suricata-3.2.1/0000755000000000000000000000000013051004531010267 500000000000000suricata-3.2.1/rules/0000755000000000000000000000000013051004504011421 500000000000000suricata-3.2.1/rules/http-events.rules0000644000000000000000000002067513051004444014713 00000000000000# HTTP event rules # # SID's fall in the 2221000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation # # These sigs fire at most once per HTTP transaction. # # A flowint http.anomaly.count is incremented for each match. By default it will be 0. # alert http any any -> any any (msg:"SURICATA HTTP unknown error"; flow:established; app-layer-event:http.unknown_error; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221000; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP gzip decompression failed"; flow:established; app-layer-event:http.gzip_decompression_failed; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221001; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP request field missing colon"; flow:established,to_server; app-layer-event:http.request_field_missing_colon; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221002; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP response field missing colon"; flow:established,to_client; app-layer-event:http.response_field_missing_colon; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221020; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid request chunk len"; flow:established,to_server; app-layer-event:http.invalid_request_chunk_len; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221003; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid response chunk len"; flow:established,to_client; app-layer-event:http.invalid_response_chunk_len; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221004; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid transfer encoding value in request"; flow:established,to_server; app-layer-event:http.invalid_transfer_encoding_value_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221005; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid transfer encoding value in response"; flow:established,to_client; app-layer-event:http.invalid_transfer_encoding_value_in_response; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221006; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid content length field in request"; flow:established,to_server; app-layer-event:http.invalid_content_length_field_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221007; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid content length field in response"; flow:established,to_client; app-layer-event:http.invalid_content_length_field_in_response; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221008; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP status 100-Continue already seen"; flow:established,to_client; app-layer-event:http.100_continue_already_seen; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221009; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP unable to match response to request"; flow:established,to_client; app-layer-event:http.unable_to_match_response_to_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221010; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid server port in request"; flow:established,to_server; app-layer-event:http.invalid_server_port_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221011; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid authority port"; flow:established; app-layer-event:http.invalid_authority_port; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221012; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP request header invalid"; flow:established,to_server; app-layer-event:http.request_header_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221013; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP response header invalid"; flow:established,to_client; app-layer-event:http.response_header_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221021; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP missing Host header"; flow:established,to_server; app-layer-event:http.missing_host_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221014; rev:1;) # Alert if hostname is both part of URL and Host header and they are not the same. alert http any any -> any any (msg:"SURICATA HTTP Host header ambiguous"; flow:established,to_server; app-layer-event:http.host_header_ambiguous; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221015; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid request field folding"; flow:established,to_server; app-layer-event:http.invalid_request_field_folding; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221016; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP invalid response field folding"; flow:established,to_client; app-layer-event:http.invalid_response_field_folding; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221017; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP request buffer too long"; flow:established,to_server; app-layer-event:http.request_field_too_long; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221018; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP response buffer too long"; flow:established,to_client; app-layer-event:http.response_field_too_long; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221019; rev:1;) # Multipart parser detected generic error. alert http any any -> any any (msg:"SURICATA HTTP multipart generic error"; flow:established,to_server; app-layer-event:http.multipart_generic_error; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221022; rev:1;) # Multipart header claiming a file to present, but no actual filedata available. alert http any any -> any any (msg:"SURICATA HTTP multipart no filedata"; flow:established,to_server; app-layer-event:http.multipart_no_filedata; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221023; rev:1;) # Multipart header invalid. alert http any any -> any any (msg:"SURICATA HTTP multipart invalid header"; flow:established,to_server; app-layer-event:http.multipart_invalid_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221024; rev:1;) # Warn when the port in the Host: header doesn't match the actual TCP Server port. alert http any any -> any any (msg:"SURICATA HTTP request server port doesn't match TCP port"; flow:established,to_server; app-layer-event:http.request_server_port_tcp_port_mismatch; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221026; rev:1;) # Host part of URI is invalid alert http any any -> any any (msg:"SURICATA HTTP Host part of URI is invalid"; flow:established,to_server; app-layer-event:http.request_uri_host_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221027; rev:1;) # Host header is invalid alert http any any -> any any (msg:"SURICATA HTTP Host header invalid"; flow:established,to_server; app-layer-event:http.request_header_host_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221028; rev:1;) # URI is terminated by non-compliant characters. RFC allows for space (0x20), but many implementations permit others like tab and more. alert http any any -> any any (msg:"SURICATA HTTP URI terminated by non-compliant character"; flow:established,to_server; app-layer-event:http.uri_delim_non_compliant; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221029; rev:1;) # Method is terminated by non-compliant characters. RFC allows for space (0x20), but many implementations permit others like tab and more. alert http any any -> any any (msg:"SURICATA HTTP METHOD terminated by non-compliant character"; flow:established,to_server; app-layer-event:http.method_delim_non_compliant; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221030; rev:1;) # Request line started with whitespace alert http any any -> any any (msg:"SURICATA HTTP Request line with leading whitespace"; flow:established,to_server; app-layer-event:http.request_line_leading_whitespace; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221031; rev:1;) # next sid 2221032 suricata-3.2.1/rules/decoder-events.rules0000644000000000000000000003651013051004444015334 00000000000000# Decoder event signatures for Suricata. # SID's fall in the 2200000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation alert pkthdr any any -> any any (msg:"SURICATA IPv4 packet too small"; decode-event:ipv4.pkt_too_small; sid:2200000; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 header size too small"; decode-event:ipv4.hlen_too_small; sid:2200001; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 total length smaller than header size"; decode-event:ipv4.iplen_smaller_than_hlen; sid:2200002; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 truncated packet"; decode-event:ipv4.trunc_pkt; sid:2200003; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 invalid option"; decode-event:ipv4.opt_invalid; sid:2200004; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 invalid option length"; decode-event:ipv4.opt_invalid_len; sid:2200005; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 malformed option"; decode-event:ipv4.opt_malformed; sid:2200006; rev:1;) #alert pkthdr any any -> any any (msg:"SURICATA IPv4 padding required "; decode-event:ipv4.opt_pad_required; sid:2200007; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 with ICMPv6 header"; decode-event:ipv4.icmpv6; sid:2200092; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 option end of list required"; decode-event:ipv4.opt_eol_required; sid:2200008; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 duplicated IP option"; decode-event:ipv4.opt_duplicate; sid:2200009; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 unknown IP option"; decode-event:ipv4.opt_unknown; sid:2200010; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 wrong IP version"; decode-event:ipv4.wrong_ip_version; sid:2200011; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 packet too small"; decode-event:ipv6.pkt_too_small; sid:2200012; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 truncated packet"; decode-event:ipv6.trunc_pkt; sid:2200013; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 truncated extension header"; decode-event:ipv6.trunc_exthdr; sid:2200014; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicated Fragment extension header"; decode-event:ipv6.exthdr_dupl_fh; sid:2200015; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 useless Fragment extension header"; decode-event:ipv6.exthdr_useless_fh; sid:2200080; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicated Routing extension header"; decode-event:ipv6.exthdr_dupl_rh; sid:2200016; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicated Hop-By-Hop Options extension header"; decode-event:ipv6.exthdr_dupl_hh; sid:2200017; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicated Destination Options extension header"; decode-event:ipv6.exthdr_dupl_dh; sid:2200018; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicated Authentication Header extension header"; decode-event:ipv6.exthdr_dupl_ah; sid:2200019; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 duplicate ESP extension header"; decode-event:ipv6.exthdr_dupl_eh; sid:2200020; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 invalid option lenght in header"; decode-event:ipv6.exthdr_invalid_optlen; sid:2200021; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6 wrong IP version"; decode-event:ipv6.wrong_ip_version; sid:2200022; rev:1;) # RFC 4302 states the reserved field should be 0. alert pkthdr any any -> any any (msg:"SURICATA IPv6 AH reserved field not 0"; decode-event:ipv6.exthdr_ah_res_not_null; sid:2200081; rev:1;) # HOP option that we don't understand alert pkthdr any any -> any any (msg:"SURICATA IPv6 HOPOPTS unknown option"; decode-event:ipv6.hopopts_unknown_opt; sid:2200086; rev:1;) # HOP header with only padding, covert channel? alert pkthdr any any -> any any (msg:"SURICATA IPv6 HOPOPTS only padding"; decode-event:ipv6.hopopts_only_padding; sid:2200087; rev:1;) # DST option that we don't understand alert pkthdr any any -> any any (msg:"SURICATA IPv6 DSTOPTS unknown option"; decode-event:ipv6.dstopts_unknown_opt; sid:2200088; rev:1;) # DST header with only padding, covert channel? alert pkthdr any any -> any any (msg:"SURICATA IPv6 DSTOPTS only padding"; decode-event:ipv6.dstopts_only_padding; sid:2200089; rev:1;) # Type 0 Routing header deprecated per RFC 5095 alert ipv6 any any -> any any (msg:"SURICATA RH Type 0"; decode-event:ipv6.rh_type_0; sid:2200093; rev:1;) # padN option with zero length field alert ipv6 any any -> any any (msg:"SURICATA zero length padN option"; decode-event:ipv6.zero_len_padn; sid:2200094; rev:1;) # Frag Header 'length' field is reserved and should be 0 alert ipv6 any any -> any any (msg:"SURICATA reserved field in Frag Header not zero"; decode-event:ipv6.fh_non_zero_reserved_field; sid:2200095; rev:1;) # Data after the 'none' header (59) is suspicious. alert ipv6 any any -> any any (msg:"SURICATA data after none (59) header"; decode-event:ipv6.data_after_none_header; sid:2200096; rev:1;) # unknown/unsupported next header / protocol. Valid protocols are not yet supported, so disabling by default #alert ipv6 any any -> any any (msg:"SURICATA unknown next header / protocol"; decode-event:ipv6.unknown_next_header; sid:2200097; rev:1;) alert ipv6 any any -> any any (msg:"SURICATA IPv6 with ICMPv4 header"; decode-event:ipv6.icmpv4; sid:2200090; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 packet too small"; decode-event:icmpv4.pkt_too_small; sid:2200023; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown type"; decode-event:icmpv4.unknown_type; sid:2200024; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown code"; decode-event:icmpv4.unknown_code; sid:2200025; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 truncated packet"; decode-event:icmpv4.ipv4_trunc_pkt; sid:2200026; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown version"; decode-event:icmpv4.ipv4_unknown_ver; sid:2200027; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 packet too small"; decode-event:icmpv6.pkt_too_small; sid:2200028; rev:1;) # uncomment the following sginature if you plan to update suricata code to support more ICMPv6 type #alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unknown type"; decode-event:icmpv6.unknown_type; sid:2200029; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unknown code"; decode-event:icmpv6.unknown_code; sid:2200030; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 truncated packet"; decode-event:icmpv6.ipv6_trunc_pkt; sid:2200031; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unknown version"; decode-event:icmpv6.ipv6_unknown_version; sid:2200032; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 MLD hop limit not 1"; decode-event:icmpv6.mld_message_with_invalid_hl; sid:2200102; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 unassigned type"; decode-event:icmpv6.unassigned_type; sid:2200108; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ICMPv6 private experimentation type"; decode-event:icmpv6.experimentation_type; sid:2200109; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA TCP packet too small"; decode-event:tcp.pkt_too_small; sid:2200033; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA TCP header length too small"; decode-event:tcp.hlen_too_small; sid:2200034; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA TCP invalid option length"; decode-event:tcp.invalid_optlen; sid:2200035; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA TCP option invalid length"; decode-event:tcp.opt_invalid_len; sid:2200036; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA TCP duplicated option"; decode-event:tcp.opt_duplicate; sid:2200037; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA UDP packet too small"; decode-event:udp.pkt_too_small; sid:2200038; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA UDP header length too small"; decode-event:udp.hlen_too_small; sid:2200039; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA UDP invalid header length"; decode-event:udp.hlen_invalid; sid:2200040; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA SLL packet too small"; decode-event:sll.pkt_too_small; sid:2200041; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA Ethernet packet too small"; decode-event:ethernet.pkt_too_small; sid:2200042; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP packet too small"; decode-event:ppp.pkt_too_small; sid:2200043; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP VJU packet too small"; decode-event:ppp.vju_pkt_too_small; sid:2200044; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP IPv4 packet too small"; decode-event:ppp.ip4_pkt_too_small; sid:2200045; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP IPv6 too small"; decode-event:ppp.ip6_pkt_too_small; sid:2200046; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP wrong type"; decode-event:ppp.wrong_type; sid:2200047; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPP unsupported protocol"; decode-event:ppp.unsup_proto; sid:2200048; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPPOE packet too small"; decode-event:pppoe.pkt_too_small; sid:2200049; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPPOE wrong code"; decode-event:pppoe.wrong_code; sid:2200050; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA PPPOE malformed tags"; decode-event:pppoe.malformed_tags; sid:2200051; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE packet too small"; decode-event:gre.pkt_too_small; sid:2200052; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE wrong version"; decode-event:gre.wrong_version; sid:2200053; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v0 recursion control"; decode-event:gre.version0_recur; sid:2200054; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v0 flags"; decode-event:gre.version0_flags; sid:2200055; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v0 header too big"; decode-event:gre.version0_hdr_too_big; sid:2200056; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 checksum present"; decode-event:gre.version1_chksum; sid:2200057; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 routing present"; decode-event:gre.version1_route; sid:2200058; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 strict source route"; decode-event:gre.version1_ssr; sid:2200059; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 recursion control"; decode-event:gre.version1_recur; sid:2200060; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 flags"; decode-event:gre.version1_flags; sid:2200061; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 no key present"; decode-event:gre.version1_no_key; sid:2200062; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 wrong protocol"; decode-event:gre.version1_wrong_protocol; sid:2200063; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 malformed Source Route Entry header"; decode-event:gre.version1_malformed_sre_hdr; sid:2200064; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA GRE v1 header too big"; decode-event:gre.version1_hdr_too_big; sid:2200065; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA VLAN header too small "; decode-event:vlan.header_too_small; sid:2200066; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA VLAN unknown type"; decode-event:vlan.unknown_type; sid:2200067; rev:1;) # more than 2 vlan layers in the packet alert pkthdr any any -> any any (msg:"SURICATA VLAN too many layers"; decode-event:vlan.too_many_layers; sid:2200091; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IP raw invalid IP version "; decode-event:ipraw.invalid_ip_version; sid:2200068; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA FRAG IPv4 Packet size too large"; decode-event:ipv4.frag_pkt_too_large; sid:2200069; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA FRAG IPv4 Fragmentation overlap"; decode-event:ipv4.frag_overlap; sid:2200070; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA FRAG IPv6 Packet size too large"; decode-event:ipv6.frag_pkt_too_large; sid:2200071; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA FRAG IPv6 Fragmentation overlap"; decode-event:ipv6.frag_overlap; sid:2200072; rev:1;) # checksum rules alert ip any any -> any any (msg:"SURICATA IPv4 invalid checksum"; ipv4-csum:invalid; sid:2200073; rev:1;) alert tcp any any -> any any (msg:"SURICATA TCPv4 invalid checksum"; tcpv4-csum:invalid; sid:2200074; rev:1;) alert udp any any -> any any (msg:"SURICATA UDPv4 invalid checksum"; udpv4-csum:invalid; sid:2200075; rev:1;) alert icmp any any -> any any (msg:"SURICATA ICMPv4 invalid checksum"; icmpv4-csum:invalid; sid:2200076; rev:1;) alert tcp any any -> any any (msg:"SURICATA TCPv6 invalid checksum"; tcpv6-csum:invalid; sid:2200077; rev:1;) alert udp any any -> any any (msg:"SURICATA UDPv6 invalid checksum"; udpv6-csum:invalid; sid:2200078; rev:1;) alert icmp any any -> any any (msg:"SURICATA ICMPv6 invalid checksum"; icmpv6-csum:invalid; sid:2200079; rev:1;) # IPv4 in IPv6 rules alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 packet too short"; decode-event:ipv6.ipv4_in_ipv6_too_small; sid:2200082; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 invalid protocol"; decode-event:ipv6.ipv4_in_ipv6_wrong_version; sid:2200083; rev:1;) # IPv6 in IPv6 rules alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 packet too short"; decode-event:ipv6.ipv6_in_ipv6_too_small; sid:2200084; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 invalid protocol"; decode-event:ipv6.ipv6_in_ipv6_wrong_version; sid:2200085; rev:1;) # MPLS rules alert pkthdr any any -> any any (msg:"SURICATA MPLS header too small"; decode-event:mpls.header_too_small; sid:2200111; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS bad router alert label"; decode-event:mpls.bad_label_router_alert; sid: 2200098; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS bad implicit null label"; decode-event:mpls.bad_label_implicit_null; sid: 2200099; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS reserved label"; decode-event:mpls.bad_label_reserved; sid: 2200100; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS unknown payload type"; decode-event:mpls.unknown_payload_type; sid: 2200101; rev:1;) # linktype null alert pkthdr any any -> any any (msg:"SURICATA NULL pkt too small"; decode-event:ltnull.pkt_too_small; sid: 2200103; rev:1;) # packet has type not supported by Suricata's decoders alert pkthdr any any -> any any (msg:"SURICATA NULL unsupported type"; decode-event:ltnull.unsupported_type; sid: 2200104; rev:1;) # ERSPAN alert pkthdr any any -> any any (msg:"SURICATA ERSPAN pkt too small"; decode-event:erspan.header_too_small; sid: 2200105; rev:1;) # packet has type not supported by Suricata's decoders alert pkthdr any any -> any any (msg:"SURICATA ERSPAN unsupported version"; decode-event:erspan.unsupported_version; sid: 2200106; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA ERSPAN too many vlan layers"; decode-event:erspan.too_many_vlan_layers; sid: 2200107; rev:1;) # Cisco Fabric Path/DCE alert pkthdr any any -> any any (msg:"SURICATA DCE packet too small"; decode-event:dce.pkt_too_small; sid:2200110; rev:1;) # next sid is 2200112 suricata-3.2.1/rules/smtp-events.rules0000644000000000000000000001151313051004444014706 00000000000000# SMTP event rules # # SID's fall in the 2220000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation # # These sigs fire at most once per connection. # # A flowint smtp.anomaly.count is incremented for each match. By default it will be 0. # alert smtp any any -> any any (msg:"SURICATA SMTP invalid reply"; flow:established,to_client; app-layer-event:smtp.invalid_reply; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220000; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP unable to match reply with request"; flow:established,to_client; app-layer-event:smtp.unable_to_match_reply_with_request; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220001; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP max command line len exceeded"; flow:established; app-layer-event:smtp.max_command_line_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220002; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP max reply line len exceeded"; flow:established,to_client; app-layer-event:smtp.max_reply_line_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220003; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP invalid pipelined sequence"; flow:established,to_server; app-layer-event:smtp.invalid_pipelined_sequence; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220004; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP bdat chunk len exceeded"; flow:established; app-layer-event:smtp.bdat_chunk_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220005; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP no server welcome message"; flow:established,to_client; app-layer-event:smtp.no_server_welcome_message; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220006; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP tls rejected"; flow:established; app-layer-event:smtp.tls_rejected; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220007; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP data command rejected"; flow:established,to_client; app-layer-event:smtp.data_command_rejected; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220008; rev:1;) # SMTP MIME events #alert smtp any any -> any any (msg:"SURICATA SMTP Mime parser failed"; flow:established; app-layer-event:smtp.mime_parse_failed; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220009; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime malformed message found"; flow:established; app-layer-event:smtp.mime_malformed_msg; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220010; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime base64-decoding failed"; flow:established; app-layer-event:smtp.mime_invalid_base64; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220011; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime header name len exceeded"; flow:established; app-layer-event:smtp.mime_long_header_name; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220012; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime header value len exceeded"; flow:established; app-layer-event:smtp.mime_long_header_value; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220013; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime quoted-printable-decoding failed"; flow:established; app-layer-event:smtp.mime_invalid_qp; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220014; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime line len exceeded"; flow:established; app-layer-event:smtp.mime_long_line; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220015; rev:1;) #alert smtp any any -> any any (msg:"SURICATA SMTP Mime encoded line len exceeded"; flow:established; app-layer-event:smtp.mime_long_enc_line; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220016; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP Mime boundary length exceeded"; flow:established,to_server; app-layer-event:smtp.mime_long_boundary; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220017; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP duplicate fields"; flow:established,to_server; app-layer-event:smtp.duplicate_fields; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220018; rev:1;) alert smtp any any -> any any (msg:"SURICATA SMTP unparsable content"; flow:established,to_server; app-layer-event:smtp.unparsable_content; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220019; rev:1;) # next sid 2220020 suricata-3.2.1/rules/tls-events.rules0000644000000000000000000001214113051004444014523 00000000000000# TLS event rules # # SID's fall in the 2230000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation # # These sigs fire at most once per connection. # # A flowint tls.anomaly.count is incremented for each match. By default it will be 0. # alert tls any any -> any any (msg:"SURICATA TLS invalid SSLv2 header"; flow:established; app-layer-event:tls.invalid_sslv2_header; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230000; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid TLS header"; flow:established; app-layer-event:tls.invalid_tls_header; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230001; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid record version"; flow:established; app-layer-event:tls.invalid_record_version; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230015; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid record type"; flow:established; app-layer-event:tls.invalid_record_type; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230002; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid handshake message"; flow:established; app-layer-event:tls.invalid_handshake_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230003; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid certificate"; flow:established; app-layer-event:tls.invalid_certificate; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230004; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS certificate missing element"; flow:established; app-layer-event:tls.certificate_missing_element; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230005; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS certificate unknown element"; flow:established; app-layer-event:tls.certificate_unknown_element; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230006; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS certificate invalid length"; flow:established; app-layer-event:tls.certificate_invalid_length; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230007; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS certificate invalid string"; flow:established; app-layer-event:tls.certificate_invalid_string; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230008; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS error message encountered"; flow:established; app-layer-event:tls.error_message_encountered; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230009; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid record/traffic"; flow:established; app-layer-event:tls.invalid_ssl_record; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230010; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS heartbeat encountered"; flow:established; app-layer-event:tls.heartbeat_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230011; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS overflow heartbeat encountered, possible exploit attempt (heartbleed)"; flow:established; app-layer-event:tls.overflow_heartbeat_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; reference:cve,2014-0160; sid:2230012; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid heartbeat encountered, possible exploit attempt (heartbleed)"; flow:established; app-layer-event:tls.invalid_heartbeat_message; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; reference:cve,2014-0160; sid:2230013; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid encrypted heartbeat encountered, possible exploit attempt (heartbleed)"; flow:established; app-layer-event:tls.dataleak_heartbeat_mismatch; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; reference:cve,2014-0160; sid:2230014; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS multiple SNI extensions"; flow:established,to_server; app-layer-event:tls.multiple_sni_extensions; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230016; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid SNI type"; flow:established,to_server; app-layer-event:tls.invalid_sni_type; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230017; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS invalid SNI length"; flow:established,to_server; app-layer-event:tls.invalid_sni_length; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230018; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS handshake invalid length"; flow:established; app-layer-event:tls.handshake_invalid_length; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230019; rev:1;) alert tls any any -> any any (msg:"SURICATA TLS too many records in packet"; flow:established; app-layer-event:tls.too_many_records_in_packet; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230020; rev:1;) #next sid is 2230021 suricata-3.2.1/rules/Makefile.am0000644000000000000000000000033113051004444013375 00000000000000EXTRA_DIST = \ decoder-events.rules \ stream-events.rules \ smtp-events.rules \ http-events.rules \ dns-events.rules \ tls-events.rules \ modbus-events.rules \ app-layer-events.rules \ files.rules \ dnp3-events.rules suricata-3.2.1/rules/app-layer-events.rules0000644000000000000000000000241713051004444015620 00000000000000# App layer event rules # # SID's fall in the 2260000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation # # These sigs fire at most once per connection. # # A flowint applayer.anomaly.count is incremented for each match. By default it will be 0. # alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260000; rev:1;) alert ip any any -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:established; app-layer-event:applayer_wrong_direction_first_data; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260001; rev:1;) alert ip any any -> any any (msg:"SURICATA Applayer Detect protocol only one direction"; flow:established; app-layer-event:applayer_detect_protocol_only_one_direction; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260002; rev:1;) alert ip any any -> any any (msg:"SURICATA Applayer Protocol detection skipped"; flow:established; app-layer-event:applayer_proto_detection_skipped; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260003; rev:1;) #next sid is 2260004 suricata-3.2.1/rules/Makefile.in0000644000000000000000000003447513051004467013433 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = rules ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = \ decoder-events.rules \ stream-events.rules \ smtp-events.rules \ http-events.rules \ dns-events.rules \ tls-events.rules \ modbus-events.rules \ app-layer-events.rules \ files.rules \ dnp3-events.rules all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu rules/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu rules/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/rules/modbus-events.rules0000644000000000000000000000334313051004444015216 00000000000000# Modbus Protocol version field is incorrect (Modbus version = 0) alert modbus any any -> any any (msg:"SURICATA Modbus invalid Protocol version"; app-layer-event:modbus.invalid_protocol_id; sid:2250001; rev:1;) # Response (answer) we didn't see a Request for. Could be packet loss. alert modbus any any -> any any (msg:"SURICATA Modbus unsolicited response"; app-layer-event:modbus.unsolicited_response; sid:2250002; rev:1;) # Malformed request or response. Malformed means length field is wrong alert modbus any any -> any any (msg:"SURICATA Modbus invalid Length"; app-layer-event:modbus.invalid_length; sid:2250003; rev:1;) # Unit identifier field is incorrect alert modbus any any -> any any (msg:"SURICATA Modbus invalid Unit Identifier"; app-layer-event:modbus.invalid_unit_identifier; sid:2250004; rev:1;) # Modbus Function code is incorrect alert modbus any any -> any any (msg:"SURICATA Modbus invalid Function code"; app-layer-event:modbus.invalid_function_code; sid:2250005; rev:1;) # Modbus Request/Response value field is incorrect alert modbus any any -> any any (msg:"SURICATA Modbus invalid Value"; app-layer-event:modbus.invalid_value; sid:2250006; rev:1;) # Modbus Expception code is incorrect alert modbus any any -> any any (msg:"SURICATA Modbus Exception code invalid"; flow:to_client; app-layer-event:modbus.invalid_exception_code; sid:2250007; rev:1;) # Value field in Modbus Response does not match with Modbus Request alert modbus any any -> any any (msg:"SURICATA Modbus Data mismatch"; flow:to_client; app-layer-event:modbus.value_mismatch; sid:2250008; rev:1;) # Request Flood Detected alert modbus any any -> any any (msg:"SURICATA Modbus Request flood detected"; flow:to_server; app-layer-event:modbus.flooded; sid:2250009; rev:1;) suricata-3.2.1/rules/dnp3-events.rules0000644000000000000000000000202613051004444014566 00000000000000# DNP3 application decoder event rules. # # This SIDs fall in the 2270000+ range. See: # http://doc.emergingthreats.net/bin/view/Main/SidAllocation # Flooded. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Request flood detected"; \ app-layer-event:dnp3.flooded; sid:2270000; rev:1;) # Length to small for PDU type. For example, link specifies the type # as user data, but the length field is not large enough for user # data. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Length too small"; \ app-layer-event:dnp3.len_too_small; sid:2270001; rev:2;) # Bad link layer CRC. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Bad link CRC"; \ app-layer-event:dnp3.bad_link_crc; sid:2270002; rev:1;) # Bad transport layer CRC. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Bad transport CRC"; \ app-layer-event:dnp3.bad_transport_crc; sid:2270003; rev:1;) # Unknown object. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Unknown object"; \ app-layer-event:dnp3.unknown_object; sid:2270004; rev:1;) suricata-3.2.1/rules/files.rules0000644000000000000000000000567413051004444013536 00000000000000# Example rules for using the file handling and extraction functionality in Suricata. # # For storing files make sure you enable the "file" output. # Also, make sure you read the comments that go with it in the suricata.yaml file. # Alert on files with jpg or bmp extensions #alert http any any -> any any (msg:"FILEEXT JPG file claimed"; fileext:"jpg"; sid:1; rev:1;) #alert http any any -> any any (msg:"FILEEXT BMP file claimed"; fileext:"bmp"; sid:3; rev:1;) # Store all files with jpg or pdf extension. #alert http any any -> any any (msg:"FILESTORE jpg"; flow:established,to_server; fileext:"jpg"; filestore; sid:6; rev:1;) #alert http any any -> any any (msg:"FILESTORE pdf"; flow:established,to_server; fileext:"pdf"; filestore; sid:8; rev:1;) # Store all PDF files, regardless of their name. #alert http any any -> any any (msg:"FILEMAGIC pdf"; flow:established,to_server; filemagic:"PDF document"; filestore; sid:9; rev:1;) # Same for JPEG's. #alert http any any -> any any (msg:"FILEMAGIC jpg(1)"; flow:established,to_server; filemagic:"JPEG image data"; filestore; sid:10; rev:1;) #alert http any any -> any any (msg:"FILEMAGIC jpg(2)"; flow:established,to_server; filemagic:"JFIF"; filestore; sid:11; rev:1;) # Unually short file #alert http any any -> any any (msg:"FILEMAGIC short"; flow:established,to_server; filemagic:"very short file (no magic)"; filestore; sid:12; rev:1;) # Simply store all files we encounter, no alerts. #alert http any any -> any any (msg:"FILE store all"; filestore; noalert; sid:15; rev:1;) # Store all JPG files, don't alert. #alert http any any -> any any (msg:"FILE magic"; filemagic:"JFIF"; filestore; noalert; sid:16; rev:1;) #alert http any any -> any any (msg:"FILE magic"; filemagic:"GIF"; filestore; noalert; sid:23; rev:1;) #alert http any any -> any any (msg:"FILE magic"; filemagic:"PNG"; filestore; noalert; sid:17; rev:1;) # Store all Windows executables #alert http any any -> any any (msg:"FILE magic -- windows"; flow:established,to_client; filemagic:"executable for MS Windows"; filestore; sid:18; rev:1;) # Alert on PNG with 1x1 pixels (tracking) #alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (1)"; filemagic:"PNG image data, 1 x 1,"; sid:19; rev:1;) #alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (2)"; filemagic:"PNG image data, 1 x 1|00|"; sid:20; rev:1;) # Alert on GIT with 1x1 pixels (tracking) # The pattern matches on |00| which is the end of the magic buffer, this way we won't match on 1 x 128. #alert http any any -> any any (msg:"FILE tracking GIF (1x1 pixel)"; filemagic:"GIF image data, version 89a, 1 x 1|00|"; sid:21; rev:1;) # Alert and store pdf attachment but not pdf file #alert http any any -> any any (msg:"FILE pdf claimed, but not pdf"; flow:established,to_client; fileext:"pdf"; filemagic:!"PDF document"; filestore; sid:22; rev:1;) # Alert and store files over SMTP #alert smtp any any -> any any (msg:"File Found over SMTP and stored"; filestore; sid:27; rev:1;) suricata-3.2.1/rules/stream-events.rules0000644000000000000000000002714713051004444015230 00000000000000# Stream events -- rules for matching on TCP stream engine events. # # SID's fall in the 2210000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation # alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake with ack in wrong dir"; stream-event:3whs_ack_in_wrong_dir; classtype:protocol-command-decode; sid:2210000; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake async wrong sequence"; stream-event:3whs_async_wrong_seq; classtype:protocol-command-decode; sid:2210001; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake right seq wrong ack evasion"; stream-event:3whs_right_seq_wrong_ack_evasion; classtype:protocol-command-decode; sid:2210002; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYNACK in wrong direction"; stream-event:3whs_synack_in_wrong_direction; classtype:protocol-command-decode; sid:2210003; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYNACK resend with different ack"; stream-event:3whs_synack_resend_with_different_ack; classtype:protocol-command-decode; sid:2210004; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYNACK resend with different seq"; stream-event:3whs_synack_resend_with_diff_seq; classtype:protocol-command-decode; sid:2210005; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYNACK to server on SYN recv"; stream-event:3whs_synack_toserver_on_syn_recv; classtype:protocol-command-decode; sid:2210006; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYNACK with wrong ack"; stream-event:3whs_synack_with_wrong_ack; classtype:protocol-command-decode; sid:2210007; rev:2;) # Excessive SYN/ACKs within a session. Limit is set in stream engine, "stream.max-synack-queued". alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake excessive different SYN/ACKs"; stream-event:3whs_synack_flood; classtype:protocol-command-decode; sid:2210055; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYN resend different seq on SYN recv"; stream-event:3whs_syn_resend_diff_seq_on_syn_recv; classtype:protocol-command-decode; sid:2210008; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake SYN to client on SYN recv"; stream-event:3whs_syn_toclient_on_syn_recv; classtype:protocol-command-decode; sid:2210009; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake wrong seq wrong ack"; stream-event:3whs_wrong_seq_wrong_ack; classtype:protocol-command-decode; sid:2210010; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 4way handshake SYNACK with wrong ACK"; stream-event:4whs_synack_with_wrong_ack; classtype:protocol-command-decode; sid:2210011; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 4way handshake SYNACK with wrong SYN"; stream-event:4whs_synack_with_wrong_syn; classtype:protocol-command-decode; sid:2210012; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 4way handshake wrong seq"; stream-event:4whs_wrong_seq; classtype:protocol-command-decode; sid:2210013; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM 4way handshake invalid ack"; stream-event:4whs_invalid_ack; classtype:protocol-command-decode; sid:2210014; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM CLOSEWAIT ACK out of window"; stream-event:closewait_ack_out_of_window; classtype:protocol-command-decode; sid:2210015; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM CLOSEWAIT FIN out of window"; stream-event:closewait_fin_out_of_window; classtype:protocol-command-decode; sid:2210016; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM CLOSEWAIT invalid ACK"; stream-event:closewait_invalid_ack; classtype:protocol-command-decode; sid:2210017; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM CLOSING ACK wrong seq"; stream-event:closing_ack_wrong_seq; classtype:protocol-command-decode; sid:2210018; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM CLOSING invalid ACK"; stream-event:closing_invalid_ack; classtype:protocol-command-decode; sid:2210019; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED packet out of window"; stream-event:est_packet_out_of_window; classtype:protocol-command-decode; sid:2210020; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYNACK resend"; stream-event:est_synack_resend; classtype:protocol-command-decode; sid:2210022; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYNACK resend with different ACK"; stream-event:est_synack_resend_with_different_ack; classtype:protocol-command-decode; sid:2210023; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYNACK resend with different seq"; stream-event:est_synack_resend_with_diff_seq; classtype:protocol-command-decode; sid:2210024; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYNACK to server"; stream-event:est_synack_toserver; classtype:protocol-command-decode; sid:2210025; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYN resend"; stream-event:est_syn_resend; classtype:protocol-command-decode; sid:2210026; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYN resend with different seq"; stream-event:est_syn_resend_diff_seq; classtype:protocol-command-decode; sid:2210027; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED SYN to client"; stream-event:est_syn_toclient; classtype:protocol-command-decode; sid:2210028; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED invalid ack"; stream-event:est_invalid_ack; classtype:protocol-command-decode; sid:2210029; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN invalid ack"; stream-event:fin_invalid_ack; classtype:protocol-command-decode; sid:2210030; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN1 ack with wrong seq"; stream-event:fin1_ack_wrong_seq; classtype:protocol-command-decode; sid:2210031; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN1 FIN with wrong seq"; stream-event:fin1_fin_wrong_seq; classtype:protocol-command-decode; sid:2210032; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN1 invalid ack"; stream-event:fin1_invalid_ack; classtype:protocol-command-decode; sid:2210033; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN2 ack with wrong seq"; stream-event:fin2_ack_wrong_seq; classtype:protocol-command-decode; sid:2210034; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN2 FIN with wrong seq"; stream-event:fin2_fin_wrong_seq; classtype:protocol-command-decode; sid:2210035; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN2 invalid ack"; stream-event:fin2_invalid_ack; classtype:protocol-command-decode; sid:2210036; rev:2;) # very common when looking at midstream traffic after IDS started #alert tcp any any -> any any (msg:"SURICATA STREAM FIN recv but no session"; stream-event:fin_but_no_session; classtype:protocol-command-decode; sid:2210037; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN out of window"; stream-event:fin_out_of_window; classtype:protocol-command-decode; sid:2210038; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM Last ACK with wrong seq"; stream-event:lastack_ack_wrong_seq; classtype:protocol-command-decode; sid:2210039; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM Last ACK invalid ACK"; stream-event:lastack_invalid_ack; classtype:protocol-command-decode; sid:2210040; rev:2;) # very common when looking at midstream traffic after IDS started #alert tcp any any -> any any (msg:"SURICATA STREAM RST recv but no session"; stream-event:rst_but_no_session; classtype:protocol-command-decode; sid:2210041; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM TIMEWAIT ACK with wrong seq"; stream-event:timewait_ack_wrong_seq; classtype:protocol-command-decode; sid:2210042; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM TIMEWAIT invalid ack"; stream-event:timewait_invalid_ack; classtype:protocol-command-decode; sid:2210043; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM Packet with invalid timestamp"; stream-event:pkt_invalid_timestamp; classtype:protocol-command-decode; sid:2210044; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM Packet with invalid ack"; stream-event:pkt_invalid_ack; classtype:protocol-command-decode; sid:2210045; rev:2;) # Broken TCP: ack field non 0, but ACK flag not set. http://ask.wireshark.org/questions/3183/acknowledgment-number-broken-tcp-the-acknowledge-field-is-nonzero-while-the-ack-flag-is-not-set # Often result of broken load balancers, firewalls and such. #alert tcp any any -> any any (msg:"SURICATA STREAM Packet with broken ack"; stream-event:pkt_broken_ack; classtype:protocol-command-decode; sid:2210051; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM SHUTDOWN RST invalid ack"; stream-event:rst_invalid_ack; classtype:protocol-command-decode; sid:2210046; rev:2;) # SYN (re)send during shutdown (closing, closewait, finwait1, finwait2, lastack, timewait states) #alert tcp any any -> any any (msg:"SURICATA STREAM SYN resend"; stream-event:shutdown_syn_resend; classtype:protocol-command-decode; sid:2210049; rev:2;) # Sequence gap: missing data in the reassembly engine. Usually due to packet loss. Will be very noisy on a overloaded link / sensor. #alert tcp any any -> any any (msg:"SURICATA STREAM reassembly sequence GAP -- missing packet(s)"; stream-event:reassembly_seq_gap; classtype:protocol-command-decode; sid:2210048; rev:2;) alert tcp any any -> any any (msg:"SURICATA STREAM reassembly overlap with different data"; stream-event:reassembly_overlap_different_data; classtype:protocol-command-decode; sid:2210050; rev:2;) # Bad Window Update: see bug 1238 for an explanation alert tcp any any -> any any (msg:"SURICATA STREAM bad window update"; stream-event:pkt_bad_window_update; classtype:protocol-command-decode; sid:2210056; rev:1;) # retransmission detection # # The rules below match on retransmissions detected in various stages of the # stream engine. They are all "noalert" rules that increment the counter # tcp.retransmission.count. The last rule sid:2210054 matches if the counter # reaches 10. Increase this number if the rule is too noisy. # # "regular" retransmissions, only count alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED retransmission packet before last ack"; stream-event:est_pkt_before_last_ack; flowint:tcp.retransmission.count,+,1; noalert; classtype:protocol-command-decode; sid:2210021; rev:3;) # retransmission, only count alert tcp any any -> any any (msg:"SURICATA STREAM CLOSEWAIT retransmission packet before last ack"; stream-event:closewait_pkt_before_last_ack; flowint:tcp.retransmission.count,+,1; noalert; classtype:protocol-command-decode; sid:2210052; rev:3;) # retransmission of pkt before reassembly window, only count alert tcp any any -> any any (msg:"SURICATA STREAM reassembly segment before base seq (retransmission)"; stream-event:reassembly_segment_before_base_seq; flowint:tcp.retransmission.count,+,1; noalert; classtype:protocol-command-decode; sid:2210047; rev:2;) # count "general" retransmissions alert tcp any any -> any any (msg:"SURICATA STREAM Packet is retransmission"; stream-event:pkt_retransmission; flowint:tcp.retransmission.count,+,1; noalert; classtype:protocol-command-decode; sid:2210053; rev:1;) # rule to alert if a stream has excessive retransmissions alert tcp any any -> any any (msg:"SURICATA STREAM excessive retransmissions"; flowbits:isnotset,tcp.retransmission.alerted; flowint:tcp.retransmission.count,>=,10; flowbits:set,tcp.retransmission.alerted; classtype:protocol-command-decode; sid:2210054; rev:1;) # next sid 2210057 suricata-3.2.1/rules/dns-events.rules0000644000000000000000000000273113051004444014511 00000000000000# Response (answer) we didn't see a Request for. Could be packet loss. alert dns any any -> any any (msg:"SURICATA DNS Unsolicited response"; flow:to_client; app-layer-event:dns.unsollicited_response; sid:2240001; rev:1;) # Malformed data in request. Malformed means length fields are wrong, etc. alert dns any any -> any any (msg:"SURICATA DNS malformed request data"; flow:to_server; app-layer-event:dns.malformed_data; sid:2240002; rev:1;) alert dns any any -> any any (msg:"SURICATA DNS malformed response data"; flow:to_client; app-layer-event:dns.malformed_data; sid:2240003; rev:1;) # Response flag set on to_server packet alert dns any any -> any any (msg:"SURICATA DNS Not a request"; flow:to_server; app-layer-event:dns.not_a_request; sid:2240004; rev:1;) # Response flag not set on to_client packet alert dns any any -> any any (msg:"SURICATA DNS Not a response"; flow:to_client; app-layer-event:dns.not_a_response; sid:2240005; rev:1;) # Z flag (reserved) not 0 alert dns any any -> any any (msg:"SURICATA DNS Z flag set"; app-layer-event:dns.z_flag_set; sid:2240006; rev:1;) # Request Flood Detected alert dns any any -> any any (msg:"SURICATA DNS request flood detected"; flow:to_server; app-layer-event:dns.flooded; sid:2240007; rev:1;) # Per-flow (state) memcap reached. Relates to the app-layer.protocols.dns.state-memcap setting. alert dns any any -> any any (msg:"SURICATA DNS flow memcap reached"; flow:to_server; app-layer-event:dns.state_memcap_reached; sid:2240008; rev:2;) suricata-3.2.1/ChangeLog0000644000000000000000000015115413051004444011773 000000000000003.2.1 -- 2017-02-15 Feature #1951: Allow building without libmagic/file Feature #1972: SURICATA ICMPv6 unknown type 143 for MLDv2 report Feature #2010: Suricata should confirm SSSE3 presence at runtime when built with Hyperscan support Bug #467: compilation with unittests & debug validation Bug #1780: VLAN tags not forwarded in afpacket inline mode Bug #1827: Mpm AC fails to alloc memory Bug #1843: Mpm Ac: int overflow during init Bug #1887: pcap-log sets snaplen to -1 Bug #1946: can't get response info in some situation Bug #1973: suricata fails to start because of unix socket Bug #1975: hostbits/xbits memory leak Bug #1982: tls: invalid record event triggers on valid traffic Bug #1984: http: protocol detection issue if both sides are malformed Bug #1985: pcap-log: minor memory leaks Bug #1987: log-pcap: pcap files created with invalid snaplen Bug #1988: tls_cert_subject bug Bug #1989: SMTP protocol detection is case sensitive Bug #1991: Suricata cannot parse ports: "![1234, 1235]" Bug #1997: tls-store: bug that cause Suricata to crash Bug #2001: Handling of unsolicited DNS responses. Bug #2003: BUG_ON body sometimes contains side-effectual code Bug #2004: Invalid file hash computation when force-hash is used Bug #2005: Incoherent sizes between request, capture and http length Bug #2007: smb: protocol detection just checks toserver Bug #2008: Suricata 3.2, pcap-log no longer works due to timestamp_pattern PCRE Bug #2009: Suricata is unable to get offloading settings when run under non-root Bug #2012: dns.log does not log unanswered queries Bug #2017: EVE Log Missing Fields Bug #2019: IPv4 defrag evasion issue Bug #2022: dns: out of bound memory read 3.2 -- 2016-12-01 Bug #1117: PCAP file count does not persist Bug #1577: luajit scripts load error Bug #1924: Windows dynamic DNS updates trigger 'DNS malformed request data' alerts Bug #1938: suricata: log handling issues Bug #1955: luajit script init failed Bug #1960: Error while parsing rule with PCRE keyword with semicolon Bug #1961: No error on missing semicolon between depth and classtype Bug #1965: dnp3/enip/cip keywords naming convention Bug #1966: af-packet fanout detection broken on Debian Jessie (master) 3.2RC1 -- 2016-11-01 Feature #1906: doc: install man page and ship pdf Feature #1916: lua: add an SCPacketTimestamp function Feature #1867: rule compatibility: flow:not_established not supported. Bug #1525: Use pkg-config for libnetfilter_queue Bug #1690: app-layer-proto negation issue Bug #1909: libhtp 0.5.23 Bug #1914: file log always shows stored: no even if file is stored Bug #1917: nfq: bypass SEGV Bug #1919: filemd5: md5-list does not allow comments any more Bug #1923: dns - back to back requests results in loss of response Bug #1928: flow bypass leads to memory errors Bug #1931: multi-tenancy fails to start Bug #1932: make install-full does not install tls-events.rules Bug #1935: Check redis reply in non pipeline mode Bug #1936: Can't set fast_pattern on tls_sni content 3.2beta1 -- 2016-10-03 Feature #509: add SHA1 and SHA256 checksum support for files Feature #1231: ssl_state negation support Feature #1345: OOBE -3- disable NIC offloading by default Feature #1373: Allow different reassembly depth for filestore rules Feature #1495: EtherNet/IP and CIP support Feature #1583: tls: validity fields (notBefore and notAfter) Feature #1657: Per application layer stats Feature #1896: Reimplement tls.subject and tls.isserdn Feature #1903: tls: tls_cert_valid and tls_cert_expired keywords Feature #1907: http_request_line and http_response_line Optimization #1044: TLS buffers evaluated by fast_pattern matcher. Optimization #1277: Trigger second live rule-reload while first one is in progress Bug #312: incorrect parsing of rules with missing semi-colon for keywords Bug #712: wildcard matches on tls.subject Bug #1353: unix-command socket created with last character missing Bug #1486: invalid rule: parser err msg not descriptive enough Bug #1525: Use pkg-config for libnetfilter_queue Bug #1893: tls: src_ip and dest_ip reversed in TLS events for IPS vs IDS mode. Bug #1898: Inspection does not always stop when stream depth is reached 3.1.2 -- 2016-09-06 Feature #1830: support 'tag' in eve log Feature #1870: make logged flow_id more unique Feature #1874: support Cisco Fabric Path / DCE Feature #1885: eve: add option to log all dropped packets Bug #1849: ICMPv6 incorrect checksum alert if Ethernet FCS is present Bug #1853: suricata is matching everything on dce_stub_data buffer Bug #1854: unified2: logging of tagged packets not working Bug #1856: PCAP mode device not found Bug #1858: Lots of TCP 'duplicated option/DNS malformed request data' after upgrading from 3.0.1 to 3.1.1 Bug #1878: dns: crash while logging sshfp records Bug #1880: icmpv4 error packets can lead to missed detection in tcp/udp Bug #1884: libhtp 0.5.22 3.1.1 -- 2016-07-13 Feature #1775: Lua: SMTP-support Bug #1419: DNS transaction handling issues Bug #1515: Problem with Threshold.config when using more than one IP Bug #1664: Unreplied DNS queries not logged when flow is aged out Bug #1808: Can't set thread priority after dropping privileges. Bug #1821: Suricata 3.1 fails to start on CentOS6 Bug #1839: suricata 3.1 configure.ac says >=libhtp-0.5.5, but >=libhtp-0.5.20 required Bug #1840: --list-keywords and --list-app-layer-protos not working Bug #1841: libhtp 0.5.21 Bug #1844: netmap: IPS mode doesn't set 2nd iface in promisc mode Bug #1845: Crash on disabling a app-layer protocol when it's logger is still enabled Optimization #1846: af-packet: improve thread calculation logic Optimization #1847: rules: don't warn on empty files 3.1 -- 2016-06-20 Bug #1589: Cannot run nfq in workers mode Bug #1804: yaml: legacy detect-engine parsing custom values broken 3.1RC1 -- 2016-06-07 Feature #681: Implement TPACKET_V3 support in AF_PACKET Feature #1134: tls: server name rule keyword Feature #1343: OOBE -1- increasing the default stream.memcap and stream.reassembly.memcap values Feature #1344: OOBE -2- decreasing the default flow-timeouts (at least for TCP) Feature #1563: dns: log sshfp records Feature #1760: Unit tests: Don't register return value, use 1 for success, 0 for failure. Feature #1761: Unit tests: Provide macros for clean test failures. Feature #1762: default to AF_PACKET for -i if available Feature #1785: hyperscan spm integration Feature #1789: hyperscan mpm: enable by default Feature #1797: netmap: implement 'threads: auto' Feature #1798: netmap: warn about NIC offloading on FreeBSD Feature #1800: update bundled libhtp to 0.5.20 Feature #1801: reduce info level verbosity Feature #1802: yaml: improve default layout Feature #1803: reimplement rule grouping Bug #1078: 'Not" operator (!) in Variable causes extremely slow loading of Suricata Bug #1202: detect-engine profile medium consumes more memory than detect-engine profile high Bug #1289: MPM b2gm matcher has questionable code Bug #1487: Configuration parser depends on key ordering Bug #1524: Potential Thread Name issues due to RHEL7 Interface Naming Contentions Bug #1584: Rule keywords conflict will cause Suricata restart itself in loop Bug #1606: [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to get MTU via ioctl: 6 Bug #1665: Default maximum packet size is insufficient when VLAN tags are present (and not stripped) Bug #1714: Kernel panic on application exit with netmap Suricata 3.0 stable Bug #1746: deadlock with autofp and --disable-detection Bug #1764: app-layer-modbus: AddressSanitizer error (segmentation fault) Bug #1768: packet processing threads doubled Bug #1771: tls store memory leak Bug #1773: smtp: not all attachments inspected in all cases Bug #1786: spm crash on rule reload Bug #1792: dns-json-log produces no output Bug #1795: Remove unused CPU affinity settings from suricata.yaml Optimization #563: pmq optimization -- remove patter_id_array Optimization #1037: Optimize TCP Option storage Optimization #1418: lockless flow handling during capture (autofp) Optimization #1784: reduce storage size of IPv4 options and IPv6 ext hdrs 3.0.1 -- 2016-04-04 Feature #1704: hyperscan mpm integration Feature #1661: Improved support for xbits/hostbits (in particular ip_pair) when running with multiple threads Bug #1697: byte_extract incompatibility with Snort. Bug #1737: Stats not reset between PCAPs when Suricata runs in socket mode 3.0.1RC1 -- 2016-03-23 Feature #1535: Expose the certificate itself in TLS-lua Feature #1696: improve logged flow_id Feature #1700: enable "relro" and "now" in compile options for 3.0 Feature #1734: gre: support transparent ethernet bridge decoding Feature #1740: Create counters for decode-events errors Bug #873: suricata.yaml: .mgc is NOT actually added to value for magic file Bug #1166: tls: CID 1197759: Resource leak (RESOURCE_LEAK) Bug #1268: suricata and macos/darwin: [ERRCODE: SC_ERR_MAGIC_LOAD(197)] - magic_load failed: File 5.19 supports only version 12 magic files. `/usr/share/file/magic.mgc' is version 7 Bug #1359: memory leak Bug #1411: Suricata generates huge load when nfq_create_queue failed Bug #1570: stream.inline defaults to IDS mode if missing Bug #1591: afpacket: unsupported datalink type 65534 on tun device Bug #1619: Per-Thread Delta Stats Broken Bug #1638: rule parsing issues: rev Bug #1641: Suricata won't build with --disable-unix-socket when libjansson is enabled Bug #1646: smtp: fix inspected tracker values Bug #1660: segv when using --set on a list Bug #1669: Suricate 3.0RC3 segfault after 10 hours Bug #1670: Modbus compiler warnings on Fedora 23 Bug #1671: Cygwin Windows compilation with libjansson from source Bug #1674: Cannot use 'tag:session' after base64_data keyword Bug #1676: gentoo build error Bug #1679: sensor-name configuration parameter specified in wrong place in default suricata.yaml Bug #1680: Output sensor name in json Bug #1684: eve: stream payload has wrong direction in IPS mode Bug #1686: Conflicting "no" for "totals" and "threads" in stats output Bug #1689: Stack overflow in case of variables misconfiguration Bug #1693: Crash on Debian with libpcre 8.35 Bug #1695: Unix Socket missing dump-counters mode Bug #1698: Segmentation Fault at detect-engine-content-inspection.c:438 (master) Bug #1699: CUDA build broken Bug #1701: memory leaks Bug #1702: TLS SNI parsing issue Bug #1703: extreme slow down in HTTP multipart parsing Bug #1706: smtp memory leaks Bug #1707: malformed json if message is too big Bug #1708: dcerpc memory leak Bug #1709: http memory leak Bug #1715: nfq: broken time stamps with recent Linux kernel 4.4 Bug #1717: Memory leak on Suricata 3.0 with Netmap Bug #1719: fileinfo output wrong in eve in http Bug #1720: flowbit memleak Bug #1724: alert-debuglog: non-decoder events won't trigger rotation. Bug #1725: smtp logging memleak Bug #1727: unix socket runmode per pcap memory leak Bug #1728: unix manager command channel memory leaks Bug #1729: PCRE jit is disabled/blacklisted when it should not Bug #1731: detect-tls memory leak Bug #1735: cppcheck: Shifting a negative value is undefined behaviour Bug #1736: tls-sni: memory leaks on malformed traffic Bug #1742: vlan use-for-tracking including Priority in hashing Bug #1743: compilation with musl c library fails Bug #1744: tls: out of bounds memory read on malformed traffic Optimization #1642: Add --disable-python option 3.0 -- 2016-01-27 Bug #1673: smtp: crash during mime parsing 3.0RC3 -- 2015-12-21 Bug #1632: Fail to download large file with browser Bug #1634: Fix non thread safeness of Prelude analyzer Bug #1640: drop log crashes Bug #1645: Race condition in unix manager Bug #1647: FlowGetKey flow-hash.c:240 segmentation fault (master) Bug #1650: DER parsing issue (master) 3.0RC2 -- 2015-12-08 Bug #1551: --enable-profiling-locks broken Bug #1602: eve-log prefix field feature broken Bug #1614: app_proto key missing from EVE file events Bug #1615: disable modbus by default Bug #1616: TCP reassembly bug Bug #1617: DNS over TCP parsing issue Bug #1618: SMTP parsing issue Feature #1635: unified2 output: disable by default 3.0RC1 -- 2015-11-25 Bug #1150: TLS store disabled by TLS EVE logging Bug #1210: global counters in stats.log Bug #1423: Unix domain log file writer should automatically reconnect if receiving program is restarted. Bug #1466: Rule reload - Rules won't reload if rule files are listed in an included file. Bug #1467: Specifying an IPv6 entry before an IPv4 entry in host-os-policy causes ASAN heap-buffer-overflow. Bug #1472: Should 'goodsigs' be 'goodtotal' when checking if signatures were loaded in detect.c? Bug #1475: app-layer-modbus: AddressSanitizer error (heap-buffer-overflow) Bug #1481: Leading whitespace in flowbits variable names Bug #1482: suricata 2.1 beta4: StoreStateTxFileOnly crashes Bug #1485: hostbits - leading and trailing spaces are treated as part of the name and direction. Bug #1488: stream_size <= and >= modifiers function as < and > (equality is not functional) Bug #1491: pf_ring is not able to capture packets when running under non-root account Bug #1493: config test (-T) doesn't fail on missing files Bug #1494: off by one on rulefile count Bug #1500: suricata.log Bug #1508: address var parsing issue Bug #1517: Order dependent, ambiguous YAML in multi-detect. Bug #1518: multitenancy - selector vlan - vlan id range Bug #1521: multitenancy - global vlan tracking relation to selector Bug #1523: Decoded base64 payload short by 16 characters Bug #1530: multitenant mapping relation Bug #1531: multitenancy - confusing tenant id and vlan id output Bug #1556: MTU setting on NIC interface not considered by af-packet Bug #1557: stream: retransmission not detected Bug #1565: defrag: evasion issue Bug #1597: dns parser issue (master) Bug #1601: tls: server name logging Feature #1116: ips packet stats in stats.log Feature #1137: Support IP lists in threshold.config Feature #1228: Suricata stats.log in JSON format Feature #1265: Replace response on Suricata dns decoder when dns error please Feature #1281: long snort ruleset support for "SC_ERR_NOT_SUPPORTED(225): content length greater than 255 unsupported" Feature #1282: support for base64_decode from snort's ruleset Feature #1342: Support Cisco erspan traffic Feature #1374: Write pre-aggregated counters for all threads Feature #1408: multi tenancy for detection Feature #1440: Load rules file from a folder or with a star pattern rather then adding them manually to suricata.yaml Feature #1454: Proposal to add Lumberjack/CEE formatting option to EVE JSON syslog output for compatibility with rsyslog parsing Feature #1492: Add HUP coverage to output json-log Feature #1498: color output Feature #1499: json output for engine messages Feature #1502: Expose tls fields to lua Feature #1514: SSH softwareversion regex should allow colon Feature #1527: Add ability to compile as a Position-Independent Executable (PIE) Feature #1568: TLS lua output support Feature #1569: SSH lua support Feature #1582: Redis output support Feature #1586: Add flow memcap counter Feature #1599: rule profiling: json output Optimization #1269: Convert SM List from linked list to array 2.1beta4 -- 2015-05-08 Bug #1314: http-events performance issues Bug #1340: null ptr dereference in Suricata v2.1beta2 (output-json.c:347) Bug #1352: file list is not cleaned up Bug #1358: Gradual memory leak using reload (kill -USR2 $pid) Bug #1366: Crash if default_packet_size is below 32 bytes Bug #1378: stats api doesn't call thread deinit funcs Bug #1384: tcp midstream window issue (master) Bug #1388: pcap-file hangs on systems w/o atomics support (master) Bug #1392: http uri parsing issue (master) Bug #1393: CentOS 5.11 build failures Bug #1398: DCERPC traffic parsing issue (master) Bug #1401: inverted matching on incomplete session Bug #1402: When re-opening files on HUP (rotation) always use the append flag. Bug #1417: no rules loaded - latest git - rev e250040 Bug #1425: dead lock in de_state vs flowints/flowvars Bug #1426: Files prematurely truncated by detection engine even though force-md5 is enabled Bug #1429: stream: last_ack update issue leading to stream gaps Bug #1435: EVE-Log alert payload option loses data Bug #1441: Local timestamps in json events Bug #1446: Unit ID check in Modbus packet error Bug #1449: smtp parsing issue Bug #1451: Fix list-keywords regressions Bug #1463: modbus parsing issue Feature #336: Add support for NETMAP to Suricata. Feature #885: smtp file_data support Feature #1394: Improve TCP reuse support Feature #1410: add alerts to EVE's drop logs Feature #1445: Suricata does not work on pfSense/FreeBSD interfaces using PPPoE Feature #1447: Ability to reject ICMP traffic Feature #1448: xbits Optimization #1014: app layer reassembly fast-path Optimization #1377: flow manager: reduce (try)locking Optimization #1403: autofp packet pool performance problems Optimization #1409: http pipeline support for stateful detection 2.1beta3 -- 2015-01-29 Bug #977: WARNING on empty rules file is fatal (should not be) Bug #1184: pfring: cppcheck warnings Bug #1321: Flow memuse bookkeeping error Bug #1327: pcre pkt/flowvar capture broken for non-relative matches (master) Bug #1332: cppcheck: ioctl Bug #1336: modbus: CID 1257762: Logically dead code (DEADCODE) Bug #1351: output-json: duplicate logging (2.1.x) Bug #1354: coredumps on quitting on OpenBSD Bug #1355: Bus error when reading pcap-file on OpenBSD Bug #1363: Suricata does not compile on OS X/Clang due to redefinition of string functions (2.1.x) Bug #1365: evasion issues (2.1.x) Feature #1261: Request for Additional Lua Capabilities Feature #1309: Lua support for Stats output Feature #1310: Modbus parsing and matching Feature #1317: Lua: Indicator for end of flow Feature #1333: unix-socket: allow (easier) non-root usage Optimization #1339: flow timeout optimization Optimization #1339: flow timeout optimization Optimization #1371: mpm optimization 2.1beta2 -- 2014-11-06 Feature #549: Extract file attachments from emails Feature #1312: Lua output support Feature #899: MPLS over Ethernet support Feature #707: ip reputation files - network range inclusion availability (cidr) Feature #383: Stream logging Feature #1263: Lua: Access to Stream Payloads Feature #1264: Lua: access to TCP quad / Flow Tuple Bug #1048: PF_RING/DNA config - suricata.yaml Bug #1230: byte_extract, within combination not working Bug #1257: Flow switch is missing from the eve-log section in suricata.yaml Bug #1259: AF_PACKET IPS is broken in 2.1beta1 Bug #1260: flow logging at shutdown broken Bug #1279: BUG: NULL pointer dereference when suricata was debug mode. Bug #1280: BUG: IPv6 address vars issue Bug #1285: Lua - http.request_line not working (2.1) Bug #1287: Lua Output has dependency on eve-log:http Bug #1288: Filestore keyword in wrong place will cause entire rule not to trigger Bug #1294: Configure doesn't use --with-libpcap-libraries when testing PF_RING library Bug #1301: suricata yaml - PF_RING load balance per hash option Bug #1308: http_header keyword not matching when SYN|ACK and ACK missing (master) Bug #1311: EVE output Unix domain socket not working (2.1) 2.1beta1 -- 2014-08-12 Feature #1155: Log packet payloads in eve alerts Feature #1208: JSON Output Enhancement - Include Payload(s) Feature #1248: flow/connection logging Feature #1258: json: include HTTP info with Alert output Optimization #1039: Packetpool should be a stack Optimization #1241: pcap recording: record per thread 2.0.3 -- 2014-08-08 Bug #1236: fix potential crash in http parsing Bug #1244: ipv6 defrag issue Bug #1238: Possible evasion in stream-tcp-reassemble.c Bug #1221: lowercase conversion table missing last value Support #1207: Cannot compile on CentOS 5 x64 with --enable-profiling 2.0.2 -- 2014-06-25 Bug #1098: http_raw_uri with relative pcre parsing issue Bug #1175: unix socket: valgrind warning Bug #1189: abort() in 2.0dev (rev 6fbb955) with pf_ring 5.6.3 Bug #1195: nflog: cppcheck reports memleaks Bug #1206: ZC pf_ring not working with Suricata 2.0.1 (or latest git) Bug #1211: defrag issue Bug #1212: core dump (after a while) when app-layer.protocols.http.enabled = yes Bug #1214: Global Thresholds (sig_id 0, gid_id 0) not applied correctly if a signature has event vars Bug #1217: Segfault in unix-manager.c line 529 when using --unix-socket and sending pcap files to be analized via socket Feature #781: IDS using NFLOG iptables target Feature #1158: Parser DNS TXT data parsing and logging Feature #1197: liblua support Feature #1200: sighup for log rotation 2.0.1 -- 2014-05-21 No changes since 2.0.1rc1 2.0.1rc1 -- 2014-05-12 Bug #978: clean up app layer parser thread local storage Bug #1064: Lack of Thread Deinitialization For Decoder Modules Bug #1101: Segmentation in AppLayerParserGetTxCnt Bug #1136: negated app-layer-protocol FP on multi-TX flows Bug #1141: dns response parsing issue Bug #1142: dns tcp toclient protocol detection Bug #1143: tls protocol detection in case of tls-alert Bug #1144: icmpv6: unknown type events for MLD_* types Bug #1145: ipv6: support PAD1 in DST/HOP extension hdr Bug #1146: tls: event on 'new session ticket' in handshake Bug #1159: Possible memory exhaustion when an invalid bpf-filter is used with AF_PACKET Bug #1160: Pcaps submitted via Unix Socket do not finish processing in Suricata 2 Bug #1161: eve: src and dst mixed up in some cases Bug #1162: proto-detect: make sure probing parsers for all registered ports are run Bug #1163: HTP Segfault Bug #1165: af_packet - one thread consistently not working Bug #1170: rohash: CID 1197756: Bad bit shift operation (BAD_SHIFT) Bug #1176: AF_PACKET IPS mode is broken in 2.0 Bug #1177: eve log do not show action 'dropped' just 'allowed' Bug #1180: Possible problem in stream tracking Feature #1157: Always create pid file if --pidfile command line option is provided. Feature #1173: tls: OpenSSL heartbleed detection 2.0 -- 2014-03-25 Bug #1151: tls.store not working when a TLS filter keyword is used 2.0rc3 -- 2014-03-18 Bug #1127: logstash & suricata parsing issue Bug #1128: Segmentation fault - live rule reload Bug #1129: pfring cluster & ring initialization Bug #1130: af-packet flow balancing problems Bug #1131: eve-log: missing user agent reported inconsistently Bug #1133: eve-log: http depends on regular http log Bug #1135: 2.0rc2 release doesn't set optimization flag on GCC Bug #1138: alert fastlog drop info missing 2.0rc2 -- 2014-03-06 Bug #611: fp: rule with ports matching on portless proto Bug #985: default config generates rule warnings and errors Bug #1021: 1.4.6: conf_filename not checked before use Bug #1089: SMTP: move depends on uninitialised value Bug #1090: FTP: Memory Leak Bug #1091: TLS-Handshake: Uninitialized value Bug #1092: HTTP: Memory Leak Bug #1108: suricata.yaml config parameter - segfault Bug #1109: PF_RING vlan handling Bug #1110: Can have the same Pattern ID (pid) for the same pattern but different case flags Bug #1111: capture stats at exit incorrect Bug #1112: tls-events.rules file missing Bug #1115: nfq: exit stats not working Bug #1120: segv with pfring/afpacket and eve-log enabled Bug #1121: crash in eve-log Bug #1124: ipfw build broken Feature #952: Add VLAN tag ID to all outputs Feature #953: Add QinQ tag ID to all outputs Feature #1012: Introduce SSH log Feature #1118: app-layer protocols http memcap - info in verbose mode (-v) Feature #1119: restore SSH protocol detection and parser 2.0rc1 -- 2014-02-13 Bug #839: http events alert multiple times Bug #954: VLAN decoder stats with AF Packet get written to the first thread only - stats.log Bug #980: memory leak in http buffers at shutdown Bug #1066: logger API's for packet based logging and tx based logging Bug #1068: format string issues with size_t + qa not catching them Bug #1072: Segmentation fault in 2.0beta2: Custom HTTP log segmentation fault Bug #1073: radix tree lookups are not thread safe Bug #1075: CUDA 5.5 doesn't compile with 2.0 beta 2 Bug #1079: Err loading rules with variables that contain negated content. Bug #1080: segfault - 2.0dev (rev 6e389a1) Bug #1081: 100% CPU utilization with suricata 2.0 beta2+ Bug #1082: af-packet vlan handling is broken Bug #1103: stats.log not incrementing decoder.ipv4/6 stats when reading in QinQ packets Bug #1104: vlan tagged fragmentation Bug #1106: Git compile fails on Ubuntu Lucid Bug #1107: flow timeout causes decoders to run on pseudo packets Feature #424: App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols Feature #542: TLS JSON output Feature #597: case insensitive fileext match Feature #772: JSON output for alerts Feature #814: QinQ tag flow support Feature #894: clean up output Feature #921: Override conf parameters Feature #1007: united output Feature #1040: Suricata should compile with -Werror Feature #1067: memcap for http inside suricata Feature #1086: dns memcap Feature #1093: stream: configurable segment pools Feature #1102: Add a decoder.QinQ stats in stats.log Feature #1105: Detect icmpv6 on ipv4 2.0beta2 -- 2013-12-18 Bug #463: Suricata not fire on http reply detect if request are not http Bug #640: app-layer-event:http.host_header_ambiguous set when it shouldn't Bug #714: some logs not created in daemon mode Bug #810: Alerts on http traffic storing the wrong packet as the IDS event payload Bug #815: address parsing with negation Bug #820: several issues found by clang 3.2 Bug #837: Af-packet statistics inconsistent under very high traffic Bug #882: MpmACCudaRegister shouldn't call PatternMatchDefaultMatcher Bug #887: http.log printing unknown hostname most of the time Bug #890: af-packet segv Bug #892: detect-engine.profile - custom - does not err out in incorrect toclient/srv values - suricata.yaml Bug #895: response: rst packet bug Bug #896: pfring dna mode issue Bug #897: make install-full fails if wget is missing Bug #903: libhtp valgrind warning Bug #907: icmp_seq and icmp_id keyword with icmpv6 traffic (master) Bug #910: make check fails w/o sudo/root privs Bug #911: HUP signal Bug #912: 1.4.3: Unit test in util-debug.c: line too long. Bug #914: Having a high number of pickup queues (216+) makes suricata crash Bug #915: 1.4.3: log-pcap.c: crash on printing a null filename Bug #917: 1.4.5: decode-ipv6.c: void function cannot return value Bug #920: Suricata failed to parse address Bug #922: trackers value in suricata.yaml Bug #925: prealloc-sessions value bigger than allowed in suricata.yaml Bug #926: prealloc host value in suricata.yaml Bug #927: detect-thread-ratio given a non numeric value in suricata.yaml Bug #928: Max number of threads Bug #932: wrong IP version - on stacked layers Bug #939: thread name buffers are sized inconsistently Bug #943: pfring: see if we can report that the module is not loaded Bug #948: apple ppc64 build broken: thread-local storage not supported for this target Bug #958: SSL parsing issue (master) Bug #963: XFF compile failure on OSX Bug #964: Modify negated content handling Bug #967: threshold rule clobbers suppress rules Bug #968: unified2 not logging tagged packets Bug #970: AC memory read error Bug #973: Use different ids for content patterns which are the same, but one of them has a fast_pattern chop set on it. Bug #976: ip_rep supplying different no of alerts for 2 different but semantically similar rules Bug #979: clean up app layer protocol detection memory Bug #982: http events missing Bug #987: default config generates error(s) Bug #988: suricata don't exit in live mode Bug #989: Segfault in HTPStateGetTxCnt after a few minutes Bug #991: threshold mem leak Bug #994: valgrind warnings in unittests Bug #995: tag keyword: tagging sessions per time is broken Bug #998: rule reload triggers app-layer-event FP's Bug #999: delayed detect inits thresholds before de_ctx Bug #1003: Segmentation fault Bug #1023: block rule reloads during delayed detect init Bug #1026: pfring: update configure to link with -lrt Bug #1031: Fix IPv6 stream pseudo packets Bug #1035: http uri/query normalization normalizes 'plus' sign to space Bug #1042: Can't match "emailAddress" field in tls.subject and tls.issuerdn Bug #1061: Multiple flowbit set in one rule Feature #234: add option disable/enable individual app layer protocol inspection modules Feature #417: ip fragmentation time out feature in yaml Feature #478: XFF (X-Forwarded-For) Feature #602: availability for http.log output - identical to apache log format Feature #622: Specify number of pf_ring/af_packet receive threads on the command line Feature #727: Explore the support for negated alprotos in sigs. Feature #746: Decoding API modification Feature #751: Add invalid packet counter Feature #752: Improve checksum detection algorithm Feature #789: Clean-up start and stop code Feature #813: VLAN flow support Feature #878: add storage api Feature #901: VLAN defrag support Feature #904: store tx id when generating an alert Feature #940: randomize http body chunks sizes Feature #944: detect nic offloading Feature #956: Implement IPv6 reject Feature #957: reject: iface setup Feature #959: Move post config initialisation code to PostConfLoadedSetup Feature #981: Update all switch case fall throughs with comments on false throughs Feature #983: Provide rule support for specifying icmpv4 and icmpv6. Feature #986: set htp request and response size limits Feature #1008: Optionally have http_uri buffer start with uri path for use in proxied environments Feature #1009: Yaml file inclusion support Feature #1032: profiling: per keyword stats Optimization #583: improve Packet_ structure layout Optimization #1018: clean up counters api Optimization #1041: remove mkinstalldirs from git 2.0beta1 -- 2013-07-18 - Luajit flow vars and flow ints support (#593) - DNS parser, logger and keyword support (#792), funded by Emerging Threats - deflate support for HTTP response bodies (#470, #775) - update to libhtp 0.5 (#775) - improved gzip support for HTTP response bodies (#470, #775) - redesigned transaction handling, improving both accuracy and performance (#753) - redesigned CUDA support (#729) - Be sure to always apply verdict to NFQ packet (#769) - stream engine: SACK allocs should adhere to memcap (#794) - stream: deal with multiple different SYN/ACK's better (#796) - stream: Randomize stream chunk size for raw stream inspection (#804) - Introduce per stream thread ssn pool (#519) - "pass" IP-only rules should bypass detection engine after matching (#718) - Generate error if bpf is used in IPS mode (#777) - Add support for batch verdicts in NFQ, thanks to Florian Westphal - Update Doxygen config, thanks to Phil Schroeder - Improve libnss detection, thanks to Christian Kreibich - Fix a FP on rules looking for port 0 and fragments (#847), thanks to Rmkml - OS X unix socket build fixed (#830) - bytetest, bytejump and byteextract negative offset failure (#827) - Fix fast.log formatting issues (#771), thanks to Rmkml - Invalidate negative depth (#774), thanks to Rmkml - Fixed accuracy issues with relative pcre matching (#791) - Fix deadlock in flowvar capture code (#802) - Improved accuracy of file_data keyword (#817) - Fix af-packet ips mode rule processing bug (#819), thanks to Laszlo Madarassy - stream: fix injecting pseudo packet too soon leading to FP (#883), thanks to Francis Trudeau 1.4.4 -- 2013-07-18 - Bug #834: Unix socket - showing as compiled when it is not desired to do so - Bug #835: Unix Socket not working as expected - Bug #841: configure --enable-unix-socket does not err out if libs/pkgs are not present - Bug #846: FP on IP frag and sig use udp port 0, thanks to Rmkml - Bug #864: backport packet action macro's - Bug #876: htp tunnel fix - Bug #877: Flowbit check with content doesn't match consistently, thanks to Francis Trudeau 1.4.3 -- 2013-06-20 - Fix missed detection in bytetest, bytejump and byteextract for negative offset (#828) - Fix IPS mode being unable to drop tunneled packets (#826) - Fix OS X Unix Socket build (#829) 1.4.2 -- 2013-05-29 - No longer force nocase to be used on http_host - Invalidate rule if uppercase content is used for http_host w/o nocase - Warn user if bpf is used in af-packet IPS mode - Better test for available libjansson version - Fixed accuracy issues with relative pcre matching (#784) - Improved accuracy of file_data keyword (#788) - Invalidate negative depth (#770) - Fix http host parsing for IPv6 addresses (#761) - Fix fast.log formatting issues (#773) - Fixed deadlock in flowvar set code for http buffers (#801) - Various signature ordering improvements - Minor stream engine fix 1.4.1 -- 2013-03-08 - GeoIP keyword, allowing matching on Maxmind's database, contributed by Ignacio Sanchez (#559) - Introduce http_host and http_raw_host keywords (#733, #743) - Add python module for interacting with unix socket (#767) - Add new unix socket commands: fetching config, counters, basic runtime info (#764, #765) - Big Napatech support update by Matt Keeler - Configurable sensor id in unified2 output, contributed by Jake Gionet (#667) - FreeBSD IPFW fixes by Nikolay Denev - Add "default" interface setting to capture configuration in yaml (#679) - Make sure "snaplen" can be set by the user (#680) - Improve HTTP URI query string normalization (#739) - Improved error reporting in MD5 loading (#693) - Improve reference.config parser error reporting (#737) - Improve build info output to include all configure options (#738) - Segfault in TLS parsing reported by Charles Smutz (#725) - Fix crash in teredo decoding, reported by Rmkml (#736) - fixed UDPv4 packets without checksum being detected as invalid (#760) - fixed DCE/SMB parsers getting confused in some fragmented cases (#764) - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#697) - FN: IP-only rule ip_proto not matching for some protocols (#689) - Fix build failure with other libhtp installs (#688) - Fix malformed yaml loading leading to a crash (#694) - Various Mac OS X fixes (#700, #701, #703) - Fix for autotools on Mac OS X by Jason Ish (#704) - Fix AF_PACKET under high load not updating stats (#706) 1.3.6 -- 2013-03-07 - fix decoder event rules not checked in all cases (#671) - checksum detection for icmpv6 was fixed (#673) - crash in HTTP server body inspection code fixed (#675) - fixed a icmpv6 payload bug (#676) - IP-only rule ip_proto not matching for some protocols was addressed (#690) - fixed malformed yaml crashing suricata (#702) - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#717) - crash in tls parser was fixed (#759) - fixed UDPv4 packets without checksum being detected as invalid (#762) - fixed DCE/SMB parsers getting confused in some fragmented cases (#763) 1.4 2012-12-13 - Decoder event matching fixed (#672) - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#665) - Add more events to IPv6 extension header anomolies (#678) - Fix ICMPv6 payload and checksum calculation (#677, #674) - Clean up flow timeout handling (#656) - Fix a shutdown bug when using AF_PACKET under high load (#653) - Fix TCP sessions being cleaned up to early (#652) 1.3.5 2012-12-06 - Flow engine memory leak fixed by Ludovico Cavedon (#651) - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#664) - Flow manager mutex used unintialized, fixed by Ludovico Cavedon (#654) - Windows building in CYGWIN fixed (#630) 1.4rc1 2012-11-29 - Interactive unix socket mode (#571, #552) - IP Reputation: loading and matching (#647) - Improved --list-keywords commandline option gives detailed info for supported keyword, including doc link (#435) - Rule analyzer improvement wrt ipv4/ipv6, invalid rules (#494) - User-Agent added to file log and filestore meta files (#629) - Endace DAG supports live stats and at exit drop stats (#638) - Add support for libhtp event "request port doesn't match tcp port" (#650) - Rules with negated addresses will not be considered IP-only (#599) - Rule reloads complete much faster in low traffic conditions (#526) - Suricata -h now displays all available options (#419) - Luajit configure time detection was improved (#636) - Flow manager mutex used w/o initialization (#628) - Cygwin work around for windows shell mangling interface string (#372) - Fix a Prelude output crash with alerts generated by rules w/o classtype or msg (#648) - CLANG compiler build fixes (#649) - Several fixes found by code analyzers 1.4beta3 2012-11-14 - support for Napatech cards was greatly improved by Matt Keeler from Npulse (#430, #619) - support for pkt_data keyword was added - user and group to run as can now be set in the config file - make HTTP request and response body inspection sizes configurable per HTTP server config (#560) - PCAP/AF_PACKET/PF_RING packet stats are now printed in stats.log (#561, #625) - add contrib directory to the dist (#567) - performance improvements to signatures with dsize option - improved rule analyzer: print fast_pattern along with the rule (#558) - fixes to stream engine reducing the number of events generated (#604) - add stream event to match on overlaps with different data in stream reassembly (#603) - stream.inline option new defaults to "auto", meaning enabled in IPS mode, disabled in IDS mode (#592) - HTTP handling in OOM condition was greatly improved (#557) - filemagic keyword performance was improved (#585) - fixes and improvements to daemon mode (#624) - fix drop rules not working correctly when thresholded (#613) - fixed a possible FP when a regular and "chopped" fast_pattern were the same (#581) - fix a false possitive condition in http_header (#607) - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#627) - fixes to rule profiling (#576) - cleanups and misc fixes (#379, #395) - updated bundled libhtp to 0.2.11 - build system improvements and cleanups - fix to SSL record parsing 1.3.4 -- 2012-11-14 - fix crash in flow and host engines in cases of low memory or low memcap settings (#617) - improve http handling in low memory conditions (#620) - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#626) - fix building on OpenBSD 5.2 - update default config's defrag settings to reflect all available options - fixes to make check - fix to SSL record parsing 1.3.3 -- 2012-11-01 - fix drop rules not working correctly when thresholded (#615) - fix a false possitive condition in http_header (#606) - fix extracted file corruption (#601) - fix a false possitive condition with the pcre keyword and relative matching (#588) - fix PF_RING set cluster problem on dma interfaces (#598) - improve http handling in low memory conditions (#586, #587) - fix FreeBSD inline mode crash (#612) - suppress pcre jit warning (#579) 1.4beta2 -- 2012-10-04 - New keyword: "luajit" to inspect packet, payload and all HTTP buffers with a Lua script (#346) - Added ability to control per server HTTP parser settings in much more detail (#503) - Rewrite of IP Defrag engine to improve performance and fix locking logic (#512, #540) - Big performance improvement in inspecting decoder, stream and app layer events (#555) - Pool performance improvements (#541) - Improved performance of signatures with simple pattern setups (#577) - Bundled docs are installed upon make install (#527) - Support for a number of global vs rule thresholds [3] was added (#425) - Improved rule profiling performance - If not explicit fast_pattern is set, pick HTTP patterns over stream patterns. HTTP method, stat code and stat msg are excluded. - Fix compilation on architectures other than x86 and x86_64 (#572) - Fix FP with anchored pcre combined with relative matching (#529) - Fix engine hanging instead of exitting if the pcap device doesn't exist (#533) - Work around for potential FP, will get properly fixed in next release (#574) - Improve ERF handling. Thanks to Jason Ish - Always set cluster_id in PF_RING - IPFW: fix broken broadcast handling - AF_PACKET kernel offset issue, IPS fix and cleanup - Fix stream engine sometimes resending the same data to app layer - Fix multiple issues in HTTP multipart parsing - Fixed a lockup at shutdown with NFQ (#537) 1.3.2 -- 2012-10-03 - Fixed a possible FP when a regular and "chopped" fast_pattern were the same (#562) - Fixed a FN condition with the flow:no_stream option (#575) - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) - Fix multiple issues in HTTP multipart parsing - Fix stream engine sometimes resending the same data to app layer - Always set cluster_id in PF_RING - Defrag: silence some potentially noisy errors/warnings - IPFW: fix broken broadcast handling - AF_PACKET kernel offset issue 1.4beta1 -- 2012-09-06 - Custom HTTP logging contributed by Ignacio Sanchez (#530) - TLS certificate logging and fingerprint computation and keyword (#443) - TLS certificate store to disk feature (#444) - Decoding of IPv4-in-IPv6, IPv6-in-IPv6 and Teredo tunnels (#462, #514, #480) - AF_PACKET IPS support (#516) - Rules can be set to inspect only IPv4 or IPv6 (#494) - filesize keyword for matching on sizes of files in HTTP (#489) - Delayed detect initialization. Starts processing packets right away and loads detection engine in the background (#522) - NFQ fail open support (#507) - Highly experimental lua scripting support for detection - Live reloads now supports HTTP rule updates better (#522) - AF_PACKET performance improvements (#197, #415) - Make defrag more configurable (#517, #528) - Improve pool performance (#518) - Improve file inspection keywords by adding a separate API (#531) - Example threshold.config file provided (#302) - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) - Various spelling corrections by Simon Moon (#533) 1.3.1 -- 2012-08-21 - AF_PACKET performance improvements - Defrag engine performance improvements - HTTP: add per server options to enable/disable double decoding of URI (#464, #504) - Stream engine packet handling for packets with non-standard flag combinations (#508) - Improved stream engine handling of packet loss (#523) - Stream engine checksum alerting fixed - Various rule analyzer fixes (#495, #496, #497) - (Rule) profiling fixed and improved (#460, #466) - Enforce limit on max-pending-packets (#510) - fast_pattern on negated content improved - TLS rule keyword parsing issues - Windows build fixes (#502) - Host OS parsing issues fixed (#499) - Reject signatures where content length is bigger than "depth" setting (#505) - Removed unused "prune-flows" option - Set main thread and live reload thread names (#498) 1.3 -- 2012-07-06 - make live rule reloads optional and disabled by default - fix a shutdown bug - fix several memory leaks (#492) - warn user if global and rule thresholding conflict (#455) - set thread names on FreeBSD (Nikolay Denev) - Fix PF_RING building on Ubuntu 12.04 - rule analyzer updates - file inspection improvements when dealing with limits (#493) 1.3rc1 -- 2012-06-29 - experimental live rule reload by sending a USR2 signal (#279) - AF_PACKET BPF support (#449) - AF_PACKET live packet loss counters (#441) - Rule analyzer (#349) - add pcap workers runmode for use with libpcap wrappers that support load balancing, such as Napatech's or Myricom's - negated filemd5 matching, allowing for md5 whitelisting - signatures with depth and/or offset are now checked against packets in addition to the stream (#404) - http_cookie keyword now also inspects "Set-Cookie" header (#479) - filemd5 keyword no longer depends on log-file output module (#447) - http_raw_header keyword inspects original header line terminators (#475) - deal with double encoded URI (#464) - improved SMB/SMB2/DCERPC robustness - ICMPv6 parsing fixes - improve HTTP body inspection - stream.inline accuracy issues fixed (#339) - general stability fixes (#482, #486) - missing unittests added (#471) - "threshold.conf not found" error made more clear (#446) - IPS mode segment logging for Unified2 improved 1.3beta2 -- 2012-06-08 - experimental support for matching on large lists of known file MD5 checksums - Improved performance for file_data, http_server_body and http_client_body keywords - Improvements to HTTP handling: multipart parsing, gzip decompression - Byte_extract can support negative offsets now (#445) - Support for PF_RING 5.4 added. Many thanks to Chris Wakelin (#459) - HOME_NET and EXTERNAL_NET and the other vars are now checked for common errors (#454) - Improved error reporting when using too long address strings (#451) - MD5 calculation improvements for daemon mode and other cases (#449) - File inspection scripts: Added Syslog action for logging to local syslog. Thanks to Martin Holste. - Rule parser is made more strict. - Unified2 output overhaul, logging individual segments in more cases. - detection_filter keyword accuracy problem was fixed (#453) - Don't inspect cookie header with http header (#461) - Crash with a rule with two byte_extract keywords (#456) - SSL parser fixes. Thanks to Chris Wakelin for testing the patches! (#476) - Accuracy issues in HTTP inspection fixed. Thanks to Rmkml (#452) - Improve escaping of some characters in logs (#418) - Checksum calculation bugs fixed - IPv6 parsing issues fixed. Thanks to Michel Saborde. - Endace DAG issues fixed. Thanks to Jason Ish from Endace. - Various OpenBSD related fixes. - Fixes for bugs found by Coverity source code analyzer. 1.3beta1 -- 2012-04-04 - TLS/SSL handshake parser, tls.subjectdn and tls.issuerdn keywords (#296, contributed by Pierre Chifflier) - Napatech capture card support (contributed by Randy Caldejon -- nPulse) - Scripts for looking up files / file md5's at Virus Total and others (contributed by Martin Holste) - Test mode: -T option to test the config (#271) - Ringbuffer and zero copy support for AF_PACKET - Commandline options to list supported app layer protocols and keywords (#344, #414) - File extraction for HTTP POST request that do not use multipart bodies - On the fly md5 checksum calculation of extracted files - Line based file log, in json format - Basic support for including other yaml files into the main yaml - New multi pattern engine: ac-bs - Profiling improvements, added lock profiling code - Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys) - Unified yaml naming convention, including fallback support (by Nikolay Denev) - Improved Endace DAG support (#431, Jason Ish -- Endace) - New default runmode: "autofp" (#433) - Major rewrite of flow engine, improving scalability. - Improved http_stat_msg and http_stat_code keywords (#394) - Improved scalability for Tag and Threshold subsystems - Made the rule keyword parser much stricter in detecting syntax errors - Split "file" output into "file-store" and "file-log" outputs - Much improved file extraction - CUDA build fixes (#421) - Various FP's reported by Rmkml (#403, #405, #411) - IPv6 decoding and detection issues (reported by Michel Sarborde) - PCAP logging crash (#422) - Fixed many (potential) issues with the help of the Coverity source code analyzer - Fixed several (potential) issues with the help of the cppcheck and clang/scan-build source code analyzers 1.2.1 -- 2012-01-20 - fix malformed unified2 records when writing alerts trigger by stream inspection (#402) - only force a pseudo packet inspection cycle for TCP streams in a state >= established 1.2 -- 2012-01-19 - improved Windows/CYGWIN path handling (#387) - fixed some issues with passing an interface or ip address with -i - make live worker runmode threads adhere to the 'detect' cpu affinity settings 1.2rc1 -- 2012-01-11 - app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events - auto detection of checksum offloading per interface (#311) - urilen options to match on raw or normalized URI (#341) - flow keyword option "only_stream" and "no_stream" - unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250) - in IPS mode, reject rules now also drop (#399) - http_header now also inspects response headers (#389) - "worker" runmodes for NFQ and IPFW - performance improvement for "ac" pattern matcher - allow empty/non-initialized flowints to be incremented - PCRE-JIT is now enabled by default if available (#356) - many file inspection and extraction improvements - flowbits and flowints are now modified in a post-match action list - general performance increasements - fixed parsing really high sid numbers >2 Billion (#393) - fixed ICMPv6 not matching in IP-only sigs (#363) 1.2beta1 -- 2011-12-19 - File name, type inspection and extraction for HTTP - filename, fileext, filemagic and filestore keywords added - "file" output for storing extracted files to disk - file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241 - new keyword http_server_body, pcre regex /S option - Option to enable/disable core dumping from the suricata.yaml (enabled by default) - Human readable size limit settings in suricata.yaml - PF_RING bpf support (required PF_RING >= 5.1) (feature #334) - tos keyword support (feature #364) - IPFW IPS mode does now support multiple divert sockets - New IPS running modes, Linux and FreeBSD do now support "worker" and "autofp" - Improved alert accuracy in autofp and single runmodes - major performance optimizations for the ac-gfbs pattern matcher implementation - unified2 output fixes - PF_RING supports privilege dropping now (bug #367) - Improved detection of duplicate signatures 1.1.1 -- 2011-12-07 - Fix for a error in the smtp parser that could crash Suricata. - Fix for AF_PACKET not compiling on modern linux systems like Fedora 16. 1.1 -- 2011-11-10 - CUDA build fixed - minor pcap, AF_PACKET and PF_RING fixes (#368) - bpf handling fix - Windows CYGWIN build - more cleanups 1.1rc1 -- 2011-11-03 - extended HTTP request logging for use with (among other things) http_agent for Sguil (#38) - AF_PACKET report drop stats on shutdown (#325) - new counters in stats.log for flow and stream engines (#348) - SMTP parsing code support for BDAT command (#347) - HTTP URI normalization no longer converts to lowercase (#362) - AF_PACKET works with privileges dropping now (#361) - Prelude output for state matches (#264, #355) - update of the pattern matching code that should improve accuracy - rule parser was made more strict (#295, #312) - multiple event suppressions for the same SID was fixed (#366) - several accuracy fixes - removal of the unified1 output plugins (#353) 1.1beta3 -- 2011-10-25 - af-packet support for high speed packet capture - "replace" keyword support (#303) - new "workers" runmode for multi-dev and/or clustered PF_RING, AF_PACKET, pcap - added "stream-event" keyword to match on TCP session anomalies - support for suppress keyword was added (#274) - byte_extract keyword support was added - improved handling of timed out TCP sessions in the detection engine - unified2 payload logging if detection was in the HTTP state (#264) - improved accuracy of the HTTP transaction logging - support for larger (64 bit) Flow/Stream memcaps (#332) - major speed improvements for PCRE, including support for PCRE JIT - support setting flowbits in ip-only rules (#292) - performance increases on SSE3+ CPU's - overhaul of the packet acquisition subsystem - packet based performance profiling subsystem was added - TCP SACK support was added to the stream engine - updated included libhtp to 0.2.6 which fixes several issues 1.1beta2 -- 2011-04-13 - New keyword support: http_raw_uri (including /I for pcre), ssl_state, ssl_version (#258, #259, #260, #262). - Inline mode for the stream engine (#230, #248). - New keyword support: nfq_set_mark - Included an example decoder-events.rules file - api for adding and selecting runmodes was added - pcap logging / recording output was added - basic SCTP protocol parsing was added - more fine grained CPU affinity setting support was added - stream engine inspects stream in larger chunks - fast_pattern support for http_method content modifier (#255) - negation support for isdataat keyword (#257) - configurable interval for stats.log updates (#247) - new pf_ring runmode was added that scales better - pcap live mode now handles the monitor interface going up and down - several QA additions to "make check" - NFQ (linux inline) mode was improved - Alerts classification fix (#275) - compiles and runs on big-endian systems (#63) - unified2 output works around barnyard2 issues with DLT_RAW + IPv6 1.1beta1 -- 2010-12-21 - New keyword support: http_raw_header, http_stat_msg, http_stat_code. - A new default pattern matcher, Aho-Corasick based, that uses much less memory. - reference.config support as supplied by ET/ETpro and VRT. - Much improved fast_pattern support, including for http_uri, http_client_body, http_header, http_raw_header. - Improved parsers, especially the DCERPC parser. - Much improved performance & accuracy. 1.0.5 -- 2011-07-25 - Fix stream reassembly bug #300. Thanks to Rmkml for the report. - Fix several (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. 1.0.4 -- 2011-06-24 - LibHTP updated to 0.2.6 - Large number of (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. - Large number of (potential) issues fixed after source code scans with the Clang static analizer. 1.0.3 -- 2011-04-13 - Fix broken checksum calculation for TCP/UDP in some cases - Fix errors in the byte_test, byte_jump, http_method and http_header keywords - Fix a ASN1 parsing issue - Improve LibHTP memory handling - Fix a defrag issue - Fix several stream engine issues suricata-3.2.1/missing0000755000000000000000000001533013051004467011620 00000000000000#! /bin/sh # Common wrapper for a few potentially missing GNU programs. scriptversion=2013-10-28.13; # UTC # Copyright (C) 1996-2014 Free Software Foundation, Inc. # Originally written by Fran,cois Pinard , 1996. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. if test $# -eq 0; then echo 1>&2 "Try '$0 --help' for more information" exit 1 fi case $1 in --is-lightweight) # Used by our autoconf macros to check whether the available missing # script is modern enough. exit 0 ;; --run) # Back-compat with the calling convention used by older automake. shift ;; -h|--h|--he|--hel|--help) echo "\ $0 [OPTION]... PROGRAM [ARGUMENT]... Run 'PROGRAM [ARGUMENT]...', returning a proper advice when this fails due to PROGRAM being missing or too old. Options: -h, --help display this help and exit -v, --version output version information and exit Supported PROGRAM values: aclocal autoconf autoheader autom4te automake makeinfo bison yacc flex lex help2man Version suffixes to PROGRAM as well as the prefixes 'gnu-', 'gnu', and 'g' are ignored when checking the name. Send bug reports to ." exit $? ;; -v|--v|--ve|--ver|--vers|--versi|--versio|--version) echo "missing $scriptversion (GNU Automake)" exit $? ;; -*) echo 1>&2 "$0: unknown '$1' option" echo 1>&2 "Try '$0 --help' for more information" exit 1 ;; esac # Run the given program, remember its exit status. "$@"; st=$? # If it succeeded, we are done. test $st -eq 0 && exit 0 # Also exit now if we it failed (or wasn't found), and '--version' was # passed; such an option is passed most likely to detect whether the # program is present and works. case $2 in --version|--help) exit $st;; esac # Exit code 63 means version mismatch. This often happens when the user # tries to use an ancient version of a tool on a file that requires a # minimum version. if test $st -eq 63; then msg="probably too old" elif test $st -eq 127; then # Program was missing. msg="missing on your system" else # Program was found and executed, but failed. Give up. exit $st fi perl_URL=http://www.perl.org/ flex_URL=http://flex.sourceforge.net/ gnu_software_URL=http://www.gnu.org/software program_details () { case $1 in aclocal|automake) echo "The '$1' program is part of the GNU Automake package:" echo "<$gnu_software_URL/automake>" echo "It also requires GNU Autoconf, GNU m4 and Perl in order to run:" echo "<$gnu_software_URL/autoconf>" echo "<$gnu_software_URL/m4/>" echo "<$perl_URL>" ;; autoconf|autom4te|autoheader) echo "The '$1' program is part of the GNU Autoconf package:" echo "<$gnu_software_URL/autoconf/>" echo "It also requires GNU m4 and Perl in order to run:" echo "<$gnu_software_URL/m4/>" echo "<$perl_URL>" ;; esac } give_advice () { # Normalize program name to check for. normalized_program=`echo "$1" | sed ' s/^gnu-//; t s/^gnu//; t s/^g//; t'` printf '%s\n' "'$1' is $msg." configure_deps="'configure.ac' or m4 files included by 'configure.ac'" case $normalized_program in autoconf*) echo "You should only need it if you modified 'configure.ac'," echo "or m4 files included by it." program_details 'autoconf' ;; autoheader*) echo "You should only need it if you modified 'acconfig.h' or" echo "$configure_deps." program_details 'autoheader' ;; automake*) echo "You should only need it if you modified 'Makefile.am' or" echo "$configure_deps." program_details 'automake' ;; aclocal*) echo "You should only need it if you modified 'acinclude.m4' or" echo "$configure_deps." program_details 'aclocal' ;; autom4te*) echo "You might have modified some maintainer files that require" echo "the 'autom4te' program to be rebuilt." program_details 'autom4te' ;; bison*|yacc*) echo "You should only need it if you modified a '.y' file." echo "You may want to install the GNU Bison package:" echo "<$gnu_software_URL/bison/>" ;; lex*|flex*) echo "You should only need it if you modified a '.l' file." echo "You may want to install the Fast Lexical Analyzer package:" echo "<$flex_URL>" ;; help2man*) echo "You should only need it if you modified a dependency" \ "of a man page." echo "You may want to install the GNU Help2man package:" echo "<$gnu_software_URL/help2man/>" ;; makeinfo*) echo "You should only need it if you modified a '.texi' file, or" echo "any other file indirectly affecting the aspect of the manual." echo "You might want to install the Texinfo package:" echo "<$gnu_software_URL/texinfo/>" echo "The spurious makeinfo call might also be the consequence of" echo "using a buggy 'make' (AIX, DU, IRIX), in which case you might" echo "want to install GNU make:" echo "<$gnu_software_URL/make/>" ;; *) echo "You might have modified some files without having the proper" echo "tools for further handling them. Check the 'README' file, it" echo "often tells you about the needed prerequisites for installing" echo "this package. You may also peek at any GNU archive site, in" echo "case some other package contains this missing '$1' program." ;; esac } give_advice "$1" | sed -e '1s/^/WARNING: /' \ -e '2,$s/^/ /' >&2 # Propagate the correct exit status (expected to be 127 for a program # not found, 63 for a program that failed due to version mismatch). exit $st # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/threshold.config0000644000000000000000000000316313051004444013400 00000000000000# Thresholding: # # This feature is used to reduce the number of logged alerts for noisy rules. # Thresholding commands limit the number of times a particular event is logged # during a specified time interval. # # The syntax is the following: # # threshold gen_id , sig_id , type , track , count , seconds # # event_filter gen_id , sig_id , type , track , count , seconds # # suppress gen_id , sig_id # suppress gen_id , sig_id , track , ip # # The options are documented at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds # # Please note that thresholding can also be set inside a signature. The interaction between rule based thresholds # and global thresholds is documented here: # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds#Global-thresholds-vs-rule-thresholds # Limit to 10 alerts every 10 seconds for each source host #threshold gen_id 0, sig_id 0, type threshold, track by_src, count 10, seconds 10 # Limit to 1 alert every 10 seconds for signature with sid 2404000 #threshold gen_id 1, sig_id 2404000, type threshold, track by_dst, count 1, seconds 10 # Avoid to alert on f-secure update # Example taken from http://blog.inliniac.net/2012/03/07/f-secure-av-updates-and-suricata-ips/ #suppress gen_id 1, sig_id 2009557, track by_src, ip 217.110.97.128/25 #suppress gen_id 1, sig_id 2012086, track by_src, ip 217.110.97.128/25 #suppress gen_id 1, sig_id 2003614, track by_src, ip 217.110.97.128/25 suricata-3.2.1/config.guess0000755000000000000000000012475313051004467012553 00000000000000#! /bin/sh # Attempt to guess a canonical system name. # Copyright 1992-2015 Free Software Foundation, Inc. timestamp='2015-08-20' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # # Originally written by Per Bothner; maintained since 2000 by Ben Elliston. # # You can get the latest version of this script from: # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD # # Please send patches to . me=`echo "$0" | sed -e 's,.*/,,'` usage="\ Usage: $0 [OPTION] Output the configuration name of the system \`$me' is run on. Operation modes: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. Copyright 1992-2015 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" >&2 exit 1 ;; * ) break ;; esac done if test $# != 0; then echo "$me: too many arguments$help" >&2 exit 1 fi trap 'exit 1' 1 2 15 # CC_FOR_BUILD -- compiler used by this script. Note that the use of a # compiler to aid in system detection is discouraged as it requires # temporary files to be created and, as you can see below, it is a # headache to deal with in a portable fashion. # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still # use `HOST_CC' if defined, but it is deprecated. # Portable tmp directory creation inspired by the Autoconf team. set_cc_for_build=' trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ; trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ; : ${TMPDIR=/tmp} ; { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } || { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } || { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } || { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ; dummy=$tmp/dummy ; tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ; case $CC_FOR_BUILD,$HOST_CC,$CC in ,,) echo "int x;" > $dummy.c ; for c in cc gcc c89 c99 ; do if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then CC_FOR_BUILD="$c"; break ; fi ; done ; if test x"$CC_FOR_BUILD" = x ; then CC_FOR_BUILD=no_compiler_found ; fi ;; ,,*) CC_FOR_BUILD=$CC ;; ,*,*) CC_FOR_BUILD=$HOST_CC ;; esac ; set_cc_for_build= ;' # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 1994-08-24) if (test -f /.attbin/uname) >/dev/null 2>&1 ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown case "${UNAME_SYSTEM}" in Linux|GNU|GNU/*) # If the system lacks a compiler, then just pick glibc. # We could probably try harder. LIBC=gnu eval $set_cc_for_build cat <<-EOF > $dummy.c #include #if defined(__UCLIBC__) LIBC=uclibc #elif defined(__dietlibc__) LIBC=dietlibc #else LIBC=gnu #endif EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` ;; esac # Note: order is significant - the case branches are not exclusive. case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, # *-*-netbsdecoff* and *-*-netbsd*. For targets that recently # switched to ELF, *-*-netbsd* would select the old # object file format. This provides both forward # compatibility and a consistent mechanism for selecting the # object file format. # # Note: NetBSD doesn't particularly care about the vendor # portion of the name. We always set it to "unknown". sysctl="sysctl -n hw.machine_arch" UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \ /sbin/$sysctl 2>/dev/null || \ /usr/sbin/$sysctl 2>/dev/null || \ echo unknown)` case "${UNAME_MACHINE_ARCH}" in armeb) machine=armeb-unknown ;; arm*) machine=arm-unknown ;; sh3el) machine=shl-unknown ;; sh3eb) machine=sh-unknown ;; sh5el) machine=sh5le-unknown ;; earmv*) arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'` endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'` machine=${arch}${endian}-unknown ;; *) machine=${UNAME_MACHINE_ARCH}-unknown ;; esac # The Operating System including object format, if it has switched # to ELF recently, or will in the future. case "${UNAME_MACHINE_ARCH}" in arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax) eval $set_cc_for_build if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ELF__ then # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout). # Return netbsd for either. FIX? os=netbsd else os=netbsdelf fi ;; *) os=netbsd ;; esac # Determine ABI tags. case "${UNAME_MACHINE_ARCH}" in earm*) expr='s/^earmv[0-9]/-eabi/;s/eb$//' abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"` ;; esac # The OS release # Debian GNU/NetBSD machines have a different userland, and # thus, need a distinct triplet. However, they do not need # kernel version information, so it can be replaced with a # suitable tag, in the style of linux-gnu. case "${UNAME_VERSION}" in Debian*) release='-gnu' ;; *) release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2` ;; esac # Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM: # contains redundant information, the shorter form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used. echo "${machine}-${os}${release}${abi}" exit ;; *:Bitrig:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'` echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE} exit ;; *:OpenBSD:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'` echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE} exit ;; *:ekkoBSD:*:*) echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE} exit ;; *:SolidBSD:*:*) echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE} exit ;; macppc:MirBSD:*:*) echo powerpc-unknown-mirbsd${UNAME_RELEASE} exit ;; *:MirBSD:*:*) echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE} exit ;; *:Sortix:*:*) echo ${UNAME_MACHINE}-unknown-sortix exit ;; alpha:OSF1:*:*) case $UNAME_RELEASE in *4.0) UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'` ;; *5.*) UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'` ;; esac # According to Compaq, /usr/sbin/psrinfo has been available on # OSF/1 and Tru64 systems produced since 1995. I hope that # covers most systems running today. This code pipes the CPU # types through head -n 1, so we only detect the type of CPU 0. ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1` case "$ALPHA_CPU_TYPE" in "EV4 (21064)") UNAME_MACHINE="alpha" ;; "EV4.5 (21064)") UNAME_MACHINE="alpha" ;; "LCA4 (21066/21068)") UNAME_MACHINE="alpha" ;; "EV5 (21164)") UNAME_MACHINE="alphaev5" ;; "EV5.6 (21164A)") UNAME_MACHINE="alphaev56" ;; "EV5.6 (21164PC)") UNAME_MACHINE="alphapca56" ;; "EV5.7 (21164PC)") UNAME_MACHINE="alphapca57" ;; "EV6 (21264)") UNAME_MACHINE="alphaev6" ;; "EV6.7 (21264A)") UNAME_MACHINE="alphaev67" ;; "EV6.8CB (21264C)") UNAME_MACHINE="alphaev68" ;; "EV6.8AL (21264B)") UNAME_MACHINE="alphaev68" ;; "EV6.8CX (21264D)") UNAME_MACHINE="alphaev68" ;; "EV6.9A (21264/EV69A)") UNAME_MACHINE="alphaev69" ;; "EV7 (21364)") UNAME_MACHINE="alphaev7" ;; "EV7.9 (21364A)") UNAME_MACHINE="alphaev79" ;; esac # A Pn.n version is a patched version. # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` # Reset EXIT trap before exiting to avoid spurious non-zero exit code. exitcode=$? trap '' 0 exit $exitcode ;; Alpha\ *:Windows_NT*:*) # How do we know it's Interix rather than the generic POSIX subsystem? # Should we change UNAME_MACHINE based on the output of uname instead # of the specific Alpha model? echo alpha-pc-interix exit ;; 21064:Windows_NT:50:3) echo alpha-dec-winnt3.5 exit ;; Amiga*:UNIX_System_V:4.0:*) echo m68k-unknown-sysv4 exit ;; *:[Aa]miga[Oo][Ss]:*:*) echo ${UNAME_MACHINE}-unknown-amigaos exit ;; *:[Mm]orph[Oo][Ss]:*:*) echo ${UNAME_MACHINE}-unknown-morphos exit ;; *:OS/390:*:*) echo i370-ibm-openedition exit ;; *:z/VM:*:*) echo s390-ibm-zvmoe exit ;; *:OS400:*:*) echo powerpc-ibm-os400 exit ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) echo arm-acorn-riscix${UNAME_RELEASE} exit ;; arm*:riscos:*:*|arm*:RISCOS:*:*) echo arm-unknown-riscos exit ;; SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*) echo hppa1.1-hitachi-hiuxmpp exit ;; Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. if test "`(/bin/universe) 2>/dev/null`" = att ; then echo pyramid-pyramid-sysv3 else echo pyramid-pyramid-bsd fi exit ;; NILE*:*:*:dcosx) echo pyramid-pyramid-svr4 exit ;; DRS?6000:unix:4.0:6*) echo sparc-icl-nx6 exit ;; DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*) case `/usr/bin/uname -p` in sparc) echo sparc-icl-nx7; exit ;; esac ;; s390x:SunOS:*:*) echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4H:SunOS:5.*:*) echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*) echo i386-pc-auroraux${UNAME_RELEASE} exit ;; i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*) eval $set_cc_for_build SUN_ARCH="i386" # If there is a compiler, see if it is configured for 64-bit objects. # Note that the Sun cc does not turn __LP64__ into 1 like gcc does. # This test works for both compilers. if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then SUN_ARCH="x86_64" fi fi echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:*:*) case "`/usr/bin/arch -k`" in Series*|S4*) UNAME_RELEASE=`uname -v` ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'` exit ;; sun3*:SunOS:*:*) echo m68k-sun-sunos${UNAME_RELEASE} exit ;; sun*:*:4.2BSD:*) UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null` test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3 case "`/bin/arch`" in sun3) echo m68k-sun-sunos${UNAME_RELEASE} ;; sun4) echo sparc-sun-sunos${UNAME_RELEASE} ;; esac exit ;; aushp:SunOS:*:*) echo sparc-auspex-sunos${UNAME_RELEASE} exit ;; # The situation for MiNT is a little confusing. The machine name # can be virtually everything (everything which is not # "atarist" or "atariste" at least should have a processor # > m68000). The system name ranges from "MiNT" over "FreeMiNT" # to the lowercase version "mint" (or "freemint"). Finally # the system name "TOS" denotes a system which is actually not # MiNT. But MiNT is downward compatible to TOS, so this should # be no problem. atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*) echo m68k-milan-mint${UNAME_RELEASE} exit ;; hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*) echo m68k-hades-mint${UNAME_RELEASE} exit ;; *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*) echo m68k-unknown-mint${UNAME_RELEASE} exit ;; m68k:machten:*:*) echo m68k-apple-machten${UNAME_RELEASE} exit ;; powerpc:machten:*:*) echo powerpc-apple-machten${UNAME_RELEASE} exit ;; RISC*:Mach:*:*) echo mips-dec-mach_bsd4.3 exit ;; RISC*:ULTRIX:*:*) echo mips-dec-ultrix${UNAME_RELEASE} exit ;; VAX*:ULTRIX*:*:*) echo vax-dec-ultrix${UNAME_RELEASE} exit ;; 2020:CLIX:*:* | 2430:CLIX:*:*) echo clipper-intergraph-clix${UNAME_RELEASE} exit ;; mips:*:*:UMIPS | mips:*:*:RISCos) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #ifdef __cplusplus #include /* for printf() prototype */ int main (int argc, char *argv[]) { #else int main (argc, argv) int argc; char *argv[]; { #endif #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF $CC_FOR_BUILD -o $dummy $dummy.c && dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` && SYSTEM_NAME=`$dummy $dummyarg` && { echo "$SYSTEM_NAME"; exit; } echo mips-mips-riscos${UNAME_RELEASE} exit ;; Motorola:PowerMAX_OS:*:*) echo powerpc-motorola-powermax exit ;; Motorola:*:4.3:PL8-*) echo powerpc-harris-powermax exit ;; Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*) echo powerpc-harris-powermax exit ;; Night_Hawk:Power_UNIX:*:*) echo powerpc-harris-powerunix exit ;; m88k:CX/UX:7*:*) echo m88k-harris-cxux7 exit ;; m88k:*:4*:R4*) echo m88k-motorola-sysv4 exit ;; m88k:*:3*:R3*) echo m88k-motorola-sysv3 exit ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=`/usr/bin/uname -p` if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ] then if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \ [ ${TARGET_BINARY_INTERFACE}x = x ] then echo m88k-dg-dgux${UNAME_RELEASE} else echo m88k-dg-dguxbcs${UNAME_RELEASE} fi else echo i586-dg-dgux${UNAME_RELEASE} fi exit ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) echo m88k-dolphin-sysv3 exit ;; M88*:*:R3*:*) # Delta 88k system running SVR3 echo m88k-motorola-sysv3 exit ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) echo m88k-tektronix-sysv3 exit ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) echo m68k-tektronix-bsd exit ;; *:IRIX*:*:*) echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'` exit ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id exit ;; # Note that: echo "'`uname -s`'" gives 'AIX ' i*86:AIX:*:*) echo i386-ibm-aix exit ;; ia64:AIX:*:*) if [ -x /usr/bin/oslevel ] ; then IBM_REV=`/usr/bin/oslevel` else IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} fi echo ${UNAME_MACHINE}-ibm-aix${IBM_REV} exit ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #include main() { if (!__power_pc()) exit(1); puts("powerpc-ibm-aix3.2.5"); exit(0); } EOF if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` then echo "$SYSTEM_NAME" else echo rs6000-ibm-aix3.2.5 fi elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then echo rs6000-ibm-aix3.2.4 else echo rs6000-ibm-aix3.2 fi exit ;; *:AIX:*:[4567]) IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'` if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi if [ -x /usr/bin/lslpp ] ; then IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | awk -F: '{ print $3 }' | sed s/[0-9]*$/0/` else IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} fi echo ${IBM_ARCH}-ibm-aix${IBM_REV} exit ;; *:AIX:*:*) echo rs6000-ibm-aix exit ;; ibmrt:4.4BSD:*|romp-ibm:BSD:*) echo romp-ibm-bsd4.4 exit ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to exit ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) echo rs6000-bull-bosx exit ;; DPX/2?00:B.O.S.:*:*) echo m68k-bull-sysv3 exit ;; 9000/[34]??:4.3bsd:1.*:*) echo m68k-hp-bsd exit ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) echo m68k-hp-bsd4.4 exit ;; 9000/[34678]??:HP-UX:*:*) HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` case "${UNAME_MACHINE}" in 9000/31? ) HP_ARCH=m68000 ;; 9000/[34]?? ) HP_ARCH=m68k ;; 9000/[678][0-9][0-9]) if [ -x /usr/bin/getconf ]; then sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null` sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null` case "${sc_cpu_version}" in 523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0 528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1 532) # CPU_PA_RISC2_0 case "${sc_kernel_bits}" in 32) HP_ARCH="hppa2.0n" ;; 64) HP_ARCH="hppa2.0w" ;; '') HP_ARCH="hppa2.0" ;; # HP-UX 10.20 esac ;; esac fi if [ "${HP_ARCH}" = "" ]; then eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #define _HPUX_SOURCE #include #include int main () { #if defined(_SC_KERNEL_BITS) long bits = sysconf(_SC_KERNEL_BITS); #endif long cpu = sysconf (_SC_CPU_VERSION); switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0"); break; case CPU_PA_RISC1_1: puts ("hppa1.1"); break; case CPU_PA_RISC2_0: #if defined(_SC_KERNEL_BITS) switch (bits) { case 64: puts ("hppa2.0w"); break; case 32: puts ("hppa2.0n"); break; default: puts ("hppa2.0"); break; } break; #else /* !defined(_SC_KERNEL_BITS) */ puts ("hppa2.0"); break; #endif default: puts ("hppa1.0"); break; } exit (0); } EOF (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy` test -z "$HP_ARCH" && HP_ARCH=hppa fi ;; esac if [ ${HP_ARCH} = "hppa2.0w" ] then eval $set_cc_for_build # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating # 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler # generating 64-bit code. GNU and HP use different nomenclature: # # $ CC_FOR_BUILD=cc ./config.guess # => hppa2.0w-hp-hpux11.23 # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess # => hppa64-hp-hpux11.23 if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | grep -q __LP64__ then HP_ARCH="hppa2.0w" else HP_ARCH="hppa64" fi fi echo ${HP_ARCH}-hp-hpux${HPUX_REV} exit ;; ia64:HP-UX:*:*) HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` echo ia64-hp-hpux${HPUX_REV} exit ;; 3050*:HI-UX:*:*) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #include int main () { long cpu = sysconf (_SC_CPU_VERSION); /* The order matters, because CPU_IS_HP_MC68K erroneously returns true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct results, however. */ if (CPU_IS_PA_RISC (cpu)) { switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break; case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break; case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break; default: puts ("hppa-hitachi-hiuxwe2"); break; } } else if (CPU_IS_HP_MC68K (cpu)) puts ("m68k-hitachi-hiuxwe2"); else puts ("unknown-hitachi-hiuxwe2"); exit (0); } EOF $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` && { echo "$SYSTEM_NAME"; exit; } echo unknown-hitachi-hiuxwe2 exit ;; 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* ) echo hppa1.1-hp-bsd exit ;; 9000/8??:4.3bsd:*:*) echo hppa1.0-hp-bsd exit ;; *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*) echo hppa1.0-hp-mpeix exit ;; hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* ) echo hppa1.1-hp-osf exit ;; hp8??:OSF1:*:*) echo hppa1.0-hp-osf exit ;; i*86:OSF1:*:*) if [ -x /usr/sbin/sysversion ] ; then echo ${UNAME_MACHINE}-unknown-osf1mk else echo ${UNAME_MACHINE}-unknown-osf1 fi exit ;; parisc*:Lites*:*:*) echo hppa1.1-hp-lites exit ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) echo c1-convex-bsd exit ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) echo c34-convex-bsd exit ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) echo c38-convex-bsd exit ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) echo c4-convex-bsd exit ;; CRAY*Y-MP:*:*:*) echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*[A-Z]90:*:*:*) echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \ -e 's/\.[^.]*$/.X/' exit ;; CRAY*TS:*:*:*) echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*T3E:*:*:*) echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*SV1:*:*:*) echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; *:UNICOS/mp:*:*) echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*) FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; 5000:UNIX_System_V:4.*:*) FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'` echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*) echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE} exit ;; sparc*:BSD/OS:*:*) echo sparc-unknown-bsdi${UNAME_RELEASE} exit ;; *:BSD/OS:*:*) echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE} exit ;; *:FreeBSD:*:*) UNAME_PROCESSOR=`/usr/bin/uname -p` case ${UNAME_PROCESSOR} in amd64) echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; *) echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; esac exit ;; i*:CYGWIN*:*) echo ${UNAME_MACHINE}-pc-cygwin exit ;; *:MINGW64*:*) echo ${UNAME_MACHINE}-pc-mingw64 exit ;; *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; *:MSYS*:*) echo ${UNAME_MACHINE}-pc-msys exit ;; i*:windows32*:*) # uname -m includes "-pc" on this system. echo ${UNAME_MACHINE}-mingw32 exit ;; i*:PW*:*) echo ${UNAME_MACHINE}-pc-pw32 exit ;; *:Interix*:*) case ${UNAME_MACHINE} in x86) echo i586-pc-interix${UNAME_RELEASE} exit ;; authenticamd | genuineintel | EM64T) echo x86_64-unknown-interix${UNAME_RELEASE} exit ;; IA64) echo ia64-unknown-interix${UNAME_RELEASE} exit ;; esac ;; [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*) echo i${UNAME_MACHINE}-pc-mks exit ;; 8664:Windows_NT:*) echo x86_64-pc-mks exit ;; i*:Windows_NT*:* | Pentium*:Windows_NT*:*) # How do we know it's Interix rather than the generic POSIX subsystem? # It also conflicts with pre-2.0 versions of AT&T UWIN. Should we # UNAME_MACHINE based on the output of uname instead of i386? echo i586-pc-interix exit ;; i*:UWIN*:*) echo ${UNAME_MACHINE}-pc-uwin exit ;; amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*) echo x86_64-unknown-cygwin exit ;; p*:CYGWIN*:*) echo powerpcle-unknown-cygwin exit ;; prep*:SunOS:5.*:*) echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; *:GNU:*:*) # the GNU system echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'` exit ;; *:GNU/*:*:*) # other systems with GNU libc and userland echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC} exit ;; i*86:Minix:*:*) echo ${UNAME_MACHINE}-pc-minix exit ;; aarch64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; aarch64_be:Linux:*:*) UNAME_MACHINE=aarch64_be echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; alpha:Linux:*:*) case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in EV5) UNAME_MACHINE=alphaev5 ;; EV56) UNAME_MACHINE=alphaev56 ;; PCA56) UNAME_MACHINE=alphapca56 ;; PCA57) UNAME_MACHINE=alphapca56 ;; EV6) UNAME_MACHINE=alphaev6 ;; EV67) UNAME_MACHINE=alphaev67 ;; EV68*) UNAME_MACHINE=alphaev68 ;; esac objdump --private-headers /bin/sh | grep -q ld.so.1 if test "$?" = 0 ; then LIBC="gnulibc1" ; fi echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; arc:Linux:*:* | arceb:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; arm*:Linux:*:*) eval $set_cc_for_build if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_EABI__ then echo ${UNAME_MACHINE}-unknown-linux-${LIBC} else if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_PCS_VFP then echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi else echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf fi fi exit ;; avr32*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; cris:Linux:*:*) echo ${UNAME_MACHINE}-axis-linux-${LIBC} exit ;; crisv32:Linux:*:*) echo ${UNAME_MACHINE}-axis-linux-${LIBC} exit ;; e2k:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; frv:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; hexagon:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; i*86:Linux:*:*) echo ${UNAME_MACHINE}-pc-linux-${LIBC} exit ;; ia64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; m32r*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; m68*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; mips:Linux:*:* | mips64:Linux:*:*) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #undef CPU #undef ${UNAME_MACHINE} #undef ${UNAME_MACHINE}el #if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) CPU=${UNAME_MACHINE}el #else #if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) CPU=${UNAME_MACHINE} #else CPU= #endif #endif EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } ;; openrisc*:Linux:*:*) echo or1k-unknown-linux-${LIBC} exit ;; or32:Linux:*:* | or1k*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; padre:Linux:*:*) echo sparc-unknown-linux-${LIBC} exit ;; parisc64:Linux:*:* | hppa64:Linux:*:*) echo hppa64-unknown-linux-${LIBC} exit ;; parisc:Linux:*:* | hppa:Linux:*:*) # Look for CPU level case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in PA7*) echo hppa1.1-unknown-linux-${LIBC} ;; PA8*) echo hppa2.0-unknown-linux-${LIBC} ;; *) echo hppa-unknown-linux-${LIBC} ;; esac exit ;; ppc64:Linux:*:*) echo powerpc64-unknown-linux-${LIBC} exit ;; ppc:Linux:*:*) echo powerpc-unknown-linux-${LIBC} exit ;; ppc64le:Linux:*:*) echo powerpc64le-unknown-linux-${LIBC} exit ;; ppcle:Linux:*:*) echo powerpcle-unknown-linux-${LIBC} exit ;; s390:Linux:*:* | s390x:Linux:*:*) echo ${UNAME_MACHINE}-ibm-linux-${LIBC} exit ;; sh64*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; sh*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; sparc:Linux:*:* | sparc64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; tile*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; vax:Linux:*:*) echo ${UNAME_MACHINE}-dec-linux-${LIBC} exit ;; x86_64:Linux:*:*) echo ${UNAME_MACHINE}-pc-linux-${LIBC} exit ;; xtensa*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; i*86:DYNIX/ptx:4*:*) # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. # earlier versions are messed up and put the nodename in both # sysname and nodename. echo i386-sequent-sysv4 exit ;; i*86:UNIX_SV:4.2MP:2.*) # Unixware is an offshoot of SVR4, but it has its own version # number series starting with 2... # I am not positive that other SVR4 systems won't match this, # I just have to hope. -- rms. # Use sysv4.2uw... so that sysv4* matches it. echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION} exit ;; i*86:OS/2:*:*) # If we were able to find `uname', then EMX Unix compatibility # is probably installed. echo ${UNAME_MACHINE}-pc-os2-emx exit ;; i*86:XTS-300:*:STOP) echo ${UNAME_MACHINE}-unknown-stop exit ;; i*86:atheos:*:*) echo ${UNAME_MACHINE}-unknown-atheos exit ;; i*86:syllable:*:*) echo ${UNAME_MACHINE}-pc-syllable exit ;; i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*) echo i386-unknown-lynxos${UNAME_RELEASE} exit ;; i*86:*DOS:*:*) echo ${UNAME_MACHINE}-pc-msdosdjgpp exit ;; i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*) UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'` if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL} else echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL} fi exit ;; i*86:*:5:[678]*) # UnixWare 7.x, OpenUNIX and OpenServer 6. case `/bin/uname -X | grep "^Machine"` in *486*) UNAME_MACHINE=i486 ;; *Pentium) UNAME_MACHINE=i586 ;; *Pent*|*Celeron) UNAME_MACHINE=i686 ;; esac echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION} exit ;; i*86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')` (/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486 (/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \ && UNAME_MACHINE=i586 (/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \ && UNAME_MACHINE=i686 (/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \ && UNAME_MACHINE=i686 echo ${UNAME_MACHINE}-pc-sco$UNAME_REL else echo ${UNAME_MACHINE}-pc-sysv32 fi exit ;; pc:*:*:*) # Left here for compatibility: # uname -m prints for DJGPP always 'pc', but it prints nothing about # the processor, so we play safe by assuming i586. # Note: whatever this is, it MUST be the same as what config.sub # prints for the "djgpp" host, or else GDB configury will decide that # this is a cross-build. echo i586-pc-msdosdjgpp exit ;; Intel:Mach:3*:*) echo i386-pc-mach3 exit ;; paragon:*:*:*) echo i860-intel-osf1 exit ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4 fi exit ;; mini*:CTIX:SYS*5:*) # "miniframe" echo m68010-convergent-sysv exit ;; mc68k:UNIX:SYSTEM5:3.51m) echo m68k-convergent-sysv exit ;; M680?0:D-NIX:5.3:*) echo m68k-diab-dnix exit ;; M68*:*:R3V[5678]*:*) test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;; 3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0) OS_REL='' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4; exit; } ;; NCR*:*:4.2:* | MPRAS*:*:4.2:*) OS_REL='.3' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*) echo m68k-unknown-lynxos${UNAME_RELEASE} exit ;; mc68030:UNIX_System_V:4.*:*) echo m68k-atari-sysv4 exit ;; TSUNAMI:LynxOS:2.*:*) echo sparc-unknown-lynxos${UNAME_RELEASE} exit ;; rs6000:LynxOS:2.*:*) echo rs6000-unknown-lynxos${UNAME_RELEASE} exit ;; PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*) echo powerpc-unknown-lynxos${UNAME_RELEASE} exit ;; SM[BE]S:UNIX_SV:*:*) echo mips-dde-sysv${UNAME_RELEASE} exit ;; RM*:ReliantUNIX-*:*:*) echo mips-sni-sysv4 exit ;; RM*:SINIX-*:*:*) echo mips-sni-sysv4 exit ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=`(uname -p) 2>/dev/null` echo ${UNAME_MACHINE}-sni-sysv4 else echo ns32k-sni-sysv fi exit ;; PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says echo i586-unisys-sysv4 exit ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm echo hppa1.1-stratus-sysv4 exit ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. echo i860-stratus-sysv4 exit ;; i*86:VOS:*:*) # From Paul.Green@stratus.com. echo ${UNAME_MACHINE}-stratus-vos exit ;; *:VOS:*:*) # From Paul.Green@stratus.com. echo hppa1.1-stratus-vos exit ;; mc68*:A/UX:*:*) echo m68k-apple-aux${UNAME_RELEASE} exit ;; news*:NEWS-OS:6*:*) echo mips-sony-newsos6 exit ;; R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*) if [ -d /usr/nec ]; then echo mips-nec-sysv${UNAME_RELEASE} else echo mips-unknown-sysv${UNAME_RELEASE} fi exit ;; BeBox:BeOS:*:*) # BeOS running on hardware made by Be, PPC only. echo powerpc-be-beos exit ;; BeMac:BeOS:*:*) # BeOS running on Mac or Mac clone, PPC only. echo powerpc-apple-beos exit ;; BePC:BeOS:*:*) # BeOS running on Intel PC compatible. echo i586-pc-beos exit ;; BePC:Haiku:*:*) # Haiku running on Intel PC compatible. echo i586-pc-haiku exit ;; x86_64:Haiku:*:*) echo x86_64-unknown-haiku exit ;; SX-4:SUPER-UX:*:*) echo sx4-nec-superux${UNAME_RELEASE} exit ;; SX-5:SUPER-UX:*:*) echo sx5-nec-superux${UNAME_RELEASE} exit ;; SX-6:SUPER-UX:*:*) echo sx6-nec-superux${UNAME_RELEASE} exit ;; SX-7:SUPER-UX:*:*) echo sx7-nec-superux${UNAME_RELEASE} exit ;; SX-8:SUPER-UX:*:*) echo sx8-nec-superux${UNAME_RELEASE} exit ;; SX-8R:SUPER-UX:*:*) echo sx8r-nec-superux${UNAME_RELEASE} exit ;; Power*:Rhapsody:*:*) echo powerpc-apple-rhapsody${UNAME_RELEASE} exit ;; *:Rhapsody:*:*) echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE} exit ;; *:Darwin:*:*) UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown eval $set_cc_for_build if test "$UNAME_PROCESSOR" = unknown ; then UNAME_PROCESSOR=powerpc fi if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then case $UNAME_PROCESSOR in i386) UNAME_PROCESSOR=x86_64 ;; powerpc) UNAME_PROCESSOR=powerpc64 ;; esac fi fi elif test "$UNAME_PROCESSOR" = i386 ; then # Avoid executing cc on OS X 10.9, as it ships with a stub # that puts up a graphical alert prompting to install # developer tools. Any system running Mac OS X 10.7 or # later (Darwin 11 and later) is required to have a 64-bit # processor. This is not true of the ARM version of Darwin # that Apple uses in portable devices. UNAME_PROCESSOR=x86_64 fi echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE} exit ;; *:procnto*:*:* | *:QNX:[0123456789]*:*) UNAME_PROCESSOR=`uname -p` if test "$UNAME_PROCESSOR" = "x86"; then UNAME_PROCESSOR=i386 UNAME_MACHINE=pc fi echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE} exit ;; *:QNX:*:4*) echo i386-pc-qnx exit ;; NEO-?:NONSTOP_KERNEL:*:*) echo neo-tandem-nsk${UNAME_RELEASE} exit ;; NSE-*:NONSTOP_KERNEL:*:*) echo nse-tandem-nsk${UNAME_RELEASE} exit ;; NSR-?:NONSTOP_KERNEL:*:*) echo nsr-tandem-nsk${UNAME_RELEASE} exit ;; *:NonStop-UX:*:*) echo mips-compaq-nonstopux exit ;; BS2000:POSIX*:*:*) echo bs2000-siemens-sysv exit ;; DS/*:UNIX_System_V:*:*) echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE} exit ;; *:Plan9:*:*) # "uname -m" is not consistent, so use $cputype instead. 386 # is converted to i386 for consistency with other x86 # operating systems. if test "$cputype" = "386"; then UNAME_MACHINE=i386 else UNAME_MACHINE="$cputype" fi echo ${UNAME_MACHINE}-unknown-plan9 exit ;; *:TOPS-10:*:*) echo pdp10-unknown-tops10 exit ;; *:TENEX:*:*) echo pdp10-unknown-tenex exit ;; KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*) echo pdp10-dec-tops20 exit ;; XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*) echo pdp10-xkl-tops20 exit ;; *:TOPS-20:*:*) echo pdp10-unknown-tops20 exit ;; *:ITS:*:*) echo pdp10-unknown-its exit ;; SEI:*:*:SEIUX) echo mips-sei-seiux${UNAME_RELEASE} exit ;; *:DragonFly:*:*) echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` exit ;; *:*VMS:*:*) UNAME_MACHINE=`(uname -p) 2>/dev/null` case "${UNAME_MACHINE}" in A*) echo alpha-dec-vms ; exit ;; I*) echo ia64-dec-vms ; exit ;; V*) echo vax-dec-vms ; exit ;; esac ;; *:XENIX:*:SysV) echo i386-pc-xenix exit ;; i*86:skyos:*:*) echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//' exit ;; i*86:rdos:*:*) echo ${UNAME_MACHINE}-pc-rdos exit ;; i*86:AROS:*:*) echo ${UNAME_MACHINE}-pc-aros exit ;; x86_64:VMkernel:*:*) echo ${UNAME_MACHINE}-unknown-esx exit ;; esac cat >&2 < in order to provide the needed information to handle your system. config.guess timestamp = $timestamp uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null` /bin/uname -X = `(/bin/uname -X) 2>/dev/null` hostinfo = `(hostinfo) 2>/dev/null` /bin/universe = `(/bin/universe) 2>/dev/null` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null` /bin/arch = `(/bin/arch) 2>/dev/null` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null` UNAME_MACHINE = ${UNAME_MACHINE} UNAME_RELEASE = ${UNAME_RELEASE} UNAME_SYSTEM = ${UNAME_SYSTEM} UNAME_VERSION = ${UNAME_VERSION} EOF exit 1 # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: suricata-3.2.1/suricata.yaml.in0000644000000000000000000020103613051004444013320 00000000000000%YAML 1.1 --- # Suricata configuration file. In addition to the comments describing all # options in this file, full documentation can be found at: # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml ## ## Step 1: inform Suricata about your network ## vars: # more specifc is better for alert accuracy and performance address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" #HOME_NET: "[192.168.0.0/16]" #HOME_NET: "[10.0.0.0/8]" #HOME_NET: "[172.16.0.0/12]" #HOME_NET: "any" EXTERNAL_NET: "!$HOME_NET" #EXTERNAL_NET: "any" HTTP_SERVERS: "$HOME_NET" SMTP_SERVERS: "$HOME_NET" SQL_SERVERS: "$HOME_NET" DNS_SERVERS: "$HOME_NET" TELNET_SERVERS: "$HOME_NET" AIM_SERVERS: "$EXTERNAL_NET" DNP3_SERVER: "$HOME_NET" DNP3_CLIENT: "$HOME_NET" MODBUS_CLIENT: "$HOME_NET" MODBUS_SERVER: "$HOME_NET" ENIP_CLIENT: "$HOME_NET" ENIP_SERVER: "$HOME_NET" port-groups: HTTP_PORTS: "80" SHELLCODE_PORTS: "!80" ORACLE_PORTS: 1521 SSH_PORTS: 22 DNP3_PORTS: 20000 MODBUS_PORTS: 502 ## ## Step 2: select the rules to enable or disable ## default-rule-path: @e_sysconfdir@rules rule-files: - botcc.rules # - botcc.portgrouped.rules - ciarmy.rules - compromised.rules - drop.rules - dshield.rules # - emerging-activex.rules - emerging-attack_response.rules - emerging-chat.rules - emerging-current_events.rules - emerging-dns.rules - emerging-dos.rules - emerging-exploit.rules - emerging-ftp.rules # - emerging-games.rules # - emerging-icmp_info.rules # - emerging-icmp.rules - emerging-imap.rules # - emerging-inappropriate.rules # - emerging-info.rules - emerging-malware.rules - emerging-misc.rules - emerging-mobile_malware.rules - emerging-netbios.rules - emerging-p2p.rules - emerging-policy.rules - emerging-pop3.rules - emerging-rpc.rules # - emerging-scada.rules # - emerging-scada_special.rules - emerging-scan.rules # - emerging-shellcode.rules - emerging-smtp.rules - emerging-snmp.rules - emerging-sql.rules - emerging-telnet.rules - emerging-tftp.rules - emerging-trojan.rules - emerging-user_agents.rules - emerging-voip.rules - emerging-web_client.rules - emerging-web_server.rules # - emerging-web_specific_apps.rules - emerging-worm.rules - tor.rules # - decoder-events.rules # available in suricata sources under rules dir # - stream-events.rules # available in suricata sources under rules dir - http-events.rules # available in suricata sources under rules dir - smtp-events.rules # available in suricata sources under rules dir - dns-events.rules # available in suricata sources under rules dir - tls-events.rules # available in suricata sources under rules dir # - modbus-events.rules # available in suricata sources under rules dir # - app-layer-events.rules # available in suricata sources under rules dir # - dnp3-events.rules # available in suricata sources under rules dir classification-file: @e_sysconfdir@classification.config reference-config-file: @e_sysconfdir@reference.config # threshold-file: @e_sysconfdir@threshold.config ## ## Step 3: select outputs to enable ## # The default logging directory. Any log or output file will be # placed here if its not specified with a full path name. This can be # overridden with the -l command line parameter. default-log-dir: @e_logdir@ # global stats configuration stats: enabled: yes # The interval field (in seconds) controls at what interval # the loggers are invoked. interval: 8 # Configure the type of alert (and other) logging you would like. outputs: # a line based alerts log similar to Snort's fast.log - fast: enabled: yes filename: fast.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: @e_enable_evelog@ filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above #identity: "suricata" #facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug #redis: # server: 127.0.0.1 # port: 6379 # mode: list ## possible values: list (default), channel # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting as to be reserved to high traffic suricata. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entry to keep in buffer types: - alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) http: yes # enable dumping of http fields tls: yes # enable dumping of tls fields ssh: yes # enable dumping of ssh fields smtp: yes # enable dumping of smtp fields dnp3: yes # enable dumping of DNP3 fields # Enable the logging of tagged packets for rules using the # "tag" keyword. tagged-packets: yes # HTTP X-Forwarded-For support by adding an extra field or overwriting # the source or destination IP address (depending on flow direction) # with the one reported in the X-Forwarded-For HTTP header. This is # helpful when reviewing alerts for traffic that is being reverse # or forward proxied. xff: enabled: no # Two operation modes are available, "extra-data" and "overwrite". mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used. deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration. header: X-Forwarded-For - http: extended: yes # enable this for extended logging information # custom allows additional http fields to be included in eve-log # the example below adds three additional fields when uncommented #custom: [Accept-Encoding, Accept-Language, Authorization] - dns: # control logging of queries and answers # default yes, no to disable query: yes # enable logging of DNS queries answer: yes # enable logging of DNS answers # control which RR types are logged # all enabled if custom not specified #custom: [a, aaaa, cname, mx, ns, ptr, txt] - tls: extended: yes # enable this for extended logging information - files: force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256 #force-hash: [md5] #- drop: # alerts: yes # log alerts that caused drops # flows: all # start or all: 'start' logs only a single drop # # per flow direction. All logs each dropped pkt. - smtp: #extended: yes # enable this for extended logging information # this includes: bcc, message-id, subject, x_mailer, user-agent # custom fields logging from the list: # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, # x-originating-ip, in-reply-to, references, importance, priority, # sensitivity, organization, content-md5, date #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] # output md5 of fields: body, subject # for the body you need to set app-layer.protocols.smtp.mime.body-md5 # to yes #md5: [body, subject] - ssh - stats: totals: yes # stats for all threads merged together threads: no # per thread stats deltas: no # include delta values # bi-directional flows - flow # uni-directional flows #- netflow #- dnp3 # alert output for use with Barnyard2 - unified2-alert: enabled: no filename: unified2.alert # File size limit. Can be specified in kb, mb, gb. Just a number # is parsed as bytes. #limit: 32mb # Sensor ID field of unified2 alerts. #sensor-id: 0 # Include payload of packets related to alerts. Defaults to true, set to # false if payload is not required. #payload: yes # HTTP X-Forwarded-For support by adding the unified2 extra header or # overwriting the source or destination IP address (depending on flow # direction) with the one reported in the X-Forwarded-For HTTP header. # This is helpful when reviewing alerts for traffic that is being reverse # or forward proxied. xff: enabled: no # Two operation modes are available, "extra-data" and "overwrite". Note # that in the "overwrite" mode, if the reported IP address in the HTTP # X-Forwarded-For header is of a different version of the packet # received, it will fall-back to "extra-data" mode. mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used. deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration. header: X-Forwarded-For # a line based log of HTTP requests (no alerts) - http-log: enabled: no filename: http.log append: yes #extended: yes # enable this for extended logging information #custom: yes # enabled the custom logging format (defined by customformat) #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P" #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # a line based log of TLS handshake parameters (no alerts) - tls-log: enabled: no # Log TLS connections. filename: tls.log # File to store TLS logs. append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' #extended: yes # Log extended information like fingerprint # output module to store certificates chain to disk - tls-store: enabled: no #certs-log-dir: certs # directory to store the certificates files # a line based log of DNS requests and/or replies (no alerts) - dns-log: enabled: no filename: dns.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # Packet log... log packets in pcap format. 3 modes of operation: "normal" # "multi" and "sguil". # # In normal mode a pcap file "filename" is created in the default-log-dir, # or are as specified by "dir". # In multi mode, a file is created per thread. This will perform much # better, but will create multiple files where 'normal' would create one. # In multi mode the filename takes a few special variables: # - %n -- thread number # - %i -- thread id # - %t -- timestamp (secs or secs.usecs based on 'ts-format' # E.g. filename: pcap.%n.%t # # Note that it's possible to use directories, but the directories are not # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the # per thread directory. # # Also note that the limit and max-files settings are enforced per thread. # So the size limit when using 8 threads with 1000mb files and 2000 files # is: 8*1000*2000 ~ 16TiB. # # In Sguil mode "dir" indicates the base directory. In this base dir the # pcaps are created in th directory structure Sguil expects: # # $sguil-base-dir/YYYY-MM-DD/$filename. # # By default all packets are logged except: # - TCP streams beyond stream.reassembly.depth # - encrypted streams after the key exchange # - pcap-log: enabled: no filename: log.pcap # File size limit. Can be specified in kb, mb, gb. Just a number # is parsed as bytes. limit: 1000mb # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit" max-files: 2000 mode: normal # normal, multi or sguil. # Directory to place pcap files. If not provided the default log # directory will be used. Required for "sguil" mode. #dir: /nsm_data/ #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stopped being logged. # a full alerts log containing much information for signature writers # or for investigating suspected false positives. - alert-debug: enabled: no filename: alert-debug.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # alert output to prelude (http://www.prelude-technologies.com/) only # available if Suricata has been compiled with --enable-prelude - alert-prelude: enabled: no profile: suricata log-packet-content: no log-packet-header: yes # Stats.log contains data from various counters of the suricata engine. - stats: enabled: yes filename: stats.log totals: yes # stats for all threads merged together threads: no # per thread stats #null-values: yes # print counters that have value 0 # a line based alerts log similar to fast.log into syslog - syslog: enabled: no # reported identity to syslog. If ommited the program name (usually # suricata) will be used. #identity: "suricata" facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug # a line based information for dropped packets in IPS mode - drop: enabled: no filename: drop.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # output module to store extracted files to disk # # The files are stored to the log-dir in a format "file." where is # an incrementing number starting at 1. For each file "file." a meta # file "file..meta" is created. # # File extraction depends on a lot of things to be fully done: # - file-store stream-depth. For optimal results, set this to 0 (unlimited) # - http request / response body sizes. Again set to 0 for optimal results. # - rules that contain the "filestore" keyword. - file-store: enabled: no # set to yes to enable log-dir: files # directory to store the files force-magic: no # force logging magic on all stored files # force logging of checksums, available hash functions are md5, # sha1 and sha256 #force-hash: [md5] force-filestore: no # force storing of all files # override global stream-depth for sessions in which we want to # perform file extraction. Set to 0 for unlimited. #stream-depth: 0 #waldo: file.waldo # waldo file to store the file_id across runs # output module to log files tracked in a easily parsable json format - file-log: enabled: no filename: files-json.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256 #force-hash: [md5] # Log TCP data after stream normalization # 2 types: file or dir. File logs into a single logfile. Dir creates # 2 files per TCP session and stores the raw TCP data into them. # Using 'both' will enable both file and dir modes. # # Note: limited by stream.depth - tcp-data: enabled: no type: file filename: tcp-data.log # Log HTTP body data after normalization, dechunking and unzipping. # 2 types: file or dir. File logs into a single logfile. Dir creates # 2 files per HTTP session and stores the normalized data into them. # Using 'both' will enable both file and dir modes. # # Note: limited by the body limit settings - http-body-data: enabled: no type: file filename: http-data.log # Lua Output Support - execute lua script to generate alert and event # output. # Documented at: # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_Output - lua: enabled: no #scripts-dir: /etc/suricata/lua-output/ scripts: # - script1.lua # Logging configuration. This is not about logging IDS alerts/events, but # output about what Suricata is doing, like startup messages, errors, etc. logging: # The default log level, can be overridden in an output section. # Note that debug level logging will only be emitted if Suricata was # compiled with the --enable-debug configure option. # # This value is overriden by the SC_LOG_LEVEL env var. default-log-level: notice # The default output format. Optional parameter, should default to # something reasonable if not provided. Can be overriden in an # output section. You can leave this out to get the default. # # This value is overriden by the SC_LOG_FORMAT env var. #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- " # A regex to filter output. Can be overridden in an output section. # Defaults to empty (no filter). # # This value is overriden by the SC_LOG_OP_FILTER env var. default-output-filter: # Define your logging outputs. If none are defined, or they are all # disabled you will get the default - console output. outputs: - console: enabled: yes # type: json - file: enabled: yes level: info filename: @e_logdir@suricata.log # type: json - syslog: enabled: no facility: local5 format: "[%i] <%d> -- " # type: json ## ## Step 4: configure common capture settings ## ## See "Advanced Capture Options" below for more options, including NETMAP ## and PF_RING. ## # Linux high speed capture support af-packet: - interface: eth0 # Number of receive threads. "auto" uses the number of cores #threads: auto # Default clusterid. AF_PACKET will load balance packets based on flow. cluster-id: 99 # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash. # This is only supported for Linux kernel > 3.1 # possible value are: # * cluster_round_robin: round robin load balancing # * cluster_flow: all packets of a given flow are send to the same socket # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket # * cluster_qm: all packets linked by network card to a RSS queue are sent to the same # socket. Requires at least Linux 3.14. # * cluster_random: packets are sent randomly to sockets but with an equipartition. # Requires at least Linux 3.14. # * cluster_rollover: kernel rotates between sockets filling each socket before moving # to the next. Requires at least Linux 3.10. # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system # with capture card using RSS (require cpu affinity tuning and system irq tuning) cluster-type: cluster_flow # In some fragmentation case, the hash can not be computed. If "defrag" is set # to yes, the kernel will do the needed defragmentation before sending the packets. defrag: yes # After Linux kernel 3.10 it is possible to activate the rollover option: if a socket is # full then kernel will send the packet on the next socket with room available. This option # can minimize packet drop and increase the treated bandwidth on single intensive flow. #rollover: yes # To use the ring feature of AF_PACKET, set 'use-mmap' to yes #use-mmap: yes # Lock memory map to avoid it goes to swap. Be careful that over suscribing could lock # your system #mmap-locked: yes # Use experimental tpacket_v3 capture mode, only active if use-mmap is true #tpacket-v3: yes # Ring size will be computed with respect to max_pending_packets and number # of threads. You can set manually the ring size in number of packets by setting # the following value. If you are using flow cluster-type and have really network # intensive single-flow you could want to set the ring-size independently of the number # of threads: #ring-size: 2048 # Block size is used by tpacket_v3 only. It should set to a value high enough to contain # a decent number of packets. Size is in bytes so please consider your MTU. It should be # a power of 2 and it must be multiple of page size (usually 4096). #block-size: 32768 # tpacket_v3 block timeout: an open block is passed to userspace if it is not # filled after block-timeout milliseconds. #block-timeout: 10 # On busy system, this could help to set it to yes to recover from a packet drop # phase. This will result in some packets (at max a ring flush) being non treated. #use-emergency-flush: yes # recv buffer size, increase value could improve performance # buffer-size: 32768 # Set to yes to disable promiscuous mode # disable-promisc: no # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - kernel: use indication sent by kernel for each packet (default) # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. # Warning: 'checksum-validation' must be set to yes to have any validation #checksum-checks: kernel # BPF filter to apply to this interface. The pcap filter syntax apply here. #bpf-filter: port 80 or udp # You can use the following variables to activate AF_PACKET tap or IPS mode. # If copy-mode is set to ips or tap, the traffic coming to the current # interface will be copied to the copy-iface interface. If 'tap' is set, the # copy is complete. If 'ips' is set, the packet matching a 'drop' action # will not be copied. #copy-mode: ips #copy-iface: eth1 # Put default values here. These will be used for an interface that is not # in the list above. - interface: default #threads: auto #use-mmap: no #rollover: yes #tpacket-v3: yes # Cross platform libpcap capture support pcap: - interface: eth0 # On Linux, pcap will try to use mmaped capture and will use buffer-size # as total of memory used by the ring. So set this to something bigger # than 1% of your bandwidth. #buffer-size: 16777216 #bpf-filter: "tcp and port 25" # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have any validation #checksum-checks: auto # With some accelerator cards using a modified libpcap (like myricom), you # may want to have the same number of capture threads as the number of capture # rings. In this case, set up the threads variable to N to start N threads # listening on the same interface. #threads: 16 # set to no to disable promiscuous mode: #promisc: no # set snaplen, if not set it defaults to MTU if MTU can be known # via ioctl call and to full capture if not. #snaplen: 1518 # Put default values here - interface: default #checksum-checks: auto # Settings for reading pcap files pcap-file: # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have checksum tested checksum-checks: auto # See "Advanced Capture Options" below for more options, including NETMAP # and PF_RING. ## ## Step 5: App Layer Protocol Configuration ## # Configure the app-layer parsers. The protocols section details each # protocol. # # The option "enabled" takes 3 values - "yes", "no", "detection-only". # "yes" enables both detection and the parser, "no" disables both, and # "detection-only" enables protocol detection only (parser disabled). app-layer: protocols: tls: enabled: yes detection-ports: dp: 443 # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow # bypass. If disabled (the default), TLS/SSL session is still # tracked for Heartbleed and other anomalies. #no-reassemble: yes dcerpc: enabled: yes ftp: enabled: yes ssh: enabled: yes smtp: enabled: yes # Configure SMTP-MIME Decoder mime: # Decode MIME messages from SMTP transactions # (may be resource intensive) # This field supercedes all others because it turns the entire # process on or off decode-mime: yes # Decode MIME entity bodies (ie. base64, quoted-printable, etc.) decode-base64: yes decode-quoted-printable: yes # Maximum bytes per header data value stored in the data structure # (default is 2000) header-value-depth: 2000 # Extract URLs and save in state data structure extract-urls: yes # Set to yes to compute the md5 of the mail body. You will then # be able to journalize it. body-md5: no # Configure inspected-tracker for file_data keyword inspected-tracker: content-limit: 100000 content-inspect-min-size: 32768 content-inspect-window: 4096 imap: enabled: detection-only msn: enabled: detection-only smb: enabled: yes detection-ports: dp: 139, 445 # smb2 detection is disabled internally inside the engine. #smb2: # enabled: yes dns: # memcaps. Globally and per flow/state. #global-memcap: 16mb #state-memcap: 512kb # How many unreplied DNS requests are considered a flood. # If the limit is reached, app-layer-event:dns.flooded; will match. #request-flood: 500 tcp: enabled: yes detection-ports: dp: 53 udp: enabled: yes detection-ports: dp: 53 http: enabled: yes # memcap: 64mb # default-config: Used when no server-config matches # personality: List of personalities used by default # request-body-limit: Limit reassembly of request body for inspection # by http_client_body & pcre /P option. # response-body-limit: Limit reassembly of response body for inspection # by file_data, http_server_body & pcre /Q option. # double-decode-path: Double decode path section of the URI # double-decode-query: Double decode query section of the URI # response-body-decompress-layer-limit: # Limit to how many layers of compression will be # decompressed. Defaults to 2. # # server-config: List of server configurations to use if address matches # address: List of ip addresses or networks for this block # personalitiy: List of personalities used by this block # request-body-limit: Limit reassembly of request body for inspection # by http_client_body & pcre /P option. # response-body-limit: Limit reassembly of response body for inspection # by file_data, http_server_body & pcre /Q option. # double-decode-path: Double decode path section of the URI # double-decode-query: Double decode query section of the URI # # uri-include-all: Include all parts of the URI. By default the # 'scheme', username/password, hostname and port # are excluded. Setting this option to true adds # all of them to the normalized uri as inspected # by http_uri, urilen, pcre with /U and the other # keywords that inspect the normalized uri. # Note that this does not affect http_raw_uri. # Also, note that including all was the default in # 1.4 and 2.0beta1. # # meta-field-limit: Hard size limit for request and response size # limits. Applies to request line and headers, # response line and headers. Does not apply to # request or response bodies. Default is 18k. # If this limit is reached an event is raised. # # Currently Available Personalities: # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0, # IIS_7_0, IIS_7_5, Apache_2 libhtp: default-config: personality: IDS # Can be specified in kb, mb, gb. Just a number indicates # it's in bytes. request-body-limit: 100kb response-body-limit: 100kb # inspection limits request-body-minimal-inspect-size: 32kb request-body-inspect-window: 4kb response-body-minimal-inspect-size: 40kb response-body-inspect-window: 16kb # response body decompression (0 disables) response-body-decompress-layer-limit: 2 # auto will use http-body-inline mode in IPS mode, yes or no set it statically http-body-inline: auto # Take a random value for inspection sizes around the specified value. # This lower the risk of some evasion technics but could lead # detection change between runs. It is set to 'yes' by default. #randomize-inspection-sizes: yes # If randomize-inspection-sizes is active, the value of various # inspection size will be choosen in the [1 - range%, 1 + range%] # range # Default value of randomize-inspection-range is 10. #randomize-inspection-range: 10 # decoding double-decode-path: no double-decode-query: no server-config: #- apache: # address: [192.168.1.0/24, 127.0.0.0/8, "::1"] # personality: Apache_2 # # Can be specified in kb, mb, gb. Just a number indicates # # it's in bytes. # request-body-limit: 4096 # response-body-limit: 4096 # double-decode-path: no # double-decode-query: no #- iis7: # address: # - 192.168.0.0/24 # - 192.168.10.0/24 # personality: IIS_7_0 # # Can be specified in kb, mb, gb. Just a number indicates # # it's in bytes. # request-body-limit: 4096 # response-body-limit: 4096 # double-decode-path: no # double-decode-query: no # Note: Modbus probe parser is minimalist due to the poor significant field # Only Modbus message length (greater than Modbus header length) # And Protocol ID (equal to 0) are checked in probing parser # It is important to enable detection port and define Modbus port # to avoid false positive modbus: # How many unreplied Modbus requests are considered a flood. # If the limit is reached, app-layer-event:modbus.flooded; will match. #request-flood: 500 enabled: no detection-ports: dp: 502 # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it # is recommended to keep the TCP connection opened with a remote device # and not to open and close it for each MODBUS/TCP transaction. In that # case, it is important to set the depth of the stream reassembling as # unlimited (stream.reassembly.depth: 0) # Stream reassembly size for modbus. By default track it completely. stream-depth: 0 # DNP3 dnp3: enabled: no detection-ports: dp: 20000 # SCADA EtherNet/IP and CIP protocol support enip: enabled: no detection-ports: dp: 44818 sp: 44818 # Limit for the maximum number of asn1 frames to decode (default 256) asn1-max-frames: 256 ############################################################################## ## ## Advanced settings below ## ############################################################################## ## ## Run Options ## # Run suricata as user and group. #run-as: # user: suri # group: suri # Some logging module will use that name in event as identifier. The default # value is the hostname #sensor-name: suricata # Default pid file. # Will use this file if no --pidfile in command options. #pid-file: @e_rundir@suricata.pid # Daemon working directory # Suricata will change directory to this one if provided # Default: "/" #daemon-directory: "/" # Suricata core dump configuration. Limits the size of the core dump file to # approximately max-dump. The actual core dump size will be a multiple of the # page size. Core dumps that would be larger than max-dump are truncated. On # Linux, the actual core dump size may be a few pages larger than max-dump. # Setting max-dump to 0 disables core dumping. # Setting max-dump to 'unlimited' will give the full core dump file. # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size # to be 'unlimited'. coredump: max-dump: unlimited # If suricata box is a router for the sniffed networks, set it to 'router'. If # it is a pure sniffing setup, set it to 'sniffer-only'. # If set to auto, the variable is internally switch to 'router' in IPS mode # and 'sniffer-only' in IDS mode. # This feature is currently only used by the reject* keywords. host-mode: auto # Number of packets preallocated per thread. The default is 1024. A higher number # will make sure each CPU will be more easily kept busy, but may negatively # impact caching. # # If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules # apply. In that case try something like 60000 or more. This is because the CUDA # pattern matcher buffers and scans as many packets as possible in parallel. #max-pending-packets: 1024 # Runmode the engine should use. Please check --list-runmodes to get the available # runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned # load balancing). #runmode: autofp # Specifies the kind of flow load balancer used by the flow pinned autofp mode. # # Supported schedulers are: # # round-robin - Flows assigned to threads in a round robin fashion. # active-packets - Flows assigned to threads that have the lowest number of # unprocessed packets (default). # hash - Flow alloted usihng the address hash. More of a random # technique. Was the default in Suricata 1.2.1 and older. # #autofp-scheduler: active-packets # Preallocated size for packet. Default is 1514 which is the classical # size for pcap on ethernet. You should adjust this value to the highest # packet size (MTU + hardware header) on your system. #default-packet-size: 1514 # Unix command socket can be used to pass commands to suricata. # An external tool can then connect to get information from suricata # or trigger some modifications of the engine. Set enabled to yes # to activate the feature. In auto mode, the feature will only be # activated in live capture mode. You can use the filename variable to set # the file name of the socket. unix-command: enabled: auto #filename: custom.socket # Magic file. The extension .mgc is added to the value here. #magic-file: /usr/share/file/magic @e_magic_file_comment@magic-file: @e_magic_file@ legacy: uricontent: enabled ## ## Detection settings ## # Set the order of alerts bassed on actions # The default order is pass, drop, reject, alert # action-order: # - pass # - drop # - reject # - alert # IP Reputation #reputation-categories-file: @e_sysconfdir@iprep/categories.txt #default-reputation-path: @e_sysconfdir@iprep #reputation-files: # - reputation.list # When run with the option --engine-analysis, the engine will read each of # the parameters below, and print reports for each of the enabled sections # and exit. The reports are printed to a file in the default log dir # given by the parameter "default-log-dir", with engine reporting # subsection below printing reports in its own report file. engine-analysis: # enables printing reports for fast-pattern for every rule. rules-fast-pattern: yes # enables printing reports for each rule rules: yes #recursion and match limits for PCRE where supported pcre: match-limit: 3500 match-limit-recursion: 1500 ## ## Advanced Traffic Tracking and Reconstruction Settings ## # Host specific policies for defragmentation and TCP stream # reassembly. The host OS lookup is done using a radix tree, just # like a routing table so the most specific entry matches. host-os-policy: # Make the default policy windows. windows: [0.0.0.0/0] bsd: [] bsd-right: [] old-linux: [] linux: [] old-solaris: [] solaris: [] hpux10: [] hpux11: [] irix: [] macos: [] vista: [] windows2k3: [] # Defrag settings: defrag: memcap: 32mb hash-size: 65536 trackers: 65535 # number of defragmented flows to follow max-frags: 65535 # number of fragments to keep (higher than trackers) prealloc: yes timeout: 60 # Enable defrag per host settings # host-config: # # - dmz: # timeout: 30 # address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"] # # - lan: # timeout: 45 # address: # - 192.168.0.0/24 # - 192.168.10.0/24 # - 172.16.14.0/24 # Flow settings: # By default, the reserved memory (memcap) for flows is 32MB. This is the limit # for flow allocation inside the engine. You can change this value to allow # more memory usage for flows. # The hash-size determine the size of the hash used to identify flows inside # the engine, and by default the value is 65536. # At the startup, the engine can preallocate a number of flows, to get a better # performance. The number of flows preallocated is 10000 by default. # emergency-recovery is the percentage of flows that the engine need to # prune before unsetting the emergency state. The emergency state is activated # when the memcap limit is reached, allowing to create new flows, but # prunning them with the emergency timeouts (they are defined below). # If the memcap is reached, the engine will try to prune flows # with the default timeouts. If it doens't find a flow to prune, it will set # the emergency bit and it will try again with more agressive timeouts. # If that doesn't work, then it will try to kill the last time seen flows # not in use. # The memcap can be specified in kb, mb, gb. Just a number indicates it's # in bytes. flow: memcap: 128mb hash-size: 65536 prealloc: 10000 emergency-recovery: 30 #managers: 1 # default to one flow manager #recyclers: 1 # default to one flow recycler thread # This option controls the use of vlan ids in the flow (and defrag) # hashing. Normally this should be enabled, but in some (broken) # setups where both sides of a flow are not tagged with the same vlan # tag, we can ignore the vlan id's in the flow hashing. vlan: use-for-tracking: true # Specific timeouts for flows. Here you can specify the timeouts that the # active flows will wait to transit from the current state to another, on each # protocol. The value of "new" determine the seconds to wait after a hanshake or # stream startup before the engine free the data of that flow it doesn't # change the state to established (usually if we don't receive more packets # of that flow). The value of "established" is the amount of # seconds that the engine will wait to free the flow if it spend that amount # without receiving new packets or closing the connection. "closed" is the # amount of time to wait after a flow is closed (usually zero). "bypassed" # timeout controls locally bypassed flows. For these flows we don't do any other # tracking. If no packets have been seen after this timeout, the flow is discarded. # # There's an emergency mode that will become active under attack circumstances, # making the engine to check flow status faster. This configuration variables # use the prefix "emergency-" and work similar as the normal ones. # Some timeouts doesn't apply to all the protocols, like "closed", for udp and # icmp. flow-timeouts: default: new: 30 established: 300 closed: 0 bypassed: 100 emergency-new: 10 emergency-established: 100 emergency-closed: 0 emergency-bypassed: 50 tcp: new: 60 established: 600 closed: 60 bypassed: 100 emergency-new: 5 emergency-established: 100 emergency-closed: 10 emergency-bypassed: 50 udp: new: 30 established: 300 bypassed: 100 emergency-new: 10 emergency-established: 100 emergency-bypassed: 50 icmp: new: 30 established: 300 bypassed: 100 emergency-new: 10 emergency-established: 100 emergency-bypassed: 50 # Stream engine settings. Here the TCP stream tracking and reassembly # engine is configured. # # stream: # memcap: 32mb # Can be specified in kb, mb, gb. Just a # # number indicates it's in bytes. # checksum-validation: yes # To validate the checksum of received # # packet. If csum validation is specified as # # "yes", then packet with invalid csum will not # # be processed by the engine stream/app layer. # # Warning: locally generated trafic can be # # generated without checksum due to hardware offload # # of checksum. You can control the handling of checksum # # on a per-interface basis via the 'checksum-checks' # # option # prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread # midstream: false # don't allow midstream session pickups # async-oneside: false # don't enable async stream handling # inline: no # stream inline mode # max-synack-queued: 5 # Max different SYN/ACKs to queue # bypass: no # Bypass packets when stream.depth is reached # # reassembly: # memcap: 64mb # Can be specified in kb, mb, gb. Just a number # # indicates it's in bytes. # depth: 1mb # Can be specified in kb, mb, gb. Just a number # # indicates it's in bytes. # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least # # this size. Can be specified in kb, mb, # # gb. Just a number indicates it's in bytes. # # The max acceptable size is 4024 bytes. # toclient-chunk-size: 2560 # inspect raw stream in chunks of at least # # this size. Can be specified in kb, mb, # # gb. Just a number indicates it's in bytes. # # The max acceptable size is 4024 bytes. # randomize-chunk-size: yes # Take a random value for chunk size around the specified value. # # This lower the risk of some evasion technics but could lead # # detection change between runs. It is set to 'yes' by default. # randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is # # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size # # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same # # calculation for toclient-chunk-size. # # Default value of randomize-chunk-range is 10. # # raw: yes # 'Raw' reassembly enabled or disabled. # # raw is for content inspection by detection # # engine. # # chunk-prealloc: 250 # Number of preallocated stream chunks. These # # are used during stream inspection (raw). # segments: # Settings for reassembly segment pool. # - size: 4 # Size of the (data)segment for a pool # prealloc: 256 # Number of segments to prealloc and keep # # in the pool. # zero-copy-size: 128 # This option sets in bytes the value at # # which segment data is passed to the app # # layer API directly. Data sizes equal to # # and higher than the value set are passed # # on directly. # stream: memcap: 64mb checksum-validation: yes # reject wrong csums inline: auto # auto will use inline mode in IPS mode, yes or no set it statically reassembly: memcap: 256mb depth: 1mb # reassemble 1mb into a stream toserver-chunk-size: 2560 toclient-chunk-size: 2560 randomize-chunk-size: yes #randomize-chunk-range: 10 #raw: yes #chunk-prealloc: 250 #segments: # - size: 4 # prealloc: 256 # - size: 16 # prealloc: 512 # - size: 112 # prealloc: 512 # - size: 248 # prealloc: 512 # - size: 512 # prealloc: 512 # - size: 768 # prealloc: 1024 # 'from_mtu' means that the size is mtu - 40, # or 1460 if mtu couldn't be determined. # - size: from_mtu # prealloc: 1024 # - size: 65535 # prealloc: 128 #zero-copy-size: 128 # Host table: # # Host table is used by tagging and per host thresholding subsystems. # host: hash-size: 4096 prealloc: 1000 memcap: 32mb # IP Pair table: # # Used by xbits 'ippair' tracking. # #ippair: # hash-size: 4096 # prealloc: 1000 # memcap: 32mb ## ## Performance tuning and profiling ## # The detection engine builds internal groups of signatures. The engine # allow us to specify the profile to use for them, to manage memory on an # efficient way keeping a good performance. For the profile keyword you # can use the words "low", "medium", "high" or "custom". If you use custom # make sure to define the values at "- custom-values" as your convenience. # Usually you would prefer medium/high/low. # # "sgh mpm-context", indicates how the staging should allot mpm contexts for # the signature groups. "single" indicates the use of a single context for # all the signature group heads. "full" indicates a mpm-context for each # group head. "auto" lets the engine decide the distribution of contexts # based on the information the engine gathers on the patterns from each # group head. # # The option inspection-recursion-limit is used to limit the recursive calls # in the content inspection code. For certain payload-sig combinations, we # might end up taking too much time in the content inspection code. # If the argument specified is 0, the engine uses an internally defined # default limit. On not specifying a value, we use no limits on the recursion. detect: profile: medium custom-values: toclient-groups: 3 toserver-groups: 25 sgh-mpm-context: auto inspection-recursion-limit: 3000 # If set to yes, the loading of signatures will be made after the capture # is started. This will limit the downtime in IPS mode. #delayed-detect: yes prefilter: # default prefiltering setting. "mpm" only creates MPM/fast_pattern # engines. "auto" also sets up prefilter engines for other keywords. # Use --list-keywords=all to see which keywords support prefiltering. default: mpm # the grouping values above control how many groups are created per # direction. Port whitelisting forces that port to get it's own group. # Very common ports will benefit, as well as ports with many expensive # rules. grouping: #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080 #udp-whitelist: 53, 135, 5060 profiling: # Log the rules that made it past the prefilter stage, per packet # default is off. The threshold setting determines how many rules # must have made it past pre-filter for that rule to trigger the # logging. #inspect-logging-threshold: 200 grouping: dump-to-disk: false include-rules: false # very verbose include-mpm-stats: false # Select the multi pattern algorithm you want to run for scan/search the # in the engine. # # The supported algorithms are: # "ac" - Aho-Corasick, default implementation # "ac-bs" - Aho-Corasick, reduced memory implementation # "ac-cuda" - Aho-Corasick, CUDA implementation # "ac-ks" - Aho-Corasick, "Ken Steele" variant # "hs" - Hyperscan, available when built with Hyperscan support # # The default mpm-algo value of "auto" will use "hs" if Hyperscan is # available, "ac" otherwise. # # The mpm you choose also decides the distribution of mpm contexts for # signature groups, specified by the conf - "detect.sgh-mpm-context". # Selecting "ac" as the mpm would require "detect.sgh-mpm-context" # to be set to "single", because of ac's memory requirements, unless the # ruleset is small enough to fit in one's memory, in which case one can # use "full" with "ac". Rest of the mpms can be run in "full" mode. # # There is also a CUDA pattern matcher (only available if Suricata was # compiled with --enable-cuda: b2g_cuda. Make sure to update your # max-pending-packets setting above as well if you use b2g_cuda. mpm-algo: auto # Select the matching algorithm you want to use for single-pattern searches. # # Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only # available if Suricata has been built with Hyperscan support). # # The default of "auto" will use "hs" if available, otherwise "bm". spm-algo: auto # Suricata is multi-threaded. Here the threading can be influenced. threading: set-cpu-affinity: no # Tune cpu affinity of threads. Each family of threads can be bound # on specific CPUs. # # These 2 apply to the all runmodes: # management-cpu-set is used for flow timeout handling, counters # worker-cpu-set is used for 'worker' threads # # Additionally, for autofp these apply: # receive-cpu-set is used for capture threads # verdict-cpu-set is used for IPS verdict threads # cpu-affinity: - management-cpu-set: cpu: [ 0 ] # include only these cpus in affinity settings - receive-cpu-set: cpu: [ 0 ] # include only these cpus in affinity settings - worker-cpu-set: cpu: [ "all" ] mode: "exclusive" # Use explicitely 3 threads and don't compute number by using # detect-thread-ratio variable: # threads: 3 prio: low: [ 0 ] medium: [ "1-2" ] high: [ 3 ] default: "medium" #- verdict-cpu-set: # cpu: [ 0 ] # prio: # default: "high" # # By default Suricata creates one "detect" thread per available CPU/CPU core. # This setting allows controlling this behaviour. A ratio setting of 2 will # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this # will result in 4 detect threads. If values below 1 are used, less threads # are created. So on a dual core CPU a setting of 0.5 results in 1 detect # thread being created. Regardless of the setting at a minimum 1 detect # thread will always be created. # detect-thread-ratio: 1.0 # Luajit has a strange memory requirement, it's 'states' need to be in the # first 2G of the process' memory. # # 'luajit.states' is used to control how many states are preallocated. # State use: per detect script: 1 per detect thread. Per output script: 1 per # script. luajit: states: 128 # Profiling settings. Only effective if Suricata has been built with the # the --enable-profiling configure flag. # profiling: # Run profiling for every xth packet. The default is 1, which means we # profile every packet. If set to 1000, one packet is profiled for every # 1000 received. #sample-rate: 1000 # rule profiling rules: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: rule_perf.log append: yes # Sort options: ticks, avgticks, checks, matches, maxticks sort: avgticks # Limit the number of items printed at exit (ignored for json). limit: 100 # output to json json: @e_enable_evelog@ # per keyword profiling keywords: enabled: yes filename: keyword_perf.log append: yes # per rulegroup profiling rulegroups: enabled: yes filename: rule_group_perf.log append: yes # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv # profiling of locking. Only available when Suricata was built with # --enable-profiling-locks. locks: enabled: no filename: lock_stats.log append: yes pcap-log: enabled: no filename: pcaplog_stats.log append: yes ## ## Netfilter integration ## # When running in NFQ inline mode, it is possible to use a simulated # non-terminal NFQUEUE verdict. # This permit to do send all needed packet to suricata via this a rule: # iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE # And below, you can have your standard filtering ruleset. To activate # this mode, you need to set mode to 'repeat' # If you want packet to be sent to another queue after an ACCEPT decision # set mode to 'route' and set next-queue value. # On linux >= 3.1, you can set batchcount to a value > 1 to improve performance # by processing several packets before sending a verdict (worker runmode only). # On linux >= 3.6, you can set the fail-open option to yes to have the kernel # accept the packet if suricata is not able to keep pace. # bypass mark and mask can be used to implement NFQ bypass. If bypass mark is # set then the NFQ bypass is activated. Suricata will set the bypass mark/mask # on packet of a flow that need to be bypassed. The Nefilter ruleset has to # directly accept all packets of a flow once a packet has been marked. nfq: # mode: accept # repeat-mark: 1 # repeat-mask: 1 # bypass-mark: 1 # bypass-mask: 1 # route-queue: 2 # batchcount: 20 # fail-open: yes #nflog support nflog: # netlink multicast group # (the same as the iptables --nflog-group param) # Group 0 is used by the kernel, so you can't use it - group: 2 # netlink buffer size buffer-size: 18432 # put default value here - group: default # set number of packet to queue inside kernel qthreshold: 1 # set the delay before flushing packet in the queue inside kernel qtimeout: 100 # netlink max buffer size max-size: 20000 ## ## Advanced Capture Options ## # general settings affecting packet capture capture: # disable NIC offloading. It's restored when Suricata exists. # Enabled by default #disable-offloading: false # # disable checksum validation. Same as setting '-k none' on the # commandline #checksum-validation: none # Netmap support # # Netmap operates with NIC directly in driver, so you need FreeBSD wich have # built-in netmap support or compile and install netmap module and appropriate # NIC driver on your Linux system. # To reach maximum throughput disable all receive-, segmentation-, # checksum- offloadings on NIC. # Disabling Tx checksum offloading is *required* for connecting OS endpoint # with NIC endpoint. # You can find more information at https://github.com/luigirizzo/netmap # netmap: # To specify OS endpoint add plus sign at the end (e.g. "eth0+") - interface: eth2 # Number of receive threads. "auto" uses number of RSS queues on interface. #threads: auto # You can use the following variables to activate netmap tap or IPS mode. # If copy-mode is set to ips or tap, the traffic coming to the current # interface will be copied to the copy-iface interface. If 'tap' is set, the # copy is complete. If 'ips' is set, the packet matching a 'drop' action # will not be copied. # To specify the OS as the copy-iface (so the OS can route packets, or forward # to a service running on the same machine) add a plus sign at the end # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0 # for return packets. Hardware checksumming must be *off* on the interface if # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD # or 'ethtool -K eth0 tx off rx off' for Linux). #copy-mode: tap #copy-iface: eth3 # Set to yes to disable promiscuous mode # disable-promisc: no # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. # Warning: 'checksum-validation' must be set to yes to have any validation #checksum-checks: auto # BPF filter to apply to this interface. The pcap filter syntax apply here. #bpf-filter: port 80 or udp #- interface: eth3 #threads: auto #copy-mode: tap #copy-iface: eth2 # Put default values here - interface: default # PF_RING configuration. for use with native PF_RING support # for more info see http://www.ntop.org/products/pf_ring/ pfring: - interface: eth0 # Number of receive threads (>1 will enable experimental flow pinned # runmode) threads: 1 # Default clusterid. PF_RING will load balance packets based on flow. # All threads/processes that will participate need to have the same # clusterid. cluster-id: 99 # Default PF_RING cluster type. PF_RING can load balance per flow. # Possible values are cluster_flow or cluster_round_robin. cluster-type: cluster_flow # bpf filter for this interface #bpf-filter: tcp # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - rxonly: only compute checksum for packets received by network card. # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have any validation #checksum-checks: auto # Second interface #- interface: eth1 # threads: 3 # cluster-id: 93 # cluster-type: cluster_flow # Put default values here - interface: default #threads: 2 # For FreeBSD ipfw(8) divert(4) support. # Please make sure you have ipfw_load="YES" and ipdivert_load="YES" # in /etc/loader.conf or kldload'ing the appropriate kernel modules. # Additionally, you need to have an ipfw rule for the engine to see # the packets from ipfw. For Example: # # ipfw add 100 divert 8000 ip from any to any # # The 8000 above should be the same number you passed on the command # line, i.e. -d 8000 # ipfw: # Reinject packets at the specified ipfw rule number. This config # option is the ipfw rule number AT WHICH rule processing continues # in the ipfw processing system after the engine has finished # inspecting the packet for acceptance. If no rule number is specified, # accepted packets are reinjected at the divert rule which they entered # and IPFW rule processing continues. No check is done to verify # this will rule makes sense so care must be taken to avoid loops in ipfw. # ## The following example tells the engine to reinject packets # back into the ipfw firewall AT rule number 5500: # # ipfw-reinjection-rule-number: 5500 napatech: # The Host Buffer Allowance for all streams # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back) hba: -1 # use_all_streams set to "yes" will query the Napatech service for all configured # streams and listen on all of them. When set to "no" the streams config array # will be used. use-all-streams: yes # The streams to listen on streams: [1, 2, 3] # Tilera mpipe configuration. for use on Tilera TILE-Gx. mpipe: # Load balancing modes: "static", "dynamic", "sticky", or "round-robin". load-balance: dynamic # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536 iqueue-packets: 2048 # List of interfaces we will listen on. inputs: - interface: xgbe2 - interface: xgbe3 - interface: xgbe4 # Relative weight of memory for packets of each mPipe buffer size. stack: size128: 0 size256: 9 size512: 0 size1024: 0 size1664: 7 size4096: 0 size10386: 0 size16384: 0 ## ## Hardware accelaration ## # Cuda configuration. cuda: # The "mpm" profile. On not specifying any of these parameters, the engine's # internal default values are used, which are same as the ones specified in # in the default conf file. mpm: # The minimum length required to buffer data to the gpu. # Anything below this is MPM'ed on the CPU. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes. # A value of 0 indicates there's no limit. data-buffer-size-min-limit: 0 # The maximum length for data that we would buffer to the gpu. # Anything over this is MPM'ed on the CPU. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes. data-buffer-size-max-limit: 1500 # The ring buffer size used by the CudaBuffer API to buffer data. cudabuffer-buffer-size: 500mb # The max chunk size that can be sent to the gpu in a single go. gpu-transfer-size: 50mb # The timeout limit for batching of packets in microseconds. batching-timeout: 2000 # The device to use for the mpm. Currently we don't support load balancing # on multiple gpus. In case you have multiple devices on your system, you # can specify the device to use, using this conf. By default we hold 0, to # specify the first device cuda sees. To find out device-id associated with # the card(s) on the system run "suricata --list-cuda-cards". device-id: 0 # No of Cuda streams used for asynchronous processing. All values > 0 are valid. # For this option you need a device with Compute Capability > 1.0. cuda-streams: 2 ## ## Include other configs ## # Includes. Files included here will be handled as if they were # inlined in this configuration file. #include: include1.yaml #include: include2.yaml suricata-3.2.1/reference.config0000644000000000000000000000253713051004444013346 00000000000000# config reference: system URL config reference: bugtraq http://www.securityfocus.com/bid/ config reference: bid http://www.securityfocus.com/bid/ config reference: cve http://cve.mitre.org/cgi-bin/cvename.cgi?name= #config reference: cve http://cvedetails.com/cve/ config reference: secunia http://www.secunia.com/advisories/ #whitehats is unfortunately gone config reference: arachNIDS http://www.whitehats.com/info/IDS config reference: McAfee http://vil.nai.com/vil/content/v_ config reference: nessus http://cgi.nessus.org/plugins/dump.php3?id= config reference: url http:// config reference: et http://doc.emergingthreats.net/ config reference: etpro http://doc.emergingthreatspro.com/ config reference: telus http:// config reference: osvdb http://osvdb.org/show/osvdb/ config reference: threatexpert http://www.threatexpert.com/report.aspx?md5= config reference: md5 http://www.threatexpert.com/report.aspx?md5= config reference: exploitdb http://www.exploit-db.com/exploits/ config reference: openpacket https://www.openpacket.org/capture/grab/ config reference: securitytracker http://securitytracker.com/id? config reference: secunia http://secunia.com/advisories/ config reference: xforce http://xforce.iss.net/xforce/xfdb/ config reference: msft http://technet.microsoft.com/security/bulletin/ suricata-3.2.1/install-sh0000755000000000000000000003546313051004467012236 00000000000000#!/bin/sh # install - install a program, script, or datafile scriptversion=2014-09-12.12; # UTC # This originates from X11R5 (mit/util/scripts/install.sh), which was # later released in X11R6 (xc/config/util/install.sh) with the # following copyright and license. # # Copyright (C) 1994 X Consortium # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to # deal in the Software without restriction, including without limitation the # rights to use, copy, modify, merge, publish, distribute, sublicense, and/or # sell copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN # AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC- # TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # # Except as contained in this notice, the name of the X Consortium shall not # be used in advertising or otherwise to promote the sale, use or other deal- # ings in this Software without prior written authorization from the X Consor- # tium. # # # FSF changes to this file are in the public domain. # # Calling this script install-sh is preferred over install.sh, to prevent # 'make' implicit rules from creating a file called install from it # when there is no Makefile. # # This script is compatible with the BSD install script, but was written # from scratch. tab=' ' nl=' ' IFS=" $tab$nl" # Set DOITPROG to "echo" to test this script. doit=${DOITPROG-} doit_exec=${doit:-exec} # Put in absolute file names if you don't have them in your path; # or use environment vars. chgrpprog=${CHGRPPROG-chgrp} chmodprog=${CHMODPROG-chmod} chownprog=${CHOWNPROG-chown} cmpprog=${CMPPROG-cmp} cpprog=${CPPROG-cp} mkdirprog=${MKDIRPROG-mkdir} mvprog=${MVPROG-mv} rmprog=${RMPROG-rm} stripprog=${STRIPPROG-strip} posix_mkdir= # Desired mode of installed file. mode=0755 chgrpcmd= chmodcmd=$chmodprog chowncmd= mvcmd=$mvprog rmcmd="$rmprog -f" stripcmd= src= dst= dir_arg= dst_arg= copy_on_change=false is_target_a_directory=possibly usage="\ Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE or: $0 [OPTION]... SRCFILES... DIRECTORY or: $0 [OPTION]... -t DIRECTORY SRCFILES... or: $0 [OPTION]... -d DIRECTORIES... In the 1st form, copy SRCFILE to DSTFILE. In the 2nd and 3rd, copy all SRCFILES to DIRECTORY. In the 4th, create DIRECTORIES. Options: --help display this help and exit. --version display version info and exit. -c (ignored) -C install only if different (preserve the last data modification time) -d create directories instead of installing files. -g GROUP $chgrpprog installed files to GROUP. -m MODE $chmodprog installed files to MODE. -o USER $chownprog installed files to USER. -s $stripprog installed files. -t DIRECTORY install into DIRECTORY. -T report an error if DSTFILE is a directory. Environment variables override the default commands: CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG RMPROG STRIPPROG " while test $# -ne 0; do case $1 in -c) ;; -C) copy_on_change=true;; -d) dir_arg=true;; -g) chgrpcmd="$chgrpprog $2" shift;; --help) echo "$usage"; exit $?;; -m) mode=$2 case $mode in *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*) echo "$0: invalid mode: $mode" >&2 exit 1;; esac shift;; -o) chowncmd="$chownprog $2" shift;; -s) stripcmd=$stripprog;; -t) is_target_a_directory=always dst_arg=$2 # Protect names problematic for 'test' and other utilities. case $dst_arg in -* | [=\(\)!]) dst_arg=./$dst_arg;; esac shift;; -T) is_target_a_directory=never;; --version) echo "$0 $scriptversion"; exit $?;; --) shift break;; -*) echo "$0: invalid option: $1" >&2 exit 1;; *) break;; esac shift done # We allow the use of options -d and -T together, by making -d # take the precedence; this is for compatibility with GNU install. if test -n "$dir_arg"; then if test -n "$dst_arg"; then echo "$0: target directory not allowed when installing a directory." >&2 exit 1 fi fi if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then # When -d is used, all remaining arguments are directories to create. # When -t is used, the destination is already specified. # Otherwise, the last argument is the destination. Remove it from $@. for arg do if test -n "$dst_arg"; then # $@ is not empty: it contains at least $arg. set fnord "$@" "$dst_arg" shift # fnord fi shift # arg dst_arg=$arg # Protect names problematic for 'test' and other utilities. case $dst_arg in -* | [=\(\)!]) dst_arg=./$dst_arg;; esac done fi if test $# -eq 0; then if test -z "$dir_arg"; then echo "$0: no input file specified." >&2 exit 1 fi # It's OK to call 'install-sh -d' without argument. # This can happen when creating conditional directories. exit 0 fi if test -z "$dir_arg"; then if test $# -gt 1 || test "$is_target_a_directory" = always; then if test ! -d "$dst_arg"; then echo "$0: $dst_arg: Is not a directory." >&2 exit 1 fi fi fi if test -z "$dir_arg"; then do_exit='(exit $ret); exit $ret' trap "ret=129; $do_exit" 1 trap "ret=130; $do_exit" 2 trap "ret=141; $do_exit" 13 trap "ret=143; $do_exit" 15 # Set umask so as not to create temps with too-generous modes. # However, 'strip' requires both read and write access to temps. case $mode in # Optimize common cases. *644) cp_umask=133;; *755) cp_umask=22;; *[0-7]) if test -z "$stripcmd"; then u_plus_rw= else u_plus_rw='% 200' fi cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;; *) if test -z "$stripcmd"; then u_plus_rw= else u_plus_rw=,u+rw fi cp_umask=$mode$u_plus_rw;; esac fi for src do # Protect names problematic for 'test' and other utilities. case $src in -* | [=\(\)!]) src=./$src;; esac if test -n "$dir_arg"; then dst=$src dstdir=$dst test -d "$dstdir" dstdir_status=$? else # Waiting for this to be detected by the "$cpprog $src $dsttmp" command # might cause directories to be created, which would be especially bad # if $src (and thus $dsttmp) contains '*'. if test ! -f "$src" && test ! -d "$src"; then echo "$0: $src does not exist." >&2 exit 1 fi if test -z "$dst_arg"; then echo "$0: no destination specified." >&2 exit 1 fi dst=$dst_arg # If destination is a directory, append the input filename; won't work # if double slashes aren't ignored. if test -d "$dst"; then if test "$is_target_a_directory" = never; then echo "$0: $dst_arg: Is a directory" >&2 exit 1 fi dstdir=$dst dst=$dstdir/`basename "$src"` dstdir_status=0 else dstdir=`dirname "$dst"` test -d "$dstdir" dstdir_status=$? fi fi obsolete_mkdir_used=false if test $dstdir_status != 0; then case $posix_mkdir in '') # Create intermediate dirs using mode 755 as modified by the umask. # This is like FreeBSD 'install' as of 1997-10-28. umask=`umask` case $stripcmd.$umask in # Optimize common cases. *[2367][2367]) mkdir_umask=$umask;; .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;; *[0-7]) mkdir_umask=`expr $umask + 22 \ - $umask % 100 % 40 + $umask % 20 \ - $umask % 10 % 4 + $umask % 2 `;; *) mkdir_umask=$umask,go-w;; esac # With -d, create the new directory with the user-specified mode. # Otherwise, rely on $mkdir_umask. if test -n "$dir_arg"; then mkdir_mode=-m$mode else mkdir_mode= fi posix_mkdir=false case $umask in *[123567][0-7][0-7]) # POSIX mkdir -p sets u+wx bits regardless of umask, which # is incompatible with FreeBSD 'install' when (umask & 300) != 0. ;; *) # $RANDOM is not portable (e.g. dash); use it when possible to # lower collision chance tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$ trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0 # As "mkdir -p" follows symlinks and we work in /tmp possibly; so # create the $tmpdir first (and fail if unsuccessful) to make sure # that nobody tries to guess the $tmpdir name. if (umask $mkdir_umask && $mkdirprog $mkdir_mode "$tmpdir" && exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1 then if test -z "$dir_arg" || { # Check for POSIX incompatibilities with -m. # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or # other-writable bit of parent directory when it shouldn't. # FreeBSD 6.1 mkdir -m -p sets mode of existing directory. test_tmpdir="$tmpdir/a" ls_ld_tmpdir=`ls -ld "$test_tmpdir"` case $ls_ld_tmpdir in d????-?r-*) different_mode=700;; d????-?--*) different_mode=755;; *) false;; esac && $mkdirprog -m$different_mode -p -- "$test_tmpdir" && { ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"` test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1" } } then posix_mkdir=: fi rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" else # Remove any dirs left behind by ancient mkdir implementations. rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null fi trap '' 0;; esac;; esac if $posix_mkdir && ( umask $mkdir_umask && $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir" ) then : else # The umask is ridiculous, or mkdir does not conform to POSIX, # or it failed possibly due to a race condition. Create the # directory the slow way, step by step, checking for races as we go. case $dstdir in /*) prefix='/';; [-=\(\)!]*) prefix='./';; *) prefix='';; esac oIFS=$IFS IFS=/ set -f set fnord $dstdir shift set +f IFS=$oIFS prefixes= for d do test X"$d" = X && continue prefix=$prefix$d if test -d "$prefix"; then prefixes= else if $posix_mkdir; then (umask=$mkdir_umask && $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break # Don't fail if two instances are running concurrently. test -d "$prefix" || exit 1 else case $prefix in *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;; *) qprefix=$prefix;; esac prefixes="$prefixes '$qprefix'" fi fi prefix=$prefix/ done if test -n "$prefixes"; then # Don't fail if two instances are running concurrently. (umask $mkdir_umask && eval "\$doit_exec \$mkdirprog $prefixes") || test -d "$dstdir" || exit 1 obsolete_mkdir_used=true fi fi fi if test -n "$dir_arg"; then { test -z "$chowncmd" || $doit $chowncmd "$dst"; } && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } && { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false || test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1 else # Make a couple of temp file names in the proper directory. dsttmp=$dstdir/_inst.$$_ rmtmp=$dstdir/_rm.$$_ # Trap to clean up those temp files at exit. trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0 # Copy the file name to the temp name. (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") && # and set any options; do chmod last to preserve setuid bits. # # If any of these fail, we abort the whole thing. If we want to # ignore errors from any of these, just make sure not to ignore # errors from the above "$doit $cpprog $src $dsttmp" command. # { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } && { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } && { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } && # If -C, don't bother to copy if it wouldn't change the file. if $copy_on_change && old=`LC_ALL=C ls -dlL "$dst" 2>/dev/null` && new=`LC_ALL=C ls -dlL "$dsttmp" 2>/dev/null` && set -f && set X $old && old=:$2:$4:$5:$6 && set X $new && new=:$2:$4:$5:$6 && set +f && test "$old" = "$new" && $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1 then rm -f "$dsttmp" else # Rename the file to the real destination. $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null || # The rename failed, perhaps because mv can't rename something else # to itself, or perhaps because mv is so ancient that it does not # support -f. { # Now remove or move aside any old file at destination location. # We try this two ways since rm can't unlink itself on some # systems and the destination file might be busy for other # reasons. In this case, the final cleanup might fail but the new # file should still install successfully. { test ! -f "$dst" || $doit $rmcmd -f "$dst" 2>/dev/null || { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null && { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; } } || { echo "$0: cannot unlink or rename $dst" >&2 (exit 1); exit 1 } } && # Now rename the file to the real destination. $doit $mvcmd "$dsttmp" "$dst" } fi || exit 1 trap '' 0 fi done # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/config.sub0000755000000000000000000010646013051004467012211 00000000000000#! /bin/sh # Configuration validation subroutine script. # Copyright 1992-2015 Free Software Foundation, Inc. timestamp='2015-08-20' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # Please send patches to . # # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. # If it is invalid, we print an error message on stderr and exit with code 1. # Otherwise, we print the canonical config type on stdout and succeed. # You can get the latest version of this script from: # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases # that are meaningful with *any* GNU software. # Each package is responsible for reporting which valid configurations # it does not support. The user should be able to distinguish # a failure to support a valid configuration from a meaningless # configuration. # The goal of this file is to map all the various variations of a given # machine specification into a single specification in the form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM # or in some cases, the newer four-part form: # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. me=`echo "$0" | sed -e 's,.*/,,'` usage="\ Usage: $0 [OPTION] CPU-MFR-OPSYS $0 [OPTION] ALIAS Canonicalize a configuration name. Operation modes: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.sub ($timestamp) Copyright 1992-2015 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" exit 1 ;; *local*) # First pass through any local machine types. echo $1 exit ;; * ) break ;; esac done case $# in 0) echo "$me: missing argument$help" >&2 exit 1;; 1) ;; *) echo "$me: too many arguments$help" >&2 exit 1;; esac # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any). # Here we must recognize all the valid KERNEL-OS combinations. maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` case $maybe_os in nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \ linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \ knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \ kopensolaris*-gnu* | \ storm-chaos* | os2-emx* | rtmk-nova*) os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; android-linux) os=-linux-android basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] then os=`echo $1 | sed 's/.*-/-/'` else os=; fi ;; esac ### Let's recognize common machines as not being operating systems so ### that things like config.sub decstation-3100 work. We also ### recognize some manufacturers as not being operating systems, so we ### can provide default operating systems below. case $os in -sun*os*) # Prevent following clause from handling this invalid input. ;; -dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \ -att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \ -unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \ -convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\ -c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \ -harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \ -apple | -axis | -knuth | -cray | -microblaze*) os= basic_machine=$1 ;; -bluegene*) os=-cnk ;; -sim | -cisco | -oki | -wec | -winbond) os= basic_machine=$1 ;; -scout) ;; -wrs) os=-vxworks basic_machine=$1 ;; -chorusos*) os=-chorusos basic_machine=$1 ;; -chorusrdb) os=-chorusrdb basic_machine=$1 ;; -hiux*) os=-hiuxwe2 ;; -sco6) os=-sco5v6 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco5) os=-sco3.2v5 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco4) os=-sco3.2v4 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2.[4-9]*) os=`echo $os | sed -e 's/sco3.2./sco3.2v/'` basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2v[4-9]*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco5v6*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco*) os=-sco3.2v2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -udk*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -isc) os=-isc2.2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -clix*) basic_machine=clipper-intergraph ;; -isc*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -lynx*178) os=-lynxos178 ;; -lynx*5) os=-lynxos5 ;; -lynx*) os=-lynxos ;; -ptx*) basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'` ;; -windowsnt*) os=`echo $os | sed -e 's/windowsnt/winnt/'` ;; -psos*) os=-psos ;; -mint | -mint[0-9]*) basic_machine=m68k-atari os=-mint ;; esac # Decode aliases for certain CPU-COMPANY combinations. case $basic_machine in # Recognize the basic CPU types without company name. # Some are omitted here because they have special meanings below. 1750a | 580 \ | a29k \ | aarch64 | aarch64_be \ | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ | am33_2.0 \ | arc | arceb \ | arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \ | avr | avr32 \ | ba \ | be32 | be64 \ | bfin \ | c4x | c8051 | clipper \ | d10v | d30v | dlx | dsp16xx \ | e2k | epiphany \ | fido | fr30 | frv | ft32 \ | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ | k1om \ | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ | mips | mipsbe | mipseb | mipsel | mipsle \ | mips16 \ | mips64 | mips64el \ | mips64octeon | mips64octeonel \ | mips64orion | mips64orionel \ | mips64r5900 | mips64r5900el \ | mips64vr | mips64vrel \ | mips64vr4100 | mips64vr4100el \ | mips64vr4300 | mips64vr4300el \ | mips64vr5000 | mips64vr5000el \ | mips64vr5900 | mips64vr5900el \ | mipsisa32 | mipsisa32el \ | mipsisa32r2 | mipsisa32r2el \ | mipsisa32r6 | mipsisa32r6el \ | mipsisa64 | mipsisa64el \ | mipsisa64r2 | mipsisa64r2el \ | mipsisa64r6 | mipsisa64r6el \ | mipsisa64sb1 | mipsisa64sb1el \ | mipsisa64sr71k | mipsisa64sr71kel \ | mipsr5900 | mipsr5900el \ | mipstx39 | mipstx39el \ | mn10200 | mn10300 \ | moxie \ | mt \ | msp430 \ | nds32 | nds32le | nds32be \ | nios | nios2 | nios2eb | nios2el \ | ns16k | ns32k \ | open8 | or1k | or1knd | or32 \ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ | riscv32 | riscv64 \ | rl78 | rx \ | score \ | sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \ | sh64 | sh64le \ | sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \ | sparcv8 | sparcv9 | sparcv9b | sparcv9v \ | spu \ | tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \ | ubicom32 \ | v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \ | visium \ | we32k \ | x86 | xc16x | xstormy16 | xtensa \ | z8k | z80) basic_machine=$basic_machine-unknown ;; c54x) basic_machine=tic54x-unknown ;; c55x) basic_machine=tic55x-unknown ;; c6x) basic_machine=tic6x-unknown ;; leon|leon[3-9]) basic_machine=sparc-$basic_machine ;; m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip) basic_machine=$basic_machine-unknown os=-none ;; m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k) ;; ms1) basic_machine=mt-unknown ;; strongarm | thumb | xscale) basic_machine=arm-unknown ;; xgate) basic_machine=$basic_machine-unknown os=-none ;; xscaleeb) basic_machine=armeb-unknown ;; xscaleel) basic_machine=armel-unknown ;; # We use `pc' rather than `unknown' # because (1) that's what they normally are, and # (2) the word "unknown" tends to confuse beginning users. i*86 | x86_64) basic_machine=$basic_machine-pc ;; # Object if more than one company name word. *-*-*) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; # Recognize the basic CPU types with company name. 580-* \ | a29k-* \ | aarch64-* | aarch64_be-* \ | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ | avr-* | avr32-* \ | ba-* \ | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ | c8051-* | clipper-* | craynv-* | cydra-* \ | d10v-* | d30v-* | dlx-* \ | e2k-* | elxsi-* \ | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ | h8300-* | h8500-* \ | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ | k1om-* \ | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ | microblaze-* | microblazeel-* \ | mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \ | mips16-* \ | mips64-* | mips64el-* \ | mips64octeon-* | mips64octeonel-* \ | mips64orion-* | mips64orionel-* \ | mips64r5900-* | mips64r5900el-* \ | mips64vr-* | mips64vrel-* \ | mips64vr4100-* | mips64vr4100el-* \ | mips64vr4300-* | mips64vr4300el-* \ | mips64vr5000-* | mips64vr5000el-* \ | mips64vr5900-* | mips64vr5900el-* \ | mipsisa32-* | mipsisa32el-* \ | mipsisa32r2-* | mipsisa32r2el-* \ | mipsisa32r6-* | mipsisa32r6el-* \ | mipsisa64-* | mipsisa64el-* \ | mipsisa64r2-* | mipsisa64r2el-* \ | mipsisa64r6-* | mipsisa64r6el-* \ | mipsisa64sb1-* | mipsisa64sb1el-* \ | mipsisa64sr71k-* | mipsisa64sr71kel-* \ | mipsr5900-* | mipsr5900el-* \ | mipstx39-* | mipstx39el-* \ | mmix-* \ | mt-* \ | msp430-* \ | nds32-* | nds32le-* | nds32be-* \ | nios-* | nios2-* | nios2eb-* | nios2el-* \ | none-* | np1-* | ns16k-* | ns32k-* \ | open8-* \ | or1k*-* \ | orion-* \ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ | pyramid-* \ | riscv32-* | riscv64-* \ | rl78-* | romp-* | rs6000-* | rx-* \ | sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \ | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ | sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \ | sparclite-* \ | sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \ | tahoe-* \ | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \ | tile*-* \ | tron-* \ | ubicom32-* \ | v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \ | vax-* \ | visium-* \ | we32k-* \ | x86-* | x86_64-* | xc16x-* | xps100-* \ | xstormy16-* | xtensa*-* \ | ymp-* \ | z8k-* | z80-*) ;; # Recognize the basic CPU types without company name, with glob match. xtensa*) basic_machine=$basic_machine-unknown ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. 386bsd) basic_machine=i386-unknown os=-bsd ;; 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) basic_machine=m68000-att ;; 3b*) basic_machine=we32k-att ;; a29khif) basic_machine=a29k-amd os=-udi ;; abacus) basic_machine=abacus-unknown ;; adobe68k) basic_machine=m68010-adobe os=-scout ;; alliant | fx80) basic_machine=fx80-alliant ;; altos | altos3068) basic_machine=m68k-altos ;; am29k) basic_machine=a29k-none os=-bsd ;; amd64) basic_machine=x86_64-pc ;; amd64-*) basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'` ;; amdahl) basic_machine=580-amdahl os=-sysv ;; amiga | amiga-*) basic_machine=m68k-unknown ;; amigaos | amigados) basic_machine=m68k-unknown os=-amigaos ;; amigaunix | amix) basic_machine=m68k-unknown os=-sysv4 ;; apollo68) basic_machine=m68k-apollo os=-sysv ;; apollo68bsd) basic_machine=m68k-apollo os=-bsd ;; aros) basic_machine=i386-pc os=-aros ;; asmjs) basic_machine=asmjs-unknown ;; aux) basic_machine=m68k-apple os=-aux ;; balance) basic_machine=ns32k-sequent os=-dynix ;; blackfin) basic_machine=bfin-unknown os=-linux ;; blackfin-*) basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; bluegene*) basic_machine=powerpc-ibm os=-cnk ;; c54x-*) basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c55x-*) basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c6x-*) basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c90) basic_machine=c90-cray os=-unicos ;; cegcc) basic_machine=arm-unknown os=-cegcc ;; convex-c1) basic_machine=c1-convex os=-bsd ;; convex-c2) basic_machine=c2-convex os=-bsd ;; convex-c32) basic_machine=c32-convex os=-bsd ;; convex-c34) basic_machine=c34-convex os=-bsd ;; convex-c38) basic_machine=c38-convex os=-bsd ;; cray | j90) basic_machine=j90-cray os=-unicos ;; craynv) basic_machine=craynv-cray os=-unicosmp ;; cr16 | cr16-*) basic_machine=cr16-unknown os=-elf ;; crds | unos) basic_machine=m68k-crds ;; crisv32 | crisv32-* | etraxfs*) basic_machine=crisv32-axis ;; cris | cris-* | etrax*) basic_machine=cris-axis ;; crx) basic_machine=crx-unknown os=-elf ;; da30 | da30-*) basic_machine=m68k-da30 ;; decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) basic_machine=mips-dec ;; decsystem10* | dec10*) basic_machine=pdp10-dec os=-tops10 ;; decsystem20* | dec20*) basic_machine=pdp10-dec os=-tops20 ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) basic_machine=m68k-motorola ;; delta88) basic_machine=m88k-motorola os=-sysv3 ;; dicos) basic_machine=i686-pc os=-dicos ;; djgpp) basic_machine=i586-pc os=-msdosdjgpp ;; dpx20 | dpx20-*) basic_machine=rs6000-bull os=-bosx ;; dpx2* | dpx2*-bull) basic_machine=m68k-bull os=-sysv3 ;; ebmon29k) basic_machine=a29k-amd os=-ebmon ;; elxsi) basic_machine=elxsi-elxsi os=-bsd ;; encore | umax | mmax) basic_machine=ns32k-encore ;; es1800 | OSE68k | ose68k | ose | OSE) basic_machine=m68k-ericsson os=-ose ;; fx2800) basic_machine=i860-alliant ;; genix) basic_machine=ns32k-ns ;; gmicro) basic_machine=tron-gmicro os=-sysv ;; go32) basic_machine=i386-pc os=-go32 ;; h3050r* | hiux*) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; h8300hms) basic_machine=h8300-hitachi os=-hms ;; h8300xray) basic_machine=h8300-hitachi os=-xray ;; h8500hms) basic_machine=h8500-hitachi os=-hms ;; harris) basic_machine=m88k-harris os=-sysv3 ;; hp300-*) basic_machine=m68k-hp ;; hp300bsd) basic_machine=m68k-hp os=-bsd ;; hp300hpux) basic_machine=m68k-hp os=-hpux ;; hp3k9[0-9][0-9] | hp9[0-9][0-9]) basic_machine=hppa1.0-hp ;; hp9k2[0-9][0-9] | hp9k31[0-9]) basic_machine=m68000-hp ;; hp9k3[2-9][0-9]) basic_machine=m68k-hp ;; hp9k6[0-9][0-9] | hp6[0-9][0-9]) basic_machine=hppa1.0-hp ;; hp9k7[0-79][0-9] | hp7[0-79][0-9]) basic_machine=hppa1.1-hp ;; hp9k78[0-9] | hp78[0-9]) # FIXME: really hppa2.0-hp basic_machine=hppa1.1-hp ;; hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893) # FIXME: really hppa2.0-hp basic_machine=hppa1.1-hp ;; hp9k8[0-9][13679] | hp8[0-9][13679]) basic_machine=hppa1.1-hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) basic_machine=hppa1.0-hp ;; hppa-next) os=-nextstep3 ;; hppaosf) basic_machine=hppa1.1-hp os=-osf ;; hppro) basic_machine=hppa1.1-hp os=-proelf ;; i370-ibm* | ibm*) basic_machine=i370-ibm ;; i*86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 ;; i*86v4*) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv4 ;; i*86v) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv ;; i*86sol2) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-solaris2 ;; i386mach) basic_machine=i386-mach os=-mach ;; i386-vsta | vsta) basic_machine=i386-unknown os=-vsta ;; iris | iris4d) basic_machine=mips-sgi case $os in -irix*) ;; *) os=-irix4 ;; esac ;; isi68 | isi) basic_machine=m68k-isi os=-sysv ;; leon-*|leon[3-9]-*) basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'` ;; m68knommu) basic_machine=m68k-unknown os=-linux ;; m68knommu-*) basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; m88k-omron*) basic_machine=m88k-omron ;; magnum | m3230) basic_machine=mips-mips os=-sysv ;; merlin) basic_machine=ns32k-utek os=-sysv ;; microblaze*) basic_machine=microblaze-xilinx ;; mingw64) basic_machine=x86_64-pc os=-mingw64 ;; mingw32) basic_machine=i686-pc os=-mingw32 ;; mingw32ce) basic_machine=arm-unknown os=-mingw32ce ;; miniframe) basic_machine=m68000-convergent ;; *mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*) basic_machine=m68k-atari os=-mint ;; mips3*-*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` ;; mips3*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown ;; monitor) basic_machine=m68k-rom68k os=-coff ;; morphos) basic_machine=powerpc-unknown os=-morphos ;; moxiebox) basic_machine=moxie-unknown os=-moxiebox ;; msdos) basic_machine=i386-pc os=-msdos ;; ms1-*) basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; msys) basic_machine=i686-pc os=-msys ;; mvs) basic_machine=i370-ibm os=-mvs ;; nacl) basic_machine=le32-unknown os=-nacl ;; ncr3000) basic_machine=i486-ncr os=-sysv4 ;; netbsd386) basic_machine=i386-unknown os=-netbsd ;; netwinder) basic_machine=armv4l-rebel os=-linux ;; news | news700 | news800 | news900) basic_machine=m68k-sony os=-newsos ;; news1000) basic_machine=m68030-sony os=-newsos ;; news-3600 | risc-news) basic_machine=mips-sony os=-newsos ;; necv70) basic_machine=v70-nec os=-sysv ;; next | m*-next ) basic_machine=m68k-next case $os in -nextstep* ) ;; -ns2*) os=-nextstep2 ;; *) os=-nextstep3 ;; esac ;; nh3000) basic_machine=m68k-harris os=-cxux ;; nh[45]000) basic_machine=m88k-harris os=-cxux ;; nindy960) basic_machine=i960-intel os=-nindy ;; mon960) basic_machine=i960-intel os=-mon960 ;; nonstopux) basic_machine=mips-compaq os=-nonstopux ;; np1) basic_machine=np1-gould ;; neo-tandem) basic_machine=neo-tandem ;; nse-tandem) basic_machine=nse-tandem ;; nsr-tandem) basic_machine=nsr-tandem ;; op50n-* | op60c-*) basic_machine=hppa1.1-oki os=-proelf ;; openrisc | openrisc-*) basic_machine=or32-unknown ;; os400) basic_machine=powerpc-ibm os=-os400 ;; OSE68000 | ose68000) basic_machine=m68000-ericsson os=-ose ;; os68k) basic_machine=m68k-none os=-os68k ;; pa-hitachi) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; paragon) basic_machine=i860-intel os=-osf ;; parisc) basic_machine=hppa-unknown os=-linux ;; parisc-*) basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; pbd) basic_machine=sparc-tti ;; pbb) basic_machine=m68k-tti ;; pc532 | pc532-*) basic_machine=ns32k-pc532 ;; pc98) basic_machine=i386-pc ;; pc98-*) basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentium | p5 | k5 | k6 | nexgen | viac3) basic_machine=i586-pc ;; pentiumpro | p6 | 6x86 | athlon | athlon_*) basic_machine=i686-pc ;; pentiumii | pentium2 | pentiumiii | pentium3) basic_machine=i686-pc ;; pentium4) basic_machine=i786-pc ;; pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*) basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumpro-* | p6-* | 6x86-* | athlon-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentium4-*) basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pn) basic_machine=pn-gould ;; power) basic_machine=power-ibm ;; ppc | ppcbe) basic_machine=powerpc-unknown ;; ppc-* | ppcbe-*) basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppcle | powerpclittle | ppc-le | powerpc-little) basic_machine=powerpcle-unknown ;; ppcle-* | powerpclittle-*) basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64) basic_machine=powerpc64-unknown ;; ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64le | powerpc64little | ppc64-le | powerpc64-little) basic_machine=powerpc64le-unknown ;; ppc64le-* | powerpc64little-*) basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ps2) basic_machine=i386-ibm ;; pw32) basic_machine=i586-unknown os=-pw32 ;; rdos | rdos64) basic_machine=x86_64-pc os=-rdos ;; rdos32) basic_machine=i386-pc os=-rdos ;; rom68k) basic_machine=m68k-rom68k os=-coff ;; rm[46]00) basic_machine=mips-siemens ;; rtpc | rtpc-*) basic_machine=romp-ibm ;; s390 | s390-*) basic_machine=s390-ibm ;; s390x | s390x-*) basic_machine=s390x-ibm ;; sa29200) basic_machine=a29k-amd os=-udi ;; sb1) basic_machine=mipsisa64sb1-unknown ;; sb1el) basic_machine=mipsisa64sb1el-unknown ;; sde) basic_machine=mipsisa32-sde os=-elf ;; sei) basic_machine=mips-sei os=-seiux ;; sequent) basic_machine=i386-sequent ;; sh) basic_machine=sh-hitachi os=-hms ;; sh5el) basic_machine=sh5le-unknown ;; sh64) basic_machine=sh64-unknown ;; sparclite-wrs | simso-wrs) basic_machine=sparclite-wrs os=-vxworks ;; sps7) basic_machine=m68k-bull os=-sysv2 ;; spur) basic_machine=spur-unknown ;; st2000) basic_machine=m68k-tandem ;; stratus) basic_machine=i860-stratus os=-sysv4 ;; strongarm-* | thumb-*) basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'` ;; sun2) basic_machine=m68000-sun ;; sun2os3) basic_machine=m68000-sun os=-sunos3 ;; sun2os4) basic_machine=m68000-sun os=-sunos4 ;; sun3os3) basic_machine=m68k-sun os=-sunos3 ;; sun3os4) basic_machine=m68k-sun os=-sunos4 ;; sun4os3) basic_machine=sparc-sun os=-sunos3 ;; sun4os4) basic_machine=sparc-sun os=-sunos4 ;; sun4sol2) basic_machine=sparc-sun os=-solaris2 ;; sun3 | sun3-*) basic_machine=m68k-sun ;; sun4) basic_machine=sparc-sun ;; sun386 | sun386i | roadrunner) basic_machine=i386-sun ;; sv1) basic_machine=sv1-cray os=-unicos ;; symmetry) basic_machine=i386-sequent os=-dynix ;; t3e) basic_machine=alphaev5-cray os=-unicos ;; t90) basic_machine=t90-cray os=-unicos ;; tile*) basic_machine=$basic_machine-unknown os=-linux-gnu ;; tx39) basic_machine=mipstx39-unknown ;; tx39el) basic_machine=mipstx39el-unknown ;; toad1) basic_machine=pdp10-xkl os=-tops20 ;; tower | tower-32) basic_machine=m68k-ncr ;; tpf) basic_machine=s390x-ibm os=-tpf ;; udi29k) basic_machine=a29k-amd os=-udi ;; ultra3) basic_machine=a29k-nyu os=-sym1 ;; v810 | necv810) basic_machine=v810-nec os=-none ;; vaxv) basic_machine=vax-dec os=-sysv ;; vms) basic_machine=vax-dec os=-vms ;; vpp*|vx|vx-*) basic_machine=f301-fujitsu ;; vxworks960) basic_machine=i960-wrs os=-vxworks ;; vxworks68) basic_machine=m68k-wrs os=-vxworks ;; vxworks29k) basic_machine=a29k-wrs os=-vxworks ;; w65*) basic_machine=w65-wdc os=-none ;; w89k-*) basic_machine=hppa1.1-winbond os=-proelf ;; xbox) basic_machine=i686-pc os=-mingw32 ;; xps | xps100) basic_machine=xps100-honeywell ;; xscale-* | xscalee[bl]-*) basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'` ;; ymp) basic_machine=ymp-cray os=-unicos ;; z8k-*-coff) basic_machine=z8k-unknown os=-sim ;; z80-*-coff) basic_machine=z80-unknown os=-sim ;; none) basic_machine=none-none os=-none ;; # Here we handle the default manufacturer of certain CPU types. It is in # some cases the only manufacturer, in others, it is the most popular. w89k) basic_machine=hppa1.1-winbond ;; op50n) basic_machine=hppa1.1-oki ;; op60c) basic_machine=hppa1.1-oki ;; romp) basic_machine=romp-ibm ;; mmix) basic_machine=mmix-knuth ;; rs6000) basic_machine=rs6000-ibm ;; vax) basic_machine=vax-dec ;; pdp10) # there are many clones, so DEC is not a safe bet basic_machine=pdp10-unknown ;; pdp11) basic_machine=pdp11-dec ;; we32k) basic_machine=we32k-att ;; sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele) basic_machine=sh-unknown ;; sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v) basic_machine=sparc-sun ;; cydra) basic_machine=cydra-cydrome ;; orion) basic_machine=orion-highlevel ;; orion105) basic_machine=clipper-highlevel ;; mac | mpw | mac-mpw) basic_machine=m68k-apple ;; pmac | pmac-mpw) basic_machine=powerpc-apple ;; *-unknown) # Make sure to match an already-canonicalized machine name. ;; *) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; esac # Here we canonicalize certain aliases for manufacturers. case $basic_machine in *-digital*) basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'` ;; *-commodore*) basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'` ;; *) ;; esac # Decode manufacturer-specific aliases for certain operating systems. if [ x"$os" != x"" ] then case $os in # First match some system type aliases # that might get confused with valid system types. # -solaris* is a basic system type, with this one exception. -auroraux) os=-auroraux ;; -solaris1 | -solaris1.*) os=`echo $os | sed -e 's|solaris1|sunos4|'` ;; -solaris) os=-solaris2 ;; -svr4*) os=-sysv4 ;; -unixware*) os=-sysv4.2uw ;; -gnu/linux*) os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'` ;; # First accept the basic system types. # The portable systems comes first. # Each alternative MUST END IN A *, to match a version number. # -sysv* is not here because it comes later, after sysvr4. -gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \ | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\ | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \ | -sym* | -kopensolaris* | -plan9* \ | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \ | -aos* | -aros* | -cloudabi* | -sortix* \ | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \ | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \ | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \ | -bitrig* | -openbsd* | -solidbsd* \ | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \ | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \ | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -chorusos* | -chorusrdb* | -cegcc* \ | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-musl* | -linux-uclibc* \ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \ | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \ | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \ | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \ | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \ | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \ | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*) # Remember, each alternative MUST END IN *, to match a version number. ;; -qnx*) case $basic_machine in x86-* | i*86-*) ;; *) os=-nto$os ;; esac ;; -nto-qnx*) ;; -nto*) os=`echo $os | sed -e 's|nto|nto-qnx|'` ;; -sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \ | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \ | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*) ;; -mac*) os=`echo $os | sed -e 's|mac|macos|'` ;; -linux-dietlibc) os=-linux-dietlibc ;; -linux*) os=`echo $os | sed -e 's|linux|linux-gnu|'` ;; -sunos5*) os=`echo $os | sed -e 's|sunos5|solaris2|'` ;; -sunos6*) os=`echo $os | sed -e 's|sunos6|solaris3|'` ;; -opened*) os=-openedition ;; -os400*) os=-os400 ;; -wince*) os=-wince ;; -osfrose*) os=-osfrose ;; -osf*) os=-osf ;; -utek*) os=-bsd ;; -dynix*) os=-bsd ;; -acis*) os=-aos ;; -atheos*) os=-atheos ;; -syllable*) os=-syllable ;; -386bsd) os=-bsd ;; -ctix* | -uts*) os=-sysv ;; -nova*) os=-rtmk-nova ;; -ns2 ) os=-nextstep2 ;; -nsk*) os=-nsk ;; # Preserve the version number of sinix5. -sinix5.*) os=`echo $os | sed -e 's|sinix|sysv|'` ;; -sinix*) os=-sysv4 ;; -tpf*) os=-tpf ;; -triton*) os=-sysv3 ;; -oss*) os=-sysv3 ;; -svr4) os=-sysv4 ;; -svr3) os=-sysv3 ;; -sysvr4) os=-sysv4 ;; # This must come after -sysvr4. -sysv*) ;; -ose*) os=-ose ;; -es1800*) os=-ose ;; -xenix) os=-xenix ;; -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) os=-mint ;; -aros*) os=-aros ;; -zvmoe) os=-zvmoe ;; -dicos*) os=-dicos ;; -nacl*) ;; -none) ;; *) # Get rid of the `-' at the beginning of $os. os=`echo $os | sed 's/[^-]*-//'` echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2 exit 1 ;; esac else # Here we handle the default operating systems that come with various machines. # The value should be what the vendor currently ships out the door with their # machine or put another way, the most popular os provided with the machine. # Note that if you're going to try to match "-MANUFACTURER" here (say, # "-sun"), then you have to tell the case statement up towards the top # that MANUFACTURER isn't an operating system. Otherwise, code above # will signal an error saying that MANUFACTURER isn't an operating # system, and we'll never get to this point. case $basic_machine in score-*) os=-elf ;; spu-*) os=-elf ;; *-acorn) os=-riscix1.2 ;; arm*-rebel) os=-linux ;; arm*-semi) os=-aout ;; c4x-* | tic4x-*) os=-coff ;; c8051-*) os=-elf ;; hexagon-*) os=-elf ;; tic54x-*) os=-coff ;; tic55x-*) os=-coff ;; tic6x-*) os=-coff ;; # This must come before the *-dec entry. pdp10-*) os=-tops20 ;; pdp11-*) os=-none ;; *-dec | vax-*) os=-ultrix4.2 ;; m68*-apollo) os=-domain ;; i386-sun) os=-sunos4.0.2 ;; m68000-sun) os=-sunos3 ;; m68*-cisco) os=-aout ;; mep-*) os=-elf ;; mips*-cisco) os=-elf ;; mips*-*) os=-elf ;; or32-*) os=-coff ;; *-tti) # must be before sparc entry or we get the wrong os. os=-sysv3 ;; sparc-* | *-sun) os=-sunos4.1.1 ;; *-be) os=-beos ;; *-haiku) os=-haiku ;; *-ibm) os=-aix ;; *-knuth) os=-mmixware ;; *-wec) os=-proelf ;; *-winbond) os=-proelf ;; *-oki) os=-proelf ;; *-hp) os=-hpux ;; *-hitachi) os=-hiux ;; i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent) os=-sysv ;; *-cbm) os=-amigaos ;; *-dg) os=-dgux ;; *-dolphin) os=-sysv3 ;; m68k-ccur) os=-rtu ;; m88k-omron*) os=-luna ;; *-next ) os=-nextstep ;; *-sequent) os=-ptx ;; *-crds) os=-unos ;; *-ns) os=-genix ;; i370-*) os=-mvs ;; *-next) os=-nextstep3 ;; *-gould) os=-sysv ;; *-highlevel) os=-bsd ;; *-encore) os=-bsd ;; *-sgi) os=-irix ;; *-siemens) os=-sysv4 ;; *-masscomp) os=-rtu ;; f30[01]-fujitsu | f700-fujitsu) os=-uxpv ;; *-rom68k) os=-coff ;; *-*bug) os=-coff ;; *-apple) os=-macos ;; *-atari*) os=-mint ;; *) os=-none ;; esac fi # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. vendor=unknown case $basic_machine in *-unknown) case $os in -riscix*) vendor=acorn ;; -sunos*) vendor=sun ;; -cnk*|-aix*) vendor=ibm ;; -beos*) vendor=be ;; -hpux*) vendor=hp ;; -mpeix*) vendor=hp ;; -hiux*) vendor=hitachi ;; -unos*) vendor=crds ;; -dgux*) vendor=dg ;; -luna*) vendor=omron ;; -genix*) vendor=ns ;; -mvs* | -opened*) vendor=ibm ;; -os400*) vendor=ibm ;; -ptx*) vendor=sequent ;; -tpf*) vendor=ibm ;; -vxsim* | -vxworks* | -windiss*) vendor=wrs ;; -aux*) vendor=apple ;; -hms*) vendor=hitachi ;; -mpw* | -macos*) vendor=apple ;; -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) vendor=atari ;; -vos*) vendor=stratus ;; esac basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"` ;; esac echo $basic_machine$os exit # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: suricata-3.2.1/src/0000755000000000000000000000000013051004503011055 500000000000000suricata-3.2.1/src/host.h0000644000000000000000000001043113051004444012126 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HOST_H__ #define __HOST_H__ #include "decode.h" #include "util-storage.h" /** Spinlocks or Mutex for the flow buckets. */ //#define HRLOCK_SPIN #define HRLOCK_MUTEX #ifdef HRLOCK_SPIN #ifdef HRLOCK_MUTEX #error Cannot enable both HRLOCK_SPIN and HRLOCK_MUTEX #endif #endif #ifdef HRLOCK_SPIN #define HRLOCK_TYPE SCSpinlock #define HRLOCK_INIT(fb) SCSpinInit(&(fb)->lock, 0) #define HRLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->lock) #define HRLOCK_LOCK(fb) SCSpinLock(&(fb)->lock) #define HRLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->lock) #define HRLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->lock) #elif defined HRLOCK_MUTEX #define HRLOCK_TYPE SCMutex #define HRLOCK_INIT(fb) SCMutexInit(&(fb)->lock, NULL) #define HRLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->lock) #define HRLOCK_LOCK(fb) SCMutexLock(&(fb)->lock) #define HRLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->lock) #define HRLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->lock) #else #error Enable HRLOCK_SPIN or HRLOCK_MUTEX #endif typedef struct Host_ { /** host mutex */ SCMutex m; /** host address -- ipv4 or ipv6 */ Address a; /** use cnt, reference counter */ SC_ATOMIC_DECLARE(unsigned int, use_cnt); /** pointers to iprep storage */ void *iprep; /** storage api handle */ Storage *storage; /** hash pointers, protected by hash row mutex/spin */ struct Host_ *hnext; struct Host_ *hprev; /** list pointers, protected by host-queue mutex/spin */ struct Host_ *lnext; struct Host_ *lprev; } Host; typedef struct HostHashRow_ { HRLOCK_TYPE lock; Host *head; Host *tail; } __attribute__((aligned(CLS))) HostHashRow; /** host hash table */ HostHashRow *host_hash; #define HOST_VERBOSE 0 #define HOST_QUIET 1 typedef struct HostConfig_ { uint64_t memcap; uint32_t hash_rand; uint32_t hash_size; uint32_t prealloc; } HostConfig; /** \brief check if a memory alloc would fit in the memcap * * \param size memory allocation size to check * * \retval 1 it fits * \retval 0 no fit */ #define HOST_CHECK_MEMCAP(size) \ ((((uint64_t)SC_ATOMIC_GET(host_memuse) + (uint64_t)(size)) <= host_config.memcap)) #define HostIncrUsecnt(h) \ (void)SC_ATOMIC_ADD((h)->use_cnt, 1) #define HostDecrUsecnt(h) \ (void)SC_ATOMIC_SUB((h)->use_cnt, 1) #define HostReference(dst_h_ptr, h) do { \ if ((h) != NULL) { \ HostIncrUsecnt((h)); \ *(dst_h_ptr) = h; \ } \ } while (0) #define HostDeReference(src_h_ptr) do { \ if (*(src_h_ptr) != NULL) { \ HostDecrUsecnt(*(src_h_ptr)); \ *(src_h_ptr) = NULL; \ } \ } while (0) HostConfig host_config; SC_ATOMIC_DECLARE(unsigned long long int,host_memuse); SC_ATOMIC_DECLARE(unsigned int,host_counter); SC_ATOMIC_DECLARE(unsigned int,host_prune_idx); void HostInitConfig(char quiet); void HostShutdown(void); void HostCleanup(void); Host *HostLookupHostFromHash (Address *); Host *HostGetHostFromHash (Address *); void HostRelease(Host *); void HostLock(Host *); void HostClearMemory(Host *); void HostMoveToSpare(Host *); uint32_t HostSpareQueueGetSize(void); void HostPrintStats (void); void HostRegisterUnittests(void); Host *HostAlloc(); void HostFree(); void HostUnlock(Host *h); #endif /* __HOST_H__ */ suricata-3.2.1/src/source-netmap.c0000644000000000000000000007757113051004444013750 00000000000000/* Copyright (C) 2011-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup netmap Netmap running mode * * @{ */ /** * \file * * \author Aleksey Katargin * * Netmap socket acquisition support * */ #include "suricata-common.h" #include "config.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-modules.h" #include "tm-threads.h" #include "tm-threads-common.h" #include "conf.h" #include "util-debug.h" #include "util-device.h" #include "util-error.h" #include "util-privs.h" #include "util-optimize.h" #include "util-checksum.h" #include "util-ioctl.h" #include "util-host-info.h" #include "tmqh-packetpool.h" #include "source-netmap.h" #include "runmodes.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda.h" #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #include "util-cuda-handlers.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ #ifdef HAVE_NETMAP #if HAVE_SYS_IOCTL_H #include #endif #if HAVE_SYS_MMAN_H #include #endif #include #endif /* HAVE_NETMAP */ #include "util-ioctl.h" extern intmax_t max_pending_packets; #ifndef HAVE_NETMAP TmEcode NoNetmapSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveNetmapRegister (void) { tmm_modules[TMM_RECEIVENETMAP].name = "ReceiveNetmap"; tmm_modules[TMM_RECEIVENETMAP].ThreadInit = NoNetmapSupportExit; tmm_modules[TMM_RECEIVENETMAP].Func = NULL; tmm_modules[TMM_RECEIVENETMAP].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVENETMAP].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVENETMAP].RegisterTests = NULL; tmm_modules[TMM_RECEIVENETMAP].cap_flags = 0; tmm_modules[TMM_RECEIVENETMAP].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for DecodeNetmap. * \todo Unit tests are needed for this module. */ void TmModuleDecodeNetmapRegister (void) { tmm_modules[TMM_DECODENETMAP].name = "DecodeNetmap"; tmm_modules[TMM_DECODENETMAP].ThreadInit = NoNetmapSupportExit; tmm_modules[TMM_DECODENETMAP].Func = NULL; tmm_modules[TMM_DECODENETMAP].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENETMAP].ThreadDeinit = NULL; tmm_modules[TMM_DECODENETMAP].RegisterTests = NULL; tmm_modules[TMM_DECODENETMAP].cap_flags = 0; tmm_modules[TMM_DECODENETMAP].flags = TM_FLAG_DECODE_TM; } /** * \brief this function prints an error message and exits. */ TmEcode NoNetmapSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NO_NETMAP,"Error creating thread %s: you do not have " "support for netmap enabled, please recompile " "with --enable-netmap", tv->name); exit(EXIT_FAILURE); } #else /* We have NETMAP support */ #define max(a, b) (((a) > (b)) ? (a) : (b)) #define POLL_TIMEOUT 100 #if defined(__linux__) #define POLL_EVENTS (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL) #ifndef IFF_PPROMISC #define IFF_PPROMISC IFF_PROMISC #endif #else #define POLL_EVENTS (POLLHUP|POLLERR|POLLNVAL) #endif enum { NETMAP_OK, NETMAP_FAILURE, }; enum { NETMAP_FLAG_ZERO_COPY = 1, }; /** * \brief Netmap ring isntance. */ typedef struct NetmapRing { int fd; struct netmap_ring *rx; struct netmap_ring *tx; int dst_ring_from; int dst_ring_to; int dst_next_ring; SCSpinlock tx_lock; } NetmapRing; /** * \brief Netmap device instance. */ typedef struct NetmapDevice_ { char ifname[IFNAMSIZ]; void *mem; size_t memsize; struct netmap_if *nif; int rings_cnt; int rx_rings_cnt; int tx_rings_cnt; /* hw rings + sw ring */ NetmapRing *rings; unsigned int ref; SC_ATOMIC_DECLARE(unsigned int, threads_run); TAILQ_ENTRY(NetmapDevice_) next; } NetmapDevice; /** * \brief Module thread local variables. */ typedef struct NetmapThreadVars_ { /* receive inteface */ NetmapDevice *ifsrc; /* dst interface for IPS mode */ NetmapDevice *ifdst; int src_ring_from; int src_ring_to; int thread_idx; int flags; struct bpf_program bpf_prog; /* internal shit */ TmSlot *slot; ThreadVars *tv; LiveDevice *livedev; /* copy from config */ int copy_mode; ChecksumValidationMode checksum_mode; /* counters */ uint64_t pkts; uint64_t bytes; uint64_t drops; uint16_t capture_kernel_packets; uint16_t capture_kernel_drops; } NetmapThreadVars; typedef TAILQ_HEAD(NetmapDeviceList_, NetmapDevice_) NetmapDeviceList; static NetmapDeviceList netmap_devlist = TAILQ_HEAD_INITIALIZER(netmap_devlist); static SCMutex netmap_devlist_lock = SCMUTEX_INITIALIZER; /** \brief get RSS RX-queue count * \retval rx_rings RSS RX queue count or 1 on error */ int NetmapGetRSSCount(const char *ifname) { struct nmreq nm_req; int rx_rings = 1; SCMutexLock(&netmap_devlist_lock); /* open netmap */ int fd = open("/dev/netmap", O_RDWR); if (fd == -1) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't open netmap device, error %s", strerror(errno)); goto error_open; } /* query netmap info */ memset(&nm_req, 0, sizeof(nm_req)); strlcpy(nm_req.nr_name, ifname, sizeof(nm_req.nr_name)); nm_req.nr_version = NETMAP_API; if (ioctl(fd, NIOCGINFO, &nm_req) != 0) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't query netmap for %s, error %s", ifname, strerror(errno)); goto error_fd; }; rx_rings = nm_req.nr_rx_rings; error_fd: close(fd); error_open: SCMutexUnlock(&netmap_devlist_lock); return rx_rings; } /** * \brief Open interface in netmap mode. * \param ifname Interface name. * \param promisc Enable promiscuous mode. * \param dev Pointer to requested netmap device instance. * \param verbose Verbose error logging. * \return Zero on success. */ static int NetmapOpen(char *ifname, int promisc, NetmapDevice **pdevice, int verbose) { NetmapDevice *pdev = NULL; struct nmreq nm_req; *pdevice = NULL; SCMutexLock(&netmap_devlist_lock); /* search interface in our already opened list */ TAILQ_FOREACH(pdev, &netmap_devlist, next) { if (strcmp(ifname, pdev->ifname) == 0) { *pdevice = pdev; pdev->ref++; SCMutexUnlock(&netmap_devlist_lock); return 0; } } /* not found, create new record */ pdev = SCMalloc(sizeof(*pdev)); if (unlikely(pdev == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); goto error; } memset(pdev, 0, sizeof(*pdev)); SC_ATOMIC_INIT(pdev->threads_run); strlcpy(pdev->ifname, ifname, sizeof(pdev->ifname)); /* open netmap */ int fd = open("/dev/netmap", O_RDWR); if (fd == -1) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't open netmap device, error %s", strerror(errno)); goto error_pdev; } /* check interface is up */ int if_flags = GetIfaceFlags(ifname); if (if_flags == -1) { if (verbose) { SCLogError(SC_ERR_NETMAP_CREATE, "Can not access to interface '%s'", ifname); } goto error_fd; } if ((if_flags & IFF_UP) == 0) { SCLogWarning(SC_ERR_NETMAP_CREATE, "Interface '%s' is down", ifname); goto error_fd; } /* if needed, try to set iface in promisc mode */ if (promisc && (if_flags & (IFF_PROMISC|IFF_PPROMISC)) == 0) { if_flags |= IFF_PPROMISC; SetIfaceFlags(ifname, if_flags); } /* query netmap info */ memset(&nm_req, 0, sizeof(nm_req)); strlcpy(nm_req.nr_name, ifname, sizeof(nm_req.nr_name)); nm_req.nr_version = NETMAP_API; if (ioctl(fd, NIOCGINFO, &nm_req) != 0) { if (verbose) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't query netmap for %s, error %s", ifname, strerror(errno)); } goto error_fd; }; pdev->memsize = nm_req.nr_memsize; pdev->rx_rings_cnt = nm_req.nr_rx_rings; pdev->tx_rings_cnt = nm_req.nr_tx_rings; pdev->rings_cnt = max(pdev->rx_rings_cnt, pdev->tx_rings_cnt); /* hw rings + sw ring */ pdev->rings = SCMalloc(sizeof(*pdev->rings) * (pdev->rings_cnt + 1)); if (unlikely(pdev->rings == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); goto error_fd; } memset(pdev->rings, 0, sizeof(*pdev->rings) * (pdev->rings_cnt + 1)); /* open individual instance for each ring */ int success_cnt = 0; for (int i = 0; i <= pdev->rings_cnt; i++) { NetmapRing *pring = &pdev->rings[i]; pring->fd = open("/dev/netmap", O_RDWR); if (pring->fd == -1) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't open netmap device: %s", strerror(errno)); break; } if (i < pdev->rings_cnt) { nm_req.nr_flags = NR_REG_ONE_NIC; nm_req.nr_ringid = i | NETMAP_NO_TX_POLL; } else { nm_req.nr_flags = NR_REG_SW; nm_req.nr_ringid = NETMAP_NO_TX_POLL; } if (ioctl(pring->fd, NIOCREGIF, &nm_req) != 0) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't register %s with netmap: %s", ifname, strerror(errno)); break; } if (pdev->mem == NULL) { pdev->mem = mmap(0, pdev->memsize, PROT_WRITE | PROT_READ, MAP_SHARED, pring->fd, 0); if (pdev->mem == MAP_FAILED) { SCLogError(SC_ERR_NETMAP_CREATE, "Couldn't mmap netmap device: %s", strerror(errno)); break; } pdev->nif = NETMAP_IF(pdev->mem, nm_req.nr_offset); } if ((i < pdev->rx_rings_cnt) || (i == pdev->rings_cnt)) { pring->rx = NETMAP_RXRING(pdev->nif, i); } if ((i < pdev->tx_rings_cnt) || (i == pdev->rings_cnt)) { pring->tx = NETMAP_TXRING(pdev->nif, i); } SCSpinInit(&pring->tx_lock, 0); success_cnt++; } if (success_cnt != (pdev->rings_cnt + 1)) { for(int i = 0; i < success_cnt; i++) { close(pdev->rings[i].fd); } if (pdev->mem) { munmap(pdev->mem, pdev->memsize); } SCFree(pdev->rings); goto error_fd; } close(fd); *pdevice = pdev; TAILQ_INSERT_TAIL(&netmap_devlist, pdev, next); SCMutexUnlock(&netmap_devlist_lock); return 0; error_fd: close(fd); error_pdev: SCFree(pdev); error: SCMutexUnlock(&netmap_devlist_lock); return -1; } /** * \brief Close or dereference netmap device instance. * \param pdev Netmap device instance. * \return Zero on success. */ static int NetmapClose(NetmapDevice *dev) { NetmapDevice *pdev, *tmp; SCMutexLock(&netmap_devlist_lock); TAILQ_FOREACH_SAFE(pdev, &netmap_devlist, next, tmp) { if (pdev == dev) { pdev->ref--; if (!pdev->ref) { munmap(pdev->mem, pdev->memsize); // First close SW ring (https://github.com/luigirizzo/netmap/issues/144) for (int i = pdev->rings_cnt; i >= 0; i--) { NetmapRing *pring = &pdev->rings[i]; close(pring->fd); SCSpinDestroy(&pring->tx_lock); } SCFree(pdev->rings); TAILQ_REMOVE(&netmap_devlist, pdev, next); SCFree(pdev); } SCMutexUnlock(&netmap_devlist_lock); return 0; } } SCMutexUnlock(&netmap_devlist_lock); return -1; } /** * \brief PcapDumpCounters * \param ntv */ static inline void NetmapDumpCounters(NetmapThreadVars *ntv) { StatsAddUI64(ntv->tv, ntv->capture_kernel_packets, ntv->pkts); StatsAddUI64(ntv->tv, ntv->capture_kernel_drops, ntv->drops); (void) SC_ATOMIC_ADD(ntv->livedev->drop, ntv->drops); (void) SC_ATOMIC_ADD(ntv->livedev->pkts, ntv->pkts); ntv->drops = 0; ntv->pkts = 0; } /** * \brief Init function for ReceiveNetmap. * \param tv pointer to ThreadVars * \param initdata pointer to the interface passed from the user * \param data pointer gets populated with NetmapThreadVars */ static TmEcode ReceiveNetmapThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); NetmapIfaceConfig *aconf = initdata; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } NetmapThreadVars *ntv = SCMalloc(sizeof(*ntv)); if (unlikely(ntv == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); goto error; } memset(ntv, 0, sizeof(*ntv)); ntv->tv = tv; ntv->checksum_mode = aconf->in.checksum_mode; ntv->copy_mode = aconf->in.copy_mode; ntv->livedev = LiveGetDevice(aconf->iface_name); if (ntv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); goto error_ntv; } if (NetmapOpen(aconf->in.iface, aconf->in.promisc, &ntv->ifsrc, 1) != 0) { goto error_ntv; } if (unlikely(!aconf->in.sw_ring && !ntv->ifsrc->rx_rings_cnt)) { SCLogError(SC_ERR_NETMAP_CREATE, "Input interface '%s' does not have Rx rings", aconf->iface_name); goto error_src; } if (unlikely(aconf->in.sw_ring && aconf->in.threads > 1)) { SCLogError(SC_ERR_INVALID_VALUE, "Interface '%s+'. " "Thread count can't be greater than 1 for SW ring.", aconf->iface_name); goto error_src; } else if (unlikely(aconf->in.threads > ntv->ifsrc->rx_rings_cnt)) { SCLogError(SC_ERR_INVALID_VALUE, "Thread count can't be greater than Rx ring count. " "Configured %d threads for interface '%s' with %d Rx rings.", aconf->in.threads, aconf->iface_name, ntv->ifsrc->rx_rings_cnt); goto error_src; } if (aconf->in.sw_ring) { ntv->thread_idx = 0; } else { do { ntv->thread_idx = SC_ATOMIC_GET(ntv->ifsrc->threads_run); } while (SC_ATOMIC_CAS(&ntv->ifsrc->threads_run, ntv->thread_idx, ntv->thread_idx + 1) == 0); } /* calculate thread rings binding */ if (aconf->in.sw_ring) { ntv->src_ring_from = ntv->src_ring_to = ntv->ifsrc->rings_cnt; } else { int tmp = (ntv->ifsrc->rx_rings_cnt + 1) / aconf->in.threads; ntv->src_ring_from = ntv->thread_idx * tmp; ntv->src_ring_to = ntv->src_ring_from + tmp - 1; if (ntv->thread_idx == (aconf->in.threads - 1)) { ntv->src_ring_to = ntv->ifsrc->rx_rings_cnt - 1; } } SCLogDebug("netmap: %s thread:%d rings:%d-%d", aconf->iface_name, ntv->thread_idx, ntv->src_ring_from, ntv->src_ring_to); if (aconf->in.copy_mode != NETMAP_COPY_MODE_NONE) { if (NetmapOpen(aconf->out.iface, aconf->out.promisc, &ntv->ifdst, 1) != 0) { goto error_src; } if (unlikely(!aconf->out.sw_ring && !ntv->ifdst->tx_rings_cnt)) { SCLogError(SC_ERR_NETMAP_CREATE, "Output interface '%s' does not have Tx rings", aconf->out.iface); goto error_dst; } /* calculate dst rings bindings */ for (int i = ntv->src_ring_from; i <= ntv->src_ring_to; i++) { NetmapRing *ring = &ntv->ifsrc->rings[i]; if (aconf->out.sw_ring) { ring->dst_ring_from = ring->dst_ring_to = ntv->ifdst->rings_cnt; } else if (ntv->ifdst->tx_rings_cnt > ntv->ifsrc->rx_rings_cnt) { int tmp = (ntv->ifdst->tx_rings_cnt + 1) / ntv->ifsrc->rx_rings_cnt; ring->dst_ring_from = i * tmp; ring->dst_ring_to = ring->dst_ring_from + tmp - 1; if (i == (ntv->src_ring_to - 1)) { ring->dst_ring_to = ntv->ifdst->tx_rings_cnt - 1; } } else { ring->dst_ring_from = ring->dst_ring_to = i % ntv->ifdst->tx_rings_cnt; } ring->dst_next_ring = ring->dst_ring_from; SCLogDebug("netmap: %s(%d)->%s(%d-%d)", aconf->in.iface, i, aconf->out.iface, ring->dst_ring_from, ring->dst_ring_to); } } /* basic counters */ ntv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ntv->tv); ntv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ntv->tv); /* enable zero-copy mode for workers runmode */ char const *active_runmode = RunmodeGetActive(); if ((aconf->in.copy_mode != NETMAP_COPY_MODE_NONE) && active_runmode && strcmp("workers", active_runmode) == 0) { ntv->flags |= NETMAP_FLAG_ZERO_COPY; SCLogPerf("Enabling zero copy mode for %s->%s", aconf->in.iface, aconf->out.iface); } else { uint16_t ring_size = ntv->ifsrc->rings[0].rx->num_slots; if (ring_size > max_pending_packets) { SCLogError(SC_ERR_NETMAP_CREATE, "Packet pool size (%" PRIuMAX ") must be greater or equal than %s ring size (%" PRIu16 "). " "Increase max_pending_packets option.", max_pending_packets, aconf->iface_name, ring_size); goto error_dst; } } if (aconf->in.bpf_filter) { SCLogConfig("Using BPF '%s' on iface '%s'", aconf->in.bpf_filter, ntv->ifsrc->ifname); if (pcap_compile_nopcap(default_packet_size, /* snaplen_arg */ LINKTYPE_ETHERNET, /* linktype_arg */ &ntv->bpf_prog, /* program */ aconf->in.bpf_filter, /* const char *buf */ 1, /* optimize */ PCAP_NETMASK_UNKNOWN /* mask */ ) == -1) { SCLogError(SC_ERR_NETMAP_CREATE, "Filter compilation failed."); goto error_dst; } } *data = (void *)ntv; aconf->DerefFunc(aconf); SCReturnInt(TM_ECODE_OK); error_dst: if (aconf->in.copy_mode != NETMAP_COPY_MODE_NONE) { NetmapClose(ntv->ifdst); } error_src: NetmapClose(ntv->ifsrc); error_ntv: SCFree(ntv); error: aconf->DerefFunc(aconf); SCReturnInt(TM_ECODE_FAILED); } /** * \brief Output packet to destination interface or drop. * \param ntv Thread local variables. * \param p Source packet. */ static TmEcode NetmapWritePacket(NetmapThreadVars *ntv, Packet *p) { if (ntv->copy_mode == NETMAP_COPY_MODE_IPS) { if (PACKET_TEST_ACTION(p, ACTION_DROP)) { return TM_ECODE_OK; } } /* map src ring_id to dst ring_id */ NetmapRing *rxring = &ntv->ifsrc->rings[p->netmap_v.ring_id]; NetmapRing *txring = &ntv->ifdst->rings[p->netmap_v.dst_ring_id]; SCSpinLock(&txring->tx_lock); if (!nm_ring_space(txring->tx)) { ntv->drops++; SCSpinUnlock(&txring->tx_lock); return TM_ECODE_FAILED; } struct netmap_slot *ts = &txring->tx->slot[txring->tx->cur]; if (ntv->flags & NETMAP_FLAG_ZERO_COPY) { struct netmap_slot *rs = &rxring->rx->slot[p->netmap_v.slot_id]; /* swap slot buffers */ uint32_t tmp_idx; tmp_idx = ts->buf_idx; ts->buf_idx = rs->buf_idx; rs->buf_idx = tmp_idx; ts->len = rs->len; ts->flags |= NS_BUF_CHANGED; rs->flags |= NS_BUF_CHANGED; } else { unsigned char *slot_data = (unsigned char *)NETMAP_BUF(txring->tx, ts->buf_idx); memcpy(slot_data, GET_PKT_DATA(p), GET_PKT_LEN(p)); ts->len = GET_PKT_LEN(p); ts->flags |= NS_BUF_CHANGED; } txring->tx->head = txring->tx->cur = nm_ring_next(txring->tx, txring->tx->cur); if ((ntv->flags & NETMAP_FLAG_ZERO_COPY) == 0) { ioctl(txring->fd, NIOCTXSYNC, 0); } SCSpinUnlock(&txring->tx_lock); return TM_ECODE_OK; } /** * \brief Packet release routine. * \param p Packet. */ static void NetmapReleasePacket(Packet *p) { NetmapThreadVars *ntv = (NetmapThreadVars *)p->netmap_v.ntv; /* Need to be in copy mode and need to detect early release where Ethernet header could not be set (and pseudo packet) */ if ((ntv->copy_mode != NETMAP_COPY_MODE_NONE) && !PKT_IS_PSEUDOPKT(p)) { NetmapWritePacket(ntv, p); } PacketFreeOrRelease(p); } /** * \brief Read packets from ring and pass them further. * \param ntv Thread local variables. * \param ring_id Ring id to read. */ static int NetmapRingRead(NetmapThreadVars *ntv, int ring_id) { SCEnter(); NetmapRing *ring = &ntv->ifsrc->rings[ring_id]; struct netmap_ring *rx = ring->rx; uint32_t avail = nm_ring_space(rx); uint32_t cur = rx->cur; if (!(ntv->flags & NETMAP_FLAG_ZERO_COPY)) { PacketPoolWaitForN(avail); } while (likely(avail-- > 0)) { struct netmap_slot *slot = &rx->slot[cur]; unsigned char *slot_data = (unsigned char *)NETMAP_BUF(rx, slot->buf_idx); if (ntv->bpf_prog.bf_len) { struct pcap_pkthdr pkthdr = { {0, 0}, slot->len, slot->len }; if (pcap_offline_filter(&ntv->bpf_prog, &pkthdr, slot_data) == 0) { /* rejected by bpf */ cur = nm_ring_next(rx, cur); continue; } } Packet *p = PacketPoolGetPacket(); if (unlikely(p == NULL)) { SCReturnInt(NETMAP_FAILURE); } PKT_SET_SRC(p, PKT_SRC_WIRE); p->livedev = ntv->livedev; p->datalink = LINKTYPE_ETHERNET; p->ts = rx->ts; ntv->pkts++; ntv->bytes += slot->len; /* checksum validation */ if (ntv->checksum_mode == CHECKSUM_VALIDATION_DISABLE) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ntv->checksum_mode == CHECKSUM_VALIDATION_AUTO) { if (ntv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ntv->pkts, SC_ATOMIC_GET(ntv->livedev->pkts), SC_ATOMIC_GET(ntv->livedev->invalid_checksums))) { ntv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } } if (ntv->flags & NETMAP_FLAG_ZERO_COPY) { if (PacketSetData(p, slot_data, slot->len) == -1) { TmqhOutputPacketpool(ntv->tv, p); SCReturnInt(NETMAP_FAILURE); } } else { if (PacketCopyData(p, slot_data, slot->len) == -1) { TmqhOutputPacketpool(ntv->tv, p); SCReturnInt(NETMAP_FAILURE); } } p->ReleasePacket = NetmapReleasePacket; p->netmap_v.ring_id = ring_id; p->netmap_v.slot_id = cur; p->netmap_v.dst_ring_id = ring->dst_next_ring; p->netmap_v.ntv = ntv; if (ring->dst_ring_from != ring->dst_ring_to) { ring->dst_next_ring++; if (ring->dst_next_ring == ring->dst_ring_to) { ring->dst_next_ring = ring->dst_ring_from; } } SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); if (TmThreadsSlotProcessPkt(ntv->tv, ntv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ntv->tv, p); SCReturnInt(NETMAP_FAILURE); } cur = nm_ring_next(rx, cur); } rx->head = rx->cur = cur; SCReturnInt(NETMAP_OK); } /** * \brief Main netmap reading loop function */ static TmEcode ReceiveNetmapLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); TmSlot *s = (TmSlot *)slot; NetmapThreadVars *ntv = (NetmapThreadVars *)data; struct pollfd *fds; int rings_count = ntv->src_ring_to - ntv->src_ring_from + 1; ntv->slot = s->slot_next; fds = SCMalloc(sizeof(*fds) * rings_count); if (unlikely(fds == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); SCReturnInt(TM_ECODE_FAILED); } for (int i = 0; i < rings_count; i++) { fds[i].fd = ntv->ifsrc->rings[ntv->src_ring_from + i].fd; fds[i].events = POLLIN; } for(;;) { if (suricata_ctl_flags != 0) { break; } /* make sure we have at least one packet in the packet pool, * to prevent us from alloc'ing packets at line rate */ PacketPoolWait(); int r = poll(fds, rings_count, POLL_TIMEOUT); if (r < 0) { /* error */ if(errno != EINTR) SCLogError(SC_ERR_NETMAP_READ, "Error polling netmap from iface '%s': (%d" PRIu32 ") %s", ntv->ifsrc->ifname, errno, strerror(errno)); continue; } else if (r == 0) { /* no events, timeout */ SCLogDebug("(%s:%d-%d) Poll timeout", ntv->ifsrc->ifname, ntv->src_ring_from, ntv->src_ring_to); /* poll timed out, lets see if we need to inject a fake packet */ TmThreadsCaptureInjectPacket(tv, ntv->slot, NULL); continue; } for (int i = 0; i < rings_count; i++) { if (fds[i].revents & POLL_EVENTS) { if (fds[i].revents & POLLERR) { SCLogError(SC_ERR_NETMAP_READ, "Error reading data from iface '%s': (%d" PRIu32 ") %s", ntv->ifsrc->ifname, errno, strerror(errno)); } else if (fds[i].revents & POLLNVAL) { SCLogError(SC_ERR_NETMAP_READ, "Invalid polling request"); } continue; } if (likely(fds[i].revents & POLLIN)) { int src_ring_id = ntv->src_ring_from + i; NetmapRingRead(ntv, src_ring_id); if ((ntv->copy_mode != NETMAP_COPY_MODE_NONE) && (ntv->flags & NETMAP_FLAG_ZERO_COPY)) { NetmapRing *src_ring = &ntv->ifsrc->rings[src_ring_id]; /* sync dst tx rings */ for (int j = src_ring->dst_ring_from; j <= src_ring->dst_ring_to; j++) { NetmapRing *dst_ring = &ntv->ifdst->rings[j]; /* if locked, another loop already do sync */ if (SCSpinTrylock(&dst_ring->tx_lock) == 0) { ioctl(dst_ring->fd, NIOCTXSYNC, 0); SCSpinUnlock(&dst_ring->tx_lock); } } } } } NetmapDumpCounters(ntv); StatsSyncCountersIfSignalled(tv); } SCFree(fds); StatsSyncCountersIfSignalled(tv); SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats to the screen at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into NetmapThreadVars for ntv */ static void ReceiveNetmapThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); NetmapThreadVars *ntv = (NetmapThreadVars *)data; NetmapDumpCounters(ntv); SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 ", bytes %" PRIu64 "", tv->name, StatsGetLocalCounterValue(tv, ntv->capture_kernel_packets), StatsGetLocalCounterValue(tv, ntv->capture_kernel_drops), ntv->bytes); } /** * \brief * \param tv * \param data Pointer to NetmapThreadVars. */ static TmEcode ReceiveNetmapThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); NetmapThreadVars *ntv = (NetmapThreadVars *)data; if (ntv->ifsrc) { NetmapClose(ntv->ifsrc); ntv->ifsrc = NULL; } if (ntv->ifdst) { NetmapClose(ntv->ifdst); ntv->ifdst = NULL; } if (ntv->bpf_prog.bf_insns) { pcap_freecode(&ntv->bpf_prog); } SCReturnInt(TM_ECODE_OK); } /** * \brief Prepare netmap decode thread. * \param tv Thread local avariables. * \param initdata Thread config. * \param data Pointer to DecodeThreadVars placed here. */ static TmEcode DecodeNetmapThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; #ifdef __SC_CUDA_SUPPORT__ if (CudaThreadVarsInit(&dtv->cuda_vars) < 0) SCReturnInt(TM_ECODE_FAILED); #endif SCReturnInt(TM_ECODE_OK); } /** * \brief This function passes off to link type decoders. * * DecodeNetmap reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param t pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into NetmapThreadVars for ntv * \param pq pointer to the current PacketQueue * \param postpq */ static TmEcode DecodeNetmap(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) SCReturnInt(TM_ECODE_OK); /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } /** * \brief * \param tv * \param data Pointer to DecodeThreadVars. */ static TmEcode DecodeNetmapThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } /** * \brief Registration Function for RecieveNetmap. */ void TmModuleReceiveNetmapRegister(void) { tmm_modules[TMM_RECEIVENETMAP].name = "ReceiveNetmap"; tmm_modules[TMM_RECEIVENETMAP].ThreadInit = ReceiveNetmapThreadInit; tmm_modules[TMM_RECEIVENETMAP].Func = NULL; tmm_modules[TMM_RECEIVENETMAP].PktAcqLoop = ReceiveNetmapLoop; tmm_modules[TMM_RECEIVENETMAP].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVENETMAP].ThreadExitPrintStats = ReceiveNetmapThreadExitStats; tmm_modules[TMM_RECEIVENETMAP].ThreadDeinit = ReceiveNetmapThreadDeinit; tmm_modules[TMM_RECEIVENETMAP].RegisterTests = NULL; tmm_modules[TMM_RECEIVENETMAP].cap_flags = SC_CAP_NET_RAW; tmm_modules[TMM_RECEIVENETMAP].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for DecodeNetmap. */ void TmModuleDecodeNetmapRegister(void) { tmm_modules[TMM_DECODENETMAP].name = "DecodeNetmap"; tmm_modules[TMM_DECODENETMAP].ThreadInit = DecodeNetmapThreadInit; tmm_modules[TMM_DECODENETMAP].Func = DecodeNetmap; tmm_modules[TMM_DECODENETMAP].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENETMAP].ThreadDeinit = DecodeNetmapThreadDeinit; tmm_modules[TMM_DECODENETMAP].RegisterTests = NULL; tmm_modules[TMM_DECODENETMAP].cap_flags = 0; tmm_modules[TMM_DECODENETMAP].flags = TM_FLAG_DECODE_TM; } #endif /* HAVE_NETMAP */ /* eof */ /** * @} */ suricata-3.2.1/src/detect-filesize.h0000644000000000000000000000277413051004444014244 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FILESIZE_H__ #define __DETECT_FILESIZE_H__ #define DETECT_FILESIZE_LT 0 /**< "less than" operator */ #define DETECT_FILESIZE_GT 1 /**< "greater than" operator */ #define DETECT_FILESIZE_RA 2 /**< range operator */ #define DETECT_FILESIZE_EQ 3 /**< equal operator */ typedef struct DetectFilesizeData_ { uint64_t size1; /**< 1st value in the signature*/ uint64_t size2; /**< 2nd value in the signature*/ uint8_t mode; /**< operator used in the signature */ } DetectFilesizeData; //int DetectFilesizeMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, // uint8_t, void *, Signature *, SigMatch *); void DetectFilesizeRegister(void); #endif /* _DETECT_URILEN_H */ suricata-3.2.1/src/util-var-name.c0000644000000000000000000001226313051004444013632 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Generic variable name utility functions */ #include "suricata-common.h" #include "detect.h" #include "util-hashlist.h" /** \brief Name2idx mapping structure for flowbits, flowvars and pktvars. */ typedef struct VariableName_ { char *name; uint8_t type; /* flowbit, pktvar, etc */ uint16_t idx; } VariableName; static uint32_t VariableNameHash(HashListTable *ht, void *buf, uint16_t buflen) { VariableName *fn = (VariableName *)buf; uint32_t hash = strlen(fn->name) + fn->type; uint16_t u; for (u = 0; u < buflen; u++) { hash += fn->name[u]; } return hash; } static char VariableNameCompare(void *buf1, uint16_t len1, void *buf2, uint16_t len2) { VariableName *fn1 = (VariableName *)buf1; VariableName *fn2 = (VariableName *)buf2; if (fn1->type != fn2->type) return 0; if (strcmp(fn1->name,fn2->name) == 0) return 1; return 0; } static uint32_t VariableIdxHash(HashListTable *ht, void *buf, uint16_t buflen) { VariableName *fn = (VariableName *)buf; uint32_t hash = fn->idx + fn->type; return hash; } static char VariableIdxCompare(void *buf1, uint16_t len1, void *buf2, uint16_t len2) { VariableName *fn1 = (VariableName *)buf1; VariableName *fn2 = (VariableName *)buf2; if (fn1->type != fn2->type) return 0; if (fn1->idx == fn2->idx) return 1; return 0; } static void VariableNameFree(void *data) { VariableName *fn = (VariableName *)data; if (fn == NULL) return; if (fn->name != NULL) { SCFree(fn->name); fn->name = NULL; } SCFree(fn); } /** \brief Initialize the Name idx hash. * \param de_ctx Ptr to the detection engine ctx. * \retval -1 in case of error * \retval 0 in case of success */ int VariableNameInitHash(DetectEngineCtx *de_ctx) { de_ctx->variable_names = HashListTableInit(4096, VariableNameHash, VariableNameCompare, VariableNameFree); if (de_ctx->variable_names == NULL) return -1; de_ctx->variable_idxs = HashListTableInit(4096, VariableIdxHash, VariableIdxCompare, NULL); if (de_ctx->variable_idxs == NULL) return -1; de_ctx->variable_names_idx = 0; return 0; } void VariableNameFreeHash(DetectEngineCtx *de_ctx) { if (de_ctx->variable_names != NULL) { HashListTableFree(de_ctx->variable_names); HashListTableFree(de_ctx->variable_idxs); de_ctx->variable_names = NULL; de_ctx->variable_idxs = NULL; } return; } /** \brief Get a name idx for a name. If the name is already used reuse the idx. * \param name nul terminated string with the name * \param type variable type * \retval 0 in case of error * \retval idx the idx or 0 */ uint16_t VariableNameGetIdx(DetectEngineCtx *de_ctx, const char *name, enum VarTypes type) { uint16_t idx = 0; VariableName *fn = SCMalloc(sizeof(VariableName)); if (unlikely(fn == NULL)) goto error; memset(fn, 0, sizeof(VariableName)); fn->type = type; fn->name = SCStrdup(name); if (fn->name == NULL) goto error; VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_names, (void *)fn, 0); if (lookup_fn == NULL) { de_ctx->variable_names_idx++; idx = fn->idx = de_ctx->variable_names_idx; HashListTableAdd(de_ctx->variable_names, (void *)fn, 0); HashListTableAdd(de_ctx->variable_idxs, (void *)fn, 0); } else { idx = lookup_fn->idx; VariableNameFree(fn); } return idx; error: VariableNameFree(fn); return 0; } /** \brief Get a name from the idx. * \param idx index of the variable whose name is to be fetched * \param type variable type * \retval NULL in case of error * \retval name of the variable if successful. */ const char *VariableIdxGetName(DetectEngineCtx *de_ctx, uint16_t idx, enum VarTypes type) { VariableName *fn = SCMalloc(sizeof(VariableName)); if (unlikely(fn == NULL)) goto error; char *name = NULL; memset(fn, 0, sizeof(VariableName)); fn->type = type; fn->idx = idx; VariableName *lookup_fn = (VariableName *)HashListTableLookup(de_ctx->variable_idxs, (void *)fn, 0); if (lookup_fn != NULL) { name = SCStrdup(lookup_fn->name); if (unlikely(name == NULL)) goto error; VariableNameFree(fn); } else { goto error; } return name; error: VariableNameFree(fn); return NULL; } suricata-3.2.1/src/util-syslog.h0000644000000000000000000000170313051004444013446 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * */ #ifndef UTIL_SYSLOG_H #define UTIL_SYSLOG_H SCEnumCharMap *SCSyslogGetFacilityMap(void); SCEnumCharMap *SCSyslogGetLogLevelMap(void); #endif /* UTIL_SYSLOG_H */ suricata-3.2.1/src/util-pages.c0000644000000000000000000000326513051004444013225 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Page util functions */ #include "suricata-common.h" #ifndef HAVE_SYS_MMAN_H #define PageSupportsRWX 1 #else #include /** \brief check if OS allows for RWX pages * * Some OS' disallow RWX pages for security reasons. This function mmaps * some memory RW and then tries to turn it into RWX. If this fails we * assume that the OS doesn't allow for this. * * Thanks to Shawn Webb from HardenedBSD for the suggestion. * * \retval 1 RWX supported * \retval 0 not supported */ int PageSupportsRWX(void) { int retval = 1; void *ptr; ptr = mmap(0, getpagesize(), PROT_READ|PROT_WRITE, MAP_ANON|MAP_SHARED, -1, 0); if (ptr != MAP_FAILED) { if (mprotect(ptr, getpagesize(), PROT_READ|PROT_WRITE|PROT_EXEC) == -1) { SCLogConfig("RWX pages denied by OS"); retval = 0; } munmap(ptr, getpagesize()); } return retval; } #endif /* HAVE_SYS_MMAN_H */ suricata-3.2.1/src/output-json-netflow.h0000644000000000000000000000162013051004444015134 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * Victor Julien */ #ifndef __OUTPUT_JSON_NETFLOW_H__ #define __OUTPUT_JSON_NETFLOW_H__ void JsonNetFlowLogRegister(void); #endif /* __OUTPUT_JSON_FLOW_H__ */ suricata-3.2.1/src/detect-tls-cert-subject.c0000644000000000000000000004556413051004444015623 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland * * Implements support for tls_cert_subject keyword. */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-tls.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectTlsSubjectSetup(DetectEngineCtx *, Signature *, char *); static void DetectTlsSubjectRegisterTests(void); /** * \brief Registration function for keyword: tls_cert_issuer */ void DetectTlsSubjectRegister(void) { sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].name = "tls_cert_subject"; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].desc = "content modifier to match specifically and only on the TLS cert subject buffer"; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tls-cert-subject"; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].Match = NULL; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].Setup = DetectTlsSubjectSetup; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].Free = NULL; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].RegisterTests = DetectTlsSubjectRegisterTests; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_cert_subject", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSSUBJECT_MATCH, 2, PrefilterTxTlsSubjectRegister); DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSSUBJECT_MATCH, DetectEngineInspectTlsSubject); } /** * \brief this function setup the tls_cert_subject modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success */ static int DetectTlsSubjectSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { s->list = DETECT_SM_LIST_TLSSUBJECT_MATCH; s->alproto = ALPROTO_TLS; return 0; } #ifdef UNITTESTS /** * \test Test that a signature containing a tls_cert_subject is correctly parsed * and that the keyword is registered. */ static int DetectTlsSubjectTest01(void) { DetectEngineCtx *de_ctx = NULL; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tls any any -> any any " "(msg:\"Testing tls_cert_subject\"; " "tls_cert_subject; content:\"test\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); /* sm should not be in the MATCH list */ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]; FAIL_IF_NOT_NULL(sm); sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_TLSSUBJECT_MATCH]; FAIL_IF_NULL(sm); FAIL_IF(sm->type != DETECT_CONTENT); FAIL_IF_NOT_NULL(sm->next); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test matching for google in the subject of a certificate * */ static int DetectTlsSubjectTest02(void) { /* client hello */ uint8_t client_hello[] = { 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00, 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86, 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc, 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b, 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46, 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f, 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00, 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00, 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32, 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e, 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00, 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02, 0x03, 0x04, 0x02, 0x02, 0x02 }; /* server hello */ uint8_t server_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00, 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd, 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d, 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1, 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23, 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00, 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10, 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00 }; /* certificate */ uint8_t certificate[] = { 0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04, 0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30, 0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19, 0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37, 0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30, 0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a, 0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae, 0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f, 0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16, 0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50, 0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f, 0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45, 0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59, 0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42, 0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03, 0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1, 0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62, 0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04, 0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4, 0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8, 0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82, 0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6, 0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86, 0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd, 0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d, 0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4, 0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5, 0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d, 0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c, 0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26, 0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec, 0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c, 0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d, 0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78, 0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0, 0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40, 0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50, 0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42, 0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb, 0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b, 0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6, 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a, 0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0, 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff, 0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a, 0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94, 0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98, 0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8, 0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09, 0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34, 0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91, 0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5, 0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1, 0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1, 0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66, 0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05, 0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20, 0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc, 0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4, 0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d, 0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e, 0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63, 0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5, 0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04, 0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9, 0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98, 0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d, 0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52, 0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00, 0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83, 0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f, 0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1, 0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6, 0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d, 0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d }; Flow f; SSLState *ssl_state = NULL; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 51251, 443); p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_TLS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->pcap_cnt = 3; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_subject\"; " "tls_cert_subject; content:\"google\"; nocase; " "sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); SigMatchSignatures(&tv, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p2); FAIL_IF(PacketAlertCheck(p2, 1)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p3); FAIL_IF_NOT(PacketAlertCheck(p3, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); PASS; } #endif static void DetectTlsSubjectRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTlsSubjectTest01", DetectTlsSubjectTest01); UtRegisterTest("DetectTlsSubjectTest02", DetectTlsSubjectTest02); #endif } suricata-3.2.1/src/util-var.h0000644000000000000000000000403713051004444012721 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_VAR_H__ #define __UTIL_VAR_H__ enum VarTypes { VAR_TYPE_NOT_SET, VAR_TYPE_PKT_BIT, VAR_TYPE_PKT_INT, VAR_TYPE_PKT_VAR, VAR_TYPE_FLOW_BIT, VAR_TYPE_FLOW_INT, VAR_TYPE_FLOW_VAR, VAR_TYPE_HOST_BIT, VAR_TYPE_HOST_INT, VAR_TYPE_HOST_VAR, VAR_TYPE_IPPAIR_BIT, VAR_TYPE_IPPAIR_INT, VAR_TYPE_IPPAIR_VAR, }; typedef struct GenericVar_ { uint8_t type; uint16_t idx; struct GenericVar_ *next; } GenericVar; typedef struct XBit_ { uint8_t type; /* type, DETECT_XBITS in this case */ uint16_t idx; /* name idx */ GenericVar *next; uint32_t expire; } XBit; void XBitFree(XBit *); // A list of variables we try to resolve while parsing configuration file. // Helps to detect recursive declarations. typedef struct ResolvedVariable_ { char var_name[256]; TAILQ_ENTRY(ResolvedVariable_) next; } ResolvedVariable; typedef TAILQ_HEAD(, ResolvedVariable_) ResolvedVariablesList; void GenericVarFree(GenericVar *); void GenericVarAppend(GenericVar **, GenericVar *); void GenericVarRemove(GenericVar **, GenericVar *); int AddVariableToResolveList(ResolvedVariablesList *list, const char *var); void CleanVariableResolveList(ResolvedVariablesList *var_list); #endif /* __UTIL_VAR_H__ */ suricata-3.2.1/src/suricata-common.h0000644000000000000000000001736513051004444014267 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Common includes, etc. */ #ifndef __SURICATA_COMMON_H__ #define __SURICATA_COMMON_H__ #ifdef DEBUG #define DBG_PERF #endif #define TRUE 1 #define FALSE 0 #define _GNU_SOURCE #define __USE_GNU #if HAVE_CONFIG_H #include #endif #ifndef CLS #warning "L1 cache line size not detected during build. Assuming 64 bytes." #define CLS 64 #endif #if HAVE_STDIO_H #include #endif #if HAVE_STDDEF_H #include #endif #if HAVE_STDINT_h #include #endif #if HAVE_STDARG_H #include #endif #ifdef HAVE_STDLIB_H #include #endif #if HAVE_ERRNO_H #include #endif #if HAVE_UNISTD_H #include #endif #if HAVE_INTTYPES_H #include #endif #if HAVE_LIMITS_H #include #endif #if HAVE_CTYPE_H #include #endif #if HAVE_STRING_H #include #endif #if HAVE_STRINGS_H #include #endif #if HAVE_FCNTL_H #include #endif #ifdef HAVE_TIME_H #include #endif #if HAVE_SYS_SYSCALL_H #include #endif #if HAVE_SYSCALL_H #include #endif #if HAVE_SYS_TYPES_H #include /* for gettid(2) */ #endif #if HAVE_SCHED_H #include /* for sched_setaffinity(2) */ #endif #include #ifdef HAVE_SYSLOG_H #include #else #ifdef OS_WIN32 #include "win32-syslog.h" #endif /* OS_WIN32 */ #endif /* HAVE_SYSLOG_H */ #ifdef OS_WIN32 #include "win32-misc.h" #include "win32-service.h" #endif /* OS_WIN32 */ #if HAVE_SYS_TIME_H #include #endif #if HAVE_POLL_H #include #endif #if HAVE_SYS_SIGNAL_H #include #endif #if HAVE_SIGNAL_H #include #endif #if HAVE_SYS_TYPES_H #include #endif #if HAVE_SYS_SOCKET_H #include #endif #if HAVE_SYS_STAT_H #include #endif #if HAVE_NETINET_IN_H #include #endif #if HAVE_ARPA_INET_H #include #endif #if HAVE_NETDB_H #include #endif #ifdef HAVE_PCAP_H #include #endif #ifdef HAVE_PCAP_PCAP_H #include #endif #ifdef HAVE_PCAP_BPF_H #include #endif #if __CYGWIN__ #if !defined _X86_ && !defined __x86_64 #define _X86_ #endif #endif #ifdef HAVE_WINDOWS_H #ifndef _WIN32_WINNT #define _WIN32_WINNT 0x0501 #endif #include #endif #ifdef HAVE_W32API_WINBASE_H #include #endif #ifdef HAVE_W32API_WTYPES_H #include #endif #if !__CYGWIN__ #ifdef HAVE_WINSOCK2_H #include #endif #ifdef HAVE_WS2TCPIP_H #include #endif #endif /* !__CYGWIN__ */ #ifdef HAVE_LIBJANSSON #include #ifndef JSON_ESCAPE_SLASH #define JSON_ESCAPE_SLASH 0 #endif /* Appears not all current distros have jansson that defines this. */ #ifndef json_boolean #define json_boolean(val) ((val) ? json_true() : json_false()) #endif #endif #ifdef HAVE_MAGIC #include #endif /* we need this to stringify the defines which are supplied at compiletime see: http://gcc.gnu.org/onlinedocs/gcc-3.4.1/cpp/Stringification.html#Stringification */ #define xstr(s) str(s) #define str(s) #s #if CPPCHECK==1 #define BUG_ON(x) if (((x))) exit(1) #else #if defined HAVE_ASSERT_H && !defined NDEBUG #include #define BUG_ON(x) assert(!(x)) #else #define BUG_ON(x) do { \ if (((x))) { \ fprintf(stderr, "BUG at %s:%d(%s)\n", __FILE__, __LINE__, __func__); \ fprintf(stderr, "Code: '%s'\n", xstr((x))); \ exit(EXIT_FAILURE); \ } \ } while(0) #endif #endif /** type for the internal signature id. Since it's used in the matching engine * extensively keeping this as small as possible reduces the overall memory * footprint of the engine. Set to uint32_t if the engine needs to support * more than 64k sigs. */ //#define SigIntId uint16_t #define SigIntId uint32_t /** same for pattern id's */ #define PatIntId uint32_t /** FreeBSD does not define __WORDSIZE, but it uses __LONG_BIT */ #ifndef __WORDSIZE #ifdef __LONG_BIT #define __WORDSIZE __LONG_BIT #else #ifdef LONG_BIT #define __WORDSIZE LONG_BIT #endif #endif #endif /** Windows does not define __WORDSIZE, but it uses __X86__ */ #ifndef __WORDSIZE #if defined(__X86__) || defined(_X86_) #define __WORDSIZE 32 #else #if defined(__X86_64__) || defined(_X86_64_) #define __WORDSIZE 64 #endif #endif #ifndef __WORDSIZE #warning Defaulting to __WORDSIZE 32 #define __WORDSIZE 32 #endif #endif /** darwin doesn't defined __BYTE_ORDER and friends, but BYTE_ORDER */ #ifndef __BYTE_ORDER #ifdef BYTE_ORDER #define __BYTE_ORDER BYTE_ORDER #endif #endif #ifndef __LITTLE_ENDIAN #ifdef LITTLE_ENDIAN #define __LITTLE_ENDIAN LITTLE_ENDIAN #endif #endif #ifndef __BIG_ENDIAN #ifdef BIG_ENDIAN #define __BIG_ENDIAN BIG_ENDIAN #endif #endif #ifndef HAVE_PCRE_FREE_STUDY #define pcre_free_study pcre_free #endif #ifndef MIN #define MIN(x, y) (((x)<(y))?(x):(y)) #endif #ifndef MAX #define MAX(x, y) (((x)<(y))?(y):(x)) #endif #define BIT_U8(n) ((uint8_t)(1 << (n))) #define BIT_U16(n) ((uint16_t)(1 << (n))) #define BIT_U32(n) (1UL << (n)) #define BIT_U64(n) (1ULL << (n)) #define WARN_UNUSED __attribute__((warn_unused_result)) typedef enum PacketProfileDetectId_ { PROF_DETECT_IPONLY, PROF_DETECT_RULES, PROF_DETECT_STATEFUL, PROF_DETECT_PREFILTER, PROF_DETECT_PF_PKT, PROF_DETECT_PF_PAYLOAD, PROF_DETECT_PF_TX, PROF_DETECT_PF_SORT1, PROF_DETECT_PF_SORT2, PROF_DETECT_NONMPMLIST, PROF_DETECT_ALERT, PROF_DETECT_CLEANUP, PROF_DETECT_GETSGH, PROF_DETECT_MPM_FD_SMTP, PROF_DETECT_SIZE, } PacketProfileDetectId; typedef enum { LOGGER_UNDEFINED, LOGGER_ALERT_DEBUG, LOGGER_ALERT_FAST, LOGGER_UNIFIED2, LOGGER_ALERT_SYSLOG, LOGGER_DROP, LOGGER_JSON_ALERT, LOGGER_JSON_DROP, LOGGER_JSON_SSH, LOGGER_DNS, LOGGER_HTTP, LOGGER_JSON_DNS, LOGGER_JSON_HTTP, LOGGER_JSON_SMTP, LOGGER_JSON_TLS, LOGGER_JSON_TEMPLATE, LOGGER_TLS_STORE, LOGGER_TLS, LOGGER_FILE, LOGGER_FILE_STORE, LOGGER_JSON_FILE, LOGGER_TCP_DATA, LOGGER_JSON_FLOW, LOGGER_JSON_NETFLOW, LOGGER_STATS, LOGGER_JSON_STATS, LOGGER_PRELUDE, LOGGER_PCAP, LOGGER_JSON_DNP3, LOGGER_SIZE, } LoggerId; #include #include "threads.h" #include "tm-threads-common.h" #include "util-debug.h" #include "util-error.h" #include "util-mem.h" #include "detect-engine-alert.h" #include "util-optimize.h" #include "util-path.h" #include "util-conf.h" #ifdef HAVE_LUA #include #include #include #endif #ifndef HAVE_STRLCAT size_t strlcat(char *, const char *src, size_t siz); #endif #ifndef HAVE_STRLCPY size_t strlcpy(char *dst, const char *src, size_t siz); #endif extern int coverage_unittests; extern int g_ut_modules; extern int g_ut_covered; #endif /* __SURICATA_COMMON_H__ */ suricata-3.2.1/src/tmqh-nfq.c0000644000000000000000000000265113051004444012704 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * NFQ Verdict Handler */ #include "suricata-common.h" #include "packet-queue.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" void TmqhOutputVerdictNfq(ThreadVars *t, Packet *p); void TmqhNfqRegister (void) { tmqh_table[TMQH_NFQ].name = "nfq"; tmqh_table[TMQH_NFQ].InHandler = NULL; tmqh_table[TMQH_NFQ].OutHandler = TmqhOutputVerdictNfq; } void TmqhOutputVerdictNfq(ThreadVars *t, Packet *p) { /* XXX not scaling */ #if 0 PacketQueue *q = &trans_q[p->verdict_q_id]; SCMutexLock(&q->mutex_q); PacketEnqueue(q, p); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); #endif } suricata-3.2.1/src/util-cuda-vars.c0000644000000000000000000000516113051004444014010 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #ifdef __SC_CUDA_SUPPORT__ #include "suricata.h" #include "util-mpm.h" #include "util-cuda-handlers.h" #include "util-cuda-vars.h" #include "detect-engine-mpm.h" #include "util-debug.h" #include "util-mpm-ac.h" static DetectEngineCtx *cuda_de_ctx = NULL; void CudaVarsSetDeCtx(DetectEngineCtx *de_ctx) { if (cuda_de_ctx != NULL) { SCLogError(SC_ERR_FATAL, "CudaVarsSetDeCtx() called more than once. " "This function should be called only once during the " "lifetime of the engine."); exit(EXIT_FAILURE); } cuda_de_ctx = de_ctx; return; } int CudaThreadVarsInit(CudaThreadVars *ctv) { if (PatternMatchDefaultMatcher() != MPM_AC_CUDA) return 0; MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); if (conf == NULL) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error obtaining cuda mpm profile."); return -1; } ctv->mpm_is_cuda = 1; ctv->cuda_ac_cb = CudaHandlerModuleGetData(MPM_AC_CUDA_MODULE_NAME, MPM_AC_CUDA_MODULE_CUDA_BUFFER_NAME); ctv->data_buffer_size_max_limit = conf->data_buffer_size_max_limit; ctv->data_buffer_size_min_limit = conf->data_buffer_size_min_limit; ctv->mpm_proto_tcp_ctx_ts = MpmFactoryGetMpmCtxForProfile(cuda_de_ctx, cuda_de_ctx->sgh_mpm_context_proto_tcp_packet, 0); ctv->mpm_proto_tcp_ctx_tc = MpmFactoryGetMpmCtxForProfile(cuda_de_ctx, cuda_de_ctx->sgh_mpm_context_proto_tcp_packet, 1); ctv->mpm_proto_udp_ctx_ts = MpmFactoryGetMpmCtxForProfile(cuda_de_ctx, cuda_de_ctx->sgh_mpm_context_proto_udp_packet, 0); ctv->mpm_proto_udp_ctx_tc = MpmFactoryGetMpmCtxForProfile(cuda_de_ctx, cuda_de_ctx->sgh_mpm_context_proto_udp_packet, 1); ctv->mpm_proto_other_ctx = MpmFactoryGetMpmCtxForProfile(cuda_de_ctx, cuda_de_ctx->sgh_mpm_context_proto_other_packet, 0); return 0; } #endif suricata-3.2.1/src/decode-icmpv4.h0000644000000000000000000002240513051004444013600 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_ICMPV4_H__ #define __DECODE_ICMPV4_H__ #include "decode.h" #include "decode-tcp.h" #include "decode-sctp.h" #include "decode-udp.h" #define ICMPV4_HEADER_LEN 8 #ifndef ICMP_ECHOREPLY #define ICMP_ECHOREPLY 0 /* Echo Reply */ #endif #ifndef ICMP_DEST_UNREACH #define ICMP_DEST_UNREACH 3 /* Destination Unreachable */ #endif #ifndef ICMP_SOURCE_QUENCH #define ICMP_SOURCE_QUENCH 4 /* Source Quench */ #endif #ifndef ICMP_REDIRECT #define ICMP_REDIRECT 5 /* Redirect (change route) */ #endif #ifndef ICMP_ECHO #define ICMP_ECHO 8 /* Echo Request */ #endif #ifndef ICMP_TIME_EXCEEDED #define ICMP_TIME_EXCEEDED 11 /* Time Exceeded */ #endif #ifndef ICMP_PARAMETERPROB #define ICMP_PARAMETERPROB 12 /* Parameter Problem */ #endif #ifndef ICMP_TIMESTAMP #define ICMP_TIMESTAMP 13 /* Timestamp Request */ #endif #ifndef ICMP_TIMESTAMPREPLY #define ICMP_TIMESTAMPREPLY 14 /* Timestamp Reply */ #endif #ifndef ICMP_INFO_REQUEST #define ICMP_INFO_REQUEST 15 /* Information Request */ #endif #ifndef ICMP_INFO_REPLY #define ICMP_INFO_REPLY 16 /* Information Reply */ #endif #ifndef ICMP_ADDRESS #define ICMP_ADDRESS 17 /* Address Mask Request */ #endif #ifndef ICMP_ADDRESSREPLY #define ICMP_ADDRESSREPLY 18 /* Address Mask Reply */ #endif #ifndef NR_ICMP_TYPES #define NR_ICMP_TYPES 18 #endif /* Codes for UNREACH. */ #ifndef ICMP_NET_UNREACH #define ICMP_NET_UNREACH 0 /* Network Unreachable */ #endif #ifndef ICMP_HOST_UNREACH #define ICMP_HOST_UNREACH 1 /* Host Unreachable */ #endif #ifndef ICMP_PROT_UNREACH #define ICMP_PROT_UNREACH 2 /* Protocol Unreachable */ #endif #ifndef ICMP_PORT_UNREACH #define ICMP_PORT_UNREACH 3 /* Port Unreachable */ #endif #ifndef ICMP_FRAG_NEEDED #define ICMP_FRAG_NEEDED 4 /* Fragmentation Needed/DF set */ #endif #ifndef ICMP_SR_FAILED #define ICMP_SR_FAILED 5 /* Source Route failed */ #endif #ifndef ICMP_NET_UNKNOWN #define ICMP_NET_UNKNOWN 6 #endif #ifndef ICMP_HOST_UNKNOWN #define ICMP_HOST_UNKNOWN 7 #endif #ifndef ICMP_HOST_ISOLATED #define ICMP_HOST_ISOLATED 8 #endif #ifndef ICMP_NET_ANO #define ICMP_NET_ANO 9 #endif #ifndef ICMP_HOST_ANO #define ICMP_HOST_ANO 10 #endif #ifndef ICMP_NET_UNR_TOS #define ICMP_NET_UNR_TOS 11 #endif #ifndef ICMP_HOST_UNR_TOS #define ICMP_HOST_UNR_TOS 12 #endif #ifndef ICMP_PKT_FILTERED #define ICMP_PKT_FILTERED 13 /* Packet filtered */ #endif #ifndef ICMP_PREC_VIOLATION #define ICMP_PREC_VIOLATION 14 /* Precedence violation */ #endif #ifndef ICMP_PREC_CUTOFF #define ICMP_PREC_CUTOFF 15 /* Precedence cut off */ #endif #ifndef NR_ICMP_UNREACH #define NR_ICMP_UNREACH 15 /* instead of hardcoding immediate value */ #endif /* Codes for REDIRECT. */ #ifndef ICMP_REDIR_NET #define ICMP_REDIR_NET 0 /* Redirect Net */ #endif #ifndef ICMP_REDIR_HOST #define ICMP_REDIR_HOST 1 /* Redirect Host */ #endif #ifndef ICMP_REDIR_NETTOS #define ICMP_REDIR_NETTOS 2 /* Redirect Net for TOS */ #endif #ifndef ICMP_REDIR_HOSTTOS #define ICMP_REDIR_HOSTTOS 3 /* Redirect Host for TOS */ #endif /* Codes for TIME_EXCEEDED. */ #ifndef ICMP_EXC_TTL #define ICMP_EXC_TTL 0 /* TTL count exceeded */ #endif #ifndef ICMP_EXC_FRAGTIME #define ICMP_EXC_FRAGTIME 1 /* Fragment Reass time exceeded */ #endif /** marco for icmpv4 type access */ #define ICMPV4_GET_TYPE(p) (p)->icmpv4h->type /** marco for icmpv4 code access */ #define ICMPV4_GET_CODE(p) (p)->icmpv4h->code /* ICMPv4 header structure */ typedef struct ICMPV4Hdr_ { uint8_t type; uint8_t code; uint16_t checksum; } __attribute__((__packed__)) ICMPV4Hdr; /* ICMPv4 header structure */ typedef struct ICMPV4ExtHdr_ { uint8_t type; uint8_t code; uint16_t checksum; uint16_t id; uint16_t seq; } ICMPV4ExtHdr; /* ICMPv4 vars */ typedef struct ICMPV4Vars_ { uint16_t id; uint16_t seq; /** Pointers to the embedded packet headers */ IPV4Hdr *emb_ipv4h; TCPHdr *emb_tcph; UDPHdr *emb_udph; ICMPV4Hdr *emb_icmpv4h; /** IPv4 src and dst address */ struct in_addr emb_ip4_src; struct in_addr emb_ip4_dst; uint8_t emb_ip4_hlen; uint8_t emb_ip4_proto; /** TCP/UDP ports */ uint16_t emb_sport; uint16_t emb_dport; } ICMPV4Vars; #define CLEAR_ICMPV4_PACKET(p) do { \ (p)->level4_comp_csum = -1; \ PACKET_CLEAR_L4VARS((p)); \ (p)->icmpv4h = NULL; \ } while(0) #define ICMPV4_HEADER_PKT_OFFSET 8 /** macro for icmpv4 "type" access */ #define ICMPV4_GET_TYPE(p) (p)->icmpv4h->type /** macro for icmpv4 "code" access */ #define ICMPV4_GET_CODE(p) (p)->icmpv4h->code /** macro for icmpv4 "csum" access */ #define ICMPV4_GET_RAW_CSUM(p) ntohs((p)->icmpv4h->checksum) #define ICMPV4_GET_CSUM(p) (p)->icmpv4h->checksum /* If message is informational */ /** macro for icmpv4 "id" access */ #define ICMPV4_GET_ID(p) ((p)->icmpv4vars.id) /** macro for icmpv4 "seq" access */ #define ICMPV4_GET_SEQ(p) ((p)->icmpv4vars.seq) /* If message is Error */ /** macro for icmpv4 embedded "protocol" access */ #define ICMPV4_GET_EMB_PROTO(p) (p)->icmpv4vars.emb_ip4_proto /** macro for icmpv4 embedded "ipv4h" header access */ #define ICMPV4_GET_EMB_IPV4(p) (p)->icmpv4vars.emb_ipv4h /** macro for icmpv4 embedded "tcph" header access */ #define ICMPV4_GET_EMB_TCP(p) (p)->icmpv4vars.emb_tcph /** macro for icmpv4 embedded "udph" header access */ #define ICMPV4_GET_EMB_UDP(p) (p)->icmpv4vars.emb_udph /** macro for icmpv4 embedded "icmpv4h" header access */ #define ICMPV4_GET_EMB_ICMPV4H(p) (p)->icmpv4vars.emb_icmpv4h /** macro for checking if a ICMP DEST UNREACH packet is valid for use * in other parts of the engine, such as the flow engine. * * \warning use only _after_ the decoder has processed the packet */ #define ICMPV4_DEST_UNREACH_IS_VALID(p) ( \ (!((p)->flags & PKT_IS_INVALID)) && \ ((p)->icmpv4h != NULL) && \ (ICMPV4_GET_TYPE((p)) == ICMP_DEST_UNREACH) && \ (ICMPV4_GET_EMB_IPV4((p)) != NULL) && \ ((ICMPV4_GET_EMB_TCP((p)) != NULL) || \ (ICMPV4_GET_EMB_UDP((p)) != NULL))) /** * marco for checking if a ICMP packet is an error message or an * query message. * * \todo This check is used in the flow engine and needs to be as * cheap as possible. Consider setting a bitflag at the decoder * stage so we can to a bit check instead of the more expensive * check below. */ #define ICMPV4_IS_ERROR_MSG(p) (ICMPV4_GET_TYPE((p)) == ICMP_DEST_UNREACH || \ ICMPV4_GET_TYPE((p)) == ICMP_SOURCE_QUENCH || \ ICMPV4_GET_TYPE((p)) == ICMP_REDIRECT || \ ICMPV4_GET_TYPE((p)) == ICMP_TIME_EXCEEDED || \ ICMPV4_GET_TYPE((p)) == ICMP_PARAMETERPROB) void DecodeICMPV4RegisterTests(void); /** ------ Inline functions ------ */ static inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t); /** * \brief Calculates the checksum for the ICMP packet * * \param pkt Pointer to the start of the ICMP packet * \param hlen Total length of the ICMP packet(header + payload) * * \retval csum Checksum for the ICMP packet */ static inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = pkt[0]; tlen -= 4; pkt += 2; while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; tlen -= 2; pkt += 1; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); return (uint16_t) ~csum; } #endif /* __DECODE_ICMPV4_H__ */ suricata-3.2.1/src/util-debug-filters.h0000644000000000000000000000655113051004444014670 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DEBUG_FILTERS_H__ #define __DEBUG_FILTERS_H__ #include #include "threads.h" #include "util-mem.h" /** * \brief Enum that holds the different kinds of filters available */ enum { SC_LOG_FILTER_BL = 0, SC_LOG_FILTER_WL = 1, SC_LOG_FILTER_MAX = 2, }; /** * \brief Structure used to hold the line_no details of a FG filter */ typedef struct SCLogFGFilterLine_ { int line; struct SCLogFGFilterLine_ *next; } SCLogFGFilterLine; /** * \brief structure used to hold the function details of a FG filter */ typedef struct SCLogFGFilterFunc_ { char *func; SCLogFGFilterLine *line; struct SCLogFGFilterFunc_ *next; } SCLogFGFilterFunc; /** * \brief Structure used to hold FG filters. Encapsulates filename details, * func details, which inturn encapsulates the line_no details */ typedef struct SCLogFGFilterFile_ { char *file; SCLogFGFilterFunc *func; struct SCLogFGFilterFile_ *next; } SCLogFGFilterFile; /** * \brief Structure used to hold the thread_list used by FD filters */ typedef struct SCLogFDFilterThreadList_ { int entered; pthread_t t; // pid_t t; struct SCLogFDFilterThreadList_ *next; } SCLogFDFilterThreadList; /** * \brief Structure that holds the FD filters */ typedef struct SCLogFDFilter_ { char *func; struct SCLogFDFilter_ *next; } SCLogFDFilter; extern int sc_log_fg_filters_present; extern int sc_log_fd_filters_present; int SCLogAddFGFilterWL(const char *, const char *, int); int SCLogAddFGFilterBL(const char *, const char *, int); int SCLogMatchFGFilterBL(const char *, const char *, int); int SCLogMatchFGFilterWL(const char *, const char *, int); void SCLogReleaseFGFilters(void); int SCLogAddFDFilter(const char *); int SCLogPrintFDFilters(void); void SCLogReleaseFDFilters(void); int SCLogRemoveFDFilter(const char *); int SCLogCheckFDFilterEntry(const char *); void SCLogCheckFDFilterExit(const char *); int SCLogMatchFDFilter(const char *); int SCLogPrintFGFilters(void); void SCLogAddToFGFFileList(SCLogFGFilterFile *, const char *, const char *, int, int); void SCLogAddToFGFFuncList(SCLogFGFilterFile *, SCLogFGFilterFunc *, const char *, int); void SCLogAddToFGFLineList(SCLogFGFilterFunc *, SCLogFGFilterLine *, int); void SCLogReleaseFDFilter(SCLogFDFilter *); #endif /* __DEBUG_H__ */ suricata-3.2.1/src/util-decode-der.h0000644000000000000000000000665113051004444014130 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * */ #ifndef __UTIL_DECODE_DER_H__ #define __UTIL_DECODE_DER_H__ #define ASN1_CLASS_UNIVERSAL 0 #define ASN1_CLASS_APPLICATION 1 #define ASN1_CLASS_CONTEXTSPEC 2 #define ASN1_CLASS_PRIVATE 3 #define ASN1_UNKNOWN 0 #define ASN1_BOOLEAN 0x01 #define ASN1_INTEGER 0x02 #define ASN1_BITSTRING 0x03 #define ASN1_OCTETSTRING 0x04 #define ASN1_NULL 0x05 #define ASN1_OID 0x06 #define ASN1_UTF8STRING 0x0c #define ASN1_SEQUENCE 0x10 #define ASN1_SET 0x11 #define ASN1_PRINTSTRING 0x13 #define ASN1_T61STRING 0x14 #define ASN1_IA5STRING 0x16 #define ASN1_UTCTIME 0x17 #define ASN1_GENERALIZEDTIME 0x18 typedef struct Asn1ElementType_ { uint8_t cls:2; uint8_t pc:1; uint8_t tag:5; } __attribute__((packed)) Asn1ElementType; /* Generic ASN.1 element * Presence and meaning of fields depends on the header and type values. */ typedef struct Asn1Generic_ { Asn1ElementType header; uint8_t type; uint32_t length; /* length of node, including header */ struct Asn1Generic_ *data; /* only if type is structured */ char *str; uint32_t strlen; uint64_t value; struct Asn1Generic_ *next; /* only if type is sequence */ } Asn1Generic; /* Generic error */ #define ERR_DER_GENERIC 0x01 /* Unknown ASN.1 element type */ #define ERR_DER_UNKNOWN_ELEMENT 0x02 /* One element requires to read more bytes than available */ #define ERR_DER_ELEMENT_SIZE_TOO_BIG 0x03 /* One element size is invalid (more than 4 bytes long) */ #define ERR_DER_INVALID_SIZE 0x04 /* Unsupported string type */ #define ERR_DER_UNSUPPORTED_STRING 0x05 /* Missing field or element */ #define ERR_DER_MISSING_ELEMENT 0x06 Asn1Generic * DecodeDer(const unsigned char *buffer, uint32_t size, uint32_t *errcode); void DerFree(Asn1Generic *a); #ifdef AFLFUZZ_DER int DerParseDataFromFile(char *filename); #endif #endif /* __UTIL_DECODE_DER_H__ */ suricata-3.2.1/src/detect-csum.c0000644000000000000000000015363413051004444013376 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements checksum keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-csum.h" #include "util-unittest.h" #include "util-debug.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" /* prototypes for the "ipv4-csum" rule keyword */ int DetectIPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIPV4CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectIPV4CsumFree(void *); /* prototypes for the "tcpv4-csum" rule keyword */ int DetectTCPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectTCPV4CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectTCPV4CsumFree(void *); /* prototypes for the "tcpv6-csum" rule keyword */ int DetectTCPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectTCPV6CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectTCPV6CsumFree(void *); /* prototypes for the "udpv4-csum" rule keyword */ int DetectUDPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectUDPV4CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectUDPV4CsumFree(void *); /* prototypes for the "udpv6-csum" rule keyword */ int DetectUDPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectUDPV6CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectUDPV6CsumFree(void *); /* prototypes for the "icmpv4-csum" rule keyword */ int DetectICMPV4CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectICMPV4CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectICMPV4CsumFree(void *); /* prototypes for the "icmpv6-csum" rule keyword */ int DetectICMPV6CsumMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectICMPV6CsumSetup(DetectEngineCtx *, Signature *, char *); void DetectICMPV6CsumFree(void *); void DetectCsumRegisterTests(void); /** * \brief Registers handlers for all the checksum keywords. The checksum * keywords that are registered are ipv4-sum, tcpv4-csum, tcpv6-csum, * udpv4-csum, udpv6-csum, icmpv4-csum and icmpv6-csum. * * Each of the checksum keywords implemented here takes 2 arguments - * "valid" or "invalid". If the rule keyword in the signature is * specified as "valid", the Match function would return TRUE if the * checksum for that particular packet and protocol is valid. Similarly * for "invalid". * * The Setup functions takes 4 arguments - * * DetectEngineCtx * (de_ctx) - A pointer to the detection engine context * Signature *(s) - Pointer to signature for the current Signature being * parsed from the rules * SigMatchCtx * (m) - Pointer to the head of the SigMatchs added to the * current Signature being parsed * char * (csum_str) - Pointer to a string holding the keyword value * * The Setup function returns 0 if it successfully parses the keyword * value, and -1 otherwise. * * The Match function takes 5 arguments - * * ThreadVars * (t) - Pointer to the tv for the detection module instance * DetectEngineThreadCtx * (det_ctx) - Pointer to the detection engine * thread context * Packet * (p) - Pointer to the Packet currently being handled * Signature * (s) - Pointer to the Signature, the packet is being * currently matched with * SigMatchCtx * (m) - Pointer to the keyword structure from the above * Signature, the Packet is being currently matched * with * * The Match function returns 1 if the Packet contents match the keyword, * and 0 otherwise * * The Free function takes a single argument - * * void * (ptr) - Pointer to the DetectCsumData for a keyword */ void DetectCsumRegister (void) { sigmatch_table[DETECT_IPV4_CSUM].name = "ipv4-csum"; sigmatch_table[DETECT_IPV4_CSUM].Match = DetectIPV4CsumMatch; sigmatch_table[DETECT_IPV4_CSUM].Setup = DetectIPV4CsumSetup; sigmatch_table[DETECT_IPV4_CSUM].Free = DetectIPV4CsumFree; sigmatch_table[DETECT_IPV4_CSUM].RegisterTests = DetectCsumRegisterTests; sigmatch_table[DETECT_TCPV4_CSUM].name = "tcpv4-csum"; sigmatch_table[DETECT_TCPV4_CSUM].Match = DetectTCPV4CsumMatch; sigmatch_table[DETECT_TCPV4_CSUM].Setup = DetectTCPV4CsumSetup; sigmatch_table[DETECT_TCPV4_CSUM].Free = DetectTCPV4CsumFree; sigmatch_table[DETECT_TCPV4_CSUM].RegisterTests = NULL; sigmatch_table[DETECT_TCPV6_CSUM].name = "tcpv6-csum"; sigmatch_table[DETECT_TCPV6_CSUM].Match = DetectTCPV6CsumMatch; sigmatch_table[DETECT_TCPV6_CSUM].Setup = DetectTCPV6CsumSetup; sigmatch_table[DETECT_TCPV6_CSUM].Free = DetectTCPV6CsumFree; sigmatch_table[DETECT_TCPV6_CSUM].RegisterTests = NULL; sigmatch_table[DETECT_UDPV4_CSUM].name = "udpv4-csum"; sigmatch_table[DETECT_UDPV4_CSUM].Match = DetectUDPV4CsumMatch; sigmatch_table[DETECT_UDPV4_CSUM].Setup = DetectUDPV4CsumSetup; sigmatch_table[DETECT_UDPV4_CSUM].Free = DetectUDPV4CsumFree; sigmatch_table[DETECT_UDPV4_CSUM].RegisterTests = NULL; sigmatch_table[DETECT_UDPV6_CSUM].name = "udpv6-csum"; sigmatch_table[DETECT_UDPV6_CSUM].Match = DetectUDPV6CsumMatch; sigmatch_table[DETECT_UDPV6_CSUM].Setup = DetectUDPV6CsumSetup; sigmatch_table[DETECT_UDPV6_CSUM].Free = DetectUDPV6CsumFree; sigmatch_table[DETECT_UDPV6_CSUM].RegisterTests = NULL; sigmatch_table[DETECT_ICMPV4_CSUM].name = "icmpv4-csum"; sigmatch_table[DETECT_ICMPV4_CSUM].Match = DetectICMPV4CsumMatch; sigmatch_table[DETECT_ICMPV4_CSUM].Setup = DetectICMPV4CsumSetup; sigmatch_table[DETECT_ICMPV4_CSUM].Free = DetectICMPV4CsumFree; sigmatch_table[DETECT_ICMPV4_CSUM].RegisterTests = NULL; sigmatch_table[DETECT_ICMPV6_CSUM].name = "icmpv6-csum"; sigmatch_table[DETECT_ICMPV6_CSUM].Match = DetectICMPV6CsumMatch; sigmatch_table[DETECT_ICMPV6_CSUM].Setup = DetectICMPV6CsumSetup; sigmatch_table[DETECT_ICMPV6_CSUM].Free = DetectICMPV6CsumFree; sigmatch_table[DETECT_ICMPV6_CSUM].RegisterTests = NULL; return; } /** * \brief Validates and parses the argument supplied with the checksum keyword. * Accepts strings both with and without quotes, i.e. valid, \"valid\", * invalid and \"invalid\" * * \param key Pointer to a const character string holding the csum keyword value * \param cd Pointer to the DetectCsumData structure that holds the keyword * value sent as argument * * \retval 1 the keyvalue has been parsed successfully * \retval 0 error */ static int DetectCsumParseArg(const char *key, DetectCsumData *cd) { char *str; if (key[0] == '\"' && key[strlen(key) - 1] == '\"') { str = SCStrdup(key + 1); if (unlikely(str == NULL)) { goto error; } str[strlen(key) - 2] = '\0'; } else { str = SCStrdup(key); if (unlikely(str == NULL)) { goto error; } } if (strcasecmp(str, DETECT_CSUM_VALID) == 0 || strcasecmp(str, DETECT_CSUM_INVALID) == 0) { cd->valid = (strcasecmp(key, DETECT_CSUM_VALID) == 0); SCFree(str); return 1; } error: if (str != NULL) SCFree(str); return 0; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * ipv4 checksum, based on whether ipv4-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectIPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip4h == NULL || PKT_IS_PSEUDOPKT(p)) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level3_comp_csum == -1) p->level3_comp_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h, IPV4_GET_HLEN(p)); if (p->level3_comp_csum == p->ip4h->ip_csum && cd->valid == 1) return 1; else if (p->level3_comp_csum != p->ip4h->ip_csum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the ipv4-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectIPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPV4_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectIPV4CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectIPV4CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * tcpv4 checksum, based on whether tcpv4-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectTCPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip4h == NULL || p->tcph == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p)) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) p->level4_comp_csum = TCPCalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); if (p->level4_comp_csum == p->tcph->th_sum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->tcph->th_sum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the tcpv4-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectTCPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TCPV4_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectTCPV4CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectTCPV4CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * tcpv6 checksum, based on whether tcpv6-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectTCPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip6h == NULL || p->tcph == NULL || p->proto != IPPROTO_TCP || PKT_IS_PSEUDOPKT(p)) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) p->level4_comp_csum = TCPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); if (p->level4_comp_csum == p->tcph->th_sum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->tcph->th_sum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the tcpv6-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectTCPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TCPV6_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectTCPV6CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectTCPV6CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * udpv4 checksum, based on whether udpv4-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectUDPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip4h == NULL || p->udph == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p) || p->udph->uh_sum == 0) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) p->level4_comp_csum = UDPV4CalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN) ); if (p->level4_comp_csum == p->udph->uh_sum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->udph->uh_sum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the udpv4-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectUDPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_UDPV4_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectUDPV4CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectUDPV4CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * udpv6 checksum, based on whether udpv6-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectUDPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip6h == NULL || p->udph == NULL || p->proto != IPPROTO_UDP || PKT_IS_PSEUDOPKT(p)) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) p->level4_comp_csum = UDPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN) ); if (p->level4_comp_csum == p->udph->uh_sum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->udph->uh_sum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the udpv6-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectUDPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_UDPV6_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (void *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectUDPV6CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectUDPV6CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * icmpv4 checksum, based on whether icmpv4-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectICMPV4CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip4h == NULL || p->icmpv4h == NULL || p->proto != IPPROTO_ICMP || PKT_IS_PSEUDOPKT(p)) return 0; if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) p->level4_comp_csum = ICMPV4CalculateChecksum((uint16_t *)p->icmpv4h, ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)) - IPV4_GET_RAW_HLEN(p->ip4h) * 4); if (p->level4_comp_csum == p->icmpv4h->checksum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->icmpv4h->checksum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the icmpv4-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectICMPV4CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; //printf("DetectCsumSetup: \'%s\'\n", csum_str); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ICMPV4_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectICMPV4CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectICMPV4CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /** * \brief Checks if the packet sent as the argument, has a valid or invalid * icmpv6 checksum, based on whether icmpv6-csum option for this rule * has been supplied with "valid" or "invalid" argument * * \param t Pointer to the tv for this detection module instance * \param det_ctx Pointer to the detection engine thread context * \param p Pointer to the Packet currently being matched * \param s Pointer to the Signature, the packet is being currently * matched with * \param m Pointer to the keyword_structure(SigMatch) from the above * Signature, the Packet is being currently matched with * * \retval 1 if the Packet contents match the keyword option; 0 otherwise */ int DetectICMPV6CsumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectCsumData *cd = (const DetectCsumData *)ctx; if (p->ip6h == NULL || p->icmpv6h == NULL || p->proto != IPPROTO_ICMPV6 || PKT_IS_PSEUDOPKT(p) || (GET_PKT_LEN(p) - ((uint8_t *)p->icmpv6h - GET_PKT_DATA(p))) <= 0) { return 0; } if (p->flags & PKT_IGNORE_CHECKSUM) { return cd->valid; } if (p->level4_comp_csum == -1) { uint16_t len = IPV6_GET_RAW_PLEN(p->ip6h) - ((uint8_t *)p->icmpv6h - (uint8_t *)p->ip6h - IPV6_HEADER_LEN); p->level4_comp_csum = ICMPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->icmpv6h, len); } if (p->level4_comp_csum == p->icmpv6h->csum && cd->valid == 1) return 1; else if (p->level4_comp_csum != p->icmpv6h->csum && cd->valid == 0) return 1; else return 0; } /** * \brief Creates a SigMatch for the icmpv6-csum keyword being sent as argument, * and appends it to the Signature(s). Accepts 2 values for the * keyword - "valid" and "invalid", both with and without quotes * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param csum_str Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectICMPV6CsumSetup(DetectEngineCtx *de_ctx, Signature *s, char *csum_str) { DetectCsumData *cd = NULL; SigMatch *sm = NULL; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ICMPV6_CSUM; if ( (cd = SCMalloc(sizeof(DetectCsumData))) == NULL) goto error; memset(cd, 0, sizeof(DetectCsumData)); if (DetectCsumParseArg(csum_str, cd) == 0) goto error; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (cd != NULL) DetectICMPV6CsumFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectICMPV6CsumFree(void *ptr) { DetectCsumData *cd = (DetectCsumData *)ptr; if (cd != NULL) SCFree(cd); return; } /* ---------------------------------- Unit Tests --------------------------- */ #ifdef UNITTESTS int DetectCsumIPV4ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectIPV4CsumSetup(NULL, &s, "\"valid\"") == 0); result &= (DetectIPV4CsumSetup(NULL, &s, "\"invalid\"") == 0); result &= (DetectIPV4CsumSetup(NULL, &s, "\"vaLid\"") == 0); result &= (DetectIPV4CsumSetup(NULL, &s, "\"VALID\"") == 0); result &= (DetectIPV4CsumSetup(NULL, &s, "\"iNvaLid\"") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectIPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumIPV4InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectIPV4CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectIPV4CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectIPV4CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectIPV4CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectIPV4CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectIPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumIPV4ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectIPV4CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectIPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectIPV4CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectIPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV4ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV4CsumSetup(NULL, &s, "valid") == 0); result &= (DetectICMPV4CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectICMPV4CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectICMPV4CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectICMPV4CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectICMPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV4InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV4CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectICMPV4CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectICMPV4CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectICMPV4CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectICMPV4CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectICMPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV4ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV4CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectICMPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectICMPV4CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectICMPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV4ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV4CsumSetup(NULL, &s, "valid") == 0); result &= (DetectTCPV4CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectTCPV4CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectTCPV4CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectTCPV4CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectTCPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV4InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV4CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectTCPV4CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectTCPV4CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectTCPV4CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectTCPV4CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectTCPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV4ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV4CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectTCPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectTCPV4CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectTCPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV4ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV4CsumSetup(NULL, &s, "valid") == 0); result &= (DetectUDPV4CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectUDPV4CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectUDPV4CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectUDPV4CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectUDPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV4InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV4CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectUDPV4CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectUDPV4CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectUDPV4CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectUDPV4CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectUDPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV4ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV4CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectUDPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectUDPV4CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectUDPV4CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV6ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV6CsumSetup(NULL, &s, "valid") == 0); result &= (DetectTCPV6CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectTCPV6CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectTCPV6CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectTCPV6CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectTCPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV6InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV6CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectTCPV6CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectTCPV6CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectTCPV6CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectTCPV6CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectTCPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumTCPV6ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectTCPV6CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectTCPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectTCPV6CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectTCPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV6ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV6CsumSetup(NULL, &s, "valid") == 0); result &= (DetectUDPV6CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectUDPV6CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectUDPV6CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectUDPV6CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectUDPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV6InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV6CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectUDPV6CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectUDPV6CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectUDPV6CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectUDPV6CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectUDPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumUDPV6ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectUDPV6CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectUDPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectUDPV6CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectUDPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV6ValidArgsTestParse01(void) { Signature s; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV6CsumSetup(NULL, &s, "valid") == 0); result &= (DetectICMPV6CsumSetup(NULL, &s, "invalid") == 0); result &= (DetectICMPV6CsumSetup(NULL, &s, "vaLid") == 0); result &= (DetectICMPV6CsumSetup(NULL, &s, "VALID") == 0); result &= (DetectICMPV6CsumSetup(NULL, &s, "iNvaLid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectICMPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV6InValidArgsTestParse02(void) { Signature s; int result = -1; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV6CsumSetup(NULL, &s, "vaid") == -1); result &= (DetectICMPV6CsumSetup(NULL, &s, "invaalid") == -1); result &= (DetectICMPV6CsumSetup(NULL, &s, "vaLiid") == -1); result &= (DetectICMPV6CsumSetup(NULL, &s, "VALieD") == -1); result &= (DetectICMPV6CsumSetup(NULL, &s, "iNvamid") == -1); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { DetectICMPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } int DetectCsumICMPV6ValidArgsTestParse03(void) { Signature s; DetectCsumData *cd = NULL; int result = 0; SigMatch *temp = NULL; memset(&s, 0, sizeof(Signature)); result = (DetectICMPV6CsumSetup(NULL, &s, "valid") == 0); while (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 1); } DetectICMPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } s.sm_lists[DETECT_SM_LIST_MATCH] = NULL; result &= (DetectICMPV6CsumSetup(NULL, &s, "INVALID") == 0); if (s.sm_lists[DETECT_SM_LIST_MATCH] != NULL) { if (s.sm_lists[DETECT_SM_LIST_MATCH]->ctx != NULL) { cd = (DetectCsumData *)s.sm_lists[DETECT_SM_LIST_MATCH]->ctx; result &= (cd->valid == 0); } DetectICMPV6CsumFree(s.sm_lists[DETECT_SM_LIST_MATCH]->ctx); temp = s.sm_lists[DETECT_SM_LIST_MATCH]; s.sm_lists[DETECT_SM_LIST_MATCH] = s.sm_lists[DETECT_SM_LIST_MATCH]->next; SCFree(temp); } return result; } #include "detect-engine.h" #include "stream-tcp.h" int DetectCsumICMPV6Test01(void) { int result = 0; DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DecodeThreadVars dtv; Packet *p = PacketGetFromAlloc(); if (p == NULL) { printf("failure PacketGetFromAlloc\n"); goto end; } uint8_t pkt[] = { 0x00, 0x30, 0x18, 0xa8, 0x7c, 0x23, 0x2c, 0x41, 0x38, 0xa7, 0xea, 0xeb, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x40, 0x3c, 0x40, 0xad, 0xa1, 0x09, 0x80, 0x00, 0x01, 0xd6, 0xf3, 0x20, 0x01, 0xf4, 0xbe, 0xea, 0x3c, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x32, 0xb2, 0x00, 0x01, 0x32, 0xb2, 0x09, 0x80, 0x20, 0x01, 0x00, 0x00, 0x3c, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x63, 0xc2, 0x00, 0x00, 0x00, 0x00 }; PacketCopyData(p, pkt, sizeof(pkt)); memset(&tv, 0, sizeof(tv)); memset(&dtv, 0, sizeof(dtv)); StreamTcpInitConfig(TRUE); FlowInitConfig(FLOW_QUIET); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("DetectEngineCtxInit failure\n"); goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(icmpv6-csum:valid; sid:1;)"); if (s == NULL) { printf("SigInit failed\n"); goto end; } SigGroupBuild(de_ctx); DecodeEthernet(&tv, &dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), NULL); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert on p, but it should: "); goto end; } result = 1; end: if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } #endif /* UNITTESTS */ void DetectCsumRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectCsumIPV4ValidArgsTestParse01", DetectCsumIPV4ValidArgsTestParse01); UtRegisterTest("DetectCsumIPV4InValidArgsTestParse02", DetectCsumIPV4InValidArgsTestParse02); UtRegisterTest("DetectCsumIPV4ValidArgsTestParse03", DetectCsumIPV4ValidArgsTestParse03); UtRegisterTest("DetectCsumICMPV4ValidArgsTestParse01", DetectCsumICMPV4ValidArgsTestParse01); UtRegisterTest("DetectCsumICMPV4InValidArgsTestParse02", DetectCsumICMPV4InValidArgsTestParse02); UtRegisterTest("DetectCsumICMPV4ValidArgsTestParse03", DetectCsumICMPV4ValidArgsTestParse03); UtRegisterTest("DetectCsumTCPV4ValidArgsTestParse01", DetectCsumTCPV4ValidArgsTestParse01); UtRegisterTest("DetectCsumTCPV4InValidArgsTestParse02", DetectCsumTCPV4InValidArgsTestParse02); UtRegisterTest("DetectCsumTCPV4ValidArgsTestParse03", DetectCsumTCPV4ValidArgsTestParse03); UtRegisterTest("DetectCsumUDPV4ValidArgsTestParse01", DetectCsumUDPV4ValidArgsTestParse01); UtRegisterTest("DetectCsumUDPV4InValidArgsTestParse02", DetectCsumUDPV4InValidArgsTestParse02); UtRegisterTest("DetectCsumUDPV4ValidArgsTestParse03", DetectCsumUDPV4ValidArgsTestParse03); UtRegisterTest("DetectCsumUDPV6ValidArgsTestParse01", DetectCsumUDPV6ValidArgsTestParse01); UtRegisterTest("DetectCsumUDPV6InValidArgsTestParse02", DetectCsumUDPV6InValidArgsTestParse02); UtRegisterTest("DetectCsumUDPV6ValidArgsTestParse03", DetectCsumUDPV6ValidArgsTestParse03); UtRegisterTest("DetectCsumTCPV6ValidArgsTestParse01", DetectCsumTCPV6ValidArgsTestParse01); UtRegisterTest("DetectCsumTCPV6InValidArgsTestParse02", DetectCsumTCPV6InValidArgsTestParse02); UtRegisterTest("DetectCsumTCPV6ValidArgsTestParse03", DetectCsumTCPV6ValidArgsTestParse03); UtRegisterTest("DetectCsumICMPV6ValidArgsTestParse01", DetectCsumICMPV6ValidArgsTestParse01); UtRegisterTest("DetectCsumICMPV6InValidArgsTestParse02", DetectCsumICMPV6InValidArgsTestParse02); UtRegisterTest("DetectCsumICMPV6ValidArgsTestParse03", DetectCsumICMPV6ValidArgsTestParse03); UtRegisterTest("DetectCsumICMPV6Test01", DetectCsumICMPV6Test01); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-smtp.c0000644000000000000000000001655513051004444014451 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Implements SMTP JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-smtp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "output-json.h" #include "output-json-email-common.h" #ifdef HAVE_LIBJANSSON static json_t *JsonSmtpDataLogger(const Flow *f, void *state, void *vtx, uint64_t tx_id) { json_t *sjs = json_object(); SMTPTransaction *tx = vtx; SMTPString *rcptto_str; if (sjs == NULL) { return NULL; } if (((SMTPState *)state)->helo) { json_object_set_new(sjs, "helo", json_string((const char *)((SMTPState *)state)->helo)); } if (tx->mail_from) { json_object_set_new(sjs, "mail_from", json_string((const char *)tx->mail_from)); } if (!TAILQ_EMPTY(&tx->rcpt_to_list)) { json_t *js_rcptto = json_array(); if (likely(js_rcptto != NULL)) { TAILQ_FOREACH(rcptto_str, &tx->rcpt_to_list, next) { json_array_append_new(js_rcptto, json_string((char *)rcptto_str->str)); } json_object_set_new(sjs, "rcpt_to", js_rcptto); } } return sjs; } static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { SCEnter(); JsonEmailLogThread *jhl = (JsonEmailLogThread *)thread_data; json_t *sjs; json_t *js = CreateJSONHeaderWithTxId((Packet *)p, 1, "smtp", tx_id); if (unlikely(js == NULL)) return TM_ECODE_OK; /* reset */ MemBufferReset(jhl->buffer); sjs = JsonSmtpDataLogger(f, state, tx, tx_id); if (sjs) { json_object_set_new(js, "smtp", sjs); } if (JsonEmailLogJson(jhl, js, p, f, state, tx, tx_id) == TM_ECODE_OK) { OutputJSONBuffer(js, jhl->emaillog_ctx->file_ctx, &jhl->buffer); } json_object_del(js, "email"); if (sjs) { json_object_del(js, "smtp"); } json_object_clear(js); json_decref(js); SCReturnInt(TM_ECODE_OK); } json_t *JsonSMTPAddMetadata(const Flow *f, uint64_t tx_id) { SMTPState *smtp_state = (SMTPState *)FlowGetAppState(f); if (smtp_state) { SMTPTransaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_SMTP, smtp_state, tx_id); if (tx) { return JsonSmtpDataLogger(f, smtp_state, tx, tx_id); } } return NULL; } static void OutputSmtpLogDeInitCtx(OutputCtx *output_ctx) { OutputJsonEmailCtx *email_ctx = output_ctx->data; if (email_ctx != NULL) { LogFileFreeCtx(email_ctx->file_ctx); SCFree(email_ctx); } SCFree(output_ctx); } static void OutputSmtpLogDeInitCtxSub(OutputCtx *output_ctx) { SCLogDebug("cleaning up sub output_ctx %p", output_ctx); OutputJsonEmailCtx *email_ctx = output_ctx->data; if (email_ctx != NULL) { SCFree(email_ctx); } SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "smtp.json" OutputCtx *OutputSmtpLogInit(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_SMTP_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } OutputJsonEmailCtx *email_ctx = SCMalloc(sizeof(OutputJsonEmailCtx)); if (unlikely(email_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(email_ctx); return NULL; } email_ctx->file_ctx = file_ctx; output_ctx->data = email_ctx; output_ctx->DeInit = OutputSmtpLogDeInitCtx; /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_SMTP); return output_ctx; } static OutputCtx *OutputSmtpLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; OutputJsonEmailCtx *email_ctx = SCMalloc(sizeof(OutputJsonEmailCtx)); if (unlikely(email_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(email_ctx); return NULL; } email_ctx->file_ctx = ojc->file_ctx; OutputEmailInitConf(conf, email_ctx); output_ctx->data = email_ctx; output_ctx->DeInit = OutputSmtpLogDeInitCtxSub; /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_SMTP); return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonSmtpLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonEmailLogThread *aft = SCMalloc(sizeof(JsonEmailLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonEmailLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogSMTP. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->emaillog_ctx = ((OutputCtx *)initdata)->data; aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonSmtpLogThreadDeinit(ThreadVars *t, void *data) { JsonEmailLogThread *aft = (JsonEmailLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonEmailLogThread)); SCFree(aft); return TM_ECODE_OK; } void JsonSmtpLogRegister (void) { /* register as separate module */ OutputRegisterTxModule(LOGGER_JSON_SMTP, "JsonSmtpLog", "smtp-json-log", OutputSmtpLogInit, ALPROTO_SMTP, JsonSmtpLogger, JsonSmtpLogThreadInit, JsonSmtpLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterTxSubModule(LOGGER_JSON_SMTP, "eve-log", "JsonSmtpLog", "eve-log.smtp", OutputSmtpLogInitSub, ALPROTO_SMTP, JsonSmtpLogger, JsonSmtpLogThreadInit, JsonSmtpLogThreadDeinit, NULL); } #else void JsonSmtpLogRegister (void) { } #endif suricata-3.2.1/src/output-json-dns.c0000644000000000000000000006500713051004444014246 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Implements JSON DNS logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "util-mem.h" #include "app-layer-parser.h" #include "output.h" #include "app-layer-dns-udp.h" #include "app-layer.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "output-json.h" #ifdef HAVE_LIBJANSSON /* we can do query logging as well, but it's disabled for now as the * TX id handling doesn't expect it */ #define QUERY 0 #define LOG_QUERIES BIT_U64(0) #define LOG_ANSWERS BIT_U64(1) #define LOG_A BIT_U64(2) #define LOG_NS BIT_U64(3) #define LOG_MD BIT_U64(4) #define LOG_MF BIT_U64(5) #define LOG_CNAME BIT_U64(6) #define LOG_SOA BIT_U64(7) #define LOG_MB BIT_U64(8) #define LOG_MG BIT_U64(9) #define LOG_MR BIT_U64(10) #define LOG_NULL BIT_U64(11) #define LOG_WKS BIT_U64(12) #define LOG_PTR BIT_U64(13) #define LOG_HINFO BIT_U64(14) #define LOG_MINFO BIT_U64(15) #define LOG_MX BIT_U64(16) #define LOG_TXT BIT_U64(17) #define LOG_RP BIT_U64(18) #define LOG_AFSDB BIT_U64(19) #define LOG_X25 BIT_U64(20) #define LOG_ISDN BIT_U64(21) #define LOG_RT BIT_U64(22) #define LOG_NSAP BIT_U64(23) #define LOG_NSAPPTR BIT_U64(24) #define LOG_SIG BIT_U64(25) #define LOG_KEY BIT_U64(26) #define LOG_PX BIT_U64(27) #define LOG_GPOS BIT_U64(28) #define LOG_AAAA BIT_U64(29) #define LOG_LOC BIT_U64(30) #define LOG_NXT BIT_U64(31) #define LOG_SRV BIT_U64(32) #define LOG_ATMA BIT_U64(33) #define LOG_NAPTR BIT_U64(34) #define LOG_KX BIT_U64(35) #define LOG_CERT BIT_U64(36) #define LOG_A6 BIT_U64(37) #define LOG_DNAME BIT_U64(38) #define LOG_OPT BIT_U64(39) #define LOG_APL BIT_U64(40) #define LOG_DS BIT_U64(41) #define LOG_SSHFP BIT_U64(42) #define LOG_IPSECKEY BIT_U64(43) #define LOG_RRSIG BIT_U64(44) #define LOG_NSEC BIT_U64(45) #define LOG_DNSKEY BIT_U64(46) #define LOG_DHCID BIT_U64(47) #define LOG_NSEC3 BIT_U64(48) #define LOG_NSEC3PARAM BIT_U64(49) #define LOG_TLSA BIT_U64(50) #define LOG_HIP BIT_U64(51) #define LOG_CDS BIT_U64(52) #define LOG_CDNSKEY BIT_U64(53) #define LOG_SPF BIT_U64(54) #define LOG_TKEY BIT_U64(55) #define LOG_TSIG BIT_U64(56) #define LOG_MAILA BIT_U64(57) #define LOG_ANY BIT_U64(58) #define LOG_URI BIT_U64(59) #define LOG_ALL_RRTYPES (~(uint64_t)(LOG_QUERIES|LOG_ANSWERS)) typedef enum { DNS_RRTYPE_A = 0, DNS_RRTYPE_NS, DNS_RRTYPE_MD, DNS_RRTYPE_MF, DNS_RRTYPE_CNAME, DNS_RRTYPE_SOA, DNS_RRTYPE_MB, DNS_RRTYPE_MG, DNS_RRTYPE_MR, DNS_RRTYPE_NULL, DNS_RRTYPE_WKS, DNS_RRTYPE_PTR, DNS_RRTYPE_HINFO, DNS_RRTYPE_MINFO, DNS_RRTYPE_MX, DNS_RRTYPE_TXT, DNS_RRTYPE_RP, DNS_RRTYPE_AFSDB, DNS_RRTYPE_X25, DNS_RRTYPE_ISDN, DNS_RRTYPE_RT, DNS_RRTYPE_NSAP, DNS_RRTYPE_NSAPPTR, DNS_RRTYPE_SIG, DNS_RRTYPE_KEY, DNS_RRTYPE_PX, DNS_RRTYPE_GPOS, DNS_RRTYPE_AAAA, DNS_RRTYPE_LOC, DNS_RRTYPE_NXT, DNS_RRTYPE_SRV, DNS_RRTYPE_ATMA, DNS_RRTYPE_NAPTR, DNS_RRTYPE_KX, DNS_RRTYPE_CERT, DNS_RRTYPE_A6, DNS_RRTYPE_DNAME, DNS_RRTYPE_OPT, DNS_RRTYPE_APL, DNS_RRTYPE_DS, DNS_RRTYPE_SSHFP, DNS_RRTYPE_IPSECKEY, DNS_RRTYPE_RRSIG, DNS_RRTYPE_NSEC, DNS_RRTYPE_DNSKEY, DNS_RRTYPE_DHCID, DNS_RRTYPE_NSEC3, DNS_RRTYPE_NSEC3PARAM, DNS_RRTYPE_TLSA, DNS_RRTYPE_HIP, DNS_RRTYPE_CDS, DNS_RRTYPE_CDNSKEY, DNS_RRTYPE_SPF, DNS_RRTYPE_TKEY, DNS_RRTYPE_TSIG, DNS_RRTYPE_MAILA, DNS_RRTYPE_ANY, DNS_RRTYPE_URI } DnsRRTypes; static struct { char *config_rrtype; uint64_t flags; } dns_rrtype_fields[] = { { "a", LOG_A }, { "ns", LOG_NS }, { "md", LOG_MD }, { "mf", LOG_MF }, { "cname", LOG_CNAME }, { "soa", LOG_SOA }, { "mb", LOG_MB }, { "mg", LOG_MG }, { "mr", LOG_MR }, { "null", LOG_NULL }, { "wks", LOG_WKS }, { "ptr", LOG_PTR }, { "hinfo", LOG_HINFO }, { "minfo", LOG_MINFO }, { "mx", LOG_MX }, { "txt", LOG_TXT }, { "rp", LOG_RP }, { "afsdb", LOG_AFSDB }, { "x25", LOG_X25 }, { "isdn", LOG_ISDN }, { "rt", LOG_RT }, { "nsap", LOG_NSAP }, { "nsapptr", LOG_NSAPPTR }, { "sig", LOG_SIG }, { "key", LOG_KEY }, { "px", LOG_PX }, { "gpos", LOG_GPOS }, { "aaaa", LOG_AAAA }, { "loc", LOG_LOC }, { "nxt", LOG_NXT }, { "srv", LOG_SRV }, { "atma", LOG_ATMA }, { "naptr", LOG_NAPTR }, { "kx", LOG_KX }, { "cert", LOG_CERT }, { "a6", LOG_A6 }, { "dname", LOG_DNAME }, { "opt", LOG_OPT }, { "apl", LOG_APL }, { "ds", LOG_DS }, { "sshfp", LOG_SSHFP }, { "ipseckey", LOG_IPSECKEY }, { "rrsig", LOG_RRSIG }, { "nsec", LOG_NSEC }, { "dnskey", LOG_DNSKEY }, { "dhcid", LOG_DHCID }, { "nsec3", LOG_NSEC3 }, { "nsec3param", LOG_NSEC3PARAM }, { "tlsa", LOG_TLSA }, { "hip", LOG_HIP }, { "cds", LOG_CDS }, { "cdnskey", LOG_CDNSKEY }, { "spf", LOG_SPF }, { "tkey", LOG_TKEY }, { "tsig", LOG_TSIG }, { "maila", LOG_MAILA }, { "any", LOG_ANY }, { "uri", LOG_URI } }; typedef struct LogDnsFileCtx_ { LogFileCtx *file_ctx; uint64_t flags; /** Store mode */ } LogDnsFileCtx; typedef struct LogDnsLogThread_ { LogDnsFileCtx *dnslog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t dns_cnt; MemBuffer *buffer; } LogDnsLogThread; static int DNSRRTypeEnabled(uint16_t type, uint64_t flags) { if (likely(flags == ~0UL)) { return 1; } switch (type) { case DNS_RECORD_TYPE_A: return ((flags & LOG_A) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NS: return ((flags & LOG_NS) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MD: return ((flags & LOG_MD) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MF: return ((flags & LOG_MF) != 0) ? 1 : 0; case DNS_RECORD_TYPE_CNAME: return ((flags & LOG_CNAME) != 0) ? 1 : 0; case DNS_RECORD_TYPE_SOA: return ((flags & LOG_SOA) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MB: return ((flags & LOG_MB) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MG: return ((flags & LOG_MG) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MR: return ((flags & LOG_MR) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NULL: return ((flags & LOG_NULL) != 0) ? 1 : 0; case DNS_RECORD_TYPE_WKS: return ((flags & LOG_WKS) != 0) ? 1 : 0; case DNS_RECORD_TYPE_PTR: return ((flags & LOG_PTR) != 0) ? 1 : 0; case DNS_RECORD_TYPE_HINFO: return ((flags & LOG_HINFO) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MINFO: return ((flags & LOG_MINFO) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MX: return ((flags & LOG_MX) != 0) ? 1 : 0; case DNS_RECORD_TYPE_TXT: return ((flags & LOG_TXT) != 0) ? 1 : 0; case DNS_RECORD_TYPE_RP: return ((flags & LOG_RP) != 0) ? 1 : 0; case DNS_RECORD_TYPE_AFSDB: return ((flags & LOG_AFSDB) != 0) ? 1 : 0; case DNS_RECORD_TYPE_X25: return ((flags & LOG_X25) != 0) ? 1 : 0; case DNS_RECORD_TYPE_ISDN: return ((flags & LOG_ISDN) != 0) ? 1 : 0; case DNS_RECORD_TYPE_RT: return ((flags & LOG_RT) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NSAP: return ((flags & LOG_NSAP) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NSAPPTR: return ((flags & LOG_NSAPPTR) != 0) ? 1 : 0; case DNS_RECORD_TYPE_SIG: return ((flags & LOG_SIG) != 0) ? 1 : 0; case DNS_RECORD_TYPE_KEY: return ((flags & LOG_KEY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_PX: return ((flags & LOG_PX) != 0) ? 1 : 0; case DNS_RECORD_TYPE_GPOS: return ((flags & LOG_GPOS) != 0) ? 1 : 0; case DNS_RECORD_TYPE_AAAA: return ((flags & LOG_AAAA) != 0) ? 1 : 0; case DNS_RECORD_TYPE_LOC: return ((flags & LOG_LOC) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NXT: return ((flags & LOG_NXT) != 0) ? 1 : 0; case DNS_RECORD_TYPE_SRV: return ((flags & LOG_SRV) != 0) ? 1 : 0; case DNS_RECORD_TYPE_ATMA: return ((flags & LOG_ATMA) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NAPTR: return ((flags & LOG_NAPTR) != 0) ? 1 : 0; case DNS_RECORD_TYPE_KX: return ((flags & LOG_KX) != 0) ? 1 : 0; case DNS_RECORD_TYPE_CERT: return ((flags & LOG_CERT) != 0) ? 1 : 0; case DNS_RECORD_TYPE_A6: return ((flags & LOG_A6) != 0) ? 1 : 0; case DNS_RECORD_TYPE_DNAME: return ((flags & LOG_DNAME) != 0) ? 1 : 0; case DNS_RECORD_TYPE_OPT: return ((flags & LOG_OPT) != 0) ? 1 : 0; case DNS_RECORD_TYPE_APL: return ((flags & LOG_APL) != 0) ? 1 : 0; case DNS_RECORD_TYPE_DS: return ((flags & LOG_DS) != 0) ? 1 : 0; case DNS_RECORD_TYPE_SSHFP: return ((flags & LOG_SSHFP) != 0) ? 1 : 0; case DNS_RECORD_TYPE_IPSECKEY: return ((flags & LOG_IPSECKEY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_RRSIG: return ((flags & LOG_RRSIG) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NSEC: return ((flags & LOG_NSEC) != 0) ? 1 : 0; case DNS_RECORD_TYPE_DNSKEY: return ((flags & LOG_DNSKEY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_DHCID: return ((flags & LOG_DHCID) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NSEC3: return ((flags & LOG_NSEC3) != 0) ? 1 : 0; case DNS_RECORD_TYPE_NSEC3PARAM: return ((flags & LOG_NSEC3PARAM) != 0) ? 1 : 0; case DNS_RECORD_TYPE_TLSA: return ((flags & LOG_TLSA) != 0) ? 1 : 0; case DNS_RECORD_TYPE_HIP: return ((flags & LOG_HIP) != 0) ? 1 : 0; case DNS_RECORD_TYPE_CDS: return ((flags & LOG_CDS) != 0) ? 1 : 0; case DNS_RECORD_TYPE_CDNSKEY: return ((flags & LOG_CDNSKEY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_SPF: return ((flags & LOG_SPF) != 0) ? 1 : 0; case DNS_RECORD_TYPE_TKEY: return ((flags & LOG_TKEY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_TSIG: return ((flags & LOG_TSIG) != 0) ? 1 : 0; case DNS_RECORD_TYPE_MAILA: return ((flags & LOG_MAILA) != 0) ? 1 : 0; case DNS_RECORD_TYPE_ANY: return ((flags & LOG_ANY) != 0) ? 1 : 0; case DNS_RECORD_TYPE_URI: return ((flags & LOG_URI) != 0) ? 1 : 0; default: return 0; } } static void LogQuery(LogDnsLogThread *aft, json_t *js, DNSTransaction *tx, uint64_t tx_id, DNSQueryEntry *entry) __attribute__((nonnull)); static void LogQuery(LogDnsLogThread *aft, json_t *js, DNSTransaction *tx, uint64_t tx_id, DNSQueryEntry *entry) { SCLogDebug("got a DNS request and now logging !!"); if (!DNSRRTypeEnabled(entry->type, aft->dnslog_ctx->flags)) { return; } json_t *djs = json_object(); if (djs == NULL) { return; } /* reset */ MemBufferReset(aft->buffer); /* type */ json_object_set_new(djs, "type", json_string("query")); /* id */ json_object_set_new(djs, "id", json_integer(tx->tx_id)); /* query */ char *c; c = BytesToString((uint8_t *)((uint8_t *)entry + sizeof(DNSQueryEntry)), entry->len); if (c != NULL) { json_object_set_new(djs, "rrname", json_string(c)); SCFree(c); } /* name */ char record[16] = ""; DNSCreateTypeString(entry->type, record, sizeof(record)); json_object_set_new(djs, "rrtype", json_string(record)); /* tx id (tx counter) */ json_object_set_new(djs, "tx_id", json_integer(tx_id)); /* dns */ json_object_set_new(js, "dns", djs); OutputJSONBuffer(js, aft->dnslog_ctx->file_ctx, &aft->buffer); json_object_del(js, "dns"); } static void OutputAnswer(LogDnsLogThread *aft, json_t *djs, DNSTransaction *tx, DNSAnswerEntry *entry) __attribute__((nonnull)); static void OutputAnswer(LogDnsLogThread *aft, json_t *djs, DNSTransaction *tx, DNSAnswerEntry *entry) { if (!DNSRRTypeEnabled(entry->type, aft->dnslog_ctx->flags)) { return; } json_t *js = json_object(); if (js == NULL) return; /* type */ json_object_set_new(js, "type", json_string("answer")); /* id */ json_object_set_new(js, "id", json_integer(tx->tx_id)); /* rcode */ char rcode[16] = ""; DNSCreateRcodeString(tx->rcode, rcode, sizeof(rcode)); json_object_set_new(js, "rcode", json_string(rcode)); /* query */ if (entry->fqdn_len > 0) { char *c; c = BytesToString((uint8_t *)((uint8_t *)entry + sizeof(DNSAnswerEntry)), entry->fqdn_len); if (c != NULL) { json_object_set_new(js, "rrname", json_string(c)); SCFree(c); } } /* name */ char record[16] = ""; DNSCreateTypeString(entry->type, record, sizeof(record)); json_object_set_new(js, "rrtype", json_string(record)); /* ttl */ json_object_set_new(js, "ttl", json_integer(entry->ttl)); uint8_t *ptr = (uint8_t *)((uint8_t *)entry + sizeof(DNSAnswerEntry)+ entry->fqdn_len); if (entry->type == DNS_RECORD_TYPE_A && entry->data_len == 4) { char a[16] = ""; PrintInet(AF_INET, (const void *)ptr, a, sizeof(a)); json_object_set_new(js, "rdata", json_string(a)); } else if (entry->type == DNS_RECORD_TYPE_AAAA && entry->data_len == 16) { char a[46] = ""; PrintInet(AF_INET6, (const void *)ptr, a, sizeof(a)); json_object_set_new(js, "rdata", json_string(a)); } else if (entry->data_len == 0) { json_object_set_new(js, "rdata", json_string("")); } else if (entry->type == DNS_RECORD_TYPE_TXT || entry->type == DNS_RECORD_TYPE_CNAME || entry->type == DNS_RECORD_TYPE_MX || entry->type == DNS_RECORD_TYPE_PTR || entry->type == DNS_RECORD_TYPE_NS) { if (entry->data_len != 0) { char buffer[256] = ""; uint16_t copy_len = entry->data_len < (sizeof(buffer) - 1) ? entry->data_len : sizeof(buffer) - 1; memcpy(buffer, ptr, copy_len); buffer[copy_len] = '\0'; json_object_set_new(js, "rdata", json_string(buffer)); } else { json_object_set_new(js, "rdata", json_string("")); } } else if (entry->type == DNS_RECORD_TYPE_SSHFP) { if (entry->data_len > 2) { /* get algo and type */ uint8_t algo = *ptr; uint8_t fptype = *(ptr+1); /* turn fp raw buffer into a nice :-separate hex string */ uint16_t fp_len = (entry->data_len - 2); uint8_t *dptr = ptr+2; /* c-string for ':' separated hex and trailing \0. */ uint32_t output_len = fp_len * 3 + 1; char hexstring[output_len]; memset(hexstring, 0x00, output_len); uint16_t x; for (x = 0; x < fp_len; x++) { char one[4]; snprintf(one, sizeof(one), x == fp_len - 1 ? "%02x" : "%02x:", dptr[x]); strlcat(hexstring, one, output_len); } /* wrap the whole thing in it's own structure */ json_t *hjs = json_object(); if (hjs != NULL) { json_object_set_new(hjs, "fingerprint", json_string(hexstring)); json_object_set_new(hjs, "algo", json_integer(algo)); json_object_set_new(hjs, "type", json_integer(fptype)); json_object_set_new(js, "sshfp", hjs); } } } /* reset */ MemBufferReset(aft->buffer); json_object_set_new(djs, "dns", js); OutputJSONBuffer(djs, aft->dnslog_ctx->file_ctx, &aft->buffer); json_object_del(djs, "dns"); return; } static void OutputFailure(LogDnsLogThread *aft, json_t *djs, DNSTransaction *tx, DNSQueryEntry *entry) __attribute__((nonnull)); static void OutputFailure(LogDnsLogThread *aft, json_t *djs, DNSTransaction *tx, DNSQueryEntry *entry) { if (!DNSRRTypeEnabled(entry->type, aft->dnslog_ctx->flags)) { return; } json_t *js = json_object(); if (js == NULL) return; /* type */ json_object_set_new(js, "type", json_string("answer")); /* id */ json_object_set_new(js, "id", json_integer(tx->tx_id)); /* rcode */ char rcode[16] = ""; DNSCreateRcodeString(tx->rcode, rcode, sizeof(rcode)); json_object_set_new(js, "rcode", json_string(rcode)); /* no answer RRs, use query for rname */ char *c; c = BytesToString((uint8_t *)((uint8_t *)entry + sizeof(DNSQueryEntry)), entry->len); if (c != NULL) { json_object_set_new(js, "rrname", json_string(c)); SCFree(c); } /* reset */ MemBufferReset(aft->buffer); json_object_set_new(djs, "dns", js); OutputJSONBuffer(djs, aft->dnslog_ctx->file_ctx, &aft->buffer); json_object_del(djs, "dns"); return; } static void LogAnswers(LogDnsLogThread *aft, json_t *js, DNSTransaction *tx, uint64_t tx_id) { SCLogDebug("got a DNS response and now logging !!"); /* rcode != noerror */ if (tx->rcode) { /* Most DNS servers do not support multiple queries because * the rcode in response is not per-query. Multiple queries * are likely to lead to FORMERR, so log this. */ DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &tx->query_list, next) { OutputFailure(aft, js, tx, query); } } DNSAnswerEntry *entry = NULL; TAILQ_FOREACH(entry, &tx->answer_list, next) { OutputAnswer(aft, js, tx, entry); } entry = NULL; TAILQ_FOREACH(entry, &tx->authority_list, next) { OutputAnswer(aft, js, tx, entry); } } static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *alstate, void *txptr, uint64_t tx_id) { SCEnter(); LogDnsLogThread *td = (LogDnsLogThread *)thread_data; LogDnsFileCtx *dnslog_ctx = td->dnslog_ctx; DNSTransaction *tx = txptr; json_t *js; if (likely(dnslog_ctx->flags & LOG_QUERIES) != 0) { DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &tx->query_list, next) { js = CreateJSONHeader((Packet *)p, 1, "dns"); if (unlikely(js == NULL)) return TM_ECODE_OK; LogQuery(td, js, tx, tx_id, query); json_decref(js); } } SCReturnInt(TM_ECODE_OK); } static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *alstate, void *txptr, uint64_t tx_id) { SCEnter(); LogDnsLogThread *td = (LogDnsLogThread *)thread_data; LogDnsFileCtx *dnslog_ctx = td->dnslog_ctx; DNSTransaction *tx = txptr; json_t *js; if (likely(dnslog_ctx->flags & LOG_ANSWERS) != 0) { js = CreateJSONHeader((Packet *)p, 0, "dns"); if (unlikely(js == NULL)) return TM_ECODE_OK; LogAnswers(td, js, tx, tx_id); json_decref(js); } SCReturnInt(TM_ECODE_OK); } #define OUTPUT_BUFFER_SIZE 65536 static TmEcode LogDnsLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogDnsLogThread *aft = SCMalloc(sizeof(LogDnsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogDnsLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogDNS. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->dnslog_ctx= ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } static TmEcode LogDnsLogThreadDeinit(ThreadVars *t, void *data) { LogDnsLogThread *aft = (LogDnsLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogDnsLogThread)); SCFree(aft); return TM_ECODE_OK; } static void LogDnsLogDeInitCtx(OutputCtx *output_ctx) { LogDnsFileCtx *dnslog_ctx = (LogDnsFileCtx *)output_ctx->data; LogFileFreeCtx(dnslog_ctx->file_ctx); SCFree(dnslog_ctx); SCFree(output_ctx); } static void LogDnsLogDeInitCtxSub(OutputCtx *output_ctx) { SCLogDebug("cleaning up sub output_ctx %p", output_ctx); LogDnsFileCtx *dnslog_ctx = (LogDnsFileCtx *)output_ctx->data; SCFree(dnslog_ctx); SCFree(output_ctx); } static void JsonDnsLogInitFilters(LogDnsFileCtx *dnslog_ctx, ConfNode *conf) { dnslog_ctx->flags = ~0UL; if (conf) { const char *query = ConfNodeLookupChildValue(conf, "query"); if (query != NULL) { if (ConfValIsTrue(query)) { dnslog_ctx->flags |= LOG_QUERIES; } else { dnslog_ctx->flags &= ~LOG_QUERIES; } } const char *response = ConfNodeLookupChildValue(conf, "answer"); if (response != NULL) { if (ConfValIsTrue(response)) { dnslog_ctx->flags |= LOG_ANSWERS; } else { dnslog_ctx->flags &= ~LOG_ANSWERS; } } ConfNode *custom; if ((custom = ConfNodeLookupChild(conf, "custom")) != NULL) { dnslog_ctx->flags &= ~LOG_ALL_RRTYPES; ConfNode *field; TAILQ_FOREACH(field, &custom->head, next) { if (field != NULL) { DnsRRTypes f; for (f = DNS_RRTYPE_A; f < DNS_RRTYPE_TXT; f++) { if (strcasecmp(dns_rrtype_fields[f].config_rrtype, field->val) == 0) { dnslog_ctx->flags |= dns_rrtype_fields[f].flags; break; } } } } } } } static OutputCtx *JsonDnsLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; LogDnsFileCtx *dnslog_ctx = SCMalloc(sizeof(LogDnsFileCtx)); if (unlikely(dnslog_ctx == NULL)) { return NULL; } memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx)); dnslog_ctx->file_ctx = ojc->file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(dnslog_ctx); return NULL; } output_ctx->data = dnslog_ctx; output_ctx->DeInit = LogDnsLogDeInitCtxSub; JsonDnsLogInitFilters(dnslog_ctx, conf); SCLogDebug("DNS log sub-module initialized"); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DNS); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_DNS); return output_ctx; } #define DEFAULT_LOG_FILENAME "dns.json" /** \brief Create a new dns log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ static OutputCtx *JsonDnsLogInitCtx(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_DNS_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogDnsFileCtx *dnslog_ctx = SCMalloc(sizeof(LogDnsFileCtx)); if (unlikely(dnslog_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx)); dnslog_ctx->file_ctx = file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(dnslog_ctx); return NULL; } output_ctx->data = dnslog_ctx; output_ctx->DeInit = LogDnsLogDeInitCtx; JsonDnsLogInitFilters(dnslog_ctx, conf); SCLogDebug("DNS log output initialized"); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DNS); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_DNS); return output_ctx; } #define MODULE_NAME "JsonDnsLog" void JsonDnsLogRegister (void) { /* Logger for requests. */ OutputRegisterTxModuleWithProgress(LOGGER_JSON_DNS, MODULE_NAME, "dns-json-log", JsonDnsLogInitCtx, ALPROTO_DNS, JsonDnsLoggerToServer, 0, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, NULL); /* Logger for replies. */ OutputRegisterTxModuleWithProgress(LOGGER_JSON_DNS, MODULE_NAME, "dns-json-log", JsonDnsLogInitCtx, ALPROTO_DNS, JsonDnsLoggerToClient, 1, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, NULL); /* Sub-logger for requests. */ OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_DNS, "eve-log", MODULE_NAME, "eve-log.dns", JsonDnsLogInitCtxSub, ALPROTO_DNS, JsonDnsLoggerToServer, 0, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, NULL); /* Sub-logger for replies. */ OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_DNS, "eve-log", MODULE_NAME, "eve-log.dns", JsonDnsLogInitCtxSub, ALPROTO_DNS, JsonDnsLoggerToClient, 1, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, NULL); } #else void JsonDnsLogRegister (void) { } #endif suricata-3.2.1/src/detect-filemd5.c0000644000000000000000000001171613051004444013746 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "util-detect-file-hash.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-filemd5.h" #ifndef HAVE_NSS static int DetectFileMd5SetupNoSupport (DetectEngineCtx *a, Signature *b, char *c) { SCLogError(SC_ERR_NO_MD5_SUPPORT, "no MD5 calculation support built in, needed for filemd5 keyword"); return -1; } /** * \brief Registration function for keyword: filemd5 */ void DetectFileMd5Register(void) { sigmatch_table[DETECT_FILEMD5].name = "filemd5"; sigmatch_table[DETECT_FILEMD5].FileMatch = NULL; sigmatch_table[DETECT_FILEMD5].Setup = DetectFileMd5SetupNoSupport; sigmatch_table[DETECT_FILEMD5].Free = NULL; sigmatch_table[DETECT_FILEMD5].RegisterTests = NULL; sigmatch_table[DETECT_FILEMD5].flags = SIGMATCH_NOT_BUILT; SCLogDebug("registering filemd5 rule option"); return; } #else /* HAVE_NSS */ static int DetectFileMd5Setup (DetectEngineCtx *, Signature *, char *); static void DetectFileMd5RegisterTests(void); /** * \brief Registration function for keyword: filemd5 */ void DetectFileMd5Register(void) { sigmatch_table[DETECT_FILEMD5].name = "filemd5"; sigmatch_table[DETECT_FILEMD5].desc = "match file MD5 against list of MD5 checksums"; sigmatch_table[DETECT_FILEMD5].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemd5"; sigmatch_table[DETECT_FILEMD5].FileMatch = DetectFileHashMatch; sigmatch_table[DETECT_FILEMD5].Setup = DetectFileMd5Setup; sigmatch_table[DETECT_FILEMD5].Free = DetectFileHashFree; sigmatch_table[DETECT_FILEMD5].RegisterTests = DetectFileMd5RegisterTests; SCLogDebug("registering filemd5 rule option"); return; } /** * \brief this function is used to parse filemd5 options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filemd5" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFileMd5Setup (DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectFileHashSetup(de_ctx, s, str, DETECT_FILEMD5); } #ifdef UNITTESTS static int MD5MatchLookupString(ROHashTable *hash, char *string) { uint8_t md5[16]; if (ReadHashString(md5, string, "file", 88, 32) == 1) { void *ptr = ROHashLookup(hash, &md5, (uint16_t)sizeof(md5)); if (ptr == NULL) return 0; else return 1; } return 0; } static int MD5MatchTest01(void) { ROHashTable *hash = ROHashInit(4, 16); if (hash == NULL) { return 0; } if (LoadHashTable(hash, "d80f93a93dc5f3ee945704754d6e0a36", "file", 1, DETECT_FILEMD5) != 1) return 0; if (LoadHashTable(hash, "92a49985b384f0d993a36e4c2d45e206", "file", 2, DETECT_FILEMD5) != 1) return 0; if (LoadHashTable(hash, "11adeaacc8c309815f7bc3e33888f281", "file", 3, DETECT_FILEMD5) != 1) return 0; if (LoadHashTable(hash, "22e10a8fe02344ade0bea8836a1714af", "file", 4, DETECT_FILEMD5) != 1) return 0; if (LoadHashTable(hash, "c3db2cbf02c68f073afcaee5634677bc", "file", 5, DETECT_FILEMD5) != 1) return 0; if (LoadHashTable(hash, "7ed095da259638f42402fb9e74287a17", "file", 6, DETECT_FILEMD5) != 1) return 0; if (ROHashInitFinalize(hash) != 1) { return 0; } if (MD5MatchLookupString(hash, "d80f93a93dc5f3ee945704754d6e0a36") != 1) return 0; if (MD5MatchLookupString(hash, "92a49985b384f0d993a36e4c2d45e206") != 1) return 0; if (MD5MatchLookupString(hash, "11adeaacc8c309815f7bc3e33888f281") != 1) return 0; if (MD5MatchLookupString(hash, "22e10a8fe02344ade0bea8836a1714af") != 1) return 0; if (MD5MatchLookupString(hash, "c3db2cbf02c68f073afcaee5634677bc") != 1) return 0; if (MD5MatchLookupString(hash, "7ed095da259638f42402fb9e74287a17") != 1) return 0; /* shouldn't match */ if (MD5MatchLookupString(hash, "33333333333333333333333333333333") == 1) return 0; ROHashFree(hash); return 1; } #endif void DetectFileMd5RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("MD5MatchTest01", MD5MatchTest01); #endif } #endif /* HAVE_NSS */ suricata-3.2.1/src/detect-rev.c0000644000000000000000000000454613051004444013220 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the rev keyword */ #include "suricata-common.h" #include "detect.h" #include "util-debug.h" #include "util-error.h" static int DetectRevSetup (DetectEngineCtx *, Signature *, char *); void DetectRevRegister (void) { sigmatch_table[DETECT_REV].name = "rev"; sigmatch_table[DETECT_REV].desc = "set version of the rule"; sigmatch_table[DETECT_REV].url = DOC_URL DOC_VERSION "/rules/meta.html#rev-revision"; sigmatch_table[DETECT_REV].Match = NULL; sigmatch_table[DETECT_REV].Setup = DetectRevSetup; sigmatch_table[DETECT_REV].Free = NULL; sigmatch_table[DETECT_REV].RegisterTests = NULL; } static int DetectRevSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char *str = rawstr; char dubbed = 0; /* Strip leading and trailing "s. */ if (rawstr[0] == '\"') { str = SCStrdup(rawstr+1); if (unlikely(str == NULL)) return -1; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(rawstr)-1] = '\0'; } dubbed = 1; } unsigned long rev = 0; char *endptr = NULL; rev = strtoul(rawstr, &endptr, 10); if (endptr == NULL || *endptr != '\0') { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid character as arg " "to rev keyword"); goto error; } if (rev >= UINT_MAX) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "rev value to high, max %u", UINT_MAX); goto error; } s->rev = (uint32_t)rev; if (dubbed) SCFree(str); return 0; error: if (dubbed) SCFree(str); return -1; } suricata-3.2.1/src/runmode-unittests.c0000644000000000000000000002110513051004444014655 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #include "suricata-common.h" #include "config.h" #include "util-unittest.h" #ifdef UNITTESTS #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-address.h" #include "detect-engine-proto.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-sigorder.h" #include "detect-engine-payload.h" #include "detect-engine-dcepayload.h" #include "detect-engine-uri.h" #include "detect-engine-hcbd.h" #include "detect-engine-hsbd.h" #include "detect-engine-hhd.h" #include "detect-engine-hrhd.h" #include "detect-engine-hmd.h" #include "detect-engine-hcd.h" #include "detect-engine-hrud.h" #include "detect-engine-hsmd.h" #include "detect-engine-hscd.h" #include "detect-engine-hua.h" #include "detect-engine-hhhd.h" #include "detect-engine-hrhhd.h" #include "detect-engine-state.h" #include "detect-engine-tag.h" #include "detect-engine-modbus.h" #include "detect-engine-filedata-smtp.h" #include "detect-fast-pattern.h" #include "flow.h" #include "flow-timeout.h" #include "flow-manager.h" #include "flow-var.h" #include "flow-bit.h" #include "pkt-var.h" #include "host.h" #include "host-bit.h" #include "ippair.h" #include "ippair-bit.h" #include "unix-manager.h" #include "stream-tcp.h" #include "app-layer-detect-proto.h" #include "app-layer-parser.h" #include "app-layer.h" #include "app-layer-smb.h" #include "app-layer-dcerpc.h" #include "app-layer-dcerpc-udp.h" #include "app-layer-htp.h" #include "app-layer-ftp.h" #include "app-layer-ssl.h" #include "app-layer-ssh.h" #include "app-layer-smtp.h" #include "util-action.h" #include "util-radix-tree.h" #include "util-host-os-info.h" #include "util-cidr.h" #include "util-unittest-helper.h" #include "util-time.h" #include "util-rule-vars.h" #include "util-classification-config.h" #include "util-threshold-config.h" #include "util-reference-config.h" #include "util-profiling.h" #include "util-magic.h" #include "util-memcmp.h" #include "util-misc.h" #include "util-ringbuffer.h" #include "util-signal.h" #include "reputation.h" #include "util-atomic.h" #include "util-spm.h" #include "util-hash.h" #include "util-hashlist.h" #include "util-bloomfilter.h" #include "util-bloomfilter-counting.h" #include "util-pool.h" #include "util-byte.h" #include "util-proto-name.h" #include "util-memrchr.h" #include "util-mpm-ac.h" #include "util-mpm-hs.h" #include "util-decode-asn1.h" #include "conf.h" #include "conf-yaml-loader.h" #include "tmqh-flow.h" #include "defrag.h" #include "detect-engine-siggroup.h" #include "util-streaming-buffer.h" #include "util-lua.h" #endif /* UNITTESTS */ void RegisterAllModules(); void TmqhSetup (void); #ifdef UNITTESTS static void RegisterUnittests(void) { UTHRegisterTests(); StreamTcpRegisterTests(); SigRegisterTests(); SCReputationRegisterTests(); TmModuleRegisterTests(); SigTableRegisterTests(); HashTableRegisterTests(); HashListTableRegisterTests(); BloomFilterRegisterTests(); BloomFilterCountingRegisterTests(); PoolRegisterTests(); ByteRegisterTests(); MpmRegisterTests(); FlowBitRegisterTests(); HostBitRegisterTests(); IPPairBitRegisterTests(); StatsRegisterTests(); DecodePPPRegisterTests(); DecodeVLANRegisterTests(); DecodeRawRegisterTests(); DecodePPPOERegisterTests(); DecodeICMPV4RegisterTests(); DecodeICMPV6RegisterTests(); DecodeIPV4RegisterTests(); DecodeIPV6RegisterTests(); DecodeTCPRegisterTests(); DecodeUDPV4RegisterTests(); DecodeGRERegisterTests(); DecodeAsn1RegisterTests(); DecodeMPLSRegisterTests(); AppLayerProtoDetectUnittestsRegister(); ConfRegisterTests(); ConfYamlRegisterTests(); TmqhFlowRegisterTests(); FlowRegisterTests(); HostRegisterUnittests(); IPPairRegisterUnittests(); SCSigRegisterSignatureOrderingTests(); SCRadixRegisterTests(); DefragRegisterTests(); SigGroupHeadRegisterTests(); SCHInfoRegisterTests(); SCRuleVarsRegisterTests(); AppLayerParserRegisterUnittests(); ThreadMacrosRegisterTests(); UtilSpmSearchRegistertests(); UtilActionRegisterTests(); SCClassConfRegisterTests(); SCThresholdConfRegisterTests(); SCRConfRegisterTests(); #ifdef __SC_CUDA_SUPPORT__ SCCudaRegisterTests(); #endif PayloadRegisterTests(); DcePayloadRegisterTests(); UriRegisterTests(); #ifdef PROFILING SCProfilingRegisterTests(); #endif DeStateRegisterTests(); DetectRingBufferRegisterTests(); MemcmpRegisterTests(); DetectEngineHttpClientBodyRegisterTests(); DetectEngineHttpServerBodyRegisterTests(); DetectEngineHttpHeaderRegisterTests(); DetectEngineHttpRawHeaderRegisterTests(); DetectEngineHttpMethodRegisterTests(); DetectEngineHttpCookieRegisterTests(); DetectEngineHttpRawUriRegisterTests(); DetectEngineHttpStatMsgRegisterTests(); DetectEngineHttpStatCodeRegisterTests(); DetectEngineHttpUARegisterTests(); DetectEngineHttpHHRegisterTests(); DetectEngineHttpHRHRegisterTests(); DetectEngineInspectModbusRegisterTests(); DetectEngineRegisterTests(); DetectEngineSMTPFiledataRegisterTests(); SCLogRegisterTests(); MagicRegisterTests(); UtilMiscRegisterTests(); DetectAddressTests(); DetectProtoTests(); DetectPortTests(); SCAtomicRegisterTests(); MemrchrRegisterTests(); #ifdef __SC_CUDA_SUPPORT__ CudaBufferRegisterUnittests(); #endif AppLayerUnittestsRegister(); MimeDecRegisterTests(); StreamingBufferRegisterTests(); } #endif /** * Run or list unittests * * \param list_unittests If set to 1, list unittests. Run them if set to 0. * \param regex_arg A regular expression to select unittests to run * * This function is terminal and will call exit after being called. */ void RunUnittests(int list_unittests, char *regex_arg) { #ifdef UNITTESTS /* Initializations for global vars, queues, etc (memsets, mutex init..) */ GlobalsInitPreConfig(); #ifdef HAVE_LUAJIT if (LuajitSetupStatesPool() != 0) { exit(EXIT_FAILURE); } #endif default_packet_size = DEFAULT_PACKET_SIZE; /* load the pattern matchers */ MpmTableSetup(); #ifdef __SC_CUDA_SUPPORT__ MpmCudaEnvironmentSetup(); #endif SpmTableSetup(); AppLayerSetup(); /* hardcoded initialization code */ SigTableSetup(); /* load the rule keywords */ TmqhSetup(); StorageInit(); CIDRInit(); SigParsePrepare(); #ifdef DBG_MEM_ALLOC SCLogInfo("Memory used at startup: %"PRIdMAX, (intmax_t)global_mem); #endif SCReputationInitCtx(); SCProtoNameInit(); TagInitCtx(); SCReferenceConfInit(); SCClassConfInit(); UtInitialize(); RegisterAllModules(); HostBitInitCtx(); StorageFinalize(); /* test and initialize the unittesting subsystem */ if(regex_arg == NULL){ regex_arg = ".*"; UtRunSelftest(regex_arg); /* inits and cleans up again */ } AppLayerHtpEnableRequestBodyCallback(); AppLayerHtpNeedFileInspection(); RegisterUnittests(); if (list_unittests) { UtListTests(regex_arg); } else { /* global packet pool */ extern intmax_t max_pending_packets; max_pending_packets = 128; PacketPoolInit(); uint32_t failed = UtRunTests(regex_arg); PacketPoolDestroy(); UtCleanup(); #ifdef BUILD_HYPERSCAN MpmHSGlobalCleanup(); #endif #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) MpmCudaBufferDeSetup(); CudaHandlerFreeProfiles(); #endif if (failed) { exit(EXIT_FAILURE); } } #ifdef HAVE_LUAJIT LuajitFreeStatesPool(); #endif #ifdef DBG_MEM_ALLOC SCLogInfo("Total memory used (without SCFree()): %"PRIdMAX, (intmax_t)global_mem); #endif exit(EXIT_SUCCESS); #else SCLogError(SC_ERR_NOT_SUPPORTED, "Unittests are not build-in"); exit(EXIT_FAILURE); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-flags.c0000644000000000000000000010243113051004444013510 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the flags keyword */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" #include "flow-var.h" #include "decode-events.h" #include "detect-flags.h" #include "util-unittest.h" #include "util-debug.h" /** * Regex (by Brian Rectanus) * flags: [!+*](SAPRFU120)[,SAPRFU12] */ #define PARSE_REGEX "^\\s*(?:([\\+\\*!]))?\\s*([SAPRFU120CE\\+\\*!]+)(?:\\s*,\\s*([SAPRFU12CE]+))?\\s*$" /** * Flags args[0] *(3) +(2) !(1) * */ #define MODIFIER_NOT 1 #define MODIFIER_PLUS 2 #define MODIFIER_ANY 3 static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectFlagsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFlagsSetup (DetectEngineCtx *, Signature *, char *); static void DetectFlagsFree(void *); static _Bool PrefilterTcpFlagsIsPrefilterable(const Signature *s); static int PrefilterSetupTcpFlags(SigGroupHead *sgh); /** * \brief Registration function for flags: keyword */ void DetectFlagsRegister (void) { sigmatch_table[DETECT_FLAGS].name = "flags"; sigmatch_table[DETECT_FLAGS].Match = DetectFlagsMatch; sigmatch_table[DETECT_FLAGS].Setup = DetectFlagsSetup; sigmatch_table[DETECT_FLAGS].Free = DetectFlagsFree; sigmatch_table[DETECT_FLAGS].RegisterTests = FlagsRegisterTests; sigmatch_table[DETECT_FLAGS].SupportsPrefilter = PrefilterTcpFlagsIsPrefilterable; sigmatch_table[DETECT_FLAGS].SetupPrefilter = PrefilterSetupTcpFlags; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline int FlagsMatch(const uint8_t pflags, const uint8_t modifier, const uint8_t dflags, const uint8_t iflags) { if (!dflags && pflags) { if(modifier == MODIFIER_NOT) { SCReturnInt(1); } SCReturnInt(0); } const uint8_t flags = pflags & iflags; switch (modifier) { case MODIFIER_ANY: if ((flags & dflags) > 0) { SCReturnInt(1); } SCReturnInt(0); case MODIFIER_PLUS: if (((flags & dflags) == dflags)) { SCReturnInt(1); } SCReturnInt(0); case MODIFIER_NOT: if ((flags & dflags) != dflags) { SCReturnInt(1); } SCReturnInt(0); default: SCLogDebug("flags %"PRIu8" and de->flags %"PRIu8"", flags, dflags); if (flags == dflags) { SCReturnInt(1); } } SCReturnInt(0); } /** * \internal * \brief This function is used to match flags on a packet with those passed via flags: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the Signature * \param m pointer to the sigmatch * * \retval 0 no match * \retval 1 match */ static int DetectFlagsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p)) { SCReturnInt(0); } const DetectFlagsData *de = (const DetectFlagsData *)ctx; const uint8_t flags = p->tcph->th_flags; return FlagsMatch(flags, de->modifier, de->flags, de->ignored_flags); } /** * \internal * \brief This function is used to parse flags options passed via flags: keyword * * \param rawstr Pointer to the user provided flags options * * \retval de pointer to DetectFlagsData on success * \retval NULL on failure */ static DetectFlagsData *DetectFlagsParse (char *rawstr) { SCEnter(); DetectFlagsData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, found = 0, ignore = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; char *args[3] = { NULL, NULL, NULL }; char *ptr; int i; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre match failed"); goto error; } for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS,i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i] = (char *)str_ptr; } if(args[1] == NULL) { SCLogDebug("args[1] == NULL"); goto error; } de = SCMalloc(sizeof(DetectFlagsData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectFlagsData)); de->ignored_flags = 0xff; /** First parse args[0] */ if(args[0]) { ptr = args[0]; while (*ptr != '\0') { switch (*ptr) { case 'S': case 's': de->flags |= TH_SYN; found++; break; case 'A': case 'a': de->flags |= TH_ACK; found++; break; case 'F': case 'f': de->flags |= TH_FIN; found++; break; case 'R': case 'r': de->flags |= TH_RST; found++; break; case 'P': case 'p': de->flags |= TH_PUSH; found++; break; case 'U': case 'u': de->flags |= TH_URG; found++; break; case '1': de->flags |= TH_CWR; found++; break; case '2': de->flags |= TH_ECN; found++; break; case 'C': case 'c': de->flags |= TH_CWR; found++; break; case 'E': case 'e': de->flags |= TH_ECN; found++; break; case '0': de->flags = 0; found++; break; case '!': de->modifier = MODIFIER_NOT; break; case '+': de->modifier = MODIFIER_PLUS; break; case '*': de->modifier = MODIFIER_ANY; break; } ptr++; } } /** Second parse first set of flags */ ptr = args[1]; while (*ptr != '\0') { switch (*ptr) { case 'S': case 's': de->flags |= TH_SYN; found++; break; case 'A': case 'a': de->flags |= TH_ACK; found++; break; case 'F': case 'f': de->flags |= TH_FIN; found++; break; case 'R': case 'r': de->flags |= TH_RST; found++; break; case 'P': case 'p': de->flags |= TH_PUSH; found++; break; case 'U': case 'u': de->flags |= TH_URG; found++; break; case '1': de->flags |= TH_CWR; found++; break; case '2': de->flags |= TH_ECN; found++; break; case 'C': case 'c': de->flags |= TH_CWR; found++; break; case 'E': case 'e': de->flags |= TH_ECN; found++; break; case '0': de->flags = 0; found++; break; case '!': if (de->modifier != 0) { SCLogError(SC_ERR_FLAGS_MODIFIER, "\"flags\" supports only" " one modifier at a time"); goto error; } de->modifier = MODIFIER_NOT; SCLogDebug("NOT modifier is set"); break; case '+': if (de->modifier != 0) { SCLogError(SC_ERR_FLAGS_MODIFIER, "\"flags\" supports only" " one modifier at a time"); goto error; } de->modifier = MODIFIER_PLUS; SCLogDebug("PLUS modifier is set"); break; case '*': if (de->modifier != 0) { SCLogError(SC_ERR_FLAGS_MODIFIER, "\"flags\" supports only" " one modifier at a time"); goto error; } de->modifier = MODIFIER_ANY; SCLogDebug("ANY modifier is set"); break; default: break; } ptr++; } if(found == 0) goto error; /** Finally parse ignored flags */ if(args[2]) { ptr = args[2]; while (*ptr != '\0') { switch (*ptr) { case 'S': case 's': de->ignored_flags &= ~TH_SYN; ignore++; break; case 'A': case 'a': de->ignored_flags &= ~TH_ACK; ignore++; break; case 'F': case 'f': de->ignored_flags &= ~TH_FIN; ignore++; break; case 'R': case 'r': de->ignored_flags &= ~TH_RST; ignore++; break; case 'P': case 'p': de->ignored_flags &= ~TH_PUSH; ignore++; break; case 'U': case 'u': de->ignored_flags &= ~TH_URG; ignore++; break; case '1': de->ignored_flags &= ~TH_CWR; ignore++; break; case '2': de->ignored_flags &= ~TH_ECN; ignore++; break; case 'C': case 'c': de->ignored_flags &= ~TH_CWR; ignore++; break; case 'E': case 'e': de->ignored_flags &= ~TH_ECN; ignore++; break; case '0': break; default: break; } ptr++; } if(ignore == 0) { SCLogDebug("ignore == 0"); goto error; } } for (i = 0; i < (ret - 1); i++){ SCLogDebug("args[%"PRId32"] = %s",i, args[i]); if (args[i] != NULL) SCFree(args[i]); } SCLogDebug("found %"PRId32" ignore %"PRId32"", found, ignore); SCReturnPtr(de, "DetectFlagsData"); error: for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } if (de) SCFree(de); SCReturnPtr(NULL, "DetectFlagsData"); } /** * \internal * \brief this function is used to add the parsed flags into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param rawstr pointer to the user provided flags options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFlagsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectFlagsData *de = NULL; SigMatch *sm = NULL; de = DetectFlagsParse(rawstr); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (de) SCFree(de); if (sm) SCFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with DetectFlagsData * * \param de pointer to DetectFlagsData */ static void DetectFlagsFree(void *de_ptr) { DetectFlagsData *de = (DetectFlagsData *)de_ptr; if(de) SCFree(de); } int DetectFlagsSignatureNeedsSynPackets(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FLAGS: { const DetectFlagsData *fl = (const DetectFlagsData *)sm->ctx; if (!(fl->modifier == MODIFIER_NOT) && (fl->flags & TH_SYN)) { return 1; } break; } } } return 0; } int DetectFlagsSignatureNeedsSynOnlyPackets(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FLAGS: { const DetectFlagsData *fl = (const DetectFlagsData *)sm->ctx; if (!(fl->modifier == MODIFIER_NOT) && (fl->flags == TH_SYN)) { return 1; } break; } } } return 0; } static void PrefilterPacketFlagsMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p)) { SCReturn; } const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; const uint8_t flags = p->tcph->th_flags; if (FlagsMatch(flags, ctx->v1.u8[0], ctx->v1.u8[1], ctx->v1.u8[2])) { SCLogDebug("packet matches TCP flags %02x", ctx->v1.u8[1]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketFlagsSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectFlagsData *a = smctx; v->u8[0] = a->modifier; v->u8[1] = a->flags; v->u8[2] = a->ignored_flags; SCLogDebug("v->u8[0] = %02x", v->u8[0]); } static _Bool PrefilterPacketFlagsCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectFlagsData *a = smctx; if (v.u8[0] == a->modifier && v.u8[1] == a->flags && v.u8[2] == a->ignored_flags) return TRUE; return FALSE; } static int PrefilterSetupTcpFlags(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_FLAGS, PrefilterPacketFlagsSet, PrefilterPacketFlagsCompare, PrefilterPacketFlagsMatch); } static _Bool PrefilterTcpFlagsIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FLAGS: return TRUE; } } return FALSE; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS /** * \test FlagsTestParse01 is a test for a valid flags value * * \retval 1 on succces * \retval 0 on failure */ static int FlagsTestParse01 (void) { DetectFlagsData *de = NULL; de = DetectFlagsParse("S"); if (de && (de->flags == TH_SYN) ) { DetectFlagsFree(de); return 1; } return 0; } /** * \test FlagsTestParse02 is a test for an invalid flags value * * \retval 1 on succces * \retval 0 on failure */ static int FlagsTestParse02 (void) { DetectFlagsData *de = NULL; de = DetectFlagsParse("G"); if (de) { DetectFlagsFree(de); return 0; } return 1; } /** * \test FlagsTestParse03 test if ACK and PUSH are set. Must return success * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse03 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST; de = DetectFlagsParse("AP+"); if (de == NULL || (de->flags != (TH_ACK|TH_PUSH)) ) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FlagsTestParse04 check if ACK bit is set. Must fails. * * \retval 1 on succces * \retval 0 on failure */ static int FlagsTestParse04 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN; de = DetectFlagsParse("A"); if (de == NULL || de->flags != TH_ACK) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /* Error expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } /** * \test FlagsTestParse05 test if ACK+PUSH and more flags are set. Ignore SYN and RST bits. * Must fails. * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse05 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST; de = DetectFlagsParse("+AP,SR"); if (de == NULL || (de->modifier != MODIFIER_PLUS) || (de->flags != (TH_ACK|TH_PUSH)) || (de->ignored_flags != (TH_SYN|TH_RST))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /* Error expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } /** * \test FlagsTestParse06 test if ACK+PUSH and more flags are set. Ignore URG and RST bits. * Must return success. * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse06 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ACK|TH_PUSH|TH_SYN|TH_RST; de = DetectFlagsParse("+AP,UR"); if (de == NULL || (de->modifier != MODIFIER_PLUS) || (de->flags != (TH_ACK|TH_PUSH)) || ((0xff - de->ignored_flags) != (TH_URG|TH_RST))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FlagsTestParse07 test if SYN or RST are set. Must fails. * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse07 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN|TH_RST; de = DetectFlagsParse("*AP"); if (de == NULL || (de->modifier != MODIFIER_ANY) || (de->flags != (TH_ACK|TH_PUSH))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /* Error expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } /** * \test FlagsTestParse08 test if SYN or RST are set. Must return success. * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse08 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN|TH_RST; de = DetectFlagsParse("*SA"); if (de == NULL || (de->modifier != MODIFIER_ANY) || (de->flags != (TH_ACK|TH_SYN))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FlagsTestParse09 test if SYN and RST are not set. Must fails. * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse09 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN|TH_RST; de = DetectFlagsParse("!PA"); if (de == NULL || (de->modifier != MODIFIER_NOT) || (de->flags != (TH_ACK|TH_PUSH))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FlagsTestParse10 test if ACK and PUSH are not set. Must return success. * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse10 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN|TH_RST; de = DetectFlagsParse("!AP"); if (de == NULL || (de->modifier != MODIFIER_NOT) || (de->flags != (TH_ACK|TH_PUSH))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FlagsTestParse11 test if ACK or PUSH are set. Ignore SYN and RST. Must fails. * * \retval 1 on success * \retval 0 on failure */ static int FlagsTestParse11 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN|TH_RST|TH_URG; de = DetectFlagsParse("*AP,SR"); if (de == NULL || (de->modifier != MODIFIER_ANY) || (de->flags != (TH_ACK|TH_PUSH)) || ((0xff - de->ignored_flags) != (TH_SYN|TH_RST))) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /* Expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } /** * \test FlagsTestParse12 check if no flags are set. Must fails. * * \retval 1 on succces * \retval 0 on failure */ static int FlagsTestParse12 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_SYN; de = DetectFlagsParse("0"); if (de == NULL || de->flags != 0) { printf("de setup: "); goto error; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /* Expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } /** * \test test for a valid flags value * * \retval 1 on succces * \retval 0 on failure */ static int FlagsTestParse13 (void) { DetectFlagsData *de = NULL; de = DetectFlagsParse("+S*"); if (de != NULL) { DetectFlagsFree(de); return 0; } return 1; } /** * \test Parse 'C' and 'E' flags. * * \retval 1 on success. * \retval 0 on failure. */ static int FlagsTestParse14(void) { DetectFlagsData *de = DetectFlagsParse("CE"); if (de != NULL && (de->flags == (TH_CWR | TH_ECN)) ) { DetectFlagsFree(de); return 1; } return 0; } static int FlagsTestParse15(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ECN | TH_CWR | TH_SYN | TH_RST; de = DetectFlagsParse("EC+"); if (de == NULL || (de->flags != (TH_ECN | TH_CWR)) ) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if (ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } static int FlagsTestParse16(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ECN | TH_SYN | TH_RST; de = DetectFlagsParse("EC*"); if (de == NULL || (de->flags != (TH_ECN | TH_CWR)) ) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if (ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test Negative test. */ static int FlagsTestParse17(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectFlagsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ipv4h; TCPHdr tcph; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(IPV4Hdr)); memset(&tcph, 0, sizeof(TCPHdr)); p->ip4h = &ipv4h; p->tcph = &tcph; p->tcph->th_flags = TH_ECN | TH_SYN | TH_RST; de = DetectFlagsParse("EC+"); if (de == NULL || (de->flags != (TH_ECN | TH_CWR)) ) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLAGS; sm->ctx = (SigMatchCtx *)de; ret = DetectFlagsMatch(&tv, NULL, p, NULL, sm->ctx); if (ret == 0) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for Flags */ void FlagsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("FlagsTestParse01", FlagsTestParse01); UtRegisterTest("FlagsTestParse02", FlagsTestParse02); UtRegisterTest("FlagsTestParse03", FlagsTestParse03); UtRegisterTest("FlagsTestParse04", FlagsTestParse04); UtRegisterTest("FlagsTestParse05", FlagsTestParse05); UtRegisterTest("FlagsTestParse06", FlagsTestParse06); UtRegisterTest("FlagsTestParse07", FlagsTestParse07); UtRegisterTest("FlagsTestParse08", FlagsTestParse08); UtRegisterTest("FlagsTestParse09", FlagsTestParse09); UtRegisterTest("FlagsTestParse10", FlagsTestParse10); UtRegisterTest("FlagsTestParse11", FlagsTestParse11); UtRegisterTest("FlagsTestParse12", FlagsTestParse12); UtRegisterTest("FlagsTestParse13", FlagsTestParse13); UtRegisterTest("FlagsTestParse14", FlagsTestParse14); UtRegisterTest("FlagsTestParse15", FlagsTestParse15); UtRegisterTest("FlagsTestParse16", FlagsTestParse16); UtRegisterTest("FlagsTestParse17", FlagsTestParse17); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-priority.c0000644000000000000000000001311413051004444014274 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the priority keyword */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-error.h" #include "util-debug.h" #include "util-unittest.h" #define PARSE_REGEX "^\\s*(\\d+|\"\\d+\")\\s*$" static pcre *regex = NULL; static pcre_extra *regex_study = NULL; static int DetectPrioritySetup (DetectEngineCtx *, Signature *, char *); void SCPriorityRegisterTests(void); /** * \brief Registers the handler functions for the "priority" keyword */ void DetectPriorityRegister (void) { sigmatch_table[DETECT_PRIORITY].name = "priority"; sigmatch_table[DETECT_PRIORITY].desc = "rules with a higher priority will be examined first"; sigmatch_table[DETECT_PRIORITY].url = DOC_URL DOC_VERSION "/rules/meta.html#priority"; sigmatch_table[DETECT_PRIORITY].Match = NULL; sigmatch_table[DETECT_PRIORITY].Setup = DetectPrioritySetup; sigmatch_table[DETECT_PRIORITY].Free = NULL; sigmatch_table[DETECT_PRIORITY].RegisterTests = SCPriorityRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, ®ex, ®ex_study); } static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char copy_str[128] = ""; #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); if (ret < 0) { SCLogError(SC_ERR_PCRE_MATCH, "Invalid Priority in Signature " "- %s", rawstr); return -1; } ret = pcre_copy_substring((char *)rawstr, ov, 30, 1, copy_str, sizeof(copy_str)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return -1; } long prio = 0; char *endptr = NULL; prio = strtol(copy_str, &endptr, 10); if (endptr == NULL || *endptr != '\0') { SCLogError(SC_ERR_INVALID_SIGNATURE, "Saw an invalid character as arg " "to priority keyword"); return -1; } /* if we have reached here, we have had a valid priority. Assign it */ s->prio = prio; return 0; } /*------------------------------Unittests-------------------------------------*/ #ifdef UNITTESTS int DetectPriorityTest01() { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:2; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; DetectEngineCtxFree(de_ctx); end: return result; } int DetectPriorityTest02() { int result = 0; Signature *last = NULL; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:1; sid:1;)"); de_ctx->sig_list = last = sig; if (sig == NULL) { result = 0; } else { result = 1; result &= (sig->prio == 1); } sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:boo; sid:1;)"); if (last != NULL) last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:10boo; sid:1;)"); if (last != NULL) last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:b10oo; sid:1;)"); if (last != NULL) last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:boo10; sid:1;)"); if (last != NULL) last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; priority:-1; sid:1;)"); if (last != NULL) last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Priority test\"; sid:1;)"); if (last != NULL) last->next = sig; if (sig == NULL) { result &= 0; } else { result &= (sig->prio == 3); } SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for Classification Config API. */ void SCPriorityRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectPriorityTest01", DetectPriorityTest01); UtRegisterTest("DetectPriorityTest02", DetectPriorityTest02); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-detect-file-hash.h0000644000000000000000000000266113051004444015240 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva * */ #ifndef __UTIL_DETECT_FILE_HASH_H__ #define __UTIL_DETECT_FILE_HASH_H__ #include "util-rohash.h" typedef struct DetectFileHashData_ { ROHashTable *hash; int negated; } DetectFileHashData; /* prototypes */ int ReadHashString(uint8_t *, char *, char *, int, uint16_t); int LoadHashTable(ROHashTable *, char *, char *, int, uint32_t); int DetectFileHashMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, File *, Signature *, SigMatch *); int DetectFileHashSetup(DetectEngineCtx *, Signature *, char *, uint32_t); void DetectFileHashFree(void *); #endif /* __UTIL_DETECT_FILE_HASH_H__ */ suricata-3.2.1/src/detect-ftpbounce.h0000644000000000000000000000166413051004444014414 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_FTPBOUNCE_H__ #define __DETECT_FTPBOUNCE_H__ /* prototypes */ void DetectFtpbounceRegister (void); #endif /* __DETECT_FTPBOUNCE_H__ */ suricata-3.2.1/src/detect-window.h0000644000000000000000000000206713051004444013734 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __DETECT_WINDOW_H__ #define __DETECT_WINDOW_H__ #define MIN_WINDOW_VALUE 0 #define MAX_WINDOW_VALUE 65535 typedef struct DetectWindowData_ { uint8_t negated; /** negated? 1=True : 0=False */ uint16_t size; /** window size to match */ } DetectWindowData; /* prototypes */ void DetectWindowRegister (void); #endif /* __DETECT_WINDOW_H__ */ suricata-3.2.1/src/decode-ppp.h0000644000000000000000000000630013051004444013171 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva Pinto */ #ifndef __DECODE_PPP_H__ #define __DECODE_PPP_H__ /** Point to Point Protocol RFC1331 - Supported tyes */ #define PPP_IP 0x0021 /* Internet Protocol */ #define PPP_IPV6 0x0057 /* Internet Protocol version 6 */ #define PPP_VJ_UCOMP 0x002f /* VJ uncompressed TCP/IP */ /** Unsupported PPP types (libpcap source reference) */ #define PPP_IPX 0x002b /* Novell IPX Protocol */ #define PPP_VJ_COMP 0x002d /* VJ compressed TCP/IP */ #define PPP_IPX 0x002b /* Novell IPX Protocol */ #define PPP_OSI 0x0023 /* OSI Network Layer */ #define PPP_NS 0x0025 /* Xerox NS IDP */ #define PPP_DECNET 0x0027 /* DECnet Phase IV */ #define PPP_APPLE 0x0029 /* Appletalk */ #define PPP_BRPDU 0x0031 /* Bridging PDU */ #define PPP_STII 0x0033 /* Stream Protocol (ST-II) */ #define PPP_VINES 0x0035 /* Banyan Vines */ #define PPP_HELLO 0x0201 /* 802.1d Hello Packets */ #define PPP_LUXCOM 0x0231 /* Luxcom */ #define PPP_SNS 0x0233 /* Sigma Network Systems */ #define PPP_MPLS_UCAST 0x0281 /* rfc 3032 */ #define PPP_MPLS_MCAST 0x0283 /* rfc 3022 */ #define PPP_IPCP 0x8021 /* IP Control Protocol */ #define PPP_OSICP 0x8023 /* OSI Network Layer Control Protocol */ #define PPP_NSCP 0x8025 /* Xerox NS IDP Control Protocol */ #define PPP_DECNETCP 0x8027 /* DECnet Control Protocol */ #define PPP_APPLECP 0x8029 /* Appletalk Control Protocol */ #define PPP_IPXCP 0x802b /* Novell IPX Control Protocol */ #define PPP_STIICP 0x8033 /* Strean Protocol Control Protocol */ #define PPP_VINESCP 0x8035 /* Banyan Vines Control Protocol */ #define PPP_IPV6CP 0x8057 /* IPv6 Control Protocol */ #define PPP_MPLSCP 0x8281 /* rfc 3022 */ #define PPP_LCP 0xc021 /* Link Control Protocol */ #define PPP_PAP 0xc023 /* Password Authentication Protocol */ #define PPP_LQM 0xc025 /* Link Quality Monitoring */ #define PPP_CHAP 0xc223 /* Challenge Handshake Authentication Protocol */ /** PPP Packet header */ typedef struct PPPHdr_ { uint8_t address; uint8_t control; uint16_t protocol; } __attribute__((__packed__)) PPPHdr; /** PPP Packet header length */ #define PPP_HEADER_LEN 4 void DecodePPPRegisterTests(void); #endif /* __DECODE_PPP_H__ */ suricata-3.2.1/src/output.h0000644000000000000000000002044113051004444012513 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited, Jason Ish */ #ifndef __OUTPUT_H__ #define __OUTPUT_H__ #include "suricata.h" #include "tm-threads.h" #define DEFAULT_LOG_MODE_APPEND "yes" #define DEFAULT_LOG_FILETYPE "regular" #include "output-packet.h" #include "output-tx.h" #include "output-file.h" #include "output-filedata.h" #include "output-flow.h" #include "output-streaming.h" #include "output-stats.h" typedef OutputCtx *(*OutputInitFunc)(ConfNode *); typedef OutputCtx *(*OutputInitSubFunc)(ConfNode *, OutputCtx *); typedef TmEcode (*OutputLogFunc)(ThreadVars *, Packet *, void *); typedef struct OutputModule_ { LoggerId logger_id; const char *name; const char *conf_name; const char *parent_name; OutputInitFunc InitFunc; OutputInitSubFunc InitSubFunc; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; PacketLogger PacketLogFunc; PacketLogCondition PacketConditionFunc; TxLogger TxLogFunc; TxLoggerCondition TxLogCondition; FileLogger FileLogFunc; FiledataLogger FiledataLogFunc; FlowLogger FlowLogFunc; StreamingLogger StreamingLogFunc; StatsLogger StatsLogFunc; AppProto alproto; enum OutputStreamingType stream_type; int tc_log_progress; int ts_log_progress; TAILQ_ENTRY(OutputModule_) entries; } OutputModule; typedef TAILQ_HEAD(OutputModuleList_, OutputModule_) OutputModuleList; extern OutputModuleList output_modules; void OutputRegisterModule(const char *, const char *, OutputInitFunc); void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger LogFunc, PacketLogCondition ConditionFunc, ThreadInitFunc, ThreadDeinitFunc, ThreadExitPrintStatsFunc); void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger LogFunc, PacketLogCondition ConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFileModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFiledataSubModule(LoggerId, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFlowModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StreamingLogger StreamingLogFunc, enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterStreamingSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StreamingLogger StreamingLogFunc, enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); OutputModule *OutputGetModuleByConfName(const char *name); void OutputDeregisterAll(void); int OutputDropLoggerEnable(void); void OutputDropLoggerDisable(void); int OutputSshLoggerEnable(void); void OutputSshLoggerDisable(void); void OutputRegisterFileRotationFlag(int *flag); void OutputUnregisterFileRotationFlag(int *flag); void OutputNotifyFileRotation(void); void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats, OutputLogFunc LogFunc); void TmModuleLoggerRegister(void); TmEcode OutputLoggerLog(ThreadVars *, Packet *, void *); TmEcode OutputLoggerThreadInit(ThreadVars *, void *, void **); TmEcode OutputLoggerThreadDeinit(ThreadVars *, void *); void OutputLoggerExitPrintStats(ThreadVars *, void *); #endif /* ! __OUTPUT_H__ */ suricata-3.2.1/src/detect-dce-stub-data.c0000644000000000000000000023460113051004444015036 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements dce_stub_data keyword */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "app-layer.h" #include "app-layer-dcerpc.h" #include "queue.h" #include "stream-tcp-reassemble.h" #include "detect-dce-stub-data.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "stream-tcp.h" int DetectDceStubDataMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectDceStubDataSetup(DetectEngineCtx *, Signature *, char *); /** * \brief Registers the keyword handlers for the "dce_stub_data" keyword. */ void DetectDceStubDataRegister(void) { sigmatch_table[DETECT_DCE_STUB_DATA].name = "dce_stub_data"; sigmatch_table[DETECT_DCE_STUB_DATA].Match = NULL; sigmatch_table[DETECT_DCE_STUB_DATA].AppLayerMatch = NULL; sigmatch_table[DETECT_DCE_STUB_DATA].Setup = DetectDceStubDataSetup; sigmatch_table[DETECT_DCE_STUB_DATA].Free = NULL; sigmatch_table[DETECT_DCE_STUB_DATA].RegisterTests = DetectDceStubDataRegisterTests; sigmatch_table[DETECT_DCE_STUB_DATA].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_DCE_STUB_DATA].flags |= SIGMATCH_PAYLOAD; return; } /** * \brief Creates a SigMatch for the \"dce_stub_data\" keyword being sent as argument, * and appends it to the Signature(s). * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param arg Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ static int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } s->list = DETECT_SM_LIST_DMATCH; s->alproto = ALPROTO_DCERPC; s->flags |= SIG_FLAG_APPLAYER; return 0; error: return -1; } /************************************Unittests*********************************/ #ifdef UNITTESTS static int DetectDceStubDataTestParse01(void) { Signature s; int result = 0; memset(&s, 0, sizeof(Signature)); result = (DetectDceStubDataSetup(NULL, &s, NULL) == 0); if (s.sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { result = 1; } else { result = 0; } return result; } /** * \test Test a valid dce_stub_data entry with bind, bind_ack, request frags. */ static int DetectDceStubDataTestParse02(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x26, 0x3d, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; /* todo chop the request frag length and change the * length related parameters in the frag */ uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47, 0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b, 0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd, 0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f, 0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5, 0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22, 0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1, 0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50, 0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22, 0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2, 0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56, 0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1, 0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76, 0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89, 0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a, 0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e, 0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e, 0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9, 0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a, 0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41, 0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6, 0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22, 0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43, 0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50, 0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99, 0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22, 0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e, 0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46, 0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76, 0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c, 0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74, 0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1, 0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c, 0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09, 0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15, 0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57, 0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56, 0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56, 0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48, 0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47, 0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56, 0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41, 0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1, 0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73, 0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a, 0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd, 0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21, 0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab, 0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3, 0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23, 0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23, 0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22, 0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76, 0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22, 0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71, 0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71, 0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06, 0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd, 0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78, 0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51, 0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50, 0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72, 0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1, 0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72, 0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72, 0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48, 0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57, 0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56, 0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78, 0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22, 0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06, 0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22, 0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92, 0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1, 0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22, 0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2, 0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70, 0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26, 0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2, 0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3, 0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x01, 0x02, 0x03, 0x04 }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_stub_data; content:\"|42 42 42 42|\";" "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* we shouldn't have any stub data */ if (PacketAlertCheck(p, 1)) goto end; /* do detect */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* we shouldn't have any stub data */ if (PacketAlertCheck(p, 1)) goto end; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_EOF, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* we should have the stub data since we previously parsed a request frag */ if (!PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_stub_data with just a request frag. */ static int DetectDceStubDataTestParse03(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; /* todo chop the request frag length and change the * length related parameters in the frag */ uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47, 0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b, 0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd, 0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f, 0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5, 0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22, 0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1, 0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50, 0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22, 0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2, 0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56, 0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1, 0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76, 0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89, 0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a, 0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e, 0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e, 0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9, 0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a, 0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41, 0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6, 0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22, 0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43, 0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50, 0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99, 0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22, 0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e, 0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46, 0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76, 0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c, 0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74, 0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1, 0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c, 0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09, 0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15, 0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57, 0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56, 0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56, 0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48, 0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47, 0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56, 0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41, 0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1, 0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73, 0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a, 0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd, 0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21, 0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab, 0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3, 0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23, 0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23, 0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22, 0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76, 0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22, 0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71, 0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71, 0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06, 0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd, 0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78, 0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51, 0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50, 0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72, 0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1, 0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72, 0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72, 0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48, 0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57, 0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56, 0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78, 0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22, 0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06, 0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22, 0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92, 0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1, 0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22, 0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2, 0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70, 0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26, 0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2, 0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3, 0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x01, 0x02, 0x03, 0x04 }; uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_stub_data; content:\"|42 42 42 42|\";" "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectDceStubDataTestParse04(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31, 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); uint32_t dcerpc_request3_len = sizeof(dcerpc_request3); uint32_t dcerpc_response3_len = sizeof(dcerpc_response3); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_stub_data; content:\"|00 02|\"; sid:1;)"); if (s == NULL) goto end; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_stub_data; content:\"|00 75|\"; sid:2;)"); if (s == NULL) goto end; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_stub_data; content:\"|00 18|\"; sid:3;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* request1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* response1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* request2 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || !PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* response2 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response2, dcerpc_response2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* request3 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request3, dcerpc_request3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || !PacketAlertCheck(p, 3)) goto end; /* response3 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response3, dcerpc_response3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectDceStubDataTestParse05(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); uint32_t dcerpc_request3_len = sizeof(dcerpc_request3); uint32_t dcerpc_response3_len = sizeof(dcerpc_response3); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_stub_data; content:\"|00 02|\"; " "sid:1;)"); if (s == NULL) goto end; s = de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_stub_data; content:\"|00 75|\"; " "sid:2;)"); if (s == NULL) goto end; s = de_ctx->sig_list->next->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_stub_data; content:\"|00 18|\"; " "sid:3;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* request1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* response1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* request2 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || !PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* response2 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response2, dcerpc_response2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || PacketAlertCheck(p, 3)) goto end; /* request3 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request3, dcerpc_request3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2) || !PacketAlertCheck(p, 3)) goto end; /* response3 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response3, dcerpc_response3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif void DetectDceStubDataRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDceStubDataTestParse01", DetectDceStubDataTestParse01); UtRegisterTest("DetectDceStubDataTestParse02", DetectDceStubDataTestParse02); UtRegisterTest("DetectDceStubDataTestParse03", DetectDceStubDataTestParse03); UtRegisterTest("DetectDceStubDataTestParse04", DetectDceStubDataTestParse04); UtRegisterTest("DetectDceStubDataTestParse05", DetectDceStubDataTestParse05); #endif return; } suricata-3.2.1/src/detect-engine-proto.h0000644000000000000000000000330213051004444015024 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PROTO_H__ #define __DETECT_PROTO_H__ #define DETECT_PROTO_ANY (1 << 0) /**< Indicate that given protocol is considered as IP */ #define DETECT_PROTO_ONLY_PKT (1 << 1) /**< Indicate that we only care about packet payloads. */ #define DETECT_PROTO_ONLY_STREAM (1 << 2) /**< Indicate that we only care about stream payloads. */ #define DETECT_PROTO_IPV4 (1 << 3) /**< IPv4 only */ #define DETECT_PROTO_IPV6 (1 << 4) /**< IPv6 only */ typedef struct DetectProto_ { uint8_t proto[256/8]; /**< bit array for 256 protocol bits */ uint8_t flags; } DetectProto; /* prototypes */ int DetectProtoParse(DetectProto *dp, char *str); int DetectProtoContainsProto(const DetectProto *, int); void DetectProtoTests(void); #endif /* __DETECT_PROTO_H__ */ suricata-3.2.1/src/detect-detection-filter.h0000644000000000000000000000227013051004444015662 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias */ #ifndef __DETECT_DETECTION_FILTER_H__ #define __DETECT_DETECTION_FILTER_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" /** * Registration function for detection_filter: keyword */ void DetectDetectionFilterRegister (void); /** * This function registers unit tests for detection_filter */ void DetectDetectionFilterRegisterTests(void); #endif /*__DETECT_DETECTION_FILTER_H__ */ suricata-3.2.1/src/detect-engine-template.h0000644000000000000000000000204313051004444015475 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author FirstName LastName */ #ifndef __DETECT_TEMPLATE_ENGINE_H__ #define __DETECT_TEMPLATE_ENGINE_H__ int DetectEngineInspectTemplateBuffer(ThreadVars *, DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, void *, uint64_t); #endif /* __DETECT_TEMPLATE_ENGINE_H__ */ suricata-3.2.1/src/util-hash.h0000644000000000000000000000356313051004444013057 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HASH_H__ #define __HASH_H__ /* hash bucket structure */ typedef struct HashTableBucket_ { void *data; uint16_t size; struct HashTableBucket_ *next; } HashTableBucket; /* hash table structure */ typedef struct HashTable_ { HashTableBucket **array; uint32_t array_size; #ifdef UNITTESTS uint32_t count; #endif uint32_t (*Hash)(struct HashTable_ *, void *, uint16_t); char (*Compare)(void *, uint16_t, void *, uint16_t); void (*Free)(void *); } HashTable; #define HASH_NO_SIZE 0 /* prototypes */ HashTable* HashTableInit(uint32_t, uint32_t (*Hash)(struct HashTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)); void HashTableFree(HashTable *); void HashTablePrint(HashTable *); int HashTableAdd(HashTable *, void *, uint16_t); int HashTableRemove(HashTable *, void *, uint16_t); void *HashTableLookup(HashTable *, void *, uint16_t); uint32_t HashTableGenericHash(HashTable *, void *, uint16_t); char HashTableDefaultCompare(void *, uint16_t, void *, uint16_t); void HashTableRegisterTests(void); #endif /* __HASH_H__ */ suricata-3.2.1/src/decode-vlan.c0000644000000000000000000001635413051004444013337 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Breno Silva * * Decode 802.1q */ #include "suricata-common.h" #include "decode.h" #include "decode-vlan.h" #include "decode-events.h" #include "flow.h" #include "util-unittest.h" #include "util-debug.h" #include "pkt-var.h" #include "util-profiling.h" #include "host.h" /** * \internal * \brief this function is used to decode IEEE802.1q packets * * \param tv pointer to the thread vars * \param dtv pointer code thread vars * \param p pointer to the packet struct * \param pkt pointer to the raw packet * \param len packet len * \param pq pointer to the packet queue * */ int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { uint32_t proto; if (p->vlan_idx == 0) StatsIncr(tv, dtv->counter_vlan); else if (p->vlan_idx == 1) StatsIncr(tv, dtv->counter_vlan_qinq); if(len < VLAN_HEADER_LEN) { ENGINE_SET_INVALID_EVENT(p, VLAN_HEADER_TOO_SMALL); return TM_ECODE_FAILED; } if (p->vlan_idx >= 2) { ENGINE_SET_EVENT(p,VLAN_HEADER_TOO_MANY_LAYERS); return TM_ECODE_FAILED; } p->vlanh[p->vlan_idx] = (VLANHdr *)pkt; if(p->vlanh[p->vlan_idx] == NULL) return TM_ECODE_FAILED; proto = GET_VLAN_PROTO(p->vlanh[p->vlan_idx]); SCLogDebug("p %p pkt %p VLAN protocol %04x VLAN PRI %d VLAN CFI %d VLAN ID %d Len: %" PRId32 "", p, pkt, proto, GET_VLAN_PRIORITY(p->vlanh[p->vlan_idx]), GET_VLAN_CFI(p->vlanh[p->vlan_idx]), GET_VLAN_ID(p->vlanh[p->vlan_idx]), len); /* only store the id for flow hashing if it's not disabled. */ if (dtv->vlan_disabled == 0) p->vlan_id[p->vlan_idx] = (uint16_t)GET_VLAN_ID(p->vlanh[p->vlan_idx]); p->vlan_idx++; switch (proto) { case ETHERNET_TYPE_IP: DecodeIPV4(tv, dtv, p, pkt + VLAN_HEADER_LEN, len - VLAN_HEADER_LEN, pq); break; case ETHERNET_TYPE_IPV6: DecodeIPV6(tv, dtv, p, pkt + VLAN_HEADER_LEN, len - VLAN_HEADER_LEN, pq); break; case ETHERNET_TYPE_PPPOE_SESS: DecodePPPOESession(tv, dtv, p, pkt + VLAN_HEADER_LEN, len - VLAN_HEADER_LEN, pq); break; case ETHERNET_TYPE_PPPOE_DISC: DecodePPPOEDiscovery(tv, dtv, p, pkt + VLAN_HEADER_LEN, len - VLAN_HEADER_LEN, pq); break; case ETHERNET_TYPE_VLAN: case ETHERNET_TYPE_8021AD: if (p->vlan_idx >= 2) { ENGINE_SET_EVENT(p,VLAN_HEADER_TOO_MANY_LAYERS); return TM_ECODE_OK; } else { DecodeVLAN(tv, dtv, p, pkt + VLAN_HEADER_LEN, len - VLAN_HEADER_LEN, pq); } break; default: SCLogDebug("unknown VLAN type: %" PRIx32 "", proto); ENGINE_SET_INVALID_EVENT(p, VLAN_UNKNOWN_TYPE); return TM_ECODE_OK; } return TM_ECODE_OK; } uint16_t DecodeVLANGetId(const Packet *p, uint8_t layer) { if (unlikely(layer > 1)) return 0; if (p->vlanh[layer] == NULL && (p->vlan_idx >= (layer + 1))) { return p->vlan_id[layer]; } else { return GET_VLAN_ID(p->vlanh[layer]); } return 0; } #ifdef UNITTESTS /** \todo Must GRE+VLAN and Multi-Vlan packets to * create more tests */ /** * \test DecodeVLANTest01 test if vlan header is too small. * * \retval 1 on success * \retval 0 on failure */ static int DecodeVLANtest01 (void) { uint8_t raw_vlan[] = { 0x00, 0x20, 0x08 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL); if(ENGINE_ISSET_EVENT(p,VLAN_HEADER_TOO_SMALL)) { SCFree(p); return 1; } SCFree(p); return 0; } /** * \test DecodeVLANTest02 test if vlan header has unknown type. * * \retval 1 on success * \retval 0 on failure */ static int DecodeVLANtest02 (void) { uint8_t raw_vlan[] = { 0x00, 0x20, 0x01, 0x00, 0x45, 0x00, 0x00, 0x34, 0x3b, 0x36, 0x40, 0x00, 0x40, 0x06, 0xb7, 0xc9, 0x83, 0x97, 0x20, 0x81, 0x83, 0x97, 0x20, 0x15, 0x04, 0x8a, 0x17, 0x70, 0x4e, 0x14, 0xdf, 0x55, 0x4d, 0x3d, 0x5a, 0x61, 0x80, 0x10, 0x6b, 0x50, 0x3c, 0x4c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x04, 0xf0, 0xc8, 0x01, 0x99, 0xa3, 0xf3}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL); if(ENGINE_ISSET_EVENT(p,VLAN_UNKNOWN_TYPE)) { SCFree(p); return 1; } SCFree(p); return 0; } /** * \test DecodeVLANTest02 test a good vlan header. * * \retval 1 on success * \retval 0 on failure */ static int DecodeVLANtest03 (void) { uint8_t raw_vlan[] = { 0x00, 0x20, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x3b, 0x36, 0x40, 0x00, 0x40, 0x06, 0xb7, 0xc9, 0x83, 0x97, 0x20, 0x81, 0x83, 0x97, 0x20, 0x15, 0x04, 0x8a, 0x17, 0x70, 0x4e, 0x14, 0xdf, 0x55, 0x4d, 0x3d, 0x5a, 0x61, 0x80, 0x10, 0x6b, 0x50, 0x3c, 0x4c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x04, 0xf0, 0xc8, 0x01, 0x99, 0xa3, 0xf3}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL); if(p->vlanh[0] == NULL) { goto error; } if(ENGINE_ISSET_EVENT(p,VLAN_HEADER_TOO_SMALL)) { goto error; } if(ENGINE_ISSET_EVENT(p,VLAN_UNKNOWN_TYPE)) { goto error; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 1; error: PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 0; } #endif /* UNITTESTS */ void DecodeVLANRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeVLANtest01", DecodeVLANtest01); UtRegisterTest("DecodeVLANtest02", DecodeVLANtest02); UtRegisterTest("DecodeVLANtest03", DecodeVLANtest03); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/runmode-tile.h0000644000000000000000000000226313051004444013561 00000000000000/* Copyright (C) 2011-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Ken Steele, Tilera Corporation * * Tilera TILE-Gx runmode support */ #ifndef __RUNMODE_TILE_H__ #define __RUNMODE_TILE_H__ #include "suricata-common.h" const char *RunModeTileMpipeGetDefaultMode(void); void RunModeTileMpipeRegister(void); extern int tile_num_pipelines; int RunModeTileMpipeWorkers(void); void *ParseMpipeConfig(const char *iface); #endif /* __RUNMODE_TILE_H__ */ suricata-3.2.1/src/util-radix-tree.c0000644000000000000000000042205213051004444014171 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implementation of radix trees */ #include "suricata-common.h" #include "util-radix-tree.h" #include "util-debug.h" #include "util-error.h" #include "util-ip.h" #include "util-unittest.h" #include "util-memcmp.h" /** * \brief Allocates and returns a new instance of SCRadixUserData. * * \param netmask The netmask entry (cidr) that has to be made in the new * SCRadixUserData instance * \param user The user data that has to be set for the above * netmask in the newly created SCRadixUserData instance. * * \retval user_data Pointer to a new instance of SCRadixUserData. */ static SCRadixUserData *SCRadixAllocSCRadixUserData(uint8_t netmask, void *user) { SCRadixUserData *user_data = SCMalloc(sizeof(SCRadixUserData)); if (unlikely(user_data == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); return NULL; } memset(user_data, 0, sizeof(SCRadixUserData)); user_data->netmask = netmask; user_data->user = user; return user_data; } /** * \brief Deallocates an instance of SCRadixUserData. * * \param user_data Pointer to the instance of SCRadixUserData that has to be * freed. */ static void SCRadixDeAllocSCRadixUserData(SCRadixUserData *user_data) { SCFree(user_data); return; } /** * \brief Appends a user_data instance(SCRadixUserData) to a * user_data(SCRadixUserData) list. We add the new entry in descending * order with respect to the netmask contained in the SCRadixUserData. * * \param new Pointer to the SCRadixUserData to be added to the list. * \param list Pointer to the SCRadixUserData list head, to which "new" has to * be appended. */ static void SCRadixAppendToSCRadixUserDataList(SCRadixUserData *new, SCRadixUserData **list) { SCRadixUserData *temp = NULL; SCRadixUserData *prev = NULL; if (new == NULL || list == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "new or list supplied as NULL"); exit(EXIT_FAILURE); } /* add to the list in descending order. The reason we do this is for * optimizing key retrieval for a ip key under a netblock */ prev = temp = *list; while (temp != NULL) { if (new->netmask > temp->netmask) break; prev = temp; temp = temp->next; } if (temp == *list) { new->next = *list; *list = new; } else { new->next = prev->next; prev->next = new; } return; } /** * \brief Creates a new Prefix for a key. Used internally by the API. * * \param key_stream Data that has to be wrapped in a SCRadixPrefix instance to * be processed for insertion/lookup/removal of a node by the * radix tree * \param key_bitlen The bitlen of the the above stream. For example if the * stream holds the ipv4 address(4 bytes), bitlen would be 32 * \param user Pointer to the user data that has to be associated with * this key * * \retval prefix The newly created prefix instance on success; NULL on failure */ static SCRadixPrefix *SCRadixCreatePrefix(uint8_t *key_stream, uint16_t key_bitlen, void *user, uint8_t netmask) { SCRadixPrefix *prefix = NULL; if ((key_bitlen % 8 != 0)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid argument bitlen - %d", key_bitlen); return NULL; } if (key_stream == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Argument \"stream\" NULL"); return NULL; } if ( (prefix = SCMalloc(sizeof(SCRadixPrefix))) == NULL) goto error; memset(prefix, 0, sizeof(SCRadixPrefix)); if ( (prefix->stream = SCMalloc(key_bitlen / 8)) == NULL) goto error; memset(prefix->stream, 0, key_bitlen / 8); memcpy(prefix->stream, key_stream, key_bitlen / 8); prefix->bitlen = key_bitlen; prefix->user_data = SCRadixAllocSCRadixUserData(netmask, user); if (prefix->user_data == NULL) { goto error; } return prefix; error: if (prefix != NULL) { if (prefix->stream != NULL) { SCFree(prefix->stream); } SCFree(prefix); } return NULL; } /** * \brief Adds a netmask and its user_data for a particular prefix stream. * * \param prefix The prefix stream to which the netmask and its corresponding * user data has to be added. * \param netmask The netmask value (cidr) that has to be added to the prefix. * \param user The pointer to the user data corresponding to the above * netmask. */ static void SCRadixAddNetmaskUserDataToPrefix(SCRadixPrefix *prefix, uint8_t netmask, void *user) { if (prefix == NULL || user == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "prefix or user NULL"); exit(EXIT_FAILURE); } SCRadixAppendToSCRadixUserDataList(SCRadixAllocSCRadixUserData(netmask, user), &prefix->user_data); return; } /** * \brief Removes a particular user_data corresponding to a particular netmask * entry, from a prefix. * * \param prefix Pointer to the prefix from which the user_data/netmask entry * has to be removed. * \param netmask The netmask value (cidr) whose user_data has to be deleted. */ static void SCRadixRemoveNetmaskUserDataFromPrefix(SCRadixPrefix *prefix, uint8_t netmask) { SCRadixUserData *temp = NULL, *prev = NULL; if (prefix == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "prefix NULL"); exit(EXIT_FAILURE); } prev = temp = prefix->user_data; while (temp != NULL) { if (temp->netmask == netmask) { if (temp == prefix->user_data) prefix->user_data = temp->next; else prev->next = temp->next; SCRadixDeAllocSCRadixUserData(temp); break; } prev = temp; temp = temp->next; } return; } /** * \brief Indicates if prefix contains an entry for an ip with a specific netmask. * * \param prefix Pointer to the ip prefix that is being checked. * \param netmask The netmask value (cidr) that has to be checked for * presence in the prefix. * * \retval 1 On match. * \retval 0 On no match. */ static int SCRadixPrefixContainNetmask(SCRadixPrefix *prefix, uint8_t netmask) { SCRadixUserData *user_data = NULL; if (prefix == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "prefix is NULL"); goto no_match; } user_data = prefix->user_data; while (user_data != NULL) { if (user_data->netmask == netmask) return 1; user_data = user_data->next; } no_match: return 0; } /** * \brief Returns the total netmask count for this prefix. * * \param prefix Pointer to the prefix * * \retval count The total netmask count for this prefix. */ static int SCRadixPrefixNetmaskCount(SCRadixPrefix *prefix) { SCRadixUserData *user_data = NULL; uint32_t count = 0; if (prefix == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "prefix is NULL"); return 0; } user_data = prefix->user_data; while (user_data != NULL) { count++; user_data = user_data->next; } return count; } /** * \brief Indicates if prefix contains an entry for an ip with a specific netmask * and if it does, it sets the user data field * SCRadixPrefix->user_data_result to the netmask user_data entry. * * \param prefix Pointer to the ip prefix that is being checked. * \param netmask The netmask value for which we will have to return the user_data * \param exact_match Bool flag which indicates if we should check if the prefix * holds proper netblock(< 32 for ipv4 and < 128 for ipv6) or not. * * \retval 1 On match. * \retval 0 On no match. */ static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix, uint16_t netmask, int exact_match, void **user_data_result) { SCRadixUserData *user_data = NULL; if (prefix == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "prefix is NULL"); goto no_match; } user_data = prefix->user_data; /* Check if we have a match for an exact ip. An exact ip as in not a proper * netblock, i.e. an ip with a netmask of 32(ipv4) or 128(ipv6) */ if (exact_match) { if (user_data->netmask == netmask) { if (user_data_result) *user_data_result = user_data->user; return 1; } else { goto no_match; } } /* Check for the user_data entry for this netmask_value */ while (user_data != NULL) { if (user_data->netmask == netmask) { if (user_data_result) *user_data_result = user_data->user; return 1; } user_data = user_data->next; } no_match: if (user_data_result != NULL) *user_data_result = NULL; return 0; } /** * \brief Frees a SCRadixPrefix instance * * \param prefix Pointer to a prefix instance * \param tree Pointer to the Radix tree to which this prefix belongs */ static void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree) { SCRadixUserData *user_data_temp1 = NULL; SCRadixUserData *user_data_temp2 = NULL; if (prefix != NULL) { if (prefix->stream != NULL) SCFree(prefix->stream); user_data_temp1 = prefix->user_data; if (tree->Free != NULL) { while (user_data_temp1 != NULL) { user_data_temp2 = user_data_temp1; user_data_temp1 = user_data_temp1->next; tree->Free(user_data_temp2->user); SCRadixDeAllocSCRadixUserData(user_data_temp2); } } else if (user_data_temp1 != NULL) { SCFree(user_data_temp1); } SCFree(prefix); } return; } /** * \brief Creates a new node for the Radix tree * * \retval node The newly created node for the radix tree */ static inline SCRadixNode *SCRadixCreateNode() { SCRadixNode *node = NULL; if ( (node = SCMalloc(sizeof(SCRadixNode))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCRadixCreateNode. Mem not allocated..."); return NULL; } memset(node, 0, sizeof(SCRadixNode)); return node; } /** * \brief Frees a Radix tree node * * \param node Pointer to a Radix tree node * \param tree Pointer to the Radix tree to which this node belongs */ static void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree) { if (node != NULL) { SCRadixReleasePrefix(node->prefix, tree); if (node->netmasks != NULL) SCFree(node->netmasks); SCFree(node); } return; } /** * \brief Creates a new Radix tree * * \param Free Function pointer supplied by the user to be used by the Radix * cleanup API to free the user suppplied data * * \retval tree The newly created radix tree on success * * \initonly (all radix trees should be created at init) */ SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*), void (*PrintData)(void*)) { SCRadixTree *tree = NULL; if ( (tree = SCMalloc(sizeof(SCRadixTree))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCRadixCreateRadixTree. Exiting..."); exit(EXIT_FAILURE); } memset(tree, 0, sizeof(SCRadixTree)); tree->Free = Free; tree->PrintData = PrintData; return tree; } /** * \brief Internal helper function used by SCRadixReleaseRadixTree to free a * subtree * * \param node Pointer to the root of the subtree that has to be freed * \param tree Pointer to the Radix tree to which this subtree belongs */ static void SCRadixReleaseRadixSubtree(SCRadixNode *node, SCRadixTree *tree) { if (node != NULL) { SCRadixReleaseRadixSubtree(node->left, tree); SCRadixReleaseRadixSubtree(node->right, tree); SCRadixReleaseNode(node, tree); } return; } /** * \brief Frees a Radix tree and all its nodes * * \param tree Pointer to the Radix tree that has to be freed */ void SCRadixReleaseRadixTree(SCRadixTree *tree) { if (tree == NULL) return; SCRadixReleaseRadixSubtree(tree->head, tree); tree->head = NULL; SCFree(tree); return; } /** * \brief Adds a key to the Radix tree. Used internally by the API. * * \param key_stream Data that has to added to the Radix tree * \param key_bitlen The bitlen of the the above stream. For example if the * stream is the string "abcd", the bitlen would be 32. If * the stream is an IPV6 address bitlen would be 128 * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with * this key * \param netmask The netmask (cidr) if we are adding an IP netblock; 255 * if we are not adding an IP netblock * * \retval node Pointer to the newly created node */ static SCRadixNode *SCRadixAddKey(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree, void *user, uint8_t netmask) { SCRadixNode *node = NULL; SCRadixNode *new_node = NULL; SCRadixNode *parent = NULL; SCRadixNode *inter_node = NULL; SCRadixNode *bottom_node = NULL; void *ptmp; uint8_t *stream = NULL; uint8_t bitlen = 0; int check_bit = 0; int differ_bit = 0; int i = 0; int j = 0; int temp = 0; if (tree == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Argument \"tree\" NULL"); return NULL; } /* chop the ip address against a netmask */ MaskIPNetblock(key_stream, netmask, key_bitlen); /* the very first element in the radix tree */ if (tree->head == NULL) { SCRadixPrefix *prefix = NULL; if ( (prefix = SCRadixCreatePrefix(key_stream, key_bitlen, user, netmask)) == NULL) { SCLogError(SC_ERR_RADIX_TREE_GENERIC, "Error creating prefix"); return NULL; } node = SCRadixCreateNode(); if (node == NULL) return NULL; node->prefix = prefix; node->bit = prefix->bitlen; tree->head = node; if (netmask == 255 || (netmask == 32 && key_bitlen == 32) || (netmask == 128 && key_bitlen == 128)) return node; /* if we have reached here, we are actually having a proper netblock in * our hand(i.e. < 32 for ipv4 and < 128 for ipv6). Add the netmask for * this node. The reason we add netmasks other than 32 and 128, is * because we need those netmasks in case of searches for ips contained * in netblocks. If the netmask is 32 or 128, either ways we will be * having an exact match for that ip value. If it is not, we start * chopping the incoming search ip key using the netmask values added * into the tree and then verify for a match */ node->netmask_cnt++; if ( (ptmp = SCRealloc(node->netmasks, (node->netmask_cnt * sizeof(uint8_t)))) == NULL) { SCFree(node->netmasks); node->netmasks = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Fatal error encountered in SCRadixAddKey. Mem not allocated"); return NULL; } node->netmasks = ptmp; node->netmasks[0] = netmask; return node; } node = tree->head; stream = key_stream; bitlen = key_bitlen; /* we walk down the tree only when we satisfy 2 conditions. The first one * being the incoming prefix is shorter than the differ bit of the current * node. In case we fail in this aspect, we walk down to the tree, till we * arrive at a node that ends in a prefix */ while (node->bit < bitlen || node->prefix == NULL) { /* if the bitlen isn't long enough to handle the bit test, we just walk * down along one of the paths, since either paths should end up with a * node that has a common prefix whose differ bit is greater than the * bitlen of the incoming prefix */ if (bitlen <= node->bit) { if (node->right == NULL) break; node = node->right; } else { if (SC_RADIX_BITTEST(stream[node->bit >> 3], (0x80 >> (node->bit % 8))) ) { if (node->right == NULL) break; node = node->right; } else { if (node->left == NULL) break; node = node->left; } } } /* we need to keep a reference to the bottom-most node, that actually holds * the prefix */ bottom_node = node; /* get the first bit position where the ips differ */ check_bit = (node->bit < bitlen)? node->bit: bitlen; for (i = 0; (i * 8) < check_bit; i++) { if ((temp = (stream[i] ^ bottom_node->prefix->stream[i])) == 0) { differ_bit = (i + 1) * 8; continue; } /* find out the position where the first bit differs. This method is * faster, but at the cost of being larger. But with larger caches * these days we don't have to worry about cache misses */ temp = temp * 2; if (temp >= 256) j = 0; else if (temp >= 128) j = 1; else if (temp >= 64) j = 2; else if (temp >= 32) j = 3; else if (temp >= 16) j = 4; else if (temp >= 8) j = 5; else if (temp >= 4) j = 6; else if (temp >= 2) j = 7; differ_bit = i * 8 + j; break; } if (check_bit < differ_bit) differ_bit = check_bit; /* walk up the tree till we find the position, to fit our new node in */ parent = node->parent; while (parent && differ_bit <= parent->bit) { node = parent; parent = node->parent; } /* We already have the node in the tree with the same differing bit pstn */ if (differ_bit == bitlen && node->bit == bitlen) { if (node->prefix != NULL) { /* Check if we already have this netmask entry covered by this prefix */ if (SCRadixPrefixContainNetmask(node->prefix, netmask)) { /* Basically we already have this stream prefix, as well as the * netblock entry for this. A perfect duplicate. */ SCLogDebug("Duplicate entry for this ip address/netblock"); } else { /* Basically we already have this stream prefix, but we don't * have an entry for this particular netmask value for this * prefix. For example, we have an entry for 192.168.0.0 and * 192.168.0.0/16 and now we are trying to enter 192.168.0.0/20 */ SCRadixAddNetmaskUserDataToPrefix(node->prefix, netmask, user); /* if we are adding a netmask of 32(for ipv4) or 128(for ipv6) * it indicates we are adding an exact host ip into the radix * tree, in which case we don't need to add the netmask value * into the tree */ if (netmask == 255 || (netmask == 32 && bitlen == 32) || (netmask == 128 && bitlen == 128)) return node; /* looks like we have a netmask which is != 32 or 128, in which * case we walk up the tree to insert this netmask value in the * correct node */ parent = node->parent; while (parent != NULL && netmask < (parent->bit + 1)) { node = parent; parent = parent->parent; } node->netmask_cnt++; new_node = node; if ( (ptmp = SCRealloc(node->netmasks, (node->netmask_cnt * sizeof(uint8_t)))) == NULL) { SCFree(node->netmasks); node->netmasks = NULL; SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCRadixAddKey. Mem not allocated..."); return NULL; } node->netmasks = ptmp; if (node->netmask_cnt == 1) { node->netmasks[0] = netmask; return new_node; } node->netmasks[node->netmask_cnt - 1] = netmask; for (i = node->netmask_cnt - 2; i >= 0; i--) { if (netmask < node->netmasks[i]) { node->netmasks[i + 1] = netmask; break; } node->netmasks[i + 1] = node->netmasks[i]; node->netmasks[i] = netmask; } } } else { node->prefix = SCRadixCreatePrefix(key_stream, key_bitlen, user, 255); } return node; } /* create the leaf node for the new key */ SCRadixPrefix *prefix = NULL; if ( (prefix = SCRadixCreatePrefix(key_stream, key_bitlen, user, netmask)) == NULL) { SCLogError(SC_ERR_RADIX_TREE_GENERIC, "Error creating prefix"); return NULL; } new_node = SCRadixCreateNode(); new_node->prefix = prefix; new_node->bit = prefix->bitlen; /* indicates that we have got a key that has length that is already covered * by a prefix of some other key in the tree. We create a new intermediate * node with a single child and stick it in. We need the if only in the * case of variable length keys */ if (differ_bit == bitlen) { if (SC_RADIX_BITTEST(bottom_node->prefix->stream[differ_bit >> 3], (0x80 >> (differ_bit % 8))) ) { new_node->right = node; } else { new_node->left = node; } new_node->parent = node->parent; if (node->parent == NULL) tree->head = new_node; else if (node->parent->right == node) node->parent->right = new_node; else node->parent->left = new_node; node->parent = new_node; /* stick our new_node into the tree. Create a node that holds the * differing bit position and break the branch. Also handle the * tranfer of netmasks between node and inter_node(explained in more * detail below) */ } else { inter_node = SCRadixCreateNode(); inter_node->prefix = NULL; inter_node->bit = differ_bit; inter_node->parent = node->parent; if (node->netmasks != NULL) { for (i = 0; i < node->netmask_cnt; i++) { if (node->netmasks[i] < differ_bit + 1) break; } if ( (inter_node->netmasks = SCMalloc((node->netmask_cnt - i) * sizeof(uint8_t))) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Fatal error encountered in SCRadixAddKey. Mem not allocated..."); return NULL; } for (j = 0; j < (node->netmask_cnt - i); j++) inter_node->netmasks[j] = node->netmasks[i + j]; inter_node->netmask_cnt = (node->netmask_cnt - i); node->netmask_cnt = i; if (node->netmask_cnt == 0) { SCFree(node->netmasks); node->netmasks = NULL; } } if (SC_RADIX_BITTEST(stream[differ_bit >> 3], (0x80 >> (differ_bit % 8))) ) { inter_node->left = node; inter_node->right = new_node; } else { inter_node->left = new_node; inter_node->right = node; } new_node->parent = inter_node; if (node->parent == NULL) tree->head = inter_node; else if (node->parent->right == node) node->parent->right = inter_node; else node->parent->left = inter_node; node->parent = inter_node; } /* insert the netmask into the tree */ if (netmask != 255 && (netmask != 32 || (netmask == 32 && bitlen != 32)) && netmask != 128) { node = new_node; parent = new_node->parent; while (parent != NULL && netmask < (parent->bit + 1)) { node = parent; parent = parent->parent; } node->netmask_cnt++; if ( (ptmp = SCRealloc(node->netmasks, (node->netmask_cnt * sizeof(uint8_t)))) == NULL) { SCFree(node->netmasks); node->netmasks = NULL; SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCRadixAddKey. Exiting..."); exit(EXIT_FAILURE); } node->netmasks = ptmp; if (node->netmask_cnt == 1) { node->netmasks[0] = netmask; return new_node; } node->netmasks[node->netmask_cnt - 1] = netmask; for (i = node->netmask_cnt - 2; i >= 0; i--) { if (netmask < node->netmasks[i]) { node->netmasks[i + 1] = netmask; break; } node->netmasks[i + 1] = node->netmasks[i]; node->netmasks[i] = netmask; } } return new_node; } /** * \brief Adds a new generic key to the Radix tree * * \param key_stream Data that has to be added to the Radix tree * \param key_bitlen The bitlen of the the above stream. For example if the * stream is the string "abcd", the bitlen would be 32 * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with the * key * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyGeneric(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree, void *user) { SCRadixNode *node = SCRadixAddKey(key_stream, key_bitlen, tree, user, 255); return node; } /** * \brief Adds a new IPV4 address to the Radix tree * * \param key_stream Data that has to be added to the Radix tree. In this case * a pointer to an IPV4 address * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with the * key * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV4(uint8_t *key_stream, SCRadixTree *tree, void *user) { SCRadixNode *node = SCRadixAddKey(key_stream, 32, tree, user, 32); return node; } /** * \brief Adds a new IPV6 address to the Radix tree * * \param key_stream Data that has to be added to the Radix tree. In this case * the pointer to an IPV6 address * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with the * key * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV6(uint8_t *key_stream, SCRadixTree *tree, void *user) { SCRadixNode *node = SCRadixAddKey(key_stream, 128, tree, user, 128); return node; } /** * \brief Adds a new IPV4 netblock to the Radix tree * * \param key_stream Data that has to be added to the Radix tree. In this case * a pointer to an IPV4 netblock * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with the * key * \param netmask The netmask (cidr) if we are adding a netblock * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV4Netblock(uint8_t *key_stream, SCRadixTree *tree, void *user, uint8_t netmask) { SCRadixNode *node = SCRadixAddKey(key_stream, 32, tree, user, netmask); return node; } /** * \brief Adds a new IPV6 netblock to the Radix tree * * \param key_stream Data that has to be added to the Radix tree. In this case * a pointer to an IPV6 netblock * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with the * key * \param netmask The netmask (cidr) if we are adding a netblock * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV6Netblock(uint8_t *key_stream, SCRadixTree *tree, void *user, uint8_t netmask) { SCRadixNode *node = SCRadixAddKey(key_stream, 128, tree, user, netmask); return node; } /** * \brief Adds a new IPV4/netblock to the Radix tree from a string * * \param str IPV4 string with optional /cidr netmask * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with * the key * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV4String(const char *str, SCRadixTree *tree, void *user) { uint32_t ip; uint8_t netmask = 32; char ip_str[32]; /* Max length for full ipv4/mask string with NUL */ char *mask_str = NULL; struct in_addr addr; /* Make a copy of the string so it can be modified */ strlcpy(ip_str, str, sizeof(ip_str) - 2); *(ip_str + (sizeof(ip_str) - 1)) = '\0'; /* Does it have a mask? */ if (NULL != (mask_str = strchr(ip_str, '/'))) { int cidr; *(mask_str++) = '\0'; /* Dotted type netmask not supported (yet) */ if (strchr(mask_str, '.') != NULL) { return NULL; } /* Get binary values for cidr mask */ cidr = atoi(mask_str); if ((cidr < 0) || (cidr > 32)) { return NULL; } netmask = (uint8_t)cidr; } /* Validate the IP */ if (inet_pton(AF_INET, ip_str, &addr) <= 0) { return NULL; } ip = addr.s_addr; return SCRadixAddKey((uint8_t *)&ip, 32, tree, user, netmask); } /** * \brief Adds a new IPV6/netblock to the Radix tree from a string * * \param str IPV6 string with optional /cidr netmask * \param tree Pointer to the Radix tree * \param user Pointer to the user data that has to be associated with * the key * * \retval node Pointer to the newly created node */ SCRadixNode *SCRadixAddKeyIPV6String(const char *str, SCRadixTree *tree, void *user) { uint8_t netmask = 128; char ip_str[80]; /* Max length for full ipv6/mask string with NUL */ char *mask_str = NULL; struct in6_addr addr; /* Make a copy of the string so it can be modified */ strlcpy(ip_str, str, sizeof(ip_str) - 2); *(ip_str + sizeof(ip_str) - 1) = '\0'; /* Does it have a mask? */ if (NULL != (mask_str = strchr(ip_str, '/'))) { int cidr; *(mask_str++) = '\0'; /* Dotted type netmask not supported (yet) */ if (strchr(mask_str, '.') != NULL) { return NULL; } /* Get binary values for cidr mask */ cidr = atoi(mask_str); if ((cidr < 0) || (cidr > 128)) { return NULL; } netmask = (uint8_t)cidr; } /* Validate the IP */ if (inet_pton(AF_INET6, ip_str, &addr) <= 0) { return NULL; } return SCRadixAddKey(addr.s6_addr, 128, tree, user, netmask); } static void SCRadixTransferNetmasksBWNodes(SCRadixNode *dest, SCRadixNode *src) { int i = 0, j = 0; void *ptmp = NULL; if (src == NULL || dest == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "src or dest NULL"); return; } /* no netmasks in the source node, to transfer to the destination node */ if (src->netmasks == NULL) return; if ( (ptmp = SCRealloc(dest->netmasks, (src->netmask_cnt + dest->netmask_cnt) * sizeof(uint8_t))) == NULL) { SCFree(dest->netmasks); dest->netmasks = NULL; return; } dest->netmasks = ptmp; for (i = dest->netmask_cnt, j = 0; j < src->netmask_cnt; i++, j++) dest->netmasks[i] = src->netmasks[j]; return; } /** * \brief Removes a netblock entry from an ip node. The function first * deletes the netblock/user_data entry for the prefix and then * removes the netmask entry that has been made in the tree, by * walking up the tree and deleting the entry from the specific node. * * \param node The node from which the netblock entry has to be removed. * \param netmask The netmask entry (cidr) that has to be removed. */ static void SCRadixRemoveNetblockEntry(SCRadixNode *node, uint8_t netmask) { void *ptmp; SCRadixNode *parent = NULL; int i = 0; if (node == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument. Node is NULL"); return; } SCRadixRemoveNetmaskUserDataFromPrefix(node->prefix, netmask); if (netmask == 32 || netmask == 128) return; parent = node->parent; while (parent != NULL && netmask < (parent->bit + 1)) { parent = parent->parent; } for (i = 0; i < node->netmask_cnt; i++) { if (node->netmasks[i] == netmask) break; } if (i == node->netmask_cnt) { SCLogDebug("Something's wrong with the tree. We are unable to find the " "netmask entry"); return; } for ( ; i < node->netmask_cnt - 1; i++) node->netmasks[i] = node->netmasks[i + 1]; node->netmask_cnt--; if (node->netmask_cnt == 0) { SCFree(node->netmasks); node->netmasks = NULL; return; } ptmp = SCRealloc(node->netmasks, node->netmask_cnt * sizeof(uint8_t)); if (ptmp == NULL) { SCFree(node->netmasks); node->netmasks = NULL; return; } node->netmasks = ptmp; return; } /** * \brief Removes a key from the Radix tree * * \param key_stream Data that has to be removed from the Radix tree * \param key_bitlen The bitlen of the the above stream. For example if the * stream holds an IPV4 address(4 bytes), bitlen would be 32 * \param tree Pointer to the Radix tree from which the key has to be * removed */ static void SCRadixRemoveKey(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree, uint8_t netmask) { SCRadixNode *node = tree->head; SCRadixNode *parent = NULL; SCRadixNode *temp_dest = NULL; SCRadixPrefix *prefix = NULL; uint32_t mask = 0; int i = 0; if (node == NULL) return; if ( (prefix = SCRadixCreatePrefix(key_stream, key_bitlen, NULL, 255)) == NULL) return; while (node->bit < prefix->bitlen) { if (SC_RADIX_BITTEST(prefix->stream[node->bit >> 3], (0x80 >> (node->bit % 8))) ) { node = node->right; } else { node = node->left; } if (node == NULL) { SCRadixReleasePrefix(prefix, tree); return; } } if (node->bit != prefix->bitlen || node->prefix == NULL) { SCRadixReleasePrefix(prefix, tree); return; } i = prefix->bitlen / 8; if (SCMemcmp(node->prefix->stream, prefix->stream, i) == 0) { mask = UINT_MAX << (8 - prefix->bitlen % 8); if (prefix->bitlen % 8 == 0 || (node->prefix->stream[i] & mask) == (prefix->stream[i] & mask)) { if (!SCRadixPrefixContainNetmask(node->prefix, netmask)) { SCLogDebug("The ip key exists in the Radix Tree, but this(%d) " "netblock entry doesn't exist", netmask); SCRadixReleasePrefix(prefix, tree); return; } } else { SCLogDebug("You are trying to remove a key that doesn't exist in " "the Radix Tree"); SCRadixReleasePrefix(prefix, tree); return; } } else { SCLogDebug("You are trying to remove a key that doesn't exist in the " "Radix Tree"); SCRadixReleasePrefix(prefix, tree); return; } /* The ip node does exist, and the netblock entry does exist in this node, if * we have reached this point. If we have more than one netblock entry, it * indicates we have multiple entries for this key. So we delete that * particular netblock entry, and make our way out of this function */ if (SCRadixPrefixNetmaskCount(node->prefix) > 1) { SCRadixRemoveNetblockEntry(node, netmask); SCRadixReleasePrefix(prefix, tree); return; } /* we are deleting the root of the tree. This would be the only node left * in the tree */ if (tree->head == node) { SCFree(node); tree->head = NULL; SCRadixReleasePrefix(prefix, tree); return; } parent = node->parent; /* parent->parent is not the root of the tree */ if (parent->parent != NULL) { if (parent->parent->left == parent) { if (node->parent->left == node) { temp_dest = parent->right; parent->parent->left = parent->right; parent->right->parent = parent->parent; } else { temp_dest = parent->left; parent->parent->left = parent->left; parent->left->parent = parent->parent; } } else { if (node->parent->left == node) { temp_dest = parent->right; parent->parent->right = parent->right; parent->right->parent = parent->parent; } else { temp_dest = parent->left; parent->parent->right = parent->left; parent->left->parent = parent->parent; } } /* parent is the root of the tree */ } else { if (parent->left == node) { temp_dest = tree->head->right; tree->head->right->parent = NULL; tree->head = tree->head->right; } else { temp_dest = tree->head->left; tree->head->left->parent = NULL; tree->head = tree->head->left; } } /* We need to shift the netmask entries from the node that would be * deleted to its immediate descendant */ SCRadixTransferNetmasksBWNodes(temp_dest, parent); /* release the nodes */ SCRadixReleaseNode(parent, tree); SCRadixReleaseNode(node, tree); SCRadixReleasePrefix(prefix, tree); return; } /** * \brief Removes a key from the Radix tree * * \param key_stream Data that has to be removed from the Radix tree * \param key_bitlen The bitlen of the the above stream. * \param tree Pointer to the Radix tree from which the key has to be * removed */ void SCRadixRemoveKeyGeneric(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree) { SCRadixRemoveKey(key_stream, key_bitlen, tree, 255); return; } /** * \brief Removes an IPV4 address netblock key from the Radix tree. * * \param key_stream Data that has to be removed from the Radix tree. In this * case an IPV4 address * \param tree Pointer to the Radix tree from which the key has to be * removed */ void SCRadixRemoveKeyIPV4Netblock(uint8_t *key_stream, SCRadixTree *tree, uint8_t netmask) { SCRadixRemoveKey(key_stream, 32, tree, netmask); return; } /** * \brief Removes an IPV4 address key(not a netblock) from the Radix tree. * Instead of using this function, we can also used * SCRadixRemoveKeyIPV4Netblock(), by supplying a netmask value of 32. * * \param key_stream Data that has to be removed from the Radix tree. In this * case an IPV4 address * \param tree Pointer to the Radix tree from which the key has to be * removed */ void SCRadixRemoveKeyIPV4(uint8_t *key_stream, SCRadixTree *tree) { SCRadixRemoveKey(key_stream, 32, tree, 32); return; } /** * \brief Removes an IPV6 netblock address key from the Radix tree. * * \param key_stream Data that has to be removed from the Radix tree. In this * case an IPV6 address * \param tree Pointer to the Radix tree from which the key has to be * removed */ void SCRadixRemoveKeyIPV6Netblock(uint8_t *key_stream, SCRadixTree *tree, uint8_t netmask) { SCRadixRemoveKey(key_stream, 128, tree, netmask); return; } /** * \brief Removes an IPV6 address key(not a netblock) from the Radix tree. * Instead of using this function, we can also used * SCRadixRemoveKeyIPV6Netblock(), by supplying a netmask value of 128. * * \param key_stream Data that has to be removed from the Radix tree. In this * case an IPV6 address * \param tree Pointer to the Radix tree from which the key has to be * removed */ void SCRadixRemoveKeyIPV6(uint8_t *key_stream, SCRadixTree *tree) { SCRadixRemoveKey(key_stream, 128, tree, 128); return; } /** * \brief Checks if an IP prefix falls under a netblock, in the path to the root * of the tree, from the node. Used internally by SCRadixFindKey() * * \param prefix Pointer to the prefix that contains the ip address * \param node Pointer to the node from where we have to climb the tree */ static inline SCRadixNode *SCRadixFindKeyIPNetblock(uint8_t *key_stream, uint8_t key_bitlen, SCRadixNode *node, void **user_data_result) { SCRadixNode *netmask_node = NULL; uint32_t mask = 0; int bytes = 0; int i = 0; int j = 0; while (node != NULL && node->netmasks == NULL) node = node->parent; if (node == NULL) return NULL; /* hold the node found containing a netmask. We will need it when we call * this function recursively */ netmask_node = node; for (j = 0; j < netmask_node->netmask_cnt; j++) { bytes = key_bitlen / 8; for (i = 0; i < bytes; i++) { mask = UINT_MAX; if ( ((i + 1) * 8) > netmask_node->netmasks[j]) { if ( ((i + 1) * 8 - netmask_node->netmasks[j]) < 8) mask = UINT_MAX << ((i + 1) * 8 - netmask_node->netmasks[j]); else mask = 0; } key_stream[i] &= mask; } while (node->bit < key_bitlen) { if (SC_RADIX_BITTEST(key_stream[node->bit >> 3], (0x80 >> (node->bit % 8))) ) { node = node->right; } else { node = node->left; } if (node == NULL) return NULL; } if (node->bit != key_bitlen || node->prefix == NULL) return NULL; if (SCMemcmp(node->prefix->stream, key_stream, bytes) == 0) { mask = UINT_MAX << (8 - key_bitlen % 8); if (key_bitlen % 8 == 0 || (node->prefix->stream[bytes] & mask) == (key_stream[bytes] & mask)) { if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, netmask_node->netmasks[j], 0, user_data_result)) return node; } } } return SCRadixFindKeyIPNetblock(key_stream, key_bitlen, netmask_node->parent, user_data_result); } /** * \brief Checks if an IP address key is present in the tree. The function * apart from handling any normal data, also handles ipv4/ipv6 netblocks * * \param key_stream Data that has to be found in the Radix tree * \param key_bitlen The bitlen of the above stream. * \param tree Pointer to the Radix tree * \param exact_match The key to be searched is an ip address */ static SCRadixNode *SCRadixFindKey(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree, int exact_match, void **user_data_result) { if (tree == NULL || tree->head == NULL) return NULL; SCRadixNode *node = tree->head; uint32_t mask = 0; int bytes = 0; uint8_t tmp_stream[255]; if (key_bitlen > 255) return NULL; memset(tmp_stream, 0, 255); memcpy(tmp_stream, key_stream, key_bitlen / 8); while (node->bit < key_bitlen) { if (SC_RADIX_BITTEST(tmp_stream[node->bit >> 3], (0x80 >> (node->bit % 8))) ) { node = node->right; } else { node = node->left; } if (node == NULL) { return NULL; } } if (node->bit != key_bitlen || node->prefix == NULL) { return NULL; } bytes = key_bitlen / 8; if (SCMemcmp(node->prefix->stream, tmp_stream, bytes) == 0) { mask = UINT_MAX << (8 - key_bitlen % 8); if (key_bitlen % 8 == 0 || (node->prefix->stream[bytes] & mask) == (tmp_stream[bytes] & mask)) { if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, key_bitlen, 1, user_data_result)) { return node; } } } /* if you are not an ip key, get out of here */ if (exact_match) { return NULL; } SCRadixNode *ret = SCRadixFindKeyIPNetblock(tmp_stream, key_bitlen, node, user_data_result); return ret; } /** * \brief Checks if a key is present in the tree * * \param key_stream Data that has to be found in the Radix tree * \param key_bitlen The bitlen of the the above stream. * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyGeneric(uint8_t *key_stream, uint16_t key_bitlen, SCRadixTree *tree, void **user_data_result) { return SCRadixFindKey(key_stream, key_bitlen, tree, 1, user_data_result); } /** * \brief Checks if an IPV4 address is present in the tree * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV4 address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV4ExactMatch(uint8_t *key_stream, SCRadixTree *tree, void **user_data_result) { return SCRadixFindKey(key_stream, 32, tree, 1, user_data_result); } /** * \brief Checks if an IPV4 address is present in the tree under a netblock * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV4 address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV4BestMatch(uint8_t *key_stream, SCRadixTree *tree, void **user_data_result) { return SCRadixFindKey(key_stream, 32, tree, 0, user_data_result); } /** * \brief Checks if an IPV4 Netblock address is present in the tree * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV4 netblock address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV4Netblock(uint8_t *key_stream, SCRadixTree *tree, uint8_t netmask, void **user_data_result) { SCRadixNode *node = NULL; node = SCRadixFindKey(key_stream, 32, tree, 0, user_data_result); if (node == NULL) return node; if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, netmask, 1, user_data_result)) return node; else return NULL; } /** * \brief Checks if an IPV6 Netblock address is present in the tree * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV6 netblock address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV6Netblock(uint8_t *key_stream, SCRadixTree *tree, uint8_t netmask, void **user_data_result) { SCRadixNode *node = NULL; node = SCRadixFindKey(key_stream, 128, tree, 0, user_data_result); if (node == NULL) return node; if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, (uint16_t)netmask, 1, user_data_result)) return node; else return NULL; } /** * \brief Checks if an IPV6 address is present in the tree * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV6 address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV6ExactMatch(uint8_t *key_stream, SCRadixTree *tree, void **user_data_result) { return SCRadixFindKey(key_stream, 128, tree, 1, user_data_result); } /** * \brief Checks if an IPV6 address is present in the tree under a netblock * * \param key_stream Data that has to be found in the Radix tree. In this case * an IPV6 address * \param tree Pointer to the Radix tree instance */ SCRadixNode *SCRadixFindKeyIPV6BestMatch(uint8_t *key_stream, SCRadixTree *tree, void **user_data_result) { return SCRadixFindKey(key_stream, 128, tree, 0, user_data_result); } /** * \brief Prints the node information from a Radix tree * * \param node Pointer to the Radix node whose information has to be printed * \param level Used for indentation purposes */ void SCRadixPrintNodeInfo(SCRadixNode *node, int level, void (*PrintData)(void*)) { int i = 0; if (node == NULL) return; for (i = 0; i < level; i++) printf(" "); printf("%d [", node->bit); if (node->netmasks == NULL) { printf("%d, ", -1); } else { for (i = 0; i < node->netmask_cnt; i++) printf("%s%d", (0 == i ? "" : ", "), node->netmasks[i]); } printf("] ("); if (node->prefix != NULL) { for (i = 0; i * 8 < node->prefix->bitlen; i++) printf("%s%d", (0 == i ? "" : "."), node->prefix->stream[i]); printf(")\n"); SCRadixUserData *ud = NULL; if (PrintData != NULL) { do { ud = node->prefix->user_data; printf(" [%d], ", ud->netmask); PrintData(ud->user); ud = ud->next; } while (ud != NULL); } else { //ud = node->prefix->user_data; //while (ud != NULL) { // printf(" [nm %d with data], ", ud->netmask); // ud = ud->next; //} printf("No print function provided"); } printf("\n"); } else { printf("NULL)\n"); } return; } /** * \brief Helper function used by SCRadixPrintTree. Prints the subtree with * node as the root of the subtree * * \param node Pointer to the node that is the root of the subtree to be printed * \param level Used for indentation purposes */ static void SCRadixPrintRadixSubtree(SCRadixNode *node, int level, void (*PrintData)(void*)) { if (node != NULL) { SCRadixPrintNodeInfo(node, level, PrintData); SCRadixPrintRadixSubtree(node->left, level + 1, PrintData); SCRadixPrintRadixSubtree(node->right, level + 1, PrintData); } return; } /** * \brief Prints the Radix Tree. While printing the radix tree we use the * following format * * Parent_0 * Left_Child_1 * Left_Child_2 * Right_Child_2 * Right_Child_1 * Left_Child_2 * Right_Child_2 and so on * * Each node printed out holds details on the next bit that differs * amongst its children, and if the node holds a prefix, the perfix is * printed as well. * * \param tree Pointer to the Radix tree that has to be printed */ void SCRadixPrintTree(SCRadixTree *tree) { printf("Printing the Radix Tree: \n"); SCRadixPrintRadixSubtree(tree->head, 0, tree->PrintData); return; } /*------------------------------------Unit_Tests------------------------------*/ #ifdef UNITTESTS int SCRadixTestInsertion01(void) { SCRadixTree *tree = NULL; SCRadixNode *node[2]; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); node[0] = SCRadixAddKeyGeneric((uint8_t *)"abaa", 32, tree, NULL); node[1] = SCRadixAddKeyGeneric((uint8_t *)"abab", 32, tree, NULL); result &= (tree->head->bit == 30); result &= (tree->head->right == node[0]); result &= (tree->head->left == node[1]); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestInsertion02(void) { SCRadixTree *tree = NULL; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); SCRadixAddKeyGeneric((uint8_t *)"aaaaaa", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"aaaaab", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"aaaaaba", 56, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"abab", 32, tree, NULL); SCRadixReleaseRadixTree(tree); /* If we don't have a segfault till here we have succeeded :) */ return result; } int SCRadixTestIPV4Insertion03(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); /* add a key that already exists in the tree */ SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); /* continue adding keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.18", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); /* test the existence of keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.3", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "127.234.2.62", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.1.2", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.18", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV4Removal04(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.18", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); /* remove the keys from the tree */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.18", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.1", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4((uint8_t *)&servaddr.sin_addr, tree); result &= (tree->head == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestCharacterInsertion05(void) { SCRadixTree *tree = NULL; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* Let us have our team here ;-) */ SCRadixAddKeyGeneric((uint8_t *)"Victor", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Matt", 32, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Josh", 32, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Margaret", 64, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Pablo", 40, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Brian", 40, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Jasonish", 64, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Jasonmc", 56, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Nathan", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Anoop", 40, tree, NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Victor", 48, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Matt", 32, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Josh", 32, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Margaret", 64, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Pablo", 40, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Brian", 40, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Jasonish", 64, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Jasonmc", 56, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Nathan", 48, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Anoop", 40, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"bamboo", 48, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"bool", 32, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"meerkat", 56, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Victor", 48, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestCharacterRemoval06(void) { SCRadixTree *tree = NULL; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* Let us have our team here ;-) */ SCRadixAddKeyGeneric((uint8_t *)"Victor", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Matt", 32, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Josh", 32, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Margaret", 64, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Pablo", 40, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Brian", 40, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Jasonish", 64, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Jasonmc", 56, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Nathan", 48, tree, NULL); SCRadixAddKeyGeneric((uint8_t *)"Anoop", 40, tree, NULL); SCRadixRemoveKeyGeneric((uint8_t *)"Nathan", 48, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Brian", 40, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Margaret", 64, tree); result &= (SCRadixFindKeyGeneric((uint8_t *)"Victor", 48, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Matt", 32, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Josh", 32, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Margaret", 64, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Brian", 40, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Nathan", 48, tree, NULL) == NULL); SCRadixRemoveKeyGeneric((uint8_t *)"Victor", 48, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Josh", 32, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Jasonmc", 56, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Matt", 32, tree); result &= (SCRadixFindKeyGeneric((uint8_t *)"Pablo", 40, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Jasonish", 64, tree, NULL) != NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Anoop", 40, tree, NULL) != NULL); SCRadixRemoveKeyGeneric((uint8_t *)"Pablo", 40, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Jasonish", 64, tree); SCRadixRemoveKeyGeneric((uint8_t *)"Anoop", 40, tree); result &= (SCRadixFindKeyGeneric((uint8_t *)"Pablo", 40, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Jasonish", 64, tree, NULL) == NULL); result &= (SCRadixFindKeyGeneric((uint8_t *)"Anoop", 40, tree, NULL) == NULL); result &= (tree->head == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV6Insertion07(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* Try to add the prefix that already exists in the tree */ SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* test the existence of keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABC2:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF5:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV6Removal08(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* Try to add the prefix that already exists in the tree */ SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* test the existence of keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "8888:0BF1:5346:BDEA:6422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2006:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* test for existance */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:DDDD:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); /* remove keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); /* test for existance */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); /* remove keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; SCRadixRemoveKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree); /* test for existance */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV4NetblockInsertion09(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.3", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.1.2", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.18", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.192.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 18); if (inet_pton(AF_INET, "192.175.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.170.1.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.145", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.64.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.191.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.224.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.174.224.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.175.224.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV4NetblockInsertion10(void) { SCRadixTree *tree = NULL; SCRadixNode *node[2]; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.235.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.0", &servaddr.sin_addr) <= 0) return 0; node[0] = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; node[1] = SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 18); if (inet_pton(AF_INET, "192.175.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.53", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[0]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[1]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[1]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[0]); /* let us remove a netblock */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.0", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.127.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV4NetblockInsertion11(void) { SCRadixTree *tree = NULL; SCRadixNode *node = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.235.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 18); if (inet_pton(AF_INET, "192.175.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) return 0; node = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 0); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.53", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.127.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "1.1.1.1", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.255.254.25", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "169.255.254.25", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.5", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL && SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "245.63.62.121", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL && SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL && SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node); /* remove node 0.0.0.0 */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, 0); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.6", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.127.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "1.1.1.1", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.255.254.25", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "169.255.254.25", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV4NetblockInsertion12(void) { SCRadixTree *tree = NULL; SCRadixNode *node[2]; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.192.235.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.167.1.4", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "220.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "253.224.1.5", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.0", &servaddr.sin_addr) <= 0) return 0; node[0] = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 24); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; node[1] = SCRadixAddKeyIPV4((uint8_t *)&servaddr.sin_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 18); if (inet_pton(AF_INET, "225.175.21.228", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 32); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.53", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[0]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.53", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[1]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[1]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.45", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[1]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.128.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == node[0]); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.171.127.78", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "225.175.21.228", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "225.175.21.224", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "225.175.21.229", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "225.175.21.230", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4ExactMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV6NetblockInsertion13(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DB00:0000:0000:0000:0000", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, NULL, 56); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1145:6241", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); /* test the existence of keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABC2:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF5:5346:1251:7422:1112:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBCA:1245:2342:1111:2212", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1146:6241", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1356:1241", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DAAA:1245:2342:1146:6241", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); SCRadixReleaseRadixTree(tree); return result; } int SCRadixTestIPV6NetblockInsertion14(void) { SCRadixTree *tree = NULL; SCRadixNode *node = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); /* add the keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2003:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "BD15:9791:5346:6223:AADB:8713:9882:2432", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "1111:A21B:6221:BDEA:BBBA::DBAA:9861", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "4444:0BF7:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "5555:0BF1:ABCD:ADEA:7922:ABCD:9124:2375", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DB00:0000:0000:0000:0000", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, NULL, 56); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1145:6241", &servaddr.sin6_addr) <= 0) return 0; SCRadixAddKeyIPV6((uint8_t *)&servaddr.sin6_addr, tree, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "::", &servaddr.sin6_addr) <= 0) return 0; node = SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, NULL, 0); /* test the existence of keys */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2004:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2004:0BF1:5346:BDEA:7422:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2004:0BF1:5346:B116:2362:8713:9124:2315", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "2004:0B23:3252:BDEA:7422:8713:9124:2341", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) == node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1145:6241", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL && SCRadixFindKeyIPV6ExactMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != node); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DBCA:ABCD:ABCD:DBAA:1245:2342:1145:6241", &servaddr.sin6_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != NULL && SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, NULL) != node); SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV4NetBlocksAndBestSearch15(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.1", &servaddr.sin_addr) <= 0) { result = 0; goto end; } for (; i <= 32; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV4NetBlocksAndBestSearch16(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.1", &servaddr.sin_addr) <= 0) { result = 0; goto end; } for (; i <= 32; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV4NetBlocksAndBestSearch17(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "10.0.0.1", &servaddr.sin_addr) <= 0) { result = 0; goto end; } for (; i <= 32; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV4NetBlocksAndBestSearch18(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "172.26.0.1", &servaddr.sin_addr) <= 0) { result = 0; goto end; } for (; i <= 32; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check special combinations of netblocks and addresses * on best search checking the returned userdata */ int SCRadixTestIPV4NetBlocksAndBestSearch19(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; void *user_data = NULL; tree = SCRadixCreateRadixTree(free, NULL); uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 100; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, 0); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } SCRadixNode *node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 100) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.0.0.0", &servaddr.sin_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 200; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, 8); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.168.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 200) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "178.168.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t*)user_data) != 100) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.168.0.0", &servaddr.sin_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 300; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, user, 12); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.168.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t*)user_data) != 300) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.167.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 300) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "177.178.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 200) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "197.178.1.15", &servaddr.sin_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 100) { result = 0; goto end; } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV6NetBlocksAndBestSearch20(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABAB:CDCD:ABAB:CDCD:1234:4321:1234:4321", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } for (; i <= 128; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV6NetBlocksAndBestSearch21(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ff00::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } for (; i <= 128; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV6NetBlocksAndBestSearch22(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ff00::192:168:1:1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } for (; i <= 128; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check that the best match search works for all the * possible netblocks of a fixed address */ int SCRadixTestIPV6NetBlocksAndBestSearch23(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); uint32_t i = 0; uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "FF00:ABCD:BCDA::ABCD", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } for (; i <= 128; i++) { user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = i; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, i); void *user_data = NULL; SCRadixNode *node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != i) { printf("User data == %"PRIu32"; i == %"PRIu32": ", *( (uint32_t *)user_data), i); result = 0; goto end; } } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test Check special combinations of netblocks and addresses * on best search checking the returned userdata */ int SCRadixTestIPV6NetBlocksAndBestSearch24(void) { SCRadixTree *tree = NULL; struct sockaddr_in6 servaddr; int result = 1; void *user_data = NULL; tree = SCRadixCreateRadixTree(free, NULL); uint32_t *user; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "::", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 100; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, 0); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } SCRadixNode *node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t*)user_data) != 100) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD::0", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 200; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, 8); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 200) { printf("User data == %"PRIu32"; i != 200 ", *( (uint32_t *)user_data)); result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "DCBA::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 100) { printf("User data == %"PRIu32"; != 100 ", *( (uint32_t *)user_data)); result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD:ABCD::0", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } user = SCMalloc(sizeof(uint32_t)); if (unlikely(user == NULL)) { result = 0; goto end; } *user = 300; SCRadixAddKeyIPV6Netblock((uint8_t *)&servaddr.sin6_addr, tree, user, 12); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD:ABCD::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 300) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABCD:AAAA::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 300) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "ABAB::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 200) { result = 0; goto end; } user_data = NULL; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET6, "CABD::1", &servaddr.sin6_addr) <= 0) { result = 0; goto end; } node = SCRadixFindKeyIPV6BestMatch((uint8_t *)&servaddr.sin6_addr, tree, &user_data); if (node == NULL) { printf("node == NULL: "); result = 0; goto end; } if (user_data == NULL) { printf("User data == NULL: "); result = 0; goto end; } if ( *( (uint32_t *)user_data) != 100) { result = 0; goto end; } end: SCRadixReleaseRadixTree(tree); return result; } /** * \test SCRadixTestIPV4NetblockInsertion15 insert a node searching on it. * Should always return true but the purposse of the test is to monitor * the memory usage to detect memleaks (there was one on searching) */ int SCRadixTestIPV4NetblockInsertion25(void) { SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; tree = SCRadixCreateRadixTree(free, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) return 0; SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, NULL, 16); /* test for the existance of a key */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.128.53", &servaddr.sin_addr) <= 0) return 0; result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree, NULL) != NULL); SCRadixReleaseRadixTree(tree); return result; } /** * \test SCRadixTestIPV4NetblockInsertion26 insert a node searching on it. * Should always return true but the purposse of the test is to monitor * the memory usage to detect memleaks (there was one on searching) */ int SCRadixTestIPV4NetblockInsertion26(void) { SCRadixNode *tmp = NULL; SCRadixTree *tree = NULL; struct sockaddr_in servaddr; int result = 1; char *str = SCStrdup("Hello1"); tree = SCRadixCreateRadixTree(free, NULL); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) return 0; tmp = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, str, 0); if (!tmp) { printf("Not inserted correctly 1:"); result = 0; goto this_end; } str = SCStrdup("Hello1"); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "176.0.0.1", &servaddr.sin_addr) <= 0) return 0; tmp = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, str, 5); if (!tmp) { printf("Not inserted correctly 2:"); result = 0; goto this_end; } str = SCStrdup("Hello1"); bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "0.0.0.0", &servaddr.sin_addr) <= 0) { SCFree(str); return 0; } tmp = SCRadixAddKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, tree, str, 7); if (!tmp) { printf("Not inserted correctly 3:"); result = 0; goto this_end; } /* test for the existance of a key */ //result &= (SCRadixFindKeyIPV4BestMatch((uint8_t *)&servaddr.sin_addr, tree) != NULL); this_end: SCRadixReleaseRadixTree(tree); //SCFree(str); return result; } #endif void SCRadixRegisterTests(void) { #ifdef UNITTESTS //UtRegisterTest("SCRadixTestInsertion01", SCRadixTestInsertion01, 1); //UtRegisterTest("SCRadixTestInsertion02", SCRadixTestInsertion02, 1); UtRegisterTest("SCRadixTestIPV4Insertion03", SCRadixTestIPV4Insertion03); UtRegisterTest("SCRadixTestIPV4Removal04", SCRadixTestIPV4Removal04); //UtRegisterTest("SCRadixTestCharacterInsertion05", // SCRadixTestCharacterInsertion05, 1); //UtRegisterTest("SCRadixTestCharacterRemoval06", // SCRadixTestCharacterRemoval06, 1); UtRegisterTest("SCRadixTestIPV6Insertion07", SCRadixTestIPV6Insertion07); UtRegisterTest("SCRadixTestIPV6Removal08", SCRadixTestIPV6Removal08); UtRegisterTest("SCRadixTestIPV4NetblockInsertion09", SCRadixTestIPV4NetblockInsertion09); UtRegisterTest("SCRadixTestIPV4NetblockInsertion10", SCRadixTestIPV4NetblockInsertion10); UtRegisterTest("SCRadixTestIPV4NetblockInsertion11", SCRadixTestIPV4NetblockInsertion11); UtRegisterTest("SCRadixTestIPV4NetblockInsertion12", SCRadixTestIPV4NetblockInsertion12); UtRegisterTest("SCRadixTestIPV6NetblockInsertion13", SCRadixTestIPV6NetblockInsertion13); UtRegisterTest("SCRadixTestIPV6NetblockInsertion14", SCRadixTestIPV6NetblockInsertion14); UtRegisterTest("SCRadixTestIPV4NetBlocksAndBestSearch15", SCRadixTestIPV4NetBlocksAndBestSearch15); UtRegisterTest("SCRadixTestIPV4NetBlocksAndBestSearch16", SCRadixTestIPV4NetBlocksAndBestSearch16); UtRegisterTest("SCRadixTestIPV4NetBlocksAndBestSearch17", SCRadixTestIPV4NetBlocksAndBestSearch17); UtRegisterTest("SCRadixTestIPV4NetBlocksAndBestSearch18", SCRadixTestIPV4NetBlocksAndBestSearch18); UtRegisterTest("SCRadixTestIPV4NetBlocksAndBestSearch19", SCRadixTestIPV4NetBlocksAndBestSearch19); UtRegisterTest("SCRadixTestIPV6NetBlocksAndBestSearch20", SCRadixTestIPV6NetBlocksAndBestSearch20); UtRegisterTest("SCRadixTestIPV6NetBlocksAndBestSearch21", SCRadixTestIPV6NetBlocksAndBestSearch21); UtRegisterTest("SCRadixTestIPV6NetBlocksAndBestSearch22", SCRadixTestIPV6NetBlocksAndBestSearch22); UtRegisterTest("SCRadixTestIPV6NetBlocksAndBestSearch23", SCRadixTestIPV6NetBlocksAndBestSearch23); UtRegisterTest("SCRadixTestIPV6NetBlocksAndBestSearch24", SCRadixTestIPV6NetBlocksAndBestSearch24); UtRegisterTest("SCRadixTestIPV4NetblockInsertion25", SCRadixTestIPV4NetblockInsertion25); UtRegisterTest("SCRadixTestIPV4NetblockInsertion26", SCRadixTestIPV4NetblockInsertion26); #endif return; } suricata-3.2.1/src/source-af-packet.c0000644000000000000000000021270113051004444014301 00000000000000/* Copyright (C) 2011-2017 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup afppacket AF_PACKET running mode * * @{ */ /** * \file * * \author Eric Leblond * * AF_PACKET socket acquisition support * * \todo watch other interface event to detect suppression of the monitored * interface */ #include "suricata-common.h" #include "config.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-modules.h" #include "tm-threads.h" #include "tm-threads-common.h" #include "conf.h" #include "util-debug.h" #include "util-device.h" #include "util-error.h" #include "util-privs.h" #include "util-optimize.h" #include "util-checksum.h" #include "util-ioctl.h" #include "util-host-info.h" #include "tmqh-packetpool.h" #include "source-af-packet.h" #include "runmodes.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda.h" #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #include "util-cuda-handlers.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ #ifdef HAVE_AF_PACKET #if HAVE_SYS_IOCTL_H #include #endif #if HAVE_LINUX_IF_ETHER_H #include #endif #if HAVE_LINUX_IF_PACKET_H #include #endif #if HAVE_LINUX_IF_ARP_H #include #endif #if HAVE_LINUX_FILTER_H #include #endif #if HAVE_SYS_MMAN_H #include #endif #ifdef HAVE_HW_TIMESTAMPING #include #endif #endif /* HAVE_AF_PACKET */ extern int max_pending_packets; #ifndef HAVE_AF_PACKET TmEcode NoAFPSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveAFPRegister (void) { tmm_modules[TMM_RECEIVEAFP].name = "ReceiveAFP"; tmm_modules[TMM_RECEIVEAFP].ThreadInit = NoAFPSupportExit; tmm_modules[TMM_RECEIVEAFP].Func = NULL; tmm_modules[TMM_RECEIVEAFP].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVEAFP].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEAFP].RegisterTests = NULL; tmm_modules[TMM_RECEIVEAFP].cap_flags = 0; tmm_modules[TMM_RECEIVEAFP].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for DecodeAFP. * \todo Unit tests are needed for this module. */ void TmModuleDecodeAFPRegister (void) { tmm_modules[TMM_DECODEAFP].name = "DecodeAFP"; tmm_modules[TMM_DECODEAFP].ThreadInit = NoAFPSupportExit; tmm_modules[TMM_DECODEAFP].Func = NULL; tmm_modules[TMM_DECODEAFP].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEAFP].ThreadDeinit = NULL; tmm_modules[TMM_DECODEAFP].RegisterTests = NULL; tmm_modules[TMM_DECODEAFP].cap_flags = 0; tmm_modules[TMM_DECODEAFP].flags = TM_FLAG_DECODE_TM; } /** * \brief this function prints an error message and exits. */ TmEcode NoAFPSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NO_AF_PACKET,"Error creating thread %s: you do not have " "support for AF_PACKET enabled, on Linux host please recompile " "with --enable-af-packet", tv->name); exit(EXIT_FAILURE); } #else /* We have AF_PACKET support */ #define AFP_IFACE_NAME_LENGTH 48 #define AFP_STATE_DOWN 0 #define AFP_STATE_UP 1 #define AFP_RECONNECT_TIMEOUT 500000 #define AFP_DOWN_COUNTER_INTERVAL 40 #define POLL_TIMEOUT 100 #ifndef TP_STATUS_USER_BUSY /* for new use latest bit available in tp_status */ #define TP_STATUS_USER_BUSY (1 << 31) #endif #ifndef TP_STATUS_VLAN_VALID #define TP_STATUS_VLAN_VALID (1 << 4) #endif /** protect pfring_set_bpf_filter, as it is not thread safe */ static SCMutex afpacket_bpf_set_filter_lock = SCMUTEX_INITIALIZER; enum { AFP_READ_OK, AFP_READ_FAILURE, AFP_FAILURE, AFP_KERNEL_DROP, }; enum { AFP_FATAL_ERROR = 1, AFP_RECOVERABLE_ERROR, }; union thdr { struct tpacket2_hdr *h2; #ifdef HAVE_TPACKET_V3 struct tpacket3_hdr *h3; #endif void *raw; }; /** * \brief Structure to hold thread specific variables. */ typedef struct AFPThreadVars_ { union { char *ring_v2; struct iovec *ring_v3; }; /* counters */ uint64_t pkts; ThreadVars *tv; TmSlot *slot; LiveDevice *livedev; /* data link type for the thread */ uint32_t datalink; unsigned int frame_offset; ChecksumValidationMode checksum_mode; /* references to packet and drop counters */ uint16_t capture_kernel_packets; uint16_t capture_kernel_drops; /* handle state */ uint8_t afp_state; uint8_t copy_mode; uint8_t flags; /* IPS peer */ AFPPeer *mpeer; /* no mmap mode */ uint8_t *data; /** Per function and thread data */ int datalen; /** Length of per function and thread data */ int cooked; /* * Init related members */ /* thread specific socket */ int socket; int ring_size; int block_size; int block_timeout; /* socket buffer size */ int buffer_size; /* Filter */ char *bpf_filter; int promisc; int down_count; int cluster_id; int cluster_type; int threads; union { struct tpacket_req req; #ifdef HAVE_TPACKET_V3 struct tpacket_req3 req3; #endif }; char iface[AFP_IFACE_NAME_LENGTH]; /* IPS output iface */ char out_iface[AFP_IFACE_NAME_LENGTH]; } AFPThreadVars; TmEcode ReceiveAFP(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode ReceiveAFPThreadInit(ThreadVars *, void *, void **); void ReceiveAFPThreadExitStats(ThreadVars *, void *); TmEcode ReceiveAFPThreadDeinit(ThreadVars *, void *); TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot); TmEcode DecodeAFPThreadInit(ThreadVars *, void *, void **); TmEcode DecodeAFPThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeAFP(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode AFPSetBPFFilter(AFPThreadVars *ptv); static int AFPGetIfnumByDev(int fd, const char *ifname, int verbose); static int AFPGetDevFlags(int fd, const char *ifname); static int AFPDerefSocket(AFPPeer* peer); static int AFPRefSocket(AFPPeer* peer); /** * \brief Registration Function for RecieveAFP. * \todo Unit tests are needed for this module. */ void TmModuleReceiveAFPRegister (void) { tmm_modules[TMM_RECEIVEAFP].name = "ReceiveAFP"; tmm_modules[TMM_RECEIVEAFP].ThreadInit = ReceiveAFPThreadInit; tmm_modules[TMM_RECEIVEAFP].Func = NULL; tmm_modules[TMM_RECEIVEAFP].PktAcqLoop = ReceiveAFPLoop; tmm_modules[TMM_RECEIVEAFP].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEAFP].ThreadExitPrintStats = ReceiveAFPThreadExitStats; tmm_modules[TMM_RECEIVEAFP].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEAFP].RegisterTests = NULL; tmm_modules[TMM_RECEIVEAFP].cap_flags = SC_CAP_NET_RAW; tmm_modules[TMM_RECEIVEAFP].flags = TM_FLAG_RECEIVE_TM; } /** * \defgroup afppeers AFP peers list * * AF_PACKET has an IPS mode were interface are peered: packet from * on interface are sent the peered interface and the other way. The ::AFPPeer * list is maitaining the list of peers. Each ::AFPPeer is storing the needed * information to be able to send packet on the interface. * A element of the list must not be destroyed during the run of Suricata as it * is used by ::Packet and other threads. * * @{ */ typedef struct AFPPeersList_ { TAILQ_HEAD(, AFPPeer_) peers; /**< Head of list of fragments. */ int cnt; int peered; int turn; /**< Next value for initialisation order */ SC_ATOMIC_DECLARE(int, reached); /**< Counter used to synchronize start */ } AFPPeersList; /** * \brief Update the peer. * * Update the AFPPeer of a thread ie set new state, socket number * or iface index. * */ void AFPPeerUpdate(AFPThreadVars *ptv) { if (ptv->mpeer == NULL) { return; } (void)SC_ATOMIC_SET(ptv->mpeer->if_idx, AFPGetIfnumByDev(ptv->socket, ptv->iface, 0)); (void)SC_ATOMIC_SET(ptv->mpeer->socket, ptv->socket); (void)SC_ATOMIC_SET(ptv->mpeer->state, ptv->afp_state); } /** * \brief Clean and free ressource used by an ::AFPPeer */ void AFPPeerClean(AFPPeer *peer) { if (peer->flags & AFP_SOCK_PROTECT) SCMutexDestroy(&peer->sock_protect); SC_ATOMIC_DESTROY(peer->socket); SC_ATOMIC_DESTROY(peer->if_idx); SC_ATOMIC_DESTROY(peer->state); SCFree(peer); } AFPPeersList peerslist; /** * \brief Init the global list of ::AFPPeer */ TmEcode AFPPeersListInit() { SCEnter(); TAILQ_INIT(&peerslist.peers); peerslist.peered = 0; peerslist.cnt = 0; peerslist.turn = 0; SC_ATOMIC_INIT(peerslist.reached); (void) SC_ATOMIC_SET(peerslist.reached, 0); SCReturnInt(TM_ECODE_OK); } /** * \brief Check that all ::AFPPeer got a peer * * \retval TM_ECODE_FAILED if some threads are not peered or TM_ECODE_OK else. */ TmEcode AFPPeersListCheck() { #define AFP_PEERS_MAX_TRY 4 #define AFP_PEERS_WAIT 20000 int try = 0; SCEnter(); while (try < AFP_PEERS_MAX_TRY) { if (peerslist.cnt != peerslist.peered) { usleep(AFP_PEERS_WAIT); } else { SCReturnInt(TM_ECODE_OK); } try++; } SCLogError(SC_ERR_AFP_CREATE, "Threads number not equals"); SCReturnInt(TM_ECODE_FAILED); } /** * \brief Declare a new AFP thread to AFP peers list. */ TmEcode AFPPeersListAdd(AFPThreadVars *ptv) { SCEnter(); AFPPeer *peer = SCMalloc(sizeof(AFPPeer)); AFPPeer *pitem; int mtu, out_mtu; if (unlikely(peer == NULL)) { SCReturnInt(TM_ECODE_FAILED); } memset(peer, 0, sizeof(AFPPeer)); SC_ATOMIC_INIT(peer->socket); SC_ATOMIC_INIT(peer->sock_usage); SC_ATOMIC_INIT(peer->if_idx); SC_ATOMIC_INIT(peer->state); peer->flags = ptv->flags; peer->turn = peerslist.turn++; if (peer->flags & AFP_SOCK_PROTECT) { SCMutexInit(&peer->sock_protect, NULL); } (void)SC_ATOMIC_SET(peer->sock_usage, 0); (void)SC_ATOMIC_SET(peer->state, AFP_STATE_DOWN); strlcpy(peer->iface, ptv->iface, AFP_IFACE_NAME_LENGTH); ptv->mpeer = peer; /* add element to iface list */ TAILQ_INSERT_TAIL(&peerslist.peers, peer, next); if (ptv->copy_mode != AFP_COPY_MODE_NONE) { peerslist.cnt++; /* Iter to find a peer */ TAILQ_FOREACH(pitem, &peerslist.peers, next) { if (pitem->peer) continue; if (strcmp(pitem->iface, ptv->out_iface)) continue; peer->peer = pitem; pitem->peer = peer; mtu = GetIfaceMTU(ptv->iface); out_mtu = GetIfaceMTU(ptv->out_iface); if (mtu != out_mtu) { SCLogError(SC_ERR_AFP_CREATE, "MTU on %s (%d) and %s (%d) are not equal, " "transmission of packets bigger than %d will fail.", ptv->iface, mtu, ptv->out_iface, out_mtu, (out_mtu > mtu) ? mtu : out_mtu); } peerslist.peered += 2; break; } } AFPPeerUpdate(ptv); SCReturnInt(TM_ECODE_OK); } int AFPPeersListWaitTurn(AFPPeer *peer) { /* If turn is zero, we already have started threads once */ if (peerslist.turn == 0) return 0; if (peer->turn == SC_ATOMIC_GET(peerslist.reached)) return 0; return 1; } void AFPPeersListReachedInc() { if (peerslist.turn == 0) return; if (SC_ATOMIC_ADD(peerslist.reached, 1) == peerslist.turn) { SCLogInfo("All AFP capture threads are running."); (void)SC_ATOMIC_SET(peerslist.reached, 0); /* Set turn to 0 to skip syncrhonization when ReceiveAFPLoop is * restarted. */ peerslist.turn = 0; } } static int AFPPeersListStarted() { return !peerslist.turn; } /** * \brief Clean the global peers list. */ void AFPPeersListClean() { AFPPeer *pitem; while ((pitem = TAILQ_FIRST(&peerslist.peers))) { TAILQ_REMOVE(&peerslist.peers, pitem, next); AFPPeerClean(pitem); } } /** * @} */ /** * \brief Registration Function for DecodeAFP. * \todo Unit tests are needed for this module. */ void TmModuleDecodeAFPRegister (void) { tmm_modules[TMM_DECODEAFP].name = "DecodeAFP"; tmm_modules[TMM_DECODEAFP].ThreadInit = DecodeAFPThreadInit; tmm_modules[TMM_DECODEAFP].Func = DecodeAFP; tmm_modules[TMM_DECODEAFP].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEAFP].ThreadDeinit = DecodeAFPThreadDeinit; tmm_modules[TMM_DECODEAFP].RegisterTests = NULL; tmm_modules[TMM_DECODEAFP].cap_flags = 0; tmm_modules[TMM_DECODEAFP].flags = TM_FLAG_DECODE_TM; } static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose); static inline void AFPDumpCounters(AFPThreadVars *ptv) { #ifdef PACKET_STATISTICS struct tpacket_stats kstats; socklen_t len = sizeof (struct tpacket_stats); if (getsockopt(ptv->socket, SOL_PACKET, PACKET_STATISTICS, &kstats, &len) > -1) { SCLogDebug("(%s) Kernel: Packets %" PRIu32 ", dropped %" PRIu32 "", ptv->tv->name, kstats.tp_packets, kstats.tp_drops); StatsAddUI64(ptv->tv, ptv->capture_kernel_packets, kstats.tp_packets); StatsAddUI64(ptv->tv, ptv->capture_kernel_drops, kstats.tp_drops); (void) SC_ATOMIC_ADD(ptv->livedev->drop, (uint64_t) kstats.tp_drops); (void) SC_ATOMIC_ADD(ptv->livedev->pkts, (uint64_t) kstats.tp_packets); } #endif } /** * \brief AF packet read function. * * This function fills * From here the packets are picked up by the DecodeAFP thread. * * \param user pointer to AFPThreadVars * \retval TM_ECODE_FAILED on failure and TM_ECODE_OK on success */ int AFPRead(AFPThreadVars *ptv) { Packet *p = NULL; /* XXX should try to use read that get directly to packet */ int offset = 0; int caplen; struct sockaddr_ll from; struct iovec iov; struct msghdr msg; struct cmsghdr *cmsg; union { struct cmsghdr cmsg; char buf[CMSG_SPACE(sizeof(struct tpacket_auxdata))]; } cmsg_buf; unsigned char aux_checksum = 0; msg.msg_name = &from; msg.msg_namelen = sizeof(from); msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_control = &cmsg_buf; msg.msg_controllen = sizeof(cmsg_buf); msg.msg_flags = 0; if (ptv->cooked) offset = SLL_HEADER_LEN; else offset = 0; iov.iov_len = ptv->datalen - offset; iov.iov_base = ptv->data + offset; caplen = recvmsg(ptv->socket, &msg, MSG_TRUNC); if (caplen < 0) { SCLogWarning(SC_ERR_AFP_READ, "recvmsg failed with error code %" PRId32, errno); SCReturnInt(AFP_READ_FAILURE); } p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnInt(AFP_FAILURE); } PKT_SET_SRC(p, PKT_SRC_WIRE); /* get timestamp of packet via ioctl */ if (ioctl(ptv->socket, SIOCGSTAMP, &p->ts) == -1) { SCLogWarning(SC_ERR_AFP_READ, "recvmsg failed with error code %" PRId32, errno); TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_READ_FAILURE); } ptv->pkts++; p->livedev = ptv->livedev; /* add forged header */ if (ptv->cooked) { SllHdr * hdrp = (SllHdr *)ptv->data; /* XXX this is minimalist, but this seems enough */ hdrp->sll_protocol = from.sll_protocol; } p->datalink = ptv->datalink; SET_PKT_LEN(p, caplen + offset); if (PacketCopyData(p, ptv->data, GET_PKT_LEN(p)) == -1) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); /* We only check for checksum disable */ if (ptv->checksum_mode == CHECKSUM_VALIDATION_DISABLE) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ptv->checksum_mode == CHECKSUM_VALIDATION_AUTO) { if (ptv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ptv->pkts, SC_ATOMIC_GET(ptv->livedev->pkts), SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) { ptv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } } else { aux_checksum = 1; } /* List is NULL if we don't have activated auxiliary data */ for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) { struct tpacket_auxdata *aux; if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct tpacket_auxdata)) || cmsg->cmsg_level != SOL_PACKET || cmsg->cmsg_type != PACKET_AUXDATA) continue; aux = (struct tpacket_auxdata *)CMSG_DATA(cmsg); if (aux_checksum && (aux->tp_status & TP_STATUS_CSUMNOTREADY)) { p->flags |= PKT_IGNORE_CHECKSUM; } break; } if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } SCReturnInt(AFP_READ_OK); } /** * \brief AF packet write function. * * This function has to be called before the memory * related to Packet in ring buffer is released. * * \param pointer to Packet * \param version of capture: TPACKET_V2 or TPACKET_V3 * \retval TM_ECODE_FAILED on failure and TM_ECODE_OK on success * */ static TmEcode AFPWritePacket(Packet *p, int version) { struct sockaddr_ll socket_address; int socket; uint8_t *pstart; size_t plen; if (p->afp_v.copy_mode == AFP_COPY_MODE_IPS) { if (PACKET_TEST_ACTION(p, ACTION_DROP)) { return TM_ECODE_OK; } } if (SC_ATOMIC_GET(p->afp_v.peer->state) == AFP_STATE_DOWN) return TM_ECODE_OK; if (p->ethh == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "Should have an Ethernet header"); return TM_ECODE_FAILED; } /* Index of the network device */ socket_address.sll_ifindex = SC_ATOMIC_GET(p->afp_v.peer->if_idx); /* Address length*/ socket_address.sll_halen = ETH_ALEN; /* Destination MAC */ memcpy(socket_address.sll_addr, p->ethh, 6); /* Send packet, locking the socket if necessary */ if (p->afp_v.peer->flags & AFP_SOCK_PROTECT) SCMutexLock(&p->afp_v.peer->sock_protect); socket = SC_ATOMIC_GET(p->afp_v.peer->socket); if (version == TPACKET_V2) { union thdr h; h.raw = p->afp_v.relptr; /* Copy VLAN header from ring memory. For post june 2011 kernel we test * the flag. It is not defined for older kernel so we go best effort * and test for non zero value of the TCI header. */ if (h.h2->tp_status & TP_STATUS_VLAN_VALID || h.h2->tp_vlan_tci) { pstart = GET_PKT_DATA(p) - VLAN_HEADER_LEN; plen = GET_PKT_LEN(p) + VLAN_HEADER_LEN; /* move ethernet addresses */ memmove(pstart, GET_PKT_DATA(p), 2 * ETH_ALEN); /* write vlan info */ *(uint16_t *)(pstart + 2 * ETH_ALEN) = htons(0x8100); *(uint16_t *)(pstart + 2 * ETH_ALEN + 2) = htons(h.h2->tp_vlan_tci); } else { pstart = GET_PKT_DATA(p); plen = GET_PKT_LEN(p); } } else { pstart = GET_PKT_DATA(p); plen = GET_PKT_LEN(p); } if (sendto(socket, pstart, plen, 0, (struct sockaddr*) &socket_address, sizeof(struct sockaddr_ll)) < 0) { SCLogWarning(SC_ERR_SOCKET, "Sending packet failed on socket %d: %s", socket, strerror(errno)); if (p->afp_v.peer->flags & AFP_SOCK_PROTECT) SCMutexUnlock(&p->afp_v.peer->sock_protect); return TM_ECODE_FAILED; } if (p->afp_v.peer->flags & AFP_SOCK_PROTECT) SCMutexUnlock(&p->afp_v.peer->sock_protect); return TM_ECODE_OK; } void AFPReleaseDataFromRing(Packet *p) { /* Need to be in copy mode and need to detect early release where Ethernet header could not be set (and pseudo packet) */ if ((p->afp_v.copy_mode != AFP_COPY_MODE_NONE) && !PKT_IS_PSEUDOPKT(p)) { AFPWritePacket(p, TPACKET_V2); } if (AFPDerefSocket(p->afp_v.mpeer) == 0) goto cleanup; if (p->afp_v.relptr) { union thdr h; h.raw = p->afp_v.relptr; h.h2->tp_status = TP_STATUS_KERNEL; } cleanup: AFPV_CLEANUP(&p->afp_v); } #ifdef HAVE_TPACKET_V3 void AFPReleasePacketV3(Packet *p) { /* Need to be in copy mode and need to detect early release where Ethernet header could not be set (and pseudo packet) */ if ((p->afp_v.copy_mode != AFP_COPY_MODE_NONE) && !PKT_IS_PSEUDOPKT(p)) { AFPWritePacket(p, TPACKET_V3); } PacketFreeOrRelease(p); } #endif void AFPReleasePacket(Packet *p) { AFPReleaseDataFromRing(p); PacketFreeOrRelease(p); } /** * \brief AF packet read function for ring * * This function fills * From here the packets are picked up by the DecodeAFP thread. * * \param user pointer to AFPThreadVars * \retval TM_ECODE_FAILED on failure and TM_ECODE_OK on success */ int AFPReadFromRing(AFPThreadVars *ptv) { Packet *p = NULL; union thdr h; uint8_t emergency_flush = 0; int read_pkts = 0; int loop_start = -1; /* Loop till we have packets available */ while (1) { if (unlikely(suricata_ctl_flags != 0)) { break; } /* Read packet from ring */ h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]); if (h.raw == NULL) { SCReturnInt(AFP_FAILURE); } if ((! h.h2->tp_status) || (h.h2->tp_status & TP_STATUS_USER_BUSY)) { if (read_pkts == 0) { if (loop_start == -1) { loop_start = ptv->frame_offset; } else if (unlikely(loop_start == (int)ptv->frame_offset)) { SCReturnInt(AFP_READ_OK); } if (++ptv->frame_offset >= ptv->req.tp_frame_nr) { ptv->frame_offset = 0; } continue; } if ((emergency_flush) && (ptv->flags & AFP_EMERGENCY_MODE)) { SCReturnInt(AFP_KERNEL_DROP); } else { SCReturnInt(AFP_READ_OK); } } read_pkts++; loop_start = -1; /* Our packet is still used by suricata, we exit read loop to * gain some time */ if (h.h2->tp_status & TP_STATUS_USER_BUSY) { SCReturnInt(AFP_READ_OK); } if ((ptv->flags & AFP_EMERGENCY_MODE) && (emergency_flush == 1)) { h.h2->tp_status = TP_STATUS_KERNEL; goto next_frame; } p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnInt(AFP_FAILURE); } PKT_SET_SRC(p, PKT_SRC_WIRE); /* Suricata will treat packet so telling it is busy, this * status will be reset to 0 (ie TP_STATUS_KERNEL) in the release * function. */ h.h2->tp_status |= TP_STATUS_USER_BUSY; ptv->pkts++; p->livedev = ptv->livedev; p->datalink = ptv->datalink; if (h.h2->tp_len > h.h2->tp_snaplen) { SCLogDebug("Packet length (%d) > snaplen (%d), truncating", h.h2->tp_len, h.h2->tp_snaplen); } /* get vlan id from header */ if ((!(ptv->flags & AFP_VLAN_DISABLED)) && (h.h2->tp_status & TP_STATUS_VLAN_VALID || h.h2->tp_vlan_tci)) { p->vlan_id[0] = h.h2->tp_vlan_tci & 0x0fff; p->vlan_idx = 1; p->vlanh[0] = NULL; } if (ptv->flags & AFP_ZERO_COPY) { if (PacketSetData(p, (unsigned char*)h.raw + h.h2->tp_mac, h.h2->tp_snaplen) == -1) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } else { p->afp_v.relptr = h.raw; p->ReleasePacket = AFPReleasePacket; p->afp_v.mpeer = ptv->mpeer; AFPRefSocket(ptv->mpeer); p->afp_v.copy_mode = ptv->copy_mode; if (p->afp_v.copy_mode != AFP_COPY_MODE_NONE) { p->afp_v.peer = ptv->mpeer->peer; } else { p->afp_v.peer = NULL; } } } else { if (PacketCopyData(p, (unsigned char*)h.raw + h.h2->tp_mac, h.h2->tp_snaplen) == -1) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } } /* Timestamp */ p->ts.tv_sec = h.h2->tp_sec; p->ts.tv_usec = h.h2->tp_nsec/1000; SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); /* We only check for checksum disable */ if (ptv->checksum_mode == CHECKSUM_VALIDATION_DISABLE) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ptv->checksum_mode == CHECKSUM_VALIDATION_AUTO) { if (ptv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ptv->pkts, SC_ATOMIC_GET(ptv->livedev->pkts), SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) { ptv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } } else { if (h.h2->tp_status & TP_STATUS_CSUMNOTREADY) { p->flags |= PKT_IGNORE_CHECKSUM; } } if (h.h2->tp_status & TP_STATUS_LOSING) { emergency_flush = 1; AFPDumpCounters(ptv); } /* release frame if not in zero copy mode */ if (!(ptv->flags & AFP_ZERO_COPY)) { h.h2->tp_status = TP_STATUS_KERNEL; } if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { h.h2->tp_status = TP_STATUS_KERNEL; if (++ptv->frame_offset >= ptv->req.tp_frame_nr) { ptv->frame_offset = 0; } TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } next_frame: if (++ptv->frame_offset >= ptv->req.tp_frame_nr) { ptv->frame_offset = 0; /* Get out of loop to be sure we will reach maintenance tasks */ SCReturnInt(AFP_READ_OK); } } SCReturnInt(AFP_READ_OK); } #ifdef HAVE_TPACKET_V3 static inline void AFPFlushBlock(struct tpacket_block_desc *pbd) { pbd->hdr.bh1.block_status = TP_STATUS_KERNEL; } static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc *pbd, struct tpacket3_hdr *ppd) { Packet *p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnInt(AFP_FAILURE); } PKT_SET_SRC(p, PKT_SRC_WIRE); ptv->pkts++; p->livedev = ptv->livedev; p->datalink = ptv->datalink; if (ptv->flags & AFP_ZERO_COPY) { if (PacketSetData(p, (unsigned char*)ppd + ppd->tp_mac, ppd->tp_snaplen) == -1) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } p->afp_v.relptr = pbd; p->ReleasePacket = AFPReleasePacketV3; p->afp_v.mpeer = ptv->mpeer; AFPRefSocket(ptv->mpeer); p->afp_v.copy_mode = ptv->copy_mode; if (p->afp_v.copy_mode != AFP_COPY_MODE_NONE) { p->afp_v.peer = ptv->mpeer->peer; } else { p->afp_v.peer = NULL; } } else { if (PacketCopyData(p, (unsigned char*)ppd + ppd->tp_mac, ppd->tp_snaplen) == -1) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } } /* Timestamp */ p->ts.tv_sec = ppd->tp_sec; p->ts.tv_usec = ppd->tp_nsec/1000; SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); /* We only check for checksum disable */ if (ptv->checksum_mode == CHECKSUM_VALIDATION_DISABLE) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ptv->checksum_mode == CHECKSUM_VALIDATION_AUTO) { if (ptv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ptv->pkts, SC_ATOMIC_GET(ptv->livedev->pkts), SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) { ptv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } } else { if (ppd->tp_status & TP_STATUS_CSUMNOTREADY) { p->flags |= PKT_IGNORE_CHECKSUM; } } if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(AFP_FAILURE); } SCReturnInt(AFP_READ_OK); } static inline int AFPWalkBlock(AFPThreadVars *ptv, struct tpacket_block_desc *pbd) { int num_pkts = pbd->hdr.bh1.num_pkts, i; uint8_t *ppd; ppd = (uint8_t *)pbd + pbd->hdr.bh1.offset_to_first_pkt; for (i = 0; i < num_pkts; ++i) { if (unlikely(AFPParsePacketV3(ptv, pbd, (struct tpacket3_hdr *)ppd) == AFP_FAILURE)) { SCReturnInt(AFP_READ_FAILURE); } ppd = ppd + ((struct tpacket3_hdr *)ppd)->tp_next_offset; } SCReturnInt(AFP_READ_OK); } #endif /* HAVE_TPACKET_V3 */ /** * \brief AF packet read function for ring * * This function fills * From here the packets are picked up by the DecodeAFP thread. * * \param user pointer to AFPThreadVars * \retval TM_ECODE_FAILED on failure and TM_ECODE_OK on success */ int AFPReadFromRingV3(AFPThreadVars *ptv) { #ifdef HAVE_TPACKET_V3 struct tpacket_block_desc *pbd; /* Loop till we have packets available */ while (1) { if (unlikely(suricata_ctl_flags != 0)) { SCLogInfo("Exiting AFP V3 read loop"); break; } pbd = (struct tpacket_block_desc *) ptv->ring_v3[ptv->frame_offset].iov_base; /* block is not ready to be read */ if ((pbd->hdr.bh1.block_status & TP_STATUS_USER) == 0) { SCReturnInt(AFP_READ_OK); } if (unlikely(AFPWalkBlock(ptv, pbd) != AFP_READ_OK)) { AFPFlushBlock(pbd); SCReturnInt(AFP_READ_FAILURE); } AFPFlushBlock(pbd); ptv->frame_offset = (ptv->frame_offset + 1) % ptv->req3.tp_block_nr; /* return to maintenance task after one loop on the ring */ if (ptv->frame_offset == 0) { SCReturnInt(AFP_READ_OK); } } #endif SCReturnInt(AFP_READ_OK); } /** * \brief Reference socket * * \retval O in case of failure, 1 in case of success */ static int AFPRefSocket(AFPPeer* peer) { if (unlikely(peer == NULL)) return 0; (void)SC_ATOMIC_ADD(peer->sock_usage, 1); return 1; } /** * \brief Dereference socket * * \retval 1 if socket is still alive, 0 if not */ static int AFPDerefSocket(AFPPeer* peer) { if (peer == NULL) return 1; if (SC_ATOMIC_SUB(peer->sock_usage, 1) == 0) { if (SC_ATOMIC_GET(peer->state) == AFP_STATE_DOWN) { SCLogInfo("Cleaning socket connected to '%s'", peer->iface); close(SC_ATOMIC_GET(peer->socket)); return 0; } } return 1; } void AFPSwitchState(AFPThreadVars *ptv, int state) { ptv->afp_state = state; ptv->down_count = 0; AFPPeerUpdate(ptv); /* Do cleaning if switching to down state */ if (state == AFP_STATE_DOWN) { #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { if (!ptv->ring_v3) { SCFree(ptv->ring_v3); ptv->ring_v3 = NULL; } } else { #endif if (ptv->ring_v2) { /* only used in reading phase, we can free it */ SCFree(ptv->ring_v2); ptv->ring_v2 = NULL; } #ifdef HAVE_TPACKET_V3 } #endif if (ptv->socket != -1) { /* we need to wait for all packets to return data */ if (SC_ATOMIC_SUB(ptv->mpeer->sock_usage, 1) == 0) { SCLogInfo("Cleaning socket connected to '%s'", ptv->iface); close(ptv->socket); ptv->socket = -1; } } } if (state == AFP_STATE_UP) { (void)SC_ATOMIC_SET(ptv->mpeer->sock_usage, 1); } } static int AFPReadAndDiscard(AFPThreadVars *ptv, struct timeval *synctv, uint64_t *discarded_pkts) { struct sockaddr_ll from; struct iovec iov; struct msghdr msg; struct timeval ts; union { struct cmsghdr cmsg; char buf[CMSG_SPACE(sizeof(struct tpacket_auxdata))]; } cmsg_buf; if (unlikely(suricata_ctl_flags != 0)) { return 1; } msg.msg_name = &from; msg.msg_namelen = sizeof(from); msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_control = &cmsg_buf; msg.msg_controllen = sizeof(cmsg_buf); msg.msg_flags = 0; iov.iov_len = ptv->datalen; iov.iov_base = ptv->data; (void)recvmsg(ptv->socket, &msg, MSG_TRUNC); if (ioctl(ptv->socket, SIOCGSTAMP, &ts) == -1) { /* FIXME */ return -1; } if ((ts.tv_sec > synctv->tv_sec) || (ts.tv_sec >= synctv->tv_sec && ts.tv_usec > synctv->tv_usec)) { return 1; } return 0; } static int AFPReadAndDiscardFromRing(AFPThreadVars *ptv, struct timeval *synctv, uint64_t *discarded_pkts) { union thdr h; if (unlikely(suricata_ctl_flags != 0)) { return 1; } #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { struct tpacket_block_desc *pbd; pbd = (struct tpacket_block_desc *) ptv->ring_v3[ptv->frame_offset].iov_base; *discarded_pkts += pbd->hdr.bh1.num_pkts; AFPFlushBlock(pbd); ptv->frame_offset = (ptv->frame_offset + 1) % ptv->req3.tp_block_nr; return 1; } else #endif { /* Read packet from ring */ h.raw = (((union thdr **)ptv->ring_v2)[ptv->frame_offset]); if (h.raw == NULL) { return -1; } (*discarded_pkts)++; if (((time_t)h.h2->tp_sec > synctv->tv_sec) || ((time_t)h.h2->tp_sec == synctv->tv_sec && (suseconds_t) (h.h2->tp_nsec / 1000) > synctv->tv_usec)) { return 1; } h.h2->tp_status = TP_STATUS_KERNEL; if (++ptv->frame_offset >= ptv->req.tp_frame_nr) { ptv->frame_offset = 0; } } return 0; } /** \brief wait for all afpacket threads to fully init * * Discard packets before all threads are ready, as the cluster * setup is not complete yet. * * if AFPPeersListStarted() returns true init is complete * * \retval r 1 = happy, otherwise unhappy */ static int AFPSynchronizeStart(AFPThreadVars *ptv, uint64_t *discarded_pkts) { int r; struct timeval synctv; struct pollfd fds; fds.fd = ptv->socket; fds.events = POLLIN; /* Set timeval to end of the world */ synctv.tv_sec = 0xffffffff; synctv.tv_usec = 0xffffffff; while (1) { r = poll(&fds, 1, POLL_TIMEOUT); if (r > 0 && (fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) { SCLogWarning(SC_ERR_AFP_READ, "poll failed %02x", fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL)); return 0; } else if (r > 0) { if (AFPPeersListStarted() && synctv.tv_sec == (time_t) 0xffffffff) { gettimeofday(&synctv, NULL); } if (ptv->flags & AFP_RING_MODE) { r = AFPReadAndDiscardFromRing(ptv, &synctv, discarded_pkts); } else { r = AFPReadAndDiscard(ptv, &synctv, discarded_pkts); } SCLogDebug("Discarding on %s", ptv->tv->name); switch (r) { case 1: SCLogDebug("Starting to read on %s", ptv->tv->name); return 1; case -1: return r; } /* no packets */ } else if (r == 0 && AFPPeersListStarted()) { SCLogDebug("Starting to read on %s", ptv->tv->name); return 1; } else if (r < 0) { /* only exit on error */ SCLogWarning(SC_ERR_AFP_READ, "poll failed with retval %d", r); return 0; } } return 1; } /** * \brief Try to reopen socket * * \retval 0 in case of success, negative if error occurs or a condition * is not met. */ static int AFPTryReopen(AFPThreadVars *ptv) { int afp_activate_r; ptv->down_count++; /* Don't reconnect till we have packet that did not release data */ if (SC_ATOMIC_GET(ptv->mpeer->sock_usage) != 0) { return -1; } afp_activate_r = AFPCreateSocket(ptv, ptv->iface, 0); if (afp_activate_r != 0) { if (ptv->down_count % AFP_DOWN_COUNTER_INTERVAL == 0) { SCLogWarning(SC_ERR_AFP_CREATE, "Can not open iface '%s'", ptv->iface); } return afp_activate_r; } SCLogInfo("Interface '%s' is back", ptv->iface); return 0; } /** * \brief Main AF_PACKET reading Loop function */ TmEcode ReceiveAFPLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); AFPThreadVars *ptv = (AFPThreadVars *)data; struct pollfd fds; int r; TmSlot *s = (TmSlot *)slot; time_t last_dump = 0; time_t current_time; int (*AFPReadFunc) (AFPThreadVars *); uint64_t discarded_pkts = 0; ptv->slot = s->slot_next; if (ptv->flags & AFP_RING_MODE) { if (ptv->flags & AFP_TPACKET_V3) { AFPReadFunc = AFPReadFromRingV3; } else { AFPReadFunc = AFPReadFromRing; } } else { AFPReadFunc = AFPRead; } if (ptv->afp_state == AFP_STATE_DOWN) { /* Wait for our turn, threads before us must have opened the socket */ while (AFPPeersListWaitTurn(ptv->mpeer)) { usleep(1000); if (suricata_ctl_flags != 0) { break; } } r = AFPCreateSocket(ptv, ptv->iface, 1); if (r < 0) { switch (-r) { case AFP_FATAL_ERROR: SCLogError(SC_ERR_AFP_CREATE, "Couldn't init AF_PACKET socket, fatal error"); SCReturnInt(TM_ECODE_FAILED); case AFP_RECOVERABLE_ERROR: SCLogWarning(SC_ERR_AFP_CREATE, "Couldn't init AF_PACKET socket, retrying soon"); } } AFPPeersListReachedInc(); } if (ptv->afp_state == AFP_STATE_UP) { SCLogDebug("Thread %s using socket %d", tv->name, ptv->socket); if ((ptv->flags & AFP_TPACKET_V3) != 0) { AFPSynchronizeStart(ptv, &discarded_pkts); } /* let's reset counter as we will start the capture at the * next function call */ #ifdef PACKET_STATISTICS struct tpacket_stats kstats; socklen_t len = sizeof (struct tpacket_stats); if (getsockopt(ptv->socket, SOL_PACKET, PACKET_STATISTICS, &kstats, &len) > -1) { uint64_t pkts = 0; SCLogDebug("(%s) Kernel socket startup: Packets %" PRIu32 ", dropped %" PRIu32 "", ptv->tv->name, kstats.tp_packets, kstats.tp_drops); pkts = kstats.tp_packets - discarded_pkts - kstats.tp_drops; StatsAddUI64(ptv->tv, ptv->capture_kernel_packets, pkts); (void) SC_ATOMIC_ADD(ptv->livedev->pkts, pkts); } #endif } fds.fd = ptv->socket; fds.events = POLLIN; while (1) { /* Start by checking the state of our interface */ if (unlikely(ptv->afp_state == AFP_STATE_DOWN)) { int dbreak = 0; do { usleep(AFP_RECONNECT_TIMEOUT); if (suricata_ctl_flags != 0) { dbreak = 1; break; } r = AFPTryReopen(ptv); fds.fd = ptv->socket; } while (r < 0); if (dbreak == 1) break; } /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); r = poll(&fds, 1, POLL_TIMEOUT); if (suricata_ctl_flags != 0) { break; } if (r > 0 && (fds.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) { if (fds.revents & (POLLHUP | POLLRDHUP)) { AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } else if (fds.revents & POLLERR) { char c; /* Do a recv to get errno */ if (recv(ptv->socket, &c, sizeof c, MSG_PEEK) != -1) continue; /* what, no error? */ SCLogError(SC_ERR_AFP_READ, "Error reading data from iface '%s': (%d" PRIu32 ") %s", ptv->iface, errno, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } else if (fds.revents & POLLNVAL) { SCLogError(SC_ERR_AFP_READ, "Invalid polling request"); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } } else if (r > 0) { r = AFPReadFunc(ptv); switch (r) { case AFP_READ_OK: /* Trigger one dump of stats every second */ current_time = time(NULL); if (current_time != last_dump) { AFPDumpCounters(ptv); last_dump = current_time; } break; case AFP_READ_FAILURE: /* AFPRead in error: best to reset the socket */ SCLogError(SC_ERR_AFP_READ, "AFPRead error reading data from iface '%s': (%d" PRIu32 ") %s", ptv->iface, errno, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; case AFP_FAILURE: AFPSwitchState(ptv, AFP_STATE_DOWN); SCReturnInt(TM_ECODE_FAILED); break; case AFP_KERNEL_DROP: AFPDumpCounters(ptv); break; } } else if (unlikely(r == 0)) { /* poll timed out, lets see if we need to inject a fake packet */ TmThreadsCaptureInjectPacket(tv, ptv->slot, NULL); } else if ((r < 0) && (errno != EINTR)) { SCLogError(SC_ERR_AFP_READ, "Error reading data from iface '%s': (%d" PRIu32 ") %s", ptv->iface, errno, strerror(errno)); AFPSwitchState(ptv, AFP_STATE_DOWN); continue; } StatsSyncCountersIfSignalled(tv); } AFPDumpCounters(ptv); StatsSyncCountersIfSignalled(tv); SCReturnInt(TM_ECODE_OK); } static int AFPGetDevFlags(int fd, const char *ifname) { struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) { SCLogError(SC_ERR_AFP_CREATE, "Unable to find type for iface \"%s\": %s", ifname, strerror(errno)); return -1; } return ifr.ifr_flags; } static int AFPGetIfnumByDev(int fd, const char *ifname, int verbose) { struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { if (verbose) SCLogError(SC_ERR_AFP_CREATE, "Unable to find iface %s: %s", ifname, strerror(errno)); return -1; } return ifr.ifr_ifindex; } static int AFPGetDevLinktype(int fd, const char *ifname) { struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { SCLogError(SC_ERR_AFP_CREATE, "Unable to find type for iface \"%s\": %s", ifname, strerror(errno)); return -1; } switch (ifr.ifr_hwaddr.sa_family) { case ARPHRD_LOOPBACK: return LINKTYPE_ETHERNET; case ARPHRD_PPP: case ARPHRD_NONE: return LINKTYPE_RAW; default: return ifr.ifr_hwaddr.sa_family; } } int AFPGetLinkType(const char *ifname) { int ltype; int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (fd == -1) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't create a AF_PACKET socket, error %s", strerror(errno)); return LINKTYPE_RAW; } ltype = AFPGetDevLinktype(fd, ifname); close(fd); return ltype; } static int AFPComputeRingParams(AFPThreadVars *ptv, int order) { /* Compute structure: Target is to store all pending packets with a size equal to MTU + auxdata And we keep a decent number of block To do so: Compute frame_size (aligned to be able to fit in block Check which block size we need. Blocksize is a 2^n * pagesize We then need to get order, big enough to have frame_size < block size Find number of frame per block (divide) Fill in packet_req Compute frame size: described in packet_mmap.txt dependant on snaplen (need to use a variable ?) snaplen: MTU ? tp_hdrlen determine_version in daq_afpacket in V1: sizeof(struct tpacket_hdr); in V2: val in getsockopt(instance->fd, SOL_PACKET, PACKET_HDRLEN, &val, &len) frame size: TPACKET_ALIGN(snaplen + TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) + sizeof(struct sockaddr_ll) + ETH_HLEN) - ETH_HLEN); */ int tp_hdrlen = sizeof(struct tpacket_hdr); int snaplen = default_packet_size; if (snaplen == 0) { snaplen = GetIfaceMaxPacketSize(ptv->iface); if (snaplen <= 0) { SCLogWarning(SC_ERR_INVALID_VALUE, "Unable to get MTU, setting snaplen to sane default of 1514"); snaplen = 1514; } } ptv->req.tp_frame_size = TPACKET_ALIGN(snaplen +TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) + sizeof(struct sockaddr_ll) + ETH_HLEN) - ETH_HLEN); ptv->req.tp_block_size = getpagesize() << order; int frames_per_block = ptv->req.tp_block_size / ptv->req.tp_frame_size; if (frames_per_block == 0) { SCLogError(SC_ERR_INVALID_VALUE, "Frame size bigger than block size"); return -1; } ptv->req.tp_frame_nr = ptv->ring_size; ptv->req.tp_block_nr = ptv->req.tp_frame_nr / frames_per_block + 1; /* exact division */ ptv->req.tp_frame_nr = ptv->req.tp_block_nr * frames_per_block; SCLogPerf("AF_PACKET RX Ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d", ptv->req.tp_block_size, ptv->req.tp_block_nr, ptv->req.tp_frame_size, ptv->req.tp_frame_nr); return 1; } #ifdef HAVE_TPACKET_V3 static int AFPComputeRingParamsV3(AFPThreadVars *ptv) { ptv->req3.tp_block_size = ptv->block_size; ptv->req3.tp_frame_size = 2048; int frames_per_block = 0; int tp_hdrlen = sizeof(struct tpacket3_hdr); int snaplen = default_packet_size; if (snaplen == 0) { snaplen = GetIfaceMaxPacketSize(ptv->iface); if (snaplen <= 0) { SCLogWarning(SC_ERR_INVALID_VALUE, "Unable to get MTU, setting snaplen to sane default of 1514"); snaplen = 1514; } } ptv->req.tp_frame_size = TPACKET_ALIGN(snaplen +TPACKET_ALIGN(TPACKET_ALIGN(tp_hdrlen) + sizeof(struct sockaddr_ll) + ETH_HLEN) - ETH_HLEN); frames_per_block = ptv->req3.tp_block_size / ptv->req3.tp_frame_size; if (frames_per_block == 0) { SCLogError(SC_ERR_INVALID_VALUE, "Block size is too small, it should be at least %d", ptv->req3.tp_frame_size); return -1; } ptv->req3.tp_block_nr = ptv->ring_size / frames_per_block + 1; /* exact division */ ptv->req3.tp_frame_nr = ptv->req3.tp_block_nr * frames_per_block; ptv->req3.tp_retire_blk_tov = ptv->block_timeout; ptv->req3.tp_feature_req_word = TP_FT_REQ_FILL_RXHASH; SCLogPerf("AF_PACKET V3 RX Ring params: block_size=%d block_nr=%d frame_size=%d frame_nr=%d (mem: %d)", ptv->req3.tp_block_size, ptv->req3.tp_block_nr, ptv->req3.tp_frame_size, ptv->req3.tp_frame_nr, ptv->req3.tp_block_size * ptv->req3.tp_block_nr ); return 1; } #endif static int AFPSetupRing(AFPThreadVars *ptv, char *devname) { int val; unsigned int len = sizeof(val), i; unsigned int ring_buflen; uint8_t * ring_buf; int order; int r, mmap_flag; #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { val = TPACKET_V3; } else #endif { val = TPACKET_V2; } if (getsockopt(ptv->socket, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) { if (errno == ENOPROTOOPT) { if (ptv->flags & AFP_TPACKET_V3) { SCLogError(SC_ERR_AFP_CREATE, "Too old kernel giving up (need 3.2 for TPACKET_V3)"); } else { SCLogError(SC_ERR_AFP_CREATE, "Too old kernel giving up (need 2.6.27 at least)"); } } SCLogError(SC_ERR_AFP_CREATE, "Error when retrieving packet header len"); return AFP_FATAL_ERROR; } val = TPACKET_V2; #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { val = TPACKET_V3; } #endif if (setsockopt(ptv->socket, SOL_PACKET, PACKET_VERSION, &val, sizeof(val)) < 0) { SCLogError(SC_ERR_AFP_CREATE, "Can't activate TPACKET_V2/TPACKET_V3 on packet socket: %s", strerror(errno)); return AFP_FATAL_ERROR; } #ifdef HAVE_HW_TIMESTAMPING int req = SOF_TIMESTAMPING_RAW_HARDWARE; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_TIMESTAMP, (void *) &req, sizeof(req)) < 0) { SCLogWarning(SC_ERR_AFP_CREATE, "Can't activate hardware timestamping on packet socket: %s", strerror(errno)); } #endif /* Let's reserve head room so we can add the VLAN header in IPS * or TAP mode before write the packet */ if (ptv->copy_mode != AFP_COPY_MODE_NONE) { /* Only one vlan is extracted from AFP header so * one VLAN header length is enough. */ int reserve = VLAN_HEADER_LEN; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_RESERVE, (void *) &reserve, sizeof(reserve)) < 0) { SCLogError(SC_ERR_AFP_CREATE, "Can't activate reserve on packet socket: %s", strerror(errno)); return AFP_FATAL_ERROR; } } /* Allocate RX ring */ #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { if (AFPComputeRingParamsV3(ptv) != 1) { return AFP_FATAL_ERROR; } r = setsockopt(ptv->socket, SOL_PACKET, PACKET_RX_RING, (void *) &ptv->req3, sizeof(ptv->req3)); if (r < 0) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate RX Ring for iface %s: (%d) %s", devname, errno, strerror(errno)); return AFP_FATAL_ERROR; } } else { #endif for (order = AFP_BLOCK_SIZE_DEFAULT_ORDER; order >= 0; order--) { if (AFPComputeRingParams(ptv, order) != 1) { SCLogInfo("Ring parameter are incorrect. Please correct the devel"); return AFP_FATAL_ERROR; } r = setsockopt(ptv->socket, SOL_PACKET, PACKET_RX_RING, (void *) &ptv->req, sizeof(ptv->req)); if (r < 0) { if (errno == ENOMEM) { SCLogInfo("Memory issue with ring parameters. Retrying."); continue; } SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate RX Ring for iface %s: (%d) %s", devname, errno, strerror(errno)); return AFP_FATAL_ERROR; } else { break; } } if (order < 0) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate RX Ring for iface %s (order 0 failed)", devname); return AFP_FATAL_ERROR; } #ifdef HAVE_TPACKET_V3 } #endif /* Allocate the Ring */ #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { ring_buflen = ptv->req3.tp_block_nr * ptv->req3.tp_block_size; } else { #endif ring_buflen = ptv->req.tp_block_nr * ptv->req.tp_block_size; #ifdef HAVE_TPACKET_V3 } #endif mmap_flag = MAP_SHARED; if (ptv->flags & AFP_MMAP_LOCKED) mmap_flag |= MAP_LOCKED; ring_buf = mmap(0, ring_buflen, PROT_READ|PROT_WRITE, mmap_flag, ptv->socket, 0); if (ring_buf == MAP_FAILED) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to mmap, error %s", strerror(errno)); goto mmap_err; } #ifdef HAVE_TPACKET_V3 if (ptv->flags & AFP_TPACKET_V3) { ptv->ring_v3 = SCMalloc(ptv->req3.tp_block_nr * sizeof(*ptv->ring_v3)); if (!ptv->ring_v3) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to malloc ptv ring_v3"); goto postmmap_err; } for (i = 0; i < ptv->req3.tp_block_nr; ++i) { ptv->ring_v3[i].iov_base = ring_buf + (i * ptv->req3.tp_block_size); ptv->ring_v3[i].iov_len = ptv->req3.tp_block_size; } } else { #endif /* allocate a ring for each frame header pointer*/ ptv->ring_v2 = SCMalloc(ptv->req.tp_frame_nr * sizeof (union thdr *)); if (ptv->ring_v2 == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate frame buf"); goto postmmap_err; } memset(ptv->ring_v2, 0, ptv->req.tp_frame_nr * sizeof (union thdr *)); /* fill the header ring with proper frame ptr*/ ptv->frame_offset = 0; for (i = 0; i < ptv->req.tp_block_nr; ++i) { void *base = &ring_buf[i * ptv->req.tp_block_size]; unsigned int j; for (j = 0; j < ptv->req.tp_block_size / ptv->req.tp_frame_size; ++j, ++ptv->frame_offset) { (((union thdr **)ptv->ring_v2)[ptv->frame_offset]) = base; base += ptv->req.tp_frame_size; } } ptv->frame_offset = 0; #ifdef HAVE_TPACKET_V3 } #endif return 0; postmmap_err: munmap(ring_buf, ring_buflen); if (ptv->ring_v2) SCFree(ptv->ring_v2); if (ptv->ring_v3) SCFree(ptv->ring_v3); mmap_err: /* Packet mmap does the cleaning when socket is closed */ return AFP_FATAL_ERROR; } /** \brief test if we can use FANOUT. Older kernels like those in * CentOS6 have HAVE_PACKET_FANOUT defined but fail to work */ int AFPIsFanoutSupported(void) { #ifdef HAVE_PACKET_FANOUT int fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (fd != -1) { uint16_t mode = PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_DEFRAG; uint16_t id = 1; uint32_t option = (mode << 16) | (id & 0xffff); int r = setsockopt(fd, SOL_PACKET, PACKET_FANOUT,(void *)&option, sizeof(option)); close(fd); if (r < 0) { SCLogPerf("fanout not supported by kernel: %s", strerror(errno)); return 0; } return 1; } #endif return 0; } static int AFPCreateSocket(AFPThreadVars *ptv, char *devname, int verbose) { int r; int ret = AFP_FATAL_ERROR; struct packet_mreq sock_params; struct sockaddr_ll bind_address; int if_idx; /* open socket */ ptv->socket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (ptv->socket == -1) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't create a AF_PACKET socket, error %s", strerror(errno)); goto error; } if_idx = AFPGetIfnumByDev(ptv->socket, devname, verbose); /* bind socket */ memset(&bind_address, 0, sizeof(bind_address)); bind_address.sll_family = AF_PACKET; bind_address.sll_protocol = htons(ETH_P_ALL); bind_address.sll_ifindex = if_idx; if (bind_address.sll_ifindex == -1) { if (verbose) SCLogError(SC_ERR_AFP_CREATE, "Couldn't find iface %s", devname); ret = AFP_RECOVERABLE_ERROR; goto socket_err; } if (ptv->promisc != 0) { /* Force promiscuous mode */ memset(&sock_params, 0, sizeof(sock_params)); sock_params.mr_type = PACKET_MR_PROMISC; sock_params.mr_ifindex = bind_address.sll_ifindex; r = setsockopt(ptv->socket, SOL_PACKET, PACKET_ADD_MEMBERSHIP,(void *)&sock_params, sizeof(sock_params)); if (r < 0) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't switch iface %s to promiscuous, error %s", devname, strerror(errno)); goto socket_err; } } if (ptv->checksum_mode == CHECKSUM_VALIDATION_KERNEL) { int val = 1; if (setsockopt(ptv->socket, SOL_PACKET, PACKET_AUXDATA, &val, sizeof(val)) == -1 && errno != ENOPROTOOPT) { SCLogWarning(SC_ERR_NO_AF_PACKET, "'kernel' checksum mode not supported, falling back to full mode."); ptv->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } } /* set socket recv buffer size */ if (ptv->buffer_size != 0) { /* * Set the socket buffer size to the specified value. */ SCLogPerf("Setting AF_PACKET socket buffer to %d", ptv->buffer_size); if (setsockopt(ptv->socket, SOL_SOCKET, SO_RCVBUF, &ptv->buffer_size, sizeof(ptv->buffer_size)) == -1) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't set buffer size to %d on iface %s, error %s", ptv->buffer_size, devname, strerror(errno)); goto socket_err; } } r = bind(ptv->socket, (struct sockaddr *)&bind_address, sizeof(bind_address)); if (r < 0) { if (verbose) { if (errno == ENETDOWN) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't bind AF_PACKET socket, iface %s is down", devname); } else { SCLogError(SC_ERR_AFP_CREATE, "Couldn't bind AF_PACKET socket to iface %s, error %s", devname, strerror(errno)); } } ret = AFP_RECOVERABLE_ERROR; goto socket_err; } #ifdef HAVE_PACKET_FANOUT /* add binded socket to fanout group */ if (ptv->threads > 1) { uint16_t mode = ptv->cluster_type; uint16_t id = ptv->cluster_id; uint32_t option = (mode << 16) | (id & 0xffff); r = setsockopt(ptv->socket, SOL_PACKET, PACKET_FANOUT,(void *)&option, sizeof(option)); if (r < 0) { SCLogError(SC_ERR_AFP_CREATE, "Couldn't set fanout mode, error %s", strerror(errno)); goto socket_err; } } #endif int if_flags = AFPGetDevFlags(ptv->socket, ptv->iface); if (if_flags == -1) { if (verbose) { SCLogError(SC_ERR_AFP_READ, "Couldn't get flags for interface '%s'", ptv->iface); } ret = AFP_RECOVERABLE_ERROR; goto socket_err; } if ((if_flags & IFF_UP) == 0) { if (verbose) { SCLogError(SC_ERR_AFP_READ, "Interface '%s' is down", ptv->iface); } ret = AFP_RECOVERABLE_ERROR; goto socket_err; } if (ptv->flags & AFP_RING_MODE) { ret = AFPSetupRing(ptv, devname); if (ret != 0) goto socket_err; } SCLogDebug("Using interface '%s' via socket %d", (char *)devname, ptv->socket); ptv->datalink = AFPGetDevLinktype(ptv->socket, ptv->iface); switch (ptv->datalink) { case ARPHRD_PPP: case ARPHRD_ATM: ptv->cooked = 1; break; } TmEcode rc; rc = AFPSetBPFFilter(ptv); if (rc == TM_ECODE_FAILED) { SCLogError(SC_ERR_AFP_CREATE, "Set AF_PACKET bpf filter \"%s\" failed.", ptv->bpf_filter); goto frame_err; } /* Init is ok */ AFPSwitchState(ptv, AFP_STATE_UP); return 0; frame_err: if (ptv->flags & AFP_TPACKET_V3) { if (ptv->ring_v3) SCFree(ptv->ring_v3); } else { if (ptv->ring_v2) SCFree(ptv->ring_v2); } socket_err: close(ptv->socket); ptv->socket = -1; error: return -ret; } TmEcode AFPSetBPFFilter(AFPThreadVars *ptv) { struct bpf_program filter; struct sock_fprog fcode; int rc; if (!ptv->bpf_filter) return TM_ECODE_OK; SCMutexLock(&afpacket_bpf_set_filter_lock); SCLogInfo("Using BPF '%s' on iface '%s'", ptv->bpf_filter, ptv->iface); if (pcap_compile_nopcap(default_packet_size, /* snaplen_arg */ ptv->datalink, /* linktype_arg */ &filter, /* program */ ptv->bpf_filter, /* const char *buf */ 0, /* optimize */ 0 /* mask */ ) == -1) { SCLogError(SC_ERR_AFP_CREATE, "Filter compilation failed."); SCMutexUnlock(&afpacket_bpf_set_filter_lock); return TM_ECODE_FAILED; } SCMutexUnlock(&afpacket_bpf_set_filter_lock); if (filter.bf_insns == NULL) { SCLogError(SC_ERR_AFP_CREATE, "Filter badly setup."); return TM_ECODE_FAILED; } fcode.len = filter.bf_len; fcode.filter = (struct sock_filter*)filter.bf_insns; rc = setsockopt(ptv->socket, SOL_SOCKET, SO_ATTACH_FILTER, &fcode, sizeof(fcode)); if(rc == -1) { SCLogError(SC_ERR_AFP_CREATE, "Failed to attach filter: %s", strerror(errno)); return TM_ECODE_FAILED; } return TM_ECODE_OK; } /** * \brief Init function for ReceiveAFP. * * \param tv pointer to ThreadVars * \param initdata pointer to the interface passed from the user * \param data pointer gets populated with AFPThreadVars * * \todo Create a general AFP setup function. */ TmEcode ReceiveAFPThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); AFPIfaceConfig *afpconfig = initdata; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } AFPThreadVars *ptv = SCMalloc(sizeof(AFPThreadVars)); if (unlikely(ptv == NULL)) { afpconfig->DerefFunc(afpconfig); SCReturnInt(TM_ECODE_FAILED); } memset(ptv, 0, sizeof(AFPThreadVars)); ptv->tv = tv; ptv->cooked = 0; strlcpy(ptv->iface, afpconfig->iface, AFP_IFACE_NAME_LENGTH); ptv->iface[AFP_IFACE_NAME_LENGTH - 1]= '\0'; ptv->livedev = LiveGetDevice(ptv->iface); if (ptv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } ptv->buffer_size = afpconfig->buffer_size; ptv->ring_size = afpconfig->ring_size; ptv->block_size = afpconfig->block_size; ptv->promisc = afpconfig->promisc; ptv->checksum_mode = afpconfig->checksum_mode; ptv->bpf_filter = NULL; ptv->threads = 1; #ifdef HAVE_PACKET_FANOUT ptv->cluster_type = PACKET_FANOUT_LB; ptv->cluster_id = 1; /* We only set cluster info if the number of reader threads is greater than 1 */ if (afpconfig->threads > 1) { ptv->cluster_id = afpconfig->cluster_id; ptv->cluster_type = afpconfig->cluster_type; ptv->threads = afpconfig->threads; } #endif ptv->flags = afpconfig->flags; if (afpconfig->bpf_filter) { ptv->bpf_filter = afpconfig->bpf_filter; } #ifdef PACKET_STATISTICS ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ptv->tv); ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ptv->tv); #endif ptv->copy_mode = afpconfig->copy_mode; if (ptv->copy_mode != AFP_COPY_MODE_NONE) { strlcpy(ptv->out_iface, afpconfig->out_iface, AFP_IFACE_NAME_LENGTH); ptv->out_iface[AFP_IFACE_NAME_LENGTH - 1]= '\0'; /* Warn about BPF filter consequence */ if (ptv->bpf_filter) { SCLogWarning(SC_WARN_UNCOMMON, "Enabling a BPF filter in IPS mode result" " in dropping all non matching packets."); } } if (AFPPeersListAdd(ptv) == TM_ECODE_FAILED) { SCFree(ptv); afpconfig->DerefFunc(afpconfig); SCReturnInt(TM_ECODE_FAILED); } #define T_DATA_SIZE 70000 ptv->data = SCMalloc(T_DATA_SIZE); if (ptv->data == NULL) { afpconfig->DerefFunc(afpconfig); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } ptv->datalen = T_DATA_SIZE; #undef T_DATA_SIZE *data = (void *)ptv; afpconfig->DerefFunc(afpconfig); /* A bit strange to have this here but we only have vlan information * during reading so we need to know if we want to keep vlan during * the capture phase */ int vlanbool = 0; if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) { ptv->flags |= AFP_VLAN_DISABLED; } /* If kernel is older than 3.0, VLAN is not stripped so we don't * get the info from packet extended header but we will use a standard * parsing of packet data (See Linux commit bcc6d47903612c3861201cc3a866fb604f26b8b2) */ if (! SCKernelVersionIsAtLeast(3, 0)) { ptv->flags |= AFP_VLAN_DISABLED; } SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats to the screen at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into AFPThreadVars for ptv */ void ReceiveAFPThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); AFPThreadVars *ptv = (AFPThreadVars *)data; #ifdef PACKET_STATISTICS AFPDumpCounters(ptv); SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 "", tv->name, StatsGetLocalCounterValue(tv, ptv->capture_kernel_packets), StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops)); #endif } /** * \brief DeInit function closes af packet socket at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into AFPThreadVars for ptv */ TmEcode ReceiveAFPThreadDeinit(ThreadVars *tv, void *data) { AFPThreadVars *ptv = (AFPThreadVars *)data; AFPSwitchState(ptv, AFP_STATE_DOWN); if (ptv->data != NULL) { SCFree(ptv->data); ptv->data = NULL; } ptv->datalen = 0; ptv->bpf_filter = NULL; SCReturnInt(TM_ECODE_OK); } /** * \brief This function passes off to link type decoders. * * DecodeAFP reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param t pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into AFPThreadVars for ptv * \param pq pointer to the current PacketQueue */ TmEcode DecodeAFP(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* If suri has set vlan during reading, we increase vlan counter */ if (p->vlan_idx) { StatsIncr(tv, dtv->counter_vlan); } /* call the decoder */ switch (p->datalink) { case LINKTYPE_ETHERNET: DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_LINUX_SLL: DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_PPP: DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_RAW: DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_NULL: DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; default: SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module DecodeAFP", p->datalink); break; } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } TmEcode DecodeAFPThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; #ifdef __SC_CUDA_SUPPORT__ if (CudaThreadVarsInit(&dtv->cuda_vars) < 0) SCReturnInt(TM_ECODE_FAILED); #endif SCReturnInt(TM_ECODE_OK); } TmEcode DecodeAFPThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* HAVE_AF_PACKET */ /* eof */ /** * @} */ suricata-3.2.1/src/app-layer-detect-proto.h0000644000000000000000000001604513051004444015461 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __APP_LAYER_DETECT_PROTO__H__ #define __APP_LAYER_DETECT_PROTO__H__ typedef struct AppLayerProtoDetectThreadCtx_ AppLayerProtoDetectThreadCtx; typedef AppProto (*ProbingParserFPtr)(uint8_t *input, uint32_t input_len, uint32_t *offset); /***** Protocol Retrieval *****/ /** * \brief Returns the app layer protocol given a buffer. * * \param tctx Pointer to the app layer protocol detection thread context. * \param f Pointer to the flow. * \param buf The buffer to be inspected. * \param buflen The length of the above buffer. * \param ipproto The ip protocol. * \param direction The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT. * * \retval The app layer protocol. */ AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t direction); /***** State Preparation *****/ /** * \brief Prepares the internal state for protocol detection. * This needs to be called once all the patterns and probing parser * ports have been registered. */ int AppLayerProtoDetectPrepareState(void); /***** PP registration *****/ void AppLayerProtoDetectPPRegister(uint8_t ipproto, char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2); /** * \retval bool 0 if no config was found, 1 if config was found */ int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc); /***** PM registration *****/ /** * \brief Registers a case-sensitive pattern for protocol detection. */ int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, char *pattern, uint16_t depth, uint16_t offset, uint8_t direction); /** * \brief Registers a case-insensitive pattern for protocol detection. */ int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, char *pattern, uint16_t depth, uint16_t offset, uint8_t direction); /***** Setup/General Registration *****/ /** * \brief The first function to be called. This initializes a global * protocol detection context. * * \retval 0 On succcess; * \retval -1 On failure. */ int AppLayerProtoDetectSetup(void); /** * \brief Cleans up the app layer protocol detection phase. */ int AppLayerProtoDetectDeSetup(void); /** * \brief Registers a protocol for protocol detection phase. * * This is the first function to be called after calling the * setup function, AppLayerProtoDetectSetup(), before calling any other * app layer functions, AppLayerParser or AppLayerProtoDetect, alike. * With this function you are associating/registering a string * that can be used by users to write rules, i.e. * you register the http protocol for protocol detection using * AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP, "http"), * following which you can write rules like - * alert http any any -> any any (sid:1;) * which basically matches on the HTTP protocol. * * \param alproto The protocol. * \param alproto_str The string to associate with the above "alproto". * Please send a static string that won't be destroyed * post making this call, since this function won't * create a copy of the received argument. * * \retval 0 On success; * -1 On failure. */ void AppLayerProtoDetectRegisterProtocol(AppProto alproto, char *alproto_name); /** * \brief Given a protocol name, checks if proto detection is enabled in * the conf file. * * \param alproto Name of the app layer protocol. * * \retval 1 If enabled. * \retval 0 If disabled. */ int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto); /** * \brief Inits and returns an app layer protocol detection thread context. * \param ctx Pointer to the app layer protocol detection context. * * \retval Pointer to the thread context, on success; * NULL, on failure. */ AppLayerProtoDetectThreadCtx *AppLayerProtoDetectGetCtxThread(void); /** * \brief Destroys the app layer protocol detection thread context. * * \param tctx Pointer to the app layer protocol detection thread context. */ void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx); /***** Utility *****/ void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos); AppProto AppLayerProtoDetectGetProtoByName(char *alproto_name); char *AppLayerProtoDetectGetProtoName(AppProto alproto); void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos); /***** Unittests *****/ #ifdef UNITTESTS /** * \brief Backs up the internal context used by the app layer proto detection * module. */ void AppLayerProtoDetectUnittestCtxBackup(void); /** * \brief Restores back the internal context used by the app layer proto * detection module, that was previously backed up by calling * AppLayerProtoDetectUnittestCtxBackup(). */ void AppLayerProtoDetectUnittestCtxRestore(void); /** * \brief Register unittests for app layer proto detection module. */ void AppLayerProtoDetectUnittestsRegister(void); #endif /* UNITTESTS */ #endif /* __APP_LAYER_DETECT_PROTO__H__ */ suricata-3.2.1/src/packet-queue.c0000644000000000000000000001227713051004444013547 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Packet Queue portion of the engine. */ #include "suricata-common.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "suricata.h" #include "util-var.h" #include "pkt-var.h" #ifdef DEBUG void PacketQueueValidateDebug(PacketQueue *q) { SCLogDebug("q->len %u, q->top %p, q->bot %p", q->len, q->top, q->bot); if (q->len == 0) { BUG_ON(q->top != NULL); BUG_ON(q->bot != NULL); } else if(q->len == 1) { SCLogDebug("q->top->next %p, q->top->prev %p", q->top->next, q->top->prev); SCLogDebug("q->bot->next %p, q->bot->prev %p", q->bot->next, q->bot->prev); BUG_ON(q->top != q->bot); BUG_ON(q->top->next != NULL); BUG_ON(q->bot->next != NULL); BUG_ON(q->top->prev != NULL); BUG_ON(q->bot->prev != NULL); } else if (q->len == 2) { SCLogDebug("q->top->next %p, q->top->prev %p", q->top->next, q->top->prev); SCLogDebug("q->bot->next %p, q->bot->prev %p", q->bot->next, q->bot->prev); BUG_ON(q->top == NULL); BUG_ON(q->bot == NULL); BUG_ON(q->top == q->bot); BUG_ON(q->top->prev != NULL); BUG_ON(q->top->next != q->bot); BUG_ON(q->bot->prev != q->top); BUG_ON(q->bot->next != NULL); } else { BUG_ON(q->top == NULL); BUG_ON(q->bot == NULL); SCLogDebug("q->top->next %p, q->top->prev %p", q->top->next, q->top->prev); SCLogDebug("q->bot->next %p, q->bot->prev %p", q->bot->next, q->bot->prev); BUG_ON(q->top == q->bot); BUG_ON(q->top->prev != NULL); BUG_ON(q->bot->next != NULL); BUG_ON(q->top->next == q->bot); BUG_ON(q->bot->prev == q->top); Packet *p, *pp; for (p = q->top, pp = p->prev; p != NULL; pp = p, p = p->next) { SCLogDebug("p %p, pp %p, p->next %p, p->prev %p", p, pp, p->next, p->prev); BUG_ON(pp != p->prev); } } } #define BUGGER_ON(cond) { \ if ((cond)) { \ PacketQueueValidateDebug(q); \ } \ } void PacketQueueValidate(PacketQueue *q) { if (q->len == 0) { BUGGER_ON(q->top != NULL); BUGGER_ON(q->bot != NULL); } else if(q->len == 1) { BUGGER_ON(q->top != q->bot); BUGGER_ON(q->top->next != NULL); BUGGER_ON(q->bot->next != NULL); BUGGER_ON(q->top->prev != NULL); BUGGER_ON(q->bot->prev != NULL); } else if (q->len == 2) { BUGGER_ON(q->top == NULL); BUGGER_ON(q->bot == NULL); BUGGER_ON(q->top == q->bot); BUGGER_ON(q->top->prev != NULL); BUGGER_ON(q->top->next != q->bot); BUGGER_ON(q->bot->prev != q->top); BUGGER_ON(q->bot->next != NULL); } else { BUGGER_ON(q->top == NULL); BUGGER_ON(q->bot == NULL); BUGGER_ON(q->top == q->bot); BUGGER_ON(q->top->prev != NULL); BUGGER_ON(q->bot->next != NULL); BUGGER_ON(q->top->next == q->bot); BUGGER_ON(q->bot->prev == q->top); Packet *p, *pp; for (p = q->top, pp = p->prev; p != NULL; pp = p, p = p->next) { BUGGER_ON(pp != p->prev); } } } #endif /* DEBUG */ void PacketEnqueue (PacketQueue *q, Packet *p) { //PacketQueueValidateDebug(q); if (p == NULL) return; /* more packets in queue */ if (q->top != NULL) { p->prev = NULL; p->next = q->top; q->top->prev = p; q->top = p; /* only packet */ } else { p->prev = NULL; p->next = NULL; q->top = p; q->bot = p; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ //PacketQueueValidateDebug(q); } Packet *PacketDequeue (PacketQueue *q) { Packet *p = NULL; //PacketQueueValidateDebug(q); /* if the queue is empty there are no packets left. */ if (q->len == 0) { return NULL; } q->len--; /* pull the bottom packet from the queue */ p = q->bot; /* Weird issue: sometimes it looks that two thread arrive * here at the same time so the bot ptr is NULL (only on OS X?) */ BUG_ON (p == NULL); /* more packets in queue */ if (q->bot->prev != NULL) { q->bot = q->bot->prev; q->bot->next = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } //PacketQueueValidateDebug(q); p->next = NULL; p->prev = NULL; return p; } suricata-3.2.1/src/detect-engine-hsbd.h0000644000000000000000000000300413051004444014600 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HSBD_H__ #define __DETECT_ENGINE_HSBD_H__ #define ENGINE_HSBD_BUFFER_LIMIT 20000 #include "app-layer-htp.h" int PrefilterTxHttpResponseBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpServerBody(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineCleanHSBDBuffers(DetectEngineThreadCtx *det_ctx); void DetectEngineHttpServerBodyRegisterTests(void); #endif /* __DETECT_ENGINE_HSBD_H__ */ suricata-3.2.1/src/alert-prelude.c0000644000000000000000000007046213051004444013723 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pierre Chifflier * \author Yoann Vandoorselaere * * Logs alerts to the Prelude system, using IDMEF (RFC 4765) messages. * * Each message contains the alert description and reference (using * the SID/GID), and a normalized description (assessment, impact, * sources etc.) * * libprelude handles the connection with the manager (collecting component), * spooling and sending the event asynchronously. It also offers transport * security (using TLS and trusted certificates) and reliability (events * are retransmitted if not sent successfully). * * This modules requires a Prelude profile to work (see man prelude-admin * and the Prelude Handbook for help). */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-time.h" #include "util-debug.h" #include "util-error.h" #include "util-print.h" #include "output.h" #include "util-privs.h" #include "util-optimize.h" #include "stream.h" #ifndef PRELUDE /* Handle the case where no PRELUDE support is compiled in. */ void AlertPreludeRegister(void) { SCLogDebug("Can't register Prelude output thread - Prelude support was disabled during build."); } #else /* implied we do have PRELUDE support */ #include #define ANALYZER_CLASS "NIDS" #define ANALYZER_MODEL "Suricata" #define ANALYZER_MANUFACTURER "http://www.openinfosecfoundation.org/" #define ANALYZER_SID_URL "http://www.snort.org/search/sid/" #define SNORT_MAX_OWNED_SID 1000000 #define DEFAULT_ANALYZER_NAME "suricata" #define DEFAULT_PRELUDE_PROFILE "suricata" static unsigned int info_priority = 4; static unsigned int low_priority = 3; static unsigned int mid_priority = 2; /** * This holds global structures and variables. Since libprelude is thread-safe, * there is no need to store a mutex. */ typedef struct AlertPreludeCtx_ { /** The client (which has the send function) */ prelude_client_t *client; int log_packet_content; int log_packet_header; } AlertPreludeCtx; /** * This holds per-thread specific structures and variables. */ typedef struct AlertPreludeThread_ { /** Pointer to the global context */ AlertPreludeCtx *ctx; idmef_analyzer_t *analyzer; } AlertPreludeThread; /** * \brief Initialize analyzer description * * \return 0 if ok */ static int SetupAnalyzer(idmef_analyzer_t *analyzer) { int ret; prelude_string_t *string; SCEnter(); ret = idmef_analyzer_new_model(analyzer, &string); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating analyzer model: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = prelude_string_set_constant(string, ANALYZER_MODEL); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting analyzer model: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = idmef_analyzer_new_class(analyzer, &string); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating analyzer class: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = prelude_string_set_constant(string, ANALYZER_CLASS); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting analyzer class: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = idmef_analyzer_new_manufacturer(analyzer, &string); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating analyzer manufacturer: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = prelude_string_set_constant(string, ANALYZER_MANUFACTURER); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting analyzer manufacturer: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = idmef_analyzer_new_version(analyzer, &string); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating analyzer version: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = prelude_string_set_constant(string, VERSION); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting analyzer version: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } SCReturnInt(0); } /** * \brief Create event impact description (see section * 4.2.6.1 of RFC 4765). * The impact contains the severity, completion (succeeded or failed) * and basic classification of the attack type. * Here, we don't set the completion since we don't know it (default * is unknown). * * \return 0 if ok */ static int EventToImpact(const PacketAlert *pa, const Packet *p, idmef_alert_t *alert) { int ret; prelude_string_t *str; idmef_impact_t *impact; idmef_assessment_t *assessment; idmef_impact_severity_t severity; SCEnter(); ret = idmef_alert_new_assessment(alert, &assessment); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating assessment: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } ret = idmef_assessment_new_impact(assessment, &impact); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating assessment impact: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(ret); } if ( (unsigned int)pa->s->prio < mid_priority ) severity = IDMEF_IMPACT_SEVERITY_HIGH; else if ( (unsigned int)pa->s->prio < low_priority ) severity = IDMEF_IMPACT_SEVERITY_MEDIUM; else if ( (unsigned int)pa->s->prio < info_priority ) severity = IDMEF_IMPACT_SEVERITY_LOW; else severity = IDMEF_IMPACT_SEVERITY_INFO; idmef_impact_set_severity(impact, severity); if (PACKET_TEST_ACTION(p, ACTION_DROP) || PACKET_TEST_ACTION(p, ACTION_REJECT) || PACKET_TEST_ACTION(p, ACTION_REJECT_DST) || PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH) ) { idmef_action_t *action; ret = idmef_action_new(&action); if (unlikely(ret < 0)) SCReturnInt(ret); idmef_action_set_category(action, IDMEF_ACTION_CATEGORY_BLOCK_INSTALLED); idmef_assessment_set_action(assessment, action, 0); } if (pa->s->class_msg) { ret = idmef_impact_new_description(impact, &str); if (unlikely(ret < 0)) SCReturnInt(ret); prelude_string_set_ref(str, pa->s->class_msg); } SCReturnInt(0); } /** * \brief Add Source and Target fields to the IDMEF alert. * These objects contains IP addresses, source and destination * ports (see sections 4.2.4.3 and 4.2.4.4 of RFC 4765). * * \return 0 if ok */ static int EventToSourceTarget(const Packet *p, idmef_alert_t *alert) { int ret; idmef_node_t *node; idmef_source_t *source; idmef_target_t *target; idmef_address_t *address; idmef_service_t *service; prelude_string_t *string; static char saddr[128], daddr[128]; uint8_t ip_vers; uint8_t ip_proto; SCEnter(); if ( !p ) SCReturnInt(0); if ( ! IPH_IS_VALID(p) ) SCReturnInt(0); if (PKT_IS_IPV4(p)) { ip_vers = 4; ip_proto = IPV4_GET_RAW_IPPROTO(p->ip4h); PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), saddr, sizeof(saddr)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), daddr, sizeof(daddr)); } else if (PKT_IS_IPV6(p)) { ip_vers = 6; ip_proto = IPV6_GET_L4PROTO(p); PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), saddr, sizeof(saddr)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), daddr, sizeof(daddr)); } else SCReturnInt(0); ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_source_new_service(source, &service); if (unlikely(ret < 0)) SCReturnInt(ret); if ( p->tcph || p->udph ) idmef_service_set_port(service, p->sp); idmef_service_set_ip_version(service, ip_vers); idmef_service_set_iana_protocol_number(service, ip_proto); ret = idmef_source_new_node(source, &node); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_address_new_address(address, &string); if (unlikely(ret < 0)) SCReturnInt(ret); prelude_string_set_ref(string, saddr); ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_target_new_service(target, &service); if (unlikely(ret < 0)) SCReturnInt(ret); if ( p->tcph || p->udph ) idmef_service_set_port(service, p->dp); idmef_service_set_ip_version(service, ip_vers); idmef_service_set_iana_protocol_number(service, ip_proto); ret = idmef_target_new_node(target, &node); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_address_new_address(address, &string); if (unlikely(ret < 0)) SCReturnInt(ret); prelude_string_set_ref(string, daddr); SCReturnInt(0); } /** * \brief Add binary data, to be stored in the Additional Data * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765). * * \return 0 if ok */ static int AddByteData(idmef_alert_t *alert, const char *meaning, const unsigned char *data, size_t size) { int ret; prelude_string_t *str; idmef_additional_data_t *ad; SCEnter(); if ( ! data || ! size ) SCReturnInt(0); ret = idmef_alert_new_additional_data(alert, &ad, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(0); ret = idmef_additional_data_set_byte_string_ref(ad, data, size); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting byte string data: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(-1); } ret = idmef_additional_data_new_meaning(ad, &str); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating additional-data meaning: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(-1); } ret = prelude_string_set_ref(str, meaning); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting byte string data meaning: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(-1); } SCReturnInt(0); } /** * \brief Add integer data, to be stored in the Additional Data * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765). * * \return 0 if ok */ static int AddIntData(idmef_alert_t *alert, const char *meaning, uint32_t data) { int ret; prelude_string_t *str; idmef_additional_data_t *ad; SCEnter(); ret = idmef_alert_new_additional_data(alert, &ad, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); idmef_additional_data_set_integer(ad, data); ret = idmef_additional_data_new_meaning(ad, &str); if (unlikely(ret < 0)) { SCLogDebug("%s: error creating additional-data meaning: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(-1); } ret = prelude_string_set_ref(str, meaning); if (unlikely(ret < 0)) { SCLogDebug("%s: error setting integer data meaning: %s.", prelude_strsource(ret), prelude_strerror(ret)); SCReturnInt(-1); } SCReturnInt(0); } /** * \brief Add IPv4 header data, to be stored in the Additional Data * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765). * * \return 0 if ok */ static int PacketToDataV4(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert) { SCEnter(); AddIntData(alert, "ip_ver", IPV4_GET_RAW_VER(p->ip4h)); AddIntData(alert, "ip_hlen", IPV4_GET_RAW_HLEN(p->ip4h)); AddIntData(alert, "ip_tos", IPV4_GET_RAW_IPTOS(p->ip4h)); AddIntData(alert, "ip_len", ntohs(IPV4_GET_RAW_IPLEN(p->ip4h))); AddIntData(alert, "ip_id", ntohs(IPV4_GET_RAW_IPID(p->ip4h))); AddIntData(alert, "ip_off", ntohs(IPV4_GET_RAW_IPOFFSET(p->ip4h))); AddIntData(alert, "ip_ttl", IPV4_GET_RAW_IPTTL(p->ip4h)); AddIntData(alert, "ip_proto", IPV4_GET_RAW_IPPROTO(p->ip4h)); AddIntData(alert, "ip_sum", ntohs(p->ip4h->ip_csum)); SCReturnInt(0); } /** * \brief Add IPv6 header data, to be stored in the Additional Data * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765). * * \return 0 if ok */ static int PacketToDataV6(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert) { SCEnter(); AddIntData(alert, "ip_ver", IPV6_GET_VER(p)); AddIntData(alert, "ip_class", IPV6_GET_CLASS(p)); AddIntData(alert, "ip_flow", IPV6_GET_FLOW(p)); AddIntData(alert, "ip_nh", IPV6_GET_NH(p)); AddIntData(alert, "ip_plen", IPV6_GET_PLEN(p)); AddIntData(alert, "ip_hlim", IPV6_GET_HLIM(p)); AddIntData(alert, "ip_proto", IPV6_GET_L4PROTO(p)); SCReturnInt(0); } /** * \brief Convert IP packet to an IDMEF alert (RFC 4765). * This function stores the alert SID (description and reference), * the payload of the packet, and pre-processed data. * * \return 0 if ok */ static int PacketToData(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert, AlertPreludeCtx *ctx) { SCEnter(); if (unlikely(p == NULL)) SCReturnInt(0); AddIntData(alert, "snort_rule_sid", pa->s->id); AddIntData(alert, "snort_rule_rev", pa->s->rev); if (ctx->log_packet_header) { if ( PKT_IS_IPV4(p) ) PacketToDataV4(p, pa, alert); else if ( PKT_IS_IPV6(p) ) PacketToDataV6(p, pa, alert); if ( PKT_IS_TCP(p) ) { AddIntData(alert, "tcp_seq", TCP_GET_SEQ(p)); AddIntData(alert, "tcp_ack", TCP_GET_ACK(p)); AddIntData(alert, "tcp_off", TCP_GET_OFFSET(p)); AddIntData(alert, "tcp_res", TCP_GET_X2(p)); AddIntData(alert, "tcp_flags", TCP_GET_FLAGS(p)); AddIntData(alert, "tcp_win", TCP_GET_WINDOW(p)); AddIntData(alert, "tcp_sum", TCP_GET_SUM(p)); AddIntData(alert, "tcp_urp", TCP_GET_URG_POINTER(p)); if (p->tcpvars.ts_val != 0) { AddIntData(alert, "tcp_tsval", TCP_GET_TSVAL(p)); } if (p->tcpvars.ts_ecr != 0) { AddIntData(alert, "tcp_tsecr", TCP_GET_TSECR(p)); } if (p->tcph != NULL) { AddIntData(alert, "tcp_wscale", TCP_GET_WSCALE(p)); } if (TCP_HAS_SACKOK(p)) { AddIntData(alert, "tcp_sackok", TCP_GET_SACKOK(p)); } if (TCP_HAS_SACK(p)) { AddIntData(alert, "tcp_sack_cnt", TCP_GET_SACK_CNT(p)); } AddIntData(alert, "tcp_hlen", TCP_GET_HLEN(p)); } else if ( PKT_IS_UDP(p) ) { AddIntData(alert, "udp_len", UDP_GET_LEN(p)); AddIntData(alert, "udp_sum", UDP_GET_SUM(p)); } else if ( PKT_IS_ICMPV4(p) ) { AddIntData(alert, "icmp_type", ICMPV4_GET_TYPE(p)); AddIntData(alert, "icmp_code", ICMPV4_GET_CODE(p)); AddIntData(alert, "icmp_sum", ICMPV4_GET_RAW_CSUM(p)); } else if ( PKT_IS_ICMPV6(p) ) { AddIntData(alert, "icmp_type", ICMPV6_GET_TYPE(p)); AddIntData(alert, "icmp_code", ICMPV6_GET_CODE(p)); AddIntData(alert, "icmp_csum", ICMPV6_GET_RAW_CSUM(p)); } } if (ctx->log_packet_content) AddByteData(alert, "payload", p->payload, p->payload_len); SCReturnInt(0); } /** * \brief Store reference on rule (SID and GID) in the IDMEF alert, * and embed an URL pointing to the rule description. * * \return 0 if ok */ static int AddSnortReference(idmef_classification_t *class, int gen_id, int sig_id) { int ret; prelude_string_t *str; idmef_reference_t *ref; SCEnter(); if ( sig_id >= SNORT_MAX_OWNED_SID ) SCReturnInt(0); ret = idmef_classification_new_reference(class, &ref, IDMEF_LIST_APPEND); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_reference_new_name(ref, &str); if (unlikely(ret < 0)) SCReturnInt(ret); idmef_reference_set_origin(ref, IDMEF_REFERENCE_ORIGIN_VENDOR_SPECIFIC); if ( gen_id == 0 ) ret = prelude_string_sprintf(str, "%u", sig_id); else ret = prelude_string_sprintf(str, "%u:%u", gen_id, sig_id); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_reference_new_meaning(ref, &str); if (unlikely(ret < 0)) SCReturnInt(ret); ret = prelude_string_sprintf(str, "Snort Signature ID"); if (unlikely(ret < 0)) SCReturnInt(ret); ret = idmef_reference_new_url(ref, &str); if (unlikely(ret < 0)) SCReturnInt(ret); if ( gen_id == 0 ) ret = prelude_string_sprintf(str, ANALYZER_SID_URL "%u", sig_id); else ret = prelude_string_sprintf(str, ANALYZER_SID_URL "%u-%u", gen_id, sig_id); SCReturnInt(ret); } /** * \brief Create event classification description (see section * 4.2.4.2 of RFC 4765). * The classification is the "name" of the alert, identification of the * rule signature, and additional information on the rule. * * \return 0 if ok */ static int EventToReference(const PacketAlert *pa, const Packet *p, idmef_classification_t *class) { int ret; prelude_string_t *str; SCEnter(); ret = idmef_classification_new_ident(class, &str); if (unlikely(ret < 0)) SCReturnInt(ret); if ( pa->s->gid == 0 ) ret = prelude_string_sprintf(str, "%u", pa->s->id); else ret = prelude_string_sprintf(str, "%u:%u", pa->s->gid, pa->s->id); if (unlikely(ret < 0)) SCReturnInt(ret); ret = AddSnortReference(class, pa->s->gid, pa->s->id); if (unlikely(ret < 0)) SCReturnInt(ret); SCReturnInt(0); } static int PreludePrintStreamSegmentCallback(const Packet *p, void *data, uint8_t *buf, uint32_t buflen) { int ret; ret = AddByteData((idmef_alert_t *)data, "stream-segment", buf, buflen); if (ret == 0) return 1; else return -1; } /** * \brief Initialize thread-specific data. Each thread structure contains * a pointer to the \a AlertPreludeCtx context. * * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED */ static TmEcode AlertPreludeThreadInit(ThreadVars *t, void *initdata, void **data) { AlertPreludeThread *aun; SCEnter(); if (unlikely(initdata == NULL)) { SCLogError(SC_ERR_INITIALIZATION, "Error getting context for Prelude. \"initdata\" argument NULL"); SCReturnInt(TM_ECODE_FAILED); } aun = SCMalloc(sizeof(AlertPreludeThread)); if (unlikely(aun == NULL)) SCReturnInt(TM_ECODE_FAILED); memset(aun, 0, sizeof(AlertPreludeThread)); /* Use the Ouput Context */ aun->ctx = ((OutputCtx *)initdata)->data; /* Create a per-thread idmef analyzer */ if (unlikely(idmef_analyzer_new(&aun->analyzer) < 0)) { SCLogError(SC_ERR_INITIALIZATION, "Error creating idmef analyzer for Prelude."); SCFree(aun); SCReturnInt(TM_ECODE_FAILED); } /* Setup the per-thread idmef analyzer */ if (unlikely(SetupAnalyzer(aun->analyzer) < 0)) { SCLogError(SC_ERR_INITIALIZATION, "Error configuring idmef analyzer for Prelude."); idmef_analyzer_destroy(aun->analyzer); SCFree(aun); SCReturnInt(TM_ECODE_FAILED); } *data = (void *)aun; SCReturnInt(TM_ECODE_OK); } /** * \brief Free thread-specific data. * * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED */ static TmEcode AlertPreludeThreadDeinit(ThreadVars *t, void *data) { AlertPreludeThread *aun = (AlertPreludeThread *)data; SCEnter(); if (unlikely(aun == NULL)) { SCLogDebug("AlertPreludeThreadDeinit done (error)"); SCReturnInt(TM_ECODE_FAILED); } /* clear memory */ idmef_analyzer_destroy(aun->analyzer); memset(aun, 0, sizeof(AlertPreludeThread)); SCFree(aun); SCReturnInt(TM_ECODE_OK); } static void AlertPreludeDeinitCtx(OutputCtx *output_ctx) { AlertPreludeCtx *ctx = (AlertPreludeCtx *)output_ctx->data; prelude_client_destroy(ctx->client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCFree(output_ctx); } /** \brief Initialize the Prelude logging module: initialize * library, create the client and try to establish the connection * to the Prelude Manager. * Client flags are set to force asynchronous (non-blocking) mode for * both alerts and heartbeats. * This function requires an existing Prelude profile to work. * * \return A newly allocated AlertPreludeCtx structure, or NULL */ static OutputCtx *AlertPreludeInitCtx(ConfNode *conf) { int ret; prelude_client_t *client; AlertPreludeCtx *ctx; const char *prelude_profile_name; const char *log_packet_content; const char *log_packet_header; OutputCtx *output_ctx; SCEnter(); ret = prelude_init(0, NULL); if (unlikely(ret < 0)) { prelude_perror(ret, "unable to initialize the prelude library"); SCReturnPtr(NULL, "AlertPreludeCtx"); } prelude_profile_name = ConfNodeLookupChildValue(conf, "profile"); if (prelude_profile_name == NULL) prelude_profile_name = DEFAULT_PRELUDE_PROFILE; log_packet_content = ConfNodeLookupChildValue(conf, "log-packet-content"); log_packet_header = ConfNodeLookupChildValue(conf, "log-packet-header"); ret = prelude_client_new(&client, prelude_profile_name); if ( unlikely(ret < 0 || client == NULL )) { prelude_perror(ret, "Unable to create a prelude client object"); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } ret = prelude_client_set_flags(client, prelude_client_get_flags(client) | PRELUDE_CLIENT_FLAGS_ASYNC_TIMER|PRELUDE_CLIENT_FLAGS_ASYNC_SEND); if (unlikely(ret < 0)) { SCLogDebug("Unable to set asynchronous send and timer."); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } ret = SetupAnalyzer(prelude_client_get_analyzer(client)); if (ret < 0) { SCLogDebug("Unable to setup prelude client analyzer."); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } ret = prelude_client_start(client); if (unlikely(ret < 0)) { prelude_perror(ret, "Unable to start prelude client"); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } ctx = SCMalloc(sizeof(AlertPreludeCtx)); if (unlikely(ctx == NULL)) { prelude_perror(ret, "Unable to allocate memory"); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } ctx->client = client; ctx->log_packet_content = 0; ctx->log_packet_header = 1; if (log_packet_content && ConfValIsTrue(log_packet_content)) ctx->log_packet_content = 1; if (log_packet_header && ConfValIsFalse(log_packet_header)) ctx->log_packet_header = 0; output_ctx = SCMalloc(sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(ctx); prelude_perror(ret, "Unable to allocate memory"); prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS); SCReturnPtr(NULL, "AlertPreludeCtx"); } output_ctx->data = ctx; output_ctx->DeInit = AlertPreludeDeinitCtx; SCReturnPtr((void*)output_ctx, "OutputCtx"); } static int AlertPreludeCondition(ThreadVars *tv, const Packet *p) { if (p->alerts.cnt == 0) return FALSE; if (!IPH_IS_VALID(p)) return FALSE; return TRUE; } /** * \brief Handle Suricata alert: convert it to and IDMEF alert (see RFC 4765) * and send it asynchronously (so, this function does not block and returns * immediately). * If the destination Prelude Manager is not available, the alert is spooled * (and the function also returns immediately). * An IDMEF object is created, and all available information is added: IP packet * header and data, rule signature ID, additional data like URL pointing to * rule description, CVE, etc. * The IDMEF alert has a reference to all created objects, so freeing it will * automatically free all allocated memory. * * \note This function is thread safe. * * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED */ static int AlertPreludeLogger(ThreadVars *tv, void *thread_data, const Packet *p) { AlertPreludeThread *apn = (AlertPreludeThread *)thread_data; int ret; idmef_time_t *time; idmef_alert_t *alert; prelude_string_t *str; idmef_message_t *idmef = NULL; idmef_classification_t *class; const PacketAlert *pa; SCEnter(); if (unlikely(apn == NULL || apn->ctx == NULL)) { SCReturnInt(TM_ECODE_FAILED); } if (p->alerts.cnt == 0) SCReturnInt(TM_ECODE_OK); if ( !IPH_IS_VALID(p) ) SCReturnInt(TM_ECODE_OK); /* XXX which one to add to this alert? Lets see how Snort solves this. * For now just take last alert. */ pa = &p->alerts.alerts[p->alerts.cnt-1]; if (unlikely(pa->s == NULL)) goto err; ret = idmef_message_new(&idmef); if (unlikely(ret < 0)) SCReturnInt(TM_ECODE_FAILED); ret = idmef_message_new_alert(idmef, &alert); if (unlikely(ret < 0)) goto err; ret = idmef_alert_new_classification(alert, &class); if (unlikely(ret < 0)) goto err; if (pa->s->msg) { ret = idmef_classification_new_text(class, &str); if (unlikely(ret < 0)) goto err; prelude_string_set_ref(str, pa->s->msg); } ret = EventToImpact(pa, p, alert); if (unlikely(ret < 0)) goto err; ret = EventToReference(pa, p, class); if (unlikely(ret < 0)) goto err; ret = EventToSourceTarget(p, alert); if (unlikely(ret < 0)) goto err; ret = PacketToData(p, pa, alert, apn->ctx); if (unlikely(ret < 0)) goto err; if (PKT_IS_TCP(p) && (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH)) { uint8_t flag; if (p->flowflags & FLOW_PKT_TOSERVER) { flag = FLOW_PKT_TOCLIENT; } else { flag = FLOW_PKT_TOSERVER; } ret = StreamSegmentForEach(p, flag, PreludePrintStreamSegmentCallback, (void *)alert); } if (unlikely(ret < 0)) goto err; ret = idmef_alert_new_detect_time(alert, &time); if (unlikely(ret < 0)) goto err; idmef_time_set_from_timeval(time, &p->ts); ret = idmef_time_new_from_gettimeofday(&time); if (unlikely(ret < 0)) goto err; idmef_alert_set_create_time(alert, time); idmef_alert_set_analyzer(alert, idmef_analyzer_ref(apn->analyzer), IDMEF_LIST_PREPEND); /* finally, send event */ prelude_client_send_idmef(apn->ctx->client, idmef); idmef_message_destroy(idmef); SCReturnInt(TM_ECODE_OK); err: if (idmef != NULL) idmef_message_destroy(idmef); SCReturnInt(TM_ECODE_FAILED); } void AlertPreludeRegister (void) { OutputRegisterPacketModule(LOGGER_PRELUDE, "AlertPrelude", "alert-prelude", AlertPreludeInitCtx, AlertPreludeLogger, AlertPreludeCondition, AlertPreludeThreadInit, AlertPreludeThreadDeinit, NULL); } #endif /* PRELUDE */ suricata-3.2.1/src/output-json-dnp3.h0000644000000000000000000000177413051004444014334 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __OUTPUT_JSON_DNP3_H__ #define __OUTPUT_JSON_DNP3_H__ #include "app-layer-dnp3.h" #ifdef HAVE_LIBJANSSON json_t *JsonDNP3LogRequest(DNP3Transaction *); json_t *JsonDNP3LogResponse(DNP3Transaction *); #endif /* HAVE_LIBJANSSON */ void JsonDNP3LogRegister(void); #endif /* __OUTPUT_JSON_DNP3_H__ */ suricata-3.2.1/src/detect-dsize.h0000644000000000000000000000216113051004444013536 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_DSIZE_H__ #define __DETECT_DSIZE_H__ #define DETECTDSIZE_LT 0 #define DETECTDSIZE_EQ 1 #define DETECTDSIZE_GT 2 #define DETECTDSIZE_RA 3 typedef struct DetectDsizeData_ { uint16_t dsize; uint16_t dsize2; uint8_t mode; } DetectDsizeData; /* prototypes */ void DetectDsizeRegister (void); #endif /* __DETECT_DSIZE_H__ */ suricata-3.2.1/src/util-runmodes.c0000644000000000000000000005316413051004444013765 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Helper function for runmode. * */ #include "suricata-common.h" #include "config.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-af-packet.h" #include "log-httplog.h" #include "output.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "alert-fastlog.h" #include "alert-prelude.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-device.h" #include "util-runmodes.h" #include "flow-hash.h" /** \brief create a queue string for autofp to pass to * the flow queue handler. * * The string will be "pickup1,pickup2,pickup3\0" */ char *RunmodeAutoFpCreatePickupQueuesString(int n) { char *queues = NULL; /* 13 because pickup12345, = 12 + \0 */ size_t queues_size = n * 13; int thread; char qname[TM_QUEUE_NAME_MAX]; queues = SCMalloc(queues_size); if (unlikely(queues == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "failed to alloc queues buffer: %s", strerror(errno)); return NULL; } memset(queues, 0x00, queues_size); for (thread = 0; thread < n; thread++) { if (strlen(queues) > 0) strlcat(queues, ",", queues_size); snprintf(qname, sizeof(qname), "pickup%d", thread+1); strlcat(queues, qname, queues_size); } SCLogDebug("%d %"PRIuMAX", queues %s", n, (uintmax_t)queues_size, queues); return queues; } /** */ int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev) { char tname[TM_THREAD_NAME_MAX]; char qname[TM_QUEUE_NAME_MAX]; char *queues = NULL; int thread = 0; /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); int nlive = LiveGetDeviceCount(); int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET); /* always create at least one thread */ if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; queues = RunmodeAutoFpCreatePickupQueuesString(thread_max); if (queues == NULL) { SCLogError(SC_ERR_RUNMODE, "RunmodeAutoFpCreatePickupQueuesString failed"); exit(EXIT_FAILURE); } if ((nlive <= 1) && (live_dev != NULL)) { void *aconf; int threads_count; SCLogDebug("live_dev %s", live_dev); aconf = ConfigParser(live_dev); if (aconf == NULL) { SCLogError(SC_ERR_RUNMODE, "Failed to allocate config for %s (%d)", live_dev, thread); exit(EXIT_FAILURE); } threads_count = ModThreadsCount(aconf); SCLogInfo("Going to use %" PRId32 " %s receive thread(s)", threads_count, recv_mod_name); /* create the threads */ for (thread = 0; thread < threads_count; thread++) { snprintf(tname, sizeof(tname), "%s#%02d", thread_name, thread+1); ThreadVars *tv_receive = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", queues, "flow", "pktacqloop"); if (tv_receive == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName(recv_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName failed for %s", recv_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, aconf); tm_module = TmModuleGetByName(decode_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName %s failed", decode_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, NULL); TmThreadSetCPU(tv_receive, RECEIVE_CPU_SET); if (TmThreadSpawn(tv_receive) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } } else { /* Multiple input device */ SCLogInfo("Using %d live device(s).", nlive); int lthread; for (lthread = 0; lthread < nlive; lthread++) { const char *dev = LiveGetDeviceName(lthread); const char *visual_devname = LiveGetShortName(live_dev); void *aconf; int threads_count; if (dev == NULL) { SCLogError(SC_ERR_RUNMODE, "Failed to lookup live dev %d", lthread); exit(EXIT_FAILURE); } SCLogDebug("dev %s", dev); aconf = ConfigParser(dev); if (aconf == NULL) { SCLogError(SC_ERR_RUNMODE, "Multidev: Failed to allocate config for %s (%d)", dev, lthread); exit(EXIT_FAILURE); } threads_count = ModThreadsCount(aconf); for (thread = 0; thread < threads_count; thread++) { snprintf(tname, sizeof(tname), "%s#%02d-%s", thread_name, thread+1, visual_devname); ThreadVars *tv_receive = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", queues, "flow", "pktacqloop"); if (tv_receive == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName(recv_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName failed for %s", recv_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, aconf); tm_module = TmModuleGetByName(decode_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName %s failed", decode_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, NULL); TmThreadSetCPU(tv_receive, RECEIVE_CPU_SET); if (TmThreadSpawn(tv_receive) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } } } for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "%s#%02d", thread_name_workers, thread+1); snprintf(qname, sizeof(qname), "pickup%d", thread+1); SCLogDebug("tname %s, qname %s", tname, qname); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(tname, qname, "flow", "packetpool", "packetpool", "varslot"); if (tv_detect_ncpu == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); TmThreadSetCPU(tv_detect_ncpu, WORKER_CPU_SET); TmThreadSetGroupName(tv_detect_ncpu, "Detect"); tm_module = TmModuleGetByName("RespondReject"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName RespondReject failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } SCFree(queues); return 0; } /** */ static int RunModeSetLiveCaptureWorkersForDevice(ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev, void *aconf, unsigned char single_mode) { int thread; int threads_count; if (single_mode) { threads_count = 1; } else { threads_count = ModThreadsCount(aconf); SCLogInfo("Going to use %" PRId32 " thread(s)", threads_count); } /* create the threads */ for (thread = 0; thread < threads_count; thread++) { char tname[TM_THREAD_NAME_MAX]; ThreadVars *tv = NULL; TmModule *tm_module = NULL; const char *visual_devname = LiveGetShortName(live_dev); if (single_mode) { snprintf(tname, sizeof(tname), "%s#01-%s", thread_name, visual_devname); } else { snprintf(tname, sizeof(tname), "%s#%02d-%s", thread_name, thread+1, visual_devname); } tv = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", "packetpool", "packetpool", "pktacqloop"); if (tv == NULL) { SCLogError(SC_ERR_THREAD_CREATE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName(recv_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "TmModuleGetByName failed for %s", recv_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, aconf); tm_module = TmModuleGetByName(decode_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "TmModuleGetByName %s failed", decode_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("RespondReject"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName RespondReject failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); TmThreadSetCPU(tv, WORKER_CPU_SET); if (TmThreadSpawn(tv) != TM_ECODE_OK) { SCLogError(SC_ERR_THREAD_SPAWN, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } return 0; } int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev) { int nlive = LiveGetDeviceCount(); void *aconf; int ldev; for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev_c = NULL; if ((nlive <= 1) && (live_dev != NULL)) { aconf = ConfigParser(live_dev); live_dev_c = live_dev; if (unlikely(live_dev_c == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate interface name"); exit(EXIT_FAILURE); } } else { live_dev_c = LiveGetDeviceName(ldev); aconf = ConfigParser(live_dev_c); } RunModeSetLiveCaptureWorkersForDevice(ModThreadsCount, recv_mod_name, decode_mod_name, thread_name, live_dev_c, aconf, 0); } return 0; } int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev) { int nlive = LiveGetDeviceCount(); const char *live_dev_c = NULL; void *aconf; if (nlive > 1) { SCLogError(SC_ERR_RUNMODE, "Can't use single runmode with multiple device"); exit(EXIT_FAILURE); } if (live_dev != NULL) { aconf = ConfigParser(live_dev); live_dev_c = live_dev; } else { live_dev_c = LiveGetDeviceName(0); aconf = ConfigParser(live_dev_c); /* \todo Set threads number in config to 1 */ } return RunModeSetLiveCaptureWorkersForDevice( ModThreadsCount, recv_mod_name, decode_mod_name, thread_name, live_dev_c, aconf, 1); } /** */ int RunModeSetIPSAutoFp(ConfigIPSParserFunc ConfigParser, const char *recv_mod_name, const char *verdict_mod_name, const char *decode_mod_name) { SCEnter(); char tname[TM_THREAD_NAME_MAX]; char qname[TM_QUEUE_NAME_MAX]; TmModule *tm_module ; const char *cur_queue = NULL; char *queues = NULL; int thread; /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); int nqueue = LiveGetDeviceCount(); int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET); /* always create at least one thread */ if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; queues = RunmodeAutoFpCreatePickupQueuesString(thread_max); if (queues == NULL) { SCLogError(SC_ERR_RUNMODE, "RunmodeAutoFpCreatePickupQueuesString failed"); exit(EXIT_FAILURE); } for (int i = 0; i < nqueue; i++) { /* create the threads */ cur_queue = LiveGetDeviceName(i); if (cur_queue == NULL) { SCLogError(SC_ERR_RUNMODE, "invalid queue number"); exit(EXIT_FAILURE); } memset(tname, 0, sizeof(tname)); snprintf(tname, sizeof(tname), "%s-Q%s", thread_name_autofp, cur_queue); ThreadVars *tv_receive = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", queues, "flow", "pktacqloop"); if (tv_receive == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName(recv_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName failed for %s", recv_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, (void *) ConfigParser(i)); tm_module = TmModuleGetByName(decode_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName %s failed", decode_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receive, tm_module, NULL); TmThreadSetCPU(tv_receive, RECEIVE_CPU_SET); if (TmThreadSpawn(tv_receive) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "%s#%02d", thread_name_workers, thread+1); snprintf(qname, sizeof(qname), "pickup%d", thread+1); SCLogDebug("tname %s, qname %s", tname, qname); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(tname, qname, "flow", "verdict-queue", "simple", "varslot"); if (tv_detect_ncpu == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); TmThreadSetCPU(tv_detect_ncpu, WORKER_CPU_SET); TmThreadSetGroupName(tv_detect_ncpu, "Detect"); if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } /* create the threads */ for (int i = 0; i < nqueue; i++) { memset(tname, 0, sizeof(tname)); snprintf(tname, sizeof(tname), "%s#%02d", thread_name_verdict, i); ThreadVars *tv_verdict = TmThreadCreatePacketHandler(tname, "verdict-queue", "simple", "packetpool", "packetpool", "varslot"); if (tv_verdict == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName(verdict_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName %s failed", verdict_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_verdict, tm_module, (void *)ConfigParser(i)); tm_module = TmModuleGetByName("RespondReject"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for RespondReject failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_verdict, tm_module, NULL); TmThreadSetCPU(tv_verdict, VERDICT_CPU_SET); if (TmThreadSpawn(tv_verdict) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } SCFree(queues); return 0; } /** */ int RunModeSetIPSWorker(ConfigIPSParserFunc ConfigParser, const char *recv_mod_name, const char *verdict_mod_name, const char *decode_mod_name) { char tname[TM_THREAD_NAME_MAX]; ThreadVars *tv = NULL; TmModule *tm_module = NULL; const char *cur_queue = NULL; int nqueue = LiveGetDeviceCount(); for (int i = 0; i < nqueue; i++) { /* create the threads */ cur_queue = LiveGetDeviceName(i); if (cur_queue == NULL) { SCLogError(SC_ERR_RUNMODE, "invalid queue number"); exit(EXIT_FAILURE); } memset(tname, 0, sizeof(tname)); snprintf(tname, sizeof(tname), "%s-Q%s", thread_name_workers, cur_queue); tv = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", "packetpool", "packetpool", "pktacqloop"); if (tv == NULL) { SCLogError(SC_ERR_THREAD_CREATE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName(recv_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "TmModuleGetByName failed for %s", recv_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, (void *) ConfigParser(i)); tm_module = TmModuleGetByName(decode_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "TmModuleGetByName %s failed", decode_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName(verdict_mod_name); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName %s failed", verdict_mod_name); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, (void *) ConfigParser(i)); tm_module = TmModuleGetByName("RespondReject"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for RespondReject failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); TmThreadSetCPU(tv, WORKER_CPU_SET); if (TmThreadSpawn(tv) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } } return 0; } suricata-3.2.1/src/app-layer-tls-handshake.h0000644000000000000000000000333413051004444015573 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * */ #ifndef __APP_LAYER_TLS_HANDSHAKE_H__ #define __APP_LAYER_TLS_HANDSHAKE_H__ int DecodeTLSHandshakeServerCertificate(SSLState *ssl_state, uint8_t *input, uint32_t input_len); #endif /* __APP_LAYER_TLS_HANDSHAKE_H__ */ suricata-3.2.1/src/stream-tcp-inline.h0000644000000000000000000000214313051004444014505 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __STREAM_TCP_INLINE_H__ #define __STREAM_TCP_INLINE_H__ #include "stream-tcp-private.h" int StreamTcpInlineMode(void); int StreamTcpInlineSegmentCompare(TcpSegment *, TcpSegment *); void StreamTcpInlineSegmentReplacePacket(Packet *, TcpSegment *); void StreamTcpInlineRegisterTests(void); #endif /* __STREAM_TCP_INLINE_H__ */ suricata-3.2.1/src/detect-tos.h0000644000000000000000000000173513051004444013233 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_TOS_H__ #define __DETECT_TOS_H__ typedef struct DetectTosData_ { uint8_t negated; uint8_t tos; } DetectTosData; void DetectTosRegister(void); #endif /* __DETECT_TOS_H__ */ suricata-3.2.1/src/detect-ssl-state.c0000644000000000000000000007623413051004444014346 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements support for ssl_state keyword. */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "detect-ssl-state.h" #include "stream-tcp.h" #include "app-layer-ssl.h" #define PARSE_REGEX1 "^\\s*(!?)([_a-zA-Z0-9]+)(.*)$" static pcre *parse_regex1; static pcre_extra *parse_regex1_study; #define PARSE_REGEX2 "^(?:\\s*[|,]\\s*(!?)([_a-zA-Z0-9]+))(.*)$" static pcre *parse_regex2; static pcre_extra *parse_regex2_study; int DetectSslStateMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); int DetectSslStateSetup(DetectEngineCtx *, Signature *, char *); void DetectSslStateRegisterTests(void); void DetectSslStateFree(void *); /** * \brief Registers the keyword handlers for the "ssl_state" keyword. */ void DetectSslStateRegister(void) { sigmatch_table[DETECT_AL_SSL_STATE].name = "ssl_state"; sigmatch_table[DETECT_AL_SSL_STATE].Match = NULL; sigmatch_table[DETECT_AL_SSL_STATE].AppLayerMatch = DetectSslStateMatch; sigmatch_table[DETECT_AL_SSL_STATE].Setup = DetectSslStateSetup; sigmatch_table[DETECT_AL_SSL_STATE].Free = DetectSslStateFree; sigmatch_table[DETECT_AL_SSL_STATE].RegisterTests = DetectSslStateRegisterTests; DetectSetupParseRegexes(PARSE_REGEX1, &parse_regex1, &parse_regex1_study); DetectSetupParseRegexes(PARSE_REGEX2, &parse_regex2, &parse_regex2_study); } /** * \brief App layer match function ssl_state keyword. * * \param tv Pointer to threadvars. * \param det_ctx Pointer to the thread's detection context. * \param f Pointer to the flow. * \param flags Flags. * \param state App layer state. * \param s Sig we are currently inspecting. * \param m SigMatch we are currently inspecting. * * \retval 1 Match. * \retval 0 No match. */ int DetectSslStateMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *alstate, Signature *s, SigMatch *m) { DetectSslStateData *ssd = (DetectSslStateData *)m->ctx; SSLState *ssl_state = (SSLState *)alstate; if (ssl_state == NULL) { SCLogDebug("no app state, no match"); return 0; } uint32_t ssl_flags = ssl_state->current_flags; if ((ssd->flags & ssl_flags) ^ ssd->mask) { return 1; } return 0; } /** * \brief Parse the arg supplied with ssl_state and return it in a * DetectSslStateData instance. * * \param arg Pointer to the string to be parsed. * * \retval ssd Pointer to DetectSslStateData on succese. * \retval NULL On failure. */ DetectSslStateData *DetectSslStateParse(char *arg) { #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov1[MAX_SUBSTRINGS]; int ov2[MAX_SUBSTRINGS]; const char *str1; const char *str2; int negate = 0; uint32_t flags = 0, mask = 0; DetectSslStateData *ssd = NULL; ret = pcre_exec(parse_regex1, parse_regex1_study, arg, strlen(arg), 0, 0, ov1, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid arg \"%s\" supplied to " "ssl_state keyword.", arg); goto error; } res = pcre_get_substring((char *)arg, ov1, MAX_SUBSTRINGS, 1, &str1); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } negate = !strcmp("!", str1); pcre_free_substring(str1); res = pcre_get_substring((char *)arg, ov1, MAX_SUBSTRINGS, 2, &str1); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (strcmp("client_hello", str1) == 0) { flags |= DETECT_SSL_STATE_CLIENT_HELLO; if (negate) mask |= DETECT_SSL_STATE_CLIENT_HELLO; } else if (strcmp("server_hello", str1) == 0) { flags |= DETECT_SSL_STATE_SERVER_HELLO; if (negate) mask |= DETECT_SSL_STATE_SERVER_HELLO; } else if (strcmp("client_keyx", str1) == 0) { flags |= DETECT_SSL_STATE_CLIENT_KEYX; if (negate) mask |= DETECT_SSL_STATE_CLIENT_KEYX; } else if (strcmp("server_keyx", str1) == 0) { flags |= DETECT_SSL_STATE_SERVER_KEYX; if (negate) mask |= DETECT_SSL_STATE_SERVER_KEYX; } else if (strcmp("unknown", str1) == 0) { flags |= DETECT_SSL_STATE_UNKNOWN; if (negate) mask |= DETECT_SSL_STATE_UNKNOWN; } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "Found invalid option \"%s\" " "in ssl_state keyword.", str1); goto error; } pcre_free_substring(str1); res = pcre_get_substring((char *)arg, ov1, MAX_SUBSTRINGS, 3, &str1); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } while (res > 0) { ret = pcre_exec(parse_regex2, parse_regex2_study, str1, strlen(str1), 0, 0, ov2, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid arg \"%s\" supplied to " "ssl_state keyword.", arg); goto error; } res = pcre_get_substring((char *)str1, ov2, MAX_SUBSTRINGS, 1, &str2); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } negate = !strcmp("!", str2); pcre_free_substring(str2); res = pcre_get_substring((char *)str1, ov2, MAX_SUBSTRINGS, 2, &str2); if (res <= 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (strcmp("client_hello", str2) == 0) { flags |= DETECT_SSL_STATE_CLIENT_HELLO; if (negate) mask |= DETECT_SSL_STATE_CLIENT_HELLO; } else if (strcmp("server_hello", str2) == 0) { flags |= DETECT_SSL_STATE_SERVER_HELLO; if (negate) mask |= DETECT_SSL_STATE_SERVER_HELLO; } else if (strcmp("client_keyx", str2) == 0) { flags |= DETECT_SSL_STATE_CLIENT_KEYX; if (negate) mask |= DETECT_SSL_STATE_CLIENT_KEYX; } else if (strcmp("server_keyx", str2) == 0) { flags |= DETECT_SSL_STATE_SERVER_KEYX; if (negate) mask |= DETECT_SSL_STATE_SERVER_KEYX; } else if (strcmp("unknown", str2) == 0) { flags |= DETECT_SSL_STATE_UNKNOWN; if (negate) mask |= DETECT_SSL_STATE_UNKNOWN; } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "Found invalid option \"%s\" " "in ssl_state keyword.", str2); goto error; } res = pcre_get_substring((char *)str1, ov2, MAX_SUBSTRINGS, 3, &str2); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } pcre_free_substring(str1); str1 = str2; } pcre_free_substring(str1); if ( (ssd = SCMalloc(sizeof(DetectSslStateData))) == NULL) { goto error; } ssd->flags = flags; ssd->mask = mask; return ssd; error: return NULL; } /** * \internal * \brief Setup function for ssl_state keyword. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature * \param arg String holding the arg. * * \retval 0 On success. * \retval -1 On failure. */ int DetectSslStateSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectSslStateData *ssd = NULL; SigMatch *sm = NULL; ssd = DetectSslStateParse(arg); if (ssd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_SSL_STATE; sm->ctx = (SigMatchCtx*)ssd; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Rule contains conflicting keywords. Have non-tls alproto " "set for a rule containing \"ssl_state\" keyword"); goto error; } s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (ssd != NULL) DetectSslStateFree(ssd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief Free memory associated with DetectSslStateData. * * \param ptr pointer to the data to be freed. */ void DetectSslStateFree(void *ptr) { if (ptr != NULL) SCFree(ptr); return; } /************************************Unittests*********************************/ #ifdef UNITTESTS int DetectSslStateTest01(void) { DetectSslStateData *ssd = DetectSslStateParse("client_hello"); FAIL_IF_NULL(ssd); FAIL_IF_NOT(ssd->flags == DETECT_SSL_STATE_CLIENT_HELLO); SCFree(ssd); PASS; } int DetectSslStateTest02(void) { DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_hello"); FAIL_IF_NULL(ssd); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO | DETECT_SSL_STATE_CLIENT_HELLO)); SCFree(ssd); PASS; } int DetectSslStateTest03(void) { DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " "client_hello"); FAIL_IF_NULL(ssd); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO | DETECT_SSL_STATE_CLIENT_KEYX | DETECT_SSL_STATE_CLIENT_HELLO)); SCFree(ssd); PASS; } int DetectSslStateTest04(void) { DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " "client_hello , server_keyx , " "unknown"); FAIL_IF_NULL(ssd); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO | DETECT_SSL_STATE_CLIENT_KEYX | DETECT_SSL_STATE_CLIENT_HELLO | DETECT_SSL_STATE_SERVER_KEYX | DETECT_SSL_STATE_UNKNOWN)); SCFree(ssd); PASS; } int DetectSslStateTest05(void) { DetectSslStateData *ssd = DetectSslStateParse(", server_hello , client_keyx , " "client_hello , server_keyx , " "unknown"); FAIL_IF_NOT_NULL(ssd); PASS; } int DetectSslStateTest06(void) { DetectSslStateData *ssd = DetectSslStateParse("server_hello , client_keyx , " "client_hello , server_keyx , " "unknown , "); FAIL_IF_NOT_NULL(ssd); PASS; } /** * \test Test a valid dce_iface entry for a bind and bind_ack */ static int DetectSslStateTest07(void) { uint8_t chello_buf[] = { 0x80, 0x67, 0x01, 0x03, 0x00, 0x00, 0x4e, 0x00, 0x00, 0x00, 0x10, 0x01, 0x00, 0x80, 0x03, 0x00, 0x80, 0x07, 0x00, 0xc0, 0x06, 0x00, 0x40, 0x02, 0x00, 0x80, 0x04, 0x00, 0x80, 0x00, 0x00, 0x39, 0x00, 0x00, 0x38, 0x00, 0x00, 0x35, 0x00, 0x00, 0x33, 0x00, 0x00, 0x32, 0x00, 0x00, 0x04, 0x00, 0x00, 0x05, 0x00, 0x00, 0x2f, 0x00, 0x00, 0x16, 0x00, 0x00, 0x13, 0x00, 0xfe, 0xff, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x15, 0x00, 0x00, 0x12, 0x00, 0xfe, 0xfe, 0x00, 0x00, 0x09, 0x00, 0x00, 0x64, 0x00, 0x00, 0x62, 0x00, 0x00, 0x03, 0x00, 0x00, 0x06, 0xa8, 0xb8, 0x93, 0xbb, 0x90, 0xe9, 0x2a, 0xa2, 0x4d, 0x6d, 0xcc, 0x1c, 0xe7, 0x2a, 0x80, 0x21 }; uint32_t chello_buf_len = sizeof(chello_buf); uint8_t shello_buf[] = { 0x16, 0x03, 0x00, 0x00, 0x4a, 0x02, 0x00, 0x00, 0x46, 0x03, 0x00, 0x44, 0x4c, 0x94, 0x8f, 0xfe, 0x81, 0xed, 0x93, 0x65, 0x02, 0x88, 0xa3, 0xf8, 0xeb, 0x63, 0x86, 0x0e, 0x2c, 0xf6, 0x8d, 0xd0, 0x0f, 0x2c, 0x2a, 0xd6, 0x4f, 0xcd, 0x2d, 0x3c, 0x16, 0xd7, 0xd6, 0x20, 0xa0, 0xfb, 0x60, 0x86, 0x3d, 0x1e, 0x76, 0xf3, 0x30, 0xfe, 0x0b, 0x01, 0xfd, 0x1a, 0x01, 0xed, 0x95, 0xf6, 0x7b, 0x8e, 0xc0, 0xd4, 0x27, 0xbf, 0xf0, 0x6e, 0xc7, 0x56, 0xb1, 0x47, 0xce, 0x98, 0x00, 0x35, 0x00, 0x16, 0x03, 0x00, 0x03, 0x44, 0x0b, 0x00, 0x03, 0x40, 0x00, 0x03, 0x3d, 0x00, 0x03, 0x3a, 0x30, 0x82, 0x03, 0x36, 0x30, 0x82, 0x02, 0x9f, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x30, 0x81, 0xa9, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x58, 0x59, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x44, 0x65, 0x73, 0x65, 0x72, 0x74, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x54, 0x6f, 0x77, 0x6e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x2c, 0x20, 0x4c, 0x74, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x15, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x20, 0x43, 0x41, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0f, 0x63, 0x61, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x33, 0x30, 0x33, 0x30, 0x35, 0x31, 0x36, 0x34, 0x37, 0x34, 0x35, 0x5a, 0x17, 0x0d, 0x30, 0x38, 0x30, 0x33, 0x30, 0x33, 0x31, 0x36, 0x34, 0x37, 0x34, 0x35, 0x5a, 0x30, 0x81, 0xa7, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x58, 0x59, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x44, 0x65, 0x73, 0x65, 0x72, 0x74, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x54, 0x6f, 0x77, 0x6e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x2c, 0x20, 0x4c, 0x74, 0x64, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0e, 0x57, 0x65, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x54, 0x65, 0x61, 0x6d, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x77, 0x77, 0x77, 0x2e, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x10, 0x77, 0x77, 0x77, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xa4, 0x6e, 0x53, 0x14, 0x0a, 0xde, 0x2c, 0xe3, 0x60, 0x55, 0x9a, 0xf2, 0x42, 0xa6, 0xaf, 0x47, 0x12, 0x2f, 0x17, 0xce, 0xfa, 0xba, 0xdc, 0x4e, 0x63, 0x56, 0x34, 0xb9, 0xba, 0x73, 0x4b, 0x78, 0x44, 0x3d, 0xc6, 0x6c, 0x69, 0xa4, 0x25, 0xb3, 0x61, 0x02, 0x9d, 0x09, 0x04, 0x3f, 0x72, 0x3d, 0xd8, 0x27, 0xd3, 0xb0, 0x5a, 0x45, 0x77, 0xb7, 0x36, 0xe4, 0x26, 0x23, 0xcc, 0x12, 0xb8, 0xae, 0xde, 0xa7, 0xb6, 0x3a, 0x82, 0x3c, 0x7c, 0x24, 0x59, 0x0a, 0xf8, 0x96, 0x43, 0x8b, 0xa3, 0x29, 0x36, 0x3f, 0x91, 0x7f, 0x5d, 0xc7, 0x23, 0x94, 0x29, 0x7f, 0x0a, 0xce, 0x0a, 0xbd, 0x8d, 0x9b, 0x2f, 0x19, 0x17, 0xaa, 0xd5, 0x8e, 0xec, 0x66, 0xa2, 0x37, 0xeb, 0x3f, 0x57, 0x53, 0x3c, 0xf2, 0xaa, 0xbb, 0x79, 0x19, 0x4b, 0x90, 0x7e, 0xa7, 0xa3, 0x99, 0xfe, 0x84, 0x4c, 0x89, 0xf0, 0x3d, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x6e, 0x30, 0x6c, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x14, 0x30, 0x12, 0x81, 0x10, 0x77, 0x77, 0x77, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x3a, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x0d, 0x04, 0x2d, 0x16, 0x2b, 0x6d, 0x6f, 0x64, 0x5f, 0x73, 0x73, 0x6c, 0x20, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x20, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x30, 0x11, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x01, 0x04, 0x04, 0x03, 0x02, 0x06, 0x40, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0xae, 0x79, 0x79, 0x22, 0x90, 0x75, 0xfd, 0xa6, 0xd5, 0xc4, 0xb8, 0xc4, 0x99, 0x4e, 0x1c, 0x05, 0x7c, 0x91, 0x59, 0xbe, 0x89, 0x0d, 0x3d, 0xc6, 0x8c, 0xa3, 0xcf, 0xf6, 0xba, 0x23, 0xdf, 0xb8, 0xae, 0x44, 0x68, 0x8a, 0x8f, 0xb9, 0x8b, 0xcb, 0x12, 0xda, 0xe6, 0xa2, 0xca, 0xa5, 0xa6, 0x55, 0xd9, 0xd2, 0xa1, 0xad, 0xba, 0x9b, 0x2c, 0x44, 0x95, 0x1d, 0x4a, 0x90, 0x59, 0x7f, 0x83, 0xae, 0x81, 0x5e, 0x3f, 0x92, 0xe0, 0x14, 0x41, 0x82, 0x4e, 0x7f, 0x53, 0xfd, 0x10, 0x23, 0xeb, 0x8a, 0xeb, 0xe9, 0x92, 0xea, 0x61, 0xf2, 0x8e, 0x19, 0xa1, 0xd3, 0x49, 0xc0, 0x84, 0x34, 0x1e, 0x2e, 0x6e, 0xf6, 0x98, 0xe2, 0x87, 0x53, 0xd6, 0x55, 0xd9, 0x1a, 0x8a, 0x92, 0x5c, 0xad, 0xdc, 0x1e, 0x1c, 0x30, 0xa7, 0x65, 0x9d, 0xc2, 0x4f, 0x60, 0xd2, 0x6f, 0xdb, 0xe0, 0x9f, 0x9e, 0xbc, 0x41, 0x16, 0x03, 0x00, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00 }; uint32_t shello_buf_len = sizeof(shello_buf); uint8_t client_change_cipher_spec_buf[] = { 0x16, 0x03, 0x00, 0x00, 0x84, 0x10, 0x00, 0x00, 0x80, 0x65, 0x51, 0x2d, 0xa6, 0xd4, 0xa7, 0x38, 0xdf, 0xac, 0x79, 0x1f, 0x0b, 0xd9, 0xb2, 0x61, 0x7d, 0x73, 0x88, 0x32, 0xd9, 0xf2, 0x62, 0x3a, 0x8b, 0x11, 0x04, 0x75, 0xca, 0x42, 0xff, 0x4e, 0xd9, 0xcc, 0xb9, 0xfa, 0x86, 0xf3, 0x16, 0x2f, 0x09, 0x73, 0x51, 0x66, 0xaa, 0x29, 0xcd, 0x80, 0x61, 0x0f, 0xe8, 0x13, 0xce, 0x5b, 0x8e, 0x0a, 0x23, 0xf8, 0x91, 0x5e, 0x5f, 0x54, 0x70, 0x80, 0x8e, 0x7b, 0x28, 0xef, 0xb6, 0x69, 0xb2, 0x59, 0x85, 0x74, 0x98, 0xe2, 0x7e, 0xd8, 0xcc, 0x76, 0x80, 0xe1, 0xb6, 0x45, 0x4d, 0xc7, 0xcd, 0x84, 0xce, 0xb4, 0x52, 0x79, 0x74, 0xcd, 0xe6, 0xd7, 0xd1, 0x9c, 0xad, 0xef, 0x63, 0x6c, 0x0f, 0xf7, 0x05, 0xe4, 0x4d, 0x1a, 0xd3, 0xcb, 0x9c, 0xd2, 0x51, 0xb5, 0x61, 0xcb, 0xff, 0x7c, 0xee, 0xc7, 0xbc, 0x5e, 0x15, 0xa3, 0xf2, 0x52, 0x0f, 0xbb, 0x32, 0x14, 0x03, 0x00, 0x00, 0x01, 0x01, 0x16, 0x03, 0x00, 0x00, 0x40, 0xa9, 0xd8, 0xd7, 0x35, 0xbc, 0x39, 0x56, 0x98, 0xad, 0x87, 0x61, 0x2a, 0xc4, 0x8f, 0xcc, 0x03, 0xcb, 0x93, 0x80, 0x81, 0xb0, 0x4a, 0xc4, 0xd2, 0x09, 0x71, 0x3e, 0x90, 0x3c, 0x8d, 0xe0, 0x95, 0x44, 0xfe, 0x56, 0xd1, 0x7e, 0x88, 0xe2, 0x48, 0xfd, 0x76, 0x70, 0x76, 0xe2, 0xcd, 0x06, 0xd0, 0xf3, 0x9d, 0x13, 0x79, 0x67, 0x1e, 0x37, 0xf6, 0x98, 0xbe, 0x59, 0x18, 0x4c, 0xfc, 0x75, 0x56 }; uint32_t client_change_cipher_spec_buf_len = sizeof(client_change_cipher_spec_buf); uint8_t server_change_cipher_spec_buf[] = { 0x14, 0x03, 0x00, 0x00, 0x01, 0x01, 0x16, 0x03, 0x00, 0x00, 0x40, 0xce, 0x7c, 0x92, 0x43, 0x59, 0xcc, 0x3d, 0x90, 0x91, 0x9c, 0x58, 0xf0, 0x7a, 0xce, 0xae, 0x0d, 0x08, 0xe0, 0x76, 0xb4, 0x86, 0xb1, 0x15, 0x5b, 0x32, 0xb8, 0x77, 0x53, 0xe7, 0xa6, 0xf9, 0xd0, 0x95, 0x5f, 0xaa, 0x07, 0xc3, 0x96, 0x7c, 0xc9, 0x88, 0xc2, 0x7a, 0x20, 0x89, 0x4f, 0xeb, 0xeb, 0xb6, 0x19, 0xef, 0xaa, 0x27, 0x73, 0x9d, 0xa6, 0xb4, 0x9f, 0xeb, 0x34, 0xe2, 0x4d, 0x9f, 0x6b }; uint32_t server_change_cipher_spec_buf_len = sizeof(server_change_cipher_spec_buf); uint8_t toserver_app_data_buf[] = { 0x17, 0x03, 0x00, 0x01, 0xb0, 0x4a, 0xc3, 0x3e, 0x9d, 0x77, 0x78, 0x01, 0x2c, 0xb4, 0xbc, 0x4c, 0x9a, 0x84, 0xd7, 0xb9, 0x90, 0x0c, 0x21, 0x10, 0xf0, 0xfa, 0x00, 0x7c, 0x16, 0xbb, 0x77, 0xfb, 0x72, 0x42, 0x4f, 0xad, 0x50, 0x4a, 0xd0, 0xaa, 0x6f, 0xaa, 0x44, 0x6c, 0x62, 0x94, 0x1b, 0xc5, 0xfe, 0xe9, 0x1c, 0x5e, 0xde, 0x85, 0x0b, 0x0e, 0x05, 0xe4, 0x18, 0x6e, 0xd2, 0xd3, 0xb5, 0x20, 0xab, 0x81, 0xfd, 0x18, 0x9a, 0x73, 0xb8, 0xd7, 0xef, 0xc3, 0xdd, 0x74, 0xd7, 0x9c, 0x1e, 0x6f, 0x21, 0x6d, 0xf8, 0x24, 0xca, 0x3c, 0x70, 0x78, 0x36, 0x12, 0x7a, 0x8a, 0x9c, 0xac, 0x4e, 0x1c, 0xa8, 0xfb, 0x27, 0x30, 0xba, 0x9a, 0xf4, 0x2f, 0x0a, 0xab, 0x80, 0x6a, 0xa1, 0x60, 0x74, 0xf0, 0xe3, 0x91, 0x84, 0xe7, 0x90, 0x88, 0xcc, 0xf0, 0x95, 0x7b, 0x0a, 0x22, 0xf2, 0xf9, 0x27, 0xe0, 0xdd, 0x38, 0x0c, 0xfd, 0xe9, 0x03, 0x71, 0xdc, 0x70, 0xa4, 0x6e, 0xdf, 0xe3, 0x72, 0x9e, 0xa1, 0xf0, 0xc9, 0x00, 0xd6, 0x03, 0x55, 0x6a, 0x67, 0x5d, 0x9c, 0xb8, 0x75, 0x01, 0xb0, 0x01, 0x9f, 0xe6, 0xd2, 0x44, 0x18, 0xbc, 0xca, 0x7a, 0x10, 0x39, 0xa6, 0xcf, 0x15, 0xc7, 0xf5, 0x35, 0xd4, 0xb3, 0x6d, 0x91, 0x23, 0x84, 0x99, 0xba, 0xb0, 0x7e, 0xd0, 0xc9, 0x4c, 0xbf, 0x3f, 0x33, 0x68, 0x37, 0xb7, 0x7d, 0x44, 0xb0, 0x0b, 0x2c, 0x0f, 0xd0, 0x75, 0xa2, 0x6b, 0x5b, 0xe1, 0x9f, 0xd4, 0x69, 0x9a, 0x14, 0xc8, 0x29, 0xb7, 0xd9, 0x10, 0xbb, 0x99, 0x30, 0x9a, 0xfb, 0xcc, 0x13, 0x1f, 0x76, 0x4e, 0xe6, 0xdf, 0x14, 0xaa, 0xd5, 0x60, 0xbf, 0x91, 0x49, 0x0d, 0x64, 0x42, 0x29, 0xa8, 0x64, 0x27, 0xd4, 0x5e, 0x1b, 0x18, 0x03, 0xa8, 0x73, 0xd6, 0x05, 0x6e, 0xf7, 0x50, 0xb0, 0x09, 0x6b, 0x69, 0x7a, 0x12, 0x28, 0x58, 0xef, 0x5a, 0x86, 0x11, 0xde, 0x71, 0x71, 0x9f, 0xca, 0xbd, 0x79, 0x2a, 0xc2, 0xe5, 0x9b, 0x5e, 0x32, 0xe7, 0xcb, 0x97, 0x6e, 0xa0, 0xea, 0xa4, 0xa4, 0x6a, 0x32, 0xf9, 0x37, 0x39, 0xd8, 0x37, 0x6d, 0x63, 0xf3, 0x08, 0x1c, 0xdd, 0x06, 0xdd, 0x2c, 0x2b, 0x9f, 0x04, 0x88, 0x5f, 0x36, 0x42, 0xc1, 0xb1, 0xc7, 0xe8, 0x2d, 0x5d, 0xa4, 0x6c, 0xe5, 0x60, 0x94, 0xae, 0xd0, 0x90, 0x1e, 0x88, 0xa0, 0x87, 0x52, 0xfb, 0xed, 0x97, 0xa5, 0x25, 0x5a, 0xb7, 0x55, 0xc5, 0x13, 0x07, 0x85, 0x27, 0x40, 0xed, 0xb8, 0xa0, 0x26, 0x13, 0x44, 0x0c, 0xfc, 0xcc, 0x5a, 0x09, 0xe5, 0x44, 0xb5, 0x63, 0xa1, 0x43, 0x51, 0x23, 0x4f, 0x17, 0x21, 0x89, 0x2e, 0x58, 0xfd, 0xf9, 0x63, 0x74, 0x04, 0x70, 0x1e, 0x7d, 0xd0, 0x66, 0xba, 0x40, 0x5e, 0x45, 0xdc, 0x39, 0x7c, 0x53, 0x0f, 0xa8, 0x38, 0xb2, 0x13, 0x99, 0x27, 0xd9, 0x4a, 0x51, 0xe9, 0x9f, 0x2a, 0x92, 0xbb, 0x9c, 0x90, 0xab, 0xfd, 0xf1, 0xb7, 0x40, 0x05, 0xa9, 0x7a, 0x20, 0x63, 0x36, 0xc1, 0xef, 0xb9, 0xad, 0xa2, 0xe0, 0x1d, 0x20, 0x4f, 0xb2, 0x34, 0xbd, 0xea, 0x07, 0xac, 0x21, 0xce, 0xf6, 0x8a, 0xa2, 0x9e, 0xcd, 0xfa }; uint32_t toserver_app_data_buf_len = sizeof(toserver_app_data_buf); Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; SSLState *ssl_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"ssl state\"; ssl_state:client_hello; " "sid:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"ssl state\"; " "ssl_state:server_hello; " "sid:2;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"ssl state\"; " "ssl_state:client_keyx; " "sid:3;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"ssl state\"; " "ssl_state:server_keyx; " "sid:4;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"ssl state\"; " "ssl_state:!client_hello; " "sid:5;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_START, chello_buf, chello_buf_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); ssl_state = f.alstate; FAIL_IF(ssl_state == NULL); /* do detect */ p->alerts.cnt = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); FAIL_IF(PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); FAIL_IF(PacketAlertCheck(p, 5)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, shello_buf, shello_buf_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ p->alerts.cnt = 0; p->flowflags = (FLOW_PKT_TOCLIENT | FLOW_PKT_ESTABLISHED); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); FAIL_IF(!PacketAlertCheck(p, 2)); FAIL_IF(PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); FAIL_IF(!PacketAlertCheck(p, 5)); PASS; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_change_cipher_spec_buf, client_change_cipher_spec_buf_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ p->alerts.cnt = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); FAIL_IF(!PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_change_cipher_spec_buf, server_change_cipher_spec_buf_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ p->alerts.cnt = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); FAIL_IF(PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, toserver_app_data_buf, toserver_app_data_buf_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ p->alerts.cnt = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); FAIL_IF(PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } /** * \brief Test that the "|" character still works as a separate for * compatibility with older Suricata rules. */ int DetectSslStateTest08(void) { DetectSslStateData *ssd = DetectSslStateParse("server_hello|client_hello"); FAIL_IF_NULL(ssd); FAIL_IF_NOT(ssd->flags == (DETECT_SSL_STATE_SERVER_HELLO | DETECT_SSL_STATE_CLIENT_HELLO)); SCFree(ssd); PASS; } /** * \test Test parsing of negated states. */ int DetectSslStateTestParseNegate(void) { DetectSslStateData *ssd = DetectSslStateParse("!client_hello"); FAIL_IF_NULL(ssd); uint32_t expected = DETECT_SSL_STATE_CLIENT_HELLO; FAIL_IF(ssd->flags != expected || ssd->mask != expected); SCFree(ssd); ssd = DetectSslStateParse("!client_hello,!server_hello"); FAIL_IF_NULL(ssd); expected = DETECT_SSL_STATE_CLIENT_HELLO | DETECT_SSL_STATE_SERVER_HELLO; FAIL_IF(ssd->flags != expected || ssd->mask != expected); SCFree(ssd); PASS; } #endif /* UNITTESTS */ void DetectSslStateRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectSslStateTest01", DetectSslStateTest01); UtRegisterTest("DetectSslStateTest02", DetectSslStateTest02); UtRegisterTest("DetectSslStateTest03", DetectSslStateTest03); UtRegisterTest("DetectSslStateTest04", DetectSslStateTest04); UtRegisterTest("DetectSslStateTest05", DetectSslStateTest05); UtRegisterTest("DetectSslStateTest06", DetectSslStateTest06); UtRegisterTest("DetectSslStateTest07", DetectSslStateTest07); UtRegisterTest("DetectSslStateTest08", DetectSslStateTest08); UtRegisterTest("DetectSslStateTestParseNegate", DetectSslStateTestParseNegate); #endif return; } suricata-3.2.1/src/util-mpm-ac-tile.c0000644000000000000000000023612013051004444014231 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele * \author Anoop Saldanha * * Aho-corasick MPM optimized for the Tilera Tile-Gx architecture. * * Efficient String Matching: An Aid to Bibliographic Search * Alfred V. Aho and Margaret J. Corasick * * - Started with util-mpm-ac.c: * - Uses the delta table for calculating transitions, * instead of having separate goto and failure * transitions. * - If we cross 2 ** 16 states, we use 4 bytes in the * transition table to hold each state, otherwise we use * 2 bytes. * - This version of the MPM is heavy on memory, but it * performs well. If you can fit the ruleset with this * mpm on your box without hitting swap, this is the MPM * to go for. * * - Added these optimizations: * - Compress the input alphabet from 256 characters down * to the actual characters used in the patterns, plus * one character for all the unused characters. * - Reduce the size of the delta table so that each state * is the smallest power of two that is larger than the * size of the compressed alphabet. * - Specialized the search function based on state count * (small for 8-bit large for 16-bit) and the size of * the alphabet, so that it is constant inside the * function for better optimization. * * \todo - Do a proper analyis of our existing MPMs and suggest a good * one based on the pattern distribution and the expected * traffic(say http). * - Irrespective of whether we cross 2 ** 16 states or * not,shift to using uint32_t for state type, so that we can * integrate it's status as a final state or not in the * topmost byte. We are already doing it if state_count is > * 2 ** 16. * - Test case-senstive patterns if they have any ascii chars. * If they don't treat them as nocase. * - Reorder the compressed alphabet to put the most common characters * first. */ #include "suricata-common.h" #include "suricata.h" #if __BYTE_ORDER == __LITTLE_ENDIAN #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "conf.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" #include "util-memcpy.h" #include "util-mpm-ac-tile.h" void SCACTileInitCtx(MpmCtx *); void SCACTileInitThreadCtx(MpmCtx *, MpmThreadCtx *); void SCACTileDestroyCtx(MpmCtx *); void SCACTileDestroyThreadCtx(MpmCtx *, MpmThreadCtx *); int SCACTileAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACTileAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACTilePreparePatterns(MpmCtx *mpm_ctx); uint32_t SCACTileSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); void SCACTilePrintInfo(MpmCtx *mpm_ctx); void SCACTilePrintSearchStats(MpmThreadCtx *mpm_thread_ctx); void SCACTileRegisterTests(void); uint32_t SCACTileSearchLarge(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall256(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall128(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall64(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall32(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall16(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchSmall8(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny256(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny128(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny64(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny32(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny16(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); uint32_t SCACTileSearchTiny8(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); static void SCACTileDestroyInitCtx(MpmCtx *mpm_ctx); /* a placeholder to denote a failure transition in the goto table */ #define SC_AC_TILE_FAIL (-1) #define STATE_QUEUE_CONTAINER_SIZE 65536 /** * \brief Helper structure used by AC during state table creation */ typedef struct StateQueue_ { int32_t store[STATE_QUEUE_CONTAINER_SIZE]; int top; int bot; } StateQueue; /** * \internal * \brief Initialize the AC context with user specified conf parameters. We * aren't retrieving anything for AC conf now, but we will certainly * need it, when we customize AC. */ static void SCACTileGetConfig() { } /** * \internal * \brief Count the occurences of each character in the pattern and * accumulate into a histogram. Really only used to detect unused * characters, so could just set to 1 instead of counting. */ static inline void SCACTileHistogramAlphabet(SCACTileCtx *ctx, MpmPattern *p) { for (int i = 0; i < p->len; i++) { ctx->alpha_hist[p->ci[i]]++; } } /* Use Alpahbet Histogram to create compressed alphabet. */ static void SCACTileInitTranslateTable(SCACTileCtx *ctx) { /* Count the number of ASCII values actually appearing in any * pattern. Create compressed mapping table with unused * characters mapping to zero. */ for (int i = 0; i < 256; i++) { /* Move all upper case counts to lower case */ if (i >= 'A' && i <= 'Z') { ctx->alpha_hist[i - 'A' + 'a'] += ctx->alpha_hist[i]; ctx->alpha_hist[i] = 0; } if (ctx->alpha_hist[i]) { ctx->alphabet_size++; ctx->translate_table[i] = ctx->alphabet_size; } else ctx->translate_table[i] = 0; } /* Fix up translation table for uppercase */ for (int i = 'A'; i <= 'Z'; i++) ctx->translate_table[i] = ctx->translate_table[i - 'A' + 'a']; SCLogDebug(" Alphabet size %d", ctx->alphabet_size); /* Round alphabet size up to next power-of-two Leave one extra * space For the unused-chararacters = 0 mapping. */ ctx->alphabet_size += 1; /* Extra space for unused-character */ if (ctx->alphabet_size <= 8) { ctx->alphabet_storage = 8; } else if (ctx->alphabet_size <= 16) { ctx->alphabet_storage = 16; } else if (ctx->alphabet_size <= 32) { ctx->alphabet_storage = 32; } else if (ctx->alphabet_size <= 64) { ctx->alphabet_storage = 64; } else if (ctx->alphabet_size <= 128) { ctx->alphabet_storage = 128; } else ctx->alphabet_storage = 256; } static void SCACTileReallocOutputTable(SCACTileCtx *ctx, int new_state_count) { /* reallocate space in the output table for the new state */ size_t size = ctx->allocated_state_count * sizeof(SCACTileOutputTable); void *ptmp = SCRealloc(ctx->output_table, size); if (ptmp == NULL) { SCFree(ctx->output_table); ctx->output_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->output_table = ptmp; } static void SCACTileReallocState(SCACTileCtx *ctx, int new_state_count) { /* reallocate space in the goto table to include a new state */ size_t size = ctx->allocated_state_count * sizeof(int32_t) * 256; void *ptmp = SCRealloc(ctx->goto_table, size); if (ptmp == NULL) { SCFree(ctx->goto_table); ctx->goto_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->goto_table = ptmp; SCACTileReallocOutputTable(ctx, new_state_count); } /** * \internal * \brief Initialize a new state in the goto and output tables. * * \param mpm_ctx Pointer to the mpm context. * * \retval The state id, of the newly created state. */ static inline int SCACTileInitNewState(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int aa = 0; /* Exponentially increase the allocated space when needed. */ if (ctx->allocated_state_count < ctx->state_count + 1) { if (ctx->allocated_state_count == 0) ctx->allocated_state_count = 256; else ctx->allocated_state_count *= 2; SCACTileReallocState(ctx, ctx->allocated_state_count); } /* set all transitions for the newly assigned state as FAIL transitions */ for (aa = 0; aa < ctx->alphabet_size; aa++) { ctx->goto_table[ctx->state_count][aa] = SC_AC_TILE_FAIL; } memset(ctx->output_table + ctx->state_count, 0, sizeof(SCACTileOutputTable)); return ctx->state_count++; } /** * \internal * \brief Adds a pid to the output table for a state. * * \param state The state to whose output table we should add the pid. * \param pid The pattern id to add. * \param mpm_ctx Pointer to the mpm context. */ static void SCACTileSetOutputState(int32_t state, MpmPatternIndex pindex, MpmCtx *mpm_ctx) { void *ptmp; SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; SCACTileOutputTable *output_state = &ctx->output_table[state]; uint32_t i = 0; /* Don't add the pattern more than once to the same state. */ for (i = 0; i < output_state->no_of_entries; i++) { if (output_state->patterns[i] == pindex) return; } /* Increase the size of the array of pids for this state and add * the new pid. */ output_state->no_of_entries++; ptmp = SCRealloc(output_state->patterns, output_state->no_of_entries * sizeof(MpmPatternIndex)); if (ptmp == NULL) { SCFree(output_state->patterns); output_state->patterns = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } output_state->patterns = ptmp; output_state->patterns[output_state->no_of_entries - 1] = pindex; } /** * \brief Helper function used by SCACTileCreateGotoTable. Adds a * pattern to the goto table. * * \param pattern Pointer to the pattern. * \param pattern_len Pattern length. * \param pid The pattern id, that corresponds to this pattern. We * need it to updated the output table for this pattern. * \param mpm_ctx Pointer to the mpm context. */ static void SCACTileEnter(uint8_t *pattern, uint16_t pattern_len, MpmPatternIndex pindex, MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int32_t state = 0; int32_t newstate = 0; int i = 0; int p = 0; int tc; /* Walk down the trie till we have a match for the pattern prefix */ state = 0; for (i = 0; i < pattern_len; i++) { tc = ctx->translate_table[pattern[i]]; if (ctx->goto_table[state][tc] == SC_AC_TILE_FAIL) break; state = ctx->goto_table[state][tc]; } /* Add the non-matching pattern suffix to the trie, from the last state * we left off */ for (p = i; p < pattern_len; p++) { newstate = SCACTileInitNewState(mpm_ctx); tc = ctx->translate_table[pattern[p]]; ctx->goto_table[state][tc] = newstate; state = newstate; } /* Add this pattern id, to the output table of the last state, where the * pattern ends in the trie */ SCACTileSetOutputState(state, pindex, mpm_ctx); } /** * \internal * \brief Create the goto table. * * \param mpm_ctx Pointer to the mpm context. */ static void SCACTileCreateGotoTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; uint32_t i = 0; /* add each pattern to create the goto table */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { SCACTileEnter(ctx->parray[i]->ci, ctx->parray[i]->len, i, mpm_ctx); } int aa = 0; for (aa = 0; aa < ctx->alphabet_size; aa++) { if (ctx->goto_table[0][aa] == SC_AC_TILE_FAIL) { ctx->goto_table[0][aa] = 0; } } } static inline int SCACTileStateQueueIsEmpty(StateQueue *q) { if (q->top == q->bot) return 1; else return 0; } static inline void SCACTileEnqueue(StateQueue *q, int32_t state) { int i = 0; /*if we already have this */ for (i = q->bot; i < q->top; i++) { if (q->store[i] == state) return; } q->store[q->top++] = state; if (q->top == STATE_QUEUE_CONTAINER_SIZE) q->top = 0; if (q->top == q->bot) { SCLogCritical(SC_ERR_AHO_CORASICK, "Just ran out of space in the queue. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } } static inline int32_t SCACTileDequeue(StateQueue *q) { if (q->bot == STATE_QUEUE_CONTAINER_SIZE) q->bot = 0; if (q->bot == q->top) { SCLogCritical(SC_ERR_AHO_CORASICK, "StateQueue behaving weirdly. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } return q->store[q->bot++]; } /** * \internal * \brief Club the output data from 2 states and store it in the 1st state. * dst_state_data = {dst_state_data} UNION {src_state_data} * * \param dst_state First state(also the destination) for the union operation. * \param src_state Second state for the union operation. * \param mpm_ctx Pointer to the mpm context. */ static void SCACTileClubOutputStates(int32_t dst_state, int32_t src_state, MpmCtx *mpm_ctx) { void *ptmp; SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; uint32_t i = 0; uint32_t j = 0; SCACTileOutputTable *output_dst_state = &ctx->output_table[dst_state]; SCACTileOutputTable *output_src_state = &ctx->output_table[src_state]; for (i = 0; i < output_src_state->no_of_entries; i++) { for (j = 0; j < output_dst_state->no_of_entries; j++) { if (output_src_state->patterns[i] == output_dst_state->patterns[j]) { break; } } if (j == output_dst_state->no_of_entries) { output_dst_state->no_of_entries++; ptmp = SCRealloc(output_dst_state->patterns, (output_dst_state->no_of_entries * sizeof(uint32_t))); if (ptmp == NULL) { SCFree(output_dst_state->patterns); output_dst_state->patterns = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } output_dst_state->patterns = ptmp; output_dst_state->patterns[output_dst_state->no_of_entries - 1] = output_src_state->patterns[i]; } } } /** * \internal * \brief Create the failure table. * * \param mpm_ctx Pointer to the mpm context. */ static void SCACTileCreateFailureTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int aa = 0; int32_t state = 0; int32_t r_state = 0; StateQueue q; memset(&q, 0, sizeof(StateQueue)); /* Allocate space for the failure table. A failure entry in the table for * every state(SCACTileCtx->state_count) */ ctx->failure_table = SCMalloc(ctx->state_count * sizeof(int32_t)); if (ctx->failure_table == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->failure_table, 0, ctx->state_count * sizeof(int32_t)); /* Add the failure transitions for the 0th state, and add every non-fail * transition from the 0th state to the queue for further processing * of failure states */ for (aa = 0; aa < ctx->alphabet_size; aa++) { int32_t temp_state = ctx->goto_table[0][aa]; if (temp_state != 0) { SCACTileEnqueue(&q, temp_state); ctx->failure_table[temp_state] = 0; } } while (!SCACTileStateQueueIsEmpty(&q)) { /* pick up every state from the queue and add failure transitions */ r_state = SCACTileDequeue(&q); for (aa = 0; aa < ctx->alphabet_size; aa++) { int32_t temp_state = ctx->goto_table[r_state][aa]; if (temp_state == SC_AC_TILE_FAIL) continue; SCACTileEnqueue(&q, temp_state); state = ctx->failure_table[r_state]; while(ctx->goto_table[state][aa] == SC_AC_TILE_FAIL) state = ctx->failure_table[state]; ctx->failure_table[temp_state] = ctx->goto_table[state][aa]; SCACTileClubOutputStates(temp_state, ctx->failure_table[temp_state], mpm_ctx); } } } /* * Set the next state for 1 byte next-state. */ static void SCACTileSetState1Byte(SCACTileCtx *ctx, int state, int aa, int next_state, int outputs) { uint8_t *state_table = (uint8_t*)ctx->state_table; uint8_t encoded_next_state = next_state; if (next_state == SC_AC_TILE_FAIL) { SCLogError(SC_ERR_MEM_ALLOC, "Error FAIL state in output"); exit(EXIT_FAILURE); } if (outputs == 0) encoded_next_state |= (1 << 7); state_table[state * ctx->alphabet_storage + aa] = encoded_next_state; } /* * Set the next state for 2 byte next-state. */ static void SCACTileSetState2Bytes(SCACTileCtx *ctx, int state, int aa, int next_state, int outputs) { uint16_t *state_table = (uint16_t*)ctx->state_table; uint16_t encoded_next_state = next_state; if (next_state == SC_AC_TILE_FAIL) { SCLogError(SC_ERR_MEM_ALLOC, "Error FAIL state in output"); exit(EXIT_FAILURE); } if (outputs == 0) encoded_next_state |= (1 << 15); state_table[state * ctx->alphabet_storage + aa] = encoded_next_state; } /* * Set the next state for 4 byte next-state. */ static void SCACTileSetState4Bytes(SCACTileCtx *ctx, int state, int aa, int next_state, int outputs) { uint32_t *state_table = (uint32_t*)ctx->state_table; uint32_t encoded_next_state = next_state; if (next_state == SC_AC_TILE_FAIL) { SCLogError(SC_ERR_MEM_ALLOC, "Error FAIL state in output"); exit(EXIT_FAILURE); } if (outputs == 0) encoded_next_state |= (1 << 31); state_table[state * ctx->alphabet_storage + aa] = encoded_next_state; } /** * \internal * \brief Create the delta table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACTileCreateDeltaTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int aa = 0; int32_t r_state = 0; if (ctx->state_count < 32767) { if (ctx->state_count < 128) { ctx->bytes_per_state = 1; ctx->set_next_state = SCACTileSetState1Byte; switch(ctx->alphabet_storage) { case 8: ctx->search = SCACTileSearchTiny8; break; case 16: ctx->search = SCACTileSearchTiny16; break; case 32: ctx->search = SCACTileSearchTiny32; break; case 64: ctx->search = SCACTileSearchTiny64; break; case 128: ctx->search = SCACTileSearchTiny128; break; default: ctx->search = SCACTileSearchTiny256; } } else { /* 16-bit state needed */ ctx->bytes_per_state = 2; ctx->set_next_state = SCACTileSetState2Bytes; switch(ctx->alphabet_storage) { case 8: ctx->search = SCACTileSearchSmall8; break; case 16: ctx->search = SCACTileSearchSmall16; break; case 32: ctx->search = SCACTileSearchSmall32; break; case 64: ctx->search = SCACTileSearchSmall64; break; case 128: ctx->search = SCACTileSearchSmall128; break; default: ctx->search = SCACTileSearchSmall256; } } } else { /* 32-bit next state */ ctx->search = SCACTileSearchLarge; ctx->bytes_per_state = 4; ctx->set_next_state = SCACTileSetState4Bytes; ctx->alphabet_storage = 256; /* Change? */ } StateQueue q; memset(&q, 0, sizeof(StateQueue)); for (aa = 0; aa < ctx->alphabet_size; aa++) { int temp_state = ctx->goto_table[0][aa]; if (temp_state != 0) SCACTileEnqueue(&q, temp_state); } while (!SCACTileStateQueueIsEmpty(&q)) { r_state = SCACTileDequeue(&q); for (aa = 0; aa < ctx->alphabet_size; aa++) { int temp_state = ctx->goto_table[r_state][aa]; if (temp_state != SC_AC_TILE_FAIL) { SCACTileEnqueue(&q, temp_state); } else { int f_state = ctx->failure_table[r_state]; ctx->goto_table[r_state][aa] = ctx->goto_table[f_state][aa]; } } } } static void SCACTileClubOutputStatePresenceWithDeltaTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int aa = 0; uint32_t state = 0; /* Allocate next-state table. */ int size = ctx->state_count * ctx->bytes_per_state * ctx->alphabet_storage; void *state_table = SCMalloc(size); if (unlikely(state_table == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(state_table, 0, size); ctx->state_table = state_table; mpm_ctx->memory_cnt++; mpm_ctx->memory_size += size; SCLogDebug("Delta Table size %d, alphabet: %d, %d-byte states: %d", size, ctx->alphabet_size, ctx->bytes_per_state, ctx->state_count); /* Copy next state from Goto table, which is 32 bits and encode it into the next * state table, which can be 1, 2 or 4 bytes each and include if there is an * output. */ for (state = 0; state < ctx->state_count; state++) { for (aa = 0; aa < ctx->alphabet_size; aa++) { int next_state = ctx->goto_table[state][aa]; int next_state_outputs = ctx->output_table[next_state].no_of_entries; ctx->set_next_state(ctx, state, aa, next_state, next_state_outputs); } } } static inline void SCACTileInsertCaseSensitiveEntriesForPatterns(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; uint32_t state = 0; uint32_t k = 0; for (state = 0; state < ctx->state_count; state++) { if (ctx->output_table[state].no_of_entries == 0) continue; for (k = 0; k < ctx->output_table[state].no_of_entries; k++) { if (ctx->pattern_list[ctx->output_table[state].patterns[k]].cs != NULL) { /* TODO - Find better way to store this. */ ctx->output_table[state].patterns[k] &= 0x0FFFFFFF; ctx->output_table[state].patterns[k] |= (uint32_t)1 << 31; } } } } #if 0 static void SCACTilePrintDeltaTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; int i = 0, j = 0; printf("##############Delta Table##############\n"); for (i = 0; i < ctx->state_count; i++) { printf("%d: \n", i); for (j = 0; j < ctx->alphabet_size; j++) { if (SCACTileGetDelta(i, j, mpm_ctx) != 0) { printf(" %c -> %d\n", j, SCACTileGetDelta(i, j, mpm_ctx)); } } } } #endif /** * \brief Process the patterns and prepare the state table. * * \param mpm_ctx Pointer to the mpm context. */ static void SCACTilePrepareStateTable(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; /* Create Alphabet compression and Lower Case translation table. */ SCACTileInitTranslateTable(ctx); /* create the 0th state in the goto table and output_table */ SCACTileInitNewState(mpm_ctx); /* create the goto table */ SCACTileCreateGotoTable(mpm_ctx); /* create the failure table */ SCACTileCreateFailureTable(mpm_ctx); /* create the final state(delta) table */ SCACTileCreateDeltaTable(mpm_ctx); /* club the output state presence with delta transition entries */ SCACTileClubOutputStatePresenceWithDeltaTable(mpm_ctx); /* club nocase entries */ SCACTileInsertCaseSensitiveEntriesForPatterns(mpm_ctx); #if 0 SCACTilePrintDeltaTable(mpm_ctx); #endif /* we don't need these anymore */ SCFree(ctx->goto_table); ctx->goto_table = NULL; SCFree(ctx->failure_table); ctx->failure_table = NULL; } /** * \brief Process Internal AC MPM tables to create the Search Context * * The search context is only the data needed to search the MPM. * * \param mpm_ctx Pointer to the mpm context. */ static void SCACTilePrepareSearch(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; /* Resize the output table to be only as big as its final size. */ SCACTileReallocOutputTable(ctx, ctx->state_count); search_ctx->search = ctx->search; memcpy(search_ctx->translate_table, ctx->translate_table, sizeof(ctx->translate_table)); /* Move the state table from the Init context */ search_ctx->state_table = ctx->state_table; ctx->state_table = NULL; /* So that it won't get freed twice. */ /* Move the output_table from the Init context to the Search Context */ /* TODO: Could be made more compact */ search_ctx->output_table = ctx->output_table; ctx->output_table = NULL; search_ctx->state_count = ctx->state_count; search_ctx->pattern_list = ctx->pattern_list; ctx->pattern_list = NULL; search_ctx->pattern_cnt = mpm_ctx->pattern_cnt; /* One bit per pattern, rounded up to the next byte size. */ search_ctx->mpm_bitarray_size = (mpm_ctx->pattern_cnt + 7) / 8; /* Can now free the Initialization data */ SCACTileDestroyInitCtx(mpm_ctx); } /** * \brief Process the patterns added to the mpm, and create the internal tables. * * \param mpm_ctx Pointer to the mpm context. */ int SCACTilePreparePatterns(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; if (mpm_ctx->pattern_cnt == 0 || search_ctx->init_ctx == NULL) { SCLogDebug("no patterns supplied to this mpm_ctx"); return 0; } SCACTileCtx *ctx = search_ctx->init_ctx; if (mpm_ctx->init_hash == NULL) { SCLogDebug("no patterns supplied to this mpm_ctx"); return 0; } /* alloc the pattern array */ ctx->parray = (MpmPattern **)SCMalloc(mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); if (ctx->parray == NULL) goto error; memset(ctx->parray, 0, mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); /* populate it with the patterns in the hash */ uint32_t i = 0, p = 0; for (i = 0; i < MPM_INIT_HASH_SIZE; i++) { MpmPattern *node = mpm_ctx->init_hash[i], *nnode = NULL; while(node != NULL) { nnode = node->next; node->next = NULL; ctx->parray[p++] = node; SCACTileHistogramAlphabet(ctx, node); node = nnode; } } /* we no longer need the hash, so free it's memory */ SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; /* Handle case patterns by storing a copy of the pattern to compare * to each possible match (no-case). * * Allocate the memory for the array and each of the strings as one block. */ size_t string_space_needed = 0; for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (!(ctx->parray[i]->flags & MPM_PATTERN_FLAG_NOCASE)) { /* Round up to next 8 byte aligned length */ uint32_t space = ((ctx->parray[i]->len + 7) / 8) * 8; string_space_needed += space; } } size_t pattern_list_size = mpm_ctx->pattern_cnt * sizeof(SCACTilePatternList); size_t mem_size = string_space_needed + pattern_list_size; void *mem_block = SCCalloc(1, mem_size); if (mem_block == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } mpm_ctx->memory_cnt++; mpm_ctx->memory_size += mem_size; /* Split the allocated block into pattern list array and string space. */ ctx->pattern_list = mem_block; uint8_t *string_space = mem_block + pattern_list_size; /* Now make the copies of the no-case strings. */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (!(ctx->parray[i]->flags & MPM_PATTERN_FLAG_NOCASE)) { uint32_t len = ctx->parray[i]->len; uint32_t space = ((len + 7) / 8) * 8; memcpy(string_space, ctx->parray[i]->original_pat, len); ctx->pattern_list[i].cs = string_space; ctx->pattern_list[i].patlen = len; string_space += space; } ctx->pattern_list[i].pid = ctx->parray[i]->id; /* ACPatternList now owns this memory */ ctx->pattern_list[i].sids_size = ctx->parray[i]->sids_size; ctx->pattern_list[i].sids = ctx->parray[i]->sids; ctx->parray[i]->sids = NULL; ctx->parray[i]->sids_size = 0; } /* prepare the state table required by AC */ SCACTilePrepareStateTable(mpm_ctx); /* Convert to the Search Context structure */ SCACTilePrepareSearch(mpm_ctx); return 0; error: return -1; } /** * \brief Init the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCACTileInitThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { memset(mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); mpm_thread_ctx->ctx = SCMalloc(sizeof(SCACTileThreadCtx)); if (mpm_thread_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_thread_ctx->ctx, 0, sizeof(SCACTileThreadCtx)); mpm_thread_ctx->memory_cnt++; mpm_thread_ctx->memory_size += sizeof(SCACTileThreadCtx); } /** * \brief Initialize the AC context. * * \param mpm_ctx Mpm context. */ void SCACTileInitCtx(MpmCtx *mpm_ctx) { if (mpm_ctx->ctx != NULL) return; /* Search Context */ mpm_ctx->ctx = SCMalloc(sizeof(SCACTileSearchCtx)); if (mpm_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->ctx, 0, sizeof(SCACTileSearchCtx)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCACTileSearchCtx); SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; /* MPM Creation context */ search_ctx->init_ctx = SCMalloc(sizeof(SCACTileCtx)); if (search_ctx->init_ctx == NULL) { exit(EXIT_FAILURE); } memset(search_ctx->init_ctx, 0, sizeof(SCACTileCtx)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCACTileCtx); /* initialize the hash we use to speed up pattern insertions */ mpm_ctx->init_hash = SCMalloc(sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); if (mpm_ctx->init_hash == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->init_hash, 0, sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); /* get conf values for AC from our yaml file. We have no conf values for * now. We will certainly need this, as we develop the algo */ SCACTileGetConfig(); } /** * \brief Destroy the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCACTileDestroyThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { SCACTilePrintSearchStats(mpm_thread_ctx); if (mpm_thread_ctx->ctx != NULL) { SCFree(mpm_thread_ctx->ctx); mpm_thread_ctx->ctx = NULL; mpm_thread_ctx->memory_cnt--; mpm_thread_ctx->memory_size -= sizeof(SCACTileThreadCtx); } } static void SCACTileDestroyInitCtx(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; if (ctx == NULL) return; if (mpm_ctx->init_hash != NULL) { SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; } if (ctx->parray != NULL) { uint32_t i; for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->parray[i] != NULL) { MpmFreePattern(mpm_ctx, ctx->parray[i]); } } SCFree(ctx->parray); ctx->parray = NULL; } if (ctx->state_table != NULL) { SCFree(ctx->state_table); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (ctx->state_count * ctx->bytes_per_state * ctx->alphabet_storage); } if (ctx->output_table != NULL) { uint32_t state; for (state = 0; state < ctx->state_count; state++) { if (ctx->output_table[state].patterns != NULL) { SCFree(ctx->output_table[state].patterns); } } SCFree(ctx->output_table); } if (ctx->pattern_list != NULL) { uint32_t i; for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->pattern_list[i].cs != NULL) SCFree(ctx->pattern_list[i].cs); if (ctx->pattern_list[i].sids != NULL) SCFree(ctx->pattern_list[i].sids); } SCFree(ctx->pattern_list); } SCFree(ctx); search_ctx->init_ctx = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCACTileCtx); } /** * \brief Destroy the mpm context. * * \param mpm_ctx Pointer to the mpm context. */ void SCACTileDestroyCtx(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; if (search_ctx == NULL) return; /* Destroy Initialization data */ SCACTileDestroyInitCtx(mpm_ctx); /* Free Search tables */ SCFree(search_ctx->state_table); if (search_ctx->pattern_list != NULL) { uint32_t i; for (i = 0; i < search_ctx->pattern_cnt; i++) { if (search_ctx->pattern_list[i].sids != NULL) SCFree(search_ctx->pattern_list[i].sids); } SCFree(search_ctx->pattern_list); } if (search_ctx->output_table != NULL) { uint32_t state; for (state = 0; state < search_ctx->state_count; state++) { if (search_ctx->output_table[state].patterns != NULL) { SCFree(search_ctx->output_table[state].patterns); } } SCFree(search_ctx->output_table); } SCFree(search_ctx); mpm_ctx->ctx = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCACTileSearchCtx); } /* * Heavily optimized pattern matching routine for TILE-Gx. */ #define SCHECK(x) ((x) > 0) #define BUF_TYPE int32_t // Extract byte N=0,1,2,3 from x #ifdef __tile__ #define BYTE0(x) __insn_bfextu(x, 0, 7) #define BYTE1(x) __insn_bfextu(x, 8, 15) #define BYTE2(x) __insn_bfextu(x, 16, 23) #define BYTE3(x) __insn_bfextu(x, 24, 31) #define EXTRA 0 #else /* fallback */ #define BYTE0(x) (((x) & 0x000000ff) >> 0) #define BYTE1(x) (((x) & 0x0000ff00) >> 8) #define BYTE2(x) (((x) & 0x00ff0000) >> 16) #define BYTE3(x) (((x) & 0xff000000) >> 24) #define EXTRA 4 // need 4 extra bytes to avoid OOB reads #endif int CheckMatch(const SCACTileSearchCtx *ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen, uint16_t state, int i, int matches, uint8_t *mpm_bitarray) { SCACTilePatternList *pattern_list = ctx->pattern_list; const uint8_t *buf_offset = buf + i + 1; // Lift out of loop uint32_t no_of_entries = ctx->output_table[state].no_of_entries; MpmPatternIndex *patterns = ctx->output_table[state].patterns; uint32_t k; for (k = 0; k < no_of_entries; k++) { MpmPatternIndex pindex = patterns[k] & 0x0FFFFFFF; if (mpm_bitarray[pindex / 8] & (1 << (pindex % 8))) { /* Pattern already seen by this MPM. */ /* NOTE: This is faster then rechecking if it is a case-sensitive match * since we know this pattern has already been seen, but imcrementing * matches here could over report matches. For example if the case-sensitive * pattern is "Foo" and the string is "Foo bar foo", matches would be reported * as 2, when it should really be 1, since "foo" is not a true match. */ matches++; continue; } /* Double check case-sensitve match now. */ if (patterns[k] >> 31) { uint16_t patlen = pattern_list[pindex].patlen; #ifdef __tile__ if (SCMemcmpNZ(pattern_list[pindex].cs, buf_offset - patlen, patlen) != 0) { #else if (SCMemcmp(pattern_list[pindex].cs, buf_offset - patlen, patlen) != 0) { #endif /* Case-sensitive match failed. */ continue; } } /* New match found */ mpm_bitarray[pindex / 8] |= (1 << (pindex % 8)); /* Always add the Signature IDs, since they could be different in the current MPM * than in a previous MPM on the same PMQ when finding the same pattern. */ PrefilterAddSids(pmq, pattern_list[pindex].sids, pattern_list[pindex].sids_size); matches++; } return matches; } /** * \brief The aho corasick search function. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param pmq Pointer to the Pattern Matcher Queue to hold * search matches. * \param buf Buffer to be searched. * \param buflen Buffer length. * * \retval matches Match count. */ uint32_t SCACTileSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen) { const SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; if (buflen == 0) return 0; /* Context specific matching function. */ return search_ctx->search(search_ctx, mpm_thread_ctx, pmq, buf, buflen); } /* This function handles (ctx->state_count >= 32767) */ uint32_t SCACTileSearchLarge(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen) { int i = 0; int matches = 0; uint8_t mpm_bitarray[ctx->mpm_bitarray_size]; memset(mpm_bitarray, 0, ctx->mpm_bitarray_size); const uint8_t* restrict xlate = ctx->translate_table; register int state = 0; int32_t (*state_table_u32)[256] = ctx->state_table; for (i = 0; i < buflen; i++) { state = state_table_u32[state & 0x00FFFFFF][xlate[buf[i]]]; if (SCHECK(state)) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } } /* for (i = 0; i < buflen; i++) */ return matches; } /* * Search with Alphabet size of 256 and 16-bit next-state entries. * Next state entry has MSB as "match" and 15 LSB bits as next-state index. */ // y = 1<ctx; printf("AC Thread Search stats (ctx %p)\n", ctx); printf("Total calls: %" PRIu32 "\n", ctx->total_calls); printf("Total matches: %" PRIu64 "\n", ctx->total_matches); #endif /* SC_AC_TILE_COUNTERS */ } void SCACTilePrintInfo(MpmCtx *mpm_ctx) { SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx; SCACTileCtx *ctx = search_ctx->init_ctx; printf("MPM AC Information:\n"); printf("Memory allocs: %" PRIu32 "\n", mpm_ctx->memory_cnt); printf("Memory alloced: %" PRIu32 "\n", mpm_ctx->memory_size); printf(" Sizeof:\n"); printf(" MpmCtx %" PRIuMAX "\n", (uintmax_t)sizeof(MpmCtx)); printf(" SCACTileCtx: %" PRIuMAX "\n", (uintmax_t)sizeof(SCACTileCtx)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf("Unique Patterns: %" PRIu32 "\n", mpm_ctx->pattern_cnt); printf("Smallest: %" PRIu32 "\n", mpm_ctx->minlen); printf("Largest: %" PRIu32 "\n", mpm_ctx->maxlen); printf("Total states in the state table: %d\n", ctx->state_count); printf("\n"); } /************************** Mpm Registration ***************************/ /** * \brief Register the aho-corasick mpm for Tilera Tile-Gx processor. */ void MpmACTileRegister(void) { #ifdef __tile__ mpm_table[MPM_AC_TILE].name = "ac-tile"; #else mpm_table[MPM_AC_TILE].name = "ac-ks"; #endif mpm_table[MPM_AC_TILE].InitCtx = SCACTileInitCtx; mpm_table[MPM_AC_TILE].InitThreadCtx = SCACTileInitThreadCtx; mpm_table[MPM_AC_TILE].DestroyCtx = SCACTileDestroyCtx; mpm_table[MPM_AC_TILE].DestroyThreadCtx = SCACTileDestroyThreadCtx; mpm_table[MPM_AC_TILE].AddPattern = SCACTileAddPatternCS; mpm_table[MPM_AC_TILE].AddPatternNocase = SCACTileAddPatternCI; mpm_table[MPM_AC_TILE].Prepare = SCACTilePreparePatterns; mpm_table[MPM_AC_TILE].Search = SCACTileSearch; mpm_table[MPM_AC_TILE].PrintCtx = SCACTilePrintInfo; mpm_table[MPM_AC_TILE].PrintThreadCtx = SCACTilePrintSearchStats; mpm_table[MPM_AC_TILE].RegisterUnittests = SCACTileRegisterTests; } /*************************************Unittests********************************/ #ifdef UNITTESTS static int SCACTileTest01(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest02(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest03(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghj", 4, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest04(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghjxyz", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest05(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest06(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcd"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest07(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* should match 30 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 29 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 28 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAA", 3, 0, 0, 2, 0, 0); /* 26 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAA", 5, 0, 0, 3, 0, 0); /* 21 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAA", 10, 0, 0, 4, 0, 0); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30, 0, 0, 5, 0, 0); PmqSetup(&pmq); /* total matches: 135 */ SCACTilePreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 135) result = 1; else printf("135 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest08(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"a", 1); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest09(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"ab", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest10(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789" "abcdefgh" "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest11(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"he", 2, 0, 0, 1, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"she", 3, 0, 0, 2, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"his", 3, 0, 0, 3, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"hers", 4, 0, 0, 4, 0, 0) == -1) goto end; PmqSetup(&pmq); if (SCACTilePreparePatterns(&mpm_ctx) == -1) goto end; result = 1; char *buf = "he"; result &= (SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "she"; result &= (SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); buf = "his"; result &= (SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "hers"; result &= (SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); end: SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest12(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest13(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCD"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCD"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest14(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDE"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDE"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest15(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDEF"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDEF"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest16(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABC"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABC"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest17(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzAB"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzAB"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest18(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcde""fghij""klmno""pqrst""uvwxy""z"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcde""fghij""klmno""pqrst""uvwxy""z"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest19(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest20(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest21(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"AA", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest22(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest23(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 0) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest24(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCI(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest25(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghiJkl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest26(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "works"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest27(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ONE", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "tone"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest28(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_TILE); SCACTileInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"one", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACTilePreparePatterns(&mpm_ctx); char *buf = "tONE"; uint32_t cnt = SCACTileSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACTileDestroyCtx(&mpm_ctx); SCACTileDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTileTest29(void) { uint8_t *buf = (uint8_t *)"onetwothreefourfivesixseveneightnine"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; fast_pattern:3,3; sid:2;)"); if (de_ctx->sig_list->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 1) { printf("if (PacketAlertCheck(p, 1) != 1) failure\n"); goto end; } if (PacketAlertCheck(p, 2) != 1) { printf("if (PacketAlertCheck(p, 1) != 2) failure\n"); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void SCACTileRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCACTileTest01", SCACTileTest01); UtRegisterTest("SCACTileTest02", SCACTileTest02); UtRegisterTest("SCACTileTest03", SCACTileTest03); UtRegisterTest("SCACTileTest04", SCACTileTest04); UtRegisterTest("SCACTileTest05", SCACTileTest05); UtRegisterTest("SCACTileTest06", SCACTileTest06); UtRegisterTest("SCACTileTest07", SCACTileTest07); UtRegisterTest("SCACTileTest08", SCACTileTest08); UtRegisterTest("SCACTileTest09", SCACTileTest09); UtRegisterTest("SCACTileTest10", SCACTileTest10); UtRegisterTest("SCACTileTest11", SCACTileTest11); UtRegisterTest("SCACTileTest12", SCACTileTest12); UtRegisterTest("SCACTileTest13", SCACTileTest13); UtRegisterTest("SCACTileTest14", SCACTileTest14); UtRegisterTest("SCACTileTest15", SCACTileTest15); UtRegisterTest("SCACTileTest16", SCACTileTest16); UtRegisterTest("SCACTileTest17", SCACTileTest17); UtRegisterTest("SCACTileTest18", SCACTileTest18); UtRegisterTest("SCACTileTest19", SCACTileTest19); UtRegisterTest("SCACTileTest20", SCACTileTest20); UtRegisterTest("SCACTileTest21", SCACTileTest21); UtRegisterTest("SCACTileTest22", SCACTileTest22); UtRegisterTest("SCACTileTest23", SCACTileTest23); UtRegisterTest("SCACTileTest24", SCACTileTest24); UtRegisterTest("SCACTileTest25", SCACTileTest25); UtRegisterTest("SCACTileTest26", SCACTileTest26); UtRegisterTest("SCACTileTest27", SCACTileTest27); UtRegisterTest("SCACTileTest28", SCACTileTest28); UtRegisterTest("SCACTileTest29", SCACTileTest29); #endif } #else /* we're big endian */ void MpmACTileRegister(void) { /* no-op on big endian */ } #endif /* little endian check */ suricata-3.2.1/src/util-lua-dnp3.h0000644000000000000000000000156613051004444013560 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __UTIL_LUA_DNP3_H__ #define __UTIL_LUA_DNP3_H__ #ifdef HAVE_LUA int LuaRegisterDNP3Functions(lua_State *); #endif /* HAVE_LUA */ #endif /* !__UTIL_LUA_DNP3_H__ */ suricata-3.2.1/src/host-timeout.c0000644000000000000000000001025013051004444013604 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "host.h" #include "detect-engine-tag.h" #include "detect-engine-threshold.h" #include "host-bit.h" #include "reputation.h" uint32_t HostGetSpareCount(void) { return HostSpareQueueGetSize(); } uint32_t HostGetActiveCount(void) { return SC_ATOMIC_GET(host_counter); } /** \internal * \brief See if we can really discard this host. Check use_cnt reference. * * \param h host * \param ts timestamp * * \retval 0 not timed out just yet * \retval 1 fully timed out, lets kill it */ static int HostHostTimedOut(Host *h, struct timeval *ts) { int tags = 0; int thresholds = 0; int vars = 0; /** never prune a host that is used by a packet * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(h->use_cnt) > 0) { return 0; } if (h->iprep) { if (SRepHostTimedOut(h) == 0) return 0; SCLogDebug("host %p reputation timed out", h); } if (TagHostHasTag(h) && TagTimeoutCheck(h, ts) == 0) { tags = 1; } if (ThresholdHostHasThreshold(h) && ThresholdTimeoutCheck(h, ts) == 0) { thresholds = 1; } if (HostHasHostBits(h) && HostBitsTimedoutCheck(h, ts) == 0) { vars = 1; } if (tags || thresholds || vars) return 0; SCLogDebug("host %p timed out", h); return 1; } /** * \internal * * \brief check all hosts in a hash row for timing out * * \param hb host hash row *LOCKED* * \param h last host in the hash row * \param ts timestamp * * \retval cnt timed out hosts */ static uint32_t HostHashRowTimeout(HostHashRow *hb, Host *h, struct timeval *ts) { uint32_t cnt = 0; do { if (SCMutexTrylock(&h->m) != 0) { h = h->hprev; continue; } Host *next_host = h->hprev; /* check if the host is fully timed out and * ready to be discarded. */ if (HostHostTimedOut(h, ts) == 1) { /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; HostClearMemory (h); /* no one is referring to this host, use_cnt 0, removed from hash * so we can unlock it and move it back to the spare queue. */ SCMutexUnlock(&h->m); /* move to spare list */ HostMoveToSpare(h); cnt++; } else { SCMutexUnlock(&h->m); } h = next_host; } while (h != NULL); return cnt; } /** * \brief time out hosts from the hash * * \param ts timestamp * * \retval cnt number of timed out host */ uint32_t HostTimeoutHash(struct timeval *ts) { uint32_t idx = 0; uint32_t cnt = 0; for (idx = 0; idx < host_config.hash_size; idx++) { HostHashRow *hb = &host_hash[idx]; if (HRLOCK_TRYLOCK(hb) != 0) continue; /* host hash bucket is now locked */ if (hb->tail == NULL) { HRLOCK_UNLOCK(hb); continue; } /* we have a host, or more than one */ cnt += HostHashRowTimeout(hb, hb->tail, ts); HRLOCK_UNLOCK(hb); } return cnt; } suricata-3.2.1/src/tmqh-nfq.h0000644000000000000000000000157113051004444012711 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TMQH_NFQ_H__ #define __TMQH_NFQ_H__ void TmqhNfqRegister (void); #endif /* __TMQH_NFQ_H__ */ suricata-3.2.1/src/decode-pppoe.c0000644000000000000000000003151313051004444013514 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author James Riden * * PPPOE Decoder */ #include "suricata-common.h" #include "packet-queue.h" #include "decode.h" #include "decode-ppp.h" #include "decode-pppoe.h" #include "decode-events.h" #include "flow.h" #include "util-unittest.h" #include "util-debug.h" /** * \brief Main decoding function for PPPOE Discovery packets */ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_pppoe); if (len < PPPOE_DISCOVERY_HEADER_MIN_LEN) { ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->pppoedh = (PPPOEDiscoveryHdr *)pkt; if (p->pppoedh == NULL) return TM_ECODE_FAILED; /* parse the PPPOE code */ switch (p->pppoedh->pppoe_code) { case PPPOE_CODE_PADI: break; case PPPOE_CODE_PADO: break; case PPPOE_CODE_PADR: break; case PPPOE_CODE_PADS: break; case PPPOE_CODE_PADT: break; default: SCLogDebug("unknown PPPOE code: 0x%0"PRIX8"", p->pppoedh->pppoe_code); ENGINE_SET_INVALID_EVENT(p, PPPOE_WRONG_CODE); return TM_ECODE_OK; } /* parse any tags we have in the packet */ uint16_t tag_length = 0; PPPOEDiscoveryTag* pppoedt = (PPPOEDiscoveryTag*) (p->pppoedh + PPPOE_DISCOVERY_HEADER_MIN_LEN); uint16_t pppoe_length = ntohs(p->pppoedh->pppoe_length); uint16_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN ; SCLogDebug("pppoe_length %"PRIu16", packet_length %"PRIu16"", pppoe_length, packet_length); if (pppoe_length > packet_length) { SCLogDebug("malformed PPPOE tags"); ENGINE_SET_INVALID_EVENT(p, PPPOE_MALFORMED_TAGS); return TM_ECODE_OK; } while (pppoedt < (PPPOEDiscoveryTag*) (pkt + (len - sizeof(PPPOEDiscoveryTag))) && pppoe_length >=4 && packet_length >=4) { #ifdef DEBUG uint16_t tag_type = ntohs(pppoedt->pppoe_tag_type); #endif tag_length = ntohs(pppoedt->pppoe_tag_length); SCLogDebug ("PPPoE Tag type %x, length %u", tag_type, tag_length); if (pppoe_length >= (4 + tag_length)) { pppoe_length -= (4 + tag_length); } else { pppoe_length = 0; // don't want an underflow } if (packet_length >= 4 + tag_length) { packet_length -= (4 + tag_length); } else { packet_length = 0; // don't want an underflow } pppoedt = pppoedt + (4 + tag_length); } return TM_ECODE_OK; } /** * \brief Main decoding function for PPPOE Session packets */ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_pppoe); if (len < PPPOE_SESSION_HEADER_LEN) { ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->pppoesh = (PPPOESessionHdr *)pkt; if (p->pppoesh == NULL) return TM_ECODE_FAILED; SCLogDebug("PPPOE VERSION %" PRIu32 " TYPE %" PRIu32 " CODE %" PRIu32 " SESSIONID %" PRIu32 " LENGTH %" PRIu32 "", PPPOE_SESSION_GET_VERSION(p->pppoesh), PPPOE_SESSION_GET_TYPE(p->pppoesh), p->pppoesh->pppoe_code, ntohs(p->pppoesh->session_id), ntohs(p->pppoesh->pppoe_length)); /* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol instead of the full PPP header */ if (ntohs(p->pppoesh->pppoe_length) > 0) { /* decode contained PPP packet */ switch (ntohs(p->pppoesh->protocol)) { case PPP_VJ_COMP: case PPP_IPX: case PPP_OSI: case PPP_NS: case PPP_DECNET: case PPP_APPLE: case PPP_BRPDU: case PPP_STII: case PPP_VINES: case PPP_HELLO: case PPP_LUXCOM: case PPP_SNS: case PPP_MPLS_UCAST: case PPP_MPLS_MCAST: case PPP_IPCP: case PPP_OSICP: case PPP_NSCP: case PPP_DECNETCP: case PPP_APPLECP: case PPP_IPXCP: case PPP_STIICP: case PPP_VINESCP: case PPP_IPV6CP: case PPP_MPLSCP: case PPP_LCP: case PPP_PAP: case PPP_LQM: case PPP_CHAP: ENGINE_SET_EVENT(p,PPP_UNSUP_PROTO); break; case PPP_VJ_UCOMP: if(len < (PPPOE_SESSION_HEADER_LEN + IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, PPPVJU_PKT_TOO_SMALL); return TM_ECODE_OK; } if(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPPOE_SESSION_HEADER_LEN)) == 4) { DecodeIPV4(tv, dtv, p, pkt + PPPOE_SESSION_HEADER_LEN, len - PPPOE_SESSION_HEADER_LEN, pq ); } break; case PPP_IP: if(len < (PPPOE_SESSION_HEADER_LEN + IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, PPPIPV4_PKT_TOO_SMALL); return TM_ECODE_OK; } DecodeIPV4(tv, dtv, p, pkt + PPPOE_SESSION_HEADER_LEN, len - PPPOE_SESSION_HEADER_LEN, pq ); break; /* PPP IPv6 was not tested */ case PPP_IPV6: if(len < (PPPOE_SESSION_HEADER_LEN + IPV6_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, PPPIPV6_PKT_TOO_SMALL); return TM_ECODE_OK; } DecodeIPV6(tv, dtv, p, pkt + PPPOE_SESSION_HEADER_LEN, len - PPPOE_SESSION_HEADER_LEN, pq ); break; default: SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol)); ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE); return TM_ECODE_OK; } } return TM_ECODE_OK; } #ifdef UNITTESTS /** DecodePPPOEtest01 * \brief Decode malformed PPPOE packet (too short) * \retval 1 Expected test value */ static int DecodePPPOEtest01 (void) { uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL); if (ENGINE_ISSET_EVENT(p,PPPOE_PKT_TOO_SMALL)) { SCFree(p); return 1; } SCFree(p); return 0; } /** DecodePPPOEtest02 * \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged * \retval 0 Expected test value */ static int DecodePPPOEtest02 (void) { uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c, 0x05, 0x5c, 0x00, 0x00, 0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f, 0xc0, 0xa8, 0x0a, 0x65, 0xab, 0xcd, 0x16, 0x5e, 0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL); if(ENGINE_ISSET_EVENT(p,PPPOE_PKT_TOO_SMALL)) { goto end; } // and we insist that the invalid ICMP encapsulated (type 0xab, code 0xcd) is flagged if(! ENGINE_ISSET_EVENT(p,ICMPV4_UNKNOWN_TYPE)) { goto end; } ret = 1; end: FlowShutdown(); SCFree(p); return ret; } /** DecodePPPOEtest03 * \brief Valid example PADO packet PPPOE packet taken from RFC2516 * \retval 0 Expected test value */ static int DecodePPPOEtest03 (void) { /* example PADO packet taken from RFC2516 */ uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02, 0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20, 0x65, 0x73, 0x68, 0x73, 0x68, 0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL); if (p->pppoedh == NULL) { SCFree(p); return 0; } SCFree(p); return 1; } /** DecodePPPOEtest04 * \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code * \retval 1 Expected test value */ static int DecodePPPOEtest04 (void) { /* example PADI packet taken from RFC2516, but with wrong code */ uint8_t raw_pppoe[] = { 0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL); if(ENGINE_ISSET_EVENT(p,PPPOE_WRONG_CODE)) { SCFree(p); return 1; } SCFree(p); return 0; } /** DecodePPPOEtest05 * \brief Valid exaple PADO PPPOE packet taken from RFC2516, but too short for given length * \retval 0 Expected test value */ static int DecodePPPOEtest05 (void) { /* example PADI packet taken from RFC2516 */ uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02, 0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20, 0x65, 0x73, 0x68, 0x73, 0x68 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL); if(ENGINE_ISSET_EVENT(p,PPPOE_MALFORMED_TAGS)) { SCFree(p); return 1; } SCFree(p); return 0; } /** DecodePPPOEtest06 * \brief Check that the macros work as expected. Type and version are * fields of 4 bits length. So they are sharing the same var and the macros * should extract the first 4 bits for version and the second 4 bits for type * \retval 1 Expected test value */ static int DecodePPPOEtest06 (void) { PPPOESessionHdr pppoesh; PPPOEDiscoveryHdr pppoedh; pppoesh.pppoe_version_type = 0xAB; pppoedh.pppoe_version_type = 0xCD; if (PPPOE_SESSION_GET_VERSION(&pppoesh) != 0x0A) { printf("Error, PPPOE macro pppoe_session_get_version failed: "); return 0; } if (PPPOE_SESSION_GET_TYPE(&pppoesh) != 0x0B) { printf("Error, PPPOE macro pppoe_session_get_type failed: "); return 0; } if (PPPOE_DISCOVERY_GET_VERSION(&pppoedh) != 0x0C) { printf("Error, PPPOE macro pppoe_discovery_get_version failed: "); return 0; } if (PPPOE_DISCOVERY_GET_TYPE(&pppoedh) != 0x0D) { printf("Error, PPPOE macro pppoe_discovery_get_type failed: "); return 0; } return 1; } #endif /* UNITTESTS */ /** * \brief Registers PPPOE unit tests * \todo More PPPOE tests */ void DecodePPPOERegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodePPPOEtest01", DecodePPPOEtest01); UtRegisterTest("DecodePPPOEtest02", DecodePPPOEtest02); UtRegisterTest("DecodePPPOEtest03", DecodePPPOEtest03); UtRegisterTest("DecodePPPOEtest04", DecodePPPOEtest04); UtRegisterTest("DecodePPPOEtest05", DecodePPPOEtest05); UtRegisterTest("DecodePPPOEtest06", DecodePPPOEtest06); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/runmode-af-packet.h0000644000000000000000000000205513051004444014456 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #ifndef __RUNMODE_AF_PACKET_H__ #define __RUNMODE_AF_PACKET_H__ int RunModeIdsAFPSingle(void); int RunModeIdsAFPAutoFp(void); int RunModeIdsAFPWorkers(void); void RunModeIdsAFPRegister(void); const char *RunModeAFPGetDefaultMode(void); int AFPRunModeIsIPS(); #endif /* __RUNMODE_AF_PACKET_H__ */ suricata-3.2.1/src/util-pool-thread.c0000644000000000000000000002554713051004444014353 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup utilpool Pool * * @{ */ /** * \file * * \author Victor Julien * * Pool utility functions */ #include "suricata-common.h" #include "util-pool.h" #include "util-pool-thread.h" #include "util-unittest.h" #include "util-debug.h" PoolThread *PoolThreadInit(int threads, uint32_t size, uint32_t prealloc_size, uint32_t elt_size, void *(*Alloc)(), int (*Init)(void *, void *), void *InitData, void (*Cleanup)(void *), void (*Free)(void *)) { PoolThread *pt = NULL; int i; if (threads <= 0) { SCLogDebug("error"); goto error; } pt = SCMalloc(sizeof(*pt)); if (unlikely(pt == NULL)) { SCLogDebug("memory alloc error"); goto error; } SCLogDebug("size %d", threads); pt->array = SCMalloc(threads * sizeof(PoolThreadElement)); if (pt->array == NULL) { SCLogDebug("memory alloc error"); goto error; } pt->size = threads; for (i = 0; i < threads; i++) { PoolThreadElement *e = &pt->array[i]; SCMutexInit(&e->lock, NULL); SCMutexLock(&e->lock); // SCLogDebug("size %u prealloc_size %u elt_size %u Alloc %p Init %p InitData %p Cleanup %p Free %p", // size, prealloc_size, elt_size, // Alloc, Init, InitData, Cleanup, Free); e->pool = PoolInit(size, prealloc_size, elt_size, Alloc, Init, InitData, Cleanup, Free); SCMutexUnlock(&e->lock); if (e->pool == NULL) { SCLogDebug("error"); goto error; } } return pt; error: if (pt != NULL) PoolThreadFree(pt); return NULL; } /** * */ int PoolThreadGrow(PoolThread *pt, uint32_t size, uint32_t prealloc_size, uint32_t elt_size, void *(*Alloc)(), int (*Init)(void *, void *), void *InitData, void (*Cleanup)(void *), void (*Free)(void *)) { void *ptmp; size_t newsize; PoolThreadElement *e = NULL; if (pt == NULL || pt->array == NULL) { SCLogError(SC_ERR_POOL_INIT, "pool grow failed"); return -1; } newsize = pt->size + 1; SCLogDebug("newsize %"PRIuMAX, (uintmax_t)newsize); ptmp = SCRealloc(pt->array, (newsize * sizeof(PoolThreadElement))); if (ptmp == NULL) { SCFree(pt->array); pt->array = NULL; SCLogError(SC_ERR_POOL_INIT, "pool grow failed"); return -1; } pt->array = ptmp; pt->size = newsize; e = &pt->array[newsize - 1]; memset(e, 0x00, sizeof(*e)); SCMutexInit(&e->lock, NULL); SCMutexLock(&e->lock); e->pool = PoolInit(size, prealloc_size, elt_size, Alloc, Init, InitData, Cleanup, Free); SCMutexUnlock(&e->lock); if (e->pool == NULL) { SCLogError(SC_ERR_POOL_INIT, "pool grow failed"); return -1; } return (int)(newsize - 1); } int PoolThreadSize(PoolThread *pt) { if (pt == NULL) return -1; return (int)pt->size; } void PoolThreadFree(PoolThread *pt) { int i; if (pt == NULL) return; if (pt->array != NULL) { for (i = 0; i < (int)pt->size; i++) { PoolThreadElement *e = &pt->array[i]; SCMutexLock(&e->lock); PoolFree(e->pool); SCMutexUnlock(&e->lock); SCMutexDestroy(&e->lock); } SCFree(pt->array); } SCFree(pt); } void *PoolThreadGetById(PoolThread *pt, uint16_t id) { void *data = NULL; if (pt == NULL || id >= pt->size) return NULL; PoolThreadElement *e = &pt->array[id]; SCMutexLock(&e->lock); data = PoolGet(e->pool); SCMutexUnlock(&e->lock); if (data) { PoolThreadReserved *did = data; *did = id; } return data; } void PoolThreadReturn(PoolThread *pt, void *data) { PoolThreadReserved *id = data; if (pt == NULL || *id >= pt->size) return; SCLogDebug("returning to id %u", *id); PoolThreadElement *e = &pt->array[*id]; SCMutexLock(&e->lock); PoolReturn(e->pool, data); SCMutexUnlock(&e->lock); } #ifdef UNITTESTS struct PoolThreadTestData { PoolThreadReserved res; int abc; }; static void *PoolThreadTestAlloc(void) { void *data = SCMalloc(sizeof(struct PoolThreadTestData)); return data; } static int PoolThreadTestInit(void *data, void *allocdata) { if (!data) return 0; memset(data,0x00,sizeof(allocdata)); struct PoolThreadTestData *pdata = data; pdata->abc = *(int *)allocdata; return 1; } static void PoolThreadTestFree(void *data) { } static int PoolThreadTestInit01(void) { PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, NULL, NULL, NULL, NULL); if (pt == NULL) return 0; PoolThreadFree(pt); return 1; } static int PoolThreadTestInit02(void) { int i = 123; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL); if (pt == NULL) return 0; PoolThreadFree(pt); return 1; } static int PoolThreadTestGet01(void) { int result = 0; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, NULL, NULL, NULL, NULL); if (pt == NULL) return 0; void *data = PoolThreadGetById(pt, 3); if (data == NULL) { printf("data == NULL: "); goto end; } struct PoolThreadTestData *pdata = data; if (pdata->res != 3) { printf("res != 3, but %d: ", pdata->res); goto end; } result = 1; end: PoolThreadFree(pt); return result; } static int PoolThreadTestGet02(void) { int i = 123; int result = 0; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL); if (pt == NULL) return 0; void *data = PoolThreadGetById(pt, 3); if (data == NULL) { printf("data == NULL: "); goto end; } struct PoolThreadTestData *pdata = data; if (pdata->res != 3) { printf("res != 3, but %d: ", pdata->res); goto end; } if (pdata->abc != 123) { printf("abc != 123, but %d: ", pdata->abc); goto end; } result = 1; end: PoolThreadFree(pt); return result; } static int PoolThreadTestReturn01(void) { int i = 123; int result = 0; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL); if (pt == NULL) return 0; void *data = PoolThreadGetById(pt, 3); if (data == NULL) { printf("data == NULL: "); goto end; } struct PoolThreadTestData *pdata = data; if (pdata->res != 3) { printf("res != 3, but %d: ", pdata->res); goto end; } if (pdata->abc != 123) { printf("abc != 123, but %d: ", pdata->abc); goto end; } if (pt->array[3].pool->outstanding != 1) { printf("pool outstanding count wrong %u: ", pt->array[3].pool->outstanding); goto end; } PoolThreadReturn(pt, data); if (pt->array[3].pool->outstanding != 0) { printf("pool outstanding count wrong %u: ", pt->array[3].pool->outstanding); goto end; } result = 1; end: PoolThreadFree(pt); return result; } static int PoolThreadTestGrow01(void) { PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, NULL, NULL, NULL, NULL); if (pt == NULL) return 0; if (PoolThreadGrow(pt, 10, 5, 10, PoolThreadTestAlloc, NULL, NULL, NULL, NULL) < 0) { PoolThreadFree(pt); return 0; } PoolThreadFree(pt); return 1; } static int PoolThreadTestGrow02(void) { int i = 123; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL); if (pt == NULL) return 0; if (PoolThreadGrow(pt, 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL) < 0) { PoolThreadFree(pt); return 0; } PoolThreadFree(pt); return 1; } static int PoolThreadTestGrow03(void) { int i = 123; int result = 0; PoolThread *pt = PoolThreadInit(4, /* threads */ 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL); if (pt == NULL) return 0; if (PoolThreadGrow(pt, 10, 5, 10, PoolThreadTestAlloc, PoolThreadTestInit, &i, PoolThreadTestFree, NULL) < 0) { PoolThreadFree(pt); return 0; } void *data = PoolThreadGetById(pt, 4); if (data == NULL) { printf("data == NULL: "); goto end; } struct PoolThreadTestData *pdata = data; if (pdata->res != 4) { printf("res != 5, but %d: ", pdata->res); goto end; } if (pdata->abc != 123) { printf("abc != 123, but %d: ", pdata->abc); goto end; } if (pt->array[4].pool->outstanding != 1) { printf("pool outstanding count wrong %u: ", pt->array[4].pool->outstanding); goto end; } PoolThreadReturn(pt, data); if (pt->array[4].pool->outstanding != 0) { printf("pool outstanding count wrong %u: ", pt->array[4].pool->outstanding); goto end; } result = 1; end: PoolThreadFree(pt); return result; } #endif void PoolThreadRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("PoolThreadTestInit01", PoolThreadTestInit01); UtRegisterTest("PoolThreadTestInit02", PoolThreadTestInit02); UtRegisterTest("PoolThreadTestGet01", PoolThreadTestGet01); UtRegisterTest("PoolThreadTestGet02", PoolThreadTestGet02); UtRegisterTest("PoolThreadTestReturn01", PoolThreadTestReturn01); UtRegisterTest("PoolThreadTestGrow01", PoolThreadTestGrow01); UtRegisterTest("PoolThreadTestGrow02", PoolThreadTestGrow02); UtRegisterTest("PoolThreadTestGrow03", PoolThreadTestGrow03); #endif } /** * @} */ suricata-3.2.1/src/util-spm.h0000644000000000000000000001057413051004444012733 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __UTIL_SPM_H__ #define __UTIL_SPM_H__ #include "util-spm-bs.h" #include "util-spm-bs2bm.h" #include "util-spm-bm.h" enum { SPM_BM, /* Boyer-Moore */ SPM_HS, /* Hyperscan */ /* Other SPM matchers will go here. */ SPM_TABLE_SIZE }; uint16_t SinglePatternMatchDefaultMatcher(void); /** Structure holding an immutable "built" SPM matcher (such as the Boyer-Moore * tables, Hyperscan database etc) that is passed to the Scan call. */ typedef struct SpmCtx_ { uint16_t matcher; void *ctx; } SpmCtx; /** Structure holding a global prototype for per-thread scratch space, passed * to each InitCtx call. */ typedef struct SpmGlobalThreadCtx_ { uint16_t matcher; void *ctx; } SpmGlobalThreadCtx; /** Structure holding some mutable per-thread space for use by a matcher at * scan time. Constructed from SpmGlobalThreadCtx by the MakeThreadCtx call. */ typedef struct SpmThreadCtx_ { uint16_t matcher; void *ctx; } SpmThreadCtx; typedef struct SpmTableElmt_ { const char *name; SpmGlobalThreadCtx *(*InitGlobalThreadCtx)(void); void (*DestroyGlobalThreadCtx)(SpmGlobalThreadCtx *g_thread_ctx); SpmThreadCtx *(*MakeThreadCtx)(const SpmGlobalThreadCtx *g_thread_ctx); void (*DestroyThreadCtx)(SpmThreadCtx *thread_ctx); SpmCtx *(*InitCtx)(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *g_thread_ctx); void (*DestroyCtx)(SpmCtx *); uint8_t *(*Scan)(const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint16_t haystack_len); } SpmTableElmt; SpmTableElmt spm_table[SPM_TABLE_SIZE]; void SpmTableSetup(void); SpmGlobalThreadCtx *SpmInitGlobalThreadCtx(uint16_t matcher); void SpmDestroyGlobalThreadCtx(SpmGlobalThreadCtx *g_thread_ctx); SpmThreadCtx *SpmMakeThreadCtx(const SpmGlobalThreadCtx *g_thread_ctx); void SpmDestroyThreadCtx(SpmThreadCtx *thread_ctx); SpmCtx *SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *g_thread_ctx); void SpmDestroyCtx(SpmCtx *ctx); uint8_t *SpmScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint16_t haystack_len); /** Default algorithm to use: Boyer Moore */ uint8_t *Bs2bmSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen); uint8_t *Bs2bmNocaseSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen); uint8_t *BoyerMooreSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen); uint8_t *BoyerMooreNocaseSearch(const uint8_t *text, uint32_t textlen, uint8_t *needle, uint16_t needlelen); /* Macros for automatic algorithm selection (use them only when you can't store the context) */ #define SpmSearch(text, textlen, needle, needlelen) ({\ uint8_t *mfound; \ if (needlelen < 4 && textlen < 512) \ mfound = BasicSearch(text, textlen, needle, needlelen); \ else if (needlelen < 4) \ mfound = BasicSearch(text, textlen, needle, needlelen); \ else \ mfound = BoyerMooreSearch(text, textlen, needle, needlelen); \ mfound; \ }) #define SpmNocaseSearch(text, textlen, needle, needlelen) ({\ uint8_t *mfound; \ if (needlelen < 4 && textlen < 512) \ mfound = BasicSearchNocase(text, textlen, needle, needlelen); \ else if (needlelen < 4) \ mfound = BasicSearchNocase(text, textlen, needle, needlelen); \ else \ mfound = BoyerMooreNocaseSearch(text, textlen, needle, needlelen); \ mfound; \ }) void UtilSpmSearchRegistertests(void); #endif /* __UTIL_SPM_H__ */ suricata-3.2.1/src/detect-modbus.c0000644000000000000000000007066113051004444013716 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author David DIALLO * * Implements the Modbus function and access keywords * You can specify a: * - concrete function like Modbus: * function 8, subfunction 4 (diagnostic: Force Listen Only Mode) * - data (in primary table) register access (r/w) like Modbus: * access read coils, address 1000 (.i.e Read coils: at address 1000) * - write data value at specific address Modbus: * access write, address 1500<>2000, value >2000 (Write multiple coils/register: * at address between 1500 and 2000 value greater than 2000) */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-modbus.h" #include "detect-engine-modbus.h" #include "util-debug.h" #include "app-layer-modbus.h" #include "stream-tcp.h" /** * \brief Regex for parsing the Modbus function string */ #define PARSE_REGEX_FUNCTION "^\\s*\"?\\s*function\\s*(!?[A-z0-9]+)(,\\s*subfunction\\s+(\\d+))?\\s*\"?\\s*$" static pcre *function_parse_regex; static pcre_extra *function_parse_regex_study; /** * \brief Regex for parsing the Modbus access string */ #define PARSE_REGEX_ACCESS "^\\s*\"?\\s*access\\s*(read|write)\\s*(discretes|coils|input|holding)?(,\\s*address\\s+([<>]?\\d+)(<>\\d+)?(,\\s*value\\s+([<>]?\\d+)(<>\\d+)?)?)?\\s*\"?\\s*$" static pcre *access_parse_regex; static pcre_extra *access_parse_regex_study; #define MAX_SUBSTRINGS 30 void DetectModbusRegisterTests(void); /** \internal * * \brief this function will free memory associated with DetectModbus * * \param ptr pointer to DetectModbus */ static void DetectModbusFree(void *ptr) { SCEnter(); DetectModbus *modbus = (DetectModbus *) ptr; if(modbus) { if (modbus->subfunction) SCFree(modbus->subfunction); if (modbus->address) SCFree(modbus->address); if (modbus->data) SCFree(modbus->data); SCFree(modbus); } } /** \internal * * \brief This function is used to parse Modbus parameters in access mode * * \param str Pointer to the user provided id option * * \retval Pointer to DetectModbusData on success or NULL on failure */ static DetectModbus *DetectModbusAccessParse(char *str) { SCEnter(); DetectModbus *modbus = NULL; char arg[MAX_SUBSTRINGS]; int ov[MAX_SUBSTRINGS], ret, res; ret = pcre_exec(access_parse_regex, access_parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) goto error; res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 1, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct Modbus option */ modbus = (DetectModbus *) SCCalloc(1, sizeof(DetectModbus)); if (unlikely(modbus == NULL)) goto error; if (strcmp(arg, "read") == 0) modbus->type = MODBUS_TYP_READ; else if (strcmp(arg, "write") == 0) modbus->type = MODBUS_TYP_WRITE; else goto error; if (ret > 2) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 2, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (*arg != '\0') { if (strcmp(arg, "discretes") == 0) { if (modbus->type == MODBUS_TYP_WRITE) /* Discrete access is only read access. */ goto error; modbus->type |= MODBUS_TYP_DISCRETES; } else if (strcmp(arg, "coils") == 0) { modbus->type |= MODBUS_TYP_COILS; } else if (strcmp(arg, "input") == 0) { if (modbus->type == MODBUS_TYP_WRITE) { /* Input access is only read access. */ goto error; } modbus->type |= MODBUS_TYP_INPUT; } else if (strcmp(arg, "holding") == 0) { modbus->type |= MODBUS_TYP_HOLDING; } else goto error; } if (ret > 4) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 4, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct address option */ modbus->address = (DetectModbusValue *) SCCalloc(1, sizeof(DetectModbusValue)); if (unlikely(modbus->address == NULL)) goto error; if (arg[0] == '>') { modbus->address->min = atoi((const char*) (arg+1)); modbus->address->mode = DETECT_MODBUS_GT; } else if (arg[0] == '<') { modbus->address->min = atoi((const char*) (arg+1)); modbus->address->mode = DETECT_MODBUS_LT; } else { modbus->address->min = atoi((const char*) arg); } SCLogDebug("and min/equal address %d", modbus->address->min); if (ret > 5) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 5, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (*arg != '\0') { modbus->address->max = atoi((const char*) (arg+2)); modbus->address->mode = DETECT_MODBUS_RA; SCLogDebug("and max address %d", modbus->address->max); } if (ret > 7) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 7, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (modbus->address->mode != DETECT_MODBUS_EQ) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords (address range and value)."); goto error; } /* We have a correct address option */ modbus->data = (DetectModbusValue *) SCCalloc(1, sizeof(DetectModbusValue)); if (unlikely(modbus->data == NULL)) goto error; if (arg[0] == '>') { modbus->data->min = atoi((const char*) (arg+1)); modbus->data->mode = DETECT_MODBUS_GT; } else if (arg[0] == '<') { modbus->data->min = atoi((const char*) (arg+1)); modbus->data->mode = DETECT_MODBUS_LT; } else { modbus->data->min = atoi((const char*) arg); } SCLogDebug("and min/equal value %d", modbus->data->min); if (ret > 8) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 8, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (*arg != '\0') { modbus->data->max = atoi((const char*) (arg+2)); modbus->data->mode = DETECT_MODBUS_RA; SCLogDebug("and max value %d", modbus->data->max); } } } } } } SCReturnPtr(modbus, "DetectModbusAccess"); error: if (modbus != NULL) DetectModbusFree(modbus); SCReturnPtr(NULL, "DetectModbus"); } /** \internal * * \brief This function is used to parse Modbus parameters in function mode * * \param str Pointer to the user provided id option * * \retval id_d pointer to DetectModbusData on success * \retval NULL on failure */ static DetectModbus *DetectModbusFunctionParse(char *str) { SCEnter(); DetectModbus *modbus = NULL; char arg[MAX_SUBSTRINGS], *ptr = arg; int ov[MAX_SUBSTRINGS], res, ret; ret = pcre_exec(function_parse_regex, function_parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) goto error; res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 1, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct Modbus function option */ modbus = (DetectModbus *) SCCalloc(1, sizeof(DetectModbus)); if (unlikely(modbus == NULL)) goto error; if (isdigit((unsigned char)ptr[0])) { modbus->function = atoi((const char*) ptr); SCLogDebug("will look for modbus function %d", modbus->function); if (ret > 2) { res = pcre_copy_substring(str, ov, MAX_SUBSTRINGS, 3, arg, MAX_SUBSTRINGS); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct address option */ modbus->subfunction =(uint16_t *) SCCalloc(1, sizeof(uint16_t)); if (modbus->subfunction == NULL) goto error; *(modbus->subfunction) = atoi((const char*) arg); SCLogDebug("and subfunction %d", *(modbus->subfunction)); } } else { uint8_t neg = 0; if (ptr[0] == '!') { neg = 1; ptr++; } if (strcmp("assigned", ptr) == 0) modbus->category = MODBUS_CAT_PUBLIC_ASSIGNED; else if (strcmp("unassigned", ptr) == 0) modbus->category = MODBUS_CAT_PUBLIC_UNASSIGNED; else if (strcmp("public", ptr) == 0) modbus->category = MODBUS_CAT_PUBLIC_ASSIGNED | MODBUS_CAT_PUBLIC_UNASSIGNED; else if (strcmp("user", ptr) == 0) modbus->category = MODBUS_CAT_USER_DEFINED; else if (strcmp("reserved", ptr) == 0) modbus->category = MODBUS_CAT_RESERVED; else if (strcmp("all", ptr) == 0) modbus->category = MODBUS_CAT_ALL; if (neg) modbus->category = ~modbus->category; SCLogDebug("will look for modbus category function %d", modbus->category); } SCReturnPtr(modbus, "DetectModbusFunction"); error: if (modbus != NULL) DetectModbusFree(modbus); SCReturnPtr(NULL, "DetectModbus"); } /** \internal * * \brief this function is used to add the parsed "id" option into the current signature * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Current Signature * \param str Pointer to the user provided "id" option * * \retval 0 on Success or -1 on Failure */ static int DetectModbusSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); DetectModbus *modbus = NULL; SigMatch *sm = NULL; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_MODBUS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } if ((modbus = DetectModbusFunctionParse(str)) == NULL) { if ((modbus = DetectModbusAccessParse(str)) == NULL) { SCLogError(SC_ERR_PCRE_MATCH, "invalid modbus option"); goto error; } } /* Okay so far so good, lets get this into a SigMatch and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_MODBUS; sm->ctx = (void *) modbus; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MODBUS_MATCH); s->alproto = ALPROTO_MODBUS; SCReturnInt(0); error: if (modbus != NULL) DetectModbusFree(modbus); if (sm != NULL) SCFree(sm); SCReturnInt(-1); } /** * \brief Registration function for Modbus keyword */ void DetectModbusRegister(void) { SCEnter(); sigmatch_table[DETECT_AL_MODBUS].name = "modbus"; sigmatch_table[DETECT_AL_MODBUS].Match = NULL; sigmatch_table[DETECT_AL_MODBUS].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_MODBUS].Setup = DetectModbusSetup; sigmatch_table[DETECT_AL_MODBUS].Free = DetectModbusFree; sigmatch_table[DETECT_AL_MODBUS].RegisterTests = DetectModbusRegisterTests; DetectSetupParseRegexes(PARSE_REGEX_FUNCTION, &function_parse_regex, &function_parse_regex_study); DetectSetupParseRegexes(PARSE_REGEX_ACCESS, &access_parse_regex, &access_parse_regex_study); DetectAppLayerInspectEngineRegister(ALPROTO_MODBUS, SIG_FLAG_TOSERVER, DETECT_SM_LIST_MODBUS_MATCH, DetectEngineInspectModbus); DetectAppLayerInspectEngineRegister(ALPROTO_MODBUS, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_MODBUS_MATCH, DetectEngineInspectModbus); } #ifdef UNITTESTS /* UNITTESTS */ #include "util-unittest.h" /** \test Signature containing a function. */ static int DetectModbusTest01(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus function\"; " "modbus: function 1; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if (modbus->function != 1) { printf("expected function %d, got %" PRIu8 ": ", 1, modbus->function); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a function and a subfunction. */ static int DetectModbusTest02(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus function and subfunction\"; " "modbus: function 8, subfunction 4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if ((modbus->function != 8) || (*modbus->subfunction != 4)) { printf("expected function %d, got %" PRIu8 ": ", 1, modbus->function); printf("expected subfunction %d, got %" PRIu16 ": ", 4, *modbus->subfunction); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a function category. */ static int DetectModbusTest03(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.function\"; " "modbus: function reserved; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if (modbus->category != MODBUS_CAT_RESERVED) { printf("expected function %d, got %" PRIu8 ": ", MODBUS_CAT_RESERVED, modbus->category); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a negative function category. */ static int DetectModbusTest04(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; uint8_t category = ~MODBUS_CAT_PUBLIC_ASSIGNED; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus function\"; " "modbus: function !assigned; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if (modbus->category != category) { printf("expected function %u, got %" PRIu8 ": ", ~MODBUS_CAT_PUBLIC_ASSIGNED, modbus->category); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a access type. */ static int DetectModbusTest05(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.access\"; " "modbus: access read; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if (modbus->type != MODBUS_TYP_READ) { printf("expected function %d, got %" PRIu8 ": ", MODBUS_TYP_READ, modbus->type); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a access function. */ static int DetectModbusTest06(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; uint8_t type = (MODBUS_TYP_READ | MODBUS_TYP_DISCRETES); int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.access\"; " "modbus: access read discretes; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if (modbus->type != type) { printf("expected function %" PRIu8 ", got %" PRIu8 ": ", type, modbus->type); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a read access at an address. */ static int DetectModbusTest07(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; DetectModbusMode mode = DETECT_MODBUS_EQ; uint8_t type = MODBUS_TYP_READ; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.access\"; " "modbus: access read, address 1000; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if ((modbus->type != type) || ((*modbus->address).mode != mode) || ((*modbus->address).min != 1000)) { printf("expected function %" PRIu8 ", got %" PRIu8 ": ", type, modbus->type); printf("expected mode %u, got %u: ", mode, (*modbus->address).mode); printf("expected address %d, got %" PRIu16 ": ", 1000, (*modbus->address).min); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a write access at a range of address. */ static int DetectModbusTest08(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; DetectModbusMode mode = DETECT_MODBUS_GT; uint8_t type = (MODBUS_TYP_WRITE | MODBUS_TYP_COILS); int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.access\"; " "modbus: access write coils, address >500; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if ((modbus->type != type) || ((*modbus->address).mode != mode) || ((*modbus->address).min != 500)) { printf("expected function %" PRIu8 ", got %" PRIu8 ": ", type, modbus->type); printf("expected mode %d, got %u: ", mode, (*modbus->address).mode); printf("expected address %u, got %" PRIu16 ": ", 500, (*modbus->address).min); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Signature containing a write access at a address a range of value. */ static int DetectModbusTest09(void) { DetectEngineCtx *de_ctx = NULL; DetectModbus *modbus = NULL; DetectModbusMode addressMode = DETECT_MODBUS_EQ; DetectModbusMode valueMode = DETECT_MODBUS_RA; uint8_t type = (MODBUS_TYP_WRITE | MODBUS_TYP_HOLDING); int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus.access\"; " "modbus: access write holding, address 100, value 500<>1000; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if ((de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH] == NULL) || (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx == NULL)) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } modbus = (DetectModbus *) de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_MODBUS_MATCH]->ctx; if ((modbus->type != type) || ((*modbus->address).mode != addressMode) || ((*modbus->address).min != 100) || ((*modbus->data).mode != valueMode) || ((*modbus->data).min != 500) || ((*modbus->data).max != 1000)) { printf("expected function %" PRIu8 ", got %" PRIu8 ": ", type, modbus->type); printf("expected address mode %u, got %u: ", addressMode, (*modbus->address).mode); printf("expected address %d, got %" PRIu16 ": ", 500, (*modbus->address).min); printf("expected value mode %u, got %u: ", valueMode, (*modbus->data).mode); printf("expected min value %d, got %" PRIu16 ": ", 500, (*modbus->data).min); printf("expected max value %d, got %" PRIu16 ": ", 1000, (*modbus->data).max); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectModbus */ void DetectModbusRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectModbusTest01 - Testing function", DetectModbusTest01); UtRegisterTest("DetectModbusTest02 - Testing function and subfunction", DetectModbusTest02); UtRegisterTest("DetectModbusTest03 - Testing category function", DetectModbusTest03); UtRegisterTest("DetectModbusTest04 - Testing category function in negative", DetectModbusTest04); UtRegisterTest("DetectModbusTest05 - Testing access type", DetectModbusTest05); UtRegisterTest("DetectModbusTest06 - Testing access function", DetectModbusTest06); UtRegisterTest("DetectModbusTest07 - Testing access at address", DetectModbusTest07); UtRegisterTest("DetectModbusTest08 - Testing a range of address", DetectModbusTest08); UtRegisterTest("DetectModbusTest09 - Testing write a range of value", DetectModbusTest09); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-daemon.c0000644000000000000000000001140513051004444013364 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias Galvan * * Daemonization process */ #include "suricata.h" #include "suricata-common.h" #include "runmodes.h" #include "util-daemon.h" #include "util-debug.h" #include "conf.h" #ifndef OS_WIN32 #include #include #include static volatile sig_atomic_t sigflag = 0; /** * \brief Signal handler used to take the parent process out of stand-by */ static void SignalHandlerSigusr1 (int signo) { sigflag = 1; } /** * \brief Tell the parent process the child is ready * * \param pid pid of the parent process to signal */ static void TellWaitingParent (pid_t pid) { kill(pid, SIGUSR1); } /** * \brief Set the parent on stand-by until the child is ready * * \param pid pid of the child process to wait */ static void WaitForChild (pid_t pid) { int status; SCLogDebug("Daemon: Parent waiting for child to be ready..."); /* Wait until child signals is ready */ while (sigflag == 0) { if (waitpid(pid, &status, WNOHANG)) { /* Check if the child is still there, otherwise the parent should exit */ if (WIFEXITED(status) || WIFSIGNALED(status)) { SCLogError(SC_ERR_DAEMON, "Child died unexpectedly"); exit(EXIT_FAILURE); } } /* sigsuspend(); */ sleep(1); } } /** * \brief Close stdin, stdout, stderr.Redirect logging info to syslog * */ static void SetupLogging (void) { /* Redirect stdin, stdout, stderr to /dev/null */ int fd = open("/dev/null", O_RDWR); if (fd < 0) return; (void)dup2(fd, 0); (void)dup2(fd, 1); (void)dup2(fd, 2); close(fd); } /** * \brief Daemonize the process * */ void Daemonize (void) { pid_t pid, sid; /* Register the signal handler */ signal(SIGUSR1, SignalHandlerSigusr1); /** \todo We should check if wie allow more than 1 instance to run simultaneously. Maybe change the behaviour through conf file */ /* Creates a new process */ pid = fork(); if (pid < 0) { /* Fork error */ SCLogError(SC_ERR_DAEMON, "Error forking the process"); exit(EXIT_FAILURE); } else if (pid == 0) { /* Child continues here */ char *daemondir; umask(027); sid = setsid(); if (sid < 0) { SCLogError(SC_ERR_DAEMON, "Error creating new session"); exit(EXIT_FAILURE); } if (ConfGet("daemon-directory", &daemondir) == 1) { if ((chdir(daemondir)) < 0) { SCLogError(SC_ERR_DAEMON, "Error changing to working directory"); exit(EXIT_FAILURE); } } #ifndef OS_WIN32 else { if (chdir("/") < 0) { SCLogError(SC_ERR_DAEMON, "Error changing to working directory '/'"); } } #endif SetupLogging(); /* Child is ready, tell its parent */ TellWaitingParent(getppid()); /* Daemon is up and running */ SCLogDebug("Daemon is running"); return; } /* Parent continues here, waiting for child to be ready */ SCLogDebug("Parent is waiting for child to be ready"); WaitForChild(pid); /* Parent exits */ SCLogDebug("Child is ready, parent exiting"); exit(EXIT_SUCCESS); } #endif /* ifndef OS_WIN32 */ /** * \brief Check for a valid combination daemon/mode * * \param daemon daemon on or off * \param mode selected mode * * \retval 1 valid combination * \retval 0 invalid combination */ int CheckValidDaemonModes (int daemon, int mode) { if (daemon) { switch (mode) { case RUNMODE_PCAP_FILE: SCLogError(SC_ERR_INVALID_RUNMODE, "ERROR: pcap offline mode cannot run as daemon"); return 0; case RUNMODE_UNITTEST: SCLogError(SC_ERR_INVALID_RUNMODE, "ERROR: unittests cannot run as daemon"); return 0; default: SCLogDebug("Allowed mode"); break; } } return 1; } suricata-3.2.1/src/util-device.h0000644000000000000000000000430513051004444013366 00000000000000/* Copyright (C) 2011-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __UTIL_DEVICE_H__ #define __UTIL_DEVICE_H__ #include "queue.h" #include "unix-manager.h" #define OFFLOAD_FLAG_SG (1<<0) #define OFFLOAD_FLAG_TSO (1<<1) #define OFFLOAD_FLAG_GSO (1<<2) #define OFFLOAD_FLAG_GRO (1<<3) #define OFFLOAD_FLAG_LRO (1<<4) #define OFFLOAD_FLAG_RXCSUM (1<<5) #define OFFLOAD_FLAG_TXCSUM (1<<6) #define OFFLOAD_FLAG_TOE (1<<7) void LiveSetOffloadDisable(void); void LiveSetOffloadWarn(void); int LiveGetOffload(void); #define MAX_DEVNAME 10 /** storage for live device names */ typedef struct LiveDevice_ { char *dev; /**< the device (e.g. "eth0") */ char dev_short[MAX_DEVNAME + 1]; int ignore_checksum; SC_ATOMIC_DECLARE(uint64_t, pkts); SC_ATOMIC_DECLARE(uint64_t, drop); SC_ATOMIC_DECLARE(uint64_t, invalid_checksums); TAILQ_ENTRY(LiveDevice_) next; uint32_t offload_orig; /**< original offload settings to restore @exit */ } LiveDevice; int LiveRegisterDevice(const char *dev); int LiveGetDeviceCount(void); const char *LiveGetDeviceName(int number); LiveDevice *LiveGetDevice(const char *dev); const char *LiveGetShortName(const char *dev); int LiveBuildDeviceList(const char *base); void LiveDeviceHasNoStats(void); int LiveDeviceListClean(void); int LiveBuildDeviceListCustom(const char *base, const char *itemname); #ifdef BUILD_UNIX_SOCKET TmEcode LiveDeviceIfaceStat(json_t *cmd, json_t *server_msg, void *data); TmEcode LiveDeviceIfaceList(json_t *cmd, json_t *server_msg, void *data); #endif #endif /* __UTIL_DEVICE_H__ */ suricata-3.2.1/src/flow-hash.h0000644000000000000000000000524413051004444013047 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_HASH_H__ #define __FLOW_HASH_H__ /** Spinlocks or Mutex for the flow buckets. */ //#define FBLOCK_SPIN #define FBLOCK_MUTEX #ifdef FBLOCK_SPIN #ifdef FBLOCK_MUTEX #error Cannot enable both FBLOCK_SPIN and FBLOCK_MUTEX #endif #endif /* flow hash bucket -- the hash is basically an array of these buckets. * Each bucket contains a flow or list of flows. All these flows have * the same hashkey (the hash is a chained hash). When doing modifications * to the list, the entire bucket is locked. */ typedef struct FlowBucket_ { Flow *head; Flow *tail; #ifdef FBLOCK_MUTEX SCMutex m; #elif defined FBLOCK_SPIN SCSpinlock s; #else #error Enable FBLOCK_SPIN or FBLOCK_MUTEX #endif /** timestamp in seconds of the earliest possible moment a flow * will time out in this row. Set by the flow manager. Cleared * to 0 by workers, either when new flows are added or when a * flow state changes. The flow manager sets this to INT_MAX for * empty buckets. */ SC_ATOMIC_DECLARE(int32_t, next_ts); } __attribute__((aligned(CLS))) FlowBucket; #ifdef FBLOCK_SPIN #define FBLOCK_INIT(fb) SCSpinInit(&(fb)->s, 0) #define FBLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->s) #define FBLOCK_LOCK(fb) SCSpinLock(&(fb)->s) #define FBLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->s) #define FBLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->s) #elif defined FBLOCK_MUTEX #define FBLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL) #define FBLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m) #define FBLOCK_LOCK(fb) SCMutexLock(&(fb)->m) #define FBLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->m) #define FBLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m) #else #error Enable FBLOCK_SPIN or FBLOCK_MUTEX #endif /* prototypes */ Flow *FlowGetFlowFromHash(ThreadVars *tv, DecodeThreadVars *dtv, const Packet *, Flow **); void FlowDisableTcpReuseHandling(void); #endif /* __FLOW_HASH_H__ */ suricata-3.2.1/src/detect-fileext.c0000644000000000000000000001723513051004444014063 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon * */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm-bm.h" #include "util-print.h" #include "util-memcmp.h" #include "app-layer.h" #include "stream-tcp.h" #include "detect-fileext.h" static int DetectFileextMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, File *, Signature *, SigMatch *); static int DetectFileextSetup (DetectEngineCtx *, Signature *, char *); static void DetectFileextRegisterTests(void); static void DetectFileextFree(void *); /** * \brief Registration function for keyword: fileext */ void DetectFileextRegister(void) { sigmatch_table[DETECT_FILEEXT].name = "fileext"; sigmatch_table[DETECT_FILEEXT].desc = "match on the extension of a file name"; sigmatch_table[DETECT_FILEEXT].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#fileext"; sigmatch_table[DETECT_FILEEXT].FileMatch = DetectFileextMatch; sigmatch_table[DETECT_FILEEXT].Setup = DetectFileextSetup; sigmatch_table[DETECT_FILEEXT].Free = DetectFileextFree; sigmatch_table[DETECT_FILEEXT].RegisterTests = DetectFileextRegisterTests; SCLogDebug("registering fileext rule option"); return; } /** * \brief match the specified file extension * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFileextData * * \retval 0 no match * \retval 1 match */ static int DetectFileextMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; DetectFileextData *fileext = (DetectFileextData *)m->ctx; if (file->name == NULL) SCReturnInt(0); if (file->txid < det_ctx->tx_id) SCReturnInt(0); if (file->txid > det_ctx->tx_id) SCReturnInt(0); if (file->name_len <= fileext->len) SCReturnInt(0); int offset = file->name_len - fileext->len; /* fileext->ext is already in lowercase, as SCMemcmpLowercase requires */ if (file->name[offset - 1] == '.' && SCMemcmpLowercase(fileext->ext, file->name + offset, fileext->len) == 0) { if (!(fileext->flags & DETECT_CONTENT_NEGATED)) { ret = 1; SCLogDebug("File ext found"); } } if (ret == 0 && (fileext->flags & DETECT_CONTENT_NEGATED)) { SCLogDebug("negated match"); ret = 1; } SCReturnInt(ret); } /** * \brief This function is used to parse fileet * * \param str Pointer to the fileext value string * * \retval pointer to DetectFileextData on success * \retval NULL on failure */ static DetectFileextData *DetectFileextParse (char *str) { DetectFileextData *fileext = NULL; /* We have a correct filename option */ fileext = SCMalloc(sizeof(DetectFileextData)); if (unlikely(fileext == NULL)) goto error; memset(fileext, 0x00, sizeof(DetectFileextData)); if (DetectContentDataParse("fileext", str, &fileext->ext, &fileext->len, &fileext->flags) == -1) { goto error; } uint16_t u; for (u = 0; u < fileext->len; u++) fileext->ext[u] = tolower(fileext->ext[u]); SCLogDebug("flags %02X", fileext->flags); if (fileext->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("negated fileext"); } #ifdef DEBUG if (SCLogDebugEnabled()) { char *ext = SCMalloc(fileext->len + 1); if (ext != NULL) { memcpy(ext, fileext->ext, fileext->len); ext[fileext->len] = '\0'; SCLogDebug("will look for fileext %s", ext); } } #endif return fileext; error: if (fileext != NULL) DetectFileextFree(fileext); return NULL; } /** * \brief this function is used to add the parsed "id" option * into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFileextSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectFileextData *fileext= NULL; SigMatch *sm = NULL; fileext = DetectFileextParse(str); if (fileext == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FILEEXT; sm->ctx = (void *)fileext; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_FILENAME); return 0; error: if (fileext != NULL) DetectFileextFree(fileext); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFileextData * * \param fileext pointer to DetectFileextData */ static void DetectFileextFree(void *ptr) { if (ptr != NULL) { DetectFileextData *fileext = (DetectFileextData *)ptr; if (fileext->ext != NULL) SCFree(fileext->ext); SCFree(fileext); } } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectFileextTestParse01 */ int DetectFileextTestParse01 (void) { DetectFileextData *dfd = DetectFileextParse("\"doc\""); if (dfd != NULL) { DetectFileextFree(dfd); return 1; } return 0; } /** * \test DetectFileextTestParse02 */ int DetectFileextTestParse02 (void) { int result = 0; DetectFileextData *dfd = DetectFileextParse("\"tar.gz\""); if (dfd != NULL) { if (dfd->len == 6 && memcmp(dfd->ext, "tar.gz", 6) == 0) { result = 1; } DetectFileextFree(dfd); return result; } return 0; } /** * \test DetectFileextTestParse03 */ int DetectFileextTestParse03 (void) { int result = 0; DetectFileextData *dfd = DetectFileextParse("\"pdf\""); if (dfd != NULL) { if (dfd->len == 3 && memcmp(dfd->ext, "pdf", 3) == 0) { result = 1; } DetectFileextFree(dfd); return result; } return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFileext */ void DetectFileextRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectFileextTestParse01", DetectFileextTestParse01); UtRegisterTest("DetectFileextTestParse02", DetectFileextTestParse02); UtRegisterTest("DetectFileextTestParse03", DetectFileextTestParse03); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-http-server-body.c0000644000000000000000000036022413051004444015640 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * \author Victor Julien * * Implements support for the http_server_body keyword */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-server-body.h" #include "stream-tcp.h" int DetectHttpServerBodySetup(DetectEngineCtx *, Signature *, char *); void DetectHttpServerBodyRegisterTests(void); void DetectHttpServerBodyFree(void *); /** * \brief Registers the keyword handlers for the "http_server_body" keyword. */ void DetectHttpServerBodyRegister(void) { sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].name = "http_server_body"; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].desc = "content modifier to match only on the HTTP response-body"; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_server-body"; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Match = NULL; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Setup = DetectHttpServerBodySetup; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].Free = DetectHttpServerBodyFree; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].RegisterTests = DetectHttpServerBodyRegisterTests; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_SERVER_BODY].flags |= SIGMATCH_PAYLOAD ; } static void DetectHttpServerBodySetupCallback(Signature *s) { s->flags |= SIG_FLAG_APPLAYER; AppLayerHtpEnableResponseBodyCallback(); return; } /** * \brief The setup function for the http_server_body keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param m Pointer to the head of the SigMatchs for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpServerBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_SERVER_BODY, DETECT_SM_LIST_FILEDATA, ALPROTO_HTTP, DetectHttpServerBodySetupCallback); } /** * \brief The function to free the http_server_body data. * * \param ptr Pointer to the http_server_body. */ void DetectHttpServerBodyFree(void *ptr) { SCEnter(); DetectContentData *hsbd = (DetectContentData *)ptr; if (hsbd == NULL) SCReturn; if (hsbd->content != NULL) SCFree(hsbd->content); SpmDestroyCtx(hsbd->spm_ctx); SCFree(hsbd); SCReturn; } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_server_body is correctly parsed * and the keyword is registered. */ static int DetectHttpServerBodyTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_server_body\"; " "content:\"one\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } /* sm should not be in the MATCH list */ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]; if (sm != NULL) { goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { goto end; } if (sm->type != DETECT_CONTENT) { printf("sm type not DETECT_AL_HTTP_SERVER_BODY: "); goto end; } if (sm->next != NULL) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_server_body entry is * parsed. */ static int DetectHttpServerBodyTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_server_body\"; " "content:\"one\"; http_server_body:; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a http_server_body * is invalidated. */ static int DetectHttpServerBodyTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_server_body\"; " "http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_server_body is invalidated. */ static int DetectHttpServerBodyTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_server_body\"; " "content:\"one\"; rawbytes; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_server_body is invalidated. */ static int DetectHttpServerBodyTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_server_body\"; " "content:\"one\"; http_server_body; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"message\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START | STREAM_EOF, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "message"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"message\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched on chunk2 but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 (chunk3) but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"message\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sag"; uint32_t http_len3 = sizeof(http_buf3) - 1; uint8_t http_buf4[] = "e4u!!"; uint32_t http_len4 = sizeof(http_buf4) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"message\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf4, http_len4); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Case insensitve. */ static int DetectHttpServerBodyTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sag"; uint32_t http_len3 = sizeof(http_buf3) - 1; uint8_t http_buf4[] = "e4u!!"; uint32_t http_len4 = sizeof(http_buf4) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"MeSSaGE\"; http_server_body; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf4, http_len4); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Negated match. */ static int DetectHttpServerBodyTest11(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "bigmessage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:!\"MaSSaGE\"; http_server_body; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have (p1): "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have (p2): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Negated match. */ static int DetectHttpServerBodyTest12(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "bigmessage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:!\"MeSSaGE\"; http_server_body; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have (p1): "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have (p2): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectHttpServerBodyTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 55\r\n" "\r\n" "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START | STREAM_EOF, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test multiple http transactions and body chunks of request handling */ static int DetectHttpServerBodyTest14(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "GET /index1.html HTTP/1.1\r\n" "User-Agent: Mozilla/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy1\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "one"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "GET /index2.html HTTP/1.1\r\n" "User-Agent: Firefox/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy2\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "two"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"one\"; http_server_body; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"two\"; http_server_body; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SCLogDebug("add chunk 1"); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } SCLogDebug("add chunk 2"); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SCLogDebug("inspect chunk 1"); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert (tx 1): "); goto end; } p->alerts.cnt = 0; SCLogDebug("add chunk 3"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } SCLogDebug("add chunk 4"); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SCLogDebug("inspect chunk 4"); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted (tx 2): "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sig 2 didn't alert (tx 2): "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int DetectHttpServerBodyTest15(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "GET /index1.html HTTP/1.1\r\n" "User-Agent: Mozilla/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy1\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "one"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "GET /index2.html HTTP/1.1\r\n" "User-Agent: Firefox/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy2\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "two"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"one\"; http_server_body; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"two\"; http_server_body; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert (tx 1): "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 2 alerted (tx 1): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted (tx 2): "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sig 2 didn't alert (tx 2): "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } int DetectHttpServerBodyTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; http_server_body; " "content:\"three\"; distance:10; http_server_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "two", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd1) || !DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; pcre:/two/; " "content:\"three\"; distance:10; http_server_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; pcre:/two/; " "content:\"three\"; distance:10; within:15; http_server_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; pcre:/two/; " "content:\"three\"; distance:10; http_server_body; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; offset:10; http_server_body; pcre:/two/; " "content:\"three\"; distance:10; http_server_body; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test invalid combination for content: distance, depth, http_server_body */ int DetectHttpServerBodyTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; offset:10; http_server_body; pcre:/two/; distance:10; " "content:\"three\"; distance:10; http_server_body; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) { printf("de_ctx->sig_list != NULL: "); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; pcre:/two/; " "content:\"three\"; http_server_body; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hsbd1->flags != 0 || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_DEPTH || memcmp(hsbd2->content, "three", hsbd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || !DETECT_CONTENT_IS_SINGLE(hsbd1) || DETECT_CONTENT_IS_SINGLE(hsbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; distance:0; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hsbd2->content, "two", hsbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; within:5; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "one", hsbd1->content_len) != 0 || hsbd2->flags != DETECT_CONTENT_WITHIN || memcmp(hsbd2->content, "two", hsbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/Q; " "content:\"two\"; within:5; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hsbd2->flags != DETECT_CONTENT_WITHIN || memcmp(hsbd2->content, "two", hsbd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_server_body; " "pcre:/one/QR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hsbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || hsbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hsbd1->content, "two", hsbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpServerBodyTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/Q; " "content:\"two\"; distance:5; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; DetectContentData *hsbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hsbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hsbd2->content, "two", hsbd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyFileDataTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "file_data; content:\"message\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START | STREAM_EOF, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyFileDataTest02(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "message"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "file_data; content:\"message\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyFileDataTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "file_data; content:\"message\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. */ static int DetectHttpServerBodyFileDataTest04(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sag"; uint32_t http_len3 = sizeof(http_buf3) - 1; uint8_t http_buf4[] = "e4u!!"; uint32_t http_len4 = sizeof(http_buf4) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "file_data; content:\"message\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf4, http_len4); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Case insensitve. */ static int DetectHttpServerBodyFileDataTest05(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "bigmes"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "sag"; uint32_t http_len3 = sizeof(http_buf3) - 1; uint8_t http_buf4[] = "e4u!!"; uint32_t http_len4 = sizeof(http_buf4) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "file_data; content:\"MeSSaGE\"; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf4, http_len4); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Negated match. */ static int DetectHttpServerBodyFileDataTest06(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "bigmessage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http file_data test\"; " "file_data; content:!\"MaSSaGE\"; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have (p1): "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have (p2): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_server_body content matches against a http request * which holds the content. Negated match. */ static int DetectHttpServerBodyFileDataTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "bigmessage4u!!"; uint32_t http_len3 = sizeof(http_buf3) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http file_data test\"; " "file_data; content:!\"MeSSaGE\"; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have (p1): "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have (p2): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectHttpServerBodyFileDataTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 55\r\n" "\r\n" "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "file_data; content:\"longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START | STREAM_EOF, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test multiple http transactions and body chunks of request handling */ static int DetectHttpServerBodyFileDataTest09(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "GET /index1.html HTTP/1.1\r\n" "User-Agent: Mozilla/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy1\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "one"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "GET /index2.html HTTP/1.1\r\n" "User-Agent: Firefox/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy2\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "two"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"one\"; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"two\"; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert (tx 1): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted (tx 2): "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sig 2 didn't alert (tx 2): "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int DetectHttpServerBodyFileDataTest10(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "GET /index1.html HTTP/1.1\r\n" "User-Agent: Mozilla/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy1\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "one"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "GET /index2.html HTTP/1.1\r\n" "User-Agent: Firefox/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Connection: keep-alive\r\n" "Cookie: dummy2\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.1 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 3\r\n" "\r\n" "two"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"one\"; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"two\"; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert (tx 1): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted (tx 2): "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sig 2 didn't alert (tx 2): "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } #endif /* UNITTESTS */ void DetectHttpServerBodyRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpServerBodyTest01", DetectHttpServerBodyTest01); UtRegisterTest("DetectHttpServerBodyTest02", DetectHttpServerBodyTest02); UtRegisterTest("DetectHttpServerBodyTest03", DetectHttpServerBodyTest03); UtRegisterTest("DetectHttpServerBodyTest04", DetectHttpServerBodyTest04); UtRegisterTest("DetectHttpServerBodyTest05", DetectHttpServerBodyTest05); UtRegisterTest("DetectHttpServerBodyTest06", DetectHttpServerBodyTest06); UtRegisterTest("DetectHttpServerBodyTest07", DetectHttpServerBodyTest07); UtRegisterTest("DetectHttpServerBodyTest08", DetectHttpServerBodyTest08); UtRegisterTest("DetectHttpServerBodyTest09", DetectHttpServerBodyTest09); UtRegisterTest("DetectHttpServerBodyTest10", DetectHttpServerBodyTest10); UtRegisterTest("DetectHttpServerBodyTest11", DetectHttpServerBodyTest11); UtRegisterTest("DetectHttpServerBodyTest12", DetectHttpServerBodyTest12); UtRegisterTest("DetectHttpServerBodyTest13", DetectHttpServerBodyTest13); UtRegisterTest("DetectHttpServerBodyTest14", DetectHttpServerBodyTest14); UtRegisterTest("DetectHttpServerBodyTest15", DetectHttpServerBodyTest15); UtRegisterTest("DetectHttpServerBodyTest22", DetectHttpServerBodyTest22); UtRegisterTest("DetectHttpServerBodyTest23", DetectHttpServerBodyTest23); UtRegisterTest("DetectHttpServerBodyTest24", DetectHttpServerBodyTest24); UtRegisterTest("DetectHttpServerBodyTest25", DetectHttpServerBodyTest25); UtRegisterTest("DetectHttpServerBodyTest26", DetectHttpServerBodyTest26); UtRegisterTest("DetectHttpServerBodyTest27", DetectHttpServerBodyTest27); UtRegisterTest("DetectHttpServerBodyTest28", DetectHttpServerBodyTest28); UtRegisterTest("DetectHttpServerBodyTest29", DetectHttpServerBodyTest29); UtRegisterTest("DetectHttpServerBodyTest30", DetectHttpServerBodyTest30); UtRegisterTest("DetectHttpServerBodyTest31", DetectHttpServerBodyTest31); UtRegisterTest("DetectHttpServerBodyTest32", DetectHttpServerBodyTest32); UtRegisterTest("DetectHttpServerBodyTest33", DetectHttpServerBodyTest33); UtRegisterTest("DetectHttpServerBodyTest34", DetectHttpServerBodyTest34); UtRegisterTest("DetectHttpServerBodyTest35", DetectHttpServerBodyTest35); UtRegisterTest("DetectHttpServerBodyTest36", DetectHttpServerBodyTest36); UtRegisterTest("DetectHttpServerBodyFileDataTest01", DetectHttpServerBodyFileDataTest01); UtRegisterTest("DetectHttpServerBodyFileDataTest02", DetectHttpServerBodyFileDataTest02); UtRegisterTest("DetectHttpServerBodyFileDataTest03", DetectHttpServerBodyFileDataTest03); UtRegisterTest("DetectHttpServerBodyFileDataTest04", DetectHttpServerBodyFileDataTest04); UtRegisterTest("DetectHttpServerBodyFileDataTest05", DetectHttpServerBodyFileDataTest05); UtRegisterTest("DetectHttpServerBodyFileDataTest06", DetectHttpServerBodyFileDataTest06); UtRegisterTest("DetectHttpServerBodyFileDataTest07", DetectHttpServerBodyFileDataTest07); UtRegisterTest("DetectHttpServerBodyFileDataTest08", DetectHttpServerBodyFileDataTest08); UtRegisterTest("DetectHttpServerBodyFileDataTest09", DetectHttpServerBodyFileDataTest09); UtRegisterTest("DetectHttpServerBodyFileDataTest10", DetectHttpServerBodyFileDataTest10); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/decode-tcp.h0000644000000000000000000002470113051004444013165 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \todo RAW* macro's should be returning the raw value, not the host order */ #ifndef __DECODE_TCP_H__ #define __DECODE_TCP_H__ #define TCP_HEADER_LEN 20 #define TCP_OPTLENMAX 40 #define TCP_OPTMAX 20 /* every opt is at least 2 bytes * (type + len), except EOL and NOP */ /* TCP flags */ #define TH_FIN 0x01 #define TH_SYN 0x02 #define TH_RST 0x04 #define TH_PUSH 0x08 #define TH_ACK 0x10 #define TH_URG 0x20 /** Establish a new connection reducing window */ #define TH_ECN 0x40 /** Echo Congestion flag */ #define TH_CWR 0x80 /* tcp option codes */ #define TCP_OPT_EOL 0x00 #define TCP_OPT_NOP 0x01 #define TCP_OPT_MSS 0x02 #define TCP_OPT_WS 0x03 #define TCP_OPT_SACKOK 0x04 #define TCP_OPT_SACK 0x05 #define TCP_OPT_TS 0x08 #define TCP_OPT_SACKOK_LEN 2 #define TCP_OPT_WS_LEN 3 #define TCP_OPT_TS_LEN 10 #define TCP_OPT_MSS_LEN 4 #define TCP_OPT_SACK_MIN_LEN 10 /* hdr 2, 1 pair 8 = 10 */ #define TCP_OPT_SACK_MAX_LEN 34 /* hdr 2, 4 pair 32= 34 */ /** Max valid wscale value. */ #define TCP_WSCALE_MAX 14 #define TCP_GET_RAW_OFFSET(tcph) (((tcph)->th_offx2 & 0xf0) >> 4) #define TCP_GET_RAW_X2(tcph) (unsigned char)((tcph)->th_offx2 & 0x0f) #define TCP_GET_RAW_SRC_PORT(tcph) ntohs((tcph)->th_sport) #define TCP_GET_RAW_DST_PORT(tcph) ntohs((tcph)->th_dport) #define TCP_SET_RAW_TCP_OFFSET(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0x0f) | (value << 4))) #define TCP_SET_RAW_TCP_X2(tcph, value) ((tcph)->th_offx2 = (unsigned char)(((tcph)->th_offx2 & 0xf0) | (value & 0x0f))) #define TCP_GET_RAW_SEQ(tcph) ntohl((tcph)->th_seq) #define TCP_GET_RAW_ACK(tcph) ntohl((tcph)->th_ack) #define TCP_GET_RAW_WINDOW(tcph) ntohs((tcph)->th_win) #define TCP_GET_RAW_URG_POINTER(tcph) ntohs((tcph)->th_urp) #define TCP_GET_RAW_SUM(tcph) ntohs((tcph)->th_sum) /** macro for getting the first timestamp from the packet in host order */ #define TCP_GET_TSVAL(p) ((p)->tcpvars.ts_val) /** macro for getting the second timestamp from the packet in host order. */ #define TCP_GET_TSECR(p) ((p)->tcpvars.ts_ecr) #define TCP_HAS_WSCALE(p) ((p)->tcpvars.ws.type == TCP_OPT_WS) #define TCP_HAS_SACK(p) ((p)->tcpvars.sack.type == TCP_OPT_SACK) #define TCP_HAS_SACKOK(p) ((p)->tcpvars.sackok.type == TCP_OPT_SACKOK) #define TCP_HAS_TS(p) ((p)->tcpvars.ts_set == TRUE) #define TCP_HAS_MSS(p) ((p)->tcpvars.mss.type == TCP_OPT_MSS) /** macro for getting the wscale from the packet. */ #define TCP_GET_WSCALE(p) (TCP_HAS_WSCALE((p)) ? \ (((*(uint8_t *)(p)->tcpvars.ws.data) <= TCP_WSCALE_MAX) ? \ (*(uint8_t *)((p)->tcpvars.ws.data)) : 0) : 0) #define TCP_GET_SACKOK(p) (TCP_HAS_SACKOK((p)) ? 1 : 0) #define TCP_GET_SACK_PTR(p) TCP_HAS_SACK((p)) ? (p)->tcpvars.sack.data : NULL #define TCP_GET_SACK_CNT(p) (TCP_HAS_SACK((p)) ? (((p)->tcpvars.sack.len - 2) / 8) : 0) #define TCP_GET_OFFSET(p) TCP_GET_RAW_OFFSET((p)->tcph) #define TCP_GET_X2(p) TCP_GET_RAW_X2((p)->tcph) #define TCP_GET_HLEN(p) (TCP_GET_OFFSET((p)) << 2) #define TCP_GET_SRC_PORT(p) TCP_GET_RAW_SRC_PORT((p)->tcph) #define TCP_GET_DST_PORT(p) TCP_GET_RAW_DST_PORT((p)->tcph) #define TCP_GET_SEQ(p) TCP_GET_RAW_SEQ((p)->tcph) #define TCP_GET_ACK(p) TCP_GET_RAW_ACK((p)->tcph) #define TCP_GET_WINDOW(p) TCP_GET_RAW_WINDOW((p)->tcph) #define TCP_GET_URG_POINTER(p) TCP_GET_RAW_URG_POINTER((p)->tcph) #define TCP_GET_SUM(p) TCP_GET_RAW_SUM((p)->tcph) #define TCP_GET_FLAGS(p) (p)->tcph->th_flags #define TCP_ISSET_FLAG_FIN(p) ((p)->tcph->th_flags & TH_FIN) #define TCP_ISSET_FLAG_SYN(p) ((p)->tcph->th_flags & TH_SYN) #define TCP_ISSET_FLAG_RST(p) ((p)->tcph->th_flags & TH_RST) #define TCP_ISSET_FLAG_PUSH(p) ((p)->tcph->th_flags & TH_PUSH) #define TCP_ISSET_FLAG_ACK(p) ((p)->tcph->th_flags & TH_ACK) #define TCP_ISSET_FLAG_URG(p) ((p)->tcph->th_flags & TH_URG) #define TCP_ISSET_FLAG_RES2(p) ((p)->tcph->th_flags & TH_RES2) #define TCP_ISSET_FLAG_RES1(p) ((p)->tcph->th_flags & TH_RES1) typedef struct TCPOpt_ { uint8_t type; uint8_t len; uint8_t *data; } TCPOpt; typedef struct TCPOptSackRecord_ { uint32_t le; /**< left edge, network order */ uint32_t re; /**< right edge, network order */ } TCPOptSackRecord; typedef struct TCPHdr_ { uint16_t th_sport; /**< source port */ uint16_t th_dport; /**< destination port */ uint32_t th_seq; /**< sequence number */ uint32_t th_ack; /**< acknowledgement number */ uint8_t th_offx2; /**< offset and reserved */ uint8_t th_flags; /**< pkt flags */ uint16_t th_win; /**< pkt window */ uint16_t th_sum; /**< checksum */ uint16_t th_urp; /**< urgent pointer */ } __attribute__((__packed__)) TCPHdr; typedef struct TCPVars_ { /* commonly used and needed opts */ _Bool ts_set; uint32_t ts_val; /* host-order */ uint32_t ts_ecr; /* host-order */ TCPOpt sack; TCPOpt sackok; TCPOpt ws; TCPOpt mss; } TCPVars; #define CLEAR_TCP_PACKET(p) { \ (p)->level4_comp_csum = -1; \ PACKET_CLEAR_L4VARS((p)); \ (p)->tcph = NULL; \ } void DecodeTCPRegisterTests(void); /** -------- Inline functions ------- */ static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t); static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); /** * \brief Calculates the checksum for the TCP packet * * \param shdr Pointer to source address field from the IP packet. Used as a * part of the pseudoheader for computing the checksum * \param pkt Pointer to the start of the TCP packet * \param tlen Total length of the TCP packet(header + payload) * * \retval csum Checksum for the TCP packet */ static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = shdr[0]; csum += shdr[1] + shdr[2] + shdr[3] + htons(6) + htons(tlen); csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[9]; tlen -= 20; pkt += 10; while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; pkt += 1; tlen -= 2; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); return (uint16_t)~csum; } /** * \brief Calculates the checksum for the TCP packet * * \param shdr Pointer to source address field from the IPV6 packet. Used as a * part of the psuedoheader for computing the checksum * \param pkt Pointer to the start of the TCP packet * \param tlen Total length of the TCP packet(header + payload) * * \retval csum Checksum for the TCP packet */ static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = shdr[0]; csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + shdr[13] + shdr[14] + shdr[15] + htons(6) + htons(tlen); csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[9]; tlen -= 20; pkt += 10; while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; pkt += 1; tlen -= 2; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); return (uint16_t)~csum; } #endif /* __DECODE_TCP_H__ */ suricata-3.2.1/src/decode-erspan.h0000644000000000000000000000205013051004444013660 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #ifndef __DECODE_ERSPAN_H__ #define __DECODE_ERSPAN_H__ #include "decode.h" #include "threadvars.h" typedef struct ErspanHdr_ { uint16_t ver_vlan; uint16_t flags_spanid; uint32_t padding; } __attribute__((__packed__)) ErspanHdr; #endif /* __DECODE_ERSPAN_H__ */ suricata-3.2.1/src/source-netmap.h0000644000000000000000000000400413051004444013732 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Aleksey Katargin */ #ifndef __SOURCE_NETMAP_H__ #define __SOURCE_NETMAP_H__ #include "queue.h" /* copy modes */ enum { NETMAP_COPY_MODE_NONE, NETMAP_COPY_MODE_TAP, NETMAP_COPY_MODE_IPS, }; #define NETMAP_IFACE_NAME_LENGTH 48 typedef struct NetmapIfaceSettings_ { /* real inner interface name */ char iface[NETMAP_IFACE_NAME_LENGTH]; int threads; /* sw ring flag for out_iface */ int sw_ring; int promisc; int copy_mode; ChecksumValidationMode checksum_mode; char *bpf_filter; } NetmapIfaceSettings; typedef struct NetmapIfaceConfig_ { /* semantic interface name */ char iface_name[NETMAP_IFACE_NAME_LENGTH]; /* settings for out capture device*/ NetmapIfaceSettings in; /* semantic interface name */ char *out_iface_name; /* settings for outgoing iface for IPS/TAP */ NetmapIfaceSettings out; SC_ATOMIC_DECLARE(unsigned int, ref); void (*DerefFunc)(void *); } NetmapIfaceConfig; typedef struct NetmapPacketVars_ { int ring_id; int slot_id; int dst_ring_id; /* NetmapThreadVars */ void *ntv; } NetmapPacketVars; int NetmapGetRSSCount(const char *ifname); void TmModuleReceiveNetmapRegister (void); void TmModuleDecodeNetmapRegister (void); #endif /* __SOURCE_NETMAP_H__ */ suricata-3.2.1/src/detect-csum.h0000644000000000000000000000220613051004444013367 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_CSUM_H__ #define __DETECT_CSUM_H__ #define DETECT_CSUM_VALID "valid" #define DETECT_CSUM_INVALID "invalid" typedef struct DetectCsumData_ { /* Indicates if the csum- keyword in a rule holds the keyvalue "valid" or "invalid" */ int16_t valid; } DetectCsumData; void DetectCsumRegister(void); #endif /* __DETECT_CSUM_H__ */ suricata-3.2.1/src/detect-engine-content-inspection.c0000644000000000000000000005403413051004444017507 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Performs content inspection on any buffer supplied. */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-isdataat.h" #include "detect-bytetest.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" #include "detect-replace.h" #include "detect-engine-content-inspection.h" #include "detect-uricontent.h" #include "detect-urilen.h" #include "detect-lua.h" #include "detect-base64-decode.h" #include "detect-base64-data.h" #include "app-layer-dcerpc.h" #include "util-spm.h" #include "util-debug.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-profiling.h" #ifdef HAVE_LUA #include "util-lua.h" #endif /** * \brief Run the actual payload match functions * * The following keywords are inspected: * - content, including all the http and dce modified contents * - isdaatat * - pcre * - bytejump * - bytetest * - byte_extract * - urilen * - * * All keywords are evaluated against the buffer with buffer_len. * * For accounting the last match in relative matching the * det_ctx->buffer_offset int is used. * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow (for pcre flowvar storage) * \param buffer Ptr to the buffer to inspect * \param buffer_len Length of the payload * \param stream_start_offset Indicates the start of the current buffer in * the whole buffer stream inspected. This * applies if the current buffer is inspected * in chunks. * \param inspection_mode Refers to the engine inspection mode we are currently * inspecting. Can be payload, stream, one of the http * buffer inspection modes or dce inspection mode. * \param data Used to send some custom data. For example in * payload inspection mode, data contains packet ptr, * and under dce inspection mode, contains dce state. * * \retval 0 no match * \retval 1 match */ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, Flow *f, uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t inspection_mode, void *data) { SCEnter(); KEYWORD_PROFILING_START; det_ctx->inspection_recursion_counter++; if (det_ctx->inspection_recursion_counter == de_ctx->inspection_recursion_limit) { det_ctx->discontinue_matching = 1; KEYWORD_PROFILING_END(det_ctx, sm->type, 0); SCReturnInt(0); } if (sm == NULL || buffer_len == 0) { KEYWORD_PROFILING_END(det_ctx, sm->type, 0); SCReturnInt(0); } /* \todo unify this which is phase 2 of payload inspection unification */ if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; SCLogDebug("inspecting content %"PRIu32" buffer_len %"PRIu32, cd->id, buffer_len); /* we might have already have this content matched by the mpm. * (if there is any other reason why we'd want to avoid checking * it here, please fill it in) */ //if (cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED) { // goto match; //} /* rule parsers should take care of this */ #ifdef DEBUG BUG_ON(cd->depth != 0 && cd->depth <= cd->offset); #endif /* search for our pattern, checking the matches recursively. * if we match we look for the next SigMatch as well */ uint8_t *found = NULL; uint32_t offset = 0; uint32_t depth = buffer_len; uint32_t prev_offset = 0; /**< used in recursive searching */ uint32_t prev_buffer_offset = det_ctx->buffer_offset; do { if ((cd->flags & DETECT_CONTENT_DISTANCE) || (cd->flags & DETECT_CONTENT_WITHIN)) { SCLogDebug("det_ctx->buffer_offset %"PRIu32, det_ctx->buffer_offset); offset = prev_buffer_offset; depth = buffer_len; int distance = cd->distance; if (cd->flags & DETECT_CONTENT_DISTANCE) { if (cd->flags & DETECT_CONTENT_DISTANCE_BE) { distance = det_ctx->bj_values[cd->distance]; } if (distance < 0 && (uint32_t)(abs(distance)) > offset) offset = 0; else offset += distance; SCLogDebug("cd->distance %"PRIi32", offset %"PRIu32", depth %"PRIu32, distance, offset, depth); } if (cd->flags & DETECT_CONTENT_WITHIN) { if (cd->flags & DETECT_CONTENT_WITHIN_BE) { if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->bj_values[cd->within] + distance)) { depth = prev_buffer_offset + det_ctx->bj_values[cd->within] + distance; } } else { if ((int32_t)depth > (int32_t)(prev_buffer_offset + cd->within + distance)) { depth = prev_buffer_offset + cd->within + distance; } SCLogDebug("cd->within %"PRIi32", det_ctx->buffer_offset %"PRIu32", depth %"PRIu32, cd->within, prev_buffer_offset, depth); } if (stream_start_offset != 0 && prev_buffer_offset == 0) { if (depth <= stream_start_offset) { goto no_match; } else if (depth >= (stream_start_offset + buffer_len)) { ; } else { depth = depth - stream_start_offset; } } } if (cd->flags & DETECT_CONTENT_DEPTH_BE) { if ((det_ctx->bj_values[cd->depth] + prev_buffer_offset) < depth) { depth = prev_buffer_offset + det_ctx->bj_values[cd->depth]; } } else { if (cd->depth != 0) { if ((cd->depth + prev_buffer_offset) < depth) { depth = prev_buffer_offset + cd->depth; } SCLogDebug("cd->depth %"PRIu32", depth %"PRIu32, cd->depth, depth); } } if (cd->flags & DETECT_CONTENT_OFFSET_BE) { if (det_ctx->bj_values[cd->offset] > offset) offset = det_ctx->bj_values[cd->offset]; } else { if (cd->offset > offset) { offset = cd->offset; SCLogDebug("setting offset %"PRIu32, offset); } } } else { /* implied no relative matches */ /* set depth */ if (cd->flags & DETECT_CONTENT_DEPTH_BE) { depth = det_ctx->bj_values[cd->depth]; } else { if (cd->depth != 0) { depth = cd->depth; } } if (stream_start_offset != 0 && cd->flags & DETECT_CONTENT_DEPTH) { if (depth <= stream_start_offset) { goto no_match; } else if (depth >= (stream_start_offset + buffer_len)) { ; } else { depth = depth - stream_start_offset; } } /* set offset */ if (cd->flags & DETECT_CONTENT_OFFSET_BE) offset = det_ctx->bj_values[cd->offset]; else offset = cd->offset; prev_buffer_offset = 0; } /* update offset with prev_offset if we're searching for * matches after the first occurence. */ SCLogDebug("offset %"PRIu32", prev_offset %"PRIu32, offset, prev_offset); if (prev_offset != 0) offset = prev_offset; SCLogDebug("offset %"PRIu32", depth %"PRIu32, offset, depth); if (depth > buffer_len) depth = buffer_len; /* if offset is bigger than depth we can never match on a pattern. * We can however, "match" on a negated pattern. */ if (offset > depth || depth == 0) { if (cd->flags & DETECT_CONTENT_NEGATED) { goto match; } else { goto no_match; } } uint8_t *sbuffer = buffer + offset; uint32_t sbuffer_len = depth - offset; uint32_t match_offset = 0; SCLogDebug("sbuffer_len %"PRIu32, sbuffer_len); #ifdef DEBUG BUG_ON(sbuffer_len > buffer_len); #endif /* \todo Add another optimization here. If cd->content_len is * greater than sbuffer_len found is anyways NULL */ /* do the actual search */ found = SpmScan(cd->spm_ctx, det_ctx->spm_thread_ctx, sbuffer, sbuffer_len); /* next we evaluate the result in combination with the * negation flag. */ SCLogDebug("found %p cd negated %s", found, cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); if (found == NULL && !(cd->flags & DETECT_CONTENT_NEGATED)) { goto no_match; } else if (found == NULL && (cd->flags & DETECT_CONTENT_NEGATED)) { goto match; } else if (found != NULL && (cd->flags & DETECT_CONTENT_NEGATED)) { SCLogDebug("content %"PRIu32" matched at offset %"PRIu32", but negated so no match", cd->id, match_offset); /* don't bother carrying recursive matches now, for preceding * relative keywords */ if (DETECT_CONTENT_IS_SINGLE(cd)) det_ctx->discontinue_matching = 1; goto no_match; } else { match_offset = (uint32_t)((found - buffer) + cd->content_len); SCLogDebug("content %"PRIu32" matched at offset %"PRIu32"", cd->id, match_offset); det_ctx->buffer_offset = match_offset; /* Match branch, add replace to the list if needed */ if (cd->flags & DETECT_CONTENT_REPLACE) { if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD) { /* we will need to replace content if match is confirmed */ det_ctx->replist = DetectReplaceAddToList(det_ctx->replist, found, cd); } else { SCLogWarning(SC_ERR_INVALID_VALUE, "Can't modify payload without packet"); } } if (!(cd->flags & DETECT_CONTENT_RELATIVE_NEXT)) { SCLogDebug("no relative match coming up, so this is a match"); goto match; } /* bail out if we have no next match. Technically this is an * error, as the current cd has the DETECT_CONTENT_RELATIVE_NEXT * flag set. */ if (sm->next == NULL) { goto no_match; } SCLogDebug("content %"PRIu32, cd->id); KEYWORD_PROFILING_END(det_ctx, sm->type, 1); /* see if the next buffer keywords match. If not, we will * search for another occurence of this content and see * if the others match then until we run out of matches */ int r = DetectEngineContentInspection(de_ctx, det_ctx, s, sm->next, f, buffer, buffer_len, stream_start_offset, inspection_mode, data); if (r == 1) { SCReturnInt(1); } if (det_ctx->discontinue_matching) goto no_match; /* set the previous match offset to the start of this match + 1 */ prev_offset = (match_offset - (cd->content_len - 1)); SCLogDebug("trying to see if there is another match after prev_offset %"PRIu32, prev_offset); } } while(1); } else if (sm->type == DETECT_ISDATAAT) { SCLogDebug("inspecting isdataat"); DetectIsdataatData *id = (DetectIsdataatData *)sm->ctx; if (id->flags & ISDATAAT_RELATIVE) { if (det_ctx->buffer_offset + id->dataat > buffer_len) { SCLogDebug("det_ctx->buffer_offset + id->dataat %"PRIu32" > %"PRIu32, det_ctx->buffer_offset + id->dataat, buffer_len); if (id->flags & ISDATAAT_NEGATED) goto match; goto no_match; } else { SCLogDebug("relative isdataat match"); if (id->flags & ISDATAAT_NEGATED) goto no_match; goto match; } } else { if (id->dataat < buffer_len) { SCLogDebug("absolute isdataat match"); if (id->flags & ISDATAAT_NEGATED) goto no_match; goto match; } else { SCLogDebug("absolute isdataat mismatch, id->isdataat %"PRIu32", buffer_len %"PRIu32"", id->dataat, buffer_len); if (id->flags & ISDATAAT_NEGATED) goto match; goto no_match; } } } else if (sm->type == DETECT_PCRE) { SCLogDebug("inspecting pcre"); DetectPcreData *pe = (DetectPcreData *)sm->ctx; uint32_t prev_buffer_offset = det_ctx->buffer_offset; uint32_t prev_offset = 0; int r = 0; det_ctx->pcre_match_start_offset = 0; do { Packet *p = NULL; if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD) p = (Packet *)data; r = DetectPcrePayloadMatch(det_ctx, s, sm, p, f, buffer, buffer_len); if (r == 0) { goto no_match; } if (!(pe->flags & DETECT_PCRE_RELATIVE_NEXT)) { SCLogDebug("no relative match coming up, so this is a match"); goto match; } KEYWORD_PROFILING_END(det_ctx, sm->type, 1); /* save it, in case we need to do a pcre match once again */ prev_offset = det_ctx->pcre_match_start_offset; /* see if the next payload keywords match. If not, we will * search for another occurence of this pcre and see * if the others match, until we run out of matches */ r = DetectEngineContentInspection(de_ctx, det_ctx, s, sm->next, f, buffer, buffer_len, stream_start_offset, inspection_mode, data); if (r == 1) { SCReturnInt(1); } if (det_ctx->discontinue_matching) goto no_match; det_ctx->buffer_offset = prev_buffer_offset; det_ctx->pcre_match_start_offset = prev_offset; } while (1); } else if (sm->type == DETECT_BYTETEST) { DetectBytetestData *btd = (DetectBytetestData *)sm->ctx; uint8_t flags = btd->flags; int32_t offset = btd->offset; uint64_t value = btd->value; if (flags & DETECT_BYTETEST_OFFSET_BE) { offset = det_ctx->bj_values[offset]; } if (flags & DETECT_BYTETEST_VALUE_BE) { value = det_ctx->bj_values[value]; } /* if we have dce enabled we will have to use the endianness * specified by the dce header */ if (flags & DETECT_BYTETEST_DCE && data != NULL) { DCERPCState *dcerpc_state = (DCERPCState *)data; /* enable the endianness flag temporarily. once we are done * processing we reset the flags to the original value*/ flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ? DETECT_BYTETEST_LITTLE: 0); } if (DetectBytetestDoMatch(det_ctx, s, sm->ctx, buffer, buffer_len, flags, offset, value) != 1) { goto no_match; } goto match; } else if (sm->type == DETECT_BYTEJUMP) { DetectBytejumpData *bjd = (DetectBytejumpData *)sm->ctx; uint8_t flags = bjd->flags; int32_t offset = bjd->offset; if (flags & DETECT_BYTEJUMP_OFFSET_BE) { offset = det_ctx->bj_values[offset]; } /* if we have dce enabled we will have to use the endianness * specified by the dce header */ if (flags & DETECT_BYTEJUMP_DCE && data != NULL) { DCERPCState *dcerpc_state = (DCERPCState *)data; /* enable the endianness flag temporarily. once we are done * processing we reset the flags to the original value*/ flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ? DETECT_BYTEJUMP_LITTLE: 0); } if (DetectBytejumpDoMatch(det_ctx, s, sm->ctx, buffer, buffer_len, flags, offset) != 1) { goto no_match; } goto match; } else if (sm->type == DETECT_BYTE_EXTRACT) { DetectByteExtractData *bed = (DetectByteExtractData *)sm->ctx; uint8_t endian = bed->endian; /* if we have dce enabled we will have to use the endianness * specified by the dce header */ if ((bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) && endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE && data != NULL) { DCERPCState *dcerpc_state = (DCERPCState *)data; /* enable the endianness flag temporarily. once we are done * processing we reset the flags to the original value*/ endian |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] == 0x10) ? DETECT_BYTE_EXTRACT_ENDIAN_LITTLE : DETECT_BYTE_EXTRACT_ENDIAN_BIG); } if (DetectByteExtractDoMatch(det_ctx, sm, s, buffer, buffer_len, &det_ctx->bj_values[bed->local_id], endian) != 1) { goto no_match; } goto match; /* we should never get here, but bail out just in case */ } else if (sm->type == DETECT_AL_URILEN) { SCLogDebug("inspecting uri len"); int r = 0; DetectUrilenData *urilend = (DetectUrilenData *) sm->ctx; switch (urilend->mode) { case DETECT_URILEN_EQ: if (buffer_len == urilend->urilen1) r = 1; break; case DETECT_URILEN_LT: if (buffer_len < urilend->urilen1) r = 1; break; case DETECT_URILEN_GT: if (buffer_len > urilend->urilen1) r = 1; break; case DETECT_URILEN_RA: if (buffer_len > urilend->urilen1 && buffer_len < urilend->urilen2) { r = 1; } break; } if (r == 1) { goto match; } det_ctx->discontinue_matching = 0; goto no_match; #ifdef HAVE_LUA } else if (sm->type == DETECT_LUA) { SCLogDebug("lua starting"); if (DetectLuaMatchBuffer(det_ctx, s, sm, buffer, buffer_len, det_ctx->buffer_offset, f) != 1) { SCLogDebug("lua no_match"); goto no_match; } SCLogDebug("lua match"); goto match; #endif /* HAVE_LUA */ } else if (sm->type == DETECT_BASE64_DECODE) { if (DetectBase64DecodeDoMatch(det_ctx, s, sm, buffer, buffer_len)) { if (s->sm_arrays[DETECT_SM_LIST_BASE64_DATA] != NULL) { KEYWORD_PROFILING_END(det_ctx, sm->type, 1); if (DetectBase64DataDoMatch(de_ctx, det_ctx, s, f)) { /* Base64 is a terminal list. */ goto final_match; } } } } else { SCLogDebug("sm->type %u", sm->type); #ifdef DEBUG BUG_ON(1); #endif } no_match: KEYWORD_PROFILING_END(det_ctx, sm->type, 0); SCReturnInt(0); match: /* this sigmatch matched, inspect the next one. If it was the last, * the buffer portion of the signature matched. */ if (sm->next != NULL) { KEYWORD_PROFILING_END(det_ctx, sm->type, 1); int r = DetectEngineContentInspection(de_ctx, det_ctx, s, sm->next, f, buffer, buffer_len, stream_start_offset, inspection_mode, data); SCReturnInt(r); } final_match: KEYWORD_PROFILING_END(det_ctx, sm->type, 1); SCReturnInt(1); } suricata-3.2.1/src/detect-http-client-body.c0000644000000000000000000022513213051004444015606 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * * Implements support for the http_client_body keyword */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-client-body.h" #include "detect-engine-hcbd.h" #include "stream-tcp.h" int DetectHttpClientBodySetup(DetectEngineCtx *, Signature *, char *); void DetectHttpClientBodyRegisterTests(void); void DetectHttpClientBodyFree(void *); /** * \brief Registers the keyword handlers for the "http_client_body" keyword. */ void DetectHttpClientBodyRegister(void) { sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].name = "http_client_body"; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].desc = "content modifier to match only on HTTP request-body"; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_client-body"; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Match = NULL; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Setup = DetectHttpClientBodySetup; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].Free = DetectHttpClientBodyFree; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].RegisterTests = DetectHttpClientBodyRegisterTests; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_NOOPT ; sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_client_body", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCBDMATCH, 2, PrefilterTxHttpRequestBodyRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCBDMATCH, DetectEngineInspectHttpClientBody); } static void DetectHttpClientBodySetupCallback(Signature *s) { AppLayerHtpEnableRequestBodyCallback(); return; } /** * \brief The setup function for the http_client_body keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param m Pointer to the head of the SigMatchs for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_CLIENT_BODY, DETECT_SM_LIST_HCBDMATCH, ALPROTO_HTTP, DetectHttpClientBodySetupCallback); } /** * \brief The function to free the http_client_body data. * * \param ptr Pointer to the http_client_body. */ void DetectHttpClientBodyFree(void *ptr) { SCEnter(); DetectContentData *hcbd = (DetectContentData *)ptr; if (hcbd == NULL) SCReturn; if (hcbd->content != NULL) SCFree(hcbd->content); SpmDestroyCtx(hcbd->spm_ctx); SCFree(hcbd); SCReturn; } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_client_body is correctly parsed * and the keyword is registered. */ static int DetectHttpClientBodyTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_client_body\"; " "content:\"one\"; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]; if (sm != NULL) { result &= (sm->type == DETECT_CONTENT); result &= (sm->next == NULL); } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_client_body entry is * parsed. */ static int DetectHttpClientBodyTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_client_body\"; " "content:\"one\"; http_client_body:; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a http_client_body * is invalidated. */ static int DetectHttpClientBodyTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_client_body\"; " "http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_client_body is invalidated. */ static int DetectHttpClientBodyTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_client_body\"; " "content:\"one\"; rawbytes; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_client_body is invalidated. */ static int DetectHttpClientBodyTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_client_body\"; " "content:\"one\"; http_client_body; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_client_body content matches against a http request * which holds the content. */ static int DetectHttpClientBodyTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"message\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_client_body content matches against a http request * which holds the content. */ static int DetectHttpClientBodyTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 54\r\n" "\r\n" "This is dummy message body1"; uint8_t http2_buf[] = "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"message\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_client_body content matches against a http request * which holds the content. */ static int DetectHttpClientBodyTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1"; uint8_t http2_buf[] = "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"message\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_client_body content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpClientBodyTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1"; uint8_t http2_buf[] = "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"body1This\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_client_body content matches against a http request * against a case insensitive pattern. */ static int DetectHttpClientBodyTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy bodY1"; uint8_t http2_buf[] = "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"body1This\"; http_client_body; nocase;" "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_client_body content matches against a * http request which doesn't hold the content. */ static int DetectHttpClientBodyTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:!\"message1\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_client_body content matches against a * http request which holds hold the content. */ static int DetectHttpClientBodyTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:!\"message\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_client_body content matches against a http request * which holds the content. */ static int DetectHttpClientBodyTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 55\r\n" "\r\n" "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_client_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test multiple http transactions and body chunks of request handling */ static int DetectHttpClientBodyTest14(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Body one!!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nBody two!!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; content:\"one\"; http_client_body; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; content:\"two\"; http_client_body; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); FLOWLOCK_UNLOCK(&f); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("signature matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (5): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) { printf("sig 1 alerted (request 2, chunk 6): "); goto end; } p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); if (r != 0) { printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 2))) { printf("signature 2 didn't match, but should have: "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test multiple http transactions and body chunks of request handling */ static int DetectHttpClientBodyTest15(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Body one!!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nBody two!!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; content:\"one\"; http_client_body; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; content:\"two\"; http_client_body; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("signature matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (5): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) { printf("sig 1 alerted (request 2, chunk 6): "); goto end; } p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); if (r != 0) { printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 2))) { printf("signature 2 didn't match, but should have: "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } /* hardcoded check of the transactions and it's client body chunks */ if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } htp_tx_t *t1 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); htp_tx_t *t2 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 1); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(t1); HtpBodyChunk *cur = htud->request_body.first; if (htud->request_body.first == NULL) { SCLogDebug("No body data in t1 (it should be removed only when the tx is destroyed): "); goto end; } if (StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body one!!", 10) != 1) { SCLogDebug("Body data in t1 is not correctly set: "); goto end; } htud = (HtpTxUserData *) htp_tx_get_user_data(t2); cur = htud->request_body.first; if (htud->request_body.first == NULL) { SCLogDebug("No body data in t1 (it should be removed only when the tx is destroyed): "); goto end; } if (StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body two!!", 10) != 1) { SCLogDebug("Body data in t1 is not correctly set: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } int DetectHttpClientBodyTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; http_client_body; " "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "two", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd1) || !DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; pcre:/two/; " "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; pcre:/two/; " "content:\"three\"; distance:10; within:15; http_client_body; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; pcre:/two/; " "content:\"three\"; distance:10; http_client_body; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; offset:10; http_client_body; pcre:/two/; " "content:\"three\"; distance:10; http_client_body; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { printf ("failed: http_client_body incorrect flags"); goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; offset:10; http_client_body; pcre:/two/; " "content:\"three\"; distance:10; http_client_body; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; pcre:/two/; " "content:\"three\"; http_client_body; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hcbd1->flags != 0 || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_DEPTH || memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || !DETECT_CONTENT_IS_SINGLE(hcbd1) || DETECT_CONTENT_IS_SINGLE(hcbd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; " "content:\"two\"; distance:0; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hcbd2->content, "two", hcbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; " "content:\"two\"; within:5; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 || hcbd2->flags != DETECT_CONTENT_WITHIN || memcmp(hcbd2->content, "two", hcbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list != NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/P; " "content:\"two\"; within:5; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hcbd2->flags != DETECT_CONTENT_WITHIN || memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_client_body; " "pcre:/one/PR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hcbd1->content, "two", hcbd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpClientBodyTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/P; " "content:\"two\"; distance:5; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hcbd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectHttpClientBodyRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpClientBodyTest01", DetectHttpClientBodyTest01); UtRegisterTest("DetectHttpClientBodyTest02", DetectHttpClientBodyTest02); UtRegisterTest("DetectHttpClientBodyTest03", DetectHttpClientBodyTest03); UtRegisterTest("DetectHttpClientBodyTest04", DetectHttpClientBodyTest04); UtRegisterTest("DetectHttpClientBodyTest05", DetectHttpClientBodyTest05); UtRegisterTest("DetectHttpClientBodyTest06", DetectHttpClientBodyTest06); UtRegisterTest("DetectHttpClientBodyTest07", DetectHttpClientBodyTest07); UtRegisterTest("DetectHttpClientBodyTest08", DetectHttpClientBodyTest08); UtRegisterTest("DetectHttpClientBodyTest09", DetectHttpClientBodyTest09); UtRegisterTest("DetectHttpClientBodyTest10", DetectHttpClientBodyTest10); UtRegisterTest("DetectHttpClientBodyTest11", DetectHttpClientBodyTest11); UtRegisterTest("DetectHttpClientBodyTest12", DetectHttpClientBodyTest12); UtRegisterTest("DetectHttpClientBodyTest13", DetectHttpClientBodyTest13); UtRegisterTest("DetectHttpClientBodyTest14", DetectHttpClientBodyTest14); UtRegisterTest("DetectHttpClientBodyTest15", DetectHttpClientBodyTest15); UtRegisterTest("DetectHttpClientBodyTest22", DetectHttpClientBodyTest22); UtRegisterTest("DetectHttpClientBodyTest23", DetectHttpClientBodyTest23); UtRegisterTest("DetectHttpClientBodyTest24", DetectHttpClientBodyTest24); UtRegisterTest("DetectHttpClientBodyTest25", DetectHttpClientBodyTest25); UtRegisterTest("DetectHttpClientBodyTest26", DetectHttpClientBodyTest26); UtRegisterTest("DetectHttpClientBodyTest27", DetectHttpClientBodyTest27); UtRegisterTest("DetectHttpClientBodyTest28", DetectHttpClientBodyTest28); UtRegisterTest("DetectHttpClientBodyTest29", DetectHttpClientBodyTest29); UtRegisterTest("DetectHttpClientBodyTest30", DetectHttpClientBodyTest30); UtRegisterTest("DetectHttpClientBodyTest31", DetectHttpClientBodyTest31); UtRegisterTest("DetectHttpClientBodyTest32", DetectHttpClientBodyTest32); UtRegisterTest("DetectHttpClientBodyTest33", DetectHttpClientBodyTest33); UtRegisterTest("DetectHttpClientBodyTest34", DetectHttpClientBodyTest34); UtRegisterTest("DetectHttpClientBodyTest35", DetectHttpClientBodyTest35); UtRegisterTest("DetectHttpClientBodyTest36", DetectHttpClientBodyTest36); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-rawbytes.c0000644000000000000000000000556713051004444014270 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements rawbytes keyword support * * \todo Provide un-normalized telnet dce/rpc buffers to match on */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "flow-var.h" #include "detect-content.h" #include "detect-pcre.h" #include "util-debug.h" static int DetectRawbytesSetup (DetectEngineCtx *, Signature *, char *); void DetectRawbytesRegister (void) { sigmatch_table[DETECT_RAWBYTES].name = "rawbytes"; sigmatch_table[DETECT_RAWBYTES].Match = NULL; sigmatch_table[DETECT_RAWBYTES].Setup = DetectRawbytesSetup; sigmatch_table[DETECT_RAWBYTES].Free = NULL; sigmatch_table[DETECT_RAWBYTES].RegisterTests = NULL; sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_RAWBYTES].flags |= SIGMATCH_PAYLOAD; } static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr) { SCEnter(); if (nullstr != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "rawbytes has no value"); return -1; } if (s->list != DETECT_SM_LIST_NOTSET) { SCLogError(SC_ERR_RAWBYTES_FILE_DATA, "\"rawbytes\" cannot be combined with \"file_data\""); SCReturnInt(-1); } SigMatch *pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceding content option"); SCReturnInt(-1); } switch (pm->type) { case DETECT_CONTENT: { DetectContentData *cd = (DetectContentData *)pm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple rawbytes modifiers for the same content. "); SCReturnInt(-1); } cd->flags |= DETECT_CONTENT_RAWBYTES; break; } default: SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceding content option"); SCReturnInt(-1); } SCReturnInt(0); } suricata-3.2.1/src/util-logopenfile-tile.h0000644000000000000000000000207213051004444015364 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele, Tilera Corporation */ #ifndef __UTIL_LOGOPENFILE_TILE_H__ #define __UTIL_LOGOPENFILE_TILE_H__ #include "util-logopenfile.h" /* LogFileCtx */ PcieFile *TileOpenPcieFp(LogFileCtx *log_ctx, const char *path, const char *append_setting); #endif /* __UTIL_LOGOPENFILE_TILE_H__ */ suricata-3.2.1/src/decode-udp.c0000644000000000000000000001523413051004444013163 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode UDP */ #include "suricata-common.h" #include "decode.h" #include "decode-udp.h" #include "decode-teredo.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" #include "flow.h" #include "app-layer.h" static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < UDP_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_TOO_SMALL); return -1; } p->udph = (UDPHdr *)pkt; if (unlikely(len < UDP_GET_LEN(p))) { ENGINE_SET_INVALID_EVENT(p, UDP_PKT_TOO_SMALL); return -1; } if (unlikely(len != UDP_GET_LEN(p))) { ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_INVALID); return -1; } SET_UDP_SRC_PORT(p,&p->sp); SET_UDP_DST_PORT(p,&p->dp); p->payload = pkt + UDP_HEADER_LEN; p->payload_len = len - UDP_HEADER_LEN; p->proto = IPPROTO_UDP; return 0; } int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_udp); if (unlikely(DecodeUDPPacket(tv, p,pkt,len) < 0)) { p->udph = NULL; return TM_ECODE_FAILED; } SCLogDebug("UDP sp: %" PRIu32 " -> dp: %" PRIu32 " - HLEN: %" PRIu32 " LEN: %" PRIu32 "", UDP_GET_SRC_PORT(p), UDP_GET_DST_PORT(p), UDP_HEADER_LEN, p->payload_len); if (unlikely(DecodeTeredo(tv, dtv, p, p->payload, p->payload_len, pq) == TM_ECODE_OK)) { /* Here we have a Teredo packet and don't need to handle app * layer */ FlowSetupPacket(p); return TM_ECODE_OK; } FlowSetupPacket(p); return TM_ECODE_OK; } #ifdef UNITTESTS static int UDPV4CalculateValidChecksumtest01(void) { uint16_t csum = 0; uint8_t raw_ipshdr[] = { 0xd0, 0x43, 0xdc, 0xdc, 0xc0, 0xa8, 0x01, 0x3}; uint8_t raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x26}; csum = *( ((uint16_t *)raw_udp) + 3); return (csum == UDPV4CalculateChecksum((uint16_t *) raw_ipshdr, (uint16_t *)raw_udp, sizeof(raw_udp))); } static int UDPV4CalculateInvalidChecksumtest02(void) { uint16_t csum = 0; uint8_t raw_ipshdr[] = { 0xd0, 0x43, 0xdc, 0xdc, 0xc0, 0xa8, 0x01, 0x3}; uint8_t raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x27}; csum = *( ((uint16_t *)raw_udp) + 3); return (csum != UDPV4CalculateChecksum((uint16_t *) raw_ipshdr, (uint16_t *)raw_udp, sizeof(raw_udp))); } static int UDPV6CalculateValidChecksumtest03(void) { uint16_t csum = 0; static uint8_t raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x00}; csum = *( ((uint16_t *)(raw_ipv6 + 60))); return (csum == UDPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 20)); } static int UDPV6CalculateInvalidChecksumtest04(void) { uint16_t csum = 0; static uint8_t raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x01}; csum = *( ((uint16_t *)(raw_ipv6 + 60))); return (csum != UDPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 20)); } #endif /* UNITTESTS */ void DecodeUDPV4RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("UDPV4CalculateValidChecksumtest01", UDPV4CalculateValidChecksumtest01); UtRegisterTest("UDPV4CalculateInvalidChecksumtest02", UDPV4CalculateInvalidChecksumtest02); UtRegisterTest("UDPV6CalculateValidChecksumtest03", UDPV6CalculateValidChecksumtest03); UtRegisterTest("UDPV6CalculateInvalidChecksumtest04", UDPV6CalculateInvalidChecksumtest04); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-proto-name.c0000644000000000000000000000634613051004444014212 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * File to provide the protocol names based on protocol numbers defined in the * specified protocol file. */ #include "suricata-common.h" #include "util-proto-name.h" static int init_once = 0; /** * \brief Function to load the protocol names from the specified protocol * file. */ void SCProtoNameInit() { BUG_ON(init_once); init_once++; memset(known_proto, 0x00, sizeof(known_proto)); /* Load the known protocols name from the /etc/protocols file */ FILE *fp = fopen(PROTO_FILE,"r"); if (fp != NULL) { char line[200]; char *ptr = NULL; while(fgets(line, sizeof(line), fp) != NULL) { if (line[0] == '#') continue; char *name = strtok_r(line," \t", &ptr); if (name == NULL) continue; char *proto_ch = strtok_r(NULL," \t", &ptr); if (proto_ch == NULL) continue; int proto = atoi(proto_ch); if (proto >= 255) continue; char *cname = strtok_r(NULL, " \t", &ptr); if (known_proto[proto] != NULL) { SCFree(known_proto[proto]); } if (cname != NULL) { known_proto[proto] = SCStrdup(cname); } else { known_proto[proto] = SCStrdup(name); } if (unlikely(known_proto[proto] == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed proto name allocation"); continue; } int proto_len = strlen(known_proto[proto]); if (proto_len > 0 && known_proto[proto][proto_len - 1] == '\n') known_proto[proto][proto_len - 1] = '\0'; } fclose(fp); } } /** * \brief Function to check if the received protocol number is valid and do * we have corresponding name entry for this number or not. * * \param proto Protocol number to be validated * \retval ret On success returns TRUE otherwise FALSE */ uint8_t SCProtoNameValid(uint16_t proto) { uint8_t ret = FALSE; if (proto <= 255 && known_proto[proto] != NULL) { ret = TRUE; } return ret; } /** * \brief Function to clears the memory used in storing the protocol names. */ void SCProtoNameDeInit() { int cnt; /* clears the memory of loaded protocol names */ for (cnt = 0; cnt < 255; cnt++) { if (known_proto[cnt] != NULL) SCFree(known_proto[cnt]); } } suricata-3.2.1/src/detect-lua-extensions.h0000644000000000000000000000207213051004444015377 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_LUA_EXT_H__ #define __DETECT_LUA_EXT_H__ #ifdef HAVE_LUA int LuaRegisterExtensions(lua_State *); void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *, DetectEngineThreadCtx *det_ctx, Flow *f, Packet *p, uint8_t flags); #endif /* HAVE_LUA */ #endif suricata-3.2.1/src/detect-bypass.h0000644000000000000000000000162013051004444013720 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo */ #ifndef __DETECT_BYPASS_H__ #define __DETECT_BYPASS_H__ void DetectBypassRegister(void); #endif /* __DETECT_BYPASS_H__ */ suricata-3.2.1/src/output-json-template.c0000644000000000000000000001335213051004444015271 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* * TODO: Update \author in this file and in output-json-template.h. * TODO: Remove SCLogNotice statements, or convert to debug. * TODO: Implement your app-layers logging. */ /** * \file * * \author FirstName LastName * * Implement JSON/eve logging app-layer Template. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-buffer.h" #include "util-debug.h" #include "util-byte.h" #include "output.h" #include "output-json.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-template.h" #ifdef HAVE_LIBJANSSON typedef struct LogTemplateFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; } LogTemplateFileCtx; typedef struct LogTemplateLogThread_ { LogTemplateFileCtx *templatelog_ctx; uint32_t count; MemBuffer *buffer; } LogTemplateLogThread; static int JsonTemplateLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { TemplateTransaction *templatetx = tx; LogTemplateLogThread *thread = thread_data; json_t *js, *templatejs; SCLogNotice("Logging template transaction %"PRIu64".", templatetx->tx_id); js = CreateJSONHeader((Packet *)p, 0, "template"); if (unlikely(js == NULL)) { return TM_ECODE_FAILED; } templatejs = json_object(); if (unlikely(templatejs == NULL)) { goto error; } /* Convert the request buffer to a string then log. */ char *request_buffer = BytesToString(templatetx->request_buffer, templatetx->request_buffer_len); if (request_buffer != NULL) { json_object_set_new(templatejs, "request", json_string(request_buffer)); SCFree(request_buffer); } /* Convert the response buffer to a string then log. */ char *response_buffer = BytesToString(templatetx->response_buffer, templatetx->response_buffer_len); if (response_buffer != NULL) { json_object_set_new(templatejs, "response", json_string(response_buffer)); SCFree(response_buffer); } json_object_set_new(js, "template", templatejs); MemBufferReset(thread->buffer); OutputJSONBuffer(js, thread->templatelog_ctx->file_ctx, &thread->buffer); json_decref(js); return TM_ECODE_OK; error: json_decref(js); return TM_ECODE_FAILED; } static void OutputTemplateLogDeInitCtxSub(OutputCtx *output_ctx) { LogTemplateFileCtx *templatelog_ctx = (LogTemplateFileCtx *)output_ctx->data; SCFree(templatelog_ctx); SCFree(output_ctx); } static OutputCtx *OutputTemplateLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { AlertJsonThread *ajt = parent_ctx->data; LogTemplateFileCtx *templatelog_ctx = SCCalloc(1, sizeof(*templatelog_ctx)); if (unlikely(templatelog_ctx == NULL)) { return NULL; } templatelog_ctx->file_ctx = ajt->file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); if (unlikely(output_ctx == NULL)) { SCFree(templatelog_ctx); return NULL; } output_ctx->data = templatelog_ctx; output_ctx->DeInit = OutputTemplateLogDeInitCtxSub; SCLogNotice("Template log sub-module initialized."); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TEMPLATE); return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogTemplateLogThread *thread = SCCalloc(1, sizeof(*thread)); if (unlikely(thread == NULL)) { return TM_ECODE_FAILED; } if (initdata == NULL) { SCLogDebug("Error getting context for EveLogTemplate. \"initdata\" is NULL."); SCFree(thread); return TM_ECODE_FAILED; } thread->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (unlikely(thread->buffer == NULL)) { SCFree(thread); return TM_ECODE_FAILED; } thread->templatelog_ctx = ((OutputCtx *)initdata)->data; *data = (void *)thread; return TM_ECODE_OK; } static TmEcode JsonTemplateLogThreadDeinit(ThreadVars *t, void *data) { LogTemplateLogThread *thread = (LogTemplateLogThread *)data; if (thread == NULL) { return TM_ECODE_OK; } if (thread->buffer != NULL) { MemBufferFree(thread->buffer); } SCFree(thread); return TM_ECODE_OK; } void JsonTemplateLogRegister(void) { /* TEMPLATE_START_REMOVE */ if (ConfGetNode("app-layer.protocols.template") == NULL) { return; } /* TEMPLATE_END_REMOVE */ /* Register as an eve sub-module. */ OutputRegisterTxSubModule(LOGGER_JSON_TEMPLATE, "eve-log", "JsonTemplateLog", "eve-log.template", OutputTemplateLogInitSub, ALPROTO_TEMPLATE, JsonTemplateLogger, JsonTemplateLogThreadInit, JsonTemplateLogThreadDeinit, NULL); SCLogNotice("Template JSON logger registered."); } #else /* No JSON support. */ void JsonTemplateLogRegister(void) { } #endif /* HAVE_LIBJANSSON */ suricata-3.2.1/src/detect-prefilter.h0000644000000000000000000000165213051004444014420 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PREFILTER_H__ #define __DETECT_PREFILTER_H__ /* prototypes */ void DetectPrefilterRegister (void); #endif /* __DETECT_PREFILTER_H__ */ suricata-3.2.1/src/decode-mpls.h0000644000000000000000000000175713051004444013360 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jason Ish * * MPLS decoder. */ #ifndef __DECODE_MPLS_H__ #define __DECODE_MPLS_H__ #define ETHERNET_TYPE_MPLS_UNICAST 0x8847 #define ETHERNET_TYPE_MPLS_MULTICAST 0x8848 void DecodeMPLSRegisterTests(void); #endif /* !__DECODE_MPLS_H__ */ suricata-3.2.1/src/util-classification-config.c0000644000000000000000000006153413051004444016367 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Used for parsing a classification.config file */ #include "suricata-common.h" #include "detect.h" #include "detect-engine.h" #include "util-hash.h" #include "conf.h" #include "util-classification-config.h" #include "util-unittest.h" #include "util-error.h" #include "util-debug.h" #include "util-fmemopen.h" /* Regex to parse the classtype argument from a Signature. The first substring * holds the classtype name, the second substring holds the classtype the * classtype description, and the third argument holds the priority */ #define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$" /* Default path for the classification.config file */ #if defined OS_WIN32 || defined __CYGWIN__ #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "\\\\classification.config" #else #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/classification.config" #endif static pcre *regex = NULL; static pcre_extra *regex_study = NULL; uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen); char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2); void SCClassConfClasstypeHashFree(void *ch); static char *SCClassConfGetConfFilename(const DetectEngineCtx *de_ctx); void SCClassConfInit(void) { const char *eb = NULL; int eo; int opts = 0; regex = pcre_compile(DETECT_CLASSCONFIG_REGEX, opts, &eb, &eo, NULL); if (regex == NULL) { SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s", DETECT_CLASSCONFIG_REGEX, eo, eb); return; } regex_study = pcre_study(regex, 0, &eb); if (eb != NULL) { pcre_free(regex); regex = NULL; SCLogDebug("pcre study failed: %s", eb); return; } return; } void SCClassConfDeinit(void) { if (regex != NULL) { pcre_free(regex); regex = NULL; } if (regex_study != NULL) { pcre_free(regex_study); regex_study = NULL; } } /** * \brief Inits the context to be used by the Classification Config parsing API. * * This function initializes the hash table to be used by the Detection * Engine Context to hold the data from the classification.config file, * obtains the file desc to parse the classification.config file, and * inits the regex used to parse the lines from classification.config * file. * * \param de_ctx Pointer to the Detection Engine Context. * * \retval fp NULL on error */ FILE *SCClassConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FILE *fd) { char *filename = NULL; /* init the hash table to be used by the classification config Classtypes */ de_ctx->class_conf_ht = HashTableInit(128, SCClassConfClasstypeHashFunc, SCClassConfClasstypeHashCompareFunc, SCClassConfClasstypeHashFree); if (de_ctx->class_conf_ht == NULL) { SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash " "table"); goto error; } /* if it is not NULL, use the file descriptor. The hack so that we can * avoid using a dummy classification file for testing purposes and * instead use an input stream against a buffer containing the * classification strings */ if (fd == NULL) { filename = SCClassConfGetConfFilename(de_ctx); if ( (fd = fopen(filename, "r")) == NULL) { #ifdef UNITTESTS if (RunmodeIsUnittests()) goto error; // silently fail #endif SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; } } return fd; error: if (de_ctx->class_conf_ht != NULL) { HashTableFree(de_ctx->class_conf_ht); de_ctx->class_conf_ht = NULL; } if (fd != NULL) { fclose(fd); fd = NULL; } return NULL; } /** * \brief Returns the path for the Classification Config file. We check if we * can retrieve the path from the yaml conf file. If it is not present, * return the default path for the classification file which is * "./classification.config". * * \retval log_filename Pointer to a string containing the path for the * Classification Config file. */ static char *SCClassConfGetConfFilename(const DetectEngineCtx *de_ctx) { char *log_filename = NULL; if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) { char config_value[256]; snprintf(config_value, sizeof(config_value), "%s.classification-file", de_ctx->config_prefix); /* try loading prefix setting, fall back to global if that * fails. */ if (ConfGet(config_value, &log_filename) != 1) { if (ConfGet("classification-file", &log_filename) != 1) { log_filename = (char *)SC_CLASS_CONF_DEF_CONF_FILEPATH; } } } else { if (ConfGet("classification-file", &log_filename) != 1) { log_filename = (char *)SC_CLASS_CONF_DEF_CONF_FILEPATH; } } return log_filename; } /** * \brief Releases resources used by the Classification Config API. */ static void SCClassConfDeInitLocalResources(DetectEngineCtx *de_ctx, FILE *fd) { if (fd != NULL) { fclose(fd); fd = NULL; } } /** * \brief Releases resources used by the Classification Config API. */ void SCClassConfDeInitContext(DetectEngineCtx *de_ctx) { if (de_ctx->class_conf_ht != NULL) HashTableFree(de_ctx->class_conf_ht); de_ctx->class_conf_ht = NULL; return; } /** * \brief Converts a string to lowercase. * * \param str Pointer to the string to be converted. */ static char *SCClassConfStringToLowercase(const char *str) { char *new_str = NULL; char *temp_str = NULL; if ( (new_str = SCStrdup(str)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); return NULL; } temp_str = new_str; while (*temp_str != '\0') { *temp_str = tolower((unsigned char)*temp_str); temp_str++; } return new_str; } /** * \brief Parses a line from the classification file and adds it to Classtype * hash table in DetectEngineCtx, i.e. DetectEngineCtx->class_conf_ht. * * \param rawstr Pointer to the string to be parsed. * \param index Relative index of the string to be parsed. * \param de_ctx Pointer to the Detection Engine Context. * * \retval 0 On success. * \retval -1 On failure. */ int SCClassConfAddClasstype(char *rawstr, uint8_t index, DetectEngineCtx *de_ctx) { char ct_name[64]; char ct_desc[512]; char ct_priority_str[16]; int ct_priority = 0; uint8_t ct_id = index; SCClassConfClasstype *ct_new = NULL; SCClassConfClasstype *ct_lookup = NULL; #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); if (ret < 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid Classtype in " "classification.config file"); goto error; } /* retrieve the classtype name */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 1, ct_name, sizeof(ct_name)); if (ret < 0) { SCLogInfo("pcre_copy_substring() failed"); goto error; } /* retrieve the classtype description */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 2, ct_desc, sizeof(ct_desc)); if (ret < 0) { SCLogInfo("pcre_copy_substring() failed"); goto error; } /* retrieve the classtype priority */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 3, ct_priority_str, sizeof(ct_priority_str)); if (ret < 0) { SCLogInfo("pcre_copy_substring() failed"); goto error; } if (strlen(ct_priority_str) == 0) { goto error; } ct_priority = atoi(ct_priority_str); /* Create a new instance of the parsed Classtype string */ ct_new = SCClassConfAllocClasstype(ct_id, ct_name, ct_desc, ct_priority); if (ct_new == NULL) goto error; /* Check if the Classtype is present in the HashTable. In case it's present * ignore it, as it is a duplicate. If not present, add it to the table */ ct_lookup = HashTableLookup(de_ctx->class_conf_ht, ct_new, 0); if (ct_lookup == NULL) { if (HashTableAdd(de_ctx->class_conf_ht, ct_new, 0) < 0) SCLogDebug("HashTable Add failed"); } else { SCLogDebug("Duplicate classtype found inside classification.config"); if (ct_new->classtype_desc) SCFree(ct_new->classtype_desc); if (ct_new->classtype) SCFree(ct_new->classtype); SCFree(ct_new); } return 0; error: return -1; } /** * \brief Checks if a string is a comment or a blank line. * * Comments lines are lines of the following format - * "# This is a comment string" or * " # This is a comment string". * * \param line String that has to be checked * * \retval 1 On the argument string being a comment or blank line * \retval 0 Otherwise */ static int SCClassConfIsLineBlankOrComment(char *line) { while (*line != '\0') { /* we have a comment */ if (*line == '#') return 1; /* this line is neither a comment line, nor a blank line */ if (!isspace((unsigned char)*line)) return 0; line++; } /* we have a blank line */ return 1; } /** * \brief Parses the Classification Config file and updates the * DetectionEngineCtx->class_conf_ht with the Classtype information. * * \param de_ctx Pointer to the Detection Engine Context. */ void SCClassConfParseFile(DetectEngineCtx *de_ctx, FILE *fd) { char line[1024]; uint8_t i = 1; while (fgets(line, sizeof(line), fd) != NULL) { if (SCClassConfIsLineBlankOrComment(line)) continue; SCClassConfAddClasstype(line, i, de_ctx); i++; } #ifdef UNITTESTS SCLogInfo("Added \"%d\" classification types from the classification file", de_ctx->class_conf_ht->count); #endif return; } /** * \brief Returns a new SCClassConfClasstype instance. The classtype string * is converted into lowercase, before being assigned to the instance. * * \param classtype Pointer to the classification type. * \param classtype_desc Pointer to the classification type description. * \param priority Holds the priority for the classification type. * * \retval ct Pointer to the new instance of SCClassConfClasstype on success; * NULL on failure. */ SCClassConfClasstype *SCClassConfAllocClasstype(uint8_t classtype_id, const char *classtype, const char *classtype_desc, int priority) { SCClassConfClasstype *ct = NULL; if (classtype == NULL) return NULL; if ( (ct = SCMalloc(sizeof(SCClassConfClasstype))) == NULL) return NULL; memset(ct, 0, sizeof(SCClassConfClasstype)); if ( (ct->classtype = SCClassConfStringToLowercase(classtype)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCClassConfDeAllocClasstype(ct); return NULL; } if (classtype_desc != NULL && (ct->classtype_desc = SCStrdup(classtype_desc)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCClassConfDeAllocClasstype(ct); return NULL; } ct->classtype_id = classtype_id; ct->priority = priority; return ct; } /** * \brief Frees a SCClassConfClasstype instance * * \param Pointer to the SCClassConfClasstype instance that has to be freed */ void SCClassConfDeAllocClasstype(SCClassConfClasstype *ct) { if (ct != NULL) { if (ct->classtype != NULL) SCFree(ct->classtype); if (ct->classtype_desc != NULL) SCFree(ct->classtype_desc); SCFree(ct); } return; } /** * \brief Hashing function to be used to hash the Classtype name. Would be * supplied as an argument to the HashTableInit function for * DetectEngineCtx->class_conf_ht. * * \param ht Pointer to the HashTable. * \param data Pointer to the data to be hashed. In this case, the data * would be a pointer to a SCClassConfClasstype instance. * \param datalen Not used by this function. */ uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen) { SCClassConfClasstype *ct = (SCClassConfClasstype *)data; uint32_t hash = 0; int i = 0; int len = strlen(ct->classtype); for (i = 0; i < len; i++) hash += tolower((unsigned char)(ct->classtype)[i]); hash = hash % ht->array_size; return hash; } /** * \brief Used to compare two Classtypes that have been stored in the HashTable. * This function is supplied as an argument to the HashTableInit function * for DetectionEngineCtx->class_conf_ct. * * \param data1 Pointer to the first SCClassConfClasstype to be compared. * \param len1 Not used by this function. * \param data2 Pointer to the second SCClassConfClasstype to be compared. * \param len2 Not used by this function. * * \retval 1 On data1 and data2 being equal. * \retval 0 On data1 and data2 not being equal. */ char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2) { SCClassConfClasstype *ct1 = (SCClassConfClasstype *)data1; SCClassConfClasstype *ct2 = (SCClassConfClasstype *)data2; int len1 = 0; int len2 = 0; if (ct1 == NULL || ct2 == NULL) return 0; if (ct1->classtype == NULL || ct2->classtype == NULL) return 0; len1 = strlen(ct1->classtype); len2 = strlen(ct2->classtype); if (len1 == len2 && memcmp(ct1->classtype, ct2->classtype, len1) == 0) { SCLogDebug("Match found inside Classification-Config hash function"); return 1; } return 0; } /** * \brief Used to free the Classification Config Hash Data that was stored in * DetectEngineCtx->class_conf_ht Hashtable. * * \param ch Pointer to the data that has to be freed. */ void SCClassConfClasstypeHashFree(void *ch) { SCClassConfDeAllocClasstype(ch); return; } /** * \brief Loads the Classtype info from the classification.config file. * * The classification.config file contains the different classtypes, * that can be used to label Signatures. Each line of the file should * have the following format - * classtype_name, classtype_description, priority * None of the above parameters should hold a quote inside the file. * * \param de_ctx Pointer to the Detection Engine Context that should be updated * with Classtype information. */ void SCClassConfLoadClassficationConfigFile(DetectEngineCtx *de_ctx, FILE *fd) { fd = SCClassConfInitContextAndLocalResources(de_ctx, fd); if (fd == NULL) { #ifdef UNITTESTS if (RunmodeIsUnittests() && fd == NULL) { return; } #endif SCLogError(SC_ERR_OPENING_FILE, "please check the \"classification-file\" " "option in your suricata.yaml file"); return; } SCClassConfParseFile(de_ctx, fd); SCClassConfDeInitLocalResources(de_ctx, fd); return; } /** * \brief Gets the classtype from the corresponding hash table stored * in the Detection Engine Context's class conf ht, given the * classtype name. * * \param ct_name Pointer to the classtype name that has to be looked up. * \param de_ctx Pointer to the Detection Engine Context. * * \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from * the hash table on success; NULL on failure. */ SCClassConfClasstype *SCClassConfGetClasstype(const char *ct_name, DetectEngineCtx *de_ctx) { char name[strlen(ct_name) + 1]; size_t s; for (s = 0; s < strlen(ct_name); s++) name[s] = tolower((unsigned char)ct_name[s]); name[s] = '\0'; SCClassConfClasstype ct_lookup = {0, name, NULL, 0 }; SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht, &ct_lookup, 0); return lookup_ct_info; } /*----------------------------------Unittests---------------------------------*/ #ifdef UNITTESTS /** * \brief Creates a dummy classification file, with all valid Classtypes, for * testing purposes. * * \file_path Pointer to the file_path for the dummy classification file. */ FILE *SCClassConfGenerateValidDummyClassConfigFD01(void) { const char *buffer = "config classification: nothing-wrong,Nothing Wrong With Us,3\n" "config classification: unknown,Unknown are we,3\n" "config classification: bad-unknown,We think it's bad, 2\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Classifiation Config test code"); return fd; } /** * \brief Creates a dummy classification file, with some valid Classtypes and a * couple of invalid Classtypes, for testing purposes. * * \file_path Pointer to the file_path for the dummy classification file. */ FILE *SCClassConfGenerateInValidDummyClassConfigFD02(void) { const char *buffer = "config classification: not-suspicious,Not Suspicious Traffic,3\n" "onfig classification: unknown,Unknown Traffic,3\n" "config classification: _badunknown,Potentially Bad Traffic, 2\n" "config classification: bamboola1,Unknown Traffic,3\n" "config classification: misc-activity,Misc activity,-1\n" "config classification: policy-violation,Potential Corporate " "config classification: bamboola,Unknown Traffic,3\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Classifiation Config test code"); return fd; } /** * \brief Creates a dummy classification file, with all invalid Classtypes, for * testing purposes. * * \file_path Pointer to the file_path for the dummy classification file. */ FILE *SCClassConfGenerateInValidDummyClassConfigFD03(void) { const char *buffer = "conig classification: not-suspicious,Not Suspicious Traffic,3\n" "onfig classification: unknown,Unknown Traffic,3\n" "config classification: _badunknown,Potentially Bad Traffic, 2\n" "config classification: misc-activity,Misc activity,-1\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Classifiation Config test code"); return fd; } /** * \test Check that the classification file is loaded and the detection engine * content class_conf_hash_table loaded with the classtype data. */ int SCClassConfTest01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return result; result = (de_ctx->class_conf_ht->count == 3); if (result == 0) printf("de_ctx->class_conf_ht->count %u: ", de_ctx->class_conf_ht->count); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check that invalid classtypes present in the classification config file * aren't loaded. */ int SCClassConfTest02(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCClassConfGenerateInValidDummyClassConfigFD03(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return result; result = (de_ctx->class_conf_ht->count == 0); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check that only valid classtypes are loaded into the hash table from * the classfication.config file. */ int SCClassConfTest03(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCClassConfGenerateInValidDummyClassConfigFD02(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return result; result = (de_ctx->class_conf_ht->count == 3); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the classtype info from the classification.config file have * been loaded into the hash table. */ int SCClassConfTest04(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return 0; result = (de_ctx->class_conf_ht->count == 3); result &= (SCClassConfGetClasstype("unknown", de_ctx) != NULL); result &= (SCClassConfGetClasstype("unKnoWn", de_ctx) != NULL); result &= (SCClassConfGetClasstype("bamboo", de_ctx) == NULL); result &= (SCClassConfGetClasstype("bad-unknown", de_ctx) != NULL); result &= (SCClassConfGetClasstype("BAD-UNKnOWN", de_ctx) != NULL); result &= (SCClassConfGetClasstype("bed-unknown", de_ctx) == NULL); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the classtype info from the invalid classification.config file * have not been loaded into the hash table, and cross verify to check * that the hash table contains no classtype data. */ int SCClassConfTest05(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCClassConfGenerateInValidDummyClassConfigFD03(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return 0; result = (de_ctx->class_conf_ht->count == 0); result &= (SCClassConfGetClasstype("unknown", de_ctx) == NULL); result &= (SCClassConfGetClasstype("unKnoWn", de_ctx) == NULL); result &= (SCClassConfGetClasstype("bamboo", de_ctx) == NULL); result &= (SCClassConfGetClasstype("bad-unknown", de_ctx) == NULL); result &= (SCClassConfGetClasstype("BAD-UNKnOWN", de_ctx) == NULL); result &= (SCClassConfGetClasstype("bed-unknown", de_ctx) == NULL); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the classtype info from the classification.config file have * been loaded into the hash table. */ int SCClassConfTest06(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCClassConfGenerateInValidDummyClassConfigFD02(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); if (de_ctx->class_conf_ht == NULL) return 0; result = (de_ctx->class_conf_ht->count == 3); result &= (SCClassConfGetClasstype("unknown", de_ctx) == NULL); result &= (SCClassConfGetClasstype("not-suspicious", de_ctx) != NULL); result &= (SCClassConfGetClasstype("bamboola1", de_ctx) != NULL); result &= (SCClassConfGetClasstype("bamboola1", de_ctx) != NULL); result &= (SCClassConfGetClasstype("BAMBOolA1", de_ctx) != NULL); result &= (SCClassConfGetClasstype("unkNOwn", de_ctx) == NULL); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for Classification Config API. */ void SCClassConfRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCClassConfTest01", SCClassConfTest01); UtRegisterTest("SCClassConfTest02", SCClassConfTest02); UtRegisterTest("SCClassConfTest03", SCClassConfTest03); UtRegisterTest("SCClassConfTest04", SCClassConfTest04); UtRegisterTest("SCClassConfTest05", SCClassConfTest05); UtRegisterTest("SCClassConfTest06", SCClassConfTest06); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-http-raw-header.h0000644000000000000000000000166713051004444015426 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_HTTP_RAW_HEADER_H__ #define __DETECT_HTTP_RAW_HEADER_H__ void DetectHttpRawHeaderRegister(void); #endif /* __DETECT_HTTP_RAW_HEADER_H__ */ suricata-3.2.1/src/flow-storage.c0000644000000000000000000001475213051004444013567 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * based on host-storage by Victor Julien * * Flow wrapper around storage api */ #include "suricata-common.h" #include "host-storage.h" #include "flow-hash.h" #include "flow-util.h" #include "util-unittest.h" unsigned int FlowStorageSize(void) { return StorageGetSize(STORAGE_FLOW); } void *FlowGetStorageById(Flow *f, int id) { return StorageGetById((Storage *)((void *)f + sizeof(Flow)), STORAGE_FLOW, id); } int FlowSetStorageById(Flow *f, int id, void *ptr) { return StorageSetById((Storage *)((void *)f + sizeof(Flow)), STORAGE_FLOW, id, ptr); } void *FlowAllocStorageById(Flow *f, int id) { return StorageAllocByIdPrealloc((Storage *)((void *)f + sizeof(Flow)), STORAGE_FLOW, id); } void FlowFreeStorageById(Flow *f, int id) { StorageFreeById((Storage *)((void *)f + sizeof(Flow)), STORAGE_FLOW, id); } void FlowFreeStorage(Flow *f) { if (FlowStorageSize() > 0) StorageFreeAll((Storage *)((void *)f + sizeof(Flow)), STORAGE_FLOW); } int FlowStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)) { return StorageRegister(STORAGE_FLOW, name, size, Alloc, Free); } #ifdef UNITTESTS static void *StorageTestAlloc(unsigned int size) { void *x = SCMalloc(size); return x; } static void StorageTestFree(void *x) { if (x) SCFree(x); } static int FlowStorageTest01(void) { Flow *f = NULL; StorageInit(); int id1 = FlowStorageRegister("test", 8, StorageTestAlloc, StorageTestFree); if (id1 < 0) goto error; int id2 = FlowStorageRegister("variable", 24, StorageTestAlloc, StorageTestFree); if (id2 < 0) goto error; int id3 = FlowStorageRegister("store", sizeof(void *), StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; FlowInitConfig(FLOW_QUIET); f = FlowAlloc(); if (f == NULL) { goto error; } void *ptr = FlowGetStorageById(f, id1); if (ptr != NULL) { goto error; } ptr = FlowGetStorageById(f, id2); if (ptr != NULL) { goto error; } ptr = FlowGetStorageById(f, id3); if (ptr != NULL) { goto error; } void *ptr1a = FlowAllocStorageById(f, id1); if (ptr1a == NULL) { goto error; } void *ptr2a = FlowAllocStorageById(f, id2); if (ptr2a == NULL) { goto error; } void *ptr3a = FlowAllocStorageById(f, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = FlowGetStorageById(f, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = FlowGetStorageById(f, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = FlowGetStorageById(f, id3); if (ptr3a != ptr3b) { goto error; } FlowClearMemory(f, 0); FlowFree(f); FlowShutdown(); StorageCleanup(); return 1; error: if (f != NULL) { FlowClearMemory(f, 0); FlowFree(f); } FlowShutdown(); StorageCleanup(); return 0; } static int FlowStorageTest02(void) { Flow *f = NULL; StorageInit(); int id1 = FlowStorageRegister("test", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; if (StorageFinalize() < 0) goto error; FlowInitConfig(FLOW_QUIET); f = FlowAlloc(); if (f == NULL) { goto error; } void *ptr = FlowGetStorageById(f, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } FlowSetStorageById(f, id1, ptr1a); void *ptr1b = FlowGetStorageById(f, id1); if (ptr1a != ptr1b) { goto error; } FlowClearMemory(f, 0); FlowFree(f); FlowShutdown(); StorageCleanup(); return 1; error: if (f != NULL) { FlowClearMemory(f, 0); FlowFree(f); } FlowShutdown(); StorageCleanup(); return 0; } static int FlowStorageTest03(void) { Flow *f = NULL; StorageInit(); int id1 = FlowStorageRegister("test1", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; int id2 = FlowStorageRegister("test2", sizeof(void *), NULL, StorageTestFree); if (id2 < 0) goto error; int id3 = FlowStorageRegister("test3", 32, StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; FlowInitConfig(FLOW_QUIET); f = FlowAlloc(); if (f == NULL) { goto error; } void *ptr = FlowGetStorageById(f, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } FlowSetStorageById(f, id1, ptr1a); void *ptr2a = SCMalloc(256); if (unlikely(ptr2a == NULL)) { goto error; } FlowSetStorageById(f, id2, ptr2a); void *ptr3a = FlowAllocStorageById(f, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = FlowGetStorageById(f, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = FlowGetStorageById(f, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = FlowGetStorageById(f, id3); if (ptr3a != ptr3b) { goto error; } FlowClearMemory(f, 0); FlowFree(f); FlowShutdown(); StorageCleanup(); return 1; error: if (f != NULL) { FlowClearMemory(f, 0); FlowFree(f); } FlowShutdown(); StorageCleanup(); return 0; } #endif void RegisterFlowStorageTests(void) { #ifdef UNITTESTS UtRegisterTest("FlowStorageTest01", FlowStorageTest01); UtRegisterTest("FlowStorageTest02", FlowStorageTest02); UtRegisterTest("FlowStorageTest03", FlowStorageTest03); #endif } suricata-3.2.1/src/detect-engine-prefilter.h0000644000000000000000000000377013051004444015666 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_PREFILTER_H__ #define __DETECT_ENGINE_PREFILTER_H__ void Prefilter(DetectEngineThreadCtx *, const SigGroupHead *, Packet *p, const uint8_t flags, int has_state); int PrefilterAppendEngine(SigGroupHead *sgh, void (*Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void (*FreeFunc)(void *pectx), const char *name); int PrefilterAppendPayloadEngine(SigGroupHead *sgh, void (*Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void (*FreeFunc)(void *pectx), const char *name); int PrefilterAppendTxEngine(SigGroupHead *sgh, void (*PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), const AppProto alproto, const int tx_min_progress, void *pectx, void (*FreeFunc)(void *pectx), const char *name); void PrefilterFreeEnginesList(PrefilterEngineList *list); void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh); void PrefilterCleanupRuleGroup(SigGroupHead *sgh); #ifdef PROFILING const char *PrefilterStoreGetName(const uint32_t id); #endif #endif suricata-3.2.1/src/detect-http-stat-msg.c0000644000000000000000000004124613051004444015136 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Gurvinder Singh * \author Anoop Saldanha * * Implements the http_stat_msg keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-engine-mpm.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-error.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-stat-msg.h" #include "detect-engine-hsmd.h" #include "stream-tcp-private.h" #include "stream-tcp.h" int DetectHttpStatMsgMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t , void *, Signature *, SigMatch *); static int DetectHttpStatMsgSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpStatMsgRegisterTests(void); void DetectHttpStatMsgFree(void *); /** * \brief Registration function for keyword: http_stat_msg */ void DetectHttpStatMsgRegister (void) { sigmatch_table[DETECT_AL_HTTP_STAT_MSG].name = "http_stat_msg"; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].desc = "content modifier to match on HTTP stat-msg-buffer"; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_stat-msg"; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Match = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetup; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Free = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].RegisterTests = DetectHttpStatMsgRegisterTests; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_stat_msg", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, 3, PrefilterTxHttpStatMsgRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, DetectEngineInspectHttpStatMsg); } /** * \brief this function setups the http_stat_msg modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success * \retval -1 On failure */ static int DetectHttpStatMsgSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_STAT_MSG, DETECT_SM_LIST_HSMDMATCH, ALPROTO_HTTP, NULL); } #ifdef UNITTESTS /** * \test Checks if a http_stat_msg is registered in a Signature, if content is not * specified in the signature or rawbyes is specified or fast_pattern is * provided in the signature. */ int DetectHttpStatMsgTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_msg\"; http_stat_msg;sid:1;)"); if (de_ctx->sig_list != NULL) goto end; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_msg\"; content:\"|FF F1|\";" " rawbytes; http_stat_msg;sid:1;)"); if (de_ctx->sig_list != NULL) goto end; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_msg\"; content:\"one\";" "fast_pattern; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; if (!(((DetectContentData *)de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)) { goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_stat_msg is registered in a Signature and also checks * the nocase */ int DetectHttpStatMsgTest02(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_msg\"; content:\"one\"; " "http_stat_msg; content:\"two\"; http_stat_msg; " "content:\"two\"; nocase; http_stat_msg; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; } SigMatch *prev = NULL; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { result = 1; } else { printf("expected DETECT_CONTENT for http_stat_msg, got %d: ", sm->type); goto end; } prev = sm; sm = sm->next; } if (! (((DetectContentData *)prev->ctx)->flags & DETECT_CONTENT_NOCASE)) { result = 0; } end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check the signature working to alert when http_stat_msg is matched . */ static int DetectHttpStatMsgSigTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status message\"; content:\"OK\"; " "http_stat_msg; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "Status message nocase\"; content:\"ok\"; nocase; " "http_stat_msg; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_stat_msg is not matched . */ static int DetectHttpStatMsgSigTest02(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status message\"; content:\"no\"; " "http_stat_msg; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_stat_msg is used with * negated content . */ static int DetectHttpStatMsgSigTest03(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status message\"; content:\"ok\"; " "nocase; http_stat_msg; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "Status message nocase\"; content:!\"Not\"; " "http_stat_msg; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (! PacketAlertCheck(p, 1)) { printf("sid 1 didn't matched but should have: "); goto end; } if (! PacketAlertCheck(p, 2)) { printf("sid 2 didn't matched but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ /** * \brief Register the UNITTESTS for the http_stat_msg keyword */ void DetectHttpStatMsgRegisterTests (void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectHttpStatMsgTest01", DetectHttpStatMsgTest01); UtRegisterTest("DetectHttpStatMsgTest02", DetectHttpStatMsgTest02); UtRegisterTest("DetectHttpStatMsgSigTest01", DetectHttpStatMsgSigTest01); UtRegisterTest("DetectHttpStatMsgSigTest02", DetectHttpStatMsgSigTest02); UtRegisterTest("DetectHttpStatMsgSigTest03", DetectHttpStatMsgSigTest03); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-pool.c0000644000000000000000000004353013051004444013076 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup utilpool Pool * * ::Pool are an effective way to maintain a set of ready to use * structures. * * To create a ::Pool, you need to use PoolInit(). You can * get an item from the ::Pool by using PoolGet(). When you're * done with it call PoolReturn(). * To destroy the ::Pool, call PoolFree(), it will free all used * memory. * * @{ */ /** * \file * * \author Victor Julien * * Pool utility functions */ #include "suricata-common.h" #include "util-pool.h" #include "util-pool-thread.h" #include "util-unittest.h" #include "util-debug.h" static int PoolMemset(void *pitem, void *initdata) { Pool *p = (Pool *) initdata; memset(pitem, 0, p->elt_size); return 1; } /** * \brief Check if data is preallocated * \retval 0 if not inside the prealloc'd block, 1 if inside */ static int PoolDataPreAllocated(Pool *p, void *data) { ptrdiff_t delta = data - p->data_buffer; if ((delta < 0) || (delta > p->data_buffer_size)) { return 0; } return 1; } /** \brief Init a Pool * * PoolInit() creates a ::Pool. The Alloc function must only do * allocation stuff. The Cleanup function must not try to free * the PoolBucket::data. This is done by the ::Pool management * system. * * \param size * \param prealloc_size * \param elt_size Memory size of an element * \param Alloc An allocation function or NULL to use a standard SCMalloc * \param Init An init function or NULL to use a standard memset to 0 * \param InitData Init data * \param Cleanup a free function or NULL if no special treatment is needed * \param Free free func * \retval the allocated Pool */ Pool *PoolInit(uint32_t size, uint32_t prealloc_size, uint32_t elt_size, void *(*Alloc)(), int (*Init)(void *, void *), void *InitData, void (*Cleanup)(void *), void (*Free)(void *)) { Pool *p = NULL; if (size != 0 && prealloc_size > size) { SCLogError(SC_ERR_POOL_INIT, "size error"); goto error; } if (size != 0 && elt_size == 0) { SCLogError(SC_ERR_POOL_INIT, "size != 0 && elt_size == 0"); goto error; } if (elt_size && Free) { SCLogError(SC_ERR_POOL_INIT, "elt_size && Free"); goto error; } /* setup the filter */ p = SCMalloc(sizeof(Pool)); if (unlikely(p == NULL)) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); goto error; } memset(p,0,sizeof(Pool)); p->max_buckets = size; p->preallocated = prealloc_size; p->elt_size = elt_size; p->data_buffer_size = prealloc_size * elt_size; p->Alloc = Alloc; p->Init = Init; p->InitData = InitData; p->Cleanup = Cleanup; p->Free = Free; if (p->Init == NULL) { p->Init = PoolMemset; p->InitData = p; } /* alloc the buckets and place them in the empty list */ uint32_t u32 = 0; if (size > 0) { PoolBucket *pb = SCCalloc(size, sizeof(PoolBucket)); if (unlikely(pb == NULL)) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); goto error; } p->pb_buffer = pb; memset(pb, 0, size * sizeof(PoolBucket)); for (u32 = 0; u32 < size; u32++) { /* populate pool */ pb->next = p->empty_stack; pb->flags |= POOL_BUCKET_PREALLOCATED; p->empty_stack = pb; p->empty_stack_size++; pb++; } } if (size > 0) { p->data_buffer = SCCalloc(prealloc_size, elt_size); /* FIXME better goto */ if (p->data_buffer == NULL) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); goto error; } } /* prealloc the buckets and requeue them to the alloc list */ for (u32 = 0; u32 < prealloc_size; u32++) { if (size == 0) { /* unlimited */ PoolBucket *pb = SCMalloc(sizeof(PoolBucket)); if (unlikely(pb == NULL)) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); goto error; } memset(pb, 0, sizeof(PoolBucket)); if (p->Alloc) { pb->data = p->Alloc(); } else { pb->data = SCMalloc(p->elt_size); } if (pb->data == NULL) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); SCFree(pb); goto error; } if (p->Init(pb->data, p->InitData) != 1) { SCLogError(SC_ERR_POOL_INIT, "init error"); if (p->Cleanup) p->Cleanup(pb->data); if (p->Free) p->Free(pb->data); else SCFree(pb->data); SCFree(pb); goto error; } p->allocated++; pb->next = p->alloc_stack; p->alloc_stack = pb; p->alloc_stack_size++; } else { PoolBucket *pb = p->empty_stack; if (pb == NULL) { SCLogError(SC_ERR_POOL_INIT, "alloc error"); goto error; } pb->data = (char *)p->data_buffer + u32 * elt_size; if (p->Init(pb->data, p->InitData) != 1) { SCLogError(SC_ERR_POOL_INIT, "init error"); if (p->Cleanup) p->Cleanup(pb->data); goto error; } p->empty_stack = pb->next; p->empty_stack_size--; p->allocated++; pb->next = p->alloc_stack; p->alloc_stack = pb; p->alloc_stack_size++; } } return p; error: if (p != NULL) { PoolFree(p); } return NULL; } void PoolFree(Pool *p) { if (p == NULL) return; while (p->alloc_stack != NULL) { PoolBucket *pb = p->alloc_stack; p->alloc_stack = pb->next; if (p->Cleanup) p->Cleanup(pb->data); if (PoolDataPreAllocated(p, pb->data) == 0) { if (p->Free) p->Free(pb->data); else SCFree(pb->data); } pb->data = NULL; if (! pb->flags & POOL_BUCKET_PREALLOCATED) { SCFree(pb); } } while (p->empty_stack != NULL) { PoolBucket *pb = p->empty_stack; p->empty_stack = pb->next; if (pb->data!= NULL) { if (p->Cleanup) p->Cleanup(pb->data); if (PoolDataPreAllocated(p, pb->data) == 0) { if (p->Free) p->Free(pb->data); else SCFree(pb->data); } pb->data = NULL; } if (! pb->flags & POOL_BUCKET_PREALLOCATED) { SCFree(pb); } } if (p->pb_buffer) SCFree(p->pb_buffer); if (p->data_buffer) SCFree(p->data_buffer); SCFree(p); } void PoolPrint(Pool *p) { printf("\n----------- Hash Table Stats ------------\n"); printf("Buckets: %" PRIu32 "\n", p->empty_stack_size + p->alloc_stack_size); printf("-----------------------------------------\n"); } void *PoolGet(Pool *p) { SCEnter(); PoolBucket *pb = p->alloc_stack; if (pb != NULL) { /* pull from the alloc list */ p->alloc_stack = pb->next; p->alloc_stack_size--; /* put in the empty list */ pb->next = p->empty_stack; p->empty_stack = pb; p->empty_stack_size++; } else { if (p->max_buckets == 0 || p->allocated < p->max_buckets) { void *pitem; SCLogDebug("max_buckets %"PRIu32"", p->max_buckets); if (p->Alloc != NULL) { pitem = p->Alloc(); } else { pitem = SCMalloc(p->elt_size); } if (pitem != NULL) { if (p->Init(pitem, p->InitData) != 1) { if (p->Cleanup) p->Cleanup(pitem); if (p->Free != NULL) p->Free(pitem); else SCFree(pitem); SCReturnPtr(NULL, "void"); } p->allocated++; p->outstanding++; if (p->outstanding > p->max_outstanding) p->max_outstanding = p->outstanding; } SCReturnPtr(pitem, "void"); } else { SCReturnPtr(NULL, "void"); } } void *ptr = pb->data; pb->data = NULL; p->outstanding++; if (p->outstanding > p->max_outstanding) p->max_outstanding = p->outstanding; SCReturnPtr(ptr,"void"); } void PoolReturn(Pool *p, void *data) { SCEnter(); PoolBucket *pb = p->empty_stack; SCLogDebug("pb %p", pb); if (pb == NULL) { p->allocated--; p->outstanding--; if (p->Cleanup != NULL) { p->Cleanup(data); } if (PoolDataPreAllocated(p, data) == 0) { if (p->Free) p->Free(data); else SCFree(data); } SCLogDebug("tried to return data %p to the pool %p, but no more " "buckets available. Just freeing the data.", data, p); SCReturn; } /* pull from the alloc list */ p->empty_stack = pb->next; p->empty_stack_size--; /* put in the alloc list */ pb->next = p->alloc_stack; p->alloc_stack = pb; p->alloc_stack_size++; pb->data = data; p->outstanding--; SCReturn; } void PoolPrintSaturation(Pool *p) { SCLogDebug("pool %p is using %"PRIu32" out of %"PRIu32" items (%02.1f%%), max %"PRIu32" (%02.1f%%): pool struct memory %"PRIu64".", p, p->outstanding, p->max_buckets, (float)(p->outstanding/(float)(p->max_buckets))*100, p->max_outstanding, (float)(p->max_outstanding/(float)(p->max_buckets))*100, (uint64_t)(p->max_buckets * sizeof(PoolBucket))); } /* * ONLY TESTS BELOW THIS COMMENT */ void *PoolTestAlloc() { void *ptr = SCMalloc(10); if (unlikely(ptr == NULL)) return NULL; return ptr; } int PoolTestInitArg(void *data, void *allocdata) { size_t len = strlen((char *)allocdata) + 1; char *str = data; if (str != NULL) strlcpy(str,(char *)allocdata,len); return 1; } void PoolTestFree(void *ptr) { return; } #ifdef UNITTESTS static int PoolTestInit01 (void) { Pool *p = PoolInit(10,5,10,PoolTestAlloc,NULL,NULL,PoolTestFree, NULL); if (p == NULL) return 0; PoolFree(p); return 1; } static int PoolTestInit02 (void) { int retval = 0; Pool *p = PoolInit(10,5,10,PoolTestAlloc,NULL,NULL,PoolTestFree, NULL); if (p == NULL) goto end; if (p->alloc_stack == NULL || p->empty_stack == NULL) { printf("list(s) not properly initialized (a:%p e:%p): ", p->alloc_stack, p->empty_stack); retval = 0; goto end; } if (p->Alloc != PoolTestAlloc) { printf("Alloc func ptr %p != %p: ", p->Alloc, PoolTestAlloc); retval = 0; goto end; } if (p->Cleanup != PoolTestFree) { printf("Free func ptr %p != %p: ", p->Cleanup, PoolTestFree); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } static int PoolTestInit03 (void) { int retval = 0; void *data = NULL; Pool *p = PoolInit(10,5,10,PoolTestAlloc,NULL,NULL,PoolTestFree, NULL); if (p == NULL) goto end; data = PoolGet(p); if (data == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (p->alloc_stack_size != 4) { printf("p->alloc_stack_size 4 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } if (p->empty_stack_size != 6) { printf("p->empty_stack_size 6 != %" PRIu32 ": ", p->empty_stack_size); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } static int PoolTestInit04 (void) { int retval = 0; char *str = NULL; Pool *p = PoolInit(10,5,strlen("test") + 1,NULL, PoolTestInitArg,(void *)"test",PoolTestFree, NULL); if (p == NULL) goto end; str = PoolGet(p); if (str == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (strcmp(str, "test") != 0) { printf("Memory not properly initialized: "); retval = 0; goto end; } if (p->alloc_stack_size != 4) { printf("p->alloc_stack_size 4 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } if (p->empty_stack_size != 6) { printf("p->empty_stack_size 6 != %" PRIu32 ": ", p->empty_stack_size); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } static int PoolTestInit05 (void) { int retval = 0; void *data = NULL; Pool *p = PoolInit(10,5,10,PoolTestAlloc,NULL, NULL,PoolTestFree, NULL); if (p == NULL) goto end; data = PoolGet(p); if (data == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (p->alloc_stack_size != 4) { printf("p->alloc_stack_size 4 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } if (p->empty_stack_size != 6) { printf("p->empty_stack_size 6 != %" PRIu32 ": ", p->empty_stack_size); retval = 0; goto end; } PoolReturn(p, data); data = NULL; if (p->alloc_stack_size != 5) { printf("p->alloc_stack_size 5 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } if (p->empty_stack_size != 5) { printf("p->empty_stack_size 5 != %" PRIu32 ": ", p->empty_stack_size); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } static int PoolTestInit06 (void) { int retval = 0; void *data = NULL; void *data2 = NULL; Pool *p = PoolInit(1,0,10,PoolTestAlloc,NULL,NULL,PoolTestFree, NULL); if (p == NULL) goto end; if (p->allocated != 0) { printf("p->allocated 0 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } data = PoolGet(p); if (data == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (p->allocated != 1) { printf("p->allocated 1 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } data2 = PoolGet(p); if (data2 != NULL) { printf("PoolGet returned %p, expected NULL: ", data2); retval = 0; goto end; } PoolReturn(p,data); data = NULL; if (p->allocated != 1) { printf("p->allocated 1 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } if (p->alloc_stack_size != 1) { printf("p->alloc_stack_size 1 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } /** \test pool with unlimited size */ static int PoolTestInit07 (void) { int retval = 0; void *data = NULL; void *data2 = NULL; Pool *p = PoolInit(0,1,10,PoolTestAlloc,NULL,NULL,PoolTestFree, NULL); if (p == NULL) goto end; if (p->max_buckets != 0) { printf("p->max_buckets 0 != %" PRIu32 ": ", p->max_buckets); retval = 0; goto end; } if (p->allocated != 1) { printf("p->allocated 1 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } data = PoolGet(p); if (data == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (p->allocated != 1) { printf("(2) p->allocated 1 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } data2 = PoolGet(p); if (data2 == NULL) { printf("PoolGet returned NULL: "); retval = 0; goto end; } if (p->allocated != 2) { printf("(3) p->allocated 2 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } PoolReturn(p,data); data = NULL; if (p->allocated != 2) { printf("(4) p->allocated 2 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } if (p->alloc_stack_size != 1) { printf("p->alloc_stack_size 1 != %" PRIu32 ": ", p->alloc_stack_size); retval = 0; goto end; } PoolReturn(p,data2); data2 = NULL; if (p->allocated != 1) { printf("(5) p->allocated 1 != %" PRIu32 ": ", p->allocated); retval = 0; goto end; } retval = 1; end: if (p != NULL) PoolFree(p); return retval; } #endif /* UNITTESTS */ void PoolRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("PoolTestInit01", PoolTestInit01); UtRegisterTest("PoolTestInit02", PoolTestInit02); UtRegisterTest("PoolTestInit03", PoolTestInit03); UtRegisterTest("PoolTestInit04", PoolTestInit04); UtRegisterTest("PoolTestInit05", PoolTestInit05); UtRegisterTest("PoolTestInit06", PoolTestInit06); UtRegisterTest("PoolTestInit07", PoolTestInit07); PoolThreadRegisterTests(); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/flow-hash.c0000644000000000000000000005053113051004444013041 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * Flow Hashing functions. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-hash.h" #include "flow-util.h" #include "flow-private.h" #include "flow-manager.h" #include "flow-storage.h" #include "app-layer-parser.h" #include "util-time.h" #include "util-debug.h" #include "util-hash-lookup3.h" #include "conf.h" #include "output.h" #include "output-flow.h" #define FLOW_DEFAULT_FLOW_PRUNE 5 SC_ATOMIC_EXTERN(unsigned int, flow_prune_idx); SC_ATOMIC_EXTERN(unsigned int, flow_flags); static Flow *FlowGetUsedFlow(ThreadVars *tv, DecodeThreadVars *dtv); /** \brief compare two raw ipv6 addrs * * \note we don't care about the real ipv6 ip's, this is just * to consistently fill the FlowHashKey6 struct, without all * the ntohl calls. * * \warning do not use elsewhere unless you know what you're doing. * detect-engine-address-ipv6.c's AddressIPv6GtU32 is likely * what you are looking for. */ static inline int FlowHashRawAddressIPv6GtU32(const uint32_t *a, const uint32_t *b) { int i; for (i = 0; i < 4; i++) { if (a[i] > b[i]) return 1; if (a[i] < b[i]) break; } return 0; } typedef struct FlowHashKey4_ { union { struct { uint32_t src, dst; uint16_t sp, dp; uint16_t proto; /**< u16 so proto and recur add up to u32 */ uint16_t recur; /**< u16 so proto and recur add up to u32 */ uint16_t vlan_id[2]; }; const uint32_t u32[5]; }; } FlowHashKey4; typedef struct FlowHashKey6_ { union { struct { uint32_t src[4], dst[4]; uint16_t sp, dp; uint16_t proto; /**< u16 so proto and recur add up to u32 */ uint16_t recur; /**< u16 so proto and recur add up to u32 */ uint16_t vlan_id[2]; }; const uint32_t u32[11]; }; } FlowHashKey6; /* calculate the hash key for this packet * * we're using: * hash_rand -- set at init time * source port * destination port * source address * destination address * recursion level -- for tunnels, make sure different tunnel layers can * never get mixed up. * * For ICMP we only consider UNREACHABLE errors atm. */ static inline uint32_t FlowGetHash(const Packet *p) { uint32_t hash = 0; if (p->ip4h != NULL) { if (p->tcph != NULL || p->udph != NULL) { FlowHashKey4 fhk; if (p->src.addr_data32[0] > p->dst.addr_data32[0]) { fhk.src = p->src.addr_data32[0]; fhk.dst = p->dst.addr_data32[0]; } else { fhk.src = p->dst.addr_data32[0]; fhk.dst = p->src.addr_data32[0]; } if (p->sp > p->dp) { fhk.sp = p->sp; fhk.dp = p->dp; } else { fhk.sp = p->dp; fhk.dp = p->sp; } fhk.proto = (uint16_t)p->proto; fhk.recur = (uint16_t)p->recursion_level; fhk.vlan_id[0] = p->vlan_id[0]; fhk.vlan_id[1] = p->vlan_id[1]; hash = hashword(fhk.u32, 5, flow_config.hash_rand); } else if (ICMPV4_DEST_UNREACH_IS_VALID(p)) { uint32_t psrc = IPV4_GET_RAW_IPSRC_U32(ICMPV4_GET_EMB_IPV4(p)); uint32_t pdst = IPV4_GET_RAW_IPDST_U32(ICMPV4_GET_EMB_IPV4(p)); FlowHashKey4 fhk; if (psrc > pdst) { fhk.src = psrc; fhk.dst = pdst; } else { fhk.src = pdst; fhk.dst = psrc; } if (p->icmpv4vars.emb_sport > p->icmpv4vars.emb_dport) { fhk.sp = p->icmpv4vars.emb_sport; fhk.dp = p->icmpv4vars.emb_dport; } else { fhk.sp = p->icmpv4vars.emb_dport; fhk.dp = p->icmpv4vars.emb_sport; } fhk.proto = (uint16_t)ICMPV4_GET_EMB_PROTO(p); fhk.recur = (uint16_t)p->recursion_level; fhk.vlan_id[0] = p->vlan_id[0]; fhk.vlan_id[1] = p->vlan_id[1]; hash = hashword(fhk.u32, 5, flow_config.hash_rand); } else { FlowHashKey4 fhk; if (p->src.addr_data32[0] > p->dst.addr_data32[0]) { fhk.src = p->src.addr_data32[0]; fhk.dst = p->dst.addr_data32[0]; } else { fhk.src = p->dst.addr_data32[0]; fhk.dst = p->src.addr_data32[0]; } fhk.sp = 0xfeed; fhk.dp = 0xbeef; fhk.proto = (uint16_t)p->proto; fhk.recur = (uint16_t)p->recursion_level; fhk.vlan_id[0] = p->vlan_id[0]; fhk.vlan_id[1] = p->vlan_id[1]; hash = hashword(fhk.u32, 5, flow_config.hash_rand); } } else if (p->ip6h != NULL) { FlowHashKey6 fhk; if (FlowHashRawAddressIPv6GtU32(p->src.addr_data32, p->dst.addr_data32)) { fhk.src[0] = p->src.addr_data32[0]; fhk.src[1] = p->src.addr_data32[1]; fhk.src[2] = p->src.addr_data32[2]; fhk.src[3] = p->src.addr_data32[3]; fhk.dst[0] = p->dst.addr_data32[0]; fhk.dst[1] = p->dst.addr_data32[1]; fhk.dst[2] = p->dst.addr_data32[2]; fhk.dst[3] = p->dst.addr_data32[3]; } else { fhk.src[0] = p->dst.addr_data32[0]; fhk.src[1] = p->dst.addr_data32[1]; fhk.src[2] = p->dst.addr_data32[2]; fhk.src[3] = p->dst.addr_data32[3]; fhk.dst[0] = p->src.addr_data32[0]; fhk.dst[1] = p->src.addr_data32[1]; fhk.dst[2] = p->src.addr_data32[2]; fhk.dst[3] = p->src.addr_data32[3]; } if (p->sp > p->dp) { fhk.sp = p->sp; fhk.dp = p->dp; } else { fhk.sp = p->dp; fhk.dp = p->sp; } fhk.proto = (uint16_t)p->proto; fhk.recur = (uint16_t)p->recursion_level; fhk.vlan_id[0] = p->vlan_id[0]; fhk.vlan_id[1] = p->vlan_id[1]; hash = hashword(fhk.u32, 11, flow_config.hash_rand); } return hash; } /* Since two or more flows can have the same hash key, we need to compare * the flow with the current flow key. */ #define CMP_FLOW(f1,f2) \ (((CMP_ADDR(&(f1)->src, &(f2)->src) && \ CMP_ADDR(&(f1)->dst, &(f2)->dst) && \ CMP_PORT((f1)->sp, (f2)->sp) && CMP_PORT((f1)->dp, (f2)->dp)) || \ (CMP_ADDR(&(f1)->src, &(f2)->dst) && \ CMP_ADDR(&(f1)->dst, &(f2)->src) && \ CMP_PORT((f1)->sp, (f2)->dp) && CMP_PORT((f1)->dp, (f2)->sp))) && \ (f1)->proto == (f2)->proto && \ (f1)->recursion_level == (f2)->recursion_level && \ (f1)->vlan_id[0] == (f2)->vlan_id[0] && \ (f1)->vlan_id[1] == (f2)->vlan_id[1]) /** * \brief See if a ICMP packet belongs to a flow by comparing the embedded * packet in the ICMP error packet to the flow. * * \param f flow * \param p ICMP packet * * \retval 1 match * \retval 0 no match */ static inline int FlowCompareICMPv4(Flow *f, const Packet *p) { if (ICMPV4_DEST_UNREACH_IS_VALID(p)) { /* first check the direction of the flow, in other words, the client -> * server direction as it's most likely the ICMP error will be a * response to the clients traffic */ if ((f->src.addr_data32[0] == IPV4_GET_RAW_IPSRC_U32( ICMPV4_GET_EMB_IPV4(p) )) && (f->dst.addr_data32[0] == IPV4_GET_RAW_IPDST_U32( ICMPV4_GET_EMB_IPV4(p) )) && f->sp == p->icmpv4vars.emb_sport && f->dp == p->icmpv4vars.emb_dport && f->proto == ICMPV4_GET_EMB_PROTO(p) && f->recursion_level == p->recursion_level && f->vlan_id[0] == p->vlan_id[0] && f->vlan_id[1] == p->vlan_id[1]) { return 1; /* check the less likely case where the ICMP error was a response to * a packet from the server. */ } else if ((f->dst.addr_data32[0] == IPV4_GET_RAW_IPSRC_U32( ICMPV4_GET_EMB_IPV4(p) )) && (f->src.addr_data32[0] == IPV4_GET_RAW_IPDST_U32( ICMPV4_GET_EMB_IPV4(p) )) && f->dp == p->icmpv4vars.emb_sport && f->sp == p->icmpv4vars.emb_dport && f->proto == ICMPV4_GET_EMB_PROTO(p) && f->recursion_level == p->recursion_level && f->vlan_id[0] == p->vlan_id[0] && f->vlan_id[1] == p->vlan_id[1]) { return 1; } /* no match, fall through */ } else { /* just treat ICMP as a normal proto for now */ return CMP_FLOW(f, p); } return 0; } void FlowSetupPacket(Packet *p) { p->flags |= PKT_WANTS_FLOW; p->flow_hash = FlowGetHash(p); } int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, void *tcp_ssn); static inline int FlowCompare(Flow *f, const Packet *p) { if (p->proto == IPPROTO_ICMP) { return FlowCompareICMPv4(f, p); } else if (p->proto == IPPROTO_TCP) { if (CMP_FLOW(f, p) == 0) return 0; /* if this session is 'reused', we don't return it anymore, * so return false on the compare */ if (f->flags & FLOW_TCP_REUSED) return 0; return 1; } else { return CMP_FLOW(f, p); } } /** * \brief Check if we should create a flow based on a packet * * We use this check to filter out flow creation based on: * - ICMP error messages * * \param p packet * \retval 1 true * \retval 0 false */ static inline int FlowCreateCheck(const Packet *p) { if (PKT_IS_ICMPV4(p)) { if (ICMPV4_IS_ERROR_MSG(p)) { return 0; } } return 1; } /** * \brief Get a new flow * * Get a new flow. We're checking memcap first and will try to make room * if the memcap is reached. * * \param tv thread vars * \param dtv decode thread vars (for flow log api thread data) * * \retval f *LOCKED* flow on succes, NULL on error. */ static Flow *FlowGetNew(ThreadVars *tv, DecodeThreadVars *dtv, const Packet *p) { Flow *f = NULL; if (FlowCreateCheck(p) == 0) { return NULL; } /* get a flow from the spare queue */ f = FlowDequeue(&flow_spare_q); if (f == NULL) { /* If we reached the max memcap, we get a used flow */ if (!(FLOW_CHECK_MEMCAP(sizeof(Flow) + FlowStorageSize()))) { /* declare state of emergency */ if (!(SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY)) { SC_ATOMIC_OR(flow_flags, FLOW_EMERGENCY); FlowTimeoutsEmergency(); /* under high load, waking up the flow mgr each time leads * to high cpu usage. Flows are not timed out much faster if * we check a 1000 times a second. */ FlowWakeupFlowManagerThread(); } f = FlowGetUsedFlow(tv, dtv); if (f == NULL) { /* max memcap reached, so increments the counter */ if (tv != NULL && dtv != NULL) { StatsIncr(tv, dtv->counter_flow_memcap); } /* very rare, but we can fail. Just giving up */ return NULL; } /* freed a flow, but it's unlocked */ } else { /* now see if we can alloc a new flow */ f = FlowAlloc(); if (f == NULL) { if (tv != NULL && dtv != NULL) { StatsIncr(tv, dtv->counter_flow_memcap); } return NULL; } /* flow is initialized but *unlocked* */ } } else { /* flow has been recycled before it went into the spare queue */ /* flow is initialized (recylced) but *unlocked* */ } FLOWLOCK_WRLOCK(f); return f; } static Flow *TcpReuseReplace(ThreadVars *tv, DecodeThreadVars *dtv, FlowBucket *fb, Flow *old_f, const uint32_t hash, const Packet *p) { /* tag flow as reused so future lookups won't find it */ old_f->flags |= FLOW_TCP_REUSED; /* get some settings that we move over to the new flow */ FlowThreadId thread_id = old_f->thread_id; /* since fb lock is still held this flow won't be found until we are done */ FLOWLOCK_UNLOCK(old_f); /* Get a new flow. It will be either a locked flow or NULL */ Flow *f = FlowGetNew(tv, dtv, p); if (f == NULL) { return NULL; } /* flow is locked */ /* put at the start of the list */ f->hnext = fb->head; fb->head->hprev = f; fb->head = f; /* initialize and return */ FlowInit(f, p); f->flow_hash = hash; f->fb = fb; f->thread_id = thread_id; return f; } /** \brief Get Flow for packet * * Hash retrieval function for flows. Looks up the hash bucket containing the * flow pointer. Then compares the packet with the found flow to see if it is * the flow we need. If it isn't, walk the list until the right flow is found. * * If the flow is not found or the bucket was emtpy, a new flow is taken from * the queue. FlowDequeue() will alloc new flows as long as we stay within our * memcap limit. * * The p->flow pointer is updated to point to the flow. * * \param tv thread vars * \param dtv decode thread vars (for flow log api thread data) * * \retval f *LOCKED* flow or NULL */ Flow *FlowGetFlowFromHash(ThreadVars *tv, DecodeThreadVars *dtv, const Packet *p, Flow **dest) { Flow *f = NULL; /* get our hash bucket and lock it */ const uint32_t hash = p->flow_hash; FlowBucket *fb = &flow_hash[hash % flow_config.hash_size]; FBLOCK_LOCK(fb); SCLogDebug("fb %p fb->head %p", fb, fb->head); /* see if the bucket already has a flow */ if (fb->head == NULL) { f = FlowGetNew(tv, dtv, p); if (f == NULL) { FBLOCK_UNLOCK(fb); return NULL; } /* flow is locked */ fb->head = f; fb->tail = f; /* got one, now lock, initialize and return */ FlowInit(f, p); f->flow_hash = hash; f->fb = fb; FlowUpdateState(f, FLOW_STATE_NEW); FlowReference(dest, f); FBLOCK_UNLOCK(fb); return f; } /* ok, we have a flow in the bucket. Let's find out if it is our flow */ f = fb->head; /* see if this is the flow we are looking for */ if (FlowCompare(f, p) == 0) { Flow *pf = NULL; /* previous flow */ while (f) { pf = f; f = f->hnext; if (f == NULL) { f = pf->hnext = FlowGetNew(tv, dtv, p); if (f == NULL) { FBLOCK_UNLOCK(fb); return NULL; } fb->tail = f; /* flow is locked */ f->hprev = pf; /* initialize and return */ FlowInit(f, p); f->flow_hash = hash; f->fb = fb; FlowUpdateState(f, FLOW_STATE_NEW); FlowReference(dest, f); FBLOCK_UNLOCK(fb); return f; } if (FlowCompare(f, p) != 0) { /* we found our flow, lets put it on top of the * hash list -- this rewards active flows */ if (f->hnext) { f->hnext->hprev = f->hprev; } if (f->hprev) { f->hprev->hnext = f->hnext; } if (f == fb->tail) { fb->tail = f->hprev; } f->hnext = fb->head; f->hprev = NULL; fb->head->hprev = f; fb->head = f; /* found our flow, lock & return */ FLOWLOCK_WRLOCK(f); if (unlikely(TcpSessionPacketSsnReuse(p, f, f->protoctx) == 1)) { f = TcpReuseReplace(tv, dtv, fb, f, hash, p); if (f == NULL) { FBLOCK_UNLOCK(fb); return NULL; } } FlowReference(dest, f); FBLOCK_UNLOCK(fb); return f; } } } /* lock & return */ FLOWLOCK_WRLOCK(f); if (unlikely(TcpSessionPacketSsnReuse(p, f, f->protoctx) == 1)) { f = TcpReuseReplace(tv, dtv, fb, f, hash, p); if (f == NULL) { FBLOCK_UNLOCK(fb); return NULL; } } FlowReference(dest, f); FBLOCK_UNLOCK(fb); return f; } /** \internal * \brief Get a flow from the hash directly. * * Called in conditions where the spare queue is empty and memcap is reached. * * Walks the hash until a flow can be freed. Timeouts are disregarded, use_cnt * is adhered to. "flow_prune_idx" atomic int makes sure we don't start at the * top each time since that would clear the top of the hash leading to longer * and longer search times under high pressure (observed). * * \param tv thread vars * \param dtv decode thread vars (for flow log api thread data) * * \retval f flow or NULL */ static Flow *FlowGetUsedFlow(ThreadVars *tv, DecodeThreadVars *dtv) { uint32_t idx = SC_ATOMIC_GET(flow_prune_idx) % flow_config.hash_size; uint32_t cnt = flow_config.hash_size; while (cnt--) { if (++idx >= flow_config.hash_size) idx = 0; FlowBucket *fb = &flow_hash[idx]; if (FBLOCK_TRYLOCK(fb) != 0) continue; Flow *f = fb->tail; if (f == NULL) { FBLOCK_UNLOCK(fb); continue; } if (FLOWLOCK_TRYWRLOCK(f) != 0) { FBLOCK_UNLOCK(fb); continue; } /** never prune a flow that is used by a packet or stream msg * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(f->use_cnt) > 0) { FBLOCK_UNLOCK(fb); FLOWLOCK_UNLOCK(f); continue; } /* remove from the hash */ if (f->hprev != NULL) f->hprev->hnext = f->hnext; if (f->hnext != NULL) f->hnext->hprev = f->hprev; if (fb->head == f) fb->head = f->hnext; if (fb->tail == f) fb->tail = f->hprev; f->hnext = NULL; f->hprev = NULL; f->fb = NULL; SC_ATOMIC_SET(fb->next_ts, 0); FBLOCK_UNLOCK(fb); int state = SC_ATOMIC_GET(f->flow_state); if (state == FLOW_STATE_NEW) f->flow_end_flags |= FLOW_END_FLAG_STATE_NEW; else if (state == FLOW_STATE_ESTABLISHED) f->flow_end_flags |= FLOW_END_FLAG_STATE_ESTABLISHED; else if (state == FLOW_STATE_CLOSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_CLOSED; else if (state == FLOW_STATE_CAPTURE_BYPASSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_BYPASSED; else if (state == FLOW_STATE_LOCAL_BYPASSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_BYPASSED; f->flow_end_flags |= FLOW_END_FLAG_FORCED; if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) f->flow_end_flags |= FLOW_END_FLAG_EMERGENCY; /* invoke flow log api */ if (dtv && dtv->output_flow_thread_data) (void)OutputFlowLog(tv, dtv->output_flow_thread_data, f); FlowClearMemory(f, f->protomap); FlowUpdateState(f, FLOW_STATE_NEW); FLOWLOCK_UNLOCK(f); (void) SC_ATOMIC_ADD(flow_prune_idx, (flow_config.hash_size - cnt)); return f; } return NULL; } suricata-3.2.1/src/util-coredump-config.c0000644000000000000000000001627713051004444015216 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eileen Donlon * * Coredump configuration */ #define _FILE_OFFSET_BITS 64 #include "util-coredump-config.h" #include "conf.h" #include /** * \brief Configures the core dump size. * * \retval Returns 1 on success and 0 on failure. * */ int32_t CoredumpLoadConfig (void) { /* get core dump configuration settings for suricata */ char* dump_size_config = NULL; rlim_t max_dump = 0; uint32_t unlimited = 0; size_t rlim_size = sizeof(rlim_t); if (ConfGet ("coredump.max-dump", &dump_size_config) == 0) { SCLogDebug ("core dump size not specified"); return 1; } if (strcasecmp (dump_size_config, "unlimited") == 0) { unlimited = 1; } else { /* disallow negative values */ if (strchr (dump_size_config, '-') != NULL) { SCLogInfo ("Negative value for core dump size; ignored."); return 0; } /* the size of rlim_t is platform dependent */ if (rlim_size > 8) { SCLogInfo ("Unexpected type for rlim_t"); return 0; } errno = 0; if (rlim_size == 8) { max_dump = (rlim_t) strtoull (dump_size_config, NULL, 10); } else if (rlim_size == 4) { max_dump = (rlim_t) strtoul (dump_size_config, NULL, 10); } if ((errno == ERANGE) || (errno != 0 && max_dump == 0)) { SCLogInfo ("Illegal core dump size: %s.", dump_size_config); return 0; } SCLogInfo ("Max dump is %llu", (unsigned long long) max_dump); } #if defined OS_WIN32 /* todo: use the registry to get/set dump configuration */ SCLogInfo("Configuring core dump is not yet supported on Windows."); return 0; #endif #ifdef HAVE_SYS_PRCTL_H /* Linux specific core dump configuration; set dumpable flag if needed */ int dumpable = 0; dumpable = prctl (PR_GET_DUMPABLE, 0, 0, 0, 0); if (dumpable == -1) { SCLogInfo ("Can't get core dump configuration of process."); } else if (unlimited == 1 || max_dump > 0) { /* try to enable core dump for this process */ if (prctl (PR_SET_DUMPABLE, 1, 0, 0, 0) == -1) { SCLogInfo ("Unable to make this process dumpable."); return 0; } else { SCLogDebug ("Process is dumpable."); } } /* don't clear dumpable flag since this will have other effects; * just set dump size to 0 below */ #endif /* Linux specific */ struct rlimit lim; /*existing limit*/ struct rlimit new_lim; /*desired limit*/ /* get the current core dump file configuration */ if (getrlimit (RLIMIT_CORE, &lim) == -1) { SCLogInfo ("Can't read coredump limit for this process."); return 0; } if (unlimited) { /* we want no limit on coredump size */ if (lim.rlim_max == RLIM_INFINITY && lim.rlim_cur == RLIM_INFINITY) { SCLogConfig ("Core dump size is unlimited."); return 1; } else { new_lim.rlim_max = RLIM_INFINITY; new_lim.rlim_cur = RLIM_INFINITY; if (setrlimit (RLIMIT_CORE, &new_lim) == 0) { SCLogConfig ("Core dump size set to unlimited."); return 1; } if (errno == EPERM) { /* couldn't raise the hard limit to unlimited; * try increasing the soft limit to the hard limit instead */ if (lim.rlim_cur < lim.rlim_max) { new_lim.rlim_cur = lim.rlim_max; if (setrlimit (RLIMIT_CORE, & new_lim) == 0) { SCLogInfo ("Could not set core dump size to unlimited; core dump size set to the hard limit."); return 0; } else { SCLogInfo ("Failed to set core dump size to unlimited or to the hard limit."); return 0; } } SCLogInfo ("Could not set core dump size to unlimited; it's set to the hard limit."); return 0; } } } else { /* we want a non-infinite soft limit on coredump size */ new_lim.rlim_cur = max_dump; /* check whether the hard limit needs to be adjusted */ if (lim.rlim_max == RLIM_INFINITY) { /* keep the current value (unlimited) for the hard limit */ new_lim.rlim_max = lim.rlim_max; } #ifdef RLIM_SAVED_MAX else if (lim.rlim_max == RLIM_SAVED_MAX) { /* keep the current value (unknown) for the hard limit */ new_lim.rlim_max = lim.rlim_max; } #endif else if (lim.rlim_max < max_dump) { /* need to raise the hard coredump size limit */ new_lim.rlim_max = max_dump; } else { /* hard limit is ample */ new_lim.rlim_max = lim.rlim_max; } if (setrlimit (RLIMIT_CORE, &new_lim) == 0) { SCLogInfo ("Core dump setting attempted is %llu", (unsigned long long) new_lim.rlim_cur); struct rlimit actual_lim; if (getrlimit (RLIMIT_CORE, &actual_lim) == 0) { if (actual_lim.rlim_cur == RLIM_INFINITY) { SCLogConfig ("Core dump size set to unlimited."); } #ifdef RLIM_SAVED_CUR else if (actual_lim.rlim_cur == RLIM_SAVED_CUR) { SCLogInfo ("Core dump size set to soft limit."); } #endif else { SCLogInfo ("Core dump size set to %llu", (unsigned long long) actual_lim.rlim_cur); } } return 1; } if (errno == EINVAL || errno == EPERM) { /* could't increase the hard limit, or the soft limit exceeded the hard * limit; try to raise the soft limit to the hard limit */ if ((lim.rlim_cur < max_dump && lim.rlim_cur < lim.rlim_max) #ifdef RLIM_SAVED_CUR || (lim.rlim_cur == RLIM_SAVED_CUR) #endif ){ new_lim.rlim_max = lim.rlim_max; new_lim.rlim_cur = lim.rlim_max; if (setrlimit (RLIMIT_CORE, &new_lim) == 0) { SCLogInfo("Core dump size set to the hard limit."); return 0; } } } } /* failed to set the coredump limit */ SCLogInfo ("Could't set coredump size to %s.", dump_size_config); return 0; } suricata-3.2.1/src/detect-engine-analyzer.c0000644000000000000000000011525413051004444015513 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eileen Donlon * * Rule analyzer for the detection engine */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-analyzer.h" #include "detect-engine-mpm.h" #include "conf.h" #include "detect-content.h" #include "detect-flow.h" #include "detect-flags.h" #include "util-print.h" static int rule_warnings_only = 0; static FILE *rule_engine_analysis_FD = NULL; static FILE *fp_engine_analysis_FD = NULL; static pcre *percent_re = NULL; static pcre_extra *percent_re_study = NULL; static char log_path[PATH_MAX]; typedef struct FpPatternStats_ { uint16_t min; uint16_t max; uint32_t cnt; uint64_t tot; } FpPatternStats; static FpPatternStats fp_pattern_stats[DETECT_SM_LIST_MAX]; static void FpPatternStatsAdd(int list, uint16_t patlen) { if (list < 0 || list >= DETECT_SM_LIST_MAX) return; FpPatternStats *f = &fp_pattern_stats[list]; if (f->min == 0) f->min = patlen; else if (patlen < f->min) f->min = patlen; if (patlen > f->max) f->max = patlen; f->cnt++; f->tot += patlen; } void EngineAnalysisFP(Signature *s, char *line) { int fast_pattern_set = 0; int fast_pattern_only_set = 0; int fast_pattern_chop_set = 0; DetectContentData *fp_cd = NULL; SigMatch *mpm_sm = s->mpm_sm; if (mpm_sm != NULL) { fp_cd = (DetectContentData *)mpm_sm->ctx; if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN) { fast_pattern_set = 1; if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { fast_pattern_only_set = 1; } else if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { fast_pattern_chop_set = 1; } } } fprintf(fp_engine_analysis_FD, "== Sid: %u ==\n", s->id); fprintf(fp_engine_analysis_FD, "%s\n", line); fprintf(fp_engine_analysis_FD, " Fast Pattern analysis:\n"); if (s->prefilter_sm != NULL) { fprintf(fp_engine_analysis_FD, " Prefilter on: %s\n", sigmatch_table[s->prefilter_sm->type].name); fprintf(fp_engine_analysis_FD, "\n"); return; } if (fp_cd == NULL) { fprintf(fp_engine_analysis_FD, " No content present\n"); fprintf(fp_engine_analysis_FD, "\n"); return; } fprintf(fp_engine_analysis_FD, " Fast pattern matcher: "); int list_type = SigMatchListSMBelongsTo(s, mpm_sm); if (list_type == DETECT_SM_LIST_PMATCH) fprintf(fp_engine_analysis_FD, "content\n"); else if (list_type == DETECT_SM_LIST_UMATCH) fprintf(fp_engine_analysis_FD, "http uri content\n"); else if (list_type == DETECT_SM_LIST_HRUDMATCH) fprintf(fp_engine_analysis_FD, "http raw uri content\n"); else if (list_type == DETECT_SM_LIST_HHDMATCH) fprintf(fp_engine_analysis_FD, "http header content\n"); else if (list_type == DETECT_SM_LIST_HRHDMATCH) fprintf(fp_engine_analysis_FD, "http raw header content\n"); else if (list_type == DETECT_SM_LIST_HMDMATCH) fprintf(fp_engine_analysis_FD, "http method content\n"); else if (list_type == DETECT_SM_LIST_HCDMATCH) fprintf(fp_engine_analysis_FD, "http cookie content\n"); else if (list_type == DETECT_SM_LIST_HCBDMATCH) fprintf(fp_engine_analysis_FD, "http client body content\n"); else if (list_type == DETECT_SM_LIST_FILEDATA) fprintf(fp_engine_analysis_FD, "http server body content\n"); else if (list_type == DETECT_SM_LIST_HSCDMATCH) fprintf(fp_engine_analysis_FD, "http stat code content\n"); else if (list_type == DETECT_SM_LIST_HSMDMATCH) fprintf(fp_engine_analysis_FD, "http stat msg content\n"); else if (list_type == DETECT_SM_LIST_HUADMATCH) fprintf(fp_engine_analysis_FD, "http user agent content\n"); int flags_set = 0; fprintf(fp_engine_analysis_FD, " Flags:"); if (fp_cd->flags & DETECT_CONTENT_OFFSET) { fprintf(fp_engine_analysis_FD, " Offset"); flags_set = 1; } if (fp_cd->flags & DETECT_CONTENT_DEPTH) { fprintf(fp_engine_analysis_FD, " Depth"); flags_set = 1; } if (fp_cd->flags & DETECT_CONTENT_WITHIN) { fprintf(fp_engine_analysis_FD, " Within"); flags_set = 1; } if (fp_cd->flags & DETECT_CONTENT_DISTANCE) { fprintf(fp_engine_analysis_FD, " Distance"); flags_set = 1; } if (fp_cd->flags & DETECT_CONTENT_NOCASE) { fprintf(fp_engine_analysis_FD, " Nocase"); flags_set = 1; } if (fp_cd->flags & DETECT_CONTENT_NEGATED) { fprintf(fp_engine_analysis_FD, " Negated"); flags_set = 1; } if (flags_set == 0) fprintf(fp_engine_analysis_FD, " None"); fprintf(fp_engine_analysis_FD, "\n"); fprintf(fp_engine_analysis_FD, " Fast pattern set: %s\n", fast_pattern_set ? "yes" : "no"); fprintf(fp_engine_analysis_FD, " Fast pattern only set: %s\n", fast_pattern_only_set ? "yes" : "no"); fprintf(fp_engine_analysis_FD, " Fast pattern chop set: %s\n", fast_pattern_chop_set ? "yes" : "no"); if (fast_pattern_chop_set) { fprintf(fp_engine_analysis_FD, " Fast pattern offset, length: %u, %u\n", fp_cd->fp_chop_offset, fp_cd->fp_chop_len); } uint16_t patlen = fp_cd->content_len; uint8_t *pat = SCMalloc(fp_cd->content_len + 1); if (unlikely(pat == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memcpy(pat, fp_cd->content, fp_cd->content_len); pat[fp_cd->content_len] = '\0'; fprintf(fp_engine_analysis_FD, " Original content: "); PrintRawUriFp(fp_engine_analysis_FD, pat, patlen); fprintf(fp_engine_analysis_FD, "\n"); if (fast_pattern_chop_set) { SCFree(pat); patlen = fp_cd->fp_chop_len; pat = SCMalloc(fp_cd->fp_chop_len + 1); if (unlikely(pat == NULL)) { exit(EXIT_FAILURE); } memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len); pat[fp_cd->fp_chop_len] = '\0'; fprintf(fp_engine_analysis_FD, " Final content: "); PrintRawUriFp(fp_engine_analysis_FD, pat, patlen); fprintf(fp_engine_analysis_FD, "\n"); FpPatternStatsAdd(list_type, patlen); } else { fprintf(fp_engine_analysis_FD, " Final content: "); PrintRawUriFp(fp_engine_analysis_FD, pat, patlen); fprintf(fp_engine_analysis_FD, "\n"); FpPatternStatsAdd(list_type, patlen); } SCFree(pat); fprintf(fp_engine_analysis_FD, "\n"); return; } /** * \brief Sets up the fast pattern analyzer according to the config. * * \retval 1 If rule analyzer successfully enabled. * \retval 0 If not enabled. */ int SetupFPAnalyzer(void) { int fp_engine_analysis_set = 0; if ((ConfGetBool("engine-analysis.rules-fast-pattern", &fp_engine_analysis_set)) == 0) { return 0; } if (fp_engine_analysis_set == 0) return 0; char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, "rules_fast_pattern.txt"); fp_engine_analysis_FD = fopen(log_path, "w"); if (fp_engine_analysis_FD == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", log_path, strerror(errno)); return 0; } SCLogInfo("Engine-Analysis for fast_pattern printed to file - %s", log_path); struct timeval tval; struct tm *tms; gettimeofday(&tval, NULL); struct tm local_tm; tms = SCLocalTime(tval.tv_sec, &local_tm); fprintf(fp_engine_analysis_FD, "----------------------------------------------" "---------------------\n"); fprintf(fp_engine_analysis_FD, "Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d\n", tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min, tms->tm_sec); fprintf(fp_engine_analysis_FD, "----------------------------------------------" "---------------------\n"); memset(&fp_pattern_stats, 0, sizeof(fp_pattern_stats)); return 1; } /** * \brief Sets up the rule analyzer according to the config * \retval 1 if rule analyzer successfully enabled * \retval 0 if not enabled */ int SetupRuleAnalyzer(void) { ConfNode *conf = ConfGetNode("engine-analysis"); int enabled = 0; if (conf != NULL) { const char *value = ConfNodeLookupChildValue(conf, "rules"); if (value && ConfValIsTrue(value)) { enabled = 1; } else if (value && strcasecmp(value, "warnings-only") == 0) { enabled = 1; rule_warnings_only = 1; } if (enabled) { char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, "rules_analysis.txt"); rule_engine_analysis_FD = fopen(log_path, "w"); if (rule_engine_analysis_FD == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", log_path, strerror(errno)); return 0; } SCLogInfo("Engine-Analysis for rules printed to file - %s", log_path); struct timeval tval; struct tm *tms; gettimeofday(&tval, NULL); struct tm local_tm; tms = SCLocalTime(tval.tv_sec, &local_tm); fprintf(rule_engine_analysis_FD, "----------------------------------------------" "---------------------\n"); fprintf(rule_engine_analysis_FD, "Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d\n", tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min, tms->tm_sec); fprintf(rule_engine_analysis_FD, "----------------------------------------------" "---------------------\n"); /*compile regex's for rule analysis*/ if (PerCentEncodingSetup()== 0) { fprintf(rule_engine_analysis_FD, "Error compiling regex; can't check for percent encoding in normalized http content.\n"); } } } else { SCLogInfo("Conf parameter \"engine-analysis.rules\" not found. " "Defaulting to not printing the rules analysis report."); } if (!enabled) { SCLogInfo("Engine-Analysis for rules disabled in conf file."); return 0; } return 1; } void CleanupFPAnalyzer(void) { fprintf(fp_engine_analysis_FD, "============\n" "Summary:\n============\n"); int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { FpPatternStats *f = &fp_pattern_stats[i]; if (f->cnt == 0) continue; fprintf(fp_engine_analysis_FD, "%s, smallest pattern %u byte(s), longest pattern %u byte(s), number of patterns %u, avg pattern len %.2f byte(s)\n", DetectSigmatchListEnumToString(i), f->min, f->max, f->cnt, (float)((double)f->tot/(float)f->cnt)); } if (fp_engine_analysis_FD != NULL) { fclose(fp_engine_analysis_FD); fp_engine_analysis_FD = NULL; } return; } void CleanupRuleAnalyzer(void) { if (rule_engine_analysis_FD != NULL) { SCLogInfo("Engine-Analyis for rules printed to file - %s", log_path); fclose(rule_engine_analysis_FD); rule_engine_analysis_FD = NULL; } } /** * \brief Compiles regex for rule analysis * \retval 1 if successful * \retval 0 if on error */ int PerCentEncodingSetup () { #define DETECT_PERCENT_ENCODING_REGEX "%[0-9|a-f|A-F]{2}" const char *eb = NULL; int eo = 0; int opts = 0; //PCRE_NEWLINE_ANY?? percent_re = pcre_compile(DETECT_PERCENT_ENCODING_REGEX, opts, &eb, &eo, NULL); if (percent_re == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s", DETECT_PERCENT_ENCODING_REGEX, eo, eb); return 0; } percent_re_study = pcre_study(percent_re, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); return 0; } return 1; } /** * \brief Checks for % encoding in content. * \param Pointer to content * \retval number of matches if content has % encoding * \retval 0 if it doesn't have % encoding * \retval -1 on error */ int PerCentEncodingMatch (uint8_t *content, uint8_t content_len) { #define MAX_ENCODED_CHARS 240 int ret = 0; int ov[MAX_ENCODED_CHARS]; ret = pcre_exec(percent_re, percent_re_study, (char *)content, content_len, 0, 0, ov, MAX_ENCODED_CHARS); if (ret == -1) { return 0; } else if (ret < -1) { SCLogError(SC_ERR_PCRE_MATCH, "Error parsing content - %s; error code is %d", content, ret); return -1; } return ret; } static void EngineAnalysisRulesPrintFP(const Signature *s) { DetectContentData *fp_cd = NULL; SigMatch *mpm_sm = s->mpm_sm; if (mpm_sm != NULL) { fp_cd = (DetectContentData *)mpm_sm->ctx; } if (fp_cd == NULL) { return; } uint16_t patlen = fp_cd->content_len; uint8_t *pat = SCMalloc(fp_cd->content_len + 1); if (unlikely(pat == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memcpy(pat, fp_cd->content, fp_cd->content_len); pat[fp_cd->content_len] = '\0'; if (fp_cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { SCFree(pat); patlen = fp_cd->fp_chop_len; pat = SCMalloc(fp_cd->fp_chop_len + 1); if (unlikely(pat == NULL)) { exit(EXIT_FAILURE); } memcpy(pat, fp_cd->content + fp_cd->fp_chop_offset, fp_cd->fp_chop_len); pat[fp_cd->fp_chop_len] = '\0'; fprintf(rule_engine_analysis_FD, " Fast Pattern \""); PrintRawUriFp(rule_engine_analysis_FD, pat, patlen); } else { fprintf(rule_engine_analysis_FD, " Fast Pattern \""); PrintRawUriFp(rule_engine_analysis_FD, pat, patlen); } SCFree(pat); fprintf(rule_engine_analysis_FD, "\" on \""); int list_type = SigMatchListSMBelongsTo(s, mpm_sm); if (list_type == DETECT_SM_LIST_PMATCH) { int payload = 0; int stream = 0; if (SignatureHasPacketContent(s)) payload = 1; if (SignatureHasStreamContent(s)) stream = 1; fprintf(rule_engine_analysis_FD, "%s", payload ? (stream ? "payload and reassembled stream" : "payload") : "reassembled stream"); } else if (list_type == DETECT_SM_LIST_UMATCH) fprintf(rule_engine_analysis_FD, "http uri content"); else if (list_type == DETECT_SM_LIST_HRUDMATCH) fprintf(rule_engine_analysis_FD, "http raw uri content"); else if (list_type == DETECT_SM_LIST_HHDMATCH) fprintf(rule_engine_analysis_FD, "http header content"); else if (list_type == DETECT_SM_LIST_HRHDMATCH) fprintf(rule_engine_analysis_FD, "http raw header content"); else if (list_type == DETECT_SM_LIST_HMDMATCH) fprintf(rule_engine_analysis_FD, "http method content"); else if (list_type == DETECT_SM_LIST_HCDMATCH) fprintf(rule_engine_analysis_FD, "http cookie content"); else if (list_type == DETECT_SM_LIST_HCBDMATCH) fprintf(rule_engine_analysis_FD, "http client body content"); else if (list_type == DETECT_SM_LIST_FILEDATA) fprintf(rule_engine_analysis_FD, "http server body content"); else if (list_type == DETECT_SM_LIST_HSCDMATCH) fprintf(rule_engine_analysis_FD, "http stat code content"); else if (list_type == DETECT_SM_LIST_HSMDMATCH) fprintf(rule_engine_analysis_FD, "http stat msg content"); else if (list_type == DETECT_SM_LIST_HUADMATCH) fprintf(rule_engine_analysis_FD, "http user agent content"); else if (list_type == DETECT_SM_LIST_DNSQUERYNAME_MATCH) fprintf(rule_engine_analysis_FD, "dns query name content"); else if (list_type == DETECT_SM_LIST_TLSSNI_MATCH) fprintf(rule_engine_analysis_FD, "tls sni extension content"); else if (list_type == DETECT_SM_LIST_TLSISSUER_MATCH) fprintf(rule_engine_analysis_FD, "tls issuer content"); else if (list_type == DETECT_SM_LIST_TLSSUBJECT_MATCH) fprintf(rule_engine_analysis_FD, "tls subject content"); else if (list_type == DETECT_SM_LIST_DNP3_DATA_MATCH) fprintf(rule_engine_analysis_FD, "dnp3 data content"); fprintf(rule_engine_analysis_FD, "\" buffer.\n"); return; } void EngineAnalysisRulesFailure(char *line, char *file, int lineno) { fprintf(rule_engine_analysis_FD, "== Sid: UNKNOWN ==\n"); fprintf(rule_engine_analysis_FD, "%s\n", line); fprintf(rule_engine_analysis_FD, " FAILURE: invalid rule.\n"); fprintf(rule_engine_analysis_FD, " File: %s.\n", file); fprintf(rule_engine_analysis_FD, " Line: %d.\n", lineno); fprintf(rule_engine_analysis_FD, "\n"); } /** * \brief Prints analysis of loaded rules. * * Warns if potential rule issues are detected. For example, * warns if a rule uses a construct that may perform poorly, * e.g. pcre without content or with http_method content only; * warns if a rule uses a construct that may not be consistent with intent, * e.g. client side ports only, http and content without any http_* modifiers, etc. * * \param s Pointer to the signature. */ void EngineAnalysisRules(const Signature *s, const char *line) { uint32_t rule_bidirectional = 0; uint32_t rule_pcre = 0; uint32_t rule_pcre_http = 0; uint32_t rule_content = 0; uint32_t rule_flow = 0; uint32_t rule_flags = 0; uint32_t rule_flow_toserver = 0; uint32_t rule_flow_toclient = 0; uint32_t rule_flow_nostream = 0; uint32_t rule_ipv4_only = 0; uint32_t rule_ipv6_only = 0; uint32_t rule_flowbits = 0; uint32_t rule_flowint = 0; //uint32_t rule_flowvar = 0; uint32_t rule_content_http = 0; uint32_t rule_content_offset_depth = 0; uint32_t list_id = 0; uint32_t rule_warning = 0; uint32_t raw_http_buf = 0; uint32_t norm_http_buf = 0; uint32_t stream_buf = 0; uint32_t packet_buf = 0; uint32_t http_header_buf = 0; uint32_t http_uri_buf = 0; uint32_t http_method_buf = 0; uint32_t http_cookie_buf = 0; uint32_t http_client_body_buf = 0; uint32_t http_server_body_buf = 0; uint32_t http_stat_code_buf = 0; uint32_t http_stat_msg_buf = 0; uint32_t http_raw_header_buf = 0; uint32_t http_raw_uri_buf = 0; uint32_t http_ua_buf = 0; uint32_t warn_pcre_no_content = 0; uint32_t warn_pcre_http_content = 0; uint32_t warn_pcre_http = 0; uint32_t warn_content_http_content = 0; uint32_t warn_content_http = 0; uint32_t warn_tcp_no_flow = 0; uint32_t warn_client_ports = 0; uint32_t warn_direction = 0; uint32_t warn_method_toclient = 0; uint32_t warn_method_serverbody = 0; uint32_t warn_pcre_method = 0; uint32_t warn_encoding_norm_http_buf = 0; uint32_t warn_offset_depth_pkt_stream = 0; uint32_t warn_offset_depth_alproto = 0; uint32_t warn_non_alproto_fp_for_alproto_sig = 0; uint32_t warn_no_direction = 0; uint32_t warn_both_direction = 0; if (s->init_flags & SIG_FLAG_INIT_BIDIREC) { rule_bidirectional = 1; } if (s->flags & SIG_FLAG_REQUIRE_PACKET) { packet_buf += 1; } if (s->flags & SIG_FLAG_REQUIRE_STREAM) { stream_buf += 1; } if (s->proto.flags & DETECT_PROTO_IPV4) { rule_ipv4_only += 1; } if (s->proto.flags & DETECT_PROTO_IPV6) { rule_ipv6_only += 1; } for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) { SigMatch *sm = NULL; for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_PCRE) { if (list_id == DETECT_SM_LIST_HCBDMATCH) { rule_pcre_http += 1; http_client_body_buf += 1; raw_http_buf += 1; } else if (list_id == DETECT_SM_LIST_UMATCH) { rule_pcre_http += 1; norm_http_buf += 1; http_uri_buf += 1; } else if (list_id == DETECT_SM_LIST_HHDMATCH) { rule_pcre_http += 1; norm_http_buf += 1; http_header_buf += 1; } else if (list_id == DETECT_SM_LIST_HCDMATCH) { rule_pcre_http += 1; norm_http_buf += 1; http_cookie_buf += 1; } else if (list_id == DETECT_SM_LIST_FILEDATA) { rule_pcre_http += 1; http_server_body_buf += 1; raw_http_buf += 1; } else if (list_id == DETECT_SM_LIST_HRHDMATCH) { rule_pcre_http += 1; raw_http_buf += 1; http_raw_header_buf += 1; } else if (list_id == DETECT_SM_LIST_HMDMATCH) { rule_pcre_http += 1; raw_http_buf += 1; http_method_buf += 1; } else if (list_id == DETECT_SM_LIST_HRUDMATCH) { rule_pcre_http += 1; raw_http_buf += 1; http_raw_uri_buf += 1; } else if (list_id == DETECT_SM_LIST_HSMDMATCH) { rule_pcre_http += 1; raw_http_buf += 1; http_stat_msg_buf += 1; } else if (list_id == DETECT_SM_LIST_HSCDMATCH) { rule_pcre_http += 1; raw_http_buf += 1; http_stat_code_buf += 1; } else if (list_id == DETECT_SM_LIST_HUADMATCH) { rule_pcre_http += 1; norm_http_buf += 1; http_ua_buf += 1; } else { rule_pcre += 1; } } else if (sm->type == DETECT_CONTENT) { if (list_id == DETECT_SM_LIST_UMATCH || list_id == DETECT_SM_LIST_HHDMATCH || list_id == DETECT_SM_LIST_HCDMATCH) { rule_content_http += 1; norm_http_buf += 1; DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd != NULL && PerCentEncodingMatch(cd->content, cd->content_len) > 0) { warn_encoding_norm_http_buf += 1; rule_warning += 1; } if (list_id == DETECT_SM_LIST_UMATCH) { http_uri_buf += 1; } else if (list_id == DETECT_SM_LIST_HHDMATCH) { http_header_buf += 1; } else if (list_id == DETECT_SM_LIST_HCDMATCH) { http_cookie_buf += 1; } } else if (list_id == DETECT_SM_LIST_HCBDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_client_body_buf += 1; } else if (list_id == DETECT_SM_LIST_FILEDATA) { rule_content_http += 1; raw_http_buf += 1; http_server_body_buf += 1; } else if (list_id == DETECT_SM_LIST_HRHDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_raw_header_buf += 1; } else if (list_id == DETECT_SM_LIST_HRUDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_raw_uri_buf += 1; } else if (list_id == DETECT_SM_LIST_HSMDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_stat_msg_buf += 1; } else if (list_id == DETECT_SM_LIST_HSCDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_stat_code_buf += 1; } else if (list_id == DETECT_SM_LIST_HMDMATCH) { rule_content_http += 1; raw_http_buf += 1; http_method_buf += 1; } else if (list_id == DETECT_SM_LIST_PMATCH) { rule_content += 1; DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd->flags & (DETECT_CONTENT_OFFSET | DETECT_CONTENT_DEPTH)) { rule_content_offset_depth++; } } } else if (sm->type == DETECT_FLOW) { rule_flow += 1; if ((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) { rule_flow_toserver = 1; } else if ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_TOSERVER)) { rule_flow_toclient = 1; } DetectFlowData *fd = (DetectFlowData *)sm->ctx; if (fd != NULL) { if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) rule_flow_nostream = 1; } } else if (sm->type == DETECT_FLOWBITS) { if (list_id == DETECT_SM_LIST_MATCH) { rule_flowbits += 1; } } else if (sm->type == DETECT_FLOWINT) { if (list_id == DETECT_SM_LIST_MATCH) { rule_flowint += 1; } } else if (sm->type == DETECT_FLAGS) { DetectFlagsData *fd = (DetectFlagsData *)sm->ctx; if (fd != NULL) { rule_flags = 1; } } } /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */ } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */ if (rule_pcre > 0 && rule_content == 0 && rule_content_http == 0) { rule_warning += 1; warn_pcre_no_content = 1; } if (rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0) { rule_warning += 1; warn_pcre_http_content = 1; } else if (s->alproto == ALPROTO_HTTP && rule_pcre > 0 && rule_pcre_http == 0) { rule_warning += 1; warn_pcre_http = 1; } if (rule_content > 0 && rule_content_http > 0) { rule_warning += 1; warn_content_http_content = 1; } if (s->alproto == ALPROTO_HTTP && rule_content > 0 && rule_content_http == 0) { rule_warning += 1; warn_content_http = 1; } if (rule_content == 1) { //todo: warning if content is weak, separate warning for pcre + weak content } if (rule_flow == 0 && rule_flags == 0 && !(s->proto.flags & DETECT_PROTO_ANY) && DetectProtoContainsProto(&s->proto, IPPROTO_TCP) && (rule_content || rule_content_http || rule_pcre || rule_pcre_http || rule_flowbits)) { rule_warning += 1; warn_tcp_no_flow = 1; } if (rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient) && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))) { if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY)) || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))) { rule_warning += 1; warn_client_ports = 1; } } if (rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)) { rule_warning += 1; warn_direction = 1; } if (http_method_buf) { if (rule_flow && rule_flow_toclient) { rule_warning += 1; warn_method_toclient = 1; } if (http_server_body_buf) { rule_warning += 1; warn_method_serverbody = 1; } if (rule_content == 0 && rule_content_http == 0 && (rule_pcre > 0 || rule_pcre_http > 0)) { rule_warning += 1; warn_pcre_method = 1; } } if (rule_content_offset_depth > 0 && stream_buf && packet_buf) { rule_warning += 1; warn_offset_depth_pkt_stream = 1; } if (rule_content_offset_depth > 0 && !stream_buf && packet_buf && s->alproto != ALPROTO_UNKNOWN) { rule_warning += 1; warn_offset_depth_alproto = 1; } if (s->mpm_sm != NULL && s->alproto == ALPROTO_HTTP && SigMatchListSMBelongsTo(s, s->mpm_sm) == DETECT_SM_LIST_PMATCH) { rule_warning += 1; warn_non_alproto_fp_for_alproto_sig = 1; } if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == 0) { warn_no_direction += 1; rule_warning += 1; } if ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) { warn_both_direction += 1; rule_warning += 1; } if (!rule_warnings_only || (rule_warnings_only && rule_warning > 0)) { fprintf(rule_engine_analysis_FD, "== Sid: %u ==\n", s->id); fprintf(rule_engine_analysis_FD, "%s\n", line); if (s->flags & SIG_FLAG_IPONLY) fprintf(rule_engine_analysis_FD, " Rule is ip only.\n"); if (s->flags & SIG_FLAG_PDONLY) fprintf(rule_engine_analysis_FD, " Rule is PD only.\n"); if (rule_ipv6_only) fprintf(rule_engine_analysis_FD, " Rule is IPv6 only.\n"); if (rule_ipv4_only) fprintf(rule_engine_analysis_FD, " Rule is IPv4 only.\n"); if (packet_buf) fprintf(rule_engine_analysis_FD, " Rule matches on packets.\n"); if (!rule_flow_nostream && stream_buf && (rule_flow || rule_flowbits || rule_content || rule_pcre)) { fprintf(rule_engine_analysis_FD, " Rule matches on reassembled stream.\n"); } if (http_uri_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http uri buffer.\n"); if (http_header_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http header buffer.\n"); if (http_cookie_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http cookie buffer.\n"); if (http_raw_uri_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http raw uri buffer.\n"); if (http_raw_header_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http raw header buffer.\n"); if (http_method_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http method buffer.\n"); if (http_server_body_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http server body buffer.\n"); if (http_client_body_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http client body buffer.\n"); if (http_stat_msg_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http stat msg buffer.\n"); if (http_stat_code_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http stat code buffer.\n"); if (http_ua_buf) fprintf(rule_engine_analysis_FD, " Rule matches on http user agent buffer.\n"); if (s->alproto != ALPROTO_UNKNOWN) { fprintf(rule_engine_analysis_FD, " App layer protocol is %s.\n", AppProtoToString(s->alproto)); } if (rule_content || rule_content_http || rule_pcre || rule_pcre_http) { fprintf(rule_engine_analysis_FD, " Rule contains %d content options, %d http content options, %d pcre options, and %d pcre options with http modifiers.\n", rule_content, rule_content_http, rule_pcre, rule_pcre_http); } /* print fast pattern info */ if (s->prefilter_sm) { fprintf(rule_engine_analysis_FD, " Prefilter on: %s.\n", sigmatch_table[s->prefilter_sm->type].name); } else { EngineAnalysisRulesPrintFP(s); } /* this is where the warnings start */ if (warn_pcre_no_content /*rule_pcre > 0 && rule_content == 0 && rule_content_http == 0*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses pcre without a content option present.\n" " -Consider adding a content to improve performance of this rule.\n"); } if (warn_pcre_http_content /*rule_content_http > 0 && rule_pcre > 0 && rule_pcre_http == 0*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses content options with http_* and pcre options without http modifiers.\n" " -Consider adding http pcre modifier.\n"); } else if (warn_pcre_http /*s->alproto == ALPROTO_HTTP && rule_pcre > 0 && rule_pcre_http == 0*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule app layer protocol is http, but pcre options do not have http modifiers.\n" " -Consider adding http pcre modifiers.\n"); } if (warn_content_http_content /*rule_content > 0 && rule_content_http > 0*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule contains content with http_* and content without http_*.\n" " -Consider adding http content modifiers.\n"); } if (warn_content_http /*s->alproto == ALPROTO_HTTP && rule_content > 0 && rule_content_http == 0*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule app layer protocol is http, but content options do not have http_* modifiers.\n" " -Consider adding http content modifiers.\n"); } if (rule_content == 1) { //todo: warning if content is weak, separate warning for pcre + weak content } if (warn_encoding_norm_http_buf) { fprintf(rule_engine_analysis_FD, " Warning: Rule may contain percent encoded content for a normalized http buffer match.\n"); } if (warn_tcp_no_flow /*rule_flow == 0 && rule_flow == 0 && !(s->proto.flags & DETECT_PROTO_ANY) && DetectProtoContainsProto(&s->proto, IPPROTO_TCP)*/) { fprintf(rule_engine_analysis_FD, " Warning: TCP rule without a flow or flags option.\n" " -Consider adding flow or flags to improve performance of this rule.\n"); } if (warn_client_ports /*rule_flow && !rule_bidirectional && (rule_flow_toserver || rule_flow_toclient) && !((s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY))) if (((s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_SP_ANY) && (s->flags & SIG_FLAG_DP_ANY)) || ((s->flags & SIG_FLAG_TOCLIENT) && !(s->flags & SIG_FLAG_DP_ANY) && (s->flags & SIG_FLAG_SP_ANY))*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule contains ports or port variables only on the client side.\n" " -Flow direction possibly inconsistent with rule.\n"); } if (warn_direction /*rule_flow && rule_bidirectional && (rule_flow_toserver || rule_flow_toclient)*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule is bidirectional and has a flow option with a specific direction.\n"); } if (warn_method_toclient /*http_method_buf && rule_flow && rule_flow_toclient*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses content or pcre for http_method with flow:to_client or from_server\n"); } if (warn_method_serverbody /*http_method_buf && http_server_body_buf*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses content or pcre for http_method with content or pcre for http_server_body.\n"); } if (warn_pcre_method /*http_method_buf && rule_content == 0 && rule_content_http == 0 && (rule_pcre > 0 || rule_pcre_http > 0)*/) { fprintf(rule_engine_analysis_FD, " Warning: Rule uses pcre with only a http_method content; possible performance issue.\n"); } if (warn_offset_depth_pkt_stream) { fprintf(rule_engine_analysis_FD, " Warning: Rule has depth" "/offset with raw content keywords. Please note the " "offset/depth will be checked against both packet " "payloads and stream. If you meant to have the offset/" "depth checked against just the payload, you can update " "the signature as \"alert tcp-pkt...\"\n"); } if (warn_offset_depth_alproto) { fprintf(rule_engine_analysis_FD, " Warning: Rule has " "offset/depth set along with a match on a specific " "app layer protocol - %d. This can lead to FNs if we " "have a offset/depth content match on a packet payload " "before we can detect the app layer protocol for the " "flow.\n", s->alproto); } if (warn_non_alproto_fp_for_alproto_sig) { fprintf(rule_engine_analysis_FD, " Warning: Rule app layer " "protocol is http, but the fast_pattern is set on the raw " "stream. Consider adding fast_pattern over a http " "buffer for increased performance."); } if (warn_no_direction) { fprintf(rule_engine_analysis_FD, " Warning: Rule has no direction indicator.\n"); } if (warn_both_direction) { fprintf(rule_engine_analysis_FD, " Warning: Rule is inspecting both directions.\n"); } if (rule_warning == 0) { fprintf(rule_engine_analysis_FD, " No warnings for this rule.\n"); } fprintf(rule_engine_analysis_FD, "\n"); } return; } suricata-3.2.1/src/runmode-ipfw.h0000644000000000000000000000177113051004444013574 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_IPFW_H__ #define __RUNMODE_IPFW_H__ int RunModeIpsIPFWAutoFp(void); int RunModeIpsIPFWWorker(void); void RunModeIpsIPFWRegister(void); const char *RunModeIpsIPFWGetDefaultMode(void); #endif /* __RUNMODE_IPFW_H__ */ suricata-3.2.1/src/app-layer-parser.h0000644000000000000000000002616413051004444014347 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __APP_LAYER_PARSER_H__ #define __APP_LAYER_PARSER_H__ #include "app-layer-events.h" #include "detect-engine-state.h" #include "util-file.h" #include "stream-tcp-private.h" #define APP_LAYER_PARSER_EOF 0x01 #define APP_LAYER_PARSER_NO_INSPECTION 0x02 #define APP_LAYER_PARSER_NO_REASSEMBLY 0x04 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD 0x08 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto); /***** transaction handling *****/ /** \brief Function ptr type for getting active TxId from a flow * Used by AppLayerTransactionGetActive. */ typedef uint64_t (*GetActiveTxIdFunc)(Flow *f, uint8_t flags); /** \brief Register GetActiveTxId Function * */ void RegisterAppLayerGetActiveTxIdFunc(GetActiveTxIdFunc FuncPtr); /** \brief active TX retrieval for normal ops: so with detection and logging * * \retval tx_id lowest tx_id that still needs work * * This is the default function. */ uint64_t AppLayerTransactionGetActiveDetectLog(Flow *f, uint8_t flags); /** \brief active TX retrieval for logging only ops * * \retval tx_id lowest tx_id that still needs work */ uint64_t AppLayerTransactionGetActiveLogOnly(Flow *f, uint8_t flags); int AppLayerParserSetup(void); int AppLayerParserDeSetup(void); typedef struct AppLayerParserThreadCtx_ AppLayerParserThreadCtx; /** * \brief Gets a new app layer protocol's parser thread context. * * \retval Non-NULL pointer on success. * NULL pointer on failure. */ AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void); /** * \brief Destroys the app layer parser thread context obtained * using AppLayerParserThreadCtxAlloc(). * * \param tctx Pointer to the thread context to be destroyed. */ void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx); /** * \brief Given a protocol name, checks if the parser is enabled in * the conf file. * * \param alproto_name Name of the app layer protocol. * * \retval 1 If enabled. * \retval 0 If disabled. */ int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name); /***** Parser related registration *****/ /** * \brief Register app layer parser for the protocol. * * \retval 0 On success. * \retval -1 On failure. */ int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, int (*Parser)(Flow *f, void *protocol_state, AppLayerParserState *pstate, uint8_t *buf, uint32_t buf_len, void *local_storage)); void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction); void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void (*StateFree)(void *)); void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void (*LocalStorageFree)(void *)); void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t)); void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t)); void AppLayerParserRegisterHasEventsFunc(uint8_t ipproto, AppProto alproto, int (*StateHasEvents)(void *)); void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, int (*StateGetTxLogged)(void *, void *, uint32_t), void (*StateSetTxLogged)(void *, void *, uint32_t)); void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto); void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void (*Truncate)(void *, uint8_t)); void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int (*StateGetStateProgress)(void *alstate, uint8_t direction)); void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void (*StateTransactionFree)(void *, uint64_t)); void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t (*StateGetTxCnt)(void *alstate)); void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id)); void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int (*StateGetStateProgressCompletionStatus)(uint8_t direction)); void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int (*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type)); void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, int (*StateHasTxDetectState)(void *alstate), DetectEngineState *(*GetTxDetectState)(void *tx), int (*SetTxDetectState)(void *alstate, void *tx, DetectEngineState *)); void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t (*GetStreamDepth)(void)); /***** Get and transaction functions *****/ void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto); void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data); uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate); void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id); void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, uint32_t logger); int AppLayerParserGetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, uint32_t logger); uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction); void AppLayerParserSetTransactionInspectId(AppLayerParserState *pstate, const uint8_t ipproto, const AppProto alproto, void *alstate, const uint8_t flags); AppLayerDecoderEvents *AppLayerParserGetDecoderEvents(AppLayerParserState *pstate); void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents); AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id); uint16_t AppLayerParserGetStateVersion(AppLayerParserState *pstate); FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction); int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction); uint64_t AppLayerParserGetTxCnt(uint8_t ipproto, AppProto alproto, void *alstate); void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id); int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction); int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type); uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto, AppLayerParserState *pstate, uint8_t direction); uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto); int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto); int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto); int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate); DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx); int AppLayerParserSetTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, DetectEngineState *s); /***** General *****/ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len); void AppLayerParserSetEOF(AppLayerParserState *pstate); int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate, uint8_t flags); int AppLayerParserIsTxAware(AppProto alproto); int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); void AppLayerParserTriggerRawStreamReassembly(Flow *f); void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); uint32_t AppLayerParserGetStreamDepth(uint8_t ipproto, AppProto alproto); /***** Cleanup *****/ void AppLayerParserStateCleanup(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate); void AppLayerParserRegisterProtocolParsers(void); void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag); int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag); void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction); AppLayerParserState *AppLayerParserStateAlloc(void); void AppLayerParserStateFree(AppLayerParserState *pstate); #ifdef DEBUG void AppLayerParserStatePrintDetails(AppLayerParserState *pstate); #endif #ifdef AFLFUZZ_APPLAYER int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename); int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename); #endif /***** Unittests *****/ #ifdef UNITTESTS void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void (*RegisterUnittests)(void)); void AppLayerParserRegisterUnittests(void); void AppLayerParserBackupParserTable(void); void AppLayerParserRestoreParserTable(void); #endif #endif /* __APP_LAYER_PARSER_H__ */ suricata-3.2.1/src/detect-tag.c0000644000000000000000000003313413051004444013172 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-tag.c * * \author Pablo Rincon * \author Victor Julien * * Implements the tag keyword * */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-tag.h" #include "detect-engine-tag.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "app-layer-parser.h" #include "debug.h" #include "decode.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "stream-tcp-private.h" #include "util-time.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "threads.h" SC_ATOMIC_EXTERN(unsigned int, num_tags); /* format: tag: , , , [direction]; */ #define PARSE_REGEX "^\\s*(host|session)\\s*(,\\s*(\\d+)\\s*,\\s*(packets|bytes|seconds)\\s*(,\\s*(src|dst))?\\s*)?$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectTagMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectTagSetup(DetectEngineCtx *, Signature *, char *); void DetectTagRegisterTests(void); void DetectTagDataFree(void *); /** * \brief Registration function for keyword tag */ void DetectTagRegister(void) { sigmatch_table[DETECT_TAG].name = "tag"; sigmatch_table[DETECT_TAG].Match = DetectTagMatch; sigmatch_table[DETECT_TAG].Setup = DetectTagSetup; sigmatch_table[DETECT_TAG].Free = DetectTagDataFree; sigmatch_table[DETECT_TAG].RegisterTests = DetectTagRegisterTests; sigmatch_table[DETECT_TAG].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to setup a tag for session/host * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTagData * * \retval 0 no match * \retval 1 match */ int DetectTagMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectTagData *td = (const DetectTagData *)ctx; DetectTagDataEntry tde; memset(&tde, 0, sizeof(DetectTagDataEntry)); switch (td->type) { case DETECT_TAG_TYPE_HOST: #ifdef DEBUG BUG_ON(!(td->direction == DETECT_TAG_DIR_SRC || td->direction == DETECT_TAG_DIR_DST)); #endif tde.sid = s->id; tde.gid = s->gid; tde.last_ts = tde.first_ts = p->ts.tv_sec; tde.metric = td->metric; tde.count = td->count; if (td->direction == DETECT_TAG_DIR_SRC) tde.flags |= TAG_ENTRY_FLAG_DIR_SRC; else if (td->direction == DETECT_TAG_DIR_DST) tde.flags |= TAG_ENTRY_FLAG_DIR_DST; SCLogDebug("Tagging Host with sid %"PRIu32":%"PRIu32"", s->id, s->gid); TagHashAddTag(&tde, p); break; case DETECT_TAG_TYPE_SESSION: if (p->flow != NULL) { SCLogDebug("Setting up tag for flow"); /* If it already exists it will be updated */ tde.sid = s->id; tde.gid = s->gid; tde.last_ts = tde.first_ts = p->ts.tv_sec; tde.metric = td->metric; tde.count = td->count; SCLogDebug("Adding to or updating flow; first_ts %u count %u", tde.first_ts, tde.count); TagFlowAdd(p, &tde); } else { SCLogDebug("No flow to append the session tag"); } break; #ifdef DEBUG default: SCLogDebug("unknown type of a tag keyword (not session nor host)"); BUG_ON(1); break; #endif } return 1; } /** * \brief This function is used to parse tag options passed to tag keyword * * \param tagstr Pointer to the user provided tag options * * \retval td pointer to DetectTagData on success * \retval NULL on failure */ DetectTagData *DetectTagParse(char *tagstr) { DetectTagData td; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; ret = pcre_exec(parse_regex, parse_regex_study, tagstr, strlen(tagstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 ", string %s", ret, tagstr); goto error; } res = pcre_get_substring((char *)tagstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* Type */ if (strcasecmp("session", str_ptr) == 0) { td.type = DETECT_TAG_TYPE_SESSION; } else if (strcasecmp("host", str_ptr) == 0) { td.type = DETECT_TAG_TYPE_HOST; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid argument type. Must be session or host (%s)", tagstr); goto error; } pcre_free_substring(str_ptr); str_ptr = NULL; /* default tag is 256 packets from session or dst host */ td.count = DETECT_TAG_MAX_PKTS; td.metric = DETECT_TAG_METRIC_PACKET; td.direction = DETECT_TAG_DIR_DST; if (ret > 4) { res = pcre_get_substring((char *)tagstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* count */ if (ByteExtractStringUint32(&td.count, 10, strlen(str_ptr), str_ptr) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Invalid argument for count. Must be a value in the range of 0 to %"PRIu32" (%s)", UINT32_MAX, tagstr); goto error; } pcre_free_substring(str_ptr); str_ptr = NULL; res = pcre_get_substring((char *)tagstr, ov, MAX_SUBSTRINGS, 4, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* metric */ if (strcasecmp("packets", str_ptr) == 0) { td.metric = DETECT_TAG_METRIC_PACKET; if (DETECT_TAG_MAX_PKTS > 0 && td.count > DETECT_TAG_MAX_PKTS) td.count = DETECT_TAG_MAX_PKTS; /* TODO: load DETECT_TAG_MAX_PKTS from config */ } else if (strcasecmp("seconds", str_ptr) == 0) { td.metric = DETECT_TAG_METRIC_SECONDS; } else if (strcasecmp("bytes", str_ptr) == 0) { td.metric = DETECT_TAG_METRIC_BYTES; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid argument metric. Must be one of \"seconds\", \"packets\" or \"bytes\" (%s)", tagstr); goto error; } pcre_free_substring(str_ptr); str_ptr = NULL; /* if specified, overwrite it */ if (ret == 7) { res = pcre_get_substring((char *)tagstr, ov, MAX_SUBSTRINGS, 6, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* metric */ if (strcasecmp("src", str_ptr) == 0) { td.direction = DETECT_TAG_DIR_SRC; } else if (strcasecmp("dst", str_ptr) == 0) { td.direction = DETECT_TAG_DIR_DST; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid argument direction. Must be one of \"src\" or \"dst\" (only valid for tag host type, not sessions) (%s)", tagstr); goto error; } if (td.type != DETECT_TAG_TYPE_HOST) { SCLogWarning(SC_ERR_INVALID_VALUE, "Argument direction doesn't make sense for type \"session\" (%s [%"PRIu8"])", tagstr, td.type); } pcre_free_substring(str_ptr); str_ptr = NULL; } } DetectTagData *real_td = SCMalloc(sizeof(DetectTagData)); if (unlikely(real_td == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); goto error; } memcpy(real_td, &td, sizeof(DetectTagData)); return real_td; error: if (str_ptr != NULL) pcre_free_substring(str_ptr); return NULL; } /** * \brief this function is used to add the parsed tag data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param tagstr pointer to the user provided tag options * * \retval 0 on Success * \retval -1 on Failure */ int DetectTagSetup(DetectEngineCtx *de_ctx, Signature *s, char *tagstr) { DetectTagData *td = NULL; SigMatch *sm = NULL; td = DetectTagParse(tagstr); if (td == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TAG; sm->ctx = (SigMatchCtx *)td; /* Append it to the list of tags */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_TMATCH); return 0; error: if (td != NULL) DetectTagDataFree(td); if (sm != NULL) SCFree(sm); return -1; } /** \internal * \brief this function will free memory associated with * DetectTagDataEntry * * \param td pointer to DetectTagDataEntry */ static void DetectTagDataEntryFree(void *ptr) { if (ptr != NULL) { DetectTagDataEntry *dte = (DetectTagDataEntry *)ptr; SCFree(dte); } } /** * \brief this function will free all the entries of a list * DetectTagDataEntry * * \param td pointer to DetectTagDataEntryList */ void DetectTagDataListFree(void *ptr) { if (ptr != NULL) { DetectTagDataEntry *entry = ptr; while (entry != NULL) { DetectTagDataEntry *next_entry = entry->next; DetectTagDataEntryFree(entry); (void) SC_ATOMIC_SUB(num_tags, 1); entry = next_entry; } } } /** * \brief this function will free memory associated with DetectTagData * * \param td pointer to DetectTagData */ void DetectTagDataFree(void *ptr) { DetectTagData *td = (DetectTagData *)ptr; SCFree(td); } #ifdef UNITTESTS /** * \test DetectTagTestParse01 is a test to make sure that we return "something" * when given valid tag opt */ static int DetectTagTestParse01(void) { int result = 0; DetectTagData *td = NULL; td = DetectTagParse("session, 123, packets"); if (td != NULL && td->type == DETECT_TAG_TYPE_SESSION && td->count == 123 && td->metric == DETECT_TAG_METRIC_PACKET) { DetectTagDataFree(td); result = 1; } return result; } /** * \test DetectTagTestParse02 is a test to check that we parse tag correctly */ static int DetectTagTestParse02(void) { int result = 0; DetectTagData *td = NULL; td = DetectTagParse("host, 200, bytes, src"); if (td != NULL && td->type == DETECT_TAG_TYPE_HOST && td->count == 200 && td->metric == DETECT_TAG_METRIC_BYTES && td->direction == DETECT_TAG_DIR_SRC) { result = 1; DetectTagDataFree(td); } return result; } /** * \test DetectTagTestParse03 is a test for setting the stateless tag opt */ static int DetectTagTestParse03(void) { int result = 0; DetectTagData *td = NULL; td = DetectTagParse("host, 200, bytes, dst"); if (td != NULL && td->type == DETECT_TAG_TYPE_HOST && td->count == 200 && td->metric == DETECT_TAG_METRIC_BYTES && td->direction == DETECT_TAG_DIR_DST) { result = 1; DetectTagDataFree(td); } return result; } /** * \test DetectTagTestParse04 is a test for default opts */ static int DetectTagTestParse04(void) { int result = 0; DetectTagData *td = NULL; td = DetectTagParse("session"); if (td != NULL && td->type == DETECT_TAG_TYPE_SESSION && td->count == DETECT_TAG_MAX_PKTS && td->metric == DETECT_TAG_METRIC_PACKET) { result = 1; DetectTagDataFree(td); } return result; } /** * \test DetectTagTestParse05 is a test for default opts */ static int DetectTagTestParse05(void) { int result = 0; DetectTagData *td = NULL; td = DetectTagParse("host"); if (td != NULL && td->type == DETECT_TAG_TYPE_HOST && td->count == DETECT_TAG_MAX_PKTS && td->metric == DETECT_TAG_METRIC_PACKET && td->direction == DETECT_TAG_DIR_DST) { result = 1; DetectTagDataFree(td); } return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectTag */ void DetectTagRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTagTestParse01", DetectTagTestParse01); UtRegisterTest("DetectTagTestParse02", DetectTagTestParse02); UtRegisterTest("DetectTagTestParse03", DetectTagTestParse03); UtRegisterTest("DetectTagTestParse04", DetectTagTestParse04); UtRegisterTest("DetectTagTestParse05", DetectTagTestParse05); DetectEngineTagRegisterTests(); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-hcbd.c0000644000000000000000000011475313051004444014571 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP request body match corresponding to http_client_body * keyword. * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "app-layer-parser.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "conf.h" #include "conf-yaml-loader.h" #include "util-validate.h" #define BUFFER_STEP 50 static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size) { if (size >= (USHRT_MAX - BUFFER_STEP)) return -1; void *ptmp; if (size > det_ctx->hcbd_buffers_size) { ptmp = SCRealloc(det_ctx->hcbd, (det_ctx->hcbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody)); if (ptmp == NULL) { SCFree(det_ctx->hcbd); det_ctx->hcbd = NULL; det_ctx->hcbd_buffers_size = 0; det_ctx->hcbd_buffers_list_len = 0; return -1; } det_ctx->hcbd = ptmp; memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody)); det_ctx->hcbd_buffers_size += BUFFER_STEP; uint16_t i; for (i = det_ctx->hcbd_buffers_list_len; i < ((uint16_t)size); i++) { det_ctx->hcbd[i].buffer_len = 0; det_ctx->hcbd[i].offset = 0; } } return 0; } /** */ static const uint8_t *DetectEngineHCBDGetBufferForTX(htp_tx_t *tx, uint64_t tx_id, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Flow *f, HtpState *htp_state, uint8_t flags, uint32_t *buffer_len, uint32_t *stream_start_offset) { int index = 0; const uint8_t *buffer = NULL; *buffer_len = 0; *stream_start_offset = 0; if (det_ctx->hcbd_buffers_list_len == 0) { /* get the inspect id to use as a 'base id' */ uint64_t base_inspect_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); BUG_ON(base_inspect_id > tx_id); /* see how many space we need for the current tx_id */ uint64_t txs = (tx_id - base_inspect_id) + 1; if (HCBDCreateSpace(det_ctx, txs) < 0) goto end; index = (tx_id - base_inspect_id); det_ctx->hcbd_start_tx_id = base_inspect_id; det_ctx->hcbd_buffers_list_len = txs; } else { if ((tx_id - det_ctx->hcbd_start_tx_id) < det_ctx->hcbd_buffers_list_len) { if (det_ctx->hcbd[(tx_id - det_ctx->hcbd_start_tx_id)].buffer_len != 0) { *buffer_len = det_ctx->hcbd[(tx_id - det_ctx->hcbd_start_tx_id)].buffer_len; *stream_start_offset = det_ctx->hcbd[(tx_id - det_ctx->hcbd_start_tx_id)].offset; return det_ctx->hcbd[(tx_id - det_ctx->hcbd_start_tx_id)].buffer; } } else { uint64_t txs = (tx_id - det_ctx->hcbd_start_tx_id) + 1; if (HCBDCreateSpace(det_ctx, txs) < 0) goto end; /* let's consider it as stage not done for now */ det_ctx->hcbd_buffers_list_len = txs; } index = (tx_id - det_ctx->hcbd_start_tx_id); } HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (htud == NULL) { SCLogDebug("no htud"); goto end; } /* no new data */ if (htud->request_body.body_inspected == htud->request_body.content_len_so_far) { SCLogDebug("no new data"); goto end; } HtpBodyChunk *cur = htud->request_body.first; if (cur == NULL) { SCLogDebug("No http chunks to inspect for this transacation"); goto end; } if (!htp_state->cfg->http_body_inline) { /* inspect the body if the transfer is complete or we have hit * our body size limit */ if ((htp_state->cfg->request.body_limit == 0 || htud->request_body.content_len_so_far < htp_state->cfg->request.body_limit) && htud->request_body.content_len_so_far < htp_state->cfg->request.inspect_min_size && !(AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_BODY) && !(flags & STREAM_EOF)) { SCLogDebug("we still haven't seen the entire request body. " "Let's defer body inspection till we see the " "entire body."); goto end; } } /* get the inspect buffer * * make sure that we have at least the configured inspect_win size. * If we have more, take at least 1/4 of the inspect win size before * the new data. */ uint64_t offset = 0; if (htud->request_body.body_inspected > htp_state->cfg->request.inspect_min_size) { BUG_ON(htud->request_body.content_len_so_far < htud->request_body.body_inspected); uint64_t inspect_win = htud->request_body.content_len_so_far - htud->request_body.body_inspected; SCLogDebug("inspect_win %u", (uint)inspect_win); if (inspect_win < htp_state->cfg->request.inspect_window) { uint64_t inspect_short = htp_state->cfg->request.inspect_window - inspect_win; if (htud->request_body.body_inspected < inspect_short) offset = 0; else offset = htud->request_body.body_inspected - inspect_short; } else { offset = htud->request_body.body_inspected - (htp_state->cfg->request.inspect_window / 4); } } StreamingBufferGetDataAtOffset(htud->request_body.sb, &det_ctx->hcbd[index].buffer, &det_ctx->hcbd[index].buffer_len, offset); det_ctx->hcbd[index].offset = offset; /* move inspected tracker to end of the data. HtpBodyPrune will consider * the window sizes when freeing data */ htud->request_body.body_inspected = htud->request_body.content_len_so_far; buffer = det_ctx->hcbd[index].buffer; *buffer_len = det_ctx->hcbd[index].buffer_len; *stream_start_offset = det_ctx->hcbd[index].offset; SCLogDebug("buffer_len %u (%u)", *buffer_len, (uint)htud->request_body.content_len_so_far); end: return buffer; } /** \brief HTTP Client Body Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpRequestBody(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = DetectEngineHCBDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len, &stream_start_offset); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxHttpRequestBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestBody, ALPROTO_HTTP, HTP_REQUEST_BODY, mpm_ctx, NULL, "http_client_body"); } int DetectEngineInspectHttpClientBody(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { HtpState *htp_state = (HtpState *)alstate; uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = DetectEngineHCBDGetBufferForTX(tx, tx_id, de_ctx, det_ctx, f, htp_state, flags, &buffer_len, &stream_start_offset); if (buffer_len == 0) goto end; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH], f, (uint8_t *)buffer, buffer_len, stream_start_offset, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_BODY) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } void DetectEngineCleanHCBDBuffers(DetectEngineThreadCtx *det_ctx) { if (det_ctx->hcbd_buffers_list_len > 0) { for (int i = 0; i < det_ctx->hcbd_buffers_list_len; i++) { det_ctx->hcbd[i].buffer_len = 0; det_ctx->hcbd[i].offset = 0; } } det_ctx->hcbd_buffers_list_len = 0; det_ctx->hcbd_start_tx_id = 0; return; } /***********************************Unittests**********************************/ #ifdef UNITTESTS struct TestSteps { const uint8_t *input; size_t input_size; /**< if 0 strlen will be used */ int direction; /**< STREAM_TOSERVER, STREAM_TOCLIENT */ int expect; }; static int RunTest (struct TestSteps *steps, const char *sig, const char *yaml) { TcpSession ssn; Flow f; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); if (yaml) { ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(yaml, strlen(yaml)); HTPConfigure(); } StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; SCLogDebug("sig %s", sig); DetectEngineAppendSig(de_ctx, (char *)sig); de_ctx->flags |= DE_QUIET; if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); struct TestSteps *b = steps; int i = 0; while (b->input != NULL) { SCLogDebug("chunk %p %d", b, i); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = &f; p->flowflags = (b->direction == STREAM_TOSERVER) ? FLOW_PKT_TOSERVER : FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, b->direction, (uint8_t *)b->input, b->input_size ? b->input_size : strlen((const char *)b->input)); if (r != 0) { printf("toserver chunk %d returned %" PRId32 ", expected 0: ", i+1, r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); int match = PacketAlertCheck(p, 1); if (b->expect != match) { printf("rule matching mismatch: "); goto end; } UTHFreePackets(&p, 1); p = NULL; b++; i++; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (yaml) { HtpConfigRestoreBackup(); ConfRestoreContextBackup(); } return result; } static int DetectEngineHttpClientBodyTest01(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1This\"; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest02(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; offset:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest03(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; offset:16; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest04(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:!\"body1\"; http_client_body; offset:16; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest05(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; depth:25; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest06(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:!\"body1\"; http_client_body; depth:25; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest07(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:!\"body1\"; http_client_body; depth:15; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest08(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"This is dummy body1This is dummy message body2\"; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest09(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"This\"; http_client_body; within:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest10(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:!\"boom\"; http_client_body; within:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest11(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"boom\"; http_client_body; within:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest12(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:!\"This\"; http_client_body; within:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest13(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"dummy\"; http_client_body; distance:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest14(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:!\"dummy\"; http_client_body; distance:10; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest15(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"dummy\"; http_client_body; distance:10; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest16(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:!\"dummy\"; http_client_body; distance:5; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest17(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"bambu\"; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest18(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"body1\"; http_client_body; content:\"bambu\"; http_client_body; fast_pattern; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest19(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"bambu\"; http_client_body; content:\"is\"; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest20(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"is\"; http_client_body; fast_pattern; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest21(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:!\"dummy\"; http_client_body; within:7; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest22(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:!\"dummy\"; within:7; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest23(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:!\"dummy\"; distance:3; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest24(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:!\"dummy\"; distance:13; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest25(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:\"dummy\"; within:15; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest26(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:\"dummy\"; within:10; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest27(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:\"dummy\"; distance:8; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest28(void) { struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (pcre:/body1/P; content:\"dummy\"; distance:14; http_client_body; sid:1;)"; return RunTest(steps, sig, NULL); } static int DetectEngineHttpClientBodyTest29(void) { const char *request_buffer = "GET /one HTTP/1.0\r\n" "Host: localhost\r\n\r\n"; #define TOTAL_REQUESTS 45 uint8_t *http_buf = SCMalloc(TOTAL_REQUESTS * strlen(request_buffer)); if (unlikely(http_buf == NULL)) return 0; for (int i = 0; i < TOTAL_REQUESTS; i++) { memcpy(http_buf + i * strlen(request_buffer), request_buffer, strlen(request_buffer)); } uint32_t http_buf_len = TOTAL_REQUESTS * strlen(request_buffer); #undef TOTAL_REQUESTS struct TestSteps steps[] = { { (const uint8_t *)http_buf, (size_t)http_buf_len, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 5\r\n" "\r\n" "dummy", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"dummyone\"; fast_pattern:0,3; http_server_body; sid:1;)"; int result = RunTest(steps, sig, NULL); SCFree(http_buf); return result; } static int DetectEngineHttpClientBodyTest30(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ \n\ request-body-inspect-window: 0\n\ response-body-inspect-window: 0\n\ request-body-minimal-inspect-size: 0\n\ response-body-minimal-inspect-size: 0\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"bags\"; within:4; http_client_body; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpClientBodyTest31(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ \n\ request-body-inspect-window: 0\n\ response-body-inspect-window: 0\n\ request-body-minimal-inspect-size: 0\n\ response-body-minimal-inspect-size: 0\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"This is dummy message body2", 0, STREAM_TOSERVER, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (content:\"bags\"; depth:4; http_client_body; sid:1;)"; return RunTest(steps, sig, yaml); } #endif /* UNITTESTS */ void DetectEngineHttpClientBodyRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpClientBodyTest01", DetectEngineHttpClientBodyTest01); UtRegisterTest("DetectEngineHttpClientBodyTest02", DetectEngineHttpClientBodyTest02); UtRegisterTest("DetectEngineHttpClientBodyTest03", DetectEngineHttpClientBodyTest03); UtRegisterTest("DetectEngineHttpClientBodyTest04", DetectEngineHttpClientBodyTest04); UtRegisterTest("DetectEngineHttpClientBodyTest05", DetectEngineHttpClientBodyTest05); UtRegisterTest("DetectEngineHttpClientBodyTest06", DetectEngineHttpClientBodyTest06); UtRegisterTest("DetectEngineHttpClientBodyTest07", DetectEngineHttpClientBodyTest07); UtRegisterTest("DetectEngineHttpClientBodyTest08", DetectEngineHttpClientBodyTest08); UtRegisterTest("DetectEngineHttpClientBodyTest09", DetectEngineHttpClientBodyTest09); UtRegisterTest("DetectEngineHttpClientBodyTest10", DetectEngineHttpClientBodyTest10); UtRegisterTest("DetectEngineHttpClientBodyTest11", DetectEngineHttpClientBodyTest11); UtRegisterTest("DetectEngineHttpClientBodyTest12", DetectEngineHttpClientBodyTest12); UtRegisterTest("DetectEngineHttpClientBodyTest13", DetectEngineHttpClientBodyTest13); UtRegisterTest("DetectEngineHttpClientBodyTest14", DetectEngineHttpClientBodyTest14); UtRegisterTest("DetectEngineHttpClientBodyTest15", DetectEngineHttpClientBodyTest15); UtRegisterTest("DetectEngineHttpClientBodyTest16", DetectEngineHttpClientBodyTest16); UtRegisterTest("DetectEngineHttpClientBodyTest17", DetectEngineHttpClientBodyTest17); UtRegisterTest("DetectEngineHttpClientBodyTest18", DetectEngineHttpClientBodyTest18); UtRegisterTest("DetectEngineHttpClientBodyTest19", DetectEngineHttpClientBodyTest19); UtRegisterTest("DetectEngineHttpClientBodyTest20", DetectEngineHttpClientBodyTest20); UtRegisterTest("DetectEngineHttpClientBodyTest21", DetectEngineHttpClientBodyTest21); UtRegisterTest("DetectEngineHttpClientBodyTest22", DetectEngineHttpClientBodyTest22); UtRegisterTest("DetectEngineHttpClientBodyTest23", DetectEngineHttpClientBodyTest23); UtRegisterTest("DetectEngineHttpClientBodyTest24", DetectEngineHttpClientBodyTest24); UtRegisterTest("DetectEngineHttpClientBodyTest25", DetectEngineHttpClientBodyTest25); UtRegisterTest("DetectEngineHttpClientBodyTest26", DetectEngineHttpClientBodyTest26); UtRegisterTest("DetectEngineHttpClientBodyTest27", DetectEngineHttpClientBodyTest27); UtRegisterTest("DetectEngineHttpClientBodyTest28", DetectEngineHttpClientBodyTest28); UtRegisterTest("DetectEngineHttpClientBodyTest29", DetectEngineHttpClientBodyTest29); UtRegisterTest("DetectEngineHttpClientBodyTest30", DetectEngineHttpClientBodyTest30); UtRegisterTest("DetectEngineHttpClientBodyTest31", DetectEngineHttpClientBodyTest31); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/util-storage.h0000644000000000000000000000504613051004444013576 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Storage API */ #ifndef __UTIL_STORAGE_H__ #define __UTIL_STORAGE_H__ typedef enum StorageEnum_ { STORAGE_HOST, STORAGE_FLOW, STORAGE_IPPAIR, STORAGE_MAX, } StorageEnum; /** void ptr array for now */ typedef void* Storage; void StorageInit(void); void StorageCleanup(void); /** \brief Register new storage * * \param type type from StorageEnum * \param name name * \param size size of the per instance storage * \param Alloc alloc function for per instance storage * \param Free free function for per instance storage * * \note if size == ptr size (so sizeof(void *)) and Alloc == NULL the API just * gives the caller a ptr to store something it alloc'ed itself. */ int StorageRegister(const StorageEnum type, const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)); int StorageFinalize(void); unsigned int StorageGetCnt(const StorageEnum type); unsigned int StorageGetSize(const StorageEnum type); /** \brief get storage for id */ void *StorageGetById(const Storage *storage, const StorageEnum type, const int id); /** \brief set storage for id */ int StorageSetById(Storage *storage, const StorageEnum type, const int id, void *ptr); /** \brief AllocById func for prealloc'd base storage (storage ptrs are part * of another memory block) */ void *StorageAllocByIdPrealloc(Storage *storage, StorageEnum type, int id); /** \brief AllocById func for when we manage the Storage ptr itself */ void *StorageAllocById(Storage **storage, const StorageEnum type, const int id); void StorageFreeById(Storage *storage, const StorageEnum type, const int id); void StorageFreeAll(Storage *storage, const StorageEnum type); void StorageFree(Storage **storage, const StorageEnum type); void StorageRegisterTests(void); #endif suricata-3.2.1/src/decode-raw.c0000644000000000000000000001400113051004444013153 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author William Metcalf * * Decode RAW */ #include "suricata-common.h" #include "decode.h" #include "decode-raw.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" #include "pkt-var.h" #include "util-profiling.h" #include "host.h" int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_raw); /* If it is ipv4 or ipv6 it should at least be the size of ipv4 */ if (unlikely(len < IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_PKT_TOO_SMALL); return TM_ECODE_FAILED; } if (IP_GET_RAW_VER(pkt) == 4) { SCLogDebug("IPV4 Packet"); DecodeIPV4(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else if (IP_GET_RAW_VER(pkt) == 6) { SCLogDebug("IPV6 Packet"); DecodeIPV6(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else { SCLogDebug("Unknown ip version %" PRIu8 "", IP_GET_RAW_VER(pkt)); ENGINE_SET_EVENT(p,IPRAW_INVALID_IPV); } return TM_ECODE_OK; } #ifdef UNITTESTS #include "flow.h" #include "flow-util.h" /** DecodeRawtest01 * \brief Valid Raw packet * \retval 0 Expected test value */ static int DecodeRawTest01 (void) { /* IPV6/TCP/no eth header */ uint8_t raw_ip[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x28, 0x06, 0x40, 0x20, 0x01, 0x06, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x99, 0xcc, 0x70, 0x20, 0x01, 0x06, 0x18, 0x00, 0x01, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x8c, 0x9b, 0x00, 0x50, 0x6a, 0xe7, 0x07, 0x36, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0x30, 0x29, 0x9c, 0x00, 0x00, 0x02, 0x04, 0x05, 0x8c, 0x04, 0x02, 0x08, 0x0a, 0x00, 0xdd, 0x1a, 0x39, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x02 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); if (PacketCopyData(p, raw_ip, sizeof(raw_ip)) == -1) { SCFree(p); return 0; } FlowInitConfig(FLOW_QUIET); DecodeRaw(&tv, &dtv, p, raw_ip, GET_PKT_LEN(p), NULL); if (p->ip6h == NULL) { printf("expected a valid ipv6 header but it was NULL: "); FlowShutdown(); SCFree(p); return 0; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 1; } /** DecodeRawtest02 * \brief Valid Raw packet * \retval 0 Expected test value */ static int DecodeRawTest02 (void) { /* IPV4/TCP/no eth header */ uint8_t raw_ip[] = { 0x45, 0x00, 0x00, 0x30, 0x00, 0xad, 0x40, 0x00, 0x7f, 0x06, 0xac, 0xc5, 0xc0, 0xa8, 0x67, 0x02, 0xc0, 0xa8, 0x66, 0x02, 0x0b, 0xc7, 0x00, 0x50, 0x1d, 0xb3, 0x12, 0x37, 0x00, 0x00, 0x00, 0x00, 0x70, 0x02, 0x40, 0x00, 0xb8, 0xc8, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x01, 0x01, 0x04, 0x02 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); if (PacketCopyData(p, raw_ip, sizeof(raw_ip)) == -1) { SCFree(p); return 0; } FlowInitConfig(FLOW_QUIET); DecodeRaw(&tv, &dtv, p, raw_ip, GET_PKT_LEN(p), NULL); if (p->ip4h == NULL) { printf("expected a valid ipv4 header but it was NULL: "); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 0; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 1; } /** DecodeRawtest03 * \brief Valid Raw packet * \retval 0 Expected test value */ static int DecodeRawTest03 (void) { /* IPV13 */ uint8_t raw_ip[] = { 0xdf, 0x00, 0x00, 0x3d, 0x49, 0x42, 0x40, 0x00, 0x40, 0x06, 0xcf, 0x8a, 0x0a, 0x1f, 0x03, 0xaf, 0x0a, 0x1f, 0x0a, 0x02, 0xa5, 0xe7, 0xde, 0xad, 0x00, 0x0c, 0xe2, 0x0e, 0x8b, 0xfe, 0x0c, 0xe7, 0x80, 0x18, 0x00, 0xb7, 0xaf, 0xeb, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xab, 0x4f, 0x34, 0x40, 0x67, 0x31, 0x3b, 0x63, 0x61, 0x74, 0x20, 0x6b, 0x65, 0x79, 0x3b }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); if (PacketCopyData(p, raw_ip, sizeof(raw_ip)) == -1) { SCFree(p); return 0; } FlowInitConfig(FLOW_QUIET); DecodeRaw(&tv, &dtv, p, raw_ip, GET_PKT_LEN(p), NULL); if (!ENGINE_ISSET_EVENT(p,IPRAW_INVALID_IPV)) { printf("expected IPRAW_INVALID_IPV to be set but it wasn't: "); FlowShutdown(); SCFree(p); return 0; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 1; } #endif /* UNITTESTS */ /** * \brief Registers Raw unit tests * \todo More Raw tests */ void DecodeRawRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeRawTest01", DecodeRawTest01); UtRegisterTest("DecodeRawTest02", DecodeRawTest02); UtRegisterTest("DecodeRawTest03", DecodeRawTest03); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-flowint.h0000644000000000000000000000426413051004444014110 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_FLOWINT_H__ #define __DETECT_FLOWINT_H__ /** Flowint operations allowed */ enum { /** Changing integer values */ FLOWINT_MODIFIER_SET, FLOWINT_MODIFIER_ADD, FLOWINT_MODIFIER_SUB, /** Comparing integer values */ FLOWINT_MODIFIER_LT, FLOWINT_MODIFIER_LE, FLOWINT_MODIFIER_EQ, FLOWINT_MODIFIER_NE, FLOWINT_MODIFIER_GE, FLOWINT_MODIFIER_GT, /** Checking if a var is set (keyword isset/notset)*/ FLOWINT_MODIFIER_ISSET, FLOWINT_MODIFIER_NOTSET, FLOWINT_MODIFIER_UNKNOWN }; /** The target can be a value, or another variable arleady declared */ enum { FLOWINT_TARGET_VAL, FLOWINT_TARGET_VAR, FLOWINT_TARGET_SELF, FLOWINT_TARGET_UNKNOWN }; /** If the target is another var, get the name and the idx */ typedef struct TargetVar_ { char *name; } TargetVar; /** Context data for flowint vars */ typedef struct DetectFlowintData_ { /* This is the main var we are going to use * against the target */ char *name; /* Internal id of the var */ uint16_t idx; /* The modifier/operation/condition we are * going to execute */ uint8_t modifier; uint8_t targettype; union { /* the target value */ uint32_t value; /* or the target var */ TargetVar tvar; } target; } DetectFlowintData; /* prototypes */ void DetectFlowintRegister (void); #endif /* __DETECT_FLOWINT_H__ */ suricata-3.2.1/src/debug.h0000644000000000000000000000156413051004444012246 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DEBUG_H__ #define __DEBUG_H__ #ifdef DEBUG #endif /* DEBUG */ #endif /* __DEBUG_H__ */ suricata-3.2.1/src/util-conf.c0000644000000000000000000000557113051004444013055 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * */ #include "suricata-common.h" #include "config.h" #include "conf.h" #include "util-conf.h" TmEcode ConfigSetLogDirectory(char *name) { return ConfSetFinal("default-log-dir", name) ? TM_ECODE_OK : TM_ECODE_FAILED; } char *ConfigGetLogDirectory() { char *log_dir = NULL; if (ConfGet("default-log-dir", &log_dir) != 1) { #ifdef OS_WIN32 log_dir = _getcwd(NULL, 0); if (log_dir == NULL) { log_dir = DEFAULT_LOG_DIR; } #else log_dir = DEFAULT_LOG_DIR; #endif /* OS_WIN32 */ } return log_dir; } TmEcode ConfigCheckLogDirectory(char *log_dir) { SCEnter(); #ifdef OS_WIN32 struct _stat buf; if (_stat(log_dir, &buf) != 0) { #else struct stat buf; if (stat(log_dir, &buf) != 0) { #endif /* OS_WIN32 */ SCReturnInt(TM_ECODE_FAILED); } SCReturnInt(TM_ECODE_OK); } /** * \brief Find the configuration node for a specific device. * Basically hunts through the list of maps for the first one with a * key of "interface", and a value of the provided interface. * * \param node The node to start looking for the device * configuration. Typically this would be something like the af-packet * or pf-ring node. * * \param iface The name of the interface to find the config for. */ ConfNode *ConfFindDeviceConfig(ConfNode *node, const char *iface) { ConfNode *if_node, *item; TAILQ_FOREACH(if_node, &node->head, next) { TAILQ_FOREACH(item, &if_node->head, next) { if (strcmp(item->name, "interface") == 0 && strcmp(item->val, iface) == 0) { return if_node; } } } return NULL; } int ConfUnixSocketIsEnable(void) { char *value; if (ConfGet("unix-command.enabled", &value) != 1) { return 0; } if (!strcmp(value, "auto")) { #ifdef HAVE_LIBJANSSON #ifdef OS_WIN32 return 0; #else if (TimeModeIsLive()) { SCLogInfo("Running in live mode, activating unix socket"); return 1; } else { return 0; } #endif #else return 0; #endif } return ConfValIsTrue(value); } suricata-3.2.1/src/util-prefilter.h0000644000000000000000000000523713051004444014130 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_PREFILTER_H__ #define __UTIL_PREFILTER_H__ /** \brief structure for storing potential rule matches * * Helper structure for the prefilter engine. The Pattern Matchers * and other prefilter engines will add rule id's for potential * rule matches */ typedef struct PrefilterRuleStore_ { /* used for storing rule id's */ /* Array of rule IDs found. */ SigIntId *rule_id_array; /* Number of rule IDs in the array. */ uint32_t rule_id_array_cnt; /* The number of slots allocated for storing rule IDs */ uint32_t rule_id_array_size; } PrefilterRuleStore; /* Resize Signature ID array. Only called from MpmAddSids(). */ int PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size); /** \brief Add array of Signature IDs to rule ID array. * * Checks size of the array first. Calls PrefilterAddSidsResize to increase * The size of the array, since that is the slow path. * * \param pmq storage for match results * \param sids pointer to array of Signature IDs * \param sids_size number of Signature IDs in sids array. * */ static inline void PrefilterAddSids(PrefilterRuleStore *pmq, SigIntId *sids, uint32_t sids_size) { if (sids_size == 0) return; uint32_t new_size = pmq->rule_id_array_cnt + sids_size; if (new_size > pmq->rule_id_array_size) { if (PrefilterAddSidsResize(pmq, new_size) == 0) { // Failed to allocate larger memory for all the SIDS, but // keep as many as we can. sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt; } } SCLogDebug("Adding %u sids", sids_size); // Add SIDs for this pattern to the end of the array SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt; SigIntId *end = ptr + sids_size; do { *ptr++ = *sids++; } while (ptr != end); pmq->rule_id_array_cnt += sids_size; } #endif /* __UTIL_PREFILTER_H__ */ suricata-3.2.1/src/detect-noalert.h0000644000000000000000000000164313051004444014070 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_NOALERT_H__ #define __DETECT_NOALERT_H__ /* prototypes */ void DetectNoalertRegister (void); #endif /* __DETECT_NOALERT_H__ */ suricata-3.2.1/src/util-fix_checksum.h0000644000000000000000000000332213051004444014575 00000000000000/* * Reference: OpenBSD's pf.c. * * Copyright (c) 2001 Daniel Hartmeier * Copyright (c) 2002 - 2008 Henning Brauer * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above * copyright notice, this list of conditions and the following * disclaimer in the documentation and/or other materials provided * with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * * Effort sponsored in part by the Defense Advanced Research Projects * Agency (DARPA) and Air Force Research Laboratory, Air Force * Materiel Command, USAF, under agreement number F30602-01-2-0537. */ uint16_t FixChecksum(uint16_t sum, uint16_t old, uint16_t new); suricata-3.2.1/src/util-cpu.h0000644000000000000000000000216613051004444012721 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __UTIL_CPU_H__ #define __UTIL_CPU_H__ /* Processors configured: */ uint16_t UtilCpuGetNumProcessorsConfigured(); /* Processors online: */ uint16_t UtilCpuGetNumProcessorsOnline(); /* Only on Solaris */ uint16_t UtilCpuGetNumProcessorsMax(); void UtilCpuPrintSummary(); uint64_t UtilCpuGetTicks(void); #endif /* __UTIL_CPU_H__ */ suricata-3.2.1/src/detect-fast-pattern.h0000644000000000000000000000360413051004444015033 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_FAST_PATTERN_H__ #define __DETECT_FAST_PATTERN_H__ typedef struct SCFPSupportSMList_ { /* the list id. Have a look at Signature->sm_lists[] */ int list_id; int priority; struct SCFPSupportSMList_ *next; } SCFPSupportSMList; extern SCFPSupportSMList *sm_fp_support_smlist_list; /** * \brief Checks if a particular list(Signature->sm_lists[]) is in the list * of lists that need to be searched for a keyword that has fp support. * * \param list_id The list id. * * \retval 1 If supported. * \retval 0 If not. */ static inline int FastPatternSupportEnabledForSigMatchList(int list_id) { if (sm_fp_support_smlist_list == NULL) return 0; SCFPSupportSMList *tmp_smlist_fp = sm_fp_support_smlist_list; while (tmp_smlist_fp != NULL) { if (tmp_smlist_fp->list_id == list_id) return 1; tmp_smlist_fp = tmp_smlist_fp->next; } return 0; } void SupportFastPatternForSigMatchList(int list_id, int priority); void SupportFastPatternForSigMatchTypes(void); void DetectFastPatternRegister(void); #endif /* __DETECT_FAST_PATTERN_H__ */ suricata-3.2.1/src/util-mpm-ac.c0000644000000000000000000026612513051004444013306 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * First iteration of aho-corasick MPM from - * * Efficient String Matching: An Aid to Bibliographic Search * Alfred V. Aho and Margaret J. Corasick * * - Uses the delta table for calculating transitions, instead of having * separate goto and failure transitions. * - If we cross 2 ** 16 states, we use 4 bytes in the transition table * to hold each state, otherwise we use 2 bytes. * - This version of the MPM is heavy on memory, but it performs well. * If you can fit the ruleset with this mpm on your box without hitting * swap, this is the MPM to go for. * * \todo - Do a proper analyis of our existing MPMs and suggest a good one based * on the pattern distribution and the expected traffic(say http). * - Tried out loop unrolling without any perf increase. Need to dig deeper. * - Irrespective of whether we cross 2 ** 16 states or not,shift to using * uint32_t for state type, so that we can integrate it's status as a * final state or not in the topmost byte. We are already doing it if * state_count is > 2 ** 16. * - Test case-senstive patterns if they have any ascii chars. If they * don't treat them as nocase. * - Carry out other optimizations we are working on. hashes, compression. */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "conf.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" #include "util-mpm-ac.h" #include "util-memcpy.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-mpm.h" #include "tm-threads.h" #include "detect-engine-mpm.h" #include "util-cuda.h" #include "util-cuda-handlers.h" #endif /* __SC_CUDA_SUPPORT__ */ void SCACInitCtx(MpmCtx *); void SCACInitThreadCtx(MpmCtx *, MpmThreadCtx *); void SCACDestroyCtx(MpmCtx *); void SCACDestroyThreadCtx(MpmCtx *, MpmThreadCtx *); int SCACAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACPreparePatterns(MpmCtx *mpm_ctx); uint32_t SCACSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); void SCACPrintInfo(MpmCtx *mpm_ctx); void SCACPrintSearchStats(MpmThreadCtx *mpm_thread_ctx); void SCACRegisterTests(void); /* a placeholder to denote a failure transition in the goto table */ #define SC_AC_FAIL (-1) #define STATE_QUEUE_CONTAINER_SIZE 65536 #define AC_CASE_MASK 0x80000000 #define AC_PID_MASK 0x7FFFFFFF #define AC_CASE_BIT 31 static int construct_both_16_and_32_state_tables = 0; /** * \brief Helper structure used by AC during state table creation */ typedef struct StateQueue_ { int32_t store[STATE_QUEUE_CONTAINER_SIZE]; int top; int bot; } StateQueue; /** * \internal * \brief Initialize the AC context with user specified conf parameters. We * aren't retrieving anything for AC conf now, but we will certainly * need it, when we customize AC. */ static void SCACGetConfig() { //ConfNode *ac_conf; //const char *hash_val = NULL; //ConfNode *pm = ConfGetNode("pattern-matcher"); return; } /** * \internal * \brief Check if size_t multiplication would overflow and perform operation * if safe. In case of an overflow we exit(). * * \param a First size_t value to multiplicate. * \param b Second size_t value to multiplicate. * * \retval The product of a and b, guaranteed to not overflow. */ static inline size_t SCACCheckSafeSizetMult(size_t a, size_t b) { /* check for safety of multiplication operation */ if (b > 0 && a > SIZE_MAX / b) { SCLogError(SC_ERR_MEM_ALLOC, "%"PRIuMAX" * %"PRIuMAX" > %" PRIuMAX" would overflow size_t calculating buffer size", (uintmax_t) a, (uintmax_t) b, (uintmax_t) SIZE_MAX); exit(EXIT_FAILURE); } return a * b; } /** * \internal * \brief Initialize a new state in the goto and output tables. * * \param mpm_ctx Pointer to the mpm context. * * \retval The state id, of the newly created state. */ static inline int SCACReallocState(SCACCtx *ctx, uint32_t cnt) { void *ptmp = NULL; size_t size = 0; /* reallocate space in the goto table to include a new state */ size = SCACCheckSafeSizetMult((size_t) cnt, (size_t) ctx->single_state_size); if (size > 0) ptmp = SCRealloc(ctx->goto_table, size); if (ptmp == NULL) { SCFree(ctx->goto_table); ctx->goto_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->goto_table = ptmp; /* reallocate space in the output table for the new state */ size_t oldsize = SCACCheckSafeSizetMult((size_t) ctx->state_count, sizeof(SCACOutputTable)); size = SCACCheckSafeSizetMult((size_t) cnt, sizeof(SCACOutputTable)); SCLogDebug("oldsize %"PRIuMAX" size %"PRIuMAX" cnt %d ctx->state_count %u", (uintmax_t) oldsize, (uintmax_t) size, cnt, ctx->state_count); ptmp = NULL; if (size > 0) ptmp = SCRealloc(ctx->output_table, size); if (ptmp == NULL) { SCFree(ctx->output_table); ctx->output_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->output_table = ptmp; memset(((uint8_t *)ctx->output_table + oldsize), 0, (size - oldsize)); /* \todo using it temporarily now during dev, since I have restricted * state var in SCACCtx->state_table to uint16_t. */ //if (ctx->state_count > 65536) { // printf("state count exceeded\n"); // exit(EXIT_FAILURE); //} return 0;//ctx->state_count++; } /** \internal * \brief Shrink state after setup is done * * Shrinks only the output table, goto table is freed after calling this */ static void SCACShrinkState(SCACCtx *ctx) { /* reallocate space in the output table for the new state */ #ifdef DEBUG int oldsize = ctx->allocated_state_count * sizeof(SCACOutputTable); #endif int newsize = ctx->state_count * sizeof(SCACOutputTable); SCLogDebug("oldsize %d newsize %d ctx->allocated_state_count %u " "ctx->state_count %u: shrink by %d bytes", oldsize, newsize, ctx->allocated_state_count, ctx->state_count, oldsize - newsize); void *ptmp = SCRealloc(ctx->output_table, newsize); if (ptmp == NULL) { SCFree(ctx->output_table); ctx->output_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->output_table = ptmp; } static inline int SCACInitNewState(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;; /* Exponentially increase the allocated space when needed. */ if (ctx->allocated_state_count < ctx->state_count + 1) { if (ctx->allocated_state_count == 0) ctx->allocated_state_count = 256; else ctx->allocated_state_count *= 2; SCACReallocState(ctx, ctx->allocated_state_count); } #if 0 if (ctx->allocated_state_count > 260) { SCACOutputTable *output_state = &ctx->output_table[260]; SCLogInfo("output_state %p %p %u", output_state, output_state->pids, output_state->no_of_entries); } #endif int ascii_code = 0; /* set all transitions for the newly assigned state as FAIL transitions */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { ctx->goto_table[ctx->state_count][ascii_code] = SC_AC_FAIL; } return ctx->state_count++; } /** * \internal * \brief Adds a pid to the output table for a state. * * \param state The state to whose output table we should add the pid. * \param pid The pattern id to add. * \param mpm_ctx Pointer to the mpm context. */ static void SCACSetOutputState(int32_t state, uint32_t pid, MpmCtx *mpm_ctx) { void *ptmp; SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; SCACOutputTable *output_state = &ctx->output_table[state]; uint32_t i = 0; for (i = 0; i < output_state->no_of_entries; i++) { if (output_state->pids[i] == pid) return; } output_state->no_of_entries++; ptmp = SCRealloc(output_state->pids, output_state->no_of_entries * sizeof(uint32_t)); if (ptmp == NULL) { SCFree(output_state->pids); output_state->pids = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } output_state->pids = ptmp; output_state->pids[output_state->no_of_entries - 1] = pid; return; } /** * \brief Helper function used by SCACCreateGotoTable. Adds a pattern to the * goto table. * * \param pattern Pointer to the pattern. * \param pattern_len Pattern length. * \param pid The pattern id, that corresponds to this pattern. We * need it to updated the output table for this pattern. * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACEnter(uint8_t *pattern, uint16_t pattern_len, uint32_t pid, MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int32_t state = 0; int32_t newstate = 0; int i = 0; int p = 0; /* walk down the trie till we have a match for the pattern prefix */ state = 0; for (i = 0; i < pattern_len; i++) { if (ctx->goto_table[state][pattern[i]] != SC_AC_FAIL) { state = ctx->goto_table[state][pattern[i]]; } else { break; } } /* add the non-matching pattern suffix to the trie, from the last state * we left off */ for (p = i; p < pattern_len; p++) { newstate = SCACInitNewState(mpm_ctx); ctx->goto_table[state][pattern[p]] = newstate; state = newstate; } /* add this pattern id, to the output table of the last state, where the * pattern ends in the trie */ SCACSetOutputState(state, pid, mpm_ctx); return; } /** * \internal * \brief Create the goto table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACCreateGotoTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; uint32_t i = 0; /* add each pattern to create the goto table */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { SCACEnter(ctx->parray[i]->ci, ctx->parray[i]->len, ctx->parray[i]->id, mpm_ctx); } int ascii_code = 0; for (ascii_code = 0; ascii_code < 256; ascii_code++) { if (ctx->goto_table[0][ascii_code] == SC_AC_FAIL) { ctx->goto_table[0][ascii_code] = 0; } } return; } static inline void SCACDetermineLevel1Gap(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; uint32_t u = 0; int map[256]; memset(map, 0, sizeof(map)); for (u = 0; u < mpm_ctx->pattern_cnt; u++) map[ctx->parray[u]->ci[0]] = 1; for (u = 0; u < 256; u++) { if (map[u] == 0) continue; int32_t newstate = SCACInitNewState(mpm_ctx); ctx->goto_table[0][u] = newstate; } return; } static inline int SCACStateQueueIsEmpty(StateQueue *q) { if (q->top == q->bot) return 1; else return 0; } static inline void SCACEnqueue(StateQueue *q, int32_t state) { int i = 0; /*if we already have this */ for (i = q->bot; i < q->top; i++) { if (q->store[i] == state) return; } q->store[q->top++] = state; if (q->top == STATE_QUEUE_CONTAINER_SIZE) q->top = 0; if (q->top == q->bot) { SCLogCritical(SC_ERR_AHO_CORASICK, "Just ran out of space in the queue. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } return; } static inline int32_t SCACDequeue(StateQueue *q) { if (q->bot == STATE_QUEUE_CONTAINER_SIZE) q->bot = 0; if (q->bot == q->top) { SCLogCritical(SC_ERR_AHO_CORASICK, "StateQueue behaving weirdly. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } return q->store[q->bot++]; } /* #define SCACStateQueueIsEmpty(q) (((q)->top == (q)->bot) ? 1 : 0) #define SCACEnqueue(q, state) do { \ int i = 0; \ \ for (i = (q)->bot; i < (q)->top; i++) { \ if ((q)->store[i] == state) \ return; \ } \ \ (q)->store[(q)->top++] = state; \ \ if ((q)->top == STATE_QUEUE_CONTAINER_SIZE) \ (q)->top = 0; \ \ if ((q)->top == (q)->bot) { \ SCLogCritical(SC_ERR_AHO_CORASICK, "Just ran out of space in the queue. " \ "Fatal Error. Exiting. Please file a bug report on this"); \ exit(EXIT_FAILURE); \ } \ } while (0) #define SCACDequeue(q) ( (((q)->bot == STATE_QUEUE_CONTAINER_SIZE)? ((q)->bot = 0): 0), \ (((q)->bot == (q)->top) ? \ (printf("StateQueue behaving " \ "weirdly. Fatal Error. Exiting. Please " \ "file a bug report on this"), \ exit(EXIT_FAILURE)) : 0), \ (q)->store[(q)->bot++]) \ */ /** * \internal * \brief Club the output data from 2 states and store it in the 1st state. * dst_state_data = {dst_state_data} UNION {src_state_data} * * \param dst_state First state(also the destination) for the union operation. * \param src_state Second state for the union operation. * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACClubOutputStates(int32_t dst_state, int32_t src_state, MpmCtx *mpm_ctx) { void *ptmp; SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; uint32_t i = 0; uint32_t j = 0; SCACOutputTable *output_dst_state = &ctx->output_table[dst_state]; SCACOutputTable *output_src_state = &ctx->output_table[src_state]; for (i = 0; i < output_src_state->no_of_entries; i++) { for (j = 0; j < output_dst_state->no_of_entries; j++) { if (output_src_state->pids[i] == output_dst_state->pids[j]) { break; } } if (j == output_dst_state->no_of_entries) { output_dst_state->no_of_entries++; ptmp = SCRealloc(output_dst_state->pids, (output_dst_state->no_of_entries * sizeof(uint32_t))); if (ptmp == NULL) { SCFree(output_dst_state->pids); output_dst_state->pids = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } output_dst_state->pids = ptmp; output_dst_state->pids[output_dst_state->no_of_entries - 1] = output_src_state->pids[i]; } } return; } /** * \internal * \brief Create the failure table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACCreateFailureTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int ascii_code = 0; int32_t state = 0; int32_t r_state = 0; StateQueue q; memset(&q, 0, sizeof(StateQueue)); /* allot space for the failure table. A failure entry in the table for * every state(SCACCtx->state_count) */ ctx->failure_table = SCMalloc(ctx->state_count * sizeof(int32_t)); if (ctx->failure_table == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->failure_table, 0, ctx->state_count * sizeof(int32_t)); /* add the failure transitions for the 0th state, and add every non-fail * transition from the 0th state to the queue for further processing * of failure states */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[0][ascii_code]; if (temp_state != 0) { SCACEnqueue(&q, temp_state); ctx->failure_table[temp_state] = 0; } } while (!SCACStateQueueIsEmpty(&q)) { /* pick up every state from the queue and add failure transitions */ r_state = SCACDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state == SC_AC_FAIL) continue; SCACEnqueue(&q, temp_state); state = ctx->failure_table[r_state]; while(ctx->goto_table[state][ascii_code] == SC_AC_FAIL) state = ctx->failure_table[state]; ctx->failure_table[temp_state] = ctx->goto_table[state][ascii_code]; SCACClubOutputStates(temp_state, ctx->failure_table[temp_state], mpm_ctx); } } return; } /** * \internal * \brief Create the delta table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACCreateDeltaTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int ascii_code = 0; int32_t r_state = 0; if ((ctx->state_count < 32767) || construct_both_16_and_32_state_tables) { ctx->state_table_u16 = SCMalloc(ctx->state_count * sizeof(SC_AC_STATE_TYPE_U16) * 256); if (ctx->state_table_u16 == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_u16, 0, ctx->state_count * sizeof(SC_AC_STATE_TYPE_U16) * 256); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (ctx->state_count * sizeof(SC_AC_STATE_TYPE_U16) * 256); StateQueue q; memset(&q, 0, sizeof(StateQueue)); for (ascii_code = 0; ascii_code < 256; ascii_code++) { SC_AC_STATE_TYPE_U16 temp_state = ctx->goto_table[0][ascii_code]; ctx->state_table_u16[0][ascii_code] = temp_state; if (temp_state != 0) SCACEnqueue(&q, temp_state); } while (!SCACStateQueueIsEmpty(&q)) { r_state = SCACDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state != SC_AC_FAIL) { SCACEnqueue(&q, temp_state); ctx->state_table_u16[r_state][ascii_code] = temp_state; } else { ctx->state_table_u16[r_state][ascii_code] = ctx->state_table_u16[ctx->failure_table[r_state]][ascii_code]; } } } } if (!(ctx->state_count < 32767) || construct_both_16_and_32_state_tables) { /* create space for the state table. We could have used the existing goto * table, but since we have it set to hold 32 bit state values, we will create * a new state table here of type SC_AC_STATE_TYPE(current set to uint16_t) */ ctx->state_table_u32 = SCMalloc(ctx->state_count * sizeof(SC_AC_STATE_TYPE_U32) * 256); if (ctx->state_table_u32 == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_u32, 0, ctx->state_count * sizeof(SC_AC_STATE_TYPE_U32) * 256); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (ctx->state_count * sizeof(SC_AC_STATE_TYPE_U32) * 256); StateQueue q; memset(&q, 0, sizeof(StateQueue)); for (ascii_code = 0; ascii_code < 256; ascii_code++) { SC_AC_STATE_TYPE_U32 temp_state = ctx->goto_table[0][ascii_code]; ctx->state_table_u32[0][ascii_code] = temp_state; if (temp_state != 0) SCACEnqueue(&q, temp_state); } while (!SCACStateQueueIsEmpty(&q)) { r_state = SCACDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state != SC_AC_FAIL) { SCACEnqueue(&q, temp_state); ctx->state_table_u32[r_state][ascii_code] = temp_state; } else { ctx->state_table_u32[r_state][ascii_code] = ctx->state_table_u32[ctx->failure_table[r_state]][ascii_code]; } } } } return; } static inline void SCACClubOutputStatePresenceWithDeltaTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int ascii_code = 0; uint32_t state = 0; uint32_t temp_state = 0; if ((ctx->state_count < 32767) || construct_both_16_and_32_state_tables) { for (state = 0; state < ctx->state_count; state++) { for (ascii_code = 0; ascii_code < 256; ascii_code++) { temp_state = ctx->state_table_u16[state & 0x7FFF][ascii_code]; if (ctx->output_table[temp_state & 0x7FFF].no_of_entries != 0) ctx->state_table_u16[state & 0x7FFF][ascii_code] |= (1 << 15); } } } if (!(ctx->state_count < 32767) || construct_both_16_and_32_state_tables) { for (state = 0; state < ctx->state_count; state++) { for (ascii_code = 0; ascii_code < 256; ascii_code++) { temp_state = ctx->state_table_u32[state & 0x00FFFFFF][ascii_code]; if (ctx->output_table[temp_state & 0x00FFFFFF].no_of_entries != 0) ctx->state_table_u32[state & 0x00FFFFFF][ascii_code] |= (1 << 24); } } } return; } static inline void SCACInsertCaseSensitiveEntriesForPatterns(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; uint32_t state = 0; uint32_t k = 0; for (state = 0; state < ctx->state_count; state++) { if (ctx->output_table[state].no_of_entries == 0) continue; for (k = 0; k < ctx->output_table[state].no_of_entries; k++) { if (ctx->pid_pat_list[ctx->output_table[state].pids[k]].cs != NULL) { ctx->output_table[state].pids[k] &= AC_PID_MASK; ctx->output_table[state].pids[k] |= ((uint32_t)1 << AC_CASE_BIT); } } } return; } #if 0 static void SCACPrintDeltaTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int i = 0, j = 0; printf("##############Delta Table##############\n"); for (i = 0; i < ctx->state_count; i++) { printf("%d: \n", i); for (j = 0; j < 256; j++) { if (SCACGetDelta(i, j, mpm_ctx) != 0) { printf(" %c -> %d\n", j, SCACGetDelta(i, j, mpm_ctx)); } } } return; } #endif /** * \brief Process the patterns and prepare the state table. * * \param mpm_ctx Pointer to the mpm context. */ static void SCACPrepareStateTable(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; /* create the 0th state in the goto table and output_table */ SCACInitNewState(mpm_ctx); SCACDetermineLevel1Gap(mpm_ctx); /* create the goto table */ SCACCreateGotoTable(mpm_ctx); /* create the failure table */ SCACCreateFailureTable(mpm_ctx); /* create the final state(delta) table */ SCACCreateDeltaTable(mpm_ctx); /* club the output state presence with delta transition entries */ SCACClubOutputStatePresenceWithDeltaTable(mpm_ctx); /* club nocase entries */ SCACInsertCaseSensitiveEntriesForPatterns(mpm_ctx); /* shrink the memory */ SCACShrinkState(ctx); #if 0 SCACPrintDeltaTable(mpm_ctx); #endif /* we don't need these anymore */ SCFree(ctx->goto_table); ctx->goto_table = NULL; SCFree(ctx->failure_table); ctx->failure_table = NULL; return; } /** * \brief Process the patterns added to the mpm, and create the internal tables. * * \param mpm_ctx Pointer to the mpm context. */ int SCACPreparePatterns(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (mpm_ctx->pattern_cnt == 0 || mpm_ctx->init_hash == NULL) { SCLogDebug("no patterns supplied to this mpm_ctx"); return 0; } /* alloc the pattern array */ ctx->parray = (MpmPattern **)SCMalloc(mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); if (ctx->parray == NULL) goto error; memset(ctx->parray, 0, mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); /* populate it with the patterns in the hash */ uint32_t i = 0, p = 0; for (i = 0; i < MPM_INIT_HASH_SIZE; i++) { MpmPattern *node = mpm_ctx->init_hash[i], *nnode = NULL; while(node != NULL) { nnode = node->next; node->next = NULL; ctx->parray[p++] = node; node = nnode; } } /* we no longer need the hash, so free it's memory */ SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; /* the memory consumed by a single state in our goto table */ ctx->single_state_size = sizeof(int32_t) * 256; /* handle no case patterns */ ctx->pid_pat_list = SCMalloc((mpm_ctx->max_pat_id + 1)* sizeof(SCACPatternList)); if (ctx->pid_pat_list == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->pid_pat_list, 0, (mpm_ctx->max_pat_id + 1) * sizeof(SCACPatternList)); for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (!(ctx->parray[i]->flags & MPM_PATTERN_FLAG_NOCASE)) { ctx->pid_pat_list[ctx->parray[i]->id].cs = SCMalloc(ctx->parray[i]->len); if (ctx->pid_pat_list[ctx->parray[i]->id].cs == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memcpy(ctx->pid_pat_list[ctx->parray[i]->id].cs, ctx->parray[i]->original_pat, ctx->parray[i]->len); ctx->pid_pat_list[ctx->parray[i]->id].patlen = ctx->parray[i]->len; } /* ACPatternList now owns this memory */ //SCLogInfo("ctx->parray[i]->sids_size %u", ctx->parray[i]->sids_size); ctx->pid_pat_list[ctx->parray[i]->id].sids_size = ctx->parray[i]->sids_size; ctx->pid_pat_list[ctx->parray[i]->id].sids = ctx->parray[i]->sids; ctx->parray[i]->sids_size = 0; ctx->parray[i]->sids = NULL; } /* prepare the state table required by AC */ SCACPrepareStateTable(mpm_ctx); #ifdef __SC_CUDA_SUPPORT__ if (mpm_ctx->mpm_type == MPM_AC_CUDA) { int r = SCCudaMemAlloc(&ctx->state_table_u32_cuda, ctx->state_count * sizeof(unsigned int) * 256); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } r = SCCudaMemcpyHtoD(ctx->state_table_u32_cuda, ctx->state_table_u32, ctx->state_count * sizeof(unsigned int) * 256); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemcpyHtoD failure."); exit(EXIT_FAILURE); } } #endif /* free all the stored patterns. Should save us a good 100-200 mbs */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->parray[i] != NULL) { MpmFreePattern(mpm_ctx, ctx->parray[i]); } } SCFree(ctx->parray); ctx->parray = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); ctx->pattern_id_bitarray_size = (mpm_ctx->max_pat_id / 8) + 1; SCLogDebug("ctx->pattern_id_bitarray_size %u", ctx->pattern_id_bitarray_size); return 0; error: return -1; } /** * \brief Init the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param matchsize We don't need this. */ void SCACInitThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { memset(mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); mpm_thread_ctx->ctx = SCMalloc(sizeof(SCACThreadCtx)); if (mpm_thread_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_thread_ctx->ctx, 0, sizeof(SCACThreadCtx)); mpm_thread_ctx->memory_cnt++; mpm_thread_ctx->memory_size += sizeof(SCACThreadCtx); return; } /** * \brief Initialize the AC context. * * \param mpm_ctx Mpm context. */ void SCACInitCtx(MpmCtx *mpm_ctx) { if (mpm_ctx->ctx != NULL) return; mpm_ctx->ctx = SCMalloc(sizeof(SCACCtx)); if (mpm_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->ctx, 0, sizeof(SCACCtx)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCACCtx); /* initialize the hash we use to speed up pattern insertions */ mpm_ctx->init_hash = SCMalloc(sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); if (mpm_ctx->init_hash == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->init_hash, 0, sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); /* get conf values for AC from our yaml file. We have no conf values for * now. We will certainly need this, as we develop the algo */ SCACGetConfig(); SCReturn; } /** * \brief Destroy the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCACDestroyThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { SCACPrintSearchStats(mpm_thread_ctx); if (mpm_thread_ctx->ctx != NULL) { SCFree(mpm_thread_ctx->ctx); mpm_thread_ctx->ctx = NULL; mpm_thread_ctx->memory_cnt--; mpm_thread_ctx->memory_size -= sizeof(SCACThreadCtx); } return; } /** * \brief Destroy the mpm context. * * \param mpm_ctx Pointer to the mpm context. */ void SCACDestroyCtx(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx == NULL) return; if (mpm_ctx->init_hash != NULL) { SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (MPM_INIT_HASH_SIZE * sizeof(MpmPattern *)); } if (ctx->parray != NULL) { uint32_t i; for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->parray[i] != NULL) { MpmFreePattern(mpm_ctx, ctx->parray[i]); } } SCFree(ctx->parray); ctx->parray = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); } if (ctx->state_table_u16 != NULL) { SCFree(ctx->state_table_u16); ctx->state_table_u16 = NULL; mpm_ctx->memory_cnt++; mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_STATE_TYPE_U16) * 256); } if (ctx->state_table_u32 != NULL) { SCFree(ctx->state_table_u32); ctx->state_table_u32 = NULL; mpm_ctx->memory_cnt++; mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_STATE_TYPE_U32) * 256); } if (ctx->output_table != NULL) { uint32_t state_count; for (state_count = 0; state_count < ctx->state_count; state_count++) { if (ctx->output_table[state_count].pids != NULL) { SCFree(ctx->output_table[state_count].pids); } } SCFree(ctx->output_table); } if (ctx->pid_pat_list != NULL) { uint32_t i; for (i = 0; i < (mpm_ctx->max_pat_id + 1); i++) { if (ctx->pid_pat_list[i].cs != NULL) SCFree(ctx->pid_pat_list[i].cs); if (ctx->pid_pat_list[i].sids != NULL) SCFree(ctx->pid_pat_list[i].sids); } SCFree(ctx->pid_pat_list); } SCFree(mpm_ctx->ctx); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCACCtx); return; } /** * \brief The aho corasick search function. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param pmq Pointer to the Pattern Matcher Queue to hold * search matches. * \param buf Buffer to be searched. * \param buflen Buffer length. * * \retval matches Match count. */ uint32_t SCACSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen) { const SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; int i = 0; int matches = 0; /* \todo tried loop unrolling with register var, with no perf increase. Need * to dig deeper */ /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */ SCACPatternList *pid_pat_list = ctx->pid_pat_list; uint8_t bitarray[ctx->pattern_id_bitarray_size]; memset(bitarray, 0, ctx->pattern_id_bitarray_size); if (ctx->state_count < 32767) { register SC_AC_STATE_TYPE_U16 state = 0; SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16; for (i = 0; i < buflen; i++) { state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])]; if (state & 0x8000) { uint32_t no_of_entries = ctx->output_table[state & 0x7FFF].no_of_entries; uint32_t *pids = ctx->output_table[state & 0x7FFF].pids; uint32_t k; for (k = 0; k < no_of_entries; k++) { if (pids[k] & AC_CASE_MASK) { uint32_t lower_pid = pids[k] & AC_PID_MASK; if (SCMemcmp(pid_pat_list[lower_pid].cs, buf + i - pid_pat_list[lower_pid].patlen + 1, pid_pat_list[lower_pid].patlen) != 0) { /* inside loop */ continue; } if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) { ; } else { bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8)); PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size); } matches++; } else { if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { ; } else { bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size); } matches++; } //loop1: //; } } } /* for (i = 0; i < buflen; i++) */ } else { register SC_AC_STATE_TYPE_U32 state = 0; SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32; for (i = 0; i < buflen; i++) { state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])]; if (state & 0xFF000000) { uint32_t no_of_entries = ctx->output_table[state & 0x00FFFFFF].no_of_entries; uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids; uint32_t k; for (k = 0; k < no_of_entries; k++) { if (pids[k] & AC_CASE_MASK) { uint32_t lower_pid = pids[k] & 0x0000FFFF; if (SCMemcmp(pid_pat_list[lower_pid].cs, buf + i - pid_pat_list[lower_pid].patlen + 1, pid_pat_list[lower_pid].patlen) != 0) { /* inside loop */ continue; } if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) { ; } else { bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8)); PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size); } matches++; } else { if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { ; } else { bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size); } matches++; } //loop1: //; } } } /* for (i = 0; i < buflen; i++) */ } return matches; } /** * \brief Add a case insensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patnen The pattern length. * \param offset Ignored. * \param depth Ignored. * \param pid The pattern id. * \param sid Ignored. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCACAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { flags |= MPM_PATTERN_FLAG_NOCASE; return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } /** * \brief Add a case sensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patnen The pattern length. * \param offset Ignored. * \param depth Ignored. * \param pid The pattern id. * \param sid Ignored. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCACAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } void SCACPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { #ifdef SC_AC_COUNTERS SCACThreadCtx *ctx = (SCACThreadCtx *)mpm_thread_ctx->ctx; printf("AC Thread Search stats (ctx %p)\n", ctx); printf("Total calls: %" PRIu32 "\n", ctx->total_calls); printf("Total matches: %" PRIu64 "\n", ctx->total_matches); #endif /* SC_AC_COUNTERS */ return; } void SCACPrintInfo(MpmCtx *mpm_ctx) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; printf("MPM AC Information:\n"); printf("Memory allocs: %" PRIu32 "\n", mpm_ctx->memory_cnt); printf("Memory alloced: %" PRIu32 "\n", mpm_ctx->memory_size); printf(" Sizeof:\n"); printf(" MpmCtx %" PRIuMAX "\n", (uintmax_t)sizeof(MpmCtx)); printf(" SCACCtx: %" PRIuMAX "\n", (uintmax_t)sizeof(SCACCtx)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf("Unique Patterns: %" PRIu32 "\n", mpm_ctx->pattern_cnt); printf("Smallest: %" PRIu32 "\n", mpm_ctx->minlen); printf("Largest: %" PRIu32 "\n", mpm_ctx->maxlen); printf("Total states in the state table: %" PRIu32 "\n", ctx->state_count); printf("\n"); return; } /****************************Cuda side of things****************************/ #ifdef __SC_CUDA_SUPPORT__ /* \todo Technically it's generic to all mpms, but since we use ac only, the * code internally directly references ac and hence it has found its * home in this file, instead of util-mpm.c */ void DetermineCudaStateTableSize(DetectEngineCtx *de_ctx) { MpmCtx *mpm_ctx = NULL; int ac_16_tables = 0; int ac_32_tables = 0; mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 0); if (mpm_ctx->mpm_type == MPM_AC_CUDA) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) ac_16_tables++; else ac_32_tables++; } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 1); if (mpm_ctx->mpm_type == MPM_AC_CUDA) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) ac_16_tables++; else ac_32_tables++; } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 0); if (mpm_ctx->mpm_type == MPM_AC_CUDA) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) ac_16_tables++; else ac_32_tables++; } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 1); if (mpm_ctx->mpm_type == MPM_AC_CUDA) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) ac_16_tables++; else ac_32_tables++; } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_other_packet, 0); if (mpm_ctx->mpm_type == MPM_AC_CUDA) { SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) ac_16_tables++; else ac_32_tables++; } if (ac_16_tables > 0 && ac_32_tables > 0) SCACConstructBoth16and32StateTables(); SCLogDebug("Total mpm ac 16 bit state tables - %d\n", ac_16_tables); SCLogDebug("Total mpm ac 32 bit state tables - %d\n", ac_32_tables); } void CudaReleasePacket(Packet *p) { if (p->cuda_pkt_vars.cuda_mpm_enabled == 1) { p->cuda_pkt_vars.cuda_mpm_enabled = 0; SCMutexLock(&p->cuda_pkt_vars.cuda_mutex); p->cuda_pkt_vars.cuda_done = 0; SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); } return; } /* \todos * - Use texture memory - Can we fit all the arrays into a 3d texture. * Texture memory definitely offers slightly better performance even * on gpus that offer cache for global memory. * - Packetpool - modify to support > 65k max pending packets. We are * hitting packetpool limit currently even with 65k packets. * - Use streams. We have tried overlapping parsing results from the * previous call with invoking the next call. * - Offer higher priority to decode threads. * - Modify pcap file mode to support reading from multiple pcap files * and hence we will have multiple receive threads. * - Split state table into many small pieces and have multiple threads * run each small state table on the same payload. * - Used a config peference of l1 over shared memory with no noticeable * perf increase. Explore it in detail over cards/architectures. * - Constant memory performance sucked. Explore it in detail. * - Currently all our state tables are small. Implement 16 bit state * tables on priority. * - Introduce profiling. * - Retrieve sgh before buffer packet. * - Buffer smsgs too. */ void SCACConstructBoth16and32StateTables(void) { construct_both_16_and_32_state_tables = 1; return; } /* \todo Reduce offset buffer size. Probably a 100,000 entry would be sufficient. */ static void *SCACCudaDispatcher(void *arg) { #define BLOCK_SIZE 32 int r = 0; ThreadVars *tv = (ThreadVars *)arg; MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); uint32_t sleep_interval_ms = conf->batching_timeout; SCLogInfo("AC Cuda Mpm Dispatcher using a timeout of " "\"%"PRIu32"\" micro-seconds", sleep_interval_ms); CudaBufferData *cb_data = CudaHandlerModuleGetData(MPM_AC_CUDA_MODULE_NAME, MPM_AC_CUDA_MODULE_CUDA_BUFFER_NAME); CUcontext cuda_context = CudaHandlerModuleGetContext(MPM_AC_CUDA_MODULE_NAME, conf->device_id); if (cuda_context == 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "context is NULL."); exit(EXIT_FAILURE); } r = SCCudaCtxPushCurrent(cuda_context); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "context push failed."); exit(EXIT_FAILURE); } CUmodule cuda_module = 0; if (CudaHandlerGetCudaModule(&cuda_module, "util-mpm-ac-cuda-kernel") < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error retrieving cuda module."); exit(EXIT_FAILURE); } CUfunction kernel = 0; #if __WORDSIZE==64 if (SCCudaModuleGetFunction(&kernel, cuda_module, "SCACCudaSearch64") == -1) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error retrieving kernel"); exit(EXIT_FAILURE); } #else if (SCCudaModuleGetFunction(&kernel, cuda_module, "SCACCudaSearch32") == -1) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error retrieving kernel"); exit(EXIT_FAILURE); } #endif uint8_t g_u8_lowercasetable[256]; for (int c = 0; c < 256; c++) g_u8_lowercasetable[c] = tolower((uint8_t)c); CUdeviceptr cuda_g_u8_lowercasetable_d = 0; CUdeviceptr cuda_packets_buffer_d = 0; CUdeviceptr cuda_offset_buffer_d = 0; CUdeviceptr cuda_results_buffer_d = 0; uint32_t *cuda_results_buffer_h = NULL; r = SCCudaMemAlloc(&cuda_g_u8_lowercasetable_d, sizeof(g_u8_lowercasetable)); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } r = SCCudaMemcpyHtoD(cuda_g_u8_lowercasetable_d, g_u8_lowercasetable, sizeof(g_u8_lowercasetable)); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemcpyHtoD failure."); exit(EXIT_FAILURE); } r = SCCudaMemAlloc(&cuda_packets_buffer_d, conf->gpu_transfer_size); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } r = SCCudaMemAlloc(&cuda_offset_buffer_d, conf->gpu_transfer_size * 4); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } r = SCCudaMemAlloc(&cuda_results_buffer_d, conf->gpu_transfer_size * 8); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } r = SCCudaMemAllocHost((void **)&cuda_results_buffer_h, conf->gpu_transfer_size * 8); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemAlloc failure."); exit(EXIT_FAILURE); } CudaBufferCulledInfo cb_culled_info; memset(&cb_culled_info, 0, sizeof(cb_culled_info)); TmThreadsSetFlag(tv, THV_INIT_DONE); while (1) { if (TmThreadsCheckFlag(tv, THV_KILL)) break; usleep(sleep_interval_ms); /**************** 1 SEND ****************/ CudaBufferCullCompletedSlices(cb_data, &cb_culled_info, conf->gpu_transfer_size); if (cb_culled_info.no_of_items == 0) continue; #if 0 SCLogInfo("1 - cb_culled_info.no_of_items-%"PRIu32" " "cb_culled_info.buffer_len - %"PRIu32" " "cb_culled_info.average size - %f " "cb_culled_info.d_buffer_start_offset - %"PRIu32" " "cb_culled_info.op_buffer_start_offset - %"PRIu32" " "cb_data.no_of_items - %"PRIu32" " "cb_data.d_buffer_read - %"PRIu32" " "cb_data.d_buffer_write - %"PRIu32" " "cb_data.op_buffer_read - %"PRIu32" " "cb_data.op_buffer_write - %"PRIu32"\n", cb_culled_info.no_of_items, cb_culled_info.d_buffer_len, cb_culled_info.d_buffer_len / (float)cb_culled_info.no_of_items, cb_culled_info.d_buffer_start_offset, cb_culled_info.op_buffer_start_offset, cb_data->no_of_items, cb_data->d_buffer_read, cb_data->d_buffer_write, cb_data->op_buffer_read, cb_data->op_buffer_write); #endif r = SCCudaMemcpyHtoDAsync(cuda_packets_buffer_d, (cb_data->d_buffer + cb_culled_info.d_buffer_start_offset), cb_culled_info.d_buffer_len, 0); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemcpyHtoD failure."); exit(EXIT_FAILURE); } r = SCCudaMemcpyHtoDAsync(cuda_offset_buffer_d, (cb_data->o_buffer + cb_culled_info.op_buffer_start_offset), sizeof(uint32_t) * cb_culled_info.no_of_items, 0); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemcpyHtoD failure."); exit(EXIT_FAILURE); } void *args[] = { &cuda_packets_buffer_d, &cb_culled_info.d_buffer_start_offset, &cuda_offset_buffer_d, &cuda_results_buffer_d, &cb_culled_info.no_of_items, &cuda_g_u8_lowercasetable_d }; r = SCCudaLaunchKernel(kernel, (cb_culled_info.no_of_items / BLOCK_SIZE) + 1, 1, 1, BLOCK_SIZE, 1, 1, 0, 0, args, NULL); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaLaunchKernel failure."); exit(EXIT_FAILURE); } r = SCCudaMemcpyDtoHAsync(cuda_results_buffer_h, cuda_results_buffer_d, sizeof(uint32_t) * (cb_culled_info.d_buffer_len * 2), 0); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaMemcpyDtoH failure."); exit(EXIT_FAILURE); } /**************** 1 SYNCHRO ****************/ r = SCCudaCtxSynchronize(); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "SCCudaCtxSynchronize failure."); exit(EXIT_FAILURE); } /************* 1 Parse Results ************/ uint32_t i_op_start_offset = cb_culled_info.op_buffer_start_offset; uint32_t no_of_items = cb_culled_info.no_of_items; uint32_t *o_buffer = cb_data->o_buffer; uint32_t d_buffer_start_offset = cb_culled_info.d_buffer_start_offset; for (uint32_t i = 0; i < no_of_items; i++, i_op_start_offset++) { Packet *p = (Packet *)cb_data->p_buffer[i_op_start_offset]; SCMutexLock(&p->cuda_pkt_vars.cuda_mutex); if (p->cuda_pkt_vars.cuda_mpm_enabled == 0) { p->cuda_pkt_vars.cuda_done = 0; SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); continue; } p->cuda_pkt_vars.cuda_gpu_matches = cuda_results_buffer_h[((o_buffer[i_op_start_offset] - d_buffer_start_offset) * 2)]; if (p->cuda_pkt_vars.cuda_gpu_matches != 0) { memcpy(p->cuda_pkt_vars.cuda_results, cuda_results_buffer_h + ((o_buffer[i_op_start_offset] - d_buffer_start_offset) * 2), (cuda_results_buffer_h[((o_buffer[i_op_start_offset] - d_buffer_start_offset) * 2)] * sizeof(uint32_t)) + 4); } p->cuda_pkt_vars.cuda_done = 1; SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); SCCondSignal(&p->cuda_pkt_vars.cuda_cond); } if (no_of_items != 0) CudaBufferReportCulledConsumption(cb_data, &cb_culled_info); } /* while (1) */ r = SCCudaModuleUnload(cuda_module); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error unloading cuda module."); exit(EXIT_FAILURE); } r = SCCudaMemFree(cuda_packets_buffer_d); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda device memory."); exit(EXIT_FAILURE); } r = SCCudaMemFree(cuda_offset_buffer_d); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda device memory."); exit(EXIT_FAILURE); } r = SCCudaMemFree(cuda_results_buffer_d); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda device memory."); exit(EXIT_FAILURE); } r = SCCudaMemFreeHost(cuda_results_buffer_h); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda host memory."); exit(EXIT_FAILURE); } TmThreadsSetFlag(tv, THV_RUNNING_DONE); TmThreadWaitForFlag(tv, THV_DEINIT); TmThreadsSetFlag(tv, THV_CLOSED); return NULL; #undef BLOCK_SIZE } uint32_t SCACCudaPacketResultsProcessing(Packet *p, const MpmCtx *mpm_ctx, PrefilterRuleStore *pmq) { uint32_t u = 0; while (!p->cuda_pkt_vars.cuda_done) { SCMutexLock(&p->cuda_pkt_vars.cuda_mutex); if (p->cuda_pkt_vars.cuda_done) { SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); break; } else { SCCondWait(&p->cuda_pkt_vars.cuda_cond, &p->cuda_pkt_vars.cuda_mutex); SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); } } /* while */ p->cuda_pkt_vars.cuda_done = 0; p->cuda_pkt_vars.cuda_mpm_enabled = 0; uint32_t cuda_matches = p->cuda_pkt_vars.cuda_gpu_matches; if (cuda_matches == 0) return 0; uint32_t matches = 0; uint32_t *results = p->cuda_pkt_vars.cuda_results + 1; uint8_t *buf = p->payload; SCACCtx *ctx = mpm_ctx->ctx; SCACOutputTable *output_table = ctx->output_table; SCACPatternList *pid_pat_list = ctx->pid_pat_list; uint8_t bitarray[ctx->pattern_id_bitarray_size]; memset(bitarray, 0, ctx->pattern_id_bitarray_size); for (u = 0; u < cuda_matches; u += 2) { uint32_t offset = results[u]; uint32_t state = results[u + 1]; /* we should technically be doing state & 0x00FFFFFF, but we don't * since the cuda kernel does that for us */ uint32_t no_of_entries = output_table[state].no_of_entries; /* we should technically be doing state & 0x00FFFFFF, but we don't * since the cuda kernel does that for us */ uint32_t *pids = output_table[state].pids; uint32_t k; /* note that this is not a verbatim copy from SCACSearch(). We * don't copy the pattern id into the pattern_id_array. That's * the only change */ for (k = 0; k < no_of_entries; k++) { if (pids[k] & AC_CASE_MASK) { uint32_t lower_pid = pids[k] & 0x0000FFFF; if (SCMemcmp(pid_pat_list[lower_pid].cs, buf + offset - pid_pat_list[lower_pid].patlen + 1, pid_pat_list[lower_pid].patlen) != 0) { /* inside loop */ continue; } if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) { ; } else { bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8)); PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size); } matches++; } else { if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { ; } else { bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size); } matches++; } } } return matches; } void SCACCudaStartDispatcher(void) { /* create the threads */ ThreadVars *tv = TmThreadCreate("Cuda_Mpm_AC_Dispatcher", NULL, NULL, NULL, NULL, "custom", SCACCudaDispatcher, 0); if (tv == NULL) { SCLogError(SC_ERR_THREAD_CREATE, "Error creating a thread for " "ac cuda dispatcher. Killing engine."); exit(EXIT_FAILURE); } if (TmThreadSpawn(tv) != 0) { SCLogError(SC_ERR_THREAD_SPAWN, "Failed to spawn thread for " "ac cuda dispatcher. Killing engine."); exit(EXIT_FAILURE); } return; } int MpmCudaBufferSetup(void) { int r = 0; MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); if (conf == NULL) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error obtaining cuda mpm profile."); return -1; } CUcontext cuda_context = CudaHandlerModuleGetContext(MPM_AC_CUDA_MODULE_NAME, conf->device_id); if (cuda_context == 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error retrieving cuda context."); return -1; } r = SCCudaCtxPushCurrent(cuda_context); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error pushing cuda context."); return -1; } uint8_t *d_buffer = NULL; uint32_t *o_buffer = NULL; void **p_buffer = NULL; r = SCCudaMemAllocHost((void *)&d_buffer, conf->cb_buffer_size); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Cuda alloc host failure."); return -1; } SCLogInfo("Allocated a cuda d_buffer - %"PRIu32" bytes", conf->cb_buffer_size); r = SCCudaMemAllocHost((void *)&o_buffer, sizeof(uint32_t) * UTIL_MPM_CUDA_CUDA_BUFFER_OPBUFFER_ITEMS_DEFAULT); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Cuda alloc host failue."); return -1; } r = SCCudaMemAllocHost((void *)&p_buffer, sizeof(void *) * UTIL_MPM_CUDA_CUDA_BUFFER_OPBUFFER_ITEMS_DEFAULT); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Cuda alloc host failure."); return -1; } r = SCCudaCtxPopCurrent(NULL); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "cuda context pop failure."); return -1; } CudaBufferData *cb = CudaBufferRegisterNew(d_buffer, conf->cb_buffer_size, o_buffer, p_buffer, UTIL_MPM_CUDA_CUDA_BUFFER_OPBUFFER_ITEMS_DEFAULT); if (cb == NULL) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error registering new cb instance."); return -1; } CudaHandlerModuleStoreData(MPM_AC_CUDA_MODULE_NAME, MPM_AC_CUDA_MODULE_CUDA_BUFFER_NAME, cb); return 0; } int MpmCudaBufferDeSetup(void) { int r = 0; MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); if (conf == NULL) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error obtaining cuda mpm profile."); return -1; } CudaBufferData *cb_data = CudaHandlerModuleGetData(MPM_AC_CUDA_MODULE_NAME, MPM_AC_CUDA_MODULE_CUDA_BUFFER_NAME); BUG_ON(cb_data == NULL); CUcontext cuda_context = CudaHandlerModuleGetContext(MPM_AC_CUDA_MODULE_NAME, conf->device_id); if (cuda_context == 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error retrieving cuda context."); return -1; } r = SCCudaCtxPushCurrent(cuda_context); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error pushing cuda context."); return -1; } r = SCCudaMemFreeHost(cb_data->d_buffer); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda host memory."); return -1; } r = SCCudaMemFreeHost(cb_data->o_buffer); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda host memory."); return -1; } r = SCCudaMemFreeHost(cb_data->p_buffer); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error freeing cuda host memory."); return -1; } r = SCCudaCtxPopCurrent(NULL); if (r < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "cuda context pop failure."); return -1; } CudaBufferDeRegister(cb_data); return 0; } #endif /* __SC_CUDA_SUPPORT */ /************************** Mpm Registration ***************************/ /** * \brief Register the aho-corasick mpm. */ void MpmACRegister(void) { mpm_table[MPM_AC].name = "ac"; mpm_table[MPM_AC].InitCtx = SCACInitCtx; mpm_table[MPM_AC].InitThreadCtx = SCACInitThreadCtx; mpm_table[MPM_AC].DestroyCtx = SCACDestroyCtx; mpm_table[MPM_AC].DestroyThreadCtx = SCACDestroyThreadCtx; mpm_table[MPM_AC].AddPattern = SCACAddPatternCS; mpm_table[MPM_AC].AddPatternNocase = SCACAddPatternCI; mpm_table[MPM_AC].Prepare = SCACPreparePatterns; mpm_table[MPM_AC].Search = SCACSearch; mpm_table[MPM_AC].PrintCtx = SCACPrintInfo; mpm_table[MPM_AC].PrintThreadCtx = SCACPrintSearchStats; mpm_table[MPM_AC].RegisterUnittests = SCACRegisterTests; return; } #ifdef __SC_CUDA_SUPPORT__ /** * \brief Register the aho-corasick cuda mpm. */ void MpmACCudaRegister(void) { mpm_table[MPM_AC_CUDA].name = "ac-cuda"; mpm_table[MPM_AC_CUDA].InitCtx = SCACInitCtx; mpm_table[MPM_AC_CUDA].InitThreadCtx = SCACInitThreadCtx; mpm_table[MPM_AC_CUDA].DestroyCtx = SCACDestroyCtx; mpm_table[MPM_AC_CUDA].DestroyThreadCtx = SCACDestroyThreadCtx; mpm_table[MPM_AC_CUDA].AddPattern = SCACAddPatternCS; mpm_table[MPM_AC_CUDA].AddPatternNocase = SCACAddPatternCI; mpm_table[MPM_AC_CUDA].Prepare = SCACPreparePatterns; mpm_table[MPM_AC_CUDA].Search = SCACSearch; mpm_table[MPM_AC_CUDA].PrintCtx = SCACPrintInfo; mpm_table[MPM_AC_CUDA].PrintThreadCtx = SCACPrintSearchStats; mpm_table[MPM_AC_CUDA].RegisterUnittests = SCACRegisterTests; return; } #endif /* __SC_CUDA_SUPPORT__ */ /*************************************Unittests********************************/ #ifdef UNITTESTS static int SCACTest01(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest02(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest03(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghj", 4, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest04(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghjxyz", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest05(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest06(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcd"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest07(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* should match 30 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 29 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 28 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAA", 3, 0, 0, 2, 0, 0); /* 26 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAA", 5, 0, 0, 3, 0, 0); /* 21 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAA", 10, 0, 0, 4, 0, 0); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30, 0, 0, 5, 0, 0); PmqSetup(&pmq); /* total matches: 135 */ SCACPreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 135) result = 1; else printf("135 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest08(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"a", 1); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest09(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"ab", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest10(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789" "abcdefgh" "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest11(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"he", 2, 0, 0, 1, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"she", 3, 0, 0, 2, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"his", 3, 0, 0, 3, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"hers", 4, 0, 0, 4, 0, 0) == -1) goto end; PmqSetup(&pmq); if (SCACPreparePatterns(&mpm_ctx) == -1) goto end; result = 1; char *buf = "he"; result &= (SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "she"; result &= (SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); buf = "his"; result &= (SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "hers"; result &= (SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); end: SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest12(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest13(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCD"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCD"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest14(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDE"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDE"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest15(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDEF"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDEF"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest16(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABC"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABC"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest17(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzAB"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzAB"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest18(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcde""fghij""klmno""pqrst""uvwxy""z"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcde""fghij""klmno""pqrst""uvwxy""z"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest19(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest20(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest21(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"AA", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest22(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest23(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 0) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest24(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCI(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest25(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghiJkl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest26(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "works"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest27(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ONE", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "tone"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest28(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC); SCACInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"one", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACPreparePatterns(&mpm_ctx); char *buf = "tONE"; uint32_t cnt = SCACSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACDestroyCtx(&mpm_ctx); SCACDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACTest29(void) { uint8_t *buf = (uint8_t *)"onetwothreefourfivesixseveneightnine"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; fast_pattern:3,3; sid:2;)"); if (de_ctx->sig_list->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 1) { printf("if (PacketAlertCheck(p, 1) != 1) failure\n"); goto end; } if (PacketAlertCheck(p, 2) != 1) { printf("if (PacketAlertCheck(p, 1) != 2) failure\n"); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void SCACRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCACTest01", SCACTest01); UtRegisterTest("SCACTest02", SCACTest02); UtRegisterTest("SCACTest03", SCACTest03); UtRegisterTest("SCACTest04", SCACTest04); UtRegisterTest("SCACTest05", SCACTest05); UtRegisterTest("SCACTest06", SCACTest06); UtRegisterTest("SCACTest07", SCACTest07); UtRegisterTest("SCACTest08", SCACTest08); UtRegisterTest("SCACTest09", SCACTest09); UtRegisterTest("SCACTest10", SCACTest10); UtRegisterTest("SCACTest11", SCACTest11); UtRegisterTest("SCACTest12", SCACTest12); UtRegisterTest("SCACTest13", SCACTest13); UtRegisterTest("SCACTest14", SCACTest14); UtRegisterTest("SCACTest15", SCACTest15); UtRegisterTest("SCACTest16", SCACTest16); UtRegisterTest("SCACTest17", SCACTest17); UtRegisterTest("SCACTest18", SCACTest18); UtRegisterTest("SCACTest19", SCACTest19); UtRegisterTest("SCACTest20", SCACTest20); UtRegisterTest("SCACTest21", SCACTest21); UtRegisterTest("SCACTest22", SCACTest22); UtRegisterTest("SCACTest23", SCACTest23); UtRegisterTest("SCACTest24", SCACTest24); UtRegisterTest("SCACTest25", SCACTest25); UtRegisterTest("SCACTest26", SCACTest26); UtRegisterTest("SCACTest27", SCACTest27); UtRegisterTest("SCACTest28", SCACTest28); UtRegisterTest("SCACTest29", SCACTest29); #endif return; } suricata-3.2.1/src/util-print.h0000644000000000000000000000510113051004444013256 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_PRINT_H__ #define __UTIL_PRINT_H__ #define PrintBufferData(buf, buf_offset_ptr, buf_size, ...) do { \ int cw = snprintf((buf) + *(buf_offset_ptr), \ (buf_size) - *(buf_offset_ptr), \ __VA_ARGS__); \ if (cw >= 0) { \ if ( (*(buf_offset_ptr) + cw) >= buf_size) { \ SCLogDebug("Truncating data write since it exceeded buffer " \ "limit of - %"PRIu32"\n", buf_size); \ *(buf_offset_ptr) = buf_size - 1; \ } else { \ *(buf_offset_ptr) += cw; \ } \ } \ } while (0) void PrintBufferRawLineHex(char *, int *,int, uint8_t *, uint32_t); void PrintRawUriFp(FILE *, uint8_t *, uint32_t); void PrintRawUriBuf(char *, uint32_t *, uint32_t, uint8_t *, uint32_t); void PrintRawJsonFp(FILE *, uint8_t *, uint32_t); void PrintRawDataFp(FILE *, const uint8_t *, uint32_t); void PrintRawDataToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, uint8_t *src_buf, uint32_t src_buf_len); void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, uint8_t *src_buf, uint32_t src_buf_len); void PrintRawLineHexBuf(char *, uint32_t, uint8_t *, uint32_t ); const char *PrintInet(int , const void *, char *, socklen_t); #endif /* __UTIL_PRINT_H__ */ suricata-3.2.1/src/detect-filestore.h0000644000000000000000000000266613051004444014426 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FILESTORE_H__ #define __DETECT_FILESTORE_H__ #define FILESTORE_DIR_DEFAULT 0 /* rule dir */ #define FILESTORE_DIR_TOSERVER 1 #define FILESTORE_DIR_TOCLIENT 2 #define FILESTORE_DIR_BOTH 3 #define FILESTORE_SCOPE_DEFAULT 0 /* per file */ #define FILESTORE_SCOPE_TX 1 /* per transaction */ #define FILESTORE_SCOPE_SSN 2 /* per flow/ssn */ typedef struct DetectFilestoreData_ { int16_t direction; int16_t scope; } DetectFilestoreData; /* prototypes */ void DetectFilestoreRegister (void); int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *); #endif /* __DETECT_FILESTORE_H__ */ suricata-3.2.1/src/util-ioctl.c0000644000000000000000000004677413051004444013254 00000000000000/* Copyright (C) 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * \author Victor Julien */ #include "suricata-common.h" #include "conf.h" #include "util-device.h" #ifdef HAVE_SYS_IOCTL_H #include #endif #ifdef HAVE_LINUX_ETHTOOL_H #include #include #ifdef HAVE_LINUX_SOCKIOS_H #include #else #error "ethtool.h present but sockios.h is missing" #endif /* HAVE_LINUX_SOCKIOS_H */ #endif /* HAVE_LINUX_ETHTOOL_H */ #ifdef HAVE_NET_IF_H #include #endif /** * \brief output a majorant of hardware header length * * \param Name of a network interface */ int GetIfaceMaxHWHeaderLength(const char *pcap_dev) { if ((!strcmp("eth", pcap_dev)) || (!strcmp("br", pcap_dev)) || (!strcmp("bond", pcap_dev)) || (!strcmp("wlan", pcap_dev)) || (!strcmp("tun", pcap_dev)) || (!strcmp("tap", pcap_dev)) || (!strcmp("lo", pcap_dev))) { /* Add possible VLAN tag or Qing headers */ return 8 + ETHERNET_HEADER_LEN; } if (!strcmp("ppp", pcap_dev)) return SLL_HEADER_LEN; /* SLL_HEADER_LEN is the biggest one and add possible VLAN tag and Qing headers */ return 8 + SLL_HEADER_LEN; } /** * \brief output the link MTU * * \param Name of link * \retval -1 in case of error, 0 if MTU can not be found */ int GetIfaceMTU(const char *pcap_dev) { #ifdef SIOCGIFMTU struct ifreq ifr; int fd; (void)strlcpy(ifr.ifr_name, pcap_dev, sizeof(ifr.ifr_name)); fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd == -1) { return -1; } if (ioctl(fd, SIOCGIFMTU, (char *)&ifr) < 0) { SCLogWarning(SC_ERR_SYSCALL, "Failure when trying to get MTU via ioctl for '%s': %s (%d)", pcap_dev, strerror(errno), errno); close(fd); return -1; } close(fd); SCLogInfo("Found an MTU of %d for '%s'", ifr.ifr_mtu, pcap_dev); return ifr.ifr_mtu; #else /* ioctl is not defined, let's pretend returning 0 is ok */ return 0; #endif } /** * \brief output max packet size for a link * * This does a best effort to find the maximum packet size * for the link. In case of uncertainty, it will output a * majorant to be sure avoid the cost of dynamic allocation. * * \param Name of a network interface * \retval 0 in case of error */ int GetIfaceMaxPacketSize(const char *pcap_dev) { if ((pcap_dev == NULL) || strlen(pcap_dev) == 0) return 0; int mtu = GetIfaceMTU(pcap_dev); switch (mtu) { case 0: case -1: return 0; } int ll_header = GetIfaceMaxHWHeaderLength(pcap_dev); if (ll_header == -1) { /* be conservative, choose a big one */ ll_header = 16; } return ll_header + mtu; } #ifdef SIOCGIFFLAGS /** * \brief Get interface flags. * \param ifname Inteface name. * \return Interface flags or -1 on error */ int GetIfaceFlags(const char *ifname) { struct ifreq ifr; int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFFLAGS, &ifr) == -1) { SCLogError(SC_ERR_SYSCALL, "Unable to get flags for iface \"%s\": %s", ifname, strerror(errno)); close(fd); return -1; } close(fd); #ifdef OS_FREEBSD int flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16); return flags; #else return ifr.ifr_flags; #endif } #endif #ifdef SIOCSIFFLAGS /** * \brief Set interface flags. * \param ifname Inteface name. * \param flags Flags to set. * \return Zero on success. */ int SetIfaceFlags(const char *ifname, int flags) { struct ifreq ifr; int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); #ifdef OS_FREEBSD ifr.ifr_flags = flags & 0xffff; ifr.ifr_flagshigh = flags >> 16; #else ifr.ifr_flags = flags; #endif if (ioctl(fd, SIOCSIFFLAGS, &ifr) == -1) { SCLogError(SC_ERR_SYSCALL, "Unable to set flags for iface \"%s\": %s", ifname, strerror(errno)); close(fd); return -1; } close(fd); return 0; } #endif /* SIOCGIFFLAGS */ #ifdef SIOCGIFCAP int GetIfaceCaps(const char *ifname) { struct ifreq ifr; int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFCAP, &ifr) == -1) { SCLogError(SC_ERR_SYSCALL, "Unable to get caps for iface \"%s\": %s", ifname, strerror(errno)); close(fd); return -1; } close(fd); return ifr.ifr_curcap; } #endif #ifdef SIOCSIFCAP int SetIfaceCaps(const char *ifname, int caps) { struct ifreq ifr; int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); ifr.ifr_reqcap = caps; if (ioctl(fd, SIOCSIFCAP, &ifr) == -1) { SCLogError(SC_ERR_SYSCALL, "Unable to set caps for iface \"%s\": %s", ifname, strerror(errno)); close(fd); return -1; } close(fd); return 0; } #endif #if defined HAVE_LINUX_ETHTOOL_H && defined SIOCETHTOOL static int GetEthtoolValue(const char *dev, int cmd, uint32_t *value) { struct ifreq ifr; int fd; struct ethtool_value ethv; fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd == -1) { return -1; } (void)strlcpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)); ethv.cmd = cmd; ifr.ifr_data = (void *) ðv; if (ioctl(fd, SIOCETHTOOL, (char *)&ifr) < 0) { SCLogWarning(SC_ERR_SYSCALL, "Failure when trying to get feature via ioctl for '%s': %s (%d)", dev, strerror(errno), errno); close(fd); return -1; } *value = ethv.data; close(fd); return 0; } static int SetEthtoolValue(const char *dev, int cmd, uint32_t value) { struct ifreq ifr; int fd; struct ethtool_value ethv; fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd == -1) { return -1; } (void)strlcpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name)); ethv.cmd = cmd; ethv.data = value; ifr.ifr_data = (void *) ðv; if (ioctl(fd, SIOCETHTOOL, (char *)&ifr) < 0) { SCLogWarning(SC_ERR_SYSCALL, "Failure when trying to get feature via ioctl for '%s': %s (%d)", dev, strerror(errno), errno); close(fd); return -1; } close(fd); return 0; } static int GetIfaceOffloadingLinux(const char *dev, int csum, int other) { int ret = 0; uint32_t value = 0; if (csum) { char *rx = "unset", *tx = "unset"; int csum_ret = 0; #ifdef ETHTOOL_GRXCSUM if (GetEthtoolValue(dev, ETHTOOL_GRXCSUM, &value) == 0 && value != 0) { rx = "SET"; csum_ret = 1; } #endif #ifdef ETHTOOL_GTXCSUM if (GetEthtoolValue(dev, ETHTOOL_GTXCSUM, &value) == 0 && value != 0) { tx = "SET"; csum_ret = 1; } #endif if (csum_ret == 0) SCLogPerf("NIC offloading on %s: RX %s TX %s", dev, rx, tx); else { SCLogWarning(SC_ERR_NIC_OFFLOADING, "NIC offloading on %s: RX %s TX %s. Run: " "ethtool -K %s rx off tx off", dev, rx, tx, dev); ret = 1; } } if (other) { char *lro = "unset", *gro = "unset", *tso = "unset", *gso = "unset"; char *sg = "unset"; int other_ret = 0; #ifdef ETHTOOL_GGRO if (GetEthtoolValue(dev, ETHTOOL_GGRO, &value) == 0 && value != 0) { gro = "SET"; other_ret = 1; } #endif #ifdef ETHTOOL_GTSO if (GetEthtoolValue(dev, ETHTOOL_GTSO, &value) == 0 && value != 0) { tso = "SET"; other_ret = 1; } #endif #ifdef ETHTOOL_GGSO if (GetEthtoolValue(dev, ETHTOOL_GGSO, &value) == 0 && value != 0) { gso = "SET"; other_ret = 1; } #endif #ifdef ETHTOOL_GSG if (GetEthtoolValue(dev, ETHTOOL_GSG, &value) == 0 && value != 0) { sg = "SET"; other_ret = 1; } #endif #ifdef ETHTOOL_GFLAGS if (GetEthtoolValue(dev, ETHTOOL_GFLAGS, &value) == 0) { if (value & ETH_FLAG_LRO) { lro = "SET"; other_ret = 1; } } #endif if (other_ret == 0) { SCLogPerf("NIC offloading on %s: SG: %s, GRO: %s, LRO: %s, " "TSO: %s, GSO: %s", dev, sg, gro, lro, tso, gso); } else { SCLogWarning(SC_ERR_NIC_OFFLOADING, "NIC offloading on %s: SG: %s, " " GRO: %s, LRO: %s, TSO: %s, GSO: %s. Run: " "ethtool -K %s sg off gro off lro off tso off gso off", dev, sg, gro, lro, tso, gso, dev); ret = 1; } } return ret; } static int DisableIfaceOffloadingLinux(LiveDevice *ldev, int csum, int other) { int ret = 0; uint32_t value = 0; if (ldev == NULL) return -1; const char *dev = ldev->dev; if (csum) { #ifdef ETHTOOL_GRXCSUM if (GetEthtoolValue(dev, ETHTOOL_GRXCSUM, &value) == 0 && value != 0) { SCLogPerf("%s: disabling rxcsum offloading", dev); SetEthtoolValue(dev, ETHTOOL_SRXCSUM, 0); ldev->offload_orig |= OFFLOAD_FLAG_RXCSUM; } #endif #ifdef ETHTOOL_GTXCSUM if (GetEthtoolValue(dev, ETHTOOL_GTXCSUM, &value) == 0 && value != 0) { SCLogPerf("%s: disabling txcsum offloading", dev); SetEthtoolValue(dev, ETHTOOL_STXCSUM, 0); ldev->offload_orig |= OFFLOAD_FLAG_TXCSUM; } #endif } if (other) { #ifdef ETHTOOL_GGRO if (GetEthtoolValue(dev, ETHTOOL_GGRO, &value) == 0 && value != 0) { SCLogPerf("%s: disabling gro offloading", dev); SetEthtoolValue(dev, ETHTOOL_SGRO, 0); ldev->offload_orig |= OFFLOAD_FLAG_GRO; } #endif #ifdef ETHTOOL_GTSO if (GetEthtoolValue(dev, ETHTOOL_GTSO, &value) == 0 && value != 0) { SCLogPerf("%s: disabling tso offloading", dev); SetEthtoolValue(dev, ETHTOOL_STSO, 0); ldev->offload_orig |= OFFLOAD_FLAG_TSO; } #endif #ifdef ETHTOOL_GGSO if (GetEthtoolValue(dev, ETHTOOL_GGSO, &value) == 0 && value != 0) { SCLogPerf("%s: disabling gso offloading", dev); SetEthtoolValue(dev, ETHTOOL_SGSO, 0); ldev->offload_orig |= OFFLOAD_FLAG_GSO; } #endif #ifdef ETHTOOL_GSG if (GetEthtoolValue(dev, ETHTOOL_GSG, &value) == 0 && value != 0) { SCLogPerf("%s: disabling sg offloading", dev); SetEthtoolValue(dev, ETHTOOL_SSG, 0); ldev->offload_orig |= OFFLOAD_FLAG_SG; } #endif #ifdef ETHTOOL_GFLAGS if (GetEthtoolValue(dev, ETHTOOL_GFLAGS, &value) == 0) { if (value & ETH_FLAG_LRO) { SCLogPerf("%s: disabling lro offloading", dev); SetEthtoolValue(dev, ETHTOOL_SFLAGS, value & ~ETH_FLAG_LRO); ldev->offload_orig |= OFFLOAD_FLAG_LRO; } } #endif } return ret; } static int RestoreIfaceOffloadingLinux(LiveDevice *ldev) { if (ldev == NULL) return -1; const char *dev = ldev->dev; #ifdef ETHTOOL_GRXCSUM if (ldev->offload_orig & OFFLOAD_FLAG_RXCSUM) { SCLogPerf("%s: restoring rxcsum offloading", dev); SetEthtoolValue(dev, ETHTOOL_SRXCSUM, 1); } #endif #ifdef ETHTOOL_GTXCSUM if (ldev->offload_orig & OFFLOAD_FLAG_TXCSUM) { SCLogPerf("%s: restoring txcsum offloading", dev); SetEthtoolValue(dev, ETHTOOL_STXCSUM, 1); } #endif #ifdef ETHTOOL_GGRO if (ldev->offload_orig & OFFLOAD_FLAG_GRO) { SCLogPerf("%s: restoring gro offloading", dev); SetEthtoolValue(dev, ETHTOOL_SGRO, 1); } #endif #ifdef ETHTOOL_GTSO if (ldev->offload_orig & OFFLOAD_FLAG_TSO) { SCLogPerf("%s: restoring tso offloading", dev); SetEthtoolValue(dev, ETHTOOL_STSO, 1); } #endif #ifdef ETHTOOL_GGSO if (ldev->offload_orig & OFFLOAD_FLAG_GSO) { SCLogPerf("%s: restoring gso offloading", dev); SetEthtoolValue(dev, ETHTOOL_SGSO, 1); } #endif #ifdef ETHTOOL_GSG if (ldev->offload_orig & OFFLOAD_FLAG_SG) { SCLogPerf("%s: restoring sg offloading", dev); SetEthtoolValue(dev, ETHTOOL_SSG, 1); } #endif #ifdef ETHTOOL_GFLAGS if (ldev->offload_orig & OFFLOAD_FLAG_LRO) { uint32_t value = 0; if (GetEthtoolValue(dev, ETHTOOL_GFLAGS, &value) == 0) { SCLogPerf("%s: restoring lro offloading", dev); SetEthtoolValue(dev, ETHTOOL_SFLAGS, value & ETH_FLAG_LRO); } } #endif return 0; } #endif /* defined HAVE_LINUX_ETHTOOL_H && defined SIOCETHTOOL */ #ifdef SIOCGIFCAP static int GetIfaceOffloadingBSD(const char *ifname) { int ret = 0; int if_caps = GetIfaceCaps(ifname); if (if_caps == -1) { return -1; } SCLogDebug("if_caps %X", if_caps); if (if_caps & IFCAP_RXCSUM) { SCLogWarning(SC_ERR_NIC_OFFLOADING, "Using %s with RXCSUM activated can lead to capture " "problems. Run: ifconfig %s -rxcsum", ifname, ifname); ret = 1; } #ifdef IFCAP_TOE if (if_caps & (IFCAP_TSO|IFCAP_TOE|IFCAP_LRO)) { SCLogWarning(SC_ERR_NIC_OFFLOADING, "Using %s with TSO, TOE or LRO activated can lead to " "capture problems. Run: ifconfig %s -tso -toe -lro", ifname, ifname); ret = 1; } #else if (if_caps & (IFCAP_TSO|IFCAP_LRO)) { SCLogWarning(SC_ERR_NIC_OFFLOADING, "Using %s with TSO or LRO activated can lead to " "capture problems. Run: ifconfig %s -tso -lro", ifname, ifname); ret = 1; } #endif return ret; } #endif #ifdef SIOCSIFCAP static int DisableIfaceOffloadingBSD(LiveDevice *ldev) { int ret = 0; if (ldev == NULL) return -1; const char *ifname = ldev->dev; int if_caps = GetIfaceCaps(ifname); int set_caps = if_caps; if (if_caps == -1) { return -1; } SCLogDebug("if_caps %X", if_caps); if (if_caps & IFCAP_RXCSUM) { SCLogPerf("%s: disabling rxcsum offloading", ifname); set_caps &= ~IFCAP_RXCSUM; } #ifdef IFCAP_TOE if (if_caps & (IFCAP_TSO|IFCAP_TOE|IFCAP_LRO)) { SCLogPerf("%s: disabling tso|toe|lro offloading", ifname); set_caps &= ~(IFCAP_TSO|IFCAP_LRO); } #else if (if_caps & (IFCAP_TSO|IFCAP_LRO)) { SCLogPerf("%s: disabling tso|lro offloading", ifname); set_caps &= ~(IFCAP_TSO|IFCAP_LRO); } #endif if (set_caps != if_caps) { if (if_caps & IFCAP_RXCSUM) ldev->offload_orig |= OFFLOAD_FLAG_RXCSUM; if (if_caps & IFCAP_TSO) ldev->offload_orig |= OFFLOAD_FLAG_TSO; #ifdef IFCAP_TOE if (if_caps & IFCAP_TOE) ldev->offload_orig |= OFFLOAD_FLAG_TOE; #endif if (if_caps & IFCAP_LRO) ldev->offload_orig |= OFFLOAD_FLAG_LRO; SetIfaceCaps(ifname, set_caps); } return ret; } static int RestoreIfaceOffloadingBSD(LiveDevice *ldev) { int ret = 0; if (ldev == NULL) return -1; const char *ifname = ldev->dev; int if_caps = GetIfaceCaps(ifname); int set_caps = if_caps; if (if_caps == -1) { return -1; } SCLogDebug("if_caps %X", if_caps); if (ldev->offload_orig & OFFLOAD_FLAG_RXCSUM) { SCLogPerf("%s: restoring rxcsum offloading", ifname); set_caps |= IFCAP_RXCSUM; } if (ldev->offload_orig & OFFLOAD_FLAG_TSO) { SCLogPerf("%s: restoring tso offloading", ifname); set_caps |= IFCAP_TSO; } #ifdef IFCAP_TOE if (ldev->offload_orig & OFFLOAD_FLAG_TOE) { SCLogPerf("%s: restoring toe offloading", ifname); set_caps |= IFCAP_TOE; } #endif if (ldev->offload_orig & OFFLOAD_FLAG_LRO) { SCLogPerf("%s: restoring lro offloading", ifname); set_caps |= IFCAP_LRO; } if (set_caps != if_caps) { SetIfaceCaps(ifname, set_caps); } return ret; } #endif /** * \brief output offloading status of the link * * Test interface for offloading features. If one of them is * activated then suricata mays received packets merge at reception. * The result is oversized packets and this may cause some serious * problem in some capture mode where the size of the packet is * limited (AF_PACKET in V2 more for example). * * \param Name of link * \param csum check if checksums are offloaded * \param other check if other things are offloaded: TSO, GRO, etc. * \retval -1 in case of error, 0 if none, 1 if some */ int GetIfaceOffloading(const char *dev, int csum, int other) { #if defined HAVE_LINUX_ETHTOOL_H && defined SIOCETHTOOL return GetIfaceOffloadingLinux(dev, csum, other); #elif defined SIOCGIFCAP return GetIfaceOffloadingBSD(dev); #else return 0; #endif } int DisableIfaceOffloading(LiveDevice *dev, int csum, int other) { #if defined HAVE_LINUX_ETHTOOL_H && defined SIOCETHTOOL return DisableIfaceOffloadingLinux(dev, csum, other); #elif defined SIOCSIFCAP return DisableIfaceOffloadingBSD(dev); #else return 0; #endif } void RestoreIfaceOffloading(LiveDevice *dev) { if (dev->offload_orig != 0) { #if defined HAVE_LINUX_ETHTOOL_H && defined SIOCETHTOOL RestoreIfaceOffloadingLinux(dev); #elif defined SIOCSIFCAP RestoreIfaceOffloadingBSD(dev); #endif } } int GetIfaceRSSQueuesNum(const char *pcap_dev) { #if defined HAVE_LINUX_ETHTOOL_H && defined ETHTOOL_GRXRINGS struct ifreq ifr; struct ethtool_rxnfc nfccmd; int fd; (void)strlcpy(ifr.ifr_name, pcap_dev, sizeof(ifr.ifr_name)); fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd == -1) { SCLogWarning(SC_ERR_SYSCALL, "Failure when opening socket for ioctl: %s (%d)", strerror(errno), errno); return -1; } nfccmd.cmd = ETHTOOL_GRXRINGS; ifr.ifr_data = (void*) &nfccmd; if (ioctl(fd, SIOCETHTOOL, (char *)&ifr) < 0) { if (errno != ENOTSUP) { SCLogWarning(SC_ERR_SYSCALL, "Failure when trying to get number of RSS queue ioctl for '%s': %s (%d)", pcap_dev, strerror(errno), errno); } close(fd); return 0; } close(fd); SCLogInfo("Found %d RX RSS queues for '%s'", (int)nfccmd.data, pcap_dev); return (int)nfccmd.data; #else return 0; #endif } suricata-3.2.1/src/util-daemon.h0000644000000000000000000000203513051004444013370 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias Galvan */ #ifndef __UTIL_DAEMON_H__ #define __UTIL_DAEMON_H__ /** \todo Adjust path */ #define DAEMON_WORKING_DIRECTORY "/" #ifdef OS_WIN32 #define Daemonize() #else void Daemonize (void); #endif int CheckValidDaemonModes (int, int); #endif /* __UTIL_DAEMON_H__ */ suricata-3.2.1/src/util-lua-http.c0000644000000000000000000002543113051004444013663 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" static int HttpGetRequestHost(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); if (tx->request_hostname == NULL) return LuaCallbackError(luastate, "no request hostname"); return LuaPushStringBuffer(luastate, bstr_ptr(tx->request_hostname), bstr_len(tx->request_hostname)); } static int HttpGetRequestUriRaw(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); if (tx->request_uri == NULL) return LuaCallbackError(luastate, "no request uri"); return LuaPushStringBuffer(luastate, bstr_ptr(tx->request_uri), bstr_len(tx->request_uri)); } static int HttpGetRequestUriNormalized(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud == NULL) return LuaCallbackError(luastate, "no htud in tx"); if (htud->request_uri_normalized == NULL || bstr_ptr(htud->request_uri_normalized) == NULL || bstr_len(htud->request_uri_normalized) == 0) return LuaCallbackError(luastate, "no normalized uri"); return LuaPushStringBuffer(luastate, bstr_ptr(htud->request_uri_normalized), bstr_len(htud->request_uri_normalized)); } static int HttpGetRequestLine(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); if (tx->request_line == NULL) return LuaCallbackError(luastate, "no request_line"); return LuaPushStringBuffer(luastate, bstr_ptr(tx->request_line), bstr_len(tx->request_line)); } static int HttpGetResponseLine(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); if (tx->response_line == NULL) return LuaCallbackError(luastate, "no response_line"); return LuaPushStringBuffer(luastate, bstr_ptr(tx->response_line), bstr_len(tx->response_line)); } static int HttpGetHeader(lua_State *luastate, int dir) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); const char *name = LuaGetStringArgument(luastate, 1); if (name == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); htp_table_t *headers = tx->request_headers; if (dir == 1) headers = tx->response_headers; if (headers == NULL) return LuaCallbackError(luastate, "tx has no headers"); htp_header_t *h = (htp_header_t *)htp_table_get_c(headers, name); if (h == NULL || bstr_len(h->value) == 0) return LuaCallbackError(luastate, "header not found"); return LuaPushStringBuffer(luastate, bstr_ptr(h->value), bstr_len(h->value)); } static int HttpGetRequestHeader(lua_State *luastate) { return HttpGetHeader(luastate, 0 /* request */); } static int HttpGetResponseHeader(lua_State *luastate) { return HttpGetHeader(luastate, 1 /* response */); } static int HttpGetRawHeaders(lua_State *luastate, int dir) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud == NULL) return LuaCallbackError(luastate, "no htud in tx"); uint8_t *raw = htud->request_headers_raw; uint32_t raw_len = htud->request_headers_raw_len; if (dir == 1) { raw = htud->response_headers_raw; raw_len = htud->response_headers_raw_len; } if (raw == NULL || raw_len == 0) return LuaCallbackError(luastate, "no raw headers"); return LuaPushStringBuffer(luastate, raw, raw_len); } static int HttpGetRawRequestHeaders(lua_State *luastate) { return HttpGetRawHeaders(luastate, 0); } static int HttpGetRawResponseHeaders(lua_State *luastate) { return HttpGetRawHeaders(luastate, 1); } static int HttpGetHeaders(lua_State *luastate, int dir) { if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); htp_table_t *table = tx->request_headers; if (dir == 1) table = tx->response_headers; if (tx->request_headers == NULL) return LuaCallbackError(luastate, "no headers"); lua_newtable(luastate); htp_header_t *h = NULL; size_t i = 0; size_t no_of_headers = htp_table_size(table); for (; i < no_of_headers; i++) { h = htp_table_get_index(table, i, NULL); LuaPushStringBuffer(luastate, bstr_ptr(h->name), bstr_len(h->name)); LuaPushStringBuffer(luastate, bstr_ptr(h->value), bstr_len(h->value)); lua_settable(luastate, -3); } return 1; } /** \brief return request headers as lua table */ static int HttpGetRequestHeaders(lua_State *luastate) { return HttpGetHeaders(luastate, 0); } /** \brief return response headers as lua table */ static int HttpGetResponseHeaders(lua_State *luastate) { return HttpGetHeaders(luastate, 1); } static int HttpGetBody(lua_State *luastate, int dir) { HtpBody *body = NULL; if (!(LuaStateNeedProto(luastate, ALPROTO_HTTP))) return LuaCallbackError(luastate, "error: protocol not http"); htp_tx_t *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud == NULL) return LuaCallbackError(luastate, "no htud in tx"); if (dir == 0) body = &htud->request_body; else body = &htud->response_body; if (body->first == NULL) return LuaCallbackError(luastate, "no body"); int index = 1; HtpBodyChunk *chunk = body->first; lua_newtable(luastate); while (chunk != NULL) { lua_pushinteger(luastate, index); const uint8_t *data = NULL; uint32_t data_len = 0; StreamingBufferSegmentGetData(body->sb, &chunk->sbseg, &data, &data_len); LuaPushStringBuffer(luastate, data, data_len); lua_settable(luastate, -3); chunk = chunk->next; index++; } if (body->first && body->last) { lua_pushinteger(luastate, body->first->sbseg.stream_offset); lua_pushinteger(luastate, body->last->sbseg.stream_offset + body->last->sbseg.segment_len); return 3; } else { return 1; } } static int HttpGetRequestBody(lua_State *luastate) { return HttpGetBody(luastate, 0); } static int HttpGetResponseBody(lua_State *luastate) { return HttpGetBody(luastate, 1); } /** \brief register http lua extensions in a luastate */ int LuaRegisterHttpFunctions(lua_State *luastate) { /* registration of the callbacks */ lua_pushcfunction(luastate, HttpGetRequestHeader); lua_setglobal(luastate, "HttpGetRequestHeader"); lua_pushcfunction(luastate, HttpGetResponseHeader); lua_setglobal(luastate, "HttpGetResponseHeader"); lua_pushcfunction(luastate, HttpGetRequestLine); lua_setglobal(luastate, "HttpGetRequestLine"); lua_pushcfunction(luastate, HttpGetResponseLine); lua_setglobal(luastate, "HttpGetResponseLine"); lua_pushcfunction(luastate, HttpGetRawRequestHeaders); lua_setglobal(luastate, "HttpGetRawRequestHeaders"); lua_pushcfunction(luastate, HttpGetRawResponseHeaders); lua_setglobal(luastate, "HttpGetRawResponseHeaders"); lua_pushcfunction(luastate, HttpGetRequestUriRaw); lua_setglobal(luastate, "HttpGetRequestUriRaw"); lua_pushcfunction(luastate, HttpGetRequestUriNormalized); lua_setglobal(luastate, "HttpGetRequestUriNormalized"); lua_pushcfunction(luastate, HttpGetRequestHeaders); lua_setglobal(luastate, "HttpGetRequestHeaders"); lua_pushcfunction(luastate, HttpGetResponseHeaders); lua_setglobal(luastate, "HttpGetResponseHeaders"); lua_pushcfunction(luastate, HttpGetRequestHost); lua_setglobal(luastate, "HttpGetRequestHost"); lua_pushcfunction(luastate, HttpGetRequestBody); lua_setglobal(luastate, "HttpGetRequestBody"); lua_pushcfunction(luastate, HttpGetResponseBody); lua_setglobal(luastate, "HttpGetResponseBody"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/util-spm-bm.c0000644000000000000000000003464613051004444013330 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Boyer Moore simple pattern matcher implementation * * Boyer Moore algorithm has a really good performance. It need two arrays * of context for each pattern that hold applicable shifts on the text * to seach in, based on characters not available in the pattern * and combinations of characters that start a sufix of the pattern. * If possible, we should store the context of patterns that we are going * to search for multiple times, so we don't spend time on rebuilding them. */ #include "suricata-common.h" #include "suricata.h" #include "util-spm-bm.h" #include "util-spm.h" #include "util-debug.h" #include "util-error.h" #include "util-memcpy.h" static int PreBmGs(const uint8_t *x, uint16_t m, uint16_t *bmGs); static void PreBmBc(const uint8_t *x, uint16_t m, uint16_t *bmBc); static void PreBmBcNocase(const uint8_t *x, uint16_t m, uint16_t *bmBc); static void BoyerMooreSuffixesNocase(const uint8_t *x, uint16_t m, uint16_t *suff); static void PreBmGsNocase(const uint8_t *x, uint16_t m, uint16_t *bmGs); /** * \brief Given a BmCtx structure, recreate the pre/suffixes for * nocase * * \retval BmCtx pointer to the already created BmCtx (with BoyerMooreCtxInit()) * \param str pointer to the pattern string * \param size length of the string */ void BoyerMooreCtxToNocase(BmCtx *bm_ctx, uint8_t *needle, uint16_t needle_len) { /* Store the content as lower case to make searching faster */ memcpy_tolower(needle, needle, needle_len); /* Prepare bad chars with nocase chars */ PreBmBcNocase(needle, needle_len, bm_ctx->bmBc); /* Prepare good Suffixes with nocase chars */ PreBmGsNocase(needle, needle_len, bm_ctx->bmGs); } /** * \brief Setup a Booyer Moore context. * * \param str pointer to the pattern string * \param size length of the string * \retval BmCtx pointer to the newly created Context for the pattern * \initonly BoyerMoore contexts should be created at init */ BmCtx *BoyerMooreCtxInit(const uint8_t *needle, uint16_t needle_len) { BmCtx *new = SCMalloc(sizeof(BmCtx)); if (unlikely(new == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in BoyerMooreCtxInit. Exiting..."); exit(EXIT_FAILURE); } /* Prepare bad chars */ PreBmBc(needle, needle_len, new->bmBc); new->bmGs = SCMalloc(sizeof(uint16_t) * (needle_len + 1)); if (new->bmGs == NULL) { exit(EXIT_FAILURE); } /* Prepare good Suffixes */ if (PreBmGs(needle, needle_len, new->bmGs) == -1) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in BooyerMooreCtxInit. Exiting..."); exit(EXIT_FAILURE); } return new; } /** * \brief Setup a Booyer Moore context for nocase search * * \param str pointer to the pattern string * \param size length of the string * \retval BmCtx pointer to the newly created Context for the pattern * \initonly BoyerMoore contexts should be created at init */ BmCtx *BoyerMooreNocaseCtxInit(uint8_t *needle, uint16_t needle_len) { BmCtx *bm_ctx = BoyerMooreCtxInit(needle, needle_len); BoyerMooreCtxToNocase(bm_ctx, needle, needle_len); return bm_ctx; } /** * \brief Free the memory allocated to Booyer Moore context. * * \param bmCtx pointer to the Context for the pattern */ void BoyerMooreCtxDeInit(BmCtx *bmctx) { SCEnter(); if (bmctx == NULL) SCReturn; if (bmctx->bmGs != NULL) SCFree(bmctx->bmGs); SCFree(bmctx); SCReturn; } /** * \brief Array setup function for bad characters that split the pattern * Remember that the result array should be the length of ALPHABET_SIZE * * \param str pointer to the pattern string * \param size length of the string * \param result pointer to an empty array that will hold the badchars */ static void PreBmBc(const uint8_t *x, uint16_t m, uint16_t *bmBc) { int32_t i; for (i = 0; i < 256; ++i) { bmBc[i] = m; } for (i = 0; i < m - 1; ++i) { bmBc[(unsigned char)x[i]] = m - i - 1; } } /** * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context * * \param x pointer to the pattern string * \param m length of the string * \param suff pointer to an empty array that will hold the prefixes (shifts) */ static void BoyerMooreSuffixes(const uint8_t *x, uint16_t m, uint16_t *suff) { int32_t f = 0, g, i; suff[m - 1] = m; g = m - 1; for (i = m - 2; i >= 0; --i) { if (i > g && suff[i + m - 1 - f] < i - g) suff[i] = suff[i + m - 1 - f]; else { if (i < g) g = i; f = i; while (g >= 0 && x[g] == x[g + m - 1 - f]) --g; suff[i] = f - g; } } } /** * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context * * \param x pointer to the pattern string * \param m length of the string * \param bmGs pointer to an empty array that will hold the prefixes (shifts) * \retval 0 ok, -1 failed */ static int PreBmGs(const uint8_t *x, uint16_t m, uint16_t *bmGs) { int32_t i, j; uint16_t suff[m + 1]; BoyerMooreSuffixes(x, m, suff); for (i = 0; i < m; ++i) bmGs[i] = m; j = 0; for (i = m - 1; i >= -1; --i) if (i == -1 || suff[i] == i + 1) for (; j < m - 1 - i; ++j) if (bmGs[j] == m) bmGs[j] = m - 1 - i; for (i = 0; i <= m - 2; ++i) bmGs[m - 1 - suff[i]] = m - 1 - i; return 0; } /** * \brief Array setup function for bad characters that split the pattern * Remember that the result array should be the length of ALPHABET_SIZE * * \param str pointer to the pattern string * \param size length of the string * \param result pointer to an empty array that will hold the badchars */ static void PreBmBcNocase(const uint8_t *x, uint16_t m, uint16_t *bmBc) { int32_t i; for (i = 0; i < 256; ++i) { bmBc[i] = m; } for (i = 0; i < m - 1; ++i) { bmBc[u8_tolower((unsigned char)x[i])] = m - 1 - i; } } static void BoyerMooreSuffixesNocase(const uint8_t *x, uint16_t m, uint16_t *suff) { int32_t f = 0, g, i; suff[m - 1] = m; g = m - 1; for (i = m - 2; i >= 0; --i) { if (i > g && suff[i + m - 1 - f] < i - g) { suff[i] = suff[i + m - 1 - f]; } else { if (i < g) { g = i; } f = i; while (g >= 0 && u8_tolower(x[g]) == u8_tolower(x[g + m - 1 - f])) { --g; } suff[i] = f - g; } } } /** * \brief Array setup function for building prefixes (shift for valid prefixes) * for boyermoore context case less * * \param x pointer to the pattern string * \param m length of the string * \param bmGs pointer to an empty array that will hold the prefixes (shifts) */ static void PreBmGsNocase(const uint8_t *x, uint16_t m, uint16_t *bmGs) { int32_t i, j; uint16_t suff[m + 1]; BoyerMooreSuffixesNocase(x, m, suff); for (i = 0; i < m; ++i) { bmGs[i] = m; } j = 0; for (i = m - 1; i >= 0; --i) { if (i == -1 || suff[i] == i + 1) { for (; j < m - 1 - i; ++j) { if (bmGs[j] == m) { bmGs[j] = m - 1 - i; } } } } for (i = 0; i <= m - 2; ++i) { bmGs[m - 1 - suff[i]] = m - 1 - i; } } /** * \brief Boyer Moore search algorithm * Is better as the pattern length increases and for big buffers to search in. * The algorithm needs a context of two arrays already prepared * by prep_bad_chars() and prep_good_suffix() * * \param y pointer to the buffer to search in * \param n length limit of the buffer * \param x pointer to the pattern we ar searching for * \param m length limit of the needle * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() * * \retval ptr to start of the match; NULL if no match */ uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx) { uint16_t *bmGs = bm_ctx->bmGs; uint16_t *bmBc = bm_ctx->bmBc; int i, j, m1, m2; #if 0 printf("\nBad:\n"); for (i=0;i= 0 && x[i] == y[i + j]; --i); if (i < 0) { return (uint8_t *)(y + j); //j += bmGs[0]; } else { // printf("%c", y[i+j]); j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2; // printf("%d, %d\n", m1, m2); } } return NULL; } /** * \brief Boyer Moore search algorithm * Is better as the pattern length increases and for big buffers to search in. * The algorithm needs a context of two arrays already prepared * by prep_bad_chars() and prep_good_suffix() * * \param y pointer to the buffer to search in * \param n length limit of the buffer * \param x pointer to the pattern we ar searching for * \param m length limit of the needle * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix() * \param bmGs pointer to an array of bachars prepared by prep_bad_chars() * * \retval ptr to start of the match; NULL if no match */ uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx) { uint16_t *bmGs = bm_ctx->bmGs; uint16_t *bmBc = bm_ctx->bmBc; int i, j, m1, m2; #if 0 printf("\nBad:\n"); for (i=0;i= 0 && x[i] == u8_tolower(y[i + j]); --i); if (i < 0) { return (uint8_t *)(y + j); } else { j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2; } } return NULL; } typedef struct SpmBmCtx_ { BmCtx *bm_ctx; uint8_t *needle; uint16_t needle_len; int nocase; } SpmBmCtx; static SpmCtx *BMInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx) { SpmCtx *ctx = SCMalloc(sizeof(SpmCtx)); if (ctx == NULL) { SCLogDebug("Unable to alloc SpmCtx."); return NULL; } memset(ctx, 0, sizeof(*ctx)); ctx->matcher = SPM_BM; SpmBmCtx *sctx = SCMalloc(sizeof(SpmBmCtx)); if (sctx == NULL) { SCLogDebug("Unable to alloc SpmBmCtx."); SCFree(ctx); return NULL; } memset(sctx, 0, sizeof(*sctx)); sctx->needle = SCMalloc(needle_len); if (sctx->needle == NULL) { SCLogDebug("Unable to alloc string."); SCFree(sctx); SCFree(ctx); return NULL; } memcpy(sctx->needle, needle, needle_len); sctx->needle_len = needle_len; if (nocase) { sctx->bm_ctx = BoyerMooreNocaseCtxInit(sctx->needle, sctx->needle_len); sctx->nocase = 1; } else { sctx->bm_ctx = BoyerMooreCtxInit(sctx->needle, sctx->needle_len); sctx->nocase = 0; } ctx->ctx = sctx; return ctx; } static void BMDestroyCtx(SpmCtx *ctx) { if (ctx == NULL) { return; } SpmBmCtx *sctx = ctx->ctx; if (sctx != NULL) { BoyerMooreCtxDeInit(sctx->bm_ctx); if (sctx->needle != NULL) { SCFree(sctx->needle); } SCFree(sctx); } SCFree(ctx); } static uint8_t *BMScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint16_t haystack_len) { const SpmBmCtx *sctx = ctx->ctx; if (sctx->nocase) { return BoyerMooreNocase(sctx->needle, sctx->needle_len, haystack, haystack_len, sctx->bm_ctx); } else { return BoyerMoore(sctx->needle, sctx->needle_len, haystack, haystack_len, sctx->bm_ctx); } } static SpmGlobalThreadCtx *BMInitGlobalThreadCtx(void) { SpmGlobalThreadCtx *global_thread_ctx = SCMalloc(sizeof(SpmGlobalThreadCtx)); if (global_thread_ctx == NULL) { SCLogDebug("Unable to alloc SpmThreadCtx."); return NULL; } memset(global_thread_ctx, 0, sizeof(*global_thread_ctx)); global_thread_ctx->matcher = SPM_BM; return global_thread_ctx; } static void BMDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx) { if (global_thread_ctx == NULL) { return; } SCFree(global_thread_ctx); } static void BMDestroyThreadCtx(SpmThreadCtx *thread_ctx) { if (thread_ctx == NULL) { return; } SCFree(thread_ctx); } static SpmThreadCtx *BMMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx) { SpmThreadCtx *thread_ctx = SCMalloc(sizeof(SpmThreadCtx)); if (thread_ctx == NULL) { SCLogDebug("Unable to alloc SpmThreadCtx."); return NULL; } memset(thread_ctx, 0, sizeof(*thread_ctx)); thread_ctx->matcher = SPM_BM; return thread_ctx; } void SpmBMRegister(void) { spm_table[SPM_BM].name = "bm"; spm_table[SPM_BM].InitGlobalThreadCtx = BMInitGlobalThreadCtx; spm_table[SPM_BM].DestroyGlobalThreadCtx = BMDestroyGlobalThreadCtx; spm_table[SPM_BM].MakeThreadCtx = BMMakeThreadCtx; spm_table[SPM_BM].DestroyThreadCtx = BMDestroyThreadCtx; spm_table[SPM_BM].InitCtx = BMInitCtx; spm_table[SPM_BM].DestroyCtx = BMDestroyCtx; spm_table[SPM_BM].Scan = BMScan; } suricata-3.2.1/src/detect-template.h0000644000000000000000000000253013051004444014233 00000000000000/* Copyright (C) 2015-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author XXX Yourname */ #ifndef __DETECT_TEMPLATE_H__ #define __DETECT_TEMPLATE_H__ /** Per keyword data. This is set up by the DetectTemplateSetup() function. * Each signature will have an instance of DetectTemplateData per occurence * of the keyword. * The structure should be considered static/readonly after initialization. */ typedef struct DetectTemplateData_ { uint8_t arg1; uint8_t arg2; } DetectTemplateData; /** \brief registers the keyword into the engine. Called from * detect.c::SigTableSetup() */ void DetectTemplateRegister(void); #endif /* __DETECT_TEMPLATE_H__ */ suricata-3.2.1/src/detect-filesha256.c0000644000000000000000000001313213051004444014263 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva * */ #include "suricata-common.h" #include "util-detect-file-hash.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-filesha256.h" #ifndef HAVE_NSS static int DetectFileSha256SetupNoSupport (DetectEngineCtx *a, Signature *b, char *c) { SCLogError(SC_ERR_NO_SHA256_SUPPORT, "no SHA-256 calculation support built in, needed for filesha256 keyword"); return -1; } /** * \brief Registration function for keyword: filesha256 */ void DetectFileSha256Register(void) { sigmatch_table[DETECT_FILESHA256].name = "filesha256"; sigmatch_table[DETECT_FILESHA256].FileMatch = NULL; sigmatch_table[DETECT_FILESHA256].Setup = DetectFileSha256SetupNoSupport; sigmatch_table[DETECT_FILESHA256].Free = NULL; sigmatch_table[DETECT_FILESHA256].RegisterTests = NULL; sigmatch_table[DETECT_FILESHA256].flags = SIGMATCH_NOT_BUILT; SCLogDebug("registering filesha256 rule option"); return; } #else /* HAVE_NSS */ static int DetectFileSha256Setup (DetectEngineCtx *, Signature *, char *); static void DetectFileSha256RegisterTests(void); /** * \brief Registration function for keyword: filesha256 */ void DetectFileSha256Register(void) { sigmatch_table[DETECT_FILESHA256].name = "filesha256"; sigmatch_table[DETECT_FILESHA256].desc = "match file SHA-256 against list of SHA-256 checksums"; sigmatch_table[DETECT_FILESHA256].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha256"; sigmatch_table[DETECT_FILESHA256].FileMatch = DetectFileHashMatch; sigmatch_table[DETECT_FILESHA256].Setup = DetectFileSha256Setup; sigmatch_table[DETECT_FILESHA256].Free = DetectFileHashFree; sigmatch_table[DETECT_FILESHA256].RegisterTests = DetectFileSha256RegisterTests; SCLogDebug("registering filesha256 rule option"); return; } /** * \brief this function is used to parse filesha256 options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filesha256" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFileSha256Setup (DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectFileHashSetup(de_ctx, s, str, DETECT_FILESHA256); } #ifdef UNITTESTS static int SHA256MatchLookupString(ROHashTable *hash, char *string) { uint8_t sha256[32]; if (ReadHashString(sha256, string, "file", 88, 64) == 1) { void *ptr = ROHashLookup(hash, &sha256, (uint16_t)sizeof(sha256)); if (ptr == NULL) return 0; else return 1; } return 0; } static int SHA256MatchTest01(void) { ROHashTable *hash = ROHashInit(4, 32); if (hash == NULL) { return 0; } if (LoadHashTable(hash, "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8", "file", 1, DETECT_FILESHA256) != 1) return 0; if (LoadHashTable(hash, "6eee51705f34b6cfc7f0c872a7949ec3e3172a908303baf5d67d03b98f70e7e3", "file", 2, DETECT_FILESHA256) != 1) return 0; if (LoadHashTable(hash, "b12c7d57507286bbbe36d7acf9b34c22c96606ffd904e3c23008399a4a50c047", "file", 3, DETECT_FILESHA256) != 1) return 0; if (LoadHashTable(hash, "ca496e1ddadc290050339dd75ce8830ad3028ce1556a5368874a4aec3aee114b", "file", 4, DETECT_FILESHA256) != 1) return 0; if (LoadHashTable(hash, "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "file", 5, DETECT_FILESHA256) != 1) return 0; if (LoadHashTable(hash, "d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9", "file", 6, DETECT_FILESHA256) != 1) return 0; if (ROHashInitFinalize(hash) != 1) { return 0; } if (SHA256MatchLookupString(hash, "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8") != 1) return 0; if (SHA256MatchLookupString(hash, "6eee51705f34b6cfc7f0c872a7949ec3e3172a908303baf5d67d03b98f70e7e3") != 1) return 0; if (SHA256MatchLookupString(hash, "b12c7d57507286bbbe36d7acf9b34c22c96606ffd904e3c23008399a4a50c047") != 1) return 0; if (SHA256MatchLookupString(hash, "ca496e1ddadc290050339dd75ce8830ad3028ce1556a5368874a4aec3aee114b") != 1) return 0; if (SHA256MatchLookupString(hash, "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f") != 1) return 0; if (SHA256MatchLookupString(hash, "d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9") != 1) return 0; /* Shouldn't match */ if (SHA256MatchLookupString(hash, "3333333333333333333333333333333333333333333333333333333333333333") == 1) return 0; ROHashFree(hash); return 1; } #endif void DetectFileSha256RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SHA256MatchTest01", SHA256MatchTest01); #endif } #endif /* HAVE_NSS */ suricata-3.2.1/src/detect-http-hrh.h0000644000000000000000000000163013051004444014156 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_HTTP_HRH_H__ #define __DETECT_HTTP_HRH_H__ void DetectHttpHRHRegister(void); #endif /* __DETECT_HTTP_HRH_H__ */ suricata-3.2.1/src/output-lua.h0000644000000000000000000000157013051004444013274 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __OUTPUT_LUA_H__ #define __OUTPUT_LUA_H__ void LuaLogRegister(void); #endif /* __OUTPUT_LUA_H__ */ suricata-3.2.1/src/detect-http-method.h0000644000000000000000000000215313051004444014656 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_HTTP_METHOD_H__ #define __DETECT_HTTP_METHOD_H__ /* prototypes */ void DetectHttpMethodRegister(void); int DetectHttpMethodDoMatch(DetectEngineThreadCtx *, Signature *, SigMatch *, Flow *, uint8_t, void *); int DetectHttpMethodValidateRule(const Signature *s); #endif /* __DETECT_HTTP_METHOD_H__ */ suricata-3.2.1/src/app-layer-dns-udp.h0000644000000000000000000000216013051004444014413 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * \author Victor Julien */ #ifndef __APP_LAYER_DNS_UDP_H__ #define __APP_LAYER_DNS_UDP_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-dns-common.h" #include "flow.h" #include "queue.h" #include "util-byte.h" void RegisterDNSUDPParsers(void); void DNSUDPParserTests(void); void DNSUDPParserRegisterTests(void); #endif /* __APP_LAYER_DNS_UDP_H__ */ suricata-3.2.1/src/detect-nocase.c0000644000000000000000000001243413051004444013667 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the nocase keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "flow-var.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-pcre.h" #include "detect-http-client-body.h" #include "detect-http-cookie.h" #include "detect-http-header.h" #include "detect-http-method.h" #include "detect-http-uri.h" #include "util-debug.h" static int DetectNocaseSetup (DetectEngineCtx *, Signature *, char *); void DetectNocaseRegister(void) { sigmatch_table[DETECT_NOCASE].name = "nocase"; sigmatch_table[DETECT_NOCASE].desc = "modify content match to be case insensitive"; sigmatch_table[DETECT_NOCASE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#nocase"; sigmatch_table[DETECT_NOCASE].Match = NULL; sigmatch_table[DETECT_NOCASE].Setup = DetectNocaseSetup; sigmatch_table[DETECT_NOCASE].Free = NULL; sigmatch_table[DETECT_NOCASE].RegisterTests = NULL; sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD; } /** * \internal * \brief Apply the nocase keyword to the last pattern match, either content or uricontent * \param det_ctx detection engine ctx * \param s signature * \param nullstr should be null * \retval 0 ok * \retval -1 failure */ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr) { SCEnter(); SigMatch *pm = NULL; int ret = -1; if (nullstr != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "nocase has value"); goto end; } /* retrive the sm to apply the depth against */ if (s->list != DETECT_SM_LIST_NOTSET) { pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]); } else { pm = SigMatchGetLastSMFromLists(s, 28, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); } if (pm == NULL) { SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs " "preceding content, uricontent option, http_client_body, " "http_server_body, http_header option, http_raw_header option, " "http_method option, http_cookie, http_raw_uri, " "http_stat_msg, http_stat_code, http_user_agent or " "file_data/dce_stub_data sticky buffer options"); goto end; } /* verify other conditions. */ DetectContentData *cd = (DetectContentData *)pm->ctx;; if (cd->flags & DETECT_CONTENT_NOCASE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple nocase modifiers with the same content"); goto end; } /* for consistency in later use (e.g. by MPM construction and hashing), * coerce the content string to lower-case. */ for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) { *c = u8_tolower(*c); } cd->flags |= DETECT_CONTENT_NOCASE; /* Recreate the context with nocase chars */ SpmDestroyCtx(cd->spm_ctx); cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx); if (cd->spm_ctx == NULL) { goto end; } ret = 0; end: SCReturnInt(ret); } suricata-3.2.1/src/ippair-bit.c0000644000000000000000000002424513051004444013214 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements per ippair bits. Actually, not a bit, * but called that way because of Snort's flowbits. * It's a binary storage. * * \todo move away from a linked list implementation * \todo use different datatypes, such as string, int, etc. */ #include "suricata-common.h" #include "threads.h" #include "ippair-bit.h" #include "ippair.h" #include "detect.h" #include "util-var.h" #include "util-debug.h" #include "util-unittest.h" #include "ippair-storage.h" static int ippair_bit_id = -1; /**< IPPair storage id for bits */ void XBitFreeAll(void *store) { GenericVar *gv = store; GenericVarFree(gv); } void IPPairBitInitCtx(void) { ippair_bit_id = IPPairStorageRegister("bit", sizeof(void *), NULL, XBitFreeAll); if (ippair_bit_id == -1) { SCLogError(SC_ERR_IPPAIR_INIT, "Can't initiate ippair storage for bits"); exit(EXIT_FAILURE); } } /* lock before using this */ int IPPairHasBits(IPPair *ippair) { if (ippair == NULL) return 0; return IPPairGetStorageById(ippair, ippair_bit_id) ? 1 : 0; } /** \retval 1 ippair timed out wrt xbits * \retval 0 ippair still has active (non-expired) xbits */ int IPPairBitsTimedoutCheck(IPPair *h, struct timeval *ts) { GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_XBITS) { XBit *xb = (XBit *)gv; if (xb->expire > (uint32_t)ts->tv_sec) return 0; } } return 1; } /* get the bit with idx from the ippair */ static XBit *IPPairBitGet(IPPair *h, uint16_t idx) { GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_XBITS && gv->idx == idx) { return (XBit *)gv; } } return NULL; } /* add a flowbit to the flow */ static void IPPairBitAdd(IPPair *h, uint16_t idx, uint32_t expire) { XBit *fb = IPPairBitGet(h, idx); if (fb == NULL) { fb = SCMalloc(sizeof(XBit)); if (unlikely(fb == NULL)) return; fb->type = DETECT_XBITS; fb->idx = idx; fb->next = NULL; fb->expire = expire; GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); GenericVarAppend(&gv, (GenericVar *)fb); IPPairSetStorageById(h, ippair_bit_id, gv); // bit already set, lets update it's timer } else { fb->expire = expire; } } static void IPPairBitRemove(IPPair *h, uint16_t idx) { XBit *fb = IPPairBitGet(h, idx); if (fb == NULL) return; GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); if (gv) { GenericVarRemove(&gv, (GenericVar *)fb); IPPairSetStorageById(h, ippair_bit_id, gv); } } void IPPairBitSet(IPPair *h, uint16_t idx, uint32_t expire) { XBit *fb = IPPairBitGet(h, idx); if (fb == NULL) { IPPairBitAdd(h, idx, expire); } } void IPPairBitUnset(IPPair *h, uint16_t idx) { XBit *fb = IPPairBitGet(h, idx); if (fb != NULL) { IPPairBitRemove(h, idx); } } void IPPairBitToggle(IPPair *h, uint16_t idx, uint32_t expire) { XBit *fb = IPPairBitGet(h, idx); if (fb != NULL) { IPPairBitRemove(h, idx); } else { IPPairBitAdd(h, idx, expire); } } int IPPairBitIsset(IPPair *h, uint16_t idx, uint32_t ts) { XBit *fb = IPPairBitGet(h, idx); if (fb != NULL) { if (fb->expire < ts) { IPPairBitRemove(h, idx); return 0; } return 1; } return 0; } int IPPairBitIsnotset(IPPair *h, uint16_t idx, uint32_t ts) { XBit *fb = IPPairBitGet(h, idx); if (fb == NULL) { return 1; } if (fb->expire < ts) { IPPairBitRemove(h, idx); return 1; } return 0; } /* TESTS */ #ifdef UNITTESTS static int IPPairBitTest01 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0, 0); XBit *fb = IPPairBitGet(h,0); if (fb != NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest02 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; XBit *fb = IPPairBitGet(h,0); if (fb == NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest03 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0, 30); XBit *fb = IPPairBitGet(h,0); if (fb == NULL) { printf("fb == NULL although it was just added: "); goto end; } IPPairBitRemove(h, 0); fb = IPPairBitGet(h,0); if (fb != NULL) { printf("fb != NULL although it was just removed: "); goto end; } else { ret = 1; } IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest04 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,30); IPPairBitAdd(h, 1,30); IPPairBitAdd(h, 2,30); IPPairBitAdd(h, 3,30); XBit *fb = IPPairBitGet(h,0); if (fb != NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest05 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,1); if (fb != NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest06 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,2); if (fb != NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest07 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,3); if (fb != NULL) ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest08 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,0); if (fb == NULL) goto end; IPPairBitRemove(h,0); fb = IPPairBitGet(h,0); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest09 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,1); if (fb == NULL) goto end; IPPairBitRemove(h,1); fb = IPPairBitGet(h,1); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest10 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,2); if (fb == NULL) goto end; IPPairBitRemove(h,2); fb = IPPairBitGet(h,2); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } static int IPPairBitTest11 (void) { int ret = 0; IPPairInitConfig(TRUE); IPPair *h = IPPairAlloc(); if (h == NULL) goto end; IPPairBitAdd(h, 0,90); IPPairBitAdd(h, 1,90); IPPairBitAdd(h, 2,90); IPPairBitAdd(h, 3,90); XBit *fb = IPPairBitGet(h,3); if (fb == NULL) goto end; IPPairBitRemove(h,3); fb = IPPairBitGet(h,3); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; IPPairFree(h); end: IPPairCleanup(); return ret; } #endif /* UNITTESTS */ void IPPairBitRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("IPPairBitTest01", IPPairBitTest01); UtRegisterTest("IPPairBitTest02", IPPairBitTest02); UtRegisterTest("IPPairBitTest03", IPPairBitTest03); UtRegisterTest("IPPairBitTest04", IPPairBitTest04); UtRegisterTest("IPPairBitTest05", IPPairBitTest05); UtRegisterTest("IPPairBitTest06", IPPairBitTest06); UtRegisterTest("IPPairBitTest07", IPPairBitTest07); UtRegisterTest("IPPairBitTest08", IPPairBitTest08); UtRegisterTest("IPPairBitTest09", IPPairBitTest09); UtRegisterTest("IPPairBitTest10", IPPairBitTest10); UtRegisterTest("IPPairBitTest11", IPPairBitTest11); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-coredump-config.h0000644000000000000000000000165613051004444015216 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eileen Donlon */ #ifndef __COREDUMP_CONFIG_H__ #define __COREDUMP_CONFIG_H__ #include "suricata-common.h" int32_t CoredumpLoadConfig (void); #endif /* __COREDUMP_CONFIG_H__ */ suricata-3.2.1/src/util-threshold-config.c0000644000000000000000000026072613051004444015374 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup threshold * @{ */ /** * \file * * \author Breno Silva Pinto * * \todo Need to support suppress * * Implements Threshold support */ #include "suricata-common.h" #include "host.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-address.h" #include "detect-threshold.h" #include "detect-parse.h" #include "conf.h" #include "util-threshold-config.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-time.h" #include "util-error.h" #include "util-debug.h" #include "util-fmemopen.h" typedef enum ThresholdRuleType { THRESHOLD_TYPE_EVENT_FILTER, THRESHOLD_TYPE_THRESHOLD, THRESHOLD_TYPE_RATE, THRESHOLD_TYPE_SUPPRESS, } ThresholdRuleType; /* File descriptor for unittests */ /* common base for all options */ #define DETECT_BASE_REGEX "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$" #define DETECT_THRESHOLD_REGEX "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$" /* TODO: "apply_to" */ #define DETECT_RATE_REGEX "^,\\s*track\\s*(by_dst|by_src|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$" /* * suppress has two form: * suppress gen_id 0, sig_id 0, track by_dst, ip 10.88.0.14 * suppress gen_id 1, sig_id 2000328 * suppress gen_id 1, sig_id 2000328, track by_src, ip fe80::/10 */ #define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$" /* Default path for the threshold.config file */ #if defined OS_WIN32 || defined __CYGWIN__ #define THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "\\\\threshold.config" #else #define THRESHOLD_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/threshold.config" #endif static pcre *regex_base = NULL; static pcre_extra *regex_base_study = NULL; static pcre *regex_threshold = NULL; static pcre_extra *regex_threshold_study = NULL; static pcre *regex_rate = NULL; static pcre_extra *regex_rate_study = NULL; static pcre *regex_suppress = NULL; static pcre_extra *regex_suppress_study = NULL; /** * \brief Returns the path for the Threshold Config file. We check if we * can retrieve the path from the yaml conf file. If it is not present, * return the default path for the threshold file which is * "./threshold.config". * * \retval log_filename Pointer to a string containing the path for the * Threshold Config file. */ static char *SCThresholdConfGetConfFilename(const DetectEngineCtx *de_ctx) { char *log_filename = NULL; if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) { char config_value[256]; snprintf(config_value, sizeof(config_value), "%s.threshold-file", de_ctx->config_prefix); /* try loading prefix setting, fall back to global if that * fails. */ if (ConfGet(config_value, &log_filename) != 1) { if (ConfGet("threshold-file", &log_filename) != 1) { log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH; } } } else { if (ConfGet("threshold-file", &log_filename) != 1) { log_filename = (char *)THRESHOLD_CONF_DEF_CONF_FILEPATH; } } return log_filename; } /** * \brief Inits the context to be used by the Threshold Config parsing API. * * This function initializes the hash table to be used by the Detection * Engine Context to hold the data from the threshold.config file, * obtains the file desc to parse the threshold.config file, and * inits the regex used to parse the lines from threshold.config * file. * * \param de_ctx Pointer to the Detection Engine Context. * \param utfd Pointer for unit test file descriptor. * * \retval 0 On success. * \retval -1 On failure. */ int SCThresholdConfInitContext(DetectEngineCtx *de_ctx, FILE *utfd) { char *filename = NULL; const char *eb = NULL; FILE *fd = utfd; int eo; int opts = 0; if (fd == NULL) { filename = SCThresholdConfGetConfFilename(de_ctx); if ( (fd = fopen(filename, "r")) == NULL) { SCLogWarning(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; } } regex_base = pcre_compile(DETECT_BASE_REGEX, opts, &eb, &eo, NULL); if (regex_base == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",DETECT_BASE_REGEX, eo, eb); goto error; } regex_base_study = pcre_study(regex_base, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); goto error; } regex_threshold = pcre_compile(DETECT_THRESHOLD_REGEX, opts, &eb, &eo, NULL); if (regex_threshold == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",DETECT_THRESHOLD_REGEX, eo, eb); goto error; } regex_threshold_study = pcre_study(regex_threshold, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); goto error; } regex_rate = pcre_compile(DETECT_RATE_REGEX, opts, &eb, &eo, NULL); if (regex_rate == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",DETECT_RATE_REGEX, eo, eb); goto error; } regex_rate_study = pcre_study(regex_rate, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); goto error; } regex_suppress = pcre_compile(DETECT_SUPPRESS_REGEX, opts, &eb, &eo, NULL); if (regex_suppress == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",DETECT_SUPPRESS_REGEX, eo, eb); goto error; } regex_suppress_study = pcre_study(regex_suppress, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); goto error; } SCThresholdConfParseFile(de_ctx, fd); SCThresholdConfDeInitContext(de_ctx, fd); SCLogDebug("Global thresholding options defined"); return 0; error: SCThresholdConfDeInitContext(de_ctx, fd); return -1; } /** * \brief Releases resources used by the Threshold Config API. * * \param de_ctx Pointer to the Detection Engine Context. * \param fd Pointer to file descriptor. */ void SCThresholdConfDeInitContext(DetectEngineCtx *de_ctx, FILE *fd) { if (fd != NULL) fclose(fd); if (regex_base != NULL) { pcre_free(regex_base); regex_base = NULL; } if (regex_base_study != NULL) { pcre_free(regex_base_study); regex_base_study = NULL; } if (regex_threshold != NULL) { pcre_free(regex_threshold); regex_threshold = NULL; } if (regex_threshold_study != NULL) { pcre_free(regex_threshold_study); regex_threshold_study = NULL; } if (regex_rate != NULL) { pcre_free(regex_rate); regex_rate = NULL; } if (regex_rate_study != NULL) { pcre_free(regex_rate_study); regex_rate_study = NULL; } if (regex_suppress != NULL) { pcre_free(regex_suppress); regex_suppress = NULL; } if (regex_suppress_study != NULL) { pcre_free(regex_suppress_study); regex_suppress_study = NULL; } return; } /** \internal * \brief setup suppress rules * \retval 0 ok * \retval -1 error */ static int SetupSuppressRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid, uint8_t parsed_type, uint8_t parsed_track, uint32_t parsed_count, uint32_t parsed_seconds, uint32_t parsed_timeout, uint8_t parsed_new_action, const char *th_ip) { Signature *s = NULL; SigMatch *sm = NULL; DetectThresholdData *de = NULL; BUG_ON(parsed_type != TYPE_SUPPRESS); /* Install it */ if (id == 0 && gid == 0) { if (parsed_track == TRACK_RULE) { SCLogWarning(SC_ERR_EVENT_ENGINE, "suppressing all rules"); } /* update each sig with our suppress info */ for (s = de_ctx->sig_list; s != NULL; s = s->next) { /* tag the rule as noalert */ if (parsed_track == TRACK_RULE) { s->flags |= SIG_FLAG_NOALERT; continue; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = TYPE_SUPPRESS; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; if (parsed_track != TRACK_RULE) { if (DetectAddressParse((const DetectEngineCtx *)de_ctx, &de->addrs, (char *)th_ip) != 0) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "failed to parse %s", th_ip); goto error; } } sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS); } } else if (id == 0 && gid > 0) { if (parsed_track == TRACK_RULE) { SCLogWarning(SC_ERR_EVENT_ENGINE, "suppressing all rules with gid %"PRIu32, gid); } /* set up suppression for each signature with a matching gid */ for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->gid != gid) continue; /* tag the rule as noalert */ if (parsed_track == TRACK_RULE) { s->flags |= SIG_FLAG_NOALERT; continue; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = TYPE_SUPPRESS; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; if (parsed_track != TRACK_RULE) { if (DetectAddressParse((const DetectEngineCtx *)de_ctx, &de->addrs, (char *)th_ip) != 0) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "failed to parse %s", th_ip); goto error; } } sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS); } } else if (id > 0 && gid == 0) { SCLogError(SC_ERR_INVALID_VALUE, "Can't use a event config that has " "sid > 0 and gid == 0. Please fix this " "in your threshold.conf file"); goto error; } else { s = SigFindSignatureBySidGid(de_ctx, id, gid); if (s == NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "can't suppress sid " "%"PRIu32", gid %"PRIu32": unknown rule", id, gid); } else { if (parsed_track == TRACK_RULE) { s->flags |= SIG_FLAG_NOALERT; goto end; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = TYPE_SUPPRESS; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; if (DetectAddressParse((const DetectEngineCtx *)de_ctx, &de->addrs, (char *)th_ip) != 0) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "failed to parse %s", th_ip); goto error; } sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_SUPPRESS); } } end: return 0; error: if (de != NULL) { DetectAddressHeadCleanup(&de->addrs); SCFree(de); } return -1; } /** \internal * \brief setup suppress rules * \retval 0 ok * \retval -1 error */ static int SetupThresholdRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid, uint8_t parsed_type, uint8_t parsed_track, uint32_t parsed_count, uint32_t parsed_seconds, uint32_t parsed_timeout, uint8_t parsed_new_action, const char *th_ip) { Signature *s = NULL; SigMatch *sm = NULL; DetectThresholdData *de = NULL; void *ptmp; BUG_ON(parsed_type == TYPE_SUPPRESS); /* Install it */ if (id == 0 && gid == 0) { for (s = de_ctx->sig_list; s != NULL; s = s->next) { sm = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "an event var set. The signature event var is " "given precedence over the threshold.conf one. " "We'll change this in the future though.", s->id); continue; } sm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "an event var set. The signature event var is " "given precedence over the threshold.conf one. " "We'll change this in the future though.", s->id); continue; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = parsed_type; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } if (parsed_type == TYPE_RATE) sm->type = DETECT_DETECTION_FILTER; else sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); if (ptmp == NULL) { SCFree(de_ctx->ths_ctx.th_entry); de_ctx->ths_ctx.th_entry = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); } else { de_ctx->ths_ctx.th_entry = ptmp; de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; de_ctx->ths_ctx.th_size++; } } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); } } else if (id == 0 && gid > 0) { for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->gid == gid) { sm = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "an event var set. The signature event var is " "given precedence over the threshold.conf one. " "We'll change this in the future though.", id); continue; } sm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "an event var set. The signature event var is " "given precedence over the threshold.conf one. " "We'll change this in the future though.", id); continue; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = parsed_type; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } if (parsed_type == TYPE_RATE) sm->type = DETECT_DETECTION_FILTER; else sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); if (ptmp == NULL) { SCFree(de_ctx->ths_ctx.th_entry); de_ctx->ths_ctx.th_entry = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); } else { de_ctx->ths_ctx.th_entry = ptmp; de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; de_ctx->ths_ctx.th_size++; } } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); } } } else if (id > 0 && gid == 0) { SCLogError(SC_ERR_INVALID_VALUE, "Can't use a event config that has " "sid > 0 and gid == 0. Please fix this " "in your threshold.conf file"); } else { s = SigFindSignatureBySidGid(de_ctx, id, gid); if (s == NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "can't suppress sid " "%"PRIu32", gid %"PRIu32": unknown rule", id, gid); } else { if (parsed_type != TYPE_SUPPRESS && parsed_type != TYPE_THRESHOLD && parsed_type != TYPE_BOTH && parsed_type != TYPE_LIMIT) { sm = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "a threshold set. The signature event var is " "given precedence over the threshold.conf one. " "Bug #425.", s->id); goto end; } sm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm != NULL) { SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has " "a detection_filter set. The signature event var is " "given precedence over the threshold.conf one. " "Bug #425.", s->id); goto end; } /* replace threshold on sig if we have a global override for it */ #if 1 } else if (parsed_type == TYPE_THRESHOLD || parsed_type == TYPE_BOTH || parsed_type == TYPE_LIMIT) { sm = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if (sm == NULL) { sm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); } if (sm != NULL) { SigMatchRemoveSMFromList(s, sm, DETECT_SM_LIST_THRESHOLD); SigMatchFree(sm); sm = NULL; } #endif } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); de->type = parsed_type; de->track = parsed_track; de->count = parsed_count; de->seconds = parsed_seconds; de->new_action = parsed_new_action; de->timeout = parsed_timeout; sm = SigMatchAlloc(); if (sm == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating SigMatch"); goto error; } if (parsed_type == TYPE_RATE) sm->type = DETECT_DETECTION_FILTER; else sm->type = DETECT_THRESHOLD; sm->ctx = (void *)de; if (parsed_track == TRACK_RULE) { ptmp = SCRealloc(de_ctx->ths_ctx.th_entry, (de_ctx->ths_ctx.th_size + 1) * sizeof(DetectThresholdEntry *)); if (ptmp == NULL) { SCFree(de_ctx->ths_ctx.th_entry); de_ctx->ths_ctx.th_entry = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for threshold config" " (tried to allocate %"PRIu32"th_entrys for rule tracking with rate_filter)", de_ctx->ths_ctx.th_size + 1); } else { de_ctx->ths_ctx.th_entry = ptmp; de_ctx->ths_ctx.th_entry[de_ctx->ths_ctx.th_size] = NULL; de_ctx->ths_ctx.th_size++; } } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); } } end: return 0; error: if (de != NULL) { DetectAddressHeadCleanup(&de->addrs); SCFree(de); } return -1; } static int ParseThresholdRule(DetectEngineCtx *de_ctx, char *rawstr, uint32_t *ret_id, uint32_t *ret_gid, uint8_t *ret_parsed_type, uint8_t *ret_parsed_track, uint32_t *ret_parsed_count, uint32_t *ret_parsed_seconds, uint32_t *ret_parsed_timeout, uint8_t *ret_parsed_new_action, const char **ret_th_ip) { char th_rule_type[32]; char th_gid[16]; char th_sid[16]; char rule_extend[1024]; const char *th_type = NULL; const char *th_track = NULL; const char *th_count = NULL; const char *th_seconds = NULL; const char *th_new_action= NULL; const char *th_timeout = NULL; const char *th_ip = NULL; uint8_t parsed_type = 0; uint8_t parsed_track = 0; uint8_t parsed_new_action = 0; uint32_t parsed_count = 0; uint32_t parsed_seconds = 0; uint32_t parsed_timeout = 0; #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; uint32_t id = 0, gid = 0; ThresholdRuleType rule_type; if (de_ctx == NULL) return -1; ret = pcre_exec(regex_base, regex_base_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } /* retrieve the classtype name */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 1, th_rule_type, sizeof(th_rule_type)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } /* retrieve the classtype name */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 2, th_gid, sizeof(th_gid)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } ret = pcre_copy_substring((char *)rawstr, ov, 30, 3, th_sid, sizeof(th_sid)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } ret = pcre_copy_substring((char *)rawstr, ov, 30, 4, rule_extend, sizeof(rule_extend)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } /* get type of rule */ if (strcasecmp(th_rule_type,"event_filter") == 0) { rule_type = THRESHOLD_TYPE_EVENT_FILTER; } else if (strcasecmp(th_rule_type,"threshold") == 0) { rule_type = THRESHOLD_TYPE_THRESHOLD; } else if (strcasecmp(th_rule_type,"rate_filter") == 0) { rule_type = THRESHOLD_TYPE_RATE; } else if (strcasecmp(th_rule_type,"suppress") == 0) { rule_type = THRESHOLD_TYPE_SUPPRESS; } else { SCLogError(SC_ERR_INVALID_VALUE, "rule type %s is unknown", th_rule_type); goto error; } /* get end of rule */ switch(rule_type) { case THRESHOLD_TYPE_EVENT_FILTER: case THRESHOLD_TYPE_THRESHOLD: if (strlen(rule_extend) > 0) { ret = pcre_exec(regex_threshold, regex_threshold_study, rule_extend, strlen(rule_extend), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rule_extend); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, 30, 1, &th_type); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, 30, 2, &th_track); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, 30, 3, &th_count); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, 30, 4, &th_seconds); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (strcasecmp(th_type,"limit") == 0) parsed_type = TYPE_LIMIT; else if (strcasecmp(th_type,"both") == 0) parsed_type = TYPE_BOTH; else if (strcasecmp(th_type,"threshold") == 0) parsed_type = TYPE_THRESHOLD; else { SCLogError(SC_ERR_INVALID_ARGUMENTS, "limit type not supported: %s", th_type); goto error; } } else { SCLogError(SC_ERR_INVALID_ARGUMENTS, "rule invalid: %s", rawstr); goto error; } break; case THRESHOLD_TYPE_SUPPRESS: if (strlen(rule_extend) > 0) { ret = pcre_exec(regex_suppress, regex_suppress_study, rule_extend, strlen(rule_extend), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rule_extend); goto error; } /* retrieve the track mode */ ret = pcre_get_substring((char *)rule_extend, ov, 30, 1, &th_track); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* retrieve the IP */ ret = pcre_get_substring((char *)rule_extend, ov, 30, 2, &th_ip); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } } else { parsed_track = TRACK_RULE; } parsed_type = TYPE_SUPPRESS; break; case THRESHOLD_TYPE_RATE: if (strlen(rule_extend) > 0) { ret = pcre_exec(regex_rate, regex_rate_study, rule_extend, strlen(rule_extend), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 5) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rule_extend); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, MAX_SUBSTRINGS, 1, &th_track); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, MAX_SUBSTRINGS, 2, &th_count); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, MAX_SUBSTRINGS, 3, &th_seconds); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, MAX_SUBSTRINGS, 4, &th_new_action); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } ret = pcre_get_substring((char *)rule_extend, ov, MAX_SUBSTRINGS, 5, &th_timeout); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* TODO: implement option "apply_to" */ if (ByteExtractStringUint32(&parsed_timeout, 10, strlen(th_timeout), th_timeout) <= 0) { goto error; } /* Get the new action to take */ if (strcasecmp(th_new_action, "alert") == 0) parsed_new_action = TH_ACTION_ALERT; if (strcasecmp(th_new_action, "drop") == 0) parsed_new_action = TH_ACTION_DROP; if (strcasecmp(th_new_action, "pass") == 0) parsed_new_action = TH_ACTION_PASS; if (strcasecmp(th_new_action, "reject") == 0) parsed_new_action = TH_ACTION_REJECT; if (strcasecmp(th_new_action, "log") == 0) { SCLogInfo("log action for rate_filter not supported yet"); parsed_new_action = TH_ACTION_LOG; } if (strcasecmp(th_new_action, "sdrop") == 0) { SCLogInfo("sdrop action for rate_filter not supported yet"); parsed_new_action = TH_ACTION_SDROP; } parsed_type = TYPE_RATE; } else { SCLogError(SC_ERR_INVALID_ARGUMENTS, "rule invalid: %s", rawstr); goto error; } break; default: SCLogError(SC_ERR_PCRE_MATCH, "unable to find rule type for string %s", rawstr); goto error; } switch (rule_type) { /* This part is common to threshold/event_filter/rate_filter */ case THRESHOLD_TYPE_EVENT_FILTER: case THRESHOLD_TYPE_THRESHOLD: case THRESHOLD_TYPE_RATE: if (strcasecmp(th_track,"by_dst") == 0) parsed_track = TRACK_DST; else if (strcasecmp(th_track,"by_src") == 0) parsed_track = TRACK_SRC; else if (strcasecmp(th_track,"by_rule") == 0) parsed_track = TRACK_RULE; else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid track parameter %s in %s", th_track, rawstr); goto error; } if (ByteExtractStringUint32(&parsed_count, 10, strlen(th_count), th_count) <= 0) { goto error; } if (parsed_count == 0) { SCLogError(SC_ERR_INVALID_VALUE, "rate filter count should be > 0"); goto error; } if (ByteExtractStringUint32(&parsed_seconds, 10, strlen(th_seconds), th_seconds) <= 0) { goto error; } break; case THRESHOLD_TYPE_SUPPRESS: /* need to get IP if extension is provided */ if (th_track != NULL) { if (strcasecmp(th_track,"by_dst") == 0) parsed_track = TRACK_DST; else if (strcasecmp(th_track,"by_src") == 0) parsed_track = TRACK_SRC; else if (strcasecmp(th_track,"by_either") == 0) { parsed_track = TRACK_EITHER; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid track parameter %s in %s", th_track, rule_extend); goto error; } } break; } if (ByteExtractStringUint32(&id, 10, strlen(th_sid), th_sid) <= 0) { goto error; } if (ByteExtractStringUint32(&gid, 10, strlen(th_gid), th_gid) <= 0) { goto error; } *ret_id = id; *ret_gid = gid; *ret_parsed_type = parsed_type; *ret_parsed_track = parsed_track; *ret_parsed_new_action = parsed_new_action; *ret_parsed_count = parsed_count; *ret_parsed_seconds = parsed_seconds; *ret_parsed_timeout = parsed_timeout; *ret_th_ip = th_ip; return 0; error: if (th_track != NULL) SCFree((char *)th_track); if (th_count != NULL) SCFree((char *)th_count); if (th_seconds != NULL) SCFree((char *)th_seconds); if (th_type != NULL) SCFree((char *)th_type); if (th_ip != NULL) SCFree((char *)th_ip); return -1; } /** * \brief Parses a line from the threshold file and applies it to the * detection engine * * \param rawstr Pointer to the string to be parsed. * \param de_ctx Pointer to the Detection Engine Context. * * \retval 0 On success. * \retval -1 On failure. */ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx) { uint8_t parsed_type = 0; uint8_t parsed_track = 0; uint8_t parsed_new_action = 0; uint32_t parsed_count = 0; uint32_t parsed_seconds = 0; uint32_t parsed_timeout = 0; const char *th_ip = NULL; uint32_t id, gid; int r = 0; r = ParseThresholdRule(de_ctx, rawstr, &id, &gid, &parsed_type, &parsed_track, &parsed_count, &parsed_seconds, &parsed_timeout, &parsed_new_action, &th_ip); if (r < 0) goto error; if (parsed_type == TYPE_SUPPRESS) { r = SetupSuppressRule(de_ctx, id, gid, parsed_type, parsed_track, parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, th_ip); } else { r = SetupThresholdRule(de_ctx, id, gid, parsed_type, parsed_track, parsed_count, parsed_seconds, parsed_timeout, parsed_new_action, th_ip); } if (r < 0) { goto error; } return 0; error: if (th_ip != NULL) SCFree((char *)th_ip); return -1; } /** * \brief Checks if a string is a comment or a blank line. * * Comments lines are lines of the following format - * "# This is a comment string" or * " # This is a comment string". * * \param line String that has to be checked * * \retval 1 On the argument string being a comment or blank line * \retval 0 Otherwise */ int SCThresholdConfIsLineBlankOrComment(char *line) { while (*line != '\0') { /* we have a comment */ if (*line == '#') return 1; /* this line is neither a comment line, nor a blank line */ if (!isspace((unsigned char)*line)) return 0; line++; } /* we have a blank line */ return 1; } /** * \brief Checks if the rule is multiline, by searching an ending slash * * \param line String that has to be checked * * \retval the position of the slash making it multiline * \retval 0 Otherwise */ int SCThresholdConfLineIsMultiline(char *line) { int flag = 0; char *rline = line; int len = strlen(line); while (line < rline + len && *line != '\n') { /* we have a comment */ if (*line == '\\') flag = line - rline; else if (!isspace((unsigned char)*line)) flag = 0; line++; } /* we have a blank line */ return flag; } /** * \brief Get the config line length to allocate the buffer needed * * \param fd Pointer to file descriptor. * \retval int of the line length */ int SCThresholdConfLineLength(FILE *fd) { long pos = ftell(fd); int len = 0; int c; while ( (c = fgetc(fd)) && (char)c != '\n' && c != EOF && !feof(fd)) len++; if (pos < 0) pos = 0; if (fseek(fd, pos, SEEK_SET) < 0) { SCLogError(SC_ERR_THRESHOLD_SETUP, "threshold fseek failure: %s", strerror(errno)); return -1; } return len; } /** * \brief Parses the Threshold Config file * * \param de_ctx Pointer to the Detection Engine Context. * \param fd Pointer to file descriptor. */ void SCThresholdConfParseFile(DetectEngineCtx *de_ctx, FILE *fd) { char *line = NULL; int len = 0; int rule_num = 0; /* position of "\", on multiline rules */ int esc_pos = 0; if (fd == NULL) return; while (!feof(fd)) { len = SCThresholdConfLineLength(fd); if (len > 0) { if (line == NULL) { line = SCMalloc(len + 1); if (unlikely(line == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); return; } } else { char *newline = SCRealloc(line, strlen(line) + len + 1); if (unlikely(newline == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCFree(line); return; } line = newline; } if (fgets(line + esc_pos, len + 1, fd) == NULL) break; /* Skip EOL to inspect the next line (or read EOF) */ (void)fgetc(fd); if (SCThresholdConfIsLineBlankOrComment(line)) { continue; } esc_pos = SCThresholdConfLineIsMultiline(line); if (esc_pos == 0) { rule_num++; SCLogDebug("Adding threshold.config rule num %"PRIu32"( %s )", rule_num, line); SCThresholdConfAddThresholdtype(line, de_ctx); } } else { /* Skip EOL to inspect the next line (or read EOF) */ (void)fgetc(fd); if (feof(fd)) break; } } SCLogInfo("Threshold config parsed: %d rule(s) found", rule_num); /* Free the last line */ SCFree(line); return; } #ifdef UNITTESTS /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD01() { FILE *fd = NULL; const char *buffer = "event_filter gen_id 1, sig_id 10, type limit, track by_src, count 1, seconds 60\n" "threshold gen_id 1, sig_id 100, type both, track by_dst, count 10, seconds 60\n" "event_filter gen_id 1, sig_id 1000, type threshold, track by_src, count 100, seconds 60\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with some valid options and a couple of invalid options. * For testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateInValidDummyFD02() { FILE *fd; const char *buffer = "event_filter gen_id 1, sig_id 1000, type invalid, track by_src, count 100, seconds 60\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD03() { FILE *fd; const char *buffer = "event_filter gen_id 0, sig_id 0, type threshold, track by_src, count 100, seconds 60\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD04() { FILE *fd = NULL; const char *buffer = "event_filter gen_id 1 \\\n, sig_id 10, type limit, track by_src, \\\ncount 1, seconds 60\n" "threshold gen_id 1, \\\nsig_id 100, type both\\\n, track by_dst, count 10, \\\n seconds 60\n" "event_filter gen_id 1, sig_id 1000, \\\ntype threshold, track \\\nby_src, count 100, seconds 60\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD05() { FILE *fd = NULL; const char *buffer = "rate_filter gen_id 1, sig_id 10, track by_src, count 1, seconds 60, new_action drop, timeout 10\n" "rate_filter gen_id 1, sig_id 100, track by_dst, count 10, seconds 60, new_action pass, timeout 5\n" "rate_filter gen_id 1, sig_id 1000, track by_rule, count 100, seconds 60, new_action alert, timeout 30\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD06() { FILE *fd = NULL; const char *buffer = "rate_filter \\\ngen_id 1, sig_id 10, track by_src, count 1, seconds 60\\\n, new_action drop, timeout 10\n" "rate_filter gen_id 1, \\\nsig_id 100, track by_dst, \\\ncount 10, seconds 60, new_action pass, timeout 5\n" "rate_filter gen_id 1, sig_id 1000, \\\ntrack by_rule, count 100, seconds 60, new_action alert, timeout 30\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD07() { FILE *fd = NULL; const char *buffer = "rate_filter gen_id 1, sig_id 10, track by_src, count 3, seconds 3, new_action drop, timeout 10\n" "rate_filter gen_id 1, sig_id 11, track by_src, count 3, seconds 1, new_action drop, timeout 5\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD08() { FILE *fd = NULL; const char *buffer = "rate_filter gen_id 1, sig_id 10, track by_rule, count 3, seconds 3, new_action drop, timeout 10\n" "rate_filter gen_id 1, sig_id 11, track by_src, count 3, seconds 1, new_action drop, timeout 5\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD09() { FILE *fd = NULL; const char *buffer = "event_filter gen_id 1 \\\n, sig_id 10, type limit, track by_src, \\\ncount 2, seconds 60\n" "threshold gen_id 1, \\\nsig_id 11, type threshold\\\n, track by_dst, count 3, \\\n seconds 60\n" "event_filter gen_id 1, sig_id 12, \\\ntype both, track \\\nby_src, count 2, seconds 60\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, but * with splitted rules (multiline), for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD10() { FILE *fd = NULL; const char *buffer = "event_filter gen_id 1 \\\n, sig_id 10, type limit, track by_src, \\\ncount 5, seconds 2\n" "threshold gen_id 1, \\\nsig_id 11, type threshold\\\n, track by_dst, count 5, \\\n seconds 2\n" "event_filter gen_id 1, sig_id 12, \\\ntype both, track \\\nby_src, count 5, seconds 2\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD11() { FILE *fd = NULL; const char *buffer = "suppress gen_id 1, sig_id 10000\n" "suppress gen_id 1, sig_id 1000, track by_src, ip 192.168.1.1\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD01(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_LIMIT && de->track == TRACK_SRC && de->count == 1 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest02(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:100;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD01(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_BOTH && de->track == TRACK_DST && de->count == 10 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest03(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD01(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_THRESHOLD && de->track == TRACK_SRC && de->count == 100 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest04(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateInValidDummyFD02(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de == NULL) return result; else result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); return result == 0; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest05(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; Signature *s = NULL, *ns = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:1;)"); if (sig == NULL) { goto end; } sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit\"; gid:1; sid:100;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD03(); SCThresholdConfInitContext(de_ctx,fd); for (s = de_ctx->sig_list; s != NULL;) { ns = s->next; if(s->id == 1 || s->id == 10 || s->id == 100) { m = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m == NULL) { goto end; } else { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_THRESHOLD && de->track == TRACK_SRC && de->count == 100 && de->seconds == 60)) result++; } } s = ns; } if(result == 3) result = 1; end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest06(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD04(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_LIMIT && de->track == TRACK_SRC && de->count == 1 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the rate_filter rules are loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest07(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD05(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_RATE && de->track == TRACK_SRC && de->count == 1 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the rate_filter rules are loaded and well parsed * with multilines * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest08(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD06(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]); if(m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_RATE && de->track == TRACK_SRC && de->count == 1 && de->seconds == 60)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the rate_filter rules work * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest09(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacket((uint8_t*)"lalala", 6, IPPROTO_TCP); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"ratefilter test\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD07(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { result = 0; goto end; } p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { result = 0; goto end; } p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { result = 0; goto end; } TimeSetIncrementTime(2); TimeGet(&p->ts); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP))) { result = 0; goto end; } TimeSetIncrementTime(3); TimeGet(&p->ts); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP))) { result = 0; goto end; } TimeSetIncrementTime(10); TimeGet(&p->ts); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { result = 0; goto end; } p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { result = 0; goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the rate_filter rules work with track by_rule * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest10(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacket((uint8_t*)"lalala", 6, IPPROTO_TCP); Packet *p2 = UTHBuildPacketSrcDst((uint8_t*)"lalala", 6, IPPROTO_TCP, "172.26.0.1", "172.26.0.10"); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int alerts = 0; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL || p2 == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"ratefilter test\"; gid:1; sid:10;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD08(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); alerts += PacketAlertCheck(p2, 10); if (alerts > 0) { result = 0; goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); if (alerts != 1) { result = 0; goto end; } TimeSetIncrementTime(2); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); alerts += PacketAlertCheck(p2, 10); if (alerts != 2) { result = 0; goto end; } TimeSetIncrementTime(10); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); if (alerts == 2) result = 1; /* Ensure that a Threshold entry was installed at the sig */ if (de_ctx->ths_ctx.th_entry[sig->num] == NULL) { result = 0; goto end; } end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the rate_filter rules work * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest11(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacket((uint8_t*)"lalala", 6, IPPROTO_TCP); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int alerts10 = 0; int alerts11 = 0; int alerts12 = 0; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test limit\"; gid:1; sid:10;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test threshold\"; gid:1; sid:11;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test both\"; gid:1; sid:12;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD09(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); TimeSetIncrementTime(100); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); TimeSetIncrementTime(10); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); if (alerts10 == 4) result = 1; /* One on the first interval, another on the second */ if (alerts11 == 2) result = 1; if (alerts12 == 2) result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the rate_filter rules work * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest12(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacket((uint8_t*)"lalala", 6, IPPROTO_TCP); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int alerts10 = 0; int alerts11 = 0; int alerts12 = 0; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test limit\"; gid:1; sid:10;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test threshold\"; gid:1; sid:11;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"event_filter test both\"; gid:1; sid:12;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD10(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); TimeSetIncrementTime(100); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); TimeSetIncrementTime(10); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts10 += PacketAlertCheck(p, 10); alerts11 += PacketAlertCheck(p, 11); alerts12 += PacketAlertCheck(p, 12); /* Yes, none of the alerts will be out of the count of the given interval for type limit */ if (alerts10 == 10) result = 1; /* One on the first interval, another on the second */ if (alerts11 == 1) result = 1; if (alerts12 == 1) result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest13(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; gid:1; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD11(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_SUPPRESS]); if (m != NULL) { de = (DetectThresholdData *)m->ctx; if(de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) result = 1; } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the suppress rules work * * \retval 1 on succces * \retval 0 on failure */ int SCThresholdConfTest14(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacketReal((uint8_t*)"lalala", 6, IPPROTO_TCP, "192.168.0.10", "192.168.0.100", 1234, 24); Packet *p1 = UTHBuildPacketReal((uint8_t*)"lalala", 6, IPPROTO_TCP, "192.168.1.1", "192.168.0.100", 1234, 24); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"suppress test\"; gid:1; sid:10000;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"suppress test 2\"; gid:1; sid:10;)"); sig = sig->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"suppress test 3\"; gid:1; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD11(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p, 10000) == 0) && (PacketAlertCheck(p, 10) == 1) && (PacketAlertCheck(p, 1000) == 1) && (PacketAlertCheck(p1, 1000) == 0)) result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the suppress rules work * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest15(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacketReal((uint8_t*)"lalala", 6, IPPROTO_TCP, "192.168.0.10", "192.168.0.100", 1234, 24); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any any (msg:\"suppress test\"; content:\"lalala\"; gid:1; sid:10000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD11(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* 10000 shouldn't match */ if (PacketAlertCheck(p, 10000) != 0) { printf("sid 10000 should not have alerted: "); goto end; } /* however, it should have set the drop flag */ if (!(PACKET_TEST_ACTION(p, ACTION_DROP))) { printf("sid 10000 should have set DROP flag even if suppressed: "); goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the suppress rules work * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest16(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacketReal((uint8_t*)"lalala", 6, IPPROTO_TCP, "192.168.1.1", "192.168.0.100", 1234, 24); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any any (msg:\"suppress test\"; gid:1; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD11(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* 10000 shouldn't match */ if (PacketAlertCheck(p, 1000) != 0) { printf("sid 1000 should not have alerted: "); goto end; } /* however, it should have set the drop flag */ if (!(PACKET_TEST_ACTION(p, ACTION_DROP))) { printf("sid 1000 should have set DROP flag even if suppressed: "); goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the suppress rules work - ip only rule * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest17(void) { Signature *sig = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); Packet *p = UTHBuildPacketReal((uint8_t*)"lalala", 6, IPPROTO_TCP, "192.168.0.10", "192.168.0.100", 1234, 24); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); struct timeval ts; memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL || p == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"drop tcp 192.168.0.10 any -> 192.168.0.100 any (msg:\"suppress test\"; gid:1; sid:10000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD11(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* 10000 shouldn't match */ if (PacketAlertCheck(p, 10000) != 0) { printf("sid 10000 should not have alerted: "); goto end; } /* however, it should have set the drop flag */ if (!(PACKET_TEST_ACTION(p, ACTION_DROP))) { printf("sid 10000 should have set DROP flag even if suppressed: "); goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ static FILE *SCThresholdConfGenerateInvalidDummyFD12() { FILE *fd = NULL; const char *buffer = "suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16\n" "suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \test Check if the suppress rule parsing handles errors correctly * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest18(void) { Signature *s = NULL; int result = 0; FILE *fd = NULL; SigMatch *sm = NULL; DetectThresholdData *de = NULL; HostInitConfig(HOST_QUIET); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.0.10 any -> 192.168.0.100 any (msg:\"suppress test\"; gid:1; sid:2200029;)"); if (s == NULL) { goto end; } fd = SCThresholdConfGenerateInvalidDummyFD12(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); if (s->sm_lists[DETECT_SM_LIST_SUPPRESS] == NULL) { printf("no thresholds: "); goto end; } sm = s->sm_lists[DETECT_SM_LIST_SUPPRESS]; if (sm == NULL) { printf("no sm: "); goto end; } de = (DetectThresholdData *)sm->ctx; if (de == NULL) { printf("no de: "); goto end; } if (!(de->type == TYPE_SUPPRESS && de->track == TRACK_DST)) { printf("de state wrong: "); goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ static FILE *SCThresholdConfGenerateInvalidDummyFD13() { FILE *fd = NULL; const char *buffer = "suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16\n" "suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \test Check if the suppress rule parsing handles errors correctly * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest19(void) { Signature *s = NULL; int result = 0; FILE *fd = NULL; SigMatch *sm = NULL; DetectThresholdData *de = NULL; HostInitConfig(HOST_QUIET); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.0.10 any -> 192.168.0.100 any (msg:\"suppress test\"; gid:1; sid:2200029;)"); if (s == NULL) { goto end; } fd = SCThresholdConfGenerateInvalidDummyFD13(); SCThresholdConfInitContext(de_ctx,fd); SigGroupBuild(de_ctx); if (s->sm_lists[DETECT_SM_LIST_SUPPRESS] == NULL) { printf("no thresholds: "); goto end; } sm = s->sm_lists[DETECT_SM_LIST_SUPPRESS]; if (sm == NULL) { printf("no sm: "); goto end; } de = (DetectThresholdData *)sm->ctx; if (de == NULL) { printf("no de: "); goto end; } if (!(de->type == TYPE_SUPPRESS && de->track == TRACK_DST)) { printf("de state wrong: "); goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \brief Creates a dummy threshold file, with all valid options, for testing purposes. * * \retval fd Pointer to file descriptor. */ FILE *SCThresholdConfGenerateValidDummyFD20() { FILE *fd = NULL; const char *buffer = "suppress gen_id 1, sig_id 1000, track by_src, ip 2.2.3.4\n" "suppress gen_id 1, sig_id 1000, track by_src, ip 1.2.3.4\n" "suppress gen_id 1, sig_id 1000, track by_src, ip 192.168.1.1\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Threshold Config test code"); return fd; } /** * \test Check if the threshold file is loaded and well parsed * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest20(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; content:\"abc\"; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD20(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_SUPPRESS]); if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { m = m->next; if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { m = m->next; if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { result = 1; } } } } } } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } /** * \test Check if the threshold file is loaded and well parsed, and applied * correctly to a rule with thresholding * * \retval 1 on succces * \retval 0 on failure */ static int SCThresholdConfTest21(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectThresholdData *de = NULL; Signature *sig = NULL; SigMatch *m = NULL; int result = 0; FILE *fd = NULL; HostInitConfig(HOST_QUIET); if (de_ctx == NULL) return result; de_ctx->flags |= DE_QUIET; sig = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Threshold limit\"; content:\"abc\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); if (sig == NULL) { goto end; } fd = SCThresholdConfGenerateValidDummyFD20(); SCThresholdConfInitContext(de_ctx,fd); m = SigMatchGetLastSMFromLists(sig, 2, DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_SUPPRESS]); if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { m = m->next; if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { m = m->next; if (m != NULL) { de = (DetectThresholdData *)m->ctx; if (de != NULL && (de->type == TYPE_SUPPRESS && de->track == TRACK_SRC)) { result = 1; } } } } } } end: SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for Classification Config API. */ void SCThresholdConfRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCThresholdConfTest01", SCThresholdConfTest01); UtRegisterTest("SCThresholdConfTest02", SCThresholdConfTest02); UtRegisterTest("SCThresholdConfTest03", SCThresholdConfTest03); UtRegisterTest("SCThresholdConfTest04", SCThresholdConfTest04); UtRegisterTest("SCThresholdConfTest05", SCThresholdConfTest05); UtRegisterTest("SCThresholdConfTest06", SCThresholdConfTest06); UtRegisterTest("SCThresholdConfTest07", SCThresholdConfTest07); UtRegisterTest("SCThresholdConfTest08", SCThresholdConfTest08); UtRegisterTest("SCThresholdConfTest09 - rate_filter", SCThresholdConfTest09); UtRegisterTest("SCThresholdConfTest10 - rate_filter", SCThresholdConfTest10); UtRegisterTest("SCThresholdConfTest11 - event_filter", SCThresholdConfTest11); UtRegisterTest("SCThresholdConfTest12 - event_filter", SCThresholdConfTest12); UtRegisterTest("SCThresholdConfTest13", SCThresholdConfTest13); UtRegisterTest("SCThresholdConfTest14 - suppress", SCThresholdConfTest14); UtRegisterTest("SCThresholdConfTest15 - suppress drop", SCThresholdConfTest15); UtRegisterTest("SCThresholdConfTest16 - suppress drop", SCThresholdConfTest16); UtRegisterTest("SCThresholdConfTest17 - suppress drop", SCThresholdConfTest17); UtRegisterTest("SCThresholdConfTest18 - suppress parsing", SCThresholdConfTest18); UtRegisterTest("SCThresholdConfTest19 - suppress parsing", SCThresholdConfTest19); UtRegisterTest("SCThresholdConfTest20 - suppress parsing", SCThresholdConfTest20); UtRegisterTest("SCThresholdConfTest21 - suppress parsing", SCThresholdConfTest21); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-engine-hsmd.h0000644000000000000000000000257513051004444014627 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HSMD_H__ #define __DETECT_ENGINE_HSMD_H__ #include "app-layer-htp.h" int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpStatMsg(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpStatMsgRegisterTests(void); #endif /* __DETECT_ENGINE_HSMD_H__ */ suricata-3.2.1/src/tmqh-flow.h0000644000000000000000000000243013051004444013067 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TMQH_FLOW_H__ #define __TMQH_FLOW_H__ typedef struct TmqhFlowMode_ { PacketQueue *q; } TmqhFlowMode; /** \brief Ctx for the flow queue handler * \param size number of queues to output to * \param queues array of queue id's this flow handler outputs to */ typedef struct TmqhFlowCtx_ { uint16_t size; uint16_t last; TmqhFlowMode *queues; } TmqhFlowCtx; void TmqhFlowRegister (void); void TmqhFlowRegisterTests(void); void TmqhFlowPrintAutofpHandler(void); #endif /* __TMQH_FLOW_H__ */ suricata-3.2.1/src/util-conf.h0000644000000000000000000000213213051004444013050 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * */ #ifndef __UTIL_UTIL_CONF_H__ #define __UTIL_UTIL_CONF_H__ #include "conf.h" TmEcode ConfigSetLogDirectory(char *name); char *ConfigGetLogDirectory(); TmEcode ConfigCheckLogDirectory(char *log_dir); ConfNode *ConfFindDeviceConfig(ConfNode *node, const char *iface); int ConfUnixSocketIsEnable(void); #endif /* __UTIL_UTIL_CONF_H__ */ suricata-3.2.1/src/flow-queue.c0000644000000000000000000000702213051004444013237 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow queue handler functions */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "flow-private.h" #include "flow-queue.h" #include "flow-util.h" #include "util-error.h" #include "util-debug.h" #include "util-print.h" FlowQueue *FlowQueueNew() { FlowQueue *q = (FlowQueue *)SCMalloc(sizeof(FlowQueue)); if (q == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in FlowQueueNew. Exiting..."); exit(EXIT_SUCCESS); } q = FlowQueueInit(q); return q; } FlowQueue *FlowQueueInit (FlowQueue *q) { if (q != NULL) { memset(q, 0, sizeof(FlowQueue)); FQLOCK_INIT(q); } return q; } /** * \brief Destroy a flow queue * * \param q the flow queue to destroy */ void FlowQueueDestroy (FlowQueue *q) { FQLOCK_DESTROY(q); } /** * \brief add a flow to a queue * * \param q queue * \param f flow */ void FlowEnqueue (FlowQueue *q, Flow *f) { #ifdef DEBUG BUG_ON(q == NULL || f == NULL); #endif FQLOCK_LOCK(q); /* more flows in queue */ if (q->top != NULL) { f->lnext = q->top; q->top->lprev = f; q->top = f; /* only flow */ } else { q->top = f; q->bot = f; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ FQLOCK_UNLOCK(q); } /** * \brief remove a flow from the queue * * \param q queue * * \retval f flow or NULL if empty list. */ Flow *FlowDequeue (FlowQueue *q) { FQLOCK_LOCK(q); Flow *f = q->bot; if (f == NULL) { FQLOCK_UNLOCK(q); return NULL; } /* more packets in queue */ if (q->bot->lprev != NULL) { q->bot = q->bot->lprev; q->bot->lnext = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } #ifdef DEBUG BUG_ON(q->len == 0); #endif if (q->len > 0) q->len--; f->lnext = NULL; f->lprev = NULL; FQLOCK_UNLOCK(q); return f; } /** * \brief Transfer a flow from a queue to the spare queue * * \param f the flow to be transfered * \param q the source queue, where the flow will be removed. This queue is locked. * * \note spare queue needs locking */ void FlowMoveToSpare(Flow *f) { /* now put it in spare */ FQLOCK_LOCK(&flow_spare_q); /* add to new queue (append) */ f->lprev = flow_spare_q.bot; if (f->lprev != NULL) f->lprev->lnext = f; f->lnext = NULL; flow_spare_q.bot = f; if (flow_spare_q.top == NULL) flow_spare_q.top = f; flow_spare_q.len++; #ifdef DBG_PERF if (flow_spare_q.len > flow_spare_q.dbg_maxlen) flow_spare_q.dbg_maxlen = flow_spare_q.len; #endif /* DBG_PERF */ FQLOCK_UNLOCK(&flow_spare_q); } suricata-3.2.1/src/app-layer-ssh.c0000644000000000000000000024347113051004444013645 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * \author Victor Julien * * App-layer parser for SSH protocol * */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-ssh.h" #include "conf.h" #include "util-spm.h" #include "util-unittest.h" #include "util-debug.h" #include "flow-private.h" #include "util-byte.h" #include "util-memcmp.h" /** \internal * \brief Function to parse the SSH version string of the client * * The input to this function is a byte buffer starting with SSH- * * \param ssh_state Pointer the state in which the value to be stored * \param input Pointer the received input data * \param input_len Length in bytes of the received data * * \retval len remaining length in input */ static int SSHParseBanner(SshState *state, SshHeader *header, const uint8_t *input, uint32_t input_len) { const uint8_t *line_ptr = input; uint32_t line_len = input_len; /* is it the version line? */ if (SCMemcmp("SSH-", line_ptr, 4) != 0) { SCReturnInt(-1); } const uint8_t *banner_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\r", 1); if (banner_end == NULL) { banner_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\n", 1); if (banner_end == NULL) { SCLogDebug("No EOL at the end of banner buffer"); SCReturnInt(-1); } } if ((banner_end - line_ptr) > 255) { SCLogDebug("Invalid version string, it should be less than 255 " "characters including , input value is %"PRIuMAX, (uintmax_t)(banner_end - line_ptr)); SCReturnInt(-1); } /* don't search things behind the end of banner */ line_len = banner_end - line_ptr; /* ok, we have found the version line/string, skip it and parse proto version */ line_ptr += 4; line_len -= 4; uint8_t *proto_end = BasicSearch(line_ptr, line_len, (uint8_t*)"-", 1); if (proto_end == NULL) { /* Strings starting with SSH- are not allowed * if they are not the real version string */ SCLogDebug("Info Version String for SSH (invalid usage of SSH- prefix)"); SCReturnInt(-1); } uint64_t proto_ver_len = (uint64_t)(proto_end - line_ptr); header->proto_version = SCMalloc(proto_ver_len + 1); if (header->proto_version == NULL) { SCReturnInt(-1); } memcpy(header->proto_version, line_ptr, proto_ver_len); header->proto_version[proto_ver_len] = '\0'; /* Now lets parse the software & version */ line_ptr += proto_ver_len + 1; line_len -= proto_ver_len + 1; if (line_len < 1) { SCLogDebug("No software version specified (weird)"); header->flags |= SSH_FLAG_VERSION_PARSED; /* Return the remaining length */ SCReturnInt(0); } uint64_t sw_ver_len = (uint64_t)(banner_end - line_ptr); /* sanity check on this arithmetic */ if ((sw_ver_len <= 1) || (sw_ver_len >= input_len)) { SCLogDebug("Should not have sw version length '%" PRIu64 "'", sw_ver_len); SCReturnInt(-1); } header->software_version = SCMalloc(sw_ver_len + 1); if (header->software_version == NULL) { SCReturnInt(-1); } memcpy(header->software_version, line_ptr, sw_ver_len); header->software_version[sw_ver_len] = '\0'; if (header->software_version[sw_ver_len - 1] == 0x0d) header->software_version[sw_ver_len - 1] = '\0'; header->flags |= SSH_FLAG_VERSION_PARSED; /* Return the remaining length */ int len = input_len - (banner_end - input); SCReturnInt(len); } static int SSHParseRecordHeader(SshState *state, SshHeader *header, const uint8_t *input, uint32_t input_len) { #ifdef DEBUG BUG_ON(input_len != 6); #else if (input_len < 6) SCReturnInt(-1); #endif /* input and input_len now point past initial line */ uint32_t pkt_len = 0; int r = ByteExtractUint32(&pkt_len, BYTE_BIG_ENDIAN, 4, input); if (r != 4) { SCLogDebug("xtract 4 bytes failed %d", r); SCReturnInt(-1); } if (pkt_len < 2) { SCReturnInt(-1); } header->pkt_len = pkt_len; SCLogDebug("pkt len: %"PRIu32, pkt_len); input += 4; //input_len -= 4; header->padding_len = *input; input += 1; //input_len -= 1; SCLogDebug("padding: %u", header->padding_len); header->msg_code = *input; SCLogDebug("msg code: %u", header->msg_code); if (header->msg_code == SSH_MSG_NEWKEYS) { /* done */ SCLogDebug("done"); header->flags |= SSH_FLAG_PARSER_DONE; } else { /* not yet done */ SCLogDebug("not done"); } SCReturnInt(0); } /** \internal * \brief Function to parse the SSH field in packet received from the client * * Input to this function is a byte buffer starting with SSH- up to at least * a \r or \n character. * * \param ssh_state Pointer the state in which the value to be stored * \param input Pointer the received input data * \param input_len Length in bytes of the received data */ static int SSHParseRecord(SshState *state, SshHeader *header, uint8_t *input, uint32_t input_len) { SCEnter(); int ret = 0; if (header->flags & SSH_FLAG_PARSER_DONE) { SCReturnInt(0); } SCLogDebug("state %p, input %p,input_len %" PRIu32, state, input, input_len); //PrintRawDataFp(stdout, input, input_len); if (!(header->flags & SSH_FLAG_VERSION_PARSED)) { ret = SSHParseBanner(state, header, input, input_len); if (ret < 0) { SCLogDebug("Invalid version string"); SCReturnInt(-1); } else if (header->flags & SSH_FLAG_VERSION_PARSED) { SCLogDebug("Version string parsed, remaining length %d", ret); input += input_len - ret; input_len -= (input_len - ret); uint32_t u = 0; while (u < input_len && (input[u] == '\r' || input[u] == '\n')) { u++; } SCLogDebug("skipping %u EOL bytes", u); input += u; input_len -= u; if (input_len == 0) SCReturnInt(0); } else { BUG_ON(1);// we only call this when we have enough data SCLogDebug("Version string not parsed yet"); //pstate->parse_field = 0; SCReturnInt(0); } } else { SCLogDebug("Version string already parsed"); } /* skip bytes from the current record if we have to */ if (header->record_left > 0) { SCLogDebug("skipping bytes part of the current record"); if (header->record_left > input_len) { header->record_left -= input_len; SCLogDebug("all input skipped, %u left in record", header->record_left); SCReturnInt(0); } else { input_len -= header->record_left; input += header->record_left; header->record_left = 0; if (input_len == 0) { SCLogDebug("all input skipped"); SCReturnInt(0); } } } again: /* input is too small, even when combined with stored bytes */ if (header->buf_offset + input_len < 6) { memcpy(header->buf + header->buf_offset, input, input_len); header->buf_offset += input_len; SCReturnInt(0); /* we have enough bytes to parse 6 bytes, lets see if we have * previously stored some */ } else if (header->buf_offset > 0) { uint8_t needed = 6 - header->buf_offset; SCLogDebug("parse stored"); memcpy(header->buf + header->buf_offset, input, needed); header->buf_offset = 6; // parse the 6 if (SSHParseRecordHeader(state, header, header->buf, 6) < 0) SCReturnInt(-1); header->buf_offset = 0; uint32_t record_left = header->pkt_len - 2; input_len -= needed; input += needed; if (record_left > input_len) { header->record_left = record_left - input_len; } else { input_len -= record_left; if (input_len == 0) SCReturnInt(0); input += record_left; SCLogDebug("we have %u left to parse", input_len); goto again; } /* nothing stored, lets parse this directly */ } else { SCLogDebug("parse direct"); //PrintRawDataFp(stdout, input, input_len); if (SSHParseRecordHeader(state, header, input, 6) < 0) SCReturnInt(-1); uint32_t record_left = header->pkt_len - 2; SCLogDebug("record left %u", record_left); input_len -= 6; input += 6; if (record_left > input_len) { header->record_left = record_left - input_len; } else { input_len -= record_left; if (input_len == 0) SCReturnInt(0); input += record_left; //PrintRawDataFp(stdout, input, input_len); SCLogDebug("we have %u left to parse", input_len); goto again; } } SCReturnInt(0); } static int EnoughData(uint8_t *input, uint32_t input_len) { uint32_t u; for (u = 0; u < input_len; u++) { if (input[u] == '\r' || input[u] == '\n') return TRUE; } return FALSE; } #define MAX_BANNER_LEN 256 static int SSHParseData(SshState *state, SshHeader *header, uint8_t *input, uint32_t input_len) { /* we're looking for the banner */ if (!(header->flags & SSH_FLAG_VERSION_PARSED)) { int banner_eol = EnoughData(input, input_len); /* fast track normal case: no buffering */ if (header->banner_buffer == NULL && banner_eol) { SCLogDebug("enough data, parse now"); // parse now int r = SSHParseRecord(state, header, input, input_len); SCReturnInt(r); /* banner EOL with existing buffer present. Time for magic. */ } else if (banner_eol) { SCLogDebug("banner EOL with existing buffer"); uint32_t tocopy = MAX_BANNER_LEN - header->banner_len; if (tocopy > input_len) tocopy = input_len; SCLogDebug("tocopy %u input_len %u", tocopy, input_len); memcpy(header->banner_buffer + header->banner_len, input, tocopy); header->banner_len += tocopy; SCLogDebug("header->banner_len %u", header->banner_len); int r = SSHParseRecord(state, header, header->banner_buffer, header->banner_len); if (r == 0) { input += tocopy; input_len -= tocopy; if (input_len > 0) { SCLogDebug("handling remaining data %u", input_len); r = SSHParseRecord(state, header, input, input_len); } } SCReturnInt(r); /* no banner EOL, so we need to buffer */ } else if (!banner_eol) { if (header->banner_buffer == NULL) { header->banner_buffer = SCMalloc(MAX_BANNER_LEN); if (header->banner_buffer == NULL) SCReturnInt(-1); } uint32_t tocopy = MAX_BANNER_LEN - header->banner_len; if (tocopy > input_len) tocopy = input_len; SCLogDebug("tocopy %u", tocopy); memcpy(header->banner_buffer + header->banner_len, input, tocopy); header->banner_len += tocopy; SCLogDebug("header->banner_len %u", header->banner_len); } /* we have a banner, the rest is just records */ } else { int r = SSHParseRecord(state, header, input, input_len); SCReturnInt(r); } //PrintRawDataFp(stdout, input, input_len); return 0; } static int SSHParseRequest(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SshState *ssh_state = (SshState *)state; SshHeader *ssh_header = &ssh_state->cli_hdr; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } int r = SSHParseData(ssh_state, ssh_header, input, input_len); if (ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE && ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE) { AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION); AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_REASSEMBLY); } SCReturnInt(r); } static int SSHParseResponse(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SshState *ssh_state = (SshState *)state; SshHeader *ssh_header = &ssh_state->srv_hdr; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } int r = SSHParseData(ssh_state, ssh_header, input, input_len); if (ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE && ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE) { AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION); AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_REASSEMBLY); } SCReturnInt(r); } /** \brief Function to allocates the SSH state memory */ static void *SSHStateAlloc(void) { void *s = SCMalloc(sizeof(SshState)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(SshState)); return s; } /** \brief Function to free the SSH state memory */ static void SSHStateFree(void *state) { SshState *s = (SshState *)state; if (s->cli_hdr.proto_version != NULL) SCFree(s->cli_hdr.proto_version); if (s->cli_hdr.software_version != NULL) SCFree(s->cli_hdr.software_version); if (s->cli_hdr.banner_buffer != NULL) SCFree(s->cli_hdr.banner_buffer); if (s->srv_hdr.proto_version != NULL) SCFree(s->srv_hdr.proto_version); if (s->srv_hdr.software_version != NULL) SCFree(s->srv_hdr.software_version); if (s->srv_hdr.banner_buffer != NULL) SCFree(s->srv_hdr.banner_buffer); SCFree(s); } static int SSHRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_SSH, "SSH-", 4, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_SSH, "SSH-", 4, 0, STREAM_TOCLIENT) < 0) { return -1; } return 0; } /** \brief Function to register the SSH protocol parsers and other functions */ void RegisterSSHParsers(void) { char *proto_name = "ssh"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_SSH, proto_name); if (SSHRegisterPatternsForProtocolDetection() < 0) return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SSH, STREAM_TOSERVER, SSHParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SSH, STREAM_TOCLIENT, SSHParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SSH, SSHStateAlloc, SSHStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_SSH, STREAM_TOSERVER|STREAM_TOCLIENT); } else { // SCLogInfo("Parsed disabled for %s protocol. Protocol detection" // "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SSH, SSHParserRegisterTests); #endif } /* UNITTESTS */ #ifdef UNITTESTS #include "flow-util.h" /** \test Send a version string in one chunk (client version str). */ static int SSHParserTest01(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0-MySSHClient-0.5.1\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER | STREAM_EOF, sshbuf, sshlen); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version string in one chunk but multiple lines and comments. * (client version str) */ static int SSHParserTest02(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0-MySSHClient-0.5.1 some comments...\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER | STREAM_EOF, sshbuf, sshlen); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a invalid version string in one chunk but multiple lines and comments. * (client version str) */ static int SSHParserTest03(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0 some comments...\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER | STREAM_EOF, sshbuf, sshlen); if (r == 0) { printf("toclient chunk 1 returned %" PRId32 ", expected != 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED) { printf("Client version string parsed? It's not a valid string: "); goto end; } if (ssh_state->cli_hdr.proto_version != NULL) { goto end; } if (ssh_state->cli_hdr.software_version != NULL) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version string in one chunk (server version str). */ static int SSHParserTest04(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0-MySSHClient-0.5.1\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT | STREAM_EOF, sshbuf, sshlen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version string in one chunk (server version str) */ static int SSHParserTest05(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0-MySSHClient-0.5.1 some comments...\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT | STREAM_EOF, sshbuf, sshlen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a invalid version string in one chunk (server version str) */ static int SSHParserTest06(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0 some comments...\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT | STREAM_EOF, sshbuf, sshlen); if (r == 0) { printf("toserver chunk 1 returned %" PRId32 ", expected != 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* Ok, it returned an error. Let's make sure we didn't parse the string at all */ SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED) { printf("Client version string parsed? It's not a valid string: "); goto end; } if (ssh_state->srv_hdr.proto_version != NULL) { goto end; } if (ssh_state->srv_hdr.software_version != NULL) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SSHParserTest07(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { "0-MySSHClient-0.5.1\r\n"}; uint32_t sshlen2 = sizeof(sshbuf2) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version banner in three chunks. */ static int SSHParserTest08(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2."; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = { "0-MySSHClient-0.5.1\r\n"}; uint32_t sshlen3 = sizeof(sshbuf3) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SSHParserTest09(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { "0-MySSHClient-0.5.1\r\n"}; uint32_t sshlen2 = sizeof(sshbuf2) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version banner in three chunks. */ static int SSHParserTest10(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2."; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = { "0-MySSHClient-0.5.1\r\n"}; uint32_t sshlen3 = sizeof(sshbuf3) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a banner and record in three chunks. */ static int SSHParserTest11(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 21, 0x00}; uint32_t sshlen2 = sizeof(sshbuf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a banner and 2 records record in four chunks. */ static int SSHParserTest12(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { 0x00, 0x00, 0x00, 0x03,0x01, 17, 0x00}; uint32_t sshlen2 = sizeof(sshbuf2); uint8_t sshbuf3[] = { 0x00, 0x00, 0x00, 0x03,0x01, 21, 0x00}; uint32_t sshlen3 = sizeof(sshbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a banner and 2 records record in four chunks. */ static int SSHParserTest13(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { 0x00, 0x00, 0x00, 0x02, 0x01, 17}; uint32_t sshlen2 = sizeof(sshbuf2); uint8_t sshbuf3[] = { 0x00, 0x00, 0x00, 0x02, 0x01, 21}; uint32_t sshlen3 = sizeof(sshbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); uint32_t u; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); for (u = 0; u < sshlen2; u++) { FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, &sshbuf2[u], 1); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); } for (u = 0; u < sshlen3; u++) { FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, &sshbuf3[u], 1); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); } SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a banner and 2 records record in four chunks. */ static int SSHParserTest14(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { 0x00, 0x00, 0x00, 0x10, 0x01, 17, 0x00}; uint32_t sshlen2 = sizeof(sshbuf2); uint8_t sshbuf3[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08}; uint32_t sshlen3 = sizeof(sshbuf3); uint8_t sshbuf4[] = { 0x09, 0x10, 0x11, 0x12, 0x13, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4); /* first byte of this record in sshbuf4 */ uint8_t sshbuf5[] = { 0x00, 0x00, 0x02, 0x01, 21}; uint32_t sshlen5 = sizeof(sshbuf5); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf5, sshlen5); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a banner and 2 records record in four chunks. */ static int SSHParserTest15(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = { 0x00, 0x00, 0x00, 0x10, 0x01, 17, 0x00}; uint32_t sshlen2 = sizeof(sshbuf2); uint8_t sshbuf3[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08}; uint32_t sshlen3 = sizeof(sshbuf3); uint8_t sshbuf4[] = { 0x09, 0x10, 0x11, 0x12, 0x13, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4); /* first byte of this record in sshbuf4 */ uint8_t sshbuf5[] = { 0x00, 0x00, 0x02, 0x01, 20, 0x00, 0x00, 0x00, 0x02, 0x01, 21}; uint32_t sshlen5 = sizeof(sshbuf5); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf5, sshlen5); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->cli_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send toserver a banner and record in three chunks. */ static int SSHParserTest16(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = { 0x00, 0x00, 0x00, 0x03,0x01, 21, 0x00}; uint32_t sshlen3 = sizeof(sshbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send toserver a banner and 2 records record in four chunks. */ static int SSHParserTest17(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 17, 0x00}; uint32_t sshlen3 = sizeof(sshbuf3); uint8_t sshbuf4[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 21, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.software_version, "MySSHClient-0.5.1", strlen("MySSHClient-0.5.1")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test 2 directional test */ static int SSHParserTest18(void) { int result = 0; Flow f; uint8_t server1[] = "SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu3\r\n"; uint32_t serverlen1 = sizeof(server1) - 1; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-MySSHClient-0.5.1\r\n"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t server2[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 21, 0x00 }; uint32_t serverlen2 = sizeof(server2) - 1; uint8_t sshbuf3[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 21, 0x00 }; uint32_t sshlen3 = sizeof(sshbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, server1, serverlen1); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, server2, serverlen2); if (r != 0) { printf("toclient chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } if (!(AppLayerParserStateIssetFlag(f.alparser, APP_LAYER_PARSER_NO_INSPECTION))) { printf("detection not disabled: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Really long banner handling: bannel exactly 255 */ static int SSHParserTest19(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; // 8 uint8_t sshbuf3[] = "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//60 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//112 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//164 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//216 "abcdefghijklmnopqrstuvwxyz"//242 "abcdefghijkl\r";//255 uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = { 0x00, 0x00, 0x00, 0x03, 0x01, 21, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } char *name = SCCalloc(1, 256); if (name == NULL) goto end; strlcpy(name, (char *)sshbuf3, 256); name[strlen(name) - 1] = '\0'; // strip \r if (strcmp((char*)ssh_state->srv_hdr.software_version, name) != 0) { printf("Client version string not parsed correctly: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Really long banner handling: banner exactly 255, * followed by malformed record */ static int SSHParserTest20(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; // 8 uint8_t sshbuf3[] = "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//60 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//112 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//164 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//216 "abcdefghijklmnopqrstuvwxyz"//242 "abcdefghijklm\r";//256 uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = {'a','b','c','d','e','f', '\r', 0x00, 0x00, 0x00, 0x06, 0x01, 21, 0x00, 0x00, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SCLogDebug("chunk 4:"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ((ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("detected the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Fragmented banner handling: chunk has final part of bannel plus * a record. */ static int SSHParserTest21(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; // 8 uint8_t sshbuf3[] = "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//60 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//112 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//164 "abcdefghijklmnopqrstuvwxyz" "abcdefghijklmnopqrstuvwxyz"//216 "abcdefghijklmnopqrstuvwxy";//241 uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = {'l','i','b','s','s','h', '\r', 0x00, 0x00, 0x00, 0x06, 0x01, 21, 0x00, 0x00, 0x00}; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SCLogDebug("chunk 4:"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Fragmented banner handling: chunk has final part of bannel plus * a record. */ static int SSHParserTest22(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "2.0-"; uint32_t sshlen2 = sizeof(sshbuf2) - 1; // 8 uint8_t sshbuf3[] = { 'l', 'i', 'b', 's', 's', 'h', '\r', //7 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, //50 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, //100 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, //150 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, //200 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, //250 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x01, 21, 0x00, 0x00, 0x00, 0x00, //300 }; uint32_t sshlen3 = sizeof(sshbuf3) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); #if 0 SCLogDebug("chunk 4:"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_SSH, STREAM_TOCLIENT, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); #endif SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if (!(ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.software_version == NULL) { printf("Client version string not parsed: "); goto end; } if (ssh_state->srv_hdr.proto_version == NULL) { printf("Client version string not parsed: "); goto end; } if (strncmp((char*)ssh_state->srv_hdr.proto_version, "2.0", strlen("2.0")) != 0) { printf("Client version string not parsed correctly: "); goto end; } if ( !(ssh_state->srv_hdr.flags & SSH_FLAG_PARSER_DONE)) { printf("Didn't detect the msg code of new keys (ciphered data starts): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version string in one chunk (client version str). */ static int SSHParserTest23(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0\r-MySSHClient-0.5.1\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER | STREAM_EOF, sshbuf, sshlen); if (r == 0) { printf("toclient chunk 1 returned 0 expected non null: "); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a version string in one chunk (client version str). */ static int SSHParserTest24(void) { int result = 0; Flow f; uint8_t sshbuf[] = "SSH-2.0-\rMySSHClient-0.5.1\n"; uint32_t sshlen = sizeof(sshbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER | STREAM_EOF, sshbuf, sshlen); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } if ( !(ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { printf("Client version string not parsed: "); goto end; } if (ssh_state->cli_hdr.software_version) { printf("Client version string should not be parsed: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif /* UNITTESTS */ void SSHParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SSHParserTest01 - ToServer", SSHParserTest01); UtRegisterTest("SSHParserTest02 - ToServer", SSHParserTest02); UtRegisterTest("SSHParserTest03 - ToServer", SSHParserTest03); UtRegisterTest("SSHParserTest04 - ToClient", SSHParserTest04); UtRegisterTest("SSHParserTest05 - ToClient", SSHParserTest05); UtRegisterTest("SSHParserTest06 - ToClient", SSHParserTest06); UtRegisterTest("SSHParserTest07 - ToServer 2 chunks", SSHParserTest07); UtRegisterTest("SSHParserTest08 - ToServer 3 chunks", SSHParserTest08); UtRegisterTest("SSHParserTest09 - ToClient 2 chunks", SSHParserTest09); UtRegisterTest("SSHParserTest10 - ToClient 3 chunks", SSHParserTest10); UtRegisterTest("SSHParserTest11 - ToClient 4 chunks", SSHParserTest11); UtRegisterTest("SSHParserTest12 - ToClient 4 chunks", SSHParserTest12); UtRegisterTest("SSHParserTest13 - ToClient 4 chunks", SSHParserTest13); UtRegisterTest("SSHParserTest14 - ToClient 4 chunks", SSHParserTest14); UtRegisterTest("SSHParserTest15", SSHParserTest15); UtRegisterTest("SSHParserTest16", SSHParserTest16); UtRegisterTest("SSHParserTest17", SSHParserTest17); UtRegisterTest("SSHParserTest18", SSHParserTest18); UtRegisterTest("SSHParserTest19", SSHParserTest19); UtRegisterTest("SSHParserTest20", SSHParserTest20); UtRegisterTest("SSHParserTest21", SSHParserTest21); UtRegisterTest("SSHParserTest22", SSHParserTest22); UtRegisterTest("SSHParserTest23", SSHParserTest23); UtRegisterTest("SSHParserTest24", SSHParserTest24); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-hcd.c0000644000000000000000000015262413051004444014426 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP cookie match * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-hcd.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP Cookie Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxRequestCookie(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_headers == NULL) return; htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Cookie"); if (h == NULL || h->value == NULL) { SCLogDebug("HTTP cookie header not present in this request"); return; } const uint32_t buffer_len = bstr_len(h->value); const uint8_t *buffer = bstr_ptr(h->value); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxRequestCookie, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_cookie (request)"); } /** \brief HTTP Cookie Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxResponseCookie(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_headers == NULL) return; htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, "Set-Cookie"); if (h == NULL || h->value == NULL) { SCLogDebug("HTTP cookie header not present in this request"); return; } const uint32_t buffer_len = bstr_len(h->value); const uint8_t *buffer = bstr_ptr(h->value); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxResponseCookie, ALPROTO_HTTP, HTP_RESPONSE_HEADERS, mpm_ctx, NULL, "http_cookie (response)"); } /** * \brief Do the http_cookie content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpCookie(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; htp_header_t *h = NULL; if (flags & STREAM_TOSERVER) { h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Cookie"); if (h == NULL) { SCLogDebug("HTTP cookie header not present in this request"); goto end; } } else { h = (htp_header_t *)htp_table_get_c(tx->response_headers, "Set-Cookie"); if (h == NULL) { SCLogDebug("HTTP Set-Cookie header not present in this request"); goto end; } } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCDMATCH], f, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (flags & STREAM_TOSERVER) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CONNECT\"; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; depth:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"ECT\"; depth:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"ECT\"; depth:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"CON\"; depth:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"ECT\"; offset:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"CO\"; offset:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"ECT\"; offset:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CON\"; offset:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:\"EC\"; within:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:!\"EC\"; within:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:\"EC\"; within:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:!\"EC\"; within:4; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:\"EC\"; distance:2; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:!\"EC\"; distance:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:\"EC\"; distance:3; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_cookie content matches against a http request * which holds the content. */ static int DetectEngineHttpCookieTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Cookie: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_cookie; " "content:!\"EC\"; distance:2; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpCookieRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpCookieTest01", DetectEngineHttpCookieTest01); UtRegisterTest("DetectEngineHttpCookieTest02", DetectEngineHttpCookieTest02); UtRegisterTest("DetectEngineHttpCookieTest03", DetectEngineHttpCookieTest03); UtRegisterTest("DetectEngineHttpCookieTest04", DetectEngineHttpCookieTest04); UtRegisterTest("DetectEngineHttpCookieTest05", DetectEngineHttpCookieTest05); UtRegisterTest("DetectEngineHttpCookieTest06", DetectEngineHttpCookieTest06); UtRegisterTest("DetectEngineHttpCookieTest07", DetectEngineHttpCookieTest07); UtRegisterTest("DetectEngineHttpCookieTest08", DetectEngineHttpCookieTest08); UtRegisterTest("DetectEngineHttpCookieTest09", DetectEngineHttpCookieTest09); UtRegisterTest("DetectEngineHttpCookieTest10", DetectEngineHttpCookieTest10); UtRegisterTest("DetectEngineHttpCookieTest11", DetectEngineHttpCookieTest11); UtRegisterTest("DetectEngineHttpCookieTest12", DetectEngineHttpCookieTest12); UtRegisterTest("DetectEngineHttpCookieTest13", DetectEngineHttpCookieTest13); UtRegisterTest("DetectEngineHttpCookieTest14", DetectEngineHttpCookieTest14); UtRegisterTest("DetectEngineHttpCookieTest15", DetectEngineHttpCookieTest15); UtRegisterTest("DetectEngineHttpCookieTest16", DetectEngineHttpCookieTest16); UtRegisterTest("DetectEngineHttpCookieTest17", DetectEngineHttpCookieTest17); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-engine-hmd.c0000644000000000000000000014512513051004444014436 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * * \brief Handle HTTP method match * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-hmd.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP Method Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context * * \retval ret number of matches */ static void PrefilterTxMethod(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_method == NULL) return; const uint32_t buffer_len = bstr_len(tx->request_method); const uint8_t *buffer = bstr_ptr(tx->request_method); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxMethodRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { return PrefilterAppendTxEngine(sgh, PrefilterTxMethod, ALPROTO_HTTP, HTP_REQUEST_LINE, mpm_ctx, NULL, "http_method"); } /** * \brief Do the http_method content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpMethod(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_method == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HMDMATCH], f, (uint8_t *)bstr_ptr(tx->request_method), bstr_len(tx->request_method), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"GET\"; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; depth:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"ECT\"; depth:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"ECT\"; depth:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"CON\"; depth:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"ECT\"; offset:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"CO\"; offset:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"ECT\"; offset:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CON\"; offset:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:\"EC\"; within:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:!\"EC\"; within:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:\"EC\"; within:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:!\"EC\"; within:4; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:\"EC\"; distance:2; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:!\"EC\"; distance:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:\"EC\"; distance:3; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_method content matches against a http request * which holds the content. */ static int DetectEngineHttpMethodTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"CO\"; http_method; " "content:!\"EC\"; distance:2; http_method; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpMethodRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpMethodTest01", DetectEngineHttpMethodTest01); UtRegisterTest("DetectEngineHttpMethodTest02", DetectEngineHttpMethodTest02); UtRegisterTest("DetectEngineHttpMethodTest03", DetectEngineHttpMethodTest03); UtRegisterTest("DetectEngineHttpMethodTest04", DetectEngineHttpMethodTest04); UtRegisterTest("DetectEngineHttpMethodTest05", DetectEngineHttpMethodTest05); UtRegisterTest("DetectEngineHttpMethodTest06", DetectEngineHttpMethodTest06); UtRegisterTest("DetectEngineHttpMethodTest07", DetectEngineHttpMethodTest07); UtRegisterTest("DetectEngineHttpMethodTest08", DetectEngineHttpMethodTest08); UtRegisterTest("DetectEngineHttpMethodTest09", DetectEngineHttpMethodTest09); UtRegisterTest("DetectEngineHttpMethodTest10", DetectEngineHttpMethodTest10); UtRegisterTest("DetectEngineHttpMethodTest11", DetectEngineHttpMethodTest11); UtRegisterTest("DetectEngineHttpMethodTest12", DetectEngineHttpMethodTest12); UtRegisterTest("DetectEngineHttpMethodTest13", DetectEngineHttpMethodTest13); UtRegisterTest("DetectEngineHttpMethodTest14", DetectEngineHttpMethodTest14); UtRegisterTest("DetectEngineHttpMethodTest15", DetectEngineHttpMethodTest15); UtRegisterTest("DetectEngineHttpMethodTest16", DetectEngineHttpMethodTest16); UtRegisterTest("DetectEngineHttpMethodTest17", DetectEngineHttpMethodTest17); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/source-erf-file.c0000644000000000000000000002070213051004444014135 00000000000000/* Copyright (C) 2010-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * * Support for reading ERF files. * * Only ethernet supported at this time. */ #include "suricata-common.h" #include "suricata.h" #include "tm-threads.h" #define DAG_TYPE_ETH 2 typedef struct DagFlags_ { uint8_t iface:2; uint8_t vlen:1; uint8_t trunc:1; uint8_t rxerror:1; uint8_t dserror:1; uint8_t reserved:1; uint8_t direction:1; } DagFlags; typedef struct DagRecord_ { uint64_t ts; uint8_t type; DagFlags flags; uint16_t rlen; uint16_t lctr; uint16_t wlen; uint16_t pad; } __attribute__((packed)) DagRecord; typedef struct ErfFileThreadVars_ { ThreadVars *tv; TmSlot *slot; FILE *erf; uint32_t pkts; uint64_t bytes; } ErfFileThreadVars; static inline TmEcode ReadErfRecord(ThreadVars *, Packet *, void *); TmEcode ReceiveErfFileLoop(ThreadVars *, void *, void *); TmEcode ReceiveErfFileThreadInit(ThreadVars *, void *, void **); void ReceiveErfFileThreadExitStats(ThreadVars *, void *); TmEcode ReceiveErfFileThreadDeinit(ThreadVars *, void *); TmEcode DecodeErfFileThreadInit(ThreadVars *, void *, void **); TmEcode DecodeErfFileThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeErfFile(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); /** * \brief Register the ERF file receiver (reader) module. */ void TmModuleReceiveErfFileRegister(void) { tmm_modules[TMM_RECEIVEERFFILE].name = "ReceiveErfFile"; tmm_modules[TMM_RECEIVEERFFILE].ThreadInit = ReceiveErfFileThreadInit; tmm_modules[TMM_RECEIVEERFFILE].Func = NULL; tmm_modules[TMM_RECEIVEERFFILE].PktAcqLoop = ReceiveErfFileLoop; tmm_modules[TMM_RECEIVEERFFILE].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEERFFILE].ThreadExitPrintStats = ReceiveErfFileThreadExitStats; tmm_modules[TMM_RECEIVEERFFILE].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEERFFILE].RegisterTests = NULL; tmm_modules[TMM_RECEIVEERFFILE].cap_flags = 0; tmm_modules[TMM_RECEIVEERFFILE].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Register the ERF file decoder module. */ void TmModuleDecodeErfFileRegister(void) { tmm_modules[TMM_DECODEERFFILE].name = "DecodeErfFile"; tmm_modules[TMM_DECODEERFFILE].ThreadInit = DecodeErfFileThreadInit; tmm_modules[TMM_DECODEERFFILE].Func = DecodeErfFile; tmm_modules[TMM_DECODEERFFILE].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEERFFILE].ThreadDeinit = DecodeErfFileThreadDeinit; tmm_modules[TMM_DECODEERFFILE].RegisterTests = NULL; tmm_modules[TMM_DECODEERFFILE].cap_flags = 0; tmm_modules[TMM_DECODEERFFILE].flags = TM_FLAG_DECODE_TM; } /** * \brief ERF file reading loop. */ TmEcode ReceiveErfFileLoop(ThreadVars *tv, void *data, void *slot) { Packet *p = NULL; ErfFileThreadVars *etv = (ErfFileThreadVars *)data; etv->slot = ((TmSlot *)slot)->slot_next; while (1) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } /* Make sure we have at least one packet in the packet pool, * to prevent us from alloc'ing packets at line rate. */ PacketPoolWait(); p = PacketGetFromQueueOrAlloc(); if (unlikely(p == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate a packet."); EngineStop(); SCReturnInt(TM_ECODE_FAILED); } PKT_SET_SRC(p, PKT_SRC_WIRE); if (ReadErfRecord(tv, p, data) != TM_ECODE_OK) { TmqhOutputPacketpool(etv->tv, p); EngineStop(); SCReturnInt(TM_ECODE_FAILED); } if (TmThreadsSlotProcessPkt(etv->tv, etv->slot, p) != TM_ECODE_OK) { EngineStop(); SCReturnInt(TM_ECODE_FAILED); } } SCReturnInt(TM_ECODE_FAILED); } static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data) { SCEnter(); ErfFileThreadVars *etv = (ErfFileThreadVars *)data; DagRecord dr; int r = fread(&dr, sizeof(DagRecord), 1, etv->erf); if (r < 1) { if (feof(etv->erf)) { SCLogInfo("End of ERF file reached"); } else { SCLogInfo("Error reading ERF record"); } SCReturnInt(TM_ECODE_FAILED); } int rlen = ntohs(dr.rlen); int wlen = ntohs(dr.wlen); r = fread(GET_PKT_DATA(p), rlen - sizeof(DagRecord), 1, etv->erf); if (r < 1) { if (feof(etv->erf)) { SCLogInfo("End of ERF file reached"); } else { SCLogInfo("Error reading ERF record"); } SCReturnInt(TM_ECODE_FAILED); } /* Only support ethernet at this time. */ if (dr.type != DAG_TYPE_ETH) { SCLogError(SC_ERR_UNIMPLEMENTED, "DAG record type %d not implemented.", dr.type); SCReturnInt(TM_ECODE_FAILED); } GET_PKT_LEN(p) = wlen; p->datalink = LINKTYPE_ETHERNET; /* Convert ERF time to timeval - from libpcap. */ uint64_t ts = dr.ts; p->ts.tv_sec = ts >> 32; ts = (ts & 0xffffffffULL) * 1000000; ts += 0x80000000; /* rounding */ p->ts.tv_usec = ts >> 32; if (p->ts.tv_usec >= 1000000) { p->ts.tv_usec -= 1000000; p->ts.tv_sec++; } etv->pkts++; etv->bytes += wlen; SCReturnInt(TM_ECODE_OK); } /** * \brief Initialize the ERF receiver thread. */ TmEcode ReceiveErfFileThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Error: No filename provided."); SCReturnInt(TM_ECODE_FAILED); } FILE *erf = fopen((const char *)initdata, "r"); if (erf == NULL) { SCLogError(SC_ERR_FOPEN, "Failed to open %s: %s", (char *)initdata, strerror(errno)); exit(EXIT_FAILURE); } ErfFileThreadVars *etv = SCMalloc(sizeof(ErfFileThreadVars)); if (unlikely(etv == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for ERF file thread vars."); fclose(erf); SCReturnInt(TM_ECODE_FAILED); } memset(etv, 0, sizeof(*etv)); etv->erf = erf; etv->tv = tv; *data = (void *)etv; SCLogInfo("Processing ERF file %s", (char *)initdata); SCReturnInt(TM_ECODE_OK); } /** * \brief Initialize the ERF decoder thread. */ TmEcode DecodeErfFileThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodeErfFileThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } /** * \brief Decode the ERF file. * * This function ups the decoder counters and then passes the packet * off to the ethernet decoder. */ TmEcode DecodeErfFile(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* Update counters. */ DecodeUpdatePacketCounters(tv, dtv, p); DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } /** * \brief Print some stats to the log at program exit. * * \param tv Pointer to ThreadVars. * \param data Pointer to data, ErfFileThreadVars. */ void ReceiveErfFileThreadExitStats(ThreadVars *tv, void *data) { ErfFileThreadVars *etv = (ErfFileThreadVars *)data; SCLogInfo("Packets: %"PRIu32"; Bytes: %"PRIu64, etv->pkts, etv->bytes); } suricata-3.2.1/src/runmode-unittests.h0000644000000000000000000000166113051004444014667 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #ifndef __UTIL_RUNMODE_UNITTESTS_H__ #define __UTIL_RUNMODE_UNITTESTS_H__ int RunUnittests(int list_unittests, char *regex_arg); #endif /* __UTIL_RUNMODE_UNITTESTS_H__ */ suricata-3.2.1/src/app-layer-ftp.c0000644000000000000000000005021713051004444013633 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * App Layer Parser for FTP */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "flow-util.h" #include "detect-engine-state.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-ftp.h" #include "util-spm.h" #include "util-unittest.h" #include "util-debug.h" #include "util-memcmp.h" static int FTPGetLineForDirection(FtpState *state, FtpLineState *line_state) { void *ptmp; if (line_state->current_line_lf_seen == 1) { /* we have seen the lf for the previous line. Clear the parser * details to parse new line */ line_state->current_line_lf_seen = 0; if (line_state->current_line_db == 1) { line_state->current_line_db = 0; SCFree(line_state->db); line_state->db = NULL; line_state->db_len = 0; state->current_line = NULL; state->current_line_len = 0; } } uint8_t *lf_idx = memchr(state->input, 0x0a, state->input_len); if (lf_idx == NULL) { /* fragmented lines. Decoder event for special cases. Not all * fragmented lines should be treated as a possible evasion * attempt. With multi payload ftp chunks we can have valid * cases of fragmentation. But within the same segment chunk * if we see fragmentation then it's definitely something you * should alert about */ if (line_state->current_line_db == 0) { line_state->db = SCMalloc(state->input_len); if (line_state->db == NULL) { return -1; } line_state->current_line_db = 1; memcpy(line_state->db, state->input, state->input_len); line_state->db_len = state->input_len; } else { ptmp = SCRealloc(line_state->db, (line_state->db_len + state->input_len)); if (ptmp == NULL) { SCFree(line_state->db); line_state->db = NULL; line_state->db_len = 0; return -1; } line_state->db = ptmp; memcpy(line_state->db + line_state->db_len, state->input, state->input_len); line_state->db_len += state->input_len; } state->input += state->input_len; state->input_len = 0; return -1; } else { line_state->current_line_lf_seen = 1; if (line_state->current_line_db == 1) { ptmp = SCRealloc(line_state->db, (line_state->db_len + (lf_idx + 1 - state->input))); if (ptmp == NULL) { SCFree(line_state->db); line_state->db = NULL; line_state->db_len = 0; return -1; } line_state->db = ptmp; memcpy(line_state->db + line_state->db_len, state->input, (lf_idx + 1 - state->input)); line_state->db_len += (lf_idx + 1 - state->input); if (line_state->db_len > 1 && line_state->db[line_state->db_len - 2] == 0x0D) { line_state->db_len -= 2; state->current_line_delimiter_len = 2; } else { line_state->db_len -= 1; state->current_line_delimiter_len = 1; } state->current_line = line_state->db; state->current_line_len = line_state->db_len; } else { state->current_line = state->input; state->current_line_len = lf_idx - state->input; if (state->input != lf_idx && *(lf_idx - 1) == 0x0D) { state->current_line_len--; state->current_line_delimiter_len = 2; } else { state->current_line_delimiter_len = 1; } } state->input_len -= (lf_idx - state->input) + 1; state->input = (lf_idx + 1); return 0; } } static int FTPGetLine(FtpState *state) { SCEnter(); /* we have run out of input */ if (state->input_len <= 0) return -1; /* toserver */ if (state->direction == 0) return FTPGetLineForDirection(state, &state->line_state[0]); else return FTPGetLineForDirection(state, &state->line_state[1]); } /** * \brief This function is called to determine and set which command is being * transfered to the ftp server * \param ftp_state the ftp state structure for the parser * \param input input line of the command * \param len of the command * * \retval 1 when the command is parsed, 0 otherwise */ static int FTPParseRequestCommand(void *ftp_state, uint8_t *input, uint32_t input_len) { SCEnter(); FtpState *fstate = (FtpState *)ftp_state; fstate->command = FTP_COMMAND_UNKNOWN; if (input_len >= 4) { if (SCMemcmpLowercase("port", input, 4) == 0) { fstate->command = FTP_COMMAND_PORT; } /* else { * Add the ftp commands you need here * } */ } return 1; } /** * \brief This function is called to retrieve a ftp request * \param ftp_state the ftp state structure for the parser * \param input input line of the command * \param input_len length of the request * \param output the resulting output * * \retval 1 when the command is parsed, 0 otherwise */ static int FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); /* PrintRawDataFp(stdout, input,input_len); */ FtpState *state = (FtpState *)ftp_state; void *ptmp; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } state->input = input; state->input_len = input_len; /* toserver stream */ state->direction = 0; while (FTPGetLine(state) >= 0) { FTPParseRequestCommand(state, state->current_line, state->current_line_len); if (state->command == FTP_COMMAND_PORT) { if (state->current_line_len > state->port_line_size) { ptmp = SCRealloc(state->port_line, state->current_line_len); if (ptmp == NULL) { SCFree(state->port_line); state->port_line = NULL; state->port_line_size = 0; return 0; } state->port_line = ptmp; state->port_line_size = state->current_line_len; } memcpy(state->port_line, state->current_line, state->current_line_len); state->port_line_len = state->current_line_len; } } return 1; } /** * \brief This function is called to retrieve a ftp response * \param ftp_state the ftp state structure for the parser * \param input input line of the command * \param input_len length of the request * \param output the resulting output * * \retval 1 when the command is parsed, 0 otherwise */ static int FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return 1; } #ifdef DEBUG static SCMutex ftp_state_mem_lock = SCMUTEX_INITIALIZER; static uint64_t ftp_state_memuse = 0; static uint64_t ftp_state_memcnt = 0; #endif static void *FTPStateAlloc(void) { void *s = SCMalloc(sizeof(FtpState)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(FtpState)); #ifdef DEBUG SCMutexLock(&ftp_state_mem_lock); ftp_state_memcnt++; ftp_state_memuse+=sizeof(FtpState); SCMutexUnlock(&ftp_state_mem_lock); #endif return s; } static void FTPStateFree(void *s) { FtpState *fstate = (FtpState *) s; if (fstate->port_line != NULL) SCFree(fstate->port_line); if (fstate->line_state[0].db) SCFree(fstate->line_state[0].db); if (fstate->line_state[1].db) SCFree(fstate->line_state[1].db); SCFree(s); #ifdef DEBUG SCMutexLock(&ftp_state_mem_lock); ftp_state_memcnt--; ftp_state_memuse-=sizeof(FtpState); SCMutexUnlock(&ftp_state_mem_lock); #endif } static int FTPRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP, "USER ", 5, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP, "PASS ", 5, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_FTP, "PORT ", 5, 0, STREAM_TOSERVER) < 0) { return -1; } return 0; } void RegisterFTPParsers(void) { char *proto_name = "ftp"; /** FTP */ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_FTP, proto_name); if (FTPRegisterPatternsForProtocolDetection() < 0 ) return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER, FTPParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOCLIENT, FTPParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_FTP, FTPStateAlloc, FTPStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER | STREAM_TOCLIENT); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_FTP, FTPParserRegisterTests); #endif } void FTPAtExitPrintStats(void) { #ifdef DEBUG SCMutexLock(&ftp_state_mem_lock); SCLogDebug("ftp_state_memcnt %"PRIu64", ftp_state_memuse %"PRIu64"", ftp_state_memcnt, ftp_state_memuse); SCMutexUnlock(&ftp_state_mem_lock); #endif } /* UNITTESTS */ #ifdef UNITTESTS /** \test Send a get request in one chunk. */ int FTPParserTest01(void) { int result = 1; Flow f; uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n"; uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send a splitted get request. */ int FTPParserTest03(void) { int result = 1; Flow f; uint8_t ftpbuf1[] = "POR"; uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint8_t ftpbuf2[] = "T 192,168,1"; uint32_t ftplen2 = sizeof(ftpbuf2) - 1; /* minus the \0 */ uint8_t ftpbuf3[] = "1,1,10,20\r\n"; uint32_t ftplen3 = sizeof(ftpbuf3) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_START, ftpbuf1, ftplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2); if (r != 0) { SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_EOF, ftpbuf3, ftplen3); if (r != 0) { SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); return result; } /** \test See how it deals with an incomplete request. */ int FTPParserTest06(void) { int result = 1; Flow f; uint8_t ftpbuf1[] = "PORT"; uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, ftpbuf1, ftplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_UNKNOWN) { SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_UNKNOWN, ftp_state->command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test See how it deals with an incomplete request in multiple chunks. */ int FTPParserTest07(void) { int result = 1; Flow f; uint8_t ftpbuf1[] = "PO"; uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint8_t ftpbuf2[] = "RT\r\n"; uint32_t ftplen2 = sizeof(ftpbuf2) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_START, ftpbuf1, ftplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_EOF, ftpbuf2, ftplen2); if (r != 0) { SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Test case where chunks are smaller than the delim length and the * last chunk is supposed to match the delim. */ int FTPParserTest10(void) { int result = 1; Flow f; uint8_t ftpbuf1[] = "PORT 1,2,3,4,5,6\r\n"; uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < ftplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (ftplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, flags, &ftpbuf1[u], 1); if (r != 0) { SCLogDebug("toserver chunk %" PRIu32 " returned %" PRId32 ", expected 0: ", u, r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); } FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif /* UNITTESTS */ void FTPParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("FTPParserTest01", FTPParserTest01); UtRegisterTest("FTPParserTest03", FTPParserTest03); UtRegisterTest("FTPParserTest06", FTPParserTest06); UtRegisterTest("FTPParserTest07", FTPParserTest07); UtRegisterTest("FTPParserTest10", FTPParserTest10); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-privs.c0000644000000000000000000001670713051004444013276 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * File to drop the engine capabilities using libcap-ng by * Steve Grubb */ #ifndef OS_WIN32 #include #include #include "suricata-common.h" #include "util-debug.h" #include "suricata.h" #ifdef HAVE_LIBCAP_NG #include #ifdef HAVE_SYS_PRCTL_H #include #endif #include "threadvars.h" #include "util-cpu.h" #include "util-privs.h" #include "runmodes.h" /** flag indicating if we'll be using caps */ extern int sc_set_caps; /** our current runmode */ extern int run_mode; /** * \brief Drop all the previliges of the given thread */ void SCDropAllCaps() { capng_clear(CAPNG_SELECT_BOTH); if (capng_apply(CAPNG_SELECT_BOTH) < 0) { SCLogError(SC_ERR_CHANGING_CAPS_FAILED, "failed in dropping the caps"); exit(EXIT_FAILURE); } } /** * \brief Drop the previliges of the main thread */ void SCDropMainThreadCaps(uint32_t userid, uint32_t groupid) { if (sc_set_caps == FALSE) return; capng_clear(CAPNG_SELECT_BOTH); switch (run_mode) { case RUNMODE_PCAP_DEV: case RUNMODE_AFP_DEV: capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_NET_RAW, /* needed for pcap live mode */ CAP_SYS_NICE, CAP_NET_ADMIN, -1); break; case RUNMODE_PFRING: capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_NET_ADMIN, CAP_NET_RAW, CAP_SYS_NICE, -1); break; case RUNMODE_NFQ: capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_NET_ADMIN, /* needed for nfqueue inline mode */ CAP_SYS_NICE, -1); break; } if (capng_change_id(userid, groupid, CAPNG_DROP_SUPP_GRP | CAPNG_CLEAR_BOUNDING) < 0) { SCLogError(SC_ERR_CHANGING_CAPS_FAILED, "capng_change_id for main thread" " failed"); exit(EXIT_FAILURE); } SCLogInfo("dropped the caps for main thread"); } void SCDropCaps(ThreadVars *tv) { #if 0 capng_clear(CAPNG_SELECT_BOTH); capng_apply(CAPNG_SELECT_BOTH); if (tv->cap_flags & SC_CAP_IPC_LOCK) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_IPC_LOCK); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_IPC_LOCK has been set", tv->name); } if (tv->cap_flags & SC_CAP_NET_ADMIN) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_ADMIN); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_NET_ADMIN has been set", tv->name); } if (tv->cap_flags & SC_CAP_NET_BIND_SERVICE) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BIND_SERVICE); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_NET_BIND_SERVICE has been set", tv->name); } if (tv->cap_flags & SC_CAP_NET_BROADCAST) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BROADCAST); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_NET_BROADCAST has been set", tv->name); } if (tv->cap_flags & SC_CAP_NET_RAW) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_RAW); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_NET_RAW has been set", tv->name); } if (tv->cap_flags & SC_CAP_SYS_ADMIN) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_ADMIN); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_SYS_ADMIN has been set", tv->name); } if (tv->cap_flags & SC_CAP_SYS_RAW_IO) { capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_RAWIO); capng_apply(CAPNG_SELECT_CAPS); SCLogDebug("For thread \"%s\" CAP_SYS_RAWIO has been set", tv->name); } #endif } #endif /* HAVE_LIBCAP_NG */ /** * \brief Function to get the user and group ID from the specified user name * * \param user_name pointer to the given user name * \param uid pointer to the user id in which result will be stored * \param gid pointer to the group id in which result will be stored * * \retval upon success it return 0 */ int SCGetUserID(char *user_name, char *group_name, uint32_t *uid, uint32_t *gid) { uint32_t userid = 0; uint32_t groupid = 0; struct passwd *pw; /* Get the user ID */ if (isdigit((unsigned char)user_name[0]) != 0) { userid = atoi(user_name); pw = getpwuid(userid); if (pw == NULL) { SCLogError(SC_ERR_UID_FAILED, "unable to get the user ID, " "check if user exist!!"); exit(EXIT_FAILURE); } } else { pw = getpwnam(user_name); if (pw == NULL) { SCLogError(SC_ERR_UID_FAILED, "unable to get the user ID, " "check if user exist!!"); exit(EXIT_FAILURE); } userid = pw->pw_uid; } /* Get the group ID */ if (group_name != NULL) { struct group *gp; if (isdigit((unsigned char)group_name[0]) != 0) { groupid = atoi(group_name); } else { gp = getgrnam(group_name); if (gp == NULL) { SCLogError(SC_ERR_GID_FAILED, "unable to get the group" " ID, check if group exist!!"); exit(EXIT_FAILURE); } groupid = gp->gr_gid; } } else { groupid = pw->pw_gid; } /* close the group database */ endgrent(); /* close the user database */ endpwent(); *uid = userid; *gid = groupid; return 0; } /** * \brief Function to get the group ID from the specified group name * * \param group_name pointer to the given group name * \param gid pointer to the group id in which result will be stored * * \retval upon success it return 0 */ int SCGetGroupID(char *group_name, uint32_t *gid) { uint32_t grpid = 0; struct group *gp; /* Get the group ID */ if (isdigit((unsigned char)group_name[0]) != 0) { grpid = atoi(group_name); } else { gp = getgrnam(group_name); if (gp == NULL) { SCLogError(SC_ERR_GID_FAILED, "unable to get the group ID," " check if group exist!!"); exit(EXIT_FAILURE); } grpid = gp->gr_gid; } /* close the group database */ endgrent(); *gid = grpid; return 0; } #endif /* OS_WIN32 */ suricata-3.2.1/src/detect-ipproto.h0000644000000000000000000000302213051004444014111 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_IPPROTO_H__ #define __DETECT_IPPROTO_H__ /** IPProto Operators */ #define DETECT_IPPROTO_OP_EQ '=' /**< "equals" operator (default) */ #define DETECT_IPPROTO_OP_NOT '!' /**< "not" operator */ #define DETECT_IPPROTO_OP_LT '<' /**< "less than" operator */ #define DETECT_IPPROTO_OP_GT '>' /**< "greater than" operator */ /** ip_proto data */ typedef struct DetectIPProtoData_ { uint8_t op; /**< Operator used to compare */ uint8_t proto; /**< Protocol used to compare */ } DetectIPProtoData; /* prototypes */ /** * \brief Registration function for ip_proto keyword. */ void DetectIPProtoRegister (void); void DetectIPProtoRemoveAllSMs(Signature *); #endif /* __DETECT_IPPROTO_H__ */ suricata-3.2.1/src/runmode-netmap.c0000644000000000000000000003254013051004444014104 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup netmap * * @{ */ /** * \file * * \author Aleksey Katargin * * Netmap runmode * */ #include "suricata-common.h" #include "config.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-netmap.h" #include "log-httplog.h" #include "output.h" #include "detect-engine-mpm.h" #include "alert-fastlog.h" #include "alert-prelude.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-device.h" #include "util-runmodes.h" #include "util-ioctl.h" #include "source-netmap.h" extern int max_pending_packets; static const char *default_mode_workers = NULL; const char *RunModeNetmapGetDefaultMode(void) { return default_mode_workers; } void RunModeIdsNetmapRegister(void) { RunModeRegisterNewRunMode(RUNMODE_NETMAP, "single", "Single threaded netmap mode", RunModeIdsNetmapSingle); RunModeRegisterNewRunMode(RUNMODE_NETMAP, "workers", "Workers netmap mode, each thread does all" " tasks from acquisition to logging", RunModeIdsNetmapWorkers); default_mode_workers = "workers"; RunModeRegisterNewRunMode(RUNMODE_NETMAP, "autofp", "Multi threaded netmap mode. Packets from " "each flow are assigned to a single detect " "thread.", RunModeIdsNetmapAutoFp); return; } #ifdef HAVE_NETMAP static void NetmapDerefConfig(void *conf) { NetmapIfaceConfig *pfp = (NetmapIfaceConfig *)conf; /* config is used only once but cost of this low. */ if (SC_ATOMIC_SUB(pfp->ref, 1) == 0) { SCFree(pfp); } } static int ParseNetmapSettings(NetmapIfaceSettings *ns, const char *iface, ConfNode *if_root, ConfNode *if_default) { ns->threads = 0; ns->promisc = 1; ns->checksum_mode = CHECKSUM_VALIDATION_AUTO; ns->copy_mode = NETMAP_COPY_MODE_NONE; strlcpy(ns->iface, iface, sizeof(ns->iface)); if (ns->iface[0]) { size_t len = strlen(ns->iface); if (ns->iface[len-1] == '+') { ns->iface[len-1] = '\0'; ns->sw_ring = 1; } } char *bpf_filter = NULL; if (ConfGet("bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { ns->bpf_filter = bpf_filter; SCLogInfo("Going to use command-line provided bpf filter '%s'", ns->bpf_filter); } } if (if_root == NULL && if_default == NULL) { SCLogInfo("Unable to find netmap config for " "interface \"%s\" or \"default\", using default values", iface); goto finalize; /* If there is no setting for current interface use default one as main iface */ } else if (if_root == NULL) { if_root = if_default; if_default = NULL; } char *threadsstr = NULL; if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) { ns->threads = 0; } else { if (strcmp(threadsstr, "auto") == 0) { ns->threads = 0; } else { ns->threads = (uint8_t)atoi(threadsstr); } } /* load netmap bpf filter */ /* command line value has precedence */ if (ns->bpf_filter == NULL) { if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { ns->bpf_filter = bpf_filter; SCLogInfo("Going to use bpf filter %s", ns->bpf_filter); } } } int boolval = 0; (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "disable-promisc", (int *)&boolval); if (boolval) { SCLogInfo("Disabling promiscuous mode on iface %s", ns->iface); ns->promisc = 0; } char *tmpctype; if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) { if (strcmp(tmpctype, "auto") == 0) { ns->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (ConfValIsTrue(tmpctype)) { ns->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(tmpctype)) { ns->checksum_mode = CHECKSUM_VALIDATION_DISABLE; } else { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid value for " "checksum-checks for %s", iface); } } char *copymodestr; if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) { if (strcmp(copymodestr, "ips") == 0) { ns->copy_mode = NETMAP_COPY_MODE_IPS; } else if (strcmp(copymodestr, "tap") == 0) { ns->copy_mode = NETMAP_COPY_MODE_TAP; } else { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid copy-mode " "(valid are tap, ips)"); } } finalize: if (ns->sw_ring) { /* just one thread per interface supported */ ns->threads = 1; } else if (ns->threads == 0) { /* As NetmapGetRSSCount is broken on Linux, first run * GetIfaceRSSQueuesNum. If that fails, run NetmapGetRSSCount */ ns->threads = GetIfaceRSSQueuesNum(ns->iface); if (ns->threads == 0) { ns->threads = NetmapGetRSSCount(ns->iface); } } if (ns->threads <= 0) { ns->threads = 1; } /* netmap needs all offloading to be disabled */ if (LiveGetOffload() == 0) { (void)GetIfaceOffloading(ns->iface, 1, 1); } else { DisableIfaceOffloading(LiveGetDevice(ns->iface), 1, 1); } return 0; } /** * \brief extract information from config file * * The returned structure will be freed by the thread init function. * This is thus necessary to or copy the structure before giving it * to thread or to reparse the file for each thread (and thus have * new structure. * * \return a NetmapIfaceConfig corresponding to the interface name */ static void *ParseNetmapConfig(const char *iface_name) { ConfNode *if_root = NULL; ConfNode *if_default = NULL; ConfNode *netmap_node; char *out_iface = NULL; if (iface_name == NULL) { return NULL; } NetmapIfaceConfig *aconf = SCMalloc(sizeof(*aconf)); if (unlikely(aconf == NULL)) { return NULL; } memset(aconf, 0, sizeof(*aconf)); aconf->DerefFunc = NetmapDerefConfig; strlcpy(aconf->iface_name, iface_name, sizeof(aconf->iface_name)); SC_ATOMIC_INIT(aconf->ref); (void) SC_ATOMIC_ADD(aconf->ref, 1); /* Find initial node */ netmap_node = ConfGetNode("netmap"); if (netmap_node == NULL) { SCLogInfo("Unable to find netmap config using default value"); } else { if_root = ConfFindDeviceConfig(netmap_node, aconf->iface_name); if_default = ConfFindDeviceConfig(netmap_node, "default"); } /* parse settings for capture iface */ ParseNetmapSettings(&aconf->in, aconf->iface_name, if_root, if_default); /* if we have a copy iface, parse that as well */ if (netmap_node != NULL) { if (ConfGetChildValueWithDefault(if_root, if_default, "copy-iface", &out_iface) == 1) { if (strlen(out_iface) > 0) { if_root = ConfFindDeviceConfig(netmap_node, out_iface); ParseNetmapSettings(&aconf->out, out_iface, if_root, if_default); } } } SC_ATOMIC_RESET(aconf->ref); (void) SC_ATOMIC_ADD(aconf->ref, aconf->in.threads); SCLogPerf("Using %d threads for interface %s", aconf->in.threads, aconf->iface_name); return aconf; } static int NetmapConfigGeThreadsCount(void *conf) { NetmapIfaceConfig *aconf = (NetmapIfaceConfig *)conf; return aconf->in.threads; } int NetmapRunModeIsIPS() { int nlive = LiveGetDeviceCount(); int ldev; ConfNode *if_root; ConfNode *if_default = NULL; ConfNode *netmap_node; int has_ips = 0; int has_ids = 0; /* Find initial node */ netmap_node = ConfGetNode("netmap"); if (netmap_node == NULL) { return 0; } if_default = ConfNodeLookupKeyValue(netmap_node, "interface", "default"); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } char *copymodestr = NULL; if_root = ConfNodeLookupKeyValue(netmap_node, "interface", live_dev); if (if_root == NULL) { if (if_default == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = if_default; } if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) { if (strcmp(copymodestr, "ips") == 0) { has_ips = 1; } else { has_ids = 1; } } else { has_ids = 1; } } if (has_ids && has_ips) { SCLogInfo("Netmap mode using IPS and IDS mode"); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = ConfNodeLookupKeyValue(netmap_node, "interface", live_dev); char *copymodestr = NULL; if (if_root == NULL) { if (if_default == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = if_default; } if (! ((ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) && (strcmp(copymodestr, "ips") == 0))) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Netmap IPS mode used and interface '%s' is in IDS or TAP mode. " "Sniffing '%s' but expect bad result as stream-inline is activated.", live_dev, live_dev); } } } return has_ips; } #endif // #ifdef HAVE_NETMAP int RunModeIdsNetmapAutoFp(void) { SCEnter(); #ifdef HAVE_NETMAP int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("netmap.live-interface", &live_dev); SCLogDebug("live_dev %s", live_dev); ret = RunModeSetLiveCaptureAutoFp( ParseNetmapConfig, NetmapConfigGeThreadsCount, "ReceiveNetmap", "DecodeNetmap", thread_name_autofp, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsNetmapAutoFp initialised"); #endif /* HAVE_NETMAP */ SCReturnInt(0); } /** * \brief Single thread version of the netmap processing. */ int RunModeIdsNetmapSingle(void) { SCEnter(); #ifdef HAVE_NETMAP int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("netmap.live-interface", &live_dev); ret = RunModeSetLiveCaptureSingle( ParseNetmapConfig, NetmapConfigGeThreadsCount, "ReceiveNetmap", "DecodeNetmap", thread_name_single, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsNetmapSingle initialised"); #endif /* HAVE_NETMAP */ SCReturnInt(0); } /** * \brief Workers version of the netmap processing. * * Start N threads with each thread doing all the work. * */ int RunModeIdsNetmapWorkers(void) { SCEnter(); #ifdef HAVE_NETMAP int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("netmap.live-interface", &live_dev); ret = RunModeSetLiveCaptureWorkers( ParseNetmapConfig, NetmapConfigGeThreadsCount, "ReceiveNetmap", "DecodeNetmap", thread_name_workers, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsNetmapWorkers initialised"); #endif /* HAVE_NETMAP */ SCReturnInt(0); } /** * @} */ suricata-3.2.1/src/detect-tls.c0000644000000000000000000005625313051004444013230 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * * Implements the tls.* keywords */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "detect-tls.h" #include "stream-tcp.h" /** * \brief Regex for parsing "id" option, matching number or "number" */ #define PARSE_REGEX "^\\s*(\\!*)\\s*([A-z0-9\\s\\-\\.=,\\*@]+|\"[A-z0-9\\s\\-\\.=,\\*@]+\")\\s*$" #define PARSE_REGEX_FINGERPRINT "^\\s*(\\!*)\\s*([A-z0-9\\:\\*]+|\"[A-z0-9\\:\\* ]+\")\\s*$" static pcre *subject_parse_regex; static pcre_extra *subject_parse_regex_study; static pcre *issuerdn_parse_regex; static pcre_extra *issuerdn_parse_regex_study; static pcre *fingerprint_parse_regex; static pcre_extra *fingerprint_parse_regex_study; static int DetectTlsSubjectMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectTlsSubjectSetup (DetectEngineCtx *, Signature *, char *); static void DetectTlsSubjectRegisterTests(void); static void DetectTlsSubjectFree(void *); static int DetectTlsIssuerDNMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectTlsIssuerDNSetup (DetectEngineCtx *, Signature *, char *); static void DetectTlsIssuerDNRegisterTests(void); static void DetectTlsIssuerDNFree(void *); static int DetectTlsFingerprintMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectTlsFingerprintSetup (DetectEngineCtx *, Signature *, char *); static void DetectTlsFingerprintFree(void *); static int DetectTlsStoreSetup (DetectEngineCtx *, Signature *, char *); static int DetectTlsStoreMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); /** * \brief Registration function for keyword: tls.version */ void DetectTlsRegister (void) { sigmatch_table[DETECT_AL_TLS_SUBJECT].name = "tls.subject"; sigmatch_table[DETECT_AL_TLS_SUBJECT].desc = "match TLS/SSL certificate Subject field"; sigmatch_table[DETECT_AL_TLS_SUBJECT].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlssubject"; sigmatch_table[DETECT_AL_TLS_SUBJECT].Match = NULL; sigmatch_table[DETECT_AL_TLS_SUBJECT].AppLayerMatch = DetectTlsSubjectMatch; sigmatch_table[DETECT_AL_TLS_SUBJECT].Setup = DetectTlsSubjectSetup; sigmatch_table[DETECT_AL_TLS_SUBJECT].Free = DetectTlsSubjectFree; sigmatch_table[DETECT_AL_TLS_SUBJECT].RegisterTests = DetectTlsSubjectRegisterTests; sigmatch_table[DETECT_AL_TLS_ISSUERDN].name = "tls.issuerdn"; sigmatch_table[DETECT_AL_TLS_ISSUERDN].desc = "match TLS/SSL certificate IssuerDN field"; sigmatch_table[DETECT_AL_TLS_ISSUERDN].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsissuerdn"; sigmatch_table[DETECT_AL_TLS_ISSUERDN].Match = NULL; sigmatch_table[DETECT_AL_TLS_ISSUERDN].AppLayerMatch = DetectTlsIssuerDNMatch; sigmatch_table[DETECT_AL_TLS_ISSUERDN].Setup = DetectTlsIssuerDNSetup; sigmatch_table[DETECT_AL_TLS_ISSUERDN].Free = DetectTlsIssuerDNFree; sigmatch_table[DETECT_AL_TLS_ISSUERDN].RegisterTests = DetectTlsIssuerDNRegisterTests; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].name = "tls.fingerprint"; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].desc = "match TLS/SSL certificate SHA1 fingerprint"; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsfingerprint"; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].Match = NULL; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].AppLayerMatch = DetectTlsFingerprintMatch; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].Setup = DetectTlsFingerprintSetup; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].Free = DetectTlsFingerprintFree; sigmatch_table[DETECT_AL_TLS_FINGERPRINT].RegisterTests = NULL; sigmatch_table[DETECT_AL_TLS_STORE].name = "tls.store"; sigmatch_table[DETECT_AL_TLS_STORE].desc = "store TLS/SSL certificate on disk"; sigmatch_table[DETECT_AL_TLS_STORE].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsstore"; sigmatch_table[DETECT_AL_TLS_STORE].Match = NULL; sigmatch_table[DETECT_AL_TLS_STORE].AppLayerMatch = DetectTlsStoreMatch; sigmatch_table[DETECT_AL_TLS_STORE].Setup = DetectTlsStoreSetup; sigmatch_table[DETECT_AL_TLS_STORE].Free = NULL; sigmatch_table[DETECT_AL_TLS_STORE].RegisterTests = NULL; sigmatch_table[DETECT_AL_TLS_STORE].flags |= SIGMATCH_NOOPT; DetectSetupParseRegexes(PARSE_REGEX, &subject_parse_regex, &subject_parse_regex_study); DetectSetupParseRegexes(PARSE_REGEX, &issuerdn_parse_regex, &issuerdn_parse_regex_study); DetectSetupParseRegexes(PARSE_REGEX_FINGERPRINT, &fingerprint_parse_regex, &fingerprint_parse_regex_study); } /** * \brief match the specified Subject on a tls session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTlsData * * \retval 0 no match * \retval 1 match */ static int DetectTlsSubjectMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectTlsData *tls_data = (DetectTlsData *)m->ctx; SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(0); } int ret = 0; SSLStateConnp *connp = NULL; if (flags & STREAM_TOSERVER) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_subject != NULL) { SCLogDebug("TLS: Subject is [%s], looking for [%s]\n", connp->cert0_subject, tls_data->subject); if (strstr(connp->cert0_subject, tls_data->subject) != NULL) { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 0; } else { ret = 1; } } else { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 1; } else { ret = 0; } } } else { ret = 0; } SCReturnInt(ret); } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectTlsData on success * \retval NULL on failure */ static DetectTlsData *DetectTlsSubjectParse (char *str) { DetectTlsData *tls = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr; char *orig = NULL; char *tmp_str; uint32_t flag = 0; ret = pcre_exec(subject_parse_regex, subject_parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid tls.subject option"); goto error; } res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (str_ptr[0] == '!') flag = DETECT_CONTENT_NEGATED; pcre_free_substring(str_ptr); res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ tls = SCMalloc(sizeof(DetectTlsData)); if (unlikely(tls == NULL)) goto error; tls->subject = NULL; tls->flags = flag; orig = SCStrdup((char*)str_ptr); if (unlikely(orig == NULL)) { goto error; } pcre_free_substring(str_ptr); tmp_str=orig; /* Let's see if we need to escape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } tls->subject = SCStrdup(tmp_str); if (unlikely(tls->subject == NULL)) { goto error; } SCFree(orig); SCLogDebug("will look for TLS subject %s", tls->subject); return tls; error: if (orig != NULL) SCFree(orig); if (tls != NULL) DetectTlsSubjectFree(tls); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTlsSubjectSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectTlsData *tls = NULL; SigMatch *sm = NULL; tls = DetectTlsSubjectParse(str); if (tls == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_TLS_SUBJECT; sm->ctx = (void *)tls; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (tls != NULL) DetectTlsSubjectFree(tls); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTlsData * * \param id_d pointer to DetectTlsData */ static void DetectTlsSubjectFree(void *ptr) { DetectTlsData *id_d = (DetectTlsData *)ptr; if (ptr == NULL) return; if (id_d->subject != NULL) SCFree(id_d->subject); SCFree(id_d); } /** * \brief this function registers unit tests for DetectTlsSubject */ static void DetectTlsSubjectRegisterTests(void) { } /** * \brief match the specified IssuerDN on a tls session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTlsData * * \retval 0 no match * \retval 1 match */ static int DetectTlsIssuerDNMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectTlsData *tls_data = (DetectTlsData *)m->ctx; SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(0); } int ret = 0; SSLStateConnp *connp = NULL; if (flags & STREAM_TOSERVER) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_issuerdn != NULL) { SCLogDebug("TLS: IssuerDN is [%s], looking for [%s]\n", connp->cert0_issuerdn, tls_data->issuerdn); if (strstr(connp->cert0_issuerdn, tls_data->issuerdn) != NULL) { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 0; } else { ret = 1; } } else { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 1; } else { ret = 0; } } } else { ret = 0; } SCReturnInt(ret); } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectTlsData on success * \retval NULL on failure */ static DetectTlsData *DetectTlsIssuerDNParse(char *str) { DetectTlsData *tls = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr; char *orig = NULL; char *tmp_str; uint32_t flag = 0; ret = pcre_exec(issuerdn_parse_regex, issuerdn_parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid tls.issuerdn option"); goto error; } res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (str_ptr[0] == '!') flag = DETECT_CONTENT_NEGATED; pcre_free_substring(str_ptr); res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ tls = SCMalloc(sizeof(DetectTlsData)); if (unlikely(tls == NULL)) goto error; tls->issuerdn = NULL; tls->flags = flag; orig = SCStrdup((char*)str_ptr); if (unlikely(orig == NULL)) { goto error; } pcre_free_substring(str_ptr); tmp_str=orig; /* Let's see if we need to escape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } tls->issuerdn = SCStrdup(tmp_str); if (unlikely(tls->issuerdn == NULL)) { goto error; } SCFree(orig); SCLogDebug("Will look for TLS issuerdn %s", tls->issuerdn); return tls; error: if (orig != NULL) SCFree(orig); if (tls != NULL) DetectTlsIssuerDNFree(tls); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTlsIssuerDNSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectTlsData *tls = NULL; SigMatch *sm = NULL; tls = DetectTlsIssuerDNParse(str); if (tls == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_TLS_ISSUERDN; sm->ctx = (void *)tls; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (tls != NULL) DetectTlsIssuerDNFree(tls); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTlsData * * \param id_d pointer to DetectTlsData */ static void DetectTlsIssuerDNFree(void *ptr) { DetectTlsData *id_d = (DetectTlsData *)ptr; SCFree(id_d->issuerdn); SCFree(id_d); } /** * \brief This function is used to parse fingerprint passed via keyword: "fingerprint" * * \param idstr Pointer to the user provided fingerprint option * * \retval pointer to DetectTlsData on success * \retval NULL on failure */ static DetectTlsData *DetectTlsFingerprintParse (char *str) { DetectTlsData *tls = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr; char *orig; char *tmp_str; uint32_t flag = 0; ret = pcre_exec(fingerprint_parse_regex, fingerprint_parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid tls.fingerprint option"); goto error; } res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (str_ptr[0] == '!') flag = DETECT_CONTENT_NEGATED; pcre_free_substring(str_ptr); res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ tls = SCMalloc(sizeof(DetectTlsData)); if (unlikely(tls == NULL)) goto error; tls->fingerprint = NULL; tls->flags = flag; orig = SCStrdup((char*)str_ptr); if (unlikely(orig == NULL)) { goto error; } pcre_free_substring(str_ptr); tmp_str=orig; /* Let's see if we need to escape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } tls->fingerprint = SCStrdup(tmp_str); if (tls->fingerprint == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate fingerprint"); } SCFree(orig); SCLogDebug("will look for TLS fingerprint %s", tls->fingerprint); return tls; error: if (tls != NULL) DetectTlsFingerprintFree(tls); return NULL; } /** * \brief match the specified fingerprint on a tls session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTlsData * * \retval 0 no match * \retval 1 match */ static int DetectTlsFingerprintMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectTlsData *tls_data = (DetectTlsData *)m->ctx; SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(0); } int ret = 0; SSLStateConnp *connp = NULL; if (flags & STREAM_TOSERVER) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_fingerprint != NULL) { SCLogDebug("TLS: Fingerprint is [%s], looking for [%s]\n", connp->cert0_fingerprint, tls_data->fingerprint); if (tls_data->fingerprint && (strstr(connp->cert0_fingerprint, tls_data->fingerprint) != NULL)) { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 0; } else { ret = 1; } } else { if (tls_data->flags & DETECT_CONTENT_NEGATED) { ret = 1; } else { ret = 0; } } } else { ret = 0; } SCReturnInt(ret); } /** * \brief this function is used to add the parsed "fingerprint" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param id pointer to the user provided "fingerprint" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTlsFingerprintSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectTlsData *tls = NULL; SigMatch *sm = NULL; tls = DetectTlsFingerprintParse(str); if (tls == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_TLS_FINGERPRINT; sm->ctx = (void *)tls; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (tls != NULL) DetectTlsFingerprintFree(tls); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTlsData * * \param pointer to DetectTlsData */ static void DetectTlsFingerprintFree(void *ptr) { DetectTlsData *id_d = (DetectTlsData *)ptr; if (id_d->fingerprint) SCFree(id_d->fingerprint); SCFree(id_d); } /** * \brief this function is used to add the parsed "store" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "store" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTlsStoreSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { SigMatch *sm = NULL; s->flags |= SIG_FLAG_TLSSTORE; sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_TLS_STORE; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (sm != NULL) SCFree(sm); return -1; } /** \warning modifies state */ static int DetectTlsStoreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(1); } if (s->flags & SIG_FLAG_TLSSTORE) { ssl_state->server_connp.cert_log_flag |= SSL_TLS_LOG_PEM; } SCReturnInt(1); } /** * \brief this function registers unit tests for DetectTlsIssuerDN */ static void DetectTlsIssuerDNRegisterTests(void) { } suricata-3.2.1/src/detect-app-layer-protocol.h0000644000000000000000000000207113051004444016151 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_APP_LAYER_PROTOCOL__H__ #define __DETECT_APP_LAYER_PROTOCOL__H__ typedef struct DetectAppLayerProtocolData_ { AppProto alproto; uint8_t negated; } DetectAppLayerProtocolData; void DetectAppLayerProtocolRegister(void); #endif /* __DETECT_APP_LAYER_PROTOCOL__H__ */ suricata-3.2.1/src/decode-teredo.h0000644000000000000000000000151113051004444013653 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq); suricata-3.2.1/src/util-mpm-ac-cuda-kernel.cu0000644000000000000000000000701013051004444015645 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * The Cuda kernel for MPM AC. * * \todo - This is a basic version of the kernel. * - Support 16 bit state tables. * - Texture memory. * - Multiple threads per blocks of threads. Make use of * shared memory/texture memory. */ extern "C" __global__ void SCACCudaSearch64(unsigned char *d_buffer, unsigned int d_buffer_start_offset, unsigned int *o_buffer, unsigned int *results_buffer, unsigned int nop, unsigned char *tolower) { unsigned int u = 0; unsigned int tid = blockIdx.x * blockDim.x + threadIdx.x; if (tid >= nop) return; unsigned int buflen = *((unsigned long *)(d_buffer + (o_buffer[tid] - d_buffer_start_offset))); unsigned int (*state_table_u32)[256] = (unsigned int (*)[256])*((unsigned long *)(d_buffer + (o_buffer[tid] - d_buffer_start_offset) + 8)); unsigned char *buf = (d_buffer + (o_buffer[tid] - d_buffer_start_offset) + 16); unsigned int state = 0; unsigned int matches = 0; unsigned int *results = (results_buffer + ((o_buffer[tid] - d_buffer_start_offset) * 2) + 1); for (u = 0; u < buflen; u++) { state = state_table_u32[state & 0x00FFFFFF][tolower[buf[u]]]; if (state & 0xFF000000) { results[matches++] = u; results[matches++] = state & 0x00FFFFFF; } } *(results - 1) = matches; return; } extern "C" __global__ void SCACCudaSearch32(unsigned char *d_buffer, unsigned int d_buffer_start_offset, unsigned int *o_buffer, unsigned int *results_buffer, unsigned int nop, unsigned char *tolower) { unsigned int u = 0; unsigned int tid = blockIdx.x * blockDim.x + threadIdx.x; if (tid >= nop) return; unsigned int buflen = *((unsigned int *)(d_buffer + (o_buffer[tid] - d_buffer_start_offset))); unsigned int (*state_table_u32)[256] = (unsigned int (*)[256])*((unsigned int *)(d_buffer + (o_buffer[tid] - d_buffer_start_offset) + 4)); unsigned char *buf = (d_buffer + (o_buffer[tid] - d_buffer_start_offset) + 8); unsigned int state = 0; unsigned int matches = 0; unsigned int *results = (results_buffer + ((o_buffer[tid] - d_buffer_start_offset) * 2) + 1); for (u = 0; u < buflen; u++) { state = state_table_u32[state & 0x00FFFFFF][tolower[buf[u]]]; if (state & 0xFF000000) { results[matches++] = u; results[matches++] = state & 0x00FFFFFF; } } *(results - 1) = matches; return; } suricata-3.2.1/src/detect-isdataat.h0000644000000000000000000000237213051004444014216 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_ISDATAAT_H__ #define __DETECT_ISDATAAT_H__ #define ISDATAAT_RELATIVE 0x01 #define ISDATAAT_RAWBYTES 0x02 #define ISDATAAT_NEGATED 0x04 #define ISDATAAT_OFFSET_BE 0x08 #define ISDATAAT_MIN 0 #define ISDATAAT_MAX 65535 typedef struct DetectIsdataatData_ { uint16_t dataat; /* data offset to match */ uint8_t flags; /* isdataat options*/ } DetectIsdataatData; /* prototypes */ void DetectIsdataatRegister (void); #endif /* __DETECT_ISDATAAT_H__ */ suricata-3.2.1/src/app-layer-htp-file.h0000644000000000000000000000223513051004444014554 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #ifndef __APP_LAYER_HTP_FILE_H__ #define __APP_LAYER_HTP_FILE_H__ int HTPFileOpen(HtpState *, const uint8_t *, uint16_t, const uint8_t *, uint32_t, uint64_t, uint8_t); int HTPFileStoreChunk(HtpState *, const uint8_t *, uint32_t, uint8_t); int HTPFileClose(HtpState *, const uint8_t *, uint32_t, uint8_t, uint8_t); void HTPFileParserRegisterTests(void); #endif /* __APP_LAYER_HTP_FILE_H__ */ suricata-3.2.1/src/detect-rpc.h0000644000000000000000000000334013051004444013204 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_RPC_H__ #define __DETECT_RPC_H__ /* At least we check the program, the version is optional, * and the procedure is optional if we are checking the version. * If we parse the wildcard "*" we will allow any value (no check) */ #define DETECT_RPC_CHECK_PROGRAM 0x01 #define DETECT_RPC_CHECK_VERSION 0x02 #define DETECT_RPC_CHECK_PROCEDURE 0x04 /** Simple struct for a rpc msg call */ typedef struct RpcMsg_ { uint32_t xid; uint32_t type; /**< CALL = 0 (We only search for CALLS */ uint32_t rpcvers; /**< must be equal to two (2) */ uint32_t prog; uint32_t vers; uint32_t proc; } RpcMsg; /* Extract uint32_t */ #define EXT_GET_UINT32T(buf) ((long)ntohl((long)*(buf)++)) typedef struct DetectRpcData_ { uint32_t program; uint32_t program_version; uint32_t procedure; uint8_t flags; } DetectRpcData; /* prototypes */ void DetectRpcRegister (void); #endif /* __DETECT_RPC_H__ */ suricata-3.2.1/src/app-layer-htp-mem.h0000644000000000000000000000177113051004444014417 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "stream-tcp-reassemble.h" void HTPParseMemcap(); void *HTPMalloc(size_t size); void *HTPCalloc(size_t n, size_t size); void *HTPRealloc(void *ptr, size_t orig_size, size_t size); void HTPFree(void *ptr, size_t size); uint64_t HTPMemuseGlobalCounter(void); uint64_t HTPMemcapGlobalCounter(void); suricata-3.2.1/src/detect-bytejump.h0000644000000000000000000001052713051004444014264 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_BYTEJUMP_H__ #define __DETECT_BYTEJUMP_H__ /** Bytejump Base */ #define DETECT_BYTEJUMP_BASE_UNSET 0 /**< Unset type value string (automatic)*/ #define DETECT_BYTEJUMP_BASE_OCT 8 /**< "oct" type value string */ #define DETECT_BYTEJUMP_BASE_DEC 10 /**< "dec" type value string */ #define DETECT_BYTEJUMP_BASE_HEX 16 /**< "hex" type value string */ /** Bytejump Flags */ #define DETECT_BYTEJUMP_BEGIN 0x01 /**< "from_beginning" jump */ #define DETECT_BYTEJUMP_LITTLE 0x02 /**< "little" endian value */ #define DETECT_BYTEJUMP_BIG 0x04 /**< "big" endian value */ #define DETECT_BYTEJUMP_STRING 0x08 /**< "string" value */ #define DETECT_BYTEJUMP_RELATIVE 0x10 /**< "relative" offset */ #define DETECT_BYTEJUMP_ALIGN 0x20 /**< "align" offset */ #define DETECT_BYTEJUMP_DCE 0x40 /**< "dce" enabled */ #define DETECT_BYTEJUMP_OFFSET_BE 0x80 /**< "byte extract" enabled */ typedef struct DetectBytejumpData_ { uint8_t nbytes; /**< Number of bytes to compare */ uint8_t base; /**< String value base (oct|dec|hex) */ uint8_t flags; /**< Flags (big|little|relative|string) */ uint32_t multiplier; /**< Multiplier for nbytes (multiplier n)*/ int32_t offset; /**< Offset in payload to extract value */ int32_t post_offset; /**< Offset to adjust post-jump */ } DetectBytejumpData; /* prototypes */ /** * Registration function for byte_jump. * * \todo add support for no_stream and stream_only */ void DetectBytejumpRegister (void); /** * This function is used to add the parsed byte_jump data * into the current signature. * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ int DetectBytejumpSetup(DetectEngineCtx *, Signature *, char *); /** * \brief this function will free memory associated with DetectBytejumpData * * \param data pointer to DetectBytejumpData */ void DetectBytejumpFree(void *ptr); /** * This function is used to parse byte_jump options passed via * * byte_jump: bytes, offset [,flags [, ...]] * * flags: "big", "little", "relative", "string", "oct", "dec", "hex" * "align", "from beginning", "multiplier N", "post_offset N" * * \param optstr Pointer to the user provided byte_jump options * \param offset Used to pass the offset back, if byte_jump uses a byte_extract * var. * * \retval data pointer to DetectBytejumpData on success * \retval NULL on failure */ DetectBytejumpData *DetectBytejumpParse(char *optstr, char **offset); /** * This function is used to match byte_jump * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectBytejumpData * * \retval -1 error * \retval 0 no match * \retval 1 match * * \todo The return seems backwards. We should return a non-zero error code. * One of the error codes is "no match". As-is if someone accidentally * does: if (DetectBytejumpMatch(...)) { match }, then they catch an * error as a match. */ int DetectBytejumpMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx); int DetectBytejumpDoMatch(DetectEngineThreadCtx *, Signature *, const SigMatchCtx *, uint8_t *, uint32_t, uint8_t, int32_t); #endif /* __DETECT_BYTEJUMP_H__ */ suricata-3.2.1/src/detect-mark.c0000644000000000000000000002127713051004444013356 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Implements the mark keyword. Based on detect-gid * by Breno Silva */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "flow-var.h" #include "decode-events.h" #include "detect-mark.h" #include "detect-parse.h" #include "util-unittest.h" #include "util-debug.h" #define PARSE_REGEX "([0x]*[0-9a-f]+)/([0x]*[0-9a-f]+)" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectMarkSetup (DetectEngineCtx *, Signature *, char *); int DetectMarkPacket(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx); void DetectMarkDataFree(void *ptr); /** * \brief Registration function for nfq_set_mark: keyword */ void DetectMarkRegister (void) { sigmatch_table[DETECT_MARK].name = "nfq_set_mark"; sigmatch_table[DETECT_MARK].Match = DetectMarkPacket; sigmatch_table[DETECT_MARK].Setup = DetectMarkSetup; sigmatch_table[DETECT_MARK].Free = DetectMarkDataFree; sigmatch_table[DETECT_MARK].RegisterTests = MarkRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } #ifdef NFQ /** * \internal * \brief This function is used to parse mark options passed via mark: keyword * * \param rawstr Pointer to the user provided mark options * * \retval 0 on success * \retval < 0 on failure */ static void * DetectMarkParse (char *rawstr) { int ret = 0, res = 0; #define MAX_SUBSTRINGS 30 int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; char *ptr = NULL; char *endptr = NULL; uint32_t mark; uint32_t mask; DetectMarkData *data; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); return NULL; } res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return NULL; } ptr = (char *)str_ptr; if (ptr == NULL) return NULL; errno = 0; mark = strtoul(ptr, &endptr, 0); if (errno == ERANGE) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); SCFree(ptr); return NULL; } /* If there is no numeric value in the given string then strtoull(), makes endptr equals to ptr and return 0 as result */ else if (endptr == ptr && mark == 0) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "No numeric value"); SCFree(ptr); return NULL; } else if (endptr == ptr) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); SCFree(ptr); return NULL; } res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return NULL; } SCFree(ptr); ptr = (char *)str_ptr; if (ptr == NULL) { data = SCMalloc(sizeof(DetectMarkData)); if (unlikely(data == NULL)) { return NULL; } data->mark = mark; data->mask = 0xffff; return data; } errno = 0; mask = strtoul(ptr, &endptr, 0); if (errno == ERANGE) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); SCFree(ptr); return NULL; } /* If there is no numeric value in the given string then strtoull(), makes endptr equals to ptr and return 0 as result */ else if (endptr == ptr && mask == 0) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "No numeric value"); SCFree(ptr); return NULL; } else if (endptr == ptr) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); SCFree(ptr); return NULL; } SCLogDebug("Rule will set mark 0x%x with mask 0x%x", mark, mask); SCFree(ptr); data = SCMalloc(sizeof(DetectMarkData)); if (unlikely(data == NULL)) { return NULL; } data->mark = mark; data->mask = mask; return data; } #endif /* NFQ */ /** * \internal * \brief this function is used to add the parsed mark into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided mark options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectMarkSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { #ifdef NFQ DetectMarkData *data = NULL; SigMatch *sm = NULL; data = DetectMarkParse(rawstr); if (data == NULL) { return -1; } else { sm = SigMatchAlloc(); if (sm == NULL) { DetectMarkDataFree(data); return -1; } sm->type = DETECT_MARK; sm->ctx = (SigMatchCtx *)data; /* Append it to the list of tags */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_TMATCH); return 0; } #else return 0; #endif } void DetectMarkDataFree(void *ptr) { DetectMarkData *data = (DetectMarkData *)ptr; SCFree(data); } int DetectMarkPacket(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { #ifdef NFQ const DetectMarkData *nf_data = (const DetectMarkData *)ctx; if (nf_data->mask) { if (!(IS_TUNNEL_PKT(p))) { /* coverity[missing_lock] */ p->nfq_v.mark = (nf_data->mark & nf_data->mask) | (p->nfq_v.mark & ~(nf_data->mask)); p->flags |= PKT_MARK_MODIFIED; } else { /* real tunnels may have multiple flows inside them, so marking * might 'mark' too much. Rebuilt packets from IP fragments * are fine. */ if (p->flags & PKT_REBUILT_FRAGMENT) { Packet *tp = p->root ? p->root : p; SCMutexLock(&tp->tunnel_mutex); tp->nfq_v.mark = (nf_data->mark & nf_data->mask) | (tp->nfq_v.mark & ~(nf_data->mask)); tp->flags |= PKT_MARK_MODIFIED; SCMutexUnlock(&tp->tunnel_mutex); } } } #endif return 1; } /* * ONLY TESTS BELOW THIS COMMENT */ #if defined UNITTESTS && defined NFQ /** * \test MarkTestParse01 is a test for a valid mark value * * \retval 1 on succces * \retval 0 on failure */ static int MarkTestParse01 (void) { DetectMarkData *data; data = DetectMarkParse("1/1"); if (data == NULL) { return 0; } DetectMarkDataFree(data); return 1; } /** * \test MarkTestParse02 is a test for an invalid mark value * * \retval 1 on succces * \retval 0 on failure */ static int MarkTestParse02 (void) { DetectMarkData *data; data = DetectMarkParse("4"); if (data == NULL) { return 1; } DetectMarkDataFree(data); return 0; } /** * \test MarkTestParse03 is a test for a valid mark value * * \retval 1 on succces * \retval 0 on failure */ static int MarkTestParse03 (void) { DetectMarkData *data; data = DetectMarkParse("0x10/0xff"); if (data == NULL) { return 0; } DetectMarkDataFree(data); return 1; } /** * \test MarkTestParse04 is a test for a invalid mark value * * \retval 1 on succces * \retval 0 on failure */ static int MarkTestParse04 (void) { DetectMarkData *data; data = DetectMarkParse("0x1g/0xff"); if (data == NULL) { return 1; } DetectMarkDataFree(data); return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for Mark */ void MarkRegisterTests(void) { #if defined UNITTESTS && defined NFQ UtRegisterTest("MarkTestParse01", MarkTestParse01); UtRegisterTest("MarkTestParse02", MarkTestParse02); UtRegisterTest("MarkTestParse03", MarkTestParse03); UtRegisterTest("MarkTestParse04", MarkTestParse04); #endif /* UNITTESTS */ } suricata-3.2.1/src/ptxdump.py0000644000000000000000000000410713051004444013056 00000000000000#!/usr/bin/env python from string import * import os, getopt, sys, platform header = '''/* Auto-generated by ptxdump.py DO NOT EDIT * * This file contains the ptx code of the Cuda kernels. * A kernel is identified by its name and the compute capability (e.g. _sm_10). */ ''' def FormatCharHex(d): s = hex(ord(d)) if len(s) == 3: s = "0x0" + s[2] return s def CleanFileName(f): v = f.replace("-","_") v = v.replace(".ptx","") return v if not(len(sys.argv[1:]) >= 2): print("Usage: ptx2c.py ") print("Description: creates a header file containing the ptx files as character array" + os.linesep) sys.exit(0) out_h = sys.argv[1] + ".h" out = open(out_h, 'w') out.writelines(header) out.writelines("#ifdef __SC_CUDA_SUPPORT__\n") out.writelines("#ifndef __ptxdump_h__\n") out.writelines("#define __ptxdump_h__\n\n") # write char arrays for file in sys.argv[2:]: in_ptx = open(file, 'r') source = in_ptx.read() source_len = len(source) varname = CleanFileName(file) out.writelines("const unsigned char " + varname + "[" + str(source_len+1) + "] = {\n") newlinecnt = 0 for i in range(0, source_len): out.write(FormatCharHex(source[i]) + ", ") newlinecnt += 1 if newlinecnt == 16: newlinecnt = 0 out.write("\n") out.write("0x00\n};\n\n") print(sys.argv[0] + ": CUmodule " + varname + " packed successfully") # write retrieval function out.writelines("const unsigned char* SCCudaPtxDumpGetModule(const char* module){\n"); for file in sys.argv[2:]: out.writelines('\tif (!strcmp(module, "' + file.replace(".ptx","")+'"))\n') out.writelines("\t\treturn " + CleanFileName(file)+";\n") out.writelines('\tSCLogError(SC_ERR_FATAL, "Error in SCCudaPtxDumpGetModule, module %s not found. Exiting...",module);\n') out.writelines("\texit(EXIT_FAILURE);\n") out.writelines("};\n") out.writelines("#endif /* __ptxdump_h__ */\n") out.writelines("#endif /* __SC_CUDA_SUPPORT__ */\n") print(sys.argv[0] + ": " + out_h + " written successfully") in_ptx.close() out.close() suricata-3.2.1/src/output-filedata.h0000644000000000000000000000326613051004444014270 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer Filedata Logger Output registration functions */ #ifndef __OUTPUT_FILEDATA_H__ #define __OUTPUT_FILEDATA_H__ #include "decode.h" #include "util-file.h" #define OUTPUT_FILEDATA_FLAG_OPEN 0x01 #define OUTPUT_FILEDATA_FLAG_CLOSE 0x02 /** filedata logger function pointer type */ typedef int (*FiledataLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, const uint8_t *, uint32_t, uint8_t); /** packet logger condition function pointer type, * must return true for packets that should be logged */ //typedef int (*TxLogCondition)(ThreadVars *, const Packet *); int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputFiledataLoggerRegister(void); void OutputFiledataShutdown(void); #endif /* __OUTPUT_FILE_H__ */ suricata-3.2.1/src/util-error.c0000644000000000000000000003427713051004444013266 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Error utility functions * * \todo Needs refining of the error codes. Renaming with a prefix of SC_ERR, * removal of duplicates and entries have to be made in util-error.c */ #include "util-error.h" #define CASE_CODE(E) case E: return #E /** * \brief Maps the error code, to its string equivalent * * \param The error code * * \retval The string equivalent for the error code */ const char * SCErrorToString(SCError err) { switch (err) { CASE_CODE (SC_OK); CASE_CODE (SC_ERR_MEM_ALLOC); CASE_CODE (SC_ERR_ACTION_ORDER); CASE_CODE (SC_ERR_PCRE_MATCH); CASE_CODE (SC_ERR_PCRE_GET_SUBSTRING); CASE_CODE (SC_ERR_PCRE_COMPILE); CASE_CODE (SC_ERR_PCRE_STUDY); CASE_CODE (SC_ERR_PCRE_PARSE); CASE_CODE (SC_ERR_LOG_MODULE_NOT_INIT); CASE_CODE (SC_ERR_LOG_FG_FILTER_MATCH); CASE_CODE (SC_ERR_PCAP_DISPATCH); CASE_CODE (SC_ERR_PCAP_CREATE); CASE_CODE (SC_ERR_PCAP_SET_SNAPLEN); CASE_CODE (SC_ERR_PCAP_SET_PROMISC); CASE_CODE (SC_ERR_PCAP_SET_TIMEOUT); CASE_CODE (SC_ERR_PCAP_OPEN_LIVE); CASE_CODE (SC_ERR_PCAP_OPEN_OFFLINE); CASE_CODE (SC_ERR_PCAP_ACTIVATE_HANDLE); CASE_CODE (SC_ERR_PCAP_SET_BUFF_SIZE); CASE_CODE (SC_ERR_NO_PCAP_SET_BUFFER_SIZE); CASE_CODE (SC_ERR_NO_PF_RING); CASE_CODE (SC_ERR_PF_RING_RECV); CASE_CODE (SC_ERR_PF_RING_GET_CLUSTERID_FAILED); CASE_CODE (SC_ERR_PF_RING_GET_INTERFACE_FAILED); CASE_CODE (SC_ERR_PF_RING_OPEN); CASE_CODE (SC_ERR_GET_CLUSTER_TYPE_FAILED); CASE_CODE (SC_ERR_INVALID_CLUSTER_TYPE); CASE_CODE (SC_ERR_PF_RING_SET_CLUSTER_FAILED); CASE_CODE (SC_ERR_DATALINK_UNIMPLEMENTED); CASE_CODE (SC_ERR_INVALID_SIGNATURE); CASE_CODE (SC_ERR_OPENING_FILE); CASE_CODE (SC_ERR_OPENING_RULE_FILE); CASE_CODE (SC_ERR_NO_RULES); CASE_CODE (SC_ERR_NO_RULES_LOADED); CASE_CODE (SC_ERR_COUNTER_EXCEEDED); CASE_CODE (SC_ERR_INVALID_CHECKSUM); CASE_CODE (SC_ERR_SPRINTF); CASE_CODE (SC_ERR_FATAL); CASE_CODE (SC_ERR_INVALID_ARGUMENT); CASE_CODE (SC_ERR_SPINLOCK); CASE_CODE (SC_ERR_INVALID_ENUM_MAP); CASE_CODE (SC_ERR_INVALID_IP_NETBLOCK); CASE_CODE (SC_ERR_INVALID_IPV4_ADDR); CASE_CODE (SC_ERR_INVALID_IPV6_ADDR); CASE_CODE (SC_ERR_INVALID_RUNMODE); CASE_CODE (SC_ERR_COMPLETE_PORT_SPACE_NEGATED); CASE_CODE (SC_ERR_NO_PORTS_LEFT_AFTER_MERGE); CASE_CODE (SC_ERR_NEGATED_VALUE_IN_PORT_RANGE); CASE_CODE (SC_ERR_PORT_PARSE_INSERT_STRING); CASE_CODE (SC_ERR_UNREACHABLE_CODE_REACHED); CASE_CODE (SC_ERR_INVALID_NUMERIC_VALUE); CASE_CODE (SC_ERR_NUMERIC_VALUE_ERANGE); CASE_CODE (SC_ERR_INVALID_NUM_BYTES); CASE_CODE (SC_ERR_ARG_LEN_LONG); CASE_CODE (SC_ERR_ALPARSER); CASE_CODE (SC_ERR_POOL_EMPTY); CASE_CODE (SC_ERR_REASSEMBLY); CASE_CODE (SC_ERR_POOL_INIT); CASE_CODE (SC_ERR_UNIMPLEMENTED); CASE_CODE (SC_ERR_ADDRESS_ENGINE_GENERIC); CASE_CODE (SC_ERR_PORT_ENGINE_GENERIC); CASE_CODE (SC_ERR_FAST_LOG_GENERIC); CASE_CODE (SC_ERR_IPONLY_RADIX); CASE_CODE (SC_ERR_DEBUG_LOG_GENERIC); CASE_CODE (SC_ERR_UNIFIED_LOG_GENERIC); CASE_CODE (SC_ERR_HTTP_LOG_GENERIC); CASE_CODE (SC_ERR_UNIFIED_ALERT_GENERIC); CASE_CODE (SC_ERR_UNIFIED2_ALERT_GENERIC); CASE_CODE (SC_ERR_FWRITE); CASE_CODE (SC_ERR_FOPEN); CASE_CODE (SC_ERR_THREAD_NICE_PRIO); CASE_CODE (SC_ERR_THREAD_SPAWN); CASE_CODE (SC_ERR_THREAD_CREATE); CASE_CODE (SC_ERR_THREAD_INIT); CASE_CODE (SC_ERR_THREAD_DEINIT); CASE_CODE (SC_ERR_THRESHOLD_HASH_ADD); CASE_CODE (SC_ERR_UNDEFINED_VAR); CASE_CODE (SC_ERR_RULE_KEYWORD_UNKNOWN); CASE_CODE (SC_ERR_FLAGS_MODIFIER); CASE_CODE (SC_ERR_DISTANCE_MISSING_CONTENT); CASE_CODE (SC_ERR_BYTETEST_MISSING_CONTENT); CASE_CODE (SC_ERR_BYTEJUMP_MISSING_CONTENT); CASE_CODE (SC_ERR_WITHIN_MISSING_CONTENT); CASE_CODE (SC_ERR_WITHIN_INVALID); CASE_CODE (SC_ERR_DEPTH_MISSING_CONTENT); CASE_CODE (SC_ERR_OFFSET_MISSING_CONTENT); CASE_CODE (SC_ERR_NOCASE_MISSING_PATTERN); CASE_CODE (SC_ERR_RAWBYTES_MISSING_CONTENT); CASE_CODE (SC_ERR_NO_URICONTENT_NEGATION); CASE_CODE (SC_ERR_HASH_TABLE_INIT); CASE_CODE (SC_ERR_STAT); CASE_CODE (SC_ERR_LOGDIR_CONFIG); CASE_CODE (SC_ERR_LOGDIR_CMDLINE); CASE_CODE (SC_ERR_RADIX_TREE_GENERIC); CASE_CODE (SC_ERR_MISSING_QUOTE); CASE_CODE (SC_ERR_UNKNOWN_PROTOCOL); CASE_CODE (SC_ERR_UNKNOWN_RUN_MODE); CASE_CODE (SC_ERR_IPFW_NOSUPPORT); CASE_CODE (SC_ERR_IPFW_BIND); CASE_CODE (SC_ERR_IPFW_SOCK); CASE_CODE (SC_ERR_IPFW_SETSOCKOPT); CASE_CODE (SC_ERR_IPFW_NOPORT); CASE_CODE (SC_WARN_IPFW_RECV); CASE_CODE (SC_WARN_IPFW_XMIT); CASE_CODE (SC_WARN_IPFW_SETSOCKOPT); CASE_CODE (SC_WARN_IPFW_UNBIND); CASE_CODE (SC_ERR_MULTIPLE_RUN_MODE); CASE_CODE (SC_ERR_BPF); CASE_CODE (SC_ERR_MISSING_CONFIG_PARAM); CASE_CODE (SC_ERR_UNKNOWN_VALUE); CASE_CODE (SC_ERR_INVALID_VALUE); CASE_CODE (SC_ERR_UNKNOWN_REGEX_MOD); CASE_CODE (SC_ERR_INVALID_OPERATOR); CASE_CODE (SC_ERR_PCAP_RECV_INIT); CASE_CODE (SC_ERR_NFQ_NOSUPPORT); CASE_CODE (SC_ERR_NFQ_UNBIND); CASE_CODE (SC_ERR_NFQ_BIND); CASE_CODE (SC_ERR_NFQ_HANDLE_PKT); CASE_CODE (SC_ERR_NFLOG_NOSUPPORT); CASE_CODE (SC_ERR_NFLOG_OPEN); CASE_CODE (SC_ERR_NFLOG_BIND); CASE_CODE (SC_ERR_NFLOG_UNBIND); CASE_CODE (SC_ERR_NFLOG_MAX_BUFSIZ); CASE_CODE (SC_ERR_NFLOG_SET_MODE); CASE_CODE (SC_ERR_NFLOG_HANDLE_PKT); CASE_CODE (SC_ERR_NFLOG_GROUP); CASE_CODE (SC_ERR_NFLOG_FD); CASE_CODE (SC_WARN_NFLOG_SETSOCKOPT); CASE_CODE (SC_WARN_NFLOG_RECV); CASE_CODE (SC_WARN_NFLOG_LOSING_EVENTS); CASE_CODE (SC_WARN_NFLOG_MAXBUFSIZ_REACHED); CASE_CODE (SC_ERR_CUDA_ERROR); CASE_CODE (SC_ERR_CUDA_HANDLER_ERROR); CASE_CODE (SC_ERR_TM_THREADS_ERROR); CASE_CODE (SC_ERR_TM_MODULES_ERROR); CASE_CODE (SC_ERR_AC_CUDA_ERROR); CASE_CODE (SC_ERR_INVALID_YAML_CONF_ENTRY); CASE_CODE (SC_ERR_TMQ_ALREADY_REGISTERED); CASE_CODE (SC_ERR_CONFLICTING_RULE_KEYWORDS); CASE_CODE (SC_ERR_INITIALIZATION); CASE_CODE (SC_ERR_INVALID_ACTION); CASE_CODE (SC_ERR_LIBNET_REQUIRED_FOR_ACTION); CASE_CODE (SC_ERR_LIBNET_INIT); CASE_CODE (SC_ERR_LIBNET_INVALID_DIR); CASE_CODE (SC_ERR_LIBNET_BUILD_FAILED); CASE_CODE (SC_ERR_LIBNET_WRITE_FAILED); CASE_CODE (SC_ERR_LIBNET_NOT_ENABLED); CASE_CODE (SC_ERR_UNIFIED_LOG_FILE_HEADER); CASE_CODE (SC_ERR_REFERENCE_UNKNOWN); CASE_CODE (SC_ERR_PIDFILE_SNPRINTF); CASE_CODE (SC_ERR_PIDFILE_OPEN); CASE_CODE (SC_ERR_PIDFILE_WRITE); CASE_CODE (SC_ERR_PIDFILE_DAEMON); CASE_CODE (SC_ERR_UID_FAILED); CASE_CODE (SC_ERR_GID_FAILED); CASE_CODE (SC_ERR_CHANGING_CAPS_FAILED); CASE_CODE (SC_ERR_LIBCAP_NG_REQUIRED); CASE_CODE (SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG); CASE_CODE (SC_WARN_FLOW_EMERGENCY); CASE_CODE (SC_ERR_SVC); CASE_CODE (SC_ERR_ERF_DAG_OPEN_FAILED); CASE_CODE (SC_ERR_ERF_DAG_STREAM_OPEN_FAILED); CASE_CODE (SC_ERR_ERF_DAG_STREAM_START_FAILED); CASE_CODE (SC_ERR_ERF_DAG_STREAM_SET_FAILED); CASE_CODE (SC_ERR_ERF_DAG_STREAM_READ_FAILED); CASE_CODE (SC_WARN_ERF_DAG_REC_LEN_CHANGED); CASE_CODE (SC_ERR_NAPATECH_OPEN_FAILED); CASE_CODE (SC_ERR_NAPATECH_STREAM_NEXT_FAILED); CASE_CODE (SC_ERR_NAPATECH_NOSUPPORT); CASE_CODE (SC_ERR_NAPATECH_REQUIRED); CASE_CODE (SC_ERR_NAPATECH_TIMESTAMP_TYPE_NOT_SUPPORTED); CASE_CODE (SC_ERR_NAPATECH_INIT_FAILED); CASE_CODE (SC_ERR_NAPATECH_CONFIG_STREAM); CASE_CODE (SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED); CASE_CODE (SC_ERR_NAPATECH_STAT_DROPS_FAILED); CASE_CODE (SC_ERR_NAPATECH_PARSE_CONFIG); CASE_CODE (SC_WARN_COMPATIBILITY); CASE_CODE (SC_ERR_DCERPC); CASE_CODE (SC_ERR_DETECT_PREPARE); CASE_CODE (SC_ERR_AHO_CORASICK); CASE_CODE (SC_ERR_REFERENCE_CONFIG); CASE_CODE (SC_ERR_DUPLICATE_SIG); CASE_CODE (SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL); CASE_CODE (SC_ERR_PCAP_MULTI_DEV_NO_SUPPORT); CASE_CODE (SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT); CASE_CODE (SC_ERR_HTTP_METHOD_INCOMPATIBLE_WITH_RAWBYTES); CASE_CODE (SC_ERR_HTTP_METHOD_RELATIVE_MISSING); CASE_CODE (SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT); CASE_CODE (SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES); CASE_CODE (SC_ERR_HTTP_COOKIE_RELATIVE_MISSING); CASE_CODE (SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING); CASE_CODE (SC_ERR_UNKNOWN_DECODE_EVENT); CASE_CODE (SC_ERR_RUNMODE); CASE_CODE (SC_ERR_SHUTDOWN); CASE_CODE (SC_ERR_INVALID_DIRECTION); CASE_CODE (SC_ERR_AFP_CREATE); CASE_CODE (SC_ERR_AFP_READ); CASE_CODE (SC_ERR_AFP_DISPATCH); CASE_CODE (SC_ERR_CMD_LINE); CASE_CODE (SC_ERR_SIZE_PARSE); CASE_CODE (SC_ERR_RAWBYTES_FILE_DATA); CASE_CODE (SC_ERR_SOCKET); CASE_CODE (SC_ERR_PCAP_TRANSLATE); CASE_CODE (SC_WARN_OUTDATED_LIBHTP); CASE_CODE (SC_WARN_DEPRECATED); CASE_CODE (SC_WARN_PROFILE); CASE_CODE (SC_ERR_FLOW_INIT); CASE_CODE (SC_ERR_HOST_INIT); CASE_CODE (SC_ERR_MEM_BUFFER_API); CASE_CODE (SC_ERR_INVALID_MD5); CASE_CODE (SC_ERR_NO_MD5_SUPPORT); CASE_CODE (SC_ERR_EVENT_ENGINE); CASE_CODE (SC_ERR_NO_LUA_SUPPORT); CASE_CODE (SC_ERR_LUA_ERROR); CASE_CODE (SC_ERR_NO_GEOIP_SUPPORT); CASE_CODE (SC_ERR_GEOIP_ERROR); CASE_CODE (SC_ERR_DEFRAG_INIT); CASE_CODE (SC_ERR_NO_REPUTATION); CASE_CODE (SC_ERR_NOT_SUPPORTED); CASE_CODE (SC_ERR_LIVE_RULE_SWAP); CASE_CODE (SC_WARN_UNCOMMON); CASE_CODE (SC_ERR_SYSCALL); CASE_CODE (SC_ERR_SYSCONF); CASE_CODE (SC_ERR_INVALID_ARGUMENTS); CASE_CODE (SC_ERR_STATS_NOT_INIT); CASE_CODE (SC_ERR_NFQ_OPEN); CASE_CODE (SC_ERR_NFQ_MAXLEN); CASE_CODE (SC_ERR_NFQ_CREATE_QUEUE); CASE_CODE (SC_ERR_NFQ_SET_MODE); CASE_CODE (SC_ERR_NFQ_SETSOCKOPT); CASE_CODE (SC_ERR_NFQ_RECV); CASE_CODE (SC_ERR_NFQ_SET_VERDICT); CASE_CODE (SC_ERR_NFQ_THREAD_INIT); CASE_CODE (SC_ERR_DAEMON); CASE_CODE (SC_ERR_TLS_LOG_GENERIC); CASE_CODE (SC_ERR_MUTEX); CASE_CODE (SC_ERR_REPUTATION_INVALID_OPERATION); CASE_CODE (SC_ERR_REPUTATION_INVALID_TYPE); CASE_CODE (SC_ERR_BYTE_EXTRACT_FAILED); CASE_CODE (SC_ERR_DAG_REQUIRED); CASE_CODE (SC_ERR_DAG_NOSUPPORT); CASE_CODE (SC_ERR_NO_AF_PACKET); CASE_CODE (SC_ERR_PCAP_FILE_DELETE_FAILED); CASE_CODE (SC_ERR_MAGIC_OPEN); CASE_CODE (SC_ERR_MAGIC_LOAD); CASE_CODE (SC_ERR_CUDA_BUFFER_ERROR); CASE_CODE (SC_ERR_DNS_LOG_GENERIC); CASE_CODE (SC_WARN_OPTION_OBSOLETE); CASE_CODE (SC_WARN_NO_UNITTESTS); CASE_CODE (SC_ERR_THREAD_QUEUE); CASE_CODE (SC_WARN_XFF_INVALID_MODE); CASE_CODE (SC_WARN_XFF_INVALID_HEADER); CASE_CODE (SC_WARN_XFF_INVALID_DEPLOYMENT); CASE_CODE (SC_ERR_THRESHOLD_SETUP); CASE_CODE (SC_ERR_DNS_CONFIG); CASE_CODE (SC_ERR_MODBUS_CONFIG); CASE_CODE (SC_ERR_CONF_YAML_ERROR); CASE_CODE (SC_ERR_ENIP_CONFIG); CASE_CODE (SC_ERR_CONF_NAME_TOO_LONG); CASE_CODE (SC_ERR_APP_LAYER_PROTOCOL_DETECTION); CASE_CODE (SC_ERR_PCIE_INIT_FAILED); CASE_CODE (SC_WARN_LUA_SCRIPT); CASE_CODE (SC_ERR_LUA_SCRIPT); CASE_CODE (SC_WARN_NO_STATS_LOGGERS); CASE_CODE (SC_ERR_NO_NETMAP); CASE_CODE (SC_ERR_NETMAP_CREATE); CASE_CODE (SC_ERR_NETMAP_READ); CASE_CODE (SC_ERR_IPPAIR_INIT); CASE_CODE (SC_ERR_MT_NO_SELECTOR); CASE_CODE (SC_ERR_MT_DUPLICATE_TENANT); CASE_CODE (SC_ERR_MT_NO_MAPPING); CASE_CODE (SC_ERR_NO_JSON_SUPPORT); CASE_CODE (SC_ERR_INVALID_RULE_ARGUMENT); CASE_CODE (SC_ERR_STATS_LOG_NEGATED); CASE_CODE (SC_ERR_JSON_STATS_LOG_NEGATED); CASE_CODE (SC_ERR_DEPRECATED_CONF); CASE_CODE (SC_WARN_FASTER_CAPTURE_AVAILABLE); CASE_CODE (SC_WARN_POOR_RULE); CASE_CODE (SC_ERR_ALERT_PAYLOAD_BUFFER); CASE_CODE (SC_ERR_STATS_LOG_GENERIC); CASE_CODE (SC_ERR_TCPDATA_LOG_GENERIC); CASE_CODE (SC_ERR_FLOW_LOG_GENERIC); CASE_CODE (SC_ERR_NETFLOW_LOG_GENERIC); CASE_CODE (SC_ERR_SMTP_LOG_GENERIC); CASE_CODE (SC_ERR_SSH_LOG_GENERIC); CASE_CODE (SC_ERR_NIC_OFFLOADING); CASE_CODE (SC_ERR_NO_FILES_FOR_PROTOCOL); CASE_CODE (SC_ERR_INVALID_HASH); CASE_CODE (SC_ERR_NO_SHA1_SUPPORT); CASE_CODE (SC_ERR_NO_SHA256_SUPPORT); CASE_CODE (SC_ERR_DNP3_CONFIG); CASE_CODE (SC_ERR_DIR_OPEN); CASE_CODE(SC_WARN_REMOVE_FILE); CASE_CODE (SC_ERR_NO_MAGIC_SUPPORT); CASE_CODE (SC_ERR_REDIS); } return "UNKNOWN_ERROR"; } suricata-3.2.1/src/util-pool-thread.h0000644000000000000000000000650013051004444014344 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup utilpool * * @{ */ /** * \file * * \author Victor Julien */ /** * Consumers of this API MUST add PoolThreadReserved as the first * member in the data structure. They also MUST ignore that data * completely. It's managed by this API. * * It's purpose is to make sure thread X can return data to a pool * from thread Y. */ #ifndef __UTIL_POOL_THREAD_H__ #define __UTIL_POOL_THREAD_H__ struct PoolThreadElement_ { SCMutex lock; /**< lock, should have low contention */ Pool *pool; /**< actual pool */ }; // __attribute__((aligned(CLS))); <- VJ: breaks on clang 32bit, segv in PoolThreadTestGrow01 typedef struct PoolThreadElement_ PoolThreadElement; typedef struct PoolThread_ { size_t size; /**< size of the array */ PoolThreadElement *array; /**< array of elements */ } PoolThread; /** per data item reserved data containing the * thread pool id */ typedef uint16_t PoolThreadReserved; void PoolThreadRegisterTests(void); /** \brief initialize a thread pool * \note same as PoolInit() except for "threads" * \param threads number of threads to use this * \retval pt thread pool or NULL on error */ PoolThread *PoolThreadInit(int threads, uint32_t size, uint32_t prealloc_size, uint32_t elt_size, void *(*Alloc)(), int (*Init)(void *, void *), void *InitData, void (*Cleanup)(void *), void (*Free)(void *)); /** \brief grow a thread pool by one * \note calls PoolInit so all args but 'pt' are the same * \param pt thread pool to grow * \retval r id of new entry on succes, -1 on error */ int PoolThreadGrow(PoolThread *pt, uint32_t size, uint32_t prealloc_size, uint32_t elt_size, void *(*Alloc)(), int (*Init)(void *, void *), void *InitData, void (*Cleanup)(void *), void (*Free)(void *)); /** \brief destroy the thread pool * \note wrapper around PoolFree() * \param pt thread pool */ void PoolThreadFree(PoolThread *pt); /** \brief get data from thread pool by thread id * \note wrapper around PoolGet() * \param pt thread pool * \param id thread id * \retval ptr data or NULL */ void *PoolThreadGetById(PoolThread *pt, uint16_t id); /** \brief return data to thread pool * \note wrapper around PoolReturn() * \param pt thread pool * \param data memory block to return, with PoolThreadReserved as it's first member */ void PoolThreadReturn(PoolThread *pt, void *data); /** \brief get size of PoolThread (number of 'threads', so array elements) * \param pt thread pool * \retval size or -1 on error */ int PoolThreadSize(PoolThread *pt); #endif /* __UTIL_POOL_THREAD_H__ */ /** * @} */ suricata-3.2.1/src/util-ioctl.h0000644000000000000000000000245213051004444013242 00000000000000/* Copyright (C) 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #include "util-device.h" int GetIfaceMTU(const char *pcap_dev); int GetIfaceMaxPacketSize(const char *pcap_dev); int GetIfaceOffloading(const char *dev, int csum, int other); int GetIfaceRSSQueuesNum(const char *pcap_dev); #ifdef SIOCGIFFLAGS int GetIfaceFlags(const char *ifname); #endif #ifdef SIOCSIFFLAGS int SetIfaceFlags(const char *ifname, int flags); #endif #ifdef SIOCGIFCAP int GetIfaceCaps(const char *ifname); #endif int DisableIfaceOffloading(LiveDevice *dev, int csum, int other); void RestoreIfaceOffloading(LiveDevice *dev); suricata-3.2.1/src/data-queue.h0000644000000000000000000000415713051004444013214 00000000000000/** * Copyright (c) 2009, 2010 Open Information Security Foundation. * * \author Anoop Saldanha * * \file Generic queues. Any instance that wants to get itself on the generic * queue, would have to implement the template struct SCDQGenericQData_ * defined below. */ #ifndef __DATA_QUEUE_H__ #define __DATA_QUEUE_H__ #include "threads.h" /** * \brief Generic template for any data structure that wants to be on the * queue. Any other data structure that wants to be on the queue * needs to use this template and define its own members from * onwards. */ typedef struct SCDQGenericQData_ { /* this is needed when we want to supply a list of data items */ struct SCDQGenericQData_ *next; struct SCDQGenericQData_ *prev; /* if we want to consider this pointer as the head of a list, this var * holds the no of elements in the list. Else it holds a . */ //uint16_t len; /* in case this data instance is the head of a list, we can refer the * bottomost instance directly using this var */ //struct SCDQGenericaQData *bot; /* any other data structure that wants to be on the queue can implement * its own memebers from here on, in its structure definition. Just note * that the first 2 members should always be next and prev in the same * order */ // } SCDQGenericQData; /** * \brief The data queue to hold instances that implement the template * SCDQGenericQData. */ typedef struct SCDQDataQueue_ { /* holds the item at the top of the queue */ SCDQGenericQData *top; /* holds the item at the bottom of the queue */ SCDQGenericQData *bot; /* no of items currently in the queue */ uint16_t len; #ifdef DBG_PERF uint16_t dbg_maxlen; #endif /* DBG_PERF */ SCMutex mutex_q; SCCondT cond_q; } __attribute__((aligned(CLS))) SCDQDataQueue; void SCDQDataEnqueue(SCDQDataQueue *, SCDQGenericQData *); SCDQGenericQData *SCDQDataDequeue(SCDQDataQueue *); #endif /* __DATA_QUEUE_H__ */ suricata-3.2.1/src/util-spm-bs.h0000644000000000000000000000221613051004444013327 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo */ #ifndef __UTIL_SPM_BS__ #define __UTIL_SPM_BS__ #include "suricata-common.h" #include "suricata.h" uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint16_t); uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint16_t); void BasicSearchInit (void); #endif /* __UTIL_SPM_BS__ */ suricata-3.2.1/src/detect-engine-hcd.h0000644000000000000000000000270113051004444014421 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HCD_H__ #define __DETECT_ENGINE_HCD_H__ #include "app-layer-htp.h" int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpCookie(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpCookieRegisterTests(void); #endif /* __DETECT_ENGINE_HCD_H__ */ suricata-3.2.1/src/detect-dnp3.c0000644000000000000000000007041513051004444013266 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "stream.h" #include "detect.h" #include "detect-parse.h" #include "detect-dnp3.h" #include "detect-engine.h" #include "detect-engine-content-inspection.h" #include "app-layer-dnp3.h" /** * The detection struct. */ typedef struct DetectDNP3_ { union { struct { /* Function code for function code detection. */ uint8_t function_code; }; struct { /* Internal indicator flags for IIN detection. */ uint16_t ind_flags; }; struct { /* Object info for object detection. */ uint8_t obj_group; uint8_t obj_variation; }; }; } DetectDNP3; /** * Indicator names to value mappings (Snort compatible). */ DNP3Mapping DNP3IndicatorsMap[] = { {"device_restart", 0x8000}, {"device_trouble", 0x4000}, {"local_control", 0x2000}, {"need_time", 0x1000}, {"class_3_events", 0x0800}, {"class_2_events", 0x0400}, {"class_1_events", 0x0200}, {"all_stations", 0x0100}, {"reserved_1", 0x0080}, {"reserved_2", 0x0040}, {"config_corrupt", 0x0020}, {"already_executing", 0x0010}, {"event_buffer_overflow", 0x0008}, {"parameter_error", 0x0004}, {"object_unknown", 0x0002}, {"no_func_code_support", 0x0001}, {NULL, 0}, }; /** * Application function code name to code mappings (Snort compatible). */ DNP3Mapping DNP3FunctionNameMap[] = { {"confirm", 0}, {"read", 1}, {"write", 2}, {"select", 3}, {"operate", 4}, {"direct_operate", 5}, {"direct_operate_nr", 6}, {"immed_freeze", 7}, {"immed_freeze_nr", 8}, {"freeze_clear", 9}, {"freeze_clear_nr", 10}, {"freeze_at_time", 11}, {"freeze_at_time_nr", 12}, {"cold_restart", 13}, {"warm_restart", 14}, {"initialize_data", 15}, {"initialize_appl", 16}, {"start_appl", 17}, {"stop_appl", 18}, {"save_config", 19}, {"enable_unsolicited", 20}, {"disable_unsolicited", 21}, {"assign_class", 22}, {"delay_measure", 23}, {"record_current_time", 24}, {"open_file", 25}, {"close_file", 26}, {"delete_file", 27}, {"get_file_info", 28}, {"authenticate_file", 29}, {"abort_file", 30}, {"activate_config", 31}, {"authenticate_req", 32}, {"authenticate_err", 33}, {"response", 129}, {"unsolicited_response", 130}, {"authenticate_resp", 131} }; static void DetectDNP3FuncRegisterTests(void); static void DetectDNP3IndRegisterTests(void); static void DetectDNP3ObjRegisterTests(void); static void DetectDNP3DataRegisterTests(void); /** * \brief Utility function to trim leading and trailing whitespace * from a string. */ static char *TrimString(char *str) { char *end = str + strlen(str) - 1; while (isspace(*str)) { str++; } while (end > str && isspace(*end)) { end--; } *(end + 1) = '\0'; return str; } static int DetectEngineInspectDNP3Data(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { SCEnter(); DNP3Transaction *tx = (DNP3Transaction *)txv; int r = 0; /* Content match - should probably be put into its own file. */ if (flags & STREAM_TOSERVER && tx->request_buffer != NULL) { r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DNP3_DATA_MATCH], f, tx->request_buffer, tx->request_buffer_len, 0, 0, NULL); } else if (flags & STREAM_TOCLIENT && tx->response_buffer != NULL) { r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DNP3_DATA_MATCH], f, tx->response_buffer, tx->response_buffer_len, 0, 0, NULL); } SCReturnInt(r); } static int DetectEngineInspectDNP3(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { return DetectEngineInspectGenericList(tv, de_ctx, det_ctx, s, f, flags, alstate, txv, tx_id, DETECT_SM_LIST_DNP3_MATCH); } /** * \brief Parse the provided function name or code to its integer * value. * * If the value passed is a number, it will be checked that it falls * within the range of valid function codes. If function name is * passed it will be resolved to its function code. * * \retval The function code as an integer if successul, -1 on * failure. */ static int DetectDNP3FuncParseFunctionCode(char *str, uint8_t *fc) { if (ByteExtractStringUint8(fc, 10, strlen(str), str) >= 0) { return 1; } /* Lookup by name. */ for (size_t i = 0; i < sizeof(DNP3FunctionNameMap) / sizeof(DNP3Mapping); i++) { if (strcasecmp(str, DNP3FunctionNameMap[i].name) == 0) { *fc = DNP3FunctionNameMap[i].value; return 1; } } return 0; } static int DetectDNP3FuncSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); DetectDNP3 *dnp3 = NULL; SigMatch *sm = NULL; uint8_t function_code; if (!DetectDNP3FuncParseFunctionCode(str, &function_code)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid argument \"%s\" supplied to dnp3_func keyword.", str); return -1; } dnp3 = SCCalloc(1, sizeof(DetectDNP3)); if (unlikely(dnp3 == NULL)) { goto error; } dnp3->function_code = function_code; sm = SigMatchAlloc(); if (sm == NULL) { goto error; } sm->type = DETECT_AL_DNP3FUNC; sm->ctx = (void *)dnp3; s->alproto = ALPROTO_DNP3; s->flags |= SIG_FLAG_STATE_MATCH; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNP3_MATCH); SCReturnInt(0); error: if (dnp3 != NULL) { SCFree(dnp3); } if (sm != NULL) { SCFree(sm); } SCReturnInt(-1); } static int DetectDNP3IndParseByName(char *str, uint16_t *flags) { char tmp[strlen(str) + 1]; char *p, *last = NULL; strlcpy(tmp, str, sizeof(tmp)); for ((p = strtok_r(tmp, ",", &last)); p; (p = strtok_r(NULL, ",", &last))) { p = TrimString(p); int found = 0; int i = 0; while (DNP3IndicatorsMap[i].name != NULL) { if (strcasecmp(p, DNP3IndicatorsMap[i].name) == 0) { *flags |= DNP3IndicatorsMap[i].value; found = 1; break; } i++; } if (!found) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Bad argument \"%s\" supplied to dnp3.ind keyword.", p); return 0; } } return 1; } static int DetectDNP3IndParse(char *str, uint16_t *flags) { *flags = 0; if (ByteExtractStringUint16(flags, 0, strlen(str), str) > 0) { return 1; } /* Parse by name - will log a more specific error message on error. */ if (DetectDNP3IndParseByName(str, flags)) { return 1; } return 0; } static int DetectDNP3IndSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); DetectDNP3 *detect = NULL; SigMatch *sm = NULL; uint16_t flags; if (!DetectDNP3IndParse(str, &flags)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid argument \"%s\" supplied to dnp3.ind keyword.", str); return -1; } detect = SCCalloc(1, sizeof(DetectDNP3)); if (unlikely(detect == NULL)) { goto error; } detect->ind_flags = flags; sm = SigMatchAlloc(); if (sm == NULL) { goto error; } sm->type = DETECT_AL_DNP3IND; sm->ctx = (void *)detect; s->alproto = ALPROTO_DNP3; s->flags |= SIG_FLAG_STATE_MATCH; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNP3_MATCH); SCReturnInt(0); error: if (detect != NULL) { SCFree(detect); } if (sm != NULL) { SCFree(sm); } SCReturnInt(-1); } /** * \brief Parse the value of string of the dnp3_obj keyword. * * \param str the input string * \param gout pointer to variable to store the parsed group integer * \param vout pointer to variable to store the parsed variation integer * * \retval 1 if parsing successful otherwise 0. */ static int DetectDNP3ObjParse(const char *str, uint8_t *group, uint8_t *var) { size_t size = strlen(str) + 1; char groupstr[size], *varstr, *sep; strlcpy(groupstr, str, size); sep = strchr(groupstr, ','); if (sep == NULL) { return 0; } *sep = '\0'; varstr = sep + 1; if (ByteExtractStringUint8(group, 0, strlen(groupstr), groupstr) < 0) { return 0; } if (ByteExtractStringUint8(var, 0, strlen(varstr), varstr) < 0) { return 0; } return 1; } static int DetectDNP3ObjSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); uint8_t group; uint8_t variation; DetectDNP3 *detect = NULL; SigMatch *sm = NULL; if (!DetectDNP3ObjParse(str, &group, &variation)) { goto fail; } detect = SCCalloc(1, sizeof(*detect)); if (unlikely(detect == NULL)) { goto fail; } detect->obj_group = group; detect->obj_variation = variation; sm = SigMatchAlloc(); if (unlikely(sm == NULL)) { goto fail; } sm->type = DETECT_AL_DNP3OBJ; sm->ctx = (void *)detect; s->alproto = ALPROTO_DNP3; s->flags |= SIG_FLAG_STATE_MATCH; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNP3_MATCH); SCReturnInt(1); fail: if (detect != NULL) { SCFree(detect); } if (sm != NULL) { SCFree(sm); } SCReturnInt(0); } static void DetectDNP3Free(void *ptr) { SCEnter(); if (ptr != NULL) { SCFree(ptr); } SCReturn; } static int DetectDNP3FuncMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx) { DNP3Transaction *tx = (DNP3Transaction *)txv; DetectDNP3 *detect = (DetectDNP3 *)ctx; int match = 0; if (flags & STREAM_TOSERVER) { match = detect->function_code == tx->request_ah.function_code; } else if (flags & STREAM_TOCLIENT) { match = detect->function_code == tx->response_ah.function_code; } return match; } static int DetectDNP3ObjMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx) { DNP3Transaction *tx = (DNP3Transaction *)txv; DetectDNP3 *detect = (DetectDNP3 *)ctx; DNP3ObjectList *objects = NULL; if (flags & STREAM_TOSERVER) { objects = &tx->request_objects; } else if (flags & STREAM_TOCLIENT) { objects = &tx->response_objects; } if (objects != NULL) { DNP3Object *object; TAILQ_FOREACH(object, objects, next) { if (object->group == detect->obj_group && object->variation == detect->obj_variation) { return 1; } } } return 0; } static int DetectDNP3IndMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx) { DNP3Transaction *tx = (DNP3Transaction *)txv; DetectDNP3 *detect = (DetectDNP3 *)ctx; if (flags & STREAM_TOCLIENT) { if ((tx->response_iin.iin1 & (detect->ind_flags >> 8)) || (tx->response_iin.iin2 & (detect->ind_flags & 0xf))) { return 1; } } return 0; } static void DetectDNP3FuncRegister(void) { SCEnter(); sigmatch_table[DETECT_AL_DNP3FUNC].name = "dnp3_func"; sigmatch_table[DETECT_AL_DNP3FUNC].alias = "dnp3.func"; sigmatch_table[DETECT_AL_DNP3FUNC].Match = NULL; sigmatch_table[DETECT_AL_DNP3FUNC].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_DNP3FUNC].AppLayerTxMatch = DetectDNP3FuncMatch; sigmatch_table[DETECT_AL_DNP3FUNC].Setup = DetectDNP3FuncSetup; sigmatch_table[DETECT_AL_DNP3FUNC].Free = DetectDNP3Free; sigmatch_table[DETECT_AL_DNP3FUNC].RegisterTests = DetectDNP3FuncRegisterTests; SCReturn; } static void DetectDNP3IndRegister(void) { SCEnter(); sigmatch_table[DETECT_AL_DNP3IND].name = "dnp3_ind"; sigmatch_table[DETECT_AL_DNP3IND].alias = "dnp3.ind"; sigmatch_table[DETECT_AL_DNP3IND].Match = NULL; sigmatch_table[DETECT_AL_DNP3IND].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_DNP3IND].AppLayerTxMatch = DetectDNP3IndMatch; sigmatch_table[DETECT_AL_DNP3IND].Setup = DetectDNP3IndSetup; sigmatch_table[DETECT_AL_DNP3IND].Free = DetectDNP3Free; sigmatch_table[DETECT_AL_DNP3IND].RegisterTests = DetectDNP3IndRegisterTests; SCReturn; } static void DetectDNP3ObjRegister(void) { SCEnter(); sigmatch_table[DETECT_AL_DNP3OBJ].name = "dnp3_obj"; sigmatch_table[DETECT_AL_DNP3OBJ].alias = "dnp3.obj"; sigmatch_table[DETECT_AL_DNP3OBJ].Match = NULL; sigmatch_table[DETECT_AL_DNP3OBJ].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_DNP3OBJ].AppLayerTxMatch = DetectDNP3ObjMatch; sigmatch_table[DETECT_AL_DNP3OBJ].Setup = DetectDNP3ObjSetup; sigmatch_table[DETECT_AL_DNP3OBJ].Free = DetectDNP3Free; sigmatch_table[DETECT_AL_DNP3OBJ].RegisterTests = DetectDNP3ObjRegisterTests; SCReturn; } static int DetectDNP3DataSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); s->list = DETECT_SM_LIST_DNP3_DATA_MATCH; s->alproto = ALPROTO_DNP3; SCReturnInt(0); } static void DetectDNP3DataRegister(void) { SCEnter(); sigmatch_table[DETECT_AL_DNP3DATA].name = "dnp3_data"; sigmatch_table[DETECT_AL_DNP3DATA].Match = NULL; sigmatch_table[DETECT_AL_DNP3DATA].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_DNP3DATA].Setup = DetectDNP3DataSetup; sigmatch_table[DETECT_AL_DNP3DATA].Free = NULL; sigmatch_table[DETECT_AL_DNP3DATA].RegisterTests = DetectDNP3DataRegisterTests; sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_PAYLOAD; DetectAppLayerInspectEngineRegister(ALPROTO_DNP3, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNP3_DATA_MATCH, DetectEngineInspectDNP3Data); DetectAppLayerInspectEngineRegister(ALPROTO_DNP3, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_DNP3_DATA_MATCH, DetectEngineInspectDNP3Data); SCReturn; } void DetectDNP3Register(void) { DetectDNP3DataRegister(); DetectDNP3FuncRegister(); DetectDNP3IndRegister(); DetectDNP3ObjRegister(); /* Register the list of func, ind and obj. */ DetectAppLayerInspectEngineRegister(ALPROTO_DNP3, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNP3_MATCH, DetectEngineInspectDNP3); DetectAppLayerInspectEngineRegister(ALPROTO_DNP3, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_DNP3_MATCH, DetectEngineInspectDNP3); } #ifdef UNITTESTS #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer-parser.h" #include "detect-engine.h" #include "flow-util.h" #include "stream-tcp.h" static int DetectDNP3FuncParseFunctionCodeTest(void) { uint8_t fc; /* Valid. */ FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("0", &fc)); FAIL_IF(fc != 0); FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("1", &fc)); FAIL_IF(fc != 1); FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("254", &fc)); FAIL_IF(fc != 254); FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("255", &fc)); FAIL_IF(fc != 255); FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("confirm", &fc)); FAIL_IF(fc != 0); FAIL_IF_NOT(DetectDNP3FuncParseFunctionCode("CONFIRM", &fc)); FAIL_IF(fc != 0); /* Invalid. */ FAIL_IF(DetectDNP3FuncParseFunctionCode("", &fc)); FAIL_IF(DetectDNP3FuncParseFunctionCode("-1", &fc)); FAIL_IF(DetectDNP3FuncParseFunctionCode("-2", &fc)); FAIL_IF(DetectDNP3FuncParseFunctionCode("256", &fc)); FAIL_IF(DetectDNP3FuncParseFunctionCode("unknown_function_code", &fc)); PASS; } static int DetectDNP3FuncTest01(void) { DetectEngineCtx *de_ctx = NULL; DetectDNP3 *dnp3func = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->sig_list = SigInit(de_ctx, "alert dnp3 any any -> any any " "(msg:\"SURICATA DNP3 Write request\"; " "dnp3_func:2; sid:5000009; rev:1;)"); FAIL_IF_NULL(de_ctx->sig_list); FAIL_IF_NULL(de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH]); FAIL_IF_NULL(de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH]->ctx); dnp3func = (DetectDNP3 *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH]->ctx; FAIL_IF(dnp3func->function_code != 2); if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } PASS; } static int DetectDNP3IndTestParseAsInteger(void) { uint16_t flags = 0; FAIL_IF(!DetectDNP3IndParse("0", &flags)); FAIL_IF(flags != 0); FAIL_IF(!DetectDNP3IndParse("1", &flags)); FAIL_IF(flags != 0x0001); FAIL_IF(!DetectDNP3IndParse("0x0", &flags)); FAIL_IF(flags != 0); FAIL_IF(!DetectDNP3IndParse("0x0000", &flags)); FAIL_IF(flags != 0); FAIL_IF(!DetectDNP3IndParse("0x0001", &flags)); FAIL_IF(flags != 0x0001); FAIL_IF(!DetectDNP3IndParse("0x8421", &flags)); FAIL_IF(flags != 0x8421); FAIL_IF(DetectDNP3IndParse("a", &flags)); PASS; } static int DetectDNP3IndTestParseByName(void) { uint16_t flags = 0; FAIL_IF(!DetectDNP3IndParse("all_stations", &flags)); FAIL_IF(!(flags & 0x0100)); FAIL_IF(!DetectDNP3IndParse("class_1_events , class_2_events", &flags)); FAIL_IF(!(flags & 0x0200)); FAIL_IF(!(flags & 0x0400)); FAIL_IF((flags & 0xf9ff)); FAIL_IF(DetectDNP3IndParse("something", &flags)); PASS; } static int DetectDNP3ObjSetupTest(void) { DetectEngineCtx *de_ctx = NULL; DetectDNP3 *detect = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->sig_list = SigInit(de_ctx, "alert dnp3 any any -> any any " "(msg:\"SURICATA DNP3 Object Test\"; " "dnp3_obj:99,99; sid:1; rev:1;)"); FAIL_IF(de_ctx->sig_list == NULL); FAIL_IF(de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH] == NULL); FAIL_IF(de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH]->ctx == NULL); detect = (DetectDNP3 *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_DNP3_MATCH]->ctx; FAIL_IF(detect->obj_group != 99); FAIL_IF(detect->obj_variation != 99); if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } PASS; } static int DetectDNP3ObjParseTest(void) { uint8_t group, var; FAIL_IF(!DetectDNP3ObjParse("0,0", &group, &var)); FAIL_IF(group != 0 || var != 0); FAIL_IF(!DetectDNP3ObjParse("255,255", &group, &var)); FAIL_IF(group != 255 || var != 255); FAIL_IF(DetectDNP3ObjParse("-1,-1", &group, &var)); FAIL_IF(DetectDNP3ObjParse("256,256", &group, &var)); FAIL_IF(DetectDNP3ObjParse("a,1", &group, &var)); FAIL_IF(DetectDNP3ObjParse("1,a", &group, &var)); PASS; } /** * Test request (to server) content match. */ static int DetectDNP3DataTest01(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p; TcpSession tcp; ThreadVars tv; uint8_t request[] = { 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, /* CRC. */ 0x72, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, /* CRC. */ 0xff, 0xff, }; /* Setup flow. */ memset(&f, 0, sizeof(Flow)); memset(&tcp, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof(ThreadVars)); p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_DNP3; f.protoctx = (void *)&tcp; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); /* Either direction - should match. */ Signature *s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00 00 00 00|\"; " "sid:1; rev:1;)"); FAIL_IF(s == NULL); /* To server - should match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "flow:established,to_server; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00 00 00 00|\"; " "sid:2; rev:1;)"); FAIL_IF(s == NULL); /* To client - should not match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "flow:established,to_client; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00 00 00 00|\"; " "sid:3; rev:1;)"); FAIL_IF(s == NULL); /* The content of a CRC - should not match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "dnp3_data; " "content:\"|72 ef|\"; " "sid:4; rev:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); SCMutexLock(&f.m); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request)); SCMutexUnlock(&f.m); FAIL_IF(r); FAIL_IF(f.alstate == NULL); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); FAIL_IF(!PacketAlertCheck(p, 2)); FAIL_IF(PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } /** * Test response (to client) content match. */ static int DetectDNP3DataTest02(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p; TcpSession tcp; ThreadVars tv; uint8_t request[] = { /* Link header. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, /* CRC. */ 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, /* CRC. */ 0x72, 0xef, /* Application layer. */ 0x00, 0x00, 0x00, 0x00, 0x00, /* CRC. */ 0xff, 0xff, }; uint8_t response[] = { /* Link header. */ 0x05, 0x64, 0x1c, 0x44, 0x01, 0x00, 0x02, 0x00, /* CRC. */ 0xe2, 0x59, /* Transport header. */ 0xc3, /* Application layyer. */ 0xc9, 0x81, 0x00, 0x00, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, /* CRC. */ 0x7a, 0x65, /* Application layer. */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* CRC. */ 0xff, 0xff }; /* Setup flow. */ memset(&f, 0, sizeof(Flow)); memset(&tcp, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof(ThreadVars)); p = UTHBuildPacket(response, sizeof(response), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_DNP3; f.protoctx = (void *)&tcp; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOCLIENT | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); /* Either direction - should match. */ Signature *s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00|\"; " "sid:1; rev:1;)"); FAIL_IF(s == NULL); /* To server - should not match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "flow:established,to_server; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00|\"; " "sid:2; rev:1;)"); FAIL_IF(s == NULL); /* To client - should match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "flow:established,to_client; " "dnp3_data; " "content:\"|01 01 01 00 00 00 00|\"; " "sid:3; rev:1;)"); FAIL_IF(s == NULL); /* The content of a CRC - should not match. */ s = DetectEngineAppendSig(de_ctx, "alert dnp3 any any -> any any (" "msg:\"DetectDNP3DataTest01\"; " "dnp3_data; " "content:\"|7a 65|\"; " "sid:4; rev:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* Send through the request, then response. */ SCMutexLock(&f.m); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request)); SCMutexUnlock(&f.m); FAIL_IF(r); FAIL_IF(f.alstate == NULL); SCMutexLock(&f.m); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNP3, STREAM_TOCLIENT, response, sizeof(response)); SCMutexUnlock(&f.m); FAIL_IF(r); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); FAIL_IF(!PacketAlertCheck(p, 3)); FAIL_IF(PacketAlertCheck(p, 4)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } #endif static void DetectDNP3FuncRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDNP3FuncParseFunctionCodeTest", DetectDNP3FuncParseFunctionCodeTest); UtRegisterTest("DetectDNP3FuncTest01", DetectDNP3FuncTest01); #endif } static void DetectDNP3IndRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDNP3IndTestParseAsInteger", DetectDNP3IndTestParseAsInteger); UtRegisterTest("DetectDNP3IndTestParseByName", DetectDNP3IndTestParseByName); #endif } static void DetectDNP3ObjRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDNP3ObjParseTest", DetectDNP3ObjParseTest); UtRegisterTest("DetectDNP3ObjSetupTest", DetectDNP3ObjSetupTest); #endif } void DetectDNP3DataRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDNP3DataTest01", DetectDNP3DataTest01); UtRegisterTest("DetectDNP3DataTest02", DetectDNP3DataTest02); #endif } suricata-3.2.1/src/util-mpm-ac-bs.h0000644000000000000000000000456413051004444013712 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * */ #include "util-mpm.h" #define SC_AC_BS_STATE_TYPE_U16 uint16_t #define SC_AC_BS_STATE_TYPE_U32 uint32_t typedef struct SCACBSPatternList_ { uint8_t *cs; uint16_t patlen; /* sid(s) for this pattern */ uint32_t sids_size; SigIntId *sids; } SCACBSPatternList; typedef struct SCACBSOutputTable_ { /* list of pattern sids */ uint32_t *pids; /* no of entries we have in pids */ uint32_t no_of_entries; } SCACBSOutputTable; typedef struct SCACBSCtx_ { /* pattern arrays. We need this only during the goto table creation phase */ MpmPattern **parray; /* no of states used by ac */ uint32_t state_count; uint32_t pattern_id_bitarray_size; /* the all important memory hungry state_table */ SC_AC_BS_STATE_TYPE_U16 (*state_table_u16)[256]; /* the all important memory hungry state_table */ SC_AC_BS_STATE_TYPE_U32 (*state_table_u32)[256]; /* the modified goto_table */ uint8_t *state_table_mod; uint8_t **state_table_mod_pointers; /* goto_table, failure table and output table. Needed to create state_table. * Will be freed, once we have created the state_table */ int32_t (*goto_table)[256]; int32_t *failure_table; SCACBSOutputTable *output_table; SCACBSPatternList *pid_pat_list; /* the size of each state */ uint16_t single_state_size; } SCACBSCtx; typedef struct SCACBSThreadCtx_ { /* the total calls we make to the search function */ uint32_t total_calls; /* the total patterns that we ended up matching against */ uint64_t total_matches; } SCACBSThreadCtx; void MpmACBSRegister(void); suricata-3.2.1/src/util-var.c0000644000000000000000000000742313051004444012716 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Generic variable utility functions */ #include "suricata-common.h" #include "detect.h" #include "util-var.h" #include "flow-var.h" #include "flow-bit.h" #include "pkt-var.h" #include "host-bit.h" #include "ippair-bit.h" #include "util-debug.h" void XBitFree(XBit *fb) { if (fb == NULL) return; SCFree(fb); } void GenericVarFree(GenericVar *gv) { if (gv == NULL) return; SCLogDebug("gv %p, gv->type %" PRIu32 "", gv, gv->type); GenericVar *next_gv = gv->next; switch (gv->type) { case DETECT_FLOWBITS: { FlowBit *fb = (FlowBit *)gv; //printf("GenericVarFree: fb %p, removing\n", fb); FlowBitFree(fb); break; } case DETECT_XBITS: { XBit *fb = (XBit *)gv; //printf("GenericVarFree: fb %p, removing\n", fb); XBitFree(fb); break; } case DETECT_FLOWVAR: { FlowVar *fv = (FlowVar *)gv; FlowVarFree(fv); break; } case DETECT_PKTVAR: { PktVar *pv = (PktVar *)gv; PktVarFree(pv); break; } default: { printf("ERROR: GenericVarFree unknown type %" PRIu32 "\n", gv->type); break; } } GenericVarFree(next_gv); } void GenericVarAppend(GenericVar **list, GenericVar *gv) { gv->next = NULL; if (*list == NULL) { *list = gv; } else { GenericVar *tgv = *list; while(tgv) { if (tgv->next == NULL) { tgv->next = gv; return; } tgv = tgv->next; } } } void GenericVarRemove(GenericVar **list, GenericVar *gv) { if (*list == NULL) return; GenericVar *listgv = *list, *prevgv = NULL; while (listgv != NULL) { if (listgv == gv) { if (prevgv == NULL) *list = gv->next; else prevgv->next = gv->next; return; } prevgv = listgv; listgv = listgv->next; } } // Checks if a variable is already in a resolve list and if it's not, adds it. int AddVariableToResolveList(ResolvedVariablesList *list, const char *var) { ResolvedVariable *p_item; if (list == NULL || var == NULL) return 0; if (var[0] != '$') { return 0; } TAILQ_FOREACH(p_item, list, next) { if (!strcmp(p_item->var_name, var)) { return -1; } } p_item = SCMalloc(sizeof(ResolvedVariable)); if (unlikely(p_item == NULL)) { return -1; } strlcpy(p_item->var_name, var, sizeof(p_item->var_name) - 1); TAILQ_INSERT_TAIL(list, p_item, next); return 0; } void CleanVariableResolveList(ResolvedVariablesList *var_list) { if (var_list == NULL) { return; } ResolvedVariable *p_item; while ((p_item = TAILQ_FIRST(var_list))) { TAILQ_REMOVE(var_list, p_item, next); SCFree(p_item); } } suricata-3.2.1/src/stream-tcp-util.h0000644000000000000000000000275613051004444014216 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __STREAM_TCP_UTIL_H__ #define __STREAM_TCP_UTIL_H__ #include "stream-tcp-private.h" void StreamTcpUTInit(TcpReassemblyThreadCtx **); void StreamTcpUTDeinit(TcpReassemblyThreadCtx *); void StreamTcpUTInitInline(void); void StreamTcpUTSetupSession(TcpSession *); void StreamTcpUTClearSession(TcpSession *); void StreamTcpUTSetupStream(TcpStream *, uint32_t isn); void StreamTcpUTClearStream(TcpStream *); int StreamTcpUTAddSegmentWithByte(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, uint32_t, uint8_t, uint16_t); int StreamTcpUTAddSegmentWithPayload(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, uint32_t, uint8_t *, uint16_t); void StreamTcpUtilRegisterTests(void); #endif /* __STREAM_TCP_UTIL_H__ */ suricata-3.2.1/src/flow.h0000644000000000000000000004503113051004444012124 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_H__ #define __FLOW_H__ #include "decode.h" #include "util-var.h" #include "util-atomic.h" #include "detect-tag.h" #include "util-optimize.h" /* Part of the flow structure, so we declare it here. * The actual declaration is in app-layer-parser.c */ typedef struct AppLayerParserState_ AppLayerParserState; #define FLOW_QUIET TRUE #define FLOW_VERBOSE FALSE #define TOSERVER 0 #define TOCLIENT 1 /* per flow flags */ /** At least on packet from the source address was seen */ #define FLOW_TO_SRC_SEEN BIT_U32(0) /** At least on packet from the destination address was seen */ #define FLOW_TO_DST_SEEN BIT_U32(1) /** Don't return this from the flow hash. It has been replaced. */ #define FLOW_TCP_REUSED BIT_U32(2) /** Flow was inspected against IP-Only sigs in the toserver direction */ #define FLOW_TOSERVER_IPONLY_SET BIT_U32(3) /** Flow was inspected against IP-Only sigs in the toclient direction */ #define FLOW_TOCLIENT_IPONLY_SET BIT_U32(4) /** Packet belonging to this flow should not be inspected at all */ #define FLOW_NOPACKET_INSPECTION BIT_U32(5) /** Packet payloads belonging to this flow should not be inspected */ #define FLOW_NOPAYLOAD_INSPECTION BIT_U32(6) /** All packets in this flow should be dropped */ #define FLOW_ACTION_DROP BIT_U32(7) /** Sgh for toserver direction set (even if it's NULL) */ #define FLOW_SGH_TOSERVER BIT_U32(8) /** Sgh for toclient direction set (even if it's NULL) */ #define FLOW_SGH_TOCLIENT BIT_U32(9) /** packet to server direction has been logged in drop file (only in IPS mode) */ #define FLOW_TOSERVER_DROP_LOGGED BIT_U32(10) /** packet to client direction has been logged in drop file (only in IPS mode) */ #define FLOW_TOCLIENT_DROP_LOGGED BIT_U32(11) /** flow has alerts */ #define FLOW_HAS_ALERTS BIT_U32(12) /** Pattern matcher alproto detection done */ #define FLOW_TS_PM_ALPROTO_DETECT_DONE BIT_U32(13) /** Probing parser alproto detection done */ #define FLOW_TS_PP_ALPROTO_DETECT_DONE BIT_U32(14) /** Pattern matcher alproto detection done */ #define FLOW_TC_PM_ALPROTO_DETECT_DONE BIT_U32(15) /** Probing parser alproto detection done */ #define FLOW_TC_PP_ALPROTO_DETECT_DONE BIT_U32(16) #define FLOW_TIMEOUT_REASSEMBLY_DONE BIT_U32(17) /** flow is ipv4 */ #define FLOW_IPV4 BIT_U32(18) /** flow is ipv6 */ #define FLOW_IPV6 BIT_U32(19) #define FLOW_PROTO_DETECT_TS_DONE BIT_U32(20) #define FLOW_PROTO_DETECT_TC_DONE BIT_U32(21) /* File flags */ /** no magic on files in this flow */ #define FLOWFILE_NO_MAGIC_TS BIT_U16(0) #define FLOWFILE_NO_MAGIC_TC BIT_U16(1) /** even if the flow has files, don't store 'm */ #define FLOWFILE_NO_STORE_TS BIT_U16(2) #define FLOWFILE_NO_STORE_TC BIT_U16(3) /** no md5 on files in this flow */ #define FLOWFILE_NO_MD5_TS BIT_U16(4) #define FLOWFILE_NO_MD5_TC BIT_U16(5) /** no sha1 on files in this flow */ #define FLOWFILE_NO_SHA1_TS BIT_U16(6) #define FLOWFILE_NO_SHA1_TC BIT_U16(7) /** no sha256 on files in this flow */ #define FLOWFILE_NO_SHA256_TS BIT_U16(8) #define FLOWFILE_NO_SHA256_TC BIT_U16(9) /** no size tracking of files in this flow */ #define FLOWFILE_NO_SIZE_TS BIT_U16(10) #define FLOWFILE_NO_SIZE_TC BIT_U16(11) #define FLOW_IS_IPV4(f) \ (((f)->flags & FLOW_IPV4) == FLOW_IPV4) #define FLOW_IS_IPV6(f) \ (((f)->flags & FLOW_IPV6) == FLOW_IPV6) #define FLOW_COPY_IPV4_ADDR_TO_PACKET(fa, pa) do { \ (pa)->family = AF_INET; \ (pa)->addr_data32[0] = (fa)->addr_data32[0]; \ } while (0) #define FLOW_COPY_IPV6_ADDR_TO_PACKET(fa, pa) do { \ (pa)->family = AF_INET6; \ (pa)->addr_data32[0] = (fa)->addr_data32[0]; \ (pa)->addr_data32[1] = (fa)->addr_data32[1]; \ (pa)->addr_data32[2] = (fa)->addr_data32[2]; \ (pa)->addr_data32[3] = (fa)->addr_data32[3]; \ } while (0) /* Set the IPv4 addressesinto the Addrs of the Packet. * Make sure p->ip4h is initialized and validated. * * We set the rest of the struct to 0 so we can * prevent using memset. */ #define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a) do { \ (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) #define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a) do { \ (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) /* clear the address structure by setting all fields to 0 */ #define FLOW_CLEAR_ADDR(a) do { \ (a)->addr_data32[0] = 0; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) /* Set the IPv6 addressesinto the Addrs of the Packet. * Make sure p->ip6h is initialized and validated. */ #define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a) do { \ (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \ (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \ (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \ (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \ } while (0) #define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a) do { \ (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \ (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \ (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \ (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \ } while (0) /* pkt flow flags */ #define FLOW_PKT_TOSERVER 0x01 #define FLOW_PKT_TOCLIENT 0x02 #define FLOW_PKT_ESTABLISHED 0x04 #define FLOW_PKT_TOSERVER_IPONLY_SET 0x08 #define FLOW_PKT_TOCLIENT_IPONLY_SET 0x10 #define FLOW_PKT_TOSERVER_FIRST 0x20 #define FLOW_PKT_TOCLIENT_FIRST 0x40 #define FLOW_END_FLAG_STATE_NEW 0x01 #define FLOW_END_FLAG_STATE_ESTABLISHED 0x02 #define FLOW_END_FLAG_STATE_CLOSED 0x04 #define FLOW_END_FLAG_EMERGENCY 0x08 #define FLOW_END_FLAG_TIMEOUT 0x10 #define FLOW_END_FLAG_FORCED 0x20 #define FLOW_END_FLAG_SHUTDOWN 0x40 #define FLOW_END_FLAG_STATE_BYPASSED 0x80 /** Mutex or RWLocks for the flow. */ //#define FLOWLOCK_RWLOCK #define FLOWLOCK_MUTEX #ifdef FLOWLOCK_RWLOCK #ifdef FLOWLOCK_MUTEX #error Cannot enable both FLOWLOCK_RWLOCK and FLOWLOCK_MUTEX #endif #endif #ifdef FLOWLOCK_RWLOCK #define FLOWLOCK_INIT(fb) SCRWLockInit(&(fb)->r, NULL) #define FLOWLOCK_DESTROY(fb) SCRWLockDestroy(&(fb)->r) #define FLOWLOCK_RDLOCK(fb) SCRWLockRDLock(&(fb)->r) #define FLOWLOCK_WRLOCK(fb) SCRWLockWRLock(&(fb)->r) #define FLOWLOCK_TRYRDLOCK(fb) SCRWLockTryRDLock(&(fb)->r) #define FLOWLOCK_TRYWRLOCK(fb) SCRWLockTryWRLock(&(fb)->r) #define FLOWLOCK_UNLOCK(fb) SCRWLockUnlock(&(fb)->r) #elif defined FLOWLOCK_MUTEX #define FLOWLOCK_INIT(fb) SCMutexInit(&(fb)->m, NULL) #define FLOWLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->m) #define FLOWLOCK_RDLOCK(fb) SCMutexLock(&(fb)->m) #define FLOWLOCK_WRLOCK(fb) SCMutexLock(&(fb)->m) #define FLOWLOCK_TRYRDLOCK(fb) SCMutexTrylock(&(fb)->m) #define FLOWLOCK_TRYWRLOCK(fb) SCMutexTrylock(&(fb)->m) #define FLOWLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->m) #else #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX #endif #define FLOW_IS_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PM_ALPROTO_DETECT_DONE)) #define FLOW_IS_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags & FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags & FLOW_TC_PP_ALPROTO_DETECT_DONE)) #define FLOW_SET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PM_ALPROTO_DETECT_DONE)) #define FLOW_SET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags |= FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags |= FLOW_TC_PP_ALPROTO_DETECT_DONE)) #define FLOW_RESET_PM_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PM_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PM_ALPROTO_DETECT_DONE)) #define FLOW_RESET_PP_DONE(f, dir) (((dir) & STREAM_TOSERVER) ? ((f)->flags &= ~FLOW_TS_PP_ALPROTO_DETECT_DONE) : ((f)->flags &= ~FLOW_TC_PP_ALPROTO_DETECT_DONE)) /* global flow config */ typedef struct FlowCnf_ { uint32_t hash_rand; uint32_t hash_size; uint64_t memcap; uint32_t max_flows; uint32_t prealloc; uint32_t timeout_new; uint32_t timeout_est; uint32_t emerg_timeout_new; uint32_t emerg_timeout_est; uint32_t emergency_recovery; } FlowConfig; /* Hash key for the flow hash */ typedef struct FlowKey_ { Address src, dst; Port sp, dp; uint8_t proto; uint8_t recursion_level; } FlowKey; typedef struct FlowAddress_ { union { uint32_t address_un_data32[4]; /* type-specific field */ uint16_t address_un_data16[8]; /* type-specific field */ uint8_t address_un_data8[16]; /* type-specific field */ } address; } FlowAddress; #define addr_data32 address.address_un_data32 #define addr_data16 address.address_un_data16 #define addr_data8 address.address_un_data8 #ifdef __tile__ /* Atomic Ints performance better on Tile. */ typedef unsigned int FlowRefCount; #else typedef unsigned short FlowRefCount; #endif #ifdef __tile__ /* Atomic Ints performance better on Tile. */ typedef unsigned int FlowStateType; #else typedef unsigned short FlowStateType; #endif /** Local Thread ID */ typedef uint16_t FlowThreadId; /** * \brief Flow data structure. * * The flow is a global data structure that is created for new packets of a * flow and then looked up for the following packets of a flow. * * Locking * * The flow is updated/used by multiple packets at the same time. This is why * there is a flow-mutex. It's a mutex and not a spinlock because some * operations on the flow can be quite expensive, thus spinning would be * too expensive. * * The flow "header" (addresses, ports, proto, recursion level) are static * after the initialization and remain read-only throughout the entire live * of a flow. This is why we can access those without protection of the lock. */ typedef struct Flow_ { /* flow "header", used for hashing and flow lookup. Static after init, * so safe to look at without lock */ FlowAddress src, dst; union { Port sp; /**< tcp/udp source port */ uint8_t type; /**< icmp type */ }; union { Port dp; /**< tcp/udp destination port */ uint8_t code; /**< icmp code */ }; uint8_t proto; uint8_t recursion_level; uint16_t vlan_id[2]; /** flow hash - the flow hash before hash table size mod. */ uint32_t flow_hash; /* time stamp of last update (last packet). Set/updated under the * flow and flow hash row locks, safe to read under either the * flow lock or flow hash row lock. */ struct timeval lastts; /* end of flow "header" */ SC_ATOMIC_DECLARE(FlowStateType, flow_state); /** how many pkts and stream msgs are using the flow *right now*. This * variable is atomic so not protected by the Flow mutex "m". * * On receiving a packet the counter is incremented while the flow * bucked is locked, which is also the case on timeout pruning. */ SC_ATOMIC_DECLARE(FlowRefCount, use_cnt); /** flow tenant id, used to setup flow timeout and stream pseudo * packets with the correct tenant id set */ uint32_t tenant_id; uint32_t probing_parser_toserver_alproto_masks; uint32_t probing_parser_toclient_alproto_masks; uint32_t flags; /**< generic flags */ uint16_t file_flags; /**< file tracking/extraction flags */ /* coccinelle: Flow:file_flags:FLOWFILE_ */ #ifdef FLOWLOCK_RWLOCK SCRWLock r; #elif defined FLOWLOCK_MUTEX SCMutex m; #else #error Enable FLOWLOCK_RWLOCK or FLOWLOCK_MUTEX #endif /** protocol specific data pointer, e.g. for TcpSession */ void *protoctx; /** mapping to Flow's protocol specific protocols for timeouts and state and free functions. */ uint8_t protomap; uint8_t flow_end_flags; /* coccinelle: Flow:flow_end_flags:FLOW_END_FLAG_ */ AppProto alproto; /**< \brief application level protocol */ AppProto alproto_ts; AppProto alproto_tc; /** detection engine ctx id used to inspect this flow. Set at initial * inspection. If it doesn't match the currently in use de_ctx, the * de_state and stored sgh ptrs are reset. */ uint32_t de_ctx_id; /** Thread ID for the stream/detect portion of this flow */ FlowThreadId thread_id; /** detect state 'alversion' inspected for both directions */ uint8_t detect_alversion[2]; /** application level storage ptrs. * */ AppLayerParserState *alparser; /**< parser internal state */ void *alstate; /**< application layer state */ /** detection engine state */ struct DetectEngineStateFlow_ *de_state; /** toclient sgh for this flow. Only use when FLOW_SGH_TOCLIENT flow flag * has been set. */ const struct SigGroupHead_ *sgh_toclient; /** toserver sgh for this flow. Only use when FLOW_SGH_TOSERVER flow flag * has been set. */ const struct SigGroupHead_ *sgh_toserver; /* pointer to the var list */ GenericVar *flowvar; /** hash list pointers, protected by fb->s */ struct Flow_ *hnext; /* hash list */ struct Flow_ *hprev; struct FlowBucket_ *fb; /** queue list pointers, protected by queue mutex */ struct Flow_ *lnext; /* list */ struct Flow_ *lprev; struct timeval startts; uint32_t todstpktcnt; uint32_t tosrcpktcnt; uint64_t todstbytecnt; uint64_t tosrcbytecnt; } Flow; enum FlowState { FLOW_STATE_NEW = 0, FLOW_STATE_ESTABLISHED, FLOW_STATE_CLOSED, FLOW_STATE_LOCAL_BYPASSED, FLOW_STATE_CAPTURE_BYPASSED, }; typedef struct FlowProtoTimeout_ { uint32_t new_timeout; uint32_t est_timeout; uint32_t closed_timeout; uint32_t bypassed_timeout; } FlowProtoTimeout; typedef struct FlowProtoFreeFunc_ { void (*Freefunc)(void *); } FlowProtoFreeFunc; /** \brief prepare packet for a life with flow * Set PKT_WANTS_FLOW flag to incidate workers should do a flow lookup * and calc the hash value to be used in the lookup and autofp flow * balancing. */ void FlowSetupPacket(Packet *p); void FlowHandlePacket (ThreadVars *, DecodeThreadVars *, Packet *); void FlowInitConfig (char); void FlowPrintQueueInfo (void); void FlowShutdown(void); void FlowSetIPOnlyFlag(Flow *, int); void FlowSetHasAlertsFlag(Flow *); int FlowHasAlerts(const Flow *); void FlowRegisterTests (void); int FlowSetProtoTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t); int FlowSetProtoEmergencyTimeout(uint8_t ,uint32_t ,uint32_t ,uint32_t); int FlowSetProtoFreeFunc (uint8_t , void (*Free)(void *)); void FlowUpdateQueue(Flow *); struct FlowQueue_; int FlowUpdateSpareFlows(void); static inline void FlowSetNoPacketInspectionFlag(Flow *); static inline void FlowSetNoPayloadInspectionFlag(Flow *); int FlowGetPacketDirection(const Flow *, const Packet *); void FlowCleanupAppLayer(Flow *); void FlowUpdateState(Flow *f, enum FlowState s); /** ----- Inline functions ----- */ /** \brief Set the No Packet Inspection Flag without locking the flow. * * \param f Flow to set the flag in */ static inline void FlowSetNoPacketInspectionFlag(Flow *f) { SCEnter(); SCLogDebug("flow %p", f); f->flags |= FLOW_NOPACKET_INSPECTION; SCReturn; } /** \brief Set the No payload inspection Flag without locking the flow. * * \param f Flow to set the flag in */ static inline void FlowSetNoPayloadInspectionFlag(Flow *f) { SCEnter(); SCLogDebug("flow %p", f); f->flags |= FLOW_NOPAYLOAD_INSPECTION; SCReturn; } /** * \brief increase the use count of a flow * * \param f flow to decrease use count for */ static inline void FlowIncrUsecnt(Flow *f) { if (f == NULL) return; (void) SC_ATOMIC_ADD(f->use_cnt, 1); } /** * \brief decrease the use count of a flow * * \param f flow to decrease use count for */ static inline void FlowDecrUsecnt(Flow *f) { if (f == NULL) return; (void) SC_ATOMIC_SUB(f->use_cnt, 1); } /** \brief Reference the flow, bumping the flows use_cnt * \note This should only be called once for a destination * pointer */ static inline void FlowReference(Flow **d, Flow *f) { if (likely(f != NULL)) { #ifdef DEBUG_VALIDATION BUG_ON(*d == f); #else if (*d == f) return; #endif FlowIncrUsecnt(f); *d = f; } } static inline void FlowDeReference(Flow **d) { if (likely(*d != NULL)) { FlowDecrUsecnt(*d); *d = NULL; } } /** \brief create a flow id that is as unique as possible * \retval flow_id signed 64bit id * \note signed because of the signedness of json_integer_t in * the json output */ static inline int64_t FlowGetId(const Flow *f) { return (int64_t)f->flow_hash << 31 | (int64_t)(f->startts.tv_sec & 0x0000FFFF) << 16 | (int64_t)(f->startts.tv_usec & 0x0000FFFF); } int FlowClearMemory(Flow *,uint8_t ); AppProto FlowGetAppProtocol(const Flow *f); void *FlowGetAppState(const Flow *f); uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags); void FlowHandlePacketUpdate(Flow *f, Packet *p); #endif /* __FLOW_H__ */ suricata-3.2.1/src/log-tlslog.h0000644000000000000000000000216313051004444013237 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Roliers Jean-Paul * \author Eric Leblond */ #ifndef __LOG_TLSLOG_H__ #define __LOG_TLSLOG_H__ void LogTlsLogRegister(void); int TLSGetIPInformations(const Packet *p, char* srcip, size_t srcip_len, Port* sp, char* dstip, size_t dstip_len, Port* dp, int ipproto); #endif /* __LOG_TLSLOG_H__ */ suricata-3.2.1/src/util-bloomfilter.h0000644000000000000000000000372213051004444014447 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __BLOOMFILTER_H__ #define __BLOOMFILTER_H__ /* Bloom Filter structure */ typedef struct BloomFilter_ { uint8_t hash_iterations; uint32_t (*Hash)(const void *, uint16_t, uint8_t, uint32_t); uint32_t bitarray_size; uint8_t *bitarray; } BloomFilter; /* prototypes */ BloomFilter *BloomFilterInit(uint32_t, uint8_t, uint32_t (*Hash)(const void *, uint16_t, uint8_t, uint32_t)); void BloomFilterFree(BloomFilter *); void BloomFilterPrint(BloomFilter *); int BloomFilterAdd(BloomFilter *, void *, uint16_t); uint32_t BloomFilterMemoryCnt(BloomFilter *); uint32_t BloomFilterMemorySize(BloomFilter *); void BloomFilterRegisterTests(void); /** ----- Inline functions ---- */ static inline int BloomFilterTest(const BloomFilter *, const void *, uint16_t); static inline int BloomFilterTest(const BloomFilter *bf, const void *data, uint16_t datalen) { uint8_t iter = 0; uint32_t hash = 0; int hit = 1; for (iter = 0; iter < bf->hash_iterations; iter++) { hash = bf->Hash(data, datalen, iter, bf->bitarray_size); if (!(bf->bitarray[hash/8] & (1< * \author Pablo Rincon * * This file provides a HTTP protocol support for the engine using HTP library. */ #ifndef __APP_LAYER_HTP_H__ #define __APP_LAYER_HTP_H__ #include "util-radix-tree.h" #include "util-file.h" #include "app-layer-htp-mem.h" #include "detect-engine-state.h" #include "util-streaming-buffer.h" #include /* default request body limit */ #define HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT 4096U #define HTP_CONFIG_DEFAULT_RESPONSE_BODY_LIMIT 4096U #define HTP_CONFIG_DEFAULT_REQUEST_INSPECT_MIN_SIZE 32768U #define HTP_CONFIG_DEFAULT_REQUEST_INSPECT_WINDOW 4096U #define HTP_CONFIG_DEFAULT_RESPONSE_INSPECT_MIN_SIZE 32768U #define HTP_CONFIG_DEFAULT_RESPONSE_INSPECT_WINDOW 4096U #define HTP_CONFIG_DEFAULT_FIELD_LIMIT_SOFT 9000U #define HTP_CONFIG_DEFAULT_FIELD_LIMIT_HARD 18000U #define HTP_CONFIG_DEFAULT_RANDOMIZE 1 #define HTP_CONFIG_DEFAULT_RANDOMIZE_RANGE 10 /** a boundary should be smaller in size */ #define HTP_BOUNDARY_MAX 200U #define HTP_FLAG_STATE_OPEN 0x0001 /**< Flag to indicate that HTTP connection is open */ #define HTP_FLAG_STATE_CLOSED_TS 0x0002 /**< Flag to indicate that HTTP connection is closed */ #define HTP_FLAG_STATE_CLOSED_TC 0x0004 /**< Flag to indicate that HTTP connection is closed */ #define HTP_FLAG_STATE_DATA 0x0008 /**< Flag to indicate that HTTP connection needs more data */ #define HTP_FLAG_STATE_ERROR 0x0010 /**< Flag to indicate that an error has been occured on HTTP connection */ #define HTP_FLAG_NEW_BODY_SET 0x0020 /**< Flag to indicate that HTTP has parsed a new body (for pcre) */ #define HTP_FLAG_STORE_FILES_TS 0x0040 #define HTP_FLAG_STORE_FILES_TC 0x0080 #define HTP_FLAG_STORE_FILES_TX_TS 0x0100 #define HTP_FLAG_STORE_FILES_TX_TC 0x0200 /** flag the state that a new file has been set in this tx */ #define HTP_FLAG_NEW_FILE_TX_TS 0x0400 /** flag the state that a new file has been set in this tx */ #define HTP_FLAG_NEW_FILE_TX_TC 0x0800 enum { HTP_BODY_NONE = 0, /**< Flag to indicate the current operation */ HTP_BODY_REQUEST, /**< Flag to indicate that the current operation is a request */ HTP_BODY_RESPONSE /**< Flag to indicate that the current * operation is a response */ }; enum { HTP_BODY_REQUEST_NONE = 0, HTP_BODY_REQUEST_MULTIPART, /* POST, MP */ HTP_BODY_REQUEST_POST, /* POST, no MP */ HTP_BODY_REQUEST_PUT, }; enum { /* libhtp errors/warnings */ HTTP_DECODER_EVENT_UNKNOWN_ERROR, HTTP_DECODER_EVENT_GZIP_DECOMPRESSION_FAILED, HTTP_DECODER_EVENT_REQUEST_FIELD_MISSING_COLON, HTTP_DECODER_EVENT_RESPONSE_FIELD_MISSING_COLON, HTTP_DECODER_EVENT_INVALID_REQUEST_CHUNK_LEN, HTTP_DECODER_EVENT_INVALID_RESPONSE_CHUNK_LEN, HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_REQUEST, HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE, HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST, HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE, HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN, HTTP_DECODER_EVENT_UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, HTTP_DECODER_EVENT_INVALID_SERVER_PORT_IN_REQUEST, HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT, HTTP_DECODER_EVENT_REQUEST_HEADER_INVALID, HTTP_DECODER_EVENT_RESPONSE_HEADER_INVALID, HTTP_DECODER_EVENT_MISSING_HOST_HEADER, HTTP_DECODER_EVENT_HOST_HEADER_AMBIGUOUS, HTTP_DECODER_EVENT_INVALID_REQUEST_FIELD_FOLDING, HTTP_DECODER_EVENT_INVALID_RESPONSE_FIELD_FOLDING, HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG, HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG, HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH, HTTP_DECODER_EVENT_URI_HOST_INVALID, HTTP_DECODER_EVENT_HEADER_HOST_INVALID, HTTP_DECODER_EVENT_METHOD_DELIM_NON_COMPLIANT, HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT, HTTP_DECODER_EVENT_REQUEST_LINE_LEADING_WHITESPACE, /* suricata errors/warnings */ HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR, HTTP_DECODER_EVENT_MULTIPART_NO_FILEDATA, HTTP_DECODER_EVENT_MULTIPART_INVALID_HEADER, }; typedef struct HTPCfgDir_ { uint32_t body_limit; uint32_t inspect_min_size; uint32_t inspect_window; StreamingBufferConfig sbcfg; } HTPCfgDir; /** Need a linked list in order to keep track of these */ typedef struct HTPCfgRec_ { htp_cfg_t *cfg; struct HTPCfgRec_ *next; int uri_include_all; /**< use all info in uri (bool) */ /** max size of the client body we inspect */ int randomize; int randomize_range; int http_body_inline; HTPCfgDir request; HTPCfgDir response; } HTPCfgRec; /** Struct used to hold chunks of a body on a request */ struct HtpBodyChunk_ { struct HtpBodyChunk_ *next; /**< Pointer to the next chunk */ StreamingBufferSegment sbseg; int logged; } __attribute__((__packed__)); typedef struct HtpBodyChunk_ HtpBodyChunk; /** Struct used to hold all the chunks of a body on a request */ typedef struct HtpBody_ { HtpBodyChunk *first; /**< Pointer to the first chunk */ HtpBodyChunk *last; /**< Pointer to the last chunk */ StreamingBuffer *sb; /* Holds the length of the htp request body seen so far */ uint64_t content_len_so_far; /* parser tracker */ uint64_t body_parsed; /* inspection tracker */ uint64_t body_inspected; } HtpBody; #define HTP_CONTENTTYPE_SET 0x01 /**< We have the content type */ #define HTP_BOUNDARY_SET 0x02 /**< We have a boundary string */ #define HTP_BOUNDARY_OPEN 0x04 /**< We have a boundary string */ #define HTP_FILENAME_SET 0x08 /**< filename is registered in the flow */ #define HTP_DONTSTORE 0x10 /**< not storing this file */ /** Now the Body Chunks will be stored per transaction, at * the tx user data */ typedef struct HtpTxUserData_ { /* Body of the request (if any) */ uint8_t request_body_init; uint8_t response_body_init; uint8_t request_has_trailers; uint8_t response_has_trailers; /* indicates which loggers that have logged */ uint32_t logged; HtpBody request_body; HtpBody response_body; bstr *request_uri_normalized; uint8_t *request_headers_raw; uint8_t *response_headers_raw; uint32_t request_headers_raw_len; uint32_t response_headers_raw_len; AppLayerDecoderEvents *decoder_events; /**< per tx events */ /** Holds the boundary identificator string if any (used on * multipart/form-data only) */ uint8_t *boundary; uint8_t boundary_len; uint8_t tsflags; uint8_t tcflags; int16_t operation; uint8_t request_body_type; uint8_t response_body_type; DetectEngineState *de_state; } HtpTxUserData; typedef struct HtpState_ { /* Connection parser structure for each connection */ htp_connp_t *connp; /* Connection structure for each connection */ htp_conn_t *conn; Flow *f; /**< Needed to retrieve the original flow when usin HTPLib callbacks */ uint64_t transaction_cnt; uint64_t store_tx_id; FileContainer *files_ts; FileContainer *files_tc; const struct HTPCfgRec_ *cfg; uint16_t flags; uint16_t events; uint16_t htp_messages_offset; /**< offset into conn->messages list */ uint64_t tx_with_detect_state_cnt; } HtpState; /** part of the engine needs the request body (e.g. http_client_body keyword) */ #define HTP_REQUIRE_REQUEST_BODY (1 << 0) /** part of the engine needs the request body multipart header (e.g. filename * and / or fileext keywords) */ #define HTP_REQUIRE_REQUEST_MULTIPART (1 << 1) /** part of the engine needs the request file (e.g. log-file module) */ #define HTP_REQUIRE_REQUEST_FILE (1 << 2) /** part of the engine needs the request body (e.g. file_data keyword) */ #define HTP_REQUIRE_RESPONSE_BODY (1 << 3) SC_ATOMIC_DECLARE(uint32_t, htp_config_flags); void RegisterHTPParsers(void); void HTPParserRegisterTests(void); void HTPAtExitPrintStats(void); void HTPFreeConfig(void); htp_tx_t *HTPTransactionMain(const HtpState *); int HTPCallbackRequestBodyData(htp_tx_data_t *); int HtpTransactionGetLoggableId(Flow *); void HtpBodyPrint(HtpBody *); void HtpBodyFree(HtpBody *); /* To free the state from unittests using app-layer-htp */ void HTPStateFree(void *); void AppLayerHtpEnableRequestBodyCallback(void); void AppLayerHtpEnableResponseBodyCallback(void); void AppLayerHtpNeedFileInspection(void); void AppLayerHtpPrintStats(void); void HTPConfigure(void); void HtpConfigCreateBackup(void); void HtpConfigRestoreBackup(void); #endif /* __APP_LAYER_HTP_H__ */ /** * @} */ suricata-3.2.1/src/flow.c0000644000000000000000000011371013051004444012117 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow implementation. */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "conf.h" #include "threadvars.h" #include "tm-threads.h" #include "runmodes.h" #include "util-random.h" #include "util-time.h" #include "flow.h" #include "flow-queue.h" #include "flow-hash.h" #include "flow-util.h" #include "flow-var.h" #include "flow-private.h" #include "flow-timeout.h" #include "flow-manager.h" #include "flow-storage.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-misc.h" #include "util-debug.h" #include "util-privs.h" #include "detect.h" #include "detect-engine-state.h" #include "stream.h" #include "app-layer-parser.h" #define FLOW_DEFAULT_EMERGENCY_RECOVERY 30 //#define FLOW_DEFAULT_HASHSIZE 262144 #define FLOW_DEFAULT_HASHSIZE 65536 //#define FLOW_DEFAULT_MEMCAP 128 * 1024 * 1024 /* 128 MB */ #define FLOW_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32 MB */ #define FLOW_DEFAULT_PREALLOC 10000 /** atomic int that is used when freeing a flow from the hash. In this * case we walk the hash to find a flow to free. This var records where * we left off in the hash. Without this only the top rows of the hash * are freed. This isn't just about fairness. Under severe presure, the * hash rows on top would be all freed and the time to find a flow to * free increased with every run. */ SC_ATOMIC_DECLARE(unsigned int, flow_prune_idx); /** atomic flags */ SC_ATOMIC_DECLARE(unsigned int, flow_flags); void FlowRegisterTests(void); void FlowInitFlowProto(); int FlowSetProtoFreeFunc(uint8_t, void (*Free)(void *)); /* Run mode selected at suricata.c */ extern int run_mode; void FlowCleanupAppLayer(Flow *f) { if (f == NULL || f->proto == 0) return; AppLayerParserStateCleanup(f->proto, f->alproto, f->alstate, f->alparser); f->alstate = NULL; f->alparser = NULL; return; } /** \brief Make sure we have enough spare flows. * * Enforce the prealloc parameter, so keep at least prealloc flows in the * spare queue and free flows going over the limit. * * \retval 1 if the queue was properly updated (or if it already was in good shape) * \retval 0 otherwise. */ int FlowUpdateSpareFlows(void) { SCEnter(); uint32_t toalloc = 0, tofree = 0, len; FQLOCK_LOCK(&flow_spare_q); len = flow_spare_q.len; FQLOCK_UNLOCK(&flow_spare_q); if (len < flow_config.prealloc) { toalloc = flow_config.prealloc - len; uint32_t i; for (i = 0; i < toalloc; i++) { Flow *f = FlowAlloc(); if (f == NULL) return 0; FlowEnqueue(&flow_spare_q,f); } } else if (len > flow_config.prealloc) { tofree = len - flow_config.prealloc; uint32_t i; for (i = 0; i < tofree; i++) { /* FlowDequeue locks the queue */ Flow *f = FlowDequeue(&flow_spare_q); if (f == NULL) return 1; FlowFree(f); } } return 1; } /** \brief Set the IPOnly scanned flag for 'direction'. * * \param f Flow to set the flag in * \param direction direction to set the flag in */ void FlowSetIPOnlyFlag(Flow *f, int direction) { direction ? (f->flags |= FLOW_TOSERVER_IPONLY_SET) : (f->flags |= FLOW_TOCLIENT_IPONLY_SET); return; } /** \brief Set flag to indicate that flow has alerts * * \param f flow */ void FlowSetHasAlertsFlag(Flow *f) { f->flags |= FLOW_HAS_ALERTS; } /** \brief Check if flow has alerts * * \param f flow * \retval 1 has alerts * \retval 0 has not alerts */ int FlowHasAlerts(const Flow *f) { if (f->flags & FLOW_HAS_ALERTS) { return 1; } return 0; } /** * \brief determine the direction of the packet compared to the flow * \retval 0 to_server * \retval 1 to_client */ int FlowGetPacketDirection(const Flow *f, const Packet *p) { if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) { if (!(CMP_PORT(p->sp,p->dp))) { /* update flags and counters */ if (CMP_PORT(f->sp,p->sp)) { return TOSERVER; } else { return TOCLIENT; } } else { if (CMP_ADDR(&f->src,&p->src)) { return TOSERVER; } else { return TOCLIENT; } } } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) { if (CMP_ADDR(&f->src,&p->src)) { return TOSERVER; } else { return TOCLIENT; } } /* default to toserver */ return TOSERVER; } /** * \brief Check to update "seen" flags * * \param p packet * * \retval 1 true * \retval 0 false */ static inline int FlowUpdateSeenFlag(const Packet *p) { if (PKT_IS_ICMPV4(p)) { if (ICMPV4_IS_ERROR_MSG(p)) { return 0; } } return 1; } /** \brief Update Packet and Flow * * Updates packet and flow based on the new packet. * * \param f locked flow * \param p packet * * \note overwrites p::flowflags */ void FlowHandlePacketUpdate(Flow *f, Packet *p) { SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f); int state = SC_ATOMIC_GET(f->flow_state); if (state != FLOW_STATE_CAPTURE_BYPASSED) { /* update the last seen timestamp of this flow */ COPY_TIMESTAMP(&p->ts, &f->lastts); } else { /* still seeing packet, we downgrade to local bypass */ if (p->ts.tv_sec - f->lastts.tv_sec > FLOW_BYPASSED_TIMEOUT / 2) { SCLogDebug("Downgrading flow to local bypass"); COPY_TIMESTAMP(&p->ts, &f->lastts); FlowUpdateState(f, FLOW_STATE_LOCAL_BYPASSED); } } /* update flags and counters */ if (FlowGetPacketDirection(f, p) == TOSERVER) { f->todstpktcnt++; f->todstbytecnt += GET_PKT_LEN(p); p->flowflags = FLOW_PKT_TOSERVER; if (!(f->flags & FLOW_TO_DST_SEEN)) { if (FlowUpdateSeenFlag(p)) { f->flags |= FLOW_TO_DST_SEEN; p->flowflags |= FLOW_PKT_TOSERVER_FIRST; } } /* xfer proto detect ts flag to first packet in ts dir */ if (f->flags & FLOW_PROTO_DETECT_TS_DONE) { f->flags &= ~FLOW_PROTO_DETECT_TS_DONE; p->flags |= PKT_PROTO_DETECT_TS_DONE; } } else { f->tosrcpktcnt++; f->tosrcbytecnt += GET_PKT_LEN(p); p->flowflags = FLOW_PKT_TOCLIENT; if (!(f->flags & FLOW_TO_SRC_SEEN)) { if (FlowUpdateSeenFlag(p)) { f->flags |= FLOW_TO_SRC_SEEN; p->flowflags |= FLOW_PKT_TOCLIENT_FIRST; } } /* xfer proto detect tc flag to first packet in tc dir */ if (f->flags & FLOW_PROTO_DETECT_TC_DONE) { f->flags &= ~FLOW_PROTO_DETECT_TC_DONE; p->flags |= PKT_PROTO_DETECT_TC_DONE; } } if ((f->flags & (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) == (FLOW_TO_DST_SEEN|FLOW_TO_SRC_SEEN)) { SCLogDebug("pkt %p FLOW_PKT_ESTABLISHED", p); p->flowflags |= FLOW_PKT_ESTABLISHED; if (f->proto != IPPROTO_TCP) { FlowUpdateState(f, FLOW_STATE_ESTABLISHED); } } /*set the detection bypass flags*/ if (f->flags & FLOW_NOPACKET_INSPECTION) { SCLogDebug("setting FLOW_NOPACKET_INSPECTION flag on flow %p", f); DecodeSetNoPacketInspectionFlag(p); } if (f->flags & FLOW_NOPAYLOAD_INSPECTION) { SCLogDebug("setting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f); DecodeSetNoPayloadInspectionFlag(p); } } /** \brief Entry point for packet flow handling * * This is called for every packet. * * \param tv threadvars * \param dtv decode thread vars (for flow output api thread data) * \param p packet to handle flow for */ void FlowHandlePacket(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) { /* Get this packet's flow from the hash. FlowHandlePacket() will setup * a new flow if nescesary. If we get NULL, we're out of flow memory. * The returned flow is locked. */ Flow *f = FlowGetFlowFromHash(tv, dtv, p, &p->flow); if (f == NULL) return; /* set the flow in the packet */ p->flags |= PKT_HAS_FLOW; return; } /** \brief initialize the configuration * \warning Not thread safe */ void FlowInitConfig(char quiet) { SCLogDebug("initializing flow engine..."); memset(&flow_config, 0, sizeof(flow_config)); SC_ATOMIC_INIT(flow_flags); SC_ATOMIC_INIT(flow_memuse); SC_ATOMIC_INIT(flow_prune_idx); FlowQueueInit(&flow_spare_q); FlowQueueInit(&flow_recycle_q); #ifndef AFLFUZZ_NO_RANDOM unsigned int seed = RandomTimePreseed(); /* set defaults */ flow_config.hash_rand = (int)( FLOW_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0)); #endif flow_config.hash_size = FLOW_DEFAULT_HASHSIZE; flow_config.memcap = FLOW_DEFAULT_MEMCAP; flow_config.prealloc = FLOW_DEFAULT_PREALLOC; /* If we have specific config, overwrite the defaults with them, * otherwise, leave the default values */ intmax_t val = 0; if (ConfGetInt("flow.emergency-recovery", &val) == 1) { if (val <= 100 && val >= 1) { flow_config.emergency_recovery = (uint8_t)val; } else { SCLogError(SC_ERR_INVALID_VALUE, "flow.emergency-recovery must be in the range of 1 and 100 (as percentage)"); flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY; } } else { SCLogDebug("flow.emergency-recovery, using default value"); flow_config.emergency_recovery = FLOW_DEFAULT_EMERGENCY_RECOVERY; } /* Check if we have memcap and hash_size defined at config */ char *conf_val; uint32_t configval = 0; /** set config values for memcap, prealloc and hash_size */ if ((ConfGet("flow.memcap", &conf_val)) == 1) { if (ParseSizeStringU64(conf_val, &flow_config.memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap " "from conf file - %s. Killing engine", conf_val); exit(EXIT_FAILURE); } } if ((ConfGet("flow.hash-size", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { flow_config.hash_size = configval; } } if ((ConfGet("flow.prealloc", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { flow_config.prealloc = configval; } } SCLogDebug("Flow config from suricata.yaml: memcap: %"PRIu64", hash-size: " "%"PRIu32", prealloc: %"PRIu32, flow_config.memcap, flow_config.hash_size, flow_config.prealloc); /* alloc hash memory */ uint64_t hash_size = flow_config.hash_size * sizeof(FlowBucket); if (!(FLOW_CHECK_MEMCAP(hash_size))) { SCLogError(SC_ERR_FLOW_INIT, "allocating flow hash failed: " "max flow memcap is smaller than projected hash size. " "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate " "total hash size by multiplying \"flow.hash-size\" with %"PRIuMAX", " "which is the hash bucket size.", flow_config.memcap, hash_size, (uintmax_t)sizeof(FlowBucket)); exit(EXIT_FAILURE); } flow_hash = SCMallocAligned(flow_config.hash_size * sizeof(FlowBucket), CLS); if (unlikely(flow_hash == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in FlowInitConfig. Exiting..."); exit(EXIT_FAILURE); } memset(flow_hash, 0, flow_config.hash_size * sizeof(FlowBucket)); uint32_t i = 0; for (i = 0; i < flow_config.hash_size; i++) { FBLOCK_INIT(&flow_hash[i]); SC_ATOMIC_INIT(flow_hash[i].next_ts); } (void) SC_ATOMIC_ADD(flow_memuse, (flow_config.hash_size * sizeof(FlowBucket))); if (quiet == FALSE) { SCLogConfig("allocated %llu bytes of memory for the flow hash... " "%" PRIu32 " buckets of size %" PRIuMAX "", SC_ATOMIC_GET(flow_memuse), flow_config.hash_size, (uintmax_t)sizeof(FlowBucket)); } /* pre allocate flows */ for (i = 0; i < flow_config.prealloc; i++) { if (!(FLOW_CHECK_MEMCAP(sizeof(Flow) + FlowStorageSize()))) { SCLogError(SC_ERR_FLOW_INIT, "preallocating flows failed: " "max flow memcap reached. Memcap %"PRIu64", " "Memuse %"PRIu64".", flow_config.memcap, ((uint64_t)SC_ATOMIC_GET(flow_memuse) + (uint64_t)sizeof(Flow))); exit(EXIT_FAILURE); } Flow *f = FlowAlloc(); if (f == NULL) { SCLogError(SC_ERR_FLOW_INIT, "preallocating flow failed: %s", strerror(errno)); exit(EXIT_FAILURE); } FlowEnqueue(&flow_spare_q,f); } if (quiet == FALSE) { SCLogConfig("preallocated %" PRIu32 " flows of size %" PRIuMAX "", flow_spare_q.len, (uintmax_t)(sizeof(Flow) + + FlowStorageSize())); SCLogConfig("flow memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(flow_memuse), flow_config.memcap); } FlowInitFlowProto(); return; } /** \brief print some flow stats * \warning Not thread safe */ static void FlowPrintStats (void) { return; } /** \brief shutdown the flow engine * \warning Not thread safe */ void FlowShutdown(void) { Flow *f; uint32_t u; FlowPrintStats(); /* free queues */ while((f = FlowDequeue(&flow_spare_q))) { FlowFree(f); } while((f = FlowDequeue(&flow_recycle_q))) { FlowFree(f); } /* clear and free the hash */ if (flow_hash != NULL) { /* clean up flow mutexes */ for (u = 0; u < flow_config.hash_size; u++) { f = flow_hash[u].head; while (f) { #ifdef DEBUG_VALIDATION BUG_ON(SC_ATOMIC_GET(f->use_cnt) != 0); #endif Flow *n = f->hnext; uint8_t proto_map = FlowGetProtoMapping(f->proto); FlowClearMemory(f, proto_map); FlowFree(f); f = n; } FBLOCK_DESTROY(&flow_hash[u]); SC_ATOMIC_DESTROY(flow_hash[u].next_ts); } SCFreeAligned(flow_hash); flow_hash = NULL; } (void) SC_ATOMIC_SUB(flow_memuse, flow_config.hash_size * sizeof(FlowBucket)); FlowQueueDestroy(&flow_spare_q); FlowQueueDestroy(&flow_recycle_q); SC_ATOMIC_DESTROY(flow_prune_idx); SC_ATOMIC_DESTROY(flow_memuse); SC_ATOMIC_DESTROY(flow_flags); return; } /** * \brief Function to set the default timeout, free function and flow state * function for all supported flow_proto. */ void FlowInitFlowProto(void) { FlowTimeoutsInit(); #define SET_DEFAULTS(p, n, e, c, b, ne, ee, ce, be) \ flow_timeouts_normal[(p)].new_timeout = (n); \ flow_timeouts_normal[(p)].est_timeout = (e); \ flow_timeouts_normal[(p)].closed_timeout = (c); \ flow_timeouts_normal[(p)].bypassed_timeout = (b); \ flow_timeouts_emerg[(p)].new_timeout = (ne); \ flow_timeouts_emerg[(p)].est_timeout = (ee); \ flow_timeouts_emerg[(p)].closed_timeout = (ce); \ flow_timeouts_emerg[(p)].bypassed_timeout = (be); \ SET_DEFAULTS(FLOW_PROTO_DEFAULT, FLOW_DEFAULT_NEW_TIMEOUT, FLOW_DEFAULT_EST_TIMEOUT, FLOW_DEFAULT_CLOSED_TIMEOUT, FLOW_DEFAULT_BYPASSED_TIMEOUT, FLOW_DEFAULT_EMERG_NEW_TIMEOUT, FLOW_DEFAULT_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT); SET_DEFAULTS(FLOW_PROTO_TCP, FLOW_IPPROTO_TCP_NEW_TIMEOUT, FLOW_IPPROTO_TCP_EST_TIMEOUT, FLOW_DEFAULT_CLOSED_TIMEOUT, FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT); SET_DEFAULTS(FLOW_PROTO_UDP, FLOW_IPPROTO_UDP_NEW_TIMEOUT, FLOW_IPPROTO_UDP_EST_TIMEOUT, FLOW_DEFAULT_CLOSED_TIMEOUT, FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT); SET_DEFAULTS(FLOW_PROTO_ICMP, FLOW_IPPROTO_ICMP_NEW_TIMEOUT, FLOW_IPPROTO_ICMP_EST_TIMEOUT, FLOW_DEFAULT_CLOSED_TIMEOUT, FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT, FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT, FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT, FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT); flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc = NULL; flow_freefuncs[FLOW_PROTO_TCP].Freefunc = NULL; flow_freefuncs[FLOW_PROTO_UDP].Freefunc = NULL; flow_freefuncs[FLOW_PROTO_ICMP].Freefunc = NULL; /* Let's see if we have custom timeouts defined from config */ const char *new = NULL; const char *established = NULL; const char *closed = NULL; const char *bypassed = NULL; const char *emergency_new = NULL; const char *emergency_established = NULL; const char *emergency_closed = NULL; const char *emergency_bypassed = NULL; ConfNode *flow_timeouts = ConfGetNode("flow-timeouts"); if (flow_timeouts != NULL) { ConfNode *proto = NULL; uint32_t configval = 0; /* Defaults. */ proto = ConfNodeLookupChild(flow_timeouts, "default"); if (proto != NULL) { new = ConfNodeLookupChildValue(proto, "new"); established = ConfNodeLookupChildValue(proto, "established"); closed = ConfNodeLookupChildValue(proto, "closed"); bypassed = ConfNodeLookupChildValue(proto, "bypassed"); emergency_new = ConfNodeLookupChildValue(proto, "emergency-new"); emergency_established = ConfNodeLookupChildValue(proto, "emergency-established"); emergency_closed = ConfNodeLookupChildValue(proto, "emergency-closed"); emergency_bypassed = ConfNodeLookupChildValue(proto, "emergency-bypassed"); if (new != NULL && ByteExtractStringUint32(&configval, 10, strlen(new), new) > 0) { flow_timeouts_normal[FLOW_PROTO_DEFAULT].new_timeout = configval; } if (established != NULL && ByteExtractStringUint32(&configval, 10, strlen(established), established) > 0) { flow_timeouts_normal[FLOW_PROTO_DEFAULT].est_timeout = configval; } if (closed != NULL && ByteExtractStringUint32(&configval, 10, strlen(closed), closed) > 0) { flow_timeouts_normal[FLOW_PROTO_DEFAULT].closed_timeout = configval; } if (bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(bypassed), bypassed) > 0) { flow_timeouts_normal[FLOW_PROTO_DEFAULT].bypassed_timeout = configval; } if (emergency_new != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_new), emergency_new) > 0) { flow_timeouts_emerg[FLOW_PROTO_DEFAULT].new_timeout = configval; } if (emergency_established != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_established), emergency_established) > 0) { flow_timeouts_emerg[FLOW_PROTO_DEFAULT].est_timeout= configval; } if (emergency_closed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_closed), emergency_closed) > 0) { flow_timeouts_emerg[FLOW_PROTO_DEFAULT].closed_timeout = configval; } if (emergency_bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_bypassed), emergency_bypassed) > 0) { flow_timeouts_emerg[FLOW_PROTO_DEFAULT].bypassed_timeout = configval; } } /* TCP. */ proto = ConfNodeLookupChild(flow_timeouts, "tcp"); if (proto != NULL) { new = ConfNodeLookupChildValue(proto, "new"); established = ConfNodeLookupChildValue(proto, "established"); closed = ConfNodeLookupChildValue(proto, "closed"); bypassed = ConfNodeLookupChildValue(proto, "bypassed"); emergency_new = ConfNodeLookupChildValue(proto, "emergency-new"); emergency_established = ConfNodeLookupChildValue(proto, "emergency-established"); emergency_closed = ConfNodeLookupChildValue(proto, "emergency-closed"); emergency_bypassed = ConfNodeLookupChildValue(proto, "emergency-bypassed"); if (new != NULL && ByteExtractStringUint32(&configval, 10, strlen(new), new) > 0) { flow_timeouts_normal[FLOW_PROTO_TCP].new_timeout = configval; } if (established != NULL && ByteExtractStringUint32(&configval, 10, strlen(established), established) > 0) { flow_timeouts_normal[FLOW_PROTO_TCP].est_timeout = configval; } if (closed != NULL && ByteExtractStringUint32(&configval, 10, strlen(closed), closed) > 0) { flow_timeouts_normal[FLOW_PROTO_TCP].closed_timeout = configval; } if (bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(bypassed), bypassed) > 0) { flow_timeouts_normal[FLOW_PROTO_TCP].bypassed_timeout = configval; } if (emergency_new != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_new), emergency_new) > 0) { flow_timeouts_emerg[FLOW_PROTO_TCP].new_timeout = configval; } if (emergency_established != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_established), emergency_established) > 0) { flow_timeouts_emerg[FLOW_PROTO_TCP].est_timeout = configval; } if (emergency_closed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_closed), emergency_closed) > 0) { flow_timeouts_emerg[FLOW_PROTO_TCP].closed_timeout = configval; } if (emergency_bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_bypassed), emergency_bypassed) > 0) { flow_timeouts_emerg[FLOW_PROTO_TCP].bypassed_timeout = configval; } } /* UDP. */ proto = ConfNodeLookupChild(flow_timeouts, "udp"); if (proto != NULL) { new = ConfNodeLookupChildValue(proto, "new"); established = ConfNodeLookupChildValue(proto, "established"); bypassed = ConfNodeLookupChildValue(proto, "bypassed"); emergency_new = ConfNodeLookupChildValue(proto, "emergency-new"); emergency_established = ConfNodeLookupChildValue(proto, "emergency-established"); emergency_bypassed = ConfNodeLookupChildValue(proto, "emergency-bypassed"); if (new != NULL && ByteExtractStringUint32(&configval, 10, strlen(new), new) > 0) { flow_timeouts_normal[FLOW_PROTO_UDP].new_timeout = configval; } if (established != NULL && ByteExtractStringUint32(&configval, 10, strlen(established), established) > 0) { flow_timeouts_normal[FLOW_PROTO_UDP].est_timeout = configval; } if (bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(bypassed), bypassed) > 0) { flow_timeouts_normal[FLOW_PROTO_UDP].bypassed_timeout = configval; } if (emergency_new != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_new), emergency_new) > 0) { flow_timeouts_emerg[FLOW_PROTO_UDP].new_timeout = configval; } if (emergency_established != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_established), emergency_established) > 0) { flow_timeouts_emerg[FLOW_PROTO_UDP].est_timeout = configval; } if (emergency_bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_bypassed), emergency_bypassed) > 0) { flow_timeouts_emerg[FLOW_PROTO_UDP].bypassed_timeout = configval; } } /* ICMP. */ proto = ConfNodeLookupChild(flow_timeouts, "icmp"); if (proto != NULL) { new = ConfNodeLookupChildValue(proto, "new"); established = ConfNodeLookupChildValue(proto, "established"); bypassed = ConfNodeLookupChildValue(proto, "bypassed"); emergency_new = ConfNodeLookupChildValue(proto, "emergency-new"); emergency_established = ConfNodeLookupChildValue(proto, "emergency-established"); emergency_bypassed = ConfNodeLookupChildValue(proto, "emergency-bypassed"); if (new != NULL && ByteExtractStringUint32(&configval, 10, strlen(new), new) > 0) { flow_timeouts_normal[FLOW_PROTO_ICMP].new_timeout = configval; } if (established != NULL && ByteExtractStringUint32(&configval, 10, strlen(established), established) > 0) { flow_timeouts_normal[FLOW_PROTO_ICMP].est_timeout = configval; } if (bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(bypassed), bypassed) > 0) { flow_timeouts_normal[FLOW_PROTO_ICMP].bypassed_timeout = configval; } if (emergency_new != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_new), emergency_new) > 0) { flow_timeouts_emerg[FLOW_PROTO_ICMP].new_timeout = configval; } if (emergency_established != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_established), emergency_established) > 0) { flow_timeouts_emerg[FLOW_PROTO_ICMP].est_timeout = configval; } if (emergency_bypassed != NULL && ByteExtractStringUint32(&configval, 10, strlen(emergency_bypassed), emergency_bypassed) > 0) { flow_timeouts_emerg[FLOW_PROTO_UDP].bypassed_timeout = configval; } } } return; } /** * \brief Function clear the flow memory before queueing it to spare flow * queue. * * \param f pointer to the flow needed to be cleared. * \param proto_map mapped value of the protocol to FLOW_PROTO's. */ int FlowClearMemory(Flow* f, uint8_t proto_map) { SCEnter(); /* call the protocol specific free function if we have one */ if (flow_freefuncs[proto_map].Freefunc != NULL) { flow_freefuncs[proto_map].Freefunc(f->protoctx); } FlowFreeStorage(f); FLOW_RECYCLE(f); SCReturnInt(1); } /** * \brief Function to set the function to get protocol specific flow state. * * \param proto protocol of which function is needed to be set. * \param Free Function pointer which will be called to free the protocol * specific memory. */ int FlowSetProtoFreeFunc (uint8_t proto, void (*Free)(void *)) { uint8_t proto_map; proto_map = FlowGetProtoMapping(proto); flow_freefuncs[proto_map].Freefunc = Free; return 1; } AppProto FlowGetAppProtocol(const Flow *f) { return f->alproto; } void *FlowGetAppState(const Flow *f) { return f->alstate; } /** * \brief get 'disruption' flags: GAP/DEPTH/PASS * \param f locked flow * \param flags existing flags to be ammended * \retval flags original flags + disrupt flags (if any) * \TODO handle UDP */ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags) { if (f->proto != IPPROTO_TCP) { return flags; } if (f->protoctx == NULL) { return flags; } uint8_t newflags = flags; TcpSession *ssn = f->protoctx; TcpStream *stream = flags & STREAM_TOSERVER ? &ssn->client : &ssn->server; if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { newflags |= STREAM_DEPTH; } if (stream->flags & STREAMTCP_STREAM_FLAG_GAP) { newflags |= STREAM_GAP; } /* todo: handle pass case (also for UDP!) */ return newflags; } void FlowUpdateState(Flow *f, enum FlowState s) { /* set the state */ SC_ATOMIC_SET(f->flow_state, s); if (f->fb) { /* and reset the flow buckup next_ts value so that the flow manager * has to revisit this row */ SC_ATOMIC_SET(f->fb->next_ts, 0); } } /************************************Unittests*******************************/ #ifdef UNITTESTS #include "threads.h" /** * \test Test the setting of the per protocol timeouts. * * \retval On success it returns 1 and on failure 0. */ static int FlowTest01 (void) { uint8_t proto_map; FlowInitFlowProto(); proto_map = FlowGetProtoMapping(IPPROTO_TCP); FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_TCP_NEW_TIMEOUT); FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_TCP_EST_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT); proto_map = FlowGetProtoMapping(IPPROTO_UDP); FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_UDP_NEW_TIMEOUT); FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_UDP_EST_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT); proto_map = FlowGetProtoMapping(IPPROTO_ICMP); FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_IPPROTO_ICMP_NEW_TIMEOUT); FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EST_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT); proto_map = FlowGetProtoMapping(IPPROTO_DCCP); FAIL_IF(flow_timeouts_normal[proto_map].new_timeout != FLOW_DEFAULT_NEW_TIMEOUT); FAIL_IF(flow_timeouts_normal[proto_map].est_timeout != FLOW_DEFAULT_EST_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].new_timeout != FLOW_DEFAULT_EMERG_NEW_TIMEOUT); FAIL_IF(flow_timeouts_emerg[proto_map].est_timeout != FLOW_DEFAULT_EMERG_EST_TIMEOUT); PASS; } /*Test function for the unit test FlowTest02*/ static void test(void *f) {} /** * \test Test the setting of the per protocol free function to free the * protocol specific memory. * * \retval On success it returns 1 and on failure 0. */ static int FlowTest02 (void) { FlowSetProtoFreeFunc(IPPROTO_DCCP, test); FlowSetProtoFreeFunc(IPPROTO_TCP, test); FlowSetProtoFreeFunc(IPPROTO_UDP, test); FlowSetProtoFreeFunc(IPPROTO_ICMP, test); FAIL_IF(flow_freefuncs[FLOW_PROTO_DEFAULT].Freefunc != test); FAIL_IF(flow_freefuncs[FLOW_PROTO_TCP].Freefunc != test); FAIL_IF(flow_freefuncs[FLOW_PROTO_UDP].Freefunc != test); FAIL_IF(flow_freefuncs[FLOW_PROTO_ICMP].Freefunc != test); PASS; } /** * \test Test flow allocations when it reach memcap * * * \retval On success it returns 1 and on failure 0. */ static int FlowTest07 (void) { int result = 0; FlowInitConfig(FLOW_QUIET); FlowConfig backup; memcpy(&backup, &flow_config, sizeof(FlowConfig)); uint32_t ini = 0; uint32_t end = flow_spare_q.len; flow_config.memcap = 10000; flow_config.prealloc = 100; /* Let's get the flow_spare_q empty */ UTHBuildPacketOfFlows(ini, end, 0); /* And now let's try to reach the memcap val */ while (FLOW_CHECK_MEMCAP(sizeof(Flow))) { ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); } /* should time out normal */ TimeSetIncrementTime(2000); ini = end + 1; end = end + 2;; UTHBuildPacketOfFlows(ini, end, 0); /* This means that the engine entered emerg mode: should happen as easy * with flow mgr activated */ if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) result = 1; memcpy(&flow_config, &backup, sizeof(FlowConfig)); FlowShutdown(); return result; } /** * \test Test flow allocations when it reach memcap * * * \retval On success it returns 1 and on failure 0. */ static int FlowTest08 (void) { int result = 0; FlowInitConfig(FLOW_QUIET); FlowConfig backup; memcpy(&backup, &flow_config, sizeof(FlowConfig)); uint32_t ini = 0; uint32_t end = flow_spare_q.len; flow_config.memcap = 10000; flow_config.prealloc = 100; /* Let's get the flow_spare_q empty */ UTHBuildPacketOfFlows(ini, end, 0); /* And now let's try to reach the memcap val */ while (FLOW_CHECK_MEMCAP(sizeof(Flow))) { ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); } /* By default we use 30 for timing out new flows. This means * that the Emergency mode should be set */ TimeSetIncrementTime(20); ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); /* This means that the engine released 5 flows by emergency timeout */ if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) result = 1; memcpy(&flow_config, &backup, sizeof(FlowConfig)); FlowShutdown(); return result; } /** * \test Test flow allocations when it reach memcap * * * \retval On success it returns 1 and on failure 0. */ static int FlowTest09 (void) { int result = 0; FlowInitConfig(FLOW_QUIET); FlowConfig backup; memcpy(&backup, &flow_config, sizeof(FlowConfig)); uint32_t ini = 0; uint32_t end = flow_spare_q.len; flow_config.memcap = 10000; flow_config.prealloc = 100; /* Let's get the flow_spare_q empty */ UTHBuildPacketOfFlows(ini, end, 0); /* And now let's try to reach the memcap val */ while (FLOW_CHECK_MEMCAP(sizeof(Flow))) { ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); } /* No timeout will work */ TimeSetIncrementTime(5); ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); /* engine in emerg mode */ if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) result = 1; memcpy(&flow_config, &backup, sizeof(FlowConfig)); FlowShutdown(); return result; } #endif /* UNITTESTS */ /** * \brief Function to register the Flow Unitests. */ void FlowRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("FlowTest01 -- Protocol Specific Timeouts", FlowTest01); UtRegisterTest("FlowTest02 -- Setting Protocol Specific Free Function", FlowTest02); UtRegisterTest("FlowTest07 -- Test flow Allocations when it reach memcap", FlowTest07); UtRegisterTest("FlowTest08 -- Test flow Allocations when it reach memcap", FlowTest08); UtRegisterTest("FlowTest09 -- Test flow Allocations when it reach memcap", FlowTest09); FlowMgrRegisterTests(); RegisterFlowStorageTests(); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-classtype.c0000644000000000000000000002207413051004444014427 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements classtype keyword. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-classtype.h" #include "flow-var.h" #include "util-classification-config.h" #include "util-error.h" #include "util-debug.h" #include "util-unittest.h" #define PARSE_REGEX "^\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*$" static pcre *regex = NULL; static pcre_extra *regex_study = NULL; static int DetectClasstypeSetup(DetectEngineCtx *, Signature *, char *); void DetectClasstypeRegisterTests(void); /** * \brief Registers the handler functions for the "Classtype" keyword. */ void DetectClasstypeRegister(void) { sigmatch_table[DETECT_CLASSTYPE].name = "classtype"; sigmatch_table[DETECT_CLASSTYPE].desc = "information about the classification of rules and alerts"; sigmatch_table[DETECT_CLASSTYPE].url = DOC_URL DOC_VERSION "/rules/meta.html#classtype"; sigmatch_table[DETECT_CLASSTYPE].Match = NULL; sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup; sigmatch_table[DETECT_CLASSTYPE].Free = NULL; sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, ®ex, ®ex_study); } /** * \brief Parses the raw string supplied with the "Classtype" keyword. * * \param Pointer to the string to be parsed. * * \retval bool success or failure. */ static int DetectClasstypeParseRawString(char *rawstr, char *out, size_t outsize) { #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; size_t len = strlen(rawstr); /* get rid of the double quotes if present */ if (rawstr[0] == '\"' && rawstr[strlen(rawstr) - 1] == '\"') { rawstr++; rawstr[strlen(rawstr) - 1] = '\0'; len -= 2; } ret = pcre_exec(regex, regex_study, rawstr, len, 0, 0, ov, 30); if (ret < 0) { SCLogError(SC_ERR_PCRE_MATCH, "Invalid Classtype in Signature"); goto end; } ret = pcre_copy_substring((char *)rawstr, ov, 30, 1, out, outsize); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto end; } return 0; end: return -1; } /** * \brief The setup function that would be called when the Signature parsing * module encounters the "Classtype" keyword. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer the current Signature instance that is being parsed. * \param rawstr Pointer to the argument supplied to the classtype keyword. * * \retval 0 On success * \retval -1 On failure */ static int DetectClasstypeSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char parsed_ct_name[1024] = ""; SCClassConfClasstype *ct = NULL; if (DetectClasstypeParseRawString(rawstr, parsed_ct_name, sizeof(parsed_ct_name)) < -1) { SCLogError(SC_ERR_PCRE_PARSE, "Error parsing classtype argument supplied with the " "classtype keyword"); goto error; } ct = SCClassConfGetClasstype(parsed_ct_name, de_ctx); if (ct == NULL) { SCLogError(SC_ERR_UNKNOWN_VALUE, "Unknown Classtype: \"%s\". Invalidating the Signature", parsed_ct_name); goto error; } /* if we have retrieved the classtype, assign the message to be displayed * for this Signature by fast.log, if a Packet matches this Signature */ s->class = ct->classtype_id; s->class_msg = ct->classtype_desc; /* if a priority keyword has appeared before the classtype, s->prio would * hold a value which is != -1, in which case we don't overwrite the value. * Otherwise, overwrite the value */ if (s->prio == -1) s->prio = ct->priority; return 0; error: return -1; } /*------------------------------Unittests-------------------------------------*/ #ifdef UNITTESTS /** * \test Check that supplying an invalid classtype in the rule, results in the * rule being invalidated. */ int DetectClasstypeTest01() { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; " "Classtype:not_available; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; DetectEngineCtxFree(de_ctx); end: return result; } /** * \test Check that both valid and invalid classtypes in a rule are handled * properly, with rules containing invalid classtypes being rejected * and the ones containing valid classtypes parsed and returned. */ int DetectClasstypeTest02() { int result = 0; Signature *last = NULL; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:bad-unknown; sid:1;)"); if (sig == NULL) { printf("first sig failed to parse: "); result = 0; goto end; } de_ctx->sig_list = last = sig; result = (sig != NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:not-there; sid:1;)"); last->next = sig; result &= (sig == NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:Bad-UnkNown; sid:1;)"); if (sig == NULL) { printf("second sig failed to parse: "); result = 0; goto end; } last->next = sig; last = sig; result &= (sig != NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:nothing-wrong; sid:1;)"); if (sig == NULL) { result = 0; goto end; } last->next = sig; last = sig; result &= (sig != NULL); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:attempted_dos; sid:1;)"); last->next = sig; result &= (sig == NULL); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return result; } /** * \test Check that the signatures are assigned priority based on classtype they * are given. */ int DetectClasstypeTest03() { int result = 0; Signature *last = NULL; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:bad-unknown; priority:1; sid:1;)"); if (sig == NULL) { result = 0; goto end; } de_ctx->sig_list = last = sig; result = (sig != NULL); result &= (sig->prio == 1); sig = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Classtype test\"; Classtype:unKnoWn; " "priority:3; sid:1;)"); if (sig == NULL) { result = 0; goto end; } last->next = sig; last = sig; result &= (sig != NULL); result &= (sig->prio == 3); sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Classtype test\"; " "Classtype:nothing-wrong; priority:1; sid:1;)"); if (sig == NULL) { result = 0; goto end; } last->next = sig; last = sig; result &= (sig != NULL); result &= (sig->prio == 1); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for Classification Config API. */ void DetectClasstypeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectClasstypeTest01", DetectClasstypeTest01); UtRegisterTest("DetectClasstypeTest02", DetectClasstypeTest02); UtRegisterTest("DetectClasstypeTest03", DetectClasstypeTest03); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-fileext.h0000644000000000000000000000216213051004444014061 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_FILEEXT_H__ #define __DETECT_FILEEXT_H__ #include "util-spm-bm.h" typedef struct DetectFileextData_ { uint8_t *ext; /** file extension to match */ uint16_t len; /** length of the file */ uint32_t flags; } DetectFileextData; /* prototypes */ void DetectFileextRegister (void); #endif /* __DETECT_FILEEXT_H__ */ suricata-3.2.1/src/util-atomic.h0000644000000000000000000003172513051004444013411 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon * * API for atomic operations. Uses atomic instructions (GCC only at this time) * where available, falls back to (spin)locked* operations otherwise. * * To prevent developers from accidentally working with the atomic variables * directly instead of through the proper macro's, a marco trick is performed * that exposes different variable names than the developer uses. So if the dev * uses "somevar", internally "somevar_sc_atomic__" is used. * * Where available, we use __sync_fetch_and_add and * __sync_bool_compare_and_swap. If those are unavailable, the API * transparently created a matching (spin)lock for each atomic variable. The * lock will be named "somevar_sc_lock__" * * (*) where spinlocks are unavailable, the threading api falls back to mutex */ #ifndef __UTIL_ATOMIC_H__ #define __UTIL_ATOMIC_H__ /* test if we have atomic operations support */ #if (!defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8) || !defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4) || \ !defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2) || !defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1)) && \ !defined(__tile__) /* Do not have atomic operations support, so implement them with locks. */ /** * \brief wrapper to declare an atomic variable including a (spin) lock * to protect it. * * \warning Variable and lock are _not_ initialized. */ #define SC_ATOMIC_DECLARE(type, name) \ type name ## _sc_atomic__; \ SCSpinlock name ## _sc_lock__ /** * \brief wrapper to reference an atomic variable already declared on another file (including the spin lock) * */ #define SC_ATOMIC_EXTERN(type, name) \ extern type name ## _sc_atomic__; \ extern SCSpinlock name ## _sc_lock__ /** * \brief wrapper to declare an atomic variable including a (spin) lock * to protect it and initialize them. */ #define SC_ATOMIC_DECL_AND_INIT(type, name) \ type name ## _sc_atomic__ = 0; \ SCSpinlock name ## _sc_lock__; \ SCSpinInit(&(name ## _sc_lock__), 0) /** * \brief Initialize the previously declared atomic variable and it's * lock. */ #define SC_ATOMIC_INIT(name) do { \ SCSpinInit(&(name ## _sc_lock__), 0); \ (name ## _sc_atomic__) = 0; \ } while(0) /** * \brief Initialize the previously declared atomic variable and it's * lock. */ #define SC_ATOMIC_RESET(name) do { \ (name ## _sc_atomic__) = 0; \ } while(0) /** * \brief Destroy the lock used to protect this variable */ #define SC_ATOMIC_DESTROY(name) do { \ SCSpinDestroy(&(name ## _sc_lock__)); \ } while (0) /** * \brief add a value to our atomic variable * * \param name the atomic variable * \param val the value to add to the variable */ #define SC_ATOMIC_ADD(name, val) ({\ typeof(name ## _sc_atomic__) var; \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) += (val); \ var = (name ## _sc_atomic__); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0); \ var ; \ }) /** * \brief sub a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_SUB(name, val) ({ \ typeof(name ## _sc_atomic__) var; \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) -= (val); \ var = (name ## _sc_atomic__); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0); \ var ; \ }) /** * \brief Bitwise AND a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_AND(name, val) \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) &= (val); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0) /** * \brief Bitwise OR a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_OR(name, val) \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) |= (val); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0) /** * \brief Bitwise NAND a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_NAND(name, val) \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) = ~(name ## _sc_atomic__) & (val); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0) /** * \brief Bitwise XOR a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_XOR(name, val) \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ (name ## _sc_atomic__) ^= (val); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while(0) /** * \brief Get the value from the atomic variable. * * \retval var value */ #define SC_ATOMIC_GET(name) ({ \ typeof(name ## _sc_atomic__) var; \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ var = (name ## _sc_atomic__); \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while (0); \ var; \ }) /** * \brief Set the value for the atomic variable. * * \retval var value */ #define SC_ATOMIC_SET(name, val) ({ \ typeof(name ## _sc_atomic__) var; \ do { \ SCSpinLock(&(name ## _sc_lock__)); \ var = (name ## _sc_atomic__) = val; \ SCSpinUnlock(&(name ## _sc_lock__)); \ } while (0); \ var; \ }) /** * \brief atomic Compare and Switch * * \warning "name" is passed to us as "&var" */ #define SC_ATOMIC_CAS(name, cmpval, newval) ({ \ char r = 0; \ do { \ SCSpinLock((name ## _sc_lock__)); \ if (*(name ## _sc_atomic__) == (cmpval)) { \ *(name ## _sc_atomic__) = (newval); \ r = 1; \ } \ SCSpinUnlock((name ## _sc_lock__)); \ } while(0); \ r; \ }) #else /* we do have support for CAS */ /** * \brief wrapper for OS/compiler specific atomic compare and swap (CAS) * function. * * \param addr Address of the variable to CAS * \param tv Test value to compare the value at address against * \param nv New value to set the variable at addr to * * \retval 0 CAS failed * \retval 1 CAS succeeded */ #define SCAtomicCompareAndSwap(addr, tv, nv) \ __sync_bool_compare_and_swap((addr), (tv), (nv)) /** * \brief wrapper for OS/compiler specific atomic fetch and add * function. * * \param addr Address of the variable to add to * \param value Value to add to the variable at addr */ #define SCAtomicFetchAndAdd(addr, value) \ __sync_fetch_and_add((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and sub * function. * * \param addr Address of the variable to add to * \param value Value to sub from the variable at addr */ #define SCAtomicFetchAndSub(addr, value) \ __sync_fetch_and_sub((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and add * function. * * \param addr Address of the variable to add to * \param value Value to add to the variable at addr */ #define SCAtomicAddAndFetch(addr, value) \ __sync_add_and_fetch((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and sub * function. * * \param addr Address of the variable to add to * \param value Value to sub from the variable at addr */ #define SCAtomicSubAndFetch(addr, value) \ __sync_sub_and_fetch((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and "AND" * function. * * \param addr Address of the variable to AND to * \param value Value to add to the variable at addr */ #define SCAtomicFetchAndAnd(addr, value) \ __sync_fetch_and_and((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and "NAND" * function. * * \param addr Address of the variable to NAND to * \param value Value to add to the variable at addr */ #define SCAtomicFetchAndNand(addr, value) \ __sync_fetch_and_nand((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and "XOR" * function. * * \param addr Address of the variable to XOR to * \param value Value to add to the variable at addr */ #define SCAtomicFetchAndXor(addr, value) \ __sync_fetch_and_xor((addr), (value)) /** * \brief wrapper for OS/compiler specific atomic fetch and or * function. * * \param addr Address of the variable to or to * \param value Value to add to the variable at addr */ #define SCAtomicFetchAndOr(addr, value) \ __sync_fetch_and_or((addr), (value)) /** * \brief wrapper for declaring atomic variables. * * \warning Only char, short, int, long, long long and their unsigned * versions are supported. * * \param type Type of the variable (char, short, int, long, long long) * \param name Name of the variable. * * We just declare the variable here as we rely on atomic operations * to modify it, so no need for locks. * * \warning variable is not initialized */ #define SC_ATOMIC_DECLARE(type, name) \ type name ## _sc_atomic__ /** * \brief wrapper for referencing an atomic variable declared on another file. * * \warning Only char, short, int, long, long long and their unsigned * versions are supported. * * \param type Type of the variable (char, short, int, long, long long) * \param name Name of the variable. * * We just declare the variable here as we rely on atomic operations * to modify it, so no need for locks. * */ #define SC_ATOMIC_EXTERN(type, name) \ extern type name ## _sc_atomic__ /** * \brief wrapper for declaring an atomic variable and initializing it. **/ #define SC_ATOMIC_DECL_AND_INIT(type, name) \ type name ## _sc_atomic__ = 0 /** * \brief wrapper for initializing an atomic variable. **/ #define SC_ATOMIC_INIT(name) \ (name ## _sc_atomic__) = 0 /** * \brief wrapper for reinitializing an atomic variable. **/ #define SC_ATOMIC_RESET(name) \ (name ## _sc_atomic__) = 0 /** * \brief No-op. */ #define SC_ATOMIC_DESTROY(name) /** * \brief add a value to our atomic variable * * \param name the atomic variable * \param val the value to add to the variable */ #define SC_ATOMIC_ADD(name, val) \ SCAtomicAddAndFetch(&(name ## _sc_atomic__), (val)) /** * \brief sub a value from our atomic variable * * \param name the atomic variable * \param val the value to sub from the variable */ #define SC_ATOMIC_SUB(name, val) \ SCAtomicSubAndFetch(&(name ## _sc_atomic__), (val)) /** * \brief Bitwise OR a value to our atomic variable * * \param name the atomic variable * \param val the value to OR to the variable */ #define SC_ATOMIC_OR(name, val) \ SCAtomicFetchAndOr(&(name ## _sc_atomic__), (val)) /** * \brief Bitwise AND a value to our atomic variable * * \param name the atomic variable * \param val the value to AND to the variable */ #define SC_ATOMIC_AND(name, val) \ SCAtomicFetchAndAnd(&(name ## _sc_atomic__), (val)) /** * \brief Bitwise NAND a value to our atomic variable * * \param name the atomic variable * \param val the value to NAND to the variable */ #define SC_ATOMIC_NAND(name, val) \ SCAtomicFetchAndNand(&(name ## _sc_atomic__), (val)) /** * \brief Bitwise XOR a value to our atomic variable * * \param name the atomic variable * \param val the value to XOR to the variable */ #define SC_ATOMIC_XOR(name, val) \ SCAtomicFetchAndXor(&(name ## _sc_atomic__), (val)) /** * \brief atomic Compare and Switch * * \warning "name" is passed to us as "&var" */ #define SC_ATOMIC_CAS(name, cmpval, newval) \ SCAtomicCompareAndSwap((name ## _sc_atomic__), cmpval, newval) /** * \brief Get the value from the atomic variable. * * \retval var value */ #define SC_ATOMIC_GET(name) \ (name ## _sc_atomic__) /** * \brief Set the value for the atomic variable. * * \retval var value */ #define SC_ATOMIC_SET(name, val) ({ \ while (SC_ATOMIC_CAS(&name, SC_ATOMIC_GET(name), val) == 0) \ ; \ }) #endif /* !no atomic operations */ void SCAtomicRegisterTests(void); #endif /* __UTIL_ATOMIC_H__ */ suricata-3.2.1/src/detect-engine-uri.c0000644000000000000000000035076713051004444014477 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien * \author Pablo Rincon Crespo * * Based on detect-engine-uri.c */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP URI Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxUri(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud == NULL || tx_ud->request_uri_normalized == NULL) return; const uint32_t uri_len = bstr_len(tx_ud->request_uri_normalized); const uint8_t *uri = bstr_ptr(tx_ud->request_uri_normalized); if (uri_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, uri, uri_len); } } int PrefilterTxUriRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxUri, ALPROTO_HTTP, HTP_REQUEST_LINE, mpm_ctx, NULL, "http_uri"); } /** * \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags app layer flags * \param state App layer state * * \retval 0 no match. * \retval 1 match. * \retval 2 Sig can't match. */ int DetectEngineInspectHttpUri(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { HtpTxUserData *tx_ud = htp_tx_get_user_data(txv); if (tx_ud == NULL || tx_ud->request_uri_normalized == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_REQUEST_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; #if 0 PrintRawDataFp(stdout, (uint8_t *)bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); #endif /* Inspect all the uricontents fetched on each * transaction at the app layer */ int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_UMATCH], f, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** \test Test a simple uricontent option */ static int UriTestSig01(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test uricontent option\"; " "uricontent:\"one\"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option */ static int UriTestSig02(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /on HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option\"; " "pcre:/one/U; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted with payload2, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option */ static int UriTestSig03(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option\"; " "pcre:/blah/U; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the urilen option */ static int UriTestSig04(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test urilen option\"; " "urilen:>20; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the urilen option */ static int UriTestSig05(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test urilen option\"; " "urilen:>4; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option */ static int UriTestSig06(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option\"; " "pcre:/(oneself)+/U; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert on payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option in combination with urilen */ static int UriTestSig07(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option with urilen \"; " "pcre:/(one){2,}(self)?/U; urilen:3<>20; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert, but it should: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option in combination with urilen */ static int UriTestSig08(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option with urilen\"; " "pcre:/(blabla){2,}(self)?/U; urilen:3<>20; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the pcre /U option in combination with urilen */ static int UriTestSig09(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U option with urilen \"; " "pcre:/(one){2,}(self)?/U; urilen:<2; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test the uricontent option in combination with urilen */ static int UriTestSig10(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test uricontent with urilen option\"; " "uricontent:\"one\"; urilen:<2; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test content, uricontent, urilen, pcre /U options */ static int UriTestSig11(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test content, uricontent, pcre /U and urilen options\"; " "content:\"one\"; uricontent:\"one\"; pcre:/(one){2,}(self)?/U;" "urilen:<2; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test uricontent, urilen, pcre /U options */ static int UriTestSig12(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /oneoneoneone HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneoneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test pcre /U, uricontent and urilen option\"; " "uricontent:\"one\"; " "pcre:/(one)+self/U; urilen:>2; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test uricontent, urilen */ static int UriTestSig13(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test urilen option\"; " "urilen:>2; uricontent:\"one\"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with pkt, but it should: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test uricontent, pcre /U */ static int UriTestSig14(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test uricontent option\"; " "uricontent:\"one\"; pcre:/one(self)?/U;sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with pkt, but it should: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test pcre /U with anchored regex (bug 155) */ static int UriTestSig15(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /oneself HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Test uricontent option\"; " "uricontent:\"one\"; pcre:/^\\/one(self)?$/U;sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with pkt, but it should: "); goto end; } DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didnt alert with payload2, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test Test pcre /U with anchored regex (bug 155) */ static int UriTestSig16(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /search?q=123&aq=7123abcee HTTP/1.0\r\n" "User-Agent: Mozilla/1.0/\r\n" "Host: 1.2.3.4\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /search?q=123&aq=7123abcee HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any any (msg:\"ET TROJAN Downadup/Conficker A or B Worm reporting\"; flow:to_server,established; uricontent:\"/search?q=\"; pcre:\"/^\\/search\\?q=[0-9]{1,3}(&aq=7(\\?[0-9a-f]{8})?)?/U\"; pcre:\"/\\x0d\\x0aHost\\: \\d+\\.\\d+\\.\\d+\\.\\d+\\x0d\\x0a/\"; sid:2009024; rev:9;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 2009024)) { printf("sig 1 didnt alert with pkt, but it should: "); goto end; } p->alerts.cnt = 0; DetectEngineStateReset(f.de_state, STREAM_TOSERVER | STREAM_TOCLIENT); p->payload = http_buf2; p->payload_len = http_buf2_len; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 2009024)) { printf("sig 1 alerted, but it should not (host should not match): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents */ static int UriTestSig17(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /now_this_is_is_big_big_string_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"this\"; uricontent:\"is\"; within:6; " "uricontent:\"big\"; within:8; " "uricontent:\"string\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents */ static int UriTestSig18(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /now_this_is_is_is_big_big_big_string_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"this\"; uricontent:\"is\"; within:9; " "uricontent:\"big\"; within:12; " "uricontent:\"string\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents */ static int UriTestSig19(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_this_now_is_is_____big_string_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"now\"; uricontent:\"this\"; " "uricontent:\"is\"; within:12; " "uricontent:\"big\"; within:8; " "uricontent:\"string\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with offset */ static int UriTestSig20(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /_________thus_thus_is_a_big HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"thus\"; offset:8; " "uricontent:\"is\"; within:6; " "uricontent:\"big\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int UriTestSig21(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"fix\"; uricontent:\"this\"; within:6; " "uricontent:!\"and\"; distance:0; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test relative pcre. */ static int UriTestSig22(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_is_a_super_duper_" "nova_in_super_nova_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "pcre:/super/U; uricontent:\"nova\"; within:7; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int UriTestSig23(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:!\"fix_this_now\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int UriTestSig24(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"we_need_to\"; uricontent:!\"fix_this_now\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test normalized uricontents. */ static int UriTestSig25(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "pcre:/normalized/U; uricontent:\"normalized uri\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int UriTestSig26(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"fix_this\"; isdataat:4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int UriTestSig27(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /we_need_to_fix_this_and_yes_fix_this_now HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "uricontent:\"fix_this\"; isdataat:!10,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig28(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"dummy\"; " "uricontent:\"this\"; " "byte_extract:1,2,one,string,dec,relative; " "uricontent:\"ring\"; distance:one; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig29(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"dummy\"; " "uricontent:\"this\"; " "byte_extract:1,2,one,string,dec,relative; " "uricontent:\"ring\"; distance:one; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig30(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"dummy\"; " "uricontent:\"this\"; " "byte_extract:1,2,one,string,dec,relative; " "uricontent:\"_b5ig\"; offset:one; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig31(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"dummy\"; " "uricontent:\"this\"; " "byte_extract:1,2,one,string,dec,relative; " "uricontent:\"his\"; depth:one; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig32(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /this_b5ig_string_now_in_http HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"dummy\"; " "uricontent:\"this\"; " "byte_extract:1,2,one,string,dec,relative; " "uricontent:\"g_st\"; within:one; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig33(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:15; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig34(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:15, norm; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig35(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:16; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig36(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:16, norm; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig37(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:17, raw; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } static int UriTestSig38(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /normalized%20uri " "HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative uricontents\"; " "urilen:18, raw; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } #endif /* UNITTESTS */ void UriRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("UriTestSig01", UriTestSig01); UtRegisterTest("UriTestSig02", UriTestSig02); UtRegisterTest("UriTestSig03", UriTestSig03); UtRegisterTest("UriTestSig04", UriTestSig04); UtRegisterTest("UriTestSig05", UriTestSig05); UtRegisterTest("UriTestSig06", UriTestSig06); UtRegisterTest("UriTestSig07", UriTestSig07); UtRegisterTest("UriTestSig08", UriTestSig08); UtRegisterTest("UriTestSig09", UriTestSig09); UtRegisterTest("UriTestSig10", UriTestSig10); UtRegisterTest("UriTestSig11", UriTestSig11); UtRegisterTest("UriTestSig12", UriTestSig12); UtRegisterTest("UriTestSig13", UriTestSig13); UtRegisterTest("UriTestSig14", UriTestSig14); UtRegisterTest("UriTestSig15", UriTestSig15); UtRegisterTest("UriTestSig16", UriTestSig16); UtRegisterTest("UriTestSig17", UriTestSig17); UtRegisterTest("UriTestSig18", UriTestSig18); UtRegisterTest("UriTestSig19", UriTestSig19); UtRegisterTest("UriTestSig20", UriTestSig20); UtRegisterTest("UriTestSig21", UriTestSig21); UtRegisterTest("UriTestSig22", UriTestSig22); UtRegisterTest("UriTestSig23", UriTestSig23); UtRegisterTest("UriTestSig24", UriTestSig24); UtRegisterTest("UriTestSig25", UriTestSig25); UtRegisterTest("UriTestSig26", UriTestSig26); UtRegisterTest("UriTestSig27", UriTestSig27); UtRegisterTest("UriTestSig28", UriTestSig28); UtRegisterTest("UriTestSig29", UriTestSig29); UtRegisterTest("UriTestSig30", UriTestSig30); UtRegisterTest("UriTestSig31", UriTestSig31); UtRegisterTest("UriTestSig32", UriTestSig32); UtRegisterTest("UriTestSig33", UriTestSig33); UtRegisterTest("UriTestSig34", UriTestSig34); UtRegisterTest("UriTestSig35", UriTestSig35); UtRegisterTest("UriTestSig36", UriTestSig36); UtRegisterTest("UriTestSig37", UriTestSig37); UtRegisterTest("UriTestSig38", UriTestSig38); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/decode-icmpv6.c0000644000000000000000000015057013051004444013602 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode ICMPv6 */ #include "suricata-common.h" #include "decode-icmpv6.h" #include "decode.h" #include "decode-tcp.h" #include "decode-sctp.h" #include "decode-udp.h" #include "decode-events.h" #include "util-unittest.h" #include "flow.h" #include "util-debug.h" #include "util-print.h" #include "pkt-var.h" #include "util-profiling.h" #include "host.h" /** * \brief Get variables and do some checks of the embedded IPV6 packet * * \param p Pointer to the packet we are filling * \param partial_packet Pointer to the raw packet buffer * \param len the len of the rest of the packet not processed yet * * \retval void No return value */ void DecodePartialIPV6(Packet *p, uint8_t *partial_packet, uint16_t len ) { /** Check the sizes, the header must fit at least */ if (len < IPV6_HEADER_LEN) { SCLogDebug("ICMPV6_IPV6_TRUNC_PKT"); ENGINE_SET_INVALID_EVENT(p, ICMPV6_IPV6_TRUNC_PKT); return; } IPV6Hdr *icmp6_ip6h = (IPV6Hdr*)partial_packet; /** Check the embedded version */ if(((icmp6_ip6h->s_ip6_vfc & 0xf0) >> 4) != 6) { SCLogDebug("ICMPv6 contains Unknown IPV6 version " "ICMPV6_IPV6_UNKNOWN_VER"); ENGINE_SET_INVALID_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER); return; } /** We need to fill icmpv6vars */ p->icmpv6vars.emb_ipv6h = icmp6_ip6h; /** Get the IP6 address */ p->icmpv6vars.emb_ip6_src[0] = icmp6_ip6h->s_ip6_src[0]; p->icmpv6vars.emb_ip6_src[1] = icmp6_ip6h->s_ip6_src[1]; p->icmpv6vars.emb_ip6_src[2] = icmp6_ip6h->s_ip6_src[2]; p->icmpv6vars.emb_ip6_src[3] = icmp6_ip6h->s_ip6_src[3]; p->icmpv6vars.emb_ip6_dst[0] = icmp6_ip6h->s_ip6_dst[0]; p->icmpv6vars.emb_ip6_dst[1] = icmp6_ip6h->s_ip6_dst[1]; p->icmpv6vars.emb_ip6_dst[2] = icmp6_ip6h->s_ip6_dst[2]; p->icmpv6vars.emb_ip6_dst[3] = icmp6_ip6h->s_ip6_dst[3]; /** Get protocol and ports inside the embedded ipv6 packet and set the pointers */ p->icmpv6vars.emb_ip6_proto_next = icmp6_ip6h->s_ip6_nxt; switch (icmp6_ip6h->s_ip6_nxt) { case IPPROTO_TCP: if (len >= IPV6_HEADER_LEN + TCP_HEADER_LEN ) { p->icmpv6vars.emb_tcph = (TCPHdr*)(partial_packet + IPV6_HEADER_LEN); p->icmpv6vars.emb_sport = p->icmpv6vars.emb_tcph->th_sport; p->icmpv6vars.emb_dport = p->icmpv6vars.emb_tcph->th_dport; SCLogDebug("ICMPV6->IPV6->TCP header sport: " "%"PRIu8" dport %"PRIu8"", p->icmpv6vars.emb_sport, p->icmpv6vars.emb_dport); } else { SCLogDebug("Warning, ICMPV6->IPV6->TCP " "header Didn't fit in the packet!"); p->icmpv6vars.emb_sport = 0; p->icmpv6vars.emb_dport = 0; } break; case IPPROTO_UDP: if (len >= IPV6_HEADER_LEN + UDP_HEADER_LEN ) { p->icmpv6vars.emb_udph = (UDPHdr*)(partial_packet + IPV6_HEADER_LEN); p->icmpv6vars.emb_sport = p->icmpv6vars.emb_udph->uh_sport; p->icmpv6vars.emb_dport = p->icmpv6vars.emb_udph->uh_dport; SCLogDebug("ICMPV6->IPV6->UDP header sport: " "%"PRIu8" dport %"PRIu8"", p->icmpv6vars.emb_sport, p->icmpv6vars.emb_dport); } else { SCLogDebug("Warning, ICMPV6->IPV6->UDP " "header Didn't fit in the packet!"); p->icmpv6vars.emb_sport = 0; p->icmpv6vars.emb_dport = 0; } break; case IPPROTO_ICMPV6: p->icmpv6vars.emb_icmpv6h = (ICMPV6Hdr*)(partial_packet + IPV6_HEADER_LEN); p->icmpv6vars.emb_sport = 0; p->icmpv6vars.emb_dport = 0; SCLogDebug("ICMPV6->IPV6->ICMP header"); break; } /* debug print */ #ifdef DEBUG char s[46], d[46]; PrintInet(AF_INET6, (const void *)p->icmpv6vars.emb_ip6_src, s, sizeof(s)); PrintInet(AF_INET6, (const void *)p->icmpv6vars.emb_ip6_dst, d, sizeof(d)); SCLogDebug("ICMPv6 embedding IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: " "%" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32, s, d, IPV6_GET_RAW_CLASS(icmp6_ip6h), IPV6_GET_RAW_FLOW(icmp6_ip6h), IPV6_GET_RAW_NH(icmp6_ip6h), IPV6_GET_RAW_PLEN(icmp6_ip6h), IPV6_GET_RAW_HLIM(icmp6_ip6h)); #endif return; } /** * \brief Decode ICMPV6 packets and fill the Packet with the decoded info * * \param tv Pointer to the thread variables * \param dtv Pointer to the decode thread variables * \param p Pointer to the packet we are filling * \param pkt Pointer to the raw packet buffer * \param len the len of the rest of the packet not processed yet * \param pq the packet queue were this packet go * * \retval void No return value */ int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { int full_hdr = 0; StatsIncr(tv, dtv->counter_icmpv6); if (len < ICMPV6_HEADER_LEN) { SCLogDebug("ICMPV6_PKT_TOO_SMALL"); ENGINE_SET_INVALID_EVENT(p, ICMPV6_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->icmpv6h = (ICMPV6Hdr *)pkt; p->proto = IPPROTO_ICMPV6; p->type = p->icmpv6h->type; p->code = p->icmpv6h->code; p->payload_len = len - ICMPV6_HEADER_LEN; p->payload = pkt + ICMPV6_HEADER_LEN; SCLogDebug("ICMPV6 TYPE %" PRIu32 " CODE %" PRIu32 "", p->icmpv6h->type, p->icmpv6h->code); switch (ICMPV6_GET_TYPE(p)) { case ICMP6_DST_UNREACH: SCLogDebug("ICMP6_DST_UNREACH"); if (ICMPV6_GET_CODE(p) > ICMP6_DST_UNREACH_REJECTROUTE) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN), len - ICMPV6_HEADER_LEN ); full_hdr = 1; } break; case ICMP6_PACKET_TOO_BIG: SCLogDebug("ICMP6_PACKET_TOO_BIG"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { p->icmpv6vars.mtu = ICMPV6_GET_MTU(p); DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN), len - ICMPV6_HEADER_LEN ); full_hdr = 1; } break; case ICMP6_TIME_EXCEEDED: SCLogDebug("ICMP6_TIME_EXCEEDED"); if (ICMPV6_GET_CODE(p) > ICMP6_TIME_EXCEED_REASSEMBLY) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN), len - ICMPV6_HEADER_LEN ); full_hdr = 1; } break; case ICMP6_PARAM_PROB: SCLogDebug("ICMP6_PARAM_PROB"); if (ICMPV6_GET_CODE(p) > ICMP6_PARAMPROB_OPTION) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { p->icmpv6vars.error_ptr= ICMPV6_GET_ERROR_PTR(p); DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN), len - ICMPV6_HEADER_LEN ); full_hdr = 1; } break; case ICMP6_ECHO_REQUEST: SCLogDebug("ICMP6_ECHO_REQUEST id: %u seq: %u", p->icmpv6h->icmpv6b.icmpv6i.id, p->icmpv6h->icmpv6b.icmpv6i.seq); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id; p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq; full_hdr = 1; } break; case ICMP6_ECHO_REPLY: SCLogDebug("ICMP6_ECHO_REPLY id: %u seq: %u", p->icmpv6h->icmpv6b.icmpv6i.id, p->icmpv6h->icmpv6b.icmpv6i.seq); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } else { p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id; p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq; full_hdr = 1; } break; case ND_ROUTER_SOLICIT: SCLogDebug("ND_ROUTER_SOLICIT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_ROUTER_ADVERT: SCLogDebug("ND_ROUTER_ADVERT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_NEIGHBOR_SOLICIT: SCLogDebug("ND_NEIGHBOR_SOLICIT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_NEIGHBOR_ADVERT: SCLogDebug("ND_NEIGHBOR_ADVERT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_REDIRECT: SCLogDebug("ND_REDIRECT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case MLD_LISTENER_QUERY: SCLogDebug("MLD_LISTENER_QUERY"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } if (IPV6_GET_HLIM(p) != 1) { ENGINE_SET_EVENT(p, ICMPV6_MLD_MESSAGE_WITH_INVALID_HL); } break; case MLD_LISTENER_REPORT: SCLogDebug("MLD_LISTENER_REPORT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } if (IPV6_GET_HLIM(p) != 1) { ENGINE_SET_EVENT(p, ICMPV6_MLD_MESSAGE_WITH_INVALID_HL); } break; case MLD_LISTENER_REDUCTION: SCLogDebug("MLD_LISTENER_REDUCTION"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } if (IPV6_GET_HLIM(p) != 1) { ENGINE_SET_EVENT(p, ICMPV6_MLD_MESSAGE_WITH_INVALID_HL); } break; case ICMP6_RR: SCLogDebug("ICMP6_RR"); if (ICMPV6_GET_CODE(p) > 2 && ICMPV6_GET_CODE(p) != 255) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ICMP6_NI_QUERY: SCLogDebug("ICMP6_NI_QUERY"); if (ICMPV6_GET_CODE(p) > 2) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ICMP6_NI_REPLY: SCLogDebug("ICMP6_NI_REPLY"); if (ICMPV6_GET_CODE(p) > 2) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_INVERSE_SOLICIT: SCLogDebug("ND_INVERSE_SOLICIT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ND_INVERSE_ADVERT: SCLogDebug("ND_INVERSE_ADVERT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case MLD_V2_LIST_REPORT: SCLogDebug("MLD_V2_LIST_REPORT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case HOME_AGENT_AD_REQUEST: SCLogDebug("HOME_AGENT_AD_REQUEST"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case HOME_AGENT_AD_REPLY: SCLogDebug("HOME_AGENT_AD_REPLY"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case MOBILE_PREFIX_SOLICIT: SCLogDebug("MOBILE_PREFIX_SOLICIT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case MOBILE_PREFIX_ADVERT: SCLogDebug("MOBILE_PREFIX_ADVERT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case CERT_PATH_SOLICIT: SCLogDebug("CERT_PATH_SOLICIT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case CERT_PATH_ADVERT: SCLogDebug("CERT_PATH_ADVERT"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case ICMP6_MOBILE_EXPERIMENTAL: SCLogDebug("ICMP6_MOBILE_EXPERIMENTAL"); break; case MC_ROUTER_ADVERT: SCLogDebug("MC_ROUTER_ADVERT"); break; case MC_ROUTER_SOLICIT: SCLogDebug("MC_ROUTER_SOLICIT"); break; case MC_ROUTER_TERMINATE: SCLogDebug("MC_ROUTER_TERMINATE"); break; case FMIPV6_MSG: SCLogDebug("FMIPV6_MSG"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case RPL_CONTROL_MSG: SCLogDebug("RPL_CONTROL_MSG"); if (ICMPV6_GET_CODE(p) > 3 && ICMPV6_GET_CODE(p) < 128) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } if (ICMPV6_GET_CODE(p) > 132) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case LOCATOR_UDATE_MSG: SCLogDebug("LOCATOR_UDATE_MSG"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case DUPL_ADDR_REQUEST: SCLogDebug("DUPL_ADDR_REQUEST"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case DUPL_ADDR_CONFIRM: SCLogDebug("DUPL_ADDR_CONFIRM"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; case MPL_CONTROL_MSG: SCLogDebug("MPL_CONTROL_MSG"); if (ICMPV6_GET_CODE(p) != 0) { ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE); } break; default: /* Various range taken from: * http://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-2 */ if ((ICMPV6_GET_TYPE(p) > 4) && (ICMPV6_GET_TYPE(p) < 100)) { ENGINE_SET_EVENT(p, ICMPV6_UNASSIGNED_TYPE); } else if ((ICMPV6_GET_TYPE(p) >= 100) && (ICMPV6_GET_TYPE(p) < 102)) { ENGINE_SET_EVENT(p, ICMPV6_EXPERIMENTATION_TYPE); } else if ((ICMPV6_GET_TYPE(p) >= 102) && (ICMPV6_GET_TYPE(p) < 127)) { ENGINE_SET_EVENT(p, ICMPV6_UNASSIGNED_TYPE); } else if ((ICMPV6_GET_TYPE(p) >= 160) && (ICMPV6_GET_TYPE(p) < 200)) { ENGINE_SET_EVENT(p, ICMPV6_UNASSIGNED_TYPE); } else if ((ICMPV6_GET_TYPE(p) >= 200) && (ICMPV6_GET_TYPE(p) < 202)) { ENGINE_SET_EVENT(p, ICMPV6_EXPERIMENTATION_TYPE); } else if (ICMPV6_GET_TYPE(p) >= 202) { ENGINE_SET_EVENT(p, ICMPV6_UNASSIGNED_TYPE); } else { SCLogDebug("ICMPV6 Message type %" PRIu8 " not " "implemented yet", ICMPV6_GET_TYPE(p)); ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_TYPE); } } /* for a info message the header is just 4 bytes */ if (!full_hdr) { if (p->payload_len >= 4) { p->payload_len -= 4; p->payload = pkt + 4; } else { p->payload_len = 0; p->payload = NULL; } } #ifdef DEBUG if (ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)) SCLogDebug("Unknown Code, ICMPV6_UNKNOWN_CODE"); if (ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_TYPE)) SCLogDebug("Unknown Type, ICMPV6_UNKNOWN_TYPE"); #endif FlowSetupPacket(p); return TM_ECODE_OK; } #ifdef UNITTESTS static int ICMPV6CalculateValidChecksumtest01(void) { uint16_t csum = 0; uint8_t raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x00}; csum = *( ((uint16_t *)(raw_ipv6 + 56))); FAIL_IF(csum != ICMPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 68)); PASS; } static int ICMPV6CalculateInvalidChecksumtest02(void) { uint16_t csum = 0; uint8_t raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x01}; csum = *( ((uint16_t *)(raw_ipv6 + 56))); FAIL_IF(csum == ICMPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 68)); PASS; } /** \test icmpv6 message type: parameter problem, valid packet * * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6ParamProbTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x38, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0xcc, 0x2a, 0x6d, 0x93, 0x0b, 0xdf, 0x69, 0x70, 0x12, 0xb7, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x00, 0x08, 0xb5, 0x99, 0xc3, 0xde, 0x40 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; uint32_t *ipv6src; uint32_t *ipv6dst; ipv6src = (uint32_t*) &raw_ipv6[8]; ipv6dst = (uint32_t*) &raw_ipv6[24]; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(p->icmpv6h == NULL); /* ICMPv6 not processed at all? */ FAIL_IF(ICMPV6_GET_TYPE(p) != 4 || ICMPV6_GET_CODE(p) != 0 || ICMPV6_GET_EMB_PROTO(p) != IPPROTO_ICMPV6); /* Let's check if we retrieved the embedded ipv6 addresses correctly */ uint32_t i=0; for (i = 0; i < 4; i++) { FAIL_IF(p->icmpv6vars.emb_ip6_src[i] != ipv6src[i] || p->icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]); } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: packet too big, valid packet * * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6PktTooBigTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x5c, 0x7a, 0x00, 0x00, 0x05, 0x00, 0x64, 0x14, 0xfd, 0xff, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; uint32_t *ipv6src; uint32_t *ipv6dst; ipv6src = (uint32_t*) &raw_ipv6[8]; ipv6dst = (uint32_t*) &raw_ipv6[24]; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(p->icmpv6h == NULL); /* Note: it has an embedded ipv6 packet but no protocol after ipv6 * (IPPROTO_NONE) */ /* Check if ICMPv6 header was processed at all. */ FAIL_IF(ICMPV6_GET_TYPE(p) != 2 || ICMPV6_GET_CODE(p) != 0 ); /* Let's check if we retrieved the embedded ipv6 addresses correctly */ uint32_t i=0; for (i = 0; i < 4; i++) { FAIL_IF(p->icmpv6vars.emb_ip6_src[i] != ipv6src[i] || p->icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]); } SCLogDebug("ICMPV6 IPV6 src and dst properly set"); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: time exceed, valid packet * * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6TimeExceedTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x00, 0x56, 0x2d, 0x00, 0x00, 0x00, 0x00, 0x6d, 0x23, 0xff, 0x3d, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; uint32_t *ipv6src; uint32_t *ipv6dst; ipv6src = (uint32_t*) &raw_ipv6[8]; ipv6dst = (uint32_t*) &raw_ipv6[24]; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); /* Note: it has an embedded ipv6 packet but no protocol after ipv6 (IPPROTO_NONE) */ FAIL_IF(ICMPV6_GET_TYPE(p) != 3 || ICMPV6_GET_CODE(p) != 0 || ICMPV6_GET_EMB_IPV6(p) == NULL || ICMPV6_GET_EMB_PROTO(p) != IPPROTO_NONE); /* Let's check if we retrieved the embedded ipv6 addresses correctly */ uint32_t i=0; for (i = 0; i < 4; i++) { FAIL_IF(p->icmpv6vars.emb_ip6_src[i] != ipv6src[i] || p->icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]); } SCLogDebug("ICMPV6 IPV6 src and dst properly set"); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: destination unreach, valid packet * * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6DestUnreachTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00, 0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; uint32_t *ipv6src; uint32_t *ipv6dst; ipv6src = (uint32_t*) &raw_ipv6[8]; ipv6dst = (uint32_t*) &raw_ipv6[24]; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); /* Note: it has an embedded ipv6 packet but no protocol after ipv6 (IPPROTO_NONE) */ FAIL_IF(ICMPV6_GET_TYPE(p) != 1 || ICMPV6_GET_CODE(p) != 0 || ICMPV6_GET_EMB_IPV6(p) == NULL || ICMPV6_GET_EMB_PROTO(p) != IPPROTO_NONE); /* Let's check if we retrieved the embedded ipv6 addresses correctly */ uint32_t i=0; for (i = 0; i < 4; i++) { FAIL_IF(p->icmpv6vars.emb_ip6_src[i] != ipv6src[i] || p->icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]); } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 message type: echo request, valid packet * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6EchoReqTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x00, 0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); SCLogDebug("ID: %u seq: %u", ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p)); if (ICMPV6_GET_TYPE(p) != 128 || ICMPV6_GET_CODE(p) != 0 || ntohs(ICMPV6_GET_ID(p)) != 9712 || ntohs(ICMPV6_GET_SEQ(p)) != 29987) { printf("ICMPv6 Echo reply decode failed TYPE %u CODE %u ID %04x(%u) SEQ %04x(%u): ", ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), ntohs(ICMPV6_GET_ID(p)), ICMPV6_GET_SEQ(p), ntohs(ICMPV6_GET_SEQ(p))); FAIL; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 message type: echo reply, valid packet * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6EchoRepTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x81, 0x00, 0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); SCLogDebug("type: %u code %u ID: %u seq: %u", ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p),ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p)); if (ICMPV6_GET_TYPE(p) != 129 || ICMPV6_GET_CODE(p) != 0 || ntohs(ICMPV6_GET_ID(p)) != 9712 || ntohs(ICMPV6_GET_SEQ(p)) != 29987) { printf("ICMPv6 Echo reply decode failed TYPE %u CODE %u ID %04x(%u) SEQ %04x(%u): ", ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), ntohs(ICMPV6_GET_ID(p)), ICMPV6_GET_SEQ(p), ntohs(ICMPV6_GET_SEQ(p))); FAIL; } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: parameter problem, invalid packet * \brief set the event ICMPV6_IPV6_UNKNOWN_VER properly when the embedded packet has an unknown version * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6ParamProbTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x38, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0xcc, 0x2a, 0x6d, 0x93, 0x0b, 0xdf, 0x38, 0x70, 0x12, 0xb7, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x00, 0x08, 0xb5, 0x99, 0xc3, 0xde, 0x40 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); FAIL_IF(ICMPV6_GET_TYPE(p) != 4 || ICMPV6_GET_CODE(p) != 0); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: packet too big, invalid packet * \brief Set the event ICMPV6_UNKNOWN_CODE if code is invalid for this type * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6PktTooBigTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x10, 0x5c, 0x7a, 0x00, 0x00, 0x05, 0x00, 0x64, 0x14, 0xfd, 0xff, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->icmpv6h); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** \test icmpv6 message type: time exceed, invalid packet * \brief set the event ICMPV6_PKT_TOO_SMALL properly * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6TimeExceedTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x03, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x10, 0x5c }; /* The icmpv6 header is broken in the checksum (so we dont have a complete header) */ Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_PKT_TOO_SMALL)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 message type: destination unreach, invalid packet * \brief The embedded packet header (ipv6) is truncated * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6DestUnreachTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00, 0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_IPV6_TRUNC_PKT)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 message type: echo request, invalid packet * \brief unknown code * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6EchoReqTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x01, 0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 message type: echo reply, invalid packet * \brief unknown code * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6EchoRepTest02(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x81, 0x01, 0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /**\test icmpv6 packet decoding and setting up of payload_len and payload buufer * \retval retval 0 = Error ; 1 = ok */ static int ICMPV6PayloadTest01(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00, 0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF_NULL(p->payload); FAIL_IF(p->payload_len != 37); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RouterSolicitTestKnownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x85, 0x00, 0xbe, 0xb0, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RouterSolicitTestUnknownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x85, 0x01, 0xbe, 0xaf, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RouterAdvertTestKnownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x86, 0x00, 0xbd, 0xb0, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RouterAdvertTestUnknownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x86, 0x01, 0xbd, 0xaf, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6NeighbourSolicitTestKnownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x87, 0x00, 0xbc, 0xb0, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6NeighbourSolicitTestUnknownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x87, 0x01, 0xbc, 0xaf, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6NeighbourAdvertTestKnownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x88, 0x00, 0xbb, 0xb0, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6NeighbourAdvertTestUnknownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x88, 0x01, 0xbb, 0xaf, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RedirectTestKnownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x89, 0x00, 0xba, 0xb0, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } static int ICMPV6RedirectTestUnknownCode(void) { static uint8_t raw_ipv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x24, 0x8c, 0xff, 0xfe, 0x0e, 0x31, 0x54, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x89, 0x01, 0xba, 0xaf, 0x00, 0x00, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL); FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } /** * \test Test for valid ICMPv6 checksum when the FCS is still attached. * * Tests that the packet is decoded with sufficient info to verify the * checksum even if the packet has some trailing data like an ethernet * FCS. */ static int ICMPV6CalculateValidChecksumWithFCS(void) { /* IPV6/ICMPv6 packet with ethernet header. * - IPv6 payload length: 36 */ uint8_t raw_ipv6[] = { 0x33, 0x33, 0x00, 0x00, 0x00, 0x16, 0x00, 0x50, 0x56, 0xa6, 0x6a, 0x7d, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x24, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf5, 0x09, 0xad, 0x44, 0x49, 0x38, 0x5f, 0xa9, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x3a, 0x00, 0x05, 0x02, 0x00, 0x00, 0x01, 0x00, 0x8f, 0x00, 0x24, 0xe0, 0x00, 0x00, 0x00, 0x01, 0x03, 0x00, /* Checksum: 0x24e0. */ 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfb, 0x1f, 0x34, 0xf6, 0xa4 }; uint16_t csum = *(((uint16_t *)(raw_ipv6 + 64))); Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); FlowInitConfig(FLOW_QUIET); DecodeIPV6(&tv, &dtv, p, raw_ipv6 + 14, sizeof(raw_ipv6) - 14, NULL); FAIL_IF_NULL(p->icmpv6h); uint16_t icmpv6_len = IPV6_GET_RAW_PLEN(p->ip6h) - ((uint8_t *)p->icmpv6h - (uint8_t *)p->ip6h - IPV6_HEADER_LEN); FAIL_IF(icmpv6_len != 28); FAIL_IF(ICMPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->icmpv6h, icmpv6_len) != csum); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); PASS; } #endif /* UNITTESTS */ /** * \brief Registers ICMPV6 unit tests * \todo More ICMPv6 tests */ void DecodeICMPV6RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ICMPV6CalculateValidChecksumtest01", ICMPV6CalculateValidChecksumtest01); UtRegisterTest("ICMPV6CalculateInValidChecksumtest02", ICMPV6CalculateInvalidChecksumtest02); UtRegisterTest("ICMPV6ParamProbTest01 (Valid)", ICMPV6ParamProbTest01); UtRegisterTest("ICMPV6DestUnreachTest01 (Valid)", ICMPV6DestUnreachTest01); UtRegisterTest("ICMPV6PktTooBigTest01 (Valid)", ICMPV6PktTooBigTest01); UtRegisterTest("ICMPV6TimeExceedTest01 (Valid)", ICMPV6TimeExceedTest01); UtRegisterTest("ICMPV6EchoReqTest01 (Valid)", ICMPV6EchoReqTest01); UtRegisterTest("ICMPV6EchoRepTest01 (Valid)", ICMPV6EchoRepTest01); UtRegisterTest("ICMPV6ParamProbTest02 (Invalid)", ICMPV6ParamProbTest02); UtRegisterTest("ICMPV6DestUnreachTest02 (Invalid)", ICMPV6DestUnreachTest02); UtRegisterTest("ICMPV6PktTooBigTest02 (Invalid)", ICMPV6PktTooBigTest02); UtRegisterTest("ICMPV6TimeExceedTest02 (Invalid)", ICMPV6TimeExceedTest02); UtRegisterTest("ICMPV6EchoReqTest02 (Invalid)", ICMPV6EchoReqTest02); UtRegisterTest("ICMPV6EchoRepTest02 (Invalid)", ICMPV6EchoRepTest02); UtRegisterTest("ICMPV6PayloadTest01", ICMPV6PayloadTest01); UtRegisterTest("ICMPV6RouterSolicitTestKnownCode", ICMPV6RouterSolicitTestKnownCode); UtRegisterTest("ICMPV6RouterSolicitTestUnknownCode", ICMPV6RouterSolicitTestUnknownCode); UtRegisterTest("ICMPV6RouterAdvertTestKnownCode", ICMPV6RouterAdvertTestKnownCode); UtRegisterTest("ICMPV6RouterAdvertTestUnknownCode", ICMPV6RouterAdvertTestUnknownCode); UtRegisterTest("ICMPV6NeighbourSolicitTestKnownCode", ICMPV6NeighbourSolicitTestKnownCode); UtRegisterTest("ICMPV6NeighbourSolicitTestUnknownCode", ICMPV6NeighbourSolicitTestUnknownCode); UtRegisterTest("ICMPV6NeighbourAdvertTestKnownCode", ICMPV6NeighbourAdvertTestKnownCode); UtRegisterTest("ICMPV6NeighbourAdvertTestUnknownCode", ICMPV6NeighbourAdvertTestUnknownCode); UtRegisterTest("ICMPV6RedirectTestKnownCode", ICMPV6RedirectTestKnownCode); UtRegisterTest("ICMPV6RedirectTestUnknownCode", ICMPV6RedirectTestUnknownCode); UtRegisterTest("ICMPV6CalculateValidChecksumWithFCS", ICMPV6CalculateValidChecksumWithFCS); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-host-info.c0000644000000000000000000000550213051004444014030 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Get information on running host * */ #include "suricata-common.h" #include "config.h" #ifndef OS_WIN32 #include #define VERSION_REGEX "^([0-9]+)\\.([0-9]+)" int SCKernelVersionIsAtLeast(int major, int minor) { struct utsname kuname; pcre *version_regex; pcre_extra *version_regex_study; const char *eb; int opts = 0; int eo; #define MAX_SUBSTRINGS 3 * 6 int ov[MAX_SUBSTRINGS]; int ret; int kmajor, kminor; const char **list; /* get local version */ if (uname(&kuname) != 0) { SCLogError(SC_ERR_INVALID_VALUE, "Invalid uname return: %s", strerror(errno)); return 0; } SCLogDebug("Kernel release is '%s'", kuname.release); version_regex = pcre_compile(VERSION_REGEX, opts, &eb, &eo, NULL); if (version_regex == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", VERSION_REGEX, eo, eb); goto error; } version_regex_study = pcre_study(version_regex, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); goto error; } ret = pcre_exec(version_regex, version_regex_study, kuname.release, strlen(kuname.release), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 0) { SCLogError(SC_ERR_PCRE_MATCH, "Version did not cut"); goto error; } if (ret < 3) { SCLogError(SC_ERR_PCRE_MATCH, "Version major and minor not found (ret %d)", ret); goto error; } pcre_get_substring_list(kuname.release, ov, ret, &list); kmajor = atoi(list[1]); kminor = atoi(list[2]); pcre_free_substring_list(list); pcre_free_study(version_regex_study); pcre_free(version_regex); if (kmajor > major) return 1; if (kmajor == major && kminor >= minor) return 1; error: return 0; } #else /* OS_WIN32 */ int SCKernelVersionIsAtLeast(int major, int minor) { SCLogError(SC_ERR_NOT_SUPPORTED, "OS compare is not supported on Windows"); return 0; } #endif /* OS_WIN32 */ suricata-3.2.1/src/detect-l3proto.c0000644000000000000000000002450313051004444014021 00000000000000/* Copyright (C) 2012-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * * Implements the l3_proto keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-ipproto.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" static int DetectL3ProtoSetup(DetectEngineCtx *, Signature *, char *); void DetectL3protoRegisterTests(void); void DetectL3ProtoRegister(void) { sigmatch_table[DETECT_L3PROTO].name = "l3_proto"; sigmatch_table[DETECT_L3PROTO].Match = NULL; sigmatch_table[DETECT_L3PROTO].Setup = DetectL3ProtoSetup; sigmatch_table[DETECT_L3PROTO].Free = NULL; sigmatch_table[DETECT_L3PROTO].RegisterTests = DetectL3protoRegisterTests; return; } /** * \internal * \brief Setup l3_proto keyword. * * \param de_ctx Detection engine context * \param s Signature * \param optstr Options string * * \return Non-zero on error */ static int DetectL3ProtoSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { char *str = optstr; char dubbed = 0; /* Strip leading and trailing "s. */ if (optstr[0] == '\"') { str = SCStrdup(optstr + 1); if (unlikely(str == NULL)) goto error; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } dubbed = 1; } /* reset possible any value */ if (s->proto.flags & DETECT_PROTO_ANY) { s->proto.flags &= ~DETECT_PROTO_ANY; } /* authorized value, ip, any, ip4, ipv4, ip6, ipv6 */ if (strcasecmp(str,"ipv4") == 0 || strcasecmp(str,"ip4") == 0 ) { if (s->proto.flags & DETECT_PROTO_IPV6) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Conflicting l3 proto specified"); goto error; } s->proto.flags |= DETECT_PROTO_IPV4; SCLogDebug("IPv4 protocol detected"); } else if (strcasecmp(str,"ipv6") == 0 || strcasecmp(str,"ip6") == 0 ) { if (s->proto.flags & DETECT_PROTO_IPV6) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Conflicting l3 proto specified"); goto error; } s->proto.flags |= DETECT_PROTO_IPV6; SCLogDebug("IPv6 protocol detected"); } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid l3 proto: \"%s\"", str); goto error; } if (dubbed) SCFree(str); return 0; error: if (dubbed) SCFree(str); return -1; } #ifdef UNITTESTS /** * \test DetectL3protoTestSig01 is a test for checking the working of ttl keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. */ static int DetectL3protoTestSig1(void) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; IPV4Hdr ip4h; memset(&th_v, 0, sizeof(th_v)); p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->ip4h = &ip4h; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv4\"; l3_proto:ipv4; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv6\"; l3_proto:ipv6; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ip4\"; l3_proto:ip4; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ip6\"; l3_proto:ip6; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 3) == 0) { printf("sid 3 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 4)) { printf("sid 4 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } /** * \test DetectL3protoTestSig02 is a test for checking the working of l3proto keyword * by setting up the signature and later testing its working by matching * the received IPv6 packet against the sig. */ static int DetectL3protoTestSig2(void) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; IPV6Hdr ip6h; memset(&th_v, 0, sizeof(th_v)); p->src.family = AF_INET6; p->dst.family = AF_INET6; p->proto = IPPROTO_TCP; p->ip6h = &ip6h; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv4\"; l3_proto:ipv4; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv6\"; l3_proto:ipv6; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ip4\"; l3_proto:ip4; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ip6\"; l3_proto:ip6; sid:4;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { printf("sid 2 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 3)) { printf("sid 3 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { printf("sid 4 did not alert, but should have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } /** * \test DetectL3protoTestSig03 is a test for checking the working of l3proto keyword * in conjonction with ip_proto keyword. */ static int DetectL3protoTestSig3(void) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; IPV6Hdr ip6h; memset(&th_v, 0, sizeof(th_v)); p->src.family = AF_INET6; p->dst.family = AF_INET6; p->proto = IPPROTO_TCP; p->ip6h = &ip6h; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv4 and ip_proto udp\"; l3_proto:ipv4; ip_proto:17; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv6 and ip_proto udp\"; l3_proto:ipv6; ip_proto:17; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ip4 and ip_proto tcp\"; l3_proto:ipv4; ip_proto:6; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"l3proto ipv6 and ip_proto tcp\"; l3_proto:ipv6; ip_proto:6; sid:4;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 3)) { printf("sid 3 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { printf("sid 4 did not alert, but should have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectL3proto */ void DetectL3protoRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectL3protoTestSig1", DetectL3protoTestSig1); UtRegisterTest("DetectL3protoTestSig2", DetectL3protoTestSig2); UtRegisterTest("DetectL3protoTestSig3", DetectL3protoTestSig3); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-http.h0000644000000000000000000000215713051004444014443 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_HTTP_H__ #define __OUTPUT_JSON_HTTP_H__ void JsonHttpLogRegister(void); #ifdef HAVE_LIBJANSSON void JsonHttpLogJSONBasic(json_t *js, htp_tx_t *tx); void JsonHttpLogJSONExtended(json_t *js, htp_tx_t *tx); json_t *JsonHttpAddMetadata(const Flow *f, uint64_t tx_id); #endif /* HAVE_LIBJANSSON */ #endif /* __OUTPUT_JSON_HTTP_H__ */ suricata-3.2.1/src/detect-http-header.h0000644000000000000000000000172013051004444014625 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_HTTP_HEADER_H__ #define __DETECT_HTTP_HEADER_H__ void DetectHttpHeaderRegister(void); void DetectHttpRawHeaderRegister(void); #endif /* __DETECT_HTTP_HEADER_H__ */ suricata-3.2.1/src/stream-tcp-util.c0000644000000000000000000001436113051004444014204 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Helper functions for the stream engine. */ #include "suricata-common.h" #include "stream-tcp-reassemble.h" #include "stream-tcp-inline.h" #include "stream-tcp.h" #include "stream-tcp-util.h" #include "util-memcmp.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #ifdef UNITTESTS /* unittest helper functions */ extern int stream_inline; void StreamTcpUTInit(TcpReassemblyThreadCtx **ra_ctx) { StreamTcpInitConfig(TRUE); *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); } void StreamTcpUTDeinit(TcpReassemblyThreadCtx *ra_ctx) { StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); stream_inline = 0; } void StreamTcpUTInitInline(void) { stream_inline = 1; } void StreamTcpUTSetupSession(TcpSession *ssn) { memset(ssn, 0x00, sizeof(TcpSession)); } void StreamTcpUTClearSession(TcpSession *ssn) { StreamTcpUTClearStream(&ssn->client); StreamTcpUTClearStream(&ssn->server); StreamTcpSessionCleanup(ssn); } void StreamTcpUTSetupStream(TcpStream *s, uint32_t isn) { memset(s, 0x00, sizeof(TcpStream)); s->isn = isn; STREAMTCP_SET_RA_BASE_SEQ(s, isn); } void StreamTcpUTClearStream(TcpStream *s) { StreamTcpStreamCleanup(s); } int StreamTcpUTAddSegmentWithPayload(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, uint32_t seq, uint8_t *payload, uint16_t len) { TcpSegment *s = StreamTcpGetSegment(tv, ra_ctx, len); if (s == NULL) { return -1; } s->seq = seq; s->payload_len = len; memcpy(s->payload, payload, len); Packet *p = UTHBuildPacketReal(s->payload, s->payload_len, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { return -1; } p->tcph->th_seq = htonl(seq); if (StreamTcpReassembleInsertSegment(tv, ra_ctx, stream, s, p) < 0) return -1; UTHFreePacket(p); return 0; } int StreamTcpUTAddSegmentWithByte(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, uint32_t seq, uint8_t byte, uint16_t len) { TcpSegment *s = StreamTcpGetSegment(tv, ra_ctx, len); if (s == NULL) { return -1; } s->seq = seq; s->payload_len = len; memset(s->payload, byte, len); Packet *p = UTHBuildPacketReal(s->payload, s->payload_len, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { return -1; } p->tcph->th_seq = htonl(seq); if (StreamTcpReassembleInsertSegment(tv, ra_ctx, stream, s, p) < 0) return -1; UTHFreePacket(p); return 0; } /* tests */ int StreamTcpUtilTest01(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; StreamTcpUTInit(&ra_ctx); if (ra_ctx == NULL) { printf("ra_ctx is NULL: "); goto end; } ret = 1; end: StreamTcpUTDeinit(ra_ctx); return ret; } int StreamTcpUtilStreamTest01(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpStream stream; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTSetupStream(&stream, 1); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } TcpSegment *seg = stream.seg_list; if (seg->seq != 2) { printf("first seg in the list should have seq 2: "); goto end; } seg = seg->next; if (seg->seq != 7) { printf("first seg in the list should have seq 7: "); goto end; } seg = seg->next; if (seg->seq != 12) { printf("first seg in the list should have seq 12: "); goto end; } ret = 1; end: StreamTcpUTClearStream(&stream); StreamTcpUTDeinit(ra_ctx); return ret; } int StreamTcpUtilStreamTest02(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpStream stream; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTSetupStream(&stream, 1); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &stream, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } TcpSegment *seg = stream.seg_list; if (seg->seq != 2) { printf("first seg in the list should have seq 2: "); goto end; } seg = seg->next; if (seg->seq != 7) { printf("first seg in the list should have seq 7: "); goto end; } seg = seg->next; if (seg->seq != 12) { printf("first seg in the list should have seq 12: "); goto end; } ret = 1; end: StreamTcpUTClearStream(&stream); StreamTcpUTDeinit(ra_ctx); return ret; } #endif void StreamTcpUtilRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("StreamTcpUtilTest01", StreamTcpUtilTest01); UtRegisterTest("StreamTcpUtilStreamTest01", StreamTcpUtilStreamTest01); UtRegisterTest("StreamTcpUtilStreamTest02", StreamTcpUtilStreamTest02); #endif /* UNITTESTS */ } suricata-3.2.1/src/log-dnslog.c0000644000000000000000000002741013051004444013216 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements dns logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-dnslog.h" #include "app-layer-dns-common.h" #include "app-layer-dns-udp.h" #include "app-layer.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "dns.log" #define MODULE_NAME "LogDnsLog" #define OUTPUT_BUFFER_SIZE 65535 /* we can do query logging as well, but it's disabled for now as the * TX id handling doesn't expect it */ #define QUERY 0 typedef struct LogDnsFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } LogDnsFileCtx; typedef struct LogDnsLogThread_ { LogDnsFileCtx *dnslog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t dns_cnt; MemBuffer *buffer; } LogDnsLogThread; static void LogQuery(LogDnsLogThread *aft, char *timebuf, char *srcip, char *dstip, Port sp, Port dp, DNSTransaction *tx, DNSQueryEntry *entry) { LogDnsFileCtx *hlog = aft->dnslog_ctx; SCLogDebug("got a DNS request and now logging !!"); /* reset */ MemBufferReset(aft->buffer); /* time & tx */ MemBufferWriteString(aft->buffer, "%s [**] Query TX %04x [**] ", timebuf, tx->tx_id); /* query */ PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)((uint8_t *)entry + sizeof(DNSQueryEntry)), entry->len); char record[16] = ""; DNSCreateTypeString(entry->type, record, sizeof(record)); MemBufferWriteString(aft->buffer, " [**] %s [**] %s:%" PRIu16 " -> %s:%" PRIu16 "\n", record, srcip, sp, dstip, dp); SCMutexLock(&hlog->file_ctx->fp_mutex); hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx); SCMutexUnlock(&hlog->file_ctx->fp_mutex); } static void LogAnswer(LogDnsLogThread *aft, char *timebuf, char *srcip, char *dstip, Port sp, Port dp, DNSTransaction *tx, DNSAnswerEntry *entry) { LogDnsFileCtx *hlog = aft->dnslog_ctx; SCLogDebug("got a DNS response and now logging !!"); /* reset */ MemBufferReset(aft->buffer); /* time & tx*/ MemBufferWriteString(aft->buffer, "%s [**] Response TX %04x [**] ", timebuf, tx->tx_id); if (entry == NULL) { if (tx->rcode) { char rcode[16] = ""; DNSCreateRcodeString(tx->rcode, rcode, sizeof(rcode)); MemBufferWriteString(aft->buffer, "%s", rcode); } else if (tx->recursion_desired) { MemBufferWriteString(aft->buffer, "Recursion Desired"); } } else { /* query */ if (entry->fqdn_len > 0) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)((uint8_t *)entry + sizeof(DNSAnswerEntry)), entry->fqdn_len); } else { MemBufferWriteString(aft->buffer, ""); } char record[16] = ""; DNSCreateTypeString(entry->type, record, sizeof(record)); MemBufferWriteString(aft->buffer, " [**] %s [**] TTL %u [**] ", record, entry->ttl); uint8_t *ptr = (uint8_t *)((uint8_t *)entry + sizeof(DNSAnswerEntry) + entry->fqdn_len); if (entry->type == DNS_RECORD_TYPE_A && entry->data_len == 4) { char a[16] = ""; PrintInet(AF_INET, (const void *)ptr, a, sizeof(a)); MemBufferWriteString(aft->buffer, "%s", a); } else if (entry->type == DNS_RECORD_TYPE_AAAA && entry->data_len == 16) { char a[46]; PrintInet(AF_INET6, (const void *)ptr, a, sizeof(a)); MemBufferWriteString(aft->buffer, "%s", a); } else if (entry->data_len == 0) { MemBufferWriteString(aft->buffer, ""); } else { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, ptr, entry->data_len); } } /* ip/tcp header info */ MemBufferWriteString(aft->buffer, " [**] %s:%" PRIu16 " -> %s:%" PRIu16 "\n", srcip, sp, dstip, dp); SCMutexLock(&hlog->file_ctx->fp_mutex); hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx); SCMutexUnlock(&hlog->file_ctx->fp_mutex); } static int LogDnsLogger(ThreadVars *tv, void *data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id, uint8_t direction) { LogDnsLogThread *aft = (LogDnsLogThread *)data; DNSTransaction *dns_tx = (DNSTransaction *)tx; SCLogDebug("pcap_cnt %"PRIu64, p->pcap_cnt); char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); int ipproto = 0; if (PKT_IS_IPV4(p)) ipproto = AF_INET; else if (PKT_IS_IPV6(p)) ipproto = AF_INET6; char srcip[46], dstip[46]; Port sp, dp; if ((PKT_IS_TOCLIENT(p))) { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); break; default: goto end; } sp = p->sp; dp = p->dp; } else { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), dstip, sizeof(dstip)); break; default: goto end; } sp = p->dp; dp = p->sp; } if (direction == STREAM_TOSERVER) { DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &dns_tx->query_list, next) { LogQuery(aft, timebuf, dstip, srcip, dp, sp, dns_tx, query); } } else if (direction == STREAM_TOCLIENT) { if (dns_tx->rcode) LogAnswer(aft, timebuf, srcip, dstip, sp, dp, dns_tx, NULL); if (dns_tx->recursion_desired) LogAnswer(aft, timebuf, srcip, dstip, sp, dp, dns_tx, NULL); DNSAnswerEntry *entry = NULL; TAILQ_FOREACH(entry, &dns_tx->answer_list, next) { LogAnswer(aft, timebuf, srcip, dstip, sp, dp, dns_tx, entry); } entry = NULL; TAILQ_FOREACH(entry, &dns_tx->authority_list, next) { LogAnswer(aft, timebuf, srcip, dstip, sp, dp, dns_tx, entry); } } aft->dns_cnt++; end: return 0; } static int LogDnsRequestLogger(ThreadVars *tv, void *data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { return LogDnsLogger(tv, data, p, f, state, tx, tx_id, STREAM_TOSERVER); } static int LogDnsResponseLogger(ThreadVars *tv, void *data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { return LogDnsLogger(tv, data, p, f, state, tx, tx_id, STREAM_TOCLIENT); } static TmEcode LogDnsLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogDnsLogThread *aft = SCMalloc(sizeof(LogDnsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogDnsLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for LogDNSLog. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->dnslog_ctx= ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } static TmEcode LogDnsLogThreadDeinit(ThreadVars *t, void *data) { LogDnsLogThread *aft = (LogDnsLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogDnsLogThread)); SCFree(aft); return TM_ECODE_OK; } static void LogDnsLogExitPrintStats(ThreadVars *tv, void *data) { LogDnsLogThread *aft = (LogDnsLogThread *)data; if (aft == NULL) { return; } SCLogInfo("DNS logger logged %" PRIu32 " transactions", aft->dns_cnt); } static void LogDnsLogDeInitCtx(OutputCtx *output_ctx) { LogDnsFileCtx *dnslog_ctx = (LogDnsFileCtx *)output_ctx->data; LogFileFreeCtx(dnslog_ctx->file_ctx); SCFree(dnslog_ctx); SCFree(output_ctx); } /** \brief Create a new dns log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ static OutputCtx *LogDnsLogInitCtx(ConfNode *conf) { LogFileCtx* file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_DNS_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogDnsFileCtx *dnslog_ctx = SCMalloc(sizeof(LogDnsFileCtx)); if (unlikely(dnslog_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx)); dnslog_ctx->file_ctx = file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(dnslog_ctx); return NULL; } output_ctx->data = dnslog_ctx; output_ctx->DeInit = LogDnsLogDeInitCtx; SCLogDebug("DNS log output initialized"); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DNS); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_DNS); return output_ctx; } void LogDnsLogRegister (void) { /* Request logger. */ OutputRegisterTxModuleWithProgress(LOGGER_DNS, MODULE_NAME, "dns-log", LogDnsLogInitCtx, ALPROTO_DNS, LogDnsRequestLogger, 0, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, LogDnsLogExitPrintStats); /* Response logger. */ OutputRegisterTxModuleWithProgress(LOGGER_DNS, MODULE_NAME, "dns-log", LogDnsLogInitCtx, ALPROTO_DNS, LogDnsResponseLogger, 1, 1, LogDnsLogThreadInit, LogDnsLogThreadDeinit, LogDnsLogExitPrintStats); /* enable the logger for the app layer */ SCLogDebug("registered %s", MODULE_NAME); } suricata-3.2.1/src/conf-yaml-loader.c0000644000000000000000000006516413051004444014312 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited - Jason Ish * * YAML configuration loader. */ #include #include "suricata-common.h" #include "conf.h" #include "util-path.h" #include "util-debug.h" #include "util-unittest.h" #define YAML_VERSION_MAJOR 1 #define YAML_VERSION_MINOR 1 /* Sometimes we'll have to create a node name on the fly (integer * conversion, etc), so this is a default length to allocate that will * work most of the time. */ #define DEFAULT_NAME_LEN 16 #define MANGLE_ERRORS_MAX 10 static int mangle_errors = 0; static char *conf_dirname = NULL; static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq); /* Configuration processing states. */ enum conf_state { CONF_KEY = 0, CONF_VAL, CONF_INCLUDE, }; /** * \brief Mangle unsupported characters. * * \param string A pointer to an null terminated string. * * \retval none */ static void Mangle(char *string) { char *c; while ((c = strchr(string, '_'))) *c = '-'; return; } /** * \brief Set the directory name of the configuration file. * * \param filename The configuration filename. */ static void ConfYamlSetConfDirname(const char *filename) { char *ep; ep = strrchr(filename, '\\'); if (ep == NULL) ep = strrchr(filename, '/'); if (ep == NULL) { conf_dirname = SCStrdup("."); if (conf_dirname == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "ERROR: Failed to allocate memory while loading configuration."); exit(EXIT_FAILURE); } } else { conf_dirname = SCStrdup(filename); if (conf_dirname == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "ERROR: Failed to allocate memory while loading configuration."); exit(EXIT_FAILURE); } conf_dirname[ep - filename] = '\0'; } } /** * \brief Include a file in the configuration. * * \param parent The configuration node the included configuration will be * placed at. * \param filename The filename to include. * * \retval 0 on success, -1 on failure. */ static int ConfYamlHandleInclude(ConfNode *parent, const char *filename) { yaml_parser_t parser; char include_filename[PATH_MAX]; FILE *file; if (yaml_parser_initialize(&parser) != 1) { SCLogError(SC_ERR_CONF_YAML_ERROR, "Failed to initialize YAML parser"); return -1; } if (PathIsAbsolute(filename)) { strlcpy(include_filename, filename, sizeof(include_filename)); } else { snprintf(include_filename, sizeof(include_filename), "%s/%s", conf_dirname, filename); } file = fopen(include_filename, "r"); if (file == NULL) { SCLogError(SC_ERR_FOPEN, "Failed to open configuration include file %s: %s", include_filename, strerror(errno)); return -1; } yaml_parser_set_input_file(&parser, file); if (ConfYamlParse(&parser, parent, 0) != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "Failed to include configuration file %s", filename); return -1; } yaml_parser_delete(&parser); fclose(file); return 0; } /** * \brief Parse a YAML layer. * * \param parser A pointer to an active yaml_parser_t. * \param parent The parent configuration node. * * \retval 0 on success, -1 on failure. */ static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq) { ConfNode *node = parent; yaml_event_t event; memset(&event, 0, sizeof(event)); int done = 0; int state = 0; int seq_idx = 0; while (!done) { if (!yaml_parser_parse(parser, &event)) { SCLogError(SC_ERR_CONF_YAML_ERROR, "Failed to parse configuration file at line %" PRIuMAX ": %s\n", (uintmax_t)parser->problem_mark.line, parser->problem); return -1; } if (event.type == YAML_DOCUMENT_START_EVENT) { SCLogDebug("event.type=YAML_DOCUMENT_START_EVENT; state=%d", state); /* Verify YAML version - its more likely to be a valid * Suricata configuration file if the version is * correct. */ yaml_version_directive_t *ver = event.data.document_start.version_directive; if (ver == NULL) { fprintf(stderr, "ERROR: Invalid configuration file.\n\n"); fprintf(stderr, "The configuration file must begin with the following two lines:\n\n"); fprintf(stderr, "%%YAML 1.1\n---\n\n"); goto fail; } int major = ver->major; int minor = ver->minor; if (!(major == YAML_VERSION_MAJOR && minor == YAML_VERSION_MINOR)) { fprintf(stderr, "ERROR: Invalid YAML version. Must be 1.1\n"); goto fail; } } else if (event.type == YAML_SCALAR_EVENT) { char *value = (char *)event.data.scalar.value; char *tag = (char *)event.data.scalar.tag; SCLogDebug("event.type=YAML_SCALAR_EVENT; state=%d; value=%s; " "tag=%s; inseq=%d", state, value, tag, inseq); if (inseq) { char sequence_node_name[DEFAULT_NAME_LEN]; snprintf(sequence_node_name, DEFAULT_NAME_LEN, "%d", seq_idx++); ConfNode *seq_node = ConfNodeLookupChild(parent, sequence_node_name); if (seq_node != NULL) { /* The sequence node has already been set, probably * from the command line. Remove it so it gets * re-added in the expected order for iteration. */ TAILQ_REMOVE(&parent->head, seq_node, next); } else { seq_node = ConfNodeNew(); if (unlikely(seq_node == NULL)) { return -1; } seq_node->name = SCStrdup(sequence_node_name); if (unlikely(seq_node->name == NULL)) { SCFree(seq_node); return -1; } seq_node->val = SCStrdup(value); if (unlikely(seq_node->val == NULL)) { SCFree(seq_node->name); return -1; } } TAILQ_INSERT_TAIL(&parent->head, seq_node, next); } else { if (state == CONF_INCLUDE) { SCLogInfo("Including configuration file %s.", value); if (ConfYamlHandleInclude(parent, value) != 0) { goto fail; } state = CONF_KEY; } else if (state == CONF_KEY) { if (strcmp(value, "include") == 0) { state = CONF_INCLUDE; goto next; } if (parent->is_seq) { if (parent->val == NULL) { parent->val = SCStrdup(value); if (parent->val && strchr(parent->val, '_')) Mangle(parent->val); } } ConfNode *existing = ConfNodeLookupChild(parent, value); if (existing != NULL) { if (!existing->final) { SCLogInfo("Configuration node '%s' redefined.", existing->name); ConfNodePrune(existing); } node = existing; } else { node = ConfNodeNew(); node->name = SCStrdup(value); if (node->name && strchr(node->name, '_')) { if (!(parent->name && ((strcmp(parent->name, "address-groups") == 0) || (strcmp(parent->name, "port-groups") == 0)))) { Mangle(node->name); if (mangle_errors < MANGLE_ERRORS_MAX) { SCLogWarning(SC_WARN_DEPRECATED, "%s is deprecated. Please use %s on line %"PRIuMAX".", value, node->name, (uintmax_t)parser->mark.line+1); mangle_errors++; if (mangle_errors >= MANGLE_ERRORS_MAX) SCLogWarning(SC_WARN_DEPRECATED, "not showing more " "parameter name warnings."); } } } TAILQ_INSERT_TAIL(&parent->head, node, next); } state = CONF_VAL; } else { if ((tag != NULL) && (strcmp(tag, "!include") == 0)) { SCLogInfo("Including configuration file %s at " "parent node %s.", value, node->name); if (ConfYamlHandleInclude(node, value) != 0) goto fail; } else if (!node->final) { if (node->val != NULL) SCFree(node->val); node->val = SCStrdup(value); } state = CONF_KEY; } } } else if (event.type == YAML_SEQUENCE_START_EVENT) { SCLogDebug("event.type=YAML_SEQUENCE_START_EVENT; state=%d", state); if (ConfYamlParse(parser, node, 1) != 0) goto fail; node->is_seq = 1; state = CONF_KEY; } else if (event.type == YAML_SEQUENCE_END_EVENT) { SCLogDebug("event.type=YAML_SEQUENCE_END_EVENT; state=%d", state); return 0; } else if (event.type == YAML_MAPPING_START_EVENT) { SCLogDebug("event.type=YAML_MAPPING_START_EVENT; state=%d", state); if (inseq) { char sequence_node_name[DEFAULT_NAME_LEN]; snprintf(sequence_node_name, DEFAULT_NAME_LEN, "%d", seq_idx++); ConfNode *seq_node = ConfNodeLookupChild(node, sequence_node_name); if (seq_node != NULL) { /* The sequence node has already been set, probably * from the command line. Remove it so it gets * re-added in the expected order for iteration. */ TAILQ_REMOVE(&node->head, seq_node, next); } else { seq_node = ConfNodeNew(); if (unlikely(seq_node == NULL)) { return -1; } seq_node->name = SCStrdup(sequence_node_name); if (unlikely(seq_node->name == NULL)) { SCFree(seq_node); return -1; } } seq_node->is_seq = 1; TAILQ_INSERT_TAIL(&node->head, seq_node, next); if (ConfYamlParse(parser, seq_node, 0) != 0) goto fail; } else { if (ConfYamlParse(parser, node, inseq) != 0) goto fail; } state = CONF_KEY; } else if (event.type == YAML_MAPPING_END_EVENT) { SCLogDebug("event.type=YAML_MAPPING_END_EVENT; state=%d", state); done = 1; } else if (event.type == YAML_STREAM_END_EVENT) { SCLogDebug("event.type=YAML_STREAM_END_EVENT; state=%d", state); done = 1; } next: yaml_event_delete(&event); continue; fail: yaml_event_delete(&event); return -1; } return 0; } /** * \brief Load configuration from a YAML file. * * This function will load a configuration file. On failure -1 will * be returned and it is suggested that the program then exit. Any * errors while loading the configuration file will have already been * logged. * * \param filename Filename of configuration file to load. * * \retval 0 on success, -1 on failure. */ int ConfYamlLoadFile(const char *filename) { FILE *infile; yaml_parser_t parser; int ret; ConfNode *root = ConfGetRootNode(); if (yaml_parser_initialize(&parser) != 1) { SCLogError(SC_ERR_FATAL, "failed to initialize yaml parser."); return -1; } struct stat stat_buf; if (stat(filename, &stat_buf) == 0) { if (stat_buf.st_mode & S_IFDIR) { SCLogError(SC_ERR_FATAL, "yaml argument is not a file but a directory: %s. " "Please specify the yaml file in your -c option.", filename); return -1; } } infile = fopen(filename, "r"); if (infile == NULL) { SCLogError(SC_ERR_FATAL, "failed to open file: %s: %s", filename, strerror(errno)); yaml_parser_delete(&parser); return -1; } if (conf_dirname == NULL) { ConfYamlSetConfDirname(filename); } yaml_parser_set_input_file(&parser, infile); ret = ConfYamlParse(&parser, root, 0); yaml_parser_delete(&parser); fclose(infile); return ret; } /** * \brief Load configuration from a YAML string. */ int ConfYamlLoadString(const char *string, size_t len) { ConfNode *root = ConfGetRootNode(); yaml_parser_t parser; int ret; if (yaml_parser_initialize(&parser) != 1) { fprintf(stderr, "Failed to initialize yaml parser.\n"); exit(EXIT_FAILURE); } yaml_parser_set_input_string(&parser, (const unsigned char *)string, len); ret = ConfYamlParse(&parser, root, 0); yaml_parser_delete(&parser); return ret; } /** * \brief Load configuration from a YAML file, insert in tree at 'prefix' * * This function will load a configuration file and insert it into the * config tree at 'prefix'. This means that if this is called with prefix * "abc" and the file contains a parameter "def", it will be loaded as * "abc.def". * * \param filename Filename of configuration file to load. * \param prefix Name prefix to use. * * \retval 0 on success, -1 on failure. */ int ConfYamlLoadFileWithPrefix(const char *filename, const char *prefix) { FILE *infile; yaml_parser_t parser; int ret; ConfNode *root = ConfGetNode(prefix); if (yaml_parser_initialize(&parser) != 1) { SCLogError(SC_ERR_FATAL, "failed to initialize yaml parser."); return -1; } struct stat stat_buf; /* coverity[toctou] */ if (stat(filename, &stat_buf) == 0) { if (stat_buf.st_mode & S_IFDIR) { SCLogError(SC_ERR_FATAL, "yaml argument is not a file but a directory: %s. " "Please specify the yaml file in your -c option.", filename); return -1; } } /* coverity[toctou] */ infile = fopen(filename, "r"); if (infile == NULL) { SCLogError(SC_ERR_FATAL, "failed to open file: %s: %s", filename, strerror(errno)); yaml_parser_delete(&parser); return -1; } if (conf_dirname == NULL) { ConfYamlSetConfDirname(filename); } if (root == NULL) { /* if node at 'prefix' doesn't yet exist, add a place holder */ ConfSet(prefix, ""); root = ConfGetNode(prefix); if (root == NULL) { fclose(infile); yaml_parser_delete(&parser); return -1; } } yaml_parser_set_input_file(&parser, infile); ret = ConfYamlParse(&parser, root, 0); yaml_parser_delete(&parser); fclose(infile); return ret; } #ifdef UNITTESTS static int ConfYamlSequenceTest(void) { char input[] = "\ %YAML 1.1\n\ ---\n\ rule-files:\n\ - netbios.rules\n\ - x11.rules\n\ \n\ default-log-dir: /tmp\n\ "; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(input, strlen(input)); ConfNode *node; node = ConfGetNode("rule-files"); if (node == NULL) return 0; if (!ConfNodeIsSequence(node)) return 0; if (TAILQ_EMPTY(&node->head)) return 0; int i = 0; ConfNode *filename; TAILQ_FOREACH(filename, &node->head, next) { if (i == 0) { if (strcmp(filename->val, "netbios.rules") != 0) return 0; if (ConfNodeIsSequence(filename)) return 0; if (filename->is_seq != 0) return 0; } else if (i == 1) { if (strcmp(filename->val, "x11.rules") != 0) return 0; if (ConfNodeIsSequence(filename)) return 0; } else { return 0; } i++; } ConfDeInit(); ConfRestoreContextBackup(); return 1; } static int ConfYamlLoggingOutputTest(void) { char input[] = "\ %YAML 1.1\n\ ---\n\ logging:\n\ output:\n\ - interface: console\n\ log-level: error\n\ - interface: syslog\n\ facility: local4\n\ log-level: info\n\ "; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(input, strlen(input)); ConfNode *outputs; outputs = ConfGetNode("logging.output"); if (outputs == NULL) return 0; ConfNode *output; ConfNode *output_param; output = TAILQ_FIRST(&outputs->head); if (output == NULL) return 0; if (strcmp(output->name, "0") != 0) return 0; output_param = TAILQ_FIRST(&output->head); if (output_param == NULL) return 0; if (strcmp(output_param->name, "interface") != 0) return 0; if (strcmp(output_param->val, "console") != 0) return 0; output_param = TAILQ_NEXT(output_param, next); if (strcmp(output_param->name, "log-level") != 0) return 0; if (strcmp(output_param->val, "error") != 0) return 0; output = TAILQ_NEXT(output, next); if (output == NULL) return 0; if (strcmp(output->name, "1") != 0) return 0; output_param = TAILQ_FIRST(&output->head); if (output_param == NULL) return 0; if (strcmp(output_param->name, "interface") != 0) return 0; if (strcmp(output_param->val, "syslog") != 0) return 0; output_param = TAILQ_NEXT(output_param, next); if (strcmp(output_param->name, "facility") != 0) return 0; if (strcmp(output_param->val, "local4") != 0) return 0; output_param = TAILQ_NEXT(output_param, next); if (strcmp(output_param->name, "log-level") != 0) return 0; if (strcmp(output_param->val, "info") != 0) return 0; ConfDeInit(); ConfRestoreContextBackup(); return 1; } /** * Try to load something that is not a valid YAML file. */ static int ConfYamlNonYamlFileTest(void) { ConfCreateContextBackup(); ConfInit(); if (ConfYamlLoadFile("/etc/passwd") != -1) return 0; ConfDeInit(); ConfRestoreContextBackup(); return 1; } static int ConfYamlBadYamlVersionTest(void) { char input[] = "\ %YAML 9.9\n\ ---\n\ logging:\n\ output:\n\ - interface: console\n\ log-level: error\n\ - interface: syslog\n\ facility: local4\n\ log-level: info\n\ "; ConfCreateContextBackup(); ConfInit(); if (ConfYamlLoadString(input, strlen(input)) != -1) return 0; ConfDeInit(); ConfRestoreContextBackup(); return 1; } static int ConfYamlSecondLevelSequenceTest(void) { char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ server-config:\n\ - apache-php:\n\ address: [\"192.168.1.0/24\"]\n\ personality: [\"Apache_2_2\", \"PHP_5_3\"]\n\ path-parsing: [\"compress_separators\", \"lowercase\"]\n\ - iis-php:\n\ address:\n\ - 192.168.0.0/24\n\ \n\ personality:\n\ - IIS_7_0\n\ - PHP_5_3\n\ \n\ path-parsing:\n\ - compress_separators\n\ "; ConfCreateContextBackup(); ConfInit(); if (ConfYamlLoadString(input, strlen(input)) != 0) return 0; ConfNode *outputs; outputs = ConfGetNode("libhtp.server-config"); if (outputs == NULL) return 0; ConfNode *node; node = TAILQ_FIRST(&outputs->head); if (node == NULL) return 0; if (strcmp(node->name, "0") != 0) return 0; node = TAILQ_FIRST(&node->head); if (node == NULL) return 0; if (strcmp(node->name, "apache-php") != 0) return 0; node = ConfNodeLookupChild(node, "address"); if (node == NULL) return 0; node = TAILQ_FIRST(&node->head); if (node == NULL) return 0; if (strcmp(node->name, "0") != 0) return 0; if (strcmp(node->val, "192.168.1.0/24") != 0) return 0; ConfDeInit(); ConfRestoreContextBackup(); return 1; } /** * Test file inclusion support. */ static int ConfYamlFileIncludeTest(void) { int ret = 0; FILE *config_file; const char config_filename[] = "ConfYamlFileIncludeTest-config.yaml"; const char config_file_contents[] = "%YAML 1.1\n" "---\n" "# Include something at the root level.\n" "include: ConfYamlFileIncludeTest-include.yaml\n" "# Test including under a mapping.\n" "mapping: !include ConfYamlFileIncludeTest-include.yaml\n"; const char include_filename[] = "ConfYamlFileIncludeTest-include.yaml"; const char include_file_contents[] = "%YAML 1.1\n" "---\n" "host-mode: auto\n" "unix-command:\n" " enabled: no\n"; ConfCreateContextBackup(); ConfInit(); /* Write out the test files. */ if ((config_file = fopen(config_filename, "w")) == NULL) { goto cleanup; } if (fwrite(config_file_contents, strlen(config_file_contents), 1, config_file) != 1) { goto cleanup; } fclose(config_file); if ((config_file = fopen(include_filename, "w")) == NULL) { goto cleanup; } if (fwrite(include_file_contents, strlen(include_file_contents), 1, config_file) != 1) { goto cleanup; } fclose(config_file); /* Reset conf_dirname. */ if (conf_dirname != NULL) { SCFree(conf_dirname); conf_dirname = NULL; } if (ConfYamlLoadFile("ConfYamlFileIncludeTest-config.yaml") != 0) goto cleanup; /* Check values that should have been loaded into the root of the * configuration. */ ConfNode *node; node = ConfGetNode("host-mode"); if (node == NULL) goto cleanup; if (strcmp(node->val, "auto") != 0) goto cleanup; node = ConfGetNode("unix-command.enabled"); if (node == NULL) goto cleanup; if (strcmp(node->val, "no") != 0) goto cleanup; /* Check for values that were included under a mapping. */ node = ConfGetNode("mapping.host-mode"); if (node == NULL) goto cleanup; if (strcmp(node->val, "auto") != 0) goto cleanup; node = ConfGetNode("mapping.unix-command.enabled"); if (node == NULL) goto cleanup; if (strcmp(node->val, "no") != 0) goto cleanup; ConfDeInit(); ConfRestoreContextBackup(); ret = 1; cleanup: unlink(config_filename); unlink(include_filename); return ret; } /** * Test that a configuration section is overridden but subsequent * occurrences. */ static int ConfYamlOverrideTest(void) { char config[] = "%YAML 1.1\n" "---\n" "some-log-dir: /var/log\n" "some-log-dir: /tmp\n" "\n" "parent:\n" " child0:\n" " key: value\n" "parent:\n" " child1:\n" " key: value\n" ; char *value; ConfCreateContextBackup(); ConfInit(); if (ConfYamlLoadString(config, strlen(config)) != 0) return 0; if (!ConfGet("some-log-dir", &value)) return 0; if (strcmp(value, "/tmp") != 0) return 0; /* Test that parent.child0 does not exist, but child1 does. */ if (ConfGetNode("parent.child0") != NULL) return 0; if (!ConfGet("parent.child1.key", &value)) return 0; if (strcmp(value, "value") != 0) return 0; ConfDeInit(); ConfRestoreContextBackup(); return 1; } /** * Test that a configuration parameter loaded from YAML doesn't * override a 'final' value that may be set on the command line. */ static int ConfYamlOverrideFinalTest(void) { ConfCreateContextBackup(); ConfInit(); char config[] = "%YAML 1.1\n" "---\n" "default-log-dir: /var/log\n"; /* Set the log directory as if it was set on the command line. */ if (!ConfSetFinal("default-log-dir", "/tmp")) return 0; if (ConfYamlLoadString(config, strlen(config)) != 0) return 0; char *default_log_dir; if (!ConfGet("default-log-dir", &default_log_dir)) return 0; if (strcmp(default_log_dir, "/tmp") != 0) { fprintf(stderr, "final value was reassigned\n"); return 0; } ConfDeInit(); ConfRestoreContextBackup(); return 1; } #endif /* UNITTESTS */ void ConfYamlRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ConfYamlSequenceTest", ConfYamlSequenceTest); UtRegisterTest("ConfYamlLoggingOutputTest", ConfYamlLoggingOutputTest); UtRegisterTest("ConfYamlNonYamlFileTest", ConfYamlNonYamlFileTest); UtRegisterTest("ConfYamlBadYamlVersionTest", ConfYamlBadYamlVersionTest); UtRegisterTest("ConfYamlSecondLevelSequenceTest", ConfYamlSecondLevelSequenceTest); UtRegisterTest("ConfYamlFileIncludeTest", ConfYamlFileIncludeTest); UtRegisterTest("ConfYamlOverrideTest", ConfYamlOverrideTest); UtRegisterTest("ConfYamlOverrideFinalTest", ConfYamlOverrideFinalTest); #endif /* UNITTESTS */ } suricata-3.2.1/src/log-droplog.c0000644000000000000000000003605713051004444013405 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * \author Victor Julien * * Drop log module to log the dropped packet information in a format * compatible to Linux' Netfilter. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "util-debug.h" #include "decode-ipv4.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "output.h" #include "log-droplog.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-classification-config.h" #include "util-privs.h" #include "util-print.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "drop.log" #define MODULE_NAME "LogDropLog" typedef struct LogDropLogThread_ { /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ LogFileCtx* file_ctx; uint64_t drop_cnt; } LogDropLogThread; /** * \brief Initialize the droplog thread * \param t Pointer the current thread variable * \param initdata pointer to the output context * \param data Pointer to the pointer to droplog thread to be initialized * * \return TM_ECODE_OK on success */ static TmEcode LogDropLogThreadInit(ThreadVars *t, void *initdata, void **data) { if(initdata == NULL) { SCLogDebug("Error getting context for LogDropLog. \"initdata\" argument NULL"); return TM_ECODE_FAILED; } LogDropLogThread *dlt = SCMalloc(sizeof(LogDropLogThread)); if (unlikely(dlt == NULL)) return TM_ECODE_FAILED; memset(dlt, 0, sizeof(LogDropLogThread)); /** Use the Ouptut Context (file pointer and mutex) */ dlt->file_ctx = ((OutputCtx *)initdata)->data; *data = (void *)dlt; return TM_ECODE_OK; } /** * \brief Deinitialize the droplog thread * \param t Pointer the current thread variable * \param data Pointer to the droplog thread to be cleared * * \return TM_ECODE_OK on success */ static TmEcode LogDropLogThreadDeinit(ThreadVars *t, void *data) { LogDropLogThread *dlt = (LogDropLogThread *)data; if (dlt == NULL) { return TM_ECODE_OK; } /* clear memory */ memset(dlt, 0, sizeof(LogDropLogThread)); SCFree(dlt); return TM_ECODE_OK; } /** * \brief Destroy the LogFileCtx and cleared "drop" output module * * \param output_ctx pointer the output context to be cleared */ static void LogDropLogDeInitCtx(OutputCtx *output_ctx) { OutputDropLoggerDisable(); if (output_ctx != NULL) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; if (logfile_ctx != NULL) { LogFileFreeCtx(logfile_ctx); } SCFree(output_ctx); } } /** * \brief Create a new LogFileCtx for "drop" output style. * \param conf The configuration node for this output. * \return A LogFileCtx pointer on success, NULL on failure. */ static OutputCtx *LogDropLogInitCtx(ConfNode *conf) { if (OutputDropLoggerEnable() != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "only one 'drop' logger " "can be enabled"); return NULL; } LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { SCLogDebug("LogDropLogInitCtx: Could not create new LogFileCtx"); return NULL; } if (SCConfLogOpenGeneric(conf, logfile_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(logfile_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(logfile_ctx); return NULL; } output_ctx->data = logfile_ctx; output_ctx->DeInit = LogDropLogDeInitCtx; return output_ctx; } /** * \brief Log the dropped packets in netfilter format when engine is running * in inline mode * * \param tv Pointer the current thread variables * \param p Pointer the packet which is being logged * \param data Pointer to the droplog struct * * \return return TM_EODE_OK on success */ static int LogDropLogNetFilter (ThreadVars *tv, const Packet *p, void *data) { LogDropLogThread *dlt = (LogDropLogThread *)data; uint16_t proto = 0; char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); SCMutexLock(&dlt->file_ctx->fp_mutex); if (dlt->file_ctx->rotation_flag) { dlt->file_ctx->rotation_flag = 0; if (SCConfLogReopen(dlt->file_ctx) != 0) { /* Rotation failed, error already logged. */ SCMutexUnlock(&dlt->file_ctx->fp_mutex); return TM_ECODE_FAILED; } } char srcip[46] = ""; char dstip[46] = ""; if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, 16); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, 16); fprintf(dlt->file_ctx->fp, "%s: IN= OUT= SRC=%s DST=%s LEN=%"PRIu16" " "TOS=0x%02"PRIu8" TTL=%"PRIu8" ID=%"PRIu16"", timebuf, srcip, dstip, IPV4_GET_IPLEN(p), IPV4_GET_IPTOS(p), IPV4_GET_IPTTL(p), IPV4_GET_IPID(p)); proto = IPV4_GET_IPPROTO(p); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); fprintf(dlt->file_ctx->fp, "%s: IN= OUT= SRC=%s DST=%s LEN=%"PRIu16"" " TC=%"PRIu32" HOPLIMIT=%"PRIu8" FLOWLBL=%"PRIu32"", timebuf, srcip, dstip, IPV6_GET_PLEN(p), IPV6_GET_CLASS(p), IPV6_GET_HLIM(p), IPV6_GET_FLOW(p)); proto = IPV6_GET_L4PROTO(p); } if (SCProtoNameValid(proto) == TRUE) { fprintf(dlt->file_ctx->fp, " PROTO=%s",known_proto[proto]); } else { fprintf(dlt->file_ctx->fp, " PROTO=%03"PRIu16"",proto); } switch (proto) { case IPPROTO_TCP: if (PKT_IS_TCP(p)) { fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16" " "SEQ=%"PRIu32" ACK=%"PRIu32" WINDOW=%"PRIu32"", GET_TCP_SRC_PORT(p), GET_TCP_DST_PORT(p), TCP_GET_SEQ(p), TCP_GET_ACK(p), TCP_GET_WINDOW(p)); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_SYN(p) ? " SYN" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_ACK(p) ? " ACK" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_PUSH(p) ? " PSH" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_RST(p) ? " RST" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_URG(p) ? " URG" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_FIN(p) ? " FIN" : ""); fprintf(dlt->file_ctx->fp, " RES=0x%02"PRIu8" URGP=%"PRIu16"", TCP_GET_RAW_X2(p->tcph), TCP_GET_URG_POINTER(p)); } break; case IPPROTO_UDP: if (PKT_IS_UDP(p)) { fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16"" " LEN=%"PRIu16"", UDP_GET_SRC_PORT(p), UDP_GET_DST_PORT(p), UDP_GET_LEN(p)); } break; case IPPROTO_ICMP: if (PKT_IS_ICMPV4(p)) { fprintf(dlt->file_ctx->fp, " TYPE=%"PRIu8" CODE=%"PRIu8"" " ID=%"PRIu16" SEQ=%"PRIu16"", ICMPV4_GET_TYPE(p), ICMPV4_GET_CODE(p), ICMPV4_GET_ID(p), ICMPV4_GET_SEQ(p)); } else if (PKT_IS_ICMPV6(p)) { fprintf(dlt->file_ctx->fp, " TYPE=%"PRIu8" CODE=%"PRIu8"" " ID=%"PRIu16" SEQ=%"PRIu16"", ICMPV6_GET_TYPE(p), ICMPV6_GET_CODE(p), ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p)); } break; default: fprintf(dlt->file_ctx->fp," Unknown protocol"); } fprintf(dlt->file_ctx->fp,"\n"); fflush(dlt->file_ctx->fp); dlt->drop_cnt++; SCMutexUnlock(&dlt->file_ctx->fp_mutex); return TM_ECODE_OK; } /** * \brief Check if we need to drop-log this packet * * \param tv Pointer the current thread variables * \param p Pointer the packet which is tested * * \retval bool TRUE or FALSE */ static int LogDropCondition(ThreadVars *tv, const Packet *p) { if (!EngineModeIsIPS()) { SCLogDebug("engine is not running in inline mode, so returning"); return FALSE; } if (PKT_IS_PSEUDOPKT(p)) { SCLogDebug("drop log doesn't log pseudo packets"); return FALSE; } if (p->flow != NULL) { int ret = FALSE; if (p->flow->flags & FLOW_ACTION_DROP) { if (PKT_IS_TOSERVER(p) && !(p->flow->flags & FLOW_TOSERVER_DROP_LOGGED)) ret = TRUE; else if (PKT_IS_TOCLIENT(p) && !(p->flow->flags & FLOW_TOCLIENT_DROP_LOGGED)) ret = TRUE; } return ret; } else if (PACKET_TEST_ACTION(p, ACTION_DROP)) { return TRUE; } return FALSE; } /** * \brief Log the dropped packets when engine is running in inline mode * * \param tv Pointer the current thread variables * \param data Pointer to the droplog struct * \param p Pointer the packet which is being logged * * \retval 0 on succes */ static int LogDropLogger(ThreadVars *tv, void *thread_data, const Packet *p) { int r = LogDropLogNetFilter(tv, p, thread_data); if (r < 0) return -1; if (p->flow) { if (p->flow->flags & FLOW_ACTION_DROP) { if (PKT_IS_TOSERVER(p) && !(p->flow->flags & FLOW_TOSERVER_DROP_LOGGED)) p->flow->flags |= FLOW_TOSERVER_DROP_LOGGED; else if (PKT_IS_TOCLIENT(p) && !(p->flow->flags & FLOW_TOCLIENT_DROP_LOGGED)) p->flow->flags |= FLOW_TOCLIENT_DROP_LOGGED; } } return 0; } static void LogDropLogExitPrintStats(ThreadVars *tv, void *data) { LogDropLogThread *dlt = (LogDropLogThread *)data; if (dlt == NULL) { return; } SCLogInfo("(%s) Dropped Packets %" PRIu64 "", tv->name, dlt->drop_cnt); } /***************************** Unittests ****************************/ #ifdef UNITTESTS /** \brief test if the action is drop then packet should be logged */ int LogDropLogTest01() { int result = 0; EngineModeSetIPS(); uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; LogDropLogThread dlt; LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { printf("Could not create new LogFileCtx\n"); return 0; } memset (&dlt, 0, sizeof(LogDropLogThread)); dlt.file_ctx = logfile_ctx; dlt.file_ctx->fp = stdout; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } de_ctx->flags |= DE_QUIET; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any any " "(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)"); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt == 1 && (PACKET_TEST_ACTION(p, ACTION_DROP))) result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0); if (LogDropCondition(NULL, p) == TRUE) LogDropLogger(NULL, &dlt, p); if (dlt.drop_cnt == 0) { printf("Packet should be logged but its not\n"); result = 0; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); EngineModeSetIDS(); return result; } /** \brief test if the action is alert then packet shouldn't be logged */ int LogDropLogTest02() { int result = 0; EngineModeSetIPS(); uint8_t *buf = (uint8_t *) "GET"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; LogDropLogThread dlt; LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { printf("Could not create new LogFileCtx\n"); return 0; } memset (&dlt, 0, sizeof(LogDropLogThread)); dlt.file_ctx = logfile_ctx; dlt.file_ctx->fp = stdout; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_UDP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } de_ctx->flags |= DE_QUIET; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"LogDropLog test\"; content:\"GET\"; Classtype:unknown; sid:1;)"); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt == 1 && p->alerts.alerts[0].action != ACTION_DROP) result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0); if (LogDropCondition(NULL, p) == TRUE) LogDropLogger(NULL, &dlt, p); if (dlt.drop_cnt != 0) { printf("Packet shouldn't be logged but it is\n"); result = 0; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); EngineModeSetIDS(); return result; } /** * \brief This function registers unit tests for AlertFastLog API. */ static void LogDropLogRegisterTests(void) { UtRegisterTest("LogDropLogTest01", LogDropLogTest01); UtRegisterTest("LogDropLogTest02", LogDropLogTest02); } #endif /** \brief function to register the drop log module */ void LogDropLogRegister (void) { OutputRegisterPacketModule(LOGGER_DROP, MODULE_NAME, "drop", LogDropLogInitCtx, LogDropLogger, LogDropCondition, LogDropLogThreadInit, LogDropLogThreadDeinit, LogDropLogExitPrintStats); #ifdef UNITTESTS LogDropLogRegisterTests(); #endif } suricata-3.2.1/src/queue.h0000644000000000000000000004461213051004444012305 00000000000000/* $OpenBSD: queue.h,v 1.32 2007/04/30 18:42:34 pedro Exp $ */ /* $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $ */ /* * Copyright (c) 1991, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)queue.h 8.5 (Berkeley) 8/20/94 */ #ifndef _SYS_QUEUE_H_ #define _SYS_QUEUE_H_ /* * This file defines five types of data structures: singly-linked lists, * lists, simple queues, tail queues, and circular queues. * * * A singly-linked list is headed by a single forward pointer. The elements * are singly linked for minimum space and pointer manipulation overhead at * the expense of O(n) removal for arbitrary elements. New elements can be * added to the list after an existing element or at the head of the list. * Elements being removed from the head of the list should use the explicit * macro for this purpose for optimum efficiency. A singly-linked list may * only be traversed in the forward direction. Singly-linked lists are ideal * for applications with large datasets and few or no removals or for * implementing a LIFO queue. * * A list is headed by a single forward pointer (or an array of forward * pointers for a hash table header). The elements are doubly linked * so that an arbitrary element can be removed without a need to * traverse the list. New elements can be added to the list before * or after an existing element or at the head of the list. A list * may only be traversed in the forward direction. * * A simple queue is headed by a pair of pointers, one the head of the * list and the other to the tail of the list. The elements are singly * linked to save space, so elements can only be removed from the * head of the list. New elements can be added to the list before or after * an existing element, at the head of the list, or at the end of the * list. A simple queue may only be traversed in the forward direction. * * A tail queue is headed by a pair of pointers, one to the head of the * list and the other to the tail of the list. The elements are doubly * linked so that an arbitrary element can be removed without a need to * traverse the list. New elements can be added to the list before or * after an existing element, at the head of the list, or at the end of * the list. A tail queue may be traversed in either direction. * * A circle queue is headed by a pair of pointers, one to the head of the * list and the other to the tail of the list. The elements are doubly * linked so that an arbitrary element can be removed without a need to * traverse the list. New elements can be added to the list before or after * an existing element, at the head of the list, or at the end of the list. * A circle queue may be traversed in either direction, but has a more * complex end of list detection. * * For details on the use of these macros, see the queue(3) manual page. */ #if defined(__clang_analyzer__) || defined(QUEUE_MACRO_DEBUG) || (defined(_KERNEL) && defined(DIAGNOSTIC)) #define _Q_INVALIDATE(a) ((a) = ((void *)-1)) #else #define _Q_INVALIDATE(a) #endif #if defined(__clang_analyzer__) #define _Q_ASSERT(a) assert((a)) #else #define _Q_ASSERT(a) #endif /* * Singly-linked List definitions. */ /* * The following macros are not used and are in conflict with Win32 API */ #if 0 #define SLIST_HEAD(name, type) \ struct name { \ struct type *slh_first; /* first element */ \ } #define SLIST_HEAD_INITIALIZER(head) \ { NULL } #define SLIST_ENTRY(type) \ struct { \ struct type *sle_next; /* next element */ \ } /* * Singly-linked List access methods. */ #define SLIST_FIRST(head) ((head)->slh_first) #define SLIST_END(head) NULL #define SLIST_EMPTY(head) (SLIST_FIRST(head) == SLIST_END(head)) #define SLIST_NEXT(elm, field) ((elm)->field.sle_next) #define SLIST_FOREACH(var, head, field) \ for((var) = SLIST_FIRST(head); \ (var) != SLIST_END(head); \ (var) = SLIST_NEXT(var, field)) #define SLIST_FOREACH_PREVPTR(var, varp, head, field) \ for ((varp) = &SLIST_FIRST((head)); \ ((var) = *(varp)) != SLIST_END(head); \ (varp) = &SLIST_NEXT((var), field)) /* * Singly-linked List functions. */ #define SLIST_INIT(head) { \ SLIST_FIRST(head) = SLIST_END(head); \ } #define SLIST_INSERT_AFTER(slistelm, elm, field) do { \ (elm)->field.sle_next = (slistelm)->field.sle_next; \ (slistelm)->field.sle_next = (elm); \ } while (0) #define SLIST_INSERT_HEAD(head, elm, field) do { \ (elm)->field.sle_next = (head)->slh_first; \ (head)->slh_first = (elm); \ } while (0) #define SLIST_REMOVE_NEXT(head, elm, field) do { \ (elm)->field.sle_next = (elm)->field.sle_next->field.sle_next; \ } while (0) #define SLIST_REMOVE_HEAD(head, field) do { \ (head)->slh_first = (head)->slh_first->field.sle_next; \ } while (0) #define SLIST_REMOVE(head, elm, type, field) do { \ if ((head)->slh_first == (elm)) { \ SLIST_REMOVE_HEAD((head), field); \ } else { \ struct type *curelm = (head)->slh_first; \ \ while (curelm->field.sle_next != (elm)) \ curelm = curelm->field.sle_next; \ curelm->field.sle_next = \ curelm->field.sle_next->field.sle_next; \ _Q_INVALIDATE((elm)->field.sle_next); \ } \ } while (0) #endif /* 0 */ /* * List definitions. */ #define LIST_HEAD(name, type) \ struct name { \ struct type *lh_first; /* first element */ \ } #define LIST_HEAD_INITIALIZER(head) \ { NULL } #define LIST_ENTRY(type) \ struct { \ struct type *le_next; /* next element */ \ struct type **le_prev; /* address of previous next element */ \ } /* * List access methods */ #define LIST_FIRST(head) ((head)->lh_first) #define LIST_END(head) NULL #define LIST_EMPTY(head) (LIST_FIRST(head) == LIST_END(head)) #define LIST_NEXT(elm, field) ((elm)->field.le_next) #define LIST_FOREACH(var, head, field) \ for((var) = LIST_FIRST(head); \ (var)!= LIST_END(head); \ (var) = LIST_NEXT(var, field)) /* * List functions. */ #define LIST_INIT(head) do { \ LIST_FIRST(head) = LIST_END(head); \ } while (0) #define LIST_INSERT_AFTER(listelm, elm, field) do { \ if (((elm)->field.le_next = (listelm)->field.le_next) != NULL) \ (listelm)->field.le_next->field.le_prev = \ &(elm)->field.le_next; \ (listelm)->field.le_next = (elm); \ (elm)->field.le_prev = &(listelm)->field.le_next; \ } while (0) #define LIST_INSERT_BEFORE(listelm, elm, field) do { \ (elm)->field.le_prev = (listelm)->field.le_prev; \ (elm)->field.le_next = (listelm); \ *(listelm)->field.le_prev = (elm); \ (listelm)->field.le_prev = &(elm)->field.le_next; \ } while (0) #define LIST_INSERT_HEAD(head, elm, field) do { \ if (((elm)->field.le_next = (head)->lh_first) != NULL) \ (head)->lh_first->field.le_prev = &(elm)->field.le_next;\ (head)->lh_first = (elm); \ (elm)->field.le_prev = &(head)->lh_first; \ } while (0) #define LIST_REMOVE(elm, field) do { \ if ((elm)->field.le_next != NULL) \ (elm)->field.le_next->field.le_prev = \ (elm)->field.le_prev; \ *(elm)->field.le_prev = (elm)->field.le_next; \ _Q_INVALIDATE((elm)->field.le_prev); \ _Q_INVALIDATE((elm)->field.le_next); \ } while (0) #define LIST_REPLACE(elm, elm2, field) do { \ if (((elm2)->field.le_next = (elm)->field.le_next) != NULL) \ (elm2)->field.le_next->field.le_prev = \ &(elm2)->field.le_next; \ (elm2)->field.le_prev = (elm)->field.le_prev; \ *(elm2)->field.le_prev = (elm2); \ _Q_INVALIDATE((elm)->field.le_prev); \ _Q_INVALIDATE((elm)->field.le_next); \ } while (0) /* * Simple queue definitions. */ #define SIMPLEQ_HEAD(name, type) \ struct name { \ struct type *sqh_first; /* first element */ \ struct type **sqh_last; /* addr of last next element */ \ } #define SIMPLEQ_HEAD_INITIALIZER(head) \ { NULL, &(head).sqh_first } #define SIMPLEQ_ENTRY(type) \ struct { \ struct type *sqe_next; /* next element */ \ } /* * Simple queue access methods. */ #define SIMPLEQ_FIRST(head) ((head)->sqh_first) #define SIMPLEQ_END(head) NULL #define SIMPLEQ_EMPTY(head) (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head)) #define SIMPLEQ_NEXT(elm, field) ((elm)->field.sqe_next) #define SIMPLEQ_FOREACH(var, head, field) \ for((var) = SIMPLEQ_FIRST(head); \ (var) != SIMPLEQ_END(head); \ (var) = SIMPLEQ_NEXT(var, field)) /* * Simple queue functions. */ #define SIMPLEQ_INIT(head) do { \ (head)->sqh_first = NULL; \ (head)->sqh_last = &(head)->sqh_first; \ } while (0) #define SIMPLEQ_INSERT_HEAD(head, elm, field) do { \ if (((elm)->field.sqe_next = (head)->sqh_first) == NULL) \ (head)->sqh_last = &(elm)->field.sqe_next; \ (head)->sqh_first = (elm); \ } while (0) #define SIMPLEQ_INSERT_TAIL(head, elm, field) do { \ (elm)->field.sqe_next = NULL; \ *(head)->sqh_last = (elm); \ (head)->sqh_last = &(elm)->field.sqe_next; \ } while (0) #define SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do { \ if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\ (head)->sqh_last = &(elm)->field.sqe_next; \ (listelm)->field.sqe_next = (elm); \ } while (0) #define SIMPLEQ_REMOVE_HEAD(head, field) do { \ if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \ (head)->sqh_last = &(head)->sqh_first; \ } while (0) /* * Tail queue definitions. */ #define TAILQ_HEAD(name, type) \ struct name { \ struct type *tqh_first; /* first element */ \ struct type **tqh_last; /* addr of last next element */ \ } #define TAILQ_HEAD_INITIALIZER(head) \ { NULL, &(head).tqh_first } #define TAILQ_ENTRY(type) \ struct { \ struct type *tqe_next; /* next element */ \ struct type **tqe_prev; /* address of previous next element */ \ } /* * tail queue access methods */ #define TAILQ_FIRST(head) ((head)->tqh_first) #define TAILQ_END(head) NULL #define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next) #define TAILQ_LAST(head, headname) \ (*(((struct headname *)((head)->tqh_last))->tqh_last)) /* XXX */ #define TAILQ_PREV(elm, headname, field) \ (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last)) #define TAILQ_EMPTY(head) \ (TAILQ_FIRST(head) == TAILQ_END(head)) #define TAILQ_FOREACH(var, head, field) \ for((var) = TAILQ_FIRST(head); \ (var) != TAILQ_END(head); \ (var) = TAILQ_NEXT(var, field)) /* removal safe iterator using a temprary element has last param */ #define TAILQ_FOREACH_SAFE(var, head, field, tvar) \ for((var) = TAILQ_FIRST(head), \ (tvar) = TAILQ_FIRST(head) ? TAILQ_NEXT(TAILQ_FIRST(head), field): NULL ; \ (var) != TAILQ_END(head); \ (var = tvar), (tvar) = var ? TAILQ_NEXT(var, field): NULL) #define TAILQ_FOREACH_REVERSE(var, head, headname, field) \ for((var) = TAILQ_LAST(head, headname); \ (var) != TAILQ_END(head); \ (var) = TAILQ_PREV(var, headname, field)) /* * Tail queue functions. */ #define TAILQ_INIT(head) do { \ (head)->tqh_first = NULL; \ (head)->tqh_last = &(head)->tqh_first; \ } while (0) #define TAILQ_INSERT_HEAD(head, elm, field) do { \ if (((elm)->field.tqe_next = (head)->tqh_first) != NULL) \ (head)->tqh_first->field.tqe_prev = \ &(elm)->field.tqe_next; \ else \ (head)->tqh_last = &(elm)->field.tqe_next; \ (head)->tqh_first = (elm); \ (elm)->field.tqe_prev = &(head)->tqh_first; \ } while (0) #define TAILQ_INSERT_TAIL(head, elm, field) do { \ _Q_ASSERT((elm)); \ _Q_ASSERT((head)); \ (elm)->field.tqe_next = NULL; \ (elm)->field.tqe_prev = (head)->tqh_last; \ *(head)->tqh_last = (elm); \ _Q_ASSERT(*(head)->tqh_last); \ (head)->tqh_last = &(elm)->field.tqe_next; \ } while (0) #define TAILQ_INSERT_AFTER(head, listelm, elm, field) do { \ if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\ (elm)->field.tqe_next->field.tqe_prev = \ &(elm)->field.tqe_next; \ else \ (head)->tqh_last = &(elm)->field.tqe_next; \ (listelm)->field.tqe_next = (elm); \ (elm)->field.tqe_prev = &(listelm)->field.tqe_next; \ } while (0) #define TAILQ_INSERT_BEFORE(listelm, elm, field) do { \ (elm)->field.tqe_prev = (listelm)->field.tqe_prev; \ (elm)->field.tqe_next = (listelm); \ *(listelm)->field.tqe_prev = (elm); \ (listelm)->field.tqe_prev = &(elm)->field.tqe_next; \ } while (0) #define TAILQ_REMOVE(head, elm, field) do { \ if (((elm)->field.tqe_next) != NULL) \ (elm)->field.tqe_next->field.tqe_prev = \ (elm)->field.tqe_prev; \ else \ (head)->tqh_last = (elm)->field.tqe_prev; \ *(elm)->field.tqe_prev = (elm)->field.tqe_next; \ _Q_ASSERT((head)->tqh_first != (elm)); \ _Q_INVALIDATE((elm)->field.tqe_prev); \ _Q_INVALIDATE((elm)->field.tqe_next); \ } while (0) #define TAILQ_REPLACE(head, elm, elm2, field) do { \ if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL) \ (elm2)->field.tqe_next->field.tqe_prev = \ &(elm2)->field.tqe_next; \ else \ (head)->tqh_last = &(elm2)->field.tqe_next; \ (elm2)->field.tqe_prev = (elm)->field.tqe_prev; \ *(elm2)->field.tqe_prev = (elm2); \ _Q_INVALIDATE((elm)->field.tqe_prev); \ _Q_INVALIDATE((elm)->field.tqe_next); \ } while (0) /* * Circular queue definitions. */ #define CIRCLEQ_HEAD(name, type) \ struct name { \ struct type *cqh_first; /* first element */ \ struct type *cqh_last; /* last element */ \ } #define CIRCLEQ_HEAD_INITIALIZER(head) \ { CIRCLEQ_END(&head), CIRCLEQ_END(&head) } #define CIRCLEQ_ENTRY(type) \ struct { \ struct type *cqe_next; /* next element */ \ struct type *cqe_prev; /* previous element */ \ } /* * Circular queue access methods */ #define CIRCLEQ_FIRST(head) ((head)->cqh_first) #define CIRCLEQ_LAST(head) ((head)->cqh_last) #define CIRCLEQ_END(head) ((void *)(head)) #define CIRCLEQ_NEXT(elm, field) ((elm)->field.cqe_next) #define CIRCLEQ_PREV(elm, field) ((elm)->field.cqe_prev) #define CIRCLEQ_EMPTY(head) \ (CIRCLEQ_FIRST(head) == CIRCLEQ_END(head)) #define CIRCLEQ_FOREACH(var, head, field) \ for((var) = CIRCLEQ_FIRST(head); \ (var) != CIRCLEQ_END(head); \ (var) = CIRCLEQ_NEXT(var, field)) #define CIRCLEQ_FOREACH_REVERSE(var, head, field) \ for((var) = CIRCLEQ_LAST(head); \ (var) != CIRCLEQ_END(head); \ (var) = CIRCLEQ_PREV(var, field)) /* * Circular queue functions. */ #define CIRCLEQ_INIT(head) do { \ (head)->cqh_first = CIRCLEQ_END(head); \ (head)->cqh_last = CIRCLEQ_END(head); \ } while (0) #define CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do { \ (elm)->field.cqe_next = (listelm)->field.cqe_next; \ (elm)->field.cqe_prev = (listelm); \ if ((listelm)->field.cqe_next == CIRCLEQ_END(head)) \ (head)->cqh_last = (elm); \ else \ (listelm)->field.cqe_next->field.cqe_prev = (elm); \ (listelm)->field.cqe_next = (elm); \ } while (0) #define CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do { \ (elm)->field.cqe_next = (listelm); \ (elm)->field.cqe_prev = (listelm)->field.cqe_prev; \ if ((listelm)->field.cqe_prev == CIRCLEQ_END(head)) \ (head)->cqh_first = (elm); \ else \ (listelm)->field.cqe_prev->field.cqe_next = (elm); \ (listelm)->field.cqe_prev = (elm); \ } while (0) #define CIRCLEQ_INSERT_HEAD(head, elm, field) do { \ (elm)->field.cqe_next = (head)->cqh_first; \ (elm)->field.cqe_prev = CIRCLEQ_END(head); \ if ((head)->cqh_last == CIRCLEQ_END(head)) \ (head)->cqh_last = (elm); \ else \ (head)->cqh_first->field.cqe_prev = (elm); \ (head)->cqh_first = (elm); \ } while (0) #define CIRCLEQ_INSERT_TAIL(head, elm, field) do { \ (elm)->field.cqe_next = CIRCLEQ_END(head); \ (elm)->field.cqe_prev = (head)->cqh_last; \ if ((head)->cqh_first == CIRCLEQ_END(head)) \ (head)->cqh_first = (elm); \ else \ (head)->cqh_last->field.cqe_next = (elm); \ (head)->cqh_last = (elm); \ } while (0) #define CIRCLEQ_REMOVE(head, elm, field) do { \ if ((elm)->field.cqe_next == CIRCLEQ_END(head)) \ (head)->cqh_last = (elm)->field.cqe_prev; \ else \ (elm)->field.cqe_next->field.cqe_prev = \ (elm)->field.cqe_prev; \ if ((elm)->field.cqe_prev == CIRCLEQ_END(head)) \ (head)->cqh_first = (elm)->field.cqe_next; \ else \ (elm)->field.cqe_prev->field.cqe_next = \ (elm)->field.cqe_next; \ _Q_INVALIDATE((elm)->field.cqe_prev); \ _Q_INVALIDATE((elm)->field.cqe_next); \ } while (0) #define CIRCLEQ_REPLACE(head, elm, elm2, field) do { \ if (((elm2)->field.cqe_next = (elm)->field.cqe_next) == \ CIRCLEQ_END(head)) \ (head).cqh_last = (elm2); \ else \ (elm2)->field.cqe_next->field.cqe_prev = (elm2); \ if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) == \ CIRCLEQ_END(head)) \ (head).cqh_first = (elm2); \ else \ (elm2)->field.cqe_prev->field.cqe_next = (elm2); \ _Q_INVALIDATE((elm)->field.cqe_prev); \ _Q_INVALIDATE((elm)->field.cqe_next); \ } while (0) #endif /* !_SYS_QUEUE_H_ */ suricata-3.2.1/src/detect-iprep.h0000644000000000000000000000241313051004444013537 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_IPREP_H__ #define __DETECT_IPREP_H__ #define DETECT_IPREP_CMD_ANY 0 #define DETECT_IPREP_CMD_BOTH 1 #define DETECT_IPREP_CMD_SRC 2 #define DETECT_IPREP_CMD_DST 3 #define DETECT_IPREP_OP_LT 0 #define DETECT_IPREP_OP_GT 1 #define DETECT_IPREP_OP_EQ 2 typedef struct DetectIPRepData_ { uint8_t cmd; int8_t cat; int8_t op; uint8_t val; } DetectIPRepData; /* prototypes */ void DetectIPRepRegister (void); #endif /* __DETECT_IPREP_H__ */ suricata-3.2.1/src/detect-hostbits.c0000644000000000000000000010116113051004444014252 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the hostbits keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "threads.h" #include "flow.h" #include "flow-util.h" #include "detect-hostbits.h" #include "util-spm.h" #include "detect-engine-sigorder.h" #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow-bit.h" #include "host-bit.h" #include "util-var-name.h" #include "util-unittest.h" #include "util-debug.h" /* hostbits:isset,bitname; hostbits:set,bitname; hostbits:set,bitname,src; hostbits:set,bitname,dst; TODO: hostbits:set,bitname,both; hostbits:set,bitname,src,3600; hostbits:set,bitname,dst,60; hostbits:set,bitname,both,120; */ #define PARSE_REGEX "([a-z]+)" /* Action */ \ "(?:\\s*,\\s*([^\\s,]+))?(?:\\s*)?" /* Name. */ \ "(?:\\s*,\\s*([^,\\s]+))?(?:\\s*)?" /* Direction. */ \ "(.+)?" /* Any remainding data. */ static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectHostbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectHostbitSetup (DetectEngineCtx *, Signature *, char *); void DetectHostbitFree (void *); void HostBitsRegisterTests(void); void DetectHostbitsRegister (void) { sigmatch_table[DETECT_HOSTBITS].name = "hostbits"; sigmatch_table[DETECT_HOSTBITS].desc = "operate on host flag"; // sigmatch_table[DETECT_HOSTBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits"; sigmatch_table[DETECT_HOSTBITS].Match = DetectHostbitMatch; sigmatch_table[DETECT_HOSTBITS].Setup = DetectHostbitSetup; sigmatch_table[DETECT_HOSTBITS].Free = DetectHostbitFree; sigmatch_table[DETECT_HOSTBITS].RegisterTests = HostBitsRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_HOSTBITS].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static int DetectHostbitMatchToggle (Packet *p, const DetectXbitsData *fd) { switch (fd->tracker) { case DETECT_XBITS_TRACK_IPSRC: if (p->host_src == NULL) { p->host_src = HostGetHostFromHash(&p->src); if (p->host_src == NULL) return 0; } else HostLock(p->host_src); HostBitToggle(p->host_src,fd->idx,p->ts.tv_sec + fd->expire); HostUnlock(p->host_src); break; case DETECT_XBITS_TRACK_IPDST: if (p->host_dst == NULL) { p->host_dst = HostGetHostFromHash(&p->dst); if (p->host_dst == NULL) return 0; } else HostLock(p->host_dst); HostBitToggle(p->host_dst,fd->idx,p->ts.tv_sec + fd->expire); HostUnlock(p->host_dst); break; } return 1; } /* return true even if bit not found */ static int DetectHostbitMatchUnset (Packet *p, const DetectXbitsData *fd) { switch (fd->tracker) { case DETECT_XBITS_TRACK_IPSRC: if (p->host_src == NULL) { p->host_src = HostLookupHostFromHash(&p->src); if (p->host_src == NULL) return 1; } else HostLock(p->host_src); HostBitUnset(p->host_src,fd->idx); HostUnlock(p->host_src); break; case DETECT_XBITS_TRACK_IPDST: if (p->host_dst == NULL) { p->host_dst = HostLookupHostFromHash(&p->dst); if (p->host_dst == NULL) return 1; } else HostLock(p->host_dst); HostBitUnset(p->host_dst,fd->idx); HostUnlock(p->host_dst); break; } return 1; } static int DetectHostbitMatchSet (Packet *p, const DetectXbitsData *fd) { switch (fd->tracker) { case DETECT_XBITS_TRACK_IPSRC: if (p->host_src == NULL) { p->host_src = HostGetHostFromHash(&p->src); if (p->host_src == NULL) return 0; } else HostLock(p->host_src); HostBitSet(p->host_src,fd->idx,p->ts.tv_sec + fd->expire); HostUnlock(p->host_src); break; case DETECT_XBITS_TRACK_IPDST: if (p->host_dst == NULL) { p->host_dst = HostGetHostFromHash(&p->dst); if (p->host_dst == NULL) return 0; } else HostLock(p->host_dst); HostBitSet(p->host_dst,fd->idx, p->ts.tv_sec + fd->expire); HostUnlock(p->host_dst); break; } return 1; } static int DetectHostbitMatchIsset (Packet *p, const DetectXbitsData *fd) { int r = 0; switch (fd->tracker) { case DETECT_XBITS_TRACK_IPSRC: if (p->host_src == NULL) { p->host_src = HostLookupHostFromHash(&p->src); if (p->host_src == NULL) return 0; } else HostLock(p->host_src); r = HostBitIsset(p->host_src,fd->idx, p->ts.tv_sec); HostUnlock(p->host_src); return r; case DETECT_XBITS_TRACK_IPDST: if (p->host_dst == NULL) { p->host_dst = HostLookupHostFromHash(&p->dst); if (p->host_dst == NULL) return 0; } else HostLock(p->host_dst); r = HostBitIsset(p->host_dst,fd->idx, p->ts.tv_sec); HostUnlock(p->host_dst); return r; } return 0; } static int DetectHostbitMatchIsnotset (Packet *p, const DetectXbitsData *fd) { int r = 0; switch (fd->tracker) { case DETECT_XBITS_TRACK_IPSRC: if (p->host_src == NULL) { p->host_src = HostLookupHostFromHash(&p->src); if (p->host_src == NULL) return 1; } else HostLock(p->host_src); r = HostBitIsnotset(p->host_src,fd->idx, p->ts.tv_sec); HostUnlock(p->host_src); return r; case DETECT_XBITS_TRACK_IPDST: if (p->host_dst == NULL) { p->host_dst = HostLookupHostFromHash(&p->dst); if (p->host_dst == NULL) return 1; } else HostLock(p->host_dst); r = HostBitIsnotset(p->host_dst,fd->idx, p->ts.tv_sec); HostUnlock(p->host_dst); return r; } return 0; } int DetectXbitMatchHost(Packet *p, const DetectXbitsData *xd) { switch (xd->cmd) { case DETECT_XBITS_CMD_ISSET: return DetectHostbitMatchIsset(p,xd); case DETECT_XBITS_CMD_ISNOTSET: return DetectHostbitMatchIsnotset(p,xd); case DETECT_XBITS_CMD_SET: return DetectHostbitMatchSet(p,xd); case DETECT_XBITS_CMD_UNSET: return DetectHostbitMatchUnset(p,xd); case DETECT_XBITS_CMD_TOGGLE: return DetectHostbitMatchToggle(p,xd); default: SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", xd->cmd); return 0; } return 0; } /* * returns 0: no match * 1: match * -1: error */ int DetectHostbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectXbitsData *xd = (const DetectXbitsData *)ctx; if (xd == NULL) return 0; return DetectXbitMatchHost(p, xd); } static int DetectHostbitParse(const char *str, char *cmd, int cmd_len, char *name, int name_len, char *dir, int dir_len) { const int max_substrings = 30; int count, rc; int ov[max_substrings]; count = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, max_substrings); if (count != 2 && count != 3 && count != 4) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for hostbits.", str); return 0; } rc = pcre_copy_substring((char *)str, ov, max_substrings, 1, cmd, cmd_len); if (rc < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return 0; } if (count >= 3) { rc = pcre_copy_substring((char *)str, ov, max_substrings, 2, name, name_len); if (rc < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return 0; } if (count >= 4) { rc = pcre_copy_substring((char *)str, ov, max_substrings, 3, dir, dir_len); if (rc < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return 0; } } } return 1; } int DetectHostbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectXbitsData *cd = NULL; SigMatch *sm = NULL; uint8_t fb_cmd = 0; uint8_t hb_dir = 0; char fb_cmd_str[16] = "", fb_name[256] = ""; char hb_dir_str[16] = ""; if (!DetectHostbitParse(rawstr, fb_cmd_str, sizeof(fb_cmd_str), fb_name, sizeof(fb_name), hb_dir_str, sizeof(hb_dir_str))) { return -1; } if (strlen(hb_dir_str) > 0) { if (strcmp(hb_dir_str, "src") == 0) hb_dir = DETECT_XBITS_TRACK_IPSRC; else if (strcmp(hb_dir_str, "dst") == 0) hb_dir = DETECT_XBITS_TRACK_IPDST; else if (strcmp(hb_dir_str, "both") == 0) { //hb_dir = DETECT_XBITS_TRACK_IPBOTH; SCLogError(SC_ERR_UNIMPLEMENTED, "'both' not implemented"); goto error; } else { // TODO goto error; } } if (strcmp(fb_cmd_str,"noalert") == 0) { fb_cmd = DETECT_XBITS_CMD_NOALERT; } else if (strcmp(fb_cmd_str,"isset") == 0) { fb_cmd = DETECT_XBITS_CMD_ISSET; } else if (strcmp(fb_cmd_str,"isnotset") == 0) { fb_cmd = DETECT_XBITS_CMD_ISNOTSET; } else if (strcmp(fb_cmd_str,"set") == 0) { fb_cmd = DETECT_XBITS_CMD_SET; } else if (strcmp(fb_cmd_str,"unset") == 0) { fb_cmd = DETECT_XBITS_CMD_UNSET; } else if (strcmp(fb_cmd_str,"toggle") == 0) { fb_cmd = DETECT_XBITS_CMD_TOGGLE; } else { SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str); goto error; } switch (fb_cmd) { case DETECT_XBITS_CMD_NOALERT: if (strlen(fb_name) != 0) goto error; s->flags |= SIG_FLAG_NOALERT; return 0; case DETECT_XBITS_CMD_ISNOTSET: case DETECT_XBITS_CMD_ISSET: case DETECT_XBITS_CMD_SET: case DETECT_XBITS_CMD_UNSET: case DETECT_XBITS_CMD_TOGGLE: default: if (strlen(fb_name) == 0) goto error; break; } cd = SCMalloc(sizeof(DetectXbitsData)); if (unlikely(cd == NULL)) goto error; cd->idx = VariableNameGetIdx(de_ctx, fb_name, VAR_TYPE_HOST_BIT); cd->cmd = fb_cmd; cd->tracker = hb_dir; cd->type = VAR_TYPE_HOST_BIT; cd->expire = 300; SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)"); /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_HOSTBITS; sm->ctx = (void *)cd; switch (fb_cmd) { /* case DETECT_XBITS_CMD_NOALERT can't happen here */ case DETECT_XBITS_CMD_ISNOTSET: case DETECT_XBITS_CMD_ISSET: /* checks, so packet list */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); break; case DETECT_XBITS_CMD_SET: case DETECT_XBITS_CMD_UNSET: case DETECT_XBITS_CMD_TOGGLE: /* modifiers, only run when entire sig has matched */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); break; } return 0; error: if (cd != NULL) SCFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectHostbitFree (void *ptr) { DetectXbitsData *fd = (DetectXbitsData *)ptr; if (fd == NULL) return; SCFree(fd); } #ifdef UNITTESTS static void HostBitsTestSetup(void) { StorageInit(); HostBitInitCtx(); StorageFinalize(); HostInitConfig(TRUE); } static void HostBitsTestShutdown(void) { HostCleanup(); StorageCleanup(); } static int HostBitsTestParse01(void) { char cmd[16] = "", name[256] = "", dir[16] = ""; /* No direction. */ FAIL_IF(!DetectHostbitParse("isset,name", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); FAIL_IF(strlen(dir)); /* No direction, leading space. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset, name", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); /* No direction, trailing space. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset,name ", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); /* No direction, leading and trailing space. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset, name ", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); /* With direction. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset,name,src", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); FAIL_IF(strcmp(dir, "src") != 0); /* With direction - leading and trailing spaces on name. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset, name ,src", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); FAIL_IF(strcmp(dir, "src") != 0); /* With direction - space around direction. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(!DetectHostbitParse("isset, name , src ", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); FAIL_IF(strcmp(cmd, "isset") != 0); FAIL_IF(strcmp(name, "name") != 0); FAIL_IF(strcmp(dir, "src") != 0); /* Name with space, no direction - should fail. */ *cmd = '\0'; *name = '\0'; *dir = '\0'; FAIL_IF(DetectHostbitParse("isset, name withspace ", cmd, sizeof(cmd), name, sizeof(name), dir, sizeof(dir))); PASS; } /** * \test HostBitsTestSig01 is a test for a valid noalert flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig01(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; HostBitsTestSetup(); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (hostbits:set,abc; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostBitsTestShutdown(); SCFree(p); PASS; } /** * \test various options * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig02(void) { Signature *s = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:isset,abc,src; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:isnotset,abc,dst; content:\"GET \"; sid:2;)"); FAIL_IF_NULL(s); /* TODO reenable after both is supported s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:set,abc,both; content:\"GET \"; sid:3;)"); FAIL_IF_NULL(s); */ s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:unset,abc,src; content:\"GET \"; sid:4;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:toggle,abc,dst; content:\"GET \"; sid:5;)"); FAIL_IF_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } #if 0 /** * \test HostBitsTestSig03 is a test for a invalid flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig03(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Unknown cmd\"; flowbits:wrongcmd; content:\"GET \"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } SCFree(p); return result; } #endif /** * \test HostBitsTestSig04 is a test check idx value * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig04(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; int idx = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; HostBitsTestSetup(); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; hostbits:isset,fbt; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); idx = VariableNameGetIdx(de_ctx, "fbt", VAR_TYPE_HOST_BIT); FAIL_IF(idx != 1); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostBitsTestShutdown(); SCFree(p); PASS; } /** * \test HostBitsTestSig05 is a test check noalert flag * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig05(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; HostBitsTestSetup(); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any (hostbits:noalert; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF((s->flags & SIG_FLAG_NOALERT) != SIG_FLAG_NOALERT); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostBitsTestShutdown(); SCFree(p); PASS; } #if 0 /** * \test HostBitsTestSig06 is a test set flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig06(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; GenericVar flowvar, *gv = NULL; int result = 0; int idx = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p->flow = &f; p->flow->flowvar = &flowvar; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->flags |= PKT_HAS_FLOW; p->flowflags |= FLOW_PKT_TOSERVER; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,myflow; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); idx = VariableNameGetIdx(de_ctx, "myflow", VAR_TYPE_HOST_BIT); gv = p->flow->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_HOSTBITS && gv->idx == idx) { result = 1; } } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); return result; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); return result; } /** * \test HostBitsTestSig07 is a test unset flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig07(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; GenericVar flowvar, *gv = NULL; int result = 0; int idx = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p->flow = &f; p->flow->flowvar = &flowvar; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,myflow2; sid:10;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit unset\"; flowbits:unset,myflow2; sid:11;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); idx = VariableNameGetIdx(de_ctx, "myflow", VAR_TYPE_HOST_BIT); gv = p->flow->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_HOSTBITS && gv->idx == idx) { result = 1; } } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); return result; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); return result;} #endif /** * \test set / isset * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig07(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; int result = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); HostBitsTestSetup(); FLOW_INITIALIZE(&f); p->flow = &f; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any (hostbits:set,myflow2; sid:10;)"); FAIL_IF_NULL(s); s = s->next = SigInit(de_ctx, "alert ip any any -> any any (hostbits:isset,myflow2; sid:11;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SCLogInfo("p->host_src %p", p->host_src); if (HostHasHostBits(p->host_src) == 1) { if (PacketAlertCheck(p, 11)) { result = 1; } } FAIL_IF_NOT(result); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); HostBitsTestShutdown(); SCFree(p); PASS; } /** * \test set / toggle / toggle / isset * * \retval 1 on succces * \retval 0 on failure */ static int HostBitsTestSig08(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); HostBitsTestSetup(); FLOW_INITIALIZE(&f); p->flow = &f; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:set,myflow2; sid:10;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:toggle,myflow2; sid:11;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:toggle,myflow2; sid:12;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (hostbits:isset,myflow2; sid:13;)"); FAIL_IF_NULL(s); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SCLogInfo("p->host_src %p", p->host_src); if (HostHasHostBits(p->host_src) == 1) { if (PacketAlertCheck(p, 10)) { SCLogInfo("sid 10 matched"); } if (PacketAlertCheck(p, 11)) { SCLogInfo("sid 11 matched"); } if (PacketAlertCheck(p, 12)) { SCLogInfo("sid 12 matched"); } if (PacketAlertCheck(p, 13)) { SCLogInfo("sid 13 matched"); } else { FAIL; } } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); HostBitsTestShutdown(); SCFree(p); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for HostBits */ void HostBitsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HostBitsTestParse01", HostBitsTestParse01); UtRegisterTest("HostBitsTestSig01", HostBitsTestSig01); UtRegisterTest("HostBitsTestSig02", HostBitsTestSig02); #if 0 UtRegisterTest("HostBitsTestSig03", HostBitsTestSig03, 0); #endif UtRegisterTest("HostBitsTestSig04", HostBitsTestSig04); UtRegisterTest("HostBitsTestSig05", HostBitsTestSig05); #if 0 UtRegisterTest("HostBitsTestSig06", HostBitsTestSig06, 1); #endif UtRegisterTest("HostBitsTestSig07", HostBitsTestSig07); UtRegisterTest("HostBitsTestSig08", HostBitsTestSig08); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-proto-name.h0000644000000000000000000000235513051004444014213 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef __UTIL_PROTO_NAME_H__ #define __UTIL_PROTO_NAME_H__ #ifndef OS_WIN32 #define PROTO_FILE "/etc/protocols" #else #define PROTO_FILE "C:\\Windows\\system32\\drivers\\etc\\protocol" #endif /* OS_WIN32 */ /** Lookup array to hold the information related to known protocol * in /etc/protocols */ char *known_proto[256]; uint8_t SCProtoNameValid(uint16_t); void SCProtoNameInit(void); void SCProtoNameDeInit(void); #endif /* __UTIL_PROTO_NAME_H__ */ suricata-3.2.1/src/respond-reject-libnet11.h0000644000000000000000000000233113051004444015512 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author William Metcalf */ #ifndef __RESPOND_REJECT_LIBNET11_H__ #define __RESPOND_REJECT_LIBNET11_H__ int RejectSendLibnet11L3IPv4TCP(ThreadVars *, Packet *, void *,int); int RejectSendLibnet11L3IPv4ICMP(ThreadVars *, Packet *, void *,int); int RejectSendLibnet11L3IPv6TCP(ThreadVars *, Packet *, void *,int); int RejectSendLibnet11L3IPv6ICMP(ThreadVars *, Packet *, void *,int); #endif /* __RESPOND_REJECT_LIBNET11_H__ */ suricata-3.2.1/src/detect-base64-decode.h0000644000000000000000000000215213051004444014725 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __DETECT_BASE64_DECODE_H__ #define __DETECT_BASE64_DECODE_H__ #include "app-layer-template.h" typedef struct DetectBase64Decode_ { uint32_t bytes; uint32_t offset; uint8_t relative; } DetectBase64Decode; void DetectBase64DecodeRegister(void); int DetectBase64DecodeDoMatch(DetectEngineThreadCtx *, Signature *, const SigMatch *, uint8_t *, uint32_t); #endif /* __DETECT_BASE64_DECODE_H__ */ suricata-3.2.1/src/detect-engine-profile.c0000644000000000000000000001043313051004444015317 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "output-json.h" #include "util-buffer.h" #include "util-print.h" #ifdef PROFILING #ifdef HAVE_LIBJANSSON static void DumpFp(const SigMatch *sm, char *pat_orig, uint32_t pat_orig_sz, char *pat_chop, uint32_t pat_chop_sz) { int fast_pattern_chop_set = 0; const DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { fast_pattern_chop_set = 1; } } uint32_t off = 0; PrintRawUriBuf(pat_orig, &off, pat_orig_sz, cd->content, cd->content_len); if (fast_pattern_chop_set) { off = 0; PrintRawUriBuf(pat_chop, &off, pat_chop_sz, cd->content + cd->fp_chop_offset, cd->fp_chop_len); } } SCMutex g_rule_dump_write_m = SCMUTEX_INITIALIZER; void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, const Packet *p) { json_t *js = CreateJSONHeader(p, 0, "inspectedrules"); if (js == NULL) return; json_t *ir = json_object(); if (ir == NULL) return; json_object_set_new(ir, "rule_group_id", json_integer(det_ctx->sgh->id)); json_object_set_new(ir, "rule_cnt", json_integer(det_ctx->match_array_cnt)); json_t *js_array = json_array(); uint32_t x; for (x = 0; x < det_ctx->match_array_cnt; x++) { const Signature *s = det_ctx->match_array[x]; if (s == NULL) continue; json_t *js_sig = json_object(); if (unlikely(js == NULL)) continue; json_object_set_new(js_sig, "sig_id", json_integer(s->id)); json_object_set_new(js_sig, "mpm", (s->mpm_sm != NULL) ? json_true() : json_false()); if (s->mpm_sm != NULL) { char orig[256] = ""; char chop[256] = ""; DumpFp(s->mpm_sm, orig, sizeof(orig), chop, sizeof(chop)); json_object_set_new(js_sig, "mpm_buffer", json_string(DetectListToHumanString(SigMatchListSMBelongsTo(s, s->mpm_sm)))); json_object_set_new(js_sig, "mpm_pattern", json_string(orig)); if (strlen(chop) > 0) { json_object_set_new(js_sig, "mpm_pattern_chop", json_string(chop)); } } json_array_append_new(js_array, js_sig); } json_object_set_new(ir, "rules", js_array); json_object_set_new(js, "inspectedrules", ir); const char *filename = "packet_inspected_rules.json"; const char *log_dir = ConfigGetLogDirectory(); char log_path[PATH_MAX] = ""; snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, filename); MemBuffer *mbuf = NULL; mbuf = MemBufferCreateNew(4096); BUG_ON(mbuf == NULL); OutputJSONMemBufferWrapper wrapper = { .buffer = &mbuf, .expand_by = 4096, }; int r = json_dump_callback(js, OutputJSONMemBufferCallback, &wrapper, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); if (r != 0) { SCLogWarning(SC_ERR_SOCKET, "unable to serialize JSON object"); } else { MemBufferWriteString(mbuf, "\n"); SCMutexLock(&g_rule_dump_write_m); FILE *fp = fopen(log_path, "a"); if (fp != NULL) { MemBufferPrintToFPAsString(mbuf, fp); fclose(fp); SCMutexUnlock(&g_rule_dump_write_m); } } MemBufferFree(mbuf); json_object_clear(js); json_decref(js); } #endif /* HAVE_LIBJANSSON */ #endif /* PROFILING */ suricata-3.2.1/src/detect-ssh-proto-version.h0000644000000000000000000000232613051004444016044 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_SSH_VERSION_H__ #define __DETECT_SSH_VERSION_H__ /** proto version 1.99 is considered proto version 2 */ #define SSH_FLAG_PROTOVERSION_2_COMPAT 0x01 typedef struct DetectSshVersionData_ { uint8_t *ver; /** ssh version to match */ uint16_t len; /** ssh version length to match */ uint8_t flags; } DetectSshVersionData; /* prototypes */ void DetectSshVersionRegister (void); #endif /* __DETECT_SSH_VERSION_H__ */ suricata-3.2.1/src/util-running-modes.h0000644000000000000000000000175613051004444014723 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #ifndef __UTIL_RUNNING_MODES_H__ #define __UTIL_RUNNING_MODES_H__ int ListKeywords(const char *keyword_info); int ListAppLayerProtocols(); #ifdef __SC_CUDA_SUPPORT__ int ListCudaCards(); #endif #endif /* __UTIL_RUNNING_MODES_H__ */ suricata-3.2.1/src/util-storage.c0000644000000000000000000003375013051004444013574 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Storage API */ #include "suricata-common.h" #include "util-unittest.h" #include "util-storage.h" typedef struct StorageMapping_ { const char *name; StorageEnum type; // host, flow, tx, stream, ssn, etc unsigned int size; void *(*Alloc)(unsigned int); void (*Free)(void *); } StorageMapping; /** \brief list of StorageMapping used at registration time */ typedef struct StorageList_ { StorageMapping map; int id; struct StorageList_ *next; } StorageList; static StorageList *storage_list = NULL; static int storage_max_id[STORAGE_MAX]; static int storage_registraton_closed = 0; static StorageMapping **storage_map = NULL; const char *StoragePrintType(StorageEnum type) { switch(type) { case STORAGE_HOST: return "host"; case STORAGE_FLOW: return "flow"; case STORAGE_IPPAIR: return "ippair"; case STORAGE_MAX: return "max"; } return "invalid"; } void StorageInit(void) { memset(&storage_max_id, 0x00, sizeof(storage_max_id)); storage_list = NULL; storage_map = NULL; storage_registraton_closed = 0; } void StorageCleanup(void) { if (storage_map) { int i; for (i = 0; i < STORAGE_MAX; i++) { if (storage_map[i] != NULL) { SCFree(storage_map[i]); storage_map[i] = NULL; } } SCFree(storage_map); storage_map = NULL; } StorageList *entry = storage_list; while (entry) { StorageList *next = entry->next; SCFree(entry); entry = next; } storage_list = NULL; } int StorageRegister(const StorageEnum type, const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)) { if (storage_registraton_closed) return -1; if (type >= STORAGE_MAX || name == NULL || strlen(name) == 0 || size == 0 || (size != sizeof(void *) && Alloc == NULL) || Free == NULL) return -1; StorageList *list = storage_list; while (list) { if (strcmp(name, list->map.name) == 0 && type == list->map.type) { SCLogError(SC_ERR_INVALID_VALUE, "storage for type \"%s\" with " "name \"%s\" already registered", StoragePrintType(type), name); return -1; } list = list->next; } StorageList *entry = SCMalloc(sizeof(StorageList)); if (unlikely(entry == NULL)) return -1; memset(entry, 0x00, sizeof(StorageList)); entry->map.type = type; entry->map.name = name; entry->map.size = size; entry->map.Alloc = Alloc; entry->map.Free = Free; entry->id = storage_max_id[type]++; entry->next = storage_list; storage_list = entry; return entry->id; } int StorageFinalize(void) { int count = 0; int i; storage_registraton_closed = 1; for (i = 0; i < STORAGE_MAX; i++) { if (storage_max_id[i] > 0) count++; } if (count == 0) return 0; storage_map = SCMalloc(sizeof(StorageMapping *) * STORAGE_MAX); if (unlikely(storage_map == NULL)) { return -1; } memset(storage_map, 0x00, sizeof(StorageMapping *) * STORAGE_MAX); for (i = 0; i < STORAGE_MAX; i++) { if (storage_max_id[i] > 0) { storage_map[i] = SCMalloc(sizeof(StorageMapping) * storage_max_id[i]); if (storage_map[i] == NULL) return -1; memset(storage_map[i], 0x00, sizeof(StorageMapping) * storage_max_id[i]); } } StorageList *entry = storage_list; while (entry) { if (storage_map[entry->map.type] != NULL) { storage_map[entry->map.type][entry->id].name = entry->map.name; storage_map[entry->map.type][entry->id].type = entry->map.type; storage_map[entry->map.type][entry->id].size = entry->map.size; storage_map[entry->map.type][entry->id].Alloc = entry->map.Alloc; storage_map[entry->map.type][entry->id].Free = entry->map.Free; } entry = entry->next; }; #ifdef DEBUG for (i = 0; i < STORAGE_MAX; i++) { if (storage_map[i] == NULL) continue; int j; for (j = 0; j < storage_max_id[i]; j++) { StorageMapping *m = &storage_map[i][j]; SCLogDebug("type \"%s\" name \"%s\" size \"%"PRIuMAX"\"", StoragePrintType(m->type), m->name, (uintmax_t)m->size); } } #endif return 0; } unsigned int StorageGetCnt(StorageEnum type) { return storage_max_id[type]; } /** \brief get the size of the void array used to store * the pointers * \retval size size in bytes, can return 0 if not storage is needed * * \todo we could return -1 when registration isn't closed yet, however * this will break lots of tests currently, so not doing it now */ unsigned int StorageGetSize(StorageEnum type) { return storage_max_id[type] * sizeof(void *); } void *StorageGetById(const Storage *storage, const StorageEnum type, const int id) { #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif SCLogDebug("storage %p id %d", storage, id); if (storage == NULL) return NULL; return storage[id]; } int StorageSetById(Storage *storage, const StorageEnum type, const int id, void *ptr) { #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif SCLogDebug("storage %p id %d", storage, id); if (storage == NULL) return -1; storage[id] = ptr; return 0; } void *StorageAllocByIdPrealloc(Storage *storage, StorageEnum type, int id) { #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif SCLogDebug("storage %p id %d", storage, id); StorageMapping *map = &storage_map[type][id]; if (storage[id] == NULL && map->Alloc != NULL) { storage[id] = map->Alloc(map->size); if (storage[id] == NULL) { return NULL; } } return storage[id]; } void *StorageAllocById(Storage **storage, StorageEnum type, int id) { #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif SCLogDebug("storage %p id %d", storage, id); StorageMapping *map = &storage_map[type][id]; Storage *store = *storage; if (store == NULL) { store = SCMalloc(sizeof(void *) * storage_max_id[type]); if (unlikely(store == NULL)) return NULL; memset(store, 0x00, sizeof(void *) * storage_max_id[type]); } SCLogDebug("store %p", store); if (store[id] == NULL && map->Alloc != NULL) { store[id] = map->Alloc(map->size); if (store[id] == NULL) { SCFree(store); *storage = NULL; return NULL; } } *storage = store; return store[id]; } void StorageFreeById(Storage *storage, StorageEnum type, int id) { #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif #ifdef UNITTESTS if (storage_map == NULL) return; #endif SCLogDebug("storage %p id %d", storage, id); Storage *store = storage; if (store != NULL) { SCLogDebug("store %p", store); if (store[id] != NULL) { StorageMapping *map = &storage_map[type][id]; map->Free(store[id]); store[id] = NULL; } } } void StorageFreeAll(Storage *storage, StorageEnum type) { if (storage == NULL) return; #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif #ifdef UNITTESTS if (storage_map == NULL) return; #endif Storage *store = storage; int i; for (i = 0; i < storage_max_id[type]; i++) { if (store[i] != NULL) { StorageMapping *map = &storage_map[type][i]; map->Free(store[i]); store[i] = NULL; } } } void StorageFree(Storage **storage, StorageEnum type) { if (*storage == NULL) return; #ifdef DEBUG BUG_ON(!storage_registraton_closed); #endif #ifdef UNITTESTS if (storage_map == NULL) return; #endif Storage *store = *storage; int i; for (i = 0; i < storage_max_id[type]; i++) { if (store[i] != NULL) { StorageMapping *map = &storage_map[type][i]; map->Free(store[i]); store[i] = NULL; } } SCFree(*storage); *storage = NULL; } #ifdef UNITTESTS static void *StorageTestAlloc(unsigned int size) { void *x = SCMalloc(size); return x; } static void StorageTestFree(void *x) { if (x) SCFree(x); } static int StorageTest01(void) { StorageInit(); int id = StorageRegister(STORAGE_HOST, "test", 8, StorageTestAlloc, StorageTestFree); if (id < 0) goto error; id = StorageRegister(STORAGE_HOST, "variable", 24, StorageTestAlloc, StorageTestFree); if (id < 0) goto error; id = StorageRegister(STORAGE_FLOW, "store", sizeof(void *), StorageTestAlloc, StorageTestFree); if (id < 0) goto error; if (StorageFinalize() < 0) goto error; StorageCleanup(); return 1; error: StorageCleanup(); return 0; } struct StorageTest02Data { int abc; }; static void *StorageTest02Init(unsigned int size) { struct StorageTest02Data *data = (struct StorageTest02Data *)SCMalloc(size); if (data != NULL) data->abc = 1234; return (void *)data; } static int StorageTest02(void) { struct StorageTest02Data *test = NULL; StorageInit(); int id1 = StorageRegister(STORAGE_HOST, "test", 4, StorageTest02Init, StorageTestFree); if (id1 < 0) { printf("StorageRegister failed (2): "); goto error; } int id2 = StorageRegister(STORAGE_HOST, "test2", 4, StorageTest02Init, StorageTestFree); if (id2 < 0) { printf("StorageRegister failed (2): "); goto error; } if (StorageFinalize() < 0) { printf("StorageFinalize failed: "); goto error; } Storage *storage = NULL; void *data = StorageAllocById(&storage, STORAGE_HOST, id1); if (data == NULL) { printf("StorageAllocById failed, data == NULL, storage %p: ", storage); goto error; } test = (struct StorageTest02Data *)data; if (test->abc != 1234) { printf("setup failed, test->abc != 1234, but %d (1):", test->abc); goto error; } test->abc = 4321; data = StorageAllocById(&storage, STORAGE_HOST, id2); if (data == NULL) { printf("StorageAllocById failed, data == NULL, storage %p: ", storage); goto error; } test = (struct StorageTest02Data *)data; if (test->abc != 1234) { printf("setup failed, test->abc != 1234, but %d (2):", test->abc); goto error; } data = StorageGetById(storage, STORAGE_HOST, id1); if (data == NULL) { printf("StorageAllocById failed, data == NULL, storage %p: ", storage); goto error; } test = (struct StorageTest02Data *)data; if (test->abc != 4321) { printf("setup failed, test->abc != 4321, but %d (3):", test->abc); goto error; } //StorageFreeById(storage, STORAGE_HOST, id1); //StorageFreeById(storage, STORAGE_HOST, id2); StorageFree(&storage, STORAGE_HOST); StorageCleanup(); return 1; error: StorageCleanup(); return 0; } static int StorageTest03(void) { StorageInit(); int id = StorageRegister(STORAGE_HOST, "test", 8, StorageTestAlloc, StorageTestFree); if (id < 0) goto error; id = StorageRegister(STORAGE_HOST, "test", 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed: "); goto error; } id = StorageRegister(STORAGE_HOST, "test1", 6, NULL, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (2): "); goto error; } id = StorageRegister(STORAGE_HOST, "test2", 8, StorageTestAlloc, NULL); if (id != -1) { printf("duplicate registration should have failed (3): "); goto error; } id = StorageRegister(STORAGE_HOST, "test3", 0, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (4): "); goto error; } id = StorageRegister(STORAGE_HOST, "", 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (5): "); goto error; } id = StorageRegister(STORAGE_HOST, NULL, 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (6): "); goto error; } id = StorageRegister(STORAGE_MAX, "test4", 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (7): "); goto error; } id = StorageRegister(38, "test5", 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (8): "); goto error; } id = StorageRegister(-1, "test6", 8, StorageTestAlloc, StorageTestFree); if (id != -1) { printf("duplicate registration should have failed (9): "); goto error; } StorageCleanup(); return 1; error: StorageCleanup(); return 0; } void StorageRegisterTests(void) { UtRegisterTest("StorageTest01", StorageTest01); UtRegisterTest("StorageTest02", StorageTest02); UtRegisterTest("StorageTest03", StorageTest03); } #endif suricata-3.2.1/src/detect-file-data.h0000644000000000000000000000164613051004444014255 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FILEDATA_H__ #define __DETECT_FILEDATA_H__ /* prototypes */ void DetectFiledataRegister (void); #endif /* __DETECT_FILEDATA_H__ */ suricata-3.2.1/src/detect-ack.c0000644000000000000000000002167113051004444013160 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * \author Victor Julien * * Implements the "ack" keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" #include "detect-ack.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /* prototypes */ static int DetectAckSetup(DetectEngineCtx *, Signature *, char *); static int DetectAckMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static void DetectAckRegisterTests(void); static void DetectAckFree(void *); static int PrefilterSetupTcpAck(SigGroupHead *sgh); static _Bool PrefilterTcpAckIsPrefilterable(const Signature *s); void DetectAckRegister(void) { sigmatch_table[DETECT_ACK].name = "ack"; sigmatch_table[DETECT_ACK].desc = "check for a specific TCP acknowledgement number"; sigmatch_table[DETECT_ACK].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ack"; sigmatch_table[DETECT_ACK].Match = DetectAckMatch; sigmatch_table[DETECT_ACK].Setup = DetectAckSetup; sigmatch_table[DETECT_ACK].Free = DetectAckFree; sigmatch_table[DETECT_ACK].SupportsPrefilter = PrefilterTcpAckIsPrefilterable; sigmatch_table[DETECT_ACK].SetupPrefilter = PrefilterSetupTcpAck; sigmatch_table[DETECT_ACK].RegisterTests = DetectAckRegisterTests; } /** * \internal * \brief This function is used to match packets with a given Ack number * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectAckData * * \retval 0 no match * \retval 1 match */ static int DetectAckMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectAckData *data = (const DetectAckData *)ctx; /* This is only needed on TCP packets */ if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p)) { return 0; } return (data->ack == TCP_GET_ACK(p)) ? 1 : 0; } /** * \internal * \brief this function is used to add the ack option into the signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectAckSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { DetectAckData *data = NULL; SigMatch *sm = NULL; data = SCMalloc(sizeof(DetectAckData)); if (unlikely(data == NULL)) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ACK; if (-1 == ByteExtractStringUint32(&data->ack, 10, 0, optstr)) { goto error; } sm->ctx = (SigMatchCtx*)data; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (data) SCFree(data); if (sm) SigMatchFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with ack option * * \param data pointer to ack configuration data */ static void DetectAckFree(void *ptr) { DetectAckData *data = (DetectAckData *)ptr; SCFree(data); } /* prefilter code */ static void PrefilterPacketAckMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; if ((p->proto) == IPPROTO_TCP && !(PKT_IS_PSEUDOPKT(p)) && (p->tcph != NULL) && (TCP_GET_ACK(p) == ctx->v1.u32[0])) { SCLogDebug("packet matches TCP ack %u", ctx->v1.u32[0]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketAckSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectAckData *a = smctx; v->u32[0] = a->ack; } static _Bool PrefilterPacketAckCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectAckData *a = smctx; if (v.u32[0] == a->ack) return TRUE; return FALSE; } static int PrefilterSetupTcpAck(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_ACK, PrefilterPacketAckSet, PrefilterPacketAckCompare, PrefilterPacketAckMatch); } static _Bool PrefilterTcpAckIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ACK: return TRUE; } } return FALSE; } #ifdef UNITTESTS /** * \internal * \brief This test tests sameip success and failure. */ static int DetectAckSigTest01(void) { Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); /* TCP w/ack=42 */ p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p1->tcph->th_ack = htonl(42); /* TCP w/ack=100 */ p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2->tcph->th_ack = htonl(100); /* ICMP */ p3 = UTHBuildPacket(NULL, 0, IPPROTO_ICMP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; /* These three are crammed in here as there is no Parse */ if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing ack\";ack:foo;sid:1;)") != NULL) { printf("invalid ack accepted: "); goto cleanup_engine; } if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing ack\";ack:9999999999;sid:1;)") != NULL) { printf("overflowing ack accepted: "); goto cleanup_engine; } if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing ack\";ack:-100;sid:1;)") != NULL) { printf("negative ack accepted: "); goto cleanup_engine; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing ack\";ack:41;sid:1;)"); if (de_ctx->sig_list == NULL) { goto cleanup_engine; } de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing ack\";ack:42;sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto cleanup_engine; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1) != 0) { printf("sid 1 alerted, but should not have: "); goto cleanup; } if (PacketAlertCheck(p1, 2) == 0) { printf("sid 2 did not alert, but should have: "); goto cleanup; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1) != 0) { printf("sid 1 alerted, but should not have: "); goto cleanup; } if (PacketAlertCheck(p2, 2) != 0) { printf("sid 2 alerted, but should not have: "); goto cleanup; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p3); if (PacketAlertCheck(p3, 1) != 0) { printf("sid 1 alerted, but should not have: "); goto cleanup; } if (PacketAlertCheck(p3, 2) != 0) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); cleanup_engine: DetectEngineCtxFree(de_ctx); end: return result; } #endif /* UNITTESTS */ /** * \internal * \brief This function registers unit tests for DetectAck */ static void DetectAckRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectAckSigTest01", DetectAckSigTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-pcap-file.c0000644000000000000000000003505513051004444014313 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * File based pcap packet acquisition support */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "source-pcap-file.h" #include "util-time.h" #include "util-debug.h" #include "conf.h" #include "util-error.h" #include "util-privs.h" #include "tmqh-packetpool.h" #include "tm-threads.h" #include "util-optimize.h" #include "flow-manager.h" #include "util-profiling.h" #include "runmode-unix-socket.h" #include "util-checksum.h" #include "util-atomic.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda.h" #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #include "util-cuda-handlers.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ extern int max_pending_packets; typedef struct PcapFileGlobalVars_ { pcap_t *pcap_handle; int (*Decoder)(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int datalink; struct bpf_program filter; uint64_t cnt; /** packet counter */ ChecksumValidationMode conf_checksum_mode; ChecksumValidationMode checksum_mode; SC_ATOMIC_DECLARE(unsigned int, invalid_checksums); } PcapFileGlobalVars; typedef struct PcapFileThreadVars_ { uint32_t tenant_id; /* counters */ uint32_t pkts; uint64_t bytes; ThreadVars *tv; TmSlot *slot; /** callback result -- set if one of the thread module failed. */ int cb_result; uint8_t done; uint32_t errs; } PcapFileThreadVars; static PcapFileGlobalVars pcap_g; TmEcode ReceivePcapFileLoop(ThreadVars *, void *, void *); TmEcode ReceivePcapFileThreadInit(ThreadVars *, void *, void **); void ReceivePcapFileThreadExitStats(ThreadVars *, void *); TmEcode ReceivePcapFileThreadDeinit(ThreadVars *, void *); TmEcode DecodePcapFile(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode DecodePcapFileThreadInit(ThreadVars *, void *, void **); TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data); void TmModuleReceivePcapFileRegister (void) { tmm_modules[TMM_RECEIVEPCAPFILE].name = "ReceivePcapFile"; tmm_modules[TMM_RECEIVEPCAPFILE].ThreadInit = ReceivePcapFileThreadInit; tmm_modules[TMM_RECEIVEPCAPFILE].Func = NULL; tmm_modules[TMM_RECEIVEPCAPFILE].PktAcqLoop = ReceivePcapFileLoop; tmm_modules[TMM_RECEIVEPCAPFILE].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEPCAPFILE].ThreadExitPrintStats = ReceivePcapFileThreadExitStats; tmm_modules[TMM_RECEIVEPCAPFILE].ThreadDeinit = ReceivePcapFileThreadDeinit; tmm_modules[TMM_RECEIVEPCAPFILE].RegisterTests = NULL; tmm_modules[TMM_RECEIVEPCAPFILE].cap_flags = 0; tmm_modules[TMM_RECEIVEPCAPFILE].flags = TM_FLAG_RECEIVE_TM; } void TmModuleDecodePcapFileRegister (void) { tmm_modules[TMM_DECODEPCAPFILE].name = "DecodePcapFile"; tmm_modules[TMM_DECODEPCAPFILE].ThreadInit = DecodePcapFileThreadInit; tmm_modules[TMM_DECODEPCAPFILE].Func = DecodePcapFile; tmm_modules[TMM_DECODEPCAPFILE].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEPCAPFILE].ThreadDeinit = DecodePcapFileThreadDeinit; tmm_modules[TMM_DECODEPCAPFILE].RegisterTests = NULL; tmm_modules[TMM_DECODEPCAPFILE].cap_flags = 0; tmm_modules[TMM_DECODEPCAPFILE].flags = TM_FLAG_DECODE_TM; } void PcapFileGlobalInit() { memset(&pcap_g, 0x00, sizeof(pcap_g)); SC_ATOMIC_INIT(pcap_g.invalid_checksums); } void PcapFileCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) { SCEnter(); PcapFileThreadVars *ptv = (PcapFileThreadVars *)user; Packet *p = PacketGetFromQueueOrAlloc(); if (unlikely(p == NULL)) { SCReturn; } PACKET_PROFILING_TMM_START(p, TMM_RECEIVEPCAPFILE); PKT_SET_SRC(p, PKT_SRC_WIRE); p->ts.tv_sec = h->ts.tv_sec; p->ts.tv_usec = h->ts.tv_usec; SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec); p->datalink = pcap_g.datalink; p->pcap_cnt = ++pcap_g.cnt; p->pcap_v.tenant_id = ptv->tenant_id; ptv->pkts++; ptv->bytes += h->caplen; if (unlikely(PacketCopyData(p, pkt, h->caplen))) { TmqhOutputPacketpool(ptv->tv, p); PACKET_PROFILING_TMM_END(p, TMM_RECEIVEPCAPFILE); SCReturn; } /* We only check for checksum disable */ if (pcap_g.checksum_mode == CHECKSUM_VALIDATION_DISABLE) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (pcap_g.checksum_mode == CHECKSUM_VALIDATION_AUTO) { if (ChecksumAutoModeCheck(ptv->pkts, p->pcap_cnt, SC_ATOMIC_GET(pcap_g.invalid_checksums))) { pcap_g.checksum_mode = CHECKSUM_VALIDATION_DISABLE; p->flags |= PKT_IGNORE_CHECKSUM; } } PACKET_PROFILING_TMM_END(p, TMM_RECEIVEPCAPFILE); if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { pcap_breakloop(pcap_g.pcap_handle); ptv->cb_result = TM_ECODE_FAILED; } SCReturn; } /** * \brief Main PCAP file reading Loop function */ TmEcode ReceivePcapFileLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); int packet_q_len = 64; PcapFileThreadVars *ptv = (PcapFileThreadVars *)data; int r; TmSlot *s = (TmSlot *)slot; ptv->slot = s->slot_next; ptv->cb_result = TM_ECODE_OK; while (1) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); /* Right now we just support reading packets one at a time. */ r = pcap_dispatch(pcap_g.pcap_handle, packet_q_len, (pcap_handler)PcapFileCallbackLoop, (u_char *)ptv); if (unlikely(r == -1)) { SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s", r, pcap_geterr(pcap_g.pcap_handle)); if (ptv->cb_result == TM_ECODE_FAILED) { SCReturnInt(TM_ECODE_FAILED); } if (! RunModeUnixSocketIsActive()) { EngineStop(); } else { pcap_close(pcap_g.pcap_handle); pcap_g.pcap_handle = NULL; UnixSocketPcapFile(TM_ECODE_DONE); SCReturnInt(TM_ECODE_DONE); } } else if (unlikely(r == 0)) { SCLogInfo("pcap file end of file reached (pcap err code %" PRId32 ")", r); if (! RunModeUnixSocketIsActive()) { EngineStop(); } else { pcap_close(pcap_g.pcap_handle); pcap_g.pcap_handle = NULL; UnixSocketPcapFile(TM_ECODE_DONE); SCReturnInt(TM_ECODE_DONE); } break; } else if (ptv->cb_result == TM_ECODE_FAILED) { SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapFileCallbackLoop failed"); if (! RunModeUnixSocketIsActive()) { SCReturnInt(TM_ECODE_FAILED); } else { pcap_close(pcap_g.pcap_handle); pcap_g.pcap_handle = NULL; UnixSocketPcapFile(TM_ECODE_DONE); SCReturnInt(TM_ECODE_DONE); } } StatsSyncCountersIfSignalled(tv); } SCReturnInt(TM_ECODE_OK); } TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); char *tmpbpfstring = NULL; char *tmpstring = NULL; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "error: initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("reading pcap file %s", (char *)initdata); PcapFileThreadVars *ptv = SCMalloc(sizeof(PcapFileThreadVars)); if (unlikely(ptv == NULL)) SCReturnInt(TM_ECODE_FAILED); memset(ptv, 0, sizeof(PcapFileThreadVars)); intmax_t tenant = 0; if (ConfGetInt("pcap-file.tenant-id", &tenant) == 1) { if (tenant > 0 && tenant < UINT_MAX) { ptv->tenant_id = (uint32_t)tenant; SCLogInfo("tenant %u", ptv->tenant_id); } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant out of range"); } } char errbuf[PCAP_ERRBUF_SIZE] = ""; pcap_g.pcap_handle = pcap_open_offline((char *)initdata, errbuf); if (pcap_g.pcap_handle == NULL) { SCLogError(SC_ERR_FOPEN, "%s\n", errbuf); SCFree(ptv); if (! RunModeUnixSocketIsActive()) { return TM_ECODE_FAILED; } else { UnixSocketPcapFile(TM_ECODE_FAILED); SCReturnInt(TM_ECODE_DONE); } } if (ConfGet("bpf-filter", &tmpbpfstring) != 1) { SCLogDebug("could not get bpf or none specified"); } else { SCLogInfo("using bpf-filter \"%s\"", tmpbpfstring); if (pcap_compile(pcap_g.pcap_handle, &pcap_g.filter, tmpbpfstring, 1, 0) < 0) { SCLogError(SC_ERR_BPF,"bpf compilation error %s", pcap_geterr(pcap_g.pcap_handle)); SCFree(ptv); return TM_ECODE_FAILED; } if (pcap_setfilter(pcap_g.pcap_handle, &pcap_g.filter) < 0) { SCLogError(SC_ERR_BPF,"could not set bpf filter %s", pcap_geterr(pcap_g.pcap_handle)); SCFree(ptv); return TM_ECODE_FAILED; } } pcap_g.datalink = pcap_datalink(pcap_g.pcap_handle); SCLogDebug("datalink %" PRId32 "", pcap_g.datalink); switch (pcap_g.datalink) { case LINKTYPE_LINUX_SLL: pcap_g.Decoder = DecodeSll; break; case LINKTYPE_ETHERNET: pcap_g.Decoder = DecodeEthernet; break; case LINKTYPE_PPP: pcap_g.Decoder = DecodePPP; break; case LINKTYPE_RAW: pcap_g.Decoder = DecodeRaw; break; case LINKTYPE_NULL: pcap_g.Decoder = DecodeNull; break; default: SCLogError(SC_ERR_UNIMPLEMENTED, "datalink type %" PRId32 " not " "(yet) supported in module PcapFile.\n", pcap_g.datalink); SCFree(ptv); if (! RunModeUnixSocketIsActive()) { SCReturnInt(TM_ECODE_FAILED); } else { pcap_close(pcap_g.pcap_handle); pcap_g.pcap_handle = NULL; UnixSocketPcapFile(TM_ECODE_DONE); SCReturnInt(TM_ECODE_DONE); } } if (ConfGet("pcap-file.checksum-checks", &tmpstring) != 1) { pcap_g.conf_checksum_mode = CHECKSUM_VALIDATION_AUTO; } else { if (strcmp(tmpstring, "auto") == 0) { pcap_g.conf_checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (ConfValIsTrue(tmpstring)){ pcap_g.conf_checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(tmpstring)) { pcap_g.conf_checksum_mode = CHECKSUM_VALIDATION_DISABLE; } } pcap_g.checksum_mode = pcap_g.conf_checksum_mode; ptv->tv = tv; *data = (void *)ptv; SCReturnInt(TM_ECODE_OK); } void ReceivePcapFileThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); PcapFileThreadVars *ptv = (PcapFileThreadVars *)data; if (pcap_g.conf_checksum_mode == CHECKSUM_VALIDATION_AUTO && pcap_g.cnt < CHECKSUM_SAMPLE_COUNT && SC_ATOMIC_GET(pcap_g.invalid_checksums)) { uint64_t chrate = pcap_g.cnt / SC_ATOMIC_GET(pcap_g.invalid_checksums); if (chrate < CHECKSUM_INVALID_RATIO) SCLogWarning(SC_ERR_INVALID_CHECKSUM, "1/%" PRIu64 "th of packets have an invalid checksum," " consider setting pcap-file.checksum-checks variable to no" " or use '-k none' option on command line.", chrate); else SCLogInfo("1/%" PRIu64 "th of packets have an invalid checksum", chrate); } SCLogNotice("Pcap-file module read %" PRIu32 " packets, %" PRIu64 " bytes", ptv->pkts, ptv->bytes); return; } TmEcode ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); PcapFileThreadVars *ptv = (PcapFileThreadVars *)data; if (ptv) { SCFree(ptv); } SCReturnInt(TM_ECODE_OK); } static double prev_signaled_ts = 0; TmEcode DecodePcapFile(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); double curr_ts = p->ts.tv_sec + p->ts.tv_usec / 1000.0; if (curr_ts < prev_signaled_ts || (curr_ts - prev_signaled_ts) > 60.0) { prev_signaled_ts = curr_ts; FlowWakeupFlowManagerThread(); } /* call the decoder */ pcap_g.Decoder(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); #ifdef DEBUG BUG_ON(p->pkt_src != PKT_SRC_WIRE && p->pkt_src != PKT_SRC_FFR); #endif PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } TmEcode DecodePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); #ifdef __SC_CUDA_SUPPORT__ if (CudaThreadVarsInit(&dtv->cuda_vars) < 0) SCReturnInt(TM_ECODE_FAILED); #endif *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodePcapFileThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } void PcapIncreaseInvalidChecksum() { (void) SC_ATOMIC_ADD(pcap_g.invalid_checksums, 1); } /* eof */ suricata-3.2.1/src/stream.c0000644000000000000000000001707613051004444012453 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Stream Chunk Handling API */ #include "suricata-common.h" #include "decode.h" #include "threads.h" #include "stream.h" #include "util-pool.h" #include "util-debug.h" #include "stream-tcp.h" #include "flow-util.h" #ifdef DEBUG static SCMutex stream_pool_memuse_mutex; static uint64_t stream_pool_memuse = 0; static uint64_t stream_pool_memcnt = 0; #endif /* per queue setting */ static uint16_t toserver_min_chunk_len = 2560; static uint16_t toclient_min_chunk_len = 2560; static Pool *stream_msg_pool = NULL; static SCMutex stream_msg_pool_mutex = SCMUTEX_INITIALIZER; static void StreamMsgEnqueue (StreamMsgQueue *q, StreamMsg *s) { SCEnter(); SCLogDebug("s %p", s); /* more packets in queue */ if (q->top != NULL) { s->next = q->top; q->top->prev = s; q->top = s; /* only packet */ } else { q->top = s; q->bot = s; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ SCReturn; } static StreamMsg *StreamMsgDequeue (StreamMsgQueue *q) { SCEnter(); /* if the queue is empty there are no packets left. * In that case we sleep and try again. */ if (q->len == 0) { SCReturnPtr(NULL, "StreamMsg"); } /* pull the bottom packet from the queue */ StreamMsg *s = q->bot; /* more packets in queue */ if (q->bot->prev != NULL) { q->bot = q->bot->prev; q->bot->next = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } q->len--; s->next = NULL; s->prev = NULL; SCReturnPtr(s, "StreamMsg"); } /* Used by stream reassembler to get msgs */ StreamMsg *StreamMsgGetFromPool(void) { SCMutexLock(&stream_msg_pool_mutex); StreamMsg *s = (StreamMsg *)PoolGet(stream_msg_pool); SCMutexUnlock(&stream_msg_pool_mutex); return s; } /* Used by l7inspection to return msgs to pool */ void StreamMsgReturnToPool(StreamMsg *s) { SCLogDebug("s %p", s); SCMutexLock(&stream_msg_pool_mutex); PoolReturn(stream_msg_pool, (void *)s); SCMutexUnlock(&stream_msg_pool_mutex); } /* Used by l7inspection to get msgs with data */ StreamMsg *StreamMsgGetFromQueue(StreamMsgQueue *q) { if (q->len > 0) { StreamMsg *s = StreamMsgDequeue(q); return s; } else { /* return NULL if we have no stream msg. Should only happen on signals. */ return NULL; } } /* Used by stream reassembler to fill the queue for l7inspect reading */ void StreamMsgPutInQueue(StreamMsgQueue *q, StreamMsg *s) { StreamMsgEnqueue(q, s); SCLogDebug("q->len %" PRIu32 "", q->len); } #define SIZE 4072 void *StreamMsgPoolAlloc(void) { if (StreamTcpReassembleCheckMemcap((uint32_t)(sizeof(StreamMsg)+SIZE)) == 0) return NULL; StreamMsg *m = SCCalloc(1, (sizeof(StreamMsg) + SIZE)); if (m != NULL) { m->data = (uint8_t *)m + sizeof(StreamMsg); m->data_size = SIZE; StreamTcpReassembleIncrMemuse((uint32_t)(sizeof(StreamMsg)+SIZE)); } return m; } int StreamMsgInit(void *data, void *initdata) { StreamMsg *s = data; memset(s->data, 0, s->data_size); #ifdef DEBUG SCMutexLock(&stream_pool_memuse_mutex); stream_pool_memuse += (sizeof(StreamMsg) + SIZE); stream_pool_memcnt ++; SCMutexUnlock(&stream_pool_memuse_mutex); #endif return 1; } void StreamMsgPoolFree(void *ptr) { if (ptr) { SCFree(ptr); StreamTcpReassembleDecrMemuse((uint32_t)(sizeof(StreamMsg)+SIZE)); } } void StreamMsgQueuesInit(uint32_t prealloc) { #ifdef DEBUG SCMutexInit(&stream_pool_memuse_mutex, NULL); #endif SCMutexLock(&stream_msg_pool_mutex); stream_msg_pool = PoolInit(0, prealloc, 0, StreamMsgPoolAlloc,StreamMsgInit, NULL,NULL,StreamMsgPoolFree); if (stream_msg_pool == NULL) exit(EXIT_FAILURE); /* XXX */ SCMutexUnlock(&stream_msg_pool_mutex); } void StreamMsgQueuesDeinit(char quiet) { if (quiet == FALSE) { if (stream_msg_pool->max_outstanding > stream_msg_pool->allocated) SCLogInfo("TCP segment chunk pool had a peak use of %u chunks, " "more than the prealloc setting of %u", stream_msg_pool->max_outstanding, stream_msg_pool->allocated); } SCMutexLock(&stream_msg_pool_mutex); PoolFree(stream_msg_pool); SCMutexUnlock(&stream_msg_pool_mutex); #ifdef DEBUG SCMutexDestroy(&stream_pool_memuse_mutex); if (quiet == FALSE) SCLogDebug("stream_pool_memuse %"PRIu64", stream_pool_memcnt %"PRIu64"", stream_pool_memuse, stream_pool_memcnt); #endif } /** \brief alloc a stream msg queue * \retval smq ptr to the queue or NULL */ StreamMsgQueue *StreamMsgQueueGetNew(void) { if (StreamTcpReassembleCheckMemcap((uint32_t)sizeof(StreamMsgQueue)) == 0) return NULL; StreamMsgQueue *smq = SCMalloc(sizeof(StreamMsgQueue)); if (unlikely(smq == NULL)) return NULL; StreamTcpReassembleIncrMemuse((uint32_t)sizeof(StreamMsgQueue)); memset(smq, 0x00, sizeof(StreamMsgQueue)); return smq; } /** \brief Free a StreamMsgQueue * \param q the queue to free * \todo we may want to consider non empty queue's */ void StreamMsgQueueFree(StreamMsgQueue *q) { SCFree(q); StreamTcpReassembleDecrMemuse((uint32_t)sizeof(StreamMsgQueue)); } void StreamMsgQueueSetMinChunkLen(uint8_t dir, uint16_t len) { if (dir == FLOW_PKT_TOSERVER) { toserver_min_chunk_len = len; } else { toclient_min_chunk_len = len; } } uint16_t StreamMsgQueueGetMinChunkLen(uint8_t dir) { if (dir == FLOW_PKT_TOSERVER) { return toserver_min_chunk_len; } else { return toclient_min_chunk_len; } } /** \brief Return a list of smsgs to the pool */ void StreamMsgReturnListToPool(void *list) { /* if we have (a) smsg(s), return to the pool */ StreamMsg *smsg = (StreamMsg *)list; while (smsg != NULL) { StreamMsg *smsg_next = smsg->next; SCLogDebug("returning smsg %p to pool", smsg); smsg->next = NULL; smsg->prev = NULL; StreamMsgReturnToPool(smsg); smsg = smsg_next; } } /** \brief Run callback for all segments * * Must be called under flow lock. * * \return -1 in case of error, the number of segment in case of success */ int StreamSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data) { switch(p->proto) { case IPPROTO_TCP: return StreamTcpSegmentForEach(p, flag, CallbackFunc, data); break; #ifdef DEBUG case IPPROTO_UDP: SCLogWarning(SC_ERR_UNKNOWN_PROTOCOL, "UDP is currently unsupported"); break; default: SCLogWarning(SC_ERR_UNKNOWN_PROTOCOL, "This protocol is currently unsupported"); break; #endif } return 0; } suricata-3.2.1/src/ippair-storage.h0000644000000000000000000000257213051004444014106 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * IPPair wrapper around storage api */ #ifndef __IPPAIR_STORAGE_H__ #define __IPPAIR_STORAGE_H__ #include "util-storage.h" #include "ippair.h" unsigned int IPPairStorageSize(void); void *IPPairGetStorageById(IPPair *h, int id); int IPPairSetStorageById(IPPair *h, int id, void *ptr); void *IPPairAllocStorageById(IPPair *h, int id); void IPPairFreeStorageById(IPPair *h, int id); void IPPairFreeStorage(IPPair *h); void RegisterIPPairStorageTests(void); int IPPairStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)); #endif /* __IPPAIR_STORAGE_H__ */ suricata-3.2.1/src/util-lua-common.h0000644000000000000000000000262213051004444014176 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_LUA_COMMON_H__ #define __UTIL_LUA_COMMON_H__ #ifdef HAVE_LUA int LuaCallbackError(lua_State *luastate, const char *msg); const char *LuaGetStringArgument(lua_State *luastate, int argc); void LuaPushTableKeyValueInt(lua_State *luastate, const char *key, int value); void LuaPushTableKeyValueString(lua_State *luastate, const char *key, const char *value); void LuaPushTableKeyValueArray(lua_State *luastate, const char *key, const uint8_t *value, size_t len); int LuaRegisterFunctions(lua_State *luastate); int LuaStateNeedProto(lua_State *luastate, AppProto alproto); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_COMMON_H__ */ suricata-3.2.1/src/util-prefilter.c0000644000000000000000000000715613051004444014125 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Pattern matcher utility Functions */ #include "suricata-common.h" /** * \brief Setup a pmq * * \param pmq Pattern matcher queue to be initialized * * \retval -1 error * \retval 0 ok */ int PmqSetup(PrefilterRuleStore *pmq) { SCEnter(); if (pmq == NULL) { SCReturnInt(-1); } memset(pmq, 0, sizeof(PrefilterRuleStore)); pmq->rule_id_array_size = 128; /* Initial size, TODO: Make configure option. */ pmq->rule_id_array_cnt = 0; size_t bytes = pmq->rule_id_array_size * sizeof(SigIntId); pmq->rule_id_array = (SigIntId*)SCMalloc(bytes); if (pmq->rule_id_array == NULL) { pmq->rule_id_array_size = 0; SCReturnInt(-1); } // Don't need to zero memory since it is always written first. SCReturnInt(0); } /** \brief Add array of Signature IDs to rule ID array. * * Checks size of the array first * * \param pmq storage for match results * \param new_size number of Signature IDs needing to be stored. * */ int PrefilterAddSidsResize(PrefilterRuleStore *pmq, uint32_t new_size) { /* Need to make the array bigger. Double the size needed to * also handle the case that sids_size might still be * larger than the old size. */ new_size = new_size * 2; SigIntId *new_array = (SigIntId*)SCRealloc(pmq->rule_id_array, new_size * sizeof(SigIntId)); if (unlikely(new_array == NULL)) { /* Try again just big enough. */ new_size = new_size / 2; new_array = (SigIntId*)SCRealloc(pmq->rule_id_array, new_size * sizeof(SigIntId)); if (unlikely(new_array == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to realloc PatternMatchQueue" " rule ID array. Some signature ID matches lost"); return 0; } } pmq->rule_id_array = new_array; pmq->rule_id_array_size = new_size; return new_size; } /** \brief Reset a Pmq for reusage. Meant to be called after a single search. * \param pmq Pattern matcher to be reset. * \todo memset is expensive, but we need it as we merge pmq's. We might use * a flag so we can clear pmq's the old way if we can. */ void PmqReset(PrefilterRuleStore *pmq) { if (pmq == NULL) return; pmq->rule_id_array_cnt = 0; /* TODO: Realloc the rule id array smaller at some size? */ } /** \brief Cleanup a Pmq * \param pmq Pattern matcher queue to be cleaned up. */ void PmqCleanup(PrefilterRuleStore *pmq) { if (pmq == NULL) return; if (pmq->rule_id_array != NULL) { SCFree(pmq->rule_id_array); pmq->rule_id_array = NULL; } } /** \brief Cleanup and free a Pmq * \param pmq Pattern matcher queue to be free'd. */ void PmqFree(PrefilterRuleStore *pmq) { if (pmq == NULL) return; PmqCleanup(pmq); } suricata-3.2.1/src/app-layer-parser.c0000644000000000000000000013600013051004444014331 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Generic App-layer parsing functions. */ #include "suricata-common.h" #include "debug.h" #include "util-unittest.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "flow-util.h" #include "flow-private.h" #include "detect-engine-state.h" #include "detect-engine-port.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream.h" #include "stream-tcp-reassemble.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-smb.h" #include "app-layer-smb2.h" #include "app-layer-dcerpc.h" #include "app-layer-dcerpc-udp.h" #include "app-layer-htp.h" #include "app-layer-ftp.h" #include "app-layer-ssl.h" #include "app-layer-ssh.h" #include "app-layer-smtp.h" #include "app-layer-dns-udp.h" #include "app-layer-dns-tcp.h" #include "app-layer-modbus.h" #include "app-layer-enip.h" #include "app-layer-dnp3.h" #include "app-layer-template.h" #include "conf.h" #include "util-spm.h" #include "util-debug.h" #include "decode-events.h" #include "util-unittest-helper.h" #include "util-validate.h" #include "runmodes.h" static GetActiveTxIdFunc AppLayerGetActiveTxIdFuncPtr = NULL; struct AppLayerParserThreadCtx_ { void *alproto_local_storage[FLOW_PROTO_MAX][ALPROTO_MAX]; }; /** * \brief App layer protocol parser context. */ typedef struct AppLayerParserProtoCtx_ { /* 0 - to_server, 1 - to_client. */ int (*Parser[2])(Flow *f, void *protocol_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_storage); char logger; void *(*StateAlloc)(void); void (*StateFree)(void *); void (*StateTransactionFree)(void *, uint64_t); void *(*LocalStorageAlloc)(void); void (*LocalStorageFree)(void *); void (*Truncate)(void *, uint8_t); FileContainer *(*StateGetFiles)(void *, uint8_t); AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t); int (*StateHasEvents)(void *); int (*StateGetProgress)(void *alstate, uint8_t direction); uint64_t (*StateGetTxCnt)(void *alstate); void *(*StateGetTx)(void *alstate, uint64_t tx_id); int (*StateGetProgressCompletionStatus)(uint8_t direction); int (*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type); int (*StateGetTxLogged)(void *alstate, void *tx, uint32_t logger); void (*StateSetTxLogged)(void *alstate, void *tx, uint32_t logger); int (*StateHasTxDetectState)(void *alstate); DetectEngineState *(*GetTxDetectState)(void *tx); int (*SetTxDetectState)(void *alstate, void *tx, DetectEngineState *); /* each app-layer has its own value */ uint32_t stream_depth; /* Indicates the direction the parser is ready to see the data * the first time for a flow. Values accepted - * STREAM_TOSERVER, STREAM_TOCLIENT */ uint8_t first_data_dir; #ifdef UNITTESTS void (*RegisterUnittests)(void); #endif } AppLayerParserProtoCtx; typedef struct AppLayerParserCtx_ { AppLayerParserProtoCtx ctxs[FLOW_PROTO_MAX][ALPROTO_MAX]; } AppLayerParserCtx; struct AppLayerParserState_ { uint8_t flags; /* State version, incremented for each update. Can wrap around. */ uint8_t version; /* Indicates the current transaction that is being inspected. * We have a var per direction. */ uint64_t inspect_id[2]; /* Indicates the current transaction being logged. Unlike inspect_id, * we don't need a var per direction since we don't log a transaction * unless we have the entire transaction. */ uint64_t log_id; /* Used to store decoder events. */ AppLayerDecoderEvents *decoder_events; }; /* Static global version of the parser context. * Post 2.0 let's look at changing this to move it out to app-layer.c. */ static AppLayerParserCtx alp_ctx; int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto) { uint8_t ipproto_map = FlowGetProtoMapping(ipproto); return (alp_ctx.ctxs[ipproto_map][alproto].StateAlloc != NULL) ? 1 : 0; } AppLayerParserState *AppLayerParserStateAlloc(void) { SCEnter(); AppLayerParserState *pstate = (AppLayerParserState *)SCMalloc(sizeof(*pstate)); if (pstate == NULL) goto end; memset(pstate, 0, sizeof(*pstate)); end: SCReturnPtr(pstate, "AppLayerParserState"); } void AppLayerParserStateFree(AppLayerParserState *pstate) { SCEnter(); if (pstate->decoder_events != NULL) AppLayerDecoderEventsFreeEvents(&pstate->decoder_events); SCFree(pstate); SCReturn; } int AppLayerParserSetup(void) { SCEnter(); AppProto alproto = 0; int flow_proto = 0; memset(&alp_ctx, 0, sizeof(alp_ctx)); /* set the default tx handler if none was set explicitly */ if (AppLayerGetActiveTxIdFuncPtr == NULL) { RegisterAppLayerGetActiveTxIdFunc(AppLayerTransactionGetActiveDetectLog); } /* lets set a default value for stream_depth */ for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) { for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { alp_ctx.ctxs[flow_proto][alproto].stream_depth = stream_config.reassembly_depth; } } SCReturnInt(0); } int AppLayerParserDeSetup(void) { SCEnter(); SMTPParserCleanup(); SCReturnInt(0); } AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void) { SCEnter(); AppProto alproto = 0; int flow_proto = 0; AppLayerParserThreadCtx *tctx; tctx = SCMalloc(sizeof(*tctx)); if (tctx == NULL) goto end; memset(tctx, 0, sizeof(*tctx)); for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) { for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto); tctx->alproto_local_storage[flow_proto][alproto] = AppLayerParserGetProtocolParserLocalStorage(ipproto, alproto); } } end: SCReturnPtr(tctx, "void *"); } void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx) { SCEnter(); AppProto alproto = 0; int flow_proto = 0; for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) { for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto); AppLayerParserDestroyProtocolParserLocalStorage(ipproto, alproto, tctx->alproto_local_storage[flow_proto][alproto]); } } SCFree(tctx); SCReturn; } /** \brief check if a parser is enabled in the config * Returns enabled always if: were running unittests and * when compiled with --enable-afl */ int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name) { SCEnter(); int enabled = 1; char param[100]; ConfNode *node; int r; #ifdef AFLFUZZ_APPLAYER goto enabled; #endif if (RunmodeIsUnittests()) goto enabled; r = snprintf(param, sizeof(param), "%s%s%s", "app-layer.protocols.", alproto_name, ".enabled"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) { SCLogDebug("Entry for %s not found.", param); r = snprintf(param, sizeof(param), "%s%s%s%s%s", "app-layer.protocols.", alproto_name, ".", ipproto, ".enabled"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) { SCLogDebug("Entry for %s not found.", param); goto enabled; } } if (ConfValIsTrue(node->val)) { goto enabled; } else if (ConfValIsFalse(node->val)) { goto disabled; } else if (strcasecmp(node->val, "detection-only") == 0) { goto disabled; } else { SCLogError(SC_ERR_FATAL, "Invalid value found for %s.", param); exit(EXIT_FAILURE); } disabled: enabled = 0; enabled: SCReturnInt(enabled); } /***** Parser related registration *****/ int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, int (*Parser)(Flow *f, void *protocol_state, AppLayerParserState *pstate, uint8_t *buf, uint32_t buf_len, void *local_storage)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. Parser[(direction & STREAM_TOSERVER) ? 0 : 1] = Parser; SCReturnInt(0); } void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].first_data_dir |= (direction & (STREAM_TOSERVER | STREAM_TOCLIENT)); SCReturn; } void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void (*StateFree)(void *)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateAlloc = StateAlloc; alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateFree = StateFree; SCReturn; } void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void (*LocalStorageFree)(void *)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].LocalStorageAlloc = LocalStorageAlloc; alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].LocalStorageFree = LocalStorageFree; SCReturn; } void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetFiles = StateGetFiles; SCReturn; } void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetEvents = StateGetEvents; SCReturn; } void AppLayerParserRegisterHasEventsFunc(uint8_t ipproto, AppProto alproto, int (*StateHasEvents)(void *)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasEvents = StateHasEvents; SCReturn; } void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, int (*StateGetTxLogged)(void *, void *, uint32_t), void (*StateSetTxLogged)(void *, void *, uint32_t)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetTxLogged = StateGetTxLogged; alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateSetTxLogged = StateSetTxLogged; SCReturn; } void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].logger = TRUE; SCReturn; } void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void (*Truncate)(void *, uint8_t)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate = Truncate; SCReturn; } void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int (*StateGetProgress)(void *alstate, uint8_t direction)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetProgress = StateGetProgress; SCReturn; } void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void (*StateTransactionFree)(void *, uint64_t)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateTransactionFree = StateTransactionFree; SCReturn; } void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t (*StateGetTxCnt)(void *alstate)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTxCnt = StateGetTxCnt; SCReturn; } void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTx = StateGetTx; SCReturn; } void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int (*StateGetProgressCompletionStatus)(uint8_t direction)) { SCEnter(); alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto]. StateGetProgressCompletionStatus = StateGetProgressCompletionStatus; SCReturn; } void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int (*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetEventInfo = StateGetEventInfo; SCReturn; } void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, int (*StateHasTxDetectState)(void *alstate), DetectEngineState *(*GetTxDetectState)(void *tx), int (*SetTxDetectState)(void *alstate, void *tx, DetectEngineState *)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasTxDetectState = StateHasTxDetectState; alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectState = GetTxDetectState; alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectState = SetTxDetectState; SCReturn; } /***** Get and transaction functions *****/ void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto) { SCEnter(); void * r = NULL; if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. LocalStorageAlloc != NULL) { r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. LocalStorageAlloc(); } SCReturnPtr(r, "void *"); } void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data) { SCEnter(); if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. LocalStorageFree != NULL) { alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. LocalStorageFree(local_data); } SCReturn; } void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, uint32_t logger) { SCEnter(); if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateSetTxLogged != NULL) { alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateSetTxLogged(alstate, tx, logger); } SCReturn; } int AppLayerParserGetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, uint32_t logger) { SCEnter(); uint8_t r = 0; if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTxLogged != NULL) { r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTxLogged(alstate, tx, logger); } SCReturnInt(r); } uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate) { SCEnter(); SCReturnCT((pstate == NULL) ? 0 : pstate->log_id, "uint64_t"); } void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id) { SCEnter(); if (pstate != NULL) pstate->log_id = tx_id; SCReturn; } uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction) { SCEnter(); if (pstate == NULL) SCReturnCT(0ULL, "uint64_t"); SCReturnCT(pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1], "uint64_t"); } void AppLayerParserSetTransactionInspectId(AppLayerParserState *pstate, const uint8_t ipproto, const AppProto alproto, void *alstate, const uint8_t flags) { SCEnter(); int direction = (flags & STREAM_TOSERVER) ? 0 : 1; uint64_t total_txs = AppLayerParserGetTxCnt(ipproto, alproto, alstate); uint64_t idx = AppLayerParserGetTransactionInspectId(pstate, flags); int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(alproto, flags); void *tx; int state_progress; for (; idx < total_txs; idx++) { tx = AppLayerParserGetTx(ipproto, alproto, alstate, idx); if (tx == NULL) continue; state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags); if (state_progress >= state_done_progress) continue; else break; } pstate->inspect_id[direction] = idx; SCReturn; } AppLayerDecoderEvents *AppLayerParserGetDecoderEvents(AppLayerParserState *pstate) { SCEnter(); SCReturnPtr(pstate->decoder_events, "AppLayerDecoderEvents *"); } void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents) { pstate->decoder_events = devents; } AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id) { SCEnter(); AppLayerDecoderEvents *ptr = NULL; if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetEvents != NULL) { ptr = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetEvents(alstate, tx_id); } SCReturnPtr(ptr, "AppLayerDecoderEvents *"); } uint16_t AppLayerParserGetStateVersion(AppLayerParserState *pstate) { SCEnter(); SCReturnCT((pstate == NULL) ? 0 : pstate->version, "uint8_t"); } FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction) { SCEnter(); FileContainer *ptr = NULL; if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetFiles != NULL) { ptr = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetFiles(alstate, direction); } SCReturnPtr(ptr, "FileContainer *"); } /** \brief active TX retrieval for normal ops: so with detection and logging * * \retval tx_id lowest tx_id that still needs work */ uint64_t AppLayerTransactionGetActiveDetectLog(Flow *f, uint8_t flags) { AppLayerParserProtoCtx *p = &alp_ctx.ctxs[FlowGetProtoMapping(f->proto)][f->alproto]; uint64_t log_id = f->alparser->log_id; uint64_t inspect_id = f->alparser->inspect_id[flags & STREAM_TOSERVER ? 0 : 1]; if (p->logger == TRUE) { return (log_id < inspect_id) ? log_id : inspect_id; } else { return inspect_id; } } /** \brief active TX retrieval for logging only: so NO detection * * If the logger is enabled, we simply return the log_id here. * * Otherwise, we go look for the tx id. There probably is no point * in running this function in that case though. With no detection * and no logging, why run a parser in the first place? **/ uint64_t AppLayerTransactionGetActiveLogOnly(Flow *f, uint8_t flags) { AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][f->alproto]; if (p->logger == TRUE) { uint64_t log_id = f->alparser->log_id; SCLogDebug("returning %"PRIu64, log_id); return log_id; } /* logger is disabled, return highest 'complete' tx id */ uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate); uint64_t idx = AppLayerParserGetTransactionInspectId(f->alparser, flags); int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(f->alproto, flags); void *tx; int state_progress; for (; idx < total_txs; idx++) { tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, idx); if (tx == NULL) continue; state_progress = AppLayerParserGetStateProgress(f->proto, f->alproto, tx, flags); if (state_progress >= state_done_progress) continue; else break; } SCLogDebug("returning %"PRIu64, idx); return idx; } void RegisterAppLayerGetActiveTxIdFunc(GetActiveTxIdFunc FuncPtr) { //BUG_ON(AppLayerGetActiveTxIdFuncPtr != NULL); AppLayerGetActiveTxIdFuncPtr = FuncPtr; SCLogDebug("AppLayerGetActiveTxIdFuncPtr is now %p", AppLayerGetActiveTxIdFuncPtr); } /** * \brief Get 'active' tx id, meaning the lowest id that still need work. * * \retval id tx id */ static uint64_t AppLayerTransactionGetActive(Flow *f, uint8_t flags) { BUG_ON(AppLayerGetActiveTxIdFuncPtr == NULL); return AppLayerGetActiveTxIdFuncPtr(f, flags); } #ifndef MIN #define MIN(a, b) (((a) < (b)) ? (a) : (b)) #endif /** * \brief remove obsolete (inspected and logged) transactions */ static void AppLayerParserTransactionsCleanup(Flow *f) { DEBUG_ASSERT_FLOW_LOCKED(f); AppLayerParserProtoCtx *p = &alp_ctx.ctxs[FlowGetProtoMapping(f->proto)][f->alproto]; if (p->StateTransactionFree == NULL) return; uint64_t tx_id_ts = AppLayerTransactionGetActive(f, STREAM_TOSERVER); uint64_t tx_id_tc = AppLayerTransactionGetActive(f, STREAM_TOCLIENT); uint64_t min = MIN(tx_id_ts, tx_id_tc); if (min > 0) { SCLogDebug("freeing %"PRIu64" %p", min - 1, p->StateTransactionFree); p->StateTransactionFree(f->alstate, min - 1); } } #define IS_DISRUPTED(flags) \ ((flags) & (STREAM_DEPTH|STREAM_GAP)) /** * \brief get the progress value for a tx/protocol * * If the stream is disrupted, we return the 'completion' value. */ int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags) { SCEnter(); int r = 0; if (unlikely(IS_DISRUPTED(flags))) { r = alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto]. StateGetProgressCompletionStatus(flags); } else { r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetProgress(alstate, flags); } SCReturnInt(r); } uint64_t AppLayerParserGetTxCnt(uint8_t ipproto, AppProto alproto, void *alstate) { SCEnter(); uint64_t r = 0; r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTxCnt(alstate); SCReturnCT(r, "uint64_t"); } void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id) { SCEnter(); void * r = NULL; r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateGetTx(alstate, tx_id); SCReturnPtr(r, "void *"); } int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction) { SCEnter(); int r = 0; r = alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto]. StateGetProgressCompletionStatus(direction); SCReturnInt(r); } int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type) { SCEnter(); int ipproto_map = FlowGetProtoMapping(ipproto); int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfo == NULL) ? -1 : alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfo(event_name, event_id, event_type); SCReturnInt(r); } uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto) { SCEnter(); uint8_t r = 0; r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. first_data_dir; SCReturnCT(r, "uint8_t"); } uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto, AppLayerParserState *pstate, uint8_t direction) { SCEnter(); uint64_t active_id; uint64_t log_id = pstate->log_id; uint64_t inspect_id = pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1]; if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].logger == TRUE) { active_id = (log_id < inspect_id) ? log_id : inspect_id; } else { active_id = inspect_id; } SCReturnCT(active_id, "uint64_t"); } int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto) { if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetFiles != NULL) return TRUE; return FALSE; } int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto) { if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectState != NULL) return TRUE; return FALSE; } int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate) { int r; SCEnter(); if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasTxDetectState == NULL) return -ENOSYS; r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasTxDetectState(alstate); SCReturnInt(r); } DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx) { SCEnter(); DetectEngineState *s; s = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectState(tx); SCReturnPtr(s, "DetectEngineState"); } int AppLayerParserSetTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, DetectEngineState *s) { int r; SCEnter(); if ((alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectState(tx) != NULL)) SCReturnInt(-EBUSY); r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectState(alstate, tx, s); SCReturnInt(r); } /***** General *****/ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len) { SCEnter(); #ifdef DEBUG_VALIDATION BUG_ON(f->protomap != FlowGetProtoMapping(f->proto)); #endif AppLayerParserState *pstate = NULL; AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][alproto]; void *alstate = NULL; uint64_t p_tx_cnt = 0; /* we don't have the parser registered for this protocol */ if (p->StateAlloc == NULL) goto end; /* Do this check before calling AppLayerParse */ if (flags & STREAM_GAP) { SCLogDebug("stream gap detected (missing packets), " "this is not yet supported."); if (f->alstate != NULL) AppLayerParserStreamTruncated(f->proto, alproto, f->alstate, flags); goto error; } /* Get the parser state (if any) */ pstate = f->alparser; if (pstate == NULL) { f->alparser = pstate = AppLayerParserStateAlloc(); if (pstate == NULL) goto error; } pstate->version++; SCLogDebug("app layer parser state version incremented to %"PRIu8, pstate->version); if (flags & STREAM_EOF) AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF); alstate = f->alstate; if (alstate == NULL) { f->alstate = alstate = p->StateAlloc(); if (alstate == NULL) goto error; SCLogDebug("alloced new app layer state %p (name %s)", alstate, AppLayerGetProtoName(f->alproto)); } else { SCLogDebug("using existing app layer state %p (name %s))", alstate, AppLayerGetProtoName(f->alproto)); } if (AppLayerParserProtocolIsTxAware(f->proto, alproto)) { p_tx_cnt = AppLayerParserGetTxCnt(f->proto, alproto, f->alstate); } /* invoke the recursive parser, but only on data. We may get empty msgs on EOF */ if (input_len > 0 || (flags & STREAM_EOF)) { /* invoke the parser */ if (p->Parser[(flags & STREAM_TOSERVER) ? 0 : 1](f, alstate, pstate, input, input_len, alp_tctx->alproto_local_storage[f->protomap][alproto]) < 0) { goto error; } } /* set the packets to no inspection and reassembly if required */ if (pstate->flags & APP_LAYER_PARSER_NO_INSPECTION) { AppLayerParserSetEOF(pstate); FlowSetNoPayloadInspectionFlag(f); if (f->proto == IPPROTO_TCP) { StreamTcpDisableAppLayer(f); /* Set the no reassembly flag for both the stream in this TcpSession */ if (pstate->flags & APP_LAYER_PARSER_NO_REASSEMBLY) { /* Used only if it's TCP */ TcpSession *ssn = f->protoctx; if (ssn != NULL) { StreamTcpSetSessionNoReassemblyFlag(ssn, flags & STREAM_TOCLIENT ? 1 : 0); StreamTcpSetSessionNoReassemblyFlag(ssn, flags & STREAM_TOSERVER ? 1 : 0); } } } } /* In cases like HeartBleed for TLS we need to inspect AppLayer but not Payload */ if (!(f->flags & FLOW_NOPAYLOAD_INSPECTION) && pstate->flags & APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD) { FlowSetNoPayloadInspectionFlag(f); /* Set the no reassembly flag for both the stream in this TcpSession */ if (f->proto == IPPROTO_TCP) { /* Used only if it's TCP */ TcpSession *ssn = f->protoctx; if (ssn != NULL) { StreamTcpSetDisableRawReassemblyFlag(ssn, 0); StreamTcpSetDisableRawReassemblyFlag(ssn, 1); } } } if (AppLayerParserProtocolIsTxAware(f->proto, alproto)) { if (likely(tv)) { uint64_t cur_tx_cnt = AppLayerParserGetTxCnt(f->proto, alproto, f->alstate); if (cur_tx_cnt > p_tx_cnt) { AppLayerIncTxCounter(tv, f, cur_tx_cnt - p_tx_cnt); } } } /* next, see if we can get rid of transactions now */ AppLayerParserTransactionsCleanup(f); /* stream truncated, inform app layer */ if (flags & STREAM_DEPTH) AppLayerParserStreamTruncated(f->proto, alproto, alstate, flags); end: SCReturnInt(0); error: /* Set the no app layer inspection flag for both * the stream in this Flow */ if (f->proto == IPPROTO_TCP) { StreamTcpDisableAppLayer(f); } AppLayerParserSetEOF(pstate); SCReturnInt(-1); } void AppLayerParserSetEOF(AppLayerParserState *pstate) { SCEnter(); if (pstate == NULL) goto end; AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF); /* increase version so we will inspect it one more time * with the EOF flags now set */ pstate->version++; end: SCReturn; } int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate, uint8_t flags) { SCEnter(); if (alstate == NULL || pstate == NULL) goto not_present; AppLayerDecoderEvents *decoder_events; uint64_t tx_id; uint64_t max_id; if (AppLayerParserProtocolIsTxEventAware(ipproto, alproto)) { /* fast path if supported by alproto */ if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasEvents != NULL) { if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateHasEvents(alstate) == 1) { goto present; } } else { /* check each tx */ tx_id = AppLayerParserGetTransactionInspectId(pstate, flags); max_id = AppLayerParserGetTxCnt(ipproto, alproto, alstate); for ( ; tx_id < max_id; tx_id++) { decoder_events = AppLayerParserGetEventsByTx(ipproto, alproto, alstate, tx_id); if (decoder_events && decoder_events->cnt) goto present; } } } decoder_events = AppLayerParserGetDecoderEvents(pstate); if (decoder_events && decoder_events->cnt) goto present; /* if we have reached here, we don't have events */ not_present: SCReturnInt(0); present: SCReturnInt(1); } /** \brief simpler way to globally test if a alproto is registered * and fully enabled in the configuration. */ int AppLayerParserIsTxAware(AppProto alproto) { return (alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto] .StateGetProgressCompletionStatus != NULL); } int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto) { SCEnter(); int ipproto_map = FlowGetProtoMapping(ipproto); int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetTx == NULL) ? 0 : 1; SCReturnInt(r); } int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto) { SCEnter(); int ipproto_map = FlowGetProtoMapping(ipproto); int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetEvents == NULL) ? 0 : 1; SCReturnInt(r); } int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto) { SCEnter(); int ipproto_map = FlowGetProtoMapping(ipproto); int r = (alp_ctx.ctxs[ipproto_map][alproto].StateTransactionFree == NULL) ? 0 : 1; SCReturnInt(r); } int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto) { SCEnter(); int ipproto_map = FlowGetProtoMapping(ipproto); int r = (alp_ctx.ctxs[ipproto_map][alproto].logger == 0) ? 0 : 1; SCReturnInt(r); } void AppLayerParserTriggerRawStreamReassembly(Flow *f) { SCEnter(); if (f != NULL && f->protoctx != NULL) StreamTcpReassembleTriggerRawReassembly(f->protoctx); SCReturn; } void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].stream_depth = stream_depth; SCReturn; } uint32_t AppLayerParserGetStreamDepth(uint8_t ipproto, AppProto alproto) { SCReturnInt(alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].stream_depth); } /***** Cleanup *****/ void AppLayerParserStateCleanup(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate) { SCEnter(); AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]; if (ctx->StateFree != NULL && alstate != NULL) ctx->StateFree(alstate); /* free the app layer parser api state */ if (pstate != NULL) AppLayerParserStateFree(pstate); SCReturn; } void AppLayerParserRegisterProtocolParsers(void) { SCEnter(); RegisterHTPParsers(); RegisterSSLParsers(); RegisterSMBParsers(); /** \todo bug 719 */ //RegisterSMB2Parsers(); RegisterDCERPCParsers(); RegisterDCERPCUDPParsers(); RegisterFTPParsers(); RegisterSSHParsers(); RegisterSMTPParsers(); RegisterDNSUDPParsers(); RegisterDNSTCPParsers(); RegisterModbusParsers(); RegisterENIPUDPParsers(); RegisterENIPTCPParsers(); RegisterDNP3Parsers(); RegisterTemplateParsers(); /** IMAP */ AppLayerProtoDetectRegisterProtocol(ALPROTO_IMAP, "imap"); if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "imap")) { if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_IMAP, "1|20|capability", 12, 0, STREAM_TOSERVER) < 0) { SCLogInfo("imap proto registration failure\n"); exit(EXIT_FAILURE); } } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", "imap"); } /** MSN Messenger */ AppLayerProtoDetectRegisterProtocol(ALPROTO_MSN, "msn"); if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "msn")) { if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_MSN, "msn", 10, 6, STREAM_TOSERVER) < 0) { SCLogInfo("msn proto registration failure\n"); exit(EXIT_FAILURE); } } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", "msn"); } return; } void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag) { SCEnter(); pstate->flags |= flag; SCReturn; } int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag) { SCEnter(); SCReturnInt(pstate->flags & flag); } void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction) { SCEnter(); if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate != NULL) alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate(alstate, direction); SCReturn; } #ifdef DEBUG void AppLayerParserStatePrintDetails(AppLayerParserState *pstate) { SCEnter(); if (pstate == NULL) SCReturn; AppLayerParserState *p = pstate; SCLogDebug("AppLayerParser parser state information for parser state p(%p). " "p->inspect_id[0](%"PRIu64"), " "p->inspect_id[1](%"PRIu64"), " "p->log_id(%"PRIu64"), " "p->version(%"PRIu8"), " "p->decoder_events(%p).", pstate, p->inspect_id[0], p->inspect_id[1], p->log_id, p->version, p->decoder_events); SCReturn; } #endif #ifdef AFLFUZZ_APPLAYER int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename) { int result = 1; Flow *f = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = SCCalloc(1, sizeof(Flow)); if (f == NULL) goto end; FLOW_INITIALIZE(f); f->flags |= FLOW_IPV4; f->src.addr_data32[0] = 0x01020304; f->dst.addr_data32[0] = 0x05060708; f->sp = 10000; f->dp = 80; f->protoctx = &ssn; f->proto = ipproto; f->protomap = FlowGetProtoMapping(f->proto); f->alproto = alproto; uint8_t buffer[64]; #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(1000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); int start = 1; while (1) { int done = 0; size_t size = fread(&buffer, 1, sizeof(buffer), fp); if (size < sizeof(buffer)) done = 1; //SCLogInfo("result %u done %d start %d", (uint)result, done, start); uint8_t flags = STREAM_TOSERVER; if (start--) { flags |= STREAM_START; } if (done) { flags |= STREAM_EOF; } //PrintRawDataFp(stdout, buffer, result); (void)AppLayerParserParse(NULL, alp_tctx, f, alproto, flags, buffer, size); if (done) break; } fclose(fp); #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ result = 0; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (f != NULL) { FlowFree(f); } return result; } int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename) { int result = 1; Flow *f = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = SCCalloc(1, sizeof(Flow)); if (f == NULL) goto end; FLOW_INITIALIZE(f); f->flags |= FLOW_IPV4; f->src.addr_data32[0] = 0x01020304; f->dst.addr_data32[0] = 0x05060708; f->sp = 10000; f->dp = 80; f->protoctx = &ssn; f->proto = ipproto; f->protomap = FlowGetProtoMapping(f->proto); f->alproto = alproto; uint8_t buffer[64]; #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(1000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); int start = 1; int flip = 0; while (1) { int done = 0; size_t size = fread(&buffer, 1, sizeof(buffer), fp); if (size < sizeof(buffer)) done = 1; //SCLogInfo("result %u done %d start %d", (uint)result, done, start); uint8_t flags = 0; if (flip) { flags = STREAM_TOCLIENT; flip = 0; } else { flags = STREAM_TOSERVER; flip = 1; } if (start--) { flags |= STREAM_START; } if (done) { flags |= STREAM_EOF; } //PrintRawDataFp(stdout, buffer, result); (void)AppLayerParserParse(NULL, alp_tctx, f, alproto, flags, buffer, size); if (done) break; } fclose(fp); #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ result = 0; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (f != NULL) { FlowFree(f); } return result; } #endif /* AFLFUZZ_APPLAYER */ /***** Unittests *****/ #ifdef UNITTESTS static AppLayerParserCtx alp_ctx_backup_unittest; typedef struct TestState_ { uint8_t test; } TestState; /** * \brief Test parser function to test the memory deallocation of app layer * parser of occurence of an error. */ static int TestProtocolParser(Flow *f, void *test_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); SCReturnInt(-1); } /** \brief Function to allocates the Test protocol state memory */ static void *TestProtocolStateAlloc(void) { SCEnter(); void *s = SCMalloc(sizeof(TestState)); if (unlikely(s == NULL)) goto end; memset(s, 0, sizeof(TestState)); end: SCReturnPtr(s, "TestState"); } /** \brief Function to free the Test Protocol state memory */ static void TestProtocolStateFree(void *s) { SCFree(s); } void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void (*RegisterUnittests)(void)) { SCEnter(); alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. RegisterUnittests = RegisterUnittests; SCReturn; } void AppLayerParserBackupParserTable(void) { SCEnter(); alp_ctx_backup_unittest = alp_ctx; memset(&alp_ctx, 0, sizeof(alp_ctx)); SCReturn; } void AppLayerParserRestoreParserTable(void) { SCEnter(); alp_ctx = alp_ctx_backup_unittest; memset(&alp_ctx_backup_unittest, 0, sizeof(alp_ctx_backup_unittest)); SCReturn; } /** * \test Test the deallocation of app layer parser memory on occurance of * error in the parsing process. */ static int AppLayerParserTest01(void) { AppLayerParserBackupParserTable(); int result = 0; Flow *f = NULL; uint8_t testbuf[] = { 0x11 }; uint32_t testlen = sizeof(testbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); /* Register the Test protocol state and parser functions */ AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEST, STREAM_TOSERVER, TestProtocolParser); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_TEST, TestProtocolStateAlloc, TestProtocolStateFree); f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40); if (f == NULL) goto end; f->protoctx = &ssn; f->alproto = ALPROTO_TEST; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_TEST, STREAM_TOSERVER | STREAM_EOF, testbuf, testlen); if (r != -1) { printf("returned %" PRId32 ", expected -1: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); if (!(ssn.flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)) { printf("flag should have been set, but is not: "); goto end; } result = 1; end: AppLayerParserRestoreParserTable(); StreamTcpFreeConfig(TRUE); UTHFreeFlow(f); return result; } /** * \test Test the deallocation of app layer parser memory on occurance of * error in the parsing process for UDP. */ static int AppLayerParserTest02(void) { AppLayerParserBackupParserTable(); int result = 1; Flow *f = NULL; uint8_t testbuf[] = { 0x11 }; uint32_t testlen = sizeof(testbuf); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); /* Register the Test protocol state and parser functions */ AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_TEST, STREAM_TOSERVER, TestProtocolParser); AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_TEST, TestProtocolStateAlloc, TestProtocolStateFree); f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40); if (f == NULL) goto end; f->alproto = ALPROTO_TEST; f->proto = IPPROTO_UDP; f->protomap = FlowGetProtoMapping(f->proto); StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_TEST, STREAM_TOSERVER | STREAM_EOF, testbuf, testlen); if (r != -1) { printf("returned %" PRId32 ", expected -1: \n", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); end: AppLayerParserRestoreParserTable(); StreamTcpFreeConfig(TRUE); UTHFreeFlow(f); return result; } void AppLayerParserRegisterUnittests(void) { SCEnter(); int ip; AppProto alproto; AppLayerParserProtoCtx *ctx; for (ip = 0; ip < FLOW_PROTO_DEFAULT; ip++) { for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { ctx = &alp_ctx.ctxs[ip][alproto]; if (ctx->RegisterUnittests == NULL) continue; ctx->RegisterUnittests(); } } UtRegisterTest("AppLayerParserTest01", AppLayerParserTest01); UtRegisterTest("AppLayerParserTest02", AppLayerParserTest02); SCReturn; } #endif suricata-3.2.1/src/util-logopenfile.h0000644000000000000000000000731213051004444014433 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mike Pomraning */ #ifndef __UTIL_LOGOPENFILE_H__ #define __UTIL_LOGOPENFILE_H__ #include "conf.h" /* ConfNode */ #include "tm-modules.h" /* LogFileCtx */ #include "util-buffer.h" #ifdef HAVE_LIBHIREDIS #include "hiredis/hiredis.h" #endif typedef struct { uint16_t fileno; } PcieFile; enum LogFileType { LOGFILE_TYPE_FILE, LOGFILE_TYPE_SYSLOG, LOGFILE_TYPE_UNIX_DGRAM, LOGFILE_TYPE_UNIX_STREAM, LOGFILE_TYPE_REDIS }; typedef struct SyslogSetup_ { int alert_syslog_level; } SyslogSetup; #ifdef HAVE_LIBHIREDIS enum RedisMode { REDIS_LIST, REDIS_CHANNEL }; typedef struct RedisSetup_ { enum RedisMode mode; const char *command; char *key; int batch_size; int batch_count; char *server; int port; time_t tried; } RedisSetup; #endif /** Global structure for Output Context */ typedef struct LogFileCtx_ { union { FILE *fp; PcieFile *pcie_fp; #ifdef HAVE_LIBHIREDIS redisContext *redis; #endif }; union { SyslogSetup syslog_setup; #ifdef HAVE_LIBHIREDIS RedisSetup redis_setup; #endif }; int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp); void (*Close)(struct LogFileCtx_ *fp); /** It will be locked if the log/alert * record cannot be written to the file in one call */ SCMutex fp_mutex; /** the type of file */ enum LogFileType type; /** The name of the file */ char *filename; /** Suricata sensor name */ char *sensor_name; /** Handle auto-connecting / reconnecting sockets */ int is_sock; int sock_type; uint64_t reconn_timer; /**< Used by some alert loggers like the unified ones that append * the date onto the end of files. */ char *prefix; size_t prefix_len; /** Generic size_limit and size_current * They must be common to the threads accesing the same file */ uint64_t size_limit; /**< file size limit */ uint64_t size_current; /**< file current size */ /* Alerts on the module (not on the file) */ uint64_t alerts; /* flag to avoid multiple threads printing the same stats */ uint8_t flags; /* Flag if file is a regular file or not. Only regular files * allow for rotataion. */ uint8_t is_regular; /* Flag set when file rotation notification is received. */ int rotation_flag; } LogFileCtx; /* Min time (msecs) before trying to reconnect a Unix domain socket */ #define LOGFILE_RECONN_MIN_TIME 500 /* flags for LogFileCtx */ #define LOGFILE_HEADER_WRITTEN 0x01 #define LOGFILE_ALERTS_PRINTED 0x02 LogFileCtx *LogFileNewCtx(void); int LogFileFreeCtx(LogFileCtx *); int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer); int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int); int SCConfLogOpenRedis(ConfNode *conf, LogFileCtx *log_ctx); int SCConfLogReopen(LogFileCtx *); #endif /* __UTIL_LOGOPENFILE_H__ */ suricata-3.2.1/src/util-spm-bs2bm.h0000644000000000000000000000235513051004444013734 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __UTIL_SPM_BS2BM__ #define __UTIL_SPM_BS2BM__ #include "suricata-common.h" #include "suricata.h" #define ALPHABET_SIZE 256 void Bs2BmBadchars(const uint8_t *, uint16_t, uint8_t *); void Bs2BmBadcharsNocase(const uint8_t *, uint16_t, uint8_t *); uint8_t * Bs2Bm(const uint8_t *, uint32_t, const uint8_t *, uint16_t, uint8_t []); uint8_t *Bs2BmNocase(const uint8_t *, uint32_t, const uint8_t *, uint16_t, uint8_t []); #endif /* __UTIL_SPM_BS2BM__ */ suricata-3.2.1/src/output-json-drop.h0000644000000000000000000000162113051004444014423 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * */ #ifndef __OUTPUT_JSON_DROP_H__ #define __OUTPUT_JSON_DROP_H__ void JsonDropLogRegister(void); #endif /* __OUTPUT_DROPLOG_H__ */ suricata-3.2.1/src/tm-queuehandlers.h0000644000000000000000000000270013051004444014434 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TM_QUEUEHANDLERS_H__ #define __TM_QUEUEHANDLERS_H__ enum { TMQH_SIMPLE, TMQH_NFQ, TMQH_PACKETPOOL, TMQH_FLOW, TMQH_RINGBUFFER_MRSW, TMQH_RINGBUFFER_SRSW, TMQH_RINGBUFFER_SRMW, TMQH_SIZE, }; typedef struct Tmqh_ { char *name; Packet *(*InHandler)(ThreadVars *); void (*InShutdownHandler)(ThreadVars *); void (*OutHandler)(ThreadVars *, Packet *); void *(*OutHandlerCtxSetup)(char *); void (*OutHandlerCtxFree)(void *); void (*RegisterTests)(void); } Tmqh; Tmqh tmqh_table[TMQH_SIZE]; void TmqhSetup (void); void TmqhCleanup(void); Tmqh* TmqhGetQueueHandlerByName(char *name); #endif /* __TM_QUEUEHANDLERS_H__ */ suricata-3.2.1/src/detect-sid.c0000644000000000000000000000775113051004444013204 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the sid keyword */ #include "suricata-common.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "util-debug.h" #include "util-error.h" #include "util-unittest.h" static int DetectSidSetup (DetectEngineCtx *, Signature *, char *); static void DetectSidRegisterTests(void); void DetectSidRegister (void) { sigmatch_table[DETECT_SID].name = "sid"; sigmatch_table[DETECT_SID].desc = "set rule id"; sigmatch_table[DETECT_SID].url = DOC_URL DOC_VERSION "/rules/meta.html#sid-signature-id"; sigmatch_table[DETECT_SID].Match = NULL; sigmatch_table[DETECT_SID].Setup = DetectSidSetup; sigmatch_table[DETECT_SID].Free = NULL; sigmatch_table[DETECT_SID].RegisterTests = DetectSidRegisterTests; } static int DetectSidSetup (DetectEngineCtx *de_ctx, Signature *s, char *sidstr) { char *str = sidstr; char duped = 0; /* Strip leading and trailing "s. */ if (sidstr[0] == '\"') { str = SCStrdup(sidstr + 1); if (unlikely(str == NULL)) { return -1; } if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } duped = 1; } unsigned long id = 0; char *endptr = NULL; id = strtoul(sidstr, &endptr, 10); if (endptr == NULL || *endptr != '\0') { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid character as arg " "to sid keyword"); goto error; } if (id >= UINT_MAX) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "sid value to high, max %u", UINT_MAX); goto error; } s->id = (uint32_t)id; if (duped) SCFree(str); return 0; error: if (duped) SCFree(str); return -1; } #ifdef UNITTESTS static int SidTestParse01(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; s = DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:1;)"); if (s == NULL || s->id != 1) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SidTestParse02(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:a; gid:1;)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SidTestParse03(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"ABC\"; sid:\";)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /** * \brief Register DetectSid unit tests. */ static void DetectSidRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SidTestParse01", SidTestParse01); UtRegisterTest("SidTestParse02", SidTestParse02); UtRegisterTest("SidTestParse03", SidTestParse03); #endif /* UNITTESTS */ } suricata-3.2.1/src/respond-reject.h0000644000000000000000000000210613051004444014075 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf */ #ifndef __RESPOND_REJECT_H__ #define __RESPOND_REJECT_H__ #include "tm-threads.h" #define REJECT_DIR_SRC 0 #define REJECT_DIR_DST 1 void TmModuleRespondRejectRegister (void); TmEcode RespondRejectFunc(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); #endif /* __RESPOND_REJECT_H__ */ suricata-3.2.1/src/detect-filestore.c0000644000000000000000000003236713051004444014422 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the filestore keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "stream-tcp.h" #include "detect-filestore.h" /** * \brief Regex for parsing our flow options */ #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectFilestoreMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, File *, Signature *, SigMatch *); static int DetectFilestoreSetup (DetectEngineCtx *, Signature *, char *); static void DetectFilestoreFree(void *); static void DetectFilestoreRegisterTests(void); /** * \brief Registration function for keyword: filestore */ void DetectFilestoreRegister(void) { sigmatch_table[DETECT_FILESTORE].name = "filestore"; sigmatch_table[DETECT_FILESTORE].desc = "stores files to disk if the rule matched"; sigmatch_table[DETECT_FILESTORE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filestore"; sigmatch_table[DETECT_FILESTORE].FileMatch = DetectFilestoreMatch; sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup; sigmatch_table[DETECT_FILESTORE].Free = DetectFilestoreFree; sigmatch_table[DETECT_FILESTORE].RegisterTests = DetectFilestoreRegisterTests; sigmatch_table[DETECT_FILESTORE].flags = SIGMATCH_OPTIONAL_OPT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief apply the post match filestore with options */ static int FilestorePostMatchWithOptions(Packet *p, Flow *f, DetectFilestoreData *filestore, FileContainer *fc, uint16_t file_id, uint16_t tx_id) { if (filestore == NULL) { SCReturnInt(0); } int this_file = 0; int this_tx = 0; int this_flow = 0; int rule_dir = 0; int toserver_dir = 0; int toclient_dir = 0; switch (filestore->direction) { case FILESTORE_DIR_DEFAULT: rule_dir = 1; break; case FILESTORE_DIR_BOTH: toserver_dir = 1; toclient_dir = 1; break; case FILESTORE_DIR_TOSERVER: toserver_dir = 1; break; case FILESTORE_DIR_TOCLIENT: toclient_dir = 1; break; } switch (filestore->scope) { case FILESTORE_SCOPE_DEFAULT: if (rule_dir) { this_file = 1; } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && toclient_dir) { this_file = 1; } else if ((p->flowflags & FLOW_PKT_TOSERVER) && toserver_dir) { this_file = 1; } break; case FILESTORE_SCOPE_TX: this_tx = 1; break; case FILESTORE_SCOPE_SSN: this_flow = 1; break; } if (this_file) { FileStoreFileById(fc, file_id); } else if (this_tx) { /* flag tx all files will be stored */ if (f->alproto == ALPROTO_HTTP && f->alstate != NULL) { HtpState *htp_state = f->alstate; if (toserver_dir) { htp_state->flags |= HTP_FLAG_STORE_FILES_TX_TS; FileStoreAllFilesForTx(htp_state->files_ts, tx_id); } if (toclient_dir) { htp_state->flags |= HTP_FLAG_STORE_FILES_TX_TC; FileStoreAllFilesForTx(htp_state->files_tc, tx_id); } htp_state->store_tx_id = tx_id; } } else if (this_flow) { /* flag flow all files will be stored */ if (f->alproto == ALPROTO_HTTP && f->alstate != NULL) { HtpState *htp_state = f->alstate; if (toserver_dir) { htp_state->flags |= HTP_FLAG_STORE_FILES_TS; FileStoreAllFiles(htp_state->files_ts); } if (toclient_dir) { htp_state->flags |= HTP_FLAG_STORE_FILES_TC; FileStoreAllFiles(htp_state->files_tc); } } } else { FileStoreFileById(fc, file_id); } SCReturnInt(0); } /** * \brief post-match function for filestore * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param p packet * * The match function for filestore records store candidates in the det_ctx. * When we are sure all parts of the signature matched, we run this function * to finalize the filestore. */ int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s) { uint8_t flags = 0; SCEnter(); if (det_ctx->filestore_cnt == 0) { SCReturnInt(0); } if (s->filestore_sm == NULL || p->flow == NULL) { #ifndef DEBUG SCReturnInt(0); #else BUG_ON(1); #endif } /* set filestore depth for stream reassembling */ TcpSession *ssn = (TcpSession *)p->flow->protoctx; TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth()); if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else flags |= STREAM_TOSERVER; FileContainer *ffc = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, flags); /* filestore for single files only */ if (s->filestore_sm->ctx == NULL) { uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FileStoreFileById(ffc, det_ctx->filestore[u].file_id); } } else { DetectFilestoreData *filestore = (DetectFilestoreData *)s->filestore_sm->ctx; uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FilestorePostMatchWithOptions(p, p->flow, filestore, ffc, det_ctx->filestore[u].file_id, det_ctx->filestore[u].tx_id); } } SCReturnInt(0); } /** * \brief match the specified filestore * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFilestoreData * * \retval 0 no match * \retval 1 match * * \todo when we start supporting more protocols, the logic in this function * needs to be put behind a api. */ static int DetectFilestoreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { uint16_t file_id = 0; SCEnter(); if (det_ctx->filestore_cnt >= DETECT_FILESTORE_MAX) { SCReturnInt(1); } /* file can be NULL when a rule with filestore scope > file * matches. */ if (file != NULL) { file_id = file->file_id; } det_ctx->filestore[det_ctx->filestore_cnt].file_id = file_id; det_ctx->filestore[det_ctx->filestore_cnt].tx_id = det_ctx->tx_id; SCLogDebug("%u, file %u, tx %"PRIu64, det_ctx->filestore_cnt, det_ctx->filestore[det_ctx->filestore_cnt].file_id, det_ctx->filestore[det_ctx->filestore_cnt].tx_id); det_ctx->filestore_cnt++; SCReturnInt(1); } /** * \brief this function is used to parse filestore options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filestore" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFilestoreSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); DetectFilestoreData *fd = NULL; SigMatch *sm = NULL; char *args[3] = {NULL,NULL,NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; /* filestore and bypass keywords can't work together */ if (s->flags & SIG_FLAG_BYPASS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "filestore can't work with bypass keyword"); return -1; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FILESTORE; if (str != NULL && strlen(str) > 0) { SCLogDebug("str %s", str); ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 ", string %s", ret, str); goto error; } if (ret > 1) { const char *str_ptr; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[0] = (char *)str_ptr; if (ret > 2) { res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[1] = (char *)str_ptr; } if (ret > 3) { res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[2] = (char *)str_ptr; } } fd = SCMalloc(sizeof(DetectFilestoreData)); if (unlikely(fd == NULL)) goto error; memset(fd, 0x00, sizeof(DetectFilestoreData)); if (args[0] != NULL) { SCLogDebug("first arg %s", args[0]); if (strcasecmp(args[0], "request") == 0 || strcasecmp(args[0], "to_server") == 0) { fd->direction = FILESTORE_DIR_TOSERVER; fd->scope = FILESTORE_SCOPE_TX; } else if (strcasecmp(args[0], "response") == 0 || strcasecmp(args[0], "to_client") == 0) { fd->direction = FILESTORE_DIR_TOCLIENT; fd->scope = FILESTORE_SCOPE_TX; } else if (strcasecmp(args[0], "both") == 0) { fd->direction = FILESTORE_DIR_BOTH; fd->scope = FILESTORE_SCOPE_TX; } } else { fd->direction = FILESTORE_DIR_DEFAULT; } if (args[1] != NULL) { SCLogDebug("second arg %s", args[1]); if (strcasecmp(args[1], "file") == 0) { fd->scope = FILESTORE_SCOPE_DEFAULT; } else if (strcasecmp(args[1], "tx") == 0) { fd->scope = FILESTORE_SCOPE_TX; } else if (strcasecmp(args[1], "ssn") == 0 || strcasecmp(args[1], "flow") == 0) { fd->scope = FILESTORE_SCOPE_SSN; } } else { if (fd->scope == 0) fd->scope = FILESTORE_SCOPE_DEFAULT; } sm->ctx = (SigMatchCtx*)fd; } else { sm->ctx = (SigMatchCtx*)NULL; } if (s->alproto == ALPROTO_HTTP) { AppLayerHtpNeedFileInspection(); } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->filestore_sm = sm; s->flags |= SIG_FLAG_FILESTORE; return 0; error: if (sm != NULL) SCFree(sm); return -1; } static void DetectFilestoreFree(void *ptr) { if (ptr != NULL) { SCFree(ptr); } } #ifdef UNITTESTS /* * The purpose of this test is to confirm that * filestore and bypass keywords can't * can't work together */ static int DetectFilestoreTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(bypass; filestore; " "content:\"message\"; http_host; " "sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectFilestoreRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFilestoreTest01", DetectFilestoreTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/flow-worker.c0000644000000000000000000002152213051004444013425 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow Workers are single thread modules taking care of (almost) * everything related to packets with flows: * * - Lookup/creation * - Stream tracking, reassembly * - Applayer update * - Detection * * This all while holding the flow lock. */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "stream-tcp.h" #include "app-layer.h" #include "detect-engine.h" #include "output.h" #include "util-validate.h" #include "flow-util.h" typedef DetectEngineThreadCtx *DetectEngineThreadCtxPtr; typedef struct FlowWorkerThreadData_ { DecodeThreadVars *dtv; union { StreamTcpThread *stream_thread; void *stream_thread_ptr; }; SC_ATOMIC_DECLARE(DetectEngineThreadCtxPtr, detect_thread); void *output_thread; /* Output thread data. */ PacketQueue pq; } FlowWorkerThreadData; /** \brief handle flow for packet * * Handle flow creation/lookup */ static inline TmEcode FlowUpdate(Packet *p) { FlowHandlePacketUpdate(p->flow, p); int state = SC_ATOMIC_GET(p->flow->flow_state); switch (state) { case FLOW_STATE_CAPTURE_BYPASSED: case FLOW_STATE_LOCAL_BYPASSED: return TM_ECODE_DONE; default: return TM_ECODE_OK; } } static TmEcode FlowWorkerThreadInit(ThreadVars *tv, void *initdata, void **data) { FlowWorkerThreadData *fw = SCCalloc(1, sizeof(*fw)); BUG_ON(fw == NULL); SC_ATOMIC_INIT(fw->detect_thread); SC_ATOMIC_SET(fw->detect_thread, NULL); fw->dtv = DecodeThreadVarsAlloc(tv); if (fw->dtv == NULL) { SC_ATOMIC_DESTROY(fw->detect_thread); SCFree(fw); return TM_ECODE_FAILED; } /* setup TCP */ BUG_ON(StreamTcpThreadInit(tv, NULL, &fw->stream_thread_ptr) != TM_ECODE_OK); if (DetectEngineEnabled()) { /* setup DETECT */ void *detect_thread = NULL; BUG_ON(DetectEngineThreadCtxInit(tv, NULL, &detect_thread) != TM_ECODE_OK); SC_ATOMIC_SET(fw->detect_thread, detect_thread); } /* Setup outputs for this thread. */ if (OutputLoggerThreadInit(tv, initdata, &fw->output_thread) != TM_ECODE_OK) { return TM_ECODE_FAILED; } AppLayerRegisterThreadCounters(tv); /* setup pq for stream end pkts */ memset(&fw->pq, 0, sizeof(PacketQueue)); SCMutexInit(&fw->pq.mutex_q, NULL); *data = fw; return TM_ECODE_OK; } static TmEcode FlowWorkerThreadDeinit(ThreadVars *tv, void *data) { FlowWorkerThreadData *fw = data; DecodeThreadVarsFree(tv, fw->dtv); /* free TCP */ StreamTcpThreadDeinit(tv, (void *)fw->stream_thread); /* free DETECT */ void *detect_thread = SC_ATOMIC_GET(fw->detect_thread); if (detect_thread != NULL) { DetectEngineThreadCtxDeinit(tv, detect_thread); SC_ATOMIC_SET(fw->detect_thread, NULL); } /* Free output. */ OutputLoggerThreadDeinit(tv, fw->output_thread); /* free pq */ BUG_ON(fw->pq.len); SCMutexDestroy(&fw->pq.mutex_q); SCFree(fw); return TM_ECODE_OK; } TmEcode Detect(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq); TmEcode StreamTcp (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data, PacketQueue *preq, PacketQueue *unused) { FlowWorkerThreadData *fw = data; void *detect_thread = SC_ATOMIC_GET(fw->detect_thread); SCLogDebug("packet %"PRIu64, p->pcap_cnt); /* update time */ if (!(PKT_IS_PSEUDOPKT(p))) { TimeSetByThread(tv->id, &p->ts); } /* handle Flow */ if (p->flags & PKT_WANTS_FLOW) { FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_FLOW); FlowHandlePacket(tv, fw->dtv, p); if (likely(p->flow != NULL)) { DEBUG_ASSERT_FLOW_LOCKED(p->flow); if (FlowUpdate(p) == TM_ECODE_DONE) { FLOWLOCK_UNLOCK(p->flow); return TM_ECODE_OK; } } /* Flow is now LOCKED */ FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_FLOW); /* if PKT_WANTS_FLOW is not set, but PKT_HAS_FLOW is, then this is a * pseudo packet created by the flow manager. */ } else if (p->flags & PKT_HAS_FLOW) { FLOWLOCK_WRLOCK(p->flow); } SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no"); /* handle TCP and app layer */ if (PKT_IS_TCP(p)) { SCLogDebug("packet %"PRIu64" is TCP", p->pcap_cnt); DEBUG_ASSERT_FLOW_LOCKED(p->flow); FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_STREAM); StreamTcp(tv, p, fw->stream_thread, &fw->pq, NULL); FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_STREAM); /* Packets here can safely access p->flow as it's locked */ SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len); Packet *x; while ((x = PacketDequeue(&fw->pq))) { SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x); // TODO do we need to call StreamTcp on these pseudo packets or not? //StreamTcp(tv, x, fw->stream_thread, &fw->pq, NULL); if (detect_thread != NULL) { FLOWWORKER_PROFILING_START(x, PROFILE_FLOWWORKER_DETECT); Detect(tv, x, detect_thread, NULL, NULL); FLOWWORKER_PROFILING_END(x, PROFILE_FLOWWORKER_DETECT); } // Outputs OutputLoggerLog(tv, x, fw->output_thread); /* put these packets in the preq queue so that they are * by the other thread modules before packet 'p'. */ PacketEnqueue(preq, x); } /* handle the app layer part of the UDP packet payload */ } else if (p->flow && p->proto == IPPROTO_UDP) { FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_APPLAYERUDP); AppLayerHandleUdp(tv, fw->stream_thread->ra_ctx->app_tctx, p, p->flow); FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_APPLAYERUDP); } /* handle Detect */ DEBUG_ASSERT_FLOW_LOCKED(p->flow); SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt); if (detect_thread != NULL) { FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT); Detect(tv, p, detect_thread, NULL, NULL); FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_DETECT); } // Outputs. OutputLoggerLog(tv, p, fw->output_thread); /* Release tcp segments. Done here after alerting can use them. */ if (p->flow != NULL && p->proto == IPPROTO_TCP) { StreamTcpPruneSession(p->flow, p->flowflags & FLOW_PKT_TOSERVER ? STREAM_TOSERVER : STREAM_TOCLIENT); } if (p->flow) { DEBUG_ASSERT_FLOW_LOCKED(p->flow); FLOWLOCK_UNLOCK(p->flow); } return TM_ECODE_OK; } void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx) { FlowWorkerThreadData *fw = flow_worker; SC_ATOMIC_SET(fw->detect_thread, detect_ctx); } void *FlowWorkerGetDetectCtxPtr(void *flow_worker) { FlowWorkerThreadData *fw = flow_worker; return SC_ATOMIC_GET(fw->detect_thread); } const char *ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi) { switch (fwi) { case PROFILE_FLOWWORKER_FLOW: return "flow"; case PROFILE_FLOWWORKER_STREAM: return "stream"; case PROFILE_FLOWWORKER_APPLAYERUDP: return "app-layer"; case PROFILE_FLOWWORKER_DETECT: return "detect"; case PROFILE_FLOWWORKER_SIZE: return "size"; } return "error"; } static void FlowWorkerExitPrintStats(ThreadVars *tv, void *data) { FlowWorkerThreadData *fw = data; OutputLoggerExitPrintStats(tv, fw->output_thread); } void TmModuleFlowWorkerRegister (void) { tmm_modules[TMM_FLOWWORKER].name = "FlowWorker"; tmm_modules[TMM_FLOWWORKER].ThreadInit = FlowWorkerThreadInit; tmm_modules[TMM_FLOWWORKER].Func = FlowWorker; tmm_modules[TMM_FLOWWORKER].ThreadDeinit = FlowWorkerThreadDeinit; tmm_modules[TMM_FLOWWORKER].ThreadExitPrintStats = FlowWorkerExitPrintStats; tmm_modules[TMM_FLOWWORKER].cap_flags = 0; tmm_modules[TMM_FLOWWORKER].flags = TM_FLAG_STREAM_TM|TM_FLAG_DETECT_TM; } suricata-3.2.1/src/util-luajit.c0000644000000000000000000001127013051004444013411 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #ifdef HAVE_LUAJIT #include "conf.h" #include "util-pool.h" #include "util-lua.h" /** \brief lua_State pool * * Lua requires states to be alloc'd in memory <2GB. For this reason we * prealloc the states early during engine startup so we have a better chance * of getting the states. We protect the pool with a lock as the detect * threads access it during their init and cleanup. * * Pool size is automagically determined based on number of keyword occurences, * cpus/cores and rule reloads being enabled or not. * * Alternatively, the "detect-engine.luajit-states" var can be set. */ static Pool *luajit_states = NULL; static pthread_mutex_t luajit_states_lock = SCMUTEX_INITIALIZER; static int luajit_states_cnt = 0; static int luajit_states_cnt_max = 0; static int luajit_states_size = 0; #define LUAJIT_DEFAULT_STATES 128 static void *LuaStatePoolAlloc(void) { return luaL_newstate(); } static void LuaStatePoolFree(void *d) { lua_State *s = (lua_State *)d; if (s != NULL) lua_close(s); } /** \brief Populate lua states pool * * \param num keyword instances * \param reloads bool indicating we have rule reloads enabled */ int LuajitSetupStatesPool(void) { int retval = 0; pthread_mutex_lock(&luajit_states_lock); if (luajit_states == NULL) { intmax_t cnt = 0; if (ConfGetInt("luajit.states", &cnt) != 1) { ConfNode *denode = NULL; ConfNode *decnf = ConfGetNode("detect-engine"); if (decnf != NULL) { TAILQ_FOREACH(denode, &decnf->head, next) { if (strcmp(denode->val, "luajit-states") == 0) { ConfGetChildValueInt(denode, "luajit-states", &cnt); } } } } if (cnt == 0) { cnt = LUAJIT_DEFAULT_STATES; } luajit_states_size = cnt; luajit_states = PoolInit(0, cnt, 0, LuaStatePoolAlloc, NULL, NULL, NULL, LuaStatePoolFree); if (luajit_states == NULL) { SCLogError(SC_ERR_LUA_ERROR, "luastate pool init failed, lua/luajit keywords won't work"); retval = -1; } if (retval == 0) { SCLogConfig("luajit states preallocated: %d", luajit_states_size); } } pthread_mutex_unlock(&luajit_states_lock); return retval; } void LuajitFreeStatesPool(void) { pthread_mutex_lock(&luajit_states_lock); if (luajit_states_cnt_max > luajit_states_size) { SCLogNotice("luajit states used %d is bigger than pool size %d. Set " "luajit.states to %d to avoid memory issues. " "See #1577 and #1955.", luajit_states_cnt_max, luajit_states_size, luajit_states_cnt_max); } PoolFree(luajit_states); luajit_states = NULL; luajit_states_size = 0; luajit_states_cnt = 0; pthread_mutex_unlock(&luajit_states_lock); } lua_State *LuajitGetState(void) { lua_State *s = NULL; pthread_mutex_lock(&luajit_states_lock); if (luajit_states != NULL) { s = (lua_State *)PoolGet(luajit_states); if (s != NULL) { if (luajit_states_cnt == luajit_states_size) { SCLogWarning(SC_WARN_LUA_SCRIPT, "luajit states pool size %d " "reached. Increase luajit.states config option. " "See #1577 and #1955", luajit_states_size); } luajit_states_cnt++; if (luajit_states_cnt > luajit_states_cnt_max) luajit_states_cnt_max = luajit_states_cnt; } } pthread_mutex_unlock(&luajit_states_lock); return s; } void LuajitReturnState(lua_State *s) { if (s != NULL) { pthread_mutex_lock(&luajit_states_lock); PoolReturn(luajit_states, (void *)s); BUG_ON(luajit_states_cnt <= 0); luajit_states_cnt--; pthread_mutex_unlock(&luajit_states_lock); } } #endif /* HAVE_LUAJIT */ suricata-3.2.1/src/util-runmodes.h0000644000000000000000000000556213051004444013771 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #ifndef __UTIL_RUNMODES_H__ #define __UTIL_RUNMODES_H__ void RunmodeSetFlowStreamAsync(void); int RunmodeGetFlowStreamAsync(void); typedef void *(*ConfigIfaceParserFunc) (const char *); typedef void *(*ConfigIPSParserFunc) (int); typedef int (*ConfigIfaceThreadsCountFunc) (void *); int RunModeSetLiveCaptureAuto(ConfigIfaceParserFunc configparser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev); int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc configparser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev); int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc configparser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev); int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc configparser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev); int RunModeSetIPSAutoFp(ConfigIPSParserFunc ConfigParser, const char *recv_mod_name, const char *verdict_mod_name, const char *decode_mod_name); int RunModeSetIPSWorker(ConfigIPSParserFunc ConfigParser, const char *recv_mod_name, const char *verdict_mod_name, const char *decode_mod_name); char *RunmodeAutoFpCreatePickupQueuesString(int n); #endif /* __UTIL_RUNMODES_H__ */ suricata-3.2.1/src/detect-pcre.c0000644000000000000000000033042613051004444013354 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the pcre keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "pkt-var.h" #include "flow-var.h" #include "flow-util.h" #include "detect-pcre.h" #include "detect-flowvar.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-sigorder.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "util-var-name.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "util-unittest.h" #include "util-print.h" #include "util-pool.h" #include "conf.h" #include "app-layer.h" #include "app-layer-htp.h" #include "stream.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "util-pages.h" #define PARSE_CAPTURE_REGEX "\\(\\?P\\<([A-z]+)\\_([A-z0-9_]+)\\>" #define PARSE_REGEX "(?ctx; if (pe->flags & DETECT_PCRE_RELATIVE) { ptr = payload + det_ctx->buffer_offset; len = payload_len - det_ctx->buffer_offset; } else { ptr = payload; len = payload_len; } int start_offset = 0; if (det_ctx->pcre_match_start_offset != 0) { start_offset = (payload + det_ctx->pcre_match_start_offset - ptr); } /* run the actual pcre detection */ ret = pcre_exec(pe->re, pe->sd, (char *)ptr, len, start_offset, 0, ov, MAX_SUBSTRINGS); SCLogDebug("ret %d (negating %s)", ret, (pe->flags & DETECT_PCRE_NEGATE) ? "set" : "not set"); if (ret == PCRE_ERROR_NOMATCH) { if (pe->flags & DETECT_PCRE_NEGATE) { /* regex didn't match with negate option means we * consider it a match */ ret = 1; } else { ret = 0; } } else if (ret >= 0) { if (pe->flags & DETECT_PCRE_NEGATE) { /* regex matched but we're negated, so not * considering it a match */ ret = 0; } else { /* regex matched and we're not negated, * considering it a match */ SCLogDebug("ret %d capidx %u", ret, pe->capidx); /* see if we need to do substring capturing. */ if (ret > 1 && pe->capidx != 0) { SCLogDebug("capturing"); const char *str_ptr; ret = pcre_get_substring((char *)ptr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (ret) { if (pe->flags & DETECT_PCRE_CAPTURE_PKT) { if (p != NULL) { PktVarAdd(p, pe->capname, (uint8_t *)str_ptr, ret); } } else if (pe->flags & DETECT_PCRE_CAPTURE_FLOW) { if (f != NULL) { /* store max 64k. Errors are ignored */ capture_len = (ret < 0xffff) ? (uint16_t)ret : 0xffff; (void)DetectFlowvarStoreMatch(det_ctx, pe->capidx, (uint8_t *)str_ptr, capture_len, DETECT_FLOWVAR_TYPE_POSTMATCH); } } } } /* update offset for pcre RELATIVE */ det_ctx->buffer_offset = (ptr + ov[1]) - payload; det_ctx->pcre_match_start_offset = (ptr + ov[0] + 1) - payload; ret = 1; } } else { SCLogDebug("pcre had matching error"); ret = 0; } SCReturnInt(ret); } static int DetectPcreSetList(int list, int set) { if (list != DETECT_SM_LIST_NOTSET) { SCLogError(SC_ERR_INVALID_SIGNATURE, "only one pcre option to specify a buffer type is allowed"); return -1; } return set; } static int DetectPcreHasUpperCase(const char *re) { size_t len = strlen(re); int is_meta = 0; for (size_t i = 0; i < len; i++) { if (is_meta) { is_meta = 0; } else if (re[i] == '\\') { is_meta = 1; } else if (isupper((unsigned char)re[i])) { return 1; } } return 0; } static DetectPcreData *DetectPcreParse (DetectEngineCtx *de_ctx, char *regexstr, int *sm_list) { int ec; const char *eb; int eo; int opts = 0; DetectPcreData *pd = NULL; char *op = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; /* take the size of the whole input as buffer size for the regex we will * extract below. Add 1 to please Coverity's alloc_strlen test. */ size_t slen = strlen(regexstr) + 1; char re[slen]; char op_str[64] = ""; uint16_t pos = 0; uint8_t negate = 0; while (pos < slen && isspace((unsigned char)regexstr[pos])) { pos++; } if (regexstr[pos] == '!') { negate = 1; pos++; } ret = pcre_exec(parse_regex, parse_regex_study, regexstr + pos, slen-pos, 0, 0, ov, MAX_SUBSTRINGS); if (ret <= 0) { SCLogError(SC_ERR_PCRE_MATCH, "pcre parse error: %s", regexstr); goto error; } res = pcre_copy_substring((char *)regexstr + pos, ov, MAX_SUBSTRINGS, 1, re, slen); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return NULL; } if (ret > 2) { res = pcre_copy_substring((char *)regexstr + pos, ov, MAX_SUBSTRINGS, 2, op_str, sizeof(op_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return NULL; } op = op_str; } //printf("ret %" PRId32 " re \'%s\', op \'%s\'\n", ret, re, op); pd = SCMalloc(sizeof(DetectPcreData)); if (unlikely(pd == NULL)) goto error; memset(pd, 0, sizeof(DetectPcreData)); if (negate) pd->flags |= DETECT_PCRE_NEGATE; if (op != NULL) { while (*op) { SCLogDebug("regex option %c", *op); switch (*op) { case 'A': opts |= PCRE_ANCHORED; break; case 'E': opts |= PCRE_DOLLAR_ENDONLY; break; case 'G': opts |= PCRE_UNGREEDY; break; case 'i': opts |= PCRE_CASELESS; pd->flags |= DETECT_PCRE_CASELESS; break; case 'm': opts |= PCRE_MULTILINE; break; case 's': opts |= PCRE_DOTALL; break; case 'x': opts |= PCRE_EXTENDED; break; case 'O': pd->flags |= DETECT_PCRE_MATCH_LIMIT; break; case 'B': /* snort's option */ if (*sm_list != DETECT_SM_LIST_NOTSET) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'B' inconsistent with chosen buffer"); goto error; } pd->flags |= DETECT_PCRE_RAWBYTES; break; case 'R': /* snort's option */ pd->flags |= DETECT_PCRE_RELATIVE; break; /* buffer selection */ case 'U': /* snort's option */ if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'U' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_UMATCH); break; case 'V': if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'V' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HUADMATCH); break; case 'W': if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'W' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HHHDMATCH); break; case 'Z': if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'Z' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HRHHDMATCH); break; case 'H': /* snort's option */ if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'H' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HHDMATCH); break; case 'I': /* snort's option */ if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'I' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HRUDMATCH); break; case 'D': /* snort's option */ *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HRHDMATCH); break; case 'M': /* snort's option */ if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'M' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HMDMATCH); break; case 'C': /* snort's option */ if (pd->flags & DETECT_PCRE_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "regex modifier 'C' inconsistent with 'B'"); goto error; } *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HCDMATCH); break; case 'P': /* snort's option (http request body inspection) */ *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HCBDMATCH); break; case 'Q': /* suricata extension (http response body inspection) */ *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_FILEDATA); break; case 'Y': /* snort's option */ *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HSMDMATCH); break; case 'S': /* snort's option */ *sm_list = DetectPcreSetList(*sm_list, DETECT_SM_LIST_HSCDMATCH); break; default: SCLogError(SC_ERR_UNKNOWN_REGEX_MOD, "unknown regex modifier '%c'", *op); goto error; } op++; } } if (*sm_list == -1) goto error; SCLogDebug("DetectPcreParse: \"%s\"", re); /* host header */ if (*sm_list == DETECT_SM_LIST_HHHDMATCH) { if (pd->flags & DETECT_PCRE_CASELESS) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http host pcre(\"W\") " "specified along with \"i(caseless)\" modifier. " "Since the hostname buffer we match against " "is actually lowercase, having a " "nocase is redundant."); } else if (DetectPcreHasUpperCase(re)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "pcre host(\"W\") " "specified has an uppercase char. " "Since the hostname buffer we match against " "is actually lowercase, please specify an " "all lowercase based pcre."); goto error; } } /* Try to compile as if all (...) groups had been meant as (?:...), * which is the common case in most rules. * If we fail because a capture group is later referenced (e.g., \1), * PCRE will let us know. */ pd->re = pcre_compile2(re, opts | PCRE_NO_AUTO_CAPTURE, &ec, &eb, &eo, NULL); if (pd->re == NULL && ec == 15) { // reference to non-existent subpattern pd->re = pcre_compile(re, opts, &eb, &eo, NULL); } if(pd->re == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", regexstr, eo, eb); goto error; } int options = 0; #ifdef PCRE_HAVE_JIT if (pcre_use_jit) options |= PCRE_STUDY_JIT_COMPILE; #endif pd->sd = pcre_study(pd->re, options, &eb); if(eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed : %s", eb); goto error; } #ifdef PCRE_HAVE_JIT int jit = 0; ret = pcre_fullinfo(pd->re, pd->sd, PCRE_INFO_JIT, &jit); if (ret != 0 || jit != 1) { /* warning, so we won't print the sig after this. Adding * file and line to the message so the admin can figure * out what sig this is about */ SCLogDebug("PCRE JIT compiler does not support: %s. " "Falling back to regular PCRE handling (%s:%d)", regexstr, de_ctx->rule_file, de_ctx->rule_line); } #endif /*PCRE_HAVE_JIT*/ if (pd->sd == NULL) pd->sd = (pcre_extra *) SCCalloc(1,sizeof(pcre_extra)); if (pd->sd) { if(pd->flags & DETECT_PCRE_MATCH_LIMIT) { if(pcre_match_limit >= -1) { pd->sd->match_limit = pcre_match_limit; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT; } #ifndef NO_PCRE_MATCH_RLIMIT if(pcre_match_limit_recursion >= -1) { pd->sd->match_limit_recursion = pcre_match_limit_recursion; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION; } #endif /* NO_PCRE_MATCH_RLIMIT */ } else { pd->sd->match_limit = SC_MATCH_LIMIT_DEFAULT; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT; #ifndef NO_PCRE_MATCH_RLIMIT pd->sd->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION; #endif /* NO_PCRE_MATCH_RLIMIT */ } } else { goto error; } return pd; error: if (pd != NULL && pd->re != NULL) pcre_free(pd->re); if (pd != NULL && pd->sd != NULL) pcre_free_study(pd->sd); if (pd) SCFree(pd); return NULL; } /** \internal * \brief check if we need to extract capture settings and set them up if needed */ static int DetectPcreParseCapture(char *regexstr, DetectEngineCtx *de_ctx, DetectPcreData *pd) { int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char type_str[16] = ""; /* take the size of the whole input as buffer size for the string we will * extract below. Add 1 to please Coverity's alloc_strlen test. */ size_t cap_buffer_len = strlen(regexstr) + 1; char capture_str[cap_buffer_len]; memset(capture_str, 0x00, cap_buffer_len); if (de_ctx == NULL) goto error; SCLogDebug("\'%s\'", regexstr); ret = pcre_exec(parse_capture_regex, parse_capture_regex_study, regexstr, strlen(regexstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3) { return 0; } res = pcre_copy_substring((char *)regexstr, ov, MAX_SUBSTRINGS, 1, type_str, sizeof(type_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } res = pcre_copy_substring((char *)regexstr, ov, MAX_SUBSTRINGS, 2, capture_str, cap_buffer_len); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } if (strlen(capture_str) == 0 || strlen(type_str) == 0) { goto error; } SCLogDebug("type \'%s\'", type_str); SCLogDebug("capture \'%s\'", capture_str); pd->capname = SCStrdup(capture_str); if (unlikely(pd->capname == NULL)) goto error; if (strcmp(type_str, "pkt") == 0) { pd->flags |= DETECT_PCRE_CAPTURE_PKT; } else if (strcmp(type_str, "flow") == 0) { pd->flags |= DETECT_PCRE_CAPTURE_FLOW; SCLogDebug("flow capture"); } if (pd->capname != NULL) { if (pd->flags & DETECT_PCRE_CAPTURE_PKT) pd->capidx = VariableNameGetIdx(de_ctx, (char *)pd->capname, VAR_TYPE_PKT_VAR); else if (pd->flags & DETECT_PCRE_CAPTURE_FLOW) pd->capidx = VariableNameGetIdx(de_ctx, (char *)pd->capname, VAR_TYPE_FLOW_VAR); } SCLogDebug("pd->capname %s", pd->capname); return 0; error: if (pd->capname != NULL) { SCFree(pd->capname); pd->capname = NULL; } return -1; } static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexstr) { SCEnter(); DetectPcreData *pd = NULL; SigMatch *sm = NULL; int ret = -1; int parsed_sm_list = DETECT_SM_LIST_NOTSET; pd = DetectPcreParse(de_ctx, regexstr, &parsed_sm_list); if (pd == NULL) goto error; if (DetectPcreParseCapture(regexstr, de_ctx, pd) < 0) goto error; if (parsed_sm_list == DETECT_SM_LIST_UMATCH || parsed_sm_list == DETECT_SM_LIST_HRUDMATCH || parsed_sm_list == DETECT_SM_LIST_HCBDMATCH || parsed_sm_list == DETECT_SM_LIST_FILEDATA || parsed_sm_list == DETECT_SM_LIST_HHDMATCH || parsed_sm_list == DETECT_SM_LIST_HRHDMATCH || parsed_sm_list == DETECT_SM_LIST_HSMDMATCH || parsed_sm_list == DETECT_SM_LIST_HSCDMATCH || parsed_sm_list == DETECT_SM_LIST_HHHDMATCH || parsed_sm_list == DETECT_SM_LIST_HRHHDMATCH || parsed_sm_list == DETECT_SM_LIST_HMDMATCH || parsed_sm_list == DETECT_SM_LIST_HCDMATCH || parsed_sm_list == DETECT_SM_LIST_HUADMATCH) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Invalid option. " "Conflicting alprotos detected for this rule. Http " "pcre modifier found along with a different protocol " "for the rule."); goto error; } if (s->list != DETECT_SM_LIST_NOTSET) { SCLogError(SC_ERR_INVALID_SIGNATURE, "pcre found with http " "modifier set, with file_data/dce_stub_data sticky " "option set."); goto error; } } int sm_list = -1; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA) { SCLogDebug("adding to http server body list because of file data"); AppLayerHtpEnableResponseBodyCallback(); } else if (s->list == DETECT_SM_LIST_DMATCH) { SCLogDebug("adding to dmatch list because of dce_stub_data"); } else if (s->list == DETECT_SM_LIST_DNSQUERYNAME_MATCH) { SCLogDebug("adding to DETECT_SM_LIST_DNSQUERYNAME_MATCH list because of dns_query"); } s->flags |= SIG_FLAG_APPLAYER; sm_list = s->list; } else { switch(parsed_sm_list) { case DETECT_SM_LIST_HCBDMATCH: AppLayerHtpEnableRequestBodyCallback(); s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_HTTP; sm_list = parsed_sm_list; break; case DETECT_SM_LIST_FILEDATA: AppLayerHtpEnableResponseBodyCallback(); s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_HTTP; sm_list = parsed_sm_list; break; case DETECT_SM_LIST_UMATCH: case DETECT_SM_LIST_HRUDMATCH: case DETECT_SM_LIST_HHDMATCH: case DETECT_SM_LIST_HRHDMATCH: case DETECT_SM_LIST_HHHDMATCH: case DETECT_SM_LIST_HRHHDMATCH: case DETECT_SM_LIST_HSMDMATCH: case DETECT_SM_LIST_HSCDMATCH: case DETECT_SM_LIST_HCDMATCH: case DETECT_SM_LIST_HMDMATCH: case DETECT_SM_LIST_HUADMATCH: s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_HTTP; sm_list = parsed_sm_list; break; case DETECT_SM_LIST_NOTSET: sm_list = DETECT_SM_LIST_PMATCH; break; } } if (sm_list == -1) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_PCRE; sm->ctx = (void *)pd; SigMatchAppendSMToList(s, sm, sm_list); if (pd->capidx != 0) { if (DetectFlowvarPostMatchSetup(s, pd->capidx) < 0) goto error_nofree; } if (!(pd->flags & DETECT_PCRE_RELATIVE)) goto okay; /* errors below shouldn't free pd */ SigMatch *prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, sm->prev, DETECT_PCRE, sm->prev); if (s->list == DETECT_SM_LIST_NOTSET && prev_pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "pcre with /R (relative) needs " "preceeding match in the same buffer"); goto error_nofree; /* null is allowed when we use a sticky buffer */ } else if (prev_pm == NULL) goto okay; if (prev_pm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)prev_pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *tmp = (DetectPcreData *)prev_pm->ctx; tmp->flags |= DETECT_PCRE_RELATIVE_NEXT; } okay: ret = 0; SCReturnInt(ret); error: DetectPcreFree(pd); error_nofree: SCReturnInt(ret); } void DetectPcreFree(void *ptr) { if (ptr == NULL) return; DetectPcreData *pd = (DetectPcreData *)ptr; if (pd->capname != NULL) SCFree(pd->capname); if (pd->re != NULL) pcre_free(pd->re); if (pd->sd != NULL) pcre_free_study(pd->sd); SCFree(pd); return; } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectPcreParseTest01 make sure we don't allow invalid opts 7. */ static int DetectPcreParseTest01 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/blah/7"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NOT_NULL(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest02 make sure we don't allow invalid opts Ui$. */ static int DetectPcreParseTest02 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/blah/Ui$"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NOT_NULL(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest03 make sure we don't allow invalid opts UZi. */ static int DetectPcreParseTest03 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/blah/UNi"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NOT_NULL(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest04 make sure we allow escaped " */ static int DetectPcreParseTest04 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/b\\\"lah/i"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest05 make sure we parse pcre with no opts */ static int DetectPcreParseTest05 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/b(l|a)h/"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest06 make sure we parse pcre with smi opts */ static int DetectPcreParseTest06 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/b(l|a)h/smi"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest07 make sure we parse pcre with /Ui opts */ static int DetectPcreParseTest07 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/blah/Ui"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest08 make sure we parse pcre with O opts */ static int DetectPcreParseTest08 (void) { int result = 1; DetectPcreData *pd = NULL; char *teststring = "/b(l|a)h/O"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectPcreParseTest09 make sure we parse pcre with a content * that has slashes */ static int DetectPcreParseTest09 (void) { DetectPcreData *pd = NULL; char *teststring = "/lala\\\\/"; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); pd = DetectPcreParse(de_ctx, teststring, &list); FAIL_IF_NULL(pd); DetectPcreFree(pd); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test pcre option for dce sig(yeah I'm bored of writing test titles). */ int DetectPcreParseTest10(void) { Signature *s = SigAlloc(); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); s->alproto = ALPROTO_DCERPC; FAIL_IF_NOT(DetectPcreSetup(de_ctx, s, "/bamboo/") == 0); FAIL_IF_NOT(s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); FAIL_IF_NULL(s); /* failure since we have no preceding content/pcre/bytejump */ FAIL_IF_NOT(DetectPcreSetup(de_ctx, s, "/bamboo/") == 0); FAIL_IF_NOT(s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test pcre option for dce sig. */ int DetectPcreParseTest11(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; DetectPcreData *data = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "pcre:/bamboo/R; sid:1;)"); FAIL_IF(de_ctx == NULL); s = de_ctx->sig_list; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL); FAIL_IF_NOT(s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; FAIL_IF(data->flags & DETECT_PCRE_RAWBYTES || !(data->flags & DETECT_PCRE_RELATIVE)); s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "pcre:/bamboo/R; sid:1;)"); FAIL_IF_NULL(s->next); s = s->next; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL); FAIL_IF_NOT(s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; FAIL_IF(data->flags & DETECT_PCRE_RAWBYTES || !(data->flags & DETECT_PCRE_RELATIVE)); s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "pcre:/bamboo/RB; sid:1;)"); FAIL_IF(s->next == NULL); s = s->next; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL); FAIL_IF_NOT(s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; FAIL_IF(!(data->flags & DETECT_PCRE_RAWBYTES) || !(data->flags & DETECT_PCRE_RELATIVE)); s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; pcre:/bamboo/; sid:1;)"); FAIL_IF(s->next == NULL); s = s->next; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test pcre option with file data. pcre is relative to file_data, * so relative flag should be unset. */ static int DetectPcreParseTest12(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; DetectPcreData *data = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; pcre:/abc/R; sid:1;)"); FAIL_IF (de_ctx->sig_list == NULL); s = de_ctx->sig_list; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL); FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; FAIL_IF(data->flags & DETECT_PCRE_RAWBYTES || !(data->flags & DETECT_PCRE_RELATIVE)); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test pcre option with file data. */ static int DetectPcreParseTest13(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; DetectPcreData *data = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; content:\"abc\"; pcre:/def/R; sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); s = de_ctx->sig_list; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL); FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; FAIL_IF(data->flags & DETECT_PCRE_RAWBYTES || !(data->flags & DETECT_PCRE_RELATIVE)); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test pcre option with file data. */ static int DetectPcreParseTest14(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; DetectPcreData *data = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; pcre:/def/; sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); s = de_ctx->sig_list; FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL); FAIL_IF(s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_PCRE); data = (DetectPcreData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; FAIL_IF(data->flags & DETECT_PCRE_RAWBYTES || data->flags & DETECT_PCRE_RELATIVE); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative method */ int DetectPcreParseTest15(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative http_method\"; " "content:\"GET\"; " "http_method; pcre:\"/abc/RM\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative cookie */ int DetectPcreParseTest16(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative http_cookie\"; " "content:\"test\"; " "http_cookie; pcre:\"/abc/RC\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative raw header */ int DetectPcreParseTest17(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative http_raw_header\"; " "flow:to_server; content:\"test\"; " "http_raw_header; pcre:\"/abc/RD\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative header */ int DetectPcreParseTest18(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative http_header\"; " "content:\"test\"; " "http_header; pcre:\"/abc/RH\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative client-body */ int DetectPcreParseTest19(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relativie http_client_body\"; " "content:\"test\"; " "http_client_body; pcre:\"/abc/RP\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative raw uri */ int DetectPcreParseTest20(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; " "content:\"test\"; " "http_raw_uri; pcre:\"/abc/RI\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative uricontent */ int DetectPcreParseTest21(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative uricontent\"; " "uricontent:\"test\"; " "pcre:\"/abc/RU\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with pcre relative http_uri */ int DetectPcreParseTest22(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing pcre relative http_uri\"; " "content:\"test\"; " "http_uri; pcre:\"/abc/RU\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with inconsistent pcre relative */ int DetectPcreParseTest23(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing inconsistent pcre relative\"; " "content:\"GET\"; " "http_cookie; pcre:\"/abc/RM\"; sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with inconsistent pcre modifiers */ int DetectPcreParseTest24(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing inconsistent pcre modifiers\"; " "pcre:\"/abc/UI\"; sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with inconsistent pcre modifiers */ int DetectPcreParseTest25(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing inconsistent pcre modifiers\"; " "pcre:\"/abc/DH\"; sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Check a signature with inconsistent pcre modifiers */ static int DetectPcreParseTest26(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"Testing inconsistent pcre modifiers\"; " "pcre:\"/abc/F\"; sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } /** \test Bug 1098 */ static int DetectPcreParseTest27(void) { DetectEngineCtx *de_ctx = NULL; FAIL_IF( (de_ctx = DetectEngineCtxInit()) == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any 80 " "(content:\"baduricontent\"; http_raw_uri; " "pcre:\"/^[a-z]{5}\\.html/R\"; sid:2; rev:2;)"); FAIL_IF_NOT(de_ctx->sig_list == NULL); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); PASS; } static int DetectPcreTestSig01(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(TcpSession)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; pcre:\"/^gEt/i\"; pcre:\"/\\/two\\//U\"; pcre:\"/GET \\/two\\//\"; pcre:\"/\\s+HTTP/R\"; sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, buf, buflen); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1) == 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } static int DetectPcreTestSig02(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; Flow f; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); FLOW_INITIALIZE(&f); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; pcre_match_limit = 100; pcre_match_limit_recursion = 100; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; pcre:\"/two/O\"; sid:2;)"); FAIL_IF(de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 2) == 1); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } /** * \test DetectPcreTestSig03Real negation test ! outside of "" this sig should not match */ static int DetectPcreTestSig03(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"GET\"; pcre:!\"/two/\"; sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); PASS; } /** * \test Check the signature with pcre modifier P (match with L7 to http body data) */ static int DetectPcreModifPTest04(void) { uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8\r\n" "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Date: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Server: Apache\r\n" "X-Powered-By: PHP/5.2.5\r\n" "P3P: CP=\"NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM\"\r\n" "Expires: Mon, 1 Jan 2001 00:00:00 GMT\r\n" "Last-Modified: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\n" "Pragma: no-cache\r\n" "Keep-Alive: timeout=15, max=100\r\n" "Connection: Keep-Alive\r\n" "Transfer-Encoding: chunked\r\n" "Content-Type: text/html; charset=utf-8\r\n" "\r\n" "15" "\r\n" "flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"Pcre modifier P\"; pcre:\"/DOCTYPE/P\"; " "sid:1;)"); FAIL_IF(s == NULL); s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"" "Pcre modifier P (no match)\"; pcre:\"/blah/P\"; sid:2;)"); FAIL_IF(s->next == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); FAIL_IF(PacketAlertCheck(p, 2)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } /** * \test Check the signature with pcre modifier P (match with L7 to http body data) * over fragmented chunks (DOCTYPE fragmented) */ static int DetectPcreModifPTest05(void) { uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8\r\n" "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Date: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Server: Apache\r\n" "X-Powered-By: PHP/5.2.5\r\n" "P3P: CP=\"NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM\"\r\n" "Expires: Mon, 1 Jan 2001 00:00:00 GMT\r\n" "Last-Modified: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\n" "Pragma: no-cache\r\n" "Keep-Alive: timeout=15, max=100\r\n" "Connection: Keep-Alive\r\n" "Transfer-Encoding: chunked\r\n" "Content-Type: text/html; charset=utf-8\r\n" "\r\n" "15" "\r\n" "flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"Pcre modifier P\"; pcre:\"/DOC/P\"; " "sid:1;)"); FAIL_IF(s == NULL); s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"" "Pcre modifier P (no match)\"; pcre:\"/DOCTYPE/P\"; sid:2;)"); FAIL_IF(s->next == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); HtpState *http_state = f.alstate; FAIL_IF(http_state == NULL); FAIL_IF(PacketAlertCheck(p1, 1)); FAIL_IF(PacketAlertCheck(p1, 2)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect for p2 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); FAIL_IF(!(PacketAlertCheck(p2, 1))); FAIL_IF(!(PacketAlertCheck(p2, 2))); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); PASS; } int DetectPcreTestSig06() { uint8_t *buf = (uint8_t *) "lalala lalala\\ lala\n"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"pcre with an ending slash\"; pcre:\"/ lalala\\\\/\"; sid:1;)"; if (UTHPacketMatchSig(p, sig) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** \test anchored pcre */ int DetectPcreTestSig07() { uint8_t *buf = (uint8_t *) "lalala\n"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); char sig[] = "alert tcp any any -> any any (msg:\"pcre with an ending slash\"; pcre:\"/^(la)+$/\"; sid:1;)"; FAIL_IF(UTHPacketMatchSig(p, sig) == 0); if (p != NULL) UTHFreePacket(p); PASS; } /** \test anchored pcre */ int DetectPcreTestSig08() { /* test it also without ending in a newline "\n" */ uint8_t *buf = (uint8_t *) "lalala"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); char sig[] = "alert tcp any any -> any any (msg:\"pcre with an ending slash\"; pcre:\"/^(la)+$/\"; sid:1;)"; FAIL_IF(UTHPacketMatchSig(p, sig) == 0); if (p != NULL) UTHFreePacket(p); PASS; } /** \test Check the signature working to alert when cookie modifier is * passed to pcre */ static int DetectPcreTestSig09(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; pcre:\"/dummy/C\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when cookie modifier is * passed to a negated pcre */ static int DetectPcreTestSig10(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummoOOooooO\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; pcre:!\"/dummy/C\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when method modifier is * passed to pcre */ static int DetectPcreTestSig11(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP method\"; pcre:\"/POST/M\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when method modifier is * passed to a negated pcre */ static int DetectPcreTestSig12(void) { Flow f; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummoOOooooO\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP method\"; pcre:!\"/POST/M\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when header modifier is * passed to pcre */ static int DetectPcreTestSig13(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP header\"; pcre:\"/User[-_]Agent[:]?\\sMozilla/H\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when header modifier is * passed to a negated pcre */ static int DetectPcreTestSig14(void) { Flow f; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\nUser-Agent: IEXPLORER/1.0\r\n" "Cookie: dummoOOooooO\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP header\"; pcre:!\"/User-Agent[:]?\\s+Mozilla/H\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when cookie and relative modifiers are * passed to pcre */ static int DetectPcreTestSig15(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy 1234\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"pcre relative HTTP cookie\"; content:\"dummy\";" " http_cookie; pcre:\"/1234/RC\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Check the signature working to alert when method and relative modifiers are * passed to pcre */ static int DetectPcreTestSig16(void) { Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy 1234\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"pcre relative HTTP method\"; content:\"PO\";" " http_method; pcre:\"/ST/RM\"; " " sid:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); PASS; } /** \test Test tracking of body chunks per transactions (on requests) */ static int DetectPcreTxBodyChunksTest01(void) { Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Body one!!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nBody two!!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); AppLayerHtpEnableRequestBodyCallback(); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); FAIL_IF(r != 0); /* Now we should have 2 transactions, each with it's own list * of request body chunks (let's test it) */ HtpState *htp_state = f.alstate; FAIL_IF(htp_state == NULL); /* hardcoded check of the transactions and it's client body chunks */ FAIL_IF(AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2); htp_tx_t *t1 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); htp_tx_t *t2 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 1); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(t1); FAIL_IF(htud == NULL); HtpBodyChunk *cur = htud->request_body.first; FAIL_IF(htud->request_body.first == NULL); FAIL_IF(StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body one!!", 10) != 1); htud = (HtpTxUserData *) htp_tx_get_user_data(t2); cur = htud->request_body.first; FAIL_IF(htud->request_body.first == NULL); FAIL_IF(StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body two!!", 10) != 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); FLOWLOCK_UNLOCK(&f); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } /** \test test pcre P modifier with multiple pipelined http transactions */ static int DetectPcreTxBodyChunksTest02(void) { Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Body one!!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nBody two!!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; pcre:\"/one/P\"; sid:1; rev:1;)"); FAIL_IF(s == NULL); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; pcre:\"/two/P\"; sid:2; rev:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))); p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 2))); p->alerts.cnt = 0; HtpState *htp_state = f.alstate; FAIL_IF(htp_state == NULL); /* hardcoded check of the transactions and it's client body chunks */ FAIL_IF(AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2); htp_tx_t *t1 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); htp_tx_t *t2 = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 1); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(t1); HtpBodyChunk *cur = htud->request_body.first; FAIL_IF(htud->request_body.first == NULL); FAIL_IF(StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body one!!", 10) != 1); htud = (HtpTxUserData *) htp_tx_get_user_data(t2); cur = htud->request_body.first; FAIL_IF(htud->request_body.first == NULL); FAIL_IF(StreamingBufferSegmentCompareRawData(htud->request_body.sb, &cur->sbseg, (uint8_t *)"Body two!!", 10) != 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } /** \test multiple http transactions and body chunks of request handling */ static int DetectPcreTxBodyChunksTest03(void) { Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Body one!!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nBody two!!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; pcre:\"/one/P\"; sid:1; rev:1;)"); FAIL_IF(s == NULL); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; pcre:\"/two/P\"; sid:2; rev:1;)"); FAIL_IF(s == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))); p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 2))); p->alerts.cnt = 0; HtpState *htp_state = f.alstate; FAIL_IF(htp_state == NULL); FAIL_IF(AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } /** * \test flowvar capture on http buffer */ static int DetectPcreFlowvarCapture01(void) { uint8_t uabuf1[] = "Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13"; uint32_t ualen1 = sizeof(uabuf1) - 1; /* minus the \0 */ uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8\r\n" "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Date: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Server: Apache\r\n" "\r\n" "flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"User-Agent: \"; http_header; pcre:\"/(?P.*)\\r\\n/HR\"; sid:1;)"); FAIL_IF(s == NULL); FAIL_IF(s->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->type != DETECT_PCRE); DetectPcreData *pd = (DetectPcreData *)s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->ctx; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); FAIL_IF(!(PacketAlertCheck(p1, 1))); FlowVar *fv = FlowVarGet(&f, pd->capidx); FAIL_IF(fv == NULL); FAIL_IF(fv->data.fv_str.value_len != ualen1); if (memcmp(fv->data.fv_str.value, uabuf1, ualen1) != 0) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); PrintRawDataFp(stdout, uabuf1, ualen1); printf("buffer mismatch: "); FAIL; } if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); PASS; } /** * \test flowvar capture on http buffer, capture overwrite */ static int DetectPcreFlowvarCapture02(void) { uint8_t uabuf1[] = "Apache"; uint32_t ualen1 = sizeof(uabuf1) - 1; /* minus the \0 */ uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8\r\n" "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Date: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Server: Apache\r\n" "\r\n" "flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"User-Agent: \"; http_header; pcre:\"/(?P.*)\\r\\n/HR\"; priority:1; sid:1;)"); FAIL_IF(s == NULL); FAIL_IF(s->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->type != DETECT_PCRE); DetectPcreData *pd1 = (DetectPcreData *)s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->ctx; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"Server: \"; http_header; pcre:\"/(?P.*)\\r\\n/HR\"; priority:3; sid:2;)"); FAIL_IF(s == NULL); FAIL_IF(s->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->type != DETECT_PCRE); DetectPcreData *pd2 = (DetectPcreData *)s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->ctx; FAIL_IF(pd1->capidx != pd2->capidx); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); FAIL_IF(!(PacketAlertCheck(p1, 1))); FlowVar *fv = FlowVarGet(&f, pd1->capidx); FAIL_IF(fv == NULL); if (fv->data.fv_str.value_len != ualen1) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); PrintRawDataFp(stdout, uabuf1, ualen1); printf("%u != %u: ", fv->data.fv_str.value_len, ualen1); FAIL; } if (memcmp(fv->data.fv_str.value, uabuf1, ualen1) != 0) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); PrintRawDataFp(stdout, uabuf1, ualen1); printf("buffer mismatch: "); FAIL; } if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); PASS; } /** * \test flowvar capture on http buffer, capture overwrite + no matching sigs, so flowvars should not be set. */ static int DetectPcreFlowvarCapture03(void) { uint8_t httpbuf1[] = "GET / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.13) Gecko/2009080315 Ubuntu/8.10 (intrepid) Firefox/3.0.13\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9;q=0.8\r\n" "Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Date: Tue, 22 Sep 2009 19:24:48 GMT\r\n" "Server: Apache\r\n" "\r\n" "flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"User-Agent: \"; http_header; pcre:\"/(?P.*)\\r\\n/HR\"; content:\"xyz\"; http_header; priority:1; sid:1;)"); FAIL_IF(s == NULL); FAIL_IF(s->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->type != DETECT_PCRE); DetectPcreData *pd1 = (DetectPcreData *)s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->ctx; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"Server: \"; http_header; pcre:\"/(?P.*)\\r\\n/HR\"; content:\"xyz\"; http_header; priority:3; sid:2;)"); FAIL_IF(s == NULL); FAIL_IF(s->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next == NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->type != DETECT_PCRE); DetectPcreData *pd2 = (DetectPcreData *)s->sm_lists[DETECT_SM_LIST_HHDMATCH]->next->ctx; FAIL_IF(pd1->capidx != pd2->capidx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); FlowVar *fv = FlowVarGet(&f, pd1->capidx); FAIL_IF(fv != NULL); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); PASS; } /** * \brief Test parsing of pcre's with the W modifier set. */ static int DetectPcreParseHttpHost(void) { DetectPcreData *pd = NULL; int list = DETECT_SM_LIST_NOTSET; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); pd = DetectPcreParse(de_ctx, "/domain\\.com/W", &list); FAIL_IF(pd == NULL); DetectPcreFree(pd); list = DETECT_SM_LIST_NOTSET; pd = DetectPcreParse(de_ctx, "/dOmain\\.com/W", &list); FAIL_IF(pd != NULL); /* Uppercase meta characters are valid. */ list = DETECT_SM_LIST_NOTSET; pd = DetectPcreParse(de_ctx, "/domain\\D+\\.com/W", &list); FAIL_IF(pd == NULL); DetectPcreFree(pd); /* This should not parse as the first \ escapes the second \, then * we have a D. */ list = DETECT_SM_LIST_NOTSET; pd = DetectPcreParse(de_ctx, "/\\\\Ddomain\\.com/W", &list); FAIL_IF(pd != NULL); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectPcre */ void DetectPcreRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectPcreParseTest01", DetectPcreParseTest01); UtRegisterTest("DetectPcreParseTest02", DetectPcreParseTest02); UtRegisterTest("DetectPcreParseTest03", DetectPcreParseTest03); UtRegisterTest("DetectPcreParseTest04", DetectPcreParseTest04); UtRegisterTest("DetectPcreParseTest05", DetectPcreParseTest05); UtRegisterTest("DetectPcreParseTest06", DetectPcreParseTest06); UtRegisterTest("DetectPcreParseTest07", DetectPcreParseTest07); UtRegisterTest("DetectPcreParseTest08", DetectPcreParseTest08); UtRegisterTest("DetectPcreParseTest09", DetectPcreParseTest09); UtRegisterTest("DetectPcreParseTest10", DetectPcreParseTest10); UtRegisterTest("DetectPcreParseTest11", DetectPcreParseTest11); UtRegisterTest("DetectPcreParseTest12", DetectPcreParseTest12); UtRegisterTest("DetectPcreParseTest13", DetectPcreParseTest13); UtRegisterTest("DetectPcreParseTest14", DetectPcreParseTest14); UtRegisterTest("DetectPcreParseTest15", DetectPcreParseTest15); UtRegisterTest("DetectPcreParseTest16", DetectPcreParseTest16); UtRegisterTest("DetectPcreParseTest17", DetectPcreParseTest17); UtRegisterTest("DetectPcreParseTest18", DetectPcreParseTest18); UtRegisterTest("DetectPcreParseTest19", DetectPcreParseTest19); UtRegisterTest("DetectPcreParseTest20", DetectPcreParseTest20); UtRegisterTest("DetectPcreParseTest21", DetectPcreParseTest21); UtRegisterTest("DetectPcreParseTest22", DetectPcreParseTest22); UtRegisterTest("DetectPcreParseTest23", DetectPcreParseTest23); UtRegisterTest("DetectPcreParseTest24", DetectPcreParseTest24); UtRegisterTest("DetectPcreParseTest25", DetectPcreParseTest25); UtRegisterTest("DetectPcreParseTest26", DetectPcreParseTest26); UtRegisterTest("DetectPcreParseTest27", DetectPcreParseTest27); UtRegisterTest("DetectPcreTestSig01 -- pcre test", DetectPcreTestSig01); UtRegisterTest("DetectPcreTestSig02 -- pcre test", DetectPcreTestSig02); UtRegisterTest("DetectPcreTestSig03 -- negated pcre test", DetectPcreTestSig03); UtRegisterTest("DetectPcreModifPTest04 -- Modifier P", DetectPcreModifPTest04); UtRegisterTest("DetectPcreModifPTest05 -- Modifier P fragmented", DetectPcreModifPTest05); UtRegisterTest("DetectPcreTestSig06", DetectPcreTestSig06); UtRegisterTest("DetectPcreTestSig07 -- anchored pcre", DetectPcreTestSig07); UtRegisterTest("DetectPcreTestSig08 -- anchored pcre", DetectPcreTestSig08); UtRegisterTest("DetectPcreTestSig09 -- Cookie modifier", DetectPcreTestSig09); UtRegisterTest("DetectPcreTestSig10 -- negated Cookie modifier", DetectPcreTestSig10); UtRegisterTest("DetectPcreTestSig11 -- Method modifier", DetectPcreTestSig11); UtRegisterTest("DetectPcreTestSig12 -- negated Method modifier", DetectPcreTestSig12); UtRegisterTest("DetectPcreTestSig13 -- Header modifier", DetectPcreTestSig13); UtRegisterTest("DetectPcreTestSig14 -- negated Header modifier", DetectPcreTestSig14); UtRegisterTest("DetectPcreTestSig15 -- relative Cookie modifier", DetectPcreTestSig15); UtRegisterTest("DetectPcreTestSig16 -- relative Method modifier", DetectPcreTestSig16); UtRegisterTest("DetectPcreTxBodyChunksTest01", DetectPcreTxBodyChunksTest01); UtRegisterTest("DetectPcreTxBodyChunksTest02 -- modifier P, body chunks per tx", DetectPcreTxBodyChunksTest02); UtRegisterTest("DetectPcreTxBodyChunksTest03 -- modifier P, body chunks per tx", DetectPcreTxBodyChunksTest03); UtRegisterTest("DetectPcreFlowvarCapture01 -- capture for http_header", DetectPcreFlowvarCapture01); UtRegisterTest("DetectPcreFlowvarCapture02 -- capture for http_header", DetectPcreFlowvarCapture02); UtRegisterTest("DetectPcreFlowvarCapture03 -- capture for http_header", DetectPcreFlowvarCapture03); UtRegisterTest("DetectPcreParseHttpHost", DetectPcreParseHttpHost); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-cidr.h0000644000000000000000000000162513051004444013052 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_NETMASK_H__ #define __UTIL_NETMASK_H__ void CIDRInit(void); uint32_t CIDRGet(int); #endif /* __UTIL_NETMASK_H__ */ suricata-3.2.1/src/util-error.h0000644000000000000000000002403613051004444013263 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __ERROR_H__ #define __ERROR_H__ /* different error types */ typedef enum { SC_OK, SC_ERR_MEM_ALLOC, SC_ERR_PCRE_MATCH, SC_ERR_ACTION_ORDER, SC_ERR_PCRE_GET_SUBSTRING, SC_ERR_PCRE_COMPILE, SC_ERR_PCRE_STUDY, SC_ERR_PCRE_PARSE, SC_ERR_LOG_MODULE_NOT_INIT, SC_ERR_LOG_FG_FILTER_MATCH, SC_ERR_COUNTER_EXCEEDED, SC_ERR_INVALID_CHECKSUM, SC_ERR_SPRINTF, SC_ERR_INVALID_ARGUMENT, SC_ERR_SPINLOCK, SC_ERR_INVALID_ENUM_MAP, SC_ERR_INVALID_IP_NETBLOCK, SC_ERR_INVALID_IPV4_ADDR, SC_ERR_INVALID_IPV6_ADDR, SC_ERR_INVALID_RUNMODE, SC_ERR_PCAP_DISPATCH, SC_ERR_PCAP_CREATE, SC_ERR_PCAP_SET_SNAPLEN, SC_ERR_PCAP_SET_PROMISC, SC_ERR_PCAP_SET_TIMEOUT, SC_ERR_PCAP_OPEN_LIVE, SC_ERR_PCAP_OPEN_OFFLINE, SC_ERR_PCAP_ACTIVATE_HANDLE, SC_ERR_PCAP_SET_BUFF_SIZE, SC_ERR_NO_PCAP_SET_BUFFER_SIZE, SC_ERR_NO_PF_RING, SC_ERR_PF_RING_RECV, SC_ERR_PF_RING_GET_CLUSTERID_FAILED, SC_ERR_PF_RING_GET_INTERFACE_FAILED, SC_ERR_PF_RING_OPEN, SC_ERR_GET_CLUSTER_TYPE_FAILED, SC_ERR_INVALID_CLUSTER_TYPE, SC_ERR_PF_RING_SET_CLUSTER_FAILED, SC_ERR_DATALINK_UNIMPLEMENTED, SC_ERR_INVALID_SIGNATURE, SC_ERR_OPENING_FILE, SC_ERR_OPENING_RULE_FILE, SC_ERR_NO_RULES, SC_ERR_NO_RULES_LOADED, SC_ERR_FOPEN, SC_ERR_INITIALIZATION, SC_ERR_THREAD_SPAWN, SC_ERR_THREAD_NICE_PRIO, SC_ERR_THREAD_CREATE, SC_ERR_THREAD_INIT, /**< thread's initialization function failed */ SC_ERR_SYSCALL, SC_ERR_SYSCONF, SC_ERR_INVALID_ARGUMENTS, SC_ERR_STATS_NOT_INIT, SC_ERR_COMPLETE_PORT_SPACE_NEGATED, SC_ERR_NO_PORTS_LEFT_AFTER_MERGE, SC_ERR_NEGATED_VALUE_IN_PORT_RANGE, SC_ERR_PORT_PARSE_INSERT_STRING, SC_ERR_UNREACHABLE_CODE_REACHED, SC_ERR_ALPARSER, SC_ERR_INVALID_NUMERIC_VALUE, SC_ERR_NUMERIC_VALUE_ERANGE, SC_ERR_INVALID_NUM_BYTES, SC_ERR_ARG_LEN_LONG, SC_ERR_POOL_EMPTY, SC_ERR_REASSEMBLY, SC_ERR_POOL_INIT, SC_ERR_NFQ_NOSUPPORT, SC_ERR_NFQ_OPEN, SC_ERR_NFQ_BIND, SC_ERR_NFQ_UNBIND, SC_ERR_NFQ_MAXLEN, SC_ERR_NFQ_CREATE_QUEUE, SC_ERR_NFQ_SET_MODE, SC_ERR_NFQ_SETSOCKOPT, SC_ERR_NFQ_RECV, SC_ERR_NFQ_HANDLE_PKT, SC_ERR_NFQ_SET_VERDICT, SC_ERR_NFQ_THREAD_INIT, SC_ERR_IPFW_NOSUPPORT, SC_ERR_IPFW_BIND, SC_ERR_IPFW_SOCK, SC_ERR_IPFW_NOPORT, SC_WARN_IPFW_RECV, SC_WARN_IPFW_XMIT, SC_WARN_IPFW_SETSOCKOPT, SC_WARN_IPFW_UNBIND, SC_ERR_DAEMON, SC_ERR_UNIMPLEMENTED, SC_ERR_ADDRESS_ENGINE_GENERIC, SC_ERR_PORT_ENGINE_GENERIC, SC_ERR_IPONLY_RADIX, SC_ERR_FAST_LOG_GENERIC, SC_ERR_DEBUG_LOG_GENERIC, SC_ERR_UNIFIED_LOG_GENERIC, SC_ERR_HTTP_LOG_GENERIC, SC_ERR_TLS_LOG_GENERIC, SC_ERR_UNIFIED_ALERT_GENERIC, SC_ERR_UNIFIED2_ALERT_GENERIC, SC_ERR_FWRITE, SC_ERR_THRESHOLD_HASH_ADD, SC_ERR_UNDEFINED_VAR, SC_ERR_RULE_KEYWORD_UNKNOWN, SC_ERR_FLAGS_MODIFIER, SC_ERR_DISTANCE_MISSING_CONTENT, SC_ERR_WITHIN_MISSING_CONTENT, SC_ERR_WITHIN_INVALID, SC_ERR_OFFSET_MISSING_CONTENT, SC_ERR_DEPTH_MISSING_CONTENT, SC_ERR_BYTETEST_MISSING_CONTENT, SC_ERR_BYTEJUMP_MISSING_CONTENT, SC_ERR_NOCASE_MISSING_PATTERN, SC_ERR_RAWBYTES_MISSING_CONTENT, SC_ERR_NO_URICONTENT_NEGATION, SC_ERR_HASH_TABLE_INIT, SC_ERR_STAT, SC_ERR_LOGDIR_CONFIG, SC_ERR_LOGDIR_CMDLINE, SC_ERR_MISSING_CONFIG_PARAM, SC_ERR_RADIX_TREE_GENERIC, SC_ERR_MISSING_QUOTE, SC_ERR_MUTEX, SC_ERR_REPUTATION_INVALID_OPERATION, SC_ERR_REPUTATION_INVALID_TYPE, SC_ERR_UNKNOWN_PROTOCOL, /**< signature contains invalid protocol */ SC_ERR_UNKNOWN_RUN_MODE, SC_ERR_MULTIPLE_RUN_MODE, SC_ERR_BPF, SC_ERR_BYTE_EXTRACT_FAILED, SC_ERR_UNKNOWN_VALUE, SC_ERR_INVALID_VALUE, SC_ERR_UNKNOWN_REGEX_MOD, SC_ERR_INVALID_OPERATOR, SC_ERR_PCAP_RECV_INIT, SC_ERR_CUDA_ERROR, SC_ERR_CUDA_HANDLER_ERROR, SC_ERR_TM_THREADS_ERROR, SC_ERR_TM_MODULES_ERROR, SC_ERR_AC_CUDA_ERROR, SC_ERR_INVALID_YAML_CONF_ENTRY, SC_ERR_TMQ_ALREADY_REGISTERED, SC_ERR_CONFLICTING_RULE_KEYWORDS, SC_ERR_INVALID_ACTION, SC_ERR_LIBNET_REQUIRED_FOR_ACTION, SC_ERR_LIBNET_INIT, SC_ERR_LIBNET_INVALID_DIR, SC_ERR_LIBNET_BUILD_FAILED, SC_ERR_LIBNET_WRITE_FAILED, SC_ERR_LIBNET_NOT_ENABLED, SC_ERR_UNIFIED_LOG_FILE_HEADER, /**< Error to indicate the unified file header writing function has been failed */ SC_ERR_REFERENCE_UNKNOWN, /**< unknown reference key (cve, url, etc) */ SC_ERR_PIDFILE_SNPRINTF, SC_ERR_PIDFILE_OPEN, SC_ERR_PIDFILE_WRITE, SC_ERR_PIDFILE_DAEMON, SC_ERR_UID_FAILED, SC_ERR_GID_FAILED, SC_ERR_CHANGING_CAPS_FAILED, SC_ERR_LIBCAP_NG_REQUIRED, SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG, SC_WARN_FLOW_EMERGENCY, SC_WARN_COMPATIBILITY, SC_ERR_SVC, SC_ERR_ERF_DAG_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_START_FAILED, SC_ERR_ERF_DAG_STREAM_SET_FAILED, SC_ERR_ERF_DAG_STREAM_READ_FAILED, SC_WARN_ERF_DAG_REC_LEN_CHANGED, SC_ERR_DAG_REQUIRED, SC_ERR_DAG_NOSUPPORT, /**< no ERF/DAG support compiled in */ SC_ERR_FATAL, SC_ERR_DCERPC, SC_ERR_DETECT_PREPARE, /**< preparing the detection engine failed */ SC_ERR_AHO_CORASICK, SC_ERR_REFERENCE_CONFIG, SC_ERR_DUPLICATE_SIG, /**< Error to indicate that signature is duplicate */ SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL, SC_ERR_PCAP_MULTI_DEV_NO_SUPPORT, SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, SC_ERR_HTTP_METHOD_INCOMPATIBLE_WITH_RAWBYTES, SC_ERR_HTTP_METHOD_RELATIVE_MISSING, SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT, SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES, SC_ERR_HTTP_COOKIE_RELATIVE_MISSING, SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING, SC_ERR_UNKNOWN_DECODE_EVENT, SC_ERR_RUNMODE, SC_ERR_SHUTDOWN, SC_ERR_INVALID_DIRECTION, SC_ERR_AFP_CREATE, SC_ERR_AFP_READ, SC_ERR_AFP_DISPATCH, SC_ERR_NO_AF_PACKET, SC_ERR_PCAP_FILE_DELETE_FAILED, SC_ERR_CMD_LINE, SC_ERR_MAGIC_OPEN, SC_ERR_MAGIC_LOAD, SC_ERR_SIZE_PARSE, SC_ERR_RAWBYTES_FILE_DATA, SC_ERR_SOCKET, SC_ERR_PCAP_TRANSLATE, /* failed to translate ip to dev */ SC_WARN_OUTDATED_LIBHTP, SC_WARN_DEPRECATED, SC_WARN_PROFILE, SC_ERR_FLOW_INIT, SC_ERR_HOST_INIT, SC_ERR_MEM_BUFFER_API, SC_ERR_INVALID_MD5, SC_ERR_NO_MD5_SUPPORT, SC_ERR_EVENT_ENGINE, SC_ERR_NO_LUA_SUPPORT, SC_ERR_LUA_ERROR, SC_ERR_DEFRAG_INIT, SC_ERR_NAPATECH_OPEN_FAILED, SC_ERR_NAPATECH_STREAM_NEXT_FAILED, SC_ERR_NAPATECH_NOSUPPORT, SC_ERR_NAPATECH_REQUIRED, SC_ERR_NAPATECH_TIMESTAMP_TYPE_NOT_SUPPORTED, SC_ERR_NAPATECH_INIT_FAILED, SC_ERR_NAPATECH_CONFIG_STREAM, SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, SC_ERR_NAPATECH_STAT_DROPS_FAILED, SC_ERR_NAPATECH_PARSE_CONFIG, SC_ERR_NO_REPUTATION, SC_ERR_NOT_SUPPORTED, SC_ERR_IPFW_SETSOCKOPT, SC_ERR_NO_GEOIP_SUPPORT, SC_ERR_GEOIP_ERROR, SC_ERR_LIVE_RULE_SWAP, SC_WARN_UNCOMMON, SC_ERR_CUDA_BUFFER_ERROR, SC_ERR_DNS_LOG_GENERIC, SC_WARN_OPTION_OBSOLETE, SC_WARN_NO_UNITTESTS, SC_ERR_THREAD_QUEUE, SC_WARN_XFF_INVALID_MODE, SC_WARN_XFF_INVALID_HEADER, SC_WARN_XFF_INVALID_DEPLOYMENT, SC_ERR_THRESHOLD_SETUP, SC_ERR_DNS_CONFIG, SC_ERR_MODBUS_CONFIG, SC_ERR_CONF_YAML_ERROR, SC_ERR_CONF_NAME_TOO_LONG, SC_ERR_APP_LAYER_PROTOCOL_DETECTION, SC_ERR_PCIE_INIT_FAILED, SC_ERR_NFLOG_NOSUPPORT, SC_ERR_NFLOG_OPEN, SC_ERR_NFLOG_BIND, SC_ERR_NFLOG_UNBIND, SC_ERR_NFLOG_MAX_BUFSIZ, SC_ERR_NFLOG_SET_MODE, SC_ERR_NFLOG_HANDLE_PKT, SC_ERR_NFLOG_GROUP, SC_ERR_NFLOG_FD, SC_WARN_NFLOG_RECV, SC_WARN_NFLOG_LOSING_EVENTS, SC_WARN_NFLOG_MAXBUFSIZ_REACHED, SC_WARN_NFLOG_SETSOCKOPT, SC_WARN_LUA_SCRIPT, SC_ERR_LUA_SCRIPT, SC_WARN_NO_STATS_LOGGERS, SC_ERR_NO_NETMAP, SC_ERR_NETMAP_CREATE, SC_ERR_NETMAP_READ, SC_ERR_THREAD_DEINIT, /**< thread's deinit function failed */ SC_ERR_IPPAIR_INIT, SC_ERR_MT_NO_SELECTOR, SC_ERR_MT_DUPLICATE_TENANT, SC_ERR_NO_JSON_SUPPORT, SC_ERR_INVALID_RULE_ARGUMENT, /**< Generic error code for invalid * rule argument. */ SC_ERR_MT_NO_MAPPING, SC_ERR_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/ SC_ERR_JSON_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/ SC_ERR_DEPRECATED_CONF, /**< Deprecated configuration parameter. */ SC_WARN_FASTER_CAPTURE_AVAILABLE, SC_WARN_POOR_RULE, SC_ERR_ALERT_PAYLOAD_BUFFER, SC_ERR_STATS_LOG_GENERIC, SC_ERR_TCPDATA_LOG_GENERIC, SC_ERR_FLOW_LOG_GENERIC, SC_ERR_NETFLOW_LOG_GENERIC, SC_ERR_SMTP_LOG_GENERIC, SC_ERR_SSH_LOG_GENERIC, SC_ERR_NIC_OFFLOADING, SC_ERR_NO_FILES_FOR_PROTOCOL, SC_ERR_INVALID_HASH, SC_ERR_NO_SHA1_SUPPORT, SC_ERR_NO_SHA256_SUPPORT, SC_ERR_ENIP_CONFIG, SC_ERR_DNP3_CONFIG, SC_ERR_DIR_OPEN, SC_WARN_REMOVE_FILE, SC_ERR_NO_MAGIC_SUPPORT, SC_ERR_REDIS, } SCError; const char *SCErrorToString(SCError); #endif /* __ERROR_H__ */ suricata-3.2.1/src/detect-app-layer-event.c0000644000000000000000000006733213051004444015437 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-smtp.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-app-layer-event.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "decode-events.h" #include "util-byte.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "stream-tcp-util.h" #define MAX_ALPROTO_NAME 50 static int DetectAppLayerEventPktMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx); static int DetectAppLayerEventAppMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectAppLayerEventSetupP1(DetectEngineCtx *, Signature *, char *); static void DetectAppLayerEventRegisterTests(void); static void DetectAppLayerEventFree(void *); static int DetectEngineAptEventInspect(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); /** * \brief Registers the keyword handlers for the "app-layer-event" keyword. */ void DetectAppLayerEventRegister(void) { sigmatch_table[DETECT_AL_APP_LAYER_EVENT].name = "app-layer-event"; sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Match = DetectAppLayerEventPktMatch; sigmatch_table[DETECT_AL_APP_LAYER_EVENT].AppLayerMatch = DetectAppLayerEventAppMatch; sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Setup = DetectAppLayerEventSetupP1; sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Free = DetectAppLayerEventFree; sigmatch_table[DETECT_AL_APP_LAYER_EVENT].RegisterTests = DetectAppLayerEventRegisterTests; DetectAppLayerInspectEngineRegister(ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, DETECT_SM_LIST_APP_EVENT, DetectEngineAptEventInspect); DetectAppLayerInspectEngineRegister(ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_APP_EVENT, DetectEngineAptEventInspect); return; } static int DetectEngineAptEventInspect(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { AppLayerDecoderEvents *decoder_events = NULL; int r = 0; AppProto alproto; SigMatch *sm; DetectAppLayerEventData *aled = NULL; alproto = f->alproto; decoder_events = AppLayerParserGetEventsByTx(f->proto, alproto, alstate, tx_id); if (decoder_events == NULL) goto end; for (sm = s->sm_lists[DETECT_SM_LIST_APP_EVENT]; sm != NULL; sm = sm->next) { aled = (DetectAppLayerEventData *)sm->ctx; KEYWORD_PROFILING_START; if (AppLayerDecoderEventsIsEventSet(decoder_events, aled->event_id)) { KEYWORD_PROFILING_END(det_ctx, sm->type, 1); continue; } KEYWORD_PROFILING_END(det_ctx, sm->type, 0); goto end; } r = 1; end: if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { if (AppLayerParserGetStateProgress(f->proto, alproto, tx, flags) == AppLayerParserGetStateProgressCompletionStatus(alproto, flags)) { return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else { return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } } } static int DetectAppLayerEventPktMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectAppLayerEventData *aled = (const DetectAppLayerEventData *)ctx; return AppLayerDecoderEventsIsEventSet(p->app_layer_events, aled->event_id); } static int DetectAppLayerEventAppMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); AppLayerDecoderEvents *decoder_events = NULL; int r = 0; DetectAppLayerEventData *aled = (DetectAppLayerEventData *)m->ctx; if (r == 0) { decoder_events = AppLayerParserGetDecoderEvents(f->alparser); if (decoder_events != NULL && AppLayerDecoderEventsIsEventSet(decoder_events, aled->event_id)) { r = 1; } } SCReturnInt(r); } static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg, AppLayerEventType *event_type) { DetectAppLayerEventData *aled; int event_id = 0; int r = 0; r = AppLayerGetPktEventInfo(arg, &event_id); if (r < 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword " "supplied with packet based event - \"%s\" that isn't " "supported yet.", arg); return NULL; } aled = SCMalloc(sizeof(DetectAppLayerEventData)); if (unlikely(aled == NULL)) return NULL; memset(aled,0x00,sizeof(*aled)); aled->event_id = event_id; *event_type = APP_LAYER_EVENT_TYPE_PACKET; return aled; } static int DetectAppLayerEventParseAppP2(DetectAppLayerEventData *data, uint8_t *ipproto_bitarray, AppLayerEventType *event_type) { int event_id = 0; const char *p_idx; uint8_t ipproto; char alproto_name[MAX_ALPROTO_NAME]; int r = 0; p_idx = strchr(data->arg, '.'); if (strlen(data->arg) > MAX_ALPROTO_NAME) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword is too long or malformed"); return -1; } strlcpy(alproto_name, data->arg, p_idx - data->arg + 1); if (ipproto_bitarray[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8)) { ipproto = IPPROTO_TCP; } else if (ipproto_bitarray[IPPROTO_UDP / 8] & 1 << (IPPROTO_UDP % 8)) { ipproto = IPPROTO_UDP; } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "protocol %s is disabled", alproto_name); return -1; } r = AppLayerParserGetEventInfo(ipproto, data->alproto, p_idx + 1, &event_id, event_type); if (r < 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword's " "protocol \"%s\" doesn't have event \"%s\" registered", alproto_name, p_idx + 1); return -1; } data->event_id = event_id; return 0; } static DetectAppLayerEventData *DetectAppLayerEventParseAppP1(const char *arg) { /* period index */ DetectAppLayerEventData *aled; AppProto alproto; const char *p_idx; char alproto_name[MAX_ALPROTO_NAME]; p_idx = strchr(arg, '.'); if (strlen(arg) > MAX_ALPROTO_NAME) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword is too long or malformed"); return NULL; } /* + 1 for trailing \0 */ strlcpy(alproto_name, arg, p_idx - arg + 1); alproto = AppLayerGetProtoByName(alproto_name); if (alproto == ALPROTO_UNKNOWN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword " "supplied with unknown protocol \"%s\"", alproto_name); return NULL; } aled = SCMalloc(sizeof(*aled)); if (unlikely(aled == NULL)) return NULL; memset(aled, 0x00, sizeof(*aled)); aled->alproto = alproto; aled->arg = SCStrdup(arg); if (aled->arg == NULL) { SCFree(aled); return NULL; } return aled; } static DetectAppLayerEventData *DetectAppLayerEventParse(const char *arg, AppLayerEventType *event_type) { *event_type = 0; if (arg == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword supplied " "with no arguments. This keyword needs an argument."); return NULL; } while (*arg != '\0' && isspace((unsigned char)*arg)) arg++; if (strchr(arg, '.') == NULL) { return DetectAppLayerEventParsePkt(arg, event_type); } else { return DetectAppLayerEventParseAppP1(arg); } } static int DetectAppLayerEventSetupP2(Signature *s, SigMatch *sm) { AppLayerEventType event_type = 0; if (DetectAppLayerEventParseAppP2((DetectAppLayerEventData *)sm->ctx, s->proto.proto, &event_type) < 0) { /* DetectAppLayerEventParseAppP2 prints errors */ return -1; } if (event_type == APP_LAYER_EVENT_TYPE_GENERAL) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); else SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_APP_EVENT); /* We should have set this flag already in SetupP1 */ s->flags |= SIG_FLAG_APPLAYER; return 0; } static int DetectAppLayerEventSetupP1(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectAppLayerEventData *data = NULL; SigMatch *sm = NULL; AppLayerEventType event_type; data = DetectAppLayerEventParse(arg, &event_type); if (data == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_APP_LAYER_EVENT; sm->ctx = (SigMatchCtx *)data; if (s->alproto != ALPROTO_UNKNOWN) { if (s->alproto != data->alproto) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains " "conflicting keywords needing different alprotos"); goto error; } } else { s->alproto = data->alproto; } if (event_type == APP_LAYER_EVENT_TYPE_PACKET) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); } else { /* We push it to this list temporarily. We deal with * these in DetectAppLayerEventPrepare(). */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_APP_EVENT); s->flags |= SIG_FLAG_APPLAYER; } return 0; error: if (data) SCFree(data); if (sm) { sm->ctx = NULL; SigMatchFree(sm); } return -1; } static void DetectAppLayerEventFree(void *ptr) { DetectAppLayerEventData *data = (DetectAppLayerEventData *)ptr; if (data->arg != NULL) SCFree(data->arg); SCFree(ptr); return; } int DetectAppLayerEventPrepare(Signature *s) { SigMatch *sm = s->sm_lists[DETECT_SM_LIST_APP_EVENT]; s->sm_lists[DETECT_SM_LIST_APP_EVENT] = NULL; s->sm_lists_tail[DETECT_SM_LIST_APP_EVENT] = NULL; while (sm != NULL) { sm->next = sm->prev = NULL; if (DetectAppLayerEventSetupP2(s, sm) < 0) return -1; sm = sm->next; } return 0; } /**********************************Unittests***********************************/ #ifdef UNITTESTS /* UNITTESTS */ #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #define APP_LAYER_EVENT_TEST_MAP_EVENT1 0 #define APP_LAYER_EVENT_TEST_MAP_EVENT2 1 #define APP_LAYER_EVENT_TEST_MAP_EVENT3 2 #define APP_LAYER_EVENT_TEST_MAP_EVENT4 3 #define APP_LAYER_EVENT_TEST_MAP_EVENT5 4 #define APP_LAYER_EVENT_TEST_MAP_EVENT6 5 SCEnumCharMap app_layer_event_test_map[ ] = { { "event1", APP_LAYER_EVENT_TEST_MAP_EVENT1 }, { "event2", APP_LAYER_EVENT_TEST_MAP_EVENT2 }, { "event3", APP_LAYER_EVENT_TEST_MAP_EVENT3 }, { "event4", APP_LAYER_EVENT_TEST_MAP_EVENT4 }, { "event5", APP_LAYER_EVENT_TEST_MAP_EVENT5 }, { "event6", APP_LAYER_EVENT_TEST_MAP_EVENT6 }, }; static int DetectAppLayerEventTestGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, app_layer_event_test_map); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "app-layer-event's test enum map table.", event_name); /* this should be treated as fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_GENERAL; return 0; } int DetectAppLayerEventTest01(void) { AppLayerParserBackupParserTable(); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_SMTP, DetectAppLayerEventTestGetEventInfo); AppLayerEventType event_type; int result = 0; uint8_t ipproto_bitarray[256 / 8]; memset(ipproto_bitarray, 0, sizeof(ipproto_bitarray)); ipproto_bitarray[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8); DetectAppLayerEventData *aled = DetectAppLayerEventParse("smtp.event1", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_SMTP || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT1) { printf("test failure. Holding wrong state\n"); goto end; } result = 1; end: AppLayerParserRestoreParserTable(); if (aled != NULL) DetectAppLayerEventFree(aled); return result; } int DetectAppLayerEventTest02(void) { AppLayerParserBackupParserTable(); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_SMTP, DetectAppLayerEventTestGetEventInfo); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_HTTP, DetectAppLayerEventTestGetEventInfo); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_SMB, DetectAppLayerEventTestGetEventInfo); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_FTP, DetectAppLayerEventTestGetEventInfo); AppLayerEventType event_type; int result = 0; uint8_t ipproto_bitarray[256 / 8]; memset(ipproto_bitarray, 0, sizeof(ipproto_bitarray)); ipproto_bitarray[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8); DetectAppLayerEventData *aled = DetectAppLayerEventParse("smtp.event1", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_SMTP || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT1) { printf("test failure. Holding wrong state\n"); goto end; } aled = DetectAppLayerEventParse("smtp.event4", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_SMTP || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT4) { printf("test failure. Holding wrong state\n"); goto end; } aled = DetectAppLayerEventParse("http.event2", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_HTTP || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT2) { printf("test failure. Holding wrong state\n"); goto end; } aled = DetectAppLayerEventParse("smb.event3", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_SMB || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT3) { printf("test failure. Holding wrong state\n"); goto end; } aled = DetectAppLayerEventParse("ftp.event5", &event_type); if (aled == NULL) goto end; if (DetectAppLayerEventParseAppP2(aled, ipproto_bitarray, &event_type) < 0) { printf("failure 1\n"); goto end; } if (aled->alproto != ALPROTO_FTP || aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT5) { printf("test failure. Holding wrong state\n"); goto end; } result = 1; end: AppLayerParserRestoreParserTable(); if (aled != NULL) DetectAppLayerEventFree(aled); return result; } int DetectAppLayerEventTest03(void) { ThreadVars tv; TcpReassemblyThreadCtx *ra_ctx = NULL; Packet *p = NULL; Flow *f = NULL; TcpSession ssn; TcpStream stream_ts, stream_tc; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; uint8_t buf_ts[] = "GET /index.html HTTP/1.1\r\n" "Host: 127.0.0.1\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-us,en;q=0.5\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Keep-Alive: 115\r\n" "Connection: keep-alive\r\n" "\r\n"; uint8_t buf_tc[] = "HTTP/1.1 200 OK\r\n" "Date: Fri, 22 Oct 2010 12:31:08 GMT\r\n" "Server: Apache/2.2.15 (Unix) DAV/2\r\n" "Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\n" "ETag: \"ab8486-2c-3e9564c23b600\"\r\n" "Accept-Ranges: bytes\r\n" "Content-Length: 44\r\n" "Keep-Alive: timeout=5, max=100\r\n" "Connection: Keep-Alive\r\n" "Content-Type: text/html\r\n" "\r\n" "

It works!

"; memset(&tv, 0, sizeof (ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); memset(&stream_ts, 0, sizeof(TcpStream)); memset(&stream_tc, 0, sizeof(TcpStream)); ssn.data_first_seen_dir = STREAM_TOSERVER; de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(app-layer-event: applayer_mismatch_protocol_both_directions; " "sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); FAIL_IF(f == NULL); FLOW_INITIALIZE(f); f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->flags |= FLOW_IPV4; p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); p->flow = f; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; StreamTcpUTInit(&ra_ctx); p->flowflags = FLOW_PKT_TOSERVER; FAIL_IF(AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF (PacketAlertCheck(p, 1)); p->flowflags = FLOW_PKT_TOCLIENT; FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); StreamTcpUTDeinit(ra_ctx); PASS; } int DetectAppLayerEventTest04(void) { ThreadVars tv; TcpReassemblyThreadCtx *ra_ctx = NULL; Packet *p = NULL; Flow *f = NULL; TcpSession ssn; TcpStream stream_ts, stream_tc; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; uint8_t buf_ts[] = "GET /index.html HTTP/1.1\r\n" "Host: 127.0.0.1\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-us,en;q=0.5\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Keep-Alive: 115\r\n" "Connection: keep-alive\r\n" "\r\n"; uint8_t buf_tc[] = "XTTP/1.1 200 OK\r\n" "Date: Fri, 22 Oct 2010 12:31:08 GMT\r\n" "Server: Apache/2.2.15 (Unix) DAV/2\r\n" "Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT\r\n" "ETag: \"ab8486-2c-3e9564c23b600\"\r\n" "Accept-Ranges: bytes\r\n" "Content-Length: 44\r\n" "Keep-Alive: timeout=5, max=100\r\n" "Connection: Keep-Alive\r\n" "Content-Type: text/html\r\n" "\r\n" "

It works!

"; memset(&tv, 0, sizeof (ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); memset(&stream_ts, 0, sizeof(TcpStream)); memset(&stream_tc, 0, sizeof(TcpStream)); ssn.data_first_seen_dir = STREAM_TOSERVER; de_ctx = DetectEngineCtxInit(); FAIL_IF (de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(app-layer-event: applayer_detect_protocol_only_one_direction; " "sid:1;)"); FAIL_IF(de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); FAIL_IF (f == NULL); FLOW_INITIALIZE(f); f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->flags |= FLOW_IPV4; p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); p->flow = f; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; StreamTcpUTInit(&ra_ctx); p->flowflags = FLOW_PKT_TOSERVER; FAIL_IF(AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF (PacketAlertCheck(p, 1)); p->flowflags = FLOW_PKT_TOCLIENT; FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF (!PacketAlertCheck(p, 1)); StreamTcpUTDeinit(ra_ctx); PASS; } int DetectAppLayerEventTest05(void) { ThreadVars tv; TcpReassemblyThreadCtx *ra_ctx = NULL; Packet *p = NULL; Flow *f = NULL; TcpSession ssn; TcpStream stream_ts, stream_tc; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; uint8_t buf_ts[] = "GET /index.html HTTP/1.1\r\n" "Host: 127.0.0.1\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100402 Firefox/3.6.3\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-us,en;q=0.5\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Keep-Alive: 115\r\n" "Connection: keep-alive\r\n" "\r\n"; /* tls */ uint8_t buf_tc[] = { 0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00, 0x82, 0x00, 0x80, 0xd3, 0x6f, 0x1f, 0x63, 0x82, 0x8d, 0x75, 0x77, 0x8c, 0x91, 0xbc, 0xa1, 0x3d, 0xbb, 0xe1, 0xb5, 0xd3, 0x31, 0x92, 0x59, 0x2b, 0x2c, 0x43, 0x96, 0xa3, 0xaa, 0x23, 0x92, 0xd0, 0x91, 0x2a, 0x5e, 0x10, 0x5b, 0xc8, 0xc1, 0xe2, 0xd3, 0x5c, 0x8b, 0x8c, 0x91, 0x9e, 0xc2, 0xf2, 0x9c, 0x3c, 0x4f, 0x37, 0x1e, 0x20, 0x5e, 0x33, 0xd5, 0xf0, 0xd6, 0xaf, 0x89, 0xf5, 0xcc, 0xb2, 0xcf, 0xc1, 0x60, 0x3a, 0x46, 0xd5, 0x4e, 0x2a, 0xb6, 0x6a, 0xb9, 0xfc, 0x32, 0x8b, 0xe0, 0x6e, 0xa0, 0xed, 0x25, 0xa0, 0xa4, 0x82, 0x81, 0x73, 0x90, 0xbf, 0xb5, 0xde, 0xeb, 0x51, 0x8d, 0xde, 0x5b, 0x6f, 0x94, 0xee, 0xba, 0xe5, 0x69, 0xfa, 0x1a, 0x80, 0x30, 0x54, 0xeb, 0x12, 0x01, 0xb9, 0xfe, 0xbf, 0x82, 0x95, 0x01, 0x7b, 0xb0, 0x97, 0x14, 0xc2, 0x06, 0x3c, 0x69, 0xfb, 0x1c, 0x66, 0x47, 0x17, 0xd9, 0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0xf6, 0xbc, 0x0d, 0x6f, 0xe8, 0xbb, 0xaa, 0xbf, 0x14, 0xeb, 0x7b, 0xcc, 0x6c, 0x28, 0xb0, 0xfc, 0xa6, 0x01, 0x2a, 0x97, 0x96, 0x17, 0x5e, 0xe8, 0xb4, 0x4e, 0x78, 0xc9, 0x04, 0x65, 0x53, 0xb6, 0x93, 0x3d, 0xeb, 0x44, 0xee, 0x86, 0xf9, 0x80, 0x49, 0x45, 0x21, 0x34, 0xd1, 0xee, 0xc8, 0x9c, }; memset(&tv, 0, sizeof (ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); memset(&stream_ts, 0, sizeof(TcpStream)); memset(&stream_tc, 0, sizeof(TcpStream)); ssn.data_first_seen_dir = STREAM_TOSERVER; de_ctx = DetectEngineCtxInit(); FAIL_IF (de_ctx == NULL); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(app-layer-event: applayer_mismatch_protocol_both_directions; " "sid:1;)"); FAIL_IF (de_ctx->sig_list == NULL); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); FAIL_IF (f == NULL); FLOW_INITIALIZE(f); f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->flags |= FLOW_IPV4; p = PacketGetFromAlloc(); FAIL_IF (unlikely(p == NULL)); p->flow = f; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; StreamTcpUTInit(&ra_ctx); p->flowflags = FLOW_PKT_TOSERVER; FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_ts, buf_ts, sizeof(buf_ts), STREAM_TOSERVER | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF (PacketAlertCheck(p, 1)); p->flowflags = FLOW_PKT_TOCLIENT; FAIL_IF (AppLayerHandleTCPData(&tv, ra_ctx, p, f, &ssn, &stream_tc, buf_tc, sizeof(buf_tc), STREAM_TOCLIENT | STREAM_START) < 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF (!PacketAlertCheck(p, 1)); StreamTcpUTDeinit(ra_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for "app-layer-event" keyword. */ void DetectAppLayerEventRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectAppLayerEventTest01", DetectAppLayerEventTest01); UtRegisterTest("DetectAppLayerEventTest02", DetectAppLayerEventTest02); UtRegisterTest("DetectAppLayerEventTest03", DetectAppLayerEventTest03); UtRegisterTest("DetectAppLayerEventTest04", DetectAppLayerEventTest04); UtRegisterTest("DetectAppLayerEventTest05", DetectAppLayerEventTest05); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/detect-engine-hua.c0000644000000000000000000014636113051004444014446 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP user agent match * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "detect-engine-hua.h" #include "util-validate.h" /** \brief HTTP UA Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxUA(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_headers == NULL) return; htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, "User-Agent"); if (h == NULL || h->value == NULL) { SCLogDebug("HTTP UA header not present in this request"); return; } const uint32_t buffer_len = bstr_len(h->value); const uint8_t *buffer = bstr_ptr(h->value); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxUARegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxUA, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_user_agent"); } /** * \brief Do the http_user_agent content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpUA(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, "User-Agent"); if (h == NULL) { SCLogDebug("HTTP user agent header not present in this request"); goto end; } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HUADMATCH], f, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CONNECT\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CO\"; depth:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_user_agent test\"; " "content:!\"ECT\"; depth:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"ECT\"; depth:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:!\"CON\"; depth:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"ECT\"; offset:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:!\"CO\"; offset:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:!\"ECT\"; offset:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CON\"; offset:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_user_agent test\"; " "content:\"CO\"; http_user_agent; " "content:\"EC\"; within:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CO\"; http_user_agent; " "content:!\"EC\"; within:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_user_agent test\"; " "content:\"CO\"; http_user_agent; " "content:\"EC\"; within:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CO\"; http_user_agent; " "content:!\"EC\"; within:4; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_user_agent test\"; " "content:\"CO\"; http_user_agent; " "content:\"EC\"; distance:2; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CO\"; http_user_agent; " "content:!\"EC\"; distance:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"CO\"; http_user_agent; " "content:\"EC\"; distance:3; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectEngineHttpUATest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "CONNECT /index.html HTTP/1.0\r\n" "User-Agent: CONNECT\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_user_agent test\"; " "content:\"CO\"; http_user_agent; " "content:!\"EC\"; distance:2; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpUARegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpUATest01", DetectEngineHttpUATest01); UtRegisterTest("DetectEngineHttpUATest02", DetectEngineHttpUATest02); UtRegisterTest("DetectEngineHttpUATest03", DetectEngineHttpUATest03); UtRegisterTest("DetectEngineHttpUATest04", DetectEngineHttpUATest04); UtRegisterTest("DetectEngineHttpUATest05", DetectEngineHttpUATest05); UtRegisterTest("DetectEngineHttpUATest06", DetectEngineHttpUATest06); UtRegisterTest("DetectEngineHttpUATest07", DetectEngineHttpUATest07); UtRegisterTest("DetectEngineHttpUATest08", DetectEngineHttpUATest08); UtRegisterTest("DetectEngineHttpUATest09", DetectEngineHttpUATest09); UtRegisterTest("DetectEngineHttpUATest10", DetectEngineHttpUATest10); UtRegisterTest("DetectEngineHttpUATest11", DetectEngineHttpUATest11); UtRegisterTest("DetectEngineHttpUATest12", DetectEngineHttpUATest12); UtRegisterTest("DetectEngineHttpUATest13", DetectEngineHttpUATest13); UtRegisterTest("DetectEngineHttpUATest14", DetectEngineHttpUATest14); UtRegisterTest("DetectEngineHttpUATest15", DetectEngineHttpUATest15); UtRegisterTest("DetectEngineHttpUATest16", DetectEngineHttpUATest16); UtRegisterTest("DetectEngineHttpUATest17", DetectEngineHttpUATest17); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-offset.c0000644000000000000000000001453013051004444013704 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the offset keyword. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-byte-extract.h" #include "app-layer.h" #include "flow-var.h" #include "util-debug.h" static int DetectOffsetSetup(DetectEngineCtx *, Signature *, char *); void DetectOffsetRegister (void) { sigmatch_table[DETECT_OFFSET].name = "offset"; sigmatch_table[DETECT_OFFSET].desc = "designate from which byte in the payload will be checked to find a match"; sigmatch_table[DETECT_OFFSET].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#offset"; sigmatch_table[DETECT_OFFSET].Match = NULL; sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup; sigmatch_table[DETECT_OFFSET].Free = NULL; sigmatch_table[DETECT_OFFSET].RegisterTests = NULL; sigmatch_table[DETECT_OFFSET].flags |= SIGMATCH_PAYLOAD; } int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) { char *str = offsetstr; char dubbed = 0; SigMatch *pm = NULL; int ret = -1; /* Strip leading and trailing "s. */ if (offsetstr[0] == '\"') { str = SCStrdup(offsetstr+1); if (unlikely(str == NULL)) goto end; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } dubbed = 1; } /* retrive the sm to apply the depth against */ if (s->list != DETECT_SM_LIST_NOTSET) { pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]); } else { pm = SigMatchGetLastSMFromLists(s, 28, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); } if (pm == NULL) { SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs " "preceding content, uricontent option, http_client_body, " "http_server_body, http_header option, http_raw_header option, " "http_method option, http_cookie, http_raw_uri, " "http_stat_msg, http_stat_code, http_user_agent or " "file_data/dce_stub_data sticky buffer options"); goto end; } /* verify other conditions */ DetectContentData *cd = (DetectContentData *)pm->ctx; if (cd->flags & DETECT_CONTENT_OFFSET) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple offsets for the same content. "); goto end; } if ((cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_DISTANCE)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative " "keyword like within/distance with a absolute " "relative keyword like depth/offset for the same " "content." ); goto end; } if (cd->flags & DETECT_CONTENT_NEGATED && cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "negated keyword set along with a fast_pattern"); goto end; } if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "keyword set along with a fast_pattern:only;"); goto end; } if (str[0] != '-' && isalpha((unsigned char)str[0])) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var " "seen in offset - %s\n", str); goto end; } cd->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id; cd->flags |= DETECT_CONTENT_OFFSET_BE; } else { cd->offset = (uint32_t)atoi(str); if (cd->depth != 0) { if (cd->depth < cd->content_len) { SCLogDebug("depth increased to %"PRIu32" to match pattern len", cd->content_len); cd->depth = cd->content_len; } /* Updating the depth as is relative to the offset */ cd->depth += cd->offset; } } cd->flags |= DETECT_CONTENT_OFFSET; ret = 0; end: if (dubbed) SCFree(str); return ret; } suricata-3.2.1/src/output-filedata.c0000644000000000000000000003256713051004444014271 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer Filedata Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output.h" #include "output-filedata.h" #include "app-layer.h" #include "app-layer-parser.h" #include "detect-filemagic.h" #include "conf.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputFiledataLogger_ { FiledataLogger LogFunc; OutputCtx *output_ctx; struct OutputFiledataLogger_ *next; const char *name; LoggerId logger_id; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; } OutputFiledataLogger; static OutputFiledataLogger *list = NULL; static char g_waldo[PATH_MAX] = ""; static SCMutex g_waldo_mutex = SCMUTEX_INITIALIZER; static int g_waldo_init = 0; static int g_waldo_deinit = 0; int OutputRegisterFiledataLogger(LoggerId id, const char *name, FiledataLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputFiledataLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->output_ctx = output_ctx; op->name = name; op->logger_id = id; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (list == NULL) list = op; else { OutputFiledataLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterFiledataLogger happy"); return 0; } SC_ATOMIC_DECLARE(unsigned int, file_id); static int CallLoggers(ThreadVars *tv, OutputLoggerThreadStore *store_list, Packet *p, const File *ff, const uint8_t *data, uint32_t data_len, uint8_t flags) { OutputFiledataLogger *logger = list; OutputLoggerThreadStore *store = store_list; int file_logged = 0; while (logger && store) { BUG_ON(logger->LogFunc == NULL); SCLogDebug("logger %p", logger); PACKET_PROFILING_LOGGER_START(p, logger->logger_id); logger->LogFunc(tv, store->thread_data, (const Packet *)p, ff, data, data_len, flags); PACKET_PROFILING_LOGGER_END(p, logger->logger_id); file_logged = 1; logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } return file_logged; } static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data) { BUG_ON(thread_data == NULL); if (list == NULL) { /* No child loggers. */ return TM_ECODE_OK; } OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputFiledataLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); uint8_t flags = 0; Flow * const f = p->flow; /* no flow, no files */ if (f == NULL) { SCReturnInt(TM_ECODE_OK); } if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else flags |= STREAM_TOSERVER; int file_close = (p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0; int file_trunc = 0; file_trunc = StreamTcpReassembleDepthReached(p); FileContainer *ffc = AppLayerParserGetFiles(p->proto, f->alproto, f->alstate, flags); SCLogDebug("ffc %p", ffc); if (ffc != NULL) { File *ff; for (ff = ffc->head; ff != NULL; ff = ff->next) { #ifdef HAVE_MAGIC if (FileForceMagic() && ff->magic == NULL) { FilemagicGlobalLookup(ff); } #endif SCLogDebug("ff %p", ff); if (ff->flags & FILE_STORED) { SCLogDebug("stored flag set"); continue; } if (!(ff->flags & FILE_STORE)) { SCLogDebug("ff FILE_STORE not set"); continue; } /* if we have no data chunks left to log, we should still * close the logger(s) */ if (FileDataSize(ff) == ff->content_stored && (file_trunc || file_close)) { CallLoggers(tv, store, p, ff, NULL, 0, OUTPUT_FILEDATA_FLAG_CLOSE); ff->flags |= FILE_STORED; continue; } /* store */ /* if file_id == 0, this is the first store of this file */ if (ff->file_id == 0) { /* new file */ ff->file_id = SC_ATOMIC_ADD(file_id, 1); flags |= OUTPUT_FILEDATA_FLAG_OPEN; } else { /* existing file */ } /* if file needs to be closed or truncated, inform * loggers */ if ((file_close || file_trunc) && ff->state < FILE_STATE_CLOSED) { ff->state = FILE_STATE_TRUNCATED; } /* tell the logger we're closing up */ if (ff->state >= FILE_STATE_CLOSED) flags |= OUTPUT_FILEDATA_FLAG_CLOSE; /* do the actual logging */ const uint8_t *data = NULL; uint32_t data_len = 0; StreamingBufferGetDataAtOffset(ff->sb, &data, &data_len, ff->content_stored); int file_logged = CallLoggers(tv, store, p, ff, data, data_len, flags); if (file_logged) { ff->content_stored += data_len; /* all done */ if (flags & OUTPUT_FILEDATA_FLAG_CLOSE) { ff->flags |= FILE_STORED; break; } } } FilePrune(ffc); } return TM_ECODE_OK; } /** * \internal * * \brief Open the waldo file (if available) and load the file_id * * \param path full path for the waldo file */ static void LogFiledataLogLoadWaldo(const char *path) { char line[16] = ""; unsigned int id = 0; FILE *fp = fopen(path, "r"); if (fp == NULL) { SCLogInfo("couldn't open waldo: %s", strerror(errno)); SCReturn; } if (fgets(line, (int)sizeof(line), fp) != NULL) { if (sscanf(line, "%10u", &id) == 1) { SCLogInfo("id %u", id); (void) SC_ATOMIC_CAS(&file_id, 0, id); } } fclose(fp); } /** * \internal * * \brief Store the waldo file based on the file_id * * \param path full path for the waldo file */ static void LogFiledataLogStoreWaldo(const char *path) { char line[16] = ""; if (SC_ATOMIC_GET(file_id) == 0) { SCReturn; } FILE *fp = fopen(path, "w"); if (fp == NULL) { SCLogInfo("couldn't open waldo: %s", strerror(errno)); SCReturn; } snprintf(line, sizeof(line), "%u\n", SC_ATOMIC_GET(file_id)); if (fwrite(line, strlen(line), 1, fp) != 1) { SCLogError(SC_ERR_FWRITE, "fwrite failed: %s", strerror(errno)); } fclose(fp); } /** \brief thread init for the tx logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputFiledataLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputFiledataLogThreadInit happy (*data %p)", *data); OutputFiledataLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } SCMutexLock(&g_waldo_mutex); if (g_waldo_init == 0) { ConfNode *node = ConfGetNode("file-store-waldo"); if (node == NULL) { ConfNode *outputs = ConfGetNode("outputs"); if (outputs) { ConfNode *output; TAILQ_FOREACH(output, &outputs->head, next) { /* we only care about file and file-store */ if (!(strcmp(output->val, "file") == 0 || strcmp(output->val, "file-store") == 0)) continue; ConfNode *file = ConfNodeLookupChild(output, output->val); BUG_ON(file == NULL); if (file == NULL) { SCLogDebug("file-store failed, lets try 'file'"); file = ConfNodeLookupChild(outputs, "file"); if (file == NULL) SCLogDebug("file failed as well, giving up"); } if (file != NULL) { node = ConfNodeLookupChild(file, "waldo"); if (node == NULL) SCLogDebug("no waldo node"); } } } } if (node != NULL) { char *s_default_log_dir = NULL; s_default_log_dir = ConfigGetLogDirectory(); const char *waldo = node->val; SCLogDebug("loading waldo %s", waldo); if (waldo != NULL && strlen(waldo) > 0) { if (PathIsAbsolute(waldo)) { snprintf(g_waldo, sizeof(g_waldo), "%s", waldo); } else { snprintf(g_waldo, sizeof(g_waldo), "%s/%s", s_default_log_dir, waldo); } SCLogDebug("loading waldo file %s", g_waldo); LogFiledataLogLoadWaldo(g_waldo); } } g_waldo_init = 1; } SCMutexUnlock(&g_waldo_mutex); return TM_ECODE_OK; } static TmEcode OutputFiledataLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFiledataLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCMutexLock(&g_waldo_mutex); if (g_waldo_deinit == 0) { if (strlen(g_waldo) > 0) { SCLogDebug("we have a waldo at %s", g_waldo); LogFiledataLogStoreWaldo(g_waldo); } g_waldo_deinit = 1; } SCMutexUnlock(&g_waldo_mutex); SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputFiledataLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFiledataLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputFiledataLoggerRegister(void) { OutputRegisterRootLogger(OutputFiledataLogThreadInit, OutputFiledataLogThreadDeinit, OutputFiledataLogExitPrintStats, OutputFiledataLog); SC_ATOMIC_INIT(file_id); } void OutputFiledataShutdown(void) { OutputFiledataLogger *logger = list; while (logger) { OutputFiledataLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/log-droplog.h0000644000000000000000000000161713051004444013404 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * */ #ifndef ALERT_DROPLOG_H #define ALERT_DROPLOG_H void LogDropLogRegister(void); #endif /* ALERT_DROPLOG_H */ suricata-3.2.1/src/threads-profile.h0000644000000000000000000002121113051004444014237 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Lock profiling wrappers */ #ifndef __THREADS_PROFILE_H__ #define __THREADS_PROFILE_H__ /* profiling */ typedef struct ProfilingLock_ { char *file; char *func; int line; int type; uint32_t cont; uint64_t ticks; } ProfilingLock; extern __thread ProfilingLock locks[PROFILING_MAX_LOCKS]; extern __thread int locks_idx; extern __thread int record_locks; extern __thread uint64_t mutex_lock_contention; extern __thread uint64_t mutex_lock_wait_ticks; extern __thread uint64_t mutex_lock_cnt; /* mutex */ //printf("%16s(%s:%d): (thread:%"PRIuMAX") locked mutex %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, retl); #define SCMutexLock_profile(mut) ({ \ mutex_lock_cnt++; \ int retl = 0; \ int cont = 0; \ uint64_t mutex_lock_start = UtilCpuGetTicks(); \ if (pthread_mutex_trylock((mut)) != 0) { \ mutex_lock_contention++; \ cont = 1; \ retl = pthread_mutex_lock(mut); \ } \ uint64_t mutex_lock_end = UtilCpuGetTicks(); \ mutex_lock_wait_ticks += (uint64_t)(mutex_lock_end - mutex_lock_start); \ \ if (locks_idx < PROFILING_MAX_LOCKS && record_locks) { \ locks[locks_idx].file = (char *)__FILE__; \ locks[locks_idx].func = (char *)__func__; \ locks[locks_idx].line = (int)__LINE__; \ locks[locks_idx].type = LOCK_MUTEX; \ locks[locks_idx].cont = cont; \ locks[locks_idx].ticks = (uint64_t)(mutex_lock_end - mutex_lock_start); \ locks_idx++; \ } \ retl; \ }) #define SCMutex pthread_mutex_t #define SCMutexAttr pthread_mutexattr_t #define SCMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCMutexLock(mut) SCMutexLock_profile(mut) #define SCMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCMutexDestroy pthread_mutex_destroy #define SCMUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER /* conditions */ #define SCCondT pthread_cond_t #define SCCondInit pthread_cond_init #define SCCondSignal pthread_cond_signal #define SCCondDestroy pthread_cond_destroy #define SCCondWait(cond, mut) pthread_cond_wait(cond, mut) /* spinlocks */ extern __thread uint64_t spin_lock_contention; extern __thread uint64_t spin_lock_wait_ticks; extern __thread uint64_t spin_lock_cnt; //printf("%16s(%s:%d): (thread:%"PRIuMAX") locked mutex %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, retl); #define SCSpinLock_profile(spin) ({ \ spin_lock_cnt++; \ int retl = 0; \ int cont = 0; \ uint64_t spin_lock_start = UtilCpuGetTicks(); \ if (pthread_spin_trylock((spin)) != 0) { \ spin_lock_contention++; \ cont = 1; \ retl = pthread_spin_lock((spin)); \ } \ uint64_t spin_lock_end = UtilCpuGetTicks(); \ spin_lock_wait_ticks += (uint64_t)(spin_lock_end - spin_lock_start); \ \ if (locks_idx < PROFILING_MAX_LOCKS && record_locks) { \ locks[locks_idx].file = (char *)__FILE__; \ locks[locks_idx].func = (char *)__func__; \ locks[locks_idx].line = (int)__LINE__; \ locks[locks_idx].type = LOCK_SPIN; \ locks[locks_idx].cont = cont; \ locks[locks_idx].ticks = (uint64_t)(spin_lock_end - spin_lock_start); \ locks_idx++; \ } \ retl; \ }) #define SCSpinlock pthread_spinlock_t #define SCSpinLock(mut) SCSpinLock_profile(mut) #define SCSpinTrylock(spin) pthread_spin_trylock(spin) #define SCSpinUnlock(spin) pthread_spin_unlock(spin) #define SCSpinInit(spin, spin_attr) pthread_spin_init(spin, spin_attr) #define SCSpinDestroy(spin) pthread_spin_destroy(spin) /* rwlocks */ extern __thread uint64_t rww_lock_contention; extern __thread uint64_t rww_lock_wait_ticks; extern __thread uint64_t rww_lock_cnt; #define SCRWLockWRLock_profile(mut) ({ \ rww_lock_cnt++; \ int retl = 0; \ int cont = 0; \ uint64_t rww_lock_start = UtilCpuGetTicks(); \ if (pthread_rwlock_trywrlock((mut)) != 0) { \ rww_lock_contention++; \ cont = 1; \ retl = pthread_rwlock_wrlock(mut); \ } \ uint64_t rww_lock_end = UtilCpuGetTicks(); \ rww_lock_wait_ticks += (uint64_t)(rww_lock_end - rww_lock_start); \ \ if (locks_idx < PROFILING_MAX_LOCKS && record_locks) { \ locks[locks_idx].file = (char *)__FILE__; \ locks[locks_idx].func = (char *)__func__; \ locks[locks_idx].line = (int)__LINE__; \ locks[locks_idx].type = LOCK_RWW; \ locks[locks_idx].cont = cont; \ locks[locks_idx].ticks = (uint64_t)(rww_lock_end - rww_lock_start); \ locks_idx++; \ } \ retl; \ }) extern __thread uint64_t rwr_lock_contention; extern __thread uint64_t rwr_lock_wait_ticks; extern __thread uint64_t rwr_lock_cnt; #define SCRWLockRDLock_profile(mut) ({ \ rwr_lock_cnt++; \ int retl = 0; \ int cont = 0; \ uint64_t rwr_lock_start = UtilCpuGetTicks(); \ if (pthread_rwlock_tryrdlock((mut)) != 0) { \ rwr_lock_contention++; \ cont = 1; \ retl = pthread_rwlock_rdlock(mut); \ } \ uint64_t rwr_lock_end = UtilCpuGetTicks(); \ rwr_lock_wait_ticks += (uint64_t)(rwr_lock_end - rwr_lock_start); \ \ if (locks_idx < PROFILING_MAX_LOCKS && record_locks) { \ locks[locks_idx].file = (char *)__FILE__; \ locks[locks_idx].func = (char *)__func__; \ locks[locks_idx].line = (int)__LINE__; \ locks[locks_idx].type = LOCK_RWR; \ locks[locks_idx].cont = cont; \ locks[locks_idx].ticks = (uint64_t)(rwr_lock_end - rwr_lock_start); \ locks_idx++; \ } \ retl; \ }) #define SCRWLock pthread_rwlock_t #define SCRWLockInit(rwl, rwlattr ) pthread_rwlock_init(rwl, rwlattr) #define SCRWLockWRLock(mut) SCRWLockWRLock_profile(mut) #define SCRWLockRDLock(mut) SCRWLockRDLock_profile(mut) #define SCRWLockTryWRLock(rwl) pthread_rwlock_trywrlock(rwl) #define SCRWLockTryRDLock(rwl) pthread_rwlock_tryrdlock(rwl) #define SCRWLockUnlock(rwl) pthread_rwlock_unlock(rwl) #define SCRWLockDestroy pthread_rwlock_destroy /* ctrl mutex */ #define SCCtrlMutex pthread_mutex_t #define SCCtrlMutexAttr pthread_mutexattr_t #define SCCtrlMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCCtrlMutexLock(mut) pthread_mutex_lock(mut) #define SCCtrlMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCCtrlMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCCtrlMutexDestroy pthread_mutex_destroy /* ctrl conditions */ #define SCCtrlCondT pthread_cond_t #define SCCtrlCondInit pthread_cond_init #define SCCtrlCondSignal pthread_cond_signal #define SCCtrlCondTimedwait pthread_cond_timedwait #define SCCtrlCondWait pthread_cond_wait #define SCCtrlCondDestroy pthread_cond_destroy #endif suricata-3.2.1/src/detect-sameip.c0000644000000000000000000001251013051004444013670 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Implements the sameip keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-sameip.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectSameipMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectSameipSetup(DetectEngineCtx *, Signature *, char *); static void DetectSameipRegisterTests(void); /** * \brief Registration function for sameip: keyword * \todo add support for no_stream and stream_only */ void DetectSameipRegister(void) { sigmatch_table[DETECT_SAMEIP].name = "sameip"; sigmatch_table[DETECT_SAMEIP].desc = "check if the IP address of the source is the same as the IP address of the destination"; sigmatch_table[DETECT_SAMEIP].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#sameip"; sigmatch_table[DETECT_SAMEIP].Match = DetectSameipMatch; sigmatch_table[DETECT_SAMEIP].Setup = DetectSameipSetup; sigmatch_table[DETECT_SAMEIP].Free = NULL; sigmatch_table[DETECT_SAMEIP].RegisterTests = DetectSameipRegisterTests; sigmatch_table[DETECT_SAMEIP].flags = SIGMATCH_NOOPT; } /** * \internal * \brief This function is used to match packets with same src/dst IPs * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectSameipData * * \retval 0 no match * \retval 1 match */ static int DetectSameipMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { return CMP_ADDR(&p->src, &p->dst) ? 1 : 0; } /** * \internal * \brief this function is used to add the sameip option into the signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectSameipSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { SigMatch *sm = NULL; /* Get this into a SigMatch and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_SAMEIP; sm->ctx = NULL; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (sm != NULL) SCFree(sm); return -1; } #ifdef UNITTESTS /* NOTE: No parameters, so no parse tests */ /** * \internal * \brief This test tests sameip success and failure. */ static int DetectSameipSigTest01(void) { uint8_t *buf = (uint8_t *) "GET / HTTP/1.0\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); /* First packet has same IPs */ p1 = UTHBuildPacketSrcDst(buf, buflen, IPPROTO_TCP, "1.2.3.4", "1.2.3.4"); /* Second packet does not have same IPs */ p2 = UTHBuildPacketSrcDst(buf, buflen, IPPROTO_TCP, "1.2.3.4", "4.3.2.1"); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing sameip\"; sameip; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1) == 0) { printf("sid 2 did not alert, but should have: "); goto cleanup; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1) != 0) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: return result; } #endif /* UNITTESTS */ /** * \internal * \brief This function registers unit tests for DetectSameip */ static void DetectSameipRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectSameipSigTest01", DetectSameipSigTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-icmp-id.h0000644000000000000000000000202213051004444013736 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias Galvan */ #ifndef __DETECT_ICMP_ID_H__ #define __DETECT_ICMP_ID_H__ typedef struct DetectIcmpIdData_ { uint16_t id; /**< id in network byte error */ } DetectIcmpIdData; /* prototypes */ void DetectIcmpIdRegister(void); #endif /* __DETECT_ICMP_ID__ */ suricata-3.2.1/src/ippair-storage.c0000644000000000000000000001567713051004444014113 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * IPPair wrapper around storage api */ #include "suricata-common.h" #include "ippair-storage.h" #include "util-unittest.h" unsigned int IPPairStorageSize(void) { return StorageGetSize(STORAGE_IPPAIR); } void *IPPairGetStorageById(IPPair *h, int id) { return StorageGetById((Storage *)((void *)h + sizeof(IPPair)), STORAGE_IPPAIR, id); } int IPPairSetStorageById(IPPair *h, int id, void *ptr) { return StorageSetById((Storage *)((void *)h + sizeof(IPPair)), STORAGE_IPPAIR, id, ptr); } void *IPPairAllocStorageById(IPPair *h, int id) { return StorageAllocByIdPrealloc((Storage *)((void *)h + sizeof(IPPair)), STORAGE_IPPAIR, id); } void IPPairFreeStorageById(IPPair *h, int id) { StorageFreeById((Storage *)((void *)h + sizeof(IPPair)), STORAGE_IPPAIR, id); } void IPPairFreeStorage(IPPair *h) { if (IPPairStorageSize() > 0) StorageFreeAll((Storage *)((void *)h + sizeof(IPPair)), STORAGE_IPPAIR); } int IPPairStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)) { return StorageRegister(STORAGE_IPPAIR, name, size, Alloc, Free); } #ifdef UNITTESTS static void *StorageTestAlloc(unsigned int size) { void *x = SCMalloc(size); return x; } static void StorageTestFree(void *x) { if (x) SCFree(x); } static int IPPairStorageTest01(void) { StorageInit(); int id1 = IPPairStorageRegister("test", 8, StorageTestAlloc, StorageTestFree); if (id1 < 0) goto error; int id2 = IPPairStorageRegister("variable", 24, StorageTestAlloc, StorageTestFree); if (id2 < 0) goto error; int id3 = IPPairStorageRegister("store", sizeof(void *), StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; IPPairInitConfig(1); Address a, b; memset(&a, 0x00, sizeof(a)); memset(&b, 0x00, sizeof(b)); a.addr_data32[0] = 0x01020304; b.addr_data32[0] = 0x04030201; a.family = AF_INET; b.family = AF_INET; IPPair *h = IPPairGetIPPairFromHash(&a, &b); if (h == NULL) { printf("failed to get ippair: "); goto error; } void *ptr = IPPairGetStorageById(h, id1); if (ptr != NULL) { goto error; } ptr = IPPairGetStorageById(h, id2); if (ptr != NULL) { goto error; } ptr = IPPairGetStorageById(h, id3); if (ptr != NULL) { goto error; } void *ptr1a = IPPairAllocStorageById(h, id1); if (ptr1a == NULL) { goto error; } void *ptr2a = IPPairAllocStorageById(h, id2); if (ptr2a == NULL) { goto error; } void *ptr3a = IPPairAllocStorageById(h, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = IPPairGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = IPPairGetStorageById(h, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = IPPairGetStorageById(h, id3); if (ptr3a != ptr3b) { goto error; } IPPairRelease(h); IPPairShutdown(); StorageCleanup(); return 1; error: IPPairShutdown(); StorageCleanup(); return 0; } static int IPPairStorageTest02(void) { StorageInit(); int id1 = IPPairStorageRegister("test", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; if (StorageFinalize() < 0) goto error; IPPairInitConfig(1); Address a, b; memset(&a, 0x00, sizeof(a)); memset(&b, 0x00, sizeof(b)); a.addr_data32[0] = 0x01020304; b.addr_data32[0] = 0x04030201; a.family = AF_INET; b.family = AF_INET; IPPair *h = IPPairGetIPPairFromHash(&a, &b); if (h == NULL) { printf("failed to get ippair: "); goto error; } void *ptr = IPPairGetStorageById(h, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } IPPairSetStorageById(h, id1, ptr1a); void *ptr1b = IPPairGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } IPPairRelease(h); IPPairShutdown(); StorageCleanup(); return 1; error: IPPairShutdown(); StorageCleanup(); return 0; } static int IPPairStorageTest03(void) { StorageInit(); int id1 = IPPairStorageRegister("test1", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; int id2 = IPPairStorageRegister("test2", sizeof(void *), NULL, StorageTestFree); if (id2 < 0) goto error; int id3 = IPPairStorageRegister("test3", 32, StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; IPPairInitConfig(1); Address a, b; memset(&a, 0x00, sizeof(a)); memset(&b, 0x00, sizeof(b)); a.addr_data32[0] = 0x01020304; b.addr_data32[0] = 0x04030201; a.family = AF_INET; b.family = AF_INET; IPPair *h = IPPairGetIPPairFromHash(&a, &b); if (h == NULL) { printf("failed to get ippair: "); goto error; } void *ptr = IPPairGetStorageById(h, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } IPPairSetStorageById(h, id1, ptr1a); void *ptr2a = SCMalloc(256); if (unlikely(ptr2a == NULL)) { goto error; } IPPairSetStorageById(h, id2, ptr2a); void *ptr3a = IPPairAllocStorageById(h, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = IPPairGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = IPPairGetStorageById(h, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = IPPairGetStorageById(h, id3); if (ptr3a != ptr3b) { goto error; } IPPairRelease(h); IPPairShutdown(); StorageCleanup(); return 1; error: IPPairShutdown(); StorageCleanup(); return 0; } #endif void RegisterIPPairStorageTests(void) { #ifdef UNITTESTS UtRegisterTest("IPPairStorageTest01", IPPairStorageTest01); UtRegisterTest("IPPairStorageTest02", IPPairStorageTest02); UtRegisterTest("IPPairStorageTest03", IPPairStorageTest03); #endif } suricata-3.2.1/src/util-base64.h0000644000000000000000000000256113051004444013215 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author David Abarbanel * */ #ifndef __UTIL_BASE64_H_ #define __UTIL_BASE64_H_ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" /* Constants */ #define ASCII_BLOCK 3 #define B64_BLOCK 4 /* Function prototypes */ uint32_t DecodeBase64(uint8_t *dest, const uint8_t *src, uint32_t len, int strict); #endif suricata-3.2.1/src/detect-engine-loader.h0000644000000000000000000000331613051004444015134 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Detect loader API, for using multiple 'loader' threads * that can load multiple detection engines in parallel. */ #ifndef __DETECT_ENGINE_LOADER_H__ #define __DETECT_ENGINE_LOADER_H__ /** * \param ctx function specific data * \param loader_id id of the loader that executed the task */ typedef int (*LoaderFunc)(void *ctx, int loader_id); typedef struct DetectLoaderTask_ { LoaderFunc Func; void *ctx; TAILQ_ENTRY(DetectLoaderTask_) next; } DetectLoaderTask; typedef struct DetectLoaderControl_ { int id; int result; /* 0 for ok, error otherwise */ SCMutex m; TAILQ_HEAD(, DetectLoaderTask_) task_list; } DetectLoaderControl; int DetectLoaderQueueTask(int loader_id, LoaderFunc Func, void *func_ctx); int DetectLoadersSync(void); void DetectLoadersInit(void); void TmThreadContinueDetectLoaderThreads(); void DetectLoaderThreadSpawn(); void TmModuleDetectLoaderRegister (void); #endif /* __DETECT_ENGINE_LOADER_H__ */ suricata-3.2.1/src/defrag-timeout.h0000644000000000000000000000171613051004444014073 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DEFRAG_TIMEOUT_H__ #define __DEFRAG_TIMEOUT_H__ uint32_t DefragTimeoutHash(struct timeval *ts); uint32_t DefragGetSpareCount(void); uint32_t DefragGetActiveCount(void); #endif suricata-3.2.1/src/decode-template.h0000644000000000000000000000177513051004444014220 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author XXX * */ #ifndef __DECODE_TEMPLATE_H__ #define __DECODE_TEMPLATE_H__ #include "decode.h" #include "threadvars.h" typedef struct TemplateHdr_ { uint8_t proto; uint8_t pad0; uint16_t pad1; } __attribute__((__packed__)) TemplateHdr; #endif /* __DECODE_TEMPLATE_H__ */ suricata-3.2.1/src/util-lua-ssh.c0000644000000000000000000001327413051004444013503 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ssh.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" static int GetServerProtoVersion(lua_State *luastate, const Flow *f) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SshState *ssh_state = (SshState *)state; if (ssh_state->srv_hdr.proto_version == NULL) return LuaCallbackError(luastate, "error: no server proto version"); return LuaPushStringBuffer(luastate, ssh_state->srv_hdr.proto_version, strlen((char *)ssh_state->srv_hdr.proto_version)); } static int SshGetServerProtoVersion(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_SSH))) return LuaCallbackError(luastate, "error: protocol not ssh"); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetServerProtoVersion(luastate, f); return r; } static int GetServerSoftwareVersion(lua_State *luastate, const Flow *f) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SshState *ssh_state = (SshState *)state; if (ssh_state->srv_hdr.software_version == NULL) return LuaCallbackError(luastate, "error: no server software version"); return LuaPushStringBuffer(luastate, ssh_state->srv_hdr.software_version, strlen((char *)ssh_state->srv_hdr.software_version)); } static int SshGetServerSoftwareVersion(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_SSH))) return LuaCallbackError(luastate, "error: protocol not ssh"); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetServerSoftwareVersion(luastate, f); return r; } static int GetClientProtoVersion(lua_State *luastate, const Flow *f) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SshState *ssh_state = (SshState *)state; if (ssh_state->cli_hdr.proto_version == NULL) return LuaCallbackError(luastate, "error: no client proto version"); return LuaPushStringBuffer(luastate, ssh_state->cli_hdr.proto_version, strlen((char *)ssh_state->cli_hdr.proto_version)); } static int SshGetClientProtoVersion(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_SSH))) return LuaCallbackError(luastate, "error: protocol not ssh"); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetClientProtoVersion(luastate, f); return r; } static int GetClientSoftwareVersion(lua_State *luastate, const Flow *f) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SshState *ssh_state = (SshState *)state; if (ssh_state->cli_hdr.software_version == NULL) return LuaCallbackError(luastate, "error: no client software version"); return LuaPushStringBuffer(luastate, ssh_state->cli_hdr.software_version, strlen((char *)ssh_state->cli_hdr.software_version)); } static int SshGetClientSoftwareVersion(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_SSH))) return LuaCallbackError(luastate, "error: protocol not ssh"); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetClientSoftwareVersion(luastate, f); return r; } /** \brief register ssh lua extensions in a luastate */ int LuaRegisterSshFunctions(lua_State *luastate) { /* registration of the callbacks */ lua_pushcfunction(luastate, SshGetServerProtoVersion); lua_setglobal(luastate, "SshGetServerProtoVersion"); lua_pushcfunction(luastate, SshGetServerSoftwareVersion); lua_setglobal(luastate, "SshGetServerSoftwareVersion"); lua_pushcfunction(luastate, SshGetClientProtoVersion); lua_setglobal(luastate, "SshGetClientProtoVersion"); lua_pushcfunction(luastate, SshGetClientSoftwareVersion); lua_setglobal(luastate, "SshGetClientSoftwareVersion"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/detect-engine-hrhhd.c0000644000000000000000000022124613051004444014762 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP host header. * HRHHD - Http Raw Host Header Data * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "detect-engine-hrhhd.h" #include "util-validate.h" /** \brief HTTP Host (Raw) Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHostnameRaw(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; const uint8_t *hname = NULL; uint32_t hname_len = 0; if (tx->parsed_uri == NULL || tx->parsed_uri->hostname == NULL) { if (tx->request_headers == NULL) return; htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Host"); if (h == NULL || h->value == NULL) return; hname = (const uint8_t *)bstr_ptr(h->value); hname_len = bstr_len(h->value); } else { hname = (const uint8_t *)bstr_ptr(tx->parsed_uri->hostname); hname_len = bstr_len(tx->parsed_uri->hostname); } if (hname != NULL && hname_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, hname, hname_len); } } int PrefilterTxHostnameRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHostnameRaw, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_raw_host"); } /** * \brief Do the http_header content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpHRH(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { uint8_t *hname; uint32_t hname_len; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->parsed_uri == NULL || tx->parsed_uri->hostname == NULL) { htp_header_t *h = NULL; h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Host"); if (h == NULL) { SCLogDebug("HTTP host header not present in this request"); goto end; } hname = (uint8_t *)bstr_ptr(h->value); hname_len = bstr_len(h->value); } else { hname = (uint8_t *)bstr_ptr(tx->parsed_uri->hostname); if (hname == NULL) goto end; hname_len = bstr_len(tx->parsed_uri->hostname); } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HRHHDMATCH], f, hname, hname_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"CONNECT\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"CO\"; depth:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:!\"ECT\"; depth:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"ECT\"; depth:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"CON\"; depth:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"ECT\"; offset:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"CO\"; offset:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"ECT\"; offset:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"CON\"; offset:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:\"EC\"; within:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:!\"EC\"; within:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:\"EC\"; within:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:!\"EC\"; within:4; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:\"EC\"; distance:2; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:!\"EC\"; distance:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:\"EC\"; distance:3; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHRHTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"CO\"; http_raw_host; " "content:!\"EC\"; distance:2; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest18(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com:8080\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"kaboom\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest19(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com:8080\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"kaboom\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest20(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com:8080\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"8080\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest21(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"kaboom\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest22(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"kaboom\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest23(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"8080\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest24(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "Host: www.rabbit.com\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"kaboom\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHRHTest25(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "Host: www.rabbit.com\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_raw_host header test\"; " "content:\"rabbit\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpHRHRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpHRHTest01", DetectEngineHttpHRHTest01); UtRegisterTest("DetectEngineHttpHRHTest02", DetectEngineHttpHRHTest02); UtRegisterTest("DetectEngineHttpHRHTest03", DetectEngineHttpHRHTest03); UtRegisterTest("DetectEngineHttpHRHTest04", DetectEngineHttpHRHTest04); UtRegisterTest("DetectEngineHttpHRHTest05", DetectEngineHttpHRHTest05); UtRegisterTest("DetectEngineHttpHRHTest06", DetectEngineHttpHRHTest06); UtRegisterTest("DetectEngineHttpHRHTest07", DetectEngineHttpHRHTest07); UtRegisterTest("DetectEngineHttpHRHTest08", DetectEngineHttpHRHTest08); UtRegisterTest("DetectEngineHttpHRHTest09", DetectEngineHttpHRHTest09); UtRegisterTest("DetectEngineHttpHRHTest10", DetectEngineHttpHRHTest10); UtRegisterTest("DetectEngineHttpHRHTest11", DetectEngineHttpHRHTest11); UtRegisterTest("DetectEngineHttpHRHTest12", DetectEngineHttpHRHTest12); UtRegisterTest("DetectEngineHttpHRHTest13", DetectEngineHttpHRHTest13); UtRegisterTest("DetectEngineHttpHRHTest14", DetectEngineHttpHRHTest14); UtRegisterTest("DetectEngineHttpHRHTest15", DetectEngineHttpHRHTest15); UtRegisterTest("DetectEngineHttpHRHTest16", DetectEngineHttpHRHTest16); UtRegisterTest("DetectEngineHttpHRHTest17", DetectEngineHttpHRHTest17); UtRegisterTest("DetectEngineHttpHRHTest18", DetectEngineHttpHRHTest18); UtRegisterTest("DetectEngineHttpHRHTest19", DetectEngineHttpHRHTest19); UtRegisterTest("DetectEngineHttpHRHTest20", DetectEngineHttpHRHTest20); UtRegisterTest("DetectEngineHttpHRHTest21", DetectEngineHttpHRHTest21); UtRegisterTest("DetectEngineHttpHRHTest22", DetectEngineHttpHRHTest22); UtRegisterTest("DetectEngineHttpHRHTest23", DetectEngineHttpHRHTest23); UtRegisterTest("DetectEngineHttpHRHTest24", DetectEngineHttpHRHTest24); UtRegisterTest("DetectEngineHttpHRHTest25", DetectEngineHttpHRHTest25); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/host-storage.h0000644000000000000000000000252613051004444013576 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Host wrapper around storage api */ #ifndef __HOST_STORAGE_H__ #define __HOST_STORAGE_H__ #include "util-storage.h" #include "host.h" unsigned int HostStorageSize(void); void *HostGetStorageById(Host *h, int id); int HostSetStorageById(Host *h, int id, void *ptr); void *HostAllocStorageById(Host *h, int id); void HostFreeStorageById(Host *h, int id); void HostFreeStorage(Host *h); void RegisterHostStorageTests(void); int HostStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)); #endif /* __HOST_STORAGE_H__ */ suricata-3.2.1/src/util-classification-config.h0000644000000000000000000000431513051004444016366 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_CLASSIFICATION_CONFIG_H__ #define __UTIL_CLASSIFICATION_CONFIG_H__ /** * \brief Container for a Classtype from the Classification.config file. */ typedef struct SCClassConfClasstype_ { /* The index of the classification within classification.confg */ uint8_t classtype_id; /* The classtype name. This is the primary key for a Classification. */ char *classtype; /* Description for a classification. Would be used while printing out * the classification info for a Signature, by the fast-log module. */ char *classtype_desc; /* The priority this classification type carries */ int priority; } SCClassConfClasstype; SCClassConfClasstype *SCClassConfAllocClasstype(uint8_t, const char *, const char *, int); void SCClassConfDeAllocClasstype(SCClassConfClasstype *); void SCClassConfLoadClassficationConfigFile(DetectEngineCtx *, FILE *fd); SCClassConfClasstype *SCClassConfGetClasstype(const char *, DetectEngineCtx *); void SCClassConfDeInitContext(DetectEngineCtx *); void SCClassConfRegisterTests(void); /* for unittests */ FILE *SCClassConfGenerateValidDummyClassConfigFD01(void); FILE *SCClassConfGenerateInValidDummyClassConfigFD02(void); FILE *SCClassConfGenerateInValidDummyClassConfigFD03(void); void SCClassConfInit(void); void SCClassConfDeinit(void); #endif /* __UTIL_CLASSIFICATION_CONFIG_H__ */ suricata-3.2.1/src/conf.c0000644000000000000000000010433013051004444012073 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited - Jason Ish * * This file provides a basic configuration system for the IDPS * engine. * * NOTE: Setting values should only be done from one thread during * engine initialization. Multiple threads should be able access read * configuration data. Allowing run time changes to the configuration * will require some locks. * * \todo Consider having the in-memory configuration database a direct * reflection of the configuration file and moving command line * parameters to a primary lookup table? * * \todo Get rid of allow override and go with a simpler first set, * stays approach? */ #include "suricata-common.h" #include "conf.h" #include "util-unittest.h" #include "util-debug.h" #include "util-path.h" /** Maximum size of a complete domain name. */ #define NODE_NAME_MAX 1024 static ConfNode *root = NULL; static ConfNode *root_backup = NULL; /** * \brief Helper function to get a node, creating it if it does not * exist. * * This function exits on memory failure as creating configuration * nodes is usually part of application initialization. * * \param name The name of the configuration node to get. * \param final Flag to set created nodes as final or not. * * \retval The existing configuration node if it exists, or a newly * created node for the provided name. On error, NULL will be returned. */ static ConfNode *ConfGetNodeOrCreate(const char *name, int final) { ConfNode *parent = root; ConfNode *node = NULL; char node_name[NODE_NAME_MAX]; char *key; char *next; if (strlcpy(node_name, name, sizeof(node_name)) >= sizeof(node_name)) { SCLogError(SC_ERR_CONF_NAME_TOO_LONG, "Configuration name too long: %s", name); return NULL; } key = node_name; do { if ((next = strchr(key, '.')) != NULL) *next++ = '\0'; if ((node = ConfNodeLookupChild(parent, key)) == NULL) { node = ConfNodeNew(); if (unlikely(node == NULL)) { SCLogWarning(SC_ERR_MEM_ALLOC, "Failed to allocate memory for configuration."); goto end; } node->name = SCStrdup(key); if (unlikely(node->name == NULL)) { ConfNodeFree(node); node = NULL; SCLogWarning(SC_ERR_MEM_ALLOC, "Failed to allocate memory for configuration."); goto end; } node->parent = parent; node->final = final; TAILQ_INSERT_TAIL(&parent->head, node, next); } key = next; parent = node; } while (next != NULL); end: return node; } /** * \brief Initialize the configuration system. */ void ConfInit(void) { if (root != NULL) { SCLogDebug("already initialized"); return; } root = ConfNodeNew(); if (root == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "ERROR: Failed to allocate memory for root configuration node, " "aborting."); exit(EXIT_FAILURE); } SCLogDebug("configuration module initialized"); } /** * \brief Allocate a new configuration node. * * \retval An allocated configuration node on success, NULL on failure. */ ConfNode *ConfNodeNew(void) { ConfNode *new; new = SCCalloc(1, sizeof(*new)); if (unlikely(new == NULL)) { return NULL; } TAILQ_INIT(&new->head); return new; } /** * \brief Free a ConfNode and all of its children. * * \param node The configuration node to SCFree. */ void ConfNodeFree(ConfNode *node) { ConfNode *tmp; while ((tmp = TAILQ_FIRST(&node->head))) { TAILQ_REMOVE(&node->head, tmp, next); ConfNodeFree(tmp); } if (node->name != NULL) SCFree(node->name); if (node->val != NULL) SCFree(node->val); SCFree(node); } /** * \brief Get a ConfNode by name. * * \param name The full name of the configuration node to lookup. * * \retval A pointer to ConfNode is found or NULL if the configuration * node does not exist. */ ConfNode *ConfGetNode(const char *name) { ConfNode *node = root; char node_name[NODE_NAME_MAX]; char *key; char *next; if (strlcpy(node_name, name, sizeof(node_name)) >= sizeof(node_name)) { SCLogError(SC_ERR_CONF_NAME_TOO_LONG, "Configuration name too long: %s", name); return NULL; } key = node_name; do { if ((next = strchr(key, '.')) != NULL) *next++ = '\0'; node = ConfNodeLookupChild(node, key); key = next; } while (next != NULL && node != NULL); return node; } /** * \brief Get the root configuration node. */ ConfNode *ConfGetRootNode(void) { return root; } /** * \brief Set a configuration value. * * Configuration values set with this function may be overridden by * subsequent calls, or if the value appears multiple times in a * configuration file. * * \param name The name of the configuration parameter to set. * \param val The value of the configuration parameter. * * \retval 1 if the value was set otherwise 0. */ int ConfSet(const char *name, char *val) { ConfNode *node = ConfGetNodeOrCreate(name, 0); if (node == NULL || node->final) { return 0; } if (node->val != NULL) SCFree(node->val); node->val = SCStrdup(val); if (unlikely(node->val == NULL)) { return 0; } return 1; } /** * \brief Set a configuration parameter from a string. * * Where the input string is something like: * stream.midstream=true * * \param input the input string to be parsed. * * \retval 1 if the value of set, otherwise 0. */ int ConfSetFromString(const char *input, int final) { int retval = 0; char *name = SCStrdup(input), *val = NULL; if (unlikely(name == NULL)) { goto done; } val = strchr(name, '='); if (val == NULL) { goto done; } *val++ = '\0'; while (isspace((int)name[strlen(name) - 1])) { name[strlen(name) - 1] = '\0'; } while (isspace((int)*val)) { val++; } if (final) { if (!ConfSetFinal(name, val)) { goto done; } } else { if (!ConfSet(name, val)) { goto done; } } retval = 1; done: if (name != NULL) { SCFree(name); } return retval; } /** * \brief Set a final configuration value. * * A final configuration value is a value that cannot be overridden by * the configuration file. Its mainly useful for setting values that * are supplied on the command line prior to the configuration file * being loaded. However, a subsequent call to this function can * override a previously set value. * * \param name The name of the configuration parameter to set. * \param val The value of the configuration parameter. * * \retval 1 if the value was set otherwise 0. */ int ConfSetFinal(const char *name, char *val) { ConfNode *node = ConfGetNodeOrCreate(name, 1); if (node == NULL) { return 0; } if (node->val != NULL) SCFree(node->val); node->val = SCStrdup(val); if (unlikely(node->val == NULL)) { return 0; } node->final = 1; return 1; } /** * \brief Retrieve the value of a configuration node. * * This function will return the value for a configuration node based * on the full name of the node. It is possible that the value * returned could be NULL, this could happen if the requested node * does exist but is not a node that contains a value, but contains * children ConfNodes instead. * * \param name Name of configuration parameter to get. * \param vptr Pointer that will be set to the configuration value parameter. * Note that this is just a reference to the actual value, not a copy. * * \retval 1 will be returned if the name is found, otherwise 0 will * be returned. */ int ConfGet(const char *name, char **vptr) { ConfNode *node = ConfGetNode(name); if (node == NULL) { SCLogDebug("failed to lookup configuration parameter '%s'", name); return 0; } else { *vptr = node->val; return 1; } } int ConfGetChildValue(const ConfNode *base, const char *name, char **vptr) { ConfNode *node = ConfNodeLookupChild(base, name); if (node == NULL) { SCLogDebug("failed to lookup configuration parameter '%s'", name); return 0; } else { *vptr = node->val; return 1; } } int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, char **vptr) { int ret = ConfGetChildValue(base, name, vptr); /* Get 'default' value */ if (ret == 0 && dflt) { return ConfGetChildValue(dflt, name, vptr); } return ret; } /** * \brief Retrieve a configuration value as an integer. * * \param name Name of configuration parameter to get. * \param val Pointer to an intmax_t that will be set the * configuration value. * * \retval 1 will be returned if the name is found and was properly * converted to an interger, otherwise 0 will be returned. */ int ConfGetInt(const char *name, intmax_t *val) { char *strval = NULL; intmax_t tmpint; char *endptr; if (ConfGet(name, &strval) == 0) return 0; errno = 0; tmpint = strtoimax(strval, &endptr, 0); if (strval[0] == '\0' || *endptr != '\0') return 0; if (errno == ERANGE && (tmpint == INTMAX_MAX || tmpint == INTMAX_MIN)) return 0; *val = tmpint; return 1; } int ConfGetChildValueInt(const ConfNode *base, const char *name, intmax_t *val) { char *strval = NULL; intmax_t tmpint; char *endptr; if (ConfGetChildValue(base, name, &strval) == 0) return 0; errno = 0; tmpint = strtoimax(strval, &endptr, 0); if (strval[0] == '\0' || *endptr != '\0') return 0; if (errno == ERANGE && (tmpint == INTMAX_MAX || tmpint == INTMAX_MIN)) return 0; *val = tmpint; return 1; } int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val) { int ret = ConfGetChildValueInt(base, name, val); /* Get 'default' value */ if (ret == 0 && dflt) { return ConfGetChildValueInt(dflt, name, val); } return ret; } /** * \brief Retrieve a configuration value as an boolen. * * \param name Name of configuration parameter to get. * \param val Pointer to an int that will be set to 1 for true, or 0 * for false. * * \retval 1 will be returned if the name is found and was properly * converted to a boolean, otherwise 0 will be returned. */ int ConfGetBool(const char *name, int *val) { char *strval = NULL; *val = 0; if (ConfGet(name, &strval) != 1) return 0; *val = ConfValIsTrue(strval); return 1; } int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val) { char *strval = NULL; *val = 0; if (ConfGetChildValue(base, name, &strval) == 0) return 0; *val = ConfValIsTrue(strval); return 1; } int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val) { int ret = ConfGetChildValueBool(base, name, val); /* Get 'default' value */ if (ret == 0 && dflt) { return ConfGetChildValueBool(dflt, name, val); } return ret; } /** * \brief Check if a value is true. * * The value is considered true if it is a string with the value of 1, * yes, true or on. The test is not case sensitive, any other value * is false. * * \param val The string to test for a true value. * * \retval 1 If the value is true, 0 if not. */ int ConfValIsTrue(const char *val) { char *trues[] = {"1", "yes", "true", "on"}; size_t u; for (u = 0; u < sizeof(trues) / sizeof(trues[0]); u++) { if (strcasecmp(val, trues[u]) == 0) { return 1; } } return 0; } /** * \brief Check if a value is false. * * The value is considered false if it is a string with the value of 0, * no, false or off. The test is not case sensitive, any other value * is not false. * * \param val The string to test for a false value. * * \retval 1 If the value is false, 0 if not. */ int ConfValIsFalse(const char *val) { char *falses[] = {"0", "no", "false", "off"}; size_t u; for (u = 0; u < sizeof(falses) / sizeof(falses[0]); u++) { if (strcasecmp(val, falses[u]) == 0) { return 1; } } return 0; } /** * \brief Retrieve a configuration value as a double * * \param name Name of configuration parameter to get. * \param val Pointer to an double that will be set the * configuration value. * * \retval 1 will be returned if the name is found and was properly * converted to a double, otherwise 0 will be returned. */ int ConfGetDouble(const char *name, double *val) { char *strval = NULL; double tmpdo; char *endptr; if (ConfGet(name, &strval) == 0) return 0; errno = 0; tmpdo = strtod(strval, &endptr); if (strval[0] == '\0' || *endptr != '\0') return 0; if (errno == ERANGE) return 0; *val = tmpdo; return 1; } /** * \brief Retrieve a configuration value as a float * * \param name Name of configuration parameter to get. * \param val Pointer to an float that will be set the * configuration value. * * \retval 1 will be returned if the name is found and was properly * converted to a double, otherwise 0 will be returned. */ int ConfGetFloat(const char *name, float *val) { char *strval = NULL; double tmpfl; char *endptr; if (ConfGet(name, &strval) == 0) return 0; errno = 0; tmpfl = strtof(strval, &endptr); if (strval[0] == '\0' || *endptr != '\0') return 0; if (errno == ERANGE) return 0; *val = tmpfl; return 1; } /** * \brief Remove (and SCFree) the provided configuration node. */ void ConfNodeRemove(ConfNode *node) { if (node->parent != NULL) TAILQ_REMOVE(&node->parent->head, node, next); ConfNodeFree(node); } /** * \brief Remove a configuration parameter from the configuration db. * * \param name The name of the configuration parameter to remove. * * \retval Returns 1 if the parameter was removed, otherwise 0 is returned * most likely indicating the parameter was not set. */ int ConfRemove(const char *name) { ConfNode *node; node = ConfGetNode(name); if (node == NULL) return 0; else { ConfNodeRemove(node); return 1; } } /** * \brief Creates a backup of the conf_hash hash_table used by the conf API. */ void ConfCreateContextBackup(void) { root_backup = root; root = NULL; return; } /** * \brief Restores the backup of the hash_table present in backup_conf_hash * back to conf_hash. */ void ConfRestoreContextBackup(void) { root = root_backup; root_backup = NULL; return; } /** * \brief De-initializes the configuration system. */ void ConfDeInit(void) { if (root != NULL) { ConfNodeFree(root); root = NULL; } SCLogDebug("configuration module de-initialized"); } static char *ConfPrintNameArray(char **name_arr, int level) { static char name[128*128]; int i; name[0] = '\0'; for (i = 0; i <= level; i++) { strlcat(name, name_arr[i], sizeof(name)); if (i < level) strlcat(name, ".", sizeof(name)); } return name; } /** * \brief Dump a configuration node and all its children. */ void ConfNodeDump(const ConfNode *node, const char *prefix) { ConfNode *child; static char *name[128]; static int level = -1; level++; TAILQ_FOREACH(child, &node->head, next) { name[level] = SCStrdup(child->name); if (unlikely(name[level] == NULL)) { continue; } if (prefix == NULL) { printf("%s = %s\n", ConfPrintNameArray(name, level), child->val); } else { printf("%s.%s = %s\n", prefix, ConfPrintNameArray(name, level), child->val); } ConfNodeDump(child, prefix); SCFree(name[level]); } level--; } /** * \brief Dump configuration to stdout. */ void ConfDump(void) { ConfNodeDump(root, NULL); } /** * \brief Lookup a child configuration node by name. * * Given a ConfNode this function will lookup an immediate child * ConfNode by name and return the child ConfNode. * * \param node The parent configuration node. * \param name The name of the child node to lookup. * * \retval A pointer the child ConfNode if found otherwise NULL. */ ConfNode *ConfNodeLookupChild(const ConfNode *node, const char *name) { ConfNode *child; if (node == NULL || name == NULL) { return NULL; } TAILQ_FOREACH(child, &node->head, next) { if (child->name != NULL && strcmp(child->name, name) == 0) return child; } return NULL; } /** * \brief Lookup the value of a child configuration node by name. * * Given a parent ConfNode this function will return the value of a * child configuration node by name returning a reference to that * value. * * \param node The parent configuration node. * \param name The name of the child node to lookup. * * \retval A pointer the child ConfNodes value if found otherwise NULL. */ const char *ConfNodeLookupChildValue(const ConfNode *node, const char *name) { ConfNode *child; child = ConfNodeLookupChild(node, name); if (child != NULL) return child->val; return NULL; } /** * \brief Lookup for a key value under a specific node * * \return the ConfNode matching or NULL */ ConfNode *ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value) { ConfNode *child; TAILQ_FOREACH(child, &base->head, next) { if (!strncmp(child->val, key, strlen(child->val))) { ConfNode *subchild; TAILQ_FOREACH(subchild, &child->head, next) { if ((!strcmp(subchild->name, key)) && (!strcmp(subchild->val, value))) { return child; } } } } return NULL; } /** * \brief Test if a configuration node has a true value. * * \param node The parent configuration node. * \param name The name of the child node to test. * * \retval 1 if the child node has a true value, otherwise 0 is * returned, even if the child node does not exist. */ int ConfNodeChildValueIsTrue(const ConfNode *node, const char *key) { const char *val; val = ConfNodeLookupChildValue(node, key); return val != NULL ? ConfValIsTrue(val) : 0; } /** * \brief Create the path for an include entry * \param file The name of the file * \retval str Pointer to the string path + sig_file */ char *ConfLoadCompleteIncludePath(const char *file) { char *defaultpath = NULL; char *path = NULL; /* Path not specified */ if (PathIsRelative(file)) { if (ConfGet("include-path", &defaultpath) == 1) { SCLogDebug("Default path: %s", defaultpath); size_t path_len = sizeof(char) * (strlen(defaultpath) + strlen(file) + 2); path = SCMalloc(path_len); if (unlikely(path == NULL)) return NULL; strlcpy(path, defaultpath, path_len); if (path[strlen(path) - 1] != '/') strlcat(path, "/", path_len); strlcat(path, file, path_len); } else { path = SCStrdup(file); if (unlikely(path == NULL)) return NULL; } } else { path = SCStrdup(file); if (unlikely(path == NULL)) return NULL; } return path; } /** * \brief Prune a configuration node. * * Pruning a configuration is similar to freeing, but only fields that * may be overridden are, leaving final type parameters. Additional * the value of the provided node is also free'd, but the node itself * is left. * * \param node The configuration node to prune. */ void ConfNodePrune(ConfNode *node) { ConfNode *item, *it; for (item = TAILQ_FIRST(&node->head); item != NULL; item = it) { it = TAILQ_NEXT(item, next); if (!item->final) { ConfNodePrune(item); if (TAILQ_EMPTY(&item->head)) { TAILQ_REMOVE(&node->head, item, next); if (item->name != NULL) SCFree(item->name); if (item->val != NULL) SCFree(item->val); SCFree(item); } } } if (node->val != NULL) { SCFree(node->val); node->val = NULL; } } /** * \brief Check if a node is a sequence or node. * * \param node the node to check. * * \return 1 if node is a seuence, otherwise 0. */ int ConfNodeIsSequence(const ConfNode *node) { return node->is_seq == 0 ? 0 : 1; } #ifdef UNITTESTS /** * Lookup a non-existant value. */ static int ConfTestGetNonExistant(void) { char name[] = "non-existant-value"; char *value; FAIL_IF(ConfGet(name, &value)); PASS; } /** * Set then lookup a value. */ static int ConfTestSetAndGet(void) { char name[] = "some-name"; char value[] = "some-value"; char *value0; FAIL_IF(ConfSet(name, value) != 1); FAIL_IF(ConfGet(name, &value0) != 1); FAIL_IF(strcmp(value, value0) != 0); /* Cleanup. */ ConfRemove(name); PASS; } /** * Test that overriding a value is allowed provided allow_override is * true and that the config parameter gets the new value. */ static int ConfTestOverrideValue1(void) { char name[] = "some-name"; char value0[] = "some-value"; char value1[] = "new-value"; char *val; FAIL_IF(ConfSet(name, value0) != 1); FAIL_IF(ConfSet(name, value1) != 1); FAIL_IF(ConfGet(name, &val) != 1); FAIL_IF(strcmp(val, value1)); /* Cleanup. */ ConfRemove(name); PASS; } /** * Test that a final value will not be overrided by a ConfSet. */ static int ConfTestOverrideValue2(void) { char name[] = "some-name"; char value0[] = "some-value"; char value1[] = "new-value"; char *val; FAIL_IF(ConfSetFinal(name, value0) != 1); FAIL_IF(ConfSet(name, value1) != 0); FAIL_IF(ConfGet(name, &val) != 1); FAIL_IF(strcmp(val, value0)); /* Cleanup. */ ConfRemove(name); PASS; } /** * Test retrieving an integer value from the configuration db. */ static int ConfTestGetInt(void) { char name[] = "some-int.x"; intmax_t val; FAIL_IF(ConfSet(name, "0") != 1); FAIL_IF(ConfGetInt(name, &val) != 1); FAIL_IF(val != 0); FAIL_IF(ConfSet(name, "-1") != 1); FAIL_IF(ConfGetInt(name, &val) != 1); FAIL_IF(val != -1); FAIL_IF(ConfSet(name, "0xffff") != 1); FAIL_IF(ConfGetInt(name, &val) != 1); FAIL_IF(val != 0xffff); FAIL_IF(ConfSet(name, "not-an-int") != 1); FAIL_IF(ConfGetInt(name, &val) != 0); PASS; } /** * Test retrieving a boolean value from the configuration db. */ static int ConfTestGetBool(void) { char name[] = "some-bool"; char *trues[] = { "1", "on", "ON", "yes", "YeS", "true", "TRUE", }; char *falses[] = { "0", "something", "off", "OFF", "false", "FalSE", "no", "NO", }; int val; size_t u; for (u = 0; u < sizeof(trues) / sizeof(trues[0]); u++) { FAIL_IF(ConfSet(name, trues[u]) != 1); FAIL_IF(ConfGetBool(name, &val) != 1); FAIL_IF(val != 1); } for (u = 0; u < sizeof(falses) / sizeof(falses[0]); u++) { FAIL_IF(ConfSet(name, falses[u]) != 1); FAIL_IF(ConfGetBool(name, &val) != 1); FAIL_IF(val != 0); } PASS; } static int ConfNodeLookupChildTest(void) { char *test_vals[] = { "one", "two", "three" }; size_t u; ConfNode *parent = ConfNodeNew(); ConfNode *child; for (u = 0; u < sizeof(test_vals)/sizeof(test_vals[0]); u++) { child = ConfNodeNew(); child->name = SCStrdup(test_vals[u]); child->val = SCStrdup(test_vals[u]); TAILQ_INSERT_TAIL(&parent->head, child, next); } child = ConfNodeLookupChild(parent, "one"); FAIL_IF(child == NULL); FAIL_IF(strcmp(child->name, "one") != 0); FAIL_IF(strcmp(child->val, "one") != 0); child = ConfNodeLookupChild(parent, "two"); FAIL_IF(child == NULL); FAIL_IF(strcmp(child->name, "two") != 0); FAIL_IF(strcmp(child->val, "two") != 0); child = ConfNodeLookupChild(parent, "three"); FAIL_IF(child == NULL); FAIL_IF(strcmp(child->name, "three") != 0); FAIL_IF(strcmp(child->val, "three") != 0); child = ConfNodeLookupChild(parent, "four"); FAIL_IF(child != NULL); FAIL_IF(ConfNodeLookupChild(NULL, NULL) != NULL); if (parent != NULL) { ConfNodeFree(parent); } PASS; } static int ConfNodeLookupChildValueTest(void) { char *test_vals[] = { "one", "two", "three" }; size_t u; ConfNode *parent = ConfNodeNew(); ConfNode *child; const char *value; for (u = 0; u < sizeof(test_vals)/sizeof(test_vals[0]); u++) { child = ConfNodeNew(); child->name = SCStrdup(test_vals[u]); child->val = SCStrdup(test_vals[u]); TAILQ_INSERT_TAIL(&parent->head, child, next); } value = (char *)ConfNodeLookupChildValue(parent, "one"); FAIL_IF(value == NULL); FAIL_IF(strcmp(value, "one") != 0); value = (char *)ConfNodeLookupChildValue(parent, "two"); FAIL_IF(value == NULL); FAIL_IF(strcmp(value, "two") != 0); value = (char *)ConfNodeLookupChildValue(parent, "three"); FAIL_IF(value == NULL); FAIL_IF(strcmp(value, "three") != 0); value = (char *)ConfNodeLookupChildValue(parent, "four"); FAIL_IF(value != NULL); ConfNodeFree(parent); PASS; } static int ConfGetChildValueWithDefaultTest(void) { char *val = ""; ConfCreateContextBackup(); ConfInit(); ConfSet("af-packet.0.interface", "eth0"); ConfSet("af-packet.1.interface", "default"); ConfSet("af-packet.1.cluster-type", "cluster_cpu"); ConfNode *myroot = ConfGetNode("af-packet.0"); ConfNode *dflt = ConfGetNode("af-packet.1"); ConfGetChildValueWithDefault(myroot, dflt, "cluster-type", &val); FAIL_IF(strcmp(val, "cluster_cpu")); ConfSet("af-packet.0.cluster-type", "cluster_flow"); ConfGetChildValueWithDefault(myroot, dflt, "cluster-type", &val); FAIL_IF(strcmp(val, "cluster_flow")); ConfDeInit(); ConfRestoreContextBackup(); PASS; } static int ConfGetChildValueIntWithDefaultTest(void) { intmax_t val = 0; ConfCreateContextBackup(); ConfInit(); ConfSet("af-packet.0.interface", "eth0"); ConfSet("af-packet.1.interface", "default"); ConfSet("af-packet.1.threads", "2"); ConfNode *myroot = ConfGetNode("af-packet.0"); ConfNode *dflt = ConfGetNode("af-packet.1"); ConfGetChildValueIntWithDefault(myroot, dflt, "threads", &val); FAIL_IF(val != 2); ConfSet("af-packet.0.threads", "1"); ConfGetChildValueIntWithDefault(myroot, dflt, "threads", &val); FAIL_IF(val != 1); ConfDeInit(); ConfRestoreContextBackup(); PASS; } static int ConfGetChildValueBoolWithDefaultTest(void) { int val; ConfCreateContextBackup(); ConfInit(); ConfSet("af-packet.0.interface", "eth0"); ConfSet("af-packet.1.interface", "default"); ConfSet("af-packet.1.use-mmap", "yes"); ConfNode *myroot = ConfGetNode("af-packet.0"); ConfNode *dflt = ConfGetNode("af-packet.1"); ConfGetChildValueBoolWithDefault(myroot, dflt, "use-mmap", &val); FAIL_IF(val == 0); ConfSet("af-packet.0.use-mmap", "no"); ConfGetChildValueBoolWithDefault(myroot, dflt, "use-mmap", &val); FAIL_IF(val); ConfDeInit(); ConfRestoreContextBackup(); PASS; } /** * Test the removal of a configuration node. */ static int ConfNodeRemoveTest(void) { ConfCreateContextBackup(); ConfInit(); FAIL_IF(ConfSet("some.nested.parameter", "blah") != 1); ConfNode *node = ConfGetNode("some.nested.parameter"); FAIL_IF(node == NULL); ConfNodeRemove(node); node = ConfGetNode("some.nested.parameter"); FAIL_IF(node != NULL); ConfDeInit(); ConfRestoreContextBackup(); PASS; } static int ConfSetTest(void) { ConfCreateContextBackup(); ConfInit(); /* Set some value with 2 levels. */ FAIL_IF(ConfSet("one.two", "three") != 1); ConfNode *n = ConfGetNode("one.two"); FAIL_IF(n == NULL); /* Set another 2 level parameter with the same first level, this * used to trigger a bug that caused the second level of the name * to become a first level node. */ FAIL_IF(ConfSet("one.three", "four") != 1); n = ConfGetNode("one.three"); FAIL_IF(n == NULL); /* A top level node of "three" should not exist. */ n = ConfGetNode("three"); FAIL_IF(n != NULL); ConfDeInit(); ConfRestoreContextBackup(); PASS; } static int ConfGetNodeOrCreateTest(void) { ConfNode *node; ConfCreateContextBackup(); ConfInit(); /* Get a node that should not exist, give it a value, re-get it * and make sure the second time it returns the existing node. */ node = ConfGetNodeOrCreate("node0", 0); FAIL_IF(node == NULL); FAIL_IF(node->parent == NULL || node->parent != root); FAIL_IF(node->val != NULL); node->val = SCStrdup("node0"); node = ConfGetNodeOrCreate("node0", 0); FAIL_IF(node == NULL); FAIL_IF(node->val == NULL); FAIL_IF(strcmp(node->val, "node0") != 0); /* Do the same, but for something deeply nested. */ node = ConfGetNodeOrCreate("parent.child.grandchild", 0); FAIL_IF(node == NULL); FAIL_IF(node->parent == NULL || node->parent == root); FAIL_IF(node->val != NULL); node->val = SCStrdup("parent.child.grandchild"); node = ConfGetNodeOrCreate("parent.child.grandchild", 0); FAIL_IF(node == NULL); FAIL_IF(node->val == NULL); FAIL_IF(strcmp(node->val, "parent.child.grandchild") != 0); /* Test that 2 child nodes have the same root. */ ConfNode *child1 = ConfGetNodeOrCreate("parent.kids.child1", 0); ConfNode *child2 = ConfGetNodeOrCreate("parent.kids.child2", 0); FAIL_IF(child1 == NULL || child2 == NULL); FAIL_IF(child1->parent != child2->parent); FAIL_IF(strcmp(child1->parent->name, "kids") != 0); ConfDeInit(); ConfRestoreContextBackup(); PASS; } static int ConfNodePruneTest(void) { ConfNode *node; ConfCreateContextBackup(); ConfInit(); /* Test that final nodes exist after a prune. */ FAIL_IF(ConfSet("node.notfinal", "notfinal") != 1); FAIL_IF(ConfSetFinal("node.final", "final") != 1); FAIL_IF(ConfGetNode("node.notfinal") == NULL); FAIL_IF(ConfGetNode("node.final") == NULL); FAIL_IF((node = ConfGetNode("node")) == NULL); ConfNodePrune(node); FAIL_IF(ConfGetNode("node.notfinal") != NULL); FAIL_IF(ConfGetNode("node.final") == NULL); /* Test that everything under a final node exists after a prune. */ FAIL_IF(ConfSet("node.final.one", "one") != 1); FAIL_IF(ConfSet("node.final.two", "two") != 1); ConfNodePrune(node); FAIL_IF(ConfNodeLookupChild(node, "final") == NULL); FAIL_IF(ConfGetNode("node.final.one") == NULL); FAIL_IF(ConfGetNode("node.final.two") == NULL); ConfDeInit(); ConfRestoreContextBackup(); PASS; } int ConfNodeIsSequenceTest(void) { ConfNode *node = ConfNodeNew(); FAIL_IF(node == NULL); FAIL_IF(ConfNodeIsSequence(node)); node->is_seq = 1; FAIL_IF(!ConfNodeIsSequence(node)); if (node != NULL) { ConfNodeFree(node); } PASS; } static int ConfSetFromStringTest(void) { ConfNode *n; ConfCreateContextBackup(); ConfInit(); FAIL_IF_NOT(ConfSetFromString("stream.midstream=true", 0)); n = ConfGetNode("stream.midstream"); FAIL_IF_NULL(n); FAIL_IF_NULL(n->val); FAIL_IF(strcmp("true", n->val)); FAIL_IF_NOT(ConfSetFromString("stream.midstream =false", 0)); n = ConfGetNode("stream.midstream"); FAIL_IF_NULL(n); FAIL_IF(n->val == NULL || strcmp("false", n->val)); FAIL_IF_NOT(ConfSetFromString("stream.midstream= true", 0)); n = ConfGetNode("stream.midstream"); FAIL_IF_NULL(n); FAIL_IF(n->val == NULL || strcmp("true", n->val)); FAIL_IF_NOT(ConfSetFromString("stream.midstream = false", 0)); n = ConfGetNode("stream.midstream"); FAIL_IF_NULL(n); FAIL_IF(n->val == NULL || strcmp("false", n->val)); ConfDeInit(); ConfRestoreContextBackup(); PASS; } void ConfRegisterTests(void) { UtRegisterTest("ConfTestGetNonExistant", ConfTestGetNonExistant); UtRegisterTest("ConfSetTest", ConfSetTest); UtRegisterTest("ConfTestSetAndGet", ConfTestSetAndGet); UtRegisterTest("ConfTestOverrideValue1", ConfTestOverrideValue1); UtRegisterTest("ConfTestOverrideValue2", ConfTestOverrideValue2); UtRegisterTest("ConfTestGetInt", ConfTestGetInt); UtRegisterTest("ConfTestGetBool", ConfTestGetBool); UtRegisterTest("ConfNodeLookupChildTest", ConfNodeLookupChildTest); UtRegisterTest("ConfNodeLookupChildValueTest", ConfNodeLookupChildValueTest); UtRegisterTest("ConfNodeRemoveTest", ConfNodeRemoveTest); UtRegisterTest("ConfGetChildValueWithDefaultTest", ConfGetChildValueWithDefaultTest); UtRegisterTest("ConfGetChildValueIntWithDefaultTest", ConfGetChildValueIntWithDefaultTest); UtRegisterTest("ConfGetChildValueBoolWithDefaultTest", ConfGetChildValueBoolWithDefaultTest); UtRegisterTest("ConfGetNodeOrCreateTest", ConfGetNodeOrCreateTest); UtRegisterTest("ConfNodePruneTest", ConfNodePruneTest); UtRegisterTest("ConfNodeIsSequenceTest", ConfNodeIsSequenceTest); UtRegisterTest("ConfSetFromStringTest", ConfSetFromStringTest); } #endif /* UNITTESTS */ suricata-3.2.1/src/detect-engine-address-ipv4.h0000644000000000000000000000253713051004444016177 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_ADDRESS_IPV4_H__ #define __DETECT_ENGINE_ADDRESS_IPV4_H__ int DetectAddressCutNotIPv4(DetectAddress *, DetectAddress **); int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b); int DetectAddressCutIPv4(DetectEngineCtx *, DetectAddress *, DetectAddress *, DetectAddress **); int DetectAddressJoinIPv4(DetectEngineCtx *, DetectAddress *target, DetectAddress *source); int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *); void DetectAddressIPv4Tests(void); #endif /* __DETECT_ENGINE_ADDRESS_IPV4_H__ */ suricata-3.2.1/src/detect-engine-hrhhd.h0000644000000000000000000000254513051004444014766 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HRHHD_H__ #define __DETECT_ENGINE_HRHHD_H__ #include "app-layer-htp.h" int PrefilterTxHostnameRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpHRH(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpHRHRegisterTests(void); #endif /* __DETECT_ENGINE_HRHHD_H__ */ suricata-3.2.1/src/detect-icmp-seq.h0000644000000000000000000000203313051004444014134 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_ICMP_SEQ_H__ #define __DETECT_ICMP_SEQ_H__ typedef struct DetectIcmpSeqData_ { uint16_t seq; /**< sequence value in network byte order */ } DetectIcmpSeqData; /* prototypes */ void DetectIcmpSeqRegister(void); #endif /* __DETECT_ICMP_SEQ__ */ suricata-3.2.1/src/util-rohash.c0000644000000000000000000001573613051004444013420 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Chained read only hash table implementation, meaning that * after the initial fill no changes are allowed. * * Loading takes 2 stages. * - stage1 maps data * - stage2 fills blob * * \todo a bloomfilter in the ROHashTableOffsets could possibly prevent * a lot of cache misses when validating a potential match * * \todo maybe add a user ctx to be returned instead, something like a * 4/8 byte ptr or simply a flag */ #include "suricata-common.h" #include "util-hash.h" #include "util-unittest.h" #include "util-memcmp.h" #include "util-hash-lookup3.h" #include "queue.h" #include "util-rohash.h" /** item_size data beyond this header */ typedef struct ROHashTableItem_ { uint32_t pos; /**< position relative to other values with same hash */ TAILQ_ENTRY(ROHashTableItem_) next; } ROHashTableItem; /** offset table */ typedef struct ROHashTableOffsets_ { uint32_t cnt; /**< number of items for this hash */ uint32_t offset; /**< position in the blob of the first item */ } ROHashTableOffsets; /** \brief initialize a new rohash * * \param hash_bits hash size as 2^hash_bits, so power of 2, max 31 * \param item_size size of the data to store * * \retval table ptr or NULL on error */ ROHashTable *ROHashInit(uint8_t hash_bits, uint16_t item_size) { if (item_size % 4 != 0 || item_size == 0) { SCLogError(SC_ERR_HASH_TABLE_INIT, "data size must be multiple of 4"); return NULL; } if (hash_bits < 4 || hash_bits > 31) { SCLogError(SC_ERR_HASH_TABLE_INIT, "invalid hash_bits setting, valid range is 4-31"); return NULL; } uint32_t size = hashsize(hash_bits) * sizeof(ROHashTableOffsets); ROHashTable *table = SCMalloc(sizeof(ROHashTable) + size); if (unlikely(table == NULL)) { SCLogError(SC_ERR_HASH_TABLE_INIT, "failed to alloc memory"); return NULL; } memset(table, 0, sizeof(ROHashTable) + size); table->items = 0; table->item_size = item_size; table->hash_bits = hash_bits; TAILQ_INIT(&table->head); return table; } void ROHashFree(ROHashTable *table) { if (table != NULL) { if (table->data != NULL) { SCFree(table->data); } SCFree(table); } } uint32_t ROHashMemorySize(ROHashTable *table) { return (uint32_t)(hashsize(table->hash_bits) * sizeof(ROHashTableOffsets) + table->items * table->item_size + sizeof(ROHashTable)); } /** * \retval NULL not found * \retval ptr found */ void *ROHashLookup(ROHashTable *table, void *data, uint16_t size) { if (data == NULL || size != table->item_size) { SCReturnPtr(NULL, "void"); } uint32_t hash = hashword(data, table->item_size/4, 0) & hashmask(table->hash_bits); /* get offsets start */ ROHashTableOffsets *os = (void *)table + sizeof(ROHashTable); ROHashTableOffsets *o = &os[hash]; /* no matches */ if (o->cnt == 0) { SCReturnPtr(NULL, "void"); } uint32_t u; for (u = 0; u < o->cnt; u++) { uint32_t offset = (o->offset + u) * table->item_size; if (SCMemcmp(table->data + offset, data, table->item_size) == 0) { SCReturnPtr(table->data + offset, "void"); } } SCReturnPtr(NULL, "void"); } /** \brief Add a new value to the hash * * \note can only be done when table isn't in a locked state yet * * \param table the hash table * \param value value to add * \param size value size. *MUST* match table item_size * * \retval 0 error * \retval 1 ok */ int ROHashInitQueueValue(ROHashTable *table, void *value, uint16_t size) { if (table->locked) { SCLogError(SC_ERR_HASH_TABLE_INIT, "can't add value to locked table"); return 0; } if (table->item_size != size) { SCLogError(SC_ERR_HASH_TABLE_INIT, "wrong size for data %u != %u", size, table->item_size); return 0; } ROHashTableItem *item = SCMalloc(sizeof(ROHashTableItem) + table->item_size); if (item != NULL) { memset(item, 0x00, sizeof(ROHashTableItem)); memcpy((void *)item + sizeof(ROHashTableItem), value, table->item_size); TAILQ_INSERT_TAIL(&table->head, item, next); return 1; } return 0; } /** \brief create final hash data structure * * \param table the hash table * * \retval 0 error * \retval 1 ok * * \note after this call the nothing can be added to the hash anymore. */ int ROHashInitFinalize(ROHashTable *table) { if (table->locked) { SCLogError(SC_ERR_HASH_TABLE_INIT, "table already locked"); return 0; } ROHashTableItem *item = NULL; ROHashTableOffsets *os = (void *)table + sizeof(ROHashTable); /* count items per hash value */ TAILQ_FOREACH(item, &table->head, next) { uint32_t hash = hashword((void *)item + sizeof(*item), table->item_size/4, 0) & hashmask(table->hash_bits); ROHashTableOffsets *o = &os[hash]; item->pos = o->cnt; o->cnt++; table->items++; } if (table->items == 0) { SCLogError(SC_ERR_HASH_TABLE_INIT, "no items"); return 0; } /* get the data block */ uint32_t newsize = table->items * table->item_size; table->data = SCMalloc(newsize); if (table->data == NULL) { SCLogError(SC_ERR_HASH_TABLE_INIT, "failed to alloc memory"); return 0; } memset(table->data, 0x00, newsize); /* calc offsets into the block per hash value */ uint32_t total = 0; uint32_t x; for (x = 0; x < hashsize(table->hash_bits); x++) { ROHashTableOffsets *o = &os[x]; if (o->cnt == 0) continue; o->offset = total; total += o->cnt; } /* copy each value into the data block */ TAILQ_FOREACH(item, &table->head, next) { uint32_t hash = hashword((void *)item + sizeof(*item), table->item_size/4, 0) & hashmask(table->hash_bits); ROHashTableOffsets *o = &os[hash]; uint32_t offset = (o->offset + item->pos) * table->item_size; memcpy(table->data + offset, (void *)item + sizeof(*item), table->item_size); } /* clean up temp items */ while ((item = TAILQ_FIRST(&table->head))) { TAILQ_REMOVE(&table->head, item, next); SCFree(item); } table->locked = 1; return 1; } suricata-3.2.1/src/util-detect-file-hash.c0000644000000000000000000002355313051004444015236 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva * */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "util-detect-file-hash.h" #include "app-layer-htp.h" #ifdef HAVE_NSS /** * \brief Read the bytes of a hash from an hexadecimal string * * \param hash buffer to store the resulting bytes * \param string hexadecimal string representing the hash * \param filename file name from where the string was read * \param line_no file line number from where the string was read * \param expected_len the expected length of the string that was read * * \retval -1 the hexadecimal string is invalid * \retval 1 the hexadecimal string was read successfully */ int ReadHashString(uint8_t *hash, char *string, char *filename, int line_no, uint16_t expected_len) { if (strlen(string) != expected_len) { SCLogError(SC_ERR_INVALID_HASH, "%s:%d hash string not %d characters", filename, line_no, expected_len); return -1; } int i, x; for (x = 0, i = 0; i < expected_len; i+=2, x++) { char buf[3] = { 0, 0, 0 }; buf[0] = string[i]; buf[1] = string[i+1]; long value = strtol(buf, NULL, 16); if (value >= 0 && value <= 255) hash[x] = (uint8_t)value; else { SCLogError(SC_ERR_INVALID_HASH, "%s:%d hash byte out of range %ld", filename, line_no, value); return -1; } } return 1; } /** * \brief Store a hash into the hash table * * \param hash_table hash table that will hold the hash * \param string hexadecimal string representing the hash * \param filename file name from where the string was read * \param line_no file line number from where the string was read * \param type the hash algorithm * * \retval -1 failed to load the hash into the hash table * \retval 1 successfully loaded the has into the hash table */ int LoadHashTable(ROHashTable *hash_table, char *string, char *filename, int line_no, uint32_t type) { /* allocate the maximum size a hash can have (in this case is SHA256, 32 bytes) */ uint8_t hash[32]; /* specify the actual size that should be read depending on the hash algorithm */ uint16_t size = 32; if (type == DETECT_FILEMD5) { size = 16; } else if (type == DETECT_FILESHA1) { size = 20; } /* every byte represented with hexadecimal digits is two characters */ uint16_t expected_len = (size * 2); if (ReadHashString(hash, string, filename, line_no, expected_len) == 1) { if (ROHashInitQueueValue(hash_table, &hash, size) != 1) return -1; } return 1; } /** * \brief Match a hash stored in a hash table * * \param hash_table hash table that will hold the hash * \param hash buffer containing the bytes of the has * \param hash_len length of the hash buffer * * \retval 0 didn't find the specified hash * \retval 1 the hash matched a stored value */ static int HashMatchHashTable(ROHashTable *hash_table, uint8_t *hash, size_t hash_len) { void *ptr = ROHashLookup(hash_table, hash, (uint16_t)hash_len); if (ptr == NULL) return 0; else return 1; } /** * \brief Match the specified file hash * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFileHashData * * \retval 0 no match * \retval 1 match */ int DetectFileHashMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; DetectFileHashData *filehash = (DetectFileHashData *)m->ctx; if (file->txid < det_ctx->tx_id) { SCReturnInt(0); } if (file->txid > det_ctx->tx_id) { SCReturnInt(0); } if (file->state != FILE_STATE_CLOSED) { SCReturnInt(0); } int match = -1; if (s->file_flags & FILE_SIG_NEED_MD5 && file->flags & FILE_MD5) { match = HashMatchHashTable(filehash->hash, file->md5, sizeof(file->md5)); } else if (s->file_flags & FILE_SIG_NEED_SHA1 && file->flags & FILE_SHA1) { match = HashMatchHashTable(filehash->hash, file->sha1, sizeof(file->sha1)); } else if (s->file_flags & FILE_SIG_NEED_SHA256 && file->flags & FILE_SHA256) { match = HashMatchHashTable(filehash->hash, file->sha256, sizeof(file->sha256)); } if (match == 1) { if (filehash->negated == 0) ret = 1; else ret = 0; } else if (match == 0) { if (filehash->negated == 0) ret = 0; else ret = 1; } SCReturnInt(ret); } static const char *hexcodes = "ABCDEFabcdef0123456789"; /** * \brief Parse the filemd5, filesha1 or filesha256 keyword * * \param det_ctx pattern matcher thread local data * \param str Pointer to the user provided option * \param type the hash algorithm * * \retval hash pointer to DetectFileHashData on success * \retval NULL on failure */ static DetectFileHashData *DetectFileHashParse (const DetectEngineCtx *de_ctx, char *str, uint32_t type) { DetectFileHashData *filehash = NULL; FILE *fp = NULL; char *filename = NULL; /* We have a correct hash algorithm option */ filehash = SCMalloc(sizeof(DetectFileHashData)); if (unlikely(filehash == NULL)) goto error; memset(filehash, 0x00, sizeof(DetectFileHashData)); if (strlen(str) && str[0] == '!') { filehash->negated = 1; str++; } if (type == DETECT_FILEMD5) { filehash->hash = ROHashInit(18, 16); } else if (type == DETECT_FILESHA1) { filehash->hash = ROHashInit(18, 20); } else if (type == DETECT_FILESHA256) { filehash->hash = ROHashInit(18, 32); } if (filehash->hash == NULL) { goto error; } /* get full filename */ filename = DetectLoadCompleteSigPath(de_ctx, str); if (filename == NULL) { goto error; } char line[8192] = ""; fp = fopen(filename, "r"); if (fp == NULL) { SCLogError(SC_ERR_OPENING_RULE_FILE, "opening hash file %s: %s", filename, strerror(errno)); goto error; } int line_no = 0; while(fgets(line, (int)sizeof(line), fp) != NULL) { size_t valid = 0, len = strlen(line); line_no++; while (strchr(hexcodes, line[valid]) != NULL && valid++ < len); /* lines that do not contain sequentially any valid character are ignored */ if (valid == 0) continue; /* ignore anything after the sequence of valid characters */ line[valid] = '\0'; if (LoadHashTable(filehash->hash, line, filename, line_no, type) != 1) { goto error; } } fclose(fp); fp = NULL; if (ROHashInitFinalize(filehash->hash) != 1) { goto error; } SCLogInfo("Hash hash table size %u bytes%s", ROHashMemorySize(filehash->hash), filehash->negated ? ", negated match" : ""); SCFree(filename); return filehash; error: if (filehash != NULL) DetectFileHashFree(filehash); if (fp != NULL) fclose(fp); if (filename != NULL) SCFree(filename); return NULL; } /** * \brief this function is used to parse filemd5, filesha1 and filesha256 options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filemd5", "filesha1" or "filesha256" option * \param type type of file hash to setup * * \retval 0 on Success * \retval -1 on Failure */ int DetectFileHashSetup (DetectEngineCtx *de_ctx, Signature *s, char *str, uint32_t type) { DetectFileHashData *filehash = NULL; SigMatch *sm = NULL; filehash = DetectFileHashParse(de_ctx, str, type); if (filehash == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = type; sm->ctx = (void *)filehash; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->file_flags |= FILE_SIG_NEED_FILE; // Setup the file flags depending on the hashing algorithm if (type == DETECT_FILEMD5) { s->file_flags |= FILE_SIG_NEED_MD5; } if (type == DETECT_FILESHA1) { s->file_flags |= FILE_SIG_NEED_SHA1; } if (type == DETECT_FILESHA256) { s->file_flags |= FILE_SIG_NEED_SHA256; } return 0; error: if (filehash != NULL) DetectFileHashFree(filehash); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFileHashData * * \param filehash pointer to DetectFileHashData */ void DetectFileHashFree(void *ptr) { if (ptr != NULL) { DetectFileHashData *filehash = (DetectFileHashData *)ptr; if (filehash->hash != NULL) ROHashFree(filehash->hash); SCFree(filehash); } } #endif /* HAVE_NSS */ suricata-3.2.1/src/stream-tcp-reassemble.h0000644000000000000000000000730513051004444015356 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh */ #ifndef __STREAM_TCP_REASSEMBLE_H__ #define __STREAM_TCP_REASSEMBLE_H__ #include "stream-tcp-private.h" #include "stream.h" #include "app-layer-detect-proto.h" #include "stream-tcp-private.h" /** Supported OS list and default OS policy is BSD */ enum { OS_POLICY_NONE = 1, OS_POLICY_BSD, OS_POLICY_BSD_RIGHT, OS_POLICY_OLD_LINUX, OS_POLICY_LINUX, OS_POLICY_OLD_SOLARIS, OS_POLICY_SOLARIS, OS_POLICY_HPUX10, OS_POLICY_HPUX11, OS_POLICY_IRIX, OS_POLICY_MACOS, OS_POLICY_WINDOWS, OS_POLICY_VISTA, OS_POLICY_WINDOWS2K3, OS_POLICY_FIRST, OS_POLICY_LAST }; typedef struct TcpReassemblyThreadCtx_ { void *app_tctx; /** TCP segments which are not being reassembled due to memcap was reached */ uint16_t counter_tcp_segment_memcap; /** number of streams that stop reassembly because their depth is reached */ uint16_t counter_tcp_stream_depth; /** count number of streams with a unrecoverable stream gap (missing pkts) */ uint16_t counter_tcp_reass_gap; #ifdef DEBUG uint64_t fp1; uint64_t fp2; uint64_t sp; #endif } TcpReassemblyThreadCtx; #define OS_POLICY_DEFAULT OS_POLICY_BSD int StreamTcpReassembleHandleSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpSession *, TcpStream *, Packet *, PacketQueue *); int StreamTcpReassembleInit(char); void StreamTcpReassembleFree(char); void StreamTcpReassembleRegisterTests(void); TcpReassemblyThreadCtx *StreamTcpReassembleInitThreadCtx(ThreadVars *tv); void StreamTcpReassembleFreeThreadCtx(TcpReassemblyThreadCtx *); int StreamTcpReassembleAppLayer (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p); void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t); void StreamTcpSetSessionNoReassemblyFlag (TcpSession *, char ); void StreamTcpSetDisableRawReassemblyFlag (TcpSession *ssn, char direction); void StreamTcpSetOSPolicy(TcpStream *, Packet *); void StreamTcpReassemblePause (TcpSession *, char ); void StreamTcpReassembleUnPause (TcpSession *, char ); int StreamTcpCheckStreamContents(uint8_t *, uint16_t , TcpStream *); int StreamTcpReassembleInsertSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, Packet *); TcpSegment* StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *, uint16_t); void StreamTcpReturnStreamSegments(TcpStream *); void StreamTcpSegmentReturntoPool(TcpSegment *); void StreamTcpReassembleTriggerRawReassembly(TcpSession *); void StreamTcpPruneSession(Flow *, uint8_t); int StreamTcpReassembleDepthReached(Packet *p); void StreamTcpReassembleIncrMemuse(uint64_t size); void StreamTcpReassembleDecrMemuse(uint64_t size); int StreamTcpReassembleCheckMemcap(uint32_t size); void StreamTcpDisableAppLayer(Flow *f); int StreamTcpAppLayerIsDisabled(Flow *f); #endif /* __STREAM_TCP_REASSEMBLE_H__ */ suricata-3.2.1/src/alert-unified2-alert.c0000644000000000000000000017022713051004444015075 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * \author Eric Leblond * \author Ignacio Sanchez * \author Duarte Silva * * Logs alerts in a format compatible to Snort's unified2 format, so it should * be readable by Barnyard2. */ #include "suricata-common.h" #include "runmodes.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "pkt-var.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-unittest.h" #include "alert-unified2-alert.h" #include "decode-ipv4.h" #include "host.h" #include "util-profiling.h" #include "decode.h" #include "util-error.h" #include "util-debug.h" #include "util-time.h" #include "util-byte.h" #include "util-misc.h" #include "util-logopenfile.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-htp-xff.h" #include "output.h" #include "util-privs.h" #include "stream.h" #include "stream-tcp-inline.h" #include "util-optimize.h" #ifndef IPPROTO_SCTP #define IPPROTO_SCTP 132 #endif #define DEFAULT_LOG_FILENAME "unified2.alert" /**< Default log file limit in MB. */ #define DEFAULT_LIMIT 32 * 1024 * 1024 /**< Minimum log file limit in MB. */ #define MIN_LIMIT 1 * 1024 * 1024 /* Default Sensor ID value */ static uint32_t sensor_id = 0; /** * Unified2 Extra Data Header * */ typedef struct Unified2ExtraDataHdr_ { uint32_t event_type; uint32_t event_length; } __attribute__((__packed__)) Unified2ExtraDataHdr; /** * Unified2 Extra Data (currently used only for XFF) * */ typedef struct Unified2ExtraData_ { uint32_t sensor_id; uint32_t event_id; uint32_t event_second; uint32_t type; /* EventInfo */ uint32_t data_type; /*EventDataType */ uint32_t blob_length; /* Length of the data + sizeof(blob_length) + sizeof(data_type)*/ } Unified2ExtraData; /** * Unified2 file header struct * * Used for storing file header options. */ typedef struct Unified2AlertFileHeader_ { uint32_t type; /**< unified2 type header */ uint32_t length; /**< unified2 struct size length */ } Unified2AlertFileHeader; /** * Unified2 Ipv4 struct * * Used for storing ipv4 type values. */ typedef struct AlertIPv4Unified2_ { uint32_t sensor_id; /**< sendor id */ uint32_t event_id; /**< event id */ uint32_t event_second; /**< event second */ uint32_t event_microsecond; /**< event microsecond */ uint32_t signature_id; /**< signature id */ uint32_t generator_id; /**< generator id */ uint32_t signature_revision; /**< signature revision */ uint32_t classification_id; /**< classification id */ uint32_t priority_id; /**< priority id */ uint32_t src_ip; /**< source ip */ uint32_t dst_ip; /**< destination ip */ uint16_t sp; /**< source port */ uint16_t dp; /**< destination port */ uint8_t protocol; /**< protocol */ uint8_t packet_action; /**< packet action */ } AlertIPv4Unified2; /** * Unified2 Ipv6 type struct * * Used for storing ipv6 type values. */ typedef struct AlertIPv6Unified2_ { uint32_t sensor_id; /**< sendor id */ uint32_t event_id; /**< event id */ uint32_t event_second; /**< event second */ uint32_t event_microsecond; /**< event microsecond */ uint32_t signature_id; /**< signature id */ uint32_t generator_id; /**< generator id */ uint32_t signature_revision; /**< signature revision */ uint32_t classification_id; /**< classification id */ uint32_t priority_id; /**< priority id */ struct in6_addr src_ip; /**< source ip */ struct in6_addr dst_ip; /**< destination ip */ uint16_t sp; /**< source port */ uint16_t dp; /**< destination port */ uint8_t protocol; /**< protocol */ uint8_t packet_action; /**< packet action */ } AlertIPv6Unified2; /** * Unified2 packet type struct * * Used for storing packet type values. */ typedef struct AlertUnified2Packet_ { uint32_t sensor_id; /**< sensor id */ uint32_t event_id; /**< event id */ uint32_t event_second; /**< event second */ uint32_t packet_second; /**< packet second */ uint32_t packet_microsecond; /**< packet microsecond */ uint32_t linktype; /**< link type */ uint32_t packet_length; /**< packet length */ uint8_t packet_data[4]; /**< packet data */ } Unified2Packet; /** Extracted XFF IP is v4 */ #define UNIFIED2_ALERT_XFF_IPV4 8 /** Extracted XFF IP is v4 */ #define UNIFIED2_ALERT_XFF_IPV6 16 typedef struct Unified2AlertFileCtx_ { LogFileCtx *file_ctx; HttpXFFCfg *xff_cfg; uint32_t flags; /**< flags for all alerts */ } Unified2AlertFileCtx; #define UNIFIED2_ALERT_FLAGS_EMIT_PACKET (1 << 0) /** * Unified2 thread vars * * Used for storing file options. */ typedef struct Unified2AlertThread_ { Unified2AlertFileCtx *unified2alert_ctx; /**< LogFileCtx pointer */ uint8_t *data; /**< Per function and thread data */ /** Pointer to the Unified2AlertFileHeader contained in * the pointer data. */ Unified2AlertFileHeader *hdr; /** Pointer to the Unified2Packet contained in * the pointer data. */ Unified2Packet *phdr; /** Pointer to the IPv4 or IPv6 header contained in * the pointer data. */ void *iphdr; int datalen; /**< Length of per function and thread data */ int offset; /**< Offset used to now where to fill data */ int length; /**< Length of data for current alert */ uint8_t xff_flags; /**< XFF flags for the current alert */ uint32_t xff_ip[4]; /**< The XFF reported IP address for the current alert */ uint32_t event_id; } Unified2AlertThread; #define UNIFIED2_PACKET_SIZE (sizeof(Unified2Packet) - 4) SC_ATOMIC_DECLARE(unsigned int, unified2_event_id); /**< Atomic counter, to link relative event */ /** prototypes */ //TmEcode Unified2Alert (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode Unified2AlertThreadInit(ThreadVars *, void *, void **); TmEcode Unified2AlertThreadDeinit(ThreadVars *, void *); static int Unified2IPv4TypeAlert(ThreadVars *, const Packet *, void *); static int Unified2IPv6TypeAlert(ThreadVars *, const Packet *, void *); static int Unified2PacketTypeAlert(Unified2AlertThread *, const Packet *, uint32_t, int); void Unified2RegisterTests(void); int Unified2AlertOpenFileCtx(LogFileCtx *, const char *); static void Unified2AlertDeInitCtx(OutputCtx *); int Unified2Condition(ThreadVars *tv, const Packet *p); int Unified2Logger(ThreadVars *tv, void *data, const Packet *p); #define MODULE_NAME "Unified2Alert" void Unified2AlertRegister(void) { OutputRegisterPacketModule(LOGGER_UNIFIED2, MODULE_NAME, "unified2-alert", Unified2AlertInitCtx, Unified2Logger, Unified2Condition, Unified2AlertThreadInit, Unified2AlertThreadDeinit, NULL); Unified2RegisterTests(); } /** * \brief Function to close unified2 file * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param aun Unified2 thread variable. */ int Unified2AlertCloseFile(ThreadVars *t, Unified2AlertThread *aun) { if (aun->unified2alert_ctx->file_ctx->fp != NULL) { fclose(aun->unified2alert_ctx->file_ctx->fp); } aun->unified2alert_ctx->file_ctx->size_current = 0; return 0; } /** * \brief Function to rotate unified2 file * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param aun Unified2 thread variable. * \retval 0 on succces * \retval -1 on failure */ int Unified2AlertRotateFile(ThreadVars *t, Unified2AlertThread *aun) { if (Unified2AlertCloseFile(t,aun) < 0) { SCLogError(SC_ERR_UNIFIED2_ALERT_GENERIC, "Error: Unified2AlertCloseFile failed"); return -1; } if (Unified2AlertOpenFileCtx(aun->unified2alert_ctx->file_ctx,aun->unified2alert_ctx-> file_ctx->prefix) < 0) { SCLogError(SC_ERR_UNIFIED2_ALERT_GENERIC, "Error: Unified2AlertOpenFileCtx, open new log file failed"); return -1; } return 0; } /** * \brief Wrapper for fwrite * * This function is basically a wrapper for fwrite which take * in charge a size counter. * * \return 1 in case of success */ static int Unified2Write(Unified2AlertThread *aun) { int ret; ret = fwrite(aun->data, aun->length, 1, aun->unified2alert_ctx->file_ctx->fp); if (ret != 1) { SCLogError(SC_ERR_FWRITE, "Error: fwrite failed: %s", strerror(errno)); return -1; } aun->unified2alert_ctx->file_ctx->size_current += aun->length; return 1; } int Unified2Condition(ThreadVars *tv, const Packet *p) { if (likely(p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG))) return FALSE; return TRUE; } /** * \brief Unified2 main entry function * * \retval TM_ECODE_OK all is good * \retval TM_ECODE_FAILED serious error */ int Unified2Logger(ThreadVars *t, void *data, const Packet *p) { int ret = 0; Unified2AlertThread *aun = (Unified2AlertThread *)data; aun->xff_flags = XFF_DISABLED; HttpXFFCfg *xff_cfg = aun->unified2alert_ctx->xff_cfg; /* overwrite mode can only work per u2 block, not per individual * alert. So we'll look for an XFF record once */ if ((xff_cfg->flags & XFF_OVERWRITE) && p->flow != NULL) { char buffer[XFF_MAXLEN]; int have_xff_ip = 0; if (FlowGetAppProtocol(p->flow) == ALPROTO_HTTP) { have_xff_ip = HttpXFFGetIP(p, xff_cfg, buffer, XFF_MAXLEN); } if (have_xff_ip) { /** Be sure that we have a nice zeroed buffer */ memset(aun->xff_ip, 0, 4 * sizeof(uint32_t)); /** We can only have override mode if packet IP version matches * the XFF IP version, otherwise fall-back to extra data */ if (inet_pton(AF_INET, buffer, aun->xff_ip) == 1) { if (PKT_IS_IPV4(p)) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV4|XFF_OVERWRITE); } else { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV4|XFF_EXTRADATA); } } else if (inet_pton(AF_INET6, buffer, aun->xff_ip) == 1) { if (PKT_IS_IPV6(p)) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV6|XFF_OVERWRITE); } else { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV6|XFF_EXTRADATA); } } } } if (PKT_IS_IPV4(p)) { ret = Unified2IPv4TypeAlert (t, p, data); } else if(PKT_IS_IPV6(p)) { ret = Unified2IPv6TypeAlert (t, p, data); } else { /* we're only supporting IPv4 and IPv6 */ return TM_ECODE_OK; } if (ret != 0) { return TM_ECODE_FAILED; } return TM_ECODE_OK; } typedef struct _FakeIPv4Hdr { IPV4Hdr ip4h; TCPHdr tcph; } __attribute__((__packed__)) FakeIPv4Hdr; static int Unified2ForgeFakeIPv4Header(FakeIPv4Hdr *fakehdr, const Packet *p, int pkt_len, char invert) { fakehdr->ip4h.ip_verhl = p->ip4h->ip_verhl; fakehdr->ip4h.ip_proto = p->ip4h->ip_proto; if (! invert) { fakehdr->ip4h.s_ip_src.s_addr = p->ip4h->s_ip_src.s_addr; fakehdr->ip4h.s_ip_dst.s_addr = p->ip4h->s_ip_dst.s_addr; } else { fakehdr->ip4h.s_ip_dst.s_addr = p->ip4h->s_ip_src.s_addr; fakehdr->ip4h.s_ip_src.s_addr = p->ip4h->s_ip_dst.s_addr; } fakehdr->ip4h.ip_len = htons((uint16_t)pkt_len); if (! invert) { fakehdr->tcph.th_sport = p->tcph->th_sport; fakehdr->tcph.th_dport = p->tcph->th_dport; } else { fakehdr->tcph.th_dport = p->tcph->th_sport; fakehdr->tcph.th_sport = p->tcph->th_dport; } fakehdr->tcph.th_offx2 = 0x50; /* just the TCP header, no options */ return 1; } typedef struct _FakeIPv6Hdr { IPV6Hdr ip6h; TCPHdr tcph; } __attribute__((__packed__)) FakeIPv6Hdr; /** * \param payload_len length of the payload */ static int Unified2ForgeFakeIPv6Header(FakeIPv6Hdr *fakehdr, const Packet *p, int payload_len, char invert) { fakehdr->ip6h.s_ip6_vfc = p->ip6h->s_ip6_vfc; fakehdr->ip6h.s_ip6_nxt = IPPROTO_TCP; fakehdr->ip6h.s_ip6_plen = htons(sizeof(TCPHdr) + payload_len); if (!invert) { memcpy(fakehdr->ip6h.s_ip6_addrs, p->ip6h->s_ip6_addrs, 32); } else { memcpy(fakehdr->ip6h.s_ip6_src, p->ip6h->s_ip6_dst, 16); memcpy(fakehdr->ip6h.s_ip6_dst, p->ip6h->s_ip6_src, 16); } if (! invert) { fakehdr->tcph.th_sport = p->tcph->th_sport; fakehdr->tcph.th_dport = p->tcph->th_dport; } else { fakehdr->tcph.th_dport = p->tcph->th_sport; fakehdr->tcph.th_sport = p->tcph->th_dport; } fakehdr->tcph.th_offx2 = 0x50; /* just the TCP header, no options */ return 1; } /** * \brief Write a faked Packet in unified2 file for each stream segment. */ static int Unified2PrintStreamSegmentCallback(const Packet *p, void *data, uint8_t *buf, uint32_t buflen) { int ret = 1; Unified2AlertThread *aun = (Unified2AlertThread *)data; Unified2AlertFileHeader *hdr = (Unified2AlertFileHeader*)(aun->data); Unified2Packet *phdr = (Unified2Packet *)(hdr + 1); /** Prepare the pointers to extra data structures should they be required. * If they are required we will shift the *hdr and the *phdr */ Unified2AlertFileHeader *eu2hdr = (Unified2AlertFileHeader*)(aun->data); Unified2ExtraDataHdr *ehdr = (Unified2ExtraDataHdr *)(eu2hdr + 1); Unified2ExtraData *dhdr = (Unified2ExtraData *) (ehdr + 1); uint32_t *edxff = (uint32_t *) (dhdr + 1); aun->length = 0; aun->offset = 0; // If XFF is in extra data mode... if (aun->xff_flags & XFF_EXTRADATA) { memset(dhdr, 0, sizeof(Unified2ExtraData)); if (aun->xff_flags & UNIFIED2_ALERT_XFF_IPV4) { eu2hdr->type = htonl (UNIFIED2_IDS_EVENT_EXTRADATA_TYPE); eu2hdr->length = htonl(sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + sizeof(uint32_t)); ehdr->event_type = htonl(UNIFIED2_EXTRADATA_TYPE_EXTRA_DATA); ehdr->event_length = htonl(sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + sizeof(uint32_t)); dhdr->sensor_id = 0; dhdr->event_id = aun->event_id; dhdr->event_second = htonl(p->ts.tv_sec); dhdr->data_type = htonl(UNIFIED2_EXTRADATA_TYPE_BLOB); dhdr->type = htonl(UNIFIED2_EXTRADATA_CLIENT_IPV4_TYPE); dhdr->blob_length = htonl(3 * sizeof(uint32_t)); aun->length += sizeof(Unified2AlertFileHeader) + sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + sizeof(uint32_t); aun->offset += sizeof(Unified2AlertFileHeader) + sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + sizeof(uint32_t); *edxff=aun->xff_ip[0]; /** Shift the *hdr and *phdr pointers */ hdr = (Unified2AlertFileHeader*)(edxff + 1); phdr = (Unified2Packet *)(hdr + 1); } else if (aun->xff_flags & UNIFIED2_ALERT_XFF_IPV6) { eu2hdr->type = htonl(UNIFIED2_IDS_EVENT_EXTRADATA_TYPE); eu2hdr->length = htonl(sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + 4 * sizeof(uint32_t)); ehdr->event_type = htonl(UNIFIED2_EXTRADATA_TYPE_EXTRA_DATA); ehdr->event_length = htonl(sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + 4 * sizeof(uint32_t)); dhdr->sensor_id = 0; dhdr->event_id = aun->event_id; dhdr->event_second = htonl(p->ts.tv_sec); dhdr->data_type = htonl(UNIFIED2_EXTRADATA_TYPE_BLOB); dhdr->type = htonl(UNIFIED2_EXTRADATA_CLIENT_IPV6_TYPE); dhdr->blob_length = htonl(6 * sizeof(uint32_t)); aun->length += sizeof(Unified2AlertFileHeader) + sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + 4 * sizeof(uint32_t); aun->offset += sizeof(Unified2AlertFileHeader) + sizeof (Unified2ExtraDataHdr) + sizeof (Unified2ExtraData) + 4 * sizeof(uint32_t); memcpy(edxff, aun->xff_ip, 4 * sizeof(uint32_t)); /** Shift the *hdr and *phdr pointers */ hdr = (Unified2AlertFileHeader*)(edxff + 4); phdr = (Unified2Packet *)(hdr + 1); } } int ethh_offset = 0; EthernetHdr ethhdr = { {0,0,0,0,0,0}, {0,0,0,0,0,0}, htons(ETHERNET_TYPE_IPV6) }; uint32_t hdr_length = 0; memset(hdr, 0, sizeof(Unified2AlertFileHeader)); memset(phdr, 0, sizeof(Unified2Packet)); hdr->type = htonl(UNIFIED2_PACKET_TYPE); aun->hdr = hdr; phdr->sensor_id = htonl(sensor_id); phdr->linktype = htonl(p->datalink); phdr->event_id = aun->event_id; phdr->event_second = phdr->packet_second = htonl(p->ts.tv_sec); phdr->packet_microsecond = htonl(p->ts.tv_usec); aun->phdr = phdr; if (p->datalink != DLT_EN10MB) { /* We have raw data here */ phdr->linktype = htonl(DLT_RAW); } aun->length += sizeof(Unified2AlertFileHeader) + UNIFIED2_PACKET_SIZE; aun->offset += sizeof(Unified2AlertFileHeader) + UNIFIED2_PACKET_SIZE; /* Include Packet header */ if (PKT_IS_IPV4(p)) { FakeIPv4Hdr fakehdr; hdr_length = sizeof(FakeIPv4Hdr); if (p->datalink == DLT_EN10MB) { /* Fake this */ ethh_offset = 14; phdr->linktype = htonl(DLT_EN10MB); aun->length += ethh_offset; if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data"); goto error; } ethhdr.eth_type = htons(ETHERNET_TYPE_IP); memcpy(aun->data + aun->offset, ðhdr, 14); aun->offset += ethh_offset; } memset(&fakehdr, 0, hdr_length); aun->length += hdr_length; Unified2ForgeFakeIPv4Header(&fakehdr, p, hdr_length + buflen, 0); if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data"); goto error; } /** If XFF is in overwrite mode... */ if (aun->xff_flags & XFF_OVERWRITE) { BUG_ON(aun->xff_flags & UNIFIED2_ALERT_XFF_IPV6); if (p->flowflags & FLOW_PKT_TOCLIENT) { fakehdr.ip4h.s_ip_dst.s_addr = aun->xff_ip[0]; } else { fakehdr.ip4h.s_ip_src.s_addr = aun->xff_ip[0]; } } memcpy(aun->data + aun->offset, &fakehdr, hdr_length); aun->iphdr = (void *)(aun->data + aun->offset); aun->offset += hdr_length; } else if (PKT_IS_IPV6(p)) { FakeIPv6Hdr fakehdr; hdr_length = sizeof(FakeIPv6Hdr); if (p->datalink == DLT_EN10MB) { /* Fake this */ ethh_offset = 14; phdr->linktype = htonl(DLT_EN10MB); aun->length += ethh_offset; if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data"); goto error; } ethhdr.eth_type = htons(ETHERNET_TYPE_IPV6); memcpy(aun->data + aun->offset, ðhdr, 14); aun->offset += ethh_offset; } memset(&fakehdr, 0, hdr_length); Unified2ForgeFakeIPv6Header(&fakehdr, p, buflen, 1); aun->length += hdr_length; if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data"); goto error; } /** If XFF is in overwrite mode... */ if (aun->xff_flags & XFF_OVERWRITE) { BUG_ON(aun->xff_flags & UNIFIED2_ALERT_XFF_IPV4); if (p->flowflags & FLOW_PKT_TOCLIENT) { memcpy(fakehdr.ip6h.s_ip6_dst, aun->xff_ip, 4 * sizeof(uint32_t)); } else { memcpy(fakehdr.ip6h.s_ip6_src, aun->xff_ip, 4 * sizeof(uint32_t)); } } memcpy(aun->data + aun->offset, &fakehdr, hdr_length); aun->iphdr = (void *)(aun->data + aun->offset); aun->offset += hdr_length; } else { goto error; } /* update unified2 headers for length */ aun->hdr->length = htonl(UNIFIED2_PACKET_SIZE + ethh_offset + hdr_length + buflen); aun->phdr->packet_length = htonl(ethh_offset + hdr_length + buflen); /* copy stream segment payload in */ aun->length += buflen; if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread" " data: %d vs %d", aun->length, aun->datalen); goto error; } memcpy(aun->data + aun->offset, buf, buflen); aun->offset += buflen; /* rebuild checksum */ if (PKT_IS_IPV6(p)) { FakeIPv6Hdr *fakehdr = (FakeIPv6Hdr *)aun->iphdr; fakehdr->tcph.th_sum = TCPV6CalculateChecksum(fakehdr->ip6h.s_ip6_addrs, (uint16_t *)&fakehdr->tcph, buflen + sizeof(TCPHdr)); } else { FakeIPv4Hdr *fakehdr = (FakeIPv4Hdr *)aun->iphdr; fakehdr->tcph.th_sum = TCPCalculateChecksum(fakehdr->ip4h.s_ip_addrs, (uint16_t *)&fakehdr->tcph, buflen + sizeof(TCPHdr)); fakehdr->ip4h.ip_csum = IPV4CalculateChecksum((uint16_t *)&fakehdr->ip4h, IPV4_GET_RAW_HLEN(&fakehdr->ip4h)); } /* write out */ ret = Unified2Write(aun); if (ret != 1) { goto error; } return 1; error: aun->length = 0; aun->offset = 0; return -1; } /** * \brief Function to fill unified2 packet format into the file. If the alert * was generated based on a stream chunk we call the stream function * to generate the record. * * Barnyard2 doesn't like DLT_RAW + IPv6, so if we don't have an ethernet * header, we create a fake one. * * No need to lock here, since it's already locked. * * \param aun thread local data * \param p Packet * \param stream pointer to stream chunk * \param event_id unique event id * \param stream state/stream match, try logging stream segments * * \retval 0 on succces * \retval -1 on failure */ static int Unified2PacketTypeAlert(Unified2AlertThread *aun, const Packet *p, uint32_t event_id, int stream) { int ret = 0; if (!(aun->unified2alert_ctx->flags & UNIFIED2_ALERT_FLAGS_EMIT_PACKET)) return 1; /* try stream logging first */ if (stream) { SCLogDebug("logging the state"); uint8_t flag; if (p->flowflags & FLOW_PKT_TOSERVER) { flag = FLOW_PKT_TOCLIENT; } else { flag = FLOW_PKT_TOSERVER; } /* make event id available to callback */ aun->event_id = event_id; /* run callback for all segments in the stream */ ret = StreamSegmentForEach(p, flag, Unified2PrintStreamSegmentCallback, (void *)aun); } /* or no segment could been logged or no segment have been logged */ if (ret == 0) { SCLogDebug("no stream, no state: falling back to payload logging"); Unified2AlertFileHeader *hdr = (Unified2AlertFileHeader*)(aun->data); Unified2Packet *phdr = (Unified2Packet *)(hdr + 1); int len = (sizeof(Unified2AlertFileHeader) + UNIFIED2_PACKET_SIZE); int datalink = p->datalink; #ifdef HAVE_OLD_BARNYARD2 int ethh_offset = 0; EthernetHdr ethhdr = { {0,0,0,0,0,0}, {0,0,0,0,0,0}, htons(ETHERNET_TYPE_IPV6) }; #endif memset(hdr, 0, sizeof(Unified2AlertFileHeader)); memset(phdr, 0, sizeof(Unified2Packet)); hdr->type = htonl(UNIFIED2_PACKET_TYPE); aun->hdr = hdr; phdr->sensor_id = htonl(sensor_id); phdr->linktype = htonl(datalink); phdr->event_id = event_id; phdr->event_second = phdr->packet_second = htonl(p->ts.tv_sec); phdr->packet_microsecond = htonl(p->ts.tv_usec); aun->phdr = phdr; /* we need to reset offset and length which could * have been modified by the segment logging */ aun->offset = len; len += GET_PKT_LEN(p); aun->length = len; /* Unified 2 packet header is the one of the packet. */ phdr->linktype = htonl(p->datalink); #ifdef HAVE_OLD_BARNYARD2 /* Fake datalink to avoid bug with old barnyard2 */ if (PKT_IS_IPV6(p) && (!p->ethh)) { /* Fake this */ ethh_offset = 14; datalink = DLT_EN10MB; phdr->linktype = htonl(datalink); aun->length += ethh_offset; if (aun->length > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data: %d vs %d", len, aun->datalen - aun->offset); return -1; } ethhdr.eth_type = htons(ETHERNET_TYPE_IPV6); memcpy(aun->data + aun->offset, ðhdr, 14); aun->offset += ethh_offset; } #endif if (len > aun->datalen) { SCLogError(SC_ERR_INVALID_VALUE, "len is too big for thread data: %d vs %d", len, aun->datalen - aun->offset); return -1; } hdr->length = htonl(UNIFIED2_PACKET_SIZE + GET_PKT_LEN(p)); phdr->packet_length = htonl(GET_PKT_LEN(p)); memcpy(aun->data + aun->offset, GET_PKT_DATA(p), GET_PKT_LEN(p)); ret = Unified2Write(aun); } if (ret < 1) { return -1; } return 1; } /** * \brief Function to fill unified2 ipv6 ids type format into the file. * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param p Packet struct used to decide for ipv4 or ipv6 * \param data Unified2 thread data. * * \retval 0 on succces * \retval -1 on failure */ static int Unified2IPv6TypeAlert(ThreadVars *t, const Packet *p, void *data) { Unified2AlertThread *aun = (Unified2AlertThread *)data; Unified2AlertFileHeader hdr; AlertIPv6Unified2 *phdr; AlertIPv6Unified2 gphdr; const PacketAlert *pa; int offset, length; int ret; unsigned int event_id; if (likely(p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG))) return 0; phdr = (AlertIPv6Unified2 *)(aun->data + sizeof(Unified2AlertFileHeader)); length = (sizeof(Unified2AlertFileHeader) + sizeof(AlertIPv6Unified2)); offset = length; memset(aun->data, 0, aun->datalen); hdr.type = htonl(UNIFIED2_IDS_EVENT_IPV6_TYPE); hdr.length = htonl(sizeof(AlertIPv6Unified2)); /* fill the gphdr structure with the data of the packet */ memset(&gphdr, 0, sizeof(gphdr)); /* FIXME this need to be copied for each alert */ gphdr.sensor_id = htonl(sensor_id); gphdr.event_second = htonl(p->ts.tv_sec); gphdr.event_microsecond = htonl(p->ts.tv_usec); gphdr.src_ip = *(struct in6_addr*)GET_IPV6_SRC_ADDR(p); gphdr.dst_ip = *(struct in6_addr*)GET_IPV6_DST_ADDR(p); /** If XFF is in overwrite mode... */ if (aun->xff_flags & XFF_OVERWRITE) { BUG_ON(aun->xff_flags & UNIFIED2_ALERT_XFF_IPV4); if (p->flowflags & FLOW_PKT_TOCLIENT) { gphdr.dst_ip = *(struct in6_addr*)aun->xff_ip; } else { gphdr.src_ip = *(struct in6_addr*)aun->xff_ip; } } gphdr.protocol = p->proto; if(PACKET_TEST_ACTION(p, ACTION_DROP)) gphdr.packet_action = UNIFIED2_BLOCKED_FLAG; else gphdr.packet_action = 0; switch(gphdr.protocol) { case IPPROTO_ICMPV6: if(p->icmpv6h) { gphdr.sp = htons(p->icmpv6h->type); gphdr.dp = htons(p->icmpv6h->code); } else { gphdr.sp = 0; gphdr.dp = 0; } break; case IPPROTO_ICMP: if(p->icmpv4h) { gphdr.sp = htons(p->icmpv4h->type); gphdr.dp = htons(p->icmpv4h->code); } else { gphdr.sp = 0; gphdr.dp = 0; } break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: gphdr.sp = htons(p->sp); gphdr.dp = htons(p->dp); break; default: gphdr.sp = 0; gphdr.dp = 0; break; } uint16_t i = 0; for (; i < p->alerts.cnt + 1; i++) { if (i < p->alerts.cnt) pa = &p->alerts.alerts[i]; else { if (!(p->flags & PKT_HAS_TAG)) break; pa = PacketAlertGetTag(); } if (unlikely(pa->s == NULL)) continue; HttpXFFCfg *xff_cfg = aun->unified2alert_ctx->xff_cfg; if ((xff_cfg->flags & XFF_EXTRADATA) && p->flow != NULL) { char buffer[XFF_MAXLEN]; int have_xff_ip = 0; if (FlowGetAppProtocol(p->flow) == ALPROTO_HTTP) { if (pa->flags & PACKET_ALERT_FLAG_TX) { have_xff_ip = HttpXFFGetIPFromTx(p, pa->tx_id, xff_cfg, buffer, XFF_MAXLEN); } else { have_xff_ip = HttpXFFGetIP(p, xff_cfg, buffer, XFF_MAXLEN); } } if (have_xff_ip) { memset(aun->xff_ip, 0, 4 * sizeof(uint32_t)); if (inet_pton(AF_INET, buffer, aun->xff_ip) == 1) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV4|XFF_EXTRADATA); } else if (inet_pton(AF_INET6, buffer, aun->xff_ip) == 1) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV6|XFF_EXTRADATA); } } } /* reset length and offset */ aun->offset = offset; aun->length = length; memset(aun->data + aun->offset, 0, aun->datalen - aun->offset); /* copy the part common to all alerts */ memcpy(aun->data, &hdr, sizeof(hdr)); memcpy(phdr, &gphdr, sizeof(gphdr)); /* fill the header structure with the data of the alert */ event_id = htonl(SC_ATOMIC_ADD(unified2_event_id, 1)); phdr->event_id = event_id; phdr->generator_id = htonl(pa->s->gid); phdr->signature_id = htonl(pa->s->id); phdr->signature_revision = htonl(pa->s->rev); phdr->classification_id = htonl(pa->s->class); phdr->priority_id = htonl(pa->s->prio); SCMutexLock(&aun->unified2alert_ctx->file_ctx->fp_mutex); if ((aun->unified2alert_ctx->file_ctx->size_current + length) > aun->unified2alert_ctx->file_ctx->size_limit) { if (Unified2AlertRotateFile(t,aun) < 0) { aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } } if (Unified2Write(aun) != 1) { aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } memset(aun->data, 0, aun->length); aun->length = 0; aun->offset = 0; /* stream flag based on state match, but only for TCP */ int stream = (gphdr.protocol == IPPROTO_TCP) ? (pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_STREAM_MATCH) ? 1 : 0) : 0; ret = Unified2PacketTypeAlert(aun, p, phdr->event_id, stream); if (ret != 1) { SCLogError(SC_ERR_FWRITE, "Error: fwrite failed: %s", strerror(errno)); aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } fflush(aun->unified2alert_ctx->file_ctx->fp); aun->unified2alert_ctx->file_ctx->alerts++; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); } return 0; } /** * \brief Function to fill unified2 ipv4 ids type format into the file. * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param p Packet struct used to decide for ipv4 or ipv6 * \param data Unified2 thread data. * \retval 0 on succces * \retval -1 on failure */ static int Unified2IPv4TypeAlert (ThreadVars *tv, const Packet *p, void *data) { Unified2AlertThread *aun = (Unified2AlertThread *)data; Unified2AlertFileHeader hdr; AlertIPv4Unified2 *phdr; AlertIPv4Unified2 gphdr; const PacketAlert *pa; int offset, length; int ret; unsigned int event_id; if (likely(p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG))) return 0; phdr = (AlertIPv4Unified2 *)(aun->data + sizeof(Unified2AlertFileHeader)); length = (sizeof(Unified2AlertFileHeader) + sizeof(AlertIPv4Unified2)); offset = length; memset(aun->data, 0, aun->datalen); hdr.type = htonl(UNIFIED2_IDS_EVENT_TYPE); hdr.length = htonl(sizeof(AlertIPv4Unified2)); /* fill the gphdr structure with the data of the packet */ memset(&gphdr, 0, sizeof(gphdr)); gphdr.sensor_id = htonl(sensor_id); gphdr.event_id = 0; gphdr.event_second = htonl(p->ts.tv_sec); gphdr.event_microsecond = htonl(p->ts.tv_usec); gphdr.src_ip = p->ip4h->s_ip_src.s_addr; gphdr.dst_ip = p->ip4h->s_ip_dst.s_addr; /** If XFF is in overwrite mode... */ if (aun->xff_flags & XFF_OVERWRITE) { BUG_ON(aun->xff_flags & UNIFIED2_ALERT_XFF_IPV6); if (p->flowflags & FLOW_PKT_TOCLIENT) { gphdr.dst_ip = aun->xff_ip[0]; } else { gphdr.src_ip = aun->xff_ip[0]; } } gphdr.protocol = IPV4_GET_RAW_IPPROTO(p->ip4h); if(PACKET_TEST_ACTION(p, ACTION_DROP)) gphdr.packet_action = UNIFIED2_BLOCKED_FLAG; else gphdr.packet_action = 0; /* TODO inverse order if needed, this should be done on a * alert basis */ switch(gphdr.protocol) { case IPPROTO_ICMP: if(p->icmpv4h) { gphdr.sp = htons(p->icmpv4h->type); gphdr.dp = htons(p->icmpv4h->code); } break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: gphdr.sp = htons(p->sp); gphdr.dp = htons(p->dp); break; default: gphdr.sp = 0; gphdr.dp = 0; break; } uint16_t i = 0; for (; i < p->alerts.cnt + 1; i++) { if (i < p->alerts.cnt) pa = &p->alerts.alerts[i]; else { if (!(p->flags & PKT_HAS_TAG)) break; pa = PacketAlertGetTag(); } if (unlikely(pa->s == NULL)) continue; HttpXFFCfg *xff_cfg = aun->unified2alert_ctx->xff_cfg; if ((xff_cfg->flags & XFF_EXTRADATA) && p->flow != NULL) { char buffer[XFF_MAXLEN]; int have_xff_ip = 0; if (FlowGetAppProtocol(p->flow) == ALPROTO_HTTP) { if (pa->flags & PACKET_ALERT_FLAG_TX) { have_xff_ip = HttpXFFGetIPFromTx(p, pa->tx_id, xff_cfg, buffer, XFF_MAXLEN); } else { have_xff_ip = HttpXFFGetIP(p, xff_cfg, buffer, XFF_MAXLEN); } } if (have_xff_ip) { memset(aun->xff_ip, 0, 4 * sizeof(uint32_t)); if (inet_pton(AF_INET, buffer, aun->xff_ip) == 1) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV4|XFF_EXTRADATA); } else if (inet_pton(AF_INET6, buffer, aun->xff_ip) == 1) { aun->xff_flags = (UNIFIED2_ALERT_XFF_IPV6|XFF_EXTRADATA); } } } /* reset length and offset */ aun->offset = offset; aun->length = length; memset(aun->data + aun->offset, 0, aun->datalen - aun->offset); /* copy the part common to all alerts */ memcpy(aun->data, &hdr, sizeof(hdr)); memcpy(phdr, &gphdr, sizeof(gphdr)); /* fill the hdr structure with the alert data */ event_id = htonl(SC_ATOMIC_ADD(unified2_event_id, 1)); phdr->event_id = event_id; phdr->generator_id = htonl(pa->s->gid); phdr->signature_id = htonl(pa->s->id); phdr->signature_revision = htonl(pa->s->rev); phdr->classification_id = htonl(pa->s->class); phdr->priority_id = htonl(pa->s->prio); /* check and enforce the filesize limit */ SCMutexLock(&aun->unified2alert_ctx->file_ctx->fp_mutex); if ((aun->unified2alert_ctx->file_ctx->size_current + length) > aun->unified2alert_ctx->file_ctx->size_limit) { if (Unified2AlertRotateFile(tv,aun) < 0) { aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } } if (Unified2Write(aun) != 1) { aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } memset(aun->data, 0, aun->length); aun->length = 0; aun->offset = 0; /* Write the alert (it doesn't lock inside, since we * already locked here for rotation check) */ int stream = (gphdr.protocol == IPPROTO_TCP) ? (pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_STREAM_MATCH) ? 1 : 0) : 0; ret = Unified2PacketTypeAlert(aun, p, event_id, stream); if (ret != 1) { aun->unified2alert_ctx->file_ctx->alerts += i; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); return -1; } fflush(aun->unified2alert_ctx->file_ctx->fp); aun->unified2alert_ctx->file_ctx->alerts++; SCMutexUnlock(&aun->unified2alert_ctx->file_ctx->fp_mutex); } return 0; } /** * \brief Thread init function. * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param initdata Unified2 thread initial data. * \param data Unified2 thread data. * \retval TM_ECODE_OK on succces * \retval TM_ECODE_FAILED on failure */ TmEcode Unified2AlertThreadInit(ThreadVars *t, void *initdata, void **data) { Unified2AlertThread *aun = SCMalloc(sizeof(Unified2AlertThread)); if (unlikely(aun == NULL)) return TM_ECODE_FAILED; memset(aun, 0, sizeof(Unified2AlertThread)); if(initdata == NULL) { SCLogDebug("Error getting context for AlertUnified2. \"initdata\" argument NULL"); SCFree(aun); return TM_ECODE_FAILED; } /** Use the Ouptut Context (file pointer and mutex) */ aun->unified2alert_ctx = ((OutputCtx *)initdata)->data; aun->data = SCMalloc(sizeof(Unified2AlertFileHeader) + sizeof(Unified2Packet) + IPV4_MAXPACKET_LEN + sizeof(Unified2ExtraDataHdr) + sizeof (Unified2ExtraData)); if (aun->data == NULL) { SCFree(aun); return TM_ECODE_FAILED; } aun->datalen = sizeof(Unified2AlertFileHeader) + sizeof(Unified2Packet) + IPV4_MAXPACKET_LEN + sizeof(Unified2ExtraDataHdr) + sizeof(Unified2ExtraData); *data = (void *)aun; return TM_ECODE_OK; } /** * \brief Thread deinit function. * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param data Unified2 thread data. * \retval TM_ECODE_OK on succces * \retval TM_ECODE_FAILED on failure */ TmEcode Unified2AlertThreadDeinit(ThreadVars *t, void *data) { Unified2AlertThread *aun = (Unified2AlertThread *)data; if (aun == NULL) { goto error; } if (!(aun->unified2alert_ctx->file_ctx->flags & LOGFILE_ALERTS_PRINTED)) { //SCLogInfo("Alert unified2 module wrote %"PRIu64" alerts", // aun->unified2alert_ctx->file_ctx->alerts); /* Do not print it for each thread */ aun->unified2alert_ctx->file_ctx->flags |= LOGFILE_ALERTS_PRINTED; } if (aun->data != NULL) { SCFree(aun->data); aun->data = NULL; } aun->datalen = 0; /* clear memory */ memset(aun, 0, sizeof(Unified2AlertThread)); SCFree(aun); return TM_ECODE_OK; error: return TM_ECODE_FAILED; } /** \brief Create a new LogFileCtx from the provided ConfNode. * \param conf The configuration node for this output. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ OutputCtx *Unified2AlertInitCtx(ConfNode *conf) { int ret = 0; LogFileCtx* file_ctx = NULL; OutputCtx* output_ctx = NULL; HttpXFFCfg *xff_cfg = NULL; file_ctx = LogFileNewCtx(); if (file_ctx == NULL) { SCLogError(SC_ERR_UNIFIED2_ALERT_GENERIC, "Couldn't create new file_ctx"); goto error; } const char *filename = NULL; if (conf != NULL) { /* To faciliate unit tests. */ filename = ConfNodeLookupChildValue(conf, "filename"); } if (filename == NULL) filename = DEFAULT_LOG_FILENAME; file_ctx->prefix = SCStrdup(filename); if (unlikely(file_ctx->prefix == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate file prefix"); exit(EXIT_FAILURE); } const char *s_limit = NULL; file_ctx->size_limit = DEFAULT_LIMIT; if (conf != NULL) { s_limit = ConfNodeLookupChildValue(conf, "limit"); if (s_limit != NULL) { if (ParseSizeStringU64(s_limit, &file_ctx->size_limit) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize unified2 output, invalid limit: %s", s_limit); exit(EXIT_FAILURE); } if (file_ctx->size_limit < 4096) { SCLogInfo("unified2-alert \"limit\" value of %"PRIu64" assumed to be pre-1.2 " "style: setting limit to %"PRIu64"mb", file_ctx->size_limit, file_ctx->size_limit); uint64_t size = file_ctx->size_limit * 1024 * 1024; file_ctx->size_limit = size; } else if (file_ctx->size_limit < MIN_LIMIT) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize unified2 output, limit less than " "allowed minimum: %d.", MIN_LIMIT); exit(EXIT_FAILURE); } } } if (conf != NULL) { const char *sensor_id_s = NULL; sensor_id_s = ConfNodeLookupChildValue(conf, "sensor-id"); if (sensor_id_s != NULL) { if (ByteExtractStringUint32(&sensor_id, 10, 0, sensor_id_s) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize unified2 output, invalid sensor-id: %s", sensor_id_s); exit(EXIT_FAILURE); } } } uint32_t flags = UNIFIED2_ALERT_FLAGS_EMIT_PACKET; if (conf != NULL) { const char *payload = NULL; payload = ConfNodeLookupChildValue(conf, "payload"); if (payload) { if (ConfValIsFalse(payload)) { flags &= ~UNIFIED2_ALERT_FLAGS_EMIT_PACKET; } else if (!ConfValIsTrue(payload)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize unified2 output, invalid payload: %s", payload); exit(EXIT_FAILURE); } } } ret = Unified2AlertOpenFileCtx(file_ctx, filename); if (ret < 0) goto error; output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) goto error; xff_cfg = SCMalloc(sizeof(HttpXFFCfg)); if (unlikely(xff_cfg == NULL)) { goto error; } memset(xff_cfg, 0x00, sizeof(HttpXFFCfg)); if (conf != NULL) { HttpXFFGetCfg(conf, xff_cfg); } Unified2AlertFileCtx *unified2alert_ctx = SCMalloc(sizeof(Unified2AlertFileCtx)); if (unlikely(unified2alert_ctx == NULL)) { goto error; } memset(unified2alert_ctx, 0x00, sizeof(Unified2AlertFileCtx)); unified2alert_ctx->file_ctx = file_ctx; unified2alert_ctx->xff_cfg = xff_cfg; unified2alert_ctx->flags = flags; output_ctx->data = unified2alert_ctx; output_ctx->DeInit = Unified2AlertDeInitCtx; SCLogInfo("Unified2-alert initialized: filename %s, limit %"PRIu64" MB", filename, file_ctx->size_limit / (1024*1024)); SC_ATOMIC_INIT(unified2_event_id); return output_ctx; error: if (xff_cfg != NULL) { SCFree(xff_cfg); } if (output_ctx != NULL) { SCFree(output_ctx); } return NULL; } static void Unified2AlertDeInitCtx(OutputCtx *output_ctx) { if (output_ctx != NULL) { Unified2AlertFileCtx *unified2alert_ctx = (Unified2AlertFileCtx *) output_ctx->data; if (unified2alert_ctx != NULL) { LogFileCtx *logfile_ctx = unified2alert_ctx->file_ctx; if (logfile_ctx != NULL) { LogFileFreeCtx(logfile_ctx); } HttpXFFCfg *xff_cfg = unified2alert_ctx->xff_cfg; if (xff_cfg != NULL) { SCFree(xff_cfg); } SCFree(unified2alert_ctx); } SCFree(output_ctx); } } /** \brief Read the config set the file pointer, open the file * \param file_ctx pointer to a created LogFileCtx using LogFileNewCtx() * \param prefix Prefix of the log file. * \return -1 if failure, 0 if succesful * */ int Unified2AlertOpenFileCtx(LogFileCtx *file_ctx, const char *prefix) { int ret = 0; char *filename = NULL; if (file_ctx->filename != NULL) filename = file_ctx->filename; else { filename = SCMalloc(PATH_MAX); /* XXX some sane default? */ if (unlikely(filename == NULL)) return -1; file_ctx->filename = filename; memset(filename, 0x00, PATH_MAX); } /** get the time so we can have a filename with seconds since epoch */ struct timeval ts; memset(&ts, 0x00, sizeof(struct timeval)); extern int run_mode; if (run_mode == RUNMODE_UNITTEST) TimeGet(&ts); else gettimeofday(&ts, NULL); /* create the filename to use */ char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, log_dir, prefix, (uint32_t)ts.tv_sec); file_ctx->fp = fopen(filename, "ab"); if (file_ctx->fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", filename, strerror(errno)); ret = -1; } return ret; } #ifdef UNITTESTS /** * \test Test the ethernet+ipv4+tcp unified2 test * * \retval 1 on succces * \retval 0 on failure */ static int Unified2Test01(void) { ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; void *data = NULL; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; Signature s; uint8_t raw_ipv4_tcp[] = { 0x00, 0x14, 0xbf, 0xe8, 0xcb, 0x26, 0xaa, 0x00, 0x04, 0x00, 0x0a, 0x04, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x8c, 0x55, 0x40, 0x00, 0x40, 0x06, 0x69, 0x86, 0xc0, 0xa8, 0x0a, 0x68, 0x4a, 0x7d, 0x2f, 0x53, 0xc2, 0x40, 0x00, 0x50, 0x1f, 0x00, 0xa4, 0xd4, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0xd0, 0x3d, 0x4e, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x1c, 0x28, 0x81, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x06}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; int ret; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); memset(&s, 0, sizeof(Signature)); p->alerts.cnt++; p->alerts.alerts[p->alerts.cnt-1].s = &s; p->alerts.alerts[p->alerts.cnt-1].s->id = 1; p->alerts.alerts[p->alerts.cnt-1].s->gid = 1; p->alerts.alerts[p->alerts.cnt-1].s->rev = 1; SET_PKT_LEN(p, sizeof(raw_ipv4_tcp)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_ipv4_tcp, sizeof(raw_ipv4_tcp), &pq); oc = Unified2AlertInitCtx(NULL); if (oc == NULL) { goto end; } uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if(lf == NULL) { goto end; } ret = Unified2AlertThreadInit(&tv, oc, &data); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2Logger(&tv, data, p); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2AlertThreadDeinit(&tv, data); if(ret == -1) { goto end; } Unified2AlertDeInitCtx(oc); PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; end: PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 0; } /** * \test Test the ethernet+ipv6+tcp unified2 test * * \retval 1 on succces * \retval 0 on failure */ static int Unified2Test02(void) { ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; void *data = NULL; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; Signature s; uint8_t raw_ipv6_tcp[] = { 0x00, 0x11, 0x25, 0x82, 0x95, 0xb5, 0x00, 0xd0, 0x09, 0xe3, 0xe8, 0xde, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x28, 0x06, 0x40, 0x20, 0x01, 0x06, 0xf8, 0x10, 0x2d, 0x00, 0x00, 0x02, 0xd0, 0x09, 0xff, 0xfe, 0xe3, 0xe8, 0xde, 0x20, 0x01, 0x06, 0xf8, 0x09, 0x00, 0x07, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xe7, 0x41, 0x00, 0x50, 0xab, 0xdc, 0xd6, 0x60, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0x80, 0x41, 0xa2, 0x00, 0x00, 0x02, 0x04, 0x05, 0xa0, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x0a, 0x22, 0xa8, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x05 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; int ret; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); memset(&s, 0, sizeof(Signature)); p->alerts.cnt++; p->alerts.alerts[p->alerts.cnt-1].s = &s; p->alerts.alerts[p->alerts.cnt-1].s->id = 1; p->alerts.alerts[p->alerts.cnt-1].s->gid = 1; p->alerts.alerts[p->alerts.cnt-1].s->rev = 1; SET_PKT_LEN(p, sizeof(raw_ipv6_tcp)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_ipv6_tcp, sizeof(raw_ipv6_tcp), &pq); oc = Unified2AlertInitCtx(NULL); if (oc == NULL) { goto end; } uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if(lf == NULL) { goto end; } ret = Unified2AlertThreadInit(&tv, oc, &data); if(ret == -1) { goto end; } ret = Unified2Logger(&tv, data, p); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2AlertThreadDeinit(&tv, data); if(ret == -1) { goto end; } Unified2AlertDeInitCtx(oc); PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; end: PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 0; } /** * \test Test the GRE unified2 test * * \retval 1 on succces * \retval 0 on failure */ static int Unified2Test03(void) { ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; void *data = NULL; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; Signature s; uint8_t raw_gre[] = { 0x00, 0x0e, 0x50, 0x06, 0x42, 0x96, 0xaa, 0x00, 0x04, 0x00, 0x0a, 0x04, 0x08, 0x00, 0x45, 0x00, 0x00, 0x74, 0x35, 0xa2, 0x40, 0x00, 0x40, 0x2f, 0xef, 0xcb, 0x0a, 0x00, 0x00, 0x64, 0x0a, 0x00, 0x00, 0x8a, 0x30, 0x01, 0x88, 0x0b, 0x00, 0x54, 0x00, 0x00, 0x00, 0x18, 0x29, 0x5f, 0xff, 0x03, 0x00, 0x21, 0x45, 0x00, 0x00, 0x50, 0xf4, 0x05, 0x40, 0x00, 0x3f, 0x06, 0x20, 0xb8, 0x50, 0x7e, 0x2b, 0x2d, 0xd4, 0xcc, 0xd6, 0x72, 0x0a, 0x92, 0x1a, 0x0b, 0xc9, 0xaf, 0x24, 0x02, 0x8c, 0xdd, 0x45, 0xf6, 0x80, 0x18, 0x21, 0xfc, 0x10, 0x7c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x08, 0x19, 0x1a, 0xda, 0x84, 0xd6, 0xda, 0x3e, 0x50, 0x49, 0x4e, 0x47, 0x20, 0x73, 0x74, 0x65, 0x72, 0x6c, 0x69, 0x6e, 0x67, 0x2e, 0x66, 0x72, 0x65, 0x65, 0x6e, 0x6f, 0x64, 0x65, 0x2e, 0x6e, 0x65, 0x74, 0x0d, 0x0a}; Packet *p = PacketGetFromAlloc(); Packet *pkt; if (unlikely(p == NULL)) return 0; int ret; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); memset(&s, 0, sizeof(Signature)); p->alerts.cnt++; p->alerts.alerts[p->alerts.cnt-1].s = &s; p->alerts.alerts[p->alerts.cnt-1].s->id = 1; p->alerts.alerts[p->alerts.cnt-1].s->gid = 1; p->alerts.alerts[p->alerts.cnt-1].s->rev = 1; SET_PKT_LEN(p, sizeof(raw_gre)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_gre, sizeof(raw_gre), &pq); oc = Unified2AlertInitCtx(NULL); if (oc == NULL) { goto end; } uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if(lf == NULL) { goto end; } ret = Unified2AlertThreadInit(&tv, oc, &data); if(ret == -1) { goto end; } ret = Unified2Logger(&tv, data, p); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2AlertThreadDeinit(&tv, data); if(ret == -1) { goto end; } Unified2AlertDeInitCtx(oc); pkt = PacketDequeue(&pq); while (pkt != NULL) { PACKET_RECYCLE(pkt); SCFree(pkt); pkt = PacketDequeue(&pq); } PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; end: pkt = PacketDequeue(&pq); while (pkt != NULL) { PACKET_RECYCLE(pkt); SCFree(pkt); pkt = PacketDequeue(&pq); } PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 0; } /** * \test Test the PPP unified2 test * * \retval 1 on succces * \retval 0 on failure */ static int Unified2Test04(void) { ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; void *data = NULL; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; Signature s; uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00, 0x2c, 0x4d, 0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01, 0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00, 0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; int ret; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); memset(&s, 0, sizeof(Signature)); p->alerts.cnt++; p->alerts.alerts[p->alerts.cnt-1].s = &s; p->alerts.alerts[p->alerts.cnt-1].s->id = 1; p->alerts.alerts[p->alerts.cnt-1].s->gid = 1; p->alerts.alerts[p->alerts.cnt-1].s->rev = 1; SET_PKT_LEN(p, sizeof(raw_ppp)); FlowInitConfig(FLOW_QUIET); DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), &pq); oc = Unified2AlertInitCtx(NULL); if (oc == NULL) { goto end; } uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if(lf == NULL) { goto end; } ret = Unified2AlertThreadInit(&tv, oc, &data); if(ret == -1) { goto end; } ret = Unified2Logger(&tv, data, p); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2AlertThreadDeinit(&tv, data); if(ret == -1) { goto end; } Unified2AlertDeInitCtx(oc); PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; end: PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 0; } /** * \test Test the ethernet+ipv4+tcp droped unified2 test * * \retval 1 on succces * \retval 0 on failure */ static int Unified2Test05(void) { ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; void *data = NULL; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; Signature s; uint8_t raw_ipv4_tcp[] = { 0x00, 0x14, 0xbf, 0xe8, 0xcb, 0x26, 0xaa, 0x00, 0x04, 0x00, 0x0a, 0x04, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x8c, 0x55, 0x40, 0x00, 0x40, 0x06, 0x69, 0x86, 0xc0, 0xa8, 0x0a, 0x68, 0x4a, 0x7d, 0x2f, 0x53, 0xc2, 0x40, 0x00, 0x50, 0x1f, 0x00, 0xa4, 0xd4, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0xd0, 0x3d, 0x4e, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x1c, 0x28, 0x81, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x06}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; int ret; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); memset(&s, 0, sizeof(Signature)); p->alerts.cnt++; p->alerts.alerts[p->alerts.cnt-1].s = &s; p->alerts.alerts[p->alerts.cnt-1].s->id = 1; p->alerts.alerts[p->alerts.cnt-1].s->gid = 1; p->alerts.alerts[p->alerts.cnt-1].s->rev = 1; SET_PKT_LEN(p, sizeof(raw_ipv4_tcp)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_ipv4_tcp, sizeof(raw_ipv4_tcp), &pq); p->action = ACTION_DROP; oc = Unified2AlertInitCtx(NULL); if (oc == NULL) { goto end; } uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if(lf == NULL) { goto end; } ret = Unified2AlertThreadInit(&tv, oc, &data); if(ret == -1) { goto end; } ret = Unified2Logger(&tv, data, p); if(ret == TM_ECODE_FAILED) { goto end; } ret = Unified2AlertThreadDeinit(&tv, data); if(ret == TM_ECODE_FAILED) { goto end; } Unified2AlertDeInitCtx(oc); PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; end: PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 0; } /** * \test Test the Rotate process * * \retval 1 on succces * \retval 0 on failure */ static int Unified2TestRotate01(void) { int ret = 0; int r = 0; ThreadVars tv; OutputCtx *oc; LogFileCtx *lf; Unified2AlertFileCtx *uaf = NULL; void *data = NULL; char *filename = NULL; oc = Unified2AlertInitCtx(NULL); if (oc == NULL) return 0; uaf = oc->data; if (uaf == NULL) return 0; lf = uaf->file_ctx; if (lf == NULL) return 0; filename = SCStrdup(lf->filename); if (unlikely(filename == NULL)) return 0; memset(&tv, 0, sizeof(ThreadVars)); ret = Unified2AlertThreadInit(&tv, oc, &data); if (ret == TM_ECODE_FAILED) { LogFileFreeCtx(lf); if (filename != NULL) SCFree(filename); return 0; } TimeSetIncrementTime(1); ret = Unified2AlertRotateFile(&tv, data); if (ret == -1) goto error; if (strcmp(filename, lf->filename) == 0) { SCLogError(SC_ERR_UNIFIED2_ALERT_GENERIC, "filename \"%s\" == \"%s\": ", filename, lf->filename); goto error; } r = 1; error: ret = Unified2AlertThreadDeinit(&tv, data); if(ret == TM_ECODE_FAILED) { printf("Unified2AlertThreadDeinit error"); } if (oc != NULL) Unified2AlertDeInitCtx(oc); if (filename != NULL) SCFree(filename); return r; } #endif /** * \brief this function registers unit tests for Unified2 */ void Unified2RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("Unified2Test01 -- Ipv4 test", Unified2Test01); UtRegisterTest("Unified2Test02 -- Ipv6 test", Unified2Test02); UtRegisterTest("Unified2Test03 -- GRE test", Unified2Test03); UtRegisterTest("Unified2Test04 -- PPP test", Unified2Test04); UtRegisterTest("Unified2Test05 -- Inline test", Unified2Test05); UtRegisterTest("Unified2TestRotate01 -- Rotate File", Unified2TestRotate01); #endif /* UNITTESTS */ } suricata-3.2.1/src/app-layer-dcerpc-common.h0000644000000000000000000002077013051004444015576 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl */ #ifndef __APP_LAYER_DCERPC_COMMON_H__ #define __APP_LAYER_DCERPC_COMMON_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "queue.h" #include "util-byte.h" void RegisterDCERPCParsers(void); void DCERPCParserTests(void); void DCERPCParserRegisterTests(void); // http://www.opengroup.org/onlinepubs/9629399/chap12.htm#tagcjh_17_06 #define REQUEST 0 #define PING 1 #define RESPONSE 2 #define FAULT 3 #define WORKING 4 #define NOCALL 5 #define REJECT 6 #define ACK 7 #define CL_CANCEL 8 #define FACK 9 #define CANCEL_ACK 10 #define BIND 11 #define BIND_ACK 12 #define BIND_NAK 13 #define ALTER_CONTEXT 14 #define ALTER_CONTEXT_RESP 15 #define SHUTDOWN 17 #define CO_CANCEL 18 #define ORPHANED 19 #if 0 typedef struct { uint8_t rpc_vers; /* 4 RPC protocol major version (4 LSB only)*/ uint8_t ptype; /* Packet type (5 LSB only) */ uint8_t flags1; /* Packet flags */ uint8_t flags2; /* Packet flags */ uint8_t drep[3]; /* Data representation format label */ uint8_t serial_hi; /* High byte of serial number */ uuid_t object; /* Object identifier */ uuid_t if_id; /* Interface identifier */ uuid_t act_id; /* Activity identifier */ unsigned long server_boot;/* Server boot time */ unsigned long if_vers; /* Interface version */ unsigned long seqnum; /* Sequence number */ unsigned short opnum; /* Operation number */ unsigned short ihint; /* Interface hint */ unsigned short ahint; /* Activity hint */ unsigned short len; /* Length of packet body */ unsigned short fragnum; /* Fragment number */ unsigned small auth_proto; /* Authentication protocol identifier*/ unsigned small serial_lo; /* Low byte of serial number */ } dc_rpc_cl_pkt_hdr_t; #endif #define RESERVED_01 0x01 #define LASTFRAG 0x02 #define FRAG 0x04 #define NOFACK 0x08 #define MAYBE 0x10 #define IDEMPOTENT 0x20 #define BROADCAST 0x40 #define RESERVED_80 0x80 #define CANCEL_PENDING 0x02 #define RESERVED_04 0x04 #define RESERVED_10 0x10 #define RESERVED_20 0x20 #define RESERVED_40 0x40 #define RESERVED_80 0x80 typedef struct DCERPCHdr_ { uint8_t rpc_vers; /**< 00:01 RPC version should be 5 */ uint8_t rpc_vers_minor; /**< 01:01 minor version */ uint8_t type; /**< 02:01 packet type */ uint8_t pfc_flags; /**< 03:01 flags (see PFC_... ) */ uint8_t packed_drep[4]; /**< 04:04 NDR data representation format label */ uint16_t frag_length; /**< 08:02 total length of fragment */ uint16_t auth_length; /**< 10:02 length of auth_value */ uint32_t call_id; /**< 12:04 call identifier */ } DCERPCHdr; #define DCERPC_HDR_LEN 16 typedef struct DCERPCHdrUdp_ { uint8_t rpc_vers; /**< 4 RPC protocol major version (4 LSB only)*/ uint8_t type; /**< Packet type (5 LSB only) */ uint8_t flags1; /**< Packet flags */ uint8_t flags2; /**< Packet flags */ uint8_t drep[3]; /**< Data representation format label */ uint8_t serial_hi; /**< High byte of serial number */ uint8_t objectuuid[16]; uint8_t interfaceuuid[16]; uint8_t activityuuid[16]; uint32_t server_boot; /**< Server boot time */ uint32_t if_vers; /**< Interface version */ uint32_t seqnum; /**< Sequence number */ uint16_t opnum; /**< Operation number */ uint16_t ihint; /**< Interface hint */ uint16_t ahint; /**< Activity hint */ uint16_t fraglen; /**< Length of packet body */ uint16_t fragnum; /**< Fragment number */ uint8_t auth_proto; /**< Authentication protocol identifier*/ uint8_t serial_lo; /**< Low byte of serial number */ } DCERPCHdrUdp; #define DCERPC_UDP_HDR_LEN 80 #define DCERPC_UUID_ENTRY_FLAG_FF 0x0001 /**< FIRST flag set on the packet that contained this uuid entry */ typedef struct DCERPCUuidEntry_ { uint16_t ctxid; uint16_t internal_id; uint16_t result; uint8_t uuid[16]; uint16_t version; uint16_t versionminor; uint16_t flags; /**< DCERPC_UUID_ENTRY_FLAG_* flags */ TAILQ_ENTRY(DCERPCUuidEntry_) next; } DCERPCUuidEntry; typedef TAILQ_HEAD(DCERPCUuidEntryList_, DCERPCUuidEntry_) DCERPCUuidEntryList; typedef struct DCERPCBindBindAck_ { uint8_t numctxitems; uint8_t numctxitemsleft; uint8_t ctxbytesprocessed; uint16_t ctxid; uint8_t uuid[16]; uint16_t version; uint16_t versionminor; DCERPCUuidEntry *uuid_entry; DCERPCUuidEntryList uuid_list; /* the interface uuids that the server has accepted */ DCERPCUuidEntryList accepted_uuid_list; uint16_t uuid_internal_id; uint16_t secondaryaddrlen; uint16_t secondaryaddrlenleft; uint16_t result; } DCERPCBindBindAck; typedef struct DCERPCRequest_ { uint16_t ctxid; uint16_t opnum; /* holds the stub data for the request */ uint8_t *stub_data_buffer; /* length of the above buffer */ uint32_t stub_data_buffer_len; /* used by the dce preproc to indicate fresh entry in the stub data buffer */ uint8_t stub_data_fresh; uint8_t first_request_seen; } DCERPCRequest; typedef struct DCERPCResponse_ { /* holds the stub data for the response */ uint8_t *stub_data_buffer; /* length of the above buffer */ uint32_t stub_data_buffer_len; /* used by the dce preproc to indicate fresh entry in the stub data buffer */ uint8_t stub_data_fresh; } DCERPCResponse; typedef struct DCERPC_ { DCERPCHdr dcerpchdr; DCERPCBindBindAck dcerpcbindbindack; DCERPCRequest dcerpcrequest; DCERPCResponse dcerpcresponse; uint16_t bytesprocessed; uint8_t pad; uint16_t padleft; uint16_t transaction_id; /* indicates if the dcerpc pdu state is in the middle of processing * a fragmented pdu */ uint8_t pdu_fragged; } DCERPC; typedef struct DCERPCUDP_ { DCERPCHdrUdp dcerpchdrudp; DCERPCBindBindAck dcerpcbindbindack; DCERPCRequest dcerpcrequest; DCERPCResponse dcerpcresponse; uint16_t bytesprocessed; uint16_t fraglenleft; uint8_t *frag_data; DCERPCUuidEntry *uuid_entry; TAILQ_HEAD(, uuid_entry) uuid_list; } DCERPCUDP; /** First fragment */ #define PFC_FIRST_FRAG 0x01 /** Last fragment */ #define PFC_LAST_FRAG 0x02 /** Cancel was pending at sender */ #define PFC_PENDING_CANCEL 0x04 #define PFC_RESERVED_1 0x08 /** supports concurrent multiplexing of a single connection. */ #define PFC_CONC_MPX 0x10 /** only meaningful on `fault' packet; if true, guaranteed * call did not execute. */ #define PFC_DID_NOT_EXECUTE 0x20 /** `maybe' call semantics requested */ #define PFC_MAYBE 0x40 /** if true, a non-nil object UUID was specified in the handle, and * is present in the optional object field. If false, the object field * is omitted. */ #define PFC_OBJECT_UUID 0x80 #define REASON_NOT_SPECIFIED 0 #define TEMPORARY_CONGESTION 1 #define LOCAL_LIMIT_EXCEEDED 2 #define CALLED_PADDR_UNKNOWN 3 /* not used */ #define PROTOCOL_VERSION_NOT_SUPPORTED 4 #define DEFAULT_CONTEXT_NOT_SUPPORTED 5 /* not used */ #define USER_DATA_NOT_READABLE 6 /* not used */ #define NO_PSAP_AVAILABLE 7 /* not used */ int32_t DCERPCParser(DCERPC *, uint8_t *, uint32_t); void hexdump(const void *buf, size_t len); void printUUID(char *type, DCERPCUuidEntry *uuid); #endif /* __APP_LAYER_DCERPC_COMMON_H__ */ suricata-3.2.1/src/detect-byte-extract.c0000644000000000000000000045543613051004444015047 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-bytejump.h" #include "detect-bytetest.h" #include "detect-byte-extract.h" #include "detect-isdataat.h" #include "app-layer-protos.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-byte.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" /* the default value of endianess to be used, if none's specified */ #define DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT DETECT_BYTE_EXTRACT_ENDIAN_BIG /* the base to be used if string mode is specified. These options would be * specified in DetectByteParseData->base */ #define DETECT_BYTE_EXTRACT_BASE_NONE 0 #define DETECT_BYTE_EXTRACT_BASE_HEX 16 #define DETECT_BYTE_EXTRACT_BASE_DEC 10 #define DETECT_BYTE_EXTRACT_BASE_OCT 8 /* the default value for multiplier. Either ways we always store a * multiplier, 1 or otherwise, so that we can always multiply the extracted * value and store it, instead of checking if a multiplier is set or not */ #define DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT 1 /* the min/max limit for multiplier */ #define DETECT_BYTE_EXTRACT_MULTIPLIER_MIN_LIMIT 1 #define DETECT_BYTE_EXTRACT_MULTIPLIER_MAX_LIMIT 65535 /* the max no of bytes that can be extracted in string mode - (string, hex) * (string, oct) or (string, dec) */ #define STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT 23 #define STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC 20 #define STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX 14 /* the max no of bytes that can be extraced in non-string mode */ #define NO_STRING_MAX_BYTES_TO_EXTRACT 8 #define PARSE_REGEX "^" \ "\\s*([0-9]+)\\s*" \ ",\\s*(-?[0-9]+)\\s*" \ ",\\s*([^\\s,]+)\\s*" \ "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \ "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \ "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \ "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \ "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \ "$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectByteExtractMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); int DetectByteExtractSetup(DetectEngineCtx *, Signature *, char *); void DetectByteExtractRegisterTests(void); void DetectByteExtractFree(void *); /** * \brief Registers the keyword handlers for the "byte_extract" keyword. */ void DetectByteExtractRegister(void) { sigmatch_table[DETECT_BYTE_EXTRACT].name = "byte_extract"; sigmatch_table[DETECT_BYTE_EXTRACT].Match = NULL; sigmatch_table[DETECT_BYTE_EXTRACT].AppLayerMatch = NULL; sigmatch_table[DETECT_BYTE_EXTRACT].Setup = DetectByteExtractSetup; sigmatch_table[DETECT_BYTE_EXTRACT].Free = DetectByteExtractFree; sigmatch_table[DETECT_BYTE_EXTRACT].RegisterTests = DetectByteExtractRegisterTests; sigmatch_table[DETECT_BYTE_EXTRACT].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } int DetectByteExtractDoMatch(DetectEngineThreadCtx *det_ctx, SigMatch *sm, Signature *s, uint8_t *payload, uint16_t payload_len, uint64_t *value, uint8_t endian) { DetectByteExtractData *data = (DetectByteExtractData *)sm->ctx; uint8_t *ptr = NULL; int32_t len = 0; uint64_t val = 0; int extbytes; if (payload_len == 0) { return 0; } /* Calculate the ptr value for the bytetest and length remaining in * the packet from that point. */ if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) { SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", " "data->offset %"PRIu32"", det_ctx->buffer_offset, data->offset); ptr = payload + det_ctx->buffer_offset; len = payload_len - det_ctx->buffer_offset; ptr += data->offset; len -= data->offset; /* No match if there is no relative base */ if (len <= 0) { return 0; } //PrintRawDataFp(stdout,ptr,len); } else { SCLogDebug("absolute, data->offset %"PRIu32"", data->offset); ptr = payload + data->offset; len = payload_len - data->offset; } /* Validate that the to-be-extracted is within the packet */ if (ptr < payload || data->nbytes > len) { SCLogDebug("Data not within payload pkt=%p, ptr=%p, len=%"PRIu32", nbytes=%d", payload, ptr, len, data->nbytes); return 0; } /* Extract the byte data */ if (data->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) { extbytes = ByteExtractStringUint64(&val, data->base, data->nbytes, (const char *)ptr); if (extbytes <= 0) { /* strtoull() return 0 if there is no numeric value in data string */ if (val == 0) { SCLogDebug("No Numeric value"); return 0; } else { SCLogError(SC_ERR_INVALID_NUM_BYTES, "Error extracting %d " "bytes of string data: %d", data->nbytes, extbytes); return -1; } } } else { int endianness = (endian == DETECT_BYTE_EXTRACT_ENDIAN_BIG) ? BYTE_BIG_ENDIAN : BYTE_LITTLE_ENDIAN; extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr); if (extbytes != data->nbytes) { SCLogError(SC_ERR_INVALID_NUM_BYTES, "Error extracting %d bytes " "of numeric data: %d\n", data->nbytes, extbytes); return 0; } } /* Adjust the jump value based on flags */ val *= data->multiplier_value; if (data->flags & DETECT_BYTE_EXTRACT_FLAG_ALIGN) { if ((val % data->align_value) != 0) { val += data->align_value - (val % data->align_value); } } ptr += extbytes; det_ctx->buffer_offset = ptr - payload; *value = val; return 1; } int DetectByteExtractMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *m) { goto end; end: return 1; } /** * \internal * \brief Used to parse byte_extract arg. * * \arg The argument to parse. * * \param bed On success an instance containing the parsed data. * On failure, NULL. */ static inline DetectByteExtractData *DetectByteExtractParse(char *arg) { DetectByteExtractData *bed = NULL; #define MAX_SUBSTRINGS 100 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i = 0; ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 19) { SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32 ", string \"%s\"", ret, arg); SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid arg to byte_extract : %s " "for byte_extract", arg); goto error; } bed = SCMalloc(sizeof(DetectByteExtractData)); if (unlikely(bed == NULL)) goto error; memset(bed, 0, sizeof(DetectByteExtractData)); /* no of bytes to extract */ char nbytes_str[64] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, 1, nbytes_str, sizeof(nbytes_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg 1 for byte_extract"); goto error; } bed->nbytes = atoi(nbytes_str); /* offset */ char offset_str[64] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, 2, offset_str, sizeof(offset_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg 2 for byte_extract"); goto error; } int offset = atoi(offset_str); if (offset < -65535 || offset > 65535) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract offset invalid - %d. " "The right offset range is -65535 to 65535", offset); goto error; } bed->offset = offset; /* var name */ char varname_str[256] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, 3, varname_str, sizeof(varname_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg 3 for byte_extract"); goto error; } bed->name = SCStrdup(varname_str); if (bed->name == NULL) goto error; /* check out other optional args */ for (i = 4; i < ret; i++) { char opt_str[64] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, i, opt_str, sizeof(opt_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg %d for byte_extract", i); goto error; } if (strcmp("relative", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "relative specified more " "than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_RELATIVE; } else if (strcmp("multiplier", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) { SCLogError(SC_ERR_INVALID_SIGNATURE, "multiplier specified more " "than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER; i++; char multiplier_str[16] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, i, multiplier_str, sizeof(multiplier_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg %d for byte_extract", i); goto error; } int multiplier = atoi(multiplier_str); if (multiplier < DETECT_BYTE_EXTRACT_MULTIPLIER_MIN_LIMIT || multiplier > DETECT_BYTE_EXTRACT_MULTIPLIER_MAX_LIMIT) { SCLogError(SC_ERR_INVALID_SIGNATURE, "multipiler_value invalid " "- %d. The range is %d-%d", multiplier, DETECT_BYTE_EXTRACT_MULTIPLIER_MIN_LIMIT, DETECT_BYTE_EXTRACT_MULTIPLIER_MAX_LIMIT); goto error; } bed->multiplier_value = multiplier; } else if (strcmp("big", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "endian option specified " "more than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN; bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_BIG; } else if (strcmp("little", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "endian option specified " "more than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN; bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_LITTLE; } else if (strcmp("dce", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "endian option specified " "more than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN; bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_DCE; } else if (strcmp("string", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) { SCLogError(SC_ERR_INVALID_SIGNATURE, "string specified more " "than once for byte_extract"); goto error; } if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "The right way to specify " "base is (string, base) and not (base, string) " "for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_STRING; } else if (strcmp("hex", opt_str) == 0) { if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Base(hex) specified " "without specifying string. The right way is " "(string, base) and not (base, string)"); goto error; } if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "More than one base " "specified for byte_extract"); goto error; } bed->base = DETECT_BYTE_EXTRACT_BASE_HEX; } else if (strcmp("oct", opt_str) == 0) { if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Base(oct) specified " "without specifying string. The right way is " "(string, base) and not (base, string)"); goto error; } if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "More than one base " "specified for byte_extract"); goto error; } bed->base = DETECT_BYTE_EXTRACT_BASE_OCT; } else if (strcmp("dec", opt_str) == 0) { if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Base(dec) specified " "without specifying string. The right way is " "(string, base) and not (base, string)"); goto error; } if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "More than one base " "specified for byte_extract"); goto error; } bed->base = DETECT_BYTE_EXTRACT_BASE_DEC; } else if (strcmp("align", opt_str) == 0) { if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ALIGN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Align specified more " "than once for byte_extract"); goto error; } bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ALIGN; i++; char align_str[16] = ""; res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, i, align_str, sizeof(align_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed " "for arg %d in byte_extract", i); goto error; } bed->align_value = atoi(align_str); if (!(bed->align_value == 2 || bed->align_value == 4)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid align_value for " "byte_extract - \"%d\"", bed->align_value); goto error; } } else if (strcmp("", opt_str) == 0) { ; } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid option - \"%s\" " "specified in byte_extract", opt_str); goto error; } } /* for (i = 4; i < ret; i++) */ /* validation */ if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER)) { /* default value */ bed->multiplier_value = DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT; } if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) { if (bed->base == DETECT_BYTE_EXTRACT_BASE_NONE) { /* Default to decimal if base not specified. */ bed->base = DETECT_BYTE_EXTRACT_BASE_DEC; } if (bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract can't have " "endian \"big\" or \"little\" specified along with " "\"string\""); goto error; } if (bed->base == DETECT_BYTE_EXTRACT_BASE_OCT) { /* if are dealing with octal nos, the max no that can fit in a 8 * byte value is 01777777777777777777777 */ if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract can't process " "more than %d bytes in \"string\" extraction", STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT); goto error; } } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_DEC) { /* if are dealing with decimal nos, the max no that can fit in a 8 * byte value is 18446744073709551615 */ if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract can't process " "more than %d bytes in \"string\" extraction", STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC); goto error; } } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_HEX) { /* if are dealing with hex nos, the max no that can fit in a 8 * byte value is 0xFFFFFFFFFFFFFFFF */ if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract can't process " "more than %d bytes in \"string\" extraction", STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX); goto error; } } else { ; // just a placeholder. we won't reach here. } } else { if (bed->nbytes > NO_STRING_MAX_BYTES_TO_EXTRACT) { SCLogError(SC_ERR_INVALID_SIGNATURE, "byte_extract can't process " "more than %d bytes in \"non-string\" extraction", NO_STRING_MAX_BYTES_TO_EXTRACT); goto error; } /* if string has not been specified and no endian option has been * specified, then set the default endian level of BIG */ if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN)) bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT; } return bed; error: if (bed != NULL) DetectByteExtractFree(bed); return NULL; } /** * \brief The setup function for the byte_extract keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success. * \retval -1 On failure. */ int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { SigMatch *sm = NULL; SigMatch *prev_pm = NULL; DetectByteExtractData *data = NULL; int ret = -1; data = DetectByteExtractParse(arg); if (data == NULL) goto error; int sm_list; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA) { if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "dce byte_extract specified " "with file_data option set."); goto error; } AppLayerHtpEnableResponseBodyCallback(); } sm_list = s->list; s->flags |= SIG_FLAG_APPLAYER; if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); } } else if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) { if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 12, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; } } else { sm_list = DETECT_SM_LIST_PMATCH; } s->alproto = ALPROTO_DCERPC; s->flags |= SIG_FLAG_APPLAYER; } else if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 168, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; if (sm_list != DETECT_SM_LIST_PMATCH) s->flags |= SIG_FLAG_APPLAYER; } } else { sm_list = DETECT_SM_LIST_PMATCH; } if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Non dce alproto sig has " "byte_extract with dce enabled"); goto error; } s->alproto = ALPROTO_DCERPC; if ((data->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) || (data->base == DETECT_BYTE_EXTRACT_BASE_DEC) || (data->base == DETECT_BYTE_EXTRACT_BASE_HEX) || (data->base == DETECT_BYTE_EXTRACT_BASE_OCT) ) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Invalid option. " "A byte_jump keyword with dce holds other invalid modifiers."); goto error; } } SigMatch *prev_bed_sm = SigMatchGetLastSMFromLists(s, 2, DETECT_BYTE_EXTRACT, s->sm_lists_tail[sm_list]); if (prev_bed_sm == NULL) data->local_id = 0; else data->local_id = ((DetectByteExtractData *)prev_bed_sm->ctx)->local_id + 1; if (data->local_id > de_ctx->byte_extract_max_local_id) de_ctx->byte_extract_max_local_id = data->local_id; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_BYTE_EXTRACT; sm->ctx = (void *)data; SigMatchAppendSMToList(s, sm, sm_list); if (!(data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE)) goto okay; if (prev_pm == NULL) goto okay; if (prev_pm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)prev_pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } okay: ret = 0; return ret; error: DetectByteExtractFree(data); return ret; } /** * \brief Used to free instances of DetectByteExtractData. * * \param ptr Instance of DetectByteExtractData to be freed. */ void DetectByteExtractFree(void *ptr) { if (ptr != NULL) { DetectByteExtractData *bed = ptr; if (bed->name != NULL) SCFree((void *)bed->name); SCFree(bed); } return; } /** * \brief Lookup the SigMatch for a named byte_extract variable. * * \param arg The name of the byte_extract variable to lookup. * \param s Pointer the signature to look in. * * \retval A pointer to the SigMatch if found, otherwise NULL. */ SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, Signature *s) { DetectByteExtractData *bed = NULL; int list; for (list = 0; list < DETECT_SM_LIST_MAX; list++) { SigMatch *sm = s->sm_lists[list]; while (sm != NULL) { if (sm->type == DETECT_BYTE_EXTRACT) { bed = (DetectByteExtractData *)sm->ctx; if (strcmp(bed->name, arg) == 0) { return sm; } } sm = sm->next; } } return NULL; } /*************************************Unittests********************************/ #ifdef UNITTESTS int DetectByteExtractTest01(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != 0 || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest02(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, relative"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_RELATIVE || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest03(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, multiplier 10"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != 10) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest04(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, relative, multiplier 10"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != 10) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest05(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, big"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_BIG || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest06(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, little"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_LITTLE || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest07(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, dce"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DCE || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest08(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, string, hex"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest09(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, string, oct"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_OCT || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest10(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, string, dec"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_DEC || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest11(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_ALIGN || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest12(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, relative"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest13(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, relative, big"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_BIG || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest14(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, relative, dce"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DCE || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest15(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, relative, little"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_ENDIAN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_LITTLE || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest16(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, relative, little, multiplier 2"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != 2 || strcmp(bed->name, "one") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN | DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_ENDIAN | DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_LITTLE || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 4 || bed->multiplier_value != 2) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest17(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "relative, little, " "multiplier 2, string hex"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest18(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "relative, little, " "multiplier 2, " "relative"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest19(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "relative, little, " "multiplier 2, " "little"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest20(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "relative, " "multiplier 2, " "align 2"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest21(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "multiplier 2, " "relative, " "multiplier 2"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest22(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "string hex, " "relative, " "string hex"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest23(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "string hex, " "relative, " "string oct"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest24(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("24, 2, one, align 4, " "string hex, " "relative"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest25(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("9, 2, one, align 4, " "little, " "relative"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest26(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "little, " "relative, " "multiplier 65536"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest27(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, align 4, " "little, " "relative, " "multiplier 0"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest28(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("23, 2, one, string, oct"); if (bed == NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest29(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("24, 2, one, string, oct"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest30(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("20, 2, one, string, dec"); if (bed == NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest31(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("21, 2, one, string, dec"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest32(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("14, 2, one, string, hex"); if (bed == NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest33(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("15, 2, one, string, hex"); if (bed != NULL) goto end; result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,2,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 2 || strncmp(bed->name, "two", cd->content_len) != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectPcreData *pd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; pcre:/asf/; " "byte_extract:4,0,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_PCRE) { result = 0; goto end; } pd = (DetectPcreData *)sm->ctx; if (pd->flags != DETECT_PCRE_RELATIVE_NEXT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectBytejumpData *bjd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; byte_jump:1,13; " "byte_extract:4,0,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest37(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectContentData *ud = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; uricontent:\"two\"; " "byte_extract:4,0,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } if (sm->next != NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)ud->content, "two", cd->content_len) != 0 || ud->flags & DETECT_CONTENT_NOCASE || ud->flags & DETECT_CONTENT_WITHIN || ud->flags & DETECT_CONTENT_DISTANCE || ud->flags & DETECT_CONTENT_FAST_PATTERN || !(ud->flags & DETECT_CONTENT_RELATIVE_NEXT) || ud->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest38(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectContentData *ud = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; uricontent:\"two\"; " "byte_extract:4,0,two,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags !=DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)ud->content, "two", cd->content_len) != 0 || ud->flags & DETECT_CONTENT_NOCASE || ud->flags & DETECT_CONTENT_WITHIN || ud->flags & DETECT_CONTENT_DISTANCE || ud->flags & DETECT_CONTENT_FAST_PATTERN || ud->flags & DETECT_CONTENT_RELATIVE_NEXT || ud->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } if (sm->next != NULL) { result = 0; goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest39(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectContentData *ud = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; content:\"two\"; http_uri; " "byte_extract:4,0,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } if (sm->next != NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)ud->content, "two", cd->content_len) != 0 || ud->flags & DETECT_CONTENT_NOCASE || ud->flags & DETECT_CONTENT_WITHIN || ud->flags & DETECT_CONTENT_DISTANCE || ud->flags & DETECT_CONTENT_FAST_PATTERN || !(ud->flags & DETECT_CONTENT_RELATIVE_NEXT) || ud->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest40(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectContentData *ud = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; content:\"two\"; http_uri; " "byte_extract:4,0,two,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags !=DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)ud->content, "two", cd->content_len) != 0 || ud->flags & DETECT_CONTENT_NOCASE || ud->flags & DETECT_CONTENT_WITHIN || ud->flags & DETECT_CONTENT_DISTANCE || ud->flags & DETECT_CONTENT_FAST_PATTERN || ud->flags & DETECT_CONTENT_RELATIVE_NEXT || ud->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } if (sm->next != NULL) { result = 0; goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest41(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "three") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 1) { result = 0; goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest42(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectContentData *ud = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "uricontent: \"three\"; " "byte_extract:4,0,four,string,hex,relative; " "byte_extract:4,0,five,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "five") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 1) { result = 0; goto end; } if (sm->next != NULL) goto end; sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)ud->content, "three", cd->content_len) != 0 || ud->flags & DETECT_CONTENT_NOCASE || ud->flags & DETECT_CONTENT_WITHIN || ud->flags & DETECT_CONTENT_DISTANCE || ud->flags & DETECT_CONTENT_FAST_PATTERN || !(ud->flags & DETECT_CONTENT_RELATIVE_NEXT) || ud->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "four") != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE | DETECT_BYTE_EXTRACT_FLAG_STRING) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest43(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "content: \"three\"; offset:two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "three", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_OFFSET_BE | DETECT_CONTENT_OFFSET) || cd->offset != bed->local_id) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest44(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "content: \"four\"; offset:two; " "content: \"five\"; offset:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_OFFSET_BE | DETECT_CONTENT_OFFSET) || cd->offset != bed1->local_id) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "five", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_OFFSET_BE | DETECT_CONTENT_OFFSET) || cd->offset != bed2->local_id) { printf("five failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest45(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "content: \"three\"; depth:two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "three", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DEPTH_BE | DETECT_CONTENT_DEPTH) || cd->depth != bed->local_id || cd->offset != 0) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest46(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "content: \"four\"; depth:two; " "content: \"five\"; depth:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DEPTH_BE | DETECT_CONTENT_DEPTH) || cd->depth != bed1->local_id) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "five", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DEPTH_BE | DETECT_CONTENT_DEPTH) || cd->depth != bed2->local_id) { printf("five failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest47(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "content: \"three\"; distance:two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "three", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_DISTANCE) || cd->distance != bed->local_id || cd->offset != 0 || cd->depth != 0) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest48(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "content: \"four\"; distance:two; " "content: \"five\"; distance:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_DISTANCE | DETECT_CONTENT_RELATIVE_NEXT) || cd->distance != bed1->local_id || cd->depth != 0 || cd->offset != 0) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "five", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_DISTANCE) || cd->distance != bed2->local_id || cd->depth != 0 || cd->offset != 0) { printf("five failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest49(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "content: \"three\"; within:two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "three", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_WITHIN) || cd->within != bed->local_id || cd->offset != 0 || cd->depth != 0 || cd->distance != 0) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest50(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "content: \"four\"; within:two; " "content: \"five\"; within:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_WITHIN| DETECT_CONTENT_RELATIVE_NEXT) || cd->within != bed1->local_id || cd->depth != 0 || cd->offset != 0 || cd->distance != 0) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "five", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_WITHIN) || cd->within != bed2->local_id || cd->depth != 0 || cd->offset != 0 || cd->distance != 0) { printf("five failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest51(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_test: 2,=,10, two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags != DETECT_BYTETEST_OFFSET_BE || btd->value != 10 || btd->offset != 0) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest52(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_test: 2,=,two,three; " "byte_test: 3,=,10,three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags != (DETECT_BYTETEST_OFFSET_BE | DETECT_BYTETEST_VALUE_BE) || btd->value != 0 || btd->offset != 1) { printf("three failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags != DETECT_BYTETEST_OFFSET_BE || btd->value != 10 || btd->offset != 1) { printf("four failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest53(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed = NULL; DetectBytejumpData *bjd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_jump: 2,two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 0 || strcmp(bed->name, "two") != 0 || bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 0) { printf("three failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest54(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectBytejumpData *bjd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_jump: 2,two; " "byte_jump: 3,three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 0) { printf("three failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 1) { printf("four failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest55(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing byte_extract\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_extract:4,0,four,string,hex; " "byte_extract:4,0,five,string,hex; " "content: \"four\"; within:two; distance:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed: "); goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || cd->within != bed1->local_id || cd->distance != bed2->local_id) { printf("four failed: "); goto end; } if (sm->next != NULL) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest56(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "uricontent:\"urione\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_extract:4,0,four,string,hex; " "byte_extract:4,0,five,string,hex; " "content: \"four\"; within:two; distance:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "urione", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || cd->within != bed1->local_id || cd->distance != bed2->local_id ) { printf("four failed\n"); result = 0; goto end; } if (sm->next != NULL) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest57(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectByteExtractData *bed2 = NULL; DetectByteExtractData *bed3 = NULL; DetectByteExtractData *bed4 = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "uricontent: \"urione\"; " "byte_extract:4,0,two,string,hex,relative; " "byte_extract:4,0,three,string,hex,relative; " "byte_extract:4,0,four,string,hex,relative; " "byte_extract:4,0,five,string,hex,relative; " "uricontent: \"four\"; within:two; distance:three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "urione", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed2 = (DetectByteExtractData *)sm->ctx; if (bed2->local_id != 1) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed3 = (DetectByteExtractData *)sm->ctx; if (bed3->local_id != 2) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed4 = (DetectByteExtractData *)sm->ctx; if (bed4->local_id != 3) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (strncmp((char *)cd->content, "four", cd->content_len) != 0 || cd->flags != (DETECT_CONTENT_DISTANCE_BE | DETECT_CONTENT_WITHIN_BE | DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || cd->within != bed1->local_id || cd->distance != bed2->local_id) { printf("four failed\n"); result = 0; goto end; } if (sm->next != NULL) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest58(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectBytejumpData *bjd = NULL; DetectIsdataatData *isdd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_jump: 2,two; " "byte_jump: 3,three; " "isdataat: three; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 0) { printf("three failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 1) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isdd = (DetectIsdataatData *)sm->ctx; if (isdd->flags != ISDATAAT_OFFSET_BE || isdd->dataat != 1) { printf("isdataat failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest59(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectBytejumpData *bjd = NULL; DetectIsdataatData *isdd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex; " "byte_extract:4,0,three,string,hex; " "byte_jump: 2,two; " "byte_jump: 3,three; " "isdataat: three,relative; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || cd->flags & DETECT_CONTENT_RELATIVE_NEXT || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != DETECT_BYTE_EXTRACT_FLAG_STRING || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 0) { printf("three failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE || bjd->offset != 1) { printf("four failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isdd = (DetectIsdataatData *)sm->ctx; if (isdd->flags != (ISDATAAT_OFFSET_BE | ISDATAAT_RELATIVE) || isdd->dataat != 1) { printf("isdataat failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest60(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectIsdataatData *isdd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex,relative; " "uricontent: \"three\"; " "byte_extract:4,0,four,string,hex,relative; " "isdataat: two; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isdd = (DetectIsdataatData *)sm->ctx; if (isdd->flags != (ISDATAAT_OFFSET_BE) || isdd->dataat != bed1->local_id) { printf("isdataat failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags != DETECT_CONTENT_RELATIVE_NEXT || strncmp((char *)cd->content, "three", cd->content_len) != 0) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "four") != 0 || bed1->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest61(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *cd = NULL; DetectByteExtractData *bed1 = NULL; DetectIsdataatData *isdd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "byte_extract:4,0,two,string,hex,relative; " "uricontent: \"three\"; " "byte_extract:4,0,four,string,hex,relative; " "isdataat: four, relative; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES || strncmp((char *)cd->content, "one", cd->content_len) != 0 || cd->flags & DETECT_CONTENT_NOCASE || cd->flags & DETECT_CONTENT_WITHIN || cd->flags & DETECT_CONTENT_DISTANCE || cd->flags & DETECT_CONTENT_FAST_PATTERN || !(cd->flags & DETECT_CONTENT_RELATIVE_NEXT) || cd->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "two") != 0 || bed1->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } if (sm->next != NULL) goto end; if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } cd = (DetectContentData *)sm->ctx; if (cd->flags != DETECT_CONTENT_RELATIVE_NEXT || strncmp((char *)cd->content, "three", cd->content_len) != 0) { printf("one failed\n"); result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed1 = (DetectByteExtractData *)sm->ctx; if (bed1->nbytes != 4 || bed1->offset != 0 || strcmp(bed1->name, "four") != 0 || bed1->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed1->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed1->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed1->align_value != 0 || bed1->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } if (bed1->local_id != 0) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isdd = (DetectIsdataatData *)sm->ctx; if (isdd->flags != (ISDATAAT_OFFSET_BE | ISDATAAT_RELATIVE) || isdd->dataat != bed1->local_id) { printf("isdataat failed\n"); result = 0; goto end; } if (sm->next != NULL) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int DetectByteExtractTest62(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; SigMatch *sm = NULL; DetectByteExtractData *bed = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; byte_extract:4,2,two,relative,string,hex; " "sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL) { goto end; } sm = s->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm->type != DETECT_BYTE_EXTRACT) { result = 0; goto end; } bed = (DetectByteExtractData *)sm->ctx; if (bed->nbytes != 4 || bed->offset != 2 || strncmp(bed->name, "two", 3) != 0 || bed->flags != (DETECT_BYTE_EXTRACT_FLAG_STRING | DETECT_BYTE_EXTRACT_FLAG_RELATIVE) || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE || bed->base != DETECT_BYTE_EXTRACT_BASE_HEX || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectByteExtractTest63(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, -2, one"); if (bed == NULL) goto end; if (bed->nbytes != 4 || bed->offset != -2 || strcmp(bed->name, "one") != 0 || bed->flags != 0 || bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT || bed->base != DETECT_BYTE_EXTRACT_BASE_NONE || bed->align_value != 0 || bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } int DetectByteExtractTestParseNoBase(void) { int result = 0; DetectByteExtractData *bed = DetectByteExtractParse("4, 2, one, string"); if (bed == NULL) goto end; if (bed->nbytes != 4) { goto end; } if (bed->offset != 2) { goto end; } if (strcmp(bed->name, "one") != 0) { goto end; } if (bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING) { goto end; } if (bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE) { goto end; } if (bed->base != DETECT_BYTE_EXTRACT_BASE_DEC) { goto end; } if (bed->align_value != 0) { goto end; } if (bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) { goto end; } result = 1; end: if (bed != NULL) DetectByteExtractFree(bed); return result; } #endif /* UNITTESTS */ void DetectByteExtractRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectByteExtractTest01", DetectByteExtractTest01); UtRegisterTest("DetectByteExtractTest02", DetectByteExtractTest02); UtRegisterTest("DetectByteExtractTest03", DetectByteExtractTest03); UtRegisterTest("DetectByteExtractTest04", DetectByteExtractTest04); UtRegisterTest("DetectByteExtractTest05", DetectByteExtractTest05); UtRegisterTest("DetectByteExtractTest06", DetectByteExtractTest06); UtRegisterTest("DetectByteExtractTest07", DetectByteExtractTest07); UtRegisterTest("DetectByteExtractTest08", DetectByteExtractTest08); UtRegisterTest("DetectByteExtractTest09", DetectByteExtractTest09); UtRegisterTest("DetectByteExtractTest10", DetectByteExtractTest10); UtRegisterTest("DetectByteExtractTest11", DetectByteExtractTest11); UtRegisterTest("DetectByteExtractTest12", DetectByteExtractTest12); UtRegisterTest("DetectByteExtractTest13", DetectByteExtractTest13); UtRegisterTest("DetectByteExtractTest14", DetectByteExtractTest14); UtRegisterTest("DetectByteExtractTest15", DetectByteExtractTest15); UtRegisterTest("DetectByteExtractTest16", DetectByteExtractTest16); UtRegisterTest("DetectByteExtractTest17", DetectByteExtractTest17); UtRegisterTest("DetectByteExtractTest18", DetectByteExtractTest18); UtRegisterTest("DetectByteExtractTest19", DetectByteExtractTest19); UtRegisterTest("DetectByteExtractTest20", DetectByteExtractTest20); UtRegisterTest("DetectByteExtractTest21", DetectByteExtractTest21); UtRegisterTest("DetectByteExtractTest22", DetectByteExtractTest22); UtRegisterTest("DetectByteExtractTest23", DetectByteExtractTest23); UtRegisterTest("DetectByteExtractTest24", DetectByteExtractTest24); UtRegisterTest("DetectByteExtractTest25", DetectByteExtractTest25); UtRegisterTest("DetectByteExtractTest26", DetectByteExtractTest26); UtRegisterTest("DetectByteExtractTest27", DetectByteExtractTest27); UtRegisterTest("DetectByteExtractTest28", DetectByteExtractTest28); UtRegisterTest("DetectByteExtractTest29", DetectByteExtractTest29); UtRegisterTest("DetectByteExtractTest30", DetectByteExtractTest30); UtRegisterTest("DetectByteExtractTest31", DetectByteExtractTest31); UtRegisterTest("DetectByteExtractTest32", DetectByteExtractTest32); UtRegisterTest("DetectByteExtractTest33", DetectByteExtractTest33); UtRegisterTest("DetectByteExtractTest34", DetectByteExtractTest34); UtRegisterTest("DetectByteExtractTest35", DetectByteExtractTest35); UtRegisterTest("DetectByteExtractTest36", DetectByteExtractTest36); UtRegisterTest("DetectByteExtractTest37", DetectByteExtractTest37); UtRegisterTest("DetectByteExtractTest38", DetectByteExtractTest38); UtRegisterTest("DetectByteExtractTest39", DetectByteExtractTest39); UtRegisterTest("DetectByteExtractTest40", DetectByteExtractTest40); UtRegisterTest("DetectByteExtractTest41", DetectByteExtractTest41); UtRegisterTest("DetectByteExtractTest42", DetectByteExtractTest42); UtRegisterTest("DetectByteExtractTest43", DetectByteExtractTest43); UtRegisterTest("DetectByteExtractTest44", DetectByteExtractTest44); UtRegisterTest("DetectByteExtractTest45", DetectByteExtractTest45); UtRegisterTest("DetectByteExtractTest46", DetectByteExtractTest46); UtRegisterTest("DetectByteExtractTest47", DetectByteExtractTest47); UtRegisterTest("DetectByteExtractTest48", DetectByteExtractTest48); UtRegisterTest("DetectByteExtractTest49", DetectByteExtractTest49); UtRegisterTest("DetectByteExtractTest50", DetectByteExtractTest50); UtRegisterTest("DetectByteExtractTest51", DetectByteExtractTest51); UtRegisterTest("DetectByteExtractTest52", DetectByteExtractTest52); UtRegisterTest("DetectByteExtractTest53", DetectByteExtractTest53); UtRegisterTest("DetectByteExtractTest54", DetectByteExtractTest54); UtRegisterTest("DetectByteExtractTest55", DetectByteExtractTest55); UtRegisterTest("DetectByteExtractTest56", DetectByteExtractTest56); UtRegisterTest("DetectByteExtractTest57", DetectByteExtractTest57); UtRegisterTest("DetectByteExtractTest58", DetectByteExtractTest58); UtRegisterTest("DetectByteExtractTest59", DetectByteExtractTest59); UtRegisterTest("DetectByteExtractTest60", DetectByteExtractTest60); UtRegisterTest("DetectByteExtractTest61", DetectByteExtractTest61); UtRegisterTest("DetectByteExtractTest62", DetectByteExtractTest62); UtRegisterTest("DetectByteExtractTest63", DetectByteExtractTest63); UtRegisterTest("DetectByteExtractTestParseNoBase", DetectByteExtractTestParseNoBase); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-profiling.c0000644000000000000000000013573013051004444014122 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Victor Julien * * An API for profiling operations. * * Really just a wrapper around the existing perf counters. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine-prefilter.h" #include "conf.h" #include "flow-worker.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-byte.h" #include "util-profiling.h" #include "util-profiling-locks.h" #ifdef PROFILING #ifndef MIN #define MIN(a, b) (((a) < (b)) ? (a) : (b)) #endif #define DEFAULT_LOG_FILENAME "profile.log" #define DEFAULT_LOG_MODE_APPEND "yes" static pthread_mutex_t packet_profile_lock; static FILE *packet_profile_csv_fp = NULL; extern int profiling_locks_enabled; extern int profiling_locks_output_to_file; extern char *profiling_locks_file_name; extern char *profiling_locks_file_mode; typedef struct SCProfilePacketData_ { uint64_t min; uint64_t max; uint64_t tot; uint64_t cnt; #ifdef PROFILE_LOCKING uint64_t lock; uint64_t ticks; uint64_t contention; uint64_t slock; uint64_t sticks; uint64_t scontention; #endif } SCProfilePacketData; SCProfilePacketData packet_profile_data4[257]; /**< all proto's + tunnel */ SCProfilePacketData packet_profile_data6[257]; /**< all proto's + tunnel */ /* each module, each proto */ SCProfilePacketData packet_profile_tmm_data4[TMM_SIZE][257]; SCProfilePacketData packet_profile_tmm_data6[TMM_SIZE][257]; SCProfilePacketData packet_profile_app_data4[TMM_SIZE][257]; SCProfilePacketData packet_profile_app_data6[TMM_SIZE][257]; SCProfilePacketData packet_profile_app_pd_data4[257]; SCProfilePacketData packet_profile_app_pd_data6[257]; SCProfilePacketData packet_profile_detect_data4[PROF_DETECT_SIZE][257]; SCProfilePacketData packet_profile_detect_data6[PROF_DETECT_SIZE][257]; SCProfilePacketData packet_profile_log_data4[LOGGER_SIZE][256]; SCProfilePacketData packet_profile_log_data6[LOGGER_SIZE][256]; struct ProfileProtoRecords { SCProfilePacketData records4[257]; SCProfilePacketData records6[257]; }; static SCProfilePacketData prefilter4[256][256]; static SCProfilePacketData prefilter6[256][256]; struct ProfileProtoRecords packet_profile_flowworker_data[PROFILE_FLOWWORKER_SIZE]; int profiling_packets_enabled = 0; int profiling_output_to_file = 0; static int profiling_packets_csv_enabled = 0; static int profiling_packets_output_to_file = 0; static char *profiling_file_name; static char profiling_packets_file_name[PATH_MAX]; static char *profiling_csv_file_name; static const char *profiling_packets_file_mode = "a"; static int rate = 1; static SC_ATOMIC_DECLARE(uint64_t, samples); /** * Used as a check so we don't double enter a profiling run. */ __thread int profiling_rules_entered = 0; void SCProfilingDumpPacketStats(void); const char * PacketProfileDetectIdToString(PacketProfileDetectId id); const char * PacketProfileLoggertIdToString(LoggerId id); static void FormatNumber(uint64_t num, char *str, size_t size) { if (num < 1000UL) snprintf(str, size, "%"PRIu64, num); else if (num < 1000000UL) snprintf(str, size, "%3.1fk", (float)num/1000UL); else if (num < 1000000000UL) snprintf(str, size, "%3.1fm", (float)num/1000000UL); else snprintf(str, size, "%3.1fb", (float)num/1000000000UL); } /** * \brief Initialize profiling. */ void SCProfilingInit(void) { ConfNode *conf; SC_ATOMIC_INIT(samples); intmax_t rate_v = 0; (void)ConfGetInt("profiling.sample-rate", &rate_v); if (rate_v > 0 && rate_v < INT_MAX) { rate = (int)rate_v; if (rate != 1) SCLogInfo("profiling runs for every %dth packet", rate); else SCLogInfo("profiling runs for every packet"); } conf = ConfGetNode("profiling.packets"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { profiling_packets_enabled = 1; if (pthread_mutex_init(&packet_profile_lock, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Failed to initialize packet profiling mutex."); exit(EXIT_FAILURE); } memset(&packet_profile_data4, 0, sizeof(packet_profile_data4)); memset(&packet_profile_data6, 0, sizeof(packet_profile_data6)); memset(&packet_profile_tmm_data4, 0, sizeof(packet_profile_tmm_data4)); memset(&packet_profile_tmm_data6, 0, sizeof(packet_profile_tmm_data6)); memset(&packet_profile_app_data4, 0, sizeof(packet_profile_app_data4)); memset(&packet_profile_app_data6, 0, sizeof(packet_profile_app_data6)); memset(&packet_profile_app_pd_data4, 0, sizeof(packet_profile_app_pd_data4)); memset(&packet_profile_app_pd_data6, 0, sizeof(packet_profile_app_pd_data6)); memset(&packet_profile_detect_data4, 0, sizeof(packet_profile_detect_data4)); memset(&packet_profile_detect_data6, 0, sizeof(packet_profile_detect_data6)); memset(&packet_profile_log_data4, 0, sizeof(packet_profile_log_data4)); memset(&packet_profile_log_data6, 0, sizeof(packet_profile_log_data6)); memset(&packet_profile_flowworker_data, 0, sizeof(packet_profile_flowworker_data)); memset(&prefilter4, 0, sizeof(prefilter4)); memset(&prefilter6, 0, sizeof(prefilter6)); const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(profiling_packets_file_name, sizeof(profiling_packets_file_name), "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_packets_file_mode = "a"; } else { profiling_packets_file_mode = "w"; } profiling_packets_output_to_file = 1; } } conf = ConfGetNode("profiling.packets.csv"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename == NULL) { filename = "packet_profile.csv"; } char *log_dir; log_dir = ConfigGetLogDirectory(); profiling_csv_file_name = SCMalloc(PATH_MAX); if (unlikely(profiling_csv_file_name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "out of memory"); exit(EXIT_FAILURE); } snprintf(profiling_csv_file_name, PATH_MAX, "%s/%s", log_dir, filename); packet_profile_csv_fp = fopen(profiling_csv_file_name, "w"); if (packet_profile_csv_fp == NULL) { return; } fprintf(packet_profile_csv_fp, "pcap_cnt,ipver,ipproto,total,"); int i; for (i = 0; i < TMM_SIZE; i++) { fprintf(packet_profile_csv_fp, "%s,", TmModuleTmmIdToString(i)); } fprintf(packet_profile_csv_fp, "threading,"); for (i = 0; i < ALPROTO_MAX; i++) { fprintf(packet_profile_csv_fp, "%s,", AppProtoToString(i)); } fprintf(packet_profile_csv_fp, "proto detect,"); for (i = 0; i < PROF_DETECT_SIZE; i++) { fprintf(packet_profile_csv_fp, "%s,", PacketProfileDetectIdToString(i)); } fprintf(packet_profile_csv_fp, "\n"); profiling_packets_csv_enabled = 1; } } } conf = ConfGetNode("profiling.locks"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { #ifndef PROFILE_LOCKING SCLogWarning(SC_WARN_PROFILE, "lock profiling not compiled in. Add --enable-profiling-locks to configure."); #else profiling_locks_enabled = 1; LockRecordInitHash(); const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); profiling_locks_file_name = SCMalloc(PATH_MAX); if (unlikely(profiling_locks_file_name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "can't duplicate file name"); exit(EXIT_FAILURE); } snprintf(profiling_locks_file_name, PATH_MAX, "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_locks_file_mode = "a"; } else { profiling_locks_file_mode = "w"; } profiling_locks_output_to_file = 1; } #endif } } } /** * \brief Free resources used by profiling. */ void SCProfilingDestroy(void) { if (profiling_packets_enabled) { pthread_mutex_destroy(&packet_profile_lock); } if (profiling_packets_csv_enabled) { if (packet_profile_csv_fp != NULL) fclose(packet_profile_csv_fp); packet_profile_csv_fp = NULL; } if (profiling_csv_file_name != NULL) SCFree(profiling_csv_file_name); profiling_csv_file_name = NULL; if (profiling_file_name != NULL) SCFree(profiling_file_name); profiling_file_name = NULL; #ifdef PROFILE_LOCKING LockRecordFreeHash(); #endif } void SCProfilingDump(void) { SCProfilingDumpPacketStats(); SCLogPerf("Done dumping profiling data."); } static void DumpPrefilterIP(FILE *fp, int ipv, uint64_t total) { char totalstr[256]; SCProfilePacketData total_pd; memset(&total_pd, 0, sizeof(total_pd)); int i; for (i = 0; i < 256; i++) { const char *name = PrefilterStoreGetName(i); for (int p = 0; p < 256; p++) { SCProfilePacketData *pd = ipv == 4 ? &prefilter4[i][p] : &prefilter6[i][p]; if (pd->cnt == 0) { continue; } total_pd.cnt += pd->cnt; total_pd.tot += pd->tot; FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-30s IPv%d %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %11s %-6.2f\n", name, ipv, p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } if (total_pd.cnt) { FormatNumber(total_pd.tot, totalstr, sizeof(totalstr)); fprintf(fp, "%-30s IPv%d %12"PRIu64" %12"PRIu64" %11s\n", "Total", ipv, total_pd.cnt, (uint64_t)(total_pd.tot / total_pd.cnt), totalstr); } } static void DumpPrefilter(FILE *fp) { uint64_t total = 0; int i; for (i = 0; i < 256; i++) { for (int p = 0; p < 256; p++) { SCProfilePacketData *pd = &prefilter4[i][p]; total += pd->tot; pd = &prefilter6[i][p]; total += pd->tot; } } fprintf(fp, "\n%-30s %-6s %-5s %-12s %-12s %-12s %-12s %-11s %-3s\n", "Prefilter", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%"); fprintf(fp, "%-30s %-6s %-5s %-12s %-12s %-12s %-12s %-11s %-3s\n", "--------------------", "------", "-----", "----------", "------------", "------------", "-----------", "---------", "---"); DumpPrefilterIP(fp, 4, total); DumpPrefilterIP(fp, 6, total); } static void SCProfilingUpdatePrefilterRecords(Packet *p) { if (p->profile->prefilter.engines != NULL) { uint32_t x; for (x = 0; x < p->profile->prefilter.size; x++) { uint64_t ticks = p->profile->prefilter.engines[x].ticks_spent; if (ticks == 0) continue; SCProfilePacketData *pd = NULL; if (PKT_IS_IPV4(p)) { pd = &prefilter4[x][p->proto]; } else if (PKT_IS_IPV6(p)) { pd = &prefilter6[x][p->proto]; } else { continue; } if (pd->min == 0 || ticks < pd->min) { pd->min = ticks; } if (pd->max < ticks) { pd->max = ticks; } pd->tot += ticks; pd->cnt ++; } } } static void DumpFlowWorkerIP(FILE *fp, int ipv, uint64_t total) { char totalstr[256]; enum ProfileFlowWorkerId fwi; for (fwi = 0; fwi < PROFILE_FLOWWORKER_SIZE; fwi++) { struct ProfileProtoRecords *r = &packet_profile_flowworker_data[fwi]; for (int p = 0; p < 257; p++) { SCProfilePacketData *pd = ipv == 4 ? &r->records4[p] : &r->records6[p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-20s IPv%d %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", ProfileFlowWorkerIdToString(fwi), ipv, p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } } static void DumpFlowWorker(FILE *fp) { uint64_t total = 0; enum ProfileFlowWorkerId fwi; for (fwi = 0; fwi < PROFILE_FLOWWORKER_SIZE; fwi++) { struct ProfileProtoRecords *r = &packet_profile_flowworker_data[fwi]; for (int p = 0; p < 257; p++) { SCProfilePacketData *pd = &r->records4[p]; total += pd->tot; pd = &r->records6[p]; total += pd->tot; } } fprintf(fp, "\n%-20s %-6s %-5s %-12s %-12s %-12s %-12s\n", "Flow Worker", "IP ver", "Proto", "cnt", "min", "max", "avg"); fprintf(fp, "%-20s %-6s %-5s %-12s %-12s %-12s %-12s\n", "--------------------", "------", "-----", "----------", "------------", "------------", "-----------"); DumpFlowWorkerIP(fp, 4, total); DumpFlowWorkerIP(fp, 6, total); fprintf(fp, "Note: %s includes app-layer for TCP\n", ProfileFlowWorkerIdToString(PROFILE_FLOWWORKER_STREAM)); } void SCProfilingDumpPacketStats(void) { int i; FILE *fp; char totalstr[256]; uint64_t total; if (profiling_packets_enabled == 0) return; if (profiling_packets_output_to_file == 1) { fp = fopen(profiling_packets_file_name, profiling_packets_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_packets_file_name, strerror(errno)); return; } } else { fp = stdout; } fprintf(fp, "\n\nPacket profile dump:\n"); fprintf(fp, "\n%-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s\n", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%"); fprintf(fp, "%-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s\n", "------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---"); total = 0; for (i = 0; i < 257; i++) { SCProfilePacketData *pd = &packet_profile_data4[i]; total += pd->tot; pd = &packet_profile_data6[i]; total += pd->tot; } for (i = 0; i < 257; i++) { SCProfilePacketData *pd = &packet_profile_data4[i]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, " IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", i, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } for (i = 0; i < 257; i++) { SCProfilePacketData *pd = &packet_profile_data6[i]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, " IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", i, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } fprintf(fp, "Note: Protocol 256 tracks pseudo/tunnel packets.\n"); fprintf(fp, "\nPer Thread module stats:\n"); fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s", "Thread Module", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%"); #ifdef PROFILE_LOCKING fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n", "locks", "ticks", "cont.", "cont.avg", "slocks", "sticks", "scont.", "scont.avg"); #else fprintf(fp, "\n"); #endif fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s", "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---"); #ifdef PROFILE_LOCKING fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n", "--------", "--------", "----------", "-----------", "--------", "--------", "------------", "-----------"); #else fprintf(fp, "\n"); #endif int m; total = 0; for (m = 0; m < TMM_SIZE; m++) { if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p]; total += pd->tot; pd = &packet_profile_tmm_data6[m][p]; total += pd->tot; } } for (m = 0; m < TMM_SIZE; m++) { if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f", TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); #ifdef PROFILE_LOCKING fprintf(fp, " %10.2f %12"PRIu64" %12"PRIu64" %10.2f %10.2f %12"PRIu64" %12"PRIu64" %10.2f\n", (float)pd->lock/pd->cnt, (uint64_t)pd->ticks/pd->cnt, pd->contention, (float)pd->contention/pd->cnt, (float)pd->slock/pd->cnt, (uint64_t)pd->sticks/pd->cnt, pd->scontention, (float)pd->scontention/pd->cnt); #else fprintf(fp, "\n"); #endif } } for (m = 0; m < TMM_SIZE; m++) { if (tmm_modules[m].flags & TM_FLAG_LOGAPI_TM) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data6[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } DumpFlowWorker(fp); fprintf(fp, "\nPer App layer parser stats:\n"); fprintf(fp, "\n%-20s %-6s %-5s %-12s %-12s %-12s %-12s\n", "App Layer", "IP ver", "Proto", "cnt", "min", "max", "avg"); fprintf(fp, "%-20s %-6s %-5s %-12s %-12s %-12s %-12s\n", "--------------------", "------", "-----", "----------", "------------", "------------", "-----------"); total = 0; for (m = 0; m < ALPROTO_MAX; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_app_data4[m][p]; total += pd->tot; pd = &packet_profile_app_data6[m][p]; total += pd->tot; } } for (m = 0; m < ALPROTO_MAX; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_app_data4[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", AppProtoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } for (m = 0; m < ALPROTO_MAX; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_app_data6[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", AppProtoToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } /* proto detect output */ { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_app_pd_data4[p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); fprintf(fp, "%-20s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s\n", "Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr); } for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_app_pd_data6[p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); fprintf(fp, "%-20s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s\n", "Proto detect", p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr); } } total = 0; for (m = 0; m < PROF_DETECT_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_detect_data4[m][p]; total += pd->tot; pd = &packet_profile_detect_data6[m][p]; total += pd->tot; } } fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s", "Log Thread Module", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot", "%%"); #ifdef PROFILE_LOCKING fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n", "locks", "ticks", "cont.", "cont.avg", "slocks", "sticks", "scont.", "scont.avg"); #else fprintf(fp, "\n"); #endif fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s %-3s", "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------", "---"); #ifdef PROFILE_LOCKING fprintf(fp, " %-10s %-10s %-12s %-12s %-10s %-10s %-12s %-12s\n", "--------", "--------", "----------", "-----------", "--------", "--------", "------------", "-----------"); #else fprintf(fp, "\n"); #endif total = 0; for (m = 0; m < TMM_SIZE; m++) { if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p]; total += pd->tot; pd = &packet_profile_tmm_data6[m][p]; total += pd->tot; } } for (m = 0; m < TMM_SIZE; m++) { if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data4[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f", TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); #ifdef PROFILE_LOCKING fprintf(fp, " %10.2f %12"PRIu64" %12"PRIu64" %10.2f %10.2f %12"PRIu64" %12"PRIu64" %10.2f\n", (float)pd->lock/pd->cnt, (uint64_t)pd->ticks/pd->cnt, pd->contention, (float)pd->contention/pd->cnt, (float)pd->slock/pd->cnt, (uint64_t)pd->sticks/pd->cnt, pd->scontention, (float)pd->scontention/pd->cnt); #else fprintf(fp, "\n"); #endif } } for (m = 0; m < TMM_SIZE; m++) { if (!(tmm_modules[m].flags & TM_FLAG_LOGAPI_TM)) continue; int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_tmm_data6[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %6.2f\n", TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } fprintf(fp, "\nLogger/output stats:\n"); total = 0; for (m = 0; m < LOGGER_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_log_data4[m][p]; total += pd->tot; pd = &packet_profile_log_data6[m][p]; total += pd->tot; } } fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n", "Logger", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot"); fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n", "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------"); for (m = 0; m < LOGGER_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_log_data4[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", PacketProfileLoggertIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } for (m = 0; m < LOGGER_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_log_data6[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", PacketProfileLoggertIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } DumpPrefilter(fp); fprintf(fp, "\nGeneral detection engine stats:\n"); total = 0; for (m = 0; m < PROF_DETECT_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_detect_data4[m][p]; total += pd->tot; pd = &packet_profile_detect_data6[m][p]; total += pd->tot; } } fprintf(fp, "\n%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n", "Detection phase", "IP ver", "Proto", "cnt", "min", "max", "avg", "tot"); fprintf(fp, "%-24s %-6s %-5s %-12s %-12s %-12s %-12s %-12s\n", "------------------------", "------", "-----", "----------", "------------", "------------", "-----------", "-----------"); for (m = 0; m < PROF_DETECT_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_detect_data4[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv4 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } for (m = 0; m < PROF_DETECT_SIZE; m++) { int p; for (p = 0; p < 257; p++) { SCProfilePacketData *pd = &packet_profile_detect_data6[m][p]; if (pd->cnt == 0) { continue; } FormatNumber(pd->tot, totalstr, sizeof(totalstr)); double percent = (long double)pd->tot / (long double)total * 100; fprintf(fp, "%-24s IPv6 %3d %12"PRIu64" %12"PRIu64" %12"PRIu64" %12"PRIu64" %12s %-6.2f\n", PacketProfileDetectIdToString(m), p, pd->cnt, pd->min, pd->max, (uint64_t)(pd->tot / pd->cnt), totalstr, percent); } } fclose(fp); } void SCProfilingPrintPacketProfile(Packet *p) { if (profiling_packets_csv_enabled == 0 || p == NULL || packet_profile_csv_fp == NULL || p->profile == NULL) { return; } uint64_t delta = p->profile->ticks_end - p->profile->ticks_start; fprintf(packet_profile_csv_fp, "%"PRIu64",%c,%"PRIu8",%"PRIu64",", p->pcap_cnt, PKT_IS_IPV4(p) ? '4' : (PKT_IS_IPV6(p) ? '6' : '?'), p->proto, delta); int i; uint64_t tmm_total = 0; for (i = 0; i < TMM_SIZE; i++) { PktProfilingTmmData *pdt = &p->profile->tmm[i]; uint64_t tmm_delta = pdt->ticks_end - pdt->ticks_start; fprintf(packet_profile_csv_fp, "%"PRIu64",", tmm_delta); tmm_total += tmm_delta; } fprintf(packet_profile_csv_fp, "%"PRIu64",", delta - tmm_total); uint64_t app_total = 0; for (i = 0; i < ALPROTO_MAX; i++) { PktProfilingAppData *pdt = &p->profile->app[i]; fprintf(packet_profile_csv_fp,"%"PRIu64",", pdt->ticks_spent); if (p->proto == IPPROTO_TCP) { app_total += pdt->ticks_spent; } } fprintf(packet_profile_csv_fp, "%"PRIu64",", p->profile->proto_detect); for (i = 0; i < PROF_DETECT_SIZE; i++) { PktProfilingDetectData *pdt = &p->profile->detect[i]; fprintf(packet_profile_csv_fp,"%"PRIu64",", pdt->ticks_spent); } fprintf(packet_profile_csv_fp,"\n"); } static void SCProfilingUpdatePacketDetectRecord(PacketProfileDetectId id, uint8_t ipproto, PktProfilingDetectData *pdt, int ipver) { if (pdt == NULL) { return; } SCProfilePacketData *pd; if (ipver == 4) pd = &packet_profile_detect_data4[id][ipproto]; else pd = &packet_profile_detect_data6[id][ipproto]; if (pd->min == 0 || pdt->ticks_spent < pd->min) { pd->min = pdt->ticks_spent; } if (pd->max < pdt->ticks_spent) { pd->max = pdt->ticks_spent; } pd->tot += pdt->ticks_spent; pd->cnt ++; } void SCProfilingUpdatePacketDetectRecords(Packet *p) { PacketProfileDetectId i; for (i = 0; i < PROF_DETECT_SIZE; i++) { PktProfilingDetectData *pdt = &p->profile->detect[i]; if (pdt->ticks_spent > 0) { if (PKT_IS_IPV4(p)) { SCProfilingUpdatePacketDetectRecord(i, p->proto, pdt, 4); } else { SCProfilingUpdatePacketDetectRecord(i, p->proto, pdt, 6); } } } } static void SCProfilingUpdatePacketAppPdRecord(uint8_t ipproto, uint32_t ticks_spent, int ipver) { SCProfilePacketData *pd; if (ipver == 4) pd = &packet_profile_app_pd_data4[ipproto]; else pd = &packet_profile_app_pd_data6[ipproto]; if (pd->min == 0 || ticks_spent < pd->min) { pd->min = ticks_spent; } if (pd->max < ticks_spent) { pd->max = ticks_spent; } pd->tot += ticks_spent; pd->cnt ++; } static void SCProfilingUpdatePacketAppRecord(int alproto, uint8_t ipproto, PktProfilingAppData *pdt, int ipver) { if (pdt == NULL) { return; } SCProfilePacketData *pd; if (ipver == 4) pd = &packet_profile_app_data4[alproto][ipproto]; else pd = &packet_profile_app_data6[alproto][ipproto]; if (pd->min == 0 || pdt->ticks_spent < pd->min) { pd->min = pdt->ticks_spent; } if (pd->max < pdt->ticks_spent) { pd->max = pdt->ticks_spent; } pd->tot += pdt->ticks_spent; pd->cnt ++; } void SCProfilingUpdatePacketAppRecords(Packet *p) { int i; for (i = 0; i < ALPROTO_MAX; i++) { PktProfilingAppData *pdt = &p->profile->app[i]; if (pdt->ticks_spent > 0) { if (PKT_IS_IPV4(p)) { SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 4); } else { SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 6); } } } if (p->profile->proto_detect > 0) { if (PKT_IS_IPV4(p)) { SCProfilingUpdatePacketAppPdRecord(p->proto, p->profile->proto_detect, 4); } else { SCProfilingUpdatePacketAppPdRecord(p->proto, p->profile->proto_detect, 6); } } } void SCProfilingUpdatePacketTmmRecord(int module, uint8_t proto, PktProfilingTmmData *pdt, int ipver) { if (pdt == NULL) { return; } SCProfilePacketData *pd; if (ipver == 4) pd = &packet_profile_tmm_data4[module][proto]; else pd = &packet_profile_tmm_data6[module][proto]; uint32_t delta = (uint32_t)pdt->ticks_end - pdt->ticks_start; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += (uint64_t)delta; pd->cnt ++; #ifdef PROFILE_LOCKING pd->lock += pdt->mutex_lock_cnt; pd->ticks += pdt->mutex_lock_wait_ticks; pd->contention += pdt->mutex_lock_contention; pd->slock += pdt->spin_lock_cnt; pd->sticks += pdt->spin_lock_wait_ticks; pd->scontention += pdt->spin_lock_contention; #endif } void SCProfilingUpdatePacketTmmRecords(Packet *p) { int i; for (i = 0; i < TMM_SIZE; i++) { PktProfilingTmmData *pdt = &p->profile->tmm[i]; if (pdt->ticks_start == 0 || pdt->ticks_end == 0 || pdt->ticks_start > pdt->ticks_end) { continue; } if (PKT_IS_IPV4(p)) { SCProfilingUpdatePacketTmmRecord(i, p->proto, pdt, 4); } else { SCProfilingUpdatePacketTmmRecord(i, p->proto, pdt, 6); } } } static inline void SCProfilingUpdatePacketGenericRecord(PktProfilingData *pdt, SCProfilePacketData *pd) { if (pdt == NULL || pd == NULL) { return; } uint64_t delta = pdt->ticks_end - pdt->ticks_start; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += delta; pd->cnt ++; } static void SCProfilingUpdatePacketGenericRecords(Packet *p, PktProfilingData *pd, struct ProfileProtoRecords *records, int size) { int i; for (i = 0; i < size; i++) { PktProfilingData *pdt = &pd[i]; if (pdt->ticks_start == 0 || pdt->ticks_end == 0 || pdt->ticks_start > pdt->ticks_end) { continue; } struct ProfileProtoRecords *r = &records[i]; SCProfilePacketData *store = NULL; if (PKT_IS_IPV4(p)) { store = &(r->records4[p->proto]); } else { store = &(r->records6[p->proto]); } SCProfilingUpdatePacketGenericRecord(pdt, store); } } static void SCProfilingUpdatePacketLogRecord(LoggerId id, uint8_t ipproto, PktProfilingLoggerData *pdt, int ipver) { if (pdt == NULL) { return; } SCProfilePacketData *pd; if (ipver == 4) pd = &packet_profile_log_data4[id][ipproto]; else pd = &packet_profile_log_data6[id][ipproto]; if (pd->min == 0 || pdt->ticks_spent < pd->min) { pd->min = pdt->ticks_spent; } if (pd->max < pdt->ticks_spent) { pd->max = pdt->ticks_spent; } pd->tot += pdt->ticks_spent; pd->cnt++; } static void SCProfilingUpdatePacketLogRecords(Packet *p) { for (LoggerId i = 0; i < LOGGER_SIZE; i++) { PktProfilingLoggerData *pdt = &p->profile->logger[i]; if (pdt->ticks_spent > 0) { if (PKT_IS_IPV4(p)) { SCProfilingUpdatePacketLogRecord(i, p->proto, pdt, 4); } else { SCProfilingUpdatePacketLogRecord(i, p->proto, pdt, 6); } } } } void SCProfilingAddPacket(Packet *p) { if (p == NULL || p->profile == NULL || p->profile->ticks_start == 0 || p->profile->ticks_end == 0 || p->profile->ticks_start > p->profile->ticks_end) return; pthread_mutex_lock(&packet_profile_lock); { if (profiling_packets_csv_enabled) SCProfilingPrintPacketProfile(p); if (PKT_IS_IPV4(p)) { SCProfilePacketData *pd = &packet_profile_data4[p->proto]; uint64_t delta = p->profile->ticks_end - p->profile->ticks_start; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += delta; pd->cnt ++; if (IS_TUNNEL_PKT(p)) { pd = &packet_profile_data4[256]; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += delta; pd->cnt ++; } SCProfilingUpdatePacketGenericRecords(p, p->profile->flowworker, packet_profile_flowworker_data, PROFILE_FLOWWORKER_SIZE); SCProfilingUpdatePacketTmmRecords(p); SCProfilingUpdatePacketAppRecords(p); SCProfilingUpdatePacketDetectRecords(p); SCProfilingUpdatePacketLogRecords(p); } else if (PKT_IS_IPV6(p)) { SCProfilePacketData *pd = &packet_profile_data6[p->proto]; uint64_t delta = p->profile->ticks_end - p->profile->ticks_start; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += delta; pd->cnt ++; if (IS_TUNNEL_PKT(p)) { pd = &packet_profile_data6[256]; if (pd->min == 0 || delta < pd->min) { pd->min = delta; } if (pd->max < delta) { pd->max = delta; } pd->tot += delta; pd->cnt ++; } SCProfilingUpdatePacketGenericRecords(p, p->profile->flowworker, packet_profile_flowworker_data, PROFILE_FLOWWORKER_SIZE); SCProfilingUpdatePacketTmmRecords(p); SCProfilingUpdatePacketAppRecords(p); SCProfilingUpdatePacketDetectRecords(p); SCProfilingUpdatePacketLogRecords(p); } SCProfilingUpdatePrefilterRecords(p); } pthread_mutex_unlock(&packet_profile_lock); } PktProfiling *SCProfilePacketStart(void) { uint64_t sample = SC_ATOMIC_ADD(samples, 1); if (sample % rate == 0) return SCCalloc(1, sizeof(PktProfiling)); else return NULL; } /* see if we want to profile rules for this packet */ int SCProfileRuleStart(Packet *p) { #ifdef PROFILE_LOCKING if (p->profile != NULL) { p->flags |= PKT_PROFILE; return 1; } #else uint64_t sample = SC_ATOMIC_ADD(samples, 1); if (sample % rate == 0) { p->flags |= PKT_PROFILE; return 1; } #endif return 0; } #define CASE_CODE(E) case E: return #E /** * \brief Maps the PacketProfileDetectId, to its string equivalent * * \param id PacketProfileDetectId id * * \retval string equivalent for the PacketProfileDetectId id */ const char * PacketProfileDetectIdToString(PacketProfileDetectId id) { switch (id) { CASE_CODE (PROF_DETECT_IPONLY); CASE_CODE (PROF_DETECT_RULES); CASE_CODE (PROF_DETECT_PREFILTER); CASE_CODE (PROF_DETECT_PF_PKT); CASE_CODE (PROF_DETECT_PF_PAYLOAD); CASE_CODE (PROF_DETECT_PF_TX); CASE_CODE (PROF_DETECT_PF_SORT1); CASE_CODE (PROF_DETECT_PF_SORT2); CASE_CODE (PROF_DETECT_STATEFUL); CASE_CODE (PROF_DETECT_ALERT); CASE_CODE (PROF_DETECT_CLEANUP); CASE_CODE (PROF_DETECT_GETSGH); CASE_CODE (PROF_DETECT_NONMPMLIST); default: return "UNKNOWN"; } } /** * \brief Maps the LoggerId's to its string equivalent for profiling output. * * \param id LoggerId id * * \retval string equivalent for the LoggerId id */ const char * PacketProfileLoggertIdToString(LoggerId id) { switch (id) { CASE_CODE (LOGGER_UNDEFINED); CASE_CODE (LOGGER_ALERT_DEBUG); CASE_CODE (LOGGER_ALERT_FAST); CASE_CODE (LOGGER_UNIFIED2); CASE_CODE (LOGGER_ALERT_SYSLOG); CASE_CODE (LOGGER_DROP); CASE_CODE (LOGGER_JSON_ALERT); CASE_CODE (LOGGER_JSON_DROP); CASE_CODE (LOGGER_JSON_SSH); CASE_CODE (LOGGER_DNS); CASE_CODE (LOGGER_HTTP); CASE_CODE (LOGGER_JSON_DNS); CASE_CODE (LOGGER_JSON_HTTP); CASE_CODE (LOGGER_JSON_SMTP); CASE_CODE (LOGGER_JSON_TLS); CASE_CODE (LOGGER_JSON_TEMPLATE); CASE_CODE (LOGGER_TLS_STORE); CASE_CODE (LOGGER_TLS); CASE_CODE (LOGGER_FILE); CASE_CODE (LOGGER_FILE_STORE); CASE_CODE (LOGGER_JSON_FILE); CASE_CODE (LOGGER_TCP_DATA); CASE_CODE (LOGGER_JSON_FLOW); CASE_CODE (LOGGER_JSON_NETFLOW); CASE_CODE (LOGGER_STATS); CASE_CODE (LOGGER_JSON_STATS); CASE_CODE (LOGGER_PRELUDE); CASE_CODE (LOGGER_PCAP); default: return "UNKNOWN"; } } #ifdef UNITTESTS static int ProfilingGenericTicksTest01(void) { #define TEST_RUNS 1024 uint64_t ticks_start = 0; uint64_t ticks_end = 0; void *ptr[TEST_RUNS]; int i; ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { ptr[i] = SCMalloc(1024); } ticks_end = UtilCpuGetTicks(); printf("malloc(1024) %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCFree(ptr[i]); } ticks_end = UtilCpuGetTicks(); printf("SCFree(1024) %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); SCMutex m[TEST_RUNS]; ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCMutexInit(&m[i], NULL); } ticks_end = UtilCpuGetTicks(); printf("SCMutexInit() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCMutexLock(&m[i]); } ticks_end = UtilCpuGetTicks(); printf("SCMutexLock() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCMutexUnlock(&m[i]); } ticks_end = UtilCpuGetTicks(); printf("SCMutexUnlock() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCMutexDestroy(&m[i]); } ticks_end = UtilCpuGetTicks(); printf("SCMutexDestroy() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); SCSpinlock s[TEST_RUNS]; ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCSpinInit(&s[i], 0); } ticks_end = UtilCpuGetTicks(); printf("SCSpinInit() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCSpinLock(&s[i]); } ticks_end = UtilCpuGetTicks(); printf("SCSpinLock() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCSpinUnlock(&s[i]); } ticks_end = UtilCpuGetTicks(); printf("SCSpinUnlock() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SCSpinDestroy(&s[i]); } ticks_end = UtilCpuGetTicks(); printf("SCSpinDestroy() %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); SC_ATOMIC_DECL_AND_INIT(unsigned int, test); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { (void) SC_ATOMIC_ADD(test,1); } ticks_end = UtilCpuGetTicks(); printf("SC_ATOMIC_ADD %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); ticks_start = UtilCpuGetTicks(); for (i = 0; i < TEST_RUNS; i++) { SC_ATOMIC_CAS(&test,i,i+1); } ticks_end = UtilCpuGetTicks(); printf("SC_ATOMIC_CAS %"PRIu64"\n", (ticks_end - ticks_start)/TEST_RUNS); return 1; } #endif /* UNITTESTS */ void SCProfilingRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ProfilingGenericTicksTest01", ProfilingGenericTicksTest01); #endif /* UNITTESTS */ } #endif /* PROFILING */ suricata-3.2.1/src/decode-icmpv6.h0000644000000000000000000002106013051004444013576 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_ICMPV6_H__ #define __DECODE_ICMPV6_H__ #include "decode-tcp.h" #include "decode-sctp.h" #include "decode-udp.h" #include "decode-ipv6.h" #define ICMPV6_HEADER_LEN 8 #define ICMPV6_HEADER_PKT_OFFSET 8 /** ICMPV6 Message Types: */ /** Error Messages: (type <128) */ #define ICMP6_DST_UNREACH 1 #define ICMP6_PACKET_TOO_BIG 2 #define ICMP6_TIME_EXCEEDED 3 #define ICMP6_PARAM_PROB 4 /** Informational Messages (type>=128) */ #define ICMP6_ECHO_REQUEST 128 #define ICMP6_ECHO_REPLY 129 #define MLD_LISTENER_QUERY 130 #define MLD_LISTENER_REPORT 131 #define MLD_LISTENER_REDUCTION 132 #define ND_ROUTER_SOLICIT 133 #define ND_ROUTER_ADVERT 134 #define ND_NEIGHBOR_SOLICIT 135 #define ND_NEIGHBOR_ADVERT 136 #define ND_REDIRECT 137 #define ICMP6_RR 138 #define ICMP6_NI_QUERY 139 #define ICMP6_NI_REPLY 140 #define ND_INVERSE_SOLICIT 141 #define ND_INVERSE_ADVERT 142 #define MLD_V2_LIST_REPORT 143 #define HOME_AGENT_AD_REQUEST 144 #define HOME_AGENT_AD_REPLY 145 #define MOBILE_PREFIX_SOLICIT 146 #define MOBILE_PREFIX_ADVERT 147 #define CERT_PATH_SOLICIT 148 #define CERT_PATH_ADVERT 149 #define ICMP6_MOBILE_EXPERIMENTAL 150 #define MC_ROUTER_ADVERT 151 #define MC_ROUTER_SOLICIT 152 #define MC_ROUTER_TERMINATE 153 #define FMIPV6_MSG 154 #define RPL_CONTROL_MSG 155 #define LOCATOR_UDATE_MSG 156 #define DUPL_ADDR_REQUEST 157 #define DUPL_ADDR_CONFIRM 158 #define MPL_CONTROL_MSG 159 /** Destination Unreachable Message (type=1) Code: */ #define ICMP6_DST_UNREACH_NOROUTE 0 /* no route to destination */ #define ICMP6_DST_UNREACH_ADMIN 1 /* communication with destination */ /* administratively prohibited */ #define ICMP6_DST_UNREACH_BEYONDSCOPE 2 /* beyond scope of source address */ #define ICMP6_DST_UNREACH_ADDR 3 /* address unreachable */ #define ICMP6_DST_UNREACH_NOPORT 4 /* bad port */ #define ICMP6_DST_UNREACH_FAILEDPOLICY 5 /* Source address failed ingress/egress policy */ #define ICMP6_DST_UNREACH_REJECTROUTE 6 /* Reject route to destination */ /** Time Exceeded Message (type=3) Code: */ #define ICMP6_TIME_EXCEED_TRANSIT 0 /* Hop Limit == 0 in transit */ #define ICMP6_TIME_EXCEED_REASSEMBLY 1 /* Reassembly time out */ /** Parameter Problem Message (type=4) Code: */ #define ICMP6_PARAMPROB_HEADER 0 /* erroneous header field */ #define ICMP6_PARAMPROB_NEXTHEADER 1 /* unrecognized Next Header */ #define ICMP6_PARAMPROB_OPTION 2 /* unrecognized IPv6 option */ /** macro for icmpv6 "type" access */ #define ICMPV6_GET_TYPE(p) (p)->icmpv6h->type /** macro for icmpv6 "code" access */ #define ICMPV6_GET_CODE(p) (p)->icmpv6h->code /** macro for icmpv6 "csum" access */ #define ICMPV6_GET_RAW_CSUM(p) ntohs((p)->icmpv6h->csum) #define ICMPV6_GET_CSUM(p) (p)->icmpv6h->csum /** If message is informational */ /** macro for icmpv6 "id" access */ #define ICMPV6_GET_ID(p) (p)->icmpv6vars.id /** macro for icmpv6 "seq" access */ #define ICMPV6_GET_SEQ(p) (p)->icmpv6vars.seq /** If message is Error */ /** macro for icmpv6 "unused" access */ #define ICMPV6_GET_UNUSED(p) (p)->icmpv6h->icmpv6b.icmpv6e.unused /** macro for icmpv6 "error_ptr" access */ #define ICMPV6_GET_ERROR_PTR(p) (p)->icmpv6h->icmpv6b.icmpv6e.error_ptr /** macro for icmpv6 "mtu" access */ #define ICMPV6_GET_MTU(p) (p)->icmpv6h->icmpv6b.icmpv6e.mtu /** macro for icmpv6 embedded "protocol" access */ #define ICMPV6_GET_EMB_PROTO(p) (p)->icmpv6vars.emb_ip6_proto_next /** macro for icmpv6 embedded "ipv6h" header access */ #define ICMPV6_GET_EMB_IPV6(p) (p)->icmpv6vars.emb_ipv6h /** macro for icmpv6 embedded "tcph" header access */ #define ICMPV6_GET_EMB_TCP(p) (p)->icmpv6vars.emb_tcph /** macro for icmpv6 embedded "udph" header access */ #define ICMPV6_GET_EMB_UDP(p) (p)->icmpv6vars.emb_udph /** macro for icmpv6 embedded "icmpv6h" header access */ #define ICMPV6_GET_EMB_icmpv6h(p) (p)->icmpv6vars.emb_icmpv6h typedef struct ICMPV6Info_ { uint16_t id; uint16_t seq; } ICMPV6Info; /** ICMPv6 header structure */ typedef struct ICMPV6Hdr_ { uint8_t type; uint8_t code; uint16_t csum; union { ICMPV6Info icmpv6i; /** Informational message */ union { uint32_t unused; /** for types 1 and 3, should be zero */ uint32_t error_ptr; /** for type 4, pointer to the octet that originate the error */ uint32_t mtu; /** for type 2, the Maximum Transmission Unit of the next-hop link */ } icmpv6e; /** Error Message */ } icmpv6b; } ICMPV6Hdr; /** Data available from the decoded packet */ typedef struct ICMPV6Vars_ { /* checksum of the icmpv6 packet */ uint16_t id; uint16_t seq; uint32_t mtu; uint32_t error_ptr; /** Pointers to the embedded packet headers */ IPV6Hdr *emb_ipv6h; TCPHdr *emb_tcph; UDPHdr *emb_udph; ICMPV6Hdr *emb_icmpv6h; /** IPv6 src and dst address */ uint32_t emb_ip6_src[4]; uint32_t emb_ip6_dst[4]; uint8_t emb_ip6_proto_next; /** TCP/UDP ports */ uint16_t emb_sport; uint16_t emb_dport; } ICMPV6Vars; #define CLEAR_ICMPV6_PACKET(p) do { \ (p)->level4_comp_csum = -1; \ PACKET_CLEAR_L4VARS((p)); \ (p)->icmpv6h = NULL; \ } while(0) void DecodeICMPV6RegisterTests(void); /** -------- Inline functions --------- */ static inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); /** * \brief Calculates the checksum for the ICMPV6 packet * * \param shdr Pointer to source address field from the IPV6 packet. Used as a * part of the psuedoheader for computing the checksum * \param pkt Pointer to the start of the ICMPV6 packet * \param tlen Total length of the ICMPV6 packet(header + payload) * * \retval csum Checksum for the ICMPV6 packet */ static inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = shdr[0]; csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + shdr[13] + shdr[14] + shdr[15] + htons(58 + tlen); csum += pkt[0]; tlen -= 4; pkt += 2; while (tlen >= 64) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19] + pkt[20] + pkt[21] + pkt[22] + pkt[23] + pkt[24] + pkt[25] + pkt[26] + pkt[27] + pkt[28] + pkt[29] + pkt[30] + pkt[31]; tlen -= 64; pkt += 32; } while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; tlen -= 2; pkt += 1; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); return (uint16_t) ~csum; } #endif /* __DECODE_ICMPV6_H__ */ suricata-3.2.1/src/detect-bytetest.h0000644000000000000000000001164413051004444014271 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_BYTETEST_H__ #define __DETECT_BYTETEST_H__ /** Bytetest Operators */ #define DETECT_BYTETEST_OP_LT 1 /**< "less than" operator */ #define DETECT_BYTETEST_OP_GT 2 /**< "greater than" operator */ #define DETECT_BYTETEST_OP_EQ 3 /**< "equals" operator */ #define DETECT_BYTETEST_OP_AND 4 /**< "bitwise and" operator */ #define DETECT_BYTETEST_OP_OR 5 /**< "bitwise or" operator */ #define DETECT_BYTETEST_OP_GE 6 /**< greater than equal operator */ #define DETECT_BYTETEST_OP_LE 7 /**< less than equal operator */ /** Bytetest Base */ #define DETECT_BYTETEST_BASE_UNSET 0 /**< Unset type value string (automatic)*/ #define DETECT_BYTETEST_BASE_OCT 8 /**< "oct" type value string */ #define DETECT_BYTETEST_BASE_DEC 10 /**< "dec" type value string */ #define DETECT_BYTETEST_BASE_HEX 16 /**< "hex" type value string */ /** Bytetest Flags */ #define DETECT_BYTETEST_NEGOP 0x01 /**< "!" negated operator */ #define DETECT_BYTETEST_LITTLE 0x02 /**< "little" endian value */ #define DETECT_BYTETEST_BIG 0x04 /**< "bi" endian value */ #define DETECT_BYTETEST_STRING 0x08 /**< "string" value */ #define DETECT_BYTETEST_RELATIVE 0x10 /**< "relative" offset */ #define DETECT_BYTETEST_DCE 0x20 /**< dce enabled */ #define DETECT_BYTETEST_VALUE_BE 0x40 /**< byte extract value enabled */ #define DETECT_BYTETEST_OFFSET_BE 0x80 /**< byte extract value enabled */ typedef struct DetectBytetestData_ { uint8_t nbytes; /**< Number of bytes to compare */ uint8_t op; /**< Operator used to compare */ uint8_t base; /**< String value base (oct|dec|hex) */ uint8_t flags; /**< Flags (big|little|relative|string) */ int32_t offset; /**< Offset in payload */ uint64_t value; /**< Value to compare against */ } DetectBytetestData; /* prototypes */ /** * Registration function for byte_test. * * \todo add support for no_stream and stream_only */ void DetectBytetestRegister (void); /** * This function is used to add the parsed byte_test data * into the current signature. * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ int DetectBytetestSetup(DetectEngineCtx *, Signature *, char *); /** * \brief this function will free memory associated with DetectBytetestData * * \param data pointer to DetectBytetestData */ void DetectBytetestFree(void *ptr); /** * This function is used to parse byte_test options passed via * * byte_test: bytes, [!]op, value, offset [,flags [, ...]] * * flags: "big", "little", "relative", "string", "oct", "dec", "hex" * * \param optstr Pointer to the user provided byte_test options * \param value Used to pass the value back, if byte_test uses a byte_extract * var. * \param offset Used to pass the offset back, if byte_test uses a byte_extract * var. * * \retval data pointer to DetectBytetestData on success * \retval NULL on failure */ DetectBytetestData *DetectBytetestParse(char *optstr, char **value, char **offset); /** * This function is used to match byte_test * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectBytetestData * * \retval -1 error * \retval 0 no match * \retval 1 match * * \todo The return seems backwards. We should return a non-zero error code. One of the error codes is "no match". As-is if someone accidentally does: if (DetectBytetestMatch(...)) { match }, then they catch an error as a match. */ int DetectBytetestMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx); int DetectBytetestDoMatch(DetectEngineThreadCtx *, Signature *, const SigMatchCtx *ctx, uint8_t *, uint32_t, uint8_t, int32_t, uint64_t); #endif /* __DETECT_BYTETEST_H__ */ suricata-3.2.1/src/detect-ipopts.h0000644000000000000000000000240413051004444013736 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_IPOPTS_H__ #define __DETECT_IPOPTS_H__ #include "decode-events.h" #include "decode-ipv4.h" /** * \struct DetectIpOptsData_ * DetectIpOptsData_ is used to store ipopts: input value */ /** * \typedef DetectIpOptsData * A typedef for DetectIpOptsData_ */ typedef struct DetectIpOptsData_ { uint16_t ipopt; /**< ip option flag */ } DetectIpOptsData; /** * Registration function for ipopts: keyword */ void DetectIpOptsRegister (void); #endif /*__DETECT_IPOPTS_H__ */ suricata-3.2.1/src/detect-ack.h0000644000000000000000000000210113051004444013150 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_ACK_H__ #define __DETECT_ACK_H__ /** * \brief ack data */ typedef struct DetectAckData_ { uint32_t ack; /**< ack to match */ } DetectAckData; /** * \brief Registration function for ack: keyword */ void DetectAckRegister(void); #endif /* __DETECT_ACK_H__ */ suricata-3.2.1/src/unix-manager.c0000644000000000000000000007552013051004444013551 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #include "suricata-common.h" #include "suricata.h" #include "unix-manager.h" #include "detect-engine.h" #include "tm-threads.h" #include "runmodes.h" #include "conf.h" #include "util-privs.h" #include "util-debug.h" #include "util-device.h" #include "util-signal.h" #include "util-buffer.h" #include #include #include #ifdef BUILD_UNIX_SOCKET #include #include "output-json.h" // MSG_NOSIGNAL does not exists on OS X #ifdef OS_DARWIN # ifndef MSG_NOSIGNAL # define MSG_NOSIGNAL SO_NOSIGPIPE # endif #endif #define SOCKET_PATH LOCAL_STATE_DIR "/run/suricata/" #define SOCKET_FILENAME "suricata-command.socket" #define SOCKET_TARGET SOCKET_PATH SOCKET_FILENAME typedef struct Command_ { char *name; TmEcode (*Func)(json_t *, json_t *, void *); void *data; int flags; TAILQ_ENTRY(Command_) next; } Command; typedef struct Task_ { TmEcode (*Func)(void *); void *data; TAILQ_ENTRY(Task_) next; } Task; #define CLIENT_BUFFER_SIZE 4096 typedef struct UnixClient_ { int fd; MemBuffer *mbuf; /**< buffer for response construction */ TAILQ_ENTRY(UnixClient_) next; } UnixClient; typedef struct UnixCommand_ { time_t start_timestamp; int socket; struct sockaddr_un client_addr; int select_max; TAILQ_HEAD(, Command_) commands; TAILQ_HEAD(, Task_) tasks; TAILQ_HEAD(, UnixClient_) clients; } UnixCommand; /** * \brief Create a command unix socket on system * * \retval 0 in case of error, 1 in case of success */ int UnixNew(UnixCommand * this) { struct sockaddr_un addr; int len; int ret; int on = 1; char sockettarget[PATH_MAX]; char *socketname; this->start_timestamp = time(NULL); this->socket = -1; this->select_max = 0; TAILQ_INIT(&this->commands); TAILQ_INIT(&this->tasks); TAILQ_INIT(&this->clients); int check_dir = 0; if (ConfGet("unix-command.filename", &socketname) == 1) { if (PathIsAbsolute(socketname)) { strlcpy(sockettarget, socketname, sizeof(sockettarget)); } else { snprintf(sockettarget, sizeof(sockettarget), "%s/%s", SOCKET_PATH, socketname); check_dir = 1; } } else { strlcpy(sockettarget, SOCKET_TARGET, sizeof(sockettarget)); check_dir = 1; } SCLogInfo("Using unix socket file '%s'", sockettarget); if (check_dir) { struct stat stat_buf; /* coverity[toctou] */ if (stat(SOCKET_PATH, &stat_buf) != 0) { /* coverity[toctou] */ ret = mkdir(SOCKET_PATH, S_IRWXU|S_IXGRP|S_IRGRP); if (ret != 0) { int err = errno; if (err != EEXIST) { SCLogError(SC_ERR_INITIALIZATION, "Cannot create socket directory %s: %s", SOCKET_PATH, strerror(err)); return 0; } } else { SCLogInfo("Created socket directory %s", SOCKET_PATH); } } } /* Remove socket file */ (void) unlink(sockettarget); /* set address */ addr.sun_family = AF_UNIX; strlcpy(addr.sun_path, sockettarget, sizeof(addr.sun_path)); addr.sun_path[sizeof(addr.sun_path) - 1] = 0; len = strlen(addr.sun_path) + sizeof(addr.sun_family) + 1; /* create socket */ this->socket = socket(AF_UNIX, SOCK_STREAM, 0); if (this->socket == -1) { SCLogWarning(SC_ERR_OPENING_FILE, "Unix Socket: unable to create UNIX socket %s: %s", addr.sun_path, strerror(errno)); return 0; } this->select_max = this->socket + 1; #if !(defined OS_FREEBSD || defined __OpenBSD__) /* Set file mode: will not fully work on most system, the group * permission is not changed on some Linux. *BSD won't do the * chmod: it returns EINVAL when calling fchmod on sockets. */ ret = fchmod(this->socket, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP); if (ret == -1) { int err = errno; SCLogWarning(SC_ERR_INITIALIZATION, "Unable to change permission on socket: %s (%d)", strerror(err), err); } #endif /* set reuse option */ ret = setsockopt(this->socket, SOL_SOCKET, SO_REUSEADDR, (char *) &on, sizeof(on)); if ( ret != 0 ) { SCLogWarning(SC_ERR_INITIALIZATION, "Cannot set sockets options: %s.", strerror(errno)); } /* bind socket */ ret = bind(this->socket, (struct sockaddr *) &addr, len); if (ret == -1) { SCLogWarning(SC_ERR_INITIALIZATION, "Unix socket: UNIX socket bind(%s) error: %s", sockettarget, strerror(errno)); return 0; } /* listen */ if (listen(this->socket, 1) == -1) { SCLogWarning(SC_ERR_INITIALIZATION, "Command server: UNIX socket listen() error: %s", strerror(errno)); return 0; } return 1; } void UnixCommandSetMaxFD(UnixCommand *this) { UnixClient *item; if (this == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Unix command is NULL, warn devel"); return; } this->select_max = this->socket + 1; TAILQ_FOREACH(item, &this->clients, next) { if (item->fd >= this->select_max) { this->select_max = item->fd + 1; } } } static UnixClient *UnixClientAlloc(void) { UnixClient *uclient = SCMalloc(sizeof(UnixClient)); if (unlikely(uclient == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate new client"); return NULL; } uclient->mbuf = MemBufferCreateNew(CLIENT_BUFFER_SIZE); if (uclient->mbuf == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate new client send buffer"); SCFree(uclient); return NULL; } return uclient; } static void UnixClientFree(UnixClient *c) { if (c != NULL) { MemBufferFree(c->mbuf); SCFree(c); } } /** * \brief Close the unix socket */ void UnixCommandClose(UnixCommand *this, int fd) { UnixClient *item; int found = 0; TAILQ_FOREACH(item, &this->clients, next) { if (item->fd == fd) { found = 1; break; } } if (found == 0) { SCLogError(SC_ERR_INVALID_VALUE, "No fd found in client list"); return; } TAILQ_REMOVE(&this->clients, item, next); close(item->fd); UnixCommandSetMaxFD(this); UnixClientFree(item); } #define UNIX_PROTO_VERSION_LENGTH 200 #define UNIX_PROTO_VERSION "0.1" int UnixCommandSendJSONToClient(UnixClient *client, json_t *js) { MemBufferReset(client->mbuf); OutputJSONMemBufferWrapper wrapper = { .buffer = &client->mbuf, .expand_by = CLIENT_BUFFER_SIZE }; int r = json_dump_callback(js, OutputJSONMemBufferCallback, &wrapper, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); if (r != 0) { SCLogWarning(SC_ERR_SOCKET, "unable to serialize JSON object"); return -1; } if (send(client->fd, (const char *)MEMBUFFER_BUFFER(client->mbuf), MEMBUFFER_OFFSET(client->mbuf), MSG_NOSIGNAL) == -1) { SCLogWarning(SC_ERR_SOCKET, "unable to send block of size " "%"PRIuMAX": %s", (uintmax_t)MEMBUFFER_OFFSET(client->mbuf), strerror(errno)); return -1; } SCLogDebug("sent message of size %"PRIuMAX" to client socket %d", (uintmax_t)MEMBUFFER_OFFSET(client->mbuf), client->fd); return 0; } /** * \brief Accept a new client on unix socket * * The function is called when a new user is detected * in UnixMain(). It does the initial protocol negotiation * with client. * * \retval 0 in case of error, 1 in case of success */ int UnixCommandAccept(UnixCommand *this) { char buffer[UNIX_PROTO_VERSION_LENGTH + 1]; json_t *client_msg; json_t *server_msg; json_t *version; json_error_t jerror; int client; int ret; UnixClient *uclient = NULL; /* accept client socket */ socklen_t len = sizeof(this->client_addr); client = accept(this->socket, (struct sockaddr *) &this->client_addr, &len); if (client < 0) { SCLogInfo("Unix socket: accept() error: %s", strerror(errno)); return 0; } SCLogDebug("Unix socket: client connection"); /* read client version */ buffer[sizeof(buffer)-1] = 0; ret = recv(client, buffer, sizeof(buffer)-1, 0); if (ret < 0) { SCLogInfo("Command server: client doesn't send version"); close(client); return 0; } if (ret >= (int)(sizeof(buffer)-1)) { SCLogInfo("Command server: client message is too long, " "disconnect him."); close(client); return 0; } buffer[ret] = 0; client_msg = json_loads(buffer, 0, &jerror); if (client_msg == NULL) { SCLogInfo("Invalid command, error on line %d: %s\n", jerror.line, jerror.text); close(client); return 0; } version = json_object_get(client_msg, "version"); if (!json_is_string(version)) { SCLogInfo("error: version is not a string"); close(client); json_decref(client_msg); return 0; } /* check client version */ if (strcmp(json_string_value(version), UNIX_PROTO_VERSION) != 0) { SCLogInfo("Unix socket: invalid client version: \"%s\"", json_string_value(version)); json_decref(client_msg); close(client); return 0; } else { SCLogDebug("Unix socket: client version: \"%s\"", json_string_value(version)); } json_decref(client_msg); /* send answer */ server_msg = json_object(); if (server_msg == NULL) { close(client); return 0; } json_object_set_new(server_msg, "return", json_string("OK")); uclient = UnixClientAlloc(); if (unlikely(uclient == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate new client"); json_decref(server_msg); close(client); return 0; } uclient->fd = client; if (UnixCommandSendJSONToClient(uclient, server_msg) != 0) { SCLogWarning(SC_ERR_SOCKET, "Unable to send command"); UnixClientFree(uclient); json_decref(server_msg); close(client); return 0; } json_decref(server_msg); /* client connected */ SCLogDebug("Unix socket: client connected"); TAILQ_INSERT_TAIL(&this->clients, uclient, next); UnixCommandSetMaxFD(this); return 1; } int UnixCommandBackgroundTasks(UnixCommand* this) { int ret = 1; Task *ltask; TAILQ_FOREACH(ltask, &this->tasks, next) { int fret = ltask->Func(ltask->data); if (fret != TM_ECODE_OK) { ret = 0; } } return ret; } /** * \brief Command dispatcher * * \param this a UnixCommand:: structure * \param command a string containing a json formatted * command * * \retval 0 in case of error, 1 in case of success */ int UnixCommandExecute(UnixCommand * this, char *command, UnixClient *client) { int ret = 1; json_error_t error; json_t *jsoncmd = NULL; json_t *cmd = NULL; json_t *server_msg = json_object(); const char * value; int found = 0; Command *lcmd; if (server_msg == NULL) { return 0; } jsoncmd = json_loads(command, 0, &error); if (jsoncmd == NULL) { SCLogInfo("Invalid command, error on line %d: %s\n", error.line, error.text); goto error; } cmd = json_object_get(jsoncmd, "command"); if(!json_is_string(cmd)) { SCLogInfo("error: command is not a string"); goto error_cmd; } value = json_string_value(cmd); TAILQ_FOREACH(lcmd, &this->commands, next) { if (!strcmp(value, lcmd->name)) { int fret = TM_ECODE_OK; found = 1; if (lcmd->flags & UNIX_CMD_TAKE_ARGS) { cmd = json_object_get(jsoncmd, "arguments"); if(!json_is_object(cmd)) { SCLogInfo("error: argument is not an object"); goto error_cmd; } } fret = lcmd->Func(cmd, server_msg, lcmd->data); if (fret != TM_ECODE_OK) { ret = 0; } break; } } if (found == 0) { json_object_set_new(server_msg, "message", json_string("Unknown command")); ret = 0; } switch (ret) { case 0: json_object_set_new(server_msg, "return", json_string("NOK")); break; case 1: json_object_set_new(server_msg, "return", json_string("OK")); break; } if (UnixCommandSendJSONToClient(client, server_msg) != 0) { goto error; } json_decref(jsoncmd); json_decref(server_msg); return ret; error_cmd: json_decref(jsoncmd); error: json_decref(server_msg); UnixCommandClose(this, client->fd); return 0; } void UnixCommandRun(UnixCommand * this, UnixClient *client) { char buffer[4096]; int ret; ret = recv(client->fd, buffer, sizeof(buffer) - 1, 0); if (ret <= 0) { if (ret == 0) { SCLogDebug("Unix socket: lost connection with client"); } else { SCLogError(SC_ERR_SOCKET, "Unix socket: error on recv() from client: %s", strerror(errno)); } UnixCommandClose(this, client->fd); return; } if (ret >= (int)(sizeof(buffer)-1)) { SCLogInfo("Command server: client command is too long, " "disconnect him."); UnixCommandClose(this, client->fd); } buffer[ret] = 0; UnixCommandExecute(this, buffer, client); } /** * \brief Select function * * \retval 0 in case of error, 1 in case of success */ int UnixMain(UnixCommand * this) { struct timeval tv; int ret; fd_set select_set; UnixClient *uclient; UnixClient *tclient; /* Wait activity on the socket */ FD_ZERO(&select_set); FD_SET(this->socket, &select_set); TAILQ_FOREACH(uclient, &this->clients, next) { FD_SET(uclient->fd, &select_set); } tv.tv_sec = 0; tv.tv_usec = 200 * 1000; ret = select(this->select_max, &select_set, NULL, NULL, &tv); /* catch select() error */ if (ret == -1) { /* Signal was caught: just ignore it */ if (errno == EINTR) { return 1; } SCLogError(SC_ERR_SOCKET, "Command server: select() fatal error: %s", strerror(errno)); return 0; } if (suricata_ctl_flags & SURICATA_STOP) { TAILQ_FOREACH_SAFE(uclient, &this->clients, next, tclient) { UnixCommandClose(this, uclient->fd); } return 1; } /* timeout: continue */ if (ret == 0) { return 1; } TAILQ_FOREACH_SAFE(uclient, &this->clients, next, tclient) { if (FD_ISSET(uclient->fd, &select_set)) { UnixCommandRun(this, uclient); } } if (FD_ISSET(this->socket, &select_set)) { if (!UnixCommandAccept(this)) return 1; } return 1; } /** * \brief Used to kill unix manager thread(s). * * \todo Kinda hackish since it uses the tv name to identify unix manager * thread. We need an all weather identification scheme. */ void UnixKillUnixManagerThread(void) { ThreadVars *tv = NULL; int cnt = 0; SCCtrlCondSignal(&unix_manager_ctrl_cond); SCMutexLock(&tv_root_lock); /* flow manager thread(s) is/are a part of mgmt threads */ tv = tv_root[TVT_CMD]; while (tv != NULL) { if (strcasecmp(tv->name, "UnixManagerThread") == 0) { TmThreadsSetFlag(tv, THV_KILL); TmThreadsSetFlag(tv, THV_DEINIT); /* be sure it has shut down */ while (!TmThreadsCheckFlag(tv, THV_CLOSED)) { usleep(100); } cnt++; } tv = tv->next; } /* not possible, unless someone decides to rename UnixManagerThread */ if (cnt == 0) { SCMutexUnlock(&tv_root_lock); abort(); } SCMutexUnlock(&tv_root_lock); return; } TmEcode UnixManagerShutdownCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); json_object_set_new(server_msg, "message", json_string("Closing Suricata")); EngineStop(); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerVersionCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); json_object_set_new(server_msg, "message", json_string( #ifdef REVISION PROG_VER " (rev " xstr(REVISION) ")" #elif defined RELEASE PROG_VER " RELEASE" #else PROG_VER #endif )); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerUptimeCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); int uptime; UnixCommand *ucmd = (UnixCommand *)data; uptime = time(NULL) - ucmd->start_timestamp; json_object_set_new(server_msg, "message", json_integer(uptime)); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerRunningModeCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); json_object_set_new(server_msg, "message", json_string(RunmodeGetActive())); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerCaptureModeCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); json_object_set_new(server_msg, "message", json_string(RunModeGetMainMode())); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerReloadRules(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); DetectEngineReloadStart(); while (DetectEngineReloadIsDone() == 0) usleep(100); json_object_set_new(server_msg, "message", json_string("done")); SCReturnInt(TM_ECODE_OK); } TmEcode UnixManagerConfGetCommand(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); char *confval = NULL; char *variable = NULL; json_t *jarg = json_object_get(cmd, "variable"); if(!json_is_string(jarg)) { SCLogInfo("error: variable is not a string"); json_object_set_new(server_msg, "message", json_string("variable is not a string")); SCReturnInt(TM_ECODE_FAILED); } variable = (char *)json_string_value(jarg); if (ConfGet(variable, &confval) != 1) { json_object_set_new(server_msg, "message", json_string("Unable to get value")); SCReturnInt(TM_ECODE_FAILED); } if (confval) { json_object_set_new(server_msg, "message", json_string(confval)); SCReturnInt(TM_ECODE_OK); } json_object_set_new(server_msg, "message", json_string("No string value")); SCReturnInt(TM_ECODE_FAILED); } TmEcode UnixManagerListCommand(json_t *cmd, json_t *answer, void *data) { SCEnter(); json_t *jdata; json_t *jarray; Command *lcmd = NULL; UnixCommand *gcmd = (UnixCommand *) data; int i = 0; jdata = json_object(); if (jdata == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } jarray = json_array(); if (jarray == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } TAILQ_FOREACH(lcmd, &gcmd->commands, next) { json_array_append_new(jarray, json_string(lcmd->name)); i++; } json_object_set_new(jdata, "count", json_integer(i)); json_object_set_new(jdata, "commands", jarray); json_object_set_new(answer, "message", jdata); SCReturnInt(TM_ECODE_OK); } #if 0 TmEcode UnixManagerReloadRules(json_t *cmd, json_t *server_msg, void *data) { SCEnter(); if (suricata_ctl_flags != 0) { json_object_set_new(server_msg, "message", json_string("Live rule swap no longer possible." " Engine in shutdown mode.")); SCReturn(TM_ECODE_FAILED); } else { /* FIXME : need to check option value */ UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2Idle); DetectEngineSpawnLiveRuleSwapMgmtThread(); json_object_set_new(server_msg, "message", json_string("Reloading rules")); } SCReturn(TM_ECODE_OK); } #endif static UnixCommand command; /** * \brief Add a command to the list of commands * * This function adds a command to the list of commands available * through the unix socket. * * When a command is received from user through the unix socket, the content * of 'Command' field in the JSON message is match against keyword, then the * Func is called. See UnixSocketAddPcapFile() for an example. * * \param keyword name of the command * \param Func function to run when command is received * \param data a pointer to data that are passed to Func when it is run * \param flags a flag now used to tune the command type * \retval TM_ECODE_OK in case of success, TM_ECODE_FAILED in case of failure */ TmEcode UnixManagerRegisterCommand(const char * keyword, TmEcode (*Func)(json_t *, json_t *, void *), void *data, int flags) { SCEnter(); Command *cmd = NULL; Command *lcmd = NULL; if (Func == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Null function"); SCReturnInt(TM_ECODE_FAILED); } if (keyword == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Null keyword"); SCReturnInt(TM_ECODE_FAILED); } TAILQ_FOREACH(lcmd, &command.commands, next) { if (!strcmp(keyword, lcmd->name)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s already registered", keyword); SCReturnInt(TM_ECODE_FAILED); } } cmd = SCMalloc(sizeof(Command)); if (unlikely(cmd == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't alloc cmd"); SCReturnInt(TM_ECODE_FAILED); } cmd->name = SCStrdup(keyword); if (unlikely(cmd->name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't alloc cmd name"); SCFree(cmd); SCReturnInt(TM_ECODE_FAILED); } cmd->Func = Func; cmd->data = data; cmd->flags = flags; /* Add it to the list */ TAILQ_INSERT_TAIL(&command.commands, cmd, next); SCReturnInt(TM_ECODE_OK); } /** * \brief Add a task to the list of tasks * * This function adds a task to run in the background. The task is run * each time the UnixMain() function exits from select. * * \param Func function to run when a command is received * \param data a pointer to data that are passed to Func when it is run * \retval TM_ECODE_OK in case of success, TM_ECODE_FAILED in case of failure */ TmEcode UnixManagerRegisterBackgroundTask(TmEcode (*Func)(void *), void *data) { SCEnter(); Task *task = NULL; if (Func == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Null function"); SCReturnInt(TM_ECODE_FAILED); } task = SCMalloc(sizeof(Task)); if (unlikely(task == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't alloc task"); SCReturnInt(TM_ECODE_FAILED); } task->Func = Func; task->data = data; /* Add it to the list */ TAILQ_INSERT_TAIL(&command.tasks, task, next); SCReturnInt(TM_ECODE_OK); } typedef struct UnixManagerThreadData_ { int padding; } UnixManagerThreadData; static TmEcode UnixManagerThreadInit(ThreadVars *t, void *initdata, void **data) { UnixManagerThreadData *utd = SCCalloc(1, sizeof(*utd)); if (utd == NULL) return TM_ECODE_FAILED; if (UnixNew(&command) == 0) { int failure_fatal = 0; if (ConfGetBool("engine.init-failure-fatal", &failure_fatal) != 1) { SCLogDebug("ConfGetBool could not load the value."); } SCFree(utd); if (failure_fatal) { SCLogError(SC_ERR_INITIALIZATION, "Unable to create unix command socket"); exit(EXIT_FAILURE); } else { SCLogWarning(SC_ERR_INITIALIZATION, "Unable to create unix command socket"); return TM_ECODE_OK; } } /* Init Unix socket */ UnixManagerRegisterCommand("shutdown", UnixManagerShutdownCommand, NULL, 0); UnixManagerRegisterCommand("command-list", UnixManagerListCommand, &command, 0); UnixManagerRegisterCommand("help", UnixManagerListCommand, &command, 0); UnixManagerRegisterCommand("version", UnixManagerVersionCommand, &command, 0); UnixManagerRegisterCommand("uptime", UnixManagerUptimeCommand, &command, 0); UnixManagerRegisterCommand("running-mode", UnixManagerRunningModeCommand, &command, 0); UnixManagerRegisterCommand("capture-mode", UnixManagerCaptureModeCommand, &command, 0); UnixManagerRegisterCommand("conf-get", UnixManagerConfGetCommand, &command, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("dump-counters", StatsOutputCounterSocket, NULL, 0); UnixManagerRegisterCommand("reload-rules", UnixManagerReloadRules, NULL, 0); UnixManagerRegisterCommand("register-tenant-handler", UnixSocketRegisterTenantHandler, &command, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("unregister-tenant-handler", UnixSocketUnregisterTenantHandler, &command, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("register-tenant", UnixSocketRegisterTenant, &command, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("reload-tenant", UnixSocketReloadTenant, &command, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("unregister-tenant", UnixSocketUnregisterTenant, &command, UNIX_CMD_TAKE_ARGS); *data = utd; return TM_ECODE_OK; } static TmEcode UnixManagerThreadDeinit(ThreadVars *t, void *data) { SCFree(data); return TM_ECODE_OK; } static TmEcode UnixManager(ThreadVars *th_v, void *thread_data) { int ret; /* set the thread name */ SCLogDebug("%s started...", th_v->name); StatsSetupPrivate(th_v); /* Set the threads capability */ th_v->cap_flags = 0; SCDropCaps(th_v); TmThreadsSetFlag(th_v, THV_INIT_DONE); while (1) { ret = UnixMain(&command); if (ret == 0) { SCLogError(SC_ERR_FATAL, "Fatal error on unix socket"); } if ((ret == 0) || (TmThreadsCheckFlag(th_v, THV_KILL))) { UnixClient *item; UnixClient *titem; TAILQ_FOREACH_SAFE(item, &(&command)->clients, next, titem) { close(item->fd); SCFree(item); } StatsSyncCounters(th_v); break; } UnixCommandBackgroundTasks(&command); } return TM_ECODE_OK; } /** \brief Spawn the unix socket manager thread * * \param mode if set to 1, init failure cause suricata exit * */ void UnixManagerThreadSpawn(int mode) { ThreadVars *tv_unixmgr = NULL; SCCtrlCondInit(&unix_manager_ctrl_cond, NULL); SCCtrlMutexInit(&unix_manager_ctrl_mutex, NULL); tv_unixmgr = TmThreadCreateCmdThreadByName(thread_name_unix_socket, "UnixManager", 0); if (tv_unixmgr == NULL) { SCLogError(SC_ERR_INITIALIZATION, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } if (TmThreadSpawn(tv_unixmgr) != TM_ECODE_OK) { SCLogError(SC_ERR_INITIALIZATION, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } if (mode == 1) { if (TmThreadsCheckFlag(tv_unixmgr, THV_RUNNING_DONE)) { SCLogError(SC_ERR_INITIALIZATION, "Unix socket init failed"); exit(EXIT_FAILURE); } } return; } // TODO can't think of a good name void UnixManagerThreadSpawnNonRunmode(void) { /* Spawn the unix socket manager thread */ int unix_socket = ConfUnixSocketIsEnable(); if (unix_socket == 1) { UnixManagerThreadSpawn(0); UnixManagerRegisterCommand("iface-stat", LiveDeviceIfaceStat, NULL, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("iface-list", LiveDeviceIfaceList, NULL, 0); } } /** * \brief Used to kill unix manager thread(s). * * \todo Kinda hackish since it uses the tv name to identify unix manager * thread. We need an all weather identification scheme. */ void UnixSocketKillSocketThread(void) { ThreadVars *tv = NULL; SCMutexLock(&tv_root_lock); /* unix manager thread(s) is/are a part of command threads */ tv = tv_root[TVT_CMD]; while (tv != NULL) { if (strcasecmp(tv->name, "UnixManagerThread") == 0) { /* If the thread dies during init it will have * THV_RUNNING_DONE set, so we can set the correct flag * and exit. */ if (TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { TmThreadsSetFlag(tv, THV_KILL); TmThreadsSetFlag(tv, THV_DEINIT); TmThreadsSetFlag(tv, THV_CLOSED); break; } TmThreadsSetFlag(tv, THV_KILL); TmThreadsSetFlag(tv, THV_DEINIT); /* Be sure it has shut down */ while (!TmThreadsCheckFlag(tv, THV_CLOSED)) { usleep(100); } } tv = tv->next; } SCMutexUnlock(&tv_root_lock); return; } #else /* BUILD_UNIX_SOCKET */ void UnixManagerThreadSpawn(int mode) { SCLogError(SC_ERR_UNIMPLEMENTED, "Unix socket is not compiled"); return; } void UnixSocketKillSocketThread(void) { return; } void UnixManagerThreadSpawnNonRunmode(void) { return; } #endif /* BUILD_UNIX_SOCKET */ void TmModuleUnixManagerRegister (void) { #ifdef BUILD_UNIX_SOCKET tmm_modules[TMM_UNIXMANAGER].name = "UnixManager"; tmm_modules[TMM_UNIXMANAGER].ThreadInit = UnixManagerThreadInit; tmm_modules[TMM_UNIXMANAGER].ThreadDeinit = UnixManagerThreadDeinit; tmm_modules[TMM_UNIXMANAGER].Management = UnixManager; tmm_modules[TMM_UNIXMANAGER].cap_flags = 0; tmm_modules[TMM_UNIXMANAGER].flags = TM_FLAG_COMMAND_TM; #endif /* BUILD_UNIX_SOCKET */ } suricata-3.2.1/src/detect-base64-data.h0000644000000000000000000000167013051004444014417 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __DETECT_BASE64_DATA_H__ #define __DETECT_BASE64_DATA_H__ void DetectBase64DataRegister(void); int DetectBase64DataDoMatch(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *); #endif /* __DETECT_BASE64_DATA_H__ */ suricata-3.2.1/src/util-profiling.h0000644000000000000000000004255413051004444014130 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Victor Julien */ #ifndef __UTIL_PROFILE_H__ #define __UTIL_PROFILE_H__ #ifdef PROFILING #include "util-profiling-locks.h" #include "util-cpu.h" extern int profiling_rules_enabled; extern int profiling_packets_enabled; extern int profiling_sghs_enabled; extern __thread int profiling_rules_entered; void SCProfilingPrintPacketProfile(Packet *); void SCProfilingAddPacket(Packet *); int SCProfileRuleStart(Packet *p); #define RULE_PROFILING_START(p) \ uint64_t profile_rule_start_ = 0; \ uint64_t profile_rule_end_ = 0; \ if (profiling_rules_enabled && SCProfileRuleStart((p))) { \ if (profiling_rules_entered > 0) { \ SCLogError(SC_ERR_FATAL, "Re-entered profiling, exiting."); \ exit(1); \ } \ profiling_rules_entered++; \ profile_rule_start_ = UtilCpuGetTicks(); \ } #define RULE_PROFILING_END(ctx, r, m, p) \ if (profiling_rules_enabled && ((p)->flags & PKT_PROFILE)) { \ profile_rule_end_ = UtilCpuGetTicks(); \ SCProfilingRuleUpdateCounter(ctx, r->profiling_id, \ profile_rule_end_ - profile_rule_start_, m); \ profiling_rules_entered--; \ } extern int profiling_keyword_enabled; extern __thread int profiling_keyword_entered; #define KEYWORD_PROFILING_SET_LIST(ctx, list) { \ (ctx)->keyword_perf_list = (list); \ } #define KEYWORD_PROFILING_START \ uint64_t profile_keyword_start_ = 0; \ uint64_t profile_keyword_end_ = 0; \ if (profiling_keyword_enabled) { \ if (profiling_keyword_entered > 0) { \ SCLogError(SC_ERR_FATAL, "Re-entered profiling, exiting."); \ abort(); \ } \ profiling_keyword_entered++; \ profile_keyword_start_ = UtilCpuGetTicks(); \ } /* we allow this macro to be called if profiling_keyword_entered == 0, * so that we don't have to refactor some of the detection code. */ #define KEYWORD_PROFILING_END(ctx, type, m) \ if (profiling_keyword_enabled && profiling_keyword_entered) { \ profile_keyword_end_ = UtilCpuGetTicks(); \ SCProfilingKeywordUpdateCounter((ctx),(type),(profile_keyword_end_ - profile_keyword_start_),(m)); \ profiling_keyword_entered--; \ } PktProfiling *SCProfilePacketStart(void); #define PACKET_PROFILING_START(p) \ if (profiling_packets_enabled) { \ (p)->profile = SCProfilePacketStart(); \ if ((p)->profile != NULL) \ (p)->profile->ticks_start = UtilCpuGetTicks(); \ } #define PACKET_PROFILING_RESTART(p) \ if (profiling_packets_enabled) { \ if ((p)->profile != NULL) \ (p)->profile->ticks_start = UtilCpuGetTicks(); \ } #define PACKET_PROFILING_END(p) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ (p)->profile->ticks_end = UtilCpuGetTicks(); \ SCProfilingAddPacket((p)); \ } #ifdef PROFILE_LOCKING #define PACKET_PROFILING_RESET_LOCKS do { \ mutex_lock_cnt = 0; \ mutex_lock_wait_ticks = 0; \ mutex_lock_contention = 0; \ spin_lock_cnt = 0; \ spin_lock_wait_ticks = 0; \ spin_lock_contention = 0; \ rww_lock_cnt = 0; \ rww_lock_wait_ticks = 0; \ rww_lock_contention = 0; \ rwr_lock_cnt = 0; \ rwr_lock_wait_ticks = 0; \ rwr_lock_contention = 0; \ locks_idx = 0; \ record_locks = 1;\ } while (0) #define PACKET_PROFILING_COPY_LOCKS(p, id) do { \ (p)->profile->tmm[(id)].mutex_lock_cnt = mutex_lock_cnt; \ (p)->profile->tmm[(id)].mutex_lock_wait_ticks = mutex_lock_wait_ticks; \ (p)->profile->tmm[(id)].mutex_lock_contention = mutex_lock_contention; \ (p)->profile->tmm[(id)].spin_lock_cnt = spin_lock_cnt; \ (p)->profile->tmm[(id)].spin_lock_wait_ticks = spin_lock_wait_ticks; \ (p)->profile->tmm[(id)].spin_lock_contention = spin_lock_contention; \ (p)->profile->tmm[(id)].rww_lock_cnt = rww_lock_cnt; \ (p)->profile->tmm[(id)].rww_lock_wait_ticks = rww_lock_wait_ticks; \ (p)->profile->tmm[(id)].rww_lock_contention = rww_lock_contention; \ (p)->profile->tmm[(id)].rwr_lock_cnt = rwr_lock_cnt; \ (p)->profile->tmm[(id)].rwr_lock_wait_ticks = rwr_lock_wait_ticks; \ (p)->profile->tmm[(id)].rwr_lock_contention = rwr_lock_contention; \ record_locks = 0; \ SCProfilingAddPacketLocks((p)); \ } while(0) #else #define PACKET_PROFILING_RESET_LOCKS #define PACKET_PROFILING_COPY_LOCKS(p, id) #endif #define PACKET_PROFILING_TMM_START(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < TMM_SIZE) { \ (p)->profile->tmm[(id)].ticks_start = UtilCpuGetTicks();\ PACKET_PROFILING_RESET_LOCKS; \ } \ } #define PACKET_PROFILING_TMM_END(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < TMM_SIZE) { \ PACKET_PROFILING_COPY_LOCKS((p), (id)); \ (p)->profile->tmm[(id)].ticks_end = UtilCpuGetTicks(); \ } \ } #define FLOWWORKER_PROFILING_START(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < PROFILE_FLOWWORKER_SIZE) { \ (p)->profile->flowworker[(id)].ticks_start = UtilCpuGetTicks();\ } \ } #define FLOWWORKER_PROFILING_END(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < PROFILE_FLOWWORKER_SIZE) { \ (p)->profile->flowworker[(id)].ticks_end = UtilCpuGetTicks(); \ } \ } #define PACKET_PROFILING_RESET(p) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ SCFree((p)->profile->prefilter.engines); \ SCFree((p)->profile); \ (p)->profile = NULL; \ } #define PACKET_PROFILING_APP_START(dp, id) \ if (profiling_packets_enabled) { \ (dp)->ticks_start = UtilCpuGetTicks(); \ (dp)->alproto = (id); \ } #define PACKET_PROFILING_APP_END(dp, id) \ if (profiling_packets_enabled) { \ BUG_ON((id) != (dp)->alproto); \ (dp)->ticks_end = UtilCpuGetTicks(); \ if ((dp)->ticks_start != 0 && (dp)->ticks_start < ((dp)->ticks_end)) { \ (dp)->ticks_spent = ((dp)->ticks_end - (dp)->ticks_start); \ } \ } #define PACKET_PROFILING_APP_PD_START(dp) \ if (profiling_packets_enabled) { \ (dp)->proto_detect_ticks_start = UtilCpuGetTicks(); \ } #define PACKET_PROFILING_APP_PD_END(dp) \ if (profiling_packets_enabled) { \ (dp)->proto_detect_ticks_end = UtilCpuGetTicks(); \ if ((dp)->proto_detect_ticks_start != 0 && (dp)->proto_detect_ticks_start < ((dp)->proto_detect_ticks_end)) { \ (dp)->proto_detect_ticks_spent = \ ((dp)->proto_detect_ticks_end - (dp)->proto_detect_ticks_start); \ } \ } #define PACKET_PROFILING_APP_RESET(dp) \ if (profiling_packets_enabled) { \ (dp)->ticks_start = 0; \ (dp)->ticks_end = 0; \ (dp)->ticks_spent = 0; \ (dp)->alproto = 0; \ (dp)->proto_detect_ticks_start = 0; \ (dp)->proto_detect_ticks_end = 0; \ (dp)->proto_detect_ticks_spent = 0; \ } #define PACKET_PROFILING_APP_STORE(dp, p) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((dp)->alproto < ALPROTO_MAX) { \ (p)->profile->app[(dp)->alproto].ticks_spent += (dp)->ticks_spent; \ (p)->profile->proto_detect += (dp)->proto_detect_ticks_spent; \ } \ } #define PACKET_PROFILING_DETECT_START(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < PROF_DETECT_SIZE) { \ (p)->profile->detect[(id)].ticks_start = UtilCpuGetTicks(); \ } \ } #define PACKET_PROFILING_DETECT_END(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < PROF_DETECT_SIZE) { \ (p)->profile->detect[(id)].ticks_end = UtilCpuGetTicks();\ if ((p)->profile->detect[(id)].ticks_start != 0 && \ (p)->profile->detect[(id)].ticks_start < (p)->profile->detect[(id)].ticks_end) { \ (p)->profile->detect[(id)].ticks_spent += \ ((p)->profile->detect[(id)].ticks_end - (p)->profile->detect[(id)].ticks_start); \ } \ } \ } #define PACKET_PROFILING_LOGGER_START(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < LOGGER_SIZE) { \ (p)->profile->logger[(id)].ticks_start = UtilCpuGetTicks(); \ } \ } #define PACKET_PROFILING_LOGGER_END(p, id) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((id) < LOGGER_SIZE) { \ (p)->profile->logger[(id)].ticks_end = UtilCpuGetTicks();\ if ((p)->profile->logger[(id)].ticks_start != 0 && \ (p)->profile->logger[(id)].ticks_start < (p)->profile->logger[(id)].ticks_end) { \ (p)->profile->logger[(id)].ticks_spent += \ ((p)->profile->logger[(id)].ticks_end - (p)->profile->logger[(id)].ticks_start); \ } \ } \ } #define SGH_PROFILING_RECORD(det_ctx, sgh) \ if (profiling_sghs_enabled) { \ SCProfilingSghUpdateCounter((det_ctx), (sgh)); \ } #define PROFILING_PREFILTER_RESET(p, detectsize) \ if (profiling_packets_enabled && (p)->profile != NULL) { \ if ((p)->profile->prefilter.size != ((detectsize) + 1)) { \ if ((p)->profile->prefilter.engines != NULL) \ SCFree((p)->profile->prefilter.engines); \ (p)->profile->prefilter.engines = \ SCCalloc((detectsize)+1, sizeof(PktProfilingPrefilterEngine)); \ (p)->profile->prefilter.size = (detectsize)+1;\ } else { \ memset((p)->profile->prefilter.engines, 0x00, \ ((detectsize)+1 * sizeof(PktProfilingPrefilterEngine))); \ } \ } \ #define PROFILING_PREFILTER_START(p) \ uint64_t ticks_start = 0; \ if (profiling_packets_enabled && (p)->profile != NULL) { \ ticks_start = UtilCpuGetTicks(); \ } \ #define PROFILING_PREFILTER_END(p, profile_id) \ if (profiling_packets_enabled && (p)->profile != NULL && \ ticks_start) \ { \ uint64_t ticks_end = UtilCpuGetTicks(); \ (p)->profile->prefilter.engines[(profile_id)].ticks_spent += (ticks_end - ticks_start); \ ticks_start = 0; \ } \ void SCProfilingRulesGlobalInit(void); void SCProfilingRuleDestroyCtx(struct SCProfileDetectCtx_ *); void SCProfilingRuleInitCounters(DetectEngineCtx *); void SCProfilingRuleUpdateCounter(DetectEngineThreadCtx *, uint16_t, uint64_t, int); void SCProfilingRuleThreadSetup(struct SCProfileDetectCtx_ *, DetectEngineThreadCtx *); void SCProfilingRuleThreadCleanup(DetectEngineThreadCtx *); void SCProfilingKeywordsGlobalInit(void); void SCProfilingKeywordDestroyCtx(DetectEngineCtx *);//struct SCProfileKeywordDetectCtx_ *); void SCProfilingKeywordInitCounters(DetectEngineCtx *); void SCProfilingKeywordUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks, int match); void SCProfilingKeywordThreadSetup(struct SCProfileKeywordDetectCtx_ *, DetectEngineThreadCtx *); void SCProfilingKeywordThreadCleanup(DetectEngineThreadCtx *); void SCProfilingSghsGlobalInit(void); void SCProfilingSghDestroyCtx(DetectEngineCtx *); void SCProfilingSghInitCounters(DetectEngineCtx *); void SCProfilingSghUpdateCounter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh); void SCProfilingSghThreadSetup(struct SCProfileSghDetectCtx_ *, DetectEngineThreadCtx *); void SCProfilingSghThreadCleanup(DetectEngineThreadCtx *); void SCProfilingInit(void); void SCProfilingDestroy(void); void SCProfilingRegisterTests(void); void SCProfilingDump(void); #else #define RULE_PROFILING_START(p) #define RULE_PROFILING_END(a,b,c,p) #define KEYWORD_PROFILING_SET_LIST(a,b) #define KEYWORD_PROFILING_START #define KEYWORD_PROFILING_END(a,b,c) #define PACKET_PROFILING_START(p) #define PACKET_PROFILING_RESTART(p) #define PACKET_PROFILING_END(p) #define PACKET_PROFILING_TMM_START(p, id) #define PACKET_PROFILING_TMM_END(p, id) #define PACKET_PROFILING_RESET(p) #define PACKET_PROFILING_APP_START(dp, id) #define PACKET_PROFILING_APP_END(dp, id) #define PACKET_PROFILING_APP_RESET(dp) #define PACKET_PROFILING_APP_STORE(dp, p) #define PACKET_PROFILING_APP_PD_START(dp) #define PACKET_PROFILING_APP_PD_END(dp) #define PACKET_PROFILING_DETECT_START(p, id) #define PACKET_PROFILING_DETECT_END(p, id) #define PACKET_PROFILING_LOGGER_START(p, id) #define PACKET_PROFILING_LOGGER_END(p, id) #define SGH_PROFILING_RECORD(det_ctx, sgh) #define FLOWWORKER_PROFILING_START(p, id) #define FLOWWORKER_PROFILING_END(p, id) #define PROFILING_PREFILTER_RESET(p, detectsize) #define PROFILING_PREFILTER_START(p) #define PROFILING_PREFILTER_END(p, profile_id) #endif /* PROFILING */ #endif /* ! __UTIL_PROFILE_H__ */ suricata-3.2.1/src/detect-engine-hua.h0000644000000000000000000000251713051004444014445 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HUA_H__ #define __DETECT_ENGINE_HUA_H__ #include "app-layer-htp.h" int PrefilterTxUARegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpUA(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpUARegisterTests(void); #endif /* __DETECT_ENGINE_HUA_H__ */ suricata-3.2.1/src/log-file.h0000644000000000000000000000160413051004444012651 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_FILELOG_H__ #define __LOG_FILELOG_H__ void LogFileLogRegister(void); #endif /* __LOG_FILELOG_H__ */ suricata-3.2.1/src/util-profiling-rulegroups.c0000644000000000000000000003067713051004444016333 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Victor Julien * * An API for rule profiling operations. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "conf.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-byte.h" #include "util-profiling.h" #include "util-profiling-locks.h" #ifdef PROFILING /** * Extra data for rule profiling. */ typedef struct SCProfileSghData_ { uint64_t checks; uint64_t non_mpm_generic; uint64_t non_mpm_syn; uint64_t post_prefilter_sigs_total; uint64_t post_prefilter_sigs_max; uint64_t mpm_match_cnt_total; uint64_t mpm_match_cnt_max; } SCProfileSghData; typedef struct SCProfileSghDetectCtx_ { uint32_t cnt; SCProfileSghData *data; pthread_mutex_t data_m; } SCProfileSghDetectCtx; static int profiling_sghs_output_to_file = 0; int profiling_sghs_enabled = 0; static char profiling_file_name[PATH_MAX]; static const char *profiling_file_mode = "a"; #ifdef HAVE_LIBJANSSON static int profiling_rulegroup_json = 0; #endif void SCProfilingSghsGlobalInit(void) { ConfNode *conf; conf = ConfGetNode("profiling.rulegroups"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { profiling_sghs_enabled = 1; const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(profiling_file_name, sizeof(profiling_file_name), "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_file_mode = "a"; } else { profiling_file_mode = "w"; } profiling_sghs_output_to_file = 1; } if (ConfNodeChildValueIsTrue(conf, "json")) { #ifdef HAVE_LIBJANSSON profiling_rulegroup_json = 1; #else SCLogWarning(SC_ERR_NO_JSON_SUPPORT, "no json support compiled in, using plain output"); #endif } } } } #ifdef HAVE_LIBJANSSON static void DoDumpJSON(SCProfileSghDetectCtx *rules_ctx, FILE *fp, const char *name) { char timebuf[64]; uint32_t i; struct timeval tval; json_t *js = json_object(); if (js == NULL) return; json_t *jsa = json_array(); if (jsa == NULL) { json_decref(js); return; } gettimeofday(&tval, NULL); CreateIsoTimeString(&tval, timebuf, sizeof(timebuf)); json_object_set_new(js, "timestamp", json_string(timebuf)); for (i = 0; i < rules_ctx->cnt; i++) { SCProfileSghData *d = &rules_ctx->data[i]; if (d == NULL || d->checks == 0) continue; double avgsigs = 0; double avgmpms = 0; if (d->post_prefilter_sigs_total && d->checks) { avgsigs = (double)((double)d->post_prefilter_sigs_total / (double)d->checks); } if (d->mpm_match_cnt_total && d->checks) { avgmpms = (double)((double)d->mpm_match_cnt_total / (double)d->checks); } json_t *jsm = json_object(); if (jsm) { json_object_set_new(jsm, "id", json_integer(i)); json_object_set_new(jsm, "checks", json_integer(d->checks)); json_object_set_new(jsm, "non_mpm_generic", json_integer(d->non_mpm_generic)); json_object_set_new(jsm, "non_mpm_syn", json_integer(d->non_mpm_syn)); json_object_set_new(jsm, "avgmpms", json_real(avgmpms)); json_object_set_new(jsm, "mpm_match_cnt_max", json_integer(d->mpm_match_cnt_max)); json_object_set_new(jsm, "avgsigs", json_real(avgsigs)); json_object_set_new(jsm, "post_prefilter_sigs_max", json_integer(d->post_prefilter_sigs_max)); json_array_append_new(jsa, jsm); } } json_object_set_new(js, "rule_groups", jsa); char *js_s = json_dumps(js, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); if (likely(js_s != NULL)) { fprintf(fp, "%s", js_s); free(js_s); } json_decref(js); } #endif /* HAVE_LIBJANSSON */ static void DoDump(SCProfileSghDetectCtx *rules_ctx, FILE *fp, const char *name) { uint32_t i; struct timeval tval; struct tm *tms; struct tm local_tm; gettimeofday(&tval, NULL); tms = SCLocalTime(tval.tv_sec, &local_tm); fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d\n", tms->tm_mon + 1, tms->tm_mday, tms->tm_year + 1900, tms->tm_hour,tms->tm_min, tms->tm_sec); fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " Stats for: %s %u\n", name, rules_ctx->cnt); fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " %-16s %-15s %-15s %-15s %-15s %-15s %-15s %-15s\n", "Sgh", "Checks", "Non-MPM(gen)", "Non-Mpm(syn)", "MPM Matches", "MPM Match Max", "Post-Filter", "Post-Filter Max"); fprintf(fp, " ---------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "\n"); for (i = 0; i < rules_ctx->cnt; i++) { SCProfileSghData *d = &rules_ctx->data[i]; if (d == NULL || d->checks == 0) continue; double avgsigs = 0; double avgmpms = 0; if (d->post_prefilter_sigs_total && d->checks) { avgsigs = (double)((double)d->post_prefilter_sigs_total / (double)d->checks); } if (d->mpm_match_cnt_total && d->checks) { avgmpms = (double)((double)d->mpm_match_cnt_total / (double)d->checks); } fprintf(fp, " %-16u %-15"PRIu64" %-15"PRIu64" %-15"PRIu64" %-15.2f %-15"PRIu64" %-15.2f %-15"PRIu64"\n", i, d->checks, d->non_mpm_generic, d->non_mpm_syn, avgmpms, d->mpm_match_cnt_max, avgsigs, d->post_prefilter_sigs_max); } fprintf(fp,"\n"); } void SCProfilingSghDump(DetectEngineCtx *de_ctx) { FILE *fp; if (profiling_sghs_enabled == 0) return; if (profiling_sghs_output_to_file == 1) { SCLogDebug("file %s mode %s", profiling_file_name, profiling_file_mode); fp = fopen(profiling_file_name, profiling_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_file_name, strerror(errno)); return; } } else { fp = stdout; } #ifdef HAVE_LIBJANSSON if (profiling_rulegroup_json) { DoDumpJSON(de_ctx->profile_sgh_ctx, fp, "rule groups"); } else #endif { DoDump(de_ctx->profile_sgh_ctx, fp, "rule groups"); } if (fp != stdout) fclose(fp); SCLogPerf("Done dumping rulegroup profiling data."); } /** * \brief Update a rule counter. * * \param id The ID of this counter. * \param ticks Number of CPU ticks for this rule. * \param match Did the rule match? */ void SCProfilingSghUpdateCounter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh) { if (det_ctx != NULL && det_ctx->sgh_perf_data != NULL && sgh->id < det_ctx->de_ctx->sgh_array_cnt) { SCProfileSghData *p = &det_ctx->sgh_perf_data[sgh->id]; p->checks++; if (det_ctx->non_pf_store_cnt > 0) { if (det_ctx->non_pf_store_ptr == sgh->non_pf_syn_store_array) p->non_mpm_syn++; else p->non_mpm_generic++; } p->post_prefilter_sigs_total += det_ctx->match_array_cnt; if (det_ctx->match_array_cnt > p->post_prefilter_sigs_max) p->post_prefilter_sigs_max = det_ctx->match_array_cnt; p->mpm_match_cnt_total += det_ctx->pmq.rule_id_array_cnt; if (det_ctx->pmq.rule_id_array_cnt > p->mpm_match_cnt_max) p->mpm_match_cnt_max = det_ctx->pmq.rule_id_array_cnt; } } SCProfileSghDetectCtx *SCProfilingSghInitCtx(void) { SCProfileSghDetectCtx *ctx = SCCalloc(1, sizeof(SCProfileSghDetectCtx)); if (ctx != NULL) { if (pthread_mutex_init(&ctx->data_m, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Failed to initialize mutex."); exit(EXIT_FAILURE); } } return ctx; } static void DetroyCtx(SCProfileSghDetectCtx *ctx) { if (ctx) { if (ctx->data != NULL) SCFree(ctx->data); pthread_mutex_destroy(&ctx->data_m); SCFree(ctx); } } void SCProfilingSghDestroyCtx(DetectEngineCtx *de_ctx) { if (de_ctx != NULL) { SCProfilingSghDump(de_ctx); DetroyCtx(de_ctx->profile_sgh_ctx); } } void SCProfilingSghThreadSetup(SCProfileSghDetectCtx *ctx, DetectEngineThreadCtx *det_ctx) { if (ctx == NULL) return; uint32_t array_size = det_ctx->de_ctx->sgh_array_cnt; SCProfileSghData *a = SCCalloc(array_size, sizeof(SCProfileSghData)); if (a != NULL) { det_ctx->sgh_perf_data = a; } } static void SCProfilingSghThreadMerge(DetectEngineCtx *de_ctx, const DetectEngineThreadCtx *det_ctx) { if (de_ctx == NULL || de_ctx->profile_sgh_ctx == NULL || de_ctx->profile_sgh_ctx->data == NULL || det_ctx == NULL || det_ctx->sgh_perf_data == NULL) return; #define ADD(name) de_ctx->profile_sgh_ctx->data[i].name += det_ctx->sgh_perf_data[i].name uint32_t i; for (i = 0; i < de_ctx->sgh_array_cnt; i++) { ADD(checks); ADD(non_mpm_generic); ADD(non_mpm_syn); ADD(post_prefilter_sigs_total); ADD(mpm_match_cnt_total); if (det_ctx->sgh_perf_data[i].mpm_match_cnt_max > de_ctx->profile_sgh_ctx->data[i].mpm_match_cnt_max) de_ctx->profile_sgh_ctx->data[i].mpm_match_cnt_max = det_ctx->sgh_perf_data[i].mpm_match_cnt_max; if (det_ctx->sgh_perf_data[i].post_prefilter_sigs_max > de_ctx->profile_sgh_ctx->data[i].post_prefilter_sigs_max) de_ctx->profile_sgh_ctx->data[i].post_prefilter_sigs_max = det_ctx->sgh_perf_data[i].post_prefilter_sigs_max; } #undef ADD } void SCProfilingSghThreadCleanup(DetectEngineThreadCtx *det_ctx) { if (det_ctx == NULL || det_ctx->de_ctx == NULL || det_ctx->sgh_perf_data == NULL) return; pthread_mutex_lock(&det_ctx->de_ctx->profile_sgh_ctx->data_m); SCProfilingSghThreadMerge(det_ctx->de_ctx, det_ctx); pthread_mutex_unlock(&det_ctx->de_ctx->profile_sgh_ctx->data_m); SCFree(det_ctx->sgh_perf_data); det_ctx->sgh_perf_data = NULL; } /** * \brief Register the keyword profiling counters. * * \param de_ctx The active DetectEngineCtx, used to get at the loaded rules. */ void SCProfilingSghInitCounters(DetectEngineCtx *de_ctx) { if (profiling_sghs_enabled == 0) return; de_ctx->profile_sgh_ctx = SCProfilingSghInitCtx(); BUG_ON(de_ctx->profile_sgh_ctx == NULL); de_ctx->profile_sgh_ctx->data = SCCalloc(de_ctx->sgh_array_cnt, sizeof(SCProfileSghData)); BUG_ON(de_ctx->profile_sgh_ctx->data == NULL); de_ctx->profile_sgh_ctx->cnt = de_ctx->sgh_array_cnt; SCLogPerf("Registered %"PRIu32" rulegroup profiling counters.", de_ctx->sgh_array_cnt); } #endif /* PROFILING */ suricata-3.2.1/src/detect-dce-opnum.h0000644000000000000000000000241513051004444014311 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_DCE_OPNUM_H__ #define __DETECT_DCE_OPNUM_H__ #define DCE_OPNUM_RANGE_MAX 65535 #define DCE_OPNUM_RANGE_UNINITIALIZED 100000 typedef struct DetectDceOpnumRange_ { uint32_t range1; uint32_t range2; struct DetectDceOpnumRange_ *next; } DetectDceOpnumRange; typedef struct DetectDceOpnumData_ { DetectDceOpnumRange *range; } DetectDceOpnumData; void DetectDceOpnumRegister(void); void DetectDceOpnumRegisterTests(void); #endif /* __DETECT_DCE_OPNUM_H__ */ suricata-3.2.1/src/detect-lua.c0000644000000000000000000016605313051004444013207 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "conf.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "stream-tcp.h" #include "detect-lua.h" #include "detect-lua-extensions.h" #include "queue.h" #include "util-cpu.h" #include "util-var-name.h" #ifndef HAVE_LUA static int DetectLuaSetupNoSupport (DetectEngineCtx *a, Signature *b, char *c) { SCLogError(SC_ERR_NO_LUA_SUPPORT, "no Lua support built in, needed for lua/luajit keyword"); return -1; } /** * \brief Registration function for keyword: lua */ void DetectLuaRegister(void) { sigmatch_table[DETECT_LUA].name = "lua"; sigmatch_table[DETECT_LUA].alias = "luajit"; sigmatch_table[DETECT_LUA].Setup = DetectLuaSetupNoSupport; sigmatch_table[DETECT_LUA].Free = NULL; sigmatch_table[DETECT_LUA].RegisterTests = NULL; sigmatch_table[DETECT_LUA].flags = SIGMATCH_NOT_BUILT; SCLogDebug("registering lua rule option"); return; } #else /* HAVE_LUA */ #include "util-lua.h" static int DetectLuaMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectLuaAppMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m); static int DetectLuaAppTxMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx); static int DetectLuaSetup (DetectEngineCtx *, Signature *, char *); static void DetectLuaRegisterTests(void); static void DetectLuaFree(void *); /** * \brief Registration function for keyword: lua */ void DetectLuaRegister(void) { sigmatch_table[DETECT_LUA].name = "lua"; sigmatch_table[DETECT_LUA].alias = "luajit"; sigmatch_table[DETECT_LUA].desc = "match via a lua script"; sigmatch_table[DETECT_LUA].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_scripting"; sigmatch_table[DETECT_LUA].Match = DetectLuaMatch; sigmatch_table[DETECT_LUA].AppLayerMatch = DetectLuaAppMatch; sigmatch_table[DETECT_LUA].AppLayerTxMatch = DetectLuaAppTxMatch; sigmatch_table[DETECT_LUA].Setup = DetectLuaSetup; sigmatch_table[DETECT_LUA].Free = DetectLuaFree; sigmatch_table[DETECT_LUA].RegisterTests = DetectLuaRegisterTests; SCLogDebug("registering lua rule option"); return; } #define DATATYPE_PACKET (1<<0) #define DATATYPE_PAYLOAD (1<<1) #define DATATYPE_STREAM (1<<2) #define DATATYPE_HTTP_URI (1<<3) #define DATATYPE_HTTP_URI_RAW (1<<4) #define DATATYPE_HTTP_REQUEST_HEADERS (1<<5) #define DATATYPE_HTTP_REQUEST_HEADERS_RAW (1<<6) #define DATATYPE_HTTP_REQUEST_COOKIE (1<<7) #define DATATYPE_HTTP_REQUEST_UA (1<<8) #define DATATYPE_HTTP_REQUEST_LINE (1<<9) #define DATATYPE_HTTP_REQUEST_BODY (1<<10) #define DATATYPE_HTTP_RESPONSE_COOKIE (1<<11) #define DATATYPE_HTTP_RESPONSE_BODY (1<<12) #define DATATYPE_HTTP_RESPONSE_HEADERS (1<<13) #define DATATYPE_HTTP_RESPONSE_HEADERS_RAW (1<<14) #define DATATYPE_DNS_RRNAME (1<<15) #define DATATYPE_DNS_REQUEST (1<<16) #define DATATYPE_DNS_RESPONSE (1<<17) #define DATATYPE_TLS (1<<18) #define DATATYPE_SSH (1<<19) #define DATATYPE_SMTP (1<<20) #define DATATYPE_DNP3 (1<<20) /** \brief dump stack from lua state to screen */ void LuaDumpStack(lua_State *state) { int size = lua_gettop(state); int i; for (i = 1; i <= size; i++) { int type = lua_type(state, i); printf("Stack size=%d, level=%d, type=%d, ", size, i, type); switch (type) { case LUA_TFUNCTION: printf("function %s", lua_tostring(state, i) ? "true" : "false"); break; case LUA_TBOOLEAN: printf("bool %s", lua_toboolean(state, i) ? "true" : "false"); break; case LUA_TNUMBER: printf("number %g", lua_tonumber(state, i)); break; case LUA_TSTRING: printf("string `%s'", lua_tostring(state, i)); break; case LUA_TTABLE: printf("table `%s'", lua_tostring(state, i)); break; default: printf("other %s", lua_typename(state, type)); break; } printf("\n"); } } int DetectLuaMatchBuffer(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, uint8_t *buffer, uint32_t buffer_len, uint32_t offset, Flow *f) { SCEnter(); int ret = 0; if (buffer == NULL || buffer_len == 0) SCReturnInt(0); DetectLuaData *lua = (DetectLuaData *)sm->ctx; if (lua == NULL) SCReturnInt(0); DetectLuaThreadData *tlua = (DetectLuaThreadData *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, lua->thread_ctx_id); if (tlua == NULL) SCReturnInt(0); LuaExtensionsMatchSetup(tlua->luastate, lua, det_ctx, f, /* no packet in the ctx */NULL, 0); /* prepare data to pass to script */ lua_getglobal(tlua->luastate, "match"); lua_newtable(tlua->luastate); /* stack at -1 */ lua_pushliteral (tlua->luastate, "offset"); /* stack at -2 */ lua_pushnumber (tlua->luastate, (int)(offset + 1)); lua_settable(tlua->luastate, -3); lua_pushstring (tlua->luastate, lua->buffername); /* stack at -2 */ LuaPushStringBuffer(tlua->luastate, (const uint8_t *)buffer, (size_t)buffer_len); lua_settable(tlua->luastate, -3); int retval = lua_pcall(tlua->luastate, 1, 1, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(tlua->luastate, -1)); } /* process returns from script */ if (lua_gettop(tlua->luastate) > 0) { /* script returns a number (return 1 or return 0) */ if (lua_type(tlua->luastate, 1) == LUA_TNUMBER) { double script_ret = lua_tonumber(tlua->luastate, 1); SCLogDebug("script_ret %f", script_ret); lua_pop(tlua->luastate, 1); if (script_ret == 1.0) ret = 1; /* script returns a table */ } else if (lua_type(tlua->luastate, 1) == LUA_TTABLE) { lua_pushnil(tlua->luastate); const char *k, *v; while (lua_next(tlua->luastate, -2)) { v = lua_tostring(tlua->luastate, -1); lua_pop(tlua->luastate, 1); k = lua_tostring(tlua->luastate, -1); if (!k || !v) continue; SCLogDebug("k='%s', v='%s'", k, v); if (strcmp(k, "retval") == 0) { if (atoi(v) == 1) ret = 1; } else { /* set flow var? */ } } /* pop the table */ lua_pop(tlua->luastate, 1); } } else { SCLogDebug("no stack"); } /* clear the stack */ while (lua_gettop(tlua->luastate) > 0) { lua_pop(tlua->luastate, 1); } if (lua->negated) { if (ret == 1) ret = 0; else ret = 1; } SCReturnInt(ret); } /** * \brief match the specified lua script * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param p packet * \param s signature being inspected * \param m sigmatch that we will cast into DetectLuaData * * \retval 0 no match * \retval 1 match */ static int DetectLuaMatch (ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); int ret = 0; DetectLuaData *lua = (DetectLuaData *)ctx; if (lua == NULL) SCReturnInt(0); DetectLuaThreadData *tlua = (DetectLuaThreadData *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, lua->thread_ctx_id); if (tlua == NULL) SCReturnInt(0); /* setup extension data for use in lua c functions */ uint8_t flags = 0; if (p->flowflags & FLOW_PKT_TOSERVER) flags = STREAM_TOSERVER; else if (p->flowflags & FLOW_PKT_TOCLIENT) flags = STREAM_TOCLIENT; LuaStateSetThreadVars(tlua->luastate, tv); LuaExtensionsMatchSetup(tlua->luastate, lua, det_ctx, p->flow, p, flags); if ((tlua->flags & DATATYPE_PAYLOAD) && p->payload_len == 0) SCReturnInt(0); if ((tlua->flags & DATATYPE_PACKET) && GET_PKT_LEN(p) == 0) SCReturnInt(0); if (tlua->alproto != ALPROTO_UNKNOWN) { if (p->flow == NULL) SCReturnInt(0); AppProto alproto = p->flow->alproto; if (tlua->alproto != alproto) SCReturnInt(0); } lua_getglobal(tlua->luastate, "match"); lua_newtable(tlua->luastate); /* stack at -1 */ if ((tlua->flags & DATATYPE_PAYLOAD) && p->payload_len) { lua_pushliteral(tlua->luastate, "payload"); /* stack at -2 */ LuaPushStringBuffer (tlua->luastate, (const uint8_t *)p->payload, (size_t)p->payload_len); /* stack at -3 */ lua_settable(tlua->luastate, -3); } if ((tlua->flags & DATATYPE_PACKET) && GET_PKT_LEN(p)) { lua_pushliteral(tlua->luastate, "packet"); /* stack at -2 */ LuaPushStringBuffer (tlua->luastate, (const uint8_t *)GET_PKT_DATA(p), (size_t)GET_PKT_LEN(p)); /* stack at -3 */ lua_settable(tlua->luastate, -3); } if (tlua->alproto == ALPROTO_HTTP) { HtpState *htp_state = p->flow->alstate; if (htp_state != NULL && htp_state->connp != NULL) { htp_tx_t *tx = NULL; uint64_t idx = AppLayerParserGetTransactionInspectId(p->flow->alparser, STREAM_TOSERVER); uint64_t total_txs= AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state); for ( ; idx < total_txs; idx++) { tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, idx); if (tx == NULL) continue; if ((tlua->flags & DATATYPE_HTTP_REQUEST_LINE) && tx->request_line != NULL && bstr_len(tx->request_line) > 0) { lua_pushliteral(tlua->luastate, "http.request_line"); /* stack at -2 */ LuaPushStringBuffer(tlua->luastate, (const uint8_t *)bstr_ptr(tx->request_line), bstr_len(tx->request_line)); lua_settable(tlua->luastate, -3); } } } } int retval = lua_pcall(tlua->luastate, 1, 1, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(tlua->luastate, -1)); } /* process returns from script */ if (lua_gettop(tlua->luastate) > 0) { /* script returns a number (return 1 or return 0) */ if (lua_type(tlua->luastate, 1) == LUA_TNUMBER) { double script_ret = lua_tonumber(tlua->luastate, 1); SCLogDebug("script_ret %f", script_ret); lua_pop(tlua->luastate, 1); if (script_ret == 1.0) ret = 1; /* script returns a table */ } else if (lua_type(tlua->luastate, 1) == LUA_TTABLE) { lua_pushnil(tlua->luastate); const char *k, *v; while (lua_next(tlua->luastate, -2)) { v = lua_tostring(tlua->luastate, -1); lua_pop(tlua->luastate, 1); k = lua_tostring(tlua->luastate, -1); if (!k || !v) continue; SCLogDebug("k='%s', v='%s'", k, v); if (strcmp(k, "retval") == 0) { if (atoi(v) == 1) ret = 1; } else { /* set flow var? */ } } /* pop the table */ lua_pop(tlua->luastate, 1); } } while (lua_gettop(tlua->luastate) > 0) { lua_pop(tlua->luastate, 1); } if (lua->negated) { if (ret == 1) ret = 0; else ret = 1; } SCReturnInt(ret); } static int DetectLuaAppMatchCommon (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, const Signature *s, const SigMatchCtx *ctx) { SCEnter(); int ret = 0; DetectLuaData *lua = (DetectLuaData *)ctx; if (lua == NULL) SCReturnInt(0); DetectLuaThreadData *tlua = (DetectLuaThreadData *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, lua->thread_ctx_id); if (tlua == NULL) SCReturnInt(0); /* setup extension data for use in lua c functions */ LuaExtensionsMatchSetup(tlua->luastate, lua, det_ctx, f, NULL, flags); if (tlua->alproto != ALPROTO_UNKNOWN) { int alproto = f->alproto; if (tlua->alproto != alproto) SCReturnInt(0); } lua_getglobal(tlua->luastate, "match"); lua_newtable(tlua->luastate); /* stack at -1 */ if (tlua->alproto == ALPROTO_HTTP) { HtpState *htp_state = state; if (htp_state != NULL && htp_state->connp != NULL) { htp_tx_t *tx = NULL; tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, det_ctx->tx_id); if (tx != NULL) { if ((tlua->flags & DATATYPE_HTTP_REQUEST_LINE) && tx->request_line != NULL && bstr_len(tx->request_line) > 0) { lua_pushliteral(tlua->luastate, "http.request_line"); /* stack at -2 */ LuaPushStringBuffer(tlua->luastate, (const uint8_t *)bstr_ptr(tx->request_line), bstr_len(tx->request_line)); lua_settable(tlua->luastate, -3); } } } } int retval = lua_pcall(tlua->luastate, 1, 1, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(tlua->luastate, -1)); } /* process returns from script */ if (lua_gettop(tlua->luastate) > 0) { /* script returns a number (return 1 or return 0) */ if (lua_type(tlua->luastate, 1) == LUA_TNUMBER) { double script_ret = lua_tonumber(tlua->luastate, 1); SCLogDebug("script_ret %f", script_ret); lua_pop(tlua->luastate, 1); if (script_ret == 1.0) ret = 1; /* script returns a table */ } else if (lua_type(tlua->luastate, 1) == LUA_TTABLE) { lua_pushnil(tlua->luastate); const char *k, *v; while (lua_next(tlua->luastate, -2)) { v = lua_tostring(tlua->luastate, -1); lua_pop(tlua->luastate, 1); k = lua_tostring(tlua->luastate, -1); if (!k || !v) continue; SCLogDebug("k='%s', v='%s'", k, v); if (strcmp(k, "retval") == 0) { if (atoi(v) == 1) ret = 1; } else { /* set flow var? */ } } /* pop the table */ lua_pop(tlua->luastate, 1); } } while (lua_gettop(tlua->luastate) > 0) { lua_pop(tlua->luastate, 1); } if (lua->negated) { if (ret == 1) ret = 0; else ret = 1; } SCReturnInt(ret); } /** * \brief match the specified lua script in AMATCH * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param s signature being inspected * \param m sigmatch that we will cast into DetectLuaData * * \retval 0 no match * \retval 1 match */ static int DetectLuaAppMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { return DetectLuaAppMatchCommon(t, det_ctx, f, flags, state, s, m->ctx); } /** * \brief match the specified lua script in a list with a tx * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param s signature being inspected * \param m sigmatch that we will cast into DetectLuaData * * \retval 0 no match * \retval 1 match */ static int DetectLuaAppTxMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx) { return DetectLuaAppMatchCommon(t, det_ctx, f, flags, state, s, ctx); } #ifdef UNITTESTS /* if this ptr is set the lua setup functions will use this buffer as the * lua script instead of calling luaL_loadfile on the filename supplied. */ static const char *ut_script = NULL; #endif static void *DetectLuaThreadInit(void *data) { int status; DetectLuaData *lua = (DetectLuaData *)data; BUG_ON(lua == NULL); DetectLuaThreadData *t = SCMalloc(sizeof(DetectLuaThreadData)); if (unlikely(t == NULL)) { SCLogError(SC_ERR_LUA_ERROR, "couldn't alloc ctx memory"); return NULL; } memset(t, 0x00, sizeof(DetectLuaThreadData)); t->alproto = lua->alproto; t->flags = lua->flags; t->luastate = LuaGetState(); if (t->luastate == NULL) { SCLogError(SC_ERR_LUA_ERROR, "luastate pool depleted"); goto error; } luaL_openlibs(t->luastate); LuaRegisterExtensions(t->luastate); lua_pushinteger(t->luastate, (lua_Integer)(lua->sid)); lua_setglobal(t->luastate, "SCRuleSid"); lua_pushinteger(t->luastate, (lua_Integer)(lua->rev)); lua_setglobal(t->luastate, "SCRuleRev"); lua_pushinteger(t->luastate, (lua_Integer)(lua->gid)); lua_setglobal(t->luastate, "SCRuleGid"); /* hackish, needed to allow unittests to pass buffers as scripts instead of files */ #ifdef UNITTESTS if (ut_script != NULL) { status = luaL_loadbuffer(t->luastate, ut_script, strlen(ut_script), "unittest"); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(t->luastate, -1)); goto error; } } else { #endif status = luaL_loadfile(t->luastate, lua->filename); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(t->luastate, -1)); goto error; } #ifdef UNITTESTS } #endif /* prime the script (or something) */ if (lua_pcall(t->luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't prime file: %s", lua_tostring(t->luastate, -1)); goto error; } return (void *)t; error: if (t->luastate != NULL) LuaReturnState(t->luastate); SCFree(t); return NULL; } static void DetectLuaThreadFree(void *ctx) { if (ctx != NULL) { DetectLuaThreadData *t = (DetectLuaThreadData *)ctx; if (t->luastate != NULL) LuaReturnState(t->luastate); SCFree(t); } } /** * \brief Parse the lua keyword * * \param str Pointer to the user provided option * * \retval lua pointer to DetectLuaData on success * \retval NULL on failure */ static DetectLuaData *DetectLuaParse (const DetectEngineCtx *de_ctx, char *str) { DetectLuaData *lua = NULL; /* We have a correct lua option */ lua = SCMalloc(sizeof(DetectLuaData)); if (unlikely(lua == NULL)) goto error; memset(lua, 0x00, sizeof(DetectLuaData)); if (strlen(str) && str[0] == '!') { lua->negated = 1; str++; } /* get full filename */ lua->filename = DetectLoadCompleteSigPath(de_ctx, str); if (lua->filename == NULL) { goto error; } return lua; error: if (lua != NULL) DetectLuaFree(lua); return NULL; } static int DetectLuaSetupPrime(DetectEngineCtx *de_ctx, DetectLuaData *ld) { int status; lua_State *luastate = luaL_newstate(); if (luastate == NULL) return -1; luaL_openlibs(luastate); /* hackish, needed to allow unittests to pass buffers as scripts instead of files */ #ifdef UNITTESTS if (ut_script != NULL) { status = luaL_loadbuffer(luastate, ut_script, strlen(ut_script), "unittest"); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(luastate, -1)); goto error; } } else { #endif status = luaL_loadfile(luastate, ld->filename); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(luastate, -1)); goto error; } #ifdef UNITTESTS } #endif /* prime the script (or something) */ if (lua_pcall(luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't prime file: %s", lua_tostring(luastate, -1)); goto error; } lua_getglobal(luastate, "init"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no init function in script"); goto error; } lua_newtable(luastate); /* stack at -1 */ if (lua_gettop(luastate) == 0 || lua_type(luastate, 2) != LUA_TTABLE) { SCLogError(SC_ERR_LUA_ERROR, "no table setup"); goto error; } lua_pushliteral(luastate, "script_api_ver"); /* stack at -2 */ lua_pushnumber (luastate, 1); /* stack at -3 */ lua_settable(luastate, -3); if (lua_pcall(luastate, 1, 1, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't run script 'init' function: %s", lua_tostring(luastate, -1)); goto error; } /* process returns from script */ if (lua_gettop(luastate) == 0) { SCLogError(SC_ERR_LUA_ERROR, "init function in script should return table, nothing returned"); goto error; } if (lua_type(luastate, 1) != LUA_TTABLE) { SCLogError(SC_ERR_LUA_ERROR, "init function in script should return table, returned is not table"); goto error; } lua_pushnil(luastate); const char *k, *v; while (lua_next(luastate, -2)) { k = lua_tostring(luastate, -2); if (k == NULL) continue; /* handle flowvar separately as it has a table as value */ if (strcmp(k, "flowvar") == 0) { if (lua_istable(luastate, -1)) { lua_pushnil(luastate); while (lua_next(luastate, -2) != 0) { /* value at -1, key is at -2 which we ignore */ const char *value = lua_tostring(luastate, -1); SCLogDebug("value %s", value); /* removes 'value'; keeps 'key' for next iteration */ lua_pop(luastate, 1); if (ld->flowvars == DETECT_LUAJIT_MAX_FLOWVARS) { SCLogError(SC_ERR_LUA_ERROR, "too many flowvars registered"); goto error; } uint16_t idx = VariableNameGetIdx(de_ctx, (char *)value, VAR_TYPE_FLOW_VAR); ld->flowvar[ld->flowvars++] = idx; SCLogDebug("script uses flowvar %u with script id %u", idx, ld->flowvars - 1); } } lua_pop(luastate, 1); continue; } else if (strcmp(k, "flowint") == 0) { if (lua_istable(luastate, -1)) { lua_pushnil(luastate); while (lua_next(luastate, -2) != 0) { /* value at -1, key is at -2 which we ignore */ const char *value = lua_tostring(luastate, -1); SCLogDebug("value %s", value); /* removes 'value'; keeps 'key' for next iteration */ lua_pop(luastate, 1); if (ld->flowints == DETECT_LUAJIT_MAX_FLOWINTS) { SCLogError(SC_ERR_LUA_ERROR, "too many flowints registered"); goto error; } uint16_t idx = VariableNameGetIdx(de_ctx, (char *)value, VAR_TYPE_FLOW_INT); ld->flowint[ld->flowints++] = idx; SCLogDebug("script uses flowint %u with script id %u", idx, ld->flowints - 1); } } lua_pop(luastate, 1); continue; } v = lua_tostring(luastate, -1); lua_pop(luastate, 1); if (v == NULL) continue; SCLogDebug("k='%s', v='%s'", k, v); if (strcmp(k, "packet") == 0 && strcmp(v, "true") == 0) { ld->flags |= DATATYPE_PACKET; } else if (strcmp(k, "payload") == 0 && strcmp(v, "true") == 0) { ld->flags |= DATATYPE_PAYLOAD; } else if (strcmp(k, "stream") == 0 && strcmp(v, "true") == 0) { ld->flags |= DATATYPE_STREAM; ld->buffername = SCStrdup("stream"); if (ld->buffername == NULL) { SCLogError(SC_ERR_LUA_ERROR, "alloc error"); goto error; } } else if (strncmp(k, "http", 4) == 0 && strcmp(v, "true") == 0) { if (ld->alproto != ALPROTO_UNKNOWN && ld->alproto != ALPROTO_HTTP) { SCLogError(SC_ERR_LUA_ERROR, "can just inspect script against one app layer proto like HTTP at a time"); goto error; } if (ld->flags != 0) { SCLogError(SC_ERR_LUA_ERROR, "when inspecting HTTP buffers only a single buffer can be inspected"); goto error; } /* http types */ ld->alproto = ALPROTO_HTTP; if (strcmp(k, "http.uri") == 0) ld->flags |= DATATYPE_HTTP_URI; else if (strcmp(k, "http.uri.raw") == 0) ld->flags |= DATATYPE_HTTP_URI_RAW; else if (strcmp(k, "http.request_line") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_LINE; else if (strcmp(k, "http.request_headers") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_HEADERS; else if (strcmp(k, "http.request_headers.raw") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_HEADERS_RAW; else if (strcmp(k, "http.request_cookie") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_COOKIE; else if (strcmp(k, "http.request_user_agent") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_UA; else if (strcmp(k, "http.request_body") == 0) ld->flags |= DATATYPE_HTTP_REQUEST_BODY; else if (strcmp(k, "http.response_body") == 0) ld->flags |= DATATYPE_HTTP_RESPONSE_BODY; else if (strcmp(k, "http.response_cookie") == 0) ld->flags |= DATATYPE_HTTP_RESPONSE_COOKIE; else if (strcmp(k, "http.response_headers") == 0) ld->flags |= DATATYPE_HTTP_RESPONSE_HEADERS; else if (strcmp(k, "http.response_headers.raw") == 0) ld->flags |= DATATYPE_HTTP_RESPONSE_HEADERS_RAW; else { SCLogError(SC_ERR_LUA_ERROR, "unsupported http data type %s", k); goto error; } ld->buffername = SCStrdup(k); if (ld->buffername == NULL) { SCLogError(SC_ERR_LUA_ERROR, "alloc error"); goto error; } } else if (strncmp(k, "dns", 3) == 0 && strcmp(v, "true") == 0) { ld->alproto = ALPROTO_DNS; if (strcmp(k, "dns.rrname") == 0) ld->flags |= DATATYPE_DNS_RRNAME; else if (strcmp(k, "dns.request") == 0) ld->flags |= DATATYPE_DNS_REQUEST; else if (strcmp(k, "dns.response") == 0) ld->flags |= DATATYPE_DNS_RESPONSE; else { SCLogError(SC_ERR_LUA_ERROR, "unsupported dns data type %s", k); goto error; } ld->buffername = SCStrdup(k); if (ld->buffername == NULL) { SCLogError(SC_ERR_LUA_ERROR, "alloc error"); goto error; } } else if (strncmp(k, "tls", 3) == 0 && strcmp(v, "true") == 0) { ld->alproto = ALPROTO_TLS; ld->flags |= DATATYPE_TLS; } else if (strncmp(k, "ssh", 3) == 0 && strcmp(v, "true") == 0) { ld->alproto = ALPROTO_SSH; ld->flags |= DATATYPE_SSH; } else if (strncmp(k, "smtp", 4) == 0 && strcmp(v, "true") == 0) { ld->alproto = ALPROTO_SMTP; ld->flags |= DATATYPE_SMTP; } else if (strncmp(k, "dnp3", 4) == 0 && strcmp(v, "true") == 0) { ld->alproto = ALPROTO_DNP3; ld->flags |= DATATYPE_DNP3; } else { SCLogError(SC_ERR_LUA_ERROR, "unsupported data type %s", k); goto error; } } /* pop the table */ lua_pop(luastate, 1); lua_close(luastate); return 0; error: lua_close(luastate); return -1; } /** * \brief this function is used to parse lua options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "lua" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectLuaSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectLuaData *lua = NULL; SigMatch *sm = NULL; lua = DetectLuaParse(de_ctx, str); if (lua == NULL) goto error; if (DetectLuaSetupPrime(de_ctx, lua) == -1) { goto error; } lua->thread_ctx_id = DetectRegisterThreadCtxFuncs(de_ctx, "lua", DetectLuaThreadInit, (void *)lua, DetectLuaThreadFree, 0); if (lua->thread_ctx_id == -1) goto error; if (lua->alproto != ALPROTO_UNKNOWN) { if (s->alproto != ALPROTO_UNKNOWN && lua->alproto != s->alproto) { goto error; } s->alproto = lua->alproto; } /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_LUA; sm->ctx = (SigMatchCtx *)lua; if (lua->alproto == ALPROTO_UNKNOWN) { if (lua->flags & DATATYPE_STREAM) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_PMATCH); else SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); } else if (lua->alproto == ALPROTO_HTTP) { if (lua->flags & DATATYPE_HTTP_RESPONSE_BODY) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEDATA); else if (lua->flags & DATATYPE_HTTP_REQUEST_BODY) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCBDMATCH); else if (lua->flags & DATATYPE_HTTP_URI) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_UMATCH); else if (lua->flags & DATATYPE_HTTP_URI_RAW) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRUDMATCH); else if (lua->flags & DATATYPE_HTTP_REQUEST_COOKIE) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCDMATCH); else if (lua->flags & DATATYPE_HTTP_REQUEST_UA) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HUADMATCH); else if (lua->flags & (DATATYPE_HTTP_REQUEST_HEADERS|DATATYPE_HTTP_RESPONSE_HEADERS)) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HHDMATCH); else if (lua->flags & (DATATYPE_HTTP_REQUEST_HEADERS_RAW|DATATYPE_HTTP_RESPONSE_HEADERS_RAW)) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRHDMATCH); else if (lua->flags & DATATYPE_HTTP_RESPONSE_COOKIE) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCDMATCH); else SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HTTP_REQLINEMATCH); } else if (lua->alproto == ALPROTO_DNS) { if (lua->flags & DATATYPE_DNS_RRNAME) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSQUERYNAME_MATCH); } else if (lua->flags & DATATYPE_DNS_REQUEST) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSREQUEST_MATCH); } else if (lua->flags & DATATYPE_DNS_RESPONSE) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSRESPONSE_MATCH); } } else if (lua->alproto == ALPROTO_TLS) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); } else if (lua->alproto == ALPROTO_SSH) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); } else if (lua->alproto == ALPROTO_SMTP) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); } else if (lua->alproto == ALPROTO_DNP3) { SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNP3_MATCH); } else { SCLogError(SC_ERR_LUA_ERROR, "lua can't be used with protocol %s", AppLayerGetProtoName(lua->alproto)); goto error; } return 0; error: if (lua != NULL) DetectLuaFree(lua); if (sm != NULL) SCFree(sm); return -1; } /** \brief post-sig parse function to set the sid,rev,gid into the * ctx, as this isn't available yet during parsing. */ void DetectLuaPostSetup(Signature *s) { int i; SigMatch *sm; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { for (sm = s->sm_lists[i]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_LUA) continue; DetectLuaData *ld = (DetectLuaData *)sm->ctx; ld->sid = s->id; ld->rev = s->rev; ld->gid = s->gid; } } } /** * \brief this function will free memory associated with DetectLuaData * * \param ptr pointer to DetectLuaData */ static void DetectLuaFree(void *ptr) { if (ptr != NULL) { DetectLuaData *lua = (DetectLuaData *)ptr; if (lua->buffername) SCFree(lua->buffername); if (lua->filename) SCFree(lua->filename); SCFree(lua); } } #ifdef UNITTESTS /** \test http buffer */ static int LuaMatchTest01(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"http.request_headers\"] = tostring(true)\n" " needs[\"flowvar\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " a = ScFlowvarGet(0)\n" " if a then\n" " a = tostring(tonumber(a)+1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " else\n" " a = tostring(1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " end\n" " \n" " print (\"pre check: \" .. (a))\n" " if tonumber(a) == 2 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert http any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect for p1 */ SCLogDebug("inspecting p1"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match on p1 but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect for p2 */ SCLogDebug("inspecting p2"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_str.value_len != 1) { printf("%u != %u: ", fv->data.fv_str.value_len, 1); goto end; } if (memcmp(fv->data.fv_str.value, "2", 1) != 0) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); printf("buffer mismatch: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test payload buffer */ static int LuaMatchTest02(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"payload\"] = tostring(true)\n" " needs[\"flowvar\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " a = ScFlowvarGet(0)\n" " if a then\n" " a = tostring(tonumber(a)+1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " else\n" " a = tostring(1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " end\n" " \n" " print (\"pre check: \" .. (a))\n" " if tonumber(a) == 2 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert tcp any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); p2 = UTHBuildPacket(httpbuf2, httplen2, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match on p1 but should have: "); goto end; } /* do detect for p2 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_str.value_len != 1) { printf("%u != %u: ", fv->data.fv_str.value_len, 1); goto end; } if (memcmp(fv->data.fv_str.value, "2", 1) != 0) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); printf("buffer mismatch: "); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test packet buffer */ static int LuaMatchTest03(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"packet\"] = tostring(true)\n" " needs[\"flowvar\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " a = ScFlowvarGet(0)\n" " if a then\n" " a = tostring(tonumber(a)+1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " else\n" " a = tostring(1)\n" " print (a)\n" " ScFlowvarSet(0, a, #a)\n" " end\n" " \n" " print (\"pre check: \" .. (a))\n" " if tonumber(a) == 2 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert tcp any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); p2 = UTHBuildPacket(httpbuf2, httplen2, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* do detect for p1 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match on p1 but should have: "); goto end; } /* do detect for p2 */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_str.value_len != 1) { printf("%u != %u: ", fv->data.fv_str.value_len, 1); goto end; } if (memcmp(fv->data.fv_str.value, "2", 1) != 0) { PrintRawDataFp(stdout, fv->data.fv_str.value, fv->data.fv_str.value_len); printf("buffer mismatch: "); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test http buffer, flowints */ static int LuaMatchTest04(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"http.request_headers\"] = tostring(true)\n" " needs[\"flowint\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " print \"inspecting\"" " a = ScFlowintGet(0)\n" " if a then\n" " ScFlowintSet(0, a + 1)\n" " else\n" " ScFlowintSet(0, 1)\n" " end\n" " \n" " a = ScFlowintGet(0)\n" " if a == 2 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert http any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect for p1 */ SCLogInfo("p1"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect for p2 */ SCLogInfo("p2"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_int.value != 2) { printf("%u != %u: ", fv->data.fv_int.value, 2); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test http buffer, flowints */ static int LuaMatchTest05(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"http.request_headers\"] = tostring(true)\n" " needs[\"flowint\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " print \"inspecting\"" " a = ScFlowintIncr(0)\n" " if a == 2 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert http any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect for p1 */ SCLogInfo("p1"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect for p2 */ SCLogInfo("p2"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_int.value != 2) { printf("%u != %u: ", fv->data.fv_int.value, 2); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test http buffer, flowints */ static int LuaMatchTest06(void) { const char script[] = "function init (args)\n" " local needs = {}\n" " needs[\"http.request_headers\"] = tostring(true)\n" " needs[\"flowint\"] = {\"cnt\"}\n" " return needs\n" "end\n" "\n" "function match(args)\n" " print \"inspecting\"" " a = ScFlowintGet(0)\n" " if a == nil then\n" " print \"new var set to 2\"" " ScFlowintSet(0, 2)\n" " end\n" " a = ScFlowintDecr(0)\n" " if a == 0 then\n" " print \"match\"\n" " return 1\n" " end\n" " return 0\n" "end\n" "return 0\n"; char sig[] = "alert http any any -> any any (flow:to_server; lua:unittest; sid:1;)"; int result = 0; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n" "Host: www.emergingthreats.net\r\n\r\n"; uint8_t httpbuf2[] = "POST / HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Flow f; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); ut_script = script; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, sig); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); HtpState *http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect for p1 */ SCLogInfo("p1"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect for p2 */ SCLogInfo("p2"); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } FlowVar *fv = FlowVarGet(&f, 1); if (fv == NULL) { printf("no flowvar: "); goto end; } if (fv->data.fv_int.value != 0) { printf("%u != %u: ", fv->data.fv_int.value, 0); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif void DetectLuaRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("LuaMatchTest01", LuaMatchTest01); UtRegisterTest("LuaMatchTest02", LuaMatchTest02); UtRegisterTest("LuaMatchTest03", LuaMatchTest03); UtRegisterTest("LuaMatchTest04", LuaMatchTest04); UtRegisterTest("LuaMatchTest05", LuaMatchTest05); UtRegisterTest("LuaMatchTest06", LuaMatchTest06); #endif } #endif /* HAVE_LUAJIT */ suricata-3.2.1/src/host.c0000644000000000000000000004471413051004444012134 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Information about hosts. */ #include "suricata-common.h" #include "conf.h" #include "util-debug.h" #include "host.h" #include "host-storage.h" #include "host-bit.h" #include "util-random.h" #include "util-misc.h" #include "util-byte.h" #include "host-queue.h" #include "detect-tag.h" #include "detect-engine-tag.h" #include "detect-engine-threshold.h" #include "util-hash-lookup3.h" static Host *HostGetUsedHost(void); /** queue with spare hosts */ static HostQueue host_spare_q; /** size of the host object. Maybe updated in HostInitConfig to include * the storage APIs additions. */ static uint16_t g_host_size = sizeof(Host); uint32_t HostSpareQueueGetSize(void) { return HostQueueLen(&host_spare_q); } void HostMoveToSpare(Host *h) { HostEnqueue(&host_spare_q, h); (void) SC_ATOMIC_SUB(host_counter, 1); } Host *HostAlloc(void) { if (!(HOST_CHECK_MEMCAP(g_host_size))) { return NULL; } (void) SC_ATOMIC_ADD(host_memuse, g_host_size); Host *h = SCMalloc(g_host_size); if (unlikely(h == NULL)) goto error; memset(h, 0x00, g_host_size); SCMutexInit(&h->m, NULL); SC_ATOMIC_INIT(h->use_cnt); return h; error: return NULL; } void HostFree(Host *h) { if (h != NULL) { HostClearMemory(h); SC_ATOMIC_DESTROY(h->use_cnt); SCMutexDestroy(&h->m); SCFree(h); (void) SC_ATOMIC_SUB(host_memuse, g_host_size); } } Host *HostNew(Address *a) { Host *h = HostAlloc(); if (h == NULL) goto error; /* copy address */ COPY_ADDRESS(a, &h->a); return h; error: return NULL; } void HostClearMemory(Host *h) { if (h->iprep != NULL) { SCFree(h->iprep); h->iprep = NULL; } if (HostStorageSize() > 0) HostFreeStorage(h); } #define HOST_DEFAULT_HASHSIZE 4096 #define HOST_DEFAULT_MEMCAP 16777216 #define HOST_DEFAULT_PREALLOC 1000 /** \brief initialize the configuration * \warning Not thread safe */ void HostInitConfig(char quiet) { SCLogDebug("initializing host engine..."); if (HostStorageSize() > 0) g_host_size = sizeof(Host) + HostStorageSize(); memset(&host_config, 0, sizeof(host_config)); //SC_ATOMIC_INIT(flow_flags); SC_ATOMIC_INIT(host_counter); SC_ATOMIC_INIT(host_memuse); SC_ATOMIC_INIT(host_prune_idx); HostQueueInit(&host_spare_q); #ifndef AFLFUZZ_NO_RANDOM unsigned int seed = RandomTimePreseed(); /* set defaults */ host_config.hash_rand = (int)( HOST_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0)); #endif host_config.hash_size = HOST_DEFAULT_HASHSIZE; host_config.memcap = HOST_DEFAULT_MEMCAP; host_config.prealloc = HOST_DEFAULT_PREALLOC; /* Check if we have memcap and hash_size defined at config */ char *conf_val; uint32_t configval = 0; /** set config values for memcap, prealloc and hash_size */ if ((ConfGet("host.memcap", &conf_val)) == 1) { if (ParseSizeStringU64(conf_val, &host_config.memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing host.memcap " "from conf file - %s. Killing engine", conf_val); exit(EXIT_FAILURE); } } if ((ConfGet("host.hash-size", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { host_config.hash_size = configval; } } if ((ConfGet("host.prealloc", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { host_config.prealloc = configval; } else { WarnInvalidConfEntry("host.prealloc", "%"PRIu32, host_config.prealloc); } } SCLogDebug("Host config from suricata.yaml: memcap: %"PRIu64", hash-size: " "%"PRIu32", prealloc: %"PRIu32, host_config.memcap, host_config.hash_size, host_config.prealloc); /* alloc hash memory */ uint64_t hash_size = host_config.hash_size * sizeof(HostHashRow); if (!(HOST_CHECK_MEMCAP(hash_size))) { SCLogError(SC_ERR_HOST_INIT, "allocating host hash failed: " "max host memcap is smaller than projected hash size. " "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate " "total hash size by multiplying \"host.hash-size\" with %"PRIuMAX", " "which is the hash bucket size.", host_config.memcap, hash_size, (uintmax_t)sizeof(HostHashRow)); exit(EXIT_FAILURE); } host_hash = SCMallocAligned(host_config.hash_size * sizeof(HostHashRow), CLS); if (unlikely(host_hash == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in HostInitConfig. Exiting..."); exit(EXIT_FAILURE); } memset(host_hash, 0, host_config.hash_size * sizeof(HostHashRow)); uint32_t i = 0; for (i = 0; i < host_config.hash_size; i++) { HRLOCK_INIT(&host_hash[i]); } (void) SC_ATOMIC_ADD(host_memuse, (host_config.hash_size * sizeof(HostHashRow))); if (quiet == FALSE) { SCLogConfig("allocated %llu bytes of memory for the host hash... " "%" PRIu32 " buckets of size %" PRIuMAX "", SC_ATOMIC_GET(host_memuse), host_config.hash_size, (uintmax_t)sizeof(HostHashRow)); } /* pre allocate hosts */ for (i = 0; i < host_config.prealloc; i++) { if (!(HOST_CHECK_MEMCAP(g_host_size))) { SCLogError(SC_ERR_HOST_INIT, "preallocating hosts failed: " "max host memcap reached. Memcap %"PRIu64", " "Memuse %"PRIu64".", host_config.memcap, ((uint64_t)SC_ATOMIC_GET(host_memuse) + g_host_size)); exit(EXIT_FAILURE); } Host *h = HostAlloc(); if (h == NULL) { SCLogError(SC_ERR_HOST_INIT, "preallocating host failed: %s", strerror(errno)); exit(EXIT_FAILURE); } HostEnqueue(&host_spare_q,h); } if (quiet == FALSE) { SCLogConfig("preallocated %" PRIu32 " hosts of size %" PRIu16 "", host_spare_q.len, g_host_size); SCLogConfig("host memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(host_memuse), host_config.memcap); } return; } /** \brief print some host stats * \warning Not thread safe */ void HostPrintStats (void) { #ifdef HOSTBITS_STATS SCLogPerf("hostbits added: %" PRIu32 ", removed: %" PRIu32 ", max memory usage: %" PRIu32 "", hostbits_added, hostbits_removed, hostbits_memuse_max); #endif /* HOSTBITS_STATS */ SCLogPerf("host memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(host_memuse), host_config.memcap); return; } /** \brief shutdown the flow engine * \warning Not thread safe */ void HostShutdown(void) { Host *h; uint32_t u; HostPrintStats(); /* free spare queue */ while((h = HostDequeue(&host_spare_q))) { BUG_ON(SC_ATOMIC_GET(h->use_cnt) > 0); HostFree(h); } /* clear and free the hash */ if (host_hash != NULL) { for (u = 0; u < host_config.hash_size; u++) { h = host_hash[u].head; while (h) { Host *n = h->hnext; HostFree(h); h = n; } HRLOCK_DESTROY(&host_hash[u]); } SCFreeAligned(host_hash); host_hash = NULL; } (void) SC_ATOMIC_SUB(host_memuse, host_config.hash_size * sizeof(HostHashRow)); HostQueueDestroy(&host_spare_q); SC_ATOMIC_DESTROY(host_prune_idx); SC_ATOMIC_DESTROY(host_memuse); SC_ATOMIC_DESTROY(host_counter); //SC_ATOMIC_DESTROY(flow_flags); return; } /** \brief Cleanup the host engine * * Cleanup the host engine from tag and threshold. * */ void HostCleanup(void) { Host *h; uint32_t u; if (host_hash != NULL) { for (u = 0; u < host_config.hash_size; u++) { h = host_hash[u].head; HostHashRow *hb = &host_hash[u]; HRLOCK_LOCK(hb); while (h) { if ((SC_ATOMIC_GET(h->use_cnt) > 0) && (h->iprep != NULL)) { /* iprep is attached to host only clear local storage */ HostFreeStorage(h); h = h->hnext; } else { Host *n = h->hnext; /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; HostClearMemory(h); HostMoveToSpare(h); h = n; } } HRLOCK_UNLOCK(hb); } } return; } /* calculate the hash key for this packet * * we're using: * hash_rand -- set at init time * source address */ uint32_t HostGetKey(Address *a) { uint32_t key; if (a->family == AF_INET) { uint32_t hash = hashword(&a->addr_data32[0], 1, host_config.hash_rand); key = hash % host_config.hash_size; } else if (a->family == AF_INET6) { uint32_t hash = hashword(a->addr_data32, 4, host_config.hash_rand); key = hash % host_config.hash_size; } else key = 0; return key; } /* Since two or more hosts can have the same hash key, we need to compare * the flow with the current flow key. */ #define CMP_HOST(h,a) \ (CMP_ADDR(&(h)->a, (a))) static inline int HostCompare(Host *h, Address *a) { return CMP_HOST(h, a); } /** * \brief Get a new host * * Get a new host. We're checking memcap first and will try to make room * if the memcap is reached. * * \retval h *LOCKED* host on succes, NULL on error. */ static Host *HostGetNew(Address *a) { Host *h = NULL; /* get a host from the spare queue */ h = HostDequeue(&host_spare_q); if (h == NULL) { /* If we reached the max memcap, we get a used host */ if (!(HOST_CHECK_MEMCAP(g_host_size))) { /* declare state of emergency */ //if (!(SC_ATOMIC_GET(host_flags) & HOST_EMERGENCY)) { // SC_ATOMIC_OR(host_flags, HOST_EMERGENCY); /* under high load, waking up the flow mgr each time leads * to high cpu usage. Flows are not timed out much faster if * we check a 1000 times a second. */ // FlowWakeupFlowManagerThread(); //} h = HostGetUsedHost(); if (h == NULL) { return NULL; } /* freed a host, but it's unlocked */ } else { /* now see if we can alloc a new host */ h = HostNew(a); if (h == NULL) { return NULL; } /* host is initialized but *unlocked* */ } } else { /* host has been recycled before it went into the spare queue */ /* host is initialized (recylced) but *unlocked* */ } (void) SC_ATOMIC_ADD(host_counter, 1); SCMutexLock(&h->m); return h; } void HostInit(Host *h, Address *a) { COPY_ADDRESS(a, &h->a); (void) HostIncrUsecnt(h); } void HostRelease(Host *h) { (void) HostDecrUsecnt(h); SCMutexUnlock(&h->m); } void HostLock(Host *h) { SCMutexLock(&h->m); } void HostUnlock(Host *h) { SCMutexUnlock(&h->m); } /* HostGetHostFromHash * * Hash retrieval function for hosts. Looks up the hash bucket containing the * host pointer. Then compares the packet with the found host to see if it is * the host we need. If it isn't, walk the list until the right host is found. * * returns a *LOCKED* host or NULL */ Host *HostGetHostFromHash (Address *a) { Host *h = NULL; /* get the key to our bucket */ uint32_t key = HostGetKey(a); /* get our hash bucket and lock it */ HostHashRow *hb = &host_hash[key]; HRLOCK_LOCK(hb); /* see if the bucket already has a host */ if (hb->head == NULL) { h = HostGetNew(a); if (h == NULL) { HRLOCK_UNLOCK(hb); return NULL; } /* host is locked */ hb->head = h; hb->tail = h; /* got one, now lock, initialize and return */ HostInit(h,a); HRLOCK_UNLOCK(hb); return h; } /* ok, we have a host in the bucket. Let's find out if it is our host */ h = hb->head; /* see if this is the host we are looking for */ if (HostCompare(h, a) == 0) { Host *ph = NULL; /* previous host */ while (h) { ph = h; h = h->hnext; if (h == NULL) { h = ph->hnext = HostGetNew(a); if (h == NULL) { HRLOCK_UNLOCK(hb); return NULL; } hb->tail = h; /* host is locked */ h->hprev = ph; /* initialize and return */ HostInit(h,a); HRLOCK_UNLOCK(hb); return h; } if (HostCompare(h, a) != 0) { /* we found our host, lets put it on top of the * hash list -- this rewards active hosts */ if (h->hnext) { h->hnext->hprev = h->hprev; } if (h->hprev) { h->hprev->hnext = h->hnext; } if (h == hb->tail) { hb->tail = h->hprev; } h->hnext = hb->head; h->hprev = NULL; hb->head->hprev = h; hb->head = h; /* found our host, lock & return */ SCMutexLock(&h->m); (void) HostIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } } } /* lock & return */ SCMutexLock(&h->m); (void) HostIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } /** \brief look up a host in the hash * * \param a address to look up * * \retval h *LOCKED* host or NULL */ Host *HostLookupHostFromHash (Address *a) { Host *h = NULL; /* get the key to our bucket */ uint32_t key = HostGetKey(a); /* get our hash bucket and lock it */ HostHashRow *hb = &host_hash[key]; HRLOCK_LOCK(hb); /* see if the bucket already has a host */ if (hb->head == NULL) { HRLOCK_UNLOCK(hb); return h; } /* ok, we have a host in the bucket. Let's find out if it is our host */ h = hb->head; /* see if this is the host we are looking for */ if (HostCompare(h, a) == 0) { while (h) { h = h->hnext; if (h == NULL) { HRLOCK_UNLOCK(hb); return h; } if (HostCompare(h, a) != 0) { /* we found our host, lets put it on top of the * hash list -- this rewards active hosts */ if (h->hnext) { h->hnext->hprev = h->hprev; } if (h->hprev) { h->hprev->hnext = h->hnext; } if (h == hb->tail) { hb->tail = h->hprev; } h->hnext = hb->head; h->hprev = NULL; hb->head->hprev = h; hb->head = h; /* found our host, lock & return */ SCMutexLock(&h->m); (void) HostIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } } } /* lock & return */ SCMutexLock(&h->m); (void) HostIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } /** \internal * \brief Get a host from the hash directly. * * Called in conditions where the spare queue is empty and memcap is reached. * * Walks the hash until a host can be freed. "host_prune_idx" atomic int makes * sure we don't start at the top each time since that would clear the top of * the hash leading to longer and longer search times under high pressure (observed). * * \retval h host or NULL */ static Host *HostGetUsedHost(void) { uint32_t idx = SC_ATOMIC_GET(host_prune_idx) % host_config.hash_size; uint32_t cnt = host_config.hash_size; while (cnt--) { if (++idx >= host_config.hash_size) idx = 0; HostHashRow *hb = &host_hash[idx]; if (HRLOCK_TRYLOCK(hb) != 0) continue; Host *h = hb->tail; if (h == NULL) { HRLOCK_UNLOCK(hb); continue; } if (SCMutexTrylock(&h->m) != 0) { HRLOCK_UNLOCK(hb); continue; } /** never prune a host that is used by a packets * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(h->use_cnt) > 0) { HRLOCK_UNLOCK(hb); SCMutexUnlock(&h->m); continue; } /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; HRLOCK_UNLOCK(hb); HostClearMemory (h); SCMutexUnlock(&h->m); (void) SC_ATOMIC_ADD(host_prune_idx, (host_config.hash_size - cnt)); return h; } return NULL; } void HostRegisterUnittests(void) { RegisterHostStorageTests(); } suricata-3.2.1/src/detect-engine-prefilter.c0000644000000000000000000004243413051004444015661 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Prefilter engine * * Prefilter engines have as purpose to check for a critical common part of * a set of rules. If the condition is present in the traffic, the rules * will have to be inspected individually. Otherwise, the rules can be * skipped. * * The best example of this is the MPM. From each rule take a pattern and * add it to the MPM state machine. Inspect that in one step and only * individually inspect the rules that had a match in MPM. * * This prefilter API is designed to abstract this logic so that it becomes * easier to add other types of prefilters. * * The prefilter engines are structured as a simple list of engines. Each * engine checks for a condition using it's callback function and private * data. It then adds the rule match candidates to the PrefilterRuleStore * structure. * * After the engines have run the resulting list of match candidates is * sorted by the rule id's so that the individual inspection happens in * the correct order. */ #include "suricata-common.h" #include "suricata.h" #include "detect-engine-prefilter.h" #include "detect-engine-mpm.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "util-profiling.h" typedef struct PrefilterStore_ { const char *name; void (*FreeFunc)(void *); uint32_t id; } PrefilterStore; static int PrefilterStoreGetId(const char *name, void (*FreeFunc)(void *)); static const PrefilterStore *PrefilterStoreGetStore(const uint32_t id); static inline void QuickSortSigIntId(SigIntId *sids, uint32_t n) { if (n < 2) return; SigIntId p = sids[n / 2]; SigIntId *l = sids; SigIntId *r = sids + n - 1; while (l <= r) { if (*l < p) l++; else if (*r > p) r--; else { SigIntId t = *l; *l = *r; *r = t; l++; r--; } } QuickSortSigIntId(sids, r - sids + 1); QuickSortSigIntId(l, sids + n - l); } static inline void PrefilterTx(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags) { SCEnter(); const AppProto alproto = p->flow->alproto; const uint8_t ipproto = p->proto; if (!(AppLayerParserProtocolIsTxAware(ipproto, alproto))) SCReturn; void *alstate = p->flow->alstate; uint64_t idx = AppLayerParserGetTransactionInspectId(p->flow->alparser, flags); const uint64_t total_txs = AppLayerParserGetTxCnt(ipproto, alproto, alstate); /* HACK test HTTP state here instead of in each engine */ if (alproto == ALPROTO_HTTP) { HtpState *htp_state = (HtpState *)alstate; if (unlikely(htp_state->connp == NULL)) { SCLogDebug("no HTTP connp"); SCReturn; } } /* run our engines against each tx */ for (; idx < total_txs; idx++) { void *tx = AppLayerParserGetTx(ipproto, alproto, alstate, idx); if (tx == NULL) continue; const int tx_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags); SCLogDebug("tx %p progress %d", tx, tx_progress); PrefilterEngine *engine = sgh->tx_engines; do { if (engine->alproto != alproto) goto next; if (engine->tx_min_progress > tx_progress) goto next; PROFILING_PREFILTER_START(p); engine->cb.PrefilterTx(det_ctx, engine->pectx, p, p->flow, tx, idx, flags); PROFILING_PREFILTER_END(p, engine->gid); next: if (engine->is_last) break; engine++; } while (1); } } void Prefilter(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const uint8_t flags, int has_state) { SCEnter(); PROFILING_PREFILTER_RESET(p, det_ctx->de_ctx->prefilter_maxid); if (sgh->pkt_engines) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_PKT); /* run packet engines */ PrefilterEngine *engine = sgh->pkt_engines; do { PROFILING_PREFILTER_START(p); engine->cb.Prefilter(det_ctx, p, engine->pectx); PROFILING_PREFILTER_END(p, engine->gid); if (engine->is_last) break; engine++; } while (1); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_PKT); } /* run payload inspecting engines */ if (sgh->payload_engines && (p->payload_len > 0 || det_ctx->smsg != NULL) && !(p->flags & PKT_NOPAYLOAD_INSPECTION)) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_PAYLOAD); PrefilterEngine *engine = sgh->payload_engines; while (1) { PROFILING_PREFILTER_START(p); engine->cb.Prefilter(det_ctx, p, engine->pectx); PROFILING_PREFILTER_END(p, engine->gid); if (engine->is_last) break; engine++; } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_PAYLOAD); } /* run tx engines */ if (((p->proto == IPPROTO_TCP && p->flowflags & FLOW_PKT_ESTABLISHED) || p->proto != IPPROTO_TCP) && has_state) { if (sgh->tx_engines != NULL && p->flow != NULL && p->flow->alproto != ALPROTO_UNKNOWN && p->flow->alstate != NULL) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_TX); PrefilterTx(det_ctx, sgh, p, flags); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_TX); } } /* Sort the rule list to lets look at pmq. * NOTE due to merging of 'stream' pmqs we *MAY* have duplicate entries */ if (likely(det_ctx->pmq.rule_id_array_cnt > 1)) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT1); QuickSortSigIntId(det_ctx->pmq.rule_id_array, det_ctx->pmq.rule_id_array_cnt); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT1); } } int PrefilterAppendEngine(SigGroupHead *sgh, void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void (*FreeFunc)(void *pectx), const char *name) { if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL) return -1; PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS); if (e == NULL) return -1; memset(e, 0x00, sizeof(*e)); e->Prefilter = PrefilterFunc; e->pectx = pectx; e->Free = FreeFunc; if (sgh->init->pkt_engines == NULL) { sgh->init->pkt_engines = e; } else { PrefilterEngineList *t = sgh->init->pkt_engines; while (t->next != NULL) { t = t->next; } t->next = e; e->id = t->id + 1; } e->name = name; e->gid = PrefilterStoreGetId(e->name, e->Free); return 0; } int PrefilterAppendPayloadEngine(SigGroupHead *sgh, void (*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void (*FreeFunc)(void *pectx), const char *name) { if (sgh == NULL || PrefilterFunc == NULL || pectx == NULL) return -1; PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS); if (e == NULL) return -1; memset(e, 0x00, sizeof(*e)); e->Prefilter = PrefilterFunc; e->pectx = pectx; e->Free = FreeFunc; if (sgh->init->payload_engines == NULL) { sgh->init->payload_engines = e; } else { PrefilterEngineList *t = sgh->init->payload_engines; while (t->next != NULL) { t = t->next; } t->next = e; e->id = t->id + 1; } e->name = name; e->gid = PrefilterStoreGetId(e->name, e->Free); return 0; } int PrefilterAppendTxEngine(SigGroupHead *sgh, void (*PrefilterTxFunc)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags), AppProto alproto, int tx_min_progress, void *pectx, void (*FreeFunc)(void *pectx), const char *name) { if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL) return -1; PrefilterEngineList *e = SCMallocAligned(sizeof(*e), CLS); if (e == NULL) return -1; memset(e, 0x00, sizeof(*e)); e->PrefilterTx = PrefilterTxFunc; e->pectx = pectx; e->alproto = alproto; e->tx_min_progress = tx_min_progress; e->Free = FreeFunc; if (sgh->init->tx_engines == NULL) { sgh->init->tx_engines = e; } else { PrefilterEngineList *t = sgh->init->tx_engines; while (t->next != NULL) { t = t->next; } t->next = e; e->id = t->id + 1; } e->name = name; e->gid = PrefilterStoreGetId(e->name, e->Free); return 0; } static void PrefilterFreeEngineList(PrefilterEngineList *e) { if (e->Free && e->pectx) { e->Free(e->pectx); } SCFreeAligned(e); } void PrefilterFreeEnginesList(PrefilterEngineList *list) { PrefilterEngineList *t = list; while (t != NULL) { PrefilterEngineList *next = t->next; PrefilterFreeEngineList(t); t = next; } } static void PrefilterFreeEngines(PrefilterEngine *list) { PrefilterEngine *t = list; while (1) { const PrefilterStore *s = PrefilterStoreGetStore(t->gid); if (s && s->FreeFunc && t->pectx) { s->FreeFunc(t->pectx); } if (t->is_last) break; t++; } SCFreeAligned(list); } void PrefilterCleanupRuleGroup(SigGroupHead *sgh) { if (sgh->pkt_engines) { PrefilterFreeEngines(sgh->pkt_engines); sgh->pkt_engines = NULL; } if (sgh->payload_engines) { PrefilterFreeEngines(sgh->payload_engines); sgh->payload_engines = NULL; } if (sgh->tx_engines) { PrefilterFreeEngines(sgh->tx_engines); sgh->tx_engines = NULL; } } void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { BUG_ON(PatternMatchPrepareGroup(de_ctx, sgh) != 0); if (de_ctx->prefilter_setting == DETECT_PREFILTER_AUTO) { int i = 0; for (i = 0; i < DETECT_TBLSIZE; i++) { if (sigmatch_table[i].SetupPrefilter != NULL) { sigmatch_table[i].SetupPrefilter(sgh); } } } /* we have lists of engines in sgh->init now. Lets setup the * match arrays */ PrefilterEngineList *el; if (sgh->init->pkt_engines != NULL) { uint32_t cnt = 0; for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) { cnt++; de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid); } sgh->pkt_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS); if (sgh->pkt_engines == NULL) { return; } memset(sgh->pkt_engines, 0x00, (cnt * sizeof(PrefilterEngine))); PrefilterEngine *e = sgh->pkt_engines; for (el = sgh->init->pkt_engines ; el != NULL; el = el->next) { e->id = el->id; e->cb.Prefilter = el->Prefilter; e->pectx = el->pectx; el->pectx = NULL; // e now owns the ctx e->gid = el->gid; if (el->next == NULL) { e->is_last = TRUE; } e++; } } if (sgh->init->payload_engines != NULL) { uint32_t cnt = 0; for (el = sgh->init->payload_engines ; el != NULL; el = el->next) { cnt++; de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid); } sgh->payload_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS); if (sgh->payload_engines == NULL) { return; } memset(sgh->payload_engines, 0x00, (cnt * sizeof(PrefilterEngine))); PrefilterEngine *e = sgh->payload_engines; for (el = sgh->init->payload_engines ; el != NULL; el = el->next) { e->id = el->id; e->cb.Prefilter = el->Prefilter; e->pectx = el->pectx; el->pectx = NULL; // e now owns the ctx e->gid = el->gid; if (el->next == NULL) { e->is_last = TRUE; } e++; } } if (sgh->init->tx_engines != NULL) { uint32_t cnt = 0; for (el = sgh->init->tx_engines ; el != NULL; el = el->next) { cnt++; de_ctx->prefilter_maxid = MAX(de_ctx->prefilter_maxid, el->gid); } sgh->tx_engines = SCMallocAligned(cnt * sizeof(PrefilterEngine), CLS); if (sgh->tx_engines == NULL) { return; } memset(sgh->tx_engines, 0x00, (cnt * sizeof(PrefilterEngine))); PrefilterEngine *e = sgh->tx_engines; for (el = sgh->init->tx_engines ; el != NULL; el = el->next) { e->id = el->id; e->alproto = el->alproto; e->tx_min_progress = el->tx_min_progress; e->cb.PrefilterTx = el->PrefilterTx; e->pectx = el->pectx; el->pectx = NULL; // e now owns the ctx e->gid = el->gid; if (el->next == NULL) { e->is_last = TRUE; } e++; } } } /* hash table for assigning a unique id to each engine type. */ static uint32_t PrefilterStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen) { PrefilterStore *ctx = data; uint32_t hash = strlen(ctx->name); uint16_t u; for (u = 0; u < strlen(ctx->name); u++) { hash += ctx->name[u]; } hash %= ht->array_size; return hash; } static char PrefilterStoreCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { PrefilterStore *ctx1 = data1; PrefilterStore *ctx2 = data2; return (strcmp(ctx1->name, ctx2->name) == 0); } static void PrefilterStoreFreeFunc(void *ptr) { SCFree(ptr); } static SCMutex g_prefilter_mutex = SCMUTEX_INITIALIZER; static uint32_t g_prefilter_id = 0; static HashListTable *g_prefilter_hash_table = NULL; static void PrefilterDeinit(void) { SCMutexLock(&g_prefilter_mutex); BUG_ON(g_prefilter_hash_table == NULL); HashListTableFree(g_prefilter_hash_table); SCMutexUnlock(&g_prefilter_mutex); } static void PrefilterInit(void) { SCMutexLock(&g_prefilter_mutex); BUG_ON(g_prefilter_hash_table != NULL); g_prefilter_hash_table = HashListTableInit(256, PrefilterStoreHashFunc, PrefilterStoreCompareFunc, PrefilterStoreFreeFunc); BUG_ON(g_prefilter_hash_table == NULL); atexit(PrefilterDeinit); SCMutexUnlock(&g_prefilter_mutex); } static int PrefilterStoreGetId(const char *name, void (*FreeFunc)(void *)) { PrefilterStore ctx = { name, FreeFunc, 0 }; if (g_prefilter_hash_table == NULL) { PrefilterInit(); } SCLogDebug("looking up %s", name); SCMutexLock(&g_prefilter_mutex); PrefilterStore *rctx = HashListTableLookup(g_prefilter_hash_table, (void *)&ctx, 0); if (rctx != NULL) { SCMutexUnlock(&g_prefilter_mutex); return rctx->id; } PrefilterStore *actx = SCCalloc(1, sizeof(*actx)); if (actx == NULL) { SCMutexUnlock(&g_prefilter_mutex); return -1; } actx->name = name; actx->FreeFunc = FreeFunc; actx->id = g_prefilter_id++; SCLogDebug("prefilter engine %s has profile id %u", actx->name, actx->id); int ret = HashListTableAdd(g_prefilter_hash_table, actx, 0); if (ret != 0) { SCMutexUnlock(&g_prefilter_mutex); SCFree(actx); return -1; } int r = actx->id; SCMutexUnlock(&g_prefilter_mutex); return r; } /** \warning slow */ static const PrefilterStore *PrefilterStoreGetStore(const uint32_t id) { const PrefilterStore *store = NULL; SCMutexLock(&g_prefilter_mutex); if (g_prefilter_hash_table != NULL) { HashListTableBucket *hb = HashListTableGetListHead(g_prefilter_hash_table); for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) { PrefilterStore *ctx = HashListTableGetListData(hb); if (ctx->id == id) { store = ctx; break; } } } SCMutexUnlock(&g_prefilter_mutex); return store; } /** \warning slow */ const char *PrefilterStoreGetName(const uint32_t id) { const char *name = NULL; SCMutexLock(&g_prefilter_mutex); if (g_prefilter_hash_table != NULL) { HashListTableBucket *hb = HashListTableGetListHead(g_prefilter_hash_table); for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) { PrefilterStore *ctx = HashListTableGetListData(hb); if (ctx->id == id) { name = ctx->name; break; } } } SCMutexUnlock(&g_prefilter_mutex); return name; } suricata-3.2.1/src/source-af-packet.h0000644000000000000000000001016713051004444014310 00000000000000/* Copyright (C) 2011,2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __SOURCE_AFP_H__ #define __SOURCE_AFP_H__ #ifndef HAVE_PACKET_FANOUT /* not defined if linux/if_packet.h trying to force */ #define HAVE_PACKET_FANOUT 1 #define PACKET_FANOUT 18 #define PACKET_FANOUT_HASH 0 #define PACKET_FANOUT_LB 1 #define PACKET_FANOUT_CPU 2 #define PACKET_FANOUT_ROLLOVER 3 #define PACKET_FANOUT_RND 4 #define PACKET_FANOUT_QM 5 #define PACKET_FANOUT_FLAG_ROLLOVER 0x1000 #define PACKET_FANOUT_FLAG_DEFRAG 0x8000 #else /* HAVE_PACKET_FANOUT */ #include #endif /* HAVE_PACKET_FANOUT */ #include "queue.h" /* value for flags */ #define AFP_RING_MODE (1<<0) #define AFP_ZERO_COPY (1<<1) #define AFP_SOCK_PROTECT (1<<2) #define AFP_EMERGENCY_MODE (1<<3) #define AFP_TPACKET_V3 (1<<4) #define AFP_VLAN_DISABLED (1<<5) #define AFP_MMAP_LOCKED (1<<6) #define AFP_COPY_MODE_NONE 0 #define AFP_COPY_MODE_TAP 1 #define AFP_COPY_MODE_IPS 2 #define AFP_FILE_MAX_PKTS 256 #define AFP_IFACE_NAME_LENGTH 48 /* In kernel the allocated block size is allocated using the formula * page_size << order. So default value is using the same formula with * an order of 3 which guarantee we have some room in the block compared * to standard frame size */ #define AFP_BLOCK_SIZE_DEFAULT_ORDER 3 typedef struct AFPIfaceConfig_ { char iface[AFP_IFACE_NAME_LENGTH]; /* number of threads */ int threads; /* socket buffer size */ int buffer_size; /* ring size in number of packets */ int ring_size; /* block size for tpacket_v3 in */ int block_size; /* block timeout for tpacket_v3 in milliseconds */ int block_timeout; /* cluster param */ int cluster_id; int cluster_type; /* promisc mode */ int promisc; /* misc use flags including ring mode */ int flags; int copy_mode; ChecksumValidationMode checksum_mode; char *bpf_filter; char *out_iface; SC_ATOMIC_DECLARE(unsigned int, ref); void (*DerefFunc)(void *); } AFPIfaceConfig; /** * \ingroup afppeers * @{ */ typedef struct AFPPeer_ { SC_ATOMIC_DECLARE(int, socket); SC_ATOMIC_DECLARE(int, sock_usage); SC_ATOMIC_DECLARE(int, if_idx); int flags; SCMutex sock_protect; int turn; /**< Field used to store initialisation order. */ SC_ATOMIC_DECLARE(uint8_t, state); struct AFPPeer_ *peer; TAILQ_ENTRY(AFPPeer_) next; char iface[AFP_IFACE_NAME_LENGTH]; } AFPPeer; /** * \brief per packet AF_PACKET vars * * This structure is used y the release data system and is cleaned * up by the AFPV_CLEANUP macro below. */ typedef struct AFPPacketVars_ { void *relptr; AFPPeer *peer; /**< Sending peer for IPS/TAP mode */ /** Pointer to ::AFPPeer used for capture. Field is used to be able * to do reference counting. */ AFPPeer *mpeer; uint8_t copy_mode; } AFPPacketVars; #define AFPV_CLEANUP(afpv) do { \ (afpv)->relptr = NULL; \ (afpv)->copy_mode = 0; \ (afpv)->peer = NULL; \ (afpv)->mpeer = NULL; \ } while(0) /** * @} */ void TmModuleReceiveAFPRegister (void); void TmModuleDecodeAFPRegister (void); TmEcode AFPPeersListInit(); TmEcode AFPPeersListCheck(); void AFPPeersListClean(); int AFPGetLinkType(const char *ifname); int AFPIsFanoutSupported(void); #endif /* __SOURCE_AFP_H__ */ suricata-3.2.1/src/util-debug.h0000644000000000000000000005547413051004444013232 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_DEBUG_H__ #define __UTIL_DEBUG_H__ #include #include #include #include "threads.h" #include "util-enum.h" #include "util-error.h" #include "util-debug-filters.h" /** * \brief ENV vars that can be used to set the properties for the logging module */ #define SC_LOG_ENV_LOG_LEVEL "SC_LOG_LEVEL" #define SC_LOG_ENV_LOG_OP_IFACE "SC_LOG_OP_IFACE" #define SC_LOG_ENV_LOG_FILE "SC_LOG_FILE" #define SC_LOG_ENV_LOG_FACILITY "SC_LOG_FACILITY" #define SC_LOG_ENV_LOG_FORMAT "SC_LOG_FORMAT" #define SC_LOG_ENV_LOG_OP_FILTER "SC_LOG_OP_FILTER" /** * \brief The various log levels */ typedef enum { SC_LOG_NOTSET = -1, SC_LOG_NONE = 0, SC_LOG_EMERGENCY, SC_LOG_ALERT, SC_LOG_CRITICAL, SC_LOG_ERROR, SC_LOG_WARNING, SC_LOG_NOTICE, SC_LOG_INFO, SC_LOG_PERF, SC_LOG_CONFIG, SC_LOG_DEBUG, SC_LOG_LEVEL_MAX, } SCLogLevel; /** * \brief The various output interfaces supported */ typedef enum { SC_LOG_OP_IFACE_CONSOLE, SC_LOG_OP_IFACE_FILE, SC_LOG_OP_IFACE_SYSLOG, SC_LOG_OP_IFACE_MAX, } SCLogOPIface; typedef enum { SC_LOG_OP_TYPE_REGULAR = 0, SC_LOG_OP_TYPE_JSON, } SCLogOPType; /* The default log_format, if it is not supplied by the user */ #ifdef RELEASE #define SC_LOG_DEF_LOG_FORMAT "%t - <%d> - " #else #define SC_LOG_DEF_LOG_FORMAT "[%i] %t - (%f:%l) <%d> (%n) -- " #endif /* The maximum length of the log message */ #define SC_LOG_MAX_LOG_MSG_LEN 2048 /* The maximum length of the log format */ #define SC_LOG_MAX_LOG_FORMAT_LEN 128 /* The default log level, if it is not supplied by the user */ #define SC_LOG_DEF_LOG_LEVEL SC_LOG_INFO /* The default output interface to be used */ #define SC_LOG_DEF_LOG_OP_IFACE SC_LOG_OP_IFACE_CONSOLE /* The default log file to be used */ #define SC_LOG_DEF_LOG_FILE "sc_ids_log.log" /* The default syslog facility to be used */ #define SC_LOG_DEF_SYSLOG_FACILITY_STR "local0" #define SC_LOG_DEF_SYSLOG_FACILITY LOG_LOCAL0 /** * \brief Structure to be used when log_level override support would be provided * by the logging module */ typedef struct SCLogOPBuffer_ { char msg[SC_LOG_MAX_LOG_MSG_LEN]; char *temp; const char *log_format; } SCLogOPBuffer; /** * \brief The output interface context for the logging module */ typedef struct SCLogOPIfaceCtx_ { SCLogOPIface iface; int16_t use_color; int16_t type; /* the output file to be used if the interface is SC_LOG_IFACE_FILE */ const char *file; /* the output file descriptor for the above file */ FILE * file_d; /* registered to be set on a file rotation signal */ int rotation_flag; /* the facility code if the interface is SC_LOG_IFACE_SYSLOG */ int facility; /* override for the global_log_level */ SCLogLevel log_level; /* override for the global_log_format(currently not used) */ const char *log_format; struct SCLogOPIfaceCtx_ *next; } SCLogOPIfaceCtx; /** * \brief Structure containing init data, that would be passed to * SCInitDebugModule() */ typedef struct SCLogInitData_ { /* startup message */ char *startup_message; /* the log level */ SCLogLevel global_log_level; /* the log format */ char *global_log_format; /* output filter */ char *op_filter; /* list of output interfaces to be used */ SCLogOPIfaceCtx *op_ifaces; /* no of op ifaces */ uint8_t op_ifaces_cnt; } SCLogInitData; /** * \brief Holds the config state used by the logging api */ typedef struct SCLogConfig_ { char *startup_message; SCLogLevel log_level; char *log_format; char *op_filter; /* compiled pcre filter expression */ pcre *op_filter_regex; pcre_extra *op_filter_regex_study; /* op ifaces used */ SCLogOPIfaceCtx *op_ifaces; /* no of op ifaces */ uint8_t op_ifaces_cnt; } SCLogConfig; /* The different log format specifiers supported by the API */ #define SC_LOG_FMT_TIME 't' /* Timestamp in standard format */ #define SC_LOG_FMT_PID 'p' /* PID */ #define SC_LOG_FMT_TID 'i' /* Thread ID */ #define SC_LOG_FMT_TM 'm' /* Thread module name */ #define SC_LOG_FMT_LOG_LEVEL 'd' /* Log level */ #define SC_LOG_FMT_FILE_NAME 'f' /* File name */ #define SC_LOG_FMT_LINE 'l' /* Line number */ #define SC_LOG_FMT_FUNCTION 'n' /* Function */ /* The log format prefix for the format specifiers */ #define SC_LOG_FMT_PREFIX '%' extern SCLogLevel sc_log_global_log_level; extern int sc_log_module_initialized; extern int sc_log_module_cleaned; #define SCLog(x, file, func, line, ...) \ do { \ if (sc_log_global_log_level >= x && \ (sc_log_fg_filters_present == 0 || \ SCLogMatchFGFilterWL(file, func, line) == 1 || \ SCLogMatchFGFilterBL(file, func, line) == 1) && \ (sc_log_fd_filters_present == 0 || \ SCLogMatchFDFilter(func) == 1)) \ { \ char _sc_log_msg[SC_LOG_MAX_LOG_MSG_LEN]; \ \ snprintf(_sc_log_msg, SC_LOG_MAX_LOG_MSG_LEN, __VA_ARGS__); \ \ SCLogMessage(x, file, line, func, SC_OK, _sc_log_msg); \ } \ } while(0) #define SCLogErr(x, file, func, line, err, ...) \ do { \ if (sc_log_global_log_level >= x && \ (sc_log_fg_filters_present == 0 || \ SCLogMatchFGFilterWL(file, func, line) == 1 || \ SCLogMatchFGFilterBL(file, func, line) == 1) && \ (sc_log_fd_filters_present == 0 || \ SCLogMatchFDFilter(func) == 1)) \ { \ char _sc_log_msg[SC_LOG_MAX_LOG_MSG_LEN]; \ \ snprintf(_sc_log_msg, SC_LOG_MAX_LOG_MSG_LEN, __VA_ARGS__); \ \ SCLogMessage(x, file, line, func, err, _sc_log_msg); \ } \ } while(0) /** * \brief Macro used to log INFORMATIONAL messages. * * \retval ... Takes as argument(s), a printf style format message */ #define SCLogInfo(...) SCLog(SC_LOG_INFO, \ __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__) #define SCLogInfoRaw(file, func, line, ...) SCLog(SC_LOG_INFO, \ (file), (func), (line), __VA_ARGS__) #define SCLogConfig(...) SCLog(SC_LOG_CONFIG, \ __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__) #define SCLogPerf(...) SCLog(SC_LOG_PERF, \ __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__) /** * \brief Macro used to log NOTICE messages. * * \retval ... Takes as argument(s), a printf style format message */ #define SCLogNotice(...) SCLog(SC_LOG_NOTICE, \ __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__) #define SCLogNoticeRaw(file, func, line, ... ) SCLog(SC_LOG_NOTICE, \ (file), (func), (line), __VA_ARGS__) /** * \brief Macro used to log WARNING messages. * * \retval err_code Error code that has to be logged along with the * warning message * \retval ... Takes as argument(s), a printf style format message */ #define SCLogWarning(err_code, ...) SCLogErr(SC_LOG_WARNING, \ __FILE__, __FUNCTION__, __LINE__, \ err_code, __VA_ARGS__) #define SCLogWarningRaw(err_code, file, func, line, ...) \ SCLogErr(SC_LOG_WARNING, (file), (func), (line), err_code, __VA_ARGS__) /** * \brief Macro used to log ERROR messages. * * \retval err_code Error code that has to be logged along with the * error message * \retval ... Takes as argument(s), a printf style format message */ #define SCLogError(err_code, ...) SCLogErr(SC_LOG_ERROR, \ __FILE__, __FUNCTION__, __LINE__, \ err_code, __VA_ARGS__) #define SCLogErrorRaw(err_code, file, func, line, ...) SCLogErr(SC_LOG_ERROR, \ (file), (func), (line), err_code, __VA_ARGS__) /** * \brief Macro used to log CRITICAL messages. * * \retval err_code Error code that has to be logged along with the * critical message * \retval ... Takes as argument(s), a printf style format message */ #define SCLogCritical(err_code, ...) SCLogErr(SC_LOG_CRITICAL, \ __FILE__, __FUNCTION__, __LINE__, \ err_code, __VA_ARGS__) /** * \brief Macro used to log ALERT messages. * * \retval err_code Error code that has to be logged along with the * alert message * \retval ... Takes as argument(s), a printf style format message */ #define SCLogAlert(err_code, ...) SCLogErr(SC_LOG_ALERT, \ __FILE__, __FUNCTION__, __LINE__, \ err_code, __VA_ARGS__) /** * \brief Macro used to log EMERGENCY messages. * * \retval err_code Error code that has to be logged along with the * emergency message * \retval ... Takes as argument(s), a printf style format message */ #define SCLogEmerg(err_code, ...) SCLogErr(SC_LOG_EMERGENCY, \ __FILE__, __FUNCTION__, __LINE__, \ err_code, __VA_ARGS__) /* Avoid the overhead of using the debugging subsystem, in production mode */ #ifndef DEBUG #define SCLogDebug(...) do { } while (0) #define SCEnter(...) #define SCReturn return #define SCReturnInt(x) return x #define SCReturnUInt(x) return x #define SCReturnDbl(x) return x #define SCReturnChar(x) return x #define SCReturnCharPtr(x) return x #define SCReturnCT(x, type) return x #define SCReturnPtr(x, type) return x /* Please use it only for debugging purposes */ #else /** * \brief Macro used to log DEBUG messages. Comes under the debugging subsystem, * and hence will be enabled only in the presence of the DEBUG macro. * * \retval ... Takes as argument(s), a printf style format message */ #define SCLogDebug(...) SCLog(SC_LOG_DEBUG, __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__) /** * \brief Macro used to log debug messages on function entry. Comes under the * debugging subsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_entry logs, it also * processes the FD filters, if any FD filters are registered. * * \retval f An argument can be supplied, although it is not used */ #define SCEnter(f) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG &&\ SCLogCheckFDFilterEntry(__FUNCTION__)) \ { \ SCLogDebug("Entering ... >>"); \ } \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that don't return * a value. */ #define SCReturn do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning ... <<" ); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns an * integer value. * * \retval x Variable of type 'integer' that has to be returned */ #define SCReturnInt(x) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning: %"PRIdMAX" ... <<", (intmax_t)x); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns an * unsigned integer value. * * \retval x Variable of type 'unsigned integer' that has to be returned */ #define SCReturnUInt(x) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning: %"PRIuMAX" ... <<", (uintmax_t)x); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns a * float/double value. * * \retval x Variable of type 'float/double' that has to be returned */ #define SCReturnDbl(x) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning: %f ... <<", x); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns a var * of character type. * * \retval x Variable of type 'char' that has to be returned */ #define SCReturnChar(x) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning: %c ... <<", x); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns a * character string. * * \retval x Pointer to the char string that has to be returned */ #define SCReturnCharPtr(x) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ if ((x) != NULL) { \ SCLogDebug("Returning: %s ... <<", x); \ } else { \ SCLogDebug("Returning: NULL ... <<"); \ } SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns a var * of custom type * * \retval x Variable instance of a custom type that has to be returned * \retval type Pointer to a character string holding the name of the custom * type(the argument x) that has to be returned */ #define SCReturnCT(x, type) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning var of " \ "type %s ... <<", type); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) /** * \brief Macro used to log debug messages on function exit. Comes under the * debugging sybsystem, and hence will be enabled only in the presence * of the DEBUG macro. Apart from logging function_exit logs, it also * processes the FD filters, if any FD filters are registered. This * function_exit macro should be used for functions that returns a * pointer to a custom type * * \retval x Pointer to a variable instance of a custom type that has to be * returned * \retval type Pointer to a character string holding the name of the custom * type(the argument x) that has to be returned */ #define SCReturnPtr(x, type) do { \ if (sc_log_global_log_level >= SC_LOG_DEBUG) { \ SCLogDebug("Returning pointer %p of " \ "type %s ... <<", x, type); \ SCLogCheckFDFilterExit(__FUNCTION__); \ } \ return x; \ } while(0) #endif /* DEBUG */ #define FatalError(x, ...) do { \ SCLogError(x, __VA_ARGS__); \ exit(EXIT_FAILURE); \ } while(0) /** \brief Fatal error IF we're starting up, and configured to consider * errors to be fatal errors */ #define FatalErrorOnInit(x, ...) do { \ int init_errors_fatal = 0; \ ConfGetBool("engine.init-failure-fatal", &init_errors_fatal); \ if (init_errors_fatal && (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT))\ { \ SCLogError(x, __VA_ARGS__); \ exit(EXIT_FAILURE); \ } \ SCLogWarning(x, __VA_ARGS__); \ } while(0) SCLogInitData *SCLogAllocLogInitData(void); SCLogOPIfaceCtx *SCLogInitOPIfaceCtx(const char *, const char *, int, const char *); void SCLogAppendOPIfaceCtx(SCLogOPIfaceCtx *, SCLogInitData *); void SCLogInitLogModule(SCLogInitData *); void SCLogDeInitLogModule(void); SCError SCLogMessage(const SCLogLevel, const char *, const unsigned int, const char *, const SCError, const char *message); SCLogOPBuffer *SCLogAllocLogOPBuffer(void); int SCLogDebugEnabled(void); void SCLogRegisterTests(void); void SCLogLoadConfig(int daemon, int verbose); #endif /* __UTIL_DEBUG_H__ */ suricata-3.2.1/src/detect-engine-tls.c0000644000000000000000000002144113051004444014462 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Mats Klepsland * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-ssl.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-validate.h" /** \brief TLS SNI Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxTlsSni(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; SSLState *ssl_state = f->alstate; if (ssl_state->client_connp.sni == NULL) return; const uint8_t *buffer = (uint8_t *)ssl_state->client_connp.sni; const uint32_t buffer_len = strlen(ssl_state->client_connp.sni); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxTlsSniRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxTlsSni, ALPROTO_TLS, 0, // TODO a special 'cert ready' state might be good to add mpm_ctx, NULL, "tls_sni"); } /** \brief Do the content inspection and validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags App layer flags * \param state App layer state * * \retval 0 No match * \retval 1 Match */ int DetectEngineInspectTlsSni(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { uint8_t *buffer; uint16_t buffer_len; int cnt = 0; SSLState *ssl_state = (SSLState *)alstate; if (ssl_state->client_connp.sni == NULL) return 0; buffer = (uint8_t *)ssl_state->client_connp.sni; buffer_len = strlen(ssl_state->client_connp.sni); cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSSNI_MATCH], f, buffer, buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } /** \brief TLS Issuer Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxTlsIssuer(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; SSLState *ssl_state = f->alstate; if (ssl_state->server_connp.cert0_issuerdn == NULL) return; const uint8_t *buffer = (const uint8_t *)ssl_state->server_connp.cert0_issuerdn; const uint32_t buffer_len = strlen(ssl_state->server_connp.cert0_issuerdn); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxTlsIssuerRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxTlsIssuer, ALPROTO_TLS, TLS_STATE_CERT_READY, mpm_ctx, NULL, "tls_cert_issuer"); } /** \brief Do the content inspection and validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags App layer flags * \param state App layer state * * \retval 0 No match * \retval 1 Match */ int DetectEngineInspectTlsIssuer(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { uint8_t *buffer; uint32_t buffer_len; int cnt = 0; SSLState *ssl_state = (SSLState *)alstate; if (ssl_state->server_connp.cert0_issuerdn == NULL) return 0; buffer = (uint8_t *)ssl_state->server_connp.cert0_issuerdn; buffer_len = strlen(ssl_state->server_connp.cert0_issuerdn); cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSISSUER_MATCH], f, buffer, buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } /** \brief TLS Subject Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxTlsSubject(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; SSLState *ssl_state = f->alstate; if (ssl_state->server_connp.cert0_subject == NULL) return; const uint8_t *buffer = (const uint8_t *)ssl_state->server_connp.cert0_subject; const uint32_t buffer_len = strlen(ssl_state->server_connp.cert0_subject); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxTlsSubjectRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxTlsSubject, ALPROTO_TLS, TLS_STATE_CERT_READY, mpm_ctx, NULL, "tls_cert_subject"); } /** \brief Do the content inspection and validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags App layer flags * \param state App layer state * * \retval 0 No match * \retval 1 Match */ int DetectEngineInspectTlsSubject(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { uint8_t *buffer; uint32_t buffer_len; int cnt = 0; SSLState *ssl_state = (SSLState *)alstate; if (ssl_state->server_connp.cert0_subject == NULL) return 0; buffer = (uint8_t *)ssl_state->server_connp.cert0_subject; buffer_len = strlen(ssl_state->server_connp.cert0_subject); cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSSUBJECT_MATCH], f, buffer, buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } int DetectEngineInspectTlsValidity(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { return DetectEngineInspectGenericList(tv, de_ctx, det_ctx, s, f, flags, alstate, txv, tx_id, DETECT_SM_LIST_TLSVALIDITY_MATCH); } suricata-3.2.1/src/runmode-pcap-file.c0000644000000000000000000002057013051004444014460 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-pcap-file.h" #include "output.h" #include "detect-engine.h" #include "source-pcap-file.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" static const char *default_mode = NULL; const char *RunModeFilePcapGetDefaultMode(void) { return default_mode; } void RunModeFilePcapRegister(void) { RunModeRegisterNewRunMode(RUNMODE_PCAP_FILE, "single", "Single threaded pcap file mode", RunModeFilePcapSingle); default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_PCAP_FILE, "autofp", "Multi threaded pcap file mode. Packets from " "each flow are assigned to a single detect thread, " "unlike \"pcap-file-auto\" where packets from " "the same flow can be processed by any detect " "thread", RunModeFilePcapAutoFp); return; } /** * \brief Single thread version of the Pcap file processing. */ int RunModeFilePcapSingle(void) { char *file = NULL; char tname[TM_THREAD_NAME_MAX]; if (ConfGet("pcap-file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving pcap-file from Conf"); exit(EXIT_FAILURE); } RunModeInitialize(); TimeModeSetOffline(); PcapFileGlobalInit(); snprintf(tname, sizeof(tname), "%s#01", thread_name_single); /* create the threads */ ThreadVars *tv = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", "packetpool", "packetpool", "pktacqloop"); if (tv == NULL) { SCLogError(SC_ERR_RUNMODE, "threading setup failed"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceivePcapFile"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName failed for ReceivePcap"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, file); tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName DecodePcap failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); TmThreadSetCPU(tv, WORKER_CPU_SET); #ifndef AFLFUZZ_PCAP_RUNMODE if (TmThreadSpawn(tv) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } #else /* in afl mode we don't spawn a new thread, but run the pipeline * in the main thread */ tv->tm_func(tv); int afl_runmode_exit_immediately = 0; (void)ConfGetBool("afl.exit_after_pcap", &afl_runmode_exit_immediately); if (afl_runmode_exit_immediately) { SCLogNotice("exit because of afl-runmode-exit-after-pcap commandline option"); exit(EXIT_SUCCESS); } #endif return 0; } /** * \brief RunModeFilePcapAutoFp set up the following thread packet handlers: * - Receive thread (from pcap file) * - Decode thread * - Stream thread * - Detect: If we have only 1 cpu, it will setup one Detect thread * If we have more than one, it will setup num_cpus - 1 * starting from the second cpu available. * - Outputs thread * By default the threads will use the first cpu available * except the Detection threads if we have more than one cpu. * * \retval 0 If all goes well. (If any problem is detected the engine will * exit()). */ int RunModeFilePcapAutoFp(void) { SCEnter(); char tname[TM_THREAD_NAME_MAX]; char qname[TM_QUEUE_NAME_MAX]; uint16_t cpu = 0; char *queues = NULL; int thread; RunModeInitialize(); char *file = NULL; if (ConfGet("pcap-file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving pcap-file from Conf"); exit(EXIT_FAILURE); } SCLogDebug("file %s", file); TimeModeSetOffline(); PcapFileGlobalInit(); /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); /* start with cpu 1 so that if we're creating an odd number of detect * threads we're not creating the most on CPU0. */ if (ncpus > 0) cpu = 1; /* always create at least one thread */ int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET); if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; queues = RunmodeAutoFpCreatePickupQueuesString(thread_max); if (queues == NULL) { SCLogError(SC_ERR_RUNMODE, "RunmodeAutoFpCreatePickupQueuesString failed"); exit(EXIT_FAILURE); } snprintf(tname, sizeof(tname), "%s#01", thread_name_autofp); /* create the threads */ ThreadVars *tv_receivepcap = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", queues, "flow", "pktacqloop"); SCFree(queues); if (tv_receivepcap == NULL) { SCLogError(SC_ERR_FATAL, "threading setup failed"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceivePcapFile"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName failed for ReceivePcap"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receivepcap, tm_module, file); tm_module = TmModuleGetByName("DecodePcapFile"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName DecodePcap failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_receivepcap, tm_module, NULL); TmThreadSetCPU(tv_receivepcap, RECEIVE_CPU_SET); if (TmThreadSpawn(tv_receivepcap) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "%s#%02u", thread_name_workers, thread+1); snprintf(qname, sizeof(qname), "pickup%d", thread+1); SCLogDebug("tname %s, qname %s", tname, qname); SCLogDebug("Assigning %s affinity to cpu %u", tname, cpu); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(tname, qname, "flow", "packetpool", "packetpool", "varslot"); if (tv_detect_ncpu == NULL) { SCLogError(SC_ERR_RUNMODE, "TmThreadsCreate failed"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); TmThreadSetGroupName(tv_detect_ncpu, "Detect"); TmThreadSetCPU(tv_detect_ncpu, WORKER_CPU_SET); if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "TmThreadSpawn failed"); exit(EXIT_FAILURE); } if ((cpu + 1) == ncpus) cpu = 0; else cpu++; } return 0; } suricata-3.2.1/src/app-layer-smtp.h0000644000000000000000000001246613051004444014036 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __APP_LAYER_SMTP_H__ #define __APP_LAYER_SMTP_H__ #include "decode-events.h" #include "util-decode-mime.h" #include "queue.h" #include "util-streaming-buffer.h" enum { SMTP_DECODER_EVENT_INVALID_REPLY, SMTP_DECODER_EVENT_UNABLE_TO_MATCH_REPLY_WITH_REQUEST, SMTP_DECODER_EVENT_MAX_COMMAND_LINE_LEN_EXCEEDED, SMTP_DECODER_EVENT_MAX_REPLY_LINE_LEN_EXCEEDED, SMTP_DECODER_EVENT_INVALID_PIPELINED_SEQUENCE, SMTP_DECODER_EVENT_BDAT_CHUNK_LEN_EXCEEDED, SMTP_DECODER_EVENT_NO_SERVER_WELCOME_MESSAGE, SMTP_DECODER_EVENT_TLS_REJECTED, SMTP_DECODER_EVENT_DATA_COMMAND_REJECTED, /* MIME Events */ SMTP_DECODER_EVENT_MIME_PARSE_FAILED, SMTP_DECODER_EVENT_MIME_MALFORMED_MSG, SMTP_DECODER_EVENT_MIME_INVALID_BASE64, SMTP_DECODER_EVENT_MIME_INVALID_QP, SMTP_DECODER_EVENT_MIME_LONG_LINE, SMTP_DECODER_EVENT_MIME_LONG_ENC_LINE, SMTP_DECODER_EVENT_MIME_LONG_HEADER_NAME, SMTP_DECODER_EVENT_MIME_LONG_HEADER_VALUE, SMTP_DECODER_EVENT_MIME_BOUNDARY_TOO_LONG, /* Invalid behavior or content */ SMTP_DECODER_EVENT_DUPLICATE_FIELDS, SMTP_DECODER_EVENT_UNPARSABLE_CONTENT, }; typedef struct SMTPString_ { uint8_t *str; uint16_t len; TAILQ_ENTRY(SMTPString_) next; } SMTPString; typedef struct SMTPTransaction_ { /** id of this tx, starting at 0 */ uint64_t tx_id; int done; /** indicates loggers done logging */ uint32_t logged; /** the first message contained in the session */ MimeDecEntity *msg_head; /** the last message contained in the session */ MimeDecEntity *msg_tail; /** the mime decoding parser state */ MimeDecParseState *mime_state; AppLayerDecoderEvents *decoder_events; /**< per tx events */ DetectEngineState *de_state; /* MAIL FROM parameters */ uint8_t *mail_from; uint16_t mail_from_len; TAILQ_HEAD(, SMTPString_) rcpt_to_list; /**< rcpt to string list */ TAILQ_ENTRY(SMTPTransaction_) next; } SMTPTransaction; typedef struct SMTPConfig { int decode_mime; MimeDecConfig mime_config; uint32_t content_limit; uint32_t content_inspect_min_size; uint32_t content_inspect_window; StreamingBufferConfig sbcfg; } SMTPConfig; typedef struct SMTPState_ { SMTPTransaction *curr_tx; TAILQ_HEAD(, SMTPTransaction_) tx_list; /**< transaction list */ uint64_t tx_cnt; /* current input that is being parsed */ uint8_t *input; int32_t input_len; uint8_t direction; /* --parser details-- */ /** current line extracted by the parser from the call to SMTPGetline() */ uint8_t *current_line; /** length of the line in current_line. Doesn't include the delimiter */ int32_t current_line_len; uint8_t current_line_delimiter_len; /** used to indicate if the current_line buffer is a malloced buffer. We * use a malloced buffer, if a line is fragmented */ uint8_t *tc_db; int32_t tc_db_len; uint8_t tc_current_line_db; /** we have see LF for the currently parsed line */ uint8_t tc_current_line_lf_seen; /** used to indicate if the current_line buffer is a malloced buffer. We * use a malloced buffer, if a line is fragmented */ uint8_t *ts_db; int32_t ts_db_len; uint8_t ts_current_line_db; /** we have see LF for the currently parsed line */ uint8_t ts_current_line_lf_seen; /** var to indicate parser state */ uint8_t parser_state; /** current command in progress */ uint8_t current_command; /** bdat chunk len */ uint32_t bdat_chunk_len; /** bdat chunk idx */ uint32_t bdat_chunk_idx; /* the request commands are store here and the reply handler uses these * stored command in the buffer to match the reply(ies) with the command */ /** the command buffer */ uint8_t *cmds; /** the buffer length */ uint16_t cmds_buffer_len; /** no of commands stored in the above buffer */ uint16_t cmds_cnt; /** index of the command in the buffer, currently in inspection by reply * handler */ uint16_t cmds_idx; /* SMTP Mime decoding and file extraction */ /** the list of files sent to the server */ FileContainer *files_ts; /* HELO of HELO message content */ uint8_t *helo; uint16_t helo_len; } SMTPState; /* Create SMTP config structure */ extern SMTPConfig smtp_config; int SMTPProcessDataChunk(const uint8_t *chunk, uint32_t len, MimeDecParseState *state); void *SMTPStateAlloc(void); void RegisterSMTPParsers(void); void SMTPParserCleanup(void); void SMTPParserRegisterTests(void); #endif /* __APP_LAYER_SMTP_H__ */ suricata-3.2.1/src/app-layer-dnp3-objects.c0000644000000000000000000072623413051004444015346 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jason Ish * * This file contains the DNP3 object decoders. */ #include "suricata-common.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" void DNP3FreeObjectPoint(int group, int variation, void *point); #if 0 static void DNP3HexDump(uint8_t *data, int len) { for (int i = 0; i < len; i++) { printf("%02x ", data[i]); } } #endif /** * \brief Allocate a list for DNP3 points. */ DNP3PointList *DNP3PointListAlloc(void) { DNP3PointList *items = SCCalloc(1, sizeof(*items)); if (unlikely(items == NULL)) { return NULL; } TAILQ_INIT(items); return items; } /** * \brief Free a DNP3PointList. */ void DNP3FreeObjectPointList(int group, int variation, DNP3PointList *list) { DNP3Point *point; while ((point = TAILQ_FIRST(list)) != NULL) { TAILQ_REMOVE(list, point, next); if (point->data != NULL) { DNP3FreeObjectPoint(group, variation, point->data); } SCFree(point); } SCFree(list); } /** * \brief Read an uint8_t from a buffer. * * Reads a uint8_t from a buffer advancing the pointer and * decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadUint8(const uint8_t **buf, uint32_t *len, uint8_t *out) { if (*len < (int)sizeof(*out)) { return 0; } *out = *(uint8_t *)(*buf); *buf += sizeof(*out); *len -= sizeof(*out); return 1; } /** * \brief Read an uint16_t from a buffer. * * Reads an uint16_t from a buffer advancing the pointer and * decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadUint16(const uint8_t **buf, uint32_t *len, uint16_t *out) { if (*len < (int)sizeof(*out)) { return 0; } *out = DNP3_SWAP16(*(uint16_t *)(*buf)); *buf += sizeof(*out); *len -= sizeof(*out); return 1; } /** * \brief Read an unsigned 24 bit integer from a buffer. * * Reads an an unsigned 24 bit integer from a buffer advancing the * pointer and decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadUint24(const uint8_t **buf, uint32_t *len, uint32_t *out) { if (*len < (int)(sizeof(uint8_t) * 3)) { return 0; } #if __BYTE_ORDER__ == __BIG_ENDIAN *out = ((uint32_t)(*buf)[0] << 16) | ((uint32_t)(*buf)[1] << 8) | (uint32_t)(*buf)[2]; #elif __BYTE_ORDER == __LITTLE_ENDIAN *out = ((uint64_t)(*buf)[0]) | ((uint64_t)(*buf)[1] << 8) | ((uint64_t)(*buf)[2] << 16); #endif *buf += 3; *len -= 3; return 1; } /** * \brief Read an uint32_t from a buffer. * * Reads an uint32_t from a buffer advancing the pointer and * decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadUint32(const uint8_t **buf, uint32_t *len, uint32_t *out) { if (*len < (int)sizeof(*out)) { return 0; } *out = DNP3_SWAP32(*(uint32_t *)(*buf)); *buf += sizeof(*out); *len -= sizeof(*out); return 1; } /** * \brief Read an unsigned 48 bit integer from a buffer. * * Reads an an unsigned 48 bit integer from a buffer advancing the * pointer and decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadUint48(const uint8_t **buf, uint32_t *len, uint64_t *out) { if (*len < (int)(sizeof(uint8_t) * 6)) { return 0; } #if __BYTE_ORDER__ == __BIG_ENDIAN *out = ((uint64_t)(*buf)[0] << 40) | ((uint64_t)(*buf)[1] << 32) | ((uint64_t)(*buf)[2] << 24) | ((uint64_t)(*buf)[3] << 16) | ((uint64_t)(*buf)[4] << 8) | (uint64_t)(*buf)[5]; #elif __BYTE_ORDER == __LITTLE_ENDIAN *out = ((uint64_t)(*buf)[0]) | ((uint64_t)(*buf)[1] << 8) | ((uint64_t)(*buf)[2] << 16) | ((uint64_t)(*buf)[3] << 24) | ((uint64_t)(*buf)[4] << 32) | ((uint64_t)(*buf)[5] << 40); #endif *buf += 6; *len -= 6; return 1; } /** * \brief Read a 32 bit float from a buffer. * * Reads an 32 bit float from a buffer advancing the pointer and * decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadFloat32(const uint8_t **buf, uint32_t *len, float *out) { if (*len < 4) { return 0; } #if __BYTE_ORDER == __LITTLE_ENDIAN *((uint8_t *)out + 0) = (*buf)[0]; *((uint8_t *)out + 1) = (*buf)[1]; *((uint8_t *)out + 2) = (*buf)[2]; *((uint8_t *)out + 3) = (*buf)[3]; #else *((uint8_t *)out + 3) = (*buf)[0]; *((uint8_t *)out + 2) = (*buf)[1]; *((uint8_t *)out + 1) = (*buf)[2]; *((uint8_t *)out + 0) = (*buf)[3]; #endif *len -= 4; *buf += 4; return 1; } /** * \brief Read a 64 bit float from a buffer. * * Reads an 64 bit float from a buffer advancing the pointer and * decrementing the length. * * \param buf A pointer to the buffer to read from. * \param len A pointer to the buffer length. * \param out A pointer to where the value will be stored. * * \retval Returns 1 if there was enough space in the buffer to read from, * otherwise 0 is returned. */ static int DNP3ReadFloat64(const uint8_t **buf, uint32_t *len, double *out) { if (*len < 8) { return 0; } #if __BYTE_ORDER == __LITTLE_ENDIAN *((uint8_t *)out + 0) = (*buf)[0]; *((uint8_t *)out + 1) = (*buf)[1]; *((uint8_t *)out + 2) = (*buf)[2]; *((uint8_t *)out + 3) = (*buf)[3]; *((uint8_t *)out + 4) = (*buf)[4]; *((uint8_t *)out + 5) = (*buf)[5]; *((uint8_t *)out + 6) = (*buf)[6]; *((uint8_t *)out + 7) = (*buf)[7]; #else *((uint8_t *)out + 7) = (*buf)[0]; *((uint8_t *)out + 6) = (*buf)[1]; *((uint8_t *)out + 5) = (*buf)[2]; *((uint8_t *)out + 4) = (*buf)[3]; *((uint8_t *)out + 3) = (*buf)[4]; *((uint8_t *)out + 2) = (*buf)[5]; *((uint8_t *)out + 1) = (*buf)[6]; *((uint8_t *)out + 0) = (*buf)[7]; #endif *len -= 8; *buf += 8; return 1; } /** * \brief Get the prefix value and advance the buffer. */ static int DNP3ReadPrefix( const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t *out) { uint8_t prefix_len = 0; switch (prefix_code) { case 0x01: case 0x04: prefix_len = 1; break; case 0x02: case 0x05: prefix_len = 2; break; case 0x03: case 0x06: prefix_len = 4; default: break; } if (*len < (uint32_t)prefix_len) { return 0; } switch (prefix_len) { case sizeof(uint32_t): if (!DNP3ReadUint32(buf, len, out)) { return 0; } break; case sizeof(uint16_t): { /* Temp value for strict-aliasing. */ uint16_t val = 0; if (!DNP3ReadUint16(buf, len, &val)) { return 0; } *out = val; break; } case sizeof(uint8_t): { /* Temp value for strict-aliasing. */ uint8_t val = 0; if (!DNP3ReadUint8(buf, len, &val)) { return 0; } *out = val; break; } default: *out = 0; break; } return 1; } /** * \brief Add an object to a DNP3PointList. * * \retval 1 if successfull, 0 on failure. */ static int DNP3AddPoint(DNP3PointList *list, void *object, uint32_t point_index, uint8_t prefix_code, uint32_t prefix) { DNP3Point *point = SCCalloc(1, sizeof(*point)); if (unlikely(point == NULL)) { return 0; } TAILQ_INSERT_TAIL(list, point, next); point->data = object; point->prefix = prefix; point->index = point_index; switch (prefix_code) { case 0x00: break; case 0x01: case 0x02: case 0x03: point->index = prefix; break; case 0x04: case 0x05: case 0x06: point->size = prefix; break; default: break; } return 1; } /* START GENERATED CODE */ /* Code generated by: * ./scripts/dnp3-gen/dnp3-gen.py */ static int DNP3DecodeObjectG1V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG1V1 *object = NULL; int bytes = (count / 8) + 1; uint32_t prefix = 0; int point_index = start; if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } for (int i = 0; i < bytes; i++) { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } for (int j = 0; j < 8 && count; j = j + 1) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } object->state = (octet >> j) & 0x1; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; count--; point_index++; } } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG1V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG1V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->reserved = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG2V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG2V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->state)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG2V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG2V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->reserved = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG2V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG2V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->reserved = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG3V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG3V1 *object = NULL; int bytes = (count / 8) + 1; uint32_t prefix = 0; int point_index = start; if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } for (int i = 0; i < bytes; i++) { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } for (int j = 0; j < 8 && count; j = j + 2) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } object->state = (octet >> j) & 0x3; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; count--; point_index++; } } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG3V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG3V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->state = (octet >> 6) & 0x3; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG4V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG4V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->state = (octet >> 6) & 0x3; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG4V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG4V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->state = (octet >> 6) & 0x3; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG4V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG4V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->chatter_filter = (octet >> 5) & 0x1; object->state = (octet >> 6) & 0x3; } if (!DNP3ReadUint16(buf, len, &object->relative_time_ms)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG10V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG10V1 *object = NULL; int bytes = (count / 8) + 1; uint32_t prefix = 0; int point_index = start; if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } for (int i = 0; i < bytes; i++) { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } for (int j = 0; j < 8 && count; j = j + 1) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } object->state = (octet >> j) & 0x1; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; count--; point_index++; } } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG10V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG10V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->reserved1 = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG11V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG11V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->reserved1 = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG11V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG11V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->reserved1 = (octet >> 6) & 0x1; object->state = (octet >> 7) & 0x1; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG12V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG12V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->op_type = (octet >> 0) & 0xf; object->qu = (octet >> 4) & 0x1; object->cr = (octet >> 5) & 0x1; object->tcc = (octet >> 6) & 0x3; } if (!DNP3ReadUint8(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->ontime)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->offtime)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG12V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG12V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->op_type = (octet >> 0) & 0xf; object->qu = (octet >> 4) & 0x1; object->cr = (octet >> 5) & 0x1; object->tcc = (octet >> 6) & 0x3; } if (!DNP3ReadUint8(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->ontime)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->offtime)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG12V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG12V3 *object = NULL; int bytes = (count / 8) + 1; uint32_t prefix = 0; int point_index = start; if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } for (int i = 0; i < bytes; i++) { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } for (int j = 0; j < 8 && count; j = j + 1) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } object->point = (octet >> j) & 0x1; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; count--; point_index++; } } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG13V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG13V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->commanded_state = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG13V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG13V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->commanded_state = (octet >> 7) & 0x1; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG20V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG20V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V9(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V9 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V10(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V10 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V11(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V11 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG21V12(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG21V12 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG22V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG22V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG23V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG23V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->rollover = (octet >> 5) & 0x1; object->reserved0 = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->count)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG30V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG30V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG31V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG31V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG32V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG32V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG33V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG33V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG34V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG34V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->deadband_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG34V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG34V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->deadband_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG34V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG34V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadFloat32(buf, len, &object->deadband_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG40V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG40V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG40V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG40V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG40V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG40V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG40V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG40V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG41V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG41V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->control_status)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG41V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG41V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->control_status)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG41V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG41V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->control_status)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG41V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG41V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->control_status)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG42V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG42V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->over_range = (octet >> 5) & 0x1; object->reference_err = (octet >> 6) & 0x1; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->commanded_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->commanded_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint32(buf, len, (uint32_t *)&object->commanded_value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, (uint16_t *)&object->commanded_value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->commanded_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->commanded_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat32(buf, len, &object->commanded_value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG43V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG43V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->status_code = (octet >> 0) & 0x7f; object->reserved0 = (octet >> 7) & 0x1; } if (!DNP3ReadFloat64(buf, len, &object->commanded_value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG50V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG50V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG50V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG50V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->interval)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG50V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG50V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG50V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG50V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->interval_count)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->interval_units)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG51V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG51V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG51V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG51V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG52V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG52V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->delay_secs)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG52V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG52V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->delay_ms)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->filename_size)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->filetype_code)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->attribute_code)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->start_record)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->end_record)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->file_size)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->created_timestamp)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->permission)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->file_id)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->owner_id)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->group_id)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->file_function_code)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->status_code)) { goto error; } if (object->filename_size > 0) { memcpy(object->filename, *buf, object->filename_size); *buf += object->filename_size; *len -= object->filename_size; } object->filename[object->filename_size] = '\0'; if (!DNP3ReadUint16(buf, len, &object->data_size)) { goto error; } if (object->data_size > 0) { memcpy(object->data, *buf, object->data_size); *buf += object->data_size; *len -= object->data_size; } object->data[object->data_size] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->username_offset)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->username_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->password_offset)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->password_size)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->authentication_key)) { goto error; } if (object->username_size > 0) { memcpy(object->username, *buf, object->username_size); *buf += object->username_size; *len -= object->username_size; } object->username[object->username_size] = '\0'; if (object->password_size > 0) { memcpy(object->password, *buf, object->password_size); *buf += object->password_size; *len -= object->password_size; } object->password[object->password_size] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->filename_offset)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->filename_size)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->created)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->permissions)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->authentication_key)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->file_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->operational_mode)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->maximum_block_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->request_id)) { goto error; } if (object->filename_size > 0) { memcpy(object->filename, *buf, object->filename_size); *buf += object->filename_size; *len -= object->filename_size; } object->filename[object->filename_size] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (!DNP3PrefixIsSize(prefix_code)) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->file_handle)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->file_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->maximum_block_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->request_id)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->status_code)) { goto error; } object->optional_text_len = prefix - (offset - *len); if (object->optional_text_len > 0) { memcpy(object->optional_text, *buf, object->optional_text_len); *buf += object->optional_text_len; *len -= object->optional_text_len; } object->optional_text[object->optional_text_len] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (!DNP3PrefixIsSize(prefix_code)) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->file_handle)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->block_number)) { goto error; } object->file_data_len = prefix - (offset - *len); if (object->file_data_len > 0) { memcpy(object->file_data, *buf, object->file_data_len); *buf += object->file_data_len; *len -= object->file_data_len; } object->file_data[object->file_data_len] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (!DNP3PrefixIsSize(prefix_code)) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->file_handle)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->block_number)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->status_code)) { goto error; } object->optional_text_len = prefix - (offset - *len); if (object->optional_text_len > 0) { memcpy(object->optional_text, *buf, object->optional_text_len); *buf += object->optional_text_len; *len -= object->optional_text_len; } object->optional_text[object->optional_text_len] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->filename_offset)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->filename_size)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->file_type)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->file_size)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->created_timestamp)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->permissions)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->request_id)) { goto error; } if (object->filename_size > 0) { memcpy(object->filename, *buf, object->filename_size); *buf += object->filename_size; *len -= object->filename_size; } object->filename[object->filename_size] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG70V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG70V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; object->file_specification_len = prefix - (offset - *len); if (object->file_specification_len > 0) { memcpy(object->file_specification, *buf, object->file_specification_len); *buf += object->file_specification_len; *len -= object->file_specification_len; } object->file_specification[object->file_specification_len] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG80V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG80V1 *object = NULL; int bytes = (count / 8) + 1; uint32_t prefix = 0; int point_index = start; if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } for (int i = 0; i < bytes; i++) { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } for (int j = 0; j < 8 && count; j = j + 1) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } object->state = (octet >> j) & 0x1; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; count--; point_index++; } } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG81V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG81V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->fill_percentage = (octet >> 0) & 0x7f; object->overflow_state = (octet >> 7) & 0x1; } if (!DNP3ReadUint8(buf, len, &object->group)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->variation)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG83V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG83V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (*len < 4) { goto error; } memcpy(object->vendor_code, *buf, 4); object->vendor_code[4] = '\0'; *buf += 4; *len -= 4; if (!DNP3ReadUint16(buf, len, &object->object_id)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->length)) { goto error; } if (object->length > 0) { if (*len < object->length) { /* Not enough data. */ goto error; } object->data_objects = SCCalloc(1, object->length); if (unlikely(object->data_objects == NULL)) { goto error; } memcpy(object->data_objects, *buf, object->length); *buf += object->length; *len -= object->length; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG86V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG86V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->rd = (octet >> 0) & 0x1; object->wr = (octet >> 1) & 0x1; object->st = (octet >> 2) & 0x1; object->ev = (octet >> 3) & 0x1; object->df = (octet >> 4) & 0x1; object->padding0 = (octet >> 5) & 0x1; object->padding1 = (octet >> 6) & 0x1; object->padding2 = (octet >> 7) & 0x1; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG102V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG102V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->csq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->usr)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->mal)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->reason)) { goto error; } object->challenge_data_len = prefix - (offset - *len); if (object->challenge_data_len > 0) { if (*len < object->challenge_data_len) { /* Not enough data. */ goto error; } object->challenge_data = SCCalloc(1, object->challenge_data_len); if (unlikely(object->challenge_data == NULL)) { goto error; } memcpy(object->challenge_data, *buf, object->challenge_data_len); *buf += object->challenge_data_len; *len -= object->challenge_data_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->csq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->usr)) { goto error; } object->mac_value_len = prefix - (offset - *len); if (object->mac_value_len > 0) { if (*len < object->mac_value_len) { /* Not enough data. */ goto error; } object->mac_value = SCCalloc(1, object->mac_value_len); if (unlikely(object->mac_value == NULL)) { goto error; } memcpy(object->mac_value, *buf, object->mac_value_len); *buf += object->mac_value_len; *len -= object->mac_value_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V3(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V3 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->csq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_number)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V4(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V4 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_number)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V5(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V5 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->ksq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_number)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->key_wrap_alg)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->key_status)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->mal)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->challenge_data_len)) { goto error; } if (object->challenge_data_len > 0) { if (*len < object->challenge_data_len) { /* Not enough data. */ goto error; } object->challenge_data = SCCalloc(1, object->challenge_data_len); if (unlikely(object->challenge_data == NULL)) { goto error; } memcpy(object->challenge_data, *buf, object->challenge_data_len); *buf += object->challenge_data_len; *len -= object->challenge_data_len; } object->mac_value_len = prefix - (offset - *len); if (object->mac_value_len > 0) { if (*len < object->mac_value_len) { /* Not enough data. */ goto error; } object->mac_value = SCCalloc(1, object->mac_value_len); if (unlikely(object->mac_value == NULL)) { goto error; } memcpy(object->mac_value, *buf, object->mac_value_len); *buf += object->mac_value_len; *len -= object->mac_value_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V6(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V6 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint24(buf, len, &object->ksq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->usr)) { goto error; } object->wrapped_key_data_len = prefix - (offset - *len); if (object->wrapped_key_data_len > 0) { if (*len < object->wrapped_key_data_len) { /* Not enough data. */ goto error; } object->wrapped_key_data = SCCalloc(1, object->wrapped_key_data_len); if (unlikely(object->wrapped_key_data == NULL)) { goto error; } memcpy(object->wrapped_key_data, *buf, object->wrapped_key_data_len); *buf += object->wrapped_key_data_len; *len -= object->wrapped_key_data_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V7(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V7 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint32(buf, len, &object->sequence_number)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->usr)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->association_id)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->error_code)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->time_of_error)) { goto error; } object->error_text_len = prefix - (offset - *len); if (object->error_text_len > 0) { memcpy(object->error_text, *buf, object->error_text_len); *buf += object->error_text_len; *len -= object->error_text_len; } object->error_text[object->error_text_len] = '\0'; if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V8(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V8 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; if (!DNP3ReadUint8(buf, len, &object->key_change_method)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->certificate_type)) { goto error; } object->certificate_len = prefix - (offset - *len); if (object->certificate_len > 0) { if (*len < object->certificate_len) { /* Not enough data. */ goto error; } object->certificate = SCCalloc(1, object->certificate_len); if (unlikely(object->certificate == NULL)) { goto error; } memcpy(object->certificate, *buf, object->certificate_len); *buf += object->certificate_len; *len -= object->certificate_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V9(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V9 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; object->mac_value_len = prefix - (offset - *len); if (object->mac_value_len > 0) { if (*len < object->mac_value_len) { /* Not enough data. */ goto error; } object->mac_value = SCCalloc(1, object->mac_value_len); if (unlikely(object->mac_value == NULL)) { goto error; } memcpy(object->mac_value, *buf, object->mac_value_len); *buf += object->mac_value_len; *len -= object->mac_value_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V10(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V10 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->key_change_method)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->operation)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->scs)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_role)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_role_expiry_interval)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->username_len)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_public_key_len)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->certification_data_len)) { goto error; } if (object->username_len > 0) { memcpy(object->username, *buf, object->username_len); *buf += object->username_len; *len -= object->username_len; } object->username[object->username_len] = '\0'; if (object->user_public_key_len > 0) { if (*len < object->user_public_key_len) { /* Not enough data. */ goto error; } object->user_public_key = SCCalloc(1, object->user_public_key_len); if (unlikely(object->user_public_key == NULL)) { goto error; } memcpy(object->user_public_key, *buf, object->user_public_key_len); *buf += object->user_public_key_len; *len -= object->user_public_key_len; } if (object->certification_data_len > 0) { if (*len < object->certification_data_len) { /* Not enough data. */ goto error; } object->certification_data = SCCalloc(1, object->certification_data_len); if (unlikely(object->certification_data == NULL)) { goto error; } memcpy(object->certification_data, *buf, object->certification_data_len); *buf += object->certification_data_len; *len -= object->certification_data_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V11(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V11 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint8(buf, len, &object->key_change_method)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->username_len)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->master_challenge_data_len)) { goto error; } if (object->username_len > 0) { memcpy(object->username, *buf, object->username_len); *buf += object->username_len; *len -= object->username_len; } object->username[object->username_len] = '\0'; if (object->master_challenge_data_len > 0) { if (*len < object->master_challenge_data_len) { /* Not enough data. */ goto error; } object->master_challenge_data = SCCalloc(1, object->master_challenge_data_len); if (unlikely(object->master_challenge_data == NULL)) { goto error; } memcpy(object->master_challenge_data, *buf, object->master_challenge_data_len); *buf += object->master_challenge_data_len; *len -= object->master_challenge_data_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V12(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V12 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->ksq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_number)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->challenge_data_len)) { goto error; } if (object->challenge_data_len > 0) { if (*len < object->challenge_data_len) { /* Not enough data. */ goto error; } object->challenge_data = SCCalloc(1, object->challenge_data_len); if (unlikely(object->challenge_data == NULL)) { goto error; } memcpy(object->challenge_data, *buf, object->challenge_data_len); *buf += object->challenge_data_len; *len -= object->challenge_data_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V13(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V13 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->ksq)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->user_number)) { goto error; } if (!DNP3ReadUint16(buf, len, &object->encrypted_update_key_len)) { goto error; } if (object->encrypted_update_key_len > 0) { if (*len < object->encrypted_update_key_len) { /* Not enough data. */ goto error; } object->encrypted_update_key_data = SCCalloc(1, object->encrypted_update_key_len); if (unlikely(object->encrypted_update_key_data == NULL)) { goto error; } memcpy(object->encrypted_update_key_data, *buf, object->encrypted_update_key_len); *buf += object->encrypted_update_key_len; *len -= object->encrypted_update_key_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V14(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V14 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; object->digital_signature_len = prefix - (offset - *len); if (object->digital_signature_len > 0) { if (*len < object->digital_signature_len) { /* Not enough data. */ goto error; } object->digital_signature = SCCalloc(1, object->digital_signature_len); if (unlikely(object->digital_signature == NULL)) { goto error; } memcpy(object->digital_signature, *buf, object->digital_signature_len); *buf += object->digital_signature_len; *len -= object->digital_signature_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG120V15(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG120V15 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; uint32_t offset; if (prefix_code != 5) { goto error; } while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } offset = *len; object->mac_len = prefix - (offset - *len); if (object->mac_len > 0) { if (*len < object->mac_len) { /* Not enough data. */ goto error; } object->mac = SCCalloc(1, object->mac_len); if (unlikely(object->mac == NULL)) { goto error; } memcpy(object->mac, *buf, object->mac_len); *buf += object->mac_len; *len -= object->mac_len; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG121V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG121V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->association_id)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG122V1(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG122V1 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->association_id)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count_value)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } static int DNP3DecodeObjectG122V2(const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { DNP3ObjectG122V2 *object = NULL; uint32_t prefix = 0; uint32_t point_index = start; while (count--) { object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { goto error; } if (!DNP3ReadPrefix(buf, len, prefix_code, &prefix)) { goto error; } { uint8_t octet; if (!DNP3ReadUint8(buf, len, &octet)) { goto error; } object->online = (octet >> 0) & 0x1; object->restart = (octet >> 1) & 0x1; object->comm_lost = (octet >> 2) & 0x1; object->remote_forced = (octet >> 3) & 0x1; object->local_forced = (octet >> 4) & 0x1; object->reserved0 = (octet >> 5) & 0x1; object->discontinuity = (octet >> 6) & 0x1; object->reserved1 = (octet >> 7) & 0x1; } if (!DNP3ReadUint16(buf, len, &object->association_id)) { goto error; } if (!DNP3ReadUint32(buf, len, &object->count_value)) { goto error; } if (!DNP3ReadUint48(buf, len, &object->timestamp)) { goto error; } if (!DNP3AddPoint(points, object, point_index, prefix_code, prefix)) { goto error; } object = NULL; point_index++; } return 1; error: if (object != NULL) { SCFree(object); } return 0; } void DNP3FreeObjectPoint(int group, int variation, void *point) { switch(DNP3_OBJECT_CODE(group, variation)) { case DNP3_OBJECT_CODE(83, 1): { DNP3ObjectG83V1 *object = (DNP3ObjectG83V1 *) point; if (object->data_objects != NULL) { SCFree(object->data_objects); } break; } case DNP3_OBJECT_CODE(120, 1): { DNP3ObjectG120V1 *object = (DNP3ObjectG120V1 *) point; if (object->challenge_data != NULL) { SCFree(object->challenge_data); } break; } case DNP3_OBJECT_CODE(120, 2): { DNP3ObjectG120V2 *object = (DNP3ObjectG120V2 *) point; if (object->mac_value != NULL) { SCFree(object->mac_value); } break; } case DNP3_OBJECT_CODE(120, 5): { DNP3ObjectG120V5 *object = (DNP3ObjectG120V5 *) point; if (object->challenge_data != NULL) { SCFree(object->challenge_data); } if (object->mac_value != NULL) { SCFree(object->mac_value); } break; } case DNP3_OBJECT_CODE(120, 6): { DNP3ObjectG120V6 *object = (DNP3ObjectG120V6 *) point; if (object->wrapped_key_data != NULL) { SCFree(object->wrapped_key_data); } break; } case DNP3_OBJECT_CODE(120, 8): { DNP3ObjectG120V8 *object = (DNP3ObjectG120V8 *) point; if (object->certificate != NULL) { SCFree(object->certificate); } break; } case DNP3_OBJECT_CODE(120, 9): { DNP3ObjectG120V9 *object = (DNP3ObjectG120V9 *) point; if (object->mac_value != NULL) { SCFree(object->mac_value); } break; } case DNP3_OBJECT_CODE(120, 10): { DNP3ObjectG120V10 *object = (DNP3ObjectG120V10 *) point; if (object->user_public_key != NULL) { SCFree(object->user_public_key); } if (object->certification_data != NULL) { SCFree(object->certification_data); } break; } case DNP3_OBJECT_CODE(120, 11): { DNP3ObjectG120V11 *object = (DNP3ObjectG120V11 *) point; if (object->master_challenge_data != NULL) { SCFree(object->master_challenge_data); } break; } case DNP3_OBJECT_CODE(120, 12): { DNP3ObjectG120V12 *object = (DNP3ObjectG120V12 *) point; if (object->challenge_data != NULL) { SCFree(object->challenge_data); } break; } case DNP3_OBJECT_CODE(120, 13): { DNP3ObjectG120V13 *object = (DNP3ObjectG120V13 *) point; if (object->encrypted_update_key_data != NULL) { SCFree(object->encrypted_update_key_data); } break; } case DNP3_OBJECT_CODE(120, 14): { DNP3ObjectG120V14 *object = (DNP3ObjectG120V14 *) point; if (object->digital_signature != NULL) { SCFree(object->digital_signature); } break; } case DNP3_OBJECT_CODE(120, 15): { DNP3ObjectG120V15 *object = (DNP3ObjectG120V15 *) point; if (object->mac != NULL) { SCFree(object->mac); } break; } default: break; } SCFree(point); } /** * \brief Decode a DNP3 object. * * \retval 0 on success. On failure a positive integer corresponding * to a DNP3 application layer event will be returned. */ int DNP3DecodeObject(int group, int variation, const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *points) { int rc = 0; switch (DNP3_OBJECT_CODE(group, variation)) { case DNP3_OBJECT_CODE(1, 1): rc = DNP3DecodeObjectG1V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(1, 2): rc = DNP3DecodeObjectG1V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(2, 1): rc = DNP3DecodeObjectG2V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(2, 2): rc = DNP3DecodeObjectG2V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(2, 3): rc = DNP3DecodeObjectG2V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(3, 1): rc = DNP3DecodeObjectG3V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(3, 2): rc = DNP3DecodeObjectG3V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(4, 1): rc = DNP3DecodeObjectG4V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(4, 2): rc = DNP3DecodeObjectG4V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(4, 3): rc = DNP3DecodeObjectG4V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(10, 1): rc = DNP3DecodeObjectG10V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(10, 2): rc = DNP3DecodeObjectG10V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(11, 1): rc = DNP3DecodeObjectG11V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(11, 2): rc = DNP3DecodeObjectG11V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(12, 1): rc = DNP3DecodeObjectG12V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(12, 2): rc = DNP3DecodeObjectG12V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(12, 3): rc = DNP3DecodeObjectG12V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(13, 1): rc = DNP3DecodeObjectG13V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(13, 2): rc = DNP3DecodeObjectG13V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 1): rc = DNP3DecodeObjectG20V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 2): rc = DNP3DecodeObjectG20V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 3): rc = DNP3DecodeObjectG20V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 4): rc = DNP3DecodeObjectG20V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 5): rc = DNP3DecodeObjectG20V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 6): rc = DNP3DecodeObjectG20V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 7): rc = DNP3DecodeObjectG20V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(20, 8): rc = DNP3DecodeObjectG20V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 1): rc = DNP3DecodeObjectG21V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 2): rc = DNP3DecodeObjectG21V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 3): rc = DNP3DecodeObjectG21V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 4): rc = DNP3DecodeObjectG21V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 5): rc = DNP3DecodeObjectG21V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 6): rc = DNP3DecodeObjectG21V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 7): rc = DNP3DecodeObjectG21V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 8): rc = DNP3DecodeObjectG21V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 9): rc = DNP3DecodeObjectG21V9(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 10): rc = DNP3DecodeObjectG21V10(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 11): rc = DNP3DecodeObjectG21V11(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(21, 12): rc = DNP3DecodeObjectG21V12(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 1): rc = DNP3DecodeObjectG22V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 2): rc = DNP3DecodeObjectG22V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 3): rc = DNP3DecodeObjectG22V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 4): rc = DNP3DecodeObjectG22V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 5): rc = DNP3DecodeObjectG22V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 6): rc = DNP3DecodeObjectG22V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 7): rc = DNP3DecodeObjectG22V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(22, 8): rc = DNP3DecodeObjectG22V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 1): rc = DNP3DecodeObjectG23V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 2): rc = DNP3DecodeObjectG23V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 3): rc = DNP3DecodeObjectG23V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 4): rc = DNP3DecodeObjectG23V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 5): rc = DNP3DecodeObjectG23V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 6): rc = DNP3DecodeObjectG23V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 7): rc = DNP3DecodeObjectG23V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(23, 8): rc = DNP3DecodeObjectG23V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 1): rc = DNP3DecodeObjectG30V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 2): rc = DNP3DecodeObjectG30V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 3): rc = DNP3DecodeObjectG30V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 4): rc = DNP3DecodeObjectG30V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 5): rc = DNP3DecodeObjectG30V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(30, 6): rc = DNP3DecodeObjectG30V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 1): rc = DNP3DecodeObjectG31V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 2): rc = DNP3DecodeObjectG31V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 3): rc = DNP3DecodeObjectG31V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 4): rc = DNP3DecodeObjectG31V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 5): rc = DNP3DecodeObjectG31V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 6): rc = DNP3DecodeObjectG31V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 7): rc = DNP3DecodeObjectG31V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(31, 8): rc = DNP3DecodeObjectG31V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 1): rc = DNP3DecodeObjectG32V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 2): rc = DNP3DecodeObjectG32V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 3): rc = DNP3DecodeObjectG32V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 4): rc = DNP3DecodeObjectG32V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 5): rc = DNP3DecodeObjectG32V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 6): rc = DNP3DecodeObjectG32V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 7): rc = DNP3DecodeObjectG32V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(32, 8): rc = DNP3DecodeObjectG32V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 1): rc = DNP3DecodeObjectG33V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 2): rc = DNP3DecodeObjectG33V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 3): rc = DNP3DecodeObjectG33V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 4): rc = DNP3DecodeObjectG33V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 5): rc = DNP3DecodeObjectG33V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 6): rc = DNP3DecodeObjectG33V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 7): rc = DNP3DecodeObjectG33V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(33, 8): rc = DNP3DecodeObjectG33V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(34, 1): rc = DNP3DecodeObjectG34V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(34, 2): rc = DNP3DecodeObjectG34V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(34, 3): rc = DNP3DecodeObjectG34V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(40, 1): rc = DNP3DecodeObjectG40V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(40, 2): rc = DNP3DecodeObjectG40V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(40, 3): rc = DNP3DecodeObjectG40V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(40, 4): rc = DNP3DecodeObjectG40V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(41, 1): rc = DNP3DecodeObjectG41V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(41, 2): rc = DNP3DecodeObjectG41V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(41, 3): rc = DNP3DecodeObjectG41V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(41, 4): rc = DNP3DecodeObjectG41V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 1): rc = DNP3DecodeObjectG42V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 2): rc = DNP3DecodeObjectG42V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 3): rc = DNP3DecodeObjectG42V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 4): rc = DNP3DecodeObjectG42V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 5): rc = DNP3DecodeObjectG42V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 6): rc = DNP3DecodeObjectG42V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 7): rc = DNP3DecodeObjectG42V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(42, 8): rc = DNP3DecodeObjectG42V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 1): rc = DNP3DecodeObjectG43V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 2): rc = DNP3DecodeObjectG43V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 3): rc = DNP3DecodeObjectG43V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 4): rc = DNP3DecodeObjectG43V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 5): rc = DNP3DecodeObjectG43V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 6): rc = DNP3DecodeObjectG43V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 7): rc = DNP3DecodeObjectG43V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(43, 8): rc = DNP3DecodeObjectG43V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(50, 1): rc = DNP3DecodeObjectG50V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(50, 2): rc = DNP3DecodeObjectG50V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(50, 3): rc = DNP3DecodeObjectG50V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(50, 4): rc = DNP3DecodeObjectG50V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(51, 1): rc = DNP3DecodeObjectG51V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(51, 2): rc = DNP3DecodeObjectG51V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(52, 1): rc = DNP3DecodeObjectG52V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(52, 2): rc = DNP3DecodeObjectG52V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 1): rc = DNP3DecodeObjectG70V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 2): rc = DNP3DecodeObjectG70V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 3): rc = DNP3DecodeObjectG70V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 4): rc = DNP3DecodeObjectG70V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 5): rc = DNP3DecodeObjectG70V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 6): rc = DNP3DecodeObjectG70V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 7): rc = DNP3DecodeObjectG70V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(70, 8): rc = DNP3DecodeObjectG70V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(80, 1): rc = DNP3DecodeObjectG80V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(81, 1): rc = DNP3DecodeObjectG81V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(83, 1): rc = DNP3DecodeObjectG83V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(86, 2): rc = DNP3DecodeObjectG86V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(102, 1): rc = DNP3DecodeObjectG102V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 1): rc = DNP3DecodeObjectG120V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 2): rc = DNP3DecodeObjectG120V2(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 3): rc = DNP3DecodeObjectG120V3(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 4): rc = DNP3DecodeObjectG120V4(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 5): rc = DNP3DecodeObjectG120V5(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 6): rc = DNP3DecodeObjectG120V6(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 7): rc = DNP3DecodeObjectG120V7(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 8): rc = DNP3DecodeObjectG120V8(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 9): rc = DNP3DecodeObjectG120V9(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 10): rc = DNP3DecodeObjectG120V10(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 11): rc = DNP3DecodeObjectG120V11(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 12): rc = DNP3DecodeObjectG120V12(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 13): rc = DNP3DecodeObjectG120V13(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 14): rc = DNP3DecodeObjectG120V14(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(120, 15): rc = DNP3DecodeObjectG120V15(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(121, 1): rc = DNP3DecodeObjectG121V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(122, 1): rc = DNP3DecodeObjectG122V1(buf, len, prefix_code, start, count, points); break; case DNP3_OBJECT_CODE(122, 2): rc = DNP3DecodeObjectG122V2(buf, len, prefix_code, start, count, points); break; default: return DNP3_DECODER_EVENT_UNKNOWN_OBJECT; } return rc ? 0 : DNP3_DECODER_EVENT_MALFORMED; } /* END GENERATED CODE */ suricata-3.2.1/src/ippair-queue.c0000644000000000000000000000564713051004444013567 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * IPPair queue handler functions */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "ippair-queue.h" #include "util-error.h" #include "util-debug.h" #include "util-print.h" IPPairQueue *IPPairQueueInit (IPPairQueue *q) { if (q != NULL) { memset(q, 0, sizeof(IPPairQueue)); HQLOCK_INIT(q); } return q; } IPPairQueue *IPPairQueueNew() { IPPairQueue *q = (IPPairQueue *)SCMalloc(sizeof(IPPairQueue)); if (q == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in IPPairQueueNew. Exiting..."); exit(EXIT_SUCCESS); } q = IPPairQueueInit(q); return q; } /** * \brief Destroy a ippair queue * * \param q the ippair queue to destroy */ void IPPairQueueDestroy (IPPairQueue *q) { HQLOCK_DESTROY(q); } /** * \brief add a ippair to a queue * * \param q queue * \param h ippair */ void IPPairEnqueue (IPPairQueue *q, IPPair *h) { #ifdef DEBUG BUG_ON(q == NULL || h == NULL); #endif HQLOCK_LOCK(q); /* more ippairs in queue */ if (q->top != NULL) { h->lnext = q->top; q->top->lprev = h; q->top = h; /* only ippair */ } else { q->top = h; q->bot = h; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ HQLOCK_UNLOCK(q); } /** * \brief remove a ippair from the queue * * \param q queue * * \retval h ippair or NULL if empty list. */ IPPair *IPPairDequeue (IPPairQueue *q) { HQLOCK_LOCK(q); IPPair *h = q->bot; if (h == NULL) { HQLOCK_UNLOCK(q); return NULL; } /* more packets in queue */ if (q->bot->lprev != NULL) { q->bot = q->bot->lprev; q->bot->lnext = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } #ifdef DEBUG BUG_ON(q->len == 0); #endif if (q->len > 0) q->len--; h->lnext = NULL; h->lprev = NULL; HQLOCK_UNLOCK(q); return h; } uint32_t IPPairQueueLen(IPPairQueue *q) { uint32_t len; HQLOCK_LOCK(q); len = q->len; HQLOCK_UNLOCK(q); return len; } suricata-3.2.1/src/source-pfring.c0000644000000000000000000005647713051004444013753 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf * \author Eric Leblond * * PF_RING packet acquisition support * * \todo remove requirement for setting cluster so old 3.x versions are supported * \todo implement DNA support * \todo Allow ring options such as snaplen etc, to be user configurable. */ #ifdef HAVE_PFRING #include #endif /* HAVE_PFRING */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "source-pfring.h" #include "util-debug.h" #include "util-checksum.h" #include "util-privs.h" #include "util-device.h" #include "util-host-info.h" #include "runmodes.h" #include "util-profiling.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda.h" #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #include "util-cuda-handlers.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot); TmEcode PfringBreakLoop(ThreadVars *tv, void *data); TmEcode ReceivePfringThreadInit(ThreadVars *, void *, void **); void ReceivePfringThreadExitStats(ThreadVars *, void *); TmEcode ReceivePfringThreadDeinit(ThreadVars *, void *); TmEcode DecodePfringThreadInit(ThreadVars *, void *, void **); TmEcode DecodePfring(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode DecodePfringThreadDeinit(ThreadVars *tv, void *data); extern int max_pending_packets; #ifndef HAVE_PFRING /*Handle cases where we don't have PF_RING support built-in*/ TmEcode NoPfringSupportExit(ThreadVars *, void *, void **); void TmModuleReceivePfringRegister (void) { tmm_modules[TMM_RECEIVEPFRING].name = "ReceivePfring"; tmm_modules[TMM_RECEIVEPFRING].ThreadInit = NoPfringSupportExit; tmm_modules[TMM_RECEIVEPFRING].Func = NULL; tmm_modules[TMM_RECEIVEPFRING].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVEPFRING].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEPFRING].RegisterTests = NULL; tmm_modules[TMM_RECEIVEPFRING].cap_flags = SC_CAP_NET_ADMIN | SC_CAP_NET_RAW | SC_CAP_NET_BIND_SERVICE | SC_CAP_NET_BROADCAST; tmm_modules[TMM_RECEIVEPFRING].flags = TM_FLAG_RECEIVE_TM; } void TmModuleDecodePfringRegister (void) { tmm_modules[TMM_DECODEPFRING].name = "DecodePfring"; tmm_modules[TMM_DECODEPFRING].ThreadInit = NoPfringSupportExit; tmm_modules[TMM_DECODEPFRING].Func = NULL; tmm_modules[TMM_DECODEPFRING].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEPFRING].ThreadDeinit = NULL; tmm_modules[TMM_DECODEPFRING].RegisterTests = NULL; tmm_modules[TMM_DECODEPFRING].cap_flags = 0; tmm_modules[TMM_DECODEPFRING].flags = TM_FLAG_DECODE_TM; } /** * \brief this funciton prints an error message and exits. * \param tv pointer to ThreadVars * \param initdata pointer to the interface passed from the user * \param data pointer gets populated with PfringThreadVars */ TmEcode NoPfringSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NO_PF_RING,"Error creating thread %s: you do not have support for pfring " "enabled please recompile with --enable-pfring", tv->name); exit(EXIT_FAILURE); } #else /* implied we do have PF_RING support */ /** protect pfring_set_bpf_filter, as it is not thread safe */ static SCMutex pfring_bpf_set_filter_lock = SCMUTEX_INITIALIZER; /* XXX replace with user configurable options */ #define LIBPFRING_PROMISC 1 #define LIBPFRING_REENTRANT 0 #define LIBPFRING_WAIT_FOR_INCOMING 1 typedef enum { PFRING_FLAGS_ZERO_COPY = 0x1 } PfringThreadVarsFlags; /** * \brief Structure to hold thread specific variables. */ typedef struct PfringThreadVars_ { /* thread specific handle */ pfring *pd; /* counters */ uint64_t bytes; uint64_t pkts; uint16_t capture_kernel_packets; uint16_t capture_kernel_drops; uint32_t flags; ThreadVars *tv; TmSlot *slot; int vlan_disabled; /* threads count */ int threads; cluster_type ctype; uint8_t cluster_id; char *interface; LiveDevice *livedev; char *bpf_filter; ChecksumValidationMode checksum_mode; } PfringThreadVars; /** * \brief Registration Function for RecievePfring. * \todo Unit tests are needed for this module. */ void TmModuleReceivePfringRegister (void) { tmm_modules[TMM_RECEIVEPFRING].name = "ReceivePfring"; tmm_modules[TMM_RECEIVEPFRING].ThreadInit = ReceivePfringThreadInit; tmm_modules[TMM_RECEIVEPFRING].Func = NULL; tmm_modules[TMM_RECEIVEPFRING].PktAcqLoop = ReceivePfringLoop; tmm_modules[TMM_RECEIVEPFRING].PktAcqBreakLoop = PfringBreakLoop; tmm_modules[TMM_RECEIVEPFRING].ThreadExitPrintStats = ReceivePfringThreadExitStats; tmm_modules[TMM_RECEIVEPFRING].ThreadDeinit = ReceivePfringThreadDeinit; tmm_modules[TMM_RECEIVEPFRING].RegisterTests = NULL; tmm_modules[TMM_RECEIVEPFRING].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for DecodePfring. * \todo Unit tests are needed for this module. */ void TmModuleDecodePfringRegister (void) { tmm_modules[TMM_DECODEPFRING].name = "DecodePfring"; tmm_modules[TMM_DECODEPFRING].ThreadInit = DecodePfringThreadInit; tmm_modules[TMM_DECODEPFRING].Func = DecodePfring; tmm_modules[TMM_DECODEPFRING].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEPFRING].ThreadDeinit = DecodePfringThreadDeinit; tmm_modules[TMM_DECODEPFRING].RegisterTests = NULL; tmm_modules[TMM_DECODEPFRING].flags = TM_FLAG_DECODE_TM; } static inline void PfringDumpCounters(PfringThreadVars *ptv) { pfring_stat pfring_s; if (likely((pfring_stats(ptv->pd, &pfring_s) >= 0))) { /* pfring counter is per socket and is not cleared after read. * So to get the number of packet on the interface we can add * the newly seen packets and drops for this thread and add it * to the interface counter */ uint64_t th_pkts = StatsGetLocalCounterValue(ptv->tv, ptv->capture_kernel_packets); uint64_t th_drops = StatsGetLocalCounterValue(ptv->tv, ptv->capture_kernel_drops); SC_ATOMIC_ADD(ptv->livedev->pkts, pfring_s.recv - th_pkts); SC_ATOMIC_ADD(ptv->livedev->drop, pfring_s.drop - th_drops); StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pfring_s.recv); StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pfring_s.drop); } } /** * \brief Pfring Packet Process function. * * This function fills in our packet structure from libpfring. * From here the packets are picked up by the DecodePfring thread. * * \param user pointer to PfringThreadVars * \param h pointer to pfring packet header * \param p pointer to the current packet */ static inline void PfringProcessPacket(void *user, struct pfring_pkthdr *h, Packet *p) { PfringThreadVars *ptv = (PfringThreadVars *)user; ptv->bytes += h->caplen; ptv->pkts++; p->livedev = ptv->livedev; /* PF_RING may fail to set timestamp */ if (h->ts.tv_sec == 0) { gettimeofday((struct timeval *)&h->ts, NULL); } p->ts.tv_sec = h->ts.tv_sec; p->ts.tv_usec = h->ts.tv_usec; /* PF_RING all packets are marked as a link type of ethernet * so that is what we do here. */ p->datalink = LINKTYPE_ETHERNET; /* get vlan id from header. Check on vlan_id not null even if comment in * header announce NO_VLAN is used when there is no VLAN. But NO_VLAN * is not defined nor used in PF_RING code. And vlan_id is set to 0 * in PF_RING kernel code when there is no VLAN. */ if ((!ptv->vlan_disabled) && h->extended_hdr.parsed_pkt.vlan_id) { p->vlan_id[0] = h->extended_hdr.parsed_pkt.vlan_id & 0x0fff; p->vlan_idx = 1; p->vlanh[0] = NULL; } switch (ptv->checksum_mode) { case CHECKSUM_VALIDATION_RXONLY: if (h->extended_hdr.rx_direction == 0) { p->flags |= PKT_IGNORE_CHECKSUM; } break; case CHECKSUM_VALIDATION_DISABLE: p->flags |= PKT_IGNORE_CHECKSUM; break; case CHECKSUM_VALIDATION_AUTO: if (ptv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ptv->pkts, SC_ATOMIC_GET(ptv->livedev->pkts), SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) { ptv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } break; default: break; } SET_PKT_LEN(p, h->caplen); } /** * \brief Recieves packets from an interface via libpfring. * * This function recieves packets from an interface and passes * the packet on to the pfring callback function. * * \param tv pointer to ThreadVars * \param data pointer that gets cast into PfringThreadVars for ptv * \param slot slot containing task information * \retval TM_ECODE_OK on success * \retval TM_ECODE_FAILED on failure */ TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); PfringThreadVars *ptv = (PfringThreadVars *)data; Packet *p = NULL; struct pfring_pkthdr hdr; TmSlot *s = (TmSlot *)slot; time_t last_dump = 0; u_int buffer_size; u_char *pkt_buffer; ptv->slot = s->slot_next; /* we have to enable the ring here as we need to do it after all * the threads have called pfring_set_cluster(). */ int rc = pfring_enable_ring(ptv->pd); if (rc != 0) { SCLogError(SC_ERR_PF_RING_OPEN, "pfring_enable_ring failed returned %d ", rc); SCReturnInt(TM_ECODE_FAILED); } while(1) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnInt(TM_ECODE_FAILED); } PKT_SET_SRC(p, PKT_SRC_WIRE); /* Some flavours of PF_RING may fail to set timestamp - see PF-RING-enabled libpcap code*/ hdr.ts.tv_sec = hdr.ts.tv_usec = 0; /* Check for Zero-copy mode */ if (ptv->flags & PFRING_FLAGS_ZERO_COPY) { buffer_size = 0; pkt_buffer = NULL; } else { buffer_size = GET_PKT_DIRECT_MAX_SIZE(p); pkt_buffer = GET_PKT_DIRECT_DATA(p); } int r = pfring_recv(ptv->pd, &pkt_buffer, buffer_size, &hdr, LIBPFRING_WAIT_FOR_INCOMING); if (likely(r == 1)) { /* profiling started before blocking pfring_recv call, so * reset it here */ PACKET_PROFILING_RESTART(p); /* Check for Zero-copy mode */ if (ptv->flags & PFRING_FLAGS_ZERO_COPY) { PacketSetData(p, pkt_buffer, hdr.caplen); } //printf("RecievePfring src %" PRIu32 " sport %" PRIu32 " dst %" PRIu32 " dstport %" PRIu32 "\n", // hdr.parsed_pkt.ipv4_src,hdr.parsed_pkt.l4_src_port, hdr.parsed_pkt.ipv4_dst,hdr.parsed_pkt.l4_dst_port); PfringProcessPacket(ptv, &hdr, p); if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(TM_ECODE_FAILED); } /* Trigger one dump of stats every second */ if (p->ts.tv_sec != last_dump) { PfringDumpCounters(ptv); last_dump = p->ts.tv_sec; } } else if (unlikely(r == 0)) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } /* pfring didn't use the packet yet */ TmThreadsCaptureInjectPacket(tv, ptv->slot, p); } else { SCLogError(SC_ERR_PF_RING_RECV,"pfring_recv error %" PRId32 "", r); TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(TM_ECODE_FAILED); } StatsSyncCountersIfSignalled(tv); } return TM_ECODE_OK; } /** * \brief Stop function for ReceivePfringLoop. * * This function forces ReceivePfringLoop to stop the * execution, exiting the packet capture loop. * * \param tv pointer to ThreadVars * \param data pointer that gets cast into PfringThreadVars for ptv * \retval TM_ECODE_OK on success * \retval TM_ECODE_FAILED on failure */ TmEcode PfringBreakLoop(ThreadVars *tv, void *data) { PfringThreadVars *ptv = (PfringThreadVars *)data; /* Safety check */ if (ptv->pd == NULL) { return TM_ECODE_FAILED; } pfring_breakloop(ptv->pd); return TM_ECODE_OK; } /** * \brief Init function for RecievePfring. * * This is a setup function for recieving packets * via libpfring. * * \param tv pointer to ThreadVars * \param initdata pointer to the interface passed from the user * \param data pointer gets populated with PfringThreadVars * \todo add a config option for setting cluster id * \todo Create a general pfring setup function. * \retval TM_ECODE_OK on success * \retval TM_ECODE_FAILED on error */ TmEcode ReceivePfringThreadInit(ThreadVars *tv, void *initdata, void **data) { int rc; u_int32_t version = 0; PfringIfaceConfig *pfconf = (PfringIfaceConfig *) initdata; unsigned int opflag; char const *active_runmode = RunmodeGetActive(); if (pfconf == NULL) return TM_ECODE_FAILED; PfringThreadVars *ptv = SCMalloc(sizeof(PfringThreadVars)); if (unlikely(ptv == NULL)) { pfconf->DerefFunc(pfconf); return TM_ECODE_FAILED; } memset(ptv, 0, sizeof(PfringThreadVars)); ptv->tv = tv; ptv->threads = 1; ptv->interface = SCStrdup(pfconf->iface); if (unlikely(ptv->interface == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate device string"); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } ptv->livedev = LiveGetDevice(pfconf->iface); if (ptv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } /* enable zero-copy mode for workers runmode */ if (active_runmode && strcmp("workers", active_runmode) == 0) { ptv->flags |= PFRING_FLAGS_ZERO_COPY; SCLogPerf("Enabling zero-copy for %s", ptv->interface); } ptv->checksum_mode = pfconf->checksum_mode; opflag = PF_RING_PROMISC; /* if suri uses VLAN and if we have a recent kernel, we need * to use parsed_pkt to get VLAN info */ if ((! ptv->vlan_disabled) && SCKernelVersionIsAtLeast(3, 0)) { opflag |= PF_RING_LONG_HEADER; } if (ptv->checksum_mode == CHECKSUM_VALIDATION_RXONLY) { if (strncmp(ptv->interface, "dna", 3) == 0) { SCLogWarning(SC_ERR_INVALID_VALUE, "Can't use rxonly checksum-checks on DNA interface," " resetting to auto"); ptv->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else { opflag |= PF_RING_LONG_HEADER; } } ptv->pd = pfring_open(ptv->interface, (uint32_t)default_packet_size, opflag); if (ptv->pd == NULL) { SCLogError(SC_ERR_PF_RING_OPEN,"Failed to open %s: pfring_open error." " Check if %s exists and pf_ring module is loaded.", ptv->interface, ptv->interface); pfconf->DerefFunc(pfconf); SCFree(ptv); return TM_ECODE_FAILED; } pfring_set_application_name(ptv->pd, PROG_NAME); pfring_version(ptv->pd, &version); /* We only set cluster info if the number of pfring threads is greater than 1 */ ptv->threads = pfconf->threads; ptv->cluster_id = pfconf->cluster_id; if ((ptv->threads == 1) && (strncmp(ptv->interface, "dna", 3) == 0)) { SCLogInfo("DNA interface detected, not adding thread to cluster"); } else if (strncmp(ptv->interface, "zc", 2) == 0) { SCLogInfo("ZC interface detected, not adding thread to cluster"); } else { ptv->ctype = pfconf->ctype; rc = pfring_set_cluster(ptv->pd, ptv->cluster_id, ptv->ctype); if (rc != 0) { SCLogError(SC_ERR_PF_RING_SET_CLUSTER_FAILED, "pfring_set_cluster " "returned %d for cluster-id: %d", rc, ptv->cluster_id); if (rc != PF_RING_ERROR_NOT_SUPPORTED || (pfconf->flags & PFRING_CONF_FLAGS_CLUSTER)) { /* cluster is mandatory as explicitly specified in the configuration */ pfconf->DerefFunc(pfconf); return TM_ECODE_FAILED; } } } if (ptv->threads > 1) { SCLogPerf("(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d", tv->name, (version & 0xFFFF0000) >> 16, (version & 0x0000FF00) >> 8, version & 0x000000FF, ptv->interface, ptv->cluster_id); } else { SCLogPerf("(%s) Using PF_RING v.%d.%d.%d, interface %s, cluster-id %d, single-pfring-thread", tv->name, (version & 0xFFFF0000) >> 16, (version & 0x0000FF00) >> 8, version & 0x000000FF, ptv->interface, ptv->cluster_id); } if (pfconf->bpf_filter) { ptv->bpf_filter = SCStrdup(pfconf->bpf_filter); if (unlikely(ptv->bpf_filter == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Set PF_RING bpf filter failed."); } else { SCMutexLock(&pfring_bpf_set_filter_lock); rc = pfring_set_bpf_filter(ptv->pd, ptv->bpf_filter); SCMutexUnlock(&pfring_bpf_set_filter_lock); if (rc < 0) { SCLogInfo("Set PF_RING bpf filter \"%s\" failed.", ptv->bpf_filter); } } } ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ptv->tv); ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ptv->tv); /* A bit strange to have this here but we only have vlan information * during reading so we need to know if we want to keep vlan during * the capture phase */ int vlanbool = 0; if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) { ptv->vlan_disabled = 1; } /* If kernel is older than 3.8, VLAN is not stripped so we don't * get the info from packt extended header but we will use a standard * parsing */ if (! SCKernelVersionIsAtLeast(3, 0)) { ptv->vlan_disabled = 1; } /* If VLAN tracking is disabled, set cluster type to 5-tuple or in case of a * ZC interface, do nothing */ if (ptv->vlan_disabled && ptv->ctype == CLUSTER_FLOW && strncmp(ptv->interface, "zc", 2) != 0) { SCLogPerf("VLAN disabled, setting cluster type to CLUSTER_FLOW_5_TUPLE"); rc = pfring_set_cluster(ptv->pd, ptv->cluster_id, CLUSTER_FLOW_5_TUPLE); if (rc != 0) { SCLogError(SC_ERR_PF_RING_SET_CLUSTER_FAILED, "pfring_set_cluster " "returned %d for cluster-id: %d", rc, ptv->cluster_id); pfconf->DerefFunc(pfconf); return TM_ECODE_FAILED; } } *data = (void *)ptv; pfconf->DerefFunc(pfconf); return TM_ECODE_OK; } /** * \brief This function prints stats to the screen at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PfringThreadVars for ptv */ void ReceivePfringThreadExitStats(ThreadVars *tv, void *data) { PfringThreadVars *ptv = (PfringThreadVars *)data; PfringDumpCounters(ptv); SCLogPerf("(%s) Kernel: Packets %" PRIu64 ", dropped %" PRIu64 "", tv->name, StatsGetLocalCounterValue(tv, ptv->capture_kernel_packets), StatsGetLocalCounterValue(tv, ptv->capture_kernel_drops)); SCLogPerf("(%s) Packets %" PRIu64 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes); } /** * \brief DeInit function closes pd at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PfringThreadVars for ptvi * \retval TM_ECODE_OK is always returned */ TmEcode ReceivePfringThreadDeinit(ThreadVars *tv, void *data) { PfringThreadVars *ptv = (PfringThreadVars *)data; if (ptv->interface) SCFree(ptv->interface); pfring_remove_from_cluster(ptv->pd); if (ptv->bpf_filter) { pfring_remove_bpf_filter(ptv->pd); SCFree(ptv->bpf_filter); } pfring_close(ptv->pd); return TM_ECODE_OK; } /** * \brief This function passes off to link type decoders. * * DecodePfring reads packets from the PacketQueue. Inside of libpcap version of * PF_RING all packets are marked as a link type of ethernet so that is what we do here. * * \param tv pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into PfringThreadVars for ptv * \param pq pointer to the current PacketQueue * * \todo Verify that PF_RING only deals with ethernet traffic * * \warning This function bypasses the pkt buf and len macro's * * \retval TM_ECODE_OK is always returned */ TmEcode DecodePfring(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* If suri has set vlan during reading, we increase vlan counter */ if (p->vlan_idx) { StatsIncr(tv, dtv->counter_vlan); } DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); PacketDecodeFinalize(tv, dtv, p); return TM_ECODE_OK; } /** * \brief This an Init function for DecodePfring * * \param tv pointer to ThreadVars * \param initdata pointer to initilization data. * \param data pointer that gets cast into PfringThreadVars for ptv * \retval TM_ECODE_OK is returned on success * \retval TM_ECODE_FAILED is returned on error */ TmEcode DecodePfringThreadInit(ThreadVars *tv, void *initdata, void **data) { DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; #ifdef __SC_CUDA_SUPPORT__ if (CudaThreadVarsInit(&dtv->cuda_vars) < 0) SCReturnInt(TM_ECODE_FAILED); #endif return TM_ECODE_OK; } TmEcode DecodePfringThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* HAVE_PFRING */ /* eof */ suricata-3.2.1/src/source-pcap-file.h0000644000000000000000000000201713051004444014310 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __SOURCE_PCAP_FILE_H__ #define __SOURCE_PCAP_FILE_H__ void TmModuleReceivePcapFileRegister (void); void TmModuleDecodePcapFileRegister (void); void PcapIncreaseInvalidChecksum(); void PcapFileGlobalInit(); #endif /* __SOURCE_PCAP_FILE_H__ */ suricata-3.2.1/src/util-decode-der-get.h0000644000000000000000000000403413051004444014676 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * */ #ifndef __UTIL_DECODE_DER_GET_H__ #define __UTIL_DECODE_DER_GET_H__ const Asn1Generic * Asn1DerGet(const Asn1Generic *top, const uint8_t *seq_index, const uint32_t seqsz, uint32_t *errcode); int Asn1DerGetIssuerDN(const Asn1Generic *cert, char *buffer, uint32_t length, uint32_t *errcode); int Asn1DerGetValidity(const Asn1Generic *cert, time_t *not_before, time_t *not_after, uint32_t *errcode); int Asn1DerGetSubjectDN(const Asn1Generic *cert, char *buffer, uint32_t length, uint32_t *errcode); #endif /* __UTIL_DECODE_DER_GET_H__ */ suricata-3.2.1/src/action-globals.h0000644000000000000000000000221113051004444014044 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __ACTION_GLOBALS_H__ #define __ACTION_GLOBALS_H__ /* Changing them as flags, so later we can have alerts * and drop simultaneously */ #define ACTION_ALERT 0x01 #define ACTION_DROP 0x02 #define ACTION_REJECT 0x04 #define ACTION_REJECT_DST 0x08 #define ACTION_REJECT_BOTH 0x10 #define ACTION_PASS 0x20 #endif /* __ACTION_GLOBALS_H__ */ suricata-3.2.1/src/util-syslog.c0000644000000000000000000000457113051004444013447 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * Syslog utility file * */ #include "suricata-common.h" /* holds the string-enum mapping for the syslog facility in SCLogOPIfaceCtx */ SCEnumCharMap sc_syslog_facility_map[] = { { "auth", LOG_AUTH }, { "authpriv", LOG_AUTHPRIV }, { "cron", LOG_CRON }, { "daemon", LOG_DAEMON }, { "ftp", LOG_FTP }, { "kern", LOG_KERN }, { "lpr", LOG_LPR }, { "mail", LOG_MAIL }, { "news", LOG_NEWS }, { "security", LOG_AUTH }, { "syslog", LOG_SYSLOG }, { "user", LOG_USER }, { "uucp", LOG_UUCP }, { "local0", LOG_LOCAL0 }, { "local1", LOG_LOCAL1 }, { "local2", LOG_LOCAL2 }, { "local3", LOG_LOCAL3 }, { "local4", LOG_LOCAL4 }, { "local5", LOG_LOCAL5 }, { "local6", LOG_LOCAL6 }, { "local7", LOG_LOCAL7 }, { NULL, -1 } }; /** \brief returns the syslog facility enum map */ SCEnumCharMap *SCSyslogGetFacilityMap() { return sc_syslog_facility_map; } SCEnumCharMap sc_syslog_level_map[ ] = { { "Emergency", LOG_EMERG }, { "Alert", LOG_ALERT }, { "Critical", LOG_CRIT }, { "Error", LOG_ERR }, { "Warning", LOG_WARNING }, { "Notice", LOG_NOTICE }, { "Info", LOG_INFO }, { "Debug", LOG_DEBUG }, { NULL, -1 } }; /** \brief returns the syslog facility enum map */ SCEnumCharMap *SCSyslogGetLogLevelMap() { return sc_syslog_level_map; } suricata-3.2.1/src/detect-geoip.h0000644000000000000000000000244413051004444013527 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ignacio Sanchez */ #ifndef __DETECT_GEOIP_H__ #define __DETECT_GEOIP_H__ #ifdef HAVE_GEOIP #include #include "util-spm-bm.h" #define GEOOPTION_MAXSIZE 3 /* Country Code (2 chars) + NULL */ #define GEOOPTION_MAXLOCATIONS 64 typedef struct DetectGeoipData_ { uint8_t location[GEOOPTION_MAXLOCATIONS][GEOOPTION_MAXSIZE]; /** country code for now, null term.*/ int nlocations; /** number of location strings parsed */ uint32_t flags; GeoIP *geoengine; } DetectGeoipData; #endif void DetectGeoipRegister(void); #endif suricata-3.2.1/src/win32-misc.c0000644000000000000000000000600313051004444013037 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jan Jezek * * Misc Windows utility functions */ #ifdef OS_WIN32 #include "suricata-common.h" #include "win32-misc.h" #include "direct.h" void setenv(const char *name, const char *value, int overwrite) { if (overwrite || NULL == getenv(name)) { char *str = SCMalloc(strlen(name) + strlen(value) + 2); if (unlikely(str == NULL)) return; snprintf(str, strlen(name) + strlen(value) + 1, "%s=%s", name, value); putenv(str); SCFree(str); } } void unsetenv(const char *name) { char *str = SCMalloc(strlen(name) + 2); if (unlikely(str == NULL)) return; snprintf(str, strlen(name) + 1, "%s=", name); putenv(str); SCFree(str); } const char* inet_ntop(int af, const void *src, char *dst, uint32_t cnt) { if (af == AF_INET) { struct sockaddr_in in; memset(&in, 0, sizeof(in)); in.sin_family = AF_INET; memcpy(&in.sin_addr, src, sizeof(struct in_addr)); if (0 == getnameinfo((struct sockaddr *)&in, sizeof(struct sockaddr_in), dst, cnt, NULL, 0, NI_NUMERICHOST)) return dst; } else if (af == AF_INET6) { struct sockaddr_in6 in6; memset(&in6, 0, sizeof(in6)); in6.sin6_family = AF_INET6; memcpy(&in6.sin6_addr, src, sizeof(struct in_addr6)); if (0 == getnameinfo((struct sockaddr *)&in6, sizeof(struct sockaddr_in6), dst, cnt, NULL, 0, NI_NUMERICHOST)) return dst; } return NULL; } int inet_pton(int af, const char *src, void *dst) { struct addrinfo hints; memset(&hints, 0, sizeof(struct addrinfo)); hints.ai_family = af; struct addrinfo* result = NULL; if (0 != getaddrinfo(src, NULL, &hints, &result)) return -1; if (result) { if (result->ai_family == AF_INET) { struct sockaddr_in* in = (struct sockaddr_in*)result->ai_addr; memcpy(dst, &in->sin_addr, 4); } else if (result->ai_family == AF_INET6) { struct sockaddr_in6* in6 = (struct sockaddr_in6*)result->ai_addr; memcpy(dst, &in6->sin6_addr, 16); } else { freeaddrinfo(result); return -1; } freeaddrinfo(result); return 1; } return -1; } #endif /* OS_WIN32 */ suricata-3.2.1/src/log-dnslog.h0000644000000000000000000000160013051004444013214 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_DNSLOG_H__ #define __LOG_DNSLOG_H__ void LogDnsLogRegister(void); #endif /* __LOG_DNSLOG_H__ */ suricata-3.2.1/src/app-layer-ssh.h0000644000000000000000000000432013051004444013636 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * \author Victor Julien */ #ifndef __APP_LAYER_SSH_H__ #define __APP_LAYER_SSH_H__ /* header flag */ #define SSH_FLAG_VERSION_PARSED 0x01 /* This flags indicate that the rest of the communication * must be ciphered, so the parsing finish here */ #define SSH_FLAG_PARSER_DONE 0x02 #define SSH_FLAG_STATE_LOGGED 0x04 #define SSH_FLAG_STATE_LOGGED_LUA 0x08 /* MSG_CODE */ #define SSH_MSG_NEWKEYS 21 /** From SSH-TRANSP rfc SSH Bunary packet structure: uint32 packet_length byte padding_length byte[n1] payload; n1 = packet_length - padding_length - 1 byte[n2] random padding; n2 = padding_length byte[m] mac (Message Authentication Code - MAC); m = mac_length So we are going to do a header struct to store the lenghts and msg_code (inside payload, if any) */ typedef struct SshHeader_ { uint32_t pkt_len; uint8_t padding_len; uint8_t msg_code; uint8_t buf[6]; uint8_t buf_offset; uint8_t flags; uint32_t record_left; uint8_t *proto_version; uint8_t *software_version; uint8_t *banner_buffer; uint16_t banner_len; } SshHeader; /** structure to store the SSH state values */ typedef struct SshState_ { SshHeader srv_hdr; SshHeader cli_hdr; } SshState; void RegisterSSHParsers(void); void SSHParserRegisterTests(void); #endif /* __APP_LAYER_SSH_H__ */ suricata-3.2.1/src/counters.h0000644000000000000000000001146313051004444013021 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Victor Julien */ #ifndef __COUNTERS_H__ #define __COUNTERS_H__ /* forward declaration of the ThreadVars structure */ struct ThreadVars_; /** * \brief Container to hold the counter variable */ typedef struct StatsCounter_ { int type; /* local id for this counter in this thread */ uint16_t id; /* global id, used in output */ uint16_t gid; /* counter value(s): copies from the 'private' counter */ uint64_t value; /**< sum of updates/increments, or 'set' value */ uint64_t updates; /**< number of updates (for avg) */ /* when using type STATS_TYPE_Q_FUNC this function is called once * to get the counter value, regardless of how many threads there are. */ uint64_t (*Func)(void); /* name of the counter */ const char *name; /* the next perfcounter for this tv's tm instance */ struct StatsCounter_ *next; } StatsCounter; /** * \brief Stats Context for a ThreadVars instance */ typedef struct StatsPublicThreadContext_ { /* flag set by the wakeup thread, to inform the client threads to sync */ uint32_t perf_flag; /* pointer to the head of a list of counters assigned under this context */ StatsCounter *head; /* holds the total no of counters already assigned for this perf context */ uint16_t curr_id; /* mutex to prevent simultaneous access during update_counter/output_stat */ SCMutex m; } StatsPublicThreadContext; /** * \brief Storage for local counters, with a link to the public counter used * for syncs */ typedef struct StatsLocalCounter_ { /* pointer to the counter that corresponds to this local counter */ StatsCounter *pc; /* local counter id of the above counter */ uint16_t id; /* total value of the adds/increments, or exact value in case of 'set' */ uint64_t value; /* no of times the local counter has been updated */ uint64_t updates; } StatsLocalCounter; /** * \brief used to hold the private version of the counters registered */ typedef struct StatsPrivateThreadContext_ { /* points to the array holding local counters */ StatsLocalCounter *head; /* size of head array in elements */ uint32_t size; int initialized; } StatsPrivateThreadContext; /* the initialization functions */ void StatsInit(void); void StatsSetupPostConfig(void); void StatsSpawnThreads(void); void StatsRegisterTests(void); /* functions used to free the resources alloted by the Stats API */ void StatsReleaseResources(void); /* counter registration functions */ uint16_t StatsRegisterCounter(char *, struct ThreadVars_ *); uint16_t StatsRegisterAvgCounter(char *, struct ThreadVars_ *); uint16_t StatsRegisterMaxCounter(char *, struct ThreadVars_ *); uint16_t StatsRegisterGlobalCounter(char *cname, uint64_t (*Func)(void)); /* functions used to update local counter values */ void StatsAddUI64(struct ThreadVars_ *, uint16_t, uint64_t); void StatsSetUI64(struct ThreadVars_ *, uint16_t, uint64_t); void StatsIncr(struct ThreadVars_ *, uint16_t); /* utility functions */ int StatsUpdateCounterArray(StatsPrivateThreadContext *, StatsPublicThreadContext *); uint64_t StatsGetLocalCounterValue(struct ThreadVars_ *, uint16_t); int StatsSetupPrivate(struct ThreadVars_ *); void StatsThreadCleanup(struct ThreadVars_ *); #define StatsSyncCounters(tv) \ StatsUpdateCounterArray(&(tv)->perf_private_ctx, &(tv)->perf_public_ctx); \ #define StatsSyncCountersIfSignalled(tv) \ do { \ if ((tv)->perf_public_ctx.perf_flag == 1) { \ StatsUpdateCounterArray(&(tv)->perf_private_ctx, \ &(tv)->perf_public_ctx); \ } \ } while (0) #ifdef BUILD_UNIX_SOCKET TmEcode StatsOutputCounterSocket(json_t *cmd, json_t *answer, void *data); #endif #endif /* __COUNTERS_H__ */ suricata-3.2.1/src/util-mpm.c0000644000000000000000000005623613051004444012725 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Pattern matcher utility Functions */ #include "suricata-common.h" #include "util-mpm.h" #include "util-debug.h" /* include pattern matchers */ #include "util-mpm-ac.h" #include "util-mpm-ac-bs.h" #include "util-mpm-ac-tile.h" #include "util-mpm-hs.h" #include "util-hashlist.h" #include "detect-engine.h" #include "util-cuda.h" #include "util-misc.h" #include "conf.h" #include "conf-yaml-loader.h" #include "queue.h" #include "util-unittest.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda-handlers.h" #include "detect-engine-mpm.h" #endif #include "util-memcpy.h" #ifdef BUILD_HYPERSCAN #include "hs.h" #endif /** * \brief Register a new Mpm Context. * * \param name A new profile to be registered to store this MpmCtx. * * \retval id Return the id created for the new MpmCtx profile. */ int32_t MpmFactoryRegisterMpmCtxProfile(DetectEngineCtx *de_ctx, const char *name) { void *ptmp; /* the very first entry */ if (de_ctx->mpm_ctx_factory_container == NULL) { de_ctx->mpm_ctx_factory_container = SCMalloc(sizeof(MpmCtxFactoryContainer)); if (de_ctx->mpm_ctx_factory_container == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(de_ctx->mpm_ctx_factory_container, 0, sizeof(MpmCtxFactoryContainer)); MpmCtxFactoryItem *item = SCMalloc(sizeof(MpmCtxFactoryItem)); if (unlikely(item == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } item[0].name = name; /* toserver */ item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx)); if (item[0].mpm_ctx_ts == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(item[0].mpm_ctx_ts, 0, sizeof(MpmCtx)); item[0].mpm_ctx_ts->global = 1; /* toclient */ item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx)); if (item[0].mpm_ctx_tc == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(item[0].mpm_ctx_tc, 0, sizeof(MpmCtx)); item[0].mpm_ctx_tc->global = 1; /* our id starts from 0 always. Helps us with the ctx retrieval from * the array */ item[0].id = 0; /* store the newly created item */ de_ctx->mpm_ctx_factory_container->items = item; de_ctx->mpm_ctx_factory_container->no_of_items++; /* the first id is always 0 */ return item[0].id; } else { int i; MpmCtxFactoryItem *items = de_ctx->mpm_ctx_factory_container->items; for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) { if (items[i].name != NULL && strcmp(items[i].name, name) == 0) { /* looks like we have this mpm_ctx freed */ if (items[i].mpm_ctx_ts == NULL) { items[i].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx)); if (items[i].mpm_ctx_ts == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(items[i].mpm_ctx_ts, 0, sizeof(MpmCtx)); items[i].mpm_ctx_ts->global = 1; } if (items[i].mpm_ctx_tc == NULL) { items[i].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx)); if (items[i].mpm_ctx_tc == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(items[i].mpm_ctx_tc, 0, sizeof(MpmCtx)); items[i].mpm_ctx_tc->global = 1; } return items[i].id; } } /* let's make the new entry */ ptmp = SCRealloc(items, (de_ctx->mpm_ctx_factory_container->no_of_items + 1) * sizeof(MpmCtxFactoryItem)); if (unlikely(ptmp == NULL)) { SCFree(items); items = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } items = ptmp; de_ctx->mpm_ctx_factory_container->items = items; MpmCtxFactoryItem *new_item = &items[de_ctx->mpm_ctx_factory_container->no_of_items]; new_item[0].name = name; /* toserver */ new_item[0].mpm_ctx_ts = SCMalloc(sizeof(MpmCtx)); if (new_item[0].mpm_ctx_ts == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(new_item[0].mpm_ctx_ts, 0, sizeof(MpmCtx)); new_item[0].mpm_ctx_ts->global = 1; /* toclient */ new_item[0].mpm_ctx_tc = SCMalloc(sizeof(MpmCtx)); if (new_item[0].mpm_ctx_tc == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(new_item[0].mpm_ctx_tc, 0, sizeof(MpmCtx)); new_item[0].mpm_ctx_tc->global = 1; new_item[0].id = de_ctx->mpm_ctx_factory_container->no_of_items; de_ctx->mpm_ctx_factory_container->no_of_items++; /* the newly created id */ return new_item[0].id; } } int32_t MpmFactoryIsMpmCtxAvailable(const DetectEngineCtx *de_ctx, const MpmCtx *mpm_ctx) { if (mpm_ctx == NULL) return 0; if (de_ctx->mpm_ctx_factory_container == NULL) { return 0; } else { int i; for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) { if (mpm_ctx == de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_ts || mpm_ctx == de_ctx->mpm_ctx_factory_container->items[i].mpm_ctx_tc) { return 1; } } return 0; } } MpmCtx *MpmFactoryGetMpmCtxForProfile(const DetectEngineCtx *de_ctx, int32_t id, int direction) { if (id == MPM_CTX_FACTORY_UNIQUE_CONTEXT) { MpmCtx *mpm_ctx = SCMalloc(sizeof(MpmCtx)); if (unlikely(mpm_ctx == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(mpm_ctx, 0, sizeof(MpmCtx)); return mpm_ctx; } else if (id < -1) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument - %d\n", id); return NULL; } else if (id >= de_ctx->mpm_ctx_factory_container->no_of_items) { /* this id does not exist */ return NULL; } else { return (direction == 0) ? de_ctx->mpm_ctx_factory_container->items[id].mpm_ctx_ts : de_ctx->mpm_ctx_factory_container->items[id].mpm_ctx_tc; } } void MpmFactoryReClaimMpmCtx(const DetectEngineCtx *de_ctx, MpmCtx *mpm_ctx) { if (mpm_ctx == NULL) return; if (!MpmFactoryIsMpmCtxAvailable(de_ctx, mpm_ctx)) { if (mpm_ctx->mpm_type != MPM_NOTSET) mpm_table[mpm_ctx->mpm_type].DestroyCtx(mpm_ctx); SCFree(mpm_ctx); } return; } void MpmFactoryDeRegisterAllMpmCtxProfiles(DetectEngineCtx *de_ctx) { if (de_ctx->mpm_ctx_factory_container == NULL) return; int i = 0; MpmCtxFactoryItem *items = de_ctx->mpm_ctx_factory_container->items; for (i = 0; i < de_ctx->mpm_ctx_factory_container->no_of_items; i++) { if (items[i].mpm_ctx_ts != NULL) { if (items[i].mpm_ctx_ts->mpm_type != MPM_NOTSET) mpm_table[items[i].mpm_ctx_ts->mpm_type].DestroyCtx(items[i].mpm_ctx_ts); SCFree(items[i].mpm_ctx_ts); } if (items[i].mpm_ctx_tc != NULL) { if (items[i].mpm_ctx_tc->mpm_type != MPM_NOTSET) mpm_table[items[i].mpm_ctx_tc->mpm_type].DestroyCtx(items[i].mpm_ctx_tc); SCFree(items[i].mpm_ctx_tc); } } SCFree(de_ctx->mpm_ctx_factory_container->items); SCFree(de_ctx->mpm_ctx_factory_container); de_ctx->mpm_ctx_factory_container = NULL; return; } #ifdef __SC_CUDA_SUPPORT__ static void MpmCudaConfFree(void *conf) { SCFree(conf); return; } static void *MpmCudaConfParse(ConfNode *node) { const char *value; MpmCudaConf *conf = SCMalloc(sizeof(MpmCudaConf)); if (unlikely(conf == NULL)) exit(EXIT_FAILURE); memset(conf, 0, sizeof(*conf)); if (node != NULL) value = ConfNodeLookupChildValue(node, "data-buffer-size-min-limit"); else value = NULL; if (value == NULL) { /* default */ conf->data_buffer_size_min_limit = UTIL_MPM_CUDA_DATA_BUFFER_SIZE_MIN_LIMIT_DEFAULT; } else if (ParseSizeStringU16(value, &conf->data_buffer_size_min_limit) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "data-buffer-size-min-limit - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "data-buffer-size-max-limit"); else value = NULL; if (value == NULL) { /* default */ conf->data_buffer_size_max_limit = UTIL_MPM_CUDA_DATA_BUFFER_SIZE_MAX_LIMIT_DEFAULT; } else if (ParseSizeStringU16(value, &conf->data_buffer_size_max_limit) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "data-buffer-size-max-limit - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "cudabuffer-buffer-size"); else value = NULL; if (value == NULL) { /* default */ conf->cb_buffer_size = UTIL_MPM_CUDA_CUDA_BUFFER_DBUFFER_SIZE_DEFAULT; } else if (ParseSizeStringU32(value, &conf->cb_buffer_size) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "cb-buffer-size - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "gpu-transfer-size"); else value = NULL; if (value == NULL) { /* default */ conf->gpu_transfer_size = UTIL_MPM_CUDA_GPU_TRANSFER_SIZE; } else if (ParseSizeStringU32(value, &conf->gpu_transfer_size) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "gpu-transfer-size - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "batching-timeout"); else value = NULL; if (value == NULL) { /* default */ conf->batching_timeout = UTIL_MPM_CUDA_BATCHING_TIMEOUT_DEFAULT; } else if ((conf->batching_timeout = atoi(value)) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "batching-timeout - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "device-id"); else value = NULL; if (value == NULL) { /* default */ conf->device_id = UTIL_MPM_CUDA_DEVICE_ID_DEFAULT; } else if ((conf->device_id = atoi(value)) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "device-id - \"%s\"", node->name, value); exit(EXIT_FAILURE); } if (node != NULL) value = ConfNodeLookupChildValue(node, "cuda-streams"); else value = NULL; if (value == NULL) { /* default */ conf->cuda_streams = UTIL_MPM_CUDA_CUDA_STREAMS_DEFAULT; } else if ((conf->cuda_streams = atoi(value)) < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for %s." "cuda-streams - \"%s\"", node->name, value); exit(EXIT_FAILURE); } return conf; } void MpmCudaEnvironmentSetup() { if (PatternMatchDefaultMatcher() != MPM_AC_CUDA) return; CudaHandlerAddCudaProfileFromConf("mpm", MpmCudaConfParse, MpmCudaConfFree); MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); if (conf == NULL) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error obtaining cuda mpm " "profile."); exit(EXIT_FAILURE); } if (MpmCudaBufferSetup() < 0) { SCLogError(SC_ERR_AC_CUDA_ERROR, "Error setting up env for ac " "cuda"); exit(EXIT_FAILURE); } return; } #endif void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher) { mpm_table[matcher].InitThreadCtx(NULL, mpm_thread_ctx); } void MpmInitCtx (MpmCtx *mpm_ctx, uint16_t matcher) { mpm_ctx->mpm_type = matcher; mpm_table[matcher].InitCtx(mpm_ctx); } /* MPM matcher to use by default, i.e. when "mpm-algo" is set to "auto". * If Hyperscan is available, use it. Otherwise, use AC. */ #ifdef BUILD_HYPERSCAN # define DEFAULT_MPM MPM_HS # ifdef __tile__ # define DEFAULT_MPM_AC MPM_AC_TILE # else # define DEFAULT_MPM_AC MPM_AC # endif #else # ifdef __tile__ # define DEFAULT_MPM MPM_AC_TILE # else # define DEFAULT_MPM MPM_AC # endif #endif void MpmTableSetup(void) { memset(mpm_table, 0, sizeof(mpm_table)); mpm_default_matcher = DEFAULT_MPM; MpmACRegister(); MpmACBSRegister(); MpmACTileRegister(); #ifdef BUILD_HYPERSCAN #ifdef HAVE_HS_VALID_PLATFORM /* Enable runtime check for SSSE3. Do not use Hyperscan MPM matcher if * check is not successful. */ if (hs_valid_platform() != HS_SUCCESS) { SCLogInfo("SSSE3 support not detected, disabling Hyperscan for " "MPM"); /* Fall back to best Aho-Corasick variant. */ mpm_default_matcher = DEFAULT_MPM_AC; } else { MpmHSRegister(); } #else MpmHSRegister(); #endif /* HAVE_HS_VALID_PLATFORM */ #endif /* BUILD_HYPERSCAN */ #ifdef __SC_CUDA_SUPPORT__ MpmACCudaRegister(); #endif /* __SC_CUDA_SUPPORT__ */ } int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { return mpm_table[mpm_ctx->mpm_type].AddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { return mpm_table[mpm_ctx->mpm_type].AddPatternNocase(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } /** * \internal * \brief Creates a hash of the pattern. We use it for the hashing process * during the initial pattern insertion time, to cull duplicate sigs. * * \param pat Pointer to the pattern. * \param patlen Pattern length. * * \retval hash A 32 bit unsigned hash. */ static inline uint32_t MpmInitHashRaw(uint8_t *pat, uint16_t patlen) { uint32_t hash = patlen * pat[0]; if (patlen > 1) hash += pat[1]; return (hash % MPM_INIT_HASH_SIZE); } /** * \internal * \brief Looks up a pattern. We use it for the hashing process during the * the initial pattern insertion time, to cull duplicate sigs. * * \param ctx Pointer to the AC ctx. * \param pat Pointer to the pattern. * \param patlen Pattern length. * \param flags Flags. We don't need this. * * \retval hash A 32 bit unsigned hash. */ static inline MpmPattern *MpmInitHashLookup(MpmCtx *ctx, uint8_t *pat, uint16_t patlen, char flags, uint32_t pid) { uint32_t hash = MpmInitHashRaw(pat, patlen); if (ctx->init_hash == NULL) { return NULL; } MpmPattern *t = ctx->init_hash[hash]; for ( ; t != NULL; t = t->next) { if (!(flags & MPM_PATTERN_CTX_OWNS_ID)) { if (t->id == pid) return t; } else { if (t->len == patlen && memcmp(pat, t->original_pat, patlen) == 0 && t->flags == flags) { return t; } } } return NULL; } /** * \internal * \brief Allocs a new pattern instance. * * \param mpm_ctx Pointer to the mpm context. * * \retval p Pointer to the newly created pattern. */ static inline MpmPattern *MpmAllocPattern(MpmCtx *mpm_ctx) { MpmPattern *p = SCMalloc(sizeof(MpmPattern)); if (unlikely(p == NULL)) { exit(EXIT_FAILURE); } memset(p, 0, sizeof(MpmPattern)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(MpmPattern); return p; } /** * \internal * \brief Used to free MpmPattern instances. * * \param mpm_ctx Pointer to the mpm context. * \param p Pointer to the MpmPattern instance to be freed. */ void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p) { if (p != NULL && p->cs != NULL && p->cs != p->ci) { SCFree(p->cs); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= p->len; } if (p != NULL && p->ci != NULL) { SCFree(p->ci); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= p->len; } if (p != NULL && p->original_pat != NULL) { SCFree(p->original_pat); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= p->len; } if (p != NULL) { SCFree(p); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(MpmPattern); } return; } static inline uint32_t MpmInitHash(MpmPattern *p) { uint32_t hash = p->len * p->original_pat[0]; if (p->len > 1) hash += p->original_pat[1]; return (hash % MPM_INIT_HASH_SIZE); } static inline int MpmInitHashAdd(MpmCtx *ctx, MpmPattern *p) { uint32_t hash = MpmInitHash(p); if (ctx->init_hash == NULL) { return 0; } if (ctx->init_hash[hash] == NULL) { ctx->init_hash[hash] = p; return 0; } MpmPattern *tt = NULL; MpmPattern *t = ctx->init_hash[hash]; /* get the list tail */ do { tt = t; t = t->next; } while (t != NULL); tt->next = p; return 0; } /** * \internal * \brief Add a pattern to the mpm-ac context. * * \param mpm_ctx Mpm context. * \param pat Pointer to the pattern. * \param patlen Length of the pattern. * \param pid Pattern id * \param sid Signature id (internal id). * \param flags Pattern's MPM_PATTERN_* flags. * * \retval 0 On success. * \retval -1 On failure. */ int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { SCLogDebug("Adding pattern for ctx %p, patlen %"PRIu16" and pid %" PRIu32, mpm_ctx, patlen, pid); if (patlen == 0) { SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0"); return 0; } if (flags & MPM_PATTERN_CTX_OWNS_ID) pid = UINT_MAX; /* check if we have already inserted this pattern */ MpmPattern *p = MpmInitHashLookup(mpm_ctx, pat, patlen, flags, pid); if (p == NULL) { SCLogDebug("Allocing new pattern"); /* p will never be NULL */ p = MpmAllocPattern(mpm_ctx); p->len = patlen; p->flags = flags; if (flags & MPM_PATTERN_CTX_OWNS_ID) p->id = mpm_ctx->max_pat_id++; else p->id = pid; p->original_pat = SCMalloc(patlen); if (p->original_pat == NULL) goto error; mpm_ctx->memory_cnt++; mpm_ctx->memory_size += patlen; memcpy(p->original_pat, pat, patlen); p->ci = SCMalloc(patlen); if (p->ci == NULL) goto error; mpm_ctx->memory_cnt++; mpm_ctx->memory_size += patlen; memcpy_tolower(p->ci, pat, patlen); /* setup the case sensitive part of the pattern */ if (p->flags & MPM_PATTERN_FLAG_NOCASE) { /* nocase means no difference between cs and ci */ p->cs = p->ci; } else { if (memcmp(p->ci, pat, p->len) == 0) { /* no diff between cs and ci: pat is lowercase */ p->cs = p->ci; } else { p->cs = SCMalloc(patlen); if (p->cs == NULL) goto error; mpm_ctx->memory_cnt++; mpm_ctx->memory_size += patlen; memcpy(p->cs, pat, patlen); } } /* put in the pattern hash */ MpmInitHashAdd(mpm_ctx, p); mpm_ctx->pattern_cnt++; if (mpm_ctx->maxlen < patlen) mpm_ctx->maxlen = patlen; if (mpm_ctx->minlen == 0) { mpm_ctx->minlen = patlen; } else { if (mpm_ctx->minlen > patlen) mpm_ctx->minlen = patlen; } /* we need the max pat id */ if (p->id > mpm_ctx->max_pat_id) mpm_ctx->max_pat_id = p->id; p->sids_size = 1; p->sids = SCMalloc(p->sids_size * sizeof(SigIntId)); BUG_ON(p->sids == NULL); p->sids[0] = sid; } else { /* we can be called multiple times for the same sid in the case * of the 'single' modus. Here multiple rule groups share the * same mpm ctx and might be adding the same pattern to the * mpm_ctx */ int found = 0; uint32_t x = 0; for (x = 0; x < p->sids_size; x++) { if (p->sids[x] == sid) { found = 1; break; } } if (!found) { SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1))); BUG_ON(sids == NULL); p->sids = sids; p->sids[p->sids_size] = sid; p->sids_size++; } } return 0; error: MpmFreePattern(mpm_ctx, p); return -1; } /************************************Unittests*********************************/ #ifdef UNITTESTS #endif /* UNITTESTS */ void MpmRegisterTests(void) { #ifdef UNITTESTS uint16_t i; for (i = 0; i < MPM_TABLE_SIZE; i++) { if (i == MPM_NOTSET) continue; g_ut_modules++; if (mpm_table[i].RegisterUnittests != NULL) { g_ut_covered++; mpm_table[i].RegisterUnittests(); } else { if (coverage_unittests) SCLogWarning(SC_WARN_NO_UNITTESTS, "mpm module %s has no " "unittest registration function.", mpm_table[i].name); } } #endif } suricata-3.2.1/src/detect-icode.c0000644000000000000000000004077613051004444013514 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias * * Implements icode keyword support */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-icode.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /** *\brief Regex for parsing our icode options */ #define PARSE_REGEX "^\\s*(<|>)?\\s*([0-9]+)\\s*(?:<>\\s*([0-9]+))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectICodeMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectICodeSetup(DetectEngineCtx *, Signature *, char *); void DetectICodeRegisterTests(void); void DetectICodeFree(void *); static int PrefilterSetupICode(SigGroupHead *sgh); static _Bool PrefilterICodeIsPrefilterable(const Signature *s); /** * \brief Registration function for icode: keyword */ void DetectICodeRegister (void) { sigmatch_table[DETECT_ICODE].name = "icode"; sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value"; sigmatch_table[DETECT_ICODE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icode"; sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch; sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup; sigmatch_table[DETECT_ICODE].Free = DetectICodeFree; sigmatch_table[DETECT_ICODE].RegisterTests = DetectICodeRegisterTests; sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable; sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } #define DETECT_ICODE_EQ PREFILTER_U8HASH_MODE_EQ /**< "equal" operator */ #define DETECT_ICODE_LT PREFILTER_U8HASH_MODE_LT /**< "less than" operator */ #define DETECT_ICODE_GT PREFILTER_U8HASH_MODE_GT /**< "greater than" operator */ #define DETECT_ICODE_RN PREFILTER_U8HASH_MODE_RA /**< "range" operator */ typedef struct DetectICodeData_ { uint8_t code1; uint8_t code2; uint8_t mode; } DetectICodeData; static inline int ICodeMatch(const uint8_t pcode, const uint8_t mode, const uint8_t dcode1, const uint8_t dcode2) { switch (mode) { case DETECT_ICODE_EQ: return (pcode == dcode1) ? 1 : 0; case DETECT_ICODE_LT: return (pcode < dcode1) ? 1 : 0; case DETECT_ICODE_GT: return (pcode > dcode1) ? 1 : 0; case DETECT_ICODE_RN: return (pcode > dcode1 && pcode < dcode2) ? 1 : 0; } return 0; } /** * \brief This function is used to match icode rule option set on a packet with those passed via icode: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectICodeData * * \retval 0 no match * \retval 1 match */ int DetectICodeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { if (PKT_IS_PSEUDOPKT(p)) return 0; uint8_t picode; if (PKT_IS_ICMPV4(p)) { picode = ICMPV4_GET_CODE(p); } else if (PKT_IS_ICMPV6(p)) { picode = ICMPV6_GET_CODE(p); } else { /* Packet not ICMPv4 nor ICMPv6 */ return 0; } const DetectICodeData *icd = (const DetectICodeData *)ctx; return ICodeMatch(picode, icd->mode, icd->code1, icd->code2); } /** * \brief This function is used to parse icode options passed via icode: keyword * * \param icodestr Pointer to the user provided icode options * * \retval icd pointer to DetectICodeData on success * \retval NULL on failure */ DetectICodeData *DetectICodeParse(char *icodestr) { DetectICodeData *icd = NULL; char *args[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, icodestr, strlen(icodestr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, icodestr); goto error; } int i; const char *str_ptr; for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)icodestr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i-1] = (char *)str_ptr; } icd = SCMalloc(sizeof(DetectICodeData)); if (unlikely(icd == NULL)) goto error; icd->code1 = 0; icd->code2 = 0; icd->mode = 0; /* we have either "<" or ">" */ if (args[0] != NULL && strlen(args[0]) != 0) { /* we have a third part ("<> y"), therefore it's invalid */ if (args[2] != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "icode: invalid value"); goto error; } /* we have only a comparison ("<", ">") */ if (ByteExtractStringUint8(&icd->code1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp code %s is not " "valid", args[1]); goto error; } if ((strcmp(args[0], ">")) == 0) icd->mode = DETECT_ICODE_GT; else icd->mode = DETECT_ICODE_LT; } else { /* no "<", ">" */ /* we have a range ("<>") */ if (args[2] != NULL) { icd->mode = (uint8_t) DETECT_ICODE_RN; if (ByteExtractStringUint8(&icd->code1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp code %s is not " "valid", args[1]); goto error; } if (ByteExtractStringUint8(&icd->code2, 10, 0, args[2]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp code %s is not " "valid", args[2]); goto error; } /* we check that the first given value in the range is less than the second, otherwise we swap them */ if (icd->code1 > icd->code2) { uint8_t temp = icd->code1; icd->code1 = icd->code2; icd->code2 = temp; } } else { /* we have an equality */ icd->mode = DETECT_ICODE_EQ; if (ByteExtractStringUint8(&icd->code1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp code %s is not " "valid", args[1]); goto error; } } } for (i = 0; i < (ret-1); i++) { if (args[i] != NULL) SCFree(args[i]); } return icd; error: for (i = 0; i < (ret-1) && i < 3; i++) { if (args[i] != NULL) SCFree(args[i]); } if (icd != NULL) DetectICodeFree(icd); return NULL; } /** * \brief this function is used to add the parsed icode data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param icodestr pointer to the user provided icode options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, char *icodestr) { DetectICodeData *icd = NULL; SigMatch *sm = NULL; icd = DetectICodeParse(icodestr); if (icd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ICODE; sm->ctx = (SigMatchCtx *)icd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (icd != NULL) DetectICodeFree(icd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectICodeData * * \param ptr pointer to DetectICodeData */ void DetectICodeFree(void *ptr) { DetectICodeData *icd = (DetectICodeData *)ptr; SCFree(icd); } /* prefilter code */ static void PrefilterPacketICodeMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (PKT_IS_PSEUDOPKT(p)) { SCReturn; } uint8_t picode; if (PKT_IS_ICMPV4(p)) { picode = ICMPV4_GET_CODE(p); } else if (PKT_IS_ICMPV6(p)) { picode = ICMPV6_GET_CODE(p); } else { /* Packet not ICMPv4 nor ICMPv6 */ return; } const PrefilterPacketU8HashCtx *h = pectx; const SigsArray *sa = h->array[picode]; if (sa) { PrefilterAddSids(&det_ctx->pmq, sa->sigs, sa->cnt); } } static void PrefilterPacketICodeSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectICodeData *a = smctx; v->u8[0] = a->mode; v->u8[1] = a->code1; v->u8[2] = a->code2; } static _Bool PrefilterPacketICodeCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectICodeData *a = smctx; if (v.u8[0] == a->mode && v.u8[1] == a->code1 && v.u8[2] == a->code2) return TRUE; return FALSE; } static int PrefilterSetupICode(SigGroupHead *sgh) { return PrefilterSetupPacketHeaderU8Hash(sgh, DETECT_ICODE, PrefilterPacketICodeSet, PrefilterPacketICodeCompare, PrefilterPacketICodeMatch); } static _Bool PrefilterICodeIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ICODE: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \test DetectICodeParseTest01 is a test for setting a valid icode value */ int DetectICodeParseTest01(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse("8"); if (icd != NULL) { if (icd->code1 == 8 && icd->mode == DETECT_ICODE_EQ) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest02 is a test for setting a valid icode value * with ">" operator */ int DetectICodeParseTest02(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse(">8"); if (icd != NULL) { if (icd->code1 == 8 && icd->mode == DETECT_ICODE_GT) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest03 is a test for setting a valid icode value * with "<" operator */ int DetectICodeParseTest03(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse("<8"); if (icd != NULL) { if (icd->code1 == 8 && icd->mode == DETECT_ICODE_LT) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest04 is a test for setting a valid icode value * with "<>" operator */ int DetectICodeParseTest04(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse("8<>20"); if (icd != NULL) { if (icd->code1 == 8 && icd->code2 == 20 && icd->mode == DETECT_ICODE_RN) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest05 is a test for setting a valid icode value * with spaces all around */ int DetectICodeParseTest05(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse(" 8 "); if (icd != NULL) { if (icd->code1 == 8 && icd->mode == DETECT_ICODE_EQ) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest06 is a test for setting a valid icode value * with ">" operator and spaces all around */ int DetectICodeParseTest06(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse(" > 8 "); if (icd != NULL) { if (icd->code1 == 8 && icd->mode == DETECT_ICODE_GT) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest07 is a test for setting a valid icode value * with "<>" operator and spaces all around */ int DetectICodeParseTest07(void) { DetectICodeData *icd = NULL; int result = 0; icd = DetectICodeParse(" 8 <> 20 "); if (icd != NULL) { if (icd->code1 == 8 && icd->code2 == 20 && icd->mode == DETECT_ICODE_RN) result = 1; DetectICodeFree(icd); } return result; } /** * \test DetectICodeParseTest08 is a test for setting an invalid icode value */ int DetectICodeParseTest08(void) { DetectICodeData *icd = NULL; icd = DetectICodeParse("> 8 <> 20"); if (icd == NULL) return 1; DetectICodeFree(icd); return 0; } /** * \test DetectICodeMatchTest01 is a test for checking the working of icode * keyword by creating 5 rules and matching a crafted packet against * them. 4 out of 5 rules shall trigger. */ int DetectICodeMatchTest01(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP); p->icmpv4h->code = 10; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert icmp any any -> any any (icode:10; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (icode:<15; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (icode:>20; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (icode:8<>20; sid:4;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (icode:20<>8; sid:5;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { SCLogDebug("sid 1 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { SCLogDebug("sid 2 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 3)) { SCLogDebug("sid 3 alerted, but should not have"); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { SCLogDebug("sid 4 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 5) == 0) { SCLogDebug("sid 5 did not alert, but should have"); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectICode */ void DetectICodeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectICodeParseTest01", DetectICodeParseTest01); UtRegisterTest("DetectICodeParseTest02", DetectICodeParseTest02); UtRegisterTest("DetectICodeParseTest03", DetectICodeParseTest03); UtRegisterTest("DetectICodeParseTest04", DetectICodeParseTest04); UtRegisterTest("DetectICodeParseTest05", DetectICodeParseTest05); UtRegisterTest("DetectICodeParseTest06", DetectICodeParseTest06); UtRegisterTest("DetectICodeParseTest07", DetectICodeParseTest07); UtRegisterTest("DetectICodeParseTest08", DetectICodeParseTest08); UtRegisterTest("DetectICodeMatchTest01", DetectICodeMatchTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/app-layer-enip.c0000644000000000000000000004060013051004444013770 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong * * App-layer parser for ENIP protocol * */ #include "suricata-common.h" #include "util-debug.h" #include "util-byte.h" #include "util-enum.h" #include "util-mem.h" #include "util-misc.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-enip.h" #include "app-layer-enip-common.h" #include "app-layer-detect-proto.h" #include "conf.h" #include "decode.h" #include "detect-parse.h" #include "detect-engine.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "pkt-var.h" #include "util-profiling.h" SCEnumCharMap enip_decoder_event_table[ ] = { { NULL, -1 }, }; /** \brief get value for 'complete' status in ENIP * * For ENIP we use a simple bool. */ int ENIPGetAlstateProgress(void *tx, uint8_t direction) { return 1; } /** \brief get value for 'complete' status in ENIP * * For ENIP we use a simple bool. */ int ENIPGetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } DetectEngineState *ENIPGetTxDetectState(void *vtx) { ENIPTransaction *tx = (ENIPTransaction *)vtx; return tx->de_state; } int ENIPSetTxDetectState(void *state, void *vtx, DetectEngineState *s) { ENIPTransaction *tx = (ENIPTransaction *)vtx; tx->de_state = s; return 0; } void *ENIPGetTx(void *alstate, uint64_t tx_id) { ENIPState *enip = (ENIPState *) alstate; ENIPTransaction *tx = NULL; if (enip->curr && enip->curr->tx_num == tx_id + 1) return enip->curr; TAILQ_FOREACH(tx, &enip->tx_list, next) { if (tx->tx_num != (tx_id+1)) continue; SCLogDebug("returning tx %p", tx); return tx; } return NULL; } uint64_t ENIPGetTxCnt(void *alstate) { return ((uint64_t) ((ENIPState *) alstate)->transaction_max); } AppLayerDecoderEvents *ENIPGetEvents(void *state, uint64_t id) { ENIPState *enip = (ENIPState *) state; ENIPTransaction *tx; if (enip->curr && enip->curr->tx_num == (id + 1)) return enip->curr->decoder_events; TAILQ_FOREACH(tx, &enip->tx_list, next) { if (tx->tx_num == (id+1)) return tx->decoder_events; } return NULL; } int ENIPHasEvents(void *state) { return (((ENIPState *) state)->events > 0); } int ENIPStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, enip_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "enip's enum map table.", event_name); /* yes this is fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } /** \brief Allocate enip state * * return state */ void *ENIPStateAlloc(void) { SCLogDebug("ENIPStateAlloc"); void *s = SCMalloc(sizeof(ENIPState)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(ENIPState)); ENIPState *enip_state = (ENIPState *) s; TAILQ_INIT(&enip_state->tx_list); return s; } /** \internal * \brief Free a ENIP TX * \param tx ENIP TX to free */ static void ENIPTransactionFree(ENIPTransaction *tx, ENIPState *state) { SCEnter(); SCLogDebug("ENIPTransactionFree"); CIPServiceEntry *svc = NULL; while ((svc = TAILQ_FIRST(&tx->service_list))) { TAILQ_REMOVE(&tx->service_list, svc, next); SegmentEntry *seg = NULL; while ((seg = TAILQ_FIRST(&svc->segment_list))) { TAILQ_REMOVE(&svc->segment_list, seg, next); SCFree(seg); } AttributeEntry *attr = NULL; while ((attr = TAILQ_FIRST(&svc->attrib_list))) { TAILQ_REMOVE(&svc->attrib_list, attr, next); SCFree(attr); } SCFree(svc); } AppLayerDecoderEventsFreeEvents(&tx->decoder_events); if (tx->de_state != NULL) { DetectEngineStateFree(tx->de_state); state->tx_with_detect_state_cnt--; } if (state->iter == tx) state->iter = NULL; SCFree(tx); SCReturn; } /** \brief Free enip state * */ void ENIPStateFree(void *s) { SCEnter(); SCLogDebug("ENIPStateFree"); if (s) { ENIPState *enip_state = (ENIPState *) s; ENIPTransaction *tx = NULL; while ((tx = TAILQ_FIRST(&enip_state->tx_list))) { TAILQ_REMOVE(&enip_state->tx_list, tx, next); ENIPTransactionFree(tx, enip_state); } if (enip_state->buffer != NULL) { SCFree(enip_state->buffer); } SCFree(s); } SCReturn; } /** \internal * \brief Allocate a ENIP TX * \retval tx or NULL */ static ENIPTransaction *ENIPTransactionAlloc(ENIPState *state) { SCLogDebug("ENIPStateTransactionAlloc"); ENIPTransaction *tx = (ENIPTransaction *) SCCalloc(1, sizeof(ENIPTransaction)); if (unlikely(tx == NULL)) return NULL; state->curr = tx; state->transaction_max++; memset(tx, 0x00, sizeof(ENIPTransaction)); TAILQ_INIT(&tx->service_list); tx->enip = state; tx->tx_num = state->transaction_max; tx->service_count = 0; TAILQ_INSERT_TAIL(&state->tx_list, tx, next); return tx; } /** * \brief enip transaction cleanup callback */ void ENIPStateTransactionFree(void *state, uint64_t tx_id) { SCEnter(); SCLogDebug("ENIPStateTransactionFree"); ENIPState *enip_state = state; ENIPTransaction *tx = NULL; TAILQ_FOREACH(tx, &enip_state->tx_list, next) { if ((tx_id+1) < tx->tx_num) break; else if ((tx_id+1) > tx->tx_num) continue; if (tx == enip_state->curr) enip_state->curr = NULL; if (tx->decoder_events != NULL) { if (tx->decoder_events->cnt <= enip_state->events) enip_state->events -= tx->decoder_events->cnt; else enip_state->events = 0; } TAILQ_REMOVE(&enip_state->tx_list, tx, next); ENIPTransactionFree(tx, state); break; } SCReturn; } /** \internal * * \brief This function is called to retrieve a ENIP * * \param state ENIP state structure for the parser * \param input Input line of the command * \param input_len Length of the request * * \retval 1 when the command is parsed, 0 otherwise */ static int ENIPParse(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); ENIPState *enip = (ENIPState *) state; ENIPTransaction *tx; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } while (input_len > 0) { tx = ENIPTransactionAlloc(enip); if (tx == NULL) SCReturnInt(0); SCLogDebug("ENIPParse input len %d", input_len); DecodeENIPPDU(input, input_len, tx); uint32_t pkt_len = tx->header.length + sizeof(ENIPEncapHdr); SCLogDebug("ENIPParse packet len %d", pkt_len); if (pkt_len > input_len) { SCLogDebug("Invalid packet length"); break; } input += pkt_len; input_len -= pkt_len; //SCLogDebug("remaining %d", input_len); if (input_len < sizeof(ENIPEncapHdr)) { //SCLogDebug("Not enough data"); //not enough data for ENIP break; } } return 1; } static uint16_t ENIPProbingParser(uint8_t *input, uint32_t input_len, uint32_t *offset) { // SCLogDebug("ENIPProbingParser %d", input_len); if (input_len < sizeof(ENIPEncapHdr)) { SCLogDebug("length too small to be a ENIP header"); return ALPROTO_UNKNOWN; } return ALPROTO_ENIP; } /** * \brief Function to register the ENIP protocol parsers and other functions */ void RegisterENIPUDPParsers(void) { SCEnter(); char *proto_name = "enip"; if (AppLayerProtoDetectConfProtoDetectionEnabled("udp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_ENIP, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL); AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL); } else { if (!AppLayerProtoDetectPPParseConfPorts("udp", IPPROTO_UDP, proto_name, ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), ENIPProbingParser, ENIPProbingParser)) { SCLogDebug( "no ENIP UDP config found enabling ENIP detection on port 44818."); AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL); AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL); } } } else { SCLogConfig("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("udp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_ENIP, STREAM_TOSERVER, ENIPParse); AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_ENIP, STREAM_TOCLIENT, ENIPParse); AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateAlloc, ENIPStateFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_UDP, ALPROTO_ENIP, NULL, ENIPGetTxDetectState, ENIPSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetTxCnt); AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateTransactionFree); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_ENIP, ENIPGetAlstateProgressCompletionStatus); AppLayerParserRegisterGetEventInfo(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateGetEventInfo); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_UDP, ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT); } else { SCLogInfo( "Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_UDP, ALPROTO_ENIP, ENIPParserRegisterTests); #endif SCReturn; } /** * \brief Function to register the ENIP protocol parsers and other functions */ void RegisterENIPTCPParsers(void) { SCEnter(); char *proto_name = "enip"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_ENIP, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "44818", ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL); } else { if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr), ENIPProbingParser, ENIPProbingParser)) { #ifndef AFLFUZZ_APPLAYER return; #endif } } } else { SCLogDebug("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_ENIP, STREAM_TOSERVER, ENIPParse); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_ENIP, STREAM_TOCLIENT, ENIPParse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_ENIP, ENIPStateAlloc, ENIPStateFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_ENIP, NULL, ENIPGetTxDetectState, ENIPSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetTxCnt); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPStateTransactionFree); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_ENIP, ENIPGetAlstateProgressCompletionStatus); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_ENIP, ENIPStateGetEventInfo); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT); } else { SCLogConfig("Parser disabled for %s protocol. Protocol detection still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_ENIP, ENIPParserRegisterTests); #endif SCReturn; } /* UNITTESTS */ #ifdef UNITTESTS #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "flow-util.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" static uint8_t listIdentity[] = {/* List ID */ 0x63, 0x00, /* Length */ 0x00, 0x00, /* Session */ 0x00, 0x00, 0x00, 0x00, /* Status */ 0x00, 0x00, 0x00, 0x00, /* Delay*/ 0x00, /* Context */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* Quantity of coils */ 0x00, 0x00, 0x00, 0x00, 0x00}; /** * \brief Test if ENIP Packet matches signature */ int ALDecodeENIPTest(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_ENIP, STREAM_TOSERVER, listIdentity, sizeof(listIdentity)); FAIL_IF(r != 0); ENIPState *enip_state = f.alstate; FAIL_IF_NULL(enip_state); ENIPTransaction *tx = ENIPGetTx(enip_state, 0); FAIL_IF_NULL(tx); FAIL_IF(tx->header.command != 99); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } #endif /* UNITTESTS */ void ENIPParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ALDecodeENIPTest", ALDecodeENIPTest); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-action.c0000644000000000000000000013542013051004444013402 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #include "suricata-common.h" #include "action-globals.h" #include "conf.h" #include "conf-yaml-loader.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-sigorder.h" #include "util-unittest.h" #include "util-action.h" #include "util-unittest-helper.h" #include "util-debug.h" /* Default order: */ uint8_t action_order_sigs[4] = {ACTION_PASS, ACTION_DROP, ACTION_REJECT, ACTION_ALERT}; /* This order can be changed from config */ /** * \brief Return the priority associated to an action (to order sigs * as specified at config) * action_order_sigs has this priority by index val * so action_order_sigs[0] has to be inspected first. * This function is called from detect-engine-sigorder * \param action can be one of ACTION_PASS, ACTION_DROP, * ACTION_REJECT or ACTION_ALERT * \retval uint8_t the priority (order of this actions) */ uint8_t ActionOrderVal(uint8_t action) { /* reject_both and reject_dst have the same prio as reject */ if( (action & ACTION_REJECT) || (action & ACTION_REJECT_BOTH) || (action & ACTION_REJECT_DST)) { action = ACTION_REJECT; } uint8_t i = 0; for (; i < 4; i++) { if (action_order_sigs[i] == action) return i; } /* Unknown action, set just a low prio (high val) */ return 10; } /** * \brief Return the ACTION_* bit from their ascii value * \param action can be one of "pass", "drop", * "reject" or "alert" * \retval uint8_t can be one of ACTION_PASS, ACTION_DROP, * ACTION_REJECT or ACTION_ALERT */ uint8_t ActionAsciiToFlag(char *action) { if (strcmp(action,"pass") == 0) return ACTION_PASS; if (strcmp(action,"drop") == 0) return ACTION_DROP; if (strcmp(action,"reject") == 0) return ACTION_REJECT; if (strcmp(action,"alert") == 0) return ACTION_ALERT; return 0; } /** * \brief Load the action order from config. If none is provided, * it will be default to ACTION_PASS, ACTION_DROP, * ACTION_REJECT, ACTION_ALERT (pass has the highest prio) * * \retval 0 on success; -1 on fatal error; */ int ActionInitConfig() { uint8_t actions_used = 0; uint8_t action_flag = 0; uint8_t actions_config[4] = {0, 0, 0, 0}; int order = 0; ConfNode *action_order; ConfNode *action = NULL; /* Let's load the order of actions from the general config */ action_order = ConfGetNode("action-order"); if (action_order == NULL) { /* No configuration, use defaults. */ return 0; } else { TAILQ_FOREACH(action, &action_order->head, next) { SCLogDebug("Loading action order : %s", action->val); action_flag = ActionAsciiToFlag(action->val); if (action_flag == 0) { SCLogError(SC_ERR_ACTION_ORDER, "action-order, invalid action: \"%s\". Please, use" " \"pass\",\"drop\",\"alert\",\"reject\". You have" " to specify all of them, without quotes and without" " capital letters", action->val); goto error; } if (actions_used & action_flag) { SCLogError(SC_ERR_ACTION_ORDER, "action-order, action already set: \"%s\". Please," " use \"pass\",\"drop\",\"alert\",\"reject\". You" " have to specify all of them, without quotes and" " without capital letters", action->val); goto error; } if (order >= 4) { SCLogError(SC_ERR_ACTION_ORDER, "action-order, you have already specified all the " "possible actions plus \"%s\". Please, use \"pass\"," "\"drop\",\"alert\",\"reject\". You have to specify" " all of them, without quotes and without capital" " letters", action->val); goto error; } actions_used |= action_flag; actions_config[order++] = action_flag; } } if (order < 4) { SCLogError(SC_ERR_ACTION_ORDER, "action-order, the config didn't specify all of the " "actions. Please, use \"pass\",\"drop\",\"alert\"," "\"reject\". You have to specify all of them, without" " quotes and without capital letters"); goto error; } /* Now, it's a valid config. Override the default preset */ for (order = 0; order < 4; order++) { action_order_sigs[order] = actions_config[order]; } return 0; error: return -1; } #ifdef UNITTESTS /** * \test Check that we invalidate duplicated actions * (It should default to pass, drop, reject, alert) */ int UtilActionTest01(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - alert\n\ - drop\n\ - reject\n\ - alert\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we invalidate with unknown keywords * (It should default to pass, drop, reject, alert) */ int UtilActionTest02(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - alert\n\ - drop\n\ - reject\n\ - ftw\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we invalidate if any action is missing * (It should default to pass, drop, reject, alert) */ int UtilActionTest03(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - alert\n\ - drop\n\ - reject\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we invalidate if any action is missing * (It should default to pass, drop, reject, alert) */ int UtilActionTest04(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we invalidate with unknown keywords * and/or more than the expected * (It should default to pass, drop, reject, alert) */ int UtilActionTest05(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - alert\n\ - drop\n\ - reject\n\ - pass\n\ - whatever\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we load a valid config */ int UtilActionTest06(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - alert\n\ - drop\n\ - reject\n\ - pass\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_ALERT || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_PASS) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we load a valid config */ int UtilActionTest07(void) { int res = 1; char config[] = "\ %YAML 1.1\n\ ---\n\ action-order:\n\ - pass\n\ - alert\n\ - drop\n\ - reject\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ActionInitConfig(); if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_ALERT || action_order_sigs[2] != ACTION_DROP || action_order_sigs[3] != ACTION_REJECT) { res = 0; } ConfRestoreContextBackup(); /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we handle the "pass" action * correctly at the IP Only engine in the default case */ int UtilActionTest08(void) { int res = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {0, 0, 0}, {1, 0, 1} }; /* This means that with the second packet, the results will be * all ({0,0,0}) since, we should match the "pass" rule first */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check that we handle the "pass" action * correctly at the IP Only engine with more * prio to drop */ int UtilActionTest09(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass ip 192.168.1.1 80 -> any any (msg:\"sig 2\"; sid:2;)"; sigs[2]= "drop ip any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {0, 0, 1}, {1, 0, 1} }; /* This means that with the second packet, the results will be * all ({0,0,1}) since, we should match the "drop" rule first. * Later the "pass" rule will avoid the "alert" rule match */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we handle the "pass" action * correctly at the detection engine in the default case */ int UtilActionTest10(void) { int res = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t *buf2 = (uint8_t *)"wo!"; uint16_t buflen2 = strlen((char *)buf2); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf2, buflen2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)"; sigs[1]= "pass ip any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {0, 0, 0}, {1, 0, 1} }; /* This means that with the second packet, the results will be * all ({0,0,0}) since, we should match the "pass" rule first */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check that we handle the "pass" action * correctly at the detection engine with more * prio to drop */ int UtilActionTest11(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t *buf2 = (uint8_t *)"Hi all wo!"; uint16_t buflen2 = strlen((char *)buf2); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf2, buflen2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"wo\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {0, 0, 1}, {1, 0, 1} }; /* This means that with the second packet, the results will be * all ({0,0,1}) since, we should match the "drop" rule first. * Later the "pass" rule will avoid the "alert" rule match */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we handle the "pass" action * correctly at the detection engine in the default case */ int UtilActionTest12(void) { int res = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass ip any any -> any any (msg:\"Testing normal 2\"; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 0}, {0, 0, 0}, {0, 0, 0} }; /* All should match the 3 sigs, but the action pass has prio */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check that we handle the "pass" action * correctly at the detection engine with more * prio to drop */ int UtilActionTest13(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 1}, {0, 0, 1}, {0, 0, 1} }; /* All the patckets should match the 3 sigs. As drop has more * priority than pass, it should alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check that we handle the "pass" action * correctly at the detection engine with more * prio to drop and alert */ int UtilActionTest14(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_ALERT; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_PASS; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; content:\"Hi all\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; content:\"Hi all\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {1, 0, 1}, {1, 0, 1} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check mixed sigs (iponly and normal) */ int UtilActionTest15(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 0}, {0, 0, 0}, {0, 0, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check mixed sigs (iponly and normal) */ int UtilActionTest16(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 0}, {0, 0, 0}, {0, 0, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check mixed sigs (iponly and normal) */ int UtilActionTest17(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 0}, {0, 0, 0}, {0, 0, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for drop */ int UtilActionTest18(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 0, 1}, {0, 0, 1}, {0, 0, 1} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for drop */ int UtilActionTest19(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 0}, {1, 0, 0}, {1, 0, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for drop */ int UtilActionTest20(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_PASS; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 1, 0}, {0, 1, 0}, {0, 1, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for alert and drop */ int UtilActionTest21(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_ALERT; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_PASS; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "alert tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "pass tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "drop tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 0, 1}, {1, 0, 1}, {1, 0, 1} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for alert and drop */ int UtilActionTest22(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_ALERT; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_PASS; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "drop tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "pass tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {1, 1, 0}, {1, 1, 0}, {1, 1, 0} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; return res; } /** * \test Check mixed sigs (iponly and normal) with more prio for alert and drop */ int UtilActionTest23(void) { int res = 1; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_ALERT; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_PASS; p[0] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[2] = UTHBuildPacketReal((uint8_t *)buf, buflen, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[3]; sigs[0]= "pass tcp any any -> any any (msg:\"sig 1\"; sid:1;)"; sigs[1]= "drop tcp any any -> any any (msg:\"sig 2\"; content:\"Hi all\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"sig 3\"; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { {0, 1, 1}, {0, 1, 1}, {0, 1, 1} }; /* All the patckets should match the 3 sigs. As drop * and alert have more priority than pass, both should * alert on each packet */ DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto cleanup; de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, 3) == 0) goto cleanup; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); res = UTHMatchPacketsWithResults(de_ctx, p, 3, sid, (uint32_t *) results, 3); cleanup: UTHFreePackets(p, 3); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } /* Restore default values */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; end: return res; } /** * \test Check that the expected defaults are loaded if the * action-order configuration is not present. */ int UtilActionTest24(void) { int res = 1; char config[] = "%YAML 1.1\n" "---\n"; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); if (ActionInitConfig() != 0) { res = 0; goto done; } if (action_order_sigs[0] != ACTION_PASS || action_order_sigs[1] != ACTION_DROP || action_order_sigs[2] != ACTION_REJECT || action_order_sigs[3] != ACTION_ALERT) { res = 0; } done: ConfRestoreContextBackup(); return res; } #endif /* Register unittests */ void UtilActionRegisterTests(void) { #ifdef UNITTESTS /* Generic tests */ UtRegisterTest("UtilActionTest01", UtilActionTest01); UtRegisterTest("UtilActionTest02", UtilActionTest02); UtRegisterTest("UtilActionTest02", UtilActionTest02); UtRegisterTest("UtilActionTest03", UtilActionTest03); UtRegisterTest("UtilActionTest04", UtilActionTest04); UtRegisterTest("UtilActionTest05", UtilActionTest05); UtRegisterTest("UtilActionTest06", UtilActionTest06); UtRegisterTest("UtilActionTest07", UtilActionTest07); UtRegisterTest("UtilActionTest08", UtilActionTest08); UtRegisterTest("UtilActionTest09", UtilActionTest09); UtRegisterTest("UtilActionTest10", UtilActionTest10); UtRegisterTest("UtilActionTest11", UtilActionTest11); UtRegisterTest("UtilActionTest12", UtilActionTest12); UtRegisterTest("UtilActionTest13", UtilActionTest13); UtRegisterTest("UtilActionTest14", UtilActionTest14); UtRegisterTest("UtilActionTest15", UtilActionTest15); UtRegisterTest("UtilActionTest16", UtilActionTest16); UtRegisterTest("UtilActionTest17", UtilActionTest17); UtRegisterTest("UtilActionTest18", UtilActionTest18); UtRegisterTest("UtilActionTest19", UtilActionTest19); UtRegisterTest("UtilActionTest20", UtilActionTest20); UtRegisterTest("UtilActionTest21", UtilActionTest21); UtRegisterTest("UtilActionTest22", UtilActionTest22); UtRegisterTest("UtilActionTest23", UtilActionTest23); UtRegisterTest("UtilActionTest24", UtilActionTest24); #endif } suricata-3.2.1/src/runmode-napatech.h0000644000000000000000000000212713051004444014406 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \autor nPulse Technologies, LLC. * \author Matt Keeler */ #ifndef __RUNMODE_NAPATECH_H__ #define __RUNMODE_NAPATECH_H__ #ifdef HAVE_NAPATECH #include #endif int RunModeNapatechAutoFp(void); int RunModeNapatechWorkers(void); void RunModeNapatechRegister(void); const char *RunModeNapatechGetDefaultMode(void); #endif /* __RUNMODE_NAPATECH_H__ */ suricata-3.2.1/src/util-decode-asn1.c0000644000000000000000000005567313051004444014223 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Implements ASN1 decoding (needed for the asn1 keyword, BER, CER & DER) */ #include "suricata.h" #include "suricata-common.h" #include "decode.h" #include "util-debug.h" #include "util-unittest.h" #include "util-print.h" #include "util-decode-asn1.h" #include "conf.h" uint16_t asn1_max_frames_config = ASN1_MAX_FRAMES; void SCAsn1LoadConfig() { intmax_t value = 0; /** set config defaults */ if ((ConfGetInt("asn1-max-frames", &value)) == 1) { asn1_max_frames_config = (uint16_t)value; SCLogDebug("Max stack frame set to %"PRIu16, asn1_max_frames_config); } } /** * \brief Decode and check the identifier information of the * current node that is in extended format * * \param ac pointer to the ASN1 Context data * * \retval byte of the status of the parser */ uint8_t SCAsn1GetHighTagNumber(Asn1Ctx *ac) { uint8_t ret = 0; uint32_t tag_num = 0; /* If we have a high tag num, skip the id octet */ ac->iter++; Asn1Node *node = ASN1CTX_CUR_NODE(ac); ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_INVALID | ASN1_STATUS_OOB; return ret; } uint8_t raw_id = *ac->iter; tag_num += ASN1_BER_GET_HIGH_TAG_NUM(raw_id); if (ASN1_BER_GET_HIGH_TAG_NUM(raw_id) == 0) { /* Set event, invalid id */ node->flags |= ASN1_BER_EVENT_INVALID_ID; ac->parser_status |= ASN1_STATUS_INVALID; return ASN1_PARSER_ERR; } ac->iter++; if (!ASN1_BER_IS_HIGH_TAG_END(raw_id)) { do { ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_INVALID | ASN1_STATUS_OOB; return ret; } raw_id = *ac->iter; if ((uint64_t) ((uint64_t)tag_num + (uint64_t)ASN1_BER_GET_HIGH_TAG_NUM(raw_id)) > UINT32_MAX) { node->flags |= ASN1_BER_EVENT_ID_TOO_LONG; ac->parser_status |= ASN1_STATUS_INVALID; return ASN1_PARSER_ERR; } tag_num += ASN1_BER_GET_HIGH_TAG_NUM(raw_id); ac->iter++; } while (!ASN1_BER_IS_HIGH_TAG_END(raw_id)); } node->id.tag_num = tag_num; return ASN1_PARSER_OK; } /** * \brief Decode and check the length, of the current node * in definite but extended format, that we are parsing, * checking invalid opts * * \param ac pointer to the ASN1 Context data * * \retval byte of the status of the parser */ uint32_t SCAsn1GetLengthLongForm(Asn1Ctx *ac) { uint8_t raw_len = *ac->iter; uint8_t ret = 0; uint32_t content_len = 0; uint8_t oct_len = ASN1_BER_GET_LONG_LEN_OCTETS(raw_len); uint8_t i = 0; Asn1Node *node = ASN1CTX_CUR_NODE(ac); for (; i < oct_len; i++) { ac->iter++; ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_INVALID | ASN1_STATUS_OOB; return ASN1_PARSER_ERR; } raw_len = *ac->iter; if (raw_len == 0xFF && ac->iter == node->len.ptr + 1) { /* 8.1.3.5, 0xFF shall not be used */ node->flags |= ASN1_BER_EVENT_INVALID_LEN; ac->parser_status = ASN1_STATUS_INVALID; return ASN1_PARSER_ERR; } if ((uint64_t) ((uint64_t)content_len + (uint64_t) ASN1_BER_GET_HIGH_TAG_NUM(raw_len)) > UINT32_MAX) { node->flags |= ASN1_BER_EVENT_LEN_TOO_LONG; ac->parser_status = ASN1_STATUS_INVALID; return ASN1_PARSER_ERR; } content_len += raw_len; } ac->iter++; node->len.len = content_len; return ASN1_PARSER_OK; } /** * \brief Check the content length and perform other inspections * and decodings if necessary * * \param ac pointer to the ASN1 Context data * * \retval byte of the status of the parser */ uint8_t SCAsn1DecodeContent(Asn1Ctx *ac) { Asn1Node *node = ASN1CTX_CUR_NODE(ac); /* Uops, if we are done, we break here */ if (node->flags & ASN1_NODE_IS_EOC) return ASN1_PARSER_OK; /* First check the form of length (BER, DER, CER) * and if we are on a zero length */ if (node->len.form != ASN1_BER_LEN_INDEFINITE && node->len.len == 0) { node->data.len = 0; return ASN1_PARSER_OK; } node->data.ptr = ac->iter; /* If we have a complete length, check that * it is in bounds */ if (ac->iter + node->len.len > ac->end) { /* We do not have all the content octets! */ node->data.len = ac->end - ac->iter; } else { /* We have all the content octets */ node->data.len = node->len.len; } return ASN1_PARSER_OK; } /** * \brief Decode and check the length, of the current node * that we are parsing, also check invalid opts * * \param ac pointer to the ASN1 Context data * * \retval byte of the status of the parser */ uint8_t SCAsn1DecodeLength(Asn1Ctx *ac) { uint8_t ret = 0; ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_INVALID | ASN1_STATUS_OOB; return ASN1_PARSER_ERR; } Asn1Node *node = ASN1CTX_CUR_NODE(ac); /* Store the position */ node->len.ptr = ac->iter; uint8_t len_byte = *ac->iter; //SCPrintByteBin(len_byte); if (*node->id.ptr == 0 && len_byte == 0) { node->flags |= ASN1_NODE_IS_EOC; ac->iter++; return ASN1_PARSER_OK; } if (ASN1_BER_IS_INDEFINITE_LEN(len_byte)) { node->len.form = ASN1_BER_LEN_INDEFINITE; node->len.len = 0; ac->iter++; uint8_t *tmp_iter = ac->iter; /* Check that e-o-c is in bounds */ for (; tmp_iter < ac->end - 1; tmp_iter++) { if (ASN1_BER_IS_EOC(tmp_iter)) { node->data.len = tmp_iter - ac->iter; node->len.len = tmp_iter - ac->iter; return ASN1_PARSER_OK; } } /* EOC Not found */ ac->parser_status |= ASN1_STATUS_INVALID; node->flags |= ASN1_BER_EVENT_EOC_NOT_FOUND; return ASN1_PARSER_ERR; } else { /* Look which form we get (and if it apply to the id type) */ if (ASN1_BER_IS_SHORT_LEN(len_byte)) { node->len.form = ASN1_BER_LEN_SHORT; node->len.len = ASN1_BER_GET_SHORT_LEN(len_byte); ac->iter++; } else { node->len.form = ASN1_BER_LEN_LONG; /* Ok, let's parse the long form */ return SCAsn1GetLengthLongForm(ac); } } return ASN1_PARSER_OK; } /** * \brief Decode and check the identifier information of the * current node that we are parsing, also check invalid opts * * \param ac pointer to the ASN1 Context data * * \retval byte of the status of the parser */ uint8_t SCAsn1DecodeIdentifier(Asn1Ctx *ac) { uint8_t ret = 0; ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_INVALID | ASN1_STATUS_OOB; return ret; } Asn1Node *node = ASN1CTX_CUR_NODE(ac); /* Store the position */ node->id.ptr = ac->iter; //SCPrintByteBin(*ac->iter); node->id.class_tag = ASN1_BER_GET_CLASS_TAG(*ac->iter); node->id.tag_type = ASN1_BER_IS_CONSTRUCTED(*ac->iter); if (ASN1_BER_IS_HIGH_TAG(*ac->iter)) { return SCAsn1GetHighTagNumber(ac); } else { node->id.tag_num = ASN1_BER_GET_LOW_TAG_NUM(*ac->iter); ac->iter++; } return ASN1_PARSER_OK; } /** * \brief Helper function that print the bits of a byte * to check encoding internals * \param byte value of the byte */ void SCPrintByteBin(uint8_t byte) { uint8_t i = 0; for (i = 8; i > 0; i--) { printf("%"PRIu8, (uint8_t)((byte >> (i - 1)) & 0x01)); if (i == 5) printf(" "); } printf("\n"); } /** * \brief check if we have remaining data available, * otherwise the parser should stop * \param ac Asn1Ctx pointer initialized * \retval 1 if we are out of bounds, 0 if not */ uint8_t SCAsn1CheckBounds(Asn1Ctx *ac) { return (ac->iter < ac->end && ac->iter >= ac->data)? ASN1_PARSER_OK : ASN1_PARSER_ERR; } /** * \brief Create a new ASN1 Parsing context * * \retval Asn1Ctx pointer to the new ctx */ Asn1Ctx *SCAsn1CtxNew(void) { Asn1Ctx *ac = SCMalloc(sizeof(Asn1Ctx)); if (unlikely(ac == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); return NULL; } memset(ac, 0, sizeof(Asn1Ctx)); ac->asn1_stack = SCMalloc(sizeof(Asn1Node *) * asn1_max_frames_config); if (ac->asn1_stack == NULL) { SCFree(ac); return NULL; } memset(ac->asn1_stack, 0, sizeof(Asn1Node *) * asn1_max_frames_config); return ac; } /** * \brief Destroy an ASN1 Parsing context * * \param Asn1Ctx pointer to the new ctx */ void SCAsn1CtxDestroy(Asn1Ctx *ac) { if (ac == NULL) return; for (uint16_t i = 0; i < asn1_max_frames_config; i++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, i); if (node == NULL) { break; } SCFree(node); } SCFree(ac->asn1_stack); SCFree(ac); } /** * \brief Create a new node at the array stack of frames in the ctx * * \param ac pointer to the ASN1 ctx * \param node index of the frame that we are going to allocate * at the asn1 stack in the parser * * \retval Asn1Node pointer to the new node allocated */ Asn1Node *SCAsn1CtxNewFrame(Asn1Ctx *ac, uint16_t node) { if (node >= asn1_max_frames_config) { return NULL; } if (ac->asn1_stack[node] == NULL) ac->asn1_stack[node] = SCMalloc(sizeof(Asn1Node)); if (ac->asn1_stack[node] == NULL) return NULL; memset(ac->asn1_stack[node], 0, sizeof(Asn1Node)); return ac->asn1_stack[node]; } /** * \brief Initialize the data of the ASN1 parser ctx with the asn1 raw buffer * * \param ac pointer to the ASN1 ctx * \param data pointer to the data to process (binary raw of asn1) * \param length length of the asn1 raw buffer * * \retval void */ void SCAsn1CtxInit(Asn1Ctx *ac, uint8_t *data, uint16_t length) { ac->data = data; ac->iter = data; ac->len = length; ac->end = data + length; ac->parser_status = ASN1_STATUS_OK; } /** * \brief Decode the nodes/frames located at certain position/level * * \param ac pointer to the ASN1 ctx * \param node_id node index at the asn1 stack of the ctx * * \retval byte of parser status */ uint8_t SCAsn1Decode(Asn1Ctx *ac, uint16_t node_id) { Asn1Node *node = NULL; uint8_t ret = 0; /* while remaining data, and no fatal error, or end, or max stack frames */ while (ac->iter < ac->end && !(ac->parser_status & ASN1_STATUS_DONE) && ac->cur_frame < asn1_max_frames_config) { /* Prepare a new frame */ if (SCAsn1CtxNewFrame(ac, node_id) == NULL) break; ac->cur_frame = node_id; node = ASN1CTX_GET_NODE(ac, node_id); SCLogDebug("ASN1 Getting ID, cur:%x remaining %"PRIu32, (uint8_t)*ac->iter, (uint32_t)(ac->end - ac->iter)); /* Get identifier/tag */ ret = SCAsn1DecodeIdentifier(ac); if (ret == ASN1_PARSER_ERR) { SCLogDebug("Error parsing identifier"); node->flags |= ASN1_BER_EVENT_INVALID_ID; ac->ctx_flags |= node->flags; break; } SCLogDebug("ASN1 Getting LEN"); /* Get length of content */ ret = SCAsn1DecodeLength(ac); if (ret == ASN1_PARSER_ERR) { SCLogDebug("Error parsing length"); node->flags |= ASN1_BER_EVENT_INVALID_LEN; ac->ctx_flags |= node->flags; break; } if ( !(node->flags & ASN1_NODE_IS_EOC)) { SCLogDebug("ASN1 Getting CONTENT"); /* Inspect content */ ret = SCAsn1DecodeContent(ac); if (ret == ASN1_PARSER_ERR) { SCLogDebug("Error parsing content"); break; } /* Skip to the next record (if any) */ if (node->id.tag_type != ASN1_TAG_TYPE_CONSTRUCTED) /* Is primitive, skip it all (no need to decode it)*/ ac->iter += node->data.len; } /* Check if we are done with data */ ret = SCAsn1CheckBounds(ac); if (ret == ASN1_PARSER_ERR) { ac->parser_status |= ASN1_STATUS_DONE; /* There's no more data available */ ret = ASN1_PARSER_OK; break; } #if 0 printf("Tag Num: %"PRIu32", Tag Type: %"PRIu8", Class:%"PRIu8", Length: %"PRIu32"\n", node->id.tag_num, node->id.tag_type, node->id.class_tag, node->len.len); printf("Data: \n"); PrintRawDataFp(stdout, node->data.ptr, node->len.len); printf(" -- EOD --\n"); #endif /* Stack flags/events here, so we have the resume at the ctx flags */ ac->ctx_flags |= node->flags; /* Check if it's not a primitive type, * then we need to decode contents */ if (node->id.tag_type == ASN1_TAG_TYPE_CONSTRUCTED) { ret = SCAsn1Decode(ac, node_id + 1); } /* Else we have reached a primitive type and stop the recursion, * look if we have other branches at the same level */ /* But first check if it's a constructed node, and the sum of child * lengths was more than the length of this frame * this would mean that we have an overflow at the attributes */ if (ac->iter > node->data.ptr + node->data.len + 1) { /* We decoded more length on this frame */ } node_id = ac->cur_frame + 1; } return ret; } /* ----------------------- Unit tests ------------------------ */ #ifdef UNITTESTS /** * \test Check we handle extended identifiers correctly */ int DecodeAsn1Test01(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 3; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->id.tag_num != 10) { ret = 0; printf("Error, expected tag_num 10, got %"PRIu32" :", node->id.tag_num); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle extended identifiers correctly */ int DecodeAsn1Test02(void) { uint8_t *str = (uint8_t *) "\x3F\x81\x81\x81\x81\x06"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 6; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->id.tag_num != 10) { ret = 0; printf("Error, expected tag_num 10, got %"PRIu32": ", node->id.tag_num); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle short identifiers correctly */ int DecodeAsn1Test03(void) { uint8_t *str = (uint8_t *) "\x28"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 1; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->id.tag_num != 8) { ret = 0; printf("Error, expected tag_num 10, got %"PRIu32": ", node->id.tag_num); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle extended lengths correctly with indefinite form */ int DecodeAsn1Test04(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06\x80\x12\x12\x12\x00\x00"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 9; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->len.len != 3) { ret = 0; printf("Error, expected length 3, got %"PRIu32": ", node->len.len); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle extended lengths correctly * in the definite form */ int DecodeAsn1Test05(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06\x82\x10\x10"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 6; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->len.len!= 32) { ret = 0; printf("Error, expected length 10, got %"PRIu32": ", node->len.len); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle short lengths correctly */ int DecodeAsn1Test06(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06\x26"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 4; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->len.len != 38) { ret = 0; printf("Error, expected length 10, got %"PRIu32": ", node->len.len); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle events correctly */ int DecodeAsn1Test07(void) { uint8_t *str = (uint8_t *) "\x3F\x00\x84\x06"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 4; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if ( !(ac->ctx_flags & ASN1_BER_EVENT_INVALID_ID) || !(node->flags & ASN1_BER_EVENT_INVALID_ID)) { ret = 0; printf("Error, expected invalid id, got flags %"PRIu8": ", ac->ctx_flags); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle events correctly */ int DecodeAsn1Test08(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06\x81\xFF"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 5; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if ( !(ac->ctx_flags & ASN1_BER_EVENT_INVALID_LEN) || !(node->flags & ASN1_BER_EVENT_INVALID_LEN)) { ret = 0; printf("Error, expected invalid length, got flags %"PRIu8": ", ac->ctx_flags); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Check we handle events correctly */ int DecodeAsn1Test09(void) { uint8_t *str = (uint8_t *) "\x3F\x84\x06\x80\xAB\xCD\xEF"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = 7; SCAsn1CtxInit(ac, str, len); SCAsn1Decode(ac, ac->cur_frame); Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if ( !(ac->ctx_flags & ASN1_BER_EVENT_EOC_NOT_FOUND) || !(node->flags & ASN1_BER_EVENT_EOC_NOT_FOUND)) { ret = 0; printf("Error, expected eoc not found, got flags %"PRIu8": ", ac->ctx_flags); goto end; } end: SCAsn1CtxDestroy(ac); return ret; } /** * \test Decode a big chunk of data */ int DecodeAsn1Test10(void) { // Example from the specification X.690-0207 Appendix A.3 uint8_t *str = (uint8_t *) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint8_t ret = 1; uint16_t len = strlen((char *)str)-1; SCAsn1CtxInit(ac, str, len); ret = SCAsn1Decode(ac, ac->cur_frame); /* General checks */ if (ret != ASN1_PARSER_OK) { printf("Error decoding asn1 data: "); ret = 0; goto end; } if (ac->cur_frame != 59) { printf("Error decoding asn1 data, not all the nodes" "were correctly decoded: "); ret = 0; goto end; } if (ac->iter != ac->end) { printf("Error decoding asn1 data, not all the nodes" "were correctly decoded: "); ret = 0; goto end; } Asn1Node *node = ASN1CTX_GET_NODE(ac, 0); if (node->len.len != 133) { printf("Error decoding asn1 data, not all the nodes" "were correctly decoded: "); ret = 0; goto end; } node = ASN1CTX_GET_NODE(ac, 30); if (node->len.len != 133) { printf("Error decoding asn1 data, not all the nodes" "were correctly decoded: "); ret = 0; goto end; } end: SCAsn1CtxDestroy(ac); return ret; } #endif void DecodeAsn1RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeAsn1Test01", DecodeAsn1Test01); UtRegisterTest("DecodeAsn1Test02", DecodeAsn1Test02); UtRegisterTest("DecodeAsn1Test03", DecodeAsn1Test03); UtRegisterTest("DecodeAsn1Test04", DecodeAsn1Test04); UtRegisterTest("DecodeAsn1Test05", DecodeAsn1Test05); UtRegisterTest("DecodeAsn1Test06", DecodeAsn1Test06); UtRegisterTest("DecodeAsn1Test07", DecodeAsn1Test07); UtRegisterTest("DecodeAsn1Test08", DecodeAsn1Test08); UtRegisterTest("DecodeAsn1Test09", DecodeAsn1Test09); UtRegisterTest("DecodeAsn1Test10", DecodeAsn1Test10); #endif } suricata-3.2.1/src/util-memrchr.h0000644000000000000000000000161213051004444013562 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * */ #ifndef __UTIL_MEMRCHR_H__ #define __UTIL_MEMRCHR_H__ void *memrchr(const void *s, int c, size_t n); void MemrchrRegisterTests(void); #endif /* __UTIL_MEMRCHR_H__ */ suricata-3.2.1/src/detect-within.h0000644000000000000000000000163713051004444013731 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_WITHIN_H__ #define __DETECT_WITHIN_H__ /* prototypes */ void DetectWithinRegister (void); #endif /* __DETECT_WITHIN_H__ */ suricata-3.2.1/src/detect-template.c0000644000000000000000000001754513051004444014242 00000000000000/* Copyright (C) 2015-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author XXX Yourname * * XXX Short description of the purpose of this keyword */ #include "suricata-common.h" #include "util-unittest.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-template.h" /** * \brief Regex for parsing our keyword options */ #define PARSE_REGEX "^\\s*([0-9]+)?\\s*,s*([0-9]+)?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; /* Prototypes of functions registered in DetectTemplateRegister below */ static int DetectTemplateMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectTemplateSetup (DetectEngineCtx *, Signature *, char *); static void DetectTemplateFree (void *); static void DetectTemplateRegisterTests (void); /** * \brief Registration function for template: keyword * * This function is called once in the 'lifetime' of the engine. */ void DetectTemplateRegister(void) { /* keyword name: this is how the keyword is used in a rule */ sigmatch_table[DETECT_TEMPLATE].name = "template"; /* description: listed in "suricata --list-keywords=all" */ sigmatch_table[DETECT_TEMPLATE].desc = "give an introduction into how a detection module works"; /* link to further documentation of the keyword. Normally on the Suricata redmine/wiki */ sigmatch_table[DETECT_TEMPLATE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Developers_Guide"; /* match function is called when the signature is inspected on a packet */ sigmatch_table[DETECT_TEMPLATE].Match = DetectTemplateMatch; /* setup function is called during signature parsing, when the template * keyword is encountered in the rule */ sigmatch_table[DETECT_TEMPLATE].Setup = DetectTemplateSetup; /* free function is called when the detect engine is freed. Normally at * shutdown, but also during rule reloads. */ sigmatch_table[DETECT_TEMPLATE].Free = DetectTemplateFree; /* registers unittests into the system */ sigmatch_table[DETECT_TEMPLATE].RegisterTests = DetectTemplateRegisterTests; /* set up the PCRE for keyword parsing */ DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to match TEMPLATE rule option on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch with context that we will cast into DetectTemplateData * * \retval 0 no match * \retval 1 match */ static int DetectTemplateMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { int ret = 0; const DetectTemplateData *templated = (const DetectTemplateData *) ctx; #if 0 if (PKT_IS_PSEUDOPKT(p)) { /* fake pkt */ } if (PKT_IS_IPV4(p)) { /* ipv4 pkt */ } else if (PKT_IS_IPV6(p)) { /* ipv6 pkt */ } else { SCLogDebug("packet is of not IPv4 or IPv6"); return ret; } #endif /* packet payload access */ if (p->payload != NULL && p->payload_len > 0) { if (templated->arg1 == p->payload[0] && templated->arg2 == p->payload[p->payload_len - 1]) { ret = 1; } } return ret; } /** * \brief This function is used to parse template options passed via template: keyword * * \param templatestr Pointer to the user provided template options * * \retval templated pointer to DetectTemplateData on success * \retval NULL on failure */ static DetectTemplateData *DetectTemplateParse (const char *templatestr) { DetectTemplateData *templated = NULL; char arg1[4] = ""; char arg2[4] = ""; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, templatestr, strlen(templatestr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 "", ret); goto error; } res = pcre_copy_substring((char *) templatestr, ov, MAX_SUBSTRINGS, 1, arg1, sizeof(arg1)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("Arg1 \"%s\"", arg1); if (ret >= 3) { res = pcre_copy_substring((char *) templatestr, ov, MAX_SUBSTRINGS, 2, arg2, sizeof(arg2)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("Arg2 \"%s\"", arg2); } templated = SCMalloc(sizeof (DetectTemplateData)); if (unlikely(templated == NULL)) goto error; templated->arg1 = (uint8_t)atoi(arg1); templated->arg2 = (uint8_t)atoi(arg2); return templated; error: if (templated) SCFree(templated); return NULL; } /** * \brief parse the options from the 'template' keyword in the rule into * the Signature data structure. * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param templatestr pointer to the user provided template options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTemplateSetup (DetectEngineCtx *de_ctx, Signature *s, char *templatestr) { DetectTemplateData *templated = NULL; SigMatch *sm = NULL; templated = DetectTemplateParse(templatestr); if (templated == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TEMPLATE; sm->ctx = (void *)templated; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (templated != NULL) DetectTemplateFree(templated); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTemplateData * * \param ptr pointer to DetectTemplateData */ static void DetectTemplateFree(void *ptr) { DetectTemplateData *templated = (DetectTemplateData *)ptr; /* do more specific cleanup here, if needed */ SCFree(templated); } #ifdef UNITTESTS /** * \test description of the test */ static int DetectTemplateParseTest01 (void) { DetectTemplateData *templated = DetectTemplateParse("1,10"); FAIL_IF_NULL(templated); FAIL_IF(!(templated->arg1 == 1 && templated->arg2 == 10)); DetectTemplateFree(templated); PASS; } static int DetectTemplateSignatureTest01 (void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); Signature *sig = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (template:1,10; sid:1; rev:1;)"); FAIL_IF_NULL(sig); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectTemplate */ void DetectTemplateRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTemplateParseTest01", DetectTemplateParseTest01); UtRegisterTest("DetectTemplateSignatureTest01", DetectTemplateSignatureTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-urilen.h0000644000000000000000000000302413051004444013715 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_URILEN_H #define _DETECT_URILEN_H #define DETECT_URILEN_LT 0 /**< "less than" operator */ #define DETECT_URILEN_GT 1 /**< "greater than" operator */ #define DETECT_URILEN_RA 2 /**< range operator */ #define DETECT_URILEN_EQ 3 /**< equal operator */ typedef struct DetectUrilenData_ { uint16_t urilen1; /**< 1st Uri Length value in the signature*/ uint16_t urilen2; /**< 2nd Uri Length value in the signature*/ uint8_t mode; /**< operator used in the signature */ uint8_t raw_buffer; }DetectUrilenData; int DetectUrilenMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); void DetectUrilenRegister(void); #endif /* _DETECT_URILEN_H */ suricata-3.2.1/src/output-json-dns.h0000644000000000000000000000161413051004444014245 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_DNS_H__ #define __OUTPUT_JSON_DNS_H__ void JsonDnsLogRegister(void); #endif /* __OUTPUT_JSON_DNS_H__ */ suricata-3.2.1/src/app-layer-enip-common.c0000644000000000000000000006701513051004444015267 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong * * App-layer parser for ENIP protocol common code * */ #include "suricata-common.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-parse.h" #include "detect-engine.h" #include "util-byte.h" #include "pkt-var.h" #include "util-profiling.h" #include "app-layer-enip-common.h" /** * \brief Extract 8 bits and move up the offset * @param res * @param input * @param offset */ int ENIPExtractUint8(uint8_t *res, uint8_t *input, uint16_t *offset, uint32_t input_len) { if (*offset > (input_len - sizeof(uint8_t))) { SCLogDebug("ENIPExtractUint8: Parsing beyond payload length"); return 0; } *res = *(input + *offset); *offset += sizeof(uint8_t); return 1; } /** * \brief Extract 16 bits and move up the offset * @param res * @param input * @param offset */ int ENIPExtractUint16(uint16_t *res, uint8_t *input, uint16_t *offset, uint32_t input_len) { if (*offset > (input_len - sizeof(uint16_t))) { SCLogDebug("ENIPExtractUint16: Parsing beyond payload length"); return 0; } ByteExtractUint16(res, BYTE_LITTLE_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + *offset)); *offset += sizeof(uint16_t); return 1; } /** * \brief Extract 32 bits and move up the offset * @param res * @param input * @param offset */ int ENIPExtractUint32(uint32_t *res, uint8_t *input, uint16_t *offset, uint32_t input_len) { if (*offset > (input_len - sizeof(uint32_t))) { SCLogDebug("ENIPExtractUint32: Parsing beyond payload length"); return 0; } ByteExtractUint32(res, BYTE_LITTLE_ENDIAN, sizeof(uint32_t), (const uint8_t *) (input + *offset)); *offset += sizeof(uint32_t); return 1; } /** * \brief Extract 64 bits and move up the offset * @param res * @param input * @param offset */ int ENIPExtractUint64(uint64_t *res, uint8_t *input, uint16_t *offset, uint32_t input_len) { if (*offset > (input_len - sizeof(uint64_t))) { SCLogDebug("ENIPExtractUint64: Parsing beyond payload length"); return 0; } ByteExtractUint64(res, BYTE_LITTLE_ENDIAN, sizeof(uint64_t), (const uint8_t *) (input + *offset)); *offset += sizeof(uint64_t); return 1; } /** * \brief Create service entry, add to transaction * @param tx Transaction * @return service entry */ static CIPServiceEntry *CIPServiceAlloc(ENIPTransaction *tx) { CIPServiceEntry *svc = (CIPServiceEntry *) SCCalloc(1, sizeof(CIPServiceEntry)); if (unlikely(svc == NULL)) return NULL; memset(svc, 0x00, sizeof(CIPServiceEntry)); TAILQ_INIT(&svc->segment_list); TAILQ_INIT(&svc->attrib_list); TAILQ_INSERT_TAIL(&tx->service_list, svc, next); tx->service_count++; return svc; } /** * \brief Delete service entry */ void CIPServiceFree(void *s) { SCEnter(); if (s) { CIPServiceEntry *svc = (CIPServiceEntry *) s; SegmentEntry *seg = NULL; while ((seg = TAILQ_FIRST(&svc->segment_list))) { TAILQ_REMOVE(&svc->segment_list, seg, next); SCFree(seg); } AttributeEntry *attr = NULL; while ((attr = TAILQ_FIRST(&svc->attrib_list))) { TAILQ_REMOVE(&svc->attrib_list, attr, next); SCFree(attr); } SCFree(s); } SCReturn; } /** * \brief Decode ENIP Encapsulation Header * @param input, input_len data stream * @param enip_data stores data from Packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeENIPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data) { int ret = 1; uint16_t offset = 0; //byte offset //Decode Encapsulation Header uint16_t cmd; uint16_t len; uint32_t session; uint32_t status; uint64_t context; uint32_t option; if (ENIPExtractUint16(&cmd, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&len, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint32(&session, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint32(&status, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint64(&context, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint32(&option, input, &offset, input_len) != 1) { return 0; } enip_data->header.command = cmd; enip_data->header.length = len; enip_data->header.session = session; enip_data->header.status = status; enip_data->header.context = context; enip_data->header.option = option; switch (enip_data->header.command) { case NOP: SCLogDebug("DecodeENIP - NOP"); break; case LIST_SERVICES: SCLogDebug("DecodeENIP - LIST_SERVICES"); break; case LIST_IDENTITY: SCLogDebug("DecodeENIP - LIST_IDENTITY"); break; case LIST_INTERFACES: SCLogDebug("DecodeENIP - LIST_INTERFACES"); break; case REGISTER_SESSION: SCLogDebug("DecodeENIP - REGISTER_SESSION"); break; case UNREGISTER_SESSION: SCLogDebug("DecodeENIP - UNREGISTER_SESSION"); break; case SEND_RR_DATA: SCLogDebug( "DecodeENIP - SEND_RR_DATA - parse Common Packet Format"); ret = DecodeCommonPacketFormatPDU(input, input_len, enip_data, offset); break; case SEND_UNIT_DATA: SCLogDebug( "DecodeENIP - SEND UNIT DATA - parse Common Packet Format"); ret = DecodeCommonPacketFormatPDU(input, input_len, enip_data, offset); break; case INDICATE_STATUS: SCLogDebug("DecodeENIP - INDICATE_STATUS"); break; case CANCEL: SCLogDebug("DecodeENIP - CANCEL"); break; default: SCLogDebug("DecodeENIP - UNSUPPORTED COMMAND 0x%x", enip_data->header.command); } return ret; } /** * \brief Decode Common Packet Format * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCommonPacketFormatPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { if (enip_data->header.length < sizeof(ENIPEncapDataHdr)) { SCLogDebug("DecodeCommonPacketFormat: Malformed ENIP packet"); return 0; } uint32_t handle; uint16_t timeout; uint16_t count; if (ENIPExtractUint32(&handle, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&timeout, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&count, input, &offset, input_len) != 1) { return 0; } enip_data->encap_data_header.interface_handle = handle; enip_data->encap_data_header.timeout = timeout; enip_data->encap_data_header.item_count = count; uint16_t address_type; uint16_t address_length; //length of connection id in bytes uint32_t address_connectionid = 0; uint32_t address_sequence = 0; if (ENIPExtractUint16(&address_type, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&address_length, input, &offset, input_len) != 1) { return 0; } //depending on addr type, get connection id, sequence if needed. Can also use addr length too? if (address_type == CONNECTION_BASED) { //get 4 byte connection id if (ENIPExtractUint32(&address_connectionid, input, &offset, input_len) != 1) { return 0; } } else if (address_type == SEQUENCE_ADDR_ITEM) { // get 4 byte connection id and 4 byte sequence if (ENIPExtractUint32(&address_connectionid, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint32(&address_sequence, input, &offset, input_len) != 1) { return 0; } } enip_data->encap_addr_item.type = address_type; enip_data->encap_addr_item.length = address_length; enip_data->encap_addr_item.conn_id = address_connectionid; enip_data->encap_addr_item.sequence_num = address_sequence; uint16_t data_type; uint16_t data_length; //length of data in bytes uint16_t data_sequence_count; if (ENIPExtractUint16(&data_type, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&data_length, input, &offset, input_len) != 1) { return 0; } enip_data->encap_data_item.type = data_type; enip_data->encap_data_item.length = data_length; if (enip_data->encap_data_item.type == CONNECTED_DATA_ITEM) { //connected data items have seq number if (ENIPExtractUint16(&data_sequence_count, input, &offset, input_len) != 1) { return 0; } enip_data->encap_data_item.sequence_count = data_sequence_count; } switch (enip_data->encap_data_item.type) { case CONNECTED_DATA_ITEM: SCLogDebug( "DecodeCommonPacketFormat - CONNECTED DATA ITEM - parse CIP"); DecodeCIPPDU(input, input_len, enip_data, offset); break; case UNCONNECTED_DATA_ITEM: SCLogDebug("DecodeCommonPacketFormat - UNCONNECTED DATA ITEM"); DecodeCIPPDU(input, input_len, enip_data, offset); break; default: SCLogDebug("DecodeCommonPacketFormat - UNKNOWN TYPE 0x%x", enip_data->encap_data_item.type); return 0; } return 1; } /** * \brief Decode CIP packet * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCIPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { int ret = 1; if (enip_data->encap_data_item.length == 0) { SCLogDebug("DecodeCIP: No CIP Data"); return 0; } if (offset > (input_len - sizeof(uint8_t))) { SCLogDebug("DecodeCIP: Parsing beyond payload length"); return 0; } uint8_t service = 0; service = *(input + offset); //SCLogDebug("CIP Service 0x%x", service); //use service code first bit to determine request/response, no need to save or push offset if (service >> 7) { ret = DecodeCIPResponsePDU(input, input_len, enip_data, offset); } else { ret = DecodeCIPRequestPDU(input, input_len, enip_data, offset); } return ret; } /** * \brief Decode CIP Request * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCIPRequestPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { int ret = 1; if (enip_data->encap_data_item.length < sizeof(CIPReqHdr)) { SCLogDebug("DecodeCIPRequest - Malformed CIP Data"); return 0; } uint8_t service; //<-----CIP SERVICE uint8_t path_size; if (ENIPExtractUint8(&service, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint8(&path_size, input, &offset, input_len) != 1) { return 0; } if (service > MAX_CIP_SERVICE) { // service codes of value 0x80 or greater are not permitted because in the CIP protocol the highest order bit is used to flag request(0)/response(1) SCLogDebug("DecodeCIPRequest - INVALID CIP SERVICE 0x%x", service); return 0; } //reached maximum number of services if (enip_data->service_count > 32) { SCLogDebug("DecodeCIPRequest: Maximum services reached"); return 0; } //save CIP data CIPServiceEntry *node = CIPServiceAlloc(enip_data); if (node == NULL) { SCLogDebug("DecodeCIPRequest: Unable to create CIP service"); return 0; } node->direction = 0; node->service = service; node->request.path_size = path_size; node->request.path_offset = offset; // SCLogDebug("DecodeCIPRequestPDU: service 0x%x size %d", node->service, // node->request.path_size); DecodeCIPRequestPathPDU(input, input_len, node, offset); offset += path_size * sizeof(uint16_t); //move offset past pathsize //list of CIP services is large and can be vendor specific, store CIP service anyways and let the rule decide the action switch (service) { case CIP_RESERVED: SCLogDebug("DecodeCIPRequest - CIP_RESERVED"); break; case CIP_GET_ATTR_ALL: SCLogDebug("DecodeCIPRequest - CIP_GET_ATTR_ALL"); break; case CIP_GET_ATTR_LIST: SCLogDebug("DecodeCIPRequest - CIP_GET_ATTR_LIST"); break; case CIP_SET_ATTR_LIST: SCLogDebug("DecodeCIPRequest - CIP_SET_ATTR_LIST"); break; case CIP_RESET: SCLogDebug("DecodeCIPRequest - CIP_RESET"); break; case CIP_START: SCLogDebug("DecodeCIPRequest - CIP_START"); break; case CIP_STOP: SCLogDebug("DecodeCIPRequest - CIP_STOP"); break; case CIP_CREATE: SCLogDebug("DecodeCIPRequest - CIP_CREATE"); break; case CIP_DELETE: SCLogDebug("DecodeCIPRequest - CIP_DELETE"); break; case CIP_MSP: SCLogDebug("DecodeCIPRequest - CIP_MSP"); DecodeCIPRequestMSPPDU(input, input_len, enip_data, offset); break; case CIP_APPLY_ATTR: SCLogDebug("DecodeCIPRequest - CIP_APPLY_ATTR"); break; case CIP_KICK_TIMER: SCLogDebug("DecodeCIPRequest - CIP_KICK_TIMER"); break; case CIP_OPEN_CONNECTION: SCLogDebug("DecodeCIPRequest - CIP_OPEN_CONNECTION"); break; case CIP_CHANGE_START: SCLogDebug("DecodeCIPRequest - CIP_CHANGE_START"); break; case CIP_GET_STATUS: SCLogDebug("DecodeCIPRequest - CIP_GET_STATUS"); break; default: SCLogDebug("DecodeCIPRequest - CIP SERVICE 0x%x", service); } return ret; } /** * \brief Deocde CIP Request Path * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @param cipserviced the cip service rule * @return 1 Packet matches * @return 0 Packet not match */ int DecodeCIPRequestPathPDU(uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset) { //SCLogDebug("DecodeCIPRequestPath: service 0x%x size %d length %d", // node->service, node->request.path_size, input_len); if (node->request.path_size < 1) { //SCLogDebug("DecodeCIPRequestPath: empty path or CIP Response"); return 0; } int bytes_remain = node->request.path_size; uint8_t segment; uint8_t reserved; //unused byte reserved by ODVA //8 bit fields uint8_t req_path_class8; uint8_t req_path_instance8; uint8_t req_path_attr8; //16 bit fields uint16_t req_path_class16; uint16_t req_path_instance16; uint16_t class = 0; SegmentEntry *seg = NULL; while (bytes_remain > 0) { if (ENIPExtractUint8(&segment, input, &offset, input_len) != 1) { return 0; } switch (segment) { //assume order is class then instance. Can have multiple case PATH_CLASS_8BIT: if (ENIPExtractUint8(&req_path_class8, input, &offset, input_len) != 1) { return 0; } class = (uint16_t) req_path_class8; SCLogDebug("DecodeCIPRequestPathPDU: 8bit class 0x%x", class); seg = SCMalloc(sizeof(SegmentEntry)); if (unlikely(seg == NULL)) return 0; seg->segment = segment; seg->value = class; TAILQ_INSERT_TAIL(&node->segment_list, seg, next); bytes_remain--; break; case PATH_INSTANCE_8BIT: if (ENIPExtractUint8(&req_path_instance8, input, &offset, input_len) != 1) { return 0; } //skip instance, don't need to store bytes_remain--; break; case PATH_ATTR_8BIT: //single attribute if (ENIPExtractUint8(&req_path_attr8, input, &offset, input_len) != 1) { return 0; } //uint16_t attrib = (uint16_t) req_path_attr8; //SCLogDebug("DecodeCIPRequestPath: 8bit attr 0x%x", attrib); seg = SCMalloc(sizeof(SegmentEntry)); if (unlikely(seg == NULL)) return 0; seg->segment = segment; seg->value = class; TAILQ_INSERT_TAIL(&node->segment_list, seg, next); bytes_remain--; break; case PATH_CLASS_16BIT: if (ENIPExtractUint8(&reserved, input, &offset, input_len) != 1) //skip reserved { return 0; } if (ENIPExtractUint16(&req_path_class16, input, &offset, input_len) != 1) { return 0; } class = req_path_class16; SCLogDebug("DecodeCIPRequestPath: 16bit class 0x%x", class); seg = SCMalloc(sizeof(SegmentEntry)); if (unlikely(seg == NULL)) return 0; seg->segment = segment; seg->value = class; TAILQ_INSERT_TAIL(&node->segment_list, seg, next); if (bytes_remain >= 2) { bytes_remain = bytes_remain - 2; } else { bytes_remain = 0; } break; case PATH_INSTANCE_16BIT: if (ENIPExtractUint8(&reserved, input, &offset, input_len) != 1) // skip reserved { return 0; } if (ENIPExtractUint16(&req_path_instance16, input, &offset, input_len) != 1) { return 0; } //skip instance, don't need to store if (bytes_remain >= 2) { bytes_remain = bytes_remain - 2; } else { bytes_remain = 0; } break; default: SCLogDebug( "DecodeCIPRequestPath: UNKNOWN SEGMENT 0x%x service 0x%x", segment, node->service); return 0; } } if ((node->service == CIP_SET_ATTR_LIST) || (node->service == CIP_GET_ATTR_LIST)) { uint16_t attr_list_count; uint16_t attribute; //parse get/set attribute list if (ENIPExtractUint16(&attr_list_count, input, &offset, input_len) != 1) { return 0; } SCLogDebug("DecodeCIPRequestPathPDU: attribute list count %d", attr_list_count); for (int i = 0; i < attr_list_count; i++) { if (ENIPExtractUint16(&attribute, input, &offset, input_len) != 1) { return 0; } SCLogDebug("DecodeCIPRequestPathPDU: attribute %d", attribute); //save attrs AttributeEntry *attr = SCMalloc(sizeof(AttributeEntry)); if (unlikely(attr == NULL)) return 0; attr->attribute = attribute; TAILQ_INSERT_TAIL(&node->attrib_list, attr, next); } } return 1; } /** * \brief Decode CIP Response * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCIPResponsePDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { int ret = 1; if (enip_data->encap_data_item.length < sizeof(CIPRespHdr)) { SCLogDebug("DecodeCIPResponse - Malformed CIP Data"); return 0; } uint8_t service; //<----CIP SERVICE uint8_t reserved; //unused byte reserved by ODVA uint16_t status; if (ENIPExtractUint8(&service, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint8(&reserved, input, &offset, input_len) != 1) { return 0; } if (ENIPExtractUint16(&status, input, &offset, input_len) != 1) { return 0; } //SCLogDebug("DecodeCIPResponse: service 0x%x",service); service &= 0x7f; //strip off top bit to get service code. Responses have first bit as 1 SCLogDebug("CIP service 0x%x status 0x%x", service, status); //reached maximum number of services if (enip_data->service_count > 32) { SCLogDebug("DecodeCIPRequest: Maximum services reached"); return 0; } //save CIP data CIPServiceEntry *node = CIPServiceAlloc(enip_data); if (node == NULL) { SCLogDebug("DecodeCIPRequest: Unable to create CIP service"); return 0; } node->direction = 1; node->service = service; node->response.status = status; SCLogDebug("DecodeCIPResponsePDU: service 0x%x size %d", node->service, node->request.path_size); //list of CIP services is large and can be vendor specific, store CIP service anyways and let the rule decide the action switch (service) { case CIP_RESERVED: SCLogDebug("DecodeCIPResponse - CIP_RESERVED"); break; case CIP_GET_ATTR_ALL: SCLogDebug("DecodeCIPResponse - CIP_GET_ATTR_ALL"); break; case CIP_GET_ATTR_LIST: SCLogDebug("DecodeCIPResponse - CIP_GET_ATTR_LIST"); break; case CIP_SET_ATTR_LIST: SCLogDebug("DecodeCIPResponse - CIP_SET_ATTR_LIST"); break; case CIP_RESET: SCLogDebug("DecodeCIPResponse - CIP_RESET"); break; case CIP_START: SCLogDebug("DecodeCIPResponse - CIP_START"); break; case CIP_STOP: SCLogDebug("DecodeCIPResponse - CIP_STOP"); break; case CIP_CREATE: SCLogDebug("DecodeCIPResponse - CIP_CREATE"); break; case CIP_DELETE: SCLogDebug("DecodeCIPResponse - CIP_DELETE"); break; case CIP_MSP: SCLogDebug("DecodeCIPResponse - CIP_MSP"); DecodeCIPResponseMSPPDU(input, input_len, enip_data, offset); break; case CIP_APPLY_ATTR: SCLogDebug("DecodeCIPResponse - CIP_APPLY_ATTR"); break; case CIP_KICK_TIMER: SCLogDebug("DecodeCIPResponse - CIP_KICK_TIMER"); break; case CIP_OPEN_CONNECTION: SCLogDebug("DecodeCIPResponse - CIP_OPEN_CONNECTION"); break; case CIP_CHANGE_START: SCLogDebug("DecodeCIPResponse - CIP_CHANGE_START"); break; case CIP_GET_STATUS: SCLogDebug("DecodeCIPResponse - CIP_GET_STATUS"); break; default: SCLogDebug("DecodeCIPResponse - CIP SERVICE 0x%x", service); } return ret; } /** * \brief Decode CIP Request Multi Service Packet * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCIPRequestMSPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { int ret = 1; if (offset >= (input_len - sizeof(uint16_t))) { SCLogDebug("DecodeCIPRequestMSPPDU: Parsing beyond payload length"); return 0; } //use temp_offset just to grab the service offset, don't want to use and push offset uint16_t temp_offset = offset; uint16_t num_services; ByteExtractUint16(&num_services, BYTE_LITTLE_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + temp_offset)); temp_offset += sizeof(uint16_t); //SCLogDebug("DecodeCIPRequestMSP number of services %d",num_services); for (int svc = 1; svc < num_services + 1; svc++) { if (temp_offset >= (input_len - sizeof(uint16_t))) { SCLogDebug("DecodeCIPRequestMSPPDU: Parsing beyond payload length"); return 0; } uint16_t svc_offset; //read set of service offsets ByteExtractUint16(&svc_offset, BYTE_LITTLE_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + temp_offset)); temp_offset += sizeof(uint16_t); //SCLogDebug("parseCIPRequestMSP service %d offset %d",svc, svc_offset); DecodeCIPPDU(input, input_len, enip_data, offset + svc_offset); //parse CIP at found offset } return ret; } /** * \brief Decode CIP Response MultiService Packet. * @param input, input_len data stream * @param enip_data stores data from Packet * @param offset current point in the packet * @return 1 Packet ok * @return 0 Packet has errors */ int DecodeCIPResponseMSPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset) { int ret = 1; if (offset >= (input_len - sizeof(uint16_t))) { SCLogDebug("DecodeCIPResponseMSPPDU: Parsing beyond payload length"); return 0; } //use temp_offset just to grab the service offset, don't want to use and push offset uint16_t temp_offset = offset; uint16_t num_services; ByteExtractUint16(&num_services, BYTE_LITTLE_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + temp_offset)); temp_offset += sizeof(uint16_t); //SCLogDebug("DecodeCIPResponseMSP number of services %d", num_services); for (int svc = 0; svc < num_services; svc++) { if (temp_offset >= (input_len - sizeof(uint16_t))) { SCLogDebug("DecodeCIPResponseMSP: Parsing beyond payload length"); return 0; } uint16_t svc_offset; //read set of service offsets ByteExtractUint16(&svc_offset, BYTE_LITTLE_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + temp_offset)); temp_offset += sizeof(uint16_t); //SCLogDebug("parseCIPResponseMSP service %d offset %d", svc, svc_offset); DecodeCIPPDU(input, input_len, enip_data, offset + svc_offset); //parse CIP at found offset } return ret; } suricata-3.2.1/src/decode-vlan.h0000644000000000000000000000343413051004444013337 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DECODE_VLAN_H__ #define __DECODE_VLAN_H__ /* return vlan id in host byte order */ uint16_t DecodeVLANGetId(const struct Packet_ *, uint8_t layer); /** Vlan type */ #define ETHERNET_TYPE_VLAN 0x8100 /** Vlan macros to access Vlan priority, Vlan CFI and VID */ #define GET_VLAN_PRIORITY(vlanh) ((ntohs((vlanh)->vlan_cfi) & 0xe000) >> 13) #define GET_VLAN_CFI(vlanh) ((ntohs((vlanh)->vlan_cfi) & 0x0100) >> 12) #define GET_VLAN_ID(vlanh) ((uint16_t)(ntohs((vlanh)->vlan_cfi) & 0x0FFF)) #define GET_VLAN_PROTO(vlanh) ((ntohs((vlanh)->protocol))) /* return vlan id in host byte order */ #define VLAN_GET_ID1(p) DecodeVLANGetId((p), 0) #define VLAN_GET_ID2(p) DecodeVLANGetId((p), 1) /** Vlan header struct */ typedef struct VLANHdr_ { uint16_t vlan_cfi; uint16_t protocol; /**< protocol field */ } __attribute__((__packed__)) VLANHdr; /** VLAN header length */ #define VLAN_HEADER_LEN 4 void DecodeVLANRegisterTests(void); #endif /* __DECODE_VLAN_H__ */ suricata-3.2.1/src/app-layer-events.c0000644000000000000000000001050313051004444014340 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #include "suricata-common.h" #include "decode.h" #include "flow.h" #include "app-layer-events.h" #include "app-layer-parser.h" #include "util-enum.h" /* events raised during protocol detection are stored in the * packets storage, not in the flow. */ SCEnumCharMap app_layer_event_pkt_table[ ] = { { "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS }, { "APPLAYER_WRONG_DIRECTION_FIRST_DATA", APPLAYER_WRONG_DIRECTION_FIRST_DATA }, { "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION }, { "APPLAYER_PROTO_DETECTION_SKIPPED", APPLAYER_PROTO_DETECTION_SKIPPED }, { NULL, -1 }, }; int AppLayerGetPktEventInfo(const char *event_name, int *event_id) { *event_id = SCMapEnumNameToValue(event_name, app_layer_event_pkt_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "app-layer-event's packet event table.", event_name); /* this should be treated as fatal */ return -1; } return 0; } #define DECODER_EVENTS_BUFFER_STEPS 8 /** * \brief Set an app layer decoder event. * * \param sevents Pointer to a AppLayerDecoderEvents pointer. If *sevents is NULL * memory will be allocated. * \param event The event to be stored. */ void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event) { if (*sevents == NULL) { AppLayerDecoderEvents *new_devents = SCMalloc(sizeof(AppLayerDecoderEvents)); if (new_devents == NULL) return; memset(new_devents, 0, sizeof(AppLayerDecoderEvents)); *sevents = new_devents; } if ((*sevents)->cnt == UCHAR_MAX) { /* we're full */ return; } if ((*sevents)->cnt == (*sevents)->events_buffer_size) { int steps = DECODER_EVENTS_BUFFER_STEPS; if (UCHAR_MAX - (*sevents)->cnt < steps) steps = UCHAR_MAX - (*sevents)->cnt < steps; void *ptr = SCRealloc((*sevents)->events, ((*sevents)->cnt + steps) * sizeof(uint8_t)); if (ptr == NULL) { /* couldn't grow buffer, but no reason to free old * so we keep the events that may already be here */ return; } (*sevents)->events = ptr; (*sevents)->events_buffer_size += steps; } (*sevents)->events[(*sevents)->cnt++] = event; } /** * \brief Set an app layer decoder event. * * \param f Pointer to a flow containing DecoderEvents pointer head. If * the head points to a DecoderEvents instance, a * new instance would be created and the pointer head would * would be updated with this new instance * \param event The event to be stored. */ void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event) { AppLayerDecoderEvents *events = AppLayerParserGetDecoderEvents(f->alparser); AppLayerDecoderEvents *new = events; AppLayerDecoderEventsSetEventRaw(&events, event); if (events != new) AppLayerParserSetDecoderEvents(f->alparser, events); } void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events) { if (events != NULL) events->cnt = 0; } void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events) { if (events && *events != NULL) { if ((*events)->events != NULL) SCFree((*events)->events); SCFree(*events); *events = NULL; } } suricata-3.2.1/src/detect-app-layer-event.h0000644000000000000000000000213713051004444015434 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_APP_LAYER_EVENT_H__ #define __DETECT_APP_LAYER_EVENT_H__ typedef struct DetectAppLayerEventData_ { AppProto alproto; int event_id; char *arg; } DetectAppLayerEventData; int DetectAppLayerEventPrepare(Signature *s); void DetectAppLayerEventRegister(void); #endif /* __DETECT_APP_LAYER_EVENT_H__ */ suricata-3.2.1/src/util-file.h0000644000000000000000000001365413051004444013055 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #ifndef __UTIL_FILE_H__ #define __UTIL_FILE_H__ #ifdef HAVE_NSS #include #endif #include "conf.h" #include "util-streaming-buffer.h" #define FILE_TRUNCATED BIT_U16(0) #define FILE_NOMAGIC BIT_U16(1) #define FILE_NOMD5 BIT_U16(2) #define FILE_MD5 BIT_U16(3) #define FILE_NOSHA1 BIT_U16(4) #define FILE_SHA1 BIT_U16(5) #define FILE_NOSHA256 BIT_U16(6) #define FILE_SHA256 BIT_U16(7) #define FILE_LOGGED BIT_U16(8) #define FILE_NOSTORE BIT_U16(9) #define FILE_STORE BIT_U16(10) #define FILE_STORED BIT_U16(11) #define FILE_NOTRACK BIT_U16(12) /**< track size of file */ #define FILE_USE_DETECT BIT_U16(13) /**< use content_inspected tracker */ typedef enum FileState_ { FILE_STATE_NONE = 0, /**< no state */ FILE_STATE_OPENED, /**< flow file is opened */ FILE_STATE_CLOSED, /**< flow file is completed, there will be no more data. */ FILE_STATE_TRUNCATED, /**< flow file is not complete, but there will be no more data. */ FILE_STATE_ERROR, /**< file is in an error state */ FILE_STATE_MAX } FileState; typedef struct File_ { uint16_t flags; uint16_t name_len; int16_t state; StreamingBuffer *sb; uint64_t txid; /**< tx this file is part of */ uint32_t file_id; uint8_t *name; #ifdef HAVE_MAGIC char *magic; #endif struct File_ *next; #ifdef HAVE_NSS HASHContext *md5_ctx; uint8_t md5[MD5_LENGTH]; HASHContext *sha1_ctx; uint8_t sha1[SHA1_LENGTH]; HASHContext *sha256_ctx; uint8_t sha256[SHA256_LENGTH]; #endif uint64_t content_inspected; /**< used in pruning if FILE_USE_DETECT * flag is set */ uint64_t content_stored; uint64_t size; } File; typedef struct FileContainer_ { File *head; File *tail; } FileContainer; FileContainer *FileContainerAlloc(); void FileContainerFree(FileContainer *); void FileContainerRecycle(FileContainer *); void FileContainerAdd(FileContainer *, File *); /** * \brief Open a new File * * \param ffc flow container * \param sbcfg buffer config * \param name filename character array * \param name_len filename len * \param data initial data * \param data_len initial data len * \param flags open flags * * \retval ff flowfile object * * \note filename is not a string, so it's not nul terminated. * * If flags contains the FILE_USE_DETECT bit, the pruning code will * consider not just the content_stored tracker, but also content_inspected. * It's the responsibility of the API user to make sure this tracker is * properly updated. */ File *FileOpenFile(FileContainer *, const StreamingBufferConfig *, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags); /** * \brief Close a File * * \param ffc the container * \param data final data if any * \param data_len data len if any * \param flags flags * * \retval 0 ok * \retval -1 error */ int FileCloseFile(FileContainer *, const uint8_t *data, uint32_t data_len, uint16_t flags); /** * \brief Store a chunk of file data in the flow. The open "flowfile" * will be used. * * \param ffc the container * \param data data chunk * \param data_len data chunk len * * \retval 0 ok * \retval -1 error */ int FileAppendData(FileContainer *, const uint8_t *data, uint32_t data_len); /** * \brief Tag a file for storing * * \param ff The file to store */ int FileStore(File *); /** * \brief Set the TX id for a file * * \param ff The file to store * \param txid the tx id */ int FileSetTx(File *, uint64_t txid); /** * \brief disable file storage for a flow * * \param f *LOCKED* flow */ void FileDisableStoring(struct Flow_ *, uint8_t); void FileDisableFilesize(Flow *f, uint8_t direction); /** * \brief disable file storing for a transaction * * \param f flow * \param tx_id transaction id */ void FileDisableStoringForTransaction(Flow *f, uint8_t direction, uint64_t tx_id); void FlowFileDisableStoringForTransaction(struct Flow_ *f, uint64_t tx_id); void FilePrune(FileContainer *ffc); void FileForceFilestoreEnable(void); int FileForceFilestore(void); void FileReassemblyDepthEnable(uint32_t size); uint32_t FileReassemblyDepth(void); void FileDisableMagic(Flow *f, uint8_t); void FileForceMagicEnable(void); int FileForceMagic(void); void FileDisableMd5(Flow *f, uint8_t); void FileForceMd5Enable(void); int FileForceMd5(void); void FileDisableSha1(Flow *f, uint8_t); void FileForceSha1Enable(void); int FileForceSha1(void); void FileDisableSha256(Flow *f, uint8_t); void FileForceSha256Enable(void); int FileForceSha256(void); void FileForceHashParseCfg(ConfNode *); void FileForceTrackingEnable(void); void FileStoreAllFiles(FileContainer *); void FileStoreAllFilesForTx(FileContainer *, uint64_t); void FileStoreFileById(FileContainer *fc, uint32_t); void FileTruncateAllOpenFiles(FileContainer *); uint64_t FileDataSize(const File *file); uint64_t FileTrackedSize(const File *file); uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction); #endif /* __UTIL_FILE_H__ */ suricata-3.2.1/src/tmqh-ringbuffer.c0000644000000000000000000001012313051004444014242 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * RingBuffer queue handler */ #include "suricata.h" #include "packet-queue.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "util-ringbuffer.h" static RingBuffer8 *ringbuffers[256]; Packet *TmqhInputRingBufferMrSw(ThreadVars *t); void TmqhOutputRingBufferMrSw(ThreadVars *t, Packet *p); Packet *TmqhInputRingBufferSrSw(ThreadVars *t); void TmqhOutputRingBufferSrSw(ThreadVars *t, Packet *p); Packet *TmqhInputRingBufferSrMw(ThreadVars *t); void TmqhOutputRingBufferSrMw(ThreadVars *t, Packet *p); void TmqhInputRingBufferShutdownHandler(ThreadVars *); /** * \brief TmqhRingBufferRegister * \initonly */ void TmqhRingBufferRegister (void) { tmqh_table[TMQH_RINGBUFFER_MRSW].name = "ringbuffer_mrsw"; tmqh_table[TMQH_RINGBUFFER_MRSW].InHandler = TmqhInputRingBufferMrSw; tmqh_table[TMQH_RINGBUFFER_MRSW].InShutdownHandler = TmqhInputRingBufferShutdownHandler; tmqh_table[TMQH_RINGBUFFER_MRSW].OutHandler = TmqhOutputRingBufferMrSw; tmqh_table[TMQH_RINGBUFFER_SRSW].name = "ringbuffer_srsw"; tmqh_table[TMQH_RINGBUFFER_SRSW].InHandler = TmqhInputRingBufferSrSw; tmqh_table[TMQH_RINGBUFFER_SRSW].InShutdownHandler = TmqhInputRingBufferShutdownHandler; tmqh_table[TMQH_RINGBUFFER_SRSW].OutHandler = TmqhOutputRingBufferSrSw; tmqh_table[TMQH_RINGBUFFER_SRMW].name = "ringbuffer_srmw"; tmqh_table[TMQH_RINGBUFFER_SRMW].InHandler = TmqhInputRingBufferSrMw; tmqh_table[TMQH_RINGBUFFER_SRMW].InShutdownHandler = TmqhInputRingBufferShutdownHandler; tmqh_table[TMQH_RINGBUFFER_SRMW].OutHandler = TmqhOutputRingBufferSrMw; memset(ringbuffers, 0, sizeof(ringbuffers)); int i = 0; for (i = 0; i < 256; i++) { ringbuffers[i] = RingBuffer8Init(); if (ringbuffers[i] == NULL) { SCLogError(SC_ERR_FATAL, "Error allocating memory to register Ringbuffers. Exiting..."); exit(EXIT_FAILURE); } } } void TmqhRingBufferDestroy (void) { int i = 0; for (i = 0; i < 256; i++) { RingBuffer8Destroy(ringbuffers[i]); } } void TmqhInputRingBufferShutdownHandler(ThreadVars *tv) { if (tv == NULL || tv->inq == NULL) { return; } RingBuffer8 *rb = ringbuffers[tv->inq->id]; if (rb == NULL) { return; } RingBuffer8Shutdown(rb); } Packet *TmqhInputRingBufferMrSw(ThreadVars *t) { RingBuffer8 *rb = ringbuffers[t->inq->id]; Packet *p = (Packet *)RingBufferMrSw8Get(rb); StatsSyncCountersIfSignalled(t); return p; } void TmqhOutputRingBufferMrSw(ThreadVars *t, Packet *p) { RingBuffer8 *rb = ringbuffers[t->outq->id]; RingBufferMrSw8Put(rb, (void *)p); } Packet *TmqhInputRingBufferSrSw(ThreadVars *t) { RingBuffer8 *rb = ringbuffers[t->inq->id]; Packet *p = (Packet *)RingBufferSrSw8Get(rb); StatsSyncCountersIfSignalled(t); return p; } void TmqhOutputRingBufferSrSw(ThreadVars *t, Packet *p) { RingBuffer8 *rb = ringbuffers[t->outq->id]; RingBufferSrSw8Put(rb, (void *)p); } Packet *TmqhInputRingBufferSrMw(ThreadVars *t) { RingBuffer8 *rb = ringbuffers[t->inq->id]; Packet *p = (Packet *)RingBufferSrMw8Get(rb); StatsSyncCountersIfSignalled(t); return p; } void TmqhOutputRingBufferSrMw(ThreadVars *t, Packet *p) { RingBuffer8 *rb = ringbuffers[t->outq->id]; RingBufferSrMw8Put(rb, (void *)p); } suricata-3.2.1/src/detect-pkt-data.h0000644000000000000000000000163513051004444014132 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PKTDATA_H__ #define __DETECT_PKTDATA_H__ /* prototypes */ void DetectPktDataRegister (void); #endif /* __DETECT_PKTDATA_H__ */ suricata-3.2.1/src/detect-http-hrh.c0000644000000000000000000020636713051004444014167 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * * Implements support for the http_raw_host keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "stream-tcp.h" #include "detect-http-hrh.h" #include "detect-engine-hrhhd.h" int DetectHttpHRHSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpHRHRegisterTests(void); void DetectHttpHRHFree(void *); /** * \brief Registers the keyword handlers for the "http_raw_host" keyword. */ void DetectHttpHRHRegister(void) { sigmatch_table[DETECT_AL_HTTP_RAW_HOST].name = "http_raw_host"; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].desc = "content modifier to match only on the HTTP host header or the raw hostname from the HTTP uri"; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Match = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Free = DetectHttpHRHFree; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].RegisterTests = DetectHttpHRHRegisterTests; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_NOOPT ; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_raw_host", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, 2, PrefilterTxHostnameRawRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, DetectEngineInspectHttpHRH); return; } /** * \brief The setup function for the http_raw_host keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to the signature for the current Signature being * parsed from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpHRHSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_RAW_HOST, DETECT_SM_LIST_HRHHDMATCH, ALPROTO_HTTP, NULL); } /** * \brief The function to free the http_raw_host data. * * \param ptr Pointer to the http_raw_host. */ void DetectHttpHRHFree(void *ptr) { DetectContentData *hrhhd = (DetectContentData *)ptr; if (hrhhd == NULL) return; if (hrhhd->content != NULL) SCFree(hrhhd->content); SpmDestroyCtx(hrhhd->spm_ctx); SCFree(hrhhd); return; } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_raw_host is correctly parsed * and the keyword is registered. */ static int DetectHttpHRHTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_host\"; " "content:\"one\"; http_raw_host; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_raw_host entry is * parsed. */ static int DetectHttpHRHTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_host\"; " "content:\"one\"; http_raw_host; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a * http_raw_host is invalidated. */ static int DetectHttpHRHTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_host\"; " "http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_raw_host is invalidated. */ static int DetectHttpHRHTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_host\"; " "content:\"one\"; rawbytes; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a http_raw_host with nocase is parsed. */ static int DetectHttpHRHTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_host\"; " "content:\"one\"; http_raw_host; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectHttpHRHTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectHttpHRHTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message"; uint8_t http2_buf[] = "body1\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectHttpHRHTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "host: This is dummy mess"; uint8_t http2_buf[] = "age body\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_raw_host content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpHRHTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy body1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"body1This\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_raw_host content matches against a http request * against a case insensitive pattern. */ static int DetectHttpHRHTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy bodY1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy bodY1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"bodY1This\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_raw_host content matches against a * http request which doesn't hold the content. */ static int DetectHttpHRHTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:!\"message\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_raw_host content matches against a * http request which holds hold the content. */ static int DetectHttpHRHTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy body\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:!\"message\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_raw_host content matches against a http request * which holds the content. */ static int DetectHttpHRHTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_raw_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test multiple http transactions and body chunks of request handling */ static int DetectHttpHRHTest14(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "Cookie: dummy1\r\n"; uint8_t httpbuf3[] = "Host: Body one!!\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf5[] = "Cookie: dummy2\r\n"; uint8_t httpbuf6[] = "Host: Body two\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy1\"; http_cookie; content:\"Body one\"; http_raw_host; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"dummy2\"; http_cookie; content:\"Body two\"; http_raw_host; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2)) { printf("sig 1 alerted (4): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) { printf("sig 1 alerted (request 2, chunk 6): "); goto end; } p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || !(PacketAlertCheck(p, 2))) { printf("signature 2 didn't match or sig 1 matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } int DetectHttpHRHTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; content:\"two\"; http_raw_host; " "content:\"three\"; distance:10; http_raw_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "two", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd1) || !DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; pcre:/two/; " "content:\"three\"; distance:10; http_raw_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; pcre:/two/; " "content:\"three\"; distance:10; within:15; http_raw_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; pcre:/two/; " "content:\"three\"; distance:10; http_raw_host; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_raw_host; pcre:/two/; " "content:\"three\"; distance:10; http_raw_host; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { printf ("failed: http_raw_host incorrect flags"); goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_raw_host; pcre:/two/; " "content:\"three\"; distance:10; http_raw_host; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; nocase; pcre:/two/; " "content:\"three\"; http_raw_host; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hrhhd1->flags != (DETECT_CONTENT_NOCASE) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DEPTH) || memcmp(hrhhd2->content, "three", hrhhd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || !DETECT_CONTENT_IS_SINGLE(hrhhd1) || DETECT_CONTENT_IS_SINGLE(hrhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; " "content:\"two\"; distance:0; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hrhhd2->content, "two", hrhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; " "content:\"two\"; within:5; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "one", hrhhd1->content_len) != 0 || hrhhd2->flags != (DETECT_CONTENT_WITHIN) || memcmp(hrhhd2->content, "two", hrhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_raw_host; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list != NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/Zi; " "content:\"two\"; within:5; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT | DETECT_PCRE_CASELESS) || hrhhd2->flags != (DETECT_CONTENT_WITHIN) || memcmp(hrhhd2->content, "two", hrhhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"two\"; http_raw_host; " "pcre:/one/ZRi; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hrhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE | DETECT_PCRE_CASELESS) || hrhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hrhhd1->content, "two", hrhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHRHTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/Zi; " "content:\"two\"; distance:5; http_raw_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; DetectContentData *hrhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT | DETECT_PCRE_CASELESS) || hrhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hrhhd2->content, "two", hrhhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_raw_host content matches against a http request * against a case insensitive pattern. */ static int DetectHttpHRHTest37(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy bodY1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy bodY1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"body1this\"; http_raw_host; nocase; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ void DetectHttpHRHRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpHRHTest01", DetectHttpHRHTest01); UtRegisterTest("DetectHttpHRHTest02", DetectHttpHRHTest02); UtRegisterTest("DetectHttpHRHTest03", DetectHttpHRHTest03); UtRegisterTest("DetectHttpHRHTest04", DetectHttpHRHTest04); UtRegisterTest("DetectHttpHRHTest05", DetectHttpHRHTest05); UtRegisterTest("DetectHttpHRHTest06", DetectHttpHRHTest06); UtRegisterTest("DetectHttpHRHTest07", DetectHttpHRHTest07); UtRegisterTest("DetectHttpHRHTest08", DetectHttpHRHTest08); UtRegisterTest("DetectHttpHRHTest09", DetectHttpHRHTest09); UtRegisterTest("DetectHttpHRHTest10", DetectHttpHRHTest10); UtRegisterTest("DetectHttpHRHTest11", DetectHttpHRHTest11); UtRegisterTest("DetectHttpHRHTest12", DetectHttpHRHTest12); UtRegisterTest("DetectHttpHRHTest13", DetectHttpHRHTest13); UtRegisterTest("DetectHttpHRHTest14", DetectHttpHRHTest14); UtRegisterTest("DetectHttpHRHTest22", DetectHttpHRHTest22); UtRegisterTest("DetectHttpHRHTest23", DetectHttpHRHTest23); UtRegisterTest("DetectHttpHRHTest24", DetectHttpHRHTest24); UtRegisterTest("DetectHttpHRHTest25", DetectHttpHRHTest25); UtRegisterTest("DetectHttpHRHTest26", DetectHttpHRHTest26); UtRegisterTest("DetectHttpHRHTest27", DetectHttpHRHTest27); UtRegisterTest("DetectHttpHRHTest28", DetectHttpHRHTest28); UtRegisterTest("DetectHttpHRHTest29", DetectHttpHRHTest29); UtRegisterTest("DetectHttpHRHTest30", DetectHttpHRHTest30); UtRegisterTest("DetectHttpHRHTest31", DetectHttpHRHTest31); UtRegisterTest("DetectHttpHRHTest32", DetectHttpHRHTest32); UtRegisterTest("DetectHttpHRHTest33", DetectHttpHRHTest33); UtRegisterTest("DetectHttpHRHTest34", DetectHttpHRHTest34); UtRegisterTest("DetectHttpHRHTest35", DetectHttpHRHTest35); UtRegisterTest("DetectHttpHRHTest36", DetectHttpHRHTest36); UtRegisterTest("DetectHttpHRHTest37", DetectHttpHRHTest37); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-bypass.c0000644000000000000000000001502113051004444013713 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo * */ #include "suricata-common.h" #include "threads.h" #include "app-layer.h" #include "app-layer-parser.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-engine-sigorder.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "stream-tcp.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-device.h" int DetectBypassMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectBypassSetup(DetectEngineCtx *, Signature *, char *); static void DetectBypassRegisterTests(void); /** * \brief Registration function for keyword: bypass */ void DetectBypassRegister(void) { sigmatch_table[DETECT_BYPASS].name = "bypass"; sigmatch_table[DETECT_BYPASS].desc = "call the bypass callback when the match of a sig is complete"; sigmatch_table[DETECT_BYPASS].url = ""; sigmatch_table[DETECT_BYPASS].Match = DetectBypassMatch; sigmatch_table[DETECT_BYPASS].AppLayerMatch = NULL; sigmatch_table[DETECT_BYPASS].Setup = DetectBypassSetup; sigmatch_table[DETECT_BYPASS].Free = NULL; sigmatch_table[DETECT_BYPASS].RegisterTests = DetectBypassRegisterTests; sigmatch_table[DETECT_BYPASS].flags = SIGMATCH_NOOPT; } static int DetectBypassSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SigMatch *sm = NULL; if (s->flags & SIG_FLAG_FILESTORE) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "bypass can't work with filestore keyword"); return -1; } s->flags |= SIG_FLAG_BYPASS; sm = SigMatchAlloc(); if (sm == NULL) return -1; sm->type = DETECT_BYPASS; sm->ctx = NULL; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); return 0; } int DetectBypassMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { PacketBypassCallback(p); return 1; } #ifdef UNITTESTS static int callback_var = 0; static int BypassCallback() { callback_var = 1; return 1; } static void ResetCallbackVar() { callback_var = 0; } static int DetectBypassTestSig01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: This is dummy message body\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); LiveDevice *livedev = SCMalloc(sizeof(LiveDevice)); FAIL_IF(livedev == NULL); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FAIL_IF(p1 == NULL); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FAIL_IF(p2 == NULL); p1->BypassPacketsFlow = BypassCallback; p2->BypassPacketsFlow = BypassCallback; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p1->livedev = livedev; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->livedev = livedev; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; char *sigs[3]; sigs[0] = "alert tcp any any -> any any (bypass; content:\"GET \"; sid:1;)"; sigs[1] = "alert http any any -> any any " "(bypass; content:\"message\"; http_server_body; " "sid:2;)"; sigs[2] = "alert http any any -> any any " "(bypass; content:\"message\"; http_host; " "sid:3;)"; FAIL_IF(UTHAppendSigs(de_ctx, sigs, 3) == 0); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); http_state = f.alstate; FAIL_IF(http_state == NULL); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); FAIL_IF(!(PacketAlertCheck(p2, 2))); FAIL_IF(!(PacketAlertCheck(p1, 3))); FAIL_IF(callback_var == 0); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); ResetCallbackVar(); SCFree(livedev); PASS; } #endif /* UNITTESTS */ void DetectBypassRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectBypassTestSig01", DetectBypassTestSig01); #endif /* UNITTESTS */ } suricata-3.2.1/src/unix-manager.h0000644000000000000000000000264313051004444013552 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef UNIX_MANAGER_H #define UNIX_MANAGER_H #ifdef BUILD_UNIX_SOCKET #include #endif #define UNIX_CMD_TAKE_ARGS 1 SCCtrlCondT unix_manager_ctrl_cond; SCCtrlMutex unix_manager_ctrl_mutex; void UnixManagerThreadSpawn(int mode); void UnixSocketKillSocketThread(void); #ifdef BUILD_UNIX_SOCKET TmEcode UnixManagerRegisterCommand(const char * keyword, TmEcode (*Func)(json_t *, json_t *, void *), void *data, int flags); TmEcode UnixManagerRegisterBackgroundTask( TmEcode (*Func)(void *), void *data); #endif void TmModuleUnixManagerRegister(void); void UnixManagerThreadSpawnNonRunmode(void); #endif /* UNIX_MANAGER_H */ suricata-3.2.1/src/output-file.c0000644000000000000000000002024713051004444013427 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer File Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output.h" #include "output-file.h" #include "app-layer.h" #include "app-layer-parser.h" #include "detect-filemagic.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputFileLogger_ { FileLogger LogFunc; OutputCtx *output_ctx; struct OutputFileLogger_ *next; const char *name; LoggerId logger_id; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; } OutputFileLogger; static OutputFileLogger *list = NULL; int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputFileLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->output_ctx = output_ctx; op->name = name; op->logger_id = id; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (list == NULL) list = op; else { OutputFileLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterFileLogger happy"); return 0; } static TmEcode OutputFileLog(ThreadVars *tv, Packet *p, void *thread_data) { BUG_ON(thread_data == NULL); if (list == NULL) { /* No child loggers. */ return TM_ECODE_OK; } OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputFileLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); uint8_t flags = 0; Flow * const f = p->flow; /* no flow, no files */ if (f == NULL) { SCReturnInt(TM_ECODE_OK); } if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else flags |= STREAM_TOSERVER; int file_close = (p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0; int file_trunc = 0; file_trunc = StreamTcpReassembleDepthReached(p); FileContainer *ffc = AppLayerParserGetFiles(p->proto, f->alproto, f->alstate, flags); SCLogDebug("ffc %p", ffc); if (ffc != NULL) { File *ff; for (ff = ffc->head; ff != NULL; ff = ff->next) { if (ff->flags & FILE_LOGGED) continue; SCLogDebug("ff %p", ff); if (file_trunc && ff->state < FILE_STATE_CLOSED) ff->state = FILE_STATE_TRUNCATED; if (file_close && ff->state < FILE_STATE_CLOSED) ff->state = FILE_STATE_TRUNCATED; if (ff->state == FILE_STATE_CLOSED || ff->state == FILE_STATE_TRUNCATED || ff->state == FILE_STATE_ERROR) { int file_logged = 0; #ifdef HAVE_MAGIC if (FileForceMagic() && ff->magic == NULL) { FilemagicGlobalLookup(ff); } #endif logger = list; store = op_thread_data->store; while (logger && store) { BUG_ON(logger->LogFunc == NULL); SCLogDebug("logger %p", logger); PACKET_PROFILING_LOGGER_START(p, logger->logger_id); logger->LogFunc(tv, store->thread_data, (const Packet *)p, (const File *)ff); PACKET_PROFILING_LOGGER_END(p, logger->logger_id); file_logged = 1; logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } if (file_logged) { ff->flags |= FILE_LOGGED; } } } FilePrune(ffc); } return TM_ECODE_OK; } /** \brief thread init for the tx logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputFileLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputFileLogThreadInit happy (*data %p)", *data); OutputFileLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } return TM_ECODE_OK; } static TmEcode OutputFileLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFileLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputFileLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFileLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputFileLoggerRegister(void) { OutputRegisterRootLogger(OutputFileLogThreadInit, OutputFileLogThreadDeinit, OutputFileLogExitPrintStats, OutputFileLog); } void OutputFileShutdown(void) { OutputFileLogger *logger = list; while (logger) { OutputFileLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/app-layer-enip-common.h0000644000000000000000000001546713051004444015300 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong */ #ifndef __APP_LAYER_ENIP_COMMON_H__ #define __APP_LAYER_ENIP_COMMON_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "queue.h" #define MAX_ENIP_CMD 65535 // EtherNet/IP commands #define NOP 0x0000 #define LIST_SERVICES 0x0004 #define LIST_IDENTITY 0x0063 #define LIST_INTERFACES 0x0064 #define REGISTER_SESSION 0x0065 #define UNREGISTER_SESSION 0x0066 #define SEND_RR_DATA 0x006F #define SEND_UNIT_DATA 0x0070 #define INDICATE_STATUS 0x0072 #define CANCEL 0x0073 //Common Packet Format Types #define NULL_ADDR 0x0000 #define CONNECTION_BASED 0x00a1 #define CONNECTED_DATA_ITEM 0x00b1 #define UNCONNECTED_DATA_ITEM 0x00b2 #define SEQUENCE_ADDR_ITEM 0xB002 //status codes #define SUCCESS 0x0000 #define INVALID_CMD 0x0001 #define NO_RESOURCES 0x0002 #define INCORRECT_DATA 0x0003 #define INVALID_SESSION 0x0064 #define INVALID_LENGTH 0x0065 #define UNSUPPORTED_PROT_REV 0x0069 #define MAX_CIP_SERVICE 127 #define MAX_CIP_CLASS 65535 #define MAX_CIP_ATTRIBUTE 65535 // CIP service codes #define CIP_RESERVED 0x00 #define CIP_GET_ATTR_ALL 0x01 #define CIP_GET_ATTR_LIST 0x03 #define CIP_SET_ATTR_LIST 0x04 #define CIP_RESET 0x05 #define CIP_START 0x06 #define CIP_STOP 0x07 #define CIP_CREATE 0x08 #define CIP_DELETE 0x09 #define CIP_MSP 0x0a #define CIP_APPLY_ATTR 0x0d #define CIP_GET_ATTR_SINGLE 0x0e #define CIP_SET_ATTR_SINGLE 0x10 #define CIP_KICK_TIMER 0x4b #define CIP_OPEN_CONNECTION 0x4c #define CIP_CHANGE_START 0x4f #define CIP_GET_STATUS 0x50 //PATH sizing codes #define PATH_CLASS_8BIT 0x20 #define PATH_CLASS_16BIT 0x21 #define PATH_INSTANCE_8BIT 0x24 #define PATH_INSTANCE_16BIT 0x25 #define PATH_ATTR_8BIT 0x30 #define PATH_ATTR_16BIT 0x31 //possible value /** * ENIP encapsulation header */ typedef struct ENIPEncapHdr_ { uint64_t context; uint32_t session; uint32_t status; uint32_t option; uint16_t command; uint16_t length; } ENIPEncapHdr; /** * ENIP encapsulation data header */ typedef struct ENIPEncapDataHdr_ { uint32_t interface_handle; uint16_t timeout; uint16_t item_count; } ENIPEncapDataHdr; /** * ENIP encapsulation address item */ typedef struct ENIPEncapAddresItem_ { uint16_t type; uint16_t length; uint16_t conn_id; uint16_t sequence_num; } ENIPEncapAddresItem; /** * ENIP encapsulation data item */ typedef struct ENIPEncapDataItem_ { uint16_t type; uint16_t length; uint16_t sequence_count; } ENIPEncapDataItem; /** * CIP Request Header */ typedef struct CIPReqHdr_ { uint8_t service; uint8_t path_size; } CIPReqHdr; /** * CIP Response Header */ typedef struct CIPRespHdr_ { uint8_t service; uint8_t pad; uint8_t status; uint8_t status_size; } CIPRespHdr; typedef struct SegmentEntry_ { uint16_t segment; /**< segment type */ uint16_t value; /**< segment value (class or attribute) */ TAILQ_ENTRY(SegmentEntry_) next; } SegmentEntry; typedef struct AttributeEntry_ { uint16_t attribute; /**< segment class */ TAILQ_ENTRY(AttributeEntry_) next; } AttributeEntry; typedef struct CIPServiceEntry_ { uint8_t service; /**< cip service */ uint8_t direction; union { struct { uint8_t path_size; /**< cip path size */ uint16_t path_offset; /**< offset to cip path */ } request; struct { uint8_t status; } response; }; TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */ TAILQ_HEAD(, AttributeEntry_) attrib_list; /**< list for CIP segment */ TAILQ_ENTRY(CIPServiceEntry_) next; } CIPServiceEntry; typedef struct ENIPTransaction_ { struct ENIPState_ *enip; uint16_t tx_num; /**< internal: id */ uint16_t tx_id; /**< transaction id */ uint16_t service_count; ENIPEncapHdr header; /**< encapsulation header */ ENIPEncapDataHdr encap_data_header; /**< encapsulation data header */ ENIPEncapAddresItem encap_addr_item; /**< encapsulated address item */ ENIPEncapDataItem encap_data_item; /**< encapsulated data item */ TAILQ_HEAD(, CIPServiceEntry_) service_list; /**< list for CIP */ AppLayerDecoderEvents *decoder_events; /**< per tx events */ TAILQ_ENTRY(ENIPTransaction_) next; DetectEngineState *de_state; } ENIPTransaction; /** \brief Per flow ENIP state container */ typedef struct ENIPState_ { TAILQ_HEAD(, ENIPTransaction_) tx_list; /**< transaction list */ ENIPTransaction *curr; /**< ptr to current tx */ ENIPTransaction *iter; uint64_t transaction_max; uint64_t tx_with_detect_state_cnt; uint16_t events; uint16_t givenup; /* used by TCP only */ uint16_t offset; uint16_t record_len; uint8_t *buffer; } ENIPState; int DecodeENIPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data); int DecodeCommonPacketFormatPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); int DecodeCIPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); int DecodeCIPRequestPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); int DecodeCIPResponsePDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); int DecodeCIPRequestPathPDU(uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset); int DecodeCIPRequestMSPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); int DecodeCIPResponseMSPPDU(uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset); #endif /* __APP_LAYER_ENIP_COMMON_H__ */ suricata-3.2.1/src/runmode-pcap.h0000644000000000000000000000176513051004444013555 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_PCAP_H__ #define __RUNMODE_PCAP_H__ int RunModeIdsPcapSingle(void); int RunModeIdsPcapAutoFp(void); void RunModeIdsPcapRegister(void); const char *RunModeIdsGetDefaultMode(void); #endif /* __RUNMODE_PCAP_H__ */ suricata-3.2.1/src/util-misc.h0000644000000000000000000000354313051004444013065 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_MISC_H__ #define __UTIL_MISC_H__ #include "util-error.h" /** * \brief Generic API that can be used by all to log an * invalid conf entry. * \param param_name A string specifying the param name. * \param format Format for the below value. For example "%s", "%"PRIu32, etc. * \param value Default value to be printed. */ #define WarnInvalidConfEntry(param_name, format, value) do { \ SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, \ "Invalid conf entry found for " \ "\"%s\". Using default value of \"" format "\".", \ param_name, value); \ } while (0) /* size string parsing API */ int ParseSizeStringU8(const char *, uint8_t *); int ParseSizeStringU16(const char *, uint16_t *); int ParseSizeStringU32(const char *, uint32_t *); int ParseSizeStringU64(const char *, uint64_t *); void UtilMiscRegisterTests(void); void ParseSizeInit(void); void ParseSizeDeinit(void); #endif /* __UTIL_MISC_H__ */ suricata-3.2.1/src/decode-ipv6.h0000644000000000000000000002026713051004444013266 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_IPV6_H__ #define __DECODE_IPV6_H__ #define IPV6_HEADER_LEN 40 #define IPV6_MAXPACKET 65535 /* maximum packet size */ #define IPV6_MAX_OPT 40 typedef struct IPV6Hdr_ { union { struct ip6_un1_ { uint32_t ip6_un1_flow; /* 20 bits of flow-ID */ uint16_t ip6_un1_plen; /* payload length */ uint8_t ip6_un1_nxt; /* next header */ uint8_t ip6_un1_hlim; /* hop limit */ } ip6_un1; uint8_t ip6_un2_vfc; /* 4 bits version, top 4 bits class */ } ip6_hdrun; union { struct { uint32_t ip6_src[4]; uint32_t ip6_dst[4]; } ip6_un2; uint16_t ip6_addrs[16]; } ip6_hdrun2; } __attribute__((__packed__)) IPV6Hdr; #define s_ip6_src ip6_hdrun2.ip6_un2.ip6_src #define s_ip6_dst ip6_hdrun2.ip6_un2.ip6_dst #define s_ip6_addrs ip6_hdrun2.ip6_addrs #define s_ip6_vfc ip6_hdrun.ip6_un2_vfc #define s_ip6_flow ip6_hdrun.ip6_un1.ip6_un1_flow #define s_ip6_plen ip6_hdrun.ip6_un1.ip6_un1_plen #define s_ip6_nxt ip6_hdrun.ip6_un1.ip6_un1_nxt #define s_ip6_hlim ip6_hdrun.ip6_un1.ip6_un1_hlim #define IPV6_GET_RAW_VER(ip6h) (((ip6h)->s_ip6_vfc & 0xf0) >> 4) #define IPV6_GET_RAW_CLASS(ip6h) ((ntohl((ip6h)->s_ip6_flow) & 0x0FF00000) >> 20) #define IPV6_GET_RAW_FLOW(ip6h) (ntohl((ip6h)->s_ip6_flow) & 0x000FFFFF) #define IPV6_GET_RAW_NH(ip6h) ((ip6h)->s_ip6_nxt) #define IPV6_GET_RAW_PLEN(ip6h) (ntohs((ip6h)->s_ip6_plen)) #define IPV6_GET_RAW_HLIM(ip6h) ((ip6h)->s_ip6_hlim) #define IPV6_SET_RAW_VER(ip6h, value) ((ip6h)->s_ip6_vfc = (((ip6h)->s_ip6_vfc & 0x0f) | (value << 4))) #define IPV6_SET_RAW_NH(ip6h, value) ((ip6h)->s_ip6_nxt = (value)) #define IPV6_SET_L4PROTO(p,proto) (p)->ip6vars.l4proto = proto /* ONLY call these functions after making sure that: * 1. p->ip6h is set * 2. p->ip6h is valid (len is correct) */ #define IPV6_GET_VER(p) \ IPV6_GET_RAW_VER((p)->ip6h) #define IPV6_GET_CLASS(p) \ IPV6_GET_RAW_CLASS((p)->ip6h) #define IPV6_GET_FLOW(p) \ IPV6_GET_RAW_FLOW((p)->ip6h) #define IPV6_GET_NH(p) \ (IPV6_GET_RAW_NH((p)->ip6h)) #define IPV6_GET_PLEN(p) \ IPV6_GET_RAW_PLEN((p)->ip6h) #define IPV6_GET_HLIM(p) \ (IPV6_GET_RAW_HLIM((p)->ip6h)) /* XXX */ #define IPV6_GET_L4PROTO(p) \ ((p)->ip6vars.l4proto) /** \brief get the highest proto/next header field we know */ //#define IPV6_GET_UPPER_PROTO(p) (p)->ip6eh.ip6_exthdrs_cnt ? // (p)->ip6eh.ip6_exthdrs[(p)->ip6eh.ip6_exthdrs_cnt - 1].next : IPV6_GET_NH((p)) /* helper structure with parsed ipv6 info */ typedef struct IPV6Vars_ { uint8_t ip_opts_len; uint8_t l4proto; /* the proto after the extension headers * store while decoding so we don't have * to loop through the exthdrs all the time */ } IPV6Vars; #define CLEAR_IPV6_PACKET(p) do { \ (p)->ip6h = NULL; \ (p)->ip6vars.ip_opts_len = 0; \ (p)->ip6vars.l4proto = 0; \ memset(&(p)->ip6eh, 0x00, sizeof((p)->ip6eh)); \ } while (0) /* Fragment header */ typedef struct IPV6FragHdr_ { uint8_t ip6fh_nxt; /* next header */ uint8_t ip6fh_reserved; /* reserved field */ uint16_t ip6fh_offlg; /* offset, reserved, and flag */ uint32_t ip6fh_ident; /* identification */ } __attribute__((__packed__)) IPV6FragHdr; #define IPV6_EXTHDR_GET_FH_NH(p) (p)->ip6eh.fh_nh #define IPV6_EXTHDR_GET_FH_OFFSET(p) (p)->ip6eh.fh_offset #define IPV6_EXTHDR_GET_FH_FLAG(p) (p)->ip6eh.fh_more_frags_set #define IPV6_EXTHDR_GET_FH_ID(p) (p)->ip6eh.fh_id /* rfc 1826 */ typedef struct IPV6AuthHdr_ { uint8_t ip6ah_nxt; /* next header */ uint8_t ip6ah_len; /* header length in units of 8 bytes, not including first 8 bytes. */ uint16_t ip6ah_reserved; /* reserved for future use */ uint32_t ip6ah_spi; /* SECURITY PARAMETERS INDEX (SPI) */ uint32_t ip6ah_seq; /* sequence number */ } __attribute__((__packed__)) IPV6AuthHdr; typedef struct IPV6EspHdr_ { uint32_t ip6esph_spi; /* SECURITY PARAMETERS INDEX (SPI) */ uint32_t ip6esph_seq; /* sequence number */ } __attribute__((__packed__)) IPV6EspHdr; typedef struct IPV6RouteHdr_ { uint8_t ip6rh_nxt; /* next header */ uint8_t ip6rh_len; /* header length in units of 8 bytes, not including first 8 bytes. */ uint8_t ip6rh_type; /* routing type */ uint8_t ip6rh_segsleft; /* segments left */ } __attribute__((__packed__)) IPV6RouteHdr; /* Hop-by-Hop header and Destination Options header use options that are * defined here. */ #define IPV6OPT_PAD1 0x00 #define IPV6OPT_PADN 0x01 #define IPV6OPT_RA 0x05 #define IPV6OPT_JUMBO 0xC2 #define IPV6OPT_HAO 0xC9 /* Home Address Option */ typedef struct IPV6OptHAO_ { uint8_t ip6hao_type; /* Option type */ uint8_t ip6hao_len; /* Option Data len (excludes type and len) */ struct in6_addr ip6hao_hoa; /* Home address. */ } IPV6OptHAO; /* Router Alert Option */ typedef struct IPV6OptRA_ { uint8_t ip6ra_type; /* Option type */ uint8_t ip6ra_len; /* Option Data len (excludes type and len) */ uint16_t ip6ra_value; /* Router Alert value */ } IPV6OptRA; /* Jumbo Option */ typedef struct IPV6OptJumbo_ { uint8_t ip6j_type; /* Option type */ uint8_t ip6j_len; /* Option Data len (excludes type and len) */ uint32_t ip6j_payload_len; /* Jumbo Payload Length */ } IPV6OptJumbo; typedef struct IPV6HopOptsHdr_ { uint8_t ip6hh_nxt; /* next header */ uint8_t ip6hh_len; /* header length in units of 8 bytes, not including first 8 bytes. */ } __attribute__((__packed__)) IPV6HopOptsHdr; typedef struct IPV6DstOptsHdr_ { uint8_t ip6dh_nxt; /* next header */ uint8_t ip6dh_len; /* header length in units of 8 bytes, not including first 8 bytes. */ } __attribute__((__packed__)) IPV6DstOptsHdr; typedef struct IPV6GenOptHdr_ { uint8_t type; uint8_t next; uint8_t len; uint8_t *data; } IPV6GenOptHdr; typedef struct IPV6ExtHdrs_ { _Bool rh_set; uint8_t rh_type; _Bool fh_set; _Bool fh_more_frags_set; uint8_t fh_nh; uint8_t fh_prev_nh; uint16_t fh_prev_hdr_offset; uint16_t fh_header_offset; uint16_t fh_data_offset; uint16_t fh_data_len; /* In fh_offset we store the offset of this extension into the packet past * the ipv6 header. We use it in defrag for creating a defragmented packet * without the frag header */ uint16_t fh_offset; uint32_t fh_id; } IPV6ExtHdrs; #define IPV6_EXTHDR_SET_FH(p) (p)->ip6eh.fh_set = TRUE #define IPV6_EXTHDR_ISSET_FH(p) (p)->ip6eh.fh_set #define IPV6_EXTHDR_SET_RH(p) (p)->ip6eh.rh_set = TRUE #define IPV6_EXTHDR_ISSET_RH(p) (p)->ip6eh.rh_set void DecodeIPV6RegisterTests(void); #endif /* __DECODE_IPV6_H__ */ suricata-3.2.1/src/defrag.c0000644000000000000000000020556313051004444012410 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited, Jason Ish * * Defragmentation module. * References: * - RFC 815 * - OpenBSD PF's IP normalizaton (pf_norm.c) * * \todo pool for frag packet storage * \todo policy bsd-right * \todo profile hash function * \todo log anomalies */ #include "suricata-common.h" #include "queue.h" #include "suricata.h" #include "threads.h" #include "conf.h" #include "decode-ipv6.h" #include "util-hashlist.h" #include "util-pool.h" #include "util-time.h" #include "util-print.h" #include "util-debug.h" #include "util-fix_checksum.h" #include "util-random.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "util-host-os-info.h" #include "defrag.h" #include "defrag-hash.h" #include "defrag-queue.h" #include "defrag-config.h" #include "tmqh-packetpool.h" #include "decode.h" #ifdef UNITTESTS #include "util-unittest.h" #endif #define DEFAULT_DEFRAG_HASH_SIZE 0xffff #define DEFAULT_DEFRAG_POOL_SIZE 0xffff /** * Default timeout (in seconds) before a defragmentation tracker will * be released. */ #define TIMEOUT_DEFAULT 60 /** * Maximum allowed timeout, 24 hours. */ #define TIMEOUT_MAX (60 * 60 * 24) /** * Minimum allowed timeout, 1 second. */ #define TIMEOUT_MIN 1 /** Fragment reassembly policies. */ enum defrag_policies { DEFRAG_POLICY_FIRST = 1, DEFRAG_POLICY_LAST, DEFRAG_POLICY_BSD, DEFRAG_POLICY_BSD_RIGHT, DEFRAG_POLICY_LINUX, DEFRAG_POLICY_WINDOWS, DEFRAG_POLICY_SOLARIS, DEFRAG_POLICY_DEFAULT = DEFRAG_POLICY_BSD, }; static int default_policy = DEFRAG_POLICY_BSD; /** The global DefragContext so all threads operate from the same * context. */ static DefragContext *defrag_context; /** * Utility/debugging function to dump the frags associated with a * tracker. Only enable when unit tests are enabled. */ #if 0 #ifdef UNITTESTS static void DumpFrags(DefragTracker *tracker) { Frag *frag; printf("Dumping frags for packet: ID=%d\n", tracker->id); TAILQ_FOREACH(frag, &tracker->frags, next) { printf("-> Frag: frag_offset=%d, frag_len=%d, data_len=%d, ltrim=%d, skip=%d\n", frag->offset, frag->len, frag->data_len, frag->ltrim, frag->skip); PrintRawDataFp(stdout, frag->pkt, frag->len); } } #endif /* UNITTESTS */ #endif /** * \brief Reset a frag for reuse in a pool. */ static void DefragFragReset(Frag *frag) { if (frag->pkt != NULL) SCFree(frag->pkt); memset(frag, 0, sizeof(*frag)); } /** * \brief Allocate a new frag for use in a pool. */ static int DefragFragInit(void *data, void *initdata) { Frag *frag = data; memset(frag, 0, sizeof(*frag)); return 1; } /** * \brief Free all frags associated with a tracker. */ void DefragTrackerFreeFrags(DefragTracker *tracker) { Frag *frag; /* Lock the frag pool as we'll be return items to it. */ SCMutexLock(&defrag_context->frag_pool_lock); while ((frag = TAILQ_FIRST(&tracker->frags)) != NULL) { TAILQ_REMOVE(&tracker->frags, frag, next); /* Don't SCFree the frag, just give it back to its pool. */ DefragFragReset(frag); PoolReturn(defrag_context->frag_pool, frag); } SCMutexUnlock(&defrag_context->frag_pool_lock); } /** * \brief Create a new DefragContext. * * \retval On success a return an initialized DefragContext, otherwise * NULL will be returned. */ static DefragContext * DefragContextNew(void) { DefragContext *dc; dc = SCCalloc(1, sizeof(*dc)); if (unlikely(dc == NULL)) return NULL; /* Initialize the pool of trackers. */ intmax_t tracker_pool_size; if (!ConfGetInt("defrag.trackers", &tracker_pool_size) || tracker_pool_size == 0) { tracker_pool_size = DEFAULT_DEFRAG_HASH_SIZE; } /* Initialize the pool of frags. */ intmax_t frag_pool_size; if (!ConfGetInt("defrag.max-frags", &frag_pool_size) || frag_pool_size == 0) { frag_pool_size = DEFAULT_DEFRAG_POOL_SIZE; } intmax_t frag_pool_prealloc = frag_pool_size / 2; dc->frag_pool = PoolInit(frag_pool_size, frag_pool_prealloc, sizeof(Frag), NULL, DefragFragInit, dc, NULL, NULL); if (dc->frag_pool == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Defrag: Failed to initialize fragment pool."); exit(EXIT_FAILURE); } if (SCMutexInit(&dc->frag_pool_lock, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Defrag: Failed to initialize frag pool mutex."); exit(EXIT_FAILURE); } /* Set the default timeout. */ intmax_t timeout; if (!ConfGetInt("defrag.timeout", &timeout)) { dc->timeout = TIMEOUT_DEFAULT; } else { if (timeout < TIMEOUT_MIN) { SCLogError(SC_ERR_INVALID_ARGUMENT, "defrag: Timeout less than minimum allowed value."); exit(EXIT_FAILURE); } else if (timeout > TIMEOUT_MAX) { SCLogError(SC_ERR_INVALID_ARGUMENT, "defrag: Tiemout greater than maximum allowed value."); exit(EXIT_FAILURE); } dc->timeout = timeout; } SCLogDebug("Defrag Initialized:"); SCLogDebug("\tTimeout: %"PRIuMAX, (uintmax_t)dc->timeout); SCLogDebug("\tMaximum defrag trackers: %"PRIuMAX, tracker_pool_size); SCLogDebug("\tPreallocated defrag trackers: %"PRIuMAX, tracker_pool_size); SCLogDebug("\tMaximum fragments: %"PRIuMAX, (uintmax_t)frag_pool_size); SCLogDebug("\tPreallocated fragments: %"PRIuMAX, (uintmax_t)frag_pool_prealloc); return dc; } static void DefragContextDestroy(DefragContext *dc) { if (dc == NULL) return; PoolFree(dc->frag_pool); SCFree(dc); } /** * Attempt to re-assemble a packet. * * \param tracker The defragmentation tracker to reassemble from. */ static Packet * Defrag4Reassemble(ThreadVars *tv, DefragTracker *tracker, Packet *p) { Packet *rp = NULL; /* Should not be here unless we have seen the last fragment. */ if (!tracker->seen_last) return NULL; /* Check that we have all the data. Relies on the fact that * fragments are inserted if frag_offset order. */ Frag *frag; int len = 0; TAILQ_FOREACH(frag, &tracker->frags, next) { if (frag->skip) continue; if (frag == TAILQ_FIRST(&tracker->frags)) { if (frag->offset != 0) { goto done; } len = frag->data_len; } else { if (frag->offset > len) { /* This fragment starts after the end of the previous * fragment. We have a hole. */ goto done; } else { len += frag->data_len; } } } /* Allocate a Packet for the reassembled packet. On failure we * SCFree all the resources held by this tracker. */ rp = PacketDefragPktSetup(p, NULL, 0, IPV4_GET_IPPROTO(p)); if (rp == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate packet for " "fragmentation re-assembly, dumping fragments."); goto error_remove_tracker; } PKT_SET_SRC(rp, PKT_SRC_DEFRAG); rp->flags |= PKT_REBUILT_FRAGMENT; rp->recursion_level = p->recursion_level; int fragmentable_offset = 0; int fragmentable_len = 0; int hlen = 0; int ip_hdr_offset = 0; TAILQ_FOREACH(frag, &tracker->frags, next) { SCLogDebug("frag %p, data_len %u, offset %u, pcap_cnt %"PRIu64, frag, frag->data_len, frag->offset, frag->pcap_cnt); if (frag->skip) continue; if (frag->data_len - frag->ltrim <= 0) continue; if (frag->offset == 0) { if (PacketCopyData(rp, frag->pkt, frag->len) == -1) goto error_remove_tracker; hlen = frag->hlen; ip_hdr_offset = frag->ip_hdr_offset; /* This is the start of the fragmentable portion of the * first packet. All fragment offsets are relative to * this. */ fragmentable_offset = frag->ip_hdr_offset + frag->hlen; fragmentable_len = frag->data_len; } else { int pkt_end = fragmentable_offset + frag->offset + frag->data_len; if (pkt_end > (int)MAX_PAYLOAD_SIZE) { SCLogWarning(SC_ERR_REASSEMBLY, "Failed re-assemble " "fragmented packet, exceeds size of packet buffer."); goto error_remove_tracker; } if (PacketCopyDataOffset(rp, fragmentable_offset + frag->offset + frag->ltrim, frag->pkt + frag->data_offset + frag->ltrim, frag->data_len - frag->ltrim) == -1) { goto error_remove_tracker; } if (frag->offset + frag->data_len > fragmentable_len) fragmentable_len = frag->offset + frag->data_len; } if (!frag->more_frags) { break; } } SCLogDebug("ip_hdr_offset %u, hlen %u, fragmentable_len %u", ip_hdr_offset, hlen, fragmentable_len); rp->ip4h = (IPV4Hdr *)(GET_PKT_DATA(rp) + ip_hdr_offset); int old = rp->ip4h->ip_len + rp->ip4h->ip_off; rp->ip4h->ip_len = htons(fragmentable_len + hlen); rp->ip4h->ip_off = 0; rp->ip4h->ip_csum = FixChecksum(rp->ip4h->ip_csum, old, rp->ip4h->ip_len + rp->ip4h->ip_off); SET_PKT_LEN(rp, ip_hdr_offset + hlen + fragmentable_len); tracker->remove = 1; DefragTrackerFreeFrags(tracker); done: return rp; error_remove_tracker: tracker->remove = 1; DefragTrackerFreeFrags(tracker); if (rp != NULL) PacketFreeOrRelease(rp); return NULL; } /** * Attempt to re-assemble a packet. * * \param tracker The defragmentation tracker to reassemble from. */ static Packet * Defrag6Reassemble(ThreadVars *tv, DefragTracker *tracker, Packet *p) { Packet *rp = NULL; /* Should not be here unless we have seen the last fragment. */ if (!tracker->seen_last) return NULL; /* Check that we have all the data. Relies on the fact that * fragments are inserted if frag_offset order. */ Frag *frag; int len = 0; TAILQ_FOREACH(frag, &tracker->frags, next) { if (frag->skip) continue; if (frag == TAILQ_FIRST(&tracker->frags)) { if (frag->offset != 0) { goto done; } len = frag->data_len; } else { if (frag->offset > len) { /* This fragment starts after the end of the previous * fragment. We have a hole. */ goto done; } else { len += frag->data_len; } } } /* Allocate a Packet for the reassembled packet. On failure we * SCFree all the resources held by this tracker. */ rp = PacketDefragPktSetup(p, (uint8_t *)p->ip6h, IPV6_GET_PLEN(p) + sizeof(IPV6Hdr), 0); if (rp == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate packet for " "fragmentation re-assembly, dumping fragments."); goto error_remove_tracker; } PKT_SET_SRC(rp, PKT_SRC_DEFRAG); int unfragmentable_len = 0; int fragmentable_offset = 0; int fragmentable_len = 0; int ip_hdr_offset = 0; uint8_t next_hdr = 0; TAILQ_FOREACH(frag, &tracker->frags, next) { if (frag->skip) continue; if (frag->data_len - frag->ltrim <= 0) continue; if (frag->offset == 0) { IPV6FragHdr *frag_hdr = (IPV6FragHdr *)(frag->pkt + frag->frag_hdr_offset); next_hdr = frag_hdr->ip6fh_nxt; /* This is the first packet, we use this packets link and * IPv6 headers. We also copy in its data, but remove the * fragmentation header. */ if (PacketCopyData(rp, frag->pkt, frag->frag_hdr_offset) == -1) goto error_remove_tracker; if (PacketCopyDataOffset(rp, frag->frag_hdr_offset, frag->pkt + frag->frag_hdr_offset + sizeof(IPV6FragHdr), frag->data_len) == -1) goto error_remove_tracker; ip_hdr_offset = frag->ip_hdr_offset; /* This is the start of the fragmentable portion of the * first packet. All fragment offsets are relative to * this. */ fragmentable_offset = frag->frag_hdr_offset; fragmentable_len = frag->data_len; /* unfragmentable part is the part between the ipv6 header * and the frag header. */ unfragmentable_len = (fragmentable_offset - ip_hdr_offset) - IPV6_HEADER_LEN; if (unfragmentable_len >= fragmentable_offset) goto error_remove_tracker; } else { if (PacketCopyDataOffset(rp, fragmentable_offset + frag->offset + frag->ltrim, frag->pkt + frag->data_offset + frag->ltrim, frag->data_len - frag->ltrim) == -1) goto error_remove_tracker; if (frag->offset + frag->data_len > fragmentable_len) fragmentable_len = frag->offset + frag->data_len; } if (!frag->more_frags) { break; } } rp->ip6h = (IPV6Hdr *)(GET_PKT_DATA(rp) + ip_hdr_offset); rp->ip6h->s_ip6_plen = htons(fragmentable_len + unfragmentable_len); /* if we have no unfragmentable part, so no ext hdrs before the frag * header, we need to update the ipv6 headers next header field. This * points to the frag header, and we will make it point to the layer * directly after the frag header. */ if (unfragmentable_len == 0) rp->ip6h->s_ip6_nxt = next_hdr; SET_PKT_LEN(rp, ip_hdr_offset + sizeof(IPV6Hdr) + unfragmentable_len + fragmentable_len); tracker->remove = 1; DefragTrackerFreeFrags(tracker); done: return rp; error_remove_tracker: tracker->remove = 1; DefragTrackerFreeFrags(tracker); if (rp != NULL) PacketFreeOrRelease(rp); return NULL; } /** * Insert a new IPv4/IPv6 fragment into a tracker. * * \todo Allocate packet buffers from a pool. */ static Packet * DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker, Packet *p, PacketQueue *pq) { Packet *r = NULL; int ltrim = 0; uint8_t more_frags; uint16_t frag_offset; /* IPv4 header length - IPv4 only. */ uint16_t hlen = 0; /* This is the offset of the start of the data in the packet that * falls after the IP header. */ uint16_t data_offset; /* The length of the (fragmented) data. This is the length of the * data that falls after the IP header. */ uint16_t data_len; /* Where the fragment ends. */ uint16_t frag_end; /* Offset in the packet to the IPv6 header. */ uint16_t ip_hdr_offset; /* Offset in the packet to the IPv6 frag header. IPv6 only. */ uint16_t frag_hdr_offset = 0; /* Address family */ int af = tracker->af; /* settings for updating a payload when an ip6 fragment with * unfragmentable exthdrs are encountered. */ int ip6_nh_set_offset = 0; uint8_t ip6_nh_set_value = 0; #ifdef DEBUG uint64_t pcap_cnt = p->pcap_cnt; #endif if (tracker->af == AF_INET) { more_frags = IPV4_GET_MF(p); frag_offset = IPV4_GET_IPOFFSET(p) << 3; hlen = IPV4_GET_HLEN(p); data_offset = (uint8_t *)p->ip4h + hlen - GET_PKT_DATA(p); data_len = IPV4_GET_IPLEN(p) - hlen; frag_end = frag_offset + data_len; ip_hdr_offset = (uint8_t *)p->ip4h - GET_PKT_DATA(p); /* Ignore fragment if the end of packet extends past the * maximum size of a packet. */ if (IPV4_HEADER_LEN + frag_offset + data_len > IPV4_MAXPACKET_LEN) { ENGINE_SET_EVENT(p, IPV4_FRAG_PKT_TOO_LARGE); return NULL; } } else if (tracker->af == AF_INET6) { more_frags = IPV6_EXTHDR_GET_FH_FLAG(p); frag_offset = IPV6_EXTHDR_GET_FH_OFFSET(p); data_offset = p->ip6eh.fh_data_offset; data_len = p->ip6eh.fh_data_len; frag_end = frag_offset + data_len; ip_hdr_offset = (uint8_t *)p->ip6h - GET_PKT_DATA(p); frag_hdr_offset = p->ip6eh.fh_header_offset; SCLogDebug("mf %s frag_offset %u data_offset %u, data_len %u, " "frag_end %u, ip_hdr_offset %u, frag_hdr_offset %u", more_frags ? "true" : "false", frag_offset, data_offset, data_len, frag_end, ip_hdr_offset, frag_hdr_offset); /* handle unfragmentable exthdrs */ if (ip_hdr_offset + IPV6_HEADER_LEN < frag_hdr_offset) { SCLogDebug("we have exthdrs before fraghdr %u bytes", (uint32_t)(frag_hdr_offset - (ip_hdr_offset + IPV6_HEADER_LEN))); /* get the offset of the 'next' field in exthdr before the FH, * relative to the buffer start */ /* store offset and FH 'next' value for updating frag buffer below */ ip6_nh_set_offset = p->ip6eh.fh_prev_hdr_offset; ip6_nh_set_value = IPV6_EXTHDR_GET_FH_NH(p); SCLogDebug("offset %d, value %u", ip6_nh_set_offset, ip6_nh_set_value); } /* Ignore fragment if the end of packet extends past the * maximum size of a packet. */ if (frag_offset + data_len > IPV6_MAXPACKET) { ENGINE_SET_EVENT(p, IPV6_FRAG_PKT_TOO_LARGE); return NULL; } } else { /* Abort - should not happen. */ SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid address family, aborting."); return NULL; } /* Update timeout. */ tracker->timeout.tv_sec = p->ts.tv_sec + tracker->host_timeout; tracker->timeout.tv_usec = p->ts.tv_usec; Frag *prev = NULL, *next; int overlap = 0; if (!TAILQ_EMPTY(&tracker->frags)) { TAILQ_FOREACH(prev, &tracker->frags, next) { ltrim = 0; next = TAILQ_NEXT(prev, next); switch (tracker->policy) { case DEFRAG_POLICY_BSD: if (frag_offset < prev->offset + prev->data_len) { if (frag_offset >= prev->offset) { ltrim = prev->offset + prev->data_len - frag_offset; overlap++; } if ((next != NULL) && (frag_end > next->offset)) { next->ltrim = frag_end - next->offset; overlap++; } if ((frag_offset < prev->offset) && (frag_end >= prev->offset + prev->data_len)) { prev->skip = 1; overlap++; } goto insert; } break; case DEFRAG_POLICY_LINUX: if (frag_offset < prev->offset + prev->data_len) { if (frag_offset > prev->offset) { ltrim = prev->offset + prev->data_len - frag_offset; overlap++; } if ((next != NULL) && (frag_end > next->offset)) { next->ltrim = frag_end - next->offset; overlap++; } if ((frag_offset < prev->offset) && (frag_end >= prev->offset + prev->data_len)) { prev->skip = 1; overlap++; } goto insert; } break; case DEFRAG_POLICY_WINDOWS: if (frag_offset < prev->offset + prev->data_len) { if (frag_offset >= prev->offset) { ltrim = prev->offset + prev->data_len - frag_offset; overlap++; } if ((frag_offset < prev->offset) && (frag_end > prev->offset + prev->data_len)) { prev->skip = 1; overlap++; } goto insert; } break; case DEFRAG_POLICY_SOLARIS: if (frag_offset < prev->offset + prev->data_len) { if (frag_offset >= prev->offset) { ltrim = prev->offset + prev->data_len - frag_offset; overlap++; } if ((frag_offset < prev->offset) && (frag_end >= prev->offset + prev->data_len)) { prev->skip = 1; overlap++; } goto insert; } break; case DEFRAG_POLICY_FIRST: if ((frag_offset >= prev->offset) && (frag_end <= prev->offset + prev->data_len)) { overlap++; goto done; } if (frag_offset < prev->offset) { goto insert; } if (frag_offset < prev->offset + prev->data_len) { ltrim = prev->offset + prev->data_len - frag_offset; overlap++; goto insert; } break; case DEFRAG_POLICY_LAST: if (frag_offset <= prev->offset) { if (frag_end > prev->offset) { prev->ltrim = frag_end - prev->offset; overlap++; } goto insert; } break; default: break; } } } insert: if (data_len - ltrim <= 0) { /* Full packet has been trimmed due to the overlap policy. Overlap * already set. */ goto done; } /* Allocate fragment and insert. */ SCMutexLock(&defrag_context->frag_pool_lock); Frag *new = PoolGet(defrag_context->frag_pool); SCMutexUnlock(&defrag_context->frag_pool_lock); if (new == NULL) { if (af == AF_INET) { ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED); } else { ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED); } goto done; } new->pkt = SCMalloc(GET_PKT_LEN(p)); if (new->pkt == NULL) { SCMutexLock(&defrag_context->frag_pool_lock); PoolReturn(defrag_context->frag_pool, new); SCMutexUnlock(&defrag_context->frag_pool_lock); if (af == AF_INET) { ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED); } else { ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED); } goto done; } memcpy(new->pkt, GET_PKT_DATA(p) + ltrim, GET_PKT_LEN(p) - ltrim); new->len = GET_PKT_LEN(p) - ltrim; /* in case of unfragmentable exthdrs, update the 'next hdr' field * in the raw buffer so the reassembled packet will point to the * correct next header after stripping the frag header */ if (ip6_nh_set_offset > 0 && frag_offset == 0 && ltrim == 0) { if (new->len > ip6_nh_set_offset) { SCLogDebug("updating frag to have 'correct' nh value: %u -> %u", new->pkt[ip6_nh_set_offset], ip6_nh_set_value); new->pkt[ip6_nh_set_offset] = ip6_nh_set_value; } } new->hlen = hlen; new->offset = frag_offset + ltrim; new->data_offset = data_offset; new->data_len = data_len - ltrim; new->ip_hdr_offset = ip_hdr_offset; new->frag_hdr_offset = frag_hdr_offset; new->more_frags = more_frags; #ifdef DEBUG new->pcap_cnt = pcap_cnt; #endif Frag *frag; TAILQ_FOREACH(frag, &tracker->frags, next) { if (new->offset < frag->offset) break; } if (frag == NULL) { TAILQ_INSERT_TAIL(&tracker->frags, new, next); } else { TAILQ_INSERT_BEFORE(frag, new, next); } if (!more_frags) { tracker->seen_last = 1; } if (tracker->seen_last) { if (tracker->af == AF_INET) { r = Defrag4Reassemble(tv, tracker, p); if (r != NULL && tv != NULL && dtv != NULL) { StatsIncr(tv, dtv->counter_defrag_ipv4_reassembled); if (pq && DecodeIPV4(tv, dtv, r, (void *)r->ip4h, IPV4_GET_IPLEN(r), pq) != TM_ECODE_OK) { UNSET_TUNNEL_PKT(r); r->root = NULL; TmqhOutputPacketpool(tv, r); r = NULL; } else { PacketDefragPktSetupParent(p); } } } else if (tracker->af == AF_INET6) { r = Defrag6Reassemble(tv, tracker, p); if (r != NULL && tv != NULL && dtv != NULL) { StatsIncr(tv, dtv->counter_defrag_ipv6_reassembled); if (pq && DecodeIPV6(tv, dtv, r, (uint8_t *)r->ip6h, IPV6_GET_PLEN(r) + IPV6_HEADER_LEN, pq) != TM_ECODE_OK) { UNSET_TUNNEL_PKT(r); r->root = NULL; TmqhOutputPacketpool(tv, r); r = NULL; } else { PacketDefragPktSetupParent(p); } } } } done: if (overlap) { if (af == AF_INET) { ENGINE_SET_EVENT(p, IPV4_FRAG_OVERLAP); } else { ENGINE_SET_EVENT(p, IPV6_FRAG_OVERLAP); } } return r; } /** * \brief Get the defrag policy based on the destination address of * the packet. * * \param p The packet used to get the destination address. * * \retval The defrag policy to use. */ uint8_t DefragGetOsPolicy(Packet *p) { int policy = -1; if (PKT_IS_IPV4(p)) { policy = SCHInfoGetIPv4HostOSFlavour((uint8_t *)GET_IPV4_DST_ADDR_PTR(p)); } else if (PKT_IS_IPV6(p)) { policy = SCHInfoGetIPv6HostOSFlavour((uint8_t *)GET_IPV6_DST_ADDR(p)); } if (policy == -1) { return default_policy; } /* Map the OS policies returned from the configured host info to * defrag specific policies. */ switch (policy) { /* BSD. */ case OS_POLICY_BSD: case OS_POLICY_HPUX10: case OS_POLICY_IRIX: return DEFRAG_POLICY_BSD; /* BSD-Right. */ case OS_POLICY_BSD_RIGHT: return DEFRAG_POLICY_BSD_RIGHT; /* Linux. */ case OS_POLICY_OLD_LINUX: case OS_POLICY_LINUX: return DEFRAG_POLICY_LINUX; /* First. */ case OS_POLICY_OLD_SOLARIS: case OS_POLICY_HPUX11: case OS_POLICY_MACOS: case OS_POLICY_FIRST: return DEFRAG_POLICY_FIRST; /* Solaris. */ case OS_POLICY_SOLARIS: return DEFRAG_POLICY_SOLARIS; /* Windows. */ case OS_POLICY_WINDOWS: case OS_POLICY_VISTA: case OS_POLICY_WINDOWS2K3: return DEFRAG_POLICY_WINDOWS; /* Last. */ case OS_POLICY_LAST: return DEFRAG_POLICY_LAST; default: return default_policy; } } /** \internal * * \retval NULL or a *LOCKED* tracker */ static DefragTracker * DefragGetTracker(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) { return DefragGetTrackerFromHash(p); } /** * \brief Entry point for IPv4 and IPv6 fragments. * * \param tv ThreadVars for the calling decoder. * \param p The packet fragment. * * \retval A new Packet resembling the re-assembled packet if the most * recent fragment allowed the packet to be re-assembled, otherwise * NULL is returned. */ Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, PacketQueue *pq) { uint16_t frag_offset; uint8_t more_frags; DefragTracker *tracker; int af; if (PKT_IS_IPV4(p)) { af = AF_INET; more_frags = IPV4_GET_MF(p); frag_offset = IPV4_GET_IPOFFSET(p); } else if (PKT_IS_IPV6(p)) { af = AF_INET6; frag_offset = IPV6_EXTHDR_GET_FH_OFFSET(p); more_frags = IPV6_EXTHDR_GET_FH_FLAG(p); } else { return NULL; } if (frag_offset == 0 && more_frags == 0) { return NULL; } if (tv != NULL && dtv != NULL) { if (af == AF_INET) { StatsIncr(tv, dtv->counter_defrag_ipv4_fragments); } else if (af == AF_INET6) { StatsIncr(tv, dtv->counter_defrag_ipv6_fragments); } } /* return a locked tracker or NULL */ tracker = DefragGetTracker(tv, dtv, p); if (tracker == NULL) return NULL; Packet *rp = DefragInsertFrag(tv, dtv, tracker, p, pq); DefragTrackerRelease(tracker); return rp; } void DefragInit(void) { intmax_t tracker_pool_size; if (!ConfGetInt("defrag.trackers", &tracker_pool_size)) { tracker_pool_size = DEFAULT_DEFRAG_HASH_SIZE; } /* Load the defrag-per-host lookup. */ DefragPolicyLoadFromConfig(); /* Allocate the DefragContext. */ defrag_context = DefragContextNew(); if (defrag_context == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for the Defrag module."); exit(EXIT_FAILURE); } DefragSetDefaultTimeout(defrag_context->timeout); DefragInitConfig(FALSE); } void DefragDestroy(void) { DefragHashShutdown(); DefragContextDestroy(defrag_context); defrag_context = NULL; DefragTreeDestroy(); } #ifdef UNITTESTS #define IP_MF 0x2000 /** * Allocate a test packet. Nothing to fancy, just a simple IP packet * with some payload of no particular protocol. */ static Packet * BuildTestPacket(uint8_t proto, uint16_t id, uint16_t off, int mf, const char content, int content_len) { Packet *p = NULL; int hlen = 20; int ttl = 64; uint8_t *pcontent; IPV4Hdr ip4h; p = SCCalloc(1, sizeof(*p) + default_packet_size); if (unlikely(p == NULL)) return NULL; PACKET_INITIALIZE(p); gettimeofday(&p->ts, NULL); //p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p); ip4h.ip_verhl = 4 << 4; ip4h.ip_verhl |= hlen >> 2; ip4h.ip_len = htons(hlen + content_len); ip4h.ip_id = htons(id); ip4h.ip_off = htons(off); if (mf) ip4h.ip_off = htons(IP_MF | off); else ip4h.ip_off = htons(off); ip4h.ip_ttl = ttl; ip4h.ip_proto = proto; ip4h.s_ip_src.s_addr = 0x01010101; /* 1.1.1.1 */ ip4h.s_ip_dst.s_addr = 0x02020202; /* 2.2.2.2 */ /* copy content_len crap, we need full length */ PacketCopyData(p, (uint8_t *)&ip4h, sizeof(ip4h)); p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p); SET_IPV4_SRC_ADDR(p, &p->src); SET_IPV4_DST_ADDR(p, &p->dst); pcontent = SCCalloc(1, content_len); if (unlikely(pcontent == NULL)) return NULL; memset(pcontent, content, content_len); PacketCopyDataOffset(p, hlen, pcontent, content_len); SET_PKT_LEN(p, hlen + content_len); SCFree(pcontent); p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)GET_PKT_DATA(p), hlen); /* Self test. */ if (IPV4_GET_VER(p) != 4) goto error; if (IPV4_GET_HLEN(p) != hlen) goto error; if (IPV4_GET_IPLEN(p) != hlen + content_len) goto error; if (IPV4_GET_IPID(p) != id) goto error; if (IPV4_GET_IPOFFSET(p) != off) goto error; if (IPV4_GET_MF(p) != mf) goto error; if (IPV4_GET_IPTTL(p) != ttl) goto error; if (IPV4_GET_IPPROTO(p) != proto) goto error; return p; error: if (p != NULL) SCFree(p); return NULL; } void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen); static Packet * IPV6BuildTestPacket(uint8_t proto, uint32_t id, uint16_t off, int mf, const char content, int content_len) { Packet *p = NULL; uint8_t *pcontent; IPV6Hdr ip6h; p = SCCalloc(1, sizeof(*p) + default_packet_size); if (unlikely(p == NULL)) return NULL; PACKET_INITIALIZE(p); gettimeofday(&p->ts, NULL); ip6h.s_ip6_nxt = 44; ip6h.s_ip6_hlim = 2; /* Source and dest address - very bogus addresses. */ ip6h.s_ip6_src[0] = 0x01010101; ip6h.s_ip6_src[1] = 0x01010101; ip6h.s_ip6_src[2] = 0x01010101; ip6h.s_ip6_src[3] = 0x01010101; ip6h.s_ip6_dst[0] = 0x02020202; ip6h.s_ip6_dst[1] = 0x02020202; ip6h.s_ip6_dst[2] = 0x02020202; ip6h.s_ip6_dst[3] = 0x02020202; /* copy content_len crap, we need full length */ PacketCopyData(p, (uint8_t *)&ip6h, sizeof(IPV6Hdr)); p->ip6h = (IPV6Hdr *)GET_PKT_DATA(p); IPV6_SET_RAW_VER(p->ip6h, 6); /* Fragmentation header. */ IPV6FragHdr *fh = (IPV6FragHdr *)(GET_PKT_DATA(p) + sizeof(IPV6Hdr)); fh->ip6fh_nxt = proto; fh->ip6fh_ident = htonl(id); fh->ip6fh_offlg = htons((off << 3) | mf); DecodeIPV6FragHeader(p, (uint8_t *)fh, 8, 8 + content_len, 0); pcontent = SCCalloc(1, content_len); if (unlikely(pcontent == NULL)) return NULL; memset(pcontent, content, content_len); PacketCopyDataOffset(p, sizeof(IPV6Hdr) + sizeof(IPV6FragHdr), pcontent, content_len); SET_PKT_LEN(p, sizeof(IPV6Hdr) + sizeof(IPV6FragHdr) + content_len); SCFree(pcontent); p->ip6h->s_ip6_plen = htons(sizeof(IPV6FragHdr) + content_len); SET_IPV6_SRC_ADDR(p, &p->src); SET_IPV6_DST_ADDR(p, &p->dst); /* Self test. */ if (IPV6_GET_VER(p) != 6) goto error; if (IPV6_GET_NH(p) != 44) goto error; if (IPV6_GET_PLEN(p) != sizeof(IPV6FragHdr) + content_len) goto error; return p; error: fprintf(stderr, "Error building test packet.\n"); if (p != NULL) SCFree(p); return NULL; } /** * Test the simplest possible re-assembly scenario. All packet in * order and no overlaps. */ static int DefragInOrderSimpleTest(void) { Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Packet *reassembled = NULL; int id = 12; int i; int ret = 0; DefragInit(); p1 = BuildTestPacket(IPPROTO_ICMP, id, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = BuildTestPacket(IPPROTO_ICMP, id, 1, 1, 'B', 8); if (p2 == NULL) goto end; p3 = BuildTestPacket(IPPROTO_ICMP, id, 2, 0, 'C', 3); if (p3 == NULL) goto end; if (Defrag(NULL, NULL, p1, NULL) != NULL) goto end; if (Defrag(NULL, NULL, p2, NULL) != NULL) goto end; reassembled = Defrag(NULL, NULL, p3, NULL); if (reassembled == NULL) { goto end; } if (IPV4_GET_HLEN(reassembled) != 20) { goto end; } if (IPV4_GET_IPLEN(reassembled) != 39) { goto end; } /* 20 bytes in we should find 8 bytes of A. */ for (i = 20; i < 20 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'A') { goto end; } } /* 28 bytes in we should find 8 bytes of B. */ for (i = 28; i < 28 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'B') { goto end; } } /* And 36 bytes in we should find 3 bytes of C. */ for (i = 36; i < 36 + 3; i++) { if (GET_PKT_DATA(reassembled)[i] != 'C') goto end; } ret = 1; end: if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); if (p3 != NULL) SCFree(p3); if (reassembled != NULL) SCFree(reassembled); DefragDestroy(); return ret; } /** * Simple fragmented packet in reverse order. */ static int DefragReverseSimpleTest(void) { Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Packet *reassembled = NULL; int id = 12; int i; int ret = 0; DefragInit(); p1 = BuildTestPacket(IPPROTO_ICMP, id, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = BuildTestPacket(IPPROTO_ICMP, id, 1, 1, 'B', 8); if (p2 == NULL) goto end; p3 = BuildTestPacket(IPPROTO_ICMP, id, 2, 0, 'C', 3); if (p3 == NULL) goto end; if (Defrag(NULL, NULL, p3, NULL) != NULL) goto end; if (Defrag(NULL, NULL, p2, NULL) != NULL) goto end; reassembled = Defrag(NULL, NULL, p1, NULL); if (reassembled == NULL) goto end; if (IPV4_GET_HLEN(reassembled) != 20) goto end; if (IPV4_GET_IPLEN(reassembled) != 39) goto end; /* 20 bytes in we should find 8 bytes of A. */ for (i = 20; i < 20 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'A') goto end; } /* 28 bytes in we should find 8 bytes of B. */ for (i = 28; i < 28 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'B') goto end; } /* And 36 bytes in we should find 3 bytes of C. */ for (i = 36; i < 36 + 3; i++) { if (GET_PKT_DATA(reassembled)[i] != 'C') goto end; } ret = 1; end: if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); if (p3 != NULL) SCFree(p3); if (reassembled != NULL) SCFree(reassembled); DefragDestroy(); return ret; } /** * Test the simplest possible re-assembly scenario. All packet in * order and no overlaps. */ static int IPV6DefragInOrderSimpleTest(void) { Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Packet *reassembled = NULL; int id = 12; int i; int ret = 0; DefragInit(); p1 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 1, 1, 'B', 8); if (p2 == NULL) goto end; p3 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 2, 0, 'C', 3); if (p3 == NULL) goto end; if (Defrag(NULL, NULL, p1, NULL) != NULL) goto end; if (Defrag(NULL, NULL, p2, NULL) != NULL) goto end; reassembled = Defrag(NULL, NULL, p3, NULL); if (reassembled == NULL) goto end; if (IPV6_GET_PLEN(reassembled) != 19) goto end; /* 40 bytes in we should find 8 bytes of A. */ for (i = 40; i < 40 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'A') goto end; } /* 28 bytes in we should find 8 bytes of B. */ for (i = 48; i < 48 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'B') goto end; } /* And 36 bytes in we should find 3 bytes of C. */ for (i = 56; i < 56 + 3; i++) { if (GET_PKT_DATA(reassembled)[i] != 'C') goto end; } ret = 1; end: if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); if (p3 != NULL) SCFree(p3); if (reassembled != NULL) SCFree(reassembled); DefragDestroy(); return ret; } static int IPV6DefragReverseSimpleTest(void) { DefragContext *dc = NULL; Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Packet *reassembled = NULL; int id = 12; int i; int ret = 0; DefragInit(); dc = DefragContextNew(); if (dc == NULL) goto end; p1 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 1, 1, 'B', 8); if (p2 == NULL) goto end; p3 = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 2, 0, 'C', 3); if (p3 == NULL) goto end; if (Defrag(NULL, NULL, p3, NULL) != NULL) goto end; if (Defrag(NULL, NULL, p2, NULL) != NULL) goto end; reassembled = Defrag(NULL, NULL, p1, NULL); if (reassembled == NULL) goto end; /* 40 bytes in we should find 8 bytes of A. */ for (i = 40; i < 40 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'A') goto end; } /* 28 bytes in we should find 8 bytes of B. */ for (i = 48; i < 48 + 8; i++) { if (GET_PKT_DATA(reassembled)[i] != 'B') goto end; } /* And 36 bytes in we should find 3 bytes of C. */ for (i = 56; i < 56 + 3; i++) { if (GET_PKT_DATA(reassembled)[i] != 'C') goto end; } ret = 1; end: if (dc != NULL) DefragContextDestroy(dc); if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); if (p3 != NULL) SCFree(p3); if (reassembled != NULL) SCFree(reassembled); DefragDestroy(); return ret; } static int DefragDoSturgesNovakTest(int policy, u_char *expected, size_t expected_len) { int i; int ret = 0; DefragInit(); /* * Build the packets. */ int id = 1; Packet *packets[17]; memset(packets, 0x00, sizeof(packets)); /* * Original fragments. */ /* A*24 at 0. */ packets[0] = BuildTestPacket(IPPROTO_ICMP, id, 0, 1, 'A', 24); /* B*15 at 32. */ packets[1] = BuildTestPacket(IPPROTO_ICMP, id, 32 >> 3, 1, 'B', 16); /* C*24 at 48. */ packets[2] = BuildTestPacket(IPPROTO_ICMP, id, 48 >> 3, 1, 'C', 24); /* D*8 at 80. */ packets[3] = BuildTestPacket(IPPROTO_ICMP, id, 80 >> 3, 1, 'D', 8); /* E*16 at 104. */ packets[4] = BuildTestPacket(IPPROTO_ICMP, id, 104 >> 3, 1, 'E', 16); /* F*24 at 120. */ packets[5] = BuildTestPacket(IPPROTO_ICMP, id, 120 >> 3, 1, 'F', 24); /* G*16 at 144. */ packets[6] = BuildTestPacket(IPPROTO_ICMP, id, 144 >> 3, 1, 'G', 16); /* H*16 at 160. */ packets[7] = BuildTestPacket(IPPROTO_ICMP, id, 160 >> 3, 1, 'H', 16); /* I*8 at 176. */ packets[8] = BuildTestPacket(IPPROTO_ICMP, id, 176 >> 3, 1, 'I', 8); /* * Overlapping subsequent fragments. */ /* J*32 at 8. */ packets[9] = BuildTestPacket(IPPROTO_ICMP, id, 8 >> 3, 1, 'J', 32); /* K*24 at 48. */ packets[10] = BuildTestPacket(IPPROTO_ICMP, id, 48 >> 3, 1, 'K', 24); /* L*24 at 72. */ packets[11] = BuildTestPacket(IPPROTO_ICMP, id, 72 >> 3, 1, 'L', 24); /* M*24 at 96. */ packets[12] = BuildTestPacket(IPPROTO_ICMP, id, 96 >> 3, 1, 'M', 24); /* N*8 at 128. */ packets[13] = BuildTestPacket(IPPROTO_ICMP, id, 128 >> 3, 1, 'N', 8); /* O*8 at 152. */ packets[14] = BuildTestPacket(IPPROTO_ICMP, id, 152 >> 3, 1, 'O', 8); /* P*8 at 160. */ packets[15] = BuildTestPacket(IPPROTO_ICMP, id, 160 >> 3, 1, 'P', 8); /* Q*16 at 176. */ packets[16] = BuildTestPacket(IPPROTO_ICMP, id, 176 >> 3, 0, 'Q', 16); default_policy = policy; /* Send all but the last. */ for (i = 0; i < 9; i++) { Packet *tp = Defrag(NULL, NULL, packets[i], NULL); if (tp != NULL) { SCFree(tp); goto end; } if (ENGINE_ISSET_EVENT(packets[i], IPV4_FRAG_OVERLAP)) { goto end; } } int overlap = 0; for (; i < 16; i++) { Packet *tp = Defrag(NULL, NULL, packets[i], NULL); if (tp != NULL) { SCFree(tp); goto end; } if (ENGINE_ISSET_EVENT(packets[i], IPV4_FRAG_OVERLAP)) { overlap++; } } if (!overlap) { goto end; } /* And now the last one. */ Packet *reassembled = Defrag(NULL, NULL, packets[16], NULL); if (reassembled == NULL) { goto end; } if (IPV4_GET_HLEN(reassembled) != 20) { goto end; } if (IPV4_GET_IPLEN(reassembled) != 20 + 192) { goto end; } if (memcmp(GET_PKT_DATA(reassembled) + 20, expected, expected_len) != 0) { goto end; } SCFree(reassembled); /* Make sure all frags were returned back to the pool. */ if (defrag_context->frag_pool->outstanding != 0) { goto end; } ret = 1; end: for (i = 0; i < 17; i++) { SCFree(packets[i]); } DefragDestroy(); return ret; } static int IPV6DefragDoSturgesNovakTest(int policy, u_char *expected, size_t expected_len) { int i; int ret = 0; DefragInit(); /* * Build the packets. */ int id = 1; Packet *packets[17]; memset(packets, 0x00, sizeof(packets)); /* * Original fragments. */ /* A*24 at 0. */ packets[0] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 0, 1, 'A', 24); /* B*15 at 32. */ packets[1] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 32 >> 3, 1, 'B', 16); /* C*24 at 48. */ packets[2] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 48 >> 3, 1, 'C', 24); /* D*8 at 80. */ packets[3] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 80 >> 3, 1, 'D', 8); /* E*16 at 104. */ packets[4] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 104 >> 3, 1, 'E', 16); /* F*24 at 120. */ packets[5] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 120 >> 3, 1, 'F', 24); /* G*16 at 144. */ packets[6] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 144 >> 3, 1, 'G', 16); /* H*16 at 160. */ packets[7] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 160 >> 3, 1, 'H', 16); /* I*8 at 176. */ packets[8] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 176 >> 3, 1, 'I', 8); /* * Overlapping subsequent fragments. */ /* J*32 at 8. */ packets[9] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 8 >> 3, 1, 'J', 32); /* K*24 at 48. */ packets[10] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 48 >> 3, 1, 'K', 24); /* L*24 at 72. */ packets[11] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 72 >> 3, 1, 'L', 24); /* M*24 at 96. */ packets[12] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 96 >> 3, 1, 'M', 24); /* N*8 at 128. */ packets[13] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 128 >> 3, 1, 'N', 8); /* O*8 at 152. */ packets[14] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 152 >> 3, 1, 'O', 8); /* P*8 at 160. */ packets[15] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 160 >> 3, 1, 'P', 8); /* Q*16 at 176. */ packets[16] = IPV6BuildTestPacket(IPPROTO_ICMPV6, id, 176 >> 3, 0, 'Q', 16); default_policy = policy; /* Send all but the last. */ for (i = 0; i < 9; i++) { Packet *tp = Defrag(NULL, NULL, packets[i], NULL); if (tp != NULL) { SCFree(tp); goto end; } if (ENGINE_ISSET_EVENT(packets[i], IPV6_FRAG_OVERLAP)) { goto end; } } int overlap = 0; for (; i < 16; i++) { Packet *tp = Defrag(NULL, NULL, packets[i], NULL); if (tp != NULL) { SCFree(tp); goto end; } if (ENGINE_ISSET_EVENT(packets[i], IPV6_FRAG_OVERLAP)) { overlap++; } } if (!overlap) goto end; /* And now the last one. */ Packet *reassembled = Defrag(NULL, NULL, packets[16], NULL); if (reassembled == NULL) goto end; if (memcmp(GET_PKT_DATA(reassembled) + 40, expected, expected_len) != 0) goto end; if (IPV6_GET_PLEN(reassembled) != 192) goto end; SCFree(reassembled); /* Make sure all frags were returned to the pool. */ if (defrag_context->frag_pool->outstanding != 0) { printf("defrag_context->frag_pool->outstanding %u: ", defrag_context->frag_pool->outstanding); goto end; } ret = 1; end: for (i = 0; i < 17; i++) { SCFree(packets[i]); } DefragDestroy(); return ret; } static int DefragSturgesNovakBsdTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_BSD, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakBsdTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_BSD, expected, sizeof(expected)); } static int DefragSturgesNovakLinuxTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "KKKKKKKK" "KKKKKKKK" "KKKKKKKK" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "PPPPPPPP" "HHHHHHHH" "QQQQQQQQ" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_LINUX, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakLinuxTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "KKKKKKKK" "KKKKKKKK" "KKKKKKKK" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "PPPPPPPP" "HHHHHHHH" "QQQQQQQQ" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_LINUX, expected, sizeof(expected)); } static int DefragSturgesNovakWindowsTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "EEEEEEEE" "EEEEEEEE" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_WINDOWS, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakWindowsTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "EEEEEEEE" "EEEEEEEE" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_WINDOWS, expected, sizeof(expected)); } static int DefragSturgesNovakSolarisTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_SOLARIS, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakSolarisTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_SOLARIS, expected, sizeof(expected)); } static int DefragSturgesNovakFirstTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "DDDDDDDD" "LLLLLLLL" "MMMMMMMM" "EEEEEEEE" "EEEEEEEE" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_FIRST, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakFirstTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "AAAAAAAA" "AAAAAAAA" "JJJJJJJJ" "BBBBBBBB" "BBBBBBBB" "CCCCCCCC" "CCCCCCCC" "CCCCCCCC" "LLLLLLLL" "DDDDDDDD" "LLLLLLLL" "MMMMMMMM" "EEEEEEEE" "EEEEEEEE" "FFFFFFFF" "FFFFFFFF" "FFFFFFFF" "GGGGGGGG" "GGGGGGGG" "HHHHHHHH" "HHHHHHHH" "IIIIIIII" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_FIRST, expected, sizeof(expected)); } static int DefragSturgesNovakLastTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "KKKKKKKK" "KKKKKKKK" "KKKKKKKK" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "NNNNNNNN" "FFFFFFFF" "GGGGGGGG" "OOOOOOOO" "PPPPPPPP" "HHHHHHHH" "QQQQQQQQ" "QQQQQQQQ" }; return DefragDoSturgesNovakTest(DEFRAG_POLICY_LAST, expected, sizeof(expected)); } static int IPV6DefragSturgesNovakLastTest(void) { /* Expected data. */ u_char expected[] = { "AAAAAAAA" "JJJJJJJJ" "JJJJJJJJ" "JJJJJJJJ" "JJJJJJJJ" "BBBBBBBB" "KKKKKKKK" "KKKKKKKK" "KKKKKKKK" "LLLLLLLL" "LLLLLLLL" "LLLLLLLL" "MMMMMMMM" "MMMMMMMM" "MMMMMMMM" "FFFFFFFF" "NNNNNNNN" "FFFFFFFF" "GGGGGGGG" "OOOOOOOO" "PPPPPPPP" "HHHHHHHH" "QQQQQQQQ" "QQQQQQQQ" }; return IPV6DefragDoSturgesNovakTest(DEFRAG_POLICY_LAST, expected, sizeof(expected)); } static int DefragTimeoutTest(void) { int i; int ret = 0; /* Setup a small numberr of trackers. */ if (ConfSet("defrag.trackers", "16") != 1) { printf("ConfSet failed: "); goto end; } DefragInit(); /* Load in 16 packets. */ for (i = 0; i < 16; i++) { Packet *p = BuildTestPacket(IPPROTO_ICMP,i, 0, 1, 'A' + i, 16); if (p == NULL) goto end; Packet *tp = Defrag(NULL, NULL, p, NULL); SCFree(p); if (tp != NULL) { SCFree(tp); goto end; } } /* Build a new packet but push the timestamp out by our timeout. * This should force our previous fragments to be timed out. */ Packet *p = BuildTestPacket(IPPROTO_ICMP, 99, 0, 1, 'A' + i, 16); if (p == NULL) goto end; p->ts.tv_sec += (defrag_context->timeout + 1); Packet *tp = Defrag(NULL, NULL, p, NULL); if (tp != NULL) { SCFree(tp); goto end; } DefragTracker *tracker = DefragLookupTrackerFromHash(p); if (tracker == NULL) goto end; if (tracker->id != 99) goto end; SCFree(p); ret = 1; end: DefragDestroy(); return ret; } /** * QA found that if you send a packet where more frags is 0, offset is * > 0 and there is no data in the packet that the re-assembler will * fail. The fix was simple, but this unit test is just to make sure * its not introduced. */ static int DefragIPv4NoDataTest(void) { DefragContext *dc = NULL; Packet *p = NULL; int id = 12; int ret = 0; DefragInit(); dc = DefragContextNew(); if (dc == NULL) goto end; /* This packet has an offset > 0, more frags set to 0 and no data. */ p = BuildTestPacket(IPPROTO_ICMP, id, 1, 0, 'A', 0); if (p == NULL) goto end; /* We do not expect a packet returned. */ if (Defrag(NULL, NULL, p, NULL) != NULL) goto end; /* The fragment should have been ignored so no fragments should * have been allocated from the pool. */ if (dc->frag_pool->outstanding != 0) return 0; ret = 1; end: if (dc != NULL) DefragContextDestroy(dc); if (p != NULL) SCFree(p); DefragDestroy(); return ret; } static int DefragIPv4TooLargeTest(void) { DefragContext *dc = NULL; Packet *p = NULL; int ret = 0; DefragInit(); dc = DefragContextNew(); if (dc == NULL) goto end; /* Create a fragment that would extend past the max allowable size * for an IPv4 packet. */ p = BuildTestPacket(IPPROTO_ICMP, 1, 8183, 0, 'A', 71); if (p == NULL) goto end; /* We do not expect a packet returned. */ if (Defrag(NULL, NULL, p, NULL) != NULL) goto end; if (!ENGINE_ISSET_EVENT(p, IPV4_FRAG_PKT_TOO_LARGE)) goto end; /* The fragment should have been ignored so no fragments should have * been allocated from the pool. */ if (dc->frag_pool->outstanding != 0) return 0; ret = 1; end: if (dc != NULL) DefragContextDestroy(dc); if (p != NULL) SCFree(p); DefragDestroy(); return ret; } /** * Test that fragments in different VLANs that would otherwise be * re-assembled, are not re-assembled. Just use simple in-order * fragments. */ static int DefragVlanTest(void) { Packet *p1 = NULL, *p2 = NULL, *r = NULL; int ret = 0; DefragInit(); p1 = BuildTestPacket(IPPROTO_ICMP, 1, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = BuildTestPacket(IPPROTO_ICMP, 1, 1, 0, 'B', 8); if (p2 == NULL) goto end; /* With no VLAN IDs set, packets should re-assemble. */ if ((r = Defrag(NULL, NULL, p1, NULL)) != NULL) goto end; if ((r = Defrag(NULL, NULL, p2, NULL)) == NULL) goto end; SCFree(r); /* With mismatched VLANs, packets should not re-assemble. */ p1->vlan_id[0] = 1; p2->vlan_id[0] = 2; if ((r = Defrag(NULL, NULL, p1, NULL)) != NULL) goto end; if ((r = Defrag(NULL, NULL, p2, NULL)) != NULL) goto end; /* Pass. */ ret = 1; end: if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); DefragDestroy(); return ret; } /** * Like DefragVlanTest, but for QinQ, testing the second level VLAN ID. */ static int DefragVlanQinQTest(void) { Packet *p1 = NULL, *p2 = NULL, *r = NULL; int ret = 0; DefragInit(); p1 = BuildTestPacket(IPPROTO_ICMP, 1, 0, 1, 'A', 8); if (p1 == NULL) goto end; p2 = BuildTestPacket(IPPROTO_ICMP, 1, 1, 0, 'B', 8); if (p2 == NULL) goto end; /* With no VLAN IDs set, packets should re-assemble. */ if ((r = Defrag(NULL, NULL, p1, NULL)) != NULL) goto end; if ((r = Defrag(NULL, NULL, p2, NULL)) == NULL) goto end; SCFree(r); /* With mismatched VLANs, packets should not re-assemble. */ p1->vlan_id[0] = 1; p2->vlan_id[0] = 1; p1->vlan_id[1] = 1; p2->vlan_id[1] = 2; if ((r = Defrag(NULL, NULL, p1, NULL)) != NULL) goto end; if ((r = Defrag(NULL, NULL, p2, NULL)) != NULL) goto end; /* Pass. */ ret = 1; end: if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); DefragDestroy(); return ret; } static int DefragTrackerReuseTest(void) { int ret = 0; int id = 1; Packet *p1 = NULL; DefragTracker *tracker1 = NULL, *tracker2 = NULL; DefragInit(); /* Build a packet, its not a fragment but shouldn't matter for * this test. */ p1 = BuildTestPacket(IPPROTO_ICMP, id, 0, 0, 'A', 8); if (p1 == NULL) { goto end; } /* Get a tracker. It shouldn't look like its already in use. */ tracker1 = DefragGetTracker(NULL, NULL, p1); if (tracker1 == NULL) { goto end; } if (tracker1->seen_last) { goto end; } if (tracker1->remove) { goto end; } DefragTrackerRelease(tracker1); /* Get a tracker again, it should be the same one. */ tracker2 = DefragGetTracker(NULL, NULL, p1); if (tracker2 == NULL) { goto end; } if (tracker2 != tracker1) { goto end; } DefragTrackerRelease(tracker1); /* Now mark the tracker for removal. It should not be returned * when we get a tracker for a packet that may have the same * attributes. */ tracker1->remove = 1; tracker2 = DefragGetTracker(NULL, NULL, p1); if (tracker2 == NULL) { goto end; } if (tracker2 == tracker1) { goto end; } if (tracker2->remove) { goto end; } ret = 1; end: if (p1 != NULL) { SCFree(p1); } DefragDestroy(); return ret; } /** * IPV4: Test the case where you have a packet fragmented in 3 parts * and send like: * - Offset: 2; MF: 1 * - Offset: 0; MF: 1 * - Offset: 1; MF: 0 * * Only the fragments with offset 0 and 1 should be reassembled. */ static int DefragMfIpv4Test(void) { int retval = 0; int ip_id = 9; Packet *p = NULL; DefragInit(); Packet *p1 = BuildTestPacket(IPPROTO_ICMP, ip_id, 2, 1, 'C', 8); Packet *p2 = BuildTestPacket(IPPROTO_ICMP, ip_id, 0, 1, 'A', 8); Packet *p3 = BuildTestPacket(IPPROTO_ICMP, ip_id, 1, 0, 'B', 8); if (p1 == NULL || p2 == NULL || p3 == NULL) { goto end; } p = Defrag(NULL, NULL, p1, NULL); if (p != NULL) { goto end; } p = Defrag(NULL, NULL, p2, NULL); if (p != NULL) { goto end; } /* This should return a packet as MF=0. */ p = Defrag(NULL, NULL, p3, NULL); if (p == NULL) { goto end; } /* Expected IP length is 20 + 8 + 8 = 36 as only 2 of the * fragments should be in the re-assembled packet. */ if (IPV4_GET_IPLEN(p) != 36) { goto end; } retval = 1; end: if (p1 != NULL) { SCFree(p1); } if (p2 != NULL) { SCFree(p2); } if (p3 != NULL) { SCFree(p3); } if (p != NULL) { SCFree(p); } DefragDestroy(); return retval; } /** * IPV6: Test the case where you have a packet fragmented in 3 parts * and send like: * - Offset: 2; MF: 1 * - Offset: 0; MF: 1 * - Offset: 1; MF: 0 * * Only the fragments with offset 0 and 1 should be reassembled. */ static int DefragMfIpv6Test(void) { int retval = 0; int ip_id = 9; Packet *p = NULL; DefragInit(); Packet *p1 = IPV6BuildTestPacket(IPPROTO_ICMPV6, ip_id, 2, 1, 'C', 8); Packet *p2 = IPV6BuildTestPacket(IPPROTO_ICMPV6, ip_id, 0, 1, 'A', 8); Packet *p3 = IPV6BuildTestPacket(IPPROTO_ICMPV6, ip_id, 1, 0, 'B', 8); if (p1 == NULL || p2 == NULL || p3 == NULL) { goto end; } p = Defrag(NULL, NULL, p1, NULL); if (p != NULL) { goto end; } p = Defrag(NULL, NULL, p2, NULL); if (p != NULL) { goto end; } /* This should return a packet as MF=0. */ p = Defrag(NULL, NULL, p3, NULL); if (p == NULL) { goto end; } /* For IPv6 the expected length is just the length of the payload * of 2 fragments, so 16. */ if (IPV6_GET_PLEN(p) != 16) { goto end; } retval = 1; end: if (p1 != NULL) { SCFree(p1); } if (p2 != NULL) { SCFree(p2); } if (p3 != NULL) { SCFree(p3); } if (p != NULL) { SCFree(p); } DefragDestroy(); return retval; } /** * \brief Test that fragments that match other than the proto don't * actually get matched. */ static int DefragTestBadProto(void) { Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; int id = 12; DefragInit(); p1 = BuildTestPacket(IPPROTO_ICMP, id, 0, 1, 'A', 8); FAIL_IF_NULL(p1); p2 = BuildTestPacket(IPPROTO_UDP, id, 1, 1, 'B', 8); FAIL_IF_NULL(p2); p3 = BuildTestPacket(IPPROTO_ICMP, id, 2, 0, 'C', 3); FAIL_IF_NULL(p3); FAIL_IF_NOT_NULL(Defrag(NULL, NULL, p1, NULL)); FAIL_IF_NOT_NULL(Defrag(NULL, NULL, p2, NULL)); FAIL_IF_NOT_NULL(Defrag(NULL, NULL, p3, NULL)); if (p1 != NULL) SCFree(p1); if (p2 != NULL) SCFree(p2); if (p3 != NULL) SCFree(p3); DefragDestroy(); PASS; } #endif /* UNITTESTS */ void DefragRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DefragInOrderSimpleTest", DefragInOrderSimpleTest); UtRegisterTest("DefragReverseSimpleTest", DefragReverseSimpleTest); UtRegisterTest("DefragSturgesNovakBsdTest", DefragSturgesNovakBsdTest); UtRegisterTest("DefragSturgesNovakLinuxTest", DefragSturgesNovakLinuxTest); UtRegisterTest("DefragSturgesNovakWindowsTest", DefragSturgesNovakWindowsTest); UtRegisterTest("DefragSturgesNovakSolarisTest", DefragSturgesNovakSolarisTest); UtRegisterTest("DefragSturgesNovakFirstTest", DefragSturgesNovakFirstTest); UtRegisterTest("DefragSturgesNovakLastTest", DefragSturgesNovakLastTest); UtRegisterTest("DefragIPv4NoDataTest", DefragIPv4NoDataTest); UtRegisterTest("DefragIPv4TooLargeTest", DefragIPv4TooLargeTest); UtRegisterTest("IPV6DefragInOrderSimpleTest", IPV6DefragInOrderSimpleTest); UtRegisterTest("IPV6DefragReverseSimpleTest", IPV6DefragReverseSimpleTest); UtRegisterTest("IPV6DefragSturgesNovakBsdTest", IPV6DefragSturgesNovakBsdTest); UtRegisterTest("IPV6DefragSturgesNovakLinuxTest", IPV6DefragSturgesNovakLinuxTest); UtRegisterTest("IPV6DefragSturgesNovakWindowsTest", IPV6DefragSturgesNovakWindowsTest); UtRegisterTest("IPV6DefragSturgesNovakSolarisTest", IPV6DefragSturgesNovakSolarisTest); UtRegisterTest("IPV6DefragSturgesNovakFirstTest", IPV6DefragSturgesNovakFirstTest); UtRegisterTest("IPV6DefragSturgesNovakLastTest", IPV6DefragSturgesNovakLastTest); UtRegisterTest("DefragVlanTest", DefragVlanTest); UtRegisterTest("DefragVlanQinQTest", DefragVlanQinQTest); UtRegisterTest("DefragTrackerReuseTest", DefragTrackerReuseTest); UtRegisterTest("DefragTimeoutTest", DefragTimeoutTest); UtRegisterTest("DefragMfIpv4Test", DefragMfIpv4Test); UtRegisterTest("DefragMfIpv6Test", DefragMfIpv6Test); UtRegisterTest("DefragTestBadProto", DefragTestBadProto); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-isdataat.c0000644000000000000000000012175013051004444014213 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Implements isdataat keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "app-layer.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-isdataat.h" #include "detect-content.h" #include "detect-uricontent.h" #include "flow.h" #include "flow-var.h" #include "util-debug.h" #include "util-byte.h" #include "detect-pcre.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" /** * \brief Regex for parsing our isdataat options */ #define PARSE_REGEX "^\\s*!?([^\\s,]+)\\s*(,\\s*relative)?\\s*(,\\s*rawbytes\\s*)?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIsdataatSetup (DetectEngineCtx *, Signature *, char *); void DetectIsdataatRegisterTests(void); void DetectIsdataatFree(void *); /** * \brief Registration function for isdataat: keyword */ void DetectIsdataatRegister(void) { sigmatch_table[DETECT_ISDATAAT].name = "isdataat"; sigmatch_table[DETECT_ISDATAAT].desc = "check if there is still data at a specific part of the payload"; sigmatch_table[DETECT_ISDATAAT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#isadataat"; /* match is handled in DetectEngineContentInspection() */ sigmatch_table[DETECT_ISDATAAT].Match = NULL; sigmatch_table[DETECT_ISDATAAT].Setup = DetectIsdataatSetup; sigmatch_table[DETECT_ISDATAAT].Free = DetectIsdataatFree; sigmatch_table[DETECT_ISDATAAT].RegisterTests = DetectIsdataatRegisterTests; sigmatch_table[DETECT_ISDATAAT].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to parse isdataat options passed via isdataat: keyword * * \param isdataatstr Pointer to the user provided isdataat options * * \retval idad pointer to DetectIsdataatData on success * \retval NULL on failure */ DetectIsdataatData *DetectIsdataatParse (char *isdataatstr, char **offset) { DetectIsdataatData *idad = NULL; char *args[3] = {NULL,NULL,NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i=0; ret = pcre_exec(parse_regex, parse_regex_study, isdataatstr, strlen(isdataatstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, isdataatstr); goto error; } if (ret > 1) { const char *str_ptr; res = pcre_get_substring((char *)isdataatstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[0] = (char *)str_ptr; if (ret > 2) { res = pcre_get_substring((char *)isdataatstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[1] = (char *)str_ptr; } if (ret > 3) { res = pcre_get_substring((char *)isdataatstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[2] = (char *)str_ptr; } idad = SCMalloc(sizeof(DetectIsdataatData)); if (unlikely(idad == NULL)) goto error; idad->flags = 0; idad->dataat = 0; if (args[0][0] != '-' && isalpha((unsigned char)args[0][0])) { if (offset == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "isdataat supplied with " "var name for offset. \"offset\" argument supplied to " "this function has to be non-NULL"); goto error; } *offset = SCStrdup(args[0]); if (*offset == NULL) goto error; } else { if (ByteExtractStringUint16(&idad->dataat, 10, strlen(args[0]), args[0]) < 0 ) { SCLogError(SC_ERR_INVALID_VALUE, "isdataat out of range"); SCFree(idad); idad = NULL; goto error; } } if (args[1] !=NULL) { idad->flags |= ISDATAAT_RELATIVE; if(args[2] !=NULL) idad->flags |= ISDATAAT_RAWBYTES; } if (isdataatstr[0] == '!') { idad->flags |= ISDATAAT_NEGATED; } for (i = 0; i < (ret -1); i++) { if (args[i] != NULL) SCFree(args[i]); } return idad; } error: for (i = 0; i < (ret -1) && i < 3; i++){ if (args[i] != NULL) SCFree(args[i]); } if (idad != NULL) DetectIsdataatFree(idad); return NULL; } /** * \brief This function is used to add the parsed isdataatdata into the current * signature. * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param isdataatstr pointer to the user provided isdataat options * * \retval 0 on Success * \retval -1 on Failure */ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatstr) { SigMatch *sm = NULL; SigMatch *prev_pm = NULL; DetectIsdataatData *idad = NULL; char *offset = NULL; int ret = -1; idad = DetectIsdataatParse(isdataatstr, &offset); if (idad == NULL) return -1; int sm_list; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA) { AppLayerHtpEnableResponseBodyCallback(); s->alproto = ALPROTO_HTTP; } sm_list = s->list; s->flags |= SIG_FLAG_APPLAYER; if (idad->flags & ISDATAAT_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); } } else if (idad->flags & ISDATAAT_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 168, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (prev_pm == NULL) sm_list = DETECT_SM_LIST_PMATCH; else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto end; } } else { sm_list = DETECT_SM_LIST_PMATCH; } if (offset != NULL) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var " "seen in isdataat - %s\n", offset); goto end; } idad->dataat = ((DetectByteExtractData *)bed_sm->ctx)->local_id; idad->flags |= ISDATAAT_OFFSET_BE; SCFree(offset); } sm = SigMatchAlloc(); if (sm == NULL) goto end; sm->type = DETECT_ISDATAAT; sm->ctx = (SigMatchCtx *)idad; SigMatchAppendSMToList(s, sm, sm_list); if (!(idad->flags & ISDATAAT_RELATIVE)) { ret = 0; goto end; } if (prev_pm == NULL) { ret = 0; goto end; } if (prev_pm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)prev_pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } ret = 0; end: if (ret != 0) DetectIsdataatFree(idad); return ret; } /** * \brief this function will free memory associated with DetectIsdataatData * * \param idad pointer to DetectIsdataatData */ void DetectIsdataatFree(void *ptr) { DetectIsdataatData *idad = (DetectIsdataatData *)ptr; SCFree(idad); } #ifdef UNITTESTS /** * \test DetectIsdataatTestParse01 is a test to make sure that we return a correct IsdataatData structure * when given valid isdataat opt */ int DetectIsdataatTestParse01 (void) { int result = 0; DetectIsdataatData *idad = NULL; idad = DetectIsdataatParse("30 ", NULL); if (idad != NULL) { DetectIsdataatFree(idad); result = 1; } return result; } /** * \test DetectIsdataatTestParse02 is a test to make sure that we return a correct IsdataatData structure * when given valid isdataat opt */ int DetectIsdataatTestParse02 (void) { int result = 0; DetectIsdataatData *idad = NULL; idad = DetectIsdataatParse("30 , relative", NULL); if (idad != NULL && idad->flags & ISDATAAT_RELATIVE && !(idad->flags & ISDATAAT_RAWBYTES)) { DetectIsdataatFree(idad); result = 1; } return result; } /** * \test DetectIsdataatTestParse03 is a test to make sure that we return a correct IsdataatData structure * when given valid isdataat opt */ int DetectIsdataatTestParse03 (void) { int result = 0; DetectIsdataatData *idad = NULL; idad = DetectIsdataatParse("30,relative, rawbytes ", NULL); if (idad != NULL && idad->flags & ISDATAAT_RELATIVE && idad->flags & ISDATAAT_RAWBYTES) { DetectIsdataatFree(idad); result = 1; } return result; } /** * \test Test isdataat option for dce sig. */ int DetectIsdataatTestParse04(void) { Signature *s = SigAlloc(); int result = 1; s->alproto = ALPROTO_DCERPC; result &= (DetectIsdataatSetup(NULL, s, "30") == 0); result &= (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); s->alproto = ALPROTO_DCERPC; /* failure since we have no preceding content/pcre/bytejump */ result &= (DetectIsdataatSetup(NULL, s, "30,relative") == 0); result &= (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); return result; } /** * \test Test isdataat option for dce sig. */ int DetectIsdataatTestParse05(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "isdataat:4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "isdataat:4,relative; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "isdataat:4,relative,rawbytes; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || !(data->flags & ISDATAAT_RAWBYTES) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; isdataat:4,relative,rawbytes; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse06(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse07(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "uricontent:\"one\"; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse08(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; http_uri; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse09(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; http_client_body; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse10(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; http_header; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse11(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "flow:to_server; content:\"one\"; http_raw_header; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse12(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; http_method; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectIsdataatTestParse13(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; http_cookie; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH] == NULL) { goto end; } result = 1; result &= (s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->type == DETECT_ISDATAAT); data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int DetectIsdataatTestParse14(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing file_data and isdataat\"; " "file_data; content:\"one\"; " "isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL) { printf("server body list empty: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_ISDATAAT) { printf("last server body sm not isdataat: "); goto end; } data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test file_data with isdataat relative to it */ static int DetectIsdataatTestParse15(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing file_data and isdataat\"; " "file_data; isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse: "); goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL) { printf("server body list empty: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_ISDATAAT) { printf("last server body sm not isdataat: "); goto end; } data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test dns_query with isdataat relative to it */ static int DetectIsdataatTestParse16(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectIsdataatData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dns_query and isdataat\"; " "dns_query; isdataat:!4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse: "); goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH] == NULL) { printf("dns_query list empty: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH]->type != DETECT_ISDATAAT) { printf("last dns_query body sm not isdataat: "); goto end; } data = (DetectIsdataatData *)s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH]->ctx; if ( !(data->flags & ISDATAAT_RELATIVE) || (data->flags & ISDATAAT_RAWBYTES) || !(data->flags & ISDATAAT_NEGATED) ) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectIsdataatTestPacket01 is a test to check matches of * isdataat, and isdataat relative */ int DetectIsdataatTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_UDP); p[2] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_ICMP); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; char *sigs[5]; sigs[0]= "alert ip any any -> any any (msg:\"Testing window 1\"; isdataat:6; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing window 2\"; content:\"all\"; isdataat:1, relative; isdataat:6; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing window 3\"; isdataat:8; sid:3;)"; sigs[3]= "alert ip any any -> any any (msg:\"Testing window 4\"; content:\"Hi\"; isdataat:5, relative; sid:4;)"; sigs[4]= "alert ip any any -> any any (msg:\"Testing window 4\"; content:\"Hi\"; isdataat:6, relative; sid:5;)"; uint32_t sid[5] = {1, 2, 3, 4, 5}; uint32_t results[3][5] = { /* packet 0 match sid 1 but should not match sid 2 */ {1, 1, 0, 1, 0}, /* packet 1 should not match */ {1, 1, 0, 1, 0}, /* packet 2 should not match */ {1, 1, 0, 1, 0} }; result = UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 5); UTHFreePackets(p, 3); end: return result; } /** * \test DetectIsdataatTestPacket02 is a test to check matches of * isdataat, and isdataat relative works if the previous keyword is pcre * (bug 144) */ int DetectIsdataatTestPacket02 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"pcre with" " isdataat + relative\"; pcre:\"/A(ll|pp)WorkAndNoPlayMakesWillA" "DullBoy/\"; isdataat:96,relative; sid:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** * \test DetectIsdataatTestPacket03 is a test to check matches of * isdataat, and isdataat relative works if the previous keyword is byte_jump * (bug 146) */ int DetectIsdataatTestPacket03 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"byte_jump match = 0 " "with distance content HTTP/1. relative against HTTP/1.0\"; byte_jump:1," "46,string,dec; isdataat:87,relative; sid:109; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } #endif /** * \brief this function registers unit tests for DetectIsdataat */ void DetectIsdataatRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectIsdataatTestParse01", DetectIsdataatTestParse01); UtRegisterTest("DetectIsdataatTestParse02", DetectIsdataatTestParse02); UtRegisterTest("DetectIsdataatTestParse03", DetectIsdataatTestParse03); UtRegisterTest("DetectIsdataatTestParse04", DetectIsdataatTestParse04); UtRegisterTest("DetectIsdataatTestParse05", DetectIsdataatTestParse05); UtRegisterTest("DetectIsdataatTestParse06", DetectIsdataatTestParse06); UtRegisterTest("DetectIsdataatTestParse07", DetectIsdataatTestParse07); UtRegisterTest("DetectIsdataatTestParse08", DetectIsdataatTestParse08); UtRegisterTest("DetectIsdataatTestParse09", DetectIsdataatTestParse09); UtRegisterTest("DetectIsdataatTestParse10", DetectIsdataatTestParse10); UtRegisterTest("DetectIsdataatTestParse11", DetectIsdataatTestParse11); UtRegisterTest("DetectIsdataatTestParse12", DetectIsdataatTestParse12); UtRegisterTest("DetectIsdataatTestParse13", DetectIsdataatTestParse13); UtRegisterTest("DetectIsdataatTestParse14", DetectIsdataatTestParse14); UtRegisterTest("DetectIsdataatTestParse15", DetectIsdataatTestParse15); UtRegisterTest("DetectIsdataatTestParse16", DetectIsdataatTestParse16); UtRegisterTest("DetectIsdataatTestPacket01", DetectIsdataatTestPacket01); UtRegisterTest("DetectIsdataatTestPacket02", DetectIsdataatTestPacket02); UtRegisterTest("DetectIsdataatTestPacket03", DetectIsdataatTestPacket03); #endif } suricata-3.2.1/src/detect-tag.h0000644000000000000000000000641713051004444013203 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * \author Victor Julien */ #ifndef __DETECT_TAG_H__ #define __DETECT_TAG_H__ #include "suricata-common.h" #include "suricata.h" #include "util-time.h" /* Limit the number of times a session can be tagged by the * same rule without finishing older tags */ #define DETECT_TAG_MATCH_LIMIT 10 /* Limit the number of tags that a session can have */ #define DETECT_TAG_MAX_TAGS 50 /* Limit the number of pkts to capture. Change this to * zero to make it unlimited * TODO: load it from config (var tagged_packet_limit) */ #define DETECT_TAG_MAX_PKTS 256 /* Type of tag: session or host */ enum { DETECT_TAG_TYPE_SESSION, DETECT_TAG_TYPE_HOST, DETECT_TAG_TYPE_MAX }; enum { DETECT_TAG_DIR_SRC, DETECT_TAG_DIR_DST, DETECT_TAG_DIR_MAX }; enum { DETECT_TAG_METRIC_PACKET, DETECT_TAG_METRIC_SECONDS, DETECT_TAG_METRIC_BYTES, DETECT_TAG_METRIC_MAX }; /** This will be the rule options/parameters */ typedef struct DetectTagData_ { uint8_t type; /**< tag type */ uint8_t direction; /**< host direction */ uint32_t count; /**< count */ uint32_t metric; /**< metric */ } DetectTagData; /** This is the installed data at the session/global or host table */ typedef struct DetectTagDataEntry_ { uint8_t flags:3; uint8_t metric:5; uint8_t pad0; uint16_t cnt_match; /**< number of times this tag was reset/updated */ uint32_t count; /**< count setting from rule */ uint32_t sid; /**< sid originating the tag */ uint32_t gid; /**< gid originating the tag */ union { uint32_t packets; /**< number of packets (metric packets) */ uint32_t bytes; /**< number of bytes (metric bytes) */ }; uint32_t first_ts; /**< First time seen (for metric = seconds) */ uint32_t last_ts; /**< Last time seen (to prune old sessions) */ #if __WORDSIZE == 64 uint32_t pad1; #endif struct DetectTagDataEntry_ *next; /**< Pointer to the next tag of this * session/src_host/dst_host (if any from other rule) */ } DetectTagDataEntry; #define TAG_ENTRY_FLAG_DIR_SRC 0x01 #define TAG_ENTRY_FLAG_DIR_DST 0x02 #define TAG_ENTRY_FLAG_SKIPPED_FIRST 0x04 /* prototypes */ void DetectTagRegister(void); void DetectTagDataFree(void *ptr); void DetectTagDataListFree(void *ptr); #endif /* __DETECT_TAG_H__ */ suricata-3.2.1/src/detect-distance.c0000644000000000000000000002276713051004444014223 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the distance keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "app-layer.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-pcre.h" #include "detect-byte-extract.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "detect-bytejump.h" #include "util-unittest-helper.h" static int DetectDistanceSetup(DetectEngineCtx *, Signature *, char *); void DetectDistanceRegisterTests(void); void DetectDistanceRegister(void) { sigmatch_table[DETECT_DISTANCE].name = "distance"; sigmatch_table[DETECT_DISTANCE].desc = "indicates a relation between this content keyword and the content preceding it"; sigmatch_table[DETECT_DISTANCE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#distance"; sigmatch_table[DETECT_DISTANCE].Match = NULL; sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup; sigmatch_table[DETECT_DISTANCE].Free = NULL; sigmatch_table[DETECT_DISTANCE].RegisterTests = DetectDistanceRegisterTests; sigmatch_table[DETECT_DISTANCE].flags |= SIGMATCH_PAYLOAD; } static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *distancestr) { char *str = distancestr; char dubbed = 0; SigMatch *pm = NULL; int ret = -1; /* Strip leading and trailing "s. */ if (distancestr[0] == '\"') { str = SCStrdup(distancestr + 1); if (unlikely(str == NULL)) goto end; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } dubbed = 1; } /* retrive the sm to apply the depth against */ if (s->list != DETECT_SM_LIST_NOTSET) { pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]); } else { pm = SigMatchGetLastSMFromLists(s, 28, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); } if (pm == NULL) { SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "distance needs " "preceding content, uricontent option, http_client_body, " "http_server_body, http_header option, http_raw_header option, " "http_method option, http_cookie, http_raw_uri, " "http_stat_msg, http_stat_code, http_user_agent or " "file_data/dce_stub_data sticky buffer option"); goto end; } /* verify other conditions */ DetectContentData *cd = (DetectContentData *)pm->ctx; if (cd->flags & DETECT_CONTENT_DISTANCE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple distances for the same content."); goto end; } if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative " "keyword like within/distance with a absolute " "relative keyword like depth/offset for the same " "content." ); goto end; } if (cd->flags & DETECT_CONTENT_NEGATED && cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "negated keyword set along with a fast_pattern"); goto end; } if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "keyword set along with a fast_pattern:only;"); goto end; } if (str[0] != '-' && isalpha((unsigned char)str[0])) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var " "seen in distance - %s\n", str); goto end; } cd->distance = ((DetectByteExtractData *)bed_sm->ctx)->local_id; cd->flags |= DETECT_CONTENT_DISTANCE_BE; } else { cd->distance = strtol(str, NULL, 10); } cd->flags |= DETECT_CONTENT_DISTANCE; SigMatch *prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, pm->prev, DETECT_PCRE, pm->prev); if (prev_pm == NULL) { ret = 0; goto end; } if (prev_pm->type == DETECT_CONTENT) { DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx; if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword " "has a fast_pattern:only; set. Can't " "have relative keywords around a fast_pattern " "only content"); goto end; } prev_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } ret = 0; end: if (dubbed) SCFree(str); return ret; } #ifdef UNITTESTS static int DetectDistanceTest01(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("no de_ctx: "); goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (content:\"|AA BB|\"; content:\"|CC DD EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE|\"; distance: 4; within: 19; sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { printf("sm NULL: "); goto end; } sm = sm->next; if (sm == NULL) { printf("sm2 NULL: "); goto end; } DetectContentData *co = (DetectContentData *)sm->ctx; if (co == NULL) { printf("co == NULL: "); goto end; } if (co->distance != 4) { printf("distance %"PRIi32", expected 4: ", co->distance); goto end; } /* within needs to be 23: distance + content_len as Snort auto fixes this */ if (co->within != 19) { printf("within %"PRIi32", expected 23: ", co->within); goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectDistanceTestPacket01 is a test to check matches of * distance works, if the previous keyword is byte_jump and content * (bug 163) */ int DetectDistanceTestPacket01 (void) { int result = 0; uint8_t buf[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 }; uint16_t buflen = sizeof(buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"suricata test\"; " "byte_jump:1,2; content:\"|00|\"; " "within:1; distance:2; sid:98711212; rev:1;)"; p->flowflags = FLOW_PKT_ESTABLISHED | FLOW_PKT_TOCLIENT; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } #endif /* UNITTESTS */ void DetectDistanceRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDistanceTest01 -- distance / within mix", DetectDistanceTest01); UtRegisterTest("DetectDistanceTestPacket01", DetectDistanceTestPacket01); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-hash.c0000644000000000000000000002355213051004444013052 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Chained hash table implementation * * The 'Free' pointer can be used to have the API free your * hashed data. If it's NULL it's the callers responsebility */ #include "suricata-common.h" #include "util-hash.h" #include "util-unittest.h" #include "util-memcmp.h" HashTable* HashTableInit(uint32_t size, uint32_t (*Hash)(struct HashTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)) { HashTable *ht = NULL; if (size == 0) { goto error; } if (Hash == NULL) { //printf("ERROR: HashTableInit no Hash function\n"); goto error; } /* setup the filter */ ht = SCMalloc(sizeof(HashTable)); if (unlikely(ht == NULL)) goto error; memset(ht,0,sizeof(HashTable)); ht->array_size = size; ht->Hash = Hash; ht->Free = Free; if (Compare != NULL) ht->Compare = Compare; else ht->Compare = HashTableDefaultCompare; /* setup the bitarray */ ht->array = SCMalloc(ht->array_size * sizeof(HashTableBucket *)); if (ht->array == NULL) goto error; memset(ht->array,0,ht->array_size * sizeof(HashTableBucket *)); return ht; error: if (ht != NULL) { if (ht->array != NULL) SCFree(ht->array); SCFree(ht); } return NULL; } void HashTableFree(HashTable *ht) { uint32_t i = 0; if (ht == NULL) return; /* free the buckets */ for (i = 0; i < ht->array_size; i++) { HashTableBucket *hashbucket = ht->array[i]; while (hashbucket != NULL) { HashTableBucket *next_hashbucket = hashbucket->next; if (ht->Free != NULL) ht->Free(hashbucket->data); SCFree(hashbucket); hashbucket = next_hashbucket; } } /* free the arrray */ if (ht->array != NULL) SCFree(ht->array); SCFree(ht); } void HashTablePrint(HashTable *ht) { printf("\n----------- Hash Table Stats ------------\n"); printf("Buckets: %" PRIu32 "\n", ht->array_size); printf("Hash function pointer: %p\n", ht->Hash); printf("-----------------------------------------\n"); } int HashTableAdd(HashTable *ht, void *data, uint16_t datalen) { if (ht == NULL || data == NULL) return -1; uint32_t hash = ht->Hash(ht, data, datalen); HashTableBucket *hb = SCMalloc(sizeof(HashTableBucket)); if (unlikely(hb == NULL)) goto error; memset(hb, 0, sizeof(HashTableBucket)); hb->data = data; hb->size = datalen; hb->next = NULL; if (ht->array[hash] == NULL) { ht->array[hash] = hb; } else { hb->next = ht->array[hash]; ht->array[hash] = hb; } #ifdef UNITTESTS ht->count++; #endif return 0; error: return -1; } int HashTableRemove(HashTable *ht, void *data, uint16_t datalen) { uint32_t hash = ht->Hash(ht, data, datalen); if (ht->array[hash] == NULL) { return -1; } if (ht->array[hash]->next == NULL) { if (ht->Free != NULL) ht->Free(ht->array[hash]->data); SCFree(ht->array[hash]); ht->array[hash] = NULL; return 0; } HashTableBucket *hashbucket = ht->array[hash], *prev_hashbucket = NULL; do { if (ht->Compare(hashbucket->data,hashbucket->size,data,datalen) == 1) { if (prev_hashbucket == NULL) { /* root bucket */ ht->array[hash] = hashbucket->next; } else { /* child bucket */ prev_hashbucket->next = hashbucket->next; } /* remove this */ if (ht->Free != NULL) ht->Free(hashbucket->data); SCFree(hashbucket); return 0; } prev_hashbucket = hashbucket; hashbucket = hashbucket->next; } while (hashbucket != NULL); return -1; } void *HashTableLookup(HashTable *ht, void *data, uint16_t datalen) { uint32_t hash = 0; if (ht == NULL) return NULL; hash = ht->Hash(ht, data, datalen); if (ht->array[hash] == NULL) return NULL; HashTableBucket *hashbucket = ht->array[hash]; do { if (ht->Compare(hashbucket->data, hashbucket->size, data, datalen) == 1) return hashbucket->data; hashbucket = hashbucket->next; } while (hashbucket != NULL); return NULL; } uint32_t HashTableGenericHash(HashTable *ht, void *data, uint16_t datalen) { uint8_t *d = (uint8_t *)data; uint32_t i; uint32_t hash = 0; for (i = 0; i < datalen; i++) { if (i == 0) hash += (((uint32_t)*d++)); else if (i == 1) hash += (((uint32_t)*d++) * datalen); else hash *= (((uint32_t)*d++) * i) + datalen + i; } hash *= datalen; hash %= ht->array_size; return hash; } char HashTableDefaultCompare(void *data1, uint16_t len1, void *data2, uint16_t len2) { if (len1 != len2) return 0; if (SCMemcmp(data1,data2,len1) != 0) return 0; return 1; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS static int HashTableTestInit01 (void) { HashTable *ht = HashTableInit(1024, HashTableGenericHash, NULL, NULL); if (ht == NULL) return 0; HashTableFree(ht); return 1; } /* no hash function, so it should fail */ static int HashTableTestInit02 (void) { HashTable *ht = HashTableInit(1024, NULL, NULL, NULL); if (ht == NULL) return 1; HashTableFree(ht); return 0; } static int HashTableTestInit03 (void) { int result = 0; HashTable *ht = HashTableInit(1024, HashTableGenericHash, NULL, NULL); if (ht == NULL) return 0; if (ht->Hash == HashTableGenericHash) result = 1; HashTableFree(ht); return result; } static int HashTableTestInit04 (void) { HashTable *ht = HashTableInit(0, HashTableGenericHash, NULL, NULL); if (ht == NULL) return 1; HashTableFree(ht); return 0; } static int HashTableTestInit05 (void) { int result = 0; HashTable *ht = HashTableInit(1024, HashTableGenericHash, NULL, NULL); if (ht == NULL) return 0; if (ht->Compare == HashTableDefaultCompare) result = 1; HashTableFree(ht); return result; } static char HashTableDefaultCompareTest(void *data1, uint16_t len1, void *data2, uint16_t len2) { if (len1 != len2) return 0; if (SCMemcmp(data1,data2,len1) != 0) return 0; return 1; } static int HashTableTestInit06 (void) { int result = 0; HashTable *ht = HashTableInit(1024, HashTableGenericHash, HashTableDefaultCompareTest, NULL); if (ht == NULL) return 0; if (ht->Compare == HashTableDefaultCompareTest) result = 1; HashTableFree(ht); return result; } static int HashTableTestAdd01 (void) { int result = 0; HashTable *ht = HashTableInit(32, HashTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashTableAdd(ht, "test", 0); if (r != 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashTableFree(ht); return result; } static int HashTableTestAdd02 (void) { int result = 0; HashTable *ht = HashTableInit(32, HashTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashTableAdd(ht, NULL, 4); if (r == 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashTableFree(ht); return result; } static int HashTableTestFull01 (void) { int result = 0; HashTable *ht = HashTableInit(32, HashTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashTableAdd(ht, "test", 4); if (r != 0) goto end; char *rp = HashTableLookup(ht, "test", 4); if (rp == NULL) goto end; r = HashTableRemove(ht, "test", 4); if (r != 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashTableFree(ht); return result; } static int HashTableTestFull02 (void) { int result = 0; HashTable *ht = HashTableInit(32, HashTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashTableAdd(ht, "test", 4); if (r != 0) goto end; char *rp = HashTableLookup(ht, "test", 4); if (rp == NULL) goto end; r = HashTableRemove(ht, "test2", 5); if (r == 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashTableFree(ht); return result; } #endif void HashTableRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HashTableTestInit01", HashTableTestInit01); UtRegisterTest("HashTableTestInit02", HashTableTestInit02); UtRegisterTest("HashTableTestInit03", HashTableTestInit03); UtRegisterTest("HashTableTestInit04", HashTableTestInit04); UtRegisterTest("HashTableTestInit05", HashTableTestInit05); UtRegisterTest("HashTableTestInit06", HashTableTestInit06); UtRegisterTest("HashTableTestAdd01", HashTableTestAdd01); UtRegisterTest("HashTableTestAdd02", HashTableTestAdd02); UtRegisterTest("HashTableTestFull01", HashTableTestFull01); UtRegisterTest("HashTableTestFull02", HashTableTestFull02); #endif } suricata-3.2.1/src/stream-tcp-reassemble.c0000644000000000000000000112115613051004444015353 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * \author Victor Julien * * Reference: * Judy Novak, Steve Sturges: Target-Based TCP Stream Reassembly August, 2007 * */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "threads.h" #include "conf.h" #include "flow-util.h" #include "threadvars.h" #include "tm-threads.h" #include "util-pool.h" #include "util-unittest.h" #include "util-print.h" #include "util-host-os-info.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-device.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp-inline.h" #include "stream-tcp-util.h" #include "stream.h" #include "util-debug.h" #include "app-layer-protos.h" #include "app-layer.h" #include "app-layer-events.h" #include "detect-engine-state.h" #include "util-profiling.h" #define PSEUDO_PACKET_PAYLOAD_SIZE 65416 /* 64 Kb minus max IP and TCP header */ #ifdef DEBUG static SCMutex segment_pool_memuse_mutex; static uint64_t segment_pool_memuse = 0; static uint64_t segment_pool_memcnt = 0; #endif /* We define several pools with prealloced segments with fixed size * payloads. We do this to prevent having to do an SCMalloc call for every * data segment we receive, which would be a large performance penalty. * The cost is in memory of course. The number of pools and the properties * of the pools are determined by the yaml. */ static int segment_pool_num = 0; static Pool **segment_pool = NULL; static SCMutex *segment_pool_mutex = NULL; static uint16_t *segment_pool_pktsizes = NULL; #ifdef DEBUG static SCMutex segment_pool_cnt_mutex; static uint64_t segment_pool_cnt = 0; #endif /* index to the right pool for all packet sizes. */ static uint16_t segment_pool_idx[65536]; /* O(1) lookups of the pool */ static int check_overlap_different_data = 0; /* Memory use counter */ SC_ATOMIC_DECLARE(uint64_t, ra_memuse); /* prototypes */ static int HandleSegmentStartsBeforeListSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, TcpSegment *, Packet *); static int HandleSegmentStartsAtSameListSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, TcpSegment *, Packet *); static int HandleSegmentStartsAfterListSegment(ThreadVars *, TcpReassemblyThreadCtx *, TcpStream *, TcpSegment *, TcpSegment *, Packet *); void StreamTcpSegmentDataReplace(TcpSegment *, TcpSegment *, uint32_t, uint16_t); void StreamTcpSegmentDataCopy(TcpSegment *, TcpSegment *); TcpSegment* StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *, uint16_t); void StreamTcpCreateTestPacket(uint8_t *, uint8_t, uint8_t, uint8_t); void StreamTcpReassemblePseudoPacketCreate(TcpStream *, Packet *, PacketQueue *); static int StreamTcpSegmentDataCompare(TcpSegment *dst_seg, TcpSegment *src_seg, uint32_t start_point, uint16_t len); void StreamTcpReassembleConfigEnableOverlapCheck(void) { check_overlap_different_data = 1; } /** * \brief Function to Increment the memory usage counter for the TCP reassembly * segments * * \param size Size of the TCP segment and its payload length memory allocated */ void StreamTcpReassembleIncrMemuse(uint64_t size) { (void) SC_ATOMIC_ADD(ra_memuse, size); return; } /** * \brief Function to Decrease the memory usage counter for the TCP reassembly * segments * * \param size Size of the TCP segment and its payload length memory allocated */ void StreamTcpReassembleDecrMemuse(uint64_t size) { (void) SC_ATOMIC_SUB(ra_memuse, size); return; } uint64_t StreamTcpReassembleMemuseGlobalCounter(void) { uint64_t smemuse = SC_ATOMIC_GET(ra_memuse); return smemuse; } /** * \brief Function to Check the reassembly memory usage counter against the * allowed max memory usgae for TCP segments. * * \param size Size of the TCP segment and its payload length memory allocated * \retval 1 if in bounds * \retval 0 if not in bounds */ int StreamTcpReassembleCheckMemcap(uint32_t size) { if (stream_config.reassembly_memcap == 0 || (uint64_t)((uint64_t)size + SC_ATOMIC_GET(ra_memuse)) <= stream_config.reassembly_memcap) return 1; return 0; } /** \brief alloc a tcp segment pool entry */ void *TcpSegmentPoolAlloc() { if (StreamTcpReassembleCheckMemcap((uint32_t)sizeof(TcpSegment)) == 0) { return NULL; } TcpSegment *seg = NULL; seg = SCMalloc(sizeof (TcpSegment)); if (unlikely(seg == NULL)) return NULL; return seg; } int TcpSegmentPoolInit(void *data, void *payload_len) { TcpSegment *seg = (TcpSegment *) data; uint16_t size = *((uint16_t *) payload_len); /* do this before the can bail, so TcpSegmentPoolCleanup * won't have uninitialized memory to consider. */ memset(seg, 0, sizeof (TcpSegment)); if (StreamTcpReassembleCheckMemcap((uint32_t)size + (uint32_t)sizeof(TcpSegment)) == 0) { return 0; } seg->pool_size = size; seg->payload_len = seg->pool_size; seg->payload = SCMalloc(seg->payload_len); if (seg->payload == NULL) { return 0; } #ifdef DEBUG SCMutexLock(&segment_pool_memuse_mutex); segment_pool_memuse += seg->payload_len; segment_pool_memcnt++; SCLogDebug("segment_pool_memcnt %"PRIu64"", segment_pool_memcnt); SCMutexUnlock(&segment_pool_memuse_mutex); #endif StreamTcpReassembleIncrMemuse((uint32_t)seg->pool_size + sizeof(TcpSegment)); return 1; } /** \brief clean up a tcp segment pool entry */ void TcpSegmentPoolCleanup(void *ptr) { if (ptr == NULL) return; TcpSegment *seg = (TcpSegment *) ptr; StreamTcpReassembleDecrMemuse((uint32_t)seg->pool_size + sizeof(TcpSegment)); #ifdef DEBUG SCMutexLock(&segment_pool_memuse_mutex); segment_pool_memuse -= seg->pool_size; segment_pool_memcnt--; SCLogDebug("segment_pool_memcnt %"PRIu64"", segment_pool_memcnt); SCMutexUnlock(&segment_pool_memuse_mutex); #endif SCFree(seg->payload); return; } /** * \brief Function to return the segment back to the pool. * * \param seg Segment which will be returned back to the pool. */ void StreamTcpSegmentReturntoPool(TcpSegment *seg) { if (seg == NULL) return; seg->next = NULL; seg->prev = NULL; uint16_t idx = segment_pool_idx[seg->pool_size]; SCMutexLock(&segment_pool_mutex[idx]); PoolReturn(segment_pool[idx], (void *) seg); SCLogDebug("segment_pool[%"PRIu16"]->empty_stack_size %"PRIu32"", idx,segment_pool[idx]->empty_stack_size); SCMutexUnlock(&segment_pool_mutex[idx]); #ifdef DEBUG SCMutexLock(&segment_pool_cnt_mutex); segment_pool_cnt--; SCMutexUnlock(&segment_pool_cnt_mutex); #endif } /** * \brief return all segments in this stream into the pool(s) * * \param stream the stream to cleanup */ void StreamTcpReturnStreamSegments (TcpStream *stream) { TcpSegment *seg = stream->seg_list; TcpSegment *next_seg; if (seg == NULL) return; while (seg != NULL) { next_seg = seg->next; StreamTcpSegmentReturntoPool(seg); seg = next_seg; } stream->seg_list = NULL; stream->seg_list_tail = NULL; } /** \param f locked flow */ void StreamTcpDisableAppLayer(Flow *f) { if (f->protoctx == NULL) return; TcpSession *ssn = (TcpSession *)f->protoctx; StreamTcpSetStreamFlagAppProtoDetectionCompleted(&ssn->client); StreamTcpSetStreamFlagAppProtoDetectionCompleted(&ssn->server); StreamTcpDisableAppLayerReassembly(ssn); } /** \param f locked flow */ int StreamTcpAppLayerIsDisabled(Flow *f) { if (f->protoctx == NULL || f->proto != IPPROTO_TCP) return 0; TcpSession *ssn = (TcpSession *)f->protoctx; return (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); } typedef struct SegmentSizes_ { uint16_t pktsize; uint32_t prealloc; } SegmentSizes; /* sort small to big */ static int SortByPktsize(const void *a, const void *b) { const SegmentSizes *s0 = a; const SegmentSizes *s1 = b; return s0->pktsize - s1->pktsize; } int StreamTcpReassemblyConfig(char quiet) { Pool **my_segment_pool = NULL; SCMutex *my_segment_lock = NULL; uint16_t *my_segment_pktsizes = NULL; SegmentSizes sizes[256]; memset(&sizes, 0x00, sizeof(sizes)); int npools = 0; ConfNode *segs = ConfGetNode("stream.reassembly.segments"); if (segs != NULL) { ConfNode *seg; TAILQ_FOREACH(seg, &segs->head, next) { ConfNode *segsize = ConfNodeLookupChild(seg,"size"); if (segsize == NULL) continue; ConfNode *segpre = ConfNodeLookupChild(seg,"prealloc"); if (segpre == NULL) continue; if (npools >= 256) { SCLogError(SC_ERR_INVALID_ARGUMENT, "too many segment packet " "pools defined, max is 256"); return -1; } SCLogDebug("segsize->val %s", segsize->val); SCLogDebug("segpre->val %s", segpre->val); uint16_t pktsize = 0; if (strcmp("from_mtu", segsize->val) == 0) { int mtu = g_default_mtu ? g_default_mtu : DEFAULT_MTU; if (mtu < MINIMUM_MTU) { FatalErrorOnInit(SC_ERR_INVALID_ARGUMENT, "invalid mtu %d", mtu); continue; } pktsize = mtu - 40; } else { if (ByteExtractStringUint16(&pktsize, 10, strlen(segsize->val), segsize->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "segment packet size " "of %s is invalid", segsize->val); return -1; } } uint32_t prealloc = 0; if (ByteExtractStringUint32(&prealloc, 10, strlen(segpre->val), segpre->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "segment prealloc of " "%s is invalid", segpre->val); return -1; } sizes[npools].pktsize = pktsize; sizes[npools].prealloc = prealloc; SCLogDebug("pktsize %u, prealloc %u", sizes[npools].pktsize, sizes[npools].prealloc); npools++; } } SCLogDebug("npools %d", npools); if (npools > 0) { /* sort the array as the index code below relies on it */ qsort(&sizes, npools, sizeof(sizes[0]), SortByPktsize); if (sizes[npools - 1].pktsize != 0xffff) { sizes[npools].pktsize = 0xffff; sizes[npools].prealloc = 8; npools++; SCLogConfig("appended a segment pool for pktsize 65536"); } } else if (npools == 0) { int mtu = g_default_mtu; if (mtu < MINIMUM_MTU) mtu = DEFAULT_MTU; /* defaults */ sizes[0].pktsize = 4; sizes[0].prealloc = 256; sizes[1].pktsize = 16; sizes[1].prealloc = 512; sizes[2].pktsize = 112; sizes[2].prealloc = 512; sizes[3].pktsize = 248; sizes[3].prealloc = 512; sizes[4].pktsize = 512; sizes[4].prealloc = 512; sizes[5].pktsize = 768; sizes[5].prealloc = 1024; sizes[6].pktsize = mtu - 40; // min size of ipv4+tcp hdrs sizes[6].prealloc = 1024; sizes[7].pktsize = 0xffff; sizes[7].prealloc = 128; npools = 8; } int i = 0; for (i = 0; i < npools; i++) { SCLogDebug("pktsize %u, prealloc %u", sizes[i].pktsize, sizes[i].prealloc); } my_segment_pool = SCMalloc(npools * sizeof(Pool *)); if (my_segment_pool == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "malloc failed"); return -1; } my_segment_lock = SCMalloc(npools * sizeof(SCMutex)); if (my_segment_lock == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "malloc failed"); SCFree(my_segment_pool); return -1; } my_segment_pktsizes = SCMalloc(npools * sizeof(uint16_t)); if (my_segment_pktsizes == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "malloc failed"); SCFree(my_segment_lock); SCFree(my_segment_pool); return -1; } uint32_t my_segment_poolsizes[npools]; for (i = 0; i < npools; i++) { my_segment_pktsizes[i] = sizes[i].pktsize; my_segment_poolsizes[i] = sizes[i].prealloc; SCMutexInit(&my_segment_lock[i], NULL); /* setup the pool */ SCMutexLock(&my_segment_lock[i]); my_segment_pool[i] = PoolInit(0, my_segment_poolsizes[i], 0, TcpSegmentPoolAlloc, TcpSegmentPoolInit, (void *) &my_segment_pktsizes[i], TcpSegmentPoolCleanup, NULL); SCMutexUnlock(&my_segment_lock[i]); if (my_segment_pool[i] == NULL) { SCLogError(SC_ERR_INITIALIZATION, "couldn't set up segment pool " "for packet size %u. Memcap too low?", my_segment_pktsizes[i]); exit(EXIT_FAILURE); } SCLogDebug("my_segment_pktsizes[i] %u, my_segment_poolsizes[i] %u", my_segment_pktsizes[i], my_segment_poolsizes[i]); if (!quiet) SCLogConfig("segment pool: pktsize %u, prealloc %u", my_segment_pktsizes[i], my_segment_poolsizes[i]); } uint16_t idx = 0; uint16_t u16 = 0; while (1) { if (idx <= my_segment_pktsizes[u16]) { segment_pool_idx[idx] = u16; if (my_segment_pktsizes[u16] == idx) u16++; } if (idx == 0xffff) break; idx++; } /* set the globals */ segment_pool = my_segment_pool; segment_pool_mutex = my_segment_lock; segment_pool_pktsizes = my_segment_pktsizes; segment_pool_num = npools; uint32_t stream_chunk_prealloc = 250; ConfNode *chunk = ConfGetNode("stream.reassembly.chunk-prealloc"); if (chunk) { uint32_t prealloc = 0; if (ByteExtractStringUint32(&prealloc, 10, strlen(chunk->val), chunk->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "chunk-prealloc of " "%s is invalid", chunk->val); return -1; } stream_chunk_prealloc = prealloc; } if (!quiet) SCLogConfig("stream.reassembly \"chunk-prealloc\": %u", stream_chunk_prealloc); StreamMsgQueuesInit(stream_chunk_prealloc); intmax_t zero_copy_size = 128; if (ConfGetInt("stream.reassembly.zero-copy-size", &zero_copy_size) == 1) { if (zero_copy_size < 0 || zero_copy_size > 0xffff) { SCLogError(SC_ERR_INVALID_ARGUMENT, "stream.reassembly.zero-copy-size of " "%"PRIiMAX" is invalid: valid values are 0 to 65535", zero_copy_size); return -1; } } stream_config.zero_copy_size = (uint16_t)zero_copy_size; if (!quiet) SCLogConfig("stream.reassembly \"zero-copy-size\": %u", stream_config.zero_copy_size); return 0; } int StreamTcpReassembleInit(char quiet) { /* init the memcap/use tracker */ SC_ATOMIC_INIT(ra_memuse); if (StreamTcpReassemblyConfig(quiet) < 0) return -1; #ifdef DEBUG SCMutexInit(&segment_pool_memuse_mutex, NULL); SCMutexInit(&segment_pool_cnt_mutex, NULL); #endif StatsRegisterGlobalCounter("tcp.reassembly_memuse", StreamTcpReassembleMemuseGlobalCounter); return 0; } #ifdef DEBUG static uint32_t dbg_app_layer_gap; static uint32_t dbg_app_layer_gap_candidate; #endif void StreamTcpReassembleFree(char quiet) { uint16_t u16 = 0; for (u16 = 0; u16 < segment_pool_num; u16++) { SCMutexLock(&segment_pool_mutex[u16]); if (quiet == FALSE) { PoolPrintSaturation(segment_pool[u16]); SCLogDebug("segment_pool[u16]->empty_stack_size %"PRIu32", " "segment_pool[u16]->alloc_stack_size %"PRIu32", alloced " "%"PRIu32"", segment_pool[u16]->empty_stack_size, segment_pool[u16]->alloc_stack_size, segment_pool[u16]->allocated); if (segment_pool[u16]->max_outstanding > segment_pool[u16]->allocated) { SCLogPerf("TCP segment pool of size %u had a peak use of %u segments, " "more than the prealloc setting of %u", segment_pool_pktsizes[u16], segment_pool[u16]->max_outstanding, segment_pool[u16]->allocated); } } PoolFree(segment_pool[u16]); SCMutexUnlock(&segment_pool_mutex[u16]); SCMutexDestroy(&segment_pool_mutex[u16]); } SCFree(segment_pool); SCFree(segment_pool_mutex); SCFree(segment_pool_pktsizes); segment_pool = NULL; segment_pool_mutex = NULL; segment_pool_pktsizes = NULL; StreamMsgQueuesDeinit(quiet); #ifdef DEBUG SCLogDebug("segment_pool_cnt %"PRIu64"", segment_pool_cnt); SCLogDebug("segment_pool_memuse %"PRIu64"", segment_pool_memuse); SCLogDebug("segment_pool_memcnt %"PRIu64"", segment_pool_memcnt); SCMutexDestroy(&segment_pool_memuse_mutex); SCMutexDestroy(&segment_pool_cnt_mutex); SCLogPerf("dbg_app_layer_gap %u", dbg_app_layer_gap); SCLogPerf("dbg_app_layer_gap_candidate %u", dbg_app_layer_gap_candidate); #endif } TcpReassemblyThreadCtx *StreamTcpReassembleInitThreadCtx(ThreadVars *tv) { SCEnter(); TcpReassemblyThreadCtx *ra_ctx = SCMalloc(sizeof(TcpReassemblyThreadCtx)); if (unlikely(ra_ctx == NULL)) return NULL; memset(ra_ctx, 0x00, sizeof(TcpReassemblyThreadCtx)); ra_ctx->app_tctx = AppLayerGetCtxThread(tv); SCReturnPtr(ra_ctx, "TcpReassemblyThreadCtx"); } void StreamTcpReassembleFreeThreadCtx(TcpReassemblyThreadCtx *ra_ctx) { SCEnter(); AppLayerDestroyCtxThread(ra_ctx->app_tctx); #ifdef DEBUG SCLogDebug("reassembly fast path stats: fp1 %"PRIu64" fp2 %"PRIu64" sp %"PRIu64, ra_ctx->fp1, ra_ctx->fp2, ra_ctx->sp); #endif SCFree(ra_ctx); SCReturn; } void PrintList2(TcpSegment *seg) { TcpSegment *prev_seg = NULL; if (seg == NULL) return; uint32_t next_seq = seg->seq; while (seg != NULL) { if (SEQ_LT(next_seq,seg->seq)) { SCLogDebug("missing segment(s) for %" PRIu32 " bytes of data", (seg->seq - next_seq)); } SCLogDebug("seg %10"PRIu32" len %" PRIu16 ", seg %p, prev %p, next %p", seg->seq, seg->payload_len, seg, seg->prev, seg->next); if (seg->prev != NULL && SEQ_LT(seg->seq,seg->prev->seq)) { /* check for SEQ_LT cornercase where a - b is exactly 2147483648, * which makes the marco return TRUE in both directions. This is * a hack though, we're going to check next how we end up with * a segment list with seq differences that big */ if (!(SEQ_LT(seg->prev->seq,seg->seq))) { SCLogDebug("inconsistent list: SEQ_LT(seg->seq,seg->prev->seq)) ==" " TRUE, seg->seq %" PRIu32 ", seg->prev->seq %" PRIu32 "" "", seg->seq, seg->prev->seq); } } if (SEQ_LT(seg->seq,next_seq)) { SCLogDebug("inconsistent list: SEQ_LT(seg->seq,next_seq)) == TRUE, " "seg->seq %" PRIu32 ", next_seq %" PRIu32 "", seg->seq, next_seq); } if (prev_seg != seg->prev) { SCLogDebug("inconsistent list: prev_seg %p != seg->prev %p", prev_seg, seg->prev); } next_seq = seg->seq + seg->payload_len; SCLogDebug("next_seq is now %"PRIu32"", next_seq); prev_seg = seg; seg = seg->next; } } void PrintList(TcpSegment *seg) { TcpSegment *prev_seg = NULL; TcpSegment *head_seg = seg; if (seg == NULL) return; uint32_t next_seq = seg->seq; while (seg != NULL) { if (SEQ_LT(next_seq,seg->seq)) { SCLogDebug("missing segment(s) for %" PRIu32 " bytes of data", (seg->seq - next_seq)); } SCLogDebug("seg %10"PRIu32" len %" PRIu16 ", seg %p, prev %p, next %p, flags 0x%02x", seg->seq, seg->payload_len, seg, seg->prev, seg->next, seg->flags); if (seg->prev != NULL && SEQ_LT(seg->seq,seg->prev->seq)) { /* check for SEQ_LT cornercase where a - b is exactly 2147483648, * which makes the marco return TRUE in both directions. This is * a hack though, we're going to check next how we end up with * a segment list with seq differences that big */ if (!(SEQ_LT(seg->prev->seq,seg->seq))) { SCLogDebug("inconsistent list: SEQ_LT(seg->seq,seg->prev->seq)) == " "TRUE, seg->seq %" PRIu32 ", seg->prev->seq %" PRIu32 "", seg->seq, seg->prev->seq); PrintList2(head_seg); abort(); } } if (SEQ_LT(seg->seq,next_seq)) { SCLogDebug("inconsistent list: SEQ_LT(seg->seq,next_seq)) == TRUE, " "seg->seq %" PRIu32 ", next_seq %" PRIu32 "", seg->seq, next_seq); PrintList2(head_seg); abort(); } if (prev_seg != seg->prev) { SCLogDebug("inconsistent list: prev_seg %p != seg->prev %p", prev_seg, seg->prev); PrintList2(head_seg); abort(); } next_seq = seg->seq + seg->payload_len; SCLogDebug("next_seq is now %"PRIu32"", next_seq); prev_seg = seg; seg = seg->next; } } /** * \internal * \brief Get the active ra_base_seq, considering stream gaps * * \retval seq the active ra_base_seq */ static inline uint32_t StreamTcpReassembleGetRaBaseSeq(TcpStream *stream) { if (!(stream->flags & STREAMTCP_STREAM_FLAG_GAP)) { SCReturnUInt(stream->ra_app_base_seq); } else { SCReturnUInt(stream->ra_raw_base_seq); } } /** * \internal * \brief Function to handle the insertion newly arrived segment, * The packet is handled based on its target OS. * * \param stream The given TCP stream to which this new segment belongs * \param seg Newly arrived segment * \param p received packet * * \retval 0 success * \retval -1 error -- either we hit a memory issue (OOM/memcap) or we received * a segment before ra_base_seq. */ int StreamTcpReassembleInsertSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, TcpSegment *seg, Packet *p) { SCEnter(); TcpSegment *list_seg = stream->seg_list; TcpSegment *next_list_seg = NULL; #if DEBUG PrintList(stream->seg_list); #endif int ret_value = 0; char return_seg = FALSE; /* before our ra_app_base_seq we don't insert it in our list, * or ra_raw_base_seq if in stream gap state */ if (SEQ_LT((TCP_GET_SEQ(p)+p->payload_len),(StreamTcpReassembleGetRaBaseSeq(stream)+1))) { SCLogDebug("not inserting: SEQ+payload %"PRIu32", last_ack %"PRIu32", " "ra_(app|raw)_base_seq %"PRIu32, (TCP_GET_SEQ(p)+p->payload_len), stream->last_ack, StreamTcpReassembleGetRaBaseSeq(stream)+1); return_seg = TRUE; ret_value = -1; StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEGMENT_BEFORE_BASE_SEQ); goto end; } SCLogDebug("SEQ %"PRIu32", SEQ+payload %"PRIu32", last_ack %"PRIu32", " "ra_app_base_seq %"PRIu32, TCP_GET_SEQ(p), (TCP_GET_SEQ(p)+p->payload_len), stream->last_ack, stream->ra_app_base_seq); if (seg == NULL) { goto end; } /* fast track */ if (list_seg == NULL) { SCLogDebug("empty list, inserting seg %p seq %" PRIu32 ", " "len %" PRIu32 "", seg, seg->seq, seg->payload_len); stream->seg_list = seg; seg->prev = NULL; stream->seg_list_tail = seg; goto end; } /* insert the segment in the stream list using this fast track, if seg->seq is equal or higher than stream->seg_list_tail.*/ if (SEQ_GEQ(seg->seq, (stream->seg_list_tail->seq + stream->seg_list_tail->payload_len))) { stream->seg_list_tail->next = seg; seg->prev = stream->seg_list_tail; stream->seg_list_tail = seg; goto end; } /* If the OS policy is not set then set the OS policy for this stream */ if (stream->os_policy == 0) { StreamTcpSetOSPolicy(stream, p); } for (; list_seg != NULL; list_seg = next_list_seg) { next_list_seg = list_seg->next; SCLogDebug("seg %p, list_seg %p, list_prev %p list_seg->next %p, " "segment length %" PRIu32 "", seg, list_seg, list_seg->prev, list_seg->next, seg->payload_len); SCLogDebug("seg->seq %"PRIu32", list_seg->seq %"PRIu32"", seg->seq, list_seg->seq); /* segment starts before list */ if (SEQ_LT(seg->seq, list_seg->seq)) { /* seg is entirely before list_seg */ if (SEQ_LEQ((seg->seq + seg->payload_len), list_seg->seq)) { SCLogDebug("before list seg: seg->seq %" PRIu32 ", list_seg->seq" " %" PRIu32 ", list_seg->payload_len %" PRIu32 ", " "list_seg->prev %p", seg->seq, list_seg->seq, list_seg->payload_len, list_seg->prev); seg->next = list_seg; if (list_seg->prev == NULL) { stream->seg_list = seg; } if (list_seg->prev != NULL) { list_seg->prev->next = seg; seg->prev = list_seg->prev; } list_seg->prev = seg; goto end; /* seg overlap with next seg(s) */ } else { ret_value = HandleSegmentStartsBeforeListSegment(tv, ra_ctx, stream, list_seg, seg, p); if (ret_value == 1) { ret_value = 0; return_seg = TRUE; goto end; } else if (ret_value == -1) { SCLogDebug("HandleSegmentStartsBeforeListSegment failed"); ret_value = -1; return_seg = TRUE; goto end; } } /* seg starts at same sequence number as list_seg */ } else if (SEQ_EQ(seg->seq, list_seg->seq)) { ret_value = HandleSegmentStartsAtSameListSegment(tv, ra_ctx, stream, list_seg, seg, p); if (ret_value == 1) { ret_value = 0; return_seg = TRUE; goto end; } else if (ret_value == -1) { SCLogDebug("HandleSegmentStartsAtSameListSegment failed"); ret_value = -1; return_seg = TRUE; goto end; } /* seg starts at sequence number higher than list_seg */ } else if (SEQ_GT(seg->seq, list_seg->seq)) { if (((SEQ_GEQ(seg->seq, (list_seg->seq + list_seg->payload_len)))) && SEQ_GT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { SCLogDebug("starts beyond list end, ends after list end: " "seg->seq %" PRIu32 ", list_seg->seq %" PRIu32 ", " "list_seg->payload_len %" PRIu32 " (%" PRIu32 ")", seg->seq, list_seg->seq, list_seg->payload_len, list_seg->seq + list_seg->payload_len); if (list_seg->next == NULL) { list_seg->next = seg; seg->prev = list_seg; stream->seg_list_tail = seg; goto end; } } else { ret_value = HandleSegmentStartsAfterListSegment(tv, ra_ctx, stream, list_seg, seg, p); if (ret_value == 1) { ret_value = 0; return_seg = TRUE; goto end; } else if (ret_value == -1) { SCLogDebug("HandleSegmentStartsAfterListSegment failed"); ret_value = -1; return_seg = TRUE; goto end; } } } } end: if (return_seg == TRUE && seg != NULL) { StreamTcpSegmentReturntoPool(seg); } #ifdef DEBUG PrintList(stream->seg_list); #endif SCReturnInt(ret_value); } /** * \brief Function to handle the newly arrived segment, when newly arrived * starts with the sequence number lower than the original segment and * ends at different position relative to original segment. * The packet is handled based on its target OS. * * \param list_seg Original Segment in the stream * \param seg Newly arrived segment * \param prev_seg Previous segment in the stream segment list * \param p Packet * * \retval 1 success and done * \retval 0 success, but not done yet * \retval -1 error, will *only* happen on memory errors */ static int HandleSegmentStartsBeforeListSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, TcpSegment *list_seg, TcpSegment *seg, Packet *p) { SCEnter(); uint16_t overlap = 0; uint16_t packet_length = 0; uint32_t overlap_point = 0; char end_before = FALSE; char end_after = FALSE; char end_same = FALSE; char return_after = FALSE; uint8_t os_policy = stream->os_policy; #ifdef DEBUG SCLogDebug("seg->seq %" PRIu32 ", seg->payload_len %" PRIu32 "", seg->seq, seg->payload_len); PrintList(stream->seg_list); #endif if (SEQ_GT((seg->seq + seg->payload_len), list_seg->seq) && SEQ_LT((seg->seq + seg->payload_len),(list_seg->seq + list_seg->payload_len))) { /* seg starts before list seg, ends beyond it but before list end */ end_before = TRUE; /* [aaaa[abab]bbbb] a = seg, b = list_seg, overlap is the part [abab] * We know seg->seq + seg->payload_len is bigger than list_seg->seq */ overlap = (seg->seq + seg->payload_len) - list_seg->seq; overlap_point = list_seg->seq; SCLogDebug("starts before list seg, ends before list end: seg->seq " "%" PRIu32 ", list_seg->seq %" PRIu32 ", " "list_seg->payload_len %" PRIu16 " overlap is %" PRIu32 ", " "overlap point %"PRIu32"", seg->seq, list_seg->seq, list_seg->payload_len, overlap, overlap_point); } else if (SEQ_EQ((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg fully overlaps list_seg, starts before, at end point * [aaa[ababab]] where a = seg, b = list_seg * overlap is [ababab], which is list_seg->payload_len */ overlap = list_seg->payload_len; end_same = TRUE; overlap_point = list_seg->seq; SCLogDebug("starts before list seg, ends at list end: list prev %p" "seg->seq %" PRIu32 ", list_seg->seq %" PRIu32 "," "list_seg->payload_len %" PRIu32 " overlap is %" PRIu32 "", list_seg->prev, seg->seq, list_seg->seq, list_seg->payload_len, overlap); /* seg fully overlaps list_seg, starts before, ends after list endpoint */ } else if (SEQ_GT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg fully overlaps list_seg, starts before, ends after list endpoint * [aaa[ababab]aaa] where a = seg, b = list_seg * overlap is [ababab] which is list_seg->payload_len */ overlap = list_seg->payload_len; end_after = TRUE; overlap_point = list_seg->seq; SCLogDebug("starts before list seg, ends after list end: seg->seq " "%" PRIu32 ", seg->payload_len %"PRIu32" list_seg->seq " "%" PRIu32 ", list_seg->payload_len %" PRIu32 " overlap is" " %" PRIu32 "", seg->seq, seg->payload_len, list_seg->seq, list_seg->payload_len, overlap); } if (overlap > 0) { /* handle the case where we need to fill a gap before list_seg first */ if (list_seg->prev != NULL && SEQ_LT((list_seg->prev->seq + list_seg->prev->payload_len), list_seg->seq)) { SCLogDebug("GAP to fill before list segment, size %u", list_seg->seq - (list_seg->prev->seq + list_seg->prev->payload_len)); uint32_t new_seq = (list_seg->prev->seq + list_seg->prev->payload_len); if (SEQ_GT(seg->seq, new_seq)) { new_seq = seg->seq; } packet_length = list_seg->seq - new_seq; if (packet_length > seg->payload_len) { packet_length = seg->payload_len; } TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; new_seg->seq = new_seq; SCLogDebug("new_seg->seq %"PRIu32" and new->payload_len " "%" PRIu16"", new_seg->seq, new_seg->payload_len); new_seg->next = list_seg; new_seg->prev = list_seg->prev; list_seg->prev->next = new_seg; list_seg->prev = new_seg; /* create a new seg, copy the list_seg data over */ StreamTcpSegmentDataCopy(new_seg, seg); #ifdef DEBUG PrintList(stream->seg_list); #endif } /* Handling case when the segment starts before the first segment in * the list */ if (list_seg->prev == NULL) { if (end_after == TRUE && list_seg->next != NULL && SEQ_LT(list_seg->next->seq, (seg->seq + seg->payload_len))) { packet_length = (list_seg->seq - seg->seq) + list_seg->payload_len; } else { packet_length = seg->payload_len + (list_seg->payload_len - overlap); return_after = TRUE; } SCLogDebug("entered here packet_length %" PRIu32 ", seg->payload_len" " %" PRIu32 ", list->payload_len %" PRIu32 "", packet_length, seg->payload_len, list_seg->payload_len); TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; new_seg->seq = seg->seq; new_seg->next = list_seg->next; new_seg->prev = list_seg->prev; StreamTcpSegmentDataCopy(new_seg, list_seg); /* first the data before the list_seg->seq */ uint16_t replace = (uint16_t) (list_seg->seq - seg->seq); SCLogDebug("copying %"PRIu16" bytes to new_seg", replace); StreamTcpSegmentDataReplace(new_seg, seg, seg->seq, replace); /* if any, data after list_seg->seq + list_seg->payload_len */ if (SEQ_GT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len)) && return_after == TRUE) { replace = (uint16_t)(((seg->seq + seg->payload_len) - (list_seg->seq + list_seg->payload_len))); SCLogDebug("replacing %"PRIu16"", replace); StreamTcpSegmentDataReplace(new_seg, seg, (list_seg->seq + list_seg->payload_len), replace); } /* update the stream last_seg in case of removal of list_seg */ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; StreamTcpSegmentReturntoPool(list_seg); list_seg = new_seg; if (new_seg->prev != NULL) { new_seg->prev->next = new_seg; } if (new_seg->next != NULL) { new_seg->next->prev = new_seg; } stream->seg_list = new_seg; SCLogDebug("list_seg now %p, stream->seg_list now %p", list_seg, stream->seg_list); } else if (end_before == TRUE || end_same == TRUE) { /* Handling overlapping with more than one segment and filling gap */ if (SEQ_GT(list_seg->seq, (list_seg->prev->seq + list_seg->prev->payload_len))) { SCLogDebug("list_seg->prev %p list_seg->prev->seq %"PRIu32" " "list_seg->prev->payload_len %"PRIu16"", list_seg->prev, list_seg->prev->seq, list_seg->prev->payload_len); if (SEQ_LT(list_seg->prev->seq, seg->seq)) { packet_length = list_seg->payload_len + (list_seg->seq - seg->seq); } else { packet_length = list_seg->payload_len + (list_seg->seq - (list_seg->prev->seq + list_seg->prev->payload_len)); } TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; if (SEQ_GT((list_seg->prev->seq + list_seg->prev->payload_len), seg->seq)) { new_seg->seq = (list_seg->prev->seq + list_seg->prev->payload_len); } else { new_seg->seq = seg->seq; } SCLogDebug("new_seg->seq %"PRIu32" and new->payload_len " "%" PRIu16"", new_seg->seq, new_seg->payload_len); new_seg->next = list_seg->next; new_seg->prev = list_seg->prev; StreamTcpSegmentDataCopy(new_seg, list_seg); uint16_t copy_len = (uint16_t) (list_seg->seq - seg->seq); SCLogDebug("copy_len %" PRIu32 " (%" PRIu32 " - %" PRIu32 ")", copy_len, list_seg->seq, seg->seq); StreamTcpSegmentDataReplace(new_seg, seg, seg->seq, copy_len); /*update the stream last_seg in case of removal of list_seg*/ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; StreamTcpSegmentReturntoPool(list_seg); list_seg = new_seg; if (new_seg->prev != NULL) { new_seg->prev->next = new_seg; } if (new_seg->next != NULL) { new_seg->next->prev = new_seg; } } } else if (end_after == TRUE) { if (list_seg->next != NULL) { if (SEQ_LEQ((seg->seq + seg->payload_len), list_seg->next->seq)) { if (SEQ_GT(seg->seq, (list_seg->prev->seq + list_seg->prev->payload_len))) { packet_length = list_seg->payload_len + (list_seg->seq - seg->seq); } else { packet_length = list_seg->payload_len + (list_seg->seq - (list_seg->prev->seq + list_seg->prev->payload_len)); } packet_length += (seg->seq + seg->payload_len) - (list_seg->seq + list_seg->payload_len); TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; if (SEQ_GT((list_seg->prev->seq + list_seg->prev->payload_len), seg->seq)) { new_seg->seq = (list_seg->prev->seq + list_seg->prev->payload_len); } else { new_seg->seq = seg->seq; } SCLogDebug("new_seg->seq %"PRIu32" and new->payload_len " "%" PRIu16"", new_seg->seq, new_seg->payload_len); new_seg->next = list_seg->next; new_seg->prev = list_seg->prev; /* create a new seg, copy the list_seg data over */ StreamTcpSegmentDataCopy(new_seg, list_seg); /* copy the part before list_seg */ uint16_t copy_len = list_seg->seq - new_seg->seq; StreamTcpSegmentDataReplace(new_seg, seg, new_seg->seq, copy_len); /* copy the part after list_seg */ copy_len = (seg->seq + seg->payload_len) - (list_seg->seq + list_seg->payload_len); StreamTcpSegmentDataReplace(new_seg, seg, (list_seg->seq + list_seg->payload_len), copy_len); if (new_seg->prev != NULL) { new_seg->prev->next = new_seg; } if (new_seg->next != NULL) { new_seg->next->prev = new_seg; } /*update the stream last_seg in case of removal of list_seg*/ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; StreamTcpSegmentReturntoPool(list_seg); list_seg = new_seg; return_after = TRUE; } /* Handle the case, when list_seg is the end of segment list, but seg is ending after the list_seg. So we need to copy the data from newly received segment. After copying return the newly received seg to pool */ } else { if (SEQ_GT(seg->seq, (list_seg->prev->seq + list_seg->prev->payload_len))) { packet_length = list_seg->payload_len + (list_seg->seq - seg->seq); } else { packet_length = list_seg->payload_len + (list_seg->seq - (list_seg->prev->seq + list_seg->prev->payload_len)); } packet_length += (seg->seq + seg->payload_len) - (list_seg->seq + list_seg->payload_len); TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; if (SEQ_GT((list_seg->prev->seq + list_seg->prev->payload_len), seg->seq)) { new_seg->seq = (list_seg->prev->seq + list_seg->prev->payload_len); } else { new_seg->seq = seg->seq; } SCLogDebug("new_seg->seq %"PRIu32" and new->payload_len " "%" PRIu16"", new_seg->seq, new_seg->payload_len); new_seg->next = list_seg->next; new_seg->prev = list_seg->prev; /* create a new seg, copy the list_seg data over */ StreamTcpSegmentDataCopy(new_seg, list_seg); /* copy the part before list_seg */ uint16_t copy_len = list_seg->seq - new_seg->seq; StreamTcpSegmentDataReplace(new_seg, seg, new_seg->seq, copy_len); /* copy the part after list_seg */ copy_len = (seg->seq + seg->payload_len) - (list_seg->seq + list_seg->payload_len); StreamTcpSegmentDataReplace(new_seg, seg, (list_seg->seq + list_seg->payload_len), copy_len); if (new_seg->prev != NULL) { new_seg->prev->next = new_seg; } /*update the stream last_seg in case of removal of list_seg*/ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; StreamTcpSegmentReturntoPool(list_seg); list_seg = new_seg; return_after = TRUE; } } if (check_overlap_different_data && !StreamTcpSegmentDataCompare(seg, list_seg, list_seg->seq, overlap)) { /* interesting, overlap with different data */ StreamTcpSetEvent(p, STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA); } if (StreamTcpInlineMode()) { if (StreamTcpInlineSegmentCompare(seg, list_seg) != 0) { StreamTcpInlineSegmentReplacePacket(p, list_seg); } } else { switch (os_policy) { case OS_POLICY_SOLARIS: case OS_POLICY_HPUX11: if (end_after == TRUE || end_same == TRUE) { StreamTcpSegmentDataReplace(list_seg, seg, overlap_point, overlap); } else { SCLogDebug("using old data in starts before list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); } break; case OS_POLICY_VISTA: case OS_POLICY_FIRST: SCLogDebug("using old data in starts before list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); break; case OS_POLICY_BSD: case OS_POLICY_HPUX10: case OS_POLICY_IRIX: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_OLD_LINUX: case OS_POLICY_LINUX: case OS_POLICY_MACOS: case OS_POLICY_LAST: default: SCLogDebug("replacing old data in starts before list seg " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); StreamTcpSegmentDataReplace(list_seg, seg, overlap_point, overlap); break; } } /* To return from for loop as seg is finished with current list_seg no need to check further (improve performance) */ if (end_before == TRUE || end_same == TRUE || return_after == TRUE) { SCReturnInt(1); } } SCReturnInt(0); } /** * \brief Function to handle the newly arrived segment, when newly arrived * starts with the same sequence number as the original segment and * ends at different position relative to original segment. * The packet is handled based on its target OS. * * \param list_seg Original Segment in the stream * \param seg Newly arrived segment * \param prev_seg Previous segment in the stream segment list * * \retval 1 success and done * \retval 0 success, but not done yet * \retval -1 error, will *only* happen on memory errors */ static int HandleSegmentStartsAtSameListSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, TcpSegment *list_seg, TcpSegment *seg, Packet *p) { uint16_t overlap = 0; uint16_t packet_length; char end_before = FALSE; char end_after = FALSE; char end_same = FALSE; char handle_beyond = FALSE; uint8_t os_policy = stream->os_policy; if (SEQ_LT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg->seg == list_seg->seq and list_seg->payload_len > seg->payload_len * [[ababab]bbbb] where a = seg, b = list_seg * overlap is the [ababab] part, which equals seg->payload_len. */ overlap = seg->payload_len; end_before = TRUE; SCLogDebug("starts at list seq, ends before list end: seg->seq " "%" PRIu32 ", list_seg->seq %" PRIu32 ", " "list_seg->payload_len %" PRIu32 " overlap is %" PRIu32, seg->seq, list_seg->seq, list_seg->payload_len, overlap); } else if (SEQ_EQ((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg starts at seq, ends at seq, retransmission. * both segments are the same, so overlap is either * seg->payload_len or list_seg->payload_len */ /* check csum, ack, other differences? */ overlap = seg->payload_len; end_same = TRUE; SCLogDebug("(retransmission) starts at list seq, ends at list end: " "seg->seq %" PRIu32 ", list_seg->seq %" PRIu32 ", " "list_seg->payload_len %" PRIu32 " overlap is %"PRIu32"", seg->seq, list_seg->seq, list_seg->payload_len, overlap); } else if (SEQ_GT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg starts at seq, ends beyond seq. */ /* seg->seg == list_seg->seq and seg->payload_len > list_seg->payload_len * [[ababab]aaaa] where a = seg, b = list_seg * overlap is the [ababab] part, which equals list_seg->payload_len. */ overlap = list_seg->payload_len; end_after = TRUE; SCLogDebug("starts at list seq, ends beyond list end: seg->seq " "%" PRIu32 ", list_seg->seq %" PRIu32 ", " "list_seg->payload_len %" PRIu32 " overlap is %" PRIu32 "", seg->seq, list_seg->seq, list_seg->payload_len, overlap); } if (overlap > 0) { /*Handle the case when newly arrived segment ends after original segment and original segment is the last segment in the list or the next segment in the list starts after the end of new segment*/ if (end_after == TRUE) { char fill_gap = FALSE; if (list_seg->next != NULL) { /* first see if we have space left to fill up */ if (SEQ_LT((list_seg->seq + list_seg->payload_len), list_seg->next->seq)) { fill_gap = TRUE; } /* then see if we overlap (partly) with the next seg */ if (SEQ_GT((seg->seq + seg->payload_len), list_seg->next->seq)) { handle_beyond = TRUE; } /* Handle the case, when list_seg is the end of segment list, but seg is ending after the list_seg. So we need to copy the data from newly received segment. After copying return the newly received seg to pool */ } else { fill_gap = TRUE; } SCLogDebug("fill_gap %s, handle_beyond %s", fill_gap?"TRUE":"FALSE", handle_beyond?"TRUE":"FALSE"); if (fill_gap == TRUE) { /* if there is a gap after this list_seg we fill it now with a * new seg */ SCLogDebug("filling gap: list_seg->next->seq %"PRIu32"", list_seg->next?list_seg->next->seq:0); if (handle_beyond == TRUE) { packet_length = list_seg->next->seq - (list_seg->seq + list_seg->payload_len); } else { packet_length = seg->payload_len - list_seg->payload_len; } SCLogDebug("packet_length %"PRIu16"", packet_length); TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("egment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); return -1; } new_seg->payload_len = packet_length; new_seg->seq = list_seg->seq + list_seg->payload_len; new_seg->next = list_seg->next; if (new_seg->next != NULL) new_seg->next->prev = new_seg; new_seg->prev = list_seg; list_seg->next = new_seg; SCLogDebug("new_seg %p, new_seg->next %p, new_seg->prev %p, " "list_seg->next %p", new_seg, new_seg->next, new_seg->prev, list_seg->next); StreamTcpSegmentDataReplace(new_seg, seg, new_seg->seq, new_seg->payload_len); /*update the stream last_seg in case of removal of list_seg*/ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; } } if (check_overlap_different_data && !StreamTcpSegmentDataCompare(list_seg, seg, seg->seq, overlap)) { /* interesting, overlap with different data */ StreamTcpSetEvent(p, STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA); } if (StreamTcpInlineMode()) { if (StreamTcpInlineSegmentCompare(list_seg, seg) != 0) { StreamTcpInlineSegmentReplacePacket(p, list_seg); } } else { switch (os_policy) { case OS_POLICY_OLD_LINUX: case OS_POLICY_SOLARIS: case OS_POLICY_HPUX11: if (end_after == TRUE || end_same == TRUE) { StreamTcpSegmentDataReplace(list_seg, seg, seg->seq, overlap); } else { SCLogDebug("using old data in starts at list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); } break; case OS_POLICY_LAST: StreamTcpSegmentDataReplace(list_seg, seg, seg->seq, overlap); break; case OS_POLICY_LINUX: if (end_after == TRUE) { StreamTcpSegmentDataReplace(list_seg, seg, seg->seq, overlap); } else { SCLogDebug("using old data in starts at list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); } break; case OS_POLICY_BSD: case OS_POLICY_HPUX10: case OS_POLICY_IRIX: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_VISTA: case OS_POLICY_MACOS: case OS_POLICY_FIRST: default: SCLogDebug("using old data in starts at list case, list_seg->seq" " %" PRIu32 " policy %" PRIu32 " overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); break; } } /* return 1 if we're done */ if (end_before == TRUE || end_same == TRUE || handle_beyond == FALSE) { return 1; } } return 0; } /** * \internal * \brief Function to handle the newly arrived segment, when newly arrived * starts with the sequence number higher than the original segment and * ends at different position relative to original segment. * The packet is handled based on its target OS. * * \param list_seg Original Segment in the stream * \param seg Newly arrived segment * \param prev_seg Previous segment in the stream segment list * \retval 1 success and done * \retval 0 success, but not done yet * \retval -1 error, will *only* happen on memory errors */ static int HandleSegmentStartsAfterListSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpStream *stream, TcpSegment *list_seg, TcpSegment *seg, Packet *p) { SCEnter(); uint16_t overlap = 0; uint16_t packet_length; char end_before = FALSE; char end_after = FALSE; char end_same = FALSE; char handle_beyond = FALSE; uint8_t os_policy = stream->os_policy; if (SEQ_LT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg starts after list, ends before list end * [bbbb[ababab]bbbb] where a = seg, b = list_seg * overlap is the part [ababab] which is seg->payload_len */ overlap = seg->payload_len; end_before = TRUE; SCLogDebug("starts beyond list seq, ends before list end: seg->seq" " %" PRIu32 ", list_seg->seq %" PRIu32 ", list_seg->payload_len " "%" PRIu32 " overlap is %" PRIu32 "", seg->seq, list_seg->seq, list_seg->payload_len, overlap); } else if (SEQ_EQ((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg starts after seq, before end, ends at seq * [bbbb[ababab]] where a = seg, b = list_seg * overlapping part is [ababab], thus seg->payload_len */ overlap = seg->payload_len; end_same = TRUE; SCLogDebug("starts beyond list seq, ends at list end: seg->seq" " %" PRIu32 ", list_seg->seq %" PRIu32 ", list_seg->payload_len " "%" PRIu32 " overlap is %" PRIu32 "", seg->seq, list_seg->seq, list_seg->payload_len, overlap); } else if (SEQ_LT(seg->seq, list_seg->seq + list_seg->payload_len) && SEQ_GT((seg->seq + seg->payload_len), (list_seg->seq + list_seg->payload_len))) { /* seg starts after seq, before end, ends beyond seq. * * [bbb[ababab]aaa] where a = seg, b = list_seg. * overlap is the [ababab] part, which can be get using: * (list_seg->seq + list_seg->payload_len) - seg->seg */ overlap = (list_seg->seq + list_seg->payload_len) - seg->seq; end_after = TRUE; SCLogDebug("starts beyond list seq, ends after list seq end: " "seg->seq %" PRIu32 ", seg->payload_len %"PRIu16" (%"PRIu32") " "list_seg->seq %" PRIu32 ", list_seg->payload_len %" PRIu32 " " "(%"PRIu32") overlap is %" PRIu32 "", seg->seq, seg->payload_len, seg->seq + seg->payload_len, list_seg->seq, list_seg->payload_len, list_seg->seq + list_seg->payload_len, overlap); } if (overlap > 0) { /*Handle the case when newly arrived segment ends after original segment and original segment is the last segment in the list*/ if (end_after == TRUE) { char fill_gap = FALSE; if (list_seg->next != NULL) { /* first see if we have space left to fill up */ if (SEQ_LT((list_seg->seq + list_seg->payload_len), list_seg->next->seq)) { fill_gap = TRUE; } /* then see if we overlap (partly) with the next seg */ if (SEQ_GT((seg->seq + seg->payload_len), list_seg->next->seq)) { handle_beyond = TRUE; } } else { fill_gap = TRUE; } SCLogDebug("fill_gap %s, handle_beyond %s", fill_gap?"TRUE":"FALSE", handle_beyond?"TRUE":"FALSE"); if (fill_gap == TRUE) { /* if there is a gap after this list_seg we fill it now with a * new seg */ if (list_seg->next != NULL) { SCLogDebug("filling gap: list_seg->next->seq %"PRIu32"", list_seg->next?list_seg->next->seq:0); packet_length = list_seg->next->seq - (list_seg->seq + list_seg->payload_len); } else { packet_length = seg->payload_len - overlap; } if (packet_length > (seg->payload_len - overlap)) { packet_length = seg->payload_len - overlap; } SCLogDebug("packet_length %"PRIu16"", packet_length); TcpSegment *new_seg = StreamTcpGetSegment(tv, ra_ctx, packet_length); if (new_seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[packet_length]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } new_seg->payload_len = packet_length; new_seg->seq = list_seg->seq + list_seg->payload_len; new_seg->next = list_seg->next; if (new_seg->next != NULL) new_seg->next->prev = new_seg; new_seg->prev = list_seg; list_seg->next = new_seg; SCLogDebug("new_seg %p, new_seg->next %p, new_seg->prev %p, " "list_seg->next %p new_seg->seq %"PRIu32"", new_seg, new_seg->next, new_seg->prev, list_seg->next, new_seg->seq); StreamTcpSegmentDataReplace(new_seg, seg, new_seg->seq, new_seg->payload_len); /* update the stream last_seg in case of removal of list_seg */ if (stream->seg_list_tail == list_seg) stream->seg_list_tail = new_seg; } } if (check_overlap_different_data && !StreamTcpSegmentDataCompare(list_seg, seg, seg->seq, overlap)) { /* interesting, overlap with different data */ StreamTcpSetEvent(p, STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA); } if (StreamTcpInlineMode()) { if (StreamTcpInlineSegmentCompare(list_seg, seg) != 0) { StreamTcpInlineSegmentReplacePacket(p, list_seg); } } else { switch (os_policy) { case OS_POLICY_SOLARIS: case OS_POLICY_HPUX11: if (end_after == TRUE) { StreamTcpSegmentDataReplace(list_seg, seg, seg->seq, overlap); } else { SCLogDebug("using old data in starts beyond list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); } break; case OS_POLICY_LAST: StreamTcpSegmentDataReplace(list_seg, seg, seg->seq, overlap); break; case OS_POLICY_BSD: case OS_POLICY_HPUX10: case OS_POLICY_IRIX: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_VISTA: case OS_POLICY_OLD_LINUX: case OS_POLICY_LINUX: case OS_POLICY_MACOS: case OS_POLICY_FIRST: default: /* DEFAULT POLICY */ SCLogDebug("using old data in starts beyond list case, " "list_seg->seq %" PRIu32 " policy %" PRIu32 " " "overlap %" PRIu32 "", list_seg->seq, os_policy, overlap); break; } } if (end_before == TRUE || end_same == TRUE || handle_beyond == FALSE) { SCReturnInt(1); } } SCReturnInt(0); } /** * \brief check if stream in pkt direction has depth reached * * \param p packet with *LOCKED* flow * * \retval 1 stream has depth reached * \retval 0 stream does not have depth reached */ int StreamTcpReassembleDepthReached(Packet *p) { if (p->flow != NULL && p->flow->protoctx != NULL) { TcpSession *ssn = p->flow->protoctx; TcpStream *stream; if (p->flowflags & FLOW_PKT_TOSERVER) { stream = &ssn->client; } else { stream = &ssn->server; } return (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) ? 1 : 0; } return 0; } /** * \internal * \brief Function to Check the reassembly depth valuer against the * allowed max depth of the stream reassmbly for TCP streams. * * \param stream stream direction * \param seq sequence number where "size" starts * \param size size of the segment that is added * * \retval size Part of the size that fits in the depth, 0 if none */ static uint32_t StreamTcpReassembleCheckDepth(TcpSession *ssn, TcpStream *stream, uint32_t seq, uint32_t size) { SCEnter(); /* if the configured depth value is 0, it means there is no limit on reassembly depth. Otherwise carry on my boy ;) */ if (ssn->reassembly_depth == 0) { SCReturnUInt(size); } /* if the final flag is set, we're not accepting anymore */ if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { SCReturnUInt(0); } /* if the ra_base_seq has moved passed the depth window we stop * checking and just reject the rest of the packets including * retransmissions. Saves us the hassle of dealing with sequence * wraps as well */ if (SEQ_GEQ((StreamTcpReassembleGetRaBaseSeq(stream)+1),(stream->isn + ssn->reassembly_depth))) { stream->flags |= STREAMTCP_STREAM_FLAG_DEPTH_REACHED; SCReturnUInt(0); } SCLogDebug("full Depth not yet reached: %"PRIu32" <= %"PRIu32, (StreamTcpReassembleGetRaBaseSeq(stream)+1), (stream->isn + ssn->reassembly_depth)); if (SEQ_GEQ(seq, stream->isn) && SEQ_LT(seq, (stream->isn + ssn->reassembly_depth))) { /* packet (partly?) fits the depth window */ if (SEQ_LEQ((seq + size),(stream->isn + ssn->reassembly_depth))) { /* complete fit */ SCReturnUInt(size); } else { stream->flags |= STREAMTCP_STREAM_FLAG_DEPTH_REACHED; /* partial fit, return only what fits */ uint32_t part = (stream->isn + ssn->reassembly_depth) - seq; #if DEBUG BUG_ON(part > size); #else if (part > size) part = size; #endif SCReturnUInt(part); } } SCReturnUInt(0); } static void StreamTcpStoreStreamChunk(TcpSession *ssn, StreamMsg *smsg, const Packet *p, int streaminline) { uint8_t direction = 0; if ((!streaminline && (p->flowflags & FLOW_PKT_TOSERVER)) || ( streaminline && (p->flowflags & FLOW_PKT_TOCLIENT))) { direction = STREAM_TOCLIENT; SCLogDebug("stream chunk is to_client"); } else { direction = STREAM_TOSERVER; SCLogDebug("stream chunk is to_server"); } /* store the smsg in the tcp stream */ if (direction == STREAM_TOSERVER) { SCLogDebug("storing smsg in the to_server"); /* put the smsg in the stream list */ if (ssn->toserver_smsg_head == NULL) { ssn->toserver_smsg_head = smsg; ssn->toserver_smsg_tail = smsg; smsg->next = NULL; smsg->prev = NULL; } else { StreamMsg *cur = ssn->toserver_smsg_tail; cur->next = smsg; smsg->prev = cur; smsg->next = NULL; ssn->toserver_smsg_tail = smsg; } } else { SCLogDebug("storing smsg in the to_client"); /* put the smsg in the stream list */ if (ssn->toclient_smsg_head == NULL) { ssn->toclient_smsg_head = smsg; ssn->toclient_smsg_tail = smsg; smsg->next = NULL; smsg->prev = NULL; } else { StreamMsg *cur = ssn->toclient_smsg_tail; cur->next = smsg; smsg->prev = cur; smsg->next = NULL; ssn->toclient_smsg_tail = smsg; } } } /** * \brief Insert a packets TCP data into the stream reassembly engine. * * \retval 0 good segment, as far as we checked. * \retval -1 badness, reason to drop in inline mode * * If the retval is 0 the segment is inserted correctly, or overlap is handled, * or it wasn't added because of reassembly depth. * */ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); if (ssn->data_first_seen_dir == 0) { if (p->flowflags & FLOW_PKT_TOSERVER) { ssn->data_first_seen_dir = STREAM_TOSERVER; } else { ssn->data_first_seen_dir = STREAM_TOCLIENT; } } if ((ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) && (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED)) { SCLogDebug("ssn %p: both app and raw reassembly disabled, not reassembling", ssn); SCReturnInt(0); } /* If we have reached the defined depth for either of the stream, then stop reassembling the TCP session */ uint32_t size = StreamTcpReassembleCheckDepth(ssn, stream, TCP_GET_SEQ(p), p->payload_len); SCLogDebug("ssn %p: check depth returned %"PRIu32, ssn, size); if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { /* increment stream depth counter */ StatsIncr(tv, ra_ctx->counter_tcp_stream_depth); stream->flags |= STREAMTCP_STREAM_FLAG_NOREASSEMBLY; SCLogDebug("ssn %p: reassembly depth reached, " "STREAMTCP_STREAM_FLAG_NOREASSEMBLY set", ssn); } if (size == 0) { SCLogDebug("ssn %p: depth reached, not reassembling", ssn); SCReturnInt(0); } #if DEBUG BUG_ON(size > p->payload_len); #else if (size > p->payload_len) size = p->payload_len; #endif TcpSegment *seg = StreamTcpGetSegment(tv, ra_ctx, size); if (seg == NULL) { SCLogDebug("segment_pool[%"PRIu16"] is empty", segment_pool_idx[size]); StreamTcpSetEvent(p, STREAM_REASSEMBLY_NO_SEGMENT); SCReturnInt(-1); } memcpy(seg->payload, p->payload, size); seg->payload_len = size; seg->seq = TCP_GET_SEQ(p); if (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) seg->flags |= SEGMENTTCP_FLAG_APPLAYER_PROCESSED; /* if raw reassembly is disabled for new segments, flag each * segment as complete for raw before insert */ if (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED) { seg->flags |= SEGMENTTCP_FLAG_RAW_PROCESSED; SCLogDebug("segment %p flagged with SEGMENTTCP_FLAG_RAW_PROCESSED, " "flags %02x", seg, seg->flags); } /* proto detection skipped, but now we do get data. Set event. */ if (stream->seg_list == NULL && stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); } if (StreamTcpReassembleInsertSegment(tv, ra_ctx, stream, seg, p) != 0) { SCLogDebug("StreamTcpReassembleInsertSegment failed"); SCReturnInt(-1); } SCReturnInt(0); } static uint8_t StreamGetAppLayerFlags(TcpSession *ssn, TcpStream *stream, Packet *p) { uint8_t flag = 0; if (!(stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)) { flag |= STREAM_START; } if (ssn->state == TCP_CLOSED) { flag |= STREAM_EOF; } if (p->flags & PKT_PSEUDO_STREAM_END) { flag |= STREAM_EOF; } if (StreamTcpInlineMode() == 0) { if (p->flowflags & FLOW_PKT_TOSERVER) { flag |= STREAM_TOCLIENT; } else { flag |= STREAM_TOSERVER; } } else { if (p->flowflags & FLOW_PKT_TOSERVER) { flag |= STREAM_TOSERVER; } else { flag |= STREAM_TOCLIENT; } } if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { flag |= STREAM_DEPTH; } return flag; } static void StreamTcpSetupMsg(TcpSession *ssn, TcpStream *stream, Packet *p, StreamMsg *smsg) { SCEnter(); smsg->data_len = 0; SCLogDebug("smsg %p", smsg); SCReturn; } /** * \brief Check the minimum size limits for reassembly. * * \retval 0 don't reassemble yet * \retval 1 do reassemble */ static int StreamTcpReassembleRawCheckLimit(TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) { SCLogDebug("reassembling now as STREAMTCP_STREAM_FLAG_NOREASSEMBLY is set, so not expecting any new packets"); SCReturnInt(1); } if (ssn->flags & STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY) { SCLogDebug("reassembling now as STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY is set"); ssn->flags &= ~STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY; SCReturnInt(1); } if (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED) { SCLogDebug("reassembling now as STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED is set, " "so no new segments will be considered"); SCReturnInt(1); } /* some states mean we reassemble no matter how much data we have */ if (ssn->state >= TCP_TIME_WAIT) SCReturnInt(1); if (p->flags & PKT_PSEUDO_STREAM_END) SCReturnInt(1); /* check if we have enough data to send to L7 */ if (p->flowflags & FLOW_PKT_TOCLIENT) { SCLogDebug("StreamMsgQueueGetMinChunkLen(STREAM_TOSERVER) %"PRIu32, StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOSERVER)); if (StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOSERVER) > (stream->last_ack - stream->ra_raw_base_seq)) { SCLogDebug("toserver min chunk len not yet reached: " "last_ack %"PRIu32", ra_raw_base_seq %"PRIu32", %"PRIu32" < " "%"PRIu32"", stream->last_ack, stream->ra_raw_base_seq, (stream->last_ack - stream->ra_raw_base_seq), StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOSERVER)); SCReturnInt(0); } } else { SCLogDebug("StreamMsgQueueGetMinChunkLen(STREAM_TOCLIENT) %"PRIu32, StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOCLIENT)); if (StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOCLIENT) > (stream->last_ack - stream->ra_raw_base_seq)) { SCLogDebug("toclient min chunk len not yet reached: " "last_ack %"PRIu32", ra_base_seq %"PRIu32", %"PRIu32" < " "%"PRIu32"", stream->last_ack, stream->ra_raw_base_seq, (stream->last_ack - stream->ra_raw_base_seq), StreamMsgQueueGetMinChunkLen(FLOW_PKT_TOCLIENT)); SCReturnInt(0); } } SCReturnInt(1); } /** * \brief see if app layer is done with a segment * * \retval 1 app layer is done with this segment * \retval 0 not done yet */ #define StreamTcpAppLayerSegmentProcessed(ssn, stream, segment) \ (( ( (ssn)->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) || \ ( (stream)->flags & STREAMTCP_STREAM_FLAG_GAP ) || \ ( (segment)->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED ) ? 1 :0 )) /** \internal * \brief check if we can remove a segment from our segment list * * If a segment is entirely before the oldest smsg, we can discard it. Otherwise * we keep it around to be able to log it. * * \retval 1 yes * \retval 0 no */ static inline int StreamTcpReturnSegmentCheck(const Flow *f, TcpSession *ssn, TcpStream *stream, TcpSegment *seg) { if (stream == &ssn->client && ssn->toserver_smsg_head != NULL) { /* not (seg is entirely before first smsg, skip) */ if (!(SEQ_LEQ(seg->seq + seg->payload_len, ssn->toserver_smsg_head->seq))) { SCReturnInt(0); } } else if (stream == &ssn->server && ssn->toclient_smsg_head != NULL) { /* not (seg is entirely before first smsg, skip) */ if (!(SEQ_LEQ(seg->seq + seg->payload_len, ssn->toclient_smsg_head->seq))) { SCReturnInt(0); } } /* if proto detect isn't done, we're not returning */ if (!(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream))) { SCReturnInt(0); } /* check app layer conditions */ if (!(StreamTcpAppLayerSegmentProcessed(ssn, stream, seg))) { SCReturnInt(0); } /* check raw reassembly conditions */ if (!(seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED)) { SCReturnInt(0); } SCReturnInt(1); } static void StreamTcpRemoveSegmentFromStream(TcpStream *stream, TcpSegment *seg) { if (seg->prev == NULL) { stream->seg_list = seg->next; if (stream->seg_list != NULL) stream->seg_list->prev = NULL; } else { seg->prev->next = seg->next; if (seg->next != NULL) seg->next->prev = seg->prev; } if (stream->seg_list_tail == seg) stream->seg_list_tail = seg->prev; } /** * \brief Update the stream reassembly upon receiving a data segment * * | left edge | right edge based on sliding window size * [aaa] * [aaabbb] * ... * [aaabbbcccdddeeefff] * [bbbcccdddeeefffggg] <- cut off aaa to adhere to the window size * * GAP situation: each chunk that is uninterrupted has it's own smsg * [aaabbb].[dddeeefff] * [aaa].[ccc].[eeefff] * * A flag will be set to indicate where the *NEW* payload starts. This * is to aid the detection code for alert only sigs. * * \todo this function is too long, we need to break it up. It needs it BAD */ static int StreamTcpReassembleInlineRaw (TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); SCLogDebug("start p %p, seq %"PRIu32, p, TCP_GET_SEQ(p)); if (ssn->flags & STREAMTCP_FLAG_DISABLE_RAW) SCReturnInt(0); if (stream->seg_list == NULL) { SCReturnInt(0); } uint32_t ra_base_seq = stream->ra_raw_base_seq; StreamMsg *smsg = NULL; uint32_t smsg_offset = 0; uint16_t payload_offset = 0; uint16_t payload_len = 0; TcpSegment *seg = stream->seg_list; uint32_t next_seq = ra_base_seq + 1; int gap = 0; uint32_t chunk_size = PKT_IS_TOSERVER(p) ? stream_config.reassembly_toserver_chunk_size : stream_config.reassembly_toclient_chunk_size; /* determine the left edge and right edge */ uint32_t right_edge = TCP_GET_SEQ(p) + p->payload_len; uint32_t left_edge = right_edge - chunk_size; /* shift the window to the right if the left edge doesn't cover segments */ if (SEQ_GT(seg->seq,left_edge)) { right_edge += (seg->seq - left_edge); left_edge = seg->seq; } SCLogDebug("left_edge %"PRIu32", right_edge %"PRIu32, left_edge, right_edge); /* loop through the segments and fill one or more msgs */ for (; seg != NULL && SEQ_LT(seg->seq, right_edge); ) { SCLogDebug("seg %p", seg); /* If packets are fully before ra_base_seq, skip them. We do this * because we've reassembled up to the ra_base_seq point already, * so we won't do anything with segments before it anyway. */ SCLogDebug("checking for pre ra_base_seq %"PRIu32" seg %p seq %"PRIu32"" " len %"PRIu16", combined %"PRIu32" and right_edge " "%"PRIu32"", ra_base_seq, seg, seg->seq, seg->payload_len, seg->seq+seg->payload_len, right_edge); /* Remove the segments which are completely before the ra_base_seq */ if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - chunk_size))) { SCLogDebug("removing pre ra_base_seq %"PRIu32" seg %p seq %"PRIu32"" " len %"PRIu16"", ra_base_seq, seg, seg->seq, seg->payload_len); /* only remove if app layer reassembly is ready too */ if (StreamTcpAppLayerSegmentProcessed(ssn, stream, seg)) { TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; /* otherwise, just flag it for removal */ } else { seg->flags |= SEGMENTTCP_FLAG_RAW_PROCESSED; seg = seg->next; } continue; } /* if app layer protocol has been detected, then remove all the segments * which has been previously processed and reassembled * * If the stream is in GAP state the app layer flag won't be set */ if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream) && (seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) && StreamTcpAppLayerSegmentProcessed(ssn, stream, seg)) { SCLogDebug("segment(%p) of length %"PRIu16" has been processed," " so return it to pool", seg, seg->payload_len); TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; continue; } /* we've run into a sequence gap, wrap up any existing smsg and * queue it so the next chunk (if any) is in a new smsg */ if (SEQ_GT(seg->seq, next_seq)) { /* pass on pre existing smsg (if any) */ if (smsg != NULL && smsg->data_len > 0) { StreamTcpStoreStreamChunk(ssn, smsg, p, 1); stream->ra_raw_base_seq = ra_base_seq; smsg = NULL; } gap = 1; } /* if the segment ends beyond left_edge we need to consider it */ if (SEQ_GT((seg->seq + seg->payload_len), left_edge)) { SCLogDebug("seg->seq %" PRIu32 ", seg->payload_len %" PRIu32 ", " "left_edge %" PRIu32 "", seg->seq, seg->payload_len, left_edge); /* handle segments partly before ra_base_seq */ if (SEQ_GT(left_edge, seg->seq)) { payload_offset = left_edge - seg->seq; if (SEQ_LT(right_edge, (seg->seq + seg->payload_len))) { payload_len = (right_edge - seg->seq) - payload_offset; } else { payload_len = seg->payload_len - payload_offset; } if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); BUG_ON((payload_len + payload_offset) > seg->payload_len); } } else { payload_offset = 0; if (SEQ_LT(right_edge, (seg->seq + seg->payload_len))) { payload_len = right_edge - seg->seq; } else { payload_len = seg->payload_len; } } SCLogDebug("payload_offset is %"PRIu16", payload_len is %"PRIu16"" " and stream->last_ack is %"PRIu32"", payload_offset, payload_len, stream->last_ack); if (payload_len == 0) { SCLogDebug("no payload_len, so bail out"); break; } if (smsg == NULL) { smsg = StreamMsgGetFromPool(); if (smsg == NULL) { SCLogDebug("stream_msg_pool is empty"); return -1; } smsg_offset = 0; StreamTcpSetupMsg(ssn, stream, p, smsg); smsg->seq = ra_base_seq + 1; } /* copy the data into the smsg */ uint32_t copy_size = smsg->data_size - smsg_offset; if (copy_size > payload_len) { copy_size = payload_len; } if (SCLogDebugEnabled()) { BUG_ON(copy_size > smsg->data_size); } SCLogDebug("copy_size is %"PRIu16"", copy_size); memcpy(smsg->data + smsg_offset, seg->payload + payload_offset, copy_size); smsg_offset += copy_size; SCLogDebug("seg total %u, seq %u off %u copy %u, ra_base_seq %u", (seg->seq + payload_offset + copy_size), seg->seq, payload_offset, copy_size, ra_base_seq); if (gap == 0 && SEQ_GT((seg->seq + payload_offset + copy_size),ra_base_seq+1)) { ra_base_seq += copy_size; } SCLogDebug("ra_base_seq %"PRIu32, ra_base_seq); smsg->data_len += copy_size; /* queue the smsg if it's full */ if (smsg->data_len == smsg->data_size) { StreamTcpStoreStreamChunk(ssn, smsg, p, 1); stream->ra_raw_base_seq = ra_base_seq; smsg = NULL; } /* if the payload len is bigger than what we copied, we handle the * rest of the payload next... */ if (copy_size < payload_len) { SCLogDebug("copy_size %" PRIu32 " < %" PRIu32 "", copy_size, payload_len); payload_offset += copy_size; payload_len -= copy_size; SCLogDebug("payload_offset is %"PRIu16", seg->payload_len is " "%"PRIu16" and stream->last_ack is %"PRIu32"", payload_offset, seg->payload_len, stream->last_ack); if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } /* we need a while loop here as the packets theoretically can be * 64k */ char segment_done = FALSE; while (segment_done == FALSE) { SCLogDebug("new msg at offset %" PRIu32 ", payload_len " "%" PRIu32 "", payload_offset, payload_len); /* get a new message XXX we need a setup function */ smsg = StreamMsgGetFromPool(); if (smsg == NULL) { SCLogDebug("stream_msg_pool is empty"); SCReturnInt(-1); } smsg_offset = 0; StreamTcpSetupMsg(ssn, stream,p,smsg); smsg->seq = ra_base_seq + 1; copy_size = smsg->data_size - smsg_offset; if ((int32_t)copy_size > (seg->payload_len - payload_offset)) { copy_size = (seg->payload_len - payload_offset); } if (SCLogDebugEnabled()) { BUG_ON(copy_size > smsg->data_size); } SCLogDebug("copy payload_offset %" PRIu32 ", smsg_offset " "%" PRIu32 ", copy_size %" PRIu32 "", payload_offset, smsg_offset, copy_size); memcpy(smsg->data + smsg_offset, seg->payload + payload_offset, copy_size); smsg_offset += copy_size; if (gap == 0 && SEQ_GT((seg->seq + payload_offset + copy_size),ra_base_seq+1)) { ra_base_seq += copy_size; } SCLogDebug("ra_base_seq %"PRIu32, ra_base_seq); smsg->data_len += copy_size; SCLogDebug("copied payload_offset %" PRIu32 ", " "smsg_offset %" PRIu32 ", copy_size %" PRIu32 "", payload_offset, smsg_offset, copy_size); if (smsg->data_len == smsg->data_size) { StreamTcpStoreStreamChunk(ssn, smsg, p, 1); stream->ra_raw_base_seq = ra_base_seq; smsg = NULL; } /* see if we have segment payload left to process */ if ((copy_size + payload_offset) < seg->payload_len) { payload_offset += copy_size; payload_len -= copy_size; if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } } else { payload_offset = 0; segment_done = TRUE; } } } } /* done with this segment, return it to the pool */ TcpSegment *next_seg = seg->next; next_seq = seg->seq + seg->payload_len; if (SEQ_LT((seg->seq + seg->payload_len), (ra_base_seq - chunk_size))) { if (seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED) { StreamTcpRemoveSegmentFromStream(stream, seg); SCLogDebug("removing seg %p, seg->next %p", seg, seg->next); StreamTcpSegmentReturntoPool(seg); } else { seg->flags |= SEGMENTTCP_FLAG_RAW_PROCESSED; } } seg = next_seg; } /* put the partly filled smsg in the queue */ if (smsg != NULL) { StreamTcpStoreStreamChunk(ssn, smsg, p, 1); smsg = NULL; stream->ra_raw_base_seq = ra_base_seq; } /* see if we can clean up some segments */ left_edge = (ra_base_seq + 1) - chunk_size; SCLogDebug("left_edge %"PRIu32", ra_base_seq %"PRIu32, left_edge, ra_base_seq); /* loop through the segments to remove unneeded segments */ for (seg = stream->seg_list; seg != NULL && SEQ_LEQ((seg->seq + p->payload_len), left_edge); ) { SCLogDebug("seg %p seq %"PRIu32", len %"PRIu16", sum %"PRIu32, seg, seg->seq, seg->payload_len, seg->seq+seg->payload_len); /* only remove if app layer reassembly is ready too */ if (StreamTcpAppLayerSegmentProcessed(ssn, stream, seg)) { TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; } else { break; } } SCLogDebug("stream->ra_raw_base_seq %u", stream->ra_raw_base_seq); SCReturnInt(0); } /** \brief Remove idle TcpSegments from TcpSession * * \param f flow * \param flags direction flags */ void StreamTcpPruneSession(Flow *f, uint8_t flags) { if (f == NULL || f->protoctx == NULL) return; TcpSession *ssn = f->protoctx; TcpStream *stream = NULL; if (flags & STREAM_TOSERVER) { stream = &ssn->client; } else if (flags & STREAM_TOCLIENT) { stream = &ssn->server; } else { return; } /* loop through the segments and fill one or more msgs */ TcpSegment *seg = stream->seg_list; for (; seg != NULL && SEQ_LT(seg->seq, stream->last_ack);) { SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32", FLAGS %02x", seg, seg->seq, seg->payload_len, (uint32_t)(seg->seq + seg->payload_len), seg->flags); if (StreamTcpReturnSegmentCheck(f, ssn, stream, seg) == 0) { break; } TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; continue; } } #ifdef DEBUG static uint64_t GetStreamSize(TcpStream *stream) { if (stream) { uint64_t size = 0; uint32_t cnt = 0; TcpSegment *seg = stream->seg_list; while (seg) { cnt++; size += (uint64_t)seg->payload_len; seg = seg->next; } SCLogDebug("size %"PRIu64", cnt %"PRIu32, size, cnt); return size; } return (uint64_t)0; } static void GetSessionSize(TcpSession *ssn, Packet *p) { uint64_t size = 0; if (ssn) { size = GetStreamSize(&ssn->client); size += GetStreamSize(&ssn->server); //if (size > 900000) // SCLogInfo("size %"PRIu64", packet %"PRIu64, size, p->pcap_cnt); SCLogDebug("size %"PRIu64", packet %"PRIu64, size, p->pcap_cnt); } } #endif typedef struct ReassembleData_ { uint32_t ra_base_seq; uint32_t data_len; uint8_t data[4096]; int partial; /* last segment was processed only partially */ uint32_t data_sent; /* data passed on this run */ } ReassembleData; /** \internal * \brief test if segment follows a gap. If so, handle the gap * * If in inline mode, segment may be un-ack'd. In this case we * consider it a gap, but it's not 'final' yet. * * \retval bool 1 gap 0 no gap */ int DoHandleGap(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, TcpSegment *seg, ReassembleData *rd, Packet *p, uint32_t next_seq) { if (unlikely(SEQ_GT(seg->seq, next_seq))) { /* we've run into a sequence gap */ if (StreamTcpInlineMode()) { /* don't conclude it's a gap until we see that the data * that is missing was acked. */ if (SEQ_GT(seg->seq,stream->last_ack) && ssn->state != TCP_CLOSED) return 1; } /* first, pass on data before the gap */ if (rd->data_len > 0) { SCLogDebug("pre GAP data"); /* process what we have so far */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, rd->data, rd->data_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); rd->data_sent += rd->data_len; rd->data_len = 0; } #ifdef DEBUG uint32_t gap_len = seg->seq - next_seq; SCLogDebug("expected next_seq %" PRIu32 ", got %" PRIu32 " , " "stream->last_ack %" PRIu32 ". Seq gap %" PRIu32"", next_seq, seg->seq, stream->last_ack, gap_len); #endif /* We have missed the packet and end host has ack'd it, so * IDS should advance it's ra_base_seq and should not consider this * packet any longer, even if it is retransmitted, as end host will * drop it anyway */ rd->ra_base_seq = seg->seq - 1; /* send gap "signal" */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, NULL, 0, StreamGetAppLayerFlags(ssn, stream, p)|STREAM_GAP); AppLayerProfilingStore(ra_ctx->app_tctx, p); /* set a GAP flag and make sure not bothering this stream anymore */ SCLogDebug("STREAMTCP_STREAM_FLAG_GAP set"); stream->flags |= STREAMTCP_STREAM_FLAG_GAP; StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEQ_GAP); StatsIncr(tv, ra_ctx->counter_tcp_reass_gap); #ifdef DEBUG dbg_app_layer_gap++; #endif return 1; } return 0; } static inline int DoReassemble(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, TcpSegment *seg, ReassembleData *rd, Packet *p) { /* fast paths: send data directly into the app layer, w/o first doing * a copy step. However, don't use the fast path until protocol detection * has been completed * TODO if initial data is big enough for proto detect, we could do the * fast path anyway. */ if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED) { /* fast path 1: segment is exactly what we need */ if (likely(rd->data_len == 0 && SEQ_EQ(seg->seq, rd->ra_base_seq+1) && SEQ_EQ(stream->last_ack, (seg->seq + seg->payload_len)))) { /* process single segment directly */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, seg->payload, seg->payload_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); rd->data_sent += seg->payload_len; rd->ra_base_seq += seg->payload_len; #ifdef DEBUG ra_ctx->fp1++; #endif /* if after the first data chunk we have no alproto yet, * there is no point in continueing here. */ if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { SCLogDebug("no alproto after first data chunk"); return 0; } return 1; /* fast path 2: segment acked completely, meets minimal size req for 0copy processing */ } else if (rd->data_len == 0 && SEQ_EQ(seg->seq, rd->ra_base_seq+1) && SEQ_GT(stream->last_ack, (seg->seq + seg->payload_len)) && seg->payload_len >= stream_config.zero_copy_size) { /* process single segment directly */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, seg->payload, seg->payload_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); rd->data_sent += seg->payload_len; rd->ra_base_seq += seg->payload_len; #ifdef DEBUG ra_ctx->fp2++; #endif /* if after the first data chunk we have no alproto yet, * there is no point in continueing here. */ if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { SCLogDebug("no alproto after first data chunk"); return 0; } return 1; } } #ifdef DEBUG ra_ctx->sp++; #endif uint16_t payload_offset = 0; uint16_t payload_len = 0; /* start clean */ rd->partial = FALSE; /* if the segment ends beyond ra_base_seq we need to consider it */ if (SEQ_GT((seg->seq + seg->payload_len), rd->ra_base_seq+1)) { SCLogDebug("seg->seq %" PRIu32 ", seg->payload_len %" PRIu32 ", " "ra_base_seq %" PRIu32 ", last_ack %"PRIu32, seg->seq, seg->payload_len, rd->ra_base_seq, stream->last_ack); if (StreamTcpInlineMode() == 0) { /* handle segments partly before ra_base_seq */ if (SEQ_GT(rd->ra_base_seq, seg->seq)) { payload_offset = (rd->ra_base_seq + 1) - seg->seq; SCLogDebug("payload_offset %u", payload_offset); if (SEQ_LT(stream->last_ack, (seg->seq + seg->payload_len))) { if (SEQ_LT(stream->last_ack, (rd->ra_base_seq + 1))) { return 1; } else { payload_len = (stream->last_ack - seg->seq) - payload_offset; SCLogDebug("payload_len %u", payload_len); } rd->partial = TRUE; } else { payload_len = seg->payload_len - payload_offset; SCLogDebug("payload_len %u", payload_len); } if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); BUG_ON((payload_len + payload_offset) > seg->payload_len); } } else { payload_offset = 0; if (SEQ_LT(stream->last_ack, (seg->seq + seg->payload_len))) { payload_len = stream->last_ack - seg->seq; SCLogDebug("payload_len %u", payload_len); rd->partial = TRUE; } else { payload_len = seg->payload_len; SCLogDebug("payload_len %u", payload_len); } } /* inline mode, don't consider last_ack as we process un-ACK'd segments */ } else { /* handle segments partly before ra_base_seq */ if (SEQ_GT(rd->ra_base_seq, seg->seq)) { payload_offset = rd->ra_base_seq - seg->seq - 1; payload_len = seg->payload_len - payload_offset; if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); BUG_ON((payload_len + payload_offset) > seg->payload_len); } } else { payload_offset = 0; payload_len = seg->payload_len; } } SCLogDebug("payload_offset is %"PRIu16", payload_len is %"PRIu16"" " and stream->last_ack is %"PRIu32"", payload_offset, payload_len, stream->last_ack); if (payload_len == 0) { SCLogDebug("no payload_len, so bail out"); return 0; } /* copy the data into the buffer */ uint16_t copy_size = sizeof(rd->data) - rd->data_len; if (copy_size + payload_offset > seg->payload_len) { copy_size = seg->payload_len - payload_offset; } if (copy_size > payload_len) { copy_size = payload_len; } if (SCLogDebugEnabled()) { BUG_ON(copy_size > sizeof(rd->data)); BUG_ON(copy_size+payload_offset > seg->payload_len); BUG_ON(copy_size+payload_offset > seg->pool_size); } SCLogDebug("copy_size is %"PRIu16"", copy_size); memcpy(rd->data + rd->data_len, seg->payload + payload_offset, copy_size); rd->data_len += copy_size; rd->ra_base_seq += copy_size; SCLogDebug("ra_base_seq %"PRIu32", data_len %"PRIu32, rd->ra_base_seq, rd->data_len); /* queue the smsg if it's full */ if (rd->data_len == sizeof(rd->data)) { /* process what we have so far */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, rd->data, rd->data_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); rd->data_sent += rd->data_len; rd->data_len = 0; /* if after the first data chunk we have no alproto yet, * there is no point in continueing here. */ if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { SCLogDebug("no alproto after first data chunk"); return 0; } } /* if the payload len is bigger than what we copied, we handle the * rest of the payload next... */ if (copy_size < payload_len) { SCLogDebug("copy_size %" PRIu32 " < %" PRIu32 "", copy_size, payload_len); payload_offset += copy_size; payload_len -= copy_size; SCLogDebug("payload_offset is %"PRIu16", seg->payload_len is " "%"PRIu16" and stream->last_ack is %"PRIu32"", payload_offset, seg->payload_len, stream->last_ack); if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } /* we need a while loop here as the packets theoretically can be * 64k */ char segment_done = FALSE; while (segment_done == FALSE) { SCLogDebug("new msg at offset %" PRIu32 ", payload_len " "%" PRIu32 "", payload_offset, payload_len); rd->data_len = 0; copy_size = sizeof(rd->data) - rd->data_len; if (copy_size > (seg->payload_len - payload_offset)) { copy_size = (seg->payload_len - payload_offset); } if (SCLogDebugEnabled()) { BUG_ON(copy_size > sizeof(rd->data)); } SCLogDebug("copy payload_offset %" PRIu32 ", data_len " "%" PRIu32 ", copy_size %" PRIu32 "", payload_offset, rd->data_len, copy_size); memcpy(rd->data + rd->data_len, seg->payload + payload_offset, copy_size); rd->data_len += copy_size; rd->ra_base_seq += copy_size; SCLogDebug("ra_base_seq %"PRIu32, rd->ra_base_seq); SCLogDebug("copied payload_offset %" PRIu32 ", " "data_len %" PRIu32 ", copy_size %" PRIu32 "", payload_offset, rd->data_len, copy_size); if (rd->data_len == sizeof(rd->data)) { /* process what we have so far */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, rd->data, rd->data_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); rd->data_sent += rd->data_len; rd->data_len = 0; /* if after the first data chunk we have no alproto yet, * there is no point in continueing here. */ if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { SCLogDebug("no alproto after first data chunk"); return 0; } } /* see if we have segment payload left to process */ if ((copy_size + payload_offset) < seg->payload_len) { payload_offset += copy_size; payload_len -= copy_size; if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } } else { payload_offset = 0; segment_done = TRUE; } } } } return 1; } /** * \brief Update the stream reassembly upon receiving an ACK packet. * * Stream is in the opposite direction of the packet, as the ACK-packet * is ACK'ing the stream. * * One of the utilities call by this function AppLayerHandleTCPData(), * has a feature where it will call this very same function for the * stream opposing the stream it is called with. This shouldn't cause * any issues, since processing of each stream is independent of the * other stream. * * \todo this function is too long, we need to break it up. It needs it BAD */ int StreamTcpReassembleAppLayer (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); /* this function can be directly called by app layer protocol * detection. */ if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) { SCLogDebug("stream no reassembly flag set. Mostly called via " "app proto detection."); SCReturnInt(0); } SCLogDebug("stream->seg_list %p", stream->seg_list); #ifdef DEBUG PrintList(stream->seg_list); GetSessionSize(ssn, p); #endif /* Check if we have a gap at the start of the stream. 2 conditions: * 1. no segments, but last_ack moved fwd * 2. segments, but clearly some missing: if last_ack is * bigger than the list start and the list start is bigger than * next_seq, we know we are missing data that has been ack'd. That * won't get retransmitted, so it's a data gap. */ if (!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)) { int ackadd = (ssn->state >= TCP_FIN_WAIT2) ? 2 : 1; if ((stream->seg_list == NULL && /*1*/ stream->ra_app_base_seq == stream->isn && SEQ_GT(stream->last_ack, stream->isn + ackadd)) || (stream->seg_list != NULL && /*2*/ SEQ_GT(stream->seg_list->seq, stream->ra_app_base_seq+1) && SEQ_LT(stream->seg_list->seq, stream->last_ack))) { if (stream->seg_list == NULL) { SCLogDebug("no segs, last_ack moved fwd so GAP " "(base %u, isn %u, last_ack %u => diff %u) p %"PRIu64, stream->ra_app_base_seq, stream->isn, stream->last_ack, stream->last_ack - (stream->isn + ackadd), p->pcap_cnt); } /* send gap signal */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, NULL, 0, StreamGetAppLayerFlags(ssn, stream, p)|STREAM_GAP); AppLayerProfilingStore(ra_ctx->app_tctx, p); /* set a GAP flag and make sure not bothering this stream anymore */ SCLogDebug("STREAMTCP_STREAM_FLAG_GAP set"); stream->flags |= STREAMTCP_STREAM_FLAG_GAP; StreamTcpSetEvent(p, STREAM_REASSEMBLY_SEQ_GAP); StatsIncr(tv, ra_ctx->counter_tcp_reass_gap); #ifdef DEBUG dbg_app_layer_gap++; #endif SCReturnInt(0); } } /* if no segments are in the list or all are already processed, * and state is beyond established, we send an empty msg */ TcpSegment *seg_tail = stream->seg_list_tail; if (seg_tail == NULL || (seg_tail->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) { /* send an empty EOF msg if we have no segments but TCP state * is beyond ESTABLISHED */ if (ssn->state >= TCP_CLOSING || (p->flags & PKT_PSEUDO_STREAM_END)) { SCLogDebug("sending empty eof message"); /* send EOF to app layer */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, NULL, 0, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); SCReturnInt(0); } } /* no segments, nothing to do */ if (stream->seg_list == NULL) { SCLogDebug("no segments in the list to reassemble"); SCReturnInt(0); } if (stream->flags & STREAMTCP_STREAM_FLAG_GAP) { SCReturnInt(0); } /* stream->ra_app_base_seq remains at stream->isn until protocol is * detected. */ ReassembleData rd; rd.ra_base_seq = stream->ra_app_base_seq; rd.data_len = 0; rd.data_sent = 0; rd.partial = FALSE; uint32_t next_seq = rd.ra_base_seq + 1; SCLogDebug("ra_base_seq %"PRIu32", last_ack %"PRIu32", next_seq %"PRIu32, rd.ra_base_seq, stream->last_ack, next_seq); /* loop through the segments and fill one or more msgs */ TcpSegment *seg = stream->seg_list; SCLogDebug("pre-loop seg %p", seg); #ifdef DEBUG_VALIDATION uint64_t bytes = 0; #endif for (; seg != NULL; ) { #ifdef DEBUG_VALIDATION bytes += seg->payload_len; #endif /* if in inline mode, we process all segments regardless of whether * they are ack'd or not. In non-inline, we process only those that * are at least partly ack'd. */ if (StreamTcpInlineMode() == 0 && SEQ_GEQ(seg->seq, stream->last_ack)) break; SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32, seg, seg->seq, seg->payload_len, (uint32_t)(seg->seq + seg->payload_len)); if (StreamTcpReturnSegmentCheck(p->flow, ssn, stream, seg) == 1) { SCLogDebug("removing segment"); TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; continue; } else if (StreamTcpAppLayerSegmentProcessed(ssn, stream, seg)) { TcpSegment *next_seg = seg->next; seg = next_seg; continue; } /* check if we have a sequence gap and if so, handle it */ if (DoHandleGap(tv, ra_ctx, ssn, stream, seg, &rd, p, next_seq) == 1) break; /* process this segment */ if (DoReassemble(tv, ra_ctx, ssn, stream, seg, &rd, p) == 0) break; /* done with this segment, return it to the pool */ TcpSegment *next_seg = seg->next; next_seq = seg->seq + seg->payload_len; if (rd.partial == FALSE) { SCLogDebug("fully done with segment in app layer reassembly (seg %p seq %"PRIu32")", seg, seg->seq); seg->flags |= SEGMENTTCP_FLAG_APPLAYER_PROCESSED; SCLogDebug("flags now %02x", seg->flags); } else { SCLogDebug("not yet fully done with segment in app layer reassembly"); } seg = next_seg; } #ifdef DEBUG_VALIDATION /* we should never have this much data queued */ BUG_ON(bytes > 1000000ULL && bytes > (stream->window * 1.5)); #endif /* put the partly filled smsg in the queue to the l7 handler */ if (rd.data_len > 0) { SCLogDebug("data_len > 0, %u", rd.data_len); /* process what we have so far */ BUG_ON(rd.data_len > sizeof(rd.data)); AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, rd.data, rd.data_len, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); } /* if no data was sent to the applayer, we send it a empty 'nudge' * when in inline mode */ if (StreamTcpInlineMode() && rd.data_sent == 0 && ssn->state > TCP_ESTABLISHED) { SCLogDebug("sending empty eof message"); /* send EOF to app layer */ AppLayerHandleTCPData(tv, ra_ctx, p, p->flow, ssn, stream, NULL, 0, StreamGetAppLayerFlags(ssn, stream, p)); AppLayerProfilingStore(ra_ctx->app_tctx, p); } /* store ra_base_seq in the stream */ if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { stream->ra_app_base_seq = rd.ra_base_seq; } else { TcpSegment *tmp_seg = stream->seg_list; while (tmp_seg != NULL) { if (!(tmp_seg->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) break; tmp_seg->flags &= ~SEGMENTTCP_FLAG_APPLAYER_PROCESSED; tmp_seg = tmp_seg->next; } } SCLogDebug("stream->ra_app_base_seq %u", stream->ra_app_base_seq); SCReturnInt(0); } typedef struct ReassembleRawData_ { uint32_t ra_base_seq; int partial; /* last segment was processed only partially */ StreamMsg *smsg; uint32_t smsg_offset; // TODO diff with smsg->data_len? } ReassembleRawData; static void DoHandleRawGap(TcpSession *ssn, TcpStream *stream, TcpSegment *seg, Packet *p, ReassembleRawData *rd, uint32_t next_seq) { /* we've run into a sequence gap */ if (SEQ_GT(seg->seq, next_seq)) { /* pass on pre existing smsg (if any) */ if (rd->smsg != NULL && rd->smsg->data_len > 0) { /* if app layer protocol has not been detected till yet, then check did we have sent message to app layer already or not. If not then sent the message and set flag that first message has been sent. No more data till proto has not been detected */ StreamTcpStoreStreamChunk(ssn, rd->smsg, p, 0); stream->ra_raw_base_seq = rd->ra_base_seq; rd->smsg = NULL; } /* see what the length of the gap is, gap length is seg->seq - * (ra_base_seq +1) */ #ifdef DEBUG uint32_t gap_len = seg->seq - next_seq; SCLogDebug("expected next_seq %" PRIu32 ", got %" PRIu32 " , " "stream->last_ack %" PRIu32 ". Seq gap %" PRIu32"", next_seq, seg->seq, stream->last_ack, gap_len); #endif stream->ra_raw_base_seq = rd->ra_base_seq; /* We have missed the packet and end host has ack'd it, so * IDS should advance it's ra_base_seq and should not consider this * packet any longer, even if it is retransmitted, as end host will * drop it anyway */ rd->ra_base_seq = seg->seq - 1; } } static int DoRawReassemble(TcpSession *ssn, TcpStream *stream, TcpSegment *seg, Packet *p, ReassembleRawData *rd) { uint16_t payload_offset = 0; uint16_t payload_len = 0; /* start clean */ rd->partial = FALSE; /* if the segment ends beyond ra_base_seq we need to consider it */ if (SEQ_GT((seg->seq + seg->payload_len), rd->ra_base_seq+1)) { SCLogDebug("seg->seq %" PRIu32 ", seg->payload_len %" PRIu32 ", " "ra_base_seq %" PRIu32 "", seg->seq, seg->payload_len, rd->ra_base_seq); /* handle segments partly before ra_base_seq */ if (SEQ_GT(rd->ra_base_seq, seg->seq)) { payload_offset = rd->ra_base_seq - seg->seq; if (SEQ_LT(stream->last_ack, (seg->seq + seg->payload_len))) { if (SEQ_LT(stream->last_ack, rd->ra_base_seq)) { return 1; } else { payload_len = (stream->last_ack - seg->seq) - payload_offset; } rd->partial = TRUE; } else { payload_len = seg->payload_len - payload_offset; } if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); BUG_ON((payload_len + payload_offset) > seg->payload_len); } } else { payload_offset = 0; if (SEQ_LT(stream->last_ack, (seg->seq + seg->payload_len))) { payload_len = stream->last_ack - seg->seq; rd->partial = TRUE; } else { payload_len = seg->payload_len; } } SCLogDebug("payload_offset is %"PRIu16", payload_len is %"PRIu16"" " and stream->last_ack is %"PRIu32"", payload_offset, payload_len, stream->last_ack); if (payload_len == 0) { SCLogDebug("no payload_len, so bail out"); return 1; // TODO } if (rd->smsg == NULL) { rd->smsg = StreamMsgGetFromPool(); if (rd->smsg == NULL) { SCLogDebug("stream_msg_pool is empty"); return -1; } rd->smsg_offset = 0; StreamTcpSetupMsg(ssn, stream, p, rd->smsg); rd->smsg->seq = rd->ra_base_seq + 1; SCLogDebug("smsg->seq %u", rd->smsg->seq); } /* copy the data into the smsg */ uint32_t copy_size = rd->smsg->data_size - rd->smsg_offset; if (copy_size + payload_offset > seg->payload_len) { copy_size = seg->payload_len - payload_offset; } if (copy_size > payload_len) { copy_size = payload_len; } if (SCLogDebugEnabled()) { BUG_ON(copy_size > rd->smsg->data_size); } SCLogDebug("copy_size is %"PRIu16"", copy_size); memcpy(rd->smsg->data + rd->smsg_offset, seg->payload + payload_offset, copy_size); rd->smsg_offset += copy_size; rd->ra_base_seq += copy_size; SCLogDebug("ra_base_seq %"PRIu32, rd->ra_base_seq); rd->smsg->data_len += copy_size; /* queue the smsg if it's full */ if (rd->smsg->data_len == rd->smsg->data_size) { StreamTcpStoreStreamChunk(ssn, rd->smsg, p, 0); stream->ra_raw_base_seq = rd->ra_base_seq; rd->smsg = NULL; } /* if the payload len is bigger than what we copied, we handle the * rest of the payload next... */ if (copy_size < payload_len) { SCLogDebug("copy_size %" PRIu32 " < %" PRIu32 "", copy_size, payload_len); payload_offset += copy_size; payload_len -= copy_size; SCLogDebug("payload_offset is %"PRIu16", seg->payload_len is " "%"PRIu16" and stream->last_ack is %"PRIu32"", payload_offset, seg->payload_len, stream->last_ack); if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } /* we need a while loop here as the packets theoretically can be * 64k */ char segment_done = FALSE; while (segment_done == FALSE) { SCLogDebug("new msg at offset %" PRIu32 ", payload_len " "%" PRIu32 "", payload_offset, payload_len); /* get a new message XXX we need a setup function */ rd->smsg = StreamMsgGetFromPool(); if (rd->smsg == NULL) { SCLogDebug("stream_msg_pool is empty"); SCReturnInt(-1); } rd->smsg_offset = 0; StreamTcpSetupMsg(ssn, stream, p, rd->smsg); rd->smsg->seq = rd->ra_base_seq + 1; copy_size = rd->smsg->data_size - rd->smsg_offset; if (copy_size > payload_len) { copy_size = payload_len; } if (SCLogDebugEnabled()) { BUG_ON(copy_size > rd->smsg->data_size); } SCLogDebug("copy payload_offset %" PRIu32 ", smsg_offset " "%" PRIu32 ", copy_size %" PRIu32 "", payload_offset, rd->smsg_offset, copy_size); memcpy(rd->smsg->data + rd->smsg_offset, seg->payload + payload_offset, copy_size); rd->smsg_offset += copy_size; rd->ra_base_seq += copy_size; SCLogDebug("ra_base_seq %"PRIu32, rd->ra_base_seq); rd->smsg->data_len += copy_size; SCLogDebug("copied payload_offset %" PRIu32 ", " "smsg_offset %" PRIu32 ", copy_size %" PRIu32 "", payload_offset, rd->smsg_offset, copy_size); if (rd->smsg->data_len == rd->smsg->data_size) { StreamTcpStoreStreamChunk(ssn, rd->smsg, p, 0); stream->ra_raw_base_seq = rd->ra_base_seq; rd->smsg = NULL; } /* see if we have segment payload left to process */ if (copy_size < payload_len) { payload_offset += copy_size; payload_len -= copy_size; if (SCLogDebugEnabled()) { BUG_ON(payload_offset > seg->payload_len); } } else { payload_offset = 0; segment_done = TRUE; } } } } return 1; } /** * \brief Update the stream reassembly upon receiving an ACK packet. * \todo this function is too long, we need to break it up. It needs it BAD */ static int StreamTcpReassembleRaw (TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); SCLogDebug("start p %p", p); if (ssn->flags & STREAMTCP_FLAG_DISABLE_RAW) SCReturnInt(0); if (stream->seg_list == NULL) { SCLogDebug("no segments in the list to reassemble"); SCReturnInt(0); } #if 0 if (ssn->state <= TCP_ESTABLISHED && !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)) { SCLogDebug("only starting raw reassembly after app layer protocol " "detection has completed."); SCReturnInt(0); } #endif /* check if we have enough data */ if (StreamTcpReassembleRawCheckLimit(ssn,stream,p) == 0) { SCLogDebug("not yet reassembling"); SCReturnInt(0); } TcpSegment *seg = stream->seg_list; ReassembleRawData rd; rd.smsg = NULL; rd.ra_base_seq = stream->ra_raw_base_seq; rd.smsg_offset = 0; uint32_t next_seq = rd.ra_base_seq + 1; SCLogDebug("ra_base_seq %"PRIu32", last_ack %"PRIu32", next_seq %"PRIu32, rd.ra_base_seq, stream->last_ack, next_seq); /* loop through the segments and fill one or more msgs */ for (; seg != NULL && SEQ_LT(seg->seq, stream->last_ack);) { SCLogDebug("seg %p, SEQ %"PRIu32", LEN %"PRIu16", SUM %"PRIu32", flags %02x", seg, seg->seq, seg->payload_len, (uint32_t)(seg->seq + seg->payload_len), seg->flags); if (StreamTcpReturnSegmentCheck(p->flow, ssn, stream, seg) == 1) { SCLogDebug("removing segment"); TcpSegment *next_seg = seg->next; StreamTcpRemoveSegmentFromStream(stream, seg); StreamTcpSegmentReturntoPool(seg); seg = next_seg; continue; } else if(seg->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) { TcpSegment *next_seg = seg->next; seg = next_seg; continue; } DoHandleRawGap(ssn, stream, seg, p, &rd, next_seq); if (DoRawReassemble(ssn, stream, seg, p, &rd) == 0) break; /* done with this segment, return it to the pool */ TcpSegment *next_seg = seg->next; next_seq = seg->seq + seg->payload_len; if (rd.partial == FALSE) { SCLogDebug("fully done with segment in raw reassembly (seg %p seq %"PRIu32")", seg, seg->seq); seg->flags |= SEGMENTTCP_FLAG_RAW_PROCESSED; SCLogDebug("flags now %02x", seg->flags); } else { SCLogDebug("not yet fully done with segment in raw reassembly"); } seg = next_seg; } /* put the partly filled smsg in the queue to the l7 handler */ if (rd.smsg != NULL) { StreamTcpStoreStreamChunk(ssn, rd.smsg, p, 0); rd.smsg = NULL; stream->ra_raw_base_seq = rd.ra_base_seq; } SCReturnInt(0); } /** \brief update app layer and raw reassembly * * \retval r 0 on success, -1 on error */ int StreamTcpReassembleHandleSegmentUpdateACK (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); SCLogDebug("stream->seg_list %p", stream->seg_list); int r = 0; if (!(StreamTcpInlineMode())) { if (StreamTcpReassembleAppLayer(tv, ra_ctx, ssn, stream, p) < 0) r = -1; if (StreamTcpReassembleRaw(ra_ctx, ssn, stream, p) < 0) r = -1; } SCLogDebug("stream->seg_list %p", stream->seg_list); SCReturnInt(r); } int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, PacketQueue *pq) { SCEnter(); SCLogDebug("ssn %p, stream %p, p %p, p->payload_len %"PRIu16"", ssn, stream, p, p->payload_len); /* we need to update the opposing stream in * StreamTcpReassembleHandleSegmentUpdateACK */ TcpStream *opposing_stream = NULL; if (stream == &ssn->client) { opposing_stream = &ssn->server; } else { opposing_stream = &ssn->client; } /* handle ack received */ if (StreamTcpReassembleHandleSegmentUpdateACK(tv, ra_ctx, ssn, opposing_stream, p) != 0) { SCLogDebug("StreamTcpReassembleHandleSegmentUpdateACK error"); SCReturnInt(-1); } /* If no stream reassembly/application layer protocol inspection, then simple return */ if (p->payload_len > 0 && !(stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { SCLogDebug("calling StreamTcpReassembleHandleSegmentHandleData"); if (StreamTcpReassembleHandleSegmentHandleData(tv, ra_ctx, ssn, stream, p) != 0) { SCLogDebug("StreamTcpReassembleHandleSegmentHandleData error"); SCReturnInt(-1); } p->flags |= PKT_STREAM_ADD; } /* in stream inline mode even if we have no data we call the reassembly * functions to handle EOF */ if (StreamTcpInlineMode()) { int r = 0; if (StreamTcpReassembleAppLayer(tv, ra_ctx, ssn, stream, p) < 0) r = -1; if (StreamTcpReassembleInlineRaw(ra_ctx, ssn, stream, p) < 0) r = -1; if (r < 0) { SCReturnInt(-1); } } SCReturnInt(0); } /** * \brief Function to replace the data from a specific point up to given length. * * \param dst_seg Destination segment to replace the data * \param src_seg Source segment of which data is to be written to destination * \param start_point Starting point to replace the data onwards * \param len Length up to which data is need to be replaced * * \todo VJ We can remove the abort()s later. * \todo VJ Why not memcpy? */ void StreamTcpSegmentDataReplace(TcpSegment *dst_seg, TcpSegment *src_seg, uint32_t start_point, uint16_t len) { uint32_t seq; uint16_t src_pos = 0; uint16_t dst_pos = 0; SCLogDebug("start_point %u", start_point); if (SEQ_GT(start_point, dst_seg->seq)) { dst_pos = start_point - dst_seg->seq; } else if (SEQ_LT(start_point, dst_seg->seq)) { dst_pos = dst_seg->seq - start_point; } if (SCLogDebugEnabled()) { BUG_ON(((len + dst_pos) - 1) > dst_seg->payload_len); } else { if (((len + dst_pos) - 1) > dst_seg->payload_len) return; } src_pos = (uint16_t)(start_point - src_seg->seq); SCLogDebug("Replacing data from dst_pos %"PRIu16"", dst_pos); for (seq = start_point; SEQ_LT(seq, (start_point + len)) && src_pos < src_seg->payload_len && dst_pos < dst_seg->payload_len; seq++, dst_pos++, src_pos++) { dst_seg->payload[dst_pos] = src_seg->payload[src_pos]; } SCLogDebug("Replaced data of size %"PRIu16" up to src_pos %"PRIu16 " dst_pos %"PRIu16, len, src_pos, dst_pos); } /** * \brief Function to compare the data from a specific point up to given length. * * \param dst_seg Destination segment to compare the data * \param src_seg Source segment of which data is to be compared to destination * \param start_point Starting point to compare the data onwards * \param len Length up to which data is need to be compared * * \retval 1 same * \retval 0 different */ static int StreamTcpSegmentDataCompare(TcpSegment *dst_seg, TcpSegment *src_seg, uint32_t start_point, uint16_t len) { uint32_t seq; uint16_t src_pos = 0; uint16_t dst_pos = 0; SCLogDebug("start_point %u dst_seg %u src_seg %u", start_point, dst_seg->seq, src_seg->seq); if (SEQ_GT(start_point, dst_seg->seq)) { SCLogDebug("start_point %u > dst %u", start_point, dst_seg->seq); dst_pos = start_point - dst_seg->seq; } else if (SEQ_LT(start_point, dst_seg->seq)) { SCLogDebug("start_point %u < dst %u", start_point, dst_seg->seq); dst_pos = dst_seg->seq - start_point; } if (SCLogDebugEnabled()) { BUG_ON(((len + dst_pos) - 1) > dst_seg->payload_len); } else { if (((len + dst_pos) - 1) > dst_seg->payload_len) return 1; } src_pos = (uint16_t)(start_point - src_seg->seq); SCLogDebug("Comparing data from dst_pos %"PRIu16", src_pos %u", dst_pos, src_pos); for (seq = start_point; SEQ_LT(seq, (start_point + len)) && src_pos < src_seg->payload_len && dst_pos < dst_seg->payload_len; seq++, dst_pos++, src_pos++) { if (dst_seg->payload[dst_pos] != src_seg->payload[src_pos]) { SCLogDebug("data is different %02x != %02x, dst_pos %u, src_pos %u", dst_seg->payload[dst_pos], src_seg->payload[src_pos], dst_pos, src_pos); return 0; } } SCLogDebug("Compared data of size %"PRIu16" up to src_pos %"PRIu16 " dst_pos %"PRIu16, len, src_pos, dst_pos); return 1; } /** * \brief Function to copy the data from src_seg to dst_seg. * * \param dst_seg Destination segment for copying the contents * \param src_seg Source segment to copy its contents * * \todo VJ wouldn't a memcpy be more appropriate here? * * \warning Both segments need to be properly initialized. */ void StreamTcpSegmentDataCopy(TcpSegment *dst_seg, TcpSegment *src_seg) { uint32_t u; uint16_t dst_pos = 0; uint16_t src_pos = 0; uint32_t seq; if (SEQ_GT(dst_seg->seq, src_seg->seq)) { src_pos = dst_seg->seq - src_seg->seq; seq = dst_seg->seq; } else { dst_pos = src_seg->seq - dst_seg->seq; seq = src_seg->seq; } SCLogDebug("Copying data from seq %"PRIu32"", seq); for (u = seq; (SEQ_LT(u, (src_seg->seq + src_seg->payload_len)) && SEQ_LT(u, (dst_seg->seq + dst_seg->payload_len))); u++) { //SCLogDebug("u %"PRIu32, u); dst_seg->payload[dst_pos] = src_seg->payload[src_pos]; dst_pos++; src_pos++; } SCLogDebug("Copyied data of size %"PRIu16" up to dst_pos %"PRIu16"", src_pos, dst_pos); } /** * \brief Function to get the segment of required length from the pool. * * \param len Length which tells the required size of needed segment. * * \retval seg Segment from the pool or NULL */ TcpSegment* StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, uint16_t len) { uint16_t idx = segment_pool_idx[len]; SCLogDebug("segment_pool_idx %" PRIu32 " for payload_len %" PRIu32 "", idx, len); SCMutexLock(&segment_pool_mutex[idx]); TcpSegment *seg = (TcpSegment *) PoolGet(segment_pool[idx]); SCLogDebug("segment_pool[%u]->empty_stack_size %u, segment_pool[%u]->alloc_" "list_size %u, alloc %u", idx, segment_pool[idx]->empty_stack_size, idx, segment_pool[idx]->alloc_stack_size, segment_pool[idx]->allocated); SCMutexUnlock(&segment_pool_mutex[idx]); SCLogDebug("seg we return is %p", seg); if (seg == NULL) { SCLogDebug("segment_pool[%u]->empty_stack_size %u, " "alloc %u", idx, segment_pool[idx]->empty_stack_size, segment_pool[idx]->allocated); /* Increment the counter to show that we are not able to serve the segment request due to memcap limit */ StatsIncr(tv, ra_ctx->counter_tcp_segment_memcap); } else { seg->flags = stream_config.segment_init_flags; seg->next = NULL; seg->prev = NULL; } #ifdef DEBUG SCMutexLock(&segment_pool_cnt_mutex); segment_pool_cnt++; SCMutexUnlock(&segment_pool_cnt_mutex); #endif return seg; } /** * \brief Trigger RAW stream reassembly * * Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream * reassembly from the applayer, for example upon completion of a * HTTP request. * * Works by setting a flag in the TcpSession that is unset as soon * as it's checked. Since everything happens when operating under * a single lock period, no side effects are expected. * * \param ssn TcpSession */ void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn) { #ifdef DEBUG BUG_ON(ssn == NULL); #endif if (ssn != NULL) { SCLogDebug("flagged ssn %p for immediate raw reassembly", ssn); ssn->flags |= STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY; } } #ifdef UNITTESTS /** unit tests and it's support functions below */ static int UtTestSmsg(StreamMsg *smsg, const uint8_t *buf, uint32_t buf_len) { if (smsg == NULL) return 0; if (smsg->data_len != buf_len) { return 0; } if (!(memcmp(buf, smsg->data, buf_len) == 0)) { printf("data is not what we expected:\nExpected:\n"); PrintRawDataFp(stdout, (uint8_t *)buf, buf_len); printf("Got:\n"); PrintRawDataFp(stdout, smsg->data, smsg->data_len); return 0; } return 1; } static uint32_t UtSsnSmsgCnt(TcpSession *ssn, uint8_t direction) { uint32_t cnt = 0; StreamMsg *smsg = (direction == STREAM_TOSERVER) ? ssn->toserver_smsg_head : ssn->toclient_smsg_head; while (smsg) { cnt++; smsg = smsg->next; } return cnt; } /** \brief The Function tests the reassembly engine working for different * OSes supported. It includes all the OS cases and send * crafted packets to test the reassembly. * * \param stream The stream which will contain the reassembled segments */ static int StreamTcpReassembleStreamTest(TcpStream *stream) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->tcph->th_seq = htonl(12); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x42, 2, 4); /*BB*/ p->tcph->th_seq = htonl(16); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x43, 3, 4); /*CCC*/ p->tcph->th_seq = htonl(18); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x44, 1, 4); /*D*/ p->tcph->th_seq = htonl(22); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x45, 2, 4); /*EE*/ p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x46, 3, 4); /*FFF*/ p->tcph->th_seq = htonl(27); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x47, 2, 4); /*GG*/ p->tcph->th_seq = htonl(30); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x48, 2, 4); /*HH*/ p->tcph->th_seq = htonl(32); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x49, 1, 4); /*I*/ p->tcph->th_seq = htonl(34); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4a, 4, 4); /*JJJJ*/ p->tcph->th_seq = htonl(13); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 4; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4b, 3, 4); /*KKK*/ p->tcph->th_seq = htonl(18); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4c, 3, 4); /*LLL*/ p->tcph->th_seq = htonl(21); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4d, 3, 4); /*MMM*/ p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4e, 1, 4); /*N*/ p->tcph->th_seq = htonl(28); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4f, 1, 4); /*O*/ p->tcph->th_seq = htonl(31); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x50, 1, 4); /*P*/ p->tcph->th_seq = htonl(32); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x51, 2, 4); /*QQ*/ p->tcph->th_seq = htonl(34); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x30, 1, 4); /*0*/ p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpReassembleFreeThreadCtx(ra_ctx); SCFree(p); return 1; } /** \brief The Function to create the packet with given payload, which is used * to test the reassembly of the engine. * * \param payload The variable used to store the payload contents of the * current packet. * \param value The value which current payload will have for this packet * \param payload_len The length of the filed payload for current packet. * \param len Length of the payload array */ void StreamTcpCreateTestPacket(uint8_t *payload, uint8_t value, uint8_t payload_len, uint8_t len) { uint8_t i; for (i = 0; i < payload_len; i++) payload[i] = value; for (; i < len; i++) payload = NULL; } /** \brief The Function Checks the reassembled stream contents against predefined * stream contents according to OS policy used. * * \param stream_policy Predefined value of stream for different OS policies * \param stream Reassembled stream returned from the reassembly functions */ int StreamTcpCheckStreamContents(uint8_t *stream_policy, uint16_t sp_size, TcpStream *stream) { TcpSegment *temp; uint16_t i = 0; uint8_t j; #ifdef DEBUG if (SCLogDebugEnabled()) { TcpSegment *temp1; for (temp1 = stream->seg_list; temp1 != NULL; temp1 = temp1->next) PrintRawDataFp(stdout, temp1->payload, temp1->payload_len); PrintRawDataFp(stdout, stream_policy, sp_size); } #endif for (temp = stream->seg_list; temp != NULL; temp = temp->next) { j = 0; for (; j < temp->payload_len; j++) { SCLogDebug("i %"PRIu16", len %"PRIu32", stream %"PRIx32" and temp is %"PRIx8"", i, temp->payload_len, stream_policy[i], temp->payload[j]); if (stream_policy[i] == temp->payload[j]) { i++; continue; } else return 0; } } return 1; } /** \brief The Function Checks the Stream Queue contents against predefined * stream contents. * * \param stream_contents Predefined value of stream contents * \param stream Queue which has the stream contents * * \retval On success the function returns 1, on failure 0. */ static int StreamTcpCheckChunks (TcpSession *ssn, uint8_t *stream_contents) { SCEnter(); StreamMsg *msg; uint16_t i = 0; uint8_t j; uint8_t cnt = 0; if (ssn == NULL) { printf("ssn == NULL, "); SCReturnInt(0); } if (ssn->toserver_smsg_head == NULL) { printf("ssn->toserver_smsg_head == NULL, "); SCReturnInt(0); } msg = ssn->toserver_smsg_head; while(msg != NULL) { cnt++; j = 0; for (; j < msg->data_len; j++) { SCLogDebug("i is %" PRIu32 " and len is %" PRIu32 " and temp is %" PRIx32 "", i, msg->data_len, msg->data[j]); if (stream_contents[i] == msg->data[j]) { i++; continue; } else { SCReturnInt(0); } } msg = msg->next; } SCReturnInt(1); } /* \brief The function craft packets to test the overlapping, where * new segment stats before the list segment. * * \param stream The stream which will contain the reassembled segments and * also tells the OS policy used for reassembling the segments. */ static int StreamTcpTestStartsBeforeListSegment(TcpStream *stream) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 1, 4); /*B*/ p->tcph->th_seq = htonl(16); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x44, 1, 4); /*D*/ p->tcph->th_seq = htonl(22); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x45, 2, 4); /*EE*/ p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ p->tcph->th_seq = htonl(15); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4a, 4, 4); /*JJJJ*/ p->tcph->th_seq = htonl(14); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 4; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } SCLogDebug("sending segment with SEQ 21, len 3"); StreamTcpCreateTestPacket(payload, 0x4c, 3, 4); /*LLL*/ p->tcph->th_seq = htonl(21); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4d, 3, 4); /*MMM*/ p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } SCFree(p); return 1; } /* \brief The function craft packets to test the overlapping, where * new segment stats at the same seq no. as the list segment. * * \param stream The stream which will contain the reassembled segments and * also tells the OS policy used for reassembling the segments. */ static int StreamTcpTestStartsAtSameListSegment(TcpStream *stream) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, 4); /*CCC*/ p->tcph->th_seq = htonl(18); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x48, 2, 4); /*HH*/ p->tcph->th_seq = htonl(32); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x49, 1, 4); /*I*/ p->tcph->th_seq = htonl(34); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4b, 3, 4); /*KKK*/ p->tcph->th_seq = htonl(18); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4c, 4, 4); /*LLLL*/ p->tcph->th_seq = htonl(18); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 4; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x50, 1, 4); /*P*/ p->tcph->th_seq = htonl(32); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x51, 2, 4); /*QQ*/ p->tcph->th_seq = htonl(34); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } SCFree(p); return 1; } /* \brief The function craft packets to test the overlapping, where * new segment stats after the list segment. * * \param stream The stream which will contain the reassembled segments and * also tells the OS policy used for reassembling the segments. */ static int StreamTcpTestStartsAfterListSegment(TcpStream *stream) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ p->tcph->th_seq = htonl(12); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x46, 3, 4); /*FFF*/ p->tcph->th_seq = htonl(27); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 3; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x47, 2, 4); /*GG*/ p->tcph->th_seq = htonl(30); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4a, 2, 4); /*JJ*/ p->tcph->th_seq = htonl(13); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4f, 1, 4); /*O*/ p->tcph->th_seq = htonl(31); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpCreateTestPacket(payload, 0x4e, 1, 4); /*N*/ p->tcph->th_seq = htonl(28); p->tcph->th_ack = htonl(31); p->payload = payload; p->payload_len = 1; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, stream, p, &pq) == -1) { SCFree(p); return 0; } SCFree(p); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and BSD policy is used to reassemble * segments. */ static int StreamTcpReassembleTest01(void) { TcpStream stream; uint8_t stream_before_bsd[10] = {0x4a, 0x4a, 0x4a, 0x4a, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_bsd,sizeof(stream_before_bsd), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and BSD policy is used * to reassemble segments. */ static int StreamTcpReassembleTest02(void) { TcpStream stream; uint8_t stream_same_bsd[8] = {0x43, 0x43, 0x43, 0x4c, 0x48, 0x48, 0x49, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_bsd, sizeof(stream_same_bsd), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and BSD policy is used to reassemble * segments. */ static int StreamTcpReassembleTest03(void) { TcpStream stream; uint8_t stream_after_bsd[8] = {0x41, 0x41, 0x4a, 0x46, 0x46, 0x46, 0x47, 0x47}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_after_bsd, sizeof(stream_after_bsd), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and BSD policy is used to * reassemble segments. */ static int StreamTcpReassembleTest04(void) { TcpStream stream; uint8_t stream_bsd[25] = {0x30, 0x41, 0x41, 0x41, 0x4a, 0x4a, 0x42, 0x43, 0x43, 0x43, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d, 0x46, 0x46, 0x46, 0x47, 0x47, 0x48, 0x48, 0x49, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly: "); return 0; } if (StreamTcpCheckStreamContents(stream_bsd, sizeof(stream_bsd), &stream) == 0) { printf("failed in stream matching: "); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and VISTA policy is used to reassemble * segments. */ static int StreamTcpReassembleTest05(void) { TcpStream stream; uint8_t stream_before_vista[10] = {0x4a, 0x41, 0x42, 0x4a, 0x4c, 0x44, 0x4c, 0x4d, 0x45, 0x45}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_VISTA; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_vista, sizeof(stream_before_vista), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and VISTA policy is used * to reassemble segments. */ static int StreamTcpReassembleTest06(void) { TcpStream stream; uint8_t stream_same_vista[8] = {0x43, 0x43, 0x43, 0x4c, 0x48, 0x48, 0x49, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_VISTA; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_vista, sizeof(stream_same_vista), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and BSD policy is used to reassemble * segments. */ static int StreamTcpReassembleTest07(void) { TcpStream stream; uint8_t stream_after_vista[8] = {0x41, 0x41, 0x4a, 0x46, 0x46, 0x46, 0x47, 0x47}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_VISTA; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_after_vista, sizeof(stream_after_vista), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and VISTA policy is used to * reassemble segments. */ static int StreamTcpReassembleTest08(void) { TcpStream stream; uint8_t stream_vista[25] = {0x30, 0x41, 0x41, 0x41, 0x4a, 0x42, 0x42, 0x43, 0x43, 0x43, 0x4c, 0x44, 0x4c, 0x4d, 0x45, 0x45, 0x46, 0x46, 0x46, 0x47, 0x47, 0x48, 0x48, 0x49, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_VISTA; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_vista, sizeof(stream_vista), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and LINUX policy is used to reassemble * segments. */ static int StreamTcpReassembleTest09(void) { TcpStream stream; uint8_t stream_before_linux[10] = {0x4a, 0x4a, 0x4a, 0x4a, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_linux, sizeof(stream_before_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and LINUX policy is used * to reassemble segments. */ static int StreamTcpReassembleTest10(void) { TcpStream stream; uint8_t stream_same_linux[8] = {0x4c, 0x4c, 0x4c, 0x4c, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_linux, sizeof(stream_same_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and LINUX policy is used to reassemble * segments. */ static int StreamTcpReassembleTest11(void) { TcpStream stream; uint8_t stream_after_linux[8] = {0x41, 0x41, 0x4a, 0x46, 0x46, 0x46, 0x47, 0x47}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_after_linux, sizeof(stream_after_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and LINUX policy is used to * reassemble segments. */ static int StreamTcpReassembleTest12(void) { TcpStream stream; uint8_t stream_linux[25] = {0x30, 0x41, 0x41, 0x41, 0x4a, 0x4a, 0x42, 0x43, 0x43, 0x43, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d, 0x46, 0x46, 0x46, 0x47, 0x47, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_linux, sizeof(stream_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and OLD_LINUX policy is used to reassemble * segments. */ static int StreamTcpReassembleTest13(void) { TcpStream stream; uint8_t stream_before_old_linux[10] = {0x4a, 0x4a, 0x4a, 0x4a, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_OLD_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_old_linux, sizeof(stream_before_old_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and OLD_LINUX policy is * used to reassemble segments. */ static int StreamTcpReassembleTest14(void) { TcpStream stream; uint8_t stream_same_old_linux[8] = {0x4c, 0x4c, 0x4c, 0x4c, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_OLD_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_old_linux, sizeof(stream_same_old_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and OLD_LINUX policy is used to reassemble * segments. */ static int StreamTcpReassembleTest15(void) { TcpStream stream; uint8_t stream_after_old_linux[8] = {0x41, 0x41, 0x4a, 0x46, 0x46, 0x46, 0x47, 0x47}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_OLD_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_after_old_linux, sizeof(stream_after_old_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and OLD_LINUX policy is used to * reassemble segments. */ static int StreamTcpReassembleTest16(void) { TcpStream stream; uint8_t stream_old_linux[25] = {0x30, 0x41, 0x41, 0x41, 0x4a, 0x4a, 0x42, 0x4b, 0x4b, 0x4b, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d, 0x46, 0x46, 0x46, 0x47, 0x47, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_OLD_LINUX; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_old_linux, sizeof(stream_old_linux), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and SOLARIS policy is used to reassemble * segments. */ static int StreamTcpReassembleTest17(void) { TcpStream stream; uint8_t stream_before_solaris[10] = {0x4a, 0x4a, 0x4a, 0x4a, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_SOLARIS; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_solaris, sizeof(stream_before_solaris), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and SOLARIS policy is used * to reassemble segments. */ static int StreamTcpReassembleTest18(void) { TcpStream stream; uint8_t stream_same_solaris[8] = {0x4c, 0x4c, 0x4c, 0x4c, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_SOLARIS; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_solaris, sizeof(stream_same_solaris), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and SOLARIS policy is used to reassemble * segments. */ static int StreamTcpReassembleTest19(void) { TcpStream stream; uint8_t stream_after_solaris[8] = {0x41, 0x4a, 0x4a, 0x46, 0x46, 0x46, 0x47, 0x47}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_SOLARIS; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); StreamTcpFreeConfig(TRUE); return 0; } if (StreamTcpCheckStreamContents(stream_after_solaris, sizeof(stream_after_solaris), &stream) == 0) { printf("failed in stream matching!!\n"); StreamTcpFreeConfig(TRUE); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and SOLARIS policy is used to * reassemble segments. */ static int StreamTcpReassembleTest20(void) { TcpStream stream; uint8_t stream_solaris[25] = {0x30, 0x41, 0x4a, 0x4a, 0x4a, 0x42, 0x42, 0x4b, 0x4b, 0x4b, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d, 0x46, 0x46, 0x46, 0x47, 0x47, 0x48, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_SOLARIS; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly!!\n"); StreamTcpFreeConfig(TRUE); return 0; } if (StreamTcpCheckStreamContents(stream_solaris, sizeof(stream_solaris), &stream) == 0) { printf("failed in stream matching!!\n"); StreamTcpFreeConfig(TRUE); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * before the list segment and LAST policy is used to reassemble * segments. */ static int StreamTcpReassembleTest21(void) { TcpStream stream; uint8_t stream_before_last[10] = {0x4a, 0x4a, 0x4a, 0x4a, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LAST; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsBeforeListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_before_last, sizeof(stream_before_last), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * at the same seq no. as the list segment and LAST policy is used * to reassemble segments. */ static int StreamTcpReassembleTest22(void) { TcpStream stream; uint8_t stream_same_last[8] = {0x4c, 0x4c, 0x4c, 0x4c, 0x50, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LAST; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAtSameListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_same_last, sizeof(stream_same_last), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly when new segment starts * after the list segment and LAST policy is used to reassemble * segments. */ static int StreamTcpReassembleTest23(void) { TcpStream stream; uint8_t stream_after_last[8] = {0x41, 0x4a, 0x4a, 0x46, 0x4e, 0x46, 0x47, 0x4f}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LAST; StreamTcpInitConfig(TRUE); if (StreamTcpTestStartsAfterListSegment(&stream) == 0) { printf("failed in segments reassembly!!\n"); return 0; } if (StreamTcpCheckStreamContents(stream_after_last, sizeof(stream_after_last), &stream) == 0) { printf("failed in stream matching!!\n"); return 0; } StreamTcpFreeConfig(TRUE); return 1; } /** \brief The Function to test the reassembly engine for all the case * before, same and after overlapping and LAST policy is used to * reassemble segments. */ static int StreamTcpReassembleTest24(void) { int ret = 0; TcpStream stream; uint8_t stream_last[25] = {0x30, 0x41, 0x4a, 0x4a, 0x4a, 0x4a, 0x42, 0x4b, 0x4b, 0x4b, 0x4c, 0x4c, 0x4c, 0x4d, 0x4d, 0x4d, 0x46, 0x4e, 0x46, 0x47, 0x4f, 0x50, 0x48, 0x51, 0x51}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_LAST; StreamTcpInitConfig(TRUE); if (StreamTcpReassembleStreamTest(&stream) == 0) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckStreamContents(stream_last, sizeof(stream_last), &stream) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); return ret; } /** \brief The Function to test the missed packets handling with given payload, * which is used to test the reassembly of the engine. * * \param stream Stream which contain the packets * \param seq Sequence number of the packet * \param ack Acknowledgment number of the packet * \param payload The variable used to store the payload contents of the * current packet. * \param len The length of the payload for current packet. * \param th_flag The TCP flags * \param flowflags The packet flow direction * \param state The TCP session state * * \retval On success it returns 0 and on failure it return -1. */ static int StreamTcpTestMissedPacket (TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, uint32_t seq, uint32_t ack, uint8_t *payload, uint16_t len, uint8_t th_flags, uint8_t flowflags, uint8_t state) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return -1; Flow f; TCPHdr tcph; Port sp; Port dp; struct in_addr in; ThreadVars tv; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&tv, 0, sizeof (ThreadVars)); sp = 200; dp = 220; FLOW_INITIALIZE(&f); if (inet_pton(AF_INET, "1.2.3.4", &in) != 1) { SCFree(p); return -1; } f.src.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.5", &in) != 1) { SCFree(p); return -1; } f.dst.addr_data32[0] = in.s_addr; f.flags |= FLOW_IPV4; f.sp = sp; f.dp = dp; f.protoctx = ssn; f.proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = htons(5480); tcph.th_seq = htonl(seq); tcph.th_ack = htonl(ack); tcph.th_flags = th_flags; p->tcph = &tcph; p->flowflags = flowflags; p->payload = payload; p->payload_len = len; ssn->state = state; TcpStream *s = NULL; if (flowflags & FLOW_PKT_TOSERVER) { s = &ssn->server; } else { s = &ssn->client; } FLOWLOCK_WRLOCK(&f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, ssn, s, p, &pq) == -1) { FLOWLOCK_UNLOCK(&f); SCFree(p); return -1; } FLOWLOCK_UNLOCK(&f); SCFree(p); return 0; } /** * \test Test the handling of packets missed by both IDS and the end host. * The packet is missed in the starting of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest25 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; TcpSession ssn; uint8_t th_flag; uint8_t flowflags; uint8_t check_contents[7] = {0x41, 0x41, 0x41, 0x42, 0x42, 0x43, 0x43}; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); memset(&ssn, 0, sizeof (TcpSession)); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; ack = 20; StreamTcpInitConfig(TRUE); StreamTcpCreateTestPacket(payload, 0x42, 2, 4); /*BB*/ seq = 10; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } StreamTcpCreateTestPacket(payload, 0x43, 2, 4); /*CC*/ seq = 12; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } ssn.server.next_seq = 14; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ seq = 7; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckStreamContents(check_contents, sizeof(check_contents), &ssn.server) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the handling of packets missed by both IDS and the end host. * The packet is missed in the middle of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest26 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; TcpSession ssn; uint8_t th_flag; uint8_t flowflags; uint8_t check_contents[7] = {0x41, 0x41, 0x41, 0x42, 0x42, 0x43, 0x43}; memset(&ssn, 0, sizeof (TcpSession)); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; ack = 20; StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ seq = 10; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } StreamTcpCreateTestPacket(payload, 0x43, 2, 4); /*CC*/ seq = 15; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } StreamTcpCreateTestPacket(payload, 0x42, 2, 4); /*BB*/ seq = 13; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckStreamContents(check_contents, sizeof(check_contents), &ssn.server) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the handling of packets missed by both IDS and the end host. * The packet is missed in the end of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest27 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; TcpSession ssn; uint8_t th_flag; uint8_t flowflags; uint8_t check_contents[7] = {0x41, 0x41, 0x41, 0x42, 0x42, 0x43, 0x43}; memset(&ssn, 0, sizeof (TcpSession)); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; ack = 20; StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ seq = 10; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } StreamTcpCreateTestPacket(payload, 0x42, 2, 4); /*BB*/ seq = 13; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } StreamTcpCreateTestPacket(payload, 0x43, 2, 4); /*CC*/ seq = 15; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckStreamContents(check_contents, sizeof(check_contents), &ssn.server) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the handling of packets missed by IDS, but the end host has * received it and send the acknowledgment of it. The packet is missed * in the starting of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest28 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; uint8_t th_flag; uint8_t th_flags; uint8_t flowflags; uint8_t check_contents[5] = {0x41, 0x41, 0x42, 0x42, 0x42}; TcpSession ssn; memset(&ssn, 0, sizeof (TcpSession)); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); StreamTcpInitConfig(TRUE); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; th_flags = TH_ACK; ssn.server.last_ack = 22; ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 6; ssn.server.isn = 6; StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ seq = 10; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly (1): "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 12; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly (2): "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ seq = 12; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly (4): "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 15; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_TIME_WAIT) == -1) { printf("failed in segments reassembly (5): "); goto end; } if (StreamTcpCheckChunks(&ssn, check_contents) == 0) { printf("failed in stream matching (6): "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the handling of packets missed by IDS, but the end host has * received it and send the acknowledgment of it. The packet is missed * in the middle of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest29 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; uint8_t th_flag; uint8_t th_flags; uint8_t flowflags; uint8_t check_contents[5] = {0x41, 0x41, 0x42, 0x42, 0x42}; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpSession ssn; memset(&ssn, 0, sizeof (TcpSession)); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; th_flags = TH_ACK; ssn.server.last_ack = 22; ssn.server.ra_raw_base_seq = 9; ssn.server.isn = 9; StreamTcpInitConfig(TRUE); StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ seq = 10; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 15; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ seq = 15; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 18; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_TIME_WAIT) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckChunks(&ssn, check_contents) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the handling of packets missed by IDS, but the end host has * received it and send the acknowledgment of it. The packet is missed * at the end of the stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest30 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; uint8_t th_flag; uint8_t th_flags; uint8_t flowflags; uint8_t check_contents[6] = {0x41, 0x41, 0x42, 0x42, 0x42, 0x00}; TcpSession ssn; memset(&ssn, 0, sizeof (TcpSession)); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; th_flags = TH_ACK; ssn.client.last_ack = 2; ssn.client.isn = 1; ssn.server.last_ack = 22; ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 9; ssn.server.isn = 9; StreamTcpInitConfig(TRUE); StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ seq = 10; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 12; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ seq = 12; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 3, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 18; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flags, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } th_flag = TH_FIN|TH_ACK; seq = 18; ack = 20; flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x00, 1, 4); if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 1, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x00, 0, 4); seq = 20; ack = 18; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 0, th_flag, flowflags, TCP_TIME_WAIT) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckChunks(&ssn, check_contents) == 0) { printf("failed in stream matching: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test to reassemble the packets using the fast track method, as most * packets arrives in order. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest31 (void) { int ret = 0; uint8_t payload[4]; uint32_t seq; uint32_t ack; uint8_t th_flag; uint8_t flowflags; uint8_t check_contents[5] = {0x41, 0x41, 0x42, 0x42, 0x42}; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpSession ssn; memset(&ssn, 0, sizeof (TcpSession)); flowflags = FLOW_PKT_TOSERVER; th_flag = TH_ACK|TH_PUSH; ssn.server.ra_raw_base_seq = 9; ssn.server.isn = 9; StreamTcpInitConfig(TRUE); StreamTcpCreateTestPacket(payload, 0x41, 2, 4); /*AA*/ seq = 10; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 2, th_flag, flowflags, TCP_ESTABLISHED) == -1){ printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 1, 4); /*B*/ seq = 15; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 1, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 1, 4); /*B*/ seq = 12; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 1, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 1, 4); /*B*/ seq = 16; ack = 20; if (StreamTcpTestMissedPacket (ra_ctx, &ssn, seq, ack, payload, 1, th_flag, flowflags, TCP_ESTABLISHED) == -1) { printf("failed in segments reassembly: "); goto end; } if (StreamTcpCheckStreamContents(check_contents, 5, &ssn.server) == 0) { printf("failed in stream matching: "); goto end; } if (ssn.server.seg_list_tail->seq != 16) { printf("failed in fast track handling: "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); return ret; } static int StreamTcpReassembleTest32(void) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; uint8_t ret = 0; uint8_t check_contents[35] = {0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x42, 0x42, 0x42, 0x42, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43}; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; uint8_t payload[20] = ""; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->tcph->th_seq = htonl(10); p->tcph->th_ack = htonl(31); p->payload_len = 10; StreamTcpCreateTestPacket(payload, 0x41, 10, 20); /*AA*/ p->payload = payload; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(31); p->payload_len = 10; StreamTcpCreateTestPacket(payload, 0x42, 10, 20); /*BB*/ p->payload = payload; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) goto end; p->tcph->th_seq = htonl(40); p->tcph->th_ack = htonl(31); p->payload_len = 10; StreamTcpCreateTestPacket(payload, 0x43, 10, 20); /*CC*/ p->payload = payload; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) goto end; p->tcph->th_seq = htonl(5); p->tcph->th_ack = htonl(31); p->payload_len = 20; StreamTcpCreateTestPacket(payload, 0x41, 20, 20); /*AA*/ p->payload = payload; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) goto end; if (StreamTcpCheckStreamContents(check_contents, 35, &stream) != 0) { ret = 1; } else { printf("failed in stream matching: "); } end: StreamTcpFreeConfig(TRUE); SCFree(p); return ret; } static int StreamTcpReassembleTest33(void) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; uint8_t packet[1460] = ""; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; p->tcph->th_seq = htonl(10); p->tcph->th_ack = htonl(31); p->payload_len = 10; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(31); p->payload_len = 10; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(40); p->tcph->th_ack = htonl(31); p->payload_len = 10; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(5); p->tcph->th_ack = htonl(31); p->payload_len = 30; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpFreeConfig(TRUE); SCFree(p); return 1; } static int StreamTcpReassembleTest34(void) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; uint8_t packet[1460] = ""; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; p->tcph->th_seq = htonl(857961230); p->tcph->th_ack = htonl(31); p->payload_len = 304; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(857961534); p->tcph->th_ack = htonl(31); p->payload_len = 1460; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(857963582); p->tcph->th_ack = htonl(31); p->payload_len = 1460; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(857960946); p->tcph->th_ack = htonl(31); p->payload_len = 1460; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpFreeConfig(TRUE); SCFree(p); return 1; } /** \test Test the bug 56 condition */ static int StreamTcpReassembleTest35(void) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; uint8_t packet[1460] = ""; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 10); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 10); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; p->tcph->th_seq = htonl(2257022155UL); p->tcph->th_ack = htonl(1374943142); p->payload_len = 142; stream.last_ack = 2257022285UL; stream.ra_raw_base_seq = 2257022172UL; stream.ra_app_base_seq = 2257022172UL; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(2257022285UL); p->tcph->th_ack = htonl(1374943142); p->payload_len = 34; stream.last_ack = 2257022285UL; stream.ra_raw_base_seq = 2257022172UL; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpFreeConfig(TRUE); SCFree(p); return 1; } /** \test Test the bug 57 condition */ static int StreamTcpReassembleTest36(void) { TcpSession ssn; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; memset(&stream, 0, sizeof (TcpStream)); stream.os_policy = OS_POLICY_BSD; uint8_t packet[1460] = ""; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 10); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 10); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; p->tcph->th_seq = htonl(1549588966); p->tcph->th_ack = htonl(4162241372UL); p->payload_len = 204; stream.last_ack = 1549589007; stream.ra_raw_base_seq = 1549589101; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(1549589007); p->tcph->th_ack = htonl(4162241372UL); p->payload_len = 23; stream.last_ack = 1549589007; stream.ra_raw_base_seq = 1549589101; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpFreeConfig(TRUE); SCFree(p); return 1; } /** \test Test the bug 76 condition */ static int StreamTcpReassembleTest37(void) { TcpSession ssn; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); TcpStream stream; uint8_t packet[1460] = ""; PacketQueue pq; ThreadVars tv; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 10); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 10); memset(&stream, 0, sizeof (TcpStream)); memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&tv, 0, sizeof (ThreadVars)); FLOW_INITIALIZE(&f); f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; stream.os_policy = OS_POLICY_BSD; p->tcph->th_seq = htonl(3061088537UL); p->tcph->th_ack = htonl(1729548549UL); p->payload_len = 1391; stream.last_ack = 3061091137UL; stream.ra_raw_base_seq = 3061091309UL; stream.ra_app_base_seq = 3061091309UL; /* pre base_seq, so should be rejected */ if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) != -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(3061089928UL); p->tcph->th_ack = htonl(1729548549UL); p->payload_len = 1391; stream.last_ack = 3061091137UL; stream.ra_raw_base_seq = 3061091309UL; stream.ra_app_base_seq = 3061091309UL; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } p->tcph->th_seq = htonl(3061091319UL); p->tcph->th_ack = htonl(1729548549UL); p->payload_len = 1391; stream.last_ack = 3061091137UL; stream.ra_raw_base_seq = 3061091309UL; stream.ra_app_base_seq = 3061091309UL; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &stream, p, &pq) == -1) { SCFree(p); return 0; } StreamTcpFreeConfig(TRUE); SCFree(p); return 1; } /** * \test Test to make sure we don't send the smsg from toclient to app layer * until the app layer protocol has been detected and one smsg from * toserver side has been sent to app layer. * * Unittest modified by commit - * * commit bab1636377bb4f1b7b889f4e3fd594795085eaa4 * Author: Anoop Saldanha * Date: Fri Feb 15 18:58:33 2013 +0530 * * Improved app protocol detection. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest38 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; Port sp; Port dp; struct in_addr in; TcpSession ssn; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t httpbuf2[] = "POST / HTTP/1.0\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf1[] = "HTTP/1.0 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ FLOW_INITIALIZE(&f); if (inet_pton(AF_INET, "1.2.3.4", &in) != 1) goto end; f.src.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.5", &in) != 1) goto end; f.dst.addr_data32[0] = in.s_addr; sp = 200; dp = 220; ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 9; ssn.server.isn = 9; ssn.server.last_ack = 60; ssn.client.ra_raw_base_seq = ssn.client.ra_app_base_seq = 9; ssn.client.isn = 9; ssn.client.last_ack = 9; f.alproto = ALPROTO_UNKNOWN; f.flags |= FLOW_IPV4; f.sp = sp; f.dp = dp; f.protoctx = &ssn; f.proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf2; p->payload_len = httplen2; ssn.state = TCP_ESTABLISHED; TcpStream *s = NULL; s = &ssn.server; FLOWLOCK_WRLOCK(&f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (1): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) > 0) { printf("there shouldn't be any stream smsgs in the queue (2): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf1; p->payload_len = httplen1; tcph.th_seq = htonl(10); tcph.th_ack = htonl(55); s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (3): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("there should one stream smsg in the queue (6): "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); return ret; } /** * \test Test to make sure that we don't return the segments until the app * layer proto has been detected and after that remove the processed * segments. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest39 (void) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread *stt = NULL; TCPHdr tcph; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); StreamTcpThreadInit(&tv, NULL, (void **)&stt); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); f.flags = FLOW_IPV4; f.proto = IPPROTO_TCP; p->flow = &f; p->tcph = &tcph; FLOWLOCK_WRLOCK(&f); int ret = 0; StreamTcpInitConfig(TRUE); /* handshake */ tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; TcpSession *ssn = (TcpSession *)f.protoctx; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != 0) { printf("failure 1\n"); goto end; } /* handshake */ p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != 0) { printf("failure 2\n"); goto end; } /* handshake */ p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != 0) { printf("failure 3\n"); goto end; } /* partial request */ uint8_t request1[] = { 0x47, 0x45, }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != STREAM_TOSERVER) { printf("failure 4\n"); goto end; } /* response ack against partial request */ p->tcph->th_ack = htonl(3); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != STREAM_TOSERVER) { printf("failure 5\n"); goto end; } /* complete partial request */ uint8_t request2[] = { 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(3); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request2); p->payload = request2; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_UNKNOWN || f.alproto_ts != ALPROTO_UNKNOWN || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next != NULL || ssn->server.seg_list != NULL || ssn->toserver_smsg_head != NULL || ssn->toclient_smsg_head != NULL || ssn->data_first_seen_dir != STREAM_TOSERVER) { printf("failure 6\n"); goto end; } /* response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_UNKNOWN || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next != NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 7\n"); goto end; } /* response ack from request */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next != NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 8\n"); goto end; } /* response - acking */ p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(328); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 9\n"); goto end; } /* response ack from request */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 10\n"); goto end; } /* response - acking the request again*/ p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(328); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 11\n"); goto end; } /*** New Request ***/ /* partial request */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 12\n"); goto end; } /* response ack against partial request */ p->tcph->th_ack = htonl(90); p->tcph->th_seq = htonl(328); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 13\n"); goto end; } /* complete request */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(90); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request2); p->payload = request2; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list == NULL || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next == NULL || ssn->client.seg_list->next->next->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 14\n"); goto end; } /* response ack against second partial request */ p->tcph->th_ack = htonl(175); p->tcph->th_seq = htonl(328); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list->next == NULL || ssn->client.seg_list->next->next == NULL || ssn->client.seg_list->next->next->next == NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 15\n"); goto end; } if (ssn->toserver_smsg_head == NULL || ssn->toserver_smsg_head->next == NULL || ssn->toserver_smsg_head->next->next != NULL || ssn->toclient_smsg_head == NULL || ssn->toclient_smsg_head->next != NULL) { printf("failure 16\n"); goto end; } StreamMsgReturnListToPool(ssn->toserver_smsg_head); ssn->toserver_smsg_head = ssn->toserver_smsg_tail = NULL; StreamMsgReturnListToPool(ssn->toclient_smsg_head); ssn->toclient_smsg_head = ssn->toclient_smsg_tail = NULL; /* response acking a request */ p->tcph->th_ack = htonl(175); p->tcph->th_seq = htonl(328); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list != NULL || ssn->server.seg_list == NULL || ssn->server.seg_list->next != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 15\n"); goto end; } /* request acking a response */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(175); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; if (StreamTcpPacket(&tv, p, stt, &pq) == -1) goto end; if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server) || !StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client) || f.alproto != ALPROTO_HTTP || f.alproto_ts != ALPROTO_HTTP || f.alproto_tc != ALPROTO_HTTP || ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED || !FLOW_IS_PM_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PP_DONE(&f, STREAM_TOSERVER) || !FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT) || FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT) || ssn->client.seg_list != NULL || ssn->server.seg_list != NULL || ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { printf("failure 15\n"); goto end; } ret = 1; end: StreamTcpThreadDeinit(&tv, (void *)stt); StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(&f); return ret; } /** * \test Test to make sure that we sent all the segments from the initial * segments to app layer until we have detected the app layer proto. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest40 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow *f = NULL; TCPHdr tcph; TcpSession ssn; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); StreamTcpInitConfig(TRUE); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 130); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t httpbuf1[] = "P"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "O"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "S"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "T \r\n"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 9; ssn.server.isn = 9; ssn.server.last_ack = 10; ssn.client.ra_raw_base_seq = ssn.client.ra_app_base_seq = 9; ssn.client.isn = 9; ssn.client.last_ack = 10; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(10); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf1; p->payload_len = httplen1; ssn.state = TCP_ESTABLISHED; TcpStream *s = NULL; s = &ssn.client; FLOWLOCK_WRLOCK(f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (1): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOCLIENT) > 0) { printf("there shouldn't be any stream smsgs in the queue, as we didn't" " processed any smsg from toserver side till yet (2): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(10); tcph.th_ack = htonl(11); s = &ssn.server; ssn.server.last_ack = 11; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (3): "); goto end; } p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf3; p->payload_len = httplen3; tcph.th_seq = htonl(11); tcph.th_ack = htonl(55); s = &ssn.client; ssn.client.last_ack = 55; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (5): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(55); tcph.th_ack = htonl(12); s = &ssn.server; ssn.server.last_ack = 12; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (6): "); goto end; } /* check is have the segment in the list and flagged or not */ if (ssn.client.seg_list == NULL || (ssn.client.seg_list->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) { printf("the list is NULL or the processed segment has not been flaged (7): "); goto end; } p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf4; p->payload_len = httplen4; tcph.th_seq = htonl(12); tcph.th_ack = htonl(100); s = &ssn.client; ssn.client.last_ack = 100; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (10): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(100); tcph.th_ack = htonl(13); s = &ssn.server; ssn.server.last_ack = 13; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (11): "); goto end; } p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf5; p->payload_len = httplen5; tcph.th_seq = htonl(13); tcph.th_ack = htonl(145); s = &ssn.client; ssn.client.last_ack = 145; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (14): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(145); tcph.th_ack = htonl(16); s = &ssn.server; ssn.server.last_ack = 16; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (15): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) == 0) { printf("there should be a stream smsgs in the queue, as we have detected" " the app layer protocol and one smsg from toserver side has " "been sent (16): "); goto end; } if (f->alproto != ALPROTO_HTTP) { printf("app layer proto has not been detected (18): "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest43 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow *f = NULL; TCPHdr tcph; TcpSession ssn; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t httpbuf1[] = "/ HTTP/1.0\r\nUser-Agent: Victor/1.0"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "W2dyb3VwMV0NCnBob25lMT1wMDB3ODgyMTMxMzAyMTINCmxvZ2lu" "MT0NCnBhc3N3b3JkMT0NCnBob25lMj1wMDB3ODgyMTMxMzAyMTIN" "CmxvZ2luMj0NCnBhc3N3b3JkMj0NCnBob25lMz0NCmxvZ2luMz0N" "CnBhc3N3b3JkMz0NCnBob25lND0NCmxvZ2luND0NCnBhc3N3b3Jk" "ND0NCnBob25lNT0NCmxvZ2luNT0NCnBhc3N3b3JkNT0NCnBob25l" "Nj0NCmxvZ2luNj0NCnBhc3N3b3JkNj0NCmNhbGxfdGltZTE9MzIN" "CmNhbGxfdGltZTI9MjMyDQpkYXlfbGltaXQ9NQ0KbW9udGhfbGlt" "aXQ9MTUNCltncm91cDJdDQpwaG9uZTE9DQpsb2dpbjE9DQpwYXNz" "d29yZDE9DQpwaG9uZTI9DQpsb2dpbjI9DQpwYXNzd29yZDI9DQpw" "aG9uZT\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 9; ssn.server.isn = 9; ssn.server.last_ack = 600; ssn.client.ra_raw_base_seq = ssn.client.ra_app_base_seq = 9; ssn.client.isn = 9; ssn.client.last_ack = 600; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(10); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; ssn.state = TCP_ESTABLISHED; TcpStream *s = NULL; s = &ssn.server; FLOWLOCK_WRLOCK(f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (1): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) > 0) { printf("there shouldn't be any stream smsgs in the queue (2): "); goto end; } p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf1; p->payload_len = httplen1; tcph.th_seq = htonl(10); tcph.th_ack = htonl(55); s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (3): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOCLIENT) > 0) { printf("there shouldn't be any stream smsgs in the queue, as we didn't" " processed any smsg from toserver side till yet (4): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(55); tcph.th_ack = htonl(44); s = &ssn.server; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (5): "); goto end; } if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn.client)) { printf("app layer detected flag isn't set, it should be (8): "); goto end; } /* This packets induces a packet gap and also shows why we need to process the current segment completely, even if it results in sending more than one smsg to the app layer. If we don't send more than one smsg in this case, then the first segment of lentgh 34 bytes will be sent to app layer and protocol can not be detected in that message and moreover the segment lentgh is less than the max. signature size for protocol detection, so this will keep looping !! */ p->flowflags = FLOW_PKT_TOSERVER; p->payload = httpbuf3; p->payload_len = httplen3; tcph.th_seq = htonl(54); tcph.th_ack = htonl(100); s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (9): "); goto end; } /* Check if we have stream smsgs in queue */ if (UtSsnSmsgCnt(&ssn, STREAM_TOCLIENT) > 0) { printf("there shouldn't be any stream smsgs in the queue, as we didn't" " detected the app layer protocol till yet (10): "); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf2; p->payload_len = httplen2; tcph.th_seq = htonl(100); tcph.th_ack = htonl(53); s = &ssn.server; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet (11): "); goto end; } /* the flag should be set, as the smsg scanned size has crossed the max. signature size for app proto detection */ if (!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn.client)) { printf("app layer detected flag is not set, it should be (14): "); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** \test Test the memcap incrementing/decrementing and memcap check */ static int StreamTcpReassembleTest44(void) { uint8_t ret = 0; StreamTcpInitConfig(TRUE); uint32_t memuse = SC_ATOMIC_GET(ra_memuse); StreamTcpReassembleIncrMemuse(500); if (SC_ATOMIC_GET(ra_memuse) != (memuse+500)) { printf("failed in incrementing the memory"); goto end; } StreamTcpReassembleDecrMemuse(500); if (SC_ATOMIC_GET(ra_memuse) != memuse) { printf("failed in decrementing the memory"); goto end; } if (StreamTcpReassembleCheckMemcap(500) != 1) { printf("failed in validating the memcap"); goto end; } if (StreamTcpReassembleCheckMemcap((memuse + stream_config.reassembly_memcap)) != 0) { printf("failed in validating the memcap"); goto end; } StreamTcpFreeConfig(TRUE); if (SC_ATOMIC_GET(ra_memuse) != 0) { printf("failed in clearing the memory"); goto end; } ret = 1; return ret; end: StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test to make sure that reassembly_depth is enforced. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest45 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow *f = NULL; TCPHdr tcph; TcpSession ssn; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); ThreadVars tv; memset(&tv, 0, sizeof (ThreadVars)); uint8_t httpbuf1[] = "/ HTTP/1.0\r\nUser-Agent: Victor/1.0"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); STREAMTCP_SET_RA_BASE_SEQ(&ssn.server, 9); ssn.server.isn = 9; ssn.server.last_ack = 60; STREAMTCP_SET_RA_BASE_SEQ(&ssn.client, 9); ssn.client.isn = 9; ssn.client.last_ack = 9; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf1; p->payload_len = httplen1; ssn.state = TCP_ESTABLISHED; /* set the default value of reassembly depth, as there is no config file */ ssn.reassembly_depth = httplen1 + 1; TcpStream *s = NULL; s = &ssn.server; FLOWLOCK_WRLOCK(f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toclient packet: "); goto end; } /* Check if we have flags set or not */ if (s->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) { printf("there shouldn't be a noreassembly flag be set: "); goto end; } STREAMTCP_SET_RA_BASE_SEQ(&ssn.server, ssn.server.isn + httplen1); p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = httplen1; s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet: "); goto end; } /* Check if we have flags set or not */ if (s->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) { printf("there shouldn't be a noreassembly flag be set: "); goto end; } STREAMTCP_SET_RA_BASE_SEQ(&ssn.client, ssn.client.isn + httplen1); p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = httplen1; s = &ssn.server; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet: "); goto end; } /* Check if we have flags set or not */ if (!(s->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("the noreassembly flags should be set, " "p.payload_len %"PRIu16" stream_config.reassembly_" "depth %"PRIu32": ", p->payload_len, stream_config.reassembly_depth); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** * \test Test the undefined config value of reassembly depth. * the default value of 0 will be loaded and stream will be reassembled * until the session ended * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest46 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow *f = NULL; TCPHdr tcph; TcpSession ssn; ThreadVars tv; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof (ThreadVars)); uint8_t httpbuf1[] = "/ HTTP/1.0\r\nUser-Agent: Victor/1.0"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); STREAMTCP_SET_RA_BASE_SEQ(&ssn.server, 9); ssn.server.isn = 9; ssn.server.last_ack = 60; ssn.server.next_seq = ssn.server.isn; STREAMTCP_SET_RA_BASE_SEQ(&ssn.client, 9); ssn.client.isn = 9; ssn.client.last_ack = 9; ssn.client.next_seq = ssn.client.isn; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOCLIENT; p->payload = httpbuf1; p->payload_len = httplen1; ssn.state = TCP_ESTABLISHED; stream_config.reassembly_depth = 0; TcpStream *s = NULL; s = &ssn.server; FLOWLOCK_WRLOCK(f); if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toclient packet\n"); goto end; } /* Check if we have flags set or not */ if ((ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || (ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("there shouldn't be any no reassembly flag be set \n"); goto end; } STREAMTCP_SET_RA_BASE_SEQ(&ssn.server, ssn.server.isn + httplen1); p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = httplen1; s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet\n"); goto end; } /* Check if we have flags set or not */ if ((ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || (ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("there shouldn't be any no reassembly flag be set \n"); goto end; } STREAMTCP_SET_RA_BASE_SEQ(&ssn.client, ssn.client.isn + httplen1); p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = httplen1; tcph.th_seq = htonl(10 + httplen1); tcph.th_ack = htonl(20 + httplen1); s = &ssn.server; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver packet\n"); goto end; } /* Check if we have flags set or not */ if ((ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || (ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("the no_reassembly flags should not be set, " "p->payload_len %"PRIu16" stream_config.reassembly_" "depth %"PRIu32": ", p->payload_len, stream_config.reassembly_depth); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** * \test Test to make sure we detect the sequence wrap around and continue * stream reassembly properly. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpReassembleTest47 (void) { int ret = 0; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Flow *f = NULL; TCPHdr tcph; TcpSession ssn; ThreadVars tv; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&ssn, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof (ThreadVars)); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 0); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 0); StreamTcpInitConfig(TRUE); TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t httpbuf1[] = "GET /EVILSUFF HTTP/1.1\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ ssn.server.ra_raw_base_seq = ssn.server.ra_app_base_seq = 572799781UL; ssn.server.isn = 572799781UL; ssn.server.last_ack = 572799782UL; ssn.client.ra_raw_base_seq = ssn.client.ra_app_base_seq = 4294967289UL; ssn.client.isn = 4294967289UL; ssn.client.last_ack = 21; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 200, 220); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; tcph.th_win = htons(5480); ssn.state = TCP_ESTABLISHED; TcpStream *s = NULL; uint8_t cnt = 0; FLOWLOCK_WRLOCK(f); for (cnt=0; cnt < httplen1; cnt++) { tcph.th_seq = htonl(ssn.client.isn + 1 + cnt); tcph.th_ack = htonl(572799782UL); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = &httpbuf1[cnt]; p->payload_len = 1; s = &ssn.client; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver " "packet\n"); goto end; } p->flowflags = FLOW_PKT_TOCLIENT; p->payload = NULL; p->payload_len = 0; tcph.th_seq = htonl(572799782UL); tcph.th_ack = htonl(ssn.client.isn + 1 + cnt); tcph.th_flags = TH_ACK; p->tcph = &tcph; s = &ssn.server; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx, &ssn, s, p, &pq) == -1) { printf("failed in segments reassembly, while processing toserver " "packet\n"); goto end; } } if (f->alproto != ALPROTO_HTTP) { printf("App layer protocol (HTTP) should have been detected\n"); goto end; } ret = 1; end: StreamTcpReassembleFreeThreadCtx(ra_ctx); StreamTcpFreeConfig(TRUE); SCFree(p); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** \test 3 in order segments in inline reassembly */ static int StreamTcpReassembleInlineTest01(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); uint8_t stream_payload[] = "AAAAABBBBBCCCCC"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 17; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload, 15) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test 3 in order segments, then reassemble, add one more and reassemble again. * test the sliding window reassembly. */ static int StreamTcpReassembleInlineTest02(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload2[] = "AAAAABBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 17; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 15) == 0) goto end; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } ssn.client.next_seq = 22; r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed 2: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected a single stream message: "); goto end; } smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 20) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test 3 in order segments, then reassemble, add one more and reassemble again. * test the sliding window reassembly with a small window size so that we * cutting off at the start (left edge) */ static int StreamTcpReassembleInlineTest03(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); stream_config.reassembly_toserver_chunk_size = 15; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload2[] = "BBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 17; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message 1: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 15) == 0) goto end; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(17); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed 2: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected two stream messages: "); goto end; } smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 15) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test 3 in order segments, then reassemble, add one more and reassemble again. * test the sliding window reassembly with a small window size so that we * cutting off at the start (left edge) with small packet overlap. */ static int StreamTcpReassembleInlineTest04(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); stream_config.reassembly_toserver_chunk_size = 16; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload2[] = "ABBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 17; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 15) == 0) goto end; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(17); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed 2: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected a single stream message: "); goto end; } smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 16) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test with a GAP we should have 2 smsgs */ static int StreamTcpReassembleInlineTest05(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); uint8_t stream_payload1[] = "AAAAABBBBB"; uint8_t stream_payload2[] = "DDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } ssn.client.next_seq = 12; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } p->tcph->th_seq = htonl(17); int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 10) == 0) goto end; smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 5) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test with a GAP we should have 2 smsgs, with filling the GAP later */ static int StreamTcpReassembleInlineTest06(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); uint8_t stream_payload1[] = "AAAAABBBBB"; uint8_t stream_payload2[] = "DDDDD"; uint8_t stream_payload3[] = "AAAAABBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } ssn.client.next_seq = 12; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } p->tcph->th_seq = htonl(17); int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected two stream messages: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 10) == 0) goto end; smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 5) == 0) goto end; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(12); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 3) { printf("expected a single stream message, got %u: ", UtSsnSmsgCnt(&ssn, STREAM_TOSERVER)); goto end; } smsg = ssn.toserver_smsg_head->next->next; if (UtTestSmsg(smsg, stream_payload3, 20) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test with a GAP we should have 2 smsgs, with filling the GAP later, small * window */ static int StreamTcpReassembleInlineTest07(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); stream_config.reassembly_toserver_chunk_size = 16; uint8_t stream_payload1[] = "ABBBBB"; uint8_t stream_payload2[] = "DDDDD"; uint8_t stream_payload3[] = "AAAAABBBBBCCCCCD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } ssn.client.next_seq = 12; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } p->tcph->th_seq = htonl(17); int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected a single stream message, got %u: ", UtSsnSmsgCnt(&ssn, STREAM_TOSERVER)); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 6) == 0) goto end; smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 5) == 0) goto end; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(12); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 3) { printf("expected a single stream message, got %u: ", UtSsnSmsgCnt(&ssn, STREAM_TOSERVER)); goto end; } smsg = ssn.toserver_smsg_head->next->next; if (UtTestSmsg(smsg, stream_payload3, 16) == 0) goto end; ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test 3 in order segments, then reassemble, add one more and reassemble again. * test the sliding window reassembly with a small window size so that we * cutting off at the start (left edge). Test if the first segment is * removed from the list. */ static int StreamTcpReassembleInlineTest08(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); stream_config.reassembly_toserver_chunk_size = 15; ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload2[] = "BBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 17; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 15) == 0) goto end; if (ssn.client.ra_raw_base_seq != 16) { printf("ra_raw_base_seq %"PRIu32", expected 16: ", ssn.client.ra_raw_base_seq); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 4: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(17); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed 2: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected a single stream message, got %u: ", UtSsnSmsgCnt(&ssn, STREAM_TOSERVER)); goto end; } smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 15) == 0) goto end; if (ssn.client.ra_raw_base_seq != 21) { printf("ra_raw_base_seq %"PRIu32", expected 21: ", ssn.client.ra_raw_base_seq); goto end; } if (ssn.client.seg_list->seq != 7) { printf("expected segment 2 (seq 7) to be first in the list, got seq %"PRIu32": ", ssn.client.seg_list->seq); goto end; } ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test 3 in order segments, then reassemble, add one more and reassemble again. * test the sliding window reassembly with a small window size so that we * cutting off at the start (left edge). Test if the first segment is * removed from the list. */ static int StreamTcpReassembleInlineTest09(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); stream_config.reassembly_toserver_chunk_size = 20; ssn.client.flags |= STREAMTCP_STREAM_FLAG_GAP; uint8_t stream_payload1[] = "AAAAABBBBBCCCCC"; uint8_t stream_payload2[] = "DDDDD"; uint8_t stream_payload3[] = "AAAAABBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(17); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 17, 'D', 5) == -1) { printf("failed to add segment 3: "); goto end; } ssn.client.next_seq = 12; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 2) { printf("expected 2 stream message2, got %u: ", UtSsnSmsgCnt(&ssn, STREAM_TOSERVER)); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 10) == 0) goto end; smsg = ssn.toserver_smsg_head->next; if (UtTestSmsg(smsg, stream_payload2, 5) == 0) goto end; if (ssn.client.ra_raw_base_seq != 11) { printf("ra_raw_base_seq %"PRIu32", expected 11: ", ssn.client.ra_raw_base_seq); goto end; } /* close the GAP and see if we properly reassemble and update ra_base_seq */ if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 4: "); goto end; } ssn.client.next_seq = 22; p->tcph->th_seq = htonl(12); r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed 2: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 3) { printf("expected 3 stream messages: "); goto end; } smsg = ssn.toserver_smsg_head->next->next; if (UtTestSmsg(smsg, stream_payload3, 20) == 0) goto end; if (ssn.client.ra_raw_base_seq != 21) { printf("ra_raw_base_seq %"PRIu32", expected 21: ", ssn.client.ra_raw_base_seq); goto end; } if (ssn.client.seg_list->seq != 2) { printf("expected segment 1 (seq 2) to be first in the list, got seq %"PRIu32": ", ssn.client.seg_list->seq); goto end; } ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test App Layer reassembly. */ static int StreamTcpReassembleInlineTest10(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow *f = NULL; Packet *p = NULL; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTInitInline(); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.server, 1); ssn.server.last_ack = 2; StreamTcpUTSetupStream(&ssn.client, 1); ssn.client.last_ack = 2; f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; uint8_t stream_payload1[] = "GE"; uint8_t stream_payload2[] = "T /"; uint8_t stream_payload3[] = "HTTP/1.0\r\n\r\n"; p = UTHBuildPacketReal(stream_payload3, 12, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(7); p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(f); if (StreamTcpUTAddSegmentWithPayload(&tv, ra_ctx, &ssn.server, 2, stream_payload1, 2) == -1) { printf("failed to add segment 1: "); goto end; } ssn.server.next_seq = 4; int r = StreamTcpReassembleAppLayer(&tv, ra_ctx, &ssn, &ssn.server, p); if (r < 0) { printf("StreamTcpReassembleAppLayer failed: "); goto end; } /* ssn.server.ra_app_base_seq should be isn here. */ if (ssn.server.ra_app_base_seq != 1 || ssn.server.ra_app_base_seq != ssn.server.isn) { printf("expected ra_app_base_seq 1, got %u: ", ssn.server.ra_app_base_seq); goto end; } if (StreamTcpUTAddSegmentWithPayload(&tv, ra_ctx, &ssn.server, 4, stream_payload2, 3) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithPayload(&tv, ra_ctx, &ssn.server, 7, stream_payload3, 12) == -1) { printf("failed to add segment 3: "); goto end; } ssn.server.next_seq = 19; r = StreamTcpReassembleAppLayer(&tv, ra_ctx, &ssn, &ssn.server, p); if (r < 0) { printf("StreamTcpReassembleAppLayer failed: "); goto end; } if (ssn.server.ra_app_base_seq != 18) { printf("expected ra_app_base_seq 18, got %u: ", ssn.server.ra_app_base_seq); goto end; } ret = 1; end: UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); FLOWLOCK_UNLOCK(f); UTHFreeFlow(f); return ret; } /** \test test insert with overlap */ static int StreamTcpReassembleInsertTest01(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; Flow f; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); FLOW_INITIALIZE(&f); uint8_t stream_payload1[] = "AAAAABBBBBCCCCCDDDDD"; uint8_t payload[] = { 'C', 'C', 'C', 'C', 'C' }; Packet *p = UTHBuildPacketReal(payload, 5, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); if (p == NULL) { printf("couldn't get a packet: "); goto end; } p->tcph->th_seq = htonl(12); p->flow = &f; FLOWLOCK_WRLOCK(&f); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 5) == -1) { printf("failed to add segment 1: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 7, 'B', 5) == -1) { printf("failed to add segment 2: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 14, 'D', 2) == -1) { printf("failed to add segment 3: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 16, 'D', 6) == -1) { printf("failed to add segment 4: "); goto end; } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 12, 'C', 5) == -1) { printf("failed to add segment 5: "); goto end; } ssn.client.next_seq = 21; int r = StreamTcpReassembleInlineRaw(ra_ctx, &ssn, &ssn.client, p); if (r < 0) { printf("StreamTcpReassembleInlineRaw failed: "); goto end; } if (UtSsnSmsgCnt(&ssn, STREAM_TOSERVER) != 1) { printf("expected a single stream message: "); goto end; } StreamMsg *smsg = ssn.toserver_smsg_head; if (UtTestSmsg(smsg, stream_payload1, 20) == 0) goto end; if (ssn.client.ra_raw_base_seq != 21) { printf("ra_raw_base_seq %"PRIu32", expected 21: ", ssn.client.ra_raw_base_seq); goto end; } ret = 1; end: FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); UTHFreePacket(p); StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test test insert with overlaps */ static int StreamTcpReassembleInsertTest02(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); int i; for (i = 2; i < 10; i++) { int len; len = i % 2; if (len == 0) len = 1; int seq; seq = i * 10; if (seq < 2) seq = 2; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, seq, 'A', len) == -1) { printf("failed to add segment 1: "); goto end; } } if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'B', 1024) == -1) { printf("failed to add segment 2: "); goto end; } ret = 1; end: StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } /** \test test insert with overlaps */ static int StreamTcpReassembleInsertTest03(void) { int ret = 0; TcpReassemblyThreadCtx *ra_ctx = NULL; ThreadVars tv; TcpSession ssn; memset(&tv, 0x00, sizeof(tv)); StreamTcpUTInit(&ra_ctx); StreamTcpUTSetupSession(&ssn); StreamTcpUTSetupStream(&ssn.client, 1); if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, 2, 'A', 1024) == -1) { printf("failed to add segment 2: "); goto end; } int i; for (i = 2; i < 10; i++) { int len; len = i % 2; if (len == 0) len = 1; int seq; seq = i * 10; if (seq < 2) seq = 2; if (StreamTcpUTAddSegmentWithByte(&tv, ra_ctx, &ssn.client, seq, 'B', len) == -1) { printf("failed to add segment 2: "); goto end; } } ret = 1; end: StreamTcpUTClearSession(&ssn); StreamTcpUTDeinit(ra_ctx); return ret; } #endif /* UNITTESTS */ /** \brief The Function Register the Unit tests to test the reassembly engine * for various OS policies. */ void StreamTcpReassembleRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("StreamTcpReassembleTest01 -- BSD OS Before Reassembly Test", StreamTcpReassembleTest01); UtRegisterTest("StreamTcpReassembleTest02 -- BSD OS At Same Reassembly Test", StreamTcpReassembleTest02); UtRegisterTest("StreamTcpReassembleTest03 -- BSD OS After Reassembly Test", StreamTcpReassembleTest03); UtRegisterTest("StreamTcpReassembleTest04 -- BSD OS Complete Reassembly Test", StreamTcpReassembleTest04); UtRegisterTest("StreamTcpReassembleTest05 -- VISTA OS Before Reassembly Test", StreamTcpReassembleTest05); UtRegisterTest("StreamTcpReassembleTest06 -- VISTA OS At Same Reassembly Test", StreamTcpReassembleTest06); UtRegisterTest("StreamTcpReassembleTest07 -- VISTA OS After Reassembly Test", StreamTcpReassembleTest07); UtRegisterTest("StreamTcpReassembleTest08 -- VISTA OS Complete Reassembly Test", StreamTcpReassembleTest08); UtRegisterTest("StreamTcpReassembleTest09 -- LINUX OS Before Reassembly Test", StreamTcpReassembleTest09); UtRegisterTest("StreamTcpReassembleTest10 -- LINUX OS At Same Reassembly Test", StreamTcpReassembleTest10); UtRegisterTest("StreamTcpReassembleTest11 -- LINUX OS After Reassembly Test", StreamTcpReassembleTest11); UtRegisterTest("StreamTcpReassembleTest12 -- LINUX OS Complete Reassembly Test", StreamTcpReassembleTest12); UtRegisterTest("StreamTcpReassembleTest13 -- LINUX_OLD OS Before Reassembly Test", StreamTcpReassembleTest13); UtRegisterTest("StreamTcpReassembleTest14 -- LINUX_OLD At Same Reassembly Test", StreamTcpReassembleTest14); UtRegisterTest("StreamTcpReassembleTest15 -- LINUX_OLD OS After Reassembly Test", StreamTcpReassembleTest15); UtRegisterTest("StreamTcpReassembleTest16 -- LINUX_OLD OS Complete Reassembly Test", StreamTcpReassembleTest16); UtRegisterTest("StreamTcpReassembleTest17 -- SOLARIS OS Before Reassembly Test", StreamTcpReassembleTest17); UtRegisterTest("StreamTcpReassembleTest18 -- SOLARIS At Same Reassembly Test", StreamTcpReassembleTest18); UtRegisterTest("StreamTcpReassembleTest19 -- SOLARIS OS After Reassembly Test", StreamTcpReassembleTest19); UtRegisterTest("StreamTcpReassembleTest20 -- SOLARIS OS Complete Reassembly Test", StreamTcpReassembleTest20); UtRegisterTest("StreamTcpReassembleTest21 -- LAST OS Before Reassembly Test", StreamTcpReassembleTest21); UtRegisterTest("StreamTcpReassembleTest22 -- LAST OS At Same Reassembly Test", StreamTcpReassembleTest22); UtRegisterTest("StreamTcpReassembleTest23 -- LAST OS After Reassembly Test", StreamTcpReassembleTest23); UtRegisterTest("StreamTcpReassembleTest24 -- LAST OS Complete Reassembly Test", StreamTcpReassembleTest24); UtRegisterTest("StreamTcpReassembleTest25 -- Gap at Start Reassembly Test", StreamTcpReassembleTest25); UtRegisterTest("StreamTcpReassembleTest26 -- Gap at middle Reassembly Test", StreamTcpReassembleTest26); UtRegisterTest("StreamTcpReassembleTest27 -- Gap at after Reassembly Test", StreamTcpReassembleTest27); UtRegisterTest("StreamTcpReassembleTest28 -- Gap at Start IDS missed packet Reassembly Test", StreamTcpReassembleTest28); UtRegisterTest("StreamTcpReassembleTest29 -- Gap at Middle IDS missed packet Reassembly Test", StreamTcpReassembleTest29); UtRegisterTest("StreamTcpReassembleTest30 -- Gap at End IDS missed packet Reassembly Test", StreamTcpReassembleTest30); UtRegisterTest("StreamTcpReassembleTest31 -- Fast Track Reassembly Test", StreamTcpReassembleTest31); UtRegisterTest("StreamTcpReassembleTest32 -- Bug test", StreamTcpReassembleTest32); UtRegisterTest("StreamTcpReassembleTest33 -- Bug test", StreamTcpReassembleTest33); UtRegisterTest("StreamTcpReassembleTest34 -- Bug test", StreamTcpReassembleTest34); UtRegisterTest("StreamTcpReassembleTest35 -- Bug56 test", StreamTcpReassembleTest35); UtRegisterTest("StreamTcpReassembleTest36 -- Bug57 test", StreamTcpReassembleTest36); UtRegisterTest("StreamTcpReassembleTest37 -- Bug76 test", StreamTcpReassembleTest37); UtRegisterTest("StreamTcpReassembleTest38 -- app proto test", StreamTcpReassembleTest38); UtRegisterTest("StreamTcpReassembleTest39 -- app proto test", StreamTcpReassembleTest39); UtRegisterTest("StreamTcpReassembleTest40 -- app proto test", StreamTcpReassembleTest40); UtRegisterTest("StreamTcpReassembleTest43 -- min smsg size test", StreamTcpReassembleTest43); UtRegisterTest("StreamTcpReassembleTest44 -- Memcap Test", StreamTcpReassembleTest44); UtRegisterTest("StreamTcpReassembleTest45 -- Depth Test", StreamTcpReassembleTest45); UtRegisterTest("StreamTcpReassembleTest46 -- Depth Test", StreamTcpReassembleTest46); UtRegisterTest("StreamTcpReassembleTest47 -- TCP Sequence Wraparound Test", StreamTcpReassembleTest47); UtRegisterTest("StreamTcpReassembleInlineTest01 -- inline RAW ra", StreamTcpReassembleInlineTest01); UtRegisterTest("StreamTcpReassembleInlineTest02 -- inline RAW ra 2", StreamTcpReassembleInlineTest02); UtRegisterTest("StreamTcpReassembleInlineTest03 -- inline RAW ra 3", StreamTcpReassembleInlineTest03); UtRegisterTest("StreamTcpReassembleInlineTest04 -- inline RAW ra 4", StreamTcpReassembleInlineTest04); UtRegisterTest("StreamTcpReassembleInlineTest05 -- inline RAW ra 5 GAP", StreamTcpReassembleInlineTest05); UtRegisterTest("StreamTcpReassembleInlineTest06 -- inline RAW ra 6 GAP", StreamTcpReassembleInlineTest06); UtRegisterTest("StreamTcpReassembleInlineTest07 -- inline RAW ra 7 GAP", StreamTcpReassembleInlineTest07); UtRegisterTest("StreamTcpReassembleInlineTest08 -- inline RAW ra 8 cleanup", StreamTcpReassembleInlineTest08); UtRegisterTest("StreamTcpReassembleInlineTest09 -- inline RAW ra 9 GAP cleanup", StreamTcpReassembleInlineTest09); UtRegisterTest("StreamTcpReassembleInlineTest10 -- inline APP ra 10", StreamTcpReassembleInlineTest10); UtRegisterTest("StreamTcpReassembleInsertTest01 -- insert with overlap", StreamTcpReassembleInsertTest01); UtRegisterTest("StreamTcpReassembleInsertTest02 -- insert with overlap", StreamTcpReassembleInsertTest02); UtRegisterTest("StreamTcpReassembleInsertTest03 -- insert with overlap", StreamTcpReassembleInsertTest03); StreamTcpInlineRegisterTests(); StreamTcpUtilRegisterTests(); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-asn1.c0000644000000000000000000012365413051004444013270 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-asn1.c * * \author Pablo Rincon Crespo * * Implements "asn1" keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "flow.h" #include "detect-asn1.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-debug.h" #include "util-decode-asn1.h" /* delimiters for functions/arguments */ const char *ASN_DELIM = " \t,\n"; int DetectAsn1Match(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectAsn1Setup (DetectEngineCtx *, Signature *, char *); void DetectAsn1RegisterTests(void); void DetectAsn1Free(void *); /** * \brief Registration function for asn1 */ void DetectAsn1Register(void) { sigmatch_table[DETECT_ASN1].name = "asn1"; sigmatch_table[DETECT_ASN1].Match = DetectAsn1Match; sigmatch_table[DETECT_ASN1].Setup = DetectAsn1Setup; sigmatch_table[DETECT_ASN1].Free = DetectAsn1Free; sigmatch_table[DETECT_ASN1].RegisterTests = DetectAsn1RegisterTests; return; } /** * \brief The main checks are done here * This function implements the detection of the following options: * - oversize_length * - bitstring_overflow * - double_overflow * We can add more checks here easily since we have all the data of the * node avaliable. If we need all the tree, we can just pass the * ASN1 ctx as argument and perform the checks here * \param node pointer to the Asn1Node to inspect * \param ad pointer to the parsed options of the asn1 keyword (which hold the * checks that we want to perform, and the lenght of oversize check * \retval 1 if any of the options match, 0 if not */ static uint8_t DetectAsn1Checks(Asn1Node *node, const DetectAsn1Data *ad) { /* oversize_length will check if a node has a length greater than * the user supplied length */ if (ad->flags & ASN1_OVERSIZE_LEN) { if (node->len.len > ad->oversize_length || node->data.len > ad->oversize_length) return 1; } /* 8.6 */ /* bitstring_overflow check a malformed option where the number of bits * to ignore is greater than the length decoded (in bits) */ if (ad->flags & ASN1_BITSTRING_OVF) { if (node->id.class_tag == ASN1_BER_CLASS_UNIV && node->id.tag_num == ASN1_UNITAG_BIT_STRING && node->id.tag_type == ASN1_TAG_TYPE_PRIMITIVE) { if (node->len.len > 0 && node->data.ptr != NULL && (node->len.len) * 8 < (uint8_t) *node->data.ptr) { return 1; } } } /* double_overflow checks a known issue that affect the MSASN1 library * when decoding double/real types. If the endoding is ASCII, * and the buffer is greater than 256, the array is overflown */ if (ad->flags & ASN1_DOUBLE_OVF) { if (node->id.class_tag == ASN1_BER_CLASS_UNIV && node->id.tag_num == ASN1_UNITAG_REAL && node->id.tag_type == ASN1_TAG_TYPE_PRIMITIVE) { if (node->len.len > 0 && node->data.ptr != NULL && !((uint8_t) *node->data.ptr & 0xC0) && (node->len.len > 256 || node->data.len > 256)) { return 1; } } } /* Good to know :) */ return 0; } /** * \brief This function will decode the asn1 data and inspect the resulting * nodes to detect if any of the specified checks match this data * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectAsn1Data * * \retval 0 no match * \retval 1 match */ int DetectAsn1Match(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { uint8_t ret = 0; if (p->payload_len == 0) { /* No error, parser done, no data in bounds to decode */ return 0; } const DetectAsn1Data *ad = (const DetectAsn1Data *)ctx; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; if (ad->flags & ASN1_ABSOLUTE_OFFSET) { SCAsn1CtxInit(ac, p->payload + ad->absolute_offset, p->payload_len - ad->absolute_offset); } else if (ad->flags & ASN1_RELATIVE_OFFSET) { SCAsn1CtxInit(ac, p->payload + ad->relative_offset, p->payload_len - ad->relative_offset); } else { SCAsn1CtxInit(ac, p->payload, p->payload_len); } SCAsn1Decode(ac, ac->cur_frame); /* Ok, now we have all the data. Let's check the nodes */ if (ac->cur_frame > 0 || (ac->asn1_stack[0] != NULL && ac->asn1_stack[0]->id.ptr != NULL)) { /* We spect at least one node */ uint16_t n_iter = 0; ret = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ ret = DetectAsn1Checks(node, ad); /* Got a match? */ if (ret == 1) break; } } SCAsn1CtxDestroy(ac); return ret; } /** * \brief This function is used to parse asn1 options passed via asn1: keyword * * \param asn1str Pointer to the user provided asn1 options * * \retval fd pointer to DetectAsn1Data on success * \retval NULL on failure */ DetectAsn1Data *DetectAsn1Parse(char *asn1str) { DetectAsn1Data *fd = NULL; char *tok = NULL; uint32_t ov_len = 0; uint32_t abs_off = 0; int32_t rel_off = 0; uint8_t flags = 0; char *saveptr = NULL; tok = strtok_r(asn1str, ASN_DELIM, &saveptr); if (tok == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed asn1 argument: %s", asn1str); return NULL; } while (tok != NULL) { if (strcasecmp("bitstring_overflow", tok) == 0) { /* No arg here, just set the flag */ flags |= ASN1_BITSTRING_OVF; } else if (strcasecmp("double_overflow", tok) == 0) { /* No arg here, just set the flag */ flags |= ASN1_DOUBLE_OVF; } else if (strcasecmp("oversize_length", tok) == 0) { flags |= ASN1_OVERSIZE_LEN; /* get the param */ tok = strtok_r(NULL, ASN_DELIM, &saveptr); if ( tok == NULL || ByteExtractStringUint32(&ov_len, 10, 0, tok) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed value for " "oversize_length: %s", tok); goto error; } } else if (strcasecmp("absolute_offset", tok) == 0) { flags |= ASN1_ABSOLUTE_OFFSET; /* get the param */ tok = strtok_r(NULL, ASN_DELIM, &saveptr); if (tok == NULL || ByteExtractStringUint32(&abs_off, 10, 0, tok) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed value for " "absolute_offset: %s", tok); goto error; } } else if (strcasecmp("relative_offset",tok) == 0) { flags |= ASN1_RELATIVE_OFFSET; /* get the param */ tok = strtok_r(NULL, ASN_DELIM, &saveptr); if (tok == NULL || ByteExtractStringInt32(&rel_off, 10, 0, tok) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed value for " "relative_offset: %s", tok); goto error; } } else { SCLogError(SC_ERR_INVALID_VALUE, "Malformed asn1 argument: %s", asn1str); return NULL; } tok = strtok_r(NULL, ASN_DELIM, &saveptr); } fd = SCMalloc(sizeof(DetectAsn1Data)); if (unlikely(fd == NULL)) { exit(EXIT_FAILURE); } memset(fd, 0x00, sizeof(DetectAsn1Data)); fd->flags = flags; fd->oversize_length = ov_len; /* Length argument if needed */ fd->absolute_offset = abs_off; /* Length argument if needed */ fd->relative_offset = rel_off; /* Length argument if needed */ return fd; error: return NULL; } /** * \brief this function is used to add the parsed asn1 data into * the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param asn1str pointer to the user provided asn1 options * * \retval 0 on Success * \retval -1 on Failure */ int DetectAsn1Setup(DetectEngineCtx *de_ctx, Signature *s, char *asn1str) { DetectAsn1Data *ad = NULL; SigMatch *sm = NULL; ad = DetectAsn1Parse(asn1str); if (ad == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ASN1; sm->ctx = (SigMatchCtx *)ad; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (ad != NULL) DetectAsn1Free(ad); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectAsn1Data * * \param ad pointer to DetectAsn1Data */ void DetectAsn1Free(void *ptr) { DetectAsn1Data *ad = (DetectAsn1Data *)ptr; SCFree(ad); } #ifdef UNITTESTS /** * \test DetectAsn1TestParse01 check that we parse oversize_length correctly */ int DetectAsn1TestParse01(void) { int result = 0; char str[] = "oversize_length 1024"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL) { if (ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN)) { result = 1; } DetectAsn1Free(ad); } return result; } /** * \test DetectAsn1TestParse02 check that we parse absolute_offset correctly */ int DetectAsn1TestParse02(void) { int result = 0; DetectAsn1Data *ad = NULL; char str[] = "absolute_offset 1024"; ad = DetectAsn1Parse(str); if (ad != NULL && ad->absolute_offset == 1024 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse03 check that we parse relative_offset correctly */ int DetectAsn1TestParse03(void) { int result = 0; char str[] = "relative_offset 1024"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->relative_offset == 1024 && (ad->flags & ASN1_RELATIVE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse04 check that we parse bitstring_overflow correctly */ int DetectAsn1TestParse04(void) { int result = 0; char str[] = "bitstring_overflow"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_BITSTRING_OVF)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse05 check that we parse double_overflow correctly */ int DetectAsn1TestParse05(void) { int result = 0; char str[] = "double_overflow"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_DOUBLE_OVF)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse06 check that we fail if a needed arg is not given */ int DetectAsn1TestParse06(void) { int result = 1; char str[] = "absolute_offset"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL) { DetectAsn1Free(ad); result = 0; } return result; } /** * \test DetectAsn1TestParse07 check that we fail if a needed arg is not given */ int DetectAsn1TestParse07(void) { int result = 1; char str[] = "relative_offset"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL) { DetectAsn1Free(ad); result = 0; } return result; } /** * \test DetectAsn1TestParse08 check that we fail if a needed arg is not given */ int DetectAsn1TestParse08(void) { int result = 1; char str[] = "oversize_length"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL) { DetectAsn1Free(ad); result = 0; } return result; } /** * \test DetectAsn1TestParse09 test that we break on invalid options */ int DetectAsn1TestParse09(void) { int result = 1; DetectAsn1Data *fd = NULL; char str[] = "oversize_length 1024, lalala 360"; fd = DetectAsn1Parse(str); if (fd != NULL) { result = 0; DetectAsn1Free(fd); } return result; } /** * \test DetectAsn1TestParse10 test that we break with a empty string */ int DetectAsn1TestParse10(void) { int result = 1; DetectAsn1Data *fd = NULL; char str[] = ""; fd = DetectAsn1Parse(str); if (fd != NULL) { result = 0; DetectAsn1Free(fd); } return result; } /** * \test DetectAsn1TestParse11 check for combinations of keywords */ int DetectAsn1TestParse11(void) { int result = 0; char str[] = "oversize_length 1024, relative_offset 10"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN) && ad->relative_offset == 10 && (ad->flags & ASN1_RELATIVE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse12 check for combinations of keywords */ int DetectAsn1TestParse12(void) { int result = 0; char str[] = "oversize_length 1024 absolute_offset 10"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN) && ad->absolute_offset == 10 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse13 check for combinations of keywords */ int DetectAsn1TestParse13(void) { int result = 0; char str[] = "oversize_length 1024 absolute_offset 10, bitstring_overflow"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN) && (ad->flags & ASN1_BITSTRING_OVF) && ad->absolute_offset == 10 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse14 check for combinations of keywords */ int DetectAsn1TestParse14(void) { int result = 0; char str[] = "double_overflow, oversize_length 1024 absolute_offset 10," " bitstring_overflow"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN) && (ad->flags & ASN1_BITSTRING_OVF) && (ad->flags & ASN1_DOUBLE_OVF) && ad->absolute_offset == 10 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1TestParse15 check for combinations of keywords */ int DetectAsn1TestParse15(void) { int result = 0; char str[] = "double_overflow, oversize_length 1024 relative_offset 10," " bitstring_overflow"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 1024 && (ad->flags & ASN1_OVERSIZE_LEN) && (ad->flags & ASN1_BITSTRING_OVF) && (ad->flags & ASN1_DOUBLE_OVF) && ad->relative_offset == 10 && (ad->flags & ASN1_RELATIVE_OFFSET)) { DetectAsn1Free(ad); result = 1; } return result; } /** * \test DetectAsn1Test01 Ensure that the checks work when they should */ static int DetectAsn1Test01(void) { /* Match if any of the nodes after offset 0 has greater length than 10 */ char str[] = "oversize_length 132 absolute_offset 0"; DetectAsn1Data *ad = DetectAsn1Parse(str); FAIL_IF_NULL(ad); FAIL_IF_NOT(ad->oversize_length == 132); FAIL_IF_NOT(ad->flags & ASN1_OVERSIZE_LEN); FAIL_IF_NOT(ad->absolute_offset == 0); FAIL_IF_NOT(ad->flags & ASN1_ABSOLUTE_OFFSET); // Example from the specification X.690-0207 Appendix A.3 char buf[] = "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717"; Asn1Ctx *ac = SCAsn1CtxNew(); FAIL_IF_NULL(ac); uint16_t len = strlen((char *)buf)-1; SCAsn1CtxInit(ac, (uint8_t *)buf, len); SCAsn1Decode(ac, ac->cur_frame); /* The first node has length 133, so it should match the oversize */ FAIL_IF_NOT(ac->cur_frame > 0); /* We spect at least one node */ uint16_t n_iter = 0; int result = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result = DetectAsn1Checks(node, ad); /* Got a match? */ if (result == 1) break; } FAIL_IF(result != 1); SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); PASS; } /** * \test DetectAsn1Test02 Ensure that the checks work when they should */ int DetectAsn1Test02(void) { int result = 0; /* Match if any of the nodes has the bitstring overflow condition */ char str[] = "oversize_length 133, absolute_offset 0"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && ad->oversize_length == 133 && (ad->flags & ASN1_OVERSIZE_LEN) && ad->absolute_offset == 0 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { // Example from the specification X.690-0207 Appendix A.3 uint8_t *buf = (uint8_t*) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint16_t len = strlen((char *)buf)-1; SCAsn1CtxInit(ac, buf, len); SCAsn1Decode(ac, ac->cur_frame); /* The first node has length 133, so it should match the oversize */ if (ac->cur_frame > 0) { /* We spect at least one node */ uint16_t n_iter = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result |= DetectAsn1Checks(node, ad); } } /* Got a match? We don't have nodes greater than 133, it should not */ if (result == 1) { printf("Error, oversize_length should not match" " any of the nodes: "); result = 0; } else { result = 1; } SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); } return result; } /** * \test DetectAsn1Test03 Ensure that the checks work when they should */ int DetectAsn1Test03(void) { int result = 0; /* Match if any of the nodes after offset 0 has a bitstring overflow */ char str[] = "bitstring_overflow, absolute_offset 0"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_BITSTRING_OVF) && ad->absolute_offset == 0 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { /* Let's say tagnum bitstring, primitive, and as universal tag, * and then length = 1 octet, but the next octet specify to ignore * the last 256 bits... (let's match!) */ uint8_t *buf = (uint8_t*) "\x03\x01\xFF"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint16_t len = 3; SCAsn1CtxInit(ac, buf, len); SCAsn1Decode(ac, ac->cur_frame); if (ac->cur_frame > 0 || ac->asn1_stack[0]->id.ptr != NULL) { /* We spect at least one node */ uint16_t n_iter = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result = DetectAsn1Checks(node, ad); /* Got a match? */ if (result == 1) break; } } SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); } if (result == 0) { printf("Error, bitstring_overflow should match the first node: "); } return result; } /** * \test DetectAsn1Test04 Ensure that the checks work when they should */ int DetectAsn1Test04(void) { int result = 0; /* Match if any of the nodes after offset 0 has a bitstring overflow */ char str[] = "bitstring_overflow, absolute_offset 0"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_BITSTRING_OVF) && ad->absolute_offset == 0 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { /* Let's say tagnum bitstring, primitive, and as universal tag, * and then length = 1 octet, but the next octet specify to ignore * the last 7 bits... (should not match) */ uint8_t *buf = (uint8_t*) "\x03\x01\x07"; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint16_t len = 3; SCAsn1CtxInit(ac, buf, len); SCAsn1Decode(ac, ac->cur_frame); if (ac->cur_frame > 0 || ac->asn1_stack[0]->id.ptr != NULL) { /* We spect at least one node */ uint16_t n_iter = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result = DetectAsn1Checks(node, ad); /* Got a match? */ if (result == 1) break; } } SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); } if (result == 1) { printf("Error, bitstring_overflog should not match any node: "); result = 0; } else { result = 1; } return result; } /** * \test DetectAsn1Test05 Ensure that the checks work when they should */ int DetectAsn1Test05(void) { int result = 0; /* Match if any of the nodes after offset 0 has a double overflow */ char str[] = "double_overflow, absolute_offset 0"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_DOUBLE_OVF) && ad->absolute_offset == 0 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { /* Let's say tag num 9 (type Real), and encoded as ASCII, with length * 257, then we must match */ uint8_t buf[261]; /* universal class, primitive type, tag_num = 9 (Data type Real) */ buf[0] = '\x09'; /* length, definite form, 2 octets */ buf[1] = '\x82'; /* length is the sum of the following octets (257): */ buf[2] = '\xFE'; buf[3] = '\x03'; /* Fill the content of the number */ uint16_t i = 4; for (; i < 257;i++) buf[i] = '\x05'; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint16_t len = 261; SCAsn1CtxInit(ac, buf, len); SCAsn1Decode(ac, ac->cur_frame); if (ac->cur_frame > 0 || ac->asn1_stack[0]->id.ptr != NULL) { /* We spect at least one node */ uint16_t n_iter = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result = DetectAsn1Checks(node, ad); /* Got a match? */ if (result == 1) break; } } SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); } if (result == 0) { printf("Error, double_overflow should match the first node: "); } return result; } /** * \test DetectAsn1Test06 Ensure that the checks work when they should */ int DetectAsn1Test06(void) { int result = 0; /* Match if any of the nodes after offset 0 has a double overflow */ char str[] = "double_overflow, absolute_offset 0"; DetectAsn1Data *ad = NULL; ad = DetectAsn1Parse(str); if (ad != NULL && (ad->flags & ASN1_DOUBLE_OVF) && ad->absolute_offset == 0 && (ad->flags & ASN1_ABSOLUTE_OFFSET)) { /* Let's say tag num 9 (type Real), and encoded as ASCII, with length * 256, which fit in the buffer, so it should not match */ uint8_t buf[260]; /* universal class, primitive type, tag_num = 9 (Data type Real) */ buf[0] = '\x09'; /* length, definite form, 2 octets */ buf[1] = '\x82'; /* length is the sum of the following octets (256): */ buf[2] = '\xFE'; buf[3] = '\x02'; /* Fill the content of the number */ uint16_t i = 4; for (; i < 256;i++) buf[i] = '\x05'; Asn1Ctx *ac = SCAsn1CtxNew(); if (ac == NULL) return 0; uint16_t len = 260; SCAsn1CtxInit(ac, buf, len); SCAsn1Decode(ac, ac->cur_frame); if (ac->cur_frame > 0 || ac->asn1_stack[0]->id.ptr != NULL) { /* We spect at least one node */ uint16_t n_iter = 0; for (; n_iter <= ac->cur_frame; n_iter++) { Asn1Node *node = ASN1CTX_GET_NODE(ac, n_iter); if (node == NULL || node->id.ptr == NULL) continue; /* Should not happen */ result = DetectAsn1Checks(node, ad); /* Got a match? */ if (result == 1) break; } } SCAsn1CtxDestroy(ac); DetectAsn1Free(ad); } if (result == 1) { printf("Error, double_overflow should not match any node: "); result = 0 ; } else { result = 1; } return result; } /** * \test DetectAsn1TestReal01 Ensure that all works together */ int DetectAsn1TestReal01(void) { int result = 0; uint8_t *buf = (uint8_t *) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen = strlen((char *)buf) - 1; /* Check the start with AA (this is to test the relative_offset keyword) */ uint8_t *buf2 = (uint8_t *) "AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen2 = strlen((char *)buf2) - 1; Packet *p[2]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf2, buflen2, IPPROTO_TCP); if (p[0] == NULL || p[1] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; " "content:\"Pablo\"; asn1:absolute_offset 0, " "oversize_length 130; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; " "content:\"AA\"; asn1:relative_offset 2, " "oversize_length 130; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; " "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[2][3] = { /* packet 0 match sid 1 */ {1, 0, 0}, /* packet 1 match sid 2 */ {0, 1, 0}}; /* None of the packets should match sid 3 */ result = UTHGenericTest(p, 2, sigs, sid, (uint32_t *) results, 3); UTHFreePackets(p, 2); end: return result; } /** * \test DetectAsn1TestReal02 Ensure that all works together */ int DetectAsn1TestReal02(void) { int result = 0; uint8_t *buf = (uint8_t *) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen = strlen((char *)buf) - 1; /* Check the start with AA (this is to test the relative_offset keyword) */ uint8_t *buf2 = (uint8_t *) "AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen2 = strlen((char *)buf2) - 1; Packet *p[2]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf2, buflen2, IPPROTO_TCP); if (p[0] == NULL || p[1] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; " "content:\"Pablo\"; asn1:absolute_offset 0, " "oversize_length 140; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; " "content:\"AA\"; asn1:relative_offset 2, " "oversize_length 140; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; " "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[2][3] = { {0, 0, 0}, {0, 0, 0}}; /* None of the packets should match */ result = UTHGenericTest(p, 2, sigs, sid, (uint32_t *) results, 3); UTHFreePackets(p, 2); end: return result; } /** * \test DetectAsn1TestReal03 Ensure that all works together */ int DetectAsn1TestReal03(void) { int result = 0; uint8_t buf[261] = ""; /* universal class, primitive type, tag_num = 9 (Data type Real) */ buf[0] = '\x09'; /* length, definite form, 2 octets */ buf[1] = '\x82'; /* length is the sum of the following octets (257): */ buf[2] = '\xFE'; buf[3] = '\x03'; /* Fill the content of the number */ uint16_t i = 4; for (; i < 257;i++) buf[i] = '\x05'; uint16_t buflen = 261; /* Check the start with AA (this is to test the relative_offset keyword) */ uint8_t *buf2 = (uint8_t *) "AA\x03\x01\xFF"; uint16_t buflen2 = 5; Packet *p[2] = { NULL, NULL }; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf2, buflen2, IPPROTO_TCP); if (p[0] == NULL || p[1] == NULL) goto end; char *sigs[3]; /* This should match the first packet */ sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; " "asn1:absolute_offset 0, double_overflow; sid:1;)"; /* This should match the second packet */ sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; " "asn1:relative_offset 2, bitstring_overflow," "oversize_length 140; sid:2;)"; /* This should match no packet */ sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; " "asn1: oversize_length 2000; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[2][3] = {{1, 0, 0}, {0, 1, 0}}; result = UTHGenericTest(p, 2, sigs, sid, (uint32_t *) results, 3); UTHFreePackets(p, 2); end: return result; } /** * \test DetectAsn1TestReal04 like the real test 02, but modified the * relative offset to check negative offset values, in this case * start decoding from -7 bytes respect the content match "John" */ int DetectAsn1TestReal04(void) { int result = 0; uint8_t *buf = (uint8_t *) "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Pablo""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen = strlen((char *)buf) - 1; /* Check the start with AA (this is to test the relative_offset keyword) */ uint8_t *buf2 = (uint8_t *) "AA\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01" "P""\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111" "\x31\x1F\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05" "Jones""\xA0\x0A\x43\x08""19590717" "\x60\x81\x85\x61\x10\x1A\x04""John""\x1A\x01""P" "\x1A\x05""Smith""\xA0\x0A\x1A\x08""Director" "\x42\x01\x33\xA1\x0A\x43\x08""19710917" "\xA2\x12\x61\x10\x1A\x04""Mary""\x1A\x01""T""\x1A\x05" "Smith""\xA3\x42\x31\x1F\x61\x11\x1A\x05""Ralph""\x1A\x01" "T""\x1A\x05""Smith""\xA0\x0A\x43\x08""19571111""\x31\x1F" "\x61\x11\x1A\x05""Susan""\x1A\x01""B""\x1A\x05""Jones" "\xA0\x0A\x43\x08""19590717"; uint16_t buflen2 = strlen((char *)buf2) - 1; Packet *p[2]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf2, buflen2, IPPROTO_TCP); if (p[0] == NULL || p[1] == NULL) goto end; char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; " "content:\"Pablo\"; asn1:absolute_offset 0, " "oversize_length 140; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; " "content:\"John\"; asn1:relative_offset -7, " "oversize_length 140; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; " "content:\"lalala\"; asn1: oversize_length 2000; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[2][3] = { {0, 0, 0}, {0, 0, 0}}; /* None of the packets should match */ result = UTHGenericTest(p, 2, sigs, sid, (uint32_t *) results, 3); UTHFreePackets(p, 2); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectAsn1 */ void DetectAsn1RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectAsn1TestParse01", DetectAsn1TestParse01); UtRegisterTest("DetectAsn1TestParse02", DetectAsn1TestParse02); UtRegisterTest("DetectAsn1TestParse03", DetectAsn1TestParse03); UtRegisterTest("DetectAsn1TestParse04", DetectAsn1TestParse04); UtRegisterTest("DetectAsn1TestParse05", DetectAsn1TestParse05); UtRegisterTest("DetectAsn1TestParse06", DetectAsn1TestParse06); UtRegisterTest("DetectAsn1TestParse07", DetectAsn1TestParse07); UtRegisterTest("DetectAsn1TestParse08", DetectAsn1TestParse08); UtRegisterTest("DetectAsn1TestParse09", DetectAsn1TestParse09); UtRegisterTest("DetectAsn1TestParse10", DetectAsn1TestParse10); UtRegisterTest("DetectAsn1TestParse11", DetectAsn1TestParse11); UtRegisterTest("DetectAsn1TestParse12", DetectAsn1TestParse12); UtRegisterTest("DetectAsn1TestParse13", DetectAsn1TestParse13); UtRegisterTest("DetectAsn1TestParse14", DetectAsn1TestParse14); UtRegisterTest("DetectAsn1TestParse15", DetectAsn1TestParse15); UtRegisterTest("DetectAsn1Test01 - oversize_len", DetectAsn1Test01); UtRegisterTest("DetectAsn1Test02 - oversize_len", DetectAsn1Test02); UtRegisterTest("DetectAsn1Test03 - bitstring_ovf", DetectAsn1Test03); UtRegisterTest("DetectAsn1Test04 - bitstring_ovf", DetectAsn1Test04); UtRegisterTest("DetectAsn1Test05 - double_ovf", DetectAsn1Test05); UtRegisterTest("DetectAsn1Test06 - double_ovf", DetectAsn1Test06); UtRegisterTest("DetectAsn1TestReal01", DetectAsn1TestReal01); UtRegisterTest("DetectAsn1TestReal02", DetectAsn1TestReal02); UtRegisterTest("DetectAsn1TestReal03", DetectAsn1TestReal03); UtRegisterTest("DetectAsn1TestReal04", DetectAsn1TestReal04); #endif /* UNITTESTS */ } suricata-3.2.1/src/output.c0000644000000000000000000010164313051004444012512 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author OISF, Jason Ish * \author Endace Technology Limited, Jason Ish * * The root logging output for all non-application logging. * * The loggers are made up of a hierarchy of loggers. At the top we * have the root logger which is the main entry point to * logging. Under the root there exists parent loggers that are the * entry point for specific types of loggers such as packet logger, * transaction loggers, etc. Each parent logger may have 0 or more * loggers that actual handle the job of producing output to something * like a file. */ #include "suricata-common.h" #include "flow.h" #include "conf.h" #include "tm-threads.h" #include "util-error.h" #include "util-debug.h" #include "output.h" #include "alert-fastlog.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "alert-prelude.h" #include "alert-syslog.h" #include "output-json-alert.h" #include "output-json-flow.h" #include "output-json-netflow.h" #include "log-droplog.h" #include "output-json-drop.h" #include "log-httplog.h" #include "output-json-http.h" #include "log-dnslog.h" #include "output-json-dns.h" #include "log-tlslog.h" #include "log-tlsstore.h" #include "output-json-tls.h" #include "output-json-ssh.h" #include "log-pcap.h" #include "log-file.h" #include "output-json-file.h" #include "output-json-smtp.h" #include "output-json-stats.h" #include "log-filestore.h" #include "log-tcp-data.h" #include "log-stats.h" #include "output-json.h" #include "output-json-template.h" #include "output-lua.h" #include "output-json-dnp3.h" typedef struct RootLogger_ { ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; OutputLogFunc LogFunc; TAILQ_ENTRY(RootLogger_) entries; } RootLogger; static TAILQ_HEAD(, RootLogger_) RootLoggers = TAILQ_HEAD_INITIALIZER(RootLoggers); typedef struct LoggerThreadStoreNode_ { void *thread_data; TAILQ_ENTRY(LoggerThreadStoreNode_) entries; } LoggerThreadStoreNode; typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_) LoggerThreadStore; /** * The list of all registered (known) output modules. */ OutputModuleList output_modules = TAILQ_HEAD_INITIALIZER(output_modules); /** * Registry of flags to be updated on file rotation notification. */ typedef struct OutputFileRolloverFlag_ { int *flag; TAILQ_ENTRY(OutputFileRolloverFlag_) entries; } OutputFileRolloverFlag; TAILQ_HEAD(, OutputFileRolloverFlag_) output_file_rotation_flags = TAILQ_HEAD_INITIALIZER(output_file_rotation_flags); void OutputRegisterRootLoggers(void); void OutputRegisterLoggers(void); /** * \brief Register an output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterModule(const char *name, const char *conf_name, OutputInitFunc InitFunc) { OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) goto error; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Output module \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered in OutputRegisterModule. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a packet output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(PacketLogFunc == NULL || PacketConditionFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->PacketLogFunc = PacketLogFunc; module->PacketConditionFunc = PacketConditionFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Packet logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a packet output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(PacketLogFunc == NULL || PacketConditionFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->PacketLogFunc = PacketLogFunc; module->PacketConditionFunc = PacketConditionFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Packet logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Wrapper function for tx output modules. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterTxModuleWrapper(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(TxLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->TxLogFunc = TxLogFunc; module->TxLogCondition = TxLogCondition; module->alproto = alproto; module->tc_log_progress = tc_log_progress; module->ts_log_progress = ts_log_progress; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Tx logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } void OutputRegisterTxSubModuleWrapper(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(TxLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->TxLogFunc = TxLogFunc; module->TxLogCondition = TxLogCondition; module->alproto = alproto; module->tc_log_progress = tc_log_progress; module->ts_log_progress = ts_log_progress; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Tx logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a tx output module with condition. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, TxLogCondition, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, TxLogCondition, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } /** * \brief Register a tx output module with progress. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc, tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } /** * \brief Register a tx output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, NULL, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, NULL, ThreadInit, ThreadDeinit, ThreadExitPrintStats); } /** * \brief Register a file output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFileModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FileLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->FileLogFunc = FileLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("File logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a file output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FileLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->FileLogFunc = FileLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("File logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a file data output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FiledataLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->FiledataLogFunc = FiledataLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Filedata logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a file data output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFiledataSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FiledataLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->FiledataLogFunc = FiledataLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Filedata logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a flow output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFlowModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FlowLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->FlowLogFunc = FlowLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Flow logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a flow output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(FlowLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->FlowLogFunc = FlowLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Flow logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a streaming data output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StreamingLogger StreamingLogFunc, enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(StreamingLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->StreamingLogFunc = StreamingLogFunc; module->stream_type = stream_type; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Streaming logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a streaming data output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterStreamingSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StreamingLogger StreamingLogFunc, enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(StreamingLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->StreamingLogFunc = StreamingLogFunc; module->stream_type = stream_type; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Streaming logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a stats data output module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(StatsLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->InitFunc = InitFunc; module->StatsLogFunc = StatsLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Stats logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Register a stats data output sub-module. * * This function will register an output module so it can be * configured with the configuration file. * * \retval Returns 0 on success, -1 on failure. */ void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { if (unlikely(StatsLogFunc == NULL)) { goto error; } OutputModule *module = SCCalloc(1, sizeof(*module)); if (unlikely(module == NULL)) { goto error; } module->logger_id = id; module->name = name; module->conf_name = conf_name; module->parent_name = parent_name; module->InitSubFunc = InitFunc; module->StatsLogFunc = StatsLogFunc; module->ThreadInit = ThreadInit; module->ThreadDeinit = ThreadDeinit; module->ThreadExitPrintStats = ThreadExitPrintStats; TAILQ_INSERT_TAIL(&output_modules, module, entries); SCLogDebug("Stats logger \"%s\" registered.", name); return; error: SCLogError(SC_ERR_FATAL, "Fatal error encountered. Exiting..."); exit(EXIT_FAILURE); } /** * \brief Get an output module by name. * * \retval The OutputModule with the given name or NULL if no output module * with the given name is registered. */ OutputModule *OutputGetModuleByConfName(const char *conf_name) { OutputModule *module; TAILQ_FOREACH(module, &output_modules, entries) { if (strcmp(module->conf_name, conf_name) == 0) return module; } return NULL; } /** * \brief Deregister all modules. Useful for a memory clean exit. */ void OutputDeregisterAll(void) { OutputModule *module; while ((module = TAILQ_FIRST(&output_modules))) { TAILQ_REMOVE(&output_modules, module, entries); SCFree(module); } } static int drop_loggers = 0; int OutputDropLoggerEnable(void) { if (drop_loggers) return -1; drop_loggers++; return 0; } void OutputDropLoggerDisable(void) { if (drop_loggers) drop_loggers--; } static int ssh_loggers = 0; int OutputSshLoggerEnable(void) { if (ssh_loggers) return -1; ssh_loggers++; return 0; } void OutputSshLoggerDisable(void) { if (ssh_loggers) ssh_loggers--; } /** * \brief Register a flag for file rotation notification. * * \param flag A pointer that will be set to 1 when file rotation is * requested. */ void OutputRegisterFileRotationFlag(int *flag) { OutputFileRolloverFlag *flag_entry = SCCalloc(1, sizeof(*flag_entry)); if (unlikely(flag_entry == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory to register file rotation flag"); return; } flag_entry->flag = flag; TAILQ_INSERT_TAIL(&output_file_rotation_flags, flag_entry, entries); } /** * \brief Unregister a file rotation flag. * * Note that it is safe to call this function with a flag that may not * have been registered, in which case this function won't do * anything. * * \param flag A pointer that has been previously registered for file * rotation notifications. */ void OutputUnregisterFileRotationFlag(int *flag) { OutputFileRolloverFlag *entry, *next; for (entry = TAILQ_FIRST(&output_file_rotation_flags); entry != NULL; entry = next) { next = TAILQ_NEXT(entry, entries); if (entry->flag == flag) { TAILQ_REMOVE(&output_file_rotation_flags, entry, entries); SCFree(entry); break; } } } /** * \brief Notifies all registered file rotation notification flags. */ void OutputNotifyFileRotation(void) { OutputFileRolloverFlag *flag; TAILQ_FOREACH(flag, &output_file_rotation_flags, entries) { *(flag->flag) = 1; } } TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data) { LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data; RootLogger *logger = TAILQ_FIRST(&RootLoggers); LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store); while (logger && thread_store_node) { if (logger->LogFunc != NULL) { logger->LogFunc(tv, p, thread_store_node->thread_data); } logger = TAILQ_NEXT(logger, entries); thread_store_node = TAILQ_NEXT(thread_store_node, entries); } return TM_ECODE_OK; } TmEcode OutputLoggerThreadInit(ThreadVars *tv, void *initdata, void **data) { LoggerThreadStore *thread_store = SCCalloc(1, sizeof(*thread_store)); if (thread_store == NULL) { return TM_ECODE_FAILED; } TAILQ_INIT(thread_store); *data = (void *)thread_store; RootLogger *logger; TAILQ_FOREACH(logger, &RootLoggers, entries) { void *child_thread_data = NULL; if (logger->ThreadInit != NULL) { if (logger->ThreadInit(tv, initdata, &child_thread_data) == TM_ECODE_OK) { LoggerThreadStoreNode *thread_store_node = SCCalloc(1, sizeof(*thread_store_node)); if (thread_store_node == NULL) { /* Undo everything, calling de-init will take care * of that. */ OutputLoggerThreadDeinit(tv, thread_store); return TM_ECODE_FAILED; } thread_store_node->thread_data = child_thread_data; TAILQ_INSERT_TAIL(thread_store, thread_store_node, entries); } } } return TM_ECODE_OK; } TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data) { LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data; RootLogger *logger = TAILQ_FIRST(&RootLoggers); LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store); while (logger && thread_store_node) { if (logger->ThreadDeinit != NULL) { logger->ThreadDeinit(tv, thread_store_node->thread_data); } logger = TAILQ_NEXT(logger, entries); thread_store_node = TAILQ_NEXT(thread_store_node, entries); } /* Free the thread store. */ while ((thread_store_node = TAILQ_FIRST(thread_store)) != NULL) { TAILQ_REMOVE(thread_store, thread_store_node, entries); SCFree(thread_store_node); } SCFree(thread_store); return TM_ECODE_OK; } void OutputLoggerExitPrintStats(ThreadVars *tv, void *thread_data) { LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data; RootLogger *logger = TAILQ_FIRST(&RootLoggers); LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store); while (logger && thread_store_node) { if (logger->ThreadExitPrintStats != NULL) { logger->ThreadExitPrintStats(tv, thread_store_node->thread_data); } logger = TAILQ_NEXT(logger, entries); thread_store_node = TAILQ_NEXT(thread_store_node, entries); } } void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats, OutputLogFunc LogFunc) { RootLogger *logger = SCCalloc(1, sizeof(*logger)); if (logger == NULL) { return; } logger->ThreadInit = ThreadInit; logger->ThreadDeinit = ThreadDeinit; logger->ThreadExitPrintStats = ThreadExitPrintStats; logger->LogFunc = LogFunc; TAILQ_INSERT_TAIL(&RootLoggers, logger, entries); } void TmModuleLoggerRegister(void) { OutputRegisterRootLoggers(); OutputRegisterLoggers(); } /** * \brief Register all root loggers. */ void OutputRegisterRootLoggers(void) { OutputPacketLoggerRegister(); OutputTxLoggerRegister(); OutputFiledataLoggerRegister(); OutputFileLoggerRegister(); OutputStreamingLoggerRegister(); } /** * \brief Register all non-root logging modules. */ void OutputRegisterLoggers(void) { LuaLogRegister(); /* fast log */ AlertFastLogRegister(); /* debug log */ AlertDebugLogRegister(); /* prelue log */ AlertPreludeRegister(); /* syslog log */ AlertSyslogRegister(); /* unified2 log */ Unified2AlertRegister(); /* drop log */ LogDropLogRegister(); JsonDropLogRegister(); /* json log */ OutputJsonRegister(); /* email logs */ JsonSmtpLogRegister(); /* http log */ LogHttpLogRegister(); JsonHttpLogRegister(); /* tls log */ LogTlsLogRegister(); JsonTlsLogRegister(); LogTlsStoreRegister(); /* ssh */ JsonSshLogRegister(); /* pcap log */ PcapLogRegister(); /* file log */ LogFileLogRegister(); JsonFileLogRegister(); LogFilestoreRegister(); /* dns log */ LogDnsLogRegister(); JsonDnsLogRegister(); /* tcp streaming data */ LogTcpDataLogRegister(); /* log stats */ LogStatsLogRegister(); JsonAlertLogRegister(); /* flow/netflow */ JsonFlowLogRegister(); JsonNetFlowLogRegister(); /* json stats */ JsonStatsLogRegister(); /* DNP3. */ JsonDNP3LogRegister(); /* Template JSON logger. */ JsonTemplateLogRegister(); } suricata-3.2.1/src/detect-tls-cert-validity.c0000644000000000000000000022045613051004444016004 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland * * Implements tls certificate validity keywords */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-tls-cert-validity.h" #include "detect-engine-tls.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "util-time.h" #include "util-unittest.h" #include "util-unittest-helper.h" /** * [tls_notbefore|tls_notafter]:[<|>][<>]; */ #define PARSE_REGEX "^\\s*(<|>)?\\s*([ -:TW0-9]+)\\s*(?:(<>)\\s*([ -:TW0-9]+))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectTlsValidityMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, void *, const Signature *, const SigMatchCtx *); static time_t DateStringToEpoch (char *); static DetectTlsValidityData *DetectTlsValidityParse (char *); static int DetectTlsExpiredSetup (DetectEngineCtx *, Signature *s, char *str); static int DetectTlsValidSetup (DetectEngineCtx *, Signature *s, char *str); static int DetectTlsNotBeforeSetup (DetectEngineCtx *, Signature *s, char *str); static int DetectTlsNotAfterSetup (DetectEngineCtx *, Signature *s, char *str); static int DetectTlsValiditySetup (DetectEngineCtx *, Signature *s, char *str, uint8_t); void TlsNotBeforeRegisterTests(void); void TlsNotAfterRegisterTests(void); void TlsExpiredRegisterTests(void); void TlsValidRegisterTests(void); static void DetectTlsValidityFree(void *); /** * \brief Registration function for tls validity keywords. */ void DetectTlsValidityRegister (void) { sigmatch_table[DETECT_AL_TLS_NOTBEFORE].name = "tls_cert_notbefore"; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].desc = "match TLS certificate notBefore field"; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsnotbefore"; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].Match = NULL; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].AppLayerTxMatch = DetectTlsValidityMatch; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].Setup = DetectTlsNotBeforeSetup; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].Free = DetectTlsValidityFree; sigmatch_table[DETECT_AL_TLS_NOTBEFORE].RegisterTests = TlsNotBeforeRegisterTests; sigmatch_table[DETECT_AL_TLS_NOTAFTER].name = "tls_cert_notafter"; sigmatch_table[DETECT_AL_TLS_NOTAFTER].desc = "match TLS certificate notAfter field"; sigmatch_table[DETECT_AL_TLS_NOTAFTER].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsnotafter"; sigmatch_table[DETECT_AL_TLS_NOTAFTER].Match = NULL; sigmatch_table[DETECT_AL_TLS_NOTAFTER].AppLayerTxMatch = DetectTlsValidityMatch; sigmatch_table[DETECT_AL_TLS_NOTAFTER].Setup = DetectTlsNotAfterSetup; sigmatch_table[DETECT_AL_TLS_NOTAFTER].Free = DetectTlsValidityFree; sigmatch_table[DETECT_AL_TLS_NOTAFTER].RegisterTests = TlsNotAfterRegisterTests; sigmatch_table[DETECT_AL_TLS_EXPIRED].name = "tls_cert_expired"; sigmatch_table[DETECT_AL_TLS_EXPIRED].desc = "match expired TLS certificates"; sigmatch_table[DETECT_AL_TLS_EXPIRED].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsexpired"; sigmatch_table[DETECT_AL_TLS_EXPIRED].Match = NULL; sigmatch_table[DETECT_AL_TLS_EXPIRED].AppLayerTxMatch = DetectTlsValidityMatch; sigmatch_table[DETECT_AL_TLS_EXPIRED].Setup = DetectTlsExpiredSetup; sigmatch_table[DETECT_AL_TLS_EXPIRED].Free = DetectTlsValidityFree; sigmatch_table[DETECT_AL_TLS_EXPIRED].RegisterTests = TlsExpiredRegisterTests; sigmatch_table[DETECT_AL_TLS_EXPIRED].flags = SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_TLS_VALID].name = "tls_cert_valid"; sigmatch_table[DETECT_AL_TLS_VALID].desc = "match valid TLS certificates"; sigmatch_table[DETECT_AL_TLS_VALID].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsvalid"; sigmatch_table[DETECT_AL_TLS_VALID].Match = NULL; sigmatch_table[DETECT_AL_TLS_VALID].AppLayerTxMatch = DetectTlsValidityMatch; sigmatch_table[DETECT_AL_TLS_VALID].Setup = DetectTlsValidSetup; sigmatch_table[DETECT_AL_TLS_VALID].Free = DetectTlsValidityFree; sigmatch_table[DETECT_AL_TLS_VALID].RegisterTests = TlsValidRegisterTests; sigmatch_table[DETECT_AL_TLS_VALID].flags = SIGMATCH_NOOPT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSVALIDITY_MATCH, DetectEngineInspectTlsValidity); } /** * \internal * \brief Function to match validity field in a tls certificate. * * \param t Pointer to thread vars. * \param det_ctx Pointer to the pattern matcher thread. * \param f Pointer to the current flow. * \param flags Flags. * \param state App layer state. * \param s Pointer to the Signature. * \param m Pointer to the sigmatch that we will cast into * DetectTlsValidityData. * * \retval 0 no match. * \retval 1 match. */ static int DetectTlsValidityMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, void *txv, const Signature *s, const SigMatchCtx *ctx) { SCEnter(); SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(0); } int ret = 0; SSLStateConnp *connp = NULL; if (flags & STREAM_TOSERVER) connp = &ssl_state->client_connp; else connp = &ssl_state->server_connp; const DetectTlsValidityData *dd = (const DetectTlsValidityData *)ctx; time_t cert_epoch = 0; if (dd->type == DETECT_TLS_TYPE_NOTBEFORE) cert_epoch = connp->cert0_not_before; else if (dd->type == DETECT_TLS_TYPE_NOTAFTER) cert_epoch = connp->cert0_not_after; if (cert_epoch == 0) SCReturnInt(0); if ((dd->mode & DETECT_TLS_VALIDITY_EQ) && cert_epoch == dd->epoch) ret = 1; else if ((dd->mode & DETECT_TLS_VALIDITY_LT) && cert_epoch <= dd->epoch) ret = 1; else if ((dd->mode & DETECT_TLS_VALIDITY_GT) && cert_epoch >= dd->epoch) ret = 1; else if ((dd->mode & DETECT_TLS_VALIDITY_RA) && cert_epoch >= dd->epoch && cert_epoch <= dd->epoch2) ret = 1; else if ((dd->mode & DETECT_TLS_VALIDITY_EX) && f->lastts.tv_sec > cert_epoch) ret = 1; else if ((dd->mode & DETECT_TLS_VALIDITY_VA) && f->lastts.tv_sec <= cert_epoch) ret = 1; SCReturnInt(ret); } /** * \internal * \brief Function to check if string is epoch. * * \param string Date string. * * \retval epoch time on success. * \retval 0 on failure. */ static time_t StringIsEpoch (char *string) { if (strlen(string) == 0) return -1; /* We assume that the date string is epoch if it consists of only digits. */ char *sp = string; while (*sp) { if (isdigit(*sp++) == 0) return -1; } return strtol(string, NULL, 10); } /** * \internal * \brief Function to convert date string to epoch. * * \param string Date string. * * \retval epoch on success. * \retval 0 on failure. */ static time_t DateStringToEpoch (char *string) { int r = 0; struct tm tm; char *patterns[] = { /* ISO 8601 */ "%Y-%m", "%Y-%m-%d", "%Y-%m-%d %H", "%Y-%m-%d %H:%M", "%Y-%m-%d %H:%M:%S", "%Y-%m-%dT%H", "%Y-%m-%dT%H:%M", "%Y-%m-%dT%H:%M:%S", "%H:%M", "%H:%M:%S", }; /* Skip leading whitespace. */ while (isspace(*string)) string++; size_t inlen, oldlen; oldlen = inlen = strlen(string); /* Skip trailing whitespace */ while (inlen > 0 && isspace(string[inlen - 1])) inlen--; char tmp[inlen + 1]; if (inlen < oldlen) { strlcpy(tmp, string, inlen + 1); string = tmp; } time_t epoch = StringIsEpoch(string); if (epoch != -1) { return epoch;; } r = SCStringPatternToTime(string, patterns, 10, &tm); if (r != 0) return -1; return SCMkTimeUtc(&tm); } /** * \internal * \brief Function to parse options passed via tls validity keywords. * * \param rawstr Pointer to the user provided options. * * \retval dd pointer to DetectTlsValidityData on success. * \retval NULL on failure. */ static DetectTlsValidityData *DetectTlsValidityParse (char *rawstr) { DetectTlsValidityData *dd = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char mode[2] = ""; char value1[20] = ""; char value2[20] = ""; char range[3] = ""; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 5) { SCLogError(SC_ERR_PCRE_MATCH, "Parse error %s", rawstr); goto error; } res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, mode, sizeof(mode)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("mode \"%s\"", mode); res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, value1, sizeof(value1)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("value1 \"%s\"", value1); if (ret > 3) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, range, sizeof(range)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("range \"%s\"", range); if (ret > 4) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, value2, sizeof(value2)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } SCLogDebug("value2 \"%s\"", value2); } } dd = SCMalloc(sizeof(DetectTlsValidityData)); if (unlikely(dd == NULL)) goto error; dd->epoch = 0; dd->epoch2 = 0; dd->mode = 0; if (strlen(mode) > 0) { if (mode[0] == '<') dd->mode |= DETECT_TLS_VALIDITY_LT; else if (mode[0] == '>') dd->mode |= DETECT_TLS_VALIDITY_GT; } if (strlen(range) > 0) { if (strcmp("<>", range) == 0) dd->mode |= DETECT_TLS_VALIDITY_RA; } if (strlen(range) != 0 && strlen(mode) != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Range specified but mode also set"); goto error; } if (dd->mode == 0) { dd->mode |= DETECT_TLS_VALIDITY_EQ; } /* set the first value */ dd->epoch = DateStringToEpoch(value1); if (dd->epoch == -1) goto error; /* set the second value if specified */ if (strlen(value2) > 0) { if (!(dd->mode & DETECT_TLS_VALIDITY_RA)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Multiple tls validity values specified but mode is not range"); goto error; } dd->epoch2 = DateStringToEpoch(value2); if (dd->epoch2 == -1) goto error; if (dd->epoch2 <= dd->epoch) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Second value in range must not be smaller than the first"); goto error; } } return dd; error: if (dd) SCFree(dd); return NULL; } /** * \brief Function to add the parsed tls_cert_expired into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param rawstr Pointer to the user provided flags options. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectTlsExpiredSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectTlsValidityData *dd = NULL; SigMatch *sm = NULL; SCLogDebug("\'%s\'", rawstr); dd = SCCalloc(1, sizeof(DetectTlsValidityData)); if (dd == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Allocation \'%s\' failed", rawstr); goto error; } /* okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } dd->mode = DETECT_TLS_VALIDITY_EX; dd->type = DETECT_TLS_TYPE_NOTAFTER; dd->epoch = 0; dd->epoch2 = 0; sm->type = DETECT_AL_TLS_EXPIRED; sm->ctx = (void *)dd; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_TLSVALIDITY_MATCH); return 0; error: DetectTlsValidityFree(dd); if (sm) SCFree(sm); return -1; } /** * \brief Function to add the parsed tls_cert_valid into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param rawstr Pointer to the user provided flags options. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectTlsValidSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectTlsValidityData *dd = NULL; SigMatch *sm = NULL; SCLogDebug("\'%s\'", rawstr); dd = SCCalloc(1, sizeof(DetectTlsValidityData)); if (dd == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Allocation \'%s\' failed", rawstr); goto error; } /* okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } dd->mode = DETECT_TLS_VALIDITY_VA; dd->type = DETECT_TLS_TYPE_NOTAFTER; dd->epoch = 0; dd->epoch2 = 0; sm->type = DETECT_AL_TLS_VALID; sm->ctx = (void *)dd; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_TLSVALIDITY_MATCH); return 0; error: DetectTlsValidityFree(dd); if (sm) SCFree(sm); return -1; } /** * \brief Function to add the parsed tls_notbefore into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param rawstr Pointer to the user provided flags options. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectTlsNotBeforeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { uint8_t type = DETECT_TLS_TYPE_NOTBEFORE; int r = DetectTlsValiditySetup(de_ctx, s, rawstr, type); SCReturnInt(r); } /** * \brief Function to add the parsed tls_notafter into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param rawstr Pointer to the user provided flags options. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectTlsNotAfterSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { uint8_t type = DETECT_TLS_TYPE_NOTAFTER; int r = DetectTlsValiditySetup(de_ctx, s, rawstr, type); SCReturnInt(r); } /** * \brief Function to add the parsed tls validity field into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param rawstr Pointer to the user provided flags options. * \param type Defines if this is notBefore or notAfter. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectTlsValiditySetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr, uint8_t type) { DetectTlsValidityData *dd = NULL; SigMatch *sm = NULL; SCLogDebug("\'%s\'", rawstr); dd = DetectTlsValidityParse(rawstr); if (dd == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Parsing \'%s\' failed", rawstr); goto error; } /* okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } if (type == DETECT_TLS_TYPE_NOTBEFORE) { dd->type = DETECT_TLS_TYPE_NOTBEFORE; sm->type = DETECT_AL_TLS_NOTBEFORE; } else if (type == DETECT_TLS_TYPE_NOTAFTER) { dd->type = DETECT_TLS_TYPE_NOTAFTER; sm->type = DETECT_AL_TLS_NOTAFTER; } else { goto error; } sm->ctx = (void *)dd; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_TLS; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_TLSVALIDITY_MATCH); return 0; error: DetectTlsValidityFree(dd); if (sm) SCFree(sm); return -1; } /** * \internal * \brief Function to free memory associated with DetectTlsValidityData. * * \param de_ptr Pointer to DetectTlsValidityData. */ void DetectTlsValidityFree(void *de_ptr) { DetectTlsValidityData *dd = (DetectTlsValidityData *)de_ptr; if (dd) SCFree(dd); } #ifdef UNITTESTS /** * \test This is a test for a valid value 1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse01 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("1430000000"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value >1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse02 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(">1430000000"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value <1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse03 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("<1430000000"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_LT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 1430000000<>1470000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse04 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("1430000000<>1470000000"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1470000000 && dd->mode == DETECT_TLS_VALIDITY_RA); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a invalid value A. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse05 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("A"); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value >1430000000<>1470000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse06 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(">1430000000<>1470000000"); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value 1430000000<>. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse07 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("1430000000<>"); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value <>1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse08 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("<>1430000000"); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value "". * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse09 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(""); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value " ". * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse10 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(" "); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a invalid value 1490000000<>1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse11 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("1490000000<>1430000000"); FAIL_IF_NOT_NULL(dd); PASS; } /** * \test This is a test for a valid value 1430000000 <> 1490000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse12 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("1430000000 <> 1490000000"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->epoch2 == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_RA); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value > 1430000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse13 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("> 1430000000 "); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1430000000 && dd->mode == DETECT_TLS_VALIDITY_GT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value < 1490000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse14 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("< 1490000000 "); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_LT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 1490000000. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse15 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(" 1490000000 "); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1490000000 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse16 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1443657600 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value >2015-10-22. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse17 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse(">2015-10-22"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445472000 && dd->mode == DETECT_TLS_VALIDITY_GT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value <2015-10-22 23. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse18 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("<2015-10-22 23"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_LT); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10-22 23:59. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse19 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10-22 23:59"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10-22 23:59:59. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse20 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10-22 23:59:59"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10-22T23. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse21 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10-22T23"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445554800 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10-22T23:59. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse22 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10-22T23:59"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445558340 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test This is a test for a valid value 2015-10-22T23:59:59. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestParse23 (void) { DetectTlsValidityData *dd = NULL; dd = DetectTlsValidityParse("2015-10-22T23:59:59"); FAIL_IF_NULL(dd); FAIL_IF_NOT(dd->epoch == 1445558399 && dd->mode == DETECT_TLS_VALIDITY_EQ); DetectTlsValidityFree(dd); PASS; } /** * \test Test matching on validity dates in a certificate. * * \retval 1 on success. * \retval 0 on failure. */ int ValidityTestDetect01(void) { /* client hello */ uint8_t client_hello[] = { 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00, 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86, 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc, 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b, 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46, 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f, 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00, 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00, 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32, 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e, 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00, 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02, 0x03, 0x04, 0x02, 0x02, 0x02 }; /* server hello */ uint8_t server_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00, 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd, 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d, 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1, 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23, 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00, 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10, 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00 }; /* certificate */ uint8_t certificate[] = { 0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04, 0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30, 0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19, 0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37, 0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30, 0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a, 0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae, 0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f, 0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16, 0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50, 0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f, 0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45, 0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59, 0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42, 0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03, 0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1, 0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62, 0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04, 0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4, 0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8, 0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82, 0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6, 0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86, 0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd, 0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d, 0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4, 0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5, 0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d, 0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c, 0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26, 0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec, 0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c, 0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d, 0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78, 0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0, 0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40, 0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50, 0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42, 0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb, 0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b, 0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6, 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a, 0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0, 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff, 0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a, 0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94, 0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98, 0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8, 0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09, 0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34, 0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91, 0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5, 0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1, 0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1, 0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66, 0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05, 0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20, 0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc, 0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4, 0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d, 0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e, 0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63, 0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5, 0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04, 0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9, 0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98, 0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d, 0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52, 0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00, 0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83, 0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f, 0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1, 0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6, 0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d, 0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d }; Flow f; SSLState *ssl_state = NULL; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 51251, 443); p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_TLS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->pcap_cnt = 3; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_notbefore\"; " "tls_cert_notbefore:<2016-07-20; sid:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_notafter\"; " "tls_cert_notafter:>2016-09-01; sid:2;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello)); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); SigMatchSignatures(&tv, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); FAIL_IF(PacketAlertCheck(p1, 2)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p2); FAIL_IF(PacketAlertCheck(p2, 1)); FAIL_IF(PacketAlertCheck(p2, 2)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p3); FAIL_IF_NOT(PacketAlertCheck(p3, 1)); FAIL_IF_NOT(PacketAlertCheck(p3, 2)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); PASS; } /** * \test Test matching on an expired certificate. * * Traffic from expired.badssl.com * * \retval 1 on success. * \retval 0 on failure. */ int ExpiredTestDetect01(void) { /* client hello */ uint8_t client_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x5a, 0x01, 0x00, 0x00, 0x56, 0x03, 0x03, 0x62, 0x87, 0xa4, 0x11, 0x3e, 0x11, 0x32, 0x7d, 0xbc, 0x5b, 0x63, 0xb7, 0xaf, 0x55, 0x8d, 0x46, 0x5b, 0x8f, 0xac, 0x50, 0x02, 0x90, 0xe3, 0x55, 0x03, 0xfe, 0xad, 0xa6, 0x92, 0x56, 0x75, 0xf9, 0x00, 0x00, 0x08, 0x00, 0x35, 0x00, 0x2f, 0x00, 0x0a, 0x00, 0xff, 0x01, 0x00, 0x00, 0x25, 0x00, 0x00, 0x00, 0x17, 0x00, 0x15, 0x00, 0x00, 0x12, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x64, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x00, 0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x02, 0x01 }; /* server hello */ uint8_t server_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x55, 0x02, 0x00, 0x00, 0x51, 0x03, 0x03, 0x22, 0xa1, 0xd8, 0xd0, 0x3c, 0x8d, 0x32, 0x7e, 0x4f, 0x60, 0x27, 0xf6, 0x0c, 0x99, 0x7a, 0x8e, 0x6e, 0x52, 0xa5, 0xf4, 0x20, 0x2e, 0xa1, 0xa4, 0x0b, 0xd5, 0x80, 0x9b, 0xec, 0xbd, 0x2c, 0x6c, 0x20, 0x7a, 0x9b, 0xcc, 0x6b, 0xbf, 0x3d, 0xfc, 0x7c, 0x31, 0x78, 0x65, 0x1e, 0xcc, 0x41, 0x0b, 0x8b, 0x3d, 0x4e, 0xde, 0x45, 0xe5, 0x20, 0xf5, 0xbd, 0x8e, 0x99, 0xce, 0xc2, 0xad, 0x88, 0x08, 0x27, 0x00, 0x2f, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01, 0x00, 0x01, 0x00 }; /* certificate */ uint8_t certificate[] = { 0x16, 0x03, 0x03, 0x05, 0x59, 0x0b, 0x00, 0x05, 0x55, 0x00, 0x05, 0x52, 0x00, 0x05, 0x4f, 0x30, 0x82, 0x05, 0x4b, 0x30, 0x82, 0x04, 0x33, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x4a, 0xe7, 0x95, 0x49, 0xfa, 0x9a, 0xbe, 0x3f, 0x10, 0x0f, 0x17, 0xa4, 0x78, 0xe1, 0x69, 0x09, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x81, 0x90, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x31, 0x36, 0x30, 0x34, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x2d, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x52, 0x53, 0x41, 0x20, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x30, 0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x34, 0x31, 0x32, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x59, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x18, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x20, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x64, 0x31, 0x1d, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x14, 0x50, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x53, 0x53, 0x4c, 0x20, 0x57, 0x69, 0x6c, 0x64, 0x63, 0x61, 0x72, 0x64, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x14, 0x0c, 0x2a, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xc2, 0x04, 0xec, 0xf8, 0x8c, 0xee, 0x04, 0xc2, 0xb3, 0xd8, 0x50, 0xd5, 0x70, 0x58, 0xcc, 0x93, 0x18, 0xeb, 0x5c, 0xa8, 0x68, 0x49, 0xb0, 0x22, 0xb5, 0xf9, 0x95, 0x9e, 0xb1, 0x2b, 0x2c, 0x76, 0x3e, 0x6c, 0xc0, 0x4b, 0x60, 0x4c, 0x4c, 0xea, 0xb2, 0xb4, 0xc0, 0x0f, 0x80, 0xb6, 0xb0, 0xf9, 0x72, 0xc9, 0x86, 0x02, 0xf9, 0x5c, 0x41, 0x5d, 0x13, 0x2b, 0x7f, 0x71, 0xc4, 0x4b, 0xbc, 0xe9, 0x94, 0x2e, 0x50, 0x37, 0xa6, 0x67, 0x1c, 0x61, 0x8c, 0xf6, 0x41, 0x42, 0xc5, 0x46, 0xd3, 0x16, 0x87, 0x27, 0x9f, 0x74, 0xeb, 0x0a, 0x9d, 0x11, 0x52, 0x26, 0x21, 0x73, 0x6c, 0x84, 0x4c, 0x79, 0x55, 0xe4, 0xd1, 0x6b, 0xe8, 0x06, 0x3d, 0x48, 0x15, 0x52, 0xad, 0xb3, 0x28, 0xdb, 0xaa, 0xff, 0x6e, 0xff, 0x60, 0x95, 0x4a, 0x77, 0x6b, 0x39, 0xf1, 0x24, 0xd1, 0x31, 0xb6, 0xdd, 0x4d, 0xc0, 0xc4, 0xfc, 0x53, 0xb9, 0x6d, 0x42, 0xad, 0xb5, 0x7c, 0xfe, 0xae, 0xf5, 0x15, 0xd2, 0x33, 0x48, 0xe7, 0x22, 0x71, 0xc7, 0xc2, 0x14, 0x7a, 0x6c, 0x28, 0xea, 0x37, 0x4a, 0xdf, 0xea, 0x6c, 0xb5, 0x72, 0xb4, 0x7e, 0x5a, 0xa2, 0x16, 0xdc, 0x69, 0xb1, 0x57, 0x44, 0xdb, 0x0a, 0x12, 0xab, 0xde, 0xc3, 0x0f, 0x47, 0x74, 0x5c, 0x41, 0x22, 0xe1, 0x9a, 0xf9, 0x1b, 0x93, 0xe6, 0xad, 0x22, 0x06, 0x29, 0x2e, 0xb1, 0xba, 0x49, 0x1c, 0x0c, 0x27, 0x9e, 0xa3, 0xfb, 0x8b, 0xf7, 0x40, 0x72, 0x00, 0xac, 0x92, 0x08, 0xd9, 0x8c, 0x57, 0x84, 0x53, 0x81, 0x05, 0xcb, 0xe6, 0xfe, 0x6b, 0x54, 0x98, 0x40, 0x27, 0x85, 0xc7, 0x10, 0xbb, 0x73, 0x70, 0xef, 0x69, 0x18, 0x41, 0x07, 0x45, 0x55, 0x7c, 0xf9, 0x64, 0x3f, 0x3d, 0x2c, 0xc3, 0xa9, 0x7c, 0xeb, 0x93, 0x1a, 0x4c, 0x86, 0xd1, 0xca, 0x85, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0xd5, 0x30, 0x82, 0x01, 0xd1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x90, 0xaf, 0x6a, 0x3a, 0x94, 0x5a, 0x0b, 0xd8, 0x90, 0xea, 0x12, 0x56, 0x73, 0xdf, 0x43, 0xb4, 0x3a, 0x28, 0xda, 0xe7, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x9d, 0xee, 0xc1, 0x7b, 0x81, 0x0b, 0x3a, 0x47, 0x69, 0x71, 0x18, 0x7d, 0x11, 0x37, 0x93, 0xbc, 0xa5, 0x1b, 0x3f, 0xfb, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05, 0xa0, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x4f, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x48, 0x30, 0x46, 0x30, 0x3a, 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xb2, 0x31, 0x01, 0x02, 0x02, 0x07, 0x30, 0x2b, 0x30, 0x29, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1d, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x50, 0x53, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x01, 0x30, 0x54, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x4d, 0x30, 0x4b, 0x30, 0x49, 0xa0, 0x47, 0xa0, 0x45, 0x86, 0x43, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x81, 0x85, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x79, 0x30, 0x77, 0x30, 0x4f, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x43, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f, 0x52, 0x53, 0x41, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x24, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x63, 0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x23, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x1c, 0x30, 0x1a, 0x82, 0x0c, 0x2a, 0x2e, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0a, 0x62, 0x61, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x6a, 0x7a, 0xf1, 0xda, 0xff, 0x03, 0x07, 0x72, 0x78, 0xc5, 0x66, 0xa1, 0x4f, 0x46, 0x43, 0x0e, 0x5f, 0x14, 0x21, 0x8c, 0x75, 0x1a, 0xeb, 0x36, 0xe0, 0x1f, 0xa4, 0x10, 0x15, 0xec, 0xda, 0x33, 0x25, 0x7c, 0x3b, 0xb5, 0x0a, 0xc7, 0x01, 0x38, 0x3d, 0x27, 0xfd, 0x58, 0xd9, 0xcc, 0xea, 0x2d, 0x69, 0x39, 0x7c, 0xbe, 0x97, 0xef, 0x0b, 0xd6, 0x0b, 0x58, 0xe7, 0x8c, 0x7f, 0xbf, 0xb3, 0x4c, 0x1d, 0xf3, 0xb7, 0x90, 0x80, 0xa6, 0x36, 0x7c, 0x14, 0x5b, 0xec, 0x07, 0x2d, 0x02, 0x3e, 0x1b, 0x5b, 0x63, 0x5b, 0x15, 0xab, 0x00, 0xfa, 0x1f, 0x3b, 0x19, 0x2d, 0xdf, 0xe2, 0x23, 0x10, 0x11, 0x07, 0x7e, 0x72, 0x7f, 0xe2, 0xbf, 0xb7, 0x00, 0x1b, 0x98, 0x2f, 0x2c, 0x3f, 0xce, 0x85, 0x9a, 0x27, 0x8c, 0x10, 0x22, 0x08, 0x41, 0x2b, 0x8a, 0x3e, 0x82, 0x4e, 0xfc, 0xdd, 0x21, 0xc6, 0x56, 0x74, 0x70, 0xa4, 0x34, 0xf2, 0xb1, 0x40, 0x9e, 0x2b, 0x58, 0xa2, 0x59, 0x0f, 0x1d, 0x48, 0xef, 0xeb, 0x11, 0x3e, 0xc1, 0x4a, 0x9e, 0xbc, 0x65, 0x55, 0x6d, 0xc6, 0xa3, 0xef, 0xd5, 0xd4, 0x96, 0xcd, 0xf1, 0xae, 0x27, 0xf7, 0xa4, 0x57, 0x14, 0x3c, 0x94, 0x41, 0x05, 0x7a, 0x8b, 0xa1, 0x37, 0x47, 0xd7, 0xf5, 0x7d, 0xdc, 0xfa, 0xce, 0x6f, 0x31, 0xa2, 0xb0, 0x8c, 0xea, 0xcc, 0x12, 0x9b, 0x22, 0xf1, 0x34, 0x70, 0xcf, 0x7d, 0x75, 0x4a, 0x8b, 0x68, 0x29, 0x0c, 0x1e, 0xe9, 0x96, 0xa8, 0xcf, 0xb0, 0x12, 0x1f, 0x5c, 0x2a, 0xee, 0x67, 0x2f, 0x7f, 0xbd, 0x73, 0xf3, 0x5a, 0x01, 0x22, 0x0c, 0x70, 0xfa, 0xcd, 0x45, 0xef, 0x78, 0x5c, 0xce, 0x0d, 0xfa, 0x4e, 0xe1, 0xef, 0xce, 0x65, 0x9f, 0x47, 0x0c, 0x4f, 0xbb, 0x36, 0x44, 0x68, 0x56, 0x5c, 0x56, 0x59, 0xad, 0xaa, 0x8a, 0xbc, }; Flow f; SSLState *ssl_state = NULL; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 51251, 443); p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_TLS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->pcap_cnt = 3; f.lastts.tv_sec = 1474978656; /* 2016-09-27 */ StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_expired\"; " "tls_cert_expired; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello)); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); SigMatchSignatures(&tv, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p2); FAIL_IF(PacketAlertCheck(p2, 1)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p3); FAIL_IF_NOT(PacketAlertCheck(p3, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); PASS; } /** * \test Test matching on a valid TLS certificate. * * \retval 1 on success. * \retval 0 on failure. */ int ValidTestDetect01(void) { /* client hello */ uint8_t client_hello[] = { 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00, 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86, 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc, 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b, 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46, 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f, 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00, 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00, 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32, 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e, 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00, 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02, 0x03, 0x04, 0x02, 0x02, 0x02 }; /* server hello */ uint8_t server_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00, 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd, 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d, 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1, 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23, 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00, 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10, 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00 }; /* certificate */ uint8_t certificate[] = { 0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04, 0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30, 0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19, 0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37, 0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30, 0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a, 0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae, 0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f, 0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16, 0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50, 0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f, 0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45, 0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59, 0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42, 0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03, 0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1, 0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62, 0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04, 0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4, 0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8, 0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82, 0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6, 0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86, 0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd, 0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d, 0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4, 0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5, 0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d, 0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c, 0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26, 0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec, 0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c, 0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d, 0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78, 0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0, 0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40, 0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50, 0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42, 0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb, 0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b, 0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6, 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a, 0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0, 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff, 0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a, 0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94, 0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98, 0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8, 0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09, 0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34, 0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91, 0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5, 0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1, 0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1, 0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66, 0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05, 0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20, 0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc, 0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4, 0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d, 0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e, 0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63, 0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5, 0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04, 0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9, 0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98, 0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d, 0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52, 0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00, 0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83, 0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f, 0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1, 0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6, 0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d, 0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d }; Flow f; SSLState *ssl_state = NULL; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 51251, 443); p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_TLS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->pcap_cnt = 3; f.lastts.tv_sec = 1474978656; /* 2016-09-27 */ StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_valid\"; " "tls_cert_valid; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello)); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); SigMatchSignatures(&tv, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p2); FAIL_IF(PacketAlertCheck(p2, 1)); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate)); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p3); FAIL_IF_NOT(PacketAlertCheck(p3, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); PASS; } #endif /* UNITTESTS */ /** * \brief Register unit tests for tls_cert_notbefore. */ void TlsNotBeforeRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("ValidityTestParse01", ValidityTestParse01); UtRegisterTest("ValidityTestParse03", ValidityTestParse03); UtRegisterTest("ValidityTestParse05", ValidityTestParse05); UtRegisterTest("ValidityTestParse07", ValidityTestParse07); UtRegisterTest("ValidityTestParse09", ValidityTestParse09); UtRegisterTest("ValidityTestParse11", ValidityTestParse11); UtRegisterTest("ValidityTestParse13", ValidityTestParse13); UtRegisterTest("ValidityTestParse15", ValidityTestParse15); UtRegisterTest("ValidityTestParse17", ValidityTestParse17); UtRegisterTest("ValidityTestParse19", ValidityTestParse19); UtRegisterTest("ValidityTestParse21", ValidityTestParse21); UtRegisterTest("ValidityTestParse23", ValidityTestParse23); UtRegisterTest("ValidityTestDetect01", ValidityTestDetect01); #endif /* UNITTESTS */ } /** * \brief Register unit tests for tls_cert_notafter. */ void TlsNotAfterRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("ValidityTestParse02", ValidityTestParse02); UtRegisterTest("ValidityTestParse04", ValidityTestParse04); UtRegisterTest("ValidityTestParse06", ValidityTestParse06); UtRegisterTest("ValidityTestParse08", ValidityTestParse08); UtRegisterTest("ValidityTestParse10", ValidityTestParse10); UtRegisterTest("ValidityTestParse12", ValidityTestParse12); UtRegisterTest("ValidityTestParse14", ValidityTestParse14); UtRegisterTest("ValidityTestParse16", ValidityTestParse16); UtRegisterTest("ValidityTestParse18", ValidityTestParse18); UtRegisterTest("ValidityTestParse20", ValidityTestParse20); UtRegisterTest("ValidityTestParse22", ValidityTestParse22); #endif /* UNITTESTS */ } /** * \brief Register unit tests for tls_cert_expired */ void TlsExpiredRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("ExpiredTestDetect01", ExpiredTestDetect01); #endif /* UNITTESTS */ } /** * \brief Register unit tests for tls_cert_valid */ void TlsValidRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("ValidTestDetect01", ValidTestDetect01); #endif /* UNITTESTS */ } suricata-3.2.1/src/log-tcp-data.h0000644000000000000000000000167513051004444013437 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_TCPDATALOG_H__ #define __LOG_TCPDATALOG_H__ void LogTcpDataLogRegister(void); OutputCtx *LogTcpDataLogInitCtx(ConfNode *); #endif /* __LOG_TCPDATALOG_H__ */ suricata-3.2.1/src/detect-parse.c0000644000000000000000000033631513051004444013540 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * signature parser */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-address.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-uricontent.h" #include "detect-reference.h" #include "detect-ipproto.h" #include "detect-flow.h" #include "detect-app-layer-protocol.h" #include "detect-lua.h" #include "detect-app-layer-event.h" #include "detect-http-method.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" #include "decode.h" #include "flow.h" #include "util-rule-vars.h" #include "conf.h" #include "conf-yaml-loader.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "util-classification-config.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "string.h" #include "detect-parse.h" #include "detect-engine-iponly.h" #include "app-layer-detect-proto.h" extern int sc_set_caps; static pcre *config_pcre = NULL; static pcre *option_pcre = NULL; static pcre_extra *config_pcre_extra = NULL; static pcre_extra *option_pcre_extra = NULL; /** * \brief We use this as data to the hash table DetectEngineCtx->dup_sig_hash_table. */ typedef struct SigDuplWrapper_ { /* the signature we want to wrap */ Signature *s; /* the signature right before the above signatue in the det_ctx->sig_list */ Signature *s_prev; } SigDuplWrapper; #define CONFIG_PARTS 8 #define CONFIG_ACTION 0 #define CONFIG_PROTO 1 #define CONFIG_SRC 2 #define CONFIG_SP 3 #define CONFIG_DIREC 4 #define CONFIG_DST 5 #define CONFIG_DP 6 #define CONFIG_OPTS 7 /* if enclosed in [], spaces are allowed */ #define CONFIG_PCRE_SRCDST "(" \ "[\\[\\]A-z0-9\\.\\:_\\$\\!\\-,\\/]+" \ "|" \ "\\[[\\[\\]A-z0-9\\.\\:_\\$\\!\\-,\\/\\s]+\\]"\ ")" /* if enclosed in [], spaces are allowed */ #define CONFIG_PCRE_PORT "([\\[\\]\\:A-z0-9_\\$\\!,\\s]+)" /* format: action space(s) protocol spaces(s) src space(s) sp spaces(s) dir spaces(s) dst spaces(s) dp spaces(s) options */ #define CONFIG_PCRE "^([A-z]+)\\s+([A-z0-9\\-]+)\\s+" \ CONFIG_PCRE_SRCDST \ "\\s+"\ CONFIG_PCRE_PORT \ "\\s+(-\\>|\\<\\>|\\<\\-)\\s+" \ CONFIG_PCRE_SRCDST \ "\\s+" \ CONFIG_PCRE_PORT \ "(?:\\s+\\((.*)?(?:\\s*)\\))?(?:(?:\\s*)\\n)?\\s*$" #define OPTION_PARTS 3 #define OPTION_PCRE "^\\s*([A-z_0-9-\\.]+)(?:\\s*\\:\\s*(.*)(?list != DETECT_SM_LIST_NOTSET) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"%s\" keyword seen " "with a sticky buffer still set. Reset sticky buffer " "with pkt_data before using the modifier.", sigmatch_table[sm_type].name); goto end; } /* for now let's hardcode it as http */ if (s->alproto != ALPROTO_UNKNOWN && s->alproto != alproto) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting " "alprotos set"); goto end; } sm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"%s\" keyword " "found inside the rule without a content context. " "Please use a \"content\" keyword before using the " "\"%s\" keyword", sigmatch_table[sm_type].name, sigmatch_table[sm_type].name); goto end; } DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_RAWBYTES) { SCLogError(SC_ERR_INVALID_SIGNATURE, "%s rule can not " "be used with the rawbytes rule keyword", sigmatch_table[sm_type].name); goto end; } if (cd->flags & (DETECT_CONTENT_WITHIN | DETECT_CONTENT_DISTANCE)) { SigMatch *pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, sm->prev, DETECT_PCRE, sm->prev); if (pm != NULL) { if (pm->type == DETECT_CONTENT) { DetectContentData *tmp_cd = (DetectContentData *)pm->ctx; tmp_cd->flags &= ~DETECT_CONTENT_RELATIVE_NEXT; } else { DetectPcreData *tmp_pd = (DetectPcreData *)pm->ctx; tmp_pd->flags &= ~DETECT_PCRE_RELATIVE_NEXT; } } pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); if (pm != NULL) { if (pm->type == DETECT_CONTENT) { DetectContentData *tmp_cd = (DetectContentData *)pm->ctx; tmp_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else { DetectPcreData *tmp_pd = (DetectPcreData *)pm->ctx; tmp_pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } } } if (CustomCallback != NULL) CustomCallback(s); s->alproto = alproto; s->flags |= SIG_FLAG_APPLAYER; /* transfer the sm from the pmatch list to hcbdmatch list */ SigMatchTransferSigMatchAcrossLists(sm, &s->sm_lists[DETECT_SM_LIST_PMATCH], &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->sm_lists[sm_list], &s->sm_lists_tail[sm_list]); ret = 0; end: return ret; } SigMatch *SigMatchAlloc(void) { SigMatch *sm = SCMalloc(sizeof(SigMatch)); if (unlikely(sm == NULL)) return NULL; memset(sm, 0, sizeof(SigMatch)); sm->prev = NULL; sm->next = NULL; return sm; } /** \brief free a SigMatch * \param sm SigMatch to free. */ void SigMatchFree(SigMatch *sm) { if (sm == NULL) return; /** free the ctx, for that we call the Free func */ if (sm->ctx != NULL) { if (sigmatch_table[sm->type].Free != NULL) { sigmatch_table[sm->type].Free(sm->ctx); } } SCFree(sm); } /* Get the detection module by name */ SigTableElmt *SigTableGet(char *name) { SigTableElmt *st = NULL; int i = 0; for (i = 0; i < DETECT_TBLSIZE; i++) { st = &sigmatch_table[i]; if (st->name != NULL) { if (strcasecmp(name,st->name) == 0) return st; if (st->alias != NULL && strcasecmp(name,st->alias) == 0) return st; } } return NULL; } /** * \brief Append a SigMatch to the list type. * * \param s Signature. * \param new The sig match to append. * \param list The list to append to. */ void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list) { if (s->sm_lists[list] == NULL) { s->sm_lists[list] = new; s->sm_lists_tail[list] = new; new->next = NULL; new->prev = NULL; } else { SigMatch *cur = s->sm_lists_tail[list]; cur->next = new; new->prev = cur; new->next = NULL; s->sm_lists_tail[list] = new; } new->idx = s->sm_cnt; s->sm_cnt++; } void SigMatchRemoveSMFromList(Signature *s, SigMatch *sm, int sm_list) { if (sm == s->sm_lists[sm_list]) { s->sm_lists[sm_list] = sm->next; } if (sm == s->sm_lists_tail[sm_list]) { s->sm_lists_tail[sm_list] = sm->prev; } if (sm->prev != NULL) sm->prev->next = sm->next; if (sm->next != NULL) sm->next->prev = sm->prev; return; } /** * \brief Returns a pointer to the last SigMatch instance of a particular type * in a Signature of the payload list. * * \param s Pointer to the tail of the sigmatch list * \param type SigMatch type which has to be searched for in the Signature. * * \retval match Pointer to the last SigMatch instance of type 'type'. */ static SigMatch *SigMatchGetLastSMByType(SigMatch *sm, uint8_t type) { while (sm != NULL) { if (sm->type == type) { return sm; } sm = sm->prev; } return NULL; } /** * \brief Returns the sm with the largest index (added latest) from the lists * passed to us. * * \retval Pointer to Last sm. */ SigMatch *SigMatchGetLastSMFromLists(const Signature *s, int args, ...) { if (args == 0 || args % 2 != 0) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "You need to send an even no of args " "(non zero as well) to this function, since we need a " "SigMatch list for every SigMatch type(send a map of sm_type " "and sm_list) sent"); /* as this is a bug we should abort to ease debugging */ BUG_ON(1); } SigMatch *sm_last = NULL; SigMatch *sm_new; int i; va_list ap; va_start(ap, args); for (i = 0; i < args; i += 2) { int sm_type = va_arg(ap, int); SigMatch *sm_list = va_arg(ap, SigMatch *); sm_new = SigMatchGetLastSMByType(sm_list, sm_type); if (sm_new == NULL) continue; if (sm_last == NULL || sm_new->idx > sm_last->idx) sm_last = sm_new; } va_end(ap); return sm_last; } /** * \brief Returns the sm with the largest index (added latest) from this sig * * \retval Pointer to Last sm. */ SigMatch *SigMatchGetLastSM(const Signature *s) { SigMatch *sm_last = NULL; SigMatch *sm_new; int i; for (i = 0; i < DETECT_SM_LIST_MAX; i ++) { sm_new = s->sm_lists_tail[i]; if (sm_new == NULL) continue; if (sm_last == NULL || sm_new->idx > sm_last->idx) sm_last = sm_new; } return sm_last; } void SigMatchTransferSigMatchAcrossLists(SigMatch *sm, SigMatch **src_sm_list, SigMatch **src_sm_list_tail, SigMatch **dst_sm_list, SigMatch **dst_sm_list_tail) { /* we won't do any checks for args */ if (sm->prev != NULL) sm->prev->next = sm->next; if (sm->next != NULL) sm->next->prev = sm->prev; if (sm == *src_sm_list) *src_sm_list = sm->next; if (sm == *src_sm_list_tail) *src_sm_list_tail = sm->prev; if (*dst_sm_list == NULL) { *dst_sm_list = sm; *dst_sm_list_tail = sm; sm->next = NULL; sm->prev = NULL; } else { SigMatch *cur = *dst_sm_list_tail; cur->next = sm; sm->prev = cur; sm->next = NULL; *dst_sm_list_tail = sm; } return; } int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm) { int list = 0; for (list = 0; list < DETECT_SM_LIST_MAX; list++) { const SigMatch *sm = s->sm_lists[list]; while (sm != NULL) { if (sm == key_sm) return list; sm = sm->next; } } SCLogError(SC_ERR_INVALID_SIGNATURE, "Unable to find the sm in any of the " "sm lists"); return -1; } void SigParsePrepare(void) { char *regexstr = CONFIG_PCRE; const char *eb; int eo; int opts = 0; opts |= PCRE_UNGREEDY; config_pcre = pcre_compile(regexstr, opts, &eb, &eo, NULL); if(config_pcre == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", regexstr, eo, eb); exit(1); } config_pcre_extra = pcre_study(config_pcre, 0, &eb); if(eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); exit(1); } regexstr = OPTION_PCRE; opts |= PCRE_UNGREEDY; option_pcre = pcre_compile(regexstr, opts, &eb, &eo, NULL); if(option_pcre == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", regexstr, eo, eb); exit(1); } option_pcre_extra = pcre_study(option_pcre, 0, &eb); if(eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); exit(1); } } static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr, char *output, size_t output_size) { #define MAX_SUBSTRINGS 30 int ov[MAX_SUBSTRINGS]; int ret = 0; SigTableElmt *st = NULL; char optname[64]; char optvalue[DETECT_MAX_RULE_SIZE] = ""; ret = pcre_exec(option_pcre, option_pcre_extra, optstr, strlen(optstr), 0, 0, ov, MAX_SUBSTRINGS); /* if successful, we either have: * 2: keyword w/o value * 3: keyword w value, final opt OR keyword w/o value, more options coming * 4: keyword w value, more options coming */ if (ret != 2 && ret != 3 && ret != 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec failed: ret %" PRId32 ", optstr \"%s\"", ret, optstr); goto error; } /* extract the substrings */ if (pcre_copy_substring(optstr, ov, MAX_SUBSTRINGS, 1, optname, sizeof(optname)) < 0) { goto error; } /* Call option parsing */ st = SigTableGet(optname); if (st == NULL) { SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "unknown rule keyword '%s'.", optname); goto error; } if (ret == 3) { if (st->flags & SIGMATCH_NOOPT) { if (pcre_copy_substring(optstr, ov, MAX_SUBSTRINGS, 2, output, output_size) < 0) { goto error; } } else { if (pcre_copy_substring(optstr, ov, MAX_SUBSTRINGS, 2, optvalue, sizeof(optvalue)) < 0) { goto error; } } } else if (ret == 4) { if (pcre_copy_substring(optstr, ov, MAX_SUBSTRINGS, 2, optvalue, sizeof(optvalue)) < 0) { goto error; } if (pcre_copy_substring(optstr, ov, MAX_SUBSTRINGS, 3, output, output_size) < 0) { goto error; } } if (!(st->flags & (SIGMATCH_NOOPT|SIGMATCH_OPTIONAL_OPT))) { if (strlen(optvalue) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid formatting or malformed option to %s keyword: \'%s\'", optname, optstr); goto error; } } /* Validate double quoting, trimming trailing white space along the way. */ if (strlen(optvalue) > 0) { size_t ovlen = strlen(optvalue); if (ovlen && optvalue[0] == '"') { for (; ovlen > 0; ovlen--) { if (isblank(optvalue[ovlen - 1])) { optvalue[ovlen - 1] = '\0'; } else { break; } } if (ovlen && optvalue[ovlen - 1] != '"') { SCLogError(SC_ERR_INVALID_SIGNATURE, "bad option value formatting (possible missing semicolon) " "for keyword %s: \'%s\'", optname, optvalue); goto error; } } } /* setup may or may not add a new SigMatch to the list */ if (st->Setup(de_ctx, s, strlen(optvalue) ? optvalue : NULL) < 0) { SCLogDebug("\"%s\" failed to setup", st->name); goto error; } if (ret == 4) { return 1; } return 0; error: return -1; } /** \brief Parse address string and update signature * * \retval 0 ok, -1 error */ static int SigParseAddress(DetectEngineCtx *de_ctx, Signature *s, const char *addrstr, char flag) { SCLogDebug("Address Group \"%s\" to be parsed now", addrstr); /* pass on to the address(list) parser */ if (flag == 0) { if (strcasecmp(addrstr, "any") == 0) s->flags |= SIG_FLAG_SRC_ANY; s->src = DetectParseAddress(de_ctx, addrstr); if (s->src == NULL) goto error; } else { if (strcasecmp(addrstr, "any") == 0) s->flags |= SIG_FLAG_DST_ANY; s->dst = DetectParseAddress(de_ctx, addrstr); if (s->dst == NULL) goto error; } return 0; error: return -1; } /** * \brief Parses the protocol supplied by the Signature. * * http://www.iana.org/assignments/protocol-numbers * * \param s Pointer to the Signature instance to which the parsed * protocol has to be added. * \param protostr Pointer to the character string containing the protocol name. * * \retval 0 On successfully parsing the protocl sent as the argument. * \retval -1 On failure */ int SigParseProto(Signature *s, const char *protostr) { SCEnter(); int r = DetectProtoParse(&s->proto, (char *)protostr); if (r < 0) { s->alproto = AppLayerGetProtoByName((char *)protostr); /* indicate that the signature is app-layer */ if (s->alproto != ALPROTO_UNKNOWN) s->flags |= SIG_FLAG_APPLAYER; else { SCLogError(SC_ERR_UNKNOWN_PROTOCOL, "protocol \"%s\" cannot be used " "in a signature. Either detection for this protocol " "supported yet OR detection has been disabled for " "protocol through the yaml option " "app-layer.protocols.%s.detection-enabled", protostr, protostr); SCReturnInt(-1); } } /* if any of these flags are set they are set in a mutually exclusive * manner */ if (s->proto.flags & DETECT_PROTO_ONLY_PKT) { s->flags |= SIG_FLAG_REQUIRE_PACKET; } else if (s->proto.flags & DETECT_PROTO_ONLY_STREAM) { s->flags |= SIG_FLAG_REQUIRE_STREAM; } SCReturnInt(0); } /** * \brief Parses the port(source or destination) field, from a Signature. * * \param s Pointer to the signature which has to be updated with the * port information. * \param portstr Pointer to the character string containing the port info. * \param Flag which indicates if the portstr received is src or dst * port. For src port: flag = 0, dst port: flag = 1. * * \retval 0 On success. * \retval -1 On failure. */ static int SigParsePort(const DetectEngineCtx *de_ctx, Signature *s, const char *portstr, char flag) { int r = 0; /* XXX VJ exclude handling this for none UDP/TCP proto's */ SCLogDebug("Port group \"%s\" to be parsed", portstr); if (flag == 0) { if (strcasecmp(portstr, "any") == 0) s->flags |= SIG_FLAG_SP_ANY; r = DetectPortParse(de_ctx, &s->sp, (char *)portstr); } else if (flag == 1) { if (strcasecmp(portstr, "any") == 0) s->flags |= SIG_FLAG_DP_ANY; r = DetectPortParse(de_ctx, &s->dp, (char *)portstr); } if (r < 0) return -1; return 0; } /** \retval 1 valid * \retval 0 invalid */ static int SigParseActionRejectValidate(const char *action) { #ifdef HAVE_LIBNET11 #if defined HAVE_LIBCAP_NG && !defined HAVE_LIBNET_CAPABILITIES if (sc_set_caps == TRUE) { SCLogError(SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG, "Libnet 1.1 is " "incompatible with POSIX based capabilities with privs dropping. " "For rejects to work, run as root/super user."); return 0; } #endif #else /* no libnet 1.1 */ SCLogError(SC_ERR_LIBNET_REQUIRED_FOR_ACTION, "Libnet 1.1.x is " "required for action \"%s\" but is not compiled into Suricata", action); return 0; #endif return 1; } /** * \brief Parses the action that has been used by the Signature and allots it * to its Signature instance. * * \param s Pointer to the Signature instance to which the action belongs. * \param action Pointer to the action string used by the Signature. * * \retval 0 On successfully parsing the action string and adding it to the * Signature. * \retval -1 On failure. */ int SigParseAction(Signature *s, const char *action) { if (strcasecmp(action, "alert") == 0) { s->action = ACTION_ALERT; return 0; } else if (strcasecmp(action, "drop") == 0) { s->action = ACTION_DROP; return 0; } else if (strcasecmp(action, "pass") == 0) { s->action = ACTION_PASS; return 0; } else if (strcasecmp(action, "reject") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; s->action = ACTION_REJECT|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectsrc") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; s->action = ACTION_REJECT|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectdst") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; s->action = ACTION_REJECT_DST|ACTION_DROP; return 0; } else if (strcasecmp(action, "rejectboth") == 0) { if (!(SigParseActionRejectValidate(action))) return -1; s->action = ACTION_REJECT_BOTH|ACTION_DROP; return 0; } else { SCLogError(SC_ERR_INVALID_ACTION,"An invalid action \"%s\" was given",action); return -1; } } /** * \internal * \brief split a signature string into a few blocks for further parsing */ static int SigParseBasics(DetectEngineCtx *de_ctx, Signature *s, const char *sigstr, SignatureParser *parser, uint8_t addrs_direction) { #define MAX_SUBSTRINGS 30 int ov[MAX_SUBSTRINGS]; int ret = 0; ret = pcre_exec(config_pcre, config_pcre_extra, sigstr, strlen(sigstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 8 && ret != 9) { SCLogDebug("pcre_exec failed: ret %" PRId32 ", sigstr \"%s\"", ret, sigstr); goto error; } if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 1, parser->action, sizeof(parser->action)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 2, parser->protocol, sizeof(parser->protocol)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 3, parser->src, sizeof(parser->src)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 4, parser->sp, sizeof(parser->sp)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 5, parser->direction, sizeof(parser->direction)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 6, parser->dst, sizeof(parser->dst)) < 0) goto error; if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 7, parser->dp, sizeof(parser->dp)) < 0) goto error; if (ret == 9) { if (pcre_copy_substring(sigstr, ov, MAX_SUBSTRINGS, 8, parser->opts, sizeof(parser->opts)) < 0) goto error; } /* Parse Action */ if (SigParseAction(s, parser->action) < 0) goto error; if (SigParseProto(s, parser->protocol) < 0) goto error; if (strcmp(parser->direction, "<-") == 0) { SCLogError(SC_ERR_INVALID_DIRECTION, "\"<-\" is not a valid direction modifier, \"->\" and \"<>\" are supported."); goto error; } /* Check if it is bidirectional */ if (strcmp(parser->direction, "<>") == 0) s->init_flags |= SIG_FLAG_INIT_BIDIREC; /* Parse Address & Ports */ if (SigParseAddress(de_ctx, s, parser->src, SIG_DIREC_SRC ^ addrs_direction) < 0) goto error; if (SigParseAddress(de_ctx, s, parser->dst, SIG_DIREC_DST ^ addrs_direction) < 0) goto error; /* For IPOnly */ if (IPOnlySigParseAddress(de_ctx, s, parser->src, SIG_DIREC_SRC ^ addrs_direction) < 0) goto error; if (IPOnlySigParseAddress(de_ctx, s, parser->dst, SIG_DIREC_DST ^ addrs_direction) < 0) goto error; /* By AWS - Traditionally we should be doing this only for tcp/udp/sctp, * but we do it for regardless of ip proto, since the dns/dnstcp/dnsudp * changes that we made sees to it that at this point of time we don't * set the ip proto for the sig. We do it a bit later. */ if (SigParsePort(de_ctx, s, parser->sp, SIG_DIREC_SRC ^ addrs_direction) < 0) goto error; if (SigParsePort(de_ctx, s, parser->dp, SIG_DIREC_DST ^ addrs_direction) < 0) goto error; return 0; error: return -1; } /** * \brief parse a signature * * \param de_ctx detection engine ctx to add it to * \param s memory structure to store the signature in * \param sigstr the raw signature as a null terminated string * \param addrs_direction direction (for bi-directional sigs) * * \param -1 parse error * \param 0 ok */ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_direction) { SCEnter(); SignatureParser parser; memset(&parser, 0x00, sizeof(parser)); s->sig_str = sigstr; int ret = SigParseBasics(de_ctx, s, sigstr, &parser, addrs_direction); if (ret < 0) { SCLogDebug("SigParseBasics failed"); SCReturnInt(-1); } /* we can have no options, so make sure we have them */ if (strlen(parser.opts) > 0) { size_t buffer_size = strlen(parser.opts) + 1; char input[buffer_size]; char output[buffer_size]; memset(input, 0x00, buffer_size); memcpy(input, parser.opts, strlen(parser.opts)+1); /* loop the option parsing. Each run processes one option * and returns the rest of the option string through the * output variable. */ do { memset(output, 0x00, buffer_size); ret = SigParseOptions(de_ctx, s, input, output, buffer_size); if (ret == 1) { memcpy(input, output, buffer_size); } } while (ret == 1); } s->sig_str = NULL; DetectIPProtoRemoveAllSMs(s); SCReturnInt(ret); } Signature *SigAlloc (void) { Signature *sig = SCMalloc(sizeof(Signature)); if (unlikely(sig == NULL)) return NULL; memset(sig, 0, sizeof(Signature)); /* assign it to -1, so that we can later check if the value has been * overwritten after the Signature has been parsed, and if it hasn't been * overwritten, we can then assign the default value of 3 */ sig->prio = -1; sig->list = DETECT_SM_LIST_NOTSET; return sig; } /** * \internal * \brief Free Reference list * * \param s Pointer to the signature */ static void SigRefFree (Signature *s) { SCEnter(); DetectReference *ref = NULL; DetectReference *next_ref = NULL; if (s == NULL) { SCReturn; } SCLogDebug("s %p, s->references %p", s, s->references); for (ref = s->references; ref != NULL;) { next_ref = ref->next; DetectReferenceFree(ref); ref = next_ref; } s->references = NULL; SCReturn; } static void SigMatchFreeArrays(Signature *s) { if (s != NULL) { int type; for (type = 0; type < DETECT_SM_LIST_MAX; type++) { if (s->sm_arrays[type] != NULL) SCFree(s->sm_arrays[type]); } } } void SigFree(Signature *s) { if (s == NULL) return; if (s->CidrDst != NULL) IPOnlyCIDRListFree(s->CidrDst); if (s->CidrSrc != NULL) IPOnlyCIDRListFree(s->CidrSrc); int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { SigMatch *sm = s->sm_lists[i], *nsm; while (sm != NULL) { nsm = sm->next; SigMatchFree(sm); sm = nsm; } } SigMatchFreeArrays(s); if (s->sp != NULL) { DetectPortCleanupList(s->sp); } if (s->dp != NULL) { DetectPortCleanupList(s->dp); } if (s->msg != NULL) SCFree(s->msg); if (s->addr_src_match4 != NULL) { SCFree(s->addr_src_match4); } if (s->addr_dst_match4 != NULL) { SCFree(s->addr_dst_match4); } if (s->addr_src_match6 != NULL) { SCFree(s->addr_src_match6); } if (s->addr_dst_match6 != NULL) { SCFree(s->addr_dst_match6); } SigRefFree(s); DetectEngineAppInspectionEngine *ie = s->app_inspect; while (ie) { DetectEngineAppInspectionEngine *next = ie->next; SCFree(ie); ie = next; } SCFree(s); } /** * \internal * \brief build address match array for cache efficient matching * * \param s the signature */ static void SigBuildAddressMatchArray(Signature *s) { /* source addresses */ uint16_t cnt = 0; uint16_t idx = 0; DetectAddress *da = s->src->ipv4_head; for ( ; da != NULL; da = da->next) { cnt++; } if (cnt > 0) { s->addr_src_match4 = SCMalloc(cnt * sizeof(DetectMatchAddressIPv4)); if (s->addr_src_match4 == NULL) { exit(EXIT_FAILURE); } for (da = s->src->ipv4_head; da != NULL; da = da->next) { s->addr_src_match4[idx].ip = ntohl(da->ip.addr_data32[0]); s->addr_src_match4[idx].ip2 = ntohl(da->ip2.addr_data32[0]); idx++; } s->addr_src_match4_cnt = cnt; } /* destination addresses */ cnt = 0; idx = 0; da = s->dst->ipv4_head; for ( ; da != NULL; da = da->next) { cnt++; } if (cnt > 0) { s->addr_dst_match4 = SCMalloc(cnt * sizeof(DetectMatchAddressIPv4)); if (s->addr_dst_match4 == NULL) { exit(EXIT_FAILURE); } for (da = s->dst->ipv4_head; da != NULL; da = da->next) { s->addr_dst_match4[idx].ip = ntohl(da->ip.addr_data32[0]); s->addr_dst_match4[idx].ip2 = ntohl(da->ip2.addr_data32[0]); idx++; } s->addr_dst_match4_cnt = cnt; } /* source addresses IPv6 */ cnt = 0; idx = 0; da = s->src->ipv6_head; for ( ; da != NULL; da = da->next) { cnt++; } if (cnt > 0) { s->addr_src_match6 = SCMalloc(cnt * sizeof(DetectMatchAddressIPv6)); if (s->addr_src_match6 == NULL) { exit(EXIT_FAILURE); } for (da = s->src->ipv6_head; da != NULL; da = da->next) { s->addr_src_match6[idx].ip[0] = ntohl(da->ip.addr_data32[0]); s->addr_src_match6[idx].ip[1] = ntohl(da->ip.addr_data32[1]); s->addr_src_match6[idx].ip[2] = ntohl(da->ip.addr_data32[2]); s->addr_src_match6[idx].ip[3] = ntohl(da->ip.addr_data32[3]); s->addr_src_match6[idx].ip2[0] = ntohl(da->ip2.addr_data32[0]); s->addr_src_match6[idx].ip2[1] = ntohl(da->ip2.addr_data32[1]); s->addr_src_match6[idx].ip2[2] = ntohl(da->ip2.addr_data32[2]); s->addr_src_match6[idx].ip2[3] = ntohl(da->ip2.addr_data32[3]); idx++; } s->addr_src_match6_cnt = cnt; } /* destination addresses IPv6 */ cnt = 0; idx = 0; da = s->dst->ipv6_head; for ( ; da != NULL; da = da->next) { cnt++; } if (cnt > 0) { s->addr_dst_match6 = SCMalloc(cnt * sizeof(DetectMatchAddressIPv6)); if (s->addr_dst_match6 == NULL) { exit(EXIT_FAILURE); } for (da = s->dst->ipv6_head; da != NULL; da = da->next) { s->addr_dst_match6[idx].ip[0] = ntohl(da->ip.addr_data32[0]); s->addr_dst_match6[idx].ip[1] = ntohl(da->ip.addr_data32[1]); s->addr_dst_match6[idx].ip[2] = ntohl(da->ip.addr_data32[2]); s->addr_dst_match6[idx].ip[3] = ntohl(da->ip.addr_data32[3]); s->addr_dst_match6[idx].ip2[0] = ntohl(da->ip2.addr_data32[0]); s->addr_dst_match6[idx].ip2[1] = ntohl(da->ip2.addr_data32[1]); s->addr_dst_match6[idx].ip2[2] = ntohl(da->ip2.addr_data32[2]); s->addr_dst_match6[idx].ip2[3] = ntohl(da->ip2.addr_data32[3]); idx++; } s->addr_dst_match6_cnt = cnt; } } /** * \internal * \brief validate a just parsed signature for internal inconsistencies * * \param s just parsed signature * * \retval 0 invalid * \retval 1 valid */ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) { uint32_t u = 0; uint32_t sig_flags = 0; SigMatch *sm, *pm; SCEnter(); if ((s->flags & SIG_FLAG_REQUIRE_PACKET) && (s->flags & SIG_FLAG_REQUIRE_STREAM)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't mix packet keywords with " "tcp-stream or flow:only_stream. Invalidating signature."); SCReturnInt(0); } for (sm = s->sm_lists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_FLOW) { DetectFlowData *fd = (DetectFlowData *)sm->ctx; if (fd == NULL) continue; if (fd->flags & FLOW_PKT_TOCLIENT) { /* check for uricontent + from_server/to_client */ if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use uricontent " "/http_uri , raw_uri, http_client_body, " "http_method, http_user_agent keywords " "with flow:to_client or flow:from_server"); SCReturnInt(0); } } else if (fd->flags & FLOW_PKT_TOSERVER) { /* check for uricontent + from_server/to_client */ if (/*s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL ||*/ s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use http_" "server_body, http_stat_msg, http_stat_code " "with flow:to_server or flow:from_client"); SCReturnInt(0); } } } } if ((s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL && s->alproto == ALPROTO_SMTP) || s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) { sig_flags |= SIG_FLAG_TOSERVER; s->flags |= SIG_FLAG_TOSERVER; s->flags &= ~SIG_FLAG_TOCLIENT; } if ((s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL && s->alproto == ALPROTO_HTTP) || s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) { sig_flags |= SIG_FLAG_TOCLIENT; s->flags |= SIG_FLAG_TOCLIENT; s->flags &= ~SIG_FLAG_TOSERVER; } if ((sig_flags & (SIG_FLAG_TOCLIENT | SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT | SIG_FLAG_TOSERVER)) { SCLogError(SC_ERR_INVALID_SIGNATURE,"You seem to have mixed keywords " "that require inspection in both directions. Atm we only " "support keywords in one direction within a rule."); SCReturnInt(0); } if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) { if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) { SCLogError(SC_ERR_INVALID_SIGNATURE,"http_raw_header signature " "without a flow direction. Use flow:to_server for " "inspecting request headers or flow:to_client for " "inspecting response headers."); SCReturnInt(0); } } if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) { for (sm = s->sm_lists[DETECT_SM_LIST_HHHDMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd->flags & DETECT_CONTENT_NOCASE) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_host keyword " "specified along with \"nocase\". " "Since the hostname buffer we match against " "is actually lowercase. So having a " "nocase is redundant."); } else { for (u = 0; u < cd->content_len; u++) { if (isupper(cd->content[u])) break; } if (u != cd->content_len) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "A pattern with " "uppercase chars detected for http_host. " "Since the hostname buffer we match against " "is lowercase only, please specify a " "lowercase pattern."); SCReturnInt(0); } } } } } if (!DetectHttpMethodValidateRule(s)) SCReturnInt(0); //if (s->alproto != ALPROTO_UNKNOWN) { // if (s->flags & SIG_FLAG_STATE_MATCH) { // if (s->alproto == ALPROTO_DNS) { // if (al_proto_table[ALPROTO_DNS_UDP].to_server == 0 || // al_proto_table[ALPROTO_DNS_UDP].to_client == 0 || // al_proto_table[ALPROTO_DNS_TCP].to_server == 0 || // al_proto_table[ALPROTO_DNS_TCP].to_client == 0) { // SCLogInfo("Signature uses options that need the app layer " // "parser for dns, but the parser's disabled " // "for the protocol. Please check if you have " // "disabled it through the option " // "\"app-layer.protocols.dcerpc[udp|tcp].enabled\"" // "or internally the parser has been disabled in " // "the code. Invalidating signature."); // SCReturnInt(0); // } // } else { // if (al_proto_table[s->alproto].to_server == 0 || // al_proto_table[s->alproto].to_client == 0) { // const char *proto_name = AppProtoToString(s->alproto); // SCLogInfo("Signature uses options that need the app layer " // "parser for \"%s\", but the parser's disabled " // "for the protocol. Please check if you have " // "disabled it through the option " // "\"app-layer.protocols.%s.enabled\" or internally " // "there the parser has been disabled in the code. " // "Invalidating signature.", proto_name, proto_name); // SCReturnInt(0); // } // } // } // // // // // //} if (s->flags & SIG_FLAG_REQUIRE_PACKET) { pm = SigMatchGetLastSMFromLists(s, 24, DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (pm != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Signature has" " replace keyword linked with a modified content" " keyword (http_*, dce_*). It only supports content on" " raw payload"); SCReturnInt(0); } if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] || s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] || s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Signature combines packet " "specific matches (like dsize, flags, ttl) with stream / " "state matching by matching on app layer proto (like using " "http_* keywords)."); SCReturnInt(0); } } for (sm = s->sm_lists[DETECT_SM_LIST_AMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_AL_APP_LAYER_PROTOCOL) continue; if (((DetectAppLayerProtocolData *)sm->ctx)->negated) break; } if (sm != NULL && s->alproto != ALPROTO_UNKNOWN) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "We can't have " "the rule match on a fixed alproto and at the same time" "have an app-layer-protocol keyword set."); SCReturnInt(0); } /* TCP: pkt vs stream vs depth/offset */ if (s->proto.proto[IPPROTO_TCP / 8] & (1 << (IPPROTO_TCP % 8))) { if (!(s->flags & (SIG_FLAG_REQUIRE_PACKET | SIG_FLAG_REQUIRE_STREAM))) { s->flags |= SIG_FLAG_REQUIRE_STREAM; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT && (((DetectContentData *)(sm->ctx))->flags & (DETECT_CONTENT_DEPTH | DETECT_CONTENT_OFFSET))) { s->flags |= SIG_FLAG_REQUIRE_PACKET; break; } sm = sm->next; } } } if (s->sm_lists[DETECT_SM_LIST_BASE64_DATA] != NULL) { int list; uint16_t idx = s->sm_lists[DETECT_SM_LIST_BASE64_DATA]->idx; for (list = 0; list < DETECT_SM_LIST_DETECT_MAX; list++) { if (list != DETECT_SM_LIST_BASE64_DATA && s->sm_lists[list] != NULL) { if (s->sm_lists[list]->idx > idx) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Rule buffer " "cannot be reset after base64_data."); SCReturnInt(0); } } } } #ifdef HAVE_LUA DetectLuaPostSetup(s); #endif #ifdef DEBUG int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { if (s->sm_lists[i] != NULL) { for (sm = s->sm_lists[i]; sm != NULL; sm = sm->next) { BUG_ON(sm == sm->prev); BUG_ON(sm == sm->next); } } } #endif if ((s->flags & SIG_FLAG_FILESTORE) || s->file_flags != 0) { if (s->alproto != ALPROTO_UNKNOWN && !AppLayerParserSupportsFiles(IPPROTO_TCP, s->alproto)) { SCLogError(SC_ERR_NO_FILES_FOR_PROTOCOL, "protocol %s doesn't " "support file matching", AppProtoToString(s->alproto)); SCReturnInt(0); } if (s->alproto == ALPROTO_HTTP) { AppLayerHtpNeedFileInspection(); } } SCReturnInt(1); } /** * \internal * \brief Helper function for SigInit(). */ static Signature *SigInitHelper(DetectEngineCtx *de_ctx, char *sigstr, uint8_t dir) { Signature *sig = SigAlloc(); if (sig == NULL) goto error; /* default gid to 1 */ sig->gid = 1; if (SigParse(de_ctx, sig, sigstr, dir) < 0) goto error; /* signature priority hasn't been overwritten. Using default priority */ if (sig->prio == -1) sig->prio = 3; sig->num = de_ctx->signum; de_ctx->signum++; if (sig->alproto != ALPROTO_UNKNOWN) { int override_needed = 0; if (sig->proto.flags & DETECT_PROTO_ANY) { sig->proto.flags &= ~DETECT_PROTO_ANY; memset(sig->proto.proto, 0x00, sizeof(sig->proto.proto)); override_needed = 1; } else { override_needed = 1; size_t s = 0; for (s = 0; s < sizeof(sig->proto.proto); s++) { if (sig->proto.proto[s] != 0x00) { override_needed = 0; break; } } } /* at this point if we had alert ip and the ip proto was not * overridden, we use the ip proto that has been configured * against the app proto in use. */ if (override_needed) AppLayerProtoDetectSupportedIpprotos(sig->alproto, sig->proto.proto); } if (DetectAppLayerEventPrepare(sig) < 0) goto error; /* set the packet and app layer flags, but only if the * app layer flag wasn't already set in which case we * only consider the app layer */ if (!(sig->flags & SIG_FLAG_APPLAYER)) { if (sig->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; for ( ; sm != NULL; sm = sm->next) { if (sigmatch_table[sm->type].Match != NULL) sig->init_flags |= SIG_FLAG_INIT_PACKET; } } else { sig->init_flags |= SIG_FLAG_INIT_PACKET; } } if (sig->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) sig->flags |= SIG_FLAG_APPLAYER; if (sig->sm_lists[DETECT_SM_LIST_UMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_DMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_AMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HTTP_REQLINEMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HTTP_RESLINEMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HCBDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_FILEDATA]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HHDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HRHDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HMDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HCDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HRUDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_FILEMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HSMDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HSCDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HUADMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HHHDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_HRHHDMATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; /* DNP3. */ if (sig->sm_lists[DETECT_SM_LIST_DNP3_DATA_MATCH]) { sig->flags |= SIG_FLAG_STATE_MATCH; } if (sig->sm_lists[DETECT_SM_LIST_DNP3_MATCH]) { sig->flags |= SIG_FLAG_STATE_MATCH; } /* Template. */ if (sig->sm_lists[DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH]) { sig->flags |= SIG_FLAG_STATE_MATCH; } /* DNS */ if (sig->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_DNSREQUEST_MATCH]) { sig->flags |= SIG_FLAG_STATE_MATCH; } if (sig->sm_lists[DETECT_SM_LIST_DNSRESPONSE_MATCH]) { sig->flags |= SIG_FLAG_STATE_MATCH; } /* TLS */ if (sig->sm_lists[DETECT_SM_LIST_TLSSNI_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_TLSISSUER_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_TLSSUBJECT_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_TLSVALIDITY_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_MODBUS_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_APP_EVENT]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_CIP_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (sig->sm_lists[DETECT_SM_LIST_ENIP_MATCH]) sig->flags |= SIG_FLAG_STATE_MATCH; if (!(sig->init_flags & SIG_FLAG_INIT_FLOW)) { sig->flags |= SIG_FLAG_TOSERVER; sig->flags |= SIG_FLAG_TOCLIENT; } SCLogDebug("sig %"PRIu32" SIG_FLAG_APPLAYER: %s, SIG_FLAG_PACKET: %s", sig->id, sig->flags & SIG_FLAG_APPLAYER ? "set" : "not set", sig->init_flags & SIG_FLAG_INIT_PACKET ? "set" : "not set"); SigBuildAddressMatchArray(sig); /* validate signature, SigValidate will report the error reason */ if (SigValidate(de_ctx, sig) == 0) { goto error; } return sig; error: if (sig != NULL) { SigFree(sig); } return NULL; } /** * \brief Parses a signature and adds it to the Detection Engine Context. * * \param de_ctx Pointer to the Detection Engine Context. * \param sigstr Pointer to a character string containing the signature to be * parsed. * * \retval Pointer to the Signature instance on success; NULL on failure. */ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { SCEnter(); uint32_t oldsignum = de_ctx->signum; Signature *sig; if ((sig = SigInitHelper(de_ctx, sigstr, SIG_DIREC_NORMAL)) == NULL) { goto error; } if (sig->init_flags & SIG_FLAG_INIT_BIDIREC) { sig->next = SigInitHelper(de_ctx, sigstr, SIG_DIREC_SWITCHED); if (sig->next == NULL) { goto error; } } SCReturnPtr(sig, "Signature"); error: if (sig != NULL) { SigFree(sig); } /* if something failed, restore the old signum count * since we didn't install it */ de_ctx->signum = oldsignum; SCReturnPtr(NULL, "Signature"); } /** * \brief The hash free function to be the used by the hash table - * DetectEngineCtx->dup_sig_hash_table. * * \param data Pointer to the data, in our case SigDuplWrapper to be freed. */ void DetectParseDupSigFreeFunc(void *data) { if (data != NULL) SCFree(data); return; } /** * \brief The hash function to be the used by the hash table - * DetectEngineCtx->dup_sig_hash_table. * * \param ht Pointer to the hash table. * \param data Pointer to the data, in our case SigDuplWrapper. * \param datalen Not used in our case. * * \retval sw->s->id The generated hash value. */ uint32_t DetectParseDupSigHashFunc(HashListTable *ht, void *data, uint16_t datalen) { SigDuplWrapper *sw = (SigDuplWrapper *)data; return (sw->s->id % ht->array_size); } /** * \brief The Compare function to be used by the hash table - * DetectEngineCtx->dup_sig_hash_table. * * \param data1 Pointer to the first SigDuplWrapper. * \param len1 Not used. * \param data2 Pointer to the second SigDuplWrapper. * \param len2 Not used. * * \retval 1 If the 2 SigDuplWrappers sent as args match. * \retval 0 If the 2 SigDuplWrappers sent as args do not match. */ char DetectParseDupSigCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { SigDuplWrapper *sw1 = (SigDuplWrapper *)data1; SigDuplWrapper *sw2 = (SigDuplWrapper *)data2; if (sw1 == NULL || sw2 == NULL || sw1->s == NULL || sw2->s == NULL) return 0; /* sid and gid match required */ if (sw1->s->id == sw2->s->id && sw1->s->gid == sw2->s->gid) return 1; return 0; } /** * \brief Initializes the hash table that is used to cull duplicate sigs. * * \param de_ctx Pointer to the detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int DetectParseDupSigHashInit(DetectEngineCtx *de_ctx) { de_ctx->dup_sig_hash_table = HashListTableInit(15000, DetectParseDupSigHashFunc, DetectParseDupSigCompareFunc, DetectParseDupSigFreeFunc); if (de_ctx->dup_sig_hash_table == NULL) return -1; return 0; } /** * \brief Frees the hash table that is used to cull duplicate sigs. * * \param de_ctx Pointer to the detection engine context that holds this table. */ void DetectParseDupSigHashFree(DetectEngineCtx *de_ctx) { if (de_ctx->dup_sig_hash_table != NULL) HashListTableFree(de_ctx->dup_sig_hash_table); de_ctx->dup_sig_hash_table = NULL; return; } /** * \brief Check if a signature is a duplicate. * * There are 3 types of return values for this function. * * - 0, which indicates that the Signature is not a duplicate * and has to be added to the detection engine list. * - 1, Signature is duplicate, and the existing signature in * the list shouldn't be replaced with this duplicate. * - 2, Signature is duplicate, and the existing signature in * the list should be replaced with this duplicate. * * \param de_ctx Pointer to the detection engine context. * \param sig Pointer to the Signature that has to be checked. * * \retval 2 If Signature is duplicate and the existing signature in * the list should be chucked out and replaced with this. * \retval 1 If Signature is duplicate, and should be chucked out. * \retval 0 If Signature is not a duplicate. */ static inline int DetectEngineSignatureIsDuplicate(DetectEngineCtx *de_ctx, Signature *sig) { /* we won't do any NULL checks on the args */ /* return value */ int ret = 0; SigDuplWrapper *sw_dup = NULL; SigDuplWrapper *sw = NULL; /* used for making a duplicate_sig_hash_table entry */ sw = SCMalloc(sizeof(SigDuplWrapper)); if (unlikely(sw == NULL)) { exit(EXIT_FAILURE); } memset(sw, 0, sizeof(SigDuplWrapper)); sw->s = sig; /* check if we have a duplicate entry for this signature */ sw_dup = HashListTableLookup(de_ctx->dup_sig_hash_table, (void *)sw, 0); /* we don't have a duplicate entry for this sig */ if (sw_dup == NULL) { /* add it to the hash table */ HashListTableAdd(de_ctx->dup_sig_hash_table, (void *)sw, 0); /* add the s_prev entry for the previously loaded sw in the hash_table */ if (de_ctx->sig_list != NULL) { SigDuplWrapper *sw_old = NULL; SigDuplWrapper sw_tmp; memset(&sw_tmp, 0, sizeof(SigDuplWrapper)); /* the topmost sig would be the last loaded sig */ sw_tmp.s = de_ctx->sig_list; sw_old = HashListTableLookup(de_ctx->dup_sig_hash_table, (void *)&sw_tmp, 0); /* sw_old == NULL case is impossible */ sw_old->s_prev = sig; } ret = 0; goto end; } /* if we have reached here we have a duplicate entry for this signature. * Check the signature revision. Store the signature with the latest rev * and discard the other one */ if (sw->s->rev <= sw_dup->s->rev) { ret = 1; SCFree(sw); sw = NULL; goto end; } /* the new sig is of a newer revision than the one that is already in the * list. Remove the old sig from the list */ if (sw_dup->s_prev == NULL) { SigDuplWrapper sw_temp; memset(&sw_temp, 0, sizeof(SigDuplWrapper)); if (sw_dup->s->init_flags & SIG_FLAG_INIT_BIDIREC) { sw_temp.s = sw_dup->s->next->next; de_ctx->sig_list = sw_dup->s->next->next; SigFree(sw_dup->s->next); } else { sw_temp.s = sw_dup->s->next; de_ctx->sig_list = sw_dup->s->next; } SigDuplWrapper *sw_next = NULL; if (sw_temp.s != NULL) { sw_next = HashListTableLookup(de_ctx->dup_sig_hash_table, (void *)&sw_temp, 0); sw_next->s_prev = sw_dup->s_prev; } SigFree(sw_dup->s); } else { SigDuplWrapper sw_temp; memset(&sw_temp, 0, sizeof(SigDuplWrapper)); if (sw_dup->s->init_flags & SIG_FLAG_INIT_BIDIREC) { sw_temp.s = sw_dup->s->next->next; sw_dup->s_prev->next = sw_dup->s->next->next; SigFree(sw_dup->s->next); } else { sw_temp.s = sw_dup->s->next; sw_dup->s_prev->next = sw_dup->s->next; } SigDuplWrapper *sw_next = NULL; if (sw_temp.s != NULL) { sw_next = HashListTableLookup(de_ctx->dup_sig_hash_table, (void *)&sw_temp, 0); sw_next->s_prev = sw_dup->s_prev;; } SigFree(sw_dup->s); } /* make changes to the entry to reflect the presence of the new sig */ sw_dup->s = sig; sw_dup->s_prev = NULL; /* this is duplicate, but a duplicate that replaced the existing sig entry */ ret = 2; SCFree(sw); end: return ret; } /** * \brief Parse and append a Signature into the Detection Engine Context * signature list. * * If the signature is bidirectional it should append two signatures * (with the addresses switched) into the list. Also handle duplicate * signatures. In case of duplicate sigs, use the ones that have the * latest revision. We use the sid and the msg to identifiy duplicate * sigs. If 2 sigs have the same sid and gid, they are duplicates. * * \param de_ctx Pointer to the Detection Engine Context. * \param sigstr Pointer to a character string containing the signature to be * parsed. * \param sig_file Pointer to a character string containing the filename from * which signature is read * \param lineno Line number from where signature is read * * \retval Pointer to the head Signature in the detection engine ctx sig_list * on success; NULL on failure. */ Signature *DetectEngineAppendSig(DetectEngineCtx *de_ctx, char *sigstr) { Signature *sig = SigInit(de_ctx, sigstr); if (sig == NULL) { return NULL; } /* checking for the status of duplicate signature */ int dup_sig = DetectEngineSignatureIsDuplicate(de_ctx, sig); /* a duplicate signature that should be chucked out. Check the previously * called function details to understand the different return values */ if (dup_sig == 1) { SCLogError(SC_ERR_DUPLICATE_SIG, "Duplicate signature \"%s\"", sigstr); goto error; } else if (dup_sig == 2) { SCLogWarning(SC_ERR_DUPLICATE_SIG, "Signature with newer revision," " so the older sig replaced by this new signature \"%s\"", sigstr); } if (sig->init_flags & SIG_FLAG_INIT_BIDIREC) { if (sig->next != NULL) { sig->next->next = de_ctx->sig_list; } else { goto error; } } else { /* if this sig is the first one, sig_list should be null */ sig->next = de_ctx->sig_list; } de_ctx->sig_list = sig; /** * In DetectEngineAppendSig(), the signatures are prepended and we always return the first one * so if the signature is bidirectional, the returned sig will point through "next" ptr * to the cloned signatures with the switched addresses */ return (dup_sig == 0 || dup_sig == 2) ? sig : NULL; error: if (sig != NULL) SigFree(sig); return NULL; } typedef struct DetectParseRegex_ { pcre *regex; pcre_extra *study; struct DetectParseRegex_ *next; } DetectParseRegex; static DetectParseRegex *g_detect_parse_regex_list = NULL; void DetectParseFreeRegexes(void) { DetectParseRegex *r = g_detect_parse_regex_list; while (r) { DetectParseRegex *next = r->next; if (r->regex) { pcre_free(r->regex); } if (r->study) { pcre_free_study(r->study); } SCFree(r); r = next; } g_detect_parse_regex_list = NULL; } /** \brief add regex and/or study to at exit free list */ void DetectParseRegexAddToFreeList(pcre *regex, pcre_extra *study) { DetectParseRegex *r = SCCalloc(1, sizeof(*r)); if (r == NULL) { FatalError(SC_ERR_MEM_ALLOC, "failed to alloc memory for pcre free list"); } r->regex = regex; r->study = study; r->next = g_detect_parse_regex_list; g_detect_parse_regex_list = r; } void DetectSetupParseRegexes(const char *parse_str, pcre **parse_regex, pcre_extra **parse_regex_study) { const char *eb; int eo; int opts = 0; *parse_regex = pcre_compile(parse_str, opts, &eb, &eo, NULL); if (*parse_regex == NULL) { FatalError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at " "offset %" PRId32 ": %s", parse_str, eo, eb); } *parse_regex_study = pcre_study(*parse_regex, 0, &eb); if (eb != NULL) { FatalError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); } DetectParseRegexAddToFreeList(*parse_regex, *parse_regex_study); return; } #ifdef AFLFUZZ_RULES #include "util-reference-config.h" int RuleParseDataFromFile(char *filename) { char buffer[65536]; SigTableSetup(); SigParsePrepare(); SCReferenceConfInit(); SCClassConfInit(); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(10000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); size_t result = fread(&buffer, 1, sizeof(buffer), fp); if (result < sizeof(buffer)) { buffer[result] = '\0'; Signature *s = SigInit(de_ctx, buffer); if (s != NULL) { SigFree(s); } } fclose(fp); #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ DetectEngineCtxFree(de_ctx); SCClassConfDeinit(); SCReferenceConfDeinit(); return 0; } #endif /* AFLFUZZ_RULES */ /* * TESTS */ #ifdef UNITTESTS int SigParseTest01 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:1;)"); if (sig == NULL) result = 0; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } int SigParseTest02 (void) { int result = 0; Signature *sig = NULL; DetectPort *port = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"ET MALWARE Suspicious 220 Banner on Local Port\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:2003055; rev:4;)"); if (sig == NULL) { goto end; } int r = DetectPortParse(de_ctx, &port, "0:20"); if (r < 0) goto end; if (DetectPortCmp(sig->sp, port) == PORT_EQ) { result = 1; } else { DetectPortPrint(port); printf(" != "); DetectPortPrint(sig->sp); printf(": "); } end: if (port != NULL) DetectPortCleanupList(port); if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test SigParseTest03 test for invalid direction operator in rule */ int SigParseTest03 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp 1.2.3.4 any <- !1.2.3.4 any (msg:\"SigParseTest03\"; sid:1;)"); if (sig != NULL) { result = 0; printf("expected NULL got sig ptr %p: ",sig); } end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } int SigParseTest04 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp 1.2.3.4 1024: -> !1.2.3.4 1024: (msg:\"SigParseTest04\"; sid:1;)"); if (sig == NULL) result = 0; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Port validation */ int SigParseTest05 (void) { int result = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp 1.2.3.4 1024:65536 -> !1.2.3.4 any (msg:\"SigParseTest05\"; sid:1;)"); if (sig == NULL) { result = 1; } else { printf("signature didn't fail to parse as we expected: "); } end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Parsing bug debugging at 2010-03-18 */ int SigParseTest06 (void) { int result = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"GET\"; nocase; http_method; uricontent:\"/uri/\"; nocase; content:\"Host|3A| abc\"; nocase; sid:1; rev:1;)"); if (sig != NULL) { result = 1; } else { printf("signature failed to parse: "); } end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing duplicate sigs. */ int SigParseTest07(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:1;)"); result = (de_ctx->sig_list != NULL && de_ctx->sig_list->next == NULL); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing duplicate sigs. */ int SigParseTest08(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:2;)"); result = (de_ctx->sig_list != NULL && de_ctx->sig_list->next == NULL && de_ctx->sig_list->rev == 2); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing duplicate sigs. */ int SigParseTest09(void) { int result = 1; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:2;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:6;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:4;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:2; rev:2;)"); result &= (de_ctx->sig_list != NULL && de_ctx->sig_list->id == 2 && de_ctx->sig_list->rev == 2); if (result == 0) goto end; result &= (de_ctx->sig_list->next != NULL && de_ctx->sig_list->next->id == 1 && de_ctx->sig_list->next->rev == 6); if (result == 0) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:2; rev:1;)"); result &= (de_ctx->sig_list != NULL && de_ctx->sig_list->id == 2 && de_ctx->sig_list->rev == 2); if (result == 0) goto end; result &= (de_ctx->sig_list->next != NULL && de_ctx->sig_list->next->id == 1 && de_ctx->sig_list->next->rev == 6); if (result == 0) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:2; rev:4;)"); result &= (de_ctx->sig_list != NULL && de_ctx->sig_list->id == 2 && de_ctx->sig_list->rev == 4); if (result == 0) goto end; result &= (de_ctx->sig_list->next != NULL && de_ctx->sig_list->next->id == 1 && de_ctx->sig_list->next->rev == 6); if (result == 0) goto end; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing duplicate sigs. */ int SigParseTest10(void) { int result = 1; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:1; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:2; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:3; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:4; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:5; rev:1;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:3; rev:2;)"); DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (msg:\"boo\"; sid:2; rev:2;)"); result &= ((de_ctx->sig_list->id == 2) && (de_ctx->sig_list->next->id == 3) && (de_ctx->sig_list->next->next->id == 5) && (de_ctx->sig_list->next->next->next->id == 4) && (de_ctx->sig_list->next->next->next->next->id == 1)); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing sig with trailing space(s) as reported by * Morgan Cox on oisf-users. */ int SigParseTest11(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (msg:\"Snort_Inline is blocking the http link\";) "); if (s == NULL) { printf("sig 1 didn't parse: "); goto end; } s = DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (msg:\"Snort_Inline is blocking the http link\"; sid:1;) "); if (s == NULL) { printf("sig 2 didn't parse: "); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test file_data with rawbytes */ static int SigParseTest12(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (file_data; content:\"abc\"; rawbytes; sid:1;)"); if (s != NULL) { printf("sig 1 should have given an error: "); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test packet/stream sig */ static int SigParseTest13(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"abc\"; sid:1;)"); if (s == NULL) { printf("sig 1 invalidated: failure"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) { printf("sig doesn't have stream flag set\n"); goto end; } if (s->flags & SIG_FLAG_REQUIRE_PACKET) { printf("sig has packet flag set\n"); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test packet/stream sig */ static int SigParseTest14(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"abc\"; dsize:>0; sid:1;)"); if (s == NULL) { printf("sig 1 invalidated: failure"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) { printf("sig doesn't have packet flag set\n"); goto end; } if (s->flags & SIG_FLAG_REQUIRE_STREAM) { printf("sig has stream flag set\n"); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test packet/stream sig */ static int SigParseTest15(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"abc\"; offset:5; sid:1;)"); if (s == NULL) { printf("sig 1 invalidated: failure"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) { printf("sig doesn't have packet flag set\n"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) { printf("sig doesn't have stream flag set\n"); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test packet/stream sig */ static int SigParseTest16(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"abc\"; depth:5; sid:1;)"); if (s == NULL) { printf("sig 1 invalidated: failure"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) { printf("sig doesn't have packet flag set\n"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) { printf("sig doesn't have stream flag set\n"); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test packet/stream sig */ static int SigParseTest17(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; Signature *s = NULL; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"abc\"; offset:1; depth:5; sid:1;)"); if (s == NULL) { printf("sig 1 invalidated: failure"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) { printf("sig doesn't have packet flag set\n"); goto end; } if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) { printf("sig doesn't have stream flag set\n"); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test sid value too large. Bug #779 */ static int SigParseTest18 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:99999999999999999999;)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test gid value too large. Related to bug #779 */ static int SigParseTest19 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:1; gid:99999999999999999999;)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test rev value too large. Related to bug #779 */ static int SigParseTest20 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> !1.2.3.4 any (msg:\"SigParseTest01\"; sid:1; rev:99999999999999999999;)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test address parsing */ static int SigParseTest21 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp [1.2.3.4, 1.2.3.5] any -> !1.2.3.4 any (sid:1;)") == NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test address parsing */ static int SigParseTest22 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp [10.10.10.0/24, !10.10.10.247] any -> [10.10.10.0/24, !10.10.10.247] any (sid:1;)") == NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest06 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any - 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest07 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any <- 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest08 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any < 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest09 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any > 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest10 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any -< 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest11 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any >- 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (invalid) */ int SigParseBidirecTest12 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any >< 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig == NULL) result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (valid) */ int SigParseBidirecTest13 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any <> 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig != NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Direction operator validation (valid) */ int SigParseBidirecTest14 (void) { int result = 1; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any -> 192.168.1.5 any (msg:\"SigParseBidirecTest05\"; sid:1;)"); if (sig != NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Ensure that we don't set bidirectional in a * normal (one direction) Signature */ int SigTestBidirec01 (void) { Signature *sig = NULL; int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 1024:65535 -> !1.2.3.4 any (msg:\"SigTestBidirec01\"; sid:1;)"); if (sig == NULL) goto end; if (sig->next != NULL) goto end; if (sig->init_flags & SIG_FLAG_INIT_BIDIREC) goto end; if (de_ctx->signum != 1) goto end; result = 1; end: if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } return result; } /** \test Ensure that we set a bidirectional Signature correctly */ int SigTestBidirec02 (void) { int result = 0; Signature *sig = NULL; Signature *copy = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; sig = DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 1024:65535 <> !1.2.3.4 any (msg:\"SigTestBidirec02\"; sid:1;)"); if (sig == NULL) goto end; if (de_ctx->sig_list != sig) goto end; if (!(sig->init_flags & SIG_FLAG_INIT_BIDIREC)) goto end; if (sig->next == NULL) goto end; if (de_ctx->signum != 2) goto end; copy = sig->next; if (copy->next != NULL) goto end; if (!(copy->init_flags & SIG_FLAG_INIT_BIDIREC)) goto end; result = 1; end: if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } return result; } /** \test Ensure that we set a bidirectional Signature correctly * and we install it with the rest of the signatures, checking * also that it match with the correct addr directions */ int SigTestBidirec03 (void) { int result = 0; Signature *sig = NULL; Packet *p = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; char *sigs[3]; sigs[0] = "alert tcp any any -> 192.168.1.1 any (msg:\"SigTestBidirec03 sid 1\"; sid:1;)"; sigs[1] = "alert tcp any any <> 192.168.1.1 any (msg:\"SigTestBidirec03 sid 2 bidirectional\"; sid:2;)"; sigs[2] = "alert tcp any any -> 192.168.1.1 any (msg:\"SigTestBidirec03 sid 3\"; sid:3;)"; UTHAppendSigs(de_ctx, sigs, 3); /* Checking that bidirectional rules are set correctly */ sig = de_ctx->sig_list; if (sig == NULL) goto end; if (sig->next == NULL) goto end; if (sig->next->next == NULL) goto end; if (sig->next->next->next == NULL) goto end; if (sig->next->next->next->next != NULL) goto end; if (de_ctx->signum != 4) goto end; uint8_t rawpkt1_ether[] = { 0x00,0x50,0x56,0xea,0x00,0xbd,0x00,0x0c, 0x29,0x40,0xc8,0xb5,0x08,0x00,0x45,0x00, 0x01,0xa8,0xb9,0xbb,0x40,0x00,0x40,0x06, 0xe0,0xbf,0xc0,0xa8,0x1c,0x83,0xc0,0xa8, 0x01,0x01,0xb9,0x0a,0x00,0x50,0x6f,0xa2, 0x92,0xed,0x7b,0xc1,0xd3,0x4d,0x50,0x18, 0x16,0xd0,0xa0,0x6f,0x00,0x00,0x47,0x45, 0x54,0x20,0x2f,0x20,0x48,0x54,0x54,0x50, 0x2f,0x31,0x2e,0x31,0x0d,0x0a,0x48,0x6f, 0x73,0x74,0x3a,0x20,0x31,0x39,0x32,0x2e, 0x31,0x36,0x38,0x2e,0x31,0x2e,0x31,0x0d, 0x0a,0x55,0x73,0x65,0x72,0x2d,0x41,0x67, 0x65,0x6e,0x74,0x3a,0x20,0x4d,0x6f,0x7a, 0x69,0x6c,0x6c,0x61,0x2f,0x35,0x2e,0x30, 0x20,0x28,0x58,0x31,0x31,0x3b,0x20,0x55, 0x3b,0x20,0x4c,0x69,0x6e,0x75,0x78,0x20, 0x78,0x38,0x36,0x5f,0x36,0x34,0x3b,0x20, 0x65,0x6e,0x2d,0x55,0x53,0x3b,0x20,0x72, 0x76,0x3a,0x31,0x2e,0x39,0x2e,0x30,0x2e, 0x31,0x34,0x29,0x20,0x47,0x65,0x63,0x6b, 0x6f,0x2f,0x32,0x30,0x30,0x39,0x30,0x39, 0x30,0x32,0x31,0x37,0x20,0x55,0x62,0x75, 0x6e,0x74,0x75,0x2f,0x39,0x2e,0x30,0x34, 0x20,0x28,0x6a,0x61,0x75,0x6e,0x74,0x79, 0x29,0x20,0x46,0x69,0x72,0x65,0x66,0x6f, 0x78,0x2f,0x33,0x2e,0x30,0x2e,0x31,0x34, 0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,0x74, 0x3a,0x20,0x74,0x65,0x78,0x74,0x2f,0x68, 0x74,0x6d,0x6c,0x2c,0x61,0x70,0x70,0x6c, 0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x2f, 0x78,0x68,0x74,0x6d,0x6c,0x2b,0x78,0x6d, 0x6c,0x2c,0x61,0x70,0x70,0x6c,0x69,0x63, 0x61,0x74,0x69,0x6f,0x6e,0x2f,0x78,0x6d, 0x6c,0x3b,0x71,0x3d,0x30,0x2e,0x39,0x2c, 0x2a,0x2f,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x38,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x4c,0x61,0x6e,0x67,0x75,0x61, 0x67,0x65,0x3a,0x20,0x65,0x6e,0x2d,0x75, 0x73,0x2c,0x65,0x6e,0x3b,0x71,0x3d,0x30, 0x2e,0x35,0x0d,0x0a,0x41,0x63,0x63,0x65, 0x70,0x74,0x2d,0x45,0x6e,0x63,0x6f,0x64, 0x69,0x6e,0x67,0x3a,0x20,0x67,0x7a,0x69, 0x70,0x2c,0x64,0x65,0x66,0x6c,0x61,0x74, 0x65,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x43,0x68,0x61,0x72,0x73,0x65, 0x74,0x3a,0x20,0x49,0x53,0x4f,0x2d,0x38, 0x38,0x35,0x39,0x2d,0x31,0x2c,0x75,0x74, 0x66,0x2d,0x38,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x2c,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x0d,0x0a,0x4b,0x65,0x65,0x70,0x2d, 0x41,0x6c,0x69,0x76,0x65,0x3a,0x20,0x33, 0x30,0x30,0x0d,0x0a,0x43,0x6f,0x6e,0x6e, 0x65,0x63,0x74,0x69,0x6f,0x6e,0x3a,0x20, 0x6b,0x65,0x65,0x70,0x2d,0x61,0x6c,0x69, 0x76,0x65,0x0d,0x0a,0x0d,0x0a }; /* end rawpkt1_ether */ FlowInitConfig(FLOW_QUIET); p = UTHBuildPacketFromEth(rawpkt1_ether, sizeof(rawpkt1_ether)); if (p == NULL) { SCLogDebug("Error building packet"); goto end; } UTHMatchPackets(de_ctx, &p, 1); uint32_t sids[3] = {1, 2, 3}; uint32_t results[3] = {1, 1, 1}; result = UTHCheckPacketMatchResults(p, sids, results, 1); end: if (p != NULL) { PACKET_RECYCLE(p); SCFree(p); } if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } FlowShutdown(); return result; } /** \test Ensure that we set a bidirectional Signature correctly * and we install it with the rest of the signatures, checking * also that it match with the correct addr directions */ int SigTestBidirec04 (void) { int result = 0; Signature *sig = NULL; Packet *p = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any -> any any (msg:\"SigTestBidirec03 sid 1\"; sid:1;)"); if (sig == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any <> any any (msg:\"SigTestBidirec03 sid 2 bidirectional\"; sid:2;)"); if (sig == NULL) goto end; if ( !(sig->init_flags & SIG_FLAG_INIT_BIDIREC)) goto end; if (sig->next == NULL) goto end; if (sig->next->next == NULL) goto end; if (sig->next->next->next != NULL) goto end; if (de_ctx->signum != 3) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp 192.168.1.1 any -> any any (msg:\"SigTestBidirec03 sid 3\"; sid:3;)"); if (sig == NULL) goto end; if (sig->next == NULL) goto end; if (sig->next->next == NULL) goto end; if (sig->next->next->next == NULL) goto end; if (sig->next->next->next->next != NULL) goto end; if (de_ctx->signum != 4) goto end; uint8_t rawpkt1_ether[] = { 0x00,0x50,0x56,0xea,0x00,0xbd,0x00,0x0c, 0x29,0x40,0xc8,0xb5,0x08,0x00,0x45,0x00, 0x01,0xa8,0xb9,0xbb,0x40,0x00,0x40,0x06, 0xe0,0xbf,0xc0,0xa8,0x1c,0x83,0xc0,0xa8, 0x01,0x01,0xb9,0x0a,0x00,0x50,0x6f,0xa2, 0x92,0xed,0x7b,0xc1,0xd3,0x4d,0x50,0x18, 0x16,0xd0,0xa0,0x6f,0x00,0x00,0x47,0x45, 0x54,0x20,0x2f,0x20,0x48,0x54,0x54,0x50, 0x2f,0x31,0x2e,0x31,0x0d,0x0a,0x48,0x6f, 0x73,0x74,0x3a,0x20,0x31,0x39,0x32,0x2e, 0x31,0x36,0x38,0x2e,0x31,0x2e,0x31,0x0d, 0x0a,0x55,0x73,0x65,0x72,0x2d,0x41,0x67, 0x65,0x6e,0x74,0x3a,0x20,0x4d,0x6f,0x7a, 0x69,0x6c,0x6c,0x61,0x2f,0x35,0x2e,0x30, 0x20,0x28,0x58,0x31,0x31,0x3b,0x20,0x55, 0x3b,0x20,0x4c,0x69,0x6e,0x75,0x78,0x20, 0x78,0x38,0x36,0x5f,0x36,0x34,0x3b,0x20, 0x65,0x6e,0x2d,0x55,0x53,0x3b,0x20,0x72, 0x76,0x3a,0x31,0x2e,0x39,0x2e,0x30,0x2e, 0x31,0x34,0x29,0x20,0x47,0x65,0x63,0x6b, 0x6f,0x2f,0x32,0x30,0x30,0x39,0x30,0x39, 0x30,0x32,0x31,0x37,0x20,0x55,0x62,0x75, 0x6e,0x74,0x75,0x2f,0x39,0x2e,0x30,0x34, 0x20,0x28,0x6a,0x61,0x75,0x6e,0x74,0x79, 0x29,0x20,0x46,0x69,0x72,0x65,0x66,0x6f, 0x78,0x2f,0x33,0x2e,0x30,0x2e,0x31,0x34, 0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,0x74, 0x3a,0x20,0x74,0x65,0x78,0x74,0x2f,0x68, 0x74,0x6d,0x6c,0x2c,0x61,0x70,0x70,0x6c, 0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x2f, 0x78,0x68,0x74,0x6d,0x6c,0x2b,0x78,0x6d, 0x6c,0x2c,0x61,0x70,0x70,0x6c,0x69,0x63, 0x61,0x74,0x69,0x6f,0x6e,0x2f,0x78,0x6d, 0x6c,0x3b,0x71,0x3d,0x30,0x2e,0x39,0x2c, 0x2a,0x2f,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x38,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x4c,0x61,0x6e,0x67,0x75,0x61, 0x67,0x65,0x3a,0x20,0x65,0x6e,0x2d,0x75, 0x73,0x2c,0x65,0x6e,0x3b,0x71,0x3d,0x30, 0x2e,0x35,0x0d,0x0a,0x41,0x63,0x63,0x65, 0x70,0x74,0x2d,0x45,0x6e,0x63,0x6f,0x64, 0x69,0x6e,0x67,0x3a,0x20,0x67,0x7a,0x69, 0x70,0x2c,0x64,0x65,0x66,0x6c,0x61,0x74, 0x65,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x43,0x68,0x61,0x72,0x73,0x65, 0x74,0x3a,0x20,0x49,0x53,0x4f,0x2d,0x38, 0x38,0x35,0x39,0x2d,0x31,0x2c,0x75,0x74, 0x66,0x2d,0x38,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x2c,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x0d,0x0a,0x4b,0x65,0x65,0x70,0x2d, 0x41,0x6c,0x69,0x76,0x65,0x3a,0x20,0x33, 0x30,0x30,0x0d,0x0a,0x43,0x6f,0x6e,0x6e, 0x65,0x63,0x74,0x69,0x6f,0x6e,0x3a,0x20, 0x6b,0x65,0x65,0x70,0x2d,0x61,0x6c,0x69, 0x76,0x65,0x0d,0x0a,0x0d,0x0a }; /* end rawpkt1_ether */ p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, rawpkt1_ether, sizeof(rawpkt1_ether), NULL); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* At this point we have a list of 4 signatures. The last one is a copy of the second one. If we receive a packet with source 192.168.1.1 80, all the sids should match */ SigGroupBuild(de_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* only sid 2 should match with a packet going to 192.168.1.1 port 80 */ if (PacketAlertCheck(p, 1) <= 0 && PacketAlertCheck(p, 3) <= 0 && PacketAlertCheck(p, 2) == 1) { result = 1; } if (p != NULL) { PACKET_RECYCLE(p); } FlowShutdown(); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); end: if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) SCFree(p); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation01 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp !any any -> any any (msg:\"SigTest41-01 src address is !any \"; classtype:misc-activity; sid:410001; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation02 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any !any -> any any (msg:\"SigTest41-02 src ip is !any \"; classtype:misc-activity; sid:410002; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation03 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> any [80:!80] (msg:\"SigTest41-03 dst port [80:!80] \"; classtype:misc-activity; sid:410003; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation04 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> any [80,!80] (msg:\"SigTest41-03 dst port [80:!80] \"; classtype:misc-activity; sid:410003; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation05 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> [192.168.0.2,!192.168.0.2] any (msg:\"SigTest41-04 dst ip [192.168.0.2,!192.168.0.2] \"; classtype:misc-activity; sid:410004; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation06 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> any [100:1000,!1:20000] (msg:\"SigTest41-05 dst port [100:1000,!1:20000] \"; classtype:misc-activity; sid:410005; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check that we don't allow invalid negation options */ static int SigParseTestNegation07 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> [192.168.0.2,!192.168.0.0/24] any (msg:\"SigTest41-06 dst ip [192.168.0.2,!192.168.0.0/24] \"; classtype:misc-activity; sid:410006; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test check valid negation bug 1079 */ static int SigParseTestNegation08 (void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tcp any any -> [192.168.0.0/16,!192.168.0.0/24] any (sid:410006; rev:1;)"); if (s == NULL) { goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test mpm */ int SigParseTestMpm01 (void) { int result = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"mpm test\"; content:\"abcd\"; sid:1;)"); if (sig == NULL) { printf("sig failed to init: "); goto end; } if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("sig doesn't have content list: "); goto end; } result = 1; end: if (sig != NULL) SigFree(sig); DetectEngineCtxFree(de_ctx); return result; } /** * \test mpm */ int SigParseTestMpm02 (void) { int result = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"mpm test\"; content:\"abcd\"; content:\"abcdef\"; sid:1;)"); if (sig == NULL) { printf("sig failed to init: "); goto end; } if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("sig doesn't have content list: "); goto end; } result = 1; end: if (sig != NULL) SigFree(sig); DetectEngineCtxFree(de_ctx); return result; } /** * \test test tls (app layer) rule */ static int SigParseTestAppLayerTLS01(void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tls any any -> any any (msg:\"SigParseTestAppLayerTLS01 \"; sid:410006; rev:1;)"); if (s == NULL) { printf("parsing sig failed: "); goto end; } if (s->alproto == 0) { printf("alproto not set: "); goto end; } result = 1; end: if (s != NULL) SigFree(s); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test test tls (app layer) rule */ static int SigParseTestAppLayerTLS02(void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tls any any -> any any (msg:\"SigParseTestAppLayerTLS02 \"; tls.version:1.0; sid:410006; rev:1;)"); if (s == NULL) { printf("parsing sig failed: "); goto end; } if (s->alproto == 0) { printf("alproto not set: "); goto end; } result = 1; end: if (s != NULL) SigFree(s); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test test tls (app layer) rule */ static int SigParseTestAppLayerTLS03(void) { int result = 0; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx,"alert tls any any -> any any (msg:\"SigParseTestAppLayerTLS03 \"; tls.version:2.5; sid:410006; rev:1;)"); if (s != NULL) { SigFree(s); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SigParseTestUnblanacedQuotes01(void) { DetectEngineCtx *de_ctx; Signature *s; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx, "alert http any any -> any any (msg:\"SigParseTestUnblanacedQuotes01\"; pcre:\"/\\/[a-z]+\\.php\\?[a-z]+?=\\d{7}&[a-z]+?=\\d{7,8}$/U\" flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2017078; rev:5;)"); FAIL_IF_NOT_NULL(s); PASS; } #endif /* UNITTESTS */ void SigParseRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SigParseTest01", SigParseTest01); UtRegisterTest("SigParseTest02", SigParseTest02); UtRegisterTest("SigParseTest03", SigParseTest03); UtRegisterTest("SigParseTest04", SigParseTest04); UtRegisterTest("SigParseTest05", SigParseTest05); UtRegisterTest("SigParseTest06", SigParseTest06); UtRegisterTest("SigParseTest07", SigParseTest07); UtRegisterTest("SigParseTest08", SigParseTest08); UtRegisterTest("SigParseTest09", SigParseTest09); UtRegisterTest("SigParseTest10", SigParseTest10); UtRegisterTest("SigParseTest11", SigParseTest11); UtRegisterTest("SigParseTest12", SigParseTest12); UtRegisterTest("SigParseTest13", SigParseTest13); UtRegisterTest("SigParseTest14", SigParseTest14); UtRegisterTest("SigParseTest15", SigParseTest15); UtRegisterTest("SigParseTest16", SigParseTest16); UtRegisterTest("SigParseTest17", SigParseTest17); UtRegisterTest("SigParseTest18", SigParseTest18); UtRegisterTest("SigParseTest19", SigParseTest19); UtRegisterTest("SigParseTest20", SigParseTest20); UtRegisterTest("SigParseTest21 -- address with space", SigParseTest21); UtRegisterTest("SigParseTest22 -- address with space", SigParseTest22); UtRegisterTest("SigParseBidirecTest06", SigParseBidirecTest06); UtRegisterTest("SigParseBidirecTest07", SigParseBidirecTest07); UtRegisterTest("SigParseBidirecTest08", SigParseBidirecTest08); UtRegisterTest("SigParseBidirecTest09", SigParseBidirecTest09); UtRegisterTest("SigParseBidirecTest10", SigParseBidirecTest10); UtRegisterTest("SigParseBidirecTest11", SigParseBidirecTest11); UtRegisterTest("SigParseBidirecTest12", SigParseBidirecTest12); UtRegisterTest("SigParseBidirecTest13", SigParseBidirecTest13); UtRegisterTest("SigParseBidirecTest14", SigParseBidirecTest14); UtRegisterTest("SigTestBidirec01", SigTestBidirec01); UtRegisterTest("SigTestBidirec02", SigTestBidirec02); UtRegisterTest("SigTestBidirec03", SigTestBidirec03); UtRegisterTest("SigTestBidirec04", SigTestBidirec04); UtRegisterTest("SigParseTestNegation01", SigParseTestNegation01); UtRegisterTest("SigParseTestNegation02", SigParseTestNegation02); UtRegisterTest("SigParseTestNegation03", SigParseTestNegation03); UtRegisterTest("SigParseTestNegation04", SigParseTestNegation04); UtRegisterTest("SigParseTestNegation05", SigParseTestNegation05); UtRegisterTest("SigParseTestNegation06", SigParseTestNegation06); UtRegisterTest("SigParseTestNegation07", SigParseTestNegation07); UtRegisterTest("SigParseTestNegation08", SigParseTestNegation08); UtRegisterTest("SigParseTestMpm01", SigParseTestMpm01); UtRegisterTest("SigParseTestMpm02", SigParseTestMpm02); UtRegisterTest("SigParseTestAppLayerTLS01", SigParseTestAppLayerTLS01); UtRegisterTest("SigParseTestAppLayerTLS02", SigParseTestAppLayerTLS02); UtRegisterTest("SigParseTestAppLayerTLS03", SigParseTestAppLayerTLS03); UtRegisterTest("SigParseTestUnblanacedQuotes01", SigParseTestUnblanacedQuotes01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-http-raw-uri.c0000644000000000000000000004156213051004444014766 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-htp.h" #include "detect-http-raw-uri.h" #include "detect-engine-hrud.h" #include "stream-tcp.h" static int DetectHttpRawUriSetup(DetectEngineCtx *, Signature *, char *); static void DetectHttpRawUriRegisterTests(void); /** * \brief Registration function for keyword http_raw_uri. */ void DetectHttpRawUriRegister(void) { sigmatch_table[DETECT_AL_HTTP_RAW_URI].name = "http_raw_uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].desc = "content modifier to match on HTTP uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri"; sigmatch_table[DETECT_AL_HTTP_RAW_URI].Match = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_URI].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_URI].Setup = DetectHttpRawUriSetup; sigmatch_table[DETECT_AL_HTTP_RAW_URI].Free = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_URI].RegisterTests = DetectHttpRawUriRegisterTests; sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_raw_uri", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRUDMATCH, 2, PrefilterTxRawUriRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRUDMATCH, DetectEngineInspectHttpRawUri); return; } /** * \brief Sets up the http_raw_uri modifier keyword. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Signature to which the current keyword belongs. * \param arg Should hold an empty string always. * * \retval 0 On success. * \retval -1 On failure. */ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_RAW_URI, DETECT_SM_LIST_HRUDMATCH, ALPROTO_HTTP, NULL); } /******************************** UNITESTS **********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Checks if a http_raw_uri is registered in a Signature, if content is not * specified in the signature. */ int DetectHttpRawUriTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_raw_uri is registered in a Signature, if some parameter * is specified with http_raw_uri in the signature. */ int DetectHttpRawUriTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; content:\"one\"; " "http_raw_uri:wrong; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_raw_uri is registered in a Signature. */ int DetectHttpRawUriTest03(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; " "content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; " "content:\"three\"; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; } while (sm != NULL) { if (sm->type == DETECT_CONTENT) { result = 1; } else { printf("expected DETECT_CONTENT for http_raw_uri(%d), got %d: ", DETECT_CONTENT, sm->type); goto end; } sm = sm->next; } end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_raw_uri is registered in a Signature, when rawbytes is * also specified in the signature. */ int DetectHttpRawUriTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; " "content:\"one\"; rawbytes; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_raw_uri is successfully converted to a rawuricontent. * */ int DetectHttpRawUriTest05(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; int result = 0; if ((de_ctx = DetectEngineCtxInit()) == NULL) goto end; s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_raw_uri\"; " "content:\"we are testing http_raw_uri keyword\"; http_raw_uri; " "sid:1;)"); if (s == NULL) { printf("sig failed to parse\n"); goto end; } if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL) goto end; if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH]->type != DETECT_CONTENT) { printf("wrong type\n"); goto end; } char *str = "we are testing http_raw_uri keyword"; int uricomp = memcmp((const char *) ((DetectContentData*)s->sm_lists[DETECT_SM_LIST_HRUDMATCH]->ctx)->content, str, strlen(str) - 1); int urilen = ((DetectContentData*)s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx)->content_len; if (uricomp != 0 || urilen != strlen("we are testing http_raw_uri keyword")) { printf("sig failed to parse, content not setup properly\n"); goto end; } result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); return result; } int DetectHttpRawUriTest12(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; distance:0; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_DISTANCE || memcmp(ud2->content, "two", ud1->content_len) != 0) { /* inside body */ goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest13(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; within:5; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_WITHIN || memcmp(ud2->content, "two", ud1->content_len) != 0) { /* inside the body */ goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest14(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest15(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest16(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest17(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; distance:0; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_DISTANCE || memcmp(ud2->content, "two", ud1->content_len) != 0) { /* inside body */ goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawUriTest18(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; within:5; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_WITHIN || memcmp(ud2->content, "two", ud1->content_len) != 0) { /* inside body */ goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief Register the UNITTESTS for the http_uri keyword */ static void DetectHttpRawUriRegisterTests (void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectHttpRawUriTest01", DetectHttpRawUriTest01); UtRegisterTest("DetectHttpRawUriTest02", DetectHttpRawUriTest02); UtRegisterTest("DetectHttpRawUriTest03", DetectHttpRawUriTest03); UtRegisterTest("DetectHttpRawUriTest04", DetectHttpRawUriTest04); UtRegisterTest("DetectHttpRawUriTest05", DetectHttpRawUriTest05); UtRegisterTest("DetectHttpRawUriTest12", DetectHttpRawUriTest12); UtRegisterTest("DetectHttpRawUriTest13", DetectHttpRawUriTest13); UtRegisterTest("DetectHttpRawUriTest14", DetectHttpRawUriTest14); UtRegisterTest("DetectHttpRawUriTest15", DetectHttpRawUriTest15); UtRegisterTest("DetectHttpRawUriTest16", DetectHttpRawUriTest16); UtRegisterTest("DetectHttpRawUriTest17", DetectHttpRawUriTest17); UtRegisterTest("DetectHttpRawUriTest18", DetectHttpRawUriTest18); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/decode-null.h0000644000000000000000000000160713051004444013351 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_NULL_H__ #define __DECODE_NULL_H__ void DecodeNullRegisterTests(void); #endif /* __DECODE_NULL_H__ */ suricata-3.2.1/src/app-layer-htp-libhtp.c0000644000000000000000000001415413051004444015115 00000000000000/* * We are using this file to hold APIs copied from libhtp 0.5.x. */ /*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * Anoop Saldanha */ #include "suricata.h" #include "suricata-common.h" /** * \brief A direct flick off libhtp-0.5.x htp_is_lws(). */ static int SC_htp_is_lws(int c) { if ((c == ' ') || (c == '\t')) return 1; else return 0; } /** * \brief A direct flick off libhtp-0.5.x htp_parse_positive_integer_whitespace(). */ static int64_t SC_htp_parse_positive_integer_whitespace(unsigned char *data, size_t len, int base) { if (len == 0) return -1003; size_t last_pos; size_t pos = 0; // Ignore LWS before while ((pos < len) && (SC_htp_is_lws(data[pos]))) pos++; if (pos == len) return -1001; int64_t r = bstr_util_mem_to_pint(data + pos, len - pos, base, &last_pos); if (r < 0) return r; // Move after the last digit pos += last_pos; // Ignore LWS after while (pos < len) { if (!SC_htp_is_lws(data[pos])) { return -1002; } pos++; } return r; } /** * \brief A direct flick off libhtp-0.5.x htp_parse_content_length() */ int64_t SC_htp_parse_content_length(bstr *b) { return SC_htp_parse_positive_integer_whitespace((unsigned char *) bstr_ptr(b), bstr_len(b), 10); } /** * \brief Generates the normalized uri. * * Libhtp doesn't recreate the whole normalized uri and save it. * That duty has now been passed to us. A lot of this code has been * copied from libhtp. * * Keep an eye out on the tx->parsed_uri struct and how the parameters * in it are generated, just in case some modifications are made to * them in the future. * * \param uri_include_all boolean to indicate if scheme, username/password, hostname and port should be part of the buffer */ bstr *SCHTPGenerateNormalizedUri(htp_tx_t *tx, htp_uri_t *uri, int uri_include_all) { if (uri == NULL) return NULL; // On the first pass determine the length of the final string size_t len = 0; if (uri_include_all) { if (uri->scheme != NULL) { len += bstr_len(uri->scheme); len += 3; // "://" } if ((uri->username != NULL) || (uri->password != NULL)) { if (uri->username != NULL) { len += bstr_len(uri->username); } len += 1; // ":" if (uri->password != NULL) { len += bstr_len(uri->password); } len += 1; // "@" } if (uri->hostname != NULL) { len += bstr_len(uri->hostname); } if (uri->port != NULL) { len += 1; // ":" len += bstr_len(uri->port); } } if (uri->path != NULL) { len += bstr_len(uri->path); } if (uri->query != NULL) { len += 1; // "?" len += bstr_len(uri->query); } if (uri->fragment != NULL) { len += 1; // "#" len += bstr_len(uri->fragment); } // On the second pass construct the string /* FIXME in memcap */ bstr *r = bstr_alloc(len); if (r == NULL) { return NULL; } if (uri_include_all) { if (uri->scheme != NULL) { bstr_add_noex(r, uri->scheme); bstr_add_c_noex(r, "://"); } if ((uri->username != NULL) || (uri->password != NULL)) { if (uri->username != NULL) { bstr_add_noex(r, uri->username); } bstr_add_c(r, ":"); if (uri->password != NULL) { bstr_add_noex(r, uri->password); } bstr_add_c_noex(r, "@"); } if (uri->hostname != NULL) { bstr_add_noex(r, uri->hostname); } if (uri->port != NULL) { bstr_add_c(r, ":"); bstr_add_noex(r, uri->port); } } if (uri->path != NULL) { bstr_add_noex(r, uri->path); } if (uri->query != NULL) { bstr *query = bstr_dup(uri->query); if (query) { uint64_t flags = 0; htp_urldecode_inplace(tx->cfg, HTP_DECODER_URLENCODED, query, &flags); bstr_add_c_noex(r, "?"); bstr_add_noex(r, query); bstr_free(query); } } if (uri->fragment != NULL) { bstr_add_c_noex(r, "#"); bstr_add_noex(r, uri->fragment); } return r; } suricata-3.2.1/src/decode-ethernet.c0000644000000000000000000001201113051004444014177 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode Ethernet */ #include "suricata-common.h" #include "decode.h" #include "decode-ethernet.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_eth); if (unlikely(len < ETHERNET_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, ETHERNET_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->ethh = (EthernetHdr *)pkt; if (unlikely(p->ethh == NULL)) return TM_ECODE_FAILED; SCLogDebug("p %p pkt %p ether type %04x", p, pkt, ntohs(p->ethh->eth_type)); switch (ntohs(p->ethh->eth_type)) { case ETHERNET_TYPE_IP: //printf("DecodeEthernet ip4\n"); DecodeIPV4(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_IPV6: //printf("DecodeEthernet ip6\n"); DecodeIPV6(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_PPPOE_SESS: //printf("DecodeEthernet PPPOE Session\n"); DecodePPPOESession(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_PPPOE_DISC: //printf("DecodeEthernet PPPOE Discovery\n"); DecodePPPOEDiscovery(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_VLAN: case ETHERNET_TYPE_8021QINQ: DecodeVLAN(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_MPLS_UNICAST: case ETHERNET_TYPE_MPLS_MULTICAST: DecodeMPLS(tv, dtv, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq); break; case ETHERNET_TYPE_DCE: if (unlikely(len < ETHERNET_DCE_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, DCE_PKT_TOO_SMALL); } else { DecodeEthernet(tv, dtv, p, pkt + ETHERNET_DCE_HEADER_LEN, len - ETHERNET_DCE_HEADER_LEN, pq); } break; default: SCLogDebug("p %p pkt %p ether type %04x not supported", p, pkt, ntohs(p->ethh->eth_type)); } return TM_ECODE_OK; } #ifdef UNITTESTS /** DecodeEthernettest01 * \brief Valid Ethernet packet * \retval 0 Expected test value */ static int DecodeEthernetTest01 (void) { /* ICMP packet wrapped in PPPOE */ uint8_t raw_eth[] = { 0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10, 0x94, 0x56, 0x00, 0x01, 0x88, 0x64, 0x11, 0x00, 0x00, 0x01, 0x00, 0x68, 0x00, 0x21, 0x45, 0xc0, 0x00, 0x64, 0x00, 0x1e, 0x00, 0x00, 0xff, 0x01, 0xa7, 0x78, 0x0a, 0x00, 0x00, 0x02, 0x0a, 0x00, 0x00, 0x01, 0x08, 0x00, 0x4a, 0x61, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x3b, 0xd4, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth), NULL); SCFree(p); return 1; } #endif /* UNITTESTS */ /** * \brief Registers Ethernet unit tests * \todo More Ethernet tests */ void DecodeEthernetRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeEthernetTest01", DecodeEthernetTest01); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/decode-gre.h0000644000000000000000000000477613051004444013166 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file decode-gre.h * * \author Breno Silva * * Generic Route Encapsulation (GRE) from RFC 1701. */ #ifndef __DECODE_GRE_H__ #define __DECODE_GRE_H__ #ifndef IPPROTO_GRE #define IPPROTO_GRE 47 #endif #include "decode.h" #include "threadvars.h" typedef struct GREHdr_ { uint8_t flags; /**< GRE packet flags */ uint8_t version; /**< GRE version */ uint16_t ether_type; /**< ether type of the encapsulated traffic */ } __attribute__((__packed__)) GREHdr; /* Generic Routing Encapsulation Source Route Entries (SREs). * The header is followed by a variable amount of Routing Information. */ typedef struct GRESreHdr_ { uint16_t af; /**< Address family */ uint8_t sre_offset; uint8_t sre_length; } __attribute__((__packed__)) GRESreHdr; #define GRE_VERSION_0 0x0000 #define GRE_VERSION_1 0x0001 #define GRE_HDR_LEN 4 #define GRE_CHKSUM_LEN 2 #define GRE_OFFSET_LEN 2 #define GRE_KEY_LEN 4 #define GRE_SEQ_LEN 4 #define GRE_SRE_HDR_LEN 4 #define GRE_PROTO_PPP 0x880b #define GRE_FLAG_ISSET_CHKSUM(r) (r->flags & 0x80) #define GRE_FLAG_ISSET_ROUTE(r) (r->flags & 0x40) #define GRE_FLAG_ISSET_KY(r) (r->flags & 0x20) #define GRE_FLAG_ISSET_SQ(r) (r->flags & 0x10) #define GRE_FLAG_ISSET_SSR(r) (r->flags & 0x08) #define GRE_FLAG_ISSET_RECUR(r) (r->flags & 0x07) #define GRE_GET_VERSION(r) (r->version & 0x07) #define GRE_GET_FLAGS(r) (r->version & 0xF8) #define GRE_GET_PROTO(r) ntohs(r->ether_type) #define GREV1_HDR_LEN 8 #define GREV1_ACK_LEN 4 #define GREV1_FLAG_ISSET_FLAGS(r) (r->version & 0x78) #define GREV1_FLAG_ISSET_ACK(r) (r->version & 0x80) void DecodeGRERegisterTests(void); #endif /* __DECODE_GRE_H__ */ suricata-3.2.1/src/util-unittest-helper.h0000644000000000000000000000456513051004444015273 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __UTIL_UNITTEST_HELPER__ #define __UTIL_UNITTEST_HELPER__ #ifdef UNITTESTS uint32_t UTHSetIPv4Address(char *); Packet *UTHBuildPacketReal(uint8_t *, uint16_t, uint8_t ipproto, char *, char *, uint16_t, uint16_t); Packet *UTHBuildPacket(uint8_t *, uint16_t, uint8_t ipproto); Packet *UTHBuildPacketSrcDst(uint8_t *, uint16_t, uint8_t ipproto, char *, char *); Packet *UTHBuildPacketSrcDstPorts(uint8_t *, uint16_t, uint8_t ipproto, uint16_t, uint16_t); Packet *UTHBuildPacketIPV6SrcDst(uint8_t *, uint16_t, uint8_t ipproto, char *, char *); int UTHPacketMatchSigMpm(Packet *, char *, uint16_t); Packet **UTHBuildPacketArrayFromEth(uint8_t **, int *, int); Packet *UTHBuildPacketFromEth(uint8_t *, uint16_t); void UTHFreePacket(Packet *); void UTHFreePackets(Packet **, int); Flow *UTHBuildFlow(int family, char *src, char *dst, Port sp, Port dp); void UTHFreeFlow(Flow *flow); int UTHAppendSigs(DetectEngineCtx *, char **, int); int UTHMatchPackets(DetectEngineCtx *, Packet **, int); int UTHPacketMatchSig(Packet *p, char *); int UTHCheckPacketMatch(Packet *, uint32_t *, uint32_t *, int); int UTHCheckPacketMatchResults(Packet *, uint32_t *, uint32_t *, int); int UTHMatchPacketsWithResults(DetectEngineCtx *, Packet **, int, uint32_t *, uint32_t *, int); int UTHGenericTest(Packet **, int, char **, uint32_t *, uint32_t *, int); uint32_t UTHBuildPacketOfFlows(uint32_t, uint32_t, uint8_t); Packet *UTHBuildPacketIPV6Real(uint8_t *, uint16_t , uint8_t ipproto, char *, char *, uint16_t , uint16_t ); #endif void UTHRegisterTests(void); #endif /* __UTIL_UNITTEST_HELPER__ */ suricata-3.2.1/src/detect-engine-file.h0000644000000000000000000000257513051004444014613 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_FILE_H__ #define __DETECT_ENGINE_FILE_H__ int DetectFileInspectHttp(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); int DetectFileInspectSmtp(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); #endif /* __DETECT_ENGINE_FILE_H__ */ suricata-3.2.1/src/output-json-smtp.h0000644000000000000000000000175213051004444014447 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_SMTP_H__ #define __OUTPUT_JSON_SMTP_H__ void JsonSmtpLogRegister(void); #ifdef HAVE_LIBJANSSON json_t *JsonSMTPAddMetadata(const Flow *f, uint64_t tx_id); #endif #endif /* __OUTPUT_JSON_SMTP_H__ */ suricata-3.2.1/src/detect-tls-cert-subject.h0000644000000000000000000000167413051004444015622 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland */ #ifndef __DETECT_TLS_SUBJECT_H__ #define __DETECT_TLS_SUBJECT_H__ #include "app-layer-ssl.h" void DetectTlsSubjectRegister(void); #endif /* __DETECT_TLS_SUBJECT_H__ */ suricata-3.2.1/src/detect-engine-tag.c0000644000000000000000000014605113051004444014440 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-engine-tag.c * * \author Victor Julien * \author Pablo Rincon Crespo * * Implements a global context to store data related to hosts flagged * tag keyword */ #include "suricata-common.h" #include "detect-engine.h" #include "util-hash.h" #include "util-atomic.h" #include "util-time.h" #include "util-hashlist.h" #include "detect-engine-tag.h" #include "detect-tag.h" #include "host.h" #include "host-storage.h" #include "flow-storage.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow-util.h" #include "stream-tcp-private.h" SC_ATOMIC_DECLARE(unsigned int, num_tags); /**< Atomic counter, to know if we have tagged hosts/sessions, to avoid locking */ static int host_tag_id = -1; /**< Host storage id for tags */ static int flow_tag_id = -1; /**< Flow storage id for tags */ void TagInitCtx(void) { SC_ATOMIC_INIT(num_tags); host_tag_id = HostStorageRegister("tag", sizeof(void *), NULL, DetectTagDataListFree); if (host_tag_id == -1) { SCLogError(SC_ERR_HOST_INIT, "Can't initiate host storage for tag"); exit(EXIT_FAILURE); } flow_tag_id = FlowStorageRegister("tag", sizeof(void *), NULL, DetectTagDataListFree); if (flow_tag_id == -1) { SCLogError(SC_ERR_FLOW_INIT, "Can't initiate flow storage for tag"); exit(EXIT_FAILURE); } } /** * \brief Destroy tag context hash tables * * \param tag_ctx Tag Context * */ void TagDestroyCtx(void) { #ifdef DEBUG BUG_ON(SC_ATOMIC_GET(num_tags) != 0); #endif SC_ATOMIC_DESTROY(num_tags); } /** \brief Reset the tagging engine context */ void TagRestartCtx() { TagDestroyCtx(); TagInitCtx(); } int TagHostHasTag(Host *host) { return HostGetStorageById(host, host_tag_id) ? 1 : 0; } static DetectTagDataEntry *DetectTagDataCopy(DetectTagDataEntry *dtd) { DetectTagDataEntry *tde = SCMalloc(sizeof(DetectTagDataEntry)); if (unlikely(tde == NULL)) { return NULL; } memset(tde, 0, sizeof(DetectTagDataEntry)); tde->sid = dtd->sid; tde->gid = dtd->gid; tde->flags = dtd->flags; tde->metric = dtd->metric; tde->count = dtd->count; tde->first_ts = dtd->first_ts; tde->last_ts = dtd->last_ts; return tde; } /** * \brief This function is used to add a tag to a session (type session) * or update it if it's already installed. The number of times to * allow an update is limited by DETECT_TAG_MATCH_LIMIT. This way * repetitive matches to the same rule are limited of setting tags, * to avoid DOS attacks * * \param p pointer to the current packet * \param tde pointer to the new DetectTagDataEntry * * \retval 0 if the tde was added succesfuly * \retval 1 if an entry of this sid/gid already exist and was updated */ int TagFlowAdd(Packet *p, DetectTagDataEntry *tde) { uint8_t updated = 0; uint16_t tag_cnt = 0; DetectTagDataEntry *iter = NULL; if (p->flow == NULL) return 1; iter = FlowGetStorageById(p->flow, flow_tag_id); if (iter != NULL) { /* First iterate installed entries searching a duplicated sid/gid */ for (; iter != NULL; iter = iter->next) { tag_cnt++; if (iter->sid == tde->sid && iter->gid == tde->gid) { iter->cnt_match++; /* If so, update data, unless the maximum MATCH limit is * reached. This prevents possible DOS attacks */ if (iter->cnt_match < DETECT_TAG_MATCH_LIMIT) { /* Reset time and counters */ iter->first_ts = iter->last_ts = tde->first_ts; iter->packets = 0; iter->bytes = 0; } updated = 1; break; } } } /* If there was no entry of this rule, prepend the new tde */ if (updated == 0 && tag_cnt < DETECT_TAG_MAX_TAGS) { DetectTagDataEntry *new_tde = DetectTagDataCopy(tde); if (new_tde != NULL) { new_tde->next = FlowGetStorageById(p->flow, flow_tag_id); FlowSetStorageById(p->flow, flow_tag_id, new_tde); SCLogDebug("adding tag with first_ts %u", new_tde->first_ts); (void) SC_ATOMIC_ADD(num_tags, 1); } } else if (tag_cnt == DETECT_TAG_MAX_TAGS) { SCLogDebug("Max tags for sessions reached (%"PRIu16")", tag_cnt); } return updated; } /** * \brief Add a tag entry for a host. If it already exist, update it. * * \param tag_ctx Tag context for hosts * \param tde Tag data * \param p packet * * \retval 0 if it was added, 1 if it was updated */ int TagHashAddTag(DetectTagDataEntry *tde, Packet *p) { SCEnter(); uint8_t updated = 0; uint16_t num_tags = 0; Host *host = NULL; /* Lookup host in the hash. If it doesn't exist yet it's * created. */ if (tde->flags & TAG_ENTRY_FLAG_DIR_SRC) { host = HostGetHostFromHash(&p->src); } else if (tde->flags & TAG_ENTRY_FLAG_DIR_DST) { host = HostGetHostFromHash(&p->dst); } /* no host for us */ if (host == NULL) { SCLogDebug("host tag not added: no host"); return -1; } void *tag = HostGetStorageById(host, host_tag_id); if (tag == NULL) { /* get a new tde as the one we have is on the stack */ DetectTagDataEntry *new_tde = DetectTagDataCopy(tde); if (new_tde != NULL) { HostSetStorageById(host, host_tag_id, new_tde); (void) SC_ATOMIC_ADD(num_tags, 1); SCLogDebug("host tag added"); } } else { /* Append the tag to the list of this host */ SCLogDebug("updating existing host"); /* First iterate installed entries searching a duplicated sid/gid */ DetectTagDataEntry *iter = NULL; for (iter = tag; iter != NULL; iter = iter->next) { num_tags++; if (iter->sid == tde->sid && iter->gid == tde->gid) { iter->cnt_match++; /* If so, update data, unless the maximum MATCH limit is * reached. This prevents possible DOS attacks */ if (iter->cnt_match < DETECT_TAG_MATCH_LIMIT) { /* Reset time and counters */ iter->first_ts = iter->last_ts = tde->first_ts; iter->packets = 0; iter->bytes = 0; } updated = 1; break; } } /* If there was no entry of this rule, append the new tde */ if (updated == 0 && num_tags < DETECT_TAG_MAX_TAGS) { /* get a new tde as the one we have is on the stack */ DetectTagDataEntry *new_tde = DetectTagDataCopy(tde); if (new_tde != NULL) { (void) SC_ATOMIC_ADD(num_tags, 1); new_tde->next = tag; HostSetStorageById(host, host_tag_id, new_tde); } } else if (num_tags == DETECT_TAG_MAX_TAGS) { SCLogDebug("Max tags for sessions reached (%"PRIu16")", num_tags); } } HostRelease(host); SCReturnInt(updated); } static void TagHandlePacketFlow(Flow *f, Packet *p) { if (FlowGetStorageById(f, flow_tag_id) == NULL) return; DetectTagDataEntry *tde = NULL; DetectTagDataEntry *prev = NULL; DetectTagDataEntry *iter = FlowGetStorageById(f, flow_tag_id); uint8_t flag_added = 0; while (iter != NULL) { /* update counters */ iter->last_ts = p->ts.tv_sec; switch (iter->metric) { case DETECT_TAG_METRIC_PACKET: iter->packets++; break; case DETECT_TAG_METRIC_BYTES: iter->bytes += GET_PKT_LEN(p); break; } /* If this packet triggered the rule with tag, we dont need * to log it (the alert will log it) */ if (!(iter->flags & TAG_ENTRY_FLAG_SKIPPED_FIRST)) { iter->flags |= TAG_ENTRY_FLAG_SKIPPED_FIRST; } else { /* Update metrics; remove if tag expired; and set alerts */ switch (iter->metric) { case DETECT_TAG_METRIC_PACKET: if (iter->packets > iter->count) { SCLogDebug("flow tag expired: packets %u > %u", iter->packets, iter->count); /* tag expired */ if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { FlowSetStorageById(p->flow, flow_tag_id, iter->next); tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; case DETECT_TAG_METRIC_BYTES: if (iter->bytes > iter->count) { /* tag expired */ SCLogDebug("flow tag expired: bytes %u > %u", iter->bytes, iter->count); if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { FlowSetStorageById(p->flow, flow_tag_id, iter->next); tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; case DETECT_TAG_METRIC_SECONDS: /* last_ts handles this metric, but also a generic time based * expiration to prevent dead sessions/hosts */ if (iter->last_ts - iter->first_ts > iter->count) { SCLogDebug("flow tag expired: %u - %u = %u > %u", iter->last_ts, iter->first_ts, (iter->last_ts - iter->first_ts), iter->count); /* tag expired */ if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { FlowSetStorageById(p->flow, flow_tag_id, iter->next); tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; } } prev = iter; iter = iter->next; } } void TagHandlePacketHost(Host *host, Packet *p) { DetectTagDataEntry *tde = NULL; DetectTagDataEntry *prev = NULL; DetectTagDataEntry *iter; uint8_t flag_added = 0; iter = HostGetStorageById(host, host_tag_id); prev = NULL; while (iter != NULL) { /* update counters */ iter->last_ts = p->ts.tv_sec; switch (iter->metric) { case DETECT_TAG_METRIC_PACKET: iter->packets++; break; case DETECT_TAG_METRIC_BYTES: iter->bytes += GET_PKT_LEN(p); break; } /* If this packet triggered the rule with tag, we dont need * to log it (the alert will log it) */ if (!(iter->flags & TAG_ENTRY_FLAG_SKIPPED_FIRST)) { iter->flags |= TAG_ENTRY_FLAG_SKIPPED_FIRST; } else { /* Update metrics; remove if tag expired; and set alerts */ switch (iter->metric) { case DETECT_TAG_METRIC_PACKET: if (iter->packets > iter->count) { SCLogDebug("host tag expired: packets %u > %u", iter->packets, iter->count); /* tag expired */ if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); HostSetStorageById(host, host_tag_id, iter); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; case DETECT_TAG_METRIC_BYTES: if (iter->bytes > iter->count) { SCLogDebug("host tag expired: bytes %u > %u", iter->bytes, iter->count); /* tag expired */ if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); HostSetStorageById(host, host_tag_id, iter); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; case DETECT_TAG_METRIC_SECONDS: /* last_ts handles this metric, but also a generic time based * expiration to prevent dead sessions/hosts */ if (iter->last_ts - iter->first_ts > iter->count) { SCLogDebug("host tag expired: %u - %u = %u > %u", iter->last_ts, iter->first_ts, (iter->last_ts - iter->first_ts), iter->count); /* tag expired */ if (prev != NULL) { tde = iter; prev->next = iter->next; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); continue; } else { tde = iter; iter = iter->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); HostSetStorageById(host, host_tag_id, iter); continue; } } else if (flag_added == 0) { /* It's matching the tag. Add it to be logged and * update "flag_added" to add the packet once. */ p->flags |= PKT_HAS_TAG; flag_added++; } break; } } prev = iter; iter = iter->next; } } /** * \brief Search tags for src and dst. Update entries of the tag, remove if necessary * * \param de_ctx Detect context * \param det_ctx Detect thread context * \param p packet * */ void TagHandlePacket(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { SCEnter(); /* If there's no tag, get out of here */ unsigned int current_tags = SC_ATOMIC_GET(num_tags); if (current_tags == 0) SCReturn; /* First update and get session tags */ if (p->flow != NULL) { TagHandlePacketFlow(p->flow, p); } Host *src = HostLookupHostFromHash(&p->src); if (src) { if (TagHostHasTag(src)) { TagHandlePacketHost(src,p); } HostRelease(src); } Host *dst = HostLookupHostFromHash(&p->dst); if (dst) { if (TagHostHasTag(dst)) { TagHandlePacketHost(dst,p); } HostRelease(dst); } SCReturn; } /** * \brief Removes the entries exceding the max timeout value * * \param tag_ctx Tag context * \param ts the current time * * \retval 1 no tags or tags removed -- host is free to go (from tag perspective) * \retval 0 still active tags */ int TagTimeoutCheck(Host *host, struct timeval *tv) { DetectTagDataEntry *tde = NULL; DetectTagDataEntry *tmp = NULL; DetectTagDataEntry *prev = NULL; int retval = 1; tmp = HostGetStorageById(host, host_tag_id); if (tmp == NULL) return 1; prev = NULL; while (tmp != NULL) { if ((tv->tv_sec - tmp->last_ts) <= TAG_MAX_LAST_TIME_SEEN) { prev = tmp; tmp = tmp->next; retval = 0; continue; } /* timed out */ if (prev != NULL) { prev->next = tmp->next; tde = tmp; tmp = tde->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); } else { HostSetStorageById(host, host_tag_id, tmp->next); tde = tmp; tmp = tde->next; SCFree(tde); (void) SC_ATOMIC_SUB(num_tags, 1); } } return retval; } #ifdef UNITTESTS /** * \test host tagging: packets */ int DetectTagTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.9", 41424, 80); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.11", 41424, 80); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.11", 41424, 80); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,packets,src; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,4,packets,dst; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int32_t results[7][5] = { {1, 1, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); SCLogDebug("running tests"); result = UTHGenericTest(p, 7, sigs, sid, (uint32_t *) results, 5); SCLogDebug("running tests done"); Host *src = HostLookupHostFromHash(&p[1]->src); if (src) { void *tag = HostGetStorageById(src, host_tag_id); if (tag != NULL) { printf("tag should have been expired: "); result = 0; } HostRelease(src); } Host *dst = HostLookupHostFromHash(&p[1]->dst); if (dst) { void *tag = HostGetStorageById(dst, host_tag_id); BUG_ON(tag == NULL); DetectTagDataEntry *iter = tag; /* check internal state */ if (!(iter->gid == 1 && iter->sid == 2 && iter->packets == 4 && iter->count == 4)) { printf("gid %u sid %u packets %u count %u: ", iter->gid, iter->sid, iter->packets, iter->count); result = 0; } HostRelease(dst); } BUG_ON(src == NULL || dst == NULL); UTHFreePackets(p, 7); HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test host tagging: seconds */ int DetectTagTestPacket02 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.9", 41424, 80); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.11", 41424, 80); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.11", 41424, 80); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host,3,seconds,src; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host,8,seconds,dst; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; //de_ctx->flags |= DE_QUIET; int32_t results[7][5] = { {1, 1, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { SCLogDebug("packet %d", i); TimeGet(&p[i]->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; TimeSetIncrementTime(2); SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 2 || i == 3 || i == 5 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test host tagging: bytes */ static int DetectTagTestPacket03 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.9", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.9", 41424, 80); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.11", 41424, 80); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.11", 41424, 80); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:host, 150, bytes, src; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"Hi all\"; tag:host, 150, bytes, dst; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; int32_t results[7][5] = { {1, 1, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 3 || i == 5 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test session tagging: packets */ static int DetectTagTestPacket04 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); Flow *f = NULL; TcpSession ssn; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); FlowInitConfig(1); f = FlowAlloc(); BUG_ON(f == NULL); FLOW_INITIALIZE(f); f->protoctx = (void *)&ssn; f->flags |= FLOW_IPV4; if (inet_pton(AF_INET, "192.168.1.5", f->src.addr_data32) != 1) goto end; if (inet_pton(AF_INET, "192.168.1.1", f->dst.addr_data32) != 1) goto end; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 80, 41424); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,4,packets; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; int32_t results[7][5] = { {1, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { p[i]->flow = f; p[i]->flow->protoctx = &ssn; SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 4 || i == 5 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } /* clean up flow */ uint8_t proto_map = FlowGetProtoMapping(f->proto); FlowClearMemory(f, proto_map); FLOW_DESTROY(f); end: FlowShutdown(); HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test session tagging: seconds */ static int DetectTagTestPacket05 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); Flow *f = NULL; TcpSession ssn; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); FlowInitConfig(1); f = FlowAlloc(); BUG_ON(f == NULL); FLOW_INITIALIZE(f); f->protoctx = (void *)&ssn; f->flags |= FLOW_IPV4; if (inet_pton(AF_INET, "192.168.1.5", f->src.addr_data32) != 1) goto end; if (inet_pton(AF_INET, "192.168.1.1", f->dst.addr_data32) != 1) goto end; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 80, 41424); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,8,seconds; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; int32_t results[7][5] = { {1, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { p[i]->flow = f; p[i]->flow->protoctx = &ssn; SCLogDebug("packet %d", i); TimeGet(&p[i]->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; TimeSetIncrementTime(2); SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 5 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } /* clean up flow */ uint8_t proto_map = FlowGetProtoMapping(f->proto); FlowClearMemory(f, proto_map); FLOW_DESTROY(f); end: FlowShutdown(); HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test session tagging: bytes */ static int DetectTagTestPacket06 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); Flow *f = NULL; TcpSession ssn; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); FlowInitConfig(1); f = FlowAlloc(); BUG_ON(f == NULL); FLOW_INITIALIZE(f); f->protoctx = (void *)&ssn; f->flags |= FLOW_IPV4; if (inet_pton(AF_INET, "192.168.1.5", f->src.addr_data32) != 1) goto end; if (inet_pton(AF_INET, "192.168.1.1", f->dst.addr_data32) != 1) goto end; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[3] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 80, 41424); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; int32_t results[7][5] = { {1, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { p[i]->flow = f; p[i]->flow->protoctx = &ssn; SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 3 || i == 4 || i == 5 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } /* clean up flow */ uint8_t proto_map = FlowGetProtoMapping(f->proto); FlowClearMemory(f, proto_map); FLOW_DESTROY(f); end: FlowShutdown(); HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } /** * \test session tagging: bytes, where a 2nd match makes us tag more */ static int DetectTagTestPacket07 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint8_t *buf2 = (uint8_t *)"lalala!"; uint16_t buf_len = strlen((char *)buf); uint16_t buf_len2 = strlen((char *)buf2); Flow *f = NULL; TcpSession ssn; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); StorageInit(); TagInitCtx(); StorageFinalize(); HostInitConfig(1); FlowInitConfig(1); f = FlowAlloc(); BUG_ON(f == NULL); FLOW_INITIALIZE(f); f->protoctx = (void *)&ssn; f->flags |= FLOW_IPV4; if (inet_pton(AF_INET, "192.168.1.5", f->src.addr_data32) != 1) goto end; if (inet_pton(AF_INET, "192.168.1.1", f->dst.addr_data32) != 1) goto end; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Packet *p[7]; p[0] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[1] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[2] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[3] = UTHBuildPacketReal(buf, buf_len, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); p[4] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[5] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 80, 41424); p[6] = UTHBuildPacketReal(buf2, buf_len2, IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 80, 41424); char *sigs[5]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing tag 1\"; content:\"Hi all\"; tag:session,150,bytes; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"blahblah\"; sid:2;)"; sigs[2]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:3;)"; sigs[3]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing tag 2\"; content:\"no match\"; sid:5;)"; /* Please, Notice that tagged data goes with sig_id = 1 and tag sig generator = 2 */ uint32_t sid[5] = {1,2,3,4,5}; int numsigs = 5; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; int32_t results[7][5] = { {1, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {1, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }; int num_packets = 7; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { p[i]->flow = f; p[i]->flow->protoctx = &ssn; SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sid, (uint32_t *)&results[i][0], numsigs) == 0) goto cleanup; SCLogDebug("packet %d flag %s", i, p[i]->flags & PKT_HAS_TAG ? "true" : "false"); #if 1 /* see if the PKT_HAS_TAG is set on the packet if needed */ int expect; if (i == 0 || i == 6) expect = FALSE; else expect = TRUE; if (((p[i]->flags & PKT_HAS_TAG) ? TRUE : FALSE) != expect) goto cleanup; #endif } result = 1; cleanup: UTHFreePackets(p, 7); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } /* clean up flow */ uint8_t proto_map = FlowGetProtoMapping(f->proto); FlowClearMemory(f, proto_map); FLOW_DESTROY(f); end: FlowShutdown(); HostShutdown(); TagDestroyCtx(); StorageCleanup(); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectTag */ void DetectEngineTagRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTagTestPacket01", DetectTagTestPacket01); UtRegisterTest("DetectTagTestPacket02", DetectTagTestPacket02); UtRegisterTest("DetectTagTestPacket03", DetectTagTestPacket03); UtRegisterTest("DetectTagTestPacket04", DetectTagTestPacket04); UtRegisterTest("DetectTagTestPacket05", DetectTagTestPacket05); UtRegisterTest("DetectTagTestPacket06", DetectTagTestPacket06); UtRegisterTest("DetectTagTestPacket07", DetectTagTestPacket07); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-icode.h0000644000000000000000000000166713051004444013515 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \file detect-icode.c * * \author Gerardo Iglesias */ #ifndef __DETECT_ICODE_H__ #define __DETECT_ICODE_H__ /* prototypes */ void DetectICodeRegister(void); #endif /* __DETECT_ICODE_H__ */ suricata-3.2.1/src/detect-http-raw-uri.h0000644000000000000000000000163613051004444014771 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * */ #ifndef __DETECT_HTTP_URI_H__ #define __DETECT_HTTP_URI_H__ void DetectHttpRawUriRegister(void); #endif /* __DETECT_HTTP_URI_H__ */ suricata-3.2.1/src/app-layer.c0000644000000000000000000032522113051004444013044 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Generic App-layer functions */ #include "suricata-common.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-detect-proto.h" #include "stream-tcp-reassemble.h" #include "stream-tcp-private.h" #include "stream-tcp-inline.h" #include "stream-tcp.h" #include "flow.h" #include "flow-util.h" #include "flow-private.h" #include "util-debug.h" #include "util-print.h" #include "util-profiling.h" #include "util-validate.h" #include "decode-events.h" #include "app-layer-htp-mem.h" #include "app-layer-dns-common.h" /** * \brief This is for the app layer in general and it contains per thread * context relevant to both the alpd and alp. */ struct AppLayerThreadCtx_ { /* App layer protocol detection thread context, from AppLayerProtoDetectGetCtxThread(). */ AppLayerProtoDetectThreadCtx *alpd_tctx; /* App layer parser thread context, from AppLayerParserThreadCtxAlloc(). */ AppLayerParserThreadCtx *alp_tctx; #ifdef PROFILING uint64_t ticks_start; uint64_t ticks_end; uint64_t ticks_spent; AppProto alproto; uint64_t proto_detect_ticks_start; uint64_t proto_detect_ticks_end; uint64_t proto_detect_ticks_spent; #endif }; #define MAX_COUNTER_SIZE 64 typedef struct AppLayerCounterNames_ { char name[MAX_COUNTER_SIZE]; char tx_name[MAX_COUNTER_SIZE]; } AppLayerCounterNames; typedef struct AppLayerCounters_ { uint16_t counter_id; uint16_t counter_tx_id; } AppLayerCounters; /* counter names. Only used at init. */ AppLayerCounterNames applayer_counter_names[FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]; /* counter id's. Used that runtime. */ AppLayerCounters applayer_counters[FLOW_PROTO_APPLAYER_MAX][ALPROTO_MAX]; void AppLayerSetupCounters(); void AppLayerDeSetupCounters(); /***** L7 layer dispatchers *****/ static inline int ProtoDetectDone(const Flow *f, const TcpSession *ssn, uint8_t direction) { const TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server; return ((stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED) || (FLOW_IS_PM_DONE(f, direction) && FLOW_IS_PP_DONE(f, direction))); } static void AppLayerIncFlowCounter(ThreadVars *tv, Flow *f) { if (likely(tv)) { StatsIncr(tv, applayer_counters[f->protomap][f->alproto].counter_id); } } void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step) { if (likely(tv)) { StatsAddUI64(tv, applayer_counters[f->protomap][f->alproto].counter_tx_id, step); } } /* in IDS mode protocol detection is done in reverse order: * when TCP data is ack'd. We want to flag the correct packet, * so in this case we set a flag in the flow so that the first * packet in the correct direction can be tagged. * * For IPS things are much simpler, and we don't use the flow * flag. We just tag the packet directly. */ static inline void FlagPacketFlow(Packet *p, Flow *f, uint8_t flags) { if (EngineModeIsIPS()) { if (flags & STREAM_TOSERVER) { if (p->flowflags & FLOW_PKT_TOSERVER) { p->flags |= PKT_PROTO_DETECT_TS_DONE; } else { f->flags |= FLOW_PROTO_DETECT_TS_DONE; } } else { if (p->flowflags & FLOW_PKT_TOCLIENT) { p->flags |= PKT_PROTO_DETECT_TC_DONE; } else { f->flags |= FLOW_PROTO_DETECT_TC_DONE; } } } else { if (flags & STREAM_TOSERVER) { f->flags |= FLOW_PROTO_DETECT_TS_DONE; } else { f->flags |= FLOW_PROTO_DETECT_TC_DONE; } } } static void DisableAppLayer(ThreadVars *tv, Flow *f, Packet *p) { SCLogDebug("disable app layer for flow %p alproto %u ts %u tc %u", f, f->alproto, f->alproto_ts, f->alproto_tc); StreamTcpDisableAppLayer(f); TcpSession *ssn = f->protoctx; ssn->data_first_seen_dir = APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER; f->alproto = ALPROTO_FAILED; AppLayerIncFlowCounter(tv, f); if (f->alproto_tc != ALPROTO_FAILED) { if (f->alproto_tc == ALPROTO_UNKNOWN) { f->alproto_tc = ALPROTO_FAILED; } FlagPacketFlow(p, f, STREAM_TOCLIENT); } if (f->alproto_ts != ALPROTO_FAILED) { if (f->alproto_ts == ALPROTO_UNKNOWN) { f->alproto_ts = ALPROTO_FAILED; } FlagPacketFlow(p, f, STREAM_TOSERVER); } SCLogDebug("disabled app layer for flow %p alproto %u ts %u tc %u", f, f->alproto, f->alproto_ts, f->alproto_tc); } /* See if we're going to have to give up: * * If we're getting a lot of data in one direction and the * proto for this direction is unknown, proto detect will * hold up segments in the segment list in the stream. * They are held so that if we detect the protocol on the * opposing stream, we can still parse this side of the stream * as well. However, some sessions are very unbalanced. FTP * data channels, large PUT/POST request and many others, can * lead to cases where we would have to store many megabytes * worth of segments before we see the opposing stream. This * leads to risks of resource starvation. * * Here a cutoff point is enforced. If we've stored 100k in * one direction and we've seen no data in the other direction, * we give up. * * Giving up means we disable applayer an set an applayer event */ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv, Flow *f, TcpSession *ssn, Packet *p) { uint32_t size_ts = ssn->client.last_ack - ssn->client.isn - 1; uint32_t size_tc = ssn->server.last_ack - ssn->server.isn - 1; SCLogDebug("size_ts %u, size_tc %u", size_ts, size_tc); #ifdef DEBUG_VALIDATION if (!(ssn->client.flags & STREAMTCP_STREAM_FLAG_GAP)) BUG_ON(size_ts > 1000000UL); if (!(ssn->server.flags & STREAMTCP_STREAM_FLAG_GAP)) BUG_ON(size_tc > 1000000UL); #endif /* DEBUG_VALIDATION */ if (ProtoDetectDone(f, ssn, STREAM_TOSERVER) && ProtoDetectDone(f, ssn, STREAM_TOCLIENT)) { goto failure; } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && size_ts > 100000 && size_tc == 0) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && size_tc > 100000 && size_ts == 0) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; /* little data in ts direction, pp done, pm not done (max * depth not reached), ts direction done, lots of data in * tc direction. */ } else if (size_tc > 100000 && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; /* little data in tc direction, pp done, pm not done (max * depth not reached), tc direction done, lots of data in * ts direction. */ } else if (size_ts > 100000 && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; /* in case of really low TS data (e.g. 4 bytes) we can have * the PP complete, PM not complete (depth not reached) and * the TC side also not recognized (proto unknown) */ } else if (size_tc > 100000 && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && (!FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && !FLOW_IS_PP_DONE(f, STREAM_TOCLIENT))) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; } return; failure: DisableAppLayer(tv, f, p); return; } /** \todo modifying p this way seems too hacky */ static int TCPProtoDetectTriggerOpposingSide(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, TcpSession *ssn, TcpStream *stream, uint8_t flags) { TcpStream *opposing_stream = NULL; if (stream == &ssn->client) { opposing_stream = &ssn->server; if (StreamTcpInlineMode()) { p->flowflags &= ~FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; } else { p->flowflags &= ~FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; } } else { opposing_stream = &ssn->client; if (StreamTcpInlineMode()) { p->flowflags &= ~FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; } else { p->flowflags &= ~FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; } } int ret = 0; /* if the opposing side is not going to work, then * we just have to give up. */ if (opposing_stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) ret = -1; else ret = StreamTcpReassembleAppLayer(tv, ra_ctx, ssn, opposing_stream, p); if (stream == &ssn->client) { if (StreamTcpInlineMode()) { p->flowflags &= ~FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; } else { p->flowflags &= ~FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; } } else { if (StreamTcpInlineMode()) { p->flowflags &= ~FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; } else { p->flowflags &= ~FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; } } return ret; } /** \todo data const */ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream *stream, uint8_t *data, uint32_t data_len, uint8_t flags) { AppProto *alproto; AppProto *alproto_otherdir; if (flags & STREAM_TOSERVER) { alproto = &f->alproto_ts; alproto_otherdir = &f->alproto_tc; } else { alproto = &f->alproto_tc; alproto_otherdir = &f->alproto_ts; } SCLogDebug("Stream initializer (len %" PRIu32 ")", data_len); #ifdef PRINT if (data_len > 0) { printf("=> Init Stream Data (app layer) -- start %s%s\n", flags & STREAM_TOCLIENT ? "toclient" : "", flags & STREAM_TOSERVER ? "toserver" : ""); PrintRawDataFp(stdout, data, data_len); printf("=> Init Stream Data -- end\n"); } #endif PACKET_PROFILING_APP_PD_START(app_tctx); *alproto = AppLayerProtoDetectGetProto(app_tctx->alpd_tctx, f, data, data_len, IPPROTO_TCP, flags); PACKET_PROFILING_APP_PD_END(app_tctx); if (*alproto != ALPROTO_UNKNOWN) { if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS); if (ssn->data_first_seen_dir == APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { /* if we already invoked the parser, we go with that proto */ f->alproto = *alproto_otherdir; } else { /* no data sent to parser yet, we can still choose * we're trusting the server more. */ if (flags & STREAM_TOCLIENT) f->alproto = *alproto; else f->alproto = *alproto_otherdir; } } else { f->alproto = *alproto; } StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); TcpSessionSetReassemblyDepth(ssn, AppLayerParserGetStreamDepth(f->proto, f->alproto)); FlagPacketFlow(p, f, flags); /* account flow if we have both sides */ if (*alproto_otherdir != ALPROTO_UNKNOWN) { AppLayerIncFlowCounter(tv, f); } /* if we have seen data from the other direction first, send * data for that direction first to the parser. This shouldn't * be an issue, since each stream processing happens * independently of the other stream direction. At this point of * call, you need to know that this function's already being * called by the very same StreamReassembly() function that we * will now call shortly for the opposing direction. */ if ((ssn->data_first_seen_dir & (STREAM_TOSERVER | STREAM_TOCLIENT)) && !(flags & ssn->data_first_seen_dir)) { if (TCPProtoDetectTriggerOpposingSide(tv, ra_ctx, p, ssn, stream, flags) != 0) { DisableAppLayer(tv, f, p); goto failure; } } /* if the parser operates such that it needs to see data from * a particular direction first, we check if we have seen * data from that direction first for the flow. IF it is not * the same, we set an event and exit. * * \todo We need to figure out a more robust solution for this, * as this can lead to easy evasion tactics, where the * attackeer can first send some dummy data in the wrong * direction first to mislead our proto detection process. * While doing this we need to update the parsers as well, * since the parsers must be robust to see such wrong * direction data. * Either ways the moment we see the * APPLAYER_WRONG_DIRECTION_FIRST_DATA event set for the * flow, it shows something's fishy. */ if (ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { uint8_t first_data_dir; first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto); if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_WRONG_DIRECTION_FIRST_DATA); DisableAppLayer(tv, f, p); goto failure; } /* This can happen if the current direction is not the * right direction, and the data from the other(also * the right direction) direction is available to be sent * to the app layer, but it is not ack'ed yet and hence * the forced call to STreamTcpAppLayerReassemble still * hasn't managed to send data from the other direction * to the app layer. */ if (first_data_dir && !(first_data_dir & flags)) { FlowCleanupAppLayer(f); StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream); FLOW_RESET_PP_DONE(f, flags); FLOW_RESET_PM_DONE(f, flags); goto failure; } } /* Set a value that is neither STREAM_TOSERVER, nor STREAM_TOCLIENT */ ssn->data_first_seen_dir = APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER; /* finally, invoke the parser */ PACKET_PROFILING_APP_START(app_tctx, f->alproto); int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto, flags, data, data_len); PACKET_PROFILING_APP_END(app_tctx, f->alproto); if (r < 0) goto failure; } else { /* if the ssn is midstream, we may end up with a case where the * start of an HTTP request is missing. We won't detect HTTP based * on the request. However, the reply is fine, so we detect * HTTP anyway. This leads to passing the incomplete request to * the htp parser. * * This has been observed, where the http parser then saw many * bogus requests in the incomplete data. * * To counter this case, a midstream session MUST find it's * protocol in the toserver direction. If not, we assume the * start of the request/toserver is incomplete and no reliable * detection and parsing is possible. So we give up. */ if ((ssn->flags & STREAMTCP_FLAG_MIDSTREAM) && !(ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK)) { if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) { SCLogDebug("midstream end pd %p", ssn); /* midstream and toserver detection failed: give up */ DisableAppLayer(tv, f, p); goto end; } } if (*alproto_otherdir != ALPROTO_UNKNOWN) { uint8_t first_data_dir; first_data_dir = AppLayerParserGetFirstDataDir(f->proto, *alproto_otherdir); /* this would handle this test case - * http parser which says it wants to see toserver data first only. * tcp handshake * toclient data first received. - RUBBISH DATA which * we don't detect as http * toserver data next sent - we detect this as http. * at this stage we see that toclient is the first data seen * for this session and we try and redetect the app protocol, * but we are unable to detect the app protocol like before. * But since we have managed to detect the protocol for the * other direction as http, we try to use that. At this * stage we check if the direction of this stream matches * to that acceptable by the app parser. If it is not the * acceptable direction we error out. */ if ((ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) && (first_data_dir) && !(first_data_dir & flags)) { DisableAppLayer(tv, f, p); goto failure; } /* if protocol detection is marked done for our direction we * pass our data on. We're only succeeded in finding one * direction: the opposing stream * * If PD was not yet complete, we don't do anything. */ if (FLOW_IS_PM_DONE(f, flags) && FLOW_IS_PP_DONE(f, flags)) { if (data_len > 0) ssn->data_first_seen_dir = APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER; PACKET_PROFILING_APP_START(app_tctx, f->alproto); int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto, flags, data, data_len); PACKET_PROFILING_APP_END(app_tctx, f->alproto); AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION); StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); TcpSessionSetReassemblyDepth(ssn, AppLayerParserGetStreamDepth(f->proto, f->alproto)); *alproto = ALPROTO_FAILED; FlagPacketFlow(p, f, flags); SCLogDebug("packet %u: pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set", (uint)p->pcap_cnt, *alproto, *alproto_otherdir, r); if (r < 0) goto failure; } } else { /* both sides unknown, let's see if we need to give up */ TCPProtoDetectCheckBailConditions(tv, f, ssn, p); } } end: return 0; failure: return -1; } /** \brief handle TCP data for the app-layer. * * First run protocol detection and then when the protocol is known invoke * the app layer parser. */ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream *stream, uint8_t *data, uint32_t data_len, uint8_t flags) { SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx; AppProto alproto; uint8_t dir; int r = 0; SCLogDebug("data_len %u flags %02X", data_len, flags); if (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) { SCLogDebug("STREAMTCP_FLAG_APP_LAYER_DISABLED is set"); goto end; } if (flags & STREAM_TOSERVER) { alproto = f->alproto_ts; dir = 0; } else { alproto = f->alproto_tc; dir = 1; } /* if we don't know the proto yet and we have received a stream * initializer message, we run proto detection. * We receive 2 stream init msgs (one for each direction) but we * only run the proto detection once. */ if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_GAP)) { StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); StreamTcpSetSessionNoReassemblyFlag(ssn, dir); SCLogDebug("ALPROTO_UNKNOWN flow %p, due to GAP in stream start", f); } else if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_START)) { /* run protocol detection */ if (TCPProtoDetect(tv, ra_ctx, app_tctx, p, f, ssn, stream, data, data_len, flags) != 0) { goto failure; } } else { SCLogDebug("stream data (len %" PRIu32 " alproto " "%"PRIu16" (flow %p)", data_len, f->alproto, f); #ifdef PRINT if (data_len > 0) { printf("=> Stream Data (app layer) -- start %s%s\n", flags & STREAM_TOCLIENT ? "toclient" : "", flags & STREAM_TOSERVER ? "toserver" : ""); PrintRawDataFp(stdout, data, data_len); printf("=> Stream Data -- end\n"); } #endif /* if we don't have a data object here we are not getting it * a start msg should have gotten us one */ if (f->alproto != ALPROTO_UNKNOWN) { PACKET_PROFILING_APP_START(app_tctx, f->alproto); r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto, flags, data, data_len); PACKET_PROFILING_APP_END(app_tctx, f->alproto); } else { SCLogDebug(" smsg not start, but no l7 data? Weird"); } } goto end; failure: r = -1; end: SCReturnInt(r); } /** * \brief Handle a app layer UDP message * * If the protocol is yet unknown, the proto detection code is run first. * * \param dp_ctx Thread app layer detect context * \param f *locked* flow * \param p UDP packet * * \retval 0 ok * \retval -1 error */ int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f) { SCEnter(); int r = 0; uint8_t flags = 0; if (p->flowflags & FLOW_PKT_TOSERVER) { flags |= STREAM_TOSERVER; } else { flags |= STREAM_TOCLIENT; } if (f->alproto == ALPROTO_FAILED) { SCReturnInt(0); /* if the protocol is still unknown, run detection */ } else if (f->alproto == ALPROTO_UNKNOWN) { SCLogDebug("Detecting AL proto on udp mesg (len %" PRIu32 ")", p->payload_len); PACKET_PROFILING_APP_PD_START(tctx); f->alproto = AppLayerProtoDetectGetProto(tctx->alpd_tctx, f, p->payload, p->payload_len, IPPROTO_UDP, flags); PACKET_PROFILING_APP_PD_END(tctx); if (f->alproto != ALPROTO_UNKNOWN) { AppLayerIncFlowCounter(tv, f); PACKET_PROFILING_APP_START(tctx, f->alproto); r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto, flags, p->payload, p->payload_len); PACKET_PROFILING_APP_END(tctx, f->alproto); } else { f->alproto = ALPROTO_FAILED; AppLayerIncFlowCounter(tv, f); SCLogDebug("ALPROTO_UNKNOWN flow %p", f); } /* we do only inspection in one direction, so flag both * sides as done here */ FlagPacketFlow(p, f, STREAM_TOSERVER); FlagPacketFlow(p, f, STREAM_TOCLIENT); } else { SCLogDebug("data (len %" PRIu32 " ), alproto " "%"PRIu16" (flow %p)", p->payload_len, f->alproto, f); /* run the parser */ PACKET_PROFILING_APP_START(tctx, f->alproto); r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto, flags, p->payload, p->payload_len); PACKET_PROFILING_APP_END(tctx, f->alproto); } PACKET_PROFILING_APP_STORE(tctx, p); SCReturnInt(r); } /***** Utility *****/ AppProto AppLayerGetProtoByName(char *alproto_name) { SCEnter(); AppProto r = AppLayerProtoDetectGetProtoByName(alproto_name); SCReturnCT(r, "AppProto"); } char *AppLayerGetProtoName(AppProto alproto) { SCEnter(); char * r = AppLayerProtoDetectGetProtoName(alproto); SCReturnCT(r, "char *"); } void AppLayerListSupportedProtocols(void) { SCEnter(); AppProto alproto; AppProto alprotos[ALPROTO_MAX]; AppLayerProtoDetectSupportedAppProtocols(alprotos); printf("=========Supported App Layer Protocols=========\n"); for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { if (alprotos[alproto] == 1) printf("%s\n", AppLayerGetProtoName(alproto)); } SCReturn; } /***** Setup/General Registration *****/ int AppLayerSetup(void) { SCEnter(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); AppLayerParserRegisterProtocolParsers(); AppLayerProtoDetectPrepareState(); AppLayerSetupCounters(); SCReturnInt(0); } int AppLayerDeSetup(void) { SCEnter(); AppLayerProtoDetectDeSetup(); AppLayerParserDeSetup(); AppLayerDeSetupCounters(); SCReturnInt(0); } AppLayerThreadCtx *AppLayerGetCtxThread(ThreadVars *tv) { SCEnter(); AppLayerThreadCtx *app_tctx = SCMalloc(sizeof(*app_tctx)); if (app_tctx == NULL) goto error; memset(app_tctx, 0, sizeof(*app_tctx)); if ((app_tctx->alpd_tctx = AppLayerProtoDetectGetCtxThread()) == NULL) goto error; if ((app_tctx->alp_tctx = AppLayerParserThreadCtxAlloc()) == NULL) goto error; goto done; error: AppLayerDestroyCtxThread(app_tctx); app_tctx = NULL; done: SCReturnPtr(app_tctx, "void *"); } void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx) { SCEnter(); if (app_tctx == NULL) SCReturn; if (app_tctx->alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(app_tctx->alpd_tctx); if (app_tctx->alp_tctx != NULL) AppLayerParserThreadCtxFree(app_tctx->alp_tctx); SCFree(app_tctx); SCReturn; } void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx) { PACKET_PROFILING_APP_RESET(app_tctx); } void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p) { PACKET_PROFILING_APP_STORE(app_tctx, p); } /** \brief HACK to work around our broken unix manager (re)init loop */ void AppLayerRegisterGlobalCounters(void) { StatsRegisterGlobalCounter("dns.memuse", DNSMemcapGetMemuseCounter); StatsRegisterGlobalCounter("dns.memcap_state", DNSMemcapGetMemcapStateCounter); StatsRegisterGlobalCounter("dns.memcap_global", DNSMemcapGetMemcapGlobalCounter); StatsRegisterGlobalCounter("http.memuse", HTPMemuseGlobalCounter); StatsRegisterGlobalCounter("http.memcap", HTPMemcapGlobalCounter); } #define IPPROTOS_MAX 2 void AppLayerSetupCounters() { uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP }; uint8_t ipproto; AppProto alproto; AppProto alprotos[ALPROTO_MAX]; const char *str = "app_layer.flow."; AppLayerProtoDetectSupportedAppProtocols(alprotos); for (ipproto = 0; ipproto < IPPROTOS_MAX; ipproto++) { uint8_t ipproto_map = FlowGetProtoMapping(ipprotos[ipproto]); uint8_t other_ipproto = (ipprotos[ipproto] == IPPROTO_TCP) ? IPPROTO_UDP : IPPROTO_TCP; const char *ipproto_suffix = (ipprotos[ipproto] == IPPROTO_TCP) ? "_tcp" : "_udp"; for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { if (alprotos[alproto] == 1) { const char *tx_str = "app_layer.tx."; const char *alproto_str = AppLayerGetProtoName(alproto); if (AppLayerParserProtoIsRegistered(ipprotos[ipproto], alproto) && AppLayerParserProtoIsRegistered(other_ipproto, alproto)) { snprintf(applayer_counter_names[ipproto_map][alproto].name, sizeof(applayer_counter_names[ipproto_map][alproto].name), "%s%s%s", str, alproto_str, ipproto_suffix); if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { snprintf(applayer_counter_names[ipproto_map][alproto].tx_name, sizeof(applayer_counter_names[ipproto_map][alproto].tx_name), "%s%s%s", tx_str, alproto_str, ipproto_suffix); } } else { snprintf(applayer_counter_names[ipproto_map][alproto].name, sizeof(applayer_counter_names[ipproto_map][alproto].name), "%s%s", str, alproto_str); if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { snprintf(applayer_counter_names[ipproto_map][alproto].tx_name, sizeof(applayer_counter_names[ipproto_map][alproto].tx_name), "%s%s", tx_str, alproto_str); } } } else if (alproto == ALPROTO_FAILED) { snprintf(applayer_counter_names[ipproto_map][alproto].name, sizeof(applayer_counter_names[ipproto_map][alproto].name), "%s%s%s", str, "failed", ipproto_suffix); } } } } void AppLayerRegisterThreadCounters(ThreadVars *tv) { uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP }; uint8_t ipproto; AppProto alproto; AppProto alprotos[ALPROTO_MAX]; AppLayerProtoDetectSupportedAppProtocols(alprotos); for (ipproto = 0; ipproto < IPPROTOS_MAX; ipproto++) { uint8_t ipproto_map = FlowGetProtoMapping(ipprotos[ipproto]); for (alproto = 0; alproto < ALPROTO_MAX; alproto++) { if (alprotos[alproto] == 1) { applayer_counters[ipproto_map][alproto].counter_id = StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv); if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { applayer_counters[ipproto_map][alproto].counter_tx_id = StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].tx_name, tv); } } else if (alproto == ALPROTO_FAILED) { applayer_counters[ipproto_map][alproto].counter_id = StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv); } } } } void AppLayerDeSetupCounters() { memset(applayer_counter_names, 0, sizeof(applayer_counter_names)); memset(applayer_counters, 0, sizeof(applayer_counters)); } /***** Unittests *****/ #ifdef UNITTESTS #include "pkt-var.h" #include "stream-tcp.h" #include "stream-tcp-util.h" #include "stream.h" #include "util-unittest.h" #define TEST_START \ Packet *p = SCMalloc(SIZE_OF_PACKET);\ FAIL_IF_NULL(p);\ Flow f;\ ThreadVars tv;\ StreamTcpThread *stt = NULL;\ TCPHdr tcph;\ PacketQueue pq;\ memset(&pq,0,sizeof(PacketQueue));\ memset(p, 0, SIZE_OF_PACKET);\ memset (&f, 0, sizeof(Flow));\ memset(&tv, 0, sizeof (ThreadVars));\ memset(&tcph, 0, sizeof (TCPHdr));\ \ FLOW_INITIALIZE(&f);\ f.flags = FLOW_IPV4;\ f.proto = IPPROTO_TCP;\ p->flow = &f;\ p->tcph = &tcph;\ \ StreamTcpInitConfig(TRUE);\ StreamTcpThreadInit(&tv, NULL, (void **)&stt);\ \ /* handshake */\ tcph.th_win = htons(5480);\ tcph.th_flags = TH_SYN;\ p->flowflags = FLOW_PKT_TOSERVER;\ p->payload_len = 0;\ p->payload = NULL;\ FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);\ TcpSession *ssn = (TcpSession *)f.protoctx;\ \ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server));\ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client));\ FAIL_IF(f.alproto != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN);\ FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED);\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(ssn->data_first_seen_dir != 0);\ \ /* handshake */\ p->tcph->th_ack = htonl(1);\ p->tcph->th_flags = TH_SYN | TH_ACK;\ p->flowflags = FLOW_PKT_TOCLIENT;\ p->payload_len = 0;\ p->payload = NULL;\ FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);\ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server));\ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client));\ FAIL_IF(f.alproto != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN);\ FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED);\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(ssn->data_first_seen_dir != 0);\ \ /* handshake */\ p->tcph->th_ack = htonl(1);\ p->tcph->th_seq = htonl(1);\ p->tcph->th_flags = TH_ACK;\ p->flowflags = FLOW_PKT_TOSERVER;\ p->payload_len = 0;\ p->payload = NULL;\ FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);\ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server));\ FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client));\ FAIL_IF(f.alproto != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN);\ FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN);\ FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED);\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));\ FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));\ FAIL_IF(ssn->data_first_seen_dir != 0); #define TEST_END \ StreamTcpSessionClear(p->flow->protoctx);\ StreamTcpThreadDeinit(&tv, (void *)stt); \ StreamTcpFreeConfig(TRUE);\ PACKET_DESTRUCTOR(p);\ SCFree(p);\ FLOW_DESTROY(&f); \ StatsThreadCleanup(&tv); /** * \test GET -> HTTP/1.1 */ static int AppLayerTest01(void) { TEST_START; /* full request */ uint8_t request[] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_HTTP); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test GE -> T -> HTTP/1.1 */ static int AppLayerTest02(void) { TEST_START; /* partial request */ uint8_t request1[] = { 0x47, 0x45, }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack against partial request */ p->tcph->th_ack = htonl(3); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* complete partial request */ uint8_t request2[] = { 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(3); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request2); p->payload = request2; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_HTTP); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test GET -> RUBBISH(PM AND PP DONE IN ONE GO) */ static int AppLayerTest03(void) { TEST_START; /* request */ uint8_t request[] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* rubbish response */ uint8_t response[] = { 0x58, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_FAILED); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test GE -> RUBBISH(TC - PM AND PP NOT DONE) -> RUBBISH(TC - PM AND PP DONE). */ static int AppLayerTest04(void) { TEST_START; /* request */ uint8_t request[] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; PrintRawDataFp(stdout, request, sizeof(request)); p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); // TOSERVER data now seen /* partial response */ uint8_t response1[] = { 0x58, 0x54, 0x54, 0x50, }; PrintRawDataFp(stdout, response1, sizeof(response1)); p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response1); p->payload = response1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); // toserver complete FAIL_IF(f.alproto != ALPROTO_HTTP); // http based on ts FAIL_IF(f.alproto_ts != ALPROTO_HTTP); // ts complete FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer /* partial response ack */ p->tcph->th_ack = htonl(5); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); // toserver complete FAIL_IF(f.alproto != ALPROTO_HTTP); // http based on ts FAIL_IF(f.alproto_ts != ALPROTO_HTTP); // ts complete FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer /* remaining response */ uint8_t response2[] = { 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; PrintRawDataFp(stdout, response2, sizeof(response2)); p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(5); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response2); p->payload = response2; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); // toserver complete FAIL_IF(f.alproto != ALPROTO_HTTP); // http based on ts FAIL_IF(f.alproto_ts != ALPROTO_HTTP); // ts complete FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); // toclient complete (failed) FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); // toserver complete FAIL_IF(f.alproto != ALPROTO_HTTP); // http based on ts FAIL_IF(f.alproto_ts != ALPROTO_HTTP); // ts complete FAIL_IF(f.alproto_tc != ALPROTO_FAILED); // tc failed FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer TEST_END; PASS; } /** * \test RUBBISH -> HTTP/1.1 */ static int AppLayerTest05(void) { TEST_START; /* full request */ uint8_t request[] = { 0x48, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; PrintRawDataFp(stdout, request, sizeof(request)); p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; PrintRawDataFp(stdout, response, sizeof(response)); p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_FAILED); FAIL_IF(f.alproto_tc != ALPROTO_HTTP); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test HTTP/1.1 -> GET */ static int AppLayerTest06(void) { TEST_START; /* full response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOCLIENT); /* full request - response ack*/ uint8_t request[] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_FAILED); FAIL_IF(f.alproto_ts != ALPROTO_FAILED); FAIL_IF(f.alproto_tc != ALPROTO_HTTP); FAIL_IF(!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test GET -> DCERPC */ static int AppLayerTest07(void) { TEST_START; /* full request */ uint8_t request[] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x05, 0x00, 0x4d, 0x42, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_HTTP); FAIL_IF(f.alproto_ts != ALPROTO_HTTP); FAIL_IF(f.alproto_tc != ALPROTO_DCERPC); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test SMB -> HTTP/1.1 */ static int AppLayerTest08(void) { TEST_START; /* full request */ uint8_t request[] = { 0x05, 0x00, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request); p->payload = request; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(88); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_DCERPC); FAIL_IF(f.alproto_ts != ALPROTO_DCERPC); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(88); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_DCERPC); FAIL_IF(f.alproto_ts != ALPROTO_DCERPC); FAIL_IF(f.alproto_tc != ALPROTO_HTTP); FAIL_IF(!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test RUBBISH(TC - PM and PP NOT DONE) -> * RUBBISH(TC - PM and PP DONE) -> * RUBBISH(TS - PM and PP DONE) */ static int AppLayerTest09(void) { TEST_START; /* full request */ uint8_t request1[] = { 0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64 }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response - request ack */ p->tcph->th_ack = htonl(9); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full request */ uint8_t request2[] = { 0x44, 0x44, 0x45, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(9); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request2); p->payload = request2; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(18); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_FAILED); FAIL_IF(f.alproto_ts != ALPROTO_FAILED); FAIL_IF(f.alproto_tc != ALPROTO_FAILED); FAIL_IF(!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test RUBBISH(TC - PM and PP DONE) -> * RUBBISH(TS - PM and PP DONE) */ static int AppLayerTest10(void) { TEST_START; /* full request */ uint8_t request1[] = { 0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response - request ack */ p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response[] = { 0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response); p->payload = response; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(18); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_FAILED); FAIL_IF(f.alproto_ts != ALPROTO_FAILED); FAIL_IF(f.alproto_tc != ALPROTO_FAILED); FAIL_IF(!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } /** * \test RUBBISH(TC - PM and PP DONE) -> * RUBBISH(TS - PM and PP NOT DONE) -> * RUBBISH(TS - PM and PP DONE) */ static int AppLayerTest11(void) { TEST_START; /* full request */ uint8_t request1[] = { 0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff }; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = sizeof(request1); p->payload = request1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response - request ack */ p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* full response - request ack */ uint8_t response1[] = { 0x55, 0x74, 0x54, 0x50, }; p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response1); p->payload = response1; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack from request */ p->tcph->th_ack = htonl(5); p->tcph->th_seq = htonl(18); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); uint8_t response2[] = { 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32, 0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31, 0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e }; p->tcph->th_ack = htonl(18); p->tcph->th_seq = htonl(5); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; p->payload_len = sizeof(response2); p->payload = response2; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); FAIL_IF(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); /* response ack from request */ p->tcph->th_ack = htonl(328); p->tcph->th_seq = htonl(18); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; p->payload_len = 0; p->payload = NULL; FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); FAIL_IF(f.alproto != ALPROTO_FAILED); FAIL_IF(f.alproto_ts != ALPROTO_FAILED); FAIL_IF(f.alproto_tc != ALPROTO_FAILED); FAIL_IF(!(ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); TEST_END; PASS; } void AppLayerUnittestsRegister(void) { SCEnter(); UtRegisterTest("AppLayerTest01", AppLayerTest01); UtRegisterTest("AppLayerTest02", AppLayerTest02); UtRegisterTest("AppLayerTest03", AppLayerTest03); UtRegisterTest("AppLayerTest04", AppLayerTest04); UtRegisterTest("AppLayerTest05", AppLayerTest05); UtRegisterTest("AppLayerTest06", AppLayerTest06); UtRegisterTest("AppLayerTest07", AppLayerTest07); UtRegisterTest("AppLayerTest08", AppLayerTest08); UtRegisterTest("AppLayerTest09", AppLayerTest09); UtRegisterTest("AppLayerTest10", AppLayerTest10); UtRegisterTest("AppLayerTest11", AppLayerTest11); SCReturn; } #endif /* UNITTESTS */ suricata-3.2.1/src/app-layer-dns-tcp.c0000644000000000000000000007273213051004444014420 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "decode.h" #include "flow-util.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-debug.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "util-spm.h" #include "util-unittest.h" #include "app-layer-dns-tcp.h" struct DNSTcpHeader_ { uint16_t len; uint16_t tx_id; uint16_t flags; uint16_t questions; uint16_t answer_rr; uint16_t authority_rr; uint16_t additional_rr; } __attribute__((__packed__)); typedef struct DNSTcpHeader_ DNSTcpHeader; /** \internal * \param input_len at least enough for the DNSTcpHeader */ static int DNSTCPRequestParseProbe(uint8_t *input, uint32_t input_len) { #ifdef DEBUG BUG_ON(input_len < sizeof(DNSTcpHeader)); #endif SCLogDebug("starting %u", input_len); DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input; if (ntohs(dns_tcp_header->len) < sizeof(DNSHeader)) { goto bad_data; } if (ntohs(dns_tcp_header->len) >= input_len) { goto insufficient_data; } input += 2; input_len -= 2; DNSHeader *dns_header = (DNSHeader *)input; uint16_t q; const uint8_t *data = input + sizeof(DNSHeader); for (q = 0; q < ntohs(dns_header->questions); q++) { uint16_t fqdn_offset = 0; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len field"); goto insufficient_data; } SCLogDebug("query length %u", *data); while (*data != 0) { if (*data > 63) { /** \todo set event?*/ goto bad_data; } uint8_t length = *data; data++; if (length > 0) { if (input + input_len < data + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, data, qry->length); if ((fqdn_offset + length + 1) < DNS_MAX_SIZE) { fqdn_offset += length; } else { /** \todo set event? */ goto bad_data; } } data += length; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for new len"); goto insufficient_data; } SCLogDebug("qry length %u", *data); } if (fqdn_offset) { fqdn_offset--; } data++; if (input + input_len < data + sizeof(DNSQueryTrailer)) { SCLogDebug("input buffer too small for DNSQueryTrailer"); goto insufficient_data; } #ifdef DEBUG DNSQueryTrailer *trailer = (DNSQueryTrailer *)data; SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class)); #endif data += sizeof(DNSQueryTrailer); } SCReturnInt(1); insufficient_data: SCReturnInt(0); bad_data: SCReturnInt(-1); } static int BufferData(DNSState *dns_state, uint8_t *data, uint16_t len) { if (dns_state->buffer == NULL) { if (DNSCheckMemcap(0xffff, dns_state) < 0) return -1; /** \todo be smarter about this, like use a pool or several pools for * chunks of various sizes */ dns_state->buffer = SCMalloc(0xffff); if (dns_state->buffer == NULL) { return -1; } DNSIncrMemcap(0xffff, dns_state); } if ((uint32_t)len + (uint32_t)dns_state->offset > (uint32_t)dns_state->record_len) { SCLogDebug("oh my, we have more data than the max record size. What do we do. WHAT DO WE DOOOOO!"); #ifdef DEBUG BUG_ON(1); #endif len = dns_state->record_len - dns_state->offset; } memcpy(dns_state->buffer + dns_state->offset, data, len); dns_state->offset += len; return 0; } static void BufferReset(DNSState *dns_state) { dns_state->record_len = 0; dns_state->offset = 0; } static int DNSRequestParseData(Flow *f, DNSState *dns_state, const uint8_t *input, const uint32_t input_len) { DNSHeader *dns_header = (DNSHeader *)input; if (DNSValidateRequestHeader(dns_state, dns_header) < 0) goto bad_data; //SCLogInfo("ID %04x", ntohs(dns_header->tx_id)); uint16_t q; const uint8_t *data = input + sizeof(DNSHeader); //PrintRawDataFp(stdout, (uint8_t*)data, input_len - (data - input)); if (dns_state != NULL) { if (timercmp(&dns_state->last_req, &dns_state->last_resp, >=)) { if (dns_state->window <= dns_state->unreplied_cnt) { dns_state->window++; } } } for (q = 0; q < ntohs(dns_header->questions); q++) { uint8_t fqdn[DNS_MAX_SIZE]; uint16_t fqdn_offset = 0; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for DNSTcpQuery"); goto insufficient_data; } SCLogDebug("query length %u", *data); while (*data != 0) { if (*data > 63) { /** \todo set event?*/ goto insufficient_data; } uint8_t length = *data; data++; if (length > 0) { if (input + input_len < data + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, data, qry->length); if ((size_t)(fqdn_offset + length + 1) < sizeof(fqdn)) { memcpy(fqdn + fqdn_offset, data, length); fqdn_offset += length; fqdn[fqdn_offset++] = '.'; } else { /** \todo set event? */ goto insufficient_data; } } data += length; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for DNSTcpQuery(2)"); goto insufficient_data; } SCLogDebug("qry length %u", *data); } if (fqdn_offset) { fqdn_offset--; } data++; if (input + input_len < data + sizeof(DNSQueryTrailer)) { SCLogDebug("input buffer too small for DNSQueryTrailer"); goto insufficient_data; } DNSQueryTrailer *trailer = (DNSQueryTrailer *)data; SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class)); data += sizeof(DNSQueryTrailer); /* store our data */ if (dns_state != NULL) { DNSStoreQueryInState(dns_state, fqdn, fqdn_offset, ntohs(trailer->type), ntohs(trailer->class), ntohs(dns_header->tx_id)); } } SCReturnInt(1); bad_data: insufficient_data: SCReturnInt(-1); } /** \internal * \brief Parse DNS request packet */ static int DNSTCPRequestParse(Flow *f, void *dstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { DNSState *dns_state = (DNSState *)dstate; SCLogDebug("starting %u", input_len); if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } /** \todo remove this when PP is fixed to enforce ipproto */ if (f != NULL && f->proto != IPPROTO_TCP) SCReturnInt(-1); /* probably a rst/fin sending an eof */ if (input == NULL || input_len == 0) { goto insufficient_data; } next_record: /* if this is the beginning of a record, we need at least the header */ if (dns_state->offset == 0 && input_len < sizeof(DNSTcpHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSTcpHeader)); goto insufficient_data; } SCLogDebug("input_len %u offset %u record %u", input_len, dns_state->offset, dns_state->record_len); /* this is the first data of this record */ if (dns_state->offset == 0) { DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input; SCLogDebug("DNS %p", dns_tcp_header); if (ntohs(dns_tcp_header->len) < sizeof(DNSHeader)) { /* bogus len, doesn't fit even basic dns header */ goto bad_data; } else if (ntohs(dns_tcp_header->len) == (input_len-2)) { /* we have all data, so process w/o buffering */ if (DNSRequestParseData(f, dns_state, input+2, input_len-2) < 0) goto bad_data; } else if ((input_len-2) > ntohs(dns_tcp_header->len)) { /* we have all data, so process w/o buffering */ if (DNSRequestParseData(f, dns_state, input+2, ntohs(dns_tcp_header->len)) < 0) goto bad_data; /* treat the rest of the data as a (potential) new record */ input += (2 + ntohs(dns_tcp_header->len)); input_len -= (2 + ntohs(dns_tcp_header->len)); goto next_record; } else { /* not enough data, store record length and buffer */ dns_state->record_len = ntohs(dns_tcp_header->len); BufferData(dns_state, input+2, input_len-2); } } else if (input_len + dns_state->offset < dns_state->record_len) { /* we don't have the full record yet, buffer */ BufferData(dns_state, input, input_len); } else if (input_len > (uint32_t)(dns_state->record_len - dns_state->offset)) { /* more data than expected, we may have another record coming up */ uint16_t need = (dns_state->record_len - dns_state->offset); BufferData(dns_state, input, need); int r = DNSRequestParseData(f, dns_state, dns_state->buffer, dns_state->record_len); BufferReset(dns_state); if (r < 0) goto bad_data; /* treat the rest of the data as a (potential) new record */ input += need; input_len -= need; goto next_record; } else { /* implied exactly the amount of data we want * add current to buffer, then inspect buffer */ BufferData(dns_state, input, input_len); int r = DNSRequestParseData(f, dns_state, dns_state->buffer, dns_state->record_len); BufferReset(dns_state); if (r < 0) goto bad_data; } if (f != NULL) { dns_state->last_req = f->lastts; } SCReturnInt(1); insufficient_data: SCReturnInt(-1); bad_data: SCReturnInt(-1); } static int DNSReponseParseData(Flow *f, DNSState *dns_state, const uint8_t *input, const uint32_t input_len) { DNSHeader *dns_header = (DNSHeader *)input; if (DNSValidateResponseHeader(dns_state, dns_header) < 0) goto bad_data; DNSTransaction *tx = NULL; int found = 0; if ((tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id))) != NULL) found = 1; if (!found) { SCLogDebug("DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE"); DNSSetEvent(dns_state, DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE); } else if (dns_state->unreplied_cnt > 0) { dns_state->unreplied_cnt--; } uint16_t q; const uint8_t *data = input + sizeof(DNSHeader); for (q = 0; q < ntohs(dns_header->questions); q++) { uint8_t fqdn[DNS_MAX_SIZE]; uint16_t fqdn_offset = 0; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len field"); goto insufficient_data; } SCLogDebug("qry length %u", *data); while (*data != 0) { uint8_t length = *data; data++; if (length > 0) { if (input + input_len < data + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, data, length); if ((size_t)(fqdn_offset + length + 1) < sizeof(fqdn)) { memcpy(fqdn + fqdn_offset, data, length); fqdn_offset += length; fqdn[fqdn_offset++] = '.'; } } data += length; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len field"); goto insufficient_data; } SCLogDebug("length %u", *data); } if (fqdn_offset) { fqdn_offset--; } data++; if (input + input_len < data + sizeof(DNSQueryTrailer)) { SCLogDebug("input buffer too small for DNSQueryTrailer"); goto insufficient_data; } #if DEBUG DNSQueryTrailer *trailer = (DNSQueryTrailer *)data; SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class)); #endif data += sizeof(DNSQueryTrailer); } for (q = 0; q < ntohs(dns_header->answer_rr); q++) { data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_ANSWER, input, input_len, data); if (data == NULL) { goto insufficient_data; } } //PrintRawDataFp(stdout, (uint8_t *)data, input_len - (data - input)); for (q = 0; q < ntohs(dns_header->authority_rr); q++) { data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_AUTHORITY, input, input_len, data); if (data == NULL) { goto insufficient_data; } } /* parse rcode, e.g. "noerror" or "nxdomain" */ uint8_t rcode = ntohs(dns_header->flags) & 0x0F; if (rcode <= DNS_RCODE_NOTZONE) { SCLogDebug("rcode %u", rcode); if (tx != NULL) tx->rcode = rcode; } else { /* this is not invalid, rcodes can be user defined */ SCLogDebug("unexpected DNS rcode %u", rcode); } if (ntohs(dns_header->flags) & 0x0080) { SCLogDebug("recursion desired"); if (tx != NULL) tx->recursion_desired = 1; } if (tx != NULL) { tx->replied = 1; } SCReturnInt(1); bad_data: insufficient_data: SCReturnInt(-1); } /** \internal * \brief DNS TCP record parser, entry function * * Parses a DNS TCP record and fills the DNS state * * As TCP records can be 64k we'll have to buffer the data. Streaming parsing * would have been _very_ tricky due to the way names are compressed in DNS * */ static int DNSTCPResponseParse(Flow *f, void *dstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { DNSState *dns_state = (DNSState *)dstate; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } /** \todo remove this when PP is fixed to enforce ipproto */ if (f != NULL && f->proto != IPPROTO_TCP) SCReturnInt(-1); /* probably a rst/fin sending an eof */ if (input == NULL || input_len == 0) { goto insufficient_data; } next_record: /* if this is the beginning of a record, we need at least the header */ if (dns_state->offset == 0 && input_len < sizeof(DNSTcpHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSTcpHeader)); goto insufficient_data; } SCLogDebug("input_len %u offset %u record %u", input_len, dns_state->offset, dns_state->record_len); /* this is the first data of this record */ if (dns_state->offset == 0) { DNSTcpHeader *dns_tcp_header = (DNSTcpHeader *)input; SCLogDebug("DNS %p", dns_tcp_header); if (ntohs(dns_tcp_header->len) == 0) { goto bad_data; } else if (ntohs(dns_tcp_header->len) == (input_len-2)) { /* we have all data, so process w/o buffering */ if (DNSReponseParseData(f, dns_state, input+2, input_len-2) < 0) goto bad_data; } else if ((input_len-2) > ntohs(dns_tcp_header->len)) { /* we have all data, so process w/o buffering */ if (DNSReponseParseData(f, dns_state, input+2, ntohs(dns_tcp_header->len)) < 0) goto bad_data; /* treat the rest of the data as a (potential) new record */ input += (2 + ntohs(dns_tcp_header->len)); input_len -= (2 + ntohs(dns_tcp_header->len)); goto next_record; } else { /* not enough data, store record length and buffer */ dns_state->record_len = ntohs(dns_tcp_header->len); BufferData(dns_state, input+2, input_len-2); } } else if (input_len + dns_state->offset < dns_state->record_len) { /* we don't have the full record yet, buffer */ BufferData(dns_state, input, input_len); } else if (input_len > (uint32_t)(dns_state->record_len - dns_state->offset)) { /* more data than expected, we may have another record coming up */ uint16_t need = (dns_state->record_len - dns_state->offset); BufferData(dns_state, input, need); int r = DNSReponseParseData(f, dns_state, dns_state->buffer, dns_state->record_len); BufferReset(dns_state); if (r < 0) goto bad_data; /* treat the rest of the data as a (potential) new record */ input += need; input_len -= need; goto next_record; } else { /* implied exactly the amount of data we want * add current to buffer, then inspect buffer */ BufferData(dns_state, input, input_len); int r = DNSReponseParseData(f, dns_state, dns_state->buffer, dns_state->record_len); BufferReset(dns_state); if (r < 0) goto bad_data; } if (f != NULL) { dns_state->last_req = f->lastts; } SCReturnInt(1); insufficient_data: SCReturnInt(-1); bad_data: SCReturnInt(-1); } static uint16_t DNSTcpProbingParser(uint8_t *input, uint32_t ilen, uint32_t *offset) { if (ilen == 0 || ilen < sizeof(DNSTcpHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSTcpHeader)); return ALPROTO_UNKNOWN; } DNSTcpHeader *dns_header = (DNSTcpHeader *)input; if (ntohs(dns_header->len) < sizeof(DNSHeader)) { /* length field bogus, won't even fit a minimal DNS header. */ return ALPROTO_FAILED; } else if (ntohs(dns_header->len) > ilen) { int r = DNSTCPRequestParseProbe(input, ilen); if (r == -1) { /* probing parser told us "bad data", so it's not * DNS */ return ALPROTO_FAILED; } else if (ilen > 512) { SCLogDebug("all the parser told us was not enough data, which is expected. Lets assume it's DNS"); return ALPROTO_DNS; } SCLogDebug("not yet enough info %u > %u", ntohs(dns_header->len), ilen); return ALPROTO_UNKNOWN; } int r = DNSTCPRequestParseProbe(input, ilen); if (r != 1) return ALPROTO_FAILED; SCLogDebug("ALPROTO_DNS"); return ALPROTO_DNS; } /** * \brief Probing parser for TCP DNS responses. * * This is a minimal parser that just checks that the input contains enough * data for a TCP DNS response. */ static uint16_t DNSTcpProbeResponse(uint8_t *input, uint32_t len, uint32_t *offset) { if (len == 0 || len < sizeof(DNSTcpHeader)) { return ALPROTO_UNKNOWN; } DNSTcpHeader *dns_header = (DNSTcpHeader *)input; if (ntohs(dns_header->len) < sizeof(DNSHeader)) { return ALPROTO_FAILED; } return ALPROTO_DNS; } void RegisterDNSTCPParsers(void) { char *proto_name = "dns"; /** DNS */ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_DNS, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, "53", ALPROTO_DNS, 0, sizeof(DNSTcpHeader), STREAM_TOSERVER, DNSTcpProbingParser, NULL); } else { int have_cfg = AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_DNS, 0, sizeof(DNSTcpHeader), DNSTcpProbingParser, DNSTcpProbeResponse); /* if we have no config, we enable the default port 53 */ if (!have_cfg) { SCLogWarning(SC_ERR_DNS_CONFIG, "no DNS TCP config found, " "enabling DNS detection on " "port 53."); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "53", ALPROTO_DNS, 0, sizeof(DNSTcpHeader), STREAM_TOSERVER, DNSTcpProbingParser, DNSTcpProbeResponse); } } } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DNS, STREAM_TOSERVER, DNSTCPRequestParse); AppLayerParserRegisterParser(IPPROTO_TCP , ALPROTO_DNS, STREAM_TOCLIENT, DNSTCPResponseParse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DNS, DNSStateAlloc, DNSStateFree); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_DNS, DNSStateTransactionFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_DNS, DNSGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_DNS, DNSHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_DNS, DNSStateHasTxDetectState, DNSGetTxDetectState, DNSSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_DNS, DNSGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_DNS, DNSGetTxCnt); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_DNS, DNSGetTxLogged, DNSSetTxLogged); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_DNS, DNSGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_DNS, DNSGetAlstateProgressCompletionStatus); DNSAppLayerRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_DNS); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_DNS, DNSTCPParserRegisterTests); #endif return; } /* UNITTESTS */ #ifdef UNITTESTS #include "util-unittest-helper.h" static int DNSTCPParserTestMultiRecord(void) { /* This is a buffer containing 20 DNS requests each prefixed by * the request length for transport over TCP. It was generated with Scapy, * where each request is: * DNS(id=i, rd=1, qd=DNSQR(qname="%d.google.com" % i, qtype="A")) * where i is 0 to 19. */ uint8_t req[] = { 0x00, 0x1e, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x30, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x31, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x02, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x32, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x03, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x33, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x04, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x05, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x35, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x06, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x36, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x07, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x37, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x08, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x38, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x09, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x39, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x30, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0b, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x31, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0c, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x32, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0d, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x33, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0e, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x0f, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x35, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x10, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x36, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x11, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x37, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x12, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x38, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x1f, 0x00, 0x13, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x39, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01 }; size_t reqlen = sizeof(req); DNSState *state = DNSStateAlloc(); FAIL_IF_NULL(state); Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_TCP; f->alproto = ALPROTO_DNS; f->alstate = state; FAIL_IF_NOT(DNSTCPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF(state->transaction_max != 20); UTHFreeFlow(f); PASS; } void DNSTCPParserRegisterTests(void) { UtRegisterTest("DNSTCPParserTestMultiRecord", DNSTCPParserTestMultiRecord); } #endif /* UNITTESTS */ suricata-3.2.1/src/util-streaming-buffer.c0000644000000000000000000006002613051004444015364 00000000000000/* Copyright (C) 2015-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "util-streaming-buffer.h" #include "util-unittest.h" #include "util-print.h" /** * \file * * \author Victor Julien * * \brief Streaming Buffer API */ /* memory handling wrappers. If config doesn't define it's own set of * functions, use the defaults */ #define MALLOC(cfg, s) \ (cfg)->Malloc ? (cfg)->Malloc((s)) : SCMalloc((s)) #define CALLOC(cfg, n, s) \ (cfg)->Calloc ? (cfg)->Calloc((n), (s)) : SCCalloc((n), (s)) #define REALLOC(cfg, ptr, orig_s, s) \ (cfg)->Realloc ? (cfg)->Realloc((ptr), (orig_s), (s)) : SCRealloc((ptr), (s)) #define FREE(cfg, ptr, s) \ (cfg)->Free ? (cfg)->Free((ptr), (s)) : SCFree((ptr)) static inline int InitBuffer(StreamingBuffer *sb) { sb->buf = CALLOC(sb->cfg, 1, sb->cfg->buf_size); if (sb->buf == NULL) { return -1; } sb->buf_size = sb->cfg->buf_size; return 0; } StreamingBuffer *StreamingBufferInit(const StreamingBufferConfig *cfg) { StreamingBuffer *sb = CALLOC(cfg, 1, sizeof(StreamingBuffer)); if (sb != NULL) { sb->buf_size = cfg->buf_size; sb->cfg = cfg; if (cfg->buf_size > 0) { if (InitBuffer(sb) == 0) { return sb; } FREE(cfg, sb, sizeof(StreamingBuffer)); /* implied buf_size == 0 */ } else { return sb; } } return NULL; } void StreamingBufferClear(StreamingBuffer *sb) { if (sb != NULL) { SCLogDebug("sb->buf_size %u max %u", sb->buf_size, sb->buf_size_max); if (sb->buf != NULL) { FREE(sb->cfg, sb->buf, sb->buf_size); sb->buf = NULL; } } } void StreamingBufferFree(StreamingBuffer *sb) { if (sb != NULL) { StreamingBufferClear(sb); FREE(sb->cfg, sb, sizeof(StreamingBuffer)); } } /** * \internal * \brief move buffer forward by 'slide' */ static void AutoSlide(StreamingBuffer *sb) { uint32_t size = sb->cfg->buf_slide; uint32_t slide = sb->buf_offset - size; SCLogDebug("sliding %u forward, size of original buffer left after slide %u", slide, size); memmove(sb->buf, sb->buf+slide, size); sb->stream_offset += slide; sb->buf_offset = size; } static int __attribute__((warn_unused_result)) GrowToSize(StreamingBuffer *sb, uint32_t size) { /* try to grow in multiples of sb->cfg->buf_size */ uint32_t x = sb->cfg->buf_size ? size % sb->cfg->buf_size : 0; uint32_t base = size - x; uint32_t grow = base + sb->cfg->buf_size; void *ptr = REALLOC(sb->cfg, sb->buf, sb->buf_size, grow); if (ptr == NULL) return -1; /* for safe printing and general caution, lets memset the * new data to 0 */ size_t diff = grow - sb->buf_size; void *new_mem = ((char *)ptr) + sb->buf_size; memset(new_mem, 0, diff); sb->buf = ptr; sb->buf_size = grow; SCLogDebug("grown buffer to %u", grow); #ifdef DEBUG if (sb->buf_size > sb->buf_size_max) { sb->buf_size_max = sb->buf_size; } #endif return 0; } /** \internal * \brief try to double the buffer size * \retval 0 ok * \retval -1 failed, buffer unchanged */ static int __attribute__((warn_unused_result)) Grow(StreamingBuffer *sb) { uint32_t grow = sb->buf_size * 2; void *ptr = REALLOC(sb->cfg, sb->buf, sb->buf_size, grow); if (ptr == NULL) return -1; /* for safe printing and general caution, lets memset the * new data to 0 */ size_t diff = grow - sb->buf_size; void *new_mem = ((char *)ptr) + sb->buf_size; memset(new_mem, 0, diff); sb->buf = ptr; sb->buf_size = grow; SCLogDebug("grown buffer to %u", grow); #ifdef DEBUG if (sb->buf_size > sb->buf_size_max) { sb->buf_size_max = sb->buf_size; } #endif return 0; } /** * \brief slide to absolute offset * \todo if sliding beyond window, we could perhaps reset? */ void StreamingBufferSlideToOffset(StreamingBuffer *sb, uint64_t offset) { if (offset > sb->stream_offset && offset <= sb->stream_offset + sb->buf_offset) { uint32_t slide = offset - sb->stream_offset; uint32_t size = sb->buf_offset - slide; SCLogDebug("sliding %u forward, size of original buffer left after slide %u", slide, size); memmove(sb->buf, sb->buf+slide, size); sb->stream_offset += slide; sb->buf_offset = size; } } void StreamingBufferSlide(StreamingBuffer *sb, uint32_t slide) { uint32_t size = sb->buf_offset - slide; SCLogDebug("sliding %u forward, size of original buffer left after slide %u", slide, size); memmove(sb->buf, sb->buf+slide, size); sb->stream_offset += slide; sb->buf_offset = size; } #define DATA_FITS(sb, len) \ ((sb)->buf_offset + (len) <= (sb)->buf_size) StreamingBufferSegment *StreamingBufferAppendRaw(StreamingBuffer *sb, const uint8_t *data, uint32_t data_len) { if (sb->buf == NULL) { if (InitBuffer(sb) == -1) return NULL; } if (!DATA_FITS(sb, data_len)) { if (sb->cfg->flags & STREAMING_BUFFER_AUTOSLIDE) AutoSlide(sb); if (sb->buf_size == 0) { if (GrowToSize(sb, data_len) != 0) return NULL; } else { while (!DATA_FITS(sb, data_len)) { if (Grow(sb) != 0) { return NULL; } } } } if (!DATA_FITS(sb, data_len)) { return NULL; } StreamingBufferSegment *seg = CALLOC(sb->cfg, 1, sizeof(StreamingBufferSegment)); if (seg != NULL) { memcpy(sb->buf + sb->buf_offset, data, data_len); seg->stream_offset = sb->stream_offset + sb->buf_offset; seg->segment_len = data_len; sb->buf_offset += data_len; return seg; } return NULL; } int StreamingBufferAppend(StreamingBuffer *sb, StreamingBufferSegment *seg, const uint8_t *data, uint32_t data_len) { BUG_ON(seg == NULL); if (sb->buf == NULL) { if (InitBuffer(sb) == -1) return -1; } if (!DATA_FITS(sb, data_len)) { if (sb->cfg->flags & STREAMING_BUFFER_AUTOSLIDE) AutoSlide(sb); if (sb->buf_size == 0) { if (GrowToSize(sb, data_len) != 0) return -1; } else { while (!DATA_FITS(sb, data_len)) { if (Grow(sb) != 0) { return -1; } } } } if (!DATA_FITS(sb, data_len)) { return -1; } memcpy(sb->buf + sb->buf_offset, data, data_len); seg->stream_offset = sb->stream_offset + sb->buf_offset; seg->segment_len = data_len; sb->buf_offset += data_len; return 0; } /** * \brief add data w/o tracking a segment */ int StreamingBufferAppendNoTrack(StreamingBuffer *sb, const uint8_t *data, uint32_t data_len) { if (sb->buf == NULL) { if (InitBuffer(sb) == -1) return -1; } if (!DATA_FITS(sb, data_len)) { if (sb->cfg->flags & STREAMING_BUFFER_AUTOSLIDE) AutoSlide(sb); if (sb->buf_size == 0) { if (GrowToSize(sb, data_len) != 0) return -1; } else { while (!DATA_FITS(sb, data_len)) { if (Grow(sb) != 0) { return -1; } } } } if (!DATA_FITS(sb, data_len)) { return -1; } memcpy(sb->buf + sb->buf_offset, data, data_len); sb->buf_offset += data_len; return 0; } #define DATA_FITS_AT_OFFSET(sb, len, offset) \ ((offset) + (len) <= (sb)->buf_size) /** * \param offset offset relative to StreamingBuffer::stream_offset */ int StreamingBufferInsertAt(StreamingBuffer *sb, StreamingBufferSegment *seg, const uint8_t *data, uint32_t data_len, uint64_t offset) { BUG_ON(seg == NULL); if (offset < sb->stream_offset) return -1; if (sb->buf == NULL) { if (InitBuffer(sb) == -1) return -1; } uint32_t rel_offset = offset - sb->stream_offset; if (!DATA_FITS_AT_OFFSET(sb, data_len, rel_offset)) { if (sb->cfg->flags & STREAMING_BUFFER_AUTOSLIDE) { AutoSlide(sb); rel_offset = offset - sb->stream_offset; } if (!DATA_FITS_AT_OFFSET(sb, data_len, rel_offset)) { if (GrowToSize(sb, (rel_offset + data_len)) != 0) return -1; } } BUG_ON(!DATA_FITS_AT_OFFSET(sb, data_len, rel_offset)); memcpy(sb->buf + rel_offset, data, data_len); seg->stream_offset = offset; seg->segment_len = data_len; if (rel_offset + data_len > sb->buf_offset) sb->buf_offset = rel_offset + data_len; return 0; } int StreamingBufferSegmentIsBeforeWindow(const StreamingBuffer *sb, const StreamingBufferSegment *seg) { if (seg->stream_offset < sb->stream_offset) { if (seg->stream_offset + seg->segment_len <= sb->stream_offset) { return 1; } } return 0; } void StreamingBufferSegmentGetData(const StreamingBuffer *sb, const StreamingBufferSegment *seg, const uint8_t **data, uint32_t *data_len) { if (seg->stream_offset >= sb->stream_offset) { uint64_t offset = seg->stream_offset - sb->stream_offset; *data = sb->buf + offset; if (offset + seg->segment_len > sb->buf_size) *data_len = sb->buf_size - offset; else *data_len = seg->segment_len; return; } else { uint64_t offset = sb->stream_offset - seg->stream_offset; if (offset < seg->segment_len) { *data = sb->buf; *data_len = seg->segment_len - offset; return; } } *data = NULL; *data_len = 0; return; } /** * \retval 1 data is the same * \retval 0 data is different */ int StreamingBufferSegmentCompareRawData(const StreamingBuffer *sb, const StreamingBufferSegment *seg, const uint8_t *rawdata, uint32_t rawdata_len) { const uint8_t *segdata = NULL; uint32_t segdata_len = 0; StreamingBufferSegmentGetData(sb, seg, &segdata, &segdata_len); if (segdata && segdata_len && segdata_len == rawdata_len && memcmp(segdata, rawdata, segdata_len) == 0) { return 1; } return 0; } int StreamingBufferGetData(const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t *stream_offset) { if (sb != NULL && sb->buf != NULL) { *data = sb->buf; *data_len = sb->buf_offset; *stream_offset = sb->stream_offset; return 1; } else { *data = NULL; *data_len = 0; *stream_offset = 0; return 0; } } int StreamingBufferGetDataAtOffset (const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t offset) { if (sb != NULL && sb->buf != NULL && offset >= sb->stream_offset && offset < (sb->stream_offset + sb->buf_offset)) { uint32_t skip = offset - sb->stream_offset; *data = sb->buf + skip; *data_len = sb->buf_offset - skip; return 1; } else { *data = NULL; *data_len = 0; return 0; } } /** * \retval 1 data is the same * \retval 0 data is different */ int StreamingBufferCompareRawData(const StreamingBuffer *sb, const uint8_t *rawdata, uint32_t rawdata_len) { const uint8_t *sbdata = NULL; uint32_t sbdata_len = 0; uint64_t offset = 0; StreamingBufferGetData(sb, &sbdata, &sbdata_len, &offset); if (offset == 0 && sbdata && sbdata_len && sbdata_len == rawdata_len && memcmp(sbdata, rawdata, sbdata_len) == 0) { return 1; } SCLogInfo("sbdata_len %u, offset %u", sbdata_len, (uint)offset); PrintRawDataFp(stdout, sbdata,sbdata_len); return 0; } void Dump(StreamingBuffer *sb) { PrintRawDataFp(stdout, sb->buf, sb->buf_offset); } void DumpSegment(StreamingBuffer *sb, StreamingBufferSegment *seg) { const uint8_t *data = NULL; uint32_t data_len = 0; StreamingBufferSegmentGetData(sb, seg, &data, &data_len); if (data && data_len) { PrintRawDataFp(stdout, data, data_len); } } #ifdef UNITTESTS static int StreamingBufferTest01(void) { StreamingBufferConfig cfg = { STREAMING_BUFFER_AUTOSLIDE, 8, 16, NULL, NULL, NULL, NULL }; StreamingBuffer *sb = StreamingBufferInit(&cfg); FAIL_IF(sb == NULL); StreamingBufferSegment *seg1 = StreamingBufferAppendRaw(sb, (const uint8_t *)"ABCDEFGH", 8); StreamingBufferSegment *seg2 = StreamingBufferAppendRaw(sb, (const uint8_t *)"01234567", 8); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 16); FAIL_IF(seg1->stream_offset != 0); FAIL_IF(seg2->stream_offset != 8); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg2)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg1,(const uint8_t *)"ABCDEFGH", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg2,(const uint8_t *)"01234567", 8)); Dump(sb); StreamingBufferSegment *seg3 = StreamingBufferAppendRaw(sb, (const uint8_t *)"QWERTY", 6); FAIL_IF(sb->stream_offset != 8); FAIL_IF(sb->buf_offset != 14); FAIL_IF(seg3->stream_offset != 16); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg3)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg3,(const uint8_t *)"QWERTY", 6)); Dump(sb); StreamingBufferSegment *seg4 = StreamingBufferAppendRaw(sb, (const uint8_t *)"KLM", 3); FAIL_IF(sb->stream_offset != 14); FAIL_IF(sb->buf_offset != 11); FAIL_IF(seg4->stream_offset != 22); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg3)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg4)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg4,(const uint8_t *)"KLM", 3)); Dump(sb); StreamingBufferSegment *seg5 = StreamingBufferAppendRaw(sb, (const uint8_t *)"!@#$%^&*()_+<>?/,.;:'[]{}-=", 27); FAIL_IF(sb->stream_offset != 17); FAIL_IF(sb->buf_offset != 35); FAIL_IF(seg5->stream_offset != 25); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg1)); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg3)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg4)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg5)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg5,(const uint8_t *)"!@#$%^&*()_+<>?/,.;:'[]{}-=", 27)); Dump(sb); StreamingBufferSegment *seg6 = StreamingBufferAppendRaw(sb, (const uint8_t *)"UVWXYZ", 6); FAIL_IF(sb->stream_offset != 17); FAIL_IF(sb->buf_offset != 41); FAIL_IF(seg6->stream_offset != 52); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg1)); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg3)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg4)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg5)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,seg6)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,seg6,(const uint8_t *)"UVWXYZ", 6)); Dump(sb); SCFree(seg1); SCFree(seg2); SCFree(seg3); SCFree(seg4); SCFree(seg5); SCFree(seg6); StreamingBufferFree(sb); PASS; } static int StreamingBufferTest02(void) { StreamingBufferConfig cfg = { 0, 8, 24, NULL, NULL, NULL, NULL }; StreamingBuffer *sb = StreamingBufferInit(&cfg); FAIL_IF(sb == NULL); StreamingBufferSegment seg1; FAIL_IF(StreamingBufferAppend(sb, &seg1, (const uint8_t *)"ABCDEFGH", 8) != 0); StreamingBufferSegment seg2; FAIL_IF(StreamingBufferAppend(sb, &seg2, (const uint8_t *)"01234567", 8) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 16); FAIL_IF(seg1.stream_offset != 0); FAIL_IF(seg2.stream_offset != 8); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); StreamingBufferSlide(sb, 6); StreamingBufferSegment seg3; FAIL_IF(StreamingBufferAppend(sb, &seg3, (const uint8_t *)"QWERTY", 6) != 0); FAIL_IF(sb->stream_offset != 6); FAIL_IF(sb->buf_offset != 16); FAIL_IF(seg3.stream_offset != 16); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); StreamingBufferSlide(sb, 6); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); StreamingBufferFree(sb); PASS; } static int StreamingBufferTest03(void) { StreamingBufferConfig cfg = { 0, 8, 24, NULL, NULL, NULL, NULL }; StreamingBuffer *sb = StreamingBufferInit(&cfg); FAIL_IF(sb == NULL); StreamingBufferSegment seg1; FAIL_IF(StreamingBufferAppend(sb, &seg1, (const uint8_t *)"ABCDEFGH", 8) != 0); StreamingBufferSegment seg2; FAIL_IF(StreamingBufferInsertAt(sb, &seg2, (const uint8_t *)"01234567", 8, 14) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 22); FAIL_IF(seg1.stream_offset != 0); FAIL_IF(seg2.stream_offset != 14); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); StreamingBufferSegment seg3; FAIL_IF(StreamingBufferInsertAt(sb, &seg3, (const uint8_t *)"QWERTY", 6, 8) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 22); FAIL_IF(seg3.stream_offset != 8); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); StreamingBufferSlide(sb, 10); FAIL_IF(!StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); StreamingBufferFree(sb); PASS; } static int StreamingBufferTest04(void) { StreamingBufferConfig cfg = { 0, 8, 16, NULL, NULL, NULL, NULL }; StreamingBuffer *sb = StreamingBufferInit(&cfg); FAIL_IF(sb == NULL); StreamingBufferSegment seg1; FAIL_IF(StreamingBufferAppend(sb, &seg1, (const uint8_t *)"ABCDEFGH", 8) != 0); StreamingBufferSegment seg2; FAIL_IF(StreamingBufferInsertAt(sb, &seg2, (const uint8_t *)"01234567", 8, 14) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 22); FAIL_IF(seg1.stream_offset != 0); FAIL_IF(seg2.stream_offset != 14); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); StreamingBufferSegment seg3; FAIL_IF(StreamingBufferInsertAt(sb, &seg3, (const uint8_t *)"QWERTY", 6, 8) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 22); FAIL_IF(seg3.stream_offset != 8); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); /* far ahead of curve: */ StreamingBufferSegment seg4; FAIL_IF(StreamingBufferInsertAt(sb, &seg4, (const uint8_t *)"XYZ", 3, 124) != 0); FAIL_IF(sb->stream_offset != 0); FAIL_IF(sb->buf_offset != 127); FAIL_IF(sb->buf_size != 128); FAIL_IF(seg4.stream_offset != 124); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg3)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(sb,&seg4)); Dump(sb); DumpSegment(sb, &seg1); DumpSegment(sb, &seg2); DumpSegment(sb, &seg3); DumpSegment(sb, &seg4); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,&seg1,(const uint8_t *)"ABCDEFGH", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,&seg2,(const uint8_t *)"01234567", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,&seg3,(const uint8_t *)"QWERTY", 6)); FAIL_IF(!StreamingBufferSegmentCompareRawData(sb,&seg4,(const uint8_t *)"XYZ", 3)); StreamingBufferFree(sb); PASS; } static int StreamingBufferTest05(void) { StreamingBufferConfig cfg = { STREAMING_BUFFER_AUTOSLIDE, 8, 32, NULL, NULL, NULL, NULL }; StreamingBuffer sb = STREAMING_BUFFER_INITIALIZER(&cfg); StreamingBufferSegment *seg1 = StreamingBufferAppendRaw(&sb, (const uint8_t *)"AAAAAAAA", 8); StreamingBufferSegment *seg2 = StreamingBufferAppendRaw(&sb, (const uint8_t *)"BBBBBBBB", 8); StreamingBufferSegment *seg3 = StreamingBufferAppendRaw(&sb, (const uint8_t *)"CCCCCCCC", 8); StreamingBufferSegment *seg4 = StreamingBufferAppendRaw(&sb, (const uint8_t *)"DDDDDDDD", 8); FAIL_IF(sb.stream_offset != 0); FAIL_IF(sb.buf_offset != 32); FAIL_IF(seg1->stream_offset != 0); FAIL_IF(seg2->stream_offset != 8); FAIL_IF(seg3->stream_offset != 16); FAIL_IF(seg4->stream_offset != 24); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(&sb,seg1)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(&sb,seg2)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(&sb,seg3)); FAIL_IF(StreamingBufferSegmentIsBeforeWindow(&sb,seg4)); FAIL_IF(!StreamingBufferSegmentCompareRawData(&sb,seg1,(const uint8_t *)"AAAAAAAA", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(&sb,seg2,(const uint8_t *)"BBBBBBBB", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(&sb,seg3,(const uint8_t *)"CCCCCCCC", 8)); FAIL_IF(!StreamingBufferSegmentCompareRawData(&sb,seg4,(const uint8_t *)"DDDDDDDD", 8)); Dump(&sb); StreamingBufferSegment *seg5 = StreamingBufferAppendRaw(&sb, (const uint8_t *)"EEEEEEEE", 8); FAIL_IF(!StreamingBufferSegmentCompareRawData(&sb,seg5,(const uint8_t *)"EEEEEEEE", 8)); Dump(&sb); SCFree(seg1); SCFree(seg2); SCFree(seg3); SCFree(seg4); SCFree(seg5); StreamingBufferClear(&sb); PASS; } #endif void StreamingBufferRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("StreamingBufferTest01", StreamingBufferTest01); UtRegisterTest("StreamingBufferTest02", StreamingBufferTest02); UtRegisterTest("StreamingBufferTest03", StreamingBufferTest03); UtRegisterTest("StreamingBufferTest04", StreamingBufferTest04); UtRegisterTest("StreamingBufferTest05", StreamingBufferTest05); #endif } suricata-3.2.1/src/util-mpm-ac-tile.h0000644000000000000000000001126013051004444014232 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Ken Steele * */ #ifndef __UTIL_MPM_AC_TILE__H__ #define __UTIL_MPM_AC_TILE__H__ typedef struct SCACTilePatternList_ { uint8_t *cs; uint16_t patlen; /* Pattern Id */ uint32_t pid; /* sid(s) for this pattern */ uint32_t sids_size; SigIntId *sids; } SCACTilePatternList; typedef struct SCACTileOutputTable_ { /* list of pattern indexes */ MpmPatternIndex *patterns; /* number of entries in pattern list */ uint32_t no_of_entries; } SCACTileOutputTable; struct SCACTileSearchCtx_; /* Reordered for Tilera cache */ typedef struct SCACTileCtx_ { /* Convert input character to matching alphabet */ uint8_t translate_table[256]; /* The all important memory hungry state_table. * The size of each next-state is determined by bytes_per_state. */ void *state_table; /* Specialized search function based on size of data in delta * tables. The alphabet size determines address shifting and the * number of states could make the next state could be 16 bits or * 32 bits. */ uint32_t (*search)(const struct SCACTileSearchCtx_ *ctx, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint16_t); /* Function to set the next state based on size of next state * (bytes_per_state). */ void (*set_next_state)(struct SCACTileCtx_ *ctx, int state, int aa, int new_state, int outputs); /* List of patterns that match for this state. Indexed by State Number */ SCACTileOutputTable *output_table; /* Indexed by MpmPatternIndex */ SCACTilePatternList *pattern_list; /* pattern arrays. We need this only during the goto table creation phase */ MpmPattern **parray; /* goto_table, failure table and output table. Needed to create * state_table. Will be freed, once we have created the * state_table */ int32_t (*goto_table)[256]; int32_t *failure_table; /* Number of states used by ac-tile */ uint32_t state_count; /* Number of states allocated for ac-tile. */ uint32_t allocated_state_count; uint32_t alpha_hist[256]; /* Number of characters in the compressed alphabet. */ uint16_t alphabet_size; /* Space used to store compressed alphabet is the next * larger or equal power-of-2. */ uint16_t alphabet_storage; /* How many bytes are used to store the next state. */ uint8_t bytes_per_state; } SCACTileCtx; /* Only the stuff used at search time. This * structure is created after all the patterns are added. */ typedef struct SCACTileSearchCtx_ { /* Specialized search function based on size of data in delta * tables. The alphabet size determines address shifting and the * number of states could make the next state could be 16 bits or * 32 bits. */ uint32_t (*search)(const struct SCACTileSearchCtx_ *ctx, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint16_t); /* Convert input character to matching alphabet */ uint8_t translate_table[256]; /* the all important memory hungry state_table */ void *state_table; /* List of patterns that match for this state. Indexed by State Number */ SCACTileOutputTable *output_table; SCACTilePatternList *pattern_list; /* Number of bytes in the array of bits. One bit per pattern in this MPM. */ uint32_t mpm_bitarray_size; /* Number of states used by ac-tile */ uint32_t state_count; uint32_t pattern_cnt; /* MPM Creation data, only used at initialization. */ SCACTileCtx *init_ctx; } SCACTileSearchCtx; typedef struct SCACTileThreadCtx_ { /* the total calls we make to the search function */ uint32_t total_calls; /* the total patterns that we ended up matching against */ uint64_t total_matches; } SCACTileThreadCtx; void MpmACTileRegister(void); #endif /* __UTIL_MPM_AC_TILE__H__ */ suricata-3.2.1/src/decode-udp.h0000644000000000000000000001244213051004444013166 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_UDP_H__ #define __DECODE_UDP_H__ #define UDP_HEADER_LEN 8 /* XXX RAW* needs to be really 'raw', so no ntohs there */ #define UDP_GET_RAW_LEN(udph) ntohs((udph)->uh_len) #define UDP_GET_RAW_SRC_PORT(udph) ntohs((udph)->uh_sport) #define UDP_GET_RAW_DST_PORT(udph) ntohs((udph)->uh_dport) #define UDP_GET_RAW_SUM(udph) ntohs((udph)->uh_sum) #define UDP_GET_LEN(p) UDP_GET_RAW_LEN(p->udph) #define UDP_GET_SRC_PORT(p) UDP_GET_RAW_SRC_PORT(p->udph) #define UDP_GET_DST_PORT(p) UDP_GET_RAW_DST_PORT(p->udph) #define UDP_GET_SUM(p) UDP_GET_RAW_SUM(p->udph) /* UDP header structure */ typedef struct UDPHdr_ { uint16_t uh_sport; /* source port */ uint16_t uh_dport; /* destination port */ uint16_t uh_len; /* length */ uint16_t uh_sum; /* checksum */ } __attribute__((__packed__)) UDPHdr; #define CLEAR_UDP_PACKET(p) do { \ (p)->level4_comp_csum = -1; \ (p)->udph = NULL; \ } while (0) void DecodeUDPV4RegisterTests(void); /** ------ Inline function ------ */ static inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t); static inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t); /** * \brief Calculates the checksum for the UDP packet * * \param shdr Pointer to source address field from the IP packet. Used as a * part of the psuedoheader for computing the checksum * \param pkt Pointer to the start of the UDP packet * \param hlen Total length of the UDP packet(header + payload) * * \retval csum Checksum for the UDP packet */ static inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = shdr[0]; csum += shdr[1] + shdr[2] + shdr[3] + htons(17) + htons(tlen); csum += pkt[0] + pkt[1] + pkt[2]; tlen -= 8; pkt += 4; while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; pkt += 1; tlen -= 2; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); uint16_t csum_u16 = (uint16_t)~csum; if (csum_u16 == 0) return 0xFFFF; else return csum_u16; } /** * \brief Calculates the checksum for the UDP packet * * \param shdr Pointer to source address field from the IPV6 packet. Used as a * part of the psuedoheader for computing the checksum * \param pkt Pointer to the start of the UDP packet * \param tlen Total length of the UDP packet(header + payload) * * \retval csum Checksum for the UDP packet */ static inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt, uint16_t tlen) { uint16_t pad = 0; uint32_t csum = shdr[0]; csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] + shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] + shdr[13] + shdr[14] + shdr[15] + htons(17) + htons(tlen); csum += pkt[0] + pkt[1] + pkt[2]; tlen -= 8; pkt += 4; while (tlen >= 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; tlen -= 32; pkt += 16; } while(tlen >= 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; tlen -= 8; pkt += 4; } while(tlen >= 4) { csum += pkt[0] + pkt[1]; tlen -= 4; pkt += 2; } while (tlen > 1) { csum += pkt[0]; pkt += 1; tlen -= 2; } if (tlen == 1) { *(uint8_t *)(&pad) = (*(uint8_t *)pkt); csum += pad; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); uint16_t csum_u16 = (uint16_t)~csum; if (csum_u16 == 0) return 0xFFFF; else return csum_u16; } #endif /* __DECODE_UDP_H__ */ suricata-3.2.1/src/Makefile.am0000644000000000000000000004362313051004444013045 00000000000000noinst_HEADERS = action-globals.h \ app-layer-nbss.h app-layer-dcerpc-common.h \ debug.h \ flow-private.h queue.h source-nfq-prototypes.h \ suricata-common.h threadvars.h util-binsearch.h \ util-validate.h bin_PROGRAMS = suricata suricata_SOURCES = \ alert-debuglog.c alert-debuglog.h \ alert-fastlog.c alert-fastlog.h \ alert-prelude.c alert-prelude.h \ alert-syslog.c alert-syslog.h \ alert-unified2-alert.c alert-unified2-alert.h \ app-layer.c app-layer.h \ app-layer-dcerpc.c app-layer-dcerpc.h \ app-layer-dcerpc-udp.c app-layer-dcerpc-udp.h \ app-layer-detect-proto.c app-layer-detect-proto.h \ app-layer-dnp3.c app-layer-dnp3.h \ app-layer-dnp3-objects.c app-layer-dnp3-objects.h \ app-layer-dns-common.c app-layer-dns-common.h \ app-layer-dns-tcp.c app-layer-dns-tcp.h \ app-layer-dns-udp.c app-layer-dns-udp.h \ app-layer-enip.c app-layer-enip.h \ app-layer-enip-common.c app-layer-enip-common.h \ app-layer-events.c app-layer-events.h \ app-layer-ftp.c app-layer-ftp.h \ app-layer-htp-body.c app-layer-htp-body.h \ app-layer-htp.c app-layer-htp.h \ app-layer-htp-file.c app-layer-htp-file.h \ app-layer-htp-libhtp.c app-layer-htp-libhtp.h \ app-layer-htp-mem.c app-layer-htp-mem.h \ app-layer-htp-xff.c app-layer-htp-xff.h \ app-layer-modbus.c app-layer-modbus.h \ app-layer-parser.c app-layer-parser.h \ app-layer-protos.c app-layer-protos.h \ app-layer-smb2.c app-layer-smb2.h \ app-layer-smb.c app-layer-smb.h \ app-layer-smtp.c app-layer-smtp.h \ app-layer-template.c app-layer-template.h \ app-layer-ssh.c app-layer-ssh.h \ app-layer-ssl.c app-layer-ssl.h \ app-layer-tls-handshake.c app-layer-tls-handshake.h \ conf.c conf.h \ conf-yaml-loader.c conf-yaml-loader.h \ counters.c counters.h \ data-queue.c data-queue.h \ decode.c decode.h \ decode-afl.c \ decode-erspan.c decode-erspan.h \ decode-ethernet.c decode-ethernet.h \ decode-events.c decode-events.h \ decode-gre.c decode-gre.h \ decode-icmpv4.c decode-icmpv4.h \ decode-icmpv6.c decode-icmpv6.h \ decode-ipv4.c decode-ipv4.h \ decode-ipv6.c decode-ipv6.h \ decode-null.c decode-null.h \ decode-ppp.c decode-ppp.h \ decode-pppoe.c decode-pppoe.h \ decode-raw.c decode-raw.h \ decode-sctp.c decode-sctp.h \ decode-sll.c decode-sll.h \ decode-tcp.c decode-tcp.h \ decode-teredo.c decode-teredo.h \ decode-udp.c decode-udp.h \ decode-vlan.c decode-vlan.h \ decode-mpls.c decode-mpls.h \ decode-template.c decode-template.h \ defrag-config.c defrag-config.h \ defrag.c defrag.h \ defrag-hash.c defrag-hash.h \ defrag-queue.c defrag-queue.h \ defrag-timeout.c defrag-timeout.h \ detect-ack.c detect-ack.h \ detect-app-layer-event.c detect-app-layer-event.h \ detect-app-layer-protocol.c detect-app-layer-protocol.h \ detect-asn1.c detect-asn1.h \ detect-base64-data.c detect-base64-data.h \ detect-base64-decode.c detect-base64-decode.h \ detect-byte-extract.c detect-byte-extract.h \ detect-bytejump.c detect-bytejump.h \ detect-bytetest.c detect-bytetest.h \ detect-bypass.c detect-bypass.h \ detect.c detect.h \ detect-classtype.c detect-classtype.h \ detect-content.c detect-content.h \ detect-csum.c detect-csum.h \ detect-dce-iface.c detect-dce-iface.h \ detect-dce-opnum.c detect-dce-opnum.h \ detect-dce-stub-data.c detect-dce-stub-data.h \ detect-depth.c detect-depth.h \ detect-detection-filter.c detect-detection-filter.h \ detect-distance.c detect-distance.h \ detect-dnp3.c detect-dnp3.h \ detect-dns-query.c detect-dns-query.h \ detect-tls-sni.c detect-tls-sni.h \ detect-tls-cert-issuer.c detect-tls-cert-issuer.h \ detect-tls-cert-subject.c detect-tls-cert-subject.h \ detect-dsize.c detect-dsize.h \ detect-engine-address.c detect-engine-address.h \ detect-engine-address-ipv4.c detect-engine-address-ipv4.h \ detect-engine-address-ipv6.c detect-engine-address-ipv6.h \ detect-engine-alert.c detect-engine-alert.h \ detect-engine-analyzer.c detect-engine-analyzer.h \ detect-engine.c detect-engine.h \ detect-engine-content-inspection.c detect-engine-content-inspection.h \ detect-engine-dcepayload.c detect-engine-dcepayload.h \ detect-engine-dns.c detect-engine-dns.h \ detect-engine-tls.c detect-engine-tls.h \ detect-engine-modbus.c detect-engine-modbus.h \ detect-engine-enip.c detect-engine-enip.h \ detect-engine-event.c detect-engine-event.h \ detect-engine-file.c detect-engine-file.h \ detect-engine-filedata-smtp.c detect-engine-filedata-smtp.h \ detect-engine-hcbd.c detect-engine-hcbd.h \ detect-engine-hcd.c detect-engine-hcd.h \ detect-engine-hhd.c detect-engine-hhd.h \ detect-engine-hhhd.c detect-engine-hhhd.h \ detect-engine-hmd.c detect-engine-hmd.h \ detect-engine-hrhd.c detect-engine-hrhd.h \ detect-engine-hrhhd.c detect-engine-hrhhd.h \ detect-engine-hrud.c detect-engine-hrud.h \ detect-engine-hsbd.c detect-engine-hsbd.h \ detect-engine-hscd.c detect-engine-hscd.h \ detect-engine-hsmd.c detect-engine-hsmd.h \ detect-engine-hua.c detect-engine-hua.h \ detect-engine-iponly.c detect-engine-iponly.h \ detect-engine-loader.c detect-engine-loader.h \ detect-engine-mpm.c detect-engine-mpm.h \ detect-engine-payload.c detect-engine-payload.h \ detect-engine-port.c detect-engine-port.h \ detect-engine-prefilter.c detect-engine-prefilter.h \ detect-engine-prefilter-common.c detect-engine-prefilter-common.h \ detect-engine-proto.c detect-engine-proto.h \ detect-engine-profile.c detect-engine-profile.h \ detect-engine-siggroup.c detect-engine-siggroup.h \ detect-engine-sigorder.c detect-engine-sigorder.h \ detect-engine-state.c detect-engine-state.h \ detect-engine-tag.c detect-engine-tag.h \ detect-engine-template.c detect-engine-template.h \ detect-engine-threshold.c detect-engine-threshold.h \ detect-engine-uri.c detect-engine-uri.h \ detect-fast-pattern.c detect-fast-pattern.h \ detect-file-data.c detect-file-data.h \ detect-fileext.c detect-fileext.h \ detect-filemagic.c detect-filemagic.h \ detect-filemd5.c detect-filemd5.h \ detect-filesha1.c detect-filesha1.h \ detect-filesha256.c detect-filesha256.h \ detect-filename.c detect-filename.h \ detect-filesize.c detect-filesize.h \ detect-filestore.c detect-filestore.h \ detect-flags.c detect-flags.h \ detect-flowbits.c detect-flowbits.h \ detect-flow.c detect-flow.h \ detect-flowint.c detect-flowint.h \ detect-flowvar.c detect-flowvar.h \ detect-fragbits.c detect-fragbits.h \ detect-fragoffset.c detect-fragoffset.h \ detect-ftpbounce.c detect-ftpbounce.h \ detect-geoip.c detect-geoip.h \ detect-gid.c detect-gid.h \ detect-hostbits.c detect-hostbits.h \ detect-http-client-body.c detect-http-client-body.h \ detect-http-cookie.c detect-http-cookie.h \ detect-http-header.c detect-http-header.h \ detect-http-hh.c detect-http-hh.h \ detect-http-hrh.c detect-http-hrh.h \ detect-http-method.c detect-http-method.h \ detect-http-raw-header.c detect-http-raw-header.h \ detect-http-raw-uri.c detect-http-raw-uri.h \ detect-http-request-line.c detect-http-request-line.h \ detect-http-response-line.c detect-http-response-line.h \ detect-http-server-body.c detect-http-server-body.h \ detect-http-stat-code.c detect-http-stat-code.h \ detect-http-stat-msg.c detect-http-stat-msg.h \ detect-http-ua.c detect-http-ua.h \ detect-http-uri.c detect-http-uri.h \ detect-icmp-id.c detect-icmp-id.h \ detect-icmp-seq.c detect-icmp-seq.h \ detect-icode.c detect-icode.h \ detect-id.c detect-id.h \ detect-ipopts.c detect-ipopts.h \ detect-ipproto.c detect-ipproto.h \ detect-iprep.c detect-iprep.h \ detect-isdataat.c detect-isdataat.h \ detect-itype.c detect-itype.h \ detect-l3proto.c detect-l3proto.h \ detect-lua.c detect-lua.h \ detect-lua-extensions.c detect-lua-extensions.h \ detect-mark.c detect-mark.h \ detect-metadata.c detect-metadata.h \ detect-msg.c detect-msg.h \ detect-noalert.c detect-noalert.h \ detect-nocase.c detect-nocase.h \ detect-offset.c detect-offset.h \ detect-parse.c detect-parse.h \ detect-pcre.c detect-pcre.h \ detect-pkt-data.c detect-pkt-data.h \ detect-pktvar.c detect-pktvar.h \ detect-prefilter.c detect-prefilter.h \ detect-priority.c detect-priority.h \ detect-rawbytes.c detect-rawbytes.h \ detect-reference.c detect-reference.h \ detect-replace.c detect-replace.h \ detect-rev.c detect-rev.h \ detect-rpc.c detect-rpc.h \ detect-sameip.c detect-sameip.h \ detect-seq.c detect-seq.h \ detect-sid.c detect-sid.h \ detect-ssh-proto-version.c detect-ssh-proto-version.h \ detect-ssh-software-version.c detect-ssh-software-version.h \ detect-ssl-state.c detect-ssl-state.h \ detect-ssl-version.c detect-ssl-version.h \ detect-stream_size.c detect-stream_size.h \ detect-tag.c detect-tag.h \ detect-template.c detect-template.h \ detect-template-buffer.c detect-template-buffer.h \ detect-threshold.c detect-threshold.h \ detect-tls.c detect-tls.h \ detect-tls-cert-validity.c detect-tls-cert-validity.h \ detect-tls-version.c detect-tls-version.h \ detect-tos.c detect-tos.h \ detect-ttl.c detect-ttl.h \ detect-uricontent.c detect-uricontent.h \ detect-urilen.c detect-urilen.h \ detect-window.c detect-window.h \ detect-within.c detect-within.h \ detect-modbus.c detect-modbus.h \ detect-xbits.c detect-xbits.h \ detect-cipservice.c detect-cipservice.h \ flow-bit.c flow-bit.h \ flow.c flow.h \ flow-hash.c flow-hash.h \ flow-manager.c flow-manager.h \ flow-queue.c flow-queue.h \ flow-storage.c flow-storage.h \ flow-timeout.c flow-timeout.h \ flow-util.c flow-util.h \ flow-var.c flow-var.h \ flow-worker.c flow-worker.h \ host.c host.h \ host-bit.c host-bit.h \ host-queue.c host-queue.h \ host-storage.c host-storage.h \ host-timeout.c host-timeout.h \ ippair.c ippair.h \ ippair-bit.c ippair-bit.h \ ippair-queue.c ippair-queue.h \ ippair-storage.c ippair-storage.h \ ippair-timeout.c ippair-timeout.h \ log-dnslog.c log-dnslog.h \ log-droplog.c log-droplog.h \ log-file.c log-file.h \ log-filestore.c log-filestore.h \ log-httplog.c log-httplog.h \ log-pcap.c log-pcap.h \ log-stats.c log-stats.h \ log-tcp-data.c log-tcp-data.h \ log-tlslog.c log-tlslog.h \ log-tlsstore.c log-tlsstore.h \ output.c output.h \ output-file.c output-file.h \ output-filedata.c output-filedata.h \ output-flow.c output-flow.h \ output-json-alert.c output-json-alert.h \ output-json-dns.c output-json-dns.h \ output-json-dnp3.c output-json-dnp3.h \ output-json-dnp3-objects.c output-json-dnp3-objects.h \ output-json-drop.c output-json-drop.h \ output-json-email-common.c output-json-email-common.h \ output-json-file.c output-json-file.h \ output-json-flow.c output-json-flow.h \ output-json-netflow.c output-json-netflow.h \ output-json-http.c output-json-http.h \ output-json-smtp.c output-json-smtp.h \ output-json-ssh.c output-json-ssh.h \ output-json-stats.c output-json-stats.h \ output-json-tls.c output-json-tls.h \ output-json-template.c output-json-template.h \ output-lua.c output-lua.h \ output-packet.c output-packet.h \ output-stats.c output-stats.h \ output-streaming.c output-streaming.h \ output-tx.c output-tx.h \ output-json.c output-json.h \ packet-queue.c packet-queue.h \ pkt-var.c pkt-var.h \ reputation.c reputation.h \ respond-reject.c respond-reject.h \ respond-reject-libnet11.h respond-reject-libnet11.c \ runmode-af-packet.c runmode-af-packet.h \ runmode-erf-dag.c runmode-erf-dag.h \ runmode-erf-file.c runmode-erf-file.h \ runmode-ipfw.c runmode-ipfw.h \ runmode-napatech.c runmode-napatech.h \ runmode-netmap.c runmode-netmap.h \ runmode-nfq.c runmode-nfq.h \ runmode-nflog.c runmode-nflog.h \ runmode-pcap.c runmode-pcap.h \ runmode-pcap-file.c runmode-pcap-file.h \ runmode-pfring.c runmode-pfring.h \ runmode-unittests.c runmode-unittests.h \ runmode-unix-socket.c runmode-unix-socket.h \ runmode-tile.c runmode-tile.h \ runmodes.c runmodes.h \ source-af-packet.c source-af-packet.h \ source-erf-dag.c source-erf-dag.h \ source-erf-file.c source-erf-file.h \ source-ipfw.c source-ipfw.h \ source-mpipe.c source-mpipe.h \ source-napatech.c source-napatech.h \ source-netmap.c source-netmap.h \ source-nfq.c source-nfq.h \ source-nflog.c source-nflog.h \ source-pcap.c source-pcap.h \ source-pcap-file.c source-pcap-file.h \ source-pfring.c source-pfring.h \ stream.c stream.h \ stream-tcp.c stream-tcp.h stream-tcp-private.h \ stream-tcp-inline.c stream-tcp-inline.h \ stream-tcp-reassemble.c stream-tcp-reassemble.h \ stream-tcp-sack.c stream-tcp-sack.h \ stream-tcp-util.c stream-tcp-util.h \ suricata.c suricata.h \ threads.c threads.h threads-arch-tile.h \ threads-debug.h threads-profile.h \ tm-modules.c tm-modules.h \ tmqh-flow.c tmqh-flow.h \ tmqh-nfq.c tmqh-nfq.h \ tmqh-packetpool.c tmqh-packetpool.h \ tmqh-ringbuffer.c tmqh-ringbuffer.h \ tmqh-simple.c tmqh-simple.h \ tm-queuehandlers.c tm-queuehandlers.h \ tm-queues.c tm-queues.h \ tm-threads.c tm-threads.h tm-threads-common.h \ unix-manager.c unix-manager.h \ util-action.c util-action.h \ util-atomic.c util-atomic.h \ util-base64.c util-base64.h \ util-bloomfilter-counting.c util-bloomfilter-counting.h \ util-bloomfilter.c util-bloomfilter.h \ util-buffer.c util-buffer.h \ util-byte.c util-byte.h \ util-checksum.c util-checksum.h \ util-cidr.c util-cidr.h \ util-classification-config.c util-classification-config.h \ util-conf.c util-conf.h \ util-coredump-config.c util-coredump-config.h \ util-cpu.c util-cpu.h \ util-crypt.c util-crypt.h \ util-cuda.c util-cuda.h \ util-cuda-buffer.c util-cuda-buffer.h \ util-cuda-handlers.c util-cuda-handlers.h \ util-cuda-vars.c util-cuda-vars.h \ util-daemon.c util-daemon.h \ util-debug.c util-debug.h \ util-debug-filters.c util-debug-filters.h \ util-decode-asn1.c util-decode-asn1.h \ util-decode-der.c util-decode-der.h \ util-decode-der-get.c util-decode-der-get.h \ util-decode-mime.c util-decode-mime.h \ util-detect-file-hash.c util-detect-file-hash.h \ util-device.c util-device.h \ util-enum.c util-enum.h \ util-error.c util-error.h \ util-file.c util-file.h \ util-fix_checksum.c util-fix_checksum.h \ util-fmemopen.c util-fmemopen.h \ util-hash.c util-hash.h \ util-hashlist.c util-hashlist.h \ util-hash-lookup3.c util-hash-lookup3.h \ util-host-os-info.c util-host-os-info.h \ util-host-info.c util-host-info.h \ util-hyperscan.c util-hyperscan.h \ util-ioctl.h util-ioctl.c \ util-ip.h util-ip.c \ util-logopenfile.h util-logopenfile.c \ util-logopenfile-tile.h util-logopenfile-tile.c \ util-lua.c util-lua.h \ util-luajit.c util-luajit.h \ util-lua-common.c util-lua-common.h \ util-lua-dnp3.c util-lua-dnp3.h \ util-lua-dnp3-objects.c util-lua-dnp3-objects.h \ util-lua-dns.c util-lua-dns.h \ util-lua-http.c util-lua-http.h \ util-lua-tls.c util-lua-tls.h \ util-lua-ssh.c util-lua-ssh.h \ util-lua-smtp.c util-lua-smtp.h \ util-magic.c util-magic.h \ util-memcmp.c util-memcmp.h \ util-memcpy.h \ util-mem.h \ util-memrchr.c util-memrchr.h \ util-misc.c util-misc.h \ util-mpm-ac-bs.c util-mpm-ac-bs.h \ util-mpm-ac.c util-mpm-ac.h \ util-mpm-ac-tile.c util-mpm-ac-tile.h \ util-mpm-ac-tile-small.c \ util-mpm-hs.c util-mpm-hs.h \ util-mpm.c util-mpm.h \ util-optimize.h \ util-pages.c util-pages.h \ util-path.c util-path.h \ util-pidfile.c util-pidfile.h \ util-pool.c util-pool.h \ util-pool-thread.c util-pool-thread.h \ util-prefilter.c util-prefilter.h \ util-print.c util-print.h \ util-privs.c util-privs.h \ util-profiling.c util-profiling.h \ util-profiling-locks.c util-profiling-locks.h \ util-profiling-rules.c \ util-profiling-keywords.c \ util-profiling-rulegroups.c \ util-proto-name.c util-proto-name.h \ util-radix-tree.c util-radix-tree.h \ util-random.c util-random.h \ util-reference-config.c util-reference-config.h \ util-ringbuffer.c util-ringbuffer.h \ util-rohash.c util-rohash.h \ util-rule-vars.c util-rule-vars.h \ util-runmodes.c util-runmodes.h \ util-running-modes.c util-running-modes.h \ util-signal.c util-signal.h \ util-spm-bm.c util-spm-bm.h \ util-spm-bs2bm.c util-spm-bs2bm.h \ util-spm-bs.c util-spm-bs.h \ util-spm-hs.c util-spm-hs.h \ util-spm.c util-spm.h util-clock.h \ util-storage.c util-storage.h \ util-streaming-buffer.c util-streaming-buffer.h \ util-strlcatu.c \ util-strlcpyu.c \ util-syslog.c util-syslog.h \ util-threshold-config.c util-threshold-config.h \ util-time.c util-time.h \ util-unittest.c util-unittest.h \ util-unittest-helper.c util-unittest-helper.h \ util-validate.h util-affinity.h util-affinity.c \ util-var.c util-var.h \ util-var-name.c util-var-name.h \ util-vector.h \ win32-misc.c win32-misc.h \ win32-service.c win32-service.h \ win32-syslog.h EXTRA_DIST = util-mpm-ac-cuda-kernel.cu ptxdump.py # set the include path found by configure AM_CPPFLAGS = $(all_includes) # the library search path. suricata_LDFLAGS = $(all_libraries) ${SECLDFLAGS} suricata_LDADD = $(HTP_LDADD) # Rules to build CUDA ptx modules if BUILD_CUDA BUILT_SOURCES = cuda-ptxdump.h suricata_CUDA_KERNELS = \ util-mpm-ac-cuda-kernel.cu NVCCFLAGS=-O2 PTXS = $(suricata_CUDA_KERNELS:.cu=.ptx_sm_20) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_21) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_30) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_32) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_35) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_37) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_50) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_52) PTXS += $(suricata_CUDA_KERNELS:.cu=.ptx_sm_53) .cu.ptx_sm_20: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_20 -ptx $< .cu.ptx_sm_21: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_21 -ptx $< .cu.ptx_sm_30: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_30 -ptx $< .cu.ptx_sm_32: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_32 -ptx $< .cu.ptx_sm_35: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_35 -ptx $< .cu.ptx_sm_37: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_37 -ptx $< .cu.ptx_sm_50: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_50 -ptx $< .cu.ptx_sm_52: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_52 -ptx $< .cu.ptx_sm_53: $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_53 -ptx $< cuda-ptxdump.h: $(PTXS) $(PYTHON) ptxdump.py cuda-ptxdump $(PTXS) CLEANFILES = $(PTXS) cuda-ptxdump.h endif # default CFLAGS AM_CFLAGS = ${OPTIMIZATION_CFLAGS} ${GCC_CFLAGS} ${CLANG_CFLAGS} ${SECCFLAGS} ${PCAP_CFLAGS} -Wall -Wno-unused-parameter -std=gnu99 -DLOCAL_STATE_DIR=\"$(localstatedir)\" # different flags for different cases if DEBUG AM_CFLAGS += -ggdb -O0 endif AM_LDFLAGS = ${SECLDFLAGS} if BUILD_UNITTESTS check-am: -mkdir $(top_builddir)/qa/log/ $(top_builddir)/src/suricata -u -l $(top_builddir)/qa/log/ -rm -rf $(top_builddir)/qa/log endif distclean-local: -rm -rf $(top_builddir)/src/build-info.h suricata-3.2.1/src/tm-threads-common.h0000644000000000000000000000422713051004444014515 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __TM_THREADS_COMMON_H__ #define __TM_THREADS_COMMON_H__ /** \brief Thread Model Module id's. * * \note anything added here should also be added to TmModuleTmmIdToString * in tm-modules.c */ typedef enum { TMM_FLOWWORKER, TMM_DECODENFQ, TMM_VERDICTNFQ, TMM_RECEIVENFQ, TMM_RECEIVEPCAP, TMM_RECEIVEPCAPFILE, TMM_DECODEPCAP, TMM_DECODEPCAPFILE, TMM_RECEIVEPFRING, TMM_DECODEPFRING, TMM_RESPONDREJECT, TMM_DECODEIPFW, TMM_VERDICTIPFW, TMM_RECEIVEIPFW, TMM_RECEIVEERFFILE, TMM_DECODEERFFILE, TMM_RECEIVEERFDAG, TMM_DECODEERFDAG, TMM_RECEIVEAFP, TMM_DECODEAFP, TMM_RECEIVENETMAP, TMM_DECODENETMAP, TMM_ALERTPCAPINFO, TMM_RECEIVEMPIPE, TMM_DECODEMPIPE, TMM_RECEIVENAPATECH, TMM_DECODENAPATECH, TMM_STATSLOGGER, TMM_RECEIVENFLOG, TMM_DECODENFLOG, TMM_FLOWMANAGER, TMM_FLOWRECYCLER, TMM_DETECTLOADER, TMM_UNIXMANAGER, TMM_SIZE, } TmmId; /*Error codes for the thread modules*/ typedef enum { TM_ECODE_OK = 0, /**< Thread module exits OK*/ TM_ECODE_FAILED, /**< Thread module exits due to failure*/ TM_ECODE_DONE, /**< Thread module task is finished*/ } TmEcode; /* ThreadVars type */ enum { TVT_PPT, TVT_MGMT, TVT_CMD, TVT_MAX, }; #endif /* __TM_THREADS_COMMON_H__ */ suricata-3.2.1/src/detect-engine-dcepayload.c0000644000000000000000000141550613051004444015777 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-pcre.h" #include "detect-isdataat.h" #include "detect-bytetest.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" #include "detect-content.h" #include "detect-engine-content-inspection.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-dcerpc.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" /** * \brief Do the content inspection & validation for a signature against dce stub. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param sm SigMatch to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectDcePayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate) { SCEnter(); DCERPCState *dcerpc_state = (DCERPCState *)alstate; uint8_t *dce_stub_data = NULL; uint16_t dce_stub_data_len; int r = 0; if (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL || dcerpc_state == NULL) { SCReturnInt(0); } if (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh != 0) { /* the request stub and stub_len */ dce_stub_data = dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer; dce_stub_data_len = dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, dce_stub_data, dce_stub_data_len, 0, 0, dcerpc_state); //r = DoInspectDcePayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, //dce_stub_data, dce_stub_data_len, dcerpc_state); if (r == 1) { SCReturnInt(1); } } if (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) { /* the response stub and stub_len */ dce_stub_data = dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer; dce_stub_data_len = dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer_len; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, dce_stub_data, dce_stub_data_len, 0, 0, dcerpc_state); //r = DoInspectDcePayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, //dce_stub_data, dce_stub_data_len, dcerpc_state); if (r == 1) { SCReturnInt(1); } } SCReturnInt(0); } /**************************************Unittests*******************************/ #ifdef UNITTESTS /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest01(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); uint8_t request3[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x26, 0x65, 0x3c, 0x6e, 0x6d, 0x64, 0x24, 0x39, 0x56, 0x43, 0x3e, 0x61, 0x5c, 0x54, 0x42, 0x23, 0x75, 0x6b, 0x71, 0x27, 0x66, 0x2e, 0x6e, 0x3d, 0x58, 0x23, 0x54, 0x77, 0x3b, 0x52, 0x6b, 0x50, 0x3b, 0x74, 0x2c, 0x54, 0x25, 0x5c, 0x51, 0x7c, 0x29, 0x7c, 0x5f, 0x4a, 0x35, 0x5c, 0x3d, 0x3f, 0x33, 0x55, 0x3b, 0x5a, 0x57, 0x31, 0x59, 0x4f, 0x6d, 0x6d, 0x7b, 0x3e, 0x38, 0x4d, 0x68, 0x75, 0x64, 0x21, 0x50, 0x63, 0x47, 0x42, 0x56, 0x39, 0x6c, 0x6f, 0x61, 0x53, 0x32, 0x56, 0x43, 0x52, 0x43, 0x67, 0x26, 0x45, 0x28, 0x6b, 0x77, 0x28, 0x7c, 0x64, 0x61, 0x24, 0x38, 0x6b, 0x59, 0x2a, 0x4f, 0x6e, 0x5b, 0x57, 0x24, 0x54, 0x33, 0x37, 0x47, 0x58, 0x4b, 0x58, 0x3d, 0x21, 0x38, 0x7c, 0x2c, 0x24, 0x5f, 0x67, 0x3a, 0x41, 0x3e, 0x2a, 0x72, 0x66, 0x2d, 0x6b, 0x66, 0x7b, 0x2b, 0x75, 0x78, 0x2f, 0x4d, 0x4c, 0x51, 0x70, 0x5d, 0x55, 0x54, 0x3c, 0x63, 0x46, 0x6b, 0x64, 0x4d, 0x25, 0x45, 0x21, 0x34, 0x65, 0x48, 0x32, 0x58, 0x4c, 0x70, 0x4c, 0x4c, 0x75, 0x5c, 0x77, 0x68, 0x78, 0x34, 0x5c, 0x2d, 0x39, 0x58, 0x3b, 0x40, 0x71, 0x77, 0x47, 0x32, 0x2e, 0x3c, 0x61, 0x6f, 0x6d, 0x5f, 0x43, 0x74, 0x36, 0x4f, 0x21, 0x44, 0x66, 0x36, 0x62, 0x30, 0x29, 0x5a, 0x34, 0x66, 0x4e, 0x51, 0x23, 0x4e, 0x38, 0x51, 0x78, 0x74, 0x58, 0x2e, 0x6d, 0x51, 0x49, 0x55, 0x73, 0x2a, 0x71, 0x3c, 0x74, 0x38, 0x6f, 0x5d, 0x4b, 0x74, 0x68, 0x65, 0x4a, 0x58, 0x41, 0x55, 0x29, 0x42, 0x69, 0x55, 0x3b, 0x2b, 0x47, 0x64, 0x3b, 0x77, 0x72, 0x74, 0x38, 0x53, 0x5c, 0x69, 0x49, 0x49, 0x5b, 0x31, 0x41, 0x6a, 0x4e, 0x2c, 0x6a, 0x63, 0x3f, 0x58, 0x4e, 0x25, 0x3e, 0x57, 0x41, 0x61, 0x26, 0x5e, 0x24, 0x69, 0x7a, 0x38, 0x60, 0x73, 0x70, 0x7d, 0x63, 0x34, 0x78, 0x4d, 0x50, 0x35, 0x69, 0x49, 0x22, 0x45, 0x44, 0x3f, 0x6e, 0x75, 0x64, 0x57, 0x3a, 0x61, 0x60, 0x34, 0x21, 0x61, 0x21, 0x2a, 0x78, 0x7b, 0x52, 0x43, 0x50, 0x5b, 0x76, 0x5f, 0x4b, 0x6a, 0x5d, 0x23, 0x5b, 0x57, 0x40, 0x53, 0x51, 0x33, 0x21, 0x35, 0x7d, 0x31, 0x46, 0x65, 0x52, 0x28, 0x25, 0x30, 0x5a, 0x37, 0x7c, 0x2c, 0x3d, 0x2a, 0x48, 0x24, 0x5a, 0x2f, 0x47, 0x64, 0x73, 0x64, 0x3d, 0x7a, 0x5b, 0x34, 0x5e, 0x42, 0x22, 0x32, 0x47, 0x6e, 0x58, 0x3b, 0x3e, 0x25, 0x2f, 0x58, 0x78, 0x42, 0x66, 0x71, 0x56, 0x2a, 0x66, 0x66, 0x5b, 0x55, 0x35, 0x7a, 0x41, 0x7c, 0x7c, 0x6a, 0x2d, 0x59, 0x25, 0x22, 0x34, 0x5a, 0x61, 0x37, 0x48, 0x39, 0x31, 0x4a, 0x55, 0x6a, 0x68, 0x40, 0x2f, 0x45, 0x69, 0x46, 0x25, 0x51, 0x7d, 0x4f, 0x71, 0x21, 0x33, 0x55, 0x50, 0x56, 0x5f, 0x75, 0x27, 0x64, 0x36, 0x7a, 0x39, 0x40, 0x6a, 0x77, 0x38, 0x5d, 0x39, 0x30, 0x5e, 0x74, 0x54, 0x24, 0x3f, 0x3d, 0x79, 0x3b, 0x27, 0x7d, 0x68, 0x7d, 0x40, 0x71, 0x7a, 0x65, 0x54, 0x50, 0x66, 0x33, 0x3c, 0x42, 0x69, 0x6e, 0x3c, 0x63, 0x63, 0x69, 0x7a, 0x5e, 0x7b, 0x76, 0x26, 0x71, 0x6f, 0x4a, 0x6d, 0x70, 0x73, 0x66, 0x3b, 0x26, 0x70, 0x43, 0x5b, 0x52, 0x4c, 0x6d, 0x51, 0x2a, 0x66, 0x6c, 0x3e, 0x68, 0x6a, 0x31, 0x41, 0x79, 0x72, 0x37, 0x47, 0x7d, 0x2b, 0x3c, 0x40, 0x6b, 0x75, 0x56, 0x70, 0x7b, 0x2d, 0x5f, 0x33, 0x30, 0x30, 0x21, 0x35, 0x7a, 0x7a, 0x67, 0x48, 0x5e, 0x3b, 0x73, 0x50, 0x54, 0x47, 0x23, 0x2b, 0x4c, 0x4e, 0x2f, 0x24, 0x44, 0x34, 0x23, 0x5d, 0x76, 0x51, 0x5a, 0x73, 0x72, 0x3e, 0x47, 0x77, 0x40, 0x28, 0x65, 0x2e, 0x2a, 0x75, 0x3c, 0x2a, 0x27, 0x4a, 0x3f, 0x3c, 0x66, 0x2d, 0x21, 0x79, 0x2d, 0x2b, 0x78, 0x7c, 0x5a, 0x73, 0x46, 0x6b, 0x39, 0x65, 0x5e, 0x3d, 0x38, 0x40, 0x32, 0x3e, 0x21, 0x62, 0x34, 0x41, 0x58, 0x53, 0x67, 0x34, 0x58, 0x56, 0x61, 0x5b, 0x3e, 0x4e, 0x2c, 0x5b, 0x73, 0x35, 0x34, 0x35, 0x21, 0x3a, 0x61, 0x5f, 0x6e, 0x45, 0x78, 0x44, 0x28, 0x23, 0x48, 0x65, 0x53, 0x47, 0x6e, 0x2c, 0x38, 0x5e, 0x2c, 0x57, 0x58, 0x30, 0x7a, 0x3b, 0x4b, 0x4a, 0x74, 0x7d, 0x3e, 0x4d, 0x30, 0x24, 0x76, 0x66, 0x6d, 0x2e, 0x74, 0x75, 0x28, 0x48, 0x5c, 0x23, 0x6c, 0x46, 0x27, 0x46, 0x6e, 0x34, 0x63, 0x21, 0x58, 0x54, 0x50, 0x2f, 0x40, 0x47, 0x40, 0x32, 0x36, 0x48, 0x5f, 0x7d, 0x4a, 0x41, 0x6e, 0x60, 0x2c, 0x4a, 0x6a, 0x67, 0x6c, 0x41, 0x27, 0x23, 0x30, 0x48, 0x6a, 0x49, 0x73, 0x26, 0x77, 0x75, 0x4d, 0x65, 0x5b, 0x34, 0x79, 0x67, 0x61, 0x5b, 0x5c, 0x2b, 0x71, 0x3f, 0x62, 0x51, 0x3a, 0x53, 0x42, 0x26, 0x6f, 0x36, 0x57, 0x3f, 0x2b, 0x34, 0x24, 0x30, 0x60, 0x55, 0x70, 0x65, 0x70, 0x57, 0x5d, 0x68, 0x36, 0x52, 0x5d, 0x3f, 0x6a, 0x3a, 0x33, 0x31, 0x6c, 0x4e, 0x57, 0x79, 0x49, 0x79, 0x69, 0x71, 0x6f, 0x70, 0x6a, 0x76, 0x4b, 0x2f, 0x33, 0x51, 0x68, 0x30, 0x2e, 0x77, 0x78, 0x55, 0x2f, 0x53, 0x52, 0x5e, 0x57, 0x60, 0x3b, 0x6f, 0x69, 0x61, 0x6c, 0x60, 0x5a, 0x34, 0x5a, 0x35, 0x4b, 0x28, 0x54, 0x32, 0x6a, 0x35, 0x36, 0x6d, 0x68, 0x47, 0x5c, 0x74, 0x2e, 0x5f, 0x6c, 0x6d, 0x55, 0x42, 0x77, 0x64, 0x7d, 0x53, 0x4d, 0x39, 0x2c, 0x41, 0x42, 0x23, 0x3a, 0x73, 0x40, 0x60, 0x5d, 0x38, 0x6d, 0x36, 0x56, 0x57, 0x2a, 0x28, 0x3d, 0x3b, 0x5c, 0x75, 0x35, 0x2d, 0x69, 0x2d, 0x44, 0x51, 0x27, 0x63, 0x66, 0x33, 0x46, 0x42, 0x2e, 0x36, 0x6b, 0x7b, 0x2c, 0x23, 0x3b, 0x5a, 0x50, 0x2a, 0x65, 0x28, 0x3b, 0x3c, 0x51, 0x3f, 0x4d, 0x63, 0x38, 0x25, 0x74, 0x2e, 0x51, 0x22, 0x31, 0x74, 0x35, 0x33, 0x23, 0x2d, 0x3f, 0x77, 0x26, 0x2c, 0x55, 0x6d, 0x27, 0x39, 0x79, 0x76, 0x63, 0x4b, 0x43, 0x4a, 0x3a, 0x6b, 0x59, 0x55, 0x65, 0x26, 0x2f, 0x3f, 0x56, 0x67, 0x5a, 0x77, 0x71, 0x22, 0x51, 0x2b, 0x6d, 0x4c, 0x2c, 0x57, 0x66, 0x76, 0x37, 0x70, 0x5f, 0x52, 0x29, 0x44, 0x52, 0x22, 0x57, 0x37, 0x27, 0x79, 0x29, 0x5c, 0x57, 0x3b, 0x54, 0x3c, 0x3f, 0x53, 0x35, 0x27, 0x5e, 0x7c, 0x49, 0x77, 0x57, 0x5a, 0x22, 0x76, 0x7c, 0x5b, 0x2f, 0x53, 0x5e, 0x55, 0x6d, 0x64, 0x67, 0x34, 0x41, 0x23, 0x76, 0x67, 0x23, 0x78, 0x6a, 0x63, 0x27, 0x68, 0x43, 0x7d, 0x58, 0x49, 0x2d, 0x79, 0x2e, 0x75, 0x60, 0x6b, 0x34, 0x48, 0x6f, 0x4a, 0x6c, 0x48, 0x40, 0x68, 0x5f, 0x35, 0x25, 0x6c, 0x38, 0x5c, 0x30, 0x32, 0x4c, 0x36, 0x31, 0x29, 0x74, 0x4a, 0x55, 0x56, 0x6d, 0x4e, 0x23, 0x54, 0x2e, 0x69, 0x78, 0x61, 0x76, 0x66, 0x22, 0x44, 0x73, 0x25, 0x44, 0x29, 0x2a, 0x28, 0x3b, 0x67, 0x48, 0x58, 0x37, 0x4a, 0x76, 0x76, 0x51, 0x4a, 0x61, 0x70, 0x51, 0x74, 0x40, 0x23, 0x29, 0x63, 0x69, 0x4a, 0x29, 0x23, 0x34, 0x6a, 0x3b, 0x25, 0x28, 0x54, 0x45, 0x33, 0x28, 0x44, 0x30, 0x61, 0x5b, 0x60, 0x51, 0x3f, 0x68, 0x50, 0x70, 0x3d, 0x58, 0x2e, 0x6e, 0x59, 0x5a, 0x62, 0x66, 0x4d, 0x7a, 0x2e, 0x37, 0x37, 0x3d, 0x7b, 0x74, 0x79, 0x48, 0x45, 0x77, 0x56, 0x33, 0x76, 0x71, 0x60, 0x74, 0x3f, 0x61, 0x22, 0x52, 0x51, 0x71, 0x69 }; uint32_t request3_len = sizeof(request3); uint8_t request4[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x75, 0x3e, 0x76, 0x3e, 0x66, 0x6b, 0x6b, 0x3e, 0x6d, 0x59, 0x38, 0x2b, 0x63, 0x4d, 0x2c, 0x73, 0x54, 0x57, 0x34, 0x25, 0x5b, 0x42, 0x7d, 0x5d, 0x37, 0x34, 0x2c, 0x79, 0x24, 0x4b, 0x74, 0x73, 0x25, 0x36, 0x73, 0x3a, 0x2c, 0x55, 0x69, 0x3c, 0x58, 0x67, 0x33, 0x53, 0x67, 0x5c, 0x61, 0x7b, 0x44, 0x2e, 0x42, 0x2d, 0x6b, 0x50, 0x55, 0x24, 0x70, 0x58, 0x60, 0x38, 0x42, 0x45, 0x70, 0x6d, 0x2f, 0x27, 0x27, 0x2c, 0x21, 0x6d, 0x57, 0x6e, 0x43, 0x3c, 0x5b, 0x27, 0x7a, 0x34, 0x49, 0x5a, 0x69, 0x30, 0x3f, 0x6f, 0x77, 0x70, 0x39, 0x2d, 0x51, 0x74, 0x4b, 0x25, 0x70, 0x51, 0x64, 0x4d, 0x75, 0x52, 0x5e, 0x3e, 0x37, 0x30, 0x5d, 0x3b, 0x2c, 0x72, 0x25, 0x6c, 0x6f, 0x79, 0x69, 0x3c, 0x5b, 0x73, 0x3d, 0x41, 0x28, 0x28, 0x64, 0x60, 0x4b, 0x7a, 0x2c, 0x4a, 0x6b, 0x3d, 0x2e, 0x6c, 0x7a, 0x54, 0x70, 0x61, 0x6f, 0x4b, 0x40, 0x28, 0x59, 0x31, 0x25, 0x21, 0x57, 0x79, 0x4b, 0x31, 0x6f, 0x4e, 0x71, 0x2b, 0x3c, 0x24, 0x30, 0x28, 0x3c, 0x61, 0x28, 0x4b, 0x35, 0x61, 0x4d, 0x55, 0x5e, 0x66, 0x34, 0x5f, 0x61, 0x70, 0x7b, 0x67, 0x51, 0x55, 0x68, 0x78, 0x26, 0x3a, 0x27, 0x4e, 0x71, 0x79, 0x4f, 0x67, 0x2c, 0x5a, 0x79, 0x75, 0x59, 0x3a, 0x33, 0x4a, 0x36, 0x71, 0x72, 0x6d, 0x49, 0x3e, 0x53, 0x59, 0x2b, 0x2b, 0x27, 0x4e, 0x50, 0x5d, 0x21, 0x55, 0x64, 0x4b, 0x72, 0x73, 0x25, 0x55, 0x26, 0x4f, 0x3a, 0x21, 0x54, 0x29, 0x4f, 0x64, 0x51, 0x59, 0x60, 0x7b, 0x7c, 0x6f, 0x3e, 0x65, 0x74, 0x6a, 0x5b, 0x52, 0x2c, 0x56, 0x4e, 0x45, 0x53, 0x4b, 0x7c, 0x38, 0x49, 0x4b, 0x4e, 0x4f, 0x4a, 0x47, 0x5e, 0x7c, 0x46, 0x3b, 0x67, 0x2e, 0x43, 0x79, 0x35, 0x55, 0x59, 0x6d, 0x38, 0x70, 0x2f, 0x59, 0x4f, 0x27, 0x63, 0x40, 0x66, 0x2d, 0x39, 0x4f, 0x3d, 0x2e, 0x4c, 0x67, 0x71, 0x7d, 0x34, 0x22, 0x52, 0x4e, 0x36, 0x7b, 0x2c, 0x39, 0x4d, 0x42, 0x60, 0x75, 0x74, 0x72, 0x4f, 0x72, 0x68, 0x3a, 0x51, 0x31, 0x2d, 0x21, 0x4a, 0x35, 0x47, 0x6d, 0x69, 0x3c, 0x50, 0x4c, 0x59, 0x66, 0x4c, 0x71, 0x24, 0x3a, 0x36, 0x67, 0x24, 0x5a, 0x59, 0x28, 0x7c, 0x21, 0x5e, 0x77, 0x68, 0x5e, 0x7b, 0x6e, 0x56, 0x62, 0x36, 0x29, 0x6f, 0x4f, 0x5d, 0x57, 0x56, 0x2b, 0x75, 0x2a, 0x2c, 0x69, 0x63, 0x51, 0x74, 0x6e, 0x5e, 0x46, 0x50, 0x28, 0x2c, 0x3b, 0x32, 0x53, 0x28, 0x78, 0x59, 0x72, 0x39, 0x5e, 0x44, 0x5c, 0x77, 0x60, 0x72, 0x44, 0x3b, 0x75, 0x68, 0x39, 0x55, 0x3e, 0x44, 0x50, 0x76, 0x3c, 0x48, 0x46, 0x43, 0x22, 0x56, 0x27, 0x21, 0x31, 0x33, 0x4a, 0x5a, 0x74, 0x41, 0x58, 0x3f, 0x39, 0x29, 0x71, 0x73, 0x30, 0x57, 0x70, 0x33, 0x62, 0x7b, 0x4a, 0x75, 0x3e, 0x4d, 0x4c, 0x4e, 0x55, 0x63, 0x38, 0x66, 0x7d, 0x68, 0x7d, 0x6f, 0x23, 0x55, 0x50, 0x3d, 0x34, 0x46, 0x5e, 0x2f, 0x55, 0x27, 0x62, 0x68, 0x7c, 0x6c, 0x21, 0x2b, 0x63, 0x4b, 0x47, 0x6b, 0x6a, 0x5b, 0x7b, 0x5c, 0x71, 0x37, 0x7c, 0x52, 0x2b, 0x2f, 0x4a, 0x47, 0x70, 0x78, 0x50, 0x2f, 0x75, 0x28, 0x4c, 0x60, 0x4c, 0x4c, 0x54, 0x6b, 0x68, 0x63, 0x4f, 0x47, 0x39, 0x2a, 0x70, 0x51, 0x7d, 0x28, 0x59, 0x52, 0x46, 0x4b, 0x38, 0x27, 0x49, 0x50, 0x5d, 0x25, 0x22, 0x5f, 0x48, 0x2c, 0x2f, 0x67, 0x59, 0x5d, 0x7d, 0x21, 0x3d, 0x72, 0x4f, 0x5c, 0x5b, 0x41, 0x47, 0x5f, 0x56, 0x69, 0x42, 0x55, 0x60, 0x68, 0x4b, 0x77, 0x44, 0x4c, 0x3b, 0x7d, 0x5a, 0x58, 0x43, 0x7a, 0x33, 0x22, 0x58, 0x58, 0x6f, 0x74, 0x53, 0x57, 0x6d, 0x6e, 0x29, 0x6b, 0x33, 0x71, 0x68, 0x29, 0x48, 0x67, 0x35, 0x52, 0x41, 0x6b, 0x36, 0x4f, 0x46, 0x31, 0x24, 0x73, 0x56, 0x40, 0x48, 0x37, 0x51, 0x24, 0x2a, 0x59, 0x21, 0x74, 0x76, 0x25, 0x2e, 0x4a, 0x74, 0x32, 0x29, 0x5f, 0x57, 0x7c, 0x58, 0x30, 0x2c, 0x7b, 0x70, 0x5b, 0x51, 0x73, 0x27, 0x4a, 0x28, 0x77, 0x2a, 0x43, 0x28, 0x2e, 0x32, 0x3d, 0x38, 0x36, 0x2e, 0x6b, 0x40, 0x6c, 0x76, 0x54, 0x66, 0x4a, 0x5c, 0x25, 0x62, 0x2e, 0x61, 0x48, 0x30, 0x28, 0x41, 0x40, 0x69, 0x3c, 0x39, 0x36, 0x4b, 0x64, 0x50, 0x76, 0x3d, 0x52, 0x50, 0x77, 0x33, 0x3b, 0x65, 0x59, 0x31, 0x5c, 0x48, 0x6a, 0x74, 0x78, 0x5b, 0x74, 0x60, 0x47, 0x27, 0x60, 0x22, 0x4a, 0x72, 0x25, 0x34, 0x5d, 0x3a, 0x21, 0x66, 0x61, 0x7b, 0x34, 0x41, 0x3b, 0x3a, 0x27, 0x44, 0x48, 0x7c, 0x7a, 0x74, 0x3a, 0x68, 0x59, 0x48, 0x61, 0x32, 0x49, 0x61, 0x40, 0x22, 0x33, 0x75, 0x29, 0x76, 0x5b, 0x24, 0x5b, 0x5c, 0x76, 0x5c, 0x28, 0x75, 0x36, 0x26, 0x2c, 0x65, 0x5e, 0x51, 0x7b, 0x3a, 0x7d, 0x4f, 0x35, 0x73, 0x6b, 0x5b, 0x5c, 0x37, 0x35, 0x6b, 0x41, 0x35, 0x40, 0x3a, 0x22, 0x28, 0x6c, 0x71, 0x46, 0x68, 0x7b, 0x66, 0x56, 0x24, 0x7c, 0x54, 0x28, 0x30, 0x22, 0x4e, 0x3c, 0x65, 0x69, 0x36, 0x44, 0x53, 0x3d, 0x6c, 0x5f, 0x73, 0x6c, 0x6f, 0x5e, 0x27, 0x23, 0x4e, 0x60, 0x45, 0x2f, 0x3d, 0x37, 0x28, 0x51, 0x29, 0x77, 0x6a, 0x6b, 0x2a, 0x2a, 0x51, 0x26, 0x4c, 0x4e, 0x71, 0x77, 0x73, 0x71, 0x2d, 0x5a, 0x2c, 0x23, 0x3d, 0x5f, 0x62, 0x63, 0x2e, 0x72, 0x2a, 0x75, 0x66, 0x43, 0x56, 0x5f, 0x21, 0x64, 0x66, 0x35, 0x3b, 0x7a, 0x45, 0x3f, 0x4f, 0x57, 0x22, 0x5a, 0x45, 0x65, 0x37, 0x58, 0x5b, 0x43, 0x66, 0x4f, 0x5d, 0x6e, 0x41, 0x41, 0x62, 0x5e, 0x39, 0x65, 0x6f, 0x43, 0x4b, 0x5e, 0x51, 0x42, 0x3f, 0x2d, 0x68, 0x4b, 0x6e, 0x46, 0x6f, 0x21, 0x44, 0x3c, 0x22, 0x46, 0x31, 0x31, 0x2e, 0x56, 0x2e, 0x77, 0x48, 0x68, 0x23, 0x4a, 0x36, 0x52, 0x5d, 0x61, 0x47, 0x71, 0x2e, 0x3a, 0x4a, 0x5b, 0x56, 0x6b, 0x52, 0x2a, 0x4c, 0x4f, 0x24, 0x34, 0x60, 0x70, 0x58, 0x7a, 0x76, 0x4b, 0x68, 0x24, 0x5f, 0x51, 0x6d, 0x75, 0x45, 0x48, 0x21, 0x53, 0x4d, 0x27, 0x75, 0x5f, 0x50, 0x3e, 0x40, 0x3f, 0x5e, 0x64, 0x41, 0x5f, 0x68, 0x48, 0x30, 0x71, 0x4b, 0x66, 0x2c, 0x2f, 0x76, 0x4b, 0x23, 0x46, 0x34, 0x50, 0x58, 0x52, 0x69, 0x2b, 0x6e, 0x7a, 0x33, 0x53, 0x43, 0x43, 0x35, 0x54, 0x30, 0x73, 0x63, 0x3b, 0x43, 0x52, 0x29, 0x45, 0x37, 0x71, 0x79, 0x5a, 0x26, 0x24, 0x72, 0x73, 0x4e, 0x44, 0x38, 0x5b, 0x71, 0x36, 0x3a, 0x4f, 0x5b, 0x71, 0x28, 0x71, 0x79, 0x72, 0x40, 0x6e, 0x51, 0x72, 0x29, 0x3d, 0x4f, 0x33, 0x22, 0x73, 0x5a, 0x30, 0x71, 0x58, 0x54, 0x59, 0x48, 0x29, 0x2b, 0x5c, 0x73, 0x6f, 0x4e, 0x60, 0x2a, 0x72, 0x39, 0x50, 0x59, 0x6f, 0x48, 0x3e, 0x62, 0x6c, 0x62, 0x49, 0x6c, 0x2c, 0x3f, 0x43, 0x3f, 0x32, 0x7c, 0x6f, 0x6c, 0x39, 0x26, 0x26, 0x7b, 0x5d, 0x65, 0x6f, 0x41, 0x7c, 0x42, 0x2b, 0x65, 0x6f, 0x3e, 0x7b, 0x69, 0x46, 0x4d, 0x68, 0x68, 0x5a, 0x33, 0x25, 0x5d, 0x6f, 0x48, 0x7c, 0x77, 0x7d, 0x3f, 0x4e, 0x30, 0x69, 0x65, 0x28, 0x2e, 0x34, 0x34, 0x41, 0x43, 0x5e, 0x30, 0x23, 0x3b, 0x60, 0x79, 0x5b, 0x26, 0x7c, 0x77, 0x3e, 0x43, 0x24, 0x31, 0x3a, 0x56, 0x24, 0x3c, 0x60, 0x3f, 0x60, 0x55, 0x6a, 0x68 }; uint32_t request4_len = sizeof(request4); uint8_t request5[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x69, 0x3e, 0x72, 0x44, 0x31, 0x6b, 0x28, 0x2f, 0x79, 0x37, 0x58, 0x5d, 0x5f, 0x68, 0x71, 0x47, 0x7a, 0x68, 0x7c, 0x6c, 0x65, 0x3c, 0x74, 0x67, 0x59, 0x5c, 0x3d, 0x28, 0x65, 0x28, 0x58, 0x74, 0x44, 0x62, 0x2e, 0x36, 0x54, 0x2f, 0x24, 0x34, 0x4b, 0x6d, 0x3a, 0x7b, 0x60, 0x71, 0x5a, 0x77, 0x4a, 0x27, 0x25, 0x70, 0x75, 0x56, 0x78, 0x73, 0x2e, 0x38, 0x6c, 0x70, 0x66, 0x7b, 0x7b, 0x2d, 0x78, 0x27, 0x65, 0x63, 0x58, 0x4f, 0x7d, 0x5c, 0x31, 0x3e, 0x36, 0x6e, 0x65, 0x61, 0x2e, 0x4e, 0x26, 0x68, 0x2b, 0x33, 0x7d, 0x54, 0x2c, 0x28, 0x47, 0x3a, 0x31, 0x47, 0x56, 0x32, 0x74, 0x51, 0x79, 0x65, 0x42, 0x45, 0x60, 0x55, 0x6f, 0x48, 0x61, 0x23, 0x72, 0x62, 0x74, 0x3a, 0x5a, 0x26, 0x2d, 0x41, 0x58, 0x62, 0x75, 0x4b, 0x37, 0x2e, 0x3f, 0x2a, 0x6e, 0x2e, 0x2c, 0x43, 0x6f, 0x53, 0x5f, 0x48, 0x7a, 0x53, 0x7b, 0x54, 0x28, 0x30, 0x2b, 0x7a, 0x34, 0x33, 0x28, 0x2b, 0x23, 0x23, 0x72, 0x38, 0x25, 0x30, 0x35, 0x66, 0x76, 0x46, 0x2a, 0x57, 0x7a, 0x60, 0x38, 0x5a, 0x26, 0x4f, 0x78, 0x43, 0x2c, 0x7d, 0x3d, 0x76, 0x7d, 0x66, 0x48, 0x7d, 0x3e, 0x59, 0x31, 0x58, 0x6b, 0x30, 0x76, 0x45, 0x6e, 0x70, 0x72, 0x5f, 0x3c, 0x70, 0x6d, 0x77, 0x42, 0x75, 0x42, 0x73, 0x68, 0x5e, 0x5f, 0x72, 0x2b, 0x2a, 0x70, 0x38, 0x7a, 0x4c, 0x58, 0x2e, 0x5e, 0x2d, 0x2d, 0x78, 0x67, 0x5a, 0x77, 0x34, 0x5a, 0x50, 0x76, 0x2d, 0x2b, 0x77, 0x37, 0x6e, 0x38, 0x2d, 0x7b, 0x44, 0x78, 0x67, 0x52, 0x57, 0x79, 0x43, 0x7d, 0x6d, 0x4d, 0x32, 0x23, 0x37, 0x51, 0x4b, 0x41, 0x60, 0x6e, 0x53, 0x4e, 0x78, 0x37, 0x37, 0x60, 0x56, 0x64, 0x52, 0x25, 0x46, 0x53, 0x5f, 0x2b, 0x56, 0x2b, 0x3b, 0x40, 0x37, 0x33, 0x37, 0x23, 0x43, 0x36, 0x6b, 0x6b, 0x5d, 0x35, 0x28, 0x7d, 0x6a, 0x2c, 0x68, 0x28, 0x4b, 0x4a, 0x6c, 0x27, 0x35, 0x51, 0x66, 0x30, 0x39, 0x28, 0x4d, 0x61, 0x2f, 0x64, 0x36, 0x59, 0x39, 0x68, 0x4b, 0x24, 0x51, 0x7b, 0x6e, 0x38, 0x49, 0x55, 0x72, 0x5f, 0x33, 0x5c, 0x26, 0x45, 0x2f, 0x71, 0x66, 0x33, 0x3d, 0x36, 0x68, 0x65, 0x48, 0x42, 0x40, 0x58, 0x61, 0x4f, 0x50, 0x70, 0x5e, 0x3c, 0x5d, 0x56, 0x43, 0x4c, 0x41, 0x45, 0x54, 0x76, 0x4b, 0x21, 0x25, 0x45, 0x4c, 0x5e, 0x58, 0x23, 0x7d, 0x34, 0x61, 0x5c, 0x53, 0x2a, 0x47, 0x37, 0x22, 0x6d, 0x31, 0x42, 0x6e, 0x22, 0x72, 0x62, 0x55, 0x59, 0x66, 0x28, 0x73, 0x55, 0x50, 0x5c, 0x6f, 0x52, 0x40, 0x3e, 0x3b, 0x44, 0x2a, 0x51, 0x3d, 0x4d, 0x47, 0x3a, 0x57, 0x3e, 0x29, 0x29, 0x7d, 0x40, 0x36, 0x41, 0x3f, 0x58, 0x77, 0x3b, 0x41, 0x2d, 0x64, 0x5a, 0x72, 0x7c, 0x7d, 0x30, 0x68, 0x54, 0x34, 0x40, 0x21, 0x7d, 0x2b, 0x2d, 0x2b, 0x6d, 0x5f, 0x49, 0x57, 0x68, 0x65, 0x79, 0x2c, 0x21, 0x41, 0x31, 0x55, 0x27, 0x4d, 0x78, 0x55, 0x2f, 0x61, 0x62, 0x78, 0x58, 0x25, 0x3a, 0x4b, 0x3e, 0x67, 0x44, 0x7c, 0x7d, 0x52, 0x3d, 0x3e, 0x3b, 0x62, 0x2d, 0x28, 0x48, 0x70, 0x2c, 0x79, 0x31, 0x5a, 0x5e, 0x3f, 0x6a, 0x30, 0x78, 0x41, 0x44, 0x60, 0x4e, 0x63, 0x63, 0x2e, 0x31, 0x79, 0x2b, 0x47, 0x57, 0x26, 0x22, 0x6a, 0x46, 0x43, 0x70, 0x30, 0x51, 0x7d, 0x21, 0x3c, 0x68, 0x74, 0x40, 0x5a, 0x6e, 0x71, 0x3f, 0x76, 0x73, 0x2e, 0x29, 0x3f, 0x6a, 0x55, 0x21, 0x72, 0x65, 0x75, 0x5e, 0x6b, 0x39, 0x6e, 0x3e, 0x76, 0x42, 0x41, 0x65, 0x3f, 0x2b, 0x37, 0x70, 0x7a, 0x7a, 0x29, 0x50, 0x66, 0x21, 0x67, 0x3f, 0x54, 0x32, 0x5f, 0x73, 0x27, 0x59, 0x6f, 0x39, 0x4b, 0x4e, 0x23, 0x54, 0x3b, 0x39, 0x21, 0x38, 0x41, 0x33, 0x44, 0x57, 0x6b, 0x51, 0x30, 0x6a, 0x76, 0x62, 0x2c, 0x5c, 0x5e, 0x49, 0x3e, 0x59, 0x38, 0x5e, 0x4a, 0x59, 0x77, 0x34, 0x25, 0x4f, 0x76, 0x6a, 0x68, 0x6f, 0x73, 0x7c, 0x3d, 0x2d, 0x64, 0x6c, 0x7a, 0x3d, 0x2c, 0x26, 0x28, 0x58, 0x2b, 0x4b, 0x45, 0x68, 0x38, 0x74, 0x63, 0x7b, 0x4a, 0x63, 0x52, 0x26, 0x54, 0x3c, 0x46, 0x77, 0x2d, 0x6b, 0x78, 0x63, 0x7b, 0x6a, 0x50, 0x26, 0x42, 0x62, 0x63, 0x65, 0x6b, 0x63, 0x54, 0x4d, 0x47, 0x59, 0x48, 0x2e, 0x60, 0x7c, 0x4d, 0x33, 0x4d, 0x61, 0x72, 0x76, 0x72, 0x21, 0x4d, 0x2b, 0x43, 0x58, 0x47, 0x4a, 0x36, 0x2d, 0x7b, 0x32, 0x72, 0x21, 0x78, 0x22, 0x38, 0x2c, 0x7a, 0x34, 0x44, 0x45, 0x66, 0x31, 0x7b, 0x37, 0x68, 0x62, 0x65, 0x62, 0x6d, 0x4e, 0x7c, 0x75, 0x38, 0x2a, 0x73, 0x27, 0x64, 0x33, 0x4f, 0x21, 0x41, 0x7c, 0x41, 0x3f, 0x60, 0x68, 0x34, 0x72, 0x5b, 0x38, 0x33, 0x6f, 0x65, 0x3e, 0x5a, 0x7d, 0x25, 0x49, 0x50, 0x60, 0x36, 0x59, 0x5e, 0x6b, 0x25, 0x66, 0x7a, 0x7d, 0x71, 0x40, 0x6c, 0x2c, 0x6e, 0x6a, 0x5a, 0x24, 0x5a, 0x76, 0x21, 0x67, 0x39, 0x4b, 0x4a, 0x31, 0x24, 0x66, 0x66, 0x2e, 0x58, 0x43, 0x46, 0x75, 0x6c, 0x47, 0x28, 0x4f, 0x21, 0x75, 0x77, 0x6f, 0x71, 0x48, 0x3f, 0x4d, 0x4c, 0x51, 0x37, 0x3b, 0x41, 0x4d, 0x41, 0x48, 0x28, 0x71, 0x24, 0x2f, 0x7a, 0x22, 0x49, 0x4a, 0x39, 0x44, 0x43, 0x68, 0x21, 0x3a, 0x34, 0x4e, 0x52, 0x7a, 0x60, 0x71, 0x61, 0x6d, 0x51, 0x58, 0x2a, 0x59, 0x4c, 0x4a, 0x59, 0x6b, 0x77, 0x78, 0x2e, 0x27, 0x78, 0x76, 0x48, 0x4f, 0x46, 0x79, 0x2c, 0x54, 0x42, 0x7b, 0x2c, 0x52, 0x41, 0x54, 0x2b, 0x2c, 0x33, 0x6b, 0x70, 0x77, 0x2e, 0x2e, 0x41, 0x25, 0x7a, 0x48, 0x6e, 0x71, 0x55, 0x6a, 0x43, 0x5a, 0x2c, 0x6c, 0x76, 0x6d, 0x71, 0x72, 0x4d, 0x76, 0x5b, 0x7b, 0x22, 0x4b, 0x45, 0x31, 0x30, 0x26, 0x53, 0x75, 0x3f, 0x26, 0x59, 0x36, 0x2f, 0x68, 0x4f, 0x34, 0x5e, 0x2b, 0x30, 0x63, 0x68, 0x7b, 0x32, 0x5e, 0x77, 0x7d, 0x7b, 0x53, 0x5f, 0x63, 0x53, 0x77, 0x7a, 0x7d, 0x35, 0x28, 0x3e, 0x41, 0x6f, 0x5b, 0x31, 0x78, 0x7b, 0x2b, 0x51, 0x23, 0x43, 0x46, 0x6a, 0x32, 0x32, 0x25, 0x45, 0x57, 0x43, 0x22, 0x50, 0x60, 0x32, 0x70, 0x2e, 0x79, 0x2e, 0x6b, 0x33, 0x67, 0x6c, 0x43, 0x5b, 0x3b, 0x68, 0x53, 0x53, 0x6a, 0x48, 0x59, 0x5f, 0x30, 0x72, 0x7d, 0x6b, 0x37, 0x24, 0x75, 0x52, 0x50, 0x2b, 0x75, 0x35, 0x24, 0x3b, 0x6e, 0x53, 0x56, 0x34, 0x23, 0x54, 0x65, 0x4f, 0x78, 0x3e, 0x46, 0x7d, 0x25, 0x3f, 0x2f, 0x49, 0x6b, 0x49, 0x47, 0x45, 0x24, 0x38, 0x3b, 0x68, 0x6c, 0x4f, 0x29, 0x21, 0x50, 0x32, 0x67, 0x47, 0x5a, 0x72, 0x76, 0x21, 0x39, 0x67, 0x3c, 0x72, 0x47, 0x43, 0x4a, 0x2e, 0x31, 0x32, 0x34, 0x3c, 0x53, 0x2d, 0x22, 0x5b, 0x5b, 0x6a, 0x77, 0x75, 0x31, 0x68, 0x30, 0x45, 0x43, 0x5f, 0x60, 0x5d, 0x56, 0x67, 0x66, 0x55, 0x6a, 0x72, 0x77, 0x7b, 0x44, 0x61, 0x22, 0x64, 0x36, 0x39, 0x6e, 0x44, 0x37, 0x54, 0x45, 0x46, 0x6f, 0x58, 0x35, 0x51, 0x3c, 0x62, 0x49, 0x3a, 0x50, 0x58, 0x56, 0x5d, 0x77, 0x6f, 0x56, 0x64, 0x7b, 0x49, 0x39, 0x21, 0x31, 0x2d, 0x5f, 0x56, 0x56, 0x33, 0x31, 0x69, 0x4a, 0x52, 0x62, 0x5b, 0x6e, 0x65, 0x7c, 0x3d, 0x31, 0x55, 0x3d, 0x75, 0x25, 0x61, 0x50, 0x71, 0x45, 0x29 }; uint32_t request5_len = sizeof(request5); uint8_t request6[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5b, 0x56, 0x3d, 0x5a, 0x6b, 0x43, 0x73, 0x26, 0x65, 0x3b, 0x38, 0x79, 0x26, 0x5e, 0x60, 0x59, 0x40, 0x71, 0x7c, 0x72, 0x28, 0x29, 0x69, 0x32, 0x72, 0x5a, 0x6c, 0x55, 0x43, 0x65, 0x3f, 0x4a, 0x21, 0x66, 0x59, 0x30, 0x76, 0x39, 0x21, 0x69, 0x4b, 0x25, 0x5d, 0x6e, 0x5f, 0x24, 0x2b, 0x38, 0x70, 0x78, 0x35, 0x7d, 0x39, 0x36, 0x31, 0x72, 0x44, 0x49, 0x45, 0x3d, 0x25, 0x50, 0x24, 0x3b, 0x52, 0x27, 0x66, 0x46, 0x5d, 0x4f, 0x34, 0x50, 0x26, 0x5a, 0x25, 0x3e, 0x3f, 0x34, 0x4b, 0x35, 0x77, 0x3a, 0x3f, 0x3e, 0x23, 0x4e, 0x30, 0x23, 0x70, 0x72, 0x33, 0x34, 0x60, 0x2a, 0x4a, 0x32, 0x6e, 0x29, 0x54, 0x73, 0x5f, 0x26, 0x71, 0x3a, 0x78, 0x5d, 0x3f, 0x31, 0x48, 0x59, 0x61, 0x44, 0x5c, 0x38, 0x4f, 0x41, 0x73, 0x67, 0x62, 0x73, 0x33, 0x52, 0x77, 0x73, 0x57, 0x49, 0x7a, 0x59, 0x26, 0x21, 0x34, 0x38, 0x2b, 0x5f, 0x5f, 0x37, 0x74, 0x28, 0x46, 0x3d, 0x43, 0x42, 0x26, 0x66, 0x63, 0x37, 0x6d, 0x2a, 0x65, 0x3f, 0x71, 0x2d, 0x4c, 0x72, 0x29, 0x4b, 0x3a, 0x77, 0x64, 0x6a, 0x6b, 0x42, 0x70, 0x5c, 0x51, 0x38, 0x71, 0x25, 0x4c, 0x7c, 0x6f, 0x74, 0x71, 0x39, 0x71, 0x25, 0x3f, 0x62, 0x23, 0x45, 0x5f, 0x77, 0x59, 0x56, 0x56, 0x67, 0x78, 0x3a, 0x2e, 0x4e, 0x27, 0x59, 0x65, 0x2f, 0x64, 0x3c, 0x62, 0x40, 0x69, 0x52, 0x36, 0x49, 0x3e, 0x3b, 0x2c, 0x47, 0x4f, 0x3e, 0x61, 0x78, 0x2d, 0x45, 0x71, 0x3f, 0x7b, 0x55, 0x34, 0x36, 0x47, 0x5e, 0x36, 0x51, 0x3d, 0x5a, 0x4b, 0x75, 0x44, 0x72, 0x61, 0x44, 0x71, 0x4e, 0x42, 0x6a, 0x2c, 0x34, 0x40, 0x3b, 0x40, 0x31, 0x31, 0x75, 0x4b, 0x32, 0x71, 0x69, 0x3a, 0x5d, 0x31, 0x25, 0x53, 0x2a, 0x61, 0x54, 0x68, 0x2a, 0x76, 0x71, 0x57, 0x67, 0x56, 0x23, 0x7d, 0x70, 0x7d, 0x28, 0x57, 0x5f, 0x2f, 0x4c, 0x71, 0x2e, 0x40, 0x63, 0x49, 0x5b, 0x7c, 0x7b, 0x56, 0x76, 0x77, 0x46, 0x69, 0x56, 0x3d, 0x75, 0x31, 0x3b, 0x35, 0x40, 0x37, 0x2c, 0x51, 0x37, 0x49, 0x6a, 0x79, 0x68, 0x53, 0x31, 0x4c, 0x6f, 0x57, 0x4c, 0x48, 0x31, 0x6a, 0x30, 0x2b, 0x69, 0x30, 0x56, 0x58, 0x4b, 0x76, 0x3b, 0x60, 0x6d, 0x35, 0x4d, 0x74, 0x2f, 0x74, 0x2c, 0x54, 0x4f, 0x6e, 0x3f, 0x38, 0x56, 0x5c, 0x67, 0x2b, 0x4a, 0x35, 0x30, 0x67, 0x7d, 0x58, 0x24, 0x59, 0x54, 0x48, 0x2e, 0x28, 0x7d, 0x6e, 0x51, 0x55, 0x68, 0x56, 0x54, 0x59, 0x31, 0x4a, 0x65, 0x5a, 0x5e, 0x27, 0x76, 0x76, 0x65, 0x6d, 0x2f, 0x75, 0x63, 0x67, 0x52, 0x5e, 0x29, 0x58, 0x3d, 0x5c, 0x3f, 0x54, 0x7c, 0x67, 0x21, 0x6e, 0x75, 0x67, 0x35, 0x77, 0x31, 0x3d, 0x26, 0x3f, 0x60, 0x45, 0x2d, 0x2b, 0x45, 0x5d, 0x3f, 0x55, 0x73, 0x59, 0x4c, 0x5e, 0x6c, 0x30, 0x4a, 0x4e, 0x47, 0x55, 0x42, 0x6a, 0x4b, 0x32, 0x3c, 0x75, 0x6e, 0x36, 0x51, 0x5f, 0x4c, 0x68, 0x72, 0x72, 0x27, 0x3b, 0x51, 0x59, 0x7b, 0x68, 0x7b, 0x3b, 0x54, 0x35, 0x37, 0x7c, 0x44, 0x43, 0x36, 0x4c, 0x4f, 0x67, 0x62, 0x4e, 0x39, 0x4b, 0x7a, 0x49, 0x36, 0x68, 0x38, 0x4c, 0x4a, 0x64, 0x33, 0x35, 0x2f, 0x3e, 0x5c, 0x58, 0x61, 0x23, 0x5b, 0x50, 0x6e, 0x34, 0x44, 0x60, 0x28, 0x54, 0x41, 0x5c, 0x31, 0x53, 0x2d, 0x58, 0x58, 0x54, 0x28, 0x77, 0x51, 0x6f, 0x64, 0x4c, 0x68, 0x34, 0x79, 0x45, 0x66, 0x2c, 0x26, 0x77, 0x64, 0x5f, 0x6c, 0x3b, 0x71, 0x28, 0x4d, 0x68, 0x2a, 0x6b, 0x37, 0x6a, 0x34, 0x51, 0x27, 0x2a, 0x46, 0x3a, 0x2e, 0x35, 0x21, 0x21, 0x79, 0x51, 0x44, 0x58, 0x5d, 0x6f, 0x65, 0x6b, 0x76, 0x68, 0x3a, 0x43, 0x70, 0x36, 0x41, 0x6b, 0x56, 0x64, 0x75, 0x5b, 0x37, 0x24, 0x56, 0x7c, 0x6e, 0x6c, 0x41, 0x3a, 0x60, 0x56, 0x38, 0x55, 0x63, 0x77, 0x4d, 0x6e, 0x50, 0x3c, 0x3d, 0x7a, 0x44, 0x71, 0x42, 0x4b, 0x55, 0x75, 0x72, 0x61, 0x60, 0x65, 0x6f, 0x7a, 0x26, 0x64, 0x46, 0x67, 0x74, 0x29, 0x2a, 0x5b, 0x62, 0x41, 0x28, 0x62, 0x30, 0x34, 0x33, 0x40, 0x79, 0x7a, 0x38, 0x56, 0x38, 0x73, 0x22, 0x7a, 0x7d, 0x73, 0x2a, 0x2a, 0x28, 0x2b, 0x63, 0x27, 0x6f, 0x3d, 0x3e, 0x2c, 0x56, 0x23, 0x32, 0x4b, 0x3b, 0x58, 0x4d, 0x72, 0x4c, 0x49, 0x6f, 0x30, 0x76, 0x23, 0x21, 0x21, 0x3c, 0x49, 0x56, 0x7a, 0x56, 0x79, 0x2f, 0x50, 0x7a, 0x5b, 0x21, 0x21, 0x4a, 0x48, 0x61, 0x33, 0x52, 0x49, 0x2e, 0x30, 0x7d, 0x2c, 0x2d, 0x67, 0x23, 0x55, 0x62, 0x66, 0x52, 0x5a, 0x61, 0x75, 0x63, 0x3c, 0x39, 0x69, 0x41, 0x31, 0x6b, 0x4e, 0x6f, 0x25, 0x34, 0x74, 0x30, 0x21, 0x3a, 0x40, 0x72, 0x44, 0x40, 0x60, 0x4c, 0x53, 0x74, 0x42, 0x64, 0x44, 0x49, 0x76, 0x67, 0x21, 0x79, 0x36, 0x3c, 0x37, 0x70, 0x4f, 0x58, 0x29, 0x71, 0x2a, 0x3a, 0x4d, 0x5d, 0x67, 0x68, 0x52, 0x63, 0x23, 0x24, 0x4b, 0x21, 0x3f, 0x68, 0x69, 0x6c, 0x66, 0x66, 0x42, 0x28, 0x59, 0x35, 0x34, 0x6f, 0x2d, 0x6a, 0x25, 0x66, 0x34, 0x54, 0x5d, 0x50, 0x26, 0x41, 0x22, 0x4f, 0x34, 0x79, 0x3c, 0x50, 0x68, 0x2d, 0x5f, 0x7b, 0x63, 0x7d, 0x58, 0x2e, 0x73, 0x46, 0x2f, 0x54, 0x61, 0x27, 0x74, 0x45, 0x23, 0x72, 0x31, 0x7d, 0x63, 0x4b, 0x43, 0x5e, 0x44, 0x54, 0x2c, 0x38, 0x58, 0x24, 0x75, 0x6c, 0x50, 0x3c, 0x23, 0x5f, 0x35, 0x57, 0x4f, 0x7b, 0x2f, 0x57, 0x29, 0x73, 0x58, 0x2a, 0x66, 0x3e, 0x49, 0x42, 0x5a, 0x6b, 0x75, 0x6a, 0x38, 0x3f, 0x73, 0x44, 0x42, 0x46, 0x2d, 0x39, 0x66, 0x5b, 0x28, 0x3e, 0x63, 0x62, 0x53, 0x75, 0x65, 0x64, 0x79, 0x32, 0x35, 0x71, 0x22, 0x6a, 0x7b, 0x41, 0x2b, 0x26, 0x43, 0x79, 0x58, 0x6f, 0x71, 0x25, 0x24, 0x34, 0x72, 0x5b, 0x4a, 0x2c, 0x5c, 0x77, 0x23, 0x42, 0x27, 0x6a, 0x67, 0x51, 0x5f, 0x3c, 0x75, 0x2c, 0x3f, 0x43, 0x45, 0x5b, 0x48, 0x65, 0x6f, 0x6c, 0x27, 0x65, 0x21, 0x3e, 0x33, 0x37, 0x5f, 0x2b, 0x2e, 0x24, 0x22, 0x47, 0x4e, 0x33, 0x5b, 0x7b, 0x21, 0x3c, 0x53, 0x69, 0x2e, 0x31, 0x3d, 0x48, 0x57, 0x3a, 0x56, 0x48, 0x6b, 0x47, 0x5d, 0x33, 0x41, 0x6c, 0x66, 0x4c, 0x61, 0x67, 0x32, 0x69, 0x53, 0x2c, 0x2f, 0x3e, 0x36, 0x68, 0x37, 0x28, 0x40, 0x21, 0x76, 0x27, 0x44, 0x26, 0x24, 0x6a, 0x30, 0x75, 0x2a, 0x73, 0x48, 0x36, 0x52, 0x4a, 0x3b, 0x51, 0x4e, 0x2f, 0x23, 0x36, 0x4b, 0x49, 0x33, 0x5a, 0x70, 0x2c, 0x54, 0x5b, 0x67, 0x48, 0x53, 0x5d, 0x21, 0x3e, 0x6b, 0x52, 0x6a, 0x3c, 0x48, 0x29, 0x68, 0x27, 0x32, 0x75, 0x61, 0x7c, 0x51, 0x2e, 0x7b, 0x49, 0x2f, 0x5b, 0x3d, 0x74, 0x5a, 0x28, 0x26, 0x29, 0x2c, 0x30, 0x54, 0x74, 0x45, 0x55, 0x4a, 0x3d, 0x39, 0x35, 0x66, 0x56, 0x28, 0x6d, 0x6e, 0x38, 0x7b, 0x2b, 0x40, 0x31, 0x56, 0x61, 0x74, 0x2b, 0x79, 0x5f, 0x63, 0x51, 0x53, 0x52, 0x7d, 0x73, 0x4e, 0x2e, 0x45, 0x3b, 0x22, 0x28, 0x6c, 0x2b, 0x47, 0x21, 0x50, 0x2a, 0x7c, 0x45, 0x48, 0x57, 0x3e, 0x2f, 0x6d, 0x66, 0x6c, 0x51, 0x23, 0x6c, 0x37, 0x4d, 0x4b, 0x4b, 0x66, 0x55, 0x69, 0x2e, 0x4a, 0x69, 0x71, 0x7c, 0x71, 0x30, 0x5c, 0x43, 0x46, 0x63, 0x5a, 0x23, 0x75, 0x40 }; uint32_t request6_len = sizeof(request6); uint8_t request7[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5d, 0x32, 0x55, 0x71, 0x51, 0x45, 0x4e, 0x54, 0x34, 0x21, 0x46, 0x77, 0x5e, 0x5b, 0x75, 0x62, 0x2b, 0x5c, 0x34, 0x26, 0x72, 0x2b, 0x2c, 0x64, 0x4b, 0x65, 0x56, 0x72, 0x31, 0x7d, 0x6a, 0x5f, 0x70, 0x26, 0x32, 0x29, 0x7d, 0x21, 0x5b, 0x3e, 0x5e, 0x53, 0x3d, 0x48, 0x5e, 0x2a, 0x4c, 0x37, 0x3d, 0x59, 0x79, 0x21, 0x4f, 0x56, 0x79, 0x2a, 0x4e, 0x28, 0x61, 0x7d, 0x2c, 0x58, 0x2f, 0x78, 0x5c, 0x3f, 0x5c, 0x42, 0x6d, 0x2f, 0x71, 0x54, 0x25, 0x31, 0x73, 0x38, 0x6c, 0x31, 0x5a, 0x2e, 0x42, 0x5b, 0x2d, 0x41, 0x24, 0x4c, 0x37, 0x40, 0x39, 0x7d, 0x2a, 0x67, 0x60, 0x6a, 0x7a, 0x62, 0x24, 0x4e, 0x3f, 0x2e, 0x69, 0x35, 0x28, 0x65, 0x77, 0x53, 0x23, 0x44, 0x59, 0x71, 0x31, 0x5c, 0x40, 0x5d, 0x3a, 0x27, 0x46, 0x55, 0x30, 0x56, 0x21, 0x74, 0x3e, 0x73, 0x41, 0x22, 0x52, 0x68, 0x40, 0x6c, 0x37, 0x3e, 0x62, 0x5a, 0x2e, 0x21, 0x23, 0x33, 0x27, 0x73, 0x68, 0x26, 0x60, 0x67, 0x70, 0x58, 0x50, 0x42, 0x58, 0x27, 0x3a, 0x35, 0x6f, 0x51, 0x62, 0x78, 0x25, 0x2c, 0x7b, 0x66, 0x34, 0x6a, 0x5a, 0x39, 0x60, 0x70, 0x41, 0x2d, 0x65, 0x26, 0x5a, 0x67, 0x58, 0x2d, 0x3e, 0x56, 0x6d, 0x30, 0x4b, 0x4d, 0x5d, 0x45, 0x41, 0x3d, 0x6e, 0x27, 0x4e, 0x5a, 0x7d, 0x2e, 0x62, 0x4d, 0x42, 0x70, 0x31, 0x24, 0x73, 0x5c, 0x78, 0x77, 0x50, 0x73, 0x27, 0x48, 0x3d, 0x35, 0x2c, 0x4b, 0x40, 0x2d, 0x25, 0x77, 0x5d, 0x3d, 0x6b, 0x50, 0x6f, 0x57, 0x73, 0x2f, 0x4f, 0x6e, 0x4c, 0x6e, 0x56, 0x7b, 0x55, 0x3c, 0x6d, 0x60, 0x47, 0x53, 0x56, 0x39, 0x3b, 0x51, 0x61, 0x71, 0x75, 0x73, 0x6b, 0x70, 0x58, 0x5f, 0x2c, 0x27, 0x74, 0x49, 0x2c, 0x2b, 0x53, 0x2d, 0x5b, 0x79, 0x43, 0x34, 0x39, 0x5a, 0x38, 0x3e, 0x2d, 0x66, 0x70, 0x3d, 0x49, 0x51, 0x29, 0x4d, 0x5d, 0x4c, 0x57, 0x4a, 0x2f, 0x41, 0x69, 0x56, 0x57, 0x77, 0x49, 0x58, 0x75, 0x28, 0x29, 0x4a, 0x6d, 0x54, 0x4f, 0x4f, 0x3f, 0x58, 0x5f, 0x58, 0x6f, 0x39, 0x22, 0x4d, 0x5d, 0x31, 0x75, 0x43, 0x2f, 0x7d, 0x31, 0x3d, 0x4c, 0x4d, 0x76, 0x74, 0x4d, 0x57, 0x3b, 0x56, 0x57, 0x48, 0x2b, 0x5d, 0x32, 0x67, 0x51, 0x6e, 0x60, 0x39, 0x6f, 0x64, 0x38, 0x37, 0x52, 0x4b, 0x52, 0x42, 0x32, 0x4f, 0x24, 0x53, 0x31, 0x6e, 0x4a, 0x68, 0x2f, 0x28, 0x2e, 0x27, 0x49, 0x75, 0x77, 0x75, 0x26, 0x47, 0x7c, 0x5d, 0x72, 0x5a, 0x77, 0x50, 0x2e, 0x6c, 0x27, 0x68, 0x6b, 0x7b, 0x27, 0x63, 0x21, 0x3d, 0x30, 0x2d, 0x5c, 0x67, 0x4d, 0x41, 0x79, 0x47, 0x42, 0x50, 0x6d, 0x32, 0x74, 0x39, 0x62, 0x4d, 0x5f, 0x65, 0x78, 0x4f, 0x67, 0x3a, 0x60, 0x26, 0x45, 0x61, 0x7c, 0x61, 0x63, 0x40, 0x46, 0x79, 0x52, 0x47, 0x57, 0x49, 0x53, 0x4c, 0x48, 0x36, 0x67, 0x47, 0x5c, 0x71, 0x50, 0x4d, 0x4f, 0x58, 0x26, 0x40, 0x6d, 0x54, 0x55, 0x67, 0x66, 0x23, 0x70, 0x23, 0x68, 0x70, 0x4d, 0x2c, 0x7a, 0x3d, 0x60, 0x51, 0x35, 0x64, 0x56, 0x2f, 0x26, 0x6d, 0x72, 0x6a, 0x59, 0x34, 0x3a, 0x73, 0x4b, 0x27, 0x33, 0x61, 0x26, 0x45, 0x61, 0x28, 0x74, 0x22, 0x54, 0x50, 0x2e, 0x39, 0x6a, 0x2c, 0x27, 0x59, 0x26, 0x73, 0x44, 0x71, 0x67, 0x4c, 0x37, 0x74, 0x2c, 0x63, 0x52, 0x2a, 0x60, 0x4f, 0x7b, 0x32, 0x39, 0x21, 0x79, 0x54, 0x79, 0x6d, 0x28, 0x27, 0x3a, 0x6a, 0x7d, 0x40, 0x6a, 0x4f, 0x4b, 0x46, 0x61, 0x36, 0x6a, 0x22, 0x3f, 0x77, 0x2d, 0x6a, 0x3b, 0x73, 0x71, 0x72, 0x3c, 0x21, 0x2e, 0x3f, 0x33, 0x25, 0x76, 0x64, 0x64, 0x70, 0x43, 0x32, 0x44, 0x73, 0x61, 0x51, 0x3c, 0x3b, 0x45, 0x3a, 0x68, 0x46, 0x5b, 0x6e, 0x36, 0x47, 0x4d, 0x38, 0x26, 0x4f, 0x5c, 0x7d, 0x73, 0x29, 0x24, 0x78, 0x44, 0x75, 0x40, 0x42, 0x41, 0x2a, 0x73, 0x2b, 0x24, 0x38, 0x51, 0x67, 0x36, 0x67, 0x2f, 0x70, 0x58, 0x54, 0x6e, 0x5d, 0x3b, 0x41, 0x59, 0x76, 0x7d, 0x2d, 0x40, 0x70, 0x29, 0x4a, 0x4a, 0x31, 0x79, 0x2c, 0x4e, 0x22, 0x31, 0x59, 0x31, 0x3c, 0x2f, 0x21, 0x29, 0x3f, 0x65, 0x6c, 0x38, 0x55, 0x4f, 0x27, 0x66, 0x66, 0x34, 0x45, 0x49, 0x41, 0x56, 0x24, 0x2e, 0x40, 0x36, 0x23, 0x5a, 0x46, 0x40, 0x23, 0x7b, 0x2d, 0x69, 0x54, 0x6c, 0x51, 0x58, 0x73, 0x56, 0x60, 0x5f, 0x60, 0x63, 0x5f, 0x77, 0x6a, 0x4c, 0x2c, 0x35, 0x39, 0x60, 0x73, 0x63, 0x3e, 0x2d, 0x55, 0x5a, 0x26, 0x4b, 0x43, 0x3b, 0x56, 0x33, 0x58, 0x74, 0x51, 0x4f, 0x5c, 0x2a, 0x44, 0x78, 0x66, 0x78, 0x71, 0x40, 0x29, 0x5e, 0x26, 0x57, 0x51, 0x49, 0x30, 0x29, 0x73, 0x38, 0x56, 0x6c, 0x41, 0x78, 0x3d, 0x61, 0x3d, 0x2c, 0x33, 0x46, 0x57, 0x54, 0x63, 0x3e, 0x79, 0x55, 0x4a, 0x7d, 0x2e, 0x2a, 0x3c, 0x77, 0x47, 0x35, 0x29, 0x5a, 0x6d, 0x69, 0x48, 0x6b, 0x73, 0x7d, 0x4f, 0x5f, 0x6f, 0x3a, 0x7a, 0x4e, 0x54, 0x59, 0x38, 0x62, 0x44, 0x72, 0x51, 0x57, 0x6a, 0x74, 0x54, 0x4f, 0x77, 0x6b, 0x66, 0x4a, 0x6b, 0x39, 0x29, 0x69, 0x60, 0x71, 0x52, 0x6a, 0x32, 0x66, 0x6c, 0x25, 0x76, 0x27, 0x7a, 0x2c, 0x38, 0x72, 0x4e, 0x5f, 0x40, 0x26, 0x74, 0x6a, 0x5e, 0x42, 0x38, 0x78, 0x34, 0x4f, 0x4f, 0x35, 0x27, 0x39, 0x62, 0x52, 0x61, 0x37, 0x54, 0x47, 0x38, 0x70, 0x31, 0x7a, 0x66, 0x69, 0x72, 0x24, 0x52, 0x2a, 0x2a, 0x78, 0x72, 0x2b, 0x2e, 0x2a, 0x57, 0x4a, 0x21, 0x52, 0x3c, 0x2a, 0x2f, 0x24, 0x58, 0x34, 0x3c, 0x42, 0x5c, 0x5b, 0x78, 0x27, 0x55, 0x63, 0x58, 0x3e, 0x26, 0x50, 0x2c, 0x72, 0x60, 0x36, 0x6c, 0x46, 0x58, 0x63, 0x59, 0x23, 0x2a, 0x2d, 0x63, 0x6a, 0x68, 0x69, 0x74, 0x3f, 0x49, 0x4f, 0x48, 0x4a, 0x3b, 0x59, 0x56, 0x77, 0x43, 0x6d, 0x57, 0x28, 0x5f, 0x39, 0x73, 0x28, 0x74, 0x3c, 0x4f, 0x43, 0x48, 0x6a, 0x57, 0x5d, 0x41, 0x73, 0x3f, 0x41, 0x7c, 0x65, 0x5e, 0x2d, 0x38, 0x72, 0x3a, 0x53, 0x3e, 0x33, 0x47, 0x69, 0x6a, 0x6e, 0x78, 0x67, 0x5d, 0x35, 0x3b, 0x3f, 0x23, 0x7c, 0x71, 0x3d, 0x7c, 0x3a, 0x3c, 0x75, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x80, 0x23, 0x00, 0xdf, 0xaf, 0xff, 0x33, 0x9b, 0x78, 0x70, 0x43, 0xc5, 0x0a, 0x4d, 0x98, 0x96, 0x02, 0x64, 0x92, 0xc1, 0xee, 0x70, 0x32 }; uint32_t request7_len = sizeof(request7); uint8_t request8[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x65, 0xc1, 0xef, 0x7b, 0xd6, 0xaa, 0xd6, 0x09, 0x21, 0xf6, 0xe7, 0xd1, 0x4c, 0xdf, 0x6a, 0x2d, 0x0a, 0xfb, 0x43, 0xea, 0xda, 0x07, 0x24, 0x84, 0x88, 0x52, 0x9e, 0xa8, 0xa1, 0x7f, 0x4b, 0x60, 0xec, 0x94, 0x57, 0x33, 0x06, 0x93, 0x92, 0x25, 0xd6, 0xac, 0xdc, 0x89, 0x68, 0x5e, 0xbb, 0x32, 0x2b, 0x17, 0x68, 0xf2, 0x06, 0xb7, 0x86, 0xac, 0x81, 0xfe, 0x52, 0x27, 0xf5, 0x80, 0x11, 0x0d, 0x4e, 0x2e, 0x1b, 0xa3, 0x44, 0x8a, 0x58, 0xed, 0xf3, 0x9c, 0xe9, 0x31, 0x01, 0x72, 0xa6, 0xab, 0xfa, 0xa8, 0x05, 0x00, 0x37, 0x60, 0x6b, 0x81, 0xef, 0xf4, 0x96, 0x9a, 0xf7, 0x67, 0x95, 0x27, 0x7a, 0x25, 0xef, 0x6f, 0x0e, 0xff, 0x2d, 0x15, 0x7f, 0x23, 0x1c, 0xa7, 0x56, 0x94, 0x4a, 0x18, 0x98, 0xc6, 0xd8, 0xd2, 0x29, 0x5b, 0x57, 0xb8, 0x5d, 0x3a, 0x93, 0x58, 0x45, 0x77, 0x36, 0xe3, 0xd1, 0x36, 0x87, 0xff, 0xe3, 0x94, 0x0f, 0x00, 0xe6, 0x7c, 0x1a, 0x92, 0xc1, 0x5f, 0x40, 0xc3, 0xa3, 0x25, 0xce, 0xd4, 0xaf, 0x39, 0xeb, 0x17, 0xcf, 0x22, 0x43, 0xd9, 0x0c, 0xce, 0x37, 0x86, 0x46, 0x54, 0xd6, 0xce, 0x00, 0x30, 0x36, 0xae, 0xf9, 0xb5, 0x2b, 0x11, 0xa0, 0xfe, 0xa3, 0x4b, 0x2e, 0x05, 0xbe, 0x54, 0xa9, 0xd8, 0xa5, 0x76, 0x83, 0x5b, 0x63, 0x01, 0x1c, 0xd4, 0x56, 0x72, 0xcd, 0xdc, 0x4a, 0x1d, 0x77, 0xda, 0x8a, 0x9e, 0xba, 0xcb, 0x6c, 0xe8, 0x19, 0x5d, 0x68, 0xef, 0x8e, 0xbc, 0x6a, 0x05, 0x53, 0x0b, 0xc7, 0xc5, 0x96, 0x84, 0x04, 0xd9, 0xda, 0x4c, 0x42, 0x31, 0xd9, 0xbd, 0x99, 0x06, 0xf7, 0xa3, 0x0a, 0x19, 0x49, 0x07, 0x77, 0xf0, 0xdb, 0x7c, 0x43, 0xfa, 0xb2, 0xad, 0xb0, 0xfa, 0x87, 0x52, 0xba, 0xc9, 0x94, 0x61, 0xdc, 0xcf, 0x16, 0xac, 0x0f, 0x4a, 0xa3, 0x6b, 0x5b, 0x6e, 0x27, 0x86, 0x1f, 0xfe, 0x4d, 0x28, 0x3a, 0xa5, 0x10, 0x54, 0x6d, 0xed, 0x53, 0xf9, 0x73, 0xc6, 0x6e, 0xa8, 0xc0, 0x97, 0xcf, 0x56, 0x3b, 0x61, 0xdf, 0xab, 0x83, 0x18, 0xe8, 0x09, 0xee, 0x6a, 0xb7, 0xf5, 0xc9, 0x62, 0x55, 0x2d, 0xc7, 0x0c, 0x0d, 0xa0, 0x22, 0xd8, 0xd4, 0xd6, 0xb2, 0x12, 0x21, 0xd7, 0x73, 0x3e, 0x41, 0xb0, 0x5c, 0xd4, 0xcf, 0x98, 0xf3, 0x70, 0xe6, 0x08, 0xe6, 0x2a, 0x4f, 0x24, 0x85, 0xe8, 0x74, 0xa8, 0x41, 0x5f, 0x0e, 0xfd, 0xf1, 0xf3, 0xbe, 0x9b, 0x14, 0xfd, 0xc0, 0x73, 0x11, 0xff, 0xa5, 0x5b, 0x06, 0x34, 0xc3, 0x6c, 0x28, 0x42, 0x07, 0xfe, 0x8a, 0xa5, 0xbe, 0x72, 0x7a, 0xf7, 0xfa, 0x25, 0xec, 0x35, 0x5e, 0x98, 0x71, 0x50, 0x60, 0x35, 0x76, 0x53, 0x40, 0x1a, 0x34, 0xa5, 0x99, 0x09, 0xa2, 0xc6, 0xca, 0xa5, 0xce, 0x08, 0x50, 0x45, 0xab, 0x8d, 0xfb, 0xe3, 0xb8, 0xe4, 0x8a, 0x61, 0x48, 0x14, 0x6e, 0xf7, 0x58, 0x71, 0xe5, 0x2e, 0xbc, 0x12, 0xd1, 0x25, 0xe9, 0x65, 0x7a, 0xa1, 0x27, 0xbe, 0x3b, 0x8b, 0xe8, 0xe7, 0xbc, 0xe1, 0x05, 0xe7, 0x92, 0xeb, 0xb9, 0xdf, 0x5d, 0x53, 0x74, 0xc0, 0x63, 0x97, 0x80, 0xb8, 0x3c, 0xae, 0xf3, 0xf2, 0x09, 0x12, 0x81, 0x6c, 0x69, 0x10, 0x6f, 0xf6, 0xbe, 0x03, 0x7b, 0x88, 0xcf, 0x26, 0x6b, 0x51, 0x06, 0x23, 0x68, 0x03, 0xa1, 0xb7, 0xd3, 0x0c, 0xca, 0xbf, 0x29, 0x01, 0xa9, 0x61, 0x34, 0x75, 0x98, 0x1e, 0x05, 0x59, 0xb3, 0x46, 0x44, 0xff, 0x2b, 0x98, 0x04, 0x88, 0x89, 0xfd, 0x7f, 0xd5, 0x19, 0x8a, 0xa6, 0xf3, 0xd9, 0x44, 0xd5, 0xf9, 0x3a, 0x3c, 0xec, 0xd9, 0x9b, 0x8c, 0x93, 0x93, 0x2b, 0x44, 0x86, 0x8b, 0x80, 0x83, 0x23, 0x00, 0xdf, 0xaf, 0xff, 0x33, 0x9b, 0x78, 0x70, 0x43, 0xf1, 0x55, 0x87, 0xb1, 0xa1, 0xb3, 0x8e, 0x79, 0x02, 0x70, 0x82, 0x6c, 0x0b, 0xc1, 0xef, 0x96, 0xf1, 0xef, 0xdd, 0xa2, 0x69, 0x86, 0xc7, 0x85, 0x09, 0x7e, 0xf0, 0x2f, 0x8e, 0xa0, 0x5f, 0xea, 0x39, 0x2e, 0x24, 0xf0, 0x82, 0x30, 0x26, 0xa8, 0xa1, 0x4f, 0xc6, 0x5c, 0xec, 0x94, 0x87, 0x52, 0x9b, 0x93, 0x92, 0xf3, 0xa3, 0x1b, 0xc7, 0x8f, 0x9e, 0xb3, 0xbb, 0x32, 0x2b, 0x17, 0x54, 0xf2, 0x06, 0x0c, 0x86, 0x92, 0x0f, 0xb8, 0xe0, 0x27, 0x50, 0xaa, 0xeb, 0xf5, 0x4e, 0x2b, 0x1b, 0xb2, 0x44, 0xe6, 0x58, 0x02, 0xd7, 0x65, 0xdc, 0x31, 0x01, 0xec, 0xa6, 0xab, 0xfa, 0xa8, 0x05, 0x00, 0x37, 0x60, 0x4f, 0xa1, 0x3c, 0x4f, 0x7a, 0x9a, 0x10, 0x67, 0x95, 0xc2, 0x5b, 0x25, 0xef, 0x76, 0x0e, 0xff, 0x2d, 0x15, 0x7f, 0x23, 0x1c, 0x77, 0x56, 0x94, 0x4a, 0x18, 0x98, 0xc6, 0xd8, 0xd2, 0x29, 0x44, 0x57, 0xb8, 0x40, 0x3a, 0x93, 0x58, 0x45, 0x77, 0x36, 0x36, 0x07, 0x35, 0x2a, 0xff, 0x00, 0x94, 0x5c, 0x80, 0xe6, 0x7c, 0x1a, 0x92, 0xc1, 0x5f, 0x40, 0xc3, 0xbc, 0xf8, 0xce, 0x05, 0x77, 0x39, 0x40, 0x17, 0xcf, 0x63, 0x43, 0x77, 0x27, 0xce, 0x37, 0x86, 0x46, 0x54, 0xd6, 0xce, 0x00, 0x30, 0x36, 0xae, 0x9f, 0x24, 0x2b, 0x5a, 0xa0, 0xfe, 0xa3, 0x4b, 0x2e, 0x7e, 0xf7, 0x54, 0xa9, 0xd8, 0xa5, 0x76, 0x83, 0x7b, 0x63, 0x01, 0x1c, 0xd4, 0x56, 0x17, 0x02, 0xdc, 0x4a, 0x89, 0x77, 0xda, 0x8f, 0x9e, 0xba, 0xcb, 0x37, 0xe8, 0x19, 0x5d, 0x68, 0x38, 0x8e, 0xbc, 0x6a, 0x05, 0x53, 0x0b, 0xc7, 0xc5, 0x96, 0x84, 0x5a, 0xd9, 0x6d, 0x4c, 0x42, 0x31, 0xd9, 0xf2, 0x99, 0x06, 0xf7, 0x0c, 0x99, 0xbe, 0x49, 0x07, 0x77, 0xf0, 0x8b, 0x7c, 0x43, 0xfa, 0xb2, 0xad, 0xb0, 0xfa, 0x87, 0x52, 0xba, 0xc9, 0x94, 0x61, 0xdc, 0xcf, 0x16, 0xac, 0x0f, 0x4a, 0xa3, 0x6b, 0x5b, 0x6e, 0x27, 0x86, 0x1f, 0xfe, 0x4d, 0x28, 0x3a, 0xa5, 0x10, 0x98, 0x6d, 0xed, 0x53, 0xf9, 0x73, 0xc6, 0xa5, 0xa8, 0xf7, 0x66, 0xcf, 0x56, 0x3b, 0x61, 0xdf, 0xab, 0x83, 0x18, 0xe8, 0x09, 0xee, 0x6a, 0xb7, 0xf5, 0xc9, 0x62, 0x55, 0x2d, 0xc7, 0x0c, 0x0d, 0xa0, 0x22, 0xd8, 0xd4, 0xd6, 0xb2, 0x12, 0x21, 0xd7, 0x73, 0x3e, 0x41, 0xb0, 0x5c, 0xd4, 0xcf, 0x98, 0xf3, 0x70, 0xe6, 0x08, 0xe6, 0x2a, 0x4f, 0x92, 0x85, 0xe8, 0x74, 0xa8, 0x41, 0x5f, 0x0e, 0xfd, 0xf1, 0xf3, 0xbe, 0x9b, 0x14, 0xfd, 0xc0, 0x73, 0x11, 0xff, 0xa5, 0x5b, 0x06, 0x34, 0xc3, 0x5d, 0x28, 0x42, 0x34, 0xfe, 0x8a, 0xa5, 0xbe, 0x72, 0x7a, 0xf7, 0xfa, 0x25, 0x2b, 0x35, 0x5e, 0x98, 0x71, 0x50, 0x2c, 0x35, 0x76, 0x53, 0x4e, 0x1a, 0x34, 0xa5, 0x99, 0x09, 0xa2, 0xc6, 0xca, 0xa5, 0xce, 0x08, 0x50, 0x45, 0xab, 0x8d, 0xfb, 0xe3, 0xb8, 0xe4, 0x8a, 0x61, 0x48, 0x14, 0x6e, 0xf7, 0x58, 0x71, 0xe5, 0x2e, 0xbc, 0x12, 0xd1, 0x25, 0xe9, 0x65, 0x7a, 0xa1, 0x27, 0xbe, 0x3b, 0x8b, 0xe8, 0xe7, 0xbc, 0x77, 0x05, 0xe7, 0x92, 0xeb, 0xb9, 0xdf, 0x5d, 0x53, 0x74, 0xc0, 0x63, 0x97, 0x80, 0xb8, 0x3c, 0xae, 0xf3, 0xf2, 0x09, 0x12, 0x81, 0x6c, 0x69, 0x10, 0x6f, 0xf6, 0xbe, 0x03, 0x7b, 0x88, 0xcf, 0x26, 0x6b, 0x51, 0x06, 0x23, 0x68, 0x03, 0xa1, 0xb7, 0xd3, 0x0c, 0xca, 0xbf, 0x29, 0x01, 0xa9, 0x61, 0x34, 0x75, 0x98, 0x1e, 0x6f, 0x59, 0xb3, 0x46, 0x44, 0xff, 0x2b, 0x98, 0x04, 0x88, 0x89, 0xfd, 0x1c, 0xd5, 0x19, 0x8a, 0xa6, 0xf3, 0xd9, 0x44, 0xd5, 0xf9, 0x79, 0x26, 0x46, 0xf7 }; uint32_t request8_len = sizeof(request8); uint8_t request9[] = { 0x05, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xbf, 0xa1, 0x12, 0x73, 0x23, 0x44, 0x86, 0x8b, 0x50, 0x6a, 0x40, 0x00 }; uint32_t request9_len = sizeof(request9); TcpSession ssn; Packet *p[11]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|26 d0 cf 80|\"; distance:0; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|43 5b 67 26 65|\"; distance:0; sid:2;)"; char *sig3 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|71 69 75 3e|\"; distance:0; sid:3;)"; char *sig4 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|6a 68 69 3e 72|\"; distance:0; sid:4;)"; char *sig5 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|61 50 71 45 29 5b 56 3d 5a|\"; distance:0; sid:5;)"; char *sig6 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|23 75 40 5d 32 55|\"; distance:0; sid:6;)"; char *sig7 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|ee 70 32 65 c1|\"; distance:0; sid:7;)"; char *sig8 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|79 26 46 f7 bf a1|\"; distance:0; sid:8;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 11; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig3); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig4); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig5); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig6); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig7); s = s->next; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig8); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 3))) { printf("sid 3 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 4))) { printf("sid 4 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 5))) { printf("sid 5 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 6))) { printf("sid 6 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 7))) { printf("sid 7 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 8))) { printf("sid 8 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 3))) { printf("sid 3 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 4))) { printf("sid 4 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 5))) { printf("sid 5 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 6))) { printf("sid 6 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 7))) { printf("sid 7 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 8))) { printf("sid 8 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if ((PacketAlertCheck(p[2], 1))) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 3))) { printf("sid 3 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 4))) { printf("sid 4 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 5))) { printf("sid 5 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 6))) { printf("sid 6 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 7))) { printf("sid 7 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 8))) { printf("sid 8 matched but shouldn't have for packet 2: "); goto end; } SCLogDebug("sending request 2"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if (!(PacketAlertCheck(p[3], 1))) { printf("sid 1 didn't match but should have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 2))) { printf("sid 2 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 3))) { printf("sid 3 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 4))) { printf("sid 4 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 5))) { printf("sid 5 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 6))) { printf("sid 6 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 7))) { printf("sid 7 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 8))) { printf("sid 8 matched but shouldn't have for packet 3: "); goto end; } SCLogDebug("sending request 3"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SCLogDebug("inspecting packet 4"); SigMatchSignatures(&tv, de_ctx, det_ctx, p[4]); if ((PacketAlertCheck(p[4], 1))) { printf("sid 1 matched but shouldn't have for packet 4: "); goto end; } if (!(PacketAlertCheck(p[4], 2))) { printf("sid 2 didn't match but should have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 3))) { printf("sid 3 matched but shouldn't have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 4))) { printf("sid 4 matched but shouldn't have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 5))) { printf("sid 5 matched but shouldn't have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 6))) { printf("sid 6 matched but shouldn't have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 7))) { printf("sid 7 matched but shouldn't have for packet 4: "); goto end; } if ((PacketAlertCheck(p[4], 8))) { printf("sid 8 matched but shouldn't have for packet 4: "); goto end; } SCLogDebug("sending request 4"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request4, request4_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[5]); if ((PacketAlertCheck(p[5], 1))) { printf("sid 1 matched but shouldn't have for packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 2))) { printf("sid 2 matched but shouldn't have for packet 5: "); goto end; } if (!(PacketAlertCheck(p[5], 3))) { printf("sid 3 didn't match but should have packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 4))) { printf("sid 4 matched but shouldn't have for packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 5))) { printf("sid 5 matched but shouldn't have for packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 6))) { printf("sid 6 matched but shouldn't have for packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 7))) { printf("sid 7 matched but shouldn't have for packet 5: "); goto end; } if ((PacketAlertCheck(p[5], 8))) { printf("sid 8 matched but shouldn't have for packet 5: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request5, request5_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[6]); if ((PacketAlertCheck(p[6], 1))) { printf("sid 1 matched but shouldn't have for packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 2))) { printf("sid 2 matched but shouldn't have for packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 3))) { printf("sid 3 matched but shouldn't have for packet 6: "); goto end; } if (!(PacketAlertCheck(p[6], 4))) { printf("sid 4 didn't match but should have packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 5))) { printf("sid 5 matched but shouldn't have for packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 6))) { printf("sid 6 matched but shouldn't have for packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 7))) { printf("sid 7 matched but shouldn't have for packet 6: "); goto end; } if ((PacketAlertCheck(p[6], 8))) { printf("sid 8 matched but shouldn't have for packet 6: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request6, request6_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[7]); if ((PacketAlertCheck(p[7], 1))) { printf("sid 1 matched but shouldn't have for packet 7: "); goto end; } if ((PacketAlertCheck(p[7], 2))) { printf("sid 2 matched but shouldn't have for packet 7: "); goto end; } if ((PacketAlertCheck(p[7], 3))) { printf("sid 3 matched but shouldn't have for packet 7: "); goto end; } if ((PacketAlertCheck(p[7], 4))) { printf("sid 4 matched but shouldn't have for packet 7: "); goto end; } if (!(PacketAlertCheck(p[7], 5))) { printf("sid 5 didn't match but should have paket 7: "); goto end; } if ((PacketAlertCheck(p[7], 6))) { printf("sid 6 matched but shouldn't have for packet 7: "); goto end; } if ((PacketAlertCheck(p[7], 7))) { printf("sid 7 matched but shouldn't have for packet 7: "); goto end; } if ((PacketAlertCheck(p[7], 8))) { printf("sid 8 matched but shouldn't have for packet 7: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request7, request7_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[8]); if ((PacketAlertCheck(p[8], 1))) { printf("sid 1 matched but shouldn't have for packet 8: "); goto end; } if ((PacketAlertCheck(p[8], 2))) { printf("sid 2 matched but shouldn't have for packet 8: "); goto end; } if ((PacketAlertCheck(p[8], 3))) { printf("sid 3 matched but shouldn't have for packet 8: "); goto end; } if ((PacketAlertCheck(p[8], 4))) { printf("sid 4 matched but shouldn't have for packet 8: "); goto end; } if ((PacketAlertCheck(p[8], 5))) { printf("sid 5 matched but shouldn't have for packet 8: "); goto end; } if (!(PacketAlertCheck(p[8], 6))) { printf("sid 6 didn't match but should have paket 8: "); goto end; } if ((PacketAlertCheck(p[8], 7))) { printf("sid 7 matched but shouldn't have for packet 8: "); goto end; } if ((PacketAlertCheck(p[8], 8))) { printf("sid 8 matched but shouldn't have for packet 8: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request8, request8_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[9]); if ((PacketAlertCheck(p[9], 1))) { printf("sid 1 matched but shouldn't have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 2))) { printf("sid 2 matched but shouldn't have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 3))) { printf("sid 3 matched but shouldn't have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 4))) { printf("sid 4 matched but shouldn't have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 5))) { printf("sid 5 matched but shouldn't have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 6))) { printf("sid 6 matched but shouldn't have for packet 9: "); goto end; } if (!(PacketAlertCheck(p[9], 7))) { printf("sid 7 didn't match but should have for packet 9: "); goto end; } if ((PacketAlertCheck(p[9], 8))) { printf("sid 8 matched but shouldn't have for packet 9: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request9, request9_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[10]); if ((PacketAlertCheck(p[10], 1))) { printf("sid 1 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 2))) { printf("sid 2 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 3))) { printf("sid 3 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 4))) { printf("sid 4 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 5))) { printf("sid 5 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 6))) { printf("sid 6 matched but shouldn't have for packet 10: "); goto end; } if ((PacketAlertCheck(p[10], 7))) { printf("sid 7 matched but shouldn't have for packet 10: "); goto end; } if (!(PacketAlertCheck(p[10], 8))) { printf("sid 8 didn't match but should have for paket 10: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 11); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest02(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "dce_stub_data; content:\"|2d 5e 63 2a 4c|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; p[1]->flowflags &=~ FLOW_PKT_TOSERVER; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (PacketAlertCheck(p[0], 1)) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } if (PacketAlertCheck(p[0], 2)) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if (!(PacketAlertCheck(p[2], 1))) { printf("sid 1 didn't match but should have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } if (!(PacketAlertCheck(p[3], 2))) { printf("sid 2 didn't match but should have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest03(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef4; " "dce_stub_data; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|2d 5e 63 2a 4c|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if ((PacketAlertCheck(p[2], 1))) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } if (!(PacketAlertCheck(p[3], 2))) { printf("sid 2 didn't match but should have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest04(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; content:\"|91 27 27 40|\"; distance:0; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|2d 5e 63 2a 4c|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if (!(PacketAlertCheck(p[2], 1))) { printf("sid 1 didn't match but should have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } if (!(PacketAlertCheck(p[3], 2))) { printf("sid 2 didn't match but should have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest05(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef4; " "dce_stub_data; content:\"|91 27 27 40|\"; distance:0; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "dce_stub_data; content:\"|2d 5e 63 2a 4c|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if ((PacketAlertCheck(p[2], 1))) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 2 matched but shouldn't have for packet 3: "); goto end; } if (!(PacketAlertCheck(p[3], 2))) { printf("sid 2 didn't match but should have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest06(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; content:\"|91 27 27 30|\"; distance:0; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|2d 5e 63 2a 4c|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if ((PacketAlertCheck(p[2], 1))) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } if (!(PacketAlertCheck(p[3], 2))) { printf("sid 2 didn't match but should have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest07(void) { #if 0 int result = 0; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[4]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; content:\"|91 27 27 30|\"; distance:0; sid:1;)"; char *sig2 = "alert tcp any any -> any any (dce_stub_data; " "content:\"|2d 5e 63 35 25|\"; distance:0; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 4; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); s = s->next; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } if ((PacketAlertCheck(p[0], 2))) { printf("sid 2 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } if ((PacketAlertCheck(p[1], 2))) { printf("sid 2 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if ((PacketAlertCheck(p[2], 1))) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } if ((PacketAlertCheck(p[2], 2))) { printf("sid 2 matched but shouldn't have for packet 2: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if ((PacketAlertCheck(p[3], 1))) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } if ((PacketAlertCheck(p[3], 2))) { printf("sid 2 matched but shouldn't have for packet 3: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 4); return result; #else return 1; #endif } /** * \test Positive test, to test the working of distance and within. */ int DcePayloadTest08(void) { #if 0 int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p[1]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5d 5b 35|\"; distance:0; content:\"|9e a3|\"; " "distance:0; within:2; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 1; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (!(PacketAlertCheck(p[0], 1))) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 1); return result; #else return 1; #endif } /** * \test Positive test, to test the working of distance and within. */ int DcePayloadTest09(void) { #if 0 int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x5d, 0x5b, 0x35, 0x46, 0x9e, 0xa3, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p[1]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5d 5b 35|\"; distance:0; content:\"|9e a3|\"; " "distance:0; within:2; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 1; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (!(PacketAlertCheck(p[0], 1))) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 1); return result; #else return 1; #endif } /** * \test Positive test, to test the working of distance and within. */ int DcePayloadTest10(void) { #if 0 int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x5d, 0x5b, 0x35, 0x46, 0x9e, 0xa3, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p[1]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|ad 0d|\"; distance:0; content:\"|ad 0d 00|\"; " "distance:-10; within:3; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 1; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (!(PacketAlertCheck(p[0], 1))) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 1); return result; #else return 1; #endif } /** * \test Postive test to check the working of disance and within across frags. */ int DcePayloadTest11(void) { #if 0 int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[2]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|af, 26, d0|\"; distance:0; content:\"|80 98 6d|\"; " "distance:1; within:3; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 2; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if (!(PacketAlertCheck(p[1], 1))) { printf("sid 1 didn't match but should have for pacekt 1: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 2); return result; #else return 1; #endif } /** * \test Negative test the working of contents on stub data with invalid * distance. */ int DcePayloadTest12(void) { #if 0 /* payload ticks off clamav */ int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); TcpSession ssn; Packet *p[2]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|af, 26, d0|\"; distance:0; content:\"|80 98 6d|\"; " "distance:2; within:3; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 2; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if ((PacketAlertCheck(p[0], 1))) { printf("sid 1 matched but shouldn't have for packet 0: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if ((PacketAlertCheck(p[1], 1))) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 2); return result; #else return 1; #endif } /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest13(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint32_t request1_len = sizeof(request1); uint8_t response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint32_t response1_len = sizeof(response1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint32_t request2_len = sizeof(request2); uint8_t response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint32_t response2_len = sizeof(response2); uint8_t request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint32_t request3_len = sizeof(request3); uint8_t response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t response3_len = sizeof(response3); TcpSession ssn; Packet *p[8]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|00 02|\"; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|00 75|\"; sid:2;)"; char *sig3 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|00 18|\"; sid:3;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); /* let the 7 and the 8th packet be dummy packets the client sends to the server */ for (i = 0; i < 8; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[1]->flowflags |= FLOW_PKT_TOCLIENT; p[1]->flowflags &=~ FLOW_PKT_TOSERVER; p[3]->flowflags |= FLOW_PKT_TOCLIENT; p[3]->flowflags &=~ FLOW_PKT_TOSERVER; p[5]->flowflags |= FLOW_PKT_TOCLIENT; p[5]->flowflags &=~ FLOW_PKT_TOSERVER; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, sig1); if (s == NULL) goto end; s = de_ctx->sig_list->next = SigInit(de_ctx, sig2); if (s == NULL) goto end; s = de_ctx->sig_list->next->next = SigInit(de_ctx, sig3); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (!PacketAlertCheck(p[0], 1) || PacketAlertCheck(p[0], 2) || PacketAlertCheck(p[0], 3)) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[6]); if (PacketAlertCheck(p[6], 1) || PacketAlertCheck(p[6], 2) || PacketAlertCheck(p[6], 3)) { printf("sid 1 matched but shouldn't have for packet 6: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, response1, response1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if (PacketAlertCheck(p[1], 1) || PacketAlertCheck(p[1], 2) || PacketAlertCheck(p[1], 3)) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ /* we should have a match for the sig once again for the same flow, since * the detection engine state for the flow has been reset because of a * fresh transaction */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if (PacketAlertCheck(p[2], 1) || !PacketAlertCheck(p[2], 2) || PacketAlertCheck(p[2], 3)) { printf("sid 1 didn't match but should have for packet 2: "); goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[7]); if (PacketAlertCheck(p[7], 1) || PacketAlertCheck(p[7], 2) || PacketAlertCheck(p[7], 3)) { printf("sid 1 matched but shouldn't have for packet 7: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, response2, response2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if (PacketAlertCheck(p[3], 1) || PacketAlertCheck(p[3], 2) || PacketAlertCheck(p[3], 3)) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ /* we should have a match for the sig once again for the same flow, since * the detection engine state for the flow has been reset because of a * fresh transaction */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[4]); if (PacketAlertCheck(p[4], 1) || PacketAlertCheck(p[4], 2) || !PacketAlertCheck(p[4], 3)) { printf("sid 1 didn't match but should have for packet 4: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, response3, response3_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[5]); if (PacketAlertCheck(p[5], 1) || PacketAlertCheck(p[5], 2) || PacketAlertCheck(p[5], 3)) { printf("sid 1 matched but shouldn't have for packet 5: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 8); return result; } /** * \test Test the working of detection engien with respect to dce keywords. */ int DcePayloadTest14(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x81, 0xbb, 0x7a, 0x36, 0x44, 0x98, 0xf1, 0x35, 0xad, 0x32, 0x98, 0xf0, 0x38, 0x00, 0x10, 0x03, 0x02, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x74, 0x73, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6e, 0x74, 0x73, 0x76, 0x63, 0x73, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x64, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x5c, 0x31, 0x37, 0x31, 0x2e, 0x37, 0x31, 0x2e, 0x38, 0x34, 0x2e, 0x36, 0x37, 0x00, 0x8a, 0x00, 0x00, 0x00, 0x00, 0x3f, 0x00, 0x0f, 0x00 }; uint32_t request2_len = sizeof(request2); uint8_t response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd2, 0xc4, 0x88, 0x14, 0xef, 0x31, 0xbb, 0x4d, 0xa8, 0x13, 0xb7, 0x1b, 0x47, 0x49, 0xb5, 0xd7, 0x00, 0x00, 0x00, 0x00 }; uint32_t response2_len = sizeof(response2); TcpSession ssn; Packet *p[6]; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; int i = 0; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|7f 01|\"; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|3f 00|\"; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); for (i = 0; i < 6; i++) { p[i] = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p[i]->flow = &f; p[i]->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p[i]->flowflags |= FLOW_PKT_TOSERVER; p[i]->flowflags |= FLOW_PKT_ESTABLISHED; } p[3]->flowflags |= FLOW_PKT_TOCLIENT; p[3]->flowflags &=~ FLOW_PKT_TOSERVER; p[5]->flowflags |= FLOW_PKT_TOCLIENT; p[5]->flowflags &=~ FLOW_PKT_TOSERVER; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, sig1); if (s == NULL) goto end; s = de_ctx->sig_list->next = SigInit(de_ctx, sig2); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[0]); if (!PacketAlertCheck(p[0], 1) || PacketAlertCheck(p[0], 2)) { printf("sid 1 didn't match but should have for packet 0: "); goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[1]); if (PacketAlertCheck(p[1], 1) || PacketAlertCheck(p[1], 2)) { printf("sid 1 matched but shouldn't have for packet 1: "); goto end; } /* bind */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind, bind_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[2]); if (PacketAlertCheck(p[2], 1) || PacketAlertCheck(p[2], 2)) { printf("sid 1 matched but shouldn't have for packet 2: "); goto end; } /* bind_ack. A new transaction initiation */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[3]); if (PacketAlertCheck(p[3], 1) || PacketAlertCheck(p[3], 2)) { printf("sid 1 matched but shouldn't have for packet 3: "); goto end; } /* we should have a match for the sig once again for the same flow, since * the detection engine state for the flow has been reset because of a * fresh transaction */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[4]); if (PacketAlertCheck(p[4], 1) || !PacketAlertCheck(p[4], 2)) { printf("sid 1 didn't match but should have for packet 4: "); goto end; } /* response */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, response2, response2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p[5]); if (PacketAlertCheck(p[5], 1) || PacketAlertCheck(p[5], 2)) { printf("sid 1 matched but shouldn't have for packet 5: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(p, 6); return result; } #endif /** * \test Test the working of byte_test endianness. */ int DcePayloadTest15(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,14080,0,relative,dce; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,46,5,relative,dce; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of byte_test endianness. */ int DcePayloadTest16(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,55,0,relative; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,11776,5,relative; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of byte_test endianness. */ int DcePayloadTest17(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,55,0,relative,big; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_test:2,=,46,5,relative,little; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of byte_jump endianness. */ int DcePayloadTest18(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x03, 0x00, 0x03, 0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,0,relative,dce; byte_test:2,=,46,0,relative,dce; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,2,relative,dce; byte_test:2,=,14080,0,relative; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of byte_jump endianness. */ int DcePayloadTest19(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x00, 0x03, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,0,relative; byte_test:2,=,46,0,relative,dce; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,2,relative; byte_test:2,=,14080,0,relative; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of byte_jump endianness. */ int DcePayloadTest20(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x76, 0x7e, 0x32, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x03, 0x03, 0x00, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x38, 0x00, 0x34, 0x00, 0x2e, 0x00, 0x36, 0x00, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x84, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x14, 0xfa, 0x7f, 0x01, 0x00, 0x00, 0x00, 0x00 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,0,relative,big; byte_test:2,=,46,0,relative,dce; sid:1;)"; char *sig2 = "alert tcp any any -> any any " "(dce_stub_data; content:\"|5c 00 5c 00 31|\"; distance:0; " "byte_jump:2,2,little,relative; byte_test:2,=,14080,0,relative; sid:2;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; s->next = SigInit(de_ctx, sig2); if (s->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of consecutive relative matches. */ int DcePayloadTest21(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x6e, 0x6f, 0x77, 0x20, 0x74, 0x68, 0x69, 0x73, /* "now this" */ 0x20, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x62, /* " is is b" */ 0x69, 0x67, 0x20, 0x62, 0x69, 0x67, 0x20, 0x73, /* "ig big s" */ 0x74, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x6e, 0x6f, /* "tring no" */ 0x77 }; /* "w" */ uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " "content:\"this\"; distance:0; content:\"is\"; within:6; content:\"big\"; within:8; " "content:\"string\"; within:8; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of consecutive relative matches. */ int DcePayloadTest22(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x6e, 0x6f, 0x77, 0x20, 0x74, 0x68, 0x69, 0x73, /* "now this" */ 0x20, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x69, /* " is is i" */ 0x73, 0x20, 0x62, 0x69, 0x67, 0x20, 0x62, 0x69, /* "s big bi" */ 0x67, 0x20, 0x62, 0x69, 0x67, 0x20, 0x73, 0x74, /* "g big st" */ 0x72, 0x69, 0x6e, 0x67, 0x20, 0x6e, 0x6f, 0x77 }; /* "ring now" */ uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " "content:\"this\"; distance:0; content:\"is\"; within:9; content:\"big\"; within:12; " "content:\"string\"; within:8; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of consecutive relative matches. */ int DcePayloadTest23(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x74, 0x68, 0x69, 0x73, 0x20, 0x74, 0x68, 0x69, /* "this thi" */ 0x73, 0x20, 0x6e, 0x6f, 0x77, 0x20, 0x69, 0x73, /* "s now is" */ 0x20, 0x69, 0x73, 0x20, 0x20, 0x20, 0x20, 0x20, /* " is " */ 0x62, 0x69, 0x67, 0x20, 0x73, 0x74, 0x72, 0x69, /* "big stri" */ 0x6e, 0x67, 0x20, 0x6e, 0x6f, 0x77 }; /* "ng now" */ uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " "content:\"now\"; distance:0; content:\"this\"; distance:-20; " "content:\"is\"; within:12; content:\"big\"; within:8; " "content:\"string\"; within:8; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; content:\"two\"; " "content:\"three\"; within:10; " "content:\"four\"; distance:4; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "pkt_data; " "content:\"one\"; " "content:\"two\"; " "content:\"three\"; within:5; " "content:\"four\"; distance:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "content:\"three\"; within:5; " "content:\"four\"; distance:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] != NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "pkt_data; " "content:\"three\";" "content:\"four\";" "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectPcreData *pd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "pkt_data; " "pcre:/boom/; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "content:\"three\";" "content:\"four\";" "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_PCRE) { result = 0; goto end; } pd = (DetectPcreData *)sm->ctx; if (pd->flags & DETECT_PCRE_RAWBYTES || pd->flags & DETECT_PCRE_RELATIVE) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "pkt_data; " "byte_jump:2,5; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "content:\"three\";" "content:\"four\";" "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bd = (DetectBytejumpData *)sm->ctx; if (bd->flags & DETECT_BYTEJUMP_BEGIN || bd->flags & DETECT_BYTEJUMP_LITTLE || bd->flags & DETECT_BYTEJUMP_BIG || bd->flags & DETECT_BYTEJUMP_STRING || bd->flags & DETECT_BYTEJUMP_RELATIVE || bd->flags & DETECT_BYTEJUMP_ALIGN || bd->flags & DETECT_BYTEJUMP_DCE ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "byte_jump:2,5,relative; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "pkt_data; " "content:\"three\";" "content:\"four\";" "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bd = (DetectBytejumpData *)sm->ctx; if (bd->flags & DETECT_BYTEJUMP_BEGIN || bd->flags & DETECT_BYTEJUMP_LITTLE || bd->flags & DETECT_BYTEJUMP_BIG || bd->flags & DETECT_BYTEJUMP_STRING || !(bd->flags & DETECT_BYTEJUMP_RELATIVE) || bd->flags & DETECT_BYTEJUMP_ALIGN || bd->flags & DETECT_BYTEJUMP_DCE ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "byte_jump:2,5,relative; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "pkt_data; " "content:\"three\";" "content:\"four\"; within:4; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bd = (DetectBytejumpData *)sm->ctx; if (bd->flags & DETECT_BYTEJUMP_BEGIN || bd->flags & DETECT_BYTEJUMP_LITTLE || bd->flags & DETECT_BYTEJUMP_BIG || bd->flags & DETECT_BYTEJUMP_STRING || !(bd->flags & DETECT_BYTEJUMP_RELATIVE) || bd->flags & DETECT_BYTEJUMP_ALIGN || bd->flags & DETECT_BYTEJUMP_DCE ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectPcreData *pd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_stub_data; " "pcre:/boom/R; " "content:\"one\"; distance:10; within:5; " "content:\"two\"; within:5;" "pkt_data; " "content:\"three\";" "content:\"four\"; distance:5;" "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_PCRE) { result = 0; goto end; } pd = (DetectPcreData *)sm->ctx; if ( pd->flags & DETECT_PCRE_RAWBYTES || !(pd->flags & DETECT_PCRE_RELATIVE)) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("one failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("four failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "four", 4) == 0); if (result == 0) goto end; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectPcreData *pd = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "pcre:/boom/R; " "byte_jump:1,2,relative,align,dce; " "content:\"one\"; within:4; distance:8; " "pkt_data; " "content:\"two\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_PCRE) { result = 0; goto end; } pd = (DetectPcreData *)sm->ctx; if ( pd->flags & DETECT_PCRE_RAWBYTES || !(pd->flags & DETECT_PCRE_RELATIVE)) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bd = (DetectBytejumpData *)sm->ctx; if (bd->flags & DETECT_BYTEJUMP_BEGIN || bd->flags & DETECT_BYTEJUMP_LITTLE || bd->flags & DETECT_BYTEJUMP_BIG || bd->flags & DETECT_BYTEJUMP_STRING || !(bd->flags & DETECT_BYTEJUMP_RELATIVE) || !(bd->flags & DETECT_BYTEJUMP_ALIGN) || !(bd->flags & DETECT_BYTEJUMP_DCE) ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytetestData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "byte_test:1,=,0,0,relative,dce; " "pkt_data; " "content:\"one\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } bd = (DetectBytetestData *)sm->ctx; if (bd->flags & DETECT_BYTETEST_LITTLE || bd->flags & DETECT_BYTETEST_BIG || bd->flags & DETECT_BYTETEST_STRING || !(bd->flags & DETECT_BYTEJUMP_RELATIVE) || !(bd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectIsdataatData *isd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "isdataat:10,relative; " "content:\"one\"; within:4; distance:8; " "pkt_data; " "content:\"two\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isd = (DetectIsdataatData *)sm->ctx; if ( isd->flags & ISDATAAT_RAWBYTES || !(isd->flags & ISDATAAT_RELATIVE)) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest37(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytejumpData *bjd = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "byte_jump:1,2,relative,align,dce; " "byte_test:1,=,2,0,relative,dce; " "pkt_data; " "content:\"one\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags & DETECT_BYTEJUMP_BEGIN || bjd->flags & DETECT_BYTEJUMP_LITTLE || bjd->flags & DETECT_BYTEJUMP_BIG || bjd->flags & DETECT_BYTEJUMP_STRING || !(bjd->flags & DETECT_BYTEJUMP_RELATIVE) || !(bjd->flags & DETECT_BYTEJUMP_ALIGN) || !(bjd->flags & DETECT_BYTEJUMP_DCE) ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags & DETECT_BYTETEST_LITTLE || btd->flags & DETECT_BYTETEST_BIG || btd->flags & DETECT_BYTETEST_STRING || !(btd->flags & DETECT_BYTETEST_RELATIVE) || !(btd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest38(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectPcreData *pd = NULL; DetectBytejumpData *bjd = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "pcre:/boom/R; " "byte_jump:1,2,relative,align,dce; " "byte_test:1,=,2,0,relative,dce; " "pkt_data; " "content:\"one\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_PCRE) { result = 0; goto end; } pd = (DetectPcreData *)sm->ctx; if ( pd->flags & DETECT_PCRE_RAWBYTES || !(pd->flags & DETECT_PCRE_RELATIVE)) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags & DETECT_BYTEJUMP_BEGIN || bjd->flags & DETECT_BYTEJUMP_LITTLE || bjd->flags & DETECT_BYTEJUMP_BIG || bjd->flags & DETECT_BYTEJUMP_STRING || !(bjd->flags & DETECT_BYTEJUMP_RELATIVE) || !(bjd->flags & DETECT_BYTEJUMP_ALIGN) || !(bjd->flags & DETECT_BYTEJUMP_DCE) ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags & DETECT_BYTETEST_LITTLE || btd->flags & DETECT_BYTETEST_BIG || btd->flags & DETECT_BYTETEST_STRING || !(btd->flags & DETECT_BYTETEST_RELATIVE) || !(btd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest39(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "content:\"two\"; within:4; distance:8; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest40(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "content:\"one\"; within:10; " "content:\"two\"; distance:20; within:30; " "byte_test:1,=,2,0,relative,dce; " "pkt_data; " "content:\"three\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags & DETECT_BYTETEST_LITTLE || btd->flags & DETECT_BYTETEST_BIG || btd->flags & DETECT_BYTETEST_STRING || !(btd->flags & DETECT_BYTETEST_RELATIVE) || !(btd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest41(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "content:\"one\"; within:10; " "pkt_data; " "content:\"two\"; " "byte_test:1,=,2,0,relative,dce; " "content:\"three\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags & DETECT_BYTETEST_LITTLE || btd->flags & DETECT_BYTETEST_BIG || btd->flags & DETECT_BYTETEST_STRING || !(btd->flags & DETECT_BYTETEST_RELATIVE) || !(btd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "three", 5) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test the working of consecutive relative matches with a negated content. */ int DcePayloadTest42(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x77, 0x65, 0x20, 0x6e, 0x65, 0x65, 0x64, 0x20, /* "we need " */ 0x74, 0x6f, 0x20, 0x66, 0x69, 0x78, 0x20, 0x74, /* "to fix t" */ 0x68, 0x69, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, /* "his and " */ 0x79, 0x65, 0x73, 0x20, 0x66, 0x69, 0x78, 0x20, /* "yes fix " */ 0x74, 0x68, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x77 /* "this now" */ }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " "content:\"fix\"; distance:0; content:\"this\"; within:6; " "content:!\"and\"; distance:0; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 matched but shouldn't have for packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test the working of consecutive relative pcres. */ int DcePayloadTest43(void) { int result = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x61, 0x20, 0x73, 0x75, 0x70, 0x65, 0x72, 0x20, 0x64, 0x75, 0x70, 0x65, 0x72, 0x20, 0x6e, 0x6f, 0x76, 0x61, 0x20, 0x69, 0x6e, 0x20, 0x73, 0x75, 0x70, 0x65, 0x72, 0x20, 0x6e, 0x6f, 0x76, 0x61, 0x20, 0x6e, 0x6f, 0x77 }; uint32_t request1_len = sizeof(request1); TcpSession ssn; Packet *p = NULL; ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; int r; char *sig1 = "alert tcp any any -> any any " "(msg:\"testing dce consecutive relative matches\"; dce_stub_data; " "pcre:/super/R; content:\"nova\"; within:7; sid:1;)"; Signature *s; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); s = de_ctx->sig_list; if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* request 1 */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* detection phase */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if ( !(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest44(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectIsdataatData *isd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "content:\"one\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "dce_opnum:10; dce_stub_data; " "isdataat:10,relative; " "content:\"one\"; within:4; distance:8; " "pkt_data; " "content:\"two\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_ISDATAAT) { result = 0; goto end; } isd = (DetectIsdataatData *)sm->ctx; if ( isd->flags & ISDATAAT_RAWBYTES || !(isd->flags & ISDATAAT_RELATIVE)) { result = 0; goto end; } sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { result = 0; printf("two failed\n"); goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { printf("three failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest45(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytejumpData *bjd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "content:\"one\"; " "dce_opnum:10; dce_stub_data; " "byte_jump:1,2,relative,align,dce; " "pkt_data; " "content:\"two\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; } bjd = (DetectBytejumpData *)sm->ctx; if (bjd->flags & DETECT_BYTEJUMP_BEGIN || bjd->flags & DETECT_BYTEJUMP_LITTLE || bjd->flags & DETECT_BYTEJUMP_BIG || bjd->flags & DETECT_BYTEJUMP_STRING || !(bjd->flags & DETECT_BYTEJUMP_RELATIVE) || !(bjd->flags & DETECT_BYTEJUMP_ALIGN) || !(bjd->flags & DETECT_BYTEJUMP_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DcePayloadParseTest46(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; SigMatch *sm = NULL; DetectContentData *data = NULL; DetectBytetestData *btd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:12345678-1234-1234-1234-123456789012; " "content:\"one\"; " "dce_opnum:10; dce_stub_data; " "byte_test:1,=,2,0,relative,dce; " "pkt_data; " "content:\"two\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } sm = s->sm_lists[DETECT_SM_LIST_DMATCH]; if (sm->type != DETECT_BYTETEST) { result = 0; goto end; } btd = (DetectBytetestData *)sm->ctx; if (btd->flags & DETECT_BYTETEST_LITTLE || btd->flags & DETECT_BYTETEST_BIG || btd->flags & DETECT_BYTETEST_STRING || !(btd->flags & DETECT_BYTETEST_RELATIVE) || !(btd->flags & DETECT_BYTETEST_DCE) ) { result = 0; printf("one failed\n"); goto end; } result &= (sm->next == NULL); sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { printf("one failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "one", 3) == 0); if (result == 0) goto end; sm = sm->next; if (sm->type != DETECT_CONTENT) { result = 0; goto end; } data = (DetectContentData *)sm->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_RELATIVE_NEXT || data->flags & DETECT_CONTENT_NEGATED ) { printf("two failed\n"); result = 0; goto end; } result &= (strncmp((char *)data->content, "two", 3) == 0); if (result == 0) goto end; result &= (sm->next == NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DcePayloadRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DcePayloadTest01", DcePayloadTest01); UtRegisterTest("DcePayloadTest02", DcePayloadTest02); UtRegisterTest("DcePayloadTest03", DcePayloadTest03); UtRegisterTest("DcePayloadTest04", DcePayloadTest04); UtRegisterTest("DcePayloadTest05", DcePayloadTest05); UtRegisterTest("DcePayloadTest06", DcePayloadTest06); UtRegisterTest("DcePayloadTest07", DcePayloadTest07); UtRegisterTest("DcePayloadTest08", DcePayloadTest08); UtRegisterTest("DcePayloadTest09", DcePayloadTest09); UtRegisterTest("DcePayloadTest10", DcePayloadTest10); UtRegisterTest("DcePayloadTest11", DcePayloadTest11); UtRegisterTest("DcePayloadTest12", DcePayloadTest12); /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 UtRegisterTest("DcePayloadTest13", DcePayloadTest13, 1); UtRegisterTest("DcePayloadTest14", DcePayloadTest14, 1); #endif UtRegisterTest("DcePayloadTest15", DcePayloadTest15); UtRegisterTest("DcePayloadTest16", DcePayloadTest16); UtRegisterTest("DcePayloadTest17", DcePayloadTest17); UtRegisterTest("DcePayloadTest18", DcePayloadTest18); UtRegisterTest("DcePayloadTest19", DcePayloadTest19); UtRegisterTest("DcePayloadTest20", DcePayloadTest20); UtRegisterTest("DcePayloadTest21", DcePayloadTest21); UtRegisterTest("DcePayloadTest22", DcePayloadTest22); UtRegisterTest("DcePayloadTest23", DcePayloadTest23); UtRegisterTest("DcePayloadParseTest25", DcePayloadParseTest25); UtRegisterTest("DcePayloadParseTest26", DcePayloadParseTest26); UtRegisterTest("DcePayloadParseTest27", DcePayloadParseTest27); UtRegisterTest("DcePayloadParseTest28", DcePayloadParseTest28); UtRegisterTest("DcePayloadParseTest29", DcePayloadParseTest29); UtRegisterTest("DcePayloadParseTest30", DcePayloadParseTest30); UtRegisterTest("DcePayloadParseTest31", DcePayloadParseTest31); UtRegisterTest("DcePayloadParseTest32", DcePayloadParseTest32); UtRegisterTest("DcePayloadParseTest33", DcePayloadParseTest33); UtRegisterTest("DcePayloadParseTest34", DcePayloadParseTest34); UtRegisterTest("DcePayloadParseTest35", DcePayloadParseTest35); UtRegisterTest("DcePayloadParseTest36", DcePayloadParseTest36); UtRegisterTest("DcePayloadParseTest37", DcePayloadParseTest37); UtRegisterTest("DcePayloadParseTest38", DcePayloadParseTest38); UtRegisterTest("DcePayloadParseTest39", DcePayloadParseTest39); UtRegisterTest("DcePayloadParseTest40", DcePayloadParseTest40); UtRegisterTest("DcePayloadParseTest41", DcePayloadParseTest41); UtRegisterTest("DcePayloadTest42", DcePayloadTest42); UtRegisterTest("DcePayloadTest43", DcePayloadTest43); UtRegisterTest("DcePayloadParseTest44", DcePayloadParseTest44); UtRegisterTest("DcePayloadParseTest45", DcePayloadParseTest45); UtRegisterTest("DcePayloadParseTest46", DcePayloadParseTest46); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/flow-var.c0000644000000000000000000001075513051004444012712 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon * * Flow level variable support for complex detection rules * Supported types atm are String and Integers */ #include "suricata-common.h" #include "threads.h" #include "flow-var.h" #include "flow.h" #include "detect.h" #include "util-debug.h" /* puts a new value into a flowvar */ static void FlowVarUpdateStr(FlowVar *fv, uint8_t *value, uint16_t size) { if (fv->data.fv_str.value) SCFree(fv->data.fv_str.value); fv->data.fv_str.value = value; fv->data.fv_str.value_len = size; } /* puts a new value into a flowvar */ static void FlowVarUpdateInt(FlowVar *fv, uint32_t value) { fv->data.fv_int.value = value; } /** \brief get the flowvar with index 'idx' from the flow * \note flow is not locked by this function, caller is * responsible */ FlowVar *FlowVarGet(Flow *f, uint16_t idx) { GenericVar *gv = f->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_FLOWVAR && gv->idx == idx) return (FlowVar *)gv; } return NULL; } /* add a flowvar to the flow, or update it */ void FlowVarAddStrNoLock(Flow *f, uint16_t idx, uint8_t *value, uint16_t size) { FlowVar *fv = FlowVarGet(f, idx); if (fv == NULL) { fv = SCMalloc(sizeof(FlowVar)); if (unlikely(fv == NULL)) return; fv->type = DETECT_FLOWVAR; fv->datatype = FLOWVAR_TYPE_STR; fv->idx = idx; fv->data.fv_str.value = value; fv->data.fv_str.value_len = size; fv->next = NULL; GenericVarAppend(&f->flowvar, (GenericVar *)fv); } else { FlowVarUpdateStr(fv, value, size); } } /* add a flowvar to the flow, or update it */ void FlowVarAddStr(Flow *f, uint16_t idx, uint8_t *value, uint16_t size) { FlowVarAddStrNoLock(f, idx, value, size); } /* add a flowvar to the flow, or update it */ void FlowVarAddIntNoLock(Flow *f, uint16_t idx, uint32_t value) { FlowVar *fv = FlowVarGet(f, idx); if (fv == NULL) { fv = SCMalloc(sizeof(FlowVar)); if (unlikely(fv == NULL)) return; fv->type = DETECT_FLOWVAR; fv->datatype = FLOWVAR_TYPE_INT; fv->idx = idx; fv->data.fv_int.value= value; fv->next = NULL; GenericVarAppend(&f->flowvar, (GenericVar *)fv); } else { FlowVarUpdateInt(fv, value); } } /* add a flowvar to the flow, or update it */ void FlowVarAddInt(Flow *f, uint16_t idx, uint32_t value) { FlowVarAddIntNoLock(f, idx, value); } void FlowVarFree(FlowVar *fv) { if (fv == NULL) return; if (fv->datatype == FLOWVAR_TYPE_STR) { if (fv->data.fv_str.value != NULL) SCFree(fv->data.fv_str.value); } SCFree(fv); } void FlowVarPrint(GenericVar *gv) { uint16_t u; if (!SCLogDebugEnabled()) return; if (gv == NULL) return; if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) { FlowVar *fv = (FlowVar *)gv; if (fv->datatype == FLOWVAR_TYPE_STR) { SCLogDebug("Name idx \"%" PRIu16 "\", Value \"", fv->idx); for (u = 0; u < fv->data.fv_str.value_len; u++) { if (isprint(fv->data.fv_str.value[u])) SCLogDebug("%c", fv->data.fv_str.value[u]); else SCLogDebug("\\%02X", fv->data.fv_str.value[u]); } SCLogDebug("\", Len \"%" PRIu16 "\"\n", fv->data.fv_str.value_len); } else if (fv->datatype == FLOWVAR_TYPE_INT) { SCLogDebug("Name idx \"%" PRIu16 "\", Value \"%" PRIu32 "\"", fv->idx, fv->data.fv_int.value); } else { SCLogDebug("Unknown data type at flowvars\n"); } } FlowVarPrint(gv->next); } suricata-3.2.1/src/util-spm.c0000644000000000000000000037255613051004444012741 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * PR (17/01/2010): Single pattern search algorithms: * Currently there are 3 algorithms to choose: BasicSearch, Bs2Bm and * BoyerMoore (Boyer Moores algorithm). The first one doesn't need a context. * But for Bs2Bm and BoyerMoore, you'll need to build some arrays. * * !! If you are going to use the same pattern multiple times, * please, try to store the context some where. For Bs2Bm, the * context is an array of "badchars". For BoyerMoore you need to store * two arrays of shifts. Have a look at the wrappers and unittests * for examples of this. If you cant store the context, use the * wrappers: Bs2bmSearch, BoyerMooreSearch, and the ones caseless, or BasicSearch * That is the most basic. * * Use the stats and util-clock.h to determine which one fit better for you * Boyer Moore should be used for patterns greater than 1 of length * In the range of 2 - 6, if the text length is greater than 1000 you could * use boyer moore, otherwise, basic search. If the pattern is greater * than 6 and the textlen is greater than 500, use boyer moore. * This is an aproximation, but use the stats and util-clock to determine which one * fit better for your case. * */ #include "suricata-common.h" #include "suricata.h" #include "util-unittest.h" #include "conf.h" #include "util-spm.h" #include "util-spm-bs.h" #include "util-spm-bs2bm.h" #include "util-spm-bm.h" #include "util-spm-hs.h" #include "util-clock.h" #ifdef BUILD_HYPERSCAN #include "hs.h" #endif /** * \brief Returns the single pattern matcher algorithm to be used, based on the * spm-algo setting in yaml. */ uint16_t SinglePatternMatchDefaultMatcher(void) { char *spm_algo; if ((ConfGet("spm-algo", &spm_algo)) == 1) { if (spm_algo != NULL) { if (strcmp("auto", spm_algo) == 0) { goto default_matcher; } for (uint16_t i = 0; i < SPM_TABLE_SIZE; i++) { if (spm_table[i].name == NULL) { continue; } if (strcmp(spm_table[i].name, spm_algo) == 0) { return i; } } } SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid spm algo supplied " "in the yaml conf file: \"%s\"", spm_algo); exit(EXIT_FAILURE); } default_matcher: /* When Suricata is built with Hyperscan support, default to using it for * SPM. */ #ifdef BUILD_HYPERSCAN #ifdef HAVE_HS_VALID_PLATFORM /* Enable runtime check for SSSE3. Do not use Hyperscan SPM matcher if * check is not successful. */ if (hs_valid_platform() != HS_SUCCESS) { SCLogInfo("SSSE3 support not detected, disabling Hyperscan for " "SPM"); /* Use Boyer-Moore as fallback. */ return SPM_BM; } else { return SPM_HS; } #else return SPM_HS; #endif #else /* Otherwise, default to Boyer-Moore */ return SPM_BM; #endif } void SpmTableSetup(void) { memset(spm_table, 0, sizeof(spm_table)); SpmBMRegister(); #ifdef BUILD_HYPERSCAN #ifdef HAVE_HS_VALID_PLATFORM if (hs_valid_platform() == HS_SUCCESS) { SpmHSRegister(); } #else SpmHSRegister(); #endif #endif } SpmGlobalThreadCtx *SpmInitGlobalThreadCtx(uint16_t matcher) { BUG_ON(spm_table[matcher].InitGlobalThreadCtx == NULL); return spm_table[matcher].InitGlobalThreadCtx(); } void SpmDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx) { if (global_thread_ctx == NULL) { return; } uint16_t matcher = global_thread_ctx->matcher; spm_table[matcher].DestroyGlobalThreadCtx(global_thread_ctx); } SpmThreadCtx *SpmMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx) { if (global_thread_ctx == NULL) { return NULL; } uint16_t matcher = global_thread_ctx->matcher; BUG_ON(spm_table[matcher].MakeThreadCtx == NULL); return spm_table[matcher].MakeThreadCtx(global_thread_ctx); } void SpmDestroyThreadCtx(SpmThreadCtx *thread_ctx) { if (thread_ctx == NULL) { return; } uint16_t matcher = thread_ctx->matcher; BUG_ON(spm_table[matcher].DestroyThreadCtx == NULL); spm_table[matcher].DestroyThreadCtx(thread_ctx); } SpmCtx *SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx) { BUG_ON(global_thread_ctx == NULL); uint16_t matcher = global_thread_ctx->matcher; BUG_ON(spm_table[matcher].InitCtx == NULL); return spm_table[matcher].InitCtx(needle, needle_len, nocase, global_thread_ctx); } void SpmDestroyCtx(SpmCtx *ctx) { if (ctx == NULL) { return; } uint16_t matcher = ctx->matcher; BUG_ON(spm_table[matcher].DestroyCtx == NULL); spm_table[matcher].DestroyCtx(ctx); } uint8_t *SpmScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint16_t haystack_len) { uint16_t matcher = ctx->matcher; return spm_table[matcher].Scan(ctx, thread_ctx, haystack, haystack_len); } /** * Wrappers for building context and searching (Bs2Bm and boyermoore) * Use them if you cant store the context * */ /** * \brief Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array) * * \param text Text to search in * \param textlen length of the text * \param needle pattern to search for * \param needlelen length of the pattern */ uint8_t *Bs2bmSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen) { uint8_t badchars[ALPHABET_SIZE]; Bs2BmBadchars(needle, needlelen, badchars); return Bs2Bm(text, textlen, needle, needlelen, badchars); } /** * \brief Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array) * * \param text Text to search in * \param textlen length of the text * \param needle pattern to search for * \param needlelen length of the pattern */ uint8_t *Bs2bmNocaseSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen) { uint8_t badchars[ALPHABET_SIZE]; Bs2BmBadchars(needle, needlelen, badchars); return Bs2BmNocase(text, textlen, needle, needlelen, badchars); } /** * \brief Search a pattern in the text using Boyer Moore algorithm * (build a bad character shifts array and good prefixes shift array) * * \param text Text to search in * \param textlen length of the text * \param needle pattern to search for * \param needlelen length of the pattern */ uint8_t *BoyerMooreSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen) { BmCtx *bm_ctx = BoyerMooreCtxInit(needle, needlelen); uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bm_ctx); BoyerMooreCtxDeInit(bm_ctx); return ret; } /** * \brief Search a pattern in the text using Boyer Moore nocase algorithm * (build a bad character shifts array and good prefixes shift array) * * \param text Text to search in * \param textlen length of the text * \param needle pattern to search for * \param needlelen length of the pattern */ uint8_t *BoyerMooreNocaseSearch(const uint8_t *text, uint32_t textlen, uint8_t *needle, uint16_t needlelen) { BmCtx *bm_ctx = BoyerMooreNocaseCtxInit(needle, needlelen); uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bm_ctx); BoyerMooreCtxDeInit(bm_ctx); return ret; } #ifdef UNITTESTS /** Comment out this if you want stats * #define ENABLE_SEARCH_STATS 1 */ /* Number of times to repeat the search (for stats) */ #define STATS_TIMES 1000000 /** * \brief Unittest helper function wrappers for the search algorithms * \param text pointer to the buffer to search in * \param needle pointer to the pattern to search for * \param times If you are testing performance, se the numebr of times * that you want to repeat the search */ uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = BasicSearch(text, textlen, needle, needlelen); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = BasicSearchNocase(text, textlen, needle, needlelen); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t badchars[ALPHABET_SIZE]; Bs2BmBadchars(needle, needlelen, badchars); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = Bs2Bm(text, textlen, needle, needlelen, badchars); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t badchars[ALPHABET_SIZE]; Bs2BmBadchars(needle, needlelen, badchars); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = Bs2BmNocase(text, textlen, needle, needlelen, badchars); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); BmCtx *bm_ctx = BoyerMooreCtxInit(needle, needlelen); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = BoyerMoore(needle, needlelen, text, textlen, bm_ctx); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; BoyerMooreCtxDeInit(bm_ctx); return ret; } uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *in_needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)in_needle); /* Make a copy of in_needle to be able to convert it to lowercase. */ uint8_t *needle = SCMalloc(needlelen); if (needle == NULL) return NULL; memcpy(needle, in_needle, needlelen); BmCtx *bm_ctx = BoyerMooreNocaseCtxInit(needle, needlelen); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = BoyerMooreNocase(needle, needlelen, text, textlen, bm_ctx); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; BoyerMooreCtxDeInit(bm_ctx); free(needle); return ret; } /** * \brief Unittest helper function wrappers for the search algorithms * \param text pointer to the buffer to search in * \param needle pointer to the pattern to search for * \param times If you are testing performance, se the numebr of times * that you want to repeat the search */ uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { /* This wrapper is a fake, no context needed! */ ret = BasicSearch(text, textlen, needle, needlelen); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { /* This wrapper is a fake, no context needed! */ ret = BasicSearchNocase(text, textlen, needle, needlelen); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t badchars[ALPHABET_SIZE]; uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { /* Stats including context building */ Bs2BmBadchars(needle, needlelen, badchars); ret = Bs2Bm(text, textlen, needle, needlelen, badchars); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t badchars[ALPHABET_SIZE]; uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { /* Stats including context building */ Bs2BmBadchars(needle, needlelen, badchars); ret = Bs2BmNocase(text, textlen, needle, needlelen, badchars); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); BmCtx *bm_ctx = BoyerMooreCtxInit(needle, needlelen); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { /* Stats including context building */ ret = BoyerMoore(needle, needlelen, text, textlen, bm_ctx); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; BoyerMooreCtxDeInit(bm_ctx); return ret; } uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)needle); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = SpmSearch(text, textlen, needle, needlelen); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; return ret; } uint8_t *BoyerMooreNocaseCtxWrapper(uint8_t *text, uint8_t *in_needle, int times) { uint32_t textlen = strlen((char *)text); uint16_t needlelen = strlen((char *)in_needle); /* Make a copy of in_needle to be able to convert it to lowercase. */ uint8_t *needle = SCMalloc(needlelen); if (needle == NULL) return NULL; memcpy(needle, in_needle, needlelen); BmCtx *bm_ctx = BoyerMooreNocaseCtxInit(needle, needlelen); uint8_t *ret = NULL; int i = 0; CLOCK_INIT; if (times > 1) CLOCK_START; for (i = 0; i < times; i++) { ret = BoyerMooreNocase(needle, needlelen, text, textlen, bm_ctx); } if (times > 1) { CLOCK_END; CLOCK_PRINT_SEC; }; BoyerMooreCtxDeInit(bm_ctx); free(needle); return ret; } /** * \test Generic test for BasicSearch matching */ int UtilSpmBasicSearchTest01() { uint8_t *needle = (uint8_t *)"oPqRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BasicSearchWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test Generic test for BasicSearch nocase matching */ int UtilSpmBasicSearchNocaseTest01() { uint8_t *needle = (uint8_t *)"OpQrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BasicSearchNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test Generic test for Bs2Bm matching */ int UtilSpmBs2bmSearchTest01() { uint8_t *needle = (uint8_t *)"oPqRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = Bs2bmWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test Generic test for Bs2Bm no case matching */ int UtilSpmBs2bmSearchNocaseTest01() { uint8_t *needle = (uint8_t *)"OpQrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = Bs2bmNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test Generic test for boyer moore matching */ int UtilSpmBoyerMooreSearchTest01() { uint8_t *needle = (uint8_t *)"oPqRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BoyerMooreWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test Generic test for boyer moore nocase matching */ int UtilSpmBoyerMooreSearchNocaseTest01() { uint8_t *needle = (uint8_t *)"OpQrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BoyerMooreNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /** * \test issue 130 (@redmine) check to ensure that the * problem is not the algorithm implementation */ int UtilSpmBoyerMooreSearchNocaseTestIssue130() { uint8_t *needle = (uint8_t *)"WWW-Authenticate: "; uint8_t *text = (uint8_t *)"Date: Mon, 23 Feb 2009 13:31:49 GMT" "Server: Apache\r\n" "Www-authenticate: Basic realm=\"Authentification user password\"\r\n" "Vary: accept-language,accept-charset\r\n" "Accept-ranges: bytes\r\n" "Connection: close\r\n" "Content-type: text/html; charset=iso-8859-1\r\n" "Content-language: fr\r\n" "Expires: Mon, 23 Feb 2009 13:31:49 GMT\r\n\r\n"; uint8_t *found = BoyerMooreNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 1; else return 0; } /* Generic tests that should not match */ int UtilSpmBasicSearchTest02() { uint8_t *needle = (uint8_t *)"oPQRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BasicSearchWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } int UtilSpmBasicSearchNocaseTest02() { uint8_t *needle = (uint8_t *)"OpZrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BasicSearchNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } int UtilSpmBs2bmSearchTest02() { uint8_t *needle = (uint8_t *)"oPQRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = Bs2bmWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } int UtilSpmBs2bmSearchNocaseTest02() { uint8_t *needle = (uint8_t *)"OpZrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = Bs2bmNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } int UtilSpmBoyerMooreSearchTest02() { uint8_t *needle = (uint8_t *)"oPQRsT"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BoyerMooreWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } int UtilSpmBoyerMooreSearchNocaseTest02() { uint8_t *needle = (uint8_t *)"OpZrSt"; uint8_t *text = (uint8_t *)"aBcDeFgHiJkLmNoPqRsTuVwXyZ"; uint8_t *found = BoyerMooreNocaseWrapper(text, needle, 1); //printf("found: %s\n", found); if (found != NULL) return 0; else return 1; } /** * \test Check that all the algorithms work at any offset and any pattern length */ int UtilSpmSearchOffsetsTest01() { char *text[26][27]; text[0][0]="azzzzzzzzzzzzzzzzzzzzzzzzzz"; text[0][1]="zazzzzzzzzzzzzzzzzzzzzzzzzz"; text[0][2]="zzazzzzzzzzzzzzzzzzzzzzzzzz"; text[0][3]="zzzazzzzzzzzzzzzzzzzzzzzzzz"; text[0][4]="zzzzazzzzzzzzzzzzzzzzzzzzzz"; text[0][5]="zzzzzazzzzzzzzzzzzzzzzzzzzz"; text[0][6]="zzzzzzazzzzzzzzzzzzzzzzzzzz"; text[0][7]="zzzzzzzazzzzzzzzzzzzzzzzzzz"; text[0][8]="zzzzzzzzazzzzzzzzzzzzzzzzzz"; text[0][9]="zzzzzzzzzazzzzzzzzzzzzzzzzz"; text[0][10]="zzzzzzzzzzazzzzzzzzzzzzzzzz"; text[0][11]="zzzzzzzzzzzazzzzzzzzzzzzzzz"; text[0][12]="zzzzzzzzzzzzazzzzzzzzzzzzzz"; text[0][13]="zzzzzzzzzzzzzazzzzzzzzzzzzz"; text[0][14]="zzzzzzzzzzzzzzazzzzzzzzzzzz"; text[0][15]="zzzzzzzzzzzzzzzazzzzzzzzzzz"; text[0][16]="zzzzzzzzzzzzzzzzazzzzzzzzzz"; text[0][17]="zzzzzzzzzzzzzzzzzazzzzzzzzz"; text[0][18]="zzzzzzzzzzzzzzzzzzazzzzzzzz"; text[0][19]="zzzzzzzzzzzzzzzzzzzazzzzzzz"; text[0][20]="zzzzzzzzzzzzzzzzzzzzazzzzzz"; text[0][21]="zzzzzzzzzzzzzzzzzzzzzazzzzz"; text[0][22]="zzzzzzzzzzzzzzzzzzzzzzazzzz"; text[0][23]="zzzzzzzzzzzzzzzzzzzzzzzazzz"; text[0][24]="zzzzzzzzzzzzzzzzzzzzzzzzazz"; text[0][25]="zzzzzzzzzzzzzzzzzzzzzzzzzaz"; text[0][26]="zzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1][0]="aBzzzzzzzzzzzzzzzzzzzzzzzzz"; text[1][1]="zaBzzzzzzzzzzzzzzzzzzzzzzzz"; text[1][2]="zzaBzzzzzzzzzzzzzzzzzzzzzzz"; text[1][3]="zzzaBzzzzzzzzzzzzzzzzzzzzzz"; text[1][4]="zzzzaBzzzzzzzzzzzzzzzzzzzzz"; text[1][5]="zzzzzaBzzzzzzzzzzzzzzzzzzzz"; text[1][6]="zzzzzzaBzzzzzzzzzzzzzzzzzzz"; text[1][7]="zzzzzzzaBzzzzzzzzzzzzzzzzzz"; text[1][8]="zzzzzzzzaBzzzzzzzzzzzzzzzzz"; text[1][9]="zzzzzzzzzaBzzzzzzzzzzzzzzzz"; text[1][10]="zzzzzzzzzzaBzzzzzzzzzzzzzzz"; text[1][11]="zzzzzzzzzzzaBzzzzzzzzzzzzzz"; text[1][12]="zzzzzzzzzzzzaBzzzzzzzzzzzzz"; text[1][13]="zzzzzzzzzzzzzaBzzzzzzzzzzzz"; text[1][14]="zzzzzzzzzzzzzzaBzzzzzzzzzzz"; text[1][15]="zzzzzzzzzzzzzzzaBzzzzzzzzzz"; text[1][16]="zzzzzzzzzzzzzzzzaBzzzzzzzzz"; text[1][17]="zzzzzzzzzzzzzzzzzaBzzzzzzzz"; text[1][18]="zzzzzzzzzzzzzzzzzzaBzzzzzzz"; text[1][19]="zzzzzzzzzzzzzzzzzzzaBzzzzzz"; text[1][20]="zzzzzzzzzzzzzzzzzzzzaBzzzzz"; text[1][21]="zzzzzzzzzzzzzzzzzzzzzaBzzzz"; text[1][22]="zzzzzzzzzzzzzzzzzzzzzzaBzzz"; text[1][23]="zzzzzzzzzzzzzzzzzzzzzzzaBzz"; text[1][24]="zzzzzzzzzzzzzzzzzzzzzzzzaBz"; text[1][25]="zzzzzzzzzzzzzzzzzzzzzzzzzaB"; text[2][0]="aBczzzzzzzzzzzzzzzzzzzzzzzz"; text[2][1]="zaBczzzzzzzzzzzzzzzzzzzzzzz"; text[2][2]="zzaBczzzzzzzzzzzzzzzzzzzzzz"; text[2][3]="zzzaBczzzzzzzzzzzzzzzzzzzzz"; text[2][4]="zzzzaBczzzzzzzzzzzzzzzzzzzz"; text[2][5]="zzzzzaBczzzzzzzzzzzzzzzzzzz"; text[2][6]="zzzzzzaBczzzzzzzzzzzzzzzzzz"; text[2][7]="zzzzzzzaBczzzzzzzzzzzzzzzzz"; text[2][8]="zzzzzzzzaBczzzzzzzzzzzzzzzz"; text[2][9]="zzzzzzzzzaBczzzzzzzzzzzzzzz"; text[2][10]="zzzzzzzzzzaBczzzzzzzzzzzzzz"; text[2][11]="zzzzzzzzzzzaBczzzzzzzzzzzzz"; text[2][12]="zzzzzzzzzzzzaBczzzzzzzzzzzz"; text[2][13]="zzzzzzzzzzzzzaBczzzzzzzzzzz"; text[2][14]="zzzzzzzzzzzzzzaBczzzzzzzzzz"; text[2][15]="zzzzzzzzzzzzzzzaBczzzzzzzzz"; text[2][16]="zzzzzzzzzzzzzzzzaBczzzzzzzz"; text[2][17]="zzzzzzzzzzzzzzzzzaBczzzzzzz"; text[2][18]="zzzzzzzzzzzzzzzzzzaBczzzzzz"; text[2][19]="zzzzzzzzzzzzzzzzzzzaBczzzzz"; text[2][20]="zzzzzzzzzzzzzzzzzzzzaBczzzz"; text[2][21]="zzzzzzzzzzzzzzzzzzzzzaBczzz"; text[2][22]="zzzzzzzzzzzzzzzzzzzzzzaBczz"; text[2][23]="zzzzzzzzzzzzzzzzzzzzzzzaBcz"; text[2][24]="zzzzzzzzzzzzzzzzzzzzzzzzaBc"; text[3][0]="aBcDzzzzzzzzzzzzzzzzzzzzzzz"; text[3][1]="zaBcDzzzzzzzzzzzzzzzzzzzzzz"; text[3][2]="zzaBcDzzzzzzzzzzzzzzzzzzzzz"; text[3][3]="zzzaBcDzzzzzzzzzzzzzzzzzzzz"; text[3][4]="zzzzaBcDzzzzzzzzzzzzzzzzzzz"; text[3][5]="zzzzzaBcDzzzzzzzzzzzzzzzzzz"; text[3][6]="zzzzzzaBcDzzzzzzzzzzzzzzzzz"; text[3][7]="zzzzzzzaBcDzzzzzzzzzzzzzzzz"; text[3][8]="zzzzzzzzaBcDzzzzzzzzzzzzzzz"; text[3][9]="zzzzzzzzzaBcDzzzzzzzzzzzzzz"; text[3][10]="zzzzzzzzzzaBcDzzzzzzzzzzzzz"; text[3][11]="zzzzzzzzzzzaBcDzzzzzzzzzzzz"; text[3][12]="zzzzzzzzzzzzaBcDzzzzzzzzzzz"; text[3][13]="zzzzzzzzzzzzzaBcDzzzzzzzzzz"; text[3][14]="zzzzzzzzzzzzzzaBcDzzzzzzzzz"; text[3][15]="zzzzzzzzzzzzzzzaBcDzzzzzzzz"; text[3][16]="zzzzzzzzzzzzzzzzaBcDzzzzzzz"; text[3][17]="zzzzzzzzzzzzzzzzzaBcDzzzzzz"; text[3][18]="zzzzzzzzzzzzzzzzzzaBcDzzzzz"; text[3][19]="zzzzzzzzzzzzzzzzzzzaBcDzzzz"; text[3][20]="zzzzzzzzzzzzzzzzzzzzaBcDzzz"; text[3][21]="zzzzzzzzzzzzzzzzzzzzzaBcDzz"; text[3][22]="zzzzzzzzzzzzzzzzzzzzzzaBcDz"; text[3][23]="zzzzzzzzzzzzzzzzzzzzzzzaBcD"; text[4][0]="aBcDezzzzzzzzzzzzzzzzzzzzzz"; text[4][1]="zaBcDezzzzzzzzzzzzzzzzzzzzz"; text[4][2]="zzaBcDezzzzzzzzzzzzzzzzzzzz"; text[4][3]="zzzaBcDezzzzzzzzzzzzzzzzzzz"; text[4][4]="zzzzaBcDezzzzzzzzzzzzzzzzzz"; text[4][5]="zzzzzaBcDezzzzzzzzzzzzzzzzz"; text[4][6]="zzzzzzaBcDezzzzzzzzzzzzzzzz"; text[4][7]="zzzzzzzaBcDezzzzzzzzzzzzzzz"; text[4][8]="zzzzzzzzaBcDezzzzzzzzzzzzzz"; text[4][9]="zzzzzzzzzaBcDezzzzzzzzzzzzz"; text[4][10]="zzzzzzzzzzaBcDezzzzzzzzzzzz"; text[4][11]="zzzzzzzzzzzaBcDezzzzzzzzzzz"; text[4][12]="zzzzzzzzzzzzaBcDezzzzzzzzzz"; text[4][13]="zzzzzzzzzzzzzaBcDezzzzzzzzz"; text[4][14]="zzzzzzzzzzzzzzaBcDezzzzzzzz"; text[4][15]="zzzzzzzzzzzzzzzaBcDezzzzzzz"; text[4][16]="zzzzzzzzzzzzzzzzaBcDezzzzzz"; text[4][17]="zzzzzzzzzzzzzzzzzaBcDezzzzz"; text[4][18]="zzzzzzzzzzzzzzzzzzaBcDezzzz"; text[4][19]="zzzzzzzzzzzzzzzzzzzaBcDezzz"; text[4][20]="zzzzzzzzzzzzzzzzzzzzaBcDezz"; text[4][21]="zzzzzzzzzzzzzzzzzzzzzaBcDez"; text[4][22]="zzzzzzzzzzzzzzzzzzzzzzaBcDe"; text[5][0]="aBcDeFzzzzzzzzzzzzzzzzzzzzz"; text[5][1]="zaBcDeFzzzzzzzzzzzzzzzzzzzz"; text[5][2]="zzaBcDeFzzzzzzzzzzzzzzzzzzz"; text[5][3]="zzzaBcDeFzzzzzzzzzzzzzzzzzz"; text[5][4]="zzzzaBcDeFzzzzzzzzzzzzzzzzz"; text[5][5]="zzzzzaBcDeFzzzzzzzzzzzzzzzz"; text[5][6]="zzzzzzaBcDeFzzzzzzzzzzzzzzz"; text[5][7]="zzzzzzzaBcDeFzzzzzzzzzzzzzz"; text[5][8]="zzzzzzzzaBcDeFzzzzzzzzzzzzz"; text[5][9]="zzzzzzzzzaBcDeFzzzzzzzzzzzz"; text[5][10]="zzzzzzzzzzaBcDeFzzzzzzzzzzz"; text[5][11]="zzzzzzzzzzzaBcDeFzzzzzzzzzz"; text[5][12]="zzzzzzzzzzzzaBcDeFzzzzzzzzz"; text[5][13]="zzzzzzzzzzzzzaBcDeFzzzzzzzz"; text[5][14]="zzzzzzzzzzzzzzaBcDeFzzzzzzz"; text[5][15]="zzzzzzzzzzzzzzzaBcDeFzzzzzz"; text[5][16]="zzzzzzzzzzzzzzzzaBcDeFzzzzz"; text[5][17]="zzzzzzzzzzzzzzzzzaBcDeFzzzz"; text[5][18]="zzzzzzzzzzzzzzzzzzaBcDeFzzz"; text[5][19]="zzzzzzzzzzzzzzzzzzzaBcDeFzz"; text[5][20]="zzzzzzzzzzzzzzzzzzzzaBcDeFz"; text[5][21]="zzzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6][0]="aBcDeFgzzzzzzzzzzzzzzzzzzzz"; text[6][1]="zaBcDeFgzzzzzzzzzzzzzzzzzzz"; text[6][2]="zzaBcDeFgzzzzzzzzzzzzzzzzzz"; text[6][3]="zzzaBcDeFgzzzzzzzzzzzzzzzzz"; text[6][4]="zzzzaBcDeFgzzzzzzzzzzzzzzzz"; text[6][5]="zzzzzaBcDeFgzzzzzzzzzzzzzzz"; text[6][6]="zzzzzzaBcDeFgzzzzzzzzzzzzzz"; text[6][7]="zzzzzzzaBcDeFgzzzzzzzzzzzzz"; text[6][8]="zzzzzzzzaBcDeFgzzzzzzzzzzzz"; text[6][9]="zzzzzzzzzaBcDeFgzzzzzzzzzzz"; text[6][10]="zzzzzzzzzzaBcDeFgzzzzzzzzzz"; text[6][11]="zzzzzzzzzzzaBcDeFgzzzzzzzzz"; text[6][12]="zzzzzzzzzzzzaBcDeFgzzzzzzzz"; text[6][13]="zzzzzzzzzzzzzaBcDeFgzzzzzzz"; text[6][14]="zzzzzzzzzzzzzzaBcDeFgzzzzzz"; text[6][15]="zzzzzzzzzzzzzzzaBcDeFgzzzzz"; text[6][16]="zzzzzzzzzzzzzzzzaBcDeFgzzzz"; text[6][17]="zzzzzzzzzzzzzzzzzaBcDeFgzzz"; text[6][18]="zzzzzzzzzzzzzzzzzzaBcDeFgzz"; text[6][19]="zzzzzzzzzzzzzzzzzzzaBcDeFgz"; text[6][20]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7][0]="aBcDeFgHzzzzzzzzzzzzzzzzzzz"; text[7][1]="zaBcDeFgHzzzzzzzzzzzzzzzzzz"; text[7][2]="zzaBcDeFgHzzzzzzzzzzzzzzzzz"; text[7][3]="zzzaBcDeFgHzzzzzzzzzzzzzzzz"; text[7][4]="zzzzaBcDeFgHzzzzzzzzzzzzzzz"; text[7][5]="zzzzzaBcDeFgHzzzzzzzzzzzzzz"; text[7][6]="zzzzzzaBcDeFgHzzzzzzzzzzzzz"; text[7][7]="zzzzzzzaBcDeFgHzzzzzzzzzzzz"; text[7][8]="zzzzzzzzaBcDeFgHzzzzzzzzzzz"; text[7][9]="zzzzzzzzzaBcDeFgHzzzzzzzzzz"; text[7][10]="zzzzzzzzzzaBcDeFgHzzzzzzzzz"; text[7][11]="zzzzzzzzzzzaBcDeFgHzzzzzzzz"; text[7][12]="zzzzzzzzzzzzaBcDeFgHzzzzzzz"; text[7][13]="zzzzzzzzzzzzzaBcDeFgHzzzzzz"; text[7][14]="zzzzzzzzzzzzzzaBcDeFgHzzzzz"; text[7][15]="zzzzzzzzzzzzzzzaBcDeFgHzzzz"; text[7][16]="zzzzzzzzzzzzzzzzaBcDeFgHzzz"; text[7][17]="zzzzzzzzzzzzzzzzzaBcDeFgHzz"; text[7][18]="zzzzzzzzzzzzzzzzzzaBcDeFgHz"; text[7][19]="zzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8][0]="aBcDeFgHizzzzzzzzzzzzzzzzzz"; text[8][1]="zaBcDeFgHizzzzzzzzzzzzzzzzz"; text[8][2]="zzaBcDeFgHizzzzzzzzzzzzzzzz"; text[8][3]="zzzaBcDeFgHizzzzzzzzzzzzzzz"; text[8][4]="zzzzaBcDeFgHizzzzzzzzzzzzzz"; text[8][5]="zzzzzaBcDeFgHizzzzzzzzzzzzz"; text[8][6]="zzzzzzaBcDeFgHizzzzzzzzzzzz"; text[8][7]="zzzzzzzaBcDeFgHizzzzzzzzzzz"; text[8][8]="zzzzzzzzaBcDeFgHizzzzzzzzzz"; text[8][9]="zzzzzzzzzaBcDeFgHizzzzzzzzz"; text[8][10]="zzzzzzzzzzaBcDeFgHizzzzzzzz"; text[8][11]="zzzzzzzzzzzaBcDeFgHizzzzzzz"; text[8][12]="zzzzzzzzzzzzaBcDeFgHizzzzzz"; text[8][13]="zzzzzzzzzzzzzaBcDeFgHizzzzz"; text[8][14]="zzzzzzzzzzzzzzaBcDeFgHizzzz"; text[8][15]="zzzzzzzzzzzzzzzaBcDeFgHizzz"; text[8][16]="zzzzzzzzzzzzzzzzaBcDeFgHizz"; text[8][17]="zzzzzzzzzzzzzzzzzaBcDeFgHiz"; text[8][18]="zzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9][0]="aBcDeFgHiJzzzzzzzzzzzzzzzzz"; text[9][1]="zaBcDeFgHiJzzzzzzzzzzzzzzzz"; text[9][2]="zzaBcDeFgHiJzzzzzzzzzzzzzzz"; text[9][3]="zzzaBcDeFgHiJzzzzzzzzzzzzzz"; text[9][4]="zzzzaBcDeFgHiJzzzzzzzzzzzzz"; text[9][5]="zzzzzaBcDeFgHiJzzzzzzzzzzzz"; text[9][6]="zzzzzzaBcDeFgHiJzzzzzzzzzzz"; text[9][7]="zzzzzzzaBcDeFgHiJzzzzzzzzzz"; text[9][8]="zzzzzzzzaBcDeFgHiJzzzzzzzzz"; text[9][9]="zzzzzzzzzaBcDeFgHiJzzzzzzzz"; text[9][10]="zzzzzzzzzzaBcDeFgHiJzzzzzzz"; text[9][11]="zzzzzzzzzzzaBcDeFgHiJzzzzzz"; text[9][12]="zzzzzzzzzzzzaBcDeFgHiJzzzzz"; text[9][13]="zzzzzzzzzzzzzaBcDeFgHiJzzzz"; text[9][14]="zzzzzzzzzzzzzzaBcDeFgHiJzzz"; text[9][15]="zzzzzzzzzzzzzzzaBcDeFgHiJzz"; text[9][16]="zzzzzzzzzzzzzzzzaBcDeFgHiJz"; text[9][17]="zzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10][0]="aBcDeFgHiJkzzzzzzzzzzzzzzzz"; text[10][1]="zaBcDeFgHiJkzzzzzzzzzzzzzzz"; text[10][2]="zzaBcDeFgHiJkzzzzzzzzzzzzzz"; text[10][3]="zzzaBcDeFgHiJkzzzzzzzzzzzzz"; text[10][4]="zzzzaBcDeFgHiJkzzzzzzzzzzzz"; text[10][5]="zzzzzaBcDeFgHiJkzzzzzzzzzzz"; text[10][6]="zzzzzzaBcDeFgHiJkzzzzzzzzzz"; text[10][7]="zzzzzzzaBcDeFgHiJkzzzzzzzzz"; text[10][8]="zzzzzzzzaBcDeFgHiJkzzzzzzzz"; text[10][9]="zzzzzzzzzaBcDeFgHiJkzzzzzzz"; text[10][10]="zzzzzzzzzzaBcDeFgHiJkzzzzzz"; text[10][11]="zzzzzzzzzzzaBcDeFgHiJkzzzzz"; text[10][12]="zzzzzzzzzzzzaBcDeFgHiJkzzzz"; text[10][13]="zzzzzzzzzzzzzaBcDeFgHiJkzzz"; text[10][14]="zzzzzzzzzzzzzzaBcDeFgHiJkzz"; text[10][15]="zzzzzzzzzzzzzzzaBcDeFgHiJkz"; text[10][16]="zzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11][0]="aBcDeFgHiJkLzzzzzzzzzzzzzzz"; text[11][1]="zaBcDeFgHiJkLzzzzzzzzzzzzzz"; text[11][2]="zzaBcDeFgHiJkLzzzzzzzzzzzzz"; text[11][3]="zzzaBcDeFgHiJkLzzzzzzzzzzzz"; text[11][4]="zzzzaBcDeFgHiJkLzzzzzzzzzzz"; text[11][5]="zzzzzaBcDeFgHiJkLzzzzzzzzzz"; text[11][6]="zzzzzzaBcDeFgHiJkLzzzzzzzzz"; text[11][7]="zzzzzzzaBcDeFgHiJkLzzzzzzzz"; text[11][8]="zzzzzzzzaBcDeFgHiJkLzzzzzzz"; text[11][9]="zzzzzzzzzaBcDeFgHiJkLzzzzzz"; text[11][10]="zzzzzzzzzzaBcDeFgHiJkLzzzzz"; text[11][11]="zzzzzzzzzzzaBcDeFgHiJkLzzzz"; text[11][12]="zzzzzzzzzzzzaBcDeFgHiJkLzzz"; text[11][13]="zzzzzzzzzzzzzaBcDeFgHiJkLzz"; text[11][14]="zzzzzzzzzzzzzzaBcDeFgHiJkLz"; text[11][15]="zzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12][0]="aBcDeFgHiJkLmzzzzzzzzzzzzzz"; text[12][1]="zaBcDeFgHiJkLmzzzzzzzzzzzzz"; text[12][2]="zzaBcDeFgHiJkLmzzzzzzzzzzzz"; text[12][3]="zzzaBcDeFgHiJkLmzzzzzzzzzzz"; text[12][4]="zzzzaBcDeFgHiJkLmzzzzzzzzzz"; text[12][5]="zzzzzaBcDeFgHiJkLmzzzzzzzzz"; text[12][6]="zzzzzzaBcDeFgHiJkLmzzzzzzzz"; text[12][7]="zzzzzzzaBcDeFgHiJkLmzzzzzzz"; text[12][8]="zzzzzzzzaBcDeFgHiJkLmzzzzzz"; text[12][9]="zzzzzzzzzaBcDeFgHiJkLmzzzzz"; text[12][10]="zzzzzzzzzzaBcDeFgHiJkLmzzzz"; text[12][11]="zzzzzzzzzzzaBcDeFgHiJkLmzzz"; text[12][12]="zzzzzzzzzzzzaBcDeFgHiJkLmzz"; text[12][13]="zzzzzzzzzzzzzaBcDeFgHiJkLmz"; text[12][14]="zzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13][0]="aBcDeFgHiJkLmNzzzzzzzzzzzzz"; text[13][1]="zaBcDeFgHiJkLmNzzzzzzzzzzzz"; text[13][2]="zzaBcDeFgHiJkLmNzzzzzzzzzzz"; text[13][3]="zzzaBcDeFgHiJkLmNzzzzzzzzzz"; text[13][4]="zzzzaBcDeFgHiJkLmNzzzzzzzzz"; text[13][5]="zzzzzaBcDeFgHiJkLmNzzzzzzzz"; text[13][6]="zzzzzzaBcDeFgHiJkLmNzzzzzzz"; text[13][7]="zzzzzzzaBcDeFgHiJkLmNzzzzzz"; text[13][8]="zzzzzzzzaBcDeFgHiJkLmNzzzzz"; text[13][9]="zzzzzzzzzaBcDeFgHiJkLmNzzzz"; text[13][10]="zzzzzzzzzzaBcDeFgHiJkLmNzzz"; text[13][11]="zzzzzzzzzzzaBcDeFgHiJkLmNzz"; text[13][12]="zzzzzzzzzzzzaBcDeFgHiJkLmNz"; text[13][13]="zzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14][0]="aBcDeFgHiJkLmNozzzzzzzzzzzz"; text[14][1]="zaBcDeFgHiJkLmNozzzzzzzzzzz"; text[14][2]="zzaBcDeFgHiJkLmNozzzzzzzzzz"; text[14][3]="zzzaBcDeFgHiJkLmNozzzzzzzzz"; text[14][4]="zzzzaBcDeFgHiJkLmNozzzzzzzz"; text[14][5]="zzzzzaBcDeFgHiJkLmNozzzzzzz"; text[14][6]="zzzzzzaBcDeFgHiJkLmNozzzzzz"; text[14][7]="zzzzzzzaBcDeFgHiJkLmNozzzzz"; text[14][8]="zzzzzzzzaBcDeFgHiJkLmNozzzz"; text[14][9]="zzzzzzzzzaBcDeFgHiJkLmNozzz"; text[14][10]="zzzzzzzzzzaBcDeFgHiJkLmNozz"; text[14][11]="zzzzzzzzzzzaBcDeFgHiJkLmNoz"; text[14][12]="zzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15][0]="aBcDeFgHiJkLmNoPzzzzzzzzzzz"; text[15][1]="zaBcDeFgHiJkLmNoPzzzzzzzzzz"; text[15][2]="zzaBcDeFgHiJkLmNoPzzzzzzzzz"; text[15][3]="zzzaBcDeFgHiJkLmNoPzzzzzzzz"; text[15][4]="zzzzaBcDeFgHiJkLmNoPzzzzzzz"; text[15][5]="zzzzzaBcDeFgHiJkLmNoPzzzzzz"; text[15][6]="zzzzzzaBcDeFgHiJkLmNoPzzzzz"; text[15][7]="zzzzzzzaBcDeFgHiJkLmNoPzzzz"; text[15][8]="zzzzzzzzaBcDeFgHiJkLmNoPzzz"; text[15][9]="zzzzzzzzzaBcDeFgHiJkLmNoPzz"; text[15][10]="zzzzzzzzzzaBcDeFgHiJkLmNoPz"; text[15][11]="zzzzzzzzzzzaBcDeFgHiJkLmNoP"; text[16][0]="aBcDeFgHiJkLmNoPqzzzzzzzzzz"; text[16][1]="zaBcDeFgHiJkLmNoPqzzzzzzzzz"; text[16][2]="zzaBcDeFgHiJkLmNoPqzzzzzzzz"; text[16][3]="zzzaBcDeFgHiJkLmNoPqzzzzzzz"; text[16][4]="zzzzaBcDeFgHiJkLmNoPqzzzzzz"; text[16][5]="zzzzzaBcDeFgHiJkLmNoPqzzzzz"; text[16][6]="zzzzzzaBcDeFgHiJkLmNoPqzzzz"; text[16][7]="zzzzzzzaBcDeFgHiJkLmNoPqzzz"; text[16][8]="zzzzzzzzaBcDeFgHiJkLmNoPqzz"; text[16][9]="zzzzzzzzzaBcDeFgHiJkLmNoPqz"; text[16][10]="zzzzzzzzzzaBcDeFgHiJkLmNoPq"; text[17][0]="aBcDeFgHiJkLmNoPqRzzzzzzzzz"; text[17][1]="zaBcDeFgHiJkLmNoPqRzzzzzzzz"; text[17][2]="zzaBcDeFgHiJkLmNoPqRzzzzzzz"; text[17][3]="zzzaBcDeFgHiJkLmNoPqRzzzzzz"; text[17][4]="zzzzaBcDeFgHiJkLmNoPqRzzzzz"; text[17][5]="zzzzzaBcDeFgHiJkLmNoPqRzzzz"; text[17][6]="zzzzzzaBcDeFgHiJkLmNoPqRzzz"; text[17][7]="zzzzzzzaBcDeFgHiJkLmNoPqRzz"; text[17][8]="zzzzzzzzaBcDeFgHiJkLmNoPqRz"; text[17][9]="zzzzzzzzzaBcDeFgHiJkLmNoPqR"; text[18][0]="aBcDeFgHiJkLmNoPqRszzzzzzzz"; text[18][1]="zaBcDeFgHiJkLmNoPqRszzzzzzz"; text[18][2]="zzaBcDeFgHiJkLmNoPqRszzzzzz"; text[18][3]="zzzaBcDeFgHiJkLmNoPqRszzzzz"; text[18][4]="zzzzaBcDeFgHiJkLmNoPqRszzzz"; text[18][5]="zzzzzaBcDeFgHiJkLmNoPqRszzz"; text[18][6]="zzzzzzaBcDeFgHiJkLmNoPqRszz"; text[18][7]="zzzzzzzaBcDeFgHiJkLmNoPqRsz"; text[18][8]="zzzzzzzzaBcDeFgHiJkLmNoPqRs"; text[19][0]="aBcDeFgHiJkLmNoPqRsTzzzzzzz"; text[19][1]="zaBcDeFgHiJkLmNoPqRsTzzzzzz"; text[19][2]="zzaBcDeFgHiJkLmNoPqRsTzzzzz"; text[19][3]="zzzaBcDeFgHiJkLmNoPqRsTzzzz"; text[19][4]="zzzzaBcDeFgHiJkLmNoPqRsTzzz"; text[19][5]="zzzzzaBcDeFgHiJkLmNoPqRsTzz"; text[19][6]="zzzzzzaBcDeFgHiJkLmNoPqRsTz"; text[19][7]="zzzzzzzaBcDeFgHiJkLmNoPqRsT"; text[20][0]="aBcDeFgHiJkLmNoPqRsTuzzzzzz"; text[20][1]="zaBcDeFgHiJkLmNoPqRsTuzzzzz"; text[20][2]="zzaBcDeFgHiJkLmNoPqRsTuzzzz"; text[20][3]="zzzaBcDeFgHiJkLmNoPqRsTuzzz"; text[20][4]="zzzzaBcDeFgHiJkLmNoPqRsTuzz"; text[20][5]="zzzzzaBcDeFgHiJkLmNoPqRsTuz"; text[20][6]="zzzzzzaBcDeFgHiJkLmNoPqRsTu"; text[21][0]="aBcDeFgHiJkLmNoPqRsTuVzzzzz"; text[21][1]="zaBcDeFgHiJkLmNoPqRsTuVzzzz"; text[21][2]="zzaBcDeFgHiJkLmNoPqRsTuVzzz"; text[21][3]="zzzaBcDeFgHiJkLmNoPqRsTuVzz"; text[21][4]="zzzzaBcDeFgHiJkLmNoPqRsTuVz"; text[21][5]="zzzzzaBcDeFgHiJkLmNoPqRsTuV"; text[22][0]="aBcDeFgHiJkLmNoPqRsTuVwzzzz"; text[22][1]="zaBcDeFgHiJkLmNoPqRsTuVwzzz"; text[22][2]="zzaBcDeFgHiJkLmNoPqRsTuVwzz"; text[22][3]="zzzaBcDeFgHiJkLmNoPqRsTuVwz"; text[22][4]="zzzzaBcDeFgHiJkLmNoPqRsTuVw"; text[23][0]="aBcDeFgHiJkLmNoPqRsTuVwXzzz"; text[23][1]="zaBcDeFgHiJkLmNoPqRsTuVwXzz"; text[23][2]="zzaBcDeFgHiJkLmNoPqRsTuVwXz"; text[23][3]="zzzaBcDeFgHiJkLmNoPqRsTuVwX"; text[24][0]="aBcDeFgHiJkLmNoPqRsTuVwXyzz"; text[24][1]="zaBcDeFgHiJkLmNoPqRsTuVwXyz"; text[24][2]="zzaBcDeFgHiJkLmNoPqRsTuVwXy"; text[25][0]="aBcDeFgHiJkLmNoPqRsTuVwXyZz"; text[25][1]="zaBcDeFgHiJkLmNoPqRsTuVwXyZ"; char *needle[26]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; needle[16]="aBcDeFgHiJkLmNoPq"; needle[17]="aBcDeFgHiJkLmNoPqR"; needle[18]="aBcDeFgHiJkLmNoPqRs"; needle[19]="aBcDeFgHiJkLmNoPqRsT"; needle[20]="aBcDeFgHiJkLmNoPqRsTu"; needle[21]="aBcDeFgHiJkLmNoPqRsTuV"; needle[22]="aBcDeFgHiJkLmNoPqRsTuVw"; needle[23]="aBcDeFgHiJkLmNoPqRsTuVwX"; needle[24]="aBcDeFgHiJkLmNoPqRsTuVwXy"; needle[25]="aBcDeFgHiJkLmNoPqRsTuVwXyZ"; int i, j; uint8_t *found = NULL; for (i = 0; i < 26; i++) { for (j = 0; j <= (26 - i); j++) { found = BasicSearchWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } found = Bs2bmWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } found = BoyerMooreWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } } } return 1; } /** * \test Check that all the algorithms (no case) work at any offset and any pattern length */ int UtilSpmSearchOffsetsNocaseTest01() { char *text[26][27]; text[0][0]="azzzzzzzzzzzzzzzzzzzzzzzzzz"; text[0][1]="zazzzzzzzzzzzzzzzzzzzzzzzzz"; text[0][2]="zzazzzzzzzzzzzzzzzzzzzzzzzz"; text[0][3]="zzzazzzzzzzzzzzzzzzzzzzzzzz"; text[0][4]="zzzzazzzzzzzzzzzzzzzzzzzzzz"; text[0][5]="zzzzzazzzzzzzzzzzzzzzzzzzzz"; text[0][6]="zzzzzzazzzzzzzzzzzzzzzzzzzz"; text[0][7]="zzzzzzzazzzzzzzzzzzzzzzzzzz"; text[0][8]="zzzzzzzzazzzzzzzzzzzzzzzzzz"; text[0][9]="zzzzzzzzzazzzzzzzzzzzzzzzzz"; text[0][10]="zzzzzzzzzzazzzzzzzzzzzzzzzz"; text[0][11]="zzzzzzzzzzzazzzzzzzzzzzzzzz"; text[0][12]="zzzzzzzzzzzzazzzzzzzzzzzzzz"; text[0][13]="zzzzzzzzzzzzzazzzzzzzzzzzzz"; text[0][14]="zzzzzzzzzzzzzzazzzzzzzzzzzz"; text[0][15]="zzzzzzzzzzzzzzzazzzzzzzzzzz"; text[0][16]="zzzzzzzzzzzzzzzzazzzzzzzzzz"; text[0][17]="zzzzzzzzzzzzzzzzzazzzzzzzzz"; text[0][18]="zzzzzzzzzzzzzzzzzzazzzzzzzz"; text[0][19]="zzzzzzzzzzzzzzzzzzzazzzzzzz"; text[0][20]="zzzzzzzzzzzzzzzzzzzzazzzzzz"; text[0][21]="zzzzzzzzzzzzzzzzzzzzzazzzzz"; text[0][22]="zzzzzzzzzzzzzzzzzzzzzzazzzz"; text[0][23]="zzzzzzzzzzzzzzzzzzzzzzzazzz"; text[0][24]="zzzzzzzzzzzzzzzzzzzzzzzzazz"; text[0][25]="zzzzzzzzzzzzzzzzzzzzzzzzzaz"; text[0][26]="zzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1][0]="aBzzzzzzzzzzzzzzzzzzzzzzzzz"; text[1][1]="zaBzzzzzzzzzzzzzzzzzzzzzzzz"; text[1][2]="zzaBzzzzzzzzzzzzzzzzzzzzzzz"; text[1][3]="zzzaBzzzzzzzzzzzzzzzzzzzzzz"; text[1][4]="zzzzaBzzzzzzzzzzzzzzzzzzzzz"; text[1][5]="zzzzzaBzzzzzzzzzzzzzzzzzzzz"; text[1][6]="zzzzzzaBzzzzzzzzzzzzzzzzzzz"; text[1][7]="zzzzzzzaBzzzzzzzzzzzzzzzzzz"; text[1][8]="zzzzzzzzaBzzzzzzzzzzzzzzzzz"; text[1][9]="zzzzzzzzzaBzzzzzzzzzzzzzzzz"; text[1][10]="zzzzzzzzzzaBzzzzzzzzzzzzzzz"; text[1][11]="zzzzzzzzzzzaBzzzzzzzzzzzzzz"; text[1][12]="zzzzzzzzzzzzaBzzzzzzzzzzzzz"; text[1][13]="zzzzzzzzzzzzzaBzzzzzzzzzzzz"; text[1][14]="zzzzzzzzzzzzzzaBzzzzzzzzzzz"; text[1][15]="zzzzzzzzzzzzzzzaBzzzzzzzzzz"; text[1][16]="zzzzzzzzzzzzzzzzaBzzzzzzzzz"; text[1][17]="zzzzzzzzzzzzzzzzzaBzzzzzzzz"; text[1][18]="zzzzzzzzzzzzzzzzzzaBzzzzzzz"; text[1][19]="zzzzzzzzzzzzzzzzzzzaBzzzzzz"; text[1][20]="zzzzzzzzzzzzzzzzzzzzaBzzzzz"; text[1][21]="zzzzzzzzzzzzzzzzzzzzzaBzzzz"; text[1][22]="zzzzzzzzzzzzzzzzzzzzzzaBzzz"; text[1][23]="zzzzzzzzzzzzzzzzzzzzzzzaBzz"; text[1][24]="zzzzzzzzzzzzzzzzzzzzzzzzaBz"; text[1][25]="zzzzzzzzzzzzzzzzzzzzzzzzzaB"; text[2][0]="aBczzzzzzzzzzzzzzzzzzzzzzzz"; text[2][1]="zaBczzzzzzzzzzzzzzzzzzzzzzz"; text[2][2]="zzaBczzzzzzzzzzzzzzzzzzzzzz"; text[2][3]="zzzaBczzzzzzzzzzzzzzzzzzzzz"; text[2][4]="zzzzaBczzzzzzzzzzzzzzzzzzzz"; text[2][5]="zzzzzaBczzzzzzzzzzzzzzzzzzz"; text[2][6]="zzzzzzaBczzzzzzzzzzzzzzzzzz"; text[2][7]="zzzzzzzaBczzzzzzzzzzzzzzzzz"; text[2][8]="zzzzzzzzaBczzzzzzzzzzzzzzzz"; text[2][9]="zzzzzzzzzaBczzzzzzzzzzzzzzz"; text[2][10]="zzzzzzzzzzaBczzzzzzzzzzzzzz"; text[2][11]="zzzzzzzzzzzaBczzzzzzzzzzzzz"; text[2][12]="zzzzzzzzzzzzaBczzzzzzzzzzzz"; text[2][13]="zzzzzzzzzzzzzaBczzzzzzzzzzz"; text[2][14]="zzzzzzzzzzzzzzaBczzzzzzzzzz"; text[2][15]="zzzzzzzzzzzzzzzaBczzzzzzzzz"; text[2][16]="zzzzzzzzzzzzzzzzaBczzzzzzzz"; text[2][17]="zzzzzzzzzzzzzzzzzaBczzzzzzz"; text[2][18]="zzzzzzzzzzzzzzzzzzaBczzzzzz"; text[2][19]="zzzzzzzzzzzzzzzzzzzaBczzzzz"; text[2][20]="zzzzzzzzzzzzzzzzzzzzaBczzzz"; text[2][21]="zzzzzzzzzzzzzzzzzzzzzaBczzz"; text[2][22]="zzzzzzzzzzzzzzzzzzzzzzaBczz"; text[2][23]="zzzzzzzzzzzzzzzzzzzzzzzaBcz"; text[2][24]="zzzzzzzzzzzzzzzzzzzzzzzzaBc"; text[3][0]="aBcDzzzzzzzzzzzzzzzzzzzzzzz"; text[3][1]="zaBcDzzzzzzzzzzzzzzzzzzzzzz"; text[3][2]="zzaBcDzzzzzzzzzzzzzzzzzzzzz"; text[3][3]="zzzaBcDzzzzzzzzzzzzzzzzzzzz"; text[3][4]="zzzzaBcDzzzzzzzzzzzzzzzzzzz"; text[3][5]="zzzzzaBcDzzzzzzzzzzzzzzzzzz"; text[3][6]="zzzzzzaBcDzzzzzzzzzzzzzzzzz"; text[3][7]="zzzzzzzaBcDzzzzzzzzzzzzzzzz"; text[3][8]="zzzzzzzzaBcDzzzzzzzzzzzzzzz"; text[3][9]="zzzzzzzzzaBcDzzzzzzzzzzzzzz"; text[3][10]="zzzzzzzzzzaBcDzzzzzzzzzzzzz"; text[3][11]="zzzzzzzzzzzaBcDzzzzzzzzzzzz"; text[3][12]="zzzzzzzzzzzzaBcDzzzzzzzzzzz"; text[3][13]="zzzzzzzzzzzzzaBcDzzzzzzzzzz"; text[3][14]="zzzzzzzzzzzzzzaBcDzzzzzzzzz"; text[3][15]="zzzzzzzzzzzzzzzaBcDzzzzzzzz"; text[3][16]="zzzzzzzzzzzzzzzzaBcDzzzzzzz"; text[3][17]="zzzzzzzzzzzzzzzzzaBcDzzzzzz"; text[3][18]="zzzzzzzzzzzzzzzzzzaBcDzzzzz"; text[3][19]="zzzzzzzzzzzzzzzzzzzaBcDzzzz"; text[3][20]="zzzzzzzzzzzzzzzzzzzzaBcDzzz"; text[3][21]="zzzzzzzzzzzzzzzzzzzzzaBcDzz"; text[3][22]="zzzzzzzzzzzzzzzzzzzzzzaBcDz"; text[3][23]="zzzzzzzzzzzzzzzzzzzzzzzaBcD"; text[4][0]="aBcDezzzzzzzzzzzzzzzzzzzzzz"; text[4][1]="zaBcDezzzzzzzzzzzzzzzzzzzzz"; text[4][2]="zzaBcDezzzzzzzzzzzzzzzzzzzz"; text[4][3]="zzzaBcDezzzzzzzzzzzzzzzzzzz"; text[4][4]="zzzzaBcDezzzzzzzzzzzzzzzzzz"; text[4][5]="zzzzzaBcDezzzzzzzzzzzzzzzzz"; text[4][6]="zzzzzzaBcDezzzzzzzzzzzzzzzz"; text[4][7]="zzzzzzzaBcDezzzzzzzzzzzzzzz"; text[4][8]="zzzzzzzzaBcDezzzzzzzzzzzzzz"; text[4][9]="zzzzzzzzzaBcDezzzzzzzzzzzzz"; text[4][10]="zzzzzzzzzzaBcDezzzzzzzzzzzz"; text[4][11]="zzzzzzzzzzzaBcDezzzzzzzzzzz"; text[4][12]="zzzzzzzzzzzzaBcDezzzzzzzzzz"; text[4][13]="zzzzzzzzzzzzzaBcDezzzzzzzzz"; text[4][14]="zzzzzzzzzzzzzzaBcDezzzzzzzz"; text[4][15]="zzzzzzzzzzzzzzzaBcDezzzzzzz"; text[4][16]="zzzzzzzzzzzzzzzzaBcDezzzzzz"; text[4][17]="zzzzzzzzzzzzzzzzzaBcDezzzzz"; text[4][18]="zzzzzzzzzzzzzzzzzzaBcDezzzz"; text[4][19]="zzzzzzzzzzzzzzzzzzzaBcDezzz"; text[4][20]="zzzzzzzzzzzzzzzzzzzzaBcDezz"; text[4][21]="zzzzzzzzzzzzzzzzzzzzzaBcDez"; text[4][22]="zzzzzzzzzzzzzzzzzzzzzzaBcDe"; text[5][0]="aBcDeFzzzzzzzzzzzzzzzzzzzzz"; text[5][1]="zaBcDeFzzzzzzzzzzzzzzzzzzzz"; text[5][2]="zzaBcDeFzzzzzzzzzzzzzzzzzzz"; text[5][3]="zzzaBcDeFzzzzzzzzzzzzzzzzzz"; text[5][4]="zzzzaBcDeFzzzzzzzzzzzzzzzzz"; text[5][5]="zzzzzaBcDeFzzzzzzzzzzzzzzzz"; text[5][6]="zzzzzzaBcDeFzzzzzzzzzzzzzzz"; text[5][7]="zzzzzzzaBcDeFzzzzzzzzzzzzzz"; text[5][8]="zzzzzzzzaBcDeFzzzzzzzzzzzzz"; text[5][9]="zzzzzzzzzaBcDeFzzzzzzzzzzzz"; text[5][10]="zzzzzzzzzzaBcDeFzzzzzzzzzzz"; text[5][11]="zzzzzzzzzzzaBcDeFzzzzzzzzzz"; text[5][12]="zzzzzzzzzzzzaBcDeFzzzzzzzzz"; text[5][13]="zzzzzzzzzzzzzaBcDeFzzzzzzzz"; text[5][14]="zzzzzzzzzzzzzzaBcDeFzzzzzzz"; text[5][15]="zzzzzzzzzzzzzzzaBcDeFzzzzzz"; text[5][16]="zzzzzzzzzzzzzzzzaBcDeFzzzzz"; text[5][17]="zzzzzzzzzzzzzzzzzaBcDeFzzzz"; text[5][18]="zzzzzzzzzzzzzzzzzzaBcDeFzzz"; text[5][19]="zzzzzzzzzzzzzzzzzzzaBcDeFzz"; text[5][20]="zzzzzzzzzzzzzzzzzzzzaBcDeFz"; text[5][21]="zzzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6][0]="aBcDeFgzzzzzzzzzzzzzzzzzzzz"; text[6][1]="zaBcDeFgzzzzzzzzzzzzzzzzzzz"; text[6][2]="zzaBcDeFgzzzzzzzzzzzzzzzzzz"; text[6][3]="zzzaBcDeFgzzzzzzzzzzzzzzzzz"; text[6][4]="zzzzaBcDeFgzzzzzzzzzzzzzzzz"; text[6][5]="zzzzzaBcDeFgzzzzzzzzzzzzzzz"; text[6][6]="zzzzzzaBcDeFgzzzzzzzzzzzzzz"; text[6][7]="zzzzzzzaBcDeFgzzzzzzzzzzzzz"; text[6][8]="zzzzzzzzaBcDeFgzzzzzzzzzzzz"; text[6][9]="zzzzzzzzzaBcDeFgzzzzzzzzzzz"; text[6][10]="zzzzzzzzzzaBcDeFgzzzzzzzzzz"; text[6][11]="zzzzzzzzzzzaBcDeFgzzzzzzzzz"; text[6][12]="zzzzzzzzzzzzaBcDeFgzzzzzzzz"; text[6][13]="zzzzzzzzzzzzzaBcDeFgzzzzzzz"; text[6][14]="zzzzzzzzzzzzzzaBcDeFgzzzzzz"; text[6][15]="zzzzzzzzzzzzzzzaBcDeFgzzzzz"; text[6][16]="zzzzzzzzzzzzzzzzaBcDeFgzzzz"; text[6][17]="zzzzzzzzzzzzzzzzzaBcDeFgzzz"; text[6][18]="zzzzzzzzzzzzzzzzzzaBcDeFgzz"; text[6][19]="zzzzzzzzzzzzzzzzzzzaBcDeFgz"; text[6][20]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7][0]="aBcDeFgHzzzzzzzzzzzzzzzzzzz"; text[7][1]="zaBcDeFgHzzzzzzzzzzzzzzzzzz"; text[7][2]="zzaBcDeFgHzzzzzzzzzzzzzzzzz"; text[7][3]="zzzaBcDeFgHzzzzzzzzzzzzzzzz"; text[7][4]="zzzzaBcDeFgHzzzzzzzzzzzzzzz"; text[7][5]="zzzzzaBcDeFgHzzzzzzzzzzzzzz"; text[7][6]="zzzzzzaBcDeFgHzzzzzzzzzzzzz"; text[7][7]="zzzzzzzaBcDeFgHzzzzzzzzzzzz"; text[7][8]="zzzzzzzzaBcDeFgHzzzzzzzzzzz"; text[7][9]="zzzzzzzzzaBcDeFgHzzzzzzzzzz"; text[7][10]="zzzzzzzzzzaBcDeFgHzzzzzzzzz"; text[7][11]="zzzzzzzzzzzaBcDeFgHzzzzzzzz"; text[7][12]="zzzzzzzzzzzzaBcDeFgHzzzzzzz"; text[7][13]="zzzzzzzzzzzzzaBcDeFgHzzzzzz"; text[7][14]="zzzzzzzzzzzzzzaBcDeFgHzzzzz"; text[7][15]="zzzzzzzzzzzzzzzaBcDeFgHzzzz"; text[7][16]="zzzzzzzzzzzzzzzzaBcDeFgHzzz"; text[7][17]="zzzzzzzzzzzzzzzzzaBcDeFgHzz"; text[7][18]="zzzzzzzzzzzzzzzzzzaBcDeFgHz"; text[7][19]="zzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8][0]="aBcDeFgHizzzzzzzzzzzzzzzzzz"; text[8][1]="zaBcDeFgHizzzzzzzzzzzzzzzzz"; text[8][2]="zzaBcDeFgHizzzzzzzzzzzzzzzz"; text[8][3]="zzzaBcDeFgHizzzzzzzzzzzzzzz"; text[8][4]="zzzzaBcDeFgHizzzzzzzzzzzzzz"; text[8][5]="zzzzzaBcDeFgHizzzzzzzzzzzzz"; text[8][6]="zzzzzzaBcDeFgHizzzzzzzzzzzz"; text[8][7]="zzzzzzzaBcDeFgHizzzzzzzzzzz"; text[8][8]="zzzzzzzzaBcDeFgHizzzzzzzzzz"; text[8][9]="zzzzzzzzzaBcDeFgHizzzzzzzzz"; text[8][10]="zzzzzzzzzzaBcDeFgHizzzzzzzz"; text[8][11]="zzzzzzzzzzzaBcDeFgHizzzzzzz"; text[8][12]="zzzzzzzzzzzzaBcDeFgHizzzzzz"; text[8][13]="zzzzzzzzzzzzzaBcDeFgHizzzzz"; text[8][14]="zzzzzzzzzzzzzzaBcDeFgHizzzz"; text[8][15]="zzzzzzzzzzzzzzzaBcDeFgHizzz"; text[8][16]="zzzzzzzzzzzzzzzzaBcDeFgHizz"; text[8][17]="zzzzzzzzzzzzzzzzzaBcDeFgHiz"; text[8][18]="zzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9][0]="aBcDeFgHiJzzzzzzzzzzzzzzzzz"; text[9][1]="zaBcDeFgHiJzzzzzzzzzzzzzzzz"; text[9][2]="zzaBcDeFgHiJzzzzzzzzzzzzzzz"; text[9][3]="zzzaBcDeFgHiJzzzzzzzzzzzzzz"; text[9][4]="zzzzaBcDeFgHiJzzzzzzzzzzzzz"; text[9][5]="zzzzzaBcDeFgHiJzzzzzzzzzzzz"; text[9][6]="zzzzzzaBcDeFgHiJzzzzzzzzzzz"; text[9][7]="zzzzzzzaBcDeFgHiJzzzzzzzzzz"; text[9][8]="zzzzzzzzaBcDeFgHiJzzzzzzzzz"; text[9][9]="zzzzzzzzzaBcDeFgHiJzzzzzzzz"; text[9][10]="zzzzzzzzzzaBcDeFgHiJzzzzzzz"; text[9][11]="zzzzzzzzzzzaBcDeFgHiJzzzzzz"; text[9][12]="zzzzzzzzzzzzaBcDeFgHiJzzzzz"; text[9][13]="zzzzzzzzzzzzzaBcDeFgHiJzzzz"; text[9][14]="zzzzzzzzzzzzzzaBcDeFgHiJzzz"; text[9][15]="zzzzzzzzzzzzzzzaBcDeFgHiJzz"; text[9][16]="zzzzzzzzzzzzzzzzaBcDeFgHiJz"; text[9][17]="zzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10][0]="aBcDeFgHiJkzzzzzzzzzzzzzzzz"; text[10][1]="zaBcDeFgHiJkzzzzzzzzzzzzzzz"; text[10][2]="zzaBcDeFgHiJkzzzzzzzzzzzzzz"; text[10][3]="zzzaBcDeFgHiJkzzzzzzzzzzzzz"; text[10][4]="zzzzaBcDeFgHiJkzzzzzzzzzzzz"; text[10][5]="zzzzzaBcDeFgHiJkzzzzzzzzzzz"; text[10][6]="zzzzzzaBcDeFgHiJkzzzzzzzzzz"; text[10][7]="zzzzzzzaBcDeFgHiJkzzzzzzzzz"; text[10][8]="zzzzzzzzaBcDeFgHiJkzzzzzzzz"; text[10][9]="zzzzzzzzzaBcDeFgHiJkzzzzzzz"; text[10][10]="zzzzzzzzzzaBcDeFgHiJkzzzzzz"; text[10][11]="zzzzzzzzzzzaBcDeFgHiJkzzzzz"; text[10][12]="zzzzzzzzzzzzaBcDeFgHiJkzzzz"; text[10][13]="zzzzzzzzzzzzzaBcDeFgHiJkzzz"; text[10][14]="zzzzzzzzzzzzzzaBcDeFgHiJkzz"; text[10][15]="zzzzzzzzzzzzzzzaBcDeFgHiJkz"; text[10][16]="zzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11][0]="aBcDeFgHiJkLzzzzzzzzzzzzzzz"; text[11][1]="zaBcDeFgHiJkLzzzzzzzzzzzzzz"; text[11][2]="zzaBcDeFgHiJkLzzzzzzzzzzzzz"; text[11][3]="zzzaBcDeFgHiJkLzzzzzzzzzzzz"; text[11][4]="zzzzaBcDeFgHiJkLzzzzzzzzzzz"; text[11][5]="zzzzzaBcDeFgHiJkLzzzzzzzzzz"; text[11][6]="zzzzzzaBcDeFgHiJkLzzzzzzzzz"; text[11][7]="zzzzzzzaBcDeFgHiJkLzzzzzzzz"; text[11][8]="zzzzzzzzaBcDeFgHiJkLzzzzzzz"; text[11][9]="zzzzzzzzzaBcDeFgHiJkLzzzzzz"; text[11][10]="zzzzzzzzzzaBcDeFgHiJkLzzzzz"; text[11][11]="zzzzzzzzzzzaBcDeFgHiJkLzzzz"; text[11][12]="zzzzzzzzzzzzaBcDeFgHiJkLzzz"; text[11][13]="zzzzzzzzzzzzzaBcDeFgHiJkLzz"; text[11][14]="zzzzzzzzzzzzzzaBcDeFgHiJkLz"; text[11][15]="zzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12][0]="aBcDeFgHiJkLmzzzzzzzzzzzzzz"; text[12][1]="zaBcDeFgHiJkLmzzzzzzzzzzzzz"; text[12][2]="zzaBcDeFgHiJkLmzzzzzzzzzzzz"; text[12][3]="zzzaBcDeFgHiJkLmzzzzzzzzzzz"; text[12][4]="zzzzaBcDeFgHiJkLmzzzzzzzzzz"; text[12][5]="zzzzzaBcDeFgHiJkLmzzzzzzzzz"; text[12][6]="zzzzzzaBcDeFgHiJkLmzzzzzzzz"; text[12][7]="zzzzzzzaBcDeFgHiJkLmzzzzzzz"; text[12][8]="zzzzzzzzaBcDeFgHiJkLmzzzzzz"; text[12][9]="zzzzzzzzzaBcDeFgHiJkLmzzzzz"; text[12][10]="zzzzzzzzzzaBcDeFgHiJkLmzzzz"; text[12][11]="zzzzzzzzzzzaBcDeFgHiJkLmzzz"; text[12][12]="zzzzzzzzzzzzaBcDeFgHiJkLmzz"; text[12][13]="zzzzzzzzzzzzzaBcDeFgHiJkLmz"; text[12][14]="zzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13][0]="aBcDeFgHiJkLmNzzzzzzzzzzzzz"; text[13][1]="zaBcDeFgHiJkLmNzzzzzzzzzzzz"; text[13][2]="zzaBcDeFgHiJkLmNzzzzzzzzzzz"; text[13][3]="zzzaBcDeFgHiJkLmNzzzzzzzzzz"; text[13][4]="zzzzaBcDeFgHiJkLmNzzzzzzzzz"; text[13][5]="zzzzzaBcDeFgHiJkLmNzzzzzzzz"; text[13][6]="zzzzzzaBcDeFgHiJkLmNzzzzzzz"; text[13][7]="zzzzzzzaBcDeFgHiJkLmNzzzzzz"; text[13][8]="zzzzzzzzaBcDeFgHiJkLmNzzzzz"; text[13][9]="zzzzzzzzzaBcDeFgHiJkLmNzzzz"; text[13][10]="zzzzzzzzzzaBcDeFgHiJkLmNzzz"; text[13][11]="zzzzzzzzzzzaBcDeFgHiJkLmNzz"; text[13][12]="zzzzzzzzzzzzaBcDeFgHiJkLmNz"; text[13][13]="zzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14][0]="aBcDeFgHiJkLmNozzzzzzzzzzzz"; text[14][1]="zaBcDeFgHiJkLmNozzzzzzzzzzz"; text[14][2]="zzaBcDeFgHiJkLmNozzzzzzzzzz"; text[14][3]="zzzaBcDeFgHiJkLmNozzzzzzzzz"; text[14][4]="zzzzaBcDeFgHiJkLmNozzzzzzzz"; text[14][5]="zzzzzaBcDeFgHiJkLmNozzzzzzz"; text[14][6]="zzzzzzaBcDeFgHiJkLmNozzzzzz"; text[14][7]="zzzzzzzaBcDeFgHiJkLmNozzzzz"; text[14][8]="zzzzzzzzaBcDeFgHiJkLmNozzzz"; text[14][9]="zzzzzzzzzaBcDeFgHiJkLmNozzz"; text[14][10]="zzzzzzzzzzaBcDeFgHiJkLmNozz"; text[14][11]="zzzzzzzzzzzaBcDeFgHiJkLmNoz"; text[14][12]="zzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15][0]="aBcDeFgHiJkLmNoPzzzzzzzzzzz"; text[15][1]="zaBcDeFgHiJkLmNoPzzzzzzzzzz"; text[15][2]="zzaBcDeFgHiJkLmNoPzzzzzzzzz"; text[15][3]="zzzaBcDeFgHiJkLmNoPzzzzzzzz"; text[15][4]="zzzzaBcDeFgHiJkLmNoPzzzzzzz"; text[15][5]="zzzzzaBcDeFgHiJkLmNoPzzzzzz"; text[15][6]="zzzzzzaBcDeFgHiJkLmNoPzzzzz"; text[15][7]="zzzzzzzaBcDeFgHiJkLmNoPzzzz"; text[15][8]="zzzzzzzzaBcDeFgHiJkLmNoPzzz"; text[15][9]="zzzzzzzzzaBcDeFgHiJkLmNoPzz"; text[15][10]="zzzzzzzzzzaBcDeFgHiJkLmNoPz"; text[15][11]="zzzzzzzzzzzaBcDeFgHiJkLmNoP"; text[16][0]="aBcDeFgHiJkLmNoPqzzzzzzzzzz"; text[16][1]="zaBcDeFgHiJkLmNoPqzzzzzzzzz"; text[16][2]="zzaBcDeFgHiJkLmNoPqzzzzzzzz"; text[16][3]="zzzaBcDeFgHiJkLmNoPqzzzzzzz"; text[16][4]="zzzzaBcDeFgHiJkLmNoPqzzzzzz"; text[16][5]="zzzzzaBcDeFgHiJkLmNoPqzzzzz"; text[16][6]="zzzzzzaBcDeFgHiJkLmNoPqzzzz"; text[16][7]="zzzzzzzaBcDeFgHiJkLmNoPqzzz"; text[16][8]="zzzzzzzzaBcDeFgHiJkLmNoPqzz"; text[16][9]="zzzzzzzzzaBcDeFgHiJkLmNoPqz"; text[16][10]="zzzzzzzzzzaBcDeFgHiJkLmNoPq"; text[17][0]="aBcDeFgHiJkLmNoPqRzzzzzzzzz"; text[17][1]="zaBcDeFgHiJkLmNoPqRzzzzzzzz"; text[17][2]="zzaBcDeFgHiJkLmNoPqRzzzzzzz"; text[17][3]="zzzaBcDeFgHiJkLmNoPqRzzzzzz"; text[17][4]="zzzzaBcDeFgHiJkLmNoPqRzzzzz"; text[17][5]="zzzzzaBcDeFgHiJkLmNoPqRzzzz"; text[17][6]="zzzzzzaBcDeFgHiJkLmNoPqRzzz"; text[17][7]="zzzzzzzaBcDeFgHiJkLmNoPqRzz"; text[17][8]="zzzzzzzzaBcDeFgHiJkLmNoPqRz"; text[17][9]="zzzzzzzzzaBcDeFgHiJkLmNoPqR"; text[18][0]="aBcDeFgHiJkLmNoPqRszzzzzzzz"; text[18][1]="zaBcDeFgHiJkLmNoPqRszzzzzzz"; text[18][2]="zzaBcDeFgHiJkLmNoPqRszzzzzz"; text[18][3]="zzzaBcDeFgHiJkLmNoPqRszzzzz"; text[18][4]="zzzzaBcDeFgHiJkLmNoPqRszzzz"; text[18][5]="zzzzzaBcDeFgHiJkLmNoPqRszzz"; text[18][6]="zzzzzzaBcDeFgHiJkLmNoPqRszz"; text[18][7]="zzzzzzzaBcDeFgHiJkLmNoPqRsz"; text[18][8]="zzzzzzzzaBcDeFgHiJkLmNoPqRs"; text[19][0]="aBcDeFgHiJkLmNoPqRsTzzzzzzz"; text[19][1]="zaBcDeFgHiJkLmNoPqRsTzzzzzz"; text[19][2]="zzaBcDeFgHiJkLmNoPqRsTzzzzz"; text[19][3]="zzzaBcDeFgHiJkLmNoPqRsTzzzz"; text[19][4]="zzzzaBcDeFgHiJkLmNoPqRsTzzz"; text[19][5]="zzzzzaBcDeFgHiJkLmNoPqRsTzz"; text[19][6]="zzzzzzaBcDeFgHiJkLmNoPqRsTz"; text[19][7]="zzzzzzzaBcDeFgHiJkLmNoPqRsT"; text[20][0]="aBcDeFgHiJkLmNoPqRsTuzzzzzz"; text[20][1]="zaBcDeFgHiJkLmNoPqRsTuzzzzz"; text[20][2]="zzaBcDeFgHiJkLmNoPqRsTuzzzz"; text[20][3]="zzzaBcDeFgHiJkLmNoPqRsTuzzz"; text[20][4]="zzzzaBcDeFgHiJkLmNoPqRsTuzz"; text[20][5]="zzzzzaBcDeFgHiJkLmNoPqRsTuz"; text[20][6]="zzzzzzaBcDeFgHiJkLmNoPqRsTu"; text[21][0]="aBcDeFgHiJkLmNoPqRsTuVzzzzz"; text[21][1]="zaBcDeFgHiJkLmNoPqRsTuVzzzz"; text[21][2]="zzaBcDeFgHiJkLmNoPqRsTuVzzz"; text[21][3]="zzzaBcDeFgHiJkLmNoPqRsTuVzz"; text[21][4]="zzzzaBcDeFgHiJkLmNoPqRsTuVz"; text[21][5]="zzzzzaBcDeFgHiJkLmNoPqRsTuV"; text[22][0]="aBcDeFgHiJkLmNoPqRsTuVwzzzz"; text[22][1]="zaBcDeFgHiJkLmNoPqRsTuVwzzz"; text[22][2]="zzaBcDeFgHiJkLmNoPqRsTuVwzz"; text[22][3]="zzzaBcDeFgHiJkLmNoPqRsTuVwz"; text[22][4]="zzzzaBcDeFgHiJkLmNoPqRsTuVw"; text[23][0]="aBcDeFgHiJkLmNoPqRsTuVwXzzz"; text[23][1]="zaBcDeFgHiJkLmNoPqRsTuVwXzz"; text[23][2]="zzaBcDeFgHiJkLmNoPqRsTuVwXz"; text[23][3]="zzzaBcDeFgHiJkLmNoPqRsTuVwX"; text[24][0]="aBcDeFgHiJkLmNoPqRsTuVwXyzz"; text[24][1]="zaBcDeFgHiJkLmNoPqRsTuVwXyz"; text[24][2]="zzaBcDeFgHiJkLmNoPqRsTuVwXy"; text[25][0]="aBcDeFgHiJkLmNoPqRsTuVwXyZz"; text[25][1]="zaBcDeFgHiJkLmNoPqRsTuVwXyZ"; char *needle[26]; needle[0]="A"; needle[1]="Ab"; needle[2]="AbC"; needle[3]="AbCd"; needle[4]="AbCdE"; needle[5]="AbCdEf"; needle[6]="AbCdEfG"; needle[7]="AbCdEfGh"; needle[8]="AbCdEfGhI"; needle[9]="AbCdEfGhIJ"; needle[10]="AbCdEfGhIjK"; needle[11]="AbCdEfGhIjKl"; needle[12]="AbCdEfGhIjKlM"; needle[13]="AbCdEfGhIjKlMn"; needle[14]="AbCdEfGhIjKlMnO"; needle[15]="AbCdEfGhIjKlMnOp"; needle[16]="AbCdEfGhIjKlMnOpQ"; needle[17]="AbCdEfGhIjKlMnOpQr"; needle[18]="AbCdEfGhIjKlMnOpQrS"; needle[19]="AbCdEfGhIjKlMnOpQrSt"; needle[20]="AbCdEfGhIjKlMnOpQrStU"; needle[21]="AbCdEfGhIjKlMnOpQrStUv"; needle[22]="AbCdEfGhIjKlMnOpQrStUvW"; needle[23]="AbCdEfGhIjKlMnOpQrStUvWx"; needle[24]="AbCdEfGhIjKlMnOpQrStUvWxY"; needle[25]="AbCdEfGhIjKlMnOpQrStUvWxYZ"; int i, j; uint8_t *found = NULL; for (i = 0; i < 26; i++) { for (j = 0; j <= (26-i); j++) { found = BasicSearchNocaseWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } found = Bs2bmNocaseWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } found = BoyerMooreNocaseWrapper((uint8_t *)text[i][j], (uint8_t *)needle[i], 1); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i][j]); return 0; } } } return 1; } /** * \test Give some stats */ int UtilSpmSearchStatsTest01() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1]="aaaaaaaaazaaaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaazaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaazaaaaaraaaaazaaaaaaazaaaaaaaaaaaaaazaaaaaaaazaaaaaaaaazaaaaaaaaaaaaB"; text[2]="aBaBaBaBaBaBaBaBazaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBzBaBaBaBaBaBaBzBaBaBaBaBzBaBaBaBaBaBzBaBaBaBaBaBzBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBazaBaBaBaBaBc"; text[3]="aBcaBcaBcaBcaBczBcaBcaBzaBcaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBzaBcaBcaBcazcaBcaBcaBcaBcaBcD"; text[4]="aBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDzBcDaBcDaBcDaBcDzBcDaBcDaBczaBcDaBcDaBczaBcDaBcDaBcDaBcDaBzDaBcDaBcDaBcDaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDaBcDaBzDaBcDaBcDaBcDaBzDaBcDaBcDaBzDaBcDaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDazcDaBcDaBcDaBcDaBcDzBcDaBcDaBcDaBcDaBcDaBcDe"; text[5]="aBcDeaBcDeaBcDeazcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDezBcDeaBcDeaBcDzaBcDeaBcDeaBcDeazcDzaBcDeaBcDezBcDeaBzDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBczeaBcDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDzaBcDeaBcDezBcDeaBcDezBcDeaBczeaBcDeaBcDeaBzDeaBcDezBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeF"; text[6]="aBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBczzaBcDeaBcDeaBcDzazcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDeaBczeaBcDezzzaBcDeFg"; text[7]="aBcDeaBczeaBcDzaBcDezBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBzDzaBcDeaBcDeazcDeaBcDzaBcDeaBczeaBcDeaBcDeaBzDzaBcDeaBcDeaBcDezBcDzaBcDeaBzDeaBcDeaBcDezBcDzaBcDeaBcDeaBzDeaBcDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBrDeaBcDeaBcDezzzaBcDeFgH"; text[8]="aBcDeaBcDeaBczzaBcDeazcDeaBcDezBcDeaBcDzaBcDeaBcDeaBcDeaBczzaBcDeaBcDeaBczeaBcDeaBcDzzBcDeaBcDeaBcDzaBczeaBcDeaBcDzaBcDeaBczeaBcDeaBcDeaBzDeaBcDeaBcDeaBzDeaBcDeaBcDzaBcDeaBcDeazcDeaBcDeaBcDzaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBczeaBcDeaBzDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHi"; text[9]="aBcDeaBcDzaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeazcDeaBcDeaBcDzzBcDeaBcDeaBczeaBcDzaBcDezBcDeaBczeaBcDzaBcDezBcDeaBcDzaBczeaBcDeaBcDzaBcDeazcDeaBcDeaBcDzaBczeaBcDeaBcDzaBzDeaBcDeaBczeaBcDeaBcDzaBcDeaBcDeaBzDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDeaBzDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJ"; text[10]="aBcDeaBcDeaBczeaBcDzaBczeaBcDeaBczeaBcDeaBcDzaBcDeaBcDeazcDeaBcDeaBcDeaBzDzaBcDeazcDeaBcDeazcDeaBcDzaBcDeazcDeaBcDeaBczzaBcDeaBcDeaBzDeaBcDeaBcDzaBczeaBcDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDezBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDezBcDeaBcDeaBcDeaBzDeaBcDeaBcDezzzaBcDeFgHiJk"; text[11]="aBcDeaBcDeaBcDeaBcDeaBzDeaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDeazcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDzzBcDeaBcDeaBcDeaBcDzaBcDzaBcDeaBzDeaBcDeaBcDezBcDeaBcDeazcDeaBcDeaBcDezBcDeaBcDeaBcDeazcDeaBcDeaBzDeaBcDeaBczeaBcDeazcDeaBcDezBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkL"; text[12]="aBcDeaBcDeaBcDeaBcDeaBzDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDeazcDeaBcDeaBcDeazcDeaBcDeaBczeaBcDeaBcDeaBcDezBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLm"; text[13]="aBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLmN"; text[14]="aBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDezzzaBcDeFgHiJkLmNo"; text[15]="aBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of greater length (text with a lot of partial matches, worst case for a basic search):\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /** * \test Give some stats for */ int UtilSpmSearchStatsTest02() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmSearchStatsTest03() { char *text[16]; text[0]="zzzzzza"; text[1]="zzzzzzaB"; text[2]="zzzzzzaBc"; text[3]="zzzzzzaBcD"; text[4]="zzzzzzaBcDe"; text[5]="zzzzzzzzaBcDeF"; text[6]="zzzzzzzzaBcDeFg"; text[7]="zzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length (badcase for):\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /** * \test Give some stats */ int UtilSpmSearchStatsTest04() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1]="aaaaaaaaazaaaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaazaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaaaaaaaaazaaaaaaaaaaaaaaaaazaaaaaaaaazaaaaaaaaaazaaaaaraaaaazaaaaaaazaaaaaaaaaaaaaazaaaaaaaazaaaaaaaaazaaaaaaaaaaaaB"; text[2]="aBaBaBaBaBaBaBaBazaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBzBaBaBaBaBaBaBzBaBaBaBaBzBaBaBaBaBaBzBaBaBaBaBaBzBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBaBaBzBaBaBaBaBaBaBaBaBaBaBazaBaBaBaBaBaBaBazaBaBaBaBaBc"; text[3]="aBcaBcaBcaBcaBczBcaBcaBzaBcaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBcaBcaBczBcaBcaBcaBcaBzaBcaBcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcazcaBcaBcaBcaBcaBcaBzaBcaBcaBcazcaBcaBcaBcaBcaBcD"; text[4]="aBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDzBcDaBcDaBcDaBcDzBcDaBcDaBczaBcDaBcDaBczaBcDaBcDaBcDaBcDaBzDaBcDaBcDaBcDaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDaBcDaBzDaBcDaBcDaBcDaBzDaBcDaBcDaBzDaBcDaBcDaBcDaBcDaBcDaBczaBcDaBcDaBcDaBcDazcDaBcDaBcDaBcDaBcDzBcDaBcDaBcDaBcDaBcDaBcDe"; text[5]="aBcDeaBcDeaBcDeazcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDezBcDeaBcDeaBcDzaBcDeaBcDeaBcDeazcDzaBcDeaBcDezBcDeaBzDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBczeaBcDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDzaBcDeaBcDezBcDeaBcDezBcDeaBczeaBcDeaBcDeaBzDeaBcDezBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeF"; text[6]="aBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBczzaBcDeaBcDeaBcDzazcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDeaBczeaBcDezzzaBcDeFg"; text[7]="aBcDeaBczeaBcDzaBcDezBcDeaBcDeaBcDeaBcDzaBzDeaBcDeaBcDeaBzDzaBcDeaBcDeazcDeaBcDzaBcDeaBczeaBcDeaBcDeaBzDzaBcDeaBcDeaBcDezBcDzaBcDeaBzDeaBcDeaBcDezBcDzaBcDeaBcDeaBzDeaBcDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBrDeaBcDeaBcDezzzaBcDeFgH"; text[8]="aBcDeaBcDeaBczzaBcDeazcDeaBcDezBcDeaBcDzaBcDeaBcDeaBcDeaBczzaBcDeaBcDeaBczeaBcDeaBcDzzBcDeaBcDeaBcDzaBczeaBcDeaBcDzaBcDeaBczeaBcDeaBcDeaBzDeaBcDeaBcDeaBzDeaBcDeaBcDzaBcDeaBcDeazcDeaBcDeaBcDzaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeazcDeaBcDeaBcDeaBczeaBcDeaBzDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHi"; text[9]="aBcDeaBcDzaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeazcDeaBcDeaBcDzzBcDeaBcDeaBczeaBcDzaBcDezBcDeaBczeaBcDzaBcDezBcDeaBcDzaBczeaBcDeaBcDzaBcDeazcDeaBcDeaBcDzaBczeaBcDeaBcDzaBzDeaBcDeaBczeaBcDeaBcDzaBcDeaBcDeaBzDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDeaBzDeaBcDeaBcDeazcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJ"; text[10]="aBcDeaBcDeaBczeaBcDzaBczeaBcDeaBczeaBcDeaBcDzaBcDeaBcDeazcDeaBcDeaBcDeaBzDzaBcDeazcDeaBcDeazcDeaBcDzaBcDeazcDeaBcDeaBczzaBcDeaBcDeaBzDeaBcDeaBcDzaBczeaBcDeaBcDeaBcDeaBczeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDezBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDezBcDeaBcDeaBcDeaBzDeaBcDeaBcDezzzaBcDeFgHiJk"; text[11]="aBcDeaBcDeaBcDeaBcDeaBzDeaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDeazcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDzaBcDzaBcDeaBcDeaBcDeaBcDzzBcDeaBcDeaBcDeaBcDzaBcDzaBcDeaBzDeaBcDeaBcDezBcDeaBcDeazcDeaBcDeaBcDezBcDeaBcDeaBcDeazcDeaBcDeaBzDeaBcDeaBczeaBcDeazcDeaBcDezBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkL"; text[12]="aBcDeaBcDeaBcDeaBcDeaBzDeaBcDeaBzDeaBcDeaBcDezBcDeaBcDeazcDeaBcDeaBcDeazcDeaBcDeaBczeaBcDeaBcDeaBcDezBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLm"; text[13]="aBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLmN"; text[14]="aBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDezzzaBcDeFgHiJkLmNo"; text[15]="aBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDzaBcDeaBcDeaBcDeaBcDezzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of greater length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i + 1); found = BasicSearchCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i + 1); found = Bs2bmCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i + 1); found = BoyerMooreCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with SpmSearch (Building Context):", i + 1); found = RawCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /** * \test Give some stats for */ int UtilSpmSearchStatsTest05() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmSearchStatsTest06() { char *text[16]; text[0]="zzzzkzzzzzzzkzzzzzza"; text[1]="BBBBkBBBBBBBkBBBBBaB"; text[2]="BcBckcBcBcBckcBcBcaBc"; text[3]="BcDBkDBcDBcDkcDBcDaBcD"; text[4]="BcDekcDeBcDekcDezzaBcDe"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length (badcase for):\n"); for (i = 0; i < 5; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmSearchStatsTest07() { char *text[16]; text[0]="zzzza"; text[1]="BBBaB"; text[2]="bbaBc"; text[3]="aaBcD"; text[4]="aBcDe"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; int i; uint8_t *found = NULL; printf("\nStats for text of real lower length (badcase for):\n"); for (i = 0; i < 5; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /** * \test Give some stats for no case algorithms */ int UtilSpmNocaseSearchStatsTest01() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of greater length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmNocaseSearchStatsTest02() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmNocaseSearchStatsTest03() { char *text[16]; text[0]="zzzzkzzzzzzzkzzzzzza"; text[1]="BBBBkBBBBBBBkBBBBBaB"; text[2]="BcBckcBcBcBckcBcBcaBc"; text[3]="BcDBkDBcDBcDkcDBcDaBcD"; text[4]="BcDekcDeBcDekcDezzaBcDe"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length (badcase for):\n"); for (i = 0; i < 5; i++) { printf("Pattern length %d with BasicSearch:", i+1); found = BasicSearchNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch:", i+1); found = Bs2bmNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch:", i+1); found = BoyerMooreNocaseWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /** * \test Give some stats for no case algorithms */ int UtilSpmNocaseSearchStatsTest04() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of greater length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmNocaseSearchStatsTest05() { char *text[16]; text[0]="zzzzzzzzzzzzzzzzzza"; text[1]="zzzzzzzzzzzzzzzzzzaB"; text[2]="zzzzzzzzzzzzzzzzzzaBc"; text[3]="zzzzzzzzzzzzzzzzzzaBcD"; text[4]="zzzzzzzzzzzzzzzzzzaBcDe"; text[5]="zzzzzzzzzzzzzzzzzzzzaBcDeF"; text[6]="zzzzzzzzzzzzzzzzzzzzaBcDeFg"; text[7]="zzzzzzzzzzzzzzzzzzzzaBcDeFgH"; text[8]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHi"; text[9]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJ"; text[10]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJk"; text[11]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkL"; text[12]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLm"; text[13]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmN"; text[14]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNo"; text[15]="zzzzzzzzzzzzzzzzzzzzaBcDeFgHiJkLmNoP"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; needle[5]="aBcDeF"; needle[6]="aBcDeFg"; needle[7]="aBcDeFgH"; needle[8]="aBcDeFgHi"; needle[9]="aBcDeFgHiJ"; needle[10]="aBcDeFgHiJk"; needle[11]="aBcDeFgHiJkL"; needle[12]="aBcDeFgHiJkLm"; needle[13]="aBcDeFgHiJkLmN"; needle[14]="aBcDeFgHiJkLmNo"; needle[15]="aBcDeFgHiJkLmNoP"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length:\n"); for (i = 0; i < 16; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmNocaseSearchStatsTest06() { char *text[16]; text[0]="zzzzkzzzzzzzkzzzzzza"; text[1]="BBBBkBBBBBBBkBBBBBaB"; text[2]="BcBckcBcBcBckcBcBcaBc"; text[3]="BcDBkDBcDBcDkcDBcDaBcD"; text[4]="BcDekcDeBcDekcDezzaBcDe"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; int i; uint8_t *found = NULL; printf("\nStats for text of lower length (badcase for):\n"); for (i = 0; i < 5; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } int UtilSpmNocaseSearchStatsTest07() { char *text[16]; text[0]="zzzza"; text[1]="bbbAb"; text[2]="bbAbC"; text[3]="bAbCd"; text[4]="AbCdE"; char *needle[16]; needle[0]="a"; needle[1]="aB"; needle[2]="aBc"; needle[3]="aBcD"; needle[4]="aBcDe"; int i; uint8_t *found = NULL; printf("\nStats for text of real lower length (badcase for):\n"); for (i = 0; i < 5; i++) { printf("Pattern length %d with BasicSearch (Building Context):", i+1); found = BasicSearchNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error1 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with Bs2BmSearch (Building Context):", i+1); found = Bs2bmNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error2 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("Pattern length %d with BoyerMooreSearch (Building Context):", i+1); found = BoyerMooreNocaseCtxWrapper((uint8_t *)text[i], (uint8_t *)needle[i], STATS_TIMES); if (found == 0) { printf("Error3 searching for %s in text %s\n", needle[i], text[i]); return 0; } printf("\n"); } return 1; } /* Unit tests for new SPM API. */ #define SPM_NO_MATCH UINT32_MAX /* Helper structure describing a particular search. */ typedef struct SpmTestData_ { const char *needle; uint16_t needle_len; const char *haystack; uint16_t haystack_len; int nocase; uint32_t match_offset; /* offset in haystack, or SPM_NO_MATCH. */ } SpmTestData; /* Helper function to conduct a search with a particular SPM matcher. */ static int SpmTestSearch(const SpmTestData *d, uint16_t matcher) { int ret = 1; SpmGlobalThreadCtx *global_thread_ctx = NULL; SpmThreadCtx *thread_ctx = NULL; SpmCtx *ctx = NULL; uint8_t *found = NULL; global_thread_ctx = SpmInitGlobalThreadCtx(matcher); if (global_thread_ctx == NULL) { ret = 0; goto exit; } ctx = SpmInitCtx((const uint8_t *)d->needle, d->needle_len, d->nocase, global_thread_ctx); if (ctx == NULL) { ret = 0; goto exit; } thread_ctx = SpmMakeThreadCtx(global_thread_ctx); if (thread_ctx == NULL) { ret = 0; goto exit; } found = SpmScan(ctx, thread_ctx, (const uint8_t *)d->haystack, d->haystack_len); if (found == NULL) { if (d->match_offset != SPM_NO_MATCH) { printf(" should have matched at %" PRIu32 " but didn't\n", d->match_offset); ret = 0; } } else { uint32_t offset = (uint32_t)(found - (const uint8_t *)d->haystack); if (offset != d->match_offset) { printf(" should have matched at %" PRIu32 " but matched at %" PRIu32 "\n", d->match_offset, offset); ret = 0; } } exit: SpmDestroyCtx(ctx); SpmDestroyThreadCtx(thread_ctx); SpmDestroyGlobalThreadCtx(global_thread_ctx); return ret; } int SpmSearchTest01() { SpmTableSetup(); printf("\n"); /* Each of the following tests will be run against every registered SPM * algorithm. */ static const SpmTestData data[] = { /* Some trivial single-character case/nocase tests */ {"a", 1, "a", 1, 0, 0}, {"a", 1, "A", 1, 1, 0}, {"A", 1, "A", 1, 0, 0}, {"A", 1, "a", 1, 1, 0}, {"a", 1, "A", 1, 0, SPM_NO_MATCH}, {"A", 1, "a", 1, 0, SPM_NO_MATCH}, /* Nulls and odd characters */ {"\x00", 1, "test\x00test", 9, 0, 4}, {"\x00", 1, "testtest", 8, 0, SPM_NO_MATCH}, {"\n", 1, "new line\n", 9, 0, 8}, {"\n", 1, "new line\x00\n", 10, 0, 9}, {"\xff", 1, "abcdef\xff", 7, 0, 6}, {"\xff", 1, "abcdef\xff", 7, 1, 6}, {"$", 1, "dollar$", 7, 0, 6}, {"^", 1, "caret^", 6, 0, 5}, /* Longer literals */ {"Suricata", 8, "This is a Suricata test", 23, 0, 10}, {"Suricata", 8, "This is a suricata test", 23, 1, 10}, {"Suricata", 8, "This is a suriCATA test", 23, 1, 10}, {"suricata", 8, "This is a Suricata test", 23, 0, SPM_NO_MATCH}, {"Suricata", 8, "This is a Suricat_ test", 23, 0, SPM_NO_MATCH}, {"Suricata", 8, "This is a _uricata test", 23, 0, SPM_NO_MATCH}, /* First occurrence with the correct case should match */ {"foo", 3, "foofoofoo", 9, 0, 0}, {"foo", 3, "_foofoofoo", 9, 0, 1}, {"FOO", 3, "foofoofoo", 9, 1, 0}, {"FOO", 3, "_foofoofoo", 9, 1, 1}, {"FOO", 3, "foo Foo FOo fOo foO FOO", 23, 0, 20}, {"foo", 3, "Foo FOo fOo foO FOO foo", 23, 0, 20}, }; int ret = 1; uint16_t matcher; for (matcher = 0; matcher < SPM_TABLE_SIZE; matcher++) { const SpmTableElmt *m = &spm_table[matcher]; if (m->name == NULL) { continue; } printf("matcher: %s\n", m->name); uint32_t i; for (i = 0; i < sizeof(data)/sizeof(data[0]); i++) { const SpmTestData *d = &data[i]; if (SpmTestSearch(d, matcher) == 0) { printf(" test %" PRIu32 ": fail\n", i); ret = 0; } } printf(" %" PRIu32 " tests passed\n", i); } return ret; } int SpmSearchTest02() { SpmTableSetup(); printf("\n"); /* Test that we can find needles of various lengths at various alignments * in the haystack. Note that these are passed to strlen. */ static const char* needles[] = { /* Single bytes */ "a", "b", "c", ":", "/", "\x7f", "\xff", /* Repeats */ "aa", "aaa", "aaaaaaaaaaaaaaaaaaaaaaa", /* Longer literals */ "suricata", "meerkat", "aardvark", "raptor", "marmot", "lemming", /* Mixed case */ "Suricata", "CAPS LOCK", "mIxEd cAsE", }; int ret = 1; uint16_t matcher; for (matcher = 0; matcher < SPM_TABLE_SIZE; matcher++) { const SpmTableElmt *m = &spm_table[matcher]; if (m->name == NULL) { continue; } printf("matcher: %s\n", m->name); SpmTestData d; uint32_t i; for (i = 0; i < sizeof(needles) / sizeof(needles[0]); i++) { const char *needle = needles[i]; uint16_t prefix; for (prefix = 0; prefix < 32; prefix++) { d.needle = needle; d.needle_len = strlen(needle); uint16_t haystack_len = prefix + d.needle_len; char *haystack = SCMalloc(haystack_len); if (haystack == NULL) { printf("alloc failure\n"); return 0; } memset(haystack, ' ', haystack_len); memcpy(haystack + prefix, d.needle, d.needle_len); d.haystack = haystack; d.haystack_len = haystack_len; d.nocase = 0; d.match_offset = prefix; /* Case-sensitive scan */ if (SpmTestSearch(&d, matcher) == 0) { printf(" test %" PRIu32 ": fail (case-sensitive)\n", i); ret = 0; } /* Case-insensitive scan */ d.nocase = 1; uint16_t j; for (j = 0; j < haystack_len; j++) { haystack[j] = toupper(haystack[j]); } if (SpmTestSearch(&d, matcher) == 0) { printf(" test %" PRIu32 ": fail (case-insensitive)\n", i); ret = 0; } SCFree(haystack); } } printf(" %" PRIu32 " tests passed\n", i); } return ret; } #endif /* Register unittests */ void UtilSpmSearchRegistertests(void) { #ifdef UNITTESTS /* Generic tests */ UtRegisterTest("UtilSpmBasicSearchTest01", UtilSpmBasicSearchTest01); UtRegisterTest("UtilSpmBasicSearchNocaseTest01", UtilSpmBasicSearchNocaseTest01); UtRegisterTest("UtilSpmBs2bmSearchTest01", UtilSpmBs2bmSearchTest01); UtRegisterTest("UtilSpmBs2bmSearchNocaseTest01", UtilSpmBs2bmSearchNocaseTest01); UtRegisterTest("UtilSpmBoyerMooreSearchTest01", UtilSpmBoyerMooreSearchTest01); UtRegisterTest("UtilSpmBoyerMooreSearchNocaseTest01", UtilSpmBoyerMooreSearchNocaseTest01); UtRegisterTest("UtilSpmBoyerMooreSearchNocaseTestIssue130", UtilSpmBoyerMooreSearchNocaseTestIssue130); UtRegisterTest("UtilSpmBs2bmSearchTest02", UtilSpmBs2bmSearchTest02); UtRegisterTest("UtilSpmBs2bmSearchNocaseTest02", UtilSpmBs2bmSearchNocaseTest02); UtRegisterTest("UtilSpmBasicSearchTest02", UtilSpmBasicSearchTest02); UtRegisterTest("UtilSpmBasicSearchNocaseTest02", UtilSpmBasicSearchNocaseTest02); UtRegisterTest("UtilSpmBoyerMooreSearchTest02", UtilSpmBoyerMooreSearchTest02); UtRegisterTest("UtilSpmBoyerMooreSearchNocaseTest02", UtilSpmBoyerMooreSearchNocaseTest02); /* test matches at any offset */ UtRegisterTest("UtilSpmSearchOffsetsTest01", UtilSpmSearchOffsetsTest01); UtRegisterTest("UtilSpmSearchOffsetsNocaseTest01", UtilSpmSearchOffsetsNocaseTest01); /* new SPM API */ UtRegisterTest("SpmSearchTest01", SpmSearchTest01); UtRegisterTest("SpmSearchTest02", SpmSearchTest02); #ifdef ENABLE_SEARCH_STATS /* Give some stats searching given a prepared context (look at the wrappers) */ UtRegisterTest("UtilSpmSearchStatsTest01", UtilSpmSearchStatsTest01); UtRegisterTest("UtilSpmSearchStatsTest02", UtilSpmSearchStatsTest02); UtRegisterTest("UtilSpmSearchStatsTest03", UtilSpmSearchStatsTest03); UtRegisterTest("UtilSpmNocaseSearchStatsTest01", UtilSpmNocaseSearchStatsTest01); UtRegisterTest("UtilSpmNocaseSearchStatsTest02", UtilSpmNocaseSearchStatsTest02); UtRegisterTest("UtilSpmNocaseSearchStatsTest03", UtilSpmNocaseSearchStatsTest03); /* Stats building context and searching */ UtRegisterTest("UtilSpmSearchStatsTest04", UtilSpmSearchStatsTest04); UtRegisterTest("UtilSpmSearchStatsTest05", UtilSpmSearchStatsTest05); UtRegisterTest("UtilSpmSearchStatsTest06", UtilSpmSearchStatsTest06); UtRegisterTest("UtilSpmSearchStatsTest07", UtilSpmSearchStatsTest07); UtRegisterTest("UtilSpmNocaseSearchStatsTest04", UtilSpmNocaseSearchStatsTest04); UtRegisterTest("UtilSpmNocaseSearchStatsTest05", UtilSpmNocaseSearchStatsTest05); UtRegisterTest("UtilSpmNocaseSearchStatsTest06", UtilSpmNocaseSearchStatsTest06); UtRegisterTest("UtilSpmNocaseSearchStatsTest07", UtilSpmNocaseSearchStatsTest07); #endif #endif } suricata-3.2.1/src/detect-l3proto.h0000644000000000000000000000170713051004444014027 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * */ #ifndef __DETECT_L3PROTO_H__ #define __DETECT_L3PROTO_H__ /** * \brief Registration function for ip_proto keyword. */ void DetectL3ProtoRegister (void); #endif /* __DETECT_L3PROTO_H__ */ suricata-3.2.1/src/detect-lua.h0000644000000000000000000000340113051004444013177 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_LUAJIT_H__ #define __DETECT_LUAJIT_H__ #ifdef HAVE_LUA typedef struct DetectLuaThreadData { lua_State *luastate; uint32_t flags; int alproto; } DetectLuaThreadData; #define DETECT_LUAJIT_MAX_FLOWVARS 15 #define DETECT_LUAJIT_MAX_FLOWINTS 15 typedef struct DetectLuaData { int thread_ctx_id; int negated; char *filename; uint32_t flags; AppProto alproto; char *buffername; /* buffer name in case of a single buffer */ uint16_t flowint[DETECT_LUAJIT_MAX_FLOWINTS]; uint16_t flowints; uint16_t flowvar[DETECT_LUAJIT_MAX_FLOWVARS]; uint16_t flowvars; uint32_t sid; uint32_t rev; uint32_t gid; } DetectLuaData; #endif /* HAVE_LUA */ /* prototypes */ void DetectLuaRegister (void); int DetectLuaMatchBuffer(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, uint8_t *buffer, uint32_t buffer_len, uint32_t offset, Flow *f); void DetectLuaPostSetup(Signature *s); #endif /* __DETECT_FILELUAJIT_H__ */ suricata-3.2.1/src/detect-engine-filedata-smtp.h0000644000000000000000000000273613051004444016425 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Giuseppe Longo */ #ifndef __DETECT_ENGINE_FILEDATA_SMTP_H__ #define __DETECT_ENGINE_FILEDATA_SMTP_H__ #include "app-layer-smtp.h" int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectSMTPFiledata(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineCleanSMTPBuffers(DetectEngineThreadCtx *det_ctx); void DetectEngineSMTPFiledataRegisterTests(void); #endif /* __DETECT_ENGINE_FILEDATA_SMTP_H__ */ suricata-3.2.1/src/util-unittest-helper.c0000644000000000000000000007405613051004444015270 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * This file provide a set of helper functions for reducing the complexity * when constructing unittests */ #include "suricata-common.h" #include "decode.h" #include "flow-private.h" #include "flow-util.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-sigorder.h" #include "util-debug.h" #include "util-time.h" #include "util-error.h" #include "util-unittest.h" #include "util-unittest-helper.h" #ifdef UNITTESTS /** * \brief return the uint32_t for a ipv4 address string * * \param str Valid ipaddress in string form (e.g. 1.2.3.4) * * \retval uint the uin32_t representation */ uint32_t UTHSetIPv4Address(char *str) { struct in_addr in; if (inet_pton(AF_INET, str, &in) != 1) { printf("invalid IPv6 address %s\n", str); exit(EXIT_FAILURE); } return (uint32_t)in.s_addr; } /** * \brief UTHBuildPacketReal is a function that create tcp/udp packets for unittests * specifying ip and port sources and destinations (IPV6) * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * \param src pointer to a string containing the ip source * \param dst pointer to a string containing the ip destination * \param sport pointer to a string containing the port source * \param dport pointer to a string containing the port destination * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacketIPV6Real(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, char *src, char *dst, uint16_t sport, uint16_t dport) { uint32_t in[4]; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return NULL; TimeGet(&p->ts); p->src.family = AF_INET6; p->dst.family = AF_INET6; p->payload = payload; p->payload_len = payload_len; p->proto = ipproto; p->ip6h = SCMalloc(sizeof(IPV6Hdr)); if (p->ip6h == NULL) goto error; memset(p->ip6h, 0, sizeof(IPV6Hdr)); p->ip6h->s_ip6_nxt = ipproto; p->ip6h->s_ip6_plen = htons(payload_len + sizeof(TCPHdr)); if (inet_pton(AF_INET6, src, &in) != 1) goto error; p->src.addr_data32[0] = in[0]; p->src.addr_data32[1] = in[1]; p->src.addr_data32[2] = in[2]; p->src.addr_data32[3] = in[3]; p->sp = sport; p->ip6h->s_ip6_src[0] = in[0]; p->ip6h->s_ip6_src[1] = in[1]; p->ip6h->s_ip6_src[2] = in[2]; p->ip6h->s_ip6_src[3] = in[3]; if (inet_pton(AF_INET6, dst, &in) != 1) goto error; p->dst.addr_data32[0] = in[0]; p->dst.addr_data32[1] = in[1]; p->dst.addr_data32[2] = in[2]; p->dst.addr_data32[3] = in[3]; p->dp = dport; p->ip6h->s_ip6_dst[0] = in[0]; p->ip6h->s_ip6_dst[1] = in[1]; p->ip6h->s_ip6_dst[2] = in[2]; p->ip6h->s_ip6_dst[3] = in[3]; p->tcph = SCMalloc(sizeof(TCPHdr)); if (p->tcph == NULL) goto error; memset(p->tcph, 0, sizeof(TCPHdr)); p->tcph->th_sport = htons(sport); p->tcph->th_dport = htons(dport); SET_PKT_LEN(p, sizeof(IPV6Hdr) + sizeof(TCPHdr) + payload_len); return p; error: if (p != NULL) { if (p->ip6h != NULL) { SCFree(p->ip6h); } if (p->tcph != NULL) { SCFree(p->tcph); } SCFree(p); } return NULL; } /** * \brief UTHBuildPacketReal is a function that create tcp/udp packets for unittests * specifying ip and port sources and destinations * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * \param src pointer to a string containing the ip source * \param dst pointer to a string containing the ip destination * \param sport pointer to a string containing the port source * \param dport pointer to a string containing the port destination * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, char *src, char *dst, uint16_t sport, uint16_t dport) { struct in_addr in; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return NULL; struct timeval tv; TimeGet(&tv); COPY_TIMESTAMP(&tv, &p->ts); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = payload; p->payload_len = payload_len; p->proto = ipproto; if (inet_pton(AF_INET, src, &in) != 1) goto error; p->src.addr_data32[0] = in.s_addr; p->sp = sport; if (inet_pton(AF_INET, dst, &in) != 1) goto error; p->dst.addr_data32[0] = in.s_addr; p->dp = dport; p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p); if (p->ip4h == NULL) goto error; p->ip4h->s_ip_src.s_addr = p->src.addr_data32[0]; p->ip4h->s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h->ip_proto = ipproto; p->ip4h->ip_verhl = sizeof(IPV4Hdr); p->proto = ipproto; int hdr_offset = sizeof(IPV4Hdr); switch (ipproto) { case IPPROTO_UDP: p->udph = (UDPHdr *)(GET_PKT_DATA(p) + sizeof(IPV4Hdr)); if (p->udph == NULL) goto error; p->udph->uh_sport = sport; p->udph->uh_dport = dport; hdr_offset += sizeof(UDPHdr); break; case IPPROTO_TCP: p->tcph = (TCPHdr *)(GET_PKT_DATA(p) + sizeof(IPV4Hdr)); if (p->tcph == NULL) goto error; p->tcph->th_sport = htons(sport); p->tcph->th_dport = htons(dport); hdr_offset += sizeof(TCPHdr); break; case IPPROTO_ICMP: p->icmpv4h = (ICMPV4Hdr *)(GET_PKT_DATA(p) + sizeof(IPV4Hdr)); if (p->icmpv4h == NULL) goto error; hdr_offset += sizeof(ICMPV4Hdr); break; default: break; /* TODO: Add more protocols */ } if (payload && payload_len) { PacketCopyDataOffset(p, hdr_offset, payload, payload_len); } SET_PKT_LEN(p, hdr_offset + payload_len); p->payload = GET_PKT_DATA(p)+hdr_offset; return p; error: SCFree(p); return NULL; } /** * \brief UTHBuildPacket is a wrapper that build packets with default ip * and port fields * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto) { return UTHBuildPacketReal(payload, payload_len, ipproto, "192.168.1.5", "192.168.1.1", 41424, 80); } /** * \brief UTHBuildPacketArrayFromEth is a wrapper that build a packets from an array of * packets in ethernet rawbytes. Hint: It also share the flows. * * \param raw_eth pointer to the array of ethernet packets in rawbytes * \param pktsize pointer to the array of sizes corresponding to each buffer pointed * from pktsize. * \param numpkts number of packets in the array * * \retval Packet pointer to the array of built in packets; NULL if something fail */ Packet **UTHBuildPacketArrayFromEth(uint8_t *raw_eth[], int *pktsize, int numpkts) { DecodeThreadVars dtv; ThreadVars th_v; if (raw_eth == NULL || pktsize == NULL || numpkts <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "The arrays cant be null, and the number" " of packets should be grater thatn zero"); return NULL; } Packet **p = NULL; p = SCMalloc(sizeof(Packet *) * numpkts); if (unlikely(p == NULL)) return NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); int i = 0; for (; i < numpkts; i++) { p[i] = PacketGetFromAlloc(); if (p[i] == NULL) { SCFree(p); return NULL; } DecodeEthernet(&th_v, &dtv, p[i], raw_eth[i], pktsize[i], NULL); } return p; } /** * \brief UTHBuildPacketFromEth is a wrapper that build a packet for the rawbytes * * \param raw_eth pointer to the rawbytes containing an ethernet packet * (and any other headers inside) * \param pktsize pointer to the length of the payload * * \retval Packet pointer to the built in packet; NULL if something fail */ Packet *UTHBuildPacketFromEth(uint8_t *raw_eth, uint16_t pktsize) { DecodeThreadVars dtv; ThreadVars th_v; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DecodeEthernet(&th_v, &dtv, p, raw_eth, pktsize, NULL); return p; } /** * \brief UTHBuildPacketSrcDst is a wrapper that build packets specifying IPs * and defaulting ports * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacketSrcDst(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, char *src, char *dst) { return UTHBuildPacketReal(payload, payload_len, ipproto, src, dst, 41424, 80); } /** * \brief UTHBuildPacketSrcDst is a wrapper that build packets specifying IPs * and defaulting ports (IPV6) * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacketIPV6SrcDst(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, char *src, char *dst) { return UTHBuildPacketIPV6Real(payload, payload_len, ipproto, src, dst, 41424, 80); } /** * \brief UTHBuildPacketSrcDstPorts is a wrapper that build packets specifying * src and dst ports and defaulting IPs * * \param payload pointer to the payloadd buffer * \param payload_len pointer to the length of the payload * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP * * \retval Packet pointer to the built in packet */ Packet *UTHBuildPacketSrcDstPorts(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, uint16_t sport, uint16_t dport) { return UTHBuildPacketReal(payload, payload_len, ipproto, "192.168.1.5", "192.168.1.1", sport, dport); } /** * \brief UTHFreePackets: function to release the allocated data * from UTHBuildPacket and the packet itself * * \param p pointer to the Packet */ void UTHFreePackets(Packet **p, int numpkts) { if (p == NULL) return; int i = 0; for (; i < numpkts; i++) { UTHFreePacket(p[i]); } } /** * \brief UTHFreePacket: function to release the allocated data * from UTHBuildPacket and the packet itself * * \param p pointer to the Packet */ void UTHFreePacket(Packet *p) { if (p == NULL) return; #if 0 // VJ we now use one buffer switch (p->proto) { case IPPROTO_UDP: if (p->udph != NULL) SCFree(p->udph); if (p->ip4h != NULL) SCFree(p->ip4h); break; case IPPROTO_TCP: if (p->tcph != NULL) SCFree(p->tcph); if (p->ip4h != NULL) SCFree(p->ip4h); break; case IPPROTO_ICMP: if (p->ip4h != NULL) SCFree(p->ip4h); break; /* TODO: Add more protocols */ } #endif SCFree(p); } Flow *UTHBuildFlow(int family, char *src, char *dst, Port sp, Port dp) { struct in_addr in; Flow *f = SCMalloc(sizeof(Flow)); if (unlikely(f == NULL)) { printf("FlowAlloc failed\n"); ; return NULL; } memset(f, 0x00, sizeof(Flow)); FLOW_INITIALIZE(f); if (family == AF_INET) { f->flags |= FLOW_IPV4; } else if (family == AF_INET6) { f->flags |= FLOW_IPV6; } if (src != NULL) { if (family == AF_INET) { if (inet_pton(AF_INET, src, &in) != 1) { printf("invalid address %s\n", src); SCFree(f); return NULL; } f->src.addr_data32[0] = in.s_addr; } else { BUG_ON(1); } } if (dst != NULL) { if (family == AF_INET) { if (inet_pton(AF_INET, dst, &in) != 1) { printf("invalid address %s\n", dst); SCFree(f); return NULL; } f->dst.addr_data32[0] = in.s_addr; } else { BUG_ON(1); } } f->sp = sp; f->dp = dp; return f; } void UTHFreeFlow(Flow *flow) { if (flow != NULL) { FlowFree(flow); } } /** * \brief UTHGenericTest: function that perfom a generic check taking care of * as maximum common unittest elements as possible. * It will create a detection engine, append an array * of signatures an check the spected results for each * of them, it check matches for an array of packets * * \param pkt pointer to the array of packets * \param numpkts number of packets to match * \param sigs array of char* pointing to signatures to load * \param numsigs number of signatures to load and check * \param results pointer to arrays of numbers, each of them foreach packet * to check if sids matches that packet as expected with * that number of times or not. The size of results should be * numpkts * numsigs * sizeof(uint16_t *) * * Example: * result[1][3] would mean the number of times the pkt[1] * match the sid[3] * * \retval int 1 if the match of all the sids is the specified has the * specified results; 0 if not */ int UTHGenericTest(Packet **pkt, int numpkts, char *sigs[], uint32_t sids[], uint32_t *results, int numsigs) { int result = 0; if (pkt == NULL || sigs == NULL || numpkts == 0 || sids == NULL || results == NULL || numsigs == 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Arguments invalid, that the pointer/arrays are not NULL, and the number of signatures and packets is > 0"); goto end; } DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; if (UTHAppendSigs(de_ctx, sigs, numsigs) == 0) goto cleanup; result = UTHMatchPacketsWithResults(de_ctx, pkt, numpkts, sids, results, numsigs); cleanup: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return result; } /** * \brief UTHCheckPacketMatches: function to check if a packet match some sids * * * \param p pointer to the Packet * \param sigs array of char* pointing to signatures to load * \param numsigs number of signatures to load from the array * \param results pointer to an array of numbers to check if sids matches * that number of times or not. * * \retval int 1 if the match of all the sids is the specified has the * specified results; 0 if not */ int UTHCheckPacketMatchResults(Packet *p, uint32_t sids[], uint32_t results[], int numsids) { if (p == NULL || sids == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Arguments invalid, check if the " "packet is NULL, and if the array contain sids is set"); return 0; } int i = 0; int res = 1; for (; i < numsids; i++) { uint16_t r = PacketAlertCheck(p, sids[i]); if (r != results[i]) { SCLogInfo("Sid %"PRIu32" matched %"PRIu16" times, and not %"PRIu32 " as expected", sids[i], r, results[i]); res = 0; } else { SCLogInfo("Sid %"PRIu32" matched %"PRIu16" times, as expected", sids[i], r); } } return res; } /** * \brief UTHAppendSigs: Add sigs to the detection_engine checking for errors * * \param de_ctx pointer to the DetectEngineCtx used * \param sigs array of char* pointing to signatures to load * \param numsigs number of signatures to load from the array * (size of the array) * * \retval int 0 if we have errors; 1 if all the signatures loaded succesfuly */ int UTHAppendSigs(DetectEngineCtx *de_ctx, char *sigs[], int numsigs) { if (de_ctx == NULL || numsigs <= 0 || sigs == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Arguments invalid, check if sigs or de_ctx are NULL, and if the array contain sigs"); return 0; } //SCLogDebug("Adding %d signatures for the current unittest", numsigs); Signature *s; int i = 0; for ( ; i < numsigs; i++) { if (sigs[i] == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Check the signature" " at position %d", i); return 0; } s = DetectEngineAppendSig(de_ctx, sigs[i]); if (s == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Check the signature at" " position %d (%s)", i, sigs[i]); return 0; } } //SCLogDebug("Added %d signatures to the de_ctx of the unittest", i); return 1; } /** * \test UTHMatchPacketsWithResults Match a packet or a array of packets against sigs * of a de_ctx, checking that each signature match match X times for certain packets * * \param de_ctx pointer with the signatures loaded * \param p pointer to the array of packets * \param num_packets number of packets in the array * * \retval return 1 if all goes well * \retval return 0 if something fail */ int UTHMatchPacketsWithResults(DetectEngineCtx *de_ctx, Packet **p, int num_packets, uint32_t sids[], uint32_t *results, int numsigs) { int result = 0; if (de_ctx == NULL || p == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "packet or de_ctx was null"); result = 0; goto end; } DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); //de_ctx->flags |= DE_QUIET; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) { SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); if (UTHCheckPacketMatchResults(p[i], sids, &results[(i * numsigs)], numsigs) == 0) goto cleanup; } /* so far, so good ;) */ result = 1; cleanup: if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); end: return result; } /** * \test UTHMatchPackets Match a packet or a array of packets against sigs * of a de_ctx, but note that the return value doesn't mean that we have a * match, we have to check it later with PacketAlertCheck() * * \param de_ctx pointer with the signatures loaded * \param p pointer to the array of packets * \param num_packets number of packets in the array * * \retval return 1 if all goes well * \retval return 0 if something fail */ int UTHMatchPackets(DetectEngineCtx *de_ctx, Packet **p, int num_packets) { int result = 1; if (de_ctx == NULL || p == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "packet or de_ctx was null"); result = 0; goto end; } DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); //de_ctx->flags |= DE_QUIET; SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int i = 0; for (; i < num_packets; i++) SigMatchSignatures(&th_v, de_ctx, det_ctx, p[i]); /* Here we don't check if the packet matched or not, because * the de_ctx can have multiple signatures, and some of them may match * and others may not. That check will be outside */ if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } end: if (de_ctx != NULL) SigGroupCleanup(de_ctx); return result; } /** * \test Test if a packet match a signature given as string and a mpm_type * Hint: Useful for unittests with only one packet and one signature * * \param sig pointer to the string signature to test * \param sid sid number of the signature * * \retval return 1 if match * \retval return 0 if not */ int UTHPacketMatchSigMpm(Packet *p, char *sig, uint16_t mpm_type) { SCEnter(); int result = 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("de_ctx == NULL: "); goto end; } de_ctx->flags |= DE_QUIET; de_ctx->mpm_matcher = mpm_type; de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { printf("signature == NULL: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, de_ctx->sig_list->id) != 1) { printf("signature didn't alert: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); SCReturnInt(result); } /** * \test Test if a packet match a signature given as string * Hint: Useful for unittests with only one packet and one signature * * \param sig pointer to the string signature to test * \param sid sid number of the signature * * \retval return 1 if match * \retval return 0 if not */ int UTHPacketMatchSig(Packet *p, char *sig) { int result = 1; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { result=0; goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, de_ctx->sig_list->id) != 1) { result = 0; goto end; } end: if (de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } uint32_t UTHBuildPacketOfFlows(uint32_t start, uint32_t end, uint8_t dir) { uint32_t i = start; uint8_t payload[] = "Payload"; for (; i < end; i++) { Packet *p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); if (dir == 0) { p->src.addr_data32[0] = i; p->dst.addr_data32[0] = i + 1; } else { p->src.addr_data32[0] = i + 1; p->dst.addr_data32[0] = i; } FlowHandlePacket(NULL, NULL, p); if (p->flow != NULL) { SC_ATOMIC_RESET(p->flow->use_cnt); FLOWLOCK_UNLOCK(p->flow); } /* Now the queues shoul be updated */ UTHFreePacket(p); } return i; } /* * unittests for the unittest helpers */ /** * \brief CheckUTHTestPacket wrapper to check packets for unittests */ int CheckUTHTestPacket(Packet *p, uint8_t ipproto) { uint16_t sport = 41424; uint16_t dport = 80; uint8_t payload[] = "Payload"; uint8_t len = sizeof(payload); if (p == NULL) return 0; if (p->payload_len != len) return 0; if (strncmp((char *)payload, (char *)p->payload, len) != 0) return 0; if (p->src.family != AF_INET) return 0; if (p->dst.family != AF_INET) return 0; if (p->proto != ipproto) return 0; switch(ipproto) { case IPPROTO_UDP: if (p->udph == NULL) return 0; if (p->udph->uh_sport != sport) return 0; if (p->udph->uh_dport != dport) return 0; break; case IPPROTO_TCP: if (p->tcph == NULL) return 0; if (ntohs(p->tcph->th_sport) != sport) return 0; if (ntohs(p->tcph->th_dport) != dport) return 0; break; } return 1; } /** * \brief UTHBuildPacketRealTest01 wrapper to check packets for unittests */ int UTHBuildPacketRealTest01(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketReal(payload, sizeof(payload), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 80); int ret = CheckUTHTestPacket(p, IPPROTO_TCP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketRealTest02 wrapper to check packets for unittests */ int UTHBuildPacketRealTest02(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketReal(payload, sizeof(payload), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 80); int ret = CheckUTHTestPacket(p, IPPROTO_UDP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketTest01 wrapper to check packets for unittests */ int UTHBuildPacketTest01(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); int ret = CheckUTHTestPacket(p, IPPROTO_TCP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketTest02 wrapper to check packets for unittests */ int UTHBuildPacketTest02(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_UDP); int ret = CheckUTHTestPacket(p, IPPROTO_UDP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketOfFlowsTest01 wrapper to check packets for unittests */ int UTHBuildPacketOfFlowsTest01(void) { int result = 0; FlowInitConfig(FLOW_QUIET); uint32_t flow_spare_q_len = flow_spare_q.len; UTHBuildPacketOfFlows(0, 100, 0); if (flow_spare_q.len != flow_spare_q_len - 100) result = 0; else result = 1; FlowShutdown(); return result; } /** * \brief UTHBuildPacketSrcDstTest01 wrapper to check packets for unittests */ int UTHBuildPacketSrcDstTest01(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketSrcDst(payload, sizeof(payload), IPPROTO_TCP, "192.168.1.5", "192.168.1.1"); int ret = CheckUTHTestPacket(p, IPPROTO_TCP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketSrcDstTest02 wrapper to check packets for unittests */ int UTHBuildPacketSrcDstTest02(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketSrcDst(payload, sizeof(payload), IPPROTO_UDP, "192.168.1.5", "192.168.1.1"); int ret = CheckUTHTestPacket(p, IPPROTO_UDP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketSrcDstPortsTest01 wrapper to check packets for unittests */ int UTHBuildPacketSrcDstPortsTest01(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketSrcDstPorts(payload, sizeof(payload), IPPROTO_TCP, 41424, 80); int ret = CheckUTHTestPacket(p, IPPROTO_TCP); UTHFreePacket(p); return ret; } /** * \brief UTHBuildPacketSrcDstPortsTest02 wrapper to check packets for unittests */ int UTHBuildPacketSrcDstPortsTest02(void) { uint8_t payload[] = "Payload"; Packet *p = UTHBuildPacketSrcDstPorts(payload, sizeof(payload), IPPROTO_UDP, 41424, 80); int ret = CheckUTHTestPacket(p, IPPROTO_UDP); UTHFreePacket(p); return ret; } #endif /* UNITTESTS */ void UTHRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("UTHBuildPacketRealTest01", UTHBuildPacketRealTest01); UtRegisterTest("UTHBuildPacketRealTest02", UTHBuildPacketRealTest02); UtRegisterTest("UTHBuildPacketTest01", UTHBuildPacketTest01); UtRegisterTest("UTHBuildPacketTest02", UTHBuildPacketTest02); UtRegisterTest("UTHBuildPacketSrcDstTest01", UTHBuildPacketSrcDstTest01); UtRegisterTest("UTHBuildPacketSrcDstTest02", UTHBuildPacketSrcDstTest02); UtRegisterTest("UTHBuildPacketSrcDstPortsTest01", UTHBuildPacketSrcDstPortsTest01); UtRegisterTest("UTHBuildPacketSrcDstPortsTest02", UTHBuildPacketSrcDstPortsTest02); UtRegisterTest("UTHBuildPacketOfFlowsTest01", UTHBuildPacketOfFlowsTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/app-layer-events.h0000644000000000000000000000456713051004444014362 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __APP_LAYER_EVENTS_H__ #define __APP_LAYER_EVENTS_H__ /* contains fwd declaration of AppLayerDecoderEvents_ */ #include "decode.h" /** * \brief Data structure to store app layer decoder events. */ struct AppLayerDecoderEvents_ { /* array of events */ uint8_t *events; /* number of events in the above buffer */ uint8_t cnt; /* current event buffer size */ uint8_t events_buffer_size; }; /* app layer pkt level events */ enum { APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS, APPLAYER_WRONG_DIRECTION_FIRST_DATA, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION, APPLAYER_PROTO_DETECTION_SKIPPED, }; /* the event types for app events */ typedef enum AppLayerEventType_ { APP_LAYER_EVENT_TYPE_GENERAL = 1, APP_LAYER_EVENT_TYPE_TRANSACTION, APP_LAYER_EVENT_TYPE_PACKET, } AppLayerEventType; int AppLayerGetPktEventInfo(const char *event_name, int *event_id); void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event); void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event); static inline int AppLayerDecoderEventsIsEventSet(AppLayerDecoderEvents *devents, uint8_t event) { if (devents == NULL) return 0; int i; int cnt = devents->cnt; for (i = 0; i < cnt; i++) { if (devents->events[i] == event) return 1; } return 0; } void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events); void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events); #endif /* __APP_LAYER_EVENTS_H__ */ suricata-3.2.1/src/detect-replace.h0000644000000000000000000000313513051004444014035 00000000000000/* Copyright (C) 2011-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __DETECT_REPLACE_H__ #define __DETECT_REPLACE_H__ DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd); /* Internal functions are only called via the inline functions below. */ void DetectReplaceExecuteInternal(Packet *p, DetectReplaceList *replist); void DetectReplaceFreeInternal(DetectReplaceList *replist); static inline void DetectReplaceExecute(Packet *p, DetectEngineThreadCtx *det_ctx) { if (p == NULL || det_ctx->replist == NULL) return; DetectReplaceExecuteInternal(p, det_ctx->replist); det_ctx->replist = NULL; } static inline void DetectReplaceFree(DetectEngineThreadCtx *det_ctx) { if (det_ctx->replist) { DetectReplaceFreeInternal(det_ctx->replist); det_ctx->replist = NULL; } } void DetectReplaceRegister (void); #endif suricata-3.2.1/src/log-stats.h0000644000000000000000000000157413051004444013076 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_STATS_H__ #define __LOG_STATS_H__ void LogStatsLogRegister(void); #endif /* __LOG_HTTPLOG_H__ */ suricata-3.2.1/src/ippair.c0000644000000000000000000004627513051004444012447 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Information about ippairs. */ #include "suricata-common.h" #include "conf.h" #include "util-debug.h" #include "ippair.h" #include "ippair-storage.h" #include "util-random.h" #include "util-misc.h" #include "util-byte.h" #include "ippair-queue.h" #include "detect-tag.h" #include "detect-engine-tag.h" #include "detect-engine-threshold.h" #include "util-hash-lookup3.h" static IPPair *IPPairGetUsedIPPair(void); /** queue with spare ippairs */ static IPPairQueue ippair_spare_q; /** size of the ippair object. Maybe updated in IPPairInitConfig to include * the storage APIs additions. */ static uint16_t g_ippair_size = sizeof(IPPair); uint32_t IPPairSpareQueueGetSize(void) { return IPPairQueueLen(&ippair_spare_q); } void IPPairMoveToSpare(IPPair *h) { IPPairEnqueue(&ippair_spare_q, h); (void) SC_ATOMIC_SUB(ippair_counter, 1); } IPPair *IPPairAlloc(void) { if (!(IPPAIR_CHECK_MEMCAP(g_ippair_size))) { return NULL; } (void) SC_ATOMIC_ADD(ippair_memuse, g_ippair_size); IPPair *h = SCMalloc(g_ippair_size); if (unlikely(h == NULL)) goto error; memset(h, 0x00, g_ippair_size); SCMutexInit(&h->m, NULL); SC_ATOMIC_INIT(h->use_cnt); return h; error: return NULL; } void IPPairFree(IPPair *h) { if (h != NULL) { IPPairClearMemory(h); SC_ATOMIC_DESTROY(h->use_cnt); SCMutexDestroy(&h->m); SCFree(h); (void) SC_ATOMIC_SUB(ippair_memuse, g_ippair_size); } } IPPair *IPPairNew(Address *a, Address *b) { IPPair *p = IPPairAlloc(); if (p == NULL) goto error; /* copy addresses */ COPY_ADDRESS(a, &p->a[0]); COPY_ADDRESS(b, &p->a[1]); return p; error: return NULL; } void IPPairClearMemory(IPPair *h) { if (IPPairStorageSize() > 0) IPPairFreeStorage(h); } #define IPPAIR_DEFAULT_HASHSIZE 4096 #define IPPAIR_DEFAULT_MEMCAP 16777216 #define IPPAIR_DEFAULT_PREALLOC 1000 /** \brief initialize the configuration * \warning Not thread safe */ void IPPairInitConfig(char quiet) { SCLogDebug("initializing ippair engine..."); if (IPPairStorageSize() > 0) g_ippair_size = sizeof(IPPair) + IPPairStorageSize(); memset(&ippair_config, 0, sizeof(ippair_config)); //SC_ATOMIC_INIT(flow_flags); SC_ATOMIC_INIT(ippair_counter); SC_ATOMIC_INIT(ippair_memuse); SC_ATOMIC_INIT(ippair_prune_idx); IPPairQueueInit(&ippair_spare_q); #ifndef AFLFUZZ_NO_RANDOM unsigned int seed = RandomTimePreseed(); /* set defaults */ ippair_config.hash_rand = (int)( IPPAIR_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0)); #endif ippair_config.hash_size = IPPAIR_DEFAULT_HASHSIZE; ippair_config.memcap = IPPAIR_DEFAULT_MEMCAP; ippair_config.prealloc = IPPAIR_DEFAULT_PREALLOC; /* Check if we have memcap and hash_size defined at config */ char *conf_val; uint32_t configval = 0; /** set config values for memcap, prealloc and hash_size */ if ((ConfGet("ippair.memcap", &conf_val)) == 1) { if (ParseSizeStringU64(conf_val, &ippair_config.memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing ippair.memcap " "from conf file - %s. Killing engine", conf_val); exit(EXIT_FAILURE); } } if ((ConfGet("ippair.hash-size", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { ippair_config.hash_size = configval; } } if ((ConfGet("ippair.prealloc", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { ippair_config.prealloc = configval; } else { WarnInvalidConfEntry("ippair.prealloc", "%"PRIu32, ippair_config.prealloc); } } SCLogDebug("IPPair config from suricata.yaml: memcap: %"PRIu64", hash-size: " "%"PRIu32", prealloc: %"PRIu32, ippair_config.memcap, ippair_config.hash_size, ippair_config.prealloc); /* alloc hash memory */ uint64_t hash_size = ippair_config.hash_size * sizeof(IPPairHashRow); if (!(IPPAIR_CHECK_MEMCAP(hash_size))) { SCLogError(SC_ERR_IPPAIR_INIT, "allocating ippair hash failed: " "max ippair memcap is smaller than projected hash size. " "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate " "total hash size by multiplying \"ippair.hash-size\" with %"PRIuMAX", " "which is the hash bucket size.", ippair_config.memcap, hash_size, (uintmax_t)sizeof(IPPairHashRow)); exit(EXIT_FAILURE); } ippair_hash = SCMallocAligned(ippair_config.hash_size * sizeof(IPPairHashRow), CLS); if (unlikely(ippair_hash == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in IPPairInitConfig. Exiting..."); exit(EXIT_FAILURE); } memset(ippair_hash, 0, ippair_config.hash_size * sizeof(IPPairHashRow)); uint32_t i = 0; for (i = 0; i < ippair_config.hash_size; i++) { HRLOCK_INIT(&ippair_hash[i]); } (void) SC_ATOMIC_ADD(ippair_memuse, (ippair_config.hash_size * sizeof(IPPairHashRow))); if (quiet == FALSE) { SCLogConfig("allocated %llu bytes of memory for the ippair hash... " "%" PRIu32 " buckets of size %" PRIuMAX "", SC_ATOMIC_GET(ippair_memuse), ippair_config.hash_size, (uintmax_t)sizeof(IPPairHashRow)); } /* pre allocate ippairs */ for (i = 0; i < ippair_config.prealloc; i++) { if (!(IPPAIR_CHECK_MEMCAP(g_ippair_size))) { SCLogError(SC_ERR_IPPAIR_INIT, "preallocating ippairs failed: " "max ippair memcap reached. Memcap %"PRIu64", " "Memuse %"PRIu64".", ippair_config.memcap, ((uint64_t)SC_ATOMIC_GET(ippair_memuse) + g_ippair_size)); exit(EXIT_FAILURE); } IPPair *h = IPPairAlloc(); if (h == NULL) { SCLogError(SC_ERR_IPPAIR_INIT, "preallocating ippair failed: %s", strerror(errno)); exit(EXIT_FAILURE); } IPPairEnqueue(&ippair_spare_q,h); } if (quiet == FALSE) { SCLogConfig("preallocated %" PRIu32 " ippairs of size %" PRIu16 "", ippair_spare_q.len, g_ippair_size); SCLogConfig("ippair memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(ippair_memuse), ippair_config.memcap); } return; } /** \brief print some ippair stats * \warning Not thread safe */ void IPPairPrintStats (void) { #ifdef IPPAIRBITS_STATS SCLogPerf("ippairbits added: %" PRIu32 ", removed: %" PRIu32 ", max memory usage: %" PRIu32 "", ippairbits_added, ippairbits_removed, ippairbits_memuse_max); #endif /* IPPAIRBITS_STATS */ SCLogPerf("ippair memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(ippair_memuse), ippair_config.memcap); return; } /** \brief shutdown the flow engine * \warning Not thread safe */ void IPPairShutdown(void) { IPPair *h; uint32_t u; IPPairPrintStats(); /* free spare queue */ while((h = IPPairDequeue(&ippair_spare_q))) { BUG_ON(SC_ATOMIC_GET(h->use_cnt) > 0); IPPairFree(h); } /* clear and free the hash */ if (ippair_hash != NULL) { for (u = 0; u < ippair_config.hash_size; u++) { h = ippair_hash[u].head; while (h) { IPPair *n = h->hnext; IPPairFree(h); h = n; } HRLOCK_DESTROY(&ippair_hash[u]); } SCFreeAligned(ippair_hash); ippair_hash = NULL; } (void) SC_ATOMIC_SUB(ippair_memuse, ippair_config.hash_size * sizeof(IPPairHashRow)); IPPairQueueDestroy(&ippair_spare_q); SC_ATOMIC_DESTROY(ippair_prune_idx); SC_ATOMIC_DESTROY(ippair_memuse); SC_ATOMIC_DESTROY(ippair_counter); //SC_ATOMIC_DESTROY(flow_flags); return; } /** \brief Cleanup the ippair engine * * Cleanup the ippair engine from tag and threshold. * */ void IPPairCleanup(void) { IPPair *h; uint32_t u; if (ippair_hash != NULL) { for (u = 0; u < ippair_config.hash_size; u++) { h = ippair_hash[u].head; IPPairHashRow *hb = &ippair_hash[u]; HRLOCK_LOCK(hb); while (h) { if ((SC_ATOMIC_GET(h->use_cnt) > 0)) { /* iprep is attached to ippair only clear local storage */ IPPairFreeStorage(h); h = h->hnext; } else { IPPair *n = h->hnext; /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; IPPairClearMemory(h); IPPairMoveToSpare(h); h = n; } } HRLOCK_UNLOCK(hb); } } return; } /* calculate the hash key for this packet * * we're using: * hash_rand -- set at init time * source address */ static uint32_t IPPairGetKey(Address *a, Address *b) { uint32_t key; if (a->family == AF_INET) { uint32_t hash = hashword(&a->addr_data32[0], 1, ippair_config.hash_rand); key = hash % ippair_config.hash_size; } else if (a->family == AF_INET6) { uint32_t hash = hashword(a->addr_data32, 4, ippair_config.hash_rand); key = hash % ippair_config.hash_size; } else key = 0; return key; } /* Since two or more ippairs can have the same hash key, we need to compare * the ippair with the current addresses. */ static inline int IPPairCompare(IPPair *p, Address *a, Address *b) { /* compare in both directions */ if ((CMP_ADDR(&p->a[0], a) && CMP_ADDR(&p->a[1], b)) || (CMP_ADDR(&p->a[0], b) && CMP_ADDR(&p->a[1], a))) return 1; return 0; } /** * \brief Get a new ippair * * Get a new ippair. We're checking memcap first and will try to make room * if the memcap is reached. * * \retval h *LOCKED* ippair on succes, NULL on error. */ static IPPair *IPPairGetNew(Address *a, Address *b) { IPPair *h = NULL; /* get a ippair from the spare queue */ h = IPPairDequeue(&ippair_spare_q); if (h == NULL) { /* If we reached the max memcap, we get a used ippair */ if (!(IPPAIR_CHECK_MEMCAP(g_ippair_size))) { /* declare state of emergency */ //if (!(SC_ATOMIC_GET(ippair_flags) & IPPAIR_EMERGENCY)) { // SC_ATOMIC_OR(ippair_flags, IPPAIR_EMERGENCY); /* under high load, waking up the flow mgr each time leads * to high cpu usage. Flows are not timed out much faster if * we check a 1000 times a second. */ // FlowWakeupFlowManagerThread(); //} h = IPPairGetUsedIPPair(); if (h == NULL) { return NULL; } /* freed a ippair, but it's unlocked */ } else { /* now see if we can alloc a new ippair */ h = IPPairNew(a,b); if (h == NULL) { return NULL; } /* ippair is initialized but *unlocked* */ } } else { /* ippair has been recycled before it went into the spare queue */ /* ippair is initialized (recylced) but *unlocked* */ } (void) SC_ATOMIC_ADD(ippair_counter, 1); SCMutexLock(&h->m); return h; } void IPPairInit(IPPair *h, Address *a, Address *b) { COPY_ADDRESS(a, &h->a[0]); COPY_ADDRESS(b, &h->a[1]); (void) IPPairIncrUsecnt(h); } void IPPairRelease(IPPair *h) { (void) IPPairDecrUsecnt(h); SCMutexUnlock(&h->m); } void IPPairLock(IPPair *h) { SCMutexLock(&h->m); } void IPPairUnlock(IPPair *h) { SCMutexUnlock(&h->m); } /* IPPairGetIPPairFromHash * * Hash retrieval function for ippairs. Looks up the hash bucket containing the * ippair pointer. Then compares the packet with the found ippair to see if it is * the ippair we need. If it isn't, walk the list until the right ippair is found. * * returns a *LOCKED* ippair or NULL */ IPPair *IPPairGetIPPairFromHash (Address *a, Address *b) { IPPair *h = NULL; /* get the key to our bucket */ uint32_t key = IPPairGetKey(a, b); /* get our hash bucket and lock it */ IPPairHashRow *hb = &ippair_hash[key]; HRLOCK_LOCK(hb); /* see if the bucket already has a ippair */ if (hb->head == NULL) { h = IPPairGetNew(a,b); if (h == NULL) { HRLOCK_UNLOCK(hb); return NULL; } /* ippair is locked */ hb->head = h; hb->tail = h; /* got one, now lock, initialize and return */ IPPairInit(h,a,b); HRLOCK_UNLOCK(hb); return h; } /* ok, we have a ippair in the bucket. Let's find out if it is our ippair */ h = hb->head; /* see if this is the ippair we are looking for */ if (IPPairCompare(h, a, b) == 0) { IPPair *ph = NULL; /* previous ippair */ while (h) { ph = h; h = h->hnext; if (h == NULL) { h = ph->hnext = IPPairGetNew(a,b); if (h == NULL) { HRLOCK_UNLOCK(hb); return NULL; } hb->tail = h; /* ippair is locked */ h->hprev = ph; /* initialize and return */ IPPairInit(h,a,b); HRLOCK_UNLOCK(hb); return h; } if (IPPairCompare(h, a, b) != 0) { /* we found our ippair, lets put it on top of the * hash list -- this rewards active ippairs */ if (h->hnext) { h->hnext->hprev = h->hprev; } if (h->hprev) { h->hprev->hnext = h->hnext; } if (h == hb->tail) { hb->tail = h->hprev; } h->hnext = hb->head; h->hprev = NULL; hb->head->hprev = h; hb->head = h; /* found our ippair, lock & return */ SCMutexLock(&h->m); (void) IPPairIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } } } /* lock & return */ SCMutexLock(&h->m); (void) IPPairIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } /** \brief look up a ippair in the hash * * \param a address to look up * * \retval h *LOCKED* ippair or NULL */ IPPair *IPPairLookupIPPairFromHash (Address *a, Address *b) { IPPair *h = NULL; /* get the key to our bucket */ uint32_t key = IPPairGetKey(a, b); /* get our hash bucket and lock it */ IPPairHashRow *hb = &ippair_hash[key]; HRLOCK_LOCK(hb); /* see if the bucket already has a ippair */ if (hb->head == NULL) { HRLOCK_UNLOCK(hb); return h; } /* ok, we have a ippair in the bucket. Let's find out if it is our ippair */ h = hb->head; /* see if this is the ippair we are looking for */ if (IPPairCompare(h, a, b) == 0) { while (h) { h = h->hnext; if (h == NULL) { HRLOCK_UNLOCK(hb); return h; } if (IPPairCompare(h, a, b) != 0) { /* we found our ippair, lets put it on top of the * hash list -- this rewards active ippairs */ if (h->hnext) { h->hnext->hprev = h->hprev; } if (h->hprev) { h->hprev->hnext = h->hnext; } if (h == hb->tail) { hb->tail = h->hprev; } h->hnext = hb->head; h->hprev = NULL; hb->head->hprev = h; hb->head = h; /* found our ippair, lock & return */ SCMutexLock(&h->m); (void) IPPairIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } } } /* lock & return */ SCMutexLock(&h->m); (void) IPPairIncrUsecnt(h); HRLOCK_UNLOCK(hb); return h; } /** \internal * \brief Get a ippair from the hash directly. * * Called in conditions where the spare queue is empty and memcap is reached. * * Walks the hash until a ippair can be freed. "ippair_prune_idx" atomic int makes * sure we don't start at the top each time since that would clear the top of * the hash leading to longer and longer search times under high pressure (observed). * * \retval h ippair or NULL */ static IPPair *IPPairGetUsedIPPair(void) { uint32_t idx = SC_ATOMIC_GET(ippair_prune_idx) % ippair_config.hash_size; uint32_t cnt = ippair_config.hash_size; while (cnt--) { if (++idx >= ippair_config.hash_size) idx = 0; IPPairHashRow *hb = &ippair_hash[idx]; if (HRLOCK_TRYLOCK(hb) != 0) continue; IPPair *h = hb->tail; if (h == NULL) { HRLOCK_UNLOCK(hb); continue; } if (SCMutexTrylock(&h->m) != 0) { HRLOCK_UNLOCK(hb); continue; } /** never prune a ippair that is used by a packets * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(h->use_cnt) > 0) { HRLOCK_UNLOCK(hb); SCMutexUnlock(&h->m); continue; } /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; HRLOCK_UNLOCK(hb); IPPairClearMemory (h); SCMutexUnlock(&h->m); (void) SC_ATOMIC_ADD(ippair_prune_idx, (ippair_config.hash_size - cnt)); return h; } return NULL; } void IPPairRegisterUnittests(void) { RegisterIPPairStorageTests(); } suricata-3.2.1/src/detect-http-ua.h0000644000000000000000000000162413051004444014005 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_HTTP_UA_H__ #define __DETECT_HTTP_UA_H__ void DetectHttpUARegister(void); #endif /* __DETECT_HTTP_UA_H__ */ suricata-3.2.1/src/output-json-tls.h0000644000000000000000000000212613051004444014262 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_TLS_H__ #define __OUTPUT_JSON_TLS_H__ void JsonTlsLogRegister(void); #ifdef HAVE_LIBJANSSON #include "app-layer-ssl.h" void JsonTlsLogJSONBasic(json_t *js, SSLState *ssl_state); void JsonTlsLogJSONExtended(json_t *js, SSLState *ssl_state); #endif /* HAVE_LIBJANSSON */ #endif /* __OUTPUT_JSON_TLS_H__ */ suricata-3.2.1/src/detect-engine-modbus.c0000644000000000000000000013104613051004444015154 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** \file * * \author David DIALLO * * Based on detect-engine-dns.c */ #include "suricata-common.h" #include "app-layer.h" #include "app-layer-modbus.h" #include "detect.h" #include "detect-modbus.h" #include "detect-engine-modbus.h" #include "flow.h" #include "util-debug.h" /** \internal * * \brief Value match detection code * * \param value Modbus value context (min, max and mode) * \param min Minimum value to compare * \param inter Interval or maximum (min + inter) value to compare * * \retval 1 match or 0 no match */ static int DetectEngineInspectModbusValueMatch(DetectModbusValue *value, uint16_t min, uint16_t inter) { SCEnter(); uint16_t max = min + inter; int ret = 0; switch (value->mode) { case DETECT_MODBUS_EQ: if ((value->min >= min) && (value->min <= max)) ret = 1; break; case DETECT_MODBUS_LT: if (value->min > min) ret = 1; break; case DETECT_MODBUS_GT: if (value->min < max) ret = 1; break; case DETECT_MODBUS_RA: if ((value->max > min) && (value->min < max)) ret = 1; break; } SCReturnInt(ret); } /** \internal * * \brief Do data (and address) inspection & validation for a signature * * \param tx Pointer to Modbus Transaction * \param address Address inspection * \param data Pointer to data signature structure to match * * \retval 0 no match or 1 match */ static int DetectEngineInspectModbusData(ModbusTransaction *tx, uint16_t address, DetectModbusValue *data) { SCEnter(); uint16_t offset, value = 0, type = tx->type; if (type & MODBUS_TYP_SINGLE) { /* Output/Register(s) Value */ if (type & MODBUS_TYP_COILS) value = (tx->data[0])? 1 : 0; else value = tx->data[0]; } else if (type & MODBUS_TYP_MULTIPLE) { int i, size = (int) sizeof(tx->data); offset = address - (tx->write.address + 1); /* In case of Coils, offset is in bit (convert in byte) */ if (type & MODBUS_TYP_COILS) offset >>= 3; for (i=0; i< size; i++) { /* Select the correct register/coils amongst the output value */ if (!(offset--)) { value = tx->data[i]; break; } } /* In case of Coils, offset is now in the bit is the rest of previous convert */ if (type & MODBUS_TYP_COILS) { offset = (address - (tx->write.address + 1)) & 0x7; value = (value >> offset) & 0x1; } } else { /* It is not possible to define the value that is writing for Mask */ /* Write Register function because the current content is not available.*/ SCReturnInt(0); } SCReturnInt(DetectEngineInspectModbusValueMatch(data, value, 0)); } /** \internal * * \brief Do address inspection & validation for a signature * * \param tx Pointer to Modbus Transaction * \param address Pointer to address signature structure to match * \param access Access mode (READ or WRITE) * * \retval 0 no match or 1 match */ static int DetectEngineInspectModbusAddress(ModbusTransaction *tx, DetectModbusValue *address, uint8_t access) { SCEnter(); int ret = 0; /* Check if read/write address of request is at/in the address range of signature */ if (access == MODBUS_TYP_READ) { /* In the PDU Coils are addresses starting at zero */ /* therefore Coils numbered 1-16 are addressed as 0-15 */ ret = DetectEngineInspectModbusValueMatch(address, tx->read.address + 1, tx->read.quantity - 1); } else { /* In the PDU Registers are addresses starting at zero */ /* therefore Registers numbered 1-16 are addressed as 0-15 */ if (tx->type & MODBUS_TYP_SINGLE) ret = DetectEngineInspectModbusValueMatch(address, tx->write.address + 1, 0); else ret = DetectEngineInspectModbusValueMatch(address, tx->write.address + 1, tx->write.quantity - 1); } SCReturnInt(ret); } /** \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect ( and sm: SigMatch to inspect) * \param f Flow * \param flags App layer flags * \param alstate App layer state * \param txv Pointer to Modbus Transaction structure * * \retval 0 no match or 1 match */ int DetectEngineInspectModbus(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { SCEnter(); ModbusTransaction *tx = (ModbusTransaction *)txv; SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MODBUS_MATCH]; DetectModbus *modbus = (DetectModbus *) sm->ctx; int ret = 0; if (modbus == NULL) { SCLogDebug("no modbus state, no match"); SCReturnInt(0); } if (modbus->type == MODBUS_TYP_NONE) { if (modbus->category == MODBUS_CAT_NONE) { if (modbus->function == tx->function) { if (modbus->subfunction != NULL) { SCLogDebug("looking for Modbus server function %d and subfunction %d", modbus->function, *(modbus->subfunction)); ret = (*(modbus->subfunction) == (tx->subFunction))? 1 : 0; } else { SCLogDebug("looking for Modbus server function %d", modbus->function); ret = 1; } } } else { SCLogDebug("looking for Modbus category function %d", modbus->category); ret = (tx->category & modbus->category)? 1 : 0; } } else { uint8_t access = modbus->type & MODBUS_TYP_ACCESS_MASK; uint8_t function = modbus->type & MODBUS_TYP_ACCESS_FUNCTION_MASK; if ((access & tx->type) && ((function == MODBUS_TYP_NONE) || (function & tx->type))) { if (modbus->address != NULL) { ret = DetectEngineInspectModbusAddress(tx, modbus->address, access); if (ret && (modbus->data != NULL)) { ret = DetectEngineInspectModbusData(tx, modbus->address->min, modbus->data); } } else { SCLogDebug("looking for Modbus access type %d and function type %d", access, function); ret = 1; } } } SCReturnInt(ret); } #ifdef UNITTESTS /* UNITTESTS */ #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "flow-util.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" /* Modbus Application Protocol Specification V1.1b3 6.1: Read Coils */ /* Example of a request to read discrete outputs 20-38 */ static uint8_t readCoilsReq[] = {/* Transaction ID */ 0x00, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x01, /* Starting Address */ 0x78, 0x90, /* Quantity of coils */ 0x00, 0x13 }; /* Modbus Application Protocol Specification V1.1b3 6.4: Read Input Registers */ /* Example of a request to read input register 9 */ static uint8_t readInputsRegistersReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x04, /* Starting Address */ 0x00, 0x08, /* Quantity of Registers */ 0x00, 0x60}; /* Modbus Application Protocol Specification V1.1b3 6.17: Read/Write Multiple registers */ /* Example of a request to read six registers starting at register 4, */ /* and to write three registers starting at register 15 */ static uint8_t readWriteMultipleRegistersReq[] = {/* Transaction ID */ 0x12, 0x34, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x11, /* Unit ID */ 0x00, /* Function code */ 0x17, /* Read Starting Address */ 0x00, 0x03, /* Quantity to Read */ 0x00, 0x06, /* Write Starting Address */ 0x00, 0x0E, /* Quantity to Write */ 0x00, 0x03, /* Write Byte count */ 0x06, /* Write Registers Value */ 0x12, 0x34, /* 15 */ 0x56, 0x78, /* 16 */ 0x9A, 0xBC};/* 17 */ /* Modbus Application Protocol Specification V1.1b3 6.8.1: 04 Force Listen Only Mode */ /* Example of a request to to remote device to its Listen Only MOde for Modbus Communications. */ static uint8_t forceListenOnlyMode[] = {/* Transaction ID */ 0x0A, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x08, /* Sub-function code */ 0x00, 0x04, /* Data */ 0x00, 0x00}; /* Modbus Application Protocol Specification V1.1b3 Annex A */ /* Modbus Reserved Function codes, Subcodes and MEI types */ static uint8_t encapsulatedInterfaceTransport[] = { /* Transaction ID */ 0x00, 0x10, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x05, /* Unit ID */ 0x00, /* Function code */ 0x2B, /* MEI Type */ 0x0F, /* Data */ 0x00, 0x00}; static uint8_t unassigned[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x02, /* Unit ID */ 0x00, /* Function code */ 0x12}; /** \test Test code function. */ static int DetectEngineInspectModbusTest01(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus code function\"; " "modbus: function 23; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readWriteMultipleRegistersReq, sizeof(readWriteMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test code function and code subfunction. */ static int DetectEngineInspectModbusTest02(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus function and subfunction\"; " "modbus: function 8, subfunction 4; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, forceListenOnlyMode, sizeof(forceListenOnlyMode)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test function category. */ static int DetectEngineInspectModbusTest03(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus category function\"; " "modbus: function reserved; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, encapsulatedInterfaceTransport, sizeof(encapsulatedInterfaceTransport)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test negative function category. */ static int DetectEngineInspectModbusTest04(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus category function\"; " "modbus: function !assigned; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, unassigned, sizeof(unassigned)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test access type. */ static int DetectEngineInspectModbusTest05(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access type\"; " "modbus: access read; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readCoilsReq, sizeof(readCoilsReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test access function. */ static int DetectEngineInspectModbusTest06(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access type\"; " "modbus: access read input; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readInputsRegistersReq, sizeof(readInputsRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test read access at an address. */ static int DetectEngineInspectModbusTest07(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus address access\"; " "modbus: access read, address 30870; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readCoilsReq, sizeof(readCoilsReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test read access at a range of address. */ static int DetectEngineInspectModbusTest08(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; /* readInputsRegistersReq, Starting Address = 0x08, Quantity of Registers = 0x60 */ /* Read access address from 9 to 104 */ s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address <9; sid:1;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 9; sid:2;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 5<>9; sid:3;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address <10; sid:4;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 5<>10; sid:5;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address >103; sid:6;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 103<>110; sid:7;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 104; sid:8;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address >104; sid:9;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus access\"; " "modbus: access read input, " "address 104<>110; sid:10;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readInputsRegistersReq, sizeof(readInputsRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 did match but should not have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 3)) { printf("sid 3 did match but should not have: "); goto end; } if (!(PacketAlertCheck(p, 4))) { printf("sid 4 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 5))) { printf("sid 5 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 6))) { printf("sid 6 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 7))) { printf("sid 7 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 8))) { printf("sid 8 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 9)) { printf("sid 9 did match but should not have: "); goto end; } if (PacketAlertCheck(p, 10)) { printf("sid 10 did match but should not have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test write access at a address in a range of value. */ static int DetectEngineInspectModbusTest09(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(readCoilsReq, sizeof(readCoilsReq), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; /* readWriteMultipleRegistersReq, Write Starting Address = 0x0E, Quantity to Write = 0x03 */ /* Write access register address 15 = 0x1234 (4660) */ /* Write access register address 16 = 0x5678 (22136) */ /* Write access register address 17 = 0x9ABC (39612) */ s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 15, value <4660; sid:1;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 16, value <22137; sid:2;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 17, value 39612; sid:3;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 15, value 4661; sid:4;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 16, value 20000<>22136; sid:5;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 17, value 30000<>39613; sid:6;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 15, value 4659<>5000; sid:7;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 16, value 22136<>30000; sid:8;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 17, value >39611; sid:9;)"); s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Testing modbus write access\"; " "modbus: access write holding, " "address 15, value >4660; sid:10;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readWriteMultipleRegistersReq, sizeof(readWriteMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 did match but should not have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 3))) { printf("sid 3 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 4)) { printf("sid 4 did match but should not have: "); goto end; } if (PacketAlertCheck(p, 5)) { printf("sid 5 did match but should not have: "); goto end; } if (!(PacketAlertCheck(p, 6))) { printf("sid 6 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 7))) { printf("sid 7 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 8)) { printf("sid 8 did match but should not have: "); goto end; } if (!(PacketAlertCheck(p, 9))) { printf("sid 9 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 10)) { printf("sid 10 did match but should not have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } #endif /* UNITTESTS */ void DetectEngineInspectModbusRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineInspectModbusTest01 - Code function", DetectEngineInspectModbusTest01); UtRegisterTest("DetectEngineInspectModbusTest02 - code function and code subfunction", DetectEngineInspectModbusTest02); UtRegisterTest("DetectEngineInspectModbusTest03 - Function category", DetectEngineInspectModbusTest03); UtRegisterTest("DetectEngineInspectModbusTest04 - Negative function category", DetectEngineInspectModbusTest04); UtRegisterTest("DetectEngineInspectModbusTest05 - Access type", DetectEngineInspectModbusTest05); UtRegisterTest("DetectEngineInspectModbusTest06 - Access function", DetectEngineInspectModbusTest06); UtRegisterTest("DetectEngineInspectModbusTest07 - Read access at an address", DetectEngineInspectModbusTest07); UtRegisterTest("DetectEngineInspectModbusTest08 - Read access at a range of address", DetectEngineInspectModbusTest08); UtRegisterTest("DetectEngineInspectModbusTest09 - Write access at an address a range of value", DetectEngineInspectModbusTest09); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-atomic.c0000644000000000000000000000317613051004444013403 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "suricata.h" #include "util-atomic.h" #include "util-unittest.h" #ifdef UNITTESTS static int SCAtomicTest01(void) { int result = 0; int a = 10; int b = 20; int *temp_int = NULL; SC_ATOMIC_DECL_AND_INIT(void *, temp); temp_int = SC_ATOMIC_GET(temp); if (temp_int != NULL) goto end; (void)SC_ATOMIC_SET(temp, &a); temp_int = SC_ATOMIC_GET(temp); if (temp_int == NULL) goto end; if (*temp_int != a) goto end; (void)SC_ATOMIC_SET(temp, &b); temp_int = SC_ATOMIC_GET(temp); if (temp_int == NULL) goto end; if (*temp_int != b) goto end; result = 1; end: return result; } #endif /* UNITTESTS */ void SCAtomicRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCAtomicTest01", SCAtomicTest01); #endif return; } suricata-3.2.1/src/runmode-napatech.c0000644000000000000000000001662413051004444014410 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author nPulse Technologies, LLC. * \author Matt Keeler */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" #include "util-device.h" #include "runmode-napatech.h" // need NapatechStreamDevConf structure #include "source-napatech.h" #define NT_RUNMODE_AUTOFP 1 #define NT_RUNMODE_WORKERS 2 static const char *default_mode = NULL; #ifdef HAVE_NAPATECH static int num_configured_streams = 0; #endif const char *RunModeNapatechGetDefaultMode(void) { return default_mode; } void RunModeNapatechRegister(void) { #ifdef HAVE_NAPATECH default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_NAPATECH, "autofp", "Multi threaded Napatech mode. Packets from " "each flow are assigned to a single detect " "thread instead of any detect thread", RunModeNapatechAutoFp); RunModeRegisterNewRunMode(RUNMODE_NAPATECH, "workers", "Workers Napatech mode, each thread does all" " tasks from acquisition to logging", RunModeNapatechWorkers); return; #endif } #ifdef HAVE_NAPATECH int NapatechRegisterDeviceStreams() { NtInfoStream_t info_stream; NtInfo_t info; char error_buf[100]; int status; int i; char live_dev_buf[9]; int use_all_streams; ConfNode *ntstreams; ConfNode *stream_id; if (ConfGetBool("napatech.use-all-streams", &use_all_streams) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving napatech.use-all-streams from Conf"); exit(EXIT_FAILURE); } if (use_all_streams) { SCLogInfo("Using All Napatech Streams"); // When using the default streams we need to query the service for a list of all configured if ((status = NT_InfoOpen(&info_stream, "SuricataStreamInfo")) != NT_SUCCESS) { NT_ExplainError(status, error_buf, sizeof(error_buf) -1); SCLogError(SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, "NT_InfoOpen failed: %s", error_buf); return -1; } info.cmd = NT_INFO_CMD_READ_STREAM; if ((status = NT_InfoRead(info_stream, &info)) != NT_SUCCESS) { NT_ExplainError(status, error_buf, sizeof(error_buf) -1); SCLogError(SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, "NT_InfoRead failed: %s", error_buf); return -1; } num_configured_streams = info.u.stream.data.count; for (i = 0; i < num_configured_streams; i++) { // The Stream IDs do not have to be sequential snprintf(live_dev_buf, sizeof(live_dev_buf), "nt%d", info.u.stream.data.streamIDList[i]); LiveRegisterDevice(live_dev_buf); } if ((status = NT_InfoClose(info_stream)) != NT_SUCCESS) { NT_ExplainError(status, error_buf, sizeof(error_buf) -1); SCLogError(SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, "NT_InfoClose failed: %s", error_buf); return -1; } } else { SCLogInfo("Using Selected Napatech Streams"); // When not using the default streams we need to parse the array of streams from the conf if ((ntstreams = ConfGetNode("napatech.streams")) == NULL) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving napatech.streams from Conf"); exit(EXIT_FAILURE); } // Loop through all stream numbers in the array and register the devices TAILQ_FOREACH(stream_id, &ntstreams->head, next) { if (stream_id == NULL) { SCLogError(SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, "Couldn't Parse Stream Configuration"); exit(EXIT_FAILURE); } num_configured_streams++; snprintf(live_dev_buf, sizeof(live_dev_buf), "nt%d", atoi(stream_id->val)); LiveRegisterDevice(live_dev_buf); } } return 0; } void *NapatechConfigParser(const char *device) { // Expect device to be of the form nt%d where %d is the stream id to use int dev_len = strlen(device); struct NapatechStreamDevConf *conf = SCMalloc(sizeof(struct NapatechStreamDevConf)); if (unlikely(conf == NULL)) return NULL; if (dev_len < 3 || dev_len > 5) { SCLogError(SC_ERR_NAPATECH_PARSE_CONFIG, "Could not parse config for device: %s - invalid length", device); return NULL; } // device+5 is a pointer to the beginning of the stream id after the constant nt portion conf->stream_id = atoi(device+2); // Set the host buffer allowance for this stream // Right now we just look at the global default - there is no per-stream hba configuration if (ConfGetInt("napatech.hba", &conf->hba) == 0) conf->hba = -1; return (void *) conf; } int NapatechGetThreadsCount(void *conf __attribute__((unused))) { // No matter which live device it is there is no reason to ever use more than 1 thread // 2 or more thread would cause packet duplication return 1; } static int NapatechInit(int runmode) { int ret; char errbuf[100]; RunModeInitialize(); TimeModeSetLive(); /* Initialize the API and check version compatibility */ if ((ret = NT_Init(NTAPI_VERSION)) != NT_SUCCESS) { NT_ExplainError(ret, errbuf, sizeof(errbuf)); SCLogError(SC_ERR_NAPATECH_INIT_FAILED ,"NT_Init failed. Code 0x%X = %s", ret, errbuf); exit(EXIT_FAILURE); } ret = NapatechRegisterDeviceStreams(); if (ret < 0 || num_configured_streams <= 0) { SCLogError(SC_ERR_NAPATECH_STREAMS_REGISTER_FAILED, "Unable to setup up Napatech Streams"); exit(EXIT_FAILURE); } switch(runmode) { case NT_RUNMODE_AUTOFP: ret = RunModeSetLiveCaptureAutoFp(NapatechConfigParser, NapatechGetThreadsCount, "NapatechStream", "NapatechDecode", thread_name_autofp, NULL); break; case NT_RUNMODE_WORKERS: ret = RunModeSetLiveCaptureWorkers(NapatechConfigParser, NapatechGetThreadsCount, "NapatechStream", "NapatechDecode", thread_name_workers, NULL); break; default: ret = -1; } if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } return 0; } int RunModeNapatechAutoFp(void) { return NapatechInit(NT_RUNMODE_AUTOFP); } int RunModeNapatechWorkers(void) { return NapatechInit(NT_RUNMODE_WORKERS); } #endif suricata-3.2.1/src/tmqh-flow.c0000644000000000000000000002524613051004444013074 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Simple output queue handler that makes sure all packets of the same flow * are sent to the same queue. We support different kind of q handlers. Have * a look at "autofp-scheduler" conf to further undertsand the various q * handlers we provide. */ #include "suricata.h" #include "packet-queue.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tmqh-flow.h" #include "tm-queuehandlers.h" #include "conf.h" #include "util-unittest.h" Packet *TmqhInputFlow(ThreadVars *t); void TmqhOutputFlowHash(ThreadVars *t, Packet *p); void TmqhOutputFlowIPPair(ThreadVars *t, Packet *p); void *TmqhOutputFlowSetupCtx(char *queue_str); void TmqhOutputFlowFreeCtx(void *ctx); void TmqhFlowRegisterTests(void); void TmqhFlowRegister(void) { tmqh_table[TMQH_FLOW].name = "flow"; tmqh_table[TMQH_FLOW].InHandler = TmqhInputFlow; tmqh_table[TMQH_FLOW].OutHandlerCtxSetup = TmqhOutputFlowSetupCtx; tmqh_table[TMQH_FLOW].OutHandlerCtxFree = TmqhOutputFlowFreeCtx; tmqh_table[TMQH_FLOW].RegisterTests = TmqhFlowRegisterTests; char *scheduler = NULL; if (ConfGet("autofp-scheduler", &scheduler) == 1) { if (strcasecmp(scheduler, "round-robin") == 0) { SCLogNotice("using flow hash instead of round robin"); tmqh_table[TMQH_FLOW].OutHandler = TmqhOutputFlowHash; } else if (strcasecmp(scheduler, "active-packets") == 0) { SCLogNotice("using flow hash instead of active packets"); tmqh_table[TMQH_FLOW].OutHandler = TmqhOutputFlowHash; } else if (strcasecmp(scheduler, "hash") == 0) { tmqh_table[TMQH_FLOW].OutHandler = TmqhOutputFlowHash; } else if (strcasecmp(scheduler, "ippair") == 0) { tmqh_table[TMQH_FLOW].OutHandler = TmqhOutputFlowIPPair; } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry \"%s\" " "for autofp-scheduler in conf. Killing engine.", scheduler); exit(EXIT_FAILURE); } } else { tmqh_table[TMQH_FLOW].OutHandler = TmqhOutputFlowHash; } return; } void TmqhFlowPrintAutofpHandler(void) { #define PRINT_IF_FUNC(f, msg) \ if (tmqh_table[TMQH_FLOW].OutHandler == (f)) \ SCLogConfig("AutoFP mode using \"%s\" flow load balancer", (msg)) PRINT_IF_FUNC(TmqhOutputFlowHash, "Hash"); PRINT_IF_FUNC(TmqhOutputFlowIPPair, "IPPair"); #undef PRINT_IF_FUNC } /* same as 'simple' */ Packet *TmqhInputFlow(ThreadVars *tv) { PacketQueue *q = &trans_q[tv->inq->id]; StatsSyncCountersIfSignalled(tv); SCMutexLock(&q->mutex_q); if (q->len == 0) { /* if we have no packets in queue, wait... */ SCCondWait(&q->cond_q, &q->mutex_q); } if (q->len > 0) { Packet *p = PacketDequeue(q); SCMutexUnlock(&q->mutex_q); return p; } else { /* return NULL if we have no pkt. Should only happen on signals. */ SCMutexUnlock(&q->mutex_q); return NULL; } } static int StoreQueueId(TmqhFlowCtx *ctx, char *name) { void *ptmp; Tmq *tmq = TmqGetQueueByName(name); if (tmq == NULL) { tmq = TmqCreateQueue(name); if (tmq == NULL) return -1; } tmq->writer_cnt++; uint16_t id = tmq->id; if (ctx->queues == NULL) { ctx->size = 1; ctx->queues = SCMalloc(ctx->size * sizeof(TmqhFlowMode)); if (ctx->queues == NULL) { return -1; } memset(ctx->queues, 0, ctx->size * sizeof(TmqhFlowMode)); } else { ctx->size++; ptmp = SCRealloc(ctx->queues, ctx->size * sizeof(TmqhFlowMode)); if (ptmp == NULL) { SCFree(ctx->queues); ctx->queues = NULL; return -1; } ctx->queues = ptmp; memset(ctx->queues + (ctx->size - 1), 0, sizeof(TmqhFlowMode)); } ctx->queues[ctx->size - 1].q = &trans_q[id]; return 0; } /** * \brief setup the queue handlers ctx * * Parses a comma separated string "queuename1,queuename2,etc" * and sets the ctx up to devide flows over these queue's. * * \param queue_str comma separated string with output queue names * * \retval ctx queues handlers ctx or NULL in error */ void *TmqhOutputFlowSetupCtx(char *queue_str) { if (queue_str == NULL || strlen(queue_str) == 0) return NULL; SCLogDebug("queue_str %s", queue_str); TmqhFlowCtx *ctx = SCMalloc(sizeof(TmqhFlowCtx)); if (unlikely(ctx == NULL)) return NULL; memset(ctx,0x00,sizeof(TmqhFlowCtx)); char *str = SCStrdup(queue_str); if (unlikely(str == NULL)) { goto error; } char *tstr = str; /* parse the comma separated string */ do { char *comma = strchr(tstr,','); if (comma != NULL) { *comma = '\0'; char *qname = tstr; int r = StoreQueueId(ctx,qname); if (r < 0) goto error; } else { char *qname = tstr; int r = StoreQueueId(ctx,qname); if (r < 0) goto error; } tstr = comma ? (comma + 1) : comma; } while (tstr != NULL); SCFree(str); return (void *)ctx; error: SCFree(ctx); if (str != NULL) SCFree(str); return NULL; } void TmqhOutputFlowFreeCtx(void *ctx) { TmqhFlowCtx *fctx = (TmqhFlowCtx *)ctx; SCLogPerf("AutoFP - Total flow handler queues - %" PRIu16, fctx->size); SCFree(fctx->queues); SCFree(fctx); return; } void TmqhOutputFlowHash(ThreadVars *tv, Packet *p) { int16_t qid = 0; TmqhFlowCtx *ctx = (TmqhFlowCtx *)tv->outctx; if (p->flags & PKT_WANTS_FLOW) { uint32_t hash = p->flow_hash; qid = hash % ctx->size; } else { qid = ctx->last++; if (ctx->last == ctx->size) ctx->last = 0; } PacketQueue *q = ctx->queues[qid].q; SCMutexLock(&q->mutex_q); PacketEnqueue(q, p); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); return; } /** * \brief select the queue to output based on IP address pair. * * \param tv thread vars. * \param p packet. */ void TmqhOutputFlowIPPair(ThreadVars *tv, Packet *p) { int16_t qid = 0; uint32_t addr_hash = 0; int i; TmqhFlowCtx *ctx = (TmqhFlowCtx *)tv->outctx; if (p->src.family == AF_INET6) { for (i = 0; i < 4; i++) { addr_hash += p->src.addr_data32[i] + p->dst.addr_data32[i]; } } else { addr_hash = p->src.addr_data32[0] + p->dst.addr_data32[0]; } /* we don't have to worry about possible overflow, since * ctx->size will be lesser than 2 ** 31 for sure */ qid = addr_hash % ctx->size; PacketQueue *q = ctx->queues[qid].q; SCMutexLock(&q->mutex_q); PacketEnqueue(q, p); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); return; } #ifdef UNITTESTS static int TmqhOutputFlowSetupCtxTest01(void) { int retval = 0; Tmq *tmq = NULL; TmqhFlowCtx *fctx = NULL; TmqResetQueues(); tmq = TmqCreateQueue("queue1"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("queue2"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("another"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("yetanother"); if (tmq == NULL) goto end; char *str = "queue1,queue2,another,yetanother"; void *ctx = TmqhOutputFlowSetupCtx(str); if (ctx == NULL) goto end; fctx = (TmqhFlowCtx *)ctx; if (fctx->size != 4) goto end; if (fctx->queues == NULL) goto end; if (fctx->queues[0].q != &trans_q[0]) goto end; if (fctx->queues[1].q != &trans_q[1]) goto end; if (fctx->queues[2].q != &trans_q[2]) goto end; if (fctx->queues[3].q != &trans_q[3]) goto end; retval = 1; end: if (fctx != NULL) TmqhOutputFlowFreeCtx(fctx); TmqResetQueues(); return retval; } static int TmqhOutputFlowSetupCtxTest02(void) { int retval = 0; Tmq *tmq = NULL; TmqhFlowCtx *fctx = NULL; TmqResetQueues(); tmq = TmqCreateQueue("queue1"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("queue2"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("another"); if (tmq == NULL) goto end; tmq = TmqCreateQueue("yetanother"); if (tmq == NULL) goto end; char *str = "queue1"; void *ctx = TmqhOutputFlowSetupCtx(str); if (ctx == NULL) goto end; fctx = (TmqhFlowCtx *)ctx; if (fctx->size != 1) goto end; if (fctx->queues == NULL) goto end; if (fctx->queues[0].q != &trans_q[0]) goto end; retval = 1; end: if (fctx != NULL) TmqhOutputFlowFreeCtx(fctx); TmqResetQueues(); return retval; } static int TmqhOutputFlowSetupCtxTest03(void) { int retval = 0; TmqhFlowCtx *fctx = NULL; TmqResetQueues(); char *str = "queue1,queue2,another,yetanother"; void *ctx = TmqhOutputFlowSetupCtx(str); if (ctx == NULL) goto end; fctx = (TmqhFlowCtx *)ctx; if (fctx->size != 4) goto end; if (fctx->queues == NULL) goto end; if (fctx->queues[0].q != &trans_q[0]) goto end; if (fctx->queues[1].q != &trans_q[1]) goto end; if (fctx->queues[2].q != &trans_q[2]) goto end; if (fctx->queues[3].q != &trans_q[3]) goto end; retval = 1; end: if (fctx != NULL) TmqhOutputFlowFreeCtx(fctx); TmqResetQueues(); return retval; } #endif /* UNITTESTS */ void TmqhFlowRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("TmqhOutputFlowSetupCtxTest01", TmqhOutputFlowSetupCtxTest01); UtRegisterTest("TmqhOutputFlowSetupCtxTest02", TmqhOutputFlowSetupCtxTest02); UtRegisterTest("TmqhOutputFlowSetupCtxTest03", TmqhOutputFlowSetupCtxTest03); #endif return; } suricata-3.2.1/src/util-cidr.c0000644000000000000000000000232613051004444013044 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * CIDR utility functions */ #include "suricata-common.h" static uint32_t cidrs[33]; void CIDRInit(void) { int i = 0; /* skip 0 as it will result in 0xffffffff */ cidrs[0] = 0; for (i = 1; i < 33; i++) { cidrs[i] = htonl(0xFFFFFFFF << (32 - i)); //printf("CIDRInit: cidrs[%02d] = 0x%08X\n", i, cidrs[i]); } } uint32_t CIDRGet(int cidr) { if (cidr < 0 || cidr > 32) return 0; return cidrs[cidr]; } suricata-3.2.1/src/util-memrchr.c0000644000000000000000000000301413051004444013553 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "util-unittest.h" #ifndef HAVE_MEMRCHR void *memrchr (const void *s, int c, size_t n) { const char *end = s + n; while (end > (const char *)s) { if (*end == (char)c) return (void *)end; end--; } return NULL; } #endif /* HAVE_MEMRCHR */ #ifdef UNITTESTS static int MemrchrTest01 (void) { char *haystack = "abcabc"; char needle = 'b'; char *ptr = memrchr(haystack, needle, strlen(haystack)); if (ptr == NULL) return 0; if (strlen(ptr) != 2) return 0; if (strcmp(ptr, "bc") != 0) return 0; return 1; } #endif void MemrchrRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("MemrchrTest01", MemrchrTest01); #endif } suricata-3.2.1/src/detect-engine-payload.c0000644000000000000000000010166113051004444015314 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Performs payload matching functions */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "stream.h" #include "util-debug.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-validate.h" #include "util-mpm-ac.h" static void PrefilterPktStream(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; const StreamMsg *smsg = det_ctx->smsg; /* for established packets inspect any smsg we may have queued up */ if (p->flowflags & FLOW_PKT_ESTABLISHED) { SCLogDebug("p->flowflags & FLOW_PKT_ESTABLISHED"); for ( ; smsg != NULL; smsg = smsg->next) { if (smsg->data_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcs, &det_ctx->pmq, smsg->data, smsg->data_len); } } } else { SCLogDebug("NOT p->flowflags & FLOW_PKT_ESTABLISHED"); } /* packets that have not been added to the stream will be inspected * as if they are stream chunks */ if ((!(p->flags & PKT_NOPAYLOAD_INSPECTION)) && !(p->flags & PKT_STREAM_ADD)) { if (p->payload_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len); } } } int PrefilterPktStreamRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { return PrefilterAppendPayloadEngine(sgh, PrefilterPktStream, mpm_ctx, NULL, "stream"); } static void PrefilterPktPayload(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; if (p->payload_len < mpm_ctx->minlen) SCReturn; #ifdef __SC_CUDA_SUPPORT__ if (p->cuda_pkt_vars.cuda_mpm_enabled && p->pkt_src == PKT_SRC_WIRE) { (void)SCACCudaPacketResultsProcessing(p, mpm_ctx, &det_ctx->pmq); } else { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len); } #else (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, p->payload, p->payload_len); #endif } int PrefilterPktPayloadRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { return PrefilterAppendPayloadEngine(sgh, PrefilterPktPayload, mpm_ctx, NULL, "payload"); } /** * \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param f flow (for pcre flowvar storage) * \param p Packet * * \retval 0 no match * \retval 1 match */ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, Packet *p) { SCEnter(); int r = 0; if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCReturnInt(0); } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; det_ctx->replist = NULL; //det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], f, p->payload, p->payload_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, p); //r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len); //det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; if (r == 1) { SCReturnInt(1); } SCReturnInt(0); } /** * \brief Do the content inspection & validation for a signature for a stream chunk * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param f flow (for pcre flowvar storage) * \param payload ptr to the payload to inspect * \param payload_len length of the payload * * \retval 0 no match * \retval 1 match * * \todo we might also pass the packet to this function for the pktvar * storage. Only, would that be right? We're not inspecting data * from the current packet here. */ int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t *payload, uint32_t payload_len) { SCEnter(); int r = 0; if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCReturnInt(0); } det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; //det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM; r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], f, payload, payload_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, NULL); //r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], NULL, f, payload, payload_len); //det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM; if (r == 1) { SCReturnInt(1); } SCReturnInt(0); } #ifdef UNITTESTS /** \test Not the first but the second occurence of "abc" should be used * for the 2nd match */ static int PayloadTestSig01 (void) { uint8_t *buf = (uint8_t *) "abcabcd"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"abc\"; content:\"d\"; distance:0; within:1; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** \test Nocase matching */ static int PayloadTestSig02 (void) { uint8_t *buf = (uint8_t *) "abcaBcd"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"abc\"; nocase; content:\"d\"; distance:0; within:1; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** \test Negative distance matching */ static int PayloadTestSig03 (void) { uint8_t *buf = (uint8_t *) "abcaBcd"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"aBc\"; nocase; content:\"abca\"; distance:-10; within:4; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test multiple relative matches. */ static int PayloadTestSig04(void) { uint8_t *buf = (uint8_t *)"now this is is big big string now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"this\"; content:\"is\"; within:6; content:\"big\"; within:8; " "content:\"string\"; within:8; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test multiple relative matches. */ static int PayloadTestSig05(void) { uint8_t *buf = (uint8_t *)"now this is is is big big big string now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"this\"; content:\"is\"; within:9; content:\"big\"; within:12; " "content:\"string\"; within:8; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test multiple relative matches. */ static int PayloadTestSig06(void) { uint8_t *buf = (uint8_t *)"this this now is is big string now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"now\"; content:\"this\"; content:\"is\"; within:12; content:\"big\"; within:8; " "content:\"string\"; within:8; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test multiple relative matches. */ static int PayloadTestSig07(void) { uint8_t *buf = (uint8_t *)" thus thus is a big"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"thus\"; offset:8; content:\"is\"; within:6; content:\"big\"; within:8; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test multiple relative matches with negative matches * and show the need for det_ctx->discontinue_matching. */ static int PayloadTestSig08(void) { uint8_t *buf = (uint8_t *)"we need to fix this and yes fix this now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"fix\"; content:\"this\"; within:6; content:!\"and\"; distance:0; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) != 1) { goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test pcre recursive matching. */ static int PayloadTestSig09(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "pcre:/super/; content:\"nova\"; within:7; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test invalid sig. */ static int PayloadTestSig10(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert udp any any -> any any (msg:\"crash\"; " "byte_test:4,>,2,0,relative; sid:11;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 1) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test invalid sig. */ static int PayloadTestSig11(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert udp any any -> any any (msg:\"crash\"; " "byte_jump:1,0,relative; sid:11;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 1) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test invalid sig. */ static int PayloadTestSig12(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert udp any any -> any any (msg:\"crash\"; " "isdataat:10,relative; sid:11;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 1) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Used to check the working of recursion_limit counter. */ static int PayloadTestSig13(void) { uint8_t *buf = (uint8_t *)"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; uint16_t mpm_type = mpm_default_matcher; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"aa\"; content:\"aa\"; distance:0; content:\"aa\"; distance:0; " "byte_test:1,>,200,0,relative; sid:1;)"; struct timeval tv_start, tv_end, tv_diff; gettimeofday(&tv_start, NULL); do { DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("de_ctx == NULL: "); goto end; } de_ctx->inspection_recursion_limit = 3000; de_ctx->flags |= DE_QUIET; de_ctx->mpm_matcher = mpm_type; de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { printf("signature == NULL: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, de_ctx->sig_list->id) != 1) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); } while (0); gettimeofday(&tv_end, NULL); tv_diff.tv_sec = tv_end.tv_sec - tv_start.tv_sec; tv_diff.tv_usec = tv_end.tv_usec - tv_start.tv_usec; printf("%ld.%06ld\n", (long int)tv_diff.tv_sec, (long int)tv_diff.tv_usec); result = 1; if (p != NULL) UTHFreePacket(p); return result; } /** * \test normal & negated matching, both absolute and relative */ static int PayloadTestSig14(void) { uint8_t *buf = (uint8_t *)"User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.6 GTB5"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"User-Agent|3A| Mozilla/5.0 |28|Macintosh|3B| \"; content:\"Firefox/3.\"; distance:0; content:!\"Firefox/3.6.12\"; distance:-10; content:!\"Mozilla/5.0 |28|Macintosh|3B| U|3B| Intel Mac OS X 10.5|3B| en-US|3B| rv|3A|1.9.1b4|29| Gecko/20090423 Firefox/3.6 GTB5\"; sid:1; rev:1;)"; //char sig[] = "alert tcp any any -> any any (content:\"User-Agent: Mozilla/5.0 (Macintosh; \"; content:\"Firefox/3.\"; distance:0; content:!\"Firefox/3.6.12\"; distance:-10; content:!\"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.6 GTB5\"; sid:1; rev:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 1) { goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig15(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"nova\"; isdataat:18,relative; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig16(void) { uint8_t *buf = (uint8_t *)"this is a super duper nova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"nova\"; isdataat:!20,relative; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig17(void) { uint8_t buf[] = { 0xEB, 0x29, 0x25, 0x38, 0x78, 0x25, 0x38, 0x78, 0x25 }; uint16_t buflen = 9; Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"%\"; depth:4; offset:0; " "content:\"%\"; within:2; distance:1; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig18(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x35, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "content:\"|0C 0D 0E 0F|\"; distance:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig19(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x35, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,hex,relative; " "content:\"|0C 0D 0E 0F|\"; distance:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig20(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x35, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "content:\"|06 35 07 08|\"; offset:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig21(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x36, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "content:\"|03 04 05 06|\"; depth:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig22(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x36, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "content:\"|09 0A 0B 0C|\"; within:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig23(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x32, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x33, 0x0B, 0x0C, 0x0D, 0x32, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "byte_extract:1,3,two,string,dec,relative; " "byte_test:1,=,one,two,string,dec,relative; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig24(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x32, /* the last byte is 2 */ 0x07, 0x08, 0x33, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|01 02 03 04|\"; " "byte_extract:1,2,one,string,dec,relative; " "byte_jump:1,one,string,dec,relative; " "content:\"|0D 0E 0F|\"; distance:0; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /* * \test Test negative byte extract. */ static int PayloadTestSig25(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x35, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|35 07 08 09|\"; " "byte_extract:1,-4,one,string,dec,relative; " "content:\"|0C 0D 0E 0F|\"; distance:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /* * \test Test negative byte extract. */ static int PayloadTestSig26(void) { uint8_t buf[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x35, /* the last byte is 2 */ 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"|35 07 08 09|\"; " "byte_extract:1,-3000,one,string,dec,relative; " "content:\"|0C 0D 0E 0F|\"; distance:one; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) != 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /* * \test Test packet/stream sigs */ static int PayloadTestSig27(void) { uint8_t buf[] = "dummypayload"; uint16_t buflen = sizeof(buf) - 1; int result = 0; Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); char sig[] = "alert tcp any any -> any any (content:\"dummy\"; " "depth:5; sid:1;)"; p->flags |= PKT_STREAM_ADD; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) != 1) goto end; result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /* * \test Test packet/stream sigs */ static int PayloadTestSig28(void) { uint8_t buf[] = "dummypayload"; uint16_t buflen = sizeof(buf) - 1; int result = 0; Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); char sig[] = "alert tcp any any -> any any (content:\"payload\"; " "offset:4; depth:12; sid:1;)"; p->flags |= PKT_STREAM_ADD; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) != 1) goto end; result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test pcre recursive matching - bug #529 */ static int PayloadTestSig29(void) { uint8_t *buf = (uint8_t *)"this is a super dupernova in super nova now"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"dummy\"; " "pcre:/^.{4}/; content:\"nova\"; within:4; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 1) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig30(void) { uint8_t *buf = (uint8_t *) "xyonexxxxxxtwojunkonetwo"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"one\"; pcre:\"/^two/R\"; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int PayloadTestSig31(void) { uint8_t *buf = (uint8_t *) "xyonexxxxxxtwojunkonetwo"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (content:\"one\"; pcre:\"/(fiv|^two)/R\"; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test byte_jump. */ static int PayloadTestSig32(void) { uint8_t *buf = (uint8_t *)"dummy2xxcardmessage"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"crash\"; " "content:\"message\"; byte_jump:2,-14,string,dec,relative; content:\"card\"; within:4; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) goto end; result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test byte_test. */ static int PayloadTestSig33(void) { uint8_t *buf = (uint8_t *)"dummy2xxcardmessage"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"crash\"; " "content:\"message\"; byte_test:1,=,2,-14,string,dec,relative; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) goto end; result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } /** * \test Test byte_extract. */ static int PayloadTestSig34(void) { uint8_t *buf = (uint8_t *)"dummy2xxcardmessage"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"crash\"; " "content:\"message\"; byte_extract:1,-14,boom,string,dec,relative; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, mpm_default_matcher) == 0) goto end; result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } #endif /* UNITTESTS */ void PayloadRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("PayloadTestSig01", PayloadTestSig01); UtRegisterTest("PayloadTestSig02", PayloadTestSig02); UtRegisterTest("PayloadTestSig03", PayloadTestSig03); UtRegisterTest("PayloadTestSig04", PayloadTestSig04); UtRegisterTest("PayloadTestSig05", PayloadTestSig05); UtRegisterTest("PayloadTestSig06", PayloadTestSig06); UtRegisterTest("PayloadTestSig07", PayloadTestSig07); UtRegisterTest("PayloadTestSig08", PayloadTestSig08); UtRegisterTest("PayloadTestSig09", PayloadTestSig09); UtRegisterTest("PayloadTestSig10", PayloadTestSig10); UtRegisterTest("PayloadTestSig11", PayloadTestSig11); UtRegisterTest("PayloadTestSig12", PayloadTestSig12); UtRegisterTest("PayloadTestSig13", PayloadTestSig13); UtRegisterTest("PayloadTestSig14", PayloadTestSig14); UtRegisterTest("PayloadTestSig15", PayloadTestSig15); UtRegisterTest("PayloadTestSig16", PayloadTestSig16); UtRegisterTest("PayloadTestSig17", PayloadTestSig17); UtRegisterTest("PayloadTestSig18", PayloadTestSig18); UtRegisterTest("PayloadTestSig19", PayloadTestSig19); UtRegisterTest("PayloadTestSig20", PayloadTestSig20); UtRegisterTest("PayloadTestSig21", PayloadTestSig21); UtRegisterTest("PayloadTestSig22", PayloadTestSig22); UtRegisterTest("PayloadTestSig23", PayloadTestSig23); UtRegisterTest("PayloadTestSig24", PayloadTestSig24); UtRegisterTest("PayloadTestSig25", PayloadTestSig25); UtRegisterTest("PayloadTestSig26", PayloadTestSig26); UtRegisterTest("PayloadTestSig27", PayloadTestSig27); UtRegisterTest("PayloadTestSig28", PayloadTestSig28); UtRegisterTest("PayloadTestSig29", PayloadTestSig29); UtRegisterTest("PayloadTestSig30", PayloadTestSig30); UtRegisterTest("PayloadTestSig31", PayloadTestSig31); UtRegisterTest("PayloadTestSig32", PayloadTestSig32); UtRegisterTest("PayloadTestSig33", PayloadTestSig33); UtRegisterTest("PayloadTestSig34", PayloadTestSig34); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/stream-tcp-inline.c0000644000000000000000000004467313051004444014516 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Functions for the "inline mode" of the stream engine. */ #include "suricata-common.h" #include "stream-tcp-inline.h" #include "util-memcmp.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" /** defined in stream-tcp-reassemble.c */ extern int stream_inline; /** * \brief See if stream engine is operating in inline mode * * \retval 0 no * \retval 1 yes */ int StreamTcpInlineMode(void) { return stream_inline; } /** * \brief Compare the shared data portion of two segments * * If no data is shared, 0 will be returned. * * \param seg1 first segment * \param seg2 second segment * * \retval 0 shared data is the same (or no data is shared) * \retval 1 shared data is different */ int StreamTcpInlineSegmentCompare(TcpSegment *seg1, TcpSegment *seg2) { SCEnter(); if (seg1 == NULL || seg2 == NULL) { SCReturnInt(0); } if (SEQ_EQ(seg1->seq, seg2->seq) && seg1->payload_len == seg2->payload_len) { int r = SCMemcmp(seg1->payload, seg2->payload, seg1->payload_len); #if 0 if (r) { PrintRawDataFp(stdout,seg1->payload,seg1->payload_len); PrintRawDataFp(stdout,seg2->payload,seg2->payload_len); } #endif SCReturnInt(r); } else if (SEQ_GT(seg1->seq, (seg2->seq + seg2->payload_len))) { SCReturnInt(0); } else if (SEQ_GT(seg2->seq, (seg1->seq + seg1->payload_len))) { SCReturnInt(0); } else { SCLogDebug("seg1 %u (%u), seg2 %u (%u)", seg1->seq, seg1->payload_len, seg2->seq, seg2->payload_len); uint32_t seg1_end = seg1->seq + seg1->payload_len; uint32_t seg2_end = seg2->seq + seg2->payload_len; SCLogDebug("seg1_end %u, seg2_end %u", seg1_end, seg2_end); #if 0 SCLogDebug("seg1"); PrintRawDataFp(stdout,seg1->payload,seg1->payload_len); SCLogDebug("seg2"); PrintRawDataFp(stdout,seg2->payload,seg2->payload_len); #endif /* get the minimal seg*_end */ uint32_t end = (SEQ_GT(seg1_end, seg2_end)) ? seg2_end : seg1_end; /* and the max seq */ uint32_t seq = (SEQ_LT(seg1->seq, seg2->seq)) ? seg2->seq : seg1->seq; SCLogDebug("seq %u, end %u", seq, end); uint16_t seg1_off = seq - seg1->seq; uint16_t seg2_off = seq - seg2->seq; SCLogDebug("seg1_off %u, seg2_off %u", seg1_off, seg2_off); uint32_t range = end - seq; SCLogDebug("range %u", range); BUG_ON(range > 65536); if (range) { int r = SCMemcmp(seg1->payload+seg1_off, seg2->payload+seg2_off, range); #if 0 if (r) { PrintRawDataFp(stdout,seg1->payload+seg1_off,range); PrintRawDataFp(stdout,seg2->payload+seg2_off,range); PrintRawDataFp(stdout,seg1->payload,seg1->payload_len); PrintRawDataFp(stdout,seg2->payload,seg2->payload_len); } #endif SCReturnInt(r); } SCReturnInt(0); } } /** * \brief Replace (part of) the payload portion of a packet by the data * in a TCP segment * * \param p Packet * \param seg TCP segment * * \todo What about reassembled fragments? * \todo What about unwrapped tunnel packets? */ void StreamTcpInlineSegmentReplacePacket(Packet *p, TcpSegment *seg) { SCEnter(); uint32_t pseq = TCP_GET_SEQ(p); uint32_t tseq = seg->seq; /* check if segment is within the packet */ if (tseq + seg->payload_len < pseq) { SCReturn; } else if (pseq + p->payload_len < tseq) { SCReturn; } else { /** \todo review logic */ uint32_t pend = pseq + p->payload_len; uint32_t tend = tseq + seg->payload_len; SCLogDebug("pend %u, tend %u", pend, tend); //SCLogDebug("packet"); //PrintRawDataFp(stdout,p->payload,p->payload_len); //SCLogDebug("seg"); //PrintRawDataFp(stdout,seg->payload,seg->payload_len); /* get the minimal seg*_end */ uint32_t end = (SEQ_GT(pend, tend)) ? tend : pend; /* and the max seq */ uint32_t seq = (SEQ_LT(pseq, tseq)) ? tseq : pseq; SCLogDebug("seq %u, end %u", seq, end); uint16_t poff = seq - pseq; uint16_t toff = seq - tseq; SCLogDebug("poff %u, toff %u", poff, toff); uint32_t range = end - seq; SCLogDebug("range %u", range); BUG_ON(range > 65536); if (range) { /* update the packets payload. As payload is a ptr to either * p->pkt or p->ext_pkt that is updated as well */ memcpy(p->payload+poff, seg->payload+toff, range); /* flag as modified so we can reinject / replace after * recalculating the checksum */ p->flags |= PKT_STREAM_MODIFIED; } } } #ifdef UNITTESTS /** \test full overlap */ static int StreamTcpInlineTest01(void) { SCEnter(); uint8_t payload1[] = "AAC"; /* packet */ uint8_t payload2[] = "ABC"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000000UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000000UL; StreamTcpInlineSegmentReplacePacket(p, t); if (!(p->flags & PKT_STREAM_MODIFIED)) { printf("PKT_STREAM_MODIFIED pkt flag not set: "); goto end; } if (memcmp(p->payload, t->payload, p->payload_len) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Segment:\n"); PrintRawDataFp(stdout,t->payload,t->payload_len); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt,payload2,sizeof(payload2)-1) != 0) { PrintRawDataFp(stdout,pkt,3); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test full overlap */ static int StreamTcpInlineTest02(void) { SCEnter(); uint8_t payload1[] = "xxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000001UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000000UL; StreamTcpInlineSegmentReplacePacket(p, t); if (!(p->flags & PKT_STREAM_MODIFIED)) { printf("PKT_STREAM_MODIFIED pkt flag not set: "); goto end; } if (memcmp(p->payload, t->payload+1, p->payload_len) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Segment:\n"); PrintRawDataFp(stdout,t->payload,t->payload_len); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt,payload2+1,sizeof(payload2)-3) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2+1,sizeof(payload2)-3); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test partial overlap */ static int StreamTcpInlineTest03(void) { SCEnter(); uint8_t payload1[] = "xxxxxxxxxxxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000000UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000003UL; StreamTcpInlineSegmentReplacePacket(p, t); if (!(p->flags & PKT_STREAM_MODIFIED)) { printf("PKT_STREAM_MODIFIED pkt flag not set: "); goto end; } if (memcmp(p->payload+3, t->payload, t->payload_len) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Segment:\n"); PrintRawDataFp(stdout,t->payload,t->payload_len); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1 + 3); if (memcmp(pkt,payload2,sizeof(payload2)-1) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2+1,sizeof(payload2)-3); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test partial overlap */ static int StreamTcpInlineTest04(void) { SCEnter(); uint8_t payload1[] = "xxxxxxxxxxxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000003UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000000UL; StreamTcpInlineSegmentReplacePacket(p, t); if (!(p->flags & PKT_STREAM_MODIFIED)) { printf("PKT_STREAM_MODIFIED pkt flag not set: "); goto end; } if (memcmp(p->payload, t->payload+3, 2) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Segment:\n"); PrintRawDataFp(stdout,t->payload,t->payload_len); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt,payload2+3,2) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2+3,2); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test partial overlap */ static int StreamTcpInlineTest05(void) { SCEnter(); uint8_t payload1[] = "xxxxxxxxxxxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000000UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000010UL; StreamTcpInlineSegmentReplacePacket(p, t); if (!(p->flags & PKT_STREAM_MODIFIED)) { printf("PKT_STREAM_MODIFIED pkt flag not set: "); goto end; } if (memcmp(p->payload+10, t->payload, 2) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Segment:\n"); PrintRawDataFp(stdout,t->payload,t->payload_len); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt+10,payload2,2) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2,2); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test no overlap */ static int StreamTcpInlineTest06(void) { SCEnter(); uint8_t payload1[] = "xxxxxxxxxxxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000020UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000000UL; StreamTcpInlineSegmentReplacePacket(p, t); if (p->flags & PKT_STREAM_MODIFIED) { printf("PKT_STREAM_MODIFIED pkt flag set, but it shouldn't: "); goto end; } if (memcmp(p->payload, payload1, sizeof(payload1)-1) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Original payload:\n"); PrintRawDataFp(stdout,payload1,sizeof(payload1)-1); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt,payload1,sizeof(payload1)-1) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2,2); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } /** \test no overlap */ static int StreamTcpInlineTest07(void) { SCEnter(); uint8_t payload1[] = "xxxxxxxxxxxx"; /* packet */ uint8_t payload2[] = "ABCDE"; /* segment */ int result = 0; TcpSegment *t = NULL; Packet *p = UTHBuildPacketSrcDstPorts(payload1, sizeof(payload1)-1, IPPROTO_TCP, 1024, 80); if (p == NULL || p->tcph == NULL) { printf("generating test packet failed: "); goto end; } p->tcph->th_seq = htonl(10000000UL); t = SCMalloc(sizeof(TcpSegment)); if (unlikely(t == NULL)) { printf("alloc TcpSegment failed: "); goto end; } memset(t, 0x00, sizeof(TcpSegment)); t->payload = payload2; t->payload_len = sizeof(payload2)-1; t->seq = 10000020UL; StreamTcpInlineSegmentReplacePacket(p, t); if (p->flags & PKT_STREAM_MODIFIED) { printf("PKT_STREAM_MODIFIED pkt flag set, but it shouldn't: "); goto end; } if (memcmp(p->payload, payload1, sizeof(payload1)-1) != 0) { printf("Packet:\n"); PrintRawDataFp(stdout,p->payload,p->payload_len); printf("Original payload:\n"); PrintRawDataFp(stdout,payload1,sizeof(payload1)-1); printf("payloads didn't match: "); goto end; } uint8_t *pkt = GET_PKT_DATA(p)+(GET_PKT_LEN(p)-sizeof(payload1)+1); if (memcmp(pkt,payload1,sizeof(payload1)-1) != 0) { printf("Segment:\n"); PrintRawDataFp(stdout,payload2,2); printf("Packet:\n"); PrintRawDataFp(stdout,pkt,3); printf("Packet (full):\n"); PrintRawDataFp(stdout,GET_PKT_DATA(p),GET_PKT_LEN(p)); printf("packet data doesn't match: "); goto end; } result = 1; end: if (p != NULL) { UTHFreePacket(p); } if (t != NULL) { SCFree(t); } SCReturnInt(result); } #endif /* UNITTESTS */ void StreamTcpInlineRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("StreamTcpInlineTest01", StreamTcpInlineTest01); UtRegisterTest("StreamTcpInlineTest02", StreamTcpInlineTest02); UtRegisterTest("StreamTcpInlineTest03", StreamTcpInlineTest03); UtRegisterTest("StreamTcpInlineTest04", StreamTcpInlineTest04); UtRegisterTest("StreamTcpInlineTest05", StreamTcpInlineTest05); UtRegisterTest("StreamTcpInlineTest06", StreamTcpInlineTest06); UtRegisterTest("StreamTcpInlineTest07", StreamTcpInlineTest07); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-decode-mime.c0000644000000000000000000026256313051004444014306 00000000000000/* Copyright (C) 2012 BAE Systems * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author David Abarbanel * */ #include "suricata-common.h" #include "util-decode-mime.h" #include "util-spm-bs.h" #include "util-unittest.h" #include "util-memcmp.h" #include "util-print.h" /* Character constants */ #ifndef CR #define CR 13 #define LF 10 #endif #define CRLF "\r\n" #define COLON 58 #define DASH 45 #define PRINTABLE_START 33 #define PRINTABLE_END 126 #define UC_START 65 #define UC_END 90 #define LC_START 97 #define LC_END 122 #define UC_LC_DIFF 32 #define EOL_LEN 2 /* Base-64 constants */ #define BASE64_STR "Base64" /* Mime Constants */ #define MAX_LINE_LEN 998 /* Def in RFC 2045, excluding CRLF sequence */ #define MAX_ENC_LINE_LEN 76 /* Def in RFC 2045, excluding CRLF sequence */ #define MAX_HEADER_NAME 75 /* 75 + ":" = 76 */ #define MAX_HEADER_VALUE 2000 /* Default - arbitrary limit */ #define BOUNDARY_BUF 256 #define CTNT_TYPE_STR "content-type" #define CTNT_DISP_STR "content-disposition" #define CTNT_TRAN_STR "content-transfer-encoding" #define MSG_ID_STR "message-id" #define BND_START_STR "boundary=" #define TOK_END_STR "\"" #define MSG_STR "message/" #define MULTIPART_STR "multipart/" #define QP_STR "quoted-printable" #define TXT_STR "text/plain" #define HTML_STR "text/html" #define URL_STR "http://" /* Memory Usage Constants */ #define STACK_FREE_NODES 10 /* Other Constants */ #define MAX_IP4_CHARS 15 #define MAX_IP6_CHARS 39 /* Globally hold configuration data */ static MimeDecConfig mime_dec_config = { 1, 1, 1, 0, MAX_HEADER_VALUE }; /* Mime Parser String translation */ static const char *StateFlags[] = { "NONE", "HEADER_READY", "HEADER_STARTED", "HEADER_DONE", "BODY_STARTED", "BODY_DONE", "BODY_END_BOUND", "PARSE_DONE", "PARSE_ERROR", NULL }; /* URL executable file extensions */ static const char *UrlExeExts[] = { ".exe", ".vbs", ".bin", ".cmd", ".bat", ".jar", ".js", NULL }; /** * \brief Function used to print character strings that are not null-terminated * * \param log_level The logging level in which to print * \param label A label for the string to print * \param src The source string * \param len The length of the string * * \return none */ static void PrintChars(int log_level, char *label, const uint8_t *src, uint32_t len) { #ifdef DEBUG if (log_level <= sc_log_global_log_level) { printf("[%s]\n", label); PrintRawDataFp(stdout, (uint8_t *)src, len); } #endif } /** * \brief Set global config policy * * \param config Config policy to set * \return none */ void MimeDecSetConfig(MimeDecConfig *config) { if (config != NULL) { mime_dec_config = *config; /* Set to default */ if (mime_dec_config.header_value_depth == 0) { mime_dec_config.header_value_depth = MAX_HEADER_VALUE; } } else { SCLogWarning(SC_ERR_MISSING_CONFIG_PARAM, "Invalid null configuration parameters"); } } /** * \brief Get global config policy * * \return config data structure */ MimeDecConfig * MimeDecGetConfig(void) { return &mime_dec_config; } /** * \brief Follow the 'next' pointers to the leaf * * \param node The root entity * * \return Pointer to leaf on 'next' side * */ static MimeDecEntity *findLastSibling(MimeDecEntity *node) { if (node == NULL) return NULL; while(node->next != NULL) node = node->next; return node; } /** * \brief Frees a mime entity tree * * \param entity The root entity * * \return none * */ void MimeDecFreeEntity (MimeDecEntity *entity) { if (entity == NULL) return; MimeDecEntity *lastSibling = findLastSibling(entity); while (entity != NULL) { /** * Move child to next * Transform tree into list */ if (entity->child != NULL) { lastSibling->next = entity->child; lastSibling = findLastSibling(lastSibling); } /** * Move to next element */ MimeDecEntity *old = entity; entity = entity->next; MimeDecFreeField(old->field_list); MimeDecFreeUrl(old->url_list); SCFree(old->filename); SCFree(old); } } /** * \brief Iteratively frees a header field entry list * * \param field The header field * * \return none * */ void MimeDecFreeField(MimeDecField *field) { MimeDecField *temp, *curr; if (field != NULL) { curr = field; while (curr != NULL) { temp = curr; curr = curr->next; /* Free contents of node */ SCFree(temp->name); SCFree(temp->value); /* Now free node data */ SCFree(temp); } } } /** * \brief Iteratively frees a URL entry list * * \param url The url entry * * \return none * */ void MimeDecFreeUrl(MimeDecUrl *url) { MimeDecUrl *temp, *curr; if (url != NULL) { curr = url; while (curr != NULL) { temp = curr; curr = curr->next; /* Now free node data */ SCFree(temp->url); SCFree(temp); } } } /** * \brief Creates and adds a header field entry to an entity * * The entity is optional. If NULL is specified, than a new stand-alone field * is created. * * \param entity The parent entity * * \return The field object, or NULL if the operation fails * */ MimeDecField * MimeDecAddField(MimeDecEntity *entity) { MimeDecField *node = SCMalloc(sizeof(MimeDecField)); if (unlikely(node == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } memset(node, 0x00, sizeof(MimeDecField)); /* If list is empty, then set as head of list */ if (entity->field_list == NULL) { entity->field_list = node; } else { /* Otherwise add to beginning of list since these are out-of-order in * the message */ node->next = entity->field_list; entity->field_list = node; } return node; } /** * \brief Searches for header fields with the specified name * * \param entity The entity to search * \param name The header name (lowercase) * * \return number of items found * */ int MimeDecFindFieldsForEach(const MimeDecEntity *entity, const char *name, int (*DataCallback)(const uint8_t *val, const size_t, void *data), void *data) { MimeDecField *curr = entity->field_list; int found = 0; while (curr != NULL) { /* name is stored lowercase */ if (strlen(name) == curr->name_len) { if (SCMemcmp(curr->name, name, curr->name_len) == 0) { if (DataCallback(curr->value, curr->value_len, data)) found++; } } curr = curr->next; } return found; } /** * \brief Searches for a header field with the specified name * * \param entity The entity to search * \param name The header name (lowercase) * * \return The field object, or NULL if not found * */ MimeDecField * MimeDecFindField(const MimeDecEntity *entity, const char *name) { MimeDecField *curr = entity->field_list; while (curr != NULL) { /* name is stored lowercase */ if (strlen(name) == curr->name_len) { if (SCMemcmp(curr->name, name, curr->name_len) == 0) { break; } } curr = curr->next; } return curr; } /** * \brief Creates and adds a URL entry to the specified entity * * The entity is optional and if NULL is specified, then a new list will be created. * * \param entity The entity * * \return URL entry or NULL if the operation fails * */ static MimeDecUrl * MimeDecAddUrl(MimeDecEntity *entity, uint8_t *url, uint32_t url_len, uint8_t flags) { MimeDecUrl *node = SCMalloc(sizeof(MimeDecUrl)); if (unlikely(node == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } memset(node, 0x00, sizeof(MimeDecUrl)); node->url = url; node->url_len = url_len; node->url_flags = flags; /* If list is empty, then set as head of list */ if (entity->url_list == NULL) { entity->url_list = node; } else { /* Otherwise add to beginning of list since these are out-of-order in * the message */ node->next = entity->url_list; entity->url_list = node; } return node; } /** * \brief Creates and adds a child entity to the specified parent entity * * \param parent The parent entity * * \return The child entity, or NULL if the operation fails * */ MimeDecEntity * MimeDecAddEntity(MimeDecEntity *parent) { MimeDecEntity *curr, *node = SCMalloc(sizeof(MimeDecEntity)); if (unlikely(node == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } memset(node, 0x00, sizeof(MimeDecEntity)); /* If parent is NULL then just return the new pointer */ if (parent != NULL) { if (parent->child == NULL) { parent->child = node; } else { curr = parent->child; while (curr->next != NULL) { curr = curr->next; } curr->next = node; } } return node; } /** * \brief Creates a mime header field and fills in its values and adds it to the * specified entity * * \param entity Entity in which to add the field * \param name String containing the name * \param nlen Length of the name * \param value String containing the value * \param vlen Length of the value * * \return The field or NULL if the operation fails */ static MimeDecField * MimeDecFillField(MimeDecEntity *entity, uint8_t *name, uint32_t nlen, const uint8_t *value, uint32_t vlen) { if (nlen == 0 && vlen == 0) return NULL; MimeDecField *field = MimeDecAddField(entity); if (unlikely(field == NULL)) { return NULL; } if (nlen > 0) { /* convert to lowercase and store */ uint32_t u; for (u = 0; u < nlen; u++) name[u] = tolower(name[u]); field->name = (uint8_t *)name; field->name_len = nlen; } if (vlen > 0) { field->value = (uint8_t *)value; field->value_len = vlen; } return field; } /** * \brief Pushes a node onto a stack and returns the new node. * * \param stack The top of the stack * * \return pointer to a new node, otherwise NULL if it fails */ static MimeDecStackNode * PushStack(MimeDecStack *stack) { /* Attempt to pull from free nodes list */ MimeDecStackNode *node = stack->free_nodes; if (node == NULL) { node = SCMalloc(sizeof(MimeDecStackNode)); if (unlikely(node == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } } else { /* Move free nodes pointer over */ stack->free_nodes = stack->free_nodes->next; stack->free_nodes_cnt--; } memset(node, 0x00, sizeof(MimeDecStackNode)); /* Push to top of stack */ node->next = stack->top; stack->top = node; /* Return a pointer to the top of the stack */ return node; } /** * \brief Pops the top node from the stack and returns the next node. * * \param stack The top of the stack * * \return pointer to the next node, otherwise NULL if no nodes remain */ static MimeDecStackNode * PopStack(MimeDecStack *stack) { /* Move stack pointer to next item */ MimeDecStackNode *curr = stack->top; if (curr != NULL) { curr = curr->next; } /* Always free alloc'd memory */ SCFree(stack->top->bdef); /* Now move head to free nodes list */ if (stack->free_nodes_cnt < STACK_FREE_NODES) { stack->top->next = stack->free_nodes; stack->free_nodes = stack->top; stack->free_nodes_cnt++; } else { SCFree(stack->top); } stack->top = curr; /* Return a pointer to the top of the stack */ return curr; } /** * \brief Frees the stack along with the free-nodes list * * \param stack The stack pointer * * \return none */ static void FreeMimeDecStack(MimeDecStack *stack) { MimeDecStackNode *temp, *curr; if (stack != NULL) { /* Top of stack */ curr = stack->top; while (curr != NULL) { temp = curr; curr = curr->next; /* Now free node */ SCFree(temp->bdef); SCFree(temp); } /* Free nodes */ curr = stack->free_nodes; while (curr != NULL) { temp = curr; curr = curr->next; /* Now free node */ SCFree(temp); } SCFree(stack); } } /** * \brief Adds a data value to the data values linked list * * \param dv The head of the linked list (NULL if new list) * * \return pointer to a new node, otherwise NULL if it fails */ static DataValue * AddDataValue(DataValue *dv) { DataValue *curr, *node = SCMalloc(sizeof(DataValue)); if (unlikely(node == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } memset(node, 0x00, sizeof(DataValue)); if (dv != NULL) { curr = dv; while (curr->next != NULL) { curr = curr->next; } curr->next = node; } return node; } /** * \brief Frees a linked list of data values starting at the head * * \param dv The head of the linked list * * \return none */ static void FreeDataValue(DataValue *dv) { DataValue *temp, *curr; if (dv != NULL) { curr = dv; while (curr != NULL) { temp = curr; curr = curr->next; /* Now free node */ SCFree(temp->value); SCFree(temp); } } } /** * \brief Converts a list of data values into a single value (returns dynamically * allocated memory) * * \param dv The head of the linked list (NULL if new list) * \param len The output length of the single value * * \return pointer to a single value, otherwise NULL if it fails or is zero-length */ static uint8_t * GetFullValue(DataValue *dv, uint32_t *len) { DataValue *curr; uint32_t offset = 0; uint8_t *val = NULL; /* First calculate total length */ *len = 0; curr = dv; while (curr != NULL) { *len += curr->value_len; #if 0 /* Add CRLF except on last one */ if (curr->next != NULL) { *len += 2; } #endif curr = curr->next; } /* Must have at least one character in the value */ if (*len > 0) { val = SCCalloc(1, *len); if (unlikely(val == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); *len = 0; return NULL; } curr = dv; while (curr != NULL) { memcpy(val + offset, curr->value, curr->value_len); offset += curr->value_len; #if 0 /* VJ unclear why this is needed ? */ /* Add CRLF except on last one */ if (curr->next != NULL) { memcpy(val + offset, CRLF, 2); offset += 2; } #endif curr = curr->next; } } return val; } /** * \brief Find a string while searching up to N characters within a source * buffer * * \param src The source string (not null-terminated) * \param len The length of the source string * \param find The string to find (null-terminated) * \param find_len length of the 'find' string * * \return Pointer to the position it was found, otherwise NULL if not found */ static inline uint8_t * FindBuffer(const uint8_t *src, uint32_t len, const uint8_t *find, uint32_t find_len) { /* Use utility search function */ return BasicSearchNocase(src, len, find, find_len); } /** * \brief Get a line (CRLF or just CR or LF) from a buffer (similar to GetToken) * * \param buf The input buffer (not null-terminated) * \param blen The length of the input buffer * \param remainPtr Pointer to remaining after tokenizing iteration * \param tokLen Output token length (if non-null line) * * \return Pointer to line */ static uint8_t * GetLine(uint8_t *buf, uint32_t blen, uint8_t **remainPtr, uint32_t *tokLen) { uint32_t i; uint8_t *tok; /* So that it can be used just like strtok_r */ if (buf == NULL) { buf = *remainPtr; } else { *remainPtr = buf; } if (buf == NULL) return NULL; tok = buf; /* length must be specified */ for (i = 0; i < blen && buf[i] != 0; i++) { /* Found delimiter */ if (buf[i] == CR || buf[i] == LF) { /* Add another if we find either CRLF or LFCR */ *remainPtr += (i + 1); if ((i + 1 < blen) && buf[i] != buf[i + 1] && (buf[i + 1] == CR || buf[i + 1] == LF)) { (*remainPtr)++; } break; } } /* If no delimiter found, then point to end of buffer */ if (buf == *remainPtr) { (*remainPtr) += i; } /* Calculate token length */ *tokLen = (buf + i) - tok; return tok; } /** * \brief Get token from buffer and return pointer to it * * \param buf The input buffer (not null-terminated) * \param blen The length of the input buffer * \param delims Character delimiters (null-terminated) * \param remainPtr Pointer to remaining after tokenizing iteration * \param tokLen Output token length (if non-null line) * * \return Pointer to token, or NULL if not found */ static uint8_t * GetToken(uint8_t *buf, uint32_t blen, const char *delims, uint8_t **remainPtr, uint32_t *tokenLen) { uint32_t i, j, delimFound = 0; uint8_t *tok = NULL; /* So that it can be used just like strtok_r */ if (buf == NULL) { buf = *remainPtr; } else { *remainPtr = buf; } if (buf == NULL) return NULL; /* Must specify length */ for (i = 0; i < blen && buf[i] != 0; i++) { /* Look for delimiters */ for (j = 0; delims[j] != 0; j++) { if (buf[i] == delims[j]) { /* Data must be found before delimiter matters */ if (tok != NULL) { (*remainPtr) += (i + 1); } delimFound = 1; break; } } /* If at least one non-delimiter found, then a token is found */ if (tok == NULL && !delimFound) { tok = buf + i; } else { /* Reset delimiter */ delimFound = 0; } /* If delimiter found, then break out of loop */ if (buf != *remainPtr) { break; } } /* Make sure remaining points to end of buffer if delimiters not found */ if (tok != NULL) { if (buf == *remainPtr) { (*remainPtr) += i; } /* Calculate token length */ *tokenLen = (buf + i) - tok; } return tok; } /** * \brief Stores the final MIME header value into the current entity on the * stack. * * \param state The parser state * * \return MIME_DEC_OK if stored, otherwise a negative number indicating error */ static int StoreMimeHeader(MimeDecParseState *state) { int ret = MIME_DEC_OK, stored = 0; uint8_t *val; uint32_t vlen; /* Lets save the most recent header */ if (state->hname != NULL || state->hvalue != NULL) { SCLogDebug("Storing last header"); val = GetFullValue(state->hvalue, &vlen); if (val != NULL) { if (state->hname == NULL) { SCLogDebug("Error: Invalid parser state - header value without" " name"); ret = MIME_DEC_ERR_PARSE; } else if (state->stack->top != NULL) { /* Store each header name and value */ if (MimeDecFillField(state->stack->top->data, state->hname, state->hlen, val, vlen) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "MimeDecFillField() function failed"); ret = MIME_DEC_ERR_MEM; } else { stored = 1; } } else { SCLogDebug("Error: Stack pointer missing"); ret = MIME_DEC_ERR_DATA; } } else if (state->hvalue != NULL) { /* Memory allocation must have failed since val is NULL */ SCLogError(SC_ERR_MEM_ALLOC, "GetFullValue() function failed"); ret = MIME_DEC_ERR_MEM; } /* Do cleanup here */ if (!stored) { SCFree(state->hname); SCFree(val); } state->hname = NULL; FreeDataValue(state->hvalue); state->hvalue = NULL; state->hvlen = 0; } return ret; } /** * \brief Function determines whether a url string points to an executable * based on file extension only. * * \param url The url string * \param len The url string length * * \retval 1 The url points to an EXE * \retval 0 The url does NOT point to an EXE */ static int IsExeUrl(const uint8_t *url, uint32_t len) { int isExeUrl = 0; uint32_t i, extLen; uint8_t *ext; /* Now check for executable extensions and if not found, cut off at first '/' */ for (i = 0; UrlExeExts[i] != NULL; i++) { extLen = strlen(UrlExeExts[i]); ext = FindBuffer(url, len, (uint8_t *)UrlExeExts[i], strlen(UrlExeExts[i])); if (ext != NULL && (ext + extLen - url == (int)len || ext[extLen] == '?')) { isExeUrl = 1; break; } } return isExeUrl; } /** * \brief Function determines whether a host string is a numeric IP v4 address * * \param urlhost The host string * \param len The host string length * * \retval 1 The host is a numeric IP * \retval 0 The host is NOT a numeric IP */ static int IsIpv4Host(const uint8_t *urlhost, uint32_t len) { struct sockaddr_in sa; char tempIp[MAX_IP4_CHARS + 1]; /* Cut off at '/' */ uint32_t i = 0; for (i = 0; i < len && urlhost[i] != 0; i++) { if (urlhost[i] == '/') { break; } } /* Too many chars */ if (i > MAX_IP4_CHARS) { return 0; } /* Create null-terminated string */ memcpy(tempIp, urlhost, i); tempIp[i] = '\0'; return inet_pton(AF_INET, tempIp, &(sa.sin_addr)); } /** * \brief Function determines whether a host string is a numeric IP v6 address * * \param urlhost The host string * \param len The host string length * * \retval 1 The host is a numeric IP * \retval 0 The host is NOT a numeric IP */ static int IsIpv6Host(const uint8_t *urlhost, uint32_t len) { struct in6_addr in6; char tempIp[MAX_IP6_CHARS + 1]; /* Cut off at '/' */ uint32_t i = 0; for (i = 0; i < len && urlhost[i] != 0; i++) { if (urlhost[i] == '/') { break; } } /* Too many chars */ if (i > MAX_IP6_CHARS) { return 0; } /* Create null-terminated string */ memcpy(tempIp, urlhost, i); tempIp[i] = '\0'; return inet_pton(AF_INET6, tempIp, &in6); } /** * \brief Traverses through the list of URLs for an exact match of the specified * string * * \param entity The MIME entity * \param url The matching URL string (lowercase) * \param url_len The matching URL string length * * \return URL object or NULL if not found */ static MimeDecUrl *FindExistingUrl(MimeDecEntity *entity, uint8_t *url, uint32_t url_len) { MimeDecUrl *curr = entity->url_list; while (curr != NULL) { if (url_len == curr->url_len) { /* search url and stored url are both in * lowercase, so we can do an exact match */ if (SCMemcmp(curr->url, url, url_len) == 0) { break; } } curr = curr->next; } return curr; } /** * \brief This function searches a text or html line for a URL string * * URLS are generally truncated to the 'host.domain' format because * some email messages contain dozens or even hundreds of URLs with * the same host, but with only small variations in path. * * The exception is that URLs with executable file extensions are stored * with the full path. They are stored in lowercase. * * Numeric IPs, malformed numeric IPs, and URLs pointing to executables are * also flagged as URLs of interest. * * \param line the line * \param len the line length * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int FindUrlStrings(const uint8_t *line, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; uint8_t *fptr, *remptr, *tok = NULL, *tempUrl; uint32_t tokLen = 0, i, tempUrlLen; uint8_t urlStrLen = 0, flags = 0; remptr = (uint8_t *)line; do { SCLogDebug("Looking for URL String starting with: %s", URL_STR); /* Check for token definition */ fptr = FindBuffer(remptr, len - (remptr - line), (uint8_t *)URL_STR, strlen(URL_STR)); if (fptr != NULL) { urlStrLen = strlen(URL_STR); fptr += urlStrLen; /* Start at end of start string */ tok = GetToken(fptr, len - (fptr - line), " \"\'<>]\t", &remptr, &tokLen); if (tok == fptr) { SCLogDebug("Found url string"); /* First copy to temp URL string */ tempUrl = SCMalloc(urlStrLen + tokLen); if (unlikely(tempUrl == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); return MIME_DEC_ERR_MEM; } PrintChars(SC_LOG_DEBUG, "RAW URL", tok, tokLen); /* Copy over to temp URL while decoding */ tempUrlLen = 0; for (i = 0; i < tokLen && tok[i] != 0; i++) { // URL decoding would probably go here /* url is all lowercase */ tempUrl[tempUrlLen] = tolower(tok[i]); tempUrlLen++; } /* Determine if URL points to an EXE */ if (IsExeUrl(tempUrl, tempUrlLen)) { flags |= URL_IS_EXE; PrintChars(SC_LOG_DEBUG, "EXE URL", tempUrl, tempUrlLen); } else { /* Not an EXE URL */ /* Cut off length at first '/' */ /* If seems that BAESystems had done the following in support of PEScan. We don't want it for logging. Therefore its been removed. tok = FindString(tempUrl, tempUrlLen, "/"); if (tok != NULL) { tempUrlLen = tok - tempUrl; } */ } /* Make sure remaining URL exists */ if (tempUrlLen > 0) { if (!(FindExistingUrl(entity, tempUrl, tempUrlLen))) { /* Now look for numeric IP */ if (IsIpv4Host(tempUrl, tempUrlLen)) { flags |= URL_IS_IP4; PrintChars(SC_LOG_DEBUG, "IP URL4", tempUrl, tempUrlLen); } else if (IsIpv6Host(tempUrl, tempUrlLen)) { flags |= URL_IS_IP6; PrintChars(SC_LOG_DEBUG, "IP URL6", tempUrl, tempUrlLen); } /* Add URL list item */ MimeDecAddUrl(entity, tempUrl, tempUrlLen, flags); } else { SCFree(tempUrl); } } else { SCFree(tempUrl); } } } } while (fptr != NULL); return ret; } /** * \brief This function is a pre-processor for handling decoded data chunks that * then invokes the caller's callback function for further processing * * \param chunk The decoded chunk * \param len The decoded chunk length (varies) * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessDecodedDataChunk(const uint8_t *chunk, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint8_t *remainPtr, *tok; uint32_t tokLen; if ((state->stack != NULL) && (state->stack->top != NULL) && (state->stack->top->data != NULL)) { MimeDecConfig *mdcfg = MimeDecGetConfig(); if (mdcfg != NULL && mdcfg->extract_urls) { MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; /* If plain text or html, then look for URLs */ if (((entity->ctnt_flags & CTNT_IS_TEXT) || (entity->ctnt_flags & CTNT_IS_MSG) || (entity->ctnt_flags & CTNT_IS_HTML)) && ((entity->ctnt_flags & CTNT_IS_ATTACHMENT) == 0)) { /* Remainder from previous line */ if (state->linerem_len > 0) { // TODO } else { /* No remainder from previous line */ /* Parse each line one by one */ remainPtr = (uint8_t *)chunk; do { tok = GetLine(remainPtr, len - (remainPtr - (uint8_t *)chunk), &remainPtr, &tokLen); if (tok != remainPtr) { // DEBUG - ADDED /* If last token found without CR/LF delimiter, then save * and reconstruct with next chunk */ if (tok + tokLen - (uint8_t *) chunk == (int)len) { PrintChars(SC_LOG_DEBUG, "LAST CHUNK LINE - CUTOFF", tok, tokLen); SCLogDebug("\nCHUNK CUTOFF CHARS: %u delim %u\n", tokLen, len - (uint32_t)(tok + tokLen - (uint8_t *) chunk)); } else { /* Search line for URL */ ret = FindUrlStrings(tok, tokLen, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: FindUrlStrings() function" " failed: %d", ret); break; } } } } while (tok != remainPtr && remainPtr - (uint8_t *) chunk < (int)len); } } } /* Now invoke callback */ if (state->DataChunkProcessorFunc != NULL) { ret = state->DataChunkProcessorFunc(chunk, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: state->dataChunkProcessor() callback function" " failed"); } } } else { SCLogDebug("Error: Stack pointer missing"); ret = MIME_DEC_ERR_DATA; } /* Reset data chunk buffer */ state->data_chunk_len = 0; /* Mark body / file as no longer at beginning */ state->body_begin = 0; return ret; } /** * \brief Processes a remainder (line % 4 = remainder) from the previous line * such that all base64 decoding attempts are divisible by 4 * * \param buf The current line * \param len The length of the line * \param state The current parser state * \param force Flag indicating whether decoding should always occur * * \return Number of bytes pulled from the current buffer */ static uint8_t ProcessBase64Remainder(const uint8_t *buf, uint32_t len, MimeDecParseState *state, int force) { uint32_t ret; uint8_t remainder = 0, remdec = 0; SCLogDebug("Base64 line remainder found: %u", state->bvr_len); /* Fill in block with first few bytes of current line */ remainder = B64_BLOCK - state->bvr_len; remainder = remainder < len ? remainder : len; if (remainder && buf) { memcpy(state->bvremain + state->bvr_len, buf, remainder); } state->bvr_len += remainder; /* If data chunk buffer will be full, then clear it now */ if (DATA_CHUNK_SIZE - state->data_chunk_len < ASCII_BLOCK) { /* Invoke pre-processor and callback */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() function failed"); } } /* Only decode if divisible by 4 */ if (state->bvr_len == B64_BLOCK || force) { remdec = DecodeBase64(state->data_chunk + state->data_chunk_len, state->bvremain, state->bvr_len, 1); if (remdec > 0) { /* Track decoded length */ state->stack->top->data->decoded_body_len += remdec; /* Update length */ state->data_chunk_len += remdec; /* If data chunk buffer is now full, then clear */ if (DATA_CHUNK_SIZE - state->data_chunk_len < ASCII_BLOCK) { /* Invoke pre-processor and callback */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() function " "failed"); } } } else { /* Track failed base64 */ state->stack->top->data->anomaly_flags |= ANOM_INVALID_BASE64; state->msg->anomaly_flags |= ANOM_INVALID_BASE64; SCLogDebug("Error: DecodeBase64() function failed"); PrintChars(SC_LOG_DEBUG, "Base64 failed string", state->bvremain, state->bvr_len); } /* Reset remaining */ state->bvr_len = 0; } return remainder; } /** * \brief Processes a body line by base64-decoding and passing to the data chunk * processing callback function when the buffer is read * * \param buf The current line * \param len The length of the line * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessBase64BodyLine(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint8_t rem1 = 0, rem2 = 0; uint32_t numDecoded, remaining, offset, avail, tobuf; /* Track long line */ if (len > MAX_ENC_LINE_LEN) { state->stack->top->data->anomaly_flags |= ANOM_LONG_ENC_LINE; state->msg->anomaly_flags |= ANOM_LONG_ENC_LINE; SCLogDebug("Error: Max encoded input line length exceeded %u > %u", len, MAX_ENC_LINE_LEN); } /* First process remaining from previous line */ if (state->bvr_len > 0) { SCLogDebug("Base64 line remainder found: %u", state->bvr_len); /* Process remainder and return number of bytes pulled from current buffer */ rem1 = ProcessBase64Remainder(buf, len, state, 0); } /* No error and at least some more data needs to be decoded */ if ((int) (len - rem1) > 0) { /* Determine whether we need to save a remainder if not divisible by 4 */ rem2 = (len - rem1) % B64_BLOCK; if (rem2 > 0) { SCLogDebug("Base64 saving remainder: %u", rem2); memcpy(state->bvremain, buf + (len - rem2), rem2); state->bvr_len = rem2; } /* Process remaining in loop in case buffer fills up */ remaining = len - rem1 - rem2; offset = rem1; while (remaining > 0) { /* Determine amount to add to buffer */ avail = (DATA_CHUNK_SIZE - state->data_chunk_len) * B64_BLOCK / ASCII_BLOCK; tobuf = avail > remaining ? remaining : avail; while (tobuf % 4 != 0) { tobuf--; } if (tobuf < B64_BLOCK) { SCLogDebug("Error: Invalid state for decoding base-64 block"); return MIME_DEC_ERR_PARSE; } SCLogDebug("Decoding: %u", len - rem1 - rem2); numDecoded = DecodeBase64(state->data_chunk + state->data_chunk_len, buf + offset, tobuf, 1); if (numDecoded > 0) { /* Track decoded length */ state->stack->top->data->decoded_body_len += numDecoded; /* Update length */ state->data_chunk_len += numDecoded; if ((int) (DATA_CHUNK_SIZE - state->data_chunk_len) < 0) { SCLogDebug("Error: Invalid Chunk length: %u", state->data_chunk_len); ret = MIME_DEC_ERR_PARSE; break; } /* If buffer full, then invoke callback */ if (DATA_CHUNK_SIZE - state->data_chunk_len < ASCII_BLOCK) { /* Invoke pre-processor and callback */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() " "function failed"); } } } else { /* Track failed base64 */ state->stack->top->data->anomaly_flags |= ANOM_INVALID_BASE64; state->msg->anomaly_flags |= ANOM_INVALID_BASE64; SCLogDebug("Error: DecodeBase64() function failed"); PrintChars(SC_LOG_DEBUG, "Base64 failed string", buf + offset, tobuf); } /* Update counts */ remaining -= tobuf; offset += tobuf; } } return ret; } /** * \brief Decoded a hex character into its equivalent byte value for * quoted-printable decoding * * \param h The hex char * * \return byte value on success, -1 if failed **/ static int16_t DecodeQPChar(char h) { uint16_t res = 0; /* 0-9 */ if (h >= 48 && h <= 57) { res = h - 48; } else if (h >= 65 && h <= 70) { /* A-F */ res = h - 55; } else { /* Invalid */ res = -1; } return res; } /** * \brief Processes a quoted-printable encoded body line by decoding and passing * to the data chunk processing callback function when the buffer is read * * \param buf The current line * \param len The length of the line * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessQuotedPrintableBodyLine(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint32_t remaining, offset; MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; uint8_t c, h1, h2, val; int16_t res; /* Track long line */ if (len > MAX_ENC_LINE_LEN) { state->stack->top->data->anomaly_flags |= ANOM_LONG_ENC_LINE; state->msg->anomaly_flags |= ANOM_LONG_ENC_LINE; SCLogDebug("Error: Max encoded input line length exceeded %u > %u", len, MAX_ENC_LINE_LEN); } remaining = len; offset = 0; while (remaining > 0) { c = *(buf + offset); /* Copy over normal character */ if (c != '=') { state->data_chunk[state->data_chunk_len] = c; state->data_chunk_len++; entity->decoded_body_len += 1; /* Add CRLF sequence if end of line */ if (remaining == 1) { memcpy(state->data_chunk + state->data_chunk_len, CRLF, EOL_LEN); state->data_chunk_len += EOL_LEN; entity->decoded_body_len += EOL_LEN; } } else if (remaining > 1) { /* If last character handle as soft line break by ignoring, otherwise process as escaped '=' character */ /* Not enough characters */ if (remaining < 3) { entity->anomaly_flags |= ANOM_INVALID_QP; state->msg->anomaly_flags |= ANOM_INVALID_QP; SCLogDebug("Error: Quoted-printable decoding failed"); } else { h1 = *(buf + offset + 1); res = DecodeQPChar(h1); if (res < 0) { entity->anomaly_flags |= ANOM_INVALID_QP; state->msg->anomaly_flags |= ANOM_INVALID_QP; SCLogDebug("Error: Quoted-printable decoding failed"); } else { val = (res << 4); /* Shift result left */ h2 = *(buf + offset + 2); res = DecodeQPChar(h2); if (res < 0) { entity->anomaly_flags |= ANOM_INVALID_QP; state->msg->anomaly_flags |= ANOM_INVALID_QP; SCLogDebug("Error: Quoted-printable decoding failed"); } else { /* Decoding sequence succeeded */ val += res; state->data_chunk[state->data_chunk_len] = val; state->data_chunk_len++; entity->decoded_body_len++; /* Add CRLF sequence if end of line */ if (remaining == 3) { memcpy(state->data_chunk + state->data_chunk_len, CRLF, EOL_LEN); state->data_chunk_len += EOL_LEN; entity->decoded_body_len += EOL_LEN; } /* Account for extra 2 characters in 3-characted QP * sequence */ remaining -= 2; offset += 2; } } } } /* Change by 1 */ remaining--; offset++; /* If buffer full, then invoke callback */ if (DATA_CHUNK_SIZE - state->data_chunk_len < EOL_LEN + 1) { /* Invoke pre-processor and callback */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() function " "failed"); } } } return ret; } /** * \brief Processes a body line by base64-decoding (if applicable) and passing to * the data chunk processing callback function * * \param buf The current line * \param len The length of the line * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessBodyLine(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint32_t remaining, offset, avail, tobuf; MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; SCLogDebug("Processing body line"); /* Track length */ entity->body_len += len + 2; /* With CRLF */ /* Process base-64 content if enabled */ MimeDecConfig *mdcfg = MimeDecGetConfig(); if (mdcfg != NULL && mdcfg->decode_base64 && (entity->ctnt_flags & CTNT_IS_BASE64)) { ret = ProcessBase64BodyLine(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBase64BodyLine() function failed"); } } else if (mdcfg != NULL && mdcfg->decode_quoted_printable && (entity->ctnt_flags & CTNT_IS_QP)) { /* Process quoted-printable content if enabled */ ret = ProcessQuotedPrintableBodyLine(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessQuotedPrintableBodyLine() function " "failed"); } } else { /* Process non-decoded content */ remaining = len; offset = 0; while (remaining > 0) { /* Plan to add CRLF to the end of each line */ avail = DATA_CHUNK_SIZE - state->data_chunk_len; tobuf = avail > remaining + EOL_LEN ? remaining : avail - EOL_LEN; /* Copy over to buffer */ memcpy(state->data_chunk + state->data_chunk_len, buf + offset, tobuf); state->data_chunk_len += tobuf; /* Now always add a CRLF to the end */ if (tobuf == remaining) { memcpy(state->data_chunk + state->data_chunk_len, CRLF, EOL_LEN); state->data_chunk_len += EOL_LEN; } if ((int) (DATA_CHUNK_SIZE - state->data_chunk_len) < 0) { SCLogDebug("Error: Invalid Chunk length: %u", state->data_chunk_len); ret = MIME_DEC_ERR_PARSE; break; } /* If buffer full, then invoke callback */ if (DATA_CHUNK_SIZE - state->data_chunk_len < EOL_LEN + 1) { /* Invoke pre-processor and callback */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() function " "failed"); } } remaining -= tobuf; offset += tobuf; } } return ret; } /** * \brief Find the start of a header name on the current line * * \param buf The input line (not null-terminated) * \param blen The length of the input line * \param glen The output length of the header name * * \return Pointer to header name, or NULL if not found */ static uint8_t * FindMimeHeaderStart(const uint8_t *buf, uint32_t blen, uint32_t *hlen) { uint32_t i, valid = 0; uint8_t *hname = NULL; /* Init */ *hlen = 0; /* Look for sequence of printable characters followed by ':', or CRLF then printable characters followed by ':' */ for (i = 0; i < blen && buf[i] != 0; i++) { /* If ready for printable characters and found one, then increment */ if (buf[i] != COLON && buf[i] >= PRINTABLE_START && buf[i] <= PRINTABLE_END) { valid++; } else if (valid > 0 && buf[i] == COLON) { /* If ready for printable characters, found some, and found colon * delimiter, then a match is found */ hname = (uint8_t *) buf + i - valid; *hlen = valid; break; } else { /* Otherwise reset and quit */ break; } } return hname; } /** * \brief Find full header name and value on the current line based on the * current state * * \param buf The current line (no CRLF) * \param blen The length of the current line * \param state The current state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int FindMimeHeader(const uint8_t *buf, uint32_t blen, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint8_t *hname, *hval = NULL; DataValue *dv; uint32_t hlen, vlen; int finish_header = 0, new_header = 0; MimeDecConfig *mdcfg = MimeDecGetConfig(); /* Find first header */ hname = FindMimeHeaderStart(buf, blen, &hlen); if (hname != NULL) { /* Warn and track but don't do anything yet */ if (hlen > MAX_HEADER_NAME) { state->stack->top->data->anomaly_flags |= ANOM_LONG_HEADER_NAME; state->msg->anomaly_flags |= ANOM_LONG_HEADER_NAME; SCLogDebug("Error: Header name exceeds limit (%u > %u)", hlen, MAX_HEADER_NAME); } /* Value starts after 'header:' (normalize spaces) */ hval = hname + hlen + 1; if (hval - buf >= (int)blen) { SCLogDebug("No Header value found"); hval = NULL; } else { while (hval[0] == ' ') { /* If last character before end of bounds, set to NULL */ if (hval - buf >= (int)blen - 1) { SCLogDebug("No Header value found"); hval = NULL; break; } hval++; } } /* If new header found, then previous header is finished */ if (state->state_flag == HEADER_STARTED) { finish_header = 1; } /* Now process new header */ new_header = 1; /* Must wait for next line to determine if finished */ state->state_flag = HEADER_STARTED; } else if (blen == 0) { /* Found body */ /* No more headers */ state->state_flag = HEADER_DONE; finish_header = 1; SCLogDebug("All Header processing finished"); } else if (state->state_flag == HEADER_STARTED) { /* Found multi-line value (ie. Received header) */ /* If max header value exceeded, flag it */ vlen = blen; if ((mdcfg != NULL) && (state->hvlen + vlen > mdcfg->header_value_depth)) { SCLogDebug("Error: Header value of length (%u) is too long", state->hvlen + vlen); vlen = mdcfg->header_value_depth - state->hvlen; state->stack->top->data->anomaly_flags |= ANOM_LONG_HEADER_VALUE; state->msg->anomaly_flags |= ANOM_LONG_HEADER_VALUE; } if (vlen > 0) { dv = AddDataValue(state->hvalue); if (dv == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "AddDataValue() function failed"); return MIME_DEC_ERR_MEM; } if (state->hvalue == NULL) { state->hvalue = dv; } dv->value = SCMalloc(vlen); if (unlikely(dv->value == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(dv->value, buf, vlen); dv->value_len = vlen; state->hvlen += vlen; } } else { /* Likely a body without headers */ SCLogDebug("No headers found"); state->state_flag = BODY_STARTED; /* Flag beginning of body */ state->body_begin = 1; state->body_end = 0; ret = ProcessBodyLine(buf, blen, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBodyLine() function failed"); return ret; } } /* If we need to finish a header, then do so below and then cleanup */ if (finish_header) { /* Store the header value */ ret = StoreMimeHeader(state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: StoreMimeHeader() function failed"); return ret; } } /* When next header is found, we always create a new one */ if (new_header) { /* Copy name and value to state */ state->hname = SCMalloc(hlen); if (unlikely(state->hname == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(state->hname, hname, hlen); state->hlen = hlen; if (state->hvalue != NULL) { SCLogDebug("Error: Parser failed due to unexpected header " "value"); return MIME_DEC_ERR_DATA; } if (hval != NULL) { /* If max header value exceeded, flag it */ vlen = blen - (hval - buf); if ((mdcfg != NULL) && (state->hvlen + vlen > mdcfg->header_value_depth)) { SCLogDebug("Error: Header value of length (%u) is too long", state->hvlen + vlen); vlen = mdcfg->header_value_depth - state->hvlen; state->stack->top->data->anomaly_flags |= ANOM_LONG_HEADER_VALUE; state->msg->anomaly_flags |= ANOM_LONG_HEADER_VALUE; } if (vlen > 0) { state->hvalue = AddDataValue(NULL); if (state->hvalue == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "AddDataValue() function failed"); return MIME_DEC_ERR_MEM; } state->hvalue->value = SCMalloc(vlen); if (unlikely(state->hvalue->value == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(state->hvalue->value, hval, vlen); state->hvalue->value_len = vlen; state->hvlen += vlen; } } } return ret; } /** * \brief Finds a mime header token within the specified field * * \param field The current field * \param search_start The start of the search (ie. boundary=\") * \param search_end The end of the search (ie. \") * \param tlen The output length of the token (if found) * * \return A pointer to the token if found, otherwise NULL if not found */ static uint8_t * FindMimeHeaderToken(MimeDecField *field, char *search_start, char *search_end, uint32_t *tlen) { uint8_t *fptr, *tptr = NULL, *tok = NULL; SCLogDebug("Looking for token: %s", search_start); /* Check for token definition */ fptr = FindBuffer(field->value, field->value_len, (const uint8_t *)search_start, strlen(search_start)); if (fptr != NULL) { fptr += strlen(search_start); /* Start at end of start string */ tok = GetToken(fptr, field->value_len - (fptr - field->value), search_end, &tptr, tlen); if (tok != NULL) { SCLogDebug("Found mime token"); } } return tok; } /** * \brief Processes the current line for mime headers and also does post-processing * when all headers found * * \param buf The current line * \param len The length of the line * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessMimeHeaders(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; MimeDecField *field; uint8_t *bptr = NULL, *rptr = NULL; uint32_t blen = 0; MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; /* Look for mime header in current line */ ret = FindMimeHeader(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: FindMimeHeader() function failed: %d", ret); return ret; } /* Post-processing after all headers done */ if (state->state_flag == HEADER_DONE) { /* First determine encoding by looking at Content-Transfer-Encoding */ field = MimeDecFindField(entity, CTNT_TRAN_STR); if (field != NULL) { /* Look for base64 */ if (FindBuffer(field->value, field->value_len, (const uint8_t *)BASE64_STR, strlen(BASE64_STR))) { SCLogDebug("Base64 encoding found"); entity->ctnt_flags |= CTNT_IS_BASE64; } else if (FindBuffer(field->value, field->value_len, (const uint8_t *)QP_STR, strlen(QP_STR))) { /* Look for quoted-printable */ SCLogDebug("quoted-printable encoding found"); entity->ctnt_flags |= CTNT_IS_QP; } } /* Check for file attachment in content disposition */ field = MimeDecFindField(entity, CTNT_DISP_STR); if (field != NULL) { bptr = FindMimeHeaderToken(field, "filename=", TOK_END_STR, &blen); if (bptr != NULL) { SCLogDebug("File attachment found in disposition"); entity->ctnt_flags |= CTNT_IS_ATTACHMENT; /* Copy over using dynamic memory */ entity->filename = SCMalloc(blen); if (unlikely(entity->filename == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(entity->filename, bptr, blen); entity->filename_len = blen; } } /* Check for boundary, encapsulated message, and file name in Content-Type */ field = MimeDecFindField(entity, CTNT_TYPE_STR); if (field != NULL) { /* Check if child entity boundary definition found */ bptr = FindMimeHeaderToken(field, BND_START_STR, TOK_END_STR, &blen); if (bptr != NULL) { state->found_child = 1; entity->ctnt_flags |= CTNT_IS_MULTIPART; if (blen > (BOUNDARY_BUF - 2)) { state->stack->top->data->anomaly_flags |= ANOM_LONG_BOUNDARY; return MIME_DEC_ERR_PARSE; } /* Store boundary in parent node */ state->stack->top->bdef = SCMalloc(blen); if (unlikely(state->stack->top->bdef == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(state->stack->top->bdef, bptr, blen); state->stack->top->bdef_len = blen; } /* Look for file name (if not already found) */ if (!(entity->ctnt_flags & CTNT_IS_ATTACHMENT)) { bptr = FindMimeHeaderToken(field, "name=", TOK_END_STR, &blen); if (bptr != NULL) { SCLogDebug("File attachment found"); entity->ctnt_flags |= CTNT_IS_ATTACHMENT; /* Copy over using dynamic memory */ entity->filename = SCMalloc(blen); if (unlikely(entity->filename == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return MIME_DEC_ERR_MEM; } memcpy(entity->filename, bptr, blen); entity->filename_len = blen; } } /* Pull out short-hand content type */ entity->ctnt_type = GetToken(field->value, field->value_len, " \r\n;", &rptr, &entity->ctnt_type_len); if (entity->ctnt_type != NULL) { /* Check for encapsulated message */ if (FindBuffer(entity->ctnt_type, entity->ctnt_type_len, (const uint8_t *)MSG_STR, strlen(MSG_STR))) { SCLogDebug("Found encapsulated message entity"); entity->ctnt_flags |= CTNT_IS_ENV; /* Create and push child to stack */ MimeDecEntity *child = MimeDecAddEntity(entity); if (child == NULL) return MIME_DEC_ERR_MEM; child->ctnt_flags |= (CTNT_IS_ENCAP | CTNT_IS_MSG); PushStack(state->stack); state->stack->top->data = child; /* Mark as encapsulated child */ state->stack->top->is_encap = 1; /* Ready to parse headers */ state->state_flag = HEADER_READY; } else if (FindBuffer(entity->ctnt_type, entity->ctnt_type_len, (const uint8_t *)MULTIPART_STR, strlen(MULTIPART_STR))) { /* Check for multipart */ SCLogDebug("Found multipart entity"); entity->ctnt_flags |= CTNT_IS_MULTIPART; } else if (FindBuffer(entity->ctnt_type, entity->ctnt_type_len, (const uint8_t *)TXT_STR, strlen(TXT_STR))) { /* Check for plain text */ SCLogDebug("Found plain text entity"); entity->ctnt_flags |= CTNT_IS_TEXT; } else if (FindBuffer(entity->ctnt_type, entity->ctnt_type_len, (const uint8_t *)HTML_STR, strlen(HTML_STR))) { /* Check for html */ SCLogDebug("Found html entity"); entity->ctnt_flags |= CTNT_IS_HTML; } } } /* Store pointer to Message-ID */ field = MimeDecFindField(entity, MSG_ID_STR); if (field != NULL) { entity->msg_id = field->value; entity->msg_id_len = field->value_len; } /* Flag beginning of body */ state->body_begin = 1; state->body_end = 0; } return ret; } /** * \brief Indicates to the parser that the body of an entity has completed * processing on the previous line * * \param state The current parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessBodyComplete(MimeDecParseState *state) { int ret = MIME_DEC_OK; SCLogDebug("Process body complete called"); /* Mark the file as hitting the end */ state->body_end = 1; if (state->bvr_len > 0) { SCLogDebug("Found (%u) remaining base64 bytes not processed", state->bvr_len); /* Process the remainder */ ret = ProcessBase64Remainder(NULL, 0, state, 1); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBase64BodyLine() function failed"); } } #ifdef HAVE_NSS if (state->md5_ctx) { unsigned int len = 0; HASH_End(state->md5_ctx, state->md5, &len, sizeof(state->md5)); } #endif /* Invoke pre-processor and callback with remaining data */ ret = ProcessDecodedDataChunk(state->data_chunk, state->data_chunk_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessDecodedDataChunk() function failed"); } /* Now reset */ state->body_begin = 0; state->body_end = 0; return ret; } /** * \brief When a mime boundary is found, look for end boundary and also do stack * management * * \param buf The current line * \param len The length of the line * \param bdef_len The length of the current boundary * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessMimeBoundary(const uint8_t *buf, uint32_t len, uint32_t bdef_len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint8_t *rptr; MimeDecEntity *child; SCLogDebug("PROCESSING BOUNDARY - START: %d", state->state_flag); /* If previous line was not an end boundary, then we process the body as * completed */ if (state->state_flag != BODY_END_BOUND) { /* First lets complete the body */ ret = ProcessBodyComplete(state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBodyComplete() function failed"); return ret; } } else { /* If last line was an end boundary, then now we are ready to parse * headers again */ state->state_flag = HEADER_READY; } /* Update remaining buffer */ rptr = (uint8_t *) buf + bdef_len + 2; /* If entity is encapsulated and current and parent didn't define the boundary, * then pop out */ if (state->stack->top->is_encap && state->stack->top->bdef_len == 0) { if (state->stack->top->next == NULL) { SCLogDebug("Error: Missing parent entity from stack"); return MIME_DEC_ERR_DATA; } if (state->stack->top->next->bdef_len == 0) { SCLogDebug("POPPED ENCAPSULATED CHILD FROM STACK: %p=%p", state->stack->top, state->stack->top->data); /* If end of boundary found, pop the child off the stack */ PopStack(state->stack); if (state->stack->top == NULL) { SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } } } /* Now check for end of nested boundary */ if (len - (rptr - buf) > 1 && rptr[0] == DASH && rptr[1] == DASH) { SCLogDebug("FOUND END BOUNDARY, POPPING: %p=%p", state->stack->top, state->stack->top->data); /* If end of boundary found, pop the child off the stack */ PopStack(state->stack); if (state->stack->top == NULL) { SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } /* If current is an encapsulated message with a boundary definition, * then pop him as well */ if (state->stack->top->is_encap && state->stack->top->bdef_len != 0) { SCLogDebug("FOUND END BOUNDARY AND ENCAP, POPPING: %p=%p", state->stack->top, state->stack->top->data); PopStack(state->stack); if (state->stack->top == NULL) { SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } } state->state_flag = BODY_END_BOUND; } else if (state->found_child) { /* Otherwise process new child */ SCLogDebug("Child entity created"); /* Create and push child to stack */ child = MimeDecAddEntity(state->stack->top->data); if (child == NULL) return MIME_DEC_ERR_MEM; child->ctnt_flags |= CTNT_IS_BODYPART; PushStack(state->stack); state->stack->top->data = child; /* Reset flag */ state->found_child = 0; } else { /* Otherwise process sibling */ if (state->stack->top->next == NULL) { SCLogDebug("Error: Missing parent entity from stack"); return MIME_DEC_ERR_DATA; } SCLogDebug("SIBLING CREATED, POPPING PARENT: %p=%p", state->stack->top, state->stack->top->data); /* First pop current to get access to parent */ PopStack(state->stack); if (state->stack->top == NULL) { SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } /* Create and push child to stack */ child = MimeDecAddEntity(state->stack->top->data); if (child == NULL) return MIME_DEC_ERR_MEM; child->ctnt_flags |= CTNT_IS_BODYPART; PushStack(state->stack); state->stack->top->data = child; } /* After boundary look for headers */ if (state->state_flag != BODY_END_BOUND) { state->state_flag = HEADER_READY; } SCLogDebug("PROCESSING BOUNDARY - END: %d", state->state_flag); return ret; } /** * \brief Processes the MIME Entity body based on the input line and current * state of the parser * * \param buf The current line * \param len The length of the line * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessMimeBody(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; uint8_t temp[BOUNDARY_BUF]; uint8_t *bstart; int body_found = 0; uint32_t tlen; #ifdef HAVE_NSS if (MimeDecGetConfig()->body_md5) { if (state->body_begin == 1) { if (state->md5_ctx == NULL) { state->md5_ctx = HASH_Create(HASH_AlgMD5); HASH_Begin(state->md5_ctx); } } HASH_Update(state->md5_ctx, buf, len + state->current_line_delimiter_len); } #endif /* Ignore empty lines */ if (len == 0) { return ret; } /* First look for boundary */ MimeDecStackNode *node = state->stack->top; if (node == NULL) { SCLogDebug("Error: Invalid stack state"); return MIME_DEC_ERR_PARSE; } /* Traverse through stack to find a boundary definition */ if (state->state_flag == BODY_END_BOUND || node->bdef == NULL) { /* If not found, then use parent's boundary */ node = node->next; while (node != NULL && node->bdef == NULL) { SCLogDebug("Traversing through stack for node with boundary"); node = node->next; } } /* This means no boundary / parent w/boundary was found so we are in the body */ if (node == NULL) { body_found = 1; } else { /* Now look for start of boundary */ if (len > 1 && buf[0] == '-' && buf[1] == '-') { tlen = node->bdef_len + 2; if (tlen > BOUNDARY_BUF) { if (state->stack->top->data) state->stack->top->data->anomaly_flags |= ANOM_LONG_BOUNDARY; return MIME_DEC_ERR_PARSE; } memcpy(temp, "--", 2); memcpy(temp + 2, node->bdef, node->bdef_len); /* Find either next boundary or end boundary */ bstart = FindBuffer((const uint8_t *)buf, len, temp, tlen); if (bstart != NULL) { ret = ProcessMimeBoundary(buf, len, node->bdef_len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessMimeBoundary() function " "failed"); return ret; } } else { /* Otherwise add value to body */ body_found = 1; } } else { /* Otherwise add value to body */ body_found = 1; } } /* Process body line */ if (body_found) { state->state_flag = BODY_STARTED; ret = ProcessBodyLine(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBodyLine() function failed"); return ret; } } return ret; } const char *MimeDecParseStateGetStatus(MimeDecParseState *state) { return StateFlags[state->state_flag]; } /** * \brief Processes the MIME Entity based on the input line and current state of * the parser * * \param buf The current line * \param len The length of the line * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ static int ProcessMimeEntity(const uint8_t *buf, uint32_t len, MimeDecParseState *state) { int ret = MIME_DEC_OK; SCLogDebug("START FLAG: %s", StateFlags[state->state_flag]); /* Track long line */ if (len > MAX_LINE_LEN) { state->stack->top->data->anomaly_flags |= ANOM_LONG_LINE; state->msg->anomaly_flags |= ANOM_LONG_LINE; SCLogDebug("Error: Max input line length exceeded %u > %u", len, MAX_LINE_LEN); } /* Looking for headers */ if (state->state_flag == HEADER_READY || state->state_flag == HEADER_STARTED) { SCLogDebug("Processing Headers"); /* Process message headers */ ret = ProcessMimeHeaders(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessMimeHeaders() function failed: %d", ret); return ret; } } else { /* Processing body */ SCLogDebug("Processing Body of: %p", state->stack->top); ret = ProcessMimeBody(buf, len, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessMimeBody() function failed: %d", ret); return ret; } } SCLogDebug("END FLAG: %s", StateFlags[state->state_flag]); return ret; } /** * \brief Init the parser by allocating memory for the state and top-level entity * * \param data A caller-specified pointer to data for access within the data chunk * processor callback function * \param dcpfunc The data chunk processor callback function * * \return A pointer to the state object, or NULL if the operation fails */ MimeDecParseState * MimeDecInitParser(void *data, int (*DataChunkProcessorFunc)(const uint8_t *chunk, uint32_t len, MimeDecParseState *state)) { MimeDecParseState *state; MimeDecEntity *mimeMsg; state = SCMalloc(sizeof(MimeDecParseState)); if (unlikely(state == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); return NULL; } memset(state, 0x00, sizeof(MimeDecParseState)); state->stack = SCMalloc(sizeof(MimeDecStack)); if (unlikely(state->stack == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); SCFree(state); return NULL; } memset(state->stack, 0x00, sizeof(MimeDecStack)); mimeMsg = SCMalloc(sizeof(MimeDecEntity)); if (unlikely(mimeMsg == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); SCFree(state->stack); SCFree(state); return NULL; } memset(mimeMsg, 0x00, sizeof(MimeDecEntity)); mimeMsg->ctnt_flags |= CTNT_IS_MSG; /* Init state */ state->msg = mimeMsg; PushStack(state->stack); if (state->stack->top == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "memory allocation failed"); SCFree(state->stack); SCFree(state); return NULL; } state->stack->top->data = mimeMsg; state->state_flag = HEADER_READY; state->data = data; state->DataChunkProcessorFunc = DataChunkProcessorFunc; return state; } /** * \brief De-Init parser by freeing up any residual memory * * \param state The parser state * * \return none */ void MimeDecDeInitParser(MimeDecParseState *state) { uint32_t cnt = 0; while (state->stack->top != NULL) { SCLogDebug("Remaining on stack: [%p]=>[%p]", state->stack->top, state->stack->top->data); PopStack(state->stack); cnt++; } if (cnt > 1) { state->msg->anomaly_flags |= ANOM_MALFORMED_MSG; SCLogDebug("Warning: Stack is not empty upon completion of " "processing (%u items remaining)", cnt); } SCFree(state->hname); FreeDataValue(state->hvalue); FreeMimeDecStack(state->stack); #ifdef HAVE_NSS if (state->md5_ctx) HASH_Destroy(state->md5_ctx); #endif SCFree(state); } /** * \brief Called to indicate that the last message line has been processed and * the parsing operation is complete * * This function should be called directly by the caller. * * \param state The parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ int MimeDecParseComplete(MimeDecParseState *state) { int ret = MIME_DEC_OK; SCLogDebug("Parsing flagged as completed"); /* Store the header value */ ret = StoreMimeHeader(state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: StoreMimeHeader() function failed"); return ret; } /* Lets complete the body */ ret = ProcessBodyComplete(state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: ProcessBodyComplete() function failed"); return ret; } if (state->stack->top == NULL) { state->msg->anomaly_flags |= ANOM_MALFORMED_MSG; SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } /* If encapsulated, pop off the stack */ if (state->stack->top->is_encap) { PopStack(state->stack); if (state->stack->top == NULL) { state->msg->anomaly_flags |= ANOM_MALFORMED_MSG; SCLogDebug("Error: Message is malformed"); return MIME_DEC_ERR_DATA; } } /* Look extra stack items remaining */ if (state->stack->top->next != NULL) { state->msg->anomaly_flags |= ANOM_MALFORMED_MSG; SCLogDebug("Warning: Message has unclosed message part boundary"); } state->state_flag = PARSE_DONE; return ret; } /** * \brief Parse a line of a MIME message and update the parser state * * \param line A string representing the line (w/out CRLF) * \param len The length of the line * \param delim_len The length of the line end delimiter * \param state The parser state * * \return MIME_DEC_OK on success, otherwise < 0 on failure */ int MimeDecParseLine(const uint8_t *line, const uint32_t len, const uint8_t delim_len, MimeDecParseState *state) { int ret = MIME_DEC_OK; /* For debugging purposes */ if (len > 0) { PrintChars(SC_LOG_DEBUG, "SMTP LINE", line, len); } else { SCLogDebug("SMTP LINE - EMPTY"); } state->current_line_delimiter_len = delim_len; /* Process the entity */ ret = ProcessMimeEntity(line, len, state); if (ret != MIME_DEC_OK) { state->state_flag = PARSE_ERROR; SCLogDebug("Error: ProcessMimeEntity() function failed: %d", ret); } return ret; } /** * \brief Parses an entire message when available in its entirety (wraps the * line-based parsing functions) * * \param buf Buffer pointing to the full message * \param blen Length of the buffer * \param data Caller data to be available in callback * \param dcpfunc Callback for processing each decoded body data chunk * * \return A pointer to the decoded MIME message, or NULL if the operation fails */ MimeDecEntity * MimeDecParseFullMsg(const uint8_t *buf, uint32_t blen, void *data, int (*dcpfunc)(const uint8_t *chunk, uint32_t len, MimeDecParseState *state)) { int ret = MIME_DEC_OK; uint8_t *remainPtr, *tok; uint32_t tokLen; MimeDecParseState *state = MimeDecInitParser(data, dcpfunc); if (state == NULL) { SCLogDebug("Error: MimeDecInitParser() function failed to create " "state"); return NULL; } MimeDecEntity *msg = state->msg; /* Parse each line one by one */ remainPtr = (uint8_t *) buf; uint8_t *line = NULL; do { tok = GetLine(remainPtr, blen - (remainPtr - buf), &remainPtr, &tokLen); if (tok != remainPtr) { line = tok; state->current_line_delimiter_len = (remainPtr - tok) - tokLen; /* Parse the line */ ret = MimeDecParseLine(line, tokLen, (remainPtr - tok) - tokLen, state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: MimeDecParseLine() function failed: %d", ret); break; } } } while (tok != remainPtr && remainPtr - buf < (int)blen); if (ret == MIME_DEC_OK) { SCLogDebug("Message parser was successful"); /* Now complete message */ ret = MimeDecParseComplete(state); if (ret != MIME_DEC_OK) { SCLogDebug("Error: MimeDecParseComplete() function failed"); } } /* De-allocate memory for parser */ MimeDecDeInitParser(state); if (ret != MIME_DEC_OK) { MimeDecFreeEntity(msg); msg = NULL; } return msg; } #ifdef AFLFUZZ_MIME static int MimeParserDataFromFileCB(const uint8_t *chunk, uint32_t len, MimeDecParseState *state) { return MIME_DEC_OK; } int MimeParserDataFromFile(char *filename) { int result = 1; uint8_t buffer[256]; #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(1000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); uint32_t line_count = 0; MimeDecParseState *state = MimeDecInitParser(&line_count, MimeParserDataFromFileCB); while (1) { int done = 0; size_t size = fread(&buffer, 1, sizeof(buffer), fp); if (size < sizeof(buffer)) done = 1; (void) MimeDecParseLine(buffer, size, 1, state); if (done) break; } /* Completed */ (void)MimeDecParseComplete(state); if (state->msg) { MimeDecFreeEntity(state->msg); } /* De Init parser */ MimeDecDeInitParser(state); fclose(fp); #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ result = 0; return result; } #endif /* AFLFUZZ_MIME */ #ifdef UNITTESTS /* Helper body chunk callback function */ static int TestDataChunkCallback(const uint8_t *chunk, uint32_t len, MimeDecParseState *state) { uint32_t *line_count = (uint32_t *) state->data; if (state->body_begin) { SCLogDebug("Body begin (len=%u)", len); } /* Add up the line counts */ if (len > 0) { uint8_t *remainPtr; uint8_t *tok; uint32_t tokLen; PrintChars(SC_LOG_DEBUG, "CHUNK", chunk, len); /* Parse each line one by one */ remainPtr = (uint8_t *) chunk; do { tok = GetLine(remainPtr, len - (remainPtr - (uint8_t *) chunk), &remainPtr, &tokLen); if (tok != NULL && tok != remainPtr) { (*line_count)++; } } while (tok != NULL && tok != remainPtr && (uint32_t)(remainPtr - (uint8_t *) chunk) < len); SCLogDebug("line count (len=%u): %u", len, *line_count); } if (state->body_end) { SCLogDebug("Body end (len=%u)", len); } return MIME_DEC_OK; } /* Test simple case of line counts */ static int MimeDecParseLineTest01(void) { int ret = MIME_DEC_OK; uint32_t expected_count = 3; uint32_t line_count = 0; /* Init parser */ MimeDecParseState *state = MimeDecInitParser(&line_count, TestDataChunkCallback); char *str = "From: Sender1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "To: Recipient1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "Content-Type: text/plain"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = ""; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "A simple message line 1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "A simple message line 2"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "A simple message line 3"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); if (ret != MIME_DEC_OK) { return 0; } /* Completed */ ret = MimeDecParseComplete(state); if (ret != MIME_DEC_OK) { return 0; } MimeDecEntity *msg = state->msg; if (msg->next != NULL || msg->child != NULL) { SCLogInfo("Error: Invalid sibling or child message"); return 0; } MimeDecFreeEntity(msg); /* De Init parser */ MimeDecDeInitParser(state); SCLogInfo("LINE COUNT FINISHED: %d", line_count); if (expected_count != line_count) { SCLogInfo("Error: Line count is invalid: expected - %d actual - %d", expected_count, line_count); return 0; } return 1; } /* Test simple case of EXE URL extraction */ static int MimeDecParseLineTest02(void) { int ret = MIME_DEC_OK; uint32_t expected_count = 2; uint32_t line_count = 0; MimeDecGetConfig()->decode_base64 = 1; MimeDecGetConfig()->decode_quoted_printable = 1; MimeDecGetConfig()->extract_urls = 1; /* Init parser */ MimeDecParseState *state = MimeDecInitParser(&line_count, TestDataChunkCallback); char *str = "From: Sender1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "To: Recipient1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "Content-Type: text/plain"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = ""; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "A simple message line 1"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); str = "A simple message line 2 click on http://www.test.com/malware.exe?" "hahah hopefully you click this link"; ret |= MimeDecParseLine((uint8_t *)str, strlen(str), 1, state); if (ret != MIME_DEC_OK) { return 0; } /* Completed */ ret = MimeDecParseComplete(state); if (ret != MIME_DEC_OK) { return 0; } MimeDecEntity *msg = state->msg; if (msg->url_list == NULL || (msg->url_list != NULL && !(msg->url_list->url_flags & URL_IS_EXE))) { SCLogInfo("Warning: Expected EXE URL not found"); return 0; } MimeDecFreeEntity(msg); /* De Init parser */ MimeDecDeInitParser(state); SCLogInfo("LINE COUNT FINISHED: %d", line_count); if (expected_count != line_count) { SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d", expected_count, line_count); return 0; } return 1; } /* Test full message with linebreaks */ static int MimeDecParseFullMsgTest01(void) { uint32_t expected_count = 3; uint32_t line_count = 0; char msg[] = "From: Sender1\r\n" "To: Recipient1\r\n" "Content-Type: text/plain\r\n" "\r\n" "Line 1\r\n" "Line 2\r\n" "Line 3\r\n"; MimeDecEntity *entity = MimeDecParseFullMsg((uint8_t *)msg, strlen(msg), &line_count, TestDataChunkCallback); if (entity == NULL) { SCLogInfo("Warning: Message failed to parse"); return 0; } MimeDecFreeEntity(entity); if (expected_count != line_count) { SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d", expected_count, line_count); return 0; } return 1; } /* Test full message with linebreaks */ static int MimeDecParseFullMsgTest02(void) { uint32_t expected_count = 3; uint32_t line_count = 0; char msg[] = "From: Sender2\r\n" "To: Recipient2\r\n" "Subject: subject2\r\n" "Content-Type: text/plain\r\n" "\r\n" "Line 1\r\n" "Line 2\r\n" "Line 3\r\n"; MimeDecEntity *entity = MimeDecParseFullMsg((uint8_t *)msg, strlen(msg), &line_count, TestDataChunkCallback); if (entity == NULL) { SCLogInfo("Warning: Message failed to parse"); return 0; } MimeDecField *field = MimeDecFindField(entity, "subject"); if (field == NULL) { SCLogInfo("Warning: Message failed to parse"); return 0; } if (field->value_len != sizeof("subject2") - 1) { SCLogInfo("Warning: failed to get subject"); return 0; } if (memcmp(field->value, "subject2", field->value_len) != 0) { SCLogInfo("Warning: failed to get subject"); return 0; } MimeDecFreeEntity(entity); if (expected_count != line_count) { SCLogInfo("Warning: Line count is invalid: expected - %d actual - %d", expected_count, line_count); return 0; } return 1; } static int MimeBase64DecodeTest01(void) { int ret = 0; char *msg = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890@" "#$%^&*()-=_+,./;'[]<>?:"; char *base64msg = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpBQkNERUZHSElKS0xNTk9QU" "VJTVFVWV1hZWjEyMzQ1Njc4OTBAIyQlXiYqKCktPV8rLC4vOydbXTw+Pzo="; uint8_t *dst = SCMalloc(strlen(msg) + 1); if (dst == NULL) return 0; ret = DecodeBase64(dst, (const uint8_t *)base64msg, strlen(base64msg), 1); if (memcmp(dst, msg, strlen(msg)) == 0) { ret = 1; } SCFree(dst); return ret; } static int MimeIsExeURLTest01(void) { int ret = 0; char *url1 = "http://www.google.com/"; char *url2 = "http://www.google.com/test.exe"; if(IsExeUrl((const uint8_t *)url1, strlen(url1)) != 0){ SCLogDebug("Debug: URL1 error"); goto end; } if(IsExeUrl((const uint8_t *)url2, strlen(url2)) != 1){ SCLogDebug("Debug: URL2 error"); goto end; } ret = 1; end: return ret; } static int MimeIsIpv4HostTest01(void) { if(IsIpv4Host((const uint8_t *)"192.168.1.1", 11) != 1) { return 0; } if(IsIpv4Host((const uint8_t *)"999.oogle.com", 14) != 0) { return 0; } if(IsIpv4Host((const uint8_t *)"0:0:0:0:0:0:0:0", 15) != 0) { return 0; } if (IsIpv4Host((const uint8_t *)"192.168.255.255", 15) != 1) { return 0; } if (IsIpv4Host((const uint8_t *)"192.168.255.255/testurl.html", 28) != 1) { return 0; } if (IsIpv4Host((const uint8_t *)"www.google.com", 14) != 0) { return 0; } return 1; } static int MimeIsIpv6HostTest01(void) { if(IsIpv6Host((const uint8_t *)"0:0:0:0:0:0:0:0", 19) != 1) { return 0; } if(IsIpv6Host((const uint8_t *)"0000:0000:0000:0000:0000:0000:0000:0000", 39) != 1) { return 0; } if(IsIpv6Host((const uint8_t *)"0:0:0:0:0:0:0:0", 19) != 1) { return 0; } if(IsIpv6Host((const uint8_t *)"192:168:1:1:0:0:0:0", 19) != 1) { return 0; } if(IsIpv6Host((const uint8_t *)"999.oogle.com", 14) != 0) { return 0; } if (IsIpv6Host((const uint8_t *)"192.168.255.255", 15) != 0) { return 0; } if (IsIpv6Host((const uint8_t *)"192.168.255.255/testurl.html", 28) != 0) { return 0; } if (IsIpv6Host((const uint8_t *)"www.google.com", 14) != 0) { return 0; } return 1; } #endif /* UNITTESTS */ void MimeDecRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("MimeDecParseLineTest01", MimeDecParseLineTest01); UtRegisterTest("MimeDecParseLineTest02", MimeDecParseLineTest02); UtRegisterTest("MimeDecParseFullMsgTest01", MimeDecParseFullMsgTest01); UtRegisterTest("MimeDecParseFullMsgTest02", MimeDecParseFullMsgTest02); UtRegisterTest("MimeBase64DecodeTest01", MimeBase64DecodeTest01); UtRegisterTest("MimeIsExeURLTest01", MimeIsExeURLTest01); UtRegisterTest("MimeIsIpv4HostTest01", MimeIsIpv4HostTest01); UtRegisterTest("MimeIsIpv6HostTest01", MimeIsIpv6HostTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-loader.c0000644000000000000000000001751113051004444015131 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "debug.h" #include "detect.h" #include "runmodes.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "queue.h" #include "util-signal.h" #include "detect-engine-loader.h" #define NLOADERS 4 static DetectLoaderControl *loaders = NULL; static int cur_loader = 0; void TmThreadWakeupDetectLoaderThreads(void); static int num_loaders = NLOADERS; /** \param loader -1 for auto select * \retval loader_id or negative in case of error */ int DetectLoaderQueueTask(int loader_id, LoaderFunc Func, void *func_ctx) { if (loader_id == -1) { loader_id = cur_loader; cur_loader++; if (cur_loader >= num_loaders) cur_loader = 0; } if (loader_id >= num_loaders || loader_id < 0) { return -ERANGE; } DetectLoaderControl *loader = &loaders[loader_id]; DetectLoaderTask *t = SCCalloc(1, sizeof(*t)); if (t == NULL) return -ENOMEM; t->Func = Func; t->ctx = func_ctx; SCMutexLock(&loader->m); TAILQ_INSERT_TAIL(&loader->task_list, t, next); SCMutexUnlock(&loader->m); TmThreadWakeupDetectLoaderThreads(); SCLogDebug("%d %p %p", loader_id, Func, func_ctx); return loader_id; } /** \brief wait for loader tasks to complete * \retval result 0 for ok, -1 for errors */ int DetectLoadersSync(void) { SCLogDebug("waiting"); int errors = 0; int i; for (i = 0; i < num_loaders; i++) { int done = 0; DetectLoaderControl *loader = &loaders[i]; while (!done) { SCMutexLock(&loader->m); if (TAILQ_EMPTY(&loader->task_list)) { done = 1; } SCMutexUnlock(&loader->m); } SCMutexLock(&loader->m); if (loader->result != 0) { errors++; loader->result = 0; } SCMutexUnlock(&loader->m); } if (errors) { SCLogError(SC_ERR_INITIALIZATION, "%d loaders reported errors", errors); return -1; } SCLogDebug("done"); return 0; } static void DetectLoaderInit(DetectLoaderControl *loader) { memset(loader, 0x00, sizeof(*loader)); SCMutexInit(&loader->m, NULL); TAILQ_INIT(&loader->task_list); } void DetectLoadersInit(void) { intmax_t setting = NLOADERS; (void)ConfGetInt("multi-detect.loaders", &setting); if (setting < 1 || setting > 1024) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "invalid multi-detect.loaders setting %"PRIdMAX, setting); exit(EXIT_FAILURE); } num_loaders = (int32_t)setting; SCLogInfo("using %d detect loader threads", num_loaders); BUG_ON(loaders != NULL); loaders = SCCalloc(num_loaders, sizeof(DetectLoaderControl)); BUG_ON(loaders == NULL); int i; for (i = 0; i < num_loaders; i++) { DetectLoaderInit(&loaders[i]); } } /** * \brief Unpauses all threads present in tv_root */ void TmThreadWakeupDetectLoaderThreads() { ThreadVars *tv = NULL; int i = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { if (strncmp(tv->name,"DL#",3) == 0) { BUG_ON(tv->ctrl_cond == NULL); pthread_cond_broadcast(tv->ctrl_cond); } tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Unpauses all threads present in tv_root */ void TmThreadContinueDetectLoaderThreads() { ThreadVars *tv = NULL; int i = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { if (strncmp(tv->name,"DL#",3) == 0) TmThreadContinue(tv); tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return; } SC_ATOMIC_DECLARE(int, detect_loader_cnt); typedef struct DetectLoaderThreadData_ { uint32_t instance; } DetectLoaderThreadData; static TmEcode DetectLoaderThreadInit(ThreadVars *t, void *initdata, void **data) { DetectLoaderThreadData *ftd = SCCalloc(1, sizeof(DetectLoaderThreadData)); if (ftd == NULL) return TM_ECODE_FAILED; ftd->instance = SC_ATOMIC_ADD(detect_loader_cnt, 1) - 1; /* id's start at 0 */ SCLogDebug("detect loader instance %u", ftd->instance); /* pass thread data back to caller */ *data = ftd; return TM_ECODE_OK; } static TmEcode DetectLoaderThreadDeinit(ThreadVars *t, void *data) { SCFree(data); return TM_ECODE_OK; } static TmEcode DetectLoader(ThreadVars *th_v, void *thread_data) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); DetectLoaderThreadData *ftd = (DetectLoaderThreadData *)thread_data; BUG_ON(ftd == NULL); SCLogDebug("loader thread started"); while (1) { if (TmThreadsCheckFlag(th_v, THV_PAUSE)) { TmThreadsSetFlag(th_v, THV_PAUSED); TmThreadTestThreadUnPaused(th_v); TmThreadsUnsetFlag(th_v, THV_PAUSED); } /* see if we have tasks */ DetectLoaderControl *loader = &loaders[ftd->instance]; SCMutexLock(&loader->m); DetectLoaderTask *task = NULL, *tmptask = NULL; TAILQ_FOREACH_SAFE(task, &loader->task_list, next, tmptask) { int r = task->Func(task->ctx, ftd->instance); loader->result |= r; TAILQ_REMOVE(&loader->task_list, task, next); SCFree(task->ctx); SCFree(task); } SCMutexUnlock(&loader->m); if (TmThreadsCheckFlag(th_v, THV_KILL)) { break; } /* just wait until someone wakes us up */ SCCtrlMutexLock(th_v->ctrl_mutex); SCCtrlCondWait(th_v->ctrl_cond, th_v->ctrl_mutex); SCCtrlMutexUnlock(th_v->ctrl_mutex); SCLogDebug("woke up..."); } return TM_ECODE_OK; } /** \brief spawn the detect loader manager thread */ void DetectLoaderThreadSpawn() { int i; for (i = 0; i < num_loaders; i++) { ThreadVars *tv_loader = NULL; char name[TM_THREAD_NAME_MAX]; snprintf(name, sizeof(name), "%s#%02d", thread_name_detect_loader, i+1); tv_loader = TmThreadCreateCmdThreadByName(name, "DetectLoader", 1); BUG_ON(tv_loader == NULL); if (tv_loader == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(1); } if (TmThreadSpawn(tv_loader) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(1); } } return; } void TmModuleDetectLoaderRegister (void) { tmm_modules[TMM_DETECTLOADER].name = "DetectLoader"; tmm_modules[TMM_DETECTLOADER].ThreadInit = DetectLoaderThreadInit; tmm_modules[TMM_DETECTLOADER].ThreadDeinit = DetectLoaderThreadDeinit; tmm_modules[TMM_DETECTLOADER].Management = DetectLoader; tmm_modules[TMM_DETECTLOADER].cap_flags = 0; tmm_modules[TMM_DETECTLOADER].flags = TM_FLAG_MANAGEMENT_TM; SCLogDebug("%s registered", tmm_modules[TMM_DETECTLOADER].name); SC_ATOMIC_INIT(detect_loader_cnt); } suricata-3.2.1/src/stream-tcp.h0000644000000000000000000002024013051004444013227 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh */ #ifndef __STREAM_TCP_H__ #define __STREAM_TCP_H__ #include "stream-tcp-private.h" #define COUNTER_STREAMTCP_STREAMS 1 #include "app-layer-detect-proto.h" #include "util-mpm.h" #include "stream.h" #include "stream-tcp-reassemble.h" #define STREAM_VERBOSE FALSE /* Flag to indicate that the checksum validation for the stream engine has been enabled */ #define STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION 0x01 /*global flow data*/ typedef struct TcpStreamCnf_ { /** stream tracking * * max stream mem usage */ uint64_t memcap; uint64_t reassembly_memcap; /**< max memory usage for stream reassembly */ uint32_t ssn_init_flags; /**< new ssn flags will be initialized to this */ uint8_t segment_init_flags; /**< new seg flags will be initialized to this */ uint16_t zero_copy_size; /**< use zero copy for app layer above segments * of this size */ uint32_t prealloc_sessions; /**< ssns to prealloc per stream thread */ int midstream; int async_oneside; uint32_t reassembly_depth; /**< Depth until when we reassemble the stream */ uint16_t reassembly_toserver_chunk_size; uint16_t reassembly_toclient_chunk_size; int check_overlap_different_data; int bypass; /** reassembly -- inline mode * * sliding window size for raw stream reassembly */ uint32_t reassembly_inline_window; uint8_t flags; uint8_t max_synack_queued; } TcpStreamCnf; typedef struct StreamTcpThread_ { int ssn_pool_id; /** queue for pseudo packet(s) that were created in the stream * process and need further handling. Currently only used when * receiving (valid) RST packets */ PacketQueue pseudo_queue; uint16_t counter_tcp_sessions; /** sessions not picked up because memcap was reached */ uint16_t counter_tcp_ssn_memcap; /** pseudo packets processed */ uint16_t counter_tcp_pseudo; /** pseudo packets failed to setup */ uint16_t counter_tcp_pseudo_failed; /** packets rejected because their csum is invalid */ uint16_t counter_tcp_invalid_checksum; /** TCP packets with no associated flow */ uint16_t counter_tcp_no_flow; /** sessions reused */ uint16_t counter_tcp_reused_ssn; /** syn pkts */ uint16_t counter_tcp_syn; /** syn/ack pkts */ uint16_t counter_tcp_synack; /** rst pkts */ uint16_t counter_tcp_rst; /** tcp reassembly thread data */ TcpReassemblyThreadCtx *ra_ctx; } StreamTcpThread; TcpStreamCnf stream_config; void StreamTcpInitConfig (char); void StreamTcpFreeConfig(char); void StreamTcpRegisterTests (void); void StreamTcpSessionPktFree (Packet *); void StreamTcpIncrMemuse(uint64_t); void StreamTcpDecrMemuse(uint64_t); int StreamTcpCheckMemcap(uint64_t); Packet *StreamTcpPseudoSetup(Packet *, uint8_t *, uint32_t); int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data); void StreamTcpReassembleConfigEnableOverlapCheck(void); void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size); /** ------- Inline functions: ------ */ /** * \brief If we are on IPS mode, and got a drop action triggered from * the IP only module, or from a reassembled msg and/or from an * applayer detection, then drop the rest of the packets of the * same stream and avoid inspecting it any further * \param p pointer to the Packet to check * \retval 1 if we must drop this stream * \retval 0 if the stream still legal */ static inline int StreamTcpCheckFlowDrops(Packet *p) { /* If we are on IPS mode, and got a drop action triggered from * the IP only module, or from a reassembled msg and/or from an * applayer detection, then drop the rest of the packets of the * same stream and avoid inspecting it any further */ if (EngineModeIsIPS() && (p->flow->flags & FLOW_ACTION_DROP)) return 1; return 0; } /** * \brief Function to flip the direction When we missed the SYN packet, * SYN/ACK is considered as sent by server, but our engine flagged the * packet as from client for the host whose packet is received first in * the session. * * \param ssn TcpSession to whom this packet belongs * \param p Packet whose flag has to be changed */ static inline void StreamTcpPacketSwitchDir(TcpSession *ssn, Packet *p) { SCLogDebug("ssn %p: switching pkt direction", ssn); if (PKT_IS_TOSERVER(p)) { p->flowflags &= ~FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; if (p->flowflags & FLOW_PKT_TOSERVER_FIRST) { p->flowflags &= ~FLOW_PKT_TOSERVER_FIRST; p->flowflags |= FLOW_PKT_TOCLIENT_FIRST; } } else { p->flowflags &= ~FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; if (p->flowflags & FLOW_PKT_TOCLIENT_FIRST) { p->flowflags &= ~FLOW_PKT_TOCLIENT_FIRST; p->flowflags |= FLOW_PKT_TOSERVER_FIRST; } } } enum { /* stream has no segments for forced reassembly, nor for detection */ STREAM_HAS_UNPROCESSED_SEGMENTS_NONE = 0, /* stream seems to have segments that need to be forced reassembled */ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY = 1, /* stream has no segments for forced reassembly, but only segments that * have been sent for detection, but are stuck in the detection queues */ STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION = 2, }; static inline int StreamNeedsReassembly(TcpSession *ssn, int direction) { /* server tcp state */ if (direction) { if (ssn->server.seg_list != NULL && (!(ssn->server.seg_list_tail->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) || !(ssn->server.seg_list_tail->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) ) { return STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY; } else if (ssn->toclient_smsg_head != NULL) { return STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; } else { return STREAM_HAS_UNPROCESSED_SEGMENTS_NONE; } } else { if (ssn->client.seg_list != NULL && (!(ssn->client.seg_list_tail->flags & SEGMENTTCP_FLAG_RAW_PROCESSED) || !(ssn->client.seg_list_tail->flags & SEGMENTTCP_FLAG_APPLAYER_PROCESSED)) ) { return STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY; } else if (ssn->toserver_smsg_head != NULL) { return STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; } else { return STREAM_HAS_UNPROCESSED_SEGMENTS_NONE; } } } TmEcode StreamTcp (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); void StreamTcpExitPrintStats(ThreadVars *, void *); TmEcode StreamTcpThreadInit(ThreadVars *, void *, void **); TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data); void StreamTcpRegisterTests (void); int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueue *pq); /* clear ssn and return to pool */ void StreamTcpSessionClear(void *ssnptr); /* cleanup ssn, but don't free ssn */ void StreamTcpSessionCleanup(TcpSession *ssn); /* cleanup stream, but don't free the stream */ void StreamTcpStreamCleanup(TcpStream *stream); /* check if bypass is enabled */ int StreamTcpBypassEnabled(void); uint32_t StreamTcpGetStreamSize(TcpStream *stream); #endif /* __STREAM_TCP_H__ */ suricata-3.2.1/src/detect-engine-port.c0000644000000000000000000021737113051004444014655 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Ports part of the detection engine. * * \todo move this out of the detection plugin structure * \todo more unittesting * */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "flow-var.h" #include "util-cidr.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-rule-vars.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-siggroup.h" #include "detect-engine-port.h" #include "conf.h" #include "util-debug.h" #include "util-error.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" #include "util-var.h" static int DetectPortCutNot(DetectPort *, DetectPort **); static int DetectPortCut(DetectEngineCtx *, DetectPort *, DetectPort *, DetectPort **); DetectPort *PortParse(char *str); int DetectPortIsValidRange(char *); /** * \brief Alloc a DetectPort structure and update counters * * \retval sgh Pointer to the newly created DetectPort on success; or NULL in * case of error. */ DetectPort *DetectPortInit(void) { DetectPort *dp = SCMalloc(sizeof(DetectPort)); if (unlikely(dp == NULL)) return NULL; memset(dp, 0, sizeof(DetectPort)); return dp; } /** * \brief Free a DetectPort and its members * * \param dp Pointer to the DetectPort that has to be freed. */ void DetectPortFree(DetectPort *dp) { if (dp == NULL) return; /* only free the head if we have the original */ if (dp->sh != NULL && !(dp->flags & PORT_SIGGROUPHEAD_COPY)) { SigGroupHeadFree(dp->sh); } dp->sh = NULL; SCFree(dp); } /** * \brief Used to see if the exact same portrange exists in the list * * \param head Pointer to the DetectPort list head * \param dp DetectPort to search in the DetectPort list * * \retval returns a ptr to the match, or NULL if no match */ DetectPort *DetectPortLookup(DetectPort *head, DetectPort *dp) { DetectPort *cur; if (head != NULL) { for (cur = head; cur != NULL; cur = cur->next) { if (DetectPortCmp(cur, dp) == PORT_EQ) return cur; } } return NULL; } /** * \brief Helper function used to print the list of ports * present in this DetectPort list. * * \param head Pointer to the DetectPort list head */ void DetectPortPrintList(DetectPort *head) { DetectPort *cur; uint16_t cnt = 0; SCLogDebug("= list start:"); if (head != NULL) { for (cur = head; cur != NULL; cur = cur->next) { DetectPortPrint(cur); cnt++; } SCLogDebug(" "); } SCLogDebug("= list end (cnt %" PRIu32 ")", cnt); } /** * \brief Free a DetectPort list and each of its members * * \param head Pointer to the DetectPort list head */ void DetectPortCleanupList (DetectPort *head) { if (head == NULL) return; DetectPort *cur, *next; for (cur = head; cur != NULL; ) { next = cur->next; cur->next = NULL; DetectPortFree(cur); cur = next; } } /** * \brief Do a sorted insert, where the top of the list should be the biggest * port range. * * \todo XXX current sorting only works for overlapping ranges * * \param head Pointer to the DetectPort list head * \param dp Pointer to DetectPort to search in the DetectPort list * \retval 0 if dp is added correctly */ int DetectPortAdd(DetectPort **head, DetectPort *dp) { DetectPort *cur, *prev_cur = NULL; //SCLogDebug("DetectPortAdd: adding "); DetectPortPrint(ag); SCLogDebug(""); if (*head != NULL) { for (cur = *head; cur != NULL; cur = cur->next) { prev_cur = cur; int r = DetectPortCmp(dp,cur); if (r == PORT_EB) { /* insert here */ dp->prev = cur->prev; dp->next = cur; cur->prev = dp; if (*head == cur) { *head = dp; } else { dp->prev->next = dp; } return 0; } } dp->prev = prev_cur; if (prev_cur != NULL) prev_cur->next = dp; } else { *head = dp; } return 0; } /** * \brief Copy and insert the new DetectPort, with a copy list of sigs * * \param de_ctx Pointer to the current detection engine context * \param head Pointer to the DetectPort list head * \param new Pointer to DetectPort to search in the DetectPort list * * \retval 0 if dp is added correctly */ int DetectPortInsertCopy(DetectEngineCtx *de_ctx, DetectPort **head, DetectPort *new) { DetectPort *copy = DetectPortCopySingle(de_ctx,new); if (copy == NULL) return -1; return DetectPortInsert(de_ctx, head, copy); } /** * \brief function for inserting a port group object. This also makes sure * SigGroupContainer lists are handled correctly. * * \param de_ctx Pointer to the current detection engine context * \param head Pointer to the DetectPort list head * \param dp DetectPort to search in the DetectPort list * * \retval 1 inserted * \retval 0 not inserted, memory of new is freed * \retval -1 error * */ int DetectPortInsert(DetectEngineCtx *de_ctx, DetectPort **head, DetectPort *new) { if (new == NULL) return 0; //BUG_ON(new->next != NULL); //BUG_ON(new->prev != NULL); /* see if it already exists or overlaps with existing ag's */ if (*head != NULL) { DetectPort *cur = NULL; int r = 0; for (cur = *head; cur != NULL; cur = cur->next) { r = DetectPortCmp(new,cur); BUG_ON(r == PORT_ER); /* if so, handle that */ if (r == PORT_EQ) { SCLogDebug("PORT_EQ %p %p", cur, new); /* exact overlap/match */ if (cur != new) { SigGroupHeadCopySigs(de_ctx, new->sh, &cur->sh); DetectPortFree(new); return 0; } return 1; } else if (r == PORT_GT) { SCLogDebug("PORT_GT (cur->next %p)", cur->next); /* only add it now if we are bigger than the last * group. Otherwise we'll handle it later. */ if (cur->next == NULL) { SCLogDebug("adding GT"); /* put in the list */ new->prev = cur; cur->next = new; return 1; } } else if (r == PORT_LT) { SCLogDebug("PORT_LT"); /* see if we need to insert the ag anywhere */ /* put in the list */ if (cur->prev != NULL) cur->prev->next = new; new->prev = cur->prev; new->next = cur; cur->prev = new; /* update head if required */ if (*head == cur) { *head = new; } return 1; /* alright, those were the simple cases, * lets handle the more complex ones now */ } else { DetectPort *c = NULL; r = DetectPortCut(de_ctx, cur, new, &c); if (r == -1) goto error; r = DetectPortInsert(de_ctx, head, new); if (r == -1) goto error; if (c != NULL) { SCLogDebug("inserting C (%p)", c); if (SCLogDebugEnabled()) { DetectPortPrint(c); } r = DetectPortInsert(de_ctx, head, c); if (r == -1) goto error; } return 1; } } /* head is NULL, so get a group and set head to it */ } else { SCLogDebug("setting new head %p", new); *head = new; } return 1; error: /* XXX */ return -1; } /** * \brief Function that cuts port groups and merge them * * \param de_ctx Pointer to the current detection engine context * \param a pointer to DetectPort "a" * \param b pointer to DetectPort "b" * \param c pointer to DetectPort "c" * * \retval 0 ok * \retval -1 error * */ static int DetectPortCut(DetectEngineCtx *de_ctx, DetectPort *a, DetectPort *b, DetectPort **c) { uint32_t a_port1 = a->port; uint32_t a_port2 = a->port2; uint32_t b_port1 = b->port; uint32_t b_port2 = b->port2; DetectPort *tmp = NULL; /* default to NULL */ *c = NULL; int r = DetectPortCmp(a,b); BUG_ON(r != PORT_ES && r != PORT_EB && r != PORT_LE && r != PORT_GE); /* get a place to temporary put sigs lists */ tmp = DetectPortInit(); if (tmp == NULL) { goto error; } memset(tmp, 0, sizeof(DetectPort)); /** * We have 3 parts: [aaa[abab]bbb] * part a: a_port1 <-> b_port1 - 1 * part b: b_port1 <-> a_port2 * part c: a_port2 + 1 <-> b_port2 */ if (r == PORT_LE) { SCLogDebug("cut r == PORT_LE"); a->port = a_port1; a->port2 = b_port1 - 1; b->port = b_port1; b->port2 = a_port2; DetectPort *tmp_c; tmp_c = DetectPortInit(); if (tmp_c == NULL) { goto error; } *c = tmp_c; tmp_c->port = a_port2 + 1; tmp_c->port2 = b_port2; SigGroupHeadCopySigs(de_ctx,b->sh,&tmp_c->sh); /* copy old b to c */ SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); /* copy a to b */ /** * We have 3 parts: [bbb[baba]aaa] * part a: b_port1 <-> a_port1 - 1 * part b: a_port1 <-> b_port2 * part c: b_port2 + 1 <-> a_port2 */ } else if (r == PORT_GE) { SCLogDebug("cut r == PORT_GE"); a->port = b_port1; a->port2 = a_port1 - 1; b->port = a_port1; b->port2 = b_port2; DetectPort *tmp_c; tmp_c = DetectPortInit(); if (tmp_c == NULL) { goto error; } *c = tmp_c; tmp_c->port = b_port2 + 1; tmp_c->port2 = a_port2; /** * 'a' gets clean and then 'b' sigs * 'b' gets clean, then 'a' then 'b' sigs * 'c' gets 'a' sigs */ SigGroupHeadCopySigs(de_ctx,a->sh,&tmp->sh); /* store old a list */ SigGroupHeadClearSigs(a->sh); /* clean a list */ SigGroupHeadCopySigs(de_ctx,tmp->sh,&tmp_c->sh); /* copy old b to c */ SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); /* copy old b to a */ SigGroupHeadCopySigs(de_ctx,tmp->sh,&b->sh);/* prepend old a before b */ SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ /** * We have 2 or three parts: * * 2 part: [[abab]bbb] or [bbb[baba]] * part a: a_port1 <-> a_port2 * part b: a_port2 + 1 <-> b_port2 * * part a: b_port1 <-> a_port1 - 1 * part b: a_port1 <-> a_port2 * * 3 part [bbb[aaa]bbb] * becomes[aaa[bbb]ccc] * * part a: b_port1 <-> a_port1 - 1 * part b: a_port1 <-> a_port2 * part c: a_port2 + 1 <-> b_port2 */ } else if (r == PORT_ES) { SCLogDebug("cut r == PORT_ES"); if (a_port1 == b_port1) { SCLogDebug("1"); a->port = a_port1; a->port2 = a_port2; b->port = a_port2 + 1; b->port2 = b_port2; /** 'b' overlaps 'a' so 'a' needs the 'b' sigs */ SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); } else if (a_port2 == b_port2) { SCLogDebug("2"); a->port = b_port1; a->port2 = a_port1 - 1; b->port = a_port1; b->port2 = a_port2; /* [bbb[baba]] will be transformed into * [aaa][bbb] * steps: copy b sigs to tmp * a overlaps b, so copy a to b * clear a * copy tmp to a */ SigGroupHeadCopySigs(de_ctx,b->sh,&tmp->sh); /* store old a list */ SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); SigGroupHeadClearSigs(a->sh); /* clean a list */ SigGroupHeadCopySigs(de_ctx,tmp->sh,&a->sh);/* merge old a with b */ SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ } else { SCLogDebug("3"); a->port = b_port1; a->port2 = a_port1 - 1; b->port = a_port1; b->port2 = a_port2; DetectPort *tmp_c; tmp_c = DetectPortInit(); if (tmp_c == NULL) { goto error; } *c = tmp_c; tmp_c->port = a_port2 + 1; tmp_c->port2 = b_port2; /** * 'a' gets clean and then 'b' sigs * 'b' gets clean, then 'a' then 'b' sigs * 'c' gets 'b' sigs */ SigGroupHeadCopySigs(de_ctx,a->sh,&tmp->sh); /* store old a list */ SigGroupHeadClearSigs(a->sh); /* clean a list */ SigGroupHeadCopySigs(de_ctx,b->sh,&tmp_c->sh); /* copy old b to c */ SigGroupHeadCopySigs(de_ctx,b->sh,&a->sh); /* copy old b to a */ SigGroupHeadCopySigs(de_ctx,tmp->sh,&b->sh);/* merge old a with b */ SigGroupHeadClearSigs(tmp->sh); /* clean tmp list */ } /** * We have 2 or three parts: * * 2 part: [[baba]aaa] or [aaa[abab]] * part a: b_port1 <-> b_port2 * part b: b_port2 + 1 <-> a_port2 * * part a: a_port1 <-> b_port1 - 1 * part b: b_port1 <-> b_port2 * * 3 part [aaa[bbb]aaa] * becomes[aaa[bbb]ccc] * * part a: a_port1 <-> b_port2 - 1 * part b: b_port1 <-> b_port2 * part c: b_port2 + 1 <-> a_port2 */ } else if (r == PORT_EB) { SCLogDebug("cut r == PORT_EB"); if (a_port1 == b_port1) { SCLogDebug("1"); a->port = b_port1; a->port2 = b_port2; b->port = b_port2 + 1; b->port2 = a_port2; /** 'b' overlaps 'a' so 'a' needs the 'b' sigs */ SigGroupHeadCopySigs(de_ctx,b->sh,&tmp->sh); SigGroupHeadClearSigs(b->sh); SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); SigGroupHeadCopySigs(de_ctx,tmp->sh,&a->sh); SigGroupHeadClearSigs(tmp->sh); } else if (a_port2 == b_port2) { SCLogDebug("2"); a->port = a_port1; a->port2 = b_port1 - 1; b->port = b_port1; b->port2 = b_port2; /** 'a' overlaps 'b' so 'b' needs the 'a' sigs */ SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); } else { SCLogDebug("3"); a->port = a_port1; a->port2 = b_port1 - 1; b->port = b_port1; b->port2 = b_port2; DetectPort *tmp_c; tmp_c = DetectPortInit(); if (tmp_c == NULL) { goto error; } *c = tmp_c; tmp_c->port = b_port2 + 1; tmp_c->port2 = a_port2; SigGroupHeadCopySigs(de_ctx,a->sh,&b->sh); SigGroupHeadCopySigs(de_ctx,a->sh,&tmp_c->sh); } } if (tmp != NULL) { DetectPortFree(tmp); } return 0; error: if (tmp != NULL) DetectPortFree(tmp); return -1; } /** * \brief Function that cuts port groups implementing group negation * * \param a pointer to DetectPort "a" * \param b pointer to DetectPort "b" * * \retval 0 ok * \retval -1 error * */ static int DetectPortCutNot(DetectPort *a, DetectPort **b) { uint16_t a_port1 = a->port; uint16_t a_port2 = a->port2; /* default to NULL */ *b = NULL; if (a_port1 != 0x0000 && a_port2 != 0xFFFF) { a->port = 0x0000; a->port2 = a_port1 - 1; DetectPort *tmp_b; tmp_b = DetectPortInit(); if (tmp_b == NULL) { goto error; } tmp_b->port = a_port2 + 1; tmp_b->port2 = 0xFFFF; *b = tmp_b; } else if (a_port1 == 0x0000 && a_port2 != 0xFFFF) { a->port = a_port2 + 1; a->port2 = 0xFFFF; } else if (a_port1 != 0x0000 && a_port2 == 0xFFFF) { a->port = 0x0000; a->port2 = a_port1 - 1; } else { goto error; } return 0; error: return -1; } /** * \brief Function that compare port groups * * \param a pointer to DetectPort "a" * \param b pointer to DetectPort "b" * * \retval PORT_XX (Port enum value, XX is EQ, ES, EB, LE, etc) * \retval PORT_ER on error * */ int DetectPortCmp(DetectPort *a, DetectPort *b) { /* check any */ if ((a->flags & PORT_FLAG_ANY) && (b->flags & PORT_FLAG_ANY)) return PORT_EQ; if ((a->flags & PORT_FLAG_ANY) && !(b->flags & PORT_FLAG_ANY)) return PORT_LT; if (!(a->flags & PORT_FLAG_ANY) && (b->flags & PORT_FLAG_ANY)) return PORT_GT; uint16_t a_port1 = a->port; uint16_t a_port2 = a->port2; uint16_t b_port1 = b->port; uint16_t b_port2 = b->port2; /* PORT_EQ */ if (a_port1 == b_port1 && a_port2 == b_port2) { //SCLogDebug("PORT_EQ"); return PORT_EQ; /* PORT_ES */ } else if (a_port1 >= b_port1 && a_port1 <= b_port2 && a_port2 <= b_port2) { //SCLogDebug("PORT_ES"); return PORT_ES; /* PORT_EB */ } else if (a_port1 <= b_port1 && a_port2 >= b_port2) { //SCLogDebug("PORT_EB"); return PORT_EB; } else if (a_port1 < b_port1 && a_port2 < b_port2 && a_port2 >= b_port1) { //SCLogDebug("PORT_LE"); return PORT_LE; } else if (a_port1 < b_port1 && a_port2 < b_port2) { //SCLogDebug("PORT_LT"); return PORT_LT; } else if (a_port1 > b_port1 && a_port1 <= b_port2 && a_port2 > b_port2) { //SCLogDebug("PORT_GE"); return PORT_GE; } else if (a_port1 > b_port2) { //SCLogDebug("PORT_GT"); return PORT_GT; } else { /* should be unreachable */ BUG_ON(1); } return PORT_ER; } /** * \brief Function that return a copy of DetectPort src * * \param de_ctx Pointer to the current Detection Engine Context * \param src Pointer to a DetectPort group to copy * * \retval Pointer to a DetectPort instance (copy of src) * \retval NULL on error * */ DetectPort *DetectPortCopy(DetectEngineCtx *de_ctx, DetectPort *src) { if (src == NULL) return NULL; DetectPort *dst = DetectPortInit(); if (dst == NULL) { goto error; } dst->port = src->port; dst->port2 = src->port2; if (src->next != NULL) { dst->next = DetectPortCopy(de_ctx, src->next); if (dst->next != NULL) { dst->next->prev = dst; } } return dst; error: return NULL; } /** * \brief Function that return a copy of DetectPort src sigs * * \param de_ctx Pointer to the current Detection Engine Context * \param src Pointer to a DetectPort group to copy * * \retval Pointer to a DetectPort instance (copy of src) * \retval NULL on error * */ DetectPort *DetectPortCopySingle(DetectEngineCtx *de_ctx,DetectPort *src) { if (src == NULL) return NULL; DetectPort *dst = DetectPortInit(); if (dst == NULL) { goto error; } dst->port = src->port; dst->port2 = src->port2; SigGroupHeadCopySigs(de_ctx,src->sh,&dst->sh); return dst; error: return NULL; } /** * \brief Function Match to Match a port against a DetectPort group * * \param dp Pointer to DetectPort group where we try to match the port * \param port To compare/match * * \retval 1 if port is in the range (it match) * \retval 0 if port is not in the range * */ int DetectPortMatch(DetectPort *dp, uint16_t port) { if (port >= dp->port && port <= dp->port2) { return 1; } return 0; } /** * \brief Helper function that print the DetectPort info * \retval none */ void DetectPortPrint(DetectPort *dp) { if (dp == NULL) return; if (dp->flags & PORT_FLAG_ANY) { SCLogDebug("=> port %p: ANY", dp); // printf("ANY"); } else { SCLogDebug("=> port %p %" PRIu32 "-%" PRIu32 "", dp, dp->port, dp->port2); // printf("%" PRIu32 "-%" PRIu32 "", dp->port, dp->port2); } } /** * \brief Function that find the group matching address in a group head * * \param dp Pointer to DetectPort group where we try to find the group * \param port port to search/lookup * * \retval Pointer to the DetectPort group of our port if it matched * \retval NULL if port is not in the list * */ DetectPort * DetectPortLookupGroup(DetectPort *dp, uint16_t port) { DetectPort *p = dp; if (dp == NULL) return NULL; for ( ; p != NULL; p = p->next) { if (DetectPortMatch(p,port) == 1) { //SCLogDebug("match, port %" PRIu32 ", dp ", port); //DetectPortPrint(p); SCLogDebug(""); return p; } } return NULL; } /** * \brief Function to join the source group to the target and its members * * \param de_ctx Pointer to the current Detection Engine Context * \param target Pointer to DetectPort group where the source is joined * \param source Pointer to DetectPort group that will join into the target * * \retval -1 on error * \retval 0 on success * */ int DetectPortJoin(DetectEngineCtx *de_ctx, DetectPort *target, DetectPort *source) { if (target == NULL || source == NULL) return -1; SigGroupHeadCopySigs(de_ctx,source->sh,&target->sh); if (source->port < target->port) target->port = source->port; if (source->port2 > target->port2) target->port2 = source->port2; return 0; } /******************* parsing routines ************************/ /** * \brief Wrapper function that call the internal/real function * to insert the new DetectPort * \param head Pointer to the head of the DetectPort group list * \param new Pointer to the new DetectPort group list * * \retval 1 inserted * \retval 0 not inserted, memory of new is freed * \retval -1 error */ static int DetectPortParseInsert(DetectPort **head, DetectPort *new) { return DetectPortInsert(NULL, head, new); } /** * \brief Function to parse and insert the string in the DetectPort head list * * \param head Pointer to the head of the DetectPort group list * \param s Pointer to the port string * * \retval 0 on success * \retval -1 on error */ static int DetectPortParseInsertString(DetectPort **head, char *s) { DetectPort *ad = NULL, *ad_any = NULL; int r = 0; char port_any = FALSE; SCLogDebug("head %p, *head %p, s %s", head, *head, s); /** parse the address */ ad = PortParse(s); if (ad == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT," failed to parse port \"%s\"",s); return -1; } if (ad->flags & PORT_FLAG_ANY) { port_any = TRUE; } /** handle the not case, we apply the negation then insert the part(s) */ if (ad->flags & PORT_FLAG_NOT) { DetectPort *ad2 = NULL; if (DetectPortCutNot(ad, &ad2) < 0) { goto error; } /** normally a 'not' will result in two ad's unless the 'not' is on the * start or end of the address space(e.g. 0.0.0.0 or 255.255.255.255) */ if (ad2 != NULL) { if (DetectPortParseInsert(head, ad2) < 0) { if (ad2 != NULL) SCFree(ad2); goto error; } } } r = DetectPortParseInsert(head, ad); if (r < 0) goto error; /** if any, insert 0.0.0.0/0 and ::/0 as well */ if (r == 1 && port_any == TRUE) { SCLogDebug("inserting 0:65535 as port is \"any\""); ad_any = PortParse("0:65535"); if (ad_any == NULL) goto error; if (DetectPortParseInsert(head, ad_any) < 0) goto error; } return 0; error: SCLogError(SC_ERR_PORT_PARSE_INSERT_STRING,"DetectPortParseInsertString error"); if (ad != NULL) DetectPortCleanupList(ad); if (ad_any != NULL) DetectPortCleanupList(ad_any); return -1; } /** * \brief Parses a port string and updates the 2 port heads with the * port groups. * * \todo We don't seem to be handling negated cases, like [port,![!port,port]], * since we pass around negate without keeping a count of ! with depth. * Can solve this by keeping a count of the negations with depth, so that * an even no of negations would count as no negation and an odd no of * negations would count as a negation. * * \param gh Pointer to the port group head that should hold port ranges * that are not negated. * \param ghn Pointer to the port group head that should hold port ranges * that are negated. * \param s Pointer to the character string holding the port to be * parsed. * \param negate Flag that indicates if the received address string is negated * or not. 0 if it is not, 1 it it is. * * \retval 0 On successfully parsing. * \retval -1 On failure. */ static int DetectPortParseDo(const DetectEngineCtx *de_ctx, DetectPort **head, DetectPort **nhead, char *s, int negate, ResolvedVariablesList *var_list) { size_t u = 0; size_t x = 0; int o_set = 0, n_set = 0, d_set = 0; int range = 0; int depth = 0; size_t size = strlen(s); char address[1024] = ""; char *rule_var_port = NULL; int r = 0; SCLogDebug("head %p, *head %p, negate %d", head, *head, negate); for (u = 0, x = 0; u < size && x < sizeof(address); u++) { address[x] = s[u]; x++; if (s[u] == ':') range = 1; if (range == 1 && s[u] == '!') { SCLogError(SC_ERR_NEGATED_VALUE_IN_PORT_RANGE,"Can't have a negated value in a range."); return -1; } else if (!o_set && s[u] == '!') { SCLogDebug("negation encountered"); n_set = 1; x--; } else if (s[u] == '[') { if (!o_set) { o_set = 1; x = 0; } depth++; } else if (s[u] == ']') { if (depth == 1) { address[x - 1] = '\0'; SCLogDebug("Parsed port from DetectPortParseDo - %s", address); x = 0; r = DetectPortParseDo(de_ctx, head, nhead, address, negate? negate: n_set, var_list); if (r == -1) goto error; n_set = 0; } depth--; range = 0; } else if (depth == 0 && s[u] == ',') { if (o_set == 1) { o_set = 0; } else if (d_set == 1) { char *temp_rule_var_port = NULL, *alloc_rule_var_port = NULL; address[x - 1] = '\0'; rule_var_port = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_PORT_GROUPS); if (rule_var_port == NULL) goto error; if (strlen(rule_var_port) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved " "to nothing. This is likely a misconfiguration. " "Note that a negated port needs to be quoted, " "\"!$HTTP_PORTS\" instead of !$HTTP_PORTS. See issue #295.", s); goto error; } temp_rule_var_port = rule_var_port; if (negate == 1 || n_set == 1) { alloc_rule_var_port = SCMalloc(strlen(rule_var_port) + 3); if (unlikely(alloc_rule_var_port == NULL)) goto error; snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3, "[%s]", rule_var_port); temp_rule_var_port = alloc_rule_var_port; } r = DetectPortParseDo(de_ctx, head, nhead, temp_rule_var_port, (negate + n_set) % 2, var_list);//negate? negate: n_set); if (r == -1) goto error; d_set = 0; n_set = 0; if (alloc_rule_var_port != NULL) SCFree(alloc_rule_var_port); } else { address[x - 1] = '\0'; SCLogDebug("Parsed port from DetectPortParseDo - %s", address); if (negate == 0 && n_set == 0) { r = DetectPortParseInsertString(head, address); } else { r = DetectPortParseInsertString(nhead, address); } if (r == -1) goto error; n_set = 0; } x = 0; range = 0; } else if (depth == 0 && s[u] == '$') { d_set = 1; } else if (depth == 0 && u == size-1) { range = 0; if (x == 1024) { address[x - 1] = '\0'; } else { address[x] = '\0'; } SCLogDebug("%s", address); if (AddVariableToResolveList(var_list, address) == -1) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Found a loop in a port " "groups declaration. This is likely a misconfiguration."); goto error; } x = 0; if (d_set == 1) { char *temp_rule_var_port = NULL, *alloc_rule_var_port = NULL; rule_var_port = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_PORT_GROUPS); if (rule_var_port == NULL) goto error; if (strlen(rule_var_port) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved " "to nothing. This is likely a misconfiguration. " "Note that a negated port needs to be quoted, " "\"!$HTTP_PORTS\" instead of !$HTTP_PORTS. See issue #295.", s); goto error; } temp_rule_var_port = rule_var_port; if ((negate + n_set) % 2) { alloc_rule_var_port = SCMalloc(strlen(rule_var_port) + 3); if (unlikely(alloc_rule_var_port == NULL)) goto error; snprintf(alloc_rule_var_port, strlen(rule_var_port) + 3, "[%s]", rule_var_port); temp_rule_var_port = alloc_rule_var_port; } r = DetectPortParseDo(de_ctx, head, nhead, temp_rule_var_port, (negate + n_set) % 2, var_list); if (r == -1) goto error; d_set = 0; if (alloc_rule_var_port != NULL) SCFree(alloc_rule_var_port); } else { if (!((negate + n_set) % 2)) { r = DetectPortParseInsertString(head,address); } else { r = DetectPortParseInsertString(nhead,address); } if (r == -1) goto error; } n_set = 0; } else if (depth == 1 && s[u] == ',') { range = 0; } } if (depth > 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not every port block was " "properly closed in \"%s\", %d missing closing brackets (]). " "Note: problem might be in a variable.", s, depth); goto error; } else if (depth < 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not every port block was " "properly opened in \"%s\", %d missing opening brackets ([). " "Note: problem might be in a variable.", s, depth*-1); goto error; } return 0; error: return -1; } /** * \brief Check if the port group list covers the complete port space. * \retval 0 no * \retval 1 yes */ int DetectPortIsCompletePortSpace(DetectPort *p) { uint16_t next_port = 0; if (p == NULL) return 0; if (p->port != 0x0000) return 0; /* if we're ending with 0xFFFF while we know we started with 0x0000 it's the complete space */ if (p->port2 == 0xFFFF) return 1; next_port = p->port2 + 1; p = p->next; for ( ; p != NULL; p = p->next) { if (p->port != next_port) return 0; if (p->port2 == 0xFFFF) return 1; next_port = p->port2 + 1; } return 0; } /** * \brief Helper function for the parsing process * * \param head Pointer to the head of the DetectPort group list * \param nhead Pointer to the new head of the DetectPort group list * * \retval 0 on success * \retval -1 on error */ int DetectPortParseMergeNotPorts(DetectPort **head, DetectPort **nhead) { DetectPort *ad = NULL; DetectPort *ag, *ag2; int r = 0; /** check if the full port space is negated */ if (DetectPortIsCompletePortSpace(*nhead) == 1) { SCLogError(SC_ERR_COMPLETE_PORT_SPACE_NEGATED,"Complete port space is negated"); goto error; } /** * step 0: if the head list is empty, but the nhead list isn't * we have a pure not thingy. In that case we add a 0:65535 * first. */ if (*head == NULL && *nhead != NULL) { SCLogDebug("inserting 0:65535 into head"); r = DetectPortParseInsertString(head,"0:65535"); if (r < 0) { goto error; } } /** step 1: insert our ghn members into the gh list */ for (ag = *nhead; ag != NULL; ag = ag->next) { /** work with a copy of the ad so we can easily clean up * the ghn group later. */ ad = DetectPortCopySingle(NULL, ag); if (ad == NULL) { goto error; } r = DetectPortParseInsert(head, ad); if (r < 0) { goto error; } ad = NULL; } /** step 2: pull the address blocks that match our 'not' blocks */ for (ag = *nhead; ag != NULL; ag = ag->next) { SCLogDebug("ag %p", ag); DetectPortPrint(ag); for (ag2 = *head; ag2 != NULL; ) { SCLogDebug("ag2 %p", ag2); DetectPortPrint(ag2); r = DetectPortCmp(ag, ag2); if (r == PORT_EQ || r == PORT_EB) { /* XXX more ??? */ if (ag2->prev == NULL) { *head = ag2->next; } else { ag2->prev->next = ag2->next; } if (ag2->next != NULL) { ag2->next->prev = ag2->prev; } /** store the next ptr and remove the group */ DetectPort *next_ag2 = ag2->next; DetectPortFree(ag2); ag2 = next_ag2; } else { ag2 = ag2->next; } } } for (ag2 = *head; ag2 != NULL; ag2 = ag2->next) { SCLogDebug("ag2 %p", ag2); DetectPortPrint(ag2); } if (*head == NULL) { SCLogError(SC_ERR_NO_PORTS_LEFT_AFTER_MERGE,"no ports left after merging ports with negated ports"); goto error; } return 0; error: if (ad != NULL) DetectPortFree(ad); return -1; } int DetectPortTestConfVars(void) { SCLogDebug("Testing port conf vars for any misconfigured values"); ResolvedVariablesList var_list = TAILQ_HEAD_INITIALIZER(var_list); ConfNode *port_vars_node = ConfGetNode("vars.port-groups"); if (port_vars_node == NULL) { return 0; } ConfNode *seq_node; TAILQ_FOREACH(seq_node, &port_vars_node->head, next) { SCLogDebug("Testing %s - %s\n", seq_node->name, seq_node->val); DetectPort *gh = DetectPortInit(); if (gh == NULL) { goto error; } DetectPort *ghn = NULL; if (seq_node->val == NULL) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Port var \"%s\" probably has a sequence(something " "in brackets) value set without any quotes. Please " "quote it using \"..\".", seq_node->name); DetectPortCleanupList(gh); goto error; } int r = DetectPortParseDo(NULL, &gh, &ghn, seq_node->val, /* start with negate no */0, &var_list); CleanVariableResolveList(&var_list); if (r < 0) { DetectPortCleanupList(gh); SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "failed to parse port var \"%s\" with value \"%s\". " "Please check it's syntax", seq_node->name, seq_node->val); goto error; } if (DetectPortIsCompletePortSpace(ghn)) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Port var - \"%s\" has the complete Port range negated " "with it's value \"%s\". Port space range is NIL. " "Probably have a !any or a port range that supplies " "a NULL address range", seq_node->name, seq_node->val); DetectPortCleanupList(gh); DetectPortCleanupList(ghn); goto error; } if (gh != NULL) DetectPortCleanupList(gh); if (ghn != NULL) DetectPortCleanupList(ghn); } return 0; error: return -1; } /** * \brief Function for parsing port strings * * \param head Pointer to the head of the DetectPort group list * \param str Pointer to the port string * * \retval 0 on success * \retval -1 on error */ int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, char *str) { int r; SCLogDebug("Port string to be parsed - str %s", str); /* negate port list */ DetectPort *nhead = NULL; r = DetectPortParseDo(de_ctx, head, &nhead, str,/* start with negate no */0, NULL); if (r < 0) goto error; SCLogDebug("head %p %p, nhead %p", head, *head, nhead); /* merge the 'not' address groups */ if (DetectPortParseMergeNotPorts(head, &nhead) < 0) goto error; /* free the temp negate head */ DetectPortCleanupList(nhead); return 0; error: DetectPortCleanupList(nhead); return -1; } /** * \brief Helper function for parsing port strings * * \param str Pointer to the port string * * \retval DetectPort pointer of the parse string on success * \retval NULL on error */ DetectPort *PortParse(char *str) { char *port2 = NULL; DetectPort *dp = NULL; char portstr[16]; strlcpy(portstr, str, sizeof(portstr)); dp = DetectPortInit(); if (dp == NULL) goto error; /* XXX better input validation */ /* we dup so we can put a nul-termination in it later */ char *port = portstr; /* handle the negation case */ if (port[0] == '!') { dp->flags |= PORT_FLAG_NOT; port++; } /* see if the address is an ipv4 or ipv6 address */ if ((port2 = strchr(port, ':')) != NULL) { /* 80:81 range format */ port2[0] = '\0'; port2++; if(DetectPortIsValidRange(port)) dp->port = atoi(port); else goto error; if (strcmp(port2, "") != 0) { if (DetectPortIsValidRange(port2)) dp->port2 = atoi(port2); else goto error; } else { dp->port2 = 65535; } /* a > b is illegal, a == b is ok */ if (dp->port > dp->port2) goto error; } else { if (strcasecmp(port,"any") == 0) { dp->port = 0; dp->port2 = 65535; } else if(DetectPortIsValidRange(port)){ dp->port = dp->port2 = atoi(port); } else { goto error; } } return dp; error: if (dp != NULL) DetectPortCleanupList(dp); return NULL; } /** * \brief Helper function to check if a parsed port is in the valid range * of available ports * * \param str Pointer to the port string * * \retval 1 if port is in the valid range * \retval 0 if invalid */ int DetectPortIsValidRange(char *port) { if(atoi(port) >= 0 && atoi(port) <= 65535) return 1; else return 0; } /********************** End parsing routines ********************/ /* hash table */ /** * \brief The hash function to be the used by the hash table - * DetectEngineCtx->dport_hash_table. * * \param ht Pointer to the hash table. * \param data Pointer to the DetectPort. * \param datalen Not used in our case. * * \retval hash The generated hash value. */ static uint32_t DetectPortHashFunc(HashListTable *ht, void *data, uint16_t datalen) { DetectPort *p = (DetectPort *)data; uint32_t hash = 0; SCLogDebug("hashing sgh %p", p); hash = ((uint32_t)p->port << 16) | p->port2; hash %= ht->array_size; SCLogDebug("hash %"PRIu32, hash); return hash; } /** * \brief The Compare function to be used by the DetectPort hash table - * DetectEngineCtx->dport_hash_table. * * \param data1 Pointer to the first DetectPort. * \param len1 Not used. * \param data2 Pointer to the second DetectPort. * \param len2 Not used. * * \retval 1 If the 2 DetectPort sent as args match. * \retval 0 If the 2 DetectPort sent as args do not match. */ static char DetectPortCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { DetectPort *dp1 = (DetectPort *)data1; DetectPort *dp2 = (DetectPort *)data2; if (data1 == NULL || data2 == NULL) return 0; if (dp1->port == dp2->port && dp1->port2 == dp2->port2) return 1; return 0; } static void DetectPortHashFreeFunc(void *ptr) { DetectPort *p = ptr; DetectPortFree(p); } /** * \brief Initializes the hash table in the detection engine context to hold the * DetectPort hash. * * \param de_ctx Pointer to the detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int DetectPortHashInit(DetectEngineCtx *de_ctx) { de_ctx->dport_hash_table = HashListTableInit(4096, DetectPortHashFunc, DetectPortCompareFunc, DetectPortHashFreeFunc); if (de_ctx->dport_hash_table == NULL) goto error; return 0; error: return -1; } /** * \brief Adds a DetectPort to the detection engine context DetectPort * hash table. * * \param de_ctx Pointer to the detection engine context. * \param dp Pointer to the DetectPort. * * \retval ret 0 on Successfully adding the DetectPort; -1 on failure. */ int DetectPortHashAdd(DetectEngineCtx *de_ctx, DetectPort *dp) { int ret = HashListTableAdd(de_ctx->dport_hash_table, (void *)dp, 0); return ret; } /** * \brief Used to lookup a DetectPort hash from the detection engine context * DetectPort hash table. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the DetectPort. * * \retval rsgh On success a pointer to the DetectPort if the DetectPort is * found in the hash table; NULL on failure. */ DetectPort *DetectPortHashLookup(DetectEngineCtx *de_ctx, DetectPort *dp) { SCEnter(); DetectPort *rdp = HashListTableLookup(de_ctx->dport_hash_table, (void *)dp, 0); SCReturnPtr(rdp, "DetectPort"); } /** * \brief Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by * DetectPortInit() function. * * \param de_ctx Pointer to the detection engine context. */ void DetectPortHashFree(DetectEngineCtx *de_ctx) { if (de_ctx->sgh_hash_table == NULL) return; HashListTableFree(de_ctx->dport_hash_table); de_ctx->dport_hash_table = NULL; return; } /*---------------------- Unittests -------------------------*/ #ifdef UNITTESTS /** * \test Check if a DetectPort is properly allocated */ int PortTestParse01 (void) { DetectPort *dd = NULL; int r = DetectPortParse(NULL,&dd,"80"); if (r == 0) { DetectPortFree(dd); return 1; } return 0; } /** * \test Check if two ports are properly allocated in the DetectPort group */ int PortTestParse02 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"80"); if (r == 0) { r = DetectPortParse(NULL,&dd,"22"); if (r == 0) { result = 1; } DetectPortCleanupList(dd); return result; } return result; } /** * \test Check if two port ranges are properly allocated in the DetectPort group */ int PortTestParse03 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"80:88"); if (r == 0) { r = DetectPortParse(NULL,&dd,"85:100"); if (r == 0) { result = 1; } DetectPortCleanupList(dd); return result; } return result; } /** * \test Check if a negated port range is properly allocated in the DetectPort */ int PortTestParse04 (void) { DetectPort *dd = NULL; int r = DetectPortParse(NULL,&dd,"!80:81"); if (r == 0) { DetectPortCleanupList(dd); return 1; } return 0; } /** * \test Check if a negated port range is properly fragmented in the allowed * real groups, ex !80:81 should allow 0:79 and 82:65535 */ int PortTestParse05 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"!80:81"); if (r != 0) goto end; if (dd->next == NULL) goto end; if (dd->port != 0 || dd->port2 != 79) goto end; if (dd->next->port != 82 || dd->next->port2 != 65535) goto end; DetectPortCleanupList(dd); result = 1; end: return result; } /** * \test Check if we copy a DetectPort correctly */ int PortTestParse06 (void) { DetectPort *dd = NULL, *copy = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"22"); if (r != 0) goto end; r = DetectPortParse(NULL,&dd,"80"); if (r != 0) goto end; r = DetectPortParse(NULL,&dd,"143"); if (r != 0) goto end; copy = DetectPortCopy(NULL,dd); if (copy == NULL) goto end; if (DetectPortCmp(dd,copy) != PORT_EQ) goto end; if (copy->next == NULL) goto end; if (DetectPortCmp(dd->next,copy->next) != PORT_EQ) goto end; if (copy->next->next == NULL) goto end; if (DetectPortCmp(dd->next->next,copy->next->next) != PORT_EQ) goto end; if (copy->port != 22 || copy->next->port != 80 || copy->next->next->port != 143) goto end; result = 1; end: if (copy != NULL) DetectPortCleanupList(copy); if (dd != NULL) DetectPortCleanupList(dd); return result; } /** * \test Check if a negated port range is properly fragmented in the allowed * real groups */ int PortTestParse07 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"!21:902"); if (r != 0) goto end; if (dd->next == NULL) goto end; if (dd->port != 0 || dd->port2 != 20) goto end; if (dd->next->port != 903 || dd->next->port2 != 65535) goto end; DetectPortCleanupList(dd); result = 1; end: return result; } /** * \test Check if we dont allow invalid port range specification */ int PortTestParse08 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"[80:!80]"); if (r == 0) goto end; DetectPortCleanupList(dd); result = 1; end: return result; } /** * \test Check if we autocomplete correctly an open range */ int PortTestParse09 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"1024:"); if (r != 0) goto end; if (dd == NULL) goto end; if (dd->port != 1024 || dd->port2 != 0xffff) goto end; DetectPortCleanupList(dd); result = 1; end: return result; } /** * \test Test we don't allow a port that is too big */ int PortTestParse10 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"77777777777777777777777777777777777777777777"); if (r != 0) { result = 1 ; goto end; } DetectPortFree(dd); end: return result; } /** * \test Test second port of range being too big */ int PortTestParse11 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"1024:65536"); if (r != 0) { result = 1 ; goto end; } DetectPortFree(dd); end: return result; } /** * \test Test second port of range being just right */ int PortTestParse12 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"1024:65535"); if (r != 0) { goto end; } DetectPortFree(dd); result = 1 ; end: return result; } /** * \test Test first port of range being too big */ int PortTestParse13 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"65536:65535"); if (r != 0) { result = 1 ; goto end; } DetectPortFree(dd); end: return result; } /** * \test Test merging port groups */ int PortTestParse14 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParseInsertString(&dd, "0:100"); if (r != 0) goto end; r = DetectPortParseInsertString(&dd, "1000:65535"); if (r != 0 || dd->next == NULL) goto end; result = 1; result &= (dd->port == 0) ? 1 : 0; result &= (dd->port2 == 100) ? 1 : 0; result &= (dd->next->port == 1000) ? 1 : 0; result &= (dd->next->port2 == 65535) ? 1 : 0; DetectPortFree(dd); end: return result; } /** * \test Test merging negated port groups */ int PortTestParse15 (void) { DetectPort *dd = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"![0:100,1000:3000]"); if (r != 0 || dd->next == NULL) goto end; result = 1; result &= (dd->port == 101) ? 1 : 0; result &= (dd->port2 == 999) ? 1 : 0; result &= (dd->next->port == 3001) ? 1 : 0; result &= (dd->next->port2 == 65535) ? 1 : 0; DetectPortFree(dd); end: return result; } /** * \test Test parse, copy and cmp functions */ int PortTestParse16 (void) { DetectPort *dd = NULL, *copy = NULL; int result = 0; int r = DetectPortParse(NULL,&dd,"22"); if (r != 0) goto end; r = DetectPortParse(NULL,&dd,"80"); if (r != 0) goto end; r = DetectPortParse(NULL,&dd,"143"); if (r != 0) goto end; copy = DetectPortCopy(NULL,dd); if (copy == NULL) goto end; if (DetectPortCmp(dd,copy) != PORT_EQ) goto end; if (copy->next == NULL) goto end; if (DetectPortCmp(dd->next,copy->next) != PORT_EQ) goto end; if (copy->next->next == NULL) goto end; if (DetectPortCmp(dd->next->next,copy->next->next) != PORT_EQ) goto end; if (copy->port != 22 || copy->next->port != 80 || copy->next->next->port != 143) goto end; if (copy->next->prev != copy) goto end; result = 1; end: if (copy != NULL) DetectPortCleanupList(copy); if (dd != NULL) DetectPortCleanupList(dd); return result; } /** * \test Test general functions */ int PortTestFunctions01(void) { DetectPort *head = NULL; DetectPort *dp1= NULL; int result = 0; /* Parse */ int r = DetectPortParse(NULL,&head,"![0:100,1000:65535]"); if (r != 0 || head->next != NULL) goto end; /* We should have only one DetectPort */ if (!(head->port == 101)) goto end; if (!(head->port2 == 999)) goto end; if (!(head->next == NULL)) goto end; r = DetectPortParse(NULL, &dp1,"2000:3000"); if (r != 0 || dp1->next != NULL) goto end; if (!(dp1->port == 2000)) goto end; if (!(dp1->port2 == 3000)) goto end; /* Add */ r = DetectPortAdd(&head, dp1); if (r != 0 || head->next == NULL) goto end; if (!(head->port == 101)) goto end; if (!(head->port2 == 999)) goto end; if (!(head->next->port == 2000)) goto end; if (!(head->next->port2 == 3000)) goto end; /* Match */ if (!DetectPortMatch(head, 150)) goto end; if (DetectPortMatch(head->next, 1500)) goto end; if ((DetectPortMatch(head, 3500))) goto end; if ((DetectPortMatch(head, 50))) goto end; result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (head != NULL) DetectPortFree(head); return result; } /** * \test Test general functions */ int PortTestFunctions02(void) { DetectPort *head = NULL; DetectPort *dp1= NULL; DetectPort *dp2= NULL; int result = 0; /* Parse */ int r = DetectPortParse(NULL,&head, "![0:100,1000:65535]"); if (r != 0 || head->next != NULL) goto end; r = DetectPortParse(NULL, &dp1, "!200:300"); if (r != 0 || dp1->next == NULL) goto end; /* Merge Nots */ r = DetectPortParseMergeNotPorts(&head, &dp1); if (r != 0 || head->next != NULL) goto end; r = DetectPortParse(NULL, &dp2, "!100:500"); if (r != 0 || dp2->next == NULL) goto end; /* Merge Nots */ r = DetectPortParseMergeNotPorts(&head, &dp2); if (r != 0 || head->next != NULL) goto end; if (!(head->port == 200)) goto end; if (!(head->port2 == 300)) goto end; result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (dp2 != NULL) DetectPortFree(dp2); if (head != NULL) DetectPortFree(head); return result; } /** * \test Test general functions */ int PortTestFunctions03(void) { DetectPort *dp1= NULL; DetectPort *dp2= NULL; DetectPort *dp3= NULL; int result = 0; int r = DetectPortParse(NULL, &dp1, "200:300"); if (r != 0) goto end; r = DetectPortParse(NULL, &dp2, "250:300"); if (r != 0) goto end; /* Cut */ DetectPortCut(NULL, dp1, dp2, &dp3); if (r != 0) goto end; if (!(dp1->port == 200)) goto end; if (!(dp1->port2 == 249)) goto end; if (!(dp2->port == 250)) goto end; if (!(dp2->port2 == 300)) goto end; dp1->port = 0; dp1->port2 = 500; dp2->port = 250; dp2->port2 = 750; /* Cut */ DetectPortCut(NULL, dp1, dp2, &dp3); if (r != 0) goto end; if (!(dp1->port == 0)) goto end; if (!(dp1->port2 == 249)) goto end; if (!(dp2->port == 250)) goto end; if (!(dp2->port2 == 500)) goto end; if (!(dp3->port == 501)) goto end; if (!(dp3->port2 == 750)) goto end; result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (dp2 != NULL) DetectPortFree(dp2); if (dp3 != NULL) DetectPortFree(dp3); return result; } /** * \test Test general functions */ int PortTestFunctions04(void) { DetectPort *dp1= NULL; DetectPort *dp2= NULL; int result = 0; int r = DetectPortParse(NULL, &dp1, "200:300"); if (r != 0) goto end; dp2 = DetectPortInit(); /* Cut Not */ DetectPortCutNot(dp1, &dp2); if (r != 0) goto end; if (!(dp1->port == 0)) goto end; if (!(dp1->port2 == 199)) goto end; if (!(dp2->port == 301)) goto end; if (!(dp2->port2 == 65535)) goto end; result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (dp2 != NULL) DetectPortFree(dp2); return result; } /** * \test Test general functions */ static int PortTestFunctions05(void) { DetectPort *dp1 = NULL; DetectPort *dp2 = NULL; DetectPort *dp3 = NULL; int result = 0; int r = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature s[2]; memset(s,0x00,sizeof(s)); s[0].num = 0; s[1].num = 1; r = DetectPortParse(NULL, &dp1, "1024:65535"); if (r != 0) { printf("r != 0 but %d: ", r); goto end; } SigGroupHeadAppendSig(de_ctx, &dp1->sh, &s[0]); r = DetectPortParse(NULL, &dp2, "any"); if (r != 0) { printf("r != 0 but %d: ", r); goto end; } SigGroupHeadAppendSig(de_ctx, &dp2->sh, &s[1]); SCLogDebug("dp1"); DetectPortPrint(dp1); SCLogDebug("dp2"); DetectPortPrint(dp2); DetectPortInsert(de_ctx, &dp3, dp1); DetectPortInsert(de_ctx, &dp3, dp2); if (dp3 == NULL) goto end; SCLogDebug("dp3"); DetectPort *x = dp3; for ( ; x != NULL; x = x->next) { DetectPortPrint(x); //SigGroupHeadPrintSigs(de_ctx, x->sh); } DetectPort *one = dp3; DetectPort *two = dp3->next; int sig = 0; if ((one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'one', but it shouldn't: ", sig); goto end; } sig = 1; if (!(one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'one', but it shouldn't: ", sig); goto end; } sig = 1; if (!(two->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'two', but it shouldn't: ", sig); goto end; } result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (dp2 != NULL) DetectPortFree(dp2); return result; } /** * \test Test general functions */ static int PortTestFunctions06(void) { DetectPort *dp1 = NULL; DetectPort *dp2 = NULL; DetectPort *dp3 = NULL; int result = 0; int r = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature s[2]; memset(s,0x00,sizeof(s)); s[0].num = 0; s[1].num = 1; r = DetectPortParse(NULL, &dp1, "1024:65535"); if (r != 0) { printf("r != 0 but %d: ", r); goto end; } SigGroupHeadAppendSig(de_ctx, &dp1->sh, &s[0]); r = DetectPortParse(NULL, &dp2, "any"); if (r != 0) { printf("r != 0 but %d: ", r); goto end; } SigGroupHeadAppendSig(de_ctx, &dp2->sh, &s[1]); SCLogDebug("dp1"); DetectPortPrint(dp1); SCLogDebug("dp2"); DetectPortPrint(dp2); DetectPortInsert(de_ctx, &dp3, dp2); DetectPortInsert(de_ctx, &dp3, dp1); if (dp3 == NULL) goto end; SCLogDebug("dp3"); DetectPort *x = dp3; for ( ; x != NULL; x = x->next) { DetectPortPrint(x); //SigGroupHeadPrintSigs(de_ctx, x->sh); } DetectPort *one = dp3; DetectPort *two = dp3->next; int sig = 0; if ((one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'one', but it shouldn't: ", sig); goto end; } sig = 1; if (!(one->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'one', but it shouldn't: ", sig); goto end; } sig = 1; if (!(two->sh->init->sig_array[sig / 8] & (1 << (sig % 8)))) { printf("sig %d part of 'two', but it shouldn't: ", sig); goto end; } result = 1; end: if (dp1 != NULL) DetectPortFree(dp1); if (dp2 != NULL) DetectPortFree(dp2); return result; } /** * \test Test general functions */ static int PortTestFunctions07(void) { DetectPort *dd = NULL; // This one should fail due to negation in a range FAIL_IF(DetectPortParse(NULL, &dd, "[80:!99]") == 0); // Correct: from 80 till 100 but 99 excluded FAIL_IF_NOT(DetectPortParse(NULL, &dd, "[80:100,!99]") == 0); FAIL_IF_NULL(dd->next); FAIL_IF_NOT(dd->port == 80); FAIL_IF_NOT(dd->port2 == 98); FAIL_IF_NOT(dd->next->port == 100); // Also good: from 1 till 80 except of 2 and 4 FAIL_IF_NOT(DetectPortParse(NULL, &dd, "[1:80,![2,4]]") == 0); FAIL_IF_NOT(dd->port == 1); FAIL_IF_NULL(DetectPortLookupGroup(dd, 3)); FAIL_IF_NOT_NULL(DetectPortLookupGroup(dd, 2)); FAIL_IF_NULL(DetectPortLookupGroup(dd, 80)); DetectPortCleanupList(dd); PASS; } /** * \test Test packet Matches * \param raw_eth_pkt pointer to the ethernet packet * \param pktsize size of the packet * \param sig pointer to the signature to test * \param sid sid number of the signature * \retval return 1 if match * \retval return 0 if not */ int PortTestMatchReal(uint8_t *raw_eth_pkt, uint16_t pktsize, char *sig, uint32_t sid) { int result = 0; FlowInitConfig(FLOW_QUIET); Packet *p = UTHBuildPacketFromEth(raw_eth_pkt, pktsize); result = UTHPacketMatchSig(p, sig); PACKET_RECYCLE(p); FlowShutdown(); return result; } /** * \brief Wrapper for PortTestMatchReal */ int PortTestMatchRealWrp(char *sig, uint32_t sid) { /* Real HTTP packeth doing a GET method * tcp.sport=47370 tcp.dport=80 * ip.src=192.168.28.131 ip.dst=192.168.1.1 */ uint8_t raw_eth_pkt[] = { 0x00,0x50,0x56,0xea,0x00,0xbd,0x00,0x0c, 0x29,0x40,0xc8,0xb5,0x08,0x00,0x45,0x00, 0x01,0xa8,0xb9,0xbb,0x40,0x00,0x40,0x06, 0xe0,0xbf,0xc0,0xa8,0x1c,0x83,0xc0,0xa8, 0x01,0x01,0xb9,0x0a,0x00,0x50,0x6f,0xa2, 0x92,0xed,0x7b,0xc1,0xd3,0x4d,0x50,0x18, 0x16,0xd0,0xa0,0x6f,0x00,0x00,0x47,0x45, 0x54,0x20,0x2f,0x20,0x48,0x54,0x54,0x50, 0x2f,0x31,0x2e,0x31,0x0d,0x0a,0x48,0x6f, 0x73,0x74,0x3a,0x20,0x31,0x39,0x32,0x2e, 0x31,0x36,0x38,0x2e,0x31,0x2e,0x31,0x0d, 0x0a,0x55,0x73,0x65,0x72,0x2d,0x41,0x67, 0x65,0x6e,0x74,0x3a,0x20,0x4d,0x6f,0x7a, 0x69,0x6c,0x6c,0x61,0x2f,0x35,0x2e,0x30, 0x20,0x28,0x58,0x31,0x31,0x3b,0x20,0x55, 0x3b,0x20,0x4c,0x69,0x6e,0x75,0x78,0x20, 0x78,0x38,0x36,0x5f,0x36,0x34,0x3b,0x20, 0x65,0x6e,0x2d,0x55,0x53,0x3b,0x20,0x72, 0x76,0x3a,0x31,0x2e,0x39,0x2e,0x30,0x2e, 0x31,0x34,0x29,0x20,0x47,0x65,0x63,0x6b, 0x6f,0x2f,0x32,0x30,0x30,0x39,0x30,0x39, 0x30,0x32,0x31,0x37,0x20,0x55,0x62,0x75, 0x6e,0x74,0x75,0x2f,0x39,0x2e,0x30,0x34, 0x20,0x28,0x6a,0x61,0x75,0x6e,0x74,0x79, 0x29,0x20,0x46,0x69,0x72,0x65,0x66,0x6f, 0x78,0x2f,0x33,0x2e,0x30,0x2e,0x31,0x34, 0x0d,0x0a,0x41,0x63,0x63,0x65,0x70,0x74, 0x3a,0x20,0x74,0x65,0x78,0x74,0x2f,0x68, 0x74,0x6d,0x6c,0x2c,0x61,0x70,0x70,0x6c, 0x69,0x63,0x61,0x74,0x69,0x6f,0x6e,0x2f, 0x78,0x68,0x74,0x6d,0x6c,0x2b,0x78,0x6d, 0x6c,0x2c,0x61,0x70,0x70,0x6c,0x69,0x63, 0x61,0x74,0x69,0x6f,0x6e,0x2f,0x78,0x6d, 0x6c,0x3b,0x71,0x3d,0x30,0x2e,0x39,0x2c, 0x2a,0x2f,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x38,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x4c,0x61,0x6e,0x67,0x75,0x61, 0x67,0x65,0x3a,0x20,0x65,0x6e,0x2d,0x75, 0x73,0x2c,0x65,0x6e,0x3b,0x71,0x3d,0x30, 0x2e,0x35,0x0d,0x0a,0x41,0x63,0x63,0x65, 0x70,0x74,0x2d,0x45,0x6e,0x63,0x6f,0x64, 0x69,0x6e,0x67,0x3a,0x20,0x67,0x7a,0x69, 0x70,0x2c,0x64,0x65,0x66,0x6c,0x61,0x74, 0x65,0x0d,0x0a,0x41,0x63,0x63,0x65,0x70, 0x74,0x2d,0x43,0x68,0x61,0x72,0x73,0x65, 0x74,0x3a,0x20,0x49,0x53,0x4f,0x2d,0x38, 0x38,0x35,0x39,0x2d,0x31,0x2c,0x75,0x74, 0x66,0x2d,0x38,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x2c,0x2a,0x3b,0x71,0x3d,0x30,0x2e, 0x37,0x0d,0x0a,0x4b,0x65,0x65,0x70,0x2d, 0x41,0x6c,0x69,0x76,0x65,0x3a,0x20,0x33, 0x30,0x30,0x0d,0x0a,0x43,0x6f,0x6e,0x6e, 0x65,0x63,0x74,0x69,0x6f,0x6e,0x3a,0x20, 0x6b,0x65,0x65,0x70,0x2d,0x61,0x6c,0x69, 0x76,0x65,0x0d,0x0a,0x0d,0x0a }; /* end raw_eth_pkt */ return PortTestMatchReal(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), sig, sid); } /** * \test Check if we match a dest port */ int PortTestMatchReal01() { /* tcp.sport=47370 tcp.dport=80 */ char *sig = "alert tcp any any -> any 80 (msg:\"Nothing..\"; content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we match a source port */ int PortTestMatchReal02() { char *sig = "alert tcp any 47370 -> any any (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we match both of them */ int PortTestMatchReal03() { char *sig = "alert tcp any 47370 -> any 80 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we negate dest ports correctly */ int PortTestMatchReal04() { char *sig = "alert tcp any any -> any !80 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we negate source ports correctly */ int PortTestMatchReal05() { char *sig = "alert tcp any !47370 -> any any (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we negate both ports correctly */ int PortTestMatchReal06() { char *sig = "alert tcp any !47370 -> any !80 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we match a dest port range */ int PortTestMatchReal07() { char *sig = "alert tcp any any -> any 70:100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we match a source port range */ int PortTestMatchReal08() { char *sig = "alert tcp any 47000:50000 -> any any (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we match both port ranges */ int PortTestMatchReal09() { char *sig = "alert tcp any 47000:50000 -> any 70:100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we negate a dest port range */ int PortTestMatchReal10() { char *sig = "alert tcp any any -> any !70:100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we negate a source port range */ int PortTestMatchReal11() { char *sig = "alert tcp any !47000:50000 -> any any (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we negate both port ranges */ int PortTestMatchReal12() { char *sig = "alert tcp any !47000:50000 -> any !70:100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we autocomplete ranges correctly */ int PortTestMatchReal13() { char *sig = "alert tcp any 47000:50000 -> any !81: (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we autocomplete ranges correctly */ int PortTestMatchReal14() { char *sig = "alert tcp any !48000:50000 -> any :100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we autocomplete ranges correctly */ int PortTestMatchReal15() { char *sig = "alert tcp any :50000 -> any 81:100 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we separate ranges correctly */ int PortTestMatchReal16() { char *sig = "alert tcp any 100: -> any ![0:79,81:65535] (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we separate ranges correctly */ int PortTestMatchReal17() { char *sig = "alert tcp any ![0:39999,48000:50000] -> any ![0:80,82:65535] " "(msg:\"Nothing..\"; content:\"GET\"; sid:1;)"; return (PortTestMatchRealWrp(sig, 1) == 0)? 1 : 0; } /** * \test Check if we separate ranges correctly */ int PortTestMatchReal18() { char *sig = "alert tcp any ![0:39999,48000:50000] -> any 80 (msg:\"Nothing" " at all\"; content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } /** * \test Check if we separate ranges correctly */ int PortTestMatchReal19() { char *sig = "alert tcp any any -> any 80 (msg:\"Nothing..\";" " content:\"GET\"; sid:1;)"; return PortTestMatchRealWrp(sig, 1); } static int PortTestMatchDoubleNegation(void) { int result = 0; DetectPort *head = NULL, *nhead = NULL; if (DetectPortParseDo(NULL, &head, &nhead, "![!80]", 0, NULL) == -1) return result; result = (head != NULL); result = (nhead == NULL); return result; } #endif /* UNITTESTS */ void DetectPortTests(void) { #ifdef UNITTESTS UtRegisterTest("PortTestParse01", PortTestParse01); UtRegisterTest("PortTestParse02", PortTestParse02); UtRegisterTest("PortTestParse03", PortTestParse03); UtRegisterTest("PortTestParse04", PortTestParse04); UtRegisterTest("PortTestParse05", PortTestParse05); UtRegisterTest("PortTestParse06", PortTestParse06); UtRegisterTest("PortTestParse07", PortTestParse07); UtRegisterTest("PortTestParse08", PortTestParse08); UtRegisterTest("PortTestParse09", PortTestParse09); UtRegisterTest("PortTestParse10", PortTestParse10); UtRegisterTest("PortTestParse11", PortTestParse11); UtRegisterTest("PortTestParse12", PortTestParse12); UtRegisterTest("PortTestParse13", PortTestParse13); UtRegisterTest("PortTestParse14", PortTestParse14); UtRegisterTest("PortTestParse15", PortTestParse15); UtRegisterTest("PortTestParse16", PortTestParse16); UtRegisterTest("PortTestFunctions01", PortTestFunctions01); UtRegisterTest("PortTestFunctions02", PortTestFunctions02); UtRegisterTest("PortTestFunctions03", PortTestFunctions03); UtRegisterTest("PortTestFunctions04", PortTestFunctions04); UtRegisterTest("PortTestFunctions05", PortTestFunctions05); UtRegisterTest("PortTestFunctions06", PortTestFunctions06); UtRegisterTest("PortTestFunctions07", PortTestFunctions07); UtRegisterTest("PortTestMatchReal01", PortTestMatchReal01); UtRegisterTest("PortTestMatchReal02", PortTestMatchReal02); UtRegisterTest("PortTestMatchReal03", PortTestMatchReal03); UtRegisterTest("PortTestMatchReal04", PortTestMatchReal04); UtRegisterTest("PortTestMatchReal05", PortTestMatchReal05); UtRegisterTest("PortTestMatchReal06", PortTestMatchReal06); UtRegisterTest("PortTestMatchReal07", PortTestMatchReal07); UtRegisterTest("PortTestMatchReal08", PortTestMatchReal08); UtRegisterTest("PortTestMatchReal09", PortTestMatchReal09); UtRegisterTest("PortTestMatchReal10", PortTestMatchReal10); UtRegisterTest("PortTestMatchReal11", PortTestMatchReal11); UtRegisterTest("PortTestMatchReal12", PortTestMatchReal12); UtRegisterTest("PortTestMatchReal13", PortTestMatchReal13); UtRegisterTest("PortTestMatchReal14", PortTestMatchReal14); UtRegisterTest("PortTestMatchReal15", PortTestMatchReal15); UtRegisterTest("PortTestMatchReal16", PortTestMatchReal16); UtRegisterTest("PortTestMatchReal17", PortTestMatchReal17); UtRegisterTest("PortTestMatchReal18", PortTestMatchReal18); UtRegisterTest("PortTestMatchReal19", PortTestMatchReal19); UtRegisterTest("PortTestMatchDoubleNegation", PortTestMatchDoubleNegation); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-mpm-hs.c0000644000000000000000000016657513051004444013345 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jim Xu * \author Justin Viiret * * MPM pattern matcher that calls the Hyperscan regex matcher. */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "conf.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" #include "util-mpm-hs.h" #include "util-memcpy.h" #include "util-hash.h" #include "util-hash-lookup3.h" #include "util-hyperscan.h" #ifdef BUILD_HYPERSCAN #include void SCHSInitCtx(MpmCtx *); void SCHSInitThreadCtx(MpmCtx *, MpmThreadCtx *); void SCHSDestroyCtx(MpmCtx *); void SCHSDestroyThreadCtx(MpmCtx *, MpmThreadCtx *); int SCHSAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCHSAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCHSPreparePatterns(MpmCtx *mpm_ctx); uint32_t SCHSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, const uint16_t buflen); void SCHSPrintInfo(MpmCtx *mpm_ctx); void SCHSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx); void SCHSRegisterTests(void); /* size of the hash table used to speed up pattern insertions initially */ #define INIT_HASH_SIZE 65536 /* Initial size of the global database hash (used for de-duplication). */ #define INIT_DB_HASH_SIZE 1000 /* Global prototype scratch, built incrementally as Hyperscan databases are * built and then cloned for each thread context. Access is serialised via * g_scratch_proto_mutex. */ static hs_scratch_t *g_scratch_proto = NULL; static SCMutex g_scratch_proto_mutex = SCMUTEX_INITIALIZER; /* Global hash table of Hyperscan databases, used for de-duplication. Access is * serialised via g_db_table_mutex. */ static HashTable *g_db_table = NULL; static SCMutex g_db_table_mutex = SCMUTEX_INITIALIZER; /** * \internal * \brief Wraps SCMalloc (which is a macro) so that it can be passed to * hs_set_allocator() for Hyperscan's use. */ static void *SCHSMalloc(size_t size) { return SCMalloc(size); } /** * \internal * \brief Wraps SCFree (which is a macro) so that it can be passed to * hs_set_allocator() for Hyperscan's use. */ static void SCHSFree(void *ptr) { SCFree(ptr); } /** \brief Register Suricata malloc/free with Hyperscan. * * Requests that Hyperscan use Suricata's allocator for allocation of * databases, scratch space, etc. */ static void SCHSSetAllocators(void) { hs_error_t err = hs_set_allocator(SCHSMalloc, SCHSFree); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "Failed to set Hyperscan allocator."); exit(EXIT_FAILURE); } } /** * \internal * \brief Creates a hash of the pattern. We use it for the hashing process * during the initial pattern insertion time, to cull duplicate sigs. * * \param pat Pointer to the pattern. * \param patlen Pattern length. * * \retval hash A 32 bit unsigned hash. */ static inline uint32_t SCHSInitHashRaw(uint8_t *pat, uint16_t patlen) { uint32_t hash = patlen * pat[0]; if (patlen > 1) hash += pat[1]; return (hash % INIT_HASH_SIZE); } /** * \internal * \brief Looks up a pattern. We use it for the hashing process during * the initial pattern insertion time, to cull duplicate sigs. * * \param ctx Pointer to the HS ctx. * \param pat Pointer to the pattern. * \param patlen Pattern length. * \param flags Flags. We don't need this. * * \retval hash A 32 bit unsigned hash. */ static inline SCHSPattern *SCHSInitHashLookup(SCHSCtx *ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char flags, uint32_t pid) { uint32_t hash = SCHSInitHashRaw(pat, patlen); if (ctx->init_hash == NULL) { return NULL; } SCHSPattern *t = ctx->init_hash[hash]; for (; t != NULL; t = t->next) { /* Since Hyperscan uses offset/depth, we must distinguish between * patterns with the same ID but different offset/depth here. */ if (t->id == pid && t->offset == offset && t->depth == depth) { BUG_ON(t->len != patlen); BUG_ON(SCMemcmp(t->original_pat, pat, patlen) != 0); return t; } } return NULL; } /** * \internal * \brief Allocates a new pattern instance. * * \param mpm_ctx Pointer to the mpm context. * * \retval p Pointer to the newly created pattern. */ static inline SCHSPattern *SCHSAllocPattern(MpmCtx *mpm_ctx) { SCHSPattern *p = SCMalloc(sizeof(SCHSPattern)); if (unlikely(p == NULL)) { exit(EXIT_FAILURE); } memset(p, 0, sizeof(SCHSPattern)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCHSPattern); return p; } /** * \internal * \brief Used to free SCHSPattern instances. * * \param mpm_ctx Pointer to the mpm context. * \param p Pointer to the SCHSPattern instance to be freed. * \param free Free the above pointer or not. */ static inline void SCHSFreePattern(MpmCtx *mpm_ctx, SCHSPattern *p) { if (p != NULL && p->original_pat != NULL) { SCFree(p->original_pat); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= p->len; } if (p != NULL && p->sids != NULL) { SCFree(p->sids); } if (p != NULL) { SCFree(p); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCHSPattern); } } static inline uint32_t SCHSInitHash(SCHSPattern *p) { uint32_t hash = p->len * p->original_pat[0]; if (p->len > 1) hash += p->original_pat[1]; return (hash % INIT_HASH_SIZE); } static inline int SCHSInitHashAdd(SCHSCtx *ctx, SCHSPattern *p) { uint32_t hash = SCHSInitHash(p); if (ctx->init_hash == NULL) { return 0; } if (ctx->init_hash[hash] == NULL) { ctx->init_hash[hash] = p; return 0; } SCHSPattern *tt = NULL; SCHSPattern *t = ctx->init_hash[hash]; /* get the list tail */ do { tt = t; t = t->next; } while (t != NULL); tt->next = p; return 0; } /** * \internal * \brief Add a pattern to the mpm-hs context. * * \param mpm_ctx Mpm context. * \param pat Pointer to the pattern. * \param patlen Length of the pattern. * \param pid Pattern id * \param sid Signature id (internal id). * \param flags Pattern's MPM_PATTERN_* flags. * * \retval 0 On success. * \retval -1 On failure. */ static int SCHSAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; if (offset != 0) { flags |= MPM_PATTERN_FLAG_OFFSET; } if (depth != 0) { flags |= MPM_PATTERN_FLAG_DEPTH; } if (patlen == 0) { SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "pattern length 0"); return 0; } /* check if we have already inserted this pattern */ SCHSPattern *p = SCHSInitHashLookup(ctx, pat, patlen, offset, depth, flags, pid); if (p == NULL) { SCLogDebug("Allocing new pattern"); /* p will never be NULL */ p = SCHSAllocPattern(mpm_ctx); p->len = patlen; p->flags = flags; p->id = pid; p->offset = offset; p->depth = depth; p->original_pat = SCMalloc(patlen); if (p->original_pat == NULL) goto error; mpm_ctx->memory_cnt++; mpm_ctx->memory_size += patlen; memcpy(p->original_pat, pat, patlen); /* put in the pattern hash */ SCHSInitHashAdd(ctx, p); mpm_ctx->pattern_cnt++; if (mpm_ctx->maxlen < patlen) mpm_ctx->maxlen = patlen; if (mpm_ctx->minlen == 0) { mpm_ctx->minlen = patlen; } else { if (mpm_ctx->minlen > patlen) mpm_ctx->minlen = patlen; } p->sids_size = 1; p->sids = SCMalloc(p->sids_size * sizeof(SigIntId)); BUG_ON(p->sids == NULL); p->sids[0] = sid; } else { /* TODO figure out how we can be called multiple times for the same CTX with the same sid */ int found = 0; uint32_t x = 0; for (x = 0; x < p->sids_size; x++) { if (p->sids[x] == sid) { found = 1; break; } } if (!found) { SigIntId *sids = SCRealloc(p->sids, (sizeof(SigIntId) * (p->sids_size + 1))); BUG_ON(sids == NULL); p->sids = sids; p->sids[p->sids_size] = sid; p->sids_size++; } } return 0; error: SCHSFreePattern(mpm_ctx, p); return -1; } /** * \brief Pattern database information used only as input to the Hyperscan * compiler. */ typedef struct SCHSCompileData_ { unsigned int *ids; unsigned int *flags; char **expressions; hs_expr_ext_t **ext; unsigned int pattern_cnt; } SCHSCompileData; static SCHSCompileData *SCHSAllocCompileData(unsigned int pattern_cnt) { SCHSCompileData *cd = SCMalloc(pattern_cnt * sizeof(SCHSCompileData)); if (cd == NULL) { goto error; } memset(cd, 0, pattern_cnt * sizeof(SCHSCompileData)); cd->pattern_cnt = pattern_cnt; cd->ids = SCMalloc(pattern_cnt * sizeof(unsigned int)); if (cd->ids == NULL) { goto error; } memset(cd->ids, 0, pattern_cnt * sizeof(unsigned int)); cd->flags = SCMalloc(pattern_cnt * sizeof(unsigned int)); if (cd->flags == NULL) { goto error; } memset(cd->flags, 0, pattern_cnt * sizeof(unsigned int)); cd->expressions = SCMalloc(pattern_cnt * sizeof(char *)); if (cd->expressions == NULL) { goto error; } memset(cd->expressions, 0, pattern_cnt * sizeof(char *)); cd->ext = SCMalloc(pattern_cnt * sizeof(hs_expr_ext_t *)); if (cd->ext == NULL) { goto error; } memset(cd->ext, 0, pattern_cnt * sizeof(hs_expr_ext_t *)); return cd; error: SCLogDebug("SCHSCompileData alloc failed"); if (cd) { SCFree(cd->ids); SCFree(cd->flags); SCFree(cd->expressions); SCFree(cd->ext); SCFree(cd); } return NULL; } static void SCHSFreeCompileData(SCHSCompileData *cd) { if (cd == NULL) { return; } SCFree(cd->ids); SCFree(cd->flags); if (cd->expressions) { for (unsigned int i = 0; i < cd->pattern_cnt; i++) { SCFree(cd->expressions[i]); } SCFree(cd->expressions); } if (cd->ext) { for (unsigned int i = 0; i < cd->pattern_cnt; i++) { SCFree(cd->ext[i]); } SCFree(cd->ext); } SCFree(cd); } typedef struct PatternDatabase_ { SCHSPattern **parray; hs_database_t *hs_db; uint32_t pattern_cnt; /* Reference count: number of MPM contexts using this pattern database. */ uint32_t ref_cnt; } PatternDatabase; static uint32_t SCHSPatternHash(const SCHSPattern *p, uint32_t hash) { BUG_ON(p->original_pat == NULL); BUG_ON(p->sids == NULL); hash = hashlittle_safe(&p->len, sizeof(p->len), hash); hash = hashlittle_safe(&p->flags, sizeof(p->flags), hash); hash = hashlittle_safe(p->original_pat, p->len, hash); hash = hashlittle_safe(&p->id, sizeof(p->id), hash); hash = hashlittle_safe(&p->offset, sizeof(p->offset), hash); hash = hashlittle_safe(&p->depth, sizeof(p->depth), hash); hash = hashlittle_safe(&p->sids_size, sizeof(p->sids_size), hash); hash = hashlittle_safe(p->sids, p->sids_size * sizeof(SigIntId), hash); return hash; } static char SCHSPatternCompare(const SCHSPattern *p1, const SCHSPattern *p2) { if ((p1->len != p2->len) || (p1->flags != p2->flags) || (p1->id != p2->id) || (p1->offset != p2->offset) || (p1->depth != p2->depth) || (p1->sids_size != p2->sids_size)) { return 0; } if (SCMemcmp(p1->original_pat, p2->original_pat, p1->len) != 0) { return 0; } if (SCMemcmp(p1->sids, p2->sids, p1->sids_size * sizeof(p1->sids[0])) != 0) { return 0; } return 1; } static uint32_t PatternDatabaseHash(HashTable *ht, void *data, uint16_t len) { const PatternDatabase *pd = data; uint32_t hash = 0; hash = hashword(&pd->pattern_cnt, 1, hash); for (uint32_t i = 0; i < pd->pattern_cnt; i++) { hash = SCHSPatternHash(pd->parray[i], hash); } hash %= ht->array_size; return hash; } static char PatternDatabaseCompare(void *data1, uint16_t len1, void *data2, uint16_t len2) { const PatternDatabase *pd1 = data1; const PatternDatabase *pd2 = data2; if (pd1->pattern_cnt != pd2->pattern_cnt) { return 0; } for (uint32_t i = 0; i < pd1->pattern_cnt; i++) { if (SCHSPatternCompare(pd1->parray[i], pd2->parray[i]) == 0) { return 0; } } return 1; } static void PatternDatabaseFree(PatternDatabase *pd) { BUG_ON(pd->ref_cnt != 0); if (pd->parray != NULL) { for (uint32_t i = 0; i < pd->pattern_cnt; i++) { SCHSPattern *p = pd->parray[i]; if (p != NULL) { SCFree(p->original_pat); SCFree(p->sids); SCFree(p); } } SCFree(pd->parray); } hs_free_database(pd->hs_db); SCFree(pd); } static void PatternDatabaseTableFree(void *data) { /* Stub function handed to hash table; actual freeing of PatternDatabase * structures is done in MPM destruction when the ref_cnt drops to zero. */ } static PatternDatabase *PatternDatabaseAlloc(uint32_t pattern_cnt) { PatternDatabase *pd = SCMalloc(sizeof(PatternDatabase)); if (pd == NULL) { return NULL; } memset(pd, 0, sizeof(PatternDatabase)); pd->pattern_cnt = pattern_cnt; pd->ref_cnt = 0; pd->hs_db = NULL; /* alloc the pattern array */ pd->parray = (SCHSPattern **)SCMalloc(pd->pattern_cnt * sizeof(SCHSPattern *)); if (pd->parray == NULL) { SCFree(pd); return NULL; } memset(pd->parray, 0, pd->pattern_cnt * sizeof(SCHSPattern *)); return pd; } /** * \brief Process the patterns added to the mpm, and create the internal tables. * * \param mpm_ctx Pointer to the mpm context. */ int SCHSPreparePatterns(MpmCtx *mpm_ctx) { SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; if (mpm_ctx->pattern_cnt == 0 || ctx->init_hash == NULL) { SCLogDebug("no patterns supplied to this mpm_ctx"); return 0; } hs_error_t err; hs_compile_error_t *compile_err = NULL; SCHSCompileData *cd = NULL; PatternDatabase *pd = NULL; cd = SCHSAllocCompileData(mpm_ctx->pattern_cnt); if (cd == NULL) { goto error; } pd = PatternDatabaseAlloc(mpm_ctx->pattern_cnt); if (pd == NULL) { goto error; } /* populate the pattern array with the patterns in the hash */ for (uint32_t i = 0, p = 0; i < INIT_HASH_SIZE; i++) { SCHSPattern *node = ctx->init_hash[i], *nnode = NULL; while (node != NULL) { nnode = node->next; node->next = NULL; pd->parray[p++] = node; node = nnode; } } /* we no longer need the hash, so free its memory */ SCFree(ctx->init_hash); ctx->init_hash = NULL; /* Serialise whole database compilation as a relatively easy way to ensure * dedupe is safe. */ SCMutexLock(&g_db_table_mutex); /* Init global pattern database hash if necessary. */ if (g_db_table == NULL) { g_db_table = HashTableInit(INIT_DB_HASH_SIZE, PatternDatabaseHash, PatternDatabaseCompare, PatternDatabaseTableFree); if (g_db_table == NULL) { SCMutexUnlock(&g_db_table_mutex); goto error; } } /* Check global hash table to see if we've seen this pattern database * before, and reuse the Hyperscan database if so. */ PatternDatabase *pd_cached = HashTableLookup(g_db_table, pd, 1); if (pd_cached != NULL) { SCLogDebug("Reusing cached database %p with %" PRIu32 " patterns (ref_cnt=%" PRIu32 ")", pd_cached->hs_db, pd_cached->pattern_cnt, pd_cached->ref_cnt); pd_cached->ref_cnt++; ctx->pattern_db = pd_cached; SCMutexUnlock(&g_db_table_mutex); PatternDatabaseFree(pd); SCHSFreeCompileData(cd); return 0; } BUG_ON(ctx->pattern_db != NULL); /* already built? */ for (uint32_t i = 0; i < pd->pattern_cnt; i++) { const SCHSPattern *p = pd->parray[i]; cd->ids[i] = i; cd->flags[i] = HS_FLAG_SINGLEMATCH; if (p->flags & MPM_PATTERN_FLAG_NOCASE) { cd->flags[i] |= HS_FLAG_CASELESS; } cd->expressions[i] = HSRenderPattern(p->original_pat, p->len); if (p->flags & (MPM_PATTERN_FLAG_OFFSET | MPM_PATTERN_FLAG_DEPTH)) { cd->ext[i] = SCMalloc(sizeof(hs_expr_ext_t)); if (cd->ext[i] == NULL) { SCMutexUnlock(&g_db_table_mutex); goto error; } memset(cd->ext[i], 0, sizeof(hs_expr_ext_t)); if (p->flags & MPM_PATTERN_FLAG_OFFSET) { cd->ext[i]->flags |= HS_EXT_FLAG_MIN_OFFSET; cd->ext[i]->min_offset = p->offset + p->len; } if (p->flags & MPM_PATTERN_FLAG_DEPTH) { cd->ext[i]->flags |= HS_EXT_FLAG_MAX_OFFSET; cd->ext[i]->max_offset = p->offset + p->depth; } } } BUG_ON(mpm_ctx->pattern_cnt == 0); err = hs_compile_ext_multi((const char *const *)cd->expressions, cd->flags, cd->ids, (const hs_expr_ext_t *const *)cd->ext, cd->pattern_cnt, HS_MODE_BLOCK, NULL, &pd->hs_db, &compile_err); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "failed to compile hyperscan database"); if (compile_err) { SCLogError(SC_ERR_FATAL, "compile error: %s", compile_err->message); } hs_free_compile_error(compile_err); SCMutexUnlock(&g_db_table_mutex); goto error; } ctx->pattern_db = pd; SCMutexLock(&g_scratch_proto_mutex); err = hs_alloc_scratch(pd->hs_db, &g_scratch_proto); SCMutexUnlock(&g_scratch_proto_mutex); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "failed to allocate scratch"); SCMutexUnlock(&g_db_table_mutex); goto error; } err = hs_database_size(pd->hs_db, &ctx->hs_db_size); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "failed to query database size"); SCMutexUnlock(&g_db_table_mutex); goto error; } mpm_ctx->memory_cnt++; mpm_ctx->memory_size += ctx->hs_db_size; SCLogDebug("Built %" PRIu32 " patterns into a database of size %" PRIuMAX " bytes", mpm_ctx->pattern_cnt, (uintmax_t)ctx->hs_db_size); /* Cache this database globally for later. */ pd->ref_cnt = 1; HashTableAdd(g_db_table, pd, 1); SCMutexUnlock(&g_db_table_mutex); SCHSFreeCompileData(cd); return 0; error: if (pd) { PatternDatabaseFree(pd); } if (cd) { SCHSFreeCompileData(cd); } return -1; } /** * \brief Init the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCHSInitThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { memset(mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); SCHSThreadCtx *ctx = SCMalloc(sizeof(SCHSThreadCtx)); if (ctx == NULL) { exit(EXIT_FAILURE); } mpm_thread_ctx->ctx = ctx; memset(ctx, 0, sizeof(SCHSThreadCtx)); mpm_thread_ctx->memory_cnt++; mpm_thread_ctx->memory_size += sizeof(SCHSThreadCtx); ctx->scratch = NULL; ctx->scratch_size = 0; SCMutexLock(&g_scratch_proto_mutex); if (g_scratch_proto == NULL) { /* There is no scratch prototype: this means that we have not compiled * any Hyperscan databases. */ SCMutexUnlock(&g_scratch_proto_mutex); SCLogDebug("No scratch space prototype"); return; } hs_error_t err = hs_clone_scratch(g_scratch_proto, (hs_scratch_t **)&ctx->scratch); SCMutexUnlock(&g_scratch_proto_mutex); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "Unable to clone scratch prototype"); exit(EXIT_FAILURE); } err = hs_scratch_size(ctx->scratch, &ctx->scratch_size); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "Unable to query scratch size"); exit(EXIT_FAILURE); } mpm_thread_ctx->memory_cnt++; mpm_thread_ctx->memory_size += ctx->scratch_size; } /** * \brief Initialize the HS context. * * \param mpm_ctx Mpm context. */ void SCHSInitCtx(MpmCtx *mpm_ctx) { if (mpm_ctx->ctx != NULL) return; mpm_ctx->ctx = SCMalloc(sizeof(SCHSCtx)); if (mpm_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->ctx, 0, sizeof(SCHSCtx)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCHSCtx); /* initialize the hash we use to speed up pattern insertions */ SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; ctx->init_hash = SCMalloc(sizeof(SCHSPattern *) * INIT_HASH_SIZE); if (ctx->init_hash == NULL) { exit(EXIT_FAILURE); } memset(ctx->init_hash, 0, sizeof(SCHSPattern *) * INIT_HASH_SIZE); } /** * \brief Destroy the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCHSDestroyThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { SCHSPrintSearchStats(mpm_thread_ctx); if (mpm_thread_ctx->ctx != NULL) { SCHSThreadCtx *thr_ctx = (SCHSThreadCtx *)mpm_thread_ctx->ctx; if (thr_ctx->scratch != NULL) { hs_free_scratch(thr_ctx->scratch); mpm_thread_ctx->memory_cnt--; mpm_thread_ctx->memory_size -= thr_ctx->scratch_size; } SCFree(mpm_thread_ctx->ctx); mpm_thread_ctx->ctx = NULL; mpm_thread_ctx->memory_cnt--; mpm_thread_ctx->memory_size -= sizeof(SCHSThreadCtx); } } /** * \brief Destroy the mpm context. * * \param mpm_ctx Pointer to the mpm context. */ void SCHSDestroyCtx(MpmCtx *mpm_ctx) { SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; if (ctx == NULL) return; if (ctx->init_hash != NULL) { SCFree(ctx->init_hash); ctx->init_hash = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (INIT_HASH_SIZE * sizeof(SCHSPattern *)); } /* Decrement pattern database ref count, and delete it entirely if the * count has dropped to zero. */ SCMutexLock(&g_db_table_mutex); PatternDatabase *pd = ctx->pattern_db; if (pd) { BUG_ON(pd->ref_cnt == 0); pd->ref_cnt--; if (pd->ref_cnt == 0) { HashTableRemove(g_db_table, pd, 1); PatternDatabaseFree(pd); } } SCMutexUnlock(&g_db_table_mutex); SCFree(mpm_ctx->ctx); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCHSCtx); } typedef struct SCHSCallbackCtx_ { SCHSCtx *ctx; void *pmq; uint32_t match_count; } SCHSCallbackCtx; /* Hyperscan MPM match event handler */ static int SCHSMatchEvent(unsigned int id, unsigned long long from, unsigned long long to, unsigned int flags, void *ctx) { SCHSCallbackCtx *cctx = ctx; PrefilterRuleStore *pmq = cctx->pmq; const PatternDatabase *pd = cctx->ctx->pattern_db; const SCHSPattern *pat = pd->parray[id]; SCLogDebug("Hyperscan Match %" PRIu32 ": id=%" PRIu32 " @ %" PRIuMAX " (pat id=%" PRIu32 ")", cctx->match_count, (uint32_t)id, (uintmax_t)to, pat->id); PrefilterAddSids(pmq, pat->sids, pat->sids_size); cctx->match_count++; return 0; } /** * \brief The Hyperscan search function. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param pmq Pointer to the Pattern Matcher Queue to hold * search matches. * \param buf Buffer to be searched. * \param buflen Buffer length. * * \retval matches Match count. */ uint32_t SCHSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, const uint16_t buflen) { uint32_t ret = 0; SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; SCHSThreadCtx *hs_thread_ctx = (SCHSThreadCtx *)(mpm_thread_ctx->ctx); const PatternDatabase *pd = ctx->pattern_db; if (unlikely(buflen == 0)) { return 0; } SCHSCallbackCtx cctx = {.ctx = ctx, .pmq = pmq, .match_count = 0}; /* scratch should have been cloned from g_scratch_proto at thread init. */ hs_scratch_t *scratch = hs_thread_ctx->scratch; BUG_ON(pd->hs_db == NULL); BUG_ON(scratch == NULL); hs_error_t err = hs_scan(pd->hs_db, (const char *)buf, buflen, 0, scratch, SCHSMatchEvent, &cctx); if (err != HS_SUCCESS) { /* An error value (other than HS_SCAN_TERMINATED) from hs_scan() * indicates that it was passed an invalid database or scratch region, * which is not something we can recover from at scan time. */ SCLogError(SC_ERR_FATAL, "Hyperscan returned error %d", err); exit(EXIT_FAILURE); } else { ret = cctx.match_count; } return ret; } /** * \brief Add a case insensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patlen The pattern length. * \param offset The pattern offset. * \param depth The pattern depth. * \param pid The pattern id. * \param sid The pattern signature id. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCHSAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { flags |= MPM_PATTERN_FLAG_NOCASE; return SCHSAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } /** * \brief Add a case sensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patlen The pattern length. * \param offset The pattern offset. * \param depth The pattern depth. * \param pid The pattern id. * \param sid The pattern signature id. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCHSAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { return SCHSAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } void SCHSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { return; } void SCHSPrintInfo(MpmCtx *mpm_ctx) { SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx; printf("MPM HS Information:\n"); printf("Memory allocs: %" PRIu32 "\n", mpm_ctx->memory_cnt); printf("Memory alloced: %" PRIu32 "\n", mpm_ctx->memory_size); printf(" Sizeof:\n"); printf(" MpmCtx %" PRIuMAX "\n", (uintmax_t)sizeof(MpmCtx)); printf(" SCHSCtx: %" PRIuMAX "\n", (uintmax_t)sizeof(SCHSCtx)); printf(" SCHSPattern %" PRIuMAX "\n", (uintmax_t)sizeof(SCHSPattern)); printf("Unique Patterns: %" PRIu32 "\n", mpm_ctx->pattern_cnt); printf("Smallest: %" PRIu32 "\n", mpm_ctx->minlen); printf("Largest: %" PRIu32 "\n", mpm_ctx->maxlen); printf("\n"); if (ctx) { PatternDatabase *pd = ctx->pattern_db; char *db_info = NULL; if (hs_database_info(pd->hs_db, &db_info) == HS_SUCCESS) { printf("HS Database Info: %s\n", db_info); SCFree(db_info); } printf("HS Database Size: %" PRIuMAX " bytes\n", (uintmax_t)ctx->hs_db_size); } printf("\n"); } /************************** Mpm Registration ***************************/ /** * \brief Register the Hyperscan MPM. */ void MpmHSRegister(void) { mpm_table[MPM_HS].name = "hs"; mpm_table[MPM_HS].InitCtx = SCHSInitCtx; mpm_table[MPM_HS].InitThreadCtx = SCHSInitThreadCtx; mpm_table[MPM_HS].DestroyCtx = SCHSDestroyCtx; mpm_table[MPM_HS].DestroyThreadCtx = SCHSDestroyThreadCtx; mpm_table[MPM_HS].AddPattern = SCHSAddPatternCS; mpm_table[MPM_HS].AddPatternNocase = SCHSAddPatternCI; mpm_table[MPM_HS].Prepare = SCHSPreparePatterns; mpm_table[MPM_HS].Search = SCHSSearch; mpm_table[MPM_HS].PrintCtx = SCHSPrintInfo; mpm_table[MPM_HS].PrintThreadCtx = SCHSPrintSearchStats; mpm_table[MPM_HS].RegisterUnittests = SCHSRegisterTests; /* Set Hyperscan memory allocators */ SCHSSetAllocators(); } /** * \brief Clean up global memory used by all Hyperscan MPM instances. * * Currently, this is just the global scratch prototype. */ void MpmHSGlobalCleanup(void) { SCMutexLock(&g_scratch_proto_mutex); if (g_scratch_proto) { SCLogPerf("Cleaning up Hyperscan global scratch"); hs_free_scratch(g_scratch_proto); g_scratch_proto = NULL; } SCMutexUnlock(&g_scratch_proto_mutex); SCMutexLock(&g_db_table_mutex); if (g_db_table != NULL) { SCLogPerf("Clearing Hyperscan database cache"); HashTableFree(g_db_table); g_db_table = NULL; } SCMutexUnlock(&g_db_table_mutex); } /*************************************Unittests********************************/ #ifdef UNITTESTS static int SCHSTest01(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest02(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest03(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghj", 4, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest04(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghjxyz", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest05(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest06(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcd"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest07(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* should match 30 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 29 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 28 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAA", 3, 0, 0, 2, 0, 0); /* 26 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAA", 5, 0, 0, 3, 0, 0); /* 21 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAA", 10, 0, 0, 4, 0, 0); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30, 0, 0, 5, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 6) result = 1; else printf("6 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest08(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"a", 1); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest09(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"ab", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest10(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789" "abcdefgh" "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest11(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"he", 2, 0, 0, 1, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"she", 3, 0, 0, 2, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"his", 3, 0, 0, 3, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"hers", 4, 0, 0, 4, 0, 0) == -1) goto end; PmqSetup(&pmq); if (SCHSPreparePatterns(&mpm_ctx) == -1) goto end; SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); result = 1; char *buf = "he"; result &= (SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "she"; result &= (SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); buf = "his"; result &= (SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "hers"; result &= (SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); end: SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest12(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest13(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCD"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCD"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest14(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDE"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDE"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest15(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDEF"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDEF"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest16(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABC"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABC"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest17(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzAB"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzAB"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest18(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ char *pat = "abcde" "fghij" "klmno" "pqrst" "uvwxy" "z"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcde" "fghij" "klmno" "pqrst" "uvwxy" "z"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest19(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 */ char *pat = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest20(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 */ char *pat = "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AAAAA" "AA"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest21(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"AA", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest22(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest23(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 0) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest24(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 1 */ MpmAddPatternCI(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest25(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghiJkl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest26(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "works"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("3 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest27(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ONE", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "tone"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest28(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_HS); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"one", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCHSPreparePatterns(&mpm_ctx); SCHSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); char *buf = "tONE"; uint32_t cnt = SCHSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ", cnt); SCHSDestroyCtx(&mpm_ctx); SCHSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCHSTest29(void) { uint8_t *buf = (uint8_t *)"onetwothreefourfivesixseveneightnine"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->mpm_matcher = MPM_HS; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit( de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; " "fast_pattern:3,3; sid:2;)"); if (de_ctx->sig_list->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 1) { printf("if (PacketAlertCheck(p, 1) != 1) failure\n"); goto end; } if (PacketAlertCheck(p, 2) != 1) { printf("if (PacketAlertCheck(p, 1) != 2) failure\n"); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void SCHSRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCHSTest01", SCHSTest01); UtRegisterTest("SCHSTest02", SCHSTest02); UtRegisterTest("SCHSTest03", SCHSTest03); UtRegisterTest("SCHSTest04", SCHSTest04); UtRegisterTest("SCHSTest05", SCHSTest05); UtRegisterTest("SCHSTest06", SCHSTest06); UtRegisterTest("SCHSTest07", SCHSTest07); UtRegisterTest("SCHSTest08", SCHSTest08); UtRegisterTest("SCHSTest09", SCHSTest09); UtRegisterTest("SCHSTest10", SCHSTest10); UtRegisterTest("SCHSTest11", SCHSTest11); UtRegisterTest("SCHSTest12", SCHSTest12); UtRegisterTest("SCHSTest13", SCHSTest13); UtRegisterTest("SCHSTest14", SCHSTest14); UtRegisterTest("SCHSTest15", SCHSTest15); UtRegisterTest("SCHSTest16", SCHSTest16); UtRegisterTest("SCHSTest17", SCHSTest17); UtRegisterTest("SCHSTest18", SCHSTest18); UtRegisterTest("SCHSTest19", SCHSTest19); UtRegisterTest("SCHSTest20", SCHSTest20); UtRegisterTest("SCHSTest21", SCHSTest21); UtRegisterTest("SCHSTest22", SCHSTest22); UtRegisterTest("SCHSTest23", SCHSTest23); UtRegisterTest("SCHSTest24", SCHSTest24); UtRegisterTest("SCHSTest25", SCHSTest25); UtRegisterTest("SCHSTest26", SCHSTest26); UtRegisterTest("SCHSTest27", SCHSTest27); UtRegisterTest("SCHSTest28", SCHSTest28); UtRegisterTest("SCHSTest29", SCHSTest29); #endif return; } #endif /* BUILD_HYPERSCAN */ suricata-3.2.1/src/detect-http-hh.h0000644000000000000000000000162413051004444013777 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_HTTP_HH_H__ #define __DETECT_HTTP_HH_H__ void DetectHttpHHRegister(void); #endif /* __DETECT_HTTP_HH_H__ */ suricata-3.2.1/src/packet-queue.h0000644000000000000000000000175013051004444013546 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __PACKET_QUEUE_H__ #define __PACKET_QUEUE_H__ #include "threads.h" #include "decode.h" void PacketEnqueue (PacketQueue *, Packet *); Packet *PacketDequeue (PacketQueue *); #endif /* __PACKET_QUEUE_H__ */ suricata-3.2.1/src/detect-engine-hrud.c0000644000000000000000000030123713051004444014626 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP raw uri match */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-hrud.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP URI Raw Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxRawUri(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (likely(tx->request_uri != NULL)) { const uint32_t uri_len = bstr_len(tx->request_uri); const uint8_t *uri = bstr_ptr(tx->request_uri); if (uri_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, uri, uri_len); } } } int PrefilterTxRawUriRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxRawUri, ALPROTO_HTTP, HTP_REQUEST_LINE, mpm_ctx, NULL, "http_raw_uri"); } /** * \brief Do the http_raw_uri content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpRawUri(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_uri == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; /* Inspect all the uricontents fetched on each * transaction at the app layer */ int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HRUDMATCH], f, (uint8_t *)bstr_ptr(tx->request_uri), bstr_len(tx->request_uri), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS static int DetectEngineHttpRawUriTest01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/../c"; uint8_t http2_buf[] = "/./d.html HTTP/1.1\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"../c/./d\"; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest02(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 19\r\n" "\r\n" "This is dummy body1"; uint32_t http1_len = sizeof(http1_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/c/./d\"; http_raw_uri; offset:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/../"; uint8_t http2_buf[] = "c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a/b\"; http_raw_uri; offset:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest04(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/../"; uint8_t http2_buf[] = "c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/a/b\"; http_raw_uri; offset:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest05(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/"; uint8_t http2_buf[] = "../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"a/b\"; http_raw_uri; depth:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest06(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/"; uint8_t http2_buf[] = "../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/a/b\"; http_raw_uri; depth:25; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/b/"; uint8_t http2_buf[] = "../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/c/./d\"; http_raw_uri; depth:12; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a/"; uint8_t http2_buf[] = "b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:!\"/c/./d\"; http_raw_uri; depth:18; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a\"; http_raw_uri; " "content:\"./c/.\"; http_raw_uri; within:9; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"/a\"; http_raw_uri; " "content:!\"boom\"; http_raw_uri; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest11(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"boom\"; http_raw_uri; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest12(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"/b/..\"; http_raw_uri; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest13(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"/c/.\"; http_raw_uri; distance:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest14(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"b/..\"; http_raw_uri; distance:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest15(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:\"/c/\"; http_raw_uri; distance:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest16(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "content:\"./a\"; http_raw_uri; " "content:!\"/c/\"; http_raw_uri; distance:4; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest21(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; http_raw_uri; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest22(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; within:5; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest23(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; distance:3; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest24(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:!\"/c/\"; distance:10; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest25(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; within:10; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest26(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; within:5; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest27(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; distance:5; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawUriTest28(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /../a"; uint8_t http2_buf[] = "/b/../c/./d.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1" "This is dummy message body2"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http raw uri test\"; " "pcre:/\\.\\/a/I; " "content:\"/c/\"; distance:10; http_raw_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** * \test Test multiple relative contents with a negated content. */ static int DetectEngineHttpRawUriTest29(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /../a/b/../c/./d.html HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative raw uri contents\"; " "content:\"/c/\"; http_raw_uri; " "isdataat:4,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** * \test Test multiple relative contents with a negated content. */ static int DetectEngineHttpRawUriTest30(void) { int result = 0; uint8_t *http_buf = (uint8_t *)"POST /../a/b/../c/./d.html HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n"; uint32_t http_buf_len = strlen((char *)http_buf); Flow f; TcpSession ssn; HtpState *http_state = NULL; Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf, http_buf_len, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test multiple relative raw uri contents\"; " "uricontent:\"/c/\"; isdataat:!10,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_buf_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } #endif /* UNITTESTS */ void DetectEngineHttpRawUriRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpRawUriTest01", DetectEngineHttpRawUriTest01); UtRegisterTest("DetectEngineHttpRawUriTest02", DetectEngineHttpRawUriTest02); UtRegisterTest("DetectEngineHttpRawUriTest03", DetectEngineHttpRawUriTest03); UtRegisterTest("DetectEngineHttpRawUriTest04", DetectEngineHttpRawUriTest04); UtRegisterTest("DetectEngineHttpRawUriTest05", DetectEngineHttpRawUriTest05); UtRegisterTest("DetectEngineHttpRawUriTest06", DetectEngineHttpRawUriTest06); UtRegisterTest("DetectEngineHttpRawUriTest07", DetectEngineHttpRawUriTest07); UtRegisterTest("DetectEngineHttpRawUriTest08", DetectEngineHttpRawUriTest08); UtRegisterTest("DetectEngineHttpRawUriTest09", DetectEngineHttpRawUriTest09); UtRegisterTest("DetectEngineHttpRawUriTest10", DetectEngineHttpRawUriTest10); UtRegisterTest("DetectEngineHttpRawUriTest11", DetectEngineHttpRawUriTest11); UtRegisterTest("DetectEngineHttpRawUriTest12", DetectEngineHttpRawUriTest12); UtRegisterTest("DetectEngineHttpRawUriTest13", DetectEngineHttpRawUriTest13); UtRegisterTest("DetectEngineHttpRawUriTest14", DetectEngineHttpRawUriTest14); UtRegisterTest("DetectEngineHttpRawUriTest15", DetectEngineHttpRawUriTest15); UtRegisterTest("DetectEngineHttpRawUriTest16", DetectEngineHttpRawUriTest16); UtRegisterTest("DetectEngineHttpRawUriTest21", DetectEngineHttpRawUriTest21); UtRegisterTest("DetectEngineHttpRawUriTest22", DetectEngineHttpRawUriTest22); UtRegisterTest("DetectEngineHttpRawUriTest23", DetectEngineHttpRawUriTest23); UtRegisterTest("DetectEngineHttpRawUriTest24", DetectEngineHttpRawUriTest24); UtRegisterTest("DetectEngineHttpRawUriTest25", DetectEngineHttpRawUriTest25); UtRegisterTest("DetectEngineHttpRawUriTest26", DetectEngineHttpRawUriTest26); UtRegisterTest("DetectEngineHttpRawUriTest27", DetectEngineHttpRawUriTest27); UtRegisterTest("DetectEngineHttpRawUriTest28", DetectEngineHttpRawUriTest28); UtRegisterTest("DetectEngineHttpRawUriTest29", DetectEngineHttpRawUriTest29); UtRegisterTest("DetectEngineHttpRawUriTest30", DetectEngineHttpRawUriTest30); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-engine-siggroup.c0000644000000000000000000010473413051004444015526 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Signature grouping part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "flow-var.h" #include "app-layer-protos.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-address.h" #include "detect-engine-mpm.h" #include "detect-engine-siggroup.h" #include "detect-engine-prefilter.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-flags.h" #include "util-hash.h" #include "util-hashlist.h" #include "util-error.h" #include "util-debug.h" #include "util-cidr.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" /* prototypes */ int SigGroupHeadClearSigs(SigGroupHead *); void SigGroupHeadInitDataFree(SigGroupHeadInitData *sghid) { if (sghid->sig_array != NULL) { SCFree(sghid->sig_array); sghid->sig_array = NULL; } if (sghid->app_mpms != NULL) { SCFree(sghid->app_mpms); } PrefilterFreeEnginesList(sghid->tx_engines); PrefilterFreeEnginesList(sghid->pkt_engines); PrefilterFreeEnginesList(sghid->payload_engines); SCFree(sghid); } static SigGroupHeadInitData *SigGroupHeadInitDataAlloc(uint32_t size) { SigGroupHeadInitData *sghid = SCMalloc(sizeof(SigGroupHeadInitData)); if (unlikely(sghid == NULL)) return NULL; memset(sghid, 0x00, sizeof(SigGroupHeadInitData)); /* initialize the signature bitarray */ sghid->sig_size = size; if ( (sghid->sig_array = SCMalloc(sghid->sig_size)) == NULL) goto error; memset(sghid->sig_array, 0, sghid->sig_size); return sghid; error: SigGroupHeadInitDataFree(sghid); return NULL; } void SigGroupHeadStore(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { void *ptmp; //printf("de_ctx->sgh_array_cnt %u, de_ctx->sgh_array_size %u, de_ctx->sgh_array %p\n", de_ctx->sgh_array_cnt, de_ctx->sgh_array_size, de_ctx->sgh_array); if (de_ctx->sgh_array_cnt < de_ctx->sgh_array_size) { de_ctx->sgh_array[de_ctx->sgh_array_cnt] = sgh; } else { int increase = 16; ptmp = SCRealloc(de_ctx->sgh_array, sizeof(SigGroupHead *) * (increase + de_ctx->sgh_array_size)); if (ptmp == NULL) { SCFree(de_ctx->sgh_array); de_ctx->sgh_array = NULL; return; } de_ctx->sgh_array = ptmp; de_ctx->sgh_array_size += increase; de_ctx->sgh_array[de_ctx->sgh_array_cnt] = sgh; } de_ctx->sgh_array_cnt++; } /** * \brief Alloc a SigGroupHead and its signature bit_array. * * \param size Size of the sig_array that has to be created for this * SigGroupHead. * * \retval sgh Pointer to the newly init SigGroupHead on success; or NULL in * case of error. */ static SigGroupHead *SigGroupHeadAlloc(const DetectEngineCtx *de_ctx, uint32_t size) { SigGroupHead *sgh = SCMalloc(sizeof(SigGroupHead)); if (unlikely(sgh == NULL)) return NULL; memset(sgh, 0, sizeof(SigGroupHead)); sgh->init = SigGroupHeadInitDataAlloc(size); if (sgh->init == NULL) goto error; return sgh; error: SigGroupHeadFree(sgh); return NULL; } /** * \brief Free a SigGroupHead and its members. * * \param sgh Pointer to the SigGroupHead that has to be freed. */ void SigGroupHeadFree(SigGroupHead *sgh) { if (sgh == NULL) return; SCLogDebug("sgh %p", sgh); if (sgh->match_array != NULL) { SCFree(sgh->match_array); sgh->match_array = NULL; } if (sgh->non_pf_other_store_array != NULL) { SCFree(sgh->non_pf_other_store_array); sgh->non_pf_other_store_array = NULL; sgh->non_pf_other_store_cnt = 0; } if (sgh->non_pf_syn_store_array != NULL) { SCFree(sgh->non_pf_syn_store_array); sgh->non_pf_syn_store_array = NULL; sgh->non_pf_syn_store_cnt = 0; } sgh->sig_cnt = 0; if (sgh->init != NULL) { SigGroupHeadInitDataFree(sgh->init); sgh->init = NULL; } PrefilterCleanupRuleGroup(sgh); SCFree(sgh); return; } /** * \brief The hash function to be the used by the hash table - * DetectEngineCtx->sgh_hash_table. * * \param ht Pointer to the hash table. * \param data Pointer to the SigGroupHead. * \param datalen Not used in our case. * * \retval hash The generated hash value. */ uint32_t SigGroupHeadHashFunc(HashListTable *ht, void *data, uint16_t datalen) { SigGroupHead *sgh = (SigGroupHead *)data; uint32_t hash = 0; uint32_t b = 0; SCLogDebug("hashing sgh %p", sgh); for (b = 0; b < sgh->init->sig_size; b++) hash += sgh->init->sig_array[b]; hash %= ht->array_size; SCLogDebug("hash %"PRIu32" (sig_size %"PRIu32")", hash, sgh->init->sig_size); return hash; } /** * \brief The Compare function to be used by the SigGroupHead hash table - * DetectEngineCtx->sgh_hash_table. * * \param data1 Pointer to the first SigGroupHead. * \param len1 Not used. * \param data2 Pointer to the second SigGroupHead. * \param len2 Not used. * * \retval 1 If the 2 SigGroupHeads sent as args match. * \retval 0 If the 2 SigGroupHeads sent as args do not match. */ char SigGroupHeadCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { SigGroupHead *sgh1 = (SigGroupHead *)data1; SigGroupHead *sgh2 = (SigGroupHead *)data2; if (data1 == NULL || data2 == NULL) return 0; if (sgh1->init->sig_size != sgh2->init->sig_size) return 0; if (SCMemcmp(sgh1->init->sig_array, sgh2->init->sig_array, sgh1->init->sig_size) != 0) return 0; return 1; } /** * \brief Initializes the hash table in the detection engine context to hold the * SigGroupHeads. * * \param de_ctx Pointer to the detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int SigGroupHeadHashInit(DetectEngineCtx *de_ctx) { de_ctx->sgh_hash_table = HashListTableInit(4096, SigGroupHeadHashFunc, SigGroupHeadCompareFunc, NULL); if (de_ctx->sgh_hash_table == NULL) goto error; return 0; error: return -1; } /** * \brief Adds a SigGroupHead to the detection engine context SigGroupHead * hash table. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the SigGroupHead. * * \retval ret 0 on Successfully adding the SigGroupHead; -1 on failure. */ int SigGroupHeadHashAdd(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { int ret = HashListTableAdd(de_ctx->sgh_hash_table, (void *)sgh, 0); return ret; } int SigGroupHeadHashRemove(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { return HashListTableRemove(de_ctx->sgh_hash_table, (void *)sgh, 0); } /** * \brief Used to lookup a SigGroupHead hash from the detection engine context * SigGroupHead hash table. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the SigGroupHead. * * \retval rsgh On success a pointer to the SigGroupHead if the SigGroupHead is * found in the hash table; NULL on failure. */ SigGroupHead *SigGroupHeadHashLookup(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { SCEnter(); SigGroupHead *rsgh = HashListTableLookup(de_ctx->sgh_hash_table, (void *)sgh, 0); SCReturnPtr(rsgh, "SigGroupHead"); } /** * \brief Frees the hash table - DetectEngineCtx->sgh_hash_table, allocated by * SigGroupHeadHashInit() function. * * \param de_ctx Pointer to the detection engine context. */ void SigGroupHeadHashFree(DetectEngineCtx *de_ctx) { if (de_ctx->sgh_hash_table == NULL) return; HashListTableFree(de_ctx->sgh_hash_table); de_ctx->sgh_hash_table = NULL; return; } /** * \brief Add a Signature to a SigGroupHead. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to a SigGroupHead. Can be NULL also. * \param s Pointer to the Signature that has to be added to the * SigGroupHead. * * \retval 0 On success. * \retval -1 On failure. */ int SigGroupHeadAppendSig(const DetectEngineCtx *de_ctx, SigGroupHead **sgh, const Signature *s) { if (de_ctx == NULL) return 0; /* see if we have a head already */ if (*sgh == NULL) { *sgh = SigGroupHeadAlloc(de_ctx, DetectEngineGetMaxSigId(de_ctx) / 8 + 1); if (*sgh == NULL) goto error; } /* enable the sig in the bitarray */ (*sgh)->init->sig_array[s->num / 8] |= 1 << (s->num % 8); return 0; error: return -1; } /** * \brief Clears the bitarray holding the sids for this SigGroupHead. * * \param sgh Pointer to the SigGroupHead. * * \retval 0 Always. */ int SigGroupHeadClearSigs(SigGroupHead *sgh) { if (sgh == NULL) return 0; if (sgh->init->sig_array != NULL) memset(sgh->init->sig_array, 0, sgh->init->sig_size); sgh->sig_cnt = 0; return 0; } /** * \brief Copies the bitarray holding the sids from the source SigGroupHead to * the destination SigGroupHead. * * \param de_ctx Pointer to the detection engine context. * \param src Pointer to the source SigGroupHead. * \param dst Pointer to the destination SigGroupHead. * * \retval 0 On success. * \retval -1 On failure. */ int SigGroupHeadCopySigs(DetectEngineCtx *de_ctx, SigGroupHead *src, SigGroupHead **dst) { uint32_t idx = 0; if (src == NULL || de_ctx == NULL) return 0; if (*dst == NULL) { *dst = SigGroupHeadAlloc(de_ctx, DetectEngineGetMaxSigId(de_ctx) / 8 + 1); if (*dst == NULL) goto error; } /* do the copy */ for (idx = 0; idx < src->init->sig_size; idx++) (*dst)->init->sig_array[idx] = (*dst)->init->sig_array[idx] | src->init->sig_array[idx]; if (src->init->whitelist) (*dst)->init->whitelist = MAX((*dst)->init->whitelist, src->init->whitelist); return 0; error: return -1; } /** * \brief Updates the SigGroupHead->sig_cnt with the total count of all the * Signatures present in this SigGroupHead. * * \param sgh Pointer to the SigGroupHead. * \param max_idx Maximum sid of the all the Signatures present in this * SigGroupHead. */ void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx) { uint32_t sig; sgh->sig_cnt = 0; for (sig = 0; sig < max_idx + 1; sig++) { if (sgh->init->sig_array[sig / 8] & (1 << (sig % 8))) sgh->sig_cnt++; } return; } void SigGroupHeadSetProtoAndDirection(SigGroupHead *sgh, uint8_t ipproto, int dir) { if (sgh && sgh->init) { SCLogDebug("setting proto %u and dir %d on sgh %p", ipproto, dir, sgh); sgh->init->protos[ipproto] = 1; sgh->init->direction |= dir; } } /** * \brief Helper function used to print the list of sids for the Signatures * present in this SigGroupHead. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the SigGroupHead. */ void SigGroupHeadPrintSigs(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { SCEnter(); if (sgh == NULL) { SCReturn; } uint32_t u; SCLogDebug("The Signatures present in this SigGroupHead are: "); for (u = 0; u < (sgh->init->sig_size * 8); u++) { if (sgh->init->sig_array[u / 8] & (1 << (u % 8))) { SCLogDebug("%" PRIu32, u); printf("s->num %"PRIu32" ", u); } } SCReturn; } /** * \brief Create an array with all the internal ids of the sigs that this * sig group head will check for. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the SigGroupHead. * \param max_idx The maximum value of the sid in the SigGroupHead arg. * * \retval 0 success * \retval -1 error */ int SigGroupHeadBuildMatchArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx) { Signature *s = NULL; uint32_t idx = 0; uint32_t sig = 0; if (sgh == NULL) return 0; BUG_ON(sgh->match_array != NULL); sgh->match_array = SCMalloc(sgh->sig_cnt * sizeof(Signature *)); if (sgh->match_array == NULL) return -1; memset(sgh->match_array,0, sgh->sig_cnt * sizeof(Signature *)); for (sig = 0; sig < max_idx + 1; sig++) { if (!(sgh->init->sig_array[(sig / 8)] & (1 << (sig % 8))) ) continue; s = de_ctx->sig_array[sig]; if (s == NULL) continue; sgh->match_array[idx] = s; idx++; } return 0; } /** * \brief Set the need magic flag in the sgh. * * \param de_ctx detection engine ctx for the signatures * \param sgh sig group head to set the flag in */ void SigGroupHeadSetFilemagicFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { #ifdef HAVE_MAGIC Signature *s = NULL; uint32_t sig = 0; if (sgh == NULL) return; for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (SignatureIsFilemagicInspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMAGIC; break; } } #endif return; } /** * \brief Set the need size flag in the sgh. * * \param de_ctx detection engine ctx for the signatures * \param sgh sig group head to set the flag in */ void SigGroupHeadSetFilesizeFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { Signature *s = NULL; uint32_t sig = 0; if (sgh == NULL) return; for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (SignatureIsFilesizeInspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILESIZE; break; } } return; } /** * \brief Set the need hash flag in the sgh. * * \param de_ctx detection engine ctx for the signatures * \param sgh sig group head to set the flag in */ void SigGroupHeadSetFileHashFlag(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { Signature *s = NULL; uint32_t sig = 0; if (sgh == NULL) return; for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (SignatureIsFileMd5Inspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMD5; SCLogDebug("sgh %p has filemd5", sgh); break; } if (SignatureIsFileSha1Inspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILESHA1; SCLogDebug("sgh %p has filesha1", sgh); break; } if (SignatureIsFileSha256Inspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILESHA256; SCLogDebug("sgh %p has filesha256", sgh); break; } } return; } /** * \brief Set the filestore_cnt in the sgh. * * \param de_ctx detection engine ctx for the signatures * \param sgh sig group head to set the counter in */ void SigGroupHeadSetFilestoreCount(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { Signature *s = NULL; uint32_t sig = 0; if (sgh == NULL) return; for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (SignatureIsFilestoring(s)) { sgh->filestore_cnt++; } } return; } /** \brief build an array of rule id's for sigs with no prefilter * Also updated de_ctx::non_pf_store_cnt_max to track the highest cnt */ int SigGroupHeadBuildNonPrefilterArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { Signature *s = NULL; uint32_t sig = 0; uint32_t non_pf = 0; uint32_t non_pf_syn = 0; if (sgh == NULL) return 0; BUG_ON(sgh->non_pf_other_store_array != NULL); for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (!(s->flags & SIG_FLAG_PREFILTER) || (s->flags & SIG_FLAG_MPM_NEG)) { if (!(DetectFlagsSignatureNeedsSynPackets(s))) { non_pf++; } non_pf_syn++; } } if (non_pf == 0 && non_pf_syn == 0) { sgh->non_pf_other_store_array = NULL; sgh->non_pf_syn_store_array = NULL; return 0; } if (non_pf > 0) { sgh->non_pf_other_store_array = SCMalloc(non_pf * sizeof(SignatureNonPrefilterStore)); BUG_ON(sgh->non_pf_other_store_array == NULL); memset(sgh->non_pf_other_store_array, 0, non_pf * sizeof(SignatureNonPrefilterStore)); } if (non_pf_syn > 0) { sgh->non_pf_syn_store_array = SCMalloc(non_pf_syn * sizeof(SignatureNonPrefilterStore)); BUG_ON(sgh->non_pf_syn_store_array == NULL); memset(sgh->non_pf_syn_store_array, 0, non_pf_syn * sizeof(SignatureNonPrefilterStore)); } for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (!(s->flags & SIG_FLAG_PREFILTER) || (s->flags & SIG_FLAG_MPM_NEG)) { if (!(DetectFlagsSignatureNeedsSynPackets(s))) { BUG_ON(sgh->non_pf_other_store_cnt >= non_pf); BUG_ON(sgh->non_pf_other_store_array == NULL); sgh->non_pf_other_store_array[sgh->non_pf_other_store_cnt].id = s->num; sgh->non_pf_other_store_array[sgh->non_pf_other_store_cnt].mask = s->mask; sgh->non_pf_other_store_cnt++; } BUG_ON(sgh->non_pf_syn_store_cnt >= non_pf_syn); BUG_ON(sgh->non_pf_syn_store_array == NULL); sgh->non_pf_syn_store_array[sgh->non_pf_syn_store_cnt].id = s->num; sgh->non_pf_syn_store_array[sgh->non_pf_syn_store_cnt].mask = s->mask; sgh->non_pf_syn_store_cnt++; } } /* track highest cnt for any sgh in our de_ctx */ uint32_t max = MAX(sgh->non_pf_other_store_cnt, sgh->non_pf_syn_store_cnt); if (max > de_ctx->non_pf_store_cnt_max) de_ctx->non_pf_store_cnt_max = max; return 0; } /** * \brief Check if a SigGroupHead contains a Signature, whose sid is sent as an * argument. * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the SigGroupHead that has to be checked for the * presence of a Signature. * \param sid The Signature id(sid) that has to be checked in the SigGroupHead. * * \retval 1 On successfully finding the sid in the SigGroupHead. * \retval 0 If the sid is not found in the SigGroupHead */ int SigGroupHeadContainsSigId(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid) { SCEnter(); uint32_t sig = 0; Signature *s = NULL; uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx); if (sgh == NULL) { SCReturnInt(0); } for (sig = 0; sig < max_sid; sig++) { if (sgh->init->sig_array == NULL) { SCReturnInt(0); } /* Check if the SigGroupHead has an entry for the sid */ if ( !(sgh->init->sig_array[sig / 8] & (1 << (sig % 8))) ) continue; /* If we have reached here, we have an entry for sid in the SigGrouHead. * Retrieve the Signature from the detection engine context */ s = de_ctx->sig_array[sig]; if (s == NULL) continue; /* If the retrieved Signature matches the sid arg, we have a match */ if (s->id == sid) { SCReturnInt(1); } } SCReturnInt(0); } /*----------------------------------Unittests---------------------------------*/ #ifdef UNITTESTS int SigAddressPrepareStage1(DetectEngineCtx *); /** * \test Check if a SigGroupHead hash table is properly allocated and * deallocated when calling SigGroupHeadHashInit() and * SigGroupHeadHashFree() respectively. */ static int SigGroupHeadTest03(void) { int result = 1; DetectEngineCtx de_ctx; SigGroupHeadHashInit(&de_ctx); result &= (de_ctx.sgh_hash_table != NULL); SigGroupHeadHashFree(&de_ctx); result &= (de_ctx.sgh_hash_table == NULL); return result; } /** * \test Check if a SigGroupHeadAppendSig() correctly appends a sid to a * SigGroupHead() and SigGroupHeadContainsSigId() correctly indicates * the presence of a sid. */ static int SigGroupHeadTest06(void) { int result = 1; SigGroupHead *sh = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature *prev_sig = NULL; if (de_ctx == NULL) return 0; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:0;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } prev_sig = de_ctx->sig_list; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:1;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:2;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:3;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:4;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; SigAddressPrepareStage1(de_ctx); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next->next->next); SigGroupHeadSetSigCnt(sh, 4); result &= (sh->sig_cnt == 3); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 0) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 1) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 2) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 3) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 4) == 1); SigGroupHeadFree(sh); end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if a SigGroupHeadAppendSig(), correctly appends a sid to a * SigGroupHead() and SigGroupHeadContainsSigId(), correctly indicates * the presence of a sid and SigGroupHeadClearSigs(), correctly clears * the SigGroupHead->sig_array and SigGroupHead->sig_cnt. */ static int SigGroupHeadTest07(void) { int result = 1; SigGroupHead *sh = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature *prev_sig = NULL; if (de_ctx == NULL) return 0; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:0;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } prev_sig = de_ctx->sig_list; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:1;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:2;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:3;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:4;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; SigAddressPrepareStage1(de_ctx); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next->next->next); SigGroupHeadSetSigCnt(sh, 4); result &= (sh->sig_cnt == 3); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 0) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 1) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 2) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 3) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 4) == 1); SigGroupHeadClearSigs(sh); result &= (sh->sig_cnt == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 0) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 1) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 2) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 3) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, sh, 4) == 0); SigGroupHeadFree(sh); end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if SigGroupHeadCopySigs(), correctly copies the sig_array from * the source to the destination SigGroupHead. */ static int SigGroupHeadTest08(void) { int result = 1; SigGroupHead *src_sh = NULL; SigGroupHead *dst_sh = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature *prev_sig = NULL; if (de_ctx == NULL) return 0; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:0;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } prev_sig = de_ctx->sig_list; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:1;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:2;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:3;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:4;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; SigAddressPrepareStage1(de_ctx); SigGroupHeadAppendSig(de_ctx, &src_sh, de_ctx->sig_list); SigGroupHeadAppendSig(de_ctx, &src_sh, de_ctx->sig_list->next->next); SigGroupHeadAppendSig(de_ctx, &src_sh, de_ctx->sig_list->next->next->next->next); SigGroupHeadSetSigCnt(src_sh, 4); result &= (src_sh->sig_cnt == 3); result &= (SigGroupHeadContainsSigId(de_ctx, src_sh, 0) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, src_sh, 1) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, src_sh, 2) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, src_sh, 3) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, src_sh, 4) == 1); SigGroupHeadCopySigs(de_ctx, src_sh, &dst_sh); SigGroupHeadSetSigCnt(dst_sh, 4); result &= (dst_sh->sig_cnt == 3); result &= (SigGroupHeadContainsSigId(de_ctx, dst_sh, 0) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, dst_sh, 1) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, dst_sh, 2) == 1); result &= (SigGroupHeadContainsSigId(de_ctx, dst_sh, 3) == 0); result &= (SigGroupHeadContainsSigId(de_ctx, dst_sh, 4) == 1); SigGroupHeadFree(src_sh); SigGroupHeadFree(dst_sh); end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if SigGroupHeadBuildMatchArray(), correctly updates the * match array with the sids. */ static int SigGroupHeadTest09(void) { int result = 1; SigGroupHead *sh = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature *prev_sig = NULL; if (de_ctx == NULL) return 0; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:0;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } prev_sig = de_ctx->sig_list; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:1;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:2;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:3;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; prev_sig->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"SigGroupHead tests\"; content:\"test1\"; " "content:\"test2\"; content:\"test3\"; sid:4;)"); if (prev_sig->next == NULL) { result = 0; goto end; } prev_sig = prev_sig->next; SigAddressPrepareStage1(de_ctx); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next); SigGroupHeadAppendSig(de_ctx, &sh, de_ctx->sig_list->next->next->next->next); SigGroupHeadSetSigCnt(sh, 4); SigGroupHeadBuildMatchArray(de_ctx, sh, 4); result &= (sh->match_array[0] == de_ctx->sig_list); result &= (sh->match_array[1] == de_ctx->sig_list->next->next); result &= (sh->match_array[2] == de_ctx->sig_list->next->next->next->next); SigGroupHeadFree(sh); end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test ICMP(?) sig grouping bug. */ static int SigGroupHeadTest10(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); Signature *s = NULL; Packet *p = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; memset(&th_v, 0, sizeof(ThreadVars)); p = UTHBuildPacketSrcDst(NULL, 0, IPPROTO_ICMP, "192.168.1.1", "1.2.3.4"); p->icmpv4h->type = 5; p->icmpv4h->code = 1; /* originally ip's were p.src.addr_data32[0] = 0xe08102d3; p.dst.addr_data32[0] = 0x3001a8c0; */ if (de_ctx == NULL) return 0; s = DetectEngineAppendSig(de_ctx, "alert icmp 192.168.0.0/16 any -> any any (icode:>1; itype:11; sid:1; rev:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> 192.168.0.0/16 any (icode:1; itype:5; sid:2; rev:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); AddressDebugPrint(&p->dst); SigGroupHead *sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p); if (sgh == NULL) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); return result; } #endif void SigGroupHeadRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SigGroupHeadTest03", SigGroupHeadTest03); UtRegisterTest("SigGroupHeadTest06", SigGroupHeadTest06); UtRegisterTest("SigGroupHeadTest07", SigGroupHeadTest07); UtRegisterTest("SigGroupHeadTest08", SigGroupHeadTest08); UtRegisterTest("SigGroupHeadTest09", SigGroupHeadTest09); UtRegisterTest("SigGroupHeadTest10", SigGroupHeadTest10); #endif } suricata-3.2.1/src/app-layer-htp-xff.c0000644000000000000000000002507613051004444014423 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ignacio Sanchez * \author Duarte Silva */ #include "suricata-common.h" #include "conf.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "app-layer-htp-xff.h" #include "util-misc.h" #include "util-memrchr.h" #include "util-unittest.h" /** XFF header value minimal length */ #define XFF_CHAIN_MINLEN 7 /** XFF header value maximum length */ #define XFF_CHAIN_MAXLEN 256 /** Default XFF header name */ #define XFF_DEFAULT "X-Forwarded-For" /** \internal * \brief parse XFF string * \param input input string, might be modified * \param output output buffer * \param output_size size of output buffer * \retval bool 1 ok, 0 fail */ static int ParseXFFString(char *input, char *output, int output_size) { size_t len = strlen(input); if (len == 0) return 0; if (input[0] == '[') { char *end = strchr(input, ']'); if (end == NULL) // malformed, not closed return 0; if (end != input+(len - 1)) { SCLogDebug("data after closing bracket"); // if we ever want to parse the port, we can do it here } /* done, lets wrap up */ input++; // skip past [ *end = '\0'; // overwrite ], ignore anything after } else { /* lets see if the xff string ends in a port */ int c = 0; int d = 0; char *p = input; while (*p != '\0') { if (*p == ':') c++; if (*p == '.') d++; p++; } /* 3 dots: ipv4, one ':' port */ if (d == 3 && c == 1) { SCLogDebug("XFF w port %s", input); char *x = strchr(input, ':'); if (x) { *x = '\0'; SCLogDebug("XFF w/o port %s", input); // if we ever want to parse the port, we can do it here } } } SCLogDebug("XFF %s", input); /** Sanity check on extracted IP for IPv4 and IPv6 */ uint32_t ip[4]; if (inet_pton(AF_INET, input, ip) == 1 || inet_pton(AF_INET6, input, ip) == 1) { strlcpy(output, input, output_size); return 1; // OK } return 0; } /** * \brief Function to return XFF IP if any in the selected transaction. The * caller needs to lock the flow. * \retval 1 if the IP has been found and returned in dstbuf * \retval 0 if the IP has not being found or error */ int HttpXFFGetIPFromTx(const Packet *p, uint64_t tx_id, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen) { uint8_t xff_chain[XFF_CHAIN_MAXLEN]; HtpState *htp_state = NULL; htp_tx_t *tx = NULL; uint64_t total_txs = 0; uint8_t *p_xff = NULL; htp_state = (HtpState *)FlowGetAppState(p->flow); if (htp_state == NULL) { SCLogDebug("no http state, XFF IP cannot be retrieved"); return 0; } total_txs = AppLayerParserGetTxCnt(p->flow->proto, ALPROTO_HTTP, htp_state); if (tx_id >= total_txs) return 0; tx = AppLayerParserGetTx(p->flow->proto, ALPROTO_HTTP, htp_state, tx_id); if (tx == NULL) { SCLogDebug("tx is NULL, XFF cannot be retrieved"); return 0; } htp_header_t *h_xff = NULL; if (tx->request_headers != NULL) { h_xff = htp_table_get_c(tx->request_headers, xff_cfg->header); } if (h_xff != NULL && bstr_len(h_xff->value) >= XFF_CHAIN_MINLEN && bstr_len(h_xff->value) < XFF_CHAIN_MAXLEN) { memcpy(xff_chain, bstr_ptr(h_xff->value), bstr_len(h_xff->value)); xff_chain[bstr_len(h_xff->value)]=0; if (xff_cfg->flags & XFF_REVERSE) { /** Get the last IP address from the chain */ p_xff = memrchr(xff_chain, ' ', bstr_len(h_xff->value)); if (p_xff == NULL) { p_xff = xff_chain; } else { p_xff++; } } else { /** Get the first IP address from the chain */ p_xff = memchr(xff_chain, ',', bstr_len(h_xff->value)); if (p_xff != NULL) { *p_xff = 0; } p_xff = xff_chain; } return ParseXFFString((char *)p_xff, dstbuf, dstbuflen); } return 0; } /** * \brief Function to return XFF IP if any. The caller needs to lock the flow. * \retval 1 if the IP has been found and returned in dstbuf * \retval 0 if the IP has not being found or error */ int HttpXFFGetIP(const Packet *p, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen) { HtpState *htp_state = NULL; uint64_t tx_id = 0; uint64_t total_txs = 0; htp_state = (HtpState *)FlowGetAppState(p->flow); if (htp_state == NULL) { SCLogDebug("no http state, XFF IP cannot be retrieved"); goto end; } total_txs = AppLayerParserGetTxCnt(p->flow->proto, ALPROTO_HTTP, htp_state); for (; tx_id < total_txs; tx_id++) { if (HttpXFFGetIPFromTx(p, tx_id, xff_cfg, dstbuf, dstbuflen) == 1) return 1; } end: return 0; // Not found } /** * \brief Function to return XFF configuration from a configuration node. */ void HttpXFFGetCfg(ConfNode *conf, HttpXFFCfg *result) { BUG_ON(conf == NULL || result == NULL); ConfNode *xff_node = NULL; if (conf != NULL) xff_node = ConfNodeLookupChild(conf, "xff"); if (xff_node != NULL && ConfNodeChildValueIsTrue(xff_node, "enabled")) { const char *xff_mode = ConfNodeLookupChildValue(xff_node, "mode"); if (xff_mode != NULL && strcasecmp(xff_mode, "overwrite") == 0) { result->flags |= XFF_OVERWRITE; } else { if (xff_mode == NULL) { SCLogWarning(SC_WARN_XFF_INVALID_MODE, "The XFF mode hasn't been defined, falling back to extra-data mode"); } else if (strcasecmp(xff_mode, "extra-data") != 0) { SCLogWarning(SC_WARN_XFF_INVALID_MODE, "The XFF mode %s is invalid, falling back to extra-data mode", xff_mode); } result->flags |= XFF_EXTRADATA; } const char *xff_deployment = ConfNodeLookupChildValue(xff_node, "deployment"); if (xff_deployment != NULL && strcasecmp(xff_deployment, "forward") == 0) { result->flags |= XFF_FORWARD; } else { if (xff_deployment == NULL) { SCLogWarning(SC_WARN_XFF_INVALID_DEPLOYMENT, "The XFF deployment hasn't been defined, falling back to reverse proxy deployment"); } else if (strcasecmp(xff_deployment, "reverse") != 0) { SCLogWarning(SC_WARN_XFF_INVALID_DEPLOYMENT, "The XFF mode %s is invalid, falling back to reverse proxy deployment", xff_deployment); } result->flags |= XFF_REVERSE; } const char *xff_header = ConfNodeLookupChildValue(xff_node, "header"); if (xff_header != NULL) { result->header = (char *) xff_header; } else { SCLogWarning(SC_WARN_XFF_INVALID_HEADER, "The XFF header hasn't been defined, using the default %s", XFF_DEFAULT); result->header = XFF_DEFAULT; } } else { result->flags = XFF_DISABLED; } } #ifdef UNITTESTS static int XFFTest01(void) { char input[] = "1.2.3.4:5678"; char output[16]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "1.2.3.4") == 0) { return 1; } return 0; } static int XFFTest02(void) { char input[] = "[12::34]:1234"; // thanks chort! char output[16]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "12::34") == 0) { return 1; } return 0; } static int XFFTest03(void) { char input[] = "[2a03:2880:1010:3f02:face:b00c:0:2]:80"; // thanks chort! char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "2a03:2880:1010:3f02:face:b00c:0:2") == 0) { return 1; } return 0; } static int XFFTest04(void) { char input[] = "[2a03:2880:1010:3f02:face:b00c:0:2]"; // thanks chort! char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "2a03:2880:1010:3f02:face:b00c:0:2") == 0) { return 1; } return 0; } static int XFFTest05(void) { char input[] = "[::ffff:1.2.3.4]:1234"; // thanks double-p char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "::ffff:1.2.3.4") == 0) { return 1; } return 0; } static int XFFTest06(void) { char input[] = "12::34"; char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "12::34") == 0) { return 1; } return 0; } static int XFFTest07(void) { char input[] = "1.2.3.4"; char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 1 && strcmp(output, "1.2.3.4") == 0) { return 1; } return 0; } static int XFFTest08(void) { char input[] = "[1.2.3.4:1234"; char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 0) { return 1; } return 0; } static int XFFTest09(void) { char input[] = "999.999.999.999:1234"; char output[46]; int r = ParseXFFString(input, output, sizeof(output)); if (r == 0) { return 1; } return 0; } #endif void HTPXFFParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("XFFTest01", XFFTest01); UtRegisterTest("XFFTest02", XFFTest02); UtRegisterTest("XFFTest03", XFFTest03); UtRegisterTest("XFFTest04", XFFTest04); UtRegisterTest("XFFTest05", XFFTest05); UtRegisterTest("XFFTest06", XFFTest06); UtRegisterTest("XFFTest07", XFFTest07); UtRegisterTest("XFFTest08", XFFTest08); UtRegisterTest("XFFTest09", XFFTest09); #endif } suricata-3.2.1/src/runmode-erf-file.c0000644000000000000000000001622013051004444014306 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-erf-file.h" #include "output.h" #include "detect-engine.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" static const char *default_mode; const char *RunModeErfFileGetDefaultMode(void) { return default_mode; } void RunModeErfFileRegister(void) { default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_ERF_FILE, "single", "Single threaded ERF file mode", RunModeErfFileSingle); RunModeRegisterNewRunMode(RUNMODE_ERF_FILE, "autofp", "Multi threaded ERF file mode. Packets from " "each flow are assigned to a single detect thread", RunModeErfFileAutoFp); return; } int RunModeErfFileSingle(void) { char *file; SCEnter(); if (ConfGet("erf-file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed to get erf-file.file from config."); exit(EXIT_FAILURE); } RunModeInitialize(); TimeModeSetOffline(); /* Basically the same setup as PCAP files. */ ThreadVars *tv = TmThreadCreatePacketHandler(thread_name_single, "packetpool", "packetpool", "packetpool", "packetpool", "pktacqloop"); if (tv == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceiveErfFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, file); tm_module = TmModuleGetByName("DecodeErfFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodeErfFile failed\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); if (TmThreadSpawn(tv) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } SCLogInfo("RunModeErfFileSingle initialised"); SCReturnInt(0); } int RunModeErfFileAutoFp(void) { SCEnter(); char tname[TM_THREAD_NAME_MAX]; char qname[TM_QUEUE_NAME_MAX]; uint16_t cpu = 0; char *queues = NULL; int thread; RunModeInitialize(); char *file = NULL; if (ConfGet("erf-file.file", &file) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving erf-file.file from config"); exit(EXIT_FAILURE); } TimeModeSetOffline(); /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); /* start with cpu 1 so that if we're creating an odd number of detect * threads we're not creating the most on CPU0. */ if (ncpus > 0) cpu = 1; /* always create at least one thread */ int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET); if (thread_max == 0) thread_max = ncpus * threading_detect_ratio; if (thread_max < 1) thread_max = 1; queues = RunmodeAutoFpCreatePickupQueuesString(thread_max); if (queues == NULL) { SCLogError(SC_ERR_RUNMODE, "RunmodeAutoFpCreatePickupQueuesString failed"); exit(EXIT_FAILURE); } /* create the threads */ ThreadVars *tv = TmThreadCreatePacketHandler(thread_name_autofp, "packetpool", "packetpool", queues, "flow", "pktacqloop"); SCFree(queues); if (tv == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } TmModule *tm_module = TmModuleGetByName("ReceiveErfFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, file); tm_module = TmModuleGetByName("DecodeErfFile"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodeErfFile failed\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv, tm_module, NULL); if (threading_set_cpu_affinity) { TmThreadSetCPUAffinity(tv, 0); if (ncpus > 1) TmThreadSetThreadPriority(tv, PRIO_MEDIUM); } if (TmThreadSpawn(tv) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } for (thread = 0; thread < thread_max; thread++) { snprintf(tname, sizeof(tname), "%s#%02d", thread_name_workers, thread+1); snprintf(qname, sizeof(qname), "pickup%d", thread+1); SCLogDebug("tname %s, qname %s", tname, qname); SCLogDebug("Assigning %s affinity to cpu %u", tname, cpu); ThreadVars *tv_detect_ncpu = TmThreadCreatePacketHandler(tname, qname, "flow", "packetpool", "packetpool", "varslot"); if (tv_detect_ncpu == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL); if (threading_set_cpu_affinity) { TmThreadSetCPUAffinity(tv_detect_ncpu, (int)cpu); /* If we have more than one core/cpu, the first Detect thread * (at cpu 0) will have less priority (higher 'nice' value) * In this case we will set the thread priority to +10 (default is 0) */ if (cpu == 0 && ncpus > 1) { TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_LOW); } else if (ncpus > 1) { TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_MEDIUM); } } TmThreadSetGroupName(tv_detect_ncpu, "Detect"); if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } if ((cpu + 1) == ncpus) cpu = 0; else cpu++; } SCLogInfo("RunModeErfFileAutoFp initialised"); SCReturnInt(0); } suricata-3.2.1/src/detect-id.h0000644000000000000000000000206513051004444013017 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __DETECT_ID_H__ #define __DETECT_ID_H__ #define DETECT_IPID_MIN 0 #define DETECT_IPID_MAX 65536 typedef struct DetectIdData_ { uint16_t id; /** ip->id to match */ } DetectIdData; /* prototypes */ void DetectIdRegister (void); #endif /* __DETECT_ID_H__ */ suricata-3.2.1/src/detect-sid.h0000644000000000000000000000162313051004444013201 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_SID_H__ #define __DETECT_SID_H__ /* prototypes */ void DetectSidRegister (void); #endif /* __DETECT_SID_H__ */ suricata-3.2.1/src/detect-detection-filter.c0000644000000000000000000004544313051004444015666 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias * * Implements the detection_filter keyword */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "host.h" #include "detect-detection-filter.h" #include "detect-threshold.h" #include "detect-parse.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #define TRACK_DST 1 #define TRACK_SRC 2 /** *\brief Regex for parsing our detection_filter options */ #define PARSE_REGEX "^\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*,\\s*(track|count|seconds)\\s+(by_src|by_dst|\\d+)\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectDetectionFilterMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectDetectionFilterSetup(DetectEngineCtx *, Signature *, char *); void DetectDetectionFilterRegisterTests(void); void DetectDetectionFilterFree(void *); /** * \brief Registration function for detection_filter: keyword */ void DetectDetectionFilterRegister (void) { sigmatch_table[DETECT_DETECTION_FILTER].name = "detection_filter"; sigmatch_table[DETECT_DETECTION_FILTER].desc = "alert on every match after a threshold has been reached"; sigmatch_table[DETECT_DETECTION_FILTER].url = DOC_URL DOC_VERSION "/rules/thresholding.html#detection-filter"; sigmatch_table[DETECT_DETECTION_FILTER].Match = DetectDetectionFilterMatch; sigmatch_table[DETECT_DETECTION_FILTER].Setup = DetectDetectionFilterSetup; sigmatch_table[DETECT_DETECTION_FILTER].Free = DetectDetectionFilterFree; sigmatch_table[DETECT_DETECTION_FILTER].RegisterTests = DetectDetectionFilterRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_DETECTION_FILTER].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } int DetectDetectionFilterMatch (ThreadVars *thv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { return 1; } /** * \internal * \brief This function is used to parse detection_filter options passed via detection_filter: keyword * * \param rawstr Pointer to the user provided detection_filter options * * \retval df pointer to DetectThresholdData on success * \retval NULL on failure */ DetectThresholdData *DetectDetectionFilterParse (char *rawstr) { DetectThresholdData *df = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; char *args[6] = { NULL, NULL, NULL, NULL, NULL, NULL}; char *copy_str = NULL, *df_opt = NULL; int seconds_found = 0, count_found = 0, track_found = 0; int seconds_pos = 0, count_pos = 0; uint16_t pos = 0; int i = 0; char *saveptr = NULL; copy_str = SCStrdup(rawstr); if (unlikely(copy_str == NULL)) { goto error; } for (pos = 0, df_opt = strtok_r(copy_str,",", &saveptr); pos < strlen(copy_str) && df_opt != NULL; pos++, df_opt = strtok_r(NULL,",", &saveptr)) { if(strstr(df_opt,"count")) count_found++; if(strstr(df_opt,"second")) seconds_found++; if(strstr(df_opt,"track")) track_found++; } SCFree(copy_str); copy_str = NULL; if (count_found != 1 || seconds_found != 1 || track_found != 1) goto error; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 5) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } df = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(df == NULL)) goto error; memset(df,0,sizeof(DetectThresholdData)); df->type = TYPE_DETECTION; for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i] = (char *)str_ptr; if (strncasecmp(args[i],"by_dst",strlen("by_dst")) == 0) df->track = TRACK_DST; if (strncasecmp(args[i],"by_src",strlen("by_src")) == 0) df->track = TRACK_SRC; if (strncasecmp(args[i],"count",strlen("count")) == 0) count_pos = i+1; if (strncasecmp(args[i],"seconds",strlen("seconds")) == 0) seconds_pos = i+1; } if (args[count_pos] == NULL || args[seconds_pos] == NULL) { goto error; } if (ByteExtractStringUint32(&df->count, 10, strlen(args[count_pos]), args[count_pos]) <= 0) { goto error; } if (ByteExtractStringUint32(&df->seconds, 10, strlen(args[seconds_pos]), args[seconds_pos]) <= 0) { goto error; } if (df->count == 0 || df->seconds == 0) { SCLogError(SC_ERR_INVALID_VALUE, "found an invalid value"); goto error; } for (i = 0; i < 6; i++){ if (args[i] != NULL) SCFree(args[i]); } return df; error: for (i = 0; i < 6; i++){ if (args[i] != NULL) SCFree(args[i]); } if (df != NULL) SCFree(df); return NULL; } /** * \internal * \brief this function is used to add the parsed detection_filter into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param rawstr pointer to the user provided detection_filter options * * \retval 0 on Success * \retval -1 on Failure */ int DetectDetectionFilterSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { SCEnter(); DetectThresholdData *df = NULL; SigMatch *sm = NULL; SigMatch *tmpm = NULL; /* checks if there's a previous instance of threshold */ tmpm = SigMatchGetLastSMFromLists(s, 2, DETECT_THRESHOLD, s->sm_lists_tail[DETECT_SM_LIST_MATCH]); if (tmpm != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"detection_filter\" and \"threshold\" are not allowed in the same rule"); SCReturnInt(-1); } /* checks there's no previous instance of detection_filter */ tmpm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists_tail[DETECT_SM_LIST_MATCH]); if (tmpm != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "At most one \"detection_filter\" is allowed per rule"); SCReturnInt(-1); } df = DetectDetectionFilterParse(rawstr); if (df == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_DETECTION_FILTER; sm->ctx = (SigMatchCtx *)df; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); return 0; error: if (df) SCFree(df); if (sm) SCFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with DetectThresholdData * * \param df_ptr pointer to DetectDetectionFilterData */ void DetectDetectionFilterFree(void *df_ptr) { DetectThresholdData *df = (DetectThresholdData *)df_ptr; if (df) SCFree(df); } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-threshold.h" #include "util-time.h" #include "util-hashlist.h" /** * \test DetectDetectionFilterTestParse01 is a test for a valid detection_filter options * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse01 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("track by_dst,count 10,seconds 60"); if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) { DetectDetectionFilterFree(df); return 1; } return 0; } /** * \test DetectDetectionFilterTestParse02 is a test for a invalid detection_filter options * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse02 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("track both,count 10,seconds 60"); if (df && (df->track == TRACK_DST || df->track == TRACK_SRC) && (df->count == 10) && (df->seconds == 60)) { DetectDetectionFilterFree(df); return 0; } return 1; } /** * \test DetectDetectionfilterTestParse03 is a test for a valid detection_filter options in any order * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse03 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("track by_dst, seconds 60, count 10"); if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) { DetectDetectionFilterFree(df); return 1; } return 0; } /** * \test DetectDetectionFilterTestParse04 is a test for an invalid detection_filter options in any order * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse04 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("count 10, track by_dst, seconds 60, count 10"); if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) { DetectDetectionFilterFree(df); return 0; } return 1; } /** * \test DetectDetectionFilterTestParse05 is a test for a valid detection_filter options in any order * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse05 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("count 10, track by_dst, seconds 60"); if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 60)) { DetectDetectionFilterFree(df); return 1; } return 0; } /** * \test DetectDetectionFilterTestParse06 is a test for an invalid value in detection_filter * * \retval 1 on succces * \retval 0 on failure */ int DetectDetectionFilterTestParse06 (void) { DetectThresholdData *df = NULL; df = DetectDetectionFilterParse("count 10, track by_dst, seconds 0"); if (df && (df->track == TRACK_DST) && (df->count == 10) && (df->seconds == 0)) { DetectDetectionFilterFree(df); return 0; } return 1; } /** * \test DetectDetectionFilterTestSig1 is a test for checking the working of detection_filter keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectDetectionFilterTestSig1(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"detection_filter Test\"; detection_filter: track by_dst, count 4, seconds 60; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if(alerts == 4) result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test DetectDetectionFilterTestSig2 is a test for checking the working of detection_filter keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectDetectionFilterTestSig2(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 4, seconds 60; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); if (alerts == 0) result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test drops */ static int DetectDetectionFilterTestSig3(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal(NULL, 0, IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (msg:\"detection_filter Test 2\"; detection_filter: track by_dst, count 2, seconds 60; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 3 && drops == 3) result = 1; else { if (alerts != 3) printf("alerts: %d != 3: ", alerts); if (drops != 3) printf("drops: %d != 3: ", drops); } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } #endif /* UNITTESTS */ void DetectDetectionFilterRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDetectionFilterTestParse01", DetectDetectionFilterTestParse01); UtRegisterTest("DetectDetectionFilterTestParse02", DetectDetectionFilterTestParse02); UtRegisterTest("DetectDetectionFilterTestParse03", DetectDetectionFilterTestParse03); UtRegisterTest("DetectDetectionFilterTestParse04", DetectDetectionFilterTestParse04); UtRegisterTest("DetectDetectionFilterTestParse05", DetectDetectionFilterTestParse05); UtRegisterTest("DetectDetectionFilterTestParse06", DetectDetectionFilterTestParse06); UtRegisterTest("DetectDetectionFilterTestSig1", DetectDetectionFilterTestSig1); UtRegisterTest("DetectDetectionFilterTestSig2", DetectDetectionFilterTestSig2); UtRegisterTest("DetectDetectionFilterTestSig3", DetectDetectionFilterTestSig3); #endif /* UNITTESTS */ } suricata-3.2.1/src/decode-sctp.h0000644000000000000000000000327413051004444013352 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __DECODE_SCTP_H__ #define __DECODE_SCTP_H__ /** size of the packet header without any chunk headers */ #define SCTP_HEADER_LEN 12 /* XXX RAW* needs to be really 'raw', so no ntohs there */ #define SCTP_GET_RAW_SRC_PORT(sctph) ntohs((sctph)->sh_sport) #define SCTP_GET_RAW_DST_PORT(sctph) ntohs((sctph)->sh_dport) #define SCTP_GET_SRC_PORT(p) SCTP_GET_RAW_SRC_PORT(p->sctph) #define SCTP_GET_DST_PORT(p) SCTP_GET_RAW_DST_PORT(p->sctph) typedef struct SCTPHdr_ { uint16_t sh_sport; /* source port */ uint16_t sh_dport; /* destination port */ uint32_t sh_vtag; /* verification tag, defined per flow */ uint32_t sh_sum; /* checksum, computed via crc32 */ } __attribute__((__packed__)) SCTPHdr; #define CLEAR_SCTP_PACKET(p) { \ (p)->sctph = NULL; \ } while (0) void DecodeSCTPRegisterTests(void); #endif /* __DECODE_SCTP_H__ */ suricata-3.2.1/src/decode-afl.c0000644000000000000000000001146213051004444013134 00000000000000/* Copyright (C) 2007-2017 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "decode.h" #include "util-debug.h" #include "util-mem.h" #include "app-layer-detect-proto.h" #include "app-layer.h" #include "tm-threads.h" #include "util-error.h" #include "util-print.h" #include "tmqh-packetpool.h" #include "util-profiling.h" #include "pkt-var.h" #include "util-mpm-ac.h" #include "output.h" #include "output-flow.h" #include "defrag.h" #include "flow.h" #ifdef AFLFUZZ_DECODER /* stateful processing of data as packets. Because AFL in case of a * crash will only safe the last input, we dump all the inputs to a * directory 'dump' with a unique timestamp for the serie and an * incrementing 'id' so that we can 'replay' it in * DecoderParseDataFromFileSerie(). */ int DecoderParseDataFromFile(char *filename, DecoderFunc Decoder) { uint8_t buffer[65536]; struct timeval ts; memset(&ts, 0, sizeof(ts)); gettimeofday(&ts, NULL); uint32_t cnt = 0; DefragInit(); FlowInitConfig(FLOW_QUIET); ThreadVars tv; memset(&tv, 0, sizeof(tv)); DecodeThreadVars *dtv = DecodeThreadVarsAlloc(&tv); DecodeRegisterPerfCounters(dtv, &tv); StatsSetupPrivate(&tv); PacketQueue pq; memset(&pq, 0, sizeof(pq)); #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(1000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); size_t size = fread(&buffer, 1, sizeof(buffer), fp); char outfilename[256]; snprintf(outfilename, sizeof(outfilename), "dump/%u-%u.%u", (uint)ts.tv_sec, (uint)ts.tv_usec, cnt); FILE *out_fp = fopen(outfilename, "w"); BUG_ON(out_fp == NULL); (void)fwrite(buffer, size, 1, out_fp); fclose(out_fp); Packet *p = PacketGetFromAlloc(); if (p != NULL) { PacketSetData(p, buffer, size); (void) Decoder (&tv, dtv, p, buffer, size, &pq); while (1) { Packet *extra_p = PacketDequeue(&pq); if (unlikely(extra_p == NULL)) break; PacketFree(extra_p); } PacketFree(p); } fclose(fp); cnt++; #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ /* if we get here there was no crash, so we can remove our files */ uint32_t x = 0; for (x = 0; x < cnt; x++) { char rmfilename[256]; snprintf(rmfilename, sizeof(rmfilename), "dump/%u-%u.%u", (uint)ts.tv_sec, (uint)ts.tv_usec, x); unlink(rmfilename); } DecodeThreadVarsFree(&tv, dtv); FlowShutdown(); DefragDestroy(); return 0; } /* load a serie of files generated by DecoderParseDataFromFile() in * the same order as it was produced. */ int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder) { uint8_t buffer[65536]; uint32_t cnt = 0; DefragInit(); FlowInitConfig(FLOW_QUIET); ThreadVars tv; memset(&tv, 0, sizeof(tv)); DecodeThreadVars *dtv = DecodeThreadVarsAlloc(&tv); DecodeRegisterPerfCounters(dtv, &tv); StatsSetupPrivate(&tv); PacketQueue pq; memset(&pq, 0, sizeof(pq)); char filename[256]; snprintf(filename, sizeof(filename), "dump/%s.%u", fileprefix, cnt); FILE *fp; while ((fp = fopen(filename, "r")) != NULL) { memset(buffer, 0, sizeof(buffer)); size_t size = fread(&buffer, 1, sizeof(buffer), fp); Packet *p = PacketGetFromAlloc(); if (p != NULL) { PacketSetData(p, buffer, size); (void) Decoder (&tv, dtv, p, buffer, size, &pq); while (1) { Packet *extra_p = PacketDequeue(&pq); if (unlikely(extra_p == NULL)) break; PacketFree(extra_p); } PacketFree(p); } fclose(fp); cnt++; snprintf(filename, sizeof(filename), "dump/%s.%u", fileprefix, cnt); } DecodeThreadVarsFree(&tv, dtv); FlowShutdown(); DefragDestroy(); return 0; } #endif /* AFLFUZZ_DECODER */ suricata-3.2.1/src/detect-filename.h0000644000000000000000000000222613051004444014202 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_FILENAME_H__ #define __DETECT_FILENAME_H__ #include "util-spm-bm.h" typedef struct DetectFilenameData { uint8_t *name; /** name of the file to match */ BmCtx *bm_ctx; /** BM context */ uint16_t len; /** name length */ uint32_t flags; } DetectFilenameData; /* prototypes */ void DetectFilenameRegister (void); #endif /* __DETECT_FILENAME_H__ */ suricata-3.2.1/src/app-layer-smb.h0000644000000000000000000001136013051004444013624 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl */ #ifndef __APP_LAYER_SMB_H__ #define __APP_LAYER_SMB_H__ #include "suricata-common.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "stream.h" #include "app-layer-nbss.h" #include "app-layer-dcerpc-common.h" typedef struct SMBHdr_ { uint8_t protocol[4]; uint8_t command; uint32_t status; uint8_t flags; uint16_t flags2; uint16_t pidhigh; uint64_t securitysignature; uint16_t unused; uint16_t tid; uint16_t pid; uint16_t uid; uint16_t mid; } SMBHdr; #define SMB_HDR_LEN 32 #define MINIMUM_SMB_LEN 35 #define NBSS_SMB_HDRS_LEN 36 typedef struct SMBWordCount_ { uint8_t wordcount; uint8_t wordcountleft; uint8_t *words; } SMBWordCount; typedef struct SMBByteCount_ { uint8_t bytecountbytes; uint16_t bytecount; uint16_t bytecountleft; uint8_t *bytes; } SMBByteCount; typedef struct SMBAndX_ { uint8_t isandx; uint8_t paddingparsed; uint8_t andxcommand; uint8_t maxchainedandx; uint16_t andxoffset; uint16_t andxbytesprocessed; uint16_t datalength; uint16_t datalengthhigh; uint64_t dataoffset; } SMBAndX; typedef struct SMBState_ { NBSSHdr nbss; uint16_t transaction_id; uint16_t bytesprocessed; SMBHdr smb; SMBWordCount wordcount; SMBByteCount bytecount; SMBAndX andx; DCERPC dcerpc; uint8_t dcerpc_present; uint8_t data_needed_for_dir; } SMBState; #define SMB_FLAGS_SERVER_TO_REDIR 0x80 #define SMB_NO_SECONDARY_ANDX_COMMAND 0xff /* http://msdn.microsoft.com/en-us/library/dd327674.aspx */ #define SMB_COM_CREATE_DIRECTORY 0x00 #define SMB_COM_DELETE_DIRECTORY 0x01 #define SMB_COM_OPEN 0x02 #define SMB_COM_CREATE 0x03 #define SMB_COM_CLOSE 0x04 #define SMB_COM_FLUSH 0x05 #define SMB_COM_DELETE 0x06 #define SMB_COM_RENAME 0x07 #define SMB_COM_QUERY_INFORMATION 0x08 #define SMB_COM_SET_INFORMATION 0x09 #define SMB_COM_READ 0x0A #define SMB_COM_WRITE 0x0B #define SMB_COM_LOCK_BYTE_RANGE 0x0C #define SMB_COM_UNLOCK_BYTE_RANGE 0x0D #define SMB_COM_CREATE_TEMPORARY 0x0E #define SMB_COM_CREATE_NEW 0x0F #define SMB_COM_CHECK_DIRECTORY 0x10 #define SMB_COM_PROCESS_EXIT 0x11 #define SMB_COM_SEEK 0x12 #define SMB_COM_LOCK_AND_READ 0x13 #define SMB_COM_WRITE_AND_UNLOCK 0x14 #define SMB_COM_READ_RAW 0x1A #define SMB_COM_READ_MPX 0x1B #define SMB_COM_READ_MPX_SECONDARY 0x1C #define SMB_COM_WRITE_RAW 0x1D #define SMB_COM_WRITE_MPX 0x1E #define SMB_COM_WRITE_COMPLETE 0x20 #define SMB_COM_SET_INFORMATION2 0x22 #define SMB_COM_QUERY_INFORMATION2 0x23 #define SMB_COM_LOCKING_ANDX 0x24 #define SMB_COM_TRANSACTION 0x25 #define SMB_COM_TRANSACTION_SECONDARY 0x26 #define SMB_COM_IOCTL 0x27 #define SMB_COM_IOCTL_SECONDARY 0x28 #define SMB_COM_COPY 0x29 #define SMB_COM_MOVE 0x2A #define SMB_COM_ECHO 0x2B #define SMB_COM_WRITE_AND_CLOSE 0x2C #define SMB_COM_OPEN_ANDX 0x2D #define SMB_COM_READ_ANDX 0x2E #define SMB_COM_WRITE_ANDX 0x2F #define SMB_COM_CLOSE_AND_TREE_DISC 0x31 #define SMB_COM_TRANSACTION2 0x32 #define SMB_COM_TRANSACTION2_SECONDARY 0x33 #define SMB_COM_FIND_CLOSE2 0x34 #define SMB_COM_FIND_NOTIFY_CLOSE 0x35 #define SMB_COM_TREE_CONNECT 0x70 #define SMB_COM_TREE_DISCONNECT 0x71 #define SMB_COM_NEGOTIATE 0x72 #define SMB_COM_SESSION_SETUP_ANDX 0x73 #define SMB_COM_LOGOFF_ANDX 0x74 #define SMB_COM_TREE_CONNECT_ANDX 0x75 #define SMB_COM_QUERY_INFORMATION_DISK 0x80 #define SMB_COM_SEARCH 0x81 #define SMB_COM_FIND 0x82 #define SMB_COM_FIND_UNIQUE 0x83 #define SMB_COM_NT_TRANSACT 0xA0 #define SMB_COM_NT_TRANSACT_SECONDARY 0xA1 #define SMB_COM_NT_CREATE_ANDX 0xA2 #define SMB_COM_NT_CANCEL 0xA4 #define SMB_COM_NT_RENAME 0xA5 #define SMB_COM_OPEN_PRINT_FILE 0xC0 #define SMB_COM_WRITE_PRINT_FILE 0xC1 #define SMB_COM_CLOSE_PRINT_FILE 0xC2 #define SMB_COM_GET_PRINT_QUEUE 0xC3 void RegisterSMBParsers(void); void SMBParserRegisterTests(void); int isAndX(SMBState *smb_state); #endif /* __APP_LAYER_SMB_H__ */ suricata-3.2.1/src/detect-base64-decode.c0000644000000000000000000005631613051004444014733 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-base64-decode.h" #include "util-base64.h" #include "util-byte.h" #include "util-print.h" /* Arbitrary maximum buffer size for decoded base64 data. */ #define BASE64_DECODE_MAX 65535 static const char decode_pattern[] = "\\s*(bytes\\s+(\\d+),?)?" "\\s*(offset\\s+(\\d+),?)?" "\\s*(\\w+)?"; static pcre *decode_pcre = NULL; static pcre_extra *decode_pcre_study = NULL; static int DetectBase64DecodeSetup(DetectEngineCtx *, Signature *, char *); static void DetectBase64DecodeFree(void *); static void DetectBase64DecodeRegisterTests(void); void DetectBase64DecodeRegister(void) { sigmatch_table[DETECT_BASE64_DECODE].name = "base64_decode"; sigmatch_table[DETECT_BASE64_DECODE].desc = "Decodes base64 encoded data."; sigmatch_table[DETECT_BASE64_DECODE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#base64-decode"; sigmatch_table[DETECT_BASE64_DECODE].Setup = DetectBase64DecodeSetup; sigmatch_table[DETECT_BASE64_DECODE].Free = DetectBase64DecodeFree; sigmatch_table[DETECT_BASE64_DECODE].RegisterTests = DetectBase64DecodeRegisterTests; sigmatch_table[DETECT_BASE64_DECODE].flags |= SIGMATCH_PAYLOAD; sigmatch_table[DETECT_BASE64_DECODE].flags |= SIGMATCH_OPTIONAL_OPT; DetectSetupParseRegexes(decode_pattern, &decode_pcre, &decode_pcre_study); } int DetectBase64DecodeDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, const SigMatch *sm, uint8_t *payload, uint32_t payload_len) { DetectBase64Decode *data = (DetectBase64Decode *)sm->ctx; int decode_len; #if 0 printf("Input data:\n"); PrintRawDataFp(stdout, payload, payload_len); #endif if (data->relative) { payload += det_ctx->buffer_offset; payload_len -= det_ctx->buffer_offset; } if (data->offset) { if (data->offset >= payload_len) { return 0; } payload = payload + data->offset; payload_len -= data->offset; } decode_len = MIN(payload_len, data->bytes); #if 0 printf("Decoding:\n"); PrintRawDataFp(stdout, payload, decode_len); #endif det_ctx->base64_decoded_len = DecodeBase64(det_ctx->base64_decoded, payload, decode_len, 0); SCLogDebug("Decoded %d bytes from base64 data.", det_ctx->base64_decoded_len); #if 0 if (det_ctx->base64_decoded_len) { printf("Decoded data:\n"); PrintRawDataFp(stdout, det_ctx->base64_decoded, det_ctx->base64_decoded_len); } #endif return det_ctx->base64_decoded_len > 0; } static int DetectBase64DecodeParse(const char *str, uint32_t *bytes, uint32_t *offset, uint8_t *relative) { static const int max = 30; int ov[max]; int pcre_rc; const char *bytes_str = NULL; const char *offset_str = NULL; const char *relative_str = NULL; int retval = 0; *bytes = 0; *offset = 0; *relative = 0; pcre_rc = pcre_exec(decode_pcre, decode_pcre_study, str, strlen(str), 0, 0, ov, max); if (pcre_rc < 3) { goto error; } if (pcre_rc >= 3) { if (pcre_get_substring((char *)str, ov, max, 2, &bytes_str) > 0) { if (ByteExtractStringUint32(bytes, 10, 0, bytes_str) <= 0) { SCLogError(SC_ERR_INVALID_RULE_ARGUMENT, "Bad value for bytes: \"%s\"", bytes_str); goto error; } } } if (pcre_rc >= 5) { if (pcre_get_substring((char *)str, ov, max, 4, &offset_str)) { if (ByteExtractStringUint32(offset, 10, 0, offset_str) <= 0) { SCLogError(SC_ERR_INVALID_RULE_ARGUMENT, "Bad value for offset: \"%s\"", offset_str); goto error; } } } if (pcre_rc >= 6) { if (pcre_get_substring((char *)str, ov, max, 5, &relative_str)) { if (strcmp(relative_str, "relative") == 0) { *relative = 1; } else { SCLogError(SC_ERR_INVALID_RULE_ARGUMENT, "Invalid argument: \"%s\"", relative_str); goto error; } } } retval = 1; error: if (bytes_str != NULL) { pcre_free_substring(bytes_str); } if (offset_str != NULL) { pcre_free_substring(offset_str); } if (relative_str != NULL) { pcre_free_substring(relative_str); } return retval; } static int DetectBase64DecodeSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { uint32_t bytes = 0; uint32_t offset = 0; uint8_t relative = 0; DetectBase64Decode *data = NULL; int sm_list; SigMatch *sm = NULL; SigMatch *pm = NULL; if (str != NULL) { if (!DetectBase64DecodeParse(str, &bytes, &offset, &relative)) { goto error; } } data = SCCalloc(1, sizeof(DetectBase64Decode)); if (unlikely(data == NULL)) { goto error; } data->bytes = bytes; data->offset = offset; data->relative = relative; if (s->list != DETECT_SM_LIST_NOTSET) { sm_list = s->list; #if 0 if (data->relative) { pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); } #endif } else { /* Copied from detect-isdataat.c. */ pm = SigMatchGetLastSMFromLists(s, 168, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, pm); if (sm_list < 0) { goto error; } } } sm = SigMatchAlloc(); if (sm == NULL) { goto error; } sm->type = DETECT_BASE64_DECODE; sm->ctx = (SigMatchCtx *)data; SigMatchAppendSMToList(s, sm, sm_list); if (!data->bytes) { data->bytes = BASE64_DECODE_MAX; } if (data->bytes > de_ctx->base64_decode_max_len) { de_ctx->base64_decode_max_len = data->bytes; } return 0; error: if (data != NULL) { SCFree(data); } return -1; } static void DetectBase64DecodeFree(void *ptr) { DetectBase64Decode *data = ptr; SCFree(data); } #ifdef UNITTESTS #include "detect-engine.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer-parser.h" #include "flow-util.h" #include "stream-tcp.h" static int DetectBase64TestDecodeParse(void) { int retval = 0; uint32_t bytes = 0; uint32_t offset = 0; uint8_t relative = 0; if (!DetectBase64DecodeParse("bytes 1", &bytes, &offset, &relative)) { goto end; } if (bytes != 1 || offset != 0 || relative != 0) { goto end; } if (!DetectBase64DecodeParse("offset 9", &bytes, &offset, &relative)) { goto end; } if (bytes != 0 || offset != 9 || relative != 0) { goto end; } if (!DetectBase64DecodeParse("relative", &bytes, &offset, &relative)) { goto end; } if (bytes != 0 || offset != 0 || relative != 1) { goto end; } if (!DetectBase64DecodeParse("bytes 1, offset 2", &bytes, &offset, &relative)) { goto end; } if (bytes != 1 || offset != 2 || relative != 0) { goto end; } if (!DetectBase64DecodeParse("bytes 1, offset 2, relative", &bytes, &offset, &relative)) { goto end; } if (bytes != 1 || offset != 2 || relative != 1) { goto end; } if (!DetectBase64DecodeParse("offset 2, relative", &bytes, &offset, &relative)) { goto end; } if (bytes != 0 || offset != 2 || relative != 1) { goto end; } /* Misspelled relative. */ if (DetectBase64DecodeParse("bytes 1, offset 2, relatve", &bytes, &offset, &relative)) { goto end; } /* Misspelled bytes. */ if (DetectBase64DecodeParse("byts 1, offset 2, relatve", &bytes, &offset, &relative)) { goto end; } /* Misspelled offset. */ if (DetectBase64DecodeParse("bytes 1, offst 2, relatve", &bytes, &offset, &relative)) { goto end; } /* Misspelled empty string. */ if (DetectBase64DecodeParse("", &bytes, &offset, &relative)) { goto end; } retval = 1; end: return retval; } /** * Test keyword setup on basic content. */ static int DetectBase64DecodeTestSetup(void) { DetectEngineCtx *de_ctx = NULL; Signature *s; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (" "msg:\"DetectBase64DecodeTestSetup\"; " "base64_decode; content:\"content\"; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s == NULL) { goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } /** * Test keyword setup when the prior rule has a content modifier on * it. */ static int DetectBase64DecodeHttpHeaderTestSetup(void) { DetectEngineCtx *de_ctx = NULL; Signature *s; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (" "msg:\"DetectBase64DecodeTestSetup\"; " "content:\"Authorization: basic \"; http_header; " "base64_decode; content:\"content\"; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s == NULL) { goto end; } /* I'm not complete sure if this list should not be NULL. */ if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { goto end; } /* Test that the http header list is not NULL. */ if (s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL) { goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } static int DetectBase64DecodeTestDecode(void) { ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Packet *p = NULL; int retval = 0; uint8_t payload[] = { 'S', 'G', 'V', 's', 'b', 'G', '8', 'g', 'V', '2', '9', 'y', 'b', 'G', 'Q', '=', }; memset(&tv, 0, sizeof(tv)); if ((de_ctx = DetectEngineCtxInit()) == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"base64 test\"; " "base64_decode; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); if (p == NULL) { goto end; } SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (det_ctx->base64_decoded_len == 0) { goto end; } retval = 1; end: if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&tv, det_ctx); } if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) { UTHFreePacket(p); } return retval; } static int DetectBase64DecodeTestDecodeWithOffset(void) { ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Packet *p = NULL; int retval = 0; uint8_t payload[] = { 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'S', 'G', 'V', 's', 'b', 'G', '8', 'g', 'V', '2', '9', 'y', 'b', 'G', 'Q', '=', }; char decoded[] = "Hello World"; memset(&tv, 0, sizeof(tv)); if ((de_ctx = DetectEngineCtxInit()) == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"base64 test\"; " "base64_decode: offset 8; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); if (p == NULL) { goto end; } SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (det_ctx->base64_decoded_len != (int)strlen(decoded)) { goto end; } if (memcmp(det_ctx->base64_decoded, decoded, strlen(decoded))) { goto end; } retval = 1; end: if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&tv, det_ctx); } if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) { UTHFreePacket(p); } return retval; } static int DetectBase64DecodeTestDecodeLargeOffset(void) { ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Packet *p = NULL; int retval = 0; uint8_t payload[] = { 'S', 'G', 'V', 's', 'b', 'G', '8', 'g', 'V', '2', '9', 'y', 'b', 'G', 'Q', '=', }; memset(&tv, 0, sizeof(tv)); if ((de_ctx = DetectEngineCtxInit()) == NULL) { goto end; } /* Offset is out of range. */ de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"base64 test\"; " "base64_decode: bytes 16, offset 32; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); if (p == NULL) { goto end; } SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (det_ctx->base64_decoded_len != 0) { goto end; } retval = 1; end: if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&tv, det_ctx); } if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) { UTHFreePacket(p); } return retval; } static int DetectBase64DecodeTestDecodeRelative(void) { ThreadVars tv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Packet *p = NULL; int retval = 0; uint8_t payload[] = { 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'a', 'S', 'G', 'V', 's', 'b', 'G', '8', 'g', 'V', '2', '9', 'y', 'b', 'G', 'Q', '=', }; char decoded[] = "Hello World"; memset(&tv, 0, sizeof(tv)); if ((de_ctx = DetectEngineCtxInit()) == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"base64 test\"; " "content:\"aaaaaaaa\"; " "base64_decode: relative; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); p = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); if (p == NULL) { goto end; } SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (det_ctx->base64_decoded_len != (int)strlen(decoded)) { goto end; } if (memcmp(det_ctx->base64_decoded, decoded, strlen(decoded))) { goto end; } retval = 1; end: if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&tv, det_ctx); } if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) { UTHFreePacket(p); } return retval; } #endif static void DetectBase64DecodeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectBase64TestDecodeParse", DetectBase64TestDecodeParse); UtRegisterTest("DetectBase64DecodeTestSetup", DetectBase64DecodeTestSetup); UtRegisterTest("DetectBase64DecodeHttpHeaderTestSetup", DetectBase64DecodeHttpHeaderTestSetup); UtRegisterTest("DetectBase64DecodeTestDecode", DetectBase64DecodeTestDecode); UtRegisterTest("DetectBase64DecodeTestDecodeWithOffset", DetectBase64DecodeTestDecodeWithOffset); UtRegisterTest("DetectBase64DecodeTestDecodeLargeOffset", DetectBase64DecodeTestDecodeLargeOffset); UtRegisterTest("DetectBase64DecodeTestDecodeRelative", DetectBase64DecodeTestDecodeRelative); #endif /* UNITTESTS */ } suricata-3.2.1/src/runmode-tile.c0000644000000000000000000001764613051004444013567 00000000000000/* Copyright (C) 2011-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Ken Steele, Tilera Corporation * * Tilera TILE-Gx runmode support */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-tile.h" #include "output.h" #include "source-mpipe.h" #include "detect-engine.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-device.h" #ifdef HAVE_MPIPE /* Number of configured parallel pipelines. */ int tile_num_pipelines; #endif /* * runmode support for tilegx */ static const char *mpipe_default_mode = "workers"; const char *RunModeTileMpipeGetDefaultMode(void) { return mpipe_default_mode; } void RunModeTileMpipeRegister(void) { #ifdef HAVE_MPIPE RunModeRegisterNewRunMode(RUNMODE_TILERA_MPIPE, "workers", "Workers tilegx mpipe mode, each thread does all" " tasks from acquisition to logging", RunModeTileMpipeWorkers); mpipe_default_mode = "workers"; #endif } #ifdef HAVE_MPIPE void *ParseMpipeConfig(const char *iface) { ConfNode *if_root; ConfNode *mpipe_node; MpipeIfaceConfig *aconf = SCMalloc(sizeof(*aconf)); char *copymodestr; char *out_iface = NULL; if (unlikely(aconf == NULL)) { return NULL; } if (iface == NULL) { SCFree(aconf); return NULL; } strlcpy(aconf->iface, iface, sizeof(aconf->iface)); /* Find initial node */ mpipe_node = ConfGetNode("mpipe.inputs"); if (mpipe_node == NULL) { SCLogInfo("Unable to find mpipe config using default value"); return aconf; } if_root = ConfNodeLookupKeyValue(mpipe_node, "interface", iface); if (if_root == NULL) { SCLogInfo("Unable to find mpipe config for " "interface %s, using default value", iface); return aconf; } if (ConfGetChildValue(if_root, "copy-iface", &out_iface) == 1) { if (strlen(out_iface) > 0) { aconf->out_iface = out_iface; } } aconf->copy_mode = MPIPE_COPY_MODE_NONE; if (ConfGetChildValue(if_root, "copy-mode", ©modestr) == 1) { if (aconf->out_iface == NULL) { SCLogInfo("Copy mode activated but no destination" " iface. Disabling feature"); } else if (strlen(copymodestr) <= 0) { aconf->out_iface = NULL; } else if (strcmp(copymodestr, "ips") == 0) { SCLogInfo("MPIPE IPS mode activated %s->%s", iface, aconf->out_iface); aconf->copy_mode = MPIPE_COPY_MODE_IPS; } else if (strcmp(copymodestr, "tap") == 0) { SCLogInfo("MPIPE TAP mode activated %s->%s", iface, aconf->out_iface); aconf->copy_mode = MPIPE_COPY_MODE_TAP; } else { SCLogError(SC_ERR_RUNMODE, "Invalid mode (expected tap or ips)"); exit(EXIT_FAILURE); } } return aconf; } /** * \brief RunModeTileMpipeWorkers set up to process all modules in each thread. * * \param iface pointer to the name of the interface from which we will * fetch the packets * \retval 0 if all goes well. (If any problem is detected the engine will * exit()) */ int RunModeTileMpipeWorkers(void) { SCEnter(); char tname[TM_THREAD_NAME_MAX]; char *thread_name; TmModule *tm_module; int pipe; RunModeInitialize(); /* Available cpus */ uint16_t ncpus = UtilCpuGetNumProcessorsOnline(); TimeModeSetLive(); unsigned int pipe_max = 1; if (ncpus > 1) pipe_max = ncpus - 1; intmax_t threads; if (ConfGetInt("mpipe.threads", &threads) == 1) { tile_num_pipelines = threads; } else { tile_num_pipelines = pipe_max; } SCLogInfo("%d Tilera worker threads", tile_num_pipelines); ReceiveMpipeInit(); char *mpipe_dev = NULL; int nlive = LiveGetDeviceCount(); if (nlive > 0) { SCLogInfo("Using %d live device(s).", nlive); /*mpipe_dev = LiveGetDevice(0);*/ } else { /* * Attempt to get interface from config file * overrides -i from command line. */ if (ConfGet("mpipe.interface", &mpipe_dev) == 0) { if (ConfGet("mpipe.single_mpipe_dev", &mpipe_dev) == 0) { SCLogError(SC_ERR_RUNMODE, "Failed retrieving " "mpipe.single_mpipe_dev from Conf"); exit(EXIT_FAILURE); } } } /* Get affinity for worker */ cpu_set_t cpus; //int result = tmc_cpus_get_my_affinity(&cpus); int result = tmc_cpus_get_dataplane_cpus(&cpus); if (result < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "tmc_cpus_get_my_affinity() returned=%d", result); SCReturnInt(TM_ECODE_FAILED); } for (pipe = 0; pipe < tile_num_pipelines; pipe++) { char *mpipe_devc; if (nlive > 0) { mpipe_devc = SCStrdup("multi"); } else { mpipe_devc = SCStrdup(mpipe_dev); } if (unlikely(mpipe_devc == NULL)) { printf("ERROR: SCStrdup failed for ReceiveMpipe\n"); exit(EXIT_FAILURE); } snprintf(tname, sizeof(tname), "%s#%02d", thread_name_workers, pipe+1); /* create the threads */ ThreadVars *tv_worker = TmThreadCreatePacketHandler(tname, "packetpool", "packetpool", "packetpool", "packetpool", "pktacqloop"); if (tv_worker == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(EXIT_FAILURE); } tm_module = TmModuleGetByName("ReceiveMpipe"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName failed for ReceiveMpipe\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_worker, tm_module, (void *)mpipe_devc); /* Bind to a single cpu. */ int pipe_cpu = tmc_cpus_find_nth_cpu(&cpus, pipe); tv_worker->rank = pipe; TmThreadSetCPUAffinity(tv_worker, pipe_cpu); tm_module = TmModuleGetByName("DecodeMpipe"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName DecodeMpipe failed\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_worker, tm_module, NULL); tm_module = TmModuleGetByName("FlowWorker"); if (tm_module == NULL) { SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_worker, tm_module, NULL); tm_module = TmModuleGetByName("RespondReject"); if (tm_module == NULL) { printf("ERROR: TmModuleGetByName for RespondReject failed\n"); exit(EXIT_FAILURE); } TmSlotSetFuncAppend(tv_worker, tm_module, NULL); SetupOutputs(tv_worker); if (TmThreadSpawn(tv_worker) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(EXIT_FAILURE); } } return 0; } #endif suricata-3.2.1/src/detect-http-cookie.c0000644000000000000000000010744113051004444014650 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Gurvinder Singh * * Implements the http_cookie keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-error.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-cookie.h" #include "detect-engine-hcd.h" #include "stream-tcp.h" static int DetectHttpCookieSetup (DetectEngineCtx *, Signature *, char *); void DetectHttpCookieRegisterTests(void); void DetectHttpCookieFree(void *); /** * \brief Registration function for keyword: http_cookie */ void DetectHttpCookieRegister(void) { sigmatch_table[DETECT_AL_HTTP_COOKIE].name = "http_cookie"; sigmatch_table[DETECT_AL_HTTP_COOKIE].desc = "content modifier to match only on the HTTP cookie-buffer"; sigmatch_table[DETECT_AL_HTTP_COOKIE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-cookie"; sigmatch_table[DETECT_AL_HTTP_COOKIE].Match = NULL; sigmatch_table[DETECT_AL_HTTP_COOKIE].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_COOKIE].Setup = DetectHttpCookieSetup; sigmatch_table[DETECT_AL_HTTP_COOKIE].Free = DetectHttpCookieFree; sigmatch_table[DETECT_AL_HTTP_COOKIE].RegisterTests = DetectHttpCookieRegisterTests; sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_cookie", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, 2, PrefilterTxRequestCookieRegister); DetectMpmAppLayerRegister("http_cookie", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, 2, PrefilterTxResponseCookieRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, DetectEngineInspectHttpCookie); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, DetectEngineInspectHttpCookie); } /** * \brief this function clears the memory of http_cookie modifier keyword * * \param ptr Pointer to the Detection Cookie data */ void DetectHttpCookieFree(void *ptr) { DetectContentData *hcd = (DetectContentData *)ptr; if (hcd == NULL) return; if (hcd->content != NULL) SCFree(hcd->content); SCFree(hcd); } /** * \brief this function setups the http_cookie modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success * \retval -1 On failure */ static int DetectHttpCookieSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectEngineContentModifierBufferSetup(de_ctx, s, str, DETECT_AL_HTTP_COOKIE, DETECT_SM_LIST_HCDMATCH, ALPROTO_HTTP, NULL); } /******************************** UNITESTS **********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Checks if a http_cookie is registered in a Signature, if content is not * specified in the signature */ int DetectHttpCookieTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; http_cookie;sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_cookie is registered in a Signature, if some parameter * is specified with http_cookie in the signature */ int DetectHttpCookieTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; content:\"me\"; " "http_cookie:woo; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_cookie is registered in a Signature */ int DetectHttpCookieTest03(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; content:\"one\"; " "http_cookie; content:\"two\"; http_cookie; " "content:\"two\"; http_cookie; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; } while (sm != NULL) { if (sm->type == DETECT_CONTENT) { result = 1; } else { printf("expected DETECT_CONTENT for http_cookie, got %d: ", sm->type); goto end; } sm = sm->next; } end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_cookie is registered in a Signature, when fast_pattern * is also specified in the signature (now it should) */ int DetectHttpCookieTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; content:\"one\"; " "fast_pattern; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_cookie is registered in a Signature, when rawbytes is * also specified in the signature */ int DetectHttpCookieTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; content:\"one\"; " "rawbytes; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_cookie is registered in a Signature, when rawbytes is * also specified in the signature */ int DetectHttpCookieTest06(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_cookie\"; content:\"one\"; " "http_cookie; uricontent:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; Signature *s = de_ctx->sig_list; BUG_ON(s->sm_lists[DETECT_SM_LIST_HCDMATCH] == NULL); if (s->sm_lists[DETECT_SM_LIST_HCDMATCH]->type != DETECT_CONTENT) goto end; if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("expected another SigMatch, got NULL: "); goto end; } if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_CONTENT) { goto end; } result = 1; end: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return result; } /** \test Check the signature working to alert when http_cookie is matched . */ static int DetectHttpCookieSigTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatchme\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:\"me\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "cookie\"; content:\"go\"; http_cookie; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sid 2 matched but shouldn't: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest02(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:\"me\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest03(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:\"boo\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest04(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:!\"boo\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest05(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: DuMmY\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:\"dummy\"; nocase; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest06(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: DuMmY\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:\"dummy\"; " "http_cookie; nocase; sid:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 failed to match: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_cookie is not present */ static int DetectHttpCookieSigTest07(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n" "Cookie: dummy\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP cookie\"; content:!\"dummy\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** * \test Check the signature working to alert against set-cookie */ static int DetectHttpCookieSigTest08(void) { int result = 0; Flow f; uint8_t httpbuf_request[] = "GET / HTTP/1.1\r\n" "User-Agent: Mozilla/1.0\r\n" "\r\n"; uint32_t httpbuf_request_len = sizeof(httpbuf_request) - 1; /* minus the \0 */ uint8_t httpbuf_response[] = "HTTP/1.1 200 OK\r\n" "Set-Cookie: response_user_agent\r\n" "\r\n"; uint32_t httpbuf_response_len = sizeof(httpbuf_response) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL, *p2 = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(flow:to_client; content:\"response_user_agent\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* request */ FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf_request, httpbuf_request_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { goto end; } /* response */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf_response, httpbuf_response_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** * \test Check the signature working to alert against cookie/set-cookie */ static int DetectHttpCookieSigTest09(void) { int result = 0; Flow f; uint8_t httpbuf_request[] = "GET / HTTP/1.1\r\n" "Cookie: request_user_agent\r\n" "User-Agent: Mozilla/1.0\r\n" "\r\n"; uint32_t httpbuf_request_len = sizeof(httpbuf_request) - 1; /* minus the \0 */ uint8_t httpbuf_response[] = "HTTP/1.1 200 OK\r\n" "Set-Cookie: response_user_agent\r\n" "\r\n"; uint32_t httpbuf_response_len = sizeof(httpbuf_response) - 1; /* minus the \0 */ TcpSession ssn; Packet *p1 = NULL, *p2 = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(flow:to_server; content:\"request_user_agent\"; " "http_cookie; sid:1;)"); if (s == NULL) { goto end; } s = de_ctx->sig_list->next = SigInit(de_ctx,"alert http any any -> any any " "(flow:to_client; content:\"response_user_agent\"; " "http_cookie; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* request */ FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf_request, httpbuf_request_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!PacketAlertCheck(p1, 1) || PacketAlertCheck(p1, 2)) { goto end; } /* response */ FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf_response, httpbuf_response_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1) || !PacketAlertCheck(p2, 2)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ /** * \brief Register the UNITTESTS for the http_cookie keyword */ void DetectHttpCookieRegisterTests (void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectHttpCookieTest01", DetectHttpCookieTest01); UtRegisterTest("DetectHttpCookieTest02", DetectHttpCookieTest02); UtRegisterTest("DetectHttpCookieTest03", DetectHttpCookieTest03); UtRegisterTest("DetectHttpCookieTest04", DetectHttpCookieTest04); UtRegisterTest("DetectHttpCookieTest05", DetectHttpCookieTest05); UtRegisterTest("DetectHttpCookieTest06", DetectHttpCookieTest06); UtRegisterTest("DetectHttpCookieSigTest01", DetectHttpCookieSigTest01); UtRegisterTest("DetectHttpCookieSigTest02", DetectHttpCookieSigTest02); UtRegisterTest("DetectHttpCookieSigTest03", DetectHttpCookieSigTest03); UtRegisterTest("DetectHttpCookieSigTest04", DetectHttpCookieSigTest04); UtRegisterTest("DetectHttpCookieSigTest05", DetectHttpCookieSigTest05); UtRegisterTest("DetectHttpCookieSigTest06", DetectHttpCookieSigTest06); UtRegisterTest("DetectHttpCookieSigTest07", DetectHttpCookieSigTest07); UtRegisterTest("DetectHttpCookieSigTest08", DetectHttpCookieSigTest08); UtRegisterTest("DetectHttpCookieSigTest09", DetectHttpCookieSigTest09); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/decode.c0000644000000000000000000004421713051004444012400 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup decode Packet decoding * * \brief Code in charge of protocol decoding * * The task of decoding packets is made in different files and * as Suricata is supporting encapsulation there is a potential * recursivity in the call. * * For each protocol a DecodePROTO function is provided. For * example we have DecodeIPV4() for IPv4 and DecodePPP() for * PPP. * * These functions have all a pkt and and a len argument which * are respectively a pointer to the protocol data and the length * of this protocol data. * * \attention The pkt parameter must point to the effective data because * it will be used later to set per protocol pointer like Packet::tcph * * @{ */ /** * \file * * \author Victor Julien * * Decode the raw packet */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "decode.h" #include "util-debug.h" #include "util-mem.h" #include "app-layer-detect-proto.h" #include "app-layer.h" #include "tm-threads.h" #include "util-error.h" #include "util-print.h" #include "tmqh-packetpool.h" #include "util-profiling.h" #include "pkt-var.h" #include "util-mpm-ac.h" #include "output.h" #include "output-flow.h" int DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq, enum DecodeTunnelProto proto) { switch (proto) { case DECODE_TUNNEL_PPP: return DecodePPP(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_IPV4: return DecodeIPV4(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_IPV6: return DecodeIPV6(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_VLAN: return DecodeVLAN(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_ETHERNET: return DecodeEthernet(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_ERSPAN: return DecodeERSPAN(tv, dtv, p, pkt, len, pq); default: SCLogInfo("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.", proto); break; } return TM_ECODE_OK; } /** * \brief Return a malloced packet. */ void PacketFree(Packet *p) { PACKET_DESTRUCTOR(p); SCFree(p); } /** * \brief Finalize decoding of a packet * * This function needs to be call at the end of decode * functions when decoding has been succesful. * */ void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) { if (p->flags & PKT_IS_INVALID) { StatsIncr(tv, dtv->counter_invalid); int i = 0; for (i = 0; i < p->events.cnt; i++) { if (EVENT_IS_DECODER_PACKET_ERROR(p->events.events[i])) { StatsIncr(tv, dtv->counter_invalid_events[p->events.events[i]]); } } } #ifdef __SC_CUDA_SUPPORT__ if (dtv->cuda_vars.mpm_is_cuda) CudaBufferPacket(&dtv->cuda_vars, p); #endif } /** * \brief Get a malloced packet. * * \retval p packet, NULL on error */ Packet *PacketGetFromAlloc(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return NULL; } memset(p, 0, SIZE_OF_PACKET); PACKET_INITIALIZE(p); p->ReleasePacket = PacketFree; p->flags |= PKT_ALLOC; SCLogDebug("allocated a new packet only using alloc..."); PACKET_PROFILING_START(p); return p; } /** * \brief Return a packet to where it was allocated. */ void PacketFreeOrRelease(Packet *p) { if (p->flags & PKT_ALLOC) PacketFree(p); else PacketPoolReturnPacket(p); } /** * \brief Get a packet. We try to get a packet from the packetpool first, but * if that is empty we alloc a packet that is free'd again after * processing. * * \retval p packet, NULL on error */ Packet *PacketGetFromQueueOrAlloc(void) { /* try the pool first */ Packet *p = PacketPoolGetPacket(); if (p == NULL) { /* non fatal, we're just not processing a packet then */ p = PacketGetFromAlloc(); } else { PACKET_PROFILING_START(p); } return p; } inline int PacketCallocExtPkt(Packet *p, int datalen) { if (! p->ext_pkt) { p->ext_pkt = SCCalloc(1, datalen); if (unlikely(p->ext_pkt == NULL)) { SET_PKT_LEN(p, 0); return -1; } } return 0; } /** * \brief Copy data to Packet payload at given offset * * This function copies data/payload to a Packet. It uses the * space allocated at Packet creation (pointed by Packet::pkt) * or allocate some memory (pointed by Packet::ext_pkt) if the * data size is to big to fit in initial space (of size * default_packet_size). * * \param Pointer to the Packet to modify * \param Offset of the copy relatively to payload of Packet * \param Pointer to the data to copy * \param Length of the data to copy */ inline int PacketCopyDataOffset(Packet *p, int offset, uint8_t *data, int datalen) { if (unlikely(offset + datalen > MAX_PAYLOAD_SIZE)) { /* too big */ return -1; } /* Do we have already an packet with allocated data */ if (! p->ext_pkt) { if (offset + datalen <= (int)default_packet_size) { /* data will fit in memory allocated with packet */ memcpy(GET_PKT_DIRECT_DATA(p) + offset, data, datalen); } else { /* here we need a dynamic allocation */ p->ext_pkt = SCMalloc(MAX_PAYLOAD_SIZE); if (unlikely(p->ext_pkt == NULL)) { SET_PKT_LEN(p, 0); return -1; } /* copy initial data */ memcpy(p->ext_pkt, GET_PKT_DIRECT_DATA(p), GET_PKT_DIRECT_MAX_SIZE(p)); /* copy data as asked */ memcpy(p->ext_pkt + offset, data, datalen); } } else { memcpy(p->ext_pkt + offset, data, datalen); } return 0; } /** * \brief Copy data to Packet payload and set packet length * * \param Pointer to the Packet to modify * \param Pointer to the data to copy * \param Length of the data to copy */ inline int PacketCopyData(Packet *p, uint8_t *pktdata, int pktlen) { SET_PKT_LEN(p, (size_t)pktlen); return PacketCopyDataOffset(p, 0, pktdata, pktlen); } /** * \brief Setup a pseudo packet (tunnel) * * \param parent parent packet for this pseudo pkt * \param pkt raw packet data * \param len packet data length * \param proto protocol of the tunneled packet * * \retval p the pseudo packet or NULL if out of memory */ Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint16_t len, enum DecodeTunnelProto proto, PacketQueue *pq) { int ret; SCEnter(); /* get us a packet */ Packet *p = PacketGetFromQueueOrAlloc(); if (unlikely(p == NULL)) { SCReturnPtr(NULL, "Packet"); } /* copy packet and set lenght, proto */ PacketCopyData(p, pkt, len); p->recursion_level = parent->recursion_level + 1; p->ts.tv_sec = parent->ts.tv_sec; p->ts.tv_usec = parent->ts.tv_usec; p->datalink = DLT_RAW; p->tenant_id = parent->tenant_id; /* set the root ptr to the lowest layer */ if (parent->root != NULL) p->root = parent->root; else p->root = parent; /* tell new packet it's part of a tunnel */ SET_TUNNEL_PKT(p); ret = DecodeTunnel(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq, proto); if (unlikely(ret != TM_ECODE_OK)) { /* Not a tunnel packet, just a pseudo packet */ p->root = NULL; UNSET_TUNNEL_PKT(p); TmqhOutputPacketpool(tv, p); SCReturnPtr(NULL, "Packet"); } /* tell parent packet it's part of a tunnel */ SET_TUNNEL_PKT(parent); /* increment tunnel packet refcnt in the root packet */ TUNNEL_INCR_PKT_TPR(p); /* disable payload (not packet) inspection on the parent, as the payload * is the packet we will now run through the system separately. We do * check it against the ip/port/other header checks though */ DecodeSetNoPayloadInspectionFlag(parent); SCReturnPtr(p, "Packet"); } /** * \brief Setup a pseudo packet (reassembled frags) * * Difference with PacketPseudoPktSetup is that this func doesn't increment * the recursion level. It needs to be on the same level as the frags because * we run the flow engine against this and we need to get the same flow. * * \param parent parent packet for this pseudo pkt * \param pkt raw packet data * \param len packet data length * \param proto protocol of the tunneled packet * * \retval p the pseudo packet or NULL if out of memory */ Packet *PacketDefragPktSetup(Packet *parent, uint8_t *pkt, uint16_t len, uint8_t proto) { SCEnter(); /* get us a packet */ Packet *p = PacketGetFromQueueOrAlloc(); if (unlikely(p == NULL)) { SCReturnPtr(NULL, "Packet"); } /* set the root ptr to the lowest layer */ if (parent->root != NULL) p->root = parent->root; else p->root = parent; /* copy packet and set lenght, proto */ if (pkt && len) { PacketCopyData(p, pkt, len); } p->recursion_level = parent->recursion_level; /* NOT incremented */ p->ts.tv_sec = parent->ts.tv_sec; p->ts.tv_usec = parent->ts.tv_usec; p->datalink = DLT_RAW; p->tenant_id = parent->tenant_id; /* tell new packet it's part of a tunnel */ SET_TUNNEL_PKT(p); p->vlan_id[0] = parent->vlan_id[0]; p->vlan_id[1] = parent->vlan_id[1]; p->vlan_idx = parent->vlan_idx; SCReturnPtr(p, "Packet"); } /** * \brief inform defrag "parent" that a pseudo packet is * now assosiated to it. */ void PacketDefragPktSetupParent(Packet *parent) { /* tell parent packet it's part of a tunnel */ SET_TUNNEL_PKT(parent); /* increment tunnel packet refcnt in the root packet */ TUNNEL_INCR_PKT_TPR(parent); /* disable payload (not packet) inspection on the parent, as the payload * is the packet we will now run through the system separately. We do * check it against the ip/port/other header checks though */ DecodeSetNoPayloadInspectionFlag(parent); } void PacketBypassCallback(Packet *p) { /* Don't try to bypass if flow is already out or * if we have failed to do it once */ int state = SC_ATOMIC_GET(p->flow->flow_state); if ((state == FLOW_STATE_LOCAL_BYPASSED) || (state == FLOW_STATE_CAPTURE_BYPASSED)) { return; } if (p->BypassPacketsFlow && p->BypassPacketsFlow(p)) { FlowUpdateState(p->flow, FLOW_STATE_CAPTURE_BYPASSED); } else { FlowUpdateState(p->flow, FLOW_STATE_LOCAL_BYPASSED); } } void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv) { /* register counters */ dtv->counter_pkts = StatsRegisterCounter("decoder.pkts", tv); dtv->counter_bytes = StatsRegisterCounter("decoder.bytes", tv); dtv->counter_invalid = StatsRegisterCounter("decoder.invalid", tv); dtv->counter_ipv4 = StatsRegisterCounter("decoder.ipv4", tv); dtv->counter_ipv6 = StatsRegisterCounter("decoder.ipv6", tv); dtv->counter_eth = StatsRegisterCounter("decoder.ethernet", tv); dtv->counter_raw = StatsRegisterCounter("decoder.raw", tv); dtv->counter_null = StatsRegisterCounter("decoder.null", tv); dtv->counter_sll = StatsRegisterCounter("decoder.sll", tv); dtv->counter_tcp = StatsRegisterCounter("decoder.tcp", tv); dtv->counter_udp = StatsRegisterCounter("decoder.udp", tv); dtv->counter_sctp = StatsRegisterCounter("decoder.sctp", tv); dtv->counter_icmpv4 = StatsRegisterCounter("decoder.icmpv4", tv); dtv->counter_icmpv6 = StatsRegisterCounter("decoder.icmpv6", tv); dtv->counter_ppp = StatsRegisterCounter("decoder.ppp", tv); dtv->counter_pppoe = StatsRegisterCounter("decoder.pppoe", tv); dtv->counter_gre = StatsRegisterCounter("decoder.gre", tv); dtv->counter_vlan = StatsRegisterCounter("decoder.vlan", tv); dtv->counter_vlan_qinq = StatsRegisterCounter("decoder.vlan_qinq", tv); dtv->counter_teredo = StatsRegisterCounter("decoder.teredo", tv); dtv->counter_ipv4inipv6 = StatsRegisterCounter("decoder.ipv4_in_ipv6", tv); dtv->counter_ipv6inipv6 = StatsRegisterCounter("decoder.ipv6_in_ipv6", tv); dtv->counter_mpls = StatsRegisterCounter("decoder.mpls", tv); dtv->counter_avg_pkt_size = StatsRegisterAvgCounter("decoder.avg_pkt_size", tv); dtv->counter_max_pkt_size = StatsRegisterMaxCounter("decoder.max_pkt_size", tv); dtv->counter_erspan = StatsRegisterMaxCounter("decoder.erspan", tv); dtv->counter_flow_memcap = StatsRegisterCounter("flow.memcap", tv); dtv->counter_defrag_ipv4_fragments = StatsRegisterCounter("defrag.ipv4.fragments", tv); dtv->counter_defrag_ipv4_reassembled = StatsRegisterCounter("defrag.ipv4.reassembled", tv); dtv->counter_defrag_ipv4_timeouts = StatsRegisterCounter("defrag.ipv4.timeouts", tv); dtv->counter_defrag_ipv6_fragments = StatsRegisterCounter("defrag.ipv6.fragments", tv); dtv->counter_defrag_ipv6_reassembled = StatsRegisterCounter("defrag.ipv6.reassembled", tv); dtv->counter_defrag_ipv6_timeouts = StatsRegisterCounter("defrag.ipv6.timeouts", tv); dtv->counter_defrag_max_hit = StatsRegisterCounter("defrag.max_frag_hits", tv); int i = 0; for (i = 0; i < DECODE_EVENT_PACKET_MAX; i++) { BUG_ON(i != (int)DEvents[i].code); dtv->counter_invalid_events[i] = StatsRegisterCounter( DEvents[i].event_name, tv); } return; } void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p) { StatsIncr(tv, dtv->counter_pkts); //StatsIncr(tv, dtv->counter_pkts_per_sec); StatsAddUI64(tv, dtv->counter_bytes, GET_PKT_LEN(p)); StatsAddUI64(tv, dtv->counter_avg_pkt_size, GET_PKT_LEN(p)); StatsSetUI64(tv, dtv->counter_max_pkt_size, GET_PKT_LEN(p)); } /** * \brief Debug print function for printing addresses * * \param Address object * * \todo IPv6 */ void AddressDebugPrint(Address *a) { if (a == NULL) return; switch (a->family) { case AF_INET: { char s[16]; PrintInet(AF_INET, (const void *)&a->addr_data32[0], s, sizeof(s)); SCLogDebug("%s", s); break; } } } /** \brief Alloc and setup DecodeThreadVars */ DecodeThreadVars *DecodeThreadVarsAlloc(ThreadVars *tv) { DecodeThreadVars *dtv = NULL; if ( (dtv = SCMalloc(sizeof(DecodeThreadVars))) == NULL) return NULL; memset(dtv, 0, sizeof(DecodeThreadVars)); dtv->app_tctx = AppLayerGetCtxThread(tv); if (OutputFlowLogThreadInit(tv, NULL, &dtv->output_flow_thread_data) != TM_ECODE_OK) { SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed"); DecodeThreadVarsFree(tv, dtv); return NULL; } /** set config defaults */ int vlanbool = 0; if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) { dtv->vlan_disabled = 1; } SCLogDebug("vlan tracking is %s", dtv->vlan_disabled == 0 ? "enabled" : "disabled"); return dtv; } void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv) { if (dtv != NULL) { if (dtv->app_tctx != NULL) AppLayerDestroyCtxThread(dtv->app_tctx); if (dtv->output_flow_thread_data != NULL) OutputFlowLogThreadDeinit(tv, dtv->output_flow_thread_data); SCFree(dtv); } } /** * \brief Set data for Packet and set length when zeo copy is used * * \param Pointer to the Packet to modify * \param Pointer to the data * \param Length of the data */ inline int PacketSetData(Packet *p, uint8_t *pktdata, int pktlen) { SET_PKT_LEN(p, (size_t)pktlen); if (unlikely(!pktdata)) { return -1; } p->ext_pkt = pktdata; p->flags |= PKT_ZERO_COPY; return 0; } const char *PktSrcToString(enum PktSrcEnum pkt_src) { char *pkt_src_str = ""; switch (pkt_src) { case PKT_SRC_WIRE: pkt_src_str = "wire/pcap"; break; case PKT_SRC_DECODER_GRE: pkt_src_str = "gre tunnel"; break; case PKT_SRC_DECODER_IPV4: pkt_src_str = "ipv4 tunnel"; break; case PKT_SRC_DECODER_IPV6: pkt_src_str = "ipv6 tunnel"; break; case PKT_SRC_DECODER_TEREDO: pkt_src_str = "teredo tunnel"; break; case PKT_SRC_DEFRAG: pkt_src_str = "defrag"; break; case PKT_SRC_STREAM_TCP_STREAM_END_PSEUDO: pkt_src_str = "stream"; break; case PKT_SRC_FFR: pkt_src_str = "stream (flow timeout)"; break; } return pkt_src_str; } void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p) { if (unlikely(PACKET_TEST_ACTION(p, (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)))) { StatsIncr(tv, s->counter_ips_rejected); } else if (unlikely(PACKET_TEST_ACTION(p, ACTION_DROP))) { StatsIncr(tv, s->counter_ips_blocked); } else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) { StatsIncr(tv, s->counter_ips_replaced); } else { StatsIncr(tv, s->counter_ips_accepted); } } void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s) { s->counter_ips_accepted = StatsRegisterCounter("ips.accepted", tv); s->counter_ips_blocked = StatsRegisterCounter("ips.blocked", tv); s->counter_ips_rejected = StatsRegisterCounter("ips.rejected", tv); s->counter_ips_replaced = StatsRegisterCounter("ips.replaced", tv); } /** * @} */ suricata-3.2.1/src/detect-engine-event.h0000644000000000000000000000204613051004444015006 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_ENGINE_EVENT_H__ #define __DETECT_ENGINE_EVENT_H__ #include "decode-events.h" typedef struct DetectEngineEventData_ { uint8_t event; } DetectEngineEventData; /* prototypes */ void DetectEngineEventRegister (void); #endif /*__DETECT_ENGINE_EVENT_H__ */ suricata-3.2.1/src/log-httplog.c0000644000000000000000000006567113051004444013424 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Ignacio Sanchez * * Implements http logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-httplog.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "http.log" #define MODULE_NAME "LogHttpLog" #define OUTPUT_BUFFER_SIZE 65535 TmEcode LogHttpLogThreadInit(ThreadVars *, void *, void **); TmEcode LogHttpLogThreadDeinit(ThreadVars *, void *); void LogHttpLogExitPrintStats(ThreadVars *, void *); static void LogHttpLogDeInitCtx(OutputCtx *); int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id); void LogHttpLogRegister (void) { OutputRegisterTxModule(LOGGER_HTTP, MODULE_NAME, "http-log", LogHttpLogInitCtx, ALPROTO_HTTP, LogHttpLogger, LogHttpLogThreadInit, LogHttpLogThreadDeinit, LogHttpLogExitPrintStats); } #define LOG_HTTP_MAXN_NODES 64 #define LOG_HTTP_NODE_STRLEN 256 #define LOG_HTTP_NODE_MAXOUTPUTLEN 8192 #define TIMESTAMP_DEFAULT_FORMAT "%b %d, %Y; %H:%M:%S" #define LOG_HTTP_CF_NONE "-" #define LOG_HTTP_CF_LITERAL '%' #define LOG_HTTP_CF_REQUEST_HOST 'h' #define LOG_HTTP_CF_REQUEST_PROTOCOL 'H' #define LOG_HTTP_CF_REQUEST_METHOD 'm' #define LOG_HTTP_CF_REQUEST_URI 'u' #define LOG_HTTP_CF_REQUEST_TIME 't' #define LOG_HTTP_CF_REQUEST_HEADER 'i' #define LOG_HTTP_CF_REQUEST_COOKIE 'C' #define LOG_HTTP_CF_REQUEST_LEN 'b' #define LOG_HTTP_CF_RESPONSE_STATUS 's' #define LOG_HTTP_CF_RESPONSE_HEADER 'o' #define LOG_HTTP_CF_RESPONSE_LEN 'B' #define LOG_HTTP_CF_TIMESTAMP 't' #define LOG_HTTP_CF_TIMESTAMP_U 'z' #define LOG_HTTP_CF_CLIENT_IP 'a' #define LOG_HTTP_CF_SERVER_IP 'A' #define LOG_HTTP_CF_CLIENT_PORT 'p' #define LOG_HTTP_CF_SERVER_PORT 'P' typedef struct LogHttpCustomFormatNode_ { uint32_t type; /** Node format type. ie: LOG_HTTP_CF_LITERAL, LOG_HTTP_CF_REQUEST_HEADER */ uint32_t maxlen; /** Maximun length of the data */ char data[LOG_HTTP_NODE_STRLEN]; /** optional data. ie: http header name */ } LogHttpCustomFormatNode; typedef struct LogHttpFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ uint32_t cf_n; /** Total number of custom string format nodes */ LogHttpCustomFormatNode *cf_nodes[LOG_HTTP_MAXN_NODES]; /** Custom format string nodes */ } LogHttpFileCtx; #define LOG_HTTP_DEFAULT 0 #define LOG_HTTP_EXTENDED 1 #define LOG_HTTP_CUSTOM 2 typedef struct LogHttpLogThread_ { LogHttpFileCtx *httplog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t uri_cnt; MemBuffer *buffer; } LogHttpLogThread; /* Retrieves the selected cookie value */ static uint32_t GetCookieValue(uint8_t *rawcookies, uint32_t rawcookies_len, char *cookiename, uint8_t **cookievalue) { uint8_t *p = rawcookies; uint8_t *cn = p; /* ptr to cookie name start */ uint8_t *cv = NULL; /* ptr to cookie value start */ while (p < rawcookies + rawcookies_len) { if (cv == NULL && *p == '=') { cv = p + 1; } else if (cv != NULL && (*p == ';' || p == rawcookies + rawcookies_len - 1) ) { /* Found end of cookie */ p++; if (strlen(cookiename) == (unsigned int) (cv-cn-1) && strncmp(cookiename, (char *) cn, cv-cn-1) == 0) { *cookievalue = cv; return (uint32_t) (p-cv); } cv = NULL; cn = p + 1; } p++; } return 0; } /* Custom format logging */ static void LogHttpLogCustom(LogHttpLogThread *aft, htp_tx_t *tx, const struct timeval *ts, char *srcip, Port sp, char *dstip, Port dp) { LogHttpFileCtx *httplog_ctx = aft->httplog_ctx; uint32_t i; uint32_t datalen; char buf[128]; uint8_t *cvalue = NULL; uint32_t cvalue_len = 0; htp_header_t *h_request_hdr; htp_header_t *h_response_hdr; time_t time = ts->tv_sec; struct tm local_tm; struct tm *timestamp = SCLocalTime(time, &local_tm); for (i = 0; i < httplog_ctx->cf_n; i++) { h_request_hdr = NULL; h_response_hdr = NULL; switch (httplog_ctx->cf_nodes[i]->type){ case LOG_HTTP_CF_LITERAL: /* LITERAL */ MemBufferWriteString(aft->buffer, "%s", httplog_ctx->cf_nodes[i]->data); break; case LOG_HTTP_CF_TIMESTAMP: /* TIMESTAMP */ if (httplog_ctx->cf_nodes[i]->data[0] == '\0') { strftime(buf, 62, TIMESTAMP_DEFAULT_FORMAT, timestamp); } else { strftime(buf, 62, httplog_ctx->cf_nodes[i]->data, timestamp); } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)buf,strlen(buf)); break; case LOG_HTTP_CF_TIMESTAMP_U: /* TIMESTAMP USECONDS */ snprintf(buf, 62, "%06u", (unsigned int) ts->tv_usec); PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)buf,strlen(buf)); break; case LOG_HTTP_CF_CLIENT_IP: /* CLIENT IP ADDRESS */ PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)srcip,strlen(srcip)); break; case LOG_HTTP_CF_SERVER_IP: /* SERVER IP ADDRESS */ PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)dstip,strlen(dstip)); break; case LOG_HTTP_CF_CLIENT_PORT: /* CLIENT PORT */ MemBufferWriteString(aft->buffer, "%" PRIu16 "", sp); break; case LOG_HTTP_CF_SERVER_PORT: /* SERVER PORT */ MemBufferWriteString(aft->buffer, "%" PRIu16 "", dp); break; case LOG_HTTP_CF_REQUEST_METHOD: /* METHOD */ if (tx->request_method != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_method), bstr_len(tx->request_method)); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_URI: /* URI */ if (tx->request_uri != NULL) { datalen = httplog_ctx->cf_nodes[i]->maxlen; if (datalen == 0 || datalen > bstr_len(tx->request_uri)) { datalen = bstr_len(tx->request_uri); } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_uri), datalen); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_HOST: /* HOSTNAME */ if (tx->request_hostname != NULL) { datalen = httplog_ctx->cf_nodes[i]->maxlen; if (datalen == 0 || datalen > bstr_len(tx->request_hostname)) { datalen = bstr_len(tx->request_hostname); } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_hostname), datalen); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_PROTOCOL: /* PROTOCOL */ if (tx->request_protocol != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_protocol), bstr_len(tx->request_protocol)); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_HEADER: /* REQUEST HEADER */ if (tx->request_headers != NULL) { h_request_hdr = htp_table_get_c(tx->request_headers, httplog_ctx->cf_nodes[i]->data); } if (h_request_hdr != NULL) { datalen = httplog_ctx->cf_nodes[i]->maxlen; if (datalen == 0 || datalen > bstr_len(h_request_hdr->value)) { datalen = bstr_len(h_request_hdr->value); } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(h_request_hdr->value), datalen); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_COOKIE: /* REQUEST COOKIE */ if (tx->request_headers != NULL) { h_request_hdr = htp_table_get_c(tx->request_headers, "Cookie"); if (h_request_hdr != NULL) { cvalue_len = GetCookieValue((uint8_t *) bstr_ptr(h_request_hdr->value), bstr_len(h_request_hdr->value), (char *) httplog_ctx->cf_nodes[i]->data, &cvalue); } } if (cvalue_len > 0 && cvalue != NULL) { datalen = httplog_ctx->cf_nodes[i]->maxlen; if (datalen == 0 || datalen > cvalue_len) { datalen = cvalue_len; } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, cvalue, datalen); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_REQUEST_LEN: /* REQUEST LEN */ MemBufferWriteString(aft->buffer, "%"PRIuMAX"", (uintmax_t)tx->request_message_len); break; case LOG_HTTP_CF_RESPONSE_STATUS: /* RESPONSE STATUS */ if (tx->response_status != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->response_status), bstr_len(tx->response_status)); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_RESPONSE_HEADER: /* RESPONSE HEADER */ if (tx->response_headers != NULL) { h_response_hdr = htp_table_get_c(tx->response_headers, httplog_ctx->cf_nodes[i]->data); } if (h_response_hdr != NULL) { datalen = httplog_ctx->cf_nodes[i]->maxlen; if (datalen == 0 || datalen > bstr_len(h_response_hdr->value)) { datalen = bstr_len(h_response_hdr->value); } PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(h_response_hdr->value), datalen); } else { MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); } break; case LOG_HTTP_CF_RESPONSE_LEN: /* RESPONSE LEN */ MemBufferWriteString(aft->buffer, "%"PRIuMAX"", (uintmax_t)tx->response_message_len); break; default: /* NO MATCH */ MemBufferWriteString(aft->buffer, LOG_HTTP_CF_NONE); SCLogDebug("No matching parameter %%%c for custom http log.", httplog_ctx->cf_nodes[i]->type); break; } } MemBufferWriteString(aft->buffer, "\n"); } static void LogHttpLogExtended(LogHttpLogThread *aft, htp_tx_t *tx) { MemBufferWriteString(aft->buffer, " [**] "); /* referer */ htp_header_t *h_referer = NULL; if (tx->request_headers != NULL) { h_referer = htp_table_get_c(tx->request_headers, "referer"); } if (h_referer != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(h_referer->value), bstr_len(h_referer->value)); } else { MemBufferWriteString(aft->buffer, ""); } MemBufferWriteString(aft->buffer, " [**] "); /* method */ if (tx->request_method != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_method), bstr_len(tx->request_method)); } MemBufferWriteString(aft->buffer, " [**] "); /* protocol */ if (tx->request_protocol != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_protocol), bstr_len(tx->request_protocol)); } else { MemBufferWriteString(aft->buffer, ""); } MemBufferWriteString(aft->buffer, " [**] "); /* response status */ if (tx->response_status != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->response_status), bstr_len(tx->response_status)); /* Redirect? */ if ((tx->response_status_number > 300) && ((tx->response_status_number) < 303)) { htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location"); if (h_location != NULL) { MemBufferWriteString(aft->buffer, " => "); PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(h_location->value), bstr_len(h_location->value)); } } } else { MemBufferWriteString(aft->buffer, ""); } /* length */ MemBufferWriteString(aft->buffer, " [**] %"PRIuMAX" bytes", (uintmax_t)tx->response_message_len); } static TmEcode LogHttpLogIPWrapper(ThreadVars *tv, void *data, const Packet *p, Flow *f, HtpState *htp_state, htp_tx_t *tx, uint64_t tx_id, int ipproto) { SCEnter(); LogHttpLogThread *aft = (LogHttpLogThread *)data; LogHttpFileCtx *hlog = aft->httplog_ctx; char timebuf[64]; /* check if we have HTTP state or not */ CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); char srcip[46], dstip[46]; Port sp, dp; if ((PKT_IS_TOSERVER(p))) { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); break; default: goto end; } sp = p->sp; dp = p->dp; } else { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), dstip, sizeof(dstip)); break; default: goto end; } sp = p->dp; dp = p->sp; } SCLogDebug("got a HTTP request and now logging !!"); /* reset */ MemBufferReset(aft->buffer); if (hlog->flags & LOG_HTTP_CUSTOM) { LogHttpLogCustom(aft, tx, &p->ts, srcip, sp, dstip, dp); } else { /* time */ MemBufferWriteString(aft->buffer, "%s ", timebuf); /* hostname */ if (tx->request_hostname != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_hostname), bstr_len(tx->request_hostname)); } else { MemBufferWriteString(aft->buffer, ""); } MemBufferWriteString(aft->buffer, " [**] "); /* uri */ if (tx->request_uri != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_uri), bstr_len(tx->request_uri)); } MemBufferWriteString(aft->buffer, " [**] "); /* user agent */ htp_header_t *h_user_agent = NULL; if (tx->request_headers != NULL) { h_user_agent = htp_table_get_c(tx->request_headers, "user-agent"); } if (h_user_agent != NULL) { PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)bstr_ptr(h_user_agent->value), bstr_len(h_user_agent->value)); } else { MemBufferWriteString(aft->buffer, ""); } if (hlog->flags & LOG_HTTP_EXTENDED) { LogHttpLogExtended(aft, tx); } /* ip/tcp header info */ MemBufferWriteString(aft->buffer, " [**] %s:%" PRIu16 " -> %s:%" PRIu16 "\n", srcip, sp, dstip, dp); } aft->uri_cnt ++; SCMutexLock(&hlog->file_ctx->fp_mutex); hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx); SCMutexUnlock(&hlog->file_ctx->fp_mutex); end: SCReturnInt(0); } int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { SCEnter(); if (!(PKT_IS_TCP(p))) { SCReturnInt(TM_ECODE_OK); } int r = 0; if (PKT_IS_IPV4(p)) { r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET); } else if (PKT_IS_IPV6(p)) { r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET6); } SCReturnInt(r); } TmEcode LogHttpLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogHttpLogThread *aft = SCMalloc(sizeof(LogHttpLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogHttpLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for LogHTTPLog. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->httplog_ctx= ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } TmEcode LogHttpLogThreadDeinit(ThreadVars *t, void *data) { LogHttpLogThread *aft = (LogHttpLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogHttpLogThread)); SCFree(aft); return TM_ECODE_OK; } void LogHttpLogExitPrintStats(ThreadVars *tv, void *data) { LogHttpLogThread *aft = (LogHttpLogThread *)data; if (aft == NULL) { return; } //SCLogInfo("HTTP logger logged %" PRIu32 " requests", aft->uri_cnt); } /** \brief Create a new http log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ OutputCtx *LogHttpLogInitCtx(ConfNode *conf) { LogFileCtx* file_ctx = LogFileNewCtx(); const char *p, *np; uint32_t n; if(file_ctx == NULL) { SCLogError(SC_ERR_HTTP_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogHttpFileCtx *httplog_ctx = SCMalloc(sizeof(LogHttpFileCtx)); if (unlikely(httplog_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } memset(httplog_ctx, 0x00, sizeof(LogHttpFileCtx)); httplog_ctx->file_ctx = file_ctx; httplog_ctx->cf_n=0; const char *extended = ConfNodeLookupChildValue(conf, "extended"); const char *custom = ConfNodeLookupChildValue(conf, "custom"); const char *customformat = ConfNodeLookupChildValue(conf, "customformat"); /* If custom logging format is selected, lets parse it */ if (custom != NULL && customformat != NULL && ConfValIsTrue(custom)) { p=customformat; httplog_ctx->flags |= LOG_HTTP_CUSTOM; for (httplog_ctx->cf_n = 0; httplog_ctx->cf_n < LOG_HTTP_MAXN_NODES-1 && p && *p != '\0'; httplog_ctx->cf_n++){ httplog_ctx->cf_nodes[httplog_ctx->cf_n] = SCMalloc(sizeof(LogHttpCustomFormatNode)); if (httplog_ctx->cf_nodes[httplog_ctx->cf_n] == NULL) { for (n = 0; n < httplog_ctx->cf_n; n++) { SCFree(httplog_ctx->cf_nodes[n]); } LogFileFreeCtx(file_ctx); SCFree(httplog_ctx); return NULL; } httplog_ctx->cf_nodes[httplog_ctx->cf_n]->maxlen = 0; if (*p != '%'){ /* Literal found in format string */ httplog_ctx->cf_nodes[httplog_ctx->cf_n]->type = LOG_HTTP_CF_LITERAL; np = strchr(p, '%'); if (np == NULL){ n = LOG_HTTP_NODE_STRLEN-2; np = NULL; /* End */ }else{ n = np-p; } strlcpy(httplog_ctx->cf_nodes[httplog_ctx->cf_n]->data,p,n+1); p = np; } else { /* Non Literal found in format string */ p++; if (*p == '[') { /* Check if maxlength has been specified (ie: [25]) */ p++; np = strchr(p, ']'); if (np != NULL) { if (np-p > 0 && np-p < 10){ long maxlen = strtol(p,NULL,10); if (maxlen > 0 && maxlen < LOG_HTTP_NODE_MAXOUTPUTLEN) { httplog_ctx->cf_nodes[httplog_ctx->cf_n]->maxlen = (uint32_t) maxlen; } } else { goto parsererror; } p = np + 1; } else { goto parsererror; } } if (*p == '{') { /* Simple format char */ np = strchr(p, '}'); if (np != NULL && np-p > 1 && np-p < LOG_HTTP_NODE_STRLEN-2) { p++; n = np-p; strlcpy(httplog_ctx->cf_nodes[httplog_ctx->cf_n]->data, p, n+1); p = np; } else { goto parsererror; } p++; } else { httplog_ctx->cf_nodes[httplog_ctx->cf_n]->data[0] = '\0'; } httplog_ctx->cf_nodes[httplog_ctx->cf_n]->type = *p; if (*p == '%'){ httplog_ctx->cf_nodes[httplog_ctx->cf_n]->type = LOG_HTTP_CF_LITERAL; strlcpy(httplog_ctx->cf_nodes[httplog_ctx->cf_n]->data, "%", 2); } p++; } } } else { if (extended == NULL) { httplog_ctx->flags |= LOG_HTTP_DEFAULT; } else { if (ConfValIsTrue(extended)) { httplog_ctx->flags |= LOG_HTTP_EXTENDED; } } } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { goto parsererror; } output_ctx->data = httplog_ctx; output_ctx->DeInit = LogHttpLogDeInitCtx; SCLogDebug("HTTP log output initialized"); /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP); return output_ctx; parsererror: for (n = 0;n < httplog_ctx->cf_n;n++) { SCFree(httplog_ctx->cf_nodes[n]); } LogFileFreeCtx(file_ctx); SCFree(httplog_ctx); SCLogError(SC_ERR_INVALID_ARGUMENT,"Syntax error in custom http log format string."); return NULL; } static void LogHttpLogDeInitCtx(OutputCtx *output_ctx) { LogHttpFileCtx *httplog_ctx = (LogHttpFileCtx *)output_ctx->data; uint32_t i; for (i = 0; i < httplog_ctx->cf_n; i++) { SCFree(httplog_ctx->cf_nodes[i]); } LogFileFreeCtx(httplog_ctx->file_ctx); SCFree(httplog_ctx); SCFree(output_ctx); } suricata-3.2.1/src/detect-engine-hsbd.c0000644000000000000000000040601513051004444014604 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP response body match corresponding to http_server_body * keyword. * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-htp-mem.h" #include "app-layer-protos.h" #include "conf.h" #include "conf-yaml-loader.h" #include "util-validate.h" #define BUFFER_STEP 50 static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size) { if (size >= (USHRT_MAX - BUFFER_STEP)) return -1; void *ptmp; if (size > det_ctx->hsbd_buffers_size) { ptmp = SCRealloc(det_ctx->hsbd, (det_ctx->hsbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody)); if (ptmp == NULL) { SCFree(det_ctx->hsbd); det_ctx->hsbd = NULL; det_ctx->hsbd_buffers_size = 0; det_ctx->hsbd_buffers_list_len = 0; return -1; } det_ctx->hsbd = ptmp; memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody)); det_ctx->hsbd_buffers_size += BUFFER_STEP; } uint16_t i; for (i = det_ctx->hsbd_buffers_list_len; i < ((uint16_t)size); i++) { det_ctx->hsbd[i].buffer_len = 0; det_ctx->hsbd[i].offset = 0; } return 0; } static const uint8_t *DetectEngineHSBDGetBufferForTX(htp_tx_t *tx, uint64_t tx_id, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Flow *f, HtpState *htp_state, uint8_t flags, uint32_t *buffer_len, uint32_t *stream_start_offset) { int index = 0; const uint8_t *buffer = NULL; *buffer_len = 0; *stream_start_offset = 0; if (det_ctx->hsbd_buffers_list_len == 0) { /* get the inspect id to use as a 'base id' */ uint64_t base_inspect_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); BUG_ON(base_inspect_id > tx_id); /* see how many space we need for the current tx_id */ uint64_t txs = (tx_id - base_inspect_id) + 1; if (HSBDCreateSpace(det_ctx, txs) < 0) goto end; index = (tx_id - base_inspect_id); det_ctx->hsbd_start_tx_id = base_inspect_id; det_ctx->hsbd_buffers_list_len = txs; } else { if ((tx_id - det_ctx->hsbd_start_tx_id) < det_ctx->hsbd_buffers_list_len) { if (det_ctx->hsbd[(tx_id - det_ctx->hsbd_start_tx_id)].buffer_len != 0) { *buffer_len = det_ctx->hsbd[(tx_id - det_ctx->hsbd_start_tx_id)].buffer_len; *stream_start_offset = det_ctx->hsbd[(tx_id - det_ctx->hsbd_start_tx_id)].offset; return det_ctx->hsbd[(tx_id - det_ctx->hsbd_start_tx_id)].buffer; } } else { uint64_t txs = (tx_id - det_ctx->hsbd_start_tx_id) + 1; if (HSBDCreateSpace(det_ctx, txs) < 0) goto end; det_ctx->hsbd_buffers_list_len = txs; } index = (tx_id - det_ctx->hsbd_start_tx_id); } HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (htud == NULL) { SCLogDebug("no htud"); goto end; } /* no new data */ if (htud->response_body.body_inspected == htud->response_body.content_len_so_far) { SCLogDebug("no new data"); goto end; } HtpBodyChunk *cur = htud->response_body.first; if (cur == NULL) { SCLogDebug("No http chunks to inspect for this transacation"); goto end; } SCLogDebug("response.body_limit %u response_body.content_len_so_far %"PRIu64 ", response.inspect_min_size %"PRIu32", EOF %s, progress > body? %s", htp_state->cfg->response.body_limit, htud->response_body.content_len_so_far, htp_state->cfg->response.inspect_min_size, flags & STREAM_EOF ? "true" : "false", (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_BODY) ? "true" : "false"); if (!htp_state->cfg->http_body_inline) { /* inspect the body if the transfer is complete or we have hit * our body size limit */ if ((htp_state->cfg->response.body_limit == 0 || htud->response_body.content_len_so_far < htp_state->cfg->response.body_limit) && htud->response_body.content_len_so_far < htp_state->cfg->response.inspect_min_size && !(AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_BODY) && !(flags & STREAM_EOF)) { SCLogDebug("we still haven't seen the entire response body. " "Let's defer body inspection till we see the " "entire body."); goto end; } } /* get the inspect buffer * * make sure that we have at least the configured inspect_win size. * If we have more, take at least 1/4 of the inspect win size before * the new data. */ uint64_t offset = 0; if (htud->response_body.body_inspected > htp_state->cfg->response.inspect_min_size) { BUG_ON(htud->response_body.content_len_so_far < htud->response_body.body_inspected); uint64_t inspect_win = htud->response_body.content_len_so_far - htud->response_body.body_inspected; SCLogDebug("inspect_win %u", (uint)inspect_win); if (inspect_win < htp_state->cfg->response.inspect_window) { uint64_t inspect_short = htp_state->cfg->response.inspect_window - inspect_win; if (htud->response_body.body_inspected < inspect_short) offset = 0; else offset = htud->response_body.body_inspected - inspect_short; } else { offset = htud->response_body.body_inspected - (htp_state->cfg->response.inspect_window / 4); } } StreamingBufferGetDataAtOffset(htud->response_body.sb, &det_ctx->hsbd[index].buffer, &det_ctx->hsbd[index].buffer_len, offset); det_ctx->hsbd[index].offset = offset; /* move inspected tracker to end of the data. HtpBodyPrune will consider * the window sizes when freeing data */ htud->response_body.body_inspected = htud->response_body.content_len_so_far; SCLogDebug("htud->response_body.body_inspected now: %"PRIu64, htud->response_body.body_inspected); buffer = det_ctx->hsbd[index].buffer; *buffer_len = det_ctx->hsbd[index].buffer_len; *stream_start_offset = det_ctx->hsbd[index].offset; end: return buffer; } /** \brief HTTP Server Body Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpResponseBody(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = DetectEngineHSBDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len, &stream_start_offset); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxHttpResponseBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseBody, ALPROTO_HTTP, HTP_RESPONSE_BODY, mpm_ctx, NULL, "file_data (http response)"); } int DetectEngineInspectHttpServerBody(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { HtpState *htp_state = (HtpState *)alstate; uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = DetectEngineHSBDGetBufferForTX(tx, tx_id, de_ctx, det_ctx, f, htp_state, flags, &buffer_len, &stream_start_offset); if (buffer_len == 0) goto end; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_FILEDATA], f, (uint8_t *)buffer, buffer_len, stream_start_offset, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_BODY) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } void DetectEngineCleanHSBDBuffers(DetectEngineThreadCtx *det_ctx) { if (det_ctx->hsbd_buffers_list_len > 0) { for (int i = 0; i < det_ctx->hsbd_buffers_list_len; i++) { det_ctx->hsbd[i].buffer_len = 0; det_ctx->hsbd[i].offset = 0; } } det_ctx->hsbd_buffers_list_len = 0; det_ctx->hsbd_start_tx_id = 0; return; } /***********************************Unittests**********************************/ #ifdef UNITTESTS struct TestSteps { const uint8_t *input; size_t input_size; /**< if 0 strlen will be used */ int direction; /**< STREAM_TOSERVER, STREAM_TOCLIENT */ int expect; }; static int RunTest(struct TestSteps *steps, const char *sig, const char *yaml) { TcpSession ssn; Flow f; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; int i = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); if (yaml) { ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(yaml, strlen(yaml)); HTPConfigure(); EngineModeSetIPS(); } StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alproto = ALPROTO_HTTP; SCLogDebug("sig %s", sig); DetectEngineAppendSig(de_ctx, (char *)sig); de_ctx->flags |= DE_QUIET; if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); struct TestSteps *b = steps; i = 0; while (b->input != NULL) { SCLogDebug("chunk %p %d", b, i); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = &f; p->flowflags = (b->direction == STREAM_TOSERVER) ? FLOW_PKT_TOSERVER : FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, b->direction, (uint8_t *)b->input, b->input_size ? b->input_size : strlen((const char *)b->input)); if (r != 0) { printf("toserver chunk %d returned %" PRId32 ", expected 0: ", i+1, r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); int match = PacketAlertCheck(p, 1); if (b->expect != match) { printf("rule matching mismatch: "); goto end; } UTHFreePackets(&p, 1); p = NULL; b++; i++; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (yaml) { HtpConfigRestoreBackup(); ConfRestoreContextBackup(); EngineModeSetIDS(); } return result; } static int DetectEngineHttpServerBodyTest01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"message\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest02(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "xxxxABC"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"ABC\"; http_server_body; offset:4; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } static int DetectEngineHttpServerBodyTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; int result = 0; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 17\r\n" "\r\n" "1234567"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "8901234ABC"; uint32_t http_len3 = sizeof(http_buf3) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"ABC\"; http_server_body; offset:14; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest04(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:!\"abc\"; http_server_body; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest05(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"abc\"; http_server_body; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest06(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:!\"def\"; http_server_body; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:!\"def\"; http_server_body; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:!\"abc\"; http_server_body; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"abc\"; http_server_body; depth:3; " "content:\"def\"; http_server_body; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"abc\"; http_server_body; depth:3; " "content:!\"xyz\"; http_server_body; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest11(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"abc\"; http_server_body; depth:3; " "content:\"xyz\"; http_server_body; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 did match but should not have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest12(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"ab\"; http_server_body; depth:2; " "content:\"ef\"; http_server_body; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest13(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"ab\"; http_server_body; depth:3; " "content:!\"yz\"; http_server_body; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest14(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "pcre:/ab/Q; " "content:\"ef\"; http_server_body; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest15(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "pcre:/abc/Q; " "content:!\"xyz\"; http_server_body; distance:0; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest16(void) { char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ \n\ request-body-inspect-window: 0\n\ response-body-inspect-window: 0\n\ request-body-minimal-inspect-size: 0\n\ response-body-minimal-inspect-size: 0\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; int result = 0; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 17\r\n" "\r\n" "1234567"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "8901234ABC"; uint32_t http_len3 = sizeof(http_buf3) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"890\"; within:3; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); HtpConfigRestoreBackup(); ConfRestoreContextBackup(); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyTest17(void) { char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ \n\ request-body-inspect-window: 0\n\ response-body-inspect-window: 0\n\ request-body-minimal-inspect-size: 0\n\ response-body-minimal-inspect-size: 0\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; int result = 0; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 17\r\n" "\r\n" "1234567"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "8901234ABC"; uint32_t http_len3 = sizeof(http_buf3) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"890\"; depth:3; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); HtpConfigRestoreBackup(); ConfRestoreContextBackup(); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* * gzip stream */ static int DetectEngineHttpServerBodyTest18(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = { 'H', 'T', 'T', 'P', '/', '1', '.', '1', ' ', '2', '0', '0', 'o', 'k', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '5', '1', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'g', 'z', 'i', 'p', 0x0d, 0x0a, 0x0d, 0x0a, 0x1f, 0x8b, 0x08, 0x08, 0x27, 0x1e, 0xe5, 0x51, 0x00, 0x03, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x74, 0x78, 0x74, 0x00, 0x2b, 0xc9, 0xc8, 0x2c, 0x56, 0x00, 0xa2, 0x44, 0x85, 0xb4, 0xcc, 0x9c, 0x54, 0x85, 0xcc, 0x3c, 0x20, 0x2b, 0x29, 0xbf, 0x42, 0x8f, 0x0b, 0x00, 0xb2, 0x7d, 0xac, 0x9b, 0x19, 0x00, 0x00, 0x00, }; uint32_t http_len2 = sizeof(http_buf2); int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"file\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* * deflate stream */ static int DetectEngineHttpServerBodyTest19(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = { 'H', 'T', 'T', 'P', '/', '1', '.', '1', ' ', '2', '0', '0', 'o', 'k', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '2', '4', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'd', 'e', 'f', 'l', 'a', 't', 'e', 0x0d, 0x0a, 0x0d, 0x0a, 0x2b, 0xc9, 0xc8, 0x2c, 0x56, 0x00, 0xa2, 0x44, 0x85, 0xb4, 0xcc, 0x9c, 0x54, 0x85, 0xcc, 0x3c, 0x20, 0x2b, 0x29, 0xbf, 0x42, 0x8f, 0x0b, 0x00, }; // 0xb2, 0x7d, 0xac, 0x9b, 0x19, 0x00, 0x00, 0x00, uint32_t http_len2 = sizeof(http_buf2); int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"file\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* * deflate stream with gzip set as content-encoding */ static int DetectEngineHttpServerBodyTest20(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = { 'H', 'T', 'T', 'P', '/', '1', '.', '1', ' ', '2', '0', '0', 'o', 'k', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '2', '4', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'g', 'z', 'i', 'p', 0x0d, 0x0a, 0x0d, 0x0a, 0x2b, 0xc9, 0xc8, 0x2c, 0x56, 0x00, 0xa2, 0x44, 0x85, 0xb4, 0xcc, 0x9c, 0x54, 0x85, 0xcc, 0x3c, 0x20, 0x2b, 0x29, 0xbf, 0x42, 0x8f, 0x0b, 0x00, }; // 0xb2, 0x7d, 0xac, 0x9b, 0x19, 0x00, 0x00, 0x00, uint32_t http_len2 = sizeof(http_buf2); int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"file\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); #ifdef HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT FAIL_IF(!(PacketAlertCheck(p2, 1))); #endif result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* * gzip stream with deflate set as content-encoding. */ static int DetectEngineHttpServerBodyTest21(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = { 'H', 'T', 'T', 'P', '/', '1', '.', '1', ' ', '2', '0', '0', 'o', 'k', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '5', '1', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'd', 'e', 'f', 'l', 'a', 't', 'e', 0x0d, 0x0a, 0x0d, 0x0a, 0x1f, 0x8b, 0x08, 0x08, 0x27, 0x1e, 0xe5, 0x51, 0x00, 0x03, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x74, 0x78, 0x74, 0x00, 0x2b, 0xc9, 0xc8, 0x2c, 0x56, 0x00, 0xa2, 0x44, 0x85, 0xb4, 0xcc, 0x9c, 0x54, 0x85, 0xcc, 0x3c, 0x20, 0x2b, 0x29, 0xbf, 0x42, 0x8f, 0x0b, 0x00, 0xb2, 0x7d, 0xac, 0x9b, 0x19, 0x00, 0x00, 0x00, }; uint32_t http_len2 = sizeof(http_buf2); int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"file\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); #ifdef HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT FAIL_IF(!(PacketAlertCheck(p2, 1))); #endif result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* * gzip stream. * We have 2 content-encoding headers. First gzip and second deflate. */ static int DetectEngineHttpServerBodyTest22(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = { 'H', 'T', 'T', 'P', '/', '1', '.', '1', ' ', '2', '0', '0', 'o', 'k', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'L', 'e', 'n', 'g', 't', 'h', ':', ' ', '5', '1', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'g', 'z', 'i', 'p', 0x0d, 0x0a, 'C', 'o', 'n', 't', 'e', 'n', 't', '-', 'E', 'n', 'c', 'o', 'd', 'i', 'n', 'g', ':', ' ', 'd', 'e', 'f', 'l', 'a', 't', 'e', 0x0d, 0x0a, 0x0d, 0x0a, 0x1f, 0x8b, 0x08, 0x08, 0x27, 0x1e, 0xe5, 0x51, 0x00, 0x03, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x74, 0x78, 0x74, 0x00, 0x2b, 0xc9, 0xc8, 0x2c, 0x56, 0x00, 0xa2, 0x44, 0x85, 0xb4, 0xcc, 0x9c, 0x54, 0x85, 0xcc, 0x3c, 0x20, 0x2b, 0x29, 0xbf, 0x42, 0x8f, 0x0b, 0x00, 0xb2, 0x7d, 0xac, 0x9b, 0x19, 0x00, 0x00, 0x00, }; uint32_t http_len2 = sizeof(http_buf2); int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "content:\"file\"; http_server_body; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: \n", r); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); #ifdef HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT FAIL_IF(!(PacketAlertCheck(p2, 1))); #endif result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyFileDataTest01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "file_data; pcre:/ab/; " "content:\"ef\"; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyFileDataTest02(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http server body test\"; " "file_data; pcre:/abc/; " "content:!\"xyz\"; distance:0; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /* \test recursive relative byte test */ static int DetectEngineHttpServerBodyFileDataTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 33\r\n" "\r\n" "XYZ_klm_1234abcd_XYZ_klm_5678abcd"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; if (!(DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(msg:\"match on 1st\"; " "file_data; content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; byte_test:4,=,1234,-8,relative,string;" "sid:1;)"))) goto end; if (!(DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(msg:\"match on 2nd\"; " "file_data; content:\"XYZ\"; content:\"_klm_\"; distance:0; content:\"abcd\"; distance:4; byte_test:4,=,5678,-8,relative,string;" "sid:2;)"))) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } if (!PacketAlertCheck(p2, 2)) { printf("sid 2 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpServerBodyFileDataTest04(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 1 }, { (const uint8_t *)"ef", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abcd\"; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest05(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"ef", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abcdef\"; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest06(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"ef", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"bcdef\"; offset:1; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest07(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 13\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 1 }, { (const uint8_t *)"123456789", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"bc\"; offset:1; depth:2; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest08(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 14\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"1234567890", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"d123456789\"; offset:3; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest09(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 13\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"cd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"123456789", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abcd12\"; depth:6; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest10(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 5\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"c", 0, STREAM_TOCLIENT, 1 }, { (const uint8_t *)"de", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abc\"; depth:3; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest11(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 5\r\n" "\r\n" "ab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"c", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"de", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"bcde\"; offset:1; depth:4; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest12(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 6\n\ response-body-inspect-window: 3\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 13\r\n" "\r\n" "a", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"b", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"c", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"d", 0, STREAM_TOCLIENT, 1 }, { (const uint8_t *)"efghijklm", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abcd\"; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest13(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 9\n\ response-body-inspect-window: 12\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 13\r\n" "\r\n" "a", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"b", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"c", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"d", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"efghijklm", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"abcdefghijklm\"; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest14(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 9\n\ response-body-inspect-window: 12\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 20\r\n" "\r\n" "1234567890", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"abcdefghi", 0, STREAM_TOCLIENT, 1 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"890abcdefghi\"; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest15(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 9\n\ response-body-inspect-window: 12\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 20\r\n" "\r\n" "1234567890", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"abcdefghi", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"7890ab\"; depth:6; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest16(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 9\n\ response-body-inspect-window: 12\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 20\r\n" "\r\n" "aaaab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"bbbbc", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"ccccd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"dddde", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"aabb\"; depth:4; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest17(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 8\n\ response-body-inspect-window: 4\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 20\r\n" "\r\n" "aaaab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"bbbbc", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"ccccd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"dddde", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"bbbc\"; depth:4; sid:1;)"; return RunTest(steps, sig, yaml); } static int DetectEngineHttpServerBodyFileDataTest18(void) { const char yaml[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ \n\ http-body-inline: yes\n\ response-body-minimal-inspect-size: 8\n\ response-body-inspect-window: 4\n\ "; struct TestSteps steps[] = { { (const uint8_t *)"GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n", 0, STREAM_TOSERVER, 0 }, { (const uint8_t *)"HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 20\r\n" "\r\n" "aaaab", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"bbbbc", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"ccccd", 0, STREAM_TOCLIENT, 0 }, { (const uint8_t *)"dddde", 0, STREAM_TOCLIENT, 0 }, { NULL, 0, 0, 0 }, }; const char *sig = "alert http any any -> any any (file_data; content:\"bccd\"; depth:4; sid:1;)"; return RunTest(steps, sig, yaml); } #endif /* UNITTESTS */ void DetectEngineHttpServerBodyRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpServerBodyTest01", DetectEngineHttpServerBodyTest01); UtRegisterTest("DetectEngineHttpServerBodyTest02", DetectEngineHttpServerBodyTest02); UtRegisterTest("DetectEngineHttpServerBodyTest03", DetectEngineHttpServerBodyTest03); UtRegisterTest("DetectEngineHttpServerBodyTest04", DetectEngineHttpServerBodyTest04); UtRegisterTest("DetectEngineHttpServerBodyTest05", DetectEngineHttpServerBodyTest05); UtRegisterTest("DetectEngineHttpServerBodyTest06", DetectEngineHttpServerBodyTest06); UtRegisterTest("DetectEngineHttpServerBodyTest07", DetectEngineHttpServerBodyTest07); UtRegisterTest("DetectEngineHttpServerBodyTest08", DetectEngineHttpServerBodyTest08); UtRegisterTest("DetectEngineHttpServerBodyTest09", DetectEngineHttpServerBodyTest09); UtRegisterTest("DetectEngineHttpServerBodyTest10", DetectEngineHttpServerBodyTest10); UtRegisterTest("DetectEngineHttpServerBodyTest11", DetectEngineHttpServerBodyTest11); UtRegisterTest("DetectEngineHttpServerBodyTest12", DetectEngineHttpServerBodyTest12); UtRegisterTest("DetectEngineHttpServerBodyTest13", DetectEngineHttpServerBodyTest13); UtRegisterTest("DetectEngineHttpServerBodyTest14", DetectEngineHttpServerBodyTest14); UtRegisterTest("DetectEngineHttpServerBodyTest15", DetectEngineHttpServerBodyTest15); UtRegisterTest("DetectEngineHttpServerBodyTest16", DetectEngineHttpServerBodyTest16); UtRegisterTest("DetectEngineHttpServerBodyTest17", DetectEngineHttpServerBodyTest17); UtRegisterTest("DetectEngineHttpServerBodyTest18", DetectEngineHttpServerBodyTest18); UtRegisterTest("DetectEngineHttpServerBodyTest19", DetectEngineHttpServerBodyTest19); UtRegisterTest("DetectEngineHttpServerBodyTest20", DetectEngineHttpServerBodyTest20); UtRegisterTest("DetectEngineHttpServerBodyTest21", DetectEngineHttpServerBodyTest21); UtRegisterTest("DetectEngineHttpServerBodyTest22", DetectEngineHttpServerBodyTest22); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest01", DetectEngineHttpServerBodyFileDataTest01); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest02", DetectEngineHttpServerBodyFileDataTest02); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest03", DetectEngineHttpServerBodyFileDataTest03); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest04", DetectEngineHttpServerBodyFileDataTest04); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest05", DetectEngineHttpServerBodyFileDataTest05); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest06", DetectEngineHttpServerBodyFileDataTest06); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest07", DetectEngineHttpServerBodyFileDataTest07); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest08", DetectEngineHttpServerBodyFileDataTest08); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest09", DetectEngineHttpServerBodyFileDataTest09); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest10", DetectEngineHttpServerBodyFileDataTest10); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest11", DetectEngineHttpServerBodyFileDataTest11); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest12", DetectEngineHttpServerBodyFileDataTest12); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest13", DetectEngineHttpServerBodyFileDataTest13); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest14", DetectEngineHttpServerBodyFileDataTest14); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest15", DetectEngineHttpServerBodyFileDataTest15); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest16", DetectEngineHttpServerBodyFileDataTest16); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest17", DetectEngineHttpServerBodyFileDataTest17); UtRegisterTest("DetectEngineHttpServerBodyFileDataTest18", DetectEngineHttpServerBodyFileDataTest18); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-http-header.c0000644000000000000000000015224413051004444014630 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Pablo Rincon * * Implements support for http_header keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-header.h" #include "detect-engine-hhd.h" #include "stream-tcp.h" int DetectHttpHeaderSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpHeaderRegisterTests(void); void DetectHttpHeaderFree(void *); /** * \brief Registers the keyword handlers for the "http_header" keyword. */ void DetectHttpHeaderRegister(void) { sigmatch_table[DETECT_AL_HTTP_HEADER].name = "http_header"; sigmatch_table[DETECT_AL_HTTP_HEADER].desc = "content modifier to match only on the HTTP header-buffer"; sigmatch_table[DETECT_AL_HTTP_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-header"; sigmatch_table[DETECT_AL_HTTP_HEADER].Match = NULL; sigmatch_table[DETECT_AL_HTTP_HEADER].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_HEADER].Setup = DetectHttpHeaderSetup; sigmatch_table[DETECT_AL_HTTP_HEADER].Free = DetectHttpHeaderFree; sigmatch_table[DETECT_AL_HTTP_HEADER].RegisterTests = DetectHttpHeaderRegisterTests; sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_NOOPT ; sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHDMATCH, 2, PrefilterTxHttpRequestHeadersRegister); DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HHDMATCH, 2, PrefilterTxHttpResponseHeadersRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHDMATCH, DetectEngineInspectHttpHeader); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HHDMATCH, DetectEngineInspectHttpHeader); return; } /** * \brief this function clears the memory of http_header modifier keyword * * \param ptr Pointer to the Detection Header Data */ void DetectHttpHeaderFree(void *ptr) { DetectContentData *hhd = (DetectContentData *)ptr; if (hhd == NULL) return; if (hhd->content != NULL) SCFree(hhd->content); SCFree(hhd); return; } /** * \brief The setup function for the http_header keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param m Pointer to the head of the SigMatchs for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success. * \retval -1 On failure. */ int DetectHttpHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_HEADER, DETECT_SM_LIST_HHDMATCH, ALPROTO_HTTP, NULL); } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_header is correctly parsed * and the keyword is registered. */ static int DetectHttpHeaderTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; " "content:\"one\"; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { printf("Error parsing signature: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH]; if (sm != NULL) { result &= (sm->type == DETECT_CONTENT); result &= (sm->next == NULL); } else { result = 0; printf("Error updating content pattern to http_header pattern: "); } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_header entry is * parsed. */ static int DetectHttpHeaderTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; " "content:\"one\"; http_header:; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a http_header * is invalidated. */ static int DetectHttpHeaderTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; " "http_header; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_header is invalidated. */ static int DetectHttpHeaderTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; " "content:\"one\"; rawbytes; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_header is invalidated. */ static int DetectHttpHeaderTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; " "content:\"one\"; nocase; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpHeaderTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Content-Type: text/html\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpHeaderTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozi"; uint8_t http2_buf[] = "lla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\nContent-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy message body1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Mozilla\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ( (PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpHeaderTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n"; uint8_t http2_buf[] = "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Gecko/20091221 Firefox/3.5.7\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpHeaderTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"; uint8_t http2_buf[] = "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy body\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Firefox/3.5.7|0D 0A|Content\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * against a case insensitive pattern. */ static int DetectHttpHeaderTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"; uint8_t http2_buf[] = "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy body"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"firefox/3.5.7|0D 0A|content\"; nocase; http_header;" "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_header content matches against a * http request which doesn't hold the content. */ static int DetectHttpHeaderTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"lalalalala\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_header content matches against a * http request which holds hold the content. */ static int DetectHttpHeaderTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"User-Agent: Mozilla/5.0 \"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpHeaderTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 100\r\n" "\r\n" "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Host: www.openinfosecfoundation.org\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } int DetectHttpHeaderTest20(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; " "content:\"two\"; distance:0; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL\n"); goto end; } DetectContentData *hhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (hhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hhd1->content, "one", hhd1->content_len) != 0 || hhd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hhd2->content, "two", hhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest21(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; " "content:\"two\"; within:5; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL\n"); goto end; } DetectContentData *hhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (hhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hhd1->content, "one", hhd1->content_len) != 0 || hhd2->flags != DETECT_CONTENT_WITHIN || memcmp(hhd2->content, "two", hhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/H; " "content:\"two\"; within:5; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhd2->flags != DETECT_CONTENT_WITHIN || memcmp(hhd2->content, "two", hhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_header; " "pcre:/one/HR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || hhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hhd1->content, "two", hhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHeaderTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(pcre:/one/H; " "content:\"two\"; distance:5; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hhd2->content, "two", hhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test app-layer-event:http.host_header_ambiguous should not be set * \bug 640*/ static int DetectHttpHeaderTest28(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; uint8_t http_buf[] = "POST http://xxx.intranet.local:8000/xxx HTTP/1.1\r\n" "User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_29\r\n" "Host: xxx.intranet.local:8000\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(app-layer-event:http.host_header_ambiguous; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldnt have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test app-layer-event:http.host_header_ambiguous should be set * \bug 640*/ static int DetectHttpHeaderTest29(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; uint8_t http_buf[] = "POST http://xxx.intranet.local:8001/xxx HTTP/1.1\r\n" "User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_29\r\n" "Host: xxx.intranet.local:8000\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(app-layer-event:http.host_header_ambiguous; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test app-layer-event:http.host_header_ambiguous should be set * \bug 640*/ static int DetectHttpHeaderTest30(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; Flow f; uint8_t http_buf[] = "POST http://xxx.intranet.local:8000/xxx HTTP/1.1\r\n" "User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_29\r\n" "Host: xyz.intranet.local:8000\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(app-layer-event:http.host_header_ambiguous; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectHttpHeaderRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpHeaderTest01", DetectHttpHeaderTest01); UtRegisterTest("DetectHttpHeaderTest02", DetectHttpHeaderTest02); UtRegisterTest("DetectHttpHeaderTest03", DetectHttpHeaderTest03); UtRegisterTest("DetectHttpHeaderTest04", DetectHttpHeaderTest04); UtRegisterTest("DetectHttpHeaderTest05", DetectHttpHeaderTest05); UtRegisterTest("DetectHttpHeaderTest06", DetectHttpHeaderTest06); UtRegisterTest("DetectHttpHeaderTest07", DetectHttpHeaderTest07); UtRegisterTest("DetectHttpHeaderTest08", DetectHttpHeaderTest08); UtRegisterTest("DetectHttpHeaderTest09", DetectHttpHeaderTest09); UtRegisterTest("DetectHttpHeaderTest10", DetectHttpHeaderTest10); UtRegisterTest("DetectHttpHeaderTest11", DetectHttpHeaderTest11); UtRegisterTest("DetectHttpHeaderTest12", DetectHttpHeaderTest12); UtRegisterTest("DetectHttpHeaderTest13", DetectHttpHeaderTest13); UtRegisterTest("DetectHttpHeaderTest20", DetectHttpHeaderTest20); UtRegisterTest("DetectHttpHeaderTest21", DetectHttpHeaderTest21); UtRegisterTest("DetectHttpHeaderTest22", DetectHttpHeaderTest22); UtRegisterTest("DetectHttpHeaderTest23", DetectHttpHeaderTest23); UtRegisterTest("DetectHttpHeaderTest24", DetectHttpHeaderTest24); UtRegisterTest("DetectHttpHeaderTest25", DetectHttpHeaderTest25); UtRegisterTest("DetectHttpHeaderTest26", DetectHttpHeaderTest26); UtRegisterTest("DetectHttpHeaderTest27", DetectHttpHeaderTest27); UtRegisterTest("DetectHttpHeaderTest28", DetectHttpHeaderTest28); UtRegisterTest("DetectHttpHeaderTest29", DetectHttpHeaderTest29); UtRegisterTest("DetectHttpHeaderTest30", DetectHttpHeaderTest30); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/util-checksum.h0000644000000000000000000000215613051004444013733 00000000000000/* Copyright (C) 2011-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __UTIL_CHECKSUM_H__ #define __UTIL_CHECKSUM_H__ int ReCalculateChecksum(Packet *p); int ChecksumAutoModeCheck(uint32_t thread_count, unsigned int iface_count, unsigned int iface_fail); /* constant linked with detection of interface with * invalid checksums */ #define CHECKSUM_SAMPLE_COUNT 1000 #define CHECKSUM_INVALID_RATIO 10 #endif suricata-3.2.1/src/app-layer-ftp.h0000644000000000000000000000655513051004444013646 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo */ #ifndef __APP_LAYER_FTP_H__ #define __APP_LAYER_FTP_H__ typedef enum { FTP_COMMAND_UNKNOWN = 0, FTP_COMMAND_ABOR, FTP_COMMAND_ACCT, FTP_COMMAND_ALLO, FTP_COMMAND_APPE, FTP_COMMAND_CDUP, FTP_COMMAND_CHMOD, FTP_COMMAND_CWD, FTP_COMMAND_DELE, FTP_COMMAND_HELP, FTP_COMMAND_IDLE, FTP_COMMAND_LIST, FTP_COMMAND_MAIL, FTP_COMMAND_MDTM, FTP_COMMAND_MKD, FTP_COMMAND_MLFL, FTP_COMMAND_MODE, FTP_COMMAND_MRCP, FTP_COMMAND_MRSQ, FTP_COMMAND_MSAM, FTP_COMMAND_MSND, FTP_COMMAND_MSOM, FTP_COMMAND_NLST, FTP_COMMAND_NOOP, FTP_COMMAND_PASS, FTP_COMMAND_PASV, FTP_COMMAND_PORT, FTP_COMMAND_PWD, FTP_COMMAND_QUIT, FTP_COMMAND_REIN, FTP_COMMAND_REST, FTP_COMMAND_RETR, FTP_COMMAND_RMD, FTP_COMMAND_RNFR, FTP_COMMAND_RNTO, FTP_COMMAND_SITE, FTP_COMMAND_SIZE, FTP_COMMAND_SMNT, FTP_COMMAND_STAT, FTP_COMMAND_STOR, FTP_COMMAND_STOU, FTP_COMMAND_STRU, FTP_COMMAND_SYST, FTP_COMMAND_TYPE, FTP_COMMAND_UMASK, FTP_COMMAND_USER /** \todo more if missing.. */ } FtpRequestCommand; typedef uint32_t FtpRequestCommandArgOfs; typedef uint16_t FtpResponseCode; enum { FTP_FIELD_NONE = 0, FTP_FIELD_REQUEST_LINE, FTP_FIELD_REQUEST_COMMAND, FTP_FIELD_REQUEST_ARGS, FTP_FIELD_RESPONSE_LINE, FTP_FIELD_REPONSE_CODE, /* must be last */ FTP_FIELD_MAX, }; /** used to hold the line state when we have fragmentation. */ typedef struct FtpLineState_ { /** used to indicate if the current_line buffer is a malloced buffer. We * use a malloced buffer, if a line is fragmented */ uint8_t *db; uint32_t db_len; uint8_t current_line_db; /** we have see LF for the currently parsed line */ uint8_t current_line_lf_seen; } FtpLineState; /** FTP State for app layer parser */ typedef struct FtpState_ { uint8_t *input; int32_t input_len; uint8_t direction; /* --parser details-- */ /** current line extracted by the parser from the call to FTPGetline() */ uint8_t *current_line; /** length of the line in current_line. Doesn't include the delimiter */ uint32_t current_line_len; uint8_t current_line_delimiter_len; /* 0 for toserver, 1 for toclient */ FtpLineState line_state[2]; FtpRequestCommand command; FtpRequestCommandArgOfs arg_offset; uint32_t port_line_len; uint32_t port_line_size; uint8_t *port_line; } FtpState; void RegisterFTPParsers(void); void FTPParserRegisterTests(void); void FTPAtExitPrintStats(void); #endif /* __APP_LAYER_FTP_H__ */ suricata-3.2.1/src/util-path.h0000644000000000000000000000164613051004444013070 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #ifndef __UTIL_PATH_H__ #define __UTIL_PATH_H__ int PathIsAbsolute(const char *); int PathIsRelative(const char *); #endif /* __UTIL_PATH_H__ */ suricata-3.2.1/src/source-erf-file.h0000644000000000000000000000165013051004444014143 00000000000000/* Copyright (C) 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited */ #ifndef __SOURCE_ERF_H__ #define __SOURCE_ERF_H__ void TmModuleReceiveErfFileRegister(void); void TmModuleDecodeErfFileRegister(void); #endif /* __SOURCE_ERF_H__ */ suricata-3.2.1/src/util-print.c0000644000000000000000000002042213051004444013254 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Print utility functions */ #include "suricata-common.h" #include "util-print.h" #include "util-error.h" #include "util-debug.h" /** * \brief print a buffer as hex on a single line * * Prints in the format "00 AA BB" * * \param nbuf buffer into which the output is written * \param offset of where to start writting into the buffer * \param max_size the size of the output buffer * \param buf buffer to print from * \param buflen length of the input buffer */ void PrintBufferRawLineHex(char *nbuf, int *offset, int max_size, uint8_t *buf, uint32_t buflen) { uint32_t u = 0; for (u = 0; u < buflen; u++) { PrintBufferData(nbuf, offset, max_size, "%02X ", buf[u]); } } /** * \brief print a buffer as hex on a single line in to retbuf buffer * * Prints in the format "00 AA BB" * * \param retbuf pointer to the buffer which will have the result * \param rebuflen lenght of the buffer * \param buf buffer to print from * \param buflen length of the input buffer */ void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, uint8_t *buf, uint32_t buflen) { uint32_t offset = 0; uint32_t u = 0; for (u = 0; u < buflen; u++) { PrintBufferData(retbuf, &offset, retbuflen, "%02X ", buf[u]); } } void PrintRawJsonFp(FILE *fp, uint8_t *buf, uint32_t buflen) { #define BUFFER_LENGTH 2048 char nbuf[BUFFER_LENGTH] = ""; uint32_t offset = 0; uint32_t u = 0; for (u = 0; u < buflen; u++) { if (buf[u] == '\\' || buf[u] == '/' || buf[u] == '\"') { PrintBufferData(nbuf, &offset, BUFFER_LENGTH, "\\%c", buf[u]); } else if (isprint(buf[u])) { PrintBufferData(nbuf, &offset, BUFFER_LENGTH, "%c", buf[u]); } else { PrintBufferData(nbuf, &offset, BUFFER_LENGTH, "\\\\x%02X", buf[u]); } } fprintf(fp, "%s", nbuf); } void PrintRawUriFp(FILE *fp, uint8_t *buf, uint32_t buflen) { #define BUFFER_LENGTH 2048 char nbuf[BUFFER_LENGTH] = ""; uint32_t offset = 0; uint32_t u = 0; for (u = 0; u < buflen; u++) { if (isprint(buf[u]) && buf[u] != '\"') { PrintBufferData(nbuf, &offset, BUFFER_LENGTH, "%c", buf[u]); } else { PrintBufferData(nbuf, &offset, BUFFER_LENGTH, "\\x%02X", buf[u]); } } fprintf(fp, "%s", nbuf); } void PrintRawUriBuf(char *retbuf, uint32_t *offset, uint32_t retbuflen, uint8_t *buf, uint32_t buflen) { uint32_t u = 0; for (u = 0; u < buflen; u++) { if (isprint(buf[u]) && buf[u] != '\"') { if (buf[u] == '\\') { PrintBufferData(retbuf, offset, retbuflen, "\\\\"); } else { PrintBufferData(retbuf, offset, retbuflen, "%c", buf[u]); } } else { PrintBufferData(retbuf, offset, retbuflen, "\\x%02X", buf[u]); } } return; } void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen) { int ch = 0; uint32_t u = 0; for (u = 0; u < buflen; u+=16) { fprintf(fp ," %04X ", u); for (ch = 0; (u+ch) < buflen && ch < 16; ch++) { fprintf(fp, "%02X ", (uint8_t)buf[u+ch]); if (ch == 7) fprintf(fp, " "); } if (ch == 16) fprintf(fp, " "); else if (ch < 8) { int spaces = (16 - ch) * 3 + 2 + 1; int s = 0; for ( ; s < spaces; s++) fprintf(fp, " "); } else if(ch < 16) { int spaces = (16 - ch) * 3 + 2; int s = 0; for ( ; s < spaces; s++) fprintf(fp, " "); } for (ch = 0; (u+ch) < buflen && ch < 16; ch++) { fprintf(fp, "%c", isprint((uint8_t)buf[u+ch]) ? (uint8_t)buf[u+ch] : '.'); if (ch == 7) fprintf(fp, " "); if (ch == 15) fprintf(fp, "\n"); } } if (ch != 16) fprintf(fp, "\n"); } void PrintRawDataToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, uint8_t *src_buf, uint32_t src_buf_len) { int ch = 0; uint32_t u = 0; for (u = 0; u < src_buf_len; u+=16) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " %04X ", u); for (ch = 0; (u + ch) < src_buf_len && ch < 16; ch++) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, "%02X ", (uint8_t)src_buf[u + ch]); if (ch == 7) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " "); } } if (ch == 16) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " "); } else if (ch < 8) { int spaces = (16 - ch) * 3 + 2 + 1; int s = 0; for ( ; s < spaces; s++) PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " "); } else if(ch < 16) { int spaces = (16 - ch) * 3 + 2; int s = 0; for ( ; s < spaces; s++) PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " "); } for (ch = 0; (u+ch) < src_buf_len && ch < 16; ch++) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, "%c", isprint((uint8_t)src_buf[u + ch]) ? (uint8_t)src_buf[u + ch] : '.'); if (ch == 7) PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, " "); if (ch == 15) PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, "\n"); } } if (ch != 16) PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, "\n"); return; } void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, uint8_t *src_buf, uint32_t src_buf_len) { uint32_t ch = 0; for (ch = 0; ch < src_buf_len; ch++) { PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size, "%c", (isprint((uint8_t)src_buf[ch]) || src_buf[ch] == '\n' || src_buf[ch] == '\r') ? (uint8_t)src_buf[ch] : '.'); } return; } #ifndef s6_addr16 # define s6_addr16 __u6_addr.__u6_addr16 #endif static const char *PrintInetIPv6(const void *src, char *dst, socklen_t size) { int i; char s_part[6]; uint16_t x[8]; memcpy(&x, src, 16); /* current IPv6 format is fixed size */ if (size < 8 * 5) { SCLogWarning(SC_ERR_ARG_LEN_LONG, "Too small buffer to write IPv6 address"); return NULL; } memset(dst, 0, size); for(i = 0; i < 8; i++) { snprintf(s_part, sizeof(s_part), "%04x:", htons(x[i])); strlcat(dst, s_part, size); } /* suppress last ':' */ dst[strlen(dst) - 1] = 0; return dst; } const char *PrintInet(int af, const void *src, char *dst, socklen_t size) { switch (af) { case AF_INET: return inet_ntop(af, src, dst, size); case AF_INET6: /* Format IPv6 without deleting zeroes */ return PrintInetIPv6(src, dst, size); default: SCLogError(SC_ERR_INVALID_VALUE, "Unsupported protocol: %d", af); } return NULL; } suricata-3.2.1/src/app-layer-dcerpc-udp.c0000644000000000000000000013753613051004444015102 00000000000000/* * Copyright (c) 2009, 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* \file * * \author Kirby Kuehl * * \todo Updated by AS: Inspect the possibilities of sending junk start at the * start of udp session to avoid alproto detection. */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "decode.h" #include "flow-util.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-debug.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer.h" #include "util-spm.h" #include "util-unittest.h" #include "app-layer-dcerpc-udp.h" enum { DCERPC_FIELD_NONE = 0, DCERPC_PARSE_DCERPC_HEADER, DCERPC_PARSE_DCERPC_BIND, DCERPC_PARSE_DCERPC_BIND_ACK, DCERPC_PARSE_DCERPC_REQUEST, /* must be last */ DCERPC_FIELD_MAX, }; /** \internal * \retval stub_len or 0 in case of error */ static uint32_t FragmentDataParser(Flow *f, void *dcerpcudp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpcudp_state; uint8_t **stub_data_buffer = NULL; uint32_t *stub_data_buffer_len = NULL; uint8_t *stub_data_fresh = NULL; uint16_t stub_len = 0; void *ptmp; /* request PDU. Retrieve the request stub buffer */ if (sstate->dcerpc.dcerpchdrudp.type == REQUEST) { stub_data_buffer = &sstate->dcerpc.dcerpcrequest.stub_data_buffer; stub_data_buffer_len = &sstate->dcerpc.dcerpcrequest.stub_data_buffer_len; stub_data_fresh = &sstate->dcerpc.dcerpcrequest.stub_data_fresh; /* response PDU. Retrieve the response stub buffer */ } else { stub_data_buffer = &sstate->dcerpc.dcerpcresponse.stub_data_buffer; stub_data_buffer_len = &sstate->dcerpc.dcerpcresponse.stub_data_buffer_len; stub_data_fresh = &sstate->dcerpc.dcerpcresponse.stub_data_fresh; } stub_len = (sstate->dcerpc.fraglenleft < input_len) ? sstate->dcerpc.fraglenleft : input_len; if (stub_len == 0) { SCReturnUInt(0); } /* if the frag is the the first frag irrespective of it being a part of * a multi frag PDU or not, it indicates the previous PDU's stub would * have been buffered and processed and we can use the buffer to hold * frags from a fresh request/response */ if (sstate->dcerpc.dcerpchdrudp.flags1 & PFC_FIRST_FRAG) { *stub_data_buffer_len = 0; } ptmp = SCRealloc(*stub_data_buffer, *stub_data_buffer_len + stub_len); if (ptmp == NULL) { SCFree(*stub_data_buffer); *stub_data_buffer = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCReturnUInt(0); } *stub_data_buffer = ptmp; memcpy(*stub_data_buffer + *stub_data_buffer_len, input, stub_len); *stub_data_fresh = 1; /* length of the buffered stub */ *stub_data_buffer_len += stub_len; sstate->dcerpc.fraglenleft -= stub_len; sstate->dcerpc.bytesprocessed += stub_len; #ifdef DEBUG if (SCLogDebugEnabled()) { int i = 0; for (i = 0; i < stub_len; i++) { SCLogDebug("0x%02x ", input[i]); } } #endif SCReturnUInt((uint32_t)stub_len); } /** * \brief DCERPCParseHeader parses the 16 byte DCERPC header * A fast path for normal decoding is used when there is enough bytes * present to parse the entire header. A slow path is used to parse * fragmented packets. */ static int DCERPCUDPParseHeader(Flow *f, void *dcerpcudp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpcudp_state; if (input_len) { switch (sstate->bytesprocessed) { case 0: // fallthrough /* above statement to prevent coverity FPs from the switch * fall through */ if (input_len >= DCERPC_UDP_HDR_LEN) { sstate->dcerpc.dcerpchdrudp.rpc_vers = *p; if (sstate->dcerpc.dcerpchdrudp.rpc_vers != 4) { SCLogDebug("DCERPC UDP Header did not validate"); SCReturnInt(-1); } sstate->dcerpc.dcerpchdrudp.type = *(p + 1); sstate->dcerpc.dcerpchdrudp.flags1 = *(p + 2); sstate->dcerpc.dcerpchdrudp.flags2 = *(p + 3); sstate->dcerpc.dcerpchdrudp.drep[0] = *(p + 4); sstate->dcerpc.dcerpchdrudp.drep[1] = *(p + 5); sstate->dcerpc.dcerpchdrudp.drep[2] = *(p + 6); sstate->dcerpc.dcerpchdrudp.serial_hi = *(p + 7); sstate->dcerpc.dcerpchdrudp.objectuuid[3] = *(p + 8); sstate->dcerpc.dcerpchdrudp.objectuuid[2] = *(p + 9); sstate->dcerpc.dcerpchdrudp.objectuuid[1] = *(p + 10); sstate->dcerpc.dcerpchdrudp.objectuuid[0] = *(p + 11); sstate->dcerpc.dcerpchdrudp.objectuuid[5] = *(p + 12); sstate->dcerpc.dcerpchdrudp.objectuuid[4] = *(p + 13); sstate->dcerpc.dcerpchdrudp.objectuuid[7] = *(p + 14); sstate->dcerpc.dcerpchdrudp.objectuuid[6] = *(p + 15); sstate->dcerpc.dcerpchdrudp.objectuuid[8] = *(p + 16); sstate->dcerpc.dcerpchdrudp.objectuuid[9] = *(p + 17); sstate->dcerpc.dcerpchdrudp.objectuuid[10] = *(p + 18); sstate->dcerpc.dcerpchdrudp.objectuuid[11] = *(p + 19); sstate->dcerpc.dcerpchdrudp.objectuuid[12] = *(p + 20); sstate->dcerpc.dcerpchdrudp.objectuuid[13] = *(p + 21); sstate->dcerpc.dcerpchdrudp.objectuuid[14] = *(p + 22); sstate->dcerpc.dcerpchdrudp.objectuuid[15] = *(p + 23); sstate->dcerpc.dcerpchdrudp.interfaceuuid[3] = *(p + 24); sstate->dcerpc.dcerpchdrudp.interfaceuuid[2] = *(p + 25); sstate->dcerpc.dcerpchdrudp.interfaceuuid[1] = *(p + 26); sstate->dcerpc.dcerpchdrudp.interfaceuuid[0] = *(p + 27); sstate->dcerpc.dcerpchdrudp.interfaceuuid[5] = *(p + 28); sstate->dcerpc.dcerpchdrudp.interfaceuuid[4] = *(p + 29); sstate->dcerpc.dcerpchdrudp.interfaceuuid[7] = *(p + 30); sstate->dcerpc.dcerpchdrudp.interfaceuuid[6] = *(p + 31); sstate->dcerpc.dcerpchdrudp.interfaceuuid[8] = *(p + 32); sstate->dcerpc.dcerpchdrudp.interfaceuuid[9] = *(p + 33); sstate->dcerpc.dcerpchdrudp.interfaceuuid[10] = *(p + 34); sstate->dcerpc.dcerpchdrudp.interfaceuuid[11] = *(p + 35); sstate->dcerpc.dcerpchdrudp.interfaceuuid[12] = *(p + 36); sstate->dcerpc.dcerpchdrudp.interfaceuuid[13] = *(p + 37); sstate->dcerpc.dcerpchdrudp.interfaceuuid[14] = *(p + 38); sstate->dcerpc.dcerpchdrudp.interfaceuuid[15] = *(p + 39); sstate->dcerpc.dcerpchdrudp.activityuuid[3] = *(p + 40); sstate->dcerpc.dcerpchdrudp.activityuuid[2] = *(p + 41); sstate->dcerpc.dcerpchdrudp.activityuuid[1] = *(p + 42); sstate->dcerpc.dcerpchdrudp.activityuuid[0] = *(p + 43); sstate->dcerpc.dcerpchdrudp.activityuuid[5] = *(p + 44); sstate->dcerpc.dcerpchdrudp.activityuuid[4] = *(p + 45); sstate->dcerpc.dcerpchdrudp.activityuuid[7] = *(p + 46); sstate->dcerpc.dcerpchdrudp.activityuuid[6] = *(p + 47); sstate->dcerpc.dcerpchdrudp.activityuuid[8] = *(p + 48); sstate->dcerpc.dcerpchdrudp.activityuuid[9] = *(p + 49); sstate->dcerpc.dcerpchdrudp.activityuuid[10] = *(p + 50); sstate->dcerpc.dcerpchdrudp.activityuuid[11] = *(p + 51); sstate->dcerpc.dcerpchdrudp.activityuuid[12] = *(p + 52); sstate->dcerpc.dcerpchdrudp.activityuuid[13] = *(p + 53); sstate->dcerpc.dcerpchdrudp.activityuuid[14] = *(p + 54); sstate->dcerpc.dcerpchdrudp.activityuuid[15] = *(p + 55); if (sstate->dcerpc.dcerpchdrudp.drep[0] == 0x10) { sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56); sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 8; sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 16; sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59) << 24; sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60); sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 8; sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 16; sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63) << 24; sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64); sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 8; sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 16; sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67) << 24; sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68); sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69) << 8; sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70); sstate->dcerpc.dcerpchdrudp.ihint |= *(p + 71) << 8; sstate->dcerpc.dcerpchdrudp.ahint = *(p + 72); sstate->dcerpc.dcerpchdrudp.ahint |= *(p + 73) << 8; sstate->dcerpc.dcerpchdrudp.fraglen = *(p + 74); sstate->dcerpc.dcerpchdrudp.fraglen |= *(p + 75) << 8; sstate->dcerpc.dcerpchdrudp.fragnum = *(p + 76); sstate->dcerpc.dcerpchdrudp.fragnum |= *(p + 77) << 8; } else { sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56) << 24; sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 16; sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 8; sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59); sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60) << 24; sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 16; sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 8; sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63); sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64) << 24; sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 16; sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 8; sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67); sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68) << 24; sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69) << 16; sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70) << 8; sstate->dcerpc.dcerpchdrudp.ihint |= *(p + 71); sstate->dcerpc.dcerpchdrudp.ahint = *(p + 72) << 8; sstate->dcerpc.dcerpchdrudp.ahint |= *(p + 73); sstate->dcerpc.dcerpchdrudp.fraglen = *(p + 74) << 8; sstate->dcerpc.dcerpchdrudp.fraglen |= *(p + 75); sstate->dcerpc.dcerpchdrudp.fragnum = *(p + 76) << 8; sstate->dcerpc.dcerpchdrudp.fragnum |= *(p + 77); } sstate->fraglenleft = sstate->dcerpc.dcerpchdrudp.fraglen; sstate->dcerpc.dcerpchdrudp.auth_proto = *(p + 78); sstate->dcerpc.dcerpchdrudp.serial_lo = *(p + 79); sstate->bytesprocessed = DCERPC_UDP_HDR_LEN; sstate->uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, sizeof(DCERPCUuidEntry)); if (sstate->uuid_entry == NULL) { SCReturnUInt(-1); } else { memcpy(sstate->uuid_entry->uuid, sstate->dcerpc.dcerpchdrudp.activityuuid, sizeof(sstate->dcerpc.dcerpchdrudp.activityuuid)); TAILQ_INSERT_HEAD(&sstate->uuid_list, sstate->uuid_entry, next); #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("DCERPC UDP", sstate->uuid_entry); } #endif } SCReturnUInt(80); break; } else { sstate->dcerpc.dcerpchdrudp.rpc_vers = *(p++); if (sstate->dcerpc.dcerpchdrudp.rpc_vers != 4) { SCLogDebug("DCERPC UDP Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* We fall through to the next case if we still have input. * Same applies for other cases as well */ } /* fall through */ case 1: sstate->dcerpc.dcerpchdrudp.type = *(p++); if (!(--input_len)) break; /* fall through */ case 2: sstate->dcerpc.dcerpchdrudp.flags1 = *(p++); if (!(--input_len)) break; /* fall through */ case 3: sstate->dcerpc.dcerpchdrudp.flags2 = *(p++); if (!(--input_len)) break; /* fall through */ case 4: sstate->dcerpc.dcerpchdrudp.drep[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 5: sstate->dcerpc.dcerpchdrudp.drep[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 6: sstate->dcerpc.dcerpchdrudp.drep[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 7: sstate->dcerpc.dcerpchdrudp.serial_hi = *(p++); if (!(--input_len)) break; /* fall through */ case 8: sstate->dcerpc.dcerpchdrudp.objectuuid[3] = *(p++); if (!(--input_len)) break; /* fall through */ case 9: sstate->dcerpc.dcerpchdrudp.objectuuid[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 10: sstate->dcerpc.dcerpchdrudp.objectuuid[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 11: sstate->dcerpc.dcerpchdrudp.objectuuid[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 12: sstate->dcerpc.dcerpchdrudp.objectuuid[5] = *(p++); if (!(--input_len)) break; /* fall through */ case 13: sstate->dcerpc.dcerpchdrudp.objectuuid[4] = *(p++); if (!(--input_len)) break; /* fall through */ case 14: sstate->dcerpc.dcerpchdrudp.objectuuid[7] = *(p++); if (!(--input_len)) break; /* fall through */ case 15: sstate->dcerpc.dcerpchdrudp.objectuuid[6] = *(p++); if (!(--input_len)) break; /* fall through */ case 16: sstate->dcerpc.dcerpchdrudp.objectuuid[8] = *(p++); if (!(--input_len)) break; /* fall through */ case 17: sstate->dcerpc.dcerpchdrudp.objectuuid[9] = *(p++); if (!(--input_len)) break; /* fall through */ case 18: sstate->dcerpc.dcerpchdrudp.objectuuid[10] = *(p++); if (!(--input_len)) break; /* fall through */ case 19: sstate->dcerpc.dcerpchdrudp.objectuuid[11] = *(p++); if (!(--input_len)) break; /* fall through */ case 20: sstate->dcerpc.dcerpchdrudp.objectuuid[12] = *(p++); if (!(--input_len)) break; /* fall through */ case 21: sstate->dcerpc.dcerpchdrudp.objectuuid[13] = *(p++); if (!(--input_len)) break; /* fall through */ case 22: sstate->dcerpc.dcerpchdrudp.objectuuid[14] = *(p++); if (!(--input_len)) break; /* fall through */ case 23: sstate->dcerpc.dcerpchdrudp.objectuuid[15] = *(p++); if (!(--input_len)) break; /* fall through */ case 24: sstate->dcerpc.dcerpchdrudp.interfaceuuid[3] = *(p++); if (!(--input_len)) break; /* fall through */ case 25: sstate->dcerpc.dcerpchdrudp.interfaceuuid[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 26: sstate->dcerpc.dcerpchdrudp.interfaceuuid[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 27: sstate->dcerpc.dcerpchdrudp.interfaceuuid[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 28: sstate->dcerpc.dcerpchdrudp.interfaceuuid[5] = *(p++); if (!(--input_len)) break; /* fall through */ case 29: sstate->dcerpc.dcerpchdrudp.interfaceuuid[4] = *(p++); if (!(--input_len)) break; /* fall through */ case 30: sstate->dcerpc.dcerpchdrudp.interfaceuuid[7] = *(p++); if (!(--input_len)) break; /* fall through */ case 31: sstate->dcerpc.dcerpchdrudp.interfaceuuid[6] = *(p++); if (!(--input_len)) break; /* fall through */ case 32: sstate->dcerpc.dcerpchdrudp.interfaceuuid[8] = *(p++); if (!(--input_len)) break; /* fall through */ case 33: sstate->dcerpc.dcerpchdrudp.interfaceuuid[9] = *(p++); if (!(--input_len)) break; /* fall through */ case 34: sstate->dcerpc.dcerpchdrudp.interfaceuuid[10] = *(p++); if (!(--input_len)) break; /* fall through */ case 35: sstate->dcerpc.dcerpchdrudp.interfaceuuid[11] = *(p++); if (!(--input_len)) break; /* fall through */ case 36: sstate->dcerpc.dcerpchdrudp.interfaceuuid[12] = *(p++); if (!(--input_len)) break; /* fall through */ case 37: sstate->dcerpc.dcerpchdrudp.interfaceuuid[13] = *(p++); if (!(--input_len)) break; /* fall through */ case 38: sstate->dcerpc.dcerpchdrudp.interfaceuuid[14] = *(p++); if (!(--input_len)) break; /* fall through */ case 39: sstate->dcerpc.dcerpchdrudp.interfaceuuid[15] = *(p++); if (!(--input_len)) break; /* fall through */ case 40: sstate->dcerpc.dcerpchdrudp.activityuuid[3] = *(p++); if (!(--input_len)) break; /* fall through */ case 41: sstate->dcerpc.dcerpchdrudp.activityuuid[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 42: sstate->dcerpc.dcerpchdrudp.activityuuid[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 43: sstate->dcerpc.dcerpchdrudp.activityuuid[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 44: sstate->dcerpc.dcerpchdrudp.activityuuid[5] = *(p++); if (!(--input_len)) break; /* fall through */ case 45: sstate->dcerpc.dcerpchdrudp.activityuuid[4] = *(p++); if (!(--input_len)) break; /* fall through */ case 46: sstate->dcerpc.dcerpchdrudp.activityuuid[7] = *(p++); if (!(--input_len)) break; /* fall through */ case 47: sstate->dcerpc.dcerpchdrudp.activityuuid[6] = *(p++); if (!(--input_len)) break; /* fall through */ case 48: sstate->dcerpc.dcerpchdrudp.activityuuid[8] = *(p++); if (!(--input_len)) break; /* fall through */ case 49: sstate->dcerpc.dcerpchdrudp.activityuuid[9] = *(p++); if (!(--input_len)) break; /* fall through */ case 50: sstate->dcerpc.dcerpchdrudp.activityuuid[10] = *(p++); if (!(--input_len)) break; /* fall through */ case 51: sstate->dcerpc.dcerpchdrudp.activityuuid[11] = *(p++); if (!(--input_len)) break; /* fall through */ case 52: sstate->dcerpc.dcerpchdrudp.activityuuid[12] = *(p++); if (!(--input_len)) break; /* fall through */ case 53: sstate->dcerpc.dcerpchdrudp.activityuuid[13] = *(p++); if (!(--input_len)) break; /* fall through */ case 54: sstate->dcerpc.dcerpchdrudp.activityuuid[14] = *(p++); if (!(--input_len)) break; /* fall through */ case 55: sstate->dcerpc.dcerpchdrudp.activityuuid[15] = *(p++); if (!(--input_len)) break; /* fall through */ case 56: sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p++); if (!(--input_len)) break; /* fall through */ case 57: sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 58: sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 59: sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 60: sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p++); if (!(--input_len)) break; /* fall through */ case 61: sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 62: sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 63: sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 64: sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p++); if (!(--input_len)) break; /* fall through */ case 65: sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 66: sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 67: sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 68: sstate->dcerpc.dcerpchdrudp.opnum = *(p++); if (!(--input_len)) break; /* fall through */ case 69: sstate->dcerpc.dcerpchdrudp.opnum |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 70: sstate->dcerpc.dcerpchdrudp.ihint = *(p++); if (!(--input_len)) break; /* fall through */ case 71: sstate->dcerpc.dcerpchdrudp.ihint |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 72: sstate->dcerpc.dcerpchdrudp.ahint = *(p++); if (!(--input_len)) break; /* fall through */ case 73: sstate->dcerpc.dcerpchdrudp.ahint |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 74: sstate->dcerpc.dcerpchdrudp.fraglen = *(p++); if (!(--input_len)) break; /* fall through */ case 75: sstate->dcerpc.dcerpchdrudp.fraglen |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 76: sstate->dcerpc.dcerpchdrudp.fragnum = *(p++); if (!(--input_len)) break; /* fall through */ case 77: sstate->dcerpc.dcerpchdrudp.fragnum |= *(p++); if (!(--input_len)) break; /* fall through */ case 78: sstate->dcerpc.dcerpchdrudp.auth_proto = *(p++); if (!(--input_len)) break; /* fall through */ case 79: sstate->dcerpc.dcerpchdrudp.serial_lo = *(p++); if (sstate->dcerpc.dcerpchdrudp.drep[0] != 0x10) { sstate->dcerpc.dcerpchdrudp.server_boot = SCByteSwap32(sstate->dcerpc.dcerpchdrudp.server_boot); sstate->dcerpc.dcerpchdrudp.if_vers= SCByteSwap32(sstate->dcerpc.dcerpchdrudp.if_vers); sstate->dcerpc.dcerpchdrudp.seqnum= SCByteSwap32(sstate->dcerpc.dcerpchdrudp.seqnum); sstate->dcerpc.dcerpchdrudp.opnum = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.opnum); sstate->dcerpc.dcerpchdrudp.ihint= SCByteSwap16(sstate->dcerpc.dcerpchdrudp.ihint); sstate->dcerpc.dcerpchdrudp.ahint = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.ahint); sstate->dcerpc.dcerpchdrudp.fraglen = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.fraglen); sstate->dcerpc.dcerpchdrudp.fragnum = SCByteSwap16(sstate->dcerpc.dcerpchdrudp.fragnum); } sstate->fraglenleft = sstate->dcerpc.dcerpchdrudp.fraglen; sstate->uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, sizeof(DCERPCUuidEntry)); if (sstate->uuid_entry == NULL) { SCReturnUInt(-1); } else { memcpy(sstate->uuid_entry->uuid, sstate->dcerpc.dcerpchdrudp.activityuuid, sizeof(sstate->dcerpc.dcerpchdrudp.activityuuid)); TAILQ_INSERT_HEAD(&sstate->uuid_list, sstate->uuid_entry, next); #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("DCERPC UDP", sstate->uuid_entry); } #endif } --input_len; break; } } sstate->bytesprocessed += (p - input); SCReturnInt((p - input)); } static int DCERPCUDPParse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { uint32_t retval = 0; uint32_t parsed = 0; int hdrretval = 0; SCEnter(); if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } DCERPCUDPState *sstate = (DCERPCUDPState *) dcerpc_state; while (sstate->bytesprocessed < DCERPC_UDP_HDR_LEN && input_len) { hdrretval = DCERPCUDPParseHeader(f, dcerpc_state, pstate, input, input_len); if (hdrretval == -1 || hdrretval > (int32_t)input_len) { sstate->bytesprocessed = 0; SCReturnInt(hdrretval); } else { parsed += hdrretval; input_len -= hdrretval; } } #if 0 printf("Done with DCERPCUDPParseHeader bytesprocessed %u/%u left %u\n", sstate->bytesprocessed, sstate->dcerpc.dcerpchdrudp.fraglen, input_len); printf("\nDCERPC Version:\t%u\n", sstate->dcerpc.dcerpchdrudp.rpc_vers); printf("DCERPC Type:\t%u\n", sstate->dcerpc.dcerpchdrudp.ptype); printf("DCERPC Flags1:\t0x%02x\n", sstate->dcerpc.dcerpchdrudp.flags1); printf("DCERPC Flags2:\t0x%02x\n", sstate->dcerpc.dcerpchdrudp.flags2); printf("DCERPC Packed Drep:\t%02x %02x %02x\n", sstate->dcerpc.dcerpchdrudp.drep[0], sstate->dcerpc.dcerpchdrudp.drep[1], sstate->dcerpc.dcerpchdrudp.drep[2]); printf("DCERPC Frag Length:\t0x%04x %u\n", sstate->dcerpc.dcerpchdrudp.fraglen, sstate->dcerpc.dcerpchdrudp.fraglen); printf("DCERPC Frag Number:\t0x%04x\n", sstate->dcerpc.dcerpchdrudp.fragnum); printf("DCERPC OpNum:\t0x%04x\n", sstate->dcerpc.dcerpchdrudp.opnum); #endif while (sstate->bytesprocessed >= DCERPC_UDP_HDR_LEN && sstate->bytesprocessed < sstate->dcerpc.dcerpchdrudp.fraglen && input_len) { retval = FragmentDataParser(f, dcerpc_state, pstate, input + parsed, input_len); if (retval || retval > input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing DCERPC UDP Fragment Data"); parsed -= input_len; input_len = 0; sstate->bytesprocessed = 0; } } if (sstate->bytesprocessed == sstate->dcerpc.dcerpchdrudp.fraglen) { sstate->bytesprocessed = 0; } if (pstate == NULL) SCReturnInt(-1); SCReturnInt(1); } static void *DCERPCUDPStateAlloc(void) { void *s = SCMalloc(sizeof(DCERPCUDPState)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(DCERPCUDPState)); return s; } static void DCERPCUDPStateFree(void *s) { DCERPCUDPState *sstate = (DCERPCUDPState *) s; DCERPCUuidEntry *item; while ((item = TAILQ_FIRST(&sstate->uuid_list))) { //printUUID("Free", item); TAILQ_REMOVE(&sstate->uuid_list, item, next); SCFree(item); } if (sstate->dcerpc.dcerpcrequest.stub_data_buffer != NULL) { SCFree(sstate->dcerpc.dcerpcrequest.stub_data_buffer); sstate->dcerpc.dcerpcrequest.stub_data_buffer = NULL; sstate->dcerpc.dcerpcrequest.stub_data_buffer_len = 0; } if (sstate->dcerpc.dcerpcresponse.stub_data_buffer != NULL) { SCFree(sstate->dcerpc.dcerpcresponse.stub_data_buffer); sstate->dcerpc.dcerpcresponse.stub_data_buffer = NULL; sstate->dcerpc.dcerpcresponse.stub_data_buffer_len = 0; } SCFree(s); } static int DCERPCUDPRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_DCERPC, "|04 00|", 2, 0, STREAM_TOSERVER) < 0) { return -1; } return 0; } void RegisterDCERPCUDPParsers(void) { char *proto_name = "dcerpc"; if (AppLayerProtoDetectConfProtoDetectionEnabled("udp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_DCERPC, proto_name); if (DCERPCUDPRegisterPatternsForProtocolDetection() < 0) return; } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", "dcerpc"); return; } if (AppLayerParserConfParserEnabled("udp", "dcerpc")) { AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOSERVER, DCERPCUDPParse); AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOCLIENT, DCERPCUDPParse); AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPStateAlloc, DCERPCUDPStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_UDP, ALPROTO_DCERPC, STREAM_TOSERVER); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", "dcerpc"); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_UDP, ALPROTO_DCERPC, DCERPCUDPParserRegisterTests); #endif return; } /* UNITTESTS */ #ifdef UNITTESTS /** \test DCERPC UDP Header Parsing and UUID handling */ int DCERPCUDPParserTest01(void) { int result = 1; Flow f; uint8_t dcerpcrequest[] = { 0x04, 0x00, 0x2c, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x3f, 0x98, 0xf0, 0x5c, 0xd9, 0x63, 0xcc, 0x46, 0xc2, 0x74, 0x51, 0x6c, 0x8a, 0x53, 0x7d, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0xff, 0xff, 0xff, 0xff, 0x70, 0x05, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x32, 0x24, 0x58, 0xfd, 0xcc, 0x45, 0x64, 0x49, 0xb0, 0x70, 0xdd, 0xae, 0x74, 0x2c, 0x96, 0xd2, 0x60, 0x5e, 0x0d, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x5e, 0x0d, 0x00, 0x02, 0x00, 0x00, 0x00, 0x7c, 0x5e, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x80, 0x96, 0xf1, 0xf1, 0x2a, 0x4d, 0xce, 0x11, 0xa6, 0x6a, 0x00, 0x20, 0xaf, 0x6e, 0x72, 0xf4, 0x0c, 0x00, 0x00, 0x00, 0x4d, 0x41, 0x52, 0x42, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0xf0, 0xad, 0xba, 0x00, 0x00, 0x00, 0x00, 0xa8, 0xf4, 0x0b, 0x00, 0x10, 0x09, 0x00, 0x00, 0x10, 0x09, 0x00, 0x00, 0x4d, 0x45, 0x4f, 0x57, 0x04, 0x00, 0x00, 0x00, 0xa2, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x38, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x08, 0x00, 0x00, 0xd8, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0xc8, 0x00, 0x00, 0x00, 0x4d, 0x45, 0x4f, 0x57, 0xd8, 0x08, 0x00, 0x00, 0xd8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc4, 0x28, 0xcd, 0x00, 0x64, 0x29, 0xcd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0xb9, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xab, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xa5, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xa6, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xa4, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xad, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x07, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x28, 0x06, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x50, 0x00, 0x00, 0x00, 0x4f, 0xb6, 0x88, 0x20, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x48, 0x00, 0x00, 0x00, 0x07, 0x00, 0x66, 0x00, 0x06, 0x09, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x78, 0x19, 0x0c, 0x00, 0x58, 0x00, 0x00, 0x00, 0x05, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x00, 0x70, 0xd8, 0x98, 0x93, 0x98, 0x4f, 0xd2, 0x11, 0xa9, 0x3d, 0xbe, 0x57, 0xb2, 0x00, 0x00, 0x00, 0x32, 0x00, 0x31, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x80, 0x00, 0x00, 0x00, 0x0d, 0xf0, 0xad, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x43, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x4d, 0x45, 0x4f, 0x57, 0x04, 0x00, 0x00, 0x00, 0xc0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x3b, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x81, 0xc5, 0x17, 0x03, 0x80, 0x0e, 0xe9, 0x4a, 0x99, 0x99, 0xf1, 0x8a, 0x50, 0x6f, 0x7a, 0x85, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x30, 0x00, 0x00, 0x00, 0x78, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd8, 0xda, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x2f, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x46, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x08, 0x00, 0xcc, 0xcc, 0xcc, 0xcc, 0x68, 0x00, 0x00, 0x00, 0x0e, 0x00, 0xff, 0xff, 0x68, 0x8b, 0x0b, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x02, 0x00, 0x00, 0x5c, 0x00, 0x5c, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x31, 0x00, 0x9d, 0x13, 0x00, 0x01, 0xcc, 0xe0, 0xfd, 0x7f, 0xcc, 0xe0, 0xfd, 0x7f, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; uint32_t requestlen = sizeof(dcerpcrequest); TcpSession ssn; DCERPCUuidEntry *uuid_entry; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_UDP; f.protomap = FlowGetProtoMapping(f.proto); StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpcrequest, requestlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCUDPState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdrudp.rpc_vers != 4) { printf("expected dcerpc version 0x04, got 0x%02x : ", dcerpc_state->dcerpc.dcerpchdrudp.rpc_vers); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdrudp.fraglen != 1392) { printf("expected dcerpc fraglen 0x%02x , got 0x%02x : ", 1392, dcerpc_state->dcerpc.dcerpchdrudp.fraglen); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdrudp.opnum != 4) { printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 4, dcerpc_state->dcerpc.dcerpchdrudp.opnum); result = 0; goto end; } TAILQ_FOREACH(uuid_entry, &dcerpc_state->uuid_list, next) { printUUID("REQUEST", uuid_entry); } end: if (alp_tctx != NULL) { AppLayerParserThreadCtxFree(alp_tctx); } StreamTcpFreeConfig(TRUE); return result; } void DCERPCUDPParserRegisterTests(void) { UtRegisterTest("DCERPCUDPParserTest01", DCERPCUDPParserTest01); } #endif suricata-3.2.1/src/log-filestore.c0000644000000000000000000004072713051004444013732 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threadvars.h" #include "tm-modules.h" #include "threads.h" #include "app-layer-parser.h" #include "detect-filemagic.h" #include "stream.h" #include "util-print.h" #include "util-unittest.h" #include "util-privs.h" #include "util-debug.h" #include "util-atomic.h" #include "util-file.h" #include "util-time.h" #include "util-misc.h" #include "output.h" #include "log-file.h" #include "util-logopenfile.h" #include "app-layer-htp.h" #include "app-layer-smtp.h" #include "util-decode-mime.h" #include "util-memcmp.h" #include "stream-tcp-reassemble.h" #define MODULE_NAME "LogFilestoreLog" static char g_logfile_base_dir[PATH_MAX] = "/tmp"; typedef struct LogFilestoreLogThread_ { LogFileCtx *file_ctx; /** LogFilestoreCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t file_cnt; } LogFilestoreLogThread; static void LogFilestoreMetaGetUri(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud->request_uri_normalized != NULL) { PrintRawUriFp(fp, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); } return; } } fprintf(fp, ""); } static void LogFilestoreMetaGetHost(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL && tx->request_hostname != NULL) { PrintRawUriFp(fp, (uint8_t *)bstr_ptr(tx->request_hostname), bstr_len(tx->request_hostname)); return; } } fprintf(fp, ""); } static void LogFilestoreMetaGetReferer(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { htp_header_t *h = NULL; h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Referer"); if (h != NULL) { PrintRawUriFp(fp, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value)); return; } } } fprintf(fp, ""); } static void LogFilestoreMetaGetUserAgent(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { htp_header_t *h = NULL; h = (htp_header_t *)htp_table_get_c(tx->request_headers, "User-Agent"); if (h != NULL) { PrintRawUriFp(fp, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value)); return; } } } fprintf(fp, ""); } static void LogFilestoreMetaGetSmtp(FILE *fp, const Packet *p, const File *ff) { SMTPState *state = (SMTPState *) p->flow->alstate; if (state != NULL) { SMTPTransaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_SMTP, state, ff->txid); if (tx == NULL || tx->msg_tail == NULL) return; /* Message Id */ if (tx->msg_tail->msg_id != NULL) { fprintf(fp, "MESSAGE-ID: "); PrintRawUriFp(fp, (uint8_t *) tx->msg_tail->msg_id, tx->msg_tail->msg_id_len); fprintf(fp, "\n"); } /* Sender */ MimeDecField *field = MimeDecFindField(tx->msg_tail, "from"); if (field != NULL) { fprintf(fp, "SENDER: "); PrintRawUriFp(fp, (uint8_t *) field->value, field->value_len); fprintf(fp, "\n"); } } } static void LogFilestoreLogCreateMetaFile(const Packet *p, const File *ff, char *filename, int ipver) { char metafilename[PATH_MAX] = ""; snprintf(metafilename, sizeof(metafilename), "%s.meta", filename); FILE *fp = fopen(metafilename, "w+"); if (fp != NULL) { char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); fprintf(fp, "TIME: %s\n", timebuf); if (p->pcap_cnt > 0) { fprintf(fp, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); } char srcip[46], dstip[46]; Port sp, dp; switch (ipver) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); break; default: strlcpy(srcip, "", sizeof(srcip)); strlcpy(dstip, "", sizeof(dstip)); break; } sp = p->sp; dp = p->dp; fprintf(fp, "SRC IP: %s\n", srcip); fprintf(fp, "DST IP: %s\n", dstip); fprintf(fp, "PROTO: %" PRIu32 "\n", p->proto); if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) { fprintf(fp, "SRC PORT: %" PRIu16 "\n", sp); fprintf(fp, "DST PORT: %" PRIu16 "\n", dp); } fprintf(fp, "APP PROTO: %s\n", AppProtoToString(p->flow->alproto)); /* Only applicable to HTTP traffic */ if (p->flow->alproto == ALPROTO_HTTP) { fprintf(fp, "HTTP URI: "); LogFilestoreMetaGetUri(fp, p, ff); fprintf(fp, "\n"); fprintf(fp, "HTTP HOST: "); LogFilestoreMetaGetHost(fp, p, ff); fprintf(fp, "\n"); fprintf(fp, "HTTP REFERER: "); LogFilestoreMetaGetReferer(fp, p, ff); fprintf(fp, "\n"); fprintf(fp, "HTTP USER AGENT: "); LogFilestoreMetaGetUserAgent(fp, p, ff); fprintf(fp, "\n"); } else if (p->flow->alproto == ALPROTO_SMTP) { /* Only applicable to SMTP */ LogFilestoreMetaGetSmtp(fp, p, ff); } fprintf(fp, "FILENAME: "); PrintRawUriFp(fp, ff->name, ff->name_len); fprintf(fp, "\n"); fclose(fp); } } static void LogFilestoreLogCloseMetaFile(const File *ff) { char filename[PATH_MAX] = ""; snprintf(filename, sizeof(filename), "%s/file.%u", g_logfile_base_dir, ff->file_id); char metafilename[PATH_MAX] = ""; snprintf(metafilename, sizeof(metafilename), "%s.meta", filename); FILE *fp = fopen(metafilename, "a"); if (fp != NULL) { #ifdef HAVE_MAGIC fprintf(fp, "MAGIC: %s\n", ff->magic ? ff->magic : ""); #endif switch (ff->state) { case FILE_STATE_CLOSED: fprintf(fp, "STATE: CLOSED\n"); #ifdef HAVE_NSS if (ff->flags & FILE_MD5) { fprintf(fp, "MD5: "); size_t x; for (x = 0; x < sizeof(ff->md5); x++) { fprintf(fp, "%02x", ff->md5[x]); } fprintf(fp, "\n"); } if (ff->flags & FILE_SHA1) { fprintf(fp, "SHA1: "); size_t x; for (x = 0; x < sizeof(ff->sha1); x++) { fprintf(fp, "%02x", ff->sha1[x]); } fprintf(fp, "\n"); } if (ff->flags & FILE_SHA256) { fprintf(fp, "SHA256: "); size_t x; for (x = 0; x < sizeof(ff->sha256); x++) { fprintf(fp, "%02x", ff->sha256[x]); } fprintf(fp, "\n"); } #endif break; case FILE_STATE_TRUNCATED: fprintf(fp, "STATE: TRUNCATED\n"); break; case FILE_STATE_ERROR: fprintf(fp, "STATE: ERROR\n"); break; default: fprintf(fp, "STATE: UNKNOWN\n"); break; } fprintf(fp, "SIZE: %"PRIu64"\n", FileTrackedSize(ff)); fclose(fp); } else { SCLogInfo("opening %s failed: %s", metafilename, strerror(errno)); } } static int LogFilestoreLogger(ThreadVars *tv, void *thread_data, const Packet *p, const File *ff, const uint8_t *data, uint32_t data_len, uint8_t flags) { SCEnter(); LogFilestoreLogThread *aft = (LogFilestoreLogThread *)thread_data; char filename[PATH_MAX] = ""; int file_fd = -1; int ipver = -1; /* no flow, no htp state */ if (p->flow == NULL) { SCReturnInt(TM_ECODE_OK); } if (PKT_IS_IPV4(p)) { ipver = AF_INET; } else if (PKT_IS_IPV6(p)) { ipver = AF_INET6; } else { return 0; } SCLogDebug("ff %p, data %p, data_len %u", ff, data, data_len); snprintf(filename, sizeof(filename), "%s/file.%u", g_logfile_base_dir, ff->file_id); if (flags & OUTPUT_FILEDATA_FLAG_OPEN) { aft->file_cnt++; /* create a .meta file that contains time, src/dst/sp/dp/proto */ LogFilestoreLogCreateMetaFile(p, ff, filename, ipver); file_fd = open(filename, O_CREAT | O_TRUNC | O_NOFOLLOW | O_WRONLY, 0644); if (file_fd == -1) { SCLogDebug("failed to create file"); return -1; } /* we can get called with a NULL ffd when we need to close */ } else if (data != NULL) { file_fd = open(filename, O_APPEND | O_NOFOLLOW | O_WRONLY); if (file_fd == -1) { SCLogDebug("failed to open file %s: %s", filename, strerror(errno)); return -1; } } if (file_fd != -1) { ssize_t r = write(file_fd, (const void *)data, (size_t)data_len); if (r == -1) { SCLogDebug("write failed: %s", strerror(errno)); } close(file_fd); } if (flags & OUTPUT_FILEDATA_FLAG_CLOSE) { LogFilestoreLogCloseMetaFile(ff); } return 0; } static TmEcode LogFilestoreLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogFilestoreLogThread *aft = SCMalloc(sizeof(LogFilestoreLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogFilestoreLogThread)); if (initdata == NULL) { SCLogDebug("Error getting context for LogFileStore. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->file_ctx = ((OutputCtx *)initdata)->data; struct stat stat_buf; if (stat(g_logfile_base_dir, &stat_buf) != 0) { int ret; ret = mkdir(g_logfile_base_dir, S_IRWXU|S_IXGRP|S_IRGRP); if (ret != 0) { int err = errno; if (err != EEXIST) { SCLogError(SC_ERR_LOGDIR_CONFIG, "Cannot create file drop directory %s: %s", g_logfile_base_dir, strerror(err)); exit(EXIT_FAILURE); } } else { SCLogInfo("Created file drop directory %s", g_logfile_base_dir); } } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode LogFilestoreLogThreadDeinit(ThreadVars *t, void *data) { LogFilestoreLogThread *aft = (LogFilestoreLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } /* clear memory */ memset(aft, 0, sizeof(LogFilestoreLogThread)); SCFree(aft); return TM_ECODE_OK; } static void LogFilestoreLogExitPrintStats(ThreadVars *tv, void *data) { LogFilestoreLogThread *aft = (LogFilestoreLogThread *)data; if (aft == NULL) { return; } SCLogInfo("(%s) Files extracted %" PRIu32 "", tv->name, aft->file_cnt); } /** * \internal * * \brief deinit the log ctx and write out the waldo * * \param output_ctx output context to deinit */ static void LogFilestoreLogDeInitCtx(OutputCtx *output_ctx) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; LogFileFreeCtx(logfile_ctx); SCFree(output_ctx); } /** \brief Create a new http log LogFilestoreCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFilestoreCtx* to the file_ctx if succesful * */ static OutputCtx *LogFilestoreLogInitCtx(ConfNode *conf) { OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) return NULL; output_ctx->data = NULL; output_ctx->DeInit = LogFilestoreLogDeInitCtx; char *s_default_log_dir = NULL; s_default_log_dir = ConfigGetLogDirectory(); const char *s_base_dir = NULL; s_base_dir = ConfNodeLookupChildValue(conf, "log-dir"); if (s_base_dir == NULL || strlen(s_base_dir) == 0) { strlcpy(g_logfile_base_dir, s_default_log_dir, sizeof(g_logfile_base_dir)); } else { if (PathIsAbsolute(s_base_dir)) { strlcpy(g_logfile_base_dir, s_base_dir, sizeof(g_logfile_base_dir)); } else { snprintf(g_logfile_base_dir, sizeof(g_logfile_base_dir), "%s/%s", s_default_log_dir, s_base_dir); } } const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore"); if (force_filestore != NULL && ConfValIsTrue(force_filestore)) { FileForceFilestoreEnable(); SCLogInfo("forcing filestore of all files"); } const char *force_magic = ConfNodeLookupChildValue(conf, "force-magic"); if (force_magic != NULL && ConfValIsTrue(force_magic)) { FileForceMagicEnable(); SCLogInfo("forcing magic lookup for stored files"); } FileForceHashParseCfg(conf); SCLogInfo("storing files in %s", g_logfile_base_dir); const char *stream_depth_str = ConfNodeLookupChildValue(conf, "stream-depth"); if (stream_depth_str != NULL && strcmp(stream_depth_str, "no")) { uint32_t stream_depth = 0; if (ParseSizeStringU32(stream_depth_str, &stream_depth) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "file-store.stream-depth " "from conf file - %s. Killing engine", stream_depth_str); exit(EXIT_FAILURE); } else { FileReassemblyDepthEnable(stream_depth); } } SCReturnPtr(output_ctx, "OutputCtx"); } void LogFilestoreRegister (void) { OutputRegisterFiledataModule(LOGGER_FILE_STORE, MODULE_NAME, "file", LogFilestoreLogInitCtx, LogFilestoreLogger, LogFilestoreLogThreadInit, LogFilestoreLogThreadDeinit, LogFilestoreLogExitPrintStats); OutputRegisterFiledataModule(LOGGER_FILE_STORE, MODULE_NAME, "file-store", LogFilestoreLogInitCtx, LogFilestoreLogger, LogFilestoreLogThreadInit, LogFilestoreLogThreadDeinit, LogFilestoreLogExitPrintStats); SCLogDebug("registered"); } suricata-3.2.1/src/detect-engine-address-ipv4.c0000644000000000000000000013135213051004444016170 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * IPV4 Address part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "flow-var.h" #include "util-cidr.h" #include "util-unittest.h" #include "detect-engine-address.h" #include "detect-engine-siggroup.h" #include "detect-engine-port.h" #include "util-error.h" #include "util-debug.h" /** * \brief Compares 2 addresses(address ranges) and returns the relationship * between the 2 addresses. * * \param a Pointer to the first address instance to be compared. * \param b Pointer to the second address instance to be compared. * * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal. * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2. * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2. * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2 * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2 * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2 * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only * after the end of the address range for 'b' */ int DetectAddressCmpIPv4(DetectAddress *a, DetectAddress *b) { uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]); uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]); uint32_t b_ip1 = ntohl(b->ip.addr_data32[0]); uint32_t b_ip2 = ntohl(b->ip2.addr_data32[0]); if (a_ip1 == b_ip1 && a_ip2 == b_ip2) { SCLogDebug("ADDRESS_EQ"); return ADDRESS_EQ; } else if (a_ip1 >= b_ip1 && a_ip1 <= b_ip2 && a_ip2 <= b_ip2) { SCLogDebug("ADDRESS_ES"); return ADDRESS_ES; } else if (a_ip1 <= b_ip1 && a_ip2 >= b_ip2) { SCLogDebug("ADDRESS_EB"); return ADDRESS_EB; } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2 && a_ip2 >= b_ip1) { SCLogDebug("ADDRESS_LE"); return ADDRESS_LE; } else if (a_ip1 < b_ip1 && a_ip2 < b_ip2) { SCLogDebug("ADDRESS_LT"); return ADDRESS_LT; } else if (a_ip1 > b_ip1 && a_ip1 <= b_ip2 && a_ip2 > b_ip2) { SCLogDebug("ADDRESS_GE"); return ADDRESS_GE; } else if (a_ip1 > b_ip2) { SCLogDebug("ADDRESS_GT"); return ADDRESS_GT; } else { /* should be unreachable */ SCLogDebug("Internal Error: should be unreachable"); } return ADDRESS_ER; } /** * \brief Cut groups and merge sigs * * a = 1.2.3.4, b = 1.2.3.4-1.2.3.5 * must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL * * a = 1.2.3.4, b = 1.2.3.3-1.2.3.5 * must result in: a == 1.2.3.3, b == 1.2.3.4, c == 1.2.3.5 * * a = 1.2.3.0/24 b = 1.2.3.128-1.2.4.10 * must result in: a == 1.2.3.0/24, b == 1.2.4.0-1.2.4.10, c == NULL * * a = 1.2.3.4, b = 1.2.3.0/24 * must result in: a == 1.2.3.0-1.2.3.3, b == 1.2.3.4, c == 1.2.3.5-1.2.3.255 * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressCutIPv4(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c) { uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]); uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]); uint32_t b_ip1 = ntohl(b->ip.addr_data32[0]); uint32_t b_ip2 = ntohl(b->ip2.addr_data32[0]); DetectAddress *tmp = NULL; DetectAddress *tmp_c = NULL; int r = 0; /* default to NULL */ *c = NULL; r = DetectAddressCmpIPv4(a, b); if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) { SCLogDebug("we shouldn't be here"); goto error; } /* get a place to temporary put sigs lists */ tmp = DetectAddressInit(); if (tmp == NULL) goto error; /* we have 3 parts: [aaa[abab)bbb] * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ if (r == ADDRESS_LE) { SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_LE"); a->ip.addr_data32[0] = htonl(a_ip1); a->ip2.addr_data32[0] = htonl(b_ip1 - 1); b->ip.addr_data32[0] = htonl(b_ip1); b->ip2.addr_data32[0] = htonl(a_ip2); tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET; tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1); tmp_c->ip2.addr_data32[0] = htonl(b_ip2); *c = tmp_c; /* we have 3 parts: [bbb[baba]aaa] * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_GE) { SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_GE"); a->ip.addr_data32[0] = htonl(b_ip1); a->ip2.addr_data32[0] = htonl(a_ip1 - 1); b->ip.addr_data32[0] = htonl(a_ip1); b->ip2.addr_data32[0] = htonl(b_ip2); tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET; tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1); tmp_c->ip2.addr_data32[0] = htonl(a_ip2); *c = tmp_c; /* we have 2 or three parts: * * 2 part: [[abab]bbb] or [bbb[baba]] * part a: a_ip1 <-> a_ip2 * part b: a_ip2 + 1 <-> b_ip2 * * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * * 3 part [bbb[aaa]bbb] * becomes[aaa[bbb]ccc] * * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ } else if (r == ADDRESS_ES) { SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_ES"); if (a_ip1 == b_ip1) { SCLogDebug("DetectAddressCutIPv4: 1"); a->ip.addr_data32[0] = htonl(a_ip1); a->ip2.addr_data32[0] = htonl(a_ip2); b->ip.addr_data32[0] = htonl(a_ip2 + 1); b->ip2.addr_data32[0] = htonl(b_ip2); } else if (a_ip2 == b_ip2) { SCLogDebug("DetectAddressCutIPv4: 2"); a->ip.addr_data32[0] = htonl(b_ip1); a->ip2.addr_data32[0] = htonl(a_ip1 - 1); b->ip.addr_data32[0] = htonl(a_ip1); b->ip2.addr_data32[0] = htonl(a_ip2); } else { SCLogDebug("3"); a->ip.addr_data32[0] = htonl(b_ip1); a->ip2.addr_data32[0] = htonl(a_ip1 - 1); b->ip.addr_data32[0] = htonl(a_ip1); b->ip2.addr_data32[0] = htonl(a_ip2); tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET; tmp_c->ip.addr_data32[0] = htonl(a_ip2 + 1); tmp_c->ip2.addr_data32[0] = htonl(b_ip2); *c = tmp_c; } /* we have 2 or three parts: * * 2 part: [[baba]aaa] or [aaa[abab]] * part a: b_ip1 <-> b_ip2 * part b: b_ip2 + 1 <-> a_ip2 * * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> b_ip2 * * 3 part [aaa[bbb]aaa] * becomes[aaa[bbb]ccc] * * part a: a_ip1 <-> b_ip2 - 1 * part b: b_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_EB) { SCLogDebug("DetectAddressCutIPv4: r == ADDRESS_EB"); if (a_ip1 == b_ip1) { SCLogDebug("DetectAddressCutIPv4: 1"); a->ip.addr_data32[0] = htonl(b_ip1); a->ip2.addr_data32[0] = htonl(b_ip2); b->ip.addr_data32[0] = htonl(b_ip2 + 1); b->ip2.addr_data32[0] = htonl(a_ip2); } else if (a_ip2 == b_ip2) { SCLogDebug("DetectAddressCutIPv4: 2"); a->ip.addr_data32[0] = htonl(a_ip1); a->ip2.addr_data32[0] = htonl(b_ip1 - 1); b->ip.addr_data32[0] = htonl(b_ip1); b->ip2.addr_data32[0] = htonl(b_ip2); } else { SCLogDebug("DetectAddressCutIPv4: 3"); a->ip.addr_data32[0] = htonl(a_ip1); a->ip2.addr_data32[0] = htonl(b_ip1 - 1); b->ip.addr_data32[0] = htonl(b_ip1); b->ip2.addr_data32[0] = htonl(b_ip2); tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET; tmp_c->ip.addr_data32[0] = htonl(b_ip2 + 1); tmp_c->ip2.addr_data32[0] = htonl(a_ip2); *c = tmp_c; } } if (tmp != NULL) DetectAddressFree(tmp); return 0; error: if (tmp != NULL) DetectAddressFree(tmp); return -1; } /** * \brief Check if the address group list covers the complete IPv4 IP space. * * \param ag Pointer to a DetectAddress list head, which has to be checked to * see if the address ranges in it, cover the entire IPv4 IP space. * * \retval 1 Yes, it covers the entire IPv4 address range. * \retval 0 No, it doesn't cover the entire IPv4 address range. */ int DetectAddressIsCompleteIPSpaceIPv4(DetectAddress *ag) { uint32_t next_ip = 0; if (ag == NULL) return 0; /* if we don't start with 0.0.0.0 we know we're good */ if (ntohl(ag->ip.addr_data32[0]) != 0x00000000) return 0; /* if we're ending with 255.255.255.255 while we know we started with * 0.0.0.0 it's the complete space */ if (ntohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF) return 1; next_ip = htonl(ntohl(ag->ip2.addr_data32[0]) + 1); ag = ag->next; for ( ; ag != NULL; ag = ag->next) { if (ag->ip.addr_data32[0] != next_ip) return 0; if (ntohl(ag->ip2.addr_data32[0]) == 0xFFFFFFFF) return 1; next_ip = htonl(ntohl(ag->ip2.addr_data32[0]) + 1); } return 0; } /** * \brief Cuts and returns an address range, which is the complement of the * address range that is supplied as the argument. * * For example: * * If a = 0.0.0.0-1.2.3.4, * then a = 1.2.3.4-255.255.255.255 and b = NULL * If a = 1.2.3.4-255.255.255.255, * then a = 0.0.0.0-1.2.3.4 and b = NULL * If a = 1.2.3.4-192.168.1.1, * then a = 0.0.0.0-1.2.3.3 and b = 192.168.1.2-255.255.255.255 * * \param a Pointer to an address range (DetectAddress) instance whose complement * has to be returned in a and b. * \param b Pointer to DetectAddress pointer, that will be supplied back with a * new DetectAddress instance, if the complement demands so. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressCutNotIPv4(DetectAddress *a, DetectAddress **b) { uint32_t a_ip1 = ntohl(a->ip.addr_data32[0]); uint32_t a_ip2 = ntohl(a->ip2.addr_data32[0]); DetectAddress *tmp_b = NULL; /* default to NULL */ *b = NULL; if (a_ip1 != 0x00000000 && a_ip2 != 0xFFFFFFFF) { a->ip.addr_data32[0] = htonl(0x00000000); a->ip2.addr_data32[0] = htonl(a_ip1 - 1); tmp_b = DetectAddressInit(); if (tmp_b == NULL) goto error; tmp_b->ip.family = AF_INET; tmp_b->ip.addr_data32[0] = htonl(a_ip2 + 1); tmp_b->ip2.addr_data32[0] = htonl(0xFFFFFFFF); *b = tmp_b; } else if (a_ip1 == 0x00000000 && a_ip2 != 0xFFFFFFFF) { a->ip.addr_data32[0] = htonl(a_ip2 + 1); a->ip2.addr_data32[0] = htonl(0xFFFFFFFF); } else if (a_ip1 != 0x00000000 && a_ip2 == 0xFFFFFFFF) { a->ip.addr_data32[0] = htonl(0x00000000); a->ip2.addr_data32[0] = htonl(a_ip1 - 1); } else { goto error; } return 0; error: return -1; } /** * \brief Extends a target address range if the the source address range is * wider than the target address range on either sides. * * Every address is a range, i.e. address->ip1....address->ip2. For * example 1.2.3.4 to 192.168.1.1. * if source->ip1 is smaller than target->ip1, it indicates that the * source's left address limit is greater(range wise) than the target's * left address limit, and hence we reassign the target's left address * limit to source's left address limit. * Similary if source->ip2 is greater than target->ip2, it indicates that * the source's right address limit is greater(range wise) than the * target's right address limit, and hence we reassign the target's right * address limit to source's right address limit. * * \param de_ctx Pointer to the detection engine context. * \param target Pointer to the target DetectAddress instance that has to be * updated. * \param source Pointer to the source DetectAddress instance that is used * to decided whether we extend the target's address range. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressJoinIPv4(DetectEngineCtx *de_ctx, DetectAddress *target, DetectAddress *source) { if (source == NULL || target == NULL) return -1; if (ntohl(source->ip.addr_data32[0]) < ntohl(target->ip.addr_data32[0])) target->ip.addr_data32[0] = source->ip.addr_data32[0]; if (ntohl(source->ip2.addr_data32[0]) > ntohl(target->ip2.addr_data32[0])) target->ip2.addr_data32[0] = source->ip2.addr_data32[0]; return 0; } /********************************Unittests*************************************/ #ifdef UNITTESTS static int DetectAddressIPv4TestAddressCmp01(void) { struct in_addr in; int result = 1; DetectAddress *a = DetectAddressInit(); if (a == NULL) return 0; DetectAddress *b = DetectAddressInit(); if (b == NULL) { DetectAddressFree(a); return 0; } if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EQ); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_ES); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_ES); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_EB); if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_EB); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE); if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE); if (inet_pton(AF_INET, "170.170.170.169", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LE); if (inet_pton(AF_INET, "170.170.170.169", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LE); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_LT); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "185.185.185.185", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; /* we could get a LE */ result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; /* we could get a LE */ result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_LT); if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE); if (inet_pton(AF_INET, "128.128.128.128", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE); if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE); if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.169", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "180.180.180.180", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GE); if (inet_pton(AF_INET, "170.170.170.169", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE); if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.169.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GE); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "200.200.200.200", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "185.185.185.185", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) == ADDRESS_GT); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "200.200.200.200", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT); if (inet_pton(AF_INET, "182.168.1.2", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "200.200.200.200", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "170.170.170.170", &in) < 0) goto error; b->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; b->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCmpIPv4(a, b) != ADDRESS_GT); DetectAddressFree(a); DetectAddressFree(b); return result; error: DetectAddressFree(a); DetectAddressFree(b); return 0; } static int DetectAddressIPv4IsCompleteIPSpace02(void) { DetectAddress *a = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1); if (inet_pton(AF_INET, "0.0.0.1", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); DetectAddressFree(a); if ( (a = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.254", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); DetectAddressFree(a); return result; error: if (a != NULL) DetectAddressFree(a); return 0; } static int DetectAddressIPv4IsCompleteIPSpace03(void) { DetectAddress *a = NULL; DetectAddress *temp = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; temp = a; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "126.36.62.61", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "126.36.62.62", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "222.52.21.62", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "222.52.21.63", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.254", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 1); DetectAddressFree(a); return result; error: if (a != NULL) DetectAddressFree(a); return 0; } static int DetectAddressIPv4IsCompleteIPSpace04(void) { DetectAddress *a = NULL; DetectAddress *temp = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; temp = a; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "126.36.62.61", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "126.36.62.62", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "222.52.21.62", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "222.52.21.64", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.254", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); if ( (temp->next = DetectAddressInit()) == NULL) goto error; temp = temp->next; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; temp->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; temp->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressIsCompleteIPSpaceIPv4(a) == 0); DetectAddressFree(a); return result; error: if (a != NULL) DetectAddressFree(a); return 0; } static int DetectAddressIPv4CutNot05(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) return 0; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCutNotIPv4(a, &b) == -1); DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int DetectAddressIPv4CutNot06(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) return 0; if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCutNotIPv4(a, &b) == 0); if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; result = (a->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; result &= (a->ip2.addr_data32[0] = in.s_addr); DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int DetectAddressIPv4CutNot07(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) return 0; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCutNotIPv4(a, &b) == 0); if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; result = (a->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; result &= (a->ip2.addr_data32[0] = in.s_addr); DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int DetectAddressIPv4CutNot08(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) return 0; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCutNotIPv4(a, &b) == 0); if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; result &= (a->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; result &= (a->ip2.addr_data32[0] = in.s_addr); if (b == NULL) { result = 0; goto error; } else { result &= 1; } if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; result &= (b->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; result &= (b->ip2.addr_data32[0] = in.s_addr); DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int DetectAddressIPv4CutNot09(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in_addr in; int result = 1; if ( (a = DetectAddressInit()) == NULL) return 0; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; a->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; a->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressCutNotIPv4(a, &b) == 0); if (inet_pton(AF_INET, "0.0.0.0", &in) < 0) goto error; result &= (a->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.3", &in) < 0) goto error; result &= (a->ip2.addr_data32[0] = in.s_addr); if (b == NULL) { result = 0; goto error; } else { result &= 1; } if (inet_pton(AF_INET, "192.168.1.3", &in) < 0) goto error; result &= (b->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "255.255.255.255", &in) < 0) goto error; result &= (b->ip2.addr_data32[0] = in.s_addr); DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int DetectAddressIPv4Join10(void) { struct in_addr in; int result = 1; DetectAddress *source = DetectAddressInit(); if (source == NULL) return 0; DetectAddress *target = DetectAddressInit(); if (target == NULL) { DetectAddressFree(source); return 0; } if (inet_pton(AF_INET, "128.51.61.124", &in) < 0) goto error; target->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; target->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; source->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; source->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressJoinIPv4(NULL, target, source) == 0); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; result &= (target->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; result &= (target->ip2.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; target->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; target->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.5", &in) < 0) goto error; source->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.1", &in) < 0) goto error; source->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressJoinIPv4(NULL, target, source) == 0); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; result &= (target->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; result &= (target->ip2.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; target->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; target->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "128.1.5.15", &in) < 0) goto error; source->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "200.202.200.200", &in) < 0) goto error; source->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressJoinIPv4(NULL, target, source) == 0); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; result &= (target->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "200.202.200.200", &in) < 0) goto error; result &= (target->ip2.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "128.51.61.124", &in) < 0) goto error; target->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; target->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; source->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; source->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressJoinIPv4(NULL, target, source) == 0); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; result &= (target->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; result &= (target->ip2.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; target->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; target->ip2.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; source->ip.addr_data32[0] = in.s_addr; if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; source->ip2.addr_data32[0] = in.s_addr; result &= (DetectAddressJoinIPv4(NULL, target, source) == 0); if (inet_pton(AF_INET, "1.2.3.4", &in) < 0) goto error; result &= (target->ip.addr_data32[0] == in.s_addr); if (inet_pton(AF_INET, "192.168.1.2", &in) < 0) goto error; result &= (target->ip2.addr_data32[0] == in.s_addr); DetectAddressFree(source); DetectAddressFree(target); return result; error: DetectAddressFree(source); DetectAddressFree(target); return 0; } #endif void DetectAddressIPv4Tests(void) { #ifdef UNITTESTS UtRegisterTest("DetectAddressIPv4TestAddressCmp01", DetectAddressIPv4TestAddressCmp01); UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace02", DetectAddressIPv4IsCompleteIPSpace02); UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace03", DetectAddressIPv4IsCompleteIPSpace03); UtRegisterTest("DetectAddressIPv4IsCompleteIPSpace04", DetectAddressIPv4IsCompleteIPSpace04); UtRegisterTest("DetectAddressIPv4CutNot05", DetectAddressIPv4CutNot05); UtRegisterTest("DetectAddressIPv4CutNot06", DetectAddressIPv4CutNot06); UtRegisterTest("DetectAddressIPv4CutNot07", DetectAddressIPv4CutNot07); UtRegisterTest("DetectAddressIPv4CutNot08", DetectAddressIPv4CutNot08); UtRegisterTest("DetectAddressIPv4CutNot09", DetectAddressIPv4CutNot09); UtRegisterTest("DetectAddressIPv4Join10", DetectAddressIPv4Join10); #endif } suricata-3.2.1/src/tmqh-simple.c0000644000000000000000000001113313051004444013404 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Simple queue handler */ #include "suricata.h" #include "packet-queue.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" Packet *TmqhInputSimple(ThreadVars *t); void TmqhOutputSimple(ThreadVars *t, Packet *p); void TmqhInputSimpleShutdownHandler(ThreadVars *); void TmqhSimpleRegister (void) { tmqh_table[TMQH_SIMPLE].name = "simple"; tmqh_table[TMQH_SIMPLE].InHandler = TmqhInputSimple; tmqh_table[TMQH_SIMPLE].InShutdownHandler = TmqhInputSimpleShutdownHandler; tmqh_table[TMQH_SIMPLE].OutHandler = TmqhOutputSimple; } Packet *TmqhInputSimple(ThreadVars *t) { PacketQueue *q = &trans_q[t->inq->id]; StatsSyncCountersIfSignalled(t); SCMutexLock(&q->mutex_q); if (q->len == 0) { /* if we have no packets in queue, wait... */ SCCondWait(&q->cond_q, &q->mutex_q); } if (q->len > 0) { Packet *p = PacketDequeue(q); SCMutexUnlock(&q->mutex_q); return p; } else { /* return NULL if we have no pkt. Should only happen on signals. */ SCMutexUnlock(&q->mutex_q); return NULL; } } void TmqhInputSimpleShutdownHandler(ThreadVars *tv) { int i; if (tv == NULL || tv->inq == NULL) { return; } for (i = 0; i < (tv->inq->reader_cnt + tv->inq->writer_cnt); i++) SCCondSignal(&trans_q[tv->inq->id].cond_q); } void TmqhOutputSimple(ThreadVars *t, Packet *p) { SCLogDebug("Packet %p, p->root %p, alloced %s", p, p->root, p->flags & PKT_ALLOC ? "true":"false"); PacketQueue *q = &trans_q[t->outq->id]; SCMutexLock(&q->mutex_q); PacketEnqueue(q, p); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); } /*******************************Generic-Q-Handlers*****************************/ /** * \brief Public version of TmqhInputSimple from the tmqh-simple queue * handler, except that it is a generic version that is directly * tied to a "SCDQDataQueue" instance(sent as an arg). * * Retrieves a data_instance from the queue. If the queue is empty, it * waits on the queue, till a data_instance is enqueued into the queue * by some other module. * * All references to "data_instance" means a reference to a data structure * instance that implements the template "struct SCDQGenericQData_". * * \param q The SCDQDataQueue instance to wait on. * * \retval p The returned packet from the queue. * \retval data The returned data_instance from the queue. */ SCDQGenericQData *TmqhInputSimpleOnQ(SCDQDataQueue *q) { SCMutexLock(&q->mutex_q); if (q->len == 0) { /* if we have no packets in queue, wait... */ SCCondWait(&q->cond_q, &q->mutex_q); } if (q->len > 0) { SCDQGenericQData *data = SCDQDataDequeue(q); SCMutexUnlock(&q->mutex_q); return data; } else { /* return NULL if we have no data in the queue. Should only happen * on signals. */ SCMutexUnlock(&q->mutex_q); return NULL; } } /** * \brief Public version of TmqhOutputSimple from the tmqh-simple queue * handler, except that it is a generic version that is directly * tied to a SCDQDataQueue instance(sent as an arg). * * Pumps out a data_instance into the queue. If the queue is empty, it * waits on the queue, till a data_instance is enqueued into the queue. * * All references to "data_instance" means a reference to a data structure * instance that implements the template "struct SCDQGenericQData_". * * \param q The SCDQDataQueue instance to pump the data into. * \param data The data instance to be enqueued. */ void TmqhOutputSimpleOnQ(SCDQDataQueue *q, SCDQGenericQData *data) { SCMutexLock(&q->mutex_q); SCDQDataEnqueue(q, data); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); return; } suricata-3.2.1/src/log-tlslog.c0000644000000000000000000002432013051004444013231 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Roliers Jean-Paul * \author Eric Leblond * \author Victor Julien * * Implements TLS logging portion of the engine. The TLS logger is * implemented as a packet logger, as the TLS parser is not transaction * aware. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-tlslog.h" #include "app-layer-ssl.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "tls.log" #define MODULE_NAME "LogTlsLog" #define OUTPUT_BUFFER_SIZE 65535 #define CERT_ENC_BUFFER_SIZE 2048 #define LOG_TLS_DEFAULT 0 #define LOG_TLS_EXTENDED 1 typedef struct LogTlsFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } LogTlsFileCtx; typedef struct LogTlsLogThread_ { LogTlsFileCtx *tlslog_ctx; /** LogTlsFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t tls_cnt; MemBuffer *buffer; } LogTlsLogThread; static void LogTlsLogExtended(LogTlsLogThread *aft, SSLState * state) { if (state->server_connp.cert0_fingerprint != NULL) { MemBufferWriteString(aft->buffer, " SHA1='%s'", state->server_connp.cert0_fingerprint); } if (state->client_connp.sni != NULL) { MemBufferWriteString(aft->buffer, " SNI='%s'", state->client_connp.sni); } switch (state->server_connp.version) { case TLS_VERSION_UNKNOWN: MemBufferWriteString(aft->buffer, " VERSION='UNDETERMINED'"); break; case SSL_VERSION_2: MemBufferWriteString(aft->buffer, " VERSION='SSLv2'"); break; case SSL_VERSION_3: MemBufferWriteString(aft->buffer, " VERSION='SSLv3'"); break; case TLS_VERSION_10: MemBufferWriteString(aft->buffer, " VERSION='TLSv1'"); break; case TLS_VERSION_11: MemBufferWriteString(aft->buffer, " VERSION='TLS 1.1'"); break; case TLS_VERSION_12: MemBufferWriteString(aft->buffer, " VERSION='TLS 1.2'"); break; default: MemBufferWriteString(aft->buffer, " VERSION='0x%04x'", state->server_connp.version); break; } if (state->server_connp.cert0_not_before != 0) { char timebuf[64]; struct timeval tv; tv.tv_sec = state->server_connp.cert0_not_before; tv.tv_usec = 0; CreateUtcIsoTimeString(&tv, timebuf, sizeof(timebuf)); MemBufferWriteString(aft->buffer, " NOTBEFORE='%s'", timebuf); } if (state->server_connp.cert0_not_after != 0) { char timebuf[64]; struct timeval tv; tv.tv_sec = state->server_connp.cert0_not_after; tv.tv_usec = 0; CreateUtcIsoTimeString(&tv, timebuf, sizeof(timebuf)); MemBufferWriteString(aft->buffer, " NOTAFTER='%s'", timebuf); } MemBufferWriteString(aft->buffer, "\n"); } int TLSGetIPInformations(const Packet *p, char* srcip, size_t srcip_len, Port* sp, char* dstip, size_t dstip_len, Port* dp, int ipproto) { if ((PKT_IS_TOSERVER(p))) { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p), srcip, srcip_len); PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p), dstip, dstip_len); break; case AF_INET6: PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), srcip, srcip_len); PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), dstip, dstip_len); break; default: return 0; } *sp = p->sp; *dp = p->dp; } else { switch (ipproto) { case AF_INET: PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p), srcip, srcip_len); PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p), dstip, dstip_len); break; case AF_INET6: PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), srcip, srcip_len); PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), dstip, dstip_len); break; default: return 0; } *sp = p->dp; *dp = p->sp; } return 1; } static TmEcode LogTlsLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogTlsLogThread *aft = SCMalloc(sizeof(LogTlsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogTlsLogThread)); if (initdata == NULL) { SCLogDebug( "Error getting context for TLSLog. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->tlslog_ctx = ((OutputCtx *) initdata)->data; *data = (void *) aft; return TM_ECODE_OK; } static TmEcode LogTlsLogThreadDeinit(ThreadVars *t, void *data) { LogTlsLogThread *aft = (LogTlsLogThread *) data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogTlsLogThread)); SCFree(aft); return TM_ECODE_OK; } static void LogTlsLogDeInitCtx(OutputCtx *output_ctx) { LogTlsFileCtx *tlslog_ctx = (LogTlsFileCtx *) output_ctx->data; LogFileFreeCtx(tlslog_ctx->file_ctx); SCFree(tlslog_ctx); SCFree(output_ctx); } static void LogTlsLogExitPrintStats(ThreadVars *tv, void *data) { LogTlsLogThread *aft = (LogTlsLogThread *) data; if (aft == NULL) { return; } SCLogInfo("TLS logger logged %" PRIu32 " requests", aft->tls_cnt); } /** \brief Create a new tls log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ static OutputCtx *LogTlsLogInitCtx(ConfNode *conf) { LogFileCtx* file_ctx = LogFileNewCtx(); if (file_ctx == NULL) { SCLogError(SC_ERR_TLS_LOG_GENERIC, "LogTlsLogInitCtx: Couldn't " "create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { goto filectx_error; } LogTlsFileCtx *tlslog_ctx = SCCalloc(1, sizeof(LogTlsFileCtx)); if (unlikely(tlslog_ctx == NULL)) goto filectx_error; tlslog_ctx->file_ctx = file_ctx; const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended == NULL) { tlslog_ctx->flags |= LOG_TLS_DEFAULT; } else { if (ConfValIsTrue(extended)) { tlslog_ctx->flags |= LOG_TLS_EXTENDED; } } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) goto tlslog_error; output_ctx->data = tlslog_ctx; output_ctx->DeInit = LogTlsLogDeInitCtx; SCLogDebug("TLS log output initialized"); /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); return output_ctx; tlslog_error: SCFree(tlslog_ctx); filectx_error: LogFileFreeCtx(file_ctx); return NULL; } static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { LogTlsLogThread *aft = (LogTlsLogThread *)thread_data; LogTlsFileCtx *hlog = aft->tlslog_ctx; char timebuf[64]; int ipproto = (PKT_IS_IPV4(p)) ? AF_INET : AF_INET6; SSLState *ssl_state = (SSLState *)state; if (unlikely(ssl_state == NULL)) { return 0; } if (ssl_state->server_connp.cert0_issuerdn == NULL || ssl_state->server_connp.cert0_subject == NULL) { return 0; } CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); #define PRINT_BUF_LEN 46 char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN]; Port sp, dp; if (!TLSGetIPInformations(p, srcip, PRINT_BUF_LEN, &sp, dstip, PRINT_BUF_LEN, &dp, ipproto)) { return 0; } MemBufferReset(aft->buffer); MemBufferWriteString(aft->buffer, "%s %s:%d -> %s:%d TLS: Subject='%s' Issuerdn='%s'", timebuf, srcip, sp, dstip, dp, ssl_state->server_connp.cert0_subject, ssl_state->server_connp.cert0_issuerdn); if (hlog->flags & LOG_TLS_EXTENDED) { LogTlsLogExtended(aft, ssl_state); } else { MemBufferWriteString(aft->buffer, "\n"); } aft->tls_cnt++; SCMutexLock(&hlog->file_ctx->fp_mutex); hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx); SCMutexUnlock(&hlog->file_ctx->fp_mutex); return 0; } void LogTlsLogRegister(void) { OutputRegisterTxModuleWithProgress(LOGGER_TLS, MODULE_NAME, "tls-log", LogTlsLogInitCtx, ALPROTO_TLS, LogTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE, LogTlsLogThreadInit, LogTlsLogThreadDeinit, LogTlsLogExitPrintStats); } suricata-3.2.1/src/detect-engine-mpm.h0000644000000000000000000000636513051004444014466 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_MPM_H__ #define __DETECT_ENGINE_MPM_H__ #include "tm-threads.h" #include "detect.h" #include "detect-content.h" #include "detect-uricontent.h" #include "stream.h" void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx); void DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx); void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx); void DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx); uint32_t PatternStrength(uint8_t *, uint16_t); uint16_t PatternMatchDefaultMatcher(void); uint32_t DnsQueryPatternSearch(DetectEngineThreadCtx *det_ctx, uint8_t *buffer, uint32_t buffer_len, uint8_t flags); void PacketPatternCleanup(ThreadVars *, DetectEngineThreadCtx *); void PatternMatchPrepare(MpmCtx *, uint16_t); void PatternMatchThreadPrepare(MpmThreadCtx *, uint16_t type); void PatternMatchDestroy(MpmCtx *, uint16_t); void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t); void PatternMatchThreadPrint(MpmThreadCtx *, uint16_t); int PatternMatchPrepareGroup(DetectEngineCtx *, SigGroupHead *); void DetectEngineThreadCtxInfo(ThreadVars *, DetectEngineThreadCtx *); TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **); TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *); void DbgPrintSearchStats(); int SignatureHasPacketContent(const Signature *); int SignatureHasStreamContent(const Signature *); void RetrieveFPForSig(Signature *s); int MpmStoreInit(DetectEngineCtx *); void MpmStoreFree(DetectEngineCtx *); void MpmStoreReportStats(const DetectEngineCtx *de_ctx); MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf); /** * \brief Figured out the FP and their respective content ids for all the * sigs in the engine. * * \param de_ctx Detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx); /** \brief register an app layer keyword for mpm * \param name keyword name * \param direction SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT * \param sm_list list that contains the keyword's sigmatches * \param PrefilterRegister Prefilter api registration function * * \note direction must be set to either toserver or toclient. * If both are needed, register the keyword twice. */ void DetectMpmAppLayerRegister(const char *name, int direction, int sm_list, int priority, int (*PrefilterRegister)(SigGroupHead *sgh, MpmCtx *mpm_ctx)); #endif /* __DETECT_ENGINE_MPM_H__ */ suricata-3.2.1/src/app-layer-protos.h0000644000000000000000000000346513051004444014400 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __APP_LAYER_PROTOS_H__ #define __APP_LAYER_PROTOS_H__ enum AppProtoEnum { ALPROTO_UNKNOWN = 0, ALPROTO_HTTP, ALPROTO_FTP, ALPROTO_SMTP, ALPROTO_TLS, /* SSLv2, SSLv3 & TLSv1 */ ALPROTO_SSH, ALPROTO_IMAP, ALPROTO_MSN, ALPROTO_JABBER, ALPROTO_SMB, ALPROTO_SMB2, ALPROTO_DCERPC, ALPROTO_IRC, ALPROTO_DNS, ALPROTO_MODBUS, ALPROTO_ENIP, ALPROTO_DNP3, ALPROTO_TEMPLATE, /* used by the probing parser when alproto detection fails * permanently for that particular stream */ ALPROTO_FAILED, #ifdef UNITTESTS ALPROTO_TEST, #endif /* UNITESTS */ /* keep last */ ALPROTO_MAX, }; /* not using the enum as that is a unsigned int, so 4 bytes */ typedef uint16_t AppProto; /** * \brief Maps the ALPROTO_*, to its string equivalent. * * \param alproto App layer protocol id. * * \retval String equivalent for the alproto. */ const char *AppProtoToString(AppProto alproto); #endif /* __APP_LAYER_PROTOS_H__ */ suricata-3.2.1/src/flow-private.h0000644000000000000000000000604013051004444013571 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_PRIVATE_H__ #define __FLOW_PRIVATE_H__ #include "flow-hash.h" #include "flow-queue.h" #include "util-atomic.h" /* global flow flags */ /** Flow engine is in emergency mode. This means it doesn't have enough spare * flows for new flows and/or it's memcap limit it reached. In this state the * flow engine with evaluate flows with lower timeout settings. */ #define FLOW_EMERGENCY 0x01 /* Flow Time out values */ #define FLOW_DEFAULT_NEW_TIMEOUT 30 #define FLOW_DEFAULT_EST_TIMEOUT 300 #define FLOW_DEFAULT_CLOSED_TIMEOUT 0 #define FLOW_DEFAULT_BYPASSED_TIMEOUT 100 #define FLOW_IPPROTO_TCP_NEW_TIMEOUT 30 #define FLOW_IPPROTO_TCP_EST_TIMEOUT 300 #define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT 100 #define FLOW_IPPROTO_UDP_NEW_TIMEOUT 30 #define FLOW_IPPROTO_UDP_EST_TIMEOUT 300 #define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT 100 #define FLOW_IPPROTO_ICMP_NEW_TIMEOUT 30 #define FLOW_IPPROTO_ICMP_EST_TIMEOUT 300 #define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT 100 #define FLOW_DEFAULT_EMERG_NEW_TIMEOUT 10 #define FLOW_DEFAULT_EMERG_EST_TIMEOUT 100 #define FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT 0 #define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT 50 #define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT 10 #define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT 100 #define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT 10 #define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT 100 #define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT 10 #define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT 100 #define FLOW_BYPASSED_TIMEOUT 6 enum { FLOW_PROTO_TCP = 0, FLOW_PROTO_UDP, FLOW_PROTO_ICMP, FLOW_PROTO_SCTP, FLOW_PROTO_DEFAULT, /* should be last */ FLOW_PROTO_MAX, }; /* max used in app-layer (counters) */ #define FLOW_PROTO_APPLAYER_MAX FLOW_PROTO_UDP + 1 /* * Variables */ /** FlowProto specific timeouts and free/state functions */ FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]; FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]; FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]; /** spare/unused/prealloced flows live here */ FlowQueue flow_spare_q; /** queue to pass flows to cleanup/log thread(s) */ FlowQueue flow_recycle_q; FlowBucket *flow_hash; FlowConfig flow_config; /** flow memuse counter (atomic), for enforcing memcap limit */ SC_ATOMIC_DECLARE(long long unsigned int, flow_memuse); #endif /* __FLOW_PRIVATE_H__ */ suricata-3.2.1/src/detect-template-buffer.c0000644000000000000000000001242713051004444015503 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* * TODO: Update the \author in this file and detect-template-buffer.h. * TODO: Update description in the \file section below. * TODO: Remove SCLogNotice statements or convert to debug. */ /** * \file * * \author FirstName LastName * * Set up of the "template_buffer" keyword to allow content * inspections on the decoded template application layer buffers. */ #include "suricata-common.h" #include "conf.h" #include "detect.h" #include "detect-engine.h" #include "app-layer-template.h" #include "detect-engine-template.h" static int DetectTemplateBufferSetup(DetectEngineCtx *, Signature *, char *); static void DetectTemplateBufferRegisterTests(void); void DetectTemplateBufferRegister(void) { /* TEMPLATE_START_REMOVE */ if (ConfGetNode("app-layer.protocols.template") == NULL) { return; } /* TEMPLATE_END_REMOVE */ sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].name = "template_buffer"; sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].desc = "Template content modififier to match on the template buffers"; sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].Setup = DetectTemplateBufferSetup; sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].RegisterTests = DetectTemplateBufferRegisterTests; sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_PAYLOAD; /* register inspect engines */ DetectAppLayerInspectEngineRegister(ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, DetectEngineInspectTemplateBuffer); DetectAppLayerInspectEngineRegister(ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, DetectEngineInspectTemplateBuffer); SCLogNotice("Template application layer detect registered."); } static int DetectTemplateBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { s->list = DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH; s->alproto = ALPROTO_TEMPLATE; return 0; } #ifdef UNITTESTS #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer-parser.h" #include "detect-engine.h" #include "detect-parse.h" #include "flow-util.h" #include "stream-tcp.h" static int DetectTemplateBufferTest(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p; TcpSession tcp; ThreadVars tv; Signature *s; uint8_t request[] = "Hello World!"; /* Setup flow. */ memset(&f, 0, sizeof(Flow)); memset(&tcp, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof(ThreadVars)); p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_TEMPLATE; f.protoctx = (void *)&tcp; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); /* This rule should match. */ s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (" "msg:\"TEMPLATE Test Rule\"; " "template_buffer; content:\"World!\"; " "sid:1; rev:1;)"); FAIL_IF_NULL(s); /* This rule should not match. */ s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (" "msg:\"TEMPLATE Test Rule\"; " "template_buffer; content:\"W0rld!\"; " "sid:2; rev:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TEMPLATE, STREAM_TOSERVER, request, sizeof(request)); FLOWLOCK_UNLOCK(&f); /* Check that we have app-layer state. */ FAIL_IF_NULL(f.alstate); SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 1)); FAIL_IF(PacketAlertCheck(p, 2)); /* Cleanup. */ if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } #endif static void DetectTemplateBufferRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTemplateBufferTest", DetectTemplateBufferTest); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-crypt.c0000644000000000000000000002011413051004444013257 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Roliers Jean-Paul * * Implements cryptographic functions. * Based on the libtomcrypt library ( http://libtom.org/?page=features&newsitems=5&whatfile=crypt ) * * Implementation of function using NSS is not linked with libtomcrypt. */ #include "suricata-common.h" #include "suricata.h" #include "util-crypt.h" #ifdef HAVE_NSS #include #endif #ifndef HAVE_NSS #define F0(x,y,z) (z ^ (x & (y ^ z))) #define F1(x,y,z) (x ^ y ^ z) #define F2(x,y,z) ((x & y) | (z & (x | y))) #define F3(x,y,z) (x ^ y ^ z) static int Sha1Compress(HashState *md, unsigned char *buf) { uint32_t a,b,c,d,e,W[80],i; /* copy the state into 512-bits into W[0..15] */ for (i = 0; i < 16; i++) { LOAD32H(W[i], buf + (4*i)); } /* copy state */ a = md->sha1.state[0]; b = md->sha1.state[1]; c = md->sha1.state[2]; d = md->sha1.state[3]; e = md->sha1.state[4]; /* expand it */ for (i = 16; i < 80; i++) { W[i] = ROL(W[i-3] ^ W[i-8] ^ W[i-14] ^ W[i-16], 1); } /* compress */ /* round one */ #define FF0(a,b,c,d,e,i) e = (ROLc(a, 5) + F0(b,c,d) + e + W[i] + 0x5a827999UL); b = ROLc(b, 30); #define FF1(a,b,c,d,e,i) e = (ROLc(a, 5) + F1(b,c,d) + e + W[i] + 0x6ed9eba1UL); b = ROLc(b, 30); #define FF2(a,b,c,d,e,i) e = (ROLc(a, 5) + F2(b,c,d) + e + W[i] + 0x8f1bbcdcUL); b = ROLc(b, 30); #define FF3(a,b,c,d,e,i) e = (ROLc(a, 5) + F3(b,c,d) + e + W[i] + 0xca62c1d6UL); b = ROLc(b, 30); for (i = 0; i < 20; ) { FF0(a,b,c,d,e,i++); FF0(e,a,b,c,d,i++); FF0(d,e,a,b,c,i++); FF0(c,d,e,a,b,i++); FF0(b,c,d,e,a,i++); } /* round two */ for (; i < 40; ) { FF1(a,b,c,d,e,i++); FF1(e,a,b,c,d,i++); FF1(d,e,a,b,c,i++); FF1(c,d,e,a,b,i++); FF1(b,c,d,e,a,i++); } /* round three */ for (; i < 60; ) { FF2(a,b,c,d,e,i++); FF2(e,a,b,c,d,i++); FF2(d,e,a,b,c,i++); FF2(c,d,e,a,b,i++); FF2(b,c,d,e,a,i++); } /* round four */ for (; i < 80; ) { FF3(a,b,c,d,e,i++); FF3(e,a,b,c,d,i++); FF3(d,e,a,b,c,i++); FF3(c,d,e,a,b,i++); FF3(b,c,d,e,a,i++); } #undef FF0 #undef FF1 #undef FF2 #undef FF3 /* store */ md->sha1.state[0] = md->sha1.state[0] + a; md->sha1.state[1] = md->sha1.state[1] + b; md->sha1.state[2] = md->sha1.state[2] + c; md->sha1.state[3] = md->sha1.state[3] + d; md->sha1.state[4] = md->sha1.state[4] + e; return SC_SHA_1_OK; } static int Sha1Init(HashState * md) { if(md == NULL) { return SC_SHA_1_NOK; } md->sha1.state[0] = 0x67452301UL; md->sha1.state[1] = 0xefcdab89UL; md->sha1.state[2] = 0x98badcfeUL; md->sha1.state[3] = 0x10325476UL; md->sha1.state[4] = 0xc3d2e1f0UL; md->sha1.curlen = 0; md->sha1.length = 0; return SC_SHA_1_OK; } static int Sha1Process (HashState * md, const unsigned char *in, unsigned long inlen) { if(md == NULL || in == NULL) { return SC_SHA_1_INVALID_ARG; } unsigned long n; int err; if (md->sha1.curlen > sizeof(md->sha1.buf)) { return SC_SHA_1_INVALID_ARG; } while (inlen > 0) { if (md-> sha1.curlen == 0 && inlen >= 64) { if ((err = Sha1Compress(md, (unsigned char *)in)) != SC_SHA_1_OK) { return err; } md-> sha1 .length += 64 * 8; in += 64; inlen -= 64; } else { n = MIN(inlen, (64 - md-> sha1 .curlen)); memcpy(md-> sha1 .buf + md-> sha1.curlen, in, (size_t)n); md-> sha1 .curlen += n; in += n; inlen -= n; if (md-> sha1 .curlen == 64) { if ((err = Sha1Compress(md, md-> sha1 .buf)) != SC_SHA_1_OK) { return err; } md-> sha1 .length += 8*64; md-> sha1 .curlen = 0; } } } return SC_SHA_1_OK; } static int Sha1Done(HashState * md, unsigned char *out) { int i; if (md == NULL || out == NULL) { return SC_SHA_1_NOK; } if (md->sha1.curlen >= sizeof(md->sha1.buf)) { return SC_SHA_1_INVALID_ARG; } /* increase the length of the message */ md->sha1.length += md->sha1.curlen * 8; /* append the '1' bit */ md->sha1.buf[md->sha1.curlen++] = (unsigned char)0x80; /* if the length is currently above 56 bytes we append zeros * then compress. Then we can fall back to padding zeros and length * encoding like normal. */ if (md->sha1.curlen > 56) { while (md->sha1.curlen < 64) { md->sha1.buf[md->sha1.curlen++] = (unsigned char)0; } Sha1Compress(md, md->sha1.buf); md->sha1.curlen = 0; } /* pad upto 56 bytes of zeroes */ while (md->sha1.curlen < 56) { md->sha1.buf[md->sha1.curlen++] = (unsigned char)0; } /* store length */ STORE64H(md->sha1.length, md->sha1.buf+56); Sha1Compress(md, md->sha1.buf); /* copy output */ for (i = 0; i < 5; i++) { STORE32H(md->sha1.state[i], out+(4*i)); } memset(md, 0, sizeof(HashState)); return SC_SHA_1_OK; } unsigned char* ComputeSHA1(unsigned char* buff, int bufflen) { HashState md; unsigned char* lResult = (unsigned char*) SCMalloc((sizeof(unsigned char) * 20)); if (lResult == NULL) return NULL; Sha1Init(&md); Sha1Process(&md, buff, bufflen); Sha1Done(&md, lResult); return lResult; } #else /* HAVE_NSS */ unsigned char* ComputeSHA1(unsigned char* buff, int bufflen) { HASHContext *sha1_ctx = HASH_Create(HASH_AlgSHA1); unsigned char* lResult = NULL; unsigned int rlen; if (sha1_ctx == NULL) { return NULL; } lResult = (unsigned char*) SCMalloc((sizeof(unsigned char) * 20)); if (lResult == NULL) { HASH_Destroy(sha1_ctx); return NULL; } HASH_Begin(sha1_ctx); HASH_Update(sha1_ctx, buff, bufflen); HASH_End(sha1_ctx, lResult, &rlen, (sizeof(unsigned char) * 20)); HASH_Destroy(sha1_ctx); return lResult; } #endif /* HAVE_NSS */ static const char *b64codes = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; int Base64Encode(const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen) { unsigned long i, len2, leven; unsigned char *p; if(in == NULL || out == NULL || outlen == NULL) { return SC_BASE64_INVALID_ARG; } /* valid output size ? */ len2 = 4 * ((inlen + 2) / 3); if (*outlen < len2 + 1) { *outlen = len2 + 1; return SC_BASE64_OVERFLOW; } p = out; leven = 3*(inlen / 3); for (i = 0; i < leven; i += 3) { *p++ = b64codes[(in[0] >> 2) & 0x3F]; *p++ = b64codes[(((in[0] & 3) << 4) + (in[1] >> 4)) & 0x3F]; *p++ = b64codes[(((in[1] & 0xf) << 2) + (in[2] >> 6)) & 0x3F]; *p++ = b64codes[in[2] & 0x3F]; in += 3; } /* Pad it if necessary... */ if (i < inlen) { unsigned a = in[0]; unsigned b = (i+1 < inlen) ? in[1] : 0; *p++ = b64codes[(a >> 2) & 0x3F]; *p++ = b64codes[(((a & 3) << 4) + (b >> 4)) & 0x3F]; *p++ = (i+1 < inlen) ? b64codes[(((b & 0xf) << 2)) & 0x3F] : '='; *p++ = '='; } /* append a NULL byte */ *p = '\0'; /* return ok */ *outlen = p - out; return SC_BASE64_OK; } suricata-3.2.1/src/detect-engine-siggroup.h0000644000000000000000000000616713051004444015534 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_SIGGROUP_H__ #define __DETECT_ENGINE_SIGGROUP_H__ int SigGroupHeadAppendSig(const DetectEngineCtx *, SigGroupHead **, const Signature *); int SigGroupHeadClearSigs(SigGroupHead *); int SigGroupHeadCopySigs(DetectEngineCtx *, SigGroupHead *, SigGroupHead **); void SigGroupHeadFree(SigGroupHead *); void SigGroupHeadFreeMpmArrays(DetectEngineCtx *); SigGroupHead *SigGroupHeadHashLookup(DetectEngineCtx *, SigGroupHead *); SigGroupHead *SigGroupHeadMpmHashLookup(DetectEngineCtx *, SigGroupHead *); SigGroupHead *SigGroupHeadDPortHashLookup(DetectEngineCtx *, SigGroupHead *); int SigGroupHeadMpmHashAdd(DetectEngineCtx *, SigGroupHead *); int SigGroupHeadHashAdd(DetectEngineCtx *, SigGroupHead *); int SigGroupHeadDPortHashAdd(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadHashFree(DetectEngineCtx *); void SigGroupHeadMpmHashFree(DetectEngineCtx *); void SigGroupHeadDPortHashFree(DetectEngineCtx *); int SigGroupHeadHashInit(DetectEngineCtx *); int SigGroupHeadMpmHashInit(DetectEngineCtx *); int SigGroupHeadDPortHashInit(DetectEngineCtx *); int SigGroupHeadHashRemove(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadInitDataFree(SigGroupHeadInitData *sghid); void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx); void SigGroupHeadSetProtoAndDirection(SigGroupHead *sgh, uint8_t ipproto, int dir); int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx); void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx); int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid); void SigGroupHeadRegisterTests(void); void SigGroupHeadPrintSigs(DetectEngineCtx *de_ctx, SigGroupHead *sgh); void SigGroupHeadStore(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadSetFilemagicFlag(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadSetFilestoreCount(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadSetFileHashFlag(DetectEngineCtx *, SigGroupHead *); void SigGroupHeadSetFilesizeFlag(DetectEngineCtx *, SigGroupHead *); uint16_t SigGroupHeadGetMinMpmSize(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int list); int SigGroupHeadBuildNonPrefilterArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh); #endif /* __DETECT_ENGINE_SIGGROUP_H__ */ suricata-3.2.1/src/detect-pcre.h0000644000000000000000000000345613051004444013361 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PCRE_H__ #define __DETECT_PCRE_H__ #define DETECT_PCRE_RELATIVE 0x00001 #define DETECT_PCRE_RAWBYTES 0x00002 #define DETECT_PCRE_CASELESS 0x00004 #define DETECT_PCRE_CAPTURE_PKT 0x00008 #define DETECT_PCRE_CAPTURE_FLOW 0x00010 #define DETECT_PCRE_MATCH_LIMIT 0x00020 #define DETECT_PCRE_RELATIVE_NEXT 0x00040 #define DETECT_PCRE_NEGATE 0x00080 typedef struct DetectPcreData_ { /* pcre options */ pcre *re; pcre_extra *sd; int opts; uint16_t flags; uint16_t capidx; char *capname; } DetectPcreData; /* prototypes */ int DetectPcrePayloadMatch(DetectEngineThreadCtx *, Signature *, SigMatch *, Packet *, Flow *, uint8_t *, uint32_t); int DetectPcrePacketPayloadMatch(DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); int DetectPcrePayloadDoMatch(DetectEngineThreadCtx *, Signature *, SigMatch *, Packet *, uint8_t *, uint16_t); void DetectPcreRegister (void); #endif /* __DETECT_PCRE_H__ */ suricata-3.2.1/src/source-napatech.h0000644000000000000000000000223313051004444014233 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author nPulse Technologies, LLC * \author Matt Keeler */ #ifndef __SOURCE_NAPATECH_H__ #define __SOURCE_NAPATECH_H__ void TmModuleNapatechStreamRegister (void); TmEcode NapatechStreamThreadDeinit(ThreadVars *tv, void *data); void TmModuleNapatechDecodeRegister (void); struct NapatechStreamDevConf { int stream_id; intmax_t hba; }; #ifdef HAVE_NAPATECH #include #endif #endif /* __SOURCE_NAPATECH_H__ */ suricata-3.2.1/src/app-layer-nbss.h0000644000000000000000000000423013051004444014006 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl */ #ifndef __APP_LAYER_NBSS_H__ #define __APP_LAYER_NBSS_H__ #include "suricata-common.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "stream.h" /* http://ubiqx.org/cifs/rfc-draft/rfc1002.html#s4.3 All session packets are of the following general structure: 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | TYPE | FLAGS | LENGTH | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | / TRAILER (Packet Type Dependent) / | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ The TYPE, FLAGS, and LENGTH fields are present in every session packet. */ #define NBSS_SESSION_MESSAGE 0x00 #define NBSS_SESSION_REQUEST 0x81 #define NBSS_POSITIVE_SESSION_RESPONSE 0x82 #define NBSS_NEGATIVE_SESSION_RESPONSE 0x83 #define NBSS_RETARGET_SESSION_RESPONSE 0x84 #define NBSS_SESSION_KEEP_ALIVE 0x85 typedef struct NBSSHdr_ { uint8_t type; uint8_t flags; uint32_t length; } NBSSHdr; #define NBSS_HDR_LEN 4 #endif /* __APP_LAYER_NBSS_H__ */ suricata-3.2.1/src/detect-seq.c0000644000000000000000000002012013051004444013176 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Implements the seq keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" #include "detect-seq.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" static int DetectSeqSetup(DetectEngineCtx *, Signature *, char *); static int DetectSeqMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static void DetectSeqRegisterTests(void); static void DetectSeqFree(void *); static int PrefilterSetupTcpSeq(SigGroupHead *sgh); static _Bool PrefilterTcpSeqIsPrefilterable(const Signature *s); void DetectSeqRegister(void) { sigmatch_table[DETECT_SEQ].name = "seq"; sigmatch_table[DETECT_SEQ].desc = "check for a specific TCP sequence number"; sigmatch_table[DETECT_SEQ].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#seq"; sigmatch_table[DETECT_SEQ].Match = DetectSeqMatch; sigmatch_table[DETECT_SEQ].Setup = DetectSeqSetup; sigmatch_table[DETECT_SEQ].Free = DetectSeqFree; sigmatch_table[DETECT_SEQ].RegisterTests = DetectSeqRegisterTests; sigmatch_table[DETECT_SEQ].SupportsPrefilter = PrefilterTcpSeqIsPrefilterable; sigmatch_table[DETECT_SEQ].SetupPrefilter = PrefilterSetupTcpSeq; } /** * \internal * \brief This function is used to match packets with a given Seq number * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectSeqData * * \retval 0 no match * \retval 1 match */ static int DetectSeqMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectSeqData *data = (const DetectSeqData *)ctx; /* This is only needed on TCP packets */ if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p)) { return 0; } return (data->seq == TCP_GET_SEQ(p)) ? 1 : 0; } /** * \internal * \brief this function is used to add the seq option into the signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectSeqSetup (DetectEngineCtx *de_ctx, Signature *s, char *optstr) { DetectSeqData *data = NULL; SigMatch *sm = NULL; data = SCMalloc(sizeof(DetectSeqData)); if (unlikely(data == NULL)) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_SEQ; if (-1 == ByteExtractStringUint32(&data->seq, 10, 0, optstr)) { goto error; } sm->ctx = (SigMatchCtx*)data; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (data) SCFree(data); if (sm) SigMatchFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with seq option * * \param data pointer to seq configuration data */ static void DetectSeqFree(void *ptr) { DetectSeqData *data = (DetectSeqData *)ptr; SCFree(data); } /* prefilter code */ static void PrefilterPacketSeqMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; if ((p->proto) == IPPROTO_TCP && !(PKT_IS_PSEUDOPKT(p)) && (p->tcph != NULL) && (TCP_GET_SEQ(p) == ctx->v1.u32[0])) { SCLogDebug("packet matches TCP seq %u", ctx->v1.u32[0]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketSeqSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectSeqData *a = smctx; v->u32[0] = a->seq; } static _Bool PrefilterPacketSeqCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectSeqData *a = smctx; if (v.u32[0] == a->seq) return TRUE; return FALSE; } static int PrefilterSetupTcpSeq(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_SEQ, PrefilterPacketSeqSet, PrefilterPacketSeqCompare, PrefilterPacketSeqMatch); } static _Bool PrefilterTcpSeqIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_SEQ: return TRUE; } } return FALSE; } #ifdef UNITTESTS /** * \test DetectSeqSigTest01 tests parses */ static int DetectSeqSigTest01(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; /* These three are crammed in here as there is no Parse */ if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing seq\";seq:foo;sid:1;)") != NULL) { printf("invalid seq accepted: "); goto cleanup; } if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing seq\";seq:9999999999;sid:1;)") != NULL) { printf("overflowing seq accepted: "); goto cleanup; } if (SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing seq\";seq:-100;sid:1;)") != NULL) { printf("negative seq accepted: "); goto cleanup; } result = 1; cleanup: if (de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } end: return result; } /** * \test DetectSeqSigTest02 tests seq keyword */ static int DetectSeqSigTest02(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[2] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_ICMP); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; /* TCP w/seq=42 */ p[0]->tcph->th_seq = htonl(42); /* TCP w/seq=100 */ p[1]->tcph->th_seq = htonl(100); char *sigs[2]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing seq\"; seq:41; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing seq\"; seq:42; sid:2;)"; uint32_t sid[2] = {1, 2}; uint32_t results[3][2] = { /* packet 0 match sid 1 but should not match sid 2 */ {0, 1}, /* packet 1 should not match */ {0, 0}, /* packet 2 should not match */ {0, 0} }; result = UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 2); UTHFreePackets(p, 3); end: return result; } #endif /* UNITTESTS */ /** * \internal * \brief This function registers unit tests for DetectSeq */ static void DetectSeqRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectSeqSigTest01", DetectSeqSigTest01); UtRegisterTest("DetectSeqSigTest02", DetectSeqSigTest02); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-ipfw.c0000644000000000000000000005701213051004444013415 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Nick Rogness * \author Eric Leblond * * IPFW packet acquisition support */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "source-ipfw.h" #include "util-debug.h" #include "conf.h" #include "util-byte.h" #include "util-privs.h" #include "util-device.h" #include "runmodes.h" #define IPFW_ACCEPT 0 #define IPFW_DROP 1 #define IPFW_SOCKET_POLL_MSEC 300 #ifndef IP_MAXPACKET #define IP_MAXPACKET 65535 #endif #ifndef IPFW /* Handle the case if --enable-ipfw was not used * */ TmEcode NoIPFWSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveIPFWRegister (void) { tmm_modules[TMM_RECEIVEIPFW].name = "ReceiveIPFW"; tmm_modules[TMM_RECEIVEIPFW].ThreadInit = NoIPFWSupportExit; tmm_modules[TMM_RECEIVEIPFW].Func = NULL; tmm_modules[TMM_RECEIVEIPFW].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVEIPFW].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEIPFW].RegisterTests = NULL; tmm_modules[TMM_RECEIVEIPFW].flags = TM_FLAG_RECEIVE_TM; } void TmModuleVerdictIPFWRegister (void) { tmm_modules[TMM_VERDICTIPFW].name = "VerdictIPFW"; tmm_modules[TMM_VERDICTIPFW].ThreadInit = NoIPFWSupportExit; tmm_modules[TMM_VERDICTIPFW].Func = NULL; tmm_modules[TMM_VERDICTIPFW].ThreadExitPrintStats = NULL; tmm_modules[TMM_VERDICTIPFW].ThreadDeinit = NULL; tmm_modules[TMM_VERDICTIPFW].RegisterTests = NULL; } void TmModuleDecodeIPFWRegister (void) { tmm_modules[TMM_DECODEIPFW].name = "DecodeIPFW"; tmm_modules[TMM_DECODEIPFW].ThreadInit = NoIPFWSupportExit; tmm_modules[TMM_DECODEIPFW].Func = NULL; tmm_modules[TMM_DECODEIPFW].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEIPFW].ThreadDeinit = NULL; tmm_modules[TMM_DECODEIPFW].RegisterTests = NULL; tmm_modules[TMM_DECODEIPFW].cap_flags = 0; tmm_modules[TMM_DECODEIPFW].flags = TM_FLAG_DECODE_TM; } TmEcode NoIPFWSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_IPFW_NOSUPPORT,"Error creating thread %s: you do not have support for ipfw " "enabled please recompile with --enable-ipfw", tv->name); exit(EXIT_FAILURE); } #else /* We have IPFW compiled in */ extern int max_pending_packets; /** * \brief Structure to hold thread specific variables. */ typedef struct IPFWThreadVars_ { /* data link type for the thread, probably not needed */ int datalink; /* this one should be not changing after init */ uint16_t port_num; /* position into the NFQ queue var array */ uint16_t ipfw_index; /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; uint32_t accepted; uint32_t dropped; } IPFWThreadVars; static IPFWThreadVars ipfw_t[IPFW_MAX_QUEUE]; static IPFWQueueVars ipfw_q[IPFW_MAX_QUEUE]; static uint16_t receive_port_num = 0; static SCMutex ipfw_init_lock; /* IPFW Prototypes */ void *IPFWGetQueue(int number); TmEcode ReceiveIPFWThreadInit(ThreadVars *, void *, void **); TmEcode ReceiveIPFW(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode ReceiveIPFWLoop(ThreadVars *tv, void *data, void *slot); void ReceiveIPFWThreadExitStats(ThreadVars *, void *); TmEcode ReceiveIPFWThreadDeinit(ThreadVars *, void *); TmEcode IPFWSetVerdict(ThreadVars *, IPFWThreadVars *, Packet *); TmEcode VerdictIPFW(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode VerdictIPFWThreadInit(ThreadVars *, void *, void **); void VerdictIPFWThreadExitStats(ThreadVars *, void *); TmEcode VerdictIPFWThreadDeinit(ThreadVars *, void *); TmEcode DecodeIPFWThreadInit(ThreadVars *, void *, void **); TmEcode DecodeIPFWThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeIPFW(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); /** * \brief Registration Function for RecieveIPFW. * \todo Unit tests are needed for this module. */ void TmModuleReceiveIPFWRegister (void) { SCMutexInit(&ipfw_init_lock, NULL); tmm_modules[TMM_RECEIVEIPFW].name = "ReceiveIPFW"; tmm_modules[TMM_RECEIVEIPFW].ThreadInit = ReceiveIPFWThreadInit; tmm_modules[TMM_RECEIVEIPFW].Func = NULL; tmm_modules[TMM_RECEIVEIPFW].PktAcqLoop = ReceiveIPFWLoop; tmm_modules[TMM_RECEIVEIPFW].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEIPFW].ThreadExitPrintStats = ReceiveIPFWThreadExitStats; tmm_modules[TMM_RECEIVEIPFW].ThreadDeinit = ReceiveIPFWThreadDeinit; tmm_modules[TMM_RECEIVEIPFW].cap_flags = SC_CAP_NET_ADMIN | SC_CAP_NET_RAW | SC_CAP_NET_BIND_SERVICE | SC_CAP_NET_BROADCAST; /** \todo untested */ tmm_modules[TMM_RECEIVEIPFW].RegisterTests = NULL; tmm_modules[TMM_RECEIVEIPFW].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for VerdictIPFW. * \todo Unit tests are needed for this module. */ void TmModuleVerdictIPFWRegister (void) { tmm_modules[TMM_VERDICTIPFW].name = "VerdictIPFW"; tmm_modules[TMM_VERDICTIPFW].ThreadInit = VerdictIPFWThreadInit; tmm_modules[TMM_VERDICTIPFW].Func = VerdictIPFW; tmm_modules[TMM_VERDICTIPFW].ThreadExitPrintStats = VerdictIPFWThreadExitStats; tmm_modules[TMM_VERDICTIPFW].ThreadDeinit = VerdictIPFWThreadDeinit; tmm_modules[TMM_VERDICTIPFW].cap_flags = SC_CAP_NET_ADMIN | SC_CAP_NET_RAW | SC_CAP_NET_BIND_SERVICE; /** \todo untested */ tmm_modules[TMM_VERDICTIPFW].RegisterTests = NULL; } /** * \brief Registration Function for DecodeIPFW. * \todo Unit tests are needed for this module. */ void TmModuleDecodeIPFWRegister (void) { tmm_modules[TMM_DECODEIPFW].name = "DecodeIPFW"; tmm_modules[TMM_DECODEIPFW].ThreadInit = DecodeIPFWThreadInit; tmm_modules[TMM_DECODEIPFW].Func = DecodeIPFW; tmm_modules[TMM_DECODEIPFW].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEIPFW].ThreadDeinit = DecodeIPFWThreadDeinit; tmm_modules[TMM_DECODEIPFW].RegisterTests = NULL; tmm_modules[TMM_DECODEIPFW].flags = TM_FLAG_DECODE_TM; } static inline void IPFWMutexInit(IPFWQueueVars *nq) { char *active_runmode = RunmodeGetActive(); if (active_runmode && !strcmp("workers", active_runmode)) { nq->use_mutex = 0; SCLogInfo("IPFW running in 'workers' runmode, will not use mutex."); } else { nq->use_mutex = 1; } if (nq->use_mutex) SCMutexInit(&nq->socket_lock, NULL); } static inline void IPFWMutexLock(IPFWQueueVars *nq) { if (nq->use_mutex) SCMutexLock(&nq->socket_lock); } static inline void IPFWMutexUnlock(IPFWQueueVars *nq) { if (nq->use_mutex) SCMutexUnlock(&nq->socket_lock); } TmEcode ReceiveIPFWLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); IPFWThreadVars *ptv = (IPFWThreadVars *)data; IPFWQueueVars *nq = NULL; uint8_t pkt[IP_MAXPACKET]; int pktlen=0; struct pollfd IPFWpoll; struct timeval IPFWts; Packet *p = NULL; nq = IPFWGetQueue(ptv->ipfw_index); if (nq == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Can't get thread variable"); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("Thread '%s' will run on port %d (item %d)", tv->name, nq->port_num, ptv->ipfw_index); while (1) { if (unlikely(suricata_ctl_flags != 0)) { SCReturnInt(TM_ECODE_OK); } IPFWpoll.fd = nq->fd; IPFWpoll.events = POLLRDNORM; /* Poll the socket for status */ if ( (poll(&IPFWpoll, 1, IPFW_SOCKET_POLL_MSEC)) > 0) { if (!(IPFWpoll.revents & (POLLRDNORM | POLLERR))) continue; } if ((pktlen = recvfrom(nq->fd, pkt, sizeof(pkt), 0, (struct sockaddr *)&nq->ipfw_sin, &nq->ipfw_sinlen)) == -1) { /* We received an error on socket read */ if (errno == EINTR || errno == EWOULDBLOCK) { /* Nothing for us to process */ continue; } else { SCLogWarning(SC_WARN_IPFW_RECV, "Read from IPFW divert socket failed: %s", strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } } /* We have a packet to process */ memset (&IPFWts, 0, sizeof(struct timeval)); gettimeofday(&IPFWts, NULL); /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnInt(TM_ECODE_FAILED); } PKT_SET_SRC(p, PKT_SRC_WIRE); SCLogDebug("Received Packet Len: %d", pktlen); p->ts.tv_sec = IPFWts.tv_sec; p->ts.tv_usec = IPFWts.tv_usec; ptv->pkts++; ptv->bytes += pktlen; p->datalink = ptv->datalink; p->ipfw_v.ipfw_index = ptv->ipfw_index; PacketCopyData(p, pkt, pktlen); SCLogDebug("Packet info: pkt_len: %" PRIu32 " (pkt %02x, pkt_data %02x)", GET_PKT_LEN(p), *pkt, *(GET_PKT_DATA(p))); if (TmThreadsSlotProcessPkt(tv, ((TmSlot *) slot)->slot_next, p) != TM_ECODE_OK) { TmqhOutputPacketpool(tv, p); SCReturnInt(TM_ECODE_FAILED); } StatsSyncCountersIfSignalled(tv); } SCReturnInt(TM_ECODE_OK); } /** * \brief Init function for RecieveIPFW. * * This is a setup function for recieving packets * via ipfw divert, binds a socket, and prepares to * to read from it. * * \param tv pointer to ThreadVars * \param initdata pointer to the divert port passed from the user * \param data pointer gets populated with IPFWThreadVars * */ TmEcode ReceiveIPFWThreadInit(ThreadVars *tv, void *initdata, void **data) { struct timeval timev; int flag; IPFWThreadVars *ntv = (IPFWThreadVars *) initdata; IPFWQueueVars *nq = IPFWGetQueue(ntv->ipfw_index); sigset_t sigs; sigfillset(&sigs); pthread_sigmask(SIG_UNBLOCK, &sigs, NULL); SCEnter(); IPFWMutexInit(nq); /* We need a divert socket to play with */ if ((nq->fd = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) { SCLogError(SC_ERR_IPFW_SOCK,"Can't create divert socket: %s", strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } /* set a timeout to the socket so we can check for a signal * in case we don't get packets for a longer period. */ timev.tv_sec = 1; timev.tv_usec = 0; if (setsockopt(nq->fd, SOL_SOCKET, SO_RCVTIMEO, &timev, sizeof(timev)) == -1) { SCLogError(SC_ERR_IPFW_SETSOCKOPT,"Can't set IPFW divert socket timeout: %s", strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } /* set SO_BROADCAST on the divert socket, otherwise sendto() * returns EACCES when reinjecting broadcast packets. */ flag = 1; if (setsockopt(nq->fd, SOL_SOCKET, SO_BROADCAST, &flag, sizeof(flag)) == -1) { SCLogError(SC_ERR_IPFW_SETSOCKOPT,"Can't set IPFW divert socket broadcast flag: %s", strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } nq->ipfw_sinlen=sizeof(nq->ipfw_sin); memset(&nq->ipfw_sin, 0, nq->ipfw_sinlen); nq->ipfw_sin.sin_family = PF_INET; nq->ipfw_sin.sin_addr.s_addr = INADDR_ANY; nq->ipfw_sin.sin_port = htons(nq->port_num); /* Bind that SOB */ if (bind(nq->fd, (struct sockaddr *)&nq->ipfw_sin, nq->ipfw_sinlen) == -1) { SCLogError(SC_ERR_IPFW_BIND,"Can't bind divert socket on port %d: %s",nq->port_num,strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } ntv->datalink = DLT_RAW; *data = (void *)ntv; SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats to the screen at exit. * \todo Unit tests are needed for this module. * \param tv pointer to ThreadVars * \param data pointer that gets cast into IPFWThreadVars for ptv */ void ReceiveIPFWThreadExitStats(ThreadVars *tv, void *data) { IPFWThreadVars *ptv = (IPFWThreadVars *)data; SCEnter(); SCLogNotice("(%s) Treated: Pkts %" PRIu32 ", Bytes %" PRIu64 ", Errors %" PRIu32 "", tv->name, ptv->pkts, ptv->bytes, ptv->errs); SCLogNotice("(%s) Verdict: Accepted %"PRIu32", Dropped %"PRIu32 "", tv->name, ptv->accepted, ptv->dropped); SCReturn; } /** * \brief DeInit function closes divert socket at exit. * \todo Unit tests are needed for this module. * \param tv pointer to ThreadVars * \param data pointer that gets cast into IPFWThreadVars for ptv */ TmEcode ReceiveIPFWThreadDeinit(ThreadVars *tv, void *data) { IPFWThreadVars *ptv = (IPFWThreadVars *)data; IPFWQueueVars *nq = IPFWGetQueue(ptv->ipfw_index); SCEnter(); /* Attempt to shut the socket down...close instead? */ if (shutdown(nq->fd, SHUT_RD) < 0) { SCLogWarning(SC_WARN_IPFW_UNBIND,"Unable to disable ipfw socket: %s",strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } SCReturnInt(TM_ECODE_OK); } /** * \brief This function passes off to link type decoders. * \todo Unit tests are needed for this module. * * DecodeIPFW reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param tv pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into IPFWThreadVars for ptv * \param pq pointer to the PacketQueue */ TmEcode DecodeIPFW(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { IPV4Hdr *ip4h = (IPV4Hdr *)GET_PKT_DATA(p); IPV6Hdr *ip6h = (IPV6Hdr *)GET_PKT_DATA(p); DecodeThreadVars *dtv = (DecodeThreadVars *)data; SCEnter(); /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* Process IP packets */ if (IPV4_GET_RAW_VER(ip4h) == 4) { SCLogDebug("DecodeIPFW ip4 processing"); DecodeIPV4(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else if(IPV6_GET_RAW_VER(ip6h) == 6) { SCLogDebug("DecodeIPFW ip6 processing"); DecodeIPV6(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else { /* We don't support anything besides IP packets for now, bridged packets? */ SCLogInfo("IPFW unknown protocol support %02x", *GET_PKT_DATA(p)); SCReturnInt(TM_ECODE_FAILED); } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } /** * \brief This function initializes the DecodeThreadVariables * * * \param tv pointer to ThreadVars * \param initdata pointer for passing in args * \param data pointer that gets cast into IPFWThreadVars for ptv */ TmEcode DecodeIPFWThreadInit(ThreadVars *tv, void *initdata, void **data) { DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodeIPFWThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } /** * \brief This function sets the Verdict and processes the packet * * * \param tv pointer to ThreadVars * \param p pointer to the Packet */ TmEcode IPFWSetVerdict(ThreadVars *tv, IPFWThreadVars *ptv, Packet *p) { uint32_t verdict; #if 0 struct pollfd IPFWpoll; #endif IPFWQueueVars *nq = NULL; SCEnter(); if (p == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Packet is NULL"); SCReturnInt(TM_ECODE_FAILED); } nq = IPFWGetQueue(p->ipfw_v.ipfw_index); if (nq == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "No thread found"); SCReturnInt(TM_ECODE_FAILED); } #if 0 IPFWpoll.fd = nq->fd; IPFWpoll.events = POLLWRNORM; #endif if (PACKET_TEST_ACTION(p, ACTION_DROP)) { verdict = IPFW_DROP; } else { verdict = IPFW_ACCEPT; } if (verdict == IPFW_ACCEPT) { SCLogDebug("IPFW Verdict is to Accept"); ptv->accepted++; /* For divert sockets, accepting means writing the * packet back to the socket for ipfw to pick up */ SCLogDebug("IPFWSetVerdict writing to socket %d, %p, %u", nq->fd, GET_PKT_DATA(p),GET_PKT_LEN(p)); #if 0 while ((poll(&IPFWpoll,1,IPFW_SOCKET_POLL_MSEC)) < 1) { /* Did we receive a signal to shutdown */ if (TmThreadsCheckFlag(tv, THV_KILL) || TmThreadsCheckFlag(tv, THV_PAUSE)) { SCLogInfo("Received ThreadShutdown: IPFW divert socket writing interrupted"); SCReturnInt(TM_ECODE_OK); } } #endif IPFWMutexLock(nq); if (sendto(nq->fd, GET_PKT_DATA(p), GET_PKT_LEN(p), 0,(struct sockaddr *)&nq->ipfw_sin, nq->ipfw_sinlen) == -1) { int r = errno; switch (r) { default: SCLogWarning(SC_WARN_IPFW_XMIT,"Write to ipfw divert socket failed: %s",strerror(r)); IPFWMutexUnlock(nq); SCReturnInt(TM_ECODE_FAILED); case EHOSTDOWN: case ENETDOWN: break; } } IPFWMutexUnlock(nq); SCLogDebug("Sent Packet back into IPFW Len: %d",GET_PKT_LEN(p)); } /* end IPFW_ACCEPT */ if (verdict == IPFW_DROP) { SCLogDebug("IPFW SetVerdict is to DROP"); ptv->dropped++; /** \todo For divert sockets, dropping means not writing the packet back to the socket. * Need to see if there is some better way to free the packet from the queue */ } /* end IPFW_DROP */ SCReturnInt(TM_ECODE_OK); } /** * \brief This function handles the Verdict processing * \todo Unit tests are needed for this module. * * * \param tv pointer to ThreadVars * \param p pointer to the Packet * \param data pointer that gets cast into IPFWThreadVars for ptv * \param pq pointer for the Packet Queue access (Not used) */ TmEcode VerdictIPFW(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { IPFWThreadVars *ptv = (IPFWThreadVars *)data; TmEcode retval = TM_ECODE_OK; SCEnter(); /* can't verdict a "fake" packet */ if (p->flags & PKT_PSEUDO_STREAM_END) { SCReturnInt(TM_ECODE_OK); } /* This came from NFQ. * if this is a tunnel packet we check if we are ready to verdict * already. */ if (IS_TUNNEL_PKT(p)) { char verdict = 1; SCMutex *m = p->root ? &p->root->tunnel_mutex : &p->tunnel_mutex; SCMutexLock(m); /* if there are more tunnel packets than ready to verdict packets, * we won't verdict this one */ if (TUNNEL_PKT_TPR(p) > TUNNEL_PKT_RTV(p)) { SCLogDebug("VerdictIPFW: not ready to verdict yet: " "TUNNEL_PKT_TPR(p) > TUNNEL_PKT_RTV(p) = %" PRId32 " > %" PRId32 "", TUNNEL_PKT_TPR(p), TUNNEL_PKT_RTV(p)); verdict = 0; } SCMutexUnlock(m); /* don't verdict if we are not ready */ if (verdict == 1) { SCLogDebug("Setting verdict on tunnel"); retval = IPFWSetVerdict(tv, ptv, p->root ? p->root : p); } else { TUNNEL_INCR_PKT_RTV(p); } } else { /* no tunnel, verdict normally */ SCLogDebug("Setting verdict on non-tunnel"); retval = IPFWSetVerdict(tv, ptv, p); } /* IS_TUNNEL_PKT end */ SCReturnInt(retval); } /** * \brief This function initializes the VerdictThread * * * \param t pointer to ThreadVars * \param initdata pointer for passing in args * \param data pointer that gets cast into IPFWThreadVars for ptv */ TmEcode VerdictIPFWThreadInit(ThreadVars *tv, void *initdata, void **data) { IPFWThreadVars *ptv = NULL; SCEnter(); /* Setup Thread vars */ if ( (ptv = SCMalloc(sizeof(IPFWThreadVars))) == NULL) SCReturnInt(TM_ECODE_FAILED); memset(ptv, 0, sizeof(IPFWThreadVars)); *data = (void *)ptv; SCReturnInt(TM_ECODE_OK); } /** * \brief This function deinitializes the VerdictThread * * * \param tv pointer to ThreadVars * \param data pointer that gets cast into IPFWThreadVars for ptv */ TmEcode VerdictIPFWThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); /* We don't need to do anything...not sure quite yet */ SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats for the VerdictThread * * * \param tv pointer to ThreadVars * \param data pointer that gets cast into IPFWThreadVars for ptv */ void VerdictIPFWThreadExitStats(ThreadVars *tv, void *data) { IPFWThreadVars *ptv = (IPFWThreadVars *)data; SCLogInfo("IPFW Processing: - (%s) Pkts accepted %" PRIu32 ", dropped %" PRIu32 "", tv->name, ptv->accepted, ptv->dropped); } /** * \brief Add an IPFW divert * * \param string with the queue name * * \retval 0 on success. * \retval -1 on failure. */ int IPFWRegisterQueue(char *queue) { IPFWThreadVars *ntv = NULL; IPFWQueueVars *nq = NULL; /* Extract the queue number from the specified command line argument */ uint16_t port_num = 0; if ((ByteExtractStringUint16(&port_num, 10, strlen(queue), queue)) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified queue number %s is not " "valid", queue); return -1; } SCMutexLock(&ipfw_init_lock); if (receive_port_num >= IPFW_MAX_QUEUE) { SCLogError(SC_ERR_INVALID_ARGUMENT, "too much IPFW divert port registered (%d)", receive_port_num); SCMutexUnlock(&ipfw_init_lock); return -1; } if (receive_port_num == 0) { memset(&ipfw_t, 0, sizeof(ipfw_t)); memset(&ipfw_q, 0, sizeof(ipfw_q)); } ntv = &ipfw_t[receive_port_num]; ntv->ipfw_index = receive_port_num; nq = &ipfw_q[receive_port_num]; nq->port_num = port_num; receive_port_num++; SCMutexUnlock(&ipfw_init_lock); LiveRegisterDevice(queue); SCLogDebug("Queue \"%s\" registered.", queue); return 0; } /** * \brief Get a pointer to the IPFW queue at index * * \param number idx of the queue in our array * * \retval ptr pointer to the IPFWThreadVars at index * \retval NULL on error */ void *IPFWGetQueue(int number) { if (number >= receive_port_num) return NULL; return (void *)&ipfw_q[number]; } /** * \brief Get a pointer to the IPFW thread at index * * This function is temporary used as configuration parser. * * \param number idx of the queue in our array * * \retval ptr pointer to the IPFWThreadVars at index * \retval NULL on error */ void *IPFWGetThread(int number) { if (number >= receive_port_num) return NULL; return (void *)&ipfw_t[number]; } #endif /* End ifdef IPFW */ /* eof */ suricata-3.2.1/src/output-json-netflow.c0000644000000000000000000003111613051004444015132 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements Unidirectiontal NetFlow JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "output-json.h" #include "stream-tcp-private.h" #ifdef HAVE_LIBJANSSON typedef struct LogJsonFileCtx_ { LogFileCtx *file_ctx; } LogJsonFileCtx; typedef struct JsonNetFlowLogThread_ { LogJsonFileCtx *flowlog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ MemBuffer *buffer; } JsonNetFlowLogThread; static json_t *CreateJSONHeaderFromFlow(Flow *f, char *event_type, int dir) { char timebuf[64]; char srcip[46], dstip[46]; Port sp, dp; json_t *js = json_object(); if (unlikely(js == NULL)) return NULL; struct timeval tv; memset(&tv, 0x00, sizeof(tv)); TimeGet(&tv); CreateIsoTimeString(&tv, timebuf, sizeof(timebuf)); srcip[0] = '\0'; dstip[0] = '\0'; if (FLOW_IS_IPV4(f)) { if (dir == 0) { PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip)); } else { PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), dstip, sizeof(dstip)); } } else if (FLOW_IS_IPV6(f)) { if (dir == 0) { PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip)); } else { PrintInet(AF_INET6, (const void *)&(f->dst.address), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)&(f->src.address), dstip, sizeof(dstip)); } } if (dir == 0) { sp = f->sp; dp = f->dp; } else { sp = f->dp; dp = f->sp; } char proto[16]; if (SCProtoNameValid(f->proto) == TRUE) { strlcpy(proto, known_proto[f->proto], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "%03" PRIu32, f->proto); } /* time */ json_object_set_new(js, "timestamp", json_string(timebuf)); CreateJSONFlowId(js, (const Flow *)f); #if 0 // TODO /* sensor id */ if (sensor_id >= 0) json_object_set_new(js, "sensor_id", json_integer(sensor_id)); #endif if (event_type) { json_object_set_new(js, "event_type", json_string(event_type)); } #if 0 /* vlan */ if (f->vlan_id[0] > 0) { json_t *js_vlan; switch (f->vlan_idx) { case 1: json_object_set_new(js, "vlan", json_integer(f->vlan_id[0])); break; case 2: js_vlan = json_array(); if (unlikely(js != NULL)) { json_array_append_new(js_vlan, json_integer(VLAN_GET_ID1(p))); json_array_append_new(js_vlan, json_integer(VLAN_GET_ID2(p))); json_object_set_new(js, "vlan", js_vlan); } break; default: /* shouldn't get here */ break; } } #endif /* tuple */ json_object_set_new(js, "src_ip", json_string(srcip)); switch(f->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "src_port", json_integer(sp)); break; } json_object_set_new(js, "dest_ip", json_string(dstip)); switch(f->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "dest_port", json_integer(dp)); break; } json_object_set_new(js, "proto", json_string(proto)); switch (f->proto) { case IPPROTO_ICMP: case IPPROTO_ICMPV6: json_object_set_new(js, "icmp_type", json_integer(f->type)); json_object_set_new(js, "icmp_code", json_integer(f->code)); break; } return js; } /* JSON format logging */ static void JsonNetFlowLogJSONToServer(JsonNetFlowLogThread *aft, json_t *js, Flow *f) { json_t *hjs = json_object(); if (hjs == NULL) { return; } json_object_set_new(js, "app_proto", json_string(AppProtoToString(f->alproto_ts ? f->alproto_ts : f->alproto))); json_object_set_new(hjs, "pkts", json_integer(f->todstpktcnt)); json_object_set_new(hjs, "bytes", json_integer(f->todstbytecnt)); char timebuf1[64], timebuf2[64]; CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1)); CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2)); json_object_set_new(hjs, "start", json_string(timebuf1)); json_object_set_new(hjs, "end", json_string(timebuf2)); int32_t age = f->lastts.tv_sec - f->startts.tv_sec; json_object_set_new(hjs, "age", json_integer(age)); json_object_set_new(js, "netflow", hjs); /* TCP */ if (f->proto == IPPROTO_TCP) { json_t *tjs = json_object(); if (tjs == NULL) { return; } TcpSession *ssn = f->protoctx; char hexflags[3]; snprintf(hexflags, sizeof(hexflags), "%02x", ssn ? ssn->client.tcp_flags : 0); json_object_set_new(tjs, "tcp_flags", json_string(hexflags)); JsonTcpFlags(ssn ? ssn->client.tcp_flags : 0, tjs); json_object_set_new(js, "tcp", tjs); } } static void JsonNetFlowLogJSONToClient(JsonNetFlowLogThread *aft, json_t *js, Flow *f) { json_t *hjs = json_object(); if (hjs == NULL) { return; } json_object_set_new(js, "app_proto", json_string(AppProtoToString(f->alproto_tc ? f->alproto_tc : f->alproto))); json_object_set_new(hjs, "pkts", json_integer(f->tosrcpktcnt)); json_object_set_new(hjs, "bytes", json_integer(f->tosrcbytecnt)); char timebuf1[64], timebuf2[64]; CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1)); CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2)); json_object_set_new(hjs, "start", json_string(timebuf1)); json_object_set_new(hjs, "end", json_string(timebuf2)); int32_t age = f->lastts.tv_sec - f->startts.tv_sec; json_object_set_new(hjs, "age", json_integer(age)); json_object_set_new(js, "netflow", hjs); /* TCP */ if (f->proto == IPPROTO_TCP) { json_t *tjs = json_object(); if (tjs == NULL) { return; } TcpSession *ssn = f->protoctx; char hexflags[3]; snprintf(hexflags, sizeof(hexflags), "%02x", ssn ? ssn->server.tcp_flags : 0); json_object_set_new(tjs, "tcp_flags", json_string(hexflags)); JsonTcpFlags(ssn ? ssn->server.tcp_flags : 0, tjs); json_object_set_new(js, "tcp", tjs); } } static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f) { SCEnter(); JsonNetFlowLogThread *jhl = (JsonNetFlowLogThread *)thread_data; /* reset */ MemBufferReset(jhl->buffer); json_t *js = CreateJSONHeaderFromFlow(f, "netflow", 0); //TODO const if (unlikely(js == NULL)) return TM_ECODE_OK; JsonNetFlowLogJSONToServer(jhl, js, f); OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer); json_object_del(js, "netflow"); json_object_clear(js); json_decref(js); /* reset */ MemBufferReset(jhl->buffer); js = CreateJSONHeaderFromFlow(f, "netflow", 1); //TODO const if (unlikely(js == NULL)) return TM_ECODE_OK; JsonNetFlowLogJSONToClient(jhl, js, f); OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer); json_object_del(js, "netflow"); json_object_clear(js); json_decref(js); SCReturnInt(TM_ECODE_OK); } static void OutputNetFlowLogDeinit(OutputCtx *output_ctx) { LogJsonFileCtx *flow_ctx = output_ctx->data; LogFileCtx *logfile_ctx = flow_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(flow_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "netflow.json" OutputCtx *OutputNetFlowLogInit(ConfNode *conf) { SCLogInfo("hi"); LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_NETFLOW_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx)); if (unlikely(flow_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(flow_ctx); return NULL; } flow_ctx->file_ctx = file_ctx; output_ctx->data = flow_ctx; output_ctx->DeInit = OutputNetFlowLogDeinit; return output_ctx; } static void OutputNetFlowLogDeinitSub(OutputCtx *output_ctx) { LogJsonFileCtx *flow_ctx = output_ctx->data; SCFree(flow_ctx); SCFree(output_ctx); } OutputCtx *OutputNetFlowLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx)); if (unlikely(flow_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(flow_ctx); return NULL; } flow_ctx->file_ctx = ojc->file_ctx; output_ctx->data = flow_ctx; output_ctx->DeInit = OutputNetFlowLogDeinitSub; return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonNetFlowLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonNetFlowLogThread *aft = SCMalloc(sizeof(JsonNetFlowLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonNetFlowLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogNetflow. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->flowlog_ctx = ((OutputCtx *)initdata)->data; //TODO aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonNetFlowLogThreadDeinit(ThreadVars *t, void *data) { JsonNetFlowLogThread *aft = (JsonNetFlowLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonNetFlowLogThread)); SCFree(aft); return TM_ECODE_OK; } void JsonNetFlowLogRegister(void) { /* register as separate module */ OutputRegisterFlowModule(LOGGER_JSON_NETFLOW, "JsonNetFlowLog", "netflow-json-log", OutputNetFlowLogInit, JsonNetFlowLogger, JsonNetFlowLogThreadInit, JsonNetFlowLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterFlowSubModule(LOGGER_JSON_NETFLOW, "eve-log", "JsonNetFlowLog", "eve-log.netflow", OutputNetFlowLogInitSub, JsonNetFlowLogger, JsonNetFlowLogThreadInit, JsonNetFlowLogThreadDeinit, NULL); } #else void JsonNetFlowLogRegister (void) { } #endif suricata-3.2.1/src/detect-filename.c0000644000000000000000000002071613051004444014201 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon * */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-engine-file.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "stream-tcp.h" #include "detect-filename.h" #include "app-layer-parser.h" static int DetectFilenameMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, File *, Signature *, SigMatch *); static int DetectFilenameSetup (DetectEngineCtx *, Signature *, char *); static void DetectFilenameRegisterTests(void); static void DetectFilenameFree(void *); /** * \brief Registration function for keyword: filename */ void DetectFilenameRegister(void) { sigmatch_table[DETECT_FILENAME].name = "filename"; sigmatch_table[DETECT_FILENAME].desc = "match on the file name"; sigmatch_table[DETECT_FILENAME].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filename"; sigmatch_table[DETECT_FILENAME].FileMatch = DetectFilenameMatch; sigmatch_table[DETECT_FILENAME].Setup = DetectFilenameSetup; sigmatch_table[DETECT_FILENAME].Free = DetectFilenameFree; sigmatch_table[DETECT_FILENAME].RegisterTests = DetectFilenameRegisterTests; DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEMATCH, DetectFileInspectHttp); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEMATCH, DetectFileInspectHttp); DetectAppLayerInspectEngineRegister(ALPROTO_SMTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEMATCH, DetectFileInspectSmtp); SCLogDebug("registering filename rule option"); return; } /** * \brief match the specified filename * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFilenameData * * \retval 0 no match * \retval 1 match */ static int DetectFilenameMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; DetectFilenameData *filename = (DetectFilenameData *)m->ctx; if (file->name == NULL) SCReturnInt(0); if (file->txid < det_ctx->tx_id) SCReturnInt(0); if (file->txid > det_ctx->tx_id) SCReturnInt(0); if (BoyerMooreNocase(filename->name, filename->len, file->name, file->name_len, filename->bm_ctx) != NULL) { #ifdef DEBUG if (SCLogDebugEnabled()) { char *name = SCMalloc(filename->len + 1); if (name != NULL) { memcpy(name, filename->name, filename->len); name[filename->len] = '\0'; SCLogDebug("will look for filename %s", name); } } #endif if (!(filename->flags & DETECT_CONTENT_NEGATED)) { ret = 1; } } if (ret == 0 && (filename->flags & DETECT_CONTENT_NEGATED)) { SCLogDebug("negated match"); ret = 1; } SCReturnInt(ret); } /** * \brief Parse the filename keyword * * \param idstr Pointer to the user provided option * * \retval filename pointer to DetectFilenameData on success * \retval NULL on failure */ static DetectFilenameData *DetectFilenameParse (char *str) { DetectFilenameData *filename = NULL; /* We have a correct filename option */ filename = SCMalloc(sizeof(DetectFilenameData)); if (unlikely(filename == NULL)) goto error; memset(filename, 0x00, sizeof(DetectFilenameData)); if (DetectContentDataParse ("filename", str, &filename->name, &filename->len, &filename->flags) == -1) { goto error; } filename->bm_ctx = BoyerMooreNocaseCtxInit(filename->name, filename->len); if (filename->bm_ctx == NULL) { goto error; } SCLogDebug("flags %02X", filename->flags); if (filename->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("negated filename"); } #ifdef DEBUG if (SCLogDebugEnabled()) { char *name = SCMalloc(filename->len + 1); if (name != NULL) { memcpy(name, filename->name, filename->len); name[filename->len] = '\0'; SCLogDebug("will look for filename %s", name); } } #endif return filename; error: if (filename != NULL) DetectFilenameFree(filename); return NULL; } /** * \brief this function is used to parse filename options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filename" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectFilenameData *filename = NULL; SigMatch *sm = NULL; filename = DetectFilenameParse(str); if (filename == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FILENAME; sm->ctx = (void *)filename; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_FILENAME); return 0; error: if (filename != NULL) DetectFilenameFree(filename); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFilenameData * * \param filename pointer to DetectFilenameData */ static void DetectFilenameFree(void *ptr) { if (ptr != NULL) { DetectFilenameData *filename = (DetectFilenameData *)ptr; if (filename->bm_ctx != NULL) { BoyerMooreCtxDeInit(filename->bm_ctx); } if (filename->name != NULL) SCFree(filename->name); SCFree(filename); } } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectFilenameTestParse01 */ int DetectFilenameTestParse01 (void) { DetectFilenameData *dnd = DetectFilenameParse("\"secret.pdf\""); if (dnd != NULL) { DetectFilenameFree(dnd); return 1; } return 0; } /** * \test DetectFilenameTestParse02 */ int DetectFilenameTestParse02 (void) { int result = 0; DetectFilenameData *dnd = DetectFilenameParse("\"backup.tar.gz\""); if (dnd != NULL) { if (dnd->len == 13 && memcmp(dnd->name, "backup.tar.gz", 13) == 0) { result = 1; } DetectFilenameFree(dnd); return result; } return 0; } /** * \test DetectFilenameTestParse03 */ int DetectFilenameTestParse03 (void) { int result = 0; DetectFilenameData *dnd = DetectFilenameParse("\"cmd.exe\""); if (dnd != NULL) { if (dnd->len == 7 && memcmp(dnd->name, "cmd.exe", 7) == 0) { result = 1; } DetectFilenameFree(dnd); return result; } return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFilename */ void DetectFilenameRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectFilenameTestParse01", DetectFilenameTestParse01); UtRegisterTest("DetectFilenameTestParse02", DetectFilenameTestParse02); UtRegisterTest("DetectFilenameTestParse03", DetectFilenameTestParse03); #endif /* UNITTESTS */ } suricata-3.2.1/src/defrag-queue.c0000644000000000000000000000614013051004444013520 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Defrag tracker queue handler functions */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "defrag-queue.h" #include "util-error.h" #include "util-debug.h" #include "util-print.h" DefragTrackerQueue *DefragTrackerQueueInit (DefragTrackerQueue *q) { if (q != NULL) { memset(q, 0, sizeof(DefragTrackerQueue)); DQLOCK_INIT(q); } return q; } DefragTrackerQueue *DefragTrackerQueueNew() { DefragTrackerQueue *q = (DefragTrackerQueue *)SCMalloc(sizeof(DefragTrackerQueue)); if (q == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in DefragTrackerQueueNew. Exiting..."); exit(EXIT_SUCCESS); } q = DefragTrackerQueueInit(q); return q; } /** * \brief Destroy a tracker queue * * \param q the tracker queue to destroy */ void DefragTrackerQueueDestroy (DefragTrackerQueue *q) { DQLOCK_DESTROY(q); } /** * \brief add a tracker to a queue * * \param q queue * \param dt tracker */ void DefragTrackerEnqueue (DefragTrackerQueue *q, DefragTracker *dt) { #ifdef DEBUG BUG_ON(q == NULL || dt == NULL); #endif DQLOCK_LOCK(q); /* more trackers in queue */ if (q->top != NULL) { dt->lnext = q->top; q->top->lprev = dt; q->top = dt; /* only tracker */ } else { q->top = dt; q->bot = dt; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ DQLOCK_UNLOCK(q); } /** * \brief remove a tracker from the queue * * \param q queue * * \retval dt tracker or NULL if empty list. */ DefragTracker *DefragTrackerDequeue (DefragTrackerQueue *q) { DQLOCK_LOCK(q); DefragTracker *dt = q->bot; if (dt == NULL) { DQLOCK_UNLOCK(q); return NULL; } /* more packets in queue */ if (q->bot->lprev != NULL) { q->bot = q->bot->lprev; q->bot->lnext = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } #ifdef DEBUG BUG_ON(q->len == 0); #endif if (q->len > 0) q->len--; dt->lnext = NULL; dt->lprev = NULL; DQLOCK_UNLOCK(q); return dt; } uint32_t DefragTrackerQueueLen(DefragTrackerQueue *q) { uint32_t len; DQLOCK_LOCK(q); len = q->len; DQLOCK_UNLOCK(q); return len; } suricata-3.2.1/src/detect-tls-sni.h0000644000000000000000000000200213051004444014003 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland */ #ifndef __DETECT_TLS_SNI_H__ #define __DETECT_TLS_SNI_H__ #include "app-layer-ssl.h" void DetectTlsSniRegister(void); uint32_t DetectTlsSniInspectMpm(DetectEngineThreadCtx *det_ctx, SSLState *ssl_state); #endif /* __DETECT_TLS_SNI_H__ */ suricata-3.2.1/src/detect.h0000644000000000000000000012461213051004444012430 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_H__ #define __DETECT_H__ #include #include "flow.h" #include "detect-engine-proto.h" #include "detect-reference.h" #include "packet-queue.h" #include "util-prefilter.h" #include "util-mpm.h" #include "util-spm.h" #include "util-hash.h" #include "util-hashlist.h" #include "util-debug.h" #include "util-error.h" #include "util-radix-tree.h" #include "util-file.h" #include "reputation.h" #include "detect-mark.h" #include "stream.h" #define DETECT_MAX_RULE_SIZE 8192 /* forward declarations for the structures from detect-engine-sigorder.h */ struct SCSigOrderFunc_; struct SCSigSignatureWrapper_; /* The detection engine groups similar signatures/rules together. Internally a tree of different types of data is created on initialization. This is it's global layout: For TCP/UDP - Flow direction -- Protocol -=- Src address -==- Dst address -===- Src port -====- Dst port For the other protocols - Flow direction -- Protocol -=- Src address -==- Dst address */ /* * DETECT ADDRESS */ /* holds the values for different possible lists in struct Signature. * These codes are access points to particular lists in the array * Signature->sm_lists[DETECT_SM_LIST_MAX]. */ enum DetectSigmatchListEnum { DETECT_SM_LIST_MATCH = 0, DETECT_SM_LIST_PMATCH, /* list for http_uri keyword and the ones relative to it */ DETECT_SM_LIST_UMATCH, /* list for http_raw_uri keyword and the ones relative to it */ DETECT_SM_LIST_HRUDMATCH, /* list for http_client_body keyword and the ones relative to it */ DETECT_SM_LIST_HCBDMATCH, /* list for http_server_body keyword and the ones relative to it */ DETECT_SM_LIST_FILEDATA, /* list for http_header keyword and the ones relative to it */ DETECT_SM_LIST_HHDMATCH, /* list for http_raw_header keyword and the ones relative to it */ DETECT_SM_LIST_HRHDMATCH, /* list for http_stat_msg keyword and the ones relative to it */ DETECT_SM_LIST_HSMDMATCH, /* list for http_stat_code keyword and the ones relative to it */ DETECT_SM_LIST_HSCDMATCH, /* list for http_host keyword and the ones relative to it */ DETECT_SM_LIST_HHHDMATCH, /* list for http_raw_host keyword and the ones relative to it */ DETECT_SM_LIST_HRHHDMATCH, /* list for http_method keyword and the ones relative to it */ DETECT_SM_LIST_HMDMATCH, /* list for http_cookie keyword and the ones relative to it */ DETECT_SM_LIST_HCDMATCH, /* list for http_user_agent keyword and the ones relative to it */ DETECT_SM_LIST_HUADMATCH, /* list for http_request_line keyword and the ones relative to it */ DETECT_SM_LIST_HTTP_REQLINEMATCH, /* list for http_response_line keyword and the ones relative to it */ DETECT_SM_LIST_HTTP_RESLINEMATCH, /* app event engine sm list */ DETECT_SM_LIST_APP_EVENT, DETECT_SM_LIST_AMATCH, DETECT_SM_LIST_DMATCH, DETECT_SM_LIST_FILEMATCH, DETECT_SM_LIST_DNSREQUEST_MATCH, /**< per DNS query tx match list */ DETECT_SM_LIST_DNSRESPONSE_MATCH, /**< per DNS response tx match list */ DETECT_SM_LIST_DNSQUERYNAME_MATCH, /**< per query in a tx list */ DETECT_SM_LIST_TLSSNI_MATCH, DETECT_SM_LIST_TLSISSUER_MATCH, DETECT_SM_LIST_TLSSUBJECT_MATCH, DETECT_SM_LIST_TLSVALIDITY_MATCH, DETECT_SM_LIST_MODBUS_MATCH, DETECT_SM_LIST_CIP_MATCH, DETECT_SM_LIST_ENIP_MATCH, DETECT_SM_LIST_BASE64_DATA, DETECT_SM_LIST_DNP3_DATA_MATCH, DETECT_SM_LIST_DNP3_MATCH, DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, /* Demarcation between detection and post-detection lists. All * detection lists must come before this. */ DETECT_SM_LIST_DETECT_MAX, /* list for post match actions: flowbit set, flowint increment, etc */ DETECT_SM_LIST_POSTMATCH = DETECT_SM_LIST_DETECT_MAX, DETECT_SM_LIST_TMATCH, /**< post-detection tagging */ /* lists for alert thresholding and suppression */ DETECT_SM_LIST_SUPPRESS, DETECT_SM_LIST_THRESHOLD, DETECT_SM_LIST_MAX, /* used for Signature->list, which indicates which list * we're adding keywords to in cases of sticky buffers like * file_data */ DETECT_SM_LIST_NOTSET, }; /* a is ... than b */ enum { ADDRESS_ER = -1, /**< error e.g. compare ipv4 and ipv6 */ ADDRESS_LT, /**< smaller [aaa] [bbb] */ ADDRESS_LE, /**< smaller with overlap [aa[bab]bb] */ ADDRESS_EQ, /**< exactly equal [abababab] */ ADDRESS_ES, /**< within [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */ ADDRESS_EB, /**< completely overlaps [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */ ADDRESS_GE, /**< bigger with overlap [bb[aba]aa] */ ADDRESS_GT, /**< bigger [bbb] [aaa] */ }; #define ADDRESS_FLAG_ANY 0x01 /**< address is "any" */ #define ADDRESS_FLAG_NOT 0x02 /**< address is negated */ /** \brief address structure for use in the detection engine. * * Contains the address information and matching information. */ typedef struct DetectAddress_ { /** address data for this group */ Address ip; Address ip2; /** flags affecting this address */ uint8_t flags; /** ptr to the previous address in the list */ struct DetectAddress_ *prev; /** ptr to the next address in the list */ struct DetectAddress_ *next; } DetectAddress; /** Signature grouping head. Here 'any', ipv4 and ipv6 are split out */ typedef struct DetectAddressHead_ { DetectAddress *any_head; DetectAddress *ipv4_head; DetectAddress *ipv6_head; } DetectAddressHead; #include "detect-threshold.h" typedef struct DetectMatchAddressIPv4_ { uint32_t ip; /**< address in host order, start of range */ uint32_t ip2; /**< address in host order, end of range */ } DetectMatchAddressIPv4; typedef struct DetectMatchAddressIPv6_ { uint32_t ip[4]; uint32_t ip2[4]; } DetectMatchAddressIPv6; /* * DETECT PORT */ /* a is ... than b */ enum { PORT_ER = -1, /* error e.g. compare ipv4 and ipv6 */ PORT_LT, /* smaller [aaa] [bbb] */ PORT_LE, /* smaller with overlap [aa[bab]bb] */ PORT_EQ, /* exactly equal [abababab] */ PORT_ES, /* within [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */ PORT_EB, /* completely overlaps [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */ PORT_GE, /* bigger with overlap [bb[aba]aa] */ PORT_GT, /* bigger [bbb] [aaa] */ }; #define PORT_FLAG_ANY 0x01 /**< 'any' special port */ #define PORT_FLAG_NOT 0x02 /**< negated port */ #define PORT_SIGGROUPHEAD_COPY 0x04 /**< sgh is a ptr copy */ /** \brief Port structure for detection engine */ typedef struct DetectPort_ { uint16_t port; uint16_t port2; uint8_t flags; /**< flags for this port */ /* signatures that belong in this group * * If the PORT_SIGGROUPHEAD_COPY flag is set, we don't own this pointer * (memory is freed elsewhere). */ struct SigGroupHead_ *sh; struct DetectPort_ *prev; struct DetectPort_ *next; } DetectPort; /* Signature flags */ #define SIG_FLAG_SRC_ANY (1) /**< source is any */ #define SIG_FLAG_DST_ANY (1<<1) /**< destination is any */ #define SIG_FLAG_SP_ANY (1<<2) /**< source port is any */ #define SIG_FLAG_DP_ANY (1<<3) /**< destination port is any */ #define SIG_FLAG_NOALERT (1<<4) /**< no alert flag is set */ #define SIG_FLAG_DSIZE (1<<5) /**< signature has a dsize setting */ #define SIG_FLAG_APPLAYER (1<<6) /**< signature applies to app layer instead of packets */ #define SIG_FLAG_IPONLY (1<<7) /**< ip only signature */ #define SIG_FLAG_STATE_MATCH (1<<8) /**< signature has matches that require stateful inspection */ #define SIG_FLAG_REQUIRE_PACKET (1<<9) /**< signature is requiring packet match */ #define SIG_FLAG_REQUIRE_STREAM (1<<10) /**< signature is requiring stream match */ #define SIG_FLAG_MPM_NEG (1<<11) #define SIG_FLAG_REQUIRE_FLOWVAR (1<<17) /**< signature can only match if a flowbit, flowvar or flowint is available. */ #define SIG_FLAG_FILESTORE (1<<18) /**< signature has filestore keyword */ #define SIG_FLAG_TOSERVER (1<<19) #define SIG_FLAG_TOCLIENT (1<<20) #define SIG_FLAG_TLSSTORE (1<<21) #define SIG_FLAG_BYPASS (1<<22) #define SIG_FLAG_PREFILTER (1<<23) /**< sig is part of a prefilter engine */ /** Proto detect only signature. * Inspected once per direction when protocol detection is done. */ #define SIG_FLAG_PDONLY (1<<24) /* signature init flags */ #define SIG_FLAG_INIT_DEONLY 1 /**< decode event only signature */ #define SIG_FLAG_INIT_PACKET (1<<1) /**< signature has matches against a packet (as opposed to app layer) */ #define SIG_FLAG_INIT_FLOW (1<<2) /**< signature has a flow setting */ #define SIG_FLAG_INIT_BIDIREC (1<<3) /**< signature has bidirectional operator */ #define SIG_FLAG_INIT_PAYLOAD (1<<4) /**< signature is inspecting the packet payload */ #define SIG_FLAG_INIT_FIRST_IPPROTO_SEEN (1 << 5) /** < signature has seen the first ip_proto keyword */ /* signature mask flags */ #define SIG_MASK_REQUIRE_PAYLOAD (1<<0) #define SIG_MASK_REQUIRE_FLOW (1<<1) #define SIG_MASK_REQUIRE_FLAGS_INITDEINIT (1<<2) /* SYN, FIN, RST */ #define SIG_MASK_REQUIRE_FLAGS_UNUSUAL (1<<3) /* URG, ECN, CWR */ #define SIG_MASK_REQUIRE_NO_PAYLOAD (1<<4) #define SIG_MASK_REQUIRE_HTTP_STATE (1<<5) #define SIG_MASK_REQUIRE_DCE_STATE (1<<6) #define SIG_MASK_REQUIRE_ENGINE_EVENT (1<<7) #define SIG_MASK_REQUIRE_SSH_STATE (1<<8) #define SIG_MASK_REQUIRE_TLS_STATE (1<<9) #define SIG_MASK_REQUIRE_DNS_STATE (1<<10) #define SIG_MASK_REQUIRE_FTP_STATE (1<<11) #define SIG_MASK_REQUIRE_SMTP_STATE (1<<12) #define SIG_MASK_REQUIRE_TEMPLATE_STATE (1<<13) #define SIG_MASK_REQUIRE_ENIP_STATE (1<<14) #define SIG_MASK_REQUIRE_DNP3_STATE (1<<15) /* for now a uint8_t is enough */ #define SignatureMask uint16_t #define DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET 0x0001 #define DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM 0x0002 #define DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH 0x0004 #define FILE_SIG_NEED_FILE 0x01 #define FILE_SIG_NEED_FILENAME 0x02 #define FILE_SIG_NEED_MAGIC 0x04 /**< need the start of the file */ #define FILE_SIG_NEED_FILECONTENT 0x08 #define FILE_SIG_NEED_MD5 0x10 #define FILE_SIG_NEED_SHA1 0x20 #define FILE_SIG_NEED_SHA256 0x40 #define FILE_SIG_NEED_SIZE 0x80 /* Detection Engine flags */ #define DE_QUIET 0x01 /**< DE is quiet (esp for unittests) */ typedef struct IPOnlyCIDRItem_ { /* address data for this item */ uint8_t family; /* netmask in CIDR values (ex. /16 /18 /24..) */ uint8_t netmask; /* If this host or net is negated for the signum */ uint8_t negated; uint32_t ip[4]; SigIntId signum; /**< our internal id */ /* linked list, the header should be the biggest network */ struct IPOnlyCIDRItem_ *next; } IPOnlyCIDRItem; /** \brief Used to start a pointer to SigMatch context * Should never be dereferenced without casting to something else. */ typedef struct SigMatchCtx_ { int foo; } SigMatchCtx; /** \brief a single match condition for a signature */ typedef struct SigMatch_ { uint8_t type; /**< match type */ uint16_t idx; /**< position in the signature */ SigMatchCtx *ctx; /**< plugin specific data */ struct SigMatch_ *next; struct SigMatch_ *prev; } SigMatch; /** \brief Data needed for Match() */ typedef struct SigMatchData_ { uint8_t type; /**< match type */ uint8_t is_last; /**< Last element of the list */ SigMatchCtx *ctx; /**< plugin specific data */ } SigMatchData; struct DetectEngineThreadCtx_;// DetectEngineThreadCtx; typedef struct DetectEngineAppInspectionEngine_ { AppProto alproto; uint8_t dir; uint8_t id; int sm_list; uint32_t inspect_flags; /* \retval 0 No match. Don't discontinue matching yet. We need more data. * 1 Match. * 2 Sig can't match. * 3 Special value used by filestore sigs to indicate disabling * filestore for the tx. */ int (*Callback)(ThreadVars *tv, struct DetectEngineCtx_ *de_ctx, struct DetectEngineThreadCtx_ *det_ctx, struct Signature_ *sig, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); struct DetectEngineAppInspectionEngine_ *next; } DetectEngineAppInspectionEngine; /** \brief Signature container */ typedef struct Signature_ { /* coccinelle: Signature:flags:SIG_FLAG */ uint32_t flags; AppProto alproto; uint16_t dsize_low; uint16_t dsize_high; SignatureMask mask; SigIntId num; /**< signature number, internal id */ /** inline -- action */ uint8_t action; uint8_t file_flags; /** addresses, ports and proto this sig matches on */ DetectProto proto; /** classification id **/ uint8_t class; /** ipv4 match arrays */ uint16_t addr_dst_match4_cnt; uint16_t addr_src_match4_cnt; uint16_t addr_dst_match6_cnt; uint16_t addr_src_match6_cnt; DetectMatchAddressIPv4 *addr_dst_match4; DetectMatchAddressIPv4 *addr_src_match4; /** ipv6 match arrays */ DetectMatchAddressIPv6 *addr_dst_match6; DetectMatchAddressIPv6 *addr_src_match6; uint32_t id; /**< sid, set by the 'sid' rule keyword */ uint32_t gid; /**< generator id */ uint32_t rev; int prio; /** port settings for this signature */ DetectPort *sp, *dp; #ifdef PROFILING uint16_t profiling_id; #endif /** number of sigmatches in the match and pmatch list */ uint16_t sm_cnt; /* used to hold flags that are predominantly used during init */ uint32_t init_flags; /* coccinelle: Signature:init_flags:SIG_FLAG_INIT_ */ /** netblocks and hosts specified at the sid, in CIDR format */ IPOnlyCIDRItem *CidrSrc, *CidrDst; DetectEngineAppInspectionEngine *app_inspect; /* Hold copies of the sm lists for Match() */ SigMatchData *sm_arrays[DETECT_SM_LIST_MAX]; /* holds all sm lists */ struct SigMatch_ *sm_lists[DETECT_SM_LIST_MAX]; /* holds all sm lists' tails */ struct SigMatch_ *sm_lists_tail[DETECT_SM_LIST_MAX]; SigMatch *filestore_sm; char *msg; /** classification message */ char *class_msg; /** Reference */ DetectReference *references; /** address settings for this signature */ const DetectAddressHead *src, *dst; /* used at init to determine max dsize */ SigMatch *dsize_sm; /* the fast pattern added from this signature */ SigMatch *mpm_sm; /* used to speed up init of prefilter */ SigMatch *prefilter_sm; /* SigMatch list used for adding content and friends. E.g. file_data; */ int list; /** score to influence rule grouping. A higher value leads to a higher * likelyhood of a rulegroup with this sig ending up as a contained * group. */ int whitelist; /* Be careful, this pointer is only valid while parsing the sig, * to warn the user about any possible problem */ char *sig_str; int prefilter_list; /** ptr to the next sig in the list */ struct Signature_ *next; } Signature; /** \brief one time registration of keywords at start up */ typedef struct DetectMpmAppLayerRegistery_ { const char *name; int direction; /**< SIG_FLAG_TOSERVER or SIG_FLAG_TOCLIENT */ int sm_list; int (*PrefilterRegister)(struct SigGroupHead_ *sgh, MpmCtx *mpm_ctx); int id; /**< index into this array and result arrays */ struct DetectMpmAppLayerRegistery_ *next; } DetectMpmAppLayerRegistery; /** \brief structure for storing per detect engine mpm keyword settings */ typedef struct DetectMpmAppLayerKeyword_ { const DetectMpmAppLayerRegistery *reg; int32_t sgh_mpm_context; /**< mpm factory id */ } DetectMpmAppLayerKeyword; typedef struct DetectReplaceList_ { struct DetectContentData_ *cd; uint8_t *found; struct DetectReplaceList_ *next; } DetectReplaceList; /** only execute flowvar storage if rule matched */ #define DETECT_FLOWVAR_TYPE_POSTMATCH 1 /** execute flowvar storage even if rule doesn't match (for lua) */ #define DETECT_FLOWVAR_TYPE_ALWAYS 2 /** list for flowvar store candidates, to be stored from * post-match function */ typedef struct DetectFlowvarList_ { uint16_t idx; /**< flowvar name idx */ uint16_t len; /**< data len */ int type; /**< type of store candidate POSTMATCH or ALWAYS */ uint8_t *buffer; /**< alloc'd buffer, may be freed by post-match, post-non-match */ struct DetectFlowvarList_ *next; } DetectFlowvarList; typedef struct DetectEngineIPOnlyThreadCtx_ { uint8_t *sig_match_array; /* bit array of sig nums */ uint32_t sig_match_size; /* size in bytes of the array */ } DetectEngineIPOnlyThreadCtx; /** \brief IP only rules matching ctx. */ typedef struct DetectEngineIPOnlyCtx_ { /* lookup hashes */ HashListTable *ht16_src, *ht16_dst; HashListTable *ht24_src, *ht24_dst; /* Lookup trees */ SCRadixTree *tree_ipv4src, *tree_ipv4dst; SCRadixTree *tree_ipv6src, *tree_ipv6dst; /* Used to build the radix trees */ IPOnlyCIDRItem *ip_src, *ip_dst; /* counters */ uint32_t a_src_uniq16, a_src_total16; uint32_t a_dst_uniq16, a_dst_total16; uint32_t a_src_uniq24, a_src_total24; uint32_t a_dst_uniq24, a_dst_total24; uint32_t max_idx; uint8_t *sig_init_array; /* bit array of sig nums */ uint32_t sig_init_size; /* size in bytes of the array */ /* number of sigs in this head */ uint32_t sig_cnt; uint32_t *match_array; } DetectEngineIPOnlyCtx; typedef struct DetectEngineLookupFlow_ { DetectPort *tcp; DetectPort *udp; struct SigGroupHead_ *sgh[256]; } DetectEngineLookupFlow; /* Flow status * * to server * to client */ #define FLOW_STATES 2 /** \brief threshold ctx */ typedef struct ThresholdCtx_ { SCMutex threshold_table_lock; /**< Mutex for hash table */ /** to support rate_filter "by_rule" option */ DetectThresholdEntry **th_entry; uint32_t th_size; } ThresholdCtx; typedef struct DetectEngineThreadKeywordCtxItem_ { void *(*InitFunc)(void *); void (*FreeFunc)(void *); void *data; struct DetectEngineThreadKeywordCtxItem_ *next; int id; const char *name; /* keyword name, for error printing */ } DetectEngineThreadKeywordCtxItem; enum DetectEnginePrefilterSetting { DETECT_PREFILTER_MPM = 0, /**< use only mpm / fast_pattern */ DETECT_PREFILTER_AUTO = 1, /**< use mpm + keyword prefilters */ }; /** \brief main detection engine ctx */ typedef struct DetectEngineCtx_ { uint8_t flags; int failure_fatal; int tenant_id; Signature *sig_list; uint32_t sig_cnt; /* version of the srep data */ uint32_t srep_version; /* reputation for netblocks */ SRepCIDRTree *srepCIDR_ctx; Signature **sig_array; uint32_t sig_array_size; /* size in bytes */ uint32_t sig_array_len; /* size in array members */ uint32_t signum; /** Maximum value of all our sgh's non_mpm_store_cnt setting, * used to alloc det_ctx::non_mpm_id_array */ uint32_t non_pf_store_cnt_max; /* used by the signature ordering module */ struct SCSigOrderFunc_ *sc_sig_order_funcs; /* hash table used for holding the classification config info */ HashTable *class_conf_ht; /* hash table used for holding the reference config info */ HashTable *reference_conf_ht; /* main sigs */ DetectEngineLookupFlow flow_gh[FLOW_STATES]; uint32_t gh_unique, gh_reuse; /* init phase vars */ HashListTable *sgh_hash_table; HashListTable *mpm_hash_table; HashListTable *variable_names; HashListTable *variable_idxs; uint16_t variable_names_idx; /* hash table used to cull out duplicate sigs */ HashListTable *dup_sig_hash_table; DetectEngineIPOnlyCtx io_ctx; ThresholdCtx ths_ctx; uint16_t mpm_matcher; /**< mpm matcher this ctx uses */ uint16_t spm_matcher; /**< spm matcher this ctx uses */ /* spm thread context prototype, built as spm matchers are constructed and * later used to construct thread context for each thread. */ SpmGlobalThreadCtx *spm_global_thread_ctx; /* Config options */ uint16_t max_uniq_toclient_groups; uint16_t max_uniq_toserver_groups; /* specify the configuration for mpm context factory */ uint8_t sgh_mpm_context; uint32_t max_fp_id; MpmCtxFactoryContainer *mpm_ctx_factory_container; /* maximum recursion depth for content inspection */ int inspection_recursion_limit; /* conf parameter that limits the length of the http request body inspected */ int hcbd_buffer_limit; /* conf parameter that limits the length of the http response body inspected */ int hsbd_buffer_limit; /* array containing all sgh's in use so we can loop * through it in Stage4. */ struct SigGroupHead_ **sgh_array; uint32_t sgh_array_cnt; uint32_t sgh_array_size; int32_t sgh_mpm_context_proto_tcp_packet; int32_t sgh_mpm_context_proto_udp_packet; int32_t sgh_mpm_context_proto_other_packet; int32_t sgh_mpm_context_stream; /* the max local id used amongst all sigs */ int32_t byte_extract_max_local_id; /* id used by every detect engine ctx instance */ uint32_t id; /** sgh for signatures that match against invalid packets. In those cases * we can't lookup by proto, address, port as we don't have these */ struct SigGroupHead_ *decoder_event_sgh; /* Maximum size of the buffer for decoded base64 data. */ uint32_t base64_decode_max_len; /** Store rule file and line so that parsers can use them in errors. */ char *rule_file; int rule_line; /** list of keywords that need thread local ctxs */ DetectEngineThreadKeywordCtxItem *keyword_list; int keyword_id; #ifdef PROFILING struct SCProfileDetectCtx_ *profile_ctx; struct SCProfileKeywordDetectCtx_ *profile_keyword_ctx; struct SCProfileKeywordDetectCtx_ *profile_keyword_ctx_per_list[DETECT_SM_LIST_MAX]; struct SCProfileSghDetectCtx_ *profile_sgh_ctx; uint32_t profile_match_logging_threshold; #endif uint32_t prefilter_maxid; char config_prefix[64]; /** minimal: essentially a stub */ int minimal; /** how many de_ctx' are referencing this */ uint32_t ref_cnt; /** list in master: either active or freelist */ struct DetectEngineCtx_ *next; /** id of loader thread 'owning' this de_ctx */ int loader_id; /** are we useing just mpm or also other prefilters */ enum DetectEnginePrefilterSetting prefilter_setting; HashListTable *dport_hash_table; DetectPort *tcp_whitelist; DetectPort *udp_whitelist; /** table for storing the string representation with the parsers result */ HashListTable *address_table; /** table with mpms and their registration function * \todo we only need this at init, so perhaps this * can move to a DetectEngineCtx 'init' struct */ DetectMpmAppLayerKeyword *app_mpms; } DetectEngineCtx; /* Engine groups profiles (low, medium, high, custom) */ enum { ENGINE_PROFILE_UNKNOWN, ENGINE_PROFILE_LOW, ENGINE_PROFILE_MEDIUM, ENGINE_PROFILE_HIGH, ENGINE_PROFILE_CUSTOM, ENGINE_PROFILE_MAX }; /* Siggroup mpm context profile */ enum { ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL, ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE, ENGINE_SGH_MPM_FACTORY_CONTEXT_AUTO }; typedef struct HttpReassembledBody_ { const uint8_t *buffer; uint32_t buffer_size; /**< size of the buffer itself */ uint32_t buffer_len; /**< data len in the buffer */ uint64_t offset; /**< data offset */ } HttpReassembledBody; typedef struct FiledataReassembledBody_ { const uint8_t *buffer; uint32_t buffer_size; /**< size of the buffer itself */ uint32_t buffer_len; /**< data len in the buffer */ uint64_t offset; /**< data offset */ } FiledataReassembledBody; #define DETECT_FILESTORE_MAX 15 typedef struct SignatureNonPrefilterStore_ { SigIntId id; SignatureMask mask; } SignatureNonPrefilterStore; /** * Detection engine thread data. */ typedef struct DetectEngineThreadCtx_ { /** \note multi-tenant hash lookup code from Detect() *depends* * on this beeing the first member */ uint32_t tenant_id; /* the thread to which this detection engine thread belongs */ ThreadVars *tv; SigIntId *non_pf_id_array; uint32_t non_pf_id_cnt; // size is cnt * sizeof(uint32_t) uint32_t mt_det_ctxs_cnt; struct DetectEngineThreadCtx_ **mt_det_ctxs; HashTable *mt_det_ctxs_hash; struct DetectEngineTenantMapping_ *tenant_array; uint32_t tenant_array_size; uint32_t (*TenantGetId)(const void *, const Packet *p); /* detection engine variables */ /** offset into the payload of the last match by: * content, pcre, etc */ uint32_t buffer_offset; /* used by pcre match function alone */ uint32_t pcre_match_start_offset; /* counter for the filestore array below -- up here for cache reasons. */ uint16_t filestore_cnt; HttpReassembledBody *hsbd; uint64_t hsbd_start_tx_id; uint16_t hsbd_buffers_size; uint16_t hsbd_buffers_list_len; HttpReassembledBody *hcbd; uint64_t hcbd_start_tx_id; uint16_t hcbd_buffers_size; uint16_t hcbd_buffers_list_len; uint8_t **hhd_buffers; uint32_t *hhd_buffers_len; uint16_t hhd_buffers_size; uint16_t hhd_buffers_list_len; uint64_t hhd_start_tx_id; FiledataReassembledBody *smtp; uint64_t smtp_start_tx_id; uint16_t smtp_buffers_size; uint16_t smtp_buffers_list_len; /** id for alert counter */ uint16_t counter_alerts; #ifdef PROFILING uint16_t counter_mpm_list; uint16_t counter_nonmpm_list; uint16_t counter_fnonmpm_list; uint16_t counter_match_list; #endif /* used to discontinue any more matching */ uint16_t discontinue_matching; uint16_t flags; /* bool: if tx_id is set, this is 1, otherwise 0 */ uint16_t tx_id_set; /** ID of the transaction currently being inspected. */ uint64_t tx_id; SC_ATOMIC_DECLARE(int, so_far_used_by_detect); /* holds the current recursion depth on content inspection */ int inspection_recursion_counter; /** array of signature pointers we're going to inspect in the detection * loop. */ Signature **match_array; /** size of the array in items (mem size if * sizeof(Signature *) * Only used during initialization. */ uint32_t match_array_len; /** size in use */ SigIntId match_array_cnt; /** Array of sigs that had a state change */ SigIntId de_state_sig_array_len; uint8_t *de_state_sig_array; const struct SigGroupHead_ *sgh; SignatureNonPrefilterStore *non_pf_store_ptr; uint32_t non_pf_store_cnt; /** pointer to the current mpm ctx that is stored * in a rule group head -- can be either a content * or uricontent ctx. */ MpmThreadCtx mtc; /**< thread ctx for the mpm */ MpmThreadCtx mtcu; /**< thread ctx for uricontent mpm */ MpmThreadCtx mtcs; /**< thread ctx for stream mpm */ PrefilterRuleStore pmq; StreamMsg *smsg; /** SPM thread context used for scanning. This has been cloned from the * prototype held by DetectEngineCtx. */ SpmThreadCtx *spm_thread_ctx; /** ip only rules ctx */ DetectEngineIPOnlyThreadCtx io_ctx; /* byte jump values */ uint64_t *bj_values; /* string to replace */ DetectReplaceList *replist; /* flowvars to store in post match function */ DetectFlowvarList *flowvarlist; /* Array in which the filestore keyword stores file id and tx id. If the * full signature matches, these are processed by a post-match filestore * function to finalize the store. */ struct { uint16_t file_id; uint64_t tx_id; } filestore[DETECT_FILESTORE_MAX]; DetectEngineCtx *de_ctx; /** store for keyword contexts that need a per thread storage because of * thread safety issues */ void **keyword_ctxs_array; int keyword_ctxs_size; uint8_t *base64_decoded; int base64_decoded_len; int base64_decoded_len_max; #ifdef PROFILING struct SCProfileData_ *rule_perf_data; int rule_perf_data_size; struct SCProfileKeywordData_ *keyword_perf_data; struct SCProfileKeywordData_ *keyword_perf_data_per_list[DETECT_SM_LIST_MAX]; int keyword_perf_list; /**< list we're currently inspecting, DETECT_SM_LIST_* */ struct SCProfileSghData_ *sgh_perf_data; #endif } DetectEngineThreadCtx; /** \brief element in sigmatch type table. * \note FileMatch pointer below takes a locked flow, AppLayerMatch an unlocked flow */ typedef struct SigTableElmt_ { /** Packet match function pointer */ int (*Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); /** AppLayer match function pointer */ int (*AppLayerMatch)(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, Signature *, SigMatch *); /** AppLayer TX match function pointer */ int (*AppLayerTxMatch)(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *); /** File match function pointer */ int (*FileMatch)(ThreadVars *, /**< thread local vars */ DetectEngineThreadCtx *, Flow *, /**< *LOCKED* flow */ uint8_t flags, File *, Signature *, SigMatch *); /** keyword setup function pointer */ int (*Setup)(DetectEngineCtx *, Signature *, char *); _Bool (*SupportsPrefilter)(const Signature *s); int (*SetupPrefilter)(struct SigGroupHead_ *sgh); void (*Free)(void *); void (*RegisterTests)(void); uint8_t flags; /** unused: warn user. Will be removed in the future. */ AppProto alproto __attribute__((deprecated)); char *name; /**< keyword name alias */ char *alias; /**< name alias */ char *desc; char *url; } SigTableElmt; #ifdef HAVE_MAGIC #define SIG_GROUP_HEAD_HAVEFILEMAGIC (1 << 20) #endif #define SIG_GROUP_HEAD_HAVEFILEMD5 (1 << 21) #define SIG_GROUP_HEAD_HAVEFILESIZE (1 << 22) #define SIG_GROUP_HEAD_HAVEFILESHA1 (1 << 23) #define SIG_GROUP_HEAD_HAVEFILESHA256 (1 << 24) enum MpmBuiltinBuffers { MPMB_TCP_PKT_TS, MPMB_TCP_PKT_TC, MPMB_TCP_STREAM_TS, MPMB_TCP_STREAM_TC, MPMB_UDP_TS, MPMB_UDP_TC, MPMB_OTHERIP, MPMB_MAX, }; typedef struct MpmStore_ { uint8_t *sid_array; uint32_t sid_array_size; int direction; enum MpmBuiltinBuffers buffer; int sm_list; int32_t sgh_mpm_context; MpmCtx *mpm_ctx; } MpmStore; typedef struct PrefilterEngineList_ { uint16_t id; /** App Proto this engine applies to: only used with Tx Engines */ AppProto alproto; /** Minimal Tx progress we need before running the engine. Only used * with Tx Engine */ int tx_min_progress; /** Context for matching. Might be MpmCtx for MPM engines, other ctx' * for other engines. */ void *pectx; void (*Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx); void (*PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags); struct PrefilterEngineList_ *next; /** Free function for pectx data. If NULL the memory is not freed. */ void (*Free)(void *pectx); const char *name; /* global id for this prefilter */ uint32_t gid; } PrefilterEngineList; typedef struct PrefilterEngine_ { uint16_t id; /** App Proto this engine applies to: only used with Tx Engines */ AppProto alproto; /** Minimal Tx progress we need before running the engine. Only used * with Tx Engine */ int tx_min_progress; /** Context for matching. Might be MpmCtx for MPM engines, other ctx' * for other engines. */ void *pectx; union { void (*Prefilter)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx); void (*PrefilterTx)(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *tx, const uint64_t idx, const uint8_t flags); } cb; /* global id for this prefilter */ uint32_t gid; int is_last; } PrefilterEngine; typedef struct SigGroupHeadInitData_ { MpmStore mpm_store[MPMB_MAX]; uint8_t *sig_array; /**< bit array of sig nums (internal id's) */ uint32_t sig_size; /**< size in bytes */ uint8_t protos[256]; /**< proto(s) this sgh is for */ uint32_t direction; /**< set to SIG_FLAG_TOSERVER, SIG_FLAG_TOCLIENT or both */ int whitelist; /**< try to make this group a unique one */ MpmCtx **app_mpms; PrefilterEngineList *pkt_engines; PrefilterEngineList *payload_engines; PrefilterEngineList *tx_engines; /* port ptr */ struct DetectPort_ *port; } SigGroupHeadInitData; /** \brief Container for matching data for a signature group */ typedef struct SigGroupHead_ { uint32_t flags; /* number of sigs in this head */ SigIntId sig_cnt; /* non prefilter list excluding SYN rules */ uint32_t non_pf_other_store_cnt; uint32_t non_pf_syn_store_cnt; SignatureNonPrefilterStore *non_pf_other_store_array; // size is non_mpm_store_cnt * sizeof(SignatureNonPrefilterStore) /* non mpm list including SYN rules */ SignatureNonPrefilterStore *non_pf_syn_store_array; // size is non_mpm_syn_store_cnt * sizeof(SignatureNonPrefilterStore) /** the number of signatures in this sgh that have the filestore keyword * set. */ uint16_t filestore_cnt; uint32_t id; /**< unique id used to index sgh_array for stats */ PrefilterEngine *pkt_engines; PrefilterEngine *payload_engines; PrefilterEngine *tx_engines; /** Array with sig ptrs... size is sig_cnt * sizeof(Signature *) */ Signature **match_array; /* ptr to our init data we only use at... init :) */ SigGroupHeadInitData *init; } SigGroupHead; /** sigmatch has no options, so the parser shouldn't expect any */ #define SIGMATCH_NOOPT (1 << 0) /** sigmatch is compatible with a ip only rule */ #define SIGMATCH_IPONLY_COMPAT (1 << 1) /** sigmatch is compatible with a decode event only rule */ #define SIGMATCH_DEONLY_COMPAT (1 << 2) /**< Flag to indicate that the signature inspects the packet payload */ #define SIGMATCH_PAYLOAD (1 << 3) /**< Flag to indicate that the signature is not built-in */ #define SIGMATCH_NOT_BUILT (1 << 4) /** sigmatch may have options, so the parser should be ready to * deal with both cases */ #define SIGMATCH_OPTIONAL_OPT (1 << 5) enum DetectEngineTenantSelectors { TENANT_SELECTOR_UNKNOWN = 0, /**< not set */ TENANT_SELECTOR_DIRECT, /**< method provides direct tenant id */ TENANT_SELECTOR_VLAN, /**< map vlan to tenant id */ }; typedef struct DetectEngineTenantMapping_ { uint32_t tenant_id; /* traffic id that maps to the tenant id */ uint32_t traffic_id; struct DetectEngineTenantMapping_ *next; } DetectEngineTenantMapping; typedef struct DetectEngineMasterCtx_ { SCMutex lock; /** enable multi tenant mode */ int multi_tenant_enabled; /** list of active detection engines. This list is used to generate the * threads det_ctx's */ DetectEngineCtx *list; /** free list, containing detection engines that will be removed but may * still be referenced by det_ctx's. Freed as soon as all references are * gone. */ DetectEngineCtx *free_list; enum DetectEngineTenantSelectors tenant_selector; /** list of tenant mappings. Updated under lock. Used to generate lookup * structures. */ DetectEngineTenantMapping *tenant_mapping_list; } DetectEngineMasterCtx; /** \brief Signature loader statistics */ typedef struct SigFileLoaderStat_ { int bad_files; int total_files; int good_sigs_total; int bad_sigs_total; } SigFileLoaderStat; /** Remember to add the options in SignatureIsIPOnly() at detect.c otherwise it wont be part of a signature group */ enum { DETECT_SID, DETECT_PRIORITY, DETECT_REV, DETECT_CLASSTYPE, /* sorted by prefilter priority. Higher in this list means it will be * picked over ones lower in the list */ DETECT_AL_APP_LAYER_PROTOCOL, DETECT_ACK, DETECT_SEQ, DETECT_WINDOW, DETECT_IPOPTS, DETECT_FLAGS, DETECT_FRAGBITS, DETECT_FRAGOFFSET, DETECT_TTL, DETECT_TOS, DETECT_ITYPE, DETECT_ICODE, DETECT_ICMP_ID, DETECT_ICMP_SEQ, DETECT_DSIZE, DETECT_FLOW, /* end prefilter sort */ DETECT_THRESHOLD, DETECT_METADATA, DETECT_REFERENCE, DETECT_TAG, DETECT_MSG, DETECT_CONTENT, DETECT_URICONTENT, DETECT_PCRE, DETECT_DEPTH, DETECT_DISTANCE, DETECT_WITHIN, DETECT_OFFSET, DETECT_REPLACE, DETECT_NOCASE, DETECT_FAST_PATTERN, DETECT_RAWBYTES, DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_SAMEIP, DETECT_GEOIP, DETECT_IPPROTO, DETECT_FTPBOUNCE, DETECT_ISDATAAT, DETECT_ID, DETECT_RPC, DETECT_FLOWVAR, DETECT_FLOWVAR_POSTMATCH, DETECT_FLOWINT, DETECT_PKTVAR, DETECT_NOALERT, DETECT_FLOWBITS, DETECT_HOSTBITS, DETECT_IPV4_CSUM, DETECT_TCPV4_CSUM, DETECT_TCPV6_CSUM, DETECT_UDPV4_CSUM, DETECT_UDPV6_CSUM, DETECT_ICMPV4_CSUM, DETECT_ICMPV6_CSUM, DETECT_STREAM_SIZE, DETECT_DETECTION_FILTER, DETECT_DECODE_EVENT, DETECT_GID, DETECT_MARK, DETECT_AL_TLS_VERSION, DETECT_AL_TLS_SUBJECT, DETECT_AL_TLS_ISSUERDN, DETECT_AL_TLS_NOTBEFORE, DETECT_AL_TLS_NOTAFTER, DETECT_AL_TLS_EXPIRED, DETECT_AL_TLS_VALID, DETECT_AL_TLS_FINGERPRINT, DETECT_AL_TLS_STORE, DETECT_AL_HTTP_COOKIE, DETECT_AL_HTTP_METHOD, DETECT_AL_URILEN, DETECT_AL_HTTP_CLIENT_BODY, DETECT_AL_HTTP_SERVER_BODY, DETECT_AL_HTTP_HEADER, DETECT_AL_HTTP_RAW_HEADER, DETECT_AL_HTTP_URI, DETECT_AL_HTTP_RAW_URI, DETECT_AL_HTTP_STAT_MSG, DETECT_AL_HTTP_STAT_CODE, DETECT_AL_HTTP_USER_AGENT, DETECT_AL_HTTP_HOST, DETECT_AL_HTTP_RAW_HOST, DETECT_AL_HTTP_REQUEST_LINE, DETECT_AL_HTTP_RESPONSE_LINE, DETECT_AL_SSH_PROTOVERSION, DETECT_AL_SSH_SOFTWAREVERSION, DETECT_AL_SSL_VERSION, DETECT_AL_SSL_STATE, DETECT_BYTE_EXTRACT, DETECT_FILE_DATA, DETECT_PKT_DATA, DETECT_AL_APP_LAYER_EVENT, DETECT_DCE_IFACE, DETECT_DCE_OPNUM, DETECT_DCE_STUB_DATA, DETECT_ASN1, DETECT_ENGINE_EVENT, DETECT_STREAM_EVENT, DETECT_FILENAME, DETECT_FILEEXT, DETECT_FILESTORE, DETECT_FILEMAGIC, DETECT_FILEMD5, DETECT_FILESHA1, DETECT_FILESHA256, DETECT_FILESIZE, DETECT_L3PROTO, DETECT_LUA, DETECT_IPREP, DETECT_AL_DNS_QUERY, DETECT_AL_TLS_SNI, DETECT_AL_TLS_CERT_ISSUER, DETECT_AL_TLS_CERT_SUBJECT, DETECT_AL_MODBUS, DETECT_CIPSERVICE, DETECT_ENIPCOMMAND, DETECT_AL_DNP3DATA, DETECT_AL_DNP3FUNC, DETECT_AL_DNP3IND, DETECT_AL_DNP3OBJ, DETECT_XBITS, DETECT_BASE64_DECODE, DETECT_BASE64_DATA, DETECT_TEMPLATE, DETECT_AL_TEMPLATE_BUFFER, DETECT_BYPASS, DETECT_PREFILTER, /* make sure this stays last */ DETECT_TBLSIZE, }; /* Table with all SigMatch registrations */ SigTableElmt sigmatch_table[DETECT_TBLSIZE]; /* detection api */ SigMatch *SigMatchAlloc(void); Signature *SigFindSignatureBySidGid(DetectEngineCtx *, uint32_t, uint32_t); void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *, Packet *, SignatureMask, uint16_t); void SigMatchFree(SigMatch *sm); void SigCleanSignatures(DetectEngineCtx *); void SigTableRegisterTests(void); void SigRegisterTests(void); void DetectSimdRegisterTests(void); void TmModuleDetectRegister (void); int SigGroupBuild(DetectEngineCtx *); int SigGroupCleanup (DetectEngineCtx *de_ctx); void SigAddressPrepareBidirectionals (DetectEngineCtx *); char *DetectLoadCompleteSigPath(const DetectEngineCtx *, char *sig_file); int SigLoadSignatures (DetectEngineCtx *, char *, int); void SigTableList(const char *keyword); void SigTableSetup(void); int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p); int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s); SigGroupHead *SigMatchSignaturesGetSgh(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p); Signature *DetectGetTagSignature(void); int SignatureIsFilestoring(Signature *); int SignatureIsFilemagicInspecting(Signature *); int SignatureIsFileMd5Inspecting(Signature *); int SignatureIsFileSha1Inspecting(Signature *s); int SignatureIsFileSha256Inspecting(Signature *s); int SignatureIsFilesizeInspecting(Signature *); int DetectRegisterThreadCtxFuncs(DetectEngineCtx *, const char *name, void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *), int); void *DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *, int); int SigMatchSignaturesRunPostMatch(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s); void DetectSignatureApplyActions(Packet *p, const Signature *s); #endif /* __DETECT_H__ */ suricata-3.2.1/src/detect-filemd5.h0000644000000000000000000000164213051004444013750 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FILEMD5_H__ #define __DETECT_FILEMD5_H__ /* prototypes */ void DetectFileMd5Register (void); #endif /* __DETECT_FILEMD5_H__ */ suricata-3.2.1/src/util-debug.c0000644000000000000000000015722213051004444013217 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Debug utility functions */ #include "suricata-common.h" #include "threads.h" #include "util-debug.h" #include "util-error.h" #include "util-enum.h" #include "util-debug-filters.h" #include "decode.h" #include "detect.h" #include "packet-queue.h" #include "threadvars.h" #include "output.h" #include "tm-queuehandlers.h" #include "tm-queues.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-syslog.h" #include "conf.h" /* holds the string-enum mapping for the enums held in the table SCLogLevel */ SCEnumCharMap sc_log_level_map[ ] = { { "Not set", SC_LOG_NOTSET}, { "None", SC_LOG_NONE }, { "Emergency", SC_LOG_EMERGENCY }, { "Alert", SC_LOG_ALERT }, { "Critical", SC_LOG_CRITICAL }, { "Error", SC_LOG_ERROR }, { "Warning", SC_LOG_WARNING }, { "Notice", SC_LOG_NOTICE }, { "Info", SC_LOG_INFO }, { "Perf", SC_LOG_PERF }, { "Config", SC_LOG_CONFIG }, { "Debug", SC_LOG_DEBUG }, { NULL, -1 } }; /* holds the string-enum mapping for the enums held in the table SCLogOPIface */ SCEnumCharMap sc_log_op_iface_map[ ] = { { "Console", SC_LOG_OP_IFACE_CONSOLE }, { "File", SC_LOG_OP_IFACE_FILE }, { "Syslog", SC_LOG_OP_IFACE_SYSLOG }, { NULL, -1 } }; #if defined (OS_WIN32) /** * \brief Used for synchronous output on WIN32 */ static SCMutex sc_log_stream_lock = NULL; #endif /* OS_WIN32 */ /** * \brief Holds the config state for the logging module */ static SCLogConfig *sc_log_config = NULL; /** * \brief Returns the full path given a file and configured log dir */ static char *SCLogGetLogFilename(char *); /** * \brief Holds the global log level. Is the same as sc_log_config->log_level */ SCLogLevel sc_log_global_log_level; /** * \brief Used to indicate whether the logging module has been init or not */ int sc_log_module_initialized = 0; /** * \brief Used to indicate whether the logging module has been cleaned or not */ int sc_log_module_cleaned = 0; /** * \brief Maps the SC logging level to the syslog logging level * * \param The SC logging level that has to be mapped to the syslog_log_level * * \retval syslog_log_level The mapped syslog_api_log_level, for the logging * module api's internal log_level */ static inline int SCLogMapLogLevelToSyslogLevel(int log_level) { int syslog_log_level = 0; switch (log_level) { case SC_LOG_EMERGENCY: syslog_log_level = LOG_EMERG; break; case SC_LOG_ALERT: syslog_log_level = LOG_ALERT; break; case SC_LOG_CRITICAL: syslog_log_level = LOG_CRIT; break; case SC_LOG_ERROR: syslog_log_level = LOG_ERR; break; case SC_LOG_WARNING: syslog_log_level = LOG_WARNING; break; case SC_LOG_NOTICE: syslog_log_level = LOG_NOTICE; break; case SC_LOG_INFO: syslog_log_level = LOG_INFO; break; case SC_LOG_DEBUG: syslog_log_level = LOG_DEBUG; break; default: syslog_log_level = LOG_EMERG; break; } return syslog_log_level; } /** * \brief Output function that logs a character string out to a file descriptor * * \param fd Pointer to the file descriptor * \param msg Pointer to the character string that should be logged */ static inline void SCLogPrintToStream(FILE *fd, char *msg) { /* Would only happen if the log file failed to re-open during rotation. */ if (fd == NULL) { return; } #if defined (OS_WIN32) SCMutexLock(&sc_log_stream_lock); #endif /* OS_WIN32 */ if (fprintf(fd, "%s\n", msg) < 0) printf("Error writing to stream using fprintf\n"); fflush(fd); #if defined (OS_WIN32) SCMutexUnlock(&sc_log_stream_lock); #endif /* OS_WIN32 */ return; } /** * \brief Output function that logs a character string throught the syslog iface * * \param syslog_log_level Holds the syslog_log_level that the message should be * logged as * \param msg Pointer to the char string, that should be logged * * \todo syslog is thread-safe according to POSIX manual and glibc code, but we * we will have to look into non POSIX compliant boxes like freeBSD */ static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg) { //static struct syslog_data data = SYSLOG_DATA_INIT; //syslog_r(syslog_log_level, NULL, "%s", msg); syslog(syslog_log_level, "%s", msg); return; } #ifdef HAVE_LIBJANSSON #include /** */ int SCLogMessageJSON(struct timeval *tval, char *buffer, size_t buffer_size, SCLogLevel log_level, const char *file, unsigned line, const char *function, SCError error_code, const char *message) { json_t *js = json_object(); if (unlikely(js == NULL)) goto error; json_t *ejs = json_object(); if (unlikely(ejs == NULL)) goto error; char timebuf[64]; CreateIsoTimeString(tval, timebuf, sizeof(timebuf)); json_object_set_new(js, "timestamp", json_string(timebuf)); json_object_set_new(js, "event_type", json_string("engine")); if (error_code > 0) { json_object_set_new(ejs, "error_code", json_integer(error_code)); json_object_set_new(ejs, "error", json_string(SCErrorToString(error_code))); } if (message) json_object_set_new(ejs, "message", json_string(message)); if (log_level >= SC_LOG_DEBUG) { if (function) json_object_set_new(ejs, "function", json_string(function)); if (file) json_object_set_new(ejs, "file", json_string(file)); if (line > 0) json_object_set_new(ejs, "line", json_integer(line)); } json_object_set_new(js, "engine", ejs); char *js_s = json_dumps(js, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); snprintf(buffer, buffer_size, "%s", js_s); free(js_s); json_object_del(js, "engine"); json_object_clear(js); json_decref(js); return 0; error: return -1; } #endif /* HAVE_LIBJANSSON */ /** * \brief Adds the global log_format to the outgoing buffer * * \param log_level log_level of the message that has to be logged * \param msg Buffer containing the outgoing message * \param file File_name from where the message originated * \param function Function_name from where the message originated * \param line Line_no from where the messaged originated * * \retval SC_OK on success; else an error code */ static SCError SCLogMessageGetBuffer( struct timeval *tval, int color, SCLogOPType type, char *buffer, size_t buffer_size, const char *log_format, const SCLogLevel log_level, const char *file, const unsigned int line, const char *function, const SCError error_code, const char *message) { #ifdef HAVE_LIBJANSSON if (type == SC_LOG_OP_TYPE_JSON) return SCLogMessageJSON(tval, buffer, buffer_size, log_level, file, line, function, error_code, message); #endif char *temp = buffer; const char *s = NULL; struct tm *tms = NULL; char *redb = ""; char *red = ""; char *yellowb = ""; char *yellow = ""; char *green = ""; char *blue = ""; char *reset = ""; if (color) { redb = "\x1b[1;31m"; red = "\x1b[31m"; yellowb = "\x1b[1;33m"; yellow = "\x1b[33m"; green = "\x1b[32m"; blue = "\x1b[34m"; reset = "\x1b[0m"; } /* no of characters_written(cw) by snprintf */ int cw = 0; BUG_ON(sc_log_module_initialized != 1); /* make a copy of the format string as it will be modified below */ char local_format[strlen(log_format) + 1]; strlcpy(local_format, log_format, sizeof(local_format)); char *temp_fmt = local_format; char *substr = temp_fmt; while ( (temp_fmt = index(temp_fmt, SC_LOG_FMT_PREFIX)) ) { if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) { return SC_OK; } switch(temp_fmt[1]) { case SC_LOG_FMT_TIME: temp_fmt[0] = '\0'; struct tm local_tm; tms = SCLocalTime(tval->tv_sec, &local_tm); cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%d/%d/%04d -- %02d:%02d:%02d%s", substr, green, tms->tm_mday, tms->tm_mon + 1, tms->tm_year + 1900, tms->tm_hour, tms->tm_min, tms->tm_sec, reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_PID: temp_fmt[0] = '\0'; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%u%s", substr, yellow, getpid(), reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_TID: temp_fmt[0] = '\0'; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%lu%s", substr, yellow, SCGetThreadIdLong(), reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_TM: temp_fmt[0] = '\0'; /* disabled to prevent dead lock: * log or alloc (which calls log on error) can call TmThreadsGetCallingThread * which will lock tv_root_lock. This can happen while we already hold this * lock. */ #if 0 ThreadVars *tv = TmThreadsGetCallingThread(); cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - *msg), "%s%s", substr, ((tv != NULL)? tv->name: "UNKNOWN TM")); #endif cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s", substr, "N/A"); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_LOG_LEVEL: temp_fmt[0] = '\0'; s = SCMapEnumValueToName(log_level, sc_log_level_map); if (s != NULL) { if (log_level <= SC_LOG_ERROR) cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, redb, s, reset); else if (log_level == SC_LOG_WARNING) cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, red, s, reset); else if (log_level == SC_LOG_NOTICE) cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, yellowb, s, reset); else cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, yellow, s, reset); } else { cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s", substr, "INVALID"); } if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_FILE_NAME: temp_fmt[0] = '\0'; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, blue, file, reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_LINE: temp_fmt[0] = '\0'; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%u%s", substr, green, line, reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; case SC_LOG_FMT_FUNCTION: temp_fmt[0] = '\0'; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr, green, function, reset); if (cw < 0) return SC_ERR_SPRINTF; temp += cw; temp_fmt++; substr = temp_fmt; substr++; break; } temp_fmt++; } if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) { return SC_OK; } cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s", substr); if (cw < 0) { return SC_ERR_SPRINTF; } temp += cw; if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) { return SC_OK; } if (error_code != SC_OK) { cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "[%sERRCODE%s: %s%s%s(%s%d%s)] - ", yellow, reset, red, SCErrorToString(error_code), reset, yellow, error_code, reset); if (cw < 0) { return SC_ERR_SPRINTF; } temp += cw; if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) { return SC_OK; } } char *hi = ""; if (error_code > SC_OK) hi = red; else if (log_level <= SC_LOG_NOTICE) hi = yellow; cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s", hi, message, reset); if (cw < 0) { return SC_ERR_SPRINTF; } temp += cw; if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) { return SC_OK; } if (sc_log_config->op_filter_regex != NULL) { #define MAX_SUBSTRINGS 30 int ov[MAX_SUBSTRINGS]; if (pcre_exec(sc_log_config->op_filter_regex, sc_log_config->op_filter_regex_study, buffer, strlen(buffer), 0, 0, ov, MAX_SUBSTRINGS) < 0) { return SC_ERR_LOG_FG_FILTER_MATCH; // bit hacky, but just return !0 } #undef MAX_SUBSTRINGS } return SC_OK; } static void SCLogReopen(SCLogOPIfaceCtx *op_iface_ctx) { if (op_iface_ctx->file_d == NULL) { return; } if (op_iface_ctx->file == NULL) { return; } fclose(op_iface_ctx->file_d); op_iface_ctx->file_d = fopen(op_iface_ctx->file, "a"); if (op_iface_ctx->file_d == NULL) { SCLogError(SC_ERR_FOPEN, "Erroring re-opening file \"%s\": %s", op_iface_ctx->file, strerror(errno)); } } /** * \brief Adds the global log_format to the outgoing buffer * * \param log_level log_level of the message that has to be logged * \param msg Buffer containing the outgoing message * \param file File_name from where the message originated * \param function Function_name from where the message originated * \param line Line_no from where the messaged originated * * \retval SC_OK on success; else an error code */ SCError SCLogMessage(const SCLogLevel log_level, const char *file, const unsigned int line, const char *function, const SCError error_code, const char *message) { char buffer[SC_LOG_MAX_LOG_MSG_LEN] = ""; SCLogOPIfaceCtx *op_iface_ctx = NULL; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return SC_OK; } /* get ts here so we log the same ts to each output */ struct timeval tval; gettimeofday(&tval, NULL); op_iface_ctx = sc_log_config->op_ifaces; while (op_iface_ctx != NULL) { if (log_level != SC_LOG_NOTSET && log_level > op_iface_ctx->log_level) { op_iface_ctx = op_iface_ctx->next; continue; } switch (op_iface_ctx->iface) { case SC_LOG_OP_IFACE_CONSOLE: if (SCLogMessageGetBuffer(&tval, op_iface_ctx->use_color, op_iface_ctx->type, buffer, sizeof(buffer), op_iface_ctx->log_format ? op_iface_ctx->log_format : sc_log_config->log_format, log_level, file, line, function, error_code, message) == 0) { SCLogPrintToStream((log_level == SC_LOG_ERROR)? stderr: stdout, buffer); } break; case SC_LOG_OP_IFACE_FILE: if (SCLogMessageGetBuffer(&tval, 0, op_iface_ctx->type, buffer, sizeof(buffer), op_iface_ctx->log_format ? op_iface_ctx->log_format : sc_log_config->log_format, log_level, file, line, function, error_code, message) == 0) { if (op_iface_ctx->rotation_flag) { SCLogReopen(op_iface_ctx); op_iface_ctx->rotation_flag = 0; } SCLogPrintToStream(op_iface_ctx->file_d, buffer); } break; case SC_LOG_OP_IFACE_SYSLOG: if (SCLogMessageGetBuffer(&tval, 0, op_iface_ctx->type, buffer, sizeof(buffer), op_iface_ctx->log_format ? op_iface_ctx->log_format : sc_log_config->log_format, log_level, file, line, function, error_code, message) == 0) { SCLogPrintToSyslog(SCLogMapLogLevelToSyslogLevel(log_level), buffer); } break; default: break; } op_iface_ctx = op_iface_ctx->next; } return SC_OK; } /** * \brief Returns whether debug messages are enabled to be logged or not * * \retval 1 if debug messages are enabled to be logged * \retval 0 if debug messages are not enabled to be logged */ int SCLogDebugEnabled(void) { #ifdef DEBUG if (sc_log_global_log_level == SC_LOG_DEBUG) return 1; else return 0; #else return 0; #endif } /** * \brief Allocates an output buffer for an output interface. Used when we * want the op_interface log_format to override the global_log_format. * Currently not used. * * \retval buffer Pointer to the newly created output_buffer */ SCLogOPBuffer *SCLogAllocLogOPBuffer(void) { SCLogOPBuffer *buffer = NULL; SCLogOPIfaceCtx *op_iface_ctx = NULL; int i = 0; if ( (buffer = SCMalloc(sc_log_config->op_ifaces_cnt * sizeof(SCLogOPBuffer))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAllocLogOPBuffer. Exiting..."); exit(EXIT_FAILURE); } op_iface_ctx = sc_log_config->op_ifaces; for (i = 0; i < sc_log_config->op_ifaces_cnt; i++, op_iface_ctx = op_iface_ctx->next) { buffer[i].log_format = op_iface_ctx->log_format; buffer[i].temp = buffer[i].msg; } return buffer; } /*----------------------The logging module initialization code--------------- */ /** * \brief Returns a new output_interface_context * * \retval iface_ctx Pointer to a newly allocated output_interface_context * \initonly */ static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx() { SCLogOPIfaceCtx *iface_ctx = NULL; if ( (iface_ctx = SCMalloc(sizeof(SCLogOPIfaceCtx))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogallocLogOPIfaceCtx. Exiting..."); exit(EXIT_FAILURE); } memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx)); return iface_ctx; } /** * \brief Initializes the file output interface * * \param file Path to the file used for logging purposes * \param log_format Pointer to the log_format for this op interface, that * overrides the global_log_format * \param log_level Override of the global_log_level by this interface * * \retval iface_ctx Pointer to the file output interface context created * \initonly */ static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file, const char *log_format, int log_level, SCLogOPType type) { SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); if (iface_ctx == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogInitFileOPIface. Exiting..."); exit(EXIT_FAILURE); } if (file == NULL || log_format == NULL) { goto error; } iface_ctx->iface = SC_LOG_OP_IFACE_FILE; iface_ctx->type = type; if ( (iface_ctx->file_d = fopen(file, "a")) == NULL) { printf("Error opening file %s\n", file); goto error; } if ((iface_ctx->file = SCStrdup(file)) == NULL) { goto error; } if ((iface_ctx->log_format = SCStrdup(log_format)) == NULL) { goto error; } OutputRegisterFileRotationFlag(&iface_ctx->rotation_flag); iface_ctx->log_level = log_level; return iface_ctx; error: if (iface_ctx->file != NULL) { SCFree((char *)iface_ctx->file); iface_ctx->file = NULL; } if (iface_ctx->log_format != NULL) { SCFree((char *)iface_ctx->log_format); iface_ctx->log_format = NULL; } if (iface_ctx->file_d != NULL) { fclose(iface_ctx->file_d); iface_ctx->file_d = NULL; } SCFree(iface_ctx); return NULL; } /** * \brief Initializes the console output interface and deals with possible * env var overrides. * * \param log_format Pointer to the log_format for this op interface, that * overrides the global_log_format * \param log_level Override of the global_log_level by this interface * * \retval iface_ctx Pointer to the console output interface context created * \initonly */ static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format, SCLogLevel log_level, SCLogOPType type) { SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); if (iface_ctx == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogInitConsoleOPIface. Exiting..."); exit(EXIT_FAILURE); } iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE; iface_ctx->type = type; /* console log format is overridden by envvars */ const char *tmp_log_format = log_format; const char *s = getenv(SC_LOG_ENV_LOG_FORMAT); if (s != NULL) { #if 0 printf("Overriding setting for \"console.format\" because of env " "var SC_LOG_FORMAT=\"%s\".\n", s); #endif tmp_log_format = s; } if (tmp_log_format != NULL && (iface_ctx->log_format = SCStrdup(tmp_log_format)) == NULL) { printf("Error allocating memory\n"); exit(EXIT_FAILURE); } /* console log level is overridden by envvars */ SCLogLevel tmp_log_level = log_level; s = getenv(SC_LOG_ENV_LOG_LEVEL); if (s != NULL) { SCLogLevel l = SCMapEnumNameToValue(s, sc_log_level_map); if (l > SC_LOG_NOTSET && l < SC_LOG_LEVEL_MAX) { #if 0 printf("Overriding setting for \"console.level\" because of env " "var SC_LOG_LEVEL=\"%s\".\n", s); #endif tmp_log_level = l; } } iface_ctx->log_level = tmp_log_level; if (isatty(fileno(stdout)) && isatty(fileno(stderr))) { iface_ctx->use_color = TRUE; } return iface_ctx; } /** * \brief Initializes the syslog output interface * * \param facility The facility code for syslog * \param log_format Pointer to the log_format for this op interface, that * overrides the global_log_format * \param log_level Override of the global_log_level by this interface * * \retval iface_ctx Pointer to the syslog output interface context created */ static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility, const char *log_format, SCLogLevel log_level, SCLogOPType type) { SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx(); if ( iface_ctx == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogInitSyslogOPIface. Exiting..."); exit(EXIT_FAILURE); } iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG; iface_ctx->type = type; if (facility == -1) facility = SC_LOG_DEF_SYSLOG_FACILITY; iface_ctx->facility = facility; if (log_format != NULL && (iface_ctx->log_format = SCStrdup(log_format)) == NULL) { printf("Error allocating memory\n"); exit(EXIT_FAILURE); } iface_ctx->log_level = log_level; openlog(NULL, LOG_NDELAY, iface_ctx->facility); return iface_ctx; } /** * \brief Frees the output_interface context supplied as an argument * * \param iface_ctx Pointer to the op_interface_context to be freed */ static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx) { SCLogOPIfaceCtx *temp = NULL; while (iface_ctx != NULL) { temp = iface_ctx; if (iface_ctx->file_d != NULL) fclose(iface_ctx->file_d); if (iface_ctx->file != NULL) SCFree((void *)iface_ctx->file); if (iface_ctx->log_format != NULL) SCFree((void *)iface_ctx->log_format); if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) { closelog(); } iface_ctx = iface_ctx->next; SCFree(temp); } return; } /** * \brief Internal function used to set the logging module global_log_level * during the initialization phase * * \param sc_lid The initialization data supplied. * \param sc_lc The logging module context which has to be updated. */ static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc) { SCLogLevel log_level = SC_LOG_NOTSET; const char *s = NULL; /* envvar overrides config */ s = getenv(SC_LOG_ENV_LOG_LEVEL); if (s != NULL) { log_level = SCMapEnumNameToValue(s, sc_log_level_map); } else if (sc_lid != NULL) { log_level = sc_lid->global_log_level; } /* deal with the global_log_level to be used */ if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX) sc_lc->log_level = log_level; else { sc_lc->log_level = SC_LOG_DEF_LOG_LEVEL; #ifndef UNITTESTS if (sc_lid != NULL) { printf("Warning: Invalid/No global_log_level assigned by user. Falling " "back on the default_log_level \"%s\"\n", SCMapEnumValueToName(sc_lc->log_level, sc_log_level_map)); } #endif } /* we also set it to a global var, as it is easier to access it */ sc_log_global_log_level = sc_lc->log_level; return; } /** * \brief Internal function used to set the logging module global_log_format * during the initialization phase * * \param sc_lid The initialization data supplied. * \param sc_lc The logging module context which has to be updated. */ static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc) { char *format = NULL; /* envvar overrides config */ format = getenv(SC_LOG_ENV_LOG_FORMAT); if (format == NULL) { if (sc_lid != NULL) { format = sc_lid->global_log_format; } } /* deal with the global log format to be used */ if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) { format = SC_LOG_DEF_LOG_FORMAT; #ifndef UNITTESTS if (sc_lid != NULL) { printf("Warning: Invalid/No global_log_format supplied by user or format " "length exceeded limit of \"%d\" characters. Falling back on " "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN, format); } #endif } if (format != NULL && (sc_lc->log_format = SCStrdup(format)) == NULL) { printf("Error allocating memory\n"); exit(EXIT_FAILURE); } return; } /** * \brief Internal function used to set the logging module global_op_ifaces * during the initialization phase * * \param sc_lid The initialization data supplied. * \param sc_lc The logging module context which has to be updated. */ static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc) { SCLogOPIfaceCtx *op_ifaces_ctx = NULL; int op_iface = 0; const char *s = NULL; if (sc_lid != NULL && sc_lid->op_ifaces != NULL) { sc_lc->op_ifaces = sc_lid->op_ifaces; sc_lid->op_ifaces = NULL; sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt; } else { s = getenv(SC_LOG_ENV_LOG_OP_IFACE); if (s != NULL) { op_iface = SCMapEnumNameToValue(s, sc_log_op_iface_map); if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) { op_iface = SC_LOG_DEF_LOG_OP_IFACE; #ifndef UNITTESTS printf("Warning: Invalid output interface supplied by user. " "Falling back on default_output_interface \"%s\"\n", SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); #endif } } else { op_iface = SC_LOG_DEF_LOG_OP_IFACE; #ifndef UNITTESTS if (sc_lid != NULL) { printf("Warning: Output_interface not supplied by user. Falling " "back on default_output_interface \"%s\"\n", SCMapEnumValueToName(op_iface, sc_log_op_iface_map)); } #endif } switch (op_iface) { case SC_LOG_OP_IFACE_CONSOLE: op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX,0); break; case SC_LOG_OP_IFACE_FILE: s = getenv(SC_LOG_ENV_LOG_FILE); if (s == NULL) { char *str = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE); if (str != NULL) { op_ifaces_ctx = SCLogInitFileOPIface(str, NULL, SC_LOG_LEVEL_MAX,0); SCFree(str); } } else { op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX,0); } break; case SC_LOG_OP_IFACE_SYSLOG: s = getenv(SC_LOG_ENV_LOG_FACILITY); if (s == NULL) s = SC_LOG_DEF_SYSLOG_FACILITY_STR; op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, SCSyslogGetFacilityMap()), NULL, -1,0); break; } sc_lc->op_ifaces = op_ifaces_ctx; sc_lc->op_ifaces_cnt++; } return; } /** * \brief Internal function used to set the logging module op_filter * during the initialization phase * * \param sc_lid The initialization data supplied. * \param sc_lc The logging module context which has to be updated. */ static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc) { const char *filter = NULL; int opts = 0; const char *ep; int eo = 0; /* envvar overrides */ filter = getenv(SC_LOG_ENV_LOG_OP_FILTER); if (filter == NULL) { if (sc_lid != NULL) { filter = sc_lid->op_filter; } } if (filter != NULL && strcmp(filter, "") != 0) { sc_lc->op_filter = SCStrdup(filter); if (sc_lc->op_filter == NULL) { printf("pcre filter alloc failed\n"); return; } sc_lc->op_filter_regex = pcre_compile(filter, opts, &ep, &eo, NULL); if (sc_lc->op_filter_regex == NULL) { SCFree(sc_lc->op_filter); printf("pcre compile of \"%s\" failed at offset %d : %s\n", filter, eo, ep); return; } sc_lc->op_filter_regex_study = pcre_study(sc_lc->op_filter_regex, 0, &ep); if (ep != NULL) { printf("pcre study failed: %s\n", ep); return; } } return; } /** * \brief Returns a pointer to a new SCLogInitData. This is a public interface * intended to be used after the logging paramters are read from the * conf file * * \retval sc_lid Pointer to the newly created SCLogInitData * \initonly */ SCLogInitData *SCLogAllocLogInitData(void) { SCLogInitData *sc_lid = NULL; /* not using SCMalloc here because if it fails we can't log */ if ( (sc_lid = SCMalloc(sizeof(SCLogInitData))) == NULL) return NULL; memset(sc_lid, 0, sizeof(SCLogInitData)); return sc_lid; } /** * \brief Frees a SCLogInitData * * \param sc_lid Pointer to the SCLogInitData to be freed */ void SCLogFreeLogInitData(SCLogInitData *sc_lid) { if (sc_lid != NULL) { if (sc_lid->startup_message != NULL) SCFree(sc_lid->startup_message); if (sc_lid->global_log_format != NULL) SCFree(sc_lid->global_log_format); if (sc_lid->op_filter != NULL) SCFree(sc_lid->op_filter); SCLogFreeLogOPIfaceCtx(sc_lid->op_ifaces); } return; } /** * \brief Frees the logging module context */ static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc) { if (sc_lc != NULL) { if (sc_lc->startup_message != NULL) SCFree(sc_lc->startup_message); if (sc_lc->log_format != NULL) SCFree(sc_lc->log_format); if (sc_lc->op_filter != NULL) SCFree(sc_lc->op_filter); SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces); SCFree(sc_lc); } return; } /** * \brief Appends an output_interface to the output_interface list sent in head * * \param iface_ctx Pointer to the output_interface that has to be added to head * \param head Pointer to the output_interface list */ void SCLogAppendOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx, SCLogInitData *sc_lid) { SCLogOPIfaceCtx *temp = NULL, *prev = NULL; SCLogOPIfaceCtx **head = &sc_lid->op_ifaces; if (iface_ctx == NULL) { #ifdef DEBUG printf("Argument(s) to SCLogAppendOPIfaceCtx() NULL\n"); #endif return; } temp = *head; while (temp != NULL) { prev = temp; temp = temp->next; } if (prev == NULL) *head = iface_ctx; else prev->next = iface_ctx; sc_lid->op_ifaces_cnt++; return; } /** * \brief Creates a new output interface based on the arguments sent. The kind * of output interface to be created is decided by the iface_name arg. * If iface_name is "file", the arg argument will hold the filename to be * used for logging purposes. If iface_name is "syslog", the arg * argument holds the facility code. If iface_name is "console", arg is * NULL. * * \param iface_name Interface name. Can be "console", "file" or "syslog" * \param log_format Override for the global_log_format * \param log_level Override for the global_log_level * \param log_level Parameter required by a particular interface. Explained in * the function description * * \retval iface_ctx Pointer to the newly created output interface */ SCLogOPIfaceCtx *SCLogInitOPIfaceCtx(const char *iface_name, const char *log_format, int log_level, const char *arg) { int iface = SCMapEnumNameToValue(iface_name, sc_log_op_iface_map); if (log_level < SC_LOG_NONE || log_level > SC_LOG_DEBUG) { #ifndef UNITTESTS printf("Warning: Supplied log_level_override for op_interface \"%s\" " "is invalid. Defaulting to not specifying an override\n", iface_name); #endif log_level = SC_LOG_NOTSET; } switch (iface) { case SC_LOG_OP_IFACE_CONSOLE: return SCLogInitConsoleOPIface(log_format, log_level, SC_LOG_OP_TYPE_REGULAR); case SC_LOG_OP_IFACE_FILE: return SCLogInitFileOPIface(arg, log_format, log_level, SC_LOG_OP_TYPE_REGULAR); case SC_LOG_OP_IFACE_SYSLOG: return SCLogInitSyslogOPIface(SCMapEnumNameToValue(arg, SCSyslogGetFacilityMap()), log_format, log_level, SC_LOG_OP_TYPE_REGULAR); default: #ifdef DEBUG printf("Output Interface \"%s\" not supported by the logging module", iface_name); #endif return NULL; } } /** * \brief Initializes the logging module. * * \param sc_lid The initialization data for the logging module. If sc_lid is * NULL, we would stick to the default configuration for the * logging subsystem. * \initonly */ void SCLogInitLogModule(SCLogInitData *sc_lid) { /* De-initialize the logging context, if it has already init by the * environment variables at the start of the engine */ SCLogDeInitLogModule(); #if defined (OS_WIN32) if (SCMutexInit(&sc_log_stream_lock, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Failed to initialize log mutex."); exit(EXIT_FAILURE); } #endif /* OS_WIN32 */ /* sc_log_config is a global variable */ if ( (sc_log_config = SCMalloc(sizeof(SCLogConfig))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogInitLogModule. Exiting..."); exit(EXIT_FAILURE); } memset(sc_log_config, 0, sizeof(SCLogConfig)); SCLogSetLogLevel(sc_lid, sc_log_config); SCLogSetLogFormat(sc_lid, sc_log_config); SCLogSetOPIface(sc_lid, sc_log_config); SCLogSetOPFilter(sc_lid, sc_log_config); sc_log_module_initialized = 1; sc_log_module_cleaned = 0; //SCOutputPrint(sc_did->startup_message); return; } void SCLogLoadConfig(int daemon, int verbose) { ConfNode *outputs; SCLogInitData *sc_lid; int have_logging = 0; outputs = ConfGetNode("logging.outputs"); if (outputs == NULL) { SCLogDebug("No logging.output configuration section found."); return; } sc_lid = SCLogAllocLogInitData(); if (sc_lid == NULL) { SCLogDebug("Could not allocate memory for log init data"); return; } /* Get default log level and format. */ char *default_log_level_s = NULL; if (ConfGet("logging.default-log-level", &default_log_level_s) == 1) { sc_lid->global_log_level = SCMapEnumNameToValue(default_log_level_s, sc_log_level_map); if (sc_lid->global_log_level == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid default log level: %s", default_log_level_s); exit(EXIT_FAILURE); } } else { SCLogWarning(SC_ERR_MISSING_CONFIG_PARAM, "No default log level set, will use notice."); sc_lid->global_log_level = SC_LOG_NOTICE; } if (verbose) { sc_lid->global_log_level += verbose; if (sc_lid->global_log_level > SC_LOG_LEVEL_MAX) sc_lid->global_log_level = SC_LOG_LEVEL_MAX; } if (ConfGet("logging.default-log-format", &sc_lid->global_log_format) != 1) sc_lid->global_log_format = SC_LOG_DEF_LOG_FORMAT; ConfGet("logging.default-output-filter", &sc_lid->op_filter); ConfNode *seq_node, *output; TAILQ_FOREACH(seq_node, &outputs->head, next) { SCLogLevel level = sc_lid->global_log_level; SCLogOPIfaceCtx *op_iface_ctx = NULL; const char *format; const char *level_s; output = ConfNodeLookupChild(seq_node, seq_node->val); if (output == NULL) continue; /* By default an output is enabled. */ const char *enabled = ConfNodeLookupChildValue(output, "enabled"); if (enabled != NULL && ConfValIsFalse(enabled)) continue; SCLogOPType type = SC_LOG_OP_TYPE_REGULAR; const char *type_s = ConfNodeLookupChildValue(output, "type"); if (type_s != NULL) { if (strcmp(type_s, "regular") == 0) type = SC_LOG_OP_TYPE_REGULAR; else if (strcmp(type_s, "json") == 0) { #ifdef HAVE_LIBJANSSON type = SC_LOG_OP_TYPE_JSON; #else SCLogError(SC_ERR_INVALID_ARGUMENT, "libjansson support not " "compiled in, can't use 'json' logging"); exit(EXIT_FAILURE); #endif /* HAVE_LIBJANSSON */ } } /* if available use the log format setting for this output, * otherwise fall back to the global setting. */ format = ConfNodeLookupChildValue(output, "format"); if (format == NULL) format = sc_lid->global_log_format; level_s = ConfNodeLookupChildValue(output, "level"); if (level_s != NULL) { level = SCMapEnumNameToValue(level_s, sc_log_level_map); if (level == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid log level: %s", level_s); exit(EXIT_FAILURE); } } if (strcmp(output->name, "console") == 0) { op_iface_ctx = SCLogInitConsoleOPIface(format, level, type); } else if (strcmp(output->name, "file") == 0) { const char *filename = ConfNodeLookupChildValue(output, "filename"); if (filename == NULL) { SCLogError(SC_ERR_MISSING_CONFIG_PARAM, "Logging to file requires a filename"); exit(EXIT_FAILURE); } have_logging = 1; op_iface_ctx = SCLogInitFileOPIface(filename, format, level, type); } else if (strcmp(output->name, "syslog") == 0) { int facility = SC_LOG_DEF_SYSLOG_FACILITY; const char *facility_s = ConfNodeLookupChildValue(output, "facility"); if (facility_s != NULL) { facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap()); if (facility == -1) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog " "facility: \"%s\", now using \"%s\" as syslog " "facility", facility_s, SC_LOG_DEF_SYSLOG_FACILITY_STR); facility = SC_LOG_DEF_SYSLOG_FACILITY; } } printf("Initialization syslog logging with format \"%s\".\n", format); have_logging = 1; op_iface_ctx = SCLogInitSyslogOPIface(facility, format, level, type); } else { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid logging method: %s, " "ignoring", output->name); } if (op_iface_ctx != NULL) { SCLogAppendOPIfaceCtx(op_iface_ctx, sc_lid); } } if (daemon && (have_logging == 0)) { SCLogError(SC_ERR_MISSING_CONFIG_PARAM, "NO logging compatible with daemon mode selected," " suricata won't be able to log. Please update " " 'logging.outputs' in the YAML."); } SCLogInitLogModule(sc_lid); SCLogDebug("sc_log_global_log_level: %d", sc_log_global_log_level); SCLogDebug("sc_lc->log_format: %s", sc_log_config->log_format); SCLogDebug("SCLogSetOPFilter: filter: %s", sc_log_config->op_filter); if (sc_lid != NULL) SCFree(sc_lid); } /** * \brief Returns a full file path given a filename uses log dir specified in * conf or DEFAULT_LOG_DIR * * \param filearg The relative filename for which we want a full path include * log directory * * \retval log_filename The fullpath of the logfile to open */ static char *SCLogGetLogFilename(char *filearg) { char *log_dir; char *log_filename; log_dir = ConfigGetLogDirectory(); log_filename = SCMalloc(PATH_MAX); if (unlikely(log_filename == NULL)) return NULL; snprintf(log_filename, PATH_MAX, "%s/%s", log_dir, filearg); return log_filename; } /** * \brief De-Initializes the logging module */ void SCLogDeInitLogModule(void) { SCLogFreeLogConfig(sc_log_config); /* reset the global logging_module variables */ sc_log_global_log_level = 0; sc_log_module_initialized = 0; sc_log_module_cleaned = 1; sc_log_config = NULL; /* de-init the FD filters */ SCLogReleaseFDFilters(); /* de-init the FG filters */ SCLogReleaseFGFilters(); #if defined (OS_WIN32) if (sc_log_stream_lock != NULL) { SCMutexDestroy(&sc_log_stream_lock); sc_log_stream_lock = NULL; } #endif /* OS_WIN32 */ return; } //------------------------------------Unit_Tests-------------------------------- /* The logging engine should be tested to the maximum extent possible, since * logging code would be used throughout the codebase, and hence we can't afford * to have a single bug here(not that you can afford to have a bug * elsewhere ;) ). Please report a bug, if you get a slightest hint of a bug * from the logging module. */ #ifdef UNITTESTS int SCLogTestInit01() { int result = 1; /* unset any environment variables set for the logging module */ unsetenv(SC_LOG_ENV_LOG_LEVEL); unsetenv(SC_LOG_ENV_LOG_OP_IFACE); unsetenv(SC_LOG_ENV_LOG_FORMAT); SCLogInitLogModule(NULL); if (sc_log_config == NULL) return 0; result &= (SC_LOG_DEF_LOG_LEVEL == sc_log_config->log_level); result &= (sc_log_config->op_ifaces != NULL && SC_LOG_DEF_LOG_OP_IFACE == sc_log_config->op_ifaces->iface); result &= (sc_log_config->log_format != NULL && strcmp(SC_LOG_DEF_LOG_FORMAT, sc_log_config->log_format) == 0); SCLogDeInitLogModule(); setenv(SC_LOG_ENV_LOG_LEVEL, "Debug", 1); setenv(SC_LOG_ENV_LOG_OP_IFACE, "Console", 1); setenv(SC_LOG_ENV_LOG_FORMAT, "%n- %l", 1); SCLogInitLogModule(NULL); result &= (SC_LOG_DEBUG == sc_log_config->log_level); result &= (sc_log_config->op_ifaces != NULL && SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->iface); result &= (sc_log_config->log_format != NULL && !strcmp("%n- %l", sc_log_config->log_format)); unsetenv(SC_LOG_ENV_LOG_LEVEL); unsetenv(SC_LOG_ENV_LOG_OP_IFACE); unsetenv(SC_LOG_ENV_LOG_FORMAT); SCLogDeInitLogModule(); return result; } int SCLogTestInit02() { SCLogInitData *sc_lid = NULL; SCLogOPIfaceCtx *sc_iface_ctx = NULL; int result = 1; char *logfile = SCLogGetLogFilename("boo.txt"); sc_lid = SCLogAllocLogInitData(); if (sc_lid == NULL) return 0; sc_lid->startup_message = "Test02"; sc_lid->global_log_level = SC_LOG_DEBUG; sc_lid->op_filter = "boo"; sc_iface_ctx = SCLogInitOPIfaceCtx("file", "%m - %d", SC_LOG_ALERT, logfile); SCLogAppendOPIfaceCtx(sc_iface_ctx, sc_lid); sc_iface_ctx = SCLogInitOPIfaceCtx("console", NULL, SC_LOG_ERROR, NULL); SCLogAppendOPIfaceCtx(sc_iface_ctx, sc_lid); SCLogInitLogModule(sc_lid); if (sc_log_config == NULL) return 0; result &= (SC_LOG_DEBUG == sc_log_config->log_level); result &= (sc_log_config->op_ifaces != NULL && SC_LOG_OP_IFACE_FILE == sc_log_config->op_ifaces->iface); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->next != NULL && SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->next->iface); result &= (sc_log_config->log_format != NULL && strcmp(SC_LOG_DEF_LOG_FORMAT, sc_log_config->log_format) == 0); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->log_format != NULL && strcmp("%m - %d", sc_log_config->op_ifaces->log_format) == 0); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->next != NULL && sc_log_config->op_ifaces->next->log_format == NULL); SCLogDeInitLogModule(); sc_lid = SCLogAllocLogInitData(); if (sc_lid == NULL) return 0; sc_lid->startup_message = "Test02"; sc_lid->global_log_level = SC_LOG_DEBUG; sc_lid->op_filter = "boo"; sc_lid->global_log_format = "kaboo"; SCLogInitLogModule(sc_lid); if (sc_log_config == NULL) return 0; result &= (SC_LOG_DEBUG == sc_log_config->log_level); result &= (sc_log_config->op_ifaces != NULL && SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->iface); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->next == NULL); result &= (sc_log_config->log_format != NULL && strcmp("kaboo", sc_log_config->log_format) == 0); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->log_format == NULL); result &= (sc_log_config->op_ifaces != NULL && sc_log_config->op_ifaces->next == NULL); SCLogDeInitLogModule(); return result; } int SCLogTestInit03() { int result = 1; SCLogInitLogModule(NULL); SCLogAddFGFilterBL(NULL, "bamboo", -1); SCLogAddFGFilterBL(NULL, "soo", -1); SCLogAddFGFilterBL(NULL, "dummy", -1); result &= (SCLogPrintFGFilters() == 3); SCLogAddFGFilterBL(NULL, "dummy1", -1); SCLogAddFGFilterBL(NULL, "dummy2", -1); result &= (SCLogPrintFGFilters() == 5); SCLogDeInitLogModule(); return result; } int SCLogTestInit04() { int result = 1; SCLogInitLogModule(NULL); SCLogAddFDFilter("bamboo"); SCLogAddFDFilter("soo"); SCLogAddFDFilter("foo"); SCLogAddFDFilter("roo"); result &= (SCLogPrintFDFilters() == 4); SCLogAddFDFilter("loo"); SCLogAddFDFilter("soo"); result &= (SCLogPrintFDFilters() == 5); SCLogRemoveFDFilter("bamboo"); SCLogRemoveFDFilter("soo"); SCLogRemoveFDFilter("foo"); SCLogRemoveFDFilter("noo"); result &= (SCLogPrintFDFilters() == 2); SCLogDeInitLogModule(); return result; } int SCLogTestInit05() { int result = 1; SCLogInfo("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); return result; } #endif /* UNITTESTS */ void SCLogRegisterTests() { #ifdef UNITTESTS UtRegisterTest("SCLogTestInit01", SCLogTestInit01); UtRegisterTest("SCLogTestInit02", SCLogTestInit02); UtRegisterTest("SCLogTestInit03", SCLogTestInit03); UtRegisterTest("SCLogTestInit04", SCLogTestInit04); UtRegisterTest("SCLogTestInit05", SCLogTestInit05); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/app-layer-dns-common.c0000644000000000000000000011470313051004444015115 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "stream.h" #include "app-layer-parser.h" #include "app-layer-dns-common.h" #ifdef DEBUG #include "util-print.h" #endif #include "util-memcmp.h" #include "util-atomic.h" typedef struct DNSConfig_ { uint32_t request_flood; uint32_t state_memcap; /**< memcap in bytes per state */ uint64_t global_memcap; /**< memcap in bytes globally for parser */ } DNSConfig; static DNSConfig dns_config; void DNSConfigInit(void) { memset(&dns_config, 0x00, sizeof(dns_config)); } void DNSConfigSetRequestFlood(uint32_t value) { dns_config.request_flood = value; } void DNSConfigSetStateMemcap(uint32_t value) { dns_config.state_memcap = value; } SC_ATOMIC_DECLARE(uint64_t, dns_memuse); /**< byte counter of current memuse */ SC_ATOMIC_DECLARE(uint64_t, dns_memcap_state); /**< counts number of 'rejects' */ SC_ATOMIC_DECLARE(uint64_t, dns_memcap_global); /**< counts number of 'rejects' */ void DNSConfigSetGlobalMemcap(uint64_t value) { dns_config.global_memcap = value; SC_ATOMIC_INIT(dns_memuse); SC_ATOMIC_INIT(dns_memcap_state); SC_ATOMIC_INIT(dns_memcap_global); } void DNSIncrMemcap(uint32_t size, DNSState *state) { if (state != NULL) { state->memuse += size; } SC_ATOMIC_ADD(dns_memuse, size); } void DNSDecrMemcap(uint32_t size, DNSState *state) { if (state != NULL) { BUG_ON(size > state->memuse); /**< TODO remove later */ state->memuse -= size; } BUG_ON(size > SC_ATOMIC_GET(dns_memuse)); /**< TODO remove later */ (void)SC_ATOMIC_SUB(dns_memuse, size); } int DNSCheckMemcap(uint32_t want, DNSState *state) { if (state != NULL) { if (state->memuse + want > dns_config.state_memcap) { SC_ATOMIC_ADD(dns_memcap_state, 1); DNSSetEvent(state, DNS_DECODER_EVENT_STATE_MEMCAP_REACHED); return -1; } } if (SC_ATOMIC_GET(dns_memuse) + (uint64_t)want > dns_config.global_memcap) { SC_ATOMIC_ADD(dns_memcap_global, 1); return -2; } return 0; } uint64_t DNSMemcapGetMemuseCounter(void) { uint64_t x = SC_ATOMIC_GET(dns_memuse); return x; } uint64_t DNSMemcapGetMemcapStateCounter(void) { uint64_t x = SC_ATOMIC_GET(dns_memcap_state); return x; } uint64_t DNSMemcapGetMemcapGlobalCounter(void) { uint64_t x = SC_ATOMIC_GET(dns_memcap_global); return x; } SCEnumCharMap dns_decoder_event_table[ ] = { { "UNSOLLICITED_RESPONSE", DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE, }, { "MALFORMED_DATA", DNS_DECODER_EVENT_MALFORMED_DATA, }, { "NOT_A_REQUEST", DNS_DECODER_EVENT_NOT_A_REQUEST, }, { "NOT_A_RESPONSE", DNS_DECODER_EVENT_NOT_A_RESPONSE, }, { "Z_FLAG_SET", DNS_DECODER_EVENT_Z_FLAG_SET, }, { "FLOODED", DNS_DECODER_EVENT_FLOODED, }, { "STATE_MEMCAP_REACHED", DNS_DECODER_EVENT_STATE_MEMCAP_REACHED, }, { NULL, -1 }, }; int DNSStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, dns_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "dns's enum map table.", event_name); /* this should be treated as fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, AppProto alproto) { AppLayerParserRegisterGetEventInfo(ipproto, alproto, DNSStateGetEventInfo); return; } AppLayerDecoderEvents *DNSGetEvents(void *state, uint64_t id) { DNSState *dns_state = (DNSState *)state; DNSTransaction *tx; if (dns_state->curr && dns_state->curr->tx_num == (id + 1)) { return dns_state->curr->decoder_events; } TAILQ_FOREACH(tx, &dns_state->tx_list, next) { if (tx->tx_num == (id+1)) return tx->decoder_events; } return NULL; } int DNSHasEvents(void *state) { DNSState *dns_state = (DNSState *)state; return (dns_state->events > 0); } void *DNSGetTx(void *alstate, uint64_t tx_id) { DNSState *dns_state = (DNSState *)alstate; DNSTransaction *tx = NULL; /* fast track: try the current tx */ if (dns_state->curr && dns_state->curr->tx_num == tx_id + 1) return dns_state->curr; /* fast track: * if the prev tx_id is equal to the stored tx ptr, we can * use this shortcut to get to the next. */ if (dns_state->iter) { if (tx_id == dns_state->iter->tx_num) { tx = TAILQ_NEXT(dns_state->iter, next); if (tx && tx->tx_num == tx_id + 1) { dns_state->iter = tx; return tx; } } } /* no luck with the fast tracks, do the full list walk */ TAILQ_FOREACH(tx, &dns_state->tx_list, next) { SCLogDebug("tx->tx_num %u, tx_id %"PRIu64, tx->tx_num, (tx_id+1)); if ((tx_id+1) != tx->tx_num) continue; SCLogDebug("returning tx %p", tx); dns_state->iter = tx; return tx; } return NULL; } uint64_t DNSGetTxCnt(void *alstate) { DNSState *dns_state = (DNSState *)alstate; return (uint64_t)dns_state->transaction_max; } int DNSGetAlstateProgress(void *tx, uint8_t direction) { DNSTransaction *dns_tx = (DNSTransaction *)tx; if (direction & STREAM_TOCLIENT) { /* response side of the tx is done if we parsed a reply * or if we tagged this tx as 'reply lost'. */ return (dns_tx->replied|dns_tx->reply_lost) ? 1 : 0; } else { /* tx is only created if we have a complete request, * or if we lost the request. Either way, if we have * a tx it we consider the request complete. */ return 1; } } void DNSSetTxLogged(void *alstate, void *tx, uint32_t logger) { DNSTransaction *dns_tx = (DNSTransaction *)tx; dns_tx->logged |= logger; } int DNSGetTxLogged(void *alstate, void *tx, uint32_t logger) { DNSTransaction *dns_tx = (DNSTransaction *)tx; if (dns_tx->logged & logger) return 1; return 0; } /** \brief get value for 'complete' status in DNS * * For DNS we use a simple bool. 1 means done. */ int DNSGetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } void DNSSetEvent(DNSState *s, uint8_t e) { if (s && s->curr) { SCLogDebug("s->curr->decoder_events %p", s->curr->decoder_events); AppLayerDecoderEventsSetEventRaw(&s->curr->decoder_events, e); SCLogDebug("s->curr->decoder_events %p", s->curr->decoder_events); s->events++; } else { SCLogDebug("couldn't set event %u", e); } } /** \internal * \brief Allocate a DNS TX * \retval tx or NULL */ static DNSTransaction *DNSTransactionAlloc(DNSState *state, const uint16_t tx_id) { if (DNSCheckMemcap(sizeof(DNSTransaction), state) < 0) return NULL; DNSTransaction *tx = SCMalloc(sizeof(DNSTransaction)); if (unlikely(tx == NULL)) return NULL; DNSIncrMemcap(sizeof(DNSTransaction), state); memset(tx, 0x00, sizeof(DNSTransaction)); TAILQ_INIT(&tx->query_list); TAILQ_INIT(&tx->answer_list); TAILQ_INIT(&tx->authority_list); tx->tx_id = tx_id; return tx; } /** \internal * \brief Free a DNS TX * \param tx DNS TX to free */ static void DNSTransactionFree(DNSTransaction *tx, DNSState *state) { SCEnter(); DNSQueryEntry *q = NULL; while ((q = TAILQ_FIRST(&tx->query_list))) { TAILQ_REMOVE(&tx->query_list, q, next); DNSDecrMemcap((sizeof(DNSQueryEntry) + q->len), state); SCFree(q); } DNSAnswerEntry *a = NULL; while ((a = TAILQ_FIRST(&tx->answer_list))) { TAILQ_REMOVE(&tx->answer_list, a, next); DNSDecrMemcap((sizeof(DNSAnswerEntry) + a->fqdn_len + a->data_len), state); SCFree(a); } while ((a = TAILQ_FIRST(&tx->authority_list))) { TAILQ_REMOVE(&tx->authority_list, a, next); DNSDecrMemcap((sizeof(DNSAnswerEntry) + a->fqdn_len + a->data_len), state); SCFree(a); } AppLayerDecoderEventsFreeEvents(&tx->decoder_events); if (tx->de_state != NULL) { DetectEngineStateFree(tx->de_state); BUG_ON(state->tx_with_detect_state_cnt == 0); state->tx_with_detect_state_cnt--; } if (state->iter == tx) state->iter = NULL; DNSDecrMemcap(sizeof(DNSTransaction), state); SCFree(tx); SCReturn; } /** * \brief dns transaction cleanup callback */ void DNSStateTransactionFree(void *state, uint64_t tx_id) { SCEnter(); DNSState *dns_state = state; DNSTransaction *tx = NULL; SCLogDebug("state %p, id %"PRIu64, dns_state, tx_id); TAILQ_FOREACH(tx, &dns_state->tx_list, next) { SCLogDebug("tx %p tx->tx_num %u, tx_id %"PRIu64, tx, tx->tx_num, (tx_id+1)); if ((tx_id+1) < tx->tx_num) break; else if ((tx_id+1) > tx->tx_num) continue; if (tx == dns_state->curr) dns_state->curr = NULL; if (tx->decoder_events != NULL) { if (tx->decoder_events->cnt <= dns_state->events) dns_state->events -= tx->decoder_events->cnt; else dns_state->events = 0; } TAILQ_REMOVE(&dns_state->tx_list, tx, next); DNSTransactionFree(tx, state); break; } SCReturn; } /** \internal * \brief Find the DNS Tx in the state * \param tx_id id of the tx * \retval tx or NULL if not found */ DNSTransaction *DNSTransactionFindByTxId(const DNSState *dns_state, const uint16_t tx_id) { if (dns_state->curr == NULL) return NULL; /* fast path */ if (dns_state->curr->tx_id == tx_id) { return dns_state->curr; /* slow path, iterate list */ } else { DNSTransaction *tx = NULL; TAILQ_FOREACH(tx, &dns_state->tx_list, next) { if (tx->tx_id == tx_id) { return tx; } else if ((dns_state->transaction_max - tx->tx_num) > (dns_state->window - 1U)) { tx->reply_lost = 1; } } } /* not found */ return NULL; } int DNSStateHasTxDetectState(void *alstate) { DNSState *state = (DNSState *)alstate; return (state->tx_with_detect_state_cnt > 0); } DetectEngineState *DNSGetTxDetectState(void *vtx) { DNSTransaction *tx = (DNSTransaction *)vtx; return tx->de_state; } int DNSSetTxDetectState(void *alstate, void *vtx, DetectEngineState *s) { DNSState *state = (DNSState *)alstate; DNSTransaction *tx = (DNSTransaction *)vtx; state->tx_with_detect_state_cnt++; tx->de_state = s; return 0; } void *DNSStateAlloc(void) { void *s = SCMalloc(sizeof(DNSState)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(DNSState)); DNSState *dns_state = (DNSState *)s; DNSIncrMemcap(sizeof(DNSState), dns_state); TAILQ_INIT(&dns_state->tx_list); return s; } void DNSStateFree(void *s) { SCEnter(); if (s) { DNSState *dns_state = (DNSState *) s; DNSTransaction *tx = NULL; while ((tx = TAILQ_FIRST(&dns_state->tx_list))) { TAILQ_REMOVE(&dns_state->tx_list, tx, next); DNSTransactionFree(tx, dns_state); } if (dns_state->buffer != NULL) { DNSDecrMemcap(0xffff, dns_state); /** TODO update if/once we alloc * in a smarter way */ SCFree(dns_state->buffer); } BUG_ON(dns_state->tx_with_detect_state_cnt > 0); DNSDecrMemcap(sizeof(DNSState), dns_state); BUG_ON(dns_state->memuse > 0); SCFree(s); } SCReturn; } /** \brief Validation checks for DNS request header * * Will set decoder events if anomalies are found. * * \retval 0 ok * \retval -1 error */ int DNSValidateRequestHeader(DNSState *dns_state, const DNSHeader *dns_header) { uint16_t flags = ntohs(dns_header->flags); if ((flags & 0x8000) != 0) { SCLogDebug("not a request 0x%04x", flags); DNSSetEvent(dns_state, DNS_DECODER_EVENT_NOT_A_REQUEST); goto bad_data; } if ((flags & 0x0040) != 0) { SCLogDebug("Z flag not 0, 0x%04x", flags); DNSSetEvent(dns_state, DNS_DECODER_EVENT_Z_FLAG_SET); goto bad_data; } return 0; bad_data: return -1; } /** \brief Validation checks for DNS response header * * Will set decoder events if anomalies are found. * * \retval 0 ok * \retval -1 error */ int DNSValidateResponseHeader(DNSState *dns_state, const DNSHeader *dns_header) { uint16_t flags = ntohs(dns_header->flags); if ((flags & 0x8000) == 0) { SCLogDebug("not a response 0x%04x", flags); DNSSetEvent(dns_state, DNS_DECODER_EVENT_NOT_A_RESPONSE); goto bad_data; } if ((flags & 0x0040) != 0) { SCLogDebug("Z flag not 0, 0x%04x", flags); DNSSetEvent(dns_state, DNS_DECODER_EVENT_Z_FLAG_SET); goto bad_data; } return 0; bad_data: return -1; } /** \internal * \brief check the query list to see if we already have this exact query * \retval bool true or false */ static int QueryIsDuplicate(DNSTransaction *tx, const uint8_t *fqdn, const uint16_t fqdn_len, const uint16_t type, const uint16_t class) { DNSQueryEntry *q = NULL; TAILQ_FOREACH(q, &tx->query_list, next) { uint8_t *qfqdn = (uint8_t *)q + sizeof(DNSQueryEntry); if (q->len == fqdn_len && q->type == type && q->class == class && SCMemcmp(qfqdn, fqdn, fqdn_len) == 0) { return TRUE; } } return FALSE; } void DNSStoreQueryInState(DNSState *dns_state, const uint8_t *fqdn, const uint16_t fqdn_len, const uint16_t type, const uint16_t class, const uint16_t tx_id) { /* flood protection */ if (dns_state->givenup) return; /* find the tx and see if this is an exact duplicate */ DNSTransaction *tx = DNSTransactionFindByTxId(dns_state, tx_id); if ((tx != NULL) && (QueryIsDuplicate(tx, fqdn, fqdn_len, type, class) == TRUE)) { SCLogDebug("query is duplicate"); return; } /* check flood limit */ if (dns_config.request_flood != 0 && dns_state->unreplied_cnt > dns_config.request_flood) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_FLOODED); dns_state->givenup = 1; } if (tx == NULL) { tx = DNSTransactionAlloc(dns_state, tx_id); if (tx == NULL) return; dns_state->transaction_max++; SCLogDebug("dns_state->transaction_max updated to %"PRIu64, dns_state->transaction_max); TAILQ_INSERT_TAIL(&dns_state->tx_list, tx, next); dns_state->curr = tx; tx->tx_num = dns_state->transaction_max; SCLogDebug("new tx %u with internal id %u", tx->tx_id, tx->tx_num); dns_state->unreplied_cnt++; } if (DNSCheckMemcap((sizeof(DNSQueryEntry) + fqdn_len), dns_state) < 0) return; DNSQueryEntry *q = SCMalloc(sizeof(DNSQueryEntry) + fqdn_len); if (unlikely(q == NULL)) return; DNSIncrMemcap((sizeof(DNSQueryEntry) + fqdn_len), dns_state); q->type = type; q->class = class; q->len = fqdn_len; memcpy((uint8_t *)q + sizeof(DNSQueryEntry), fqdn, fqdn_len); TAILQ_INSERT_TAIL(&tx->query_list, q, next); SCLogDebug("Query for TX %04x stored", tx_id); } void DNSStoreAnswerInState(DNSState *dns_state, const int rtype, const uint8_t *fqdn, const uint16_t fqdn_len, const uint16_t type, const uint16_t class, const uint16_t ttl, const uint8_t *data, const uint16_t data_len, const uint16_t tx_id) { DNSTransaction *tx = DNSTransactionFindByTxId(dns_state, tx_id); if (tx == NULL) { tx = DNSTransactionAlloc(dns_state, tx_id); if (tx == NULL) return; TAILQ_INSERT_TAIL(&dns_state->tx_list, tx, next); dns_state->curr = tx; dns_state->transaction_max++; tx->tx_num = dns_state->transaction_max; } if (DNSCheckMemcap((sizeof(DNSAnswerEntry) + fqdn_len + data_len), dns_state) < 0) return; DNSAnswerEntry *q = SCMalloc(sizeof(DNSAnswerEntry) + fqdn_len + data_len); if (unlikely(q == NULL)) return; DNSIncrMemcap((sizeof(DNSAnswerEntry) + fqdn_len + data_len), dns_state); q->type = type; q->class = class; q->ttl = ttl; q->fqdn_len = fqdn_len; q->data_len = data_len; uint8_t *ptr = (uint8_t *)q + sizeof(DNSAnswerEntry); if (fqdn != NULL && fqdn_len > 0) { memcpy(ptr, fqdn, fqdn_len); ptr += fqdn_len; } if (data != NULL && data_len > 0) { memcpy(ptr, data, data_len); } if (rtype == DNS_LIST_ANSWER) TAILQ_INSERT_TAIL(&tx->answer_list, q, next); else if (rtype == DNS_LIST_AUTHORITY) TAILQ_INSERT_TAIL(&tx->authority_list, q, next); else BUG_ON(1); SCLogDebug("Answer for TX %04x stored", tx_id); /* mark tx is as replied so we can log it */ tx->replied = 1; } /** \internal * \brief get domain name from dns packet * * In case of compressed name storage this function follows the ptrs to * create the full domain name. * * The length bytes are converted into dots, e.g. |03|com|00| becomes * .com * The trailing . is not stored. * * \param input input buffer (complete dns record) * \param input_len lenght of input buffer * \param offset offset into @input where dns name starts * \param fqdn buffer to store result * \param fqdn_size size of @fqdn buffer * \retval 0 on error/no buffer * \retval size size of fqdn */ static uint16_t DNSResponseGetNameByOffset(const uint8_t * const input, const uint32_t input_len, const uint16_t offset, uint8_t *fqdn, const size_t fqdn_size) { if (offset >= input_len) { SCLogDebug("input buffer too small for domain of len %u", offset); goto insufficient_data; } int steps = 0; uint16_t fqdn_offset = 0; uint8_t length = *(input + offset); const uint8_t *qdata = input + offset; SCLogDebug("qry length %u", length); if (length == 0) { memcpy(fqdn, "", 6); SCReturnUInt(6U); } if ((uint64_t)((qdata + 1) - input) >= (uint64_t)input_len) { SCLogDebug("input buffer too small"); goto insufficient_data; } while (length != 0) { int cnt = 0; while (length & 0xc0) { uint16_t off = ((length & 0x3f) << 8) + *(qdata+1); qdata = (const uint8_t *)input + off; if ((uint64_t)((qdata + 1) - input) >= (uint64_t)input_len) { SCLogDebug("input buffer too small"); goto insufficient_data; } length = *qdata; SCLogDebug("qry length %u", length); if (cnt++ == 100) { SCLogDebug("too many pointer iterations, loop?"); goto bad_data; } } qdata++; if (length == 0) { break; } if (input + input_len < qdata + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, qdata, length); if ((size_t)(fqdn_offset + length + 1) < fqdn_size) { memcpy(fqdn + fqdn_offset, qdata, length); fqdn_offset += length; fqdn[fqdn_offset++] = '.'; } qdata += length; /* if we're at the end of the input data, we're done */ if ((uint64_t)((qdata + 1) - input) == (uint64_t)input_len) { break; } else if ((uint64_t)((qdata + 1) - input) > (uint64_t)input_len) { SCLogDebug("input buffer too small"); goto insufficient_data; } length = *qdata; SCLogDebug("qry length %u", length); steps++; if (steps >= 255) goto bad_data; } if (fqdn_offset) { fqdn_offset--; } //PrintRawDataFp(stdout, fqdn, fqdn_offset); SCReturnUInt(fqdn_offset); bad_data: insufficient_data: SCReturnUInt(0U); } /** \internal * \brief skip past domain name field * * Skip the domain at position data. We don't care about following compressed names * as we only want to know when the next part of the buffer starts * * \param input input buffer (complete dns record) * \param input_len lenght of input buffer * \param data current position * * \retval NULL on out of bounds data * \retval sdata ptr to position in buffer past the name */ static const uint8_t *SkipDomain(const uint8_t * const input, const uint32_t input_len, const uint8_t *data) { const uint8_t *sdata = data; while (*sdata != 0x00) { if (*sdata & 0xc0) { sdata++; break; } else { sdata += ((*sdata) + 1); } if (input + input_len < sdata) { SCLogDebug("input buffer too small for data of len"); goto insufficient_data; } } sdata++; if (input + input_len < sdata) { SCLogDebug("input buffer too small for data of len"); goto insufficient_data; } return sdata; insufficient_data: return NULL; } const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_header, const uint16_t num, const DnsListEnum list, const uint8_t * const input, const uint32_t input_len, const uint8_t *data) { if (input + input_len < data + 2) { SCLogDebug("input buffer too small for record 'name' field, record %u, " "total answer_rr %u", num, ntohs(dns_header->answer_rr)); goto insufficient_data; } uint8_t fqdn[DNS_MAX_SIZE]; uint16_t fqdn_len = 0; /* see if name is compressed */ if (!(data[0] & 0xc0)) { if ((fqdn_len = DNSResponseGetNameByOffset(input, input_len, data - input, fqdn, sizeof(fqdn))) == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto insufficient_data; } //PrintRawDataFp(stdout, fqdn, fqdn_len); const uint8_t *tdata = SkipDomain(input, input_len, data); if (tdata == NULL) { goto insufficient_data; } data = tdata; } else { uint16_t offset = (data[0] & 0x3f) << 8 | data[1]; if ((fqdn_len = DNSResponseGetNameByOffset(input, input_len, offset, fqdn, sizeof(fqdn))) == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto insufficient_data; } //PrintRawDataFp(stdout, fqdn, fqdn_len); data += 2; } if (input + input_len < data + sizeof(DNSAnswerHeader)) { SCLogDebug("input buffer too small for DNSAnswerHeader"); goto insufficient_data; } const DNSAnswerHeader *head = (DNSAnswerHeader *)data; const uint16_t datalen = ntohs(head->len); data += sizeof(DNSAnswerHeader); SCLogDebug("head->len %u", ntohs(head->len)); if (input + input_len < data + ntohs(head->len)) { SCLogDebug("input buffer too small for data of len %u", ntohs(head->len)); goto insufficient_data; } SCLogDebug("TTL %u", ntohl(head->ttl)); switch (ntohs(head->type)) { case DNS_RECORD_TYPE_A: { if (datalen == 0 || datalen == 4) { //PrintRawDataFp(stdout, data, ntohs(head->len)); //char a[16]; //PrintInet(AF_INET, (const void *)data, a, sizeof(a)); //SCLogInfo("A %s TTL %u", a, ntohl(head->ttl)); DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), data, datalen, ntohs(dns_header->tx_id)); } else { SCLogDebug("invalid length for A response data: %u", ntohs(head->len)); goto bad_data; } data += datalen; break; } case DNS_RECORD_TYPE_AAAA: { if (datalen == 0 || datalen == 16) { //char a[46]; //PrintInet(AF_INET6, (const void *)data, a, sizeof(a)); //SCLogInfo("AAAA %s TTL %u", a, ntohl(head->ttl)); DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), data, datalen, ntohs(dns_header->tx_id)); } else { SCLogDebug("invalid length for AAAA response data: %u", ntohs(head->len)); goto bad_data; } data += datalen; break; } case DNS_RECORD_TYPE_MX: case DNS_RECORD_TYPE_CNAME: case DNS_RECORD_TYPE_PTR: { uint8_t name[DNS_MAX_SIZE]; uint16_t name_len = 0; uint8_t skip = 0; if (ntohs(head->type) == DNS_RECORD_TYPE_MX) { // Skip the preference header skip = 2; } if ((name_len = DNSResponseGetNameByOffset(input, input_len, data - input + skip, name, sizeof(name))) == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto insufficient_data; } DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), name, name_len, ntohs(dns_header->tx_id)); data += ntohs(head->len); break; } case DNS_RECORD_TYPE_NS: case DNS_RECORD_TYPE_SOA: { uint8_t pname[DNS_MAX_SIZE]; uint16_t pname_len = 0; if ((pname_len = DNSResponseGetNameByOffset(input, input_len, data - input, pname, sizeof(pname))) == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto insufficient_data; } if (ntohs(head->type) == DNS_RECORD_TYPE_SOA) { const uint8_t *sdata = SkipDomain(input, input_len, data); if (sdata == NULL) { goto insufficient_data; } uint8_t pmail[DNS_MAX_SIZE]; uint16_t pmail_len = 0; SCLogDebug("getting pmail"); if ((pmail_len = DNSResponseGetNameByOffset(input, input_len, sdata - input, pmail, sizeof(pmail))) == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto insufficient_data; } SCLogDebug("pmail_len %u", pmail_len); //PrintRawDataFp(stdout, (uint8_t *)pmail, pmail_len); const uint8_t *tdata = SkipDomain(input, input_len, sdata); if (tdata == NULL) { goto insufficient_data; } #if DEBUG struct Trailer { uint32_t serial; uint32_t refresh; uint32_t retry; uint32_t experiation; uint32_t minttl; } *tail = (struct Trailer *)tdata; if (input + input_len < tdata + sizeof(struct Trailer)) { SCLogDebug("input buffer too small for data of len"); goto insufficient_data; } SCLogDebug("serial %u refresh %u retry %u exp %u min ttl %u", ntohl(tail->serial), ntohl(tail->refresh), ntohl(tail->retry), ntohl(tail->experiation), ntohl(tail->minttl)); #endif } DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), pname, pname_len, ntohs(dns_header->tx_id)); data += ntohs(head->len); break; } case DNS_RECORD_TYPE_TXT: { uint16_t txtdatalen = datalen; if (txtdatalen == 0) { DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); goto bad_data; } uint8_t txtlen = *data; const uint8_t *tdata = data + 1; do { //PrintRawDataFp(stdout, (uint8_t*)tdata, txtlen); if (txtlen >= txtdatalen) goto bad_data; DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), (uint8_t*)tdata, (uint16_t)txtlen, ntohs(dns_header->tx_id)); txtdatalen -= txtlen; tdata += txtlen; txtlen = *tdata; tdata++; txtdatalen--; SCLogDebug("datalen %u, txtlen %u", txtdatalen, txtlen); } while (txtdatalen > 1); data += datalen; break; } case DNS_RECORD_TYPE_SSHFP: { /* data here should be: * [1 byte algo][1 byte type][var bytes fingerprint] * As we currently can't store each of those in the state, * we just store the raw data an let the output/detect * code figure out what to do with it. */ DNSStoreAnswerInState(dns_state, list, fqdn, fqdn_len, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), data, ntohs(head->len), ntohs(dns_header->tx_id)); data += datalen; break; } default: /* unsupported record */ { DNSStoreAnswerInState(dns_state, list, NULL, 0, ntohs(head->type), ntohs(head->class), ntohl(head->ttl), NULL, 0, ntohs(dns_header->tx_id)); //PrintRawDataFp(stdout, data, ntohs(head->len)); data += datalen; break; } } return data; bad_data: insufficient_data: return NULL; } void DNSCreateTypeString(uint16_t type, char *str, size_t str_size) { switch (type) { case DNS_RECORD_TYPE_A: snprintf(str, str_size, "A"); break; case DNS_RECORD_TYPE_NS: snprintf(str, str_size, "NS"); break; case DNS_RECORD_TYPE_AAAA: snprintf(str, str_size, "AAAA"); break; case DNS_RECORD_TYPE_CNAME: snprintf(str, str_size, "CNAME"); break; case DNS_RECORD_TYPE_TXT: snprintf(str, str_size, "TXT"); break; case DNS_RECORD_TYPE_MX: snprintf(str, str_size, "MX"); break; case DNS_RECORD_TYPE_SOA: snprintf(str, str_size, "SOA"); break; case DNS_RECORD_TYPE_PTR: snprintf(str, str_size, "PTR"); break; case DNS_RECORD_TYPE_SIG: snprintf(str, str_size, "SIG"); break; case DNS_RECORD_TYPE_KEY: snprintf(str, str_size, "KEY"); break; case DNS_RECORD_TYPE_WKS: snprintf(str, str_size, "WKS"); break; case DNS_RECORD_TYPE_TKEY: snprintf(str, str_size, "TKEY"); break; case DNS_RECORD_TYPE_TSIG: snprintf(str, str_size, "TSIG"); break; case DNS_RECORD_TYPE_ANY: snprintf(str, str_size, "ANY"); break; case DNS_RECORD_TYPE_RRSIG: snprintf(str, str_size, "RRSIG"); break; case DNS_RECORD_TYPE_NSEC: snprintf(str, str_size, "NSEC"); break; case DNS_RECORD_TYPE_DNSKEY: snprintf(str, str_size, "DNSKEY"); break; case DNS_RECORD_TYPE_HINFO: snprintf(str, str_size, "HINFO"); break; case DNS_RECORD_TYPE_MINFO: snprintf(str, str_size, "MINFO"); break; case DNS_RECORD_TYPE_RP: snprintf(str, str_size, "RP"); break; case DNS_RECORD_TYPE_AFSDB: snprintf(str, str_size, "AFSDB"); break; case DNS_RECORD_TYPE_X25: snprintf(str, str_size, "X25"); break; case DNS_RECORD_TYPE_ISDN: snprintf(str, str_size, "ISDN"); break; case DNS_RECORD_TYPE_RT: snprintf(str, str_size, "RT"); break; case DNS_RECORD_TYPE_NSAP: snprintf(str, str_size, "NSAP"); break; case DNS_RECORD_TYPE_NSAPPTR: snprintf(str, str_size, "NSAPPTR"); break; case DNS_RECORD_TYPE_PX: snprintf(str, str_size, "PX"); break; case DNS_RECORD_TYPE_GPOS: snprintf(str, str_size, "GPOS"); break; case DNS_RECORD_TYPE_LOC: snprintf(str, str_size, "LOC"); break; case DNS_RECORD_TYPE_SRV: snprintf(str, str_size, "SRV"); break; case DNS_RECORD_TYPE_ATMA: snprintf(str, str_size, "ATMA"); break; case DNS_RECORD_TYPE_NAPTR: snprintf(str, str_size, "NAPTR"); break; case DNS_RECORD_TYPE_KX: snprintf(str, str_size, "KX"); break; case DNS_RECORD_TYPE_CERT: snprintf(str, str_size, "CERT"); break; case DNS_RECORD_TYPE_A6: snprintf(str, str_size, "A6"); break; case DNS_RECORD_TYPE_DNAME: snprintf(str, str_size, "DNAME"); break; case DNS_RECORD_TYPE_OPT: snprintf(str, str_size, "OPT"); break; case DNS_RECORD_TYPE_APL: snprintf(str, str_size, "APL"); break; case DNS_RECORD_TYPE_DS: snprintf(str, str_size, "DS"); break; case DNS_RECORD_TYPE_SSHFP: snprintf(str, str_size, "SSHFP"); break; case DNS_RECORD_TYPE_IPSECKEY: snprintf(str, str_size, "IPSECKEY"); break; case DNS_RECORD_TYPE_DHCID: snprintf(str, str_size, "DHCID"); break; case DNS_RECORD_TYPE_NSEC3: snprintf(str, str_size, "NSEC3"); break; case DNS_RECORD_TYPE_NSEC3PARAM: snprintf(str, str_size, "NSEC3PARAM"); break; case DNS_RECORD_TYPE_TLSA: snprintf(str, str_size, "TLSA"); break; case DNS_RECORD_TYPE_HIP: snprintf(str, str_size, "HIP"); break; case DNS_RECORD_TYPE_CDS: snprintf(str, str_size, "CDS"); break; case DNS_RECORD_TYPE_CDNSKEY: snprintf(str, str_size, "CDNSKEY"); break; case DNS_RECORD_TYPE_MAILA: snprintf(str, str_size, "MAILA"); break; case DNS_RECORD_TYPE_URI: snprintf(str, str_size, "URI"); break; case DNS_RECORD_TYPE_MB: snprintf(str, str_size, "MB"); break; case DNS_RECORD_TYPE_MG: snprintf(str, str_size, "MG"); break; case DNS_RECORD_TYPE_MR: snprintf(str, str_size, "MR"); break; case DNS_RECORD_TYPE_NULL: snprintf(str, str_size, "NULL"); break; case DNS_RECORD_TYPE_SPF: snprintf(str, str_size, "SPF"); break; case DNS_RECORD_TYPE_NXT: snprintf(str, str_size, "NXT"); break; case DNS_RECORD_TYPE_MD: snprintf(str, str_size, "MD"); break; case DNS_RECORD_TYPE_MF: snprintf(str, str_size, "MF"); break; default: snprintf(str, str_size, "%04x/%u", type, type); } } void DNSCreateRcodeString(uint8_t rcode, char *str, size_t str_size) { switch (rcode) { case DNS_RCODE_NOERROR: snprintf(str, str_size, "NOERROR"); break; case DNS_RCODE_FORMERR: snprintf(str, str_size, "FORMERR"); break; case DNS_RCODE_SERVFAIL: snprintf(str, str_size, "SERVFAIL"); break; case DNS_RCODE_NXDOMAIN: snprintf(str, str_size, "NXDOMAIN"); break; case DNS_RCODE_NOTIMP: snprintf(str, str_size, "NOTIMP"); break; case DNS_RCODE_REFUSED: snprintf(str, str_size, "REFUSED"); break; case DNS_RCODE_YXDOMAIN: snprintf(str, str_size, "YXDOMAIN"); break; case DNS_RCODE_YXRRSET: snprintf(str, str_size, "YXRRSET"); break; case DNS_RCODE_NXRRSET: snprintf(str, str_size, "NXRRSET"); break; case DNS_RCODE_NOTAUTH: snprintf(str, str_size, "NOTAUTH"); break; case DNS_RCODE_NOTZONE: snprintf(str, str_size, "NOTZONE"); break; /* these are the same, need more logic */ case DNS_RCODE_BADVERS: //case DNS_RCODE_BADSIG: snprintf(str, str_size, "BADVERS/BADSIG"); break; case DNS_RCODE_BADKEY: snprintf(str, str_size, "BADKEY"); break; case DNS_RCODE_BADTIME: snprintf(str, str_size, "BADTIME"); break; case DNS_RCODE_BADMODE: snprintf(str, str_size, "BADMODE"); break; case DNS_RCODE_BADNAME: snprintf(str, str_size, "BADNAME"); break; case DNS_RCODE_BADALG: snprintf(str, str_size, "BADALG"); break; case DNS_RCODE_BADTRUNC: snprintf(str, str_size, "BADTRUNC"); break; default: SCLogDebug("could not map DNS rcode to name, bug!"); snprintf(str, str_size, "%04x/%u", rcode, rcode); } } suricata-3.2.1/src/output-streaming.h0000644000000000000000000000350213051004444014501 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer Filedata Logger Output registration functions */ #ifndef __OUTPUT_STREAMING_H__ #define __OUTPUT_STREAMING_H__ #include "decode.h" #include "util-file.h" #define OUTPUT_STREAMING_FLAG_OPEN 0x01 #define OUTPUT_STREAMING_FLAG_CLOSE 0x02 #define OUTPUT_STREAMING_FLAG_TOSERVER 0x04 #define OUTPUT_STREAMING_FLAG_TOCLIENT 0x08 #define OUTPUT_STREAMING_FLAG_TRANSACTION 0x10 enum OutputStreamingType { STREAMING_TCP_DATA, STREAMING_HTTP_BODIES, }; /** filedata logger function pointer type */ typedef int (*StreamingLogger)(ThreadVars *, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags); int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *, enum OutputStreamingType, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputStreamingLoggerRegister (void); void OutputStreamingShutdown(void); #endif /* __OUTPUT_STREAMING_H__ */ suricata-3.2.1/src/util-optimize.h0000644000000000000000000000255513051004444013774 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __UTIL_OPTIMIZE_H__ #define __UTIL_OPTIMIZE_H__ /** * \file * * \author Victor Julien */ #if CPPCHECK==1 #define likely #define unlikely #else #ifndef likely #define likely(expr) __builtin_expect(!!(expr), 1) #endif #ifndef unlikely #define unlikely(expr) __builtin_expect(!!(expr), 0) #endif #endif /** from http://en.wikipedia.org/wiki/Memory_ordering * * C Compiler memory barrier */ #define cc_barrier() __asm__ __volatile__("": : :"memory") /** from http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Atomic-Builtins.html * * Hardware memory barrier */ #define hw_barrier() __sync_synchronize() #endif /* __UTIL_OPTIMIZE_H__ */ suricata-3.2.1/src/detect-engine-iponly.c0000644000000000000000000023727013051004444015203 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * Signatures that only inspect IP addresses are processed here * We use radix trees for src dst ipv4 and ipv6 adresses * This radix trees hold information for subnets and hosts in a * hierarchical distribution */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "decode.h" #include "flow.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "detect-engine-proto.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-threshold.h" #include "detect-engine-iponly.h" #include "detect-threshold.h" #include "util-classification-config.h" #include "util-rule-vars.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-print.h" #include "util-profiling.h" #ifdef OS_WIN32 #include #else #include #endif /* OS_WIN32 */ /** * \brief This function creates a new IPOnlyCIDRItem * * \retval IPOnlyCIDRItem address of the new instance */ static IPOnlyCIDRItem *IPOnlyCIDRItemNew() { SCEnter(); IPOnlyCIDRItem *item = NULL; item = SCMalloc(sizeof(IPOnlyCIDRItem)); if (unlikely(item == NULL)) SCReturnPtr(NULL, "IPOnlyCIDRItem"); memset(item, 0, sizeof(IPOnlyCIDRItem)); SCReturnPtr(item, "IPOnlyCIDRItem"); } static uint8_t IPOnlyCIDRItemCompare(IPOnlyCIDRItem *head, IPOnlyCIDRItem *item) { uint8_t i = 0; for (; i < head->netmask / 32 || i < 1; i++) { if (item->ip[i] < head->ip[i]) //if (*(uint8_t *)(item->ip + i) < *(uint8_t *)(head->ip + i)) return 1; } return 0; } /** * \internal * \brief Parses an ipv4/ipv6 address string and updates the result into the * IPOnlyCIDRItem instance sent as the argument. * * \param dd Pointer to the IPOnlyCIDRItem instance which should be updated with * the address (in cidr) details from the parsed ip string. * \param str Pointer to address string that has to be parsed. * * \retval 0 On successfully parsing the address string. * \retval -1 On failure. */ static int IPOnlyCIDRItemParseSingle(IPOnlyCIDRItem *dd, char *str) { char buf[256] = ""; char *ip = NULL, *ip2 = NULL; char *mask = NULL; int r = 0; while (*str != '\0' && *str == ' ') str++; SCLogDebug("str %s", str); strlcpy(buf, str, sizeof(buf)); ip = buf; /* first handle 'any' */ if (strcasecmp(str, "any") == 0) { /* if any, insert 0.0.0.0/0 and ::/0 as well */ SCLogDebug("adding 0.0.0.0/0 and ::/0 as we\'re handling \'any\'"); IPOnlyCIDRItemParseSingle(dd, "0.0.0.0/0"); BUG_ON(dd->family == 0); dd->next = IPOnlyCIDRItemNew(); if (dd->next == NULL) goto error; IPOnlyCIDRItemParseSingle(dd->next, "::/0"); BUG_ON(dd->family == 0); SCLogDebug("address is \'any\'"); return 0; } /* handle the negation case */ if (ip[0] == '!') { dd->negated = (dd->negated)? 0 : 1; ip++; } /* see if the address is an ipv4 or ipv6 address */ if ((strchr(str, ':')) == NULL) { /* IPv4 Address */ struct in_addr in; dd->family = AF_INET; if ((mask = strchr(ip, '/')) != NULL) { /* 1.2.3.4/xxx format (either dotted or cidr notation */ ip[mask - ip] = '\0'; mask++; uint32_t netmask = 0; size_t u = 0; if ((strchr (mask, '.')) == NULL) { /* 1.2.3.4/24 format */ for (u = 0; u < strlen(mask); u++) { if(!isdigit((unsigned char)mask[u])) goto error; } int cidr = atoi(mask); if (cidr < 0 || cidr > 32) goto error; dd->netmask = cidr; } else { /* 1.2.3.4/255.255.255.0 format */ r = inet_pton(AF_INET, mask, &in); if (r <= 0) goto error; netmask = in.s_addr; /* Extract cidr netmask */ while ((0x01 & netmask) == 0) { dd->netmask++; netmask = netmask >> 1; } dd->netmask = 32 - dd->netmask; } r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; dd->ip[0] = in.s_addr; } else if ((ip2 = strchr(ip, '-')) != NULL) { /* 1.2.3.4-1.2.3.6 range format */ ip[ip2 - ip] = '\0'; ip2++; uint32_t tmp_ip[4]; uint32_t tmp_ip2[4]; uint32_t first, last; r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; tmp_ip[0] = in.s_addr; r = inet_pton(AF_INET, ip2, &in); if (r <= 0) goto error; tmp_ip2[0] = in.s_addr; /* a > b is illegal, a = b is ok */ if (ntohl(tmp_ip[0]) > ntohl(tmp_ip2[0])) goto error; first = ntohl(tmp_ip[0]); last = ntohl(tmp_ip2[0]); dd->netmask = 32; dd->ip[0] =htonl(first); if (first < last) { for (first++; first <= last; first++) { IPOnlyCIDRItem *new = IPOnlyCIDRItemNew(); if (new == NULL) goto error; dd->next = new; new->negated = dd->negated; new->family= dd->family; new->netmask = dd->netmask; new->ip[0] = htonl(first); dd = dd->next; } } } else { /* 1.2.3.4 format */ r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; /* single host */ dd->ip[0] = in.s_addr; dd->netmask = 32; } } else { /* IPv6 Address */ struct in6_addr in6; uint32_t ip6addr[4]; dd->family = AF_INET6; if ((mask = strchr(ip, '/')) != NULL) { mask[0] = '\0'; mask++; r = inet_pton(AF_INET6, ip, &in6); if (r <= 0) goto error; /* Format is cidr val */ dd->netmask = atoi(mask); memcpy(dd->ip, &in6.s6_addr, sizeof(ip6addr)); } else { r = inet_pton(AF_INET6, ip, &in6); if (r <= 0) goto error; memcpy(dd->ip, &in6.s6_addr, sizeof(dd->ip)); dd->netmask = 128; } } BUG_ON(dd->family == 0); return 0; error: return -1; } /** * \brief Setup a single address string, parse it and add the resulting * Address items in cidr format to the list of gh * * \param gh Pointer to the IPOnlyCIDRItem list Head to which the * resulting Address-Range(s) from the parsed ip string has to * be added. * \param s Pointer to the ip address string to be parsed. * * \retval 0 On success. * \retval -1 On failure. */ static int IPOnlyCIDRItemSetup(IPOnlyCIDRItem *gh, char *s) { SCLogDebug("gh %p, s %s", gh, s); /* parse the address */ if (IPOnlyCIDRItemParseSingle(gh, s) == -1) { SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC, "DetectAddressParse error \"%s\"", s); goto error; } return 0; error: return -1; } /** * \brief This function insert a IPOnlyCIDRItem * to a list of IPOnlyCIDRItems sorted by netmask * ascending * \param head Pointer to the head of IPOnlyCIDRItems list * \param item Pointer to the item to insert in the list * * \retval IPOnlyCIDRItem address of the new head if apply */ static IPOnlyCIDRItem *IPOnlyCIDRItemInsertReal(IPOnlyCIDRItem *head, IPOnlyCIDRItem *item) { IPOnlyCIDRItem *it, *prev = NULL; if (item == NULL) return head; /* Compare with the head */ if (item->netmask < head->netmask || (item->netmask == head->netmask && IPOnlyCIDRItemCompare(head, item))) { item->next = head; return item; } if (item->netmask == head->netmask && !IPOnlyCIDRItemCompare(head, item)) { item->next = head->next; head->next = item; return head; } for (prev = it = head; it != NULL && it->netmask < item->netmask; it = it->next) prev = it; if (it == NULL) { prev->next = item; item->next = NULL; } else { item->next = it; prev->next = item; } return head; } /** * \brief This function insert a IPOnlyCIDRItem list * to a list of IPOnlyCIDRItems sorted by netmask * ascending * \param head Pointer to the head of IPOnlyCIDRItems list * \param item Pointer to the list of items to insert in the list * * \retval IPOnlyCIDRItem address of the new head if apply */ static IPOnlyCIDRItem *IPOnlyCIDRItemInsert(IPOnlyCIDRItem *head, IPOnlyCIDRItem *item) { IPOnlyCIDRItem *it, *prev = NULL; /* The first element */ if (head == NULL) { SCLogDebug("Head is NULL to insert item (%p)",item); return item; } if (item == NULL) { SCLogDebug("Item is NULL"); return head; } SCLogDebug("Inserting item(%p)->netmask %u head %p", item, item->netmask, head); prev = item; while (prev != NULL) { it = prev->next; /* Separate from the item list */ prev->next = NULL; //SCLogDebug("Before:"); //IPOnlyCIDRListPrint(head); head = IPOnlyCIDRItemInsertReal(head, prev); //SCLogDebug("After:"); //IPOnlyCIDRListPrint(head); prev = it; } return head; } /** * \brief This function free a IPOnlyCIDRItem list * \param tmphead Pointer to the list */ void IPOnlyCIDRListFree(IPOnlyCIDRItem *tmphead) { SCEnter(); uint32_t i = 0; IPOnlyCIDRItem *it, *next = NULL; if (tmphead == NULL) { SCLogDebug("temphead is NULL"); return; } it = tmphead; next = it->next; while (it != NULL) { i++; SCFree(it); SCLogDebug("Item(%p) %"PRIu32" removed", it, i); it = next; if (next != NULL) next = next->next; } SCReturn; } /** * \brief This function update a list of IPOnlyCIDRItems * setting the signature internal id (signum) to "i" * * \param tmphead Pointer to the list * \param i number of signature internal id */ static void IPOnlyCIDRListSetSigNum(IPOnlyCIDRItem *tmphead, SigIntId i) { while (tmphead != NULL) { tmphead->signum = i; tmphead = tmphead->next; } } #ifdef UNITTESTS /** * \brief This function print a IPOnlyCIDRItem list * \param tmphead Pointer to the head of IPOnlyCIDRItems list */ static void IPOnlyCIDRListPrint(IPOnlyCIDRItem *tmphead) { uint32_t i = 0; while (tmphead != NULL) { i++; SCLogDebug("Item %"PRIu32" has netmask %"PRIu16" negated:" " %s; IP: %s; signum: %"PRIu16, i, tmphead->netmask, (tmphead->negated) ? "yes":"no", inet_ntoa(*(struct in_addr*)&tmphead->ip[0]), tmphead->signum); tmphead = tmphead->next; } } #endif /** * \brief This function print a SigNumArray, it's used with the * radix tree print function to help debugging * \param tmp Pointer to the head of SigNumArray */ static void SigNumArrayPrint(void *tmp) { SigNumArray *sna = (SigNumArray *)tmp; uint32_t u; for (u = 0; u < sna->size; u++) { uint8_t bitarray = sna->array[u]; uint8_t i = 0; for (; i < 8; i++) { if (bitarray & 0x01) printf(", %"PRIu32"", u * 8 + i); else printf(", "); bitarray = bitarray >> 1; } } } /** * \brief This function creates a new SigNumArray with the * size fixed to the io_ctx->max_idx * \param de_ctx Pointer to the current detection context * \param io_ctx Pointer to the current ip only context * * \retval SigNumArray address of the new instance */ static SigNumArray *SigNumArrayNew(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) { SigNumArray *new = SCMalloc(sizeof(SigNumArray)); if (unlikely(new == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigNumArrayNew. Exiting..."); exit(EXIT_FAILURE); } memset(new, 0, sizeof(SigNumArray)); new->array = SCMalloc(io_ctx->max_idx / 8 + 1); if (new->array == NULL) { exit(EXIT_FAILURE); } memset(new->array, 0, io_ctx->max_idx / 8 + 1); new->size = io_ctx->max_idx / 8 + 1; SCLogDebug("max idx= %u", io_ctx->max_idx); return new; } /** * \brief This function creates a new SigNumArray with the * same data as the argument * * \param orig Pointer to the original SigNumArray to copy * * \retval SigNumArray address of the new instance */ static SigNumArray *SigNumArrayCopy(SigNumArray *orig) { SigNumArray *new = SCMalloc(sizeof(SigNumArray)); if (unlikely(new == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigNumArrayCopy. Exiting..."); exit(EXIT_FAILURE); } memset(new, 0, sizeof(SigNumArray)); new->size = orig->size; new->array = SCMalloc(orig->size); if (new->array == NULL) { exit(EXIT_FAILURE); } memcpy(new->array, orig->array, orig->size); return new; } /** * \brief This function free() a SigNumArray * \param orig Pointer to the original SigNumArray to copy */ static void SigNumArrayFree(void *tmp) { SigNumArray *sna = (SigNumArray *)tmp; if (sna == NULL) return; if (sna->array != NULL) SCFree(sna->array); SCFree(sna); } /** * \brief This function parses and return a list of IPOnlyCIDRItem * * \param s Pointer to the string of the addresses * (in the format of signatures) * \param negate flag to indicate if all this string is negated or not * * \retval 0 if success * \retval -1 if fails */ static IPOnlyCIDRItem *IPOnlyCIDRListParse2(const DetectEngineCtx *de_ctx, char *s, int negate) { size_t x = 0; size_t u = 0; int o_set = 0, n_set = 0, d_set = 0; int depth = 0; size_t size = strlen(s); char address[8196] = ""; char *rule_var_address = NULL; char *temp_rule_var_address = NULL; IPOnlyCIDRItem *head; IPOnlyCIDRItem *subhead; head = subhead = NULL; SCLogDebug("s %s negate %s", s, negate ? "true" : "false"); for (u = 0, x = 0; u < size && x < sizeof(address); u++) { address[x] = s[u]; x++; if (!o_set && s[u] == '!') { n_set = 1; x--; } else if (s[u] == '[') { if (!o_set) { o_set = 1; x = 0; } depth++; } else if (s[u] == ']') { if (depth == 1) { address[x - 1] = '\0'; x = 0; if ( (subhead = IPOnlyCIDRListParse2(de_ctx, address, (negate + n_set) % 2)) == NULL) goto error; head = IPOnlyCIDRItemInsert(head, subhead); n_set = 0; } depth--; } else if (depth == 0 && s[u] == ',') { if (o_set == 1) { o_set = 0; } else if (d_set == 1) { address[x - 1] = '\0'; rule_var_address = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_ADDRESS_GROUPS); if (rule_var_address == NULL) goto error; temp_rule_var_address = rule_var_address; if ((negate + n_set) % 2) { temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3); if (unlikely(temp_rule_var_address == NULL)) { goto error; } snprintf(temp_rule_var_address, strlen(rule_var_address) + 3, "[%s]", rule_var_address); } subhead = IPOnlyCIDRListParse2(de_ctx, temp_rule_var_address, (negate + n_set) % 2); head = IPOnlyCIDRItemInsert(head, subhead); d_set = 0; n_set = 0; if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); } else { address[x - 1] = '\0'; subhead = IPOnlyCIDRItemNew(); if (subhead == NULL) goto error; if (!((negate + n_set) % 2)) subhead->negated = 0; else subhead->negated = 1; if (IPOnlyCIDRItemSetup(subhead, address) < 0) { IPOnlyCIDRListFree(subhead); subhead = NULL; goto error; } head = IPOnlyCIDRItemInsert(head, subhead); n_set = 0; } x = 0; } else if (depth == 0 && s[u] == '$') { d_set = 1; } else if (depth == 0 && u == size - 1) { if (x == sizeof(address)) { address[x - 1] = '\0'; } else { address[x] = '\0'; } x = 0; if (d_set == 1) { rule_var_address = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_ADDRESS_GROUPS); if (rule_var_address == NULL) goto error; temp_rule_var_address = rule_var_address; if ((negate + n_set) % 2) { temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3); if (unlikely(temp_rule_var_address == NULL)) { goto error; } snprintf(temp_rule_var_address, strlen(rule_var_address) + 3, "[%s]", rule_var_address); } subhead = IPOnlyCIDRListParse2(de_ctx, temp_rule_var_address, (negate + n_set) % 2); head = IPOnlyCIDRItemInsert(head, subhead); d_set = 0; if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); } else { subhead = IPOnlyCIDRItemNew(); if (subhead == NULL) goto error; if (!((negate + n_set) % 2)) subhead->negated = 0; else subhead->negated = 1; if (IPOnlyCIDRItemSetup(subhead, address) < 0) { IPOnlyCIDRListFree(subhead); subhead = NULL; goto error; } head = IPOnlyCIDRItemInsert(head, subhead); } n_set = 0; } } return head; error: SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC,"Error parsing addresses"); return head; } /** * \brief Parses an address group sent as a character string and updates the * IPOnlyCIDRItem list * * \param gh Pointer to the IPOnlyCIDRItem list * \param str Pointer to the character string containing the address group * that has to be parsed. * * \retval 0 On success. * \retval -1 On failure. */ static int IPOnlyCIDRListParse(const DetectEngineCtx *de_ctx, IPOnlyCIDRItem **gh, char *str) { SCLogDebug("gh %p, str %s", gh, str); if (gh == NULL) goto error; *gh = IPOnlyCIDRListParse2(de_ctx, str, 0); if (*gh == NULL) { SCLogDebug("DetectAddressParse2 returned null"); goto error; } return 0; error: return -1; } /** * \brief Parses an address group sent as a character string and updates the * IPOnlyCIDRItem lists src and dst of the Signature *s * * \param s Pointer to the signature structure * \param addrstr Pointer to the character string containing the address group * that has to be parsed. * \param flag to indicate if we are parsing the src string or the dst string * * \retval 0 On success. * \retval -1 On failure. */ int IPOnlySigParseAddress(const DetectEngineCtx *de_ctx, Signature *s, const char *addrstr, char flag) { SCLogDebug("Address Group \"%s\" to be parsed now", addrstr); IPOnlyCIDRItem *tmp = NULL; /* pass on to the address(list) parser */ if (flag == 0) { if (strcasecmp(addrstr, "any") == 0) { s->flags |= SIG_FLAG_SRC_ANY; if (IPOnlyCIDRListParse(de_ctx, &s->CidrSrc, (char *)"0.0.0.0/0") < 0) goto error; if (IPOnlyCIDRListParse(de_ctx, &tmp, (char *)"::/0") < 0) goto error; s->CidrSrc = IPOnlyCIDRItemInsert(s->CidrSrc, tmp); } else if (IPOnlyCIDRListParse(de_ctx, &s->CidrSrc, (char *)addrstr) < 0) { goto error; } /* IPOnlyCIDRListPrint(s->CidrSrc); */ } else { if (strcasecmp(addrstr, "any") == 0) { s->flags |= SIG_FLAG_DST_ANY; if (IPOnlyCIDRListParse(de_ctx, &tmp, (char *)"0.0.0.0/0") < 0) goto error; if (IPOnlyCIDRListParse(de_ctx, &s->CidrDst, (char *)"::/0") < 0) goto error; s->CidrDst = IPOnlyCIDRItemInsert(s->CidrDst, tmp); } else if (IPOnlyCIDRListParse(de_ctx, &s->CidrDst, (char *)addrstr) < 0) { goto error; } /* IPOnlyCIDRListPrint(s->CidrDst); */ } return 0; error: SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC, "failed to parse addresses"); return -1; } /** * \brief Setup the IP Only detection engine context * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only detection engine */ void IPOnlyInit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) { io_ctx->sig_init_size = DetectEngineGetMaxSigId(de_ctx) / 8 + 1; if ( (io_ctx->sig_init_array = SCMalloc(io_ctx->sig_init_size)) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in IPOnlyInit. Exiting..."); exit(EXIT_FAILURE); } memset(io_ctx->sig_init_array, 0, io_ctx->sig_init_size); io_ctx->tree_ipv4src = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint); io_ctx->tree_ipv4dst = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint); io_ctx->tree_ipv6src = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint); io_ctx->tree_ipv6dst = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint); } /** * \brief Setup the IP Only thread detection engine context * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only thread detection engine */ void DetectEngineIPOnlyThreadInit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyThreadCtx *io_tctx) { /* initialize the signature bitarray */ io_tctx->sig_match_size = de_ctx->io_ctx.max_idx / 8 + 1; io_tctx->sig_match_array = SCMalloc(io_tctx->sig_match_size); if (io_tctx->sig_match_array == NULL) { exit(EXIT_FAILURE); } memset(io_tctx->sig_match_array, 0, io_tctx->sig_match_size); } /** * \brief Print stats of the IP Only engine * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only detection engine */ void IPOnlyPrint(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) { /* XXX: how are we going to print the stats now? */ } /** * \brief Deinitialize the IP Only detection engine context * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only detection engine */ void IPOnlyDeinit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx) { if (io_ctx == NULL) return; if (io_ctx->tree_ipv4src != NULL) SCRadixReleaseRadixTree(io_ctx->tree_ipv4src); io_ctx->tree_ipv4src = NULL; if (io_ctx->tree_ipv4dst != NULL) SCRadixReleaseRadixTree(io_ctx->tree_ipv4dst); io_ctx->tree_ipv4dst = NULL; if (io_ctx->tree_ipv6src != NULL) SCRadixReleaseRadixTree(io_ctx->tree_ipv6src); io_ctx->tree_ipv6src = NULL; if (io_ctx->tree_ipv6dst != NULL) SCRadixReleaseRadixTree(io_ctx->tree_ipv6dst); io_ctx->tree_ipv6dst = NULL; if (io_ctx->sig_init_array) SCFree(io_ctx->sig_init_array); io_ctx->sig_init_array = NULL; } /** * \brief Deinitialize the IP Only thread detection engine context * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only detection engine */ void DetectEngineIPOnlyThreadDeinit(DetectEngineIPOnlyThreadCtx *io_tctx) { SCFree(io_tctx->sig_match_array); } static inline int IPOnlyMatchCompatSMs(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_MATCH); SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (sm != NULL) { BUG_ON(!(sigmatch_table[sm->type].flags & SIGMATCH_IPONLY_COMPAT)); KEYWORD_PROFILING_START; if (sigmatch_table[sm->type].Match(tv, det_ctx, p, s, sm->ctx) > 0) { KEYWORD_PROFILING_END(det_ctx, sm->type, 1); sm = sm->next; continue; } KEYWORD_PROFILING_END(det_ctx, sm->type, 0); return 0; } return 1; } /** * \brief Match a packet against the IP Only detection engine contexts * * \param de_ctx Pointer to the current detection engine * \param io_ctx Pointer to the current ip only detection engine * \param io_ctx Pointer to the current ip only thread detection engine * \param p Pointer to the Packet to match against */ void IPOnlyMatchPacket(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, DetectEngineIPOnlyCtx *io_ctx, DetectEngineIPOnlyThreadCtx *io_tctx, Packet *p) { SigNumArray *src = NULL; SigNumArray *dst = NULL; void *user_data_src = NULL, *user_data_dst = NULL; if (p->src.family == AF_INET) { (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)&GET_IPV4_SRC_ADDR_U32(p), io_ctx->tree_ipv4src, &user_data_src); } else if (p->src.family == AF_INET6) { (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)&GET_IPV6_SRC_ADDR(p), io_ctx->tree_ipv6src, &user_data_src); } if (p->dst.family == AF_INET) { (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)&GET_IPV4_DST_ADDR_U32(p), io_ctx->tree_ipv4dst, &user_data_dst); } else if (p->dst.family == AF_INET6) { (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)&GET_IPV6_DST_ADDR(p), io_ctx->tree_ipv6dst, &user_data_dst); } src = user_data_src; dst = user_data_dst; if (src == NULL || dst == NULL) return; uint32_t u; for (u = 0; u < src->size; u++) { SCLogDebug("And %"PRIu8" & %"PRIu8, src->array[u], dst->array[u]); /* The final results will be at io_tctx */ io_tctx->sig_match_array[u] = dst->array[u] & src->array[u]; /* We have to move the logic of the signature checking * to the main detect loop, in order to apply the * priority of actions (pass, drop, reject, alert) */ if (io_tctx->sig_match_array[u] != 0) { /* We have a match :) Let's see from which signum's */ uint8_t bitarray = io_tctx->sig_match_array[u]; uint8_t i = 0; for (; i < 8; i++, bitarray = bitarray >> 1) { if (bitarray & 0x01) { Signature *s = de_ctx->sig_array[u * 8 + i]; if ((s->proto.flags & DETECT_PROTO_IPV4) && !PKT_IS_IPV4(p)) { SCLogDebug("ip version didn't match"); continue; } if ((s->proto.flags & DETECT_PROTO_IPV6) && !PKT_IS_IPV6(p)) { SCLogDebug("ip version didn't match"); continue; } if (DetectProtoContainsProto(&s->proto, IP_GET_IPPROTO(p)) == 0) { SCLogDebug("proto didn't match"); continue; } /* check the source & dst port in the sig */ if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) { if (!(s->flags & SIG_FLAG_DP_ANY)) { if (p->flags & PKT_IS_FRAGMENT) continue; DetectPort *dport = DetectPortLookupGroup(s->dp,p->dp); if (dport == NULL) { SCLogDebug("dport didn't match."); continue; } } if (!(s->flags & SIG_FLAG_SP_ANY)) { if (p->flags & PKT_IS_FRAGMENT) continue; DetectPort *sport = DetectPortLookupGroup(s->sp,p->sp); if (sport == NULL) { SCLogDebug("sport didn't match."); continue; } } } else if ((s->flags & (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) != (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) { SCLogDebug("port-less protocol and sig needs ports"); continue; } if (!IPOnlyMatchCompatSMs(tv, det_ctx, s, p)) { continue; } SCLogDebug("Signum %"PRIu16" match (sid: %"PRIu16", msg: %s)", u * 8 + i, s->id, s->msg); if (s->sm_arrays[DETECT_SM_LIST_POSTMATCH] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_POSTMATCH); SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_POSTMATCH]; SCLogDebug("running match functions, sm %p", smd); if (smd != NULL) { while (1) { KEYWORD_PROFILING_START; (void)sigmatch_table[smd->type].Match(tv, det_ctx, p, s, smd->ctx); KEYWORD_PROFILING_END(det_ctx, smd->type, 1); if (smd->is_last) break; smd++; } } } if (!(s->flags & SIG_FLAG_NOALERT)) { if (s->action & ACTION_DROP) PacketAlertAppend(det_ctx, s, p, 0, PACKET_ALERT_FLAG_DROP_FLOW); else PacketAlertAppend(det_ctx, s, p, 0, 0); } else { /* apply actions for noalert/rule suppressed as well */ DetectSignatureApplyActions(p, s); } } } } } } /** * \brief Build the radix trees from the lists of parsed adresses in CIDR format * the result should be 4 radix trees: src/dst ipv4 and src/dst ipv6 * holding SigNumArrays, each of them with a hierarchical relation * of subnets and hosts * * \param de_ctx Pointer to the current detection engine */ void IPOnlyPrepare(DetectEngineCtx *de_ctx) { SCLogDebug("Preparing Final Lists"); /* IPOnlyCIDRListPrint((de_ctx->io_ctx).ip_src); IPOnlyCIDRListPrint((de_ctx->io_ctx).ip_dst); */ IPOnlyCIDRItem *src, *dst; SCRadixNode *node = NULL; /* Prepare Src radix trees */ for (src = (de_ctx->io_ctx).ip_src; src != NULL; ) { if (src->family == AF_INET) { /* SCLogDebug("To IPv4"); SCLogDebug("Item has netmask %"PRIu16" negated: %s; IP: %s; " "signum: %"PRIu16, src->netmask, (src->negated) ? "yes":"no", inet_ntoa( *(struct in_addr*)&src->ip[0]), src->signum); */ void *user_data = NULL; if (src->netmask == 32) (void)SCRadixFindKeyIPV4ExactMatch((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, &user_data); else (void)SCRadixFindKeyIPV4Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, src->netmask, &user_data); if (user_data == NULL) { SCLogDebug("Exact match not found"); /** Not found, look if there's a subnet of this range with * bigger netmask */ (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, &user_data); if (user_data == NULL) { SCLogDebug("best match not found"); /* Not found, insert a new one */ SigNumArray *sna = SigNumArrayNew(de_ctx, &de_ctx->io_ctx); /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; if (src->netmask == 32) node = SCRadixAddKeyIPV4((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, sna); else node = SCRadixAddKeyIPV4Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, sna, src->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the " "src ipv4 radix tree"); } else { SCLogDebug("Best match found"); /* Found, copy the sig num table, add this signum and insert */ SigNumArray *sna = NULL; sna = SigNumArrayCopy((SigNumArray *) user_data); /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; if (src->netmask == 32) node = SCRadixAddKeyIPV4((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, sna); else node = SCRadixAddKeyIPV4Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv4src, sna, src->netmask); if (node == NULL) { char tmpstr[64]; PrintInet(src->family, &src->ip[0], tmpstr, sizeof(tmpstr)); SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the" " src ipv4 radix tree ip %s netmask %"PRIu8, tmpstr, src->netmask); //SCRadixPrintTree((de_ctx->io_ctx).tree_ipv4src); exit(-1); } } } else { SCLogDebug("Exact match found"); /* it's already inserted. Update it */ SigNumArray *sna = (SigNumArray *)user_data; /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; } } else if (src->family == AF_INET6) { SCLogDebug("To IPv6"); void *user_data = NULL; if (src->netmask == 128) (void)SCRadixFindKeyIPV6ExactMatch((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, &user_data); else (void)SCRadixFindKeyIPV6Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, src->netmask, &user_data); if (user_data == NULL) { /* Not found, look if there's a subnet of this range with bigger netmask */ (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, &user_data); if (user_data == NULL) { /* Not found, insert a new one */ SigNumArray *sna = SigNumArrayNew(de_ctx, &de_ctx->io_ctx); /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; if (src->netmask == 128) node = SCRadixAddKeyIPV6((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, sna); else node = SCRadixAddKeyIPV6Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, sna, src->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the src " "ipv6 radix tree"); } else { /* Found, copy the sig num table, add this signum and insert */ SigNumArray *sna = NULL; sna = SigNumArrayCopy((SigNumArray *)user_data); /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; if (src->netmask == 128) node = SCRadixAddKeyIPV6((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, sna); else node = SCRadixAddKeyIPV6Netblock((uint8_t *)&src->ip[0], (de_ctx->io_ctx).tree_ipv6src, sna, src->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the src " "ipv6 radix tree"); } } else { /* it's already inserted. Update it */ SigNumArray *sna = (SigNumArray *)user_data; /* Update the sig */ uint8_t tmp = 1 << (src->signum % 8); if (src->negated > 0) /* Unset it */ sna->array[src->signum / 8] &= ~tmp; else /* Set it */ sna->array[src->signum / 8] |= tmp; } } IPOnlyCIDRItem *tmpaux = src; src = src->next; SCFree(tmpaux); } SCLogDebug("dsts:"); /* Prepare Dst radix trees */ for (dst = (de_ctx->io_ctx).ip_dst; dst != NULL; ) { if (dst->family == AF_INET) { SCLogDebug("To IPv4"); SCLogDebug("Item has netmask %"PRIu16" negated: %s; IP: %s; signum:" " %"PRIu16"", dst->netmask, (dst->negated)?"yes":"no", inet_ntoa(*(struct in_addr*)&dst->ip[0]), dst->signum); void *user_data = NULL; if (dst->netmask == 32) (void) SCRadixFindKeyIPV4ExactMatch((uint8_t *) &dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, &user_data); else (void) SCRadixFindKeyIPV4Netblock((uint8_t *) &dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, dst->netmask, &user_data); if (user_data == NULL) { SCLogDebug("Exact match not found"); /** * Not found, look if there's a subnet of this range * with bigger netmask */ (void) SCRadixFindKeyIPV4BestMatch((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, &user_data); if (user_data == NULL) { SCLogDebug("Best match not found"); /** Not found, insert a new one */ SigNumArray *sna = SigNumArrayNew(de_ctx, &de_ctx->io_ctx); /** Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /** Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /** Set it */ sna->array[dst->signum / 8] |= tmp; if (dst->netmask == 32) node = SCRadixAddKeyIPV4((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, sna); else node = SCRadixAddKeyIPV4Netblock((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, sna, dst->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the dst " "ipv4 radix tree"); } else { SCLogDebug("Best match found"); /* Found, copy the sig num table, add this signum and insert */ SigNumArray *sna = NULL; sna = SigNumArrayCopy((SigNumArray *) user_data); /* Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /* Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /* Set it */ sna->array[dst->signum / 8] |= tmp; if (dst->netmask == 32) node = SCRadixAddKeyIPV4((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, sna); else node = SCRadixAddKeyIPV4Netblock((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv4dst, sna, dst->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the dst " "ipv4 radix tree"); } } else { SCLogDebug("Exact match found"); /* it's already inserted. Update it */ SigNumArray *sna = (SigNumArray *)user_data; /* Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /* Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /* Set it */ sna->array[dst->signum / 8] |= tmp; } } else if (dst->family == AF_INET6) { SCLogDebug("To IPv6"); void *user_data = NULL; if (dst->netmask == 128) (void) SCRadixFindKeyIPV6ExactMatch((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, &user_data); else (void) SCRadixFindKeyIPV6Netblock((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, dst->netmask, &user_data); if (user_data == NULL) { /** Not found, look if there's a subnet of this range with * bigger netmask */ (void) SCRadixFindKeyIPV6BestMatch((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, &user_data); if (user_data == NULL) { /* Not found, insert a new one */ SigNumArray *sna = SigNumArrayNew(de_ctx, &de_ctx->io_ctx); /* Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /* Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /* Set it */ sna->array[dst->signum / 8] |= tmp; if (dst->netmask == 128) node = SCRadixAddKeyIPV6((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, sna); else node = SCRadixAddKeyIPV6Netblock((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, sna, dst->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the dst " "ipv6 radix tree"); } else { /* Found, copy the sig num table, add this signum and insert */ SigNumArray *sna = NULL; sna = SigNumArrayCopy((SigNumArray *)user_data); /* Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /* Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /* Set it */ sna->array[dst->signum / 8] |= tmp; if (dst->netmask == 128) node = SCRadixAddKeyIPV6((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, sna); else node = SCRadixAddKeyIPV6Netblock((uint8_t *)&dst->ip[0], (de_ctx->io_ctx).tree_ipv6dst, sna, dst->netmask); if (node == NULL) SCLogError(SC_ERR_IPONLY_RADIX, "Error inserting in the dst " "ipv6 radix tree"); } } else { /* it's already inserted. Update it */ SigNumArray *sna = (SigNumArray *)user_data; /* Update the sig */ uint8_t tmp = 1 << (dst->signum % 8); if (dst->negated > 0) /* Unset it */ sna->array[dst->signum / 8] &= ~tmp; else /* Set it */ sna->array[dst->signum / 8] |= tmp; } } IPOnlyCIDRItem *tmpaux = dst; dst = dst->next; SCFree(tmpaux); } /* print all the trees: for debuggin it might print too much info SCLogDebug("Radix tree src ipv4:"); SCRadixPrintTree((de_ctx->io_ctx).tree_ipv4src); SCLogDebug("Radix tree src ipv6:"); SCRadixPrintTree((de_ctx->io_ctx).tree_ipv6src); SCLogDebug("__________________"); SCLogDebug("Radix tree dst ipv4:"); SCRadixPrintTree((de_ctx->io_ctx).tree_ipv4dst); SCLogDebug("Radix tree dst ipv6:"); SCRadixPrintTree((de_ctx->io_ctx).tree_ipv6dst); SCLogDebug("__________________"); */ } /** * \brief Add a signature to the lists of Adrresses in CIDR format (sorted) * this step is necesary to build the radix tree with a hierarchical * relation between nodes * \param de_ctx Pointer to the current detection engine context * \param de_ctx Pointer to the current ip only detection engine contest * \param s Pointer to the current signature */ void IPOnlyAddSignature(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx, Signature *s) { if (!(s->flags & SIG_FLAG_IPONLY)) return; /* Set the internal signum to the list before merging */ IPOnlyCIDRListSetSigNum(s->CidrSrc, s->num); IPOnlyCIDRListSetSigNum(s->CidrDst, s->num); /** * ipv4 and ipv6 are mixed, but later we will separate them into * different trees */ io_ctx->ip_src = IPOnlyCIDRItemInsert(io_ctx->ip_src, s->CidrSrc); io_ctx->ip_dst = IPOnlyCIDRItemInsert(io_ctx->ip_dst, s->CidrDst); if (s->num > io_ctx->max_idx) io_ctx->max_idx = s->num; /* enable the sig in the bitarray */ io_ctx->sig_init_array[(s->num/8)] |= 1 << (s->num % 8); /** no longer ref to this, it's in the table now */ s->CidrSrc = NULL; s->CidrDst = NULL; } #ifdef UNITTESTS /** * \test check that we set a Signature as IPOnly because it has no rule * option appending a SigMatch and no port is fixed */ static int IPOnlyTestSig01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; Signature *s = SigInit(de_ctx,"alert tcp any any -> any any (sid:400001; rev:1;)"); FAIL_IF(s == NULL); FAIL_IF(SignatureIsIPOnly(de_ctx, s) == 0); SigFree(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test check that we dont set a Signature as IPOnly because it has no rule * option appending a SigMatch but a port is fixed */ static int IPOnlyTestSig02 (void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; Signature *s = SigInit(de_ctx,"alert tcp any any -> any 80 (sid:400001; rev:1;)"); FAIL_IF(s == NULL); FAIL_IF(SignatureIsIPOnly(de_ctx, s) == 0); SigFree(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test check that we set dont set a Signature as IPOnly * because it has rule options appending a SigMatch like content, and pcre */ static int IPOnlyTestSig03 (void) { int result = 1; DetectEngineCtx *de_ctx; Signature *s=NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; /* combination of pcre and content */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (pcre and content) \"; content:\"php\"; pcre:\"/require(_once)?/i\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (content): "); result=0; } SigFree(s); /* content */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (content) \"; content:\"match something\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (content): "); result=0; } SigFree(s); /* uricontent */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (uricontent) \"; uricontent:\"match something\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (uricontent): "); result=0; } SigFree(s); /* pcre */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (pcre) \"; pcre:\"/e?idps rule[sz]/i\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (pcre): "); result=0; } SigFree(s); /* flow */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (flow) \"; flow:to_server; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (flow): "); result=0; } SigFree(s); /* dsize */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (dsize) \"; dsize:100; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (dsize): "); result=0; } SigFree(s); /* flowbits */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (flowbits) \"; flowbits:unset; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (flowbits): "); result=0; } SigFree(s); /* flowvar */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (flowvar) \"; pcre:\"/(?.*)/i\"; flowvar:var,\"str\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (flowvar): "); result=0; } SigFree(s); /* pktvar */ s = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest40-03 sig is not IPOnly (pktvar) \"; pcre:\"/(?.*)/i\"; pktvar:var,\"str\"; classtype:misc-activity; sid:400001; rev:1;)"); if (s == NULL) { goto end; } if(SignatureIsIPOnly(de_ctx, s)) { printf("got a IPOnly signature (pktvar): "); result=0; } SigFree(s); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test */ static int IPOnlyTestSig04 (void) { int result = 1; IPOnlyCIDRItem *head = NULL; IPOnlyCIDRItem *new; new = IPOnlyCIDRItemNew(); new->netmask= 10; head = IPOnlyCIDRItemInsert(head, new); new = IPOnlyCIDRItemNew(); new->netmask= 11; head = IPOnlyCIDRItemInsert(head, new); new = IPOnlyCIDRItemNew(); new->netmask= 9; head = IPOnlyCIDRItemInsert(head, new); new = IPOnlyCIDRItemNew(); new->netmask= 10; head = IPOnlyCIDRItemInsert(head, new); new = IPOnlyCIDRItemNew(); new->netmask= 10; head = IPOnlyCIDRItemInsert(head, new); IPOnlyCIDRListPrint(head); new = head; if (new->netmask != 9) { result = 0; goto end; } new = new->next; if (new->netmask != 10) { result = 0; goto end; } new = new->next; if (new->netmask != 10) { result = 0; goto end; } new = new->next; if (new->netmask != 10) { result = 0; goto end; } new = new->next; if (new->netmask != 11) { result = 0; goto end; } end: IPOnlyCIDRListFree(head); return result; } /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (all should match) */ int IPOnlyTestSig05(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); char *sigs[numsigs]; sigs[0]= "alert tcp 192.168.1.5 any -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp any any -> 192.168.1.1 any (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp 192.168.1.0/24 any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp 192.168.1.0/24 any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 7)\"; content:\"Hi all\";sid:7;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 1, 1, 1, 1, 1, 1, 1}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (none should match) */ int IPOnlyTestSig06(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, "80.58.0.33", "195.235.113.3"); char *sigs[numsigs]; sigs[0]= "alert tcp 192.168.1.5 any -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp any any -> 192.168.1.1 any (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp 192.168.1.0/24 any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp 192.168.1.0/24 any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 7)\"; content:\"Hi all\";sid:7;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 0, 0, 0, 0, 0, 0, 0}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /* \todo fix it. We have disabled this unittest because 599 exposes 608, * which is why these unittests fail. When we fix 608, we need to renable * these sigs */ #if 0 /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (all should match) */ int IPOnlyTestSig07(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); char *sigs[numsigs]; sigs[0]= "alert tcp 192.168.1.5 any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp [192.168.1.2,192.168.1.5,192.168.1.4] any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp [192.168.1.0/24,!192.168.1.1] any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp [192.0.0.0/8,!192.168.0.0/16,192.168.1.0/24,!192.168.1.1] any -> [192.168.1.0/24,!192.168.1.5] any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> [192.168.0.0/16,!192.168.1.0/24,192.168.1.1] any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp [78.129.202.0/24,192.168.1.5,78.129.205.64,78.129.214.103,78.129.223.19,78.129.233.17,78.137.168.33,78.140.132.11,78.140.133.15,78.140.138.105,78.140.139.105,78.140.141.107,78.140.141.114,78.140.143.103,78.140.143.13,78.140.145.144,78.140.170.164,78.140.23.18,78.143.16.7,78.143.46.124,78.157.129.71] any -> 192.168.1.1 any (msg:\"ET RBN Known Russian Business Network IP TCP - BLOCKING (246)\"; sid:7;)"; /* real sid:"2407490" */ /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 1, 1, 1, 1, 1, 1, 1}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } #endif /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (none should match) */ int IPOnlyTestSig08(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_TCP,"192.168.1.1","192.168.1.5"); char *sigs[numsigs]; sigs[0]= "alert tcp 192.168.1.5 any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp [192.168.1.2,192.168.1.5,192.168.1.4] any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp [192.168.1.0/24,!192.168.1.1] any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp [192.0.0.0/8,!192.168.0.0/16,192.168.1.0/24,!192.168.1.1] any -> [192.168.1.0/24,!192.168.1.5] any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp any any -> !192.168.1.5 any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> [192.168.0.0/16,!192.168.1.0/24,192.168.1.1] any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp [78.129.202.0/24,192.168.1.5,78.129.205.64,78.129.214.103,78.129.223.19,78.129.233.17,78.137.168.33,78.140.132.11,78.140.133.15,78.140.138.105,78.140.139.105,78.140.141.107,78.140.141.114,78.140.143.103,78.140.143.13,78.140.145.144,78.140.170.164,78.140.23.18,78.143.16.7,78.143.46.124,78.157.129.71] any -> 192.168.1.1 any (msg:\"ET RBN Known Russian Business Network IP TCP - BLOCKING (246)\"; sid:7;)"; /* real sid:"2407490" */ /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 0, 0, 0, 0, 0, 0, 0}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (all should match) */ int IPOnlyTestSig09(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacketIPV6SrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565", "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562"); char *sigs[numsigs]; sigs[0]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp any any -> 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 any (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> 3FFE:FFFF:7654:FEDA:1245:BA98:3210:0/96 any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp 3FFE:FFFF:7654:FEDA:0:0:0:0/64 any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> 3FFE:FFFF:7654:FEDA:0:0:0:0/64 any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp 3FFE:FFFF:7654:FEDA:0:0:0:0/64 any -> 3FFE:FFFF:7654:FEDA:0:0:0:0/64 any (msg:\"Testing src/dst ip (sid 7)\"; content:\"Hi all\";sid:7;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 1, 1, 1, 1, 1, 1, 1}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (none should match) */ int IPOnlyTestSig10(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; p[0] = UTHBuildPacketIPV6SrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562", "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565"); char *sigs[numsigs]; sigs[0]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp any any -> 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 any (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565 any -> !3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562/96 any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp !3FFE:FFFF:7654:FEDA:0:0:0:0/64 any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> !3FFE:FFFF:7654:FEDA:0:0:0:0/64 any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp 3FFE:FFFF:7654:FEDA:0:0:0:0/64 any -> 3FFE:FFFF:7654:FEDB:0:0:0:0/64 any (msg:\"Testing src/dst ip (sid 7)\"; content:\"Hi all\";sid:7;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 0, 0, 0, 0, 0, 0, 0}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /* \todo fix it. We have disabled this unittest because 599 exposes 608, * which is why these unittests fail. When we fix 608, we need to renable * these sigs */ #if 0 /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (all should match) with ipv4 and ipv6 mixed */ int IPOnlyTestSig11(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 2; uint8_t numsigs = 7; Packet *p[2]; p[0] = UTHBuildPacketIPV6SrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565", "3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562"); p[1] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_TCP,"192.168.1.1","192.168.1.5"); char *sigs[numsigs]; sigs[0]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.1 any -> 3FFE:FFFF:7654:FEDA:0:0:0:0/64,192.168.1.5 any (msg:\"Testing src/dst ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp [192.168.1.1,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.4,192.168.1.5,!192.168.1.0/24] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.0/24] any (msg:\"Testing src/dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp [3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.1] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.5] any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp [3FFE:FFFF:0:0:0:0:0:0/32,!3FFE:FFFF:7654:FEDA:0:0:0:0/64,3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.1] any -> [3FFE:FFFF:7654:FEDA:0:0:0:0/64,192.168.1.0/24,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565] any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp any any -> any any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> [3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:0:0:0:0/64,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.5] any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp [78.129.202.0/24,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.1,78.129.205.64,78.129.214.103,78.129.223.19,78.129.233.17,78.137.168.33,78.140.132.11,78.140.133.15,78.140.138.105,78.140.139.105,78.140.141.107,78.140.141.114,78.140.143.103,78.140.143.13,78.140.145.144,78.140.170.164,78.140.23.18,78.143.16.7,78.143.46.124,78.157.129.71] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.0.0.0/8] any (msg:\"ET RBN Known Russian Business Network IP TCP - BLOCKING (246)\"; sid:7;)"; /* real sid:"2407490" */ /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[2][7] = {{ 1, 1, 1, 1, 1, 1, 1}, { 1, 1, 1, 1, 1, 1, 1}}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } #endif /** * \test Test a set of ip only signatures making use a lot of * addresses for src and dst (none should match) with ipv4 and ipv6 mixed */ int IPOnlyTestSig12(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 2; uint8_t numsigs = 7; Packet *p[2]; p[0] = UTHBuildPacketIPV6SrcDst((uint8_t *)buf, buflen, IPPROTO_TCP,"3FBE:FFFF:7654:FEDA:1245:BA98:3210:4562","3FBE:FFFF:7654:FEDA:1245:BA98:3210:4565"); p[1] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_TCP,"195.85.1.1","80.198.1.5"); char *sigs[numsigs]; sigs[0]= "alert tcp 3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.1 any -> 3FFE:FFFF:7654:FEDA:0:0:0:0/64,192.168.1.5 any (msg:\"Testing src/dst ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp [192.168.1.1,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.4,192.168.1.5,!192.168.1.0/24] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.0/24] any (msg:\"Testing src/dst ip (sid 2)\"; sid:2;)"; sigs[2]= "alert tcp [3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.1] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.5] any (msg:\"Testing src/dst ip (sid 3)\"; sid:3;)"; sigs[3]= "alert tcp [3FFE:FFFF:0:0:0:0:0:0/32,!3FFE:FFFF:7654:FEDA:0:0:0:0/64,3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.1] any -> [3FFE:FFFF:7654:FEDA:0:0:0:0/64,192.168.1.0/24,!3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565] any (msg:\"Testing src/dst ip (sid 4)\"; sid:4;)"; sigs[4]= "alert tcp any any -> [!3FBE:FFFF:7654:FEDA:1245:BA98:3210:4565,!80.198.1.5] any (msg:\"Testing src/dst ip (sid 5)\"; sid:5;)"; sigs[5]= "alert tcp any any -> [3FFE:FFFF:7654:FEDA:0:0:0:0/64,!3FFE:FFFF:7654:FEDA:0:0:0:0/64,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.168.1.5] any (msg:\"Testing src/dst ip (sid 6)\"; sid:6;)"; sigs[6]= "alert tcp [78.129.202.0/24,3FFE:FFFF:7654:FEDA:1245:BA98:3210:4565,192.168.1.1,78.129.205.64,78.129.214.103,78.129.223.19,78.129.233.17,78.137.168.33,78.140.132.11,78.140.133.15,78.140.138.105,78.140.139.105,78.140.141.107,78.140.141.114,78.140.143.103,78.140.143.13,78.140.145.144,78.140.170.164,78.140.23.18,78.143.16.7,78.143.46.124,78.157.129.71] any -> [3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562,192.0.0.0/8] any (msg:\"ET RBN Known Russian Business Network IP TCP - BLOCKING (246)\"; sid:7;)"; /* real sid:"2407490" */ /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[2][7] = {{ 0, 0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0, 0}}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } static int IPOnlyTestSig13(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; Signature *s = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Test flowbits ip only\"; " "flowbits:set,myflow1; sid:1; rev:1;)"); FAIL_IF(s == NULL); FAIL_IF(SignatureIsIPOnly(de_ctx, s) == 0); SigFree(s); DetectEngineCtxFree(de_ctx); PASS; } static int IPOnlyTestSig14(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; Signature *s = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Test flowbits ip only\"; " "flowbits:set,myflow1; flowbits:isset,myflow2; sid:1; rev:1;)"); FAIL_IF(s == NULL); FAIL_IF(SignatureIsIPOnly(de_ctx, s) == 1); SigFree(s); DetectEngineCtxFree(de_ctx); PASS; } int IPOnlyTestSig15(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 7; Packet *p[1]; Flow f; GenericVar flowvar; memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[0]->flow = &f; p[0]->flow->flowvar = &flowvar; p[0]->flags |= PKT_HAS_FLOW; p[0]->flowflags |= FLOW_PKT_TOSERVER; char *sigs[numsigs]; sigs[0]= "alert tcp 192.168.1.5 any -> any any (msg:\"Testing src ip (sid 1)\"; " "flowbits:set,one; sid:1;)"; sigs[1]= "alert tcp any any -> 192.168.1.1 any (msg:\"Testing dst ip (sid 2)\"; " "flowbits:set,two; sid:2;)"; sigs[2]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 3)\"; " "flowbits:set,three; sid:3;)"; sigs[3]= "alert tcp 192.168.1.5 any -> 192.168.1.1 any (msg:\"Testing src/dst ip (sid 4)\"; " "flowbits:set,four; sid:4;)"; sigs[4]= "alert tcp 192.168.1.0/24 any -> any any (msg:\"Testing src/dst ip (sid 5)\"; " "flowbits:set,five; sid:5;)"; sigs[5]= "alert tcp any any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 6)\"; " "flowbits:set,six; sid:6;)"; sigs[6]= "alert tcp 192.168.1.0/24 any -> 192.168.0.0/16 any (msg:\"Testing src/dst ip (sid 7)\"; " "flowbits:set,seven; content:\"Hi all\"; sid:7;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[7] = { 1, 2, 3, 4, 5, 6, 7}; uint32_t results[7] = { 1, 1, 1, 1, 1, 1, 1}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); FLOW_DESTROY(&f); return result; } /** * \brief Unittest to show #599. We fail to match if we have negated addresses. */ int IPOnlyTestSig16(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 2; Packet *p[1]; p[0] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_TCP, "100.100.0.0", "50.0.0.0"); char *sigs[numsigs]; sigs[0]= "alert tcp !100.100.0.1 any -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert tcp any any -> !50.0.0.1 any (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; /* Sid numbers (we could extract them from the sig) */ uint32_t sid[2] = { 1, 2}; uint32_t results[2] = { 1, 1}; result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } /** * \brief Unittest to show #611. Ports on portless protocols. */ int IPOnlyTestSig17(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); uint8_t numpkts = 1; uint8_t numsigs = 2; Packet *p[1]; p[0] = UTHBuildPacketSrcDst((uint8_t *)buf, buflen, IPPROTO_ICMP, "100.100.0.0", "50.0.0.0"); char *sigs[numsigs]; sigs[0]= "alert ip 100.100.0.0 80 -> any any (msg:\"Testing src ip (sid 1)\"; sid:1;)"; sigs[1]= "alert ip any any -> 50.0.0.0 123 (msg:\"Testing dst ip (sid 2)\"; sid:2;)"; uint32_t sid[2] = { 1, 2}; uint32_t results[2] = { 0, 0}; /* neither should match */ result = UTHGenericTest(p, numpkts, sigs, sid, (uint32_t *) results, numsigs); UTHFreePackets(p, numpkts); return result; } #endif /* UNITTESTS */ void IPOnlyRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("IPOnlyTestSig01", IPOnlyTestSig01); UtRegisterTest("IPOnlyTestSig02", IPOnlyTestSig02); UtRegisterTest("IPOnlyTestSig03", IPOnlyTestSig03); UtRegisterTest("IPOnlyTestSig04", IPOnlyTestSig04); UtRegisterTest("IPOnlyTestSig05", IPOnlyTestSig05); UtRegisterTest("IPOnlyTestSig06", IPOnlyTestSig06); /* \todo fix it. We have disabled this unittest because 599 exposes 608, * which is why these unittests fail. When we fix 608, we need to renable * these sigs */ #if 0 UtRegisterTest("IPOnlyTestSig07", IPOnlyTestSig07, 1); #endif UtRegisterTest("IPOnlyTestSig08", IPOnlyTestSig08); UtRegisterTest("IPOnlyTestSig09", IPOnlyTestSig09); UtRegisterTest("IPOnlyTestSig10", IPOnlyTestSig10); /* \todo fix it. We have disabled this unittest because 599 exposes 608, * which is why these unittests fail. When we fix 608, we need to renable * these sigs */ #if 0 UtRegisterTest("IPOnlyTestSig11", IPOnlyTestSig11, 1); #endif UtRegisterTest("IPOnlyTestSig12", IPOnlyTestSig12); UtRegisterTest("IPOnlyTestSig13", IPOnlyTestSig13); UtRegisterTest("IPOnlyTestSig14", IPOnlyTestSig14); UtRegisterTest("IPOnlyTestSig15", IPOnlyTestSig15); UtRegisterTest("IPOnlyTestSig16", IPOnlyTestSig16); UtRegisterTest("IPOnlyTestSig17", IPOnlyTestSig17); #endif return; } suricata-3.2.1/src/tm-queues.c0000644000000000000000000000635513051004444013103 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Thread module management functions */ #include "suricata.h" #include "threads.h" #include "tm-queues.h" #include "util-debug.h" #define TMQ_MAX_QUEUES 256 static uint16_t tmq_id = 0; static Tmq tmqs[TMQ_MAX_QUEUES]; Tmq* TmqAlloc(void) { Tmq *q = SCMalloc(sizeof(Tmq)); if (unlikely(q == NULL)) goto error; memset(q, 0, sizeof(Tmq)); return q; error: return NULL; } Tmq* TmqCreateQueue(char *name) { if (tmq_id >= TMQ_MAX_QUEUES) goto error; Tmq *q = &tmqs[tmq_id]; q->name = SCStrdup(name); if (q->name == NULL) goto error; q->id = tmq_id++; /* for cuda purposes */ q->q_type = 0; SCLogDebug("created queue \'%s\', %p", name, q); return q; error: SCLogError(SC_ERR_THREAD_QUEUE, "too many thread queues %u, max is %u", tmq_id+1, TMQ_MAX_QUEUES); return NULL; } Tmq* TmqGetQueueByName(char *name) { uint16_t i; for (i = 0; i < tmq_id; i++) { if (strcmp(tmqs[i].name, name) == 0) return &tmqs[i]; } return NULL; } void TmqDebugList(void) { uint16_t i = 0; for (i = 0; i < tmq_id; i++) { /* get a lock accessing the len */ SCMutexLock(&trans_q[tmqs[i].id].mutex_q); printf("TmqDebugList: id %" PRIu32 ", name \'%s\', len %" PRIu32 "\n", tmqs[i].id, tmqs[i].name, trans_q[tmqs[i].id].len); SCMutexUnlock(&trans_q[tmqs[i].id].mutex_q); } } void TmqResetQueues(void) { uint16_t i; for (i = 0; i < TMQ_MAX_QUEUES; i++) { if (tmqs[i].name) { SCFree(tmqs[i].name); } } memset(&tmqs, 0x00, sizeof(tmqs)); tmq_id = 0; } /** * \brief Checks if all the queues allocated so far have at least one reader * and writer. */ void TmValidateQueueState(void) { int i = 0; char err = FALSE; for (i = 0; i < tmq_id; i++) { SCMutexLock(&trans_q[tmqs[i].id].mutex_q); if (tmqs[i].reader_cnt == 0) { SCLogError(SC_ERR_THREAD_QUEUE, "queue \"%s\" doesn't have a reader (id %d, max %u)", tmqs[i].name, i, tmq_id); err = TRUE; } else if (tmqs[i].writer_cnt == 0) { SCLogError(SC_ERR_THREAD_QUEUE, "queue \"%s\" doesn't have a writer (id %d, max %u)", tmqs[i].name, i, tmq_id); err = TRUE; } SCMutexUnlock(&trans_q[tmqs[i].id].mutex_q); if (err == TRUE) goto error; } return; error: SCLogError(SC_ERR_FATAL, "fatal error during threading setup"); exit(EXIT_FAILURE); } suricata-3.2.1/src/detect-metadata.h0000644000000000000000000000164713051004444014210 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_METADATA_H__ #define __DETECT_METADATA_H__ /* prototypes */ void DetectMetadataRegister (void); #endif /* __DETECT_METADATA_H__ */ suricata-3.2.1/src/util-privs.h0000644000000000000000000000741613051004444013300 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _UTIL_PRIVS_H #define _UTIL_PRIVS_H #define SC_CAP_NONE 0x01 #define SC_CAP_SYS_ADMIN 0x02 #define SC_CAP_SYS_RAW_IO 0x04 #define SC_CAP_IPC_LOCK 0x08 #define SC_CAP_NET_ADMIN 0x10 #define SC_CAP_NET_RAW 0x20 #define SC_CAP_NET_BIND_SERVICE 0x40 #define SC_CAP_NET_BROADCAST 0x80 #ifndef HAVE_LIBCAP_NG #define SCDropCaps(...) #define SCDropMainThreadCaps(...) #else #include "threadvars.h" #include "util-debug.h" #include /**Drop the previliges of the given thread tv, based on the thread cap_flags * which implies the capability requirement of the given thread. Initially all * caps are dropped and later, the required caps are set for the given thread */ void SCDropCaps(ThreadVars *tv); /* #define SCDropCaps(tv) ({ \ capng_clear(CAPNG_SELECT_BOTH); \ capng_apply(CAPNG_SELECT_BOTH); \ if (tv->cap_flags & SC_CAP_IPC_LOCK) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_IPC_LOCK); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_IPC_LOCK has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_NET_ADMIN) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_ADMIN); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_NET_ADMIN has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_NET_BIND_SERVICE) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BIND_SERVICE); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_NET_BIND_SERVICE has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_NET_BROADCAST) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BROADCAST); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_NET_BROADCAST has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_NET_RAW) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_RAW); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_NET_RAW has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_SYS_ADMIN) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_ADMIN); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_SYS_ADMIN has been set", tv->name); \ } \ if (tv->cap_flags & SC_CAP_SYS_RAW_IO) { \ capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_RAWIO); \ capng_apply(CAPNG_SELECT_CAPS); \ SCLogDebug("For thread \"%s\" CAP_SYS_RAWIO has been set", tv->name); \ } \ }) */ void SCDropMainThreadCaps(uint32_t , uint32_t ); #endif /* HAVE_LIBCAP_NG */ int SCGetUserID(char *, char *, uint32_t *, uint32_t *); int SCGetGroupID(char *, uint32_t *); #endif /* _UTIL_PRIVS_H */ suricata-3.2.1/src/util-hashlist.h0000644000000000000000000000437313051004444013753 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HASHLIST_H__ #define __HASHLIST_H__ /* hash bucket structure */ typedef struct HashListTableBucket_ { void *data; uint16_t size; struct HashListTableBucket_ *bucknext; struct HashListTableBucket_ *listnext; struct HashListTableBucket_ *listprev; } HashListTableBucket; /* hash table structure */ typedef struct HashListTable_ { HashListTableBucket **array; HashListTableBucket *listhead; HashListTableBucket *listtail; uint32_t array_size; uint32_t (*Hash)(struct HashListTable_ *, void *, uint16_t); char (*Compare)(void *, uint16_t, void *, uint16_t); void (*Free)(void *); } HashListTable; #define HASHLIST_NO_SIZE 0 /* prototypes */ HashListTable* HashListTableInit(uint32_t, uint32_t (*Hash)(struct HashListTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)); void HashListTableFree(HashListTable *); void HashListTablePrint(HashListTable *); int HashListTableAdd(HashListTable *, void *, uint16_t); int HashListTableRemove(HashListTable *, void *, uint16_t); void *HashListTableLookup(HashListTable *, void *, uint16_t); uint32_t HashListTableGenericHash(HashListTable *, void *, uint16_t); HashListTableBucket *HashListTableGetListHead(HashListTable *); #define HashListTableGetListNext(hb) (hb)->listnext #define HashListTableGetListData(hb) (hb)->data char HashListTableDefaultCompare(void *, uint16_t, void *, uint16_t); void HashListTableRegisterTests(void); #endif /* __HASHLIST_H__ */ suricata-3.2.1/src/win32-service.h0000644000000000000000000000211213051004444013546 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ondrej Slanina */ #ifndef __WIN32_SERVICE_H__ #define __WIN32_SERVICE_H__ #ifdef OS_WIN32 int SCRunningAsService(void); int SCServiceInit(int argc, char **argv); int SCServiceInstall(int argc, char **argv); int SCServiceRemove(int argc, char **argv); int SCServiceChangeParams(int argc, char **argv); #endif /* OS_WIN32 */ #endif suricata-3.2.1/src/detect-xbits.h0000644000000000000000000000306413051004444013554 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_XBITS_H__ #define __DETECT_XBITS_H__ #define DETECT_XBITS_CMD_SET 0 #define DETECT_XBITS_CMD_TOGGLE 1 #define DETECT_XBITS_CMD_UNSET 2 #define DETECT_XBITS_CMD_ISNOTSET 3 #define DETECT_XBITS_CMD_ISSET 4 #define DETECT_XBITS_CMD_NOALERT 5 #define DETECT_XBITS_CMD_MAX 6 #define DETECT_XBITS_TRACK_IPSRC 0 #define DETECT_XBITS_TRACK_IPDST 1 #define DETECT_XBITS_TRACK_IPPAIR 2 #define DETECT_XBITS_TRACK_FLOW 3 #define DETECT_XBITS_EXPIRE_DEFAULT 30 typedef struct DetectXbitsData_ { uint16_t idx; uint8_t cmd; uint8_t tracker; uint32_t expire; /** data type: host/ippair/flow used for sig sorting in sigorder */ enum VarTypes type; } DetectXbitsData; /* prototypes */ void DetectXbitsRegister (void); #endif /* __DETECT_XBITS_H__ */ suricata-3.2.1/src/util-cuda-handlers.c0000644000000000000000000002570013051004444014636 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ /* compile in, only if we have a CUDA enabled device on the machine, with the * toolkit and the driver installed */ #include "suricata-common.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-error.h" #include "util-debug.h" #include "conf.h" #include "util-cuda.h" #include "util-cuda-handlers.h" /* file only exists if cuda is enabled */ #include "cuda-ptxdump.h" /************************conf file profile section**********************/ typedef struct CudaHandlerConfProfile_ { char *name; void *ctx; void (*Free)(void *); struct CudaHandlerConfProfile_ *next; } CudaHandlerConfProfile; static CudaHandlerConfProfile *conf_profiles = NULL; /* protects above var */ static SCMutex mutex = SCMUTEX_INITIALIZER; void CudaHandlerAddCudaProfileFromConf(const char *name, void *(*Callback)(ConfNode *node), void (*Free)(void *)) { /* we don't do data validation */ SCMutexLock(&mutex); CudaHandlerConfProfile *tmp_cp = conf_profiles; while (tmp_cp != NULL && strcasecmp(name, tmp_cp->name) != 0) tmp_cp = tmp_cp->next; if (tmp_cp != NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "We already have a cuda conf " "profile by the name \"%s\" registered.", name); exit(EXIT_FAILURE); } char tmp[200]; int r = snprintf(tmp, sizeof(tmp), "%s%s", "cuda.", name); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(tmp)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } void *ctx = Callback(ConfGetNode(tmp)); if (ctx == NULL) { SCMutexUnlock(&mutex); return; } CudaHandlerConfProfile *new_cp = SCMalloc(sizeof(CudaHandlerConfProfile)); if (unlikely(new_cp == NULL)) exit(EXIT_FAILURE); memset(new_cp, 0, sizeof(CudaHandlerConfProfile)); new_cp->name = SCStrdup(name); if (new_cp->name == NULL) exit(EXIT_FAILURE); new_cp->ctx = ctx; new_cp->Free = Free; if (conf_profiles == NULL) { conf_profiles = new_cp; } else { new_cp->next = conf_profiles; conf_profiles = new_cp; } SCMutexUnlock(&mutex); return; } void *CudaHandlerGetCudaProfile(const char *name) { SCMutexLock(&mutex); CudaHandlerConfProfile *tmp_cp = conf_profiles; while (tmp_cp != NULL && strcasecmp(name, tmp_cp->name) != 0) tmp_cp = tmp_cp->next; if (tmp_cp == NULL) { SCMutexUnlock(&mutex); return NULL; } SCMutexUnlock(&mutex); return tmp_cp->ctx; } void CudaHandlerFreeProfiles(void) { SCMutexLock(&mutex); CudaHandlerConfProfile *tmp = conf_profiles; while (tmp != NULL) { CudaHandlerConfProfile *curr = tmp; tmp = tmp->next; SCFree(curr->name); if (curr->Free != NULL) curr->Free(curr->ctx); SCFree(curr); } SCMutexUnlock(&mutex); return; } /*******************cuda context related data section*******************/ /* we use a concept where every device on the gpu has only 1 context. If * a section in the engine wants to use a device and tries to open a context * on it, we first check if a context is already created for the device and if * so we return it. If not we create a new one and update with the entry */ static CUcontext *cuda_contexts = NULL; static int no_of_cuda_contexts = 0; typedef struct CudaHandlerModuleData_ { char *name; void *data; struct CudaHandlerModuleData_ *next; } CudaHandlerModuleData; typedef struct CudaHandlerModule_ { char *name; /* the context used by this module */ CUcontext context; /* the device on which the above context was created */ int device_id; CudaHandlerModuleData *module_data; struct CudaHandlerModule_ *next; } CudaHandlerModule; static CudaHandlerModule *cudahl_modules = NULL; CUcontext CudaHandlerModuleGetContext(const char *name, int device_id) { void *ptmp; SCMutexLock(&mutex); CudaHandlerModule *module = cudahl_modules; while (module != NULL && strcasecmp(module->name, name) != 0) module = module->next; if (module != NULL) { if (module->device_id != device_id) { SCLogError(SC_ERR_CUDA_HANDLER_ERROR, "Module already " "registered, but the new device_id is different " "from the already registered device_id."); exit(EXIT_FAILURE); } SCMutexUnlock(&mutex); return module->context; } CudaHandlerModule *new_module = SCMalloc(sizeof(CudaHandlerModule)); if (unlikely(new_module == NULL)) exit(EXIT_FAILURE); memset(new_module, 0, sizeof(CudaHandlerModule)); new_module->device_id = device_id; new_module->name = SCStrdup(name); if (new_module->name == NULL) exit(EXIT_FAILURE); if (cudahl_modules == NULL) { cudahl_modules = new_module; } else { new_module->next = cudahl_modules; cudahl_modules = new_module; } if (no_of_cuda_contexts <= device_id) { ptmp = SCRealloc(cuda_contexts, sizeof(CUcontext) * (device_id + 1)); if (unlikely(ptmp == NULL)) { SCFree(cuda_contexts); cuda_contexts = NULL; exit(EXIT_FAILURE); } cuda_contexts = ptmp; memset(cuda_contexts + no_of_cuda_contexts, 0, sizeof(CUcontext) * ((device_id + 1) - no_of_cuda_contexts)); no_of_cuda_contexts = device_id + 1; } if (cuda_contexts[device_id] == 0) { SCCudaDevices *devices = SCCudaGetDeviceList(); if (SCCudaCtxCreate(&cuda_contexts[device_id], CU_CTX_SCHED_BLOCKING_SYNC, devices->devices[device_id]->device) == -1) { SCLogDebug("ctxcreate failure."); exit(EXIT_FAILURE); } } new_module->context = cuda_contexts[device_id]; SCMutexUnlock(&mutex); return cuda_contexts[device_id]; } void CudaHandlerModuleStoreData(const char *module_name, const char *data_name, void *data_ptr) { SCMutexLock(&mutex); CudaHandlerModule *module = cudahl_modules; while (module != NULL && strcasecmp(module->name, module_name) != 0) module = module->next; if (module == NULL) { SCLogError(SC_ERR_CUDA_HANDLER_ERROR, "Trying to retrieve data " "\"%s\" from module \"%s\" that hasn't been registered " "yet.", module_name, data_name); exit(EXIT_FAILURE); } CudaHandlerModuleData *data = module->module_data; while (data != NULL && (strcasecmp(data_name, data->name) != 0)) { data = data->next; } if (data != NULL) { SCLogWarning(SC_ERR_CUDA_HANDLER_ERROR, "Data \"%s\" already " "registered for this module \"%s\".", data_name, module_name); SCMutexUnlock(&mutex); goto end; } CudaHandlerModuleData *new_data = SCMalloc(sizeof(CudaHandlerModuleData)); if (unlikely(new_data == NULL)) exit(EXIT_FAILURE); memset(new_data, 0, sizeof(CudaHandlerModuleData)); new_data->name = SCStrdup(data_name); if (new_data->name == NULL) exit(EXIT_FAILURE); new_data->data = data_ptr; if (module->module_data == NULL) { module->module_data = new_data; } else { new_data->next = module->module_data; module->module_data = new_data; } SCMutexUnlock(&mutex); end: return; } void *CudaHandlerModuleGetData(const char *module_name, const char *data_name) { SCMutexLock(&mutex); CudaHandlerModule *module = cudahl_modules; while (module != NULL && strcasecmp(module->name, module_name) != 0) module = module->next; if (module == NULL) { SCLogError(SC_ERR_CUDA_HANDLER_ERROR, "Trying to retrieve data " "\"%s\" from module \"%s\" that hasn't been registered " "yet.", module_name, data_name); SCMutexUnlock(&mutex); return NULL; } CudaHandlerModuleData *data = module->module_data; while (data != NULL && (strcasecmp(data_name, data->name) != 0)) { data = data->next; } if (data == NULL) { SCLogInfo("Data \"%s\" already registered for this module \"%s\". " "Returning it.", data_name, module_name); SCMutexUnlock(&mutex); return NULL; } SCMutexUnlock(&mutex); return data->data; } int CudaHandlerGetCudaModule(CUmodule *p_module, const char *ptx_image) { #define CUDA_HANDLER_GET_CUDA_MODULE_BUFFER_EXTRA_SPACE 15 int i = 0; /* select the ptx image based on the compute capability supported by all * devices (i.e. the lowest) */ char *image = SCMalloc(strlen(ptx_image) + CUDA_HANDLER_GET_CUDA_MODULE_BUFFER_EXTRA_SPACE); if (unlikely(image == NULL)) { exit(EXIT_FAILURE); } memset(image, 0x00, strlen(ptx_image) + CUDA_HANDLER_GET_CUDA_MODULE_BUFFER_EXTRA_SPACE); int major = INT_MAX; int minor = INT_MAX; SCCudaDevices *devices = SCCudaGetDeviceList(); for (i = 0; i < devices->count; i++){ if (devices->devices[i]->major_rev < major){ major = devices->devices[i]->major_rev; minor = devices->devices[i]->minor_rev; } if (devices->devices[i]->major_rev == major && devices->devices[i]->minor_rev < minor){ minor = devices->devices[i]->minor_rev; } } snprintf(image, strlen(ptx_image) + CUDA_HANDLER_GET_CUDA_MODULE_BUFFER_EXTRA_SPACE, "%s_sm_%u%u", ptx_image, major, minor); /* we don't have a cuda module associated with this module. Create a * cuda module, update the module with this cuda module reference and * then return the module refernce back to the calling function using * the argument */ SCLogDebug("Loading kernel module: %s\n",image); if (SCCudaModuleLoadData(p_module, (void *)SCCudaPtxDumpGetModule(image)) == -1) goto error; SCFree(image); return 0; error: SCFree(image); return -1; #undef CUDA_HANDLER_GET_CUDA_MODULE_BUFFER_EXTRA_SPACE } #endif /* __SC_CUDA_SUPPORT__ */ suricata-3.2.1/src/util-cuda-buffer.h0000644000000000000000000000707013051004444014314 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file API to allow buffering of data. * * Introduced with cuda as the primary objective. Allows multiple * threads to simultaneously access a single buffer and write to it. * * Current version allows only serial reads from the buffer. * When the need arises, the API will be updated to allow multiple * non-sequential reads. * * \author Anoop Saldanha */ #ifdef __SC_CUDA_SUPPORT__ #ifndef __UTIL_CUDA_BUFFER_H__ #define __UTIL_CUDA_BUFFER_H__ #include "util-atomic.h" /** * \brief Used by consumers to retrieve the data buffered. */ typedef struct CudaBufferCulledInfo_ { uint32_t no_of_items; uint32_t d_buffer_start_offset; uint32_t d_buffer_len; /* we use no_of_items to determine the no of items here */ uint32_t op_buffer_start_offset; uint8_t d_buffer_reset; uint8_t op_buffer_reset; } CudaBufferCulledInfo; /** * /brief A slice which contains details on where to buffer data by a * writer. */ typedef struct CudaBufferSlice_ { uint32_t start_offset; uint32_t end_offset; uint8_t *buffer; SC_ATOMIC_DECLARE(uint8_t, done); struct CudaBufferSlice_ *next; } CudaBufferSlice; typedef struct CudaBufferData_ { /* the data buffer */ uint8_t *d_buffer; uint32_t d_buffer_len; uint32_t d_buffer_write; uint32_t d_buffer_read; /* debug only. Can be removed */ uint32_t no_of_items; /* these 2 buffers below - o_buffer and p_buffer should be * used/updated in tandem * p_buffer is the ptr buffer that points to a data instance that * represents it's corresponding data stored in d_buffer. * o_buffer is the corresponding entry to the one in p_buffer, which * holds the offset to the corresponding entry in d_buffer. */ uint32_t *o_buffer; void **p_buffer; uint32_t op_buffer_len; uint32_t op_buffer_write; uint32_t op_buffer_read; /* slice lists used by writers */ CudaBufferSlice *slice_head; CudaBufferSlice *slice_tail; /* mutex used by the entire struct */ SCMutex m; } CudaBufferData; void CudaBufferReportCulledConsumption(CudaBufferData *cb_data, CudaBufferCulledInfo *culled_info); void CudaBufferCullCompletedSlices(CudaBufferData *cb_data, CudaBufferCulledInfo *culled_info, uint32_t size_limit); CudaBufferSlice *CudaBufferGetSlice(CudaBufferData *data, uint32_t len, void *p); void CudaBufferDeRegister(CudaBufferData *cb_data); CudaBufferData *CudaBufferRegisterNew(uint8_t *d_buffer, uint32_t d_buffer_len, uint32_t *o_buffer, void **p_buffer, uint32_t op_buffer_no_of_items); void CudaBufferInit(void); void CudaBufferRegisterUnittests(void); #endif /* __UTIL_CUDA_BUFFER_H__ */ #endif /* __SC_CUDA_SUPPORT__ */ suricata-3.2.1/src/util-spm-bs.c0000644000000000000000000001004313051004444013317 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * bs is a bruteforce search. It will try to search the pattern * from all characters until the available text len is less * than the length of the pattern. It needs no context but it * time cost is not good. */ #include "suricata-common.h" #include "suricata.h" #include "util-debug.h" #include "util-spm-bs.h" /** * \brief Basic search improved. Limits are better handled, so * it doesn't start searches that wont fit in the remaining buffer * * \param haystack pointer to the buffer to search in * \param haystack_len length limit of the buffer * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * * \retval ptr to start of the match; NULL if no match */ uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len) { SCEnter(); const uint8_t *h, *n; const uint8_t *hmax = haystack + haystack_len; const uint8_t *nmax = needle + needle_len; if (needle_len == 0 || needle_len > haystack_len) { SCReturnPtr(NULL, "uint8_t"); } //PrintRawDataFp(stdout,needle,needle_len); //PrintRawDataFp(stdout,haystack,haystack_len); for (n = needle; nmax - n <= hmax - haystack; haystack++) { if (*haystack != *n) { continue; } SCLogDebug("*haystack == *n, %c == %c", *haystack, *n); /* one byte needles */ if (needle_len == 1) { SCReturnPtr((uint8_t *)haystack, "uint8_t"); } for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { if (*h != *n) { break; } SCLogDebug("*haystack == *n, %c == %c", *haystack, *n); /* if we run out of needle we fully matched */ if (n == nmax - 1) { SCReturnPtr((uint8_t *)haystack, "uint8_t"); } } n = needle; } SCReturnPtr(NULL, "uint8_t"); } /** * \brief Basic search case less * * \param haystack pointer to the buffer to search in * \param haystack_len length limit of the buffer * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * * \retval ptr to start of the match; NULL if no match */ uint8_t *BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len) { const uint8_t *h, *n; const uint8_t *hmax = haystack + haystack_len; const uint8_t *nmax = needle + needle_len; if (needle_len == 0 || needle_len > haystack_len) return NULL; for (n = needle; nmax - n <= hmax - haystack; haystack++) { if (u8_tolower(*haystack) != u8_tolower(*n)) { continue; } /* one byte needles */ if (needle_len == 1) { return (uint8_t *)haystack; } for (h = haystack+1, n++; nmax - n <= hmax - h ; h++, n++) { if (u8_tolower(*h) != u8_tolower(*n)) { break; } /* if we run out of needle we fully matched */ if (n == nmax - 1) { return (uint8_t *)haystack; } } n = needle; } return NULL; } void BasicSearchInit (void) { /* nothing no more */ } suricata-3.2.1/src/detect-engine-modbus.h0000644000000000000000000000353713051004444015164 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** \file * * \author David DIALLO */ #ifndef __DETECT_ENGINE_MODBUS_H__ #define __DETECT_ENGINE_MODBUS_H__ int DetectEngineInspectModbus(ThreadVars *, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, void *, uint64_t); void DetectEngineInspectModbusRegisterTests(void); #endif /* __DETECT_ENGINE_MODBUS_H__ */ suricata-3.2.1/src/detect-pktvar.h0000644000000000000000000000205113051004444013725 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PKTVAR_H__ #define __DETECT_PKTVAR_H__ typedef struct DetectPktvarData_ { char *name; uint8_t *content; uint8_t content_len; uint8_t flags; } DetectPktvarData; /* prototypes */ void DetectPktvarRegister (void); #endif /* __DETECT_PKTVAR_H__ */ suricata-3.2.1/src/app-layer-modbus.c0000644000000000000000000034300413051004444014332 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author David DIALLO * * App-layer parser for Modbus protocol * */ #include "suricata-common.h" #include "util-debug.h" #include "util-byte.h" #include "util-enum.h" #include "util-mem.h" #include "util-misc.h" #include "stream.h" #include "stream-tcp.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-modbus.h" #include "app-layer-detect-proto.h" #include "conf.h" #include "conf-yaml-loader.h" #include "decode.h" SCEnumCharMap modbus_decoder_event_table[ ] = { /* Modbus Application Data Unit messages - ADU Modbus */ { "INVALID_PROTOCOL_ID", MODBUS_DECODER_EVENT_INVALID_PROTOCOL_ID }, { "UNSOLICITED_RESPONSE", MODBUS_DECODER_EVENT_UNSOLICITED_RESPONSE }, { "INVALID_LENGTH", MODBUS_DECODER_EVENT_INVALID_LENGTH }, { "INVALID_UNIT_IDENTIFIER", MODBUS_DECODER_EVENT_INVALID_UNIT_IDENTIFIER}, /* Modbus Protocol Data Unit messages - PDU Modbus */ { "INVALID_FUNCTION_CODE", MODBUS_DECODER_EVENT_INVALID_FUNCTION_CODE }, { "INVALID_VALUE", MODBUS_DECODER_EVENT_INVALID_VALUE }, { "INVALID_EXCEPTION_CODE", MODBUS_DECODER_EVENT_INVALID_EXCEPTION_CODE }, { "VALUE_MISMATCH", MODBUS_DECODER_EVENT_VALUE_MISMATCH }, /* Modbus Decoder event */ { "FLOODED", MODBUS_DECODER_EVENT_FLOODED}, { NULL, -1 }, }; /* Modbus Application Data Unit (ADU) length range. */ #define MODBUS_MIN_ADU_LEN 2 #define MODBUS_MAX_ADU_LEN 254 /* Modbus Protocol version. */ #define MODBUS_PROTOCOL_VER 0 /* Modbus Unit Identifier range. */ #define MODBUS_MIN_INVALID_UNIT_ID 247 #define MODBUS_MAX_INVALID_UNIT_ID 255 /* Modbus Quantity range. */ #define MODBUS_MIN_QUANTITY 0 #define MODBUS_MAX_QUANTITY_IN_BIT_ACCESS 2000 #define MODBUS_MAX_QUANTITY_IN_WORD_ACCESS 125 /* Modbus Count range. */ #define MODBUS_MIN_COUNT 1 #define MODBUS_MAX_COUNT 250 /* Modbus Function Code. */ #define MODBUS_FUNC_NONE 0x00 #define MODBUS_FUNC_READCOILS 0x01 #define MODBUS_FUNC_READDISCINPUTS 0x02 #define MODBUS_FUNC_READHOLDREGS 0x03 #define MODBUS_FUNC_READINPUTREGS 0x04 #define MODBUS_FUNC_WRITESINGLECOIL 0x05 #define MODBUS_FUNC_WRITESINGLEREG 0x06 #define MODBUS_FUNC_READEXCSTATUS 0x07 #define MODBUS_FUNC_DIAGNOSTIC 0x08 #define MODBUS_FUNC_GETCOMEVTCOUNTER 0x0b #define MODBUS_FUNC_GETCOMEVTLOG 0x0c #define MODBUS_FUNC_WRITEMULTCOILS 0x0f #define MODBUS_FUNC_WRITEMULTREGS 0x10 #define MODBUS_FUNC_REPORTSERVERID 0x11 #define MODBUS_FUNC_READFILERECORD 0x14 #define MODBUS_FUNC_WRITEFILERECORD 0x15 #define MODBUS_FUNC_MASKWRITEREG 0x16 #define MODBUS_FUNC_READWRITEMULTREGS 0x17 #define MODBUS_FUNC_READFIFOQUEUE 0x18 #define MODBUS_FUNC_ENCAPINTTRANS 0x2b #define MODBUS_FUNC_MASK 0x7f #define MODBUS_FUNC_ERRORMASK 0x80 /* Modbus Diagnostic functions: Subfunction Code. */ #define MODBUS_SUBFUNC_QUERY_DATA 0x00 #define MODBUS_SUBFUNC_RESTART_COM 0x01 #define MODBUS_SUBFUNC_DIAG_REGS 0x02 #define MODBUS_SUBFUNC_CHANGE_DELIMITER 0x03 #define MODBUS_SUBFUNC_LISTEN_MODE 0x04 #define MODBUS_SUBFUNC_CLEAR_REGS 0x0a #define MODBUS_SUBFUNC_BUS_MSG_COUNT 0x0b #define MODBUS_SUBFUNC_COM_ERR_COUNT 0x0c #define MODBUS_SUBFUNC_EXCEPT_ERR_COUNT 0x0d #define MODBUS_SUBFUNC_SERVER_MSG_COUNT 0x0e #define MODBUS_SUBFUNC_SERVER_NO_RSP_COUNT 0x0f #define MODBUS_SUBFUNC_SERVER_NAK_COUNT 0x10 #define MODBUS_SUBFUNC_SERVER_BUSY_COUNT 0x11 #define MODBUS_SUBFUNC_SERVER_CHAR_COUNT 0x12 #define MODBUS_SUBFUNC_CLEAR_COUNT 0x14 /* Modbus Encapsulated Interface Transport function: MEI type. */ #define MODBUS_MEI_ENCAPINTTRANS_CAN 0x0d #define MODBUS_MEI_ENCAPINTTRANS_READ 0x0e /* Modbus Exception Codes. */ #define MODBUS_ERROR_CODE_ILLEGAL_FUNCTION 0x01 #define MODBUS_ERROR_CODE_ILLEGAL_DATA_ADDRESS 0x02 #define MODBUS_ERROR_CODE_ILLEGAL_DATA_VALUE 0x03 #define MODBUS_ERROR_CODE_SERVER_DEVICE_FAILURE 0x04 #define MODBUS_ERROR_CODE_MEMORY_PARITY_ERROR 0x08 /* Modbus Application Protocol (MBAP) header. */ struct ModbusHeader_ { uint16_t transactionId; uint16_t protocolId; uint16_t length; uint8_t unitId; } __attribute__((__packed__)); typedef struct ModbusHeader_ ModbusHeader; /* Modbus Read/Write function and Access Types. */ #define MODBUS_TYP_WRITE_SINGLE (MODBUS_TYP_WRITE | MODBUS_TYP_SINGLE) #define MODBUS_TYP_WRITE_MULTIPLE (MODBUS_TYP_WRITE | MODBUS_TYP_MULTIPLE) #define MODBUS_TYP_READ_WRITE_MULTIPLE (MODBUS_TYP_READ | MODBUS_TYP_WRITE | MODBUS_TYP_MULTIPLE) /* Macro to convert quantity value (in bit) into count value (in word): count = Ceil(quantity/8) */ #define CEIL(quantity) (((quantity) + 7)>>3) /* Modbus Default unreplied Modbus requests are considered a flood */ #define MODBUS_CONFIG_DEFAULT_REQUEST_FLOOD 500 /* Modbus default stream reassembly depth */ #define MODBUS_CONFIG_DEFAULT_STREAM_DEPTH 0 static uint32_t request_flood = MODBUS_CONFIG_DEFAULT_REQUEST_FLOOD; static uint32_t stream_depth = MODBUS_CONFIG_DEFAULT_STREAM_DEPTH; int ModbusStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, modbus_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "modbus's enum map table.", event_name); /* yes this is fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } void ModbusSetEvent(ModbusState *modbus, uint8_t e) { if (modbus && modbus->curr) { SCLogDebug("modbus->curr->decoder_events %p", modbus->curr->decoder_events); AppLayerDecoderEventsSetEventRaw(&modbus->curr->decoder_events, e); SCLogDebug("modbus->curr->decoder_events %p", modbus->curr->decoder_events); modbus->events++; } else SCLogDebug("couldn't set event %u", e); } AppLayerDecoderEvents *ModbusGetEvents(void *state, uint64_t id) { ModbusState *modbus = (ModbusState *) state; ModbusTransaction *tx; if (modbus->curr && modbus->curr->tx_num == (id + 1)) return modbus->curr->decoder_events; TAILQ_FOREACH(tx, &modbus->tx_list, next) { if (tx->tx_num == (id+1)) return tx->decoder_events; } return NULL; } int ModbusHasEvents(void *state) { return (((ModbusState *) state)->events > 0); } int ModbusGetAlstateProgress(void *modbus_tx, uint8_t direction) { ModbusTransaction *tx = (ModbusTransaction *) modbus_tx; ModbusState *modbus = tx->modbus; if (tx->replied == 1) return 1; /* Check flood limit */ if ((modbus->givenup == 1) && ((modbus->transaction_max - tx->tx_num) > request_flood)) return 1; return 0; } /** \brief Get value for 'complete' status in Modbus */ int ModbusGetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } void *ModbusGetTx(void *alstate, uint64_t tx_id) { ModbusState *modbus = (ModbusState *) alstate; ModbusTransaction *tx = NULL; if (modbus->curr && modbus->curr->tx_num == tx_id + 1) return modbus->curr; TAILQ_FOREACH(tx, &modbus->tx_list, next) { SCLogDebug("tx->tx_num %"PRIu64", tx_id %"PRIu64, tx->tx_num, (tx_id+1)); if (tx->tx_num != (tx_id+1)) continue; SCLogDebug("returning tx %p", tx); return tx; } return NULL; } void ModbusSetTxLogged(void *alstate, void *vtx, uint32_t logger) { ModbusTransaction *tx = (ModbusTransaction *)vtx; tx->logged |= logger; } int ModbusGetTxLogged(void *alstate, void *vtx, uint32_t logger) { ModbusTransaction *tx = (ModbusTransaction *)vtx; if (tx->logged & logger) return 1; return 0; } uint64_t ModbusGetTxCnt(void *alstate) { return ((uint64_t) ((ModbusState *) alstate)->transaction_max); } /** \internal * \brief Find the Modbus Transaction in the state based on Transaction ID. * * \param modbus Pointer to Modbus state structure * \param transactionId Transaction ID of the transaction * * \retval tx or NULL if not found */ static ModbusTransaction *ModbusTxFindByTransaction(const ModbusState *modbus, const uint16_t transactionId) { ModbusTransaction *tx = NULL; if (modbus->curr == NULL) return NULL; /* fast path */ if ((modbus->curr->transactionId == transactionId) && !(modbus->curr->replied)) { return modbus->curr; /* slow path, iterate list */ } else { TAILQ_FOREACH(tx, &modbus->tx_list, next) { if ((tx->transactionId == transactionId) && !(modbus->curr->replied)) return tx; } } /* not found */ return NULL; } /** \internal * \brief Allocate a Modbus Transaction and * add it into Transaction list of Modbus State * * \param modbus Pointer to Modbus state structure * * \retval Pointer to Transaction or NULL pointer */ static ModbusTransaction *ModbusTxAlloc(ModbusState *modbus) { ModbusTransaction *tx; tx = (ModbusTransaction *) SCCalloc(1, sizeof(ModbusTransaction)); if (unlikely(tx == NULL)) return NULL; modbus->transaction_max++; modbus->unreplied_cnt++; /* Check flood limit */ if ((request_flood != 0) && (modbus->unreplied_cnt > request_flood)) { ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_FLOODED); modbus->givenup = 1; } modbus->curr = tx; SCLogDebug("modbus->transaction_max updated to %"PRIu64, modbus->transaction_max); TAILQ_INSERT_TAIL(&modbus->tx_list, tx, next); tx->modbus = modbus; tx->tx_num = modbus->transaction_max; return tx; } /** \internal * \brief Free a Modbus Transaction * * \retval Pointer to Transaction or NULL pointer */ static void ModbusTxFree(ModbusTransaction *tx) { SCEnter(); if (tx->data != NULL) SCFree(tx->data); AppLayerDecoderEventsFreeEvents(&tx->decoder_events); if (tx->de_state != NULL) DetectEngineStateFree(tx->de_state); SCFree(tx); SCReturn; } /** * \brief Modbus transaction cleanup callback */ void ModbusStateTxFree(void *state, uint64_t tx_id) { SCEnter(); ModbusState *modbus = (ModbusState *) state; ModbusTransaction *tx = NULL, *ttx; SCLogDebug("state %p, id %"PRIu64, modbus, tx_id); TAILQ_FOREACH_SAFE(tx, &modbus->tx_list, next, ttx) { SCLogDebug("tx %p tx->tx_num %"PRIu64", tx_id %"PRIu64, tx, tx->tx_num, (tx_id+1)); if (tx->tx_num != (tx_id+1)) continue; if (tx == modbus->curr) modbus->curr = NULL; if (tx->decoder_events != NULL) { if (tx->decoder_events->cnt <= modbus->events) modbus->events -= tx->decoder_events->cnt; else modbus->events = 0; } modbus->unreplied_cnt--; /* Check flood limit */ if ((modbus->givenup == 1) && (request_flood != 0) && (modbus->unreplied_cnt < request_flood) ) modbus->givenup = 0; TAILQ_REMOVE(&modbus->tx_list, tx, next); ModbusTxFree(tx); break; } SCReturn; } /** \internal * \brief Extract 8bits data from pointer the received input data * * \param res Pointer to the result * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static int ModbusExtractUint8(ModbusState *modbus, uint8_t *res, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); if (input_len < (uint32_t) (*offset + sizeof(uint8_t))) { ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_LENGTH); SCReturnInt(-1); } *res = *(input + *offset); *offset += sizeof(uint8_t); SCReturnInt(0); } /** \internal * \brief Extract 16bits data from pointer the received input data * * \param res Pointer to the result * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static int ModbusExtractUint16(ModbusState *modbus, uint16_t *res, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); if (input_len < (uint32_t) (*offset + sizeof(uint16_t))) { ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_LENGTH); SCReturnInt(-1); } ByteExtractUint16(res, BYTE_BIG_ENDIAN, sizeof(uint16_t), (const uint8_t *) (input + *offset)); *offset += sizeof(uint16_t); SCReturnInt(0); } /** \internal * \brief Check length field in Modbus header according to code function * * \param modbus Pointer to Modbus state structure * \param length Length field in Modbus Header * \param len Length according to code functio */ static int ModbusCheckHeaderLength(ModbusState *modbus, uint16_t length, uint16_t len) { SCEnter(); if (length != len) { ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_LENGTH); SCReturnInt(-1); } SCReturnInt(0); } /** \internal * \brief Check Modbus header * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param header Pointer to Modbus header state in which the value to be stored */ static void ModbusCheckHeader(ModbusState *modbus, ModbusHeader *header) { SCEnter(); /* MODBUS protocol is identified by the value 0. */ if (header->protocolId != MODBUS_PROTOCOL_VER) ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_PROTOCOL_ID); /* Check Length field that is a byte count of the following fields */ if ((header->length < MODBUS_MIN_ADU_LEN) || (header->length > MODBUS_MAX_ADU_LEN) ) ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_LENGTH); /* Check Unit Identifier field that is not in invalid range */ if ((header->unitId > MODBUS_MIN_INVALID_UNIT_ID) && (header->unitId < MODBUS_MAX_INVALID_UNIT_ID) ) ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_UNIT_IDENTIFIER); SCReturn; } /** \internal * \brief Parse Exception Response and verify protocol compliance. * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static void ModbusExceptionResponse(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint8_t exception = 0; /* Exception code (1 byte) */ if (ModbusExtractUint8(modbus, &exception, input, input_len, offset)) SCReturn; switch (exception) { case MODBUS_ERROR_CODE_ILLEGAL_FUNCTION: case MODBUS_ERROR_CODE_SERVER_DEVICE_FAILURE: break; case MODBUS_ERROR_CODE_ILLEGAL_DATA_VALUE: if (tx->function == MODBUS_FUNC_DIAGNOSTIC) { break; } /* Fallthrough */ case MODBUS_ERROR_CODE_ILLEGAL_DATA_ADDRESS: if ( (tx->type & MODBUS_TYP_ACCESS_FUNCTION_MASK) || (tx->function == MODBUS_FUNC_READFIFOQUEUE) || (tx->function == MODBUS_FUNC_ENCAPINTTRANS)) { break; } /* Fallthrough */ case MODBUS_ERROR_CODE_MEMORY_PARITY_ERROR: if ( (tx->function == MODBUS_FUNC_READFILERECORD) || (tx->function == MODBUS_FUNC_WRITEFILERECORD) ) { break; } /* Fallthrough */ default: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_EXCEPTION_CODE); break; } SCReturn; } /** \internal * \brief Parse Read data Request, complete Transaction structure * and verify protocol compliance. * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static void ModbusParseReadRequest(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint16_t quantity; uint8_t type = tx->type; /* Starting Address (2 bytes) */ if (ModbusExtractUint16(modbus, &(tx->read.address), input, input_len, offset)) goto end; /* Quantity (2 bytes) */ if (ModbusExtractUint16(modbus, &(tx->read.quantity), input, input_len, offset)) goto end; quantity = tx->read.quantity; /* Check Quantity range */ if (type & MODBUS_TYP_BIT_ACCESS_MASK) { if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_BIT_ACCESS)) goto error; } else { if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_WORD_ACCESS)) goto error; } if (~type & MODBUS_TYP_WRITE) /* Except from Read/Write Multiple Registers function (code 23) */ /* The length of all Read Data function requests is 6 bytes */ /* Modbus Application Protocol Specification V1.1b3 from 6.1 to 6.4 */ ModbusCheckHeaderLength(modbus, tx->length, 6); goto end; error: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_VALUE); end: SCReturn; } /** \internal * \brief Parse Read data Response and verify protocol compliance * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static void ModbusParseReadResponse(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint8_t count = 0; /* Count (1 bytes) */ if (ModbusExtractUint8(modbus, &count, input, input_len, offset)) goto end; /* Check Count range and value according to the request */ if ((tx->type) & MODBUS_TYP_BIT_ACCESS_MASK) { if ( (count < MODBUS_MIN_COUNT) || (count > MODBUS_MAX_COUNT) || (count != CEIL(tx->read.quantity))) goto error; } else { if ( (count == MODBUS_MIN_COUNT) || (count > MODBUS_MAX_COUNT) || (count != (2 * (tx->read.quantity)))) goto error; } /* Except from Read/Write Multiple Registers function (code 23) */ /* The length of all Read Data function responses is (3 bytes + count) */ /* Modbus Application Protocol Specification V1.1b3 from 6.1 to 6.4 */ ModbusCheckHeaderLength(modbus, tx->length, 3 + count); goto end; error: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_VALUE_MISMATCH); end: SCReturn; } /** \internal * \brief Parse Write data Request, complete Transaction structure * and verify protocol compliance. * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer * * \retval On success returns 0 or on failure returns -1. */ static int ModbusParseWriteRequest(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint16_t quantity = 1, word = 0; uint8_t byte = 0, count = 1, type = tx->type; int i = 0; /* Starting/Output/Register Address (2 bytes) */ if (ModbusExtractUint16(modbus, &(tx->write.address), input, input_len, offset)) goto end; if (type & MODBUS_TYP_SINGLE) { /* The length of Write Single Coil (code 5) and */ /* Write Single Register (code 6) requests is 6 bytes */ /* Modbus Application Protocol Specification V1.1b3 6.5 and 6.6 */ if (ModbusCheckHeaderLength(modbus, tx->length, 6)) goto end; } else if (type & MODBUS_TYP_MULTIPLE) { /* Quantity (2 bytes) */ if (ModbusExtractUint16(modbus, &quantity, input, input_len, offset)) goto end; tx->write.quantity = quantity; /* Count (1 bytes) */ if (ModbusExtractUint8(modbus, &count, input, input_len, offset)) goto end; tx->write.count = count; if (type & MODBUS_TYP_BIT_ACCESS_MASK) { /* Check Quantity range and conversion in byte (count) */ if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_BIT_ACCESS) || (quantity != CEIL(count))) goto error; /* The length of Write Multiple Coils (code 15) request is (7 + count) */ /* Modbus Application Protocol Specification V1.1b3 6.11 */ if (ModbusCheckHeaderLength(modbus, tx->length, 7 + count)) goto end; } else { /* Check Quantity range and conversion in byte (count) */ if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_WORD_ACCESS) || (count != (2 * quantity))) goto error; if (type & MODBUS_TYP_READ) { /* The length of Read/Write Multiple Registers function (code 23) */ /* request is (11 bytes + count) */ /* Modbus Application Protocol Specification V1.1b3 6.17 */ if (ModbusCheckHeaderLength(modbus, tx->length, 11 + count)) goto end; } else { /* The length of Write Multiple Coils (code 15) and */ /* Write Multiple Registers (code 16) functions requests is (7 bytes + count) */ /* Modbus Application Protocol Specification V1.1b3 from 6.11 and 6.12 */ if (ModbusCheckHeaderLength(modbus, tx->length, 7 + count)) goto end; } } } else { /* Mask Write Register function (And_Mask and Or_Mask) */ quantity = 2; /* The length of Mask Write Register (code 22) function request is 8 */ /* Modbus Application Protocol Specification V1.1b3 6.16 */ if (ModbusCheckHeaderLength(modbus, tx->length, 8)) goto end; } if (type & MODBUS_TYP_COILS) { /* Output value (data block) unit is count */ tx->data = (uint16_t *) SCCalloc(1, count * sizeof(uint16_t)); if (unlikely(tx->data == NULL)) SCReturnInt(-1); if (type & MODBUS_TYP_SINGLE) { /* Outputs value (2 bytes) */ if (ModbusExtractUint16(modbus, &word, input, input_len, offset)) goto end; tx->data[i] = word; if ((word != 0x00) && (word != 0xFF00)) goto error; } else { for (i = 0; i < count; i++) { /* Outputs value (1 byte) */ if (ModbusExtractUint8(modbus, &byte, input, input_len, offset)) goto end; tx->data[i] = (uint16_t) byte; } } } else { /* Registers value (data block) unit is quantity */ tx->data = (uint16_t *) SCCalloc(1, quantity * sizeof(uint16_t)); if (unlikely(tx->data == NULL)) SCReturnInt(-1); for (i = 0; i < quantity; i++) { /* Outputs/Registers value (2 bytes) */ if (ModbusExtractUint16(modbus, &word, input, input_len, offset)) goto end; tx->data[i] = word; } } goto end; error: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_VALUE); end: SCReturnInt(0); } /** \internal * \brief Parse Write data Response and verify protocol compliance * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static void ModbusParseWriteResponse(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint16_t address = 0, quantity = 0, word = 0; uint8_t type = tx->type; /* Starting Address (2 bytes) */ if (ModbusExtractUint16(modbus, &address, input, input_len, offset)) goto end; if (address != tx->write.address) goto error; if (type & MODBUS_TYP_SINGLE) { /* Check if Outputs/Registers value has been stored */ if (tx->data != NULL) { /* Outputs/Registers value (2 bytes) */ if (ModbusExtractUint16(modbus, &word, input, input_len, offset)) goto end; /* Check with Outputs/Registers from request */ if (word != tx->data[0]) goto error; } } else if (type & MODBUS_TYP_MULTIPLE) { /* Quantity (2 bytes) */ if (ModbusExtractUint16(modbus, &quantity, input, input_len, offset)) goto end; /* Check Quantity range */ if (type & MODBUS_TYP_BIT_ACCESS_MASK) { if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_WORD_ACCESS)) goto error; } else { if ((quantity == MODBUS_MIN_QUANTITY) || (quantity > MODBUS_MAX_QUANTITY_IN_BIT_ACCESS)) goto error; } /* Check Quantity value according to the request */ if (quantity != tx->write.quantity) goto error; } else { /* Check if And_Mask and Or_Mask values have been stored */ if (tx->data != NULL) { /* And_Mask value (2 bytes) */ if (ModbusExtractUint16(modbus, &word, input, input_len, offset)) goto end; /* Check And_Mask value according to the request */ if (word != tx->data[0]) goto error; /* And_Or_Mask value (2 bytes) */ if (ModbusExtractUint16(modbus, &word, input, input_len, offset)) goto end; /* Check Or_Mask value according to the request */ if (word != tx->data[1]) goto error; } /* The length of Mask Write Register (code 22) function response is 8 */ /* Modbus Application Protocol Specification V1.1b3 6.16 */ ModbusCheckHeaderLength(modbus, tx->length, 8); goto end; } /* Except from Mask Write Register (code 22) */ /* The length of all Write Data function responses is 6 */ /* Modbus Application Protocol Specification V1.1b3 6.5, 6.6, 6.11, 6.12 and 6.17 */ ModbusCheckHeaderLength(modbus, tx->length, 6); goto end; error: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_VALUE_MISMATCH); end: SCReturn; } /** \internal * \brief Parse Diagnostic Request, complete Transaction * structure (Category) and verify protocol compliance. * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer to Modbus state structure * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer * * \retval Reserved category function returns 1 otherwise returns 0. */ static int ModbusParseDiagnosticRequest(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len, uint16_t *offset) { SCEnter(); uint16_t data = 0; /* Sub-function (2 bytes) */ if (ModbusExtractUint16(modbus, &(tx->subFunction), input, input_len, offset)) goto end; /* Data (2 bytes) */ if (ModbusExtractUint16(modbus, &data, input, input_len, offset)) goto end; if (tx->subFunction != MODBUS_SUBFUNC_QUERY_DATA) { switch (tx->subFunction) { case MODBUS_SUBFUNC_RESTART_COM: if ((data != 0x00) && (data != 0xFF00)) goto error; break; case MODBUS_SUBFUNC_CHANGE_DELIMITER: if ((data & 0xFF) != 0x00) goto error; break; case MODBUS_SUBFUNC_LISTEN_MODE: /* No answer is expected then mark tx as completed. */ tx->replied = 1; /* Fallthrough */ case MODBUS_SUBFUNC_DIAG_REGS: case MODBUS_SUBFUNC_CLEAR_REGS: case MODBUS_SUBFUNC_BUS_MSG_COUNT: case MODBUS_SUBFUNC_COM_ERR_COUNT: case MODBUS_SUBFUNC_EXCEPT_ERR_COUNT: case MODBUS_SUBFUNC_SERVER_MSG_COUNT: case MODBUS_SUBFUNC_SERVER_NO_RSP_COUNT: case MODBUS_SUBFUNC_SERVER_NAK_COUNT: case MODBUS_SUBFUNC_SERVER_BUSY_COUNT: case MODBUS_SUBFUNC_SERVER_CHAR_COUNT: case MODBUS_SUBFUNC_CLEAR_COUNT: if (data != 0x00) goto error; break; default: /* Set function code category */ tx->category = MODBUS_CAT_RESERVED; SCReturnInt(1); } /* The length of all Diagnostic Requests is 6 */ /* Modbus Application Protocol Specification V1.1b3 6.8 */ ModbusCheckHeaderLength(modbus, tx->length, 6); } goto end; error: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_VALUE); end: SCReturnInt(0); } /* Modbus Function Code Categories structure. */ typedef struct ModbusFunctionCodeRange_ { uint8_t function; uint8_t category; } ModbusFunctionCodeRange; /* Modbus Function Code Categories table. */ static ModbusFunctionCodeRange modbusFunctionCodeRanges[] = { { 0, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 9, MODBUS_CAT_RESERVED }, { 15, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 41, MODBUS_CAT_RESERVED }, { 43, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 65, MODBUS_CAT_USER_DEFINED }, { 73, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 90, MODBUS_CAT_RESERVED }, { 92, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 100, MODBUS_CAT_USER_DEFINED }, { 111, MODBUS_CAT_PUBLIC_UNASSIGNED}, { 125, MODBUS_CAT_RESERVED }, { 128, MODBUS_CAT_NONE } }; /** \internal * \brief Parse the Modbus Protocol Data Unit (PDU) Request * * \param tx Pointer to Modbus Transaction structure * \param ModbusPdu Pointer the Modbus PDU state in which the value to be stored * \param input Pointer the received input data * \param input_len Length of the received input data */ static void ModbusParseRequestPDU(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len) { SCEnter(); uint16_t offset = (uint16_t) sizeof(ModbusHeader); uint8_t count = 0; int i = 0; /* Standard function codes used on MODBUS application layer protocol (1 byte) */ if (ModbusExtractUint8(modbus, &(tx->function), input, input_len, &offset)) goto end; /* Set default function code category */ tx->category = MODBUS_CAT_NONE; /* Set default function primary table */ tx->type = MODBUS_TYP_NONE; switch (tx->function) { case MODBUS_FUNC_NONE: ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_FUNCTION_CODE); break; case MODBUS_FUNC_READCOILS: /* Set function type */ tx->type = (MODBUS_TYP_COILS | MODBUS_TYP_READ); break; case MODBUS_FUNC_READDISCINPUTS: /* Set function type */ tx->type = (MODBUS_TYP_DISCRETES | MODBUS_TYP_READ); break; case MODBUS_FUNC_READHOLDREGS: /* Set function type */ tx->type = (MODBUS_TYP_HOLDING | MODBUS_TYP_READ); break; case MODBUS_FUNC_READINPUTREGS: /* Set function type */ tx->type = (MODBUS_TYP_INPUT | MODBUS_TYP_READ); break; case MODBUS_FUNC_WRITESINGLECOIL: /* Set function type */ tx->type = (MODBUS_TYP_COILS | MODBUS_TYP_WRITE_SINGLE); break; case MODBUS_FUNC_WRITESINGLEREG: /* Set function type */ tx->type = (MODBUS_TYP_HOLDING | MODBUS_TYP_WRITE_SINGLE); break; case MODBUS_FUNC_WRITEMULTCOILS: /* Set function type */ tx->type = (MODBUS_TYP_COILS | MODBUS_TYP_WRITE_MULTIPLE); break; case MODBUS_FUNC_WRITEMULTREGS: /* Set function type */ tx->type = (MODBUS_TYP_HOLDING | MODBUS_TYP_WRITE_MULTIPLE); break; case MODBUS_FUNC_MASKWRITEREG: /* Set function type */ tx->type = (MODBUS_TYP_HOLDING | MODBUS_TYP_WRITE); break; case MODBUS_FUNC_READWRITEMULTREGS: /* Set function type */ tx->type = (MODBUS_TYP_HOLDING | MODBUS_TYP_READ_WRITE_MULTIPLE); break; case MODBUS_FUNC_READFILERECORD: case MODBUS_FUNC_WRITEFILERECORD: /* Count/length (1 bytes) */ if (ModbusExtractUint8(modbus, &count, input, input_len, &offset)) goto end; /* Modbus Application Protocol Specification V1.1b3 6.14 and 6.15 */ ModbusCheckHeaderLength(modbus, tx->length, 2 + count); break; case MODBUS_FUNC_DIAGNOSTIC: if(ModbusParseDiagnosticRequest(tx, modbus, input, input_len, &offset)) goto end; break; case MODBUS_FUNC_READEXCSTATUS: case MODBUS_FUNC_GETCOMEVTCOUNTER: case MODBUS_FUNC_GETCOMEVTLOG: case MODBUS_FUNC_REPORTSERVERID: /* Modbus Application Protocol Specification V1.1b3 6.7, 6.9, 6.10 and 6.13 */ ModbusCheckHeaderLength(modbus, tx->length, 2); break; case MODBUS_FUNC_READFIFOQUEUE: /* Modbus Application Protocol Specification V1.1b3 6.18 */ ModbusCheckHeaderLength(modbus, tx->length, 4); break; case MODBUS_FUNC_ENCAPINTTRANS: /* MEI type (1 byte) */ if (ModbusExtractUint8(modbus, &(tx->mei), input, input_len, &offset)) goto end; if (tx->mei == MODBUS_MEI_ENCAPINTTRANS_READ) { /* Modbus Application Protocol Specification V1.1b3 6.21 */ ModbusCheckHeaderLength(modbus, tx->length, 5); } else if (tx->mei != MODBUS_MEI_ENCAPINTTRANS_CAN) { /* Set function code category */ tx->category = MODBUS_CAT_RESERVED; goto end; } break; default: /* Check if request is error. */ if (tx->function & MODBUS_FUNC_ERRORMASK) { ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_INVALID_FUNCTION_CODE); goto end; } /* Get and store function code category */ for (i = 0; modbusFunctionCodeRanges[i].category != MODBUS_CAT_NONE; i++) { if (tx->function <= modbusFunctionCodeRanges[i].function) break; tx->category = modbusFunctionCodeRanges[i].category; } goto end; } /* Set function code category */ tx->category = MODBUS_CAT_PUBLIC_ASSIGNED; if (tx->type & MODBUS_TYP_READ) ModbusParseReadRequest(tx, modbus, input, input_len, &offset); if (tx->type & MODBUS_TYP_WRITE) ModbusParseWriteRequest(tx, modbus, input, input_len, &offset); end: SCReturn; } /** \internal * \brief Parse the Modbus Protocol Data Unit (PDU) Response * * \param tx Pointer to Modbus Transaction structure * \param modbus Pointer the Modbus PDU state in which the value to be stored * \param input Pointer the received input data * \param input_len Length of the received input data * \param offset Offset of the received input data pointer */ static void ModbusParseResponsePDU(ModbusTransaction *tx, ModbusState *modbus, uint8_t *input, uint32_t input_len) { SCEnter(); uint16_t offset = (uint16_t) sizeof(ModbusHeader); uint8_t count = 0, error = FALSE, function = 0, mei = 0; /* Standard function codes used on MODBUS application layer protocol (1 byte) */ if (ModbusExtractUint8(modbus, &function, input, input_len, &offset)) goto end; /* Check if response is error */ if(function & MODBUS_FUNC_ERRORMASK) { function &= MODBUS_FUNC_MASK; error = TRUE; } if (tx->category == MODBUS_CAT_PUBLIC_ASSIGNED) { /* Check if response is error. */ if (error) { ModbusExceptionResponse(tx, modbus, input, input_len, &offset); } else { switch(function) { case MODBUS_FUNC_READEXCSTATUS: /* Modbus Application Protocol Specification V1.1b3 6.7 */ ModbusCheckHeaderLength(modbus, tx->length, 3); goto end; case MODBUS_FUNC_GETCOMEVTCOUNTER: /* Modbus Application Protocol Specification V1.1b3 6.9 */ ModbusCheckHeaderLength(modbus, tx->length, 6); goto end; case MODBUS_FUNC_READFILERECORD: case MODBUS_FUNC_WRITEFILERECORD: /* Count/length (1 bytes) */ if (ModbusExtractUint8(modbus, &count, input, input_len, &offset)) goto end; /* Modbus Application Protocol Specification V1.1b3 6.14 and 6.15 */ ModbusCheckHeaderLength(modbus, tx->length, 2 + count); goto end; case MODBUS_FUNC_ENCAPINTTRANS: /* MEI type (1 byte) */ if (ModbusExtractUint8(modbus, &mei, input, input_len, &offset)) goto end; if (mei != tx->mei) ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_VALUE_MISMATCH); goto end; } if (tx->type & MODBUS_TYP_READ) ModbusParseReadResponse(tx, modbus, input, input_len, &offset); /* Read/Write response contents none write response part */ else if (tx->type & MODBUS_TYP_WRITE) ModbusParseWriteResponse(tx, modbus, input, input_len, &offset); } } end: SCReturn; } /** \internal * \brief Parse the Modbus Application Protocol (MBAP) header * * \param header Pointer the Modbus header state in which the value to be stored * \param input Pointer the received input data */ static int ModbusParseHeader(ModbusState *modbus, ModbusHeader *header, uint8_t *input, uint32_t input_len) { SCEnter(); uint16_t offset = 0; /* Transaction Identifier (2 bytes) */ if (ModbusExtractUint16(modbus, &(header->transactionId), input, input_len, &offset) || /* Protocol Identifier (2 bytes) */ ModbusExtractUint16(modbus, &(header->protocolId), input, input_len, &offset) || /* Length (2 bytes) */ ModbusExtractUint16(modbus, &(header->length), input, input_len, &offset) || /* Unit Identifier (1 byte) */ ModbusExtractUint8(modbus, &(header->unitId), input, input_len, &offset)) SCReturnInt(-1); SCReturnInt(0); } /** \internal * * \brief This function is called to retrieve a Modbus Request * * \param state Modbus state structure for the parser * \param input Input line of the command * \param input_len Length of the request * * \retval 1 when the command is parsed, 0 otherwise */ static int ModbusParseRequest(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); ModbusState *modbus = (ModbusState *) state; ModbusTransaction *tx; ModbusHeader header; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } while (input_len > 0) { uint32_t adu_len = input_len; uint8_t *adu = input; /* Extract MODBUS Header */ if (ModbusParseHeader(modbus, &header, adu, adu_len)) SCReturnInt(0); /* Update ADU length with length in Modbus header. */ adu_len = (uint32_t) sizeof(ModbusHeader) + (uint32_t) header.length - 1; if (adu_len > input_len) SCReturnInt(0); /* Allocate a Transaction Context and add it to Transaction list */ tx = ModbusTxAlloc(modbus); if (tx == NULL) SCReturnInt(0); /* Check MODBUS Header */ ModbusCheckHeader(modbus, &header); /* Store Transaction ID & PDU length */ tx->transactionId = header.transactionId; tx->length = header.length; /* Extract MODBUS PDU and fill Transaction Context */ ModbusParseRequestPDU(tx, modbus, adu, adu_len); /* Update input line and remaining input length of the command */ input += adu_len; input_len -= adu_len; } SCReturnInt(1); } /** \internal * \brief This function is called to retrieve a Modbus response * * \param state Pointer to Modbus state structure for the parser * \param input Input line of the command * \param input_len Length of the request * * \retval 1 when the command is parsed, 0 otherwise */ static int ModbusParseResponse(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); ModbusHeader header; ModbusState *modbus = (ModbusState *) state; ModbusTransaction *tx; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } while (input_len > 0) { uint32_t adu_len = input_len; uint8_t *adu = input; /* Extract MODBUS Header */ if (ModbusParseHeader(modbus, &header, adu, adu_len)) SCReturnInt(0); /* Update ADU length with length in Modbus header. */ adu_len = (uint32_t) sizeof(ModbusHeader) + (uint32_t) header.length - 1; if (adu_len > input_len) SCReturnInt(0); /* Find the transaction context thanks to transaction ID (and function code) */ tx = ModbusTxFindByTransaction(modbus, header.transactionId); if (tx == NULL) { /* Allocate a Transaction Context if not previous request */ /* and add it to Transaction list */ tx = ModbusTxAlloc(modbus); if (tx == NULL) SCReturnInt(0); SCLogDebug("MODBUS_DECODER_EVENT_UNSOLICITED_RESPONSE"); ModbusSetEvent(modbus, MODBUS_DECODER_EVENT_UNSOLICITED_RESPONSE); } else { /* Store PDU length */ tx->length = header.length; /* Extract MODBUS PDU and fill Transaction Context */ ModbusParseResponsePDU(tx, modbus, adu, adu_len); } /* Check and store MODBUS Header */ ModbusCheckHeader(modbus, &header); /* Mark as completed */ tx->replied = 1; /* Update input line and remaining input length of the command */ input += adu_len; input_len -= adu_len; } SCReturnInt(1); } /** \internal * \brief Function to allocate the Modbus state memory */ static void *ModbusStateAlloc(void) { ModbusState *modbus; modbus = (ModbusState *) SCCalloc(1, sizeof(ModbusState)); if (unlikely(modbus == NULL)) return NULL; TAILQ_INIT(&modbus->tx_list); return (void *) modbus; } /** \internal * \brief Function to free the Modbus state memory */ static void ModbusStateFree(void *state) { SCEnter(); ModbusState *modbus = (ModbusState *) state; ModbusTransaction *tx = NULL, *ttx; if (state) { TAILQ_FOREACH_SAFE(tx, &modbus->tx_list, next, ttx) { ModbusTxFree(tx); } SCFree(state); } SCReturn; } static uint16_t ModbusProbingParser(uint8_t *input, uint32_t input_len, uint32_t *offset) { ModbusHeader *header = (ModbusHeader *) input; /* Modbus header is 7 bytes long */ if (input_len < sizeof(ModbusHeader)) return ALPROTO_UNKNOWN; /* MODBUS protocol is identified by the value 0. */ if (header->protocolId != 0) return ALPROTO_FAILED; return ALPROTO_MODBUS; } DetectEngineState *ModbusGetTxDetectState(void *vtx) { ModbusTransaction *tx = (ModbusTransaction *)vtx; return tx->de_state; } int ModbusSetTxDetectState(void *state, void *vtx, DetectEngineState *s) { ModbusTransaction *tx = (ModbusTransaction *)vtx; tx->de_state = s; return 0; } /** * \brief Function to register the Modbus protocol parsers and other functions */ void RegisterModbusParsers(void) { SCEnter(); char *proto_name = "modbus"; /* Modbus application protocol V1.1b3 */ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_MODBUS, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, "502", ALPROTO_MODBUS, 0, sizeof(ModbusHeader), STREAM_TOSERVER, ModbusProbingParser, NULL); } else { /* If there is no app-layer section for Modbus, silently * leave it disabled. */ if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_MODBUS, 0, sizeof(ModbusHeader), ModbusProbingParser, NULL)) { #ifndef AFLFUZZ_APPLAYER return; #endif } } ConfNode *p = NULL; p = ConfGetNode("app-layer.protocols.modbus.request-flood"); if (p != NULL) { uint32_t value; if (ParseSizeStringU32(p->val, &value) < 0) { SCLogError(SC_ERR_MODBUS_CONFIG, "invalid value for request-flood %s", p->val); } else { request_flood = value; } } SCLogConfig("Modbus request flood protection level: %u", request_flood); p = ConfGetNode("app-layer.protocols.modbus.stream-depth"); if (p != NULL) { uint32_t value; if (ParseSizeStringU32(p->val, &value) < 0) { SCLogError(SC_ERR_MODBUS_CONFIG, "invalid value for stream-depth %s", p->val); } else { stream_depth = value; } } SCLogConfig("Modbus stream depth: %u", stream_depth); } else { #ifndef AFLFUZZ_APPLAYER SCLogConfig("Protocol detection and parser disabled for %s protocol.", proto_name); return; #endif } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_MODBUS, STREAM_TOSERVER, ModbusParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_MODBUS, STREAM_TOCLIENT, ModbusParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_MODBUS, ModbusStateAlloc, ModbusStateFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_MODBUS, ModbusGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_MODBUS, ModbusHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_MODBUS, NULL, ModbusGetTxDetectState, ModbusSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_MODBUS, ModbusGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_MODBUS, ModbusGetTxCnt); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_MODBUS, ModbusGetTxLogged, ModbusSetTxLogged); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_MODBUS, ModbusStateTxFree); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_MODBUS, ModbusGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_MODBUS, ModbusGetAlstateProgressCompletionStatus); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_MODBUS, ModbusStateGetEventInfo); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_MODBUS, STREAM_TOSERVER); AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_MODBUS, stream_depth); } else { SCLogConfig("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_MODBUS, ModbusParserRegisterTests); #endif SCReturn; } /* UNITTESTS */ #ifdef UNITTESTS #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "flow-util.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "stream-tcp.h" #include "stream-tcp-private.h" /* Modbus Application Protocol Specification V1.1b3 6.1: Read Coils */ /* Example of a request to read discrete outputs 20-38 */ static uint8_t readCoilsReq[] = {/* Transaction ID */ 0x00, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x01, /* Starting Address */ 0x78, 0x90, /* Quantity of coils */ 0x00, 0x13 }; static uint8_t readCoilsRsp[] = {/* Transaction ID */ 0x00, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x01, /* Byte count */ 0x03, /* Coil Status */ 0xCD, 0x6B, 0x05 }; static uint8_t readCoilsErrorRsp[] = {/* Transaction ID */ 0x00, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x03, /* Unit ID */ 0x00, /* Function code */ 0x81, /* Exception code */ 0x05}; /* Modbus Application Protocol Specification V1.1b3 6.6: Write Single register */ /* Example of a request to write register 2 to 00 03 hex */ static uint8_t writeSingleRegisterReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x06, /* Register Address */ 0x00, 0x01, /* Register Value */ 0x00, 0x03}; static uint8_t invalidWriteSingleRegisterReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x04, /* Unit ID */ 0x00, /* Function code */ 0x06, /* Register Address */ 0x00, 0x01}; static uint8_t writeSingleRegisterRsp[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x06, /* Register Address */ 0x00, 0x01, /* Register Value */ 0x00, 0x03}; /* Modbus Application Protocol Specification V1.1b3 6.12: Write Multiple registers */ /* Example of a request to write two registers starting at 2 to 00 0A and 01 02 hex */ static uint8_t writeMultipleRegistersReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x0B, /* Unit ID */ 0x00, /* Function code */ 0x10, /* Starting Address */ 0x00, 0x01, /* Quantity of Registers */ 0x00, 0x02, /* Byte count */ 0x04, /* Registers Value */ 0x00, 0x0A, 0x01, 0x02}; static uint8_t writeMultipleRegistersRsp[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x10, /* Starting Address */ 0x00, 0x01, /* Quantity of Registers */ 0x00, 0x02}; /* Modbus Application Protocol Specification V1.1b3 6.16: Mask Write Register */ /* Example of a request to mask write to register 5 */ static uint8_t maskWriteRegisterReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x08, /* Unit ID */ 0x00, /* Function code */ 0x16, /* Reference Address */ 0x00, 0x04, /* And_Mask */ 0x00, 0xF2, /* Or_Mask */ 0x00, 0x25}; static uint8_t invalidMaskWriteRegisterReq[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x16, /* Reference Address */ 0x00, 0x04, /* And_Mask */ 0x00, 0xF2}; static uint8_t maskWriteRegisterRsp[] = {/* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x08, /* Unit ID */ 0x00, /* Function code */ 0x16, /* Reference Address */ 0x00, 0x04, /* And_Mask */ 0x00, 0xF2, /* Or_Mask */ 0x00, 0x25}; /* Modbus Application Protocol Specification V1.1b3 6.17: Read/Write Multiple registers */ /* Example of a request to read six registers starting at register 4, */ /* and to write three registers starting at register 15 */ static uint8_t readWriteMultipleRegistersReq[] = {/* Transaction ID */ 0x12, 0x34, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x11, /* Unit ID */ 0x00, /* Function code */ 0x17, /* Read Starting Address */ 0x00, 0x03, /* Quantity to Read */ 0x00, 0x06, /* Write Starting Address */ 0x00, 0x0E, /* Quantity to Write */ 0x00, 0x03, /* Write Byte count */ 0x06, /* Write Registers Value */ 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; /* Mismatch value in Byte count 0x0B instead of 0x0C */ static uint8_t readWriteMultipleRegistersRsp[] = {/* Transaction ID */ 0x12, 0x34, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x0E, /* Unit ID */ 0x00, /* Function code */ 0x17, /* Byte count */ 0x0B, /* Read Registers Value */ 0x00, 0xFE, 0x0A, 0xCD, 0x00, 0x01, 0x00, 0x03, 0x00, 0x0D, 0x00}; /* Modbus Application Protocol Specification V1.1b3 6.8.1: 04 Force Listen Only Mode */ /* Example of a request to to remote device to its Listen Only MOde for Modbus Communications. */ static uint8_t forceListenOnlyMode[] = {/* Transaction ID */ 0x0A, 0x00, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x08, /* Sub-function code */ 0x00, 0x04, /* Data */ 0x00, 0x00}; static uint8_t invalidProtocolIdReq[] = {/* Transaction ID */ 0x00, 0x00, /* Protocol ID */ 0x00, 0x01, /* Length */ 0x00, 0x06, /* Unit ID */ 0x00, /* Function code */ 0x01, /* Starting Address */ 0x78, 0x90, /* Quantity of coils */ 0x00, 0x13 }; static uint8_t invalidLengthWriteMultipleRegistersReq[] = { /* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x09, /* Unit ID */ 0x00, /* Function code */ 0x10, /* Starting Address */ 0x00, 0x01, /* Quantity of Registers */ 0x00, 0x02, /* Byte count */ 0x04, /* Registers Value */ 0x00, 0x0A, 0x01, 0x02}; static uint8_t exceededLengthWriteMultipleRegistersReq[] = { /* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0xff, 0xfa, /* Unit ID */ 0x00, /* Function code */ 0x10, /* Starting Address */ 0x00, 0x01, /* Quantity of Registers */ 0x7f, 0xf9, /* Byte count */ 0xff}; static uint8_t invalidLengthPDUWriteMultipleRegistersReq[] = { /* Transaction ID */ 0x00, 0x0A, /* Protocol ID */ 0x00, 0x00, /* Length */ 0x00, 0x02, /* Unit ID */ 0x00, /* Function code */ 0x10}; /** \test Send Modbus Read Coils request/response. */ static int ModbusParserTest01(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readCoilsReq, sizeof(readCoilsReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 1) || (tx->read.address != 0x7890) || (tx->read.quantity != 19)) { printf("expected function %d, got %" PRIu8 ": ", 1, tx->function); printf("expected address %d, got %" PRIu16 ": ", 0x7890, tx->read.address); printf("expected quantity %d, got %" PRIu16 ": ", 19, tx->read.quantity); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, readCoilsRsp, sizeof(readCoilsRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send Modbus Write Multiple registers request/response. */ static int ModbusParserTest02(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, writeMultipleRegistersReq, sizeof(writeMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 16) || (tx->write.address != 0x01) || (tx->write.quantity != 2) || (tx->write.count != 4) || (tx->data[0] != 0x000A) || (tx->data[1] != 0x0102)) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); printf("expected write address %d, got %" PRIu16 ": ", 0x01, tx->write.address); printf("expected write quantity %d, got %" PRIu16 ": ", 2, tx->write.quantity); printf("expected write count %d, got %" PRIu8 ": ", 4, tx->write.count); printf("expected data %d, got %" PRIu16 ": ", 0x000A, tx->data[0]); printf("expected data %d, got %" PRIu16 ": ", 0x0102, tx->data[1]); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, writeMultipleRegistersRsp, sizeof(writeMultipleRegistersRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send Modbus Read/Write Multiple registers request/response with mismatch value. */ static int ModbusParserTest03(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus Data mismatch\"; " "app-layer-event: " "modbus.value_mismatch; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readWriteMultipleRegistersReq, sizeof(readWriteMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 23) || (tx->read.address != 0x03) || (tx->read.quantity != 6) || (tx->write.address != 0x0E) || (tx->write.quantity != 3) || (tx->write.count != 6) || (tx->data[0] != 0x1234) || (tx->data[1] != 0x5678) || (tx->data[2] != 0x9ABC)) { printf("expected function %d, got %" PRIu8 ": ", 23, tx->function); printf("expected read address %d, got %" PRIu16 ": ", 0x03, tx->read.address); printf("expected read quantity %d, got %" PRIu16 ": ", 6, tx->read.quantity); printf("expected write address %d, got %" PRIu16 ": ", 0x0E, tx->write.address); printf("expected write quantity %d, got %" PRIu16 ": ", 3, tx->write.quantity); printf("expected write count %d, got %" PRIu8 ": ", 6, tx->write.count); printf("expected data %d, got %" PRIu16 ": ", 0x1234, tx->data[0]); printf("expected data %d, got %" PRIu16 ": ", 0x5678, tx->data[1]); printf("expected data %d, got %" PRIu16 ": ", 0x9ABC, tx->data[2]); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, readWriteMultipleRegistersRsp, sizeof(readWriteMultipleRegistersRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus Force Listen Only Mode request. */ static int ModbusParserTest04(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, forceListenOnlyMode, sizeof(forceListenOnlyMode)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 8) || (tx->subFunction != 4)) { printf("expected function %d, got %" PRIu8 ": ", 8, tx->function); printf("expected sub-function %d, got %" PRIu16 ": ", 0x04, tx->subFunction); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send Modbus invalid Protocol version in request. */ static int ModbusParserTest05(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Protocol version\"; " "app-layer-event: " "modbus.invalid_protocol_id; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, invalidProtocolIdReq, sizeof(invalidProtocolIdReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus unsolicited response. */ static int ModbusParserTest06(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus unsolicited response\"; " "app-layer-event: " "modbus.unsolicited_response; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, readCoilsRsp, sizeof(readCoilsRsp)); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus invalid Length request. */ static int ModbusParserTest07(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Length\"; " "app-layer-event: " "modbus.invalid_length; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, invalidLengthWriteMultipleRegistersReq, sizeof(invalidLengthWriteMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus Read Coils request and error response with Exception code invalid. */ static int ModbusParserTest08(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus Exception code invalid\"; " "app-layer-event: " "modbus.invalid_exception_code; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readCoilsReq, sizeof(readCoilsReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 1) || (tx->read.address != 0x7890) || (tx->read.quantity != 19)) { printf("expected function %d, got %" PRIu8 ": ", 1, tx->function); printf("expected address %d, got %" PRIu16 ": ", 0x7890, tx->read.address); printf("expected quantity %d, got %" PRIu16 ": ", 19, tx->read.quantity); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, readCoilsErrorRsp, sizeof(readCoilsErrorRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Modbus fragmentation - 1 ADU over 2 TCP packets. */ static int ModbusParserTest09(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; uint32_t input_len = sizeof(readCoilsReq), part2_len = 3; uint8_t *input = readCoilsReq; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len - part2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 1) || (tx->read.address != 0x7890) || (tx->read.quantity != 19)) { printf("expected function %d, got %" PRIu8 ": ", 1, tx->function); printf("expected address %d, got %" PRIu16 ": ", 0x7890, tx->read.address); printf("expected quantity %d, got %" PRIu16 ": ", 19, tx->read.quantity); goto end; } input_len = sizeof(readCoilsRsp); part2_len = 10; input = readCoilsRsp; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, input_len - part2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, input_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Modbus fragmentation - 2 ADU in 1 TCP packet. */ static int ModbusParserTest10(void) { uint32_t input_len = sizeof(readCoilsReq) + sizeof(writeMultipleRegistersReq); uint8_t *input, *ptr; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; input = (uint8_t *) SCMalloc (input_len * sizeof(uint8_t)); if (unlikely(input == NULL)) goto end; memcpy(input, readCoilsReq, sizeof(readCoilsReq)); memcpy(input + sizeof(readCoilsReq), writeMultipleRegistersReq, sizeof(writeMultipleRegistersReq)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } if (modbus_state->transaction_max !=2) { printf("expected transaction_max %d, got %" PRIu64 ": ", 2, modbus_state->transaction_max); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 1); if ((tx->function != 16) || (tx->write.address != 0x01) || (tx->write.quantity != 2) || (tx->write.count != 4) || (tx->data[0] != 0x000A) || (tx->data[1] != 0x0102)) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); printf("expected write address %d, got %" PRIu16 ": ", 0x01, tx->write.address); printf("expected write quantity %d, got %" PRIu16 ": ", 2, tx->write.quantity); printf("expected write count %d, got %" PRIu8 ": ", 4, tx->write.count); printf("expected data %d, got %" PRIu16 ": ", 0x000A, tx->data[0]); printf("expected data %d, got %" PRIu16 ": ", 0x0102, tx->data[1]); goto end; } input_len = sizeof(readCoilsRsp) + sizeof(writeMultipleRegistersRsp); ptr = (uint8_t *) SCRealloc (input, input_len * sizeof(uint8_t)); if (unlikely(ptr == NULL)) goto end; input = ptr; memcpy(input, readCoilsRsp, sizeof(readCoilsRsp)); memcpy(input + sizeof(readCoilsRsp), writeMultipleRegistersRsp, sizeof(writeMultipleRegistersRsp)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, sizeof(input_len)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result = 1; end: if (input != NULL) SCFree(input); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send Modbus exceed Length request. */ static int ModbusParserTest11(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Length\"; " "app-layer-event: " "modbus.invalid_length; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, exceededLengthWriteMultipleRegistersReq, sizeof(exceededLengthWriteMultipleRegistersReq) + 65523 * sizeof(uint8_t)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus invalid PDU Length. */ static int ModbusParserTest12(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Length\"; " "app-layer-event: " "modbus.invalid_length; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, invalidLengthPDUWriteMultipleRegistersReq, sizeof(invalidLengthPDUWriteMultipleRegistersReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send Modbus Mask Write register request/response. */ static int ModbusParserTest13(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, maskWriteRegisterReq, sizeof(maskWriteRegisterReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 22) || (tx->data[0] != 0x00F2) || (tx->data[1] != 0x0025)) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); printf("expected And_Mask %d, got %" PRIu16 ": ", 0x00F2, tx->data[0]); printf("expected Or_Mask %d, got %" PRIu16 ": ", 0x0025, tx->data[1]); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, maskWriteRegisterRsp, sizeof(maskWriteRegisterRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send Modbus Write single register request/response. */ static int ModbusParserTest14(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; int result = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, writeSingleRegisterReq, sizeof(writeSingleRegisterReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 6) || (tx->write.address != 0x0001) || (tx->data[0] != 0x0003)) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); printf("expected write address %d, got %" PRIu16 ": ", 0x01, tx->write.address); printf("expected data %d, got %" PRIu16 ": ", 0x03, tx->data[0]); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, writeSingleRegisterRsp, sizeof(writeSingleRegisterRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Send invalid Modbus Mask Write register request. */ static int ModbusParserTest15(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Length\"; " "app-layer-event: " "modbus.invalid_length; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, invalidMaskWriteRegisterReq, sizeof(invalidMaskWriteRegisterReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if (tx->function != 22) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, maskWriteRegisterRsp, sizeof(maskWriteRegisterRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Send invalid Modbus Mask Write register request. */ static int ModbusParserTest16(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_MODBUS; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any " "(msg:\"Modbus invalid Length\"; " "app-layer-event: " "modbus.invalid_length; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, invalidWriteSingleRegisterReq, sizeof(invalidWriteSingleRegisterReq)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); ModbusState *modbus_state = f.alstate; if (modbus_state == NULL) { printf("no modbus state: "); goto end; } ModbusTransaction *tx = ModbusGetTx(modbus_state, 0); if ((tx->function != 6) || (tx->write.address != 0x0001)) { printf("expected function %d, got %" PRIu8 ": ", 16, tx->function); printf("expected write address %d, got %" PRIu16 ": ", 0x01, tx->write.address); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, writeSingleRegisterRsp, sizeof(writeSingleRegisterRsp)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (modbus_state->transaction_max !=1) { printf("expected transaction_max %d, got %" PRIu64 ": ", 1, modbus_state->transaction_max); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Checks if stream_depth is correct */ static int ModbusParserTest17(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; FAIL_IF(alp_tctx == NULL); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, readCoilsReq, sizeof(readCoilsReq)); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(f.alstate == NULL); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, readCoilsRsp, sizeof(readCoilsRsp)); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /*/ \test Checks if stream depth is correct over 2 TCP packets */ static int ModbusParserTest18(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow f; TcpSession ssn; uint32_t input_len = sizeof(readCoilsReq), part2_len = 3; uint8_t *input = readCoilsReq; FAIL_IF(alp_tctx == NULL); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len - part2_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); FAIL_IF(f.alstate == NULL); input_len = sizeof(readCoilsRsp); part2_len = 10; input = readCoilsRsp; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, input_len - part2_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, input_len); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); FAIL_IF(((TcpSession *)(f.protoctx))->reassembly_depth != MODBUS_CONFIG_DEFAULT_STREAM_DEPTH); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } #endif /* UNITTESTS */ void ModbusParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ModbusParserTest01 - Modbus Read Coils request", ModbusParserTest01); UtRegisterTest("ModbusParserTest02 - Modbus Write Multiple registers request", ModbusParserTest02); UtRegisterTest("ModbusParserTest03 - Modbus Read/Write Multiple registers request", ModbusParserTest03); UtRegisterTest("ModbusParserTest04 - Modbus Force Listen Only Mode request", ModbusParserTest04); UtRegisterTest("ModbusParserTest05 - Modbus invalid Protocol version", ModbusParserTest05); UtRegisterTest("ModbusParserTest06 - Modbus unsolicited response", ModbusParserTest06); UtRegisterTest("ModbusParserTest07 - Modbus invalid Length request", ModbusParserTest07); UtRegisterTest("ModbusParserTest08 - Modbus Exception code invalid", ModbusParserTest08); UtRegisterTest("ModbusParserTest09 - Modbus fragmentation - 1 ADU in 2 TCP packets", ModbusParserTest09); UtRegisterTest("ModbusParserTest10 - Modbus fragmentation - 2 ADU in 1 TCP packet", ModbusParserTest10); UtRegisterTest("ModbusParserTest11 - Modbus exceeded Length request", ModbusParserTest11); UtRegisterTest("ModbusParserTest12 - Modbus invalid PDU Length", ModbusParserTest12); UtRegisterTest("ModbusParserTest13 - Modbus Mask Write register request", ModbusParserTest13); UtRegisterTest("ModbusParserTest14 - Modbus Write single register request", ModbusParserTest14); UtRegisterTest("ModbusParserTest15 - Modbus invalid Mask Write register request", ModbusParserTest15); UtRegisterTest("ModbusParserTest16 - Modbus invalid Write single register request", ModbusParserTest16); UtRegisterTest("ModbusParserTest17 - Modbus stream depth", ModbusParserTest17); UtRegisterTest("ModbusParserTest18 - Modbus stream depth in 2 TCP packets", ModbusParserTest18); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-modbus.h0000644000000000000000000000532713051004444013720 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author David DIALLO */ #ifndef __DETECT_MODBUS_H__ #define __DETECT_MODBUS_H__ #include "app-layer-modbus.h" typedef enum { DETECT_MODBUS_EQ = 0, /** < EQual operator */ DETECT_MODBUS_LT, /** < "Less Than" operator */ DETECT_MODBUS_GT, /** < "Greater Than" operator */ DETECT_MODBUS_RA, /** < RAnge operator */ } DetectModbusMode; typedef struct DetectModbusValue_ { uint16_t min; /** < Modbus minimum [range] or equal value to match */ uint16_t max; /** < Modbus maximum value [range] to match */ DetectModbusMode mode; /** < Modbus operator used in the address/data signature */ } DetectModbusValue; typedef struct DetectModbus_ { uint8_t category; /** < Modbus function code category to match */ uint8_t function; /** < Modbus function code to match */ uint16_t *subfunction; /** < Modbus subfunction to match */ uint8_t type; /** < Modbus access type to match */ DetectModbusValue *address; /** < Modbus address to match */ DetectModbusValue *data; /** < Modbus data to match */ } DetectModbus; /* prototypes */ void DetectModbusRegister(void); #endif /* __DETECT_MODBUS_H__ */ suricata-3.2.1/src/detect-tos.c0000644000000000000000000002304713051004444013226 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-tos.h" #include "app-layer-protos.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-byte.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #define PARSE_REGEX "^\\s*(!?\\s*[0-9]{1,3}|!?\\s*[xX][0-9a-fA-F]{1,2})\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectTosSetup(DetectEngineCtx *, Signature *, char *); static int DetectTosMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static void DetectTosRegisterTests(void); static void DetectTosFree(void *); #define DETECT_IPTOS_MIN 0 #define DETECT_IPTOS_MAX 255 /** * \brief Register Tos keyword. */ void DetectTosRegister(void) { sigmatch_table[DETECT_TOS].name = "tos"; sigmatch_table[DETECT_TOS].Match = DetectTosMatch; sigmatch_table[DETECT_TOS].Setup = DetectTosSetup; sigmatch_table[DETECT_TOS].Free = DetectTosFree; sigmatch_table[DETECT_TOS].RegisterTests = DetectTosRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief Match function for tos keyword. * * \param tv ThreadVars instance. * \param det_ctx Pointer to the detection thread ctx. * \param p Pointer to the packet. * \param m Pointer to the SigMatch containing the tos data. * * \retval 0 no match * \retval 1 match */ int DetectTosMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectTosData *tosd = (const DetectTosData *)ctx; int result = 0; if (!PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) { return 0; } if (tosd->tos == IPV4_GET_IPTOS(p)) { SCLogDebug("tos match found for %d\n", tosd->tos); result = 1; } return (tosd->negated ^ result); } DetectTosData *DetectTosParse(char *arg) { DetectTosData *tosd = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 2) { SCLogError(SC_ERR_PCRE_MATCH, "invalid tos option - %s. " "The tos option value must be in the range " "%u - %u", arg, DETECT_IPTOS_MIN, DETECT_IPTOS_MAX); goto error; } const char *str_ptr; res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } int64_t tos = 0; int negated = 0; if (*str_ptr == '!') { str_ptr++; negated = 1; } while (isspace((unsigned char)*str_ptr)) str_ptr++; if (*str_ptr == 'x' || *str_ptr == 'X') { int r = ByteExtractStringSigned(&tos, 16, 0, str_ptr + 1); if (r < 0) { goto error; } } else { int r = ByteExtractStringSigned(&tos, 10, 0, str_ptr); if (r < 0) { goto error; } } if (!(tos >= DETECT_IPTOS_MIN && tos <= DETECT_IPTOS_MAX)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid tos argument - " "%s. The tos option value must be in the range " "%u - %u", str_ptr, DETECT_IPTOS_MIN, DETECT_IPTOS_MAX); goto error; } tosd = SCMalloc(sizeof(DetectTosData)); if (unlikely(tosd == NULL)) goto error; tosd->tos = (uint8_t)tos; tosd->negated = negated; return tosd; error: return NULL; } /** * \brief Setup function for tos argument. Parse the argument and * add it into the sig. * * \param de_ctx Detection Engine Context instance. * \param s Pointer to the signature. * \param arg Argument to be parsed. * * \retval 0 on Success. * \retval -1 on Failure. */ int DetectTosSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectTosData *tosd; SigMatch *sm; tosd = DetectTosParse(arg); if (tosd == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TOS; sm->ctx = (SigMatchCtx *)tosd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: return -1; } /** * \brief Free data allocated by the tos keyword. * * \param tosd Data to be freed. */ void DetectTosFree(void *tosd) { SCFree(tosd); } /********************************Unittests***********************************/ #ifdef UNITTESTS int DetectTosTest01(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("12"); if (tosd != NULL && tosd->tos == 12 && !tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest02(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("123"); if (tosd != NULL && tosd->tos == 123 && !tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest03(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse(" 12 "); if (tosd != NULL && tosd->tos == 12 && !tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest04(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("256"); if (tosd != NULL) { DetectTosFree(tosd); return 0; } return 1; } int DetectTosTest05(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("boom"); if (tosd != NULL) { DetectTosFree(tosd); return 0; } return 1; } int DetectTosTest06(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("x12"); if (tosd != NULL && tosd->tos == 0x12 && !tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest07(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("X12"); if (tosd != NULL && tosd->tos == 0x12 && !tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest08(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("x121"); if (tosd != NULL) { DetectTosFree(tosd); return 0; } return 1; } int DetectTosTest09(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("!12"); if (tosd != NULL && tosd->tos == 12 && tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest10(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse("!x12"); if (tosd != NULL && tosd->tos == 0x12 && tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest11(void) { DetectTosData *tosd = NULL; tosd = DetectTosParse(" ! 12"); if (tosd != NULL && tosd->tos == 12 && tosd->negated) { DetectTosFree(tosd); return 1; } return 0; } int DetectTosTest12(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; IPV4_SET_RAW_IPTOS(p->ip4h, 10); char *sigs[4]; sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; tos:10; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; tos:!10; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; tos:20; sid:3;)"; sigs[3]= "alert ip any any -> any any (msg:\"Testing id 3\"; tos:!20; sid:4;)"; uint32_t sid[4] = {1, 2, 3, 4}; uint32_t results[1][4] = { {1, 0, 0, 1}, }; result = UTHGenericTest(&p, 1, sigs, sid, (uint32_t *) results, 4); UTHFreePackets(&p, 1); end: return result; } #endif void DetectTosRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTosTest01", DetectTosTest01); UtRegisterTest("DetectTosTest02", DetectTosTest02); UtRegisterTest("DetectTosTest03", DetectTosTest03); UtRegisterTest("DetectTosTest04", DetectTosTest04); UtRegisterTest("DetectTosTest05", DetectTosTest05); UtRegisterTest("DetectTosTest06", DetectTosTest06); UtRegisterTest("DetectTosTest07", DetectTosTest07); UtRegisterTest("DetectTosTest08", DetectTosTest08); UtRegisterTest("DetectTosTest09", DetectTosTest09); UtRegisterTest("DetectTosTest10", DetectTosTest10); UtRegisterTest("DetectTosTest11", DetectTosTest11); UtRegisterTest("DetectTosTest12", DetectTosTest12); #endif return; } suricata-3.2.1/src/log-filestore.h0000644000000000000000000000161213051004444013725 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_FILESTORE_H__ #define __LOG_FILESTORE_H__ void LogFilestoreRegister(void); #endif /* __LOG_FILELOG_H__ */ suricata-3.2.1/src/util-action.h0000644000000000000000000000175213051004444013407 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __ACTION_ORDER_H__ #define __ACTION_ORDER_H__ #include "suricata-common.h" int ActionInitConfig(); uint8_t ActionOrderVal(uint8_t); void UtilActionRegisterTests(void); #endif /* __ACTION_ORDER_H__ */ suricata-3.2.1/src/flow-util.c0000644000000000000000000001063513051004444013074 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow utility functions */ #include "suricata-common.h" #include "threads.h" #include "flow.h" #include "flow-private.h" #include "flow-util.h" #include "flow-var.h" #include "app-layer.h" #include "util-var.h" #include "util-debug.h" #include "flow-storage.h" #include "detect.h" #include "detect-engine-state.h" /** \brief allocate a flow * * We check against the memuse counter. If it passes that check we increment * the counter first, then we try to alloc. * * \retval f the flow or NULL on out of memory */ Flow *FlowAlloc(void) { Flow *f; size_t size = sizeof(Flow) + FlowStorageSize(); if (!(FLOW_CHECK_MEMCAP(size))) { return NULL; } (void) SC_ATOMIC_ADD(flow_memuse, size); f = SCMalloc(size); if (unlikely(f == NULL)) { (void)SC_ATOMIC_SUB(flow_memuse, size); return NULL; } memset(f, 0, size); /* coverity[missing_lock] */ FLOW_INITIALIZE(f); return f; } /** * \brief cleanup & free the memory of a flow * * \param f flow to clear & destroy */ void FlowFree(Flow *f) { FLOW_DESTROY(f); SCFree(f); size_t size = sizeof(Flow) + FlowStorageSize(); (void) SC_ATOMIC_SUB(flow_memuse, size); } /** * \brief Function to map the protocol to the defined FLOW_PROTO_* enumeration. * * \param proto protocol which is needed to be mapped */ uint8_t FlowGetProtoMapping(uint8_t proto) { switch (proto) { case IPPROTO_TCP: return FLOW_PROTO_TCP; case IPPROTO_UDP: return FLOW_PROTO_UDP; case IPPROTO_ICMP: return FLOW_PROTO_ICMP; case IPPROTO_SCTP: return FLOW_PROTO_SCTP; default: return FLOW_PROTO_DEFAULT; } } uint8_t FlowGetReverseProtoMapping(uint8_t rproto) { switch (rproto) { case FLOW_PROTO_TCP: return IPPROTO_TCP; case FLOW_PROTO_UDP: return IPPROTO_UDP; case FLOW_PROTO_ICMP: return IPPROTO_ICMP; case FLOW_PROTO_SCTP: return IPPROTO_SCTP; default: exit(EXIT_FAILURE); } } /* initialize the flow from the first packet * we see from it. */ void FlowInit(Flow *f, const Packet *p) { SCEnter(); SCLogDebug("flow %p", f); f->proto = p->proto; f->recursion_level = p->recursion_level; f->vlan_id[0] = p->vlan_id[0]; f->vlan_id[1] = p->vlan_id[1]; if (PKT_IS_IPV4(p)) { FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, &f->src); FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, &f->dst); f->flags |= FLOW_IPV4; } else if (PKT_IS_IPV6(p)) { FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, &f->src); FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, &f->dst); f->flags |= FLOW_IPV6; } #ifdef DEBUG /* XXX handle default */ else { printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__); } #endif if (p->tcph != NULL) { /* XXX MACRO */ SET_TCP_SRC_PORT(p,&f->sp); SET_TCP_DST_PORT(p,&f->dp); } else if (p->udph != NULL) { /* XXX MACRO */ SET_UDP_SRC_PORT(p,&f->sp); SET_UDP_DST_PORT(p,&f->dp); } else if (p->icmpv4h != NULL) { f->type = p->type; f->code = p->code; } else if (p->icmpv6h != NULL) { f->type = p->type; f->code = p->code; } else if (p->sctph != NULL) { /* XXX MACRO */ SET_SCTP_SRC_PORT(p,&f->sp); SET_SCTP_DST_PORT(p,&f->dp); } /* XXX handle default */ #ifdef DEBUG else { printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__); } #endif COPY_TIMESTAMP(&p->ts, &f->startts); f->protomap = FlowGetProtoMapping(f->proto); SCReturn; } suricata-3.2.1/src/detect-engine-address.h0000644000000000000000000000453413051004444015316 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ADDRESS_H__ #define __DETECT_ADDRESS_H__ /* prototypes */ void DetectAddressRegister (void); DetectAddressHead *DetectAddressHeadInit(void); void DetectAddressHeadFree(DetectAddressHead *); void DetectAddressHeadCleanup(DetectAddressHead *); int DetectAddressParseString(DetectAddress *, char *); int DetectAddressParse(const DetectEngineCtx *, DetectAddressHead *, const char *); DetectAddress *DetectAddressInit(void); void DetectAddressFree(DetectAddress *); void DetectAddressCleanupList (DetectAddress *); int DetectAddressAdd(DetectAddress **, DetectAddress *); void DetectAddressPrintList(DetectAddress *); int DetectAddressInsert(DetectEngineCtx *, DetectAddressHead *, DetectAddress *); int DetectAddressJoin(DetectEngineCtx *, DetectAddress *, DetectAddress *); DetectAddress *DetectAddressLookupInHead(const DetectAddressHead *, Address *); DetectAddress *DetectAddressLookupInList(DetectAddress *, DetectAddress *); int DetectAddressMatch(DetectAddress *, Address *); DetectAddress *DetectAddressCopy(DetectAddress *); void DetectAddressPrint(DetectAddress *); int DetectAddressCmp(DetectAddress *, DetectAddress *); int DetectAddressMatchIPv4(DetectMatchAddressIPv4 *, uint16_t, Address *); int DetectAddressMatchIPv6(DetectMatchAddressIPv6 *, uint16_t, Address *); int DetectAddressTestConfVars(void); void DetectAddressTests(void); int DetectAddressMapInit(DetectEngineCtx *de_ctx); void DetectAddressMapFree(DetectEngineCtx *de_ctx); const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, const char *string); #endif /* __DETECT_ADDRESS_H__ */ suricata-3.2.1/src/detect-msg.h0000644000000000000000000000162313051004444013210 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_MSG_H__ #define __DETECT_MSG_H__ /* prototypes */ void DetectMsgRegister (void); #endif /* __DETECT_MSG_H__ */ suricata-3.2.1/src/defrag-hash.h0000644000000000000000000000606413051004444013331 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DEFRAG_HASH_H__ #define __DEFRAG_HASH_H__ #include "decode.h" #include "defrag.h" /** Spinlocks or Mutex for the flow buckets. */ //#define DRLOCK_SPIN #define DRLOCK_MUTEX #ifdef DRLOCK_SPIN #ifdef DRLOCK_MUTEX #error Cannot enable both DRLOCK_SPIN and DRLOCK_MUTEX #endif #endif #ifdef DRLOCK_SPIN #define DRLOCK_TYPE SCSpinlock #define DRLOCK_INIT(fb) SCSpinInit(&(fb)->lock, 0) #define DRLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->lock) #define DRLOCK_LOCK(fb) SCSpinLock(&(fb)->lock) #define DRLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->lock) #define DRLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->lock) #elif defined DRLOCK_MUTEX #define DRLOCK_TYPE SCMutex #define DRLOCK_INIT(fb) SCMutexInit(&(fb)->lock, NULL) #define DRLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->lock) #define DRLOCK_LOCK(fb) SCMutexLock(&(fb)->lock) #define DRLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->lock) #define DRLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->lock) #else #error Enable DRLOCK_SPIN or DRLOCK_MUTEX #endif typedef struct DefragTrackerHashRow_ { DRLOCK_TYPE lock; DefragTracker *head; DefragTracker *tail; } DefragTrackerHashRow; /** defrag tracker hash table */ DefragTrackerHashRow *defragtracker_hash; #define DEFRAG_VERBOSE 0 #define DEFRAG_QUIET 1 typedef struct DefragConfig_ { uint64_t memcap; uint32_t hash_rand; uint32_t hash_size; uint32_t prealloc; } DefragConfig; /** \brief check if a memory alloc would fit in the memcap * * \param size memory allocation size to check * * \retval 1 it fits * \retval 0 no fit */ #define DEFRAG_CHECK_MEMCAP(size) \ ((((uint64_t)SC_ATOMIC_GET(defrag_memuse) + (uint64_t)(size)) <= defrag_config.memcap)) DefragConfig defrag_config; SC_ATOMIC_DECLARE(unsigned long long int,defrag_memuse); SC_ATOMIC_DECLARE(unsigned int,defragtracker_counter); SC_ATOMIC_DECLARE(unsigned int,defragtracker_prune_idx); void DefragInitConfig(char quiet); void DefragHashShutdown(void); DefragTracker *DefragLookupTrackerFromHash (Packet *); DefragTracker *DefragGetTrackerFromHash (Packet *); void DefragTrackerRelease(DefragTracker *); void DefragTrackerClearMemory(DefragTracker *); void DefragTrackerMoveToSpare(DefragTracker *); uint32_t DefragTrackerSpareQueueGetSize(void); #endif /* __DEFRAG_HASH_H__ */ suricata-3.2.1/src/util-fmemopen.h0000644000000000000000000000260313051004444013734 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * Based on FMem.c of Alexandre Flori (2008/10/17 AF) */ #ifndef __FMEMOPEN_H__ #define __FMEMOPEN_H__ #include #include #include /* Include this file only for OSX / BSD compilations */ #ifdef OS_DARWIN #define USE_FMEM_WRAPPER 1 #endif #ifdef OS_FREEBSD #define USE_FMEM_WRAPPER 1 #endif #ifdef __OpenBSD__ #define USE_FMEM_WRAPPER 1 #endif #ifdef OS_WIN32 #define USE_FMEM_WRAPPER 1 #endif #ifdef USE_FMEM_WRAPPER FILE *SCFmemopen(void *, size_t, const char *); #else /* Else use the normal fmemopen */ #define SCFmemopen fmemopen #endif #endif /* __FMEMOPEN_H__ */ suricata-3.2.1/src/util-lua-smtp.h0000644000000000000000000000157513051004444013677 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __UTIL_LUA_SMTP_H__ #define __UTIL_LUA_SMTP_H__ #ifdef HAVE_LUA int LuaRegisterSmtpFunctions(lua_State *luastate); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_SMTP_H__ */ suricata-3.2.1/src/util-magic.h0000644000000000000000000000207213051004444013206 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_MAGIC_H__ #define __UTIL_MAGIC_H__ #ifdef HAVE_MAGIC int MagicInit(void); void MagicDeinit(void); char *MagicGlobalLookup(const uint8_t *, uint32_t); char *MagicThreadLookup(magic_t *, const uint8_t *, uint32_t); #endif void MagicRegisterTests(void); #endif /* __UTIL_MAGIC_H__ */ suricata-3.2.1/src/detect-replace.c0000644000000000000000000006266513051004444014045 00000000000000/* Copyright (C) 2011-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Replace part of the detection engine. * * If previous filter is of content type, replace can be used to change * the matched part to a new value. */ #include "suricata-common.h" #include "runmodes.h" extern int run_mode; #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-byte-extract.h" #include "detect-replace.h" #include "app-layer.h" #include "detect-engine-mpm.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "util-checksum.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow-var.h" #include "util-debug.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" static int DetectReplaceSetup(DetectEngineCtx *, Signature *, char *); void DetectReplaceRegisterTests(void); void DetectReplaceRegister (void) { sigmatch_table[DETECT_REPLACE].name = "replace"; sigmatch_table[DETECT_REPLACE].Match = NULL; sigmatch_table[DETECT_REPLACE].Setup = DetectReplaceSetup; sigmatch_table[DETECT_REPLACE].Free = NULL; sigmatch_table[DETECT_REPLACE].RegisterTests = DetectReplaceRegisterTests; sigmatch_table[DETECT_REPLACE].flags |= SIGMATCH_PAYLOAD; } int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *replacestr) { uint8_t *content = NULL; uint16_t len = 0; uint32_t flags = 0; SigMatch *pm = NULL; DetectContentData *ud = NULL; int ret = DetectContentDataParse("replace", replacestr, &content, &len, &flags); if (ret == -1) goto error; if (flags & DETECT_CONTENT_NEGATED) { SCLogError(SC_ERR_INVALID_VALUE, "Can't negate replacement string: %s", replacestr); goto error; } switch (run_mode) { case RUNMODE_NFQ: case RUNMODE_IPFW: break; default: SCLogWarning(SC_ERR_RUNMODE, "Can't use 'replace' keyword in non IPS mode: %s", s->sig_str); /* this is a success, having the alert is interesting */ return 0; } /* add to the latest "content" keyword from either dmatch or pmatch */ pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "replace needs" "preceding content option for raw sig"); SCFree(content); return -1; } /* we can remove this switch now with the unified structure */ ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); SCFree(content); return -1; } if (ud->flags & DETECT_CONTENT_NEGATED) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "negated keyword set along with a replacement"); goto error; } if (ud->content_len != len) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a content " "length different from replace length"); goto error; } ud->replace = SCMalloc(len); if (ud->replace == NULL) { goto error; } memcpy(ud->replace, content, len); ud->replace_len = len; ud->flags |= DETECT_CONTENT_REPLACE; /* want packet matching only won't be able to replace data with * a flow. */ s->flags |= SIG_FLAG_REQUIRE_PACKET; SCFree(content); return 0; error: SCFree(content); return -1; } /* Add to the head of the replace-list. * * The first to add to the replace-list has the highest priority. So, * adding the the head of the list results in the newest modifications * of content being applied first, so later changes can over ride * earlier changes. Thus the highest priority modifications should be * applied last. */ DetectReplaceList *DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd) { DetectReplaceList *newlist; if (cd->content_len != cd->replace_len) return NULL; SCLogDebug("replace: Adding match"); newlist = SCMalloc(sizeof(DetectReplaceList)); if (unlikely(newlist == NULL)) return replist; newlist->found = found; newlist->cd = cd; /* Push new value onto the front of the list. */ newlist->next = replist; return newlist; } void DetectReplaceExecuteInternal(Packet *p, DetectReplaceList *replist) { DetectReplaceList *tlist = NULL; SCLogDebug("replace: Executing match"); while (replist) { memcpy(replist->found, replist->cd->replace, replist->cd->replace_len); SCLogDebug("replace: injecting '%s'", replist->cd->replace); p->flags |= PKT_STREAM_MODIFIED; ReCalculateChecksum(p); tlist = replist; replist = replist->next; SCFree(tlist); } } void DetectReplaceFreeInternal(DetectReplaceList *replist) { DetectReplaceList *tlist = NULL; while (replist) { SCLogDebug("replace: Freeing match"); tlist = replist; replist = replist->next; SCFree(tlist); } } #ifdef UNITTESTS /* UNITTESTS */ /** * \test Test packet Matches * \param raw_eth_pkt pointer to the ethernet packet * \param pktsize size of the packet * \param sig pointer to the signature to test * \param sid sid number of the signature * \retval return 1 if match * \retval return 0 if not */ static int DetectReplaceLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize, char *sig, uint32_t sid, uint8_t *pp, uint16_t *len) { int result = 0; Packet *p = NULL; p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; if (pp == NULL) { SCLogDebug("replace: looks like a second run"); } PacketCopyData(p, raw_eth_pkt, pktsize); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); dtv.app_tctx = AppLayerGetCtxThread(&th_v); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, GET_PKT_DATA(p), pktsize, NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = NULL; if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_CONTENT) { DetectContentData *co = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (co->flags & DETECT_CONTENT_RELATIVE_NEXT) { printf("relative next flag set on final match which is content: "); goto end; } } SigGroupBuild(de_ctx); DetectEngineAddToMaster(de_ctx); DetectEngineThreadCtxInit(&th_v, NULL, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); DetectEngineMoveToFreeList(de_ctx); if (PacketAlertCheck(p, sid) != 1) { SCLogDebug("replace: no alert on sig %d", sid); goto end; } if (pp) { memcpy(pp, GET_PKT_DATA(p), GET_PKT_LEN(p)); *len = pktsize; SCLogDebug("replace: copying %d on %p", *len, pp); } result = 1; end: if (dtv.app_tctx != NULL) AppLayerDestroyCtxThread(dtv.app_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEnginePruneFreeList(); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \brief Wrapper for DetectContentLongPatternMatchTest */ int DetectReplaceLongPatternMatchTestWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep) { int ret; /** Real packet with the following tcp data: * "Hi, this is a big test to check content matches of splitted" * "patterns between multiple chunks!" * (without quotes! :) ) */ uint8_t raw_eth_pkt[] = { 0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00, 0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00, 0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06, 0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00, 0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02, 0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66, 0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65, 0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72, 0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65, 0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69, 0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e, 0x6b,0x73,0x21 }; /* end raw_eth_pkt */ uint8_t p[sizeof(raw_eth_pkt)]; uint16_t psize = sizeof(raw_eth_pkt); /* would be unittest */ int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), sig, sid, p, &psize); if (ret == 1) { SCLogDebug("replace: test1 phase1"); ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL); } run_mode = run_mode_backup; return ret; } /** * \brief Wrapper for DetectContentLongPatternMatchTest */ int DetectReplaceLongPatternMatchTestUDPWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep) { int ret; /** Real UDP DNS packet with a request A to a1.twimg.com */ uint8_t raw_eth_pkt[] = { 0x8c, 0xa9, 0x82, 0x75, 0x5d, 0x62, 0xb4, 0x07, 0xf9, 0xf3, 0xc7, 0x0a, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3a, 0x92, 0x4f, 0x40, 0x00, 0x40, 0x11, 0x31, 0x1a, 0xc0, 0xa8, 0x00, 0x02, 0xc1, 0xbd, 0xf4, 0xe1, 0x3b, 0x7e, 0x00, 0x35, 0x00, 0x26, 0xcb, 0x81, 0x37, 0x62, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x61, 0x31, 0x05, 0x74, 0x77, 0x69, 0x6d, 0x67, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01 }; uint8_t p[sizeof(raw_eth_pkt)]; uint16_t psize = sizeof(raw_eth_pkt); int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), sig, sid, p, &psize); if (ret == 1) { SCLogDebug("replace: test1 phase1 ok: %" PRIuMAX" vs %d",(uintmax_t)sizeof(raw_eth_pkt),psize); ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL); } run_mode = run_mode_backup; return ret; } /** * \test Check if replace is working */ static int DetectReplaceMatchTest01(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; replace:\"pig\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"this is a pig test\"; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with offset */ static int DetectReplaceMatchTest02(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"th\"; offset: 4; replace:\"TH\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"THis\"; offset:4; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with offset and keyword inversion */ static int DetectReplaceMatchTest03(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"th\"; replace:\"TH\"; offset: 4; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"THis\"; offset:4; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with second content */ static int DetectReplaceMatchTest04(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"th\"; replace:\"TH\"; content:\"patter\"; replace:\"matter\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"THis\"; content:\"matterns\"; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is not done when second content don't match */ static int DetectReplaceMatchTest05(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"th\"; replace:\"TH\"; content:\"nutella\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"TH\"; sid:2;)"; return !DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is not done when second content match and not * first */ static int DetectReplaceMatchTest06(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"nutella\"; replace:\"commode\"; content:\"this is\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"commode\"; sid:2;)"; return !DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working when nocase used */ static int DetectReplaceMatchTest07(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"BiG\"; nocase; replace:\"pig\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"this is a pig test\"; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working when depth is used */ static int DetectReplaceMatchTest08(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; depth:17; replace:\"pig\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"this is a pig test\"; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working when depth block match used */ static int DetectReplaceMatchTest09(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; depth:16; replace:\"pig\"; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"this is a pig test\"; sid:2;)"; return !DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working when depth block match used */ static int DetectReplaceMatchTest10(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; depth:17; replace:\"pig\"; offset: 14; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"pig\"; depth:17; offset:14; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with within */ static int DetectReplaceMatchTest11(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 11; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"pig\"; depth:17; offset:14; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with within */ static int DetectReplaceMatchTest12(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 4; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"pig\"; depth:17; offset:14; sid:2;)"; return !DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with within */ static int DetectReplaceMatchTest13(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 1; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"pig\"; depth:17; offset:14; sid:2;)"; return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with within */ static int DetectReplaceMatchTest14(void) { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 2; sid:1;)"; char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" " content:\"pig\"; depth:17; offset:14; sid:2;)"; return !DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); } /** * \test Check if replace is working with within */ static int DetectReplaceMatchTest15(void) { char *sig = "alert udp any any -> any any (msg:\"Nothing..\";" " content:\"com\"; replace:\"org\"; sid:1;)"; char *sig_rep = "alert udp any any -> any any (msg:\"replace worked\";" " content:\"twimg|03|org\"; sid:2;)"; return DetectReplaceLongPatternMatchTestUDPWrp(sig, 1, sig_rep, 2); } /** * \test Parsing test */ static int DetectReplaceParseTest01(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"doh\"; replace:\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: non valid because of http protocol */ static int DetectReplaceParseTest02(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"test\"; content:\"doh\"; replace:\"bon\"; sid:238012;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: non valid because of http_header on same content * as replace keyword */ static int DetectReplaceParseTest03(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; content:\"doh\"; replace:\"don\"; http_header; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test no content */ static int DetectReplaceParseTest04(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; replace:\"don\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test content after replace */ static int DetectReplaceParseTest05(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; replace:\"don\"; content:\"doh\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test content and replace length differ */ static int DetectReplaceParseTest06(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; content:\"don\"; replace:\"donut\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test content and replace length differ */ static int DetectReplaceParseTest07(void) { int run_mode_backup = run_mode; run_mode = RUNMODE_NFQ; DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; content:\"don\"; replace:\"dou\"; content:\"jpg\"; http_header; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: run_mode = run_mode_backup; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectContent */ void DetectReplaceRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ /* matching */ UtRegisterTest("DetectReplaceMatchTest01", DetectReplaceMatchTest01); UtRegisterTest("DetectReplaceMatchTest02", DetectReplaceMatchTest02); UtRegisterTest("DetectReplaceMatchTest03", DetectReplaceMatchTest03); UtRegisterTest("DetectReplaceMatchTest04", DetectReplaceMatchTest04); UtRegisterTest("DetectReplaceMatchTest05", DetectReplaceMatchTest05); UtRegisterTest("DetectReplaceMatchTest06", DetectReplaceMatchTest06); UtRegisterTest("DetectReplaceMatchTest07", DetectReplaceMatchTest07); UtRegisterTest("DetectReplaceMatchTest08", DetectReplaceMatchTest08); UtRegisterTest("DetectReplaceMatchTest09", DetectReplaceMatchTest09); UtRegisterTest("DetectReplaceMatchTest10", DetectReplaceMatchTest10); UtRegisterTest("DetectReplaceMatchTest11", DetectReplaceMatchTest11); UtRegisterTest("DetectReplaceMatchTest12", DetectReplaceMatchTest12); UtRegisterTest("DetectReplaceMatchTest13", DetectReplaceMatchTest13); UtRegisterTest("DetectReplaceMatchTest14", DetectReplaceMatchTest14); UtRegisterTest("DetectReplaceMatchTest15", DetectReplaceMatchTest15); /* parsing */ UtRegisterTest("DetectReplaceParseTest01", DetectReplaceParseTest01); UtRegisterTest("DetectReplaceParseTest02", DetectReplaceParseTest02); UtRegisterTest("DetectReplaceParseTest03", DetectReplaceParseTest03); UtRegisterTest("DetectReplaceParseTest04", DetectReplaceParseTest04); UtRegisterTest("DetectReplaceParseTest05", DetectReplaceParseTest05); UtRegisterTest("DetectReplaceParseTest06", DetectReplaceParseTest06); UtRegisterTest("DetectReplaceParseTest07", DetectReplaceParseTest07); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-tls.c0000644000000000000000000002250713051004444014262 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Implements TLS JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "app-layer-parser.h" #include "output.h" #include "app-layer-ssl.h" #include "app-layer.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "output-json.h" #ifdef HAVE_LIBJANSSON SC_ATOMIC_DECLARE(unsigned int, cert_id); #define MODULE_NAME "LogTlsLog" #define LOG_TLS_DEFAULT 0 #define LOG_TLS_EXTENDED (1 << 0) typedef struct OutputTlsCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } OutputTlsCtx; typedef struct JsonTlsLogThread_ { OutputTlsCtx *tlslog_ctx; MemBuffer *buffer; } JsonTlsLogThread; #define SSL_VERSION_LENGTH 13 void JsonTlsLogJSONBasic(json_t *js, SSLState *ssl_state) { /* tls.subject */ json_object_set_new(js, "subject", json_string(ssl_state->server_connp.cert0_subject)); /* tls.issuerdn */ json_object_set_new(js, "issuerdn", json_string(ssl_state->server_connp.cert0_issuerdn)); } void JsonTlsLogJSONExtended(json_t *tjs, SSLState * state) { char ssl_version[SSL_VERSION_LENGTH + 1]; /* tls.fingerprint */ json_object_set_new(tjs, "fingerprint", json_string(state->server_connp.cert0_fingerprint)); /* tls.sni */ if (state->client_connp.sni) { json_object_set_new(tjs, "sni", json_string(state->client_connp.sni)); } /* tls.version */ switch (state->server_connp.version) { case TLS_VERSION_UNKNOWN: snprintf(ssl_version, SSL_VERSION_LENGTH, "UNDETERMINED"); break; case SSL_VERSION_2: snprintf(ssl_version, SSL_VERSION_LENGTH, "SSLv2"); break; case SSL_VERSION_3: snprintf(ssl_version, SSL_VERSION_LENGTH, "SSLv3"); break; case TLS_VERSION_10: snprintf(ssl_version, SSL_VERSION_LENGTH, "TLSv1"); break; case TLS_VERSION_11: snprintf(ssl_version, SSL_VERSION_LENGTH, "TLS 1.1"); break; case TLS_VERSION_12: snprintf(ssl_version, SSL_VERSION_LENGTH, "TLS 1.2"); break; default: snprintf(ssl_version, SSL_VERSION_LENGTH, "0x%04x", state->server_connp.version); break; } json_object_set_new(tjs, "version", json_string(ssl_version)); /* tls.notbefore */ if (state->server_connp.cert0_not_before != 0) { char timebuf[64]; struct timeval tv; tv.tv_sec = state->server_connp.cert0_not_before; tv.tv_usec = 0; CreateUtcIsoTimeString(&tv, timebuf, sizeof(timebuf)); json_object_set_new(tjs, "notbefore", json_string(timebuf)); } /* tls.notafter */ if (state->server_connp.cert0_not_after != 0) { char timebuf[64]; struct timeval tv; tv.tv_sec = state->server_connp.cert0_not_after; tv.tv_usec = 0; CreateUtcIsoTimeString(&tv, timebuf, sizeof(timebuf)); json_object_set_new(tjs, "notafter", json_string(timebuf)); } } static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *txptr, uint64_t tx_id) { JsonTlsLogThread *aft = (JsonTlsLogThread *)thread_data; OutputTlsCtx *tls_ctx = aft->tlslog_ctx; SSLState *ssl_state = (SSLState *)state; if (unlikely(ssl_state == NULL)) { return 0; } if (ssl_state->server_connp.cert0_issuerdn == NULL || ssl_state->server_connp.cert0_subject == NULL) return 0; json_t *js = CreateJSONHeader((Packet *)p, 1, "tls"); if (unlikely(js == NULL)) return 0; json_t *tjs = json_object(); if (tjs == NULL) { free(js); return 0; } /* reset */ MemBufferReset(aft->buffer); JsonTlsLogJSONBasic(tjs, ssl_state); if (tls_ctx->flags & LOG_TLS_EXTENDED) { JsonTlsLogJSONExtended(tjs, ssl_state); } json_object_set_new(js, "tls", tjs); OutputJSONBuffer(js, tls_ctx->file_ctx, &aft->buffer); json_object_clear(js); json_decref(js); return 0; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonTlsLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonTlsLogThread *aft = SCMalloc(sizeof(JsonTlsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonTlsLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogTLS. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->tlslog_ctx = ((OutputCtx *)initdata)->data; aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonTlsLogThreadDeinit(ThreadVars *t, void *data) { JsonTlsLogThread *aft = (JsonTlsLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonTlsLogThread)); SCFree(aft); return TM_ECODE_OK; } static void OutputTlsLogDeinit(OutputCtx *output_ctx) { OutputTlsCtx *tls_ctx = output_ctx->data; LogFileCtx *logfile_ctx = tls_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(tls_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "tls.json" OutputCtx *OutputTlsLogInit(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_TLS_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } OutputTlsCtx *tls_ctx = SCMalloc(sizeof(OutputTlsCtx)); if (unlikely(tls_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(tls_ctx); return NULL; } tls_ctx->file_ctx = file_ctx; tls_ctx->flags = LOG_TLS_DEFAULT; if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended != NULL) { if (ConfValIsTrue(extended)) { tls_ctx->flags = LOG_TLS_EXTENDED; } } } output_ctx->data = tls_ctx; output_ctx->DeInit = OutputTlsLogDeinit; AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); return output_ctx; } static void OutputTlsLogDeinitSub(OutputCtx *output_ctx) { OutputTlsCtx *tls_ctx = output_ctx->data; SCFree(tls_ctx); SCFree(output_ctx); } OutputCtx *OutputTlsLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; OutputTlsCtx *tls_ctx = SCMalloc(sizeof(OutputTlsCtx)); if (unlikely(tls_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(tls_ctx); return NULL; } tls_ctx->file_ctx = ojc->file_ctx; tls_ctx->flags = LOG_TLS_DEFAULT; if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended != NULL) { if (ConfValIsTrue(extended)) { tls_ctx->flags = LOG_TLS_EXTENDED; } } } output_ctx->data = tls_ctx; output_ctx->DeInit = OutputTlsLogDeinitSub; AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); return output_ctx; } void JsonTlsLogRegister (void) { /* register as separate module */ OutputRegisterTxModuleWithProgress(LOGGER_JSON_TLS, "JsonTlsLog", "tls-json-log", OutputTlsLogInit, ALPROTO_TLS, JsonTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE, JsonTlsLogThreadInit, JsonTlsLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TLS, "eve-log", "JsonTlsLog", "eve-log.tls", OutputTlsLogInitSub, ALPROTO_TLS, JsonTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE, JsonTlsLogThreadInit, JsonTlsLogThreadDeinit, NULL); } #else void JsonTlsLogRegister (void) { } #endif suricata-3.2.1/src/detect-ipopts.c0000644000000000000000000002064213051004444013735 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the ipopts keyword */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "flow-var.h" #include "decode-events.h" #include "util-debug.h" #include "detect-ipopts.h" #include "util-unittest.h" #define PARSE_REGEX "\\S[A-z]" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIpOptsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIpOptsSetup (DetectEngineCtx *, Signature *, char *); void IpOptsRegisterTests(void); void DetectIpOptsFree(void *); /** * \brief Registration function for ipopts: keyword */ void DetectIpOptsRegister (void) { sigmatch_table[DETECT_IPOPTS].name = "ipopts"; sigmatch_table[DETECT_IPOPTS].desc = "check if a specific IP option is set"; sigmatch_table[DETECT_IPOPTS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ipopts"; sigmatch_table[DETECT_IPOPTS].Match = DetectIpOptsMatch; sigmatch_table[DETECT_IPOPTS].Setup = DetectIpOptsSetup; sigmatch_table[DETECT_IPOPTS].Free = DetectIpOptsFree; sigmatch_table[DETECT_IPOPTS].RegisterTests = IpOptsRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \struct DetectIpOptss_ * DetectIpOptss_ is used to store supported iptops values */ struct DetectIpOpts_ { const char *ipopt_name; /**< ip option name */ uint16_t code; /**< ip option flag value */ } ipopts[] = { { "rr", IPV4_OPT_FLAG_RR, }, { "lsrr", IPV4_OPT_FLAG_LSRR, }, { "eol", IPV4_OPT_FLAG_EOL, }, { "nop", IPV4_OPT_FLAG_NOP, }, { "ts", IPV4_OPT_FLAG_TS, }, { "sec", IPV4_OPT_FLAG_SEC, }, { "ssrr", IPV4_OPT_FLAG_SSRR, }, { "satid", IPV4_OPT_FLAG_SID, }, { "any", 0xffff, }, { NULL, 0 }, }; /** * \internal * \brief This function is used to match ip option on a packet with those passed via ipopts: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the Signature * \param m pointer to the sigmatch * * \retval 0 no match * \retval 1 match */ int DetectIpOptsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectIpOptsData *de = (const DetectIpOptsData *)ctx; if (!de || !PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) return 0; if (p->ip4vars.opts_set & de->ipopt) { return 1; } return 0; } /** * \internal * \brief This function is used to parse ipopts options passed via ipopts: keyword * * \param rawstr Pointer to the user provided ipopts options * * \retval de pointer to DetectIpOptsData on success * \retval NULL on failure */ DetectIpOptsData *DetectIpOptsParse (char *rawstr) { int i; DetectIpOptsData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, found = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } for(i = 0; ipopts[i].ipopt_name != NULL; i++) { if((strcasecmp(ipopts[i].ipopt_name,rawstr)) == 0) { found = 1; break; } } if(found == 0) goto error; de = SCMalloc(sizeof(DetectIpOptsData)); if (unlikely(de == NULL)) goto error; de->ipopt = ipopts[i].code; return de; error: if (de) SCFree(de); return NULL; } /** * \internal * \brief this function is used to add the parsed ipopts into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided ipopts options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectIpOptsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectIpOptsData *de = NULL; SigMatch *sm = NULL; de = DetectIpOptsParse(rawstr); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPOPTS; sm->ctx = (SigMatchCtx *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (de) SCFree(de); if (sm) SCFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with DetectIpOptsData * * \param de pointer to DetectIpOptsData */ void DetectIpOptsFree(void *de_ptr) { DetectIpOptsData *de = (DetectIpOptsData *)de_ptr; if(de) SCFree(de); } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS /** * \test IpOptsTestParse01 is a test for a valid ipopts value * * \retval 1 on succces * \retval 0 on failure */ int IpOptsTestParse01 (void) { DetectIpOptsData *de = NULL; de = DetectIpOptsParse("lsrr"); if (de) { DetectIpOptsFree(de); return 1; } return 0; } /** * \test IpOptsTestParse02 is a test for an invalid ipopts value * * \retval 1 on succces * \retval 0 on failure */ int IpOptsTestParse02 (void) { DetectIpOptsData *de = NULL; de = DetectIpOptsParse("invalidopt"); if (de) { DetectIpOptsFree(de); return 0; } return 1; } /** * \test IpOptsTestParse03 test the match function on a packet that needs to match * * \retval 1 on succces * \retval 0 on failure */ int IpOptsTestParse03 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectIpOptsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ip4h; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->ip4h = &ip4h; p->ip4vars.opts_set = IPV4_OPT_FLAG_RR; de = DetectIpOptsParse("rr"); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPOPTS; sm->ctx = (SigMatchCtx *)de; ret = DetectIpOptsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test IpOptsTestParse04 test the match function on a packet that needs to not match * * \retval 1 on succces * \retval 0 on failure */ int IpOptsTestParse04 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectIpOptsData *de = NULL; SigMatch *sm = NULL; IPV4Hdr ip4h; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->ip4h = &ip4h; p->ip4vars.opts_set = IPV4_OPT_FLAG_RR; de = DetectIpOptsParse("lsrr"); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPOPTS; sm->ctx = (SigMatchCtx *)de; ret = DetectIpOptsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { SCFree(p); return 0; } /* Error expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for IpOpts */ void IpOptsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("IpOptsTestParse01", IpOptsTestParse01); UtRegisterTest("IpOptsTestParse02", IpOptsTestParse02); UtRegisterTest("IpOptsTestParse03", IpOptsTestParse03); UtRegisterTest("IpOptsTestParse04", IpOptsTestParse04); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-within.c0000644000000000000000000002466113051004444013726 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the within keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" #include "app-layer.h" #include "flow-var.h" #include "util-debug.h" #include "detect-pcre.h" #include "util-unittest.h" static int DetectWithinSetup(DetectEngineCtx *, Signature *, char *); void DetectWithinRegisterTests(void); void DetectWithinRegister(void) { sigmatch_table[DETECT_WITHIN].name = "within"; sigmatch_table[DETECT_WITHIN].desc = "indicate that this content match has to be within a certain distance of the previous content keyword match"; sigmatch_table[DETECT_WITHIN].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#within"; sigmatch_table[DETECT_WITHIN].Match = NULL; sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup; sigmatch_table[DETECT_WITHIN].Free = NULL; sigmatch_table[DETECT_WITHIN].RegisterTests = DetectWithinRegisterTests; sigmatch_table[DETECT_WITHIN].flags |= SIGMATCH_PAYLOAD; } /** \brief Setup within pattern (content/uricontent) modifier. * * \todo apply to uricontent * * \retval 0 ok * \retval -1 error, sig needs to be invalidated */ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, char *withinstr) { char *str = withinstr; char dubbed = 0; SigMatch *pm = NULL; int ret = -1; /* Strip leading and trailing "s. */ if (withinstr[0] == '\"') { str = SCStrdup(withinstr+1); if (unlikely(str == NULL)) goto end; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } dubbed = 1; } /* retrive the sm to apply the depth against */ if (s->list != DETECT_SM_LIST_NOTSET) { pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]); } else { pm = SigMatchGetLastSMFromLists(s, 28, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); } if (pm == NULL) { SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "within needs " "preceding content, uricontent option, http_client_body, " "http_server_body, http_header option, http_raw_header option, " "http_method option, http_cookie, http_raw_uri, " "http_stat_msg, http_stat_code, http_user_agent or " "file_data/dce_stub_data sticky buffer option"); goto end; } /* verify other conditions */ DetectContentData *cd = (DetectContentData *)pm->ctx; if (cd->flags & DETECT_CONTENT_WITHIN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple withins for the same content."); goto end; } if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative " "keyword like within/distance with a absolute " "relative keyword like depth/offset for the same " "content." ); goto end; } if (cd->flags & DETECT_CONTENT_NEGATED && cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "negated keyword set along with a fast_pattern"); goto end; } if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "keyword set along with a fast_pattern:only;"); goto end; } if (str[0] != '-' && isalpha((unsigned char)str[0])) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var " "seen in within - %s\n", str); goto end; } cd->within = ((DetectByteExtractData *)bed_sm->ctx)->local_id; cd->flags |= DETECT_CONTENT_WITHIN_BE; } else { cd->within = strtol(str, NULL, 10); if (cd->within < (int32_t)cd->content_len) { SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is " "less than the content length \"%"PRIu32"\" which is invalid, since " "this will never match. Invalidating signature", cd->within, cd->content_len); goto end; } } cd->flags |= DETECT_CONTENT_WITHIN; /* these are the only ones against which we set a flag. We have other * relative keywords like byttest, isdataat, bytejump, but we don't * set a flag against them */ SigMatch *prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, pm->prev, DETECT_PCRE, pm->prev); if (prev_pm == NULL) { ret = 0; goto end; } if (prev_pm->type == DETECT_CONTENT) { DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx; if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword " "has a fast_pattern:only; set. Can't " "have relative keywords around a fast_pattern " "only content"); goto end; } prev_cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } ret = 0; end: if (dubbed) SCFree(str); return ret; } /***********************************Unittests**********************************/ #ifdef UNITTESTS #include "util-unittest-helper.h" /** * \test DetectWithinTestPacket01 is a test to check matches of * within, if the previous keyword is pcre (bug 145) */ int DetectWithinTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"pcre with within " "modifier\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\";" " content:\"HTTP\"; within:5; sid:49; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } int DetectWithinTestPacket02 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Zero Five Ten Fourteen"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"pcre with within " "modifier\"; content:\"Five\"; content:\"Ten\"; within:3; distance:1; sid:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } static int DetectWithinTestVarSetup(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; char sig[] = "alert tcp any any -> any any ( " "msg:\"test rule\"; " "content:\"abc\"; " "http_client_body; " "byte_extract:2,0,somevar,relative; " "content:\"def\"; " "within:somevar; " "http_client_body; " "sid:4; rev:1;)"; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectWithinRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectWithinTestPacket01", DetectWithinTestPacket01); UtRegisterTest("DetectWithinTestPacket02", DetectWithinTestPacket02); UtRegisterTest("DetectWithinTestVarSetup", DetectWithinTestVarSetup); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-itype.h0000644000000000000000000000163413051004444013556 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias */ #ifndef __DETECT_ITYPE_H__ #define __DETECT_ITYPE_H__ /* prototypes */ void DetectITypeRegister(void); #endif /* __DETECT_ITYPE_H__ */ suricata-3.2.1/src/detect-filemagic.c0000644000000000000000000003140513051004444014336 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-magic.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "stream-tcp.h" #include "detect-filemagic.h" #include "conf.h" #ifndef HAVE_MAGIC static int DetectFilemagicSetupNoSupport (DetectEngineCtx *de_ctx, Signature *s, char *str) { SCLogError(SC_ERR_NO_MAGIC_SUPPORT, "no libmagic support built in, needed for filemagic keyword"); return -1; } /** * \brief Registration function for keyword: filemagic */ void DetectFilemagicRegister(void) { sigmatch_table[DETECT_FILEMAGIC].name = "filemagic"; sigmatch_table[DETECT_FILEMAGIC].desc = "match on the information libmagic returns about a file"; sigmatch_table[DETECT_FILEMAGIC].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File-keywords#filemagic"; sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetupNoSupport; } #else /* HAVE_MAGIC */ static int DetectFilemagicMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, File *, Signature *, SigMatch *); static int DetectFilemagicSetup (DetectEngineCtx *, Signature *, char *); static void DetectFilemagicRegisterTests(void); static void DetectFilemagicFree(void *); /** * \brief Registration function for keyword: filemagic */ void DetectFilemagicRegister(void) { sigmatch_table[DETECT_FILEMAGIC].name = "filemagic"; sigmatch_table[DETECT_FILEMAGIC].desc = "match on the information libmagic returns about a file"; sigmatch_table[DETECT_FILEMAGIC].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filemagic"; sigmatch_table[DETECT_FILEMAGIC].FileMatch = DetectFilemagicMatch; sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetup; sigmatch_table[DETECT_FILEMAGIC].Free = DetectFilemagicFree; sigmatch_table[DETECT_FILEMAGIC].RegisterTests = DetectFilemagicRegisterTests; SCLogDebug("registering filemagic rule option"); return; } #define FILEMAGIC_MIN_SIZE 512 /** * \brief run the magic check * * \param file the file * * \retval -1 error * \retval 0 ok */ int FilemagicGlobalLookup(File *file) { if (file == NULL || FileDataSize(file) == 0) { SCReturnInt(-1); } const uint8_t *data = NULL; uint32_t data_len = 0; uint64_t offset = 0; StreamingBufferGetData(file->sb, &data, &data_len, &offset); if (offset == 0) { if (FileDataSize(file) >= FILEMAGIC_MIN_SIZE) { file->magic = MagicGlobalLookup(data, data_len); } else if (file->state >= FILE_STATE_CLOSED) { file->magic = MagicGlobalLookup(data, data_len); } } SCReturnInt(0); } /** * \brief run the magic check * * \param file the file * * \retval -1 error * \retval 0 ok */ int FilemagicThreadLookup(magic_t *ctx, File *file) { if (ctx == NULL || file == NULL || FileDataSize(file) == 0) { SCReturnInt(-1); } const uint8_t *data = NULL; uint32_t data_len = 0; uint64_t offset = 0; StreamingBufferGetData(file->sb, &data, &data_len, &offset); if (offset == 0) { if (FileDataSize(file) >= FILEMAGIC_MIN_SIZE) { file->magic = MagicThreadLookup(ctx, data, data_len); } else if (file->state >= FILE_STATE_CLOSED) { file->magic = MagicThreadLookup(ctx, data, data_len); } } SCReturnInt(0); } /** * \brief match the specified filemagic * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFilemagicData * * \retval 0 no match * \retval 1 match */ static int DetectFilemagicMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; DetectFilemagicData *filemagic = (DetectFilemagicData *)m->ctx; if (file->txid < det_ctx->tx_id) SCReturnInt(0); if (file->txid > det_ctx->tx_id) SCReturnInt(0); DetectFilemagicThreadData *tfilemagic = (DetectFilemagicThreadData *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, filemagic->thread_ctx_id); if (tfilemagic == NULL) { SCReturnInt(0); } if (file->magic == NULL) { FilemagicThreadLookup(&tfilemagic->ctx, file); } if (file->magic != NULL) { SCLogDebug("magic %s", file->magic); /* we include the \0 in the inspection, so patterns can match on the * end of the string. */ if (BoyerMooreNocase(filemagic->name, filemagic->len, (uint8_t *)file->magic, strlen(file->magic) + 1, filemagic->bm_ctx) != NULL) { #ifdef DEBUG if (SCLogDebugEnabled()) { char *name = SCMalloc(filemagic->len + 1); if (name != NULL) { memcpy(name, filemagic->name, filemagic->len); name[filemagic->len] = '\0'; SCLogDebug("will look for filemagic %s", name); } } #endif if (!(filemagic->flags & DETECT_CONTENT_NEGATED)) { ret = 1; } } else if (filemagic->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("negated match"); ret = 1; } } SCReturnInt(ret); } /** * \brief Parse the filemagic keyword * * \param idstr Pointer to the user provided option * * \retval filemagic pointer to DetectFilemagicData on success * \retval NULL on failure */ static DetectFilemagicData *DetectFilemagicParse (char *str) { DetectFilemagicData *filemagic = NULL; /* We have a correct filemagic option */ filemagic = SCMalloc(sizeof(DetectFilemagicData)); if (unlikely(filemagic == NULL)) goto error; memset(filemagic, 0x00, sizeof(DetectFilemagicData)); if (DetectContentDataParse ("filemagic", str, &filemagic->name, &filemagic->len, &filemagic->flags) == -1) { goto error; } filemagic->bm_ctx = BoyerMooreNocaseCtxInit(filemagic->name, filemagic->len); if (filemagic->bm_ctx == NULL) { goto error; } SCLogDebug("flags %02X", filemagic->flags); if (filemagic->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("negated filemagic"); } #ifdef DEBUG if (SCLogDebugEnabled()) { char *name = SCMalloc(filemagic->len + 1); if (name != NULL) { memcpy(name, filemagic->name, filemagic->len); name[filemagic->len] = '\0'; SCLogDebug("will look for filemagic %s", name); } } #endif return filemagic; error: if (filemagic != NULL) DetectFilemagicFree(filemagic); return NULL; } static void *DetectFilemagicThreadInit(void *data) { char *filename = NULL; FILE *fd = NULL; DetectFilemagicData *filemagic = (DetectFilemagicData *)data; BUG_ON(filemagic == NULL); DetectFilemagicThreadData *t = SCMalloc(sizeof(DetectFilemagicThreadData)); if (unlikely(t == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "couldn't alloc ctx memory"); return NULL; } memset(t, 0x00, sizeof(DetectFilemagicThreadData)); t->ctx = magic_open(0); if (t->ctx == NULL) { SCLogError(SC_ERR_MAGIC_OPEN, "magic_open failed: %s", magic_error(t->ctx)); goto error; } (void)ConfGet("magic-file", &filename); if (filename != NULL) { if (strlen(filename) == 0) { /* set filename to NULL on *nix systems so magic_load uses system default path (see man libmagic) */ SCLogInfo("using system default magic-file"); filename = NULL; } else { SCLogInfo("using magic-file %s", filename); if ( (fd = fopen(filename, "r")) == NULL) { SCLogWarning(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; } fclose(fd); } } if (magic_load(t->ctx, filename) != 0) { SCLogError(SC_ERR_MAGIC_LOAD, "magic_load failed: %s", magic_error(t->ctx)); goto error; } return (void *)t; error: if (t->ctx) magic_close(t->ctx); SCFree(t); return NULL; } static void DetectFilemagicThreadFree(void *ctx) { if (ctx != NULL) { DetectFilemagicThreadData *t = (DetectFilemagicThreadData *)ctx; if (t->ctx) magic_close(t->ctx); SCFree(t); } } /** * \brief this function is used to parse filemagic options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filemagic" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectFilemagicData *filemagic = NULL; SigMatch *sm = NULL; filemagic = DetectFilemagicParse(str); if (filemagic == NULL) goto error; filemagic->thread_ctx_id = DetectRegisterThreadCtxFuncs(de_ctx, "filemagic", DetectFilemagicThreadInit, (void *)filemagic, DetectFilemagicThreadFree, 1); if (filemagic->thread_ctx_id == -1) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FILEMAGIC; sm->ctx = (void *)filemagic; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_MAGIC); return 0; error: if (filemagic != NULL) DetectFilemagicFree(filemagic); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFilemagicData * * \param filemagic pointer to DetectFilemagicData */ static void DetectFilemagicFree(void *ptr) { if (ptr != NULL) { DetectFilemagicData *filemagic = (DetectFilemagicData *)ptr; if (filemagic->bm_ctx != NULL) { BoyerMooreCtxDeInit(filemagic->bm_ctx); } if (filemagic->name != NULL) SCFree(filemagic->name); SCFree(filemagic); } } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectFilemagicTestParse01 */ int DetectFilemagicTestParse01 (void) { DetectFilemagicData *dnd = DetectFilemagicParse("\"secret.pdf\""); if (dnd != NULL) { DetectFilemagicFree(dnd); return 1; } return 0; } /** * \test DetectFilemagicTestParse02 */ int DetectFilemagicTestParse02 (void) { int result = 0; DetectFilemagicData *dnd = DetectFilemagicParse("\"backup.tar.gz\""); if (dnd != NULL) { if (dnd->len == 13 && memcmp(dnd->name, "backup.tar.gz", 13) == 0) { result = 1; } DetectFilemagicFree(dnd); return result; } return 0; } /** * \test DetectFilemagicTestParse03 */ int DetectFilemagicTestParse03 (void) { int result = 0; DetectFilemagicData *dnd = DetectFilemagicParse("\"cmd.exe\""); if (dnd != NULL) { if (dnd->len == 7 && memcmp(dnd->name, "cmd.exe", 7) == 0) { result = 1; } DetectFilemagicFree(dnd); return result; } return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFilemagic */ void DetectFilemagicRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectFilemagicTestParse01", DetectFilemagicTestParse01); UtRegisterTest("DetectFilemagicTestParse02", DetectFilemagicTestParse02); UtRegisterTest("DetectFilemagicTestParse03", DetectFilemagicTestParse03); #endif /* UNITTESTS */ } #endif /* HAVE_MAGIC */ suricata-3.2.1/src/detect-filesha256.h0000644000000000000000000000174413051004444014276 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva */ #ifndef __DETECT_FILESHA256_H__ #define __DETECT_FILESHA256_H__ /* prototypes */ void DetectFileSha256Register (void); #endif /* __DETECT_FILESHA256_H__ */ suricata-3.2.1/src/flow-bit.h0000644000000000000000000000265113051004444012701 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_BIT_H__ #define __FLOW_BIT_H__ #include "flow.h" #include "util-var.h" typedef struct FlowBit_ { uint8_t type; /* type, DETECT_FLOWBITS in this case */ uint16_t idx; /* name idx */ GenericVar *next; /* right now just implement this as a list, * in the long run we have think of something * faster. */ } FlowBit; void FlowBitFree(FlowBit *); void FlowBitRegisterTests(void); void FlowBitSet(Flow *, uint16_t); void FlowBitUnset(Flow *, uint16_t); void FlowBitToggle(Flow *, uint16_t); int FlowBitIsset(Flow *, uint16_t); int FlowBitIsnotset(Flow *, uint16_t); #endif /* __FLOW_BIT_H__ */ suricata-3.2.1/src/tm-modules.c0000644000000000000000000001265713051004444013246 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Thread Module functions */ #include "suricata-common.h" #include "packet-queue.h" #include "tm-threads.h" #include "util-debug.h" #include "threads.h" #include "util-logopenfile.h" void TmModuleDebugList(void) { TmModule *t; uint16_t i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; SCLogDebug("%s:%p", t->name, t->Func); } } /** \brief get a tm module ptr by name * \param name name string * \retval ptr to the module or NULL */ TmModule *TmModuleGetByName(const char *name) { TmModule *t; uint16_t i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; if (strcmp(t->name, name) == 0) return t; } return NULL; } /** \brief get the id of a module from it's name * \param name registered name of the module * \retval id the id or -1 in case of error */ int TmModuleGetIdByName(const char *name) { TmModule *tm = TmModuleGetByName(name); if (tm == NULL) return -1;; return TmModuleGetIDForTM(tm); } /** * \brief Returns a TM Module by its id. * * \param id Id of the TM Module to return. * * \retval Pointer of the module to be returned if available; * NULL if unavailable. */ TmModule *TmModuleGetById(int id) { if (id < 0 || id >= TMM_SIZE) { SCLogError(SC_ERR_TM_MODULES_ERROR, "Threading module with the id " "\"%d\" doesn't exist", id); return NULL; } return &tmm_modules[id]; } /** * \brief Given a TM Module, returns its id. * * \param tm Pointer to the TM Module. * * \retval id of the TM Module if available; -1 if unavailable. */ int TmModuleGetIDForTM(TmModule *tm) { TmModule *t; int i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; if (strcmp(t->name, tm->name) == 0) return i; } return -1; } void TmModuleRunInit(void) { TmModule *t; uint16_t i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; if (t->Init == NULL) continue; t->Init(); } } void TmModuleRunDeInit(void) { TmModule *t; uint16_t i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; if (t->DeInit == NULL) continue; t->DeInit(); } } /** \brief register all unittests for the tm modules */ void TmModuleRegisterTests(void) { #ifdef UNITTESTS TmModule *t; uint16_t i; for (i = 0; i < TMM_SIZE; i++) { t = &tmm_modules[i]; if (t->name == NULL) continue; g_ut_modules++; if (t->RegisterTests == NULL) { if (coverage_unittests) SCLogWarning(SC_WARN_NO_UNITTESTS, "threading module %s has no unittest " "registration function.", t->name); } else { t->RegisterTests(); g_ut_covered++; } } #endif /* UNITTESTS */ } #define CASE_CODE(E) case E: return #E /** * \brief Maps the TmmId, to its string equivalent * * \param id tmm id * * \retval string equivalent for the tmm id */ const char * TmModuleTmmIdToString(TmmId id) { switch (id) { CASE_CODE (TMM_FLOWWORKER); CASE_CODE (TMM_RECEIVENFLOG); CASE_CODE (TMM_DECODENFLOG); CASE_CODE (TMM_DECODENFQ); CASE_CODE (TMM_VERDICTNFQ); CASE_CODE (TMM_RECEIVENFQ); CASE_CODE (TMM_RECEIVEPCAP); CASE_CODE (TMM_RECEIVEPCAPFILE); CASE_CODE (TMM_DECODEPCAP); CASE_CODE (TMM_DECODEPCAPFILE); CASE_CODE (TMM_RECEIVEPFRING); CASE_CODE (TMM_DECODEPFRING); CASE_CODE (TMM_RESPONDREJECT); CASE_CODE (TMM_DECODEIPFW); CASE_CODE (TMM_VERDICTIPFW); CASE_CODE (TMM_RECEIVEIPFW); CASE_CODE (TMM_RECEIVEERFFILE); CASE_CODE (TMM_DECODEERFFILE); CASE_CODE (TMM_RECEIVEERFDAG); CASE_CODE (TMM_DECODEERFDAG); CASE_CODE (TMM_RECEIVEMPIPE); CASE_CODE (TMM_DECODEMPIPE); CASE_CODE (TMM_RECEIVENAPATECH); CASE_CODE (TMM_DECODENAPATECH); CASE_CODE (TMM_RECEIVEAFP); CASE_CODE (TMM_ALERTPCAPINFO); CASE_CODE (TMM_DECODEAFP); CASE_CODE (TMM_STATSLOGGER); CASE_CODE (TMM_FLOWMANAGER); CASE_CODE (TMM_FLOWRECYCLER); CASE_CODE (TMM_UNIXMANAGER); CASE_CODE (TMM_DETECTLOADER); CASE_CODE (TMM_RECEIVENETMAP); CASE_CODE (TMM_DECODENETMAP); CASE_CODE (TMM_SIZE); } return ""; } suricata-3.2.1/src/detect-engine-file.c0000644000000000000000000002512513051004444014602 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-filestore.h" #include "detect-engine-uri.h" #include "detect-engine-hcbd.h" #include "detect-engine-hhd.h" #include "detect-engine-hrhd.h" #include "detect-engine-hmd.h" #include "detect-engine-hcd.h" #include "detect-engine-hrud.h" #include "detect-engine-dcepayload.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "app-layer-smb.h" #include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc.h" #include "app-layer-smtp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-profiling.h" /** * \brief Inspect the file inspecting keywords. * * \param tv thread vars * \param det_ctx detection engine thread ctx * \param f flow * \param s signature to inspect * * \retval 0 no match * \retval 1 match * \retval 2 can't match * \retval 3 can't match filestore signature * * \note flow is not locked at this time */ static int DetectFileInspect(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Flow *f, Signature *s, uint8_t flags, FileContainer *ffc) { SigMatch *sm = NULL; int r = 0; int match = 0; int store_r = 0; KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_FILEMATCH); SCLogDebug("file inspection... %p", ffc); if (ffc != NULL) { File *file = ffc->head; for (; file != NULL; file = file->next) { SCLogDebug("file"); if (file->state == FILE_STATE_NONE) { SCLogDebug("file state FILE_STATE_NONE"); continue; } if (file->txid < det_ctx->tx_id) { SCLogDebug("file->txid < det_ctx->tx_id == %"PRIu64" < %"PRIu64, file->txid, det_ctx->tx_id); continue; } if (file->txid > det_ctx->tx_id) { SCLogDebug("file->txid > det_ctx->tx_id == %"PRIu64" > %"PRIu64, file->txid, det_ctx->tx_id); break; } if ((s->file_flags & FILE_SIG_NEED_FILENAME) && file->name == NULL) { SCLogDebug("sig needs filename, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } uint64_t file_size = FileDataSize(file); if ((s->file_flags & FILE_SIG_NEED_MAGIC) && file_size == 0) { SCLogDebug("sig needs file content, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } if ((s->file_flags & FILE_SIG_NEED_FILECONTENT) && file_size == 0) { SCLogDebug("sig needs file content, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } if ((s->file_flags & FILE_SIG_NEED_MD5) && (!(file->flags & FILE_MD5))) { SCLogDebug("sig needs file md5, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } if ((s->file_flags & FILE_SIG_NEED_SHA1) && (!(file->flags & FILE_SHA1))) { SCLogDebug("sig needs file sha1, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } if ((s->file_flags & FILE_SIG_NEED_SHA256) && (!(file->flags & FILE_SHA256))) { SCLogDebug("sig needs file sha256, but we don't have any"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } if ((s->file_flags & FILE_SIG_NEED_SIZE) && file->state < FILE_STATE_CLOSED) { SCLogDebug("sig needs filesize, but state < FILE_STATE_CLOSED"); r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; break; } /* run the file match functions. */ for (sm = s->sm_lists[DETECT_SM_LIST_FILEMATCH]; sm != NULL; sm = sm->next) { SCLogDebug("sm %p, sm->next %p", sm, sm->next); if (sigmatch_table[sm->type].FileMatch != NULL) { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. FileMatch(tv, det_ctx, f, flags, file, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0)); if (match == 0) { r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; break; } else if (sm->next == NULL) { r = DETECT_ENGINE_INSPECT_SIG_MATCH; break; } } } /* continue inspection for other files as we may want to store * those as well. We'll return 1 (match) regardless of their * results though */ if (r == DETECT_ENGINE_INSPECT_SIG_MATCH) store_r = DETECT_ENGINE_INSPECT_SIG_MATCH; /* if this is a filestore sig, and the sig can't match * return 3 so we can distinguish */ if ((s->flags & SIG_FLAG_FILESTORE) && r == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE; /* continue, this file may (or may not) be unable to match * maybe we have more that can :) */ } } else { /* if we have a filestore sm with a scope > file (so tx, ssn) we * run it here */ sm = s->sm_lists[DETECT_SM_LIST_FILEMATCH]; if (sm != NULL && sm->next == NULL && sm->type == DETECT_FILESTORE && sm->ctx != NULL) { DetectFilestoreData *fd = (DetectFilestoreData *)sm->ctx; if (fd->scope > FILESTORE_SCOPE_DEFAULT) { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. FileMatch(tv, det_ctx, f, flags, /* no file */NULL, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0)); if (match == 1) { r = DETECT_ENGINE_INSPECT_SIG_MATCH; } } } } if (r == DETECT_ENGINE_INSPECT_SIG_NO_MATCH && store_r == DETECT_ENGINE_INSPECT_SIG_MATCH) { SCLogDebug("stored MATCH, current file NOMATCH"); SCReturnInt(DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES); } if (store_r == DETECT_ENGINE_INSPECT_SIG_MATCH) r = DETECT_ENGINE_INSPECT_SIG_MATCH; SCReturnInt(r); } /** * \brief Inspect the file inspecting keywords against the HTTP transactions. * * \param tv thread vars * \param det_ctx detection engine thread ctx * \param f flow * \param s signature to inspect * \param alstate state * \param flags direction flag * * \retval 0 no match * \retval 1 match * \retval 2 can't match * \retval 3 can't match filestore signature * * \note flow should be locked when this function's called. */ int DetectFileInspectHttp(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { int r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; FileContainer *ffc; HtpState *htp_state = (HtpState *)alstate; if (flags & STREAM_TOCLIENT) ffc = htp_state->files_tc; else ffc = htp_state->files_ts; int match = DetectFileInspect(tv, det_ctx, f, s, flags, ffc); if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) { r = DETECT_ENGINE_INSPECT_SIG_MATCH; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) { SCLogDebug("sid %u can't match on this transaction", s->id); r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE) { SCLogDebug("sid %u can't match on this transaction (filestore sig)", s->id); r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE; } return r; } /** * \brief Inspect the file inspecting keywords against the SMTP transactions. * * \param tv thread vars * \param det_ctx detection engine thread ctx * \param f flow * \param s signature to inspect * \param alstate state * \param flags direction flag * * \retval 0 no match * \retval 1 match * \retval 2 can't match * \retval 3 can't match filestore signature * * \note flow is not locked at this time */ int DetectFileInspectSmtp(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { SCEnter(); int r = DETECT_ENGINE_INSPECT_SIG_NO_MATCH; SMTPState *smtp_state = NULL; FileContainer *ffc; smtp_state = (SMTPState *)alstate; if (smtp_state == NULL) { SCLogDebug("no SMTP state"); goto end; } if (flags & STREAM_TOSERVER) ffc = smtp_state->files_ts; else goto end; int match = DetectFileInspect(tv, det_ctx, f, s, flags, ffc); if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) { r = DETECT_ENGINE_INSPECT_SIG_MATCH; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) { SCLogDebug("sid %u can't match on this transaction", s->id); r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE) { SCLogDebug("sid %u can't match on this transaction (filestore sig)", s->id); r = DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE; } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) { SCLogDebug("match with more files ahead"); r = match; } end: SCReturnInt(r); } suricata-3.2.1/src/tm-modules.h0000644000000000000000000000601713051004444013244 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TM_MODULES_H__ #define __TM_MODULES_H__ #include "tm-threads-common.h" #include "threadvars.h" /* thread flags */ #define TM_FLAG_RECEIVE_TM 0x01 #define TM_FLAG_DECODE_TM 0x02 #define TM_FLAG_STREAM_TM 0x04 #define TM_FLAG_DETECT_TM 0x08 #define TM_FLAG_LOGAPI_TM 0x10 /**< TM is run by Log API */ #define TM_FLAG_MANAGEMENT_TM 0x20 #define TM_FLAG_COMMAND_TM 0x40 typedef TmEcode (*ThreadInitFunc)(ThreadVars *, void *, void **); typedef TmEcode (*ThreadDeinitFunc)(ThreadVars *, void *); typedef void (*ThreadExitPrintStatsFunc)(ThreadVars *, void *); typedef struct TmModule_ { char *name; /** thread handling */ TmEcode (*ThreadInit)(ThreadVars *, void *, void **); void (*ThreadExitPrintStats)(ThreadVars *, void *); TmEcode (*ThreadDeinit)(ThreadVars *, void *); /** the packet processing function */ TmEcode (*Func)(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode (*PktAcqLoop)(ThreadVars *, void *, void *); /** terminates the capture loop in PktAcqLoop */ TmEcode (*PktAcqBreakLoop)(ThreadVars *, void *); TmEcode (*Management)(ThreadVars *, void *); /** global Init/DeInit */ TmEcode (*Init)(void); TmEcode (*DeInit)(void); void (*RegisterTests)(void); uint8_t cap_flags; /**< Flags to indicate the capability requierment of the given TmModule */ /* Other flags used by the module */ uint8_t flags; } TmModule; TmModule tmm_modules[TMM_SIZE]; /** * Structure that output modules use to maintain private data. */ typedef struct OutputCtx_ { /** Pointer to data private to the output. */ void *data; /** Pointer to a cleanup function. */ void (*DeInit)(struct OutputCtx_ *); TAILQ_HEAD(, OutputModule_) submodules; } OutputCtx; TmModule *TmModuleGetByName(const char *name); TmModule *TmModuleGetById(int id); int TmModuleGetIdByName(const char *name); int TmModuleGetIDForTM(TmModule *tm); TmEcode TmModuleRegister(char *name, int (*module_func)(ThreadVars *, Packet *, void *)); void TmModuleDebugList(void); void TmModuleRegisterTests(void); const char * TmModuleTmmIdToString(TmmId id); void TmModuleRunInit(void); void TmModuleRunDeInit(void); #endif /* __TM_MODULES_H__ */ suricata-3.2.1/src/util-cuda-handlers.h0000644000000000000000000000354313051004444014644 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_CUDA_HANDLERS__H__ #define __UTIL_CUDA_HANDLERS__H__ #include "conf.h" #include "util-cuda.h" /************************conf file profile section**********************/ void CudaHandlerAddCudaProfileFromConf(const char *name, void *(*Callback)(ConfNode *node), void (*Free)(void *)); void *CudaHandlerGetCudaProfile(const char *name); void CudaHandlerFreeProfiles(void); /*******************cuda context related data section*******************/ #define CUDA_HANDLER_MODULE_DATA_TYPE_MEMORY_HOST 0 #define CUDA_HANDLER_MODULE_DATA_TYPE_MEMORY_DEVICE 1 #define CUDA_HANDLER_MODULE_DATA_TYPE_CUDA_BUFFER 2 CUcontext CudaHandlerModuleGetContext(const char *module_name, int device_id); void CudaHandlerModuleStoreData(const char *module_name, const char *data_name, void *data_ptr); void *CudaHandlerModuleGetData(const char *module_name, const char *data_name); int CudaHandlerGetCudaModule(CUmodule *p_module, const char *ptx_image); #endif /* __UTIL_CUDA_HANDLERS__H__ */ suricata-3.2.1/src/detect-http-ua.c0000644000000000000000000017667713051004444014025 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * * Implements support for the http_user_agent keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "stream-tcp.h" #include "detect-http-ua.h" #include "detect-engine-hua.h" int DetectHttpUASetup(DetectEngineCtx *, Signature *, char *); void DetectHttpUARegisterTests(void); void DetectHttpUAFree(void *); /** * \brief Registers the keyword handlers for the "http_user_agent" keyword. */ void DetectHttpUARegister(void) { sigmatch_table[DETECT_AL_HTTP_USER_AGENT].name = "http_user_agent"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].desc = "content modifier to match only on the HTTP User-Agent header"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_user-agent"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Match = NULL; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Setup = DetectHttpUASetup; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Free = DetectHttpUAFree; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].RegisterTests = DetectHttpUARegisterTests; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_user_agent", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HUADMATCH, 2, PrefilterTxUARegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HUADMATCH, DetectEngineInspectHttpUA); return; } /** * \brief The setup function for the http_user_agent keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to the signature for the current Signature being * parsed from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpUASetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_USER_AGENT, DETECT_SM_LIST_HUADMATCH, ALPROTO_HTTP, NULL); } /** * \brief The function to free the http_user_agent data. * * \param ptr Pointer to the http_user_agent. */ void DetectHttpUAFree(void *ptr) { DetectContentData *huad = (DetectContentData *)ptr; if (huad == NULL) return; if (huad->content != NULL) SCFree(huad->content); SpmDestroyCtx(huad->spm_ctx); SCFree(huad); return; } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_user_agent is correctly parsed * and the keyword is registered. */ static int DetectHttpUATest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_user_agent\"; " "content:\"one\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_user_agent entry is * parsed. */ static int DetectHttpUATest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_user_agent\"; " "content:\"one\"; http_user_agent:; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a * http_user_agent is invalidated. */ static int DetectHttpUATest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_user_agent\"; " "http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_user_agent is invalidated. */ static int DetectHttpUATest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_user_agent\"; " "content:\"one\"; rawbytes; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a http_user_agent with nocase is parsed. */ static int DetectHttpUATest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_user_agent\"; " "content:\"one\"; http_user_agent; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectHttpUATest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"message\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectHttpUATest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy message"; uint8_t http2_buf[] = "body1\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"message\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectHttpUATest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy mess"; uint8_t http2_buf[] = "age body\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"message\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_user_agent content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpUATest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy body1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"body1This\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_user_agent content matches against a http request * against a case insensitive pattern. */ static int DetectHttpUATest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy bodY1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy bodY1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"body1this\"; http_user_agent; nocase;" "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_user_agent content matches against a * http request which doesn't hold the content. */ static int DetectHttpUATest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:!\"message\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_user_agent content matches against a * http request which holds hold the content. */ static int DetectHttpUATest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy body\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:!\"message\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_user_agent content matches against a http request * which holds the content. */ static int DetectHttpUATest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http user agent test\"; " "content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_user_agent; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test multiple http transactions and body chunks of request handling */ static int DetectHttpUATest14(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "Cookie: dummy1\r\n"; uint8_t httpbuf3[] = "User-Agent: Body one!!\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf5[] = "Cookie: dummy2\r\n"; uint8_t httpbuf6[] = "User-Agent: Body two\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy1\"; http_cookie; content:\"Body one\"; http_user_agent; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"dummy2\"; http_cookie; content:\"Body two\"; http_user_agent; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2)) { printf("sig 1 alerted (4): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) { printf("sig 1 alerted (request 2, chunk 6): "); goto end; } p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || !(PacketAlertCheck(p, 2))) { printf("signature 2 didn't match or sig 1 matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } int DetectHttpUATest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; content:\"two\"; http_user_agent; " "content:\"three\"; distance:10; http_user_agent; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "two", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_DISTANCE || memcmp(huad2->content, "three", huad1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd1) || !DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; pcre:/two/; " "content:\"three\"; distance:10; http_user_agent; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_DISTANCE || memcmp(huad2->content, "three", huad1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; pcre:/two/; " "content:\"three\"; distance:10; within:15; http_user_agent; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(huad2->content, "three", huad1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; pcre:/two/; " "content:\"three\"; distance:10; http_user_agent; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_DISTANCE || memcmp(huad2->content, "three", huad1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_user_agent; pcre:/two/; " "content:\"three\"; distance:10; http_user_agent; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(huad2->content, "three", huad1->content_len) != 0) { printf ("failed: http_user_agent incorrect flags"); goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_user_agent; pcre:/two/; " "content:\"three\"; distance:10; http_user_agent; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; pcre:/two/; " "content:\"three\"; http_user_agent; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || huad1->flags != 0 || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_DEPTH || memcmp(huad2->content, "three", huad1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || !DETECT_CONTENT_IS_SINGLE(huad1) || DETECT_CONTENT_IS_SINGLE(huad2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; distance:0; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_DISTANCE || memcmp(huad2->content, "two", huad1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; within:5; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "one", huad1->content_len) != 0 || huad2->flags != DETECT_CONTENT_WITHIN || memcmp(huad2->content, "two", huad1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_user_agent; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list != NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/V; " "content:\"two\"; within:5; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || huad2->flags != DETECT_CONTENT_WITHIN || memcmp(huad2->content, "two", huad2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"two\"; http_user_agent; " "pcre:/one/VR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *huad1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || huad1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(huad1->content, "two", huad1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUATest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/V; " "content:\"two\"; distance:5; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; DetectContentData *huad2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || huad2->flags != DETECT_CONTENT_DISTANCE || memcmp(huad2->content, "two", huad2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectHttpUARegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpUATest01", DetectHttpUATest01); UtRegisterTest("DetectHttpUATest02", DetectHttpUATest02); UtRegisterTest("DetectHttpUATest03", DetectHttpUATest03); UtRegisterTest("DetectHttpUATest04", DetectHttpUATest04); UtRegisterTest("DetectHttpUATest05", DetectHttpUATest05); UtRegisterTest("DetectHttpUATest06", DetectHttpUATest06); UtRegisterTest("DetectHttpUATest07", DetectHttpUATest07); UtRegisterTest("DetectHttpUATest08", DetectHttpUATest08); UtRegisterTest("DetectHttpUATest09", DetectHttpUATest09); UtRegisterTest("DetectHttpUATest10", DetectHttpUATest10); UtRegisterTest("DetectHttpUATest11", DetectHttpUATest11); UtRegisterTest("DetectHttpUATest12", DetectHttpUATest12); UtRegisterTest("DetectHttpUATest13", DetectHttpUATest13); UtRegisterTest("DetectHttpUATest14", DetectHttpUATest14); UtRegisterTest("DetectHttpUATest22", DetectHttpUATest22); UtRegisterTest("DetectHttpUATest23", DetectHttpUATest23); UtRegisterTest("DetectHttpUATest24", DetectHttpUATest24); UtRegisterTest("DetectHttpUATest25", DetectHttpUATest25); UtRegisterTest("DetectHttpUATest26", DetectHttpUATest26); UtRegisterTest("DetectHttpUATest27", DetectHttpUATest27); UtRegisterTest("DetectHttpUATest28", DetectHttpUATest28); UtRegisterTest("DetectHttpUATest29", DetectHttpUATest29); UtRegisterTest("DetectHttpUATest30", DetectHttpUATest30); UtRegisterTest("DetectHttpUATest31", DetectHttpUATest31); UtRegisterTest("DetectHttpUATest32", DetectHttpUATest32); UtRegisterTest("DetectHttpUATest33", DetectHttpUATest33); UtRegisterTest("DetectHttpUATest34", DetectHttpUATest34); UtRegisterTest("DetectHttpUATest35", DetectHttpUATest35); UtRegisterTest("DetectHttpUATest36", DetectHttpUATest36); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/util-misc.c0000644000000000000000000005337113051004444013064 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "config.h" #include "suricata.h" #include "util-byte.h" #include "util-debug.h" #include "util-unittest.h" #define PARSE_REGEX "^\\s*(\\d+(?:.\\d+)?)\\s*([a-zA-Z]{2})?\\s*$" static pcre *parse_regex = NULL; static pcre_extra *parse_regex_study = NULL; void ParseSizeInit(void) { const char *eb = NULL; int eo; int opts = 0; parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); if (parse_regex == NULL) { SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset " "%" PRId32 ": %s", PARSE_REGEX, eo, eb); exit(EXIT_FAILURE); } parse_regex_study = pcre_study(parse_regex, 0, &eb); if (eb != NULL) { SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); exit(EXIT_FAILURE); } } void ParseSizeDeinit(void) { if (parse_regex != NULL) pcre_free(parse_regex); if (parse_regex_study != NULL) pcre_free_study(parse_regex_study); } /* size string parsing API */ static int ParseSizeString(const char *size, double *res) { #define MAX_SUBSTRINGS 30 int pcre_exec_ret; int r; int ov[MAX_SUBSTRINGS]; int retval = 0; char str[128]; char str2[128]; *res = 0; pcre_exec_ret = pcre_exec(parse_regex, parse_regex_study, size, strlen(size), 0, 0, ov, MAX_SUBSTRINGS); if (!(pcre_exec_ret == 2 || pcre_exec_ret == 3)) { SCLogError(SC_ERR_PCRE_MATCH, "invalid size argument - %s. Valid size " "argument should be in the format - \n" "xxx <- indicates it is just bytes\n" "xxxkb or xxxKb or xxxKB or xxxkB <- indicates kilobytes\n" "xxxmb or xxxMb or xxxMB or xxxmB <- indicates megabytes\n" "xxxgb or xxxGb or xxxGB or xxxgB <- indicates gigabytes.\n", size); retval = -2; goto end; } r = pcre_copy_substring((char *)size, ov, MAX_SUBSTRINGS, 1, str, sizeof(str)); if (r < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); retval = -2; goto end; } char *endptr, *str_ptr = str; errno = 0; *res = strtod(str_ptr, &endptr); if (errno == ERANGE) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); retval = -1; goto end; } else if (endptr == str_ptr) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); retval = -1; goto end; } if (pcre_exec_ret == 3) { r = pcre_copy_substring((char *)size, ov, MAX_SUBSTRINGS, 2, str2, sizeof(str2)); if (r < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); retval = -2; goto end; } if (strcasecmp(str2, "kb") == 0) { *res *= 1024; } else if (strcasecmp(str2, "mb") == 0) { *res *= 1024 * 1024; } else if (strcasecmp(str2, "gb") == 0) { *res *= 1024 * 1024 * 1024; } else { /* Bad unit. */ retval = -1; goto end; } } retval = 0; end: return retval; } int ParseSizeStringU8(const char *size, uint8_t *res) { double temp_res = 0; *res = 0; int r = ParseSizeString(size, &temp_res); if (r < 0) return r; if (temp_res > UINT8_MAX) return -1; *res = temp_res; return 0; } int ParseSizeStringU16(const char *size, uint16_t *res) { double temp_res = 0; *res = 0; int r = ParseSizeString(size, &temp_res); if (r < 0) return r; if (temp_res > UINT16_MAX) return -1; *res = temp_res; return 0; } int ParseSizeStringU32(const char *size, uint32_t *res) { double temp_res = 0; *res = 0; int r = ParseSizeString(size, &temp_res); if (r < 0) return r; if (temp_res > UINT32_MAX) return -1; *res = temp_res; return 0; } int ParseSizeStringU64(const char *size, uint64_t *res) { double temp_res = 0; *res = 0; int r = ParseSizeString(size, &temp_res); if (r < 0) return r; if (temp_res > UINT64_MAX) return -1; *res = temp_res; return 0; } /*********************************Unittests********************************/ #ifdef UNITTESTS int UtilMiscParseSizeStringTest01(void) { const char *str; double result; /* no space */ str = "10"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = "10kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = "10gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240UL) { goto error; } /* space start */ str = " 10"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = " 10kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = " 10gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space end */ str = "10 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = "10kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = "10gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space start - space end */ str = " 10 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = " 10kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = " 10gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space between number and scale */ /* no space */ str = "10"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = "10 kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = "10 gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space start */ str = " 10"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = " 10 kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = " 10 gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space end */ str = "10 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = "10 kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = "10 mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = "10 gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* space start - space end */ str = " 10 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10) { goto error; } str = " 10 kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024) { goto error; } str = " 10 mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10 * 1024 * 1024) { goto error; } str = " 10 gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10737418240) { goto error; } /* no space */ str = "10.5"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = "10.5kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = "10.5gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space start */ str = " 10.5"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = " 10.5kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = " 10.5gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space end */ str = "10.5 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = "10.5kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = "10.5gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space start - space end */ str = " 10.5 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = " 10.5kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = " 10.5gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space between number and scale */ /* no space */ str = "10.5"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = "10.5 kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = "10.5 gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space start */ str = " 10.5"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = " 10.5 kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 Kb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 KB"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 mb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = " 10.5 gb"; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space end */ str = "10.5 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = "10.5 kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = "10.5 mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = "10.5 gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* space start - space end */ str = " 10.5 "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5) { goto error; } str = " 10.5 kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 Kb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 KB "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024) { goto error; } str = " 10.5 mb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024) { goto error; } str = " 10.5 gb "; result = 0; if (ParseSizeString(str, &result) > 0) { goto error; } if (result != 10.5 * 1024 * 1024 * 1024) { goto error; } /* Should fail on unknown units. */ if (ParseSizeString("32eb", &result) > 0) { goto error; } return 1; error: return 0; } #endif /* UNITTESTS */ void UtilMiscRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("UtilMiscParseSizeStringTest01", UtilMiscParseSizeStringTest01); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/detect-tls-cert-validity.h0000644000000000000000000000300213051004444015773 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland */ #ifndef __DETECT_TLS_VALIDITY_H__ #define __DETECT_TLS_VALIDITY_H__ #define DETECT_TLS_VALIDITY_EQ (1) /* equal */ #define DETECT_TLS_VALIDITY_LT (1<<1) /* less than */ #define DETECT_TLS_VALIDITY_GT (1<<2) /* greater than */ #define DETECT_TLS_VALIDITY_RA (1<<3) /* range */ /* Used by tls_cert_expired */ #define DETECT_TLS_VALIDITY_EX (1<<4) /* expired */ /* Used by tls_cert_valid */ #define DETECT_TLS_VALIDITY_VA (1<<5) /* valid */ #define DETECT_TLS_TYPE_NOTBEFORE 0 #define DETECT_TLS_TYPE_NOTAFTER 1 typedef struct DetectTlsValidityData_ { time_t epoch; time_t epoch2; uint8_t mode; uint8_t type; } DetectTlsValidityData; /* prototypes */ void DetectTlsValidityRegister (void); #endif /* __DETECT_TLS_VALIDITY_H__ */ suricata-3.2.1/src/detect-ipproto.c0000644000000000000000000073314313051004444014122 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Implements the ip_proto keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-ipproto.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /** * \brief Regex for parsing our options */ #define PARSE_REGEX "^\\s*" \ "([!<>]?)" \ "\\s*([^\\s]+)" \ "\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectIPProtoSetup(DetectEngineCtx *, Signature *, char *); static DetectIPProtoData *DetectIPProtoParse(const char *); static void DetectIPProtoRegisterTests(void); static void DetectIPProtoFree(void *); void DetectIPProtoRegister(void) { sigmatch_table[DETECT_IPPROTO].name = "ip_proto"; sigmatch_table[DETECT_IPPROTO].desc = "match on the IP protocol in the packet-header"; sigmatch_table[DETECT_IPPROTO].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ip-proto"; sigmatch_table[DETECT_IPPROTO].Match = NULL; sigmatch_table[DETECT_IPPROTO].Setup = DetectIPProtoSetup; sigmatch_table[DETECT_IPPROTO].Free = DetectIPProtoFree; sigmatch_table[DETECT_IPPROTO].RegisterTests = DetectIPProtoRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \internal * \brief Parse ip_proto options string. * * \param optstr Options string to parse * * \return New ip_proto data structure */ static DetectIPProtoData *DetectIPProtoParse(const char *optstr) { DetectIPProtoData *data = NULL; char *args[2] = { NULL, NULL }; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i; const char *str_ptr; /* Execute the regex and populate args with captures. */ ret = pcre_exec(parse_regex, parse_regex_study, optstr, strlen(optstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret" "%" PRId32 ", string %s", ret, optstr); goto error; } for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)optstr, ov, MAX_SUBSTRINGS, i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i] = (char *)str_ptr; } /* Initialize the data */ data = SCMalloc(sizeof(DetectIPProtoData)); if (unlikely(data == NULL)) goto error; data->op = DETECT_IPPROTO_OP_EQ; data->proto = 0; /* Operator */ if (*(args[0]) != '\0') { data->op = *(args[0]); } /* Protocol name/number */ if (!isdigit((unsigned char)*(args[1]))) { struct protoent *pent = getprotobyname(args[1]); if (pent == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed protocol name: %s", str_ptr); goto error; } data->proto = (uint8_t)pent->p_proto; } else { if (ByteExtractStringUint8(&data->proto, 10, 0, args[1]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed protocol number: %s", str_ptr); goto error; } } for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } return data; error: for (i = 0; i < (ret - 1) && i < 2; i++){ if (args[i] != NULL) SCFree(args[i]); } if (data != NULL) SCFree(data); return NULL; } static int DetectIPProtoTypePresentForOP(Signature *s, uint8_t op) { SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; DetectIPProtoData *data; while (sm != NULL) { if (sm->type == DETECT_IPPROTO) { data = (DetectIPProtoData *)sm->ctx; if (data->op == op) return 1; } sm = sm->next; } return 0; } /* Updated by AS. Please do not remove this unused code. * Need it as we redo this code once we solve ipproto * multiple uses */ #if 0 static int DetectIPProtoQSortCompare(const void *a, const void *b) { const uint8_t *one = a; const uint8_t *two = b; return ((int)*one - *two); } #endif /** * \internal * \brief Setup ip_proto keyword. * * \param de_ctx Detection engine context * \param s Signature * \param optstr Options string * * \return Non-zero on error */ static int DetectIPProtoSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { SigMatch *sm = NULL; DetectIPProtoData *data = NULL; int i; data = DetectIPProtoParse((const char *)optstr); if (data == NULL) { goto error; } /* Reset our "any" (or "ip") state: for ipv4, ipv6 and ip cases, the bitfield * s->proto.proto have all bit set to 1 to be able to match any protocols. ipproto * will refined the protocol list and thus it needs to reset the bitfield to zero * before setting the value specified by the ip_proto keyword. */ if (s->proto.flags & (DETECT_PROTO_ANY | DETECT_PROTO_IPV6 | DETECT_PROTO_IPV4)) { s->proto.flags &= ~DETECT_PROTO_ANY; memset(s->proto.proto, 0x00, sizeof(s->proto.proto)); s->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; } else { /* The ipproto engine has a relationship with the protocol that is * set after the action and also the app protocol(that can also be * set through the app-layer-protocol. * An ip_proto keyword can be used only with alert ip, which if * not true we error out on the sig. And hence the init_flag to * indicate this. */ if (!(s->init_flags & SIG_FLAG_INIT_FIRST_IPPROTO_SEEN)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Signature can use " "ip_proto keyword only when we use alert ip, " "in which case the _ANY flag is set on the sig " "and the if condition should match."); goto error; } } int eq_set = DetectIPProtoTypePresentForOP(s, DETECT_IPPROTO_OP_EQ); int gt_set = DetectIPProtoTypePresentForOP(s, DETECT_IPPROTO_OP_GT); int lt_set = DetectIPProtoTypePresentForOP(s, DETECT_IPPROTO_OP_LT); int not_set = DetectIPProtoTypePresentForOP(s, DETECT_IPPROTO_OP_NOT); switch (data->op) { case DETECT_IPPROTO_OP_EQ: if (eq_set || gt_set || lt_set || not_set) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a eq " "ipproto without any operators attached to " "them in the same sig"); goto error; } s->proto.proto[data->proto / 8] |= 1 << (data->proto % 8); break; case DETECT_IPPROTO_OP_GT: if (eq_set || gt_set) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a eq or gt " "ipproto along with a greater than ipproto in the " "same sig "); goto error; } if (!lt_set && !not_set) { s->proto.proto[data->proto / 8] = 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0xff; } } else if (lt_set && !not_set) { SigMatch *temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO) { break; } temp_sm = temp_sm->next; } if (temp_sm != NULL) { DetectIPProtoData *data_temp = (DetectIPProtoData *)temp_sm->ctx; if (data_temp->proto <= data->proto) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have " "both gt and lt ipprotos, with the lt being " "lower than gt value"); goto error; /* Updated by AS. Please do not remove this unused code. Need it * as we redo this code once we solve ipproto multiple uses */ #if 0 s->proto.proto[data->proto / 8] |= 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0xff; } #endif } else { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0; } s->proto.proto[data->proto / 8] &= 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] &= 0xff; } } } } else if (!lt_set && not_set) { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0; } s->proto.proto[data->proto / 8] &= 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] &= 0xff; } } else { DetectIPProtoData *data_temp; SigMatch *temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO && ((DetectIPProtoData *)temp_sm->ctx)->op == DETECT_IPPROTO_OP_LT) { break; } temp_sm = temp_sm->next; } if (temp_sm != NULL) { data_temp = (DetectIPProtoData *)temp_sm->ctx; if (data_temp->proto <= data->proto) { /* Updated by AS. Please do not remove this unused code. * Need it as we redo this code once we solve ipproto * multiple uses */ SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have " "both gt and lt ipprotos, with the lt being " "lower than gt value"); goto error; #if 0 s->proto.proto[data->proto / 8] |= 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0xff; } temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; uint8_t *not_protos = NULL; int not_protos_len = 0; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO && ((DetectIPProtoData *)temp_sm->ctx)->op == DETECT_IPPROTO_OP_NOT) { DetectIPProtoData *data_temp = temp_sm->ctx; not_protos = SCRealloc(not_protos, (not_protos_len + 1) * sizeof(uint8_t)); if (not_protos == NULL) goto error; not_protos[not_protos_len] = data_temp->proto; not_protos_len++; } temp_sm = temp_sm->next; } qsort(not_protos, not_protos_len, sizeof(uint8_t), DetectIPProtoQSortCompare); int j = 0; while (j < not_protos_len) { if (not_protos[j] < data->proto) { ; } else { s->proto.proto[not_protos[j] / 8] &= ~(1 << (not_protos[j] % 8)); } j++; } #endif } else { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0; } s->proto.proto[data->proto / 8] &= 0xfe << (data->proto % 8); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] &= 0xff; } } } } break; case DETECT_IPPROTO_OP_LT: if (eq_set || lt_set) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a eq or lt " "ipproto along with a less than ipproto in the " "same sig "); goto error; } if (!gt_set && !not_set) { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0xff; } s->proto.proto[data->proto / 8] = ~(0xff << (data->proto % 8)); } else if (gt_set && !not_set) { SigMatch *temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO) { break; } temp_sm = temp_sm->next; } if (temp_sm != NULL) { DetectIPProtoData *data_temp = (DetectIPProtoData *)temp_sm->ctx; if (data_temp->proto >= data->proto) { /* Updated by AS. Please do not remove this unused code. * Need it as we redo this code once we solve ipproto * multiple uses */ SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a have " "both gt and lt ipprotos, with the lt being " "lower than gt value"); goto error; #if 0 for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0xff; } s->proto.proto[data->proto / 8] |= ~(0xff << (data->proto % 8));; #endif } else { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] &= 0xff; } s->proto.proto[data->proto / 8] &= ~(0xff << (data->proto % 8)); for (i = (data->proto / 8) + 1; i < 256 / 8; i++) { s->proto.proto[i] = 0; } } } } else if (!gt_set && not_set) { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] &= 0xFF; } s->proto.proto[data->proto / 8] &= ~(0xff << (data->proto % 8)); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0; } } else { DetectIPProtoData *data_temp; SigMatch *temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO && ((DetectIPProtoData *)temp_sm->ctx)->op == DETECT_IPPROTO_OP_GT) { break; } temp_sm = temp_sm->next; } if (temp_sm != NULL) { data_temp = (DetectIPProtoData *)temp_sm->ctx; if (data_temp->proto >= data->proto) { /* Updated by AS. Please do not remove this unused code. * Need it as we redo this code once we solve ipproto * multiple uses */ SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have " "both gt and lt ipprotos, with the lt being " "lower than gt value"); goto error; #if 0 for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0xff; } s->proto.proto[data->proto / 8] |= ~(0xff << (data->proto % 8)); temp_sm = s->sm_lists[DETECT_SM_LIST_MATCH]; uint8_t *not_protos = NULL; int not_protos_len = 0; while (temp_sm != NULL) { if (temp_sm->type == DETECT_IPPROTO && ((DetectIPProtoData *)temp_sm->ctx)->op == DETECT_IPPROTO_OP_NOT) { DetectIPProtoData *data_temp = temp_sm->ctx; not_protos = SCRealloc(not_protos, (not_protos_len + 1) * sizeof(uint8_t)); if (not_protos == NULL) goto error; not_protos[not_protos_len] = data_temp->proto; not_protos_len++; } temp_sm = temp_sm->next; } qsort(not_protos, not_protos_len, sizeof(uint8_t), DetectIPProtoQSortCompare); int j = 0; while (j < not_protos_len) { if (not_protos[j] < data->proto) { s->proto.proto[not_protos[j] / 8] &= ~(1 << (not_protos[j] % 8)); } else { ; } j++; } #endif } else { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] &= 0xFF; } s->proto.proto[data->proto / 8] &= ~(0xff << (data->proto % 8)); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0; } } } } break; case DETECT_IPPROTO_OP_NOT: if (eq_set) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a eq " "ipproto along with a not ipproto in the " "same sig "); goto error; } if (!gt_set && !lt_set && !not_set) { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] = 0xff; } s->proto.proto[data->proto / 8] = ~(1 << (data->proto % 8)); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] = 0xff; } } else { for (i = 0; i < (data->proto / 8); i++) { s->proto.proto[i] &= 0xff; } s->proto.proto[data->proto / 8] &= ~(1 << (data->proto % 8)); for (i = (data->proto / 8) + 1; i < (256 / 8); i++) { s->proto.proto[i] &= 0xff; } } break; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPPROTO; sm->ctx = (void *)data; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: return -1; } void DetectIPProtoRemoveAllSMs(Signature *s) { SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; while (sm != NULL) { if (sm->type != DETECT_IPPROTO) { sm = sm->next; continue; } SigMatch *tmp_sm = sm->next; SigMatchRemoveSMFromList(s, sm, DETECT_SM_LIST_MATCH); SigMatchFree(sm); sm = tmp_sm; } return; } static void DetectIPProtoFree(void *ptr) { DetectIPProtoData *data = (DetectIPProtoData *)ptr; if (data) { SCFree(data); } } /* UNITTESTS */ #ifdef UNITTESTS /** * \test DetectIPProtoTestParse01 is a test for an invalid proto number */ static int DetectIPProtoTestParse01(void) { int result = 0; DetectIPProtoData *data = NULL; data = DetectIPProtoParse("999"); if (data == NULL) { result = 1; } if (data) SCFree(data); return result; } /** * \test DetectIPProtoTestParse02 is a test for an invalid proto name */ static int DetectIPProtoTestParse02(void) { int result = 0; DetectIPProtoData *data = NULL; data = DetectIPProtoParse("foobarbooeek"); if (data == NULL) { result = 1; } if (data) SCFree(data); return result; } /** * \test DetectIPProtoTestSetup01 is a test for a protocol number */ static int DetectIPProtoTestSetup01(void) { int result = 0; Signature *sig; char *value_str = "14"; int value = atoi(value_str); int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; DetectIPProtoSetup(NULL, sig, value_str); for (i = 0; i < (value / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value / 8] != 0x40) { goto end; } for (i = (value / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } /** * \test DetectIPProtoTestSetup02 is a test for a protocol name */ static int DetectIPProtoTestSetup02(void) { int result = 0; Signature *sig = NULL; char *value_str = "tcp"; struct protoent *pent = getprotobyname(value_str); if (pent == NULL) { goto end; } uint8_t value = (uint8_t)pent->p_proto; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; DetectIPProtoSetup(NULL, sig, value_str); for (i = 0; i < (value / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value / 8] != 0x40) { goto end; } for (i = (value / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: if (sig != NULL) SigFree(sig); return result; } /** * \test DetectIPProtoTestSetup03 is a test for a < operator */ static int DetectIPProtoTestSetup03(void) { int result = 0; Signature *sig; char *value_str = "<14"; int value = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; DetectIPProtoSetup(NULL, sig, value_str); for (i = 0; i < (value / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value / 8] != 0x3F) { goto end; } for (i = (value / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } /** * \test DetectIPProtoTestSetup04 is a test for a > operator */ static int DetectIPProtoTestSetup04(void) { int result = 0; Signature *sig; char *value_str = ">14"; int value = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; DetectIPProtoSetup(NULL, sig, value_str); for (i = 0; i < (value / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value / 8] != 0x80) { goto end; } for (i = (value / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } /** * \test DetectIPProtoTestSetup05 is a test for a ! operator */ static int DetectIPProtoTestSetup05(void) { int result = 0; Signature *sig; char *value_str = "!14"; int value = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; DetectIPProtoSetup(NULL, sig, value_str); for (i = 0; i < (value / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value / 8] != 0xBF) { goto end; } for (i = (value / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup06(void) { int result = 0; Signature *sig; char *value1_str = "14"; char *value2_str = "15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup07(void) { int result = 0; Signature *sig; char *value1_str = "14"; char *value2_str = "<15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup08(void) { int result = 0; Signature *sig; char *value1_str = "14"; char *value2_str = ">15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup09(void) { int result = 0; Signature *sig; char *value1_str = "14"; char *value2_str = "!15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup10(void) { int result = 0; Signature *sig; char *value1_str = ">14"; char *value2_str = "15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup11(void) { int result = 0; Signature *sig; char *value1_str = "<14"; char *value2_str = "15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup12(void) { int result = 0; Signature *sig; char *value1_str = "!14"; char *value2_str = "15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } /** * \test Negative test. */ static int DetectIPProtoTestSetup13(void) { int result = 0; Signature *sig; char *value1_str = ">14"; char *value2_str = ">15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup14(void) { int result = 0; Signature *sig; char *value1_str = "<14"; char *value2_str = "<15"; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != -1) goto end; result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup15(void) { int result = 0; Signature *sig; char *value1_str = "<14"; int value1 = 14; char *value2_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x3F) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<14"; int value1 = 14; char *value2_str = ">34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x3F) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup16(void) { int result = 0; Signature *sig; char *value1_str = "<14"; char *value2_str = ">34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<14"; int value1 = 14; char *value2_str = ">34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x3F) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup17(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = ">13"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = ">13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0xC7) { goto end; } if (sig->proto.proto[value2 / 8] != 0xC7) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup18(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = ">13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xC0) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = ">13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0xC7) { goto end; } if (sig->proto.proto[value2 / 8] != 0xC7) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup19(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup20(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup21(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup22(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup23(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup24(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!13"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup25(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup26(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup27(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup28(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup29(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup30(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!18"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup31(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup32(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup33(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup34(void) { int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup35(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup36(void) { int result = 0; Signature *sig; char *value1_str = "<11"; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<11"; int value1 = 11; char *value2_str = "!34"; char *value3_str = ">36"; int value3 = 36; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x07) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xE0) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup37(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup38(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value3_str = ">14"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup39(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup40(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x80) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup41(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x80) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup42(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x80) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!12"; char *value3_str = ">14"; int value3 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x83) { goto end; } for (i = (value3 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup43(void) { int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup44(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup45(void) { int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup46(void) { int result = 0; Signature *sig; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup47(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup48(void) { int result = 0; Signature *sig; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup49(void) { int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup50(void) { int result = 0; Signature *sig; char *value1_str = "!11"; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup51(void) { int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup52(void) { int result = 0; Signature *sig; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x1F) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value3_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup53(void) { int result = 0; Signature *sig; char *value1_str = "!11"; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup54(void) { int result = 0; Signature *sig; char *value2_str = "<13"; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "!11"; int value1 = 11; char *value2_str = "<13"; int value2 = 13; char *value3_str = ">34"; int value3 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x17) { goto end; } for (i = (value2 / 8) + 1; i < value3 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value3 / 8] != 0xF8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup55(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup56(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; char *value3_str = "!37"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup57(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup58(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup59(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; char *value3_str = "!37"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup60(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!37"; int value3 = 37; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xD8) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup61(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup62(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; char *value3_str = "!44"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup63(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup64(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup65(void) { int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; char *value3_str = "!44"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup66(void) { int result = 0; Signature *sig; char *value1_str = "<13"; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; result = 1; end: SigFree(sig); return result; #if 0 int result = 0; Signature *sig; char *value1_str = "<13"; int value1 = 13; char *value2_str = ">34"; int value2 = 34; char *value3_str = "!44"; int value3 = 44; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1F) { goto end; } for (i = (value1 / 8) + 1; i < value2 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value3 / 8] != 0xEF) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; #endif } static int DetectIPProtoTestSetup67(void) { int result = 0; Signature *sig; char *value1_str = ">14"; int value1 = 14; char *value2_str = "<34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x80) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup68(void) { int result = 0; Signature *sig; char *value1_str = ">14"; int value1 = 14; char *value2_str = "<34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x80) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup69(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<14"; int value2 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x38) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup70(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<14"; int value2 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0x38) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup71(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!14"; int value2 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xB8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup72(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!14"; int value2 = 14; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xB8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup73(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup74(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!34"; int value2 = 34; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup75(void) { int result = 0; Signature *sig; char *value1_str = "!8"; char *value2_str = ">10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup76(void) { int result = 0; Signature *sig; char *value1_str = "!8"; char *value2_str = ">10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup77(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup78(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup79(void) { int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup80(void) { int result = 0; Signature *sig; char *value1_str = "!4"; int value1 = 4; char *value2_str = "<10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[value1 / 8] != 0xEF) { goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup81(void) { int result = 0; Signature *sig; char *value1_str = "!9"; int value1 = 9; char *value2_str = "<13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1D) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup82(void) { int result = 0; Signature *sig; char *value1_str = "!9"; int value1 = 9; char *value2_str = "<13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x1D) { goto end; } for (i = (value2 / 8) + 1; i < (256 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup83(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup84(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup85(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!35"; int value2 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup86(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!35"; int value2 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup87(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup88(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup89(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup90(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup91(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup92(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">10"; int value2 = 10; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x07) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup93(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup94(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup95(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup96(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup97(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup98(void) { int result = 0; Signature *sig; char *value1_str = "!9"; char *value2_str = ">12"; int value2 = 12; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xE0) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup99(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup100(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup101(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup102(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup103(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup104(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!13"; int value2 = 13; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xD8) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup105(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup106(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup107(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup108(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup109(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup110(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!18"; int value2 = 18; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } if (sig->proto.proto[value2 / 8] != 0xFB) { goto end; } for (i = (value2 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup111(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup112(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup113(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup114(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup115(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup116(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!33"; char *value3_str = "<35"; int value3 = 35; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value3 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value3 / 8] != 0x05) { goto end; } for (i = (value3 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup117(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup118(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup119(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup120(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup121(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup122(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!38"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup123(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup124(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup125(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup126(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup127(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup128(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "<34"; int value2 = 34; char *value3_str = "!45"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value2 / 8] != 0x03) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup129(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = ">10"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } if (DetectIPProtoSetup(NULL, sig, value2_str) == 0) goto end; result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup130(void) { int result = 0; Signature *sig; char *value1_str = "<10"; char *value2_str = ">10"; int value2 = 10; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) == 0) goto end; for (i = 0; i < (value2 / 8); i++) { if (sig->proto.proto[i] != 0) goto end; } if (sig->proto.proto[value2 / 8] != 0xF8) { goto end; } for (i = (value2 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup131(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!10"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup132(void) { int result = 0; Signature *sig; char *value1_str = "<10"; int value1 = 10; char *value2_str = "!10"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0xFF) goto end; } if (sig->proto.proto[value1 / 8] != 0x03) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0x0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup133(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!10"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup134(void) { int result = 0; Signature *sig; char *value1_str = ">10"; int value1 = 10; char *value2_str = "!10"; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; for (i = 0; i < (value1 / 8); i++) { if (sig->proto.proto[i] != 0x0) goto end; } if (sig->proto.proto[value1 / 8] != 0xF8) { goto end; } for (i = (value1 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0xFF) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup135(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup136(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup137(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup138(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup139(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup140(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup141(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup142(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!27"; char *value4_str = "!29"; char *value5_str = "!30"; char *value6_str = "!34"; char *value7_str = "<36"; char *value8_str = "!38"; int value8 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xFE) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value8 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup143(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!10"; char *value4_str = "!14"; char *value5_str = "!27"; char *value6_str = "!29"; char *value7_str = "!30"; char *value8_str = "!34"; char *value9_str = "<36"; char *value10_str = "!38"; int value10 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value9_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value10_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xBA) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value10 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup144(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!10"; char *value4_str = "!14"; char *value5_str = "!27"; char *value6_str = "!29"; char *value7_str = "!30"; char *value8_str = "!34"; char *value9_str = "<36"; char *value10_str = "!38"; int value10 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value10_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value9_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xBA) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value10 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSetup145(void) { int result = 0; Signature *sig; char *value1_str = "!4"; char *value2_str = ">8"; char *value3_str = "!10"; char *value4_str = "!14"; char *value5_str = "!27"; char *value6_str = "!29"; char *value7_str = "!30"; char *value8_str = "!34"; char *value9_str = "<36"; char *value10_str = "!38"; int value10 = 38; int i; if ((sig = SigAlloc()) == NULL) goto end; sig->init_flags |= SIG_FLAG_INIT_FIRST_IPPROTO_SEEN; sig->proto.flags |= DETECT_PROTO_ANY; if (DetectIPProtoSetup(NULL, sig, value5_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value8_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value2_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value10_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value1_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value6_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value9_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value4_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value3_str) != 0) goto end; if (DetectIPProtoSetup(NULL, sig, value7_str) != 0) goto end; if (sig->proto.proto[0] != 0) { goto end; } if (sig->proto.proto[1] != 0xBA) { goto end; } if (sig->proto.proto[2] != 0xFF) { goto end; } if (sig->proto.proto[3] != 0x97) { goto end; } if (sig->proto.proto[4] != 0x0B) { goto end; } for (i = (value10 / 8) + 1; i < 256 / 8; i++) { if (sig->proto.proto[i] != 0) goto end; } result = 1; end: SigFree(sig); return result; } static int DetectIPProtoTestSig1(void) { int result = 0; uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) return 0; char *sigs[4]; sigs[0] = "alert ip any any -> any any " "(msg:\"Not tcp\"; ip_proto:!tcp; content:\"GET \"; sid:1;)"; sigs[1] = "alert ip any any -> any any " "(msg:\"Less than 7\"; content:\"GET \"; ip_proto:<7; sid:2;)"; sigs[2] = "alert ip any any -> any any " "(msg:\"Greater than 5\"; content:\"GET \"; ip_proto:>5; sid:3;)"; sigs[3] = "alert ip any any -> any any " "(msg:\"Equals tcp\"; content:\"GET \"; ip_proto:tcp; sid:4;)"; /* sids to match */ uint32_t sid[4] = {1, 2, 3, 4}; /* expected matches for each sid within this packet we are testing */ uint32_t results[4] = {0, 1, 1, 1}; /* remember that UTHGenericTest expect the first parameter * as an array of packet pointers. And also a bidimensional array of results * For example: * results[numpacket][position] should hold the number of times * that the sid at sid[position] matched that packet (should be always 1..) * But here we built it as unidimensional array */ result = UTHGenericTest(&p, 1, sigs, sid, results, 4); UTHFreePacket(p); return result; } static int DetectIPProtoTestSig2(void) { int result = 0; uint8_t raw_eth[] = { 0x01, 0x00, 0x5e, 0x00, 0x00, 0x0d, 0x00, 0x26, 0x88, 0x61, 0x3a, 0x80, 0x08, 0x00, 0x45, 0xc0, 0x00, 0x36, 0xe4, 0xcd, 0x00, 0x00, 0x01, 0x67, 0xc7, 0xab, 0xac, 0x1c, 0x7f, 0xfe, 0xe0, 0x00, 0x00, 0x0d, 0x20, 0x00, 0x90, 0x20, 0x00, 0x01, 0x00, 0x02, 0x00, 0x69, 0x00, 0x02, 0x00, 0x04, 0x81, 0xf4, 0x07, 0xd0, 0x00, 0x13, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x14, 0x00, 0x04, 0x4a, 0xea, 0x7a, 0x8e, }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; p->proto = 0; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any (msg:\"Check ipproto usage\"; " "ip_proto:!103; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { result = 1; goto end; } else { result = 0; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FlowShutdown(); SCFree(p); return result; end: if (de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx) DetectEngineCtxFree(de_ctx); FlowShutdown(); SCFree(p); return result; } static int DetectIPProtoTestSig3(void) { int result = 0; uint8_t raw_eth[] = { 0x01, 0x00, 0x5e, 0x00, 0x00, 0x0d, 0x00, 0x26, 0x88, 0x61, 0x3a, 0x80, 0x08, 0x00, 0x45, 0xc0, 0x00, 0x36, 0xe4, 0xcd, 0x00, 0x00, 0x01, 0x67, 0xc7, 0xab, 0xac, 0x1c, 0x7f, 0xfe, 0xe0, 0x00, 0x00, 0x0d, 0x20, 0x00, 0x90, 0x20, 0x00, 0x01, 0x00, 0x02, 0x00, 0x69, 0x00, 0x02, 0x00, 0x04, 0x81, 0xf4, 0x07, 0xd0, 0x00, 0x13, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x14, 0x00, 0x04, 0x4a, 0xea, 0x7a, 0x8e, }; Packet *p = UTHBuildPacket((uint8_t *)"boom", 4, IPPROTO_TCP); if (p == NULL) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; p->proto = 0; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any (msg:\"Check ipproto usage\"; " "ip_proto:103; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { result = 0; goto end; } else { result = 1; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FlowShutdown(); SCFree(p); return result; end: if (de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx) DetectEngineCtxFree(de_ctx); FlowShutdown(); SCFree(p); return result; } #endif /* UNITTESTS */ /** * \internal * \brief Register ip_proto tests. */ static void DetectIPProtoRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectIPProtoTestParse01", DetectIPProtoTestParse01); UtRegisterTest("DetectIPProtoTestParse02", DetectIPProtoTestParse02); UtRegisterTest("DetectIPProtoTestSetup01", DetectIPProtoTestSetup01); UtRegisterTest("DetectIPProtoTestSetup02", DetectIPProtoTestSetup02); UtRegisterTest("DetectIPProtoTestSetup03", DetectIPProtoTestSetup03); UtRegisterTest("DetectIPProtoTestSetup04", DetectIPProtoTestSetup04); UtRegisterTest("DetectIPProtoTestSetup05", DetectIPProtoTestSetup05); UtRegisterTest("DetectIPProtoTestSetup06", DetectIPProtoTestSetup06); UtRegisterTest("DetectIPProtoTestSetup07", DetectIPProtoTestSetup07); UtRegisterTest("DetectIPProtoTestSetup08", DetectIPProtoTestSetup08); UtRegisterTest("DetectIPProtoTestSetup09", DetectIPProtoTestSetup09); UtRegisterTest("DetectIPProtoTestSetup10", DetectIPProtoTestSetup10); UtRegisterTest("DetectIPProtoTestSetup11", DetectIPProtoTestSetup11); UtRegisterTest("DetectIPProtoTestSetup12", DetectIPProtoTestSetup12); UtRegisterTest("DetectIPProtoTestSetup13", DetectIPProtoTestSetup13); UtRegisterTest("DetectIPProtoTestSetup14", DetectIPProtoTestSetup14); UtRegisterTest("DetectIPProtoTestSetup15", DetectIPProtoTestSetup15); UtRegisterTest("DetectIPProtoTestSetup16", DetectIPProtoTestSetup16); UtRegisterTest("DetectIPProtoTestSetup17", DetectIPProtoTestSetup17); UtRegisterTest("DetectIPProtoTestSetup18", DetectIPProtoTestSetup18); UtRegisterTest("DetectIPProtoTestSetup19", DetectIPProtoTestSetup19); UtRegisterTest("DetectIPProtoTestSetup20", DetectIPProtoTestSetup20); UtRegisterTest("DetectIPProtoTestSetup21", DetectIPProtoTestSetup21); UtRegisterTest("DetectIPProtoTestSetup22", DetectIPProtoTestSetup22); UtRegisterTest("DetectIPProtoTestSetup23", DetectIPProtoTestSetup23); UtRegisterTest("DetectIPProtoTestSetup24", DetectIPProtoTestSetup24); UtRegisterTest("DetectIPProtoTestSetup25", DetectIPProtoTestSetup25); UtRegisterTest("DetectIPProtoTestSetup26", DetectIPProtoTestSetup26); UtRegisterTest("DetectIPProtoTestSetup27", DetectIPProtoTestSetup27); UtRegisterTest("DetectIPProtoTestSetup28", DetectIPProtoTestSetup28); UtRegisterTest("DetectIPProtoTestSetup29", DetectIPProtoTestSetup29); UtRegisterTest("DetectIPProtoTestSetup30", DetectIPProtoTestSetup30); UtRegisterTest("DetectIPProtoTestSetup31", DetectIPProtoTestSetup31); UtRegisterTest("DetectIPProtoTestSetup32", DetectIPProtoTestSetup32); UtRegisterTest("DetectIPProtoTestSetup33", DetectIPProtoTestSetup33); UtRegisterTest("DetectIPProtoTestSetup34", DetectIPProtoTestSetup34); UtRegisterTest("DetectIPProtoTestSetup35", DetectIPProtoTestSetup35); UtRegisterTest("DetectIPProtoTestSetup36", DetectIPProtoTestSetup36); UtRegisterTest("DetectIPProtoTestSetup37", DetectIPProtoTestSetup37); UtRegisterTest("DetectIPProtoTestSetup38", DetectIPProtoTestSetup38); UtRegisterTest("DetectIPProtoTestSetup39", DetectIPProtoTestSetup39); UtRegisterTest("DetectIPProtoTestSetup40", DetectIPProtoTestSetup40); UtRegisterTest("DetectIPProtoTestSetup41", DetectIPProtoTestSetup41); UtRegisterTest("DetectIPProtoTestSetup42", DetectIPProtoTestSetup42); UtRegisterTest("DetectIPProtoTestSetup43", DetectIPProtoTestSetup43); UtRegisterTest("DetectIPProtoTestSetup44", DetectIPProtoTestSetup44); UtRegisterTest("DetectIPProtoTestSetup45", DetectIPProtoTestSetup45); UtRegisterTest("DetectIPProtoTestSetup46", DetectIPProtoTestSetup46); UtRegisterTest("DetectIPProtoTestSetup47", DetectIPProtoTestSetup47); UtRegisterTest("DetectIPProtoTestSetup48", DetectIPProtoTestSetup48); UtRegisterTest("DetectIPProtoTestSetup49", DetectIPProtoTestSetup49); UtRegisterTest("DetectIPProtoTestSetup50", DetectIPProtoTestSetup50); UtRegisterTest("DetectIPProtoTestSetup51", DetectIPProtoTestSetup51); UtRegisterTest("DetectIPProtoTestSetup52", DetectIPProtoTestSetup52); UtRegisterTest("DetectIPProtoTestSetup53", DetectIPProtoTestSetup53); UtRegisterTest("DetectIPProtoTestSetup54", DetectIPProtoTestSetup54); UtRegisterTest("DetectIPProtoTestSetup55", DetectIPProtoTestSetup55); UtRegisterTest("DetectIPProtoTestSetup56", DetectIPProtoTestSetup56); UtRegisterTest("DetectIPProtoTestSetup57", DetectIPProtoTestSetup57); UtRegisterTest("DetectIPProtoTestSetup58", DetectIPProtoTestSetup58); UtRegisterTest("DetectIPProtoTestSetup59", DetectIPProtoTestSetup59); UtRegisterTest("DetectIPProtoTestSetup60", DetectIPProtoTestSetup60); UtRegisterTest("DetectIPProtoTestSetup61", DetectIPProtoTestSetup61); UtRegisterTest("DetectIPProtoTestSetup62", DetectIPProtoTestSetup62); UtRegisterTest("DetectIPProtoTestSetup63", DetectIPProtoTestSetup63); UtRegisterTest("DetectIPProtoTestSetup64", DetectIPProtoTestSetup64); UtRegisterTest("DetectIPProtoTestSetup65", DetectIPProtoTestSetup65); UtRegisterTest("DetectIPProtoTestSetup66", DetectIPProtoTestSetup66); UtRegisterTest("DetectIPProtoTestSetup67", DetectIPProtoTestSetup67); UtRegisterTest("DetectIPProtoTestSetup68", DetectIPProtoTestSetup68); UtRegisterTest("DetectIPProtoTestSetup69", DetectIPProtoTestSetup69); UtRegisterTest("DetectIPProtoTestSetup70", DetectIPProtoTestSetup70); UtRegisterTest("DetectIPProtoTestSetup71", DetectIPProtoTestSetup71); UtRegisterTest("DetectIPProtoTestSetup72", DetectIPProtoTestSetup72); UtRegisterTest("DetectIPProtoTestSetup73", DetectIPProtoTestSetup73); UtRegisterTest("DetectIPProtoTestSetup74", DetectIPProtoTestSetup74); UtRegisterTest("DetectIPProtoTestSetup75", DetectIPProtoTestSetup75); UtRegisterTest("DetectIPProtoTestSetup76", DetectIPProtoTestSetup76); UtRegisterTest("DetectIPProtoTestSetup77", DetectIPProtoTestSetup77); UtRegisterTest("DetectIPProtoTestSetup78", DetectIPProtoTestSetup78); UtRegisterTest("DetectIPProtoTestSetup79", DetectIPProtoTestSetup79); UtRegisterTest("DetectIPProtoTestSetup80", DetectIPProtoTestSetup80); UtRegisterTest("DetectIPProtoTestSetup81", DetectIPProtoTestSetup81); UtRegisterTest("DetectIPProtoTestSetup82", DetectIPProtoTestSetup82); UtRegisterTest("DetectIPProtoTestSetup83", DetectIPProtoTestSetup83); UtRegisterTest("DetectIPProtoTestSetup84", DetectIPProtoTestSetup84); UtRegisterTest("DetectIPProtoTestSetup85", DetectIPProtoTestSetup85); UtRegisterTest("DetectIPProtoTestSetup86", DetectIPProtoTestSetup86); UtRegisterTest("DetectIPProtoTestSetup87", DetectIPProtoTestSetup87); UtRegisterTest("DetectIPProtoTestSetup88", DetectIPProtoTestSetup88); UtRegisterTest("DetectIPProtoTestSetup89", DetectIPProtoTestSetup89); UtRegisterTest("DetectIPProtoTestSetup90", DetectIPProtoTestSetup90); UtRegisterTest("DetectIPProtoTestSetup91", DetectIPProtoTestSetup91); UtRegisterTest("DetectIPProtoTestSetup92", DetectIPProtoTestSetup92); UtRegisterTest("DetectIPProtoTestSetup93", DetectIPProtoTestSetup93); UtRegisterTest("DetectIPProtoTestSetup94", DetectIPProtoTestSetup94); UtRegisterTest("DetectIPProtoTestSetup95", DetectIPProtoTestSetup95); UtRegisterTest("DetectIPProtoTestSetup96", DetectIPProtoTestSetup96); UtRegisterTest("DetectIPProtoTestSetup97", DetectIPProtoTestSetup97); UtRegisterTest("DetectIPProtoTestSetup98", DetectIPProtoTestSetup98); UtRegisterTest("DetectIPProtoTestSetup99", DetectIPProtoTestSetup99); UtRegisterTest("DetectIPProtoTestSetup100", DetectIPProtoTestSetup100); UtRegisterTest("DetectIPProtoTestSetup101", DetectIPProtoTestSetup101); UtRegisterTest("DetectIPProtoTestSetup102", DetectIPProtoTestSetup102); UtRegisterTest("DetectIPProtoTestSetup103", DetectIPProtoTestSetup103); UtRegisterTest("DetectIPProtoTestSetup104", DetectIPProtoTestSetup104); UtRegisterTest("DetectIPProtoTestSetup105", DetectIPProtoTestSetup105); UtRegisterTest("DetectIPProtoTestSetup106", DetectIPProtoTestSetup106); UtRegisterTest("DetectIPProtoTestSetup107", DetectIPProtoTestSetup107); UtRegisterTest("DetectIPProtoTestSetup108", DetectIPProtoTestSetup108); UtRegisterTest("DetectIPProtoTestSetup109", DetectIPProtoTestSetup109); UtRegisterTest("DetectIPProtoTestSetup110", DetectIPProtoTestSetup110); UtRegisterTest("DetectIPProtoTestSetup111", DetectIPProtoTestSetup111); UtRegisterTest("DetectIPProtoTestSetup112", DetectIPProtoTestSetup112); UtRegisterTest("DetectIPProtoTestSetup113", DetectIPProtoTestSetup113); UtRegisterTest("DetectIPProtoTestSetup114", DetectIPProtoTestSetup114); UtRegisterTest("DetectIPProtoTestSetup115", DetectIPProtoTestSetup115); UtRegisterTest("DetectIPProtoTestSetup116", DetectIPProtoTestSetup116); UtRegisterTest("DetectIPProtoTestSetup117", DetectIPProtoTestSetup117); UtRegisterTest("DetectIPProtoTestSetup118", DetectIPProtoTestSetup118); UtRegisterTest("DetectIPProtoTestSetup119", DetectIPProtoTestSetup119); UtRegisterTest("DetectIPProtoTestSetup120", DetectIPProtoTestSetup120); UtRegisterTest("DetectIPProtoTestSetup121", DetectIPProtoTestSetup121); UtRegisterTest("DetectIPProtoTestSetup122", DetectIPProtoTestSetup122); UtRegisterTest("DetectIPProtoTestSetup123", DetectIPProtoTestSetup123); UtRegisterTest("DetectIPProtoTestSetup124", DetectIPProtoTestSetup124); UtRegisterTest("DetectIPProtoTestSetup125", DetectIPProtoTestSetup125); UtRegisterTest("DetectIPProtoTestSetup126", DetectIPProtoTestSetup126); UtRegisterTest("DetectIPProtoTestSetup127", DetectIPProtoTestSetup127); UtRegisterTest("DetectIPProtoTestSetup128", DetectIPProtoTestSetup128); UtRegisterTest("DetectIPProtoTestSetup129", DetectIPProtoTestSetup129); UtRegisterTest("DetectIPProtoTestSetup130", DetectIPProtoTestSetup130); UtRegisterTest("DetectIPProtoTestSetup131", DetectIPProtoTestSetup131); UtRegisterTest("DetectIPProtoTestSetup132", DetectIPProtoTestSetup132); UtRegisterTest("DetectIPProtoTestSetup133", DetectIPProtoTestSetup133); UtRegisterTest("DetectIPProtoTestSetup134", DetectIPProtoTestSetup134); UtRegisterTest("DetectIPProtoTestSetup135", DetectIPProtoTestSetup135); UtRegisterTest("DetectIPProtoTestSetup136", DetectIPProtoTestSetup136); UtRegisterTest("DetectIPProtoTestSetup137", DetectIPProtoTestSetup137); UtRegisterTest("DetectIPProtoTestSetup138", DetectIPProtoTestSetup138); UtRegisterTest("DetectIPProtoTestSetup139", DetectIPProtoTestSetup139); UtRegisterTest("DetectIPProtoTestSetup140", DetectIPProtoTestSetup140); UtRegisterTest("DetectIPProtoTestSetup141", DetectIPProtoTestSetup141); UtRegisterTest("DetectIPProtoTestSetup142", DetectIPProtoTestSetup142); UtRegisterTest("DetectIPProtoTestSetup143", DetectIPProtoTestSetup143); UtRegisterTest("DetectIPProtoTestSetup144", DetectIPProtoTestSetup144); UtRegisterTest("DetectIPProtoTestSetup145", DetectIPProtoTestSetup145); UtRegisterTest("DetectIPProtoTestSig1", DetectIPProtoTestSig1); UtRegisterTest("DetectIPProtoTestSig2", DetectIPProtoTestSig2); UtRegisterTest("DetectIPProtoTestSig3", DetectIPProtoTestSig3); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-hashlist.c0000644000000000000000000003110113051004444013733 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Chained hash table implementation * * The 'Free' pointer can be used to have the API free your * hashed data. If it's NULL it's the callers responsebility */ #include "suricata-common.h" #include "util-hashlist.h" #include "util-unittest.h" #include "util-debug.h" #include "util-memcmp.h" HashListTable* HashListTableInit(uint32_t size, uint32_t (*Hash)(struct HashListTable_ *, void *, uint16_t), char (*Compare)(void *, uint16_t, void *, uint16_t), void (*Free)(void *)) { HashListTable *ht = NULL; if (size == 0) { goto error; } if (Hash == NULL) { //printf("ERROR: HashListTableInit no Hash function\n"); goto error; } /* setup the filter */ ht = SCMalloc(sizeof(HashListTable)); if (unlikely(ht == NULL)) goto error; memset(ht,0,sizeof(HashListTable)); ht->array_size = size; ht->Hash = Hash; ht->Free = Free; if (Compare != NULL) ht->Compare = Compare; else ht->Compare = HashListTableDefaultCompare; /* setup the bitarray */ ht->array = SCMalloc(ht->array_size * sizeof(HashListTableBucket *)); if (ht->array == NULL) goto error; memset(ht->array,0,ht->array_size * sizeof(HashListTableBucket *)); ht->listhead = NULL; ht->listtail = NULL; return ht; error: if (ht != NULL) { if (ht->array != NULL) SCFree(ht->array); SCFree(ht); } return NULL; } void HashListTableFree(HashListTable *ht) { uint32_t i = 0; if (ht == NULL) return; /* free the buckets */ for (i = 0; i < ht->array_size; i++) { HashListTableBucket *hashbucket = ht->array[i]; while (hashbucket != NULL) { HashListTableBucket *next_hashbucket = hashbucket->bucknext; if (ht->Free != NULL) ht->Free(hashbucket->data); SCFree(hashbucket); hashbucket = next_hashbucket; } } /* free the array */ if (ht->array != NULL) SCFree(ht->array); SCFree(ht); } void HashListTablePrint(HashListTable *ht) { printf("\n----------- Hash Table Stats ------------\n"); printf("Buckets: %" PRIu32 "\n", ht->array_size); printf("Hash function pointer: %p\n", ht->Hash); printf("-----------------------------------------\n"); } int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen) { if (ht == NULL || data == NULL) return -1; uint32_t hash = ht->Hash(ht, data, datalen); SCLogDebug("ht %p hash %"PRIu32"", ht, hash); HashListTableBucket *hb = SCMalloc(sizeof(HashListTableBucket)); if (unlikely(hb == NULL)) goto error; memset(hb, 0, sizeof(HashListTableBucket)); hb->data = data; hb->size = datalen; hb->bucknext = NULL; hb->listnext = NULL; hb->listprev = NULL; if (ht->array[hash] == NULL) { ht->array[hash] = hb; } else { hb->bucknext = ht->array[hash]; ht->array[hash] = hb; } if (ht->listtail == NULL) { ht->listhead = hb; ht->listtail = hb; } else { hb->listprev = ht->listtail; ht->listtail->listnext = hb; ht->listtail = hb; } return 0; error: return -1; } int HashListTableRemove(HashListTable *ht, void *data, uint16_t datalen) { uint32_t hash = ht->Hash(ht, data, datalen); SCLogDebug("ht %p hash %"PRIu32"", ht, hash); if (ht->array[hash] == NULL) { SCLogDebug("ht->array[hash] NULL"); return -1; } /* fast track for just one data part */ if (ht->array[hash]->bucknext == NULL) { HashListTableBucket *hb = ht->array[hash]; if (ht->Compare(hb->data,hb->size,data,datalen) == 1) { /* remove from the list */ if (hb->listprev == NULL) { ht->listhead = hb->listnext; } else { hb->listprev->listnext = hb->listnext; } if (hb->listnext == NULL) { ht->listtail = hb->listprev; } else { hb->listnext->listprev = hb->listprev; } if (ht->Free != NULL) ht->Free(hb->data); SCFree(ht->array[hash]); ht->array[hash] = NULL; return 0; } SCLogDebug("fast track default case"); return -1; } /* more data in this bucket */ HashListTableBucket *hashbucket = ht->array[hash], *prev_hashbucket = NULL; do { if (ht->Compare(hashbucket->data,hashbucket->size,data,datalen) == 1) { /* remove from the list */ if (hashbucket->listprev == NULL) { ht->listhead = hashbucket->listnext; } else { hashbucket->listprev->listnext = hashbucket->listnext; } if (hashbucket->listnext == NULL) { ht->listtail = hashbucket->listprev; } else { hashbucket->listnext->listprev = hashbucket->listprev; } if (prev_hashbucket == NULL) { /* root bucket */ ht->array[hash] = hashbucket->bucknext; } else { /* child bucket */ prev_hashbucket->bucknext = hashbucket->bucknext; } /* remove this */ if (ht->Free != NULL) ht->Free(hashbucket->data); SCFree(hashbucket); return 0; } prev_hashbucket = hashbucket; hashbucket = hashbucket->bucknext; } while (hashbucket != NULL); SCLogDebug("slow track default case"); return -1; } char HashListTableDefaultCompare(void *data1, uint16_t len1, void *data2, uint16_t len2) { if (len1 != len2) return 0; if (SCMemcmp(data1,data2,len1) != 0) return 0; return 1; } void *HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen) { if (ht == NULL) { SCLogDebug("Hash List table is NULL"); return NULL; } uint32_t hash = ht->Hash(ht, data, datalen); if (ht->array[hash] == NULL) { return NULL; } HashListTableBucket *hashbucket = ht->array[hash]; do { if (ht->Compare(hashbucket->data,hashbucket->size,data,datalen) == 1) return hashbucket->data; hashbucket = hashbucket->bucknext; } while (hashbucket != NULL); return NULL; } uint32_t HashListTableGenericHash(HashListTable *ht, void *data, uint16_t datalen) { uint8_t *d = (uint8_t *)data; uint32_t i; uint32_t hash = 0; for (i = 0; i < datalen; i++) { if (i == 0) hash += (((uint32_t)*d++)); else if (i == 1) hash += (((uint32_t)*d++) * datalen); else hash *= (((uint32_t)*d++) * i) + datalen + i; } hash *= datalen; hash %= ht->array_size; return hash; } HashListTableBucket *HashListTableGetListHead(HashListTable *ht) { return ht->listhead; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS static int HashListTableTestInit01 (void) { HashListTable *ht = HashListTableInit(1024, HashListTableGenericHash, NULL, NULL); if (ht == NULL) return 0; HashListTableFree(ht); return 1; } /* no hash function, so it should fail */ static int HashListTableTestInit02 (void) { HashListTable *ht = HashListTableInit(1024, NULL, NULL, NULL); if (ht == NULL) return 1; HashListTableFree(ht); return 0; } static int HashListTableTestInit03 (void) { int result = 0; HashListTable *ht = HashListTableInit(1024, HashListTableGenericHash, NULL, NULL); if (ht == NULL) return 0; if (ht->Hash == HashListTableGenericHash) result = 1; HashListTableFree(ht); return result; } static int HashListTableTestInit04 (void) { HashListTable *ht = HashListTableInit(0, HashListTableGenericHash, NULL, NULL); if (ht == NULL) return 1; HashListTableFree(ht); return 0; } static int HashListTableTestAdd01 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, "test", 0); if (r != 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } static int HashListTableTestAdd02 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, NULL, 4); if (r == 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } static int HashListTableTestAdd03 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, "test", 0); if (r != 0) goto end; if (ht->listhead == NULL) { printf("ht->listhead == NULL: "); goto end; } if (ht->listtail == NULL) { printf("ht->listtail == NULL: "); goto end; } /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } static int HashListTableTestAdd04 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, "test", 4); if (r != 0) goto end; char *rp = HashListTableLookup(ht, "test", 4); if (rp == NULL) goto end; HashListTableBucket *htb = HashListTableGetListHead(ht); if (htb == NULL) { printf("htb == NULL: "); goto end; } char *rp2 = HashListTableGetListData(htb); if (rp2 == NULL) { printf("rp2 == NULL: "); goto end; } if (rp != rp2) { printf("rp != rp2: "); goto end; } /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } static int HashListTableTestFull01 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, "test", 4); if (r != 0) goto end; char *rp = HashListTableLookup(ht, "test", 4); if (rp == NULL) goto end; r = HashListTableRemove(ht, "test", 4); if (r != 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } static int HashListTableTestFull02 (void) { int result = 0; HashListTable *ht = HashListTableInit(32, HashListTableGenericHash, NULL, NULL); if (ht == NULL) goto end; int r = HashListTableAdd(ht, "test", 4); if (r != 0) goto end; char *rp = HashListTableLookup(ht, "test", 4); if (rp == NULL) goto end; r = HashListTableRemove(ht, "test2", 5); if (r == 0) goto end; /* all is good! */ result = 1; end: if (ht != NULL) HashListTableFree(ht); return result; } #endif /* UNITTESTS */ void HashListTableRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HashListTableTestInit01", HashListTableTestInit01); UtRegisterTest("HashListTableTestInit02", HashListTableTestInit02); UtRegisterTest("HashListTableTestInit03", HashListTableTestInit03); UtRegisterTest("HashListTableTestInit04", HashListTableTestInit04); UtRegisterTest("HashListTableTestAdd01", HashListTableTestAdd01); UtRegisterTest("HashListTableTestAdd02", HashListTableTestAdd02); UtRegisterTest("HashListTableTestAdd03", HashListTableTestAdd03); UtRegisterTest("HashListTableTestAdd04", HashListTableTestAdd04); UtRegisterTest("HashListTableTestFull01", HashListTableTestFull01); UtRegisterTest("HashListTableTestFull02", HashListTableTestFull02); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-threshold.h0000644000000000000000000000302113051004444015653 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * \author Victor Julien */ #ifndef __DETECT_ENGINE_THRESHOLD_H__ #define __DETECT_ENGINE_THRESHOLD_H__ #include "detect.h" #include "host.h" void ThresholdInit(void); int ThresholdHostStorageId(void); int ThresholdHostHasThreshold(Host *); const DetectThresholdData *SigGetThresholdTypeIter(const Signature *, Packet *, const SigMatch **, int list); int PacketAlertThreshold(DetectEngineCtx *, DetectEngineThreadCtx *, const DetectThresholdData *, Packet *, const Signature *, PacketAlert *); void ThresholdHashInit(DetectEngineCtx *); void ThresholdContextDestroy(DetectEngineCtx *); int ThresholdTimeoutCheck(Host *, struct timeval *); void ThresholdListFree(void *ptr); #endif /* __DETECT_ENGINE_THRESHOLD_H__ */ suricata-3.2.1/src/app-layer-dcerpc.c0000644000000000000000000103033413051004444014301 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl * \author Anoop Saldanha * * \file DCE/RPC parser and decoder * * \todo Remove all the unnecessary per byte incremental loops with a full one * time jump, i.e. * * input[0], input_len * for (i = 0; i < x; i++) * input++; * * with * * input += x; * * You'll be surprised at how many such cases we have here. We also need * to do the same for htp parser. Should speed up the engine drastically. */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-debug.h" #include "flow-util.h" #include "detect-engine-state.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer.h" #include "util-spm.h" #include "util-unittest.h" #include "app-layer-dcerpc.h" enum { DCERPC_FIELD_NONE = 0, DCERPC_PARSE_DCERPC_HEADER, DCERPC_PARSE_DCERPC_BIND, DCERPC_PARSE_DCERPC_BIND_ACK, DCERPC_PARSE_DCERPC_REQUEST, /* must be last */ DCERPC_FIELD_MAX, }; void DCERPCUuidListFree(DCERPCUuidEntryList *list); /* \brief hexdump function from libdnet, used for debugging only */ void hexdump(/*Flow *f,*/ const void *buf, size_t len) { /* dumps len bytes of *buf to stdout. Looks like: * [0000] 75 6E 6B 6E 6F 77 6E 20 * 30 FF 00 00 00 00 39 00 unknown 0.....9. * (in a single line of course) */ const unsigned char *p = buf; unsigned char c; size_t n; char bytestr[4] = {0}; char addrstr[10] = {0}; char hexstr[ 16*3 + 5] = {0}; char charstr[16*1 + 5] = {0}; for (n=1; n<=len; n++) { if (n%16 == 1) { /* store address for this line */ #if __WORDSIZE == 64 snprintf(addrstr, sizeof(addrstr), "%.4"PRIx64, ((uint64_t)p-(uint64_t)buf) ); #else snprintf(addrstr, sizeof(addrstr), "%.4"PRIx32, ((uint32_t)p-(uint32_t)buf) ); #endif } c = *p; if (isalnum(c) == 0) { c = '.'; } /* store hex str (for left side) */ snprintf(bytestr, sizeof(bytestr), "%02X ", *p); strlcat(hexstr, bytestr, sizeof(hexstr)-strlen(hexstr)-1); /* store char str (for right side) */ snprintf(bytestr, sizeof(bytestr), "%c", c); strlcat(charstr, bytestr, sizeof(charstr)-strlen(charstr)-1); if(n%16 == 0) { /* line completed */ printf("[%4.4s] %-50.50s %s\n", addrstr, hexstr, charstr); hexstr[0] = 0; charstr[0] = 0; } else if(n%8 == 0) { /* half line: add whitespaces */ strlcat(hexstr, " ", sizeof(hexstr)-strlen(hexstr)-1); strlcat(charstr, " ", sizeof(charstr)-strlen(charstr)-1); } p++; /* next byte */ } if (strlen(hexstr) > 0) { /* print rest of buffer if not empty */ printf("[%4.4s] %-50.50s %s\n", addrstr, hexstr, charstr); } } /** * \brief printUUID function used to print UUID, Major and Minor Version Number * and if it was Accepted or Rejected in the BIND_ACK. */ void printUUID(char *type, DCERPCUuidEntry *uuid) { uint8_t i = 0; if (uuid == NULL) { return; } printf("%s UUID [%2u] %s ", type, uuid->ctxid, (uuid->result == 0) ? "Accepted" : "Rejected"); for (i = 0; i < 16; i++) { printf("%02x", uuid->uuid[i]); } printf(" Major Version 0x%04x Minor Version 0x%04x\n", uuid->version, uuid->versionminor); } /** * \brief DCERPCParseSecondaryAddr reads secondaryaddrlen bytes from the BIND_ACK * DCERPC call. */ static uint32_t DCERPCParseSecondaryAddr(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; while (dcerpc->dcerpcbindbindack.secondaryaddrlenleft-- && input_len--) { SCLogDebug("0x%02x ", *p); p++; } dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t PaddingParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; while (dcerpc->padleft-- && input_len--) { SCLogDebug("0x%02x ", *p); p++; } dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t DCERPCGetCTXItems(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; if (input_len) { switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { case 0: if (input_len >= 4) { dcerpc->dcerpcbindbindack.numctxitems = *p; dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; dcerpc->dcerpcbindbindack.ctxbytesprocessed += 4; dcerpc->bytesprocessed += 4; SCReturnUInt(4U); } else { dcerpc->dcerpcbindbindack.numctxitems = *(p++); dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; if (!(--input_len)) break; } /* fall through */ case 1: p++; if (!(--input_len)) break; /* fall through */ case 2: p++; if (!(--input_len)) break; /* fall through */ case 3: p++; input_len--; break; } } dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** * \brief DCERPCParseBINDCTXItem is called for each CTXItem found the DCERPC BIND call. * each UUID is added to a TAILQ. */ static uint32_t DCERPCParseBINDCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; if (input_len) { switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { case 0: if (input_len >= 44) { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.ctxid = *(p); dcerpc->dcerpcbindbindack.ctxid |= *(p + 1) << 8; dcerpc->dcerpcbindbindack.uuid[3] = *(p + 4); dcerpc->dcerpcbindbindack.uuid[2] = *(p + 5); dcerpc->dcerpcbindbindack.uuid[1] = *(p + 6); dcerpc->dcerpcbindbindack.uuid[0] = *(p + 7); dcerpc->dcerpcbindbindack.uuid[5] = *(p + 8); dcerpc->dcerpcbindbindack.uuid[4] = *(p + 9); dcerpc->dcerpcbindbindack.uuid[7] = *(p + 10); dcerpc->dcerpcbindbindack.uuid[6] = *(p + 11); dcerpc->dcerpcbindbindack.uuid[8] = *(p + 12); dcerpc->dcerpcbindbindack.uuid[9] = *(p + 13); dcerpc->dcerpcbindbindack.uuid[10] = *(p + 14); dcerpc->dcerpcbindbindack.uuid[11] = *(p + 15); dcerpc->dcerpcbindbindack.uuid[12] = *(p + 16); dcerpc->dcerpcbindbindack.uuid[13] = *(p + 17); dcerpc->dcerpcbindbindack.uuid[14] = *(p + 18); dcerpc->dcerpcbindbindack.uuid[15] = *(p + 19); dcerpc->dcerpcbindbindack.version = *(p + 20); dcerpc->dcerpcbindbindack.version |= *(p + 21) << 8; dcerpc->dcerpcbindbindack.versionminor = *(p + 22); dcerpc->dcerpcbindbindack.versionminor |= *(p + 23) << 8; } else { /* Big Endian */ dcerpc->dcerpcbindbindack.ctxid = *(p) << 8; dcerpc->dcerpcbindbindack.ctxid |= *(p + 1); dcerpc->dcerpcbindbindack.uuid[0] = *(p + 4); dcerpc->dcerpcbindbindack.uuid[1] = *(p + 5); dcerpc->dcerpcbindbindack.uuid[2] = *(p + 6); dcerpc->dcerpcbindbindack.uuid[3] = *(p + 7); dcerpc->dcerpcbindbindack.uuid[4] = *(p + 8); dcerpc->dcerpcbindbindack.uuid[5] = *(p + 9); dcerpc->dcerpcbindbindack.uuid[6] = *(p + 10); dcerpc->dcerpcbindbindack.uuid[7] = *(p + 11); dcerpc->dcerpcbindbindack.uuid[8] = *(p + 12); dcerpc->dcerpcbindbindack.uuid[9] = *(p + 13); dcerpc->dcerpcbindbindack.uuid[10] = *(p + 14); dcerpc->dcerpcbindbindack.uuid[11] = *(p + 15); dcerpc->dcerpcbindbindack.uuid[12] = *(p + 16); dcerpc->dcerpcbindbindack.uuid[13] = *(p + 17); dcerpc->dcerpcbindbindack.uuid[14] = *(p + 18); dcerpc->dcerpcbindbindack.uuid[15] = *(p + 19); dcerpc->dcerpcbindbindack.version = *(p + 20) << 8; dcerpc->dcerpcbindbindack.version |= *(p + 21); dcerpc->dcerpcbindbindack.versionminor = *(p + 22) << 8; dcerpc->dcerpcbindbindack.versionminor |= *(p + 23); } //if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems // - dcerpc->dcerpcbindbindack.numctxitemsleft) { dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *)SCCalloc(1, sizeof(DCERPCUuidEntry)); if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { SCLogDebug("UUID Entry is NULL"); SCReturnUInt(0); } dcerpc->dcerpcbindbindack.uuid_entry->internal_id = dcerpc->dcerpcbindbindack.uuid_internal_id++; memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid, sizeof(dcerpc->dcerpcbindbindack.uuid)); dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid; dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version; dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor; /* store the first frag flag in the uuid as pfc_flags will * be overwritten by new packets. */ if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) { dcerpc->dcerpcbindbindack.uuid_entry->flags |= DCERPC_UUID_ENTRY_FLAG_FF; } TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry, next); #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("BIND", dcerpc->dcerpcbindbindack.uuid_entry); } #endif dcerpc->dcerpcbindbindack.numctxitemsleft--; dcerpc->bytesprocessed += (44); dcerpc->dcerpcbindbindack.ctxbytesprocessed += (44); SCReturnUInt(44U); //} else { // SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid, // dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft); // SCReturnUInt(0); //} } else { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.ctxid = *(p++); } else { dcerpc->dcerpcbindbindack.ctxid = *(p++) << 8; } if (!(--input_len)) break; } /* fall through */ case 1: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.ctxid |= *(p++) << 8; } else { dcerpc->dcerpcbindbindack.ctxid |= *(p++); } if (!(--input_len)) break; /* fall through */ case 2: /* num transact items */ p++; if (!(--input_len)) break; /* fall through */ case 3: /* reserved */ p++; if (!(--input_len)) break; /* fall through */ case 4: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[3] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[0] = *(p++); } if (!(--input_len)) break; /* fall through */ case 5: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[2] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[1] = *(p++); } if (!(--input_len)) break; /* fall through */ case 6: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[1] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[2] = *(p++); } if (!(--input_len)) break; /* fall through */ case 7: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[0] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[3] = *(p++); } if (!(--input_len)) break; /* fall through */ case 8: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[5] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[4] = *(p++); } if (!(--input_len)) break; /* fall through */ case 9: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[4] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[5] = *(p++); } if (!(--input_len)) break; /* fall through */ case 10: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[7] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[6] = *(p++); } if (!(--input_len)) break; /* fall through */ case 11: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.uuid[6] = *(p++); } else { dcerpc->dcerpcbindbindack.uuid[7] = *(p++); } if (!(--input_len)) break; /* fall through */ case 12: /* The following bytes are in the same order for both big and little endian */ dcerpc->dcerpcbindbindack.uuid[8] = *(p++); if (!(--input_len)) break; /* fall through */ case 13: dcerpc->dcerpcbindbindack.uuid[9] = *(p++); if (!(--input_len)) break; /* fall through */ case 14: dcerpc->dcerpcbindbindack.uuid[10] = *(p++); if (!(--input_len)) break; /* fall through */ case 15: dcerpc->dcerpcbindbindack.uuid[11] = *(p++); if (!(--input_len)) break; /* fall through */ case 16: dcerpc->dcerpcbindbindack.uuid[12] = *(p++); if (!(--input_len)) break; /* fall through */ case 17: dcerpc->dcerpcbindbindack.uuid[13] = *(p++); if (!(--input_len)) break; /* fall through */ case 18: dcerpc->dcerpcbindbindack.uuid[14] = *(p++); if (!(--input_len)) break; /* fall through */ case 19: dcerpc->dcerpcbindbindack.uuid[15] = *(p++); if (!(--input_len)) break; /* fall through */ case 20: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.version = *(p++); } else { dcerpc->dcerpcbindbindack.version = *(p++) << 8; } if (!(--input_len)) break; /* fall through */ case 21: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.version |= *(p++) << 8; } else { dcerpc->dcerpcbindbindack.version |= *(p++); } if (!(--input_len)) break; /* fall through */ case 22: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.versionminor = *(p++); } else { dcerpc->dcerpcbindbindack.versionminor = *(p++) << 8; } if (!(--input_len)) break; /* fall through */ case 23: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.versionminor |= *(p++) << 8; } else { dcerpc->dcerpcbindbindack.versionminor |= *(p++); } if (!(--input_len)) break; /* fall through */ case 24: p++; if (!(--input_len)) break; /* fall through */ case 25: p++; if (!(--input_len)) break; /* fall through */ case 26: p++; if (!(--input_len)) break; /* fall through */ case 27: p++; if (!(--input_len)) break; /* fall through */ case 28: p++; if (!(--input_len)) break; /* fall through */ case 29: p++; if (!(--input_len)) break; /* fall through */ case 30: p++; if (!(--input_len)) break; /* fall through */ case 31: p++; if (!(--input_len)) break; /* fall through */ case 32: p++; if (!(--input_len)) break; /* fall through */ case 33: p++; if (!(--input_len)) break; /* fall through */ case 34: p++; if (!(--input_len)) break; /* fall through */ case 35: p++; if (!(--input_len)) break; /* fall through */ case 36: p++; if (!(--input_len)) break; /* fall through */ case 37: p++; if (!(--input_len)) break; /* fall through */ case 38: p++; if (!(--input_len)) break; /* fall through */ case 39: p++; if (!(--input_len)) break; /* fall through */ case 40: p++; if (!(--input_len)) break; /* fall through */ case 41: p++; if (!(--input_len)) break; /* fall through */ case 42: p++; if (!(--input_len)) break; /* fall through */ case 43: p++; --input_len; //if (dcerpc->dcerpcbindbindack.ctxid == dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft) { dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, sizeof(DCERPCUuidEntry)); if (dcerpc->dcerpcbindbindack.uuid_entry == NULL) { SCLogDebug("UUID Entry is NULL\n"); SCReturnUInt(0); } dcerpc->dcerpcbindbindack.uuid_entry->internal_id = dcerpc->dcerpcbindbindack.uuid_internal_id++; memcpy(dcerpc->dcerpcbindbindack.uuid_entry->uuid, dcerpc->dcerpcbindbindack.uuid, sizeof(dcerpc->dcerpcbindbindack.uuid)); dcerpc->dcerpcbindbindack.uuid_entry->ctxid = dcerpc->dcerpcbindbindack.ctxid; dcerpc->dcerpcbindbindack.uuid_entry->version = dcerpc->dcerpcbindbindack.version; dcerpc->dcerpcbindbindack.uuid_entry->versionminor = dcerpc->dcerpcbindbindack.versionminor; /* store the first frag flag in the uuid as pfc_flags will * be overwritten by new packets. */ if (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) { dcerpc->dcerpcbindbindack.uuid_entry->flags |= DCERPC_UUID_ENTRY_FLAG_FF; } TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.uuid_list, dcerpc->dcerpcbindbindack.uuid_entry, next); #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("BINDACK", dcerpc->dcerpcbindbindack.uuid_entry); } #endif dcerpc->dcerpcbindbindack.numctxitemsleft--; dcerpc->bytesprocessed += (p - input); dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); //} else { // SCLogDebug("ctxitem %u, expected %u\n", dcerpc->dcerpcbindbindack.ctxid, // dcerpc->dcerpcbindbindack.numctxitems - dcerpc->dcerpcbindbindack.numctxitemsleft); // SCReturnUInt(0); //} break; } } dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** * \brief DCERPCParseBINDACKCTXItem is called for each CTXItem found in * the BIND_ACK call. The result (Accepted or Rejected) is added to the * correct UUID from the BIND call. */ static uint32_t DCERPCParseBINDACKCTXItem(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; DCERPCUuidEntry *uuid_entry; if (input_len) { switch (dcerpc->dcerpcbindbindack.ctxbytesprocessed) { case 0: if (input_len >= 24) { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.result = *p; dcerpc->dcerpcbindbindack.result |= *(p + 1) << 8; } else { dcerpc->dcerpcbindbindack.result = *p << 8; dcerpc->dcerpcbindbindack.result |= *(p + 1); } TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) { if (uuid_entry->internal_id == dcerpc->dcerpcbindbindack.uuid_internal_id) { uuid_entry->result = dcerpc->dcerpcbindbindack.result; #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("BIND_ACK", uuid_entry); } #endif if (uuid_entry->result != 0) break; dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, sizeof(DCERPCUuidEntry)); if (dcerpc->dcerpcbindbindack.uuid_entry != NULL) { memcpy(dcerpc->dcerpcbindbindack.uuid_entry, uuid_entry, sizeof(DCERPCUuidEntry)); TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.accepted_uuid_list, dcerpc->dcerpcbindbindack.uuid_entry, next); } break; } } dcerpc->dcerpcbindbindack.uuid_internal_id++; dcerpc->dcerpcbindbindack.numctxitemsleft--; dcerpc->bytesprocessed += (24); dcerpc->dcerpcbindbindack.ctxbytesprocessed += (24); SCReturnUInt(24U); } else { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.result = *(p++); } else { dcerpc->dcerpcbindbindack.result = *(p++) << 8; } if (!(--input_len)) break; } /* fall through */ case 1: if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.result |= *(p++) << 8; } else { dcerpc->dcerpcbindbindack.result |= *(p++); } if (!(--input_len)) break; /* fall through */ case 2: /* num transact items */ p++; if (!(--input_len)) break; /* fall through */ case 3: /* reserved */ p++; if (!(--input_len)) break; /* fall through */ case 4: p++; if (!(--input_len)) break; /* fall through */ case 5: p++; if (!(--input_len)) break; /* fall through */ case 6: p++; if (!(--input_len)) break; /* fall through */ case 7: p++; if (!(--input_len)) break; /* fall through */ case 8: p++; if (!(--input_len)) break; /* fall through */ case 9: p++; if (!(--input_len)) break; /* fall through */ case 10: p++; if (!(--input_len)) break; /* fall through */ case 11: p++; if (!(--input_len)) break; /* fall through */ case 12: p++; if (!(--input_len)) break; /* fall through */ case 13: p++; if (!(--input_len)) break; /* fall through */ case 14: p++; if (!(--input_len)) break; /* fall through */ case 15: p++; if (!(--input_len)) break; /* fall through */ case 16: p++; if (!(--input_len)) break; /* fall through */ case 17: p++; if (!(--input_len)) break; /* fall through */ case 18: p++; if (!(--input_len)) break; /* fall through */ case 19: p++; if (!(--input_len)) break; /* fall through */ case 20: p++; if (!(--input_len)) break; /* fall through */ case 21: p++; if (!(--input_len)) break; /* fall through */ case 22: p++; if (!(--input_len)) break; /* fall through */ case 23: TAILQ_FOREACH(uuid_entry, &dcerpc->dcerpcbindbindack.uuid_list, next) { if (uuid_entry->internal_id == dcerpc->dcerpcbindbindack.uuid_internal_id) { uuid_entry->result = dcerpc->dcerpcbindbindack.result; #ifdef UNITTESTS if (RunmodeIsUnittests()) { printUUID("BIND_ACK", uuid_entry); } #endif if (uuid_entry->result != 0) break; dcerpc->dcerpcbindbindack.uuid_entry = (DCERPCUuidEntry *) SCCalloc(1, sizeof(DCERPCUuidEntry)); if (dcerpc->dcerpcbindbindack.uuid_entry != NULL) { memcpy(dcerpc->dcerpcbindbindack.uuid_entry, uuid_entry, sizeof(DCERPCUuidEntry)); TAILQ_INSERT_HEAD(&dcerpc->dcerpcbindbindack.accepted_uuid_list, dcerpc->dcerpcbindbindack.uuid_entry, next); } break; } } dcerpc->dcerpcbindbindack.uuid_internal_id++; dcerpc->dcerpcbindbindack.numctxitemsleft--; p++; --input_len; break; } } dcerpc->dcerpcbindbindack.ctxbytesprocessed += (p - input); dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t DCERPCParseBIND(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; if (input_len) { switch (dcerpc->bytesprocessed) { case 16: dcerpc->dcerpcbindbindack.numctxitems = 0; if (input_len >= 12) { DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); if (dcerpc->dcerpchdr.type == BIND) { DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); } dcerpc->dcerpcbindbindack.uuid_internal_id = 0; dcerpc->dcerpcbindbindack.numctxitems = *(p + 8); dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; dcerpc->bytesprocessed += 12; SCReturnUInt(12U); } else { /* max_xmit_frag */ p++; if (!(--input_len)) break; } /* fall through */ case 17: /* max_xmit_frag */ p++; if (!(--input_len)) break; /* fall through */ case 18: /* max_recv_frag */ p++; if (!(--input_len)) break; /* fall through */ case 19: /* max_recv_frag */ p++; if (!(--input_len)) break; /* fall through */ case 20: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 21: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 22: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 23: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 24: DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); if (dcerpc->dcerpchdr.type == BIND) { DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); } dcerpc->dcerpcbindbindack.uuid_internal_id = 0; dcerpc->dcerpcbindbindack.numctxitems = *(p++); dcerpc->dcerpcbindbindack.numctxitemsleft = dcerpc->dcerpcbindbindack.numctxitems; if (!(--input_len)) break; /* fall through */ case 25: /* pad byte 1 */ p++; if (!(--input_len)) break; /* fall through */ case 26: /* pad byte 2 */ p++; if (!(--input_len)) break; /* fall through */ case 27: /* pad byte 3 */ p++; --input_len; break; /* fall through */ default: dcerpc->bytesprocessed++; SCReturnUInt(1); break; } } dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t DCERPCParseBINDACK(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; switch (dcerpc->bytesprocessed) { case 16: dcerpc->dcerpcbindbindack.uuid_internal_id = 0; dcerpc->dcerpcbindbindack.numctxitems = 0; if (input_len >= 10) { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8); dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9) << 8; } else { dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p + 8) << 8; dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p + 9); } dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen; dcerpc->bytesprocessed += 10; SCReturnUInt(10U); } else { /* max_xmit_frag */ p++; if (!(--input_len)) break; } /* fall through */ case 17: /* max_xmit_frag */ p++; if (!(--input_len)) break; /* fall through */ case 18: /* max_recv_frag */ p++; if (!(--input_len)) break; /* fall through */ case 19: /* max_recv_frag */ p++; if (!(--input_len)) break; /* fall through */ case 20: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 21: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 22: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 23: /* assoc_group_id */ p++; if (!(--input_len)) break; /* fall through */ case 24: dcerpc->dcerpcbindbindack.secondaryaddrlen = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 25: dcerpc->dcerpcbindbindack.secondaryaddrlen |= *(p++); if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcbindbindack.secondaryaddrlen = SCByteSwap16(dcerpc->dcerpcbindbindack.secondaryaddrlen); } dcerpc->dcerpcbindbindack.secondaryaddrlenleft = dcerpc->dcerpcbindbindack.secondaryaddrlen; SCLogDebug("secondaryaddrlen %u 0x%04x\n", dcerpc->dcerpcbindbindack.secondaryaddrlen, dcerpc->dcerpcbindbindack.secondaryaddrlen); --input_len; break; default: dcerpc->bytesprocessed++; SCReturnUInt(1); break; } dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; switch (dcerpc->bytesprocessed) { case 16: dcerpc->dcerpcbindbindack.numctxitems = 0; if (input_len >= 8) { if (dcerpc->dcerpchdr.type == REQUEST) { if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpcrequest.ctxid = *(p + 4); dcerpc->dcerpcrequest.ctxid |= *(p + 5) << 8; dcerpc->dcerpcrequest.opnum = *(p + 6); dcerpc->dcerpcrequest.opnum |= *(p + 7) << 8; } else { dcerpc->dcerpcrequest.ctxid = *(p + 4) << 8; dcerpc->dcerpcrequest.ctxid |= *(p + 5); dcerpc->dcerpcrequest.opnum = *(p + 6) << 8; dcerpc->dcerpcrequest.opnum |= *(p + 7); } dcerpc->dcerpcrequest.first_request_seen = 1; } dcerpc->bytesprocessed += 8; SCReturnUInt(8U); } else { /* alloc hint 1 */ p++; if (!(--input_len)) break; } /* fall through */ case 17: /* alloc hint 2 */ p++; if (!(--input_len)) break; /* fall through */ case 18: /* alloc hint 3 */ p++; if (!(--input_len)) break; /* fall through */ case 19: /* alloc hint 4 */ p++; if (!(--input_len)) break; /* fall through */ case 20: /* context id 1 */ dcerpc->dcerpcrequest.ctxid = *(p++); if (!(--input_len)) break; /* fall through */ case 21: /* context id 2 */ dcerpc->dcerpcrequest.ctxid |= *(p++) << 8; if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { dcerpc->dcerpcrequest.ctxid = SCByteSwap16(dcerpc->dcerpcrequest.ctxid); } dcerpc->dcerpcrequest.first_request_seen = 1; if (!(--input_len)) break; /* fall through */ case 22: if (dcerpc->dcerpchdr.type == REQUEST) { dcerpc->dcerpcrequest.opnum = *(p++); } else { p++; } if (!(--input_len)) break; /* fall through */ case 23: if (dcerpc->dcerpchdr.type == REQUEST) { dcerpc->dcerpcrequest.opnum |= *(p++) << 8; if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { dcerpc->dcerpcrequest.opnum = SCByteSwap16(dcerpc->dcerpcrequest.opnum); } } else { p++; } --input_len; break; default: dcerpc->bytesprocessed++; SCReturnUInt(1); break; } dcerpc->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** \internal * \retval stub_len or 0 in case of error */ static uint32_t StubDataParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t **stub_data_buffer = NULL; uint32_t *stub_data_buffer_len = NULL; uint8_t *stub_data_fresh = NULL; uint16_t stub_len = 0; void *ptmp; /* request PDU. Retrieve the request stub buffer */ if (dcerpc->dcerpchdr.type == REQUEST) { stub_data_buffer = &dcerpc->dcerpcrequest.stub_data_buffer; stub_data_buffer_len = &dcerpc->dcerpcrequest.stub_data_buffer_len; stub_data_fresh = &dcerpc->dcerpcrequest.stub_data_fresh; /* response PDU. Retrieve the response stub buffer */ } else { stub_data_buffer = &dcerpc->dcerpcresponse.stub_data_buffer; stub_data_buffer_len = &dcerpc->dcerpcresponse.stub_data_buffer_len; stub_data_fresh = &dcerpc->dcerpcresponse.stub_data_fresh; } stub_len = (dcerpc->padleft < input_len) ? dcerpc->padleft : input_len; if (stub_len == 0) { SCLogError(SC_ERR_DCERPC, "stub_len is NULL. We shouldn't be seeing " "this. In case you are, there is something gravely wrong " "with the dcerpc parser"); SCReturnInt(0); } /* To see what is in this stub fragment */ //hexdump(input, stub_len); /* if the frag is the the first frag irrespective of it being a part of * a multi frag PDU or not, it indicates the previous PDU's stub would * have been buffered and processed and we can use the buffer to hold * frags from a fresh request/response. Also if the state is in the * process of processing a fragmented pdu, we should append to the * existing stub and not reset the stub buffer */ if ((dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG) && !dcerpc->pdu_fragged) { *stub_data_buffer_len = 0; /* just a hack to get thing working. We shouldn't be setting * this var here. The ideal thing would have been to use * an extra state var, to indicate that the stub parser has made a * fresh entry after reseting the buffer, but maintaing an extra var * would be a nuisance, while we can achieve the same thing with * little or no effort, with a simple set here, although semantically * it is a wrong thing to set it here, since we still can't conclude * if a pdu is fragmented or not at this point, if we are parsing a PDU * that has some stub data in the first segment, but it still doesn't * contain the entire PDU */ dcerpc->pdu_fragged = 1; } ptmp = SCRealloc(*stub_data_buffer, *stub_data_buffer_len + stub_len); if (ptmp == NULL) { SCFree(*stub_data_buffer); *stub_data_buffer = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCReturnUInt(0); } *stub_data_buffer = ptmp; memcpy(*stub_data_buffer + *stub_data_buffer_len, input, stub_len); *stub_data_fresh = 1; /* length of the buffered stub */ *stub_data_buffer_len += stub_len; /* To see the total reassembled stubdata */ //hexdump(*stub_data_buffer, *stub_data_buffer_len); dcerpc->padleft -= stub_len; dcerpc->bytesprocessed += stub_len; #ifdef DEBUG if (SCLogDebugEnabled()) { int i = 0; for (i = 0; i < stub_len; i++) { SCLogDebug("0x%02x ", input[i]); } } #endif SCReturnUInt((uint32_t)stub_len); } /** * \brief DCERPCParseHeader parses the 16 byte DCERPC header * A fast path for normal decoding is used when there is enough bytes * present to parse the entire header. A slow path is used to parse * fragmented packets. * \retval -1 if DCERPC Header does not validate * \retval Number of bytes processed */ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint8_t *p = input; if (input_len) { SCLogDebug("dcerpc->bytesprocessed %u", dcerpc->bytesprocessed); switch (dcerpc->bytesprocessed) { case 0: if (input_len >= DCERPC_HDR_LEN) { dcerpc->dcerpchdr.rpc_vers = *p; dcerpc->dcerpchdr.rpc_vers_minor = *(p + 1); if ((dcerpc->dcerpchdr.rpc_vers != 5) || ((dcerpc->dcerpchdr.rpc_vers_minor != 0) && (dcerpc->dcerpchdr.rpc_vers_minor != 1))) { SCLogDebug("DCERPC Header did not validate"); SCReturnInt(-1); } dcerpc->dcerpchdr.type = *(p + 2); SCLogDebug("dcerpc->dcerpchdr.type %02x", dcerpc->dcerpchdr.type); dcerpc->dcerpchdr.pfc_flags = *(p + 3); dcerpc->dcerpchdr.packed_drep[0] = *(p + 4); dcerpc->dcerpchdr.packed_drep[1] = *(p + 5); dcerpc->dcerpchdr.packed_drep[2] = *(p + 6); dcerpc->dcerpchdr.packed_drep[3] = *(p + 7); if (dcerpc->dcerpchdr.packed_drep[0] & 0x10) { dcerpc->dcerpchdr.frag_length = *(p + 8); dcerpc->dcerpchdr.frag_length |= *(p + 9) << 8; dcerpc->dcerpchdr.auth_length = *(p + 10); dcerpc->dcerpchdr.auth_length |= *(p + 11) << 8; dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12) << 24; dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 16; dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 8; dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15); } else { dcerpc->dcerpchdr.frag_length = *(p + 8) << 8; dcerpc->dcerpchdr.frag_length |= *(p + 9); dcerpc->dcerpchdr.auth_length = *(p + 10) << 8; dcerpc->dcerpchdr.auth_length |= *(p + 11); dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12); dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 8; dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 16; dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15) << 24; } dcerpc->bytesprocessed = DCERPC_HDR_LEN; SCReturnInt(16); break; } else { dcerpc->dcerpchdr.rpc_vers = *(p++); if (!(--input_len)) break; } /* fall through */ case 1: dcerpc->dcerpchdr.rpc_vers_minor = *(p++); if ((dcerpc->dcerpchdr.rpc_vers != 5) || ((dcerpc->dcerpchdr.rpc_vers_minor != 0) && (dcerpc->dcerpchdr.rpc_vers_minor != 1))) { SCLogDebug("DCERPC Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* fall through */ case 2: dcerpc->dcerpchdr.type = *(p++); SCLogDebug("dcerpc->dcerpchdr.type %02x", dcerpc->dcerpchdr.type); if (!(--input_len)) break; /* fall through */ case 3: dcerpc->dcerpchdr.pfc_flags = *(p++); if (!(--input_len)) break; /* fall through */ case 4: dcerpc->dcerpchdr.packed_drep[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 5: dcerpc->dcerpchdr.packed_drep[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 6: dcerpc->dcerpchdr.packed_drep[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 7: dcerpc->dcerpchdr.packed_drep[3] = *(p++); if (!(--input_len)) break; /* fall through */ case 8: dcerpc->dcerpchdr.frag_length = *(p++); if (!(--input_len)) break; /* fall through */ case 9: dcerpc->dcerpchdr.frag_length |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 10: dcerpc->dcerpchdr.auth_length = *(p++); if (!(--input_len)) break; /* fall through */ case 11: dcerpc->dcerpchdr.auth_length |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 12: dcerpc->dcerpchdr.call_id = (uint32_t) *(p++); if (!(--input_len)) break; /* fall through */ case 13: dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 14: dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 15: dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 24; if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) { dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length); dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length); dcerpc->dcerpchdr.call_id = SCByteSwap32(dcerpc->dcerpchdr.call_id); } --input_len; break; default: dcerpc->bytesprocessed++; SCReturnInt(1); } } dcerpc->bytesprocessed += (p - input); SCReturnInt((p - input)); } static inline void DCERPCResetParsingState(DCERPC *dcerpc) { dcerpc->bytesprocessed = 0; dcerpc->pdu_fragged = 0; dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; return; } static inline void DCERPCResetStub(DCERPC *dcerpc) { if (dcerpc->dcerpchdr.type == REQUEST) dcerpc->dcerpcrequest.stub_data_buffer_len = 0; else if (dcerpc->dcerpchdr.type == RESPONSE) dcerpc->dcerpcresponse.stub_data_buffer_len = 0; return; } static inline int DCERPCThrowOutExtraData(DCERPC *dcerpc, uint8_t *input, uint16_t input_len) { int parsed = 0; /* the function always assumes that * dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length */ if (input_len > (dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed)) { parsed = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed; } else { parsed = input_len; } dcerpc->bytesprocessed += parsed; return parsed; } /** * \todo - Currently the parser is very generic. Enable target based * reassembly. * - Disable reiniting tailq for mid and last bind/alter_context pdus. * - Use a PM to search for subsequent 05 00 when we see an inconsistent * pdu. This should be done for each platform based on how it handles * a condition where it has receives a segment with 2 pdus, while the * first pdu in the segment is corrupt. */ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) { SCEnter(); uint32_t retval = 0; uint32_t parsed = 0; int hdrretval = 0; dcerpc->dcerpcrequest.stub_data_fresh = 0; dcerpc->dcerpcresponse.stub_data_fresh = 0; /* temporary use. we will get rid of this later, once we have ironed out * all the endless loops cases */ int counter = 0; while (input_len) { /* in case we have any corner cases remainging, we have this */ if (counter++ == 30) { SCLogDebug("Somehow seem to be stuck inside the dce " "parser for quite sometime. Let's get out of here."); DCERPCResetParsingState(dcerpc); SCReturnInt(0); } while (dcerpc->bytesprocessed < DCERPC_HDR_LEN && input_len) { hdrretval = DCERPCParseHeader(dcerpc, input + parsed, input_len); if (hdrretval == -1 || hdrretval > (int32_t)input_len) { SCLogDebug("Error parsing dce header. Discarding " "PDU and reseting parsing state to parse next PDU"); /* error parsing pdu header. Let's clear the dce state */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } else { parsed += hdrretval; input_len -= hdrretval; } } SCLogDebug("Done with DCERPCParseHeader bytesprocessed %u/%u left %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); #if 0 printf("Done with DCERPCParseHeader bytesprocessed %u/%u input_len left %u\n", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); printf("\nDCERPC Version:\t%u\n", dcerpc->dcerpchdr.rpc_vers); printf("DCERPC Version Minor:\t%u\n", dcerpc->dcerpchdr.rpc_vers_minor); printf("DCERPC Type:\t%u\n", dcerpc->dcerpchdr.type); printf("DCERPC Flags:\t0x%02x\n", dcerpc->dcerpchdr.pfc_flags); printf("DCERPC Packed Drep:\t%02x %02x %02x %02x\n", dcerpc->dcerpchdr.packed_drep[0], dcerpc->dcerpchdr.packed_drep[1], dcerpc->dcerpchdr.packed_drep[2], dcerpc->dcerpchdr.packed_drep[3]); printf("DCERPC Frag Length:\t0x%04x %u\n", dcerpc->dcerpchdr.frag_length, dcerpc->dcerpchdr.frag_length); printf("DCERPC Auth Length:\t0x%04x\n", dcerpc->dcerpchdr.auth_length); printf("DCERPC Call Id:\t0x%08x\n", dcerpc->dcerpchdr.call_id); #endif /* check if we have parsed the entire input passed in the header parser. * If we have, time to leave */ if (input_len == 0) { if (dcerpc->bytesprocessed < 10) { /* if the parser is known to be fragmented at this stage itself, * we reset the stub buffer here itself */ if (!dcerpc->pdu_fragged && (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) { DCERPCResetStub(dcerpc); } dcerpc->pdu_fragged = 1; } else { if (dcerpc->bytesprocessed >= dcerpc->dcerpchdr.frag_length) { SCLogDebug("Weird DCE PDU"); DCERPCResetParsingState(dcerpc); } else { /* if the parser is known to be fragmented at this stage itself, * we reset the stub buffer here itself */ if (!dcerpc->pdu_fragged && (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) { DCERPCResetStub(dcerpc); } dcerpc->pdu_fragged = 1; } } SCReturnInt(parsed); } switch (dcerpc->dcerpchdr.type) { case BIND: case ALTER_CONTEXT: while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 12 && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseBIND(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error Parsing DCERPC %s PDU", (dcerpc->dcerpchdr.type == BIND) ? "BIND" : "ALTER_CONTEXT"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } SCLogDebug("Done with DCERPCParseBIND bytesprocessed %u/%u numctxitems %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems); while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseBINDCTXItem(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 44) { dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; } parsed += retval; input_len -= retval; SCLogDebug("BIND processed %u/%u ctxitems %u/%u input_len left %u\n", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitemsleft, dcerpc->dcerpcbindbindack.numctxitems, input_len); } else if (input_len) { //parsed -= input_len; SCLogDebug("Error Parsing CTX Item %u\n", parsed); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ dcerpc->dcerpcbindbindack.numctxitemsleft = 0; DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); SCReturnInt(0); } else { /* temporary fix */ if (input_len) { retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { input_len -= retval; parsed += retval; if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else { dcerpc->pdu_fragged = 1; } } else { SCLogDebug("Error Parsing DCERPC"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } else { dcerpc->pdu_fragged = 1; } } break; case BIND_ACK: case ALTER_CONTEXT_RESP: while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 9 && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseBINDACK(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; SCLogDebug("DCERPCParseBINDACK processed %u/%u input_len left %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); } else if (input_len) { SCLogDebug("Error parsing %s\n", (dcerpc->dcerpchdr.type == BIND_ACK) ? "BIND_ACK" : "ALTER_CONTEXT_RESP"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10 + dcerpc->dcerpcbindbindack.secondaryaddrlen && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseSecondaryAddr(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; SCLogDebug("DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len, dcerpc->dcerpcbindbindack.secondaryaddrlen); } else if (input_len) { SCLogDebug("Error parsing Secondary Address"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 10 + dcerpc->dcerpcbindbindack.secondaryaddrlen) { if (dcerpc->bytesprocessed % 4) { dcerpc->pad = (4 - dcerpc->bytesprocessed % 4); dcerpc->padleft = dcerpc->pad; } } while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 10 + dcerpc->dcerpcbindbindack.secondaryaddrlen + dcerpc->pad && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = PaddingParser(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; SCLogDebug("PaddingParser %u/%u left %u pad(%u)", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len, dcerpc->pad); } else if (input_len) { SCLogDebug("Error parsing DCERPC Padding"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 10 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen && dcerpc->bytesprocessed < DCERPC_HDR_LEN + 14 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCGetCTXItems(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; SCLogDebug("DCERPCGetCTXItems %u/%u (%u)", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitems); } else if (input_len) { SCLogDebug("Error parsing CTX Items"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } if (dcerpc->bytesprocessed == DCERPC_HDR_LEN + 14 + dcerpc->pad + dcerpc->dcerpcbindbindack.secondaryaddrlen) { dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; } while (dcerpc->dcerpcbindbindack.numctxitemsleft && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseBINDACKCTXItem(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { if (dcerpc->dcerpcbindbindack.ctxbytesprocessed == 24) { dcerpc->dcerpcbindbindack.ctxbytesprocessed = 0; } parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing CTX Items"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ dcerpc->dcerpcbindbindack.numctxitemsleft = 0; DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } SCLogDebug("BINDACK processed %u/%u input_len left %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len); if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { /* response and request done */ if (dcerpc->dcerpchdr.type == BIND_ACK) { /* update transaction id */ dcerpc->transaction_id++; SCLogDebug("transaction_id updated to %"PRIu16, dcerpc->transaction_id); } DCERPCResetParsingState(dcerpc); } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); SCReturnInt(0); } else { /* temporary fix */ if (input_len) { retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { input_len -= retval; parsed += retval; if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else { dcerpc->pdu_fragged = 1; } } else { SCLogDebug("Error Parsing DCERPC"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } else { dcerpc->pdu_fragged = 1; } } break; case REQUEST: case RESPONSE: while (dcerpc->bytesprocessed < DCERPC_HDR_LEN + 8 && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && input_len) { retval = DCERPCParseREQUEST(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; dcerpc->padleft = dcerpc->dcerpchdr.frag_length - dcerpc->bytesprocessed; } else if (input_len) { SCLogDebug("Error parsing DCERPC %s", (dcerpc->dcerpchdr.type == REQUEST) ? "REQUEST" : "RESPONSE"); parsed = 0; (void)parsed; /* for scan-build */ dcerpc->padleft = 0; input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } while (dcerpc->bytesprocessed >= DCERPC_HDR_LEN + 8 && dcerpc->bytesprocessed < dcerpc->dcerpchdr.frag_length && dcerpc->padleft && input_len) { retval = StubDataParser(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing DCERPC Stub Data"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } if (dcerpc->dcerpchdr.type == REQUEST) { SCLogDebug("REQUEST processed %u frag length %u opnum %u input_len %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcrequest.opnum, input_len); } else { SCLogDebug("RESPONSE processed %u frag length %u opnum %u input_len %u", dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcrequest.opnum, input_len); } /* don't see how we could break the parser for request pdus, by * pusing bytesprocessed beyond frag_length. Let's have the * check anyways */ if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else if (dcerpc->bytesprocessed > dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); SCReturnInt(0); } else { if (!dcerpc->pdu_fragged && (dcerpc->dcerpchdr.pfc_flags & PFC_FIRST_FRAG)) { DCERPCResetStub(dcerpc); } /* temporary fix */ if (input_len) { retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { input_len -= retval; parsed += retval; if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else { dcerpc->pdu_fragged = 1; } } else { SCLogDebug("Error Parsing DCERPC"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } } else { dcerpc->pdu_fragged = 1; } } /* response and request done */ if (dcerpc->dcerpchdr.type == RESPONSE) { /* update transaction id */ dcerpc->transaction_id++; SCLogDebug("transaction_id updated to %"PRIu16, dcerpc->transaction_id); } break; default: SCLogDebug("DCERPC Type 0x%02x not implemented yet", dcerpc->dcerpchdr.type); retval = DCERPCThrowOutExtraData(dcerpc, input + parsed, input_len); if (retval && retval <= input_len) { input_len -= retval; parsed += retval; if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) { DCERPCResetParsingState(dcerpc); } else { dcerpc->pdu_fragged = 1; } } else { SCLogDebug("Error Parsing DCERPC"); parsed = 0; (void)parsed; /* for scan-build */ input_len = 0; (void)input_len; /* for scan-build */ DCERPCResetParsingState(dcerpc); SCReturnInt(0); } break; } } SCReturnInt(parsed); } static int DCERPCParse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data, int dir) { SCEnter(); int32_t retval = 0; DCERPCState *sstate = (DCERPCState *) dcerpc_state; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } if (sstate->dcerpc.bytesprocessed != 0 && sstate->data_needed_for_dir != dir) { SCReturnInt(-1); } retval = DCERPCParser(&sstate->dcerpc, input, input_len); if (retval == -1) { SCReturnInt(0); } sstate->data_needed_for_dir = dir; if (pstate == NULL) SCReturnInt(-1); SCReturnInt(1); } static int DCERPCParseRequest(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return DCERPCParse(f, dcerpc_state, pstate, input, input_len, local_data, 0); } static int DCERPCParseResponse(Flow *f, void *dcerpc_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return DCERPCParse(f, dcerpc_state, pstate, input, input_len, local_data, 1); } void DCERPCInit(DCERPC *dcerpc) { dcerpc->transaction_id = 1; TAILQ_INIT(&dcerpc->dcerpcbindbindack.uuid_list); TAILQ_INIT(&dcerpc->dcerpcbindbindack.accepted_uuid_list); } static void *DCERPCStateAlloc(void) { SCEnter(); DCERPCState *s = SCCalloc(1, sizeof(DCERPCState)); if (unlikely(s == NULL)) { SCReturnPtr(NULL, "void"); } DCERPCInit(&s->dcerpc); SCReturnPtr((void *)s, "void"); } void DCERPCUuidListFree(DCERPCUuidEntryList *list) { DCERPCUuidEntry *entry; while ((entry = TAILQ_FIRST(list))) { TAILQ_REMOVE(list, entry, next); SCFree(entry); } } void DCERPCCleanup(DCERPC *dcerpc) { DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.uuid_list); DCERPCUuidListFree(&dcerpc->dcerpcbindbindack.accepted_uuid_list); if (dcerpc->dcerpcrequest.stub_data_buffer != NULL) { SCFree(dcerpc->dcerpcrequest.stub_data_buffer); dcerpc->dcerpcrequest.stub_data_buffer = NULL; dcerpc->dcerpcrequest.stub_data_buffer_len = 0; } if (dcerpc->dcerpcresponse.stub_data_buffer != NULL) { SCFree(dcerpc->dcerpcresponse.stub_data_buffer); dcerpc->dcerpcresponse.stub_data_buffer = NULL; dcerpc->dcerpcresponse.stub_data_buffer_len = 0; } } static void DCERPCStateFree(void *s) { DCERPCState *sstate = (DCERPCState *) s; DCERPCCleanup(&sstate->dcerpc); SCFree(s); } static int DCERPCRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0, STREAM_TOCLIENT) < 0) { return -1; } return 0; } void RegisterDCERPCParsers(void) { char *proto_name = "dcerpc"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_DCERPC, proto_name); if (DCERPCRegisterPatternsForProtocolDetection() < 0) return; } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOSERVER, DCERPCParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOCLIENT, DCERPCParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCStateAlloc, DCERPCStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOSERVER); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCParserRegisterTests); #endif return; } /* UNITTESTS */ #ifdef UNITTESTS /** \test DCERPC Header Parsing and BIND / BIND_ACK multiple UUID handling */ /* set this to 1 to see problem */ int DCERPCParserTest01(void) { int result = 1; Flow f; uint8_t dcerpcbind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3c, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x2c, 0xd0, 0x28, 0xda, 0x76, 0x91, 0xf6, 0x6e, 0xcb, 0x0f, 0xbf, 0x85, 0xcd, 0x9b, 0xf6, 0x39, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x2c, 0x75, 0xce, 0x7e, 0x82, 0x3b, 0x06, 0xac, 0x1b, 0xf0, 0xf5, 0xb7, 0xa7, 0xf7, 0x28, 0xaf, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xe3, 0xb2, 0x10, 0xd1, 0xd0, 0x0c, 0xcc, 0x3d, 0x2f, 0x80, 0x20, 0x7c, 0xef, 0xe7, 0x09, 0xe0, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xde, 0x85, 0x70, 0xc4, 0x02, 0x7c, 0x60, 0x23, 0x67, 0x0c, 0x22, 0xbf, 0x18, 0x36, 0x79, 0x17, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x41, 0x65, 0x29, 0x51, 0xaa, 0xe7, 0x7b, 0xa8, 0xf2, 0x37, 0x0b, 0xd0, 0x3f, 0xb3, 0x36, 0xed, 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x14, 0x96, 0x80, 0x01, 0x2e, 0x78, 0xfb, 0x5d, 0xb4, 0x3c, 0x14, 0xb3, 0x3d, 0xaa, 0x02, 0xfb, 0x06, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x3b, 0x04, 0x68, 0x3e, 0x63, 0xfe, 0x9f, 0xd8, 0x64, 0x55, 0xcd, 0xe7, 0x39, 0xaf, 0x98, 0x9f, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0x16, 0x7a, 0x4f, 0x1b, 0xdb, 0x25, 0x92, 0x55, 0xdd, 0xae, 0x9e, 0x5b, 0x3e, 0x93, 0x66, 0x93, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xe8, 0xa4, 0x8a, 0xcf, 0x95, 0x6c, 0xc7, 0x8f, 0x14, 0xcc, 0x56, 0xfc, 0x7b, 0x5f, 0x4f, 0xe8, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0xd8, 0xda, 0xfb, 0xbc, 0xa2, 0x55, 0x6f, 0x5d, 0xc0, 0x2d, 0x88, 0x6f, 0x00, 0x17, 0x52, 0x8d, 0x06, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x3f, 0x17, 0x55, 0x0c, 0xf4, 0x23, 0x3c, 0xca, 0xe6, 0xa0, 0xaa, 0xcc, 0xb5, 0xe3, 0xf9, 0xce, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc9, 0x9f, 0x3e, 0x6e, 0x82, 0x0a, 0x2b, 0x28, 0x37, 0x78, 0xe1, 0x13, 0x70, 0x05, 0x38, 0x4d, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00, 0x11, 0xaa, 0x4b, 0x15, 0xdf, 0xa6, 0x86, 0x3f, 0xfb, 0xe0, 0x09, 0xb7, 0xf8, 0x56, 0xd2, 0x3f, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0xee, 0x99, 0xc4, 0x25, 0x11, 0xe4, 0x95, 0x62, 0x29, 0xfa, 0xfd, 0x26, 0x57, 0x02, 0xf1, 0xce, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, 0xba, 0x81, 0x9e, 0x1a, 0xdf, 0x2b, 0xba, 0xe4, 0xd3, 0x17, 0x41, 0x60, 0x6d, 0x2d, 0x9e, 0x28, 0x03, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0xa0, 0x24, 0x03, 0x9a, 0xa9, 0x99, 0xfb, 0xbe, 0x49, 0x11, 0xad, 0x77, 0x30, 0xaa, 0xbc, 0xb6, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00, 0x32, 0x04, 0x7e, 0xae, 0xec, 0x28, 0xd1, 0x55, 0x83, 0x4e, 0xc3, 0x47, 0x5d, 0x1d, 0xc6, 0x65, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x12, 0x00, 0x01, 0x00, 0xc6, 0xa4, 0x81, 0x48, 0x66, 0x2a, 0x74, 0x7d, 0x56, 0x6e, 0xc5, 0x1d, 0x19, 0xf2, 0xb5, 0xb6, 0x03, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x13, 0x00, 0x01, 0x00, 0xcb, 0xae, 0xb3, 0xc0, 0x0c, 0xf4, 0xa4, 0x5e, 0x91, 0x72, 0xdd, 0x53, 0x24, 0x70, 0x89, 0x02, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0xb8, 0xd0, 0xa0, 0x1a, 0x5e, 0x7a, 0x2d, 0xfe, 0x35, 0xc6, 0x7d, 0x08, 0x0d, 0x33, 0x73, 0x18, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x15, 0x00, 0x01, 0x00, 0x21, 0xd3, 0xaa, 0x09, 0x03, 0xa7, 0x0b, 0xc2, 0x06, 0x45, 0xd9, 0x6c, 0x75, 0xc2, 0x15, 0xa8, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x16, 0x00, 0x01, 0x00, 0xe1, 0xbd, 0x59, 0xfc, 0xbc, 0xa9, 0x95, 0xc2, 0x68, 0x79, 0xf3, 0x75, 0xe0, 0xae, 0x6c, 0xe5, 0x04, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x17, 0x00, 0x01, 0x00, 0x06, 0x52, 0xb4, 0x71, 0x70, 0x15, 0x4e, 0xf5, 0x7f, 0x08, 0x86, 0x14, 0xe6, 0x17, 0xd5, 0x97, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00}; uint8_t dcerpcbindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x6c, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0xce, 0x47, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0xf6, 0x6e, 0x18, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint8_t dcerpcrequest[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d, 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, 0x00, 0x69, 0x00}; uint32_t requestlen = sizeof(dcerpcrequest); uint32_t bindlen = sizeof(dcerpcbind); uint32_t bindacklen = sizeof(dcerpcbindack); TcpSession ssn; DCERPCUuidEntry *uuid_entry; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpcbind, bindlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) { printf("expected dcerpc version 0x05, got 0x%02x : ", dcerpc_state->dcerpc.dcerpchdr.rpc_vers); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.type != BIND) { printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND, dcerpc_state->dcerpc.dcerpchdr.type); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1084) { printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1084, dcerpc_state->dcerpc.dcerpchdr.frag_length); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpcbindack, bindacklen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (dcerpc_state->dcerpc.dcerpchdr.type != BIND_ACK) { printf("expected dcerpc type 0x%02x , got 0x%02x : ", BIND_ACK, dcerpc_state->dcerpc.dcerpchdr.type); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 620) { printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 620, dcerpc_state->dcerpc.dcerpchdr.frag_length); result = 0; goto end; } TAILQ_FOREACH(uuid_entry, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { printUUID("BIND_ACK", uuid_entry); } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_EOF, dcerpcrequest, requestlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) { printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test DCERPC Request decoding and opnum parsing. */ int DCERPCParserTest02(void) { int result = 1; Flow f; uint8_t dcerpcrequest[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d, 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, 0x00, 0x69, 0x00}; uint32_t requestlen = sizeof(dcerpcrequest); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpcrequest, requestlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.rpc_vers != 5) { printf("expected dcerpc version 0x05, got 0x%02x : ", dcerpc_state->dcerpc.dcerpchdr.rpc_vers); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.type != REQUEST) { printf("expected dcerpc type 0x%02x , got 0x%02x : ", REQUEST, dcerpc_state->dcerpc.dcerpchdr.type); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) { printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) { printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** \test Test endianness handling */ int DCERPCParserTest03(void) { int result = 1; Flow f; uint8_t dcerpcrequest[] = { 0x05, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x45, 0x00, 0x2c, 0x00, 0x4d, 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, 0x00, 0x4b, 0x00, 0x4b, 0x00, 0x3c, 0x00, 0x48, 0x00, 0x24, 0x00, 0x38, 0x00, 0x54, 0x00, 0x60, 0x00, 0x2d, 0x00, 0x29, 0x00, 0x64, 0x00, 0x5b, 0x00, 0x77, 0x00, 0x3a, 0x00, 0x4c, 0x00, 0x24, 0x00, 0x23, 0x00, 0x66, 0x00, 0x43, 0x00, 0x68, 0x00, 0x22, 0x00, 0x55, 0x00, 0x29, 0x00, 0x2c, 0x00, 0x4f, 0x00, 0x5a, 0x00, 0x50, 0x00, 0x61, 0x00, 0x2a, 0x00, 0x6f, 0x00, 0x2f, 0x00, 0x4d, 0x00, 0x68, 0x00, 0x3a, 0x00, 0x5c, 0x00, 0x67, 0x00, 0x68, 0x00, 0x68, 0x00, 0x49, 0x00, 0x45, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x53, 0x00, 0x4c, 0x00, 0x25, 0x00, 0x4d, 0x00, 0x67, 0x00, 0x2e, 0x00, 0x4f, 0x00, 0x64, 0x00, 0x61, 0x00, 0x73, 0x00, 0x24, 0x00, 0x46, 0x00, 0x35, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x6f, 0x00, 0x40, 0x00, 0x41, 0x00, 0x33, 0x00, 0x38, 0x00, 0x47, 0x00, 0x71, 0x00, 0x5a, 0x00, 0x37, 0x00, 0x7a, 0x00, 0x35, 0x00, 0x6b, 0x00, 0x3c, 0x00, 0x26, 0x00, 0x37, 0x00, 0x69, 0x00, 0x75, 0x00, 0x36, 0x00, 0x37, 0x00, 0x47, 0x00, 0x21, 0x00, 0x2d, 0x00, 0x69, 0x00, 0x37, 0x00, 0x78, 0x00, 0x5f, 0x00, 0x72, 0x00, 0x4b, 0x00, 0x5c, 0x00, 0x74, 0x00, 0x3e, 0x00, 0x52, 0x00, 0x7a, 0x00, 0x49, 0x00, 0x31, 0x00, 0x5a, 0x00, 0x7b, 0x00, 0x29, 0x00, 0x3b, 0x00, 0x78, 0x00, 0x3b, 0x00, 0x55, 0x00, 0x3e, 0x00, 0x35, 0x00, 0x2b, 0x00, 0x4e, 0x00, 0x4f, 0x00, 0x59, 0x00, 0x38, 0x00, 0x2a, 0x00, 0x59, 0x00, 0x6b, 0x00, 0x42, 0x00, 0x4c, 0x00, 0x3e, 0x00, 0x6a, 0x00, 0x49, 0x00, 0x2c, 0x00, 0x79, 0x00, 0x6e, 0x00, 0x35, 0x00, 0x4f, 0x00, 0x49, 0x00, 0x55, 0x00, 0x35, 0x00, 0x61, 0x00, 0x72, 0x00, 0x77, 0x00, 0x38, 0x00, 0x32, 0x00, 0x24, 0x00, 0x46, 0x00, 0x32, 0x00, 0x32, 0x00, 0x27, 0x00, 0x64, 0x00, 0x5a, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x37, 0x00, 0x77, 0x00, 0x2e, 0x00, 0x28, 0x00, 0x63, 0x00, 0x4f, 0x00, 0x67, 0x00, 0x64, 0x00, 0x39, 0x00, 0x37, 0x00, 0x31, 0x00, 0x30, 0x00, 0x28, 0x00, 0x2e, 0x00, 0x6f, 0x00, 0x3e, 0x00, 0x59, 0x00, 0x28, 0x00, 0x67, 0x00, 0x52, 0x00, 0x35, 0x00, 0x5a, 0x00, 0x7c, 0x00, 0x56, 0x00, 0x6a, 0x00, 0x5c, 0x00, 0x3c, 0x00, 0x30, 0x00, 0x59, 0x00, 0x5c, 0x00, 0x5e, 0x00, 0x38, 0x00, 0x54, 0x00, 0x5c, 0x00, 0x5b, 0x00, 0x42, 0x00, 0x62, 0x00, 0x70, 0x00, 0x34, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x7a, 0x00, 0x4b, 0x00, 0x2f, 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x33, 0x00, 0x52, 0x00, 0x36, 0x00, 0x27, 0x00, 0x30, 0x00, 0x6d, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x78, 0x00, 0x46, 0x00, 0x65, 0x00, 0x4e, 0x00, 0x29, 0x00, 0x66, 0x00, 0x3f, 0x00, 0x72, 0x00, 0x71, 0x00, 0x75, 0x00, 0x4c, 0x00, 0x2b, 0x00, 0x5c, 0x00, 0x46, 0x00, 0x52, 0x00, 0x7b, 0x00, 0x5c, 0x00, 0x69, 0x00, 0x66, 0x00, 0x56, 0x00, 0x31, 0x00, 0x2d, 0x00, 0x72, 0x00, 0x61, 0x00, 0x68, 0x00, 0x28, 0x00, 0x7d, 0x00, 0x58, 0x00, 0x2a, 0x00, 0x7b, 0x00, 0x28, 0x00, 0x5b, 0x00, 0x54, 0x00, 0x3a, 0x00, 0x26, 0x00, 0x52, 0x00, 0x44, 0x00, 0x60, 0x00, 0x50, 0x00, 0x65, 0x00, 0x48, 0x00, 0x7d, 0x00, 0x2a, 0x00, 0x74, 0x00, 0x49, 0x00, 0x7b, 0x00, 0x21, 0x00, 0x61, 0x00, 0x52, 0x00, 0x43, 0x00, 0x5f, 0x00, 0x5a, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x62, 0x00, 0x68, 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x2b, 0x00, 0x6f, 0x00, 0x7c, 0x00, 0x42, 0x00, 0x67, 0x00, 0x32, 0x00, 0x58, 0x00, 0x35, 0x00, 0x30, 0x00, 0x2f, 0x00, 0x2d, 0x00, 0x60, 0x00, 0x62, 0x00, 0x51, 0x00, 0x2a, 0x00, 0x30, 0x00, 0x31, 0x00, 0x48, 0x00, 0x5b, 0x00, 0x5b, 0x00, 0x5d, 0x00, 0x25, 0x00, 0x58, 0x00, 0x4a, 0x00, 0x76, 0x00, 0x32, 0x00, 0x62, 0x00, 0x27, 0x00, 0x42, 0x00, 0x40, 0x00, 0x53, 0x00, 0x7c, 0x00, 0x7d, 0x00, 0x50, 0x00, 0x3d, 0x00, 0x40, 0x00, 0x76, 0x00, 0x38, 0x00, 0x58, 0x00, 0x39, 0x00, 0x63, 0x00, 0x3c, 0x00, 0x5b, 0x00, 0x23, 0x00, 0x53, 0x00, 0x7a, 0x00, 0x54, 0x00, 0x74, 0x00, 0x61, 0x00, 0x76, 0x00, 0x4a, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x75, 0x00, 0x66, 0x00, 0x2d, 0x00, 0x48, 0x00, 0x33, 0x00, 0x71, 0x00, 0x76, 0x00, 0x48, 0x00, 0x71, 0x00, 0x41, 0x00, 0x6f, 0x00, 0x2a, 0x00, 0x67, 0x00, 0x70, 0x00, 0x21, 0x00, 0x70, 0x00, 0x4b, 0x00, 0x52, 0x00, 0x58, 0x00, 0x68, 0x00, 0x23, 0x00, 0x39, 0x00, 0x46, 0x00, 0x4d, 0x00, 0x51, 0x00, 0x57, 0x00, 0x3a, 0x00, 0x79, 0x00, 0x7b, 0x00, 0x6c, 0x00, 0x55, 0x00, 0x33, 0x00, 0x65, 0x00, 0x49, 0x00, 0x72, 0x00, 0x30, 0x00, 0x4f, 0x00, 0x41, 0x00, 0x6e, 0x00, 0x31, 0x00, 0x4a, 0x00, 0x60, 0x00, 0x79, 0x00, 0x70, 0x00, 0x4f, 0x00, 0x58, 0x00, 0x75, 0x00, 0x44, 0x00, 0x59, 0x00, 0x58, 0x00, 0x46, 0x00, 0x3d, 0x00, 0x46, 0x00, 0x74, 0x00, 0x51, 0x00, 0x57, 0x00, 0x6e, 0x00, 0x2d, 0x00, 0x47, 0x00, 0x23, 0x00, 0x45, 0x00, 0x60, 0x00, 0x4c, 0x00, 0x72, 0x00, 0x4e, 0x00, 0x74, 0x00, 0x40, 0x00, 0x76, 0x00, 0x75, 0x00, 0x74, 0x00, 0x56, 0x00, 0x44, 0x00, 0x29, 0x00, 0x62, 0x00, 0x58, 0x00, 0x31, 0x00, 0x78, 0x00, 0x32, 0x00, 0x52, 0x00, 0x4a, 0x00, 0x6b, 0x00, 0x55, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x6f, 0x00, 0x4a, 0x00, 0x54, 0x00, 0x7d, 0x00, 0x68, 0x00, 0x3f, 0x00, 0x28, 0x00, 0x21, 0x00, 0x53, 0x00, 0x48, 0x00, 0x5a, 0x00, 0x34, 0x00, 0x36, 0x00, 0x35, 0x00, 0x64, 0x00, 0x4e, 0x00, 0x75, 0x00, 0x69, 0x00, 0x23, 0x00, 0x75, 0x00, 0x55, 0x00, 0x43, 0x00, 0x75, 0x00, 0x2f, 0x00, 0x73, 0x00, 0x62, 0x00, 0x6f, 0x00, 0x37, 0x00, 0x4e, 0x00, 0x25, 0x00, 0x25, 0x00, 0x21, 0x00, 0x3d, 0x00, 0x3c, 0x00, 0x71, 0x00, 0x3e, 0x00, 0x3f, 0x00, 0x30, 0x00, 0x36, 0x00, 0x62, 0x00, 0x63, 0x00, 0x53, 0x00, 0x54, 0x00, 0x5d, 0x00, 0x61, 0x00, 0x4c, 0x00, 0x28, 0x00, 0x2b, 0x00, 0x4c, 0x00, 0x4e, 0x00, 0x66, 0x00, 0x5f, 0x00, 0x4b, 0x00, 0x43, 0x00, 0x75, 0x00, 0x45, 0x00, 0x37, 0x00, 0x28, 0x00, 0x56, 0x00, 0x36, 0x00, 0x6a, 0x00, 0x3e, 0x00, 0x64, 0x00, 0x34, 0x00, 0x6a, 0x00, 0x7d, 0x00, 0x4a, 0x00, 0x66, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x75, 0x00, 0x38, 0x00, 0x7b, 0x00, 0x42, 0x00, 0x76, 0x00, 0x29, 0x00, 0x4c, 0x00, 0x65, 0x00, 0x2e, 0x00, 0x32, 0x00, 0x4b, 0x00, 0x2b, 0x00, 0x51, 0x00, 0x47, 0x00, 0x22, 0x00, 0x48, 0x00, 0x3d, 0x00, 0x49, 0x00, 0x44, 0x00, 0x5d, 0x00, 0x59, 0x00, 0x63, 0x00, 0x5c, 0x00, 0x24, 0x00, 0x35, 0x00, 0x34, 0x00, 0x70, 0x00, 0x69, 0x00}; uint32_t requestlen = sizeof(dcerpcrequest); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpcrequest, requestlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] != 0x01) { printf("expected dcerpc data representation 0x01, got 0x%02x : ", dcerpc_state->dcerpc.dcerpchdr.packed_drep[0]); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpchdr.frag_length != 1024) { printf("expected dcerpc frag_length 0x%02x , got 0x%02x : ", 1024, dcerpc_state->dcerpc.dcerpchdr.frag_length); result = 0; goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 9) { printf("expected dcerpc opnum 0x%02x , got 0x%02x : ", 9, dcerpc_state->dcerpc.dcerpcrequest.opnum); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \todo Needs to be rewritten */ int DCERPCParserTest04(void) { /* AWS - Disabled this test since clamav FPs on the payloads used. * We will have to rewrite this test with new payloads. Will be done * as a part of dcerpc update/fixes */ #if 0 int result = 1; Flow f; uint8_t bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_len = sizeof(bind); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t request1[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x91, 0xfc, 0x27, 0x40, 0x4a, 0x97, 0x4a, 0x98, 0x4b, 0x41, 0x3f, 0x48, 0x99, 0x90, 0xf8, 0x27, 0xfd, 0x3f, 0x27, 0x37, 0x40, 0xd6, 0x27, 0xfc, 0x3f, 0x9f, 0x4f, 0xfd, 0x42, 0x47, 0x47, 0x49, 0x3f, 0xf9, 0x9b, 0xd6, 0x48, 0x37, 0x27, 0x46, 0x93, 0x49, 0xfd, 0x93, 0x91, 0xfd, 0x93, 0x90, 0x92, 0x96, 0xf5, 0x92, 0x4e, 0x91, 0x98, 0x46, 0x4f, 0x4b, 0x46, 0xf5, 0xf5, 0xfd, 0x40, 0xf9, 0x9b, 0x40, 0x9f, 0x93, 0x4e, 0xf8, 0x40, 0x40, 0x4e, 0xf5, 0x4b, 0x98, 0xf5, 0x91, 0xd6, 0x42, 0x99, 0x96, 0x27, 0x49, 0x48, 0x47, 0x4f, 0x46, 0x99, 0x4b, 0x92, 0x92, 0x90, 0x47, 0x46, 0x4e, 0x43, 0x9b, 0x43, 0x42, 0x3f, 0x4b, 0x27, 0x97, 0x93, 0xf9, 0x42, 0x9b, 0x46, 0x9b, 0x4b, 0x98, 0x41, 0x98, 0x37, 0x41, 0x9f, 0x98, 0x4e, 0x93, 0x48, 0x46, 0x46, 0x9f, 0x97, 0x9b, 0x42, 0x37, 0x90, 0x46, 0xf9, 0x97, 0x91, 0xf5, 0x4e, 0x97, 0x4e, 0x99, 0xf8, 0x99, 0x41, 0xf5, 0x41, 0x9f, 0x49, 0xfd, 0x92, 0x96, 0x3f, 0x3f, 0x42, 0x27, 0x27, 0x93, 0x47, 0x49, 0x91, 0x27, 0x27, 0x40, 0x42, 0x99, 0x9f, 0xfc, 0x97, 0x47, 0x99, 0x4a, 0xf9, 0x3f, 0x48, 0x91, 0x47, 0x97, 0x91, 0x42, 0x4b, 0x9b, 0x4a, 0x48, 0x9f, 0x43, 0x43, 0x40, 0x99, 0xf9, 0x48, 0x4e, 0x92, 0x93, 0x92, 0x41, 0x46, 0x4b, 0x4a, 0x4a, 0x49, 0x96, 0x4a, 0x4f, 0xf5, 0x42, 0x47, 0x98, 0x9b, 0xf5, 0x91, 0xf9, 0xd6, 0x9b, 0x48, 0x4e, 0x9f, 0x91, 0xd6, 0x93, 0x4b, 0x37, 0x3f, 0x43, 0xf5, 0x41, 0x41, 0xf5, 0x37, 0x4f, 0x43, 0x92, 0x97, 0x27, 0x93, 0x92, 0x46, 0x47, 0x4b, 0x96, 0x41, 0x90, 0x90, 0x3f, 0x96, 0x27, 0x41, 0xd6, 0xd6, 0xd6, 0xf9, 0xf8, 0x47, 0x27, 0x46, 0x37, 0x41, 0x90, 0x91, 0xfc, 0x46, 0x41, 0x43, 0x97, 0x9f, 0x4a, 0x49, 0x92, 0x41, 0x91, 0x41, 0x92, 0x42, 0x4a, 0x3f, 0x93, 0x99, 0x9b, 0x9f, 0x4e, 0x47, 0x93, 0xd6, 0x37, 0x37, 0x40, 0x98, 0xfd, 0x41, 0x42, 0x97, 0x4e, 0x4e, 0x98, 0x9f, 0x4e, 0x48, 0x3f, 0x48, 0x42, 0x96, 0x9f, 0x99, 0x4f, 0x4e, 0x42, 0x97, 0xf9, 0x3f, 0x37, 0x27, 0x46, 0x41, 0xf9, 0x92, 0x96, 0x41, 0x93, 0x91, 0x4b, 0x96, 0x4f, 0x43, 0xfd, 0xf5, 0x9f, 0x43, 0x27, 0x99, 0xd6, 0xf5, 0x4e, 0xfd, 0x97, 0x4b, 0x47, 0x47, 0x92, 0x98, 0x4f, 0x47, 0x49, 0x37, 0x97, 0x3f, 0x4e, 0x40, 0x46, 0x4e, 0x9f, 0x4e, 0x4e, 0xfc, 0x41, 0x47, 0xf8, 0x37, 0x9b, 0x41, 0x4e, 0x96, 0x99, 0x46, 0x99, 0x46, 0xf9, 0x4e, 0x4f, 0x48, 0x97, 0x97, 0x93, 0xd6, 0x9b, 0x41, 0x40, 0x97, 0x97, 0x4f, 0x92, 0x91, 0xd6, 0x96, 0x40, 0x4f, 0x4b, 0x91, 0x46, 0x27, 0x92, 0x3f, 0xf5, 0xfc, 0x3f, 0x91, 0x97, 0xf8, 0x43, 0x4e, 0xfd, 0x9b, 0x27, 0xfd, 0x9b, 0xf5, 0x27, 0x47, 0x42, 0x46, 0x93, 0x37, 0x93, 0x91, 0x91, 0x91, 0xf8, 0x4f, 0x92, 0x4f, 0xf8, 0x93, 0xf5, 0x49, 0x91, 0x4b, 0x3f, 0xfc, 0x37, 0x4f, 0x46, 0x98, 0x97, 0x9f, 0x40, 0xfd, 0x9f, 0x98, 0xfd, 0x4e, 0x97, 0x4f, 0x47, 0x91, 0x27, 0x4a, 0x90, 0x96, 0x40, 0x98, 0x97, 0x41, 0x3f, 0xd6, 0xfd, 0x41, 0xfd, 0x42, 0x97, 0x4b, 0x9b, 0x46, 0x4e, 0xfc, 0x96, 0xf9, 0x37, 0x4b, 0x96, 0x9f, 0x9b, 0x42, 0x9f, 0x93, 0x40, 0x42, 0x43, 0xf5, 0x93, 0x48, 0x3f, 0x4b, 0xfd, 0x9f, 0x4b, 0x41, 0x4a, 0x90, 0x9b, 0x46, 0x97, 0x98, 0x96, 0x9b, 0x98, 0x92, 0xd6, 0x4e, 0x4a, 0x27, 0x90, 0x96, 0x99, 0x91, 0x46, 0x49, 0x41, 0x4b, 0x90, 0x43, 0x91, 0xd6, 0x48, 0x42, 0x90, 0x4f, 0x96, 0x43, 0x9b, 0xf9, 0x9b, 0x9f, 0x9f, 0x27, 0x47, 0x4b, 0xf5, 0x43, 0x99, 0x99, 0x91, 0x4e, 0x41, 0x42, 0x46, 0x97, 0x46, 0x47, 0xf9, 0xf5, 0x48, 0x4a, 0xf8, 0x4e, 0xd6, 0x43, 0x4a, 0x27, 0x9b, 0x42, 0x90, 0x46, 0x46, 0x3f, 0x99, 0x96, 0x9b, 0x91, 0x9f, 0xf5, 0x48, 0x43, 0x9f, 0x4a, 0x99, 0x96, 0xfd, 0x92, 0x49, 0x46, 0x91, 0x40, 0xfd, 0x4a, 0x48, 0x4f, 0x90, 0x91, 0x98, 0x48, 0x4b, 0x9f, 0x42, 0x27, 0x93, 0x47, 0xf8, 0x4f, 0x48, 0x3f, 0x90, 0x47, 0x41, 0xf5, 0xfc, 0x27, 0xf8, 0x97, 0x4a, 0x49, 0x37, 0x40, 0x4f, 0x40, 0x37, 0x41, 0x27, 0x96, 0x37, 0xfc, 0x42, 0xd6, 0x4b, 0x48, 0x37, 0x42, 0xf5, 0x27, 0xf9, 0xd6, 0x48, 0x9b, 0xfd, 0x40, 0x96, 0x4e, 0x43, 0xf8, 0x90, 0x40, 0x40, 0x49, 0x3f, 0xfc, 0x4a, 0x42, 0x47, 0xf8, 0x49, 0x42, 0x97, 0x4f, 0x91, 0xfd, 0x4b, 0x46, 0x4b, 0xfc, 0x48, 0x49, 0x96, 0x4b, 0x96, 0x43, 0x9f, 0x90, 0x37, 0xd6, 0x4a, 0xd6, 0x3f, 0xd6, 0x90, 0x49, 0x27, 0x4e, 0x96, 0x96, 0xf8, 0x49, 0x96, 0xf8, 0x37, 0x90, 0x4e, 0x4b, 0x4f, 0x99, 0xf8, 0x6a, 0x52, 0x59, 0xd9, 0xee, 0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13, 0x30, 0x50, 0xf0, 0x82, 0x83, 0xeb, 0xfc, 0xe2, 0xf4, 0xb1, 0x94, 0x0f, 0x6d, 0xcf, 0xaf, 0xb4, 0x7e, 0x5a, 0xbb, 0xbf, 0x6a, 0xc9, 0xaf, 0x0f, 0x7d, 0x50, 0xdb, 0x9c, 0xa6, 0x14, 0xdb, 0xb5, 0xbe, 0xbb, 0x2c, 0xf5, 0xfa, 0x31, 0xbf, 0x7b, 0xcd, 0x28, 0xdb, 0xaf, 0xa2, 0x31, 0xbb, 0x13, 0xb2, 0x79, 0xdb, 0xc4, 0x09, 0x31, 0xbe, 0xc1, 0x42, 0xa9, 0xfc, 0x74, 0x42, 0x44, 0x57, 0x31, 0x48, 0x3d, 0x51, 0x32, 0x69, 0xc4, 0x6b, 0xa4, 0xa6, 0x18, 0x25, 0x13, 0x09, 0x6f, 0x74, 0xf1, 0x69, 0x56, 0xdb, 0xfc, 0xc9, 0xbb, 0x0f, 0xec, 0x83, 0xdb, 0x53, 0xdc, 0x09, 0xb9, 0x3c, 0xd4, 0x9e, 0x51, 0x93, 0xc1, 0x42, 0x54, 0xdb, 0xb0, 0xb2, 0xbb, 0x10, 0xfc, 0x09, 0x40, 0x4c, 0x5d, 0x09, 0x70, 0x58, 0xae, 0xea, 0xbe, 0x1e, 0xfe, 0x6e, 0x60, 0xaf, 0x26, 0xb3, 0xeb, 0x36, 0xa3, 0xe4, 0x58, 0x63, 0xc2, 0xea, 0x47, 0x23, 0xc2, 0xdd, 0x64, 0xaf, 0x20, 0xea, 0xfb, 0xbd, 0x0c, 0xb9, 0x60, 0xaf, 0x26, 0xdd, 0xb9, 0xb5, 0x96, 0x03, 0xdd, 0x58, 0xf2, 0xd7, 0x5a, 0x52, 0x0f, 0x52, 0x58, 0x89, 0xf9, 0x77, 0x9d, 0x07, 0x0f, 0x54, 0x63, 0x03, 0xa3, 0xd1, 0x63, 0x13, 0xa3, 0xc1, 0x63, 0xaf, 0x20, 0xe4, 0x58, 0x41, 0xac, 0xe4, 0x63, 0xd9, 0x11, 0x17, 0x58, 0xf4, 0xea, 0xf2, 0xf7, 0x07, 0x0f, 0x54, 0x5a, 0x40, 0xa1, 0xd7, 0xcf, 0x80, 0x98, 0x26, 0x9d, 0x7e, 0x19, 0xd5, 0xcf, 0x86, 0xa3, 0xd7, 0xcf, 0x80, 0x98, 0x67, 0x79, 0xd6, 0xb9, 0xd5, 0xcf, 0x86, 0xa0, 0xd6, 0x64, 0x05, 0x0f, 0x52, 0xa3, 0x38, 0x17, 0xfb, 0xf6, 0x29, 0xa7, 0x7d, 0xe6, 0x05, 0x0f, 0x52, 0x56, 0x3a, 0x94, 0xe4, 0x58, 0x33, 0x9d, 0x0b, 0xd5, 0x3a, 0xa0, 0xdb, 0x19, 0x9c, 0x79, 0x65, 0x5a, 0x14, 0x79, 0x60, 0x01, 0x90, 0x03, 0x28, 0xce, 0x12, 0xdd, 0x7c, 0x72, 0x7c, 0x63, 0x0f, 0x4a, 0x68, 0x5b, 0x29, 0x9b, 0x38, 0x82, 0x7c, 0x83, 0x46, 0x0f, 0xf7, 0x74, 0xaf, 0x26, 0xd9, 0x67, 0x02, 0xa1, 0xd3, 0x61, 0x3a, 0xf1, 0xd3, 0x61, 0x05, 0xa1, 0x7d, 0xe0, 0x38, 0x5d, 0x5b, 0x35, 0x9e, 0xa3, 0x7d, 0xe6, 0x3a, 0x0f, 0x7d, 0x07, 0xaf, 0x20, 0x09, 0x67, 0xac, 0x73, 0x46, 0x54, 0xaf, 0x26, 0xd0 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xcf, 0x80, 0x98, 0x6d, 0xfe, 0xb0, 0x90, 0xd1, 0xcf, 0x86, 0x0f, 0x52, 0x2c, 0x23, 0x66, 0x28, 0x27, 0x30, 0x48, 0x55, 0x42, 0x6a, 0x48, 0x4b, 0x68, 0x22, 0x2e, 0x23, 0x64, 0x33, 0x2c, 0x2d, 0x5c, 0x51, 0x48, 0x55, 0x24, 0x67, 0x6c, 0x4c, 0x45, 0x71, 0x35, 0x72, 0x5a, 0x48, 0x5e, 0x35, 0x61, 0x78, 0x35, 0x42, 0x2c, 0x7a, 0x75, 0x61, 0x5b, 0x4e, 0x76, 0x30, 0x26, 0x2f, 0x2a, 0x34, 0x48, 0x29, 0x25, 0x6e, 0x5c, 0x3a, 0x6c, 0x3e, 0x79, 0x4e, 0x2a, 0x21, 0x6f, 0x6f, 0x34, 0x46, 0x43, 0x26, 0x5b, 0x35, 0x78, 0x27, 0x69, 0x23, 0x72, 0x21, 0x69, 0x56, 0x6a, 0x7d, 0x4b, 0x5e, 0x65, 0x37, 0x60, 0x44, 0x7c, 0x5d, 0x5b, 0x72, 0x7d, 0x73, 0x7b, 0x47, 0x57, 0x21, 0x41, 0x38, 0x76, 0x38, 0x76, 0x5c, 0x58, 0x32, 0x4a, 0x37, 0x2f, 0x40, 0x4b, 0x4c, 0x3d, 0x41, 0x33, 0x56, 0x73, 0x38, 0x61, 0x71, 0x24, 0x49, 0x4c, 0x4a, 0x44, 0x2e, 0x3a, 0x3f, 0x74, 0x54, 0x4c, 0x65, 0x54, 0x2d, 0x3b, 0x28, 0x41, 0x45, 0x49, 0x2c, 0x6e, 0x48, 0x44, 0x43, 0x37, 0x3d, 0x7b, 0x6d, 0x2b, 0x4b, 0x32, 0x5a, 0x31, 0x61, 0x6e, 0x2b, 0x27, 0x50, 0x6b, 0x66, 0x76, 0x4e, 0x55, 0x35, 0x2b, 0x72, 0x2d, 0x5e, 0x42, 0x3e, 0x5a, 0x5d, 0x36, 0x45, 0x32, 0x3a, 0x58, 0x78, 0x78, 0x3e, 0x60, 0x6c, 0x5d, 0x63, 0x41, 0x7c, 0x52, 0x21, 0x75, 0x6a, 0x5a, 0x70, 0x55, 0x45, 0x76, 0x58, 0x33, 0x40, 0x38, 0x39, 0x21, 0x37, 0x7d, 0x77, 0x21, 0x70, 0x2b, 0x72, 0x29, 0x6a, 0x31, 0x5f, 0x38, 0x4a, 0x66, 0x65, 0x62, 0x2c, 0x39, 0x52, 0x5f, 0x2a, 0x2b, 0x63, 0x4f, 0x76, 0x43, 0x25, 0x6a, 0x50, 0x37, 0x52, 0x5e, 0x23, 0x3c, 0x42, 0x28, 0x75, 0x75, 0x42, 0x25, 0x23, 0x28, 0x56, 0x6c, 0x46, 0x5c, 0x5e, 0x6b, 0x7d, 0x48, 0x24, 0x77, 0x6c, 0x70, 0x62, 0x2e, 0x28, 0x7d, 0x6b, 0x69, 0x4a, 0x75, 0x3d, 0x5d, 0x56, 0x21, 0x49, 0x56, 0x47, 0x64, 0x2b, 0x4c, 0x52, 0x43, 0x60, 0x77, 0x49, 0x46, 0x46, 0x33, 0x2c, 0x4b, 0x4b, 0x3d, 0x63, 0x5d, 0x33, 0x78, 0x76, 0x51, 0x56, 0x77, 0x3c, 0x72, 0x74, 0x52, 0x27, 0x40, 0x6c, 0x42, 0x79, 0x49, 0x24, 0x62, 0x5e, 0x26, 0x31, 0x5c, 0x22, 0x2b, 0x4c, 0x64, 0x49, 0x52, 0x45, 0x47, 0x49, 0x3a, 0x2a, 0x51, 0x71, 0x22, 0x22, 0x70, 0x24, 0x34, 0x67, 0x4b, 0x6d, 0x58, 0x29, 0x63, 0x26, 0x7b, 0x6f, 0x38, 0x78, 0x25, 0x62, 0x4d, 0x3a, 0x7d, 0x40, 0x23, 0x57, 0x67, 0x33, 0x38, 0x31, 0x4e, 0x54, 0x3c, 0x4b, 0x48, 0x69, 0x3c, 0x39, 0x31, 0x2b, 0x26, 0x70, 0x44, 0x66, 0x4a, 0x37, 0x2b, 0x75, 0x36, 0x45, 0x59, 0x34, 0x3e, 0x3e, 0x29, 0x70, 0x71, 0x5a, 0x55, 0x49, 0x3e, 0x4b, 0x68, 0x4e, 0x75, 0x70, 0x3c, 0x5c, 0x50, 0x58, 0x28, 0x75, 0x3c, 0x2a, 0x41, 0x70, 0x2f, 0x2b, 0x37, 0x26, 0x75, 0x71, 0x55, 0x22, 0x3a, 0x44, 0x30, 0x48, 0x5d, 0x2f, 0x6c, 0x44, 0x28, 0x4b, 0x34, 0x45, 0x21, 0x60, 0x44, 0x36, 0x7b, 0x32, 0x39, 0x5f, 0x6d, 0x3f, 0x68, 0x73, 0x25, 0x45, 0x56, 0x7c, 0x78, 0x7a, 0x49, 0x6a, 0x46, 0x3d, 0x2d, 0x33, 0x6c, 0x6f, 0x23, 0x77, 0x38, 0x33, 0x36, 0x74, 0x7b, 0x57, 0x4b, 0x6d, 0x27, 0x75, 0x24, 0x6e, 0x43, 0x61, 0x4d, 0x44, 0x6d, 0x27, 0x48, 0x58, 0x5e, 0x7b, 0x26, 0x6a, 0x50, 0x7c, 0x51, 0x23, 0x3c, 0x4f, 0x37, 0x4c, 0x47, 0x3e, 0x45, 0x56, 0x22, 0x33, 0x7c, 0x66, 0x35, 0x54, 0x7a, 0x6e, 0x5a, 0x24, 0x70, 0x62, 0x29, 0x3f, 0x69, 0x79, 0x24, 0x43, 0x41, 0x24, 0x65, 0x25, 0x62, 0x4f, 0x73, 0x3e, 0x2b, 0x36, 0x46, 0x69, 0x27, 0x55, 0x2a, 0x6e, 0x24, 0x6c, 0x7d, 0x64, 0x7c, 0x61, 0x26, 0x67, 0x2a, 0x53, 0x73, 0x60, 0x28, 0x2d, 0x6b, 0x44, 0x54, 0x61, 0x34, 0x53, 0x22, 0x59, 0x6d, 0x73, 0x56, 0x55, 0x25, 0x2c, 0x38, 0x4a, 0x3b, 0x4e, 0x78, 0x46, 0x54, 0x6e, 0x6d, 0x4f, 0x47, 0x4f, 0x4f, 0x5a, 0x67, 0x77, 0x39, 0x66, 0x28, 0x29, 0x4e, 0x43, 0x55, 0x6e, 0x60, 0x59, 0x28, 0x3b, 0x65, 0x62, 0x61, 0x5a, 0x29, 0x6e, 0x79, 0x60, 0x41, 0x53, 0x2f, 0x5d, 0x44, 0x36, 0x7b, 0x3e, 0x7c, 0x2b, 0x77, 0x36, 0x70, 0x3f, 0x40, 0x55, 0x48, 0x67, 0x4b, 0x4d, 0x5d, 0x51, 0x79, 0x76, 0x48, 0x4a, 0x2d, 0x21, 0x60, 0x40, 0x46, 0x55, 0x7a, 0x60, 0x22, 0x25, 0x3f, 0x4b, 0x54, 0x6a, 0x6a, 0x3c, 0x77, 0x22, 0x5b, 0x43, 0x67, 0x58, 0x71, 0x22, 0x79, 0x4b, 0x32, 0x61, 0x44, 0x4d, 0x6f, 0x42, 0x33, 0x2d, 0x53, 0x35, 0x3d, 0x6f, 0x57, 0x48, 0x33, 0x3b, 0x5a, 0x53, 0x3f, 0x4e, 0x3f, 0x6b, 0x4c, 0x27, 0x26, 0x3b, 0x73, 0x49, 0x22, 0x55, 0x79, 0x2f, 0x47, 0x2f, 0x55, 0x5a, 0x7a, 0x71, 0x6c, 0x31, 0x43, 0x40, 0x56, 0x7b, 0x21, 0x7a, 0x6d, 0x4c, 0x43, 0x5e, 0x38, 0x47, 0x29, 0x38, 0x62, 0x49, 0x45, 0x78, 0x70, 0x2b, 0x2e, 0x65, 0x47, 0x71, 0x58, 0x79, 0x39, 0x67, 0x7d, 0x6d, 0x6a, 0x67, 0x4a, 0x71, 0x27, 0x35, 0x2a, 0x4c, 0x3e, 0x58, 0x55, 0x30, 0x4d, 0x75, 0x77, 0x48, 0x5f, 0x4b, 0x59, 0x34, 0x65, 0x68, 0x57, 0x59, 0x63, 0x23, 0x47, 0x38, 0x47, 0x5e, 0x56, 0x28, 0x79, 0x58, 0x3e, 0x39, 0x66, 0x77, 0x67, 0x33, 0x29, 0x61, 0x24, 0x7d, 0x37, 0x44, 0x37, 0x67, 0x3a, 0x58, 0x76, 0x21, 0x51, 0x59, 0x61, 0x73, 0x66, 0x75, 0x71, 0x53, 0x4d, 0x24, 0x2d, 0x4b, 0x29, 0x30, 0x32, 0x26, 0x59, 0x64, 0x27, 0x55, 0x2c, 0x5a, 0x4c, 0x3c, 0x6c, 0x53, 0x56, 0x4b, 0x3e, 0x55, 0x2e, 0x44, 0x38, 0x6b, 0x47, 0x76, 0x2d, 0x2c, 0x3f, 0x4d, 0x22, 0x7b, 0x6d, 0x61, 0x34, 0x6b, 0x50, 0x73, 0x28, 0x6d, 0x41, 0x71, 0x21, 0x76, 0x52, 0x2a, 0x6d, 0x53, 0x2a, 0x74, 0x28, 0x27, 0x62, 0x2a, 0x66, 0x25, 0x6e, 0x5e, 0x37, 0x4f, 0x27, 0x72, 0x28, 0x47, 0x63, 0x6e, 0x5a, 0x6a, 0x41, 0x35, 0x3a, 0x42, 0x3f, 0x27, 0x75, 0x3e, 0x26, 0x3e, 0x6b, 0x55, 0x59, 0x60, 0x24, 0x70, 0x49, 0x3c, 0x4e, 0x2c, 0x39, 0x7a, 0x36, 0x6c, 0x27, 0x3e, 0x6a, 0x4a, 0x59, 0x5a, 0x3e, 0x21, 0x73, 0x4e, 0x59, 0x6e, 0x3d, 0x32, 0x27, 0x45, 0x49, 0x58, 0x7d, 0x37, 0x39, 0x77, 0x28, 0x51, 0x79, 0x54, 0x2b, 0x78, 0x46, 0x5a, 0x21, 0x75, 0x33, 0x21, 0x63, 0x5a, 0x7b, 0x3e, 0x33, 0x4f, 0x67, 0x75, 0x3a, 0x50, 0x48, 0x60, 0x26, 0x64, 0x76, 0x5c, 0x42, 0x5c, 0x72, 0x38, 0x6c, 0x52, 0x21, 0x2b, 0x25, 0x6b, 0x7c, 0x6b, 0x2d, 0x5e, 0x63, 0x2a, 0x4c, 0x26, 0x5b, 0x4c, 0x58, 0x52, 0x51, 0x55, 0x31, 0x79, 0x6c, 0x53, 0x62, 0x3a, 0x36, 0x46, 0x7a, 0x29, 0x27, 0x78, 0x1a, 0xbf, 0x49, 0x74, 0x68, 0x24, 0x51, 0x44, 0x5b, 0x3e, 0x34, 0x44, 0x29, 0x5e, 0x4f, 0x2a, 0xe9, 0x3f, 0xf8, 0xff, 0xff, 0x52, 0x7d, 0x47, 0x67, 0x40, 0x27, 0x5e, 0x47, 0x46, 0x6d, 0x72, 0x5d, 0x49, 0x26, 0x45, 0x33, 0x6b, 0x4d, 0x4a, 0x6f, 0x62, 0x60, 0x45, 0x62, 0x27, 0x27, 0x7d, 0x6a, 0x41, 0x2c, 0x6c, 0x5b, 0x2a, 0x2b, 0x36, 0x29, 0x58, 0x7a, 0x4c, 0x6e, 0x2d, 0x74, 0x5c, 0x38, 0x22, 0x5f, 0x49, 0x63, 0x43, 0x5b, 0x67 }; uint32_t request2_len = sizeof(request2); uint8_t request3[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x26, 0x65, 0x3c, 0x6e, 0x6d, 0x64, 0x24, 0x39, 0x56, 0x43, 0x3e, 0x61, 0x5c, 0x54, 0x42, 0x23, 0x75, 0x6b, 0x71, 0x27, 0x66, 0x2e, 0x6e, 0x3d, 0x58, 0x23, 0x54, 0x77, 0x3b, 0x52, 0x6b, 0x50, 0x3b, 0x74, 0x2c, 0x54, 0x25, 0x5c, 0x51, 0x7c, 0x29, 0x7c, 0x5f, 0x4a, 0x35, 0x5c, 0x3d, 0x3f, 0x33, 0x55, 0x3b, 0x5a, 0x57, 0x31, 0x59, 0x4f, 0x6d, 0x6d, 0x7b, 0x3e, 0x38, 0x4d, 0x68, 0x75, 0x64, 0x21, 0x50, 0x63, 0x47, 0x42, 0x56, 0x39, 0x6c, 0x6f, 0x61, 0x53, 0x32, 0x56, 0x43, 0x52, 0x43, 0x67, 0x26, 0x45, 0x28, 0x6b, 0x77, 0x28, 0x7c, 0x64, 0x61, 0x24, 0x38, 0x6b, 0x59, 0x2a, 0x4f, 0x6e, 0x5b, 0x57, 0x24, 0x54, 0x33, 0x37, 0x47, 0x58, 0x4b, 0x58, 0x3d, 0x21, 0x38, 0x7c, 0x2c, 0x24, 0x5f, 0x67, 0x3a, 0x41, 0x3e, 0x2a, 0x72, 0x66, 0x2d, 0x6b, 0x66, 0x7b, 0x2b, 0x75, 0x78, 0x2f, 0x4d, 0x4c, 0x51, 0x70, 0x5d, 0x55, 0x54, 0x3c, 0x63, 0x46, 0x6b, 0x64, 0x4d, 0x25, 0x45, 0x21, 0x34, 0x65, 0x48, 0x32, 0x58, 0x4c, 0x70, 0x4c, 0x4c, 0x75, 0x5c, 0x77, 0x68, 0x78, 0x34, 0x5c, 0x2d, 0x39, 0x58, 0x3b, 0x40, 0x71, 0x77, 0x47, 0x32, 0x2e, 0x3c, 0x61, 0x6f, 0x6d, 0x5f, 0x43, 0x74, 0x36, 0x4f, 0x21, 0x44, 0x66, 0x36, 0x62, 0x30, 0x29, 0x5a, 0x34, 0x66, 0x4e, 0x51, 0x23, 0x4e, 0x38, 0x51, 0x78, 0x74, 0x58, 0x2e, 0x6d, 0x51, 0x49, 0x55, 0x73, 0x2a, 0x71, 0x3c, 0x74, 0x38, 0x6f, 0x5d, 0x4b, 0x74, 0x68, 0x65, 0x4a, 0x58, 0x41, 0x55, 0x29, 0x42, 0x69, 0x55, 0x3b, 0x2b, 0x47, 0x64, 0x3b, 0x77, 0x72, 0x74, 0x38, 0x53, 0x5c, 0x69, 0x49, 0x49, 0x5b, 0x31, 0x41, 0x6a, 0x4e, 0x2c, 0x6a, 0x63, 0x3f, 0x58, 0x4e, 0x25, 0x3e, 0x57, 0x41, 0x61, 0x26, 0x5e, 0x24, 0x69, 0x7a, 0x38, 0x60, 0x73, 0x70, 0x7d, 0x63, 0x34, 0x78, 0x4d, 0x50, 0x35, 0x69, 0x49, 0x22, 0x45, 0x44, 0x3f, 0x6e, 0x75, 0x64, 0x57, 0x3a, 0x61, 0x60, 0x34, 0x21, 0x61, 0x21, 0x2a, 0x78, 0x7b, 0x52, 0x43, 0x50, 0x5b, 0x76, 0x5f, 0x4b, 0x6a, 0x5d, 0x23, 0x5b, 0x57, 0x40, 0x53, 0x51, 0x33, 0x21, 0x35, 0x7d, 0x31, 0x46, 0x65, 0x52, 0x28, 0x25, 0x30, 0x5a, 0x37, 0x7c, 0x2c, 0x3d, 0x2a, 0x48, 0x24, 0x5a, 0x2f, 0x47, 0x64, 0x73, 0x64, 0x3d, 0x7a, 0x5b, 0x34, 0x5e, 0x42, 0x22, 0x32, 0x47, 0x6e, 0x58, 0x3b, 0x3e, 0x25, 0x2f, 0x58, 0x78, 0x42, 0x66, 0x71, 0x56, 0x2a, 0x66, 0x66, 0x5b, 0x55, 0x35, 0x7a, 0x41, 0x7c, 0x7c, 0x6a, 0x2d, 0x59, 0x25, 0x22, 0x34, 0x5a, 0x61, 0x37, 0x48, 0x39, 0x31, 0x4a, 0x55, 0x6a, 0x68, 0x40, 0x2f, 0x45, 0x69, 0x46, 0x25, 0x51, 0x7d, 0x4f, 0x71, 0x21, 0x33, 0x55, 0x50, 0x56, 0x5f, 0x75, 0x27, 0x64, 0x36, 0x7a, 0x39, 0x40, 0x6a, 0x77, 0x38, 0x5d, 0x39, 0x30, 0x5e, 0x74, 0x54, 0x24, 0x3f, 0x3d, 0x79, 0x3b, 0x27, 0x7d, 0x68, 0x7d, 0x40, 0x71, 0x7a, 0x65, 0x54, 0x50, 0x66, 0x33, 0x3c, 0x42, 0x69, 0x6e, 0x3c, 0x63, 0x63, 0x69, 0x7a, 0x5e, 0x7b, 0x76, 0x26, 0x71, 0x6f, 0x4a, 0x6d, 0x70, 0x73, 0x66, 0x3b, 0x26, 0x70, 0x43, 0x5b, 0x52, 0x4c, 0x6d, 0x51, 0x2a, 0x66, 0x6c, 0x3e, 0x68, 0x6a, 0x31, 0x41, 0x79, 0x72, 0x37, 0x47, 0x7d, 0x2b, 0x3c, 0x40, 0x6b, 0x75, 0x56, 0x70, 0x7b, 0x2d, 0x5f, 0x33, 0x30, 0x30, 0x21, 0x35, 0x7a, 0x7a, 0x67, 0x48, 0x5e, 0x3b, 0x73, 0x50, 0x54, 0x47, 0x23, 0x2b, 0x4c, 0x4e, 0x2f, 0x24, 0x44, 0x34, 0x23, 0x5d, 0x76, 0x51, 0x5a, 0x73, 0x72, 0x3e, 0x47, 0x77, 0x40, 0x28, 0x65, 0x2e, 0x2a, 0x75, 0x3c, 0x2a, 0x27, 0x4a, 0x3f, 0x3c, 0x66, 0x2d, 0x21, 0x79, 0x2d, 0x2b, 0x78, 0x7c, 0x5a, 0x73, 0x46, 0x6b, 0x39, 0x65, 0x5e, 0x3d, 0x38, 0x40, 0x32, 0x3e, 0x21, 0x62, 0x34, 0x41, 0x58, 0x53, 0x67, 0x34, 0x58, 0x56, 0x61, 0x5b, 0x3e, 0x4e, 0x2c, 0x5b, 0x73, 0x35, 0x34, 0x35, 0x21, 0x3a, 0x61, 0x5f, 0x6e, 0x45, 0x78, 0x44, 0x28, 0x23, 0x48, 0x65, 0x53, 0x47, 0x6e, 0x2c, 0x38, 0x5e, 0x2c, 0x57, 0x58, 0x30, 0x7a, 0x3b, 0x4b, 0x4a, 0x74, 0x7d, 0x3e, 0x4d, 0x30, 0x24, 0x76, 0x66, 0x6d, 0x2e, 0x74, 0x75, 0x28, 0x48, 0x5c, 0x23, 0x6c, 0x46, 0x27, 0x46, 0x6e, 0x34, 0x63, 0x21, 0x58, 0x54, 0x50, 0x2f, 0x40, 0x47, 0x40, 0x32, 0x36, 0x48, 0x5f, 0x7d, 0x4a, 0x41, 0x6e, 0x60, 0x2c, 0x4a, 0x6a, 0x67, 0x6c, 0x41, 0x27, 0x23, 0x30, 0x48, 0x6a, 0x49, 0x73, 0x26, 0x77, 0x75, 0x4d, 0x65, 0x5b, 0x34, 0x79, 0x67, 0x61, 0x5b, 0x5c, 0x2b, 0x71, 0x3f, 0x62, 0x51, 0x3a, 0x53, 0x42, 0x26, 0x6f, 0x36, 0x57, 0x3f, 0x2b, 0x34, 0x24, 0x30, 0x60, 0x55, 0x70, 0x65, 0x70, 0x57, 0x5d, 0x68, 0x36, 0x52, 0x5d, 0x3f, 0x6a, 0x3a, 0x33, 0x31, 0x6c, 0x4e, 0x57, 0x79, 0x49, 0x79, 0x69, 0x71, 0x6f, 0x70, 0x6a, 0x76, 0x4b, 0x2f, 0x33, 0x51, 0x68, 0x30, 0x2e, 0x77, 0x78, 0x55, 0x2f, 0x53, 0x52, 0x5e, 0x57, 0x60, 0x3b, 0x6f, 0x69, 0x61, 0x6c, 0x60, 0x5a, 0x34, 0x5a, 0x35, 0x4b, 0x28, 0x54, 0x32, 0x6a, 0x35, 0x36, 0x6d, 0x68, 0x47, 0x5c, 0x74, 0x2e, 0x5f, 0x6c, 0x6d, 0x55, 0x42, 0x77, 0x64, 0x7d, 0x53, 0x4d, 0x39, 0x2c, 0x41, 0x42, 0x23, 0x3a, 0x73, 0x40, 0x60, 0x5d, 0x38, 0x6d, 0x36, 0x56, 0x57, 0x2a, 0x28, 0x3d, 0x3b, 0x5c, 0x75, 0x35, 0x2d, 0x69, 0x2d, 0x44, 0x51, 0x27, 0x63, 0x66, 0x33, 0x46, 0x42, 0x2e, 0x36, 0x6b, 0x7b, 0x2c, 0x23, 0x3b, 0x5a, 0x50, 0x2a, 0x65, 0x28, 0x3b, 0x3c, 0x51, 0x3f, 0x4d, 0x63, 0x38, 0x25, 0x74, 0x2e, 0x51, 0x22, 0x31, 0x74, 0x35, 0x33, 0x23, 0x2d, 0x3f, 0x77, 0x26, 0x2c, 0x55, 0x6d, 0x27, 0x39, 0x79, 0x76, 0x63, 0x4b, 0x43, 0x4a, 0x3a, 0x6b, 0x59, 0x55, 0x65, 0x26, 0x2f, 0x3f, 0x56, 0x67, 0x5a, 0x77, 0x71, 0x22, 0x51, 0x2b, 0x6d, 0x4c, 0x2c, 0x57, 0x66, 0x76, 0x37, 0x70, 0x5f, 0x52, 0x29, 0x44, 0x52, 0x22, 0x57, 0x37, 0x27, 0x79, 0x29, 0x5c, 0x57, 0x3b, 0x54, 0x3c, 0x3f, 0x53, 0x35, 0x27, 0x5e, 0x7c, 0x49, 0x77, 0x57, 0x5a, 0x22, 0x76, 0x7c, 0x5b, 0x2f, 0x53, 0x5e, 0x55, 0x6d, 0x64, 0x67, 0x34, 0x41, 0x23, 0x76, 0x67, 0x23, 0x78, 0x6a, 0x63, 0x27, 0x68, 0x43, 0x7d, 0x58, 0x49, 0x2d, 0x79, 0x2e, 0x75, 0x60, 0x6b, 0x34, 0x48, 0x6f, 0x4a, 0x6c, 0x48, 0x40, 0x68, 0x5f, 0x35, 0x25, 0x6c, 0x38, 0x5c, 0x30, 0x32, 0x4c, 0x36, 0x31, 0x29, 0x74, 0x4a, 0x55, 0x56, 0x6d, 0x4e, 0x23, 0x54, 0x2e, 0x69, 0x78, 0x61, 0x76, 0x66, 0x22, 0x44, 0x73, 0x25, 0x44, 0x29, 0x2a, 0x28, 0x3b, 0x67, 0x48, 0x58, 0x37, 0x4a, 0x76, 0x76, 0x51, 0x4a, 0x61, 0x70, 0x51, 0x74, 0x40, 0x23, 0x29, 0x63, 0x69, 0x4a, 0x29, 0x23, 0x34, 0x6a, 0x3b, 0x25, 0x28, 0x54, 0x45, 0x33, 0x28, 0x44, 0x30, 0x61, 0x5b, 0x60, 0x51, 0x3f, 0x68, 0x50, 0x70, 0x3d, 0x58, 0x2e, 0x6e, 0x59, 0x5a, 0x62, 0x66, 0x4d, 0x7a, 0x2e, 0x37, 0x37, 0x3d, 0x7b, 0x74, 0x79, 0x48, 0x45, 0x77, 0x56, 0x33, 0x76, 0x71, 0x60, 0x74, 0x3f, 0x61, 0x22, 0x52, 0x51, 0x71, 0x69 }; uint32_t request3_len = sizeof(request3); uint8_t request4[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x75, 0x3e, 0x76, 0x3e, 0x66, 0x6b, 0x6b, 0x3e, 0x6d, 0x59, 0x38, 0x2b, 0x63, 0x4d, 0x2c, 0x73, 0x54, 0x57, 0x34, 0x25, 0x5b, 0x42, 0x7d, 0x5d, 0x37, 0x34, 0x2c, 0x79, 0x24, 0x4b, 0x74, 0x73, 0x25, 0x36, 0x73, 0x3a, 0x2c, 0x55, 0x69, 0x3c, 0x58, 0x67, 0x33, 0x53, 0x67, 0x5c, 0x61, 0x7b, 0x44, 0x2e, 0x42, 0x2d, 0x6b, 0x50, 0x55, 0x24, 0x70, 0x58, 0x60, 0x38, 0x42, 0x45, 0x70, 0x6d, 0x2f, 0x27, 0x27, 0x2c, 0x21, 0x6d, 0x57, 0x6e, 0x43, 0x3c, 0x5b, 0x27, 0x7a, 0x34, 0x49, 0x5a, 0x69, 0x30, 0x3f, 0x6f, 0x77, 0x70, 0x39, 0x2d, 0x51, 0x74, 0x4b, 0x25, 0x70, 0x51, 0x64, 0x4d, 0x75, 0x52, 0x5e, 0x3e, 0x37, 0x30, 0x5d, 0x3b, 0x2c, 0x72, 0x25, 0x6c, 0x6f, 0x79, 0x69, 0x3c, 0x5b, 0x73, 0x3d, 0x41, 0x28, 0x28, 0x64, 0x60, 0x4b, 0x7a, 0x2c, 0x4a, 0x6b, 0x3d, 0x2e, 0x6c, 0x7a, 0x54, 0x70, 0x61, 0x6f, 0x4b, 0x40, 0x28, 0x59, 0x31, 0x25, 0x21, 0x57, 0x79, 0x4b, 0x31, 0x6f, 0x4e, 0x71, 0x2b, 0x3c, 0x24, 0x30, 0x28, 0x3c, 0x61, 0x28, 0x4b, 0x35, 0x61, 0x4d, 0x55, 0x5e, 0x66, 0x34, 0x5f, 0x61, 0x70, 0x7b, 0x67, 0x51, 0x55, 0x68, 0x78, 0x26, 0x3a, 0x27, 0x4e, 0x71, 0x79, 0x4f, 0x67, 0x2c, 0x5a, 0x79, 0x75, 0x59, 0x3a, 0x33, 0x4a, 0x36, 0x71, 0x72, 0x6d, 0x49, 0x3e, 0x53, 0x59, 0x2b, 0x2b, 0x27, 0x4e, 0x50, 0x5d, 0x21, 0x55, 0x64, 0x4b, 0x72, 0x73, 0x25, 0x55, 0x26, 0x4f, 0x3a, 0x21, 0x54, 0x29, 0x4f, 0x64, 0x51, 0x59, 0x60, 0x7b, 0x7c, 0x6f, 0x3e, 0x65, 0x74, 0x6a, 0x5b, 0x52, 0x2c, 0x56, 0x4e, 0x45, 0x53, 0x4b, 0x7c, 0x38, 0x49, 0x4b, 0x4e, 0x4f, 0x4a, 0x47, 0x5e, 0x7c, 0x46, 0x3b, 0x67, 0x2e, 0x43, 0x79, 0x35, 0x55, 0x59, 0x6d, 0x38, 0x70, 0x2f, 0x59, 0x4f, 0x27, 0x63, 0x40, 0x66, 0x2d, 0x39, 0x4f, 0x3d, 0x2e, 0x4c, 0x67, 0x71, 0x7d, 0x34, 0x22, 0x52, 0x4e, 0x36, 0x7b, 0x2c, 0x39, 0x4d, 0x42, 0x60, 0x75, 0x74, 0x72, 0x4f, 0x72, 0x68, 0x3a, 0x51, 0x31, 0x2d, 0x21, 0x4a, 0x35, 0x47, 0x6d, 0x69, 0x3c, 0x50, 0x4c, 0x59, 0x66, 0x4c, 0x71, 0x24, 0x3a, 0x36, 0x67, 0x24, 0x5a, 0x59, 0x28, 0x7c, 0x21, 0x5e, 0x77, 0x68, 0x5e, 0x7b, 0x6e, 0x56, 0x62, 0x36, 0x29, 0x6f, 0x4f, 0x5d, 0x57, 0x56, 0x2b, 0x75, 0x2a, 0x2c, 0x69, 0x63, 0x51, 0x74, 0x6e, 0x5e, 0x46, 0x50, 0x28, 0x2c, 0x3b, 0x32, 0x53, 0x28, 0x78, 0x59, 0x72, 0x39, 0x5e, 0x44, 0x5c, 0x77, 0x60, 0x72, 0x44, 0x3b, 0x75, 0x68, 0x39, 0x55, 0x3e, 0x44, 0x50, 0x76, 0x3c, 0x48, 0x46, 0x43, 0x22, 0x56, 0x27, 0x21, 0x31, 0x33, 0x4a, 0x5a, 0x74, 0x41, 0x58, 0x3f, 0x39, 0x29, 0x71, 0x73, 0x30, 0x57, 0x70, 0x33, 0x62, 0x7b, 0x4a, 0x75, 0x3e, 0x4d, 0x4c, 0x4e, 0x55, 0x63, 0x38, 0x66, 0x7d, 0x68, 0x7d, 0x6f, 0x23, 0x55, 0x50, 0x3d, 0x34, 0x46, 0x5e, 0x2f, 0x55, 0x27, 0x62, 0x68, 0x7c, 0x6c, 0x21, 0x2b, 0x63, 0x4b, 0x47, 0x6b, 0x6a, 0x5b, 0x7b, 0x5c, 0x71, 0x37, 0x7c, 0x52, 0x2b, 0x2f, 0x4a, 0x47, 0x70, 0x78, 0x50, 0x2f, 0x75, 0x28, 0x4c, 0x60, 0x4c, 0x4c, 0x54, 0x6b, 0x68, 0x63, 0x4f, 0x47, 0x39, 0x2a, 0x70, 0x51, 0x7d, 0x28, 0x59, 0x52, 0x46, 0x4b, 0x38, 0x27, 0x49, 0x50, 0x5d, 0x25, 0x22, 0x5f, 0x48, 0x2c, 0x2f, 0x67, 0x59, 0x5d, 0x7d, 0x21, 0x3d, 0x72, 0x4f, 0x5c, 0x5b, 0x41, 0x47, 0x5f, 0x56, 0x69, 0x42, 0x55, 0x60, 0x68, 0x4b, 0x77, 0x44, 0x4c, 0x3b, 0x7d, 0x5a, 0x58, 0x43, 0x7a, 0x33, 0x22, 0x58, 0x58, 0x6f, 0x74, 0x53, 0x57, 0x6d, 0x6e, 0x29, 0x6b, 0x33, 0x71, 0x68, 0x29, 0x48, 0x67, 0x35, 0x52, 0x41, 0x6b, 0x36, 0x4f, 0x46, 0x31, 0x24, 0x73, 0x56, 0x40, 0x48, 0x37, 0x51, 0x24, 0x2a, 0x59, 0x21, 0x74, 0x76, 0x25, 0x2e, 0x4a, 0x74, 0x32, 0x29, 0x5f, 0x57, 0x7c, 0x58, 0x30, 0x2c, 0x7b, 0x70, 0x5b, 0x51, 0x73, 0x27, 0x4a, 0x28, 0x77, 0x2a, 0x43, 0x28, 0x2e, 0x32, 0x3d, 0x38, 0x36, 0x2e, 0x6b, 0x40, 0x6c, 0x76, 0x54, 0x66, 0x4a, 0x5c, 0x25, 0x62, 0x2e, 0x61, 0x48, 0x30, 0x28, 0x41, 0x40, 0x69, 0x3c, 0x39, 0x36, 0x4b, 0x64, 0x50, 0x76, 0x3d, 0x52, 0x50, 0x77, 0x33, 0x3b, 0x65, 0x59, 0x31, 0x5c, 0x48, 0x6a, 0x74, 0x78, 0x5b, 0x74, 0x60, 0x47, 0x27, 0x60, 0x22, 0x4a, 0x72, 0x25, 0x34, 0x5d, 0x3a, 0x21, 0x66, 0x61, 0x7b, 0x34, 0x41, 0x3b, 0x3a, 0x27, 0x44, 0x48, 0x7c, 0x7a, 0x74, 0x3a, 0x68, 0x59, 0x48, 0x61, 0x32, 0x49, 0x61, 0x40, 0x22, 0x33, 0x75, 0x29, 0x76, 0x5b, 0x24, 0x5b, 0x5c, 0x76, 0x5c, 0x28, 0x75, 0x36, 0x26, 0x2c, 0x65, 0x5e, 0x51, 0x7b, 0x3a, 0x7d, 0x4f, 0x35, 0x73, 0x6b, 0x5b, 0x5c, 0x37, 0x35, 0x6b, 0x41, 0x35, 0x40, 0x3a, 0x22, 0x28, 0x6c, 0x71, 0x46, 0x68, 0x7b, 0x66, 0x56, 0x24, 0x7c, 0x54, 0x28, 0x30, 0x22, 0x4e, 0x3c, 0x65, 0x69, 0x36, 0x44, 0x53, 0x3d, 0x6c, 0x5f, 0x73, 0x6c, 0x6f, 0x5e, 0x27, 0x23, 0x4e, 0x60, 0x45, 0x2f, 0x3d, 0x37, 0x28, 0x51, 0x29, 0x77, 0x6a, 0x6b, 0x2a, 0x2a, 0x51, 0x26, 0x4c, 0x4e, 0x71, 0x77, 0x73, 0x71, 0x2d, 0x5a, 0x2c, 0x23, 0x3d, 0x5f, 0x62, 0x63, 0x2e, 0x72, 0x2a, 0x75, 0x66, 0x43, 0x56, 0x5f, 0x21, 0x64, 0x66, 0x35, 0x3b, 0x7a, 0x45, 0x3f, 0x4f, 0x57, 0x22, 0x5a, 0x45, 0x65, 0x37, 0x58, 0x5b, 0x43, 0x66, 0x4f, 0x5d, 0x6e, 0x41, 0x41, 0x62, 0x5e, 0x39, 0x65, 0x6f, 0x43, 0x4b, 0x5e, 0x51, 0x42, 0x3f, 0x2d, 0x68, 0x4b, 0x6e, 0x46, 0x6f, 0x21, 0x44, 0x3c, 0x22, 0x46, 0x31, 0x31, 0x2e, 0x56, 0x2e, 0x77, 0x48, 0x68, 0x23, 0x4a, 0x36, 0x52, 0x5d, 0x61, 0x47, 0x71, 0x2e, 0x3a, 0x4a, 0x5b, 0x56, 0x6b, 0x52, 0x2a, 0x4c, 0x4f, 0x24, 0x34, 0x60, 0x70, 0x58, 0x7a, 0x76, 0x4b, 0x68, 0x24, 0x5f, 0x51, 0x6d, 0x75, 0x45, 0x48, 0x21, 0x53, 0x4d, 0x27, 0x75, 0x5f, 0x50, 0x3e, 0x40, 0x3f, 0x5e, 0x64, 0x41, 0x5f, 0x68, 0x48, 0x30, 0x71, 0x4b, 0x66, 0x2c, 0x2f, 0x76, 0x4b, 0x23, 0x46, 0x34, 0x50, 0x58, 0x52, 0x69, 0x2b, 0x6e, 0x7a, 0x33, 0x53, 0x43, 0x43, 0x35, 0x54, 0x30, 0x73, 0x63, 0x3b, 0x43, 0x52, 0x29, 0x45, 0x37, 0x71, 0x79, 0x5a, 0x26, 0x24, 0x72, 0x73, 0x4e, 0x44, 0x38, 0x5b, 0x71, 0x36, 0x3a, 0x4f, 0x5b, 0x71, 0x28, 0x71, 0x79, 0x72, 0x40, 0x6e, 0x51, 0x72, 0x29, 0x3d, 0x4f, 0x33, 0x22, 0x73, 0x5a, 0x30, 0x71, 0x58, 0x54, 0x59, 0x48, 0x29, 0x2b, 0x5c, 0x73, 0x6f, 0x4e, 0x60, 0x2a, 0x72, 0x39, 0x50, 0x59, 0x6f, 0x48, 0x3e, 0x62, 0x6c, 0x62, 0x49, 0x6c, 0x2c, 0x3f, 0x43, 0x3f, 0x32, 0x7c, 0x6f, 0x6c, 0x39, 0x26, 0x26, 0x7b, 0x5d, 0x65, 0x6f, 0x41, 0x7c, 0x42, 0x2b, 0x65, 0x6f, 0x3e, 0x7b, 0x69, 0x46, 0x4d, 0x68, 0x68, 0x5a, 0x33, 0x25, 0x5d, 0x6f, 0x48, 0x7c, 0x77, 0x7d, 0x3f, 0x4e, 0x30, 0x69, 0x65, 0x28, 0x2e, 0x34, 0x34, 0x41, 0x43, 0x5e, 0x30, 0x23, 0x3b, 0x60, 0x79, 0x5b, 0x26, 0x7c, 0x77, 0x3e, 0x43, 0x24, 0x31, 0x3a, 0x56, 0x24, 0x3c, 0x60, 0x3f, 0x60, 0x55, 0x6a, 0x68 }; uint32_t request4_len = sizeof(request4); uint8_t request5[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x69, 0x3e, 0x72, 0x44, 0x31, 0x6b, 0x28, 0x2f, 0x79, 0x37, 0x58, 0x5d, 0x5f, 0x68, 0x71, 0x47, 0x7a, 0x68, 0x7c, 0x6c, 0x65, 0x3c, 0x74, 0x67, 0x59, 0x5c, 0x3d, 0x28, 0x65, 0x28, 0x58, 0x74, 0x44, 0x62, 0x2e, 0x36, 0x54, 0x2f, 0x24, 0x34, 0x4b, 0x6d, 0x3a, 0x7b, 0x60, 0x71, 0x5a, 0x77, 0x4a, 0x27, 0x25, 0x70, 0x75, 0x56, 0x78, 0x73, 0x2e, 0x38, 0x6c, 0x70, 0x66, 0x7b, 0x7b, 0x2d, 0x78, 0x27, 0x65, 0x63, 0x58, 0x4f, 0x7d, 0x5c, 0x31, 0x3e, 0x36, 0x6e, 0x65, 0x61, 0x2e, 0x4e, 0x26, 0x68, 0x2b, 0x33, 0x7d, 0x54, 0x2c, 0x28, 0x47, 0x3a, 0x31, 0x47, 0x56, 0x32, 0x74, 0x51, 0x79, 0x65, 0x42, 0x45, 0x60, 0x55, 0x6f, 0x48, 0x61, 0x23, 0x72, 0x62, 0x74, 0x3a, 0x5a, 0x26, 0x2d, 0x41, 0x58, 0x62, 0x75, 0x4b, 0x37, 0x2e, 0x3f, 0x2a, 0x6e, 0x2e, 0x2c, 0x43, 0x6f, 0x53, 0x5f, 0x48, 0x7a, 0x53, 0x7b, 0x54, 0x28, 0x30, 0x2b, 0x7a, 0x34, 0x33, 0x28, 0x2b, 0x23, 0x23, 0x72, 0x38, 0x25, 0x30, 0x35, 0x66, 0x76, 0x46, 0x2a, 0x57, 0x7a, 0x60, 0x38, 0x5a, 0x26, 0x4f, 0x78, 0x43, 0x2c, 0x7d, 0x3d, 0x76, 0x7d, 0x66, 0x48, 0x7d, 0x3e, 0x59, 0x31, 0x58, 0x6b, 0x30, 0x76, 0x45, 0x6e, 0x70, 0x72, 0x5f, 0x3c, 0x70, 0x6d, 0x77, 0x42, 0x75, 0x42, 0x73, 0x68, 0x5e, 0x5f, 0x72, 0x2b, 0x2a, 0x70, 0x38, 0x7a, 0x4c, 0x58, 0x2e, 0x5e, 0x2d, 0x2d, 0x78, 0x67, 0x5a, 0x77, 0x34, 0x5a, 0x50, 0x76, 0x2d, 0x2b, 0x77, 0x37, 0x6e, 0x38, 0x2d, 0x7b, 0x44, 0x78, 0x67, 0x52, 0x57, 0x79, 0x43, 0x7d, 0x6d, 0x4d, 0x32, 0x23, 0x37, 0x51, 0x4b, 0x41, 0x60, 0x6e, 0x53, 0x4e, 0x78, 0x37, 0x37, 0x60, 0x56, 0x64, 0x52, 0x25, 0x46, 0x53, 0x5f, 0x2b, 0x56, 0x2b, 0x3b, 0x40, 0x37, 0x33, 0x37, 0x23, 0x43, 0x36, 0x6b, 0x6b, 0x5d, 0x35, 0x28, 0x7d, 0x6a, 0x2c, 0x68, 0x28, 0x4b, 0x4a, 0x6c, 0x27, 0x35, 0x51, 0x66, 0x30, 0x39, 0x28, 0x4d, 0x61, 0x2f, 0x64, 0x36, 0x59, 0x39, 0x68, 0x4b, 0x24, 0x51, 0x7b, 0x6e, 0x38, 0x49, 0x55, 0x72, 0x5f, 0x33, 0x5c, 0x26, 0x45, 0x2f, 0x71, 0x66, 0x33, 0x3d, 0x36, 0x68, 0x65, 0x48, 0x42, 0x40, 0x58, 0x61, 0x4f, 0x50, 0x70, 0x5e, 0x3c, 0x5d, 0x56, 0x43, 0x4c, 0x41, 0x45, 0x54, 0x76, 0x4b, 0x21, 0x25, 0x45, 0x4c, 0x5e, 0x58, 0x23, 0x7d, 0x34, 0x61, 0x5c, 0x53, 0x2a, 0x47, 0x37, 0x22, 0x6d, 0x31, 0x42, 0x6e, 0x22, 0x72, 0x62, 0x55, 0x59, 0x66, 0x28, 0x73, 0x55, 0x50, 0x5c, 0x6f, 0x52, 0x40, 0x3e, 0x3b, 0x44, 0x2a, 0x51, 0x3d, 0x4d, 0x47, 0x3a, 0x57, 0x3e, 0x29, 0x29, 0x7d, 0x40, 0x36, 0x41, 0x3f, 0x58, 0x77, 0x3b, 0x41, 0x2d, 0x64, 0x5a, 0x72, 0x7c, 0x7d, 0x30, 0x68, 0x54, 0x34, 0x40, 0x21, 0x7d, 0x2b, 0x2d, 0x2b, 0x6d, 0x5f, 0x49, 0x57, 0x68, 0x65, 0x79, 0x2c, 0x21, 0x41, 0x31, 0x55, 0x27, 0x4d, 0x78, 0x55, 0x2f, 0x61, 0x62, 0x78, 0x58, 0x25, 0x3a, 0x4b, 0x3e, 0x67, 0x44, 0x7c, 0x7d, 0x52, 0x3d, 0x3e, 0x3b, 0x62, 0x2d, 0x28, 0x48, 0x70, 0x2c, 0x79, 0x31, 0x5a, 0x5e, 0x3f, 0x6a, 0x30, 0x78, 0x41, 0x44, 0x60, 0x4e, 0x63, 0x63, 0x2e, 0x31, 0x79, 0x2b, 0x47, 0x57, 0x26, 0x22, 0x6a, 0x46, 0x43, 0x70, 0x30, 0x51, 0x7d, 0x21, 0x3c, 0x68, 0x74, 0x40, 0x5a, 0x6e, 0x71, 0x3f, 0x76, 0x73, 0x2e, 0x29, 0x3f, 0x6a, 0x55, 0x21, 0x72, 0x65, 0x75, 0x5e, 0x6b, 0x39, 0x6e, 0x3e, 0x76, 0x42, 0x41, 0x65, 0x3f, 0x2b, 0x37, 0x70, 0x7a, 0x7a, 0x29, 0x50, 0x66, 0x21, 0x67, 0x3f, 0x54, 0x32, 0x5f, 0x73, 0x27, 0x59, 0x6f, 0x39, 0x4b, 0x4e, 0x23, 0x54, 0x3b, 0x39, 0x21, 0x38, 0x41, 0x33, 0x44, 0x57, 0x6b, 0x51, 0x30, 0x6a, 0x76, 0x62, 0x2c, 0x5c, 0x5e, 0x49, 0x3e, 0x59, 0x38, 0x5e, 0x4a, 0x59, 0x77, 0x34, 0x25, 0x4f, 0x76, 0x6a, 0x68, 0x6f, 0x73, 0x7c, 0x3d, 0x2d, 0x64, 0x6c, 0x7a, 0x3d, 0x2c, 0x26, 0x28, 0x58, 0x2b, 0x4b, 0x45, 0x68, 0x38, 0x74, 0x63, 0x7b, 0x4a, 0x63, 0x52, 0x26, 0x54, 0x3c, 0x46, 0x77, 0x2d, 0x6b, 0x78, 0x63, 0x7b, 0x6a, 0x50, 0x26, 0x42, 0x62, 0x63, 0x65, 0x6b, 0x63, 0x54, 0x4d, 0x47, 0x59, 0x48, 0x2e, 0x60, 0x7c, 0x4d, 0x33, 0x4d, 0x61, 0x72, 0x76, 0x72, 0x21, 0x4d, 0x2b, 0x43, 0x58, 0x47, 0x4a, 0x36, 0x2d, 0x7b, 0x32, 0x72, 0x21, 0x78, 0x22, 0x38, 0x2c, 0x7a, 0x34, 0x44, 0x45, 0x66, 0x31, 0x7b, 0x37, 0x68, 0x62, 0x65, 0x62, 0x6d, 0x4e, 0x7c, 0x75, 0x38, 0x2a, 0x73, 0x27, 0x64, 0x33, 0x4f, 0x21, 0x41, 0x7c, 0x41, 0x3f, 0x60, 0x68, 0x34, 0x72, 0x5b, 0x38, 0x33, 0x6f, 0x65, 0x3e, 0x5a, 0x7d, 0x25, 0x49, 0x50, 0x60, 0x36, 0x59, 0x5e, 0x6b, 0x25, 0x66, 0x7a, 0x7d, 0x71, 0x40, 0x6c, 0x2c, 0x6e, 0x6a, 0x5a, 0x24, 0x5a, 0x76, 0x21, 0x67, 0x39, 0x4b, 0x4a, 0x31, 0x24, 0x66, 0x66, 0x2e, 0x58, 0x43, 0x46, 0x75, 0x6c, 0x47, 0x28, 0x4f, 0x21, 0x75, 0x77, 0x6f, 0x71, 0x48, 0x3f, 0x4d, 0x4c, 0x51, 0x37, 0x3b, 0x41, 0x4d, 0x41, 0x48, 0x28, 0x71, 0x24, 0x2f, 0x7a, 0x22, 0x49, 0x4a, 0x39, 0x44, 0x43, 0x68, 0x21, 0x3a, 0x34, 0x4e, 0x52, 0x7a, 0x60, 0x71, 0x61, 0x6d, 0x51, 0x58, 0x2a, 0x59, 0x4c, 0x4a, 0x59, 0x6b, 0x77, 0x78, 0x2e, 0x27, 0x78, 0x76, 0x48, 0x4f, 0x46, 0x79, 0x2c, 0x54, 0x42, 0x7b, 0x2c, 0x52, 0x41, 0x54, 0x2b, 0x2c, 0x33, 0x6b, 0x70, 0x77, 0x2e, 0x2e, 0x41, 0x25, 0x7a, 0x48, 0x6e, 0x71, 0x55, 0x6a, 0x43, 0x5a, 0x2c, 0x6c, 0x76, 0x6d, 0x71, 0x72, 0x4d, 0x76, 0x5b, 0x7b, 0x22, 0x4b, 0x45, 0x31, 0x30, 0x26, 0x53, 0x75, 0x3f, 0x26, 0x59, 0x36, 0x2f, 0x68, 0x4f, 0x34, 0x5e, 0x2b, 0x30, 0x63, 0x68, 0x7b, 0x32, 0x5e, 0x77, 0x7d, 0x7b, 0x53, 0x5f, 0x63, 0x53, 0x77, 0x7a, 0x7d, 0x35, 0x28, 0x3e, 0x41, 0x6f, 0x5b, 0x31, 0x78, 0x7b, 0x2b, 0x51, 0x23, 0x43, 0x46, 0x6a, 0x32, 0x32, 0x25, 0x45, 0x57, 0x43, 0x22, 0x50, 0x60, 0x32, 0x70, 0x2e, 0x79, 0x2e, 0x6b, 0x33, 0x67, 0x6c, 0x43, 0x5b, 0x3b, 0x68, 0x53, 0x53, 0x6a, 0x48, 0x59, 0x5f, 0x30, 0x72, 0x7d, 0x6b, 0x37, 0x24, 0x75, 0x52, 0x50, 0x2b, 0x75, 0x35, 0x24, 0x3b, 0x6e, 0x53, 0x56, 0x34, 0x23, 0x54, 0x65, 0x4f, 0x78, 0x3e, 0x46, 0x7d, 0x25, 0x3f, 0x2f, 0x49, 0x6b, 0x49, 0x47, 0x45, 0x24, 0x38, 0x3b, 0x68, 0x6c, 0x4f, 0x29, 0x21, 0x50, 0x32, 0x67, 0x47, 0x5a, 0x72, 0x76, 0x21, 0x39, 0x67, 0x3c, 0x72, 0x47, 0x43, 0x4a, 0x2e, 0x31, 0x32, 0x34, 0x3c, 0x53, 0x2d, 0x22, 0x5b, 0x5b, 0x6a, 0x77, 0x75, 0x31, 0x68, 0x30, 0x45, 0x43, 0x5f, 0x60, 0x5d, 0x56, 0x67, 0x66, 0x55, 0x6a, 0x72, 0x77, 0x7b, 0x44, 0x61, 0x22, 0x64, 0x36, 0x39, 0x6e, 0x44, 0x37, 0x54, 0x45, 0x46, 0x6f, 0x58, 0x35, 0x51, 0x3c, 0x62, 0x49, 0x3a, 0x50, 0x58, 0x56, 0x5d, 0x77, 0x6f, 0x56, 0x64, 0x7b, 0x49, 0x39, 0x21, 0x31, 0x2d, 0x5f, 0x56, 0x56, 0x33, 0x31, 0x69, 0x4a, 0x52, 0x62, 0x5b, 0x6e, 0x65, 0x7c, 0x3d, 0x31, 0x55, 0x3d, 0x75, 0x25, 0x61, 0x50, 0x71, 0x45, 0x29 }; uint32_t request5_len = sizeof(request5); uint8_t request6[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5b, 0x56, 0x3d, 0x5a, 0x6b, 0x43, 0x73, 0x26, 0x65, 0x3b, 0x38, 0x79, 0x26, 0x5e, 0x60, 0x59, 0x40, 0x71, 0x7c, 0x72, 0x28, 0x29, 0x69, 0x32, 0x72, 0x5a, 0x6c, 0x55, 0x43, 0x65, 0x3f, 0x4a, 0x21, 0x66, 0x59, 0x30, 0x76, 0x39, 0x21, 0x69, 0x4b, 0x25, 0x5d, 0x6e, 0x5f, 0x24, 0x2b, 0x38, 0x70, 0x78, 0x35, 0x7d, 0x39, 0x36, 0x31, 0x72, 0x44, 0x49, 0x45, 0x3d, 0x25, 0x50, 0x24, 0x3b, 0x52, 0x27, 0x66, 0x46, 0x5d, 0x4f, 0x34, 0x50, 0x26, 0x5a, 0x25, 0x3e, 0x3f, 0x34, 0x4b, 0x35, 0x77, 0x3a, 0x3f, 0x3e, 0x23, 0x4e, 0x30, 0x23, 0x70, 0x72, 0x33, 0x34, 0x60, 0x2a, 0x4a, 0x32, 0x6e, 0x29, 0x54, 0x73, 0x5f, 0x26, 0x71, 0x3a, 0x78, 0x5d, 0x3f, 0x31, 0x48, 0x59, 0x61, 0x44, 0x5c, 0x38, 0x4f, 0x41, 0x73, 0x67, 0x62, 0x73, 0x33, 0x52, 0x77, 0x73, 0x57, 0x49, 0x7a, 0x59, 0x26, 0x21, 0x34, 0x38, 0x2b, 0x5f, 0x5f, 0x37, 0x74, 0x28, 0x46, 0x3d, 0x43, 0x42, 0x26, 0x66, 0x63, 0x37, 0x6d, 0x2a, 0x65, 0x3f, 0x71, 0x2d, 0x4c, 0x72, 0x29, 0x4b, 0x3a, 0x77, 0x64, 0x6a, 0x6b, 0x42, 0x70, 0x5c, 0x51, 0x38, 0x71, 0x25, 0x4c, 0x7c, 0x6f, 0x74, 0x71, 0x39, 0x71, 0x25, 0x3f, 0x62, 0x23, 0x45, 0x5f, 0x77, 0x59, 0x56, 0x56, 0x67, 0x78, 0x3a, 0x2e, 0x4e, 0x27, 0x59, 0x65, 0x2f, 0x64, 0x3c, 0x62, 0x40, 0x69, 0x52, 0x36, 0x49, 0x3e, 0x3b, 0x2c, 0x47, 0x4f, 0x3e, 0x61, 0x78, 0x2d, 0x45, 0x71, 0x3f, 0x7b, 0x55, 0x34, 0x36, 0x47, 0x5e, 0x36, 0x51, 0x3d, 0x5a, 0x4b, 0x75, 0x44, 0x72, 0x61, 0x44, 0x71, 0x4e, 0x42, 0x6a, 0x2c, 0x34, 0x40, 0x3b, 0x40, 0x31, 0x31, 0x75, 0x4b, 0x32, 0x71, 0x69, 0x3a, 0x5d, 0x31, 0x25, 0x53, 0x2a, 0x61, 0x54, 0x68, 0x2a, 0x76, 0x71, 0x57, 0x67, 0x56, 0x23, 0x7d, 0x70, 0x7d, 0x28, 0x57, 0x5f, 0x2f, 0x4c, 0x71, 0x2e, 0x40, 0x63, 0x49, 0x5b, 0x7c, 0x7b, 0x56, 0x76, 0x77, 0x46, 0x69, 0x56, 0x3d, 0x75, 0x31, 0x3b, 0x35, 0x40, 0x37, 0x2c, 0x51, 0x37, 0x49, 0x6a, 0x79, 0x68, 0x53, 0x31, 0x4c, 0x6f, 0x57, 0x4c, 0x48, 0x31, 0x6a, 0x30, 0x2b, 0x69, 0x30, 0x56, 0x58, 0x4b, 0x76, 0x3b, 0x60, 0x6d, 0x35, 0x4d, 0x74, 0x2f, 0x74, 0x2c, 0x54, 0x4f, 0x6e, 0x3f, 0x38, 0x56, 0x5c, 0x67, 0x2b, 0x4a, 0x35, 0x30, 0x67, 0x7d, 0x58, 0x24, 0x59, 0x54, 0x48, 0x2e, 0x28, 0x7d, 0x6e, 0x51, 0x55, 0x68, 0x56, 0x54, 0x59, 0x31, 0x4a, 0x65, 0x5a, 0x5e, 0x27, 0x76, 0x76, 0x65, 0x6d, 0x2f, 0x75, 0x63, 0x67, 0x52, 0x5e, 0x29, 0x58, 0x3d, 0x5c, 0x3f, 0x54, 0x7c, 0x67, 0x21, 0x6e, 0x75, 0x67, 0x35, 0x77, 0x31, 0x3d, 0x26, 0x3f, 0x60, 0x45, 0x2d, 0x2b, 0x45, 0x5d, 0x3f, 0x55, 0x73, 0x59, 0x4c, 0x5e, 0x6c, 0x30, 0x4a, 0x4e, 0x47, 0x55, 0x42, 0x6a, 0x4b, 0x32, 0x3c, 0x75, 0x6e, 0x36, 0x51, 0x5f, 0x4c, 0x68, 0x72, 0x72, 0x27, 0x3b, 0x51, 0x59, 0x7b, 0x68, 0x7b, 0x3b, 0x54, 0x35, 0x37, 0x7c, 0x44, 0x43, 0x36, 0x4c, 0x4f, 0x67, 0x62, 0x4e, 0x39, 0x4b, 0x7a, 0x49, 0x36, 0x68, 0x38, 0x4c, 0x4a, 0x64, 0x33, 0x35, 0x2f, 0x3e, 0x5c, 0x58, 0x61, 0x23, 0x5b, 0x50, 0x6e, 0x34, 0x44, 0x60, 0x28, 0x54, 0x41, 0x5c, 0x31, 0x53, 0x2d, 0x58, 0x58, 0x54, 0x28, 0x77, 0x51, 0x6f, 0x64, 0x4c, 0x68, 0x34, 0x79, 0x45, 0x66, 0x2c, 0x26, 0x77, 0x64, 0x5f, 0x6c, 0x3b, 0x71, 0x28, 0x4d, 0x68, 0x2a, 0x6b, 0x37, 0x6a, 0x34, 0x51, 0x27, 0x2a, 0x46, 0x3a, 0x2e, 0x35, 0x21, 0x21, 0x79, 0x51, 0x44, 0x58, 0x5d, 0x6f, 0x65, 0x6b, 0x76, 0x68, 0x3a, 0x43, 0x70, 0x36, 0x41, 0x6b, 0x56, 0x64, 0x75, 0x5b, 0x37, 0x24, 0x56, 0x7c, 0x6e, 0x6c, 0x41, 0x3a, 0x60, 0x56, 0x38, 0x55, 0x63, 0x77, 0x4d, 0x6e, 0x50, 0x3c, 0x3d, 0x7a, 0x44, 0x71, 0x42, 0x4b, 0x55, 0x75, 0x72, 0x61, 0x60, 0x65, 0x6f, 0x7a, 0x26, 0x64, 0x46, 0x67, 0x74, 0x29, 0x2a, 0x5b, 0x62, 0x41, 0x28, 0x62, 0x30, 0x34, 0x33, 0x40, 0x79, 0x7a, 0x38, 0x56, 0x38, 0x73, 0x22, 0x7a, 0x7d, 0x73, 0x2a, 0x2a, 0x28, 0x2b, 0x63, 0x27, 0x6f, 0x3d, 0x3e, 0x2c, 0x56, 0x23, 0x32, 0x4b, 0x3b, 0x58, 0x4d, 0x72, 0x4c, 0x49, 0x6f, 0x30, 0x76, 0x23, 0x21, 0x21, 0x3c, 0x49, 0x56, 0x7a, 0x56, 0x79, 0x2f, 0x50, 0x7a, 0x5b, 0x21, 0x21, 0x4a, 0x48, 0x61, 0x33, 0x52, 0x49, 0x2e, 0x30, 0x7d, 0x2c, 0x2d, 0x67, 0x23, 0x55, 0x62, 0x66, 0x52, 0x5a, 0x61, 0x75, 0x63, 0x3c, 0x39, 0x69, 0x41, 0x31, 0x6b, 0x4e, 0x6f, 0x25, 0x34, 0x74, 0x30, 0x21, 0x3a, 0x40, 0x72, 0x44, 0x40, 0x60, 0x4c, 0x53, 0x74, 0x42, 0x64, 0x44, 0x49, 0x76, 0x67, 0x21, 0x79, 0x36, 0x3c, 0x37, 0x70, 0x4f, 0x58, 0x29, 0x71, 0x2a, 0x3a, 0x4d, 0x5d, 0x67, 0x68, 0x52, 0x63, 0x23, 0x24, 0x4b, 0x21, 0x3f, 0x68, 0x69, 0x6c, 0x66, 0x66, 0x42, 0x28, 0x59, 0x35, 0x34, 0x6f, 0x2d, 0x6a, 0x25, 0x66, 0x34, 0x54, 0x5d, 0x50, 0x26, 0x41, 0x22, 0x4f, 0x34, 0x79, 0x3c, 0x50, 0x68, 0x2d, 0x5f, 0x7b, 0x63, 0x7d, 0x58, 0x2e, 0x73, 0x46, 0x2f, 0x54, 0x61, 0x27, 0x74, 0x45, 0x23, 0x72, 0x31, 0x7d, 0x63, 0x4b, 0x43, 0x5e, 0x44, 0x54, 0x2c, 0x38, 0x58, 0x24, 0x75, 0x6c, 0x50, 0x3c, 0x23, 0x5f, 0x35, 0x57, 0x4f, 0x7b, 0x2f, 0x57, 0x29, 0x73, 0x58, 0x2a, 0x66, 0x3e, 0x49, 0x42, 0x5a, 0x6b, 0x75, 0x6a, 0x38, 0x3f, 0x73, 0x44, 0x42, 0x46, 0x2d, 0x39, 0x66, 0x5b, 0x28, 0x3e, 0x63, 0x62, 0x53, 0x75, 0x65, 0x64, 0x79, 0x32, 0x35, 0x71, 0x22, 0x6a, 0x7b, 0x41, 0x2b, 0x26, 0x43, 0x79, 0x58, 0x6f, 0x71, 0x25, 0x24, 0x34, 0x72, 0x5b, 0x4a, 0x2c, 0x5c, 0x77, 0x23, 0x42, 0x27, 0x6a, 0x67, 0x51, 0x5f, 0x3c, 0x75, 0x2c, 0x3f, 0x43, 0x45, 0x5b, 0x48, 0x65, 0x6f, 0x6c, 0x27, 0x65, 0x21, 0x3e, 0x33, 0x37, 0x5f, 0x2b, 0x2e, 0x24, 0x22, 0x47, 0x4e, 0x33, 0x5b, 0x7b, 0x21, 0x3c, 0x53, 0x69, 0x2e, 0x31, 0x3d, 0x48, 0x57, 0x3a, 0x56, 0x48, 0x6b, 0x47, 0x5d, 0x33, 0x41, 0x6c, 0x66, 0x4c, 0x61, 0x67, 0x32, 0x69, 0x53, 0x2c, 0x2f, 0x3e, 0x36, 0x68, 0x37, 0x28, 0x40, 0x21, 0x76, 0x27, 0x44, 0x26, 0x24, 0x6a, 0x30, 0x75, 0x2a, 0x73, 0x48, 0x36, 0x52, 0x4a, 0x3b, 0x51, 0x4e, 0x2f, 0x23, 0x36, 0x4b, 0x49, 0x33, 0x5a, 0x70, 0x2c, 0x54, 0x5b, 0x67, 0x48, 0x53, 0x5d, 0x21, 0x3e, 0x6b, 0x52, 0x6a, 0x3c, 0x48, 0x29, 0x68, 0x27, 0x32, 0x75, 0x61, 0x7c, 0x51, 0x2e, 0x7b, 0x49, 0x2f, 0x5b, 0x3d, 0x74, 0x5a, 0x28, 0x26, 0x29, 0x2c, 0x30, 0x54, 0x74, 0x45, 0x55, 0x4a, 0x3d, 0x39, 0x35, 0x66, 0x56, 0x28, 0x6d, 0x6e, 0x38, 0x7b, 0x2b, 0x40, 0x31, 0x56, 0x61, 0x74, 0x2b, 0x79, 0x5f, 0x63, 0x51, 0x53, 0x52, 0x7d, 0x73, 0x4e, 0x2e, 0x45, 0x3b, 0x22, 0x28, 0x6c, 0x2b, 0x47, 0x21, 0x50, 0x2a, 0x7c, 0x45, 0x48, 0x57, 0x3e, 0x2f, 0x6d, 0x66, 0x6c, 0x51, 0x23, 0x6c, 0x37, 0x4d, 0x4b, 0x4b, 0x66, 0x55, 0x69, 0x2e, 0x4a, 0x69, 0x71, 0x7c, 0x71, 0x30, 0x5c, 0x43, 0x46, 0x63, 0x5a, 0x23, 0x75, 0x40 }; uint32_t request6_len = sizeof(request6); uint8_t request7[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5d, 0x32, 0x55, 0x71, 0x51, 0x45, 0x4e, 0x54, 0x34, 0x21, 0x46, 0x77, 0x5e, 0x5b, 0x75, 0x62, 0x2b, 0x5c, 0x34, 0x26, 0x72, 0x2b, 0x2c, 0x64, 0x4b, 0x65, 0x56, 0x72, 0x31, 0x7d, 0x6a, 0x5f, 0x70, 0x26, 0x32, 0x29, 0x7d, 0x21, 0x5b, 0x3e, 0x5e, 0x53, 0x3d, 0x48, 0x5e, 0x2a, 0x4c, 0x37, 0x3d, 0x59, 0x79, 0x21, 0x4f, 0x56, 0x79, 0x2a, 0x4e, 0x28, 0x61, 0x7d, 0x2c, 0x58, 0x2f, 0x78, 0x5c, 0x3f, 0x5c, 0x42, 0x6d, 0x2f, 0x71, 0x54, 0x25, 0x31, 0x73, 0x38, 0x6c, 0x31, 0x5a, 0x2e, 0x42, 0x5b, 0x2d, 0x41, 0x24, 0x4c, 0x37, 0x40, 0x39, 0x7d, 0x2a, 0x67, 0x60, 0x6a, 0x7a, 0x62, 0x24, 0x4e, 0x3f, 0x2e, 0x69, 0x35, 0x28, 0x65, 0x77, 0x53, 0x23, 0x44, 0x59, 0x71, 0x31, 0x5c, 0x40, 0x5d, 0x3a, 0x27, 0x46, 0x55, 0x30, 0x56, 0x21, 0x74, 0x3e, 0x73, 0x41, 0x22, 0x52, 0x68, 0x40, 0x6c, 0x37, 0x3e, 0x62, 0x5a, 0x2e, 0x21, 0x23, 0x33, 0x27, 0x73, 0x68, 0x26, 0x60, 0x67, 0x70, 0x58, 0x50, 0x42, 0x58, 0x27, 0x3a, 0x35, 0x6f, 0x51, 0x62, 0x78, 0x25, 0x2c, 0x7b, 0x66, 0x34, 0x6a, 0x5a, 0x39, 0x60, 0x70, 0x41, 0x2d, 0x65, 0x26, 0x5a, 0x67, 0x58, 0x2d, 0x3e, 0x56, 0x6d, 0x30, 0x4b, 0x4d, 0x5d, 0x45, 0x41, 0x3d, 0x6e, 0x27, 0x4e, 0x5a, 0x7d, 0x2e, 0x62, 0x4d, 0x42, 0x70, 0x31, 0x24, 0x73, 0x5c, 0x78, 0x77, 0x50, 0x73, 0x27, 0x48, 0x3d, 0x35, 0x2c, 0x4b, 0x40, 0x2d, 0x25, 0x77, 0x5d, 0x3d, 0x6b, 0x50, 0x6f, 0x57, 0x73, 0x2f, 0x4f, 0x6e, 0x4c, 0x6e, 0x56, 0x7b, 0x55, 0x3c, 0x6d, 0x60, 0x47, 0x53, 0x56, 0x39, 0x3b, 0x51, 0x61, 0x71, 0x75, 0x73, 0x6b, 0x70, 0x58, 0x5f, 0x2c, 0x27, 0x74, 0x49, 0x2c, 0x2b, 0x53, 0x2d, 0x5b, 0x79, 0x43, 0x34, 0x39, 0x5a, 0x38, 0x3e, 0x2d, 0x66, 0x70, 0x3d, 0x49, 0x51, 0x29, 0x4d, 0x5d, 0x4c, 0x57, 0x4a, 0x2f, 0x41, 0x69, 0x56, 0x57, 0x77, 0x49, 0x58, 0x75, 0x28, 0x29, 0x4a, 0x6d, 0x54, 0x4f, 0x4f, 0x3f, 0x58, 0x5f, 0x58, 0x6f, 0x39, 0x22, 0x4d, 0x5d, 0x31, 0x75, 0x43, 0x2f, 0x7d, 0x31, 0x3d, 0x4c, 0x4d, 0x76, 0x74, 0x4d, 0x57, 0x3b, 0x56, 0x57, 0x48, 0x2b, 0x5d, 0x32, 0x67, 0x51, 0x6e, 0x60, 0x39, 0x6f, 0x64, 0x38, 0x37, 0x52, 0x4b, 0x52, 0x42, 0x32, 0x4f, 0x24, 0x53, 0x31, 0x6e, 0x4a, 0x68, 0x2f, 0x28, 0x2e, 0x27, 0x49, 0x75, 0x77, 0x75, 0x26, 0x47, 0x7c, 0x5d, 0x72, 0x5a, 0x77, 0x50, 0x2e, 0x6c, 0x27, 0x68, 0x6b, 0x7b, 0x27, 0x63, 0x21, 0x3d, 0x30, 0x2d, 0x5c, 0x67, 0x4d, 0x41, 0x79, 0x47, 0x42, 0x50, 0x6d, 0x32, 0x74, 0x39, 0x62, 0x4d, 0x5f, 0x65, 0x78, 0x4f, 0x67, 0x3a, 0x60, 0x26, 0x45, 0x61, 0x7c, 0x61, 0x63, 0x40, 0x46, 0x79, 0x52, 0x47, 0x57, 0x49, 0x53, 0x4c, 0x48, 0x36, 0x67, 0x47, 0x5c, 0x71, 0x50, 0x4d, 0x4f, 0x58, 0x26, 0x40, 0x6d, 0x54, 0x55, 0x67, 0x66, 0x23, 0x70, 0x23, 0x68, 0x70, 0x4d, 0x2c, 0x7a, 0x3d, 0x60, 0x51, 0x35, 0x64, 0x56, 0x2f, 0x26, 0x6d, 0x72, 0x6a, 0x59, 0x34, 0x3a, 0x73, 0x4b, 0x27, 0x33, 0x61, 0x26, 0x45, 0x61, 0x28, 0x74, 0x22, 0x54, 0x50, 0x2e, 0x39, 0x6a, 0x2c, 0x27, 0x59, 0x26, 0x73, 0x44, 0x71, 0x67, 0x4c, 0x37, 0x74, 0x2c, 0x63, 0x52, 0x2a, 0x60, 0x4f, 0x7b, 0x32, 0x39, 0x21, 0x79, 0x54, 0x79, 0x6d, 0x28, 0x27, 0x3a, 0x6a, 0x7d, 0x40, 0x6a, 0x4f, 0x4b, 0x46, 0x61, 0x36, 0x6a, 0x22, 0x3f, 0x77, 0x2d, 0x6a, 0x3b, 0x73, 0x71, 0x72, 0x3c, 0x21, 0x2e, 0x3f, 0x33, 0x25, 0x76, 0x64, 0x64, 0x70, 0x43, 0x32, 0x44, 0x73, 0x61, 0x51, 0x3c, 0x3b, 0x45, 0x3a, 0x68, 0x46, 0x5b, 0x6e, 0x36, 0x47, 0x4d, 0x38, 0x26, 0x4f, 0x5c, 0x7d, 0x73, 0x29, 0x24, 0x78, 0x44, 0x75, 0x40, 0x42, 0x41, 0x2a, 0x73, 0x2b, 0x24, 0x38, 0x51, 0x67, 0x36, 0x67, 0x2f, 0x70, 0x58, 0x54, 0x6e, 0x5d, 0x3b, 0x41, 0x59, 0x76, 0x7d, 0x2d, 0x40, 0x70, 0x29, 0x4a, 0x4a, 0x31, 0x79, 0x2c, 0x4e, 0x22, 0x31, 0x59, 0x31, 0x3c, 0x2f, 0x21, 0x29, 0x3f, 0x65, 0x6c, 0x38, 0x55, 0x4f, 0x27, 0x66, 0x66, 0x34, 0x45, 0x49, 0x41, 0x56, 0x24, 0x2e, 0x40, 0x36, 0x23, 0x5a, 0x46, 0x40, 0x23, 0x7b, 0x2d, 0x69, 0x54, 0x6c, 0x51, 0x58, 0x73, 0x56, 0x60, 0x5f, 0x60, 0x63, 0x5f, 0x77, 0x6a, 0x4c, 0x2c, 0x35, 0x39, 0x60, 0x73, 0x63, 0x3e, 0x2d, 0x55, 0x5a, 0x26, 0x4b, 0x43, 0x3b, 0x56, 0x33, 0x58, 0x74, 0x51, 0x4f, 0x5c, 0x2a, 0x44, 0x78, 0x66, 0x78, 0x71, 0x40, 0x29, 0x5e, 0x26, 0x57, 0x51, 0x49, 0x30, 0x29, 0x73, 0x38, 0x56, 0x6c, 0x41, 0x78, 0x3d, 0x61, 0x3d, 0x2c, 0x33, 0x46, 0x57, 0x54, 0x63, 0x3e, 0x79, 0x55, 0x4a, 0x7d, 0x2e, 0x2a, 0x3c, 0x77, 0x47, 0x35, 0x29, 0x5a, 0x6d, 0x69, 0x48, 0x6b, 0x73, 0x7d, 0x4f, 0x5f, 0x6f, 0x3a, 0x7a, 0x4e, 0x54, 0x59, 0x38, 0x62, 0x44, 0x72, 0x51, 0x57, 0x6a, 0x74, 0x54, 0x4f, 0x77, 0x6b, 0x66, 0x4a, 0x6b, 0x39, 0x29, 0x69, 0x60, 0x71, 0x52, 0x6a, 0x32, 0x66, 0x6c, 0x25, 0x76, 0x27, 0x7a, 0x2c, 0x38, 0x72, 0x4e, 0x5f, 0x40, 0x26, 0x74, 0x6a, 0x5e, 0x42, 0x38, 0x78, 0x34, 0x4f, 0x4f, 0x35, 0x27, 0x39, 0x62, 0x52, 0x61, 0x37, 0x54, 0x47, 0x38, 0x70, 0x31, 0x7a, 0x66, 0x69, 0x72, 0x24, 0x52, 0x2a, 0x2a, 0x78, 0x72, 0x2b, 0x2e, 0x2a, 0x57, 0x4a, 0x21, 0x52, 0x3c, 0x2a, 0x2f, 0x24, 0x58, 0x34, 0x3c, 0x42, 0x5c, 0x5b, 0x78, 0x27, 0x55, 0x63, 0x58, 0x3e, 0x26, 0x50, 0x2c, 0x72, 0x60, 0x36, 0x6c, 0x46, 0x58, 0x63, 0x59, 0x23, 0x2a, 0x2d, 0x63, 0x6a, 0x68, 0x69, 0x74, 0x3f, 0x49, 0x4f, 0x48, 0x4a, 0x3b, 0x59, 0x56, 0x77, 0x43, 0x6d, 0x57, 0x28, 0x5f, 0x39, 0x73, 0x28, 0x74, 0x3c, 0x4f, 0x43, 0x48, 0x6a, 0x57, 0x5d, 0x41, 0x73, 0x3f, 0x41, 0x7c, 0x65, 0x5e, 0x2d, 0x38, 0x72, 0x3a, 0x53, 0x3e, 0x33, 0x47, 0x69, 0x6a, 0x6e, 0x78, 0x67, 0x5d, 0x35, 0x3b, 0x3f, 0x23, 0x7c, 0x71, 0x3d, 0x7c, 0x3a, 0x3c, 0x75, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x6a, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x80, 0x23, 0x00, 0xdf, 0xaf, 0xff, 0x33, 0x9b, 0x78, 0x70, 0x43, 0xc5, 0x0a, 0x4d, 0x98, 0x96, 0x02, 0x64, 0x92, 0xc1, 0xee, 0x70, 0x32 }; uint32_t request7_len = sizeof(request7); uint8_t request8[] = { 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x65, 0xc1, 0xef, 0x7b, 0xd6, 0xaa, 0xd6, 0x09, 0x21, 0xf6, 0xe7, 0xd1, 0x4c, 0xdf, 0x6a, 0x2d, 0x0a, 0xfb, 0x43, 0xea, 0xda, 0x07, 0x24, 0x84, 0x88, 0x52, 0x9e, 0xa8, 0xa1, 0x7f, 0x4b, 0x60, 0xec, 0x94, 0x57, 0x33, 0x06, 0x93, 0x92, 0x25, 0xd6, 0xac, 0xdc, 0x89, 0x68, 0x5e, 0xbb, 0x32, 0x2b, 0x17, 0x68, 0xf2, 0x06, 0xb7, 0x86, 0xac, 0x81, 0xfe, 0x52, 0x27, 0xf5, 0x80, 0x11, 0x0d, 0x4e, 0x2e, 0x1b, 0xa3, 0x44, 0x8a, 0x58, 0xed, 0xf3, 0x9c, 0xe9, 0x31, 0x01, 0x72, 0xa6, 0xab, 0xfa, 0xa8, 0x05, 0x00, 0x37, 0x60, 0x6b, 0x81, 0xef, 0xf4, 0x96, 0x9a, 0xf7, 0x67, 0x95, 0x27, 0x7a, 0x25, 0xef, 0x6f, 0x0e, 0xff, 0x2d, 0x15, 0x7f, 0x23, 0x1c, 0xa7, 0x56, 0x94, 0x4a, 0x18, 0x98, 0xc6, 0xd8, 0xd2, 0x29, 0x5b, 0x57, 0xb8, 0x5d, 0x3a, 0x93, 0x58, 0x45, 0x77, 0x36, 0xe3, 0xd1, 0x36, 0x87, 0xff, 0xe3, 0x94, 0x0f, 0x00, 0xe6, 0x7c, 0x1a, 0x92, 0xc1, 0x5f, 0x40, 0xc3, 0xa3, 0x25, 0xce, 0xd4, 0xaf, 0x39, 0xeb, 0x17, 0xcf, 0x22, 0x43, 0xd9, 0x0c, 0xce, 0x37, 0x86, 0x46, 0x54, 0xd6, 0xce, 0x00, 0x30, 0x36, 0xae, 0xf9, 0xb5, 0x2b, 0x11, 0xa0, 0xfe, 0xa3, 0x4b, 0x2e, 0x05, 0xbe, 0x54, 0xa9, 0xd8, 0xa5, 0x76, 0x83, 0x5b, 0x63, 0x01, 0x1c, 0xd4, 0x56, 0x72, 0xcd, 0xdc, 0x4a, 0x1d, 0x77, 0xda, 0x8a, 0x9e, 0xba, 0xcb, 0x6c, 0xe8, 0x19, 0x5d, 0x68, 0xef, 0x8e, 0xbc, 0x6a, 0x05, 0x53, 0x0b, 0xc7, 0xc5, 0x96, 0x84, 0x04, 0xd9, 0xda, 0x4c, 0x42, 0x31, 0xd9, 0xbd, 0x99, 0x06, 0xf7, 0xa3, 0x0a, 0x19, 0x49, 0x07, 0x77, 0xf0, 0xdb, 0x7c, 0x43, 0xfa, 0xb2, 0xad, 0xb0, 0xfa, 0x87, 0x52, 0xba, 0xc9, 0x94, 0x61, 0xdc, 0xcf, 0x16, 0xac, 0x0f, 0x4a, 0xa3, 0x6b, 0x5b, 0x6e, 0x27, 0x86, 0x1f, 0xfe, 0x4d, 0x28, 0x3a, 0xa5, 0x10, 0x54, 0x6d, 0xed, 0x53, 0xf9, 0x73, 0xc6, 0x6e, 0xa8, 0xc0, 0x97, 0xcf, 0x56, 0x3b, 0x61, 0xdf, 0xab, 0x83, 0x18, 0xe8, 0x09, 0xee, 0x6a, 0xb7, 0xf5, 0xc9, 0x62, 0x55, 0x2d, 0xc7, 0x0c, 0x0d, 0xa0, 0x22, 0xd8, 0xd4, 0xd6, 0xb2, 0x12, 0x21, 0xd7, 0x73, 0x3e, 0x41, 0xb0, 0x5c, 0xd4, 0xcf, 0x98, 0xf3, 0x70, 0xe6, 0x08, 0xe6, 0x2a, 0x4f, 0x24, 0x85, 0xe8, 0x74, 0xa8, 0x41, 0x5f, 0x0e, 0xfd, 0xf1, 0xf3, 0xbe, 0x9b, 0x14, 0xfd, 0xc0, 0x73, 0x11, 0xff, 0xa5, 0x5b, 0x06, 0x34, 0xc3, 0x6c, 0x28, 0x42, 0x07, 0xfe, 0x8a, 0xa5, 0xbe, 0x72, 0x7a, 0xf7, 0xfa, 0x25, 0xec, 0x35, 0x5e, 0x98, 0x71, 0x50, 0x60, 0x35, 0x76, 0x53, 0x40, 0x1a, 0x34, 0xa5, 0x99, 0x09, 0xa2, 0xc6, 0xca, 0xa5, 0xce, 0x08, 0x50, 0x45, 0xab, 0x8d, 0xfb, 0xe3, 0xb8, 0xe4, 0x8a, 0x61, 0x48, 0x14, 0x6e, 0xf7, 0x58, 0x71, 0xe5, 0x2e, 0xbc, 0x12, 0xd1, 0x25, 0xe9, 0x65, 0x7a, 0xa1, 0x27, 0xbe, 0x3b, 0x8b, 0xe8, 0xe7, 0xbc, 0xe1, 0x05, 0xe7, 0x92, 0xeb, 0xb9, 0xdf, 0x5d, 0x53, 0x74, 0xc0, 0x63, 0x97, 0x80, 0xb8, 0x3c, 0xae, 0xf3, 0xf2, 0x09, 0x12, 0x81, 0x6c, 0x69, 0x10, 0x6f, 0xf6, 0xbe, 0x03, 0x7b, 0x88, 0xcf, 0x26, 0x6b, 0x51, 0x06, 0x23, 0x68, 0x03, 0xa1, 0xb7, 0xd3, 0x0c, 0xca, 0xbf, 0x29, 0x01, 0xa9, 0x61, 0x34, 0x75, 0x98, 0x1e, 0x05, 0x59, 0xb3, 0x46, 0x44, 0xff, 0x2b, 0x98, 0x04, 0x88, 0x89, 0xfd, 0x7f, 0xd5, 0x19, 0x8a, 0xa6, 0xf3, 0xd9, 0x44, 0xd5, 0xf9, 0x3a, 0x3c, 0xec, 0xd9, 0x9b, 0x8c, 0x93, 0x93, 0x2b, 0x44, 0x86, 0x8b, 0x80, 0x83, 0x23, 0x00, 0xdf, 0xaf, 0xff, 0x33, 0x9b, 0x78, 0x70, 0x43, 0xf1, 0x55, 0x87, 0xb1, 0xa1, 0xb3, 0x8e, 0x79, 0x02, 0x70, 0x82, 0x6c, 0x0b, 0xc1, 0xef, 0x96, 0xf1, 0xef, 0xdd, 0xa2, 0x69, 0x86, 0xc7, 0x85, 0x09, 0x7e, 0xf0, 0x2f, 0x8e, 0xa0, 0x5f, 0xea, 0x39, 0x2e, 0x24, 0xf0, 0x82, 0x30, 0x26, 0xa8, 0xa1, 0x4f, 0xc6, 0x5c, 0xec, 0x94, 0x87, 0x52, 0x9b, 0x93, 0x92, 0xf3, 0xa3, 0x1b, 0xc7, 0x8f, 0x9e, 0xb3, 0xbb, 0x32, 0x2b, 0x17, 0x54, 0xf2, 0x06, 0x0c, 0x86, 0x92, 0x0f, 0xb8, 0xe0, 0x27, 0x50, 0xaa, 0xeb, 0xf5, 0x4e, 0x2b, 0x1b, 0xb2, 0x44, 0xe6, 0x58, 0x02, 0xd7, 0x65, 0xdc, 0x31, 0x01, 0xec, 0xa6, 0xab, 0xfa, 0xa8, 0x05, 0x00, 0x37, 0x60, 0x4f, 0xa1, 0x3c, 0x4f, 0x7a, 0x9a, 0x10, 0x67, 0x95, 0xc2, 0x5b, 0x25, 0xef, 0x76, 0x0e, 0xff, 0x2d, 0x15, 0x7f, 0x23, 0x1c, 0x77, 0x56, 0x94, 0x4a, 0x18, 0x98, 0xc6, 0xd8, 0xd2, 0x29, 0x44, 0x57, 0xb8, 0x40, 0x3a, 0x93, 0x58, 0x45, 0x77, 0x36, 0x36, 0x07, 0x35, 0x2a, 0xff, 0x00, 0x94, 0x5c, 0x80, 0xe6, 0x7c, 0x1a, 0x92, 0xc1, 0x5f, 0x40, 0xc3, 0xbc, 0xf8, 0xce, 0x05, 0x77, 0x39, 0x40, 0x17, 0xcf, 0x63, 0x43, 0x77, 0x27, 0xce, 0x37, 0x86, 0x46, 0x54, 0xd6, 0xce, 0x00, 0x30, 0x36, 0xae, 0x9f, 0x24, 0x2b, 0x5a, 0xa0, 0xfe, 0xa3, 0x4b, 0x2e, 0x7e, 0xf7, 0x54, 0xa9, 0xd8, 0xa5, 0x76, 0x83, 0x7b, 0x63, 0x01, 0x1c, 0xd4, 0x56, 0x17, 0x02, 0xdc, 0x4a, 0x89, 0x77, 0xda, 0x8f, 0x9e, 0xba, 0xcb, 0x37, 0xe8, 0x19, 0x5d, 0x68, 0x38, 0x8e, 0xbc, 0x6a, 0x05, 0x53, 0x0b, 0xc7, 0xc5, 0x96, 0x84, 0x5a, 0xd9, 0x6d, 0x4c, 0x42, 0x31, 0xd9, 0xf2, 0x99, 0x06, 0xf7, 0x0c, 0x99, 0xbe, 0x49, 0x07, 0x77, 0xf0, 0x8b, 0x7c, 0x43, 0xfa, 0xb2, 0xad, 0xb0, 0xfa, 0x87, 0x52, 0xba, 0xc9, 0x94, 0x61, 0xdc, 0xcf, 0x16, 0xac, 0x0f, 0x4a, 0xa3, 0x6b, 0x5b, 0x6e, 0x27, 0x86, 0x1f, 0xfe, 0x4d, 0x28, 0x3a, 0xa5, 0x10, 0x98, 0x6d, 0xed, 0x53, 0xf9, 0x73, 0xc6, 0xa5, 0xa8, 0xf7, 0x66, 0xcf, 0x56, 0x3b, 0x61, 0xdf, 0xab, 0x83, 0x18, 0xe8, 0x09, 0xee, 0x6a, 0xb7, 0xf5, 0xc9, 0x62, 0x55, 0x2d, 0xc7, 0x0c, 0x0d, 0xa0, 0x22, 0xd8, 0xd4, 0xd6, 0xb2, 0x12, 0x21, 0xd7, 0x73, 0x3e, 0x41, 0xb0, 0x5c, 0xd4, 0xcf, 0x98, 0xf3, 0x70, 0xe6, 0x08, 0xe6, 0x2a, 0x4f, 0x92, 0x85, 0xe8, 0x74, 0xa8, 0x41, 0x5f, 0x0e, 0xfd, 0xf1, 0xf3, 0xbe, 0x9b, 0x14, 0xfd, 0xc0, 0x73, 0x11, 0xff, 0xa5, 0x5b, 0x06, 0x34, 0xc3, 0x5d, 0x28, 0x42, 0x34, 0xfe, 0x8a, 0xa5, 0xbe, 0x72, 0x7a, 0xf7, 0xfa, 0x25, 0x2b, 0x35, 0x5e, 0x98, 0x71, 0x50, 0x2c, 0x35, 0x76, 0x53, 0x4e, 0x1a, 0x34, 0xa5, 0x99, 0x09, 0xa2, 0xc6, 0xca, 0xa5, 0xce, 0x08, 0x50, 0x45, 0xab, 0x8d, 0xfb, 0xe3, 0xb8, 0xe4, 0x8a, 0x61, 0x48, 0x14, 0x6e, 0xf7, 0x58, 0x71, 0xe5, 0x2e, 0xbc, 0x12, 0xd1, 0x25, 0xe9, 0x65, 0x7a, 0xa1, 0x27, 0xbe, 0x3b, 0x8b, 0xe8, 0xe7, 0xbc, 0x77, 0x05, 0xe7, 0x92, 0xeb, 0xb9, 0xdf, 0x5d, 0x53, 0x74, 0xc0, 0x63, 0x97, 0x80, 0xb8, 0x3c, 0xae, 0xf3, 0xf2, 0x09, 0x12, 0x81, 0x6c, 0x69, 0x10, 0x6f, 0xf6, 0xbe, 0x03, 0x7b, 0x88, 0xcf, 0x26, 0x6b, 0x51, 0x06, 0x23, 0x68, 0x03, 0xa1, 0xb7, 0xd3, 0x0c, 0xca, 0xbf, 0x29, 0x01, 0xa9, 0x61, 0x34, 0x75, 0x98, 0x1e, 0x6f, 0x59, 0xb3, 0x46, 0x44, 0xff, 0x2b, 0x98, 0x04, 0x88, 0x89, 0xfd, 0x1c, 0xd5, 0x19, 0x8a, 0xa6, 0xf3, 0xd9, 0x44, 0xd5, 0xf9, 0x79, 0x26, 0x46, 0xf7 }; uint32_t request8_len = sizeof(request8); uint8_t request9[] = { 0x05, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xbf, 0xa1, 0x12, 0x73, 0x23, 0x44, 0x86, 0x8b, 0x50, 0x6a, 0x40, 0x00 }; uint32_t request9_len = sizeof(request9); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); /* bind */ int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER|STREAM_START, bind, bind_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 0) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; /* bind_ack */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 0) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; /* request1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 1024 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 2048 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 3072 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request4 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request4, request4_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 4096 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request5 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request5, request5_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 5120) && dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL); if (result == 0) goto end; /* request6 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request6, request6_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 6144 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request7 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request7, request7_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 7168 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request8 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request8, request8_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 8192 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request9 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request9, request9_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 8204 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh = 0; /* request1 again */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } result &= ( (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 1024 && dcerpc_state->dcerpc.dcerpcrequest.stub_data_fresh == 1) && (dcerpc_state->dcerpc.dcerpcresponse.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcresponse.stub_data_fresh == 0) ); if (result == 0) goto end; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); return result; #endif return 1; } /** * \test General test. */ int DCERPCParserTest05(void) { int result = 1; Flow f; int r = 0; uint8_t bind1[] = { 0x05, 0x00, 0x0b, 0x01, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11, 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind1_len = sizeof(bind1); uint8_t bind2[] = { 0x05, 0x00, 0x0b, 0x02, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11, 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x67, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind2_len = sizeof(bind2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, bind1, bind1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } DCERPCUuidEntry *item = NULL; int m = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { printf("%d ", m); printUUID("BIND",item); m++; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind2, bind2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); item = NULL; m = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { printf("%d ", m); printUUID("BIND",item); m++; } /* we will need this test later for fragged bind pdus. keep it */ result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented bind PDU(one PDU which is frag'ed) */ int DCERPCParserTest06(void) { int result = 1; Flow f; int r = 0; uint8_t bind1[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0xdc, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xc7, 0x70, 0x0d, 0x3e, 0x71, 0x37, 0x39, 0x0d, 0x3a, 0x4f, 0xd3, 0xdc, 0xca, 0x49, 0xe8, 0xa3, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x84, 0xb6, 0x55, 0x75, 0xdb, 0x9e, 0xba, 0x54, 0x56, 0xd3, 0x45, 0x10, 0xb7, 0x7a, 0x2a, 0xe2, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x6e, 0x39, 0x21, 0x24, 0x70, 0x6f, 0x41, 0x57, 0x54, 0x70, 0xb8, 0xc3, 0x5e, 0x89, 0x3b, 0x43, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0x39, 0x6a, 0x86, 0x5d, 0x24, 0x0f, 0xd2, 0xf7, 0xb6, 0xce, 0x95, 0x9c, 0x54, 0x1d, 0x3a, 0xdb, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x12, 0xa5, 0xdd, 0xc5, 0x55, 0xce, 0xc3, 0x46, 0xbd, 0xa0, 0x94, 0x39, 0x3c, 0x0d, 0x9b, 0x5b, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x87, 0x1c, 0x8b, 0x6e, 0x11, 0xa8, 0x67, 0x98, 0xd4, 0x5d, 0xf6, 0x8a, 0x2f, 0x33, 0x24, 0x7b, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x9b, 0x82, 0x13, 0xd1, 0x28, 0xe0, 0x63, 0xf3, 0x62, 0xee, 0x76, 0x73, 0xf9, 0xac, 0x3d, 0x2e, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0xa9, 0xd4, 0x73, 0xf2, 0xed, 0xad, 0xe8, 0x82, 0xf8, 0xcf, 0x9d, 0x9f, 0x66, 0xe6, 0x43, 0x37, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x06, 0x2b, 0x85, 0x38, 0x4f, 0x73, 0x96, 0xb1, 0x73, 0xe1, 0x59, 0xbe, 0x9d, 0xe2, 0x6c, 0x07, 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60}; uint32_t bind1_len = sizeof(bind1); uint8_t bind2[] = { 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0xbf, 0xfa, 0xbb, 0xa4, 0x9e, 0x5c, 0x80, 0x61, 0xb5, 0x8b, 0x79, 0x69, 0xa6, 0x32, 0x88, 0x77, 0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x39, 0xa8, 0x2c, 0x39, 0x73, 0x50, 0x06, 0x8d, 0xf2, 0x37, 0x1e, 0x1e, 0xa8, 0x8f, 0x46, 0x98, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x91, 0x13, 0xd0, 0xa7, 0xef, 0xc4, 0xa7, 0x96, 0x0c, 0x4a, 0x0d, 0x29, 0x80, 0xd3, 0xfe, 0xbf, 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xcc, 0x2b, 0x55, 0x1d, 0xd4, 0xa4, 0x0d, 0xfb, 0xcb, 0x6f, 0x86, 0x36, 0xa6, 0x57, 0xc3, 0x21, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00, 0x43, 0x7b, 0x07, 0xee, 0x85, 0xa8, 0xb9, 0x3a, 0x0f, 0xf9, 0x83, 0x70, 0xe6, 0x0b, 0x4f, 0x33, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x9c, 0x6a, 0x15, 0x8c, 0xd6, 0x9c, 0xa6, 0xc3, 0xb2, 0x9e, 0x62, 0x9f, 0x3d, 0x8e, 0x47, 0x73, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind2_len = sizeof(bind2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, bind1, bind1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 420); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 40); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 8); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind2, bind2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.ctxbytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 16); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitemsleft == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). */ int DCERPCParserTest07(void) { int result = 1; Flow f; int r = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x0D, 0x0E }; uint32_t request2_len = sizeof(request2); uint8_t request3[] = { 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14 }; uint32_t request3_len = sizeof(request3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 36); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); result &= (dcerpc_state->dcerpc.pdu_fragged = 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 38); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); result &= (dcerpc_state->dcerpc.pdu_fragged = 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 20); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). */ int DCERPCParserTest08(void) { int result = 1; Flow f; int r = 0; uint8_t request[] = { 0x05, 0x02, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, }; uint32_t request_len = sizeof(request); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, request, request_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 0); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented bind PDU(one PDU which is frag'ed). */ int DCERPCParserTest09(void) { int result = 1; Flow f; int r = 0; uint8_t request[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, }; uint32_t request_len = sizeof(request); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, request, request_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 36); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); result &= (dcerpc_state->dcerpc.pdu_fragged == 1); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented PDU. */ int DCERPCParserTest10(void) { int result = 1; Flow f; int r = 0; uint8_t fault[] = { 0x05, 0x00, 0x03, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0xf7, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; uint32_t fault_len = sizeof(fault); uint8_t request1[] = { 0x05, 0x00 }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C }; uint32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, fault, fault_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 2); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL); result &= (dcerpc_state->dcerpc.pdu_fragged == 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented PDU. */ int DCERPCParserTest11(void) { int result = 1; Flow f; int r = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x05, 0x00 }; uint32_t request2_len = sizeof(request2); uint8_t request3[] = { 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0xFF, 0xFF }; uint32_t request3_len = sizeof(request3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 12); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 2); result &= (dcerpc_state->dcerpc.pdu_fragged == 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented PDU. */ int DCERPCParserTest12(void) { int result = 1; Flow f; int r = 0; uint8_t bind_ack1[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x48, 0x1a, 0x00, 0x00, }; uint32_t bind_ack1_len = sizeof(bind_ack1); uint8_t bind_ack2[] = { 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack2_len = sizeof(bind_ack2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack1, bind_ack1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 24); result &= (dcerpc_state->dcerpc.pdu_fragged == 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack2, bind_ack2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Check if the parser accepts bind pdus that have context ids starting * from a non-zero value. */ int DCERPCParserTest13(void) { int result = 1; Flow f; int r = 0; uint8_t bindbuf[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bindbuf_len = sizeof(bindbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bindbuf, bindbuf_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); result &= (dcerpc_state->dcerpc.dcerpcbindbindack.numctxitems == 1); if (result == 0) goto end; result = 0; uint8_t ctx_uuid_from_pcap[16] = { 0x00, 0x00, 0x01, 0xa0, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46}; DCERPCUuidEntry *item = NULL; int internal_id = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (ctx_uuid_from_pcap[i] != item->uuid[i]) { result = 0; goto end; } } result = 1; result &= (item->internal_id == internal_id++); } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Check for another endless loop with bind pdus. */ int DCERPCParserTest14(void) { int result = 1; Flow f; int r = 0; uint8_t bindbuf[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xa0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0xFF /* ka boom - endless loop */ }; uint32_t bindbuf_len = sizeof(bindbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bindbuf, bindbuf_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Check for another endless loop for bind_ack pdus. */ int DCERPCParserTest15(void) { int result = 1; Flow f; int r = 0; uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x00, 0x00, 0x7f, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0xfd, 0x04, 0x01, 0x00, 0x04, 0x00, 0x31, 0x33, 0x35, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x01, 0x02, 0x03, 0x04, 0xFF }; uint32_t bind_ack_len = sizeof(bind_ack); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Check for correct internal ids for bind_acks. */ int DCERPCParserTest16(void) { int result = 1; Flow f; int r = 0; uint8_t bind1[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x58, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x50, 0x08, 0x43, 0x95, 0x43, 0x5a, 0x8b, 0xb2, 0xf4, 0xc5, 0xb9, 0xee, 0x67, 0x55, 0x7c, 0x19, 0x00, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xda, 0xc2, 0xbc, 0x9b, 0x35, 0x2e, 0xd4, 0xc9, 0x1f, 0x85, 0x01, 0xe6, 0x4e, 0x5a, 0x5e, 0xd4, 0x04, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xb2, 0x97, 0xcc, 0x14, 0x6f, 0x70, 0x0d, 0xa5, 0x33, 0xd7, 0xf4, 0xe3, 0x8e, 0xb2, 0x2a, 0x1e, 0x05, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0x96, 0x4e, 0xa6, 0xf6, 0xb2, 0x4b, 0xae, 0xb3, 0x21, 0xf4, 0x97, 0x7c, 0xcd, 0xa7, 0x08, 0xb0, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0xbc, 0xc0, 0xf7, 0x71, 0x3f, 0x71, 0x54, 0x44, 0x22, 0xa8, 0x55, 0x0f, 0x98, 0x83, 0x1f, 0xfe, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0xbe, 0x52, 0xf2, 0x58, 0x4a, 0xc3, 0xb5, 0xd0, 0xba, 0xac, 0xda, 0xf0, 0x12, 0x99, 0x38, 0x6e, 0x04, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0xdb, 0xfa, 0x73, 0x01, 0xb3, 0x81, 0x01, 0xd4, 0x7f, 0xa0, 0x36, 0xb1, 0x97, 0xae, 0x29, 0x7f, 0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0x89, 0xbe, 0x41, 0x1d, 0x38, 0x75, 0xf5, 0xb5, 0xad, 0x27, 0x73, 0xf1, 0xb0, 0x7a, 0x28, 0x82, 0x05, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xf6, 0x87, 0x09, 0x93, 0xb8, 0xa8, 0x20, 0xc4, 0xb8, 0x63, 0xe6, 0x95, 0xed, 0x59, 0xee, 0x3f, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0x92, 0x77, 0x92, 0x68, 0x3e, 0xa4, 0xbc, 0x3f, 0x44, 0x33, 0x0e, 0xb8, 0x33, 0x0a, 0x2f, 0xdf, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0xa1, 0x03, 0xd2, 0xa9, 0xd2, 0x16, 0xc9, 0x89, 0x67, 0x18, 0x3e, 0xb1, 0xee, 0x6b, 0xf9, 0x18, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x2f, 0x09, 0x5e, 0x74, 0xec, 0xa0, 0xbb, 0xc1, 0x60, 0x18, 0xf1, 0x93, 0x04, 0x17, 0x11, 0xf9, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind1_len = sizeof(bind1); uint8_t bind_ack1[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0xc1, 0x2b, 0x00, 0x00, 0x0e, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack1_len = sizeof(bind_ack1); uint8_t bind2[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0xdc, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xc7, 0x70, 0x0d, 0x3e, 0x71, 0x37, 0x39, 0x0d, 0x3a, 0x4f, 0xd3, 0xdc, 0xca, 0x49, 0xe8, 0xa3, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x84, 0xb6, 0x55, 0x75, 0xdb, 0x9e, 0xba, 0x54, 0x56, 0xd3, 0x45, 0x10, 0xb7, 0x7a, 0x2a, 0xe2, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x6e, 0x39, 0x21, 0x24, 0x70, 0x6f, 0x41, 0x57, 0x54, 0x70, 0xb8, 0xc3, 0x5e, 0x89, 0x3b, 0x43, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0x39, 0x6a, 0x86, 0x5d, 0x24, 0x0f, 0xd2, 0xf7, 0xb6, 0xce, 0x95, 0x9c, 0x54, 0x1d, 0x3a, 0xdb, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x12, 0xa5, 0xdd, 0xc5, 0x55, 0xce, 0xc3, 0x46, 0xbd, 0xa0, 0x94, 0x39, 0x3c, 0x0d, 0x9b, 0x5b, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x87, 0x1c, 0x8b, 0x6e, 0x11, 0xa8, 0x67, 0x98, 0xd4, 0x5d, 0xf6, 0x8a, 0x2f, 0x33, 0x24, 0x7b, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x9b, 0x82, 0x13, 0xd1, 0x28, 0xe0, 0x63, 0xf3, 0x62, 0xee, 0x76, 0x73, 0xf9, 0xac, 0x3d, 0x2e, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0xa9, 0xd4, 0x73, 0xf2, 0xed, 0xad, 0xe8, 0x82, 0xf8, 0xcf, 0x9d, 0x9f, 0x66, 0xe6, 0x43, 0x37, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x06, 0x2b, 0x85, 0x38, 0x4f, 0x73, 0x96, 0xb1, 0x73, 0xe1, 0x59, 0xbe, 0x9d, 0xe2, 0x6c, 0x07, 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0xbf, 0xfa, 0xbb, 0xa4, 0x9e, 0x5c, 0x80, 0x61, 0xb5, 0x8b, 0x79, 0x69, 0xa6, 0x32, 0x88, 0x77, 0x01, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x39, 0xa8, 0x2c, 0x39, 0x73, 0x50, 0x06, 0x8d, 0xf2, 0x37, 0x1e, 0x1e, 0xa8, 0x8f, 0x46, 0x98, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x91, 0x13, 0xd0, 0xa7, 0xef, 0xc4, 0xa7, 0x96, 0x0c, 0x4a, 0x0d, 0x29, 0x80, 0xd3, 0xfe, 0xbf, 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xcc, 0x2b, 0x55, 0x1d, 0xd4, 0xa4, 0x0d, 0xfb, 0xcb, 0x6f, 0x86, 0x36, 0xa6, 0x57, 0xc3, 0x21, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00, 0x43, 0x7b, 0x07, 0xee, 0x85, 0xa8, 0xb9, 0x3a, 0x0f, 0xf9, 0x83, 0x70, 0xe6, 0x0b, 0x4f, 0x33, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x9c, 0x6a, 0x15, 0x8c, 0xd6, 0x9c, 0xa6, 0xc3, 0xb2, 0x9e, 0x62, 0x9f, 0x3d, 0x8e, 0x47, 0x73, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind2_len = sizeof(bind2); uint8_t bind_ack2[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0xac, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0xc2, 0x2b, 0x00, 0x00, 0x0e, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack2_len = sizeof(bind_ack2); uint8_t bind3[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x2c, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xa4, 0x7f, 0x8e, 0xc6, 0xef, 0x56, 0x9b, 0x63, 0x92, 0xfa, 0x08, 0xb3, 0x35, 0xe2, 0xa5, 0x81, 0x00, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x9f, 0xfc, 0x78, 0xd2, 0x5f, 0x16, 0x0b, 0xbc, 0xc6, 0xdb, 0x5d, 0xef, 0xde, 0x54, 0xa2, 0x6f, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x78, 0xb8, 0x96, 0xc7, 0x2f, 0xda, 0x11, 0x6b, 0xd1, 0x28, 0x68, 0xe1, 0xd6, 0x71, 0xac, 0x9d, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xcf, 0xf4, 0xd7, 0x37, 0x03, 0xda, 0xcc, 0xe3, 0x3e, 0x34, 0x7f, 0x67, 0x99, 0x91, 0x41, 0x3d, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x48, 0xeb, 0x32, 0xf0, 0x27, 0xd5, 0x9d, 0xd0, 0x1e, 0xc6, 0x48, 0x46, 0x97, 0xe9, 0xdb, 0x09, 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x82, 0xec, 0x0d, 0x08, 0xf2, 0x8f, 0x22, 0x57, 0x42, 0x9b, 0xce, 0xa8, 0x74, 0x16, 0xc6, 0xec, 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x2e, 0x00, 0x70, 0x44, 0xee, 0xc9, 0x30, 0x6b, 0xf4, 0x34, 0x1e, 0x3d, 0x35, 0x0f, 0xf7, 0xf7, 0x00, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0x59, 0x04, 0x39, 0x3f, 0x59, 0x87, 0x14, 0x0e, 0x76, 0x8d, 0x17, 0xc2, 0x47, 0xfa, 0x67, 0x7f, 0x04, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x30, 0xd6, 0xed, 0x2e, 0x57, 0xfa, 0xf4, 0x72, 0x6c, 0x10, 0x0d, 0xe5, 0x51, 0x7f, 0xd0, 0x39, 0x02, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0xea, 0x8b, 0x84, 0x4d, 0x44, 0x43, 0xc1, 0x94, 0x75, 0xe2, 0x81, 0x48, 0xd8, 0x77, 0xd9, 0xce, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x89, 0x4f, 0xe7, 0x95, 0xa3, 0xc1, 0x62, 0x36, 0x26, 0x9e, 0x67, 0xdb, 0x2c, 0x52, 0x89, 0xd3, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x78, 0x56, 0x34, 0x12, 0x34, 0x12, 0xcd, 0xab, 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind3_len = sizeof(bind3); uint8_t bind_ack3[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x4c, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x1a, 0x33, 0x00, 0x00, 0x0e, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, 0x73, 0x70, 0x6f, 0x6f, 0x6c, 0x73, 0x73, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack3_len = sizeof(bind_ack3); TcpSession ssn; DCERPCUuidEntry *item = NULL; int count = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); uint8_t accepted_uuids[3][16] = { {0x4b, 0x32, 0x4f, 0xc8, 0x16, 0x70, 0x01, 0xd3, 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88}, {0x4b, 0x32, 0x4f, 0xc8, 0x16, 0x70, 0x01, 0xd3, 0x12, 0x78, 0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88}, {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0xab, 0xcd, 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab} }; uint16_t accepted_ctxids[3] = {12, 15, 11}; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind1, bind1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack1, bind_ack1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (accepted_uuids[0][i] != item->uuid[i]) { result = 0; goto end; } } if (accepted_ctxids[0] != item->ctxid) { result = 0; goto end; } count++; } if (count != 1) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind2, bind2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { count++; } if (count != 0) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack2, bind_ack2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (accepted_uuids[1][i] != item->uuid[i]) { result = 0; goto end; } } if (accepted_ctxids[1] != item->ctxid) { result = 0; goto end; } count++; } if (count != 1) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bind3, bind3_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { count++; } if (count != 0) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack3, bind_ack3_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (accepted_uuids[2][i] != item->uuid[i]) { result = 0; goto end; } } if (accepted_ctxids[2] != item->ctxid) { result = 0; goto end; } count++; } if (count != 1) { result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Check for correct internal ids for bind_acks + alter_contexts */ int DCERPCParserTest17(void) { int result = 1; Flow f; int r = 0; uint8_t bindbuf[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bindbuf_len = sizeof(bindbuf); uint8_t bind_ack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t bind_ack_len = sizeof(bind_ack); uint8_t alter_context[] = { 0x05, 0x00, 0x0e, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xd0, 0x4c, 0x67, 0x57, 0x00, 0x52, 0xce, 0x11, 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t alter_context_len = sizeof(alter_context); uint8_t alter_context_resp[] = { 0x05, 0x00, 0x0f, 0x03, 0x10, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t alter_context_resp_len = sizeof(alter_context_resp); TcpSession ssn; DCERPCUuidEntry *item = NULL; int count = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); uint8_t accepted_uuids[2][16] = { {0x57, 0x67, 0x4c, 0xd0, 0x52, 0x00, 0x11, 0xce, 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d}, {0x34, 0x2c, 0xfd, 0x40, 0x3c, 0x6c, 0x11, 0xce, 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d}, }; uint16_t accepted_ctxids[2] = {1, 0}; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, bindbuf, bindbuf_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, bind_ack, bind_ack_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (accepted_uuids[1][i] != item->uuid[i]) { result = 0; goto end; } } if (accepted_ctxids[1] != item->ctxid) { result = 0; goto end; } count++; } if (count != 1) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, alter_context, alter_context_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { count++; } if (count != 1) { result = 0; goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, alter_context_resp, alter_context_resp_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); count = 0; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { int i = 0; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (accepted_uuids[count][i] != item->uuid[i]) { result = 0; goto end; } } if (accepted_ctxids[count] != item->ctxid) { result = 0; goto end; } count++; } if (count != 2) { result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test DCERPC fragmented PDU. */ int DCERPCParserTest18(void) { int result = 1; Flow f; int r = 0; uint8_t request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, }; uint32_t request1_len = sizeof(request1); uint8_t request2[] = { 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0xFF, 0xFF }; uint32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); result = 0; goto end; } result &= (dcerpc_state->dcerpc.bytesprocessed == 18); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer == NULL); result &= (dcerpc_state->dcerpc.pdu_fragged == 1); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result &= (dcerpc_state->dcerpc.bytesprocessed == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer != NULL && dcerpc_state->dcerpc.dcerpcrequest.stub_data_buffer_len == 14); result &= (dcerpc_state->dcerpc.pdu_fragged == 0); result &= (dcerpc_state->dcerpc.dcerpcrequest.opnum == 2); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int DCERPCParserTest19(void) { int result = 0; Flow f; uint8_t dcerpcbind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x3c, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x2c, 0xd0, 0x28, 0xda, 0x76, 0x91, 0xf6, 0x6e, 0xcb, 0x0f, 0xbf, 0x85, 0xcd, 0x9b, 0xf6, 0x39, 0x01, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x2c, 0x75, 0xce, 0x7e, 0x82, 0x3b, 0x06, 0xac, 0x1b, 0xf0, 0xf5, 0xb7, 0xa7, 0xf7, 0x28, 0xaf, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0xe3, 0xb2, 0x10, 0xd1, 0xd0, 0x0c, 0xcc, 0x3d, 0x2f, 0x80, 0x20, 0x7c, 0xef, 0xe7, 0x09, 0xe0, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xde, 0x85, 0x70, 0xc4, 0x02, 0x7c, 0x60, 0x23, 0x67, 0x0c, 0x22, 0xbf, 0x18, 0x36, 0x79, 0x17, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x01, 0x00, 0x41, 0x65, 0x29, 0x51, 0xaa, 0xe7, 0x7b, 0xa8, 0xf2, 0x37, 0x0b, 0xd0, 0x3f, 0xb3, 0x36, 0xed, 0x05, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x14, 0x96, 0x80, 0x01, 0x2e, 0x78, 0xfb, 0x5d, 0xb4, 0x3c, 0x14, 0xb3, 0x3d, 0xaa, 0x02, 0xfb, 0x06, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x3b, 0x04, 0x68, 0x3e, 0x63, 0xfe, 0x9f, 0xd8, 0x64, 0x55, 0xcd, 0xe7, 0x39, 0xaf, 0x98, 0x9f, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x07, 0x00, 0x01, 0x00, 0x16, 0x7a, 0x4f, 0x1b, 0xdb, 0x25, 0x92, 0x55, 0xdd, 0xae, 0x9e, 0x5b, 0x3e, 0x93, 0x66, 0x93, 0x04, 0x00, 0x01, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xe8, 0xa4, 0x8a, 0xcf, 0x95, 0x6c, 0xc7, 0x8f, 0x14, 0xcc, 0x56, 0xfc, 0x7b, 0x5f, 0x4f, 0xe8, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0xd8, 0xda, 0xfb, 0xbc, 0xa2, 0x55, 0x6f, 0x5d, 0xc0, 0x2d, 0x88, 0x6f, 0x00, 0x17, 0x52, 0x8d, 0x06, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x3f, 0x17, 0x55, 0x0c, 0xf4, 0x23, 0x3c, 0xca, 0xe6, 0xa0, 0xaa, 0xcc, 0xb5, 0xe3, 0xf9, 0xce, 0x04, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0xc9, 0x9f, 0x3e, 0x6e, 0x82, 0x0a, 0x2b, 0x28, 0x37, 0x78, 0xe1, 0x13, 0x70, 0x05, 0x38, 0x4d, 0x01, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x00, 0x11, 0xaa, 0x4b, 0x15, 0xdf, 0xa6, 0x86, 0x3f, 0xfb, 0xe0, 0x09, 0xb7, 0xf8, 0x56, 0xd2, 0x3f, 0x05, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x01, 0x00, 0xee, 0x99, 0xc4, 0x25, 0x11, 0xe4, 0x95, 0x62, 0x29, 0xfa, 0xfd, 0x26, 0x57, 0x02, 0xf1, 0xce, 0x03, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, 0xba, 0x81, 0x9e, 0x1a, 0xdf, 0x2b, 0xba, 0xe4, 0xd3, 0x17, 0x41, 0x60, 0x6d, 0x2d, 0x9e, 0x28, 0x03, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0xa0, 0x24, 0x03, 0x9a, 0xa9, 0x99, 0xfb, 0xbe, 0x49, 0x11, 0xad, 0x77, 0x30, 0xaa, 0xbc, 0xb6, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x11, 0x00, 0x01, 0x00, 0x32, 0x04, 0x7e, 0xae, 0xec, 0x28, 0xd1, 0x55, 0x83, 0x4e, 0xc3, 0x47, 0x5d, 0x1d, 0xc6, 0x65, 0x02, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x12, 0x00, 0x01, 0x00, 0xc6, 0xa4, 0x81, 0x48, 0x66, 0x2a, 0x74, 0x7d, 0x56, 0x6e, 0xc5, 0x1d, 0x19, 0xf2, 0xb5, 0xb6, 0x03, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x13, 0x00, 0x01, 0x00, 0xcb, 0xae, 0xb3, 0xc0, 0x0c, 0xf4, 0xa4, 0x5e, 0x91, 0x72, 0xdd, 0x53, 0x24, 0x70, 0x89, 0x02, 0x05, 0x00, 0x03, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0xb8, 0xd0, 0xa0, 0x1a, 0x5e, 0x7a, 0x2d, 0xfe, 0x35, 0xc6, 0x7d, 0x08, 0x0d, 0x33, 0x73, 0x18, 0x02, 0x00, 0x02, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, }; uint8_t dcerpcbindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x6c, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0xce, 0x47, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0xf6, 0x6e, 0x18, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; uint32_t bindlen = sizeof(dcerpcbind); uint32_t bindacklen = sizeof(dcerpcbindack); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpcbind, bindlen); if (r != 0) { printf("dcerpc header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); DCERPCState *dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.bytesprocessed == 0) { printf("request - dce parser bytesprocessed should not be 0.\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpcbindack, bindacklen); if (r == 0) { printf("dce parser didn't return fail\n"); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif /* UNITTESTS */ void DCERPCParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DCERPCParserTest01", DCERPCParserTest01); UtRegisterTest("DCERPCParserTest02", DCERPCParserTest02); UtRegisterTest("DCERPCParserTest03", DCERPCParserTest03); UtRegisterTest("DCERPCParserTest04", DCERPCParserTest04); UtRegisterTest("DCERPCParserTest05", DCERPCParserTest05); UtRegisterTest("DCERPCParserTest06", DCERPCParserTest06); UtRegisterTest("DCERPCParserTest07", DCERPCParserTest07); UtRegisterTest("DCERPCParserTest08", DCERPCParserTest08); UtRegisterTest("DCERPCParserTest09", DCERPCParserTest09); UtRegisterTest("DCERPCParserTest10", DCERPCParserTest10); UtRegisterTest("DCERPCParserTest11", DCERPCParserTest11); UtRegisterTest("DCERPCParserTest12", DCERPCParserTest12); UtRegisterTest("DCERPCParserTest13", DCERPCParserTest13); UtRegisterTest("DCERPCParserTest14", DCERPCParserTest14); UtRegisterTest("DCERPCParserTest15", DCERPCParserTest15); UtRegisterTest("DCERPCParserTest16", DCERPCParserTest16); UtRegisterTest("DCERPCParserTest17", DCERPCParserTest17); UtRegisterTest("DCERPCParserTest18", DCERPCParserTest18); UtRegisterTest("DCERPCParserTest19", DCERPCParserTest19); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/detect-engine-hcbd.h0000644000000000000000000000277413051004444014575 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HCBD_H__ #define __DETECT_ENGINE_HCBD_H__ #define ENGINE_HCBD_BUFFER_LIMIT 20000 #include "app-layer-htp.h" int PrefilterTxHttpRequestBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpClientBody(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineCleanHCBDBuffers(DetectEngineThreadCtx *); void DetectEngineHttpClientBodyRegisterTests(void); #endif /* __DETECT_ENGINE_HCBD_H__ */ suricata-3.2.1/src/threads.h0000644000000000000000000002250213051004444012605 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * Threading functions defined as macros */ #ifndef __THREADS_H__ #define __THREADS_H__ #if HAVE_CONFIG_H #include #endif /* need this for the _POSIX_SPIN_LOCKS define */ #if HAVE_UNISTD_H #include #endif #ifdef PROFILING #include "util-cpu.h" #ifdef PROFILE_LOCKING #include "util-profiling-locks.h" #endif /* PROFILE_LOCKING */ #endif /* PROFILING */ #if defined OS_FREEBSD || __OpenBSD__ #if ! defined __OpenBSD__ #include #endif enum { PRIO_LOW = 2, PRIO_MEDIUM = 0, PRIO_HIGH = -2, }; #elif OS_DARWIN #include enum { PRIO_LOW = 2, PRIO_MEDIUM = 0, PRIO_HIGH = -2, }; #elif OS_WIN32 #include enum { PRIO_LOW = THREAD_PRIORITY_LOWEST, PRIO_MEDIUM = THREAD_PRIORITY_NORMAL, PRIO_HIGH = THREAD_PRIORITY_HIGHEST, }; #else /* LINUX */ #if HAVE_SYS_SYSCALL_H #include #endif #if HAVE_SYS_PRCTL_H #include #define THREAD_NAME_LEN 16 #endif enum { PRIO_LOW = 2, PRIO_MEDIUM = 0, PRIO_HIGH = -2, }; #endif /* OS_FREEBSD */ #include /* The mutex/spinlock/condition definitions and functions are used * in the same way as the POSIX definitions; Anyway we are centralizing * them here to make an easier portability process and debugging process; * Please, make sure you initialize mutex and spinlocks before using them * because, some OS doesn't initialize them for you :) */ //#define DBG_THREADS #ifdef __tile__ #include "threads-arch-tile.h" #elif defined DBG_THREADS #ifdef PROFILE_LOCKING #error "Cannot mix DBG_THREADS and PROFILE_LOCKING" #endif #include "threads-debug.h" #elif defined PROFILE_LOCKING #include "threads-profile.h" #else /* normal */ /* mutex */ #define SCMutex pthread_mutex_t #define SCMutexAttr pthread_mutexattr_t #define SCMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCMutexLock(mut) pthread_mutex_lock(mut) #define SCMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCMutexDestroy pthread_mutex_destroy #define SCMUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER /* rwlocks */ #define SCRWLock pthread_rwlock_t #define SCRWLockInit(rwl, rwlattr ) pthread_rwlock_init(rwl, rwlattr) #define SCRWLockWRLock(rwl) pthread_rwlock_wrlock(rwl) #define SCRWLockRDLock(rwl) pthread_rwlock_rdlock(rwl) #define SCRWLockTryWRLock(rwl) pthread_rwlock_trywrlock(rwl) #define SCRWLockTryRDLock(rwl) pthread_rwlock_tryrdlock(rwl) #define SCRWLockUnlock(rwl) pthread_rwlock_unlock(rwl) #define SCRWLockDestroy pthread_rwlock_destroy /* conditions */ #define SCCondT pthread_cond_t #define SCCondInit pthread_cond_init #define SCCondSignal pthread_cond_signal #define SCCondDestroy pthread_cond_destroy #define SCCondWait(cond, mut) pthread_cond_wait(cond, mut) /* ctrl mutex */ #define SCCtrlMutex pthread_mutex_t #define SCCtrlMutexAttr pthread_mutexattr_t #define SCCtrlMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCCtrlMutexLock(mut) pthread_mutex_lock(mut) #define SCCtrlMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCCtrlMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCCtrlMutexDestroy pthread_mutex_destroy /* ctrl conditions */ #define SCCtrlCondT pthread_cond_t #define SCCtrlCondInit pthread_cond_init #define SCCtrlCondSignal pthread_cond_signal #define SCCtrlCondTimedwait pthread_cond_timedwait #define SCCtrlCondWait pthread_cond_wait #define SCCtrlCondDestroy pthread_cond_destroy /* spinlocks */ #if ((_POSIX_SPIN_LOCKS - 200112L) < 0L) || defined HELGRIND #define SCSpinlock SCMutex #define SCSpinLock(spin) SCMutexLock((spin)) #define SCSpinTrylock(spin) SCMutexTrylock((spin)) #define SCSpinUnlock(spin) SCMutexUnlock((spin)) #define SCSpinInit(spin, spin_attr) SCMutexInit((spin), NULL) #define SCSpinDestroy(spin) SCMutexDestroy((spin)) #else /* no spinlocks */ #define SCSpinlock pthread_spinlock_t #define SCSpinLock(spin) pthread_spin_lock(spin) #define SCSpinTrylock(spin) pthread_spin_trylock(spin) #define SCSpinUnlock(spin) pthread_spin_unlock(spin) #define SCSpinInit(spin, spin_attr) pthread_spin_init(spin, spin_attr) #define SCSpinDestroy(spin) pthread_spin_destroy(spin) #endif /* no spinlocks */ #endif /* __tile__ */ #if (!defined SCMutex || !defined SCMutexAttr || !defined SCMutexInit || \ !defined SCMutexLock || !defined SCMutexTrylock || \ !defined SCMutexUnlock || !defined SCMutexDestroy || \ !defined SCMUTEX_INITIALIZER) #error "Mutex types and/or macro's not properly defined" #endif #if (!defined SCCtrlMutex || !defined SCCtrlMutexAttr || !defined SCCtrlMutexInit || \ !defined SCCtrlMutexLock || !defined SCCtrlMutexTrylock || \ !defined SCCtrlMutexUnlock || !defined SCCtrlMutexDestroy) #error "SCCtrlMutex types and/or macro's not properly defined" #endif #if (!defined SCSpinlock || !defined SCSpinLock || \ !defined SCSpinTrylock || !defined SCSpinUnlock || \ !defined SCSpinInit || !defined SCSpinDestroy) #error "Spinlock types and/or macro's not properly defined" #endif #if (!defined SCRWLock || !defined SCRWLockInit || !defined SCRWLockWRLock || \ !defined SCRWLockRDLock || !defined SCRWLockTryWRLock || \ !defined SCRWLockTryRDLock || !defined SCRWLockUnlock || !defined SCRWLockDestroy) #error "SCRWLock types and/or macro's not properly defined" #endif #if (!defined SCCondT || !defined SCCondInit || !defined SCCondSignal || \ !defined SCCondDestroy || !defined SCCondWait) #error "SCCond types and/or macro's not properly defined" #endif #if (!defined SCCtrlCondT || !defined SCCtrlCondInit || !defined SCCtrlCondSignal ||\ !defined SCCtrlCondDestroy || !defined SCCtrlCondTimedwait) #error "SCCtrlCond types and/or macro's not properly defined" #endif /** Get the Current Thread Id */ #ifdef OS_FREEBSD #include #define SCGetThreadIdLong(...) ({ \ long tmpthid; \ thr_self(&tmpthid); \ u_long _scgetthread_tid = (u_long)tmpthid; \ _scgetthread_tid; \ }) #elif __OpenBSD__ #define SCGetThreadIdLong(...) ({ \ pid_t tpid; \ tpid = getpid(); \ u_long _scgetthread_tid = (u_long)tpid; \ _scgetthread_tid; \ }) #elif __CYGWIN__ #define SCGetThreadIdLong(...) ({ \ u_long _scgetthread_tid = (u_long)GetCurrentThreadId(); \ _scgetthread_tid; \ }) #elif OS_WIN32 #define SCGetThreadIdLong(...) ({ \ u_long _scgetthread_tid = (u_long)GetCurrentThreadId(); \ _scgetthread_tid; \ }) #elif OS_DARWIN #define SCGetThreadIdLong(...) ({ \ thread_port_t tpid; \ tpid = mach_thread_self(); \ u_long _scgetthread_tid = (u_long)tpid; \ _scgetthread_tid; \ }) #elif defined(sun) #include #define SCGetThreadIdLong(...) ({ \ thread_t tmpthid = thr_self(); \ u_long _scgetthread_tid = (u_long)tmpthid; \ _scgetthread_tid; \ }) #else #define SCGetThreadIdLong(...) ({ \ pid_t tmpthid; \ tmpthid = syscall(SYS_gettid); \ u_long _scgetthread_tid = (u_long)tmpthid; \ _scgetthread_tid; \ }) #endif /* OS FREEBSD */ /* * OS specific macro's for setting the thread name. "top" can display * this name. */ #if defined OS_FREEBSD /* FreeBSD */ /** \todo Add implementation for FreeBSD */ #define SCSetThreadName(n) ({ \ char tname[16] = ""; \ if (strlen(n) > 16) \ SCLogDebug("Thread name is too long, truncating it..."); \ strlcpy(tname, n, 16); \ pthread_set_name_np(pthread_self(), tname); \ 0; \ }) #elif defined __OpenBSD__ /* OpenBSD */ /** \todo Add implementation for OpenBSD */ #define SCSetThreadName(n) (0) #elif defined OS_WIN32 /* Windows */ /** \todo Add implementation for Windows */ #define SCSetThreadName(n) (0) #elif defined OS_DARWIN /* Mac OS X */ /** \todo Add implementation for MacOS */ #define SCSetThreadName(n) (0) #elif defined PR_SET_NAME /* PR_SET_NAME */ /** * \brief Set the threads name */ #define SCSetThreadName(n) ({ \ char tname[THREAD_NAME_LEN + 1] = ""; \ if (strlen(n) > THREAD_NAME_LEN) \ SCLogDebug("Thread name is too long, truncating it..."); \ strlcpy(tname, n, THREAD_NAME_LEN); \ int ret = 0; \ if ((ret = prctl(PR_SET_NAME, tname, 0, 0, 0)) < 0) \ SCLogDebug("Error setting thread name \"%s\": %s", tname, strerror(errno)); \ ret; \ }) #else #define SCSetThreadName(n) (0) #endif void ThreadMacrosRegisterTests(void); #endif /* __THREADS_H__ */ suricata-3.2.1/src/output-json-drop.c0000644000000000000000000003251013051004444014417 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * JSON Drop log module to log the dropped packet information * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "util-debug.h" #include "decode-ipv4.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "output.h" #include "output-json.h" #include "output-json-alert.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-classification-config.h" #include "util-privs.h" #include "util-print.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "util-buffer.h" #define MODULE_NAME "JsonDropLog" #ifdef HAVE_LIBJANSSON #define LOG_DROP_ALERTS 1 typedef struct JsonDropOutputCtx_ { LogFileCtx *file_ctx; uint8_t flags; } JsonDropOutputCtx; typedef struct JsonDropLogThread_ { JsonDropOutputCtx *drop_ctx; MemBuffer *buffer; } JsonDropLogThread; /* default to true as this has been the default behavior for a long time */ static int g_droplog_flows_start = 1; /** * \brief Log the dropped packets in netfilter format when engine is running * in inline mode * * \param tv Pointer the current thread variables * \param p Pointer the packet which is being logged * * \return return TM_EODE_OK on success */ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p) { uint16_t proto = 0; json_t *js = CreateJSONHeader((Packet *)p, 0, "drop");//TODO const if (unlikely(js == NULL)) return TM_ECODE_OK; json_t *djs = json_object(); if (unlikely(djs == NULL)) { json_decref(js); return TM_ECODE_OK; } /* reset */ MemBufferReset(aft->buffer); if (PKT_IS_IPV4(p)) { json_object_set_new(djs, "len", json_integer(IPV4_GET_IPLEN(p))); json_object_set_new(djs, "tos", json_integer(IPV4_GET_IPTOS(p))); json_object_set_new(djs, "ttl", json_integer(IPV4_GET_IPTTL(p))); json_object_set_new(djs, "ipid", json_integer(IPV4_GET_IPID(p))); proto = IPV4_GET_IPPROTO(p); } else if (PKT_IS_IPV6(p)) { json_object_set_new(djs, "len", json_integer(IPV6_GET_PLEN(p))); json_object_set_new(djs, "tc", json_integer(IPV6_GET_CLASS(p))); json_object_set_new(djs, "hoplimit", json_integer(IPV6_GET_HLIM(p))); json_object_set_new(djs, "flowlbl", json_integer(IPV6_GET_FLOW(p))); proto = IPV6_GET_L4PROTO(p); } switch (proto) { case IPPROTO_TCP: if (PKT_IS_TCP(p)) { json_object_set_new(djs, "tcpseq", json_integer(TCP_GET_SEQ(p))); json_object_set_new(djs, "tcpack", json_integer(TCP_GET_ACK(p))); json_object_set_new(djs, "tcpwin", json_integer(TCP_GET_WINDOW(p))); json_object_set_new(djs, "syn", TCP_ISSET_FLAG_SYN(p) ? json_true() : json_false()); json_object_set_new(djs, "ack", TCP_ISSET_FLAG_ACK(p) ? json_true() : json_false()); json_object_set_new(djs, "psh", TCP_ISSET_FLAG_PUSH(p) ? json_true() : json_false()); json_object_set_new(djs, "rst", TCP_ISSET_FLAG_RST(p) ? json_true() : json_false()); json_object_set_new(djs, "urg", TCP_ISSET_FLAG_URG(p) ? json_true() : json_false()); json_object_set_new(djs, "fin", TCP_ISSET_FLAG_FIN(p) ? json_true() : json_false()); json_object_set_new(djs, "tcpres", json_integer(TCP_GET_RAW_X2(p->tcph))); json_object_set_new(djs, "tcpurgp", json_integer(TCP_GET_URG_POINTER(p))); } break; case IPPROTO_UDP: if (PKT_IS_UDP(p)) { json_object_set_new(djs, "udplen", json_integer(UDP_GET_LEN(p))); } break; case IPPROTO_ICMP: if (PKT_IS_ICMPV4(p)) { json_object_set_new(djs, "icmp_id", json_integer(ICMPV4_GET_ID(p))); json_object_set_new(djs, "icmp_seq", json_integer(ICMPV4_GET_SEQ(p))); } else if(PKT_IS_ICMPV6(p)) { json_object_set_new(djs, "icmp_id", json_integer(ICMPV6_GET_ID(p))); json_object_set_new(djs, "icmp_seq", json_integer(ICMPV6_GET_SEQ(p))); } break; } json_object_set_new(js, "drop", djs); if (aft->drop_ctx->flags & LOG_DROP_ALERTS) { int logged = 0; int i; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } if ((pa->action & (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)) || ((pa->action & ACTION_DROP) && EngineModeIsIPS())) { AlertJsonHeader(p, pa, js); logged = 1; } } if (logged == 0) { if (p->alerts.drop.action != 0) { const PacketAlert *pa = &p->alerts.drop; AlertJsonHeader(p, pa, js); } } } OutputJSONBuffer(js, aft->drop_ctx->file_ctx, &aft->buffer); json_object_del(js, "drop"); json_object_clear(js); json_decref(js); return TM_ECODE_OK; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonDropLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonDropLogThread *aft = SCMalloc(sizeof(JsonDropLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(*aft)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogDrop. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /** Use the Ouptut Context (file pointer and mutex) */ aft->drop_ctx = ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonDropLogThreadDeinit(ThreadVars *t, void *data) { JsonDropLogThread *aft = (JsonDropLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(*aft)); SCFree(aft); return TM_ECODE_OK; } static void JsonDropOutputCtxFree(JsonDropOutputCtx *drop_ctx) { if (drop_ctx != NULL) { if (drop_ctx->file_ctx != NULL) LogFileFreeCtx(drop_ctx->file_ctx); SCFree(drop_ctx); } } static void JsonDropLogDeInitCtx(OutputCtx *output_ctx) { OutputDropLoggerDisable(); JsonDropOutputCtx *drop_ctx = output_ctx->data; JsonDropOutputCtxFree(drop_ctx); SCFree(output_ctx); } static void JsonDropLogDeInitCtxSub(OutputCtx *output_ctx) { OutputDropLoggerDisable(); JsonDropOutputCtx *drop_ctx = output_ctx->data; SCFree(drop_ctx); SCLogDebug("cleaning up sub output_ctx %p", output_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "drop.json" static OutputCtx *JsonDropLogInitCtx(ConfNode *conf) { if (OutputDropLoggerEnable() != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "only one 'drop' logger " "can be enabled"); return NULL; } JsonDropOutputCtx *drop_ctx = SCCalloc(1, sizeof(*drop_ctx)); if (drop_ctx == NULL) return NULL; drop_ctx->file_ctx = LogFileNewCtx(); if (drop_ctx->file_ctx == NULL) { JsonDropOutputCtxFree(drop_ctx); return NULL; } if (SCConfLogOpenGeneric(conf, drop_ctx->file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { JsonDropOutputCtxFree(drop_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { JsonDropOutputCtxFree(drop_ctx); return NULL; } if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "alerts"); if (extended != NULL) { if (ConfValIsTrue(extended)) { drop_ctx->flags = LOG_DROP_ALERTS; } } extended = ConfNodeLookupChildValue(conf, "flows"); if (extended != NULL) { if (strcasecmp(extended, "start") == 0) { g_droplog_flows_start = 1; } else if (strcasecmp(extended, "all") == 0) { g_droplog_flows_start = 0; } else { SCLogWarning(SC_ERR_CONF_YAML_ERROR, "valid options for " "'flow' are 'start' and 'all'"); } } } output_ctx->data = drop_ctx; output_ctx->DeInit = JsonDropLogDeInitCtx; return output_ctx; } static OutputCtx *JsonDropLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx) { if (OutputDropLoggerEnable() != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "only one 'drop' logger " "can be enabled"); return NULL; } AlertJsonThread *ajt = parent_ctx->data; JsonDropOutputCtx *drop_ctx = SCCalloc(1, sizeof(*drop_ctx)); if (drop_ctx == NULL) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { JsonDropOutputCtxFree(drop_ctx); return NULL; } if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "alerts"); if (extended != NULL) { if (ConfValIsTrue(extended)) { drop_ctx->flags = LOG_DROP_ALERTS; } } extended = ConfNodeLookupChildValue(conf, "flows"); if (extended != NULL) { if (strcasecmp(extended, "start") == 0) { g_droplog_flows_start = 1; } else if (strcasecmp(extended, "all") == 0) { g_droplog_flows_start = 0; } else { SCLogWarning(SC_ERR_CONF_YAML_ERROR, "valid options for " "'flow' are 'start' and 'all'"); } } } drop_ctx->file_ctx = ajt->file_ctx; output_ctx->data = drop_ctx; output_ctx->DeInit = JsonDropLogDeInitCtxSub; return output_ctx; } /** * \brief Log the dropped packets when engine is running in inline mode * * \param tv Pointer the current thread variables * \param data Pointer to the droplog struct * \param p Pointer the packet which is being logged * * \retval 0 on succes */ static int JsonDropLogger(ThreadVars *tv, void *thread_data, const Packet *p) { JsonDropLogThread *td = thread_data; int r = DropLogJSON(td, p); if (r < 0) return -1; if (!g_droplog_flows_start) return 0; if (p->flow) { if (p->flow->flags & FLOW_ACTION_DROP) { if (PKT_IS_TOSERVER(p) && !(p->flow->flags & FLOW_TOSERVER_DROP_LOGGED)) p->flow->flags |= FLOW_TOSERVER_DROP_LOGGED; else if (PKT_IS_TOCLIENT(p) && !(p->flow->flags & FLOW_TOCLIENT_DROP_LOGGED)) p->flow->flags |= FLOW_TOCLIENT_DROP_LOGGED; } } return 0; } /** * \brief Check if we need to drop-log this packet * * \param tv Pointer the current thread variables * \param p Pointer the packet which is tested * * \retval bool TRUE or FALSE */ static int JsonDropLogCondition(ThreadVars *tv, const Packet *p) { if (!EngineModeIsIPS()) { SCLogDebug("engine is not running in inline mode, so returning"); return FALSE; } if (PKT_IS_PSEUDOPKT(p)) { SCLogDebug("drop log doesn't log pseudo packets"); return FALSE; } if (g_droplog_flows_start && p->flow != NULL) { int ret = FALSE; /* for a flow that will be dropped fully, log just once per direction */ if (p->flow->flags & FLOW_ACTION_DROP) { if (PKT_IS_TOSERVER(p) && !(p->flow->flags & FLOW_TOSERVER_DROP_LOGGED)) ret = TRUE; else if (PKT_IS_TOCLIENT(p) && !(p->flow->flags & FLOW_TOCLIENT_DROP_LOGGED)) ret = TRUE; } /* if drop is caused by signature, log anyway */ if (p->alerts.drop.action != 0) ret = TRUE; return ret; } else if (PACKET_TEST_ACTION(p, ACTION_DROP)) { return TRUE; } return FALSE; } void JsonDropLogRegister (void) { OutputRegisterPacketModule(LOGGER_JSON_DROP, MODULE_NAME, "drop-json-log", JsonDropLogInitCtx, JsonDropLogger, JsonDropLogCondition, JsonDropLogThreadInit, JsonDropLogThreadDeinit, NULL); OutputRegisterPacketSubModule(LOGGER_JSON_DROP, "eve-log", MODULE_NAME, "eve-log.drop", JsonDropLogInitCtxSub, JsonDropLogger, JsonDropLogCondition, JsonDropLogThreadInit, JsonDropLogThreadDeinit, NULL); } #else void JsonDropLogRegister (void) { } #endif suricata-3.2.1/src/detect-stream_size.h0000644000000000000000000000246713051004444014756 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_STREAM_SIZE_H #define _DETECT_STREAM_SIZE_H #define DETECTSSIZE_LT 0 #define DETECTSSIZE_LEQ 1 #define DETECTSSIZE_EQ 2 #define DETECTSSIZE_NEQ 3 #define DETECTSSIZE_GT 4 #define DETECTSSIZE_GEQ 5 #define STREAM_SIZE_SERVER 0x01 #define STREAM_SIZE_CLIENT 0x02 #define STREAM_SIZE_BOTH 0x04 #define STREAM_SIZE_EITHER 0x08 typedef struct DetectStreamSizeData_ { uint8_t flags; uint8_t mode; uint32_t ssize; }DetectStreamSizeData; void DetectStreamSizeRegister(void); #endif /* _DETECT_STREAM_SIZE_H */ suricata-3.2.1/src/conf.h0000644000000000000000000000622713051004444012106 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited - Jason Ish */ #ifndef __CONF_H__ #define __CONF_H__ #include "queue.h" /** * Structure of a configuration parameter. */ typedef struct ConfNode_ { char *name; char *val; int is_seq; /**< Flag that sets this nodes value as final. */ int final; struct ConfNode_ *parent; TAILQ_HEAD(, ConfNode_) head; TAILQ_ENTRY(ConfNode_) next; } ConfNode; /** * The default log directory. */ #ifdef OS_WIN32 #define DEFAULT_LOG_DIR "C:\\WINDOWS\\Temp" #else #define DEFAULT_LOG_DIR "/var/log/suricata" #endif /* OS_WIN32 */ void ConfInit(void); void ConfDeInit(void); ConfNode *ConfGetRootNode(void); int ConfGet(const char *name, char **vptr); int ConfGetInt(const char *name, intmax_t *val); int ConfGetBool(const char *name, int *val); int ConfGetDouble(const char *name, double *val); int ConfGetFloat(const char *name, float *val); int ConfSet(const char *name, char *val); int ConfSetFromString(const char *input, int final); int ConfSetFinal(const char *name, char *val); void ConfDump(void); void ConfNodeDump(const ConfNode *node, const char *prefix); ConfNode *ConfNodeNew(void); void ConfNodeFree(ConfNode *); ConfNode *ConfGetNode(const char *key); void ConfCreateContextBackup(void); void ConfRestoreContextBackup(void); ConfNode *ConfNodeLookupChild(const ConfNode *node, const char *key); const char *ConfNodeLookupChildValue(const ConfNode *node, const char *key); void ConfNodeRemove(ConfNode *); void ConfRegisterTests(); int ConfNodeChildValueIsTrue(const ConfNode *node, const char *key); int ConfValIsTrue(const char *val); int ConfValIsFalse(const char *val); void ConfNodePrune(ConfNode *node); ConfNode *ConfNodeLookupKeyValue(const ConfNode *base, const char *key, const char *value); int ConfGetChildValue(const ConfNode *base, const char *name, char **vptr); int ConfGetChildValueInt(const ConfNode *base, const char *name, intmax_t *val); int ConfGetChildValueBool(const ConfNode *base, const char *name, int *val); int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, char **vptr); int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val); int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val); char *ConfLoadCompleteIncludePath(const char *); int ConfNodeIsSequence(const ConfNode *node); #endif /* ! __CONF_H__ */ suricata-3.2.1/src/detect-flowvar.c0000644000000000000000000002220213051004444014071 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Simple flowvar content match part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "threads.h" #include "flow.h" #include "flow-var.h" #include "detect-flowvar.h" #include "util-spm.h" #include "util-var-name.h" #include "util-debug.h" #include "util-print.h" #define PARSE_REGEX "(.*),(.*)" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectFlowvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFlowvarSetup (DetectEngineCtx *, Signature *, char *); static int DetectFlowvarPostMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx); static void DetectFlowvarDataFree(void *ptr); void DetectFlowvarRegister (void) { sigmatch_table[DETECT_FLOWVAR].name = "flowvar"; sigmatch_table[DETECT_FLOWVAR].Match = DetectFlowvarMatch; sigmatch_table[DETECT_FLOWVAR].Setup = DetectFlowvarSetup; sigmatch_table[DETECT_FLOWVAR].Free = DetectFlowvarDataFree; sigmatch_table[DETECT_FLOWVAR].RegisterTests = NULL; /* post-match for flowvar storage */ sigmatch_table[DETECT_FLOWVAR_POSTMATCH].name = "__flowvar__postmatch__"; sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Match = DetectFlowvarPostMatch; sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Setup = NULL; sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Free = DetectFlowvarDataFree; sigmatch_table[DETECT_FLOWVAR_POSTMATCH].RegisterTests = NULL; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief this function will SCFree memory associated with DetectFlowvarData * * \param cd pointer to DetectCotentData */ static void DetectFlowvarDataFree(void *ptr) { if (ptr == NULL) SCReturn; DetectFlowvarData *fd = (DetectFlowvarData *)ptr; if (fd->name) SCFree(fd->name); if (fd->content) SCFree(fd->content); SCFree(fd); } /* * returns 0: no match * 1: match * -1: error */ int DetectFlowvarMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { int ret = 0; DetectFlowvarData *fd = (DetectFlowvarData *)ctx; FlowVar *fv = FlowVarGet(p->flow, fd->idx); if (fv != NULL) { uint8_t *ptr = SpmSearch(fv->data.fv_str.value, fv->data.fv_str.value_len, fd->content, fd->content_len); if (ptr != NULL) ret = 1; } return ret; } static int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectFlowvarData *fd = NULL; SigMatch *sm = NULL; char *varname = NULL, *varcontent = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr; uint8_t *content = NULL; uint16_t contentlen = 0; uint32_t contentflags = 0; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for flowvar.", rawstr); return -1; } res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } varname = (char *)str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } varcontent = (char *)str_ptr; res = DetectContentDataParse("flowvar", varcontent, &content, &contentlen, &contentflags); if (res == -1) goto error; fd = SCMalloc(sizeof(DetectFlowvarData)); if (unlikely(fd == NULL)) goto error; memset(fd, 0x00, sizeof(*fd)); fd->content = SCMalloc(contentlen); if (unlikely(fd->content == NULL)) goto error; memcpy(fd->content, content, contentlen); fd->content_len = contentlen; fd->flags = contentflags; fd->name = SCStrdup(varname); if (unlikely(fd->name == NULL)) goto error; fd->idx = VariableNameGetIdx(de_ctx, varname, VAR_TYPE_FLOW_VAR); /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (unlikely(sm == NULL)) goto error; sm->type = DETECT_FLOWVAR; sm->ctx = (SigMatchCtx *)fd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); SCFree(content); return 0; error: if (fd != NULL) DetectFlowvarDataFree(fd); if (sm != NULL) SCFree(sm); if (content != NULL) SCFree(content); return -1; } /** \brief Store flowvar in det_ctx so we can exec it post-match */ int DetectFlowvarStoreMatch(DetectEngineThreadCtx *det_ctx, uint16_t idx, uint8_t *buffer, uint16_t len, int type) { DetectFlowvarList *fs = det_ctx->flowvarlist; /* first check if we have had a previous match for this idx */ for ( ; fs != NULL; fs = fs->next) { if (fs->idx == idx) { /* we're replacing the older store */ SCFree(fs->buffer); fs->buffer = NULL; break; } } if (fs == NULL) { fs = SCMalloc(sizeof(*fs)); if (unlikely(fs == NULL)) return -1; fs->idx = idx; fs->next = det_ctx->flowvarlist; det_ctx->flowvarlist = fs; } fs->len = len; fs->type = type; fs->buffer = buffer; return 0; } /** \brief Setup a post-match for flowvar storage * We're piggyback riding the DetectFlowvarData struct */ int DetectFlowvarPostMatchSetup(Signature *s, uint16_t idx) { SigMatch *sm = NULL; DetectFlowvarData *fv = NULL; fv = SCMalloc(sizeof(DetectFlowvarData)); if (unlikely(fv == NULL)) goto error; memset(fv, 0x00, sizeof(*fv)); /* we only need the idx */ fv->idx = idx; sm = SigMatchAlloc(); if (unlikely(sm == NULL)) goto error; sm->type = DETECT_FLOWVAR_POSTMATCH; sm->ctx = (SigMatchCtx *)fv; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); return 0; error: if (fv != NULL) DetectFlowvarDataFree(fv); return -1; } /** \internal * \brief post-match func to store flowvars in the flow * \param sm sigmatch containing the idx to store * \retval 1 or -1 in case of error */ static int DetectFlowvarPostMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { DetectFlowvarList *fs, *prev; const DetectFlowvarData *fd; if (det_ctx->flowvarlist == NULL || p->flow == NULL) return 1; fd = (const DetectFlowvarData *)ctx; prev = NULL; fs = det_ctx->flowvarlist; while (fs != NULL) { if (fd->idx == fs->idx) { SCLogDebug("adding to the flow %u:", fs->idx); //PrintRawDataFp(stdout, fs->buffer, fs->len); FlowVarAddStrNoLock(p->flow, fs->idx, fs->buffer, fs->len); /* memory at fs->buffer is now the responsibility of * the flowvar code. */ if (fs == det_ctx->flowvarlist) { det_ctx->flowvarlist = fs->next; SCFree(fs); fs = det_ctx->flowvarlist; } else { prev->next = fs->next; SCFree(fs); fs = prev->next; } } else { prev = fs; fs = fs->next; } } return 1; } /** \brief Handle flowvar candidate list in det_ctx: * - clean up the list * - enforce storage for type ALWAYS (vars set from lua) * Only called from DetectFlowvarProcessList() when flowvarlist is not NULL . */ void DetectFlowvarProcessListInternal(DetectFlowvarList *fs, Flow *f) { DetectFlowvarList *next; do { next = fs->next; if (fs->type == DETECT_FLOWVAR_TYPE_ALWAYS) { SCLogDebug("adding to the flow %u:", fs->idx); //PrintRawDataFp(stdout, fs->buffer, fs->len); FlowVarAddStrNoLock(f, fs->idx, fs->buffer, fs->len); /* memory at fs->buffer is now the responsibility of * the flowvar code. */ } else { SCFree(fs->buffer); } SCFree(fs); fs = next; } while (fs != NULL); } suricata-3.2.1/src/ippair-bit.h0000644000000000000000000000244113051004444013213 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __IPPAIR_BIT_H__ #define __IPPAIR_BIT_H__ #include "ippair.h" #include "util-var.h" void IPPairBitInitCtx(void); void IPPairBitRegisterTests(void); int IPPairHasBits(IPPair *host); int IPPairBitsTimedoutCheck(IPPair *h, struct timeval *ts); void IPPairBitSet(IPPair *, uint16_t, uint32_t); void IPPairBitUnset(IPPair *, uint16_t); void IPPairBitToggle(IPPair *, uint16_t, uint32_t); int IPPairBitIsset(IPPair *, uint16_t, uint32_t); int IPPairBitIsnotset(IPPair *, uint16_t, uint32_t); #endif /* __IPPAIR_BIT_H__ */ suricata-3.2.1/src/detect-ftpbounce.c0000644000000000000000000004012213051004444014377 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * ftpbounce keyword, part of the detection engine. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ftp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "threads.h" #include "detect-ftpbounce.h" #include "stream-tcp.h" #include "util-byte.h" int DetectFtpbounceMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); int DetectFtpbounceALMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectFtpbounceSetup(DetectEngineCtx *, Signature *, char *); int DetectFtpbounceMatchArgs(uint8_t *payload, uint16_t payload_len, uint32_t ip_orig, uint16_t offset); void DetectFtpbounceRegisterTests(void); void DetectFtpbounceFree(void *); /** * \brief Registration function for ftpbounce: keyword * \todo add support for no_stream and stream_only */ void DetectFtpbounceRegister(void) { sigmatch_table[DETECT_FTPBOUNCE].name = "ftpbounce"; sigmatch_table[DETECT_FTPBOUNCE].Setup = DetectFtpbounceSetup; sigmatch_table[DETECT_FTPBOUNCE].Match = NULL; sigmatch_table[DETECT_FTPBOUNCE].AppLayerMatch = DetectFtpbounceALMatch; sigmatch_table[DETECT_FTPBOUNCE].Free = NULL; sigmatch_table[DETECT_FTPBOUNCE].RegisterTests = DetectFtpbounceRegisterTests; sigmatch_table[DETECT_FTPBOUNCE].flags = SIGMATCH_NOOPT; return; } /** * \brief This function is used to match ftpbounce attacks * * \param payload Payload of the PORT command * \param payload_len Length of the payload * \param ip_orig IP source to check the ftpbounce condition * \param offset offset to the arguments of the PORT command * * \retval 1 if ftpbounce detected, 0 if not */ int DetectFtpbounceMatchArgs(uint8_t *payload, uint16_t payload_len, uint32_t ip_orig, uint16_t offset) { SCEnter(); SCLogDebug("Checking ftpbounce condition"); char *c = NULL; uint16_t i = 0; int octet = 0; int octet_ascii_len = 0; int noctet = 0; uint32_t ip = 0; /* PrintRawDataFp(stdout, payload, payload_len); */ if (payload_len < 7) { /* we need at least a differet ip address * in the format 1,2,3,4,x,y where x,y is the port * in two byte representation so let's look at * least for the IP octets in comma separated */ return 0; } if (offset + 7 >= payload_len) return 0; c =(char*) payload; if (c == NULL) { SCLogDebug("No payload to check"); return 0; } i = offset; /* Search for the first IP octect(Skips "PORT ") */ while (i < payload_len && !isdigit((unsigned char)c[i])) i++; for (;i < payload_len && octet_ascii_len < 4 ;i++) { if (isdigit((unsigned char)c[i])) { octet =(c[i] - '0') + octet * 10; octet_ascii_len++; } else { if (octet > 256) { SCLogDebug("Octet not in ip format"); return 0; } if (isspace((unsigned char)c[i])) while (i < payload_len && isspace((unsigned char)c[i]) ) i++; if (i < payload_len && c[i] == ',') { /* we have an octet */ noctet++; octet_ascii_len = 0; ip =(ip << 8) + octet; octet = 0; } else { SCLogDebug("Unrecognized character '%c'", c[i]); return 0; } if (noctet == 4) { /* Different IP than src, ftp bounce scan */ ip = SCByteSwap32(ip); if (ip != ip_orig) { SCLogDebug("Different ip, so Matched ip:%d <-> ip_orig:%d", ip, ip_orig); return 1; } SCLogDebug("Same ip, so no match here"); return 0; } } } SCLogDebug("No match"); return 0; } /** * \brief This function is used to check matches from the FTP App Layer Parser * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch but we don't use it since ftpbounce * has no options * \retval 0 no match * \retval 1 match */ int DetectFtpbounceALMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); FtpState *ftp_state =(FtpState *)state; if (ftp_state == NULL) { SCLogDebug("no ftp state, no match"); SCReturnInt(0); } int ret = 0; if (ftp_state->command == FTP_COMMAND_PORT) { ret = DetectFtpbounceMatchArgs(ftp_state->port_line, ftp_state->port_line_len, f->src.address.address_un_data32[0], ftp_state->arg_offset); } SCReturnInt(ret); } /** * \brief this function is used to add the parsed ftpbounce * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param ftpbouncestr pointer to the user provided ftpbounce options * currently there are no options. * * \retval 0 on Success * \retval -1 on Failure */ int DetectFtpbounceSetup(DetectEngineCtx *de_ctx, Signature *s, char *ftpbouncestr) { SCEnter(); SigMatch *sm = NULL; sm = SigMatchAlloc(); if (sm == NULL) { goto error;; } sm->type = DETECT_FTPBOUNCE; /* We don't need to allocate any data for ftpbounce here. * * TODO: As a suggestion, maybe we can add a flag in the flow * to set the stream as "bounce detected" for fast Match. * When you do a ftp bounce attack you usually use the same * communication control stream to "setup" various destinations * whithout breaking the connection, so I guess we can make it a bit faster * with a flow flag set lookup in the Match function. */ sm->ctx = NULL; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_FTP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->alproto = ALPROTO_FTP; s->flags |= SIG_FLAG_APPLAYER; SCReturnInt(0); error: if (sm != NULL) { SigMatchFree(sm); } SCReturnInt(-1); } #ifdef UNITTESTS /** * \test DetectFtpbounceTestSetup01 is a test for the Setup ftpbounce */ int DetectFtpbounceTestSetup01(void) { int res = 0; DetectEngineCtx *de_ctx = NULL; Signature *s = SigAlloc(); if (s == NULL) return 0; /* ftpbounce doesn't accept options so the str is NULL */ res = !DetectFtpbounceSetup(de_ctx, s, NULL); res &= s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL && s->sm_lists[DETECT_SM_LIST_AMATCH]->type & DETECT_FTPBOUNCE; SigFree(s); return res; } #include "stream-tcp-reassemble.h" /** * \test Check the ftpbounce match, send a get request in three chunks * + more data. * \brief This test tests the ftpbounce condition match, based on the * ftp layer parser */ static int DetectFtpbounceTestALMatch02(void) { int result = 0; uint8_t ftpbuf1[] = { 'P','O' }; uint32_t ftplen1 = sizeof(ftpbuf1); uint8_t ftpbuf2[] = { 'R', 'T' }; uint32_t ftplen2 = sizeof(ftpbuf2); uint8_t ftpbuf3[] = { ' ', '8','0',',','5' }; uint32_t ftplen3 = sizeof(ftpbuf3); uint8_t ftpbuf4[] = "8,0,33,10,20\r\n"; uint32_t ftplen4 = sizeof(ftpbuf4); TcpSession ssn; Flow f; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacketSrcDst(NULL, 0, IPPROTO_TCP, "1.2.3.4", "5.6.7.8"); FLOW_INITIALIZE(&f); f.src.address.address_un_data32[0]=0x01020304; f.protoctx =(void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_FTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any " "(msg:\"Ftp Bounce\"; ftpbounce; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v,(void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf1, ftplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2); if (r != 0) { SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf3, ftplen3); if (r != 0) { SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf4, ftplen4); if (r != 0) { SCLogDebug("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command port not detected"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Check the ftpbounce match * \brief This test tests the ftpbounce condition match, based on * the ftp layer parser */ static int DetectFtpbounceTestALMatch03(void) { int result = 0; uint8_t ftpbuf1[] = { 'P','O' }; uint32_t ftplen1 = sizeof(ftpbuf1); uint8_t ftpbuf2[] = { 'R', 'T' }; uint32_t ftplen2 = sizeof(ftpbuf2); uint8_t ftpbuf3[] = { ' ', '1',',','2',',' }; uint32_t ftplen3 = sizeof(ftpbuf3); uint8_t ftpbuf4[] = "3,4,10,20\r\n"; uint32_t ftplen4 = sizeof(ftpbuf4); TcpSession ssn; Flow f; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = 0x04030201; p->payload = NULL; p->payload_len = 0; p->proto = IPPROTO_TCP; FLOW_INITIALIZE(&f); f.src.address.address_un_data32[0]=0x04030201; f.protoctx =(void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_FTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any " "(msg:\"Ftp Bounce\"; ftpbounce; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v,(void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf1, ftplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2); if (r != 0) { SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf3, ftplen3); if (r != 0) { SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf4, ftplen4); if (r != 0) { SCLogDebug("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FtpState *ftp_state = f.alstate; if (ftp_state == NULL) { SCLogDebug("no ftp state: "); result = 0; goto end; } if (ftp_state->command != FTP_COMMAND_PORT) { SCLogDebug("expected command port not detected"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* It should not match */ if (!(PacketAlertCheck(p, 1))) { result = 1; } else { SCLogDebug("It should not match here!"); } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); SCFree(p); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFtpbounce */ void DetectFtpbounceRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFtpbounceTestSetup01", DetectFtpbounceTestSetup01); UtRegisterTest("DetectFtpbounceTestALMatch02", DetectFtpbounceTestALMatch02); UtRegisterTest("DetectFtpbounceTestALMatch03", DetectFtpbounceTestALMatch03); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-address-ipv6.c0000644000000000000000000017776213051004444016211 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * IPV6 Address part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "flow-var.h" #include "util-cidr.h" #include "util-unittest.h" #include "detect-engine-address.h" #include "detect-engine-siggroup.h" #include "detect-engine-port.h" #include "util-debug.h" /** * \brief Compares 2 ipv6 addresses and returns if the first address(a) is less * than the second address(b) or not. * * \param a The first ipv6 address to be compared. * \param b The second ipv6 address to be compared. * * \retval 1 If a < b. * \retval 0 Otherwise, i.e. a >= b. */ int AddressIPv6Lt(Address *a, Address *b) { int i = 0; for (i = 0; i < 4; i++) { if (ntohl(a->addr_data32[i]) < ntohl(b->addr_data32[i])) return 1; if (ntohl(a->addr_data32[i]) > ntohl(b->addr_data32[i])) break; } return 0; } int AddressIPv6LtU32(uint32_t *a, uint32_t *b) { int i = 0; for (i = 0; i < 4; i++) { if (ntohl(a[i]) < ntohl(b[i])) return 1; if (ntohl(a[i]) > ntohl(b[i])) break; } return 0; } /** * \brief Compares 2 ipv6 addresses and returns if the first address(a) is * greater than the second address(b) or not. * * \param a The first ipv6 address to be compared. * \param b The second ipv6 address to be compared. * * \retval 1 If a > b. * \retval 0 Otherwise, i.e. a <= b. */ int AddressIPv6Gt(Address *a, Address *b) { int i = 0; for (i = 0; i < 4; i++) { if (ntohl(a->addr_data32[i]) > ntohl(b->addr_data32[i])) return 1; if (ntohl(a->addr_data32[i]) < ntohl(b->addr_data32[i])) break; } return 0; } int AddressIPv6GtU32(uint32_t *a, uint32_t *b) { int i = 0; for (i = 0; i < 4; i++) { if (ntohl(a[i]) > ntohl(b[i])) return 1; if (ntohl(a[i]) < ntohl(b[i])) break; } return 0; } /** * \brief Compares 2 ipv6 addresses and returns if the addresses are equal * or not. * * \param a The first ipv6 address to be compared. * \param b The second ipv6 address to be compared. * * \retval 1 If a == b. * \retval 0 Otherwise. */ int AddressIPv6Eq(Address *a, Address *b) { int i = 0; for (i = 0; i < 4; i++) { if (a->addr_data32[i] != b->addr_data32[i]) return 0; } return 1; } int AddressIPv6EqU32(uint32_t *a, uint32_t *b) { int i = 0; for (i = 0; i < 4; i++) { if (a[i] != b[i]) return 0; } return 1; } /** * \brief Compares 2 ipv6 addresses and returns if the first address(a) is less * than or equal to the second address(b) or not. * * \param a The first ipv6 address to be compared. * \param b The second ipv6 address to be compared. * * \retval 1 If a <= b. * \retval 0 Otherwise, i.e. a > b. */ int AddressIPv6Le(Address *a, Address *b) { if (AddressIPv6Eq(a, b) == 1) return 1; if (AddressIPv6Lt(a, b) == 1) return 1; return 0; } int AddressIPv6LeU32(uint32_t *a, uint32_t *b) { if (AddressIPv6EqU32(a, b) == 1) return 1; if (AddressIPv6LtU32(a, b) == 1) return 1; return 0; } /** * \brief Compares 2 ipv6 addresses and returns if the first address(a) is * greater than or equal to the second address(b) or not. * * \param a The first ipv6 address to be compared. * \param b The second ipv6 address to be compared. * * \retval 1 If a >= b. * \retval 0 Otherwise, i.e. a < b. */ int AddressIPv6Ge(Address *a, Address *b) { if (AddressIPv6Eq(a, b) == 1) return 1; if (AddressIPv6Gt(a, b) == 1) return 1; return 0; } int AddressIPv6GeU32(uint32_t *a, uint32_t *b) { if (AddressIPv6EqU32(a, b) == 1) return 1; if (AddressIPv6GtU32(a, b) == 1) return 1; return 0; } /** * \brief Compares 2 addresses(address ranges) and returns the relationship * between the 2 addresses. * * \param a Pointer to the first address instance to be compared. * \param b Pointer to the second address instance to be compared. * * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal. * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2. * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2. * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2 * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2 * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2 * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only * after the end of the address range for 'b' */ int DetectAddressCmpIPv6(DetectAddress *a, DetectAddress *b) { if (AddressIPv6Eq(&a->ip, &b->ip) == 1 && AddressIPv6Eq(&a->ip2, &b->ip2) == 1) { return ADDRESS_EQ; } else if (AddressIPv6Ge(&a->ip, &b->ip) == 1 && AddressIPv6Le(&a->ip, &b->ip2) == 1 && AddressIPv6Le(&a->ip2, &b->ip2) == 1) { return ADDRESS_ES; } else if (AddressIPv6Le(&a->ip, &b->ip) == 1 && AddressIPv6Ge(&a->ip2, &b->ip2) == 1) { return ADDRESS_EB; } else if (AddressIPv6Lt(&a->ip, &b->ip) == 1 && AddressIPv6Lt(&a->ip2, &b->ip2) == 1 && AddressIPv6Ge(&a->ip2, &b->ip) == 1) { return ADDRESS_LE; } else if (AddressIPv6Lt(&a->ip, &b->ip) == 1 && AddressIPv6Lt(&a->ip2, &b->ip2) == 1) { return ADDRESS_LT; } else if (AddressIPv6Gt(&a->ip, &b->ip) == 1 && AddressIPv6Le(&a->ip, &b->ip2) == 1 && AddressIPv6Gt(&a->ip2, &b->ip2) == 1) { return ADDRESS_GE; } else if (AddressIPv6Gt(&a->ip, &b->ip2) == 1) { return ADDRESS_GT; } else { /* should be unreachable */ SCLogDebug("Internal Error: should be unreachable\n"); } return ADDRESS_ER; } /** * \brief Takes an IPv6 address in a, and returns in b an IPv6 address which is * one less than the IPv6 address in a. The address sent in a is in host * order, and the address in b will be returned in network order! * * \param a Pointer to an IPv6 address in host order. * \param b Pointer to an IPv6 address store in memory which has to be updated * with the new address(a - 1). */ static void AddressCutIPv6CopySubOne(uint32_t *a, uint32_t *b) { uint32_t t = a[3]; b[0] = a[0]; b[1] = a[1]; b[2] = a[2]; b[3] = a[3]; b[3]--; if (b[3] > t) { t = b[2]; b[2]--; if (b[2] > t) { t = b[1]; b[1]--; if (b[1] > t) b[0]--; } } b[0] = htonl(b[0]); b[1] = htonl(b[1]); b[2] = htonl(b[2]); b[3] = htonl(b[3]); return; } /** * \brief Takes an IPv6 address in a, and returns in b an IPv6 address which is * one more than the IPv6 address in a. The address sent in a is in host * order, and the address in b will be returned in network order! * * \param a Pointer to an IPv6 address in host order. * \param b Pointer to an IPv6 address store in memory which has to be updated * with the new address(a + 1). */ static void AddressCutIPv6CopyAddOne(uint32_t *a, uint32_t *b) { uint32_t t = a[3]; b[0] = a[0]; b[1] = a[1]; b[2] = a[2]; b[3] = a[3]; b[3]++; if (b[3] < t) { t = b[2]; b[2]++; if (b[2] < t) { t = b[1]; b[1]++; if (b[1] < t) b[0]++; } } b[0] = htonl(b[0]); b[1] = htonl(b[1]); b[2] = htonl(b[2]); b[3] = htonl(b[3]); return; } /** * \brief Copies an IPv6 address in a to the b. The address in a is in host * order and will be copied in network order to b! * * \param a Pointer to the IPv6 address to be copied. * \param b Pointer to an IPv6 address in memory which will be updated with the * address in a. */ static void AddressCutIPv6Copy(uint32_t *a, uint32_t *b) { b[0] = htonl(a[0]); b[1] = htonl(a[1]); b[2] = htonl(a[2]); b[3] = htonl(a[3]); return; } int DetectAddressCutIPv6(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c) { uint32_t a_ip1[4] = { ntohl(a->ip.addr_data32[0]), ntohl(a->ip.addr_data32[1]), ntohl(a->ip.addr_data32[2]), ntohl(a->ip.addr_data32[3]) }; uint32_t a_ip2[4] = { ntohl(a->ip2.addr_data32[0]), ntohl(a->ip2.addr_data32[1]), ntohl(a->ip2.addr_data32[2]), ntohl(a->ip2.addr_data32[3]) }; uint32_t b_ip1[4] = { ntohl(b->ip.addr_data32[0]), ntohl(b->ip.addr_data32[1]), ntohl(b->ip.addr_data32[2]), ntohl(b->ip.addr_data32[3]) }; uint32_t b_ip2[4] = { ntohl(b->ip2.addr_data32[0]), ntohl(b->ip2.addr_data32[1]), ntohl(b->ip2.addr_data32[2]), ntohl(b->ip2.addr_data32[3]) }; DetectAddress *tmp = NULL; /* default to NULL */ *c = NULL; int r = DetectAddressCmpIPv6(a, b); if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) { goto error; } /* get a place to temporary put sigs lists */ tmp = DetectAddressInit(); if (tmp == NULL) goto error; memset(tmp,0,sizeof(DetectAddress)); /* we have 3 parts: [aaa[abab]bbb] * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ if (r == ADDRESS_LE) { AddressCutIPv6Copy(a_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(b_ip1, b->ip.addr_data32); AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32); DetectAddress *tmp_c; tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET6; AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip.addr_data32); AddressCutIPv6Copy(b_ip2, tmp_c->ip2.addr_data32); *c = tmp_c; /* we have 3 parts: [bbb[baba]aaa] * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_GE) { AddressCutIPv6Copy(b_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(a_ip1, b->ip.addr_data32); AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32); DetectAddress *tmp_c; tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET6; AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip.addr_data32); AddressCutIPv6Copy(a_ip2, tmp_c->ip2.addr_data32); *c = tmp_c; /* we have 2 or three parts: * * 2 part: [[abab]bbb] or [bbb[baba]] * part a: a_ip1 <-> a_ip2 * part b: a_ip2 + 1 <-> b_ip2 * * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * * 3 part [bbb[aaa]bbb] * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ } else if (r == ADDRESS_ES) { if (AddressIPv6EqU32(a_ip1, b_ip1) == 1) { AddressCutIPv6Copy(a_ip1, a->ip.addr_data32); AddressCutIPv6Copy(a_ip2, a->ip2.addr_data32); AddressCutIPv6CopyAddOne(a_ip2, b->ip.addr_data32); AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32); } else if (AddressIPv6EqU32(a_ip2, b_ip2) == 1) { AddressCutIPv6Copy(b_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(a_ip1, b->ip.addr_data32); AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32); } else { AddressCutIPv6Copy(b_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(a_ip1, b->ip.addr_data32); AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32); DetectAddress *tmp_c; tmp_c = DetectAddressInit(); if (tmp_c == NULL) { goto error; } tmp_c->ip.family = AF_INET6; AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip.addr_data32); AddressCutIPv6Copy(b_ip2, tmp_c->ip2.addr_data32); *c = tmp_c; } /* we have 2 or three parts: * * 2 part: [[baba]aaa] or [aaa[abab]] * part a: b_ip1 <-> b_ip2 * part b: b_ip2 + 1 <-> a_ip2 * * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> b_ip2 * * 3 part [aaa[bbb]aaa] * part a: a_ip1 <-> b_ip2 - 1 * part b: b_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_EB) { if (AddressIPv6EqU32(a_ip1, b_ip1) == 1) { AddressCutIPv6Copy(b_ip1, a->ip.addr_data32); AddressCutIPv6Copy(b_ip2, a->ip2.addr_data32); AddressCutIPv6CopyAddOne(b_ip2, b->ip.addr_data32); AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32); } else if (AddressIPv6EqU32(a_ip2, b_ip2) == 1) { AddressCutIPv6Copy(a_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(b_ip1, b->ip.addr_data32); AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32); } else { AddressCutIPv6Copy(a_ip1, a->ip.addr_data32); AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32); AddressCutIPv6Copy(b_ip1, b->ip.addr_data32); AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32); DetectAddress *tmp_c; tmp_c = DetectAddressInit(); if (tmp_c == NULL) goto error; tmp_c->ip.family = AF_INET6; AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip.addr_data32); AddressCutIPv6Copy(a_ip2, tmp_c->ip2.addr_data32); *c = tmp_c; } } if (tmp != NULL) DetectAddressFree(tmp); return 0; error: if (tmp != NULL) DetectAddressFree(tmp); return -1; } #if 0 int DetectAddressCutIPv6(DetectAddressData *a, DetectAddressData *b, DetectAddressData **c) { uint32_t a_ip1[4] = { ntohl(a->ip[0]), ntohl(a->ip[1]), ntohl(a->ip[2]), ntohl(a->ip[3]) }; uint32_t a_ip2[4] = { ntohl(a->ip2[0]), ntohl(a->ip2[1]), ntohl(a->ip2[2]), ntohl(a->ip2[3]) }; uint32_t b_ip1[4] = { ntohl(b->ip[0]), ntohl(b->ip[1]), ntohl(b->ip[2]), ntohl(b->ip[3]) }; uint32_t b_ip2[4] = { ntohl(b->ip2[0]), ntohl(b->ip2[1]), ntohl(b->ip2[2]), ntohl(b->ip2[3]) }; /* default to NULL */ *c = NULL; int r = DetectAddressCmpIPv6(a, b); if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) { goto error; } /* we have 3 parts: [aaa[abab]bbb] * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ if (r == ADDRESS_LE) { AddressCutIPv6Copy(a_ip1, a->ip); AddressCutIPv6CopySubOne(b_ip1, a->ip2); AddressCutIPv6Copy(b_ip1, b->ip); AddressCutIPv6Copy(a_ip2, b->ip2); DetectAddressData *tmp_c; tmp_c = DetectAddressDataInit(); if (tmp_c == NULL) goto error; tmp_c->family = AF_INET6; AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip); AddressCutIPv6Copy(b_ip2, tmp_c->ip2); *c = tmp_c; /* we have 3 parts: [bbb[baba]aaa] * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_GE) { AddressCutIPv6Copy(b_ip1, a->ip); AddressCutIPv6CopySubOne(a_ip1, a->ip2); AddressCutIPv6Copy(a_ip1, b->ip); AddressCutIPv6Copy(b_ip2, b->ip2); DetectAddressData *tmp_c; tmp_c = DetectAddressDataInit(); if (tmp_c == NULL) goto error; tmp_c->family = AF_INET6; AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip); AddressCutIPv6Copy(a_ip2, tmp_c->ip2); *c = tmp_c; /* we have 2 or three parts: * * 2 part: [[abab]bbb] or [bbb[baba]] * part a: a_ip1 <-> a_ip2 * part b: a_ip2 + 1 <-> b_ip2 * * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * * 3 part [bbb[aaa]bbb] * part a: b_ip1 <-> a_ip1 - 1 * part b: a_ip1 <-> a_ip2 * part c: a_ip2 + 1 <-> b_ip2 */ } else if (r == ADDRESS_ES) { if (AddressIPv6Eq(a_ip1,b_ip1) == 1) { AddressCutIPv6Copy(a_ip1, a->ip); AddressCutIPv6Copy(a_ip2, a->ip2); AddressCutIPv6CopyAddOne(a_ip2, b->ip); AddressCutIPv6Copy(b_ip2, b->ip2); } else if (AddressIPv6Eq(a_ip2, b_ip2) == 1) { AddressCutIPv6Copy(b_ip1, a->ip); AddressCutIPv6CopySubOne(a_ip1, a->ip2); AddressCutIPv6Copy(a_ip1, b->ip); AddressCutIPv6Copy(a_ip2, b->ip2); } else { AddressCutIPv6Copy(b_ip1, a->ip); AddressCutIPv6CopySubOne(a_ip1, a->ip2); AddressCutIPv6Copy(a_ip1, b->ip); AddressCutIPv6Copy(a_ip2, b->ip2); DetectAddressData *tmp_c; tmp_c = DetectAddressDataInit(); if (tmp_c == NULL) goto error; tmp_c->family = AF_INET6; AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip); AddressCutIPv6Copy(b_ip2, tmp_c->ip2); *c = tmp_c; } /* we have 2 or three parts: * * 2 part: [[baba]aaa] or [aaa[abab]] * part a: b_ip1 <-> b_ip2 * part b: b_ip2 + 1 <-> a_ip2 * * part a: a_ip1 <-> b_ip1 - 1 * part b: b_ip1 <-> b_ip2 * * 3 part [aaa[bbb]aaa] * part a: a_ip1 <-> b_ip2 - 1 * part b: b_ip1 <-> b_ip2 * part c: b_ip2 + 1 <-> a_ip2 */ } else if (r == ADDRESS_EB) { if (AddressIPv6Eq(a_ip1, b_ip1) == 1) { AddressCutIPv6Copy(b_ip1, a->ip); AddressCutIPv6Copy(b_ip2, a->ip2); AddressCutIPv6CopyAddOne(b_ip2, b->ip); AddressCutIPv6Copy(a_ip2, b->ip2); } else if (AddressIPv6Eq(a_ip2, b_ip2) == 1) { AddressCutIPv6Copy(a_ip1, a->ip); AddressCutIPv6CopySubOne(b_ip1, a->ip2); AddressCutIPv6Copy(b_ip1, b->ip); AddressCutIPv6Copy(b_ip2, b->ip2); } else { AddressCutIPv6Copy(a_ip1, a->ip); AddressCutIPv6CopySubOne(b_ip1, a->ip2); AddressCutIPv6Copy(b_ip1, b->ip); AddressCutIPv6Copy(b_ip2, b->ip2); DetectAddressData *tmp_c; tmp_c = DetectAddressDataInit(); if (tmp_c == NULL) goto error; tmp_c->family = AF_INET6; AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip); AddressCutIPv6Copy(a_ip2, tmp_c->ip2); *c = tmp_c; } } return 0; error: return -1; } #endif /** * \brief Cuts and returns an address range, which is the complement of the * address range that is supplied as the argument. * * For example: * * If a = ::-2000::, * then a = 2000::1-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF and b = NULL * If a = 2000::1-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF, * then a = ::-2000:: and b = NULL * If a = 2000::1-20FF::2, * then a = ::-2000:: and * b = 20FF::3-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF * * \param a Pointer to an address range (DetectAddress) instance whose complement * has to be returned in a and b. * \param b Pointer to DetectAddress pointer, that will be supplied back with a * new DetectAddress instance, if the complement demands so. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressCutNotIPv6(DetectAddress *a, DetectAddress **b) { uint32_t a_ip1[4] = { ntohl(a->ip.addr_data32[0]), ntohl(a->ip.addr_data32[1]), ntohl(a->ip.addr_data32[2]), ntohl(a->ip.addr_data32[3]) }; uint32_t a_ip2[4] = { ntohl(a->ip2.addr_data32[0]), ntohl(a->ip2.addr_data32[1]), ntohl(a->ip2.addr_data32[2]), ntohl(a->ip2.addr_data32[3]) }; uint32_t ip_nul[4] = { 0x00000000, 0x00000000, 0x00000000, 0x00000000 }; uint32_t ip_max[4] = { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF }; /* default to NULL */ *b = NULL; if (!(a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 && a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) && !(a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF && a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) { AddressCutIPv6Copy(ip_nul, a->ip.addr_data32); AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32); DetectAddress *tmp_b = DetectAddressInit(); if (tmp_b == NULL) goto error; tmp_b->ip.family = AF_INET6; AddressCutIPv6CopyAddOne(a_ip2, tmp_b->ip.addr_data32); AddressCutIPv6Copy(ip_max, tmp_b->ip2.addr_data32); *b = tmp_b; } else if ((a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 && a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) && !(a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF && a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) { AddressCutIPv6CopyAddOne(a_ip2, a->ip.addr_data32); AddressCutIPv6Copy(ip_max, a->ip2.addr_data32); } else if (!(a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 && a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) && (a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF && a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) { AddressCutIPv6Copy(ip_nul, a->ip.addr_data32); AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32); } else { goto error; } return 0; error: return -1; } /** * \brief Extends a target address range if the the source address range is * wider than the target address range on either sides. * * Every address is a range, i.e. address->ip1....address->ip2. For * example 2000::-2010:: * if source->ip1 is smaller than target->ip1, it indicates that the * source's left address limit is greater(range wise) than the target's * left address limit, and hence we reassign the target's left address * limit to source's left address limit. * Similary if source->ip2 is greater than target->ip2, it indicates that * the source's right address limit is greater(range wise) than the * target's right address limit, and hence we reassign the target's right * address limit to source's right address limit. * * \param de_ctx Pointer to the detection engine context. * \param target Pointer to the target DetectAddress instance that has to be * updated. * \param source Pointer to the source DetectAddress instance that is used * to decided whether we extend the target's address range. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressJoinIPv6(DetectEngineCtx *de_ctx, DetectAddress *target, DetectAddress *source) { if (AddressIPv6Lt(&source->ip, &target->ip)) { COPY_ADDRESS(&source->ip, &target->ip); } if (AddressIPv6Gt(&source->ip, &target->ip)) { COPY_ADDRESS(&source->ip2, &target->ip2); } return 0; } /***************************************Unittests******************************/ #ifdef UNITTESTS int AddressTestIPv6Gt01(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 0, 2, 3, 4 }; if (AddressIPv6GtU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Gt02(void) { int result = 0; uint32_t a[4] = { 0, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6GtU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Gt03(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6GtU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Gt04(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 5 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6GtU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Lt01(void) { int result = 0; uint32_t a[4] = { 0, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6LtU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Lt02(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 0, 2, 3, 4 }; if (AddressIPv6LtU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Lt03(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6LtU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Lt04(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 5 }; if (AddressIPv6LtU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Eq01(void) { int result = 0; uint32_t a[4] = { 0, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6EqU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Eq02(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 0, 2, 3, 4 }; if (AddressIPv6EqU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Eq03(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6EqU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Eq04(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 5 }; if (AddressIPv6EqU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Le01(void) { int result = 0; uint32_t a[4] = { 0, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6LeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Le02(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 0, 2, 3, 4 }; if (AddressIPv6LeU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Le03(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6LeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Le04(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 5 }; if (AddressIPv6LeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Le05(void) { int result = 0; uint32_t a[4]; uint32_t b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1) return 0; memcpy(&a, &in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(&b, &in6.s6_addr, sizeof(in6.s6_addr)); if (AddressIPv6LeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Ge01(void) { int result = 0; uint32_t a[4] = { 0, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6GeU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Ge02(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 0, 2, 3, 4 }; if (AddressIPv6GeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Ge03(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 4 }; if (AddressIPv6GeU32(a, b) == 1) result = 1; return result; } int AddressTestIPv6Ge04(void) { int result = 0; uint32_t a[4] = { 1, 2, 3, 4 }; uint32_t b[4] = { 1, 2, 3, 5 }; if (AddressIPv6GeU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6Ge05(void) { int result = 0; uint32_t a[4]; uint32_t b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1) return 0; memcpy(&a, &in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(&b, &in6.s6_addr, sizeof(in6.s6_addr)); if (AddressIPv6GeU32(a, b) == 0) result = 1; return result; } int AddressTestIPv6SubOne01(void) { int result = 0; uint32_t a[4], b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "2000::1", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); a[0] = ntohl(a[0]); a[1] = ntohl(a[1]); a[2] = ntohl(a[2]); a[3] = ntohl(a[3]); AddressCutIPv6CopySubOne(a, b); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); if (b[0] == a[0] && b[1] == a[1] && b[2] == a[2] && b[3] == a[3]) { result = 1; } return result; } int AddressTestIPv6SubOne02(void) { int result = 0; uint32_t a[4], b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); a[0] = ntohl(a[0]); a[1] = ntohl(a[1]); a[2] = ntohl(a[2]); a[3] = ntohl(a[3]); AddressCutIPv6CopySubOne(a, b); if (inet_pton(AF_INET6, "1FFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); if (b[0] == a[0] && b[1] == a[1] && b[2] == a[2] && b[3] == a[3]) { result = 1; } return result; } int AddressTestIPv6AddOne01(void) { int result = 0; uint32_t a[4], b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); a[0] = ntohl(a[0]); a[1] = ntohl(a[1]); a[2] = ntohl(a[2]); a[3] = ntohl(a[3]); AddressCutIPv6CopyAddOne(a, b); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); if (b[0] == a[0] && b[1] == a[1] && b[2] == a[2] && b[3] == a[3]) { result = 1; } return result; } int AddressTestIPv6AddOne02(void) { int result = 0; uint32_t a[4], b[4]; struct in6_addr in6; if (inet_pton(AF_INET6, "1FFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); a[0] = ntohl(a[0]); a[1] = ntohl(a[1]); a[2] = ntohl(a[2]); a[3] = ntohl(a[3]); AddressCutIPv6CopyAddOne(a, b); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) return 0; memcpy(a, in6.s6_addr, sizeof(in6.s6_addr)); if (b[0] == a[0] && b[1] == a[1] && b[2] == a[2] && b[3] == a[3]) { result = 1; } return result; } static int AddressTestIPv6AddressCmp01(void) { DetectAddress *a = DetectAddressInit(); DetectAddress *b = DetectAddressInit(); struct in6_addr in6; int result = 1; if (a == NULL || b == NULL) goto error; if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_EQ); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_ES); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_ES); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_ES); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_ES); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_ES); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_EB); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_EB); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_EB); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::11", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_EB); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_LE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_LE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LE); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_LE); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_LT); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); /* we could get a LE */ result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LT); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); /* we could get a LE */ result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LT); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::19", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LT); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LT); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_LT); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_GE); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_GE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_GE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_GE); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::19", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_GE); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_GE); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) == ADDRESS_GT); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_GT); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCmpIPv6(a, b) != ADDRESS_GT); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int AddressTestIPv6CutNot01(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; struct in6_addr in6; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET6, "::", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCutNotIPv6(a, &b) == -1); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); return 0; } static int AddressTestIPv6CutNot02(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; DetectAddress *temp = NULL; struct in6_addr in6; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if ( (temp = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET6, "::", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCutNotIPv6(a, &b) == 0); result &= (b == NULL); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(a, temp) == ADDRESS_EQ); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return 0; } static int AddressTestIPv6CutNot03(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; DetectAddress *temp = NULL; struct in6_addr in6; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if ( (temp = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCutNotIPv6(a, &b) == 0); result &= (b == NULL); if (inet_pton(AF_INET6, "::", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(a, temp) == ADDRESS_EQ); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return 0; } static int AddressTestIPv6CutNot04(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; DetectAddress *temp = NULL; struct in6_addr in6; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if ( (temp = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCutNotIPv6(a, &b) == 0); if (inet_pton(AF_INET6, "::", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(a, temp) == ADDRESS_EQ); result &= (b != NULL); if (result == 0) goto error; if (inet_pton(AF_INET6, "2000::2", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(b, temp) == ADDRESS_EQ); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return 0; } static int AddressTestIPv6CutNot05(void) { DetectAddress *a = NULL; DetectAddress *b = NULL; DetectAddress *temp = NULL; struct in6_addr in6; int result = 1; if ( (a = DetectAddressInit()) == NULL) goto error; if ( (temp = DetectAddressInit()) == NULL) goto error; if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressCutNotIPv6(a, &b) == 0); if (inet_pton(AF_INET6, "::", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::0", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(a, temp) == ADDRESS_EQ); result &= (b != NULL); if (result == 0) goto error; if (inet_pton(AF_INET6, "2000::21", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(b, temp) == ADDRESS_EQ); if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return result; error: if (a != NULL) DetectAddressFree(a); if (b != NULL) DetectAddressFree(b); if (temp != NULL) DetectAddressFree(temp); return 0; } static int AddressTestIPv6Join01(void) { DetectAddress *source = DetectAddressInit(); DetectAddress *target = DetectAddressInit(); DetectAddress *temp = DetectAddressInit(); struct in6_addr in6; int result = 1; if (source == NULL || target == NULL || temp == NULL) goto error; /* case 1 */ if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&target->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&target->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&source->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&source->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressJoinIPv6(NULL, target, source) == 0); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(target, temp) == ADDRESS_EQ); /* case 2 */ if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&target->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&target->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::2", &in6) != 1) goto error; memcpy(&source->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::19", &in6) != 1) goto error; memcpy(&source->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressJoinIPv6(NULL, target, source) == 0); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(target, temp) == ADDRESS_EQ); /* case 3 */ if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&target->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::15", &in6) != 1) goto error; memcpy(&target->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&source->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&source->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressJoinIPv6(NULL, target, source) == 0); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(target, temp) == ADDRESS_EQ); /* case 4 */ if (inet_pton(AF_INET6, "2000::10", &in6) != 1) goto error; memcpy(&target->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&target->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&source->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&source->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressJoinIPv6(NULL, target, source) == 0); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(target, temp) == ADDRESS_EQ); /* case 5 */ if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&target->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&target->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&source->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&source->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result &= (DetectAddressJoinIPv6(NULL, target, source) == 0); if (inet_pton(AF_INET6, "2000::1", &in6) != 1) goto error; memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr)); if (inet_pton(AF_INET6, "2000::20", &in6) != 1) goto error; memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr)); result = (DetectAddressCmpIPv6(target, temp) == ADDRESS_EQ); if (source != NULL) DetectAddressFree(source); if (target != NULL) DetectAddressFree(target); if (temp != NULL) DetectAddressFree(temp); return result; error: if (source != NULL) DetectAddressFree(source); if (target != NULL) DetectAddressFree(target); if (temp != NULL) DetectAddressFree(temp); return 0; } #endif /* UNITTESTS */ void DetectAddressIPv6Tests(void) { #ifdef UNITTESTS UtRegisterTest("AddressTestIPv6Gt01", AddressTestIPv6Gt01); UtRegisterTest("AddressTestIPv6Gt02", AddressTestIPv6Gt02); UtRegisterTest("AddressTestIPv6Gt03", AddressTestIPv6Gt03); UtRegisterTest("AddressTestIPv6Gt04", AddressTestIPv6Gt04); UtRegisterTest("AddressTestIPv6Lt01", AddressTestIPv6Lt01); UtRegisterTest("AddressTestIPv6Lt02", AddressTestIPv6Lt02); UtRegisterTest("AddressTestIPv6Lt03", AddressTestIPv6Lt03); UtRegisterTest("AddressTestIPv6Lt04", AddressTestIPv6Lt04); UtRegisterTest("AddressTestIPv6Eq01", AddressTestIPv6Eq01); UtRegisterTest("AddressTestIPv6Eq02", AddressTestIPv6Eq02); UtRegisterTest("AddressTestIPv6Eq03", AddressTestIPv6Eq03); UtRegisterTest("AddressTestIPv6Eq04", AddressTestIPv6Eq04); UtRegisterTest("AddressTestIPv6Le01", AddressTestIPv6Le01); UtRegisterTest("AddressTestIPv6Le02", AddressTestIPv6Le02); UtRegisterTest("AddressTestIPv6Le03", AddressTestIPv6Le03); UtRegisterTest("AddressTestIPv6Le04", AddressTestIPv6Le04); UtRegisterTest("AddressTestIPv6Le05", AddressTestIPv6Le05); UtRegisterTest("AddressTestIPv6Ge01", AddressTestIPv6Ge01); UtRegisterTest("AddressTestIPv6Ge02", AddressTestIPv6Ge02); UtRegisterTest("AddressTestIPv6Ge03", AddressTestIPv6Ge03); UtRegisterTest("AddressTestIPv6Ge04", AddressTestIPv6Ge04); UtRegisterTest("AddressTestIPv6Ge05", AddressTestIPv6Ge05); UtRegisterTest("AddressTestIPv6SubOne01", AddressTestIPv6SubOne01); UtRegisterTest("AddressTestIPv6SubOne02", AddressTestIPv6SubOne02); UtRegisterTest("AddressTestIPv6AddOne01", AddressTestIPv6AddOne01); UtRegisterTest("AddressTestIPv6AddOne02", AddressTestIPv6AddOne02); UtRegisterTest("AddressTestIPv6AddressCmp01", AddressTestIPv6AddressCmp01); UtRegisterTest("AddressTestIPv6CutNot01", AddressTestIPv6CutNot01); UtRegisterTest("AddressTestIPv6CutNot02", AddressTestIPv6CutNot02); UtRegisterTest("AddressTestIPv6CutNot03", AddressTestIPv6CutNot03); UtRegisterTest("AddressTestIPv6CutNot04", AddressTestIPv6CutNot04); UtRegisterTest("AddressTestIPv6CutNot05", AddressTestIPv6CutNot05); UtRegisterTest("AddressTestIPv6Join01", AddressTestIPv6Join01); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/detect-seq.h0000644000000000000000000000210113051004444013202 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_SEQ_H__ #define __DETECT_SEQ_H__ /** * \brief seq data */ typedef struct DetectSeqData_ { uint32_t seq; /**< seq to match */ } DetectSeqData; /** * \brief Registration function for ack: keyword */ void DetectSeqRegister(void); #endif /* __DETECT_SEQ_H__ */ suricata-3.2.1/src/detect-dce-iface.c0000644000000000000000000015453413051004444014227 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements dce_iface keyword. */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-dce-iface.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "app-layer.h" #include "app-layer-dcerpc.h" #include "queue.h" #include "stream-tcp-reassemble.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "stream-tcp.h" #define PARSE_REGEX "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$" static pcre *parse_regex = NULL; static pcre_extra *parse_regex_study = NULL; int DetectDceIfaceMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectDceIfaceSetup(DetectEngineCtx *, Signature *, char *); void DetectDceIfaceFree(void *); /** * \brief Registers the keyword handlers for the "dce_iface" keyword. */ void DetectDceIfaceRegister(void) { sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface"; sigmatch_table[DETECT_DCE_IFACE].Match = NULL; sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch; sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup; sigmatch_table[DETECT_DCE_IFACE].Free = DetectDceIfaceFree; sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests; sigmatch_table[DETECT_DCE_IFACE].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \internal * \brief Parses the argument sent along with the "dce_iface" keyword. * * \param arg Pointer to the string containing the argument to be parsed. * * \retval did Pointer to a DetectDceIfaceData instance that holds the data * from the parsed arg. */ static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg) { DetectDceIfaceData *did = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; uint8_t hex_value; char copy_str[128] = ""; int i = 0, j = 0; int len = 0; char temp_str[3] = ""; int version; ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg); goto error; } if ( (did = SCMalloc(sizeof(DetectDceIfaceData))) == NULL) goto error; memset(did, 0, sizeof(DetectDceIfaceData)); /* retrieve the iface uuid string. iface uuid is a compulsion in the keyword */ res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 1, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } /* parse the iface uuid string */ len = strlen(copy_str); j = 0; temp_str[2] = '\0'; for (i = 0; i < len; ) { if (copy_str[i] == '-') { i++; continue; } temp_str[0] = copy_str[i]; temp_str[1] = copy_str[i + 1]; hex_value = strtol(temp_str, NULL, 16); did->uuid[j] = hex_value; i += 2; j++; } /* if the regex has 3 or 5, any_frag option is present in the signature */ if (ret == 3 || ret == 5) did->any_frag = 1; /* if the regex has 4 or 5, version/operator is present in the signature */ if (ret == 4 || ret == 5) { /* first handle the version number, so that we can do some additional * validations of the version number, wrt. the operator */ res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 3, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } version = atoi(copy_str); if (version > UINT16_MAX) { SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface version " "invalid: %d\n", version); goto error; } did->version = version; /* now let us handle the operator supplied with the version number */ res = pcre_copy_substring(arg, ov, MAX_SUBSTRINGS, 2, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } switch (copy_str[0]) { case '<': if (version == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface " "version invalid: %d. Version can't be less" "than 0, with \"<\" operator", version); goto error; } did->op = DETECT_DCE_IFACE_OP_LT; break; case '>': if (version == UINT16_MAX) { SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface " "version invalid: %d. Version can't be greater" "than %d, with \">\" operator", version, UINT16_MAX); goto error; } did->op = DETECT_DCE_IFACE_OP_GT; break; case '=': did->op = DETECT_DCE_IFACE_OP_EQ; break; case '!': did->op = DETECT_DCE_IFACE_OP_NE; break; } } return did; error: if (did != NULL) SCFree(did); return NULL; } /** * \internal * \brief Internal function that compares the dce interface version for this * flow, to the signature's interface version specified using the * dce_iface keyword. * * \param version The dce interface version for this flow. * \param dce_data Pointer to the Signature's dce_iface keyword * state(DetectDceIfaceData *). */ static inline int DetectDceIfaceMatchIfaceVersion(uint16_t version, DetectDceIfaceData *dce_data) { switch (dce_data->op) { case DETECT_DCE_IFACE_OP_LT: return (version < dce_data->version); case DETECT_DCE_IFACE_OP_GT: return (version > dce_data->version); case DETECT_DCE_IFACE_OP_EQ: return (version == dce_data->version); case DETECT_DCE_IFACE_OP_NE: return (version != dce_data->version); default: return 1; } } /** * \brief App layer match function for the "dce_iface" keyword. * * \param t Pointer to the ThreadVars instance. * \param det_ctx Pointer to the DetectEngineThreadCtx. * \param f Pointer to the flow. * \param flags Pointer to the flags indicating the flow direction. * \param state Pointer to the app layer state data. * \param s Pointer to the Signature instance. * \param m Pointer to the SigMatch. * * \retval 1 On Match. * \retval 0 On no match. */ int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; DCERPCUuidEntry *item = NULL; int i = 0; DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m->ctx; DCERPCState *dcerpc_state = (DCERPCState *)state; if (dcerpc_state == NULL) { SCLogDebug("No DCERPCState for the flow"); SCReturnInt(0); } /* we still haven't seen a request */ if (!dcerpc_state->dcerpc.dcerpcrequest.first_request_seen) goto end; if (!(dcerpc_state->dcerpc.dcerpchdr.type == REQUEST)) goto end; TAILQ_FOREACH(item, &dcerpc_state->dcerpc.dcerpcbindbindack.accepted_uuid_list, next) { SCLogDebug("item %p", item); ret = 1; /* if any_frag is not enabled, we need to match only against the first * fragment */ if (!dce_data->any_frag && !(item->flags & DCERPC_UUID_ENTRY_FLAG_FF)) continue; /* if the uuid has been rejected(item->result == 1), we skip to the * next uuid */ if (item->result != 0) continue; /* check the interface uuid */ for (i = 0; i < 16; i++) { if (dce_data->uuid[i] != item->uuid[i]) { ret = 0; break; } } ret &= (item->ctxid == dcerpc_state->dcerpc.dcerpcrequest.ctxid); if (ret == 0) continue; /* check the interface version */ if (dce_data->op != DETECT_DCE_IFACE_OP_NONE && !DetectDceIfaceMatchIfaceVersion(item->version, dce_data)) { ret &= 0; } /* we have a match. Time to leave with a match */ if (ret == 1) goto end; } end: SCReturnInt(ret); } /** * \brief Creates a SigMatch for the "dce_iface" keyword being sent as argument, * and appends it to the Signature(s). * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param arg Pointer to the string holding the keyword value. * * \retval 0 on success, -1 on failure. */ static int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectDceIfaceData *did = NULL; SigMatch *sm = NULL; did = DetectDceIfaceArgParse(arg); if (did == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dec_iface option in " "signature"); goto error; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_DCE_IFACE; sm->ctx = (void *)did; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->alproto = ALPROTO_DCERPC; /* Flagged the signature as to inspect the app layer data */ s->flags |= SIG_FLAG_APPLAYER; return 0; error: DetectDceIfaceFree(did); if (sm != NULL) SCFree(sm); return -1; } void DetectDceIfaceFree(void *ptr) { SCFree(ptr); return; } /************************************Unittests*********************************/ #ifdef UNITTESTS static int DetectDceIfaceTestParse01(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 0); result &= (did->op == 0); result &= (did->any_frag == 0); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse02(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 1); result &= (did->op == DETECT_DCE_IFACE_OP_GT); result &= (did->any_frag == 0); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse03(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<10") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 10); result &= (did->op == DETECT_DCE_IFACE_OP_LT); result &= (did->any_frag == 0); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse04(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!10") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 10); result &= (did->op == DETECT_DCE_IFACE_OP_NE); result &= (did->any_frag == 0); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse05(void) { SCEnter(); Signature *s = SigAlloc(); int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=10") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 10); result &= (did->op == DETECT_DCE_IFACE_OP_EQ); result &= (did->any_frag == 0); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse06(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 0); result &= (did->op == 0); result &= (did->any_frag == 1); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse07(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 1); result &= (did->op == DETECT_DCE_IFACE_OP_GT); result &= (did->any_frag == 1); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse08(void) { Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 1); result &= (did->op == DETECT_DCE_IFACE_OP_LT); result &= (did->any_frag == 1); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse09(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0); temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 1); result &= (did->op == DETECT_DCE_IFACE_OP_EQ); result &= (did->any_frag == 1); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse10(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 0; DetectDceIfaceData *did = NULL; uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}; SigMatch *temp = NULL; int i = 0; result = (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) { SCReturnInt(0); } temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; did = (DetectDceIfaceData *)temp->ctx; if (did == NULL) { SCReturnInt(0); } result &= 1; for (i = 0; i < 16; i++) { if (did->uuid[i] != test_uuid[i]) { result = 0; break; } } result &= (did->version == 1); result &= (did->op == DETECT_DCE_IFACE_OP_NE); result &= (did->any_frag == 1); SigFree(s); SCReturnInt(result); } static int DetectDceIfaceTestParse11(void) { SCEnter(); Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 1; result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,<0,any_frag") == -1); result &= (DetectDceIfaceSetup(NULL, s, "12345678-1234-1234-1234-123456789ABC,>65535,any_frag") == -1); SigFree(s); return result; } /** * \test Test a valid dce_iface entry for a bind and bind_ack */ static int DetectDceIfaceTestParse12(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x26, 0x3d, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5,=0,any_frag; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SCLogDebug("handling to_server chunk"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 didn't match (1): "); goto end; } SCLogDebug("handling to_client chunk"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched, but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 matched, but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 /** * \test Test a valid dce_iface entry with a bind, bind_ack and 3 request/responses. */ static int DetectDceIfaceTestParse13(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31, 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); uint32_t dcerpc_request3_len = sizeof(dcerpc_request3); uint32_t dcerpc_response3_len = sizeof(dcerpc_response3); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_iface:338cd001-2244-31f1-aaaa-900038001003,=1,any_frag; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SCLogDebug("chunk 1, bind"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 didn't match after bind request: "); goto end; } SCLogDebug("chunk 2, bind_ack"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched again after bind ack: "); goto end; } SCLogDebug("chunk 3, request 1"); /* request1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't match after request1: "); goto end; } SCLogDebug("sending response1"); /* response1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched after response1, but shouldn't: "); goto end; } SCLogDebug("sending request2"); /* request2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't match after request2: "); goto end; } /* response2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response2, dcerpc_response2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched after response2, but shouldn't have: "); goto end; } /* request3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request3, dcerpc_request3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't match after request3: "); goto end; } /* response3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response3, dcerpc_response3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched after response3, but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } #endif /** * \test Test a valid dce_iface entry for a bind and bind_ack */ static int DetectDceIfaceTestParse14(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x26, 0x3d, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xad, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5,=0; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_iface entry for a bind and bind_ack */ static int DetectDceIfaceTestParse15(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint8_t dcerpc_alter_context[] = { 0x05, 0x00, 0x0e, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0xd0, 0x4c, 0x67, 0x57, 0x00, 0x52, 0xce, 0x11, 0xa8, 0x97, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t dcerpc_alter_context_len = sizeof(dcerpc_alter_context); uint8_t dcerpc_alter_context_resp[] = { 0x05, 0x00, 0x0f, 0x03, 0x10, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t dcerpc_alter_context_resp_len = sizeof(dcerpc_alter_context_resp); uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x20, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xdd, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf5, 0x66, 0xbf, 0x54, 0xc4, 0xdb, 0xdb, 0x4f, 0xa0, 0x01, 0x6d, 0xf4, 0xf6, 0xa8, 0x44, 0xb3, 0x00, 0x00, 0x00, 0x00 }; uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, }; uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_iface:57674cd0-5200-11ce-a897-08002b2e9c6d; " "sid:1;)"); if (s == NULL) goto end; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_iface:342cfd40-3c6c-11ce-a893-08002b2e9c6d; " "sid:2;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; if (PacketAlertCheck(p, 2)) goto end; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_alter_context, dcerpc_alter_context_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_alter_context_resp, dcerpc_alter_context_resp_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't have: "); goto end; } if (!PacketAlertCheck(p, 2)) { printf("sig 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif void DetectDceIfaceRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDceIfaceTestParse01", DetectDceIfaceTestParse01); UtRegisterTest("DetectDceIfaceTestParse02", DetectDceIfaceTestParse02); UtRegisterTest("DetectDceIfaceTestParse03", DetectDceIfaceTestParse03); UtRegisterTest("DetectDceIfaceTestParse04", DetectDceIfaceTestParse04); UtRegisterTest("DetectDceIfaceTestParse05", DetectDceIfaceTestParse05); UtRegisterTest("DetectDceIfaceTestParse06", DetectDceIfaceTestParse06); UtRegisterTest("DetectDceIfaceTestParse07", DetectDceIfaceTestParse07); UtRegisterTest("DetectDceIfaceTestParse08", DetectDceIfaceTestParse08); UtRegisterTest("DetectDceIfaceTestParse09", DetectDceIfaceTestParse09); UtRegisterTest("DetectDceIfaceTestParse10", DetectDceIfaceTestParse10); UtRegisterTest("DetectDceIfaceTestParse11", DetectDceIfaceTestParse11); UtRegisterTest("DetectDceIfaceTestParse12", DetectDceIfaceTestParse12); /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 UtRegisterTest("DetectDceIfaceTestParse13", DetectDceIfaceTestParse13, 1); #endif UtRegisterTest("DetectDceIfaceTestParse14", DetectDceIfaceTestParse14); UtRegisterTest("DetectDceIfaceTestParse15", DetectDceIfaceTestParse15); #endif return; } suricata-3.2.1/src/util-checksum.c0000644000000000000000000000622413051004444013726 00000000000000/* Copyright (C) 2011-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Util functions for checskum. */ #include "suricata-common.h" #include "util-checksum.h" int ReCalculateChecksum(Packet *p) { if (PKT_IS_IPV4(p)) { if (PKT_IS_TCP(p)) { /* TCP */ p->tcph->th_sum = 0; p->tcph->th_sum = TCPCalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); } else if (PKT_IS_UDP(p)) { p->udph->uh_sum = 0; p->udph->uh_sum = UDPV4CalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN)); } /* IPV4 */ p->ip4h->ip_csum = 0; p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h, IPV4_GET_RAW_HLEN(p->ip4h)); } else if (PKT_IS_IPV6(p)) { /* just TCP for IPV6 */ if (PKT_IS_TCP(p)) { p->tcph->th_sum = 0; p->tcph->th_sum = TCPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); } else if (PKT_IS_UDP(p)) { p->udph->uh_sum = 0; p->udph->uh_sum = UDPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN)); } } return 0; } /** * \brief Check if the number of invalid checksums indicate checksum * offloading in place. * * \retval 1 yes, offloading in place * \retval 0 no, no offloading used */ int ChecksumAutoModeCheck(uint32_t thread_count, unsigned int iface_count, unsigned int iface_fail) { if (thread_count == CHECKSUM_SAMPLE_COUNT) { if (iface_fail != 0) { if ((iface_count / iface_fail) < CHECKSUM_INVALID_RATIO) { SCLogInfo("More than 1/%dth of packets have an invalid " "checksum, assuming checksum offloading is used (%u/%u)", CHECKSUM_INVALID_RATIO, iface_fail, iface_count); return 1; } else { SCLogInfo("Less than 1/%dth of packets have an invalid " "checksum, assuming checksum offloading is NOT used (%u/%u)", CHECKSUM_INVALID_RATIO, iface_fail, iface_count); } } else { SCLogInfo("No packets with invalid checksum, assuming checksum offloading is NOT used"); } } return 0; } suricata-3.2.1/src/host-queue.h0000644000000000000000000000441113051004444013251 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HOST_QUEUE_H__ #define __HOST_QUEUE_H__ #include "suricata-common.h" #include "host.h" /** Spinlocks or Mutex for the host queues. */ //#define HQLOCK_SPIN #define HQLOCK_MUTEX #ifdef HQLOCK_SPIN #ifdef HQLOCK_MUTEX #error Cannot enable both HQLOCK_SPIN and HQLOCK_MUTEX #endif #endif /* Define a queue for storing hosts */ typedef struct HostQueue_ { Host *top; Host *bot; uint32_t len; #ifdef DBG_PERF uint32_t dbg_maxlen; #endif /* DBG_PERF */ #ifdef HQLOCK_MUTEX SCMutex m; #elif defined HQLOCK_SPIN SCSpinlock s; #else #error Enable HQLOCK_SPIN or HQLOCK_MUTEX #endif } HostQueue; #ifdef HQLOCK_SPIN #define HQLOCK_INIT(q) SCSpinInit(&(q)->s, 0) #define HQLOCK_DESTROY(q) SCSpinDestroy(&(q)->s) #define HQLOCK_LOCK(q) SCSpinLock(&(q)->s) #define HQLOCK_TRYLOCK(q) SCSpinTrylock(&(q)->s) #define HQLOCK_UNLOCK(q) SCSpinUnlock(&(q)->s) #elif defined HQLOCK_MUTEX #define HQLOCK_INIT(q) SCMutexInit(&(q)->m, NULL) #define HQLOCK_DESTROY(q) SCMutexDestroy(&(q)->m) #define HQLOCK_LOCK(q) SCMutexLock(&(q)->m) #define HQLOCK_TRYLOCK(q) SCMutexTrylock(&(q)->m) #define HQLOCK_UNLOCK(q) SCMutexUnlock(&(q)->m) #else #error Enable HQLOCK_SPIN or HQLOCK_MUTEX #endif /* prototypes */ HostQueue *HostQueueNew(); HostQueue *HostQueueInit(HostQueue *); void HostQueueDestroy (HostQueue *); void HostEnqueue (HostQueue *, Host *); Host *HostDequeue (HostQueue *); uint32_t HostQueueLen(HostQueue *); #endif /* __HOST_QUEUE_H__ */ suricata-3.2.1/src/detect-base64-data.c0000644000000000000000000001776713051004444014430 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "detect.h" #include "detect-engine-content-inspection.h" #include "detect-parse.h" #include "util-unittest.h" static int DetectBase64DataSetup(DetectEngineCtx *, Signature *, char *); static void DetectBase64DataRegisterTests(void); void DetectBase64DataRegister(void) { sigmatch_table[DETECT_BASE64_DATA].name = "base64_data"; sigmatch_table[DETECT_BASE64_DATA].desc = "Content match base64 decoded data."; sigmatch_table[DETECT_BASE64_DATA].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#base64-data"; sigmatch_table[DETECT_BASE64_DATA].Setup = DetectBase64DataSetup; sigmatch_table[DETECT_BASE64_DATA].RegisterTests = DetectBase64DataRegisterTests; sigmatch_table[DETECT_BASE64_DATA].flags |= SIGMATCH_NOOPT; } static int DetectBase64DataSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { SigMatch *pm = NULL; /* Check for a preceding base64_decode. */ pm = SigMatchGetLastSMFromLists(s, 28, DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BASE64_DECODE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"base64_data\" keyword seen without preceding base64_decode."); return -1; } s->list = DETECT_SM_LIST_BASE64_DATA; return 0; } int DetectBase64DataDoMatch(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f) { if (det_ctx->base64_decoded_len) { return DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_BASE64_DATA], f, det_ctx->base64_decoded, det_ctx->base64_decoded_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } return 0; } #ifdef UNITTESTS #include "detect-engine.h" static int DetectBase64DataSetupTest01(void) { DetectEngineCtx *de_ctx = NULL; SigMatch *sm; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any (msg:\"DetectBase64DataSetupTest\"; " "base64_decode; base64_data; content:\"content\"; sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { printf("SigInit failed: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { printf("DETECT_SM_LIST_PMATCH should not be NULL: "); goto end; } if (sm->type != DETECT_BASE64_DECODE) { printf("sm->type should be DETECT_BASE64_DECODE: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_BASE64_DATA] == NULL) { printf("DETECT_SM_LIST_BASE64_DATA should not be NULL: "); goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } static int DetectBase64DataSetupTest02(void) { DetectEngineCtx *de_ctx = NULL; SigMatch *sm; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any ( " "msg:\"DetectBase64DataSetupTest\"; " "file_data; " "content:\"SGV\"; " "base64_decode: bytes 16; " "base64_data; " "content:\"content\"; " "sid:1; rev:1;)"); if (de_ctx->sig_list == NULL) { printf("SigInit failed: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm != NULL) { printf("DETECT_SM_LIST_PMATCH is not NULL: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { printf("DETECT_SM_LIST_FILEDATA is NULL: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_BASE64_DATA]; if (sm == NULL) { printf("DETECT_SM_LIST_BASE64_DATA is NULL: "); goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } /** * \test Test that the rule fails to load if the detection list is * changed after base64_data. */ static int DetectBase64DataSetupTest03(void) { DetectEngineCtx *de_ctx = NULL; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any ( " "msg:\"DetectBase64DataSetupTest\"; " "base64_decode: bytes 16; " "base64_data; " "content:\"content\"; " "file_data; " "content:\"SGV\"; " "sid:1; rev:1;)"); if (de_ctx->sig_list != NULL) { printf("SigInit should have failed: "); goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } /** * \test Test that the list can be changed to post-detection lists * after the base64 keyword. */ static int DetectBase64DataSetupTest04(void) { DetectEngineCtx *de_ctx = NULL; int retval = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"some b64thing\"; flow:established,from_server; file_data; content:\"sometext\"; fast_pattern; base64_decode:relative; base64_data; content:\"foobar\"; nocase; tag:session,120,seconds; sid:1111111; rev:1;)"); if (de_ctx->sig_list == NULL) { printf("SigInit failed: "); goto end; } retval = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return retval; } #endif static void DetectBase64DataRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectBase64DataSetupTest01", DetectBase64DataSetupTest01); UtRegisterTest("DetectBase64DataSetupTest02", DetectBase64DataSetupTest02); UtRegisterTest("DetectBase64DataSetupTest03", DetectBase64DataSetupTest03); UtRegisterTest("DetectBase64DataSetupTest04", DetectBase64DataSetupTest04); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-file.c0000644000000000000000000002143613051004444014377 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Log files we track. * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threadvars.h" #include "tm-modules.h" #include "threads.h" #include "app-layer-parser.h" #include "detect-filemagic.h" #include "stream.h" #include "util-print.h" #include "util-unittest.h" #include "util-privs.h" #include "util-debug.h" #include "util-atomic.h" #include "util-file.h" #include "util-time.h" #include "util-buffer.h" #include "util-byte.h" #include "log-file.h" #include "util-logopenfile.h" #include "output.h" #include "output-json.h" #include "output-json-http.h" #include "output-json-smtp.h" #include "output-json-email-common.h" #include "app-layer-htp.h" #include "util-memcmp.h" #include "stream-tcp-reassemble.h" #ifdef HAVE_LIBJANSSON typedef struct OutputFileCtx_ { LogFileCtx *file_ctx; uint32_t file_cnt; } OutputFileCtx; typedef struct JsonFileLogThread_ { OutputFileCtx *filelog_ctx; MemBuffer *buffer; } JsonFileLogThread; /** * \internal * \brief Write meta data on a single line json record */ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const File *ff) { json_t *js = CreateJSONHeader((Packet *)p, 0, "fileinfo"); //TODO const json_t *hjs = NULL; if (unlikely(js == NULL)) return; /* reset */ MemBufferReset(aft->buffer); switch (p->flow->alproto) { case ALPROTO_HTTP: hjs = JsonHttpAddMetadata(p->flow, ff->txid); if (hjs) json_object_set_new(js, "http", hjs); break; case ALPROTO_SMTP: hjs = JsonSMTPAddMetadata(p->flow, ff->txid); if (hjs) json_object_set_new(js, "smtp", hjs); hjs = JsonEmailAddMetadata(p->flow, ff->txid); if (hjs) json_object_set_new(js, "email", hjs); break; } json_object_set_new(js, "app_proto", json_string(AppProtoToString(p->flow->alproto))); json_t *fjs = json_object(); if (unlikely(fjs == NULL)) { json_decref(js); return; } char *s = BytesToString(ff->name, ff->name_len); json_object_set_new(fjs, "filename", json_string(s)); if (s != NULL) SCFree(s); #ifdef HAVE_MAGIC if (ff->magic) json_object_set_new(fjs, "magic", json_string((char *)ff->magic)); #endif switch (ff->state) { case FILE_STATE_CLOSED: json_object_set_new(fjs, "state", json_string("CLOSED")); #ifdef HAVE_NSS if (ff->flags & FILE_MD5) { size_t x; int i; char str[256]; for (i = 0, x = 0; x < sizeof(ff->md5); x++) { i += snprintf(&str[i], 255-i, "%02x", ff->md5[x]); } json_object_set_new(fjs, "md5", json_string(str)); } if (ff->flags & FILE_SHA1) { size_t x; int i; char str[256]; for (i = 0, x = 0; x < sizeof(ff->sha1); x++) { i += snprintf(&str[i], 255-i, "%02x", ff->sha1[x]); } json_object_set_new(fjs, "sha1", json_string(str)); } if (ff->flags & FILE_SHA256) { size_t x; int i; char str[256]; for (i = 0, x = 0; x < sizeof(ff->sha256); x++) { i += snprintf(&str[i], 255-i, "%02x", ff->sha256[x]); } json_object_set_new(fjs, "sha256", json_string(str)); } #endif break; case FILE_STATE_TRUNCATED: json_object_set_new(fjs, "state", json_string("TRUNCATED")); break; case FILE_STATE_ERROR: json_object_set_new(fjs, "state", json_string("ERROR")); break; default: json_object_set_new(fjs, "state", json_string("UNKNOWN")); break; } json_object_set_new(fjs, "stored", (ff->flags & FILE_STORED) ? json_true() : json_false()); if (ff->flags & FILE_STORED) { json_object_set_new(fjs, "file_id", json_integer(ff->file_id)); } json_object_set_new(fjs, "size", json_integer(FileTrackedSize(ff))); json_object_set_new(fjs, "tx_id", json_integer(ff->txid)); /* originally just 'file', but due to bug 1127 naming it fileinfo */ json_object_set_new(js, "fileinfo", fjs); OutputJSONBuffer(js, aft->filelog_ctx->file_ctx, &aft->buffer); json_object_del(js, "fileinfo"); switch (p->flow->alproto) { case ALPROTO_HTTP: json_object_del(js, "http"); break; case ALPROTO_SMTP: json_object_del(js, "smtp"); json_object_del(js, "email"); break; } json_object_clear(js); json_decref(js); } static int JsonFileLogger(ThreadVars *tv, void *thread_data, const Packet *p, const File *ff) { SCEnter(); JsonFileLogThread *aft = (JsonFileLogThread *)thread_data; BUG_ON(ff->flags & FILE_LOGGED); SCLogDebug("ff %p", ff); FileWriteJsonRecord(aft, p, ff); return 0; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonFileLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonFileLogThread *aft = SCMalloc(sizeof(JsonFileLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonFileLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogFile. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->filelog_ctx = ((OutputCtx *)initdata)->data; aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonFileLogThreadDeinit(ThreadVars *t, void *data) { JsonFileLogThread *aft = (JsonFileLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonFileLogThread)); SCFree(aft); return TM_ECODE_OK; } static void OutputFileLogDeinitSub(OutputCtx *output_ctx) { OutputFileCtx *ff_ctx = output_ctx->data; SCFree(ff_ctx); SCFree(output_ctx); } /** \brief Create a new http log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ OutputCtx *OutputFileLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; OutputFileCtx *output_file_ctx = SCMalloc(sizeof(OutputFileCtx)); if (unlikely(output_file_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(output_file_ctx); return NULL; } output_file_ctx->file_ctx = ojc->file_ctx; if (conf) { const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore"); if (force_filestore != NULL && ConfValIsTrue(force_filestore)) { FileForceFilestoreEnable(); SCLogConfig("forcing filestore of all files"); } const char *force_magic = ConfNodeLookupChildValue(conf, "force-magic"); if (force_magic != NULL && ConfValIsTrue(force_magic)) { FileForceMagicEnable(); SCLogConfig("forcing magic lookup for logged files"); } FileForceHashParseCfg(conf); } output_ctx->data = output_file_ctx; output_ctx->DeInit = OutputFileLogDeinitSub; FileForceTrackingEnable(); return output_ctx; } void JsonFileLogRegister (void) { /* register as child of eve-log */ OutputRegisterFileSubModule(LOGGER_JSON_FILE, "eve-log", "JsonFileLog", "eve-log.files", OutputFileLogInitSub, JsonFileLogger, JsonFileLogThreadInit, JsonFileLogThreadDeinit, NULL); } #else void JsonFileLogRegister (void) { } #endif suricata-3.2.1/src/app-layer-protos.c0000644000000000000000000000516013051004444014365 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #include "suricata-common.h" #include "app-layer-protos.h" #define CASE_CODE(E) case E: return #E const char *AppProtoToString(AppProto alproto) { const char *proto_name = NULL; enum AppProtoEnum proto = alproto; switch (proto) { case ALPROTO_HTTP: proto_name = "http"; break; case ALPROTO_FTP: proto_name = "ftp"; break; case ALPROTO_SMTP: proto_name = "smtp"; break; case ALPROTO_TLS: proto_name = "tls"; break; case ALPROTO_SSH: proto_name = "ssh"; break; case ALPROTO_IMAP: proto_name = "imap"; break; case ALPROTO_MSN: proto_name = "msn"; break; case ALPROTO_JABBER: proto_name = "jabber"; break; case ALPROTO_SMB: proto_name = "smb"; break; case ALPROTO_SMB2: proto_name = "smb2"; break; case ALPROTO_DCERPC: proto_name = "dcerpc"; break; case ALPROTO_IRC: proto_name = "irc"; break; case ALPROTO_DNS: proto_name = "dns"; break; case ALPROTO_MODBUS: proto_name = "modbus"; break; case ALPROTO_ENIP: proto_name = "enip"; break; case ALPROTO_DNP3: proto_name = "dnp3"; break; case ALPROTO_TEMPLATE: proto_name = "template"; break; case ALPROTO_FAILED: proto_name = "failed"; break; #ifdef UNITTESTS case ALPROTO_TEST: #endif case ALPROTO_MAX: case ALPROTO_UNKNOWN: break; } return proto_name; } suricata-3.2.1/src/detect-http-uri.h0000644000000000000000000000216513051004444014200 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias Galvan */ #ifndef _DETECT_HTTP_URI_H #define _DETECT_HTTP_URI_H /* prototypes */ void DetectHttpUriRegister (void); int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *str); int DetectHttpUriDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, Flow *f, uint8_t flags, void *state); #endif /* _DETECT_HTTP_URI_H */ suricata-3.2.1/src/detect-depth.h0000644000000000000000000000163313051004444013527 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_DEPTH_H__ #define __DETECT_DEPTH_H__ /* prototypes */ void DetectDepthRegister (void); #endif /* __DETECT_DEPTH_H__ */ suricata-3.2.1/src/util-radix-tree.h0000644000000000000000000001147413051004444014200 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_RADIX_TREE_H__ #define __UTIL_RADIX_TREE_H__ #define SC_RADIX_BITTEST(x, y) ((x) & (y)) /** * \brief Structure that hold the user data and the netmask associated with it. */ typedef struct SCRadixUserData_ { /* holds a pointer to the user data associated with the particular netmask */ void *user; /* pointer to the next user data in the list */ struct SCRadixUserData_ *next; /* holds the netmask value that corresponds to this user data pointer */ uint8_t netmask; } SCRadixUserData; /** * \brief Structure for the prefix/key in the radix tree */ typedef struct SCRadixPrefix_ { /* length of the stream */ uint16_t bitlen; /* the key that has been stored in the tree */ uint8_t *stream; /* any user data that has to be associated with this key. We need a user * data field for each netblock value possible since one ip can be associated * with any of the the 32 or 128 netblocks. Also for non-ips, we store the * netmask as 255 in SCRadixUserData->netmask */ SCRadixUserData *user_data; } SCRadixPrefix; /** * \brief Structure for the node in the radix tree */ typedef struct SCRadixNode_ { /* the bit position where the bits differ in the nodes children. Used * to determine the path to be taken during a lookup*/ uint16_t bit; uint16_t pad0; /* total no of netmasks that are registered under this node */ int netmask_cnt; /* holds a list of netmaks that come under this node in the tree */ uint8_t *netmasks; /* holds the prefix that the path to this node holds */ SCRadixPrefix *prefix; /* the left and the right children of a node */ struct SCRadixNode_ *left, *right; /* the parent node for this tree */ struct SCRadixNode_ *parent; } SCRadixNode; /** * \brief Structure for the radix tree */ typedef struct SCRadixTree_ { /* the root node in the radix tree */ SCRadixNode *head; /* function pointer that is supplied by the user to free the user data * held by the user field of SCRadixNode */ void (*PrintData)(void *); void (*Free)(void *); } SCRadixTree; struct in_addr *SCRadixValidateIPV4Address(const char *); struct in6_addr *SCRadixValidateIPV6Address(const char *); void SCRadixChopIPAddressAgainstNetmask(uint8_t *, uint8_t, uint16_t); SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*), void (*PrintData)(void*)); void SCRadixReleaseRadixTree(SCRadixTree *); SCRadixNode *SCRadixAddKeyGeneric(uint8_t *, uint16_t, SCRadixTree *, void *); SCRadixNode *SCRadixAddKeyIPV4(uint8_t *, SCRadixTree *, void *); SCRadixNode *SCRadixAddKeyIPV6(uint8_t *, SCRadixTree *, void *); SCRadixNode *SCRadixAddKeyIPV4Netblock(uint8_t *, SCRadixTree *, void *, uint8_t); SCRadixNode *SCRadixAddKeyIPV6Netblock(uint8_t *, SCRadixTree *, void *, uint8_t); SCRadixNode *SCRadixAddKeyIPV4String(const char *, SCRadixTree *, void *); SCRadixNode *SCRadixAddKeyIPV6String(const char *, SCRadixTree *, void *); void SCRadixRemoveKeyGeneric(uint8_t *, uint16_t, SCRadixTree *); void SCRadixRemoveKeyIPV4Netblock(uint8_t *, SCRadixTree *, uint8_t); void SCRadixRemoveKeyIPV4(uint8_t *, SCRadixTree *); void SCRadixRemoveKeyIPV6Netblock(uint8_t *, SCRadixTree *, uint8_t); void SCRadixRemoveKeyIPV6(uint8_t *, SCRadixTree *); SCRadixNode *SCRadixFindKeyGeneric(uint8_t *, uint16_t, SCRadixTree *, void **); SCRadixNode *SCRadixFindKeyIPV4ExactMatch(uint8_t *, SCRadixTree *, void **); SCRadixNode *SCRadixFindKeyIPV4Netblock(uint8_t *, SCRadixTree *, uint8_t, void **); SCRadixNode *SCRadixFindKeyIPV4BestMatch(uint8_t *, SCRadixTree *, void **); SCRadixNode *SCRadixFindKeyIPV6ExactMatch(uint8_t *, SCRadixTree *, void **); SCRadixNode *SCRadixFindKeyIPV6Netblock(uint8_t *, SCRadixTree *, uint8_t, void **); SCRadixNode *SCRadixFindKeyIPV6BestMatch(uint8_t *, SCRadixTree *, void **); void SCRadixPrintTree(SCRadixTree *); void SCRadixPrintNodeInfo(SCRadixNode *, int, void (*PrintData)(void*)); void SCRadixRegisterTests(void); #endif /* __UTIL_RADIX_TREE_H__ */ suricata-3.2.1/src/defrag-config.h0000644000000000000000000000201013051004444013636 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo * */ #ifndef DEFRAG_CONFIG_H_ #define DEFRAG_CONFIG_H_ void DefragSetDefaultTimeout(intmax_t timeout); void DefragPolicyLoadFromConfig(void); int DefragPolicyGetHostTimeout(Packet *p); void DefragTreeDestroy(void); #endif /* DEFRAG_CONFIG_H_ */ suricata-3.2.1/src/ippair-timeout.c0000644000000000000000000000740313051004444014121 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "ippair.h" #include "ippair-bit.h" uint32_t IPPairGetSpareCount(void) { return IPPairSpareQueueGetSize(); } uint32_t IPPairGetActiveCount(void) { return SC_ATOMIC_GET(ippair_counter); } /** \internal * \brief See if we can really discard this ippair. Check use_cnt reference. * * \param h ippair * \param ts timestamp * * \retval 0 not timed out just yet * \retval 1 fully timed out, lets kill it */ static int IPPairTimedOut(IPPair *h, struct timeval *ts) { int vars = 0; /** never prune a ippair that is used by a packet * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(h->use_cnt) > 0) { return 0; } if (IPPairHasBits(h) && IPPairBitsTimedoutCheck(h, ts) == 0) { vars = 1; } if (vars) { return 0; } SCLogDebug("ippair %p timed out", h); return 1; } /** * \internal * * \brief check all ippairs in a hash row for timing out * * \param hb ippair hash row *LOCKED* * \param h last ippair in the hash row * \param ts timestamp * * \retval cnt timed out ippairs */ static uint32_t IPPairHashRowTimeout(IPPairHashRow *hb, IPPair *h, struct timeval *ts) { uint32_t cnt = 0; do { if (SCMutexTrylock(&h->m) != 0) { h = h->hprev; continue; } IPPair *next_ippair = h->hprev; /* check if the ippair is fully timed out and * ready to be discarded. */ if (IPPairTimedOut(h, ts) == 1) { /* remove from the hash */ if (h->hprev != NULL) h->hprev->hnext = h->hnext; if (h->hnext != NULL) h->hnext->hprev = h->hprev; if (hb->head == h) hb->head = h->hnext; if (hb->tail == h) hb->tail = h->hprev; h->hnext = NULL; h->hprev = NULL; IPPairClearMemory (h); /* no one is referring to this ippair, use_cnt 0, removed from hash * so we can unlock it and move it back to the spare queue. */ SCMutexUnlock(&h->m); /* move to spare list */ IPPairMoveToSpare(h); cnt++; } else { SCMutexUnlock(&h->m); } h = next_ippair; } while (h != NULL); return cnt; } /** * \brief time out ippairs from the hash * * \param ts timestamp * * \retval cnt number of timed out ippair */ uint32_t IPPairTimeoutHash(struct timeval *ts) { uint32_t idx = 0; uint32_t cnt = 0; for (idx = 0; idx < ippair_config.hash_size; idx++) { IPPairHashRow *hb = &ippair_hash[idx]; if (HRLOCK_TRYLOCK(hb) != 0) continue; /* ippair hash bucket is now locked */ if (hb->tail == NULL) { HRLOCK_UNLOCK(hb); continue; } /* we have a ippair, or more than one */ cnt += IPPairHashRowTimeout(hb, hb->tail, ts); HRLOCK_UNLOCK(hb); } return cnt; } suricata-3.2.1/src/util-cuda-vars.h0000644000000000000000000000337013051004444014015 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifdef __SC_CUDA_SUPPORT__ #ifndef __UTIL_CUDA_VARS__H__ #define __UTIL_CUDA_VARS__H__ #include "util-cuda-buffer.h" #include "util-mpm.h" #include "threads.h" typedef struct CudaThreadVars_ { /* cb - CudaBuffer */ CudaBufferData *cuda_ac_cb; MpmCtx *mpm_proto_other_ctx; MpmCtx *mpm_proto_tcp_ctx_ts; MpmCtx *mpm_proto_udp_ctx_ts; MpmCtx *mpm_proto_tcp_ctx_tc; MpmCtx *mpm_proto_udp_ctx_tc; uint16_t data_buffer_size_max_limit; uint16_t data_buffer_size_min_limit; uint8_t mpm_is_cuda; } CudaThreadVars; typedef struct CudaPacketVars_ { uint8_t cuda_mpm_enabled; uint8_t cuda_done; uint16_t cuda_gpu_matches; SCMutex cuda_mutex; SCCondT cuda_cond; uint32_t cuda_results[(UTIL_MPM_CUDA_DATA_BUFFER_SIZE_MAX_LIMIT_DEFAULT * 2) + 1]; } CudaPacketVars; void CudaVarsSetDeCtx(struct DetectEngineCtx_ *de_ctx); int CudaThreadVarsInit(CudaThreadVars *ctv); #endif /* __UTIL_CUDA_VARS__H__ */ #endif /* __SC_CUDA_SUPPORT__ */ suricata-3.2.1/src/util-bloomfilter-counting.c0000644000000000000000000002612413051004444016267 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Counting Bloom Filter implementation. Can be used with 8, 16, 32 bits * counters. */ #include "suricata-common.h" #include "util-bloomfilter-counting.h" #include "util-unittest.h" /* type: 1, 2 or 4 for 8, 16, or 32 bit counters * */ BloomFilterCounting *BloomFilterCountingInit(uint32_t size, uint8_t type, uint8_t iter, uint32_t (*Hash)(void *, uint16_t, uint8_t, uint32_t)) { BloomFilterCounting *bf = NULL; if (iter == 0) goto error; if (Hash == NULL || size == 0) { //printf("ERROR: BloomFilterCountingInit no Hash function\n"); goto error; } if (type != 1 && type != 2 && type != 4) { //printf("ERROR: BloomFilterCountingInit only 1, 2 and 4 bytes are supported\n"); goto error; } /* setup the filter */ bf = SCMalloc(sizeof(BloomFilterCounting)); if (unlikely(bf == NULL)) goto error; memset(bf,0,sizeof(BloomFilterCounting)); bf->type = type; /* size of the type: 1, 2, 4 */ bf->array_size = size; bf->hash_iterations = iter; bf->Hash = Hash; /* setup the bitarray */ bf->array = SCMalloc(bf->array_size * bf->type); if (bf->array == NULL) goto error; memset(bf->array,0,bf->array_size * bf->type); return bf; error: if (bf != NULL) { if (bf->array != NULL) SCFree(bf->array); SCFree(bf); } return NULL; } void BloomFilterCountingFree(BloomFilterCounting *bf) { if (bf != NULL) { if (bf->array != NULL) SCFree(bf->array); SCFree(bf); } } void BloomFilterCountingPrint(BloomFilterCounting *bf) { printf("\n------ Counting Bloom Filter Stats ------\n"); printf("Buckets: %" PRIu32 "\n", bf->array_size); printf("Counter size: %" PRIu32 "\n", bf->type); printf("Memory size: %" PRIu32 " bytes\n", bf->array_size * bf->type); printf("Hash function pointer: %p\n", bf->Hash); printf("Hash functions: %" PRIu32 "\n", bf->hash_iterations); printf("-----------------------------------------\n"); } int BloomFilterCountingAdd(BloomFilterCounting *bf, void *data, uint16_t datalen) { uint8_t iter = 0; uint32_t hash = 0; if (bf == NULL || data == NULL || datalen == 0) return -1; for (iter = 0; iter < bf->hash_iterations; iter++) { hash = bf->Hash(data, datalen, iter, bf->array_size) * bf->type; if (bf->type == 1) { uint8_t *u8 = (uint8_t *)&bf->array[hash]; if ((*u8) != 255) (*u8)++; } else if (bf->type == 2) { uint16_t *u16 = (uint16_t *)&bf->array[hash]; if ((*u16) != 65535) (*u16)++; } else if (bf->type == 4) { uint32_t *u32 = (uint32_t *)&bf->array[hash]; if ((*u32) != 4294967295UL) (*u32)++; } } return 0; } int BloomFilterCountingRemove(BloomFilterCounting *bf, void *data, uint16_t datalen) { uint8_t iter = 0; uint32_t hash = 0; if (bf == NULL || data == NULL || datalen == 0) return -1; /* only remove data that was actually added */ if (BloomFilterCountingTest(bf, data, datalen) == 0) { printf("ERROR: BloomFilterCountingRemove tried to remove data " "that was never added to the set or was already removed.\n"); return -1; } /* decrease counters for every iteration */ for (iter = 0; iter < bf->hash_iterations; iter++) { hash = bf->Hash(data, datalen, iter, bf->array_size) * bf->type; if (bf->type == 1) { uint8_t *u8 = (uint8_t *)&bf->array[hash]; if ((*u8) > 0) (*u8)--; else { printf("ERROR: BloomFilterCountingRemove tried to decrease a " "counter below zero.\n"); return -1; } } else if (bf->type == 2) { uint16_t *u16 = (uint16_t *)&bf->array[hash]; if ((*u16) > 0) (*u16)--; else { printf("ERROR: BloomFilterCountingRemove tried to decrease a " "counter below zero.\n"); return -1; } } else if (bf->type == 4) { uint32_t *u32 = (uint32_t *)&bf->array[hash]; if ((*u32) > 0) (*u32)--; else { printf("ERROR: BloomFilterCountingRemove tried to decrease a " "counter below zero.\n"); return -1; } } } return 0; } /* Test if data matches our filter and is likely to be in the set * * returns 0: for no match * 1: match */ int BloomFilterCountingTest(BloomFilterCounting *bf, void *data, uint16_t datalen) { uint8_t iter = 0; uint32_t hash = 0; int hit = 1; /* check each hash iteration */ for (iter = 0; iter < bf->hash_iterations; iter++) { hash = bf->Hash(data, datalen, iter, bf->array_size) * bf->type; if (bf->type == 1) { uint8_t *u8 = (uint8_t *)&bf->array[hash]; if ((*u8) == 0x00) { hit = 0; break; } } else if (bf->type == 2) { uint16_t *u16 = (uint16_t *)&bf->array[hash]; if ((*u16) == 0x0000) { hit = 0; break; } } else if (bf->type == 4) { uint32_t *u32 = (uint32_t *)&bf->array[hash]; if ((*u32) == 0x00000000) { hit = 0; break; } } } return hit; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS static uint32_t BloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) { uint8_t *d = (uint8_t *)data; uint32_t i; uint32_t hash = 0; for (i = 0; i < datalen; i++) { if (i == 0) hash += (((uint32_t)*d++)); else if (i == 1) hash += (((uint32_t)*d++) * datalen); else hash *= (((uint32_t)*d++) * i); } hash *= (iter + datalen); hash %= hash_size; return hash; } static int BloomFilterCountingTestInit01 (void) { BloomFilterCounting *bf = BloomFilterCountingInit(1024, 4, 4, BloomHash); if (bf == NULL) return 0; BloomFilterCountingFree(bf); return 1; } /* no hash function, so it should fail */ static int BloomFilterCountingTestInit02 (void) { BloomFilterCounting *bf = BloomFilterCountingInit(1024, 4, 4, NULL); if (bf == NULL) return 1; BloomFilterCountingFree(bf); return 0; } static int BloomFilterCountingTestInit03 (void) { int result = 0; BloomFilterCounting *bf = BloomFilterCountingInit(1024, 4, 4, BloomHash); if (bf == NULL) return 0; if (bf->Hash == BloomHash) result = 1; BloomFilterCountingFree(bf); return result; } static int BloomFilterCountingTestInit04 (void) { BloomFilterCounting *bf = BloomFilterCountingInit(1024, 0, 4, BloomHash); if (bf == NULL) return 1; BloomFilterCountingFree(bf); return 0; } static int BloomFilterCountingTestInit05 (void) { BloomFilterCounting *bf = BloomFilterCountingInit(0, 4, 4, BloomHash); if (bf == NULL) return 1; BloomFilterCountingFree(bf); return 0; } static int BloomFilterCountingTestInit06 (void) { BloomFilterCounting *bf = BloomFilterCountingInit(32, 3, 4, BloomHash); if (bf == NULL) return 1; BloomFilterCountingFree(bf); return 0; } static int BloomFilterCountingTestAdd01 (void) { int result = 0; BloomFilterCounting *bf = BloomFilterCountingInit(1024, 4, 4, BloomHash); if (bf == NULL) return 0; int r = BloomFilterCountingAdd(bf, "test", 0); if (r == 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterCountingFree(bf); return result; } static int BloomFilterCountingTestAdd02 (void) { int result = 0; BloomFilterCounting *bf = BloomFilterCountingInit(1024, 4, 4, BloomHash); if (bf == NULL) return 0; int r = BloomFilterCountingAdd(bf, NULL, 4); if (r == 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterCountingFree(bf); return result; } static int BloomFilterCountingTestFull01 (void) { int result = 0; BloomFilterCounting *bf = BloomFilterCountingInit(32, 4, 4, BloomHash); if (bf == NULL) { printf("init failed: "); goto end; } int r = BloomFilterCountingAdd(bf, "test", 4); if (r != 0) { printf("first add: "); goto end; } r = BloomFilterCountingTest(bf, "test", 4); if (r != 1) { printf("2nd add: "); goto end; } r = BloomFilterCountingRemove(bf, "test", 4); if (r != 0) { printf("3rd add: "); goto end; } /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterCountingFree(bf); return result; } static int BloomFilterCountingTestFull02 (void) { int result = 0; BloomFilterCounting *bf = BloomFilterCountingInit(32, 4, 4, BloomHash); if (bf == NULL) goto end; int r = BloomFilterCountingTest(bf, "test", 4); if (r != 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterCountingFree(bf); return result; } #endif void BloomFilterCountingRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("BloomFilterCountingTestInit01", BloomFilterCountingTestInit01); UtRegisterTest("BloomFilterCountingTestInit02", BloomFilterCountingTestInit02); UtRegisterTest("BloomFilterCountingTestInit03", BloomFilterCountingTestInit03); UtRegisterTest("BloomFilterCountingTestInit04", BloomFilterCountingTestInit04); UtRegisterTest("BloomFilterCountingTestInit05", BloomFilterCountingTestInit05); UtRegisterTest("BloomFilterCountingTestInit06", BloomFilterCountingTestInit06); UtRegisterTest("BloomFilterCountingTestAdd01", BloomFilterCountingTestAdd01); UtRegisterTest("BloomFilterCountingTestAdd02", BloomFilterCountingTestAdd02); UtRegisterTest("BloomFilterCountingTestFull01", BloomFilterCountingTestFull01); UtRegisterTest("BloomFilterCountingTestFull02", BloomFilterCountingTestFull02); #endif } suricata-3.2.1/src/stream-tcp.c0000644000000000000000000127137513051004444013244 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh * * TCP stream tracking and reassembly engine. * * \todo - 4WHS: what if after the 2nd SYN we turn out to be normal 3WHS anyway? */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "flow-util.h" #include "conf.h" #include "conf-yaml-loader.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-pool.h" #include "util-pool-thread.h" #include "util-checksum.h" #include "util-unittest.h" #include "util-print.h" #include "util-debug.h" #include "util-device.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream-tcp-inline.h" #include "stream-tcp-sack.h" #include "stream-tcp-util.h" #include "stream.h" #include "pkt-var.h" #include "host.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp-mem.h" #include "util-host-os-info.h" #include "util-privs.h" #include "util-profiling.h" #include "util-misc.h" #include "util-validate.h" #include "util-runmodes.h" #include "source-pcap-file.h" //#define DEBUG #define STREAMTCP_DEFAULT_PREALLOC 2048 #define STREAMTCP_DEFAULT_MEMCAP (32 * 1024 * 1024) /* 32mb */ #define STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP (64 * 1024 * 1024) /* 64mb */ #define STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE 2560 #define STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE 2560 #define STREAMTCP_DEFAULT_MAX_SYNACK_QUEUED 5 #define STREAMTCP_NEW_TIMEOUT 60 #define STREAMTCP_EST_TIMEOUT 3600 #define STREAMTCP_CLOSED_TIMEOUT 120 #define STREAMTCP_EMERG_NEW_TIMEOUT 10 #define STREAMTCP_EMERG_EST_TIMEOUT 300 #define STREAMTCP_EMERG_CLOSED_TIMEOUT 20 static int StreamTcpHandleFin(ThreadVars *tv, StreamTcpThread *, TcpSession *, Packet *, PacketQueue *); void StreamTcpReturnStreamSegments (TcpStream *); void StreamTcpInitConfig(char); int StreamTcpGetFlowState(void *); void StreamTcpSetOSPolicy(TcpStream*, Packet*); void StreamTcpPseudoPacketCreateStreamEndPacket(ThreadVars *tv, StreamTcpThread *stt, Packet *p, TcpSession *ssn, PacketQueue *pq); static int StreamTcpValidateTimestamp(TcpSession * , Packet *); static int StreamTcpHandleTimestamp(TcpSession * , Packet *); static int StreamTcpValidateRst(TcpSession * , Packet *); static inline int StreamTcpValidateAck(TcpSession *ssn, TcpStream *, Packet *); static PoolThread *ssn_pool = NULL; static SCMutex ssn_pool_mutex = SCMUTEX_INITIALIZER; /**< init only, protect initializing and growing pool */ #ifdef DEBUG static uint64_t ssn_pool_cnt = 0; /** counts ssns, protected by ssn_pool_mutex */ #endif uint64_t StreamTcpReassembleMemuseGlobalCounter(void); SC_ATOMIC_DECLARE(uint64_t, st_memuse); /* stream engine running in "inline" mode. */ int stream_inline = 0; void StreamTcpIncrMemuse(uint64_t size) { (void) SC_ATOMIC_ADD(st_memuse, size); return; } void StreamTcpDecrMemuse(uint64_t size) { (void) SC_ATOMIC_SUB(st_memuse, size); return; } uint64_t StreamTcpMemuseCounter(void) { uint64_t memusecopy = SC_ATOMIC_GET(st_memuse); return memusecopy; } /** * \brief Check if alloc'ing "size" would mean we're over memcap * * \retval 1 if in bounds * \retval 0 if not in bounds */ int StreamTcpCheckMemcap(uint64_t size) { if (stream_config.memcap == 0 || size + SC_ATOMIC_GET(st_memuse) <= stream_config.memcap) return 1; return 0; } void StreamTcpStreamCleanup(TcpStream *stream) { if (stream != NULL) { StreamTcpSackFreeList(stream); StreamTcpReturnStreamSegments(stream); } } /** * \brief Session cleanup function. Does not free the ssn. * \param ssn tcp session */ void StreamTcpSessionCleanup(TcpSession *ssn) { SCEnter(); StreamMsg *smsg = NULL; TcpStateQueue *q, *q_next; if (ssn == NULL) return; StreamTcpStreamCleanup(&ssn->client); StreamTcpStreamCleanup(&ssn->server); /* if we have (a) smsg(s), return to the pool */ smsg = ssn->toserver_smsg_head; while(smsg != NULL) { StreamMsg *smsg_next = smsg->next; SCLogDebug("returning smsg %p to pool", smsg); smsg->next = NULL; smsg->prev = NULL; StreamMsgReturnToPool(smsg); smsg = smsg_next; } ssn->toserver_smsg_head = NULL; smsg = ssn->toclient_smsg_head; while(smsg != NULL) { StreamMsg *smsg_next = smsg->next; SCLogDebug("returning smsg %p to pool", smsg); smsg->next = NULL; smsg->prev = NULL; StreamMsgReturnToPool(smsg); smsg = smsg_next; } ssn->toclient_smsg_head = NULL; q = ssn->queue; while (q != NULL) { q_next = q->next; SCFree(q); q = q_next; StreamTcpDecrMemuse((uint64_t)sizeof(TcpStateQueue)); } ssn->queue = NULL; ssn->queue_len = 0; SCReturn; } /** * \brief Function to return the stream back to the pool. It returns the * segments in the stream to the segment pool. * * This function is called when the flow is destroyed, so it should free * *everything* related to the tcp session. So including the app layer * data. We are guaranteed to only get here when the flow's use_cnt is 0. * * \param ssn Void ptr to the ssn. */ void StreamTcpSessionClear(void *ssnptr) { SCEnter(); TcpSession *ssn = (TcpSession *)ssnptr; if (ssn == NULL) return; StreamTcpSessionCleanup(ssn); /* HACK: don't loose track of thread id */ PoolThreadReserved a = ssn->res; memset(ssn, 0, sizeof(TcpSession)); ssn->res = a; PoolThreadReturn(ssn_pool, ssn); #ifdef DEBUG SCMutexLock(&ssn_pool_mutex); ssn_pool_cnt--; SCMutexUnlock(&ssn_pool_mutex); #endif SCReturn; } /** * \brief Function to return the stream segments back to the pool. * * We don't clear out the app layer storage here as that is under protection * of the "use_cnt" reference counter in the flow. This function is called * when the use_cnt is always at least 1 (this pkt has incremented the flow * use_cnt itself), so we don't bother. * * \param p Packet used to identify the stream. */ void StreamTcpSessionPktFree (Packet *p) { SCEnter(); TcpSession *ssn = (TcpSession *)p->flow->protoctx; if (ssn == NULL) SCReturn; StreamTcpReturnStreamSegments(&ssn->client); StreamTcpReturnStreamSegments(&ssn->server); SCReturn; } /** \brief Stream alloc function for the Pool * \retval ptr void ptr to TcpSession structure with all vars set to 0/NULL */ static void *StreamTcpSessionPoolAlloc() { void *ptr = NULL; if (StreamTcpCheckMemcap((uint32_t)sizeof(TcpSession)) == 0) return NULL; ptr = SCMalloc(sizeof(TcpSession)); if (unlikely(ptr == NULL)) return NULL; return ptr; } static int StreamTcpSessionPoolInit(void *data, void* initdata) { memset(data, 0, sizeof(TcpSession)); StreamTcpIncrMemuse((uint64_t)sizeof(TcpSession)); return 1; } /** \brief Pool cleanup function * \param s Void ptr to TcpSession memory */ static void StreamTcpSessionPoolCleanup(void *s) { if (s != NULL) { StreamTcpSessionCleanup(s); /** \todo not very clean, as the memory is not freed here */ StreamTcpDecrMemuse((uint64_t)sizeof(TcpSession)); } } /** \brief To initialize the stream global configuration data * * \param quiet It tells the mode of operation, if it is TRUE nothing will * be get printed. */ void StreamTcpInitConfig(char quiet) { intmax_t value = 0; uint16_t rdrange = 10; SCLogDebug("Initializing Stream"); memset(&stream_config, 0, sizeof(stream_config)); if ((ConfGetInt("stream.max-sessions", &value)) == 1) { SCLogWarning(SC_WARN_OPTION_OBSOLETE, "max-sessions is obsolete. " "Number of concurrent sessions is now only limited by Flow and " "TCP stream engine memcaps."); } if ((ConfGetInt("stream.prealloc-sessions", &value)) == 1) { stream_config.prealloc_sessions = (uint32_t)value; } else { if (RunmodeIsUnittests()) { stream_config.prealloc_sessions = 128; } else { stream_config.prealloc_sessions = STREAMTCP_DEFAULT_PREALLOC; if (ConfGetNode("stream.prealloc-sessions") != NULL) { WarnInvalidConfEntry("stream.prealloc_sessions", "%"PRIu32, stream_config.prealloc_sessions); } } } if (!quiet) { SCLogConfig("stream \"prealloc-sessions\": %"PRIu32" (per thread)", stream_config.prealloc_sessions); } char *temp_stream_memcap_str; if (ConfGet("stream.memcap", &temp_stream_memcap_str) == 1) { if (ParseSizeStringU64(temp_stream_memcap_str, &stream_config.memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing stream.memcap " "from conf file - %s. Killing engine", temp_stream_memcap_str); exit(EXIT_FAILURE); } } else { stream_config.memcap = STREAMTCP_DEFAULT_MEMCAP; } if (!quiet) { SCLogConfig("stream \"memcap\": %"PRIu64, stream_config.memcap); } ConfGetBool("stream.midstream", &stream_config.midstream); if (!quiet) { SCLogConfig("stream \"midstream\" session pickups: %s", stream_config.midstream ? "enabled" : "disabled"); } ConfGetBool("stream.async-oneside", &stream_config.async_oneside); if (!quiet) { SCLogConfig("stream \"async-oneside\": %s", stream_config.async_oneside ? "enabled" : "disabled"); } int csum = 0; if ((ConfGetBool("stream.checksum-validation", &csum)) == 1) { if (csum == 1) { stream_config.flags |= STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION; } /* Default is that we validate the checksum of all the packets */ } else { stream_config.flags |= STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION; } if (!quiet) { SCLogConfig("stream \"checksum-validation\": %s", stream_config.flags & STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION ? "enabled" : "disabled"); } char *temp_stream_inline_str; if (ConfGet("stream.inline", &temp_stream_inline_str) == 1) { int inl = 0; /* checking for "auto" and falling back to boolean to provide * backward compatibility */ if (strcmp(temp_stream_inline_str, "auto") == 0) { if (EngineModeIsIPS()) { stream_inline = 1; } else { stream_inline = 0; } } else if (ConfGetBool("stream.inline", &inl) == 1) { stream_inline = inl; } } else { /* default to 'auto' */ if (EngineModeIsIPS()) { stream_inline = 1; } else { stream_inline = 0; } } if (!quiet) { SCLogConfig("stream.\"inline\": %s", stream_inline ? "enabled" : "disabled"); } int bypass = 0; if ((ConfGetBool("stream.bypass", &bypass)) == 1) { if (bypass == 1) { stream_config.bypass = 1; } else { stream_config.bypass = 0; } } else { stream_config.bypass = 0; } if (!quiet) { SCLogConfig("stream \"bypass\": %s", bypass ? "enabled" : "disabled"); } if ((ConfGetInt("stream.max-synack-queued", &value)) == 1) { if (value >= 0 && value <= 255) { stream_config.max_synack_queued = (uint8_t)value; } else { stream_config.max_synack_queued = (uint8_t)STREAMTCP_DEFAULT_MAX_SYNACK_QUEUED; } } else { stream_config.max_synack_queued = (uint8_t)STREAMTCP_DEFAULT_MAX_SYNACK_QUEUED; } if (!quiet) { SCLogConfig("stream \"max-synack-queued\": %"PRIu8, stream_config.max_synack_queued); } char *temp_stream_reassembly_memcap_str; if (ConfGet("stream.reassembly.memcap", &temp_stream_reassembly_memcap_str) == 1) { if (ParseSizeStringU64(temp_stream_reassembly_memcap_str, &stream_config.reassembly_memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "stream.reassembly.memcap " "from conf file - %s. Killing engine", temp_stream_reassembly_memcap_str); exit(EXIT_FAILURE); } } else { stream_config.reassembly_memcap = STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP; } if (!quiet) { SCLogConfig("stream.reassembly \"memcap\": %"PRIu64"", stream_config.reassembly_memcap); } char *temp_stream_reassembly_depth_str; if (ConfGet("stream.reassembly.depth", &temp_stream_reassembly_depth_str) == 1) { if (ParseSizeStringU32(temp_stream_reassembly_depth_str, &stream_config.reassembly_depth) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "stream.reassembly.depth " "from conf file - %s. Killing engine", temp_stream_reassembly_depth_str); exit(EXIT_FAILURE); } } else { stream_config.reassembly_depth = 0; } if (!quiet) { SCLogConfig("stream.reassembly \"depth\": %"PRIu32"", stream_config.reassembly_depth); } int randomize = 0; if ((ConfGetBool("stream.reassembly.randomize-chunk-size", &randomize)) == 0) { /* randomize by default if value not set * In ut mode we disable, to get predictible test results */ if (!(RunmodeIsUnittests())) randomize = 1; } if (randomize) { char *temp_rdrange; if (ConfGet("stream.reassembly.randomize-chunk-range", &temp_rdrange) == 1) { if (ParseSizeStringU16(temp_rdrange, &rdrange) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "stream.reassembly.randomize-chunk-range " "from conf file - %s. Killing engine", temp_rdrange); exit(EXIT_FAILURE); } else if (rdrange >= 100) { SCLogError(SC_ERR_INVALID_VALUE, "stream.reassembly.randomize-chunk-range " "must be lower than 100"); exit(EXIT_FAILURE); } } /* set a "random" seed */ srandom(time(0)); } char *temp_stream_reassembly_toserver_chunk_size_str; if (ConfGet("stream.reassembly.toserver-chunk-size", &temp_stream_reassembly_toserver_chunk_size_str) == 1) { if (ParseSizeStringU16(temp_stream_reassembly_toserver_chunk_size_str, &stream_config.reassembly_toserver_chunk_size) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "stream.reassembly.toserver-chunk-size " "from conf file - %s. Killing engine", temp_stream_reassembly_toserver_chunk_size_str); exit(EXIT_FAILURE); } } else { stream_config.reassembly_toserver_chunk_size = STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE; } if (randomize) { stream_config.reassembly_toserver_chunk_size += (int) (stream_config.reassembly_toserver_chunk_size * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); } StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, stream_config.reassembly_toserver_chunk_size); char *temp_stream_reassembly_toclient_chunk_size_str; if (ConfGet("stream.reassembly.toclient-chunk-size", &temp_stream_reassembly_toclient_chunk_size_str) == 1) { if (ParseSizeStringU16(temp_stream_reassembly_toclient_chunk_size_str, &stream_config.reassembly_toclient_chunk_size) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing " "stream.reassembly.toclient-chunk-size " "from conf file - %s. Killing engine", temp_stream_reassembly_toclient_chunk_size_str); exit(EXIT_FAILURE); } } else { stream_config.reassembly_toclient_chunk_size = STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE; } if (randomize) { stream_config.reassembly_toclient_chunk_size += (int) (stream_config.reassembly_toclient_chunk_size * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); } StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, stream_config.reassembly_toclient_chunk_size); if (!quiet) { SCLogConfig("stream.reassembly \"toserver-chunk-size\": %"PRIu16, stream_config.reassembly_toserver_chunk_size); SCLogConfig("stream.reassembly \"toclient-chunk-size\": %"PRIu16, stream_config.reassembly_toclient_chunk_size); } int enable_raw = 1; if (ConfGetBool("stream.reassembly.raw", &enable_raw) == 1) { if (!enable_raw) { stream_config.ssn_init_flags = STREAMTCP_FLAG_DISABLE_RAW; stream_config.segment_init_flags = SEGMENTTCP_FLAG_RAW_PROCESSED; } } else { enable_raw = 1; } if (!quiet) SCLogConfig("stream.reassembly.raw: %s", enable_raw ? "enabled" : "disabled"); /* init the memcap/use tracking */ SC_ATOMIC_INIT(st_memuse); StatsRegisterGlobalCounter("tcp.memuse", StreamTcpMemuseCounter); StreamTcpReassembleInit(quiet); /* set the default free function and flow state function * values. */ FlowSetProtoFreeFunc(IPPROTO_TCP, StreamTcpSessionClear); #ifdef UNITTESTS if (RunmodeIsUnittests()) { SCMutexLock(&ssn_pool_mutex); if (ssn_pool == NULL) { ssn_pool = PoolThreadInit(1, /* thread */ 0, /* unlimited */ stream_config.prealloc_sessions, sizeof(TcpSession), StreamTcpSessionPoolAlloc, StreamTcpSessionPoolInit, NULL, StreamTcpSessionPoolCleanup, NULL); } SCMutexUnlock(&ssn_pool_mutex); } #endif } void StreamTcpFreeConfig(char quiet) { StreamTcpReassembleFree(quiet); SCMutexLock(&ssn_pool_mutex); if (ssn_pool != NULL) { PoolThreadFree(ssn_pool); ssn_pool = NULL; } SCMutexUnlock(&ssn_pool_mutex); SCMutexDestroy(&ssn_pool_mutex); SCLogDebug("ssn_pool_cnt %"PRIu64"", ssn_pool_cnt); } /** \brief The function is used to to fetch a TCP session from the * ssn_pool, when a TCP SYN is received. * * \param p packet starting the new TCP session. * \param id thread pool id * * \retval ssn new TCP session. */ TcpSession *StreamTcpNewSession (Packet *p, int id) { TcpSession *ssn = (TcpSession *)p->flow->protoctx; if (ssn == NULL) { p->flow->protoctx = PoolThreadGetById(ssn_pool, id); #ifdef DEBUG SCMutexLock(&ssn_pool_mutex); if (p->flow->protoctx != NULL) ssn_pool_cnt++; SCMutexUnlock(&ssn_pool_mutex); #endif ssn = (TcpSession *)p->flow->protoctx; if (ssn == NULL) { SCLogDebug("ssn_pool is empty"); return NULL; } ssn->state = TCP_NONE; ssn->reassembly_depth = stream_config.reassembly_depth; ssn->flags = stream_config.ssn_init_flags; ssn->tcp_packet_flags = p->tcph ? p->tcph->th_flags : 0; if (PKT_IS_TOSERVER(p)) { ssn->client.tcp_flags = p->tcph ? p->tcph->th_flags : 0; ssn->server.tcp_flags = 0; } else if (PKT_IS_TOCLIENT(p)) { ssn->server.tcp_flags = p->tcph ? p->tcph->th_flags : 0; ssn->client.tcp_flags = 0; } } return ssn; } static void StreamTcpPacketSetState(Packet *p, TcpSession *ssn, uint8_t state) { if (state == ssn->state || PKT_IS_PSEUDOPKT(p)) return; ssn->state = state; /* update the flow state */ switch(ssn->state) { case TCP_ESTABLISHED: case TCP_FIN_WAIT1: case TCP_FIN_WAIT2: case TCP_CLOSING: case TCP_CLOSE_WAIT: FlowUpdateState(p->flow, FLOW_STATE_ESTABLISHED); break; case TCP_LAST_ACK: case TCP_TIME_WAIT: case TCP_CLOSED: FlowUpdateState(p->flow, FLOW_STATE_CLOSED); break; } } /** * \brief Function to set the OS policy for the given stream based on the * destination of the received packet. * * \param stream TcpStream of which os_policy needs to set * \param p Packet which is used to set the os policy */ void StreamTcpSetOSPolicy(TcpStream *stream, Packet *p) { int ret = 0; if (PKT_IS_IPV4(p)) { /* Get the OS policy based on destination IP address, as destination OS will decide how to react on the anomalies of newly received packets */ ret = SCHInfoGetIPv4HostOSFlavour((uint8_t *)GET_IPV4_DST_ADDR_PTR(p)); if (ret > 0) stream->os_policy = ret; else stream->os_policy = OS_POLICY_DEFAULT; } else if (PKT_IS_IPV6(p)) { /* Get the OS policy based on destination IP address, as destination OS will decide how to react on the anomalies of newly received packets */ ret = SCHInfoGetIPv6HostOSFlavour((uint8_t *)GET_IPV6_DST_ADDR(p)); if (ret > 0) stream->os_policy = ret; else stream->os_policy = OS_POLICY_DEFAULT; } if (stream->os_policy == OS_POLICY_BSD_RIGHT) stream->os_policy = OS_POLICY_BSD; else if (stream->os_policy == OS_POLICY_OLD_SOLARIS) stream->os_policy = OS_POLICY_SOLARIS; SCLogDebug("Policy is %"PRIu8"", stream->os_policy); } /** * \brief get the size of a stream * * \note this just calculates the diff between isn and last_ack * and will not consider sequence wrap arounds (streams * bigger than 4gb). * * \retval size stream size */ uint32_t StreamTcpGetStreamSize(TcpStream *stream) { return (stream->last_ack - stream->isn - 1); } /** * \brief macro to update last_ack only if the new value is higher * * \param ssn session * \param stream stream to update * \param ack ACK value to test and set */ #define StreamTcpUpdateLastAck(ssn, stream, ack) { \ if (SEQ_GT((ack), (stream)->last_ack)) \ { \ SCLogDebug("ssn %p: last_ack set to %"PRIu32", moved %u forward", (ssn), (ack), (ack) - (stream)->last_ack); \ if ((SEQ_LEQ((stream)->last_ack, (stream)->next_seq) && SEQ_GT((ack),(stream)->next_seq))) { \ SCLogDebug("last_ack just passed next_seq: %u (was %u) > %u", (ack), (stream)->last_ack, (stream)->next_seq); \ } else { \ SCLogDebug("next_seq (%u) <> last_ack now %d", (stream)->next_seq, (int)(stream)->next_seq - (ack)); \ }\ (stream)->last_ack = (ack); \ StreamTcpSackPruneList((stream)); \ } else { \ SCLogDebug("ssn %p: no update: ack %u, last_ack %"PRIu32", next_seq %u (state %u)", \ (ssn), (ack), (stream)->last_ack, (stream)->next_seq, (ssn)->state); \ }\ } /** * \brief macro to update next_win only if the new value is higher * * \param ssn session * \param stream stream to update * \param win window value to test and set */ #define StreamTcpUpdateNextWin(ssn, stream, win) { \ uint32_t sacked_size__ = StreamTcpSackedSize((stream)); \ if (SEQ_GT(((win) + sacked_size__), (stream)->next_win)) { \ (stream)->next_win = ((win) + sacked_size__); \ SCLogDebug("ssn %p: next_win set to %"PRIu32, (ssn), (stream)->next_win); \ } \ } static int StreamTcpPacketIsRetransmission(TcpStream *stream, Packet *p) { if (p->payload_len == 0) SCReturnInt(0); /* retransmission of already partially ack'd data */ if (SEQ_LT(TCP_GET_SEQ(p), stream->last_ack) && SEQ_GT((TCP_GET_SEQ(p) + p->payload_len), stream->last_ack)) { StreamTcpSetEvent(p, STREAM_PKT_RETRANSMISSION); SCReturnInt(1); } /* retransmission of already ack'd data */ if (SEQ_LEQ((TCP_GET_SEQ(p) + p->payload_len), stream->last_ack)) { StreamTcpSetEvent(p, STREAM_PKT_RETRANSMISSION); SCReturnInt(1); } /* retransmission of in flight data */ if (SEQ_LEQ((TCP_GET_SEQ(p) + p->payload_len), stream->next_seq)) { StreamTcpSetEvent(p, STREAM_PKT_RETRANSMISSION); SCReturnInt(2); } SCLogDebug("seq %u payload_len %u => %u, last_ack %u, next_seq %u", TCP_GET_SEQ(p), p->payload_len, (TCP_GET_SEQ(p) + p->payload_len), stream->last_ack, stream->next_seq); SCReturnInt(0); } /** * \internal * \brief Function to handle the TCP_CLOSED or NONE state. The function handles * packets while the session state is None which means a newly * initialized structure, or a fully closed session. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling * * \retval 0 ok * \retval -1 error */ static int StreamTcpPacketStateNone(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (p->tcph->th_flags & TH_RST) { StreamTcpSetEvent(p, STREAM_RST_BUT_NO_SESSION); SCLogDebug("RST packet received, no session setup"); return -1; } else if (p->tcph->th_flags & TH_FIN) { StreamTcpSetEvent(p, STREAM_FIN_BUT_NO_SESSION); SCLogDebug("FIN packet received, no session setup"); return -1; /* SYN/ACK */ } else if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { if (stream_config.midstream == FALSE && stream_config.async_oneside == FALSE) return 0; if (ssn == NULL) { ssn = StreamTcpNewSession(p, stt->ssn_pool_id); if (ssn == NULL) { StatsIncr(tv, stt->counter_tcp_ssn_memcap); return -1; } StatsIncr(tv, stt->counter_tcp_sessions); } /* set the state */ StreamTcpPacketSetState(p, ssn, TCP_SYN_RECV); SCLogDebug("ssn %p: =~ midstream picked ssn state is now " "TCP_SYN_RECV", ssn); ssn->flags |= STREAMTCP_FLAG_MIDSTREAM; /* Flag used to change the direct in the later stage in the session */ ssn->flags |= STREAMTCP_FLAG_MIDSTREAM_SYNACK; /* sequence number & window */ ssn->server.isn = TCP_GET_SEQ(p); STREAMTCP_SET_RA_BASE_SEQ(&ssn->server, ssn->server.isn); ssn->server.next_seq = ssn->server.isn + 1; ssn->server.window = TCP_GET_WINDOW(p); SCLogDebug("ssn %p: server window %u", ssn, ssn->server.window); ssn->client.isn = TCP_GET_ACK(p) - 1; STREAMTCP_SET_RA_BASE_SEQ(&ssn->client, ssn->client.isn); ssn->client.next_seq = ssn->client.isn + 1; ssn->client.last_ack = TCP_GET_ACK(p); ssn->server.last_ack = TCP_GET_SEQ(p); ssn->server.next_win = ssn->server.last_ack + ssn->server.window; /** If the client has a wscale option the server had it too, * so set the wscale for the server to max. Otherwise none * will have the wscale opt just like it should. */ if (TCP_HAS_WSCALE(p)) { ssn->client.wscale = TCP_GET_WSCALE(p); ssn->server.wscale = TCP_WSCALE_MAX; } SCLogDebug("ssn %p: ssn->client.isn %"PRIu32", ssn->client.next_seq" " %"PRIu32", ssn->client.last_ack %"PRIu32"", ssn, ssn->client.isn, ssn->client.next_seq, ssn->client.last_ack); SCLogDebug("ssn %p: ssn->server.isn %"PRIu32", ssn->server.next_seq" " %"PRIu32", ssn->server.last_ack %"PRIu32"", ssn, ssn->server.isn, ssn->server.next_seq, ssn->server.last_ack); /* Set the timestamp value for both streams, if packet has timestamp * option enabled.*/ if (TCP_HAS_TS(p)) { ssn->server.last_ts = TCP_GET_TSVAL(p); ssn->client.last_ts = TCP_GET_TSECR(p); SCLogDebug("ssn %p: ssn->server.last_ts %" PRIu32" " "ssn->client.last_ts %" PRIu32"", ssn, ssn->server.last_ts, ssn->client.last_ts); ssn->flags |= STREAMTCP_FLAG_TIMESTAMP; ssn->server.last_pkt_ts = p->ts.tv_sec; if (ssn->server.last_ts == 0) ssn->server.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; if (ssn->client.last_ts == 0) ssn->client.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } else { ssn->server.last_ts = 0; ssn->client.last_ts = 0; } if (TCP_GET_SACKOK(p) == 1) { ssn->flags |= STREAMTCP_FLAG_SACKOK; SCLogDebug("ssn %p: SYN/ACK with SACK permitted, assuming " "SACK permitted for both sides", ssn); } /* packet thinks it is in the wrong direction, flip it */ StreamTcpPacketSwitchDir(ssn, p); } else if (p->tcph->th_flags & TH_SYN) { if (ssn == NULL) { ssn = StreamTcpNewSession(p, stt->ssn_pool_id); if (ssn == NULL) { StatsIncr(tv, stt->counter_tcp_ssn_memcap); return -1; } StatsIncr(tv, stt->counter_tcp_sessions); } /* set the state */ StreamTcpPacketSetState(p, ssn, TCP_SYN_SENT); SCLogDebug("ssn %p: =~ ssn state is now TCP_SYN_SENT", ssn); /* set the sequence numbers and window */ ssn->client.isn = TCP_GET_SEQ(p); STREAMTCP_SET_RA_BASE_SEQ(&ssn->client, ssn->client.isn); ssn->client.next_seq = ssn->client.isn + 1; /* Set the stream timestamp value, if packet has timestamp option * enabled. */ if (TCP_HAS_TS(p)) { ssn->client.last_ts = TCP_GET_TSVAL(p); SCLogDebug("ssn %p: %02x", ssn, ssn->client.last_ts); if (ssn->client.last_ts == 0) ssn->client.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; ssn->client.last_pkt_ts = p->ts.tv_sec; ssn->client.flags |= STREAMTCP_STREAM_FLAG_TIMESTAMP; } ssn->server.window = TCP_GET_WINDOW(p); if (TCP_HAS_WSCALE(p)) { ssn->flags |= STREAMTCP_FLAG_SERVER_WSCALE; ssn->server.wscale = TCP_GET_WSCALE(p); } if (TCP_GET_SACKOK(p) == 1) { ssn->flags |= STREAMTCP_FLAG_CLIENT_SACKOK; SCLogDebug("ssn %p: SACK permited on SYN packet", ssn); } SCLogDebug("ssn %p: ssn->client.isn %" PRIu32 ", " "ssn->client.next_seq %" PRIu32 ", ssn->client.last_ack " "%"PRIu32"", ssn, ssn->client.isn, ssn->client.next_seq, ssn->client.last_ack); } else if (p->tcph->th_flags & TH_ACK) { if (stream_config.midstream == FALSE) return 0; if (ssn == NULL) { ssn = StreamTcpNewSession(p, stt->ssn_pool_id); if (ssn == NULL) { StatsIncr(tv, stt->counter_tcp_ssn_memcap); return -1; } StatsIncr(tv, stt->counter_tcp_sessions); } /* set the state */ StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ midstream picked ssn state is now " "TCP_ESTABLISHED", ssn); ssn->flags = STREAMTCP_FLAG_MIDSTREAM; ssn->flags |= STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED; /** window scaling for midstream pickups, we can't do much other * than assume that it's set to the max value: 14 */ ssn->client.wscale = TCP_WSCALE_MAX; ssn->server.wscale = TCP_WSCALE_MAX; /* set the sequence numbers and window */ ssn->client.isn = TCP_GET_SEQ(p) - 1; STREAMTCP_SET_RA_BASE_SEQ(&ssn->client, ssn->client.isn); ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; ssn->client.last_ack = TCP_GET_SEQ(p); ssn->client.next_win = ssn->client.last_ack + ssn->client.window; SCLogDebug("ssn %p: ssn->client.isn %u, ssn->client.next_seq %u", ssn, ssn->client.isn, ssn->client.next_seq); ssn->server.isn = TCP_GET_ACK(p) - 1; STREAMTCP_SET_RA_BASE_SEQ(&ssn->server, ssn->server.isn); ssn->server.next_seq = ssn->server.isn + 1; ssn->server.last_ack = TCP_GET_ACK(p); ssn->server.next_win = ssn->server.last_ack; SCLogDebug("ssn %p: ssn->client.next_win %"PRIu32", " "ssn->server.next_win %"PRIu32"", ssn, ssn->client.next_win, ssn->server.next_win); SCLogDebug("ssn %p: ssn->client.last_ack %"PRIu32", " "ssn->server.last_ack %"PRIu32"", ssn, ssn->client.last_ack, ssn->server.last_ack); /* Set the timestamp value for both streams, if packet has timestamp * option enabled.*/ if (TCP_HAS_TS(p)) { ssn->client.last_ts = TCP_GET_TSVAL(p); ssn->server.last_ts = TCP_GET_TSECR(p); SCLogDebug("ssn %p: ssn->server.last_ts %" PRIu32" " "ssn->client.last_ts %" PRIu32"", ssn, ssn->server.last_ts, ssn->client.last_ts); ssn->flags |= STREAMTCP_FLAG_TIMESTAMP; ssn->client.last_pkt_ts = p->ts.tv_sec; if (ssn->server.last_ts == 0) ssn->server.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; if (ssn->client.last_ts == 0) ssn->client.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } else { ssn->server.last_ts = 0; ssn->client.last_ts = 0; } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); ssn->flags |= STREAMTCP_FLAG_SACKOK; SCLogDebug("ssn %p: assuming SACK permitted for both sides", ssn); } else { SCLogDebug("default case"); } return 0; } /** \internal * \brief Setup TcpStateQueue based on SYN/ACK packet */ static inline void StreamTcp3whsSynAckToStateQueue(Packet *p, TcpStateQueue *q) { q->flags = 0; q->wscale = 0; q->ts = 0; q->win = TCP_GET_WINDOW(p); q->seq = TCP_GET_SEQ(p); q->ack = TCP_GET_ACK(p); q->pkt_ts = p->ts.tv_sec; if (TCP_GET_SACKOK(p) == 1) q->flags |= STREAMTCP_QUEUE_FLAG_SACK; if (TCP_HAS_WSCALE(p)) { q->flags |= STREAMTCP_QUEUE_FLAG_WS; q->wscale = TCP_GET_WSCALE(p); } if (TCP_HAS_TS(p)) { q->flags |= STREAMTCP_QUEUE_FLAG_TS; q->ts = TCP_GET_TSVAL(p); } } /** \internal * \brief Find the Queued SYN/ACK that is the same as this SYN/ACK * \retval q or NULL */ TcpStateQueue *StreamTcp3whsFindSynAckBySynAck(TcpSession *ssn, Packet *p) { TcpStateQueue *q = ssn->queue; TcpStateQueue search; StreamTcp3whsSynAckToStateQueue(p, &search); while (q != NULL) { if (search.flags == q->flags && search.wscale == q->wscale && search.win == q->win && search.seq == q->seq && search.ack == q->ack && search.ts == q->ts) { return q; } q = q->next; } return q; } int StreamTcp3whsQueueSynAck(TcpSession *ssn, Packet *p) { /* first see if this is already in our list */ if (StreamTcp3whsFindSynAckBySynAck(ssn, p) != NULL) return 0; if (ssn->queue_len == stream_config.max_synack_queued) { SCLogDebug("ssn %p: =~ SYN/ACK queue limit reached", ssn); StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_FLOOD); return -1; } if (StreamTcpCheckMemcap((uint32_t)sizeof(TcpStateQueue)) == 0) { SCLogDebug("ssn %p: =~ SYN/ACK queue failed: stream memcap reached", ssn); return -1; } TcpStateQueue *q = SCMalloc(sizeof(*q)); if (unlikely(q == NULL)) { SCLogDebug("ssn %p: =~ SYN/ACK queue failed: alloc failed", ssn); return -1; } memset(q, 0x00, sizeof(*q)); StreamTcpIncrMemuse((uint64_t)sizeof(TcpStateQueue)); StreamTcp3whsSynAckToStateQueue(p, q); /* put in list */ q->next = ssn->queue; ssn->queue = q; ssn->queue_len++; return 0; } /** \internal * \brief Find the Queued SYN/ACK that goes with this ACK * \retval q or NULL */ TcpStateQueue *StreamTcp3whsFindSynAckByAck(TcpSession *ssn, Packet *p) { uint32_t ack = TCP_GET_SEQ(p); uint32_t seq = TCP_GET_ACK(p) - 1; TcpStateQueue *q = ssn->queue; while (q != NULL) { if (seq == q->seq && ack == q->ack) { return q; } q = q->next; } return NULL; } /** \internal * \brief Update SSN after receiving a valid SYN/ACK * * Normally we update the SSN from the SYN/ACK packet. But in case * of queued SYN/ACKs, we can use one of those. * * \param ssn TCP session * \param p Packet * \param q queued state if used, NULL otherwise * * To make sure all SYN/ACK based state updates are in one place, * this function can updated based on Packet or TcpStateQueue, where * the latter takes precedence. */ static void StreamTcp3whsSynAckUpdate(TcpSession *ssn, Packet *p, TcpStateQueue *q) { TcpStateQueue update; if (likely(q == NULL)) { StreamTcp3whsSynAckToStateQueue(p, &update); q = &update; } if (ssn->state != TCP_SYN_RECV) { /* update state */ StreamTcpPacketSetState(p, ssn, TCP_SYN_RECV); SCLogDebug("ssn %p: =~ ssn state is now TCP_SYN_RECV", ssn); } /* sequence number & window */ ssn->server.isn = q->seq; STREAMTCP_SET_RA_BASE_SEQ(&ssn->server, ssn->server.isn); ssn->server.next_seq = ssn->server.isn + 1; ssn->client.window = q->win; SCLogDebug("ssn %p: window %" PRIu32 "", ssn, ssn->server.window); /* Set the timestamp values used to validate the timestamp of * received packets.*/ if ((q->flags & STREAMTCP_QUEUE_FLAG_TS) && (ssn->client.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)) { ssn->server.last_ts = q->ts; SCLogDebug("ssn %p: ssn->server.last_ts %" PRIu32" " "ssn->client.last_ts %" PRIu32"", ssn, ssn->server.last_ts, ssn->client.last_ts); ssn->flags |= STREAMTCP_FLAG_TIMESTAMP; ssn->server.last_pkt_ts = q->pkt_ts; if (ssn->server.last_ts == 0) ssn->server.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } else { ssn->client.last_ts = 0; ssn->server.last_ts = 0; ssn->client.flags &= ~STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } ssn->client.last_ack = q->ack; ssn->server.last_ack = ssn->server.isn + 1; /** check for the presense of the ws ptr to determine if we * support wscale at all */ if ((ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) && (q->flags & STREAMTCP_QUEUE_FLAG_WS)) { ssn->client.wscale = q->wscale; } else { ssn->client.wscale = 0; } if ((ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) && (q->flags & STREAMTCP_QUEUE_FLAG_SACK)) { ssn->flags |= STREAMTCP_FLAG_SACKOK; SCLogDebug("ssn %p: SACK permitted for session", ssn); } else { ssn->flags &= ~STREAMTCP_FLAG_SACKOK; } ssn->server.next_win = ssn->server.last_ack + ssn->server.window; ssn->client.next_win = ssn->client.last_ack + ssn->client.window; SCLogDebug("ssn %p: ssn->server.next_win %" PRIu32 "", ssn, ssn->server.next_win); SCLogDebug("ssn %p: ssn->client.next_win %" PRIu32 "", ssn, ssn->client.next_win); SCLogDebug("ssn %p: ssn->server.isn %" PRIu32 ", " "ssn->server.next_seq %" PRIu32 ", " "ssn->server.last_ack %" PRIu32 " " "(ssn->client.last_ack %" PRIu32 ")", ssn, ssn->server.isn, ssn->server.next_seq, ssn->server.last_ack, ssn->client.last_ack); /* unset the 4WHS flag as we received this SYN/ACK as part of a * (so far) valid 3WHS */ if (ssn->flags & STREAMTCP_FLAG_4WHS) SCLogDebug("ssn %p: STREAMTCP_FLAG_4WHS unset, normal SYN/ACK" " so considering 3WHS", ssn); ssn->flags &=~ STREAMTCP_FLAG_4WHS; } /** * \brief Function to handle the TCP_SYN_SENT state. The function handles * SYN, SYN/ACK, RST packets and correspondingly changes the connection * state. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; SCLogDebug("ssn %p: pkt received: %s", ssn, PKT_IS_TOCLIENT(p) ? "toclient":"toserver"); /* RST */ if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; if (PKT_IS_TOSERVER(p)) { if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.isn) && SEQ_EQ(TCP_GET_WINDOW(p), 0) && SEQ_EQ(TCP_GET_ACK(p), (ssn->client.isn + 1))) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received and state changed to " "TCP_CLOSED", ssn); } } else { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received and state changed to " "TCP_CLOSED", ssn); } /* FIN */ } else if (p->tcph->th_flags & TH_FIN) { /** \todo */ /* SYN/ACK */ } else if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { if ((ssn->flags & STREAMTCP_FLAG_4WHS) && PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: SYN/ACK received on 4WHS session", ssn); /* Check if the SYN/ACK packet ack's the earlier * received SYN packet. */ if (!(SEQ_EQ(TCP_GET_ACK(p), ssn->server.isn + 1))) { StreamTcpSetEvent(p, STREAM_4WHS_SYNACK_WITH_WRONG_ACK); SCLogDebug("ssn %p: 4WHS ACK mismatch, packet ACK %"PRIu32"" " != %" PRIu32 " from stream", ssn, TCP_GET_ACK(p), ssn->server.isn + 1); return -1; } /* Check if the SYN/ACK packet SEQ's the *FIRST* received SYN * packet. */ if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->client.isn))) { StreamTcpSetEvent(p, STREAM_4WHS_SYNACK_WITH_WRONG_SYN); SCLogDebug("ssn %p: 4WHS SEQ mismatch, packet SEQ %"PRIu32"" " != %" PRIu32 " from *first* SYN pkt", ssn, TCP_GET_SEQ(p), ssn->client.isn); return -1; } /* update state */ StreamTcpPacketSetState(p, ssn, TCP_SYN_RECV); SCLogDebug("ssn %p: =~ 4WHS ssn state is now TCP_SYN_RECV", ssn); /* sequence number & window */ ssn->client.isn = TCP_GET_SEQ(p); STREAMTCP_SET_RA_BASE_SEQ(&ssn->client, ssn->client.isn); ssn->client.next_seq = ssn->client.isn + 1; ssn->server.window = TCP_GET_WINDOW(p); SCLogDebug("ssn %p: 4WHS window %" PRIu32 "", ssn, ssn->client.window); /* Set the timestamp values used to validate the timestamp of * received packets. */ if ((TCP_HAS_TS(p)) && (ssn->server.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)) { ssn->client.last_ts = TCP_GET_TSVAL(p); SCLogDebug("ssn %p: 4WHS ssn->client.last_ts %" PRIu32" " "ssn->server.last_ts %" PRIu32"", ssn, ssn->client.last_ts, ssn->server.last_ts); ssn->flags |= STREAMTCP_FLAG_TIMESTAMP; ssn->client.last_pkt_ts = p->ts.tv_sec; if (ssn->client.last_ts == 0) ssn->client.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } else { ssn->server.last_ts = 0; ssn->client.last_ts = 0; ssn->server.flags &= ~STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } ssn->server.last_ack = TCP_GET_ACK(p); ssn->client.last_ack = ssn->client.isn + 1; /** check for the presense of the ws ptr to determine if we * support wscale at all */ if ((ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) && (TCP_HAS_WSCALE(p))) { ssn->server.wscale = TCP_GET_WSCALE(p); } else { ssn->server.wscale = 0; } if ((ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) && TCP_GET_SACKOK(p) == 1) { ssn->flags |= STREAMTCP_FLAG_SACKOK; SCLogDebug("ssn %p: SACK permitted for 4WHS session", ssn); } ssn->client.next_win = ssn->client.last_ack + ssn->client.window; ssn->server.next_win = ssn->server.last_ack + ssn->server.window; SCLogDebug("ssn %p: 4WHS ssn->client.next_win %" PRIu32 "", ssn, ssn->client.next_win); SCLogDebug("ssn %p: 4WHS ssn->server.next_win %" PRIu32 "", ssn, ssn->server.next_win); SCLogDebug("ssn %p: 4WHS ssn->client.isn %" PRIu32 ", " "ssn->client.next_seq %" PRIu32 ", " "ssn->client.last_ack %" PRIu32 " " "(ssn->server.last_ack %" PRIu32 ")", ssn, ssn->client.isn, ssn->client.next_seq, ssn->client.last_ack, ssn->server.last_ack); /* done here */ return 0; } if (PKT_IS_TOSERVER(p)) { StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_IN_WRONG_DIRECTION); SCLogDebug("ssn %p: SYN/ACK received in the wrong direction", ssn); return -1; } /* Check if the SYN/ACK packet ack's the earlier * received SYN packet. */ if (!(SEQ_EQ(TCP_GET_ACK(p), ssn->client.isn + 1))) { StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_WITH_WRONG_ACK); SCLogDebug("ssn %p: ACK mismatch, packet ACK %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_ACK(p), ssn->client.isn + 1); return -1; } StreamTcp3whsSynAckUpdate(ssn, p, /* no queue override */NULL); } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn %p: SYN packet on state SYN_SENT... resent", ssn); if (ssn->flags & STREAMTCP_FLAG_4WHS) { SCLogDebug("ssn %p: SYN packet on state SYN_SENT... resent of " "4WHS SYN", ssn); } if (PKT_IS_TOCLIENT(p)) { /** a SYN only packet in the opposite direction could be: * http://www.breakingpointsystems.com/community/blog/tcp- * portals-the-three-way-handshake-is-a-lie * * \todo improve resetting the session */ /* indicate that we're dealing with 4WHS here */ ssn->flags |= STREAMTCP_FLAG_4WHS; SCLogDebug("ssn %p: STREAMTCP_FLAG_4WHS flag set", ssn); /* set the sequence numbers and window for server * We leave the ssn->client.isn in place as we will * check the SYN/ACK pkt with that. */ ssn->server.isn = TCP_GET_SEQ(p); STREAMTCP_SET_RA_BASE_SEQ(&ssn->server, ssn->server.isn); ssn->server.next_seq = ssn->server.isn + 1; /* Set the stream timestamp value, if packet has timestamp * option enabled. */ if (TCP_HAS_TS(p)) { ssn->server.last_ts = TCP_GET_TSVAL(p); SCLogDebug("ssn %p: %02x", ssn, ssn->server.last_ts); if (ssn->server.last_ts == 0) ssn->server.flags |= STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; ssn->server.last_pkt_ts = p->ts.tv_sec; ssn->server.flags |= STREAMTCP_STREAM_FLAG_TIMESTAMP; } ssn->server.window = TCP_GET_WINDOW(p); if (TCP_HAS_WSCALE(p)) { ssn->flags |= STREAMTCP_FLAG_SERVER_WSCALE; ssn->server.wscale = TCP_GET_WSCALE(p); } else { ssn->flags &= ~STREAMTCP_FLAG_SERVER_WSCALE; ssn->server.wscale = 0; } if (TCP_GET_SACKOK(p) == 1) { ssn->flags |= STREAMTCP_FLAG_CLIENT_SACKOK; } else { ssn->flags &= ~STREAMTCP_FLAG_CLIENT_SACKOK; } SCLogDebug("ssn %p: 4WHS ssn->server.isn %" PRIu32 ", " "ssn->server.next_seq %" PRIu32 ", " "ssn->server.last_ack %"PRIu32"", ssn, ssn->server.isn, ssn->server.next_seq, ssn->server.last_ack); SCLogDebug("ssn %p: 4WHS ssn->client.isn %" PRIu32 ", " "ssn->client.next_seq %" PRIu32 ", " "ssn->client.last_ack %"PRIu32"", ssn, ssn->client.isn, ssn->client.next_seq, ssn->client.last_ack); } /** \todo check if it's correct or set event */ } else if (p->tcph->th_flags & TH_ACK) { /* Handle the asynchronous stream, when we receive a SYN packet and now istead of receving a SYN/ACK we receive a ACK from the same host, which sent the SYN, this suggests the ASNYC streams.*/ if (stream_config.async_oneside == FALSE) return 0; /* we are in AYNC (one side) mode now. */ /* one side async means we won't see a SYN/ACK, so we can * only check the SYN. */ if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq))) { StreamTcpSetEvent(p, STREAM_3WHS_ASYNC_WRONG_SEQ); SCLogDebug("ssn %p: SEQ mismatch, packet SEQ %" PRIu32 " != " "%" PRIu32 " from stream",ssn, TCP_GET_SEQ(p), ssn->client.next_seq); return -1; } ssn->flags |= STREAMTCP_FLAG_ASYNC; StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn); ssn->client.window = TCP_GET_WINDOW(p); ssn->client.last_ack = TCP_GET_SEQ(p); ssn->client.next_win = ssn->client.last_ack + ssn->client.window; /* Set the server side parameters */ ssn->server.isn = TCP_GET_ACK(p) - 1; STREAMTCP_SET_RA_BASE_SEQ(&ssn->server, ssn->server.isn); ssn->server.next_seq = ssn->server.isn + 1; ssn->server.last_ack = ssn->server.next_seq; ssn->server.next_win = ssn->server.last_ack; SCLogDebug("ssn %p: synsent => Asynchronous stream, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), " "ssn->client.next_seq %" PRIu32 "" ,ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.next_seq); /* if SYN had wscale, assume it to be supported. Otherwise * we know it not to be supported. */ if (ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) { ssn->client.wscale = TCP_WSCALE_MAX; } /* Set the timestamp values used to validate the timestamp of * received packets.*/ if (TCP_HAS_TS(p) && (ssn->client.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)) { ssn->flags |= STREAMTCP_FLAG_TIMESTAMP; ssn->client.flags &= ~STREAMTCP_STREAM_FLAG_TIMESTAMP; ssn->client.last_pkt_ts = p->ts.tv_sec; } else { ssn->client.last_ts = 0; ssn->client.flags &= ~STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; } if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) { ssn->flags |= STREAMTCP_FLAG_SACKOK; } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the TCP_SYN_RECV state. The function handles * SYN, SYN/ACK, ACK, FIN, RST packets and correspondingly changes * the connection state. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling * * \retval 0 ok * \retval -1 error */ static int StreamTcpPacketStateSynRecv(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; uint8_t reset = TRUE; /* After receiveing the RST in SYN_RECV state and if detection evasion flags has been set, then the following operating systems will not closed the connection. As they consider the packet as stray packet and not belonging to the current session, for more information check http://www.packetstan.com/2010/06/recently-ive-been-on-campaign-to-make.html */ if (ssn->flags & STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT) { if (PKT_IS_TOSERVER(p)) { if ((ssn->server.os_policy == OS_POLICY_LINUX) || (ssn->server.os_policy == OS_POLICY_OLD_LINUX) || (ssn->server.os_policy == OS_POLICY_SOLARIS)) { reset = FALSE; SCLogDebug("Detection evasion has been attempted, so" " not resetting the connection !!"); } } else { if ((ssn->client.os_policy == OS_POLICY_LINUX) || (ssn->client.os_policy == OS_POLICY_OLD_LINUX) || (ssn->client.os_policy == OS_POLICY_SOLARIS)) { reset = FALSE; SCLogDebug("Detection evasion has been attempted, so" " not resetting the connection !!"); } } } if (reset == TRUE) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received and state changed to " "TCP_CLOSED", ssn); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } } } else if (p->tcph->th_flags & TH_FIN) { /* FIN is handled in the same way as in TCP_ESTABLISHED case */; if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if ((StreamTcpHandleFin(tv, stt, ssn, p, pq)) == -1) return -1; /* SYN/ACK */ } else if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { SCLogDebug("ssn %p: SYN/ACK packet on state SYN_RECV. resent", ssn); if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: SYN/ACK-pkt to server in SYN_RECV state", ssn); StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_TOSERVER_ON_SYN_RECV); return -1; } /* Check if the SYN/ACK packets ACK matches the earlier * received SYN/ACK packet. */ if (!(SEQ_EQ(TCP_GET_ACK(p), ssn->client.last_ack))) { SCLogDebug("ssn %p: ACK mismatch, packet ACK %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_ACK(p), ssn->client.isn + 1); StreamTcpSetEvent(p, STREAM_3WHS_SYNACK_RESEND_WITH_DIFFERENT_ACK); return -1; } /* Check if the SYN/ACK packet SEQ the earlier * received SYN/ACK packet, server resend with different ISN. */ if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->server.isn))) { SCLogDebug("ssn %p: SEQ mismatch, packet SEQ %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.isn); if (StreamTcp3whsQueueSynAck(ssn, p) == -1) return -1; SCLogDebug("ssn %p: queued different SYN/ACK", ssn); } } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn %p: SYN packet on state SYN_RECV... resent", ssn); if (PKT_IS_TOCLIENT(p)) { SCLogDebug("ssn %p: SYN-pkt to client in SYN_RECV state", ssn); StreamTcpSetEvent(p, STREAM_3WHS_SYN_TOCLIENT_ON_SYN_RECV); return -1; } if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->client.isn))) { SCLogDebug("ssn %p: SYN with different SEQ on SYN_RECV state", ssn); StreamTcpSetEvent(p, STREAM_3WHS_SYN_RESEND_DIFF_SEQ_ON_SYN_RECV); return -1; } } else if (p->tcph->th_flags & TH_ACK) { if (ssn->queue_len) { SCLogDebug("ssn %p: checking ACK against queued SYN/ACKs", ssn); TcpStateQueue *q = StreamTcp3whsFindSynAckByAck(ssn, p); if (q != NULL) { SCLogDebug("ssn %p: here we update state against queued SYN/ACK", ssn); StreamTcp3whsSynAckUpdate(ssn, p, /* using queue to update state */q); } else { SCLogDebug("ssn %p: none found, now checking ACK against original SYN/ACK (state)", ssn); } } /* If the timestamp option is enabled for both the streams, then * validate the received packet timestamp value against the * stream->last_ts. If the timestamp is valid then process the * packet normally otherwise the drop the packet (RFC 1323)*/ if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!(StreamTcpValidateTimestamp(ssn, p))) { return -1; } } if ((ssn->flags & STREAMTCP_FLAG_4WHS) && PKT_IS_TOCLIENT(p)) { SCLogDebug("ssn %p: ACK received on 4WHS session",ssn); if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq))) { SCLogDebug("ssn %p: 4WHS wrong seq nr on packet", ssn); StreamTcpSetEvent(p, STREAM_4WHS_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: 4WHS invalid ack nr on packet", ssn); StreamTcpSetEvent(p, STREAM_4WHS_INVALID_ACK); return -1; } SCLogDebug("4WHS normal pkt"); SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); ssn->server.next_seq += p->payload_len; ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; ssn->client.next_win = ssn->client.last_ack + ssn->client.window; StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: ssn->client.next_win %" PRIu32 ", " "ssn->client.last_ack %"PRIu32"", ssn, ssn->client.next_win, ssn->client.last_ack); return 0; } /* Check if the ACK received is in right direction. But when we have * picked up a mid stream session after missing the initial SYN pkt, * in this case the ACK packet can arrive from either client (normal * case) or from server itself (asynchronous streams). Therefore * the check has been avoided in this case */ if (PKT_IS_TOCLIENT(p)) { /* special case, handle 4WHS, so SYN/ACK in the opposite * direction */ if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK) { SCLogDebug("ssn %p: ACK received on midstream SYN/ACK " "pickup session",ssn); /* fall through */ } else { SCLogDebug("ssn %p: ACK received in the wrong direction", ssn); StreamTcpSetEvent(p, STREAM_3WHS_ACK_IN_WRONG_DIR); return -1; } } SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ %" PRIu32 "" ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); /* Check both seq and ack number before accepting the packet and changing to ESTABLISHED state */ if ((SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)) && SEQ_EQ(TCP_GET_ACK(p), ssn->server.next_seq)) { SCLogDebug("normal pkt"); /* process the packet normal, No Async streams :) */ if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); ssn->client.next_seq += p->payload_len; ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; ssn->server.next_win = ssn->server.last_ack + ssn->server.window; if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) { ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; ssn->client.next_win = ssn->client.last_ack + ssn->client.window; ssn->server.next_win = ssn->server.last_ack + ssn->server.window; if (!(ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK)) { /* window scaling for midstream pickups, we can't do much * other than assume that it's set to the max value: 14 */ ssn->server.wscale = TCP_WSCALE_MAX; ssn->client.wscale = TCP_WSCALE_MAX; ssn->flags |= STREAMTCP_FLAG_SACKOK; } } StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); /* If asynchronous stream handling is allowed then set the session, if packet's seq number is equal the expected seq no.*/ } else if (stream_config.async_oneside == TRUE && (SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq))) { /*set the ASYNC flag used to indicate the session as async stream and helps in relaxing the windows checks.*/ ssn->flags |= STREAMTCP_FLAG_ASYNC; ssn->server.next_seq += p->payload_len; ssn->server.last_ack = TCP_GET_SEQ(p); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; ssn->client.last_ack = TCP_GET_ACK(p); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) { ssn->server.window = TCP_GET_WINDOW(p); ssn->client.next_win = ssn->server.last_ack + ssn->server.window; /* window scaling for midstream pickups, we can't do much * other than assume that it's set to the max value: 14 */ ssn->server.wscale = TCP_WSCALE_MAX; ssn->client.wscale = TCP_WSCALE_MAX; ssn->flags |= STREAMTCP_FLAG_SACKOK; } SCLogDebug("ssn %p: synrecv => Asynchronous stream, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), " "ssn->server.next_seq %" PRIu32 "\n" , ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->server.next_seq); StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); /* Upon receiving the packet with correct seq number and wrong ACK number, it causes the other end to send RST. But some target system (Linux & solaris) does not RST the connection, so it is likely to avoid the detection */ } else if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)){ ssn->flags |= STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT; SCLogDebug("ssn %p: wrong ack nr on packet, possible evasion!!", ssn); StreamTcpSetEvent(p, STREAM_3WHS_RIGHT_SEQ_WRONG_ACK_EVASION); return -1; /* if we get a packet with a proper ack, but a seq that is beyond * next_seq but in-window, we probably missed some packets */ } else if (SEQ_GT(TCP_GET_SEQ(p), ssn->client.next_seq) && SEQ_LEQ(TCP_GET_SEQ(p),ssn->client.next_win) && SEQ_EQ(TCP_GET_ACK(p), ssn->server.next_seq)) { SCLogDebug("ssn %p: ACK for missing data", ssn); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ACK for missing data: ssn->client.next_seq %u", ssn, ssn->client.next_seq); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; ssn->server.next_win = ssn->server.last_ack + ssn->server.window; if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) { ssn->client.window = TCP_GET_WINDOW(p); ssn->server.next_win = ssn->server.last_ack + ssn->server.window; /* window scaling for midstream pickups, we can't do much * other than assume that it's set to the max value: 14 */ ssn->server.wscale = TCP_WSCALE_MAX; ssn->client.wscale = TCP_WSCALE_MAX; ssn->flags |= STREAMTCP_FLAG_SACKOK; } StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED); SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { SCLogDebug("ssn %p: wrong seq nr on packet", ssn); StreamTcpSetEvent(p, STREAM_3WHS_WRONG_SEQ_WRONG_ACK); return -1; } SCLogDebug("ssn %p: ssn->server.next_win %" PRIu32 ", " "ssn->server.last_ack %"PRIu32"", ssn, ssn->server.next_win, ssn->server.last_ack); } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the TCP_ESTABLISHED state packets, which are * sent by the client to server. The function handles * ACK packets and call StreamTcpReassembleHandleSegment() to handle * the reassembly. * * Timestamp has already been checked at this point. * * \param tv Thread Variable containig input/output queue, cpu affinity etc. * \param ssn Pointer to the current TCP session * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int HandleEstablishedPacketToServer(ThreadVars *tv, TcpSession *ssn, Packet *p, StreamTcpThread *stt, PacketQueue *pq) { SCLogDebug("ssn %p: =+ pkt (%" PRIu32 ") is to server: SEQ %" PRIu32 "," "ACK %" PRIu32 ", WIN %"PRIu16"", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p), TCP_GET_WINDOW(p)); if (StreamTcpValidateAck(ssn, &(ssn->server), p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_EST_INVALID_ACK); return -1; } /* check for Keep Alive */ if ((p->payload_len == 0 || p->payload_len == 1) && (TCP_GET_SEQ(p) == (ssn->client.next_seq - 1))) { SCLogDebug("ssn %p: pkt is keep alive", ssn); /* normal pkt */ } else if (!(SEQ_GEQ((TCP_GET_SEQ(p)+p->payload_len), ssn->client.last_ack))) { if (ssn->flags & STREAMTCP_FLAG_ASYNC) { SCLogDebug("ssn %p: server => Asynchrouns stream, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 ")," " ssn->client.last_ack %" PRIu32 ", ssn->client.next_win" "%" PRIu32"(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.last_ack, ssn->client.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->client.next_win); /* update the last_ack to current seq number as the session is * async and other stream is not updating it anymore :( */ StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_SEQ(p)); } else if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p)) && (stream_config.async_oneside == TRUE) && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) { SCLogDebug("ssn %p: server => Asynchronous stream, packet SEQ." " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), " "ssn->client.last_ack %" PRIu32 ", ssn->client.next_win " "%" PRIu32 "(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.last_ack, ssn->client.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->client.next_win); /* it seems we missed SYN and SYN/ACK packets of this session. * Update the last_ack to current seq number as the session * is async and other stream is not updating it anymore :( */ StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_SEQ(p)); ssn->flags |= STREAMTCP_FLAG_ASYNC; } else if (SEQ_EQ(ssn->client.last_ack, (ssn->client.isn + 1)) && (stream_config.async_oneside == TRUE) && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) { SCLogDebug("ssn %p: server => Asynchronous stream, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), " "ssn->client.last_ack %" PRIu32 ", ssn->client.next_win " "%" PRIu32 "(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.last_ack, ssn->client.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->client.next_win); /* it seems we missed SYN and SYN/ACK packets of this session. * Update the last_ack to current seq number as the session * is async and other stream is not updating it anymore :(*/ StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_SEQ(p)); ssn->flags |= STREAMTCP_FLAG_ASYNC; /* if last ack is beyond next_seq, we have accepted ack's for missing data. * In this case we do accept the data before last_ack if it is (partly) * beyond next seq */ } else if (SEQ_GT(ssn->client.last_ack, ssn->client.next_seq) && SEQ_GT((TCP_GET_SEQ(p)+p->payload_len),ssn->client.next_seq)) { SCLogDebug("ssn %p: PKT SEQ %"PRIu32" payload_len %"PRIu16 " before last_ack %"PRIu32", after next_seq %"PRIu32":" " acked data that we haven't seen before", ssn, TCP_GET_SEQ(p), p->payload_len, ssn->client.last_ack, ssn->client.next_seq); if (SEQ_EQ(TCP_GET_SEQ(p),ssn->client.next_seq)) { ssn->client.next_seq += p->payload_len; } } else { SCLogDebug("ssn %p: server => SEQ before last_ack, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 "), " "ssn->client.last_ack %" PRIu32 ", ssn->client.next_win " "%" PRIu32 "(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.last_ack, ssn->client.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->client.next_win); SCLogDebug("ssn %p: rejecting because pkt before last_ack", ssn); StreamTcpSetEvent(p, STREAM_EST_PKT_BEFORE_LAST_ACK); return -1; } } int zerowindowprobe = 0; /* zero window probe */ if (p->payload_len == 1 && TCP_GET_SEQ(p) == ssn->client.next_seq && ssn->client.window == 0) { SCLogDebug("ssn %p: zero window probe", ssn); zerowindowprobe = 1; /* expected packet */ } else if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p))) { ssn->client.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); /* not completely as expected, but valid */ } else if (SEQ_LT(TCP_GET_SEQ(p),ssn->client.next_seq) && SEQ_GT((TCP_GET_SEQ(p)+p->payload_len), ssn->client.next_seq)) { ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %"PRIu32 " (started before next_seq, ended after)", ssn, ssn->client.next_seq); /* if next_seq has fallen behind last_ack, we got some catching up to do */ } else if (SEQ_LT(ssn->client.next_seq, ssn->client.last_ack)) { ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %"PRIu32 " (next_seq had fallen behind last_ack)", ssn, ssn->client.next_seq); } else { SCLogDebug("ssn %p: no update to ssn->client.next_seq %"PRIu32 " SEQ %u SEQ+ %u last_ack %u", ssn, ssn->client.next_seq, TCP_GET_SEQ(p), TCP_GET_SEQ(p)+p->payload_len, ssn->client.last_ack); } /* in window check */ if (zerowindowprobe) { SCLogDebug("ssn %p: zero window probe, skipping oow check", ssn); } else if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->client.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || (ssn->flags & STREAMTCP_FLAG_ASYNC)) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->client.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->client.next_win); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; SCLogDebug("ssn %p: ssn->server.window %"PRIu32"", ssn, ssn->server.window); /* Check if the ACK value is sane and inside the window limit */ StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); SCLogDebug("ack %u last_ack %u next_seq %u", TCP_GET_ACK(p), ssn->server.last_ack, ssn->server.next_seq); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpSackUpdatePacket(&ssn->server, p); /* update next_win */ StreamTcpUpdateNextWin(ssn, &ssn->server, (ssn->server.last_ack + ssn->server.window)); /* handle data (if any) */ StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { SCLogDebug("ssn %p: toserver => SEQ out of window, packet SEQ " "%" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 ")," "ssn->client.last_ack %" PRIu32 ", ssn->client.next_win " "%" PRIu32 "(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->client.last_ack, ssn->client.next_win, (TCP_GET_SEQ(p) + p->payload_len) - ssn->client.next_win); SCLogDebug("ssn %p: window %u sacked %u", ssn, ssn->client.window, StreamTcpSackedSize(&ssn->client)); StreamTcpSetEvent(p, STREAM_EST_PACKET_OUT_OF_WINDOW); return -1; } return 0; } /** * \brief Function to handle the TCP_ESTABLISHED state packets, which are * sent by the server to client. The function handles * ACK packets and call StreamTcpReassembleHandleSegment() to handle * the reassembly * * Timestamp has already been checked at this point. * * \param tv Thread Variable containig input/output queue, cpu affinity etc. * \param ssn Pointer to the current TCP session * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int HandleEstablishedPacketToClient(ThreadVars *tv, TcpSession *ssn, Packet *p, StreamTcpThread *stt, PacketQueue *pq) { SCLogDebug("ssn %p: =+ pkt (%" PRIu32 ") is to client: SEQ %" PRIu32 "," " ACK %" PRIu32 ", WIN %"PRIu16"", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p), TCP_GET_WINDOW(p)); if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_EST_INVALID_ACK); return -1; } /* To get the server window value from the servers packet, when connection is picked up as midstream */ if ((ssn->flags & STREAMTCP_FLAG_MIDSTREAM) && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED)) { ssn->server.window = TCP_GET_WINDOW(p); ssn->server.next_win = ssn->server.last_ack + ssn->server.window; ssn->flags &= ~STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED; SCLogDebug("ssn %p: adjusted midstream ssn->server.next_win to " "%" PRIu32 "", ssn, ssn->server.next_win); } /* check for Keep Alive */ if ((p->payload_len == 0 || p->payload_len == 1) && (TCP_GET_SEQ(p) == (ssn->server.next_seq - 1))) { SCLogDebug("ssn %p: pkt is keep alive", ssn); /* normal pkt */ } else if (!(SEQ_GEQ((TCP_GET_SEQ(p)+p->payload_len), ssn->server.last_ack))) { if (ssn->flags & STREAMTCP_FLAG_ASYNC) { SCLogDebug("ssn %p: client => Asynchrouns stream, packet SEQ" " %" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 ")," " ssn->client.last_ack %" PRIu32 ", ssn->client.next_win" " %"PRIu32"(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->server.last_ack, ssn->server.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->server.next_win); ssn->server.last_ack = TCP_GET_SEQ(p); /* if last ack is beyond next_seq, we have accepted ack's for missing data. * In this case we do accept the data before last_ack if it is (partly) * beyond next seq */ } else if (SEQ_GT(ssn->server.last_ack, ssn->server.next_seq) && SEQ_GT((TCP_GET_SEQ(p)+p->payload_len),ssn->server.next_seq)) { SCLogDebug("ssn %p: PKT SEQ %"PRIu32" payload_len %"PRIu16 " before last_ack %"PRIu32", after next_seq %"PRIu32":" " acked data that we haven't seen before", ssn, TCP_GET_SEQ(p), p->payload_len, ssn->server.last_ack, ssn->server.next_seq); if (SEQ_EQ(TCP_GET_SEQ(p),ssn->server.next_seq)) { ssn->server.next_seq += p->payload_len; } } else { SCLogDebug("ssn %p: PKT SEQ %"PRIu32" payload_len %"PRIu16 " before last_ack %"PRIu32". next_seq %"PRIu32, ssn, TCP_GET_SEQ(p), p->payload_len, ssn->server.last_ack, ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_EST_PKT_BEFORE_LAST_ACK); return -1; } } int zerowindowprobe = 0; /* zero window probe */ if (p->payload_len == 1 && TCP_GET_SEQ(p) == ssn->server.next_seq && ssn->server.window == 0) { SCLogDebug("ssn %p: zero window probe", ssn); zerowindowprobe = 1; /* expected packet */ } else if (SEQ_EQ(ssn->server.next_seq, TCP_GET_SEQ(p))) { ssn->server.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); /* not completely as expected, but valid */ } else if (SEQ_LT(TCP_GET_SEQ(p),ssn->server.next_seq) && SEQ_GT((TCP_GET_SEQ(p)+p->payload_len), ssn->server.next_seq)) { ssn->server.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 " (started before next_seq, ended after)", ssn, ssn->server.next_seq); /* if next_seq has fallen behind last_ack, we got some catching up to do */ } else if (SEQ_LT(ssn->server.next_seq, ssn->server.last_ack)) { ssn->server.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %"PRIu32 " (next_seq had fallen behind last_ack)", ssn, ssn->server.next_seq); } else { SCLogDebug("ssn %p: no update to ssn->server.next_seq %"PRIu32 " SEQ %u SEQ+ %u last_ack %u", ssn, ssn->server.next_seq, TCP_GET_SEQ(p), TCP_GET_SEQ(p)+p->payload_len, ssn->server.last_ack); } if (zerowindowprobe) { SCLogDebug("ssn %p: zero window probe, skipping oow check", ssn); } else if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->server.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || (ssn->flags & STREAMTCP_FLAG_ASYNC)) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->server.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->server.next_win); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; SCLogDebug("ssn %p: ssn->client.window %"PRIu32"", ssn, ssn->client.window); StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpSackUpdatePacket(&ssn->client, p); StreamTcpUpdateNextWin(ssn, &ssn->client, (ssn->client.last_ack + ssn->client.window)); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } else { SCLogDebug("ssn %p: client => SEQ out of window, packet SEQ" "%" PRIu32 ", payload size %" PRIu32 " (%" PRIu32 ")," " ssn->server.last_ack %" PRIu32 ", ssn->server.next_win " "%" PRIu32 "(%"PRIu32")", ssn, TCP_GET_SEQ(p), p->payload_len, TCP_GET_SEQ(p) + p->payload_len, ssn->server.last_ack, ssn->server.next_win, TCP_GET_SEQ(p) + p->payload_len - ssn->server.next_win); StreamTcpSetEvent(p, STREAM_EST_PACKET_OUT_OF_WINDOW); return -1; } return 0; } /** * \internal * * \brief Find the highest sequence number needed to consider all segments as ACK'd * * Used to treat all segments as ACK'd upon receiving a valid RST. * * \param stream stream to inspect the segments from * \param seq sequence number to check against * * \retval ack highest ack we need to set */ static inline uint32_t StreamTcpResetGetMaxAck(TcpStream *stream, uint32_t seq) { uint32_t ack = seq; if (stream->seg_list_tail != NULL) { if (SEQ_GT((stream->seg_list_tail->seq + stream->seg_list_tail->payload_len), ack)) { ack = stream->seg_list_tail->seq + stream->seg_list_tail->payload_len; } } SCReturnUInt(ack); } /** * \brief Function to handle the TCP_ESTABLISHED state. The function handles * ACK, FIN, RST packets and correspondingly changes the connection * state. The function handles the data inside packets and call * StreamTcpReassembleHandleSegment(tv, ) to handle the reassembling. * * \param tv Thread Variable containig input/output queue, cpu affinity etc. * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateEstablished(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); if (PKT_IS_TOSERVER(p)) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received and state changed to " "TCP_CLOSED", ssn); ssn->server.next_seq = TCP_GET_ACK(p); ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); /* don't return packets to pools here just yet, the pseudo * packet will take care, otherwise the normal session * cleanup. */ } else { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received and state changed to " "TCP_CLOSED", ssn); ssn->server.next_seq = TCP_GET_SEQ(p) + p->payload_len + 1; ssn->client.next_seq = TCP_GET_ACK(p); SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); /* don't return packets to pools here just yet, the pseudo * packet will take care, otherwise the normal session * cleanup. */ } } else if (p->tcph->th_flags & TH_FIN) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } SCLogDebug("ssn (%p: FIN received SEQ" " %" PRIu32 ", last ACK %" PRIu32 ", next win %"PRIu32"," " win %" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack, ssn->server.next_win, ssn->server.window); if ((StreamTcpHandleFin(tv, stt, ssn, p, pq)) == -1) return -1; /* SYN/ACK */ } else if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { SCLogDebug("ssn %p: SYN/ACK packet on state ESTABLISHED... resent", ssn); if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: SYN/ACK-pkt to server in ESTABLISHED state", ssn); StreamTcpSetEvent(p, STREAM_EST_SYNACK_TOSERVER); return -1; } /* Check if the SYN/ACK packets ACK matches the earlier * received SYN/ACK packet. */ if (!(SEQ_EQ(TCP_GET_ACK(p), ssn->client.last_ack))) { SCLogDebug("ssn %p: ACK mismatch, packet ACK %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_ACK(p), ssn->client.isn + 1); StreamTcpSetEvent(p, STREAM_EST_SYNACK_RESEND_WITH_DIFFERENT_ACK); return -1; } /* Check if the SYN/ACK packet SEQ the earlier * received SYN packet. */ if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->server.isn))) { SCLogDebug("ssn %p: SEQ mismatch, packet SEQ %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_ACK(p), ssn->client.isn + 1); StreamTcpSetEvent(p, STREAM_EST_SYNACK_RESEND_WITH_DIFF_SEQ); return -1; } if (ssn->flags & STREAMTCP_FLAG_3WHS_CONFIRMED) { /* a resend of a SYN while we are established already -- fishy */ StreamTcpSetEvent(p, STREAM_EST_SYNACK_RESEND); return -1; } SCLogDebug("ssn %p: SYN/ACK packet on state ESTABLISHED... resent. " "Likely due server not receiving final ACK in 3whs", ssn); /* resetting state to TCP_SYN_RECV as we should get another ACK now */ StreamTcpPacketSetState(p, ssn, TCP_SYN_RECV); SCLogDebug("ssn %p: =~ ssn state is now reset to TCP_SYN_RECV", ssn); return 0; } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn %p: SYN packet on state ESTABLISED... resent", ssn); if (PKT_IS_TOCLIENT(p)) { SCLogDebug("ssn %p: SYN-pkt to client in EST state", ssn); StreamTcpSetEvent(p, STREAM_EST_SYN_TOCLIENT); return -1; } if (!(SEQ_EQ(TCP_GET_SEQ(p), ssn->client.isn))) { SCLogDebug("ssn %p: SYN with different SEQ on SYN_RECV state", ssn); StreamTcpSetEvent(p, STREAM_EST_SYN_RESEND_DIFF_SEQ); return -1; } /* a resend of a SYN while we are established already -- fishy */ StreamTcpSetEvent(p, STREAM_EST_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { /* Urgent pointer size can be more than the payload size, as it tells * the future coming data from the sender will be handled urgently * until data of size equal to urgent offset has been processed * (RFC 2147) */ /* If the timestamp option is enabled for both the streams, then * validate the received packet timestamp value against the * stream->last_ts. If the timestamp is valid then process the * packet normally otherwise the drop the packet (RFC 1323) */ if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { /* Process the received packet to server */ HandleEstablishedPacketToServer(tv, ssn, p, stt, pq); SCLogDebug("ssn %p: next SEQ %" PRIu32 ", last ACK %" PRIu32 "," " next win %" PRIu32 ", win %" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack ,ssn->client.next_win, ssn->client.window); } else { /* implied to client */ if (!(ssn->flags & STREAMTCP_FLAG_3WHS_CONFIRMED)) { ssn->flags |= STREAMTCP_FLAG_3WHS_CONFIRMED; SCLogDebug("3whs is now confirmed by server"); } /* Process the received packet to client */ HandleEstablishedPacketToClient(tv, ssn, p, stt, pq); SCLogDebug("ssn %p: next SEQ %" PRIu32 ", last ACK %" PRIu32 "," " next win %" PRIu32 ", win %" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack, ssn->server.next_win, ssn->server.window); } } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the FIN packets for states TCP_SYN_RECV and * TCP_ESTABLISHED and changes to another TCP state as required. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling * * \retval 0 success * \retval -1 something wrong with the packet */ static int StreamTcpHandleFin(ThreadVars *tv, StreamTcpThread *stt, TcpSession *ssn, Packet *p, PacketQueue *pq) { if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ %" PRIu32 "," " ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN_INVALID_ACK); return -1; } if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN_OUT_OF_WINDOW); return -1; } StreamTcpPacketSetState(p, ssn, TCP_CLOSE_WAIT); SCLogDebug("ssn %p: state changed to TCP_CLOSE_WAIT", ssn); if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)) ssn->client.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK %" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ %" PRIu32 ", " "ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN_INVALID_ACK); return -1; } if (SEQ_LT(TCP_GET_SEQ(p), ssn->server.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 " != " "%" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN_OUT_OF_WINDOW); return -1; } StreamTcpPacketSetState(p, ssn, TCP_FIN_WAIT1); SCLogDebug("ssn %p: state changed to TCP_FIN_WAIT1", ssn); if (SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq)) ssn->server.next_seq = TCP_GET_SEQ(p) + p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK %" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } return 0; } /** * \brief Function to handle the TCP_FIN_WAIT1 state. The function handles * ACK, FIN, RST packets and correspondingly changes the connection * state. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling * * \retval 0 success * \retval -1 something wrong with the packet */ static int StreamTcpPacketStateFinWait1(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if ((p->tcph->th_flags & (TH_FIN|TH_ACK)) == (TH_FIN|TH_ACK)) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p))) { ssn->client.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->server.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->server.next_seq, TCP_GET_SEQ(p))) { ssn->server.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else if (p->tcph->th_flags & TH_FIN) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_CLOSING); SCLogDebug("ssn %p: state changed to TCP_CLOSING", ssn); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p))) { ssn->client.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->server.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_CLOSING); SCLogDebug("ssn %p: state changed to TCP_CLOSING", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->server.next_seq, TCP_GET_SEQ(p))) { ssn->server.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on FinWait1", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->client.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || ssn->flags & STREAMTCP_FLAG_ASYNC) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->client.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->client.next_win); if (TCP_GET_SEQ(p) == ssn->client.next_seq) { StreamTcpPacketSetState(p, ssn, TCP_FIN_WAIT2); SCLogDebug("ssn %p: state changed to TCP_FIN_WAIT2", ssn); } } else { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_ACK_WRONG_SEQ); return -1; } ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p))) { ssn->client.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); } StreamTcpSackUpdatePacket(&ssn->server, p); /* update next_win */ StreamTcpUpdateNextWin(ssn, &ssn->server, (ssn->server.last_ack + ssn->server.window)); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN1_INVALID_ACK); return -1; } if (!retransmission) { if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->server.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || (ssn->flags & STREAMTCP_FLAG_ASYNC)) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->server.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->server.next_win); if (TCP_GET_SEQ(p) == ssn->server.next_seq) { StreamTcpPacketSetState(p, ssn, TCP_FIN_WAIT2); SCLogDebug("ssn %p: state changed to TCP_FIN_WAIT2", ssn); } } else { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN1_ACK_WRONG_SEQ); return -1; } ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(ssn->server.next_seq, TCP_GET_SEQ(p))) { ssn->server.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); } StreamTcpSackUpdatePacket(&ssn->client, p); /* update next_win */ StreamTcpUpdateNextWin(ssn, &ssn->client, (ssn->client.last_ack + ssn->client.window)); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else { SCLogDebug("ssn (%p): default case", ssn); } return 0; } /** * \brief Function to handle the TCP_FIN_WAIT2 state. The function handles * ACK, RST, FIN packets and correspondingly changes the connection * state. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateFinWait2(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if (p->tcph->th_flags & TH_FIN) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq - 1) && SEQ_EQ(TCP_GET_ACK(p), ssn->server.last_ack)) { SCLogDebug("ssn %p: retransmission", ssn); retransmission = 1; } else if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ " "%" PRIu32 " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN2_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN2_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq - 1) && SEQ_EQ(TCP_GET_ACK(p), ssn->client.last_ack)) { SCLogDebug("ssn %p: retransmission", ssn); retransmission = 1; } else if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (SEQ_LT(TCP_GET_SEQ(p), ssn->server.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ " "%" PRIu32 " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN2_FIN_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN2_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on FinWait2", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN2_INVALID_ACK); return -1; } if (!retransmission) { if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->client.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || (ssn->flags & STREAMTCP_FLAG_ASYNC)) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->client.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->client.next_win); } else { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_FIN2_ACK_WRONG_SEQ); return -1; } ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } if (SEQ_EQ(ssn->client.next_seq, TCP_GET_SEQ(p))) { ssn->client.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->client.next_seq %" PRIu32 "", ssn, ssn->client.next_seq); } StreamTcpSackUpdatePacket(&ssn->server, p); /* update next_win */ StreamTcpUpdateNextWin(ssn, &ssn->server, (ssn->server.last_ack + ssn->server.window)); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_FIN2_INVALID_ACK); return -1; } if (!retransmission) { if (SEQ_LEQ(TCP_GET_SEQ(p) + p->payload_len, ssn->server.next_win) || (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) || (ssn->flags & STREAMTCP_FLAG_ASYNC)) { SCLogDebug("ssn %p: seq %"PRIu32" in window, ssn->server.next_win " "%" PRIu32 "", ssn, TCP_GET_SEQ(p), ssn->server.next_win); } else { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_FIN2_ACK_WRONG_SEQ); return -1; } ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } if (SEQ_EQ(ssn->server.next_seq, TCP_GET_SEQ(p))) { ssn->server.next_seq += p->payload_len; SCLogDebug("ssn %p: ssn->server.next_seq %" PRIu32 "", ssn, ssn->server.next_seq); } StreamTcpSackUpdatePacket(&ssn->client, p); /* update next_win */ StreamTcpUpdateNextWin(ssn, &ssn->client, (ssn->client.last_ack + ssn->client.window)); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the TCP_CLOSING state. Upon arrival of ACK * the connection goes to TCP_TIME_WAIT state. The state has been * reached as both end application has been closed. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateClosing(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on Closing", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (TCP_GET_SEQ(p) != ssn->client.next_seq) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_CLOSING_ACK_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSING_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { /* implied to client */ SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (TCP_GET_SEQ(p) != ssn->server.next_seq) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_CLOSING_ACK_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSING_INVALID_ACK); return -1; } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_TIME_WAIT); SCLogDebug("ssn %p: state changed to TCP_TIME_WAIT", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("StreamTcpPacketStateClosing (%p): =+ next SEQ " "%" PRIu32 ", last ACK %" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the TCP_CLOSE_WAIT state. Upon arrival of FIN * packet from server the connection goes to TCP_LAST_ACK state. * The state is possible only for server host. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateCloseWait(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { SCEnter(); if (ssn == NULL) { SCReturnInt(-1); } if (PKT_IS_TOCLIENT(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); } else { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); } if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if (p->tcph->th_flags & TH_FIN) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) SCReturnInt(-1); } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (!retransmission) { if (SEQ_LT(TCP_GET_SEQ(p), ssn->client.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW); SCReturnInt(-1); } } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_INVALID_ACK); SCReturnInt(-1); } /* don't update to LAST_ACK here as we want a toclient FIN for that */ if (!retransmission) ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (!retransmission) { if (SEQ_LT(TCP_GET_SEQ(p), ssn->server.next_seq) || SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW); SCReturnInt(-1); } } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_LAST_ACK); SCLogDebug("ssn %p: state changed to TCP_LAST_ACK", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on CloseWait", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); SCReturnInt(-1); } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) SCReturnInt(-1); } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (p->payload_len > 0 && (SEQ_LEQ((TCP_GET_SEQ(p) + p->payload_len), ssn->client.last_ack))) { SCLogDebug("ssn %p: -> retransmission", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_PKT_BEFORE_LAST_ACK); SCReturnInt(-1); } else if (SEQ_GT(TCP_GET_SEQ(p), (ssn->client.last_ack + ssn->client.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW); SCReturnInt(-1); } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(TCP_GET_SEQ(p),ssn->client.next_seq)) ssn->client.next_seq += p->payload_len; StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } else { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (p->payload_len > 0 && (SEQ_LEQ((TCP_GET_SEQ(p) + p->payload_len), ssn->server.last_ack))) { SCLogDebug("ssn %p: -> retransmission", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_PKT_BEFORE_LAST_ACK); SCReturnInt(-1); } else if (SEQ_GT(TCP_GET_SEQ(p), (ssn->server.last_ack + ssn->server.window))) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW); SCReturnInt(-1); } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_CLOSEWAIT_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); if (SEQ_EQ(TCP_GET_SEQ(p),ssn->server.next_seq)) ssn->server.next_seq += p->payload_len; StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); } } else { SCLogDebug("ssn %p: default case", ssn); } SCReturnInt(0); } /** * \brief Function to handle the TCP_LAST_ACK state. Upon arrival of ACK * the connection goes to TCP_CLOSED state and stream memory is * returned back to pool. The state is possible only for server host. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateLastAck(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if (p->tcph->th_flags & TH_FIN) { /** \todo */ } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on LastAck", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } if (TCP_GET_SEQ(p) != ssn->client.next_seq && TCP_GET_SEQ(p) != ssn->client.next_seq + 1) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_LASTACK_ACK_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_LASTACK_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: state changed to TCP_CLOSED", ssn); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); } } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \brief Function to handle the TCP_TIME_WAIT state. Upon arrival of ACK * the connection goes to TCP_CLOSED state and stream memory is * returned back to pool. * * \param tv Thread Variable containig input/output queue, cpu affinity * \param p Packet which has to be handled in this TCP state. * \param stt Strean Thread module registered to handle the stream handling */ static int StreamTcpPacketStateTimeWait(ThreadVars *tv, Packet *p, StreamTcpThread *stt, TcpSession *ssn, PacketQueue *pq) { if (ssn == NULL) return -1; if (p->tcph->th_flags & TH_RST) { if (!StreamTcpValidateRst(ssn, p)) return -1; /* force both streams to reassemble, if necessary */ StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: Reset received state changed to TCP_CLOSED", ssn); if (PKT_IS_TOSERVER(p)) { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->server, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } else { if ((p->tcph->th_flags & TH_ACK) && StreamTcpValidateAck(ssn, &ssn->client, p) == 0) StreamTcpUpdateLastAck(ssn, &ssn->client, StreamTcpResetGetMaxAck(&ssn->client, TCP_GET_ACK(p))); StreamTcpUpdateLastAck(ssn, &ssn->server, StreamTcpResetGetMaxAck(&ssn->server, TCP_GET_SEQ(p))); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } } else if (p->tcph->th_flags & TH_FIN) { /** \todo */ } else if (p->tcph->th_flags & TH_SYN) { SCLogDebug("ssn (%p): SYN pkt on TimeWait", ssn); StreamTcpSetEvent(p, STREAM_SHUTDOWN_SYN_RESEND); return -1; } else if (p->tcph->th_flags & TH_ACK) { if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) return -1; } if (PKT_IS_TOSERVER(p)) { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to server: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->client, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (TCP_GET_SEQ(p) != ssn->client.next_seq && TCP_GET_SEQ(p) != ssn->client.next_seq+1) { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->client.next_seq); StreamTcpSetEvent(p, STREAM_TIMEWAIT_ACK_WRONG_SEQ); return -1; } if (StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_TIMEWAIT_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: state changed to TCP_CLOSED", ssn); ssn->server.window = TCP_GET_WINDOW(p) << ssn->server.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->server, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->server.next_seq, TCP_GET_ACK(p))) ssn->server.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->client.next_seq, ssn->server.last_ack); StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); } else { SCLogDebug("ssn %p: pkt (%" PRIu32 ") is to client: SEQ " "%" PRIu32 ", ACK %" PRIu32 "", ssn, p->payload_len, TCP_GET_SEQ(p), TCP_GET_ACK(p)); int retransmission = 0; if (StreamTcpPacketIsRetransmission(&ssn->server, p)) { SCLogDebug("ssn %p: packet is retransmission", ssn); retransmission = 1; } else if (TCP_GET_SEQ(p) != ssn->server.next_seq && TCP_GET_SEQ(p) != ssn->server.next_seq+1) { if (p->payload_len > 0 && TCP_GET_SEQ(p) == ssn->server.last_ack) { SCLogDebug("ssn %p: -> retransmission", ssn); SCReturnInt(0); } else { SCLogDebug("ssn %p: -> SEQ mismatch, packet SEQ %" PRIu32 "" " != %" PRIu32 " from stream", ssn, TCP_GET_SEQ(p), ssn->server.next_seq); StreamTcpSetEvent(p, STREAM_TIMEWAIT_ACK_WRONG_SEQ); return -1; } } if (StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_TIMEWAIT_INVALID_ACK); SCReturnInt(-1); } if (!retransmission) { StreamTcpPacketSetState(p, ssn, TCP_CLOSED); SCLogDebug("ssn %p: state changed to TCP_CLOSED", ssn); ssn->client.window = TCP_GET_WINDOW(p) << ssn->client.wscale; } StreamTcpUpdateLastAck(ssn, &ssn->client, TCP_GET_ACK(p)); if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { StreamTcpHandleTimestamp(ssn, p); } /* Update the next_seq, in case if we have missed the client packet and server has already received and acked it */ if (SEQ_LT(ssn->client.next_seq, TCP_GET_ACK(p))) ssn->client.next_seq = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); SCLogDebug("ssn %p: =+ next SEQ %" PRIu32 ", last ACK " "%" PRIu32 "", ssn, ssn->server.next_seq, ssn->client.last_ack); StreamTcpPseudoPacketCreateStreamEndPacket(tv, stt, p, ssn, pq); } } else { SCLogDebug("ssn %p: default case", ssn); } return 0; } /** * \retval 1 packet is a keep alive pkt * \retval 0 packet is not a keep alive pkt */ static int StreamTcpPacketIsKeepAlive(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL, *ostream = NULL; uint32_t seq; uint32_t ack; if (p->flags & PKT_PSEUDO_STREAM_END) return 0; /* rfc 1122: An implementation SHOULD send a keep-alive segment with no data; however, it MAY be configurable to send a keep-alive segment containing one garbage octet, for compatibility with erroneous TCP implementations. */ if (p->payload_len > 1) return 0; if ((p->tcph->th_flags & (TH_SYN|TH_FIN|TH_RST)) != 0) { return 0; } if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; ostream = &ssn->server; } else { stream = &ssn->server; ostream = &ssn->client; } seq = TCP_GET_SEQ(p); ack = TCP_GET_ACK(p); if (ack == ostream->last_ack && seq == (stream->next_seq - 1)) { SCLogDebug("packet is TCP keep-alive: %"PRIu64, p->pcap_cnt); stream->flags |= STREAMTCP_STREAM_FLAG_KEEPALIVE; return 1; } SCLogDebug("seq %u (%u), ack %u (%u)", seq, (stream->next_seq - 1), ack, ostream->last_ack); return 0; } /** * \retval 1 packet is a keep alive ACK pkt * \retval 0 packet is not a keep alive ACK pkt */ static int StreamTcpPacketIsKeepAliveACK(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL, *ostream = NULL; uint32_t seq; uint32_t ack; uint32_t pkt_win; if (p->flags & PKT_PSEUDO_STREAM_END) return 0; /* should get a normal ACK to a Keep Alive */ if (p->payload_len > 0) return 0; if ((p->tcph->th_flags & (TH_SYN|TH_FIN|TH_RST)) != 0) return 0; if (TCP_GET_WINDOW(p) == 0) return 0; if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; ostream = &ssn->server; } else { stream = &ssn->server; ostream = &ssn->client; } seq = TCP_GET_SEQ(p); ack = TCP_GET_ACK(p); pkt_win = TCP_GET_WINDOW(p) << ostream->wscale; if (pkt_win != ostream->window) return 0; if ((ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) && ack == ostream->last_ack && seq == stream->next_seq) { SCLogDebug("packet is TCP keep-aliveACK: %"PRIu64, p->pcap_cnt); ostream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE; return 1; } SCLogDebug("seq %u (%u), ack %u (%u) FLAG_KEEPALIVE: %s", seq, stream->next_seq, ack, ostream->last_ack, ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE ? "set" : "not set"); return 0; } static void StreamTcpClearKeepAliveFlag(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL; if (p->flags & PKT_PSEUDO_STREAM_END) return; if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; } else { stream = &ssn->server; } if (stream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) { stream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE; SCLogDebug("FLAG_KEEPALIVE cleared"); } } /** * \retval 1 packet is a window update pkt * \retval 0 packet is not a window update pkt */ static int StreamTcpPacketIsWindowUpdate(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL, *ostream = NULL; uint32_t seq; uint32_t ack; uint32_t pkt_win; if (p->flags & PKT_PSEUDO_STREAM_END) return 0; if (ssn->state < TCP_ESTABLISHED) return 0; if (p->payload_len > 0) return 0; if ((p->tcph->th_flags & (TH_SYN|TH_FIN|TH_RST)) != 0) return 0; if (TCP_GET_WINDOW(p) == 0) return 0; if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; ostream = &ssn->server; } else { stream = &ssn->server; ostream = &ssn->client; } seq = TCP_GET_SEQ(p); ack = TCP_GET_ACK(p); pkt_win = TCP_GET_WINDOW(p) << ostream->wscale; if (pkt_win == ostream->window) return 0; if (ack == ostream->last_ack && seq == stream->next_seq) { SCLogDebug("packet is TCP window update: %"PRIu64, p->pcap_cnt); return 1; } SCLogDebug("seq %u (%u), ack %u (%u)", seq, stream->next_seq, ack, ostream->last_ack); return 0; } /** * Try to detect whether a packet is a valid FIN 4whs final ack. * */ static int StreamTcpPacketIsFinShutdownAck(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL, *ostream = NULL; uint32_t seq; uint32_t ack; if (p->flags & PKT_PSEUDO_STREAM_END) return 0; if (!(ssn->state == TCP_TIME_WAIT || ssn->state == TCP_CLOSE_WAIT || ssn->state == TCP_LAST_ACK)) return 0; if (p->tcph->th_flags != TH_ACK) return 0; if (p->payload_len != 0) return 0; if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; ostream = &ssn->server; } else { stream = &ssn->server; ostream = &ssn->client; } seq = TCP_GET_SEQ(p); ack = TCP_GET_ACK(p); SCLogDebug("%"PRIu64", seq %u ack %u stream->next_seq %u ostream->next_seq %u", p->pcap_cnt, seq, ack, stream->next_seq, ostream->next_seq); if (SEQ_EQ(stream->next_seq + 1, seq) && SEQ_EQ(ack, ostream->next_seq + 1)) { return 1; } return 0; } /** * Try to detect packets doing bad window updates * * See bug 1238. * * Find packets that are unexpected, and shrink the window to the point * where the packets we do expect are rejected for being out of window. * * The logic we use here is: * - packet seq > next_seq * - packet ack > next_seq (packet acks unseen data) * - packet shrinks window more than it's own data size * - packet shrinks window more than the diff between it's ack and the * last_ack value * * Packets coming in after packet loss can look quite a bit like this. */ static int StreamTcpPacketIsBadWindowUpdate(TcpSession *ssn, Packet *p) { TcpStream *stream = NULL, *ostream = NULL; uint32_t seq; uint32_t ack; uint32_t pkt_win; if (p->flags & PKT_PSEUDO_STREAM_END) return 0; if (ssn->state < TCP_ESTABLISHED || ssn->state == TCP_CLOSED) return 0; if ((p->tcph->th_flags & (TH_SYN|TH_FIN|TH_RST)) != 0) return 0; if (PKT_IS_TOSERVER(p)) { stream = &ssn->client; ostream = &ssn->server; } else { stream = &ssn->server; ostream = &ssn->client; } seq = TCP_GET_SEQ(p); ack = TCP_GET_ACK(p); pkt_win = TCP_GET_WINDOW(p) << ostream->wscale; if (pkt_win < ostream->window) { uint32_t diff = ostream->window - pkt_win; if (diff > p->payload_len && SEQ_GT(ack, ostream->next_seq) && SEQ_GT(seq, stream->next_seq)) { SCLogDebug("%"PRIu64", pkt_win %u, stream win %u, diff %u, dsize %u", p->pcap_cnt, pkt_win, ostream->window, diff, p->payload_len); SCLogDebug("%"PRIu64", pkt_win %u, stream win %u", p->pcap_cnt, pkt_win, ostream->window); SCLogDebug("%"PRIu64", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, ostream->next_win %u, diff %u (%u)", p->pcap_cnt, seq, ack, ostream->next_seq, ostream->last_ack, ostream->next_win, ostream->next_seq - ostream->last_ack, stream->next_seq - stream->last_ack); /* get the expected window shrinking from looking at ack vs last_ack. * Observed a lot of just a little overrunning that value. So added some * margin that is still ok. To make sure this isn't a loophole to still * close the window, this is limited to windows above 1024. Both values * are rather arbitrary. */ uint32_t adiff = ack - ostream->last_ack; if (((pkt_win > 1024) && (diff > (adiff + 32))) || ((pkt_win <= 1024) && (diff > adiff))) { SCLogDebug("pkt ACK %u is %u bytes beyond last_ack %u, shrinks window by %u " "(allowing 32 bytes extra): pkt WIN %u", ack, adiff, ostream->last_ack, diff, pkt_win); SCLogDebug("%u - %u = %u (state %u)", diff, adiff, diff - adiff, ssn->state); StreamTcpSetEvent(p, STREAM_PKT_BAD_WINDOW_UPDATE); return 1; } } } SCLogDebug("seq %u (%u), ack %u (%u)", seq, stream->next_seq, ack, ostream->last_ack); return 0; } /* flow is and stays locked */ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueue *pq) { SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(p->flow); SCLogDebug("p->pcap_cnt %"PRIu64, p->pcap_cnt); /* assign the thread id to the flow */ if (unlikely(p->flow->thread_id == 0)) { p->flow->thread_id = (FlowThreadId)tv->id; #ifdef DEBUG } else if (unlikely((FlowThreadId)tv->id != p->flow->thread_id)) { SCLogDebug("wrong thread: flow has %u, we are %d", p->flow->thread_id, tv->id); #endif } TcpSession *ssn = (TcpSession *)p->flow->protoctx; /* track TCP flags */ if (ssn != NULL) { ssn->tcp_packet_flags |= p->tcph->th_flags; if (PKT_IS_TOSERVER(p)) ssn->client.tcp_flags |= p->tcph->th_flags; else if (PKT_IS_TOCLIENT(p)) ssn->server.tcp_flags |= p->tcph->th_flags; } /* update counters */ if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { StatsIncr(tv, stt->counter_tcp_synack); } else if (p->tcph->th_flags & (TH_SYN)) { StatsIncr(tv, stt->counter_tcp_syn); } if (p->tcph->th_flags & (TH_RST)) { StatsIncr(tv, stt->counter_tcp_rst); } /* broken TCP http://ask.wireshark.org/questions/3183/acknowledgment-number-broken-tcp-the-acknowledge-field-is-nonzero-while-the-ack-flag-is-not-set */ if (!(p->tcph->th_flags & TH_ACK) && TCP_GET_ACK(p) != 0) { StreamTcpSetEvent(p, STREAM_PKT_BROKEN_ACK); } /* If we are on IPS mode, and got a drop action triggered from * the IP only module, or from a reassembled msg and/or from an * applayer detection, then drop the rest of the packets of the * same stream and avoid inspecting it any further */ if (StreamTcpCheckFlowDrops(p) == 1) { SCLogDebug("This flow/stream triggered a drop rule"); FlowSetNoPacketInspectionFlag(p->flow); DecodeSetNoPacketInspectionFlag(p); StreamTcpDisableAppLayer(p->flow); PACKET_DROP(p); /* return the segments to the pool */ StreamTcpSessionPktFree(p); SCReturnInt(0); } if (ssn == NULL || ssn->state == TCP_NONE) { if (StreamTcpPacketStateNone(tv, p, stt, ssn, &stt->pseudo_queue) == -1) { goto error; } if (ssn != NULL) SCLogDebug("ssn->alproto %"PRIu16"", p->flow->alproto); } else { /* special case for PKT_PSEUDO_STREAM_END packets: * bypass the state handling and various packet checks, * we care about reassembly here. */ if (p->flags & PKT_PSEUDO_STREAM_END) { if (PKT_IS_TOCLIENT(p)) { ssn->client.last_ack = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, p, pq); } else { ssn->server.last_ack = TCP_GET_ACK(p); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p, pq); } /* straight to 'skip' as we already handled reassembly */ goto skip; } /* check if the packet is in right direction, when we missed the SYN packet and picked up midstream session. */ if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK) StreamTcpPacketSwitchDir(ssn, p); if (StreamTcpPacketIsKeepAlive(ssn, p) == 1) { goto skip; } if (StreamTcpPacketIsKeepAliveACK(ssn, p) == 1) { StreamTcpClearKeepAliveFlag(ssn, p); goto skip; } StreamTcpClearKeepAliveFlag(ssn, p); /* if packet is not a valid window update, check if it is perhaps * a bad window update that we should ignore (and alert on) */ if (StreamTcpPacketIsFinShutdownAck(ssn, p) == 0) if (StreamTcpPacketIsWindowUpdate(ssn, p) == 0) if (StreamTcpPacketIsBadWindowUpdate(ssn,p)) goto skip; switch (ssn->state) { case TCP_SYN_SENT: if(StreamTcpPacketStateSynSent(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_SYN_RECV: if(StreamTcpPacketStateSynRecv(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_ESTABLISHED: if(StreamTcpPacketStateEstablished(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_FIN_WAIT1: if(StreamTcpPacketStateFinWait1(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_FIN_WAIT2: if(StreamTcpPacketStateFinWait2(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_CLOSING: if(StreamTcpPacketStateClosing(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_CLOSE_WAIT: if(StreamTcpPacketStateCloseWait(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_LAST_ACK: if(StreamTcpPacketStateLastAck(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_TIME_WAIT: if(StreamTcpPacketStateTimeWait(tv, p, stt, ssn, &stt->pseudo_queue)) { goto error; } break; case TCP_CLOSED: /* TCP session memory is not returned to pool until timeout. */ SCLogDebug("packet received on closed state"); break; default: SCLogDebug("packet received on default state"); break; } skip: if (ssn->state >= TCP_ESTABLISHED) { p->flags |= PKT_STREAM_EST; } } /* deal with a pseudo packet that is created upon receiving a RST * segment. To be sure we process both sides of the connection, we * inject a fake packet into the system, forcing reassembly of the * opposing direction. * There should be only one, but to be sure we do a while loop. */ if (ssn != NULL) { while (stt->pseudo_queue.len > 0) { SCLogDebug("processing pseudo packet / stream end"); Packet *np = PacketDequeue(&stt->pseudo_queue); if (np != NULL) { /* process the opposing direction of the original packet */ if (PKT_IS_TOSERVER(np)) { SCLogDebug("pseudo packet is to server"); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, np, NULL); } else { SCLogDebug("pseudo packet is to client"); StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->server, np, NULL); } /* enqueue this packet so we inspect it in detect etc */ PacketEnqueue(pq, np); } SCLogDebug("processing pseudo packet / stream end done"); } /* recalc the csum on the packet if it was modified */ if (p->flags & PKT_STREAM_MODIFIED) { ReCalculateChecksum(p); } /* check for conditions that may make us not want to log this packet */ /* streams that hit depth */ if ((ssn->client.flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) && (ssn->server.flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED)) { /* we can call bypass callback, if enabled */ if (StreamTcpBypassEnabled()) { PacketBypassCallback(p); } } if ((ssn->client.flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) || (ssn->server.flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED)) { p->flags |= PKT_STREAM_NOPCAPLOG; } /* encrypted packets */ if ((PKT_IS_TOSERVER(p) && (ssn->client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) || (PKT_IS_TOCLIENT(p) && (ssn->server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY))) { p->flags |= PKT_STREAM_NOPCAPLOG; } if ((ssn->client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) && (ssn->server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { /* we can call bypass callback, if enabled */ if (StreamTcpBypassEnabled()) { PacketBypassCallback(p); } } } SCReturnInt(0); error: /* make sure we don't leave packets in our pseudo queue */ while (stt->pseudo_queue.len > 0) { Packet *np = PacketDequeue(&stt->pseudo_queue); if (np != NULL) { PacketEnqueue(pq, np); } } /* recalc the csum on the packet if it was modified */ if (p->flags & PKT_STREAM_MODIFIED) { ReCalculateChecksum(p); } if (StreamTcpInlineMode()) { PACKET_DROP(p); } SCReturnInt(-1); } /** * \brief Function to validate the checksum of the received packet. If the * checksum is invalid, packet will be dropped, as the end system will * also drop the packet. * * \param p Packet of which checksum has to be validated * \retval 1 if the checksum is valid, otherwise 0 */ static inline int StreamTcpValidateChecksum(Packet *p) { int ret = 1; if (p->flags & PKT_IGNORE_CHECKSUM) return ret; if (p->level4_comp_csum == -1) { if (PKT_IS_IPV4(p)) { p->level4_comp_csum = TCPCalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); } else if (PKT_IS_IPV6(p)) { p->level4_comp_csum = TCPV6CalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); } } if (p->level4_comp_csum != p->tcph->th_sum) { ret = 0; SCLogDebug("Checksum of received packet %p is invalid",p); if (p->livedev) { (void) SC_ATOMIC_ADD(p->livedev->invalid_checksums, 1); } else if (p->pcap_cnt) { PcapIncreaseInvalidChecksum(); } } return ret; } /** \internal * \brief check if a packet is a valid stream started * \retval bool true/false */ static int TcpSessionPacketIsStreamStarter(const Packet *p) { if (p->tcph->th_flags == TH_SYN) { SCLogDebug("packet %"PRIu64" is a stream starter: %02x", p->pcap_cnt, p->tcph->th_flags); return 1; } if (stream_config.midstream == TRUE || stream_config.async_oneside == TRUE) { if (p->tcph->th_flags == (TH_SYN|TH_ACK)) { SCLogDebug("packet %"PRIu64" is a midstream stream starter: %02x", p->pcap_cnt, p->tcph->th_flags); return 1; } } return 0; } /** \internal * \brief Check if Flow and TCP SSN allow this flow/tuple to be reused * \retval bool true yes reuse, false no keep tracking old ssn */ static int TcpSessionReuseDoneEnoughSyn(const Packet *p, const Flow *f, const TcpSession *ssn) { if (FlowGetPacketDirection(f, p) == TOSERVER) { if (ssn == NULL) { SCLogDebug("steam starter packet %"PRIu64", ssn %p null. No reuse.", p->pcap_cnt, ssn); return 0; } if (SEQ_EQ(ssn->client.isn, TCP_GET_SEQ(p))) { SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); return 0; } if (ssn->state >= TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state == TCP_NONE) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state < TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); return 0; } } else { if (ssn == NULL) { SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); return 1; } if (ssn->state >= TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state == TCP_NONE) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state < TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); return 0; } } SCLogDebug("default: how did we get here?"); return 0; } /** \internal * \brief check if ssn is done enough for reuse by syn/ack * \note should only be called if midstream is enabled */ static int TcpSessionReuseDoneEnoughSynAck(const Packet *p, const Flow *f, const TcpSession *ssn) { if (FlowGetPacketDirection(f, p) == TOCLIENT) { if (ssn == NULL) { SCLogDebug("steam starter packet %"PRIu64", ssn %p null. No reuse.", p->pcap_cnt, ssn); return 0; } if (SEQ_EQ(ssn->server.isn, TCP_GET_SEQ(p))) { SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); return 0; } if (ssn->state >= TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state == TCP_NONE) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state < TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); return 0; } } else { if (ssn == NULL) { SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); return 1; } if (ssn->state >= TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state == TCP_NONE) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); return 1; } if (ssn->state < TCP_LAST_ACK) { SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); return 0; } } SCLogDebug("default: how did we get here?"); return 0; } /** \brief Check if SSN is done enough for reuse * * Reuse means a new TCP session reuses the tuple (flow in suri) * * \retval bool true if ssn can be reused, false if not */ int TcpSessionReuseDoneEnough(const Packet *p, const Flow *f, const TcpSession *ssn) { if (p->tcph->th_flags == TH_SYN) { return TcpSessionReuseDoneEnoughSyn(p, f, ssn); } if (stream_config.midstream == TRUE || stream_config.async_oneside == TRUE) { if (p->tcph->th_flags == (TH_SYN|TH_ACK)) { return TcpSessionReuseDoneEnoughSynAck(p, f, ssn); } } return 0; } int TcpSessionPacketSsnReuse(const Packet *p, const Flow *f, const void *tcp_ssn) { if (p->proto == IPPROTO_TCP && p->tcph != NULL) { if (TcpSessionPacketIsStreamStarter(p) == 1) { if (TcpSessionReuseDoneEnough(p, f, tcp_ssn) == 1) { return 1; } } } return 0; } TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { StreamTcpThread *stt = (StreamTcpThread *)data; SCLogDebug("p->pcap_cnt %"PRIu64, p->pcap_cnt); if (!(PKT_IS_TCP(p))) { return TM_ECODE_OK; } if (p->flow == NULL) { StatsIncr(tv, stt->counter_tcp_no_flow); return TM_ECODE_OK; } /* only TCP packets with a flow from here */ if (!(p->flags & PKT_PSEUDO_STREAM_END)) { if (stream_config.flags & STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION) { if (StreamTcpValidateChecksum(p) == 0) { StatsIncr(tv, stt->counter_tcp_invalid_checksum); return TM_ECODE_OK; } } else { p->flags |= PKT_IGNORE_CHECKSUM; } } else { p->flags |= PKT_IGNORE_CHECKSUM; //TODO check that this is set at creation } AppLayerProfilingReset(stt->ra_ctx->app_tctx); (void)StreamTcpPacket(tv, p, stt, pq); return TM_ECODE_OK; } TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); StreamTcpThread *stt = SCMalloc(sizeof(StreamTcpThread)); if (unlikely(stt == NULL)) SCReturnInt(TM_ECODE_FAILED); memset(stt, 0, sizeof(StreamTcpThread)); stt->ssn_pool_id = -1; *data = (void *)stt; stt->counter_tcp_sessions = StatsRegisterCounter("tcp.sessions", tv); stt->counter_tcp_ssn_memcap = StatsRegisterCounter("tcp.ssn_memcap_drop", tv); stt->counter_tcp_pseudo = StatsRegisterCounter("tcp.pseudo", tv); stt->counter_tcp_pseudo_failed = StatsRegisterCounter("tcp.pseudo_failed", tv); stt->counter_tcp_invalid_checksum = StatsRegisterCounter("tcp.invalid_checksum", tv); stt->counter_tcp_no_flow = StatsRegisterCounter("tcp.no_flow", tv); stt->counter_tcp_syn = StatsRegisterCounter("tcp.syn", tv); stt->counter_tcp_synack = StatsRegisterCounter("tcp.synack", tv); stt->counter_tcp_rst = StatsRegisterCounter("tcp.rst", tv); /* init reassembly ctx */ stt->ra_ctx = StreamTcpReassembleInitThreadCtx(tv); if (stt->ra_ctx == NULL) SCReturnInt(TM_ECODE_FAILED); stt->ra_ctx->counter_tcp_segment_memcap = StatsRegisterCounter("tcp.segment_memcap_drop", tv); stt->ra_ctx->counter_tcp_stream_depth = StatsRegisterCounter("tcp.stream_depth_reached", tv); stt->ra_ctx->counter_tcp_reass_gap = StatsRegisterCounter("tcp.reassembly_gap", tv); SCLogDebug("StreamTcp thread specific ctx online at %p, reassembly ctx %p", stt, stt->ra_ctx); SCMutexLock(&ssn_pool_mutex); if (ssn_pool == NULL) { ssn_pool = PoolThreadInit(1, /* thread */ 0, /* unlimited */ stream_config.prealloc_sessions, sizeof(TcpSession), StreamTcpSessionPoolAlloc, StreamTcpSessionPoolInit, NULL, StreamTcpSessionPoolCleanup, NULL); stt->ssn_pool_id = 0; SCLogDebug("pool size %d, thread ssn_pool_id %d", PoolThreadSize(ssn_pool), stt->ssn_pool_id); } else { /* grow ssn_pool until we have a element for our thread id */ stt->ssn_pool_id = PoolThreadGrow(ssn_pool, 0, /* unlimited */ stream_config.prealloc_sessions, sizeof(TcpSession), StreamTcpSessionPoolAlloc, StreamTcpSessionPoolInit, NULL, StreamTcpSessionPoolCleanup, NULL); SCLogDebug("pool size %d, thread ssn_pool_id %d", PoolThreadSize(ssn_pool), stt->ssn_pool_id); } SCMutexUnlock(&ssn_pool_mutex); if (stt->ssn_pool_id < 0 || ssn_pool == NULL) SCReturnInt(TM_ECODE_FAILED); SCReturnInt(TM_ECODE_OK); } TmEcode StreamTcpThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); StreamTcpThread *stt = (StreamTcpThread *)data; if (stt == NULL) { return TM_ECODE_OK; } /* XXX */ /* free reassembly ctx */ StreamTcpReassembleFreeThreadCtx(stt->ra_ctx); /* clear memory */ memset(stt, 0, sizeof(StreamTcpThread)); SCFree(stt); SCReturnInt(TM_ECODE_OK); } /** * \brief Function to check the validity of the RST packets based on the * target OS of the given packet. * * \param ssn TCP session to which the given packet belongs * \param p Packet which has to be checked for its validity * * \retval 0 unacceptable RST * \retval 1 acceptable RST * * WebSense sends RST packets that are: * - RST flag, win 0, ack 0, seq = nextseq * */ static int StreamTcpValidateRst(TcpSession *ssn, Packet *p) { uint8_t os_policy; if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) { if (!StreamTcpValidateTimestamp(ssn, p)) { SCReturnInt(0); } } /* Set up the os_policy to be used in validating the RST packets based on target system */ if (PKT_IS_TOSERVER(p)) { if (ssn->server.os_policy == 0) StreamTcpSetOSPolicy(&ssn->server, p); os_policy = ssn->server.os_policy; if (p->tcph->th_flags & TH_ACK && TCP_GET_ACK(p) && StreamTcpValidateAck(ssn, &ssn->server, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_RST_INVALID_ACK); SCReturnInt(0); } } else { if (ssn->client.os_policy == 0) StreamTcpSetOSPolicy(&ssn->client, p); os_policy = ssn->client.os_policy; if (p->tcph->th_flags & TH_ACK && TCP_GET_ACK(p) && StreamTcpValidateAck(ssn, &ssn->client, p) == -1) { SCLogDebug("ssn %p: rejecting because of invalid ack value", ssn); StreamTcpSetEvent(p, STREAM_RST_INVALID_ACK); SCReturnInt(0); } } switch (os_policy) { case OS_POLICY_HPUX11: if(PKT_IS_TOSERVER(p)){ if(SEQ_GEQ(TCP_GET_SEQ(p), ssn->client.next_seq)) { SCLogDebug("reset is Valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } else { SCLogDebug("reset is not Valid! Packet SEQ: %" PRIu32 " " "and server SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->client.next_seq); return 0; } } else { /* implied to client */ if(SEQ_GEQ(TCP_GET_SEQ(p), ssn->server.next_seq)) { SCLogDebug("reset is valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } else { SCLogDebug("reset is not valid! Packet SEQ: %" PRIu32 " " "and client SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->server.next_seq); return 0; } } break; case OS_POLICY_OLD_LINUX: case OS_POLICY_LINUX: case OS_POLICY_SOLARIS: if(PKT_IS_TOSERVER(p)){ if(SEQ_GEQ((TCP_GET_SEQ(p)+p->payload_len), ssn->client.last_ack)) { /*window base is needed !!*/ if(SEQ_LT(TCP_GET_SEQ(p), (ssn->client.next_seq + ssn->client.window))) { SCLogDebug("reset is Valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } } else { SCLogDebug("reset is not valid! Packet SEQ: %" PRIu32 " and" " server SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->client.next_seq); return 0; } } else { /* implied to client */ if(SEQ_GEQ((TCP_GET_SEQ(p) + p->payload_len), ssn->server.last_ack)) { /*window base is needed !!*/ if(SEQ_LT(TCP_GET_SEQ(p), (ssn->server.next_seq + ssn->server.window))) { SCLogDebug("reset is Valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } } else { SCLogDebug("reset is not valid! Packet SEQ: %" PRIu32 " and" " client SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->server.next_seq); return 0; } } break; default: case OS_POLICY_BSD: case OS_POLICY_FIRST: case OS_POLICY_HPUX10: case OS_POLICY_IRIX: case OS_POLICY_MACOS: case OS_POLICY_LAST: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_VISTA: if(PKT_IS_TOSERVER(p)) { if(SEQ_EQ(TCP_GET_SEQ(p), ssn->client.next_seq)) { SCLogDebug("reset is valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } else { SCLogDebug("reset is not valid! Packet SEQ: %" PRIu32 " " "and server SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->client.next_seq); return 0; } } else { /* implied to client */ if(SEQ_EQ(TCP_GET_SEQ(p), ssn->server.next_seq)) { SCLogDebug("reset is valid! Packet SEQ: %" PRIu32 "", TCP_GET_SEQ(p)); return 1; } else { SCLogDebug("reset is not valid! Packet SEQ: %" PRIu32 " and" " client SEQ: %" PRIu32 "", TCP_GET_SEQ(p), ssn->server.next_seq); return 0; } } break; } return 0; } /** * \brief Function to check the validity of the received timestamp based on * the target OS of the given stream. * * It's passive except for: * 1. it sets the os policy on the stream if necessary * 2. it sets an event in the packet if necessary * * \param ssn TCP session to which the given packet belongs * \param p Packet which has to be checked for its validity * * \retval 1 if the timestamp is valid * \retval 0 if the timestamp is invalid */ static int StreamTcpValidateTimestamp (TcpSession *ssn, Packet *p) { SCEnter(); TcpStream *sender_stream; TcpStream *receiver_stream; uint8_t ret = 1; uint8_t check_ts = 1; if (PKT_IS_TOSERVER(p)) { sender_stream = &ssn->client; receiver_stream = &ssn->server; } else { sender_stream = &ssn->server; receiver_stream = &ssn->client; } /* Set up the os_policy to be used in validating the timestamps based on the target system */ if (receiver_stream->os_policy == 0) { StreamTcpSetOSPolicy(receiver_stream, p); } if (TCP_HAS_TS(p)) { uint32_t ts = TCP_GET_TSVAL(p); uint32_t last_pkt_ts = sender_stream->last_pkt_ts; uint32_t last_ts = sender_stream->last_ts; if (sender_stream->flags & STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP) { /* The 3whs used the timestamp with 0 value. */ switch (receiver_stream->os_policy) { case OS_POLICY_LINUX: case OS_POLICY_WINDOWS2K3: /* Linux and windows 2003 does not allow the use of 0 as * timestamp in the 3whs. */ check_ts = 0; break; case OS_POLICY_OLD_LINUX: case OS_POLICY_WINDOWS: case OS_POLICY_VISTA: if (SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) { last_ts = ts; check_ts = 0; /*next packet will be checked for validity and stream TS has been updated with this one.*/ } break; } } if (receiver_stream->os_policy == OS_POLICY_HPUX11) { /* HPUX11 igoners the timestamp of out of order packets */ if (!SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) check_ts = 0; } if (ts == 0) { switch (receiver_stream->os_policy) { case OS_POLICY_OLD_LINUX: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_VISTA: case OS_POLICY_SOLARIS: /* Old Linux and windows allowed packet with 0 timestamp. */ break; default: /* other OS simply drop the pakcet with 0 timestamp, when * 3whs has valid timestamp*/ goto invalid; } } if (check_ts) { int32_t result = 0; SCLogDebug("ts %"PRIu32", last_ts %"PRIu32"", ts, last_ts); if (receiver_stream->os_policy == OS_POLICY_LINUX) { /* Linux accepts TS which are off by one.*/ result = (int32_t) ((ts - last_ts) + 1); } else { result = (int32_t) (ts - last_ts); } SCLogDebug("result %"PRIi32", p->ts.tv_sec %"PRIuMAX"", result, (uintmax_t)p->ts.tv_sec); if (last_pkt_ts == 0 && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) { last_pkt_ts = p->ts.tv_sec; } if (result < 0) { SCLogDebug("timestamp is not valid last_ts " "%" PRIu32 " p->tcpvars->ts %" PRIu32 " result " "%" PRId32 "", last_ts, ts, result); /* candidate for rejection */ ret = 0; } else if ((sender_stream->last_ts != 0) && (((uint32_t) p->ts.tv_sec) > last_pkt_ts + PAWS_24DAYS)) { SCLogDebug("packet is not valid last_pkt_ts " "%" PRIu32 " p->ts.tv_sec %" PRIu32 "", last_pkt_ts, (uint32_t) p->ts.tv_sec); /* candidate for rejection */ ret = 0; } if (ret == 0) { /* if the timestamp of packet is not valid then, check if the * current stream timestamp is not so old. if so then we need to * accept the packet and update the stream->last_ts (RFC 1323)*/ if ((SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) && (((uint32_t) p->ts.tv_sec > (last_pkt_ts + PAWS_24DAYS)))) { SCLogDebug("timestamp considered valid anyway"); } else { goto invalid; } } } } SCReturnInt(1); invalid: StreamTcpSetEvent(p, STREAM_PKT_INVALID_TIMESTAMP); SCReturnInt(0); } /** * \brief Function to check the validity of the received timestamp based on * the target OS of the given stream and update the session. * * \param ssn TCP session to which the given packet belongs * \param p Packet which has to be checked for its validity * * \retval 1 if the timestamp is valid * \retval 0 if the timestamp is invalid */ static int StreamTcpHandleTimestamp (TcpSession *ssn, Packet *p) { SCEnter(); TcpStream *sender_stream; TcpStream *receiver_stream; uint8_t ret = 1; uint8_t check_ts = 1; if (PKT_IS_TOSERVER(p)) { sender_stream = &ssn->client; receiver_stream = &ssn->server; } else { sender_stream = &ssn->server; receiver_stream = &ssn->client; } /* Set up the os_policy to be used in validating the timestamps based on the target system */ if (receiver_stream->os_policy == 0) { StreamTcpSetOSPolicy(receiver_stream, p); } if (TCP_HAS_TS(p)) { uint32_t ts = TCP_GET_TSVAL(p); if (sender_stream->flags & STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP) { /* The 3whs used the timestamp with 0 value. */ switch (receiver_stream->os_policy) { case OS_POLICY_LINUX: case OS_POLICY_WINDOWS2K3: /* Linux and windows 2003 does not allow the use of 0 as * timestamp in the 3whs. */ ssn->flags &= ~STREAMTCP_FLAG_TIMESTAMP; check_ts = 0; break; case OS_POLICY_OLD_LINUX: case OS_POLICY_WINDOWS: case OS_POLICY_VISTA: sender_stream->flags &= ~STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP; if (SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) { sender_stream->last_ts = ts; check_ts = 0; /*next packet will be checked for validity and stream TS has been updated with this one.*/ } break; default: break; } } if (receiver_stream->os_policy == OS_POLICY_HPUX11) { /*HPUX11 igoners the timestamp of out of order packets*/ if (!SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) check_ts = 0; } if (ts == 0) { switch (receiver_stream->os_policy) { case OS_POLICY_OLD_LINUX: case OS_POLICY_WINDOWS: case OS_POLICY_WINDOWS2K3: case OS_POLICY_VISTA: case OS_POLICY_SOLARIS: /* Old Linux and windows allowed packet with 0 timestamp. */ break; default: /* other OS simply drop the pakcet with 0 timestamp, when * 3whs has valid timestamp*/ goto invalid; } } if (check_ts) { int32_t result = 0; SCLogDebug("ts %"PRIu32", last_ts %"PRIu32"", ts, sender_stream->last_ts); if (receiver_stream->os_policy == OS_POLICY_LINUX) { /* Linux accepts TS which are off by one.*/ result = (int32_t) ((ts - sender_stream->last_ts) + 1); } else { result = (int32_t) (ts - sender_stream->last_ts); } SCLogDebug("result %"PRIi32", p->ts.tv_sec %"PRIuMAX"", result, (uintmax_t)p->ts.tv_sec); if (sender_stream->last_pkt_ts == 0 && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) { sender_stream->last_pkt_ts = p->ts.tv_sec; } if (result < 0) { SCLogDebug("timestamp is not valid sender_stream->last_ts " "%" PRIu32 " p->tcpvars->ts %" PRIu32 " result " "%" PRId32 "", sender_stream->last_ts, ts, result); /* candidate for rejection */ ret = 0; } else if ((sender_stream->last_ts != 0) && (((uint32_t) p->ts.tv_sec) > sender_stream->last_pkt_ts + PAWS_24DAYS)) { SCLogDebug("packet is not valid sender_stream->last_pkt_ts " "%" PRIu32 " p->ts.tv_sec %" PRIu32 "", sender_stream->last_pkt_ts, (uint32_t) p->ts.tv_sec); /* candidate for rejection */ ret = 0; } if (ret == 1) { /* Update the timestamp and last seen packet time for this * stream */ if (SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) sender_stream->last_ts = ts; sender_stream->last_pkt_ts = p->ts.tv_sec; } else if (ret == 0) { /* if the timestamp of packet is not valid then, check if the * current stream timestamp is not so old. if so then we need to * accept the packet and update the stream->last_ts (RFC 1323)*/ if ((SEQ_EQ(sender_stream->next_seq, TCP_GET_SEQ(p))) && (((uint32_t) p->ts.tv_sec > (sender_stream->last_pkt_ts + PAWS_24DAYS)))) { sender_stream->last_ts = ts; sender_stream->last_pkt_ts = p->ts.tv_sec; SCLogDebug("timestamp considered valid anyway"); } else { goto invalid; } } } } else { /* Solaris stops using timestamps if a packet is received without a timestamp and timestamps were used on that stream. */ if (receiver_stream->os_policy == OS_POLICY_SOLARIS) ssn->flags &= ~STREAMTCP_FLAG_TIMESTAMP; } SCReturnInt(1); invalid: StreamTcpSetEvent(p, STREAM_PKT_INVALID_TIMESTAMP); SCReturnInt(0); } /** * \brief Function to test the received ACK values against the stream window * and previous ack value. ACK values should be higher than previous * ACK value and less than the next_win value. * * \param ssn TcpSession for state access * \param stream TcpStream of which last_ack needs to be tested * \param p Packet which is used to test the last_ack * * \retval 0 ACK is valid, last_ack is updated if ACK was higher * \retval -1 ACK is invalid */ static inline int StreamTcpValidateAck(TcpSession *ssn, TcpStream *stream, Packet *p) { SCEnter(); uint32_t ack = TCP_GET_ACK(p); /* fast track */ if (SEQ_GT(ack, stream->last_ack) && SEQ_LEQ(ack, stream->next_win)) { SCLogDebug("ACK in bounds"); SCReturnInt(0); } /* fast track */ else if (SEQ_EQ(ack, stream->last_ack)) { SCLogDebug("pkt ACK %"PRIu32" == stream last ACK %"PRIu32, TCP_GET_ACK(p), stream->last_ack); SCReturnInt(0); } /* exception handling */ if (SEQ_LT(ack, stream->last_ack)) { SCLogDebug("pkt ACK %"PRIu32" < stream last ACK %"PRIu32, TCP_GET_ACK(p), stream->last_ack); /* This is an attempt to get a 'left edge' value that we can check against. * It doesn't work when the window is 0, need to think of a better way. */ if (stream->window != 0 && SEQ_LT(ack, (stream->last_ack - stream->window))) { SCLogDebug("ACK %"PRIu32" is before last_ack %"PRIu32" - window " "%"PRIu32" = %"PRIu32, ack, stream->last_ack, stream->window, stream->last_ack - stream->window); goto invalid; } SCReturnInt(0); } if (ssn->state > TCP_SYN_SENT && SEQ_GT(ack, stream->next_win)) { SCLogDebug("ACK %"PRIu32" is after next_win %"PRIu32, ack, stream->next_win); goto invalid; /* a toclient RST as a reponse to SYN, next_win is 0, ack will be isn+1, just like * the syn ack */ } else if (ssn->state == TCP_SYN_SENT && PKT_IS_TOCLIENT(p) && p->tcph->th_flags & TH_RST && SEQ_EQ(ack, stream->isn + 1)) { SCReturnInt(0); } SCLogDebug("default path leading to invalid: ACK %"PRIu32", last_ack %"PRIu32 " next_win %"PRIu32, ack, stream->last_ack, stream->next_win); invalid: StreamTcpSetEvent(p, STREAM_PKT_INVALID_ACK); SCReturnInt(-1); } /** \brief Set the No reassembly flag for the given direction in given TCP * session. * * \param ssn TCP Session to set the flag in * \param direction direction to set the flag in: 0 toserver, 1 toclient */ void StreamTcpSetSessionNoReassemblyFlag (TcpSession *ssn, char direction) { direction ? (ssn->server.flags |= STREAMTCP_STREAM_FLAG_NOREASSEMBLY) : (ssn->client.flags |= STREAMTCP_STREAM_FLAG_NOREASSEMBLY); } /** \brief Set the No reassembly flag for the given direction in given TCP * session. * * \param ssn TCP Session to set the flag in * \param direction direction to set the flag in: 0 toserver, 1 toclient */ void StreamTcpSetDisableRawReassemblyFlag (TcpSession *ssn, char direction) { direction ? (ssn->server.flags |= STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED) : (ssn->client.flags |= STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED); } #define PSEUDO_PKT_SET_IPV4HDR(nipv4h,ipv4h) do { \ IPV4_SET_RAW_VER(nipv4h, IPV4_GET_RAW_VER(ipv4h)); \ IPV4_SET_RAW_HLEN(nipv4h, IPV4_GET_RAW_HLEN(ipv4h)); \ IPV4_SET_RAW_IPLEN(nipv4h, IPV4_GET_RAW_IPLEN(ipv4h)); \ IPV4_SET_RAW_IPTOS(nipv4h, IPV4_GET_RAW_IPTOS(ipv4h)); \ IPV4_SET_RAW_IPPROTO(nipv4h, IPV4_GET_RAW_IPPROTO(ipv4h)); \ (nipv4h)->s_ip_src = IPV4_GET_RAW_IPDST(ipv4h); \ (nipv4h)->s_ip_dst = IPV4_GET_RAW_IPSRC(ipv4h); \ } while (0) #define PSEUDO_PKT_SET_IPV6HDR(nipv6h,ipv6h) do { \ (nipv6h)->s_ip6_src[0] = (ipv6h)->s_ip6_dst[0]; \ (nipv6h)->s_ip6_src[1] = (ipv6h)->s_ip6_dst[1]; \ (nipv6h)->s_ip6_src[2] = (ipv6h)->s_ip6_dst[2]; \ (nipv6h)->s_ip6_src[3] = (ipv6h)->s_ip6_dst[3]; \ (nipv6h)->s_ip6_dst[0] = (ipv6h)->s_ip6_src[0]; \ (nipv6h)->s_ip6_dst[1] = (ipv6h)->s_ip6_src[1]; \ (nipv6h)->s_ip6_dst[2] = (ipv6h)->s_ip6_src[2]; \ (nipv6h)->s_ip6_dst[3] = (ipv6h)->s_ip6_src[3]; \ IPV6_SET_RAW_NH(nipv6h, IPV6_GET_RAW_NH(ipv6h)); \ } while (0) #define PSEUDO_PKT_SET_TCPHDR(ntcph,tcph) do { \ COPY_PORT((tcph)->th_dport, (ntcph)->th_sport); \ COPY_PORT((tcph)->th_sport, (ntcph)->th_dport); \ (ntcph)->th_seq = (tcph)->th_ack; \ (ntcph)->th_ack = (tcph)->th_seq; \ } while (0) /** * \brief Function to fetch a packet from the packet allocation queue for * creation of the pseudo packet from the reassembled stream. * * @param parent Pointer to the parent of the pseudo packet * @param pkt pointer to the raw packet of the parent * @param len length of the packet * @return upon success returns the pointer to the new pseudo packet * otherwise NULL */ Packet *StreamTcpPseudoSetup(Packet *parent, uint8_t *pkt, uint32_t len) { SCEnter(); if (len == 0) { SCReturnPtr(NULL, "Packet"); } Packet *p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCReturnPtr(NULL, "Packet"); } /* set the root ptr to the lowest layer */ if (parent->root != NULL) p->root = parent->root; else p->root = parent; /* copy packet and set lenght, proto */ p->proto = parent->proto; p->datalink = parent->datalink; PacketCopyData(p, pkt, len); p->recursion_level = parent->recursion_level + 1; p->ts.tv_sec = parent->ts.tv_sec; p->ts.tv_usec = parent->ts.tv_usec; FlowReference(&p->flow, parent->flow); /* set tunnel flags */ /* tell new packet it's part of a tunnel */ SET_TUNNEL_PKT(p); /* tell parent packet it's part of a tunnel */ SET_TUNNEL_PKT(parent); /* increment tunnel packet refcnt in the root packet */ TUNNEL_INCR_PKT_TPR(p); return p; } /** * \brief Function to setup the IP and TCP header of the pseudo packet from * the newly copied raw packet contents of the parent. * * @param np pointer to the pseudo packet * @param p pointer to the original packet */ static void StreamTcpPseudoPacketSetupHeader(Packet *np, Packet *p) { /* Setup the IP header */ if (PKT_IS_IPV4(p)) { np->ip4h = (IPV4Hdr *)((uint8_t *)GET_PKT_DATA(np) + (GET_PKT_LEN(np) - IPV4_GET_IPLEN(p))); PSEUDO_PKT_SET_IPV4HDR(np->ip4h, p->ip4h); /* Similarly setup the TCP header with ports in opposite direction */ np->tcph = (TCPHdr *)((uint8_t *)np->ip4h + IPV4_GET_HLEN(np)); PSEUDO_PKT_SET_TCPHDR(np->tcph, p->tcph); /* Setup the adress and port details */ SET_IPV4_SRC_ADDR(p, &np->dst); SET_IPV4_DST_ADDR(p, &np->src); SET_TCP_SRC_PORT(p, &np->dp); SET_TCP_DST_PORT(p, &np->sp); } else if (PKT_IS_IPV6(p)) { np->ip6h = (IPV6Hdr *)((uint8_t *)GET_PKT_DATA(np) + (GET_PKT_LEN(np) - IPV6_GET_PLEN(p) - IPV6_HEADER_LEN)); PSEUDO_PKT_SET_IPV6HDR(np->ip6h, p->ip6h); /* Similarly setup the TCP header with ports in opposite direction */ np->tcph = (TCPHdr *)((uint8_t *)np->ip6h + IPV6_HEADER_LEN); PSEUDO_PKT_SET_TCPHDR(np->tcph, p->tcph); /* Setup the adress and port details */ SET_IPV6_SRC_ADDR(p, &np->dst); SET_IPV6_DST_ADDR(p, &np->src); SET_TCP_SRC_PORT(p, &np->dp); SET_TCP_DST_PORT(p, &np->sp); } /* we don't need a payload (if any) */ np->payload = NULL; np->payload_len = 0; } /** \brief Create a pseudo packet injected into the engine to signal the * opposing direction of this stream to wrap up stream reassembly. * * \param p real packet * \param pq packet queue to store the new pseudo packet in */ void StreamTcpPseudoPacketCreateStreamEndPacket(ThreadVars *tv, StreamTcpThread *stt, Packet *p, TcpSession *ssn, PacketQueue *pq) { SCEnter(); if (p->flags & PKT_PSEUDO_STREAM_END) { SCReturn; } /* no need for a pseudo packet if there is nothing left to reassemble */ if (ssn->server.seg_list == NULL && ssn->client.seg_list == NULL) { SCReturn; } Packet *np = StreamTcpPseudoSetup(p, GET_PKT_DATA(p), GET_PKT_LEN(p)); if (np == NULL) { SCLogDebug("The packet received from packet allocation is NULL"); StatsIncr(tv, stt->counter_tcp_pseudo_failed); SCReturn; } PKT_SET_SRC(np, PKT_SRC_STREAM_TCP_STREAM_END_PSEUDO); /* Setup the IP and TCP headers */ StreamTcpPseudoPacketSetupHeader(np,p); np->tenant_id = p->flow->tenant_id; np->flowflags = p->flowflags; np->flags |= PKT_STREAM_EST; np->flags |= PKT_STREAM_EOF; np->flags |= PKT_HAS_FLOW; np->flags |= PKT_PSEUDO_STREAM_END; if (p->flags & PKT_NOPACKET_INSPECTION) { DecodeSetNoPacketInspectionFlag(np); } if (p->flags & PKT_NOPAYLOAD_INSPECTION) { DecodeSetNoPayloadInspectionFlag(np); } if (PKT_IS_TOSERVER(p)) { SCLogDebug("original is to_server, so pseudo is to_client"); np->flowflags &= ~FLOW_PKT_TOSERVER; np->flowflags |= FLOW_PKT_TOCLIENT; #ifdef DEBUG BUG_ON(!(PKT_IS_TOCLIENT(np))); BUG_ON((PKT_IS_TOSERVER(np))); #endif } else if (PKT_IS_TOCLIENT(p)) { SCLogDebug("original is to_client, so pseudo is to_server"); np->flowflags &= ~FLOW_PKT_TOCLIENT; np->flowflags |= FLOW_PKT_TOSERVER; #ifdef DEBUG BUG_ON(!(PKT_IS_TOSERVER(np))); BUG_ON((PKT_IS_TOCLIENT(np))); #endif } PacketEnqueue(pq, np); StatsIncr(tv, stt->counter_tcp_pseudo); SCReturn; } /** * \brief Run callback function on each TCP segment * * \note when stream engine is running in inline mode all segments are used, * in IDS/non-inline mode only ack'd segments are iterated. * * \note Must be called under flow lock. * * \return -1 in case of error, the number of segment in case of success * */ int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data) { TcpSession *ssn = NULL; TcpStream *stream = NULL; int ret = 0; int cnt = 0; if (p->flow == NULL) return 0; ssn = (TcpSession *)p->flow->protoctx; if (ssn == NULL) { return 0; } if (flag & FLOW_PKT_TOSERVER) { stream = &(ssn->server); } else { stream = &(ssn->client); } /* for IDS, return ack'd segments. For IPS all. */ TcpSegment *seg = stream->seg_list; for (; seg != NULL && (stream_inline || SEQ_LT(seg->seq, stream->last_ack));) { ret = CallbackFunc(p, data, seg->payload, seg->payload_len); if (ret != 1) { SCLogDebug("Callback function has failed"); return -1; } seg = seg->next; cnt++; } return cnt; } int StreamTcpBypassEnabled(void) { return stream_config.bypass; } void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size) { if (size > ssn->reassembly_depth || size == 0) { ssn->reassembly_depth = size; } return; } #ifdef UNITTESTS /** * \test Test the allocation of TCP session for a given packet from the * ssn_pool. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest01 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); TcpSession *ssn = StreamTcpNewSession(p, 0); if (ssn == NULL) { printf("Session can not be allocated: "); goto end; } f.protoctx = ssn; if (f.alparser != NULL) { printf("AppLayer field not set to NULL: "); goto end; } if (ssn->state != 0) { printf("TCP state field not set to 0: "); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the deallocation of TCP session for a given packet and return * the memory back to ssn_pool and corresponding segments to segment * pool. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest02 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx ra_ctx; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&ra_ctx, 0, sizeof(TcpReassemblyThreadCtx)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; int ret = 0; stt.ra_ctx = &ra_ctx; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(6); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we missed the intial * SYN packet of the session. The session is setup only if midstream * sessions are allowed to setup. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest03 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_SYN|TH_ACK; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(19); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 20 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 11) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we missed the intial * SYN/ACK packet of the session. The session is setup only if * midstream sessions are allowed to setup. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest04 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(9); p->tcph->th_ack = htonl(19); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 10 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 20) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we missed the intial * 3WHS packet of the session. The session is setup only if * midstream sessions are allowed to setup. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest05 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(13); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, 4); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(19); p->tcph->th_ack = htonl(16); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x44, 3, 4); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 16 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 23) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we have seen only the * FIN, RST packets packet of the session. The session is setup only if * midstream sessions are allowed to setup. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest06 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; TcpSession ssn; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof (TcpSession)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); tcph.th_flags = TH_FIN; p->tcph = &tcph; FLOWLOCK_WRLOCK(&f); /* StreamTcpPacket returns -1 on unsolicited FIN */ if (StreamTcpPacket(&tv, p, &stt, &pq) != -1) { printf("StreamTcpPacket failed: "); goto end; } if (((TcpSession *)(p->flow->protoctx)) != NULL) { printf("we have a ssn while we shouldn't: "); goto end; } p->tcph->th_flags = TH_RST; /* StreamTcpPacket returns -1 on unsolicited RST */ if (StreamTcpPacket(&tv, p, &stt, &pq) != -1) { printf("StreamTcpPacket failed (2): "); goto end; } if (((TcpSession *)(p->flow->protoctx)) != NULL) { printf("we have a ssn while we shouldn't (2): "); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the working on PAWS. The packet will be dropped by stream, as * its timestamp is old, although the segment is in the window. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest07 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF(unlikely(p == NULL)); Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[1] = {0x42}; PacketQueue pq; memset(p, 0, SIZE_OF_PACKET); memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof(StreamTcpThread)); memset(&tcph, 0, sizeof(TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); stream_config.midstream = TRUE; /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->tcpvars.ts_set = TRUE; p->tcpvars.ts_val = 10; p->tcpvars.ts_ecr = 11; p->payload = payload; p->payload_len = 1; FLOWLOCK_WRLOCK(&f); FAIL_IF(StreamTcpPacket(&tv, p, &stt, &pq) == -1); p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; p->tcpvars.ts_val = 2; FAIL_IF(StreamTcpPacket(&tv, p, &stt, &pq) != -1); FAIL_IF (((TcpSession *) (p->flow->protoctx))->client.next_seq != 11); StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); PASS; } /** * \test Test the working on PAWS. The packet will be accpeted by engine as * the timestamp is valid and it is in window. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest08 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF(unlikely(p == NULL)); Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[1] = {0x42}; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof(StreamTcpThread)); memset(&tcph, 0, sizeof(TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); stream_config.midstream = TRUE; /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->tcpvars.ts_set = TRUE; p->tcpvars.ts_val = 10; p->tcpvars.ts_ecr = 11; p->payload = payload; p->payload_len = 1; FLOWLOCK_WRLOCK(&f); FAIL_IF(StreamTcpPacket(&tv, p, &stt, &pq) == -1); p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(20); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; p->tcpvars.ts_val = 12; FAIL_IF(StreamTcpPacket(&tv, p, &stt, &pq) == -1); FAIL_IF(((TcpSession *) (p->flow->protoctx))->client.next_seq != 12); StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); PASS; } /** * \test Test the working of No stream reassembly flag. The stream will not * reassemble the segment if the flag is set. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest09 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[1] = {0x42}; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof(StreamTcpThread)); memset(&tcph, 0, sizeof(TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); stream_config.midstream = TRUE; //prevent L7 from kicking in StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->payload = payload; p->payload_len = 1; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(12); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpSetSessionNoReassemblyFlag(((TcpSession *)(p->flow->protoctx)), 0); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (((TcpSession *) (p->flow->protoctx))->client.seg_list->next == NULL) ret = 1; StreamTcpSessionClear(p->flow->protoctx); end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we are seeing asynchronous * stream, while we see all the packets in that stream from start. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest10 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(11); tcph.th_flags = TH_SYN; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(6); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.async_oneside != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("failed in setting state\n"); goto end; } if (! (((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_ASYNC)) { printf("failed in setting asynchronous session\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.last_ack != 6 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 11) { printf("failed in seq %"PRIu32" match\n", ((TcpSession *)(p->flow->protoctx))->client.last_ack); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we are seeing asynchronous * stream, while we missed the SYN packet of that stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest11 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(1); tcph.th_flags = TH_SYN|TH_ACK; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(2); p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.async_oneside != TRUE) { ret = 1; goto end; } if (! (((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_ASYNC)) { printf("failed in setting asynchronous session\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("failed in setting state\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->server.last_ack != 2 && ((TcpSession *)(p->flow->protoctx))->client.next_seq != 1) { printf("failed in seq %"PRIu32" match\n", ((TcpSession *)(p->flow->protoctx))->server.last_ack); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we are seeing asynchronous * stream, while we missed the SYN and SYN/ACK packets in that stream. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest12 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(11); tcph.th_flags = TH_ACK; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(10); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(6); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.async_oneside != TRUE) { ret = 1; goto end; } if (! (((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_ASYNC)) { printf("failed in setting asynchronous session\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("failed in setting state\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.last_ack != 6 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 11) { printf("failed in seq %"PRIu32" match\n", ((TcpSession *)(p->flow->protoctx))->client.last_ack); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session when we are seeing asynchronous * stream, while we missed the SYN and SYN/ACK packets in that stream. * Later, we start to receive the packet from other end stream too. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest13 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(11); tcph.th_flags = TH_ACK; p->tcph = &tcph; int ret = 0; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(10); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(6); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.async_oneside != TRUE) { ret = 1; goto end; } if (! (((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_ASYNC)) { printf("failed in setting asynchronous session\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("failed in setting state\n"); goto end; } p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(9); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p->flow->protoctx))->client.last_ack != 9 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 14) { printf("failed in seq %"PRIu32" match\n", ((TcpSession *)(p->flow->protoctx))->client.last_ack); goto end; } StreamTcpSessionPktFree(p); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /* Dummy conf string to setup the OS policy for unit testing */ static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "default-log-dir: /var/log/eidps\n" "\n" "logging:\n" "\n" " default-log-level: debug\n" "\n" " default-format: \"<%t> - <%l>\"\n" "\n" " default-startup-message: Your IDS has started.\n" "\n" " default-output-filter:\n" "\n" "host-os-policy:\n" "\n" " windows: 192.168.0.1\n" "\n" " linux: 192.168.0.2\n" "\n"; /* Dummy conf string to setup the OS policy for unit testing */ static const char *dummy_conf_string1 = "%YAML 1.1\n" "---\n" "\n" "default-log-dir: /var/log/eidps\n" "\n" "logging:\n" "\n" " default-log-level: debug\n" "\n" " default-format: \"<%t> - <%l>\"\n" "\n" " default-startup-message: Your IDS has started.\n" "\n" " default-output-filter:\n" "\n" "host-os-policy:\n" "\n" " windows: 192.168.0.0/24," "192.168.1.1\n" "\n" " linux: 192.168.1.0/24," "192.168.0.1\n" "\n"; /** * \brief Function to parse the dummy conf string and get the value of IP * address for the corresponding OS policy type. * * \param conf_val_name Name of the OS policy type * \retval returns IP address as string on success and NULL on failure */ char *StreamTcpParseOSPolicy (char *conf_var_name) { SCEnter(); char conf_var_type_name[15] = "host-os-policy"; char *conf_var_full_name = NULL; char *conf_var_value = NULL; if (conf_var_name == NULL) goto end; /* the + 2 is for the '.' and the string termination character '\0' */ conf_var_full_name = (char *)SCMalloc(strlen(conf_var_type_name) + strlen(conf_var_name) + 2); if (conf_var_full_name == NULL) goto end; if (snprintf(conf_var_full_name, strlen(conf_var_type_name) + strlen(conf_var_name) + 2, "%s.%s", conf_var_type_name, conf_var_name) < 0) { SCLogError(SC_ERR_INVALID_VALUE, "Error in making the conf full name"); goto end; } if (ConfGet(conf_var_full_name, &conf_var_value) != 1) { SCLogError(SC_ERR_UNKNOWN_VALUE, "Error in getting conf value for conf name %s", conf_var_full_name); goto end; } SCLogDebug("Value obtained from the yaml conf file, for the var " "\"%s\" is \"%s\"", conf_var_name, conf_var_value); end: if (conf_var_full_name != NULL) SCFree(conf_var_full_name); SCReturnCharPtr(conf_var_value); } /** * \test Test the setting up a OS policy. Te OS policy values are defined in * the config string "dummy_conf_string" * * \retval On success it returns 1 and on failure 0 */ static int StreamTcpTest14 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; struct in_addr addr; IPV4Hdr ipv4h; char os_policy_name[10] = "windows"; char *ip_addr; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&addr, 0, sizeof(addr)); memset(&ipv4h, 0, sizeof(ipv4h)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); strlcpy(os_policy_name, "linux\0", sizeof(os_policy_name)); ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); addr.s_addr = inet_addr("192.168.0.1"); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->dst.family = AF_INET; p->dst.address.address_un_data32[0] = addr.s_addr; p->ip4h = &ipv4h; StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/ p->payload = payload; p->payload_len = 3; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, sizeof(payload)); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(15); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(14); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; addr.s_addr = inet_addr("192.168.0.2"); p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 13 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 23) { printf("failed in next_seq match client.next_seq %"PRIu32"" " server.next_seq %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->client.next_seq, ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.os_policy != OS_POLICY_WINDOWS && ((TcpSession *) (p->flow->protoctx))->server.os_policy != OS_POLICY_LINUX) { printf("failed in setting up OS policy, client.os_policy: %"PRIu8"" " should be %"PRIu8" and server.os_policy: %"PRIu8"" " should be %"PRIu8"\n", ((TcpSession *) (p->flow->protoctx))->client.os_policy, (uint8_t)OS_POLICY_WINDOWS, ((TcpSession *)(p->flow->protoctx))->server.os_policy, (uint8_t)OS_POLICY_LINUX); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a TCP session using the 4WHS: * SYN, SYN, SYN/ACK, ACK * * \retval On success it returns 1 and on failure 0. */ static int StreamTcp4WHSTest01 (void) { int ret = 0; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = 0; tcph.th_flags = TH_SYN; p->tcph = &tcph; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = 0; p->tcph->th_flags = TH_SYN; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if ((!(((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_4WHS))) { printf("STREAMTCP_FLAG_4WHS flag not set: "); goto end; } p->tcph->th_seq = htonl(10); p->tcph->th_ack = htonl(21); /* the SYN/ACK uses the SEQ from the first SYN pkt */ p->tcph->th_flags = TH_SYN|TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(21); p->tcph->th_ack = htonl(10); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("state is not ESTABLISHED: "); goto end; } ret = 1; end: StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test set up a TCP session using the 4WHS: * SYN, SYN, SYN/ACK, ACK, but the SYN/ACK does * not have the right SEQ * * \retval On success it returns 1 and on failure 0. */ static int StreamTcp4WHSTest02 (void) { int ret = 0; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = 0; tcph.th_flags = TH_SYN; p->tcph = &tcph; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = 0; p->tcph->th_flags = TH_SYN; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if ((!(((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_4WHS))) { printf("STREAMTCP_FLAG_4WHS flag not set: "); goto end; } p->tcph->th_seq = htonl(30); p->tcph->th_ack = htonl(21); /* the SYN/ACK uses the SEQ from the first SYN pkt */ p->tcph->th_flags = TH_SYN|TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) != -1) { printf("SYN/ACK pkt not rejected but it should have: "); goto end; } ret = 1; end: StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test set up a TCP session using the 4WHS: * SYN, SYN, SYN/ACK, ACK: however the SYN/ACK and ACK * are part of a normal 3WHS * * \retval On success it returns 1 and on failure 0. */ static int StreamTcp4WHSTest03 (void) { int ret = 0; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; memset(p, 0, SIZE_OF_PACKET); PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p->flow = &f; StreamTcpInitConfig(TRUE); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = 0; tcph.th_flags = TH_SYN; p->tcph = &tcph; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = 0; p->tcph->th_flags = TH_SYN; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if ((!(((TcpSession *)(p->flow->protoctx))->flags & STREAMTCP_FLAG_4WHS))) { printf("STREAMTCP_FLAG_4WHS flag not set: "); goto end; } p->tcph->th_seq = htonl(30); p->tcph->th_ack = htonl(11); p->tcph->th_flags = TH_SYN|TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(11); p->tcph->th_ack = htonl(31); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) { printf("state is not ESTABLISHED: "); goto end; } ret = 1; end: StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a OS policy. Te OS policy values are defined in * the config string "dummy_conf_string1" * * \retval On success it returns 1 and on failure 0 */ static int StreamTcpTest15 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; struct in_addr addr; IPV4Hdr ipv4h; char os_policy_name[10] = "windows"; char *ip_addr; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&addr, 0, sizeof(addr)); memset(&ipv4h, 0, sizeof(ipv4h)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); strlcpy(os_policy_name, "linux\0", sizeof(os_policy_name)); ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); addr.s_addr = inet_addr("192.168.0.20"); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->dst.family = AF_INET; p->dst.address.address_un_data32[0] = addr.s_addr; p->ip4h = &ipv4h; StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/ p->payload = payload; p->payload_len = 3; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, sizeof(payload)); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(15); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(14); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; addr.s_addr = inet_addr("192.168.1.20"); p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 13 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 23) { printf("failed in next_seq match client.next_seq %"PRIu32"" " server.next_seq %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->client.next_seq, ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.os_policy != OS_POLICY_WINDOWS && ((TcpSession *) (p->flow->protoctx))->server.os_policy != OS_POLICY_LINUX) { printf("failed in setting up OS policy, client.os_policy: %"PRIu8"" " should be %"PRIu8" and server.os_policy: %"PRIu8"" " should be %"PRIu8"\n", ((TcpSession *) (p->flow->protoctx))->client.os_policy, (uint8_t)OS_POLICY_WINDOWS, ((TcpSession *)(p->flow->protoctx))->server.os_policy, (uint8_t)OS_POLICY_LINUX); goto end; } StreamTcpSessionPktFree(p); ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a OS policy. Te OS policy values are defined in * the config string "dummy_conf_string1" * * \retval On success it returns 1 and on failure 0 */ static int StreamTcpTest16 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; struct in_addr addr; IPV4Hdr ipv4h; char os_policy_name[10] = "windows"; char *ip_addr; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&addr, 0, sizeof(addr)); memset(&ipv4h, 0, sizeof(ipv4h)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); strlcpy(os_policy_name, "linux\0", sizeof(os_policy_name)); ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); addr.s_addr = inet_addr("192.168.0.1"); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->dst.family = AF_INET; p->dst.address.address_un_data32[0] = addr.s_addr; p->ip4h = &ipv4h; StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/ p->payload = payload; p->payload_len = 3; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, sizeof(payload)); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(15); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(14); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; addr.s_addr = inet_addr("192.168.1.1"); p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 13 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 23) { printf("failed in next_seq match client.next_seq %"PRIu32"" " server.next_seq %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->client.next_seq, ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.os_policy != OS_POLICY_LINUX && ((TcpSession *) (p->flow->protoctx))->server.os_policy != OS_POLICY_WINDOWS) { printf("failed in setting up OS policy, client.os_policy: %"PRIu8"" " should be %"PRIu8" and server.os_policy: %"PRIu8"" " should be %"PRIu8"\n", ((TcpSession *) (p->flow->protoctx))->client.os_policy, (uint8_t)OS_POLICY_LINUX, ((TcpSession *)(p->flow->protoctx))->server.os_policy, (uint8_t)OS_POLICY_WINDOWS); goto end; } StreamTcpSessionPktFree(p); ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the setting up a OS policy. Te OS policy values are defined in * the config string "dummy_conf_string1". To check the setting of * Default os policy * * \retval On success it returns 1 and on failure 0 */ static int StreamTcpTest17 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; uint8_t payload[4]; struct in_addr addr; IPV4Hdr ipv4h; char os_policy_name[10] = "windows"; char *ip_addr; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&addr, 0, sizeof(addr)); memset(&ipv4h, 0, sizeof(ipv4h)); FLOW_INITIALIZE(&f); p->flow = &f; int ret = 0; StreamTcpInitConfig(TRUE); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); strlcpy(os_policy_name, "linux\0", sizeof(os_policy_name)); ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); addr.s_addr = inet_addr("192.168.0.1"); tcph.th_win = htons(5480); tcph.th_seq = htonl(10); tcph.th_ack = htonl(20); tcph.th_flags = TH_ACK|TH_PUSH; p->tcph = &tcph; p->dst.family = AF_INET; p->dst.address.address_un_data32[0] = addr.s_addr; p->ip4h = &ipv4h; StreamTcpCreateTestPacket(payload, 0x41, 3, sizeof(payload)); /*AAA*/ p->payload = payload; p->payload_len = 3; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(20); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x42, 3, sizeof(payload)); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(15); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(14); p->tcph->th_ack = htonl(23); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x43, 3, sizeof(payload)); /*CCC*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; addr.s_addr = inet_addr("10.1.1.1"); p->tcph->th_seq = htonl(25); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_seq = htonl(24); p->tcph->th_ack = htonl(13); p->tcph->th_flags = TH_ACK|TH_PUSH; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x44, 3, sizeof(payload)); /*DDD*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; if (stream_config.midstream != TRUE) { ret = 1; goto end; } if (((TcpSession *)(p->flow->protoctx))->state != TCP_ESTABLISHED) goto end; if (((TcpSession *)(p->flow->protoctx))->client.next_seq != 13 && ((TcpSession *)(p->flow->protoctx))->server.next_seq != 23) { printf("failed in next_seq match client.next_seq %"PRIu32"" " server.next_seq %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->client.next_seq, ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } if (((TcpSession *)(p->flow->protoctx))->client.os_policy != OS_POLICY_LINUX && ((TcpSession *) (p->flow->protoctx))->server.os_policy != OS_POLICY_DEFAULT) { printf("failed in setting up OS policy, client.os_policy: %"PRIu8"" " should be %"PRIu8" and server.os_policy: %"PRIu8"" " should be %"PRIu8"\n", ((TcpSession *) (p->flow->protoctx))->client.os_policy, (uint8_t)OS_POLICY_LINUX, ((TcpSession *)(p->flow->protoctx))->server.os_policy, (uint8_t)OS_POLICY_DEFAULT); goto end; } StreamTcpSessionPktFree(p); ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** \test Test the various OS policies based on different IP addresses from confuguration defined in 'dummy_conf_string1' */ static int StreamTcpTest18 (void) { struct in_addr addr; char os_policy_name[10] = "windows"; char *ip_addr; TcpStream stream; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV4Hdr ipv4h; int ret = 0; memset(&addr, 0, sizeof(addr)); memset(&stream, 0, sizeof(stream)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(ipv4h)); StreamTcpInitConfig(TRUE); SCHInfoCleanResources(); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); p->dst.family = AF_INET; p->ip4h = &ipv4h; addr.s_addr = inet_addr("192.168.1.1"); p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpSetOSPolicy(&stream, p); if (stream.os_policy != OS_POLICY_WINDOWS) goto end; ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return ret; } /** \test Test the various OS policies based on different IP addresses from confuguration defined in 'dummy_conf_string1' */ static int StreamTcpTest19 (void) { struct in_addr addr; char os_policy_name[10] = "windows"; char *ip_addr; TcpStream stream; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV4Hdr ipv4h; int ret = 0; memset(&addr, 0, sizeof(addr)); memset(&stream, 0, sizeof(stream)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(ipv4h)); StreamTcpInitConfig(TRUE); SCHInfoCleanResources(); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); p->dst.family = AF_INET; p->ip4h = &ipv4h; addr.s_addr = inet_addr("192.168.0.30"); p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpSetOSPolicy(&stream, p); if (stream.os_policy != OS_POLICY_WINDOWS) { printf("expected os_policy: %"PRIu8" but received %"PRIu8": ", (uint8_t)OS_POLICY_WINDOWS, stream.os_policy); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return ret; } /** \test Test the various OS policies based on different IP addresses from confuguration defined in 'dummy_conf_string1' */ static int StreamTcpTest20 (void) { struct in_addr addr; char os_policy_name[10] = "linux"; char *ip_addr; TcpStream stream; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV4Hdr ipv4h; int ret = 0; memset(&addr, 0, sizeof(addr)); memset(&stream, 0, sizeof(stream)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(ipv4h)); StreamTcpInitConfig(TRUE); SCHInfoCleanResources(); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); p->dst.family = AF_INET; p->ip4h = &ipv4h; addr.s_addr = inet_addr("192.168.0.1"); p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpSetOSPolicy(&stream, p); if (stream.os_policy != OS_POLICY_LINUX) { printf("expected os_policy: %"PRIu8" but received %"PRIu8"\n", (uint8_t)OS_POLICY_LINUX, stream.os_policy); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return ret; } /** \test Test the various OS policies based on different IP addresses from confuguration defined in 'dummy_conf_string1' */ static int StreamTcpTest21 (void) { struct in_addr addr; char os_policy_name[10] = "linux"; char *ip_addr; TcpStream stream; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV4Hdr ipv4h; int ret = 0; memset(&addr, 0, sizeof(addr)); memset(&stream, 0, sizeof(stream)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(ipv4h)); StreamTcpInitConfig(TRUE); SCHInfoCleanResources(); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); p->dst.family = AF_INET; p->ip4h = &ipv4h; addr.s_addr = inet_addr("192.168.1.30"); p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpSetOSPolicy(&stream, p); if (stream.os_policy != OS_POLICY_LINUX) { printf("expected os_policy: %"PRIu8" but received %"PRIu8"\n", (uint8_t)OS_POLICY_LINUX, stream.os_policy); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return ret; } /** \test Test the various OS policies based on different IP addresses from confuguration defined in 'dummy_conf_string1' */ static int StreamTcpTest22 (void) { struct in_addr addr; char os_policy_name[10] = "windows"; char *ip_addr; TcpStream stream; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV4Hdr ipv4h; int ret = 0; memset(&addr, 0, sizeof(addr)); memset(&stream, 0, sizeof(stream)); memset(p, 0, SIZE_OF_PACKET); memset(&ipv4h, 0, sizeof(ipv4h)); StreamTcpInitConfig(TRUE); SCHInfoCleanResources(); /* Load the config string in to parser */ ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string1, strlen(dummy_conf_string1)); /* Get the IP address as string and add it to Host info tree for lookups */ ip_addr = StreamTcpParseOSPolicy(os_policy_name); SCHInfoAddHostOSInfo(os_policy_name, ip_addr, -1); p->dst.family = AF_INET; p->ip4h = &ipv4h; addr.s_addr = inet_addr("123.231.2.1"); p->dst.address.address_un_data32[0] = addr.s_addr; StreamTcpSetOSPolicy(&stream, p); if (stream.os_policy != OS_POLICY_DEFAULT) { printf("expected os_policy: %"PRIu8" but received %"PRIu8"\n", (uint8_t)OS_POLICY_DEFAULT, stream.os_policy); goto end; } ret = 1; end: StreamTcpFreeConfig(TRUE); ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return ret; } /** \test Test the stream mem leaks conditions. */ static int StreamTcpTest23(void) { TcpSession ssn; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t packet[1460] = ""; ThreadVars tv; int result = 1; PacketQueue pq; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; memset(&pq,0,sizeof(PacketQueue)); memset(&ssn, 0, sizeof (TcpSession)); memset(p, 0, SIZE_OF_PACKET); memset(&f, 0, sizeof (Flow)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&tv, 0, sizeof (ThreadVars)); StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); FLOW_INITIALIZE(&f); ssn.client.os_policy = OS_POLICY_BSD; f.protoctx = &ssn; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; ssn.client.ra_app_base_seq = ssn.client.ra_raw_base_seq = ssn.client.last_ack = 3184324453UL; p->tcph->th_seq = htonl(3184324453UL); p->tcph->th_ack = htonl(3373419609UL); p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling: "); result &= 0; goto end; } p->tcph->th_seq = htonl(3184324455UL); p->tcph->th_ack = htonl(3373419621UL); p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling: "); result &= 0; goto end; } p->tcph->th_seq = htonl(3184324453UL); p->tcph->th_ack = htonl(3373419621UL); p->payload_len = 6; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling: "); result &= 0; // goto end; } if(ssn.client.seg_list_tail != NULL && ssn.client.seg_list_tail->payload_len != 4) { printf("failed in segment reassmebling: "); result &= 0; } end: StreamTcpReturnStreamSegments(&ssn.client); StreamTcpFreeConfig(TRUE); if (SC_ATOMIC_GET(st_memuse) == 0) { result &= 1; } else { printf("smemuse.stream_memuse %"PRIu64"\n", SC_ATOMIC_GET(st_memuse)); } SCFree(p); FLOW_DESTROY(&f); return result; } /** \test Test the stream mem leaks conditions. */ static int StreamTcpTest24(void) { TcpSession ssn; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); uint8_t packet[1460] = ""; ThreadVars tv; int result = 1; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); memset(&ssn, 0, sizeof (TcpSession)); memset(p, 0, SIZE_OF_PACKET); memset(&f, 0, sizeof (Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); ssn.client.os_policy = OS_POLICY_BSD; f.protoctx = &ssn; p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; p->flow = &f; tcph.th_win = 5480; tcph.th_flags = TH_PUSH | TH_ACK; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; p->payload = packet; ssn.client.ra_app_base_seq = ssn.client.ra_raw_base_seq = ssn.client.last_ack = 3184324453UL; p->tcph->th_seq = htonl(3184324455UL); p->tcph->th_ack = htonl(3373419621UL); p->payload_len = 4; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } p->tcph->th_seq = htonl(3184324459UL); p->tcph->th_ack = htonl(3373419633UL); p->payload_len = 2; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } p->tcph->th_seq = htonl(3184324459UL); p->tcph->th_ack = htonl(3373419657UL); p->payload_len = 4; if (StreamTcpReassembleHandleSegment(&tv, ra_ctx,&ssn, &ssn.client, p, &pq) == -1) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } if(ssn.client.seg_list_tail != NULL && ssn.client.seg_list_tail->payload_len != 2) { printf("failed in segment reassmebling\n"); result &= 0; } end: StreamTcpReturnStreamSegments(&ssn.client); StreamTcpFreeConfig(TRUE); if (SC_ATOMIC_GET(st_memuse) == 0) { result &= 1; } else { printf("smemuse.stream_memuse %"PRIu64"\n", SC_ATOMIC_GET(st_memuse)); } SCFree(p); FLOW_DESTROY(&f); return result; } /** * \test Test the initialization of tcp streams with congestion flags * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest25(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN | TH_CWR; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; /* prevent L7 from kicking in */ StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER, 4096); StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOCLIENT, 4096); StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(6); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the initialization of tcp streams with congestion flags * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest26(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN | TH_ECN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(6); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the initialization of tcp streams with congestion flags * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest27(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN | TH_CWR | TH_ECN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(6); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x42, 3, 4); /*BBB*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) goto end; StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** \test Test the memcap incrementing/decrementing and memcap check */ static int StreamTcpTest28(void) { uint8_t ret = 0; StreamTcpInitConfig(TRUE); uint32_t memuse = SC_ATOMIC_GET(st_memuse); StreamTcpIncrMemuse(500); if (SC_ATOMIC_GET(st_memuse) != (memuse+500)) { printf("failed in incrementing the memory"); goto end; } StreamTcpDecrMemuse(500); if (SC_ATOMIC_GET(st_memuse) != memuse) { printf("failed in decrementing the memory"); goto end; } if (StreamTcpCheckMemcap(500) != 1) { printf("failed in validating the memcap"); goto end; } if (StreamTcpCheckMemcap((memuse + stream_config.memcap)) != 0) { printf("failed in validating the overflowed memcap"); goto end; } StreamTcpFreeConfig(TRUE); if (SC_ATOMIC_GET(st_memuse) != 0) { printf("failed in clearing the memory"); goto end; } ret = 1; return ret; end: StreamTcpFreeConfig(TRUE); return ret; } #if 0 /** * \test Test the resetting of the sesison with bad checksum packet and later * send the malicious contents on the session. Engine should drop the * packet with the bad checksum. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest29(void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpSession ssn; IPV4Hdr ipv4h; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); struct in_addr addr; struct in_addr addr1; TCPCache tcpc; TCPVars tcpvars; TcpStream server; TcpStream client; memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset (&ipv4h, 0, sizeof(IPV4Hdr)); memset (&addr, 0, sizeof(addr)); memset (&addr1, 0, sizeof(addr1)); memset (&tcpc, 0, sizeof(tcpc)); memset (&tcpvars, 0, sizeof(tcpvars)); memset(&ssn, 0, sizeof (TcpSession)); memset(&server, 0, sizeof (TcpStream)); memset(&client, 0, sizeof (TcpStream)); uint8_t packet[1460] = ""; int result = 1; FLOW_INITIALIZE(&f); StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ ssn.client.os_policy = OS_POLICY_BSD; p.src.family = AF_INET; p.dst.family = AF_INET; p.proto = IPPROTO_TCP; p.flow = &f; tcph.th_win = 5480; p.tcph = &tcph; p.payload = packet; p.ip4h = &ipv4h; p.tcpc = tcpc; p.tcpc.level4_comp_csum = -1; tcpvars.hlen = 20; p.tcpvars = tcpvars; ssn.state = TCP_ESTABLISHED; addr.s_addr = inet_addr("10.1.3.53"); p.dst.address.address_un_data32[0] = addr.s_addr; addr1.s_addr = inet_addr("10.1.3.7"); p.src.address.address_un_data32[0] = addr1.s_addr; f.protoctx = &ssn; stt.ra_ctx = ra_ctx; ssn.server = server; ssn.client = client; ssn.client.isn = 10; ssn.client.window = 5184; ssn.client.last_ack = 10; ssn.client.ra_base_seq = 10; ssn.client.next_win = 5184; ssn.server.isn = 119197101; ssn.server.window = 5184; ssn.server.next_win = 5184; ssn.server.last_ack = 119197101; ssn.server.ra_base_seq = 119197101; tcph.th_flags = TH_PUSH | TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(11); p.tcph->th_ack = htonl(119197102); p.payload_len = 4; p.ip4h->ip_src = addr1; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; p.tcph->th_seq = htonl(119197102); p.tcph->th_ack = htonl(15); p.payload_len = 0; p.ip4h->ip_src = addr; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_RST | TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(15); p.tcph->th_ack = htonl(119197102); p.payload_len = 0; p.ip4h->ip_src = addr1; p.tcph->th_sum = 12345; if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } if (ssn.state != TCP_ESTABLISHED) { printf("the ssn.state should be TCP_ESTABLISHED(%"PRIu8"), not %"PRIu8"" "\n", TCP_ESTABLISHED, ssn.state); result &= 0; goto end; } end: StreamTcpReturnStreamSegments(&ssn.client); StreamTcpFreeConfig(TRUE); return result; } /** * \test Test the overlapping of the packet with bad checksum packet and later * send the malicious contents on the session. Engine should drop the * packet with the bad checksum. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest30(void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpSession ssn; IPV4Hdr ipv4h; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); struct in_addr addr; struct in_addr addr1; TCPCache tcpc; TCPVars tcpvars; TcpStream server; TcpStream client; memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset (&ipv4h, 0, sizeof(IPV4Hdr)); memset (&addr, 0, sizeof(addr)); memset (&addr1, 0, sizeof(addr1)); memset (&tcpc, 0, sizeof(tcpc)); memset (&tcpvars, 0, sizeof(tcpvars)); memset(&ssn, 0, sizeof (TcpSession)); memset(&server, 0, sizeof (TcpStream)); memset(&client, 0, sizeof (TcpStream)); uint8_t payload[9] = "AAAAAAAAA"; uint8_t payload1[9] = "GET /EVIL"; uint8_t expected_content[9] = { 0x47, 0x45, 0x54, 0x20, 0x2f, 0x45, 0x56, 0x49, 0x4c }; int result = 1; FLOW_INITIALIZE(&f); StreamTcpInitConfig(TRUE); /* prevent L7 from kicking in */ ssn.client.os_policy = OS_POLICY_BSD; p.src.family = AF_INET; p.dst.family = AF_INET; p.proto = IPPROTO_TCP; p.flow = &f; tcph.th_win = 5480; p.tcph = &tcph; p.payload = payload; p.ip4h = &ipv4h; p.tcpc = tcpc; p.tcpc.level4_comp_csum = -1; p.tcpvars = tcpvars; ssn.state = TCP_ESTABLISHED; addr.s_addr = inet_addr("10.1.3.53"); p.dst.address.address_un_data32[0] = addr.s_addr; addr1.s_addr = inet_addr("10.1.3.7"); p.src.address.address_un_data32[0] = addr1.s_addr; f.protoctx = &ssn; stt.ra_ctx = ra_ctx; ssn.server = server; ssn.client = client; ssn.client.isn = 10; ssn.client.window = 5184; ssn.client.last_ack = 10; ssn.client.ra_base_seq = 10; ssn.client.next_win = 5184; ssn.server.isn = 1351079940; ssn.server.window = 5184; ssn.server.next_win = 1351088132; ssn.server.last_ack = 1351079940; ssn.server.ra_base_seq = 1351079940; tcph.th_flags = TH_PUSH | TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(11); p.tcph->th_ack = htonl(1351079940); p.payload_len = 9; p.ip4h->ip_src = addr1; p.tcph->th_sum = 12345; if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_PUSH | TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(11); p.tcph->th_ack = htonl(1351079940); p.payload = payload1; p.payload_len = 9; p.ip4h->ip_src = addr1; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; p.tcph->th_seq = htonl(1351079940); p.tcph->th_ack = htonl(20); p.payload_len = 0; p.ip4h->ip_src = addr; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } if (StreamTcpCheckStreamContents(expected_content, 9, &ssn.client) != 1) { printf("the contents are not as expected(GET /EVIL), contents are: "); PrintRawDataFp(stdout, ssn.client.seg_list->payload, 9); result &= 0; goto end; } end: StreamTcpReturnStreamSegments(&ssn.client); StreamTcpFreeConfig(TRUE); return result; } /** * \test Test the multiple SYN packet handling with bad checksum and timestamp * value. Engine should drop the bad checksum packet and establish * TCP session correctly. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest31(void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpSession ssn; IPV4Hdr ipv4h; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); struct in_addr addr; struct in_addr addr1; TCPCache tcpc; TCPVars tcpvars; TcpStream server; TcpStream client; TCPOpt tcpopt; memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset (&ipv4h, 0, sizeof(IPV4Hdr)); memset (&addr, 0, sizeof(addr)); memset (&addr1, 0, sizeof(addr1)); memset (&tcpc, 0, sizeof(tcpc)); memset (&tcpvars, 0, sizeof(tcpvars)); memset(&ssn, 0, sizeof (TcpSession)); memset(&server, 0, sizeof (TcpStream)); memset(&client, 0, sizeof (TcpStream)); memset(&tcpopt, 0, sizeof (TCPOpt)); int result = 1; StreamTcpInitConfig(TRUE); FLOW_INITIALIZE(&f); /* prevent L7 from kicking in */ ssn.client.os_policy = OS_POLICY_LINUX; p.src.family = AF_INET; p.dst.family = AF_INET; p.proto = IPPROTO_TCP; p.flow = &f; tcph.th_win = 5480; p.tcph = &tcph; p.ip4h = &ipv4h; p.tcpc = tcpc; p.tcpc.level4_comp_csum = -1; p.tcpvars = tcpvars; p.tcpvars.ts = &tcpopt; addr.s_addr = inet_addr("10.1.3.53"); p.dst.address.address_un_data32[0] = addr.s_addr; addr1.s_addr = inet_addr("10.1.3.7"); p.src.address.address_un_data32[0] = addr1.s_addr; f.protoctx = &ssn; stt.ra_ctx = ra_ctx; ssn.server = server; ssn.client = client; ssn.client.isn = 10; ssn.client.window = 5184; ssn.client.last_ack = 10; ssn.client.ra_base_seq = 10; ssn.client.next_win = 5184; ssn.server.isn = 1351079940; ssn.server.window = 5184; ssn.server.next_win = 1351088132; ssn.server.last_ack = 1351079940; ssn.server.ra_base_seq = 1351079940; tcph.th_flags = TH_SYN; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(10); p.payload_len = 0; p.ip4h->ip_src = addr1; p.tcpc.ts1 = 100; p.tcph->th_sum = 12345; if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_SYN; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(10); p.payload_len = 0; p.ip4h->ip_src = addr1; p.tcpc.ts1 = 10; p.tcpc.level4_comp_csum = -1; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } ssn.flags |= STREAMTCP_FLAG_TIMESTAMP; tcph.th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; p.tcph->th_seq = htonl(1351079940); p.tcph->th_ack = htonl(11); p.payload_len = 0; p.tcpc.ts1 = 10; p.ip4h->ip_src = addr; p.tcpc.level4_comp_csum = -1; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } tcph.th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; p.tcph->th_seq = htonl(11); p.tcph->th_ack = htonl(1351079941); p.payload_len = 0; p.tcpc.ts1 = 10; p.ip4h->ip_src = addr1; p.tcpc.level4_comp_csum = -1; p.tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p.ip4h->ip_src), (uint16_t *)p.tcph, (p.payload_len + p.tcpvars.hlen) ); if (StreamTcp(&tv, &p, (void *)&stt, NULL, NULL) != TM_ECODE_OK) { printf("failed in segment reassmebling\n"); result &= 0; goto end; } if (ssn.state != TCP_ESTABLISHED) { printf("the should have been changed to TCP_ESTABLISHED!!\n "); result &= 0; goto end; } end: StreamTcpReturnStreamSegments(&ssn.client); StreamTcpFreeConfig(TRUE); return result; } /** * \test Test the initialization of tcp streams with ECN & CWR flags * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest32(void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p.flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN | TH_CWR | TH_ECN; p.tcph = &tcph; p.flowflags = FLOW_PKT_TOSERVER; StreamTcpInitConfig(TRUE); if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_flags = TH_SYN | TH_ACK | TH_ECN; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_ACK | TH_ECN | TH_CWR; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(2); p.tcph->th_flags = TH_PUSH | TH_ACK | TH_ECN | TH_CWR; p.flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p.payload = payload; p.payload_len = 3; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p.flowflags = FLOW_PKT_TOCLIENT; p.tcph->th_flags = TH_ACK; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p.flow->protoctx)->state != TCP_ESTABLISHED) { printf("the TCP state should be TCP_ESTABLISEHD\n"); goto end; } StreamTcpSessionClear(p.flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the allocation of TCP session for a given packet when the same * ports have been used to start the new session after resetting the * previous session. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest33 (void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpReassemblyThreadCtx ra_ctx; StreamMsgQueue stream_q; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&stream_q, 0, sizeof(StreamMsgQueue)); memset(&ra_ctx, 0, sizeof(TcpReassemblyThreadCtx)); memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p.flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p.tcph = &tcph; p.flowflags = FLOW_PKT_TOSERVER; int ret = 0; ra_ctx.stream_q = &stream_q; stt.ra_ctx = &ra_ctx; StreamTcpInitConfig(TRUE); if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_RST | TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p.flow->protoctx))->state != TCP_CLOSED) { printf("Tcp session should have been closed\n"); goto end; } p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_SYN; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_seq = htonl(1); p.tcph->th_ack = htonl(2); p.tcph->th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(2); p.tcph->th_seq = htonl(2); p.tcph->th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p.flow->protoctx))->state != TCP_ESTABLISHED) { printf("Tcp session should have been ESTABLISHED\n"); goto end; } ret = 1; end: StreamTcpSessionClear(p.flow->protoctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the allocation of TCP session for a given packet when the SYN * packet is sent with the PUSH flag set. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest34 (void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpReassemblyThreadCtx ra_ctx; StreamMsgQueue stream_q; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&stream_q, 0, sizeof(StreamMsgQueue)); memset(&ra_ctx, 0, sizeof(TcpReassemblyThreadCtx)); memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p.flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN|TH_PUSH; p.tcph = &tcph; p.flowflags = FLOW_PKT_TOSERVER; int ret = 0; ra_ctx.stream_q = &stream_q; stt.ra_ctx = &ra_ctx; StreamTcpInitConfig(TRUE); if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p.flow->protoctx))->state != TCP_ESTABLISHED) { printf("Tcp session should have been establisehd\n"); goto end; } ret = 1; end: StreamTcpSessionClear(p.flow->protoctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the allocation of TCP session for a given packet when the SYN * packet is sent with the URG flag set. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest35 (void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; TcpReassemblyThreadCtx ra_ctx; StreamMsgQueue stream_q; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(&stream_q, 0, sizeof(StreamMsgQueue)); memset(&ra_ctx, 0, sizeof(TcpReassemblyThreadCtx)); memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); p.flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN|TH_URG; p.tcph = &tcph; p.flowflags = FLOW_PKT_TOSERVER; int ret = 0; ra_ctx.stream_q = &stream_q; stt.ra_ctx = &ra_ctx; StreamTcpInitConfig(TRUE); if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) goto end; if (((TcpSession *)(p.flow->protoctx))->state != TCP_ESTABLISHED) { printf("Tcp session should have been establisehd\n"); goto end; } ret = 1; end: StreamTcpSessionClear(p.flow->protoctx); StreamTcpFreeConfig(TRUE); return ret; } /** * \test Test the processing of PSH and URG flag in tcp session. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest36(void) { Packet p; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset (&p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p.flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p.tcph = &tcph; p.flowflags = FLOW_PKT_TOSERVER; StreamTcpInitConfig(TRUE); if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1) { printf("failed in processing packet\n"); goto end; } p.tcph->th_ack = htonl(1); p.tcph->th_flags = TH_SYN | TH_ACK; p.flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p.tcph->th_ack = htonl(1); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_ACK; p.flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p.flow->protoctx)->state != TCP_ESTABLISHED) { printf("the TCP state should be TCP_ESTABLISEHD\n"); goto end; } p.tcph->th_ack = htonl(2); p.tcph->th_seq = htonl(1); p.tcph->th_flags = TH_PUSH | TH_ACK | TH_URG; p.flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p.payload = payload; p.payload_len = 3; if (StreamTcpPacket(&tv, &p, &stt, &pq) == -1 || (TcpSession *)p.flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p.flow->protoctx)->client.next_seq != 4) { printf("the ssn->client.next_seq should be 4, but it is %"PRIu32"\n", ((TcpSession *)p.flow->protoctx)->client.next_seq); goto end; } StreamTcpSessionClear(p.flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); return ret; } #endif /** * \test Test the processing of out of order FIN packets in tcp session. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest37(void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); int ret = 0; PacketQueue pq; memset(&pq,0,sizeof(PacketQueue)); memset(p, 0, SIZE_OF_PACKET); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); FLOW_INITIALIZE(&f); stt.ra_ctx = ra_ctx; p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p->flow->protoctx)->state != TCP_ESTABLISHED) { printf("the TCP state should be TCP_ESTABLISEHD\n"); goto end; } p->tcph->th_ack = htonl(2); p->tcph->th_seq = htonl(4); p->tcph->th_flags = TH_ACK|TH_FIN; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p->flow->protoctx)->state != TCP_CLOSE_WAIT) { printf("the TCP state should be TCP_CLOSE_WAIT\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } p->tcph->th_ack = htonl(4); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_ACK; p->payload_len = 0; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1 || (TcpSession *)p->flow->protoctx == NULL) { printf("failed in processing packet\n"); goto end; } if (((TcpSession *)p->flow->protoctx)->client.ra_raw_base_seq != 3) { printf("the ssn->client.next_seq should be 3, but it is %"PRIu32"\n", ((TcpSession *)p->flow->protoctx)->client.ra_raw_base_seq); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** * \test Test the validation of the ACK number before setting up the * stream.last_ack. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest38 (void) { int ret = 0; Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[128]; TCPHdr tcph; PacketQueue pq; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&pq,0,sizeof(PacketQueue)); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); FLOW_INITIALIZE(&f); p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; stt.ra_ctx = ra_ctx; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(29847); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } /* last_ack value should be 1 as the previous sent ACK value is out of window */ if (((TcpSession *)(p->flow->protoctx))->server.last_ack != 1) { printf("the server.last_ack should be 1, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.last_ack); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x41, 127, 128); /*AAA*/ p->payload = payload; p->payload_len = 127; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->server.next_seq != 128) { printf("the server.next_seq should be 128, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } p->tcph->th_ack = htonl(256); // in window, but beyond next_seq p->tcph->th_seq = htonl(5); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } /* last_ack value should be 256, as the previous sent ACK value is inside window */ if (((TcpSession *)(p->flow->protoctx))->server.last_ack != 256) { printf("the server.last_ack should be 1, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.last_ack); goto end; } p->tcph->th_ack = htonl(128); p->tcph->th_seq = htonl(8); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } /* last_ack value should be 256 as the previous sent ACK value is inside window */ if (((TcpSession *)(p->flow->protoctx))->server.last_ack != 256) { printf("the server.last_ack should be 256, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.last_ack); goto end; } ret = 1; end: StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); if (stt.ra_ctx != NULL) StreamTcpReassembleFreeThreadCtx(stt.ra_ctx); return ret; } /** * \test Test the validation of the ACK number before setting up the * stream.last_ack and update the next_seq after loosing the . * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpTest39 (void) { Flow f; ThreadVars tv; StreamTcpThread stt; uint8_t payload[4]; TCPHdr tcph; PacketQueue pq; TcpReassemblyThreadCtx *ra_ctx = StreamTcpReassembleInitThreadCtx(NULL); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); memset(&pq,0,sizeof(PacketQueue)); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); FLOW_INITIALIZE(&f); p->flow = &f; tcph.th_win = htons(5480); tcph.th_flags = TH_SYN; p->tcph = &tcph; p->flowflags = FLOW_PKT_TOSERVER; int ret = 0; stt.ra_ctx = ra_ctx; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } p->tcph->th_ack = htonl(1); p->tcph->th_seq = htonl(1); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } if (((TcpSession *)(p->flow->protoctx))->server.next_seq != 4) { printf("the server.next_seq should be 4, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } p->tcph->th_ack = htonl(4); p->tcph->th_seq = htonl(2); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } /* last_ack value should be 4 as the previous sent ACK value is inside window */ if (((TcpSession *)(p->flow->protoctx))->server.last_ack != 4) { printf("the server.last_ack should be 4, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.last_ack); goto end; } p->tcph->th_seq = htonl(4); p->tcph->th_ack = htonl(5); p->tcph->th_flags = TH_PUSH | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; StreamTcpCreateTestPacket(payload, 0x41, 3, 4); /*AAA*/ p->payload = payload; p->payload_len = 3; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) { printf("failed in processing packet in StreamTcpPacket\n"); goto end; } /* next_seq value should be 2987 as the previous sent ACK value is inside window */ if (((TcpSession *)(p->flow->protoctx))->server.next_seq != 7) { printf("the server.next_seq should be 7, but it is %"PRIu32"\n", ((TcpSession *)(p->flow->protoctx))->server.next_seq); goto end; } ret = 1; end: StreamTcpSessionClear(p->flow->protoctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); if (stt.ra_ctx != NULL) StreamTcpReassembleFreeThreadCtx(stt.ra_ctx); return ret; } static int StreamTcpTest40(void) { uint8_t raw_vlan[] = { 0x00, 0x20, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34, 0x3b, 0x36, 0x40, 0x00, 0x40, 0x06, 0xb7, 0xc9, 0x83, 0x97, 0x20, 0x81, 0x83, 0x97, 0x20, 0x15, 0x04, 0x8a, 0x17, 0x70, 0x4e, 0x14, 0xdf, 0x55, 0x4d, 0x3d, 0x5a, 0x61, 0x80, 0x10, 0x6b, 0x50, 0x3c, 0x4c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x04, 0xf0, 0xc8, 0x01, 0x99, 0xa3, 0xf3 }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); PACKET_INITIALIZE(p); SET_PKT_LEN(p, sizeof(raw_vlan)); memcpy(GET_PKT_DATA(p), raw_vlan, sizeof(raw_vlan)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); DecodeVLAN(&tv, &dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), NULL); if(p->vlanh[0] == NULL) { SCFree(p); return 0; } if(p->tcph == NULL) { SCFree(p); return 0; } Packet *np = StreamTcpPseudoSetup(p, GET_PKT_DATA(p), GET_PKT_LEN(p)); if (np == NULL) { printf("the packet received from packet allocation is NULL: "); return 0; } StreamTcpPseudoPacketSetupHeader(np,p); if (((uint8_t *)p->tcph - (uint8_t *)p->ip4h) != ((uint8_t *)np->tcph - (uint8_t *)np->ip4h)) { return 0; } PACKET_RECYCLE(np); PACKET_RECYCLE(p); FlowShutdown(); return 1; } static int StreamTcpTest41(void) { /* IPV6/TCP/no eth header */ uint8_t raw_ip[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x28, 0x06, 0x40, 0x20, 0x01, 0x06, 0x18, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x99, 0xcc, 0x70, 0x20, 0x01, 0x06, 0x18, 0x00, 0x01, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x8c, 0x9b, 0x00, 0x50, 0x6a, 0xe7, 0x07, 0x36, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0x30, 0x29, 0x9c, 0x00, 0x00, 0x02, 0x04, 0x05, 0x8c, 0x04, 0x02, 0x08, 0x0a, 0x00, 0xdd, 0x1a, 0x39, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x02 }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); PACKET_INITIALIZE(p); if (PacketCopyData(p, raw_ip, sizeof(raw_ip)) == -1) { PacketFree(p); return 1; } FlowInitConfig(FLOW_QUIET); DecodeRaw(&tv, &dtv, p, raw_ip, GET_PKT_LEN(p), NULL); if (p->ip6h == NULL) { printf("expected a valid ipv6 header but it was NULL: "); FlowShutdown(); SCFree(p); return 1; } if(p->tcph == NULL) { SCFree(p); return 0; } Packet *np = StreamTcpPseudoSetup(p, GET_PKT_DATA(p), GET_PKT_LEN(p)); if (np == NULL) { printf("the packet received from packet allocation is NULL: "); return 0; } StreamTcpPseudoPacketSetupHeader(np,p); if (((uint8_t *)p->tcph - (uint8_t *)p->ip6h) != ((uint8_t *)np->tcph - (uint8_t *)np->ip6h)) { return 0; } PACKET_RECYCLE(np); PACKET_RECYCLE(p); SCFree(p); FlowShutdown(); return 1; } /** \test multiple different SYN/ACK, pick first */ static int StreamTcpTest42 (void) { int ret = 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; PacketQueue pq; Packet *p = SCMalloc(SIZE_OF_PACKET); TcpSession *ssn; if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); StreamTcpInitConfig(TRUE); FLOW_INITIALIZE(&f); p->tcph = &tcph; tcph.th_win = htons(5480); p->flow = &f; /* SYN pkt */ tcph.th_flags = TH_SYN; tcph.th_seq = htonl(100); p->flowflags = FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(500); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(1000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* ACK */ p->tcph->th_ack = htonl(501); p->tcph->th_seq = htonl(101); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; ssn = p->flow->protoctx; if (ssn->state != TCP_ESTABLISHED) { printf("state not TCP_ESTABLISHED: "); goto end; } if (ssn->server.isn != 500) { SCLogDebug("ssn->server.isn %"PRIu32" != %"PRIu32"", ssn->server.isn, 500); goto end; } if (ssn->client.isn != 100) { SCLogDebug("ssn->client.isn %"PRIu32" != %"PRIu32"", ssn->client.isn, 100); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** \test multiple different SYN/ACK, pick second */ static int StreamTcpTest43 (void) { int ret = 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; PacketQueue pq; Packet *p = SCMalloc(SIZE_OF_PACKET); TcpSession *ssn; if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); StreamTcpInitConfig(TRUE); FLOW_INITIALIZE(&f); p->tcph = &tcph; tcph.th_win = htons(5480); p->flow = &f; /* SYN pkt */ tcph.th_flags = TH_SYN; tcph.th_seq = htonl(100); p->flowflags = FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(500); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(1000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* ACK */ p->tcph->th_ack = htonl(1001); p->tcph->th_seq = htonl(101); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; ssn = p->flow->protoctx; if (ssn->state != TCP_ESTABLISHED) { printf("state not TCP_ESTABLISHED: "); goto end; } if (ssn->server.isn != 1000) { SCLogDebug("ssn->server.isn %"PRIu32" != %"PRIu32"", ssn->server.isn, 1000); goto end; } if (ssn->client.isn != 100) { SCLogDebug("ssn->client.isn %"PRIu32" != %"PRIu32"", ssn->client.isn, 100); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** \test multiple different SYN/ACK, pick neither */ static int StreamTcpTest44 (void) { int ret = 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; PacketQueue pq; Packet *p = SCMalloc(SIZE_OF_PACKET); TcpSession *ssn; if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); StreamTcpInitConfig(TRUE); FLOW_INITIALIZE(&f); p->tcph = &tcph; tcph.th_win = htons(5480); p->flow = &f; /* SYN pkt */ tcph.th_flags = TH_SYN; tcph.th_seq = htonl(100); p->flowflags = FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(500); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(1000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* ACK */ p->tcph->th_ack = htonl(3001); p->tcph->th_seq = htonl(101); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) != -1) goto end; ssn = p->flow->protoctx; if (ssn->state != TCP_SYN_RECV) { SCLogDebug("state not TCP_SYN_RECV"); goto end; } if (ssn->client.isn != 100) { SCLogDebug("ssn->client.isn %"PRIu32" != %"PRIu32"", ssn->client.isn, 100); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); FLOW_DESTROY(&f); return ret; } /** \test multiple different SYN/ACK, over the limit */ static int StreamTcpTest45 (void) { int ret = 0; Flow f; ThreadVars tv; StreamTcpThread stt; TCPHdr tcph; PacketQueue pq; Packet *p = SCMalloc(SIZE_OF_PACKET); TcpSession *ssn; if (unlikely(p == NULL)) return 0; memset(p, 0, SIZE_OF_PACKET); memset(&pq,0,sizeof(PacketQueue)); memset (&f, 0, sizeof(Flow)); memset(&tv, 0, sizeof (ThreadVars)); memset(&stt, 0, sizeof (StreamTcpThread)); memset(&tcph, 0, sizeof (TCPHdr)); StreamTcpInitConfig(TRUE); stream_config.max_synack_queued = 2; FLOW_INITIALIZE(&f); p->tcph = &tcph; tcph.th_win = htons(5480); p->flow = &f; /* SYN pkt */ tcph.th_flags = TH_SYN; tcph.th_seq = htonl(100); p->flowflags = FLOW_PKT_TOSERVER; FLOWLOCK_WRLOCK(&f); if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(500); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(1000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(2000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; /* SYN/ACK */ p->tcph->th_seq = htonl(3000); p->tcph->th_ack = htonl(101); p->tcph->th_flags = TH_SYN | TH_ACK; p->flowflags = FLOW_PKT_TOCLIENT; if (StreamTcpPacket(&tv, p, &stt, &pq) != -1) goto end; /* ACK */ p->tcph->th_ack = htonl(1001); p->tcph->th_seq = htonl(101); p->tcph->th_flags = TH_ACK; p->flowflags = FLOW_PKT_TOSERVER; if (StreamTcpPacket(&tv, p, &stt, &pq) == -1) goto end; ssn = p->flow->protoctx; if (ssn->state != TCP_ESTABLISHED) { printf("state not TCP_ESTABLISHED: "); goto end; } if (ssn->server.isn != 1000) { SCLogDebug("ssn->server.isn %"PRIu32" != %"PRIu32"", ssn->server.isn, 1000); goto end; } if (ssn->client.isn != 100) { SCLogDebug("ssn->client.isn %"PRIu32" != %"PRIu32"", ssn->client.isn, 100); goto end; } StreamTcpSessionClear(p->flow->protoctx); ret = 1; end: StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); SCFree(p); return ret; } #endif /* UNITTESTS */ void StreamTcpRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("StreamTcpTest01 -- TCP session allocation", StreamTcpTest01); UtRegisterTest("StreamTcpTest02 -- TCP session deallocation", StreamTcpTest02); UtRegisterTest("StreamTcpTest03 -- SYN missed MidStream session", StreamTcpTest03); UtRegisterTest("StreamTcpTest04 -- SYN/ACK missed MidStream session", StreamTcpTest04); UtRegisterTest("StreamTcpTest05 -- 3WHS missed MidStream session", StreamTcpTest05); UtRegisterTest("StreamTcpTest06 -- FIN, RST message MidStream session", StreamTcpTest06); UtRegisterTest("StreamTcpTest07 -- PAWS invalid timestamp", StreamTcpTest07); UtRegisterTest("StreamTcpTest08 -- PAWS valid timestamp", StreamTcpTest08); UtRegisterTest("StreamTcpTest09 -- No Client Reassembly", StreamTcpTest09); UtRegisterTest("StreamTcpTest10 -- No missed packet Async stream", StreamTcpTest10); UtRegisterTest("StreamTcpTest11 -- SYN missed Async stream", StreamTcpTest11); UtRegisterTest("StreamTcpTest12 -- SYN/ACK missed Async stream", StreamTcpTest12); UtRegisterTest("StreamTcpTest13 -- opposite stream packets for Async " "stream", StreamTcpTest13); UtRegisterTest("StreamTcp4WHSTest01", StreamTcp4WHSTest01); UtRegisterTest("StreamTcp4WHSTest02", StreamTcp4WHSTest02); UtRegisterTest("StreamTcp4WHSTest03", StreamTcp4WHSTest03); UtRegisterTest("StreamTcpTest14 -- setup OS policy", StreamTcpTest14); UtRegisterTest("StreamTcpTest15 -- setup OS policy", StreamTcpTest15); UtRegisterTest("StreamTcpTest16 -- setup OS policy", StreamTcpTest16); UtRegisterTest("StreamTcpTest17 -- setup OS policy", StreamTcpTest17); UtRegisterTest("StreamTcpTest18 -- setup OS policy", StreamTcpTest18); UtRegisterTest("StreamTcpTest19 -- setup OS policy", StreamTcpTest19); UtRegisterTest("StreamTcpTest20 -- setup OS policy", StreamTcpTest20); UtRegisterTest("StreamTcpTest21 -- setup OS policy", StreamTcpTest21); UtRegisterTest("StreamTcpTest22 -- setup OS policy", StreamTcpTest22); UtRegisterTest("StreamTcpTest23 -- stream memory leaks", StreamTcpTest23); UtRegisterTest("StreamTcpTest24 -- stream memory leaks", StreamTcpTest24); UtRegisterTest("StreamTcpTest25 -- test ecn/cwr sessions", StreamTcpTest25); UtRegisterTest("StreamTcpTest26 -- test ecn/cwr sessions", StreamTcpTest26); UtRegisterTest("StreamTcpTest27 -- test ecn/cwr sessions", StreamTcpTest27); UtRegisterTest("StreamTcpTest28 -- Memcap Test", StreamTcpTest28); #if 0 /* VJ 2010/09/01 disabled since they blow up on Fedora and Fedora is * right about blowing up. The checksum functions are not used properly * in the tests. */ UtRegisterTest("StreamTcpTest29 -- Badchecksum Reset Test", StreamTcpTest29, 1); UtRegisterTest("StreamTcpTest30 -- Badchecksum Overlap Test", StreamTcpTest30, 1); UtRegisterTest("StreamTcpTest31 -- MultipleSyns Test", StreamTcpTest31, 1); UtRegisterTest("StreamTcpTest32 -- Bogus CWR Test", StreamTcpTest32, 1); UtRegisterTest("StreamTcpTest33 -- RST-SYN Again Test", StreamTcpTest33, 1); UtRegisterTest("StreamTcpTest34 -- SYN-PUSH Test", StreamTcpTest34, 1); UtRegisterTest("StreamTcpTest35 -- SYN-URG Test", StreamTcpTest35, 1); UtRegisterTest("StreamTcpTest36 -- PUSH-URG Test", StreamTcpTest36, 1); #endif UtRegisterTest("StreamTcpTest37 -- Out of order FIN Test", StreamTcpTest37); UtRegisterTest("StreamTcpTest38 -- validate ACK", StreamTcpTest38); UtRegisterTest("StreamTcpTest39 -- update next_seq", StreamTcpTest39); UtRegisterTest("StreamTcpTest40 -- pseudo setup", StreamTcpTest40); UtRegisterTest("StreamTcpTest41 -- pseudo setup", StreamTcpTest41); UtRegisterTest("StreamTcpTest42 -- SYN/ACK queue", StreamTcpTest42); UtRegisterTest("StreamTcpTest43 -- SYN/ACK queue", StreamTcpTest43); UtRegisterTest("StreamTcpTest44 -- SYN/ACK queue", StreamTcpTest44); UtRegisterTest("StreamTcpTest45 -- SYN/ACK queue", StreamTcpTest45); /* set up the reassembly tests as well */ StreamTcpReassembleRegisterTests(); StreamTcpSackRegisterTests (); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-alert.c0000644000000000000000000006226013051004444014567 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Logs alerts in JSON format. * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "util-debug.h" #include "util-misc.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "app-layer-parser.h" #include "app-layer-dnp3.h" #include "app-layer-htp.h" #include "app-layer-htp-xff.h" #include "util-classification-config.h" #include "util-syslog.h" #include "util-logopenfile.h" #include "output.h" #include "output-json.h" #include "output-json-dnp3.h" #include "output-json-http.h" #include "output-json-tls.h" #include "output-json-ssh.h" #include "output-json-smtp.h" #include "output-json-email-common.h" #include "util-byte.h" #include "util-privs.h" #include "util-print.h" #include "util-proto-name.h" #include "util-optimize.h" #include "util-buffer.h" #include "util-crypt.h" #define MODULE_NAME "JsonAlertLog" #ifdef HAVE_LIBJANSSON #define LOG_JSON_PAYLOAD 0x001 #define LOG_JSON_PACKET 0x002 #define LOG_JSON_PAYLOAD_BASE64 0x004 #define LOG_JSON_HTTP 0x008 #define LOG_JSON_TLS 0x010 #define LOG_JSON_SSH 0x020 #define LOG_JSON_SMTP 0x040 #define LOG_JSON_TAGGED_PACKETS 0x080 #define LOG_JSON_DNP3 0x100 #define JSON_STREAM_BUFFER_SIZE 4096 typedef struct AlertJsonOutputCtx_ { LogFileCtx* file_ctx; uint16_t flags; uint32_t payload_buffer_size; HttpXFFCfg *xff_cfg; } AlertJsonOutputCtx; typedef struct JsonAlertLogThread_ { /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ LogFileCtx* file_ctx; MemBuffer *json_buffer; MemBuffer *payload_buffer; AlertJsonOutputCtx* json_output_ctx; } JsonAlertLogThread; /* Callback function to pack payload contents from a stream into a buffer * so we can report them in JSON output. */ static int AlertJsonDumpStreamSegmentCallback(const Packet *p, void *data, uint8_t *buf, uint32_t buflen) { MemBuffer *payload = (MemBuffer *)data; MemBufferWriteRaw(payload, buf, buflen); return 1; } static void AlertJsonTls(const Flow *f, json_t *js) { SSLState *ssl_state = (SSLState *)FlowGetAppState(f); if (ssl_state) { json_t *tjs = json_object(); if (unlikely(tjs == NULL)) return; JsonTlsLogJSONBasic(tjs, ssl_state); JsonTlsLogJSONExtended(tjs, ssl_state); json_object_set_new(js, "tls", tjs); } return; } static void AlertJsonSsh(const Flow *f, json_t *js) { SshState *ssh_state = (SshState *)FlowGetAppState(f); if (ssh_state) { json_t *tjs = json_object(); if (unlikely(tjs == NULL)) return; JsonSshLogJSON(tjs, ssh_state); json_object_set_new(js, "ssh", tjs); } return; } static void AlertJsonDnp3(const Flow *f, json_t *js) { DNP3State *dnp3_state = (DNP3State *)FlowGetAppState(f); if (dnp3_state) { uint64_t tx_id = AppLayerParserGetTransactionLogId(f->alparser); DNP3Transaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_DNP3, dnp3_state, tx_id); if (tx) { json_t *dnp3js = json_object(); if (likely(dnp3js != NULL)) { if (tx->has_request && tx->request_done) { json_t *request = JsonDNP3LogRequest(tx); if (request != NULL) { json_object_set_new(dnp3js, "request", request); } } if (tx->has_response && tx->response_done) { json_t *response = JsonDNP3LogResponse(tx); if (response != NULL) { json_object_set_new(dnp3js, "response", response); } } json_object_set_new(js, "dnp3", dnp3js); } } } return; } void AlertJsonHeader(const Packet *p, const PacketAlert *pa, json_t *js) { char *action = "allowed"; /* use packet action if rate_filter modified the action */ if (unlikely(pa->flags & PACKET_ALERT_RATE_FILTER_MODIFIED)) { if (PACKET_TEST_ACTION(p, (ACTION_DROP|ACTION_REJECT| ACTION_REJECT_DST|ACTION_REJECT_BOTH))) { action = "blocked"; } } else { if (pa->action & (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)) { action = "blocked"; } else if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "blocked"; } } /* Add tx_id to root element for correlation with other events. */ json_object_del(js, "tx_id"); if (pa->flags & PACKET_ALERT_FLAG_TX) json_object_set_new(js, "tx_id", json_integer(pa->tx_id)); json_t *ajs = json_object(); if (ajs == NULL) { json_decref(js); return; } json_object_set_new(ajs, "action", json_string(action)); json_object_set_new(ajs, "gid", json_integer(pa->s->gid)); json_object_set_new(ajs, "signature_id", json_integer(pa->s->id)); json_object_set_new(ajs, "rev", json_integer(pa->s->rev)); json_object_set_new(ajs, "signature", json_string((pa->s->msg) ? pa->s->msg : "")); json_object_set_new(ajs, "category", json_string((pa->s->class_msg) ? pa->s->class_msg : "")); json_object_set_new(ajs, "severity", json_integer(pa->s->prio)); if (p->tenant_id > 0) json_object_set_new(ajs, "tenant_id", json_integer(p->tenant_id)); /* alert */ json_object_set_new(js, "alert", ajs); } static void AlertJsonPacket(const Packet *p, json_t *js) { unsigned long len = GET_PKT_LEN(p) * 2; uint8_t encoded_packet[len]; Base64Encode((unsigned char*) GET_PKT_DATA(p), GET_PKT_LEN(p), encoded_packet, &len); json_object_set_new(js, "packet", json_string((char *)encoded_packet)); /* Create packet info. */ json_t *packetinfo_js = json_object(); if (unlikely(packetinfo_js == NULL)) { return; } json_object_set_new(packetinfo_js, "linktype", json_integer(p->datalink)); json_object_set_new(js, "packet_info", packetinfo_js); } static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p) { MemBuffer *payload = aft->payload_buffer; AlertJsonOutputCtx *json_output_ctx = aft->json_output_ctx; json_t *hjs = NULL; int i; if (p->alerts.cnt == 0 && !(p->flags & PKT_HAS_TAG)) return TM_ECODE_OK; json_t *js = CreateJSONHeader((Packet *)p, 0, "alert"); if (unlikely(js == NULL)) return TM_ECODE_OK; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } MemBufferReset(aft->json_buffer); /* alert */ AlertJsonHeader(p, pa, js); if (json_output_ctx->flags & LOG_JSON_HTTP) { if (p->flow != NULL) { uint16_t proto = FlowGetAppProtocol(p->flow); /* http alert */ if (proto == ALPROTO_HTTP) { hjs = JsonHttpAddMetadata(p->flow, pa->tx_id); if (hjs) json_object_set_new(js, "http", hjs); } } } if (json_output_ctx->flags & LOG_JSON_TLS) { if (p->flow != NULL) { uint16_t proto = FlowGetAppProtocol(p->flow); /* http alert */ if (proto == ALPROTO_TLS) AlertJsonTls(p->flow, js); } } if (json_output_ctx->flags & LOG_JSON_SSH) { if (p->flow != NULL) { uint16_t proto = FlowGetAppProtocol(p->flow); /* http alert */ if (proto == ALPROTO_SSH) AlertJsonSsh(p->flow, js); } } if (json_output_ctx->flags & LOG_JSON_SMTP) { if (p->flow != NULL) { uint16_t proto = FlowGetAppProtocol(p->flow); /* http alert */ if (proto == ALPROTO_SMTP) { hjs = JsonSMTPAddMetadata(p->flow, pa->tx_id); if (hjs) json_object_set_new(js, "smtp", hjs); hjs = JsonEmailAddMetadata(p->flow, pa->tx_id); if (hjs) json_object_set_new(js, "email", hjs); } } } if (json_output_ctx->flags & LOG_JSON_DNP3) { if (p->flow != NULL) { uint16_t proto = FlowGetAppProtocol(p->flow); if (proto == ALPROTO_DNP3) { AlertJsonDnp3(p->flow, js); } } } /* payload */ if (json_output_ctx->flags & (LOG_JSON_PAYLOAD | LOG_JSON_PAYLOAD_BASE64)) { int stream = (p->proto == IPPROTO_TCP) ? (pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_STREAM_MATCH) ? 1 : 0) : 0; /* Is this a stream? If so, pack part of it into the payload field */ if (stream) { uint8_t flag; MemBufferReset(payload); if (p->flowflags & FLOW_PKT_TOSERVER) { flag = FLOW_PKT_TOCLIENT; } else { flag = FLOW_PKT_TOSERVER; } StreamSegmentForEach((const Packet *)p, flag, AlertJsonDumpStreamSegmentCallback, (void *)payload); if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) { unsigned long len = json_output_ctx->payload_buffer_size * 2; uint8_t encoded[len]; Base64Encode(payload->buffer, payload->offset, encoded, &len); json_object_set_new(js, "payload", json_string((char *)encoded)); } if (json_output_ctx->flags & LOG_JSON_PAYLOAD) { uint8_t printable_buf[payload->offset + 1]; uint32_t offset = 0; PrintStringsToBuffer(printable_buf, &offset, sizeof(printable_buf), payload->buffer, payload->offset); json_object_set_new(js, "payload_printable", json_string((char *)printable_buf)); } } else { /* This is a single packet and not a stream */ if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) { unsigned long len = p->payload_len * 2 + 1; uint8_t encoded[len]; if (Base64Encode(p->payload, p->payload_len, encoded, &len) == SC_BASE64_OK) { json_object_set_new(js, "payload", json_string((char *)encoded)); } } if (json_output_ctx->flags & LOG_JSON_PAYLOAD) { uint8_t printable_buf[p->payload_len + 1]; uint32_t offset = 0; PrintStringsToBuffer(printable_buf, &offset, p->payload_len + 1, p->payload, p->payload_len); printable_buf[p->payload_len] = '\0'; json_object_set_new(js, "payload_printable", json_string((char *)printable_buf)); } } json_object_set_new(js, "stream", json_integer(stream)); } /* base64-encoded full packet */ if (json_output_ctx->flags & LOG_JSON_PACKET) { AlertJsonPacket(p, js); } HttpXFFCfg *xff_cfg = json_output_ctx->xff_cfg; /* xff header */ if ((xff_cfg != NULL) && !(xff_cfg->flags & XFF_DISABLED) && p->flow != NULL) { int have_xff_ip = 0; char buffer[XFF_MAXLEN]; if (FlowGetAppProtocol(p->flow) == ALPROTO_HTTP) { if (pa->flags & PACKET_ALERT_FLAG_TX) { have_xff_ip = HttpXFFGetIPFromTx(p, pa->tx_id, xff_cfg, buffer, XFF_MAXLEN); } else { have_xff_ip = HttpXFFGetIP(p, xff_cfg, buffer, XFF_MAXLEN); } } if (have_xff_ip) { if (xff_cfg->flags & XFF_EXTRADATA) { json_object_set_new(js, "xff", json_string(buffer)); } else if (xff_cfg->flags & XFF_OVERWRITE) { if (p->flowflags & FLOW_PKT_TOCLIENT) { json_object_set(js, "dest_ip", json_string(buffer)); } else { json_object_set(js, "src_ip", json_string(buffer)); } } } } OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer); json_object_del(js, "alert"); } json_object_clear(js); json_decref(js); if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags & LOG_JSON_TAGGED_PACKETS)) { MemBufferReset(aft->json_buffer); json_t *packetjs = CreateJSONHeader((Packet *)p, 0, "packet"); if (unlikely(packetjs != NULL)) { AlertJsonPacket(p, packetjs); OutputJSONBuffer(packetjs, aft->file_ctx, &aft->json_buffer); json_decref(packetjs); } } return TM_ECODE_OK; } static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p) { int i; char timebuf[64]; json_t *js; if (p->alerts.cnt == 0) return TM_ECODE_OK; CreateIsoTimeString(&p->ts, timebuf, sizeof(timebuf)); for (i = 0; i < p->alerts.cnt; i++) { MemBufferReset(aft->json_buffer); const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } char *action = "allowed"; if (pa->action & (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)) { action = "blocked"; } else if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "blocked"; } char buf[(32 * 3) + 1]; PrintRawLineHexBuf(buf, sizeof(buf), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); js = json_object(); if (js == NULL) return TM_ECODE_OK; json_t *ajs = json_object(); if (ajs == NULL) { json_decref(js); return TM_ECODE_OK; } /* time & tx */ json_object_set_new(js, "timestamp", json_string(timebuf)); /* tuple */ //json_object_set_new(js, "srcip", json_string(srcip)); //json_object_set_new(js, "sp", json_integer(p->sp)); //json_object_set_new(js, "dstip", json_string(dstip)); //json_object_set_new(js, "dp", json_integer(p->dp)); //json_object_set_new(js, "proto", json_integer(proto)); json_object_set_new(ajs, "action", json_string(action)); json_object_set_new(ajs, "gid", json_integer(pa->s->gid)); json_object_set_new(ajs, "signature_id", json_integer(pa->s->id)); json_object_set_new(ajs, "rev", json_integer(pa->s->rev)); json_object_set_new(ajs, "signature", json_string((pa->s->msg) ? pa->s->msg : "")); json_object_set_new(ajs, "category", json_string((pa->s->class_msg) ? pa->s->class_msg : "")); json_object_set_new(ajs, "severity", json_integer(pa->s->prio)); if (p->tenant_id > 0) json_object_set_new(ajs, "tenant_id", json_integer(p->tenant_id)); /* alert */ json_object_set_new(js, "alert", ajs); OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer); json_object_clear(js); json_decref(js); } return TM_ECODE_OK; } static int JsonAlertLogger(ThreadVars *tv, void *thread_data, const Packet *p) { JsonAlertLogThread *aft = thread_data; if (PKT_IS_IPV4(p) || PKT_IS_IPV6(p)) { return AlertJson(tv, aft, p); } else if (p->alerts.cnt > 0) { return AlertJsonDecoderEvent(tv, aft, p); } return 0; } static int JsonAlertLogCondition(ThreadVars *tv, const Packet *p) { if (p->alerts.cnt || (p->flags & PKT_HAS_TAG)) { return TRUE; } return FALSE; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonAlertLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonAlertLogThread *aft = SCMalloc(sizeof(JsonAlertLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonAlertLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogAlert. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->json_buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->json_buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /** Use the Output Context (file pointer and mutex) */ AlertJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data; aft->file_ctx = json_output_ctx->file_ctx; aft->json_output_ctx = json_output_ctx; aft->payload_buffer = MemBufferCreateNew(json_output_ctx->payload_buffer_size); if (aft->payload_buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonAlertLogThreadDeinit(ThreadVars *t, void *data) { JsonAlertLogThread *aft = (JsonAlertLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->json_buffer); MemBufferFree(aft->payload_buffer); /* clear memory */ memset(aft, 0, sizeof(JsonAlertLogThread)); SCFree(aft); return TM_ECODE_OK; } static void JsonAlertLogDeInitCtx(OutputCtx *output_ctx) { AlertJsonOutputCtx *json_output_ctx = (AlertJsonOutputCtx *) output_ctx->data; if (json_output_ctx != NULL) { HttpXFFCfg *xff_cfg = json_output_ctx->xff_cfg; if (xff_cfg != NULL) { SCFree(xff_cfg); } LogFileFreeCtx(json_output_ctx->file_ctx); SCFree(json_output_ctx); } SCFree(output_ctx); } static void JsonAlertLogDeInitCtxSub(OutputCtx *output_ctx) { SCLogDebug("cleaning up sub output_ctx %p", output_ctx); AlertJsonOutputCtx *json_output_ctx = (AlertJsonOutputCtx *) output_ctx->data; if (json_output_ctx != NULL) { HttpXFFCfg *xff_cfg = json_output_ctx->xff_cfg; if (xff_cfg != NULL) { SCFree(xff_cfg); } SCFree(json_output_ctx); } SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "alert.json" static void XffSetup(AlertJsonOutputCtx *json_output_ctx, ConfNode *conf) { HttpXFFCfg *xff_cfg = NULL; xff_cfg = SCMalloc(sizeof(HttpXFFCfg)); if (unlikely(xff_cfg == NULL)) { return; } memset(xff_cfg, 0, sizeof(HttpXFFCfg)); json_output_ctx->xff_cfg = xff_cfg; uint32_t payload_buffer_size = JSON_STREAM_BUFFER_SIZE; if (conf != NULL) { const char *payload = ConfNodeLookupChildValue(conf, "payload"); const char *payload_buffer_value = ConfNodeLookupChildValue(conf, "payload-buffer-size"); const char *packet = ConfNodeLookupChildValue(conf, "packet"); const char *payload_printable = ConfNodeLookupChildValue(conf, "payload-printable"); const char *http = ConfNodeLookupChildValue(conf, "http"); const char *tls = ConfNodeLookupChildValue(conf, "tls"); const char *ssh = ConfNodeLookupChildValue(conf, "ssh"); const char *smtp = ConfNodeLookupChildValue(conf, "smtp"); const char *tagged_packets = ConfNodeLookupChildValue(conf, "tagged-packets"); const char *dnp3 = ConfNodeLookupChildValue(conf, "dnp3"); if (ssh != NULL) { if (ConfValIsTrue(ssh)) { json_output_ctx->flags |= LOG_JSON_SSH; } } if (tls != NULL) { if (ConfValIsTrue(tls)) { json_output_ctx->flags |= LOG_JSON_TLS; } } if (http != NULL) { if (ConfValIsTrue(http)) { json_output_ctx->flags |= LOG_JSON_HTTP; } } if (smtp != NULL) { if (ConfValIsTrue(smtp)) { json_output_ctx->flags |= LOG_JSON_SMTP; } } if (payload_printable != NULL) { if (ConfValIsTrue(payload_printable)) { json_output_ctx->flags |= LOG_JSON_PAYLOAD; } } if (payload != NULL) { if (ConfValIsTrue(payload)) { json_output_ctx->flags |= LOG_JSON_PAYLOAD_BASE64; } } if (payload_buffer_value != NULL) { uint32_t value; if (ParseSizeStringU32(payload_buffer_value, &value) < 0) { SCLogError(SC_ERR_ALERT_PAYLOAD_BUFFER, "Error parsing " "payload-buffer-size - %s. Killing engine", payload_buffer_value); exit(EXIT_FAILURE); } else { payload_buffer_size = value; } } if (packet != NULL) { if (ConfValIsTrue(packet)) { json_output_ctx->flags |= LOG_JSON_PACKET; } } if (tagged_packets != NULL) { if (ConfValIsTrue(tagged_packets)) { json_output_ctx->flags |= LOG_JSON_TAGGED_PACKETS; } } if (dnp3 != NULL) { if (ConfValIsTrue(dnp3)) { json_output_ctx->flags |= LOG_JSON_DNP3; } } json_output_ctx->payload_buffer_size = payload_buffer_size; HttpXFFGetCfg(conf, xff_cfg); } } /** * \brief Create a new LogFileCtx for "fast" output style. * \param conf The configuration node for this output. * \return A LogFileCtx pointer on success, NULL on failure. */ static OutputCtx *JsonAlertLogInitCtx(ConfNode *conf) { AlertJsonOutputCtx *json_output_ctx = NULL; LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { SCLogDebug("AlertFastLogInitCtx2: Could not create new LogFileCtx"); return NULL; } if (SCConfLogOpenGeneric(conf, logfile_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(logfile_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(logfile_ctx); return NULL; } json_output_ctx = SCMalloc(sizeof(AlertJsonOutputCtx)); if (unlikely(json_output_ctx == NULL)) { LogFileFreeCtx(logfile_ctx); SCFree(output_ctx); return NULL; } memset(json_output_ctx, 0, sizeof(AlertJsonOutputCtx)); json_output_ctx->file_ctx = logfile_ctx; XffSetup(json_output_ctx, conf); output_ctx->data = json_output_ctx; output_ctx->DeInit = JsonAlertLogDeInitCtx; return output_ctx; } /** * \brief Create a new LogFileCtx for "fast" output style. * \param conf The configuration node for this output. * \return A LogFileCtx pointer on success, NULL on failure. */ static OutputCtx *JsonAlertLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ajt = parent_ctx->data; AlertJsonOutputCtx *json_output_ctx = NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) return NULL; json_output_ctx = SCMalloc(sizeof(AlertJsonOutputCtx)); if (unlikely(json_output_ctx == NULL)) { goto error; } memset(json_output_ctx, 0, sizeof(AlertJsonOutputCtx)); json_output_ctx->file_ctx = ajt->file_ctx; XffSetup(json_output_ctx, conf); output_ctx->data = json_output_ctx; output_ctx->DeInit = JsonAlertLogDeInitCtxSub; return output_ctx; error: if (json_output_ctx != NULL) { SCFree(json_output_ctx); } if (output_ctx != NULL) { SCFree(output_ctx); } return NULL; } void JsonAlertLogRegister (void) { OutputRegisterPacketModule(LOGGER_JSON_ALERT, MODULE_NAME, "alert-json-log", JsonAlertLogInitCtx, JsonAlertLogger, JsonAlertLogCondition, JsonAlertLogThreadInit, JsonAlertLogThreadDeinit, NULL); OutputRegisterPacketSubModule(LOGGER_JSON_ALERT, "eve-log", MODULE_NAME, "eve-log.alert", JsonAlertLogInitCtxSub, JsonAlertLogger, JsonAlertLogCondition, JsonAlertLogThreadInit, JsonAlertLogThreadDeinit, NULL); } #else void JsonAlertLogRegister (void) { } #endif suricata-3.2.1/src/output-json-email-common.h0000644000000000000000000000271413051004444016040 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_EMAIL_COMMON_H__ #define __OUTPUT_JSON_EMAIL_COMMON_H__ typedef struct OutputJsonEmailCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ uint64_t fields;/** Store fields */ } OutputJsonEmailCtx; #ifdef HAVE_LIBJANSSON typedef struct JsonEmailLogThread_ { OutputJsonEmailCtx *emaillog_ctx; MemBuffer *buffer; } JsonEmailLogThread; TmEcode JsonEmailLogJson(JsonEmailLogThread *aft, json_t *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id); json_t *JsonEmailAddMetadata(const Flow *f, uint32_t tx_id); #endif void OutputEmailInitConf(ConfNode *conf, OutputJsonEmailCtx *email_ctx); #endif /* __OUTPUT_JSON_EMAIL_COMMON_H__ */ suricata-3.2.1/src/util-file.c0000644000000000000000000006631013051004444013045 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon * */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "flow.h" #include "stream.h" #include "stream-tcp.h" #include "runmodes.h" #include "util-hash.h" #include "util-debug.h" #include "util-memcmp.h" #include "util-print.h" #include "app-layer-parser.h" #include "util-validate.h" /** \brief switch to force filestore on all files * regardless of the rules. */ static int g_file_force_filestore = 0; /** \brief switch to force magic checks on all files * regardless of the rules. */ static int g_file_force_magic = 0; /** \brief switch to force md5 calculation on all files * regardless of the rules. */ static int g_file_force_md5 = 0; /** \brief switch to force sha1 calculation on all files * regardless of the rules. */ static int g_file_force_sha1 = 0; /** \brief switch to force sha256 calculation on all files * regardless of the rules. */ static int g_file_force_sha256 = 0; /** \brief switch to force tracking off all files * regardless of the rules. */ static int g_file_force_tracking = 0; /** \brief switch to use g_file_store_reassembly_depth * to reassembly files */ static int g_file_store_enable = 0; /** \brief stream_config.reassembly_depth equivalent * for files */ static uint32_t g_file_store_reassembly_depth = 0; /* prototypes */ static void FileFree(File *); void FileForceFilestoreEnable(void) { g_file_force_filestore = 1; } void FileForceMagicEnable(void) { g_file_force_magic = 1; } void FileForceMd5Enable(void) { g_file_force_md5 = 1; } void FileForceSha1Enable(void) { g_file_force_sha1 = 1; } void FileForceSha256Enable(void) { g_file_force_sha256 = 1; } int FileForceFilestore(void) { return g_file_force_filestore; } void FileReassemblyDepthEnable(uint32_t size) { g_file_store_enable = 1; g_file_store_reassembly_depth = size; } uint32_t FileReassemblyDepth(void) { if (g_file_store_enable == 1) return g_file_store_reassembly_depth; else return stream_config.reassembly_depth; } int FileForceMagic(void) { return g_file_force_magic; } int FileForceMd5(void) { return g_file_force_md5; } int FileForceSha1(void) { return g_file_force_sha1; } int FileForceSha256(void) { return g_file_force_sha256; } void FileForceTrackingEnable(void) { g_file_force_tracking = 1; } /** * \brief Function to parse forced file hashing configuration. */ void FileForceHashParseCfg(ConfNode *conf) { BUG_ON(conf == NULL); ConfNode *forcehash_node = NULL; /* legacy option */ const char *force_md5 = ConfNodeLookupChildValue(conf, "force-md5"); if (force_md5 != NULL) { SCLogWarning(SC_ERR_DEPRECATED_CONF, "deprecated 'force-md5' option " "found. Please use 'force-hash: [md5]' instead"); if (ConfValIsTrue(force_md5)) { #ifdef HAVE_NSS FileForceMd5Enable(); SCLogInfo("forcing md5 calculation for logged files"); #else SCLogInfo("md5 calculation requires linking against libnss"); #endif } } if (conf != NULL) forcehash_node = ConfNodeLookupChild(conf, "force-hash"); if (forcehash_node != NULL) { ConfNode *field = NULL; TAILQ_FOREACH(field, &forcehash_node->head, next) { if (strcasecmp("md5", field->val) == 0) { #ifdef HAVE_NSS FileForceMd5Enable(); SCLogConfig("forcing md5 calculation for logged or stored files"); #else SCLogInfo("md5 calculation requires linking against libnss"); #endif } if (strcasecmp("sha1", field->val) == 0) { #ifdef HAVE_NSS FileForceSha1Enable(); SCLogConfig("forcing sha1 calculation for logged or stored files"); #else SCLogInfo("sha1 calculation requires linking against libnss"); #endif } if (strcasecmp("sha256", field->val) == 0) { #ifdef HAVE_NSS FileForceSha256Enable(); SCLogConfig("forcing sha256 calculation for logged or stored files"); #else SCLogInfo("sha256 calculation requires linking against libnss"); #endif } } } } uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction) { uint16_t flags = 0; if (direction == STREAM_TOSERVER) { if (flow->file_flags & FLOWFILE_NO_STORE_TS) { flags |= FILE_NOSTORE; } if (flow->file_flags & FLOWFILE_NO_MAGIC_TS) { flags |= FILE_NOMAGIC; } if (flow->file_flags & FLOWFILE_NO_MD5_TS) { flags |= FILE_NOMD5; } if (flow->file_flags & FLOWFILE_NO_SHA1_TS) { flags |= FILE_NOSHA1; } if (flow->file_flags & FLOWFILE_NO_SHA256_TS) { flags |= FILE_NOSHA256; } } else { if (flow->file_flags & FLOWFILE_NO_STORE_TC) { flags |= FILE_NOSTORE; } if (flow->file_flags & FLOWFILE_NO_MAGIC_TC) { flags |= FILE_NOMAGIC; } if (flow->file_flags & FLOWFILE_NO_MD5_TC) { flags |= FILE_NOMD5; } if (flow->file_flags & FLOWFILE_NO_SHA1_TC) { flags |= FILE_NOSHA1; } if (flow->file_flags & FLOWFILE_NO_SHA256_TC) { flags |= FILE_NOSHA256; } } return flags; } int FileMagicSize(void) { /** \todo make this size configurable */ return 512; } /** * \brief get the size of the file data * * This doesn't reflect how much of the file we have in memory, just the * total size of filedata so far. */ uint64_t FileDataSize(const File *file) { if (file != NULL && file->sb != NULL) { SCLogDebug("returning %"PRIu64, file->sb->stream_offset + file->sb->buf_offset); return file->sb->stream_offset + file->sb->buf_offset; } SCLogDebug("returning 0 (default)"); return 0; } /** * \brief get the size of the file * * This doesn't reflect how much of the file we have in memory, just the * total size of file so far. */ uint64_t FileTrackedSize(const File *file) { if (file != NULL) { return file->size; } return 0; } static int FilePruneFile(File *file) { SCEnter(); #ifdef HAVE_MAGIC if (!(file->flags & FILE_NOMAGIC)) { /* need magic but haven't set it yet, bail out */ if (file->magic == NULL) SCReturnInt(0); else SCLogDebug("file->magic %s", file->magic); } else { SCLogDebug("file->flags & FILE_NOMAGIC == true"); } #endif uint64_t left_edge = file->content_stored; if (file->flags & FILE_NOSTORE) { left_edge = FileDataSize(file); } if (file->flags & FILE_USE_DETECT) { left_edge = MIN(left_edge, file->content_inspected); } if (left_edge) { StreamingBufferSlideToOffset(file->sb, left_edge); } if (left_edge != FileDataSize(file)) { SCReturnInt(0); } SCLogDebug("file->state %d. Is >= FILE_STATE_CLOSED: %s", file->state, (file->state >= FILE_STATE_CLOSED) ? "yes" : "no"); /* file is done when state is closed+, logging/storing is done (if any) */ if (file->state >= FILE_STATE_CLOSED && (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) && (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED))) { SCReturnInt(1); } else { SCReturnInt(0); } } void FilePrune(FileContainer *ffc) { File *file = ffc->head; while (file) { if (FilePruneFile(file) == 0) break; BUG_ON(file != ffc->head); SCLogDebug("removing file %p", file); File *file_next = file->next; /* update head and tail */ ffc->head = file_next; if (file == ffc->tail) ffc->tail = NULL; FileFree(file); file = file_next; } } /** * \brief allocate a FileContainer * * \retval new newly allocated FileContainer * \retval NULL error */ FileContainer *FileContainerAlloc(void) { FileContainer *new = SCMalloc(sizeof(FileContainer)); if (unlikely(new == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating mem"); return NULL; } memset(new, 0, sizeof(FileContainer)); new->head = new->tail = NULL; return new; } /** * \brief Recycle a FileContainer * * \param ffc FileContainer */ void FileContainerRecycle(FileContainer *ffc) { if (ffc == NULL) return; File *cur = ffc->head; File *next = NULL; for (;cur != NULL; cur = next) { next = cur->next; FileFree(cur); } ffc->head = ffc->tail = NULL; } /** * \brief Free a FileContainer * * \param ffc FileContainer */ void FileContainerFree(FileContainer *ffc) { if (ffc == NULL) return; File *ptr = ffc->head; File *next = NULL; for (;ptr != NULL; ptr = next) { next = ptr->next; FileFree(ptr); } ffc->head = ffc->tail = NULL; SCFree(ffc); } /** * \brief Alloc a new File * * \param name character array containing the name (not a string) * \param name_len length in bytes of the name * * \retval new File object or NULL on error */ static File *FileAlloc(const uint8_t *name, uint16_t name_len) { File *new = SCMalloc(sizeof(File)); if (unlikely(new == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating mem"); return NULL; } memset(new, 0, sizeof(File)); new->name = SCMalloc(name_len); if (new->name == NULL) { SCFree(new); return NULL; } new->name_len = name_len; memcpy(new->name, name, name_len); return new; } static void FileFree(File *ff) { if (ff == NULL) return; if (ff->name != NULL) SCFree(ff->name); #ifdef HAVE_MAGIC /* magic returned by libmagic is strdup'd by MagicLookup. */ if (ff->magic != NULL) SCFree(ff->magic); #endif if (ff->sb != NULL) { StreamingBufferFree(ff->sb); } #ifdef HAVE_NSS if (ff->md5_ctx) HASH_Destroy(ff->md5_ctx); if (ff->sha1_ctx) HASH_Destroy(ff->sha1_ctx); if (ff->sha256_ctx) HASH_Destroy(ff->sha256_ctx); #endif SCFree(ff); } void FileContainerAdd(FileContainer *ffc, File *ff) { if (ffc->head == NULL || ffc->tail == NULL) { ffc->head = ffc->tail = ff; } else { ffc->tail->next = ff; ffc->tail = ff; } } /** * \brief Tag a file for storing * * \param ff The file to store */ int FileStore(File *ff) { ff->flags |= FILE_STORE; SCReturnInt(0); } /** * \brief Set the TX id for a file * * \param ff The file to store * \param txid the tx id */ int FileSetTx(File *ff, uint64_t txid) { SCLogDebug("ff %p txid %"PRIu64, ff, txid); if (ff != NULL) ff->txid = txid; SCReturnInt(0); } /** * \brief check if we have stored enough * * \param ff file * * \retval 0 limit not reached yet * \retval 1 limit reached */ static int FileStoreNoStoreCheck(File *ff) { SCEnter(); if (ff == NULL) { SCReturnInt(0); } if (ff->flags & FILE_NOSTORE) { if (ff->state == FILE_STATE_OPENED && FileDataSize(ff) >= (uint64_t)FileMagicSize()) { SCReturnInt(1); } } SCReturnInt(0); } static int AppendData(File *file, const uint8_t *data, uint32_t data_len) { if (StreamingBufferAppendNoTrack(file->sb, data, data_len) != 0) { SCReturnInt(-1); } #ifdef HAVE_NSS if (file->md5_ctx) { HASH_Update(file->md5_ctx, data, data_len); } if (file->sha1_ctx) { HASH_Update(file->sha1_ctx, data, data_len); } if (file->sha256_ctx) { HASH_Update(file->sha256_ctx, data, data_len); } #endif SCReturnInt(0); } /** * \brief Store a chunk of file data in the flow. The open "flowfile" * will be used. * * \param ffc the container * \param data data chunk * \param data_len data chunk len * * \retval 0 ok * \retval -1 error * \retval -2 no store for this file */ int FileAppendData(FileContainer *ffc, const uint8_t *data, uint32_t data_len) { SCEnter(); if (ffc == NULL || ffc->tail == NULL || data == NULL || data_len == 0) { SCReturnInt(-1); } ffc->tail->size += data_len; if (ffc->tail->state != FILE_STATE_OPENED) { if (ffc->tail->flags & FILE_NOSTORE) { SCReturnInt(-2); } SCReturnInt(-1); } if (FileStoreNoStoreCheck(ffc->tail) == 1) { #ifdef HAVE_NSS int hash_done = 0; /* no storage but forced hashing */ if (ffc->tail->md5_ctx) { HASH_Update(ffc->tail->md5_ctx, data, data_len); hash_done = 1; } if (ffc->tail->sha1_ctx) { HASH_Update(ffc->tail->sha1_ctx, data, data_len); hash_done = 1; } if (ffc->tail->sha256_ctx) { HASH_Update(ffc->tail->sha256_ctx, data, data_len); hash_done = 1; } if (hash_done) SCReturnInt(0); #endif if (g_file_force_tracking || (!(ffc->tail->flags & FILE_NOTRACK))) SCReturnInt(0); ffc->tail->state = FILE_STATE_TRUNCATED; SCLogDebug("flowfile state transitioned to FILE_STATE_TRUNCATED"); SCReturnInt(-2); } SCLogDebug("appending %"PRIu32" bytes", data_len); if (AppendData(ffc->tail, data, data_len) != 0) { ffc->tail->state = FILE_STATE_ERROR; SCReturnInt(-1); } SCReturnInt(0); } /** * \brief Open a new File * * \param ffc flow container * \param sbcfg buffer config * \param name filename character array * \param name_len filename len * \param data initial data * \param data_len initial data len * \param flags open flags * * \retval ff flowfile object * * \note filename is not a string, so it's not nul terminated. */ File *FileOpenFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags) { SCEnter(); //PrintRawDataFp(stdout, name, name_len); File *ff = FileAlloc(name, name_len); if (ff == NULL) { SCReturnPtr(NULL, "File"); } ff->sb = StreamingBufferInit(sbcfg); if (ff->sb == NULL) { FileFree(ff); SCReturnPtr(NULL, "File"); } SCLogDebug("ff->sb %p", ff->sb); if (flags & FILE_STORE || g_file_force_filestore) { FileStore(ff); } else if (flags & FILE_NOSTORE) { SCLogDebug("not storing this file"); ff->flags |= FILE_NOSTORE; } if (flags & FILE_NOMAGIC) { SCLogDebug("not doing magic for this file"); ff->flags |= FILE_NOMAGIC; } if (flags & FILE_NOMD5) { SCLogDebug("not doing md5 for this file"); ff->flags |= FILE_NOMD5; } if (flags & FILE_NOSHA1) { SCLogDebug("not doing sha1 for this file"); ff->flags |= FILE_NOSHA1; } if (flags & FILE_NOSHA256) { SCLogDebug("not doing sha256 for this file"); ff->flags |= FILE_NOSHA256; } if (flags & FILE_USE_DETECT) { SCLogDebug("considering content_inspect tracker when pruning"); ff->flags |= FILE_USE_DETECT; } #ifdef HAVE_NSS if (!(ff->flags & FILE_NOMD5) || g_file_force_md5) { ff->md5_ctx = HASH_Create(HASH_AlgMD5); if (ff->md5_ctx != NULL) { HASH_Begin(ff->md5_ctx); } } if (!(ff->flags & FILE_NOSHA1) || g_file_force_sha1) { ff->sha1_ctx = HASH_Create(HASH_AlgSHA1); if (ff->sha1_ctx != NULL) { HASH_Begin(ff->sha1_ctx); } } if (!(ff->flags & FILE_NOSHA256) || g_file_force_sha256) { ff->sha256_ctx = HASH_Create(HASH_AlgSHA256); if (ff->sha256_ctx != NULL) { HASH_Begin(ff->sha256_ctx); } } #endif ff->state = FILE_STATE_OPENED; SCLogDebug("flowfile state transitioned to FILE_STATE_OPENED"); FileContainerAdd(ffc, ff); if (data != NULL) { ff->size += data_len; if (AppendData(ff, data, data_len) != 0) { ff->state = FILE_STATE_ERROR; SCReturnPtr(NULL, "File"); } SCLogDebug("file size is now %"PRIu64, FileTrackedSize(ff)); } SCReturnPtr(ff, "File"); } static int FileCloseFilePtr(File *ff, const uint8_t *data, uint32_t data_len, uint16_t flags) { SCEnter(); if (ff == NULL) { SCReturnInt(-1); } if (ff->state != FILE_STATE_OPENED) { SCReturnInt(-1); } if (data != NULL) { ff->size += data_len; if (ff->flags & FILE_NOSTORE) { #ifdef HAVE_NSS /* no storage but hashing */ if (ff->md5_ctx) HASH_Update(ff->md5_ctx, data, data_len); if (ff->sha1_ctx) HASH_Update(ff->sha1_ctx, data, data_len); if (ff->sha256_ctx) HASH_Update(ff->sha256_ctx, data, data_len); #endif } else { if (AppendData(ff, data, data_len) != 0) { ff->state = FILE_STATE_ERROR; SCReturnInt(-1); } } } if (flags & FILE_TRUNCATED) { ff->state = FILE_STATE_TRUNCATED; SCLogDebug("flowfile state transitioned to FILE_STATE_TRUNCATED"); if (flags & FILE_NOSTORE) { SCLogDebug("not storing this file"); ff->flags |= FILE_NOSTORE; } } else { ff->state = FILE_STATE_CLOSED; SCLogDebug("flowfile state transitioned to FILE_STATE_CLOSED"); #ifdef HAVE_NSS if (ff->md5_ctx) { unsigned int len = 0; HASH_End(ff->md5_ctx, ff->md5, &len, sizeof(ff->md5)); ff->flags |= FILE_MD5; } if (ff->sha1_ctx) { unsigned int len = 0; HASH_End(ff->sha1_ctx, ff->sha1, &len, sizeof(ff->sha1)); ff->flags |= FILE_SHA1; } if (ff->sha256_ctx) { unsigned int len = 0; HASH_End(ff->sha256_ctx, ff->sha256, &len, sizeof(ff->sha256)); ff->flags |= FILE_SHA256; } #endif } SCReturnInt(0); } /** * \brief Close a File * * \param ffc the container * \param data final data if any * \param data_len data len if any * \param flags flags * * \retval 0 ok * \retval -1 error */ int FileCloseFile(FileContainer *ffc, const uint8_t *data, uint32_t data_len, uint16_t flags) { SCEnter(); if (ffc == NULL || ffc->tail == NULL) { SCReturnInt(-1); } if (FileCloseFilePtr(ffc->tail, data, data_len, flags) == -1) { SCReturnInt(-1); } SCReturnInt(0); } /** * \brief disable file storage for a flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableStoring(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_STORE_TS; else f->file_flags |= FLOWFILE_NO_STORE_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { /* if we're already storing, we'll continue */ if (!(ptr->flags & FILE_STORE)) { SCLogDebug("not storing this file"); ptr->flags |= FILE_NOSTORE; } } } SCReturn; } /** * \brief disable file magic lookups for this flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableMagic(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_MAGIC_TS; else f->file_flags |= FLOWFILE_NO_MAGIC_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { SCLogDebug("disabling magic for file %p from direction %s", ptr, direction == STREAM_TOSERVER ? "toserver":"toclient"); ptr->flags |= FILE_NOMAGIC; } } SCReturn; } /** * \brief disable file md5 calc for this flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableMd5(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_MD5_TS; else f->file_flags |= FLOWFILE_NO_MD5_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { SCLogDebug("disabling md5 for file %p from direction %s", ptr, direction == STREAM_TOSERVER ? "toserver":"toclient"); ptr->flags |= FILE_NOMD5; #ifdef HAVE_NSS /* destroy any ctx we may have so far */ if (ptr->md5_ctx != NULL) { HASH_Destroy(ptr->md5_ctx); ptr->md5_ctx = NULL; } #endif } } SCReturn; } /** * \brief disable file sha1 calc for this flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableSha1(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_SHA1_TS; else f->file_flags |= FLOWFILE_NO_SHA1_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { SCLogDebug("disabling sha1 for file %p from direction %s", ptr, direction == STREAM_TOSERVER ? "toserver":"toclient"); ptr->flags |= FILE_NOSHA1; #ifdef HAVE_NSS /* destroy any ctx we may have so far */ if (ptr->sha1_ctx != NULL) { HASH_Destroy(ptr->sha1_ctx); ptr->sha1_ctx = NULL; } #endif } } SCReturn; } /** * \brief disable file sha256 calc for this flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableSha256(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_SHA256_TS; else f->file_flags |= FLOWFILE_NO_SHA256_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { SCLogDebug("disabling sha256 for file %p from direction %s", ptr, direction == STREAM_TOSERVER ? "toserver":"toclient"); ptr->flags |= FILE_NOSHA256; #ifdef HAVE_NSS /* destroy any ctx we may have so far */ if (ptr->sha256_ctx != NULL) { HASH_Destroy(ptr->sha256_ctx); ptr->sha256_ctx = NULL; } #endif } } SCReturn; } /** * \brief disable file size tracking for this flow * * \param f *LOCKED* flow * \param direction flow direction */ void FileDisableFilesize(Flow *f, uint8_t direction) { File *ptr = NULL; SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); if (direction == STREAM_TOSERVER) f->file_flags |= FLOWFILE_NO_SIZE_TS; else f->file_flags |= FLOWFILE_NO_SIZE_TC; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { SCLogDebug("disabling size tracking for file %p from direction %s", ptr, direction == STREAM_TOSERVER ? "toserver":"toclient"); ptr->flags |= FILE_NOTRACK; } } SCReturn; } /** * \brief set no store flag, close file if needed * * \param ff file */ void FileDisableStoringForFile(File *ff) { SCEnter(); if (ff == NULL) { SCReturn; } SCLogDebug("not storing this file"); ff->flags |= FILE_NOSTORE; if (ff->state == FILE_STATE_OPENED && FileDataSize(ff) >= (uint64_t)FileMagicSize()) { if (g_file_force_md5 == 0 && g_file_force_sha1 == 0 && g_file_force_sha256 == 0 && g_file_force_tracking == 0) { (void)FileCloseFilePtr(ff, NULL, 0, (FILE_TRUNCATED|FILE_NOSTORE)); } } } /** * \brief disable file storing for files in a transaction * * \param f *LOCKED* flow * \param direction flow direction * \param tx_id transaction id */ void FileDisableStoringForTransaction(Flow *f, uint8_t direction, uint64_t tx_id) { File *ptr = NULL; DEBUG_ASSERT_FLOW_LOCKED(f); SCEnter(); FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto, f->alstate, direction); if (ffc != NULL) { for (ptr = ffc->head; ptr != NULL; ptr = ptr->next) { if (ptr->txid == tx_id) { if (ptr->flags & FILE_STORE) { /* weird, already storing -- let it continue*/ SCLogDebug("file is already being stored"); } else { FileDisableStoringForFile(ptr); } } } } SCReturn; } /** * \brief flag a file with id "file_id" to be stored. * * \param fc file store * \param file_id the file's id */ void FileStoreFileById(FileContainer *fc, uint32_t file_id) { File *ptr = NULL; SCEnter(); if (fc != NULL) { for (ptr = fc->head; ptr != NULL; ptr = ptr->next) { if (ptr->file_id == file_id) { FileStore(ptr); } } } } void FileStoreAllFilesForTx(FileContainer *fc, uint64_t tx_id) { File *ptr = NULL; SCEnter(); if (fc != NULL) { for (ptr = fc->head; ptr != NULL; ptr = ptr->next) { if (ptr->txid == tx_id) { FileStore(ptr); } } } } void FileStoreAllFiles(FileContainer *fc) { File *ptr = NULL; SCEnter(); if (fc != NULL) { for (ptr = fc->head; ptr != NULL; ptr = ptr->next) { FileStore(ptr); } } } void FileTruncateAllOpenFiles(FileContainer *fc) { File *ptr = NULL; SCEnter(); if (fc != NULL) { for (ptr = fc->head; ptr != NULL; ptr = ptr->next) { if (ptr->state == FILE_STATE_OPENED) { FileCloseFilePtr(ptr, NULL, 0, FILE_TRUNCATED); } } } } suricata-3.2.1/src/output-json-ssh.c0000644000000000000000000002024213051004444014247 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements SSH JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "app-layer-parser.h" #include "output.h" #include "app-layer-ssh.h" #include "app-layer.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "output-json.h" #ifdef HAVE_LIBJANSSON #define MODULE_NAME "LogSshLog" typedef struct OutputSshCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } OutputSshCtx; typedef struct JsonSshLogThread_ { OutputSshCtx *sshlog_ctx; MemBuffer *buffer; } JsonSshLogThread; void JsonSshLogJSON(json_t *tjs, SshState *ssh_state) { json_t *cjs = json_object(); if (cjs != NULL) { json_object_set_new(cjs, "proto_version", json_string((char *)ssh_state->cli_hdr.proto_version)); json_object_set_new(cjs, "software_version", json_string((char *)ssh_state->cli_hdr.software_version)); } json_object_set_new(tjs, "client", cjs); json_t *sjs = json_object(); if (sjs != NULL) { json_object_set_new(sjs, "proto_version", json_string((char *)ssh_state->srv_hdr.proto_version)); json_object_set_new(sjs, "software_version", json_string((char *)ssh_state->srv_hdr.software_version)); } json_object_set_new(tjs, "server", sjs); } static int JsonSshLogger(ThreadVars *tv, void *thread_data, const Packet *p) { JsonSshLogThread *aft = (JsonSshLogThread *)thread_data; OutputSshCtx *ssh_ctx = aft->sshlog_ctx; if (unlikely(p->flow == NULL)) { return 0; } /* check if we have SSH state or not */ uint16_t proto = FlowGetAppProtocol(p->flow); if (proto != ALPROTO_SSH) goto end; SshState *ssh_state = (SshState *)FlowGetAppState(p->flow); if (unlikely(ssh_state == NULL)) { goto end; } if (ssh_state->cli_hdr.software_version == NULL || ssh_state->srv_hdr.software_version == NULL) goto end; json_t *js = CreateJSONHeader((Packet *)p, 1, "ssh");//TODO if (unlikely(js == NULL)) goto end; json_t *tjs = json_object(); if (tjs == NULL) { free(js); goto end; } /* reset */ MemBufferReset(aft->buffer); JsonSshLogJSON(tjs, ssh_state); json_object_set_new(js, "ssh", tjs); OutputJSONBuffer(js, ssh_ctx->file_ctx, &aft->buffer); json_object_clear(js); json_decref(js); /* we only log the state once */ ssh_state->cli_hdr.flags |= SSH_FLAG_STATE_LOGGED; end: return 0; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonSshLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonSshLogThread *aft = SCMalloc(sizeof(JsonSshLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonSshLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogSSH. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->sshlog_ctx = ((OutputCtx *)initdata)->data; aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonSshLogThreadDeinit(ThreadVars *t, void *data) { JsonSshLogThread *aft = (JsonSshLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonSshLogThread)); SCFree(aft); return TM_ECODE_OK; } static void OutputSshLogDeinit(OutputCtx *output_ctx) { OutputSshLoggerDisable(); OutputSshCtx *ssh_ctx = output_ctx->data; LogFileCtx *logfile_ctx = ssh_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(ssh_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "ssh.json" OutputCtx *OutputSshLogInit(ConfNode *conf) { if (OutputSshLoggerEnable() != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "only one 'ssh' logger " "can be enabled"); return NULL; } LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_SSH_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } OutputSshCtx *ssh_ctx = SCMalloc(sizeof(OutputSshCtx)); if (unlikely(ssh_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(ssh_ctx); return NULL; } ssh_ctx->file_ctx = file_ctx; output_ctx->data = ssh_ctx; output_ctx->DeInit = OutputSshLogDeinit; return output_ctx; } static void OutputSshLogDeinitSub(OutputCtx *output_ctx) { OutputSshLoggerDisable(); OutputSshCtx *ssh_ctx = output_ctx->data; SCFree(ssh_ctx); SCFree(output_ctx); } OutputCtx *OutputSshLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; if (OutputSshLoggerEnable() != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "only one 'ssh' logger " "can be enabled"); return NULL; } OutputSshCtx *ssh_ctx = SCMalloc(sizeof(OutputSshCtx)); if (unlikely(ssh_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(ssh_ctx); return NULL; } ssh_ctx->file_ctx = ojc->file_ctx; output_ctx->data = ssh_ctx; output_ctx->DeInit = OutputSshLogDeinitSub; return output_ctx; } /** \internal * \brief Condition function for SSH logger * \retval bool true or false -- log now? */ static int JsonSshCondition(ThreadVars *tv, const Packet *p) { if (p->flow == NULL) { return FALSE; } if (!(PKT_IS_TCP(p))) { return FALSE; } uint16_t proto = FlowGetAppProtocol(p->flow); if (proto != ALPROTO_SSH) goto dontlog; SshState *ssh_state = (SshState *)FlowGetAppState(p->flow); if (ssh_state == NULL) { SCLogDebug("no ssh state, so no logging"); goto dontlog; } /* we only log the state once */ if (ssh_state->cli_hdr.flags & SSH_FLAG_STATE_LOGGED) goto dontlog; if (ssh_state->cli_hdr.software_version == NULL || ssh_state->srv_hdr.software_version == NULL) goto dontlog; /* todo: logic to log once */ return TRUE; dontlog: return FALSE; } void JsonSshLogRegister (void) { /* register as separate module */ OutputRegisterPacketModule(LOGGER_JSON_SSH, "JsonSshLog", "ssh-json-log", OutputSshLogInit, JsonSshLogger, JsonSshCondition, JsonSshLogThreadInit, JsonSshLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterPacketSubModule(LOGGER_JSON_SSH, "eve-log", "JsonSshLog", "eve-log.ssh", OutputSshLogInitSub, JsonSshLogger, JsonSshCondition, JsonSshLogThreadInit, JsonSshLogThreadDeinit, NULL); } #else void JsonSshLogRegister (void) { } #endif suricata-3.2.1/src/detect-engine.c0000644000000000000000000025317513051004444013675 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "flow-private.h" #include "flow-util.h" #include "flow-worker.h" #include "conf.h" #include "conf-yaml-loader.h" #include "app-layer-htp.h" #include "detect-parse.h" #include "detect-engine-sigorder.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-iponly.h" #include "detect-engine-tag.h" #include "detect-engine-uri.h" #include "detect-engine-hrhd.h" #include "detect-engine-file.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-byte-extract.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-engine-threshold.h" #include "detect-engine-loader.h" #include "util-classification-config.h" #include "util-reference-config.h" #include "util-threshold-config.h" #include "util-error.h" #include "util-hash.h" #include "util-byte.h" #include "util-debug.h" #include "util-unittest.h" #include "util-action.h" #include "util-magic.h" #include "util-signal.h" #include "util-spm.h" #include "util-var-name.h" #include "tm-threads.h" #include "runmodes.h" #ifdef PROFILING #include "util-profiling.h" #endif #include "reputation.h" #define DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT 3000 static uint32_t detect_engine_ctx_id = 1; static DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload( ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt); static int DetectEngineCtxLoadConf(DetectEngineCtx *); static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER, 0, NULL, NULL, TENANT_SELECTOR_UNKNOWN, NULL,}; static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len); static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len); static void TenantIdFree(void *d); static uint32_t DetectEngineTentantGetIdFromVlanId(const void *ctx, const Packet *p); static uint32_t DetectEngineTentantGetIdFromPcap(const void *ctx, const Packet *p); static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL; void DetectAppLayerInspectEngineRegister(AppProto alproto, uint32_t dir, int32_t sm_list, int (*Callback)(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *sig, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)) { if ((alproto >= ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) || (sm_list < DETECT_SM_LIST_MATCH || sm_list >= DETECT_SM_LIST_MAX) || (Callback == NULL)) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments"); exit(EXIT_FAILURE); } int direction; if (dir == SIG_FLAG_TOSERVER) { direction = 0; } else { direction = 1; } DetectEngineAppInspectionEngine *new_engine = SCMalloc(sizeof(DetectEngineAppInspectionEngine)); if (unlikely(new_engine == NULL)) { exit(EXIT_FAILURE); } memset(new_engine, 0, sizeof(*new_engine)); new_engine->alproto = alproto; new_engine->dir = direction; new_engine->sm_list = sm_list; new_engine->Callback = Callback; if (g_app_inspect_engines == NULL) { g_app_inspect_engines = new_engine; } else { DetectEngineAppInspectionEngine *t = g_app_inspect_engines; while (t->next != NULL) { t = t->next; } t->next = new_engine; } } int DetectEngineAppInspectionEngine2Signature(Signature *s) { DetectEngineAppInspectionEngine *t = g_app_inspect_engines; while (t != NULL) { if (s->sm_lists[t->sm_list] == NULL) goto next; if (t->alproto == ALPROTO_UNKNOWN) { /* special case, inspect engine applies to all protocols */ } else if (s->alproto != ALPROTO_UNKNOWN && s->alproto != t->alproto) goto next; if (s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) { if (t->dir == 1) goto next; } else if (s->flags & SIG_FLAG_TOCLIENT && !(s->flags & SIG_FLAG_TOSERVER)) { if (t->dir == 0) goto next; } DetectEngineAppInspectionEngine *new_engine = SCCalloc(1, sizeof(DetectEngineAppInspectionEngine)); if (unlikely(new_engine == NULL)) { exit(EXIT_FAILURE); } new_engine->alproto = t->alproto; new_engine->dir = t->dir; new_engine->sm_list = t->sm_list; new_engine->Callback = t->Callback; if (s->app_inspect == NULL) { s->app_inspect = new_engine; new_engine->inspect_flags = BIT_U32(DE_STATE_FLAG_BASE); // start beyond the built-ins } else { DetectEngineAppInspectionEngine *a = s->app_inspect; while (a->next != NULL) { a = a->next; } a->next = new_engine; new_engine->id = a->id + 1; new_engine->inspect_flags = BIT_U32(new_engine->id + DE_STATE_FLAG_BASE); } SCLogDebug("sid %u: engine %p/%u added", s->id, new_engine, new_engine->id); next: t = t->next; } return 0; } /* code to control the main thread to do a reload */ enum DetectEngineSyncState { IDLE, /**< ready to start a reload */ RELOAD, /**< command main thread to do the reload */ DONE, /**< main thread telling us reload is done */ }; typedef struct DetectEngineSyncer_ { SCMutex m; enum DetectEngineSyncState state; } DetectEngineSyncer; static DetectEngineSyncer detect_sync = { SCMUTEX_INITIALIZER, IDLE }; /* tell main to start reloading */ int DetectEngineReloadStart(void) { int r = 0; SCMutexLock(&detect_sync.m); if (detect_sync.state == IDLE) { detect_sync.state = RELOAD; } else { r = -1; } SCMutexUnlock(&detect_sync.m); return r; } /* main thread checks this to see if it should start */ int DetectEngineReloadIsStart(void) { int r = 0; SCMutexLock(&detect_sync.m); if (detect_sync.state == RELOAD) { r = 1; } SCMutexUnlock(&detect_sync.m); return r; } /* main thread sets done when it's done */ void DetectEngineReloadSetDone(void) { SCMutexLock(&detect_sync.m); detect_sync.state = DONE; SCMutexUnlock(&detect_sync.m); } /* caller loops this until it returns 1 */ int DetectEngineReloadIsDone(void) { int r = 0; SCMutexLock(&detect_sync.m); if (detect_sync.state == DONE) { r = 1; detect_sync.state = IDLE; } SCMutexUnlock(&detect_sync.m); return r; } /** \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags app layer flags * \param state App layer state * * \retval 0 no match * \retval 1 match */ int DetectEngineInspectGenericList(ThreadVars *tv, const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f, const uint8_t flags, void *alstate, void *txv, uint64_t tx_id, const int list) { #ifdef PROFILING KEYWORD_PROFILING_SET_LIST(det_ctx, list); #endif SigMatchData *smd = s->sm_arrays[list]; SCLogDebug("running match functions, sm %p", smd); if (smd != NULL) { while (1) { int match = 0; #ifdef PROFILING KEYWORD_PROFILING_START; #endif match = sigmatch_table[smd->type]. AppLayerTxMatch(tv, det_ctx, f, flags, alstate, txv, s, smd->ctx); #ifdef PROFILING KEYWORD_PROFILING_END(det_ctx, smd->type, (match == 1)); #endif if (match == 0) return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; if (match == 2) { return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } if (smd->is_last) break; smd++; } } return DETECT_ENGINE_INSPECT_SIG_MATCH; } /* nudge capture loops to wake up */ static void BreakCapture(void) { SCMutexLock(&tv_root_lock); ThreadVars *tv = tv_root[TVT_PPT]; while (tv) { /* find the correct slot */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { if (suricata_ctl_flags != 0) { SCMutexUnlock(&tv_root_lock); return; } TmModule *tm = TmModuleGetById(slots->tm_id); if (!(tm->flags & TM_FLAG_RECEIVE_TM)) { slots = slots->slot_next; continue; } /* signal capture method that we need a packet. */ TmThreadsSetFlag(tv, THV_CAPTURE_INJECT_PKT); /* if the method supports it, BreakLoop. Otherwise we rely on * the capture method's recv timeout */ if (tm->PktAcqLoop && tm->PktAcqBreakLoop) { tm->PktAcqBreakLoop(tv, SC_ATOMIC_GET(slots->slot_data)); } break; } tv = tv->next; } SCMutexUnlock(&tv_root_lock); } /** \internal * \brief inject a pseudo packet into each detect thread that doesn't use the * new det_ctx yet */ static void InjectPackets(ThreadVars **detect_tvs, DetectEngineThreadCtx **new_det_ctx, int no_of_detect_tvs) { int i; /* inject a fake packet if the detect thread isn't using the new ctx yet, * this speeds up the process */ for (i = 0; i < no_of_detect_tvs; i++) { if (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) != 1) { if (detect_tvs[i]->inq != NULL) { Packet *p = PacketGetFromAlloc(); if (p != NULL) { p->flags |= PKT_PSEUDO_STREAM_END; PacketQueue *q = &trans_q[detect_tvs[i]->inq->id]; SCMutexLock(&q->mutex_q); PacketEnqueue(q, p); SCCondSignal(&q->cond_q); SCMutexUnlock(&q->mutex_q); } } } } } /** \internal * \brief Update detect threads with new detect engine * * Atomically update each detect thread with a new thread context * that is associated to the new detection engine(s). * * If called in unix socket mode, it's possible that we don't have * detect threads yet. * * \retval -1 error * \retval 0 no detection threads * \retval 1 successful reload */ static int DetectEngineReloadThreads(DetectEngineCtx *new_de_ctx) { SCEnter(); int i = 0; int no_of_detect_tvs = 0; ThreadVars *tv = NULL; /* count detect threads in use */ SCMutexLock(&tv_root_lock); tv = tv_root[TVT_PPT]; while (tv) { /* obtain the slots for this TV */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { TmModule *tm = TmModuleGetById(slots->tm_id); if (suricata_ctl_flags != 0) { SCLogInfo("rule reload interupted by engine shutdown"); SCMutexUnlock(&tv_root_lock); return -1; } if (!(tm->flags & TM_FLAG_DETECT_TM)) { slots = slots->slot_next; continue; } no_of_detect_tvs++; break; } tv = tv->next; } SCMutexUnlock(&tv_root_lock); /* can be zero in unix socket mode */ if (no_of_detect_tvs == 0) { return 0; } /* prepare swap structures */ DetectEngineThreadCtx *old_det_ctx[no_of_detect_tvs]; DetectEngineThreadCtx *new_det_ctx[no_of_detect_tvs]; ThreadVars *detect_tvs[no_of_detect_tvs]; memset(old_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *))); memset(new_det_ctx, 0x00, (no_of_detect_tvs * sizeof(DetectEngineThreadCtx *))); memset(detect_tvs, 0x00, (no_of_detect_tvs * sizeof(ThreadVars *))); /* start the process of swapping detect threads ctxs */ /* get reference to tv's and setup new_det_ctx array */ SCMutexLock(&tv_root_lock); tv = tv_root[TVT_PPT]; while (tv) { /* obtain the slots for this TV */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { TmModule *tm = TmModuleGetById(slots->tm_id); if (suricata_ctl_flags != 0) { SCMutexUnlock(&tv_root_lock); goto error; } if (!(tm->flags & TM_FLAG_DETECT_TM)) { slots = slots->slot_next; continue; } old_det_ctx[i] = FlowWorkerGetDetectCtxPtr(SC_ATOMIC_GET(slots->slot_data)); detect_tvs[i] = tv; new_det_ctx[i] = DetectEngineThreadCtxInitForReload(tv, new_de_ctx, 1); if (new_det_ctx[i] == NULL) { SCLogError(SC_ERR_LIVE_RULE_SWAP, "Detect engine thread init " "failure in live rule swap. Let's get out of here"); SCMutexUnlock(&tv_root_lock); goto error; } SCLogDebug("live rule swap created new det_ctx - %p and de_ctx " "- %p\n", new_det_ctx[i], new_de_ctx); i++; break; } tv = tv->next; } BUG_ON(i != no_of_detect_tvs); /* atomicly replace the det_ctx data */ i = 0; tv = tv_root[TVT_PPT]; while (tv) { /* find the correct slot */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { if (suricata_ctl_flags != 0) { return -1; } TmModule *tm = TmModuleGetById(slots->tm_id); if (!(tm->flags & TM_FLAG_DETECT_TM)) { slots = slots->slot_next; continue; } SCLogDebug("swapping new det_ctx - %p with older one - %p", new_det_ctx[i], SC_ATOMIC_GET(slots->slot_data)); FlowWorkerReplaceDetectCtx(SC_ATOMIC_GET(slots->slot_data), new_det_ctx[i++]); break; } tv = tv->next; } SCMutexUnlock(&tv_root_lock); /* threads now all have new data, however they may not have started using * it and may still use the old data */ SCLogDebug("Live rule swap has swapped %d old det_ctx's with new ones, " "along with the new de_ctx", no_of_detect_tvs); InjectPackets(detect_tvs, new_det_ctx, no_of_detect_tvs); for (i = 0; i < no_of_detect_tvs; i++) { int break_out = 0; usleep(1000); while (SC_ATOMIC_GET(new_det_ctx[i]->so_far_used_by_detect) != 1) { if (suricata_ctl_flags != 0) { break_out = 1; break; } BreakCapture(); usleep(1000); } if (break_out) break; SCLogDebug("new_det_ctx - %p used by detect engine", new_det_ctx[i]); } /* this is to make sure that if someone initiated shutdown during a live * rule swap, the live rule swap won't clean up the old det_ctx and * de_ctx, till all detect threads have stopped working and sitting * silently after setting RUNNING_DONE flag and while waiting for * THV_DEINIT flag */ if (i != no_of_detect_tvs) { // not all threads we swapped tv = tv_root[TVT_PPT]; while (tv) { /* obtain the slots for this TV */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { TmModule *tm = TmModuleGetById(slots->tm_id); if (!(tm->flags & TM_FLAG_DETECT_TM)) { slots = slots->slot_next; continue; } while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { usleep(100); } slots = slots->slot_next; } tv = tv->next; } } /* free all the ctxs */ for (i = 0; i < no_of_detect_tvs; i++) { SCLogDebug("Freeing old_det_ctx - %p used by detect", old_det_ctx[i]); DetectEngineThreadCtxDeinit(NULL, old_det_ctx[i]); } SRepReloadComplete(); return 1; error: for (i = 0; i < no_of_detect_tvs; i++) { if (new_det_ctx[i] != NULL) DetectEngineThreadCtxDeinit(NULL, new_det_ctx[i]); } return -1; } static DetectEngineCtx *DetectEngineCtxInitReal(int minimal, const char *prefix) { DetectEngineCtx *de_ctx; de_ctx = SCMalloc(sizeof(DetectEngineCtx)); if (unlikely(de_ctx == NULL)) goto error; memset(de_ctx,0,sizeof(DetectEngineCtx)); if (minimal) { de_ctx->minimal = 1; de_ctx->id = detect_engine_ctx_id++; return de_ctx; } if (prefix != NULL) { strlcpy(de_ctx->config_prefix, prefix, sizeof(de_ctx->config_prefix)); } if (ConfGetBool("engine.init-failure-fatal", (int *)&(de_ctx->failure_fatal)) != 1) { SCLogDebug("ConfGetBool could not load the value."); } de_ctx->mpm_matcher = PatternMatchDefaultMatcher(); de_ctx->spm_matcher = SinglePatternMatchDefaultMatcher(); SCLogConfig("pattern matchers: MPM: %s, SPM: %s", mpm_table[de_ctx->mpm_matcher].name, spm_table[de_ctx->spm_matcher].name); de_ctx->spm_global_thread_ctx = SpmInitGlobalThreadCtx(de_ctx->spm_matcher); if (de_ctx->spm_global_thread_ctx == NULL) { SCLogDebug("Unable to alloc SpmGlobalThreadCtx."); goto error; } DetectEngineCtxLoadConf(de_ctx); SigGroupHeadHashInit(de_ctx); MpmStoreInit(de_ctx); ThresholdHashInit(de_ctx); VariableNameInitHash(de_ctx); DetectParseDupSigHashInit(de_ctx); DetectAddressMapInit(de_ctx); /* init iprep... ignore errors for now */ (void)SRepInit(de_ctx); #ifdef PROFILING SCProfilingKeywordInitCounters(de_ctx); de_ctx->profile_match_logging_threshold = UINT_MAX; // disabled intmax_t v = 0; if (ConfGetInt("detect.profiling.inspect-logging-threshold", &v) == 1) de_ctx->profile_match_logging_threshold = (uint32_t)v; #endif SCClassConfLoadClassficationConfigFile(de_ctx, NULL); SCRConfLoadReferenceConfigFile(de_ctx, NULL); if (ActionInitConfig() < 0) { goto error; } de_ctx->id = detect_engine_ctx_id++; return de_ctx; error: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return NULL; } DetectEngineCtx *DetectEngineCtxInitMinimal(void) { return DetectEngineCtxInitReal(1, NULL); } DetectEngineCtx *DetectEngineCtxInit(void) { return DetectEngineCtxInitReal(0, NULL); } DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix) { if (prefix == NULL || strlen(prefix) == 0) return DetectEngineCtxInit(); else return DetectEngineCtxInitReal(0, prefix); } static void DetectEngineCtxFreeThreadKeywordData(DetectEngineCtx *de_ctx) { DetectEngineThreadKeywordCtxItem *item = de_ctx->keyword_list; while (item) { DetectEngineThreadKeywordCtxItem *next = item->next; SCFree(item); item = next; } de_ctx->keyword_list = NULL; } /** * \brief Free a DetectEngineCtx:: * * \param de_ctx DetectEngineCtx:: to be freed */ void DetectEngineCtxFree(DetectEngineCtx *de_ctx) { if (de_ctx == NULL) return; #ifdef PROFILING if (de_ctx->profile_ctx != NULL) { SCProfilingRuleDestroyCtx(de_ctx->profile_ctx); de_ctx->profile_ctx = NULL; } if (de_ctx->profile_keyword_ctx != NULL) { SCProfilingKeywordDestroyCtx(de_ctx);//->profile_keyword_ctx); // de_ctx->profile_keyword_ctx = NULL; } if (de_ctx->profile_sgh_ctx != NULL) { SCProfilingSghDestroyCtx(de_ctx); } #endif /* Normally the hashes are freed elsewhere, but * to be sure look at them again here. */ SigGroupHeadHashFree(de_ctx); MpmStoreFree(de_ctx); DetectParseDupSigHashFree(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); ThresholdContextDestroy(de_ctx); SigCleanSignatures(de_ctx); SCFree(de_ctx->app_mpms); de_ctx->app_mpms = NULL; VariableNameFreeHash(de_ctx); if (de_ctx->sig_array) SCFree(de_ctx->sig_array); SCClassConfDeInitContext(de_ctx); SCRConfDeInitContext(de_ctx); SigGroupCleanup(de_ctx); SpmDestroyGlobalThreadCtx(de_ctx->spm_global_thread_ctx); MpmFactoryDeRegisterAllMpmCtxProfiles(de_ctx); DetectEngineCtxFreeThreadKeywordData(de_ctx); SRepDestroy(de_ctx); DetectAddressMapFree(de_ctx); /* if we have a config prefix, remove the config from the tree */ if (strlen(de_ctx->config_prefix) > 0) { /* remove config */ ConfNode *node = ConfGetNode(de_ctx->config_prefix); if (node != NULL) { ConfNodeRemove(node); /* frees node */ } #if 0 ConfDump(); #endif } DetectPortCleanupList(de_ctx->tcp_whitelist); DetectPortCleanupList(de_ctx->udp_whitelist); SCFree(de_ctx); //DetectAddressGroupPrintMemory(); //DetectSigGroupPrintMemory(); //DetectPortPrintMemory(); } /** \brief Function that load DetectEngineCtx config for grouping sigs * used by the engine * \retval 0 if no config provided, 1 if config was provided * and loaded successfuly */ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx) { uint8_t profile = ENGINE_PROFILE_UNKNOWN; char *max_uniq_toclient_groups_str = NULL; char *max_uniq_toserver_groups_str = NULL; char *sgh_mpm_context = NULL; char *de_ctx_profile = NULL; (void)ConfGet("detect.profile", &de_ctx_profile); (void)ConfGet("detect.sgh-mpm-context", &sgh_mpm_context); ConfNode *de_ctx_custom = ConfGetNode("detect-engine"); ConfNode *opt = NULL; if (de_ctx_custom != NULL) { TAILQ_FOREACH(opt, &de_ctx_custom->head, next) { if (de_ctx_profile == NULL) { if (strcmp(opt->val, "profile") == 0) { de_ctx_profile = opt->head.tqh_first->val; } } if (sgh_mpm_context == NULL) { if (strcmp(opt->val, "sgh-mpm-context") == 0) { sgh_mpm_context = opt->head.tqh_first->val; } } } } if (de_ctx_profile != NULL) { if (strcmp(de_ctx_profile, "low") == 0) { profile = ENGINE_PROFILE_LOW; } else if (strcmp(de_ctx_profile, "medium") == 0) { profile = ENGINE_PROFILE_MEDIUM; } else if (strcmp(de_ctx_profile, "high") == 0) { profile = ENGINE_PROFILE_HIGH; } else if (strcmp(de_ctx_profile, "custom") == 0) { profile = ENGINE_PROFILE_CUSTOM; } SCLogDebug("Profile for detection engine groups is \"%s\"", de_ctx_profile); } else { SCLogDebug("Profile for detection engine groups not provided " "at suricata.yaml. Using default (\"medium\")."); } /* detect-engine.sgh-mpm-context option parsing */ if (sgh_mpm_context == NULL || strcmp(sgh_mpm_context, "auto") == 0) { /* for now, since we still haven't implemented any intelligence into * understanding the patterns and distributing mpm_ctx across sgh */ if (de_ctx->mpm_matcher == MPM_AC || de_ctx->mpm_matcher == MPM_AC_TILE || #ifdef BUILD_HYPERSCAN de_ctx->mpm_matcher == MPM_HS || #endif #ifdef __SC_CUDA_SUPPORT__ de_ctx->mpm_matcher == MPM_AC_BS || de_ctx->mpm_matcher == MPM_AC_CUDA) { #else de_ctx->mpm_matcher == MPM_AC_BS) { #endif de_ctx->sgh_mpm_context = ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE; } else { de_ctx->sgh_mpm_context = ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL; } } else { if (strcmp(sgh_mpm_context, "single") == 0) { de_ctx->sgh_mpm_context = ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE; } else if (strcmp(sgh_mpm_context, "full") == 0) { #ifdef __SC_CUDA_SUPPORT__ if (de_ctx->mpm_matcher == MPM_AC_CUDA) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "You can't use " "the cuda version of our mpm ac, i.e. \"ac-cuda\" " "along with \"full\" \"sgh-mpm-context\". " "Allowed values are \"single\" and \"auto\"."); exit(EXIT_FAILURE); } #endif de_ctx->sgh_mpm_context = ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL; } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "You have supplied an " "invalid conf value for detect-engine.sgh-mpm-context-" "%s", sgh_mpm_context); exit(EXIT_FAILURE); } } if (run_mode == RUNMODE_UNITTEST) { de_ctx->sgh_mpm_context = ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL; } /* parse profile custom-values */ opt = NULL; switch (profile) { case ENGINE_PROFILE_LOW: de_ctx->max_uniq_toclient_groups = 15; de_ctx->max_uniq_toserver_groups = 25; break; case ENGINE_PROFILE_HIGH: de_ctx->max_uniq_toclient_groups = 75; de_ctx->max_uniq_toserver_groups = 75; break; case ENGINE_PROFILE_CUSTOM: (void)ConfGet("detect.custom-values.toclient-groups", &max_uniq_toclient_groups_str); (void)ConfGet("detect.custom-values.toserver-groups", &max_uniq_toserver_groups_str); if (de_ctx_custom != NULL) { TAILQ_FOREACH(opt, &de_ctx_custom->head, next) { if (strcmp(opt->val, "custom-values") == 0) { if (max_uniq_toclient_groups_str == NULL) { max_uniq_toclient_groups_str = (char *)ConfNodeLookupChildValue (opt->head.tqh_first, "toclient-sp-groups"); } if (max_uniq_toclient_groups_str == NULL) { max_uniq_toclient_groups_str = (char *)ConfNodeLookupChildValue (opt->head.tqh_first, "toclient-groups"); } if (max_uniq_toserver_groups_str == NULL) { max_uniq_toserver_groups_str = (char *)ConfNodeLookupChildValue (opt->head.tqh_first, "toserver-dp-groups"); } if (max_uniq_toserver_groups_str == NULL) { max_uniq_toserver_groups_str = (char *)ConfNodeLookupChildValue (opt->head.tqh_first, "toserver-groups"); } } } } if (max_uniq_toclient_groups_str != NULL) { if (ByteExtractStringUint16(&de_ctx->max_uniq_toclient_groups, 10, strlen(max_uniq_toclient_groups_str), (const char *)max_uniq_toclient_groups_str) <= 0) { de_ctx->max_uniq_toclient_groups = 20; SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for " "toclient-groups failed, using %u", max_uniq_toclient_groups_str, de_ctx->max_uniq_toclient_groups); } } else { de_ctx->max_uniq_toclient_groups = 20; } SCLogConfig("toclient-groups %u", de_ctx->max_uniq_toclient_groups); if (max_uniq_toserver_groups_str != NULL) { if (ByteExtractStringUint16(&de_ctx->max_uniq_toserver_groups, 10, strlen(max_uniq_toserver_groups_str), (const char *)max_uniq_toserver_groups_str) <= 0) { de_ctx->max_uniq_toserver_groups = 40; SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for " "toserver-groups failed, using %u", max_uniq_toserver_groups_str, de_ctx->max_uniq_toserver_groups); } } else { de_ctx->max_uniq_toserver_groups = 40; } SCLogConfig("toserver-groups %u", de_ctx->max_uniq_toserver_groups); break; /* Default (or no config provided) is profile medium */ case ENGINE_PROFILE_MEDIUM: case ENGINE_PROFILE_UNKNOWN: default: de_ctx->max_uniq_toclient_groups = 20; de_ctx->max_uniq_toserver_groups = 40; break; } if (profile == ENGINE_PROFILE_UNKNOWN) { goto error; } intmax_t value = 0; if (ConfGetInt("detect.inspection-recursion-limit", &value) == 1) { if (value >= 0 && value <= INT_MAX) { de_ctx->inspection_recursion_limit = (int)value; } /* fall back to old config parsing */ } else { ConfNode *insp_recursion_limit_node = NULL; char *insp_recursion_limit = NULL; if (de_ctx_custom != NULL) { opt = NULL; TAILQ_FOREACH(opt, &de_ctx_custom->head, next) { if (strcmp(opt->val, "inspection-recursion-limit") != 0) continue; insp_recursion_limit_node = ConfNodeLookupChild(opt, opt->val); if (insp_recursion_limit_node == NULL) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Error retrieving conf " "entry for detect-engine:inspection-recursion-limit"); break; } insp_recursion_limit = insp_recursion_limit_node->val; SCLogDebug("Found detect-engine.inspection-recursion-limit - %s:%s", insp_recursion_limit_node->name, insp_recursion_limit_node->val); break; } if (insp_recursion_limit != NULL) { de_ctx->inspection_recursion_limit = atoi(insp_recursion_limit); } else { de_ctx->inspection_recursion_limit = DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT; } } } if (de_ctx->inspection_recursion_limit == 0) de_ctx->inspection_recursion_limit = -1; SCLogDebug("de_ctx->inspection_recursion_limit: %d", de_ctx->inspection_recursion_limit); /* parse port grouping whitelisting settings */ char *ports = NULL; (void)ConfGet("detect.grouping.tcp-whitelist", &ports); if (ports) { SCLogConfig("grouping: tcp-whitelist %s", ports); } else { ports = "53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080"; SCLogConfig("grouping: tcp-whitelist (default) %s", ports); } if (DetectPortParse(de_ctx, &de_ctx->tcp_whitelist, ports) != 0) { SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value " "for detect.grouping.tcp-whitelist", ports); } DetectPort *x = de_ctx->tcp_whitelist; for ( ; x != NULL; x = x->next) { if (x->port != x->port2) { SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value " "for detect.grouping.tcp-whitelist: only single ports allowed", ports); DetectPortCleanupList(de_ctx->tcp_whitelist); de_ctx->tcp_whitelist = NULL; break; } } ports = NULL; (void)ConfGet("detect.grouping.udp-whitelist", &ports); if (ports) { SCLogConfig("grouping: udp-whitelist %s", ports); } else { ports = "53, 135, 5060"; SCLogConfig("grouping: udp-whitelist (default) %s", ports); } if (DetectPortParse(de_ctx, &de_ctx->udp_whitelist, ports) != 0) { SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value " "forr detect.grouping.udp-whitelist", ports); } for (x = de_ctx->udp_whitelist; x != NULL; x = x->next) { if (x->port != x->port2) { SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value " "for detect.grouping.udp-whitelist: only single ports allowed", ports); DetectPortCleanupList(de_ctx->udp_whitelist); de_ctx->udp_whitelist = NULL; break; } } de_ctx->prefilter_setting = DETECT_PREFILTER_MPM; char *pf_setting = NULL; if (ConfGet("detect.prefilter.default", &pf_setting) == 1 && pf_setting) { if (strcasecmp(pf_setting, "mpm") == 0) { de_ctx->prefilter_setting = DETECT_PREFILTER_MPM; } else if (strcasecmp(pf_setting, "auto") == 0) { de_ctx->prefilter_setting = DETECT_PREFILTER_AUTO; } } switch (de_ctx->prefilter_setting) { case DETECT_PREFILTER_MPM: SCLogConfig("prefilter engines: MPM"); break; case DETECT_PREFILTER_AUTO: SCLogConfig("prefilter engines: MPM and keywords"); break; } return 0; error: return -1; } /* * getting & (re)setting the internal sig i */ //inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *de_ctx) //{ // return de_ctx->signum; //} void DetectEngineResetMaxSigId(DetectEngineCtx *de_ctx) { de_ctx->signum = 0; } static int DetectEngineThreadCtxInitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { if (de_ctx->keyword_id > 0) { det_ctx->keyword_ctxs_array = SCMalloc(de_ctx->keyword_id * sizeof(void *)); if (det_ctx->keyword_ctxs_array == NULL) { SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx"); return TM_ECODE_FAILED; } memset(det_ctx->keyword_ctxs_array, 0x00, de_ctx->keyword_id * sizeof(void *)); det_ctx->keyword_ctxs_size = de_ctx->keyword_id; DetectEngineThreadKeywordCtxItem *item = de_ctx->keyword_list; while (item) { det_ctx->keyword_ctxs_array[item->id] = item->InitFunc(item->data); if (det_ctx->keyword_ctxs_array[item->id] == NULL) { SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx " "for keyword \"%s\" failed", item->name); return TM_ECODE_FAILED; } item = item->next; } } return TM_ECODE_OK; } static void DetectEngineThreadCtxDeinitKeywords(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { if (de_ctx->keyword_id > 0) { DetectEngineThreadKeywordCtxItem *item = de_ctx->keyword_list; while (item) { if (det_ctx->keyword_ctxs_array[item->id] != NULL) item->FreeFunc(det_ctx->keyword_ctxs_array[item->id]); item = item->next; } det_ctx->keyword_ctxs_size = 0; SCFree(det_ctx->keyword_ctxs_array); det_ctx->keyword_ctxs_array = NULL; } } /** NOTE: master MUST be locked before calling this */ static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThreadCtx *det_ctx) { DetectEngineMasterCtx *master = &g_master_de_ctx; DetectEngineTenantMapping *map_array = NULL; uint32_t map_array_size = 0; uint32_t map_cnt = 0; int max_tenant_id = 0; DetectEngineCtx *list = master->list; HashTable *mt_det_ctxs_hash = NULL; if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) { SCLogError(SC_ERR_MT_NO_SELECTOR, "no tenant selector set: " "set using multi-detect.selector"); return TM_ECODE_FAILED; } uint32_t tcnt = 0; while (list) { if (list->tenant_id > max_tenant_id) max_tenant_id = list->tenant_id; list = list->next; tcnt++; } mt_det_ctxs_hash = HashTableInit(tcnt * 2, TenantIdHash, TenantIdCompare, TenantIdFree); if (mt_det_ctxs_hash == NULL) { goto error; } if (max_tenant_id == 0) { SCLogInfo("no tenants left, or none registered yet"); } else { max_tenant_id++; DetectEngineTenantMapping *map = master->tenant_mapping_list; while (map) { map_cnt++; map = map->next; } if (map_cnt > 0) { map_array_size = map_cnt + 1; map_array = SCCalloc(map_array_size, sizeof(*map_array)); if (map_array == NULL) goto error; /* fill the array */ map_cnt = 0; map = master->tenant_mapping_list; while (map) { if (map_cnt >= map_array_size) { goto error; } map_array[map_cnt].traffic_id = map->traffic_id; map_array[map_cnt].tenant_id = map->tenant_id; map_cnt++; map = map->next; } } /* set up hash for tenant lookup */ list = master->list; while (list) { SCLogDebug("tenant-id %u", list->tenant_id); if (list->tenant_id != 0) { DetectEngineThreadCtx *mt_det_ctx = DetectEngineThreadCtxInitForReload(tv, list, 0); if (mt_det_ctx == NULL) goto error; if (HashTableAdd(mt_det_ctxs_hash, mt_det_ctx, 0) != 0) { goto error; } } list = list->next; } } det_ctx->mt_det_ctxs_hash = mt_det_ctxs_hash; mt_det_ctxs_hash = NULL; det_ctx->mt_det_ctxs_cnt = max_tenant_id; det_ctx->tenant_array = map_array; det_ctx->tenant_array_size = map_array_size; switch (master->tenant_selector) { case TENANT_SELECTOR_UNKNOWN: SCLogDebug("TENANT_SELECTOR_UNKNOWN"); break; case TENANT_SELECTOR_VLAN: det_ctx->TenantGetId = DetectEngineTentantGetIdFromVlanId; SCLogDebug("TENANT_SELECTOR_VLAN"); break; case TENANT_SELECTOR_DIRECT: det_ctx->TenantGetId = DetectEngineTentantGetIdFromPcap; SCLogDebug("TENANT_SELECTOR_DIRECT"); break; } return TM_ECODE_OK; error: if (map_array != NULL) SCFree(map_array); if (mt_det_ctxs_hash != NULL) HashTableFree(mt_det_ctxs_hash); return TM_ECODE_FAILED; } /** \internal * \brief Helper for DetectThread setup functions */ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { PatternMatchThreadPrepare(&det_ctx->mtc, de_ctx->mpm_matcher); PatternMatchThreadPrepare(&det_ctx->mtcs, de_ctx->mpm_matcher); PatternMatchThreadPrepare(&det_ctx->mtcu, de_ctx->mpm_matcher); PmqSetup(&det_ctx->pmq); det_ctx->spm_thread_ctx = SpmMakeThreadCtx(de_ctx->spm_global_thread_ctx); if (det_ctx->spm_thread_ctx == NULL) { return TM_ECODE_FAILED; } /* sized to the max of our sgh settings. A max setting of 0 implies that all * sgh's have: sgh->non_pf_store_cnt == 0 */ if (de_ctx->non_pf_store_cnt_max > 0) { det_ctx->non_pf_id_array = SCCalloc(de_ctx->non_pf_store_cnt_max, sizeof(SigIntId)); BUG_ON(det_ctx->non_pf_id_array == NULL); } /* IP-ONLY */ DetectEngineIPOnlyThreadInit(de_ctx,&det_ctx->io_ctx); /* DeState */ if (de_ctx->sig_array_len > 0) { det_ctx->de_state_sig_array_len = de_ctx->sig_array_len; det_ctx->de_state_sig_array = SCMalloc(det_ctx->de_state_sig_array_len * sizeof(uint8_t)); if (det_ctx->de_state_sig_array == NULL) { return TM_ECODE_FAILED; } memset(det_ctx->de_state_sig_array, 0, det_ctx->de_state_sig_array_len * sizeof(uint8_t)); det_ctx->match_array_len = de_ctx->sig_array_len; det_ctx->match_array = SCMalloc(det_ctx->match_array_len * sizeof(Signature *)); if (det_ctx->match_array == NULL) { return TM_ECODE_FAILED; } memset(det_ctx->match_array, 0, det_ctx->match_array_len * sizeof(Signature *)); } /* byte_extract storage */ det_ctx->bj_values = SCMalloc(sizeof(*det_ctx->bj_values) * (de_ctx->byte_extract_max_local_id + 1)); if (det_ctx->bj_values == NULL) { return TM_ECODE_FAILED; } /* Allocate space for base64 decoded data. */ if (de_ctx->base64_decode_max_len) { det_ctx->base64_decoded = SCMalloc(de_ctx->base64_decode_max_len); if (det_ctx->base64_decoded == NULL) { return TM_ECODE_FAILED; } det_ctx->base64_decoded_len_max = de_ctx->base64_decode_max_len; det_ctx->base64_decoded_len = 0; } DetectEngineThreadCtxInitKeywords(de_ctx, det_ctx); #ifdef PROFILING SCProfilingRuleThreadSetup(de_ctx->profile_ctx, det_ctx); SCProfilingKeywordThreadSetup(de_ctx->profile_keyword_ctx, det_ctx); SCProfilingSghThreadSetup(de_ctx->profile_sgh_ctx, det_ctx); #endif SC_ATOMIC_INIT(det_ctx->so_far_used_by_detect); return TM_ECODE_OK; } /** \brief initialize thread specific detection engine context * * \note there is a special case when using delayed detect. In this case the * function is called twice per thread. The first time the rules are not * yet loaded. de_ctx->delayed_detect_initialized will be 0. The 2nd * time they will be loaded. de_ctx->delayed_detect_initialized will be 1. * This is needed to do the per thread counter registration before the * packet runtime starts. In delayed detect mode, the first call will * return a NULL ptr through the data ptr. * * \param tv ThreadVars for this thread * \param initdata pointer to de_ctx * \param data[out] pointer to store our thread detection ctx * * \retval TM_ECODE_OK if all went well * \retval TM_ECODE_FAILED on serious erro */ TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data) { /* first register the counter. In delayed detect mode we exit right after if the * rules haven't been loaded yet. */ uint16_t counter_alerts = StatsRegisterCounter("detect.alert", tv); #ifdef PROFILING uint16_t counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv); uint16_t counter_nonmpm_list = StatsRegisterAvgCounter("detect.nonmpm_list", tv); uint16_t counter_fnonmpm_list = StatsRegisterAvgCounter("detect.fnonmpm_list", tv); uint16_t counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv); #endif DetectEngineThreadCtx *det_ctx = SCMalloc(sizeof(DetectEngineThreadCtx)); if (unlikely(det_ctx == NULL)) return TM_ECODE_FAILED; memset(det_ctx, 0, sizeof(DetectEngineThreadCtx)); det_ctx->tv = tv; det_ctx->de_ctx = DetectEngineGetCurrent(); if (det_ctx->de_ctx == NULL) { #ifdef UNITTESTS if (RunmodeIsUnittests()) { det_ctx->de_ctx = (DetectEngineCtx *)initdata; } else { DetectEngineThreadCtxDeinit(tv, det_ctx); return TM_ECODE_FAILED; } #else DetectEngineThreadCtxDeinit(tv, det_ctx); return TM_ECODE_FAILED; #endif } if (det_ctx->de_ctx->minimal == 0) { if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) { DetectEngineThreadCtxDeinit(tv, det_ctx); return TM_ECODE_FAILED; } } /** alert counter setup */ det_ctx->counter_alerts = counter_alerts; #ifdef PROFILING det_ctx->counter_mpm_list = counter_mpm_list; det_ctx->counter_nonmpm_list = counter_nonmpm_list; det_ctx->counter_fnonmpm_list = counter_fnonmpm_list; det_ctx->counter_match_list = counter_match_list; #endif /* pass thread data back to caller */ *data = (void *)det_ctx; if (DetectEngineMultiTenantEnabled()) { if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) return TM_ECODE_FAILED; } return TM_ECODE_OK; } /** * \internal * \brief initialize a det_ctx for reload cases * \param new_de_ctx the new detection engine * \param mt flag to indicate if MT should be set up for this det_ctx * this should only be done for the 'root' det_ctx * * \retval det_ctx detection engine thread ctx or NULL in case of error */ static DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload( ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt) { DetectEngineThreadCtx *det_ctx = SCMalloc(sizeof(DetectEngineThreadCtx)); if (unlikely(det_ctx == NULL)) return NULL; memset(det_ctx, 0, sizeof(DetectEngineThreadCtx)); det_ctx->tenant_id = new_de_ctx->tenant_id; det_ctx->tv = tv; det_ctx->de_ctx = DetectEngineReference(new_de_ctx); if (det_ctx->de_ctx == NULL) { SCFree(det_ctx); return NULL; } /* most of the init happens here */ if (ThreadCtxDoInit(det_ctx->de_ctx, det_ctx) != TM_ECODE_OK) { DetectEngineDeReference(&det_ctx->de_ctx); SCFree(det_ctx); return NULL; } /** alert counter setup */ det_ctx->counter_alerts = StatsRegisterCounter("detect.alert", tv); #ifdef PROFILING uint16_t counter_mpm_list = StatsRegisterAvgCounter("detect.mpm_list", tv); uint16_t counter_nonmpm_list = StatsRegisterAvgCounter("detect.nonmpm_list", tv); uint16_t counter_fnonmpm_list = StatsRegisterAvgCounter("detect.fnonmpm_list", tv); uint16_t counter_match_list = StatsRegisterAvgCounter("detect.match_list", tv); det_ctx->counter_mpm_list = counter_mpm_list; det_ctx->counter_nonmpm_list = counter_nonmpm_list; det_ctx->counter_fnonmpm_list = counter_fnonmpm_list; det_ctx->counter_match_list = counter_match_list; #endif if (mt && DetectEngineMultiTenantEnabled()) { if (DetectEngineThreadCtxInitForMT(tv, det_ctx) != TM_ECODE_OK) { DetectEngineDeReference(&det_ctx->de_ctx); SCFree(det_ctx); return NULL; } } return det_ctx; } void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx) { int i; if (det_ctx->tenant_array != NULL) { SCFree(det_ctx->tenant_array); det_ctx->tenant_array = NULL; } #ifdef PROFILING SCProfilingRuleThreadCleanup(det_ctx); SCProfilingKeywordThreadCleanup(det_ctx); SCProfilingSghThreadCleanup(det_ctx); #endif DetectEngineIPOnlyThreadDeinit(&det_ctx->io_ctx); /** \todo get rid of this static */ if (det_ctx->de_ctx != NULL) { PatternMatchThreadDestroy(&det_ctx->mtc, det_ctx->de_ctx->mpm_matcher); PatternMatchThreadDestroy(&det_ctx->mtcs, det_ctx->de_ctx->mpm_matcher); PatternMatchThreadDestroy(&det_ctx->mtcu, det_ctx->de_ctx->mpm_matcher); } PmqFree(&det_ctx->pmq); if (det_ctx->spm_thread_ctx != NULL) { SpmDestroyThreadCtx(det_ctx->spm_thread_ctx); } if (det_ctx->non_pf_id_array != NULL) SCFree(det_ctx->non_pf_id_array); if (det_ctx->de_state_sig_array != NULL) SCFree(det_ctx->de_state_sig_array); if (det_ctx->match_array != NULL) SCFree(det_ctx->match_array); if (det_ctx->bj_values != NULL) SCFree(det_ctx->bj_values); /* HHD temp storage */ for (i = 0; i < det_ctx->hhd_buffers_size; i++) { if (det_ctx->hhd_buffers[i] != NULL) SCFree(det_ctx->hhd_buffers[i]); } if (det_ctx->hhd_buffers) SCFree(det_ctx->hhd_buffers); det_ctx->hhd_buffers = NULL; if (det_ctx->hhd_buffers_len) SCFree(det_ctx->hhd_buffers_len); det_ctx->hhd_buffers_len = NULL; /* HSBD */ if (det_ctx->hsbd != NULL) { SCLogDebug("det_ctx hsbd %u", det_ctx->hsbd_buffers_size); SCFree(det_ctx->hsbd); } /* HSCB */ if (det_ctx->hcbd != NULL) { SCLogDebug("det_ctx hcbd %u", det_ctx->hcbd_buffers_size); SCFree(det_ctx->hcbd); } /* SMTP */ if (det_ctx->smtp != NULL) { SCLogDebug("det_ctx smtp %u", det_ctx->smtp_buffers_size); SCFree(det_ctx->smtp); } /* Decoded base64 data. */ if (det_ctx->base64_decoded != NULL) { SCFree(det_ctx->base64_decoded); } if (det_ctx->de_ctx != NULL) { DetectEngineThreadCtxDeinitKeywords(det_ctx->de_ctx, det_ctx); #ifdef UNITTESTS if (!RunmodeIsUnittests() || det_ctx->de_ctx->ref_cnt > 0) DetectEngineDeReference(&det_ctx->de_ctx); #else DetectEngineDeReference(&det_ctx->de_ctx); #endif } SCFree(det_ctx); } TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data) { DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data; if (det_ctx == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "argument \"data\" NULL"); return TM_ECODE_OK; } if (det_ctx->mt_det_ctxs_hash != NULL) { HashTableFree(det_ctx->mt_det_ctxs_hash); det_ctx->mt_det_ctxs_hash = NULL; } DetectEngineThreadCtxFree(det_ctx); return TM_ECODE_OK; } void DetectEngineThreadCtxInfo(ThreadVars *t, DetectEngineThreadCtx *det_ctx) { /* XXX */ PatternMatchThreadPrint(&det_ctx->mtc, det_ctx->de_ctx->mpm_matcher); PatternMatchThreadPrint(&det_ctx->mtcu, det_ctx->de_ctx->mpm_matcher); } /** \brief Register Thread keyword context Funcs * * \param de_ctx detection engine to register in * \param name keyword name for error printing * \param InitFunc function ptr * \param data keyword init data to pass to Func * \param FreeFunc function ptr * \param mode 0 normal (ctx per keyword instance) 1 shared (one ctx per det_ct) * * \retval id for retrieval of ctx at runtime * \retval -1 on error * * \note make sure "data" remains valid and it free'd elsewhere. It's * recommended to store it in the keywords global ctx so that * it's freed when the de_ctx is freed. */ int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void (*FreeFunc)(void *), int mode) { BUG_ON(de_ctx == NULL || InitFunc == NULL || FreeFunc == NULL || data == NULL); if (mode) { DetectEngineThreadKeywordCtxItem *item = de_ctx->keyword_list; while (item != NULL) { if (strcmp(name, item->name) == 0) { return item->id; } item = item->next; } } DetectEngineThreadKeywordCtxItem *item = SCMalloc(sizeof(DetectEngineThreadKeywordCtxItem)); if (unlikely(item == NULL)) return -1; memset(item, 0x00, sizeof(DetectEngineThreadKeywordCtxItem)); item->InitFunc = InitFunc; item->FreeFunc = FreeFunc; item->data = data; item->name = name; item->next = de_ctx->keyword_list; de_ctx->keyword_list = item; item->id = de_ctx->keyword_id++; return item->id; } /** \brief Retrieve thread local keyword ctx by id * * \param det_ctx detection engine thread ctx to retrieve the ctx from * \param id id of the ctx returned by DetectRegisterThreadCtxInitFunc at * keyword init. * * \retval ctx or NULL on error */ void *DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id) { if (id < 0 || id > det_ctx->keyword_ctxs_size || det_ctx->keyword_ctxs_array == NULL) return NULL; return det_ctx->keyword_ctxs_array[id]; } /** \brief Check if detection is enabled * \retval bool true or false */ int DetectEngineEnabled(void) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (master->list == NULL) { SCMutexUnlock(&master->lock); return 0; } SCMutexUnlock(&master->lock); return 1; } DetectEngineCtx *DetectEngineGetCurrent(void) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (master->list == NULL) { SCMutexUnlock(&master->lock); return NULL; } master->list->ref_cnt++; SCLogDebug("master->list %p ref_cnt %u", master->list, master->list->ref_cnt); SCMutexUnlock(&master->lock); return master->list; } DetectEngineCtx *DetectEngineReference(DetectEngineCtx *de_ctx) { if (de_ctx == NULL) return NULL; de_ctx->ref_cnt++; return de_ctx; } /** TODO locking? Not needed if this is a one time setting at startup */ int DetectEngineMultiTenantEnabled(void) { DetectEngineMasterCtx *master = &g_master_de_ctx; return (master->multi_tenant_enabled); } /** \internal * \brief load a tenant from a yaml file * * \param tenant_id the tenant id by which the config is known * \param filename full path of a yaml file * \param loader_id id of loader thread or -1 * * \retval 0 ok * \retval -1 failed */ static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *filename, int loader_id) { DetectEngineCtx *de_ctx = NULL; char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d", tenant_id); #ifdef OS_WIN32 struct _stat st; if(_stat(filename, &st) != 0) { #else struct stat st; if(stat(filename, &st) != 0) { #endif /* OS_WIN32 */ SCLogError(SC_ERR_FOPEN, "failed to stat file %s", filename); goto error; } de_ctx = DetectEngineGetByTenantId(tenant_id); if (de_ctx != NULL) { SCLogError(SC_ERR_MT_DUPLICATE_TENANT, "tenant %u already registered", tenant_id); DetectEngineDeReference(&de_ctx); goto error; } ConfNode *node = ConfGetNode(prefix); if (node == NULL) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s", filename); goto error; } de_ctx = DetectEngineCtxInitWithPrefix(prefix); if (de_ctx == NULL) { SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine " "context failed."); goto error; } SCLogDebug("de_ctx %p with prefix %s", de_ctx, de_ctx->config_prefix); de_ctx->tenant_id = tenant_id; de_ctx->loader_id = loader_id; if (SigLoadSignatures(de_ctx, NULL, 0) < 0) { SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed."); goto error; } DetectEngineAddToMaster(de_ctx); return 0; error: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return -1; } static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *filename, int reload_cnt) { DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id); if (old_de_ctx == NULL) { SCLogError(SC_ERR_INITIALIZATION, "tenant detect engine not found"); return -1; } char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d.reload.%d", tenant_id, reload_cnt); reload_cnt++; SCLogDebug("prefix %s", prefix); if (ConfYamlLoadFileWithPrefix(filename, prefix) != 0) { SCLogError(SC_ERR_INITIALIZATION,"failed to load yaml"); goto error; } ConfNode *node = ConfGetNode(prefix); if (node == NULL) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s", filename); goto error; } DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix); if (new_de_ctx == NULL) { SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine " "context failed."); goto error; } SCLogDebug("de_ctx %p with prefix %s", new_de_ctx, new_de_ctx->config_prefix); new_de_ctx->tenant_id = tenant_id; new_de_ctx->loader_id = old_de_ctx->loader_id; if (SigLoadSignatures(new_de_ctx, NULL, 0) < 0) { SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed."); goto error; } DetectEngineAddToMaster(new_de_ctx); /* move to free list */ DetectEngineMoveToFreeList(old_de_ctx); DetectEngineDeReference(&old_de_ctx); return 0; error: DetectEngineDeReference(&old_de_ctx); return -1; } typedef struct TenantLoaderCtx_ { uint32_t tenant_id; int reload_cnt; /**< used by reload */ const char *yaml; } TenantLoaderCtx; static int DetectLoaderFuncLoadTenant(void *vctx, int loader_id) { TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx; SCLogDebug("loader %d", loader_id); if (DetectEngineMultiTenantLoadTenant(ctx->tenant_id, ctx->yaml, loader_id) != 0) { return -1; } return 0; } int DetectLoaderSetupLoadTenant(uint32_t tenant_id, const char *yaml) { TenantLoaderCtx *t = SCCalloc(1, sizeof(*t)); if (t == NULL) return -ENOMEM; t->tenant_id = tenant_id; t->yaml = yaml; return DetectLoaderQueueTask(-1, DetectLoaderFuncLoadTenant, t); } static int DetectLoaderFuncReloadTenant(void *vctx, int loader_id) { TenantLoaderCtx *ctx = (TenantLoaderCtx *)vctx; SCLogDebug("loader_id %d", loader_id); if (DetectEngineMultiTenantReloadTenant(ctx->tenant_id, ctx->yaml, ctx->reload_cnt) != 0) { return -1; } return 0; } int DetectLoaderSetupReloadTenant(uint32_t tenant_id, const char *yaml, int reload_cnt) { DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id); if (old_de_ctx == NULL) return -ENOENT; int loader_id = old_de_ctx->loader_id; DetectEngineDeReference(&old_de_ctx); TenantLoaderCtx *t = SCCalloc(1, sizeof(*t)); if (t == NULL) return -ENOMEM; t->tenant_id = tenant_id; t->yaml = yaml; t->reload_cnt = reload_cnt; SCLogDebug("loader_id %d", loader_id); return DetectLoaderQueueTask(loader_id, DetectLoaderFuncReloadTenant, t); } /** \brief Load a tenant and wait for loading to complete */ int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml) { int r = DetectLoaderSetupLoadTenant(tenant_id, yaml); if (r < 0) return r; if (DetectLoadersSync() != 0) return -1; return 0; } /** \brief Reload a tenant and wait for loading to complete */ int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt) { int r = DetectLoaderSetupReloadTenant(tenant_id, yaml, reload_cnt); if (r < 0) return r; if (DetectLoadersSync() != 0) return -1; return 0; } /** * \brief setup multi-detect / multi-tenancy * * See if MT is enabled. If so, setup the selector, tenants and mappings. * Tenants and mappings are optional, and can also dynamically be added * and removed from the unix socket. */ int DetectEngineMultiTenantSetup(void) { enum DetectEngineTenantSelectors tenant_selector = TENANT_SELECTOR_UNKNOWN; DetectEngineMasterCtx *master = &g_master_de_ctx; int unix_socket = ConfUnixSocketIsEnable(); int failure_fatal = 0; (void)ConfGetBool("engine.init-failure-fatal", &failure_fatal); int enabled = 0; (void)ConfGetBool("multi-detect.enabled", &enabled); if (enabled == 1) { DetectLoadersInit(); TmModuleDetectLoaderRegister(); DetectLoaderThreadSpawn(); TmThreadContinueDetectLoaderThreads(); SCMutexLock(&master->lock); master->multi_tenant_enabled = 1; char *handler = NULL; if (ConfGet("multi-detect.selector", &handler) == 1) { SCLogConfig("multi-tenant selector type %s", handler); if (strcmp(handler, "vlan") == 0) { tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN; int vlanbool = 0; if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) { SCLogError(SC_ERR_INVALID_VALUE, "vlan tracking is disabled, " "can't use multi-detect selector 'vlan'"); SCMutexUnlock(&master->lock); goto error; } } else if (strcmp(handler, "direct") == 0) { tenant_selector = master->tenant_selector = TENANT_SELECTOR_DIRECT; } else { SCLogError(SC_ERR_INVALID_VALUE, "unknown value %s " "multi-detect.selector", handler); SCMutexUnlock(&master->lock); goto error; } } SCMutexUnlock(&master->lock); SCLogConfig("multi-detect is enabled (multi tenancy). Selector: %s", handler); /* traffic -- tenant mappings */ ConfNode *mappings_root_node = ConfGetNode("multi-detect.mappings"); ConfNode *mapping_node = NULL; int mapping_cnt = 0; if (mappings_root_node != NULL) { TAILQ_FOREACH(mapping_node, &mappings_root_node->head, next) { ConfNode *tenant_id_node = ConfNodeLookupChild(mapping_node, "tenant-id"); if (tenant_id_node == NULL) goto bad_mapping; ConfNode *vlan_id_node = ConfNodeLookupChild(mapping_node, "vlan-id"); if (vlan_id_node == NULL) goto bad_mapping; uint32_t tenant_id = 0; if (ByteExtractStringUint32(&tenant_id, 10, strlen(tenant_id_node->val), tenant_id_node->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant-id " "of %s is invalid", tenant_id_node->val); goto bad_mapping; } uint16_t vlan_id = 0; if (ByteExtractStringUint16(&vlan_id, 10, strlen(vlan_id_node->val), vlan_id_node->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "vlan-id " "of %s is invalid", vlan_id_node->val); goto bad_mapping; } if (vlan_id == 0 || vlan_id >= 4095) { SCLogError(SC_ERR_INVALID_ARGUMENT, "vlan-id " "of %s is invalid. Valid range 1-4094.", vlan_id_node->val); goto bad_mapping; } if (DetectEngineTentantRegisterVlanId(tenant_id, (uint32_t)vlan_id) != 0) { goto error; } SCLogConfig("vlan %u connected to tenant-id %u", vlan_id, tenant_id); mapping_cnt++; continue; bad_mapping: if (failure_fatal) goto error; } } if (tenant_selector == TENANT_SELECTOR_VLAN && mapping_cnt == 0) { /* no mappings are valid when we're in unix socket mode, * they can be added on the fly. Otherwise warn/error * depending on failure_fatal */ if (unix_socket) { SCLogNotice("no tenant traffic mappings defined, " "tenants won't be used until mappings are added"); } else { if (failure_fatal) { SCLogError(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined"); goto error; } else { SCLogWarning(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined"); } } } /* tenants */ ConfNode *tenants_root_node = ConfGetNode("multi-detect.tenants"); ConfNode *tenant_node = NULL; if (tenants_root_node != NULL) { TAILQ_FOREACH(tenant_node, &tenants_root_node->head, next) { ConfNode *id_node = ConfNodeLookupChild(tenant_node, "id"); if (id_node == NULL) { goto bad_tenant; } ConfNode *yaml_node = ConfNodeLookupChild(tenant_node, "yaml"); if (yaml_node == NULL) { goto bad_tenant; } uint32_t tenant_id = 0; if (ByteExtractStringUint32(&tenant_id, 10, strlen(id_node->val), id_node->val) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant_id " "of %s is invalid", id_node->val); goto bad_tenant; } SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val); /* setup the yaml in this loop so that it's not done by the loader * threads. ConfYamlLoadFileWithPrefix is not thread safe. */ char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d", tenant_id); if (ConfYamlLoadFileWithPrefix(yaml_node->val, prefix) != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to load yaml %s", yaml_node->val); goto bad_tenant; } int r = DetectLoaderSetupLoadTenant(tenant_id, yaml_node->val); if (r < 0) { /* error logged already */ goto bad_tenant; } continue; bad_tenant: if (failure_fatal) goto error; } } /* wait for our loaders to complete their tasks */ if (DetectLoadersSync() != 0) { goto error; } } else { SCLogDebug("multi-detect not enabled (multi tenancy)"); } return 0; error: return -1; } static uint32_t DetectEngineTentantGetIdFromVlanId(const void *ctx, const Packet *p) { const DetectEngineThreadCtx *det_ctx = ctx; uint32_t x = 0; uint32_t vlan_id = 0; if (p->vlan_idx == 0) return 0; vlan_id = p->vlan_id[0]; if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0) return 0; /* not very efficient, but for now we're targeting only limited amounts. * Can use hash/tree approach later. */ for (x = 0; x < det_ctx->tenant_array_size; x++) { if (det_ctx->tenant_array[x].traffic_id == vlan_id) return det_ctx->tenant_array[x].tenant_id; } return 0; } static int DetectEngineTentantRegisterSelector(enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (!(master->tenant_selector == TENANT_SELECTOR_UNKNOWN || master->tenant_selector == selector)) { SCLogInfo("conflicting selector already set"); SCMutexUnlock(&master->lock); return -1; } DetectEngineTenantMapping *m = master->tenant_mapping_list; while (m) { if (m->traffic_id == traffic_id) { SCLogInfo("traffic id already registered"); SCMutexUnlock(&master->lock); return -1; } m = m->next; } DetectEngineTenantMapping *map = SCCalloc(1, sizeof(*map)); if (map == NULL) { SCLogInfo("memory fail"); SCMutexUnlock(&master->lock); return -1; } map->traffic_id = traffic_id; map->tenant_id = tenant_id; map->next = master->tenant_mapping_list; master->tenant_mapping_list = map; master->tenant_selector = selector; SCLogDebug("tenant handler %u %u %u registered", selector, tenant_id, traffic_id); SCMutexUnlock(&master->lock); return 0; } static int DetectEngineTentantUnregisterSelector(enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (master->tenant_mapping_list == NULL) { SCMutexUnlock(&master->lock); return -1; } DetectEngineTenantMapping *prev = NULL; DetectEngineTenantMapping *map = master->tenant_mapping_list; while (map) { if (map->traffic_id == traffic_id && map->tenant_id == tenant_id) { if (prev != NULL) prev->next = map->next; else master->tenant_mapping_list = map->next; map->next = NULL; SCFree(map); SCLogInfo("tenant handler %u %u %u unregistered", selector, tenant_id, traffic_id); SCMutexUnlock(&master->lock); return 0; } prev = map; map = map->next; } SCMutexUnlock(&master->lock); return -1; } int DetectEngineTentantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id) { return DetectEngineTentantRegisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id); } int DetectEngineTentantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id) { return DetectEngineTentantUnregisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id); } int DetectEngineTentantRegisterPcapFile(uint32_t tenant_id) { SCLogInfo("registering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id); return DetectEngineTentantRegisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0); } int DetectEngineTentantUnregisterPcapFile(uint32_t tenant_id) { SCLogInfo("unregistering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id); return DetectEngineTentantUnregisterSelector(TENANT_SELECTOR_DIRECT, tenant_id, 0); } static uint32_t DetectEngineTentantGetIdFromPcap(const void *ctx, const Packet *p) { return p->pcap_v.tenant_id; } DetectEngineCtx *DetectEngineGetByTenantId(int tenant_id) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (master->list == NULL) { SCMutexUnlock(&master->lock); return NULL; } DetectEngineCtx *de_ctx = master->list; while (de_ctx) { if (de_ctx->tenant_id == tenant_id) { de_ctx->ref_cnt++; break; } de_ctx = de_ctx->next; } SCMutexUnlock(&master->lock); return de_ctx; } void DetectEngineDeReference(DetectEngineCtx **de_ctx) { BUG_ON((*de_ctx)->ref_cnt == 0); (*de_ctx)->ref_cnt--; *de_ctx = NULL; } static int DetectEngineAddToList(DetectEngineCtx *instance) { DetectEngineMasterCtx *master = &g_master_de_ctx; if (instance == NULL) return -1; if (master->list == NULL) { master->list = instance; } else { instance->next = master->list; master->list = instance; } return 0; } int DetectEngineAddToMaster(DetectEngineCtx *de_ctx) { int r; if (de_ctx == NULL) return -1; SCLogDebug("adding de_ctx %p to master", de_ctx); DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); r = DetectEngineAddToList(de_ctx); SCMutexUnlock(&master->lock); return r; } int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); DetectEngineCtx *instance = master->list; if (instance == NULL) { SCMutexUnlock(&master->lock); return -1; } /* remove from active list */ if (instance == de_ctx) { master->list = instance->next; } else { DetectEngineCtx *prev = instance; instance = instance->next; /* already checked first element */ while (instance) { DetectEngineCtx *next = instance->next; if (instance == de_ctx) { prev->next = instance->next; break; } prev = instance; instance = next; } if (instance == NULL) { SCMutexUnlock(&master->lock); return -1; } } /* instance is now detached from list */ instance->next = NULL; /* add to free list */ if (master->free_list == NULL) { master->free_list = instance; } else { instance->next = master->free_list; master->free_list = instance; } SCLogDebug("detect engine %p moved to free list (%u refs)", de_ctx, de_ctx->ref_cnt); SCMutexUnlock(&master->lock); return 0; } void DetectEnginePruneFreeList(void) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); DetectEngineCtx *prev = NULL; DetectEngineCtx *instance = master->free_list; while (instance) { DetectEngineCtx *next = instance->next; SCLogDebug("detect engine %p has %u ref(s)", instance, instance->ref_cnt); if (instance->ref_cnt == 0) { if (prev == NULL) { master->free_list = next; } else { prev->next = next; } SCLogDebug("freeing detect engine %p", instance); DetectEngineCtxFree(instance); instance = NULL; } prev = instance; instance = next; } SCMutexUnlock(&master->lock); } static int reloads = 0; /** \brief Reload the detection engine * * \param filename YAML file to load for the detect config * * \retval -1 error * \retval 0 ok */ int DetectEngineReload(SCInstance *suri) { DetectEngineCtx *new_de_ctx = NULL; DetectEngineCtx *old_de_ctx = NULL; char prefix[128]; memset(prefix, 0, sizeof(prefix)); SCLogNotice("rule reload starting"); if (suri->conf_filename != NULL) { snprintf(prefix, sizeof(prefix), "detect-engine-reloads.%d", reloads++); if (ConfYamlLoadFileWithPrefix(suri->conf_filename, prefix) != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to load yaml %s", suri->conf_filename); return -1; } ConfNode *node = ConfGetNode(prefix); if (node == NULL) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s", suri->conf_filename); return -1; } #if 0 ConfDump(); #endif } /* get a reference to the current de_ctx */ old_de_ctx = DetectEngineGetCurrent(); if (old_de_ctx == NULL) return -1; SCLogDebug("get ref to old_de_ctx %p", old_de_ctx); /* get new detection engine */ new_de_ctx = DetectEngineCtxInitWithPrefix(prefix); if (new_de_ctx == NULL) { SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine " "context failed."); DetectEngineDeReference(&old_de_ctx); return -1; } if (SigLoadSignatures(new_de_ctx, suri->sig_file, suri->sig_file_exclusive) != 0) { DetectEngineCtxFree(new_de_ctx); DetectEngineDeReference(&old_de_ctx); return -1; } SCThresholdConfInitContext(new_de_ctx, NULL); SCLogDebug("set up new_de_ctx %p", new_de_ctx); /* add to master */ DetectEngineAddToMaster(new_de_ctx); /* move to old free list */ DetectEngineMoveToFreeList(old_de_ctx); DetectEngineDeReference(&old_de_ctx); SCLogDebug("going to reload the threads to use new_de_ctx %p", new_de_ctx); /* update the threads */ DetectEngineReloadThreads(new_de_ctx); SCLogDebug("threads now run new_de_ctx %p", new_de_ctx); /* walk free list, freeing the old_de_ctx */ DetectEnginePruneFreeList(); SCLogDebug("old_de_ctx should have been freed"); SCLogNotice("rule reload complete"); return 0; } static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len) { DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data; return det_ctx->tenant_id % h->array_size; } static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len) { DetectEngineThreadCtx *det1 = (DetectEngineThreadCtx *)d1; DetectEngineThreadCtx *det2 = (DetectEngineThreadCtx *)d2; return (det1->tenant_id == det2->tenant_id); } static void TenantIdFree(void *d) { DetectEngineThreadCtxFree(d); } int DetectEngineMTApply(void) { DetectEngineMasterCtx *master = &g_master_de_ctx; SCMutexLock(&master->lock); if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) { SCLogInfo("error, no tenant selector"); SCMutexUnlock(&master->lock); return -1; } DetectEngineCtx *minimal_de_ctx = NULL; /* if we have no tenants, we need a minimal one */ if (master->list == NULL) { minimal_de_ctx = master->list = DetectEngineCtxInitMinimal(); SCLogDebug("no tenants, using minimal %p", minimal_de_ctx); } else if (master->list->next == NULL && master->list->tenant_id == 0) { minimal_de_ctx = master->list; SCLogDebug("no tenants, using original %p", minimal_de_ctx); /* the default de_ctx should be in the list with tenant_id 0 */ } else { DetectEngineCtx *list = master->list; for ( ; list != NULL; list = list->next) { SCLogDebug("list %p tenant %u", list, list->tenant_id); if (list->tenant_id == 0) { minimal_de_ctx = list; break; } } } /* update the threads */ SCLogDebug("MT reload starting"); DetectEngineReloadThreads(minimal_de_ctx); SCLogDebug("MT reload done"); SCMutexUnlock(&master->lock); /* walk free list, freeing the old_de_ctx */ DetectEnginePruneFreeList(); SCLogDebug("old_de_ctx should have been freed"); return 0; } const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type) { switch (type) { case DETECT_SM_LIST_MATCH: return "packet"; case DETECT_SM_LIST_PMATCH: return "packet/stream payload"; case DETECT_SM_LIST_UMATCH: return "http uri"; case DETECT_SM_LIST_HRUDMATCH: return "http raw uri"; case DETECT_SM_LIST_HCBDMATCH: return "http client body"; case DETECT_SM_LIST_FILEDATA: return "http server body"; case DETECT_SM_LIST_HHDMATCH: return "http headers"; case DETECT_SM_LIST_HRHDMATCH: return "http raw headers"; case DETECT_SM_LIST_HSMDMATCH: return "http stat msg"; case DETECT_SM_LIST_HSCDMATCH: return "http stat code"; case DETECT_SM_LIST_HHHDMATCH: return "http host"; case DETECT_SM_LIST_HRHHDMATCH: return "http raw host header"; case DETECT_SM_LIST_HMDMATCH: return "http method"; case DETECT_SM_LIST_HCDMATCH: return "http cookie"; case DETECT_SM_LIST_HUADMATCH: return "http user-agent"; case DETECT_SM_LIST_HTTP_REQLINEMATCH: return "http request line"; case DETECT_SM_LIST_HTTP_RESLINEMATCH: return "http response line"; case DETECT_SM_LIST_APP_EVENT: return "app layer events"; case DETECT_SM_LIST_AMATCH: return "generic app layer"; case DETECT_SM_LIST_DMATCH: return "dcerpc"; case DETECT_SM_LIST_TMATCH: return "tag"; case DETECT_SM_LIST_FILEMATCH: return "file"; case DETECT_SM_LIST_DNSQUERYNAME_MATCH: return "dns query name"; case DETECT_SM_LIST_DNSREQUEST_MATCH: return "dns request"; case DETECT_SM_LIST_DNSRESPONSE_MATCH: return "dns response"; case DETECT_SM_LIST_TLSSNI_MATCH: return "tls sni extension"; case DETECT_SM_LIST_TLSISSUER_MATCH: return "tls issuer"; case DETECT_SM_LIST_TLSSUBJECT_MATCH: return "tls subject"; case DETECT_SM_LIST_TLSVALIDITY_MATCH: return "tls validity"; case DETECT_SM_LIST_MODBUS_MATCH: return "modbus"; case DETECT_SM_LIST_DNP3_DATA_MATCH: return "dnp3_data"; case DETECT_SM_LIST_DNP3_MATCH: return "dnp3"; case DETECT_SM_LIST_CIP_MATCH: return "cip"; case DETECT_SM_LIST_ENIP_MATCH: return "enip"; case DETECT_SM_LIST_BASE64_DATA: return "base64_data"; case DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH: return "template_buffer"; case DETECT_SM_LIST_POSTMATCH: return "post-match"; case DETECT_SM_LIST_SUPPRESS: return "suppress"; case DETECT_SM_LIST_THRESHOLD: return "threshold"; case DETECT_SM_LIST_MAX: return "max (internal)"; case DETECT_SM_LIST_NOTSET: return "not set (internal)"; } return "error"; } /*************************************Unittest*********************************/ #ifdef UNITTESTS static int DetectEngineInitYamlConf(char *conf) { ConfCreateContextBackup(); ConfInit(); return ConfYamlLoadString(conf, strlen(conf)); } static void DetectEngineDeInitYamlConf(void) { ConfDeInit(); ConfRestoreContextBackup(); return; } static int DetectEngineTest01(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: medium\n" " - custom-values:\n" " toclient_src_groups: 2\n" " toclient_dst_groups: 2\n" " toclient_sp_groups: 2\n" " toclient_dp_groups: 3\n" " toserver_src_groups: 2\n" " toserver_dst_groups: 4\n" " toserver_sp_groups: 2\n" " toserver_dp_groups: 25\n" " - inspection-recursion-limit: 0\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; result = (de_ctx->inspection_recursion_limit == -1); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } static int DetectEngineTest02(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: medium\n" " - custom-values:\n" " toclient_src_groups: 2\n" " toclient_dst_groups: 2\n" " toclient_sp_groups: 2\n" " toclient_dp_groups: 3\n" " toserver_src_groups: 2\n" " toserver_dst_groups: 4\n" " toserver_sp_groups: 2\n" " toserver_dp_groups: 25\n" " - inspection-recursion-limit:\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; result = (de_ctx->inspection_recursion_limit == -1); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } static int DetectEngineTest03(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: medium\n" " - custom-values:\n" " toclient_src_groups: 2\n" " toclient_dst_groups: 2\n" " toclient_sp_groups: 2\n" " toclient_dp_groups: 3\n" " toserver_src_groups: 2\n" " toserver_dst_groups: 4\n" " toserver_sp_groups: 2\n" " toserver_dp_groups: 25\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; result = (de_ctx->inspection_recursion_limit == DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } static int DetectEngineTest04(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: medium\n" " - custom-values:\n" " toclient_src_groups: 2\n" " toclient_dst_groups: 2\n" " toclient_sp_groups: 2\n" " toclient_dp_groups: 3\n" " toserver_src_groups: 2\n" " toserver_dst_groups: 4\n" " toserver_sp_groups: 2\n" " toserver_dp_groups: 25\n" " - inspection-recursion-limit: 10\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; result = (de_ctx->inspection_recursion_limit == 10); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } static int DetectEngineTest08(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: custom\n" " - custom-values:\n" " toclient-groups: 23\n" " toserver-groups: 27\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (de_ctx->max_uniq_toclient_groups == 23 && de_ctx->max_uniq_toserver_groups == 27) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } /** \test bug 892 bad values */ static int DetectEngineTest09(void) { char *conf = "%YAML 1.1\n" "---\n" "detect-engine:\n" " - profile: custom\n" " - custom-values:\n" " toclient-groups: BA\n" " toserver-groups: BA\n" " - inspection-recursion-limit: 10\n"; DetectEngineCtx *de_ctx = NULL; int result = 0; if (DetectEngineInitYamlConf(conf) == -1) return 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (de_ctx->max_uniq_toclient_groups == 20 && de_ctx->max_uniq_toserver_groups == 40) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); DetectEngineDeInitYamlConf(); return result; } #endif void DetectEngineRegisterTests() { #ifdef UNITTESTS UtRegisterTest("DetectEngineTest01", DetectEngineTest01); UtRegisterTest("DetectEngineTest02", DetectEngineTest02); UtRegisterTest("DetectEngineTest03", DetectEngineTest03); UtRegisterTest("DetectEngineTest04", DetectEngineTest04); UtRegisterTest("DetectEngineTest08", DetectEngineTest08); UtRegisterTest("DetectEngineTest09", DetectEngineTest09); #endif return; } suricata-3.2.1/src/source-pcap.h0000644000000000000000000000351213051004444013374 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __SOURCE_PCAP_H__ #define __SOURCE_PCAP_H__ void TmModuleReceivePcapRegister (void); void TmModuleDecodePcapRegister (void); void PcapTranslateIPToDevice(char *pcap_dev, size_t len); int PcapLiveRegisterDevice(char *); int PcapLiveGetDeviceCount(void); char *PcapLiveGetDevice(int); #define LIBPCAP_SNAPLEN 1518 #define LIBPCAP_COPYWAIT 500 #define LIBPCAP_PROMISC 1 /* per packet Pcap vars */ typedef struct PcapPacketVars_ { uint32_t tenant_id; } PcapPacketVars; /** needs to be able to contain Windows adapter id's, so * must be quite long. */ #define PCAP_IFACE_NAME_LENGTH 128 typedef struct PcapIfaceConfig_ { char iface[PCAP_IFACE_NAME_LENGTH]; /* number of threads */ int threads; /* socket buffer size */ int buffer_size; /* snapshot length */ int snaplen; /* promiscuous value */ int promisc; /* BPF filter */ char *bpf_filter; ChecksumValidationMode checksum_mode; SC_ATOMIC_DECLARE(unsigned int, ref); void (*DerefFunc)(void *); } PcapIfaceConfig; #endif /* __SOURCE_PCAP_H__ */ suricata-3.2.1/src/util-host-os-info.c0000644000000000000000000014532613051004444014460 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Host info utility functions */ #include "suricata-common.h" #include "util-host-os-info.h" #include "util-error.h" #include "util-debug.h" #include "util-ip.h" #include "util-radix-tree.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "conf.h" #include "conf-yaml-loader.h" #include "util-enum.h" #include "util-unittest.h" /** Enum map for the various OS flavours */ SCEnumCharMap sc_hinfo_os_policy_map[ ] = { { "none", OS_POLICY_NONE }, { "bsd", OS_POLICY_BSD }, { "bsd-right", OS_POLICY_BSD_RIGHT }, { "old-linux", OS_POLICY_OLD_LINUX }, { "linux", OS_POLICY_LINUX }, { "old-solaris", OS_POLICY_OLD_SOLARIS }, { "solaris", OS_POLICY_SOLARIS }, { "hpux10", OS_POLICY_HPUX10 }, { "hpux11", OS_POLICY_HPUX11 }, { "irix", OS_POLICY_IRIX }, { "macos", OS_POLICY_MACOS }, { "windows", OS_POLICY_WINDOWS }, { "vista", OS_POLICY_VISTA }, { "windows2k3", OS_POLICY_WINDOWS2K3 }, { NULL, -1 }, }; /** Radix tree that holds the host OS information */ static SCRadixTree *sc_hinfo_tree = NULL; /** * \brief Allocates the host_os flavour wrapped in user_data variable to be sent * along with the key to the radix tree * * \param host_os Pointer to a character string containing the host_os flavour * * \retval user_data On success, pointer to the user_data that has to be sent * along with the key, to be added to the Radix tree; NULL on * failure * \initonly */ static void *SCHInfoAllocUserDataOSPolicy(const char *host_os) { int *user_data = NULL; if ( (user_data = SCMalloc(sizeof(int))) == NULL) { SCLogError(SC_ERR_FATAL, "Error allocating memory. Exiting"); exit(EXIT_FAILURE); } /* the host os flavour that has to be sent as user data */ if ( (*user_data = SCMapEnumNameToValue(host_os, sc_hinfo_os_policy_map)) == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "Invalid enum map inside " "SCHInfoAddHostOSInfo()"); SCFree(user_data); return NULL; } return (void *)user_data; } /** * \brief Used to free the user data that is allocated by host_os_info API * * \param Pointer to the data that has to be freed */ static void SCHInfoFreeUserDataOSPolicy(void *data) { if (data != NULL) SCFree(data); return; } /** * \brief Used to add the host-os-info data obtained from the conf * * \param host_os The host_os name/flavour from the conf file * \param host_os_ip_range Pointer to a char string holding the ip/ip_netblock * for the host_os specified in the first argument * \param is_ipv4 Indicates if the ip address to be considered for the * default configuration is IPV4; if not it is IPV6. * Specified using SC_HINFO_IS_IPV6 or SC_HINFO_IS_IPV4 * * \retval 0 On successfully adding the host os info to the Radix tree * \retval -1 On failure * \initonly (only specified from config, at the startup) */ int SCHInfoAddHostOSInfo(char *host_os, char *host_os_ip_range, int is_ipv4) { char *ip_str = NULL; char *ip_str_rem = NULL; struct in_addr *ipv4_addr = NULL; struct in6_addr *ipv6_addr = NULL; char *netmask_str = NULL; int netmask_value = 0; int *user_data = NULL; char recursive = FALSE; if (host_os == NULL || host_os_ip_range == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return -1; } /* create the radix tree that would hold all the host os info */ if (sc_hinfo_tree == NULL) sc_hinfo_tree = SCRadixCreateRadixTree(SCHInfoFreeUserDataOSPolicy, NULL); /* the host os flavour that has to be sent as user data */ if ( (user_data = SCHInfoAllocUserDataOSPolicy(host_os)) == NULL) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "Invalid enum map inside"); return -1; } /* if we have a default configuration set the appropriate values for the * netblocks */ if ( (strcasecmp(host_os_ip_range, "default")) == 0) { if (is_ipv4) host_os_ip_range = "0.0.0.0/0"; else host_os_ip_range = "::/0"; } if ( (ip_str = SCStrdup(host_os_ip_range)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } /* check if we have more addresses in the host_os_ip_range */ if ((ip_str_rem = index(ip_str, ',')) != NULL) { ip_str_rem[0] = '\0'; ip_str_rem++; recursive = TRUE; } /* check if we have received a netblock */ if ( (netmask_str = index(ip_str, '/')) != NULL) { netmask_str[0] = '\0'; netmask_str++; } if (index(ip_str, ':') == NULL) { /* if we are here, we have an IPV4 address */ if ( (ipv4_addr = ValidateIPV4Address(ip_str)) == NULL) { SCLogError(SC_ERR_INVALID_IPV4_ADDR, "Invalid IPV4 address"); SCHInfoFreeUserDataOSPolicy(user_data); SCFree(ip_str); return -1; } if (netmask_str == NULL) { SCRadixAddKeyIPV4((uint8_t *)ipv4_addr, sc_hinfo_tree, (void *)user_data); } else { netmask_value = atoi(netmask_str); if (netmask_value < 0 || netmask_value > 32) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "Invalid IPV4 Netblock"); SCHInfoFreeUserDataOSPolicy(user_data); SCFree(ipv4_addr); SCFree(ip_str); return -1; } MaskIPNetblock((uint8_t *)ipv4_addr, netmask_value, 32); SCRadixAddKeyIPV4Netblock((uint8_t *)ipv4_addr, sc_hinfo_tree, (void *)user_data, netmask_value); } } else { /* if we are here, we have an IPV6 address */ if ( (ipv6_addr = ValidateIPV6Address(ip_str)) == NULL) { SCLogError(SC_ERR_INVALID_IPV6_ADDR, "Invalid IPV6 address inside"); SCHInfoFreeUserDataOSPolicy(user_data); SCFree(ip_str); return -1; } if (netmask_str == NULL) { SCRadixAddKeyIPV6((uint8_t *)ipv6_addr, sc_hinfo_tree, (void *)user_data); } else { netmask_value = atoi(netmask_str); if (netmask_value < 0 || netmask_value > 128) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "Invalid IPV6 Netblock"); SCHInfoFreeUserDataOSPolicy(user_data); SCFree(ipv6_addr); SCFree(ip_str); return -1; } MaskIPNetblock((uint8_t *)ipv6_addr, netmask_value, 128); SCRadixAddKeyIPV6Netblock((uint8_t *)ipv6_addr, sc_hinfo_tree, (void *)user_data, netmask_value); } } if (recursive == TRUE) { SCHInfoAddHostOSInfo(host_os, ip_str_rem, is_ipv4); } SCFree(ip_str); if (ipv4_addr != NULL) SCFree(ipv4_addr); if (ipv6_addr != NULL) SCFree(ipv6_addr); return *user_data; } /** * \brief Retrieves the host os flavour, given an ipv4/ipv6 address as a string. * * \param Pointer to a string containing an IP address * * \retval The OS flavour on success; -1 on failure, or on not finding the key */ int SCHInfoGetHostOSFlavour(char *ip_addr_str) { struct in_addr *ipv4_addr = NULL; struct in6_addr *ipv6_addr = NULL; void *user_data = NULL; if (ip_addr_str == NULL || index(ip_addr_str, '/') != NULL) return -1; if (index(ip_addr_str, ':') != NULL) { if ( (ipv6_addr = ValidateIPV6Address(ip_addr_str)) == NULL) { SCLogError(SC_ERR_INVALID_IPV4_ADDR, "Invalid IPV4 address"); return -1; } (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)ipv6_addr, sc_hinfo_tree, &user_data); if (user_data == NULL) return -1; else return *((int *)user_data); } else { if ( (ipv4_addr = ValidateIPV4Address(ip_addr_str)) == NULL) { SCLogError(SC_ERR_INVALID_IPV4_ADDR, "Invalid IPV4 address"); return -1; } (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)ipv4_addr, sc_hinfo_tree, &user_data); if (user_data == NULL) return -1; else return *((int *)user_data); } } /** * \brief Retrieves the host os flavour, given an ipv4 address in the raw * address format. * * \param Pointer to a raw ipv4 address. * * \retval The OS flavour on success; -1 on failure, or on not finding the key */ int SCHInfoGetIPv4HostOSFlavour(uint8_t *ipv4_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, sc_hinfo_tree, &user_data); if (user_data == NULL) return -1; else return *((int *)user_data); } /** * \brief Retrieves the host os flavour, given an ipv6 address in the raw * address format. * * \param Pointer to a raw ipv6 address. * * \retval The OS flavour on success; -1 on failure, or on not finding the key */ int SCHInfoGetIPv6HostOSFlavour(uint8_t *ipv6_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, sc_hinfo_tree, &user_data); if (user_data == NULL) return -1; else return *((int *)user_data); } void SCHInfoCleanResources(void) { if (sc_hinfo_tree != NULL) { SCRadixReleaseRadixTree(sc_hinfo_tree); sc_hinfo_tree = NULL; } return; } /** * \brief Load the host os policy information from the configuration. * * \initonly (A mem alloc error should cause an exit failure) */ void SCHInfoLoadFromConfig(void) { ConfNode *root = ConfGetNode("host-os-policy"); if (root == NULL) return; ConfNode *policy; TAILQ_FOREACH(policy, &root->head, next) { ConfNode *host; TAILQ_FOREACH(host, &policy->head, next) { int is_ipv4 = 1; if (host->val != NULL && index(host->val, ':') != NULL) is_ipv4 = 0; if (SCHInfoAddHostOSInfo(policy->name, host->val, is_ipv4) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to add host \"%s\" with policy \"%s\" to host " "info database", host->val, policy->name); exit(EXIT_FAILURE); } } } } /*------------------------------------Unit_Tests------------------------------*/ #ifdef UNITTESTS static SCRadixTree *sc_hinfo_tree_backup = NULL; static void SCHInfoCreateContextBackup(void) { sc_hinfo_tree_backup = sc_hinfo_tree; sc_hinfo_tree = NULL; return; } static void SCHInfoRestoreContextBackup(void) { sc_hinfo_tree = sc_hinfo_tree_backup; sc_hinfo_tree_backup = NULL; return; } /** * \test Check if we the IPs with the right OS flavours are added to the host OS * radix tree, and the IPS with invalid flavours returns an error(-1) */ int SCHInfoTestInvalidOSFlavour01(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("bamboo", "192.168.1.1", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("windows", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("irix", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("bsd", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("bsd", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("old_linux", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("old_linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("macos", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("macos", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("vista", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("windows2k3", "192.168.1.1", SC_HINFO_IS_IPV4) != SCMapEnumNameToValue("windows2k3", sc_hinfo_os_policy_map)) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that invalid ipv4 addresses and ipv4 netblocks are rejected by * the host os info API */ int SCHInfoTestInvalidIPV4Address02(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "192.168.1.566", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.168.1", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.168", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "", SC_HINFO_IS_IPV4) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.168.1.1/33", SC_HINFO_IS_IPV4) != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that invalid ipv4 addresses and ipv4 netblocks are rejected by * the host os info API */ int SCHInfoTestInvalidIPV6Address03(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "2362:7322", SC_HINFO_IS_IPV6) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "19YW:", SC_HINFO_IS_IPV6) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "1235", SC_HINFO_IS_IPV6) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "1922:236115:", SC_HINFO_IS_IPV6) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "", SC_HINFO_IS_IPV6) != -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "1921.6311:6241:6422:7352:ABBB:DDDD:EEEE/129", SC_HINFO_IS_IPV6) != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv4 addresses are inserted into the host os radix * tree, and the host os api retrieves the right value for the host os * flavour, on supplying as arg an ipv4 addresses that has been added to * the host os radix tree. */ int SCHInfoTestValidIPV4Address04(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "192.168.1.1", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "192.192.1.2", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "192.168.1.100", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "192.168.2.4", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.192.1.5", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "192.168.10.20", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "111.163.151.62", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "11.1.120.210", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "19.18.110.210", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "19.18.120.110", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "191.168.11.128", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "191.168.11.192", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.1") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.2") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.192.2.4") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.2.4") != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.192.1.5") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.10.20") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.163.151.62") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("11.1.120.210") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("19.18.110.210") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("19.18.120.110") != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("191.168.11.128") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("191.168.11.192") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("191.168.11.224") != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv4 addresses/netblocks are inserted into the host os * radix tree, and the host os api retrieves the right value for the host * os flavour, on supplying as arg an ipv4 addresses that has been added * to the host os radix tree. */ int SCHInfoTestValidIPV4Address05(void) { SCHInfoCreateContextBackup(); struct in_addr in; int result = 0; if (SCHInfoAddHostOSInfo("linux", "192.168.1.1", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "192.192.1.2", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "192.168.1.100", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "192.168.2.4", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "192.192.1.5", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "192.168.10.20", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "111.163.151.62", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "111.162.208.124/20", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "111.162.240.1", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "111.162.214.100", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "111.162.208.100", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "111.162.194.112", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.1") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.2") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.192.2.4") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.2.4") != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.192.1.5") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.10.20") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.163.151.62") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.208.0") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.210.1") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.214.1") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.0.0") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.240.112") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.240.1") != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.214.100") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (inet_pton(AF_INET, "111.162.208.100", &in) < 0) { goto end; } if (SCHInfoGetIPv4HostOSFlavour((uint8_t *)&in) != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.194.112") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.208.200") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (inet_pton(AF_INET, "111.162.208.200", &in) < 0) { goto end; } if (SCHInfoGetIPv4HostOSFlavour((uint8_t *)&in) != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("111.162.200.201") != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv6 addresses are inserted into the host os radix * tree, and the host os api retrieves the right value for the host os * flavour, on supplying as arg an ipv6 address that has been added to * the host os radix tree. */ int SCHInfoTestValidIPV6Address06(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "2351:2512:6211:6246:235A:6242:2352:62AD", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "6961:6121:2132:6241:423A:2135:2461:621D", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "DD13:613D:F312:62DD:6213:421A:6212:2652", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "9891:2131:2151:6426:1342:674D:622F:2342", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "3525:2351:4223:6211:2311:2667:6242:2154", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "1511:6211:6726:7777:1212:2333:6222:7722", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "2666:6222:7222:2335:6223:7722:3425:2362", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "8762:2352:6241:7245:EE23:21AD:2312:622C", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "6422:EE1A:2621:34AD:2462:432D:642E:E13A", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "3521:7622:6241:6242:7277:1234:2352:6234", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "2141:6232:6252:2223:7734:2345:6245:6222", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "5222:6432:6432:2322:6662:3423:4322:3245", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:62AD") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:6FFFE") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2652") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2222") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("9891:2131:2151:6426:1342:674D:622F:2342") != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("3525:2351:4223:6211:2311:2667:6242:2154") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("1511:6211:6726:7777:1212:2333:6222:7722") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2666:6222:7222:2335:6223:7722:3425:2362") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:622C") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("6422:EE1A:2621:34AD:2462:432D:642E:E13A") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("3521:7622:6241:6242:7277:1234:2352:6234") != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2141:6232:6252:2223:7734:2345:6245:6222") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("5222:6432:6432:2322:6662:3423:4322:3245") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("5222:6432:6432:2322:6662:3423:4322:DDDD") != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv6 addresses/netblocks are inserted into the host os * radix tree, and the host os api retrieves the right value for the host * os flavour, on supplying as arg an ipv6 address that has been added to * the host os radix tree. */ int SCHInfoTestValidIPV6Address07(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "2351:2512:6211:6246:235A:6242:2352:62AD", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "6961:6121:2132:6241:423A:2135:2461:621D", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "DD13:613D:F312:62DD:6213:421A:6212:2652", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "9891:2131:2151:6426:1342:674D:622F:2342", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "3525:2351:4223:6211:2311:2667:6242:2154", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "1511:6211:6726:7777:1212:2333:6222:7722", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "2666:6222:7222:2335:6223:7722:3425:2362", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "8762:2352:6241:7245:EE23:21AD:2312:622C/68", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "8762:2352:6241:7245:EE23:21AD:2412:622C", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "8762:2352:6241:7245:EE23:21AD:FFFF:622C", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "8762:2352:6241:7245:EE23:21AD:2312:62FF", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "8762:2352:6241:7245:EE23:21AD:2121:1212", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:62AD") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:6FFFE") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2652") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2222") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("9891:2131:2151:6426:1342:674D:622F:2342") != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("3525:2351:4223:6211:2311:2667:6242:2154") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("1511:6211:6726:7777:1212:2333:6222:7722") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2666:6222:7222:2335:6223:7722:3425:2362") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:622C") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2412:622C") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:FFFF:622C") != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:62FF") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2121:1212") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("5222:6432:6432:2322:6662:3423:4322:DDDD") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2121:1DDD") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:FFFF:2121:1DDD") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:622C") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE00:0000:0000:0000") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:E000:0000:0000:0000") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv6 addresses/netblocks are inserted into the host os * radix tree, and the host os api retrieves the right value for the host * os flavour, on supplying as arg an ipv6 address that has been added to * the host os radix tree. */ int SCHInfoTestValidIPV6Address08(void) { SCHInfoCreateContextBackup(); struct in6_addr in6; int result = 0; if (SCHInfoAddHostOSInfo("linux", "2351:2512:6211:6246:235A:6242:2352:62AD", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "6961:6121:2132:6241:423A:2135:2461:621D", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "DD13:613D:F312:62DD:6213:421A:6212:2652", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux10", "9891:2131:2151:6426:1342:674D:622F:2342", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "3525:2351:4223:6211:2311:2667:6242:2154", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "1511:6211:6726:7777:1212:2333:6222:7722", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "2666:6222:7222:2335:6223:7722:3425:2362", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "8762:2352:6241:7245:EE23:21AD:2312:622C/68", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("linux", "8762:2352:6241:7245:EE23:21AD:2412:622C", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "8762:2352:6241:7245:EE23:21AD:FFFF:622C", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("hpux11", "8762:2352:6241:7245:EE23:21AD:2312:62FF", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("vista", "8762:2352:6241:7245:EE23:21AD:2121:1212", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoAddHostOSInfo("irix", "default", SC_HINFO_IS_IPV6) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:62AD") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2351:2512:6211:6246:235A:6242:2352:6FFF") != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2652") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("DD13:613D:F312:62DD:6213:421A:6212:2222") != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("9891:2131:2151:6426:1342:674D:622F:2342") != SCMapEnumNameToValue("hpux10", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("3525:2351:4223:6211:2311:2667:6242:2154") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("1511:6211:6726:7777:1212:2333:6222:7722") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("2666:6222:7222:2335:6223:7722:3425:2362") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:622C") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2412:622C") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:FFFF:622C") != SCMapEnumNameToValue("windows", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:62FF") != SCMapEnumNameToValue("hpux11", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2121:1212") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("5222:6432:6432:2322:6662:3423:4322:DDDD") != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2121:1DDD") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:FFFF:2121:1DDD") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE23:21AD:2312:622C") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("8762:2352:6241:7245:EE00:0000:0000:0000") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (inet_pton(AF_INET6, "8762:2352:6241:7245:E000:0000:0000:0000", &in6) < 0) { goto end; } if (SCHInfoGetIPv6HostOSFlavour((uint8_t *)&in6) != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } if (inet_pton(AF_INET6, "AD23:2DDA:6D1D:A223:E235:0232:1241:1666", &in6) < 0) { goto end; } if (SCHInfoGetIPv6HostOSFlavour((uint8_t *)&in6) != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check that valid ipv4 addresses are inserted into the host os radix * tree, and the host os api retrieves the right value for the host os * flavour, on supplying as arg an ipv4 addresses that has been added to * the host os radix tree. */ int SCHInfoTestValidIPV4Address09(void) { SCHInfoCreateContextBackup(); int result = 0; if (SCHInfoAddHostOSInfo("linux", "192.168.1.0", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("windows", "192.192.1.2", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.0") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "192.168.1.0/16", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("macos", "192.168.1.0/20", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.0") != SCMapEnumNameToValue("linux", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("vista", "192.168.50.128/25", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.50.128") != SCMapEnumNameToValue("vista", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoAddHostOSInfo("irix", "192.168.50.128", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.50.128") != SCMapEnumNameToValue("irix", sc_hinfo_os_policy_map)) { goto end; } if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("macos", sc_hinfo_os_policy_map)) { goto end; } struct sockaddr_in servaddr; bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) { goto end; } SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, sc_hinfo_tree, 16); if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("macos", sc_hinfo_os_policy_map)) { goto end; } bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) { goto end; } SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, sc_hinfo_tree, 20); if (SCHInfoGetHostOSFlavour("192.168.1.100") != -1) { goto end; } if (SCHInfoAddHostOSInfo("solaris", "192.168.1.0/16", SC_HINFO_IS_IPV4) == -1) { goto end; } if (SCHInfoAddHostOSInfo("macos", "192.168.1.0/20", SC_HINFO_IS_IPV4) == -1) { goto end; } /* 192.168.1.100 should match "macos" as its more specific than * "solaris". */ if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("macos", sc_hinfo_os_policy_map)) { goto end; } /* Remove the 192.168.1.0/20 -> macos entry. */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) { goto end; } SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, sc_hinfo_tree, 20); if (SCHInfoGetHostOSFlavour("192.168.1.100") != SCMapEnumNameToValue("solaris", sc_hinfo_os_policy_map)) { goto end; } /* Remove the 192.168.1.0/16 -> solaris entry. */ bzero(&servaddr, sizeof(servaddr)); if (inet_pton(AF_INET, "192.168.0.0", &servaddr.sin_addr) <= 0) { goto end; } SCRadixRemoveKeyIPV4Netblock((uint8_t *)&servaddr.sin_addr, sc_hinfo_tree, 16); if (SCHInfoGetHostOSFlavour("192.168.1.100") != -1) { goto end; } result = 1; end: SCHInfoCleanResources(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check the loading of host info from a configuration file. */ int SCHInfoTestLoadFromConfig01(void) { char config[] = "\ %YAML 1.1\n\ ---\n\ host-os-policy:\n\ bsd: [0.0.0.0/0]\n\ windows: [10.0.0.0/8, 192.168.1.0/24]\n\ linux: [10.0.0.5/32]\n\ \n"; int result = 0; SCHInfoCreateContextBackup(); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); SCHInfoLoadFromConfig(); if (SCHInfoGetHostOSFlavour("10.0.0.4") != OS_POLICY_WINDOWS) goto end; if (SCHInfoGetHostOSFlavour("10.0.0.5") != OS_POLICY_LINUX) goto end; if (SCHInfoGetHostOSFlavour("192.168.1.1") != OS_POLICY_WINDOWS) goto end; if (SCHInfoGetHostOSFlavour("172.168.1.1") != OS_POLICY_BSD) goto end; result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check the loading of host info from a configuration file. */ int SCHInfoTestLoadFromConfig02(void) { char config[] = "\ %YAML 1.1\n\ ---\n\ host-os-policy:\n\ one-two: [0.0.0.0/0]\n\ one-two-three:\n\ four_five:\n\ six-seven_eight: [10.0.0.0/8, 192.168.1.0/24]\n\ nine_ten_eleven: [10.0.0.5/32]\n\ \n"; int result = 0; SCHInfoCreateContextBackup(); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ConfNode *root = ConfGetNode("host-os-policy"); if (root == NULL) goto end; int count = 0; ConfNode *policy; TAILQ_FOREACH(policy, &root->head, next) { switch (count) { case 0: if (strcmp("one-two", policy->name) != 0) goto end; break; case 1: if (strcmp("one-two-three", policy->name) != 0) goto end; break; case 2: if (strcmp("four-five", policy->name) != 0) goto end; break; case 3: if (strcmp("six-seven-eight", policy->name) != 0) goto end; break; case 4: if (strcmp("nine-ten-eleven", policy->name) != 0) goto end; break; } count++; } result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check the loading of host info from a configuration file. */ int SCHInfoTestLoadFromConfig03(void) { char config[] = "\ %YAML 1.1\n\ ---\n\ host-os-policy:\n\ bsd-right: [0.0.0.1]\n\ old-linux: [0.0.0.2]\n\ old-solaris: [0.0.0.3]\n\ windows: [0.0.0.4]\n\ vista: [0.0.0.5]\n\ \n"; int result = 0; SCHInfoCreateContextBackup(); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ConfNode *root = ConfGetNode("host-os-policy"); if (root == NULL) goto end; ConfNode *policy; TAILQ_FOREACH(policy, &root->head, next) { if (SCMapEnumNameToValue(policy->name, sc_hinfo_os_policy_map) == -1) { printf("Invalid enum map inside\n"); goto end; } } result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check the loading of host info from a configuration file. */ int SCHInfoTestLoadFromConfig04(void) { char config[] = "\ %YAML 1.1\n\ ---\n\ host-os-policy:\n\ bsd_right: [0.0.0.1]\n\ old_linux: [0.0.0.2]\n\ old_solaris: [0.0.0.3]\n\ windows: [0.0.0.4]\n\ vista: [0.0.0.5]\n\ \n"; int result = 0; SCHInfoCreateContextBackup(); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); ConfNode *root = ConfGetNode("host-os-policy"); if (root == NULL) goto end; ConfNode *policy; TAILQ_FOREACH(policy, &root->head, next) { if (SCMapEnumNameToValue(policy->name, sc_hinfo_os_policy_map) == -1) { printf("Invalid enum map inside\n"); goto end; } } result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); SCHInfoRestoreContextBackup(); return result; } /** * \test Check the loading of host info from a configuration file. */ int SCHInfoTestLoadFromConfig05(void) { char config[] = "\ %YAML 1.1\n\ ---\n\ host-os-policy:\n\ bsd_right: [0.0.0.1]\n\ old_linux: [0.0.0.2]\n\ old-solaris: [0.0.0.3]\n\ windows: [0.0.0.4]\n\ linux: [0.0.0.5]\n\ \n"; int result = 0; SCHInfoCreateContextBackup(); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(config, strlen(config)); SCHInfoLoadFromConfig(); if (SCHInfoGetHostOSFlavour("0.0.0.1") != OS_POLICY_BSD_RIGHT) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.2") != OS_POLICY_OLD_LINUX) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.3") != OS_POLICY_OLD_SOLARIS) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.4") != OS_POLICY_WINDOWS) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.5") != OS_POLICY_VISTA) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.0") != -1) { goto end; } if (SCHInfoGetHostOSFlavour("0.0.0.6") != -1) { goto end; } result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); SCHInfoRestoreContextBackup(); return result; } #endif /* UNITTESTS */ void SCHInfoRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCHInfoTesInvalidOSFlavour01", SCHInfoTestInvalidOSFlavour01); UtRegisterTest("SCHInfoTestInvalidIPV4Address02", SCHInfoTestInvalidIPV4Address02); UtRegisterTest("SCHInfoTestInvalidIPV6Address03", SCHInfoTestInvalidIPV6Address03); UtRegisterTest("SCHInfoTestValidIPV4Address04", SCHInfoTestValidIPV4Address04); UtRegisterTest("SCHInfoTestValidIPV4Address05", SCHInfoTestValidIPV4Address05); UtRegisterTest("SCHInfoTestValidIPV6Address06", SCHInfoTestValidIPV6Address06); UtRegisterTest("SCHInfoTestValidIPV6Address07", SCHInfoTestValidIPV6Address07); UtRegisterTest("SCHInfoTestValidIPV6Address08", SCHInfoTestValidIPV6Address08); UtRegisterTest("SCHInfoTestValidIPV4Address09", SCHInfoTestValidIPV4Address09); UtRegisterTest("SCHInfoTestLoadFromConfig01", SCHInfoTestLoadFromConfig01); UtRegisterTest("SCHInfoTestLoadFromConfig02", SCHInfoTestLoadFromConfig02); UtRegisterTest("SCHInfoTestLoadFromConfig03", SCHInfoTestLoadFromConfig03); UtRegisterTest("SCHInfoTestLoadFromConfig04", SCHInfoTestLoadFromConfig04); #endif /* UNITTESTS */ } suricata-3.2.1/src/defrag-timeout.c0000644000000000000000000000753313051004444014071 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "defrag.h" #include "defrag-hash.h" uint32_t DefragTrackerGetSpareCount(void) { return DefragTrackerSpareQueueGetSize(); } uint32_t DefragTrackerGetActiveCount(void) { return SC_ATOMIC_GET(defragtracker_counter); } /** \internal * \brief See if we can really discard this tracker. Check use_cnt reference. * * \param dt tracker * \param ts timestamp * * \retval 0 not timed out just yet * \retval 1 fully timed out, lets kill it */ static int DefragTrackerTimedOut(DefragTracker *dt, struct timeval *ts) { /** never prune a trackers that is used by a packet * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(dt->use_cnt) > 0) { return 0; } /* retain if remove is not set and not timed out */ if (!dt->remove && timercmp(&dt->timeout, ts, >)) return 0; return 1; } /** * \internal * * \brief check all trackers in a hash row for timing out * * \param hb tracker hash row *LOCKED* * \param dt last tracker in the hash row * \param ts timestamp * * \retval cnt timed out tracker */ static uint32_t DefragTrackerHashRowTimeout(DefragTrackerHashRow *hb, DefragTracker *dt, struct timeval *ts) { uint32_t cnt = 0; do { if (SCMutexTrylock(&dt->lock) != 0) { dt = dt->hprev; continue; } DefragTracker *next_dt = dt->hprev; /* check if the tracker is fully timed out and * ready to be discarded. */ if (DefragTrackerTimedOut(dt, ts) == 1) { /* remove from the hash */ if (dt->hprev != NULL) dt->hprev->hnext = dt->hnext; if (dt->hnext != NULL) dt->hnext->hprev = dt->hprev; if (hb->head == dt) hb->head = dt->hnext; if (hb->tail == dt) hb->tail = dt->hprev; dt->hnext = NULL; dt->hprev = NULL; DefragTrackerClearMemory(dt); /* no one is referring to this tracker, use_cnt 0, removed from hash * so we can unlock it and move it back to the spare queue. */ SCMutexUnlock(&dt->lock); /* move to spare list */ DefragTrackerMoveToSpare(dt); cnt++; } else { SCMutexUnlock(&dt->lock); } dt = next_dt; } while (dt != NULL); return cnt; } /** * \brief time out tracker from the hash * * \param ts timestamp * * \retval cnt number of timed out tracker */ uint32_t DefragTimeoutHash(struct timeval *ts) { uint32_t idx = 0; uint32_t cnt = 0; for (idx = 0; idx < defrag_config.hash_size; idx++) { DefragTrackerHashRow *hb = &defragtracker_hash[idx]; if (DRLOCK_TRYLOCK(hb) != 0) continue; /* defrag hash bucket is now locked */ if (hb->tail == NULL) { DRLOCK_UNLOCK(hb); continue; } /* we have a tracker, or more than one */ cnt += DefragTrackerHashRowTimeout(hb, hb->tail, ts); DRLOCK_UNLOCK(hb); } return cnt; } suricata-3.2.1/src/Makefile.in0000644000000000000000000025134713051004467013067 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ bin_PROGRAMS = suricata$(EXEEXT) # different flags for different cases @DEBUG_TRUE@am__append_1 = -ggdb -O0 subdir = src ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(noinst_HEADERS) \ $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" PROGRAMS = $(bin_PROGRAMS) am_suricata_OBJECTS = alert-debuglog.$(OBJEXT) alert-fastlog.$(OBJEXT) \ alert-prelude.$(OBJEXT) alert-syslog.$(OBJEXT) \ alert-unified2-alert.$(OBJEXT) app-layer.$(OBJEXT) \ app-layer-dcerpc.$(OBJEXT) app-layer-dcerpc-udp.$(OBJEXT) \ app-layer-detect-proto.$(OBJEXT) app-layer-dnp3.$(OBJEXT) \ app-layer-dnp3-objects.$(OBJEXT) \ app-layer-dns-common.$(OBJEXT) app-layer-dns-tcp.$(OBJEXT) \ app-layer-dns-udp.$(OBJEXT) app-layer-enip.$(OBJEXT) \ app-layer-enip-common.$(OBJEXT) app-layer-events.$(OBJEXT) \ app-layer-ftp.$(OBJEXT) app-layer-htp-body.$(OBJEXT) \ app-layer-htp.$(OBJEXT) app-layer-htp-file.$(OBJEXT) \ app-layer-htp-libhtp.$(OBJEXT) app-layer-htp-mem.$(OBJEXT) \ app-layer-htp-xff.$(OBJEXT) app-layer-modbus.$(OBJEXT) \ app-layer-parser.$(OBJEXT) app-layer-protos.$(OBJEXT) \ app-layer-smb2.$(OBJEXT) app-layer-smb.$(OBJEXT) \ app-layer-smtp.$(OBJEXT) app-layer-template.$(OBJEXT) \ app-layer-ssh.$(OBJEXT) app-layer-ssl.$(OBJEXT) \ app-layer-tls-handshake.$(OBJEXT) conf.$(OBJEXT) \ conf-yaml-loader.$(OBJEXT) counters.$(OBJEXT) \ data-queue.$(OBJEXT) decode.$(OBJEXT) decode-afl.$(OBJEXT) \ decode-erspan.$(OBJEXT) decode-ethernet.$(OBJEXT) \ decode-events.$(OBJEXT) decode-gre.$(OBJEXT) \ decode-icmpv4.$(OBJEXT) decode-icmpv6.$(OBJEXT) \ decode-ipv4.$(OBJEXT) decode-ipv6.$(OBJEXT) \ decode-null.$(OBJEXT) decode-ppp.$(OBJEXT) \ decode-pppoe.$(OBJEXT) decode-raw.$(OBJEXT) \ decode-sctp.$(OBJEXT) decode-sll.$(OBJEXT) \ decode-tcp.$(OBJEXT) decode-teredo.$(OBJEXT) \ decode-udp.$(OBJEXT) decode-vlan.$(OBJEXT) \ decode-mpls.$(OBJEXT) decode-template.$(OBJEXT) \ defrag-config.$(OBJEXT) defrag.$(OBJEXT) defrag-hash.$(OBJEXT) \ defrag-queue.$(OBJEXT) defrag-timeout.$(OBJEXT) \ detect-ack.$(OBJEXT) detect-app-layer-event.$(OBJEXT) \ detect-app-layer-protocol.$(OBJEXT) detect-asn1.$(OBJEXT) \ detect-base64-data.$(OBJEXT) detect-base64-decode.$(OBJEXT) \ detect-byte-extract.$(OBJEXT) detect-bytejump.$(OBJEXT) \ detect-bytetest.$(OBJEXT) detect-bypass.$(OBJEXT) \ detect.$(OBJEXT) detect-classtype.$(OBJEXT) \ detect-content.$(OBJEXT) detect-csum.$(OBJEXT) \ detect-dce-iface.$(OBJEXT) detect-dce-opnum.$(OBJEXT) \ detect-dce-stub-data.$(OBJEXT) detect-depth.$(OBJEXT) \ detect-detection-filter.$(OBJEXT) detect-distance.$(OBJEXT) \ detect-dnp3.$(OBJEXT) detect-dns-query.$(OBJEXT) \ detect-tls-sni.$(OBJEXT) detect-tls-cert-issuer.$(OBJEXT) \ detect-tls-cert-subject.$(OBJEXT) detect-dsize.$(OBJEXT) \ detect-engine-address.$(OBJEXT) \ detect-engine-address-ipv4.$(OBJEXT) \ detect-engine-address-ipv6.$(OBJEXT) \ detect-engine-alert.$(OBJEXT) detect-engine-analyzer.$(OBJEXT) \ detect-engine.$(OBJEXT) \ detect-engine-content-inspection.$(OBJEXT) \ detect-engine-dcepayload.$(OBJEXT) detect-engine-dns.$(OBJEXT) \ detect-engine-tls.$(OBJEXT) detect-engine-modbus.$(OBJEXT) \ detect-engine-enip.$(OBJEXT) detect-engine-event.$(OBJEXT) \ detect-engine-file.$(OBJEXT) \ detect-engine-filedata-smtp.$(OBJEXT) \ detect-engine-hcbd.$(OBJEXT) detect-engine-hcd.$(OBJEXT) \ detect-engine-hhd.$(OBJEXT) detect-engine-hhhd.$(OBJEXT) \ detect-engine-hmd.$(OBJEXT) detect-engine-hrhd.$(OBJEXT) \ detect-engine-hrhhd.$(OBJEXT) detect-engine-hrud.$(OBJEXT) \ detect-engine-hsbd.$(OBJEXT) detect-engine-hscd.$(OBJEXT) \ detect-engine-hsmd.$(OBJEXT) detect-engine-hua.$(OBJEXT) \ detect-engine-iponly.$(OBJEXT) detect-engine-loader.$(OBJEXT) \ detect-engine-mpm.$(OBJEXT) detect-engine-payload.$(OBJEXT) \ detect-engine-port.$(OBJEXT) detect-engine-prefilter.$(OBJEXT) \ detect-engine-prefilter-common.$(OBJEXT) \ detect-engine-proto.$(OBJEXT) detect-engine-profile.$(OBJEXT) \ detect-engine-siggroup.$(OBJEXT) \ detect-engine-sigorder.$(OBJEXT) detect-engine-state.$(OBJEXT) \ detect-engine-tag.$(OBJEXT) detect-engine-template.$(OBJEXT) \ detect-engine-threshold.$(OBJEXT) detect-engine-uri.$(OBJEXT) \ detect-fast-pattern.$(OBJEXT) detect-file-data.$(OBJEXT) \ detect-fileext.$(OBJEXT) detect-filemagic.$(OBJEXT) \ detect-filemd5.$(OBJEXT) detect-filesha1.$(OBJEXT) \ detect-filesha256.$(OBJEXT) detect-filename.$(OBJEXT) \ detect-filesize.$(OBJEXT) detect-filestore.$(OBJEXT) \ detect-flags.$(OBJEXT) detect-flowbits.$(OBJEXT) \ detect-flow.$(OBJEXT) detect-flowint.$(OBJEXT) \ detect-flowvar.$(OBJEXT) detect-fragbits.$(OBJEXT) \ detect-fragoffset.$(OBJEXT) detect-ftpbounce.$(OBJEXT) \ detect-geoip.$(OBJEXT) detect-gid.$(OBJEXT) \ detect-hostbits.$(OBJEXT) detect-http-client-body.$(OBJEXT) \ detect-http-cookie.$(OBJEXT) detect-http-header.$(OBJEXT) \ detect-http-hh.$(OBJEXT) detect-http-hrh.$(OBJEXT) \ detect-http-method.$(OBJEXT) detect-http-raw-header.$(OBJEXT) \ detect-http-raw-uri.$(OBJEXT) \ detect-http-request-line.$(OBJEXT) \ detect-http-response-line.$(OBJEXT) \ detect-http-server-body.$(OBJEXT) \ detect-http-stat-code.$(OBJEXT) detect-http-stat-msg.$(OBJEXT) \ detect-http-ua.$(OBJEXT) detect-http-uri.$(OBJEXT) \ detect-icmp-id.$(OBJEXT) detect-icmp-seq.$(OBJEXT) \ detect-icode.$(OBJEXT) detect-id.$(OBJEXT) \ detect-ipopts.$(OBJEXT) detect-ipproto.$(OBJEXT) \ detect-iprep.$(OBJEXT) detect-isdataat.$(OBJEXT) \ detect-itype.$(OBJEXT) detect-l3proto.$(OBJEXT) \ detect-lua.$(OBJEXT) detect-lua-extensions.$(OBJEXT) \ detect-mark.$(OBJEXT) detect-metadata.$(OBJEXT) \ detect-msg.$(OBJEXT) detect-noalert.$(OBJEXT) \ detect-nocase.$(OBJEXT) detect-offset.$(OBJEXT) \ detect-parse.$(OBJEXT) detect-pcre.$(OBJEXT) \ detect-pkt-data.$(OBJEXT) detect-pktvar.$(OBJEXT) \ detect-prefilter.$(OBJEXT) detect-priority.$(OBJEXT) \ detect-rawbytes.$(OBJEXT) detect-reference.$(OBJEXT) \ detect-replace.$(OBJEXT) detect-rev.$(OBJEXT) \ detect-rpc.$(OBJEXT) detect-sameip.$(OBJEXT) \ detect-seq.$(OBJEXT) detect-sid.$(OBJEXT) \ detect-ssh-proto-version.$(OBJEXT) \ detect-ssh-software-version.$(OBJEXT) \ detect-ssl-state.$(OBJEXT) detect-ssl-version.$(OBJEXT) \ detect-stream_size.$(OBJEXT) detect-tag.$(OBJEXT) \ detect-template.$(OBJEXT) detect-template-buffer.$(OBJEXT) \ detect-threshold.$(OBJEXT) detect-tls.$(OBJEXT) \ detect-tls-cert-validity.$(OBJEXT) \ detect-tls-version.$(OBJEXT) detect-tos.$(OBJEXT) \ detect-ttl.$(OBJEXT) detect-uricontent.$(OBJEXT) \ detect-urilen.$(OBJEXT) detect-window.$(OBJEXT) \ detect-within.$(OBJEXT) detect-modbus.$(OBJEXT) \ detect-xbits.$(OBJEXT) detect-cipservice.$(OBJEXT) \ flow-bit.$(OBJEXT) flow.$(OBJEXT) flow-hash.$(OBJEXT) \ flow-manager.$(OBJEXT) flow-queue.$(OBJEXT) \ flow-storage.$(OBJEXT) flow-timeout.$(OBJEXT) \ flow-util.$(OBJEXT) flow-var.$(OBJEXT) flow-worker.$(OBJEXT) \ host.$(OBJEXT) host-bit.$(OBJEXT) host-queue.$(OBJEXT) \ host-storage.$(OBJEXT) host-timeout.$(OBJEXT) ippair.$(OBJEXT) \ ippair-bit.$(OBJEXT) ippair-queue.$(OBJEXT) \ ippair-storage.$(OBJEXT) ippair-timeout.$(OBJEXT) \ log-dnslog.$(OBJEXT) log-droplog.$(OBJEXT) log-file.$(OBJEXT) \ log-filestore.$(OBJEXT) log-httplog.$(OBJEXT) \ log-pcap.$(OBJEXT) log-stats.$(OBJEXT) log-tcp-data.$(OBJEXT) \ log-tlslog.$(OBJEXT) log-tlsstore.$(OBJEXT) output.$(OBJEXT) \ output-file.$(OBJEXT) output-filedata.$(OBJEXT) \ output-flow.$(OBJEXT) output-json-alert.$(OBJEXT) \ output-json-dns.$(OBJEXT) output-json-dnp3.$(OBJEXT) \ output-json-dnp3-objects.$(OBJEXT) output-json-drop.$(OBJEXT) \ output-json-email-common.$(OBJEXT) output-json-file.$(OBJEXT) \ output-json-flow.$(OBJEXT) output-json-netflow.$(OBJEXT) \ output-json-http.$(OBJEXT) output-json-smtp.$(OBJEXT) \ output-json-ssh.$(OBJEXT) output-json-stats.$(OBJEXT) \ output-json-tls.$(OBJEXT) output-json-template.$(OBJEXT) \ output-lua.$(OBJEXT) output-packet.$(OBJEXT) \ output-stats.$(OBJEXT) output-streaming.$(OBJEXT) \ output-tx.$(OBJEXT) output-json.$(OBJEXT) \ packet-queue.$(OBJEXT) pkt-var.$(OBJEXT) reputation.$(OBJEXT) \ respond-reject.$(OBJEXT) respond-reject-libnet11.$(OBJEXT) \ runmode-af-packet.$(OBJEXT) runmode-erf-dag.$(OBJEXT) \ runmode-erf-file.$(OBJEXT) runmode-ipfw.$(OBJEXT) \ runmode-napatech.$(OBJEXT) runmode-netmap.$(OBJEXT) \ runmode-nfq.$(OBJEXT) runmode-nflog.$(OBJEXT) \ runmode-pcap.$(OBJEXT) runmode-pcap-file.$(OBJEXT) \ runmode-pfring.$(OBJEXT) runmode-unittests.$(OBJEXT) \ runmode-unix-socket.$(OBJEXT) runmode-tile.$(OBJEXT) \ runmodes.$(OBJEXT) source-af-packet.$(OBJEXT) \ source-erf-dag.$(OBJEXT) source-erf-file.$(OBJEXT) \ source-ipfw.$(OBJEXT) source-mpipe.$(OBJEXT) \ source-napatech.$(OBJEXT) source-netmap.$(OBJEXT) \ source-nfq.$(OBJEXT) source-nflog.$(OBJEXT) \ source-pcap.$(OBJEXT) source-pcap-file.$(OBJEXT) \ source-pfring.$(OBJEXT) stream.$(OBJEXT) stream-tcp.$(OBJEXT) \ stream-tcp-inline.$(OBJEXT) stream-tcp-reassemble.$(OBJEXT) \ stream-tcp-sack.$(OBJEXT) stream-tcp-util.$(OBJEXT) \ suricata.$(OBJEXT) threads.$(OBJEXT) tm-modules.$(OBJEXT) \ tmqh-flow.$(OBJEXT) tmqh-nfq.$(OBJEXT) \ tmqh-packetpool.$(OBJEXT) tmqh-ringbuffer.$(OBJEXT) \ tmqh-simple.$(OBJEXT) tm-queuehandlers.$(OBJEXT) \ tm-queues.$(OBJEXT) tm-threads.$(OBJEXT) \ unix-manager.$(OBJEXT) util-action.$(OBJEXT) \ util-atomic.$(OBJEXT) util-base64.$(OBJEXT) \ util-bloomfilter-counting.$(OBJEXT) util-bloomfilter.$(OBJEXT) \ util-buffer.$(OBJEXT) util-byte.$(OBJEXT) \ util-checksum.$(OBJEXT) util-cidr.$(OBJEXT) \ util-classification-config.$(OBJEXT) util-conf.$(OBJEXT) \ util-coredump-config.$(OBJEXT) util-cpu.$(OBJEXT) \ util-crypt.$(OBJEXT) util-cuda.$(OBJEXT) \ util-cuda-buffer.$(OBJEXT) util-cuda-handlers.$(OBJEXT) \ util-cuda-vars.$(OBJEXT) util-daemon.$(OBJEXT) \ util-debug.$(OBJEXT) util-debug-filters.$(OBJEXT) \ util-decode-asn1.$(OBJEXT) util-decode-der.$(OBJEXT) \ util-decode-der-get.$(OBJEXT) util-decode-mime.$(OBJEXT) \ util-detect-file-hash.$(OBJEXT) util-device.$(OBJEXT) \ util-enum.$(OBJEXT) util-error.$(OBJEXT) util-file.$(OBJEXT) \ util-fix_checksum.$(OBJEXT) util-fmemopen.$(OBJEXT) \ util-hash.$(OBJEXT) util-hashlist.$(OBJEXT) \ util-hash-lookup3.$(OBJEXT) util-host-os-info.$(OBJEXT) \ util-host-info.$(OBJEXT) util-hyperscan.$(OBJEXT) \ util-ioctl.$(OBJEXT) util-ip.$(OBJEXT) \ util-logopenfile.$(OBJEXT) util-logopenfile-tile.$(OBJEXT) \ util-lua.$(OBJEXT) util-luajit.$(OBJEXT) \ util-lua-common.$(OBJEXT) util-lua-dnp3.$(OBJEXT) \ util-lua-dnp3-objects.$(OBJEXT) util-lua-dns.$(OBJEXT) \ util-lua-http.$(OBJEXT) util-lua-tls.$(OBJEXT) \ util-lua-ssh.$(OBJEXT) util-lua-smtp.$(OBJEXT) \ util-magic.$(OBJEXT) util-memcmp.$(OBJEXT) \ util-memrchr.$(OBJEXT) util-misc.$(OBJEXT) \ util-mpm-ac-bs.$(OBJEXT) util-mpm-ac.$(OBJEXT) \ util-mpm-ac-tile.$(OBJEXT) util-mpm-ac-tile-small.$(OBJEXT) \ util-mpm-hs.$(OBJEXT) util-mpm.$(OBJEXT) util-pages.$(OBJEXT) \ util-path.$(OBJEXT) util-pidfile.$(OBJEXT) util-pool.$(OBJEXT) \ util-pool-thread.$(OBJEXT) util-prefilter.$(OBJEXT) \ util-print.$(OBJEXT) util-privs.$(OBJEXT) \ util-profiling.$(OBJEXT) util-profiling-locks.$(OBJEXT) \ util-profiling-rules.$(OBJEXT) \ util-profiling-keywords.$(OBJEXT) \ util-profiling-rulegroups.$(OBJEXT) util-proto-name.$(OBJEXT) \ util-radix-tree.$(OBJEXT) util-random.$(OBJEXT) \ util-reference-config.$(OBJEXT) util-ringbuffer.$(OBJEXT) \ util-rohash.$(OBJEXT) util-rule-vars.$(OBJEXT) \ util-runmodes.$(OBJEXT) util-running-modes.$(OBJEXT) \ util-signal.$(OBJEXT) util-spm-bm.$(OBJEXT) \ util-spm-bs2bm.$(OBJEXT) util-spm-bs.$(OBJEXT) \ util-spm-hs.$(OBJEXT) util-spm.$(OBJEXT) \ util-storage.$(OBJEXT) util-streaming-buffer.$(OBJEXT) \ util-strlcatu.$(OBJEXT) util-strlcpyu.$(OBJEXT) \ util-syslog.$(OBJEXT) util-threshold-config.$(OBJEXT) \ util-time.$(OBJEXT) util-unittest.$(OBJEXT) \ util-unittest-helper.$(OBJEXT) util-affinity.$(OBJEXT) \ util-var.$(OBJEXT) util-var-name.$(OBJEXT) \ win32-misc.$(OBJEXT) win32-service.$(OBJEXT) suricata_OBJECTS = $(am_suricata_OBJECTS) am__DEPENDENCIES_1 = suricata_DEPENDENCIES = $(am__DEPENDENCIES_1) AM_V_lt = $(am__v_lt_@AM_V@) am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) am__v_lt_0 = --silent am__v_lt_1 = suricata_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(suricata_LDFLAGS) $(LDFLAGS) -o $@ AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CFLAGS) $(CFLAGS) AM_V_CC = $(am__v_CC_@AM_V@) am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) am__v_CC_0 = @echo " CC " $@; am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; am__v_CCLD_1 = SOURCES = $(suricata_SOURCES) DIST_SOURCES = $(suricata_SOURCES) am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac HEADERS = $(noinst_HEADERS) am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ noinst_HEADERS = action-globals.h \ app-layer-nbss.h app-layer-dcerpc-common.h \ debug.h \ flow-private.h queue.h source-nfq-prototypes.h \ suricata-common.h threadvars.h util-binsearch.h \ util-validate.h suricata_SOURCES = \ alert-debuglog.c alert-debuglog.h \ alert-fastlog.c alert-fastlog.h \ alert-prelude.c alert-prelude.h \ alert-syslog.c alert-syslog.h \ alert-unified2-alert.c alert-unified2-alert.h \ app-layer.c app-layer.h \ app-layer-dcerpc.c app-layer-dcerpc.h \ app-layer-dcerpc-udp.c app-layer-dcerpc-udp.h \ app-layer-detect-proto.c app-layer-detect-proto.h \ app-layer-dnp3.c app-layer-dnp3.h \ app-layer-dnp3-objects.c app-layer-dnp3-objects.h \ app-layer-dns-common.c app-layer-dns-common.h \ app-layer-dns-tcp.c app-layer-dns-tcp.h \ app-layer-dns-udp.c app-layer-dns-udp.h \ app-layer-enip.c app-layer-enip.h \ app-layer-enip-common.c app-layer-enip-common.h \ app-layer-events.c app-layer-events.h \ app-layer-ftp.c app-layer-ftp.h \ app-layer-htp-body.c app-layer-htp-body.h \ app-layer-htp.c app-layer-htp.h \ app-layer-htp-file.c app-layer-htp-file.h \ app-layer-htp-libhtp.c app-layer-htp-libhtp.h \ app-layer-htp-mem.c app-layer-htp-mem.h \ app-layer-htp-xff.c app-layer-htp-xff.h \ app-layer-modbus.c app-layer-modbus.h \ app-layer-parser.c app-layer-parser.h \ app-layer-protos.c app-layer-protos.h \ app-layer-smb2.c app-layer-smb2.h \ app-layer-smb.c app-layer-smb.h \ app-layer-smtp.c app-layer-smtp.h \ app-layer-template.c app-layer-template.h \ app-layer-ssh.c app-layer-ssh.h \ app-layer-ssl.c app-layer-ssl.h \ app-layer-tls-handshake.c app-layer-tls-handshake.h \ conf.c conf.h \ conf-yaml-loader.c conf-yaml-loader.h \ counters.c counters.h \ data-queue.c data-queue.h \ decode.c decode.h \ decode-afl.c \ decode-erspan.c decode-erspan.h \ decode-ethernet.c decode-ethernet.h \ decode-events.c decode-events.h \ decode-gre.c decode-gre.h \ decode-icmpv4.c decode-icmpv4.h \ decode-icmpv6.c decode-icmpv6.h \ decode-ipv4.c decode-ipv4.h \ decode-ipv6.c decode-ipv6.h \ decode-null.c decode-null.h \ decode-ppp.c decode-ppp.h \ decode-pppoe.c decode-pppoe.h \ decode-raw.c decode-raw.h \ decode-sctp.c decode-sctp.h \ decode-sll.c decode-sll.h \ decode-tcp.c decode-tcp.h \ decode-teredo.c decode-teredo.h \ decode-udp.c decode-udp.h \ decode-vlan.c decode-vlan.h \ decode-mpls.c decode-mpls.h \ decode-template.c decode-template.h \ defrag-config.c defrag-config.h \ defrag.c defrag.h \ defrag-hash.c defrag-hash.h \ defrag-queue.c defrag-queue.h \ defrag-timeout.c defrag-timeout.h \ detect-ack.c detect-ack.h \ detect-app-layer-event.c detect-app-layer-event.h \ detect-app-layer-protocol.c detect-app-layer-protocol.h \ detect-asn1.c detect-asn1.h \ detect-base64-data.c detect-base64-data.h \ detect-base64-decode.c detect-base64-decode.h \ detect-byte-extract.c detect-byte-extract.h \ detect-bytejump.c detect-bytejump.h \ detect-bytetest.c detect-bytetest.h \ detect-bypass.c detect-bypass.h \ detect.c detect.h \ detect-classtype.c detect-classtype.h \ detect-content.c detect-content.h \ detect-csum.c detect-csum.h \ detect-dce-iface.c detect-dce-iface.h \ detect-dce-opnum.c detect-dce-opnum.h \ detect-dce-stub-data.c detect-dce-stub-data.h \ detect-depth.c detect-depth.h \ detect-detection-filter.c detect-detection-filter.h \ detect-distance.c detect-distance.h \ detect-dnp3.c detect-dnp3.h \ detect-dns-query.c detect-dns-query.h \ detect-tls-sni.c detect-tls-sni.h \ detect-tls-cert-issuer.c detect-tls-cert-issuer.h \ detect-tls-cert-subject.c detect-tls-cert-subject.h \ detect-dsize.c detect-dsize.h \ detect-engine-address.c detect-engine-address.h \ detect-engine-address-ipv4.c detect-engine-address-ipv4.h \ detect-engine-address-ipv6.c detect-engine-address-ipv6.h \ detect-engine-alert.c detect-engine-alert.h \ detect-engine-analyzer.c detect-engine-analyzer.h \ detect-engine.c detect-engine.h \ detect-engine-content-inspection.c detect-engine-content-inspection.h \ detect-engine-dcepayload.c detect-engine-dcepayload.h \ detect-engine-dns.c detect-engine-dns.h \ detect-engine-tls.c detect-engine-tls.h \ detect-engine-modbus.c detect-engine-modbus.h \ detect-engine-enip.c detect-engine-enip.h \ detect-engine-event.c detect-engine-event.h \ detect-engine-file.c detect-engine-file.h \ detect-engine-filedata-smtp.c detect-engine-filedata-smtp.h \ detect-engine-hcbd.c detect-engine-hcbd.h \ detect-engine-hcd.c detect-engine-hcd.h \ detect-engine-hhd.c detect-engine-hhd.h \ detect-engine-hhhd.c detect-engine-hhhd.h \ detect-engine-hmd.c detect-engine-hmd.h \ detect-engine-hrhd.c detect-engine-hrhd.h \ detect-engine-hrhhd.c detect-engine-hrhhd.h \ detect-engine-hrud.c detect-engine-hrud.h \ detect-engine-hsbd.c detect-engine-hsbd.h \ detect-engine-hscd.c detect-engine-hscd.h \ detect-engine-hsmd.c detect-engine-hsmd.h \ detect-engine-hua.c detect-engine-hua.h \ detect-engine-iponly.c detect-engine-iponly.h \ detect-engine-loader.c detect-engine-loader.h \ detect-engine-mpm.c detect-engine-mpm.h \ detect-engine-payload.c detect-engine-payload.h \ detect-engine-port.c detect-engine-port.h \ detect-engine-prefilter.c detect-engine-prefilter.h \ detect-engine-prefilter-common.c detect-engine-prefilter-common.h \ detect-engine-proto.c detect-engine-proto.h \ detect-engine-profile.c detect-engine-profile.h \ detect-engine-siggroup.c detect-engine-siggroup.h \ detect-engine-sigorder.c detect-engine-sigorder.h \ detect-engine-state.c detect-engine-state.h \ detect-engine-tag.c detect-engine-tag.h \ detect-engine-template.c detect-engine-template.h \ detect-engine-threshold.c detect-engine-threshold.h \ detect-engine-uri.c detect-engine-uri.h \ detect-fast-pattern.c detect-fast-pattern.h \ detect-file-data.c detect-file-data.h \ detect-fileext.c detect-fileext.h \ detect-filemagic.c detect-filemagic.h \ detect-filemd5.c detect-filemd5.h \ detect-filesha1.c detect-filesha1.h \ detect-filesha256.c detect-filesha256.h \ detect-filename.c detect-filename.h \ detect-filesize.c detect-filesize.h \ detect-filestore.c detect-filestore.h \ detect-flags.c detect-flags.h \ detect-flowbits.c detect-flowbits.h \ detect-flow.c detect-flow.h \ detect-flowint.c detect-flowint.h \ detect-flowvar.c detect-flowvar.h \ detect-fragbits.c detect-fragbits.h \ detect-fragoffset.c detect-fragoffset.h \ detect-ftpbounce.c detect-ftpbounce.h \ detect-geoip.c detect-geoip.h \ detect-gid.c detect-gid.h \ detect-hostbits.c detect-hostbits.h \ detect-http-client-body.c detect-http-client-body.h \ detect-http-cookie.c detect-http-cookie.h \ detect-http-header.c detect-http-header.h \ detect-http-hh.c detect-http-hh.h \ detect-http-hrh.c detect-http-hrh.h \ detect-http-method.c detect-http-method.h \ detect-http-raw-header.c detect-http-raw-header.h \ detect-http-raw-uri.c detect-http-raw-uri.h \ detect-http-request-line.c detect-http-request-line.h \ detect-http-response-line.c detect-http-response-line.h \ detect-http-server-body.c detect-http-server-body.h \ detect-http-stat-code.c detect-http-stat-code.h \ detect-http-stat-msg.c detect-http-stat-msg.h \ detect-http-ua.c detect-http-ua.h \ detect-http-uri.c detect-http-uri.h \ detect-icmp-id.c detect-icmp-id.h \ detect-icmp-seq.c detect-icmp-seq.h \ detect-icode.c detect-icode.h \ detect-id.c detect-id.h \ detect-ipopts.c detect-ipopts.h \ detect-ipproto.c detect-ipproto.h \ detect-iprep.c detect-iprep.h \ detect-isdataat.c detect-isdataat.h \ detect-itype.c detect-itype.h \ detect-l3proto.c detect-l3proto.h \ detect-lua.c detect-lua.h \ detect-lua-extensions.c detect-lua-extensions.h \ detect-mark.c detect-mark.h \ detect-metadata.c detect-metadata.h \ detect-msg.c detect-msg.h \ detect-noalert.c detect-noalert.h \ detect-nocase.c detect-nocase.h \ detect-offset.c detect-offset.h \ detect-parse.c detect-parse.h \ detect-pcre.c detect-pcre.h \ detect-pkt-data.c detect-pkt-data.h \ detect-pktvar.c detect-pktvar.h \ detect-prefilter.c detect-prefilter.h \ detect-priority.c detect-priority.h \ detect-rawbytes.c detect-rawbytes.h \ detect-reference.c detect-reference.h \ detect-replace.c detect-replace.h \ detect-rev.c detect-rev.h \ detect-rpc.c detect-rpc.h \ detect-sameip.c detect-sameip.h \ detect-seq.c detect-seq.h \ detect-sid.c detect-sid.h \ detect-ssh-proto-version.c detect-ssh-proto-version.h \ detect-ssh-software-version.c detect-ssh-software-version.h \ detect-ssl-state.c detect-ssl-state.h \ detect-ssl-version.c detect-ssl-version.h \ detect-stream_size.c detect-stream_size.h \ detect-tag.c detect-tag.h \ detect-template.c detect-template.h \ detect-template-buffer.c detect-template-buffer.h \ detect-threshold.c detect-threshold.h \ detect-tls.c detect-tls.h \ detect-tls-cert-validity.c detect-tls-cert-validity.h \ detect-tls-version.c detect-tls-version.h \ detect-tos.c detect-tos.h \ detect-ttl.c detect-ttl.h \ detect-uricontent.c detect-uricontent.h \ detect-urilen.c detect-urilen.h \ detect-window.c detect-window.h \ detect-within.c detect-within.h \ detect-modbus.c detect-modbus.h \ detect-xbits.c detect-xbits.h \ detect-cipservice.c detect-cipservice.h \ flow-bit.c flow-bit.h \ flow.c flow.h \ flow-hash.c flow-hash.h \ flow-manager.c flow-manager.h \ flow-queue.c flow-queue.h \ flow-storage.c flow-storage.h \ flow-timeout.c flow-timeout.h \ flow-util.c flow-util.h \ flow-var.c flow-var.h \ flow-worker.c flow-worker.h \ host.c host.h \ host-bit.c host-bit.h \ host-queue.c host-queue.h \ host-storage.c host-storage.h \ host-timeout.c host-timeout.h \ ippair.c ippair.h \ ippair-bit.c ippair-bit.h \ ippair-queue.c ippair-queue.h \ ippair-storage.c ippair-storage.h \ ippair-timeout.c ippair-timeout.h \ log-dnslog.c log-dnslog.h \ log-droplog.c log-droplog.h \ log-file.c log-file.h \ log-filestore.c log-filestore.h \ log-httplog.c log-httplog.h \ log-pcap.c log-pcap.h \ log-stats.c log-stats.h \ log-tcp-data.c log-tcp-data.h \ log-tlslog.c log-tlslog.h \ log-tlsstore.c log-tlsstore.h \ output.c output.h \ output-file.c output-file.h \ output-filedata.c output-filedata.h \ output-flow.c output-flow.h \ output-json-alert.c output-json-alert.h \ output-json-dns.c output-json-dns.h \ output-json-dnp3.c output-json-dnp3.h \ output-json-dnp3-objects.c output-json-dnp3-objects.h \ output-json-drop.c output-json-drop.h \ output-json-email-common.c output-json-email-common.h \ output-json-file.c output-json-file.h \ output-json-flow.c output-json-flow.h \ output-json-netflow.c output-json-netflow.h \ output-json-http.c output-json-http.h \ output-json-smtp.c output-json-smtp.h \ output-json-ssh.c output-json-ssh.h \ output-json-stats.c output-json-stats.h \ output-json-tls.c output-json-tls.h \ output-json-template.c output-json-template.h \ output-lua.c output-lua.h \ output-packet.c output-packet.h \ output-stats.c output-stats.h \ output-streaming.c output-streaming.h \ output-tx.c output-tx.h \ output-json.c output-json.h \ packet-queue.c packet-queue.h \ pkt-var.c pkt-var.h \ reputation.c reputation.h \ respond-reject.c respond-reject.h \ respond-reject-libnet11.h respond-reject-libnet11.c \ runmode-af-packet.c runmode-af-packet.h \ runmode-erf-dag.c runmode-erf-dag.h \ runmode-erf-file.c runmode-erf-file.h \ runmode-ipfw.c runmode-ipfw.h \ runmode-napatech.c runmode-napatech.h \ runmode-netmap.c runmode-netmap.h \ runmode-nfq.c runmode-nfq.h \ runmode-nflog.c runmode-nflog.h \ runmode-pcap.c runmode-pcap.h \ runmode-pcap-file.c runmode-pcap-file.h \ runmode-pfring.c runmode-pfring.h \ runmode-unittests.c runmode-unittests.h \ runmode-unix-socket.c runmode-unix-socket.h \ runmode-tile.c runmode-tile.h \ runmodes.c runmodes.h \ source-af-packet.c source-af-packet.h \ source-erf-dag.c source-erf-dag.h \ source-erf-file.c source-erf-file.h \ source-ipfw.c source-ipfw.h \ source-mpipe.c source-mpipe.h \ source-napatech.c source-napatech.h \ source-netmap.c source-netmap.h \ source-nfq.c source-nfq.h \ source-nflog.c source-nflog.h \ source-pcap.c source-pcap.h \ source-pcap-file.c source-pcap-file.h \ source-pfring.c source-pfring.h \ stream.c stream.h \ stream-tcp.c stream-tcp.h stream-tcp-private.h \ stream-tcp-inline.c stream-tcp-inline.h \ stream-tcp-reassemble.c stream-tcp-reassemble.h \ stream-tcp-sack.c stream-tcp-sack.h \ stream-tcp-util.c stream-tcp-util.h \ suricata.c suricata.h \ threads.c threads.h threads-arch-tile.h \ threads-debug.h threads-profile.h \ tm-modules.c tm-modules.h \ tmqh-flow.c tmqh-flow.h \ tmqh-nfq.c tmqh-nfq.h \ tmqh-packetpool.c tmqh-packetpool.h \ tmqh-ringbuffer.c tmqh-ringbuffer.h \ tmqh-simple.c tmqh-simple.h \ tm-queuehandlers.c tm-queuehandlers.h \ tm-queues.c tm-queues.h \ tm-threads.c tm-threads.h tm-threads-common.h \ unix-manager.c unix-manager.h \ util-action.c util-action.h \ util-atomic.c util-atomic.h \ util-base64.c util-base64.h \ util-bloomfilter-counting.c util-bloomfilter-counting.h \ util-bloomfilter.c util-bloomfilter.h \ util-buffer.c util-buffer.h \ util-byte.c util-byte.h \ util-checksum.c util-checksum.h \ util-cidr.c util-cidr.h \ util-classification-config.c util-classification-config.h \ util-conf.c util-conf.h \ util-coredump-config.c util-coredump-config.h \ util-cpu.c util-cpu.h \ util-crypt.c util-crypt.h \ util-cuda.c util-cuda.h \ util-cuda-buffer.c util-cuda-buffer.h \ util-cuda-handlers.c util-cuda-handlers.h \ util-cuda-vars.c util-cuda-vars.h \ util-daemon.c util-daemon.h \ util-debug.c util-debug.h \ util-debug-filters.c util-debug-filters.h \ util-decode-asn1.c util-decode-asn1.h \ util-decode-der.c util-decode-der.h \ util-decode-der-get.c util-decode-der-get.h \ util-decode-mime.c util-decode-mime.h \ util-detect-file-hash.c util-detect-file-hash.h \ util-device.c util-device.h \ util-enum.c util-enum.h \ util-error.c util-error.h \ util-file.c util-file.h \ util-fix_checksum.c util-fix_checksum.h \ util-fmemopen.c util-fmemopen.h \ util-hash.c util-hash.h \ util-hashlist.c util-hashlist.h \ util-hash-lookup3.c util-hash-lookup3.h \ util-host-os-info.c util-host-os-info.h \ util-host-info.c util-host-info.h \ util-hyperscan.c util-hyperscan.h \ util-ioctl.h util-ioctl.c \ util-ip.h util-ip.c \ util-logopenfile.h util-logopenfile.c \ util-logopenfile-tile.h util-logopenfile-tile.c \ util-lua.c util-lua.h \ util-luajit.c util-luajit.h \ util-lua-common.c util-lua-common.h \ util-lua-dnp3.c util-lua-dnp3.h \ util-lua-dnp3-objects.c util-lua-dnp3-objects.h \ util-lua-dns.c util-lua-dns.h \ util-lua-http.c util-lua-http.h \ util-lua-tls.c util-lua-tls.h \ util-lua-ssh.c util-lua-ssh.h \ util-lua-smtp.c util-lua-smtp.h \ util-magic.c util-magic.h \ util-memcmp.c util-memcmp.h \ util-memcpy.h \ util-mem.h \ util-memrchr.c util-memrchr.h \ util-misc.c util-misc.h \ util-mpm-ac-bs.c util-mpm-ac-bs.h \ util-mpm-ac.c util-mpm-ac.h \ util-mpm-ac-tile.c util-mpm-ac-tile.h \ util-mpm-ac-tile-small.c \ util-mpm-hs.c util-mpm-hs.h \ util-mpm.c util-mpm.h \ util-optimize.h \ util-pages.c util-pages.h \ util-path.c util-path.h \ util-pidfile.c util-pidfile.h \ util-pool.c util-pool.h \ util-pool-thread.c util-pool-thread.h \ util-prefilter.c util-prefilter.h \ util-print.c util-print.h \ util-privs.c util-privs.h \ util-profiling.c util-profiling.h \ util-profiling-locks.c util-profiling-locks.h \ util-profiling-rules.c \ util-profiling-keywords.c \ util-profiling-rulegroups.c \ util-proto-name.c util-proto-name.h \ util-radix-tree.c util-radix-tree.h \ util-random.c util-random.h \ util-reference-config.c util-reference-config.h \ util-ringbuffer.c util-ringbuffer.h \ util-rohash.c util-rohash.h \ util-rule-vars.c util-rule-vars.h \ util-runmodes.c util-runmodes.h \ util-running-modes.c util-running-modes.h \ util-signal.c util-signal.h \ util-spm-bm.c util-spm-bm.h \ util-spm-bs2bm.c util-spm-bs2bm.h \ util-spm-bs.c util-spm-bs.h \ util-spm-hs.c util-spm-hs.h \ util-spm.c util-spm.h util-clock.h \ util-storage.c util-storage.h \ util-streaming-buffer.c util-streaming-buffer.h \ util-strlcatu.c \ util-strlcpyu.c \ util-syslog.c util-syslog.h \ util-threshold-config.c util-threshold-config.h \ util-time.c util-time.h \ util-unittest.c util-unittest.h \ util-unittest-helper.c util-unittest-helper.h \ util-validate.h util-affinity.h util-affinity.c \ util-var.c util-var.h \ util-var-name.c util-var-name.h \ util-vector.h \ win32-misc.c win32-misc.h \ win32-service.c win32-service.h \ win32-syslog.h EXTRA_DIST = util-mpm-ac-cuda-kernel.cu ptxdump.py # set the include path found by configure AM_CPPFLAGS = $(all_includes) # the library search path. suricata_LDFLAGS = $(all_libraries) ${SECLDFLAGS} suricata_LDADD = $(HTP_LDADD) # Rules to build CUDA ptx modules @BUILD_CUDA_TRUE@BUILT_SOURCES = cuda-ptxdump.h @BUILD_CUDA_TRUE@suricata_CUDA_KERNELS = \ @BUILD_CUDA_TRUE@util-mpm-ac-cuda-kernel.cu @BUILD_CUDA_TRUE@NVCCFLAGS = -O2 @BUILD_CUDA_TRUE@PTXS = $(suricata_CUDA_KERNELS:.cu=.ptx_sm_20) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_21) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_30) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_32) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_35) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_37) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_50) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_52) \ @BUILD_CUDA_TRUE@ $(suricata_CUDA_KERNELS:.cu=.ptx_sm_53) @BUILD_CUDA_TRUE@CLEANFILES = $(PTXS) cuda-ptxdump.h # default CFLAGS AM_CFLAGS = ${OPTIMIZATION_CFLAGS} ${GCC_CFLAGS} ${CLANG_CFLAGS} \ ${SECCFLAGS} ${PCAP_CFLAGS} -Wall -Wno-unused-parameter \ -std=gnu99 -DLOCAL_STATE_DIR=\"$(localstatedir)\" \ $(am__append_1) AM_LDFLAGS = ${SECLDFLAGS} all: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) all-am .SUFFIXES: .SUFFIXES: .c .cu .lo .o .obj .ptx_sm_20 .ptx_sm_21 .ptx_sm_30 .ptx_sm_32 .ptx_sm_35 .ptx_sm_37 .ptx_sm_50 .ptx_sm_52 .ptx_sm_53 $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu src/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): install-binPROGRAMS: $(bin_PROGRAMS) @$(NORMAL_INSTALL) @list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \ $(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \ fi; \ for p in $$list; do echo "$$p $$p"; done | \ sed 's/$(EXEEXT)$$//' | \ while read p p1; do if test -f $$p \ || test -f $$p1 \ ; then echo "$$p"; echo "$$p"; else :; fi; \ done | \ sed -e 'p;s,.*/,,;n;h' \ -e 's|.*|.|' \ -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \ sed 'N;N;N;s,\n, ,g' | \ $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \ { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ if ($$2 == $$4) files[d] = files[d] " " $$1; \ else { print "f", $$3 "/" $$4, $$1; } } \ END { for (d in files) print "f", d, files[d] }' | \ while read type dir files; do \ if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \ test -z "$$files" || { \ echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(bindir)$$dir'"; \ $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \ } \ ; done uninstall-binPROGRAMS: @$(NORMAL_UNINSTALL) @list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \ files=`for p in $$list; do echo "$$p"; done | \ sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \ -e 's/$$/$(EXEEXT)/' \ `; \ test -n "$$list" || exit 0; \ echo " ( cd '$(DESTDIR)$(bindir)' && rm -f" $$files ")"; \ cd "$(DESTDIR)$(bindir)" && rm -f $$files clean-binPROGRAMS: @list='$(bin_PROGRAMS)'; test -n "$$list" || exit 0; \ echo " rm -f" $$list; \ rm -f $$list || exit $$?; \ test -n "$(EXEEXT)" || exit 0; \ list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ echo " rm -f" $$list; \ rm -f $$list suricata$(EXEEXT): $(suricata_OBJECTS) $(suricata_DEPENDENCIES) $(EXTRA_suricata_DEPENDENCIES) @rm -f suricata$(EXEEXT) $(AM_V_CCLD)$(suricata_LINK) $(suricata_OBJECTS) $(suricata_LDADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alert-debuglog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alert-fastlog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alert-prelude.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alert-syslog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/alert-unified2-alert.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dcerpc-udp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dcerpc.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-detect-proto.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dnp3-objects.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dnp3.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dns-common.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dns-tcp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-dns-udp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-enip-common.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-enip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-events.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-ftp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp-body.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp-libhtp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp-mem.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp-xff.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-htp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-modbus.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-parser.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-protos.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-smb.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-smb2.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-smtp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-ssh.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-ssl.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-template.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer-tls-handshake.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/app-layer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf-yaml-loader.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/conf.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/counters.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/data-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-afl.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-erspan.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-ethernet.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-events.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-gre.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-icmpv4.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-icmpv6.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-ipv4.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-ipv6.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-mpls.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-null.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-ppp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-pppoe.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-raw.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-sctp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-sll.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-tcp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-template.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-teredo.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-udp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode-vlan.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/defrag-config.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/defrag-hash.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/defrag-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/defrag-timeout.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/defrag.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ack.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-app-layer-event.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-app-layer-protocol.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-asn1.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-base64-data.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-base64-decode.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-bypass.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-byte-extract.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-bytejump.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-bytetest.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-cipservice.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-classtype.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-content.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-csum.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dce-iface.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dce-opnum.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dce-stub-data.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-depth.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-detection-filter.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-distance.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dnp3.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dns-query.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-dsize.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-address-ipv4.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-address-ipv6.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-address.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-alert.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-analyzer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-content-inspection.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-dcepayload.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-dns.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-enip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-event.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-filedata-smtp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hcbd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hcd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hhd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hhhd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hmd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hrhd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hrhhd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hrud.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hsbd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hscd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hsmd.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-hua.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-iponly.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-loader.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-modbus.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-mpm.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-payload.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-port.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-prefilter-common.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-prefilter.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-profile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-proto.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-siggroup.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-sigorder.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-state.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-tag.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-template.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-threshold.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-tls.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine-uri.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-engine.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-fast-pattern.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-file-data.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-fileext.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filemagic.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filemd5.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filename.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filesha1.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filesha256.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filesize.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-filestore.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-flags.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-flow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-flowbits.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-flowint.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-flowvar.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-fragbits.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-fragoffset.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ftpbounce.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-geoip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-gid.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-hostbits.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-client-body.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-cookie.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-header.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-hh.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-hrh.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-method.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-raw-header.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-raw-uri.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-request-line.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-response-line.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-server-body.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-stat-code.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-stat-msg.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-ua.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-http-uri.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-icmp-id.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-icmp-seq.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-icode.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-id.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ipopts.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ipproto.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-iprep.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-isdataat.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-itype.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-l3proto.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-lua-extensions.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-lua.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-mark.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-metadata.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-modbus.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-msg.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-noalert.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-nocase.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-offset.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-parse.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-pcre.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-pkt-data.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-pktvar.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-prefilter.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-priority.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-rawbytes.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-reference.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-replace.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-rev.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-rpc.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-sameip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-seq.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-sid.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ssh-proto-version.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ssh-software-version.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ssl-state.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ssl-version.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-stream_size.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tag.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-template-buffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-template.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-threshold.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls-cert-issuer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls-cert-subject.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls-cert-validity.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls-sni.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls-version.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tls.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-tos.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-ttl.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-uricontent.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-urilen.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-window.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-within.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect-xbits.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/detect.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-bit.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-hash.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-manager.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-storage.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-timeout.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-util.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-var.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow-worker.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/host-bit.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/host-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/host-storage.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/host-timeout.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/host.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ippair-bit.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ippair-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ippair-storage.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ippair-timeout.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ippair.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-dnslog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-droplog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-filestore.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-httplog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-pcap.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-stats.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-tcp-data.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-tlslog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log-tlsstore.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-filedata.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-flow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-alert.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-dnp3-objects.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-dnp3.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-dns.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-drop.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-email-common.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-flow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-http.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-netflow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-smtp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-ssh.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-stats.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-template.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json-tls.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-json.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-lua.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-packet.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-stats.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-streaming.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output-tx.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/packet-queue.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pkt-var.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/reputation.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/respond-reject-libnet11.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/respond-reject.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-af-packet.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-erf-dag.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-erf-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-ipfw.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-napatech.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-netmap.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-nflog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-nfq.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-pcap-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-pcap.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-pfring.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-tile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-unittests.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmode-unix-socket.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/runmodes.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-af-packet.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-erf-dag.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-erf-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-ipfw.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-mpipe.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-napatech.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-netmap.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-nflog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-nfq.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-pcap-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-pcap.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/source-pfring.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream-tcp-inline.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream-tcp-reassemble.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream-tcp-sack.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream-tcp-util.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream-tcp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/suricata.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/threads.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tm-modules.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tm-queuehandlers.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tm-queues.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tm-threads.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tmqh-flow.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tmqh-nfq.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tmqh-packetpool.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tmqh-ringbuffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tmqh-simple.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/unix-manager.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-action.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-affinity.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-atomic.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-base64.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-bloomfilter-counting.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-bloomfilter.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-buffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-byte.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-checksum.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cidr.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-classification-config.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-conf.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-coredump-config.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cpu.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-crypt.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cuda-buffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cuda-handlers.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cuda-vars.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-cuda.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-daemon.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-debug-filters.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-debug.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-decode-asn1.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-decode-der-get.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-decode-der.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-decode-mime.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-detect-file-hash.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-device.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-enum.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-error.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-file.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-fix_checksum.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-fmemopen.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-hash-lookup3.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-hash.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-hashlist.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-host-info.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-host-os-info.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-hyperscan.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-ioctl.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-ip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-logopenfile-tile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-logopenfile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-common.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-dnp3-objects.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-dnp3.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-dns.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-http.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-smtp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-ssh.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua-tls.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-lua.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-luajit.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-magic.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-memcmp.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-memrchr.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-misc.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm-ac-bs.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm-ac-tile-small.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm-ac-tile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm-ac.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm-hs.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-mpm.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-pages.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-path.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-pidfile.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-pool-thread.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-pool.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-prefilter.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-print.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-privs.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-profiling-keywords.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-profiling-locks.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-profiling-rulegroups.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-profiling-rules.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-profiling.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-proto-name.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-radix-tree.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-random.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-reference-config.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-ringbuffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-rohash.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-rule-vars.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-runmodes.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-running-modes.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-signal.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-spm-bm.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-spm-bs.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-spm-bs2bm.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-spm-hs.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-spm.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-storage.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-streaming-buffer.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-strlcatu.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-strlcpyu.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-syslog.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-threshold-config.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-time.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-unittest-helper.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-unittest.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-var-name.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/util-var.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/win32-misc.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/win32-service.Po@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $< .c.obj: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .c.lo: @am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-am TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-am CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-am cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) check-am all-am: Makefile $(PROGRAMS) $(HEADERS) installdirs: for dir in "$(DESTDIR)$(bindir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." -test -z "$(BUILT_SOURCES)" || rm -f $(BUILT_SOURCES) clean: clean-am clean-am: clean-binPROGRAMS clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -rf ./$(DEPDIR) -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-local distclean-tags dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-binPROGRAMS install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-binPROGRAMS .MAKE: all check install install-am install-strip .PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \ clean-binPROGRAMS clean-generic clean-libtool cscopelist-am \ ctags ctags-am distclean distclean-compile distclean-generic \ distclean-libtool distclean-local distclean-tags distdir dvi \ dvi-am html html-am info info-am install install-am \ install-binPROGRAMS install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \ uninstall-binPROGRAMS .PRECIOUS: Makefile @BUILD_CUDA_TRUE@.cu.ptx_sm_20: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_20 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_21: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_21 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_30: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_30 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_32: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_32 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_35: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_35 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_37: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_37 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_50: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_50 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_52: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_52 -ptx $< @BUILD_CUDA_TRUE@.cu.ptx_sm_53: @BUILD_CUDA_TRUE@ $(NVCC) $(NVCCFLAGS) -o $@ -arch=sm_53 -ptx $< @BUILD_CUDA_TRUE@cuda-ptxdump.h: $(PTXS) @BUILD_CUDA_TRUE@ $(PYTHON) ptxdump.py cuda-ptxdump $(PTXS) @BUILD_UNITTESTS_TRUE@check-am: @BUILD_UNITTESTS_TRUE@ -mkdir $(top_builddir)/qa/log/ @BUILD_UNITTESTS_TRUE@ $(top_builddir)/src/suricata -u -l $(top_builddir)/qa/log/ @BUILD_UNITTESTS_TRUE@ -rm -rf $(top_builddir)/qa/log distclean-local: -rm -rf $(top_builddir)/src/build-info.h # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/src/detect-msg.c0000644000000000000000000001525513051004444013211 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the msg keyword */ #include "suricata-common.h" #include "detect.h" #include "util-classification-config.h" #include "util-debug.h" #include "util-unittest.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" static int DetectMsgSetup (DetectEngineCtx *, Signature *, char *); void DetectMsgRegisterTests(void); void DetectMsgRegister (void) { sigmatch_table[DETECT_MSG].name = "msg"; sigmatch_table[DETECT_MSG].desc = "information about the rule and the possible alert"; sigmatch_table[DETECT_MSG].url = DOC_URL DOC_VERSION "/rules/meta.html#msg-message"; sigmatch_table[DETECT_MSG].Match = NULL; sigmatch_table[DETECT_MSG].Setup = DetectMsgSetup; sigmatch_table[DETECT_MSG].Free = NULL; sigmatch_table[DETECT_MSG].RegisterTests = DetectMsgRegisterTests; } static int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char *msgstr) { char *str = NULL; uint16_t len; uint16_t pos = 0; uint16_t slen = 0; slen = strlen(msgstr); if (slen == 0) goto error; /* skip the first spaces */ while (pos < slen && isspace((unsigned char)msgstr[pos])) pos++; /* Strip leading and trailing "s. */ if (msgstr[pos] == '\"') { str = SCStrdup(msgstr + pos + 1); if (unlikely(str == NULL)) goto error; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str)-1] = '\0'; } } else { SCLogError(SC_ERR_INVALID_VALUE, "format error \'%s\'", msgstr); goto error; } len = strlen(str); if (len == 0) goto error; char converted = 0; { uint16_t i, x; uint8_t escape = 0; /* it doesn't matter if we need to escape or not we remove the extra "\" to mimic snort */ for (i = 0, x = 0; i < len; i++) { //printf("str[%02u]: %c\n", i, str[i]); if(!escape && str[i] == '\\') { escape = 1; } else if (escape) { if (str[i] != ':' && str[i] != ';' && str[i] != '\\' && str[i] != '\"') { SCLogDebug("character \"%c\" does not need to be escaped but is" ,str[i]); } escape = 0; converted = 1; str[x] = str[i]; x++; }else{ str[x] = str[i]; x++; } } #if 0 //def DEBUG if (SCLogDebugEnabled()) { for (i = 0; i < x; i++) { printf("%c", str[i]); } printf("\n"); } #endif if (converted) { len = x; str[len] = '\0'; } } s->msg = SCMalloc(len + 1); if (s->msg == NULL) goto error; strlcpy(s->msg, str, len + 1); SCFree(str); return 0; error: SCFree(str); return -1; } /* -------------------------------------Unittests-----------------------------*/ #ifdef UNITTESTS static int DetectMsgParseTest01(void) { int result = 0; Signature *sig = NULL; char *teststringparsed = "flow stateless to_server"; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"flow stateless to_server\"; flow:stateless,to_server; content:\"flowstatelesscheck\"; classtype:bad-unknown; sid: 40000002; rev: 1;)"); if(sig == NULL) goto end; if (strcmp(sig->msg, teststringparsed) != 0) { printf("got \"%s\", expected: \"%s\": ", sig->msg, teststringparsed); goto end; } result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int DetectMsgParseTest02(void) { int result = 0; Signature *sig = NULL; char *teststringparsed = "msg escape tests wxy'\"\\;:"; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"msg escape tests \\w\\x\\y\\'\\\"\\\\;\\:\"; flow:to_server,established; content:\"blah\"; uricontent:\"/blah/\"; sid: 100;)"); if(sig == NULL) goto end; if (strcmp(sig->msg, teststringparsed) != 0) { printf("got \"%s\", expected: \"%s\": ",sig->msg, teststringparsed); goto end; } result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int DetectMsgParseTest03(void) { int result = 0; Signature *sig = NULL; char *teststringparsed = "flow stateless to_server"; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); sig = SigInit(de_ctx, "alert tcp any any -> any any (msg: \"flow stateless to_server\"; flow:stateless,to_server; content:\"flowstatelesscheck\"; classtype:bad-unknown; sid: 40000002; rev: 1;)"); if(sig == NULL) goto end; if (strcmp(sig->msg, teststringparsed) != 0) { printf("got \"%s\", expected: \"%s\": ", sig->msg, teststringparsed); goto end; } result = 1; end: if (sig != NULL) SigFree(sig); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectMsg */ void DetectMsgRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectMsgParseTest01", DetectMsgParseTest01); UtRegisterTest("DetectMsgParseTest02", DetectMsgParseTest02); UtRegisterTest("DetectMsgParseTest03", DetectMsgParseTest03); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-nflog.h0000644000000000000000000000330513051004444013556 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo */ #ifndef __SOURCE_NFLOG_H__ #define __SOURCE_NFLOG_H__ #ifdef HAVE_NFLOG #include #include #endif /* HAVE_NFLOG */ #define NFLOG_GROUP_NAME_LENGTH 48 typedef struct NflogGroupConfig_ { /* nflog's group */ uint16_t group; /* netlink buffer size */ uint32_t nlbufsiz; /* netlink max buffer size */ uint32_t nlbufsiz_max; /* max amount of logs in buffer*/ uint32_t qthreshold; /* max time to push log buffer */ uint32_t qtimeout; /* used to initialize livedev */ char numgroup[NFLOG_GROUP_NAME_LENGTH]; int nful_overrun_warned; void (*DerefFunc)(void *); } NflogGroupConfig; typedef struct NFLOGPacketVars_ { uint32_t mark; uint32_t ifi; uint32_t ifo; uint16_t hw_protocol; } NFLOGPacketVars; void TmModuleReceiveNFLOGRegister(void); void TmModuleDecodeNFLOGRegister(void); #endif /* __SOURCE_NFLOG_H__ */ suricata-3.2.1/src/ippair-queue.h0000644000000000000000000000447213051004444013567 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __IPPAIR_QUEUE_H__ #define __IPPAIR_QUEUE_H__ #include "suricata-common.h" #include "ippair.h" /** Spinlocks or Mutex for the ippair queues. */ //#define HQLOCK_SPIN #define HQLOCK_MUTEX #ifdef HQLOCK_SPIN #ifdef HQLOCK_MUTEX #error Cannot enable both HQLOCK_SPIN and HQLOCK_MUTEX #endif #endif /* Define a queue for storing ippairs */ typedef struct IPPairQueue_ { IPPair *top; IPPair *bot; uint32_t len; #ifdef DBG_PERF uint32_t dbg_maxlen; #endif /* DBG_PERF */ #ifdef HQLOCK_MUTEX SCMutex m; #elif defined HQLOCK_SPIN SCSpinlock s; #else #error Enable HQLOCK_SPIN or HQLOCK_MUTEX #endif } IPPairQueue; #ifdef HQLOCK_SPIN #define HQLOCK_INIT(q) SCSpinInit(&(q)->s, 0) #define HQLOCK_DESTROY(q) SCSpinDestroy(&(q)->s) #define HQLOCK_LOCK(q) SCSpinLock(&(q)->s) #define HQLOCK_TRYLOCK(q) SCSpinTrylock(&(q)->s) #define HQLOCK_UNLOCK(q) SCSpinUnlock(&(q)->s) #elif defined HQLOCK_MUTEX #define HQLOCK_INIT(q) SCMutexInit(&(q)->m, NULL) #define HQLOCK_DESTROY(q) SCMutexDestroy(&(q)->m) #define HQLOCK_LOCK(q) SCMutexLock(&(q)->m) #define HQLOCK_TRYLOCK(q) SCMutexTrylock(&(q)->m) #define HQLOCK_UNLOCK(q) SCMutexUnlock(&(q)->m) #else #error Enable HQLOCK_SPIN or HQLOCK_MUTEX #endif /* prototypes */ IPPairQueue *IPPairQueueNew(); IPPairQueue *IPPairQueueInit(IPPairQueue *); void IPPairQueueDestroy (IPPairQueue *); void IPPairEnqueue (IPPairQueue *, IPPair *); IPPair *IPPairDequeue (IPPairQueue *); uint32_t IPPairQueueLen(IPPairQueue *); #endif /* __IPPAIR_QUEUE_H__ */ suricata-3.2.1/src/detect-engine-mpm.c0000644000000000000000000012507113051004444014455 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Multi pattern matcher */ #include "suricata.h" #include "suricata-common.h" #include "app-layer-protos.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-siggroup.h" #include "detect-engine-mpm.h" #include "detect-engine-iponly.h" #include "detect-parse.h" #include "util-mpm.h" #include "util-memcmp.h" #include "util-memcpy.h" #include "conf.h" #include "detect-fast-pattern.h" #include "flow.h" #include "flow-var.h" #include "detect-flow.h" #include "detect-content.h" #include "detect-engine-payload.h" #include "detect-engine-uri.h" #include "detect-engine-hrud.h" #include "detect-engine-hmd.h" #include "detect-engine-hhd.h" #include "detect-engine-hrhd.h" #include "detect-engine-hcd.h" #include "detect-engine-hua.h" #include "detect-engine-hhhd.h" #include "detect-engine-hrhhd.h" #include "detect-engine-hsmd.h" #include "detect-engine-hscd.h" #include "detect-engine-hcbd.h" #include "detect-engine-hsbd.h" #include "detect-engine-dns.h" #include "detect-engine-filedata-smtp.h" #include "detect-engine-tls.h" #include "stream.h" #include "util-enum.h" #include "util-debug.h" #include "util-print.h" #include "util-validate.h" const char *builtin_mpms[] = { "toserver TCP packet", "toclient TCP packet", "toserver TCP stream", "toclient TCP stream", "toserver UDP packet", "toclient UDP packet", "other IP packet", NULL }; /* Registery for mpm keywords * * Keywords are registered at engine start up */ static DetectMpmAppLayerRegistery *g_app_mpms_list = NULL; static int g_app_mpms_list_cnt = 0; void DetectMpmAppLayerRegister(const char *name, int direction, int sm_list, int priority, int (*PrefilterRegister)(SigGroupHead *sgh, MpmCtx *mpm_ctx)) { DetectMpmAppLayerRegistery *am = SCCalloc(1, sizeof(*am)); BUG_ON(am == NULL); am->name = name; am->direction = direction; am->sm_list = sm_list; am->PrefilterRegister = PrefilterRegister; if (g_app_mpms_list == NULL) { g_app_mpms_list = am; } else { DetectMpmAppLayerRegistery *t = g_app_mpms_list; while (t->next != NULL) { t = t->next; } t->next = am; am->id = t->id + 1; } g_app_mpms_list_cnt++; SupportFastPatternForSigMatchList(sm_list, priority); } void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx) { BUG_ON(g_app_mpms_list_cnt == 0); de_ctx->app_mpms = SCCalloc(g_app_mpms_list_cnt + 1, sizeof(DetectMpmAppLayerKeyword)); BUG_ON(de_ctx->app_mpms == NULL); DetectMpmAppLayerRegistery *list = g_app_mpms_list; while (list != NULL) { DetectMpmAppLayerKeyword *am = &de_ctx->app_mpms[list->id]; am->reg = list; /* default to whatever the global setting is */ int shared = (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE); /* see if we use a unique or shared mpm ctx for this type */ int confshared = 0; char confstring[256] = "detect.mpm."; strlcat(confstring, am->reg->name, sizeof(confstring)); strlcat(confstring, ".shared", sizeof(confstring)); if (ConfGetBool(confstring, &confshared) == 1) shared = confshared; if (shared == 0) { if (!(de_ctx->flags & DE_QUIET)) { SCLogPerf("using unique mpm ctx' for %s", am->reg->name); } am->sgh_mpm_context = MPM_CTX_FACTORY_UNIQUE_CONTEXT; } else { if (!(de_ctx->flags & DE_QUIET)) { SCLogPerf("using shared mpm ctx' for %s", am->reg->name); } am->sgh_mpm_context = MpmFactoryRegisterMpmCtxProfile(de_ctx, am->reg->name); } SCLogDebug("AppLayer MPM %s: %u", am->reg->name, am->sgh_mpm_context); list = list->next; } } /** * \brief initialize mpm contexts for applayer buffers that are in * "single or "shared" mode. */ void DetectMpmPrepareAppMpms(DetectEngineCtx *de_ctx) { DetectMpmAppLayerKeyword *am = de_ctx->app_mpms; while (am->reg != NULL) { int dir = (am->reg->direction == SIG_FLAG_TOSERVER) ? 1 : 0; if (am->sgh_mpm_context != MPM_CTX_FACTORY_UNIQUE_CONTEXT) { MpmCtx *mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, am->sgh_mpm_context, dir); if (mpm_ctx != NULL) { if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } } } am++; } } static int32_t SetupBuiltinMpm(DetectEngineCtx *de_ctx, const char *name) { /* default to whatever the global setting is */ int shared = (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE); /* see if we use a unique or shared mpm ctx for this type */ int confshared = 0; char confstring[256] = "detect.mpm."; strlcat(confstring, name, sizeof(confstring)); strlcat(confstring, ".shared", sizeof(confstring)); if (ConfGetBool(confstring, &confshared) == 1) shared = confshared; int32_t ctx; if (shared == 0) { ctx = MPM_CTX_FACTORY_UNIQUE_CONTEXT; SCLogPerf("using unique mpm ctx' for %s", name); } else { ctx = MpmFactoryRegisterMpmCtxProfile(de_ctx, name); SCLogPerf("using shared mpm ctx' for %s", name); } return ctx; } void DetectMpmInitializeBuiltinMpms(DetectEngineCtx *de_ctx) { de_ctx->sgh_mpm_context_proto_tcp_packet = SetupBuiltinMpm(de_ctx, "tcp-packet"); de_ctx->sgh_mpm_context_stream = SetupBuiltinMpm(de_ctx, "tcp-stream"); de_ctx->sgh_mpm_context_proto_udp_packet = SetupBuiltinMpm(de_ctx, "udp-packet"); de_ctx->sgh_mpm_context_proto_other_packet = SetupBuiltinMpm(de_ctx, "other-ip"); } /** * \brief initialize mpm contexts for builtin buffers that are in * "single or "shared" mode. */ void DetectMpmPrepareBuiltinMpms(DetectEngineCtx *de_ctx) { MpmCtx *mpm_ctx = NULL; if (de_ctx->sgh_mpm_context_proto_tcp_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) { mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_tcp_packet, 1); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } } if (de_ctx->sgh_mpm_context_proto_udp_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) { mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_udp_packet, 1); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } } if (de_ctx->sgh_mpm_context_proto_other_packet != MPM_CTX_FACTORY_UNIQUE_CONTEXT) { mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_proto_other_packet, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } } if (de_ctx->sgh_mpm_context_stream != MPM_CTX_FACTORY_UNIQUE_CONTEXT) { mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 0); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, de_ctx->sgh_mpm_context_stream, 1); if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) { mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx); } } } /** * \brief check if a signature has patterns that are to be inspected * against a packets payload (as opposed to the stream payload) * * \param s signature * * \retval 1 true * \retval 0 false */ int SignatureHasPacketContent(const Signature *s) { SCEnter(); if (s == NULL) { SCReturnInt(0); } if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) { SCReturnInt(1); } if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCLogDebug("no mpm"); SCReturnInt(0); } if (!(s->flags & SIG_FLAG_REQUIRE_PACKET)) { SCReturnInt(0); } SCReturnInt(1); } /** * \brief check if a signature has patterns that are to be inspected * against the stream payload (as opposed to the individual packets * payload(s)) * * \param s signature * * \retval 1 true * \retval 0 false */ int SignatureHasStreamContent(const Signature *s) { SCEnter(); if (s == NULL) { SCReturnInt(0); } if (!(s->proto.proto[IPPROTO_TCP / 8] & 1 << (IPPROTO_TCP % 8))) { SCReturnInt(0); } if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCLogDebug("no mpm"); SCReturnInt(0); } if (!(s->flags & SIG_FLAG_REQUIRE_STREAM)) { SCReturnInt(0); } SCReturnInt(1); } /** * \brief Function to return the multi pattern matcher algorithm to be * used by the engine, based on the mpm-algo setting in yaml * Use the default mpm if none is specified in the yaml file. * * \retval mpm algo value */ uint16_t PatternMatchDefaultMatcher(void) { char *mpm_algo; uint16_t mpm_algo_val = mpm_default_matcher; /* Get the mpm algo defined in config file by the user */ if ((ConfGet("mpm-algo", &mpm_algo)) == 1) { uint16_t u; if (mpm_algo != NULL) { #if __BYTE_ORDER == __BIG_ENDIAN if (strcmp(mpm_algo, "ac-ks") == 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "ac-ks does " "not work on big endian systems at this time."); exit(EXIT_FAILURE); } #endif if (strcmp("auto", mpm_algo) == 0) { goto done; } for (u = 0; u < MPM_TABLE_SIZE; u++) { if (mpm_table[u].name == NULL) continue; if (strcmp(mpm_table[u].name, mpm_algo) == 0) { mpm_algo_val = u; goto done; } } } SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid mpm algo supplied " "in the yaml conf file: \"%s\"", mpm_algo); exit(EXIT_FAILURE); } done: #ifdef __tile__ if (mpm_algo_val == MPM_AC) mpm_algo_val = MPM_AC_TILE; #endif return mpm_algo_val; } /** \brief cleans up the mpm instance after a match */ void PacketPatternCleanup(ThreadVars *t, DetectEngineThreadCtx *det_ctx) { PmqReset(&det_ctx->pmq); } void PatternMatchDestroy(MpmCtx *mpm_ctx, uint16_t mpm_matcher) { SCLogDebug("mpm_ctx %p, mpm_matcher %"PRIu16"", mpm_ctx, mpm_matcher); mpm_table[mpm_matcher].DestroyCtx(mpm_ctx); } void PatternMatchPrepare(MpmCtx *mpm_ctx, uint16_t mpm_matcher) { SCLogDebug("mpm_ctx %p, mpm_matcher %"PRIu16"", mpm_ctx, mpm_matcher); MpmInitCtx(mpm_ctx, mpm_matcher); } void PatternMatchThreadPrint(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher) { SCLogDebug("mpm_thread_ctx %p, mpm_matcher %"PRIu16" defunct", mpm_thread_ctx, mpm_matcher); //mpm_table[mpm_matcher].PrintThreadCtx(mpm_thread_ctx); } void PatternMatchThreadDestroy(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher) { SCLogDebug("mpm_thread_ctx %p, mpm_matcher %"PRIu16"", mpm_thread_ctx, mpm_matcher); if (mpm_table[mpm_matcher].DestroyThreadCtx != NULL) mpm_table[mpm_matcher].DestroyThreadCtx(NULL, mpm_thread_ctx); } void PatternMatchThreadPrepare(MpmThreadCtx *mpm_thread_ctx, uint16_t mpm_matcher) { SCLogDebug("mpm_thread_ctx %p, type %"PRIu16, mpm_thread_ctx, mpm_matcher); MpmInitThreadCtx(mpm_thread_ctx, mpm_matcher); } /** \brief Predict a strength value for patterns * * Patterns with high character diversity score higher. * Alpha chars score not so high * Other printable + a few common codes a little higher * Everything else highest. * Longer patterns score better than short patters. * * \param pat pattern * \param patlen length of the patternn * * \retval s pattern score */ uint32_t PatternStrength(uint8_t *pat, uint16_t patlen) { uint8_t a[256]; memset(&a, 0 ,sizeof(a)); uint32_t s = 0; uint16_t u = 0; for (u = 0; u < patlen; u++) { if (a[pat[u]] == 0) { if (isalpha(pat[u])) s += 3; else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF) s += 4; else s += 6; a[pat[u]] = 1; } else { s++; } } return s; } static void PopulateMpmHelperAddPattern(MpmCtx *mpm_ctx, const DetectContentData *cd, const Signature *s, uint8_t flags, int chop) { uint16_t pat_offset = cd->offset; uint16_t pat_depth = cd->depth; /* recompute offset/depth to cope with chop */ if (chop && (pat_depth || pat_offset)) { pat_offset += cd->fp_chop_offset; if (pat_depth) { pat_depth -= cd->content_len; pat_depth += cd->fp_chop_offset + cd->fp_chop_len; } } if (cd->flags & DETECT_CONTENT_NOCASE) { if (chop) { MpmAddPatternCI(mpm_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len, pat_offset, pat_depth, cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID); } else { MpmAddPatternCI(mpm_ctx, cd->content, cd->content_len, pat_offset, pat_depth, cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID); } } else { if (chop) { MpmAddPatternCS(mpm_ctx, cd->content + cd->fp_chop_offset, cd->fp_chop_len, pat_offset, pat_depth, cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID); } else { MpmAddPatternCS(mpm_ctx, cd->content, cd->content_len, pat_offset, pat_depth, cd->id, s->num, flags|MPM_PATTERN_CTX_OWNS_ID); } } return; } #define SGH_PROTO(sgh, p) ((sgh)->init->protos[(p)] == 1) #define SGH_DIRECTION_TS(sgh) ((sgh)->init->direction & SIG_FLAG_TOSERVER) #define SGH_DIRECTION_TC(sgh) ((sgh)->init->direction & SIG_FLAG_TOCLIENT) static void SetMpm(Signature *s, SigMatch *mpm_sm) { if (s == NULL || mpm_sm == NULL) return; DetectContentData *cd = (DetectContentData *)mpm_sm->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { if (DETECT_CONTENT_IS_SINGLE(cd) && !(cd->flags & DETECT_CONTENT_NEGATED) && !(cd->flags & DETECT_CONTENT_REPLACE) && cd->content_len == cd->fp_chop_len) { cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED; } } else { if (DETECT_CONTENT_IS_SINGLE(cd) && !(cd->flags & DETECT_CONTENT_NEGATED) && !(cd->flags & DETECT_CONTENT_REPLACE)) { cd->flags |= DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED; } } s->mpm_sm = mpm_sm; return; } void RetrieveFPForSig(Signature *s) { if (s->mpm_sm != NULL) return; SigMatch *mpm_sm = NULL, *sm = NULL; int nn_sm_list[DETECT_SM_LIST_MAX]; int n_sm_list[DETECT_SM_LIST_MAX]; memset(nn_sm_list, 0, sizeof(nn_sm_list)); memset(n_sm_list, 0, sizeof(n_sm_list)); int count_nn_sm_list = 0; int count_n_sm_list = 0; int list_id; /* inspect rule to see if we have the fast_pattern reg to * force using a sig, otherwise keep stats about the patterns */ for (list_id = 0; list_id < DETECT_SM_LIST_DETECT_MAX; list_id++) { if (s->sm_lists[list_id] == NULL) continue; if (!FastPatternSupportEnabledForSigMatchList(list_id)) continue; for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; DetectContentData *cd = (DetectContentData *)sm->ctx; /* fast_pattern set in rule, so using this pattern */ if ((cd->flags & DETECT_CONTENT_FAST_PATTERN)) { SetMpm(s, sm); return; } if (cd->flags & DETECT_CONTENT_NEGATED) { n_sm_list[list_id] = 1; count_n_sm_list++; } else { nn_sm_list[list_id] = 1; count_nn_sm_list++; } } } /* prefer normal not-negated over negated */ int *curr_sm_list = NULL; int skip_negated_content = 1; if (count_nn_sm_list > 0) { curr_sm_list = nn_sm_list; } else if (count_n_sm_list > 0) { curr_sm_list = n_sm_list; skip_negated_content = 0; } else { return; } int final_sm_list[DETECT_SM_LIST_DETECT_MAX] = { 0 }; int count_final_sm_list = 0; int priority; SCFPSupportSMList *tmp = sm_fp_support_smlist_list; while (tmp != NULL) { for (priority = tmp->priority; tmp != NULL && priority == tmp->priority; tmp = tmp->next) { if (curr_sm_list[tmp->list_id] == 0) continue; final_sm_list[count_final_sm_list++] = tmp->list_id; } if (count_final_sm_list != 0) break; } BUG_ON(count_final_sm_list == 0); int max_len = 0; int i; for (i = 0; i < count_final_sm_list; i++) { for (sm = s->sm_lists[final_sm_list[i]]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; DetectContentData *cd = (DetectContentData *)sm->ctx; /* skip_negated_content is only set if there's absolutely no * non-negated content present in the sig */ if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content) continue; if (max_len < cd->content_len) max_len = cd->content_len; } } for (i = 0; i < count_final_sm_list; i++) { for (sm = s->sm_lists[final_sm_list[i]]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; DetectContentData *cd = (DetectContentData *)sm->ctx; /* skip_negated_content is only set if there's absolutely no * non-negated content present in the sig */ if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content) continue; if (cd->content_len != max_len) continue; if (mpm_sm == NULL) { mpm_sm = sm; } else { DetectContentData *data1 = (DetectContentData *)sm->ctx; DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx; uint32_t ls = PatternStrength(data1->content, data1->content_len); uint32_t ss = PatternStrength(data2->content, data2->content_len); if (ls > ss) { mpm_sm = sm; } else if (ls == ss) { /* if 2 patterns are of equal strength, we pick the longest */ if (data1->content_len > data2->content_len) mpm_sm = sm; } else { SCLogDebug("sticking with mpm_sm"); } } } } /* assign to signature */ SetMpm(s, mpm_sm); return; } /** \internal * \brief The hash function for MpmStore * * \param ht Pointer to the hash table. * \param data Pointer to the MpmStore. * \param datalen Not used in our case. * * \retval hash The generated hash value. */ static uint32_t MpmStoreHashFunc(HashListTable *ht, void *data, uint16_t datalen) { const MpmStore *ms = (MpmStore *)data; uint32_t hash = 0; uint32_t b = 0; for (b = 0; b < ms->sid_array_size; b++) hash += ms->sid_array[b]; return hash % ht->array_size; } /** * \brief The Compare function for MpmStore * * \param data1 Pointer to the first MpmStore. * \param len1 Not used. * \param data2 Pointer to the second MpmStore. * \param len2 Not used. * * \retval 1 If the 2 MpmStores sent as args match. * \retval 0 If the 2 MpmStores sent as args do not match. */ static char MpmStoreCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { const MpmStore *ms1 = (MpmStore *)data1; const MpmStore *ms2 = (MpmStore *)data2; if (ms1->sid_array_size != ms2->sid_array_size) return 0; if (ms1->buffer != ms2->buffer) return 0; if (ms1->direction != ms2->direction) return 0; if (ms1->sm_list != ms2->sm_list) return 0; if (SCMemcmp(ms1->sid_array, ms2->sid_array, ms1->sid_array_size) != 0) { return 0; } return 1; } static void MpmStoreFreeFunc(void *ptr) { MpmStore *ms = ptr; if (ms != NULL) { if (ms->mpm_ctx != NULL && !ms->mpm_ctx->global) { SCLogDebug("destroying mpm_ctx %p", ms->mpm_ctx); mpm_table[ms->mpm_ctx->mpm_type].DestroyCtx(ms->mpm_ctx); SCFree(ms->mpm_ctx); } ms->mpm_ctx = NULL; SCFree(ms->sid_array); SCFree(ms); } } /** * \brief Initializes the MpmStore mpm hash table to be used by the detection * engine context. * * \param de_ctx Pointer to the detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int MpmStoreInit(DetectEngineCtx *de_ctx) { de_ctx->mpm_hash_table = HashListTableInit(4096, MpmStoreHashFunc, MpmStoreCompareFunc, MpmStoreFreeFunc); if (de_ctx->mpm_hash_table == NULL) goto error; return 0; error: return -1; } /** * \brief Adds a MpmStore to the detection engine context MpmStore * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the MpmStore. * * \retval ret 0 on Successfully adding the argument sgh; -1 on failure. */ static int MpmStoreAdd(DetectEngineCtx *de_ctx, MpmStore *s) { int ret = HashListTableAdd(de_ctx->mpm_hash_table, (void *)s, 0); return ret; } /** * \brief Used to lookup a MpmStore from the MpmStore * * \param de_ctx Pointer to the detection engine context. * \param sgh Pointer to the MpmStore. * * \retval rsgh On success a pointer to the MpmStore if the MpmStore is * found in the hash table; NULL on failure. */ static MpmStore *MpmStoreLookup(DetectEngineCtx *de_ctx, MpmStore *s) { MpmStore *rs = HashListTableLookup(de_ctx->mpm_hash_table, (void *)s, 0); return rs; } void MpmStoreReportStats(const DetectEngineCtx *de_ctx) { HashListTableBucket *htb = NULL; int app_mpms_cnt = 0; DetectMpmAppLayerKeyword *a = de_ctx->app_mpms; while (a->reg != NULL) { a++; app_mpms_cnt++; } uint32_t stats[MPMB_MAX] = {0}; uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build memset(&appstats, 0x00, sizeof(appstats)); for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table); htb != NULL; htb = HashListTableGetListNext(htb)) { const MpmStore *ms = (MpmStore *)HashListTableGetListData(htb); if (ms == NULL) { continue; } if (ms->buffer < MPMB_MAX) stats[ms->buffer]++; else if (ms->sm_list != DETECT_SM_LIST_PMATCH) { int i = 0; DetectMpmAppLayerKeyword *am = de_ctx->app_mpms; while (am->reg != NULL) { if (ms->sm_list == am->reg->sm_list && ms->direction == am->reg->direction) { SCLogDebug("%s %s: %u patterns. Min %u, Max %u. Ctx %p", am->reg->name, am->reg->direction == SIG_FLAG_TOSERVER ? "toserver":"toclient", ms->mpm_ctx->pattern_cnt, ms->mpm_ctx->minlen, ms->mpm_ctx->maxlen, ms->mpm_ctx); appstats[i]++; break; } i++; am++; } } } if (!(de_ctx->flags & DE_QUIET)) { int x; for (x = 0; x < MPMB_MAX; x++) { SCLogPerf("Builtin MPM \"%s\": %u", builtin_mpms[x], stats[x]); } for (x = 0; x < app_mpms_cnt; x++) { if (appstats[x] == 0) continue; const char *name = de_ctx->app_mpms[x].reg->name; char *direction = de_ctx->app_mpms[x].reg->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient"; SCLogPerf("AppLayer MPM \"%s %s\": %u", direction, name, appstats[x]); } } } /** * \brief Frees the hash table - DetectEngineCtx->mpm_hash_table, allocated by * MpmStoreInit() function. * * \param de_ctx Pointer to the detection engine context. */ void MpmStoreFree(DetectEngineCtx *de_ctx) { if (de_ctx->mpm_hash_table == NULL) return; HashListTableFree(de_ctx->mpm_hash_table); de_ctx->mpm_hash_table = NULL; return; } void MpmStoreSetup(const DetectEngineCtx *de_ctx, MpmStore *ms) { const Signature *s = NULL; uint32_t sig; int dir = 0; if (ms->buffer != MPMB_MAX) { BUG_ON(ms->sm_list != DETECT_SM_LIST_PMATCH); switch (ms->buffer) { /* TS is 1 */ case MPMB_TCP_PKT_TS: case MPMB_TCP_STREAM_TS: case MPMB_UDP_TS: dir = 1; break; /* TC is 0 */ default: case MPMB_UDP_TC: case MPMB_TCP_STREAM_TC: case MPMB_TCP_PKT_TC: case MPMB_OTHERIP: /**< use 0 for other */ dir = 0; break; } } else { BUG_ON(ms->sm_list == DETECT_SM_LIST_PMATCH); BUG_ON(ms->direction == 0); BUG_ON(ms->direction == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)); if (ms->direction == SIG_FLAG_TOSERVER) dir = 1; else dir = 0; } ms->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx, ms->sgh_mpm_context, dir); if (ms->mpm_ctx == NULL) return; MpmInitCtx(ms->mpm_ctx, de_ctx->mpm_matcher); /* add the patterns */ for (sig = 0; sig < (ms->sid_array_size * 8); sig++) { if (ms->sid_array[sig / 8] & (1 << (sig % 8))) { s = de_ctx->sig_array[sig]; if (s == NULL) continue; if (s->mpm_sm == NULL) continue; int list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (list < 0) continue; if (list != ms->sm_list) continue; if ((s->flags & ms->direction) == 0) continue; SCLogDebug("adding %u", s->id); const DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; int skip = 0; /* negated logic: if mpm match can't be used to be sure about this * pattern, we have to inspect the rule fully regardless of mpm * match. So in this case there is no point of adding it at all. * The non-mpm list entry for the sig will make sure the sig is * inspected. */ if ((cd->flags & DETECT_CONTENT_NEGATED) && !(DETECT_CONTENT_MPM_IS_CONCLUSIVE(cd))) { skip = 1; SCLogDebug("not adding negated mpm as it's not 'single'"); } if (!skip) { PopulateMpmHelperAddPattern(ms->mpm_ctx, cd, s, 0, (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP)); } } } if (ms->mpm_ctx->pattern_cnt == 0) { MpmFactoryReClaimMpmCtx(de_ctx, ms->mpm_ctx); ms->mpm_ctx = NULL; } else { if (ms->sgh_mpm_context == MPM_CTX_FACTORY_UNIQUE_CONTEXT) { if (mpm_table[ms->mpm_ctx->mpm_type].Prepare != NULL) { mpm_table[ms->mpm_ctx->mpm_type].Prepare(ms->mpm_ctx); } } } } /** \brief Get MpmStore for a built-in buffer type * */ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, enum MpmBuiltinBuffers buf) { const Signature *s = NULL; uint32_t sig; uint32_t cnt = 0; int direction = 0; uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1; uint8_t sids_array[max_sid]; memset(sids_array, 0x00, max_sid); int sgh_mpm_context = 0; switch (buf) { case MPMB_TCP_PKT_TS: case MPMB_TCP_PKT_TC: sgh_mpm_context = de_ctx->sgh_mpm_context_proto_tcp_packet; break; case MPMB_TCP_STREAM_TS: case MPMB_TCP_STREAM_TC: sgh_mpm_context = de_ctx->sgh_mpm_context_stream; break; case MPMB_UDP_TS: case MPMB_UDP_TC: sgh_mpm_context = de_ctx->sgh_mpm_context_proto_udp_packet; break; case MPMB_OTHERIP: sgh_mpm_context = de_ctx->sgh_mpm_context_proto_other_packet; break; default: break; } switch(buf) { case MPMB_TCP_PKT_TS: case MPMB_TCP_STREAM_TS: case MPMB_UDP_TS: direction = SIG_FLAG_TOSERVER; break; case MPMB_TCP_PKT_TC: case MPMB_TCP_STREAM_TC: case MPMB_UDP_TC: direction = SIG_FLAG_TOCLIENT; break; case MPMB_OTHERIP: direction = (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER); break; case MPMB_MAX: BUG_ON(1); break; } for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (s->mpm_sm == NULL) continue; int list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (list < 0) continue; if (list != DETECT_SM_LIST_PMATCH) continue; switch (buf) { case MPMB_TCP_PKT_TS: case MPMB_TCP_PKT_TC: if (SignatureHasPacketContent(s) == 1) { sids_array[s->num / 8] |= 1 << (s->num % 8); cnt++; } break; case MPMB_TCP_STREAM_TS: case MPMB_TCP_STREAM_TC: if (SignatureHasStreamContent(s) == 1) { sids_array[s->num / 8] |= 1 << (s->num % 8); cnt++; } break; case MPMB_UDP_TS: case MPMB_UDP_TC: sids_array[s->num / 8] |= 1 << (s->num % 8); cnt++; break; case MPMB_OTHERIP: sids_array[s->num / 8] |= 1 << (s->num % 8); cnt++; break; default: break; } } if (cnt == 0) return NULL; MpmStore lookup = { sids_array, max_sid, direction, buf, DETECT_SM_LIST_PMATCH, 0, NULL}; MpmStore *result = MpmStoreLookup(de_ctx, &lookup); if (result == NULL) { MpmStore *copy = SCCalloc(1, sizeof(MpmStore)); if (copy == NULL) return NULL; uint8_t *sids = SCCalloc(1, max_sid); if (sids == NULL) { SCFree(copy); return NULL; } memcpy(sids, sids_array, max_sid); copy->sid_array = sids; copy->sid_array_size = max_sid; copy->buffer = buf; copy->direction = direction; copy->sm_list = DETECT_SM_LIST_PMATCH; copy->sgh_mpm_context = sgh_mpm_context; MpmStoreSetup(de_ctx, copy); MpmStoreAdd(de_ctx, copy); return copy; } else { return result; } } static MpmStore *MpmStorePrepareBufferAppLayer(DetectEngineCtx *de_ctx, SigGroupHead *sgh, DetectMpmAppLayerKeyword *am) { const Signature *s = NULL; uint32_t sig; uint32_t cnt = 0; uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1; uint8_t sids_array[max_sid]; memset(sids_array, 0x00, max_sid); SCLogDebug("handling %s direction %s for list %d", am->reg->name, am->reg->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient", am->reg->sm_list); for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (s->mpm_sm == NULL) continue; int list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (list < 0) continue; if ((s->flags & am->reg->direction) == 0) continue; if (list != am->reg->sm_list) continue; sids_array[s->num / 8] |= 1 << (s->num % 8); cnt++; } if (cnt == 0) return NULL; MpmStore lookup = { sids_array, max_sid, am->reg->direction, MPMB_MAX, am->reg->sm_list, 0, NULL}; SCLogDebug("am->direction %d am->sm_list %d", am->reg->direction, am->reg->sm_list); MpmStore *result = MpmStoreLookup(de_ctx, &lookup); if (result == NULL) { SCLogDebug("new unique mpm for %s %s: %u patterns", am->reg->name, am->reg->direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient", cnt); MpmStore *copy = SCCalloc(1, sizeof(MpmStore)); if (copy == NULL) return NULL; uint8_t *sids = SCCalloc(1, max_sid); if (sids == NULL) { SCFree(copy); return NULL; } memcpy(sids, sids_array, max_sid); copy->sid_array = sids; copy->sid_array_size = max_sid; copy->buffer = MPMB_MAX; copy->direction = am->reg->direction; copy->sm_list = am->reg->sm_list; copy->sgh_mpm_context = am->sgh_mpm_context; MpmStoreSetup(de_ctx, copy); MpmStoreAdd(de_ctx, copy); return copy; } else { SCLogDebug("using existing mpm %p", result); return result; } return NULL; } /** \brief Prepare the pattern matcher ctx in a sig group head. * */ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) { MpmStore *mpm_store = NULL; if (SGH_PROTO(sh, IPPROTO_TCP)) { if (SGH_DIRECTION_TS(sh)) { mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TS); if (mpm_store != NULL) { PrefilterPktPayloadRegister(sh, mpm_store->mpm_ctx); } mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TS); if (mpm_store != NULL) { PrefilterPktStreamRegister(sh, mpm_store->mpm_ctx); } } if (SGH_DIRECTION_TC(sh)) { mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_PKT_TC); if (mpm_store != NULL) { PrefilterPktPayloadRegister(sh, mpm_store->mpm_ctx); } mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_TCP_STREAM_TC); if (mpm_store != NULL) { PrefilterPktStreamRegister(sh, mpm_store->mpm_ctx); } } } else if (SGH_PROTO(sh, IPPROTO_UDP)) { if (SGH_DIRECTION_TS(sh)) { mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TS); if (mpm_store != NULL) { PrefilterPktPayloadRegister(sh, mpm_store->mpm_ctx); } } if (SGH_DIRECTION_TC(sh)) { mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_UDP_TC); if (mpm_store != NULL) { PrefilterPktPayloadRegister(sh, mpm_store->mpm_ctx); } } } else { mpm_store = MpmStorePrepareBuffer(de_ctx, sh, MPMB_OTHERIP); if (mpm_store != NULL) { PrefilterPktPayloadRegister(sh, mpm_store->mpm_ctx); } } int i = 0; DetectMpmAppLayerKeyword *a = de_ctx->app_mpms; while (a->reg != NULL) { i++; a++; } if (i == 0) return 0; sh->init->app_mpms = SCCalloc(i, sizeof(MpmCtx *)); BUG_ON(sh->init->app_mpms == NULL); a = de_ctx->app_mpms; while (a->reg != NULL) { if ((a->reg->direction == SIG_FLAG_TOSERVER && SGH_DIRECTION_TS(sh)) || (a->reg->direction == SIG_FLAG_TOCLIENT && SGH_DIRECTION_TC(sh))) { mpm_store = MpmStorePrepareBufferAppLayer(de_ctx, sh, a); if (mpm_store != NULL) { sh->init->app_mpms[a->reg->id] = mpm_store->mpm_ctx; /* if we have just certain types of negated patterns, * mpm_ctx can be NULL */ if (a->reg->PrefilterRegister && mpm_store->mpm_ctx) { BUG_ON(a->reg->PrefilterRegister(sh, mpm_store->mpm_ctx) != 0); } } } a++; } return 0; } typedef struct DetectFPAndItsId_ { PatIntId id; uint16_t content_len; uint32_t flags; int sm_list; uint8_t *content; } DetectFPAndItsId; /** * \brief Figured out the FP and their respective content ids for all the * sigs in the engine. * * \param de_ctx Detection engine context. * * \retval 0 On success. * \retval -1 On failure. */ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx) { uint32_t struct_total_size = 0; uint32_t content_total_size = 0; Signature *s = NULL; /* Count the amount of memory needed to store all the structures * and the content of those structures. This will over estimate the * true size, since duplicates are removed below, but counted here. */ for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->flags & SIG_FLAG_PREFILTER) continue; RetrieveFPForSig(s); if (s->mpm_sm != NULL) { DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; struct_total_size += sizeof(DetectFPAndItsId); content_total_size += cd->content_len; s->flags |= SIG_FLAG_PREFILTER; } } /* no rules */ if (struct_total_size + content_total_size == 0) return 0; /* array hash buffer - i've run out of ideas to name it */ uint8_t *ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size)); if (unlikely(ahb == NULL)) return -1; uint8_t *content = NULL; uint8_t content_len = 0; PatIntId max_id = 0; DetectFPAndItsId *struct_offset = (DetectFPAndItsId *)ahb; uint8_t *content_offset = ahb + struct_total_size; for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->mpm_sm != NULL) { int sm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); BUG_ON(sm_list == -1); DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; DetectFPAndItsId *dup = (DetectFPAndItsId *)ahb; if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { content = cd->content + cd->fp_chop_offset; content_len = cd->fp_chop_len; } else { content = cd->content; content_len = cd->content_len; } uint32_t flags = cd->flags & DETECT_CONTENT_NOCASE; /* Check for content already found on the same list */ for (; dup != struct_offset; dup++) { if (dup->content_len != content_len) continue; if (dup->sm_list != sm_list) continue; if (dup->flags != flags) continue; /* Check for pattern matching a duplicate. Use case insensitive matching * for case insensitive patterns. */ if (flags & DETECT_CONTENT_NOCASE) { if (SCMemcmpLowercase(dup->content, content, content_len) != 0) continue; } else { /* Case sensitive matching */ if (SCMemcmp(dup->content, content, content_len) != 0) continue; } /* Found a match with a previous pattern. */ break; } if (dup != struct_offset) { /* Exited for-loop before the end, so found an existing match. * Use its ID. */ cd->id = dup->id; continue; } /* Not found, so new content. Give it a new ID and add it * to the array. Copy the content at the end of the * content array. */ struct_offset->id = max_id++; cd->id = struct_offset->id; struct_offset->content_len = content_len; struct_offset->sm_list = sm_list; struct_offset->content = content_offset; struct_offset->flags = flags; content_offset += content_len; if (flags & DETECT_CONTENT_NOCASE) { /* Need to store case-insensitive patterns as lower case * because SCMemcmpLowercase() above assumes that all * patterns are stored lower case so that it doesn't * need to relower its first argument. */ memcpy_tolower(struct_offset->content, content, content_len); } else { memcpy(struct_offset->content, content, content_len); } struct_offset++; } /* if (s->mpm_sm != NULL) */ } /* for */ de_ctx->max_fp_id = max_id; SCFree(ahb); return 0; } suricata-3.2.1/src/alert-syslog.c0000644000000000000000000003170213051004444013575 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * Logs alerts in a line based text format in to syslog. * */ #include "suricata-common.h" #include "debug.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "output.h" #include "alert-syslog.h" #include "util-classification-config.h" #include "util-debug.h" #include "util-print.h" #include "util-proto-name.h" #include "util-syslog.h" #include "util-optimize.h" #include "util-logopenfile.h" #ifndef OS_WIN32 #define DEFAULT_ALERT_SYSLOG_FACILITY_STR "local0" #define DEFAULT_ALERT_SYSLOG_FACILITY LOG_LOCAL0 #define DEFAULT_ALERT_SYSLOG_LEVEL LOG_ERR #define MODULE_NAME "AlertSyslog" static int alert_syslog_level = DEFAULT_ALERT_SYSLOG_LEVEL; typedef struct AlertSyslogThread_ { /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ LogFileCtx* file_ctx; } AlertSyslogThread; /** * \brief Function to clear the memory of the output context and closes the * syslog interface * * \param output_ctx pointer to the output context to be cleared */ static void AlertSyslogDeInitCtx(OutputCtx *output_ctx) { if (output_ctx != NULL) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; if (logfile_ctx != NULL) { LogFileFreeCtx(logfile_ctx); } SCFree(output_ctx); } closelog(); } /** * \brief Create a new LogFileCtx for "syslog" output style. * * \param conf The configuration node for this output. * \return A OutputCtx pointer on success, NULL on failure. */ OutputCtx *AlertSyslogInitCtx(ConfNode *conf) { const char *facility_s = ConfNodeLookupChildValue(conf, "facility"); if (facility_s == NULL) { facility_s = DEFAULT_ALERT_SYSLOG_FACILITY_STR; } LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { SCLogDebug("AlertSyslogInitCtx: Could not create new LogFileCtx"); return NULL; } int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap()); if (facility == -1) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog facility: \"%s\"," " now using \"%s\" as syslog facility", facility_s, DEFAULT_ALERT_SYSLOG_FACILITY_STR); facility = DEFAULT_ALERT_SYSLOG_FACILITY; } const char *level_s = ConfNodeLookupChildValue(conf, "level"); if (level_s != NULL) { int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap()); if (level != -1) { alert_syslog_level = level; } } const char *ident = ConfNodeLookupChildValue(conf, "identity"); /* if null we just pass that to openlog, which will then * figure it out by itself. */ openlog(ident, LOG_PID|LOG_NDELAY, facility); OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCLogDebug("AlertSyslogInitCtx: Could not create new OutputCtx"); return NULL; } memset(output_ctx, 0x00, sizeof(OutputCtx)); output_ctx->data = logfile_ctx; output_ctx->DeInit = AlertSyslogDeInitCtx; SCLogInfo("Syslog output initialized"); return output_ctx; } /** * \brief Function to initialize the AlertSystlogThread and sets the output * context pointer * * \param tv Pointer to the threadvars * \param initdata Pointer to the output context * \param data pointer to pointer to point to the AlertSyslogThread */ static TmEcode AlertSyslogThreadInit(ThreadVars *t, void *initdata, void **data) { if(initdata == NULL) { SCLogDebug("Error getting context for AlertSyslog. \"initdata\" " "argument NULL"); return TM_ECODE_FAILED; } AlertSyslogThread *ast = SCMalloc(sizeof(AlertSyslogThread)); if (unlikely(ast == NULL)) return TM_ECODE_FAILED; memset(ast, 0, sizeof(AlertSyslogThread)); /** Use the Ouptut Context (file pointer and mutex) */ ast->file_ctx = ((OutputCtx *)initdata)->data; *data = (void *)ast; return TM_ECODE_OK; } /** * \brief Function to deinitialize the AlertSystlogThread * * \param tv Pointer to the threadvars * \param data pointer to the AlertSyslogThread to be cleared */ static TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data) { AlertSyslogThread *ast = (AlertSyslogThread *)data; if (ast == NULL) { return TM_ECODE_OK; } /* clear memory */ memset(ast, 0, sizeof(AlertSyslogThread)); SCFree(ast); return TM_ECODE_OK; } /** * \brief Function which is called to print the IPv4 alerts to the syslog * * \param tv Pointer to the threadvars * \param p Pointer to the packet * \param data pointer to the AlertSyslogThread * * \return On succes return TM_ECODE_OK */ static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data) { AlertSyslogThread *ast = (AlertSyslogThread *)data; int i; char *action = ""; if (p->alerts.cnt == 0) return TM_ECODE_OK; SCMutexLock(&ast->file_ctx->fp_mutex); ast->file_ctx->alerts += p->alerts.cnt; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } char srcip[16], dstip[16]; PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "[Drop] "; } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } if (SCProtoNameValid(IPV4_GET_IPPROTO(p)) == TRUE) { syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%" PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]" " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio, known_proto[IPV4_GET_IPPROTO(p)], srcip, p->sp, dstip, p->dp); } else { syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%" PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]" " {PROTO:%03" PRIu32 "} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio, IPV4_GET_IPPROTO(p), srcip, p->sp, dstip, p->dp); } } SCMutexUnlock(&ast->file_ctx->fp_mutex); return TM_ECODE_OK; } /** * \brief Function which is called to print the IPv6 alerts to the syslog * * \param tv Pointer to the threadvars * \param p Pointer to the packet * \param data pointer to the AlertSyslogThread * * \return On succes return TM_ECODE_OK */ static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data) { AlertSyslogThread *ast = (AlertSyslogThread *)data; int i; char *action = ""; if (p->alerts.cnt == 0) return TM_ECODE_OK; SCMutexLock(&ast->file_ctx->fp_mutex); ast->file_ctx->alerts += p->alerts.cnt; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } char srcip[46], dstip[46]; PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "[Drop] "; } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } if (SCProtoNameValid(IPV6_GET_L4PROTO(p)) == TRUE) { syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%" "" PRIu32 "] %s [Classification: %s] [Priority: %" "" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio, known_proto[IPV6_GET_L4PROTO(p)], srcip, p->sp, dstip, p->dp); } else { syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%" "" PRIu32 "] %s [Classification: %s] [Priority: %" "" PRIu32 "] {PROTO:%03" PRIu32 "} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio, IPV6_GET_L4PROTO(p), srcip, p->sp, dstip, p->dp); } } SCMutexUnlock(&ast->file_ctx->fp_mutex); return TM_ECODE_OK; } /** * \brief Function which is called to print the decode alerts to the syslog * * \param tv Pointer to the threadvars * \param p Pointer to the packet * \param data pointer to the AlertSyslogThread * \param pq pointer the to packet queue * \param postpq pointer to the post processed packet queue * * \return On succes return TM_ECODE_OK */ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data) { AlertSyslogThread *ast = (AlertSyslogThread *)data; int i; char *action = ""; if (p->alerts.cnt == 0) return TM_ECODE_OK; SCMutexLock(&ast->file_ctx->fp_mutex); ast->file_ctx->alerts += p->alerts.cnt; char temp_buf_hdr[512]; char temp_buf_pkt[65] = ""; char temp_buf_tail[32]; char alert[2048] = ""; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "[Drop] "; } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } snprintf(temp_buf_hdr, sizeof(temp_buf_hdr), "%s[%" PRIu32 ":%" PRIu32 ":%" PRIu32 "] %s [Classification: %s] [Priority: %" PRIu32 "] [**] [Raw pkt: ", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio); strlcpy(alert, temp_buf_hdr, sizeof(alert)); PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); strlcat(alert, temp_buf_pkt, sizeof(alert)); if (p->pcap_cnt != 0) { snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]", p->pcap_cnt); } else { temp_buf_tail[0] = ']'; temp_buf_tail[1] = '\0'; } strlcat(alert, temp_buf_tail, sizeof(alert)); syslog(alert_syslog_level, "%s", alert); } SCMutexUnlock(&ast->file_ctx->fp_mutex); return TM_ECODE_OK; } /** * \brief Function to print the total alert while closing the engine * * \param tv Pointer to the output threadvars * \param data Pointer to the AlertSyslogThread data */ static void AlertSyslogExitPrintStats(ThreadVars *tv, void *data) { AlertSyslogThread *ast = (AlertSyslogThread *)data; if (ast == NULL) { return; } SCLogInfo("(%s) Alerts %" PRIu64 "", tv->name, ast->file_ctx->alerts); } static int AlertSyslogCondition(ThreadVars *tv, const Packet *p) { return (p->alerts.cnt > 0 ? TRUE : FALSE); } static int AlertSyslogLogger(ThreadVars *tv, void *thread_data, const Packet *p) { if (PKT_IS_IPV4(p)) { return AlertSyslogIPv4(tv, p, thread_data); } else if (PKT_IS_IPV6(p)) { return AlertSyslogIPv6(tv, p, thread_data); } else if (p->events.cnt > 0) { return AlertSyslogDecoderEvent(tv, p, thread_data); } return TM_ECODE_OK; } #endif /* !OS_WIN32 */ /** \brief Function to register the AlertSyslog module */ void AlertSyslogRegister (void) { #ifndef OS_WIN32 OutputRegisterPacketModule(LOGGER_ALERT_SYSLOG, MODULE_NAME, "syslog", AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition, AlertSyslogThreadInit, AlertSyslogThreadDeinit, AlertSyslogExitPrintStats); #endif /* !OS_WIN32 */ } suricata-3.2.1/src/util-hash-lookup3.c0000644000000000000000000012061413051004444014441 00000000000000/* ------------------------------------------------------------------------------- lookup3.c, by Bob Jenkins, May 2006, Public Domain. These are functions for producing 32-bit hashes for hash table lookup. hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() are externally useful functions. Routines to test the hash are included if SELF_TEST is defined. You can use this free for any purpose. It's in the public domain. It has no warranty. You probably want to use hashlittle(). hashlittle() and hashbig() hash byte arrays. hashlittle() is is faster than hashbig() on little-endian machines. Intel and AMD are little-endian machines. On second thought, you probably want hashlittle2(), which is identical to hashlittle() except it returns two 32-bit hashes for the price of one. You could implement hashbig2() if you wanted but I haven't bothered here. If you want to find a hash of, say, exactly 7 integers, do a = i1; b = i2; c = i3; mix(a,b,c); a += i4; b += i5; c += i6; mix(a,b,c); a += i7; final(a,b,c); then use c as the hash value. If you have a variable length array of 4-byte integers to hash, use hashword(). If you have a byte array (like a character string), use hashlittle(). If you have several byte arrays, or a mix of things, see the comments above hashlittle(). Why is this so big? I read 12 bytes at a time into 3 4-byte integers, then mix those integers. This is fast (you can do a lot more thorough mixing with 12*3 instructions on 3 integers than you can with 3 instructions on 1 byte), but shoehorning those bytes into integers efficiently is messy. ------------------------------------------------------------------------------- */ //#define SELF_TEST 1 #include /* defines printf for tests */ #include /* defines time_t for timings in the test */ #include /* defines uint32_t etc */ #include /* attempt to define endianness */ #ifdef linux # include /* attempt to define endianness */ #endif /* * My best guess at if you are big-endian or little-endian. This may * need adjustment. */ #if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \ __BYTE_ORDER == __LITTLE_ENDIAN) || \ (defined(i386) || defined(__i386__) || defined(__i486__) || \ defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL)) # define HASH_LITTLE_ENDIAN 1 # define HASH_BIG_ENDIAN 0 #elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \ __BYTE_ORDER == __BIG_ENDIAN) || \ (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel)) # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 1 #else # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 0 #endif #define hashsize(n) ((uint32_t)1<<(n)) #define hashmask(n) (hashsize(n)-1) #define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k)))) /* ------------------------------------------------------------------------------- mix -- mix 3 32-bit values reversibly. This is reversible, so any information in (a,b,c) before mix() is still in (a,b,c) after mix(). If four pairs of (a,b,c) inputs are run through mix(), or through mix() in reverse, there are at least 32 bits of the output that are sometimes the same for one pair and different for another pair. This was tested for: * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that satisfy this are 4 6 8 16 19 4 9 15 3 18 27 15 14 9 3 7 17 3 Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing for "differ" defined as + with a one-bit base and a two-bit delta. I used http://burtleburtle.net/bob/hash/avalanche.html to choose the operations, constants, and arrangements of the variables. This does not achieve avalanche. There are input bits of (a,b,c) that fail to affect some output bits of (a,b,c), especially of a. The most thoroughly mixed value is c, but it doesn't really even achieve avalanche in c. This allows some parallelism. Read-after-writes are good at doubling the number of bits affected, so the goal of mixing pulls in the opposite direction as the goal of parallelism. I did what I could. Rotates seem to cost as much as shifts on every machine I could lay my hands on, and rotates are much kinder to the top and bottom bits, so I used rotates. ------------------------------------------------------------------------------- */ #define mix(a,b,c) \ { \ a -= c; a ^= rot(c, 4); c += b; \ b -= a; b ^= rot(a, 6); a += c; \ c -= b; c ^= rot(b, 8); b += a; \ a -= c; a ^= rot(c,16); c += b; \ b -= a; b ^= rot(a,19); a += c; \ c -= b; c ^= rot(b, 4); b += a; \ } /* ------------------------------------------------------------------------------- final -- final mixing of 3 32-bit values (a,b,c) into c Pairs of (a,b,c) values differing in only a few bits will usually produce values of c that look totally different. This was tested for * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. These constants passed: 14 11 25 16 4 14 24 12 14 25 16 4 14 24 and these came close: 4 8 15 26 3 22 24 10 8 15 26 3 22 24 11 8 15 26 3 22 24 ------------------------------------------------------------------------------- */ #define final(a,b,c) \ { \ c ^= b; c -= rot(b,14); \ a ^= c; a -= rot(c,11); \ b ^= a; b -= rot(a,25); \ c ^= b; c -= rot(b,16); \ a ^= c; a -= rot(c,4); \ b ^= a; b -= rot(a,14); \ c ^= b; c -= rot(b,24); \ } /* -------------------------------------------------------------------- This works on all machines. To be useful, it requires -- that the key be an array of uint32_t's, and -- that the length be the number of uint32_t's in the key The function hashword() is identical to hashlittle() on little-endian machines, and identical to hashbig() on big-endian machines, except that the length has to be measured in uint32_ts rather than in bytes. hashlittle() is more complicated than hashword() only because hashlittle() has to dance around fitting the key bytes into registers. -------------------------------------------------------------------- */ uint32_t hashword( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t initval) /* the previous hash, or an arbitrary value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = 0xdeadbeef + (((uint32_t)length)<<2) + initval; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ return c; } /* -------------------------------------------------------------------- hashword2() -- same as hashword(), but take two seeds and return two 32-bit values. pc and pb must both be nonnull, and *pc and *pb must both be initialized with seeds. If you pass in (*pb)==0, the output (*pc) will be the same as the return value from hashword(). -------------------------------------------------------------------- */ void hashword2 ( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t *pc, /* IN: seed OUT: primary hash value */ uint32_t *pb) /* IN: more seed OUT: secondary hash value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)(length<<2)) + *pc; c += *pb; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ *pc=c; *pb=b; } /* ------------------------------------------------------------------------------- hashlittle() -- hash a variable-length key into a 32-bit value k : the key (the unaligned variable-length array of bytes) length : the length of the key, counting by bytes initval : can be any 4-byte value Returns a 32-bit value. Every bit of the key affects every bit of the return value. Two keys differing by one or two bits will have totally different hash values. The best hash table sizes are powers of 2. There is no need to do mod a prime (mod is sooo slow!). If you need less than 32 bits, use a bitmask. For example, if you need only 10 bits, do h = (h & hashmask(10)); In which case, the hash table should have hashsize(10) elements. If you are hashing n strings (uint8_t **)k, do it like this: for (i=0, h=0; i 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ const uint8_t *k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : return c; } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : return c; /* zero length requires no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : return c; } } final(a,b,c); return c; } /* ------------------------------------------------------------------------------- hashlittle_safe() -- hash a variable-length key into a 32-bit value k : the key (the unaligned variable-length array of bytes) length : the length of the key, counting by bytes initval : can be any 4-byte value Returns a 32-bit value. Every bit of the key affects every bit of the return value. Two keys differing by one or two bits will have totally different hash values. The best hash table sizes are powers of 2. There is no need to do mod a prime (mod is sooo slow!). If you need less than 32 bits, use a bitmask. For example, if you need only 10 bits, do h = (h & hashmask(10)); In which case, the hash table should have hashsize(10) elements. If you are hashing n strings (uint8_t **)k, do it like this: for (i=0, h=0; i 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * Note that unlike hashlittle() above, we use the "safe" version of this * block that is #ifdef VALGRIND above, in order to avoid warnings from * Valgrind or Address Sanitizer. */ const uint8_t *k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : return c; } } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : return c; /* zero length requires no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : return c; } } final(a,b,c); return c; } /* * hashlittle2: return 2 32-bit hash values * * This is identical to hashlittle(), except it returns two 32-bit hash * values instead of just one. This is good enough for hash table * lookup with 2^^64 buckets, or if you want a second hash if you're not * happy with the first, or if you want a probably-unique 64-bit ID for * the key. *pc is better mixed than *pb, so use *pc first. If you want * a 64-bit value do something like "*pc + (((uint64_t)*pb)<<32)". */ void hashlittle2( const void *key, /* the key to hash */ size_t length, /* length of the key */ uint32_t *pc, /* IN: primary initval, OUT: primary hash */ uint32_t *pb) /* IN: secondary initval, OUT: secondary hash */ { uint32_t a,b,c; /* internal state */ union { const void *ptr; size_t i; } u; /* needed for Mac Powerbook G4 */ /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)length) + *pc; c += *pb; u.ptr = key; if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #else /* make valgrind happy */ const uint8_t *k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } final(a,b,c); *pc=c; *pb=b; } /* * hashbig(): * This is the same as hashword() on big-endian machines. It is different * from hashlittle() on all machines. hashbig() takes advantage of * big-endian byte ordering. */ uint32_t hashbig( const void *key, size_t length, uint32_t initval) { uint32_t a,b,c; union { const void *ptr; size_t i; } u; /* to cast key to (size_t) happily */ /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)length) + initval; u.ptr = key; if (HASH_BIG_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]<<8" actually reads beyond the end of the string, but * then shifts out the part it's not allowed to read. Because the * string is aligned, the illegal read is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff00; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff0000; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff000000; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff00; a+=k[0]; break; case 6 : b+=k[1]&0xffff0000; a+=k[0]; break; case 5 : b+=k[1]&0xff000000; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff00; break; case 2 : a+=k[0]&0xffff0000; break; case 1 : a+=k[0]&0xff000000; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ const uint8_t *k8 = (const uint8_t *)k; switch(length) /* all the case statements fall through */ { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<8; /* fall through */ case 10: c+=((uint32_t)k8[9])<<16; /* fall through */ case 9 : c+=((uint32_t)k8[8])<<24; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<8; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<16; /* fall through */ case 5 : b+=((uint32_t)k8[4])<<24; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<8; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<16; /* fall through */ case 1 : a+=((uint32_t)k8[0])<<24; break; case 0 : return c; } #endif /* !VALGRIND */ } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += ((uint32_t)k[0])<<24; a += ((uint32_t)k[1])<<16; a += ((uint32_t)k[2])<<8; a += ((uint32_t)k[3]); b += ((uint32_t)k[4])<<24; b += ((uint32_t)k[5])<<16; b += ((uint32_t)k[6])<<8; b += ((uint32_t)k[7]); c += ((uint32_t)k[8])<<24; c += ((uint32_t)k[9])<<16; c += ((uint32_t)k[10])<<8; c += ((uint32_t)k[11]); mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=k[11]; case 11: c+=((uint32_t)k[10])<<8; case 10: c+=((uint32_t)k[9])<<16; case 9 : c+=((uint32_t)k[8])<<24; case 8 : b+=k[7]; case 7 : b+=((uint32_t)k[6])<<8; case 6 : b+=((uint32_t)k[5])<<16; case 5 : b+=((uint32_t)k[4])<<24; case 4 : a+=k[3]; case 3 : a+=((uint32_t)k[2])<<8; case 2 : a+=((uint32_t)k[1])<<16; case 1 : a+=((uint32_t)k[0])<<24; break; case 0 : return c; } } final(a,b,c); return c; } #ifdef SELF_TEST /* used for timings */ void driver1() { uint8_t buf[256]; uint32_t i; uint32_t h=0; time_t a,z; time(&a); for (i=0; i<256; ++i) buf[i] = 'x'; for (i=0; i<1; ++i) { h = hashlittle(&buf[0],1,h); } time(&z); if (z-a > 0) printf("time %d %.8x\n", z-a, h); } /* check that every input bit changes every output bit half the time */ #define HASHSTATE 1 #define HASHLEN 1 #define MAXPAIR 60 #define MAXLEN 70 void driver2() { uint8_t qa[MAXLEN+1], qb[MAXLEN+2], *a = &qa[0], *b = &qb[1]; uint32_t c[HASHSTATE], d[HASHSTATE], i=0, j=0, k, l, m=0, z; uint32_t e[HASHSTATE],f[HASHSTATE],g[HASHSTATE],h[HASHSTATE]; uint32_t x[HASHSTATE],y[HASHSTATE]; uint32_t hlen; printf("No more than %d trials should ever be needed \n",MAXPAIR/2); for (hlen=0; hlen < MAXLEN; ++hlen) { z=0; for (i=0; i>(8-j)); c[0] = hashlittle(a, hlen, m); b[i] ^= ((k+1)<>(8-j)); d[0] = hashlittle(b, hlen, m); /* check every bit is 1, 0, set, and not set at least once */ for (l=0; lz) z=k; if (k==MAXPAIR) { printf("Some bit didn't change: "); printf("%.8x %.8x %.8x %.8x %.8x %.8x ", e[0],f[0],g[0],h[0],x[0],y[0]); printf("i %d j %d m %d len %d\n", i, j, m, hlen); } if (z==MAXPAIR) goto done; } } } done: if (z < MAXPAIR) { printf("Mix success %2d bytes %2d initvals ",i,m); printf("required %d trials\n", z/2); } } printf("\n"); } /* Check for reading beyond the end of the buffer and alignment problems */ void driver3() { uint8_t buf[MAXLEN+20], *b; uint32_t len; uint8_t q[] = "This is the time for all good men to come to the aid of their country..."; uint32_t h; uint8_t qq[] = "xThis is the time for all good men to come to the aid of their country..."; uint32_t i; uint8_t qqq[] = "xxThis is the time for all good men to come to the aid of their country..."; uint32_t j; uint8_t qqqq[] = "xxxThis is the time for all good men to come to the aid of their country..."; uint32_t ref,x,y; uint8_t *p; printf("Endianness. These lines should all be the same (for values filled in):\n"); printf("%.8x %.8x %.8x\n", hashword((const uint32_t *)q, (sizeof(q)-1)/4, 13), hashword((const uint32_t *)q, (sizeof(q)-5)/4, 13), hashword((const uint32_t *)q, (sizeof(q)-9)/4, 13)); p = q; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qq[1]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qqq[2]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qqqq[3]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); printf("\n"); /* check that hashlittle2 and hashlittle produce the same results */ i=47; j=0; hashlittle2(q, sizeof(q), &i, &j); if (hashlittle(q, sizeof(q), 47) != i) printf("hashlittle2 and hashlittle mismatch\n"); /* check that hashword2 and hashword produce the same results */ len = 0xdeadbeef; i=47, j=0; hashword2(&len, 1, &i, &j); if (hashword(&len, 1, 47) != i) printf("hashword2 and hashword mismatch %x %x\n", i, hashword(&len, 1, 47)); /* check hashlittle doesn't read before or after the ends of the string */ for (h=0, b=buf+1; h<8; ++h, ++b) { for (i=0; i */ #include "suricata-common.h" #include "decode-events.h" /* code moved to app-layer-events */ const struct DecodeEvents_ DEvents[] = { /* IPV4 EVENTS */ { "decoder.ipv4.pkt_too_small", IPV4_PKT_TOO_SMALL, }, { "decoder.ipv4.hlen_too_small", IPV4_HLEN_TOO_SMALL, }, { "decoder.ipv4.iplen_smaller_than_hlen", IPV4_IPLEN_SMALLER_THAN_HLEN, }, { "decoder.ipv4.trunc_pkt", IPV4_TRUNC_PKT, }, /* IPV4 OPTIONS */ { "decoder.ipv4.opt_invalid", IPV4_OPT_INVALID, }, { "decoder.ipv4.opt_invalid_len", IPV4_OPT_INVALID_LEN, }, { "decoder.ipv4.opt_malformed", IPV4_OPT_MALFORMED, }, { "decoder.ipv4.opt_pad_required", IPV4_OPT_PAD_REQUIRED, }, { "decoder.ipv4.opt_eol_required", IPV4_OPT_EOL_REQUIRED, }, { "decoder.ipv4.opt_duplicate", IPV4_OPT_DUPLICATE, }, { "decoder.ipv4.opt_unknown", IPV4_OPT_UNKNOWN, }, { "decoder.ipv4.wrong_ip_version", IPV4_WRONG_IP_VER, }, { "decoder.ipv4.icmpv6", IPV4_WITH_ICMPV6, }, /* ICMP EVENTS */ { "decoder.icmpv4.pkt_too_small", ICMPV4_PKT_TOO_SMALL, }, { "decoder.icmpv4.unknown_type", ICMPV4_UNKNOWN_TYPE, }, { "decoder.icmpv4.unknown_code", ICMPV4_UNKNOWN_CODE, }, { "decoder.icmpv4.ipv4_trunc_pkt", ICMPV4_IPV4_TRUNC_PKT, }, { "decoder.icmpv4.ipv4_unknown_ver", ICMPV4_IPV4_UNKNOWN_VER, }, /* ICMPv6 EVENTS */ { "decoder.icmpv6.unknown_type", ICMPV6_UNKNOWN_TYPE,}, { "decoder.icmpv6.unknown_code", ICMPV6_UNKNOWN_CODE,}, { "decoder.icmpv6.pkt_too_small", ICMPV6_PKT_TOO_SMALL,}, { "decoder.icmpv6.ipv6_unknown_version", ICMPV6_IPV6_UNKNOWN_VER,}, { "decoder.icmpv6.ipv6_trunc_pkt", ICMPV6_IPV6_TRUNC_PKT,}, { "decoder.icmpv6.mld_message_with_invalid_hl", ICMPV6_MLD_MESSAGE_WITH_INVALID_HL,}, { "decoder.icmpv6.unassigned_type", ICMPV6_UNASSIGNED_TYPE,}, { "decoder.icmpv6.experimentation_type", ICMPV6_EXPERIMENTATION_TYPE,}, /* IPV6 EVENTS */ { "decoder.ipv6.pkt_too_small", IPV6_PKT_TOO_SMALL, }, { "decoder.ipv6.trunc_pkt", IPV6_TRUNC_PKT, }, { "decoder.ipv6.trunc_exthdr", IPV6_TRUNC_EXTHDR, }, { "decoder.ipv6.exthdr_dupl_fh", IPV6_EXTHDR_DUPL_FH, }, { "decoder.ipv6.exthdr_useless_fh", IPV6_EXTHDR_USELESS_FH, }, { "decoder.ipv6.exthdr_dupl_rh", IPV6_EXTHDR_DUPL_RH, }, { "decoder.ipv6.exthdr_dupl_hh", IPV6_EXTHDR_DUPL_HH, }, { "decoder.ipv6.exthdr_dupl_dh", IPV6_EXTHDR_DUPL_DH, }, { "decoder.ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, }, { "decoder.ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, }, { "decoder.ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, }, { "decoder.ipv6.wrong_ip_version", IPV6_WRONG_IP_VER, }, { "decoder.ipv6.exthdr_ah_res_not_null", IPV6_EXTHDR_AH_RES_NOT_NULL, }, { "decoder.ipv6.hopopts_unknown_opt", IPV6_HOPOPTS_UNKNOWN_OPT, }, { "decoder.ipv6.hopopts_only_padding", IPV6_HOPOPTS_ONLY_PADDING, }, { "decoder.ipv6.dstopts_unknown_opt", IPV6_DSTOPTS_UNKNOWN_OPT, }, { "decoder.ipv6.dstopts_only_padding", IPV6_DSTOPTS_ONLY_PADDING, }, { "decoder.ipv6.rh_type_0", IPV6_EXTHDR_RH_TYPE_0, }, { "decoder.ipv6.zero_len_padn", IPV6_EXTHDR_ZERO_LEN_PADN, }, { "decoder.ipv6.fh_non_zero_reserved_field", IPV6_FH_NON_ZERO_RES_FIELD, }, { "decoder.ipv6.data_after_none_header", IPV6_DATA_AFTER_NONE_HEADER, }, { "decoder.ipv6.unknown_next_header", IPV6_UNKNOWN_NEXT_HEADER, }, { "decoder.ipv6.icmpv4", IPV6_WITH_ICMPV4, }, /* TCP EVENTS */ { "decoder.tcp.pkt_too_small", TCP_PKT_TOO_SMALL, }, { "decoder.tcp.hlen_too_small", TCP_HLEN_TOO_SMALL, }, { "decoder.tcp.invalid_optlen", TCP_INVALID_OPTLEN, }, /* TCP OPTIONS */ { "decoder.tcp.opt_invalid_len", TCP_OPT_INVALID_LEN, }, { "decoder.tcp.opt_duplicate", TCP_OPT_DUPLICATE, }, /* UDP EVENTS */ { "decoder.udp.pkt_too_small", UDP_PKT_TOO_SMALL, }, { "decoder.udp.hlen_too_small", UDP_HLEN_TOO_SMALL, }, { "decoder.udp.hlen_invalid", UDP_HLEN_INVALID, }, /* SLL EVENTS */ { "decoder.sll.pkt_too_small", SLL_PKT_TOO_SMALL, }, /* ETHERNET EVENTS */ { "decoder.ethernet.pkt_too_small", ETHERNET_PKT_TOO_SMALL, }, /* PPP EVENTS */ { "decoder.ppp.pkt_too_small", PPP_PKT_TOO_SMALL, }, { "decoder.ppp.vju_pkt_too_small", PPPVJU_PKT_TOO_SMALL, }, { "decoder.ppp.ip4_pkt_too_small", PPPIPV4_PKT_TOO_SMALL, }, { "decoder.ppp.ip6_pkt_too_small", PPPIPV6_PKT_TOO_SMALL, }, { "decoder.ppp.wrong_type", PPP_WRONG_TYPE, }, /** unknown & invalid protocol */ { "decoder.ppp.unsup_proto", PPP_UNSUP_PROTO, }, /** unsupported but valid protocol */ /* PPPOE EVENTS */ { "decoder.pppoe.pkt_too_small", PPPOE_PKT_TOO_SMALL, }, { "decoder.pppoe.wrong_code", PPPOE_WRONG_CODE, }, { "decoder.pppoe.malformed_tags", PPPOE_MALFORMED_TAGS, }, /* GRE EVENTS */ { "decoder.gre.pkt_too_small", GRE_PKT_TOO_SMALL, }, { "decoder.gre.wrong_version", GRE_WRONG_VERSION, }, { "decoder.gre.version0_recur", GRE_VERSION0_RECUR, }, { "decoder.gre.version0_flags", GRE_VERSION0_FLAGS, }, { "decoder.gre.version0_hdr_too_big", GRE_VERSION0_HDR_TOO_BIG, }, { "decoder.gre.version0_malformed_sre_hdr", GRE_VERSION0_MALFORMED_SRE_HDR, }, { "decoder.gre.version1_chksum", GRE_VERSION1_CHKSUM, }, { "decoder.gre.version1_route", GRE_VERSION1_ROUTE, }, { "decoder.gre.version1_ssr", GRE_VERSION1_SSR, }, { "decoder.gre.version1_recur", GRE_VERSION1_RECUR, }, { "decoder.gre.version1_flags", GRE_VERSION1_FLAGS, }, { "decoder.gre.version1_no_key", GRE_VERSION1_NO_KEY, }, { "decoder.gre.version1_wrong_protocol", GRE_VERSION1_WRONG_PROTOCOL, }, { "decoder.gre.version1_malformed_sre_hdr", GRE_VERSION1_MALFORMED_SRE_HDR, }, { "decoder.gre.version1_hdr_too_big", GRE_VERSION1_HDR_TOO_BIG, }, /* VLAN EVENTS */ { "decoder.vlan.header_too_small",VLAN_HEADER_TOO_SMALL, }, { "decoder.vlan.unknown_type",VLAN_UNKNOWN_TYPE, }, { "decoder.vlan.too_many_layers", VLAN_HEADER_TOO_MANY_LAYERS, }, /* RAW EVENTS */ { "decoder.ipraw.invalid_ip_version",IPRAW_INVALID_IPV, }, /* LINKTYPE NULL EVENTS */ { "decoder.ltnull.pkt_too_small", LTNULL_PKT_TOO_SMALL, }, { "decoder.ltnull.unsupported_type", LTNULL_UNSUPPORTED_TYPE, }, /* SCTP EVENTS */ { "decoder.sctp.pkt_too_small", SCTP_PKT_TOO_SMALL, }, /* Fragmentation reasembly events. */ { "decoder.ipv4.frag_pkt_too_large", IPV4_FRAG_PKT_TOO_LARGE, }, { "decoder.ipv6.frag_pkt_too_large", IPV6_FRAG_PKT_TOO_LARGE, }, { "decoder.ipv4.frag_overlap", IPV4_FRAG_OVERLAP, }, { "decoder.ipv6.frag_overlap", IPV6_FRAG_OVERLAP, }, /* Fragment ignored due to internal error */ { "decoder.ipv4.frag_ignored", IPV4_FRAG_IGNORED, }, { "decoder.ipv6.frag_ignored", IPV6_FRAG_IGNORED, }, /* IPv4 in IPv6 events */ { "decoder.ipv6.ipv4_in_ipv6_too_small", IPV4_IN_IPV6_PKT_TOO_SMALL, }, { "decoder.ipv6.ipv4_in_ipv6_wrong_version", IPV4_IN_IPV6_WRONG_IP_VER, }, /* IPv6 in IPv6 events */ { "decoder.ipv6.ipv6_in_ipv6_too_small", IPV6_IN_IPV6_PKT_TOO_SMALL, }, { "decoder.ipv6.ipv6_in_ipv6_wrong_version", IPV6_IN_IPV6_WRONG_IP_VER, }, /* MPLS events */ { "decoder.mpls.header_too_small", MPLS_HEADER_TOO_SMALL, }, { "decoder.mpls.bad_label_router_alert", MPLS_BAD_LABEL_ROUTER_ALERT, }, { "decoder.mpls.bad_label_implicit_null", MPLS_BAD_LABEL_IMPLICIT_NULL, }, { "decoder.mpls.bad_label_reserved", MPLS_BAD_LABEL_RESERVED, }, { "decoder.mpls.unknown_payload_type", MPLS_UNKNOWN_PAYLOAD_TYPE, }, /* ERSPAN events */ { "decoder.erspan.header_too_small", ERSPAN_HEADER_TOO_SMALL, }, { "decoder.erspan.unsupported_version", ERSPAN_UNSUPPORTED_VERSION, }, { "decoder.erspan.too_many_vlan_layers", ERSPAN_TOO_MANY_VLAN_LAYERS, }, /* Cisco Fabric Path/DCE events. */ { "decoder.dce.pkt_too_small", DCE_PKT_TOO_SMALL, }, /* STREAM EVENTS */ { "stream.3whs_ack_in_wrong_dir", STREAM_3WHS_ACK_IN_WRONG_DIR, }, { "stream.3whs_async_wrong_seq", STREAM_3WHS_ASYNC_WRONG_SEQ, }, { "stream.3whs_right_seq_wrong_ack_evasion", STREAM_3WHS_RIGHT_SEQ_WRONG_ACK_EVASION, }, { "stream.3whs_synack_in_wrong_direction", STREAM_3WHS_SYNACK_IN_WRONG_DIRECTION, }, { "stream.3whs_synack_resend_with_different_ack", STREAM_3WHS_SYNACK_RESEND_WITH_DIFFERENT_ACK, }, { "stream.3whs_synack_resend_with_diff_seq", STREAM_3WHS_SYNACK_RESEND_WITH_DIFF_SEQ, }, { "stream.3whs_synack_toserver_on_syn_recv", STREAM_3WHS_SYNACK_TOSERVER_ON_SYN_RECV, }, { "stream.3whs_synack_with_wrong_ack", STREAM_3WHS_SYNACK_WITH_WRONG_ACK, }, { "stream.3whs_synack_flood", STREAM_3WHS_SYNACK_FLOOD, }, { "stream.3whs_syn_resend_diff_seq_on_syn_recv", STREAM_3WHS_SYN_RESEND_DIFF_SEQ_ON_SYN_RECV, }, { "stream.3whs_syn_toclient_on_syn_recv", STREAM_3WHS_SYN_TOCLIENT_ON_SYN_RECV, }, { "stream.3whs_wrong_seq_wrong_ack", STREAM_3WHS_WRONG_SEQ_WRONG_ACK, }, { "stream.4whs_synack_with_wrong_ack", STREAM_4WHS_SYNACK_WITH_WRONG_ACK, }, { "stream.4whs_synack_with_wrong_syn", STREAM_4WHS_SYNACK_WITH_WRONG_SYN, }, { "stream.4whs_wrong_seq", STREAM_4WHS_WRONG_SEQ, }, { "stream.4whs_invalid_ack", STREAM_4WHS_INVALID_ACK, }, { "stream.closewait_ack_out_of_window", STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW, }, { "stream.closewait_fin_out_of_window", STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW, }, { "stream.closewait_pkt_before_last_ack", STREAM_CLOSEWAIT_PKT_BEFORE_LAST_ACK, }, { "stream.closewait_invalid_ack", STREAM_CLOSEWAIT_INVALID_ACK, }, { "stream.closing_ack_wrong_seq", STREAM_CLOSING_ACK_WRONG_SEQ, }, { "stream.closing_invalid_ack", STREAM_CLOSING_INVALID_ACK, }, { "stream.est_packet_out_of_window", STREAM_EST_PACKET_OUT_OF_WINDOW, }, { "stream.est_pkt_before_last_ack", STREAM_EST_PKT_BEFORE_LAST_ACK, }, { "stream.est_synack_resend", STREAM_EST_SYNACK_RESEND, }, { "stream.est_synack_resend_with_different_ack", STREAM_EST_SYNACK_RESEND_WITH_DIFFERENT_ACK, }, { "stream.est_synack_resend_with_diff_seq", STREAM_EST_SYNACK_RESEND_WITH_DIFF_SEQ, }, { "stream.est_synack_toserver", STREAM_EST_SYNACK_TOSERVER, }, { "stream.est_syn_resend", STREAM_EST_SYN_RESEND, }, { "stream.est_syn_resend_diff_seq", STREAM_EST_SYN_RESEND_DIFF_SEQ, }, { "stream.est_syn_toclient", STREAM_EST_SYN_TOCLIENT, }, { "stream.est_invalid_ack", STREAM_EST_INVALID_ACK, }, { "stream.fin_invalid_ack", STREAM_FIN_INVALID_ACK, }, { "stream.fin1_ack_wrong_seq", STREAM_FIN1_ACK_WRONG_SEQ, }, { "stream.fin1_fin_wrong_seq", STREAM_FIN1_FIN_WRONG_SEQ, }, { "stream.fin1_invalid_ack", STREAM_FIN1_INVALID_ACK, }, { "stream.fin2_ack_wrong_seq", STREAM_FIN2_ACK_WRONG_SEQ, }, { "stream.fin2_fin_wrong_seq", STREAM_FIN2_FIN_WRONG_SEQ, }, { "stream.fin2_invalid_ack", STREAM_FIN2_INVALID_ACK, }, { "stream.fin_but_no_session", STREAM_FIN_BUT_NO_SESSION, }, { "stream.fin_out_of_window", STREAM_FIN_OUT_OF_WINDOW, }, { "stream.lastack_ack_wrong_seq", STREAM_LASTACK_ACK_WRONG_SEQ, }, { "stream.lastack_invalid_ack", STREAM_LASTACK_INVALID_ACK, }, { "stream.rst_but_no_session", STREAM_RST_BUT_NO_SESSION, }, { "stream.timewait_ack_wrong_seq", STREAM_TIMEWAIT_ACK_WRONG_SEQ, }, { "stream.timewait_invalid_ack", STREAM_TIMEWAIT_INVALID_ACK, }, { "stream.pkt_invalid_timestamp", STREAM_PKT_INVALID_TIMESTAMP, }, { "stream.pkt_invalid_ack", STREAM_PKT_INVALID_ACK, }, { "stream.pkt_broken_ack", STREAM_PKT_BROKEN_ACK, }, { "stream.rst_invalid_ack", STREAM_RST_INVALID_ACK, }, { "stream.shutdown_syn_resend", STREAM_SHUTDOWN_SYN_RESEND, }, { "stream.pkt_retransmission", STREAM_PKT_RETRANSMISSION, }, { "stream.reassembly_segment_before_base_seq", STREAM_REASSEMBLY_SEGMENT_BEFORE_BASE_SEQ, }, { "stream.reassembly_no_segment", STREAM_REASSEMBLY_NO_SEGMENT, }, { "stream.reassembly_seq_gap", STREAM_REASSEMBLY_SEQ_GAP, }, { "stream.reassembly_overlap_different_data", STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA, }, { "stream.pkt_bad_window_update", STREAM_PKT_BAD_WINDOW_UPDATE, }, { NULL, 0 }, }; suricata-3.2.1/src/detect-tls-version.c0000644000000000000000000004157013051004444014707 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the tls.version keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ssl.h" #include "detect-tls-version.h" #include "stream-tcp.h" /** * \brief Regex for parsing "id" option, matching number or "number" */ #define PARSE_REGEX "^\\s*([A-z0-9\\.]+|\"[A-z0-9\\.]+\")\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectTlsVersionMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectTlsVersionSetup (DetectEngineCtx *, Signature *, char *); void DetectTlsVersionRegisterTests(void); void DetectTlsVersionFree(void *); /** * \brief Registration function for keyword: tls.version */ void DetectTlsVersionRegister (void) { sigmatch_table[DETECT_AL_TLS_VERSION].name = "tls.version"; sigmatch_table[DETECT_AL_TLS_VERSION].desc = "match on TLS/SSL version"; sigmatch_table[DETECT_AL_TLS_VERSION].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tlsversion"; sigmatch_table[DETECT_AL_TLS_VERSION].Match = NULL; sigmatch_table[DETECT_AL_TLS_VERSION].AppLayerMatch = DetectTlsVersionMatch; sigmatch_table[DETECT_AL_TLS_VERSION].Setup = DetectTlsVersionSetup; sigmatch_table[DETECT_AL_TLS_VERSION].Free = DetectTlsVersionFree; sigmatch_table[DETECT_AL_TLS_VERSION].RegisterTests = DetectTlsVersionRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief match the specified version on a tls session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTlsVersionData * * \retval 0 no match * \retval 1 match */ int DetectTlsVersionMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectTlsVersionData *tls_data = (DetectTlsVersionData *)m->ctx; SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, no match"); SCReturnInt(0); } int ret = 0; SCLogDebug("looking for tls_data->ver 0x%02X (flags 0x%02X)", tls_data->ver, flags); if (flags & STREAM_TOCLIENT) { SCLogDebug("server (toclient) version is 0x%02X", ssl_state->server_connp.version); if (tls_data->ver == ssl_state->server_connp.version) ret = 1; } else if (flags & STREAM_TOSERVER) { SCLogDebug("client (toserver) version is 0x%02X", ssl_state->client_connp.version); if (tls_data->ver == ssl_state->client_connp.version) ret = 1; } SCReturnInt(ret); } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectTlsVersionData on success * \retval NULL on failure */ DetectTlsVersionData *DetectTlsVersionParse (char *str) { uint16_t temp; DetectTlsVersionData *tls = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid tls.version option"); goto error; } if (ret > 1) { const char *str_ptr; char *orig; char *tmp_str; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ tls = SCMalloc(sizeof(DetectTlsVersionData)); if (unlikely(tls == NULL)) goto error; orig = SCStrdup((char*)str_ptr); if (unlikely(orig == NULL)) { goto error; } tmp_str=orig; /* Let's see if we need to scape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } if (strcmp("1.0", tmp_str) == 0) { temp = TLS_VERSION_10; } else if (strcmp("1.1", tmp_str) == 0) { temp = TLS_VERSION_11; } else if (strcmp("1.2", tmp_str) == 0) { temp = TLS_VERSION_12; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid value"); SCFree(orig); goto error; } tls->ver = temp; SCFree(orig); SCLogDebug("will look for tls %"PRIu8"", tls->ver); } return tls; error: if (tls != NULL) DetectTlsVersionFree(tls); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTlsVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectTlsVersionData *tls = NULL; SigMatch *sm = NULL; tls = DetectTlsVersionParse(str); if (tls == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_TLS_VERSION; sm->ctx = (void *)tls; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->alproto = ALPROTO_TLS; return 0; error: if (tls != NULL) DetectTlsVersionFree(tls); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTlsVersionData * * \param id_d pointer to DetectTlsVersionData */ void DetectTlsVersionFree(void *ptr) { DetectTlsVersionData *id_d = (DetectTlsVersionData *)ptr; SCFree(id_d); } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectTlsVersionTestParse01 is a test to make sure that we parse the "id" * option correctly when given valid id option */ int DetectTlsVersionTestParse01 (void) { DetectTlsVersionData *tls = NULL; tls = DetectTlsVersionParse("1.0"); FAIL_IF_NULL(tls); FAIL_IF_NOT(tls->ver == TLS_VERSION_10); DetectTlsVersionFree(tls); PASS; } /** * \test DetectTlsVersionTestParse02 is a test to make sure that we parse the "id" * option correctly when given an invalid id option * it should return id_d = NULL */ int DetectTlsVersionTestParse02 (void) { DetectTlsVersionData *tls = NULL; tls = DetectTlsVersionParse("2.5"); FAIL_IF_NOT_NULL(tls); DetectTlsVersionFree(tls); PASS; } #include "stream-tcp-reassemble.h" /** \test Send a get request in three chunks + more data. */ static int DetectTlsVersionTestDetect01(void) { Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03 }; uint32_t tlslen2 = sizeof(tlsbuf2); uint8_t tlsbuf3[] = { 0x01 }; uint32_t tlslen3 = sizeof(tlsbuf3); uint8_t tlsbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x01 }; uint32_t tlslen4 = sizeof(tlsbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tls any any -> any any (msg:\"TLS\"; tls.version:1.0; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf3, tlslen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf4, tlslen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); SCLogDebug("ssl_state is at %p, ssl_state->server_version 0x%02X " "ssl_state->client_version 0x%02X", ssl_state, ssl_state->server_connp.version, ssl_state->client_connp.version); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } static int DetectTlsVersionTestDetect02(void) { Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03 }; uint32_t tlslen2 = sizeof(tlsbuf2); uint8_t tlsbuf3[] = { 0x01 }; uint32_t tlslen3 = sizeof(tlsbuf3); uint8_t tlsbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x02 }; uint32_t tlslen4 = sizeof(tlsbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tls any any -> any any (msg:\"TLS\"; tls.version:1.0; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf3, tlslen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf4, tlslen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } static int DetectTlsVersionTestDetect03(void) { DetectEngineCtx *de_ctx = NULL; Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03 }; uint32_t tlslen2 = sizeof(tlsbuf2); uint8_t tlsbuf3[] = { 0x01 }; uint32_t tlslen3 = sizeof(tlsbuf3); uint8_t tlsbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x02 }; uint32_t tlslen4 = sizeof(tlsbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->tcph->th_seq = htonl(1000); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_TLS; f.proto = p->proto; StreamTcpInitConfig(TRUE); StreamMsg *stream_msg = StreamMsgGetFromPool(); FAIL_IF_NULL(stream_msg); memcpy(stream_msg->data, tlsbuf4, tlslen4); stream_msg->data_len = tlslen4; ssn.toserver_smsg_head = stream_msg; ssn.toserver_smsg_tail = stream_msg; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"TLS\"; tls.version:1.0; content:\"|01 00 00 AD|\"; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf3, tlslen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf4, tlslen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectTlsVersion */ void DetectTlsVersionRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectTlsVersionTestParse01", DetectTlsVersionTestParse01); UtRegisterTest("DetectTlsVersionTestParse02", DetectTlsVersionTestParse02); UtRegisterTest("DetectTlsVersionTestDetect01", DetectTlsVersionTestDetect01); UtRegisterTest("DetectTlsVersionTestDetect02", DetectTlsVersionTestDetect02); UtRegisterTest("DetectTlsVersionTestDetect03", DetectTlsVersionTestDetect03); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-memcmp.h0000644000000000000000000003500713051004444013410 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Memcmp implementations for SSE3, SSE4.1, SSE4.2 and TILE-Gx SIMD. * * Both SCMemcmp and SCMemcmpLowercase return 0 on a exact match, * 1 on a failed match. */ #ifndef __UTIL_MEMCMP_H__ #define __UTIL_MEMCMP_H__ #include "util-optimize.h" /** \brief compare two patterns, converting the 2nd to lowercase * \warning *ONLY* the 2nd pattern is converted to lowercase */ static inline int SCMemcmpLowercase(const void *, const void *, size_t); void MemcmpRegisterTests(void); static inline int MemcmpLowercase(const void *s1, const void *s2, size_t n) { ssize_t i; /* check backwards because we already tested the first * 2 to 4 chars. This way we are more likely to detect * a miss and thus speed up a little... */ for (i = n - 1; i >= 0; i--) { if (((uint8_t *)s1)[i] != u8_tolower(*(((uint8_t *)s2)+i))) return 1; } return 0; } #if defined(__SSE4_2__) #include /* No SIMD support, fall back to plain memcmp and a home grown lowercase one */ static inline int SCMemcmp(const void *s1, const void *s2, size_t n) { __m128i b1, b2; int r; /* counter for how far we already matched in the buffer */ size_t m = 0; do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(n - m < 16)) { return memcmp(s1, s2, n - m) ? 1 : 0; } /* load the buffers into the 128bit vars */ b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); /* do the actual compare */ m += (r = _mm_cmpestri(b1, n - m, b2, 16, _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY)); s1 += 16; s2 += 16; } while (r == 16); return ((m == n) ? 0 : 1); } /* Range of values of uppercase characters. We only use the first 2 bytes. */ static char scmemcmp_uppercase[16] __attribute__((aligned(16))) = { 'A', 'Z', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, }; /** \brief compare two buffers in a case insensitive way * \param s1 buffer already in lowercase * \param s2 buffer with mixed upper and lowercase */ static inline int SCMemcmpLowercase(const void *s1, const void *s2, size_t n) { __m128i b1, b2, mask; int r; /* counter for how far we already matched in the buffer */ size_t m = 0; __m128i ucase = _mm_load_si128((const __m128i *) scmemcmp_uppercase); __m128i nulls = _mm_setzero_si128(); __m128i uplow = _mm_set1_epi8(0x20); do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(n - m < 16)) { return MemcmpLowercase(s1, s2, n - m); } b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); size_t len = n - m; /* The first step is creating a mask that is FF for all uppercase * characters, 00 for all others */ mask = _mm_cmpestrm(ucase, 2, b2, len, _SIDD_CMP_RANGES | _SIDD_UNIT_MASK); /* Next we use that mask to create a new: this one has 0x20 for * the uppercase chars, 00 for all other. */ mask = _mm_blendv_epi8(nulls, uplow, mask); /* finally, merge the mask and the buffer converting the * uppercase to lowercase */ b2 = _mm_add_epi8(b2, mask); /* search using our converted buffer */ m += (r = _mm_cmpestri(b1, len, b2, 16, _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY)); s1 += 16; s2 += 16; } while (r == 16); return ((m == n) ? 0 : 1); } #elif defined(__SSE4_1__) #include #define SCMEMCMP_BYTES 16 static inline int SCMemcmp(const void *s1, const void *s2, size_t len) { size_t offset = 0; __m128i b1, b2, c; do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(len - offset < 16)) { return memcmp(s1, s2, len - offset) ? 1 : 0; } /* do unaligned loads using _mm_loadu_si128. On my Core2 E6600 using * _mm_lddqu_si128 was about 2% slower even though it's supposed to * be faster. */ b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); c = _mm_cmpeq_epi8(b1, b2); int diff = len - offset; if (diff < 16) { int rmask = ~(0xFFFFFFFF << diff); if ((_mm_movemask_epi8(c) & rmask) != rmask) { return 1; } } else { if (_mm_movemask_epi8(c) != 0x0000FFFF) { return 1; } } offset += SCMEMCMP_BYTES; s1 += SCMEMCMP_BYTES; s2 += SCMEMCMP_BYTES; } while (len > offset); return 0; } #define UPPER_LOW 0x40 /* "A" - 1 */ #define UPPER_HIGH 0x5B /* "Z" + 1 */ static inline int SCMemcmpLowercase(const void *s1, const void *s2, size_t len) { size_t offset = 0; __m128i b1, b2, mask1, mask2, upper1, upper2, nulls, uplow; /* setup registers for upper to lower conversion */ upper1 = _mm_set1_epi8(UPPER_LOW); upper2 = _mm_set1_epi8(UPPER_HIGH); nulls = _mm_setzero_si128(); uplow = _mm_set1_epi8(0x20); do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(len - offset < 16)) { return MemcmpLowercase(s1, s2, len - offset); } /* unaligned loading of the bytes to compare */ b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); /* mark all chars bigger than upper1 */ mask1 = _mm_cmpgt_epi8(b2, upper1); /* mark all chars lower than upper2 */ mask2 = _mm_cmplt_epi8(b2, upper2); /* merge the two, leaving only those that are true in both */ mask1 = _mm_cmpeq_epi8(mask1, mask2); /* Next we use that mask to create a new: this one has 0x20 for * the uppercase chars, 00 for all other. */ mask1 = _mm_blendv_epi8(nulls, uplow, mask1); /* add to b2, converting uppercase to lowercase */ b2 = _mm_add_epi8(b2, mask1); /* now all is lowercase, let's do the actual compare (reuse mask1 reg) */ mask1 = _mm_cmpeq_epi8(b1, b2); int diff = len - offset; if (diff < 16) { int rmask = ~(0xFFFFFFFF << diff); if ((_mm_movemask_epi8(mask1) & rmask) != rmask) { return 1; } } else { if (_mm_movemask_epi8(mask1) != 0x0000FFFF) { return 1; } } offset += SCMEMCMP_BYTES; s1 += SCMEMCMP_BYTES; s2 += SCMEMCMP_BYTES; } while (len > offset); return 0; } #elif defined(__SSE3__) #include /* for SSE3 */ #define SCMEMCMP_BYTES 16 static inline int SCMemcmp(const void *s1, const void *s2, size_t len) { size_t offset = 0; __m128i b1, b2, c; do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(len - offset < 16)) { return memcmp(s1, s2, len - offset) ? 1 : 0; } /* do unaligned loads using _mm_loadu_si128. On my Core2 E6600 using * _mm_lddqu_si128 was about 2% slower even though it's supposed to * be faster. */ b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); c = _mm_cmpeq_epi8(b1, b2); int diff = len - offset; if (diff < 16) { int rmask = ~(0xFFFFFFFF << diff); if ((_mm_movemask_epi8(c) & rmask) != rmask) { return 1; } } else { if (_mm_movemask_epi8(c) != 0x0000FFFF) { return 1; } } offset += SCMEMCMP_BYTES; s1 += SCMEMCMP_BYTES; s2 += SCMEMCMP_BYTES; } while (len > offset); return 0; } #define UPPER_LOW 0x40 /* "A" - 1 */ #define UPPER_HIGH 0x5B /* "Z" + 1 */ #define UPPER_DELTA 0xDF /* 0xFF - 0x20 */ static inline int SCMemcmpLowercase(const void *s1, const void *s2, size_t len) { size_t offset = 0; __m128i b1, b2, mask1, mask2, upper1, upper2, delta; /* setup registers for upper to lower conversion */ upper1 = _mm_set1_epi8(UPPER_LOW); upper2 = _mm_set1_epi8(UPPER_HIGH); delta = _mm_set1_epi8(UPPER_DELTA); do { /* apparently we can't just read 16 bytes even though * it almost always works fine :) */ if (likely(len - offset < 16)) { return MemcmpLowercase(s1, s2, len - offset); } /* unaligned loading of the bytes to compare */ b1 = _mm_loadu_si128((const __m128i *) s1); b2 = _mm_loadu_si128((const __m128i *) s2); /* mark all chars bigger than upper1 */ mask1 = _mm_cmpgt_epi8(b2, upper1); /* mark all chars lower than upper2 */ mask2 = _mm_cmplt_epi8(b2, upper2); /* merge the two, leaving only those that are true in both */ mask1 = _mm_cmpeq_epi8(mask1, mask2); /* sub delta leaves 0x20 only for uppercase positions, the rest is 0x00 due to the saturation (reuse mask1 reg)*/ mask1 = _mm_subs_epu8(mask1, delta); /* add to b2, converting uppercase to lowercase */ b2 = _mm_add_epi8(b2, mask1); /* now all is lowercase, let's do the actual compare (reuse mask1 reg) */ mask1 = _mm_cmpeq_epi8(b1, b2); int diff = len - offset; if (diff < 16) { int rmask = ~(0xFFFFFFFF << diff); if ((_mm_movemask_epi8(mask1) & rmask) != rmask) { return 1; } } else { if (_mm_movemask_epi8(mask1) != 0x0000FFFF) { return 1; } } offset += SCMEMCMP_BYTES; s1 += SCMEMCMP_BYTES; s2 += SCMEMCMP_BYTES; } while (len > offset); return 0; } #elif defined(__tile__) #include /* Compare to non-zero sequence of bytes. */ static inline int SCMemcmpNZ(const void *s1, const void *s2, size_t len) { uint64_t b1, w1, aligned1; uint64_t b2, w2, aligned2; /* Load aligned words containing the beginning of each string. * These loads don't trigger unaligned events. */ w1 = __insn_ldna(s1); w2 = __insn_ldna(s2); /* Can't just read next 8 bytes because it might go past the end * of a page. */ while (len > 8) { /* Here, the buffer extends into the next word by at least one * byte, so it is safe to read the next word. Do an aligned * loads on the next word. Then use the two words to create * an aligned word from each string. */ b1 = __insn_ldna(s1 + 8); b2 = __insn_ldna(s2 + 8); aligned1 = __insn_dblalign(w1, b1, s1); aligned2 = __insn_dblalign(w2, b2, s2); if (aligned1 != aligned2) return 1; /* Move forward one word (8 bytes) */ w1 = b1; w2 = b2; len -= 8; s1 += 8; s2 += 8; } /* Process the last up-to 8 bytes. */ do { if (*(char*)s1 != *(char*)s2) return 1; s1++; s2++; len--; } while (len); return 0; } /* Compare two sequences of bytes. */ static inline int SCMemcmp(const void *s1, const void *s2, size_t len) { if (len == 0) return 0; return SCMemcmpNZ(s1, s2, len); } /** \brief Convert 8 characters to lower case using SIMD. * \param Word containing the 8 bytes. * \return Word containing 8-bytes each converted to lowercase. */ static inline uint64_t vec_tolower(uint64_t cc) { /* For Uppercases letters, add 32 to convert to lower case. */ uint64_t less_than_eq_Z = __insn_v1cmpltui (cc, 'Z' + 1); uint64_t less_than_A = __insn_v1cmpltui (cc, 'A'); uint64_t is_upper = __insn_v1cmpne (less_than_eq_Z, less_than_A); return __insn_v1add (cc,__insn_v1shli (is_upper, 5)); } /** \brief compare two buffers in a case insensitive way * \param s1 buffer already in lowercase * \param s2 buffer with mixed upper and lowercase */ static inline int SCMemcmpLowercase(const void *s1, const void *s2, size_t len) { uint64_t b1, w1, aligned1; uint64_t b2, w2, aligned2; if (len == 0) return 0; /* TODO Check for already aligned cases. To optimize. */ /* Load word containing the beginning of each string. * These loads don't trigger unaligned events. */ w1 = __insn_ldna(s1); w2 = __insn_ldna(s2); /* Can't just read next 8 bytes because it might go past the end * of a page. */ while (len > 8) { /* Here, the buffer extends into the next word by at least one * byte, so it is safe to read the next word. Do aligned * loads on next word. Then use the two words to create an * aligned word from each string. */ b1 = __insn_ldna(s1 + 8); b2 = __insn_ldna(s2 + 8); aligned1 = __insn_dblalign(w1, b1, s1); aligned2 = vec_tolower(__insn_dblalign(w2, b2, s2)); if (aligned1 != aligned2) return 1; /* Move forward one word (8 bytes) */ w1 = b1; w2 = b2; len -= 8; s1 += 8; s2 += 8; } do { if (*(char*)s1 != tolower(*(char*)s2)) return 1; s1++; s2++; len--; } while (len); return 0; } #else /* No SIMD support, fall back to plain memcmp and a home grown lowercase one */ /* wrapper around memcmp to match the retvals of the SIMD implementations */ #define SCMemcmp(a,b,c) ({ \ memcmp((a), (b), (c)) ? 1 : 0; \ }) static inline int SCMemcmpLowercase(const void *s1, const void *s2, size_t len) { return MemcmpLowercase(s1, s2, len); } #endif /* SIMD */ #endif /* __UTIL_MEMCMP_H__ */ suricata-3.2.1/src/reputation.h0000644000000000000000000001171113051004444013345 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * \author Victor Julien * Original Idea by Matt Jonkman */ #ifndef __REPUTATION_H__ #define __REPUTATION_H__ #include "host.h" #define SREP_MAX_CATS 60 typedef struct SRepCIDRTree_ { SCRadixTree *srepIPV4_tree[SREP_MAX_CATS]; SCRadixTree *srepIPV6_tree[SREP_MAX_CATS]; } SRepCIDRTree; typedef struct SReputation_ { uint32_t version; uint8_t rep[SREP_MAX_CATS]; } SReputation; uint8_t SRepCatGetByShortname(char *shortname); int SRepInit(struct DetectEngineCtx_ *de_ctx); void SRepDestroy(struct DetectEngineCtx_ *de_ctx); void SRepReloadComplete(void); int SRepHostTimedOut(Host *); /** Reputation numbers (types) that we can use to lookup/update, etc * Please, dont convert this to a enum since we want the same reputation * codes always. */ #define REPUTATION_SPAM 0 /**< spammer */ #define REPUTATION_CNC 1 /**< CnC server */ #define REPUTATION_SCAN 2 /**< scanner */ #define REPUTATION_HOSTILE 3 /**< hijacked nets, RBN nets, etc */ #define REPUTATION_DYNAMIC 4 /**< Known dial up, residential, user networks */ #define REPUTATION_PUBLICACCESS 5 /**< known internet cafe's open access points */ #define REPUTATION_PROXY 6 /**< known tor out nodes, proxy servers, etc */ #define REPUTATION_P2P 7 /**< Heavy p2p node, torrent server, other sharing services */ #define REPUTATION_UTILITY 8 /**< known good places like google, yahoo, msn.com, etc */ #define REPUTATION_DDOS 9 /**< Known ddos participant */ #define REPUTATION_PHISH 10 /**< Known Phishing site */ #define REPUTATION_MALWARE 11 /**< Known Malware distribution site. Hacked web server, etc */ #define REPUTATION_ZOMBIE 12 /**< Known Zombie (botnet member) They typically are Scanner or Hostile, but if collaboration with botnet snooping, like we did back in 2005 or so, can proactively identify online zombies that joined a botnet, you may want to break those out separately */ #define REPUTATION_NUMBER 13 /**< number of rep types we have for data structure size (be careful with this) */ /* Flags for reputation */ #define REPUTATION_FLAG_NEEDSYNC 0x01 /**< rep was changed by engine, needs sync with external hub */ /** Reputation Context for IPV4 IPV6 */ typedef struct IPReputationCtx_ { /** Radix trees that holds the host reputation information */ SCRadixTree *reputationIPV4_tree; SCRadixTree *reputationIPV6_tree; /** Mutex to support concurrent access */ SCMutex reputationIPV4_lock; SCMutex reputationIPV6_lock; }IPReputationCtx; uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version); uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version); void SRepResetVersion(); int SRepLoadCatFileFromFD(FILE *fp); int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp); /** Reputation Data */ //TODO: Add a timestamp here to know the last update of this reputation. typedef struct Reputation_ { uint8_t reps[REPUTATION_NUMBER]; /**< array of 8 bit reputations */ uint8_t flags; /**< reputation flags */ time_t ctime; /**< creation time (epoch) */ time_t mtime; /**< modification time (epoch) */ } Reputation; /* flags for transactions */ #define TRANSACTION_FLAG_NEEDSYNC 0x01 /**< We will apply the transaction only if necesary */ #define TRANSACTION_FLAG_INCS 0x02 /**< We will increment only if necesary */ #define TRANSACTION_FLAG_DECS 0x04 /**< We will decrement only if necesary */ /* transaction for feedback */ typedef struct ReputationTransaction_ { uint16_t inc[REPUTATION_NUMBER]; uint16_t dec[REPUTATION_NUMBER]; uint8_t flags; } ReputationTransaction; /* API */ Reputation *SCReputationAllocData(); Reputation *SCReputationClone(Reputation *); void SCReputationFreeData(void *); IPReputationCtx *SCReputationInitCtx(void); void SCReputationFreeCtx(IPReputationCtx *); void SCReputationPrint(Reputation *); void SCReputationRegisterTests(void); #endif /* __REPUTATION_H__ */ suricata-3.2.1/src/detect-reference.h0000644000000000000000000000274713051004444014370 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_REFERENCE_H__ #define __DETECT_REFERENCE_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" /** * \brief Signature reference list. */ typedef struct DetectReference_ { /* pointer to key */ char *key; /* reference data */ char *reference; /* next reference in the signature */ struct DetectReference_ *next; } DetectReference; /** * Registration function for Reference keyword */ void DetectReferenceRegister(void); /** * This function registers unit tests for Reference keyword. */ void ReferenceRegisterTests(void); /** * Free function for a Reference object */ void DetectReferenceFree(DetectReference *); #endif /*__DETECT_REFERENCE_H__ */ suricata-3.2.1/src/host-storage.c0000644000000000000000000001731313051004444013571 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Host wrapper around storage api */ #include "suricata-common.h" #include "host-storage.h" #include "util-unittest.h" unsigned int HostStorageSize(void) { return StorageGetSize(STORAGE_HOST); } /** \defgroup hoststorage Host storage API * * The Host storage API is a per-host storage. It is a mean to extend * the Host structure with arbitrary data. * * You have first to register the storage via HostStorageRegister() during * the init of your module. Then you can attach data via HostSetStorageById() * and access them via HostGetStorageById(). * @{ */ /** * \brief Register a Host storage * * \param name the name of the storage * \param size integer coding the size of the stored value (sizeof(void *) is best choice here) * \param Alloc allocation function for the storage (can be null) * \param Free free function for the new storage * * \retval The ID of the newly register storage that will be used to access data * * It has to be called once during the init of the sub system */ int HostStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)) { return StorageRegister(STORAGE_HOST, name, size, Alloc, Free); } /** * \brief Store a pointer in a given Host storage * * \param h a pointer to the Host * \param id the id of the storage (return of HostStorageRegister() call) * \param ptr pointer to the data to store */ int HostSetStorageById(Host *h, int id, void *ptr) { return StorageSetById((Storage *)((void *)h + sizeof(Host)), STORAGE_HOST, id, ptr); } /** * \brief Get a value from a given Host storage * * \param h a pointer to the Host * \param id the id of the storage (return of HostStorageRegister() call) * */ void *HostGetStorageById(Host *h, int id) { return StorageGetById((Storage *)((void *)h + sizeof(Host)), STORAGE_HOST, id); } /** * @} */ /* Start of "private" function */ void *HostAllocStorageById(Host *h, int id) { return StorageAllocByIdPrealloc((Storage *)((void *)h + sizeof(Host)), STORAGE_HOST, id); } void HostFreeStorageById(Host *h, int id) { StorageFreeById((Storage *)((void *)h + sizeof(Host)), STORAGE_HOST, id); } void HostFreeStorage(Host *h) { if (HostStorageSize() > 0) StorageFreeAll((Storage *)((void *)h + sizeof(Host)), STORAGE_HOST); } #ifdef UNITTESTS static void *StorageTestAlloc(unsigned int size) { void *x = SCMalloc(size); return x; } static void StorageTestFree(void *x) { if (x) SCFree(x); } static int HostStorageTest01(void) { StorageInit(); int id1 = HostStorageRegister("test", 8, StorageTestAlloc, StorageTestFree); if (id1 < 0) goto error; int id2 = HostStorageRegister("variable", 24, StorageTestAlloc, StorageTestFree); if (id2 < 0) goto error; int id3 = HostStorageRegister("store", sizeof(void *), StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; HostInitConfig(1); Address a; memset(&a, 0x00, sizeof(a)); a.addr_data32[0] = 0x01020304; a.family = AF_INET; Host *h = HostGetHostFromHash(&a); if (h == NULL) { printf("failed to get host: "); goto error; } void *ptr = HostGetStorageById(h, id1); if (ptr != NULL) { goto error; } ptr = HostGetStorageById(h, id2); if (ptr != NULL) { goto error; } ptr = HostGetStorageById(h, id3); if (ptr != NULL) { goto error; } void *ptr1a = HostAllocStorageById(h, id1); if (ptr1a == NULL) { goto error; } void *ptr2a = HostAllocStorageById(h, id2); if (ptr2a == NULL) { goto error; } void *ptr3a = HostAllocStorageById(h, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = HostGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = HostGetStorageById(h, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = HostGetStorageById(h, id3); if (ptr3a != ptr3b) { goto error; } HostRelease(h); HostShutdown(); StorageCleanup(); return 1; error: HostShutdown(); StorageCleanup(); return 0; } static int HostStorageTest02(void) { StorageInit(); int id1 = HostStorageRegister("test", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; if (StorageFinalize() < 0) goto error; HostInitConfig(1); Address a; memset(&a, 0x00, sizeof(a)); a.addr_data32[0] = 0x01020304; a.family = AF_INET; Host *h = HostGetHostFromHash(&a); if (h == NULL) { printf("failed to get host: "); goto error; } void *ptr = HostGetStorageById(h, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } HostSetStorageById(h, id1, ptr1a); void *ptr1b = HostGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } HostRelease(h); HostShutdown(); StorageCleanup(); return 1; error: HostShutdown(); StorageCleanup(); return 0; } static int HostStorageTest03(void) { StorageInit(); int id1 = HostStorageRegister("test1", sizeof(void *), NULL, StorageTestFree); if (id1 < 0) goto error; int id2 = HostStorageRegister("test2", sizeof(void *), NULL, StorageTestFree); if (id2 < 0) goto error; int id3 = HostStorageRegister("test3", 32, StorageTestAlloc, StorageTestFree); if (id3 < 0) goto error; if (StorageFinalize() < 0) goto error; HostInitConfig(1); Address a; memset(&a, 0x00, sizeof(a)); a.addr_data32[0] = 0x01020304; a.family = AF_INET; Host *h = HostGetHostFromHash(&a); if (h == NULL) { printf("failed to get host: "); goto error; } void *ptr = HostGetStorageById(h, id1); if (ptr != NULL) { goto error; } void *ptr1a = SCMalloc(128); if (unlikely(ptr1a == NULL)) { goto error; } HostSetStorageById(h, id1, ptr1a); void *ptr2a = SCMalloc(256); if (unlikely(ptr2a == NULL)) { goto error; } HostSetStorageById(h, id2, ptr2a); void *ptr3a = HostAllocStorageById(h, id3); if (ptr3a == NULL) { goto error; } void *ptr1b = HostGetStorageById(h, id1); if (ptr1a != ptr1b) { goto error; } void *ptr2b = HostGetStorageById(h, id2); if (ptr2a != ptr2b) { goto error; } void *ptr3b = HostGetStorageById(h, id3); if (ptr3a != ptr3b) { goto error; } HostRelease(h); HostShutdown(); StorageCleanup(); return 1; error: HostShutdown(); StorageCleanup(); return 0; } #endif void RegisterHostStorageTests(void) { #ifdef UNITTESTS UtRegisterTest("HostStorageTest01", HostStorageTest01); UtRegisterTest("HostStorageTest02", HostStorageTest02); UtRegisterTest("HostStorageTest03", HostStorageTest03); #endif } suricata-3.2.1/src/output-json-template.h0000644000000000000000000000163413051004444015276 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author FirstName LastName */ #ifndef __OUTPUT_JSON_TEMPLATE_H__ #define __OUTPUT_JSON_TEMPLATE_H__ void JsonTemplateLogRegister(void); #endif /* __OUTPUT_JSON_TEMPLATE_H__ */ suricata-3.2.1/src/util-memcmp.c0000644000000000000000000002524313051004444013404 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Memcmp implementations. */ #include "suricata-common.h" #include "util-memcmp.h" #include "util-unittest.h" /* code is implemented in util-memcmp.h as it's all inlined */ /* UNITTESTS */ #ifdef UNITTESTS static int MemcmpTest01 (void) { uint8_t a[] = "abcd"; uint8_t b[] = "abcd"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest02 (void) { uint8_t a[] = "abcdabcdabcdabcd"; uint8_t b[] = "abcdabcdabcdabcd"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest03 (void) { uint8_t a[] = "abcdabcd"; uint8_t b[] = "abcdabcd"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest04 (void) { uint8_t a[] = "abcd"; uint8_t b[] = "abcD"; int r = SCMemcmp(a, b, sizeof(a)-1); if (r != 1) { printf("%s != %s, but memcmp returned %d: ", a, b, r); return 0; } return 1; } static int MemcmpTest05 (void) { uint8_t a[] = "abcdabcdabcdabcd"; uint8_t b[] = "abcDabcdabcdabcd"; if (SCMemcmp(a, b, sizeof(a)-1) != 1) return 0; return 1; } static int MemcmpTest06 (void) { uint8_t a[] = "abcdabcd"; uint8_t b[] = "abcDabcd"; if (SCMemcmp(a, b, sizeof(a)-1) != 1) return 0; return 1; } static int MemcmpTest07 (void) { uint8_t a[] = "abcd"; uint8_t b[] = "abcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest08 (void) { uint8_t a[] = "abcdabcdabcdabcd"; uint8_t b[] = "abcdabcdabcdabcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest09 (void) { uint8_t a[] = "abcdabcd"; uint8_t b[] = "abcdabcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 0) return 0; return 1; } static int MemcmpTest10 (void) { uint8_t a[] = "abcd"; uint8_t b[] = "Zbcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 1) return 0; return 1; } static int MemcmpTest11 (void) { uint8_t a[] = "abcdabcdabcdabcd"; uint8_t b[] = "Zbcdabcdabcdabcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 1) return 0; return 1; } static int MemcmpTest12 (void) { uint8_t a[] = "abcdabcd"; uint8_t b[] = "Zbcdabcde"; if (SCMemcmp(a, b, sizeof(a)-1) != 1) return 0; return 1; } static int MemcmpTest13 (void) { uint8_t a[] = "abcdefgh"; uint8_t b[] = "AbCdEfGhIjK"; if (SCMemcmpLowercase(a, b, sizeof(a)-1) != 0) return 0; return 1; } #include "util-cpu.h" #define TEST_RUNS 1000000 static int MemcmpTest14 (void) { #ifdef PROFILING uint64_t ticks_start = 0; uint64_t ticks_end = 0; char *a[] = { "0123456789012345", "abc", "abcdefghij", "suricata", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; char *b[] = { "1234567890123456", "abc", "abcdefghik", "suricatb", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; int t = 0; int i, j; int r1 = 0; printf("\n"); ticks_start = UtilCpuGetTicks(); for (t = 0; t < TEST_RUNS; t++) { for (i = 0; a[i] != NULL; i++) { // printf("a[%d] = %s\n", i, a[i]); size_t alen = strlen(a[i]) - 1; for (j = 0; b[j] != NULL; j++) { // printf("b[%d] = %s\n", j, b[j]); size_t blen = strlen(b[j]) - 1; r1 += (memcmp((uint8_t *)a[i], (uint8_t *)b[j], (alen < blen) ? alen : blen) ? 1 : 0); } } } ticks_end = UtilCpuGetTicks(); printf("memcmp(%d) \t\t\t%"PRIu64"\n", TEST_RUNS, ((uint64_t)(ticks_end - ticks_start))/TEST_RUNS); SCLogInfo("ticks passed %"PRIu64, ticks_end - ticks_start); printf("r1 %d\n", r1); if (r1 != (51 * TEST_RUNS)) return 0; #endif return 1; } static int MemcmpTest15 (void) { #ifdef PROFILING uint64_t ticks_start = 0; uint64_t ticks_end = 0; char *a[] = { "0123456789012345", "abc", "abcdefghij", "suricata", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; char *b[] = { "1234567890123456", "abc", "abcdefghik", "suricatb", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; int t = 0; int i, j; int r2 = 0; printf("\n"); ticks_start = UtilCpuGetTicks(); for (t = 0; t < TEST_RUNS; t++) { for (i = 0; a[i] != NULL; i++) { // printf("a[%d] = %s\n", i, a[i]); size_t alen = strlen(a[i]) - 1; for (j = 0; b[j] != NULL; j++) { // printf("b[%d] = %s\n", j, b[j]); size_t blen = strlen(b[j]) - 1; r2 += MemcmpLowercase((uint8_t *)a[i], (uint8_t *)b[j], (alen < blen) ? alen : blen); } } } ticks_end = UtilCpuGetTicks(); printf("MemcmpLowercase(%d) \t\t%"PRIu64"\n", TEST_RUNS, ((uint64_t)(ticks_end - ticks_start))/TEST_RUNS); SCLogInfo("ticks passed %"PRIu64, ticks_end - ticks_start); printf("r2 %d\n", r2); if (r2 != (51 * TEST_RUNS)) return 0; #endif return 1; } static int MemcmpTest16 (void) { #ifdef PROFILING uint64_t ticks_start = 0; uint64_t ticks_end = 0; char *a[] = { "0123456789012345", "abc", "abcdefghij", "suricata", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; char *b[] = { "1234567890123456", "abc", "abcdefghik", "suricatb", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; int t = 0; int i, j; int r3 = 0; printf("\n"); ticks_start = UtilCpuGetTicks(); for (t = 0; t < TEST_RUNS; t++) { for (i = 0; a[i] != NULL; i++) { // printf("a[%d] = %s\n", i, a[i]); size_t alen = strlen(a[i]) - 1; for (j = 0; b[j] != NULL; j++) { // printf("b[%d] = %s\n", j, b[j]); size_t blen = strlen(b[j]) - 1; r3 += SCMemcmp((uint8_t *)a[i], (uint8_t *)b[j], (alen < blen) ? alen : blen); } } } ticks_end = UtilCpuGetTicks(); printf("SCMemcmp(%d) \t\t\t%"PRIu64"\n", TEST_RUNS, ((uint64_t)(ticks_end - ticks_start))/TEST_RUNS); SCLogInfo("ticks passed %"PRIu64, ticks_end - ticks_start); printf("r3 %d\n", r3); if (r3 != (51 * TEST_RUNS)) return 0; #endif return 1; } static int MemcmpTest17 (void) { #ifdef PROFILING uint64_t ticks_start = 0; uint64_t ticks_end = 0; char *a[] = { "0123456789012345", "abc", "abcdefghij", "suricata", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; char *b[] = { "1234567890123456", "abc", "abcdefghik", "suricatb", "test", "xyz", "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr", "abcdefghijklmnopqrstuvwxyz", NULL }; int t = 0; int i, j; int r4 = 0; printf("\n"); ticks_start = UtilCpuGetTicks(); for (t = 0; t < TEST_RUNS; t++) { for (i = 0; a[i] != NULL; i++) { // printf("a[%d] = %s\n", i, a[i]); size_t alen = strlen(a[i]) - 1; for (j = 0; b[j] != NULL; j++) { // printf("b[%d] = %s\n", j, b[j]); size_t blen = strlen(b[j]) - 1; r4 += SCMemcmpLowercase((uint8_t *)a[i], (uint8_t *)b[j], (alen < blen) ? alen : blen); } } } ticks_end = UtilCpuGetTicks(); printf("SCMemcmpLowercase(%d) \t\t%"PRIu64"\n", TEST_RUNS, ((uint64_t)(ticks_end - ticks_start))/TEST_RUNS); SCLogInfo("ticks passed %"PRIu64, ticks_end - ticks_start); printf("r4 %d\n", r4); if (r4 != (51 * TEST_RUNS)) return 0; #endif return 1; } struct MemcmpTest18Tests { char *a; char *b; int result; } memcmp_tests18_tests[] = { { "abcdefgh", "!bcdefgh", 1, }, { "?bcdefgh", "!bcdefgh", 1, }, { "!bcdefgh", "abcdefgh", 1, }, { "!bcdefgh", "?bcdefgh", 1, }, { "zbcdefgh", "bbcdefgh", 1, }, { "abcdefgh12345678", "!bcdefgh12345678", 1, }, { "?bcdefgh12345678", "!bcdefgh12345678", 1, }, { "!bcdefgh12345678", "abcdefgh12345678", 1, }, { "!bcdefgh12345678", "?bcdefgh12345678", 1, }, { "bbcdefgh12345678", "zbcdefgh12345678", 1, }, { "abcdefgh", "abcdefgh", 0, }, { "abcdefgh", "Abcdefgh", 0, }, { "abcdefgh12345678", "Abcdefgh12345678", 0, }, { NULL, NULL, 0 }, }; static int MemcmpTest18 (void) { struct MemcmpTest18Tests *t = memcmp_tests18_tests; while (t && t->a != NULL) { if (SCMemcmpLowercase(t->a, t->b, strlen(t->a)-1) != t->result) return 0; SCLogInfo("ok"); t++; } return 1; } #endif /* UNITTESTS */ void MemcmpRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("MemcmpTest01", MemcmpTest01); UtRegisterTest("MemcmpTest02", MemcmpTest02); UtRegisterTest("MemcmpTest03", MemcmpTest03); UtRegisterTest("MemcmpTest04", MemcmpTest04); UtRegisterTest("MemcmpTest05", MemcmpTest05); UtRegisterTest("MemcmpTest06", MemcmpTest06); UtRegisterTest("MemcmpTest07", MemcmpTest07); UtRegisterTest("MemcmpTest08", MemcmpTest08); UtRegisterTest("MemcmpTest09", MemcmpTest09); UtRegisterTest("MemcmpTest10", MemcmpTest10); UtRegisterTest("MemcmpTest11", MemcmpTest11); UtRegisterTest("MemcmpTest12", MemcmpTest12); UtRegisterTest("MemcmpTest13", MemcmpTest13); UtRegisterTest("MemcmpTest14", MemcmpTest14); UtRegisterTest("MemcmpTest15", MemcmpTest15); UtRegisterTest("MemcmpTest16", MemcmpTest16); UtRegisterTest("MemcmpTest17", MemcmpTest17); UtRegisterTest("MemcmpTest18", MemcmpTest18); #endif /* UNITTESTS */ } suricata-3.2.1/src/runmode-pcap-file.h0000644000000000000000000000201413051004444014456 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_PCAP_FILE_H__ #define __RUNMODE_PCAP_FILE_H__ int RunModeFilePcapSingle(void); int RunModeFilePcapAutoFp(void); void RunModeFilePcapRegister(void); const char *RunModeFilePcapGetDefaultMode(void); #endif /* __RUNMODE_PCAP_FILE_H__ */ suricata-3.2.1/src/util-magic.c0000644000000000000000000004766513051004444013222 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Wrappers and tests for libmagic usage. * * Libmagic's API is not thread safe. The data the pointer returned by * magic_buffer is overwritten by the next magic_buffer call. This is * why we need to lock calls and copy the returned string. */ #include "suricata-common.h" #ifdef HAVE_MAGIC #include "conf.h" #include "util-unittest.h" static magic_t g_magic_ctx = NULL; static SCMutex g_magic_lock; /** * \brief Initialize the "magic" context. */ int MagicInit(void) { BUG_ON(g_magic_ctx != NULL); SCEnter(); char *filename = NULL; FILE *fd = NULL; SCMutexInit(&g_magic_lock, NULL); SCMutexLock(&g_magic_lock); g_magic_ctx = magic_open(0); if (g_magic_ctx == NULL) { SCLogError(SC_ERR_MAGIC_OPEN, "magic_open failed: %s", magic_error(g_magic_ctx)); goto error; } (void)ConfGet("magic-file", &filename); if (filename != NULL) { if (strlen(filename) == 0) { /* set filename to NULL on *nix systems so magic_load uses system * default path (see man libmagic) */ SCLogConfig("using system default magic-file"); filename = NULL; } else { SCLogConfig("using magic-file %s", filename); if ( (fd = fopen(filename, "r")) == NULL) { SCLogWarning(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; } fclose(fd); } } if (magic_load(g_magic_ctx, filename) != 0) { SCLogError(SC_ERR_MAGIC_LOAD, "magic_load failed: %s", magic_error(g_magic_ctx)); goto error; } SCMutexUnlock(&g_magic_lock); SCReturnInt(0); error: if (g_magic_ctx != NULL) { magic_close(g_magic_ctx); g_magic_ctx = NULL; } SCMutexUnlock(&g_magic_lock); SCReturnInt(-1); } /** * \brief Find the magic value for a buffer. * * \param buf the buffer * \param buflen length of the buffer * * \retval result pointer to null terminated string */ char *MagicGlobalLookup(const uint8_t *buf, uint32_t buflen) { const char *result = NULL; char *magic = NULL; SCMutexLock(&g_magic_lock); if (buf != NULL && buflen > 0) { result = magic_buffer(g_magic_ctx, (void *)buf, (size_t)buflen); if (result != NULL) { magic = SCStrdup(result); if (unlikely(magic == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup magic"); } } } SCMutexUnlock(&g_magic_lock); SCReturnPtr(magic, "const char"); } /** * \brief Find the magic value for a buffer. * * \param buf the buffer * \param buflen length of the buffer * * \retval result pointer to null terminated string */ char *MagicThreadLookup(magic_t *ctx, const uint8_t *buf, uint32_t buflen) { const char *result = NULL; char *magic = NULL; if (buf != NULL && buflen > 0) { result = magic_buffer(*ctx, (void *)buf, (size_t)buflen); if (result != NULL) { magic = SCStrdup(result); if (unlikely(magic == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup magic"); } } } SCReturnPtr(magic, "const char"); } void MagicDeinit(void) { SCMutexLock(&g_magic_lock); if (g_magic_ctx != NULL) { magic_close(g_magic_ctx); g_magic_ctx = NULL; } SCMutexUnlock(&g_magic_lock); SCMutexDestroy(&g_magic_lock); } #ifdef UNITTESTS #if defined OS_FREEBSD || defined OS_DARWIN #define MICROSOFT_OFFICE_DOC "OLE 2 Compound Document" #else #define MICROSOFT_OFFICE_DOC "Microsoft Office Document" #endif /** \test magic lib calls -- init */ int MagicInitTest01(void) { int result = 0; magic_t magic_ctx; magic_ctx = magic_open(0); if (magic_ctx == NULL) { printf("failure retrieving magic_ctx\n"); return 0; } if (magic_load(magic_ctx, NULL) == -1) { printf("failure magic_load\n"); goto end; } result = 1; end: magic_close(magic_ctx); return result; } /** \test magic init through api */ int MagicInitTest02(void) { if (g_magic_ctx != NULL) { printf("g_magic_ctx != NULL at start of the test: "); return 0; } if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } if (g_magic_ctx == NULL) { printf("g_magic_ctx == NULL: "); return 0; } MagicDeinit(); if (g_magic_ctx != NULL) { printf("g_magic_ctx != NULL at end of the test: "); return 0; } return 1; } /** \test magic lib calls -- lookup */ int MagicDetectTest01(void) { magic_t magic_ctx; char *result = NULL; char buffer[] = { 0x25, 'P', 'D', 'F', '-', '1', '.', '3', 0x0d, 0x0a}; size_t buffer_len = sizeof(buffer); int retval = 0; magic_ctx = magic_open(0); if (magic_ctx == NULL) { printf("failure retrieving magic_ctx\n"); return 0; } if (magic_load(magic_ctx, NULL) == -1) { printf("magic_load failure\n"); goto end; } result = (char *)magic_buffer(magic_ctx, (void *)buffer, buffer_len); if (result == NULL || strncmp(result, "PDF document", 12) != 0) { printf("result %p:%s, not \"PDF document\": ", result,result?result:"(null)"); goto end; } retval = 1; end: magic_close(magic_ctx); return retval; } #if 0 /** \test magic lib calls -- lookup */ int MagicDetectTest02(void) { magic_t magic_ctx; char *result = NULL; char buffer[] = { 0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x03, 0x00, 0xfe, 0xff, 0x09, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x98, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x97, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }; size_t buffer_len = sizeof(buffer); int retval = 0; magic_ctx = magic_open(0); if (magic_ctx == NULL) { printf("failure retrieving magic_ctx\n"); return 0; } if (magic_load(magic_ctx, NULL) == -1) { printf("magic_load failure\n"); goto end; } result = (char *)magic_buffer(magic_ctx, (void *)buffer, buffer_len); if (result == NULL || strcmp(result, MICROSOFT_OFFICE_DOC) != 0) { printf("result %p:%s, not \"Microsoft Office Document\": ", result,result?result:"(null)"); goto end; } retval = 1; end: magic_close(magic_ctx); return retval; } #endif /** \test magic lib calls -- lookup */ int MagicDetectTest03(void) { char buffer[] = { 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x55, 0x2a, 0x36, 0x5e, 0xc6, 0x32, 0x0c, 0x27, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x6e, 0x64, 0x2e, 0x6f, 0x61, 0x73, 0x69, 0x73, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x74, 0x65, 0x78, 0x74, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x55, 0x2a, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x32, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x62, 0x61, 0x72, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x0b, }; size_t buffer_len = sizeof(buffer); magic_t magic_ctx = magic_open(0); FAIL_IF_NULL(magic_ctx); FAIL_IF(magic_load(magic_ctx, NULL) == -1); char *result = (char *)magic_buffer(magic_ctx, (void *)buffer, buffer_len); FAIL_IF_NULL(result); char *str = strstr(result, "OpenDocument Text"); if (str == NULL) { printf("result %s, not \"OpenDocument Text\": ", str); FAIL; } magic_close(magic_ctx); PASS; } /** \test magic lib calls -- lookup */ int MagicDetectTest04(void) { magic_t magic_ctx; char *result = NULL; char buffer[] = { 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x00, 0x00, 0x52, 0x7b, 0x86, 0x3c, 0x8b, 0x70, 0x96, 0x08, 0x1c, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x6e, 0x64, 0x2e, 0x73, 0x75, 0x6e, 0x2e, 0x78, 0x6d, 0x6c, 0x2e, 0x62, 0x61, 0x73, 0x65, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x00, 0x00, 0x52, 0x7b, 0x86, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x45, 0x54, 0x41, 0x2d, 0x49, 0x4e, 0x46, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x08, 0x00, 0xa8, 0x42, 0x1d, 0x37, 0x5d, 0xa7, 0xb2, 0xc1, 0xde, 0x01, 0x00, 0x00, 0x7e, 0x04, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2e, 0x78, 0x6d, 0x6c, 0x95, 0x54, 0x4d, 0x6f, 0xdb, 0x30, 0x0c, 0xbd, 0xe7, 0x57, 0x18, 0x02, 0x06, 0x6c, 0x07, 0xc5, 0xe9, 0xb6, 0xc3, 0x22, 0xc4, 0x29, 0x86, 0x7d, 0x00, 0x05, 0x8a, 0x9d, 0xb2, 0x43, 0x8f, 0xb2, 0x24, 0xa7, 0xc2, 0x64, 0xc9, 0x15, }; size_t buffer_len = sizeof(buffer); int retval = 0; magic_ctx = magic_open(0); if (magic_ctx == NULL) { printf("failure retrieving magic_ctx\n"); return 0; } if (magic_load(magic_ctx, NULL) == -1) { printf("magic_load failure\n"); goto end; } result = (char *)magic_buffer(magic_ctx, (void *)buffer, buffer_len); if (result == NULL || strncmp(result, "OpenOffice.org 1.x", 18) != 0) { printf("result %p:%s, not \"OpenOffice.org 1.x\": ", result,result?result:"(null)"); goto end; } retval = 1; end: magic_close(magic_ctx); return retval; } /** \test magic api calls -- lookup */ int MagicDetectTest05(void) { const char *result = NULL; uint8_t buffer[] = { 0x25, 'P', 'D', 'F', '-', '1', '.', '3', 0x0d, 0x0a}; size_t buffer_len = sizeof(buffer); int retval = 0; if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } result = MagicGlobalLookup(buffer, buffer_len); if (result == NULL || strncmp(result, "PDF document", 12) != 0) { printf("result %p:%s, not \"PDF document\": ", result,result?result:"(null)"); goto end; } retval = 1; end: MagicDeinit(); return retval; } #if 0 /** \test magic api calls -- lookup */ int MagicDetectTest06(void) { const char *result = NULL; uint8_t buffer[] = { 0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x00, 0x03, 0x00, 0xfe, 0xff, 0x09, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x98, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x97, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }; size_t buffer_len = sizeof(buffer); int retval = 0; if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } result = MagicGlobalLookup(buffer, buffer_len); if (result == NULL || strcmp(result, MICROSOFT_OFFICE_DOC) != 0) { printf("result %p:%s, not \"Microsoft Office Document\": ", result,result?result:"(null)"); goto end; } retval = 1; end: MagicDeinit(); return retval; } #endif /** \test magic api calls -- lookup */ int MagicDetectTest07(void) { const char *result = NULL; uint8_t buffer[] = { 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x55, 0x2a, 0x36, 0x5e, 0xc6, 0x32, 0x0c, 0x27, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x6e, 0x64, 0x2e, 0x6f, 0x61, 0x73, 0x69, 0x73, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x64, 0x6f, 0x63, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x74, 0x65, 0x78, 0x74, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x55, 0x2a, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x32, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x62, 0x61, 0x72, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x0b, }; size_t buffer_len = sizeof(buffer); FAIL_IF(MagicInit() < 0); result = MagicGlobalLookup(buffer, buffer_len); FAIL_IF_NULL(result); char *str = strstr(result, "OpenDocument Text"); if (str == NULL) { printf("result %s, not \"OpenDocument Text\": ", str); FAIL; } MagicDeinit(); PASS; } /** \test magic api calls -- lookup */ int MagicDetectTest08(void) { const char *result = NULL; uint8_t buffer[] = { 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x00, 0x00, 0x52, 0x7b, 0x86, 0x3c, 0x8b, 0x70, 0x96, 0x08, 0x1c, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x6e, 0x64, 0x2e, 0x73, 0x75, 0x6e, 0x2e, 0x78, 0x6d, 0x6c, 0x2e, 0x62, 0x61, 0x73, 0x65, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x00, 0x00, 0x52, 0x7b, 0x86, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x45, 0x54, 0x41, 0x2d, 0x49, 0x4e, 0x46, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x08, 0x08, 0x00, 0xa8, 0x42, 0x1d, 0x37, 0x5d, 0xa7, 0xb2, 0xc1, 0xde, 0x01, 0x00, 0x00, 0x7e, 0x04, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2e, 0x78, 0x6d, 0x6c, 0x95, 0x54, 0x4d, 0x6f, 0xdb, 0x30, 0x0c, 0xbd, 0xe7, 0x57, 0x18, 0x02, 0x06, 0x6c, 0x07, 0xc5, 0xe9, 0xb6, 0xc3, 0x22, 0xc4, 0x29, 0x86, 0x7d, 0x00, 0x05, 0x8a, 0x9d, 0xb2, 0x43, 0x8f, 0xb2, 0x24, 0xa7, 0xc2, 0x64, 0xc9, 0x15, }; size_t buffer_len = sizeof(buffer); int retval = 0; if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } result = MagicGlobalLookup(buffer, buffer_len); if (result == NULL || strncmp(result, "OpenOffice.org 1.x", 18) != 0) { printf("result %p:%s, not \"OpenOffice.org 1.x\": ", result,result?result:"(null)"); goto end; } retval = 1; end: MagicDeinit(); return retval; } /** \test magic api calls -- make sure memory is shared */ int MagicDetectTest09(void) { const char *result1 = NULL; const char *result2 = NULL; uint8_t buffer[] = { 0x25, 'P', 'D', 'F', '-', '1', '.', '3', 0x0d, 0x0a}; size_t buffer_len = sizeof(buffer); int retval = 0; if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } result1 = MagicGlobalLookup(buffer, buffer_len); if (result1 == NULL || strncmp(result1, "PDF document", 12) != 0) { printf("result %p:%s, not \"PDF document\": ", result1,result1?result1:"(null)"); goto end; } result2 = MagicGlobalLookup(buffer, buffer_len); if (result2 == NULL || strncmp(result2, "PDF document", 12) != 0) { printf("result %p:%s, not \"PDF document\": ", result2,result2?result2:"(null)"); goto end; } if (result1 != result2) { printf("pointers not equal, weird... %p != %p: ", result1, result2); goto end; } retval = 1; end: MagicDeinit(); return retval; } /** \test results in valgrind warning about invalid read, tested with * file 5.09 and 5.11 */ static int MagicDetectTest10ValgrindError(void) { const char *result = NULL; uint8_t buffer[] = { 0xFF,0xD8,0xFF,0xE0,0x00,0x10,0x4A,0x46,0x49,0x46,0x00,0x01,0x01,0x01,0x01,0x2C, 0x01,0x2C,0x00,0x00,0xFF,0xFE,0x00,0x4C,0x53,0x69,0x67,0x6E,0x61,0x74,0x75,0x72, 0x65,0x3A,0x34,0x31,0x31,0x65,0x33,0x38,0x61,0x61,0x61,0x31,0x37,0x65,0x33,0x30, 0x66,0x30,0x32,0x38,0x62,0x61,0x30,0x31,0x36,0x32,0x36,0x37,0x66,0x66,0x30,0x31, 0x36,0x36,0x61,0x65,0x35,0x39,0x65,0x38,0x31,0x39,0x62,0x61,0x32,0x34,0x63,0x39, 0x62,0x31,0x33,0x37,0x33,0x62,0x31,0x61,0x35,0x61,0x38,0x65,0x64,0x63,0x36,0x30, 0x65,0x37,0xFF,0xE2,0x02,0x2C,0x49,0x43,0x43,0x5F,0x50,0x52,0x4F,0x46,0x49,0x4C, 0x45,0x00,0x01,0x01,0x00,0x00,0x02,0x1C,0x41,0x44,0x42,0x45,0x02,0x10,0x00,0x00, 0x6D,0x6E,0x74,0x72,0x52,0x47,0x42,0x20,0x58,0x59,0x5A,0x20,0x07,0xCF,0x00,0x05, 0x00,0x09,0x00,0x15,0x00,0x0B,0x00,0x21,0x61,0x63,0x73,0x70,0x41,0x50,0x50,0x4C, 0x00,0x00,0x00,0x00,0x6E,0x6F,0x6E,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, }; size_t buffer_len = sizeof(buffer); int retval = 0; if (MagicInit() < 0) { printf("MagicInit() failure\n"); return 0; } result = MagicGlobalLookup(buffer, buffer_len); if (result == NULL || strncmp(result, "JPEG", 4) != 0) { printf("result %p:%s, not \"JPEG\": ", result,result?result:"(null)"); goto end; } retval = 1; end: MagicDeinit(); return retval; } #endif /* UNITTESTS */ #endif void MagicRegisterTests(void) { #ifdef HAVE_MAGIC #ifdef UNITTESTS UtRegisterTest("MagicInitTest01", MagicInitTest01); UtRegisterTest("MagicInitTest02", MagicInitTest02); UtRegisterTest("MagicDetectTest01", MagicDetectTest01); //UtRegisterTest("MagicDetectTest02", MagicDetectTest02, 1); UtRegisterTest("MagicDetectTest03", MagicDetectTest03); UtRegisterTest("MagicDetectTest04", MagicDetectTest04); UtRegisterTest("MagicDetectTest05", MagicDetectTest05); //UtRegisterTest("MagicDetectTest06", MagicDetectTest06, 1); UtRegisterTest("MagicDetectTest07", MagicDetectTest07); UtRegisterTest("MagicDetectTest08", MagicDetectTest08); /* fails in valgrind, somehow it returns different pointers then. UtRegisterTest("MagicDetectTest09", MagicDetectTest09, 1); */ UtRegisterTest("MagicDetectTest10ValgrindError", MagicDetectTest10ValgrindError); #endif /* UNITTESTS */ #endif /* HAVE_MAGIC */ } suricata-3.2.1/src/app-layer-dns-common.h0000644000000000000000000002550713051004444015125 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __APP_LAYER_DNS_COMMON_H__ #define __APP_LAYER_DNS_COMMON_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "queue.h" #include "util-byte.h" #define DNS_MAX_SIZE 256 #define DNS_RECORD_TYPE_A 1 #define DNS_RECORD_TYPE_NS 2 #define DNS_RECORD_TYPE_MD 3 // Obsolete #define DNS_RECORD_TYPE_MF 4 // Obsolete #define DNS_RECORD_TYPE_CNAME 5 #define DNS_RECORD_TYPE_SOA 6 #define DNS_RECORD_TYPE_MB 7 // Experimental #define DNS_RECORD_TYPE_MG 8 // Experimental #define DNS_RECORD_TYPE_MR 9 // Experimental #define DNS_RECORD_TYPE_NULL 10 // Experimental #define DNS_RECORD_TYPE_WKS 11 #define DNS_RECORD_TYPE_PTR 12 #define DNS_RECORD_TYPE_HINFO 13 #define DNS_RECORD_TYPE_MINFO 14 #define DNS_RECORD_TYPE_MX 15 #define DNS_RECORD_TYPE_TXT 16 #define DNS_RECORD_TYPE_RP 17 #define DNS_RECORD_TYPE_AFSDB 18 #define DNS_RECORD_TYPE_X25 19 #define DNS_RECORD_TYPE_ISDN 20 #define DNS_RECORD_TYPE_RT 21 #define DNS_RECORD_TYPE_NSAP 22 #define DNS_RECORD_TYPE_NSAPPTR 23 #define DNS_RECORD_TYPE_SIG 24 #define DNS_RECORD_TYPE_KEY 25 #define DNS_RECORD_TYPE_PX 26 #define DNS_RECORD_TYPE_GPOS 27 #define DNS_RECORD_TYPE_AAAA 28 #define DNS_RECORD_TYPE_LOC 29 #define DNS_RECORD_TYPE_NXT 30 // Obosolete #define DNS_RECORD_TYPE_SRV 33 #define DNS_RECORD_TYPE_ATMA 34 #define DNS_RECORD_TYPE_NAPTR 35 #define DNS_RECORD_TYPE_KX 36 #define DNS_RECORD_TYPE_CERT 37 #define DNS_RECORD_TYPE_A6 38 // Obsolete #define DNS_RECORD_TYPE_DNAME 39 #define DNS_RECORD_TYPE_OPT 41 #define DNS_RECORD_TYPE_APL 42 #define DNS_RECORD_TYPE_DS 43 #define DNS_RECORD_TYPE_SSHFP 44 #define DNS_RECORD_TYPE_IPSECKEY 45 #define DNS_RECORD_TYPE_RRSIG 46 #define DNS_RECORD_TYPE_NSEC 47 #define DNS_RECORD_TYPE_DNSKEY 48 #define DNS_RECORD_TYPE_DHCID 49 #define DNS_RECORD_TYPE_NSEC3 50 #define DNS_RECORD_TYPE_NSEC3PARAM 51 #define DNS_RECORD_TYPE_TLSA 52 #define DNS_RECORD_TYPE_HIP 55 #define DNS_RECORD_TYPE_CDS 59 #define DNS_RECORD_TYPE_CDNSKEY 60 #define DNS_RECORD_TYPE_SPF 99 // Obsolete #define DNS_RECORD_TYPE_TKEY 249 #define DNS_RECORD_TYPE_TSIG 250 #define DNS_RECORD_TYPE_MAILA 254 // Obsolete #define DNS_RECORD_TYPE_ANY 255 #define DNS_RECORD_TYPE_URI 256 #define DNS_RCODE_NOERROR 0 #define DNS_RCODE_FORMERR 1 #define DNS_RCODE_SERVFAIL 2 #define DNS_RCODE_NXDOMAIN 3 #define DNS_RCODE_NOTIMP 4 #define DNS_RCODE_REFUSED 5 #define DNS_RCODE_YXDOMAIN 6 #define DNS_RCODE_YXRRSET 7 #define DNS_RCODE_NXRRSET 8 #define DNS_RCODE_NOTAUTH 9 #define DNS_RCODE_NOTZONE 10 // Support for OPT RR from RFC6891 will be needed to // parse RCODE values over 15 #define DNS_RCODE_BADVERS 16 #define DNS_RCODE_BADSIG 16 #define DNS_RCODE_BADKEY 17 #define DNS_RCODE_BADTIME 18 #define DNS_RCODE_BADMODE 19 #define DNS_RCODE_BADNAME 20 #define DNS_RCODE_BADALG 21 #define DNS_RCODE_BADTRUNC 22 enum { DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE, DNS_DECODER_EVENT_MALFORMED_DATA, DNS_DECODER_EVENT_NOT_A_REQUEST, DNS_DECODER_EVENT_NOT_A_RESPONSE, DNS_DECODER_EVENT_Z_FLAG_SET, DNS_DECODER_EVENT_FLOODED, DNS_DECODER_EVENT_STATE_MEMCAP_REACHED, }; /** \brief DNS packet header */ typedef struct DNSHeader_ { uint16_t tx_id; uint16_t flags; uint16_t questions; uint16_t answer_rr; uint16_t authority_rr; uint16_t additional_rr; } __attribute__((__packed__)) DNSHeader; typedef struct DNSQueryTrailer_ { uint16_t type; uint16_t class; } __attribute__((__packed__)) DNSQueryTrailer; /** \brief DNS answer header * packed as we don't want alignment to mess up sizeof() */ struct DNSAnswerHeader_ { uint16_t type; uint16_t class; uint32_t ttl; uint16_t len; } __attribute__((__packed__)); typedef struct DNSAnswerHeader_ DNSAnswerHeader; /** \brief List types in the TX. * Used when storing answers from "Answer" or "Authority" */ typedef enum { DNS_LIST_ANSWER = 0, DNS_LIST_AUTHORITY, } DnsListEnum; /** \brief DNS Query storage. Stored in TX list. * * Layout is: * [list ptr][2 byte type][2 byte class][2 byte len][...data...] */ typedef struct DNSQueryEntry_ { TAILQ_ENTRY(DNSQueryEntry_) next; uint16_t type; uint16_t class; uint16_t len; } DNSQueryEntry; /** \brief DNS Answer storage. Stored in TX list. * * Layout is: * [list ptr][2 byte type][2 byte class][2 byte ttl] \ * [2 byte fqdn len][2 byte data len][...fqdn...][...data...] */ typedef struct DNSAnswerEntry_ { TAILQ_ENTRY(DNSAnswerEntry_) next; uint16_t type; uint16_t class; uint32_t ttl; uint16_t fqdn_len; uint16_t data_len; } DNSAnswerEntry; /** \brief DNS Transaction, request/reply with same TX id. */ typedef struct DNSTransaction_ { uint16_t tx_num; /**< internal: id */ uint16_t tx_id; /**< transaction id */ uint32_t logged; /**< flags for loggers done logging */ uint8_t replied; /**< bool indicating request is replied to. */ uint8_t reply_lost; uint8_t rcode; /**< response code (e.g. "no error" / "no such name") */ uint8_t recursion_desired; /**< server said "recursion desired" */ TAILQ_HEAD(, DNSQueryEntry_) query_list; /**< list for query/queries */ TAILQ_HEAD(, DNSAnswerEntry_) answer_list; /**< list for answers */ TAILQ_HEAD(, DNSAnswerEntry_) authority_list; /**< list for authority records */ AppLayerDecoderEvents *decoder_events; /**< per tx events */ TAILQ_ENTRY(DNSTransaction_) next; DetectEngineState *de_state; } DNSTransaction; /** \brief Per flow DNS state container */ typedef struct DNSState_ { TAILQ_HEAD(, DNSTransaction_) tx_list; /**< transaction list */ DNSTransaction *curr; /**< ptr to current tx */ DNSTransaction *iter; uint64_t transaction_max; uint32_t unreplied_cnt; /**< number of unreplied requests in a row */ uint32_t memuse; /**< state memuse, for comparing with state-memcap settings */ uint64_t tx_with_detect_state_cnt; struct timeval last_req; /**< Timestamp of last request. */ struct timeval last_resp; /**< Timestamp of last response. */ uint16_t window; /**< Window of allowed unreplied * requests. Set by the maximum * number of subsequent requests * without a response. */ uint16_t events; uint16_t givenup; /* used by TCP only */ uint16_t offset; uint16_t record_len; uint8_t *buffer; } DNSState; #define DNS_CONFIG_DEFAULT_REQUEST_FLOOD 500 #define DNS_CONFIG_DEFAULT_STATE_MEMCAP 512*1024 #define DNS_CONFIG_DEFAULT_GLOBAL_MEMCAP 16*1024*1024 void DNSConfigInit(void); void DNSConfigSetRequestFlood(uint32_t value); void DNSConfigSetStateMemcap(uint32_t value); void DNSConfigSetGlobalMemcap(uint64_t value); void DNSIncrMemcap(uint32_t size, DNSState *state); void DNSDecrMemcap(uint32_t size, DNSState *state); int DNSCheckMemcap(uint32_t want, DNSState *state); uint64_t DNSMemcapGetMemuseCounter(void); uint64_t DNSMemcapGetMemcapStateCounter(void); uint64_t DNSMemcapGetMemcapGlobalCounter(void); void RegisterDNSParsers(void); void DNSParserTests(void); void DNSParserRegisterTests(void); void DNSAppLayerDecoderEventsRegister(int alproto); int DNSStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type); void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, AppProto alproto); void *DNSGetTx(void *alstate, uint64_t tx_id); uint64_t DNSGetTxCnt(void *alstate); void DNSSetTxLogged(void *alstate, void *tx, uint32_t logger); int DNSGetTxLogged(void *alstate, void *tx, uint32_t logger); int DNSGetAlstateProgress(void *tx, uint8_t direction); int DNSGetAlstateProgressCompletionStatus(uint8_t direction); void DNSStateTransactionFree(void *state, uint64_t tx_id); DNSTransaction *DNSTransactionFindByTxId(const DNSState *dns_state, const uint16_t tx_id); int DNSStateHasTxDetectState(void *alstate); DetectEngineState *DNSGetTxDetectState(void *vtx); int DNSSetTxDetectState(void *alstate, void *vtx, DetectEngineState *s); void DNSSetEvent(DNSState *s, uint8_t e); void *DNSStateAlloc(void); void DNSStateFree(void *s); AppLayerDecoderEvents *DNSGetEvents(void *state, uint64_t id); int DNSHasEvents(void *state); int DNSValidateRequestHeader(DNSState *, const DNSHeader *dns_header); int DNSValidateResponseHeader(DNSState *, const DNSHeader *dns_header); void DNSStoreQueryInState(DNSState *dns_state, const uint8_t *fqdn, const uint16_t fqdn_len, const uint16_t type, const uint16_t class, const uint16_t tx_id); void DNSStoreAnswerInState(DNSState *dns_state, const int rtype, const uint8_t *fqdn, const uint16_t fqdn_len, const uint16_t type, const uint16_t class, const uint16_t ttl, const uint8_t *data, const uint16_t data_len, const uint16_t tx_id); const uint8_t *DNSReponseParse(DNSState *dns_state, const DNSHeader * const dns_header, const uint16_t num, const DnsListEnum list, const uint8_t * const input, const uint32_t input_len, const uint8_t *data); uint16_t DNSUdpResponseGetNameByOffset(const uint8_t * const input, const uint32_t input_len, const uint16_t offset, uint8_t *fqdn, const size_t fqdn_size); void DNSCreateTypeString(uint16_t type, char *str, size_t str_size); void DNSCreateRcodeString(uint8_t rcode, char *str, size_t str_size); #endif /* __APP_LAYER_DNS_COMMON_H__ */ suricata-3.2.1/src/alert-syslog.h0000644000000000000000000000170013051004444013575 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * alert syslog modeule header file * */ #ifndef __ALERT_SYSLOG_H__ #define __ALERT_SYSLOG_H__ void AlertSyslogRegister(void); #endif /* __ALERT_SYSLOG_H__ */ suricata-3.2.1/src/data-queue.c0000644000000000000000000000451413051004444013204 00000000000000/** * Copyright (c) 2009, 2010 Open Information Security Foundation. * * \author Anoop Saldanha */ #include "suricata-common.h" #include "data-queue.h" #include "threads.h" /** * \brief Enqueues data on the queue. * * \param q Pointer to the data queue. * \param data Pointer to the data to be queued. It should be a pointer to a * structure instance that implements the template structure * struct SCDQGenericQData_ defined in data-queue.h. */ void SCDQDataEnqueue(SCDQDataQueue *q, SCDQGenericQData *data) { /* we already have some data in queue */ if (q->top != NULL) { data->next = q->top; q->top->prev = data; q->top = data; /* the queue is empty */ } else { q->top = data; q->bot = data; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ return; } /** * \brief Dequeues and returns an entry from the queue. * * \param q Pointer to the data queue. * \param retval Pointer to the data that has been enqueued. The instance * returned is/should be a pointer to a structure instance that * implements the template structure struct SCDQGenericQData_ * defined in data-queue.h. */ SCDQGenericQData *SCDQDataDequeue(SCDQDataQueue *q) { SCDQGenericQData *data = NULL; /* if the queue is empty there are is no data left and we return NULL */ if (q->len == 0) { return NULL; } /* If we are going to get the last packet, set len to 0 * before doing anything else (to make the threads to follow * the SCondWait as soon as possible) */ q->len--; /* pull the bottom packet from the queue */ data = q->bot; #ifdef OS_DARWIN /* Weird issue in OS_DARWIN * Sometimes it looks that two thread arrive here at the same time * so the bot ptr is NULL */ if (data == NULL) { printf("No data to dequeue!\n"); return NULL; } #endif /* OS_DARWIN */ /* more data in queue */ if (q->bot->prev != NULL) { q->bot = q->bot->prev; q->bot->next = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } data->next = NULL; data->prev = NULL; return data; } suricata-3.2.1/src/detect-engine-hrhd.h0000644000000000000000000000274013051004444014613 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HRHD_H__ #define __DETECT_ENGINE_HRHD_H__ #include "app-layer-htp.h" int PrefilterTxRequestHeadersRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxResponseHeadersRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpRawHeader(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpRawHeaderRegisterTests(void); #endif /* __DETECT_ENGINE_HHD_H__ */ suricata-3.2.1/src/output-tx.c0000644000000000000000000002765613051004444013156 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer TX Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output.h" #include "output-tx.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputTxLogger_ { AppProto alproto; TxLogger LogFunc; TxLoggerCondition LogCondition; OutputCtx *output_ctx; struct OutputTxLogger_ *next; const char *name; LoggerId logger_id; uint32_t id; int tc_log_progress; int ts_log_progress; TmEcode (*ThreadInit)(ThreadVars *, void *, void **); TmEcode (*ThreadDeinit)(ThreadVars *, void *); void (*ThreadExitPrintStats)(ThreadVars *, void *); } OutputTxLogger; static OutputTxLogger *list = NULL; int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void (*ThreadExitPrintStats)(ThreadVars *, void *)) { if (!(AppLayerParserIsTxAware(alproto))) { SCLogNotice("%s logger not enabled: protocol %s is disabled", name, AppProtoToString(alproto)); return -1; } OutputTxLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->alproto = alproto; op->LogFunc = LogFunc; op->LogCondition = LogCondition; op->output_ctx = output_ctx; op->name = name; op->logger_id = id; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (tc_log_progress < 0) { op->tc_log_progress = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOCLIENT); } else { op->tc_log_progress = tc_log_progress; } if (ts_log_progress < 0) { op->ts_log_progress = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOSERVER); } else { op->ts_log_progress = ts_log_progress; } if (list == NULL) { op->id = 1; list = op; } else { OutputTxLogger *t = list; while (t->next) t = t->next; if (t->id * 2 > UINT32_MAX) { SCLogError(SC_ERR_FATAL, "Too many loggers registered."); exit(EXIT_FAILURE); } op->id = t->id * 2; t->next = op; } SCLogDebug("OutputRegisterTxLogger happy"); return 0; } static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data) { BUG_ON(thread_data == NULL); if (list == NULL) { /* No child loggers registered. */ return TM_ECODE_OK; } OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputTxLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); if (p->flow == NULL) return TM_ECODE_OK; Flow * const f = p->flow; AppProto alproto = f->alproto; if (AppLayerParserProtocolIsTxAware(p->proto, alproto) == 0) goto end; if (AppLayerParserProtocolHasLogger(p->proto, alproto) == 0) goto end; void *alstate = f->alstate; if (alstate == NULL) { SCLogDebug("no alstate"); goto end; } uint64_t total_txs = AppLayerParserGetTxCnt(p->proto, alproto, alstate); uint64_t tx_id = AppLayerParserGetTransactionLogId(f->alparser); uint64_t max_id = tx_id; int logged = 0; int gap = 0; for (; tx_id < total_txs; tx_id++) { /* Track the number of loggers, of the eligible loggers that * actually logged this transaction. They all must have logged * before the transaction is considered logged. */ int number_of_loggers = 0; int loggers_that_logged = 0; void *tx = AppLayerParserGetTx(p->proto, alproto, alstate, tx_id); if (tx == NULL) { SCLogDebug("tx is NULL not logging"); continue; } int tx_progress_ts = AppLayerParserGetStateProgress(p->proto, alproto, tx, FlowGetDisruptionFlags(f, STREAM_TOSERVER)); int tx_progress_tc = AppLayerParserGetStateProgress(p->proto, alproto, tx, FlowGetDisruptionFlags(f, STREAM_TOCLIENT)); SCLogDebug("tx_progress_ts %d tx_progress_tc %d", tx_progress_ts, tx_progress_tc); // call each logger here (pseudo code) logger = list; store = op_thread_data->store; while (logger && store) { BUG_ON(logger->LogFunc == NULL); SCLogDebug("logger %p, LogCondition %p, ts_log_progress %d " "tc_log_progress %d", logger, logger->LogCondition, logger->ts_log_progress, logger->tc_log_progress); if (logger->alproto == alproto) { SCLogDebug("alproto match, logging tx_id %"PRIu64, tx_id); number_of_loggers++; if (AppLayerParserGetTxLogged(p->proto, alproto, alstate, tx, logger->id)) { SCLogDebug("logger has already logged this transaction"); loggers_that_logged++; goto next; } if (!(AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF))) { if (logger->LogCondition) { int r = logger->LogCondition(tv, p, alstate, tx, tx_id); if (r == FALSE) { SCLogDebug("conditions not met, not logging"); goto next; } } else { if (tx_progress_tc < logger->tc_log_progress) { SCLogDebug("progress not far enough, not logging"); goto next; } if (tx_progress_ts < logger->ts_log_progress) { SCLogDebug("progress not far enough, not logging"); goto next; } } } SCLogDebug("Logging tx_id %"PRIu64" to logger %d", tx_id, logger->logger_id); PACKET_PROFILING_LOGGER_START(p, logger->logger_id); logger->LogFunc(tv, store->thread_data, p, f, alstate, tx, tx_id); PACKET_PROFILING_LOGGER_END(p, logger->logger_id); AppLayerParserSetTxLogged(p->proto, alproto, alstate, tx, logger->id); loggers_that_logged++; } next: logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } /* If all loggers logged set a flag and update the last tx_id * that was logged. * * If not all loggers were logged we flag that there was a gap * so any subsequent transactions in this loop don't increase * the maximum ID that was logged. */ if (!gap && loggers_that_logged == number_of_loggers) { logged = 1; max_id = tx_id; } else { gap = 1; } } /* Update the the last ID that has been logged with all * transactions before it. */ if (logged) { SCLogDebug("updating log tx_id %"PRIu64, max_id); AppLayerParserSetTransactionLogId(f->alparser, max_id + 1); } end: return TM_ECODE_OK; } /** \brief thread init for the tx logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputTxLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputTxLogThreadInit happy (*data %p)", *data); OutputTxLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } return TM_ECODE_OK; } static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputTxLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputTxLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputTxLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputTxLoggerRegister (void) { OutputRegisterRootLogger(OutputTxLogThreadInit, OutputTxLogThreadDeinit, OutputTxLogExitPrintStats, OutputTxLog); } void OutputTxShutdown(void) { OutputTxLogger *logger = list; while (logger) { OutputTxLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/detect-engine-tag.h0000644000000000000000000000360013051004444014435 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-engine-tag.h * * \author Pablo Rincon Crespo * * Implements a global context to store data related to hosts flagged * tag keyword */ #ifndef __DETECT_ENGINE_TAG_H__ #define __DETECT_ENGINE_TAG_H__ #include "host.h" #include "detect.h" /* This limit should be overwriten/predefined at the config file * to limit the options to prevent possible DOS situations. We should also * create a limit for bytes and a limit for number of packets */ #define TAG_MAX_LAST_TIME_SEEN 600 #define TAG_TIMEOUT_CHECK_INTERVAL 60 /* Used for tagged data (sid and gid of the packets that * follow the one that triggered the rule with tag option) */ #define TAG_SIG_GEN 2 #define TAG_SIG_ID 1 int TagHashAddTag(DetectTagDataEntry *, Packet *); int TagFlowAdd(Packet *, DetectTagDataEntry *); void TagContextDestroy(void); void TagHandlePacket(DetectEngineCtx *, DetectEngineThreadCtx *, Packet *); void TagInitCtx(void); void TagDestroyCtx(void); void TagRestartCtx(void); int TagTimeoutCheck(Host *, struct timeval *); int TagHostHasTag(Host *host); void DetectEngineTagRegisterTests(void); #endif /* __DETECT_ENGINE_TAG_H__ */ suricata-3.2.1/src/util-lua-smtp.c0000644000000000000000000002477313051004444013677 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author casec Bachelors group * \author Lauritz Prag Sømme * \author Levi Tobiassen * \author Stian Hoel Bergseth * \author Vinjar Hillestad */ #include "suricata-common.h" #include "debug.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "output.h" #include "app-layer-smtp.h" #ifdef HAVE_LUA #include #include #include "util-lua.h" #include "util-lua-common.h" #include "util-file.h" /* * \brief internal function used by SMTPGetMimeField * * \param luastate luastate stack to use and push attributes to * \param flow network flow of SMTP packets * \param name name of the attribute to extract from MimeDecField * * \retval 1 if success mimefield found and pushed to stack. Returns error * int and msg pushed to luastate stack if error occurs. */ static int GetMimeDecField(lua_State *luastate, Flow *flow, const char *name) { /* extract state from flow */ SMTPState *state = (SMTPState *) FlowGetAppState(flow); /* check that state exsists */ if(state == NULL) { return LuaCallbackError(luastate, "Internal error: no state in flow"); } /* pointer to current transaction in state */ SMTPTransaction *smtp_tx = state->curr_tx; if(smtp_tx == NULL) { return LuaCallbackError(luastate, "Transaction ending or not found"); } /* pointer to tail of msg list of MimeDecEntitys in current transaction. */ MimeDecEntity *mime = smtp_tx->msg_tail; /* check if msg_tail was hit */ if(mime == NULL){ return LuaCallbackError(luastate, "Internal error: no fields in transaction"); } /* extract MIME field based on spesific field name. */ MimeDecField *field = MimeDecFindField(mime, name); /* check MIME field */ if(field == NULL) { return LuaCallbackError(luastate, "Error: mimefield not found"); } /* return extracted field. */ if(field->value == NULL || field->value_len == 0){ return LuaCallbackError(luastate, "Error, pointer error"); } return LuaPushStringBuffer(luastate, field->value, field->value_len); } /** * \brief Function extracts specific MIME field based on argument from luastate * stack then pushing the attribute onto the luastate stack. * * \param luastate luastate stack to pop and push attributes for I/O to lua * * \retval 1 if success mimefield found and pushed to stack. Returns error * int and msg pushed to luastate stack if error occurs. */ static int SMTPGetMimeField(lua_State *luastate) { if(!(LuaStateNeedProto(luastate, ALPROTO_SMTP))) { return LuaCallbackError(luastate, "error: protocol not SMTP"); } Flow *flow = LuaStateGetFlow(luastate); /* check that flow exist */ if(flow == NULL) { return LuaCallbackError(luastate, "Error: no flow found"); } const char *name = LuaGetStringArgument(luastate, 1); if (name == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); GetMimeDecField(luastate, flow, name); return 1; } /** * \brief Internal function used by SMTPGetMimeList * * \param luastate luastate stack to pop and push attributes for I/O to lua * \param flow network flow of SMTP packets * * \retval 1 if the mimelist table is pushed to luastate stack. * Returns error int and msg pushed to luastate stack if error occurs. */ static int GetMimeList(lua_State *luastate, Flow *flow) { SMTPState *state = (SMTPState *) FlowGetAppState(flow); if(state == NULL) { return LuaCallbackError(luastate, "Error: no SMTP state"); } /* Create a pointer to the current SMTPtransaction */ SMTPTransaction *smtp_tx = state->curr_tx; if(smtp_tx == NULL) { return LuaCallbackError(luastate, "Error: no SMTP transaction found"); } /* Create a pointer to the tail of MimeDecEntity list */ MimeDecEntity *mime = smtp_tx->msg_tail; if(mime == NULL) { return LuaCallbackError(luastate, "Error: no mime entity found"); } MimeDecField *field = mime->field_list; if(field == NULL) { return LuaCallbackError(luastate, "Error: no field_list found"); } if(field->name == NULL || field->name_len == 0) { return LuaCallbackError(luastate, "Error: field has no name"); } /* Counter of MIME fields found */ int num = 1; /* loop trough the list of mimeFields, printing each name found */ lua_newtable(luastate); while (field != NULL) { if(field->name != NULL && field->name_len != 0) { lua_pushinteger(luastate,num++); LuaPushStringBuffer(luastate, field->name, field->name_len); lua_settable(luastate,-3); } field = field->next; } return 1; } /** * \brief Lists name and value to all MIME fields which * is included in a SMTP transaction. * * \param luastate luastate stack to pop and push attributes for I/O to lua. * * \retval 1 if the table is pushed to lua. * Returns error int and msg pushed to luastate stack if error occurs * */ static int SMTPGetMimeList(lua_State *luastate) { /* Check if right protocol */ if(!(LuaStateNeedProto(luastate, ALPROTO_SMTP))) { return LuaCallbackError(luastate, "Error: protocol not SMTP"); } /* Extract network flow */ Flow *flow = LuaStateGetFlow(luastate); if(flow == NULL) { return LuaCallbackError(luastate, "Error: no flow found"); } GetMimeList(luastate, flow); return 1; } /** * \brief internal function used by SMTPGetMailFrom * * \param luastate luastate stack to pop and push attributes for I/O to lua. * \param flow flow to get state for SMTP * * \retval 1 if mailfrom field found. * Retruns error int and msg pushed to luastate stack if error occurs */ static int GetMailFrom(lua_State *luastate, Flow *flow) { /* Extract SMTPstate from current flow */ SMTPState *state = (SMTPState *) FlowGetAppState(flow); if(state == NULL) { return LuaCallbackError(luastate, "Internal Error: no state"); } SMTPTransaction *smtp_tx = state->curr_tx; if(smtp_tx == NULL) { return LuaCallbackError(luastate, "Internal Error: no SMTP transaction"); } if(smtp_tx->mail_from == NULL || smtp_tx->mail_from_len == 0) { return LuaCallbackError(luastate, "MailFrom not found"); } return LuaPushStringBuffer(luastate, smtp_tx->mail_from, smtp_tx->mail_from_len); /* Returns 1 because we never push more then 1 item to the lua stack */ } /** * \brief Extracts mail_from parameter from SMTPState. * Attribute may also be available from mimefields, although there is no * guarantee of it existing as mime. * * \param luastate luastate stack to pop and push attributes for I/O to lua. * * \retval 1 if mailfrom field found. * Retruns error int and msg pushed to luastate stack if error occurs */ static int SMTPGetMailFrom(lua_State *luastate) { /* check protocol */ if(!(LuaStateNeedProto(luastate, ALPROTO_SMTP))) { return LuaCallbackError(luastate, "Error: protocol not SMTP"); } /* Extract flow, with lockhint to check mutexlocking */ Flow *flow = LuaStateGetFlow(luastate); if(flow == NULL) { return LuaCallbackError(luastate, "Internal Error: no flow"); } GetMailFrom(luastate, flow); return 1; } /** * \brief intern function used by SMTPGetRcpList * * \params luastate luastate stack for internal communication with Lua. * Used to hand over data to the recieveing luascript. * * \retval 1 if the table is pushed to lua. * Returns error int and msg pushed to luastate stack if error occurs */ static int GetRcptList(lua_State *luastate, Flow *flow) { SMTPState *state = (SMTPState *) FlowGetAppState(flow); if(state == NULL) { return LuaCallbackError(luastate, "Internal error, no state"); } SMTPTransaction *smtp_tx = state->curr_tx; if(smtp_tx == NULL) { return LuaCallbackError(luastate, "No more tx, or tx not found"); } /* Create a new table in luastate for rcpt list */ lua_newtable(luastate); /* rcpt var for iterator */ int u = 1; SMTPString *rcpt; TAILQ_FOREACH(rcpt, &smtp_tx->rcpt_to_list, next) { lua_pushinteger(luastate, u++); LuaPushStringBuffer(luastate, rcpt->str, rcpt->len); lua_settable(luastate, -3); } /* return 1 since we allways push one table to luastate */ return 1; } /** * \brief function loops through rcpt-list located in * flow->SMTPState->SMTPTransaction, adding all items to a table. * Then pushing it to the luastate stack. * * \params luastate luastate stack for internal communication with Lua. * Used to hand over data to the recieveing luascript. * * \retval 1 if the table is pushed to lua. * Returns error int and msg pushed to luastate stack if error occurs */ static int SMTPGetRcptList(lua_State *luastate) { /* check protocol */ if(!(LuaStateNeedProto(luastate, ALPROTO_SMTP))) { return LuaCallbackError(luastate, "Error: protocol not SMTP"); } /* Extract flow, with lockhint to check mutexlocking */ Flow *flow = LuaStateGetFlow(luastate); if(flow == NULL) { return LuaCallbackError(luastate, "Internal error: no flow"); } GetRcptList(luastate, flow); /* return 1 since we allways push one table to luastate */ return 1; } int LuaRegisterSmtpFunctions(lua_State *luastate) { lua_pushcfunction(luastate, SMTPGetMimeField); lua_setglobal(luastate, "SMTPGetMimeField"); lua_pushcfunction(luastate, SMTPGetMimeList); lua_setglobal(luastate, "SMTPGetMimeList"); lua_pushcfunction(luastate, SMTPGetMailFrom); lua_setglobal(luastate, "SMTPGetMailFrom"); lua_pushcfunction(luastate, SMTPGetRcptList); lua_setglobal(luastate, "SMTPGetRcptList"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/util-lua-common.c0000644000000000000000000006244513051004444014202 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Common function for Lua Output */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" int LuaCallbackError(lua_State *luastate, const char *msg) { lua_pushnil(luastate); lua_pushstring(luastate, msg); return 2; } const char *LuaGetStringArgument(lua_State *luastate, int argc) { /* get argument */ if (!lua_isstring(luastate, argc)) return NULL; const char *str = lua_tostring(luastate, argc); if (str == NULL) return NULL; if (strlen(str) == 0) return NULL; return str; } void LuaPushTableKeyValueInt(lua_State *luastate, const char *key, int value) { lua_pushstring(luastate, key); lua_pushnumber(luastate, value); lua_settable(luastate, -3); } /** \brief Push a key plus string value to the stack * * If value is NULL, string "(null")" will be put on the stack. */ void LuaPushTableKeyValueString(lua_State *luastate, const char *key, const char *value) { lua_pushstring(luastate, key); lua_pushstring(luastate, value ? value : "(null)"); lua_settable(luastate, -3); } void LuaPushTableKeyValueArray(lua_State *luastate, const char *key, const uint8_t *value, size_t len) { lua_pushstring(luastate, key); LuaPushStringBuffer(luastate, value, len); lua_settable(luastate, -3); } /** \internal * \brief fill lua stack with payload * \param luastate the lua state * \param p packet * \retval cnt number of data items placed on the stack * * Places: payload (string) */ static int LuaCallbackStreamingBufferPushToStack(lua_State *luastate, const LuaStreamingBuffer *b) { //PrintRawDataFp(stdout, (uint8_t *)b->data, b->data_len); lua_pushlstring (luastate, (const char *)b->data, b->data_len); lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_OPEN)); lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_CLOSE)); return 3; } /** \internal * \brief Wrapper for getting payload into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackStreamingBuffer(lua_State *luastate) { const LuaStreamingBuffer *b = LuaStateGetStreamingBuffer(luastate); if (b == NULL) return LuaCallbackError(luastate, "internal error: no buffer"); return LuaCallbackStreamingBufferPushToStack(luastate, b); } /** \internal * \brief fill lua stack with payload * \param luastate the lua state * \param p packet * \retval cnt number of data items placed on the stack * * Places: payload (string) */ static int LuaCallbackPacketPayloadPushToStackFromPacket(lua_State *luastate, const Packet *p) { lua_pushlstring (luastate, (const char *)p->payload, p->payload_len); return 1; } /** \internal * \brief Wrapper for getting payload into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackPacketPayload(lua_State *luastate) { const Packet *p = LuaStateGetPacket(luastate); if (p == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackPacketPayloadPushToStackFromPacket(luastate, p); } /** \internal * \brief fill lua stack with packet timestamp * \param luastate the lua state * \param p packet * \retval cnt number of data items placed on the stack * * Places: seconds (number), microseconds (number) */ static int LuaCallbackTimestampPushToStack(lua_State *luastate, const struct timeval *ts) { lua_pushnumber(luastate, (double)ts->tv_sec); lua_pushnumber(luastate, (double)ts->tv_usec); return 2; } /** \internal * \brief fill lua stack with header info * \param luastate the lua state * \param p packet * \retval cnt number of data items placed on the stack * * Places: ts (string) */ static int LuaCallbackTimeStringPushToStackFromPacket(lua_State *luastate, const Packet *p) { char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); lua_pushstring (luastate, timebuf); return 1; } /** \internal * \brief Wrapper for getting packet timestamp (as numbers) into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackPacketTimestamp(lua_State *luastate) { const Packet *p = LuaStateGetPacket(luastate); if (p == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackTimestampPushToStack(luastate, &p->ts); } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackPacketTimeString(lua_State *luastate) { const Packet *p = LuaStateGetPacket(luastate); if (p == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackTimeStringPushToStackFromPacket(luastate, p); } /** \internal * \brief fill lua stack with time string * \param luastate the lua state * \param flow flow * \retval cnt number of data items placed on the stack * * Places: ts (string) */ static int LuaCallbackTimeStringPushToStackFromFlow(lua_State *luastate, const Flow *flow) { char timebuf[64]; CreateTimeString(&flow->startts, timebuf, sizeof(timebuf)); lua_pushstring (luastate, timebuf); return 1; } /** \internal * \brief Wrapper for getting ts info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackFlowTimeString(lua_State *luastate) { int r = 0; Flow *flow = LuaStateGetFlow(luastate); if (flow == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = LuaCallbackTimeStringPushToStackFromFlow(luastate, flow); return r; } /** \internal * \brief fill lua stack with flow has alerts * \param luastate the lua state * \param flow flow * \retval cnt number of data items placed on the stack * * Places alerts (bool) */ static int LuaCallbackHasAlertsPushToStackFromFlow(lua_State *luastate, const Flow *flow) { lua_pushboolean(luastate, FlowHasAlerts(flow)); return 1; } /** \internal * \brief Wrapper for getting flow has alerts info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackFlowHasAlerts(lua_State *luastate) { int r = 0; Flow *flow = LuaStateGetFlow(luastate); if (flow == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = LuaCallbackHasAlertsPushToStackFromFlow(luastate, flow); return r; } /** \internal * \brief fill lua stack with header info * \param luastate the lua state * \param p packet * \retval cnt number of data items placed on the stack * * Places: ipver (number), src ip (string), dst ip (string), protocol (number), * sp or icmp type (number), dp or icmp code (number). */ static int LuaCallbackTuplePushToStackFromPacket(lua_State *luastate, const Packet *p) { int ipver = 0; if (PKT_IS_IPV4(p)) { ipver = 4; } else if (PKT_IS_IPV6(p)) { ipver = 6; } lua_pushnumber (luastate, ipver); if (ipver == 0) return 1; char srcip[46] = "", dstip[46] = ""; if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); } lua_pushstring (luastate, srcip); lua_pushstring (luastate, dstip); /* proto and ports (or type/code) */ lua_pushnumber (luastate, p->proto); if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) { lua_pushnumber (luastate, p->sp); lua_pushnumber (luastate, p->dp); } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) { lua_pushnumber (luastate, p->type); lua_pushnumber (luastate, p->code); } else { lua_pushnumber (luastate, 0); lua_pushnumber (luastate, 0); } return 6; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackTuple(lua_State *luastate) { const Packet *p = LuaStateGetPacket(luastate); if (p == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackTuplePushToStackFromPacket(luastate, p); } /** \internal * \brief fill lua stack with header info * \param luastate the lua state * \param f flow, locked * \retval cnt number of data items placed on the stack * * Places: ipver (number), src ip (string), dst ip (string), protocol (number), * sp or icmp type (number), dp or icmp code (number). */ static int LuaCallbackTuplePushToStackFromFlow(lua_State *luastate, const Flow *f) { int ipver = 0; if (FLOW_IS_IPV4(f)) { ipver = 4; } else if (FLOW_IS_IPV6(f)) { ipver = 6; } lua_pushnumber (luastate, ipver); if (ipver == 0) return 1; char srcip[46] = "", dstip[46] = ""; if (FLOW_IS_IPV4(f)) { PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip)); } else if (FLOW_IS_IPV6(f)) { PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip)); } lua_pushstring (luastate, srcip); lua_pushstring (luastate, dstip); /* proto and ports (or type/code) */ lua_pushnumber (luastate, f->proto); if (f->proto == IPPROTO_TCP || f->proto == IPPROTO_UDP) { lua_pushnumber (luastate, f->sp); lua_pushnumber (luastate, f->dp); } else if (f->proto == IPPROTO_ICMP || f->proto == IPPROTO_ICMPV6) { lua_pushnumber (luastate, f->type); lua_pushnumber (luastate, f->code); } else { lua_pushnumber (luastate, 0); lua_pushnumber (luastate, 0); } return 6; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackTupleFlow(lua_State *luastate) { int r = 0; Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = LuaCallbackTuplePushToStackFromFlow(luastate, f); return r; } /** \internal * \brief fill lua stack with AppLayerProto * \param luastate the lua state * \param f flow, locked * \retval cnt number of data items placed on the stack * * Places: alproto as string (string) */ static int LuaCallbackAppLayerProtoPushToStackFromFlow(lua_State *luastate, const Flow *f) { const char *string = AppProtoToString(f->alproto); if (string == NULL) string = "unknown"; lua_pushstring(luastate, string); return 1; } /** \internal * \brief Wrapper for getting AppLayerProto info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackAppLayerProtoFlow(lua_State *luastate) { int r = 0; Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f); return r; } /** \internal * \brief fill lua stack with flow stats * \param luastate the lua state * \param f flow, locked * \retval cnt number of data items placed on the stack * * Places: ts pkts (number), ts bytes (number), tc pkts (number), tc bytes (number) */ static int LuaCallbackStatsPushToStackFromFlow(lua_State *luastate, const Flow *f) { lua_pushnumber(luastate, f->todstpktcnt); lua_pushnumber(luastate, f->todstbytecnt); lua_pushnumber(luastate, f->tosrcpktcnt); lua_pushnumber(luastate, f->tosrcbytecnt); return 4; } /** \internal * \brief Wrapper for getting AppLayerProto info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackStatsFlow(lua_State *luastate) { int r = 0; Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = LuaCallbackStatsPushToStackFromFlow(luastate, f); return r; } /** \internal * \brief fill lua stack with alert info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: sid (number), rev (number), gid (number) */ static int LuaCallbackRuleIdsPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa) { lua_pushnumber (luastate, pa->s->id); lua_pushnumber (luastate, pa->s->rev); lua_pushnumber (luastate, pa->s->gid); return 3; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackRuleIds(lua_State *luastate) { const PacketAlert *pa = LuaStateGetPacketAlert(luastate); if (pa == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackRuleIdsPushToStackFromPacketAlert(luastate, pa); } /** \internal * \brief fill lua stack with alert info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: msg (string) */ static int LuaCallbackRuleMsgPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa) { lua_pushstring (luastate, pa->s->msg); return 1; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackRuleMsg(lua_State *luastate) { const PacketAlert *pa = LuaStateGetPacketAlert(luastate); if (pa == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackRuleMsgPushToStackFromPacketAlert(luastate, pa); } /** \internal * \brief fill lua stack with alert info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: class (string), prio (number) */ static int LuaCallbackRuleClassPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa) { lua_pushstring (luastate, pa->s->class_msg); lua_pushnumber (luastate, pa->s->prio); return 2; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackRuleClass(lua_State *luastate) { const PacketAlert *pa = LuaStateGetPacketAlert(luastate); if (pa == NULL) return LuaCallbackError(luastate, "internal error: no packet"); return LuaCallbackRuleClassPushToStackFromPacketAlert(luastate, pa); } static int LuaCallbackLogPath(lua_State *luastate) { const char *ld = ConfigGetLogDirectory(); if (ld == NULL) return LuaCallbackError(luastate, "internal error: no log dir"); return LuaPushStringBuffer(luastate, (const uint8_t *)ld, strlen(ld)); } static int LuaCallbackLogDebug(lua_State *luastate) { const char *msg = LuaGetStringArgument(luastate, 1); if (msg == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); SCLogDebug("%s", msg); return 0; } static int LuaCallbackLogInfo(lua_State *luastate) { const char *msg = LuaGetStringArgument(luastate, 1); if (msg == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); lua_Debug ar; lua_getstack(luastate, 1, &ar); lua_getinfo(luastate, "nSl", &ar); const char *funcname = ar.name ? ar.name : ar.what; SCLogInfoRaw(ar.short_src, funcname, ar.currentline, "%s", msg); return 0; } static int LuaCallbackLogNotice(lua_State *luastate) { const char *msg = LuaGetStringArgument(luastate, 1); if (msg == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); lua_Debug ar; lua_getstack(luastate, 1, &ar); lua_getinfo(luastate, "nSl", &ar); const char *funcname = ar.name ? ar.name : ar.what; SCLogNoticeRaw(ar.short_src, funcname, ar.currentline, "%s", msg); return 0; } static int LuaCallbackLogWarning(lua_State *luastate) { const char *msg = LuaGetStringArgument(luastate, 1); if (msg == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); lua_Debug ar; lua_getstack(luastate, 1, &ar); lua_getinfo(luastate, "nSl", &ar); const char *funcname = ar.name ? ar.name : ar.what; SCLogWarningRaw(SC_WARN_LUA_SCRIPT, ar.short_src, funcname, ar.currentline, "%s", msg); return 0; } static int LuaCallbackLogError(lua_State *luastate) { const char *msg = LuaGetStringArgument(luastate, 1); if (msg == NULL) return LuaCallbackError(luastate, "1st argument missing, empty or wrong type"); lua_Debug ar; lua_getstack(luastate, 1, &ar); lua_getinfo(luastate, "nSl", &ar); const char *funcname = ar.name ? ar.name : ar.what; SCLogErrorRaw(SC_ERR_LUA_SCRIPT, ar.short_src, funcname, ar.currentline, "%s", msg); return 0; } /** \internal * \brief fill lua stack with file info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: fileid (number), txid (number), name (string), * size (number), magic (string), md5 in hex (string) */ static int LuaCallbackFileInfoPushToStackFromFile(lua_State *luastate, const File *file) { #ifdef HAVE_NSS char md5[33] = ""; char *md5ptr = md5; if (file->flags & FILE_MD5) { size_t x; for (x = 0; x < sizeof(file->md5); x++) { char one[3] = ""; snprintf(one, sizeof(one), "%02x", file->md5[x]); strlcat(md5, one, sizeof(md5)); } } char sha1[41] = ""; char *sha1ptr = sha1; if (file->flags & FILE_SHA1) { size_t x; for (x = 0; x < sizeof(file->sha1); x++) { char one[3] = ""; snprintf(one, sizeof(one), "%02x", file->sha1[x]); strlcat(sha1, one, sizeof(sha1)); } } char sha256[65] = ""; char *sha256ptr = sha256; if (file->flags & FILE_SHA256) { size_t x; for (x = 0; x < sizeof(file->sha256); x++) { char one[3] = ""; snprintf(one, sizeof(one), "%02x", file->sha256[x]); strlcat(sha256, one, sizeof(sha256)); } } #else char *md5ptr = NULL; char *sha1ptr = NULL; char *sha256ptr = NULL; #endif lua_pushnumber(luastate, file->file_id); lua_pushnumber(luastate, file->txid); lua_pushlstring(luastate, (char *)file->name, file->name_len); lua_pushnumber(luastate, FileTrackedSize(file)); lua_pushstring (luastate, #ifdef HAVE_MAGIC file->magic #else "nomagic" #endif ); lua_pushstring(luastate, md5ptr); lua_pushstring(luastate, sha1ptr); lua_pushstring(luastate, sha256ptr); return 6; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackFileInfo(lua_State *luastate) { const File *file = LuaStateGetFile(luastate); if (file == NULL) return LuaCallbackError(luastate, "internal error: no file"); return LuaCallbackFileInfoPushToStackFromFile(luastate, file); } /** \internal * \brief fill lua stack with file info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: state (string), stored (bool) */ static int LuaCallbackFileStatePushToStackFromFile(lua_State *luastate, const File *file) { const char *state = "UNKNOWN"; switch (file->state) { case FILE_STATE_CLOSED: state = "CLOSED"; break; case FILE_STATE_TRUNCATED: state = "TRUNCATED"; break; case FILE_STATE_ERROR: state = "ERROR"; break; } lua_pushstring (luastate, state); lua_pushboolean (luastate, file->flags & FILE_STORED); return 2; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackFileState(lua_State *luastate) { const File *file = LuaStateGetFile(luastate); if (file == NULL) return LuaCallbackError(luastate, "internal error: no file"); return LuaCallbackFileStatePushToStackFromFile(luastate, file); } /** \internal * \brief fill lua stack with thread info * \param luastate the lua state * \param pa pointer to packet alert struct * \retval cnt number of data items placed on the stack * * Places: thread id (number), thread name (string, thread group name (string) */ static int LuaCallbackThreadInfoPushToStackFromThreadVars(lua_State *luastate, const ThreadVars *tv) { u_long tid = SCGetThreadIdLong(); lua_pushinteger (luastate, (lua_Integer)tid); lua_pushstring (luastate, tv->name); lua_pushstring (luastate, tv->thread_group_name); return 3; } /** \internal * \brief Wrapper for getting tuple info into a lua script * \retval cnt number of items placed on the stack */ static int LuaCallbackThreadInfo(lua_State *luastate) { const ThreadVars *tv = LuaStateGetThreadVars(luastate); if (tv == NULL) return LuaCallbackError(luastate, "internal error: no tv"); return LuaCallbackThreadInfoPushToStackFromThreadVars(luastate, tv); } int LuaRegisterFunctions(lua_State *luastate) { /* registration of the callbacks */ lua_pushcfunction(luastate, LuaCallbackPacketPayload); lua_setglobal(luastate, "SCPacketPayload"); lua_pushcfunction(luastate, LuaCallbackPacketTimestamp); lua_setglobal(luastate, "SCPacketTimestamp"); lua_pushcfunction(luastate, LuaCallbackPacketTimeString); lua_setglobal(luastate, "SCPacketTimeString"); lua_pushcfunction(luastate, LuaCallbackTuple); lua_setglobal(luastate, "SCPacketTuple"); lua_pushcfunction(luastate, LuaCallbackFlowTimeString); lua_setglobal(luastate, "SCFlowTimeString"); lua_pushcfunction(luastate, LuaCallbackTupleFlow); lua_setglobal(luastate, "SCFlowTuple"); lua_pushcfunction(luastate, LuaCallbackAppLayerProtoFlow); lua_setglobal(luastate, "SCFlowAppLayerProto"); lua_pushcfunction(luastate, LuaCallbackStatsFlow); lua_setglobal(luastate, "SCFlowStats"); lua_pushcfunction(luastate, LuaCallbackFlowHasAlerts); lua_setglobal(luastate, "SCFlowHasAlerts"); lua_pushcfunction(luastate, LuaCallbackStreamingBuffer); lua_setglobal(luastate, "SCStreamingBuffer"); lua_pushcfunction(luastate, LuaCallbackLogPath); lua_setglobal(luastate, "SCLogPath"); lua_pushcfunction(luastate, LuaCallbackLogDebug); lua_setglobal(luastate, "SCLogDebug"); lua_pushcfunction(luastate, LuaCallbackLogInfo); lua_setglobal(luastate, "SCLogInfo"); lua_pushcfunction(luastate, LuaCallbackLogNotice); lua_setglobal(luastate, "SCLogNotice"); lua_pushcfunction(luastate, LuaCallbackLogWarning); lua_setglobal(luastate, "SCLogWarning"); lua_pushcfunction(luastate, LuaCallbackLogError); lua_setglobal(luastate, "SCLogError"); lua_pushcfunction(luastate, LuaCallbackRuleIds); lua_setglobal(luastate, "SCRuleIds"); lua_pushcfunction(luastate, LuaCallbackRuleMsg); lua_setglobal(luastate, "SCRuleMsg"); lua_pushcfunction(luastate, LuaCallbackRuleClass); lua_setglobal(luastate, "SCRuleClass"); lua_pushcfunction(luastate, LuaCallbackFileInfo); lua_setglobal(luastate, "SCFileInfo"); lua_pushcfunction(luastate, LuaCallbackFileState); lua_setglobal(luastate, "SCFileState"); lua_pushcfunction(luastate, LuaCallbackThreadInfo); lua_setglobal(luastate, "SCThreadInfo"); return 0; } int LuaStateNeedProto(lua_State *luastate, AppProto alproto) { AppProto flow_alproto = 0; Flow *flow = LuaStateGetFlow(luastate); if (flow == NULL) return LuaCallbackError(luastate, "internal error: no flow"); flow_alproto = flow->alproto; return (alproto == flow_alproto); } #endif /* HAVE_LUA */ suricata-3.2.1/src/log-stats.c0000644000000000000000000002302213051004444013061 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-stats.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "stats.log" #define MODULE_NAME "LogStatsLog" #define OUTPUT_BUFFER_SIZE 16384 #define LOG_STATS_TOTALS (1<<0) #define LOG_STATS_THREADS (1<<1) #define LOG_STATS_NULLS (1<<2) TmEcode LogStatsLogThreadInit(ThreadVars *, void *, void **); TmEcode LogStatsLogThreadDeinit(ThreadVars *, void *); void LogStatsLogExitPrintStats(ThreadVars *, void *); static void LogStatsLogDeInitCtx(OutputCtx *); typedef struct LogStatsFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } LogStatsFileCtx; typedef struct LogStatsLogThread_ { LogStatsFileCtx *statslog_ctx; MemBuffer *buffer; } LogStatsLogThread; int LogStatsLogger(ThreadVars *tv, void *thread_data, const StatsTable *st) { SCEnter(); LogStatsLogThread *aft = (LogStatsLogThread *)thread_data; struct timeval tval; struct tm *tms; gettimeofday(&tval, NULL); struct tm local_tm; tms = SCLocalTime(tval.tv_sec, &local_tm); /* Calculate the Engine uptime */ int up_time = (int)difftime(tval.tv_sec, st->start_time); int sec = up_time % 60; // Seconds in a minute int in_min = up_time / 60; int min = in_min % 60; // Minutes in a hour int in_hours = in_min / 60; int hours = in_hours % 24; // Hours in a day int days = in_hours / 24; MemBufferWriteString(aft->buffer, "----------------------------------------------" "--------------------------------------\n"); MemBufferWriteString(aft->buffer, "Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d (uptime: %"PRId32"d, %02dh %02dm %02ds)\n", tms->tm_mon + 1, tms->tm_mday, tms->tm_year + 1900, tms->tm_hour, tms->tm_min, tms->tm_sec, days, hours, min, sec); MemBufferWriteString(aft->buffer, "----------------------------------------------" "--------------------------------------\n"); MemBufferWriteString(aft->buffer, "%-42s | %-25s | %-s\n", "Counter", "TM Name", "Value"); MemBufferWriteString(aft->buffer, "----------------------------------------------" "--------------------------------------\n"); /* global stats */ uint32_t u = 0; if (aft->statslog_ctx->flags & LOG_STATS_TOTALS) { for (u = 0; u < st->nstats; u++) { if (st->stats[u].name == NULL) continue; if (!(aft->statslog_ctx->flags & LOG_STATS_NULLS) && st->stats[u].value == 0) continue; char line[256]; size_t len = snprintf(line, sizeof(line), "%-42s | %-25s | %-" PRIu64 "\n", st->stats[u].name, st->stats[u].tm_name, st->stats[u].value); /* since we can have many threads, the buffer might not be big enough. * Expand if necessary. */ if (MEMBUFFER_OFFSET(aft->buffer) + len >= MEMBUFFER_SIZE(aft->buffer)) { MemBufferExpand(&aft->buffer, OUTPUT_BUFFER_SIZE); } MemBufferWriteString(aft->buffer, "%s", line); } } /* per thread stats */ if (st->tstats != NULL && aft->statslog_ctx->flags & LOG_STATS_THREADS) { /* for each thread (store) */ uint32_t x; for (x = 0; x < st->ntstats; x++) { uint32_t offset = x * st->nstats; /* for each counter */ for (u = offset; u < (offset + st->nstats); u++) { if (st->tstats[u].name == NULL) continue; if (!(aft->statslog_ctx->flags & LOG_STATS_NULLS) && st->tstats[u].value == 0) continue; char line[256]; size_t len = snprintf(line, sizeof(line), "%-42s | %-25s | %-" PRIu64 "\n", st->tstats[u].name, st->tstats[u].tm_name, st->tstats[u].value); /* since we can have many threads, the buffer might not be big enough. * Expand if necessary. */ if (MEMBUFFER_OFFSET(aft->buffer) + len >= MEMBUFFER_SIZE(aft->buffer)) { MemBufferExpand(&aft->buffer, OUTPUT_BUFFER_SIZE); } MemBufferWriteString(aft->buffer, "%s", line); } } } SCMutexLock(&aft->statslog_ctx->file_ctx->fp_mutex); aft->statslog_ctx->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), aft->statslog_ctx->file_ctx); SCMutexUnlock(&aft->statslog_ctx->file_ctx->fp_mutex); MemBufferReset(aft->buffer); SCReturnInt(0); } TmEcode LogStatsLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogStatsLogThread *aft = SCMalloc(sizeof(LogStatsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogStatsLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for LogStats. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->statslog_ctx= ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } TmEcode LogStatsLogThreadDeinit(ThreadVars *t, void *data) { LogStatsLogThread *aft = (LogStatsLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogStatsLogThread)); SCFree(aft); return TM_ECODE_OK; } void LogStatsLogExitPrintStats(ThreadVars *tv, void *data) { LogStatsLogThread *aft = (LogStatsLogThread *)data; if (aft == NULL) { return; } } /** \brief Create a new http log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ OutputCtx *LogStatsLogInitCtx(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if (file_ctx == NULL) { SCLogError(SC_ERR_STATS_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogStatsFileCtx *statslog_ctx = SCMalloc(sizeof(LogStatsFileCtx)); if (unlikely(statslog_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } memset(statslog_ctx, 0x00, sizeof(LogStatsFileCtx)); statslog_ctx->flags = LOG_STATS_TOTALS; if (conf != NULL) { const char *totals = ConfNodeLookupChildValue(conf, "totals"); const char *threads = ConfNodeLookupChildValue(conf, "threads"); const char *nulls = ConfNodeLookupChildValue(conf, "null-values"); SCLogDebug("totals %s threads %s", totals, threads); if ((totals != NULL && ConfValIsFalse(totals)) && (threads != NULL && ConfValIsFalse(threads))) { LogFileFreeCtx(file_ctx); SCFree(statslog_ctx); SCLogError(SC_ERR_STATS_LOG_NEGATED, "Cannot disable both totals and threads in stats logging"); return NULL; } if (totals != NULL && ConfValIsFalse(totals)) { statslog_ctx->flags &= ~LOG_STATS_TOTALS; } if (threads != NULL && ConfValIsTrue(threads)) { statslog_ctx->flags |= LOG_STATS_THREADS; } if (nulls != NULL && ConfValIsTrue(nulls)) { statslog_ctx->flags |= LOG_STATS_NULLS; } SCLogDebug("statslog_ctx->flags %08x", statslog_ctx->flags); } statslog_ctx->file_ctx = file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(statslog_ctx); return NULL; } output_ctx->data = statslog_ctx; output_ctx->DeInit = LogStatsLogDeInitCtx; SCLogDebug("STATS log output initialized"); return output_ctx; } static void LogStatsLogDeInitCtx(OutputCtx *output_ctx) { LogStatsFileCtx *statslog_ctx = (LogStatsFileCtx *)output_ctx->data; LogFileFreeCtx(statslog_ctx->file_ctx); SCFree(statslog_ctx); SCFree(output_ctx); } void LogStatsLogRegister (void) { OutputRegisterStatsModule(LOGGER_STATS, MODULE_NAME, "stats", LogStatsLogInitCtx, LogStatsLogger, LogStatsLogThreadInit, LogStatsLogThreadDeinit, LogStatsLogExitPrintStats); } suricata-3.2.1/src/source-pcap.c0000644000000000000000000006526713051004444013406 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Live pcap packet acquisition support */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "source-pcap.h" #include "conf.h" #include "util-debug.h" #include "util-error.h" #include "util-privs.h" #include "util-device.h" #include "util-optimize.h" #include "util-checksum.h" #include "util-ioctl.h" #include "tmqh-packetpool.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda.h" #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #include "util-cuda-handlers.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ #define PCAP_STATE_DOWN 0 #define PCAP_STATE_UP 1 #define PCAP_RECONNECT_TIMEOUT 500000 /** * \brief Structure to hold thread specific variables. */ typedef struct PcapThreadVars_ { /* thread specific handle */ pcap_t *pcap_handle; /* handle state */ unsigned char pcap_state; /* thread specific bpf */ struct bpf_program filter; /* ptr to string from config */ char *bpf_filter; time_t last_stats_dump; /* data link type for the thread */ int datalink; /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; uint16_t capture_kernel_packets; uint16_t capture_kernel_drops; uint16_t capture_kernel_ifdrops; ThreadVars *tv; TmSlot *slot; /** callback result -- set if one of the thread module failed. */ int cb_result; /* pcap buffer size */ int pcap_buffer_size; int pcap_snaplen; ChecksumValidationMode checksum_mode; #if LIBPCAP_VERSION_MAJOR == 0 char iface[PCAP_IFACE_NAME_LENGTH]; #endif LiveDevice *livedev; } PcapThreadVars; TmEcode ReceivePcapThreadInit(ThreadVars *, void *, void **); void ReceivePcapThreadExitStats(ThreadVars *, void *); TmEcode ReceivePcapThreadDeinit(ThreadVars *, void *); TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot); TmEcode DecodePcapThreadInit(ThreadVars *, void *, void **); TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodePcap(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); /** protect pcap_compile and pcap_setfilter, as they are not thread safe: * http://seclists.org/tcpdump/2009/q1/62 */ static SCMutex pcap_bpf_compile_lock = SCMUTEX_INITIALIZER; /** * \brief Registration Function for RecievePcap. * \todo Unit tests are needed for this module. */ void TmModuleReceivePcapRegister (void) { tmm_modules[TMM_RECEIVEPCAP].name = "ReceivePcap"; tmm_modules[TMM_RECEIVEPCAP].ThreadInit = ReceivePcapThreadInit; tmm_modules[TMM_RECEIVEPCAP].Func = NULL; tmm_modules[TMM_RECEIVEPCAP].PktAcqLoop = ReceivePcapLoop; tmm_modules[TMM_RECEIVEPCAP].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEPCAP].ThreadExitPrintStats = ReceivePcapThreadExitStats; tmm_modules[TMM_RECEIVEPCAP].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEPCAP].RegisterTests = NULL; tmm_modules[TMM_RECEIVEPCAP].cap_flags = SC_CAP_NET_RAW; tmm_modules[TMM_RECEIVEPCAP].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration Function for DecodePcap. * \todo Unit tests are needed for this module. */ void TmModuleDecodePcapRegister (void) { tmm_modules[TMM_DECODEPCAP].name = "DecodePcap"; tmm_modules[TMM_DECODEPCAP].ThreadInit = DecodePcapThreadInit; tmm_modules[TMM_DECODEPCAP].Func = DecodePcap; tmm_modules[TMM_DECODEPCAP].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEPCAP].ThreadDeinit = DecodePcapThreadDeinit; tmm_modules[TMM_DECODEPCAP].RegisterTests = NULL; tmm_modules[TMM_DECODEPCAP].cap_flags = 0; tmm_modules[TMM_DECODEPCAP].flags = TM_FLAG_DECODE_TM; } static inline void PcapDumpCounters(PcapThreadVars *ptv) { struct pcap_stat pcap_s; if (likely((pcap_stats(ptv->pcap_handle, &pcap_s) >= 0))) { StatsSetUI64(ptv->tv, ptv->capture_kernel_packets, pcap_s.ps_recv); StatsSetUI64(ptv->tv, ptv->capture_kernel_drops, pcap_s.ps_drop); (void) SC_ATOMIC_SET(ptv->livedev->drop, pcap_s.ps_drop); StatsSetUI64(ptv->tv, ptv->capture_kernel_ifdrops, pcap_s.ps_ifdrop); } } #if LIBPCAP_VERSION_MAJOR == 1 static int PcapTryReopen(PcapThreadVars *ptv) { int pcap_activate_r; ptv->pcap_state = PCAP_STATE_DOWN; pcap_activate_r = pcap_activate(ptv->pcap_handle); if (pcap_activate_r != 0) { return pcap_activate_r; } /* set bpf filter if we have one */ if (ptv->bpf_filter != NULL) { if(pcap_compile(ptv->pcap_handle,&ptv->filter,ptv->bpf_filter,1,0) < 0) { SCLogError(SC_ERR_BPF,"bpf compilation error %s",pcap_geterr(ptv->pcap_handle)); return -1; } if(pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) { SCLogError(SC_ERR_BPF,"could not set bpf filter %s",pcap_geterr(ptv->pcap_handle)); return -1; } } SCLogInfo("Recovering interface listening"); ptv->pcap_state = PCAP_STATE_UP; return 0; } #else /* implied LIBPCAP_VERSION_MAJOR == 0 */ static int PcapTryReopen(PcapThreadVars *ptv) { char errbuf[PCAP_ERRBUF_SIZE] = ""; ptv->pcap_state = PCAP_STATE_DOWN; pcap_close(ptv->pcap_handle); ptv->pcap_handle = pcap_open_live((char *)ptv->iface, ptv->pcap_snaplen, LIBPCAP_PROMISC, LIBPCAP_COPYWAIT, errbuf); if (ptv->pcap_handle == NULL) { SCLogError(SC_ERR_PCAP_OPEN_LIVE, "Problem creating pcap handler for live mode, error %s", errbuf); return -1; } /* set bpf filter if we have one */ if (ptv->bpf_filter != NULL) { SCLogInfo("using bpf-filter \"%s\"", ptv->bpf_filter); if(pcap_compile(ptv->pcap_handle,&ptv->filter,ptv->bpf_filter,1,0) < 0) { SCLogError(SC_ERR_BPF,"bpf compilation error %s",pcap_geterr(ptv->pcap_handle)); return -1; } if(pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) { SCLogError(SC_ERR_BPF,"could not set bpf filter %s",pcap_geterr(ptv->pcap_handle)); return -1; } } SCLogInfo("Recovering interface listening"); ptv->pcap_state = PCAP_STATE_UP; return 0; } #endif void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) { SCEnter(); PcapThreadVars *ptv = (PcapThreadVars *)user; Packet *p = PacketGetFromQueueOrAlloc(); struct timeval current_time; if (unlikely(p == NULL)) { SCReturn; } PKT_SET_SRC(p, PKT_SRC_WIRE); p->ts.tv_sec = h->ts.tv_sec; p->ts.tv_usec = h->ts.tv_usec; SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec); p->datalink = ptv->datalink; ptv->pkts++; ptv->bytes += h->caplen; (void) SC_ATOMIC_ADD(ptv->livedev->pkts, 1); p->livedev = ptv->livedev; if (unlikely(PacketCopyData(p, pkt, h->caplen))) { TmqhOutputPacketpool(ptv->tv, p); SCReturn; } switch (ptv->checksum_mode) { case CHECKSUM_VALIDATION_AUTO: if (ptv->livedev->ignore_checksum) { p->flags |= PKT_IGNORE_CHECKSUM; } else if (ChecksumAutoModeCheck(ptv->pkts, SC_ATOMIC_GET(ptv->livedev->pkts), SC_ATOMIC_GET(ptv->livedev->invalid_checksums))) { ptv->livedev->ignore_checksum = 1; p->flags |= PKT_IGNORE_CHECKSUM; } break; case CHECKSUM_VALIDATION_DISABLE: p->flags |= PKT_IGNORE_CHECKSUM; break; default: break; } if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { pcap_breakloop(ptv->pcap_handle); ptv->cb_result = TM_ECODE_FAILED; } /* Trigger one dump of stats every second */ TimeGet(¤t_time); if (current_time.tv_sec != ptv->last_stats_dump) { PcapDumpCounters(ptv); ptv->last_stats_dump = current_time.tv_sec; } SCReturn; } /** * \brief Main PCAP reading Loop function */ TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); int packet_q_len = 64; PcapThreadVars *ptv = (PcapThreadVars *)data; int r; TmSlot *s = (TmSlot *)slot; ptv->slot = s->slot_next; ptv->cb_result = TM_ECODE_OK; while (1) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); /* Right now we just support reading packets one at a time. */ r = pcap_dispatch(ptv->pcap_handle, packet_q_len, (pcap_handler)PcapCallbackLoop, (u_char *)ptv); if (unlikely(r < 0)) { int dbreak = 0; SCLogError(SC_ERR_PCAP_DISPATCH, "error code %" PRId32 " %s", r, pcap_geterr(ptv->pcap_handle)); #ifdef PCAP_ERROR_BREAK if (r == PCAP_ERROR_BREAK) { SCReturnInt(ptv->cb_result); } #endif do { usleep(PCAP_RECONNECT_TIMEOUT); if (suricata_ctl_flags != 0) { dbreak = 1; break; } r = PcapTryReopen(ptv); } while (r < 0); if (dbreak) { break; } } else if (ptv->cb_result == TM_ECODE_FAILED) { SCLogError(SC_ERR_PCAP_DISPATCH, "Pcap callback PcapCallbackLoop failed"); SCReturnInt(TM_ECODE_FAILED); } else if (unlikely(r == 0)) { TmThreadsCaptureInjectPacket(tv, ptv->slot, NULL); } StatsSyncCountersIfSignalled(tv); } PcapDumpCounters(ptv); StatsSyncCountersIfSignalled(tv); SCReturnInt(TM_ECODE_OK); } /** * \brief Init function for ReceivePcap. * * This is a setup function for recieving packets * via libpcap. There are two versions of this function * depending on the major version of libpcap used. * For versions prior to 1.x we use open_pcap_live, * for versions 1.x and greater we use pcap_create + pcap_activate. * * \param tv pointer to ThreadVars * \param initdata pointer to the interface passed from the user * \param data pointer gets populated with PcapThreadVars * * \todo Create a general pcap setup function. */ #if LIBPCAP_VERSION_MAJOR == 1 TmEcode ReceivePcapThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); PcapIfaceConfig *pcapconfig = initdata; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } PcapThreadVars *ptv = SCMalloc(sizeof(PcapThreadVars)); if (unlikely(ptv == NULL)) { pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } memset(ptv, 0, sizeof(PcapThreadVars)); ptv->tv = tv; ptv->livedev = LiveGetDevice(pcapconfig->iface); if (ptv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("using interface %s", (char *)pcapconfig->iface); if (LiveGetOffload() == 0) { (void)GetIfaceOffloading((char *)pcapconfig->iface, 1, 1); } else { DisableIfaceOffloading(ptv->livedev, 1, 1); } ptv->checksum_mode = pcapconfig->checksum_mode; if (ptv->checksum_mode == CHECKSUM_VALIDATION_AUTO) { SCLogInfo("Running in 'auto' checksum mode. Detection of interface state will require " xstr(CHECKSUM_SAMPLE_COUNT) " packets."); } /* XXX create a general pcap setup function */ char errbuf[PCAP_ERRBUF_SIZE]; ptv->pcap_handle = pcap_create((char *)pcapconfig->iface, errbuf); if (ptv->pcap_handle == NULL) { if (strlen(errbuf)) { SCLogError(SC_ERR_PCAP_CREATE, "Couldn't create a new pcap handler for %s, error %s", (char *)pcapconfig->iface, errbuf); } else { SCLogError(SC_ERR_PCAP_CREATE, "Couldn't create a new pcap handler for %s", (char *)pcapconfig->iface); } SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } if (pcapconfig->snaplen == 0) { /* We set snaplen if we can get the MTU */ ptv->pcap_snaplen = GetIfaceMaxPacketSize(pcapconfig->iface); } else { ptv->pcap_snaplen = pcapconfig->snaplen; } if (ptv->pcap_snaplen > 0) { /* set Snaplen. Must be called before pcap_activate */ int pcap_set_snaplen_r = pcap_set_snaplen(ptv->pcap_handle, ptv->pcap_snaplen); if (pcap_set_snaplen_r != 0) { SCLogError(SC_ERR_PCAP_SET_SNAPLEN, "Couldn't set snaplen, error: %s", pcap_geterr(ptv->pcap_handle)); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("Set snaplen to %d for '%s'", ptv->pcap_snaplen, pcapconfig->iface); } /* set Promisc, and Timeout. Must be called before pcap_activate */ int pcap_set_promisc_r = pcap_set_promisc(ptv->pcap_handle, pcapconfig->promisc); //printf("ReceivePcapThreadInit: pcap_set_promisc(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_promisc_r); if (pcap_set_promisc_r != 0) { SCLogError(SC_ERR_PCAP_SET_PROMISC, "Couldn't set promisc mode, error %s", pcap_geterr(ptv->pcap_handle)); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } int pcap_set_timeout_r = pcap_set_timeout(ptv->pcap_handle,LIBPCAP_COPYWAIT); //printf("ReceivePcapThreadInit: pcap_set_timeout(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_timeout_r); if (pcap_set_timeout_r != 0) { SCLogError(SC_ERR_PCAP_SET_TIMEOUT, "Problems setting timeout, error %s", pcap_geterr(ptv->pcap_handle)); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } #ifdef HAVE_PCAP_SET_BUFF ptv->pcap_buffer_size = pcapconfig->buffer_size; if (ptv->pcap_buffer_size >= 0 && ptv->pcap_buffer_size <= INT_MAX) { if (ptv->pcap_buffer_size > 0) SCLogInfo("Going to use pcap buffer size of %" PRId32 "", ptv->pcap_buffer_size); int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->pcap_handle,ptv->pcap_buffer_size); //printf("ReceivePcapThreadInit: pcap_set_timeout(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_set_buffer_size_r); if (pcap_set_buffer_size_r != 0) { SCLogError(SC_ERR_PCAP_SET_BUFF_SIZE, "Problems setting pcap buffer size, error %s", pcap_geterr(ptv->pcap_handle)); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } } #endif /* HAVE_PCAP_SET_BUFF */ /* activate the handle */ int pcap_activate_r = pcap_activate(ptv->pcap_handle); //printf("ReceivePcapThreadInit: pcap_activate(%p) returned %" PRId32 "\n", ptv->pcap_handle, pcap_activate_r); if (pcap_activate_r != 0) { SCLogError(SC_ERR_PCAP_ACTIVATE_HANDLE, "Couldn't activate the pcap handler, error %s", pcap_geterr(ptv->pcap_handle)); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } else { ptv->pcap_state = PCAP_STATE_UP; } /* set bpf filter if we have one */ if (pcapconfig->bpf_filter) { SCMutexLock(&pcap_bpf_compile_lock); ptv->bpf_filter = pcapconfig->bpf_filter; if (pcap_compile(ptv->pcap_handle,&ptv->filter,ptv->bpf_filter,1,0) < 0) { SCLogError(SC_ERR_BPF, "bpf compilation error %s", pcap_geterr(ptv->pcap_handle)); SCMutexUnlock(&pcap_bpf_compile_lock); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); return TM_ECODE_FAILED; } if (pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) { SCLogError(SC_ERR_BPF, "could not set bpf filter %s", pcap_geterr(ptv->pcap_handle)); SCMutexUnlock(&pcap_bpf_compile_lock); SCFree(ptv); pcapconfig->DerefFunc(pcapconfig); return TM_ECODE_FAILED; } SCMutexUnlock(&pcap_bpf_compile_lock); } /* no offloading supported at all */ (void)GetIfaceOffloading(pcapconfig->iface, 1, 1); ptv->datalink = pcap_datalink(ptv->pcap_handle); pcapconfig->DerefFunc(pcapconfig); ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ptv->tv); ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ptv->tv); ptv->capture_kernel_ifdrops = StatsRegisterCounter("capture.kernel_ifdrops", ptv->tv); *data = (void *)ptv; SCReturnInt(TM_ECODE_OK); } #else /* implied LIBPCAP_VERSION_MAJOR == 0 */ TmEcode ReceivePcapThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); PcapIfaceConfig *pcapconfig = initdata; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } PcapThreadVars *ptv = SCMalloc(sizeof(PcapThreadVars)); if (unlikely(ptv == NULL)) { pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } memset(ptv, 0, sizeof(PcapThreadVars)); ptv->tv = tv; ptv->livedev = LiveGetDevice(pcapconfig->iface); if (ptv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); SCFree(ptv); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("using interface %s", pcapconfig->iface); if (strlen(pcapconfig->iface) > PCAP_IFACE_NAME_LENGTH) { SCFree(ptv); /* Dereference config */ pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } strlcpy(ptv->iface, pcapconfig->iface, PCAP_IFACE_NAME_LENGTH); if (pcapconfig->snaplen == 0) { /* We try to set snaplen from MTU value */ ptv->pcap_snaplen = GetIfaceMaxPacketSize(pcapconfig->iface); /* be conservative with old pcap lib to mimic old tcpdump behavior when MTU was not available. */ if (ptv->pcap_snaplen <= 0) ptv->pcap_snaplen = LIBPCAP_SNAPLEN; } else { ptv->pcap_snaplen = pcapconfig->snaplen; } char errbuf[PCAP_ERRBUF_SIZE] = ""; ptv->pcap_handle = pcap_open_live(ptv->iface, ptv->pcap_snaplen, LIBPCAP_PROMISC, LIBPCAP_COPYWAIT, errbuf); if (ptv->pcap_handle == NULL) { SCLogError(SC_ERR_PCAP_OPEN_LIVE, "Problem creating pcap handler for live mode, error %s", errbuf); SCFree(ptv); /* Dereference config */ pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_FAILED); } /* set bpf filter if we have one */ if (pcapconfig->bpf_filter) { SCMutexLock(&pcap_bpf_compile_lock); ptv->bpf_filter = pcapconfig->bpf_filter; SCLogInfo("using bpf-filter \"%s\"", ptv->bpf_filter); if(pcap_compile(ptv->pcap_handle,&ptv->filter, ptv->bpf_filter,1,0) < 0) { SCLogError(SC_ERR_BPF,"bpf compilation error %s",pcap_geterr(ptv->pcap_handle)); SCMutexUnlock(&pcap_bpf_compile_lock); SCFree(ptv); /* Dereference config */ pcapconfig->DerefFunc(pcapconfig); return TM_ECODE_FAILED; } if(pcap_setfilter(ptv->pcap_handle,&ptv->filter) < 0) { SCLogError(SC_ERR_BPF,"could not set bpf filter %s",pcap_geterr(ptv->pcap_handle)); SCMutexUnlock(&pcap_bpf_compile_lock); SCFree(ptv); /* Dereference config */ pcapconfig->DerefFunc(pcapconfig); return TM_ECODE_FAILED; } SCMutexUnlock(&pcap_bpf_compile_lock); } ptv->datalink = pcap_datalink(ptv->pcap_handle); ptv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ptv->tv); ptv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ptv->tv); ptv->capture_kernel_ifdrops = StatsRegisterCounter("capture.kernel_ifdrops", ptv->tv); *data = (void *)ptv; /* Dereference config */ pcapconfig->DerefFunc(pcapconfig); SCReturnInt(TM_ECODE_OK); } #endif /* LIBPCAP_VERSION_MAJOR */ /** * \brief This function prints stats to the screen at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PcapThreadVars for ptv */ void ReceivePcapThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); PcapThreadVars *ptv = (PcapThreadVars *)data; struct pcap_stat pcap_s; if (pcap_stats(ptv->pcap_handle, &pcap_s) < 0) { SCLogError(SC_ERR_STAT,"(%s) Failed to get pcap_stats: %s", tv->name, pcap_geterr(ptv->pcap_handle)); SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes); return; } else { SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes); /* these numbers are not entirely accurate as ps_recv contains packets that are still waiting to be processed at exit. * ps_drop only contains packets dropped by the driver and not any packets dropped by the interface. * Additionally see http://tracker.icir.org/bro/ticket/18 * * Note: ps_recv includes dropped packets and should be considered total. * Unless we start to look at ps_ifdrop which isn't supported everywhere. */ SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).", tv->name, (uint64_t)pcap_s.ps_recv, (uint64_t)pcap_s.ps_recv - (uint64_t)pcap_s.ps_drop, (uint64_t)pcap_s.ps_drop, (((float)(uint64_t)pcap_s.ps_drop)/(float)(uint64_t)pcap_s.ps_recv)*100); return; } } /** * \brief DeInit function closes pcap_handle at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PcapThreadVars for ptv */ TmEcode ReceivePcapThreadDeinit(ThreadVars *tv, void *data) { PcapThreadVars *ptv = (PcapThreadVars *)data; pcap_close(ptv->pcap_handle); SCReturnInt(TM_ECODE_OK); } /** * \brief This function passes off to link type decoders. * * DecodePcap reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param t pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into PcapThreadVars for ptv * \param pq pointer to the current PacketQueue */ TmEcode DecodePcap(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* call the decoder */ switch(p->datalink) { case LINKTYPE_LINUX_SLL: DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_ETHERNET: DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_PPP: DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_RAW: DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; case LINKTYPE_NULL: DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; default: SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module DecodePcap", p->datalink); break; } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } TmEcode DecodePcapThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); #ifdef __SC_CUDA_SUPPORT__ if (CudaThreadVarsInit(&dtv->cuda_vars) < 0) SCReturnInt(TM_ECODE_FAILED); #endif *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodePcapThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } void PcapTranslateIPToDevice(char *pcap_dev, size_t len) { char errbuf[PCAP_ERRBUF_SIZE]; pcap_if_t *alldevsp = NULL; pcap_if_t *devsp = NULL; struct addrinfo aiHints; struct addrinfo *aiList = NULL; int retVal = 0; memset(&aiHints, 0, sizeof(aiHints)); aiHints.ai_family = AF_UNSPEC; aiHints.ai_flags = AI_NUMERICHOST; /* try to translate IP */ if ((retVal = getaddrinfo(pcap_dev, NULL, &aiHints, &aiList)) != 0) { return; } if (pcap_findalldevs(&alldevsp, errbuf)) { freeaddrinfo(aiList); return; } for (devsp = alldevsp; devsp ; devsp = devsp->next) { pcap_addr_t *ip = NULL; for (ip = devsp->addresses; ip ; ip = ip->next) { if (aiList->ai_family != ip->addr->sa_family) { continue; } if (ip->addr->sa_family == AF_INET) { if (memcmp(&((struct sockaddr_in*)aiList->ai_addr)->sin_addr, &((struct sockaddr_in*)ip->addr)->sin_addr, sizeof(struct in_addr))) { continue; } } else if (ip->addr->sa_family == AF_INET6) { if (memcmp(&((struct sockaddr_in6*)aiList->ai_addr)->sin6_addr, &((struct sockaddr_in6*)ip->addr)->sin6_addr, sizeof(struct in6_addr))) { continue; } } else { continue; } freeaddrinfo(aiList); memset(pcap_dev, 0, len); strlcpy(pcap_dev, devsp->name, len); pcap_freealldevs(alldevsp); return; } } freeaddrinfo(aiList); pcap_freealldevs(alldevsp); } /* eof */ suricata-3.2.1/src/decode-null.c0000644000000000000000000000422513051004444013343 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode linkype null: * http://www.tcpdump.org/linktypes.html */ #include "suricata-common.h" #include "decode.h" #include "decode-raw.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" #include "pkt-var.h" #include "util-profiling.h" #include "host.h" #define HDR_SIZE 4 int DecodeNull(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_null); if (unlikely(len < HDR_SIZE)) { ENGINE_SET_INVALID_EVENT(p, LTNULL_PKT_TOO_SMALL); return TM_ECODE_FAILED; } uint32_t type = *((uint32_t *)pkt); switch(type) { case AF_INET: SCLogDebug("IPV4 Packet"); DecodeIPV4(tv, dtv, p, GET_PKT_DATA(p)+HDR_SIZE, GET_PKT_LEN(p)-HDR_SIZE, pq); break; case AF_INET6: SCLogDebug("IPV6 Packet"); DecodeIPV6(tv, dtv, p, GET_PKT_DATA(p)+HDR_SIZE, GET_PKT_LEN(p)-HDR_SIZE, pq); break; default: SCLogDebug("Unknown Null packet type version %" PRIu32 "", type); ENGINE_SET_EVENT(p, LTNULL_UNSUPPORTED_TYPE); break; } return TM_ECODE_OK; } #ifdef UNITTESTS #endif /* UNITTESTS */ /** * \brief Registers Null unit tests */ void DecodeNullRegisterTests(void) { #ifdef UNITTESTS #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-engine-sigorder.c0000644000000000000000000021165513051004444015506 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Signature ordering part of the detection engine. */ #include "suricata-common.h" #include "detect.h" #include "detect-xbits.h" #include "detect-flowbits.h" #include "detect-flowint.h" #include "detect-parse.h" #include "detect-engine-sigorder.h" #include "detect-pcre.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "util-action.h" #include "action-globals.h" #include "flow-util.h" #define DETECT_FLOWVAR_NOT_USED 1 #define DETECT_FLOWVAR_TYPE_READ 2 #define DETECT_FLOWVAR_TYPE_SET_READ 3 #define DETECT_FLOWVAR_TYPE_SET 4 #define DETECT_PKTVAR_NOT_USED 1 #define DETECT_PKTVAR_TYPE_READ 2 #define DETECT_PKTVAR_TYPE_SET_READ 3 #define DETECT_PKTVAR_TYPE_SET 4 #define DETECT_FLOWBITS_NOT_USED 1 #define DETECT_FLOWBITS_TYPE_READ 2 #define DETECT_FLOWBITS_TYPE_SET_READ 3 #define DETECT_FLOWBITS_TYPE_SET 4 #define DETECT_FLOWINT_NOT_USED 1 #define DETECT_FLOWINT_TYPE_READ 2 #define DETECT_FLOWINT_TYPE_SET_READ 3 #define DETECT_FLOWINT_TYPE_SET 4 #define DETECT_XBITS_NOT_USED 1 #define DETECT_XBITS_TYPE_READ 2 #define DETECT_XBITS_TYPE_SET_READ 3 #define DETECT_XBITS_TYPE_SET 4 /** * \brief Registers a keyword-based, signature ordering function * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param FuncPtr Pointer to the signature ordering function. The prototype of * the signature ordering function should accept a pointer to a * SCSigSignatureWrapper as its argument and shouldn't return * anything */ static void SCSigRegisterSignatureOrderingFunc(DetectEngineCtx *de_ctx, int (*SWCompare)(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2)) { SCSigOrderFunc *curr = NULL; SCSigOrderFunc *prev = NULL; SCSigOrderFunc *temp = NULL; curr = de_ctx->sc_sig_order_funcs; /* Walk to the end of the list, and leave prev pointing at the last element. */ prev = curr; while (curr != NULL) { if (curr->SWCompare == SWCompare) { /* Already specified this compare */ return; } prev = curr; curr = curr->next; } if ( (temp = SCMalloc(sizeof(SCSigOrderFunc))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCSigRegisterSignatureOrderingFunc. Exiting..."); exit(EXIT_FAILURE); } memset(temp, 0, sizeof(SCSigOrderFunc)); temp->SWCompare = SWCompare; /* Append the new compare function at the end of the list. */ if (prev == NULL) de_ctx->sc_sig_order_funcs = temp; else prev->next = temp; return; } /** * \brief Returns the flowbit type set for this signature. If more than one * flowbit has been set for the same rule, we return the flowbit type of * the maximum priority/value, where priority/value is maximum for the * ones that set the value and the lowest for ones that read the value. * If no flowbit has been set for the rule, we return 0, which indicates * the least value amongst flowbit types. * * \param sig Pointer to the Signature from which the flowbit value has to be * returned. * * \retval flowbits The flowbits type for this signature if it is set; if it is * not set, return 0 */ static inline int SCSigGetFlowbitsType(Signature *sig) { DetectFlowbitsData *fb = NULL; int flowbits_user_type = DETECT_FLOWBITS_NOT_USED; int read = 0; int write = 0; SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; while (sm != NULL) { if (sm->type == DETECT_FLOWBITS) { fb = (DetectFlowbitsData *)sm->ctx; if (fb->cmd == DETECT_FLOWBITS_CMD_ISNOTSET || fb->cmd == DETECT_FLOWBITS_CMD_ISSET) { read++; } else { #ifdef DEBUG BUG_ON(1); #endif } } sm = sm->next; } sm = sig->sm_lists[DETECT_SM_LIST_POSTMATCH]; while (sm != NULL) { if (sm->type == DETECT_FLOWBITS) { fb = (DetectFlowbitsData *)sm->ctx; if (fb->cmd == DETECT_FLOWBITS_CMD_SET || fb->cmd == DETECT_FLOWBITS_CMD_UNSET || fb->cmd == DETECT_FLOWBITS_CMD_TOGGLE) { write++; } else { #ifdef DEBUG BUG_ON(1); #endif } } sm = sm->next; } if (read > 0 && write == 0) { flowbits_user_type = DETECT_FLOWBITS_TYPE_READ; } else if (read == 0 && write > 0) { flowbits_user_type = DETECT_FLOWBITS_TYPE_SET; } else if (read > 0 && write > 0) { flowbits_user_type = DETECT_FLOWBITS_TYPE_SET_READ; } SCLogDebug("Sig %s typeval %d", sig->msg, flowbits_user_type); return flowbits_user_type; } static inline int SCSigGetFlowintType(Signature *sig) { DetectFlowintData *fi = NULL; int flowint_user_type = DETECT_FLOWINT_NOT_USED; int read = 0; int write = 0; SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; while (sm != NULL) { if (sm->type == DETECT_FLOWINT) { fi = (DetectFlowintData *)sm->ctx; if (fi->modifier == FLOWINT_MODIFIER_LT || fi->modifier == FLOWINT_MODIFIER_LE || fi->modifier == FLOWINT_MODIFIER_EQ || fi->modifier == FLOWINT_MODIFIER_NE || fi->modifier == FLOWINT_MODIFIER_GE || fi->modifier == FLOWINT_MODIFIER_GT || fi->modifier == FLOWINT_MODIFIER_NOTSET || fi->modifier == FLOWINT_MODIFIER_ISSET) { read++; } else { #ifdef DEBUG BUG_ON(1); #endif } } sm = sm->next; } sm = sig->sm_lists[DETECT_SM_LIST_POSTMATCH]; while (sm != NULL) { if (sm->type == DETECT_FLOWINT) { fi = (DetectFlowintData *)sm->ctx; if (fi->modifier == FLOWINT_MODIFIER_SET || fi->modifier == FLOWINT_MODIFIER_ADD || fi->modifier == FLOWINT_MODIFIER_SUB) { write++; } else { #ifdef DEBUG BUG_ON(1); #endif } } sm = sm->next; } if (read > 0 && write == 0) { flowint_user_type = DETECT_FLOWINT_TYPE_READ; } else if (read == 0 && write > 0) { flowint_user_type = DETECT_FLOWINT_TYPE_SET; } else if (read > 0 && write > 0) { flowint_user_type = DETECT_FLOWINT_TYPE_SET_READ; } SCLogDebug("Sig %s typeval %d", sig->msg, flowint_user_type); return flowint_user_type; } /** * \brief Returns whether the flowvar set for this rule, sets the flowvar or * reads the flowvar. If the rule sets the flowvar the function returns * DETECT_FLOWVAR_TYPE_SET(3), if it reads the flowvar the function * returns DETECT_FLOWVAR_TYPE_READ(2), and if flowvar is not used in this * rule the function returns DETECT_FLOWVAR_NOT_USED(1) * * \param sig Pointer to the Signature from which the flowvar type has to be * returned. * * \retval type DETECT_FLOWVAR_TYPE_SET(3) if the rule sets the flowvar, * DETECT_FLOWVAR_TYPE_READ(2) if it reads, and * DETECT_FLOWVAR_NOT_USED(1) if flowvar is not used. */ static inline int SCSigGetFlowvarType(Signature *sig) { DetectPcreData *pd = NULL; int type = DETECT_FLOWVAR_NOT_USED; int read = 0; int write = 0; SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { pd = (DetectPcreData *)sm->ctx; if (sm->type == DETECT_PCRE && (pd->flags & DETECT_PCRE_CAPTURE_FLOW)) { write++; } sm = sm->next; } sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; pd = NULL; while (sm != NULL) { if (sm->type == DETECT_FLOWVAR) { read++; } sm = sm->next; } if (read > 0 && write == 0) { type = DETECT_FLOWVAR_TYPE_READ; } else if (read == 0 && write > 0) { type = DETECT_FLOWVAR_TYPE_SET; } else if (read > 0 && write > 0) { type = DETECT_FLOWVAR_TYPE_SET_READ; } return type; } /** * \brief Returns whether the pktvar set for this rule, sets the flowvar or * reads the pktvar. If the rule sets the pktvar the function returns * DETECT_PKTVAR_TYPE_SET(3), if it reads the pktvar the function * returns DETECT_PKTVAR_TYPE_READ(2), and if pktvar is not used in this * rule the function returns DETECT_PKTVAR_NOT_USED(1) * * \param sig Pointer to the Signature from which the pktvar type has to be * returned. * * \retval type DETECT_PKTVAR_TYPE_SET(3) if the rule sets the flowvar, * DETECT_PKTVAR_TYPE_READ(2) if it reads, and * DETECT_PKTVAR_NOT_USED(1) if pktvar is not used. */ static inline int SCSigGetPktvarType(Signature *sig) { DetectPcreData *pd = NULL; int type = DETECT_PKTVAR_NOT_USED; int read = 0; int write = 0; SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { pd = (DetectPcreData *)sm->ctx; if (sm->type == DETECT_PCRE && (pd->flags & DETECT_PCRE_CAPTURE_PKT)) { write++; } sm = sm->next; } sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; pd = NULL; while (sm != NULL) { if (sm->type == DETECT_PKTVAR) { read++; } sm = sm->next; } if (read > 0 && write == 0) { type = DETECT_PKTVAR_TYPE_READ; } else if (read == 0 && write > 0) { type = DETECT_PKTVAR_TYPE_SET; } else if (read > 0 && write > 0) { type = DETECT_PKTVAR_TYPE_SET_READ; } return type; } /** * \brief Returns the xbit type set for this signature. If more than one * xbit has been set for the same rule, we return the xbit type of * the maximum priority/value, where priority/value is maximum for the * ones that set the value and the lowest for ones that read the value. * If no xbit has been set for the rule, we return 0, which indicates * the least value amongst xbit types. * * \param sig Pointer to the Signature from which the xbit value has to be * returned. * * \retval xbits The xbits type for this signature if it is set; if it is * not set, return 0 */ static inline int SCSigGetXbitsType(Signature *sig, enum VarTypes type) { DetectXbitsData *fb = NULL; int xbits_user_type = DETECT_XBITS_NOT_USED; int read = 0; int write = 0; SigMatch *sm = sig->sm_lists[DETECT_SM_LIST_MATCH]; while (sm != NULL) { if (sm->type == DETECT_XBITS) { fb = (DetectXbitsData *)sm->ctx; if (fb->type == type) { if (fb->cmd == DETECT_XBITS_CMD_ISNOTSET || fb->cmd == DETECT_XBITS_CMD_ISSET) { read++; } else { #ifdef DEBUG BUG_ON(1); #endif } } } sm = sm->next; } sm = sig->sm_lists[DETECT_SM_LIST_POSTMATCH]; while (sm != NULL) { if (sm->type == DETECT_HOSTBITS) { fb = (DetectXbitsData *)sm->ctx; if (fb->type == type) { if (fb->cmd == DETECT_XBITS_CMD_SET || fb->cmd == DETECT_XBITS_CMD_UNSET || fb->cmd == DETECT_XBITS_CMD_TOGGLE) { write++; } else { #ifdef DEBUG BUG_ON(1); #endif } } } sm = sm->next; } if (read > 0 && write == 0) { xbits_user_type = DETECT_XBITS_TYPE_READ; } else if (read == 0 && write > 0) { xbits_user_type = DETECT_XBITS_TYPE_SET; } else if (read > 0 && write > 0) { xbits_user_type = DETECT_XBITS_TYPE_SET_READ; } SCLogDebug("Sig %s typeval %d", sig->msg, xbits_user_type); return xbits_user_type; } /** * \brief Processes the flowbits data for this signature and caches it for * future use. This is needed to optimize the sig_ordering module. * * \param sw The sigwrapper/signature for which the flowbits data has to be * cached */ static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_FLOWBITS] = SCSigGetFlowbitsType(sw->sig); } /** * \brief Processes the flowvar data for this signature and caches it for * future use. This is needed to optimize the sig_ordering module. * * \param sw The sigwrapper/signature for which the flowvar data has to be * cached */ static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_FLOWVAR] = SCSigGetFlowvarType(sw->sig); } static inline void SCSigProcessUserDataForFlowint(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_FLOWINT] = SCSigGetFlowintType(sw->sig); } /** * \brief Processes the pktvar data for this signature and caches it for * future use. This is needed to optimize the sig_ordering module. * * \param sw The sigwrapper/signature for which the pktvar data has to be * cached */ static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_PKTVAR] = SCSigGetPktvarType(sw->sig); } /** * \brief Processes the hostbits data for this signature and caches it for * future use. This is needed to optimize the sig_ordering module. * * \param sw The sigwrapper/signature for which the hostbits data has to be * cached */ static inline void SCSigProcessUserDataForHostbits(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_HOSTBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_HOST_BIT); } /** * \brief Processes the hostbits data for this signature and caches it for * future use. This is needed to optimize the sig_ordering module. * * \param sw The sigwrapper/signature for which the hostbits data has to be * cached */ static inline void SCSigProcessUserDataForIPPairbits(SCSigSignatureWrapper *sw) { sw->user[SC_RADIX_USER_DATA_IPPAIRBITS] = SCSigGetXbitsType(sw->sig, VAR_TYPE_IPPAIR_BIT); } /* Return 1 if sw1 comes before sw2 in the final list. */ static int SCSigLessThan(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2, SCSigOrderFunc *cmp_func_list) { SCSigOrderFunc *funcs = cmp_func_list; while (funcs != NULL) { int delta = funcs->SWCompare(sw1, sw2); if (delta > 0) return 1; else if (delta < 0) return 0; funcs = funcs->next; } // They are equal, so use sid as the final decider. return sw1->sig->id < sw2->sig->id; } /* Merge sort based on a list of compare functions */ static SCSigSignatureWrapper *SCSigOrder(SCSigSignatureWrapper *sw, SCSigOrderFunc *cmp_func_list) { SCSigSignatureWrapper *subA = NULL; SCSigSignatureWrapper *subB = NULL; SCSigSignatureWrapper *first; SCSigSignatureWrapper *second; SCSigSignatureWrapper *result = NULL; SCSigSignatureWrapper *last = NULL; SCSigSignatureWrapper *new = NULL; /* Divide input list into two sub-lists. */ while (sw != NULL) { first = sw; sw = sw->next; /* Push the first element onto sub-list A */ first->next = subA; subA = first; if (sw == NULL) break; second = sw; sw = sw->next; /* Push the second element onto sub-list B */ second->next = subB; subB = second; } if (subB == NULL) { /* Only zero or one element on the list. */ return subA; } /* Now sort each list */ subA = SCSigOrder(subA, cmp_func_list); subB = SCSigOrder(subB, cmp_func_list); /* Merge the two sorted lists. */ while (subA != NULL && subB != NULL) { if (SCSigLessThan(subA, subB, cmp_func_list)) { new = subA; subA = subA->next; } else { new = subB; subB = subB->next; } /* Push onto the end of the output list. */ new->next = NULL; if (result == NULL) { result = new; last = new; } else { last->next = new; last = new; } } /* Attach the rest of any remaining list. Only one can be non-NULL here. */ if (subA == NULL) last->next = subB; else if (subB == NULL) last->next = subA; return result; } /** * \brief Orders an incoming Signature based on its action * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its action */ static int SCSigOrderByActionCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return ActionOrderVal(sw2->sig->action) - ActionOrderVal(sw1->sig->action); } /** * \brief Orders an incoming Signature based on its flowbits type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its flowbits */ static int SCSigOrderByFlowbitsCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_FLOWBITS] - sw2->user[SC_RADIX_USER_DATA_FLOWBITS]; } /** * \brief Orders an incoming Signature based on its flowvar type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its flowvar */ static int SCSigOrderByFlowvarCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_FLOWVAR] - sw2->user[SC_RADIX_USER_DATA_FLOWVAR]; } /** * \brief Orders an incoming Signature based on its pktvar type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its pktvar */ static int SCSigOrderByPktvarCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_PKTVAR] - sw2->user[SC_RADIX_USER_DATA_PKTVAR]; } static int SCSigOrderByFlowintCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_FLOWINT] - sw2->user[SC_RADIX_USER_DATA_FLOWINT]; } /** * \brief Orders an incoming Signature based on its hostbits type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its hostbits */ static int SCSigOrderByHostbitsCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_HOSTBITS] - sw2->user[SC_RADIX_USER_DATA_HOSTBITS]; } /** * \brief Orders an incoming Signature based on its ippairbits (xbits) type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its bits */ static int SCSigOrderByIPPairbitsCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw1->user[SC_RADIX_USER_DATA_IPPAIRBITS] - sw2->user[SC_RADIX_USER_DATA_IPPAIRBITS]; } /** * \brief Orders an incoming Signature based on its priority type * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. * \param sw The new signature that has to be ordered based on its priority */ static int SCSigOrderByPriorityCompare(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2) { return sw2->sig->prio - sw1->sig->prio; } /** * \brief Creates a Wrapper around the Signature * * \param Pointer to the Signature to be wrapped * * \retval sw Pointer to the wrapper that holds the signature */ static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *sig) { SCSigSignatureWrapper *sw = NULL; if ( (sw = SCMalloc(sizeof(SCSigSignatureWrapper))) == NULL) return NULL; memset(sw, 0, sizeof(SCSigSignatureWrapper)); sw->sig = sig; /* Process data from the signature into a cache for further use by the * sig_ordering module */ SCSigProcessUserDataForFlowbits(sw); SCSigProcessUserDataForFlowvar(sw); SCSigProcessUserDataForFlowint(sw); SCSigProcessUserDataForPktvar(sw); SCSigProcessUserDataForHostbits(sw); SCSigProcessUserDataForIPPairbits(sw); return sw; } /** * \brief Orders the signatures * * \param de_ctx Pointer to the Detection Engine Context that holds the * signatures to be ordered */ void SCSigOrderSignatures(DetectEngineCtx *de_ctx) { Signature *sig = NULL; SCSigSignatureWrapper *sigw = NULL; SCSigSignatureWrapper *sigw_list = NULL; int i = 0; SCLogDebug("ordering signatures in memory"); sig = de_ctx->sig_list; while (sig != NULL) { sigw = SCSigAllocSignatureWrapper(sig); /* Push signature wrapper onto a list, order doesn't matter here. */ sigw->next = sigw_list; sigw_list = sigw; sig = sig->next; i++; } /* Sort the list */ sigw_list = SCSigOrder(sigw_list, de_ctx->sc_sig_order_funcs); SCLogDebug("Total Signatures to be processed by the" "sigordering module: %d", i); /* Recreate the sig list in order */ de_ctx->sig_list = NULL; sigw = sigw_list; i = 0; while (sigw != NULL) { i++; sigw->sig->next = NULL; if (de_ctx->sig_list == NULL) { /* First entry on the list */ de_ctx->sig_list = sigw->sig; sig = de_ctx->sig_list; } else { sig->next = sigw->sig; sig = sig->next; } SCSigSignatureWrapper *sigw_to_free = sigw; sigw = sigw->next; SCFree(sigw_to_free); } SCLogDebug("total signatures reordered by the sigordering module: %d", i); } /** * \brief Lets you register the Signature ordering functions. The order in * which the functions are registered, show the priority. The first * function registered provides more priority than the function * registered after it. To add a new registration function, register * it by listing it in the correct position in the below sequence, * based on the priority you would want to offer to that keyword. * * \param de_ctx Pointer to the detection engine context from which the * signatures have to be ordered. */ void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *de_ctx) { SCLogDebug("registering signature ordering functions"); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowintCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByHostbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByIPPairbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); } /** * \brief De-registers all the signature ordering functions registered * * \param de_ctx Pointer to the detection engine context from which the * signatures were ordered. */ void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *de_ctx) { SCSigOrderFunc *funcs; void *temp; /* clean the memory alloted to the signature ordering funcs */ funcs = de_ctx->sc_sig_order_funcs; while (funcs != NULL) { temp = funcs; funcs = funcs->next; SCFree(temp); } de_ctx->sc_sig_order_funcs = NULL; } /**********Unittests**********/ DetectEngineCtx *DetectEngineCtxInit(void); Signature *SigInit(DetectEngineCtx *, char *); void SigFree(Signature *); void DetectEngineCtxFree(DetectEngineCtx *); #ifdef UNITTESTS static int SCSigOrderingTest01(void) { SCSigOrderFunc *temp = NULL; int i = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); temp = de_ctx->sc_sig_order_funcs; while (temp != NULL) { i++; temp = temp->next; } DetectEngineCtxFree(de_ctx); return (i == 5); end: return 0; } static int SCSigOrderingTest02(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; flowvar:http_host,\"www.oisf.net\"; rev:4; priority:1; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:1; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering\"; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; content:\"220\"; offset:10; depth:4; rev:4; priority:3; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; priority:3; flowbits:set,TEST.one; flowbits:noalert; sid:9;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:10;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:11;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:12;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; pktvar:http_host,\"www.oisf.net\"; priority:2; flowbits:isnotset,TEST.two; sid:13;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; flowbits:set,TEST.two; sid:14;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; /* pass */ result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 10); sig = sig->next; /* drops */ result &= (sig->id == 9); sig = sig->next; result &= (sig->id == 13); sig = sig->next; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 3); sig = sig->next; /* alerts */ result &= (sig->id == 14); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 11); sig = sig->next; result &= (sig->id == 12); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest03(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; flowbits:unset,TEST.one; rev:4; priority:2; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; flowbits:isset,TEST.one; rev:4; priority:1; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; priority:2; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; flowbits:isnotset,TEST.one; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/220[- ]/\"; flowbits:unset,TEST.one; rev:4; priority:3; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/220[- ]/\"; flowbits:toggle,TEST.one; rev:4; priority:1; pktvar:http_host,\"www.oisf.net\"; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; rev:4; flowbits:set,TEST.one; flowbits:noalert; pktvar:http_host,\"www.oisf.net\"; sid:9;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:10;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:11;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:12;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; flowbits:isnotset,TEST.one; sid:13;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; flowbits:set,TEST.one; sid:14;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 9); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 14); sig = sig->next; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 13); sig = sig->next; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 10); sig = sig->next; result &= (sig->id == 11); sig = sig->next; result &= (sig->id == 12); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest04(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; content:\"220\"; offset:10; rev:4; priority:3; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; priority:3; flowvar:http_host,\"www.oisf.net\"; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; pktvar:http_host,\"www.oisf.net\"; rev:4; priority:1; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; flowvar:http_host,\"www.oisf.net\"; pktvar:http_host,\"www.oisf.net\"; priority:1; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; flowvar:http_host,\"www.oisf.net\"; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; flowvar:http_host,\"www.oisf.net\"; sid:9;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; /* flowvar set */ result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 9); sig = sig->next; /* pktvar */ result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 1); sig = sig->next; end: if (de_ctx) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest05(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; content:\"220\"; offset:10; rev:4; priority:3; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; pcre:\"/^User-Agent: (?P.*)\\r\\n/m\"; rev:4; priority:3; pktvar:http_host,\"www.oisf.net\"; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:3; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; pktvar:http_host,\"www.oisf.net\"; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; pktvar:http_host,\"www.oisf.net\"; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; //#ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } //#endif sig = de_ctx->sig_list; /* pktvar set */ result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 4); sig = sig->next; /* pktvar read */ result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 6); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest06(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; rev:4; priority:2; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; rev:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:10; depth:4; rev:4; priority:2; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:1; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 3); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest07(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:1; rev:4;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; sid:2; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:10; depth:4; sid:3; rev:4; priority:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; depth:4; sid:4; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:5; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering reject\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:7; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; sid:8; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 3); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Order with a different Action priority * (as specified from config) */ static int SCSigOrderingTest08(void) { #ifdef HAVE_LIBNET11 int result = 0; Signature *prevsig = NULL, *sig = NULL; extern uint8_t action_order_sigs[4]; /* Let's change the order. Default is pass, drop, reject, alert (pass has highest prio) */ action_order_sigs[0] = ACTION_REJECT; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_ALERT; action_order_sigs[3] = ACTION_PASS; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:1; rev:4;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; sid:2; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:10; depth:4; sid:3; rev:4; priority:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; depth:4; sid:4; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:5; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "reject tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering reject\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:7; rev:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; sid:8; rev:4; priority:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 7); sig = sig->next; end: /* Restore the default pre-order definition */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; #else return 1; #endif } /** * \test Order with a different Action priority * (as specified from config) */ static int SCSigOrderingTest09(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; extern uint8_t action_order_sigs[4]; /* Let's change the order. Default is pass, drop, reject, alert (pass has highest prio) */ action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_REJECT; action_order_sigs[2] = ACTION_ALERT; action_order_sigs[3] = ACTION_PASS; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; priority:2; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:10; depth:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; depth:4; rev:4; priority:2; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:1; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering reject\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 5); sig = sig->next; end: /* Restore the default pre-order definition */ action_order_sigs[0] = ACTION_DROP; action_order_sigs[1] = ACTION_REJECT; action_order_sigs[2] = ACTION_PASS; action_order_sigs[3] = ACTION_ALERT; if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Order with a different Action priority * (as specified from config) */ static int SCSigOrderingTest10(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; extern uint8_t action_order_sigs[4]; /* Let's change the order. Default is pass, drop, reject, alert (pass has highest prio) */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_ALERT; action_order_sigs[2] = ACTION_DROP; action_order_sigs[3] = ACTION_REJECT; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; rev:4; priority:2; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:10; depth:4; rev:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:10; depth:4; rev:4; priority:2; sid:4;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "pass tcp any !21:902 -> any any (msg:\"Testing sigordering pass\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:5;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:1; sid:6;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering reject\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:7;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering alert\"; content:\"220\"; offset:12; depth:4; pcre:\"/220[- ]/\"; rev:4; priority:2; sid:8;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 4); sig = sig->next; result &= (sig->id == 5); sig = sig->next; result &= (sig->id == 8); sig = sig->next; result &= (sig->id == 1); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 7); sig = sig->next; end: /* Restore the default pre-order definition */ action_order_sigs[0] = ACTION_PASS; action_order_sigs[1] = ACTION_DROP; action_order_sigs[2] = ACTION_REJECT; action_order_sigs[3] = ACTION_ALERT; if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest11(void) { int result = 0; Signature *prevsig = NULL, *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering set\"; flowbits:isnotset,myflow1; rev:4; sid:1;)"); if (sig == NULL) { goto end; } prevsig = sig; de_ctx->sig_list = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering toggle\"; flowbits:toggle,myflow2; rev:4; sid:2;)"); if (sig == NULL) { goto end; } prevsig->next = sig; prevsig = sig; sig = SigInit(de_ctx, "alert tcp any !21:902 -> any any (msg:\"Testing sigordering unset\"; flowbits:isset, myflow1; flowbits:unset,myflow2; rev:4; priority:3; sid:3;)"); if (sig == NULL) { goto end; } prevsig->next = sig; SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByActionCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPktvarCompare); SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByPriorityCompare); SCSigOrderSignatures(de_ctx); result = 1; sig = de_ctx->sig_list; #ifdef DEBUG while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 2); sig = sig->next; result &= (sig->id == 3); sig = sig->next; result &= (sig->id == 1); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static int SCSigOrderingTest12(void) { Signature *sig = NULL; Packet *p = NULL; uint8_t buf[] = "test message"; int result = 0; Flow f; FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.alproto = ALPROTO_UNKNOWN; f.proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; char *sigs[2]; sigs[0] = "alert tcp any any -> any any (content:\"test\"; dsize:>0; flowbits:isset,one; flowbits:set,two; sid:1;)"; sigs[1] = "alert tcp any any -> any any (content:\"test\"; dsize:>0; flowbits:set,one; sid:2;)"; UTHAppendSigs(de_ctx, sigs, 2); sig = de_ctx->sig_list; if (sig == NULL) goto end; if (sig->next == NULL) goto end; if (sig->next->next != NULL) goto end; if (de_ctx->signum != 2) goto end; FlowInitConfig(FLOW_QUIET); p = UTHBuildPacket(buf, sizeof(buf), IPPROTO_TCP); if (p == NULL) { printf("Error building packet."); goto end; } p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; UTHMatchPackets(de_ctx, &p, 1); uint32_t sids[2] = {1, 2}; uint32_t results[2] = {1, 1}; result = UTHCheckPacketMatchResults(p, sids, results, 2); end: if (p != NULL) SCFree(p); if (de_ctx != NULL) { SigCleanSignatures(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } FlowShutdown(); return result; } /** \test Bug 1061 */ static int SCSigOrderingTest13(void) { int result = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flowbits:isset,bit1; flowbits:set,bit2; flowbits:set,bit3; sid:6;)"); if (sig == NULL) { goto end; } sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flowbits:set,bit1; flowbits:set,bit2; sid:7;)"); if (sig == NULL) { goto end; } sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flowbits:isset,bit1; flowbits:isset,bit2; flowbits:isset,bit3; sid:5;)"); if (sig == NULL) { goto end; } SCSigRegisterSignatureOrderingFunc(de_ctx, SCSigOrderByFlowbitsCompare); SCSigOrderSignatures(de_ctx); result = 1; #ifdef DEBUG sig = de_ctx->sig_list; while (sig != NULL) { printf("sid: %d\n", sig->id); sig = sig->next; } #endif sig = de_ctx->sig_list; result &= (sig->id == 7); sig = sig->next; result &= (sig->id == 6); sig = sig->next; result &= (sig->id == 5); sig = sig->next; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif void SCSigRegisterSignatureOrderingTests(void) { #ifdef UNITTESTS UtRegisterTest("SCSigOrderingTest01", SCSigOrderingTest01); UtRegisterTest("SCSigOrderingTest02", SCSigOrderingTest02); UtRegisterTest("SCSigOrderingTest03", SCSigOrderingTest03); UtRegisterTest("SCSigOrderingTest04", SCSigOrderingTest04); UtRegisterTest("SCSigOrderingTest05", SCSigOrderingTest05); UtRegisterTest("SCSigOrderingTest06", SCSigOrderingTest06); UtRegisterTest("SCSigOrderingTest07", SCSigOrderingTest07); UtRegisterTest("SCSigOrderingTest08", SCSigOrderingTest08); UtRegisterTest("SCSigOrderingTest09", SCSigOrderingTest09); UtRegisterTest("SCSigOrderingTest10", SCSigOrderingTest10); UtRegisterTest("SCSigOrderingTest11", SCSigOrderingTest11); UtRegisterTest("SCSigOrderingTest12", SCSigOrderingTest12); UtRegisterTest("SCSigOrderingTest13", SCSigOrderingTest13); #endif } suricata-3.2.1/src/detect-metadata.c0000644000000000000000000000317413051004444014200 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements metadata keyword support * * \todo Do we need to do anything more this is used in snort host attribute table * It is also used for rule managment. */ #include "suricata-common.h" #include "detect.h" static int DetectMetadataSetup (DetectEngineCtx *, Signature *, char *); void DetectMetadataRegister (void) { sigmatch_table[DETECT_METADATA].name = "metadata"; sigmatch_table[DETECT_METADATA].desc = "ignored by suricata"; sigmatch_table[DETECT_METADATA].url = DOC_URL DOC_VERSION "/rules/meta.html#metadata"; sigmatch_table[DETECT_METADATA].Match = NULL; sigmatch_table[DETECT_METADATA].Setup = DetectMetadataSetup; sigmatch_table[DETECT_METADATA].Free = NULL; sigmatch_table[DETECT_METADATA].RegisterTests = NULL; } static int DetectMetadataSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { return 0; } suricata-3.2.1/src/host-bit.c0000644000000000000000000002347513051004444012711 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements per host bits. Actually, not a bit, * but called that way because of Snort's flowbits. * It's a binary storage. * * \todo move away from a linked list implementation * \todo use different datatypes, such as string, int, etc. */ #include "suricata-common.h" #include "threads.h" #include "host-bit.h" #include "host.h" #include "detect.h" #include "util-var.h" #include "util-debug.h" #include "util-unittest.h" #include "host-storage.h" static int host_bit_id = -1; /**< Host storage id for bits */ void HostBitFreeAll(void *store) { GenericVar *gv = store; GenericVarFree(gv); } void HostBitInitCtx(void) { host_bit_id = HostStorageRegister("bit", sizeof(void *), NULL, HostBitFreeAll); if (host_bit_id == -1) { SCLogError(SC_ERR_HOST_INIT, "Can't initiate host storage for bits"); exit(EXIT_FAILURE); } } /* lock before using this */ int HostHasHostBits(Host *host) { if (host == NULL) return 0; return HostGetStorageById(host, host_bit_id) ? 1 : 0; } /** \retval 1 host timed out wrt xbits * \retval 0 host still has active (non-expired) xbits */ int HostBitsTimedoutCheck(Host *h, struct timeval *ts) { GenericVar *gv = HostGetStorageById(h, host_bit_id); for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_XBITS) { XBit *xb = (XBit *)gv; if (xb->expire > (uint32_t)ts->tv_sec) return 0; } } return 1; } /* get the bit with idx from the host */ static XBit *HostBitGet(Host *h, uint16_t idx) { GenericVar *gv = HostGetStorageById(h, host_bit_id); for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_XBITS && gv->idx == idx) { return (XBit *)gv; } } return NULL; } /* add a flowbit to the flow */ static void HostBitAdd(Host *h, uint16_t idx, uint32_t expire) { XBit *fb = HostBitGet(h, idx); if (fb == NULL) { fb = SCMalloc(sizeof(XBit)); if (unlikely(fb == NULL)) return; fb->type = DETECT_XBITS; fb->idx = idx; fb->next = NULL; fb->expire = expire; GenericVar *gv = HostGetStorageById(h, host_bit_id); GenericVarAppend(&gv, (GenericVar *)fb); HostSetStorageById(h, host_bit_id, gv); // bit already set, lets update it's time } else { fb->expire = expire; } } static void HostBitRemove(Host *h, uint16_t idx) { XBit *fb = HostBitGet(h, idx); if (fb == NULL) return; GenericVar *gv = HostGetStorageById(h, host_bit_id); if (gv) { GenericVarRemove(&gv, (GenericVar *)fb); XBitFree(fb); HostSetStorageById(h, host_bit_id, gv); } } void HostBitSet(Host *h, uint16_t idx, uint32_t expire) { XBit *fb = HostBitGet(h, idx); if (fb == NULL) { HostBitAdd(h, idx, expire); } } void HostBitUnset(Host *h, uint16_t idx) { XBit *fb = HostBitGet(h, idx); if (fb != NULL) { HostBitRemove(h, idx); } } void HostBitToggle(Host *h, uint16_t idx, uint32_t expire) { XBit *fb = HostBitGet(h, idx); if (fb != NULL) { HostBitRemove(h, idx); } else { HostBitAdd(h, idx, expire); } } int HostBitIsset(Host *h, uint16_t idx, uint32_t ts) { XBit *fb = HostBitGet(h, idx); if (fb != NULL) { if (fb->expire < ts) { HostBitRemove(h,idx); return 0; } return 1; } return 0; } int HostBitIsnotset(Host *h, uint16_t idx, uint32_t ts) { XBit *fb = HostBitGet(h, idx); if (fb == NULL) { return 1; } if (fb->expire < ts) { HostBitRemove(h,idx); return 1; } return 0; } /* TESTS */ #ifdef UNITTESTS static int HostBitTest01 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 0); XBit *fb = HostBitGet(h,0); if (fb != NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest02 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; XBit *fb = HostBitGet(h,0); if (fb == NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest03 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 30); XBit *fb = HostBitGet(h,0); if (fb == NULL) { printf("fb == NULL although it was just added: "); goto end; } HostBitRemove(h, 0); fb = HostBitGet(h,0); if (fb != NULL) { printf("fb != NULL although it was just removed: "); goto end; } else { ret = 1; } HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest04 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 30); HostBitAdd(h, 1, 30); HostBitAdd(h, 2, 30); HostBitAdd(h, 3, 30); XBit *fb = HostBitGet(h,0); if (fb != NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest05 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 30); HostBitAdd(h, 1, 30); HostBitAdd(h, 2, 30); HostBitAdd(h, 3, 30); XBit *fb = HostBitGet(h,1); if (fb != NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest06 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,2); if (fb != NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest07 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,3); if (fb != NULL) ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest08 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,0); if (fb == NULL) goto end; HostBitRemove(h,0); fb = HostBitGet(h,0); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest09 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,1); if (fb == NULL) goto end; HostBitRemove(h,1); fb = HostBitGet(h,1); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest10 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,2); if (fb == NULL) goto end; HostBitRemove(h,2); fb = HostBitGet(h,2); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; HostFree(h); end: HostCleanup(); return ret; } static int HostBitTest11 (void) { int ret = 0; HostInitConfig(TRUE); Host *h = HostAlloc(); if (h == NULL) goto end; HostBitAdd(h, 0, 90); HostBitAdd(h, 1, 90); HostBitAdd(h, 2, 90); HostBitAdd(h, 3, 90); XBit *fb = HostBitGet(h,3); if (fb == NULL) goto end; HostBitRemove(h,3); fb = HostBitGet(h,3); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; HostFree(h); end: HostCleanup(); return ret; } #endif /* UNITTESTS */ void HostBitRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HostBitTest01", HostBitTest01); UtRegisterTest("HostBitTest02", HostBitTest02); UtRegisterTest("HostBitTest03", HostBitTest03); UtRegisterTest("HostBitTest04", HostBitTest04); UtRegisterTest("HostBitTest05", HostBitTest05); UtRegisterTest("HostBitTest06", HostBitTest06); UtRegisterTest("HostBitTest07", HostBitTest07); UtRegisterTest("HostBitTest08", HostBitTest08); UtRegisterTest("HostBitTest09", HostBitTest09); UtRegisterTest("HostBitTest10", HostBitTest10); UtRegisterTest("HostBitTest11", HostBitTest11); #endif /* UNITTESTS */ } suricata-3.2.1/src/app-layer-modbus.h0000644000000000000000000001174413051004444014342 00000000000000/* * Copyright (C) 2014 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author David DIALLO */ #ifndef __APP_LAYER_MODBUS_H__ #define __APP_LAYER_MODBUS_H__ #include "decode.h" #include "detect-engine-state.h" #include "queue.h" /* Modbus Application Data Unit (ADU) * and Protocol Data Unit (PDU) messages */ enum { MODBUS_DECODER_EVENT_INVALID_PROTOCOL_ID, MODBUS_DECODER_EVENT_UNSOLICITED_RESPONSE, MODBUS_DECODER_EVENT_INVALID_LENGTH, MODBUS_DECODER_EVENT_INVALID_UNIT_IDENTIFIER, MODBUS_DECODER_EVENT_INVALID_FUNCTION_CODE, MODBUS_DECODER_EVENT_INVALID_VALUE, MODBUS_DECODER_EVENT_INVALID_EXCEPTION_CODE, MODBUS_DECODER_EVENT_VALUE_MISMATCH, MODBUS_DECODER_EVENT_FLOODED, }; /* Modbus Function Code Categories. */ #define MODBUS_CAT_NONE 0x0 #define MODBUS_CAT_PUBLIC_ASSIGNED (1<<0) #define MODBUS_CAT_PUBLIC_UNASSIGNED (1<<1) #define MODBUS_CAT_USER_DEFINED (1<<2) #define MODBUS_CAT_RESERVED (1<<3) #define MODBUS_CAT_ALL 0xFF /* Modbus Read/Write function and Access Types. */ #define MODBUS_TYP_NONE 0x0 #define MODBUS_TYP_ACCESS_MASK 0x03 #define MODBUS_TYP_READ (1<<0) #define MODBUS_TYP_WRITE (1<<1) #define MODBUS_TYP_ACCESS_FUNCTION_MASK 0x3C #define MODBUS_TYP_BIT_ACCESS_MASK 0x0C #define MODBUS_TYP_DISCRETES (1<<2) #define MODBUS_TYP_COILS (1<<3) #define MODBUS_TYP_WORD_ACCESS_MASK 0x30 #define MODBUS_TYP_INPUT (1<<4) #define MODBUS_TYP_HOLDING (1<<5) #define MODBUS_TYP_SINGLE (1<<6) #define MODBUS_TYP_MULTIPLE (1<<7) #define MODBUS_TYP_WRITE_SINGLE (MODBUS_TYP_WRITE | MODBUS_TYP_SINGLE) #define MODBUS_TYP_WRITE_MULTIPLE (MODBUS_TYP_WRITE | MODBUS_TYP_MULTIPLE) #define MODBUS_TYP_READ_WRITE_MULTIPLE (MODBUS_TYP_READ | MODBUS_TYP_WRITE | MODBUS_TYP_MULTIPLE) /* Modbus Transaction Structure, request/response. */ typedef struct ModbusTransaction_ { struct ModbusState_ *modbus; uint64_t tx_num; /**< internal: id */ uint32_t logged; /**< flags indicating which loggers have logged */ uint16_t transactionId; uint16_t length; uint8_t function; uint8_t category; uint8_t type; uint8_t replied; /**< bool indicating request is replied to. */ union { uint16_t subFunction; uint8_t mei; struct { struct { uint16_t address; uint16_t quantity; } read; struct { uint16_t address; uint16_t quantity; uint8_t count; } write; }; }; uint16_t *data; /**< to store data to write, bit is converted in 16bits. */ AppLayerDecoderEvents *decoder_events; /**< per tx events */ DetectEngineState *de_state; TAILQ_ENTRY(ModbusTransaction_) next; } ModbusTransaction; /* Modbus State Structure. */ typedef struct ModbusState_ { TAILQ_HEAD(, ModbusTransaction_) tx_list; /**< transaction list */ ModbusTransaction *curr; /**< ptr to current tx */ uint64_t transaction_max; uint32_t unreplied_cnt; /**< number of unreplied requests */ uint16_t events; uint8_t givenup; /**< bool indicating flood. */ } ModbusState; void RegisterModbusParsers(void); void ModbusParserRegisterTests(void); #endif /* __APP_LAYER_MODBUS_H__ */ suricata-3.2.1/src/detect-flowvar.h0000644000000000000000000000321613051004444014102 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FLOWVAR_H__ #define __DETECT_FLOWVAR_H__ typedef struct DetectFlowvarData_ { char *name; uint16_t idx; uint8_t *content; uint8_t content_len; uint8_t flags; } DetectFlowvarData; /* prototypes */ void DetectFlowvarRegister (void); int DetectFlowvarPostMatchSetup(Signature *s, uint16_t idx); int DetectFlowvarStoreMatch(DetectEngineThreadCtx *, uint16_t, uint8_t *, uint16_t, int); /* For use only by DetectFlowvarProcessList() */ void DetectFlowvarProcessListInternal(DetectFlowvarList *fs, Flow *f); static inline void DetectFlowvarProcessList(DetectEngineThreadCtx *det_ctx, Flow *f) { DetectFlowvarList *fs = det_ctx->flowvarlist; SCLogDebug("flow %p det_ctx->flowvarlist %p", f, fs); if (f && fs != NULL) { det_ctx->flowvarlist = NULL; DetectFlowvarProcessListInternal(fs, f); } } #endif /* __DETECT_FLOWVAR_H__ */ suricata-3.2.1/src/app-layer-dcerpc-udp.h0000644000000000000000000000133213051004444015067 00000000000000/* * Copyright (c) 2009,2010 Open Information Security Foundation * * \author Kirby Kuehl */ #ifndef __APP_LAYER_DCERPC_UDP_H__ #define __APP_LAYER_DCERPC_UDP_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-dcerpc-common.h" #include "flow.h" #include "queue.h" #include "util-byte.h" typedef struct DCERPCUDPState_ { DCERPCUDP dcerpc; uint16_t bytesprocessed; uint16_t fraglenleft; uint8_t *frag_data; DCERPCUuidEntry *uuid_entry; TAILQ_HEAD(, DCERPCUuidEntry_) uuid_list; } DCERPCUDPState; void RegisterDCERPCUDPParsers(void); void DCERPCUDPParserTests(void); void DCERPCUDPParserRegisterTests(void); #endif /* __APP_LAYER_DCERPC_UDP_H__ */ suricata-3.2.1/src/util-hyperscan.h0000644000000000000000000000175513051004444014131 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Justin Viiret * * Support functions for Hyperscan library integration. */ #ifndef __UTIL_HYPERSCAN__H__ #define __UTIL_HYPERSCAN__H__ char *HSRenderPattern(const uint8_t *pat, uint16_t pat_len); #endif /* __UTIL_HYPERSCAN__H__ */ suricata-3.2.1/src/detect-uricontent.h0000644000000000000000000000212513051004444014612 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh */ #ifndef __DETECT_URICONTENT_H__ #define __DETECT_URICONTENT_H__ #include "detect-content.h" #include "app-layer-htp.h" /* prototypes */ void DetectUricontentRegister (void); void DetectUricontentPrint(DetectContentData *); #endif /* __DETECT_URICONTENT_H__ */ suricata-3.2.1/src/util-lua.h0000644000000000000000000000471413051004444012714 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_LUA_H__ #define __UTIL_LUA_H__ #ifdef HAVE_LUA #include "util-luajit.h" typedef struct LuaStreamingBuffer_ { const uint8_t *data; uint32_t data_len; uint8_t flags; } LuaStreamingBuffer; lua_State *LuaGetState(void); void LuaReturnState(lua_State *s); /* gets */ /** \brief get tv pointer from the lua state */ ThreadVars *LuaStateGetThreadVars(lua_State *luastate); Packet *LuaStateGetPacket(lua_State *luastate); void *LuaStateGetTX(lua_State *luastate); /** \brief get flow pointer from lua state * * \retval f flow poiner or NULL if it was not set */ Flow *LuaStateGetFlow(lua_State *luastate); PacketAlert *LuaStateGetPacketAlert(lua_State *luastate); /** \brief get file pointer from the lua state */ File *LuaStateGetFile(lua_State *luastate); LuaStreamingBuffer *LuaStateGetStreamingBuffer(lua_State *luastate); int LuaStateGetDirection(lua_State *luastate); /* sets */ void LuaStateSetPacket(lua_State *luastate, Packet *p); void LuaStateSetTX(lua_State *luastate, void *tx); /** \brief set a flow pointer in the lua state * * \param f flow pointer */ void LuaStateSetFlow(lua_State *luastate, Flow *f); void LuaStateSetPacketAlert(lua_State *luastate, PacketAlert *pa); void LuaStateSetFile(lua_State *luastate, File *file); void LuaStateSetThreadVars(lua_State *luastate, ThreadVars *tv); void LuaStateSetStreamingBuffer(lua_State *luastate, LuaStreamingBuffer *b); void LuaStateSetDirection(lua_State *luastate, int direction); void LuaPrintStack(lua_State *state); int LuaPushStringBuffer(lua_State *luastate, const uint8_t *input, size_t input_len); int LuaPushInteger(lua_State *luastate, lua_Integer n); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_H__ */ suricata-3.2.1/src/host-bit.h0000644000000000000000000000237413051004444012711 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HOST_BIT_H__ #define __HOST_BIT_H__ #include "host.h" #include "util-var.h" void HostBitInitCtx(void); void HostBitRegisterTests(void); int HostHasHostBits(Host *host); int HostBitsTimedoutCheck(Host *h, struct timeval *ts); void HostBitSet(Host *, uint16_t, uint32_t); void HostBitUnset(Host *, uint16_t); void HostBitToggle(Host *, uint16_t, uint32_t); int HostBitIsset(Host *, uint16_t, uint32_t); int HostBitIsnotset(Host *, uint16_t, uint32_t); #endif /* __HOST_BIT_H__ */ suricata-3.2.1/src/util-mpm-ac-tile-small.c0000644000000000000000000000700213051004444015332 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele * Included by util-mpm-ac-tile.c with different SLOAD, SINDEX and * FUNC_NAME * */ /* Only included into util-mpm-ac-tile.c, which defines FUNC_NAME * */ #ifdef FUNC_NAME /* This function handles (ctx->state_count < 32767) */ uint32_t FUNC_NAME(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen) { int i = 0; int matches = 0; uint8_t mpm_bitarray[ctx->mpm_bitarray_size]; memset(mpm_bitarray, 0, ctx->mpm_bitarray_size); const uint8_t* restrict xlate = ctx->translate_table; STYPE *state_table = (STYPE*)ctx->state_table; STYPE state = 0; int c = xlate[buf[0]]; /* If buflen at least 4 bytes and buf 4-byte aligned. */ if (buflen >= (4 + EXTRA) && ((uintptr_t)buf & 0x3) == 0) { BUF_TYPE data = *(BUF_TYPE* restrict)(&buf[0]); uint64_t index = 0; /* Process 4*floor(buflen/4) bytes. */ i = 0; while ((i + EXTRA) < (buflen & ~0x3)) { BUF_TYPE data1 = *(BUF_TYPE* restrict)(&buf[i + 4]); index = SINDEX(index, state); state = SLOAD(state_table + index + c); c = xlate[BYTE1(data)]; if (unlikely(SCHECK(state))) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } i++; index = SINDEX(index, state); state = SLOAD(state_table + index + c); c = xlate[BYTE2(data)]; if (unlikely(SCHECK(state))) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } i++; index = SINDEX(index, state); state = SLOAD(state_table + index + c); c = xlate[BYTE3(data)]; if (unlikely(SCHECK(state))) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } data = data1; i++; index = SINDEX(index, state); state = SLOAD(state_table + index + c); c = xlate[BYTE0(data)]; if (unlikely(SCHECK(state))) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } i++; } } /* Process buflen % 4 bytes. */ for (; i < buflen; i++) { size_t index = 0 ; index = SINDEX(index, state); state = SLOAD(state_table + index + c); #ifndef __tile__ if (likely(i+1 < buflen)) #endif c = xlate[buf[i+1]]; if (unlikely(SCHECK(state))) { matches = CheckMatch(ctx, pmq, buf, buflen, state, i, matches, mpm_bitarray); } } /* for (i = 0; i < buflen; i++) */ return matches; } #endif /* FUNC_NAME */ suricata-3.2.1/src/decode-ethernet.h0000644000000000000000000000414113051004444014211 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_ETHERNET_H__ #define __DECODE_ETHERNET_H__ #define ETHERNET_HEADER_LEN 14 /* Cisco Fabric Path / DCE header length. */ #define ETHERNET_DCE_HEADER_LEN ETHERNET_HEADER_LEN + 2 /* Ethernet types -- taken from Snort and Libdnet */ #define ETHERNET_TYPE_PUP 0x0200 /* PUP protocol */ #define ETHERNET_TYPE_IP 0x0800 #define ETHERNET_TYPE_ARP 0x0806 #define ETHERNET_TYPE_BRIDGE 0x6558 /* transparant ethernet bridge (GRE) */ #define ETHERNET_TYPE_REVARP 0x8035 #define ETHERNET_TYPE_EAPOL 0x888e #define ETHERNET_TYPE_IPV6 0x86dd #define ETHERNET_TYPE_IPX 0x8137 #define ETHERNET_TYPE_PPPOE_DISC 0x8863 /* discovery stage */ #define ETHERNET_TYPE_PPPOE_SESS 0x8864 /* session stage */ #define ETHERNET_TYPE_8021AD 0x88a8 #define ETHERNET_TYPE_8021Q 0x8100 #define ETHERNET_TYPE_LOOP 0x9000 #define ETHERNET_TYPE_8021QINQ 0x9100 #define ETHERNET_TYPE_ERSPAN 0x88BE #define ETHERNET_TYPE_DCE 0x8903 /* Data center ethernet, * Cisco Fabric Path */ typedef struct EthernetHdr_ { uint8_t eth_dst[6]; uint8_t eth_src[6]; uint16_t eth_type; } __attribute__((__packed__)) EthernetHdr; #endif /* __DECODE_ETHERNET_H__ */ suricata-3.2.1/src/reputation.c0000644000000000000000000020275013051004444013345 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * \author Victor Julien * Original Idea by Matt Jonkman * * IP Reputation Module, initial API for IPV4 and IPV6 feed */ #include "suricata-common.h" #include "util-error.h" #include "util-debug.h" #include "util-ip.h" #include "util-radix-tree.h" #include "util-unittest.h" #include "threads.h" #include "util-print.h" #include "host.h" #include "conf.h" #include "detect.h" #include "reputation.h" /** effective reputation version, atomic as the host * time out code will use it to check if a host's * reputation info is outdated. */ SC_ATOMIC_DECLARE(uint32_t, srep_eversion); /** reputation version set to the host's reputation, * this will be set to 1 before rep files are loaded, * so hosts will always have a minial value of 1 */ static uint32_t srep_version = 0; static uint32_t SRepIncrVersion(void) { return ++srep_version; } static uint32_t SRepGetVersion(void) { return srep_version; } void SRepResetVersion(void) { srep_version = 0; } static uint32_t SRepGetEffectiveVersion(void) { return SC_ATOMIC_GET(srep_eversion); } static void SRepCIDRFreeUserData(void *data) { if (data != NULL) SCFree(data); return; } static void SRepCIDRAddNetblock(SRepCIDRTree *cidr_ctx, char *ip, int cat, int value) { SReputation *user_data = NULL; if ((user_data = SCMalloc(sizeof(SReputation))) == NULL) { SCLogError(SC_ERR_FATAL, "Error allocating memory. Exiting"); exit(EXIT_FAILURE); } memset(user_data, 0x00, sizeof(SReputation)); user_data->version = SRepGetVersion(); user_data->rep[cat] = value; if (strchr(ip, ':') != NULL) { if (cidr_ctx->srepIPV6_tree[cat] == NULL) { cidr_ctx->srepIPV6_tree[cat] = SCRadixCreateRadixTree(SRepCIDRFreeUserData, NULL); if (cidr_ctx->srepIPV6_tree[cat] == NULL) { SCLogDebug("Error initializing Reputation IPV6 with CIDR module for cat %d", cat); exit(EXIT_FAILURE); } SCLogDebug("Reputation IPV6 with CIDR module for cat %d initialized", cat); } SCLogDebug("adding ipv6 host %s", ip); if (SCRadixAddKeyIPV6String(ip, cidr_ctx->srepIPV6_tree[cat], (void *)user_data) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "failed to add ipv6 host %s", ip); } } else { if (cidr_ctx->srepIPV4_tree[cat] == NULL) { cidr_ctx->srepIPV4_tree[cat] = SCRadixCreateRadixTree(SRepCIDRFreeUserData, NULL); if (cidr_ctx->srepIPV4_tree[cat] == NULL) { SCLogDebug("Error initializing Reputation IPV4 with CIDR module for cat %d", cat); exit(EXIT_FAILURE); } SCLogDebug("Reputation IPV4 with CIDR module for cat %d initialized", cat); } SCLogDebug("adding ipv4 host %s", ip); if (SCRadixAddKeyIPV4String(ip, cidr_ctx->srepIPV4_tree[cat], (void *)user_data) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "failed to add ipv4 host %s", ip); } } } static uint8_t SRepCIDRGetIPv4IPRep(SRepCIDRTree *cidr_ctx, uint8_t *ipv4_addr, uint8_t cat) { void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, cidr_ctx->srepIPV4_tree[cat], &user_data); if (user_data == NULL) return 0; SReputation *r = (SReputation *)user_data; return r->rep[cat]; } static uint8_t SRepCIDRGetIPv6IPRep(SRepCIDRTree *cidr_ctx, uint8_t *ipv6_addr, uint8_t cat) { void *user_data = NULL; (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, cidr_ctx->srepIPV6_tree[cat], &user_data); if (user_data == NULL) return 0; SReputation *r = (SReputation *)user_data; return r->rep[cat]; } uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version) { uint8_t rep = 0; if (PKT_IS_IPV4(p)) rep = SRepCIDRGetIPv4IPRep(cidr_ctx, (uint8_t *)GET_IPV4_SRC_ADDR_PTR(p), cat); else if (PKT_IS_IPV6(p)) rep = SRepCIDRGetIPv6IPRep(cidr_ctx, (uint8_t *)GET_IPV6_SRC_ADDR(p), cat); return rep; } uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version) { uint8_t rep = 0; if (PKT_IS_IPV4(p)) rep = SRepCIDRGetIPv4IPRep(cidr_ctx, (uint8_t *)GET_IPV4_DST_ADDR_PTR(p), cat); else if (PKT_IS_IPV6(p)) rep = SRepCIDRGetIPv6IPRep(cidr_ctx, (uint8_t *)GET_IPV6_DST_ADDR(p), cat); return rep; } /** \brief Increment effective reputation version after * a rule/reputatio reload is complete. */ void SRepReloadComplete(void) { (void) SC_ATOMIC_ADD(srep_eversion, 1); SCLogDebug("effective Reputation version %u", SRepGetEffectiveVersion()); } /** \brief Set effective reputation version after * reputation initialization is complete. */ void SRepInitComplete(void) { (void) SC_ATOMIC_SET(srep_eversion, 1); SCLogDebug("effective Reputation version %u", SRepGetEffectiveVersion()); } /** \brief Check if a Host is timed out wrt ip rep, meaning a new * version is in place. * * We clean up the old version here. * * \param h host * * \retval 0 not timed out * \retval 1 timed out */ int SRepHostTimedOut(Host *h) { BUG_ON(h == NULL); if (h->iprep == NULL) return 1; uint32_t eversion = SRepGetEffectiveVersion(); SReputation *r = h->iprep; if (r->version < eversion) { SCLogDebug("host %p has reputation version %u, " "effective version is %u", h, r->version, eversion); SCFree(h->iprep); h->iprep = NULL; HostDecrUsecnt(h); return 1; } return 0; } static int SRepCatSplitLine(char *line, uint8_t *cat, char *shortname, size_t shortname_len) { size_t line_len = strlen(line); char *ptrs[2] = {NULL,NULL}; int i = 0; int idx = 0; char *origline = line; while (i < (int)line_len) { if (line[i] == ',' || line[i] == '\n' || line[i] == '\0' || i == (int)(line_len - 1)) { line[i] = '\0'; ptrs[idx] = line; idx++; line += (i+1); i = 0; if (line >= origline + line_len) break; if (strlen(line) == 0) break; if (idx == 2) break; } else { i++; } } if (idx != 2) { return -1; } SCLogDebug("%s, %s", ptrs[0], ptrs[1]); int c = atoi(ptrs[0]); if (c < 0 || c >= SREP_MAX_CATS) { return -1; } *cat = (uint8_t)c; strlcpy(shortname, ptrs[1], shortname_len); return 0; } /** * \retval 0 valid * \retval 1 header * \retval -1 boo */ static int SRepSplitLine(SRepCIDRTree *cidr_ctx, char *line, Address *ip, uint8_t *cat, uint8_t *value) { size_t line_len = strlen(line); char *ptrs[3] = {NULL,NULL,NULL}; int i = 0; int idx = 0; char *origline = line; while (i < (int)line_len) { if (line[i] == ',' || line[i] == '\n' || line[i] == '\0' || i == (int)(line_len - 1)) { line[i] = '\0'; ptrs[idx] = line; idx++; line += (i+1); i = 0; if (line >= origline + line_len) break; if (strlen(line) == 0) break; if (idx == 3) break; } else { i++; } } if (idx != 3) { return -1; } //SCLogInfo("%s, %s, %s", ptrs[0], ptrs[1], ptrs[2]); if (strcmp(ptrs[0], "ip") == 0) return 1; int c = atoi(ptrs[1]); if (c < 0 || c >= SREP_MAX_CATS) { return -1; } int v = atoi(ptrs[2]); if (v < 0 || v > 127) { return -1; } if (strchr(ptrs[0], '/') != NULL) { SRepCIDRAddNetblock(cidr_ctx, ptrs[0], c, v); return 1; } else { if (inet_pton(AF_INET, ptrs[0], &ip->address) == 1) { ip->family = AF_INET; } else if (inet_pton(AF_INET6, ptrs[0], &ip->address) == 1) { ip->family = AF_INET6; } else { return -1; } *cat = c; *value = v; } return 0; } #define SREP_SHORTNAME_LEN 32 static char srep_cat_table[SREP_MAX_CATS][SREP_SHORTNAME_LEN]; int SRepCatValid(uint8_t cat) { if (cat >= SREP_MAX_CATS) return 0; if (strlen(srep_cat_table[cat]) == 0) return 0; return 1; } uint8_t SRepCatGetByShortname(char *shortname) { uint8_t cat; for (cat = 0; cat < SREP_MAX_CATS; cat++) { if (strcmp(srep_cat_table[cat], shortname) == 0) return cat; } return 0; } static int SRepLoadCatFile(char *filename) { int r = 0; FILE *fp = fopen(filename, "r"); if (fp == NULL) { SCLogError(SC_ERR_OPENING_RULE_FILE, "opening ip rep file %s: %s", filename, strerror(errno)); return -1; } r = SRepLoadCatFileFromFD(fp); fclose(fp); fp = NULL; return r; } int SRepLoadCatFileFromFD(FILE *fp) { char line[8192] = ""; Address a; memset(&a, 0x00, sizeof(a)); a.family = AF_INET; memset(&srep_cat_table, 0x00, sizeof(srep_cat_table)); BUG_ON(SRepGetVersion() > 0); while(fgets(line, (int)sizeof(line), fp) != NULL) { size_t len = strlen(line); if (len == 0) continue; /* ignore comments and empty lines */ if (line[0] == '\n' || line [0] == '\r' || line[0] == ' ' || line[0] == '#' || line[0] == '\t') continue; while (isspace((unsigned char)line[--len])); /* Check if we have a trailing newline, and remove it */ len = strlen(line); if (len == 0) continue; if (line[len - 1] == '\n' || line[len - 1] == '\r') { line[len - 1] = '\0'; } uint8_t cat = 0; char shortname[SREP_SHORTNAME_LEN]; if (SRepCatSplitLine(line, &cat, shortname, sizeof(shortname)) == 0) { strlcpy(srep_cat_table[cat], shortname, SREP_SHORTNAME_LEN); } else { SCLogError(SC_ERR_NO_REPUTATION, "bad line \"%s\"", line); } } SCLogDebug("IP Rep categories:"); int i; for (i = 0; i < SREP_MAX_CATS; i++) { if (strlen(srep_cat_table[i]) == 0) continue; SCLogDebug("CAT %d, name %s", i, srep_cat_table[i]); } return 0; } static int SRepLoadFile(SRepCIDRTree *cidr_ctx, char *filename) { int r = 0; FILE *fp = fopen(filename, "r"); if (fp == NULL) { SCLogError(SC_ERR_OPENING_RULE_FILE, "opening ip rep file %s: %s", filename, strerror(errno)); return -1; } r = SRepLoadFileFromFD(cidr_ctx, fp); fclose(fp); fp = NULL; return r; } int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp) { char line[8192] = ""; Address a; memset(&a, 0x00, sizeof(a)); a.family = AF_INET; while(fgets(line, (int)sizeof(line), fp) != NULL) { size_t len = strlen(line); if (len == 0) continue; /* ignore comments and empty lines */ if (line[0] == '\n' || line [0] == '\r' || line[0] == ' ' || line[0] == '#' || line[0] == '\t') continue; while (isspace((unsigned char)line[--len])); /* Check if we have a trailing newline, and remove it */ len = strlen(line); if (len == 0) continue; if (line[len - 1] == '\n' || line[len - 1] == '\r') { line[len - 1] = '\0'; } uint8_t cat = 0, value = 0; int r = SRepSplitLine(cidr_ctx, line, &a, &cat, &value); if (r < 0) { SCLogError(SC_ERR_NO_REPUTATION, "bad line \"%s\"", line); } else if (r == 0) { if (a.family == AF_INET) { char ipstr[16]; PrintInet(AF_INET, (const void *)&a.address, ipstr, sizeof(ipstr)); SCLogDebug("%s %u %u", ipstr, cat, value); } else { char ipstr[128]; PrintInet(AF_INET6, (const void *)&a.address, ipstr, sizeof(ipstr)); SCLogDebug("%s %u %u", ipstr, cat, value); } Host *h = HostGetHostFromHash(&a); if (h == NULL) { SCLogError(SC_ERR_NO_REPUTATION, "failed to get a host, increase host.memcap"); break; } else { //SCLogInfo("host %p", h); if (h->iprep == NULL) { h->iprep = SCMalloc(sizeof(SReputation)); if (h->iprep != NULL) { memset(h->iprep, 0x00, sizeof(SReputation)); HostIncrUsecnt(h); } } if (h->iprep != NULL) { SReputation *rep = h->iprep; /* if version is outdated, it's an older entry that we'll * now replace. */ if (rep->version != SRepGetVersion()) { memset(rep, 0x00, sizeof(SReputation)); } rep->version = SRepGetVersion(); rep->rep[cat] = value; SCLogDebug("host %p iprep %p setting cat %u to value %u", h, h->iprep, cat, value); #ifdef DEBUG if (SCLogDebugEnabled()) { int i; for (i = 0; i < SREP_MAX_CATS; i++) { if (rep->rep[i] == 0) continue; SCLogDebug("--> host %p iprep %p cat %d to value %u", h, h->iprep, i, rep->rep[i]); } } #endif } HostRelease(h); } } } return 0; } /** * \brief Create the path if default-rule-path was specified * \param sig_file The name of the file * \retval str Pointer to the string path + sig_file */ static char *SRepCompleteFilePath(char *file) { char *defaultpath = NULL; char *path = NULL; /* Path not specified */ if (PathIsRelative(file)) { if (ConfGet("default-reputation-path", &defaultpath) == 1) { SCLogDebug("Default path: %s", defaultpath); size_t path_len = sizeof(char) * (strlen(defaultpath) + strlen(file) + 2); path = SCMalloc(path_len); if (unlikely(path == NULL)) return NULL; strlcpy(path, defaultpath, path_len); #if defined OS_WIN32 || defined __CYGWIN__ if (path[strlen(path) - 1] != '\\') strlcat(path, "\\\\", path_len); #else if (path[strlen(path) - 1] != '/') strlcat(path, "/", path_len); #endif strlcat(path, file, path_len); } else { path = SCStrdup(file); if (unlikely(path == NULL)) return NULL; } } else { path = SCStrdup(file); if (unlikely(path == NULL)) return NULL; } return path; } /** \brief init reputation * * \param de_ctx detection engine ctx for tracking iprep version * * \retval 0 ok * \retval -1 error * * If this function is called more than once, the category file * is not reloaded. */ int SRepInit(DetectEngineCtx *de_ctx) { ConfNode *files; ConfNode *file = NULL; int r = 0; char *sfile = NULL; char *filename = NULL; int init = 0; int i = 0; de_ctx->srepCIDR_ctx = (SRepCIDRTree *)SCMalloc(sizeof(SRepCIDRTree)); if (de_ctx->srepCIDR_ctx == NULL) exit(EXIT_FAILURE); memset(de_ctx->srepCIDR_ctx, 0, sizeof(SRepCIDRTree)); SRepCIDRTree *cidr_ctx = de_ctx->srepCIDR_ctx; for (i = 0; i < SREP_MAX_CATS; i++) { cidr_ctx->srepIPV4_tree[i] = NULL; cidr_ctx->srepIPV6_tree[i] = NULL; } if (SRepGetVersion() == 0) { SC_ATOMIC_INIT(srep_eversion); init = 1; } /* if both settings are missing, we assume the user doesn't want ip rep */ (void)ConfGet("reputation-categories-file", &filename); files = ConfGetNode("reputation-files"); if (filename == NULL && files == NULL) { SCLogConfig("IP reputation disabled"); return 0; } if (files == NULL) { SCLogError(SC_ERR_NO_REPUTATION, "\"reputation-files\" not set"); return -1; } if (init) { if (filename == NULL) { SCLogError(SC_ERR_NO_REPUTATION, "\"reputation-categories-file\" not set"); return -1; } /* init even if we have reputation files, so that when we * have a live reload, we have inited the cats */ if (SRepLoadCatFile(filename) < 0) { SCLogError(SC_ERR_NO_REPUTATION, "failed to load reputation " "categories file %s", filename); return -1; } } de_ctx->srep_version = SRepIncrVersion(); SCLogDebug("Reputation version %u", de_ctx->srep_version); /* ok, let's load signature files from the general config */ if (files != NULL) { TAILQ_FOREACH(file, &files->head, next) { sfile = SRepCompleteFilePath(file->val); SCLogInfo("Loading reputation file: %s", sfile); r = SRepLoadFile(cidr_ctx, sfile); if (r < 0){ if (de_ctx->failure_fatal == 1) { exit(EXIT_FAILURE); } } SCFree(sfile); } } /* Set effective rep version. * On live reload we will handle this after de_ctx has been swapped */ if (init) { SRepInitComplete(); } HostPrintStats(); return 0; } void SRepDestroy(DetectEngineCtx *de_ctx) { if (de_ctx->srepCIDR_ctx != NULL) { int i; for (i = 0; i < SREP_MAX_CATS; i++) { if (de_ctx->srepCIDR_ctx->srepIPV4_tree[i] != NULL) { SCRadixReleaseRadixTree(de_ctx->srepCIDR_ctx->srepIPV4_tree[i]); de_ctx->srepCIDR_ctx->srepIPV4_tree[i] = NULL; } if (de_ctx->srepCIDR_ctx->srepIPV6_tree[i] != NULL) { SCRadixReleaseRadixTree(de_ctx->srepCIDR_ctx->srepIPV6_tree[i]); de_ctx->srepCIDR_ctx->srepIPV6_tree[i] = NULL; } } SCFree(de_ctx->srepCIDR_ctx); de_ctx->srepCIDR_ctx = NULL; } } #ifdef UNITTESTS #include "conf-yaml-loader.h" #include "detect-engine.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "util-unittest-helper.h" static int SRepTest01(void) { char str[] = "1.2.3.4,1,2"; int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return 0; } SRepInit(de_ctx); Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 0) { goto end; } char ipstr[16]; PrintInet(AF_INET, (const void *)&a.address, ipstr, sizeof(ipstr)); if (strcmp(ipstr, "1.2.3.4") != 0) goto end; if (cat != 1) goto end; if (value != 2) goto end; result = 1; end: DetectEngineCtxFree(de_ctx); return result; } static int SRepTest02(void) { char str[] = "1.1.1.1,"; int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return 0; } SRepInit(de_ctx); Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) == 0) { goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); return result; } static int SRepTest03(void) { char str[] = "1,Shortname,Long Name"; uint8_t cat = 0; char shortname[SREP_SHORTNAME_LEN]; if (SRepCatSplitLine(str, &cat, shortname, sizeof(shortname)) != 0) { printf("split failed: "); return 0; } if (strcmp(shortname, "Shortname") != 0) { printf("%s != Shortname: ", shortname); return 0; } if (cat != 1) { printf("cat 1 != %u: ", cat); return 0; } return 1; } static int SRepTest04(void) { int result = 0; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } SRepInit(de_ctx); char str[] = "10.0.0.0/16,1,2"; Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 1) { goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); return result; } static int SRepTest05(void) { Packet *p = NULL; int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) { return result; } p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1"); DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } SRepInit(de_ctx); char str[] = "10.0.0.0/16,1,20"; Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 1) { goto end; } cat = 1; value = SRepCIDRGetIPRepSrc(de_ctx->srepCIDR_ctx, p, cat, 0); if (value != 20) { goto end; } result = 1; end: UTHFreePacket(p); DetectEngineCtxFree(de_ctx); return result; } static int SRepTest06(void) { Packet *p = NULL; int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) { return result; } p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1"); DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } SRepInit(de_ctx); char str[] = "0.0.0.0/0,1,10\n" "192.168.0.0/16,2,127"; Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) != 1) { goto end; } cat = 1; value = SRepCIDRGetIPRepSrc(de_ctx->srepCIDR_ctx, p, cat, 0); if (value != 10) { goto end; } result = 1; end: UTHFreePacket(p); DetectEngineCtxFree(de_ctx); return result; } static int SRepTest07(void) { char str[] = "2000:0000:0000:0000:0000:0000:0000:0001,"; int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return 0; } SRepInit(de_ctx); Address a; uint8_t cat = 0, value = 0; if (SRepSplitLine(de_ctx->srepCIDR_ctx, str, &a, &cat, &value) == 0) { goto end; } result = 1; end: DetectEngineCtxFree(de_ctx); return result; } #endif /** Global trees that hold host reputation for IPV4 and IPV6 hosts */ IPReputationCtx *rep_ctx; /** * \brief Initialization fuction for the Reputation Context (IPV4 and IPV6) * * \retval Pointer to the IPReputationCtx created * NULL Error initializing moule; */ IPReputationCtx *SCReputationInitCtx(void) { rep_ctx = (IPReputationCtx *)SCMalloc(sizeof(IPReputationCtx)); if (rep_ctx == NULL) return NULL; memset(rep_ctx,0,sizeof(IPReputationCtx)); rep_ctx->reputationIPV4_tree = SCRadixCreateRadixTree(SCReputationFreeData, NULL); if (rep_ctx->reputationIPV4_tree == NULL) { SCLogDebug("Error initializing Reputation IPV4 module"); return NULL; } SCLogDebug("Reputation IPV4 module initialized"); rep_ctx->reputationIPV6_tree = SCRadixCreateRadixTree(SCReputationFreeData, NULL); if (rep_ctx->reputationIPV6_tree == NULL) { SCLogDebug("Error initializing Reputation IPV6 module"); return NULL; } SCLogDebug("Reputation IPV6 module initialized"); if (SCMutexInit(&rep_ctx->reputationIPV4_lock, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Mutex not correctly initialized"); exit(EXIT_FAILURE); } if (SCMutexInit(&rep_ctx->reputationIPV6_lock, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Mutex not correctly initialized"); exit(EXIT_FAILURE); } return rep_ctx; } /** * \brief Allocates the Reputation structure for a host/netblock * * \retval rep_data On success, pointer to the rep_data that has to be sent * along with the key, to be added to the Radix tree */ Reputation *SCReputationAllocData(void) { Reputation *rep_data = NULL; if ( (rep_data = SCMalloc(sizeof(Reputation))) == NULL) return NULL; memset(rep_data,0, sizeof(Reputation)); rep_data->ctime = time(NULL); rep_data->mtime= time(NULL); return rep_data; } /** * \brief Used to SCFree the reputation data that is allocated by Reputation API * * \param Pointer to the data that has to be SCFreed */ void SCReputationFreeData(void *data) { if (data != NULL) SCFree(data); return; } /** * \brief Allocates the Reputation structure for a host/netblock * * \retval ReputationTransaction pointer On success */ ReputationTransaction *SCReputationTransactionAlloc(void) { ReputationTransaction *rtx = NULL; if ( (rtx = SCMalloc(sizeof(ReputationTransaction))) == NULL) return NULL; memset(rtx, 0, sizeof(ReputationTransaction)); return rtx; } /** * \brief Used to SCFree the transaction data * * \param Pointer to the data that has to be SCFreed */ void SCReputationTransactionFreeData(void *data) { if (data != NULL) SCFree(data); return; } /** * \brief Apply the transaction of changes to the reputation * We use transactions because we cant be locking/unlocking the * trees foreach update. This help for a better performance * * \param rep_data pointer to the reputation to update * \param rtx pointer to the transaction data */ void SCReputationApplyTransaction(Reputation *rep_data, ReputationTransaction *rtx) { int i = 0; /* No modification needed */ if ( !(rtx->flags & TRANSACTION_FLAG_NEEDSYNC)) return; /* Here we should apply a formula, a threshold or similar, * maybe values loaded from config */ for (; i < REPUTATION_NUMBER; i++) { if (rtx->flags & TRANSACTION_FLAG_INCS) { if (rep_data->reps[i] + rtx->inc[i] < 255) rep_data->reps[i] += rtx->inc[i]; else rep_data->reps[i] = 255; } if (rtx->flags & TRANSACTION_FLAG_DECS) { if (rep_data->reps[i] - rtx->dec[i] > 0) rep_data->reps[i] -= rtx->dec[i]; else rep_data->reps[i] = 0; } } rep_data->mtime = time(NULL); rep_data->flags |= REPUTATION_FLAG_NEEDSYNC; } /** * \brief Function that compare two reputation structs to determine if they are equal * * \param rep1 pointer to reputation 1 * \param rep2 pointer to reputation 2 * * \retval 1 if they are equal; 0 if not */ int SCReputationEqual(Reputation *rep1, Reputation *rep2) { return (memcmp(rep1->reps, rep2->reps, REPUTATION_NUMBER * sizeof(uint8_t)) == 0)? 1 : 0; } /** * \brief Helper function to print the Reputation structure * * \param Pointer rep_data to a Reputation structure */ void SCReputationPrint(Reputation *rep_data) { if (rep_data == NULL) { printf("No Reputation Data!\n"); return; } int i = 0; for (; i < REPUTATION_NUMBER; i++) printf("Rep_type %d = %d\n", i, rep_data->reps[i]); if (rep_data->flags & REPUTATION_FLAG_NEEDSYNC) printf("REPUTATION_FLAG_NEEDSYNC = 1\n"); } /** * \brief Clone all the data of a reputation * When you try to update the feed, if the data you have belongs * to a netblock, it will be cloned and inserted or a host, with * the modifications that you add * * \param orig Pointer to the original reputation (probably of a netblock) * * \retval Reputation Pointer to the reputation copy */ Reputation *SCReputationClone(Reputation *orig) { Reputation *rep = NULL; if (orig == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return NULL; } if ( (rep = SCMalloc(sizeof(Reputation))) == NULL) return NULL; memcpy(rep, orig, sizeof(Reputation)); return rep; } void SCReputationFreeCtx(IPReputationCtx *ctx) { if (ctx->reputationIPV4_tree != NULL) { SCRadixReleaseRadixTree(ctx->reputationIPV4_tree); ctx->reputationIPV4_tree = NULL; SCMutexDestroy(&ctx->reputationIPV4_lock); } if (ctx->reputationIPV6_tree != NULL) { SCRadixReleaseRadixTree(ctx->reputationIPV6_tree); ctx->reputationIPV6_tree = NULL; SCMutexDestroy(&ctx->reputationIPV6_lock); } } /** * \brief Used to add a new reputation to the reputation module (only at the startup) * * \param ipv4addr pointer to the ipv4 address key * \param netmask_value of the ipv4 address (can be a subnet or a host (32)) * \param rep_data Reputation pointer to the Reputation associated to the host/net * * \retval NULL On failure; rep_data on success */ Reputation *SCReputationAddIPV4Data(uint8_t *ipv4addr, int netmask_value, Reputation *rep_data) { struct in_addr *ipv4_addr = (struct in_addr *) ipv4addr; if (ipv4_addr == NULL || rep_data == NULL || rep_ctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return NULL; } /* If the reputation tree is not initialized yet */ if (rep_ctx->reputationIPV4_tree == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Reputation trees not initialized"); return NULL; } if (netmask_value == 32) { /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV4_lock); SCRadixAddKeyIPV4((uint8_t *)ipv4_addr, rep_ctx->reputationIPV4_tree, (void *)rep_data); SCMutexUnlock(&rep_ctx->reputationIPV4_lock); } else { if (netmask_value < 0 || netmask_value > 31) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "Invalid IPV4 Netblock"); return NULL; } MaskIPNetblock((uint8_t *)ipv4_addr, netmask_value, 32); /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV4_lock); SCRadixAddKeyIPV4Netblock((uint8_t *)ipv4_addr, rep_ctx->reputationIPV4_tree, (void *)rep_data, netmask_value); SCMutexUnlock(&rep_ctx->reputationIPV4_lock); } return rep_data; } /** * \brief Retrieves the Reputation of a host (exact match), given an ipv4 address in the raw * address format. * * \param ipv4_addr Pointer to a raw ipv4 address. * * \retval Pointer to a copy of the host Reputation on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV4ExactMatch(uint8_t *ipv4_addr) { Reputation *rep_data = NULL; /* Be careful with this (locking)*/ SCMutexLock(&rep_ctx->reputationIPV4_lock); void *user_data = NULL; (void)SCRadixFindKeyIPV4ExactMatch(ipv4_addr, rep_ctx->reputationIPV4_tree, &user_data); if (user_data == NULL) { rep_data = NULL; } else { /* Yes, we clone it because the pointer can be outdated * while another thread remove this reputation */ rep_data = SCReputationClone((Reputation *)user_data); } SCMutexUnlock(&rep_ctx->reputationIPV4_lock); return rep_data; } /** * \brief Retrieves the Reputation of a host (best match), given an ipv4 address in the raw * address format. * * \param ipv4_addr Pointer to a raw ipv4 address. * * \retval Pointer to a copy of the host Reputation on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV4BestMatch(uint8_t *ipv4_addr) { Reputation *rep_data; /* Be careful with this (locking)*/ SCMutexLock(&rep_ctx->reputationIPV4_lock); void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, rep_ctx->reputationIPV4_tree, &user_data); if (user_data == NULL) { rep_data = NULL; } else { /* Yes, we clone it because the pointer can be outdated * while another thread remove this reputation */ rep_data = SCReputationClone((Reputation *)user_data); } SCMutexUnlock(&rep_ctx->reputationIPV4_lock); return rep_data; } /** * \brief Retrieves the Reputation of a host (best match), given an ipv6 address in the raw * address format. * * \param Pointer to a raw ipv6 address. * * \retval Pointer to a copy of the host Reputation on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV6BestMatch(uint8_t *ipv6_addr) { Reputation *rep_data; /* Be careful with this (locking)*/ SCMutexLock(&rep_ctx->reputationIPV6_lock); void *user_data = NULL; (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, rep_ctx->reputationIPV6_tree, &user_data); if (user_data == NULL) { rep_data = NULL; } else { /* Yes, we clone it because the pointer can be outdated * while another thread remove this reputation */ rep_data = SCReputationClone((Reputation *)user_data); } SCMutexUnlock(&rep_ctx->reputationIPV6_lock); return rep_data; } /** * \brief Retrieves the Reputation of a host (exact match), given an ipv6 address in the raw * address format. * * \param Pointer to a raw ipv6 address. * * \retval Pointer to a copy of the host reputation on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV6ExactMatch(uint8_t *ipv6_addr) { Reputation *rep_data; /* Be careful with this (locking)*/ SCMutexLock(&rep_ctx->reputationIPV6_lock); void *user_data = NULL; (void)SCRadixFindKeyIPV6ExactMatch(ipv6_addr, rep_ctx->reputationIPV6_tree, &user_data); if (user_data == NULL) { rep_data = NULL; } else { /* Yes, we clone it because the pointer can be outdated * while another thread remove this reputation */ rep_data = SCReputationClone((Reputation *)user_data); } SCMutexUnlock(&rep_ctx->reputationIPV6_lock); return rep_data; } /** * \brief Retrieves the Real Reputation of a host (exact match), given an ipv4 address in the raw * address format. (Not thread safe!) * * \param ipv4_addr Pointer to a raw ipv4 address. * * \retval Pointer to the Reputation of the host on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV4ExactMatchReal(uint8_t *ipv4_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV4ExactMatch(ipv4_addr, rep_ctx->reputationIPV4_tree, &user_data); if (user_data == NULL) { return NULL; } else { return (Reputation *)user_data; } } /** * \brief Retrieves the Real Reputation of a host (best match), given an ipv4 address in the raw * address format. (Not thread safe!) * * \param ipv4_addr Pointer to a raw ipv4 address. * * \retval Pointer to the Reputation of the host on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV4BestMatchReal(uint8_t *ipv4_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, rep_ctx->reputationIPV4_tree, &user_data); if (user_data == NULL) { return NULL; } else { return (Reputation *)user_data; } } /** * \brief Retrieves the Real Reputation of a host (best match), given an ipv6 address in the raw * address format. (Not thread safe!) * * \param Pointer to a raw ipv6 address. * * \retval Pointer to the Reputation of the host on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV6BestMatchReal(uint8_t *ipv6_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, rep_ctx->reputationIPV6_tree, &user_data); if (user_data == NULL) { return NULL; } else { return (Reputation *)user_data; } } /** * \brief Retrieves the Real Reputation of a host (exact match), given an ipv6 address in the raw * address format. (Not thread safe!) * * \param Pointer to a raw ipv6 address. * * \retval Pointer to the Reputation of the host on success; * NULL on failure, or on not finding the key; */ Reputation *SCReputationLookupIPV6ExactMatchReal(uint8_t *ipv6_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV6ExactMatch(ipv6_addr, rep_ctx->reputationIPV6_tree, &user_data); if (user_data == NULL) { return NULL; } else { return (Reputation *)user_data; } } /** * \brief Remove the node of the reputation tree associated to the ipv4 address * * \param ipv4_addr Pointer to a raw ipv4 address * \param netmask_value netmask to apply to the address (32 for host) * */ void SCReputationRemoveIPV4Data(uint8_t * ipv4_addr, uint8_t netmask_value) { SCMutexLock(&rep_ctx->reputationIPV4_lock); SCRadixRemoveKeyIPV4Netblock(ipv4_addr, rep_ctx->reputationIPV4_tree, netmask_value); SCMutexUnlock(&rep_ctx->reputationIPV4_lock); } /** * \brief Remove the node of the reputation tree associated to the ipv6 address * * \param ipv6_addr Pointer to a raw ipv6 address * \param netmask_value netmask to apply to the address (128 for host) * */ void SCReputationRemoveIPV6Data(uint8_t * ipv6_addr, uint8_t netmask_value) { SCMutexLock(&rep_ctx->reputationIPV6_lock); SCRadixRemoveKeyIPV6Netblock(ipv6_addr, rep_ctx->reputationIPV6_tree, netmask_value); SCMutexUnlock(&rep_ctx->reputationIPV6_lock); } /** * \brief Used to add a new reputation to the reputation module (only at the startup) * * \param ipv6addr pointer to the ipv6 address key * \param netmask_value of the ipv6 address (can be a subnet) * \param rep_data Reputation pointer to the Reputation associated to the host/net * * \retval NULL On failure */ Reputation *SCReputationAddIPV6Data(uint8_t *ipv6addr, int netmask_value, Reputation *rep_data) { struct in_addr *ipv6_addr = (struct in_addr *) ipv6addr; if (ipv6_addr == NULL || rep_data == NULL || rep_ctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return NULL; } /* If the reputation tree is not initialized yet */ if (rep_ctx->reputationIPV6_tree == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Reputation trees not initialized"); return NULL; } if (netmask_value == 128) { /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV6_lock); SCRadixAddKeyIPV6((uint8_t *)ipv6_addr, rep_ctx->reputationIPV6_tree, (void *)rep_data); SCMutexUnlock(&rep_ctx->reputationIPV6_lock); } else { if (netmask_value < 0 || netmask_value > 127) { SCLogError(SC_ERR_INVALID_IP_NETBLOCK, "Invalid IPV6 Netblock"); return NULL; } MaskIPNetblock((uint8_t *)ipv6_addr, netmask_value, 128); /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV6_lock); SCRadixAddKeyIPV6Netblock((uint8_t *)ipv6_addr, rep_ctx->reputationIPV6_tree, (void *)rep_data, netmask_value); SCMutexUnlock(&rep_ctx->reputationIPV6_lock); } return rep_data; } /** * \brief Update a reputation or insert a new one. If it doesn't exist * it will try to search for the reputation of parent subnets to * create the new reputation data based on this one * * \param ipv6addr pointer to the ipv6 address key * \param rep_data Reputation pointer to the Reputation associated to the host/net * * \retval NULL On failure */ Reputation *SCReputationUpdateIPV4Data(uint8_t *ipv4addr, ReputationTransaction *rtx) { struct in_addr *ipv4_addr = (struct in_addr *) ipv4addr; Reputation *actual_rep; if (ipv4_addr == NULL || rtx == NULL || rep_ctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return NULL; } /* If the reputation tree is not initialized yet */ if (rep_ctx->reputationIPV4_tree == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Reputation trees not initialized"); return NULL; } /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV4_lock); /* Search exact match and update */ actual_rep = SCReputationLookupIPV4ExactMatchReal(ipv4addr); if (actual_rep == NULL) { /* else search best match (parent subnets) */ actual_rep =SCReputationLookupIPV4BestMatchReal(ipv4addr); if (actual_rep != NULL) { /* clone from parent and insert host */ actual_rep = SCReputationClone(actual_rep); } else { /* else insert a new reputation data for the host */ actual_rep = SCReputationAllocData(); /* If new, we only increment values */ rtx->flags = TRANSACTION_FLAG_INCS; rtx->flags |= TRANSACTION_FLAG_NEEDSYNC; } /* insert the reputation data in the tree */ SCRadixAddKeyIPV4((uint8_t *)ipv4_addr, rep_ctx->reputationIPV4_tree, (void *)actual_rep); } /* Apply updates */ SCReputationApplyTransaction(actual_rep, rtx); /* Unlock! */ SCMutexUnlock(&rep_ctx->reputationIPV4_lock); return actual_rep; } /** * \brief Update a reputation or insert a new one. If it doesn't exist * it will try to search for the reputation of parent subnets to * create the new reputation data based on this one * * \param ipv6addr pointer to the ipv6 address key * \param rep_data Reputation pointer to the Reputation associated to the host/net * * \retval NULL On failure */ Reputation *SCReputationUpdateIPV6Data(uint8_t *ipv6addr, ReputationTransaction *rtx) { struct in_addr *ipv6_addr = (struct in_addr *) ipv6addr; Reputation *actual_rep; if (ipv6_addr == NULL || rtx == NULL || rep_ctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid arguments"); return NULL; } /* If the reputation tree is not initialized yet */ if (rep_ctx->reputationIPV6_tree == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Reputation trees not initialized"); return NULL; } /* Be careful with the mutex */ SCMutexLock(&rep_ctx->reputationIPV6_lock); /* Search exact match and update */ actual_rep = SCReputationLookupIPV6ExactMatchReal(ipv6addr); if (actual_rep == NULL) { /* else search best match (parent subnets) */ actual_rep =SCReputationLookupIPV6BestMatchReal(ipv6addr); if (actual_rep != NULL) { /* clone from parent and insert host */ actual_rep = SCReputationClone(actual_rep); } else { /* else insert a new reputation data for the host */ actual_rep = SCReputationAllocData(); /* If new, we only increment values */ rtx->flags = TRANSACTION_FLAG_INCS; rtx->flags |= TRANSACTION_FLAG_NEEDSYNC; } /* insert the reputation data in the tree */ SCRadixAddKeyIPV6((uint8_t *)ipv6_addr, rep_ctx->reputationIPV6_tree, (void *)actual_rep); } /* Apply updates */ SCReputationApplyTransaction(actual_rep, rtx); /* Unlock! */ SCMutexUnlock(&rep_ctx->reputationIPV6_lock); return actual_rep; } /* ----------------- UNITTESTS-------------------- */ #ifdef UNITTESTS /** * \test Adding (from numeric ipv4) and removing host reputation in the Reputation context * tree. THe reputation data is the real one, no copies here. */ int SCReputationTestIPV4AddRemoveHost01(void) { int i = 0; struct in_addr in; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.6", &in) < 0) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 6; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 32, rep_orig); if (rep_orig == NULL) goto error; Reputation *rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_orig) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.7", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 32, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_orig) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.7", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 31, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data == NULL || rep_data == rep_orig) goto error; if (inet_pton(AF_INET, "192.168.1.8", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data != NULL) goto error; /* Removing */ if (inet_pton(AF_INET, "192.168.1.7", &in) < 0) goto error; SCReputationRemoveIPV4Data((uint8_t *) &in, 32); rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; if (inet_pton(AF_INET, "192.168.1.6", &in) < 0) goto error; SCReputationRemoveIPV4Data((uint8_t *) &in, 32); rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; SCRadixPrintTree(rep_ctx->reputationIPV4_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Adding (from numeric ipv6) and removing host reputation in the Reputation context * tree. THe reputation data is the real one, no copies here. */ int SCReputationTestIPV6AddRemoveHost01(void) { uint8_t in[16]; uint8_t i = 0; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2362", &in) < 0) goto error; Reputation *rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 1; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 128, rep_orig); if (rep_orig == NULL) goto error; Reputation *rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_orig) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2363", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 8; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 128, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_orig) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2363", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 127, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data == NULL || rep_data == rep_orig) goto error; /* Removing */ if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2363", &in) < 0) goto error; SCReputationRemoveIPV6Data((uint8_t *) &in, 128); rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2362", &in) < 0) goto error; SCReputationRemoveIPV6Data((uint8_t *) &in, 128); rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; SCRadixPrintTree(rep_ctx->reputationIPV6_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Adding (from numeric ipv4) and retrieving reputations * tree. The reputation data retireved are copies of the original. */ int SCReputationTestIPV4AddRemoveHost02(void) { int i = 0; struct in_addr in; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.6", &in) < 0) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 6; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 32, rep_orig); if (rep_orig == NULL) goto error; Reputation *rep_data = SCReputationLookupIPV4ExactMatch((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 0) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.7", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 32, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV4ExactMatch((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 0) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.7", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 9; rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 31, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV4ExactMatch((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 1) goto error; SCRadixPrintTree(rep_ctx->reputationIPV4_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Adding (from numeric ipv6) and removing host reputation in the Reputation context * tree. The reputation data retireved are copies of the original. */ int SCReputationTestIPV6AddRemoveHost02(void) { int i = 0; uint8_t in[16]; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2362", &in) < 0) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 6; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 128, rep_orig); if (rep_orig == NULL) goto error; Reputation *rep_data = SCReputationLookupIPV6ExactMatch((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 0) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2363", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 128, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV6ExactMatch((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 0) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2363", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 9; rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 127, rep_orig); if (rep_orig == NULL) goto error; rep_data = SCReputationLookupIPV6ExactMatch((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data == NULL || SCReputationEqual(rep_data, rep_orig) == 1) goto error; if (inet_pton(AF_INET6, "aaaa:bbbb:cccc:dddd:1223:1722:3425:2364", &in) < 0) goto error; rep_data = SCReputationLookupIPV6ExactMatch((uint8_t *) &in); /* It should return the host info and not the subnet info */ if (rep_data != NULL) goto error; SCRadixPrintTree(rep_ctx->reputationIPV6_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Test searches (best and exact matches) */ int SCReputationTestIPV4BestExactMatch01(void) { int i = 0; struct in_addr in; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_origC = NULL; Reputation *rep_origB = NULL; Reputation *rep_origA = NULL; Reputation *rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.6", &in) < 0) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 6; /* adding a host */ rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 32, rep_orig); if (rep_orig == NULL) goto error; Reputation *rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_orig) goto error; rep_orig = SCReputationAllocData(); if (rep_orig == NULL) goto error; /* Adding C subnet */ if (inet_pton(AF_INET, "192.168.1.0", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_origC = SCReputationAddIPV4Data((uint8_t *) &in, 24, rep_orig); if (rep_origC == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origC) goto error; rep_orig = SCReputationAllocData(); /* Adding B subnet */ if (inet_pton(AF_INET, "192.168.0.0", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_origB = SCReputationAddIPV4Data((uint8_t *) &in, 16, rep_orig); if (rep_origB == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origC) goto error; if (inet_pton(AF_INET, "192.168.2.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origB) goto error; rep_orig = SCReputationAllocData(); /* Adding A subnet */ if (inet_pton(AF_INET, "192.0.0.0", &in) < 0) goto error; for (i = 0; i < REPUTATION_NUMBER; i++) rep_orig->reps[i] = i * 10 + 7; rep_origA = SCReputationAddIPV4Data((uint8_t *) &in, 8, rep_orig); if (rep_origA == NULL) goto error; if (inet_pton(AF_INET, "192.168.1.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origC) goto error; if (inet_pton(AF_INET, "192.168.2.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origB) goto error; if (inet_pton(AF_INET, "192.167.2.5", &in) < 0) goto error; rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data != NULL) goto error; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || rep_data != rep_origA) goto error; SCRadixPrintTree(rep_ctx->reputationIPV4_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Update transactions */ int SCReputationTestIPV4Update01(void) { int i = 0; struct in_addr in; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_orig = SCReputationAllocData(); ReputationTransaction rtx; memset(&rtx, 0, sizeof(ReputationTransaction)); if (rep_orig == NULL) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) { rep_orig->reps[i] = 10; } if (inet_pton(AF_INET, "192.168.0.0", &in) < 0) goto error; /* Add add it as net */ rep_orig = SCReputationAddIPV4Data((uint8_t *) &in, 16, rep_orig); if (rep_orig == NULL) goto error; rtx.dec[REPUTATION_DDOS] = 5; rtx.inc[REPUTATION_PHISH] = 50; rtx.inc[REPUTATION_MALWARE] = 30; rtx.flags |= TRANSACTION_FLAG_NEEDSYNC; rtx.flags |= TRANSACTION_FLAG_INCS; rtx.flags |= TRANSACTION_FLAG_DECS; if (inet_pton(AF_INET, "192.168.10.100", &in) < 0) goto error; /* Update (it will create the host entry with the data of the net) */ SCReputationUpdateIPV4Data((uint8_t *)&in, &rtx); /* Create the reputation that any host 192.168.* should have */ Reputation *rep_aux = SCReputationAllocData(); /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) { rep_aux->reps[i] = 10; } rep_aux->reps[REPUTATION_DDOS] = 5; rep_aux->reps[REPUTATION_PHISH] = 60; rep_aux->reps[REPUTATION_MALWARE] = 40; Reputation *rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; /* Now that is created, it should update only the host */ rtx.dec[REPUTATION_DDOS] = 50; rtx.inc[REPUTATION_PHISH] = 50; rtx.inc[REPUTATION_MALWARE] = 50; rep_aux->reps[REPUTATION_DDOS] = 0; rep_aux->reps[REPUTATION_PHISH] = 110; rep_aux->reps[REPUTATION_MALWARE] = 90; SCReputationUpdateIPV4Data((uint8_t *)&in, &rtx); rep_data = SCReputationLookupIPV4ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; /* So let's see if we add a host and get the parent data again */ if (inet_pton(AF_INET, "192.168.10.101", &in) < 0) goto error; rep_aux->reps[REPUTATION_DDOS] = 10; rep_aux->reps[REPUTATION_PHISH] = 10; rep_aux->reps[REPUTATION_MALWARE] = 10; rep_data = SCReputationLookupIPV4BestMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; SCRadixPrintTree(rep_ctx->reputationIPV4_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } /** * \test Update transactions */ int SCReputationTestIPV6Update01(void) { int i = 0; uint8_t in[16]; SCReputationInitCtx(); if (rep_ctx == NULL) { SCLogInfo("Error initializing Reputation Module"); return 0; } Reputation *rep_orig = SCReputationAllocData(); ReputationTransaction rtx; memset(&rtx, 0, sizeof(ReputationTransaction)); if (rep_orig == NULL) goto error; /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) { rep_orig->reps[i] = 10; } if (inet_pton(AF_INET6, "8762:2352:6261:7265:EE23:21AD:2121:1DDD", &in) < 0) goto error; /* Add add it as net */ rep_orig = SCReputationAddIPV6Data((uint8_t *) &in, 98, rep_orig); if (rep_orig == NULL) goto error; rtx.dec[REPUTATION_DDOS] = 5; rtx.inc[REPUTATION_PHISH] = 50; rtx.inc[REPUTATION_MALWARE] = 30; rtx.flags |= TRANSACTION_FLAG_NEEDSYNC; rtx.flags |= TRANSACTION_FLAG_INCS; rtx.flags |= TRANSACTION_FLAG_DECS; if (inet_pton(AF_INET6, "8762:2352:6261:7265:EE23:21AD:2121:1ABA", &in) < 0) goto error; /* Update (it will create the host entry with the data of the net) */ SCReputationUpdateIPV6Data((uint8_t *)&in, &rtx); /* Create the reputation that any host 192.168.* should have */ Reputation *rep_aux = SCReputationAllocData(); /* Fill the reputation with some values.. */ for (i = 0; i < REPUTATION_NUMBER; i++) { rep_aux->reps[i] = 10; } rep_aux->reps[REPUTATION_DDOS] = 5; rep_aux->reps[REPUTATION_PHISH] = 60; rep_aux->reps[REPUTATION_MALWARE] = 40; Reputation *rep_data = SCReputationLookupIPV6BestMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; /* Now that is created, it should update only the host */ rtx.dec[REPUTATION_DDOS] = 50; rtx.inc[REPUTATION_PHISH] = 50; rtx.inc[REPUTATION_MALWARE] = 50; rep_aux->reps[REPUTATION_DDOS] = 0; rep_aux->reps[REPUTATION_PHISH] = 110; rep_aux->reps[REPUTATION_MALWARE] = 90; SCReputationUpdateIPV6Data((uint8_t *)&in, &rtx); rep_data = SCReputationLookupIPV6ExactMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; /* So let's see if we add a host and get the parent data again */ if (inet_pton(AF_INET6, "8762:2352:6261:7265:EE23:21AD:2121:1ACB", &in) < 0) goto error; rep_aux->reps[REPUTATION_DDOS] = 10; rep_aux->reps[REPUTATION_PHISH] = 10; rep_aux->reps[REPUTATION_MALWARE] = 10; rep_data = SCReputationLookupIPV6BestMatchReal((uint8_t *) &in); if (rep_data == NULL || SCReputationEqual(rep_data, rep_aux) != 1) goto error; SCRadixPrintTree(rep_ctx->reputationIPV6_tree); SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 1; error: SCReputationFreeCtx(rep_ctx); rep_ctx = NULL; return 0; } #endif /* UNITTESTS */ /** Register the following unittests for the Reputation module */ void SCReputationRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCReputationTestIPV4AddRemoveHost01", SCReputationTestIPV4AddRemoveHost01); UtRegisterTest("SCReputationTestIPV6AddRemoveHost01", SCReputationTestIPV6AddRemoveHost01); UtRegisterTest("SCReputationTestIPV4BestExactMatch01", SCReputationTestIPV4BestExactMatch01); UtRegisterTest("SCReputationTestIPV4AddRemoveHost02", SCReputationTestIPV4AddRemoveHost02); UtRegisterTest("SCReputationTestIPV6AddRemoveHost02", SCReputationTestIPV6AddRemoveHost02); UtRegisterTest("SCReputationTestIPV4Update01", SCReputationTestIPV4Update01); UtRegisterTest("SCReputationTestIPV6Update01", SCReputationTestIPV6Update01); UtRegisterTest("SRepTest01", SRepTest01); UtRegisterTest("SRepTest02", SRepTest02); UtRegisterTest("SRepTest03", SRepTest03); UtRegisterTest("SRepTest04", SRepTest04); UtRegisterTest("SRepTest05", SRepTest05); UtRegisterTest("SRepTest06", SRepTest06); UtRegisterTest("SRepTest07", SRepTest07); #endif /* UNITTESTS */ } suricata-3.2.1/src/app-layer-ssl.h0000644000000000000000000001410013051004444013637 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Pierre Chifflier * */ #ifndef __APP_LAYER_SSL_H__ #define __APP_LAYER_SSL_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "decode-events.h" #include "queue.h" enum { /* TLS protocol messages */ TLS_DECODER_EVENT_INVALID_SSLV2_HEADER, TLS_DECODER_EVENT_INVALID_TLS_HEADER, TLS_DECODER_EVENT_INVALID_RECORD_VERSION, TLS_DECODER_EVENT_INVALID_RECORD_TYPE, TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE, TLS_DECODER_EVENT_HEARTBEAT, TLS_DECODER_EVENT_INVALID_HEARTBEAT, TLS_DECODER_EVENT_OVERFLOW_HEARTBEAT, TLS_DECODER_EVENT_DATALEAK_HEARTBEAT_MISMATCH, TLS_DECODER_EVENT_HANDSHAKE_INVALID_LENGTH, TLS_DECODER_EVENT_MULTIPLE_SNI_EXTENSIONS, TLS_DECODER_EVENT_INVALID_SNI_TYPE, TLS_DECODER_EVENT_INVALID_SNI_LENGTH, TLS_DECODER_EVENT_TOO_MANY_RECORDS_IN_PACKET, /* Certificates decoding messages */ TLS_DECODER_EVENT_INVALID_CERTIFICATE, TLS_DECODER_EVENT_CERTIFICATE_MISSING_ELEMENT, TLS_DECODER_EVENT_CERTIFICATE_UNKNOWN_ELEMENT, TLS_DECODER_EVENT_CERTIFICATE_INVALID_LENGTH, TLS_DECODER_EVENT_CERTIFICATE_INVALID_STRING, TLS_DECODER_EVENT_ERROR_MSG_ENCOUNTERED, TLS_DECODER_EVENT_INVALID_SSL_RECORD, }; enum { TLS_STATE_IN_PROGRESS = 0, TLS_STATE_CERT_READY = 1, TLS_HANDSHAKE_DONE = 2, TLS_STATE_FINISHED = 3 }; /* Flag to indicate that server will now on send encrypted msgs */ #define SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC 0x0001 /* Flag to indicate that client will now on send encrypted msgs */ #define SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC 0x0002 #define SSL_AL_FLAG_CHANGE_CIPHER_SPEC 0x0004 /* SSL related flags */ #define SSL_AL_FLAG_SSL_CLIENT_HS 0x0008 #define SSL_AL_FLAG_SSL_SERVER_HS 0x0010 #define SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY 0x0020 #define SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED 0x0040 #define SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED 0x0080 #define SSL_AL_FLAG_SSL_NO_SESSION_ID 0x0100 /* flags specific to detect-ssl-state keyword */ #define SSL_AL_FLAG_STATE_CLIENT_HELLO 0x0200 #define SSL_AL_FLAG_STATE_SERVER_HELLO 0x0400 #define SSL_AL_FLAG_STATE_CLIENT_KEYX 0x0800 #define SSL_AL_FLAG_STATE_SERVER_KEYX 0x1000 #define SSL_AL_FLAG_STATE_UNKNOWN 0x2000 /* flag to indicate that session is finished */ #define SSL_AL_FLAG_STATE_FINISHED 0x4000 /* flags specific to HeartBeat state */ #define SSL_AL_FLAG_HB_INFLIGHT 0x8000 #define SSL_AL_FLAG_HB_CLIENT_INIT 0x10000 #define SSL_AL_FLAG_HB_SERVER_INIT 0x20000 /* flag to indicate that handshake is done */ #define SSL_AL_FLAG_HANDSHAKE_DONE 0x80000 /* config flags */ #define SSL_TLS_LOG_PEM (1 << 0) /* extensions */ #define SSL_EXTENSION_SNI 0x0000 /* SNI types */ #define SSL_SNI_TYPE_HOST_NAME 0 /* SSL versions. We'll use a unified format for all, with the top byte * holding the major version and the lower byte the minor version */ enum { TLS_VERSION_UNKNOWN = 0x0000, SSL_VERSION_2 = 0x0200, SSL_VERSION_3 = 0x0300, TLS_VERSION_10 = 0x0301, TLS_VERSION_11 = 0x0302, TLS_VERSION_12 = 0x0303, }; typedef struct SSLCertsChain_ { uint8_t *cert_data; uint32_t cert_len; TAILQ_ENTRY(SSLCertsChain_) next; } SSLCertsChain; typedef struct SSLStateConnp_ { /* record length */ uint32_t record_length; /* record length's length for SSLv2 */ uint32_t record_lengths_length; /* offset of the beginning of the current message (including header) */ uint32_t message_start; uint32_t message_length; uint16_t version; uint8_t content_type; uint8_t handshake_type; uint32_t handshake_length; /* the no of bytes processed in the currently parsed record */ uint16_t bytes_processed; /* the no of bytes processed in the currently parsed handshake */ uint16_t hs_bytes_processed; /* sslv2 client hello session id length */ uint16_t session_id_length; char *cert0_subject; char *cert0_issuerdn; time_t cert0_not_before; time_t cert0_not_after; char *cert0_fingerprint; /* ssl server name indication extension */ char *sni; uint8_t *cert_input; uint32_t cert_input_len; TAILQ_HEAD(, SSLCertsChain_) certs; uint32_t cert_log_flag; /* buffer for the tls record. * We use a malloced buffer, if the record is fragmented */ uint8_t *trec; uint32_t trec_len; uint32_t trec_pos; } SSLStateConnp; /** * \brief SSLv[2.0|3.[0|1|2|3]] state structure. * * Structure to store the SSL state values. */ typedef struct SSLState_ { Flow *f; /* holds some state flags we need */ uint32_t flags; /* specifies which loggers are done logging */ uint32_t logged; /* there might be a better place to store this*/ uint16_t hb_record_len; uint16_t events; uint32_t current_flags; SSLStateConnp *curr_connp; SSLStateConnp client_connp; SSLStateConnp server_connp; DetectEngineState *de_state; AppLayerDecoderEvents *decoder_events; } SSLState; void RegisterSSLParsers(void); void SSLParserRegisterTests(void); void SSLSetEvent(SSLState *ssl_state, uint8_t event); #endif /* __APP_LAYER_SSL_H__ */ suricata-3.2.1/src/util-time.h0000644000000000000000000000346713051004444013075 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_TIME_H__ #define __UTIL_TIME_H__ /** * A timeval with 32 bit fields. * * Used by the unified on disk file format. */ typedef struct SCTimeval32_ { uint32_t tv_sec; uint32_t tv_usec; } SCTimeval32; void TimeInit(void); void TimeDeinit(void); void TimeSetByThread(const int thread_id, const struct timeval *tv); void TimeGet(struct timeval *); #ifdef UNITTESTS void TimeSet(struct timeval *); void TimeSetToCurrentTime(void); void TimeSetIncrementTime(uint32_t); #endif void TimeModeSetLive(void); void TimeModeSetOffline (void); int TimeModeIsLive(void); struct tm *SCLocalTime(time_t timep, struct tm *result); void CreateTimeString (const struct timeval *ts, char *str, size_t size); void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size); void CreateUtcIsoTimeString (const struct timeval *ts, char *str, size_t size); time_t SCMkTimeUtc (struct tm *tp); int SCStringPatternToTime (char *string, char **patterns, int num_patterns, struct tm *time); #endif /* __UTIL_TIME_H__ */ suricata-3.2.1/src/runmode-ipfw.c0000644000000000000000000000453313051004444013566 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Eric Leblond * * Handling of ipfw runmodes. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-ipfw.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" #include "source-ipfw.h" #include "util-device.h" static const char *default_mode; const char *RunModeIpsIPFWGetDefaultMode(void) { return default_mode; } void RunModeIpsIPFWRegister(void) { default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_IPFW, "autofp", "Multi threaded IPFW IPS mode with respect to flow", RunModeIpsIPFWAutoFp); RunModeRegisterNewRunMode(RUNMODE_IPFW, "workers", "Multi queue IPFW IPS mode with one thread per queue", RunModeIpsIPFWWorker); return; } int RunModeIpsIPFWAutoFp(void) { SCEnter(); int ret = 0; #ifdef IPFW RunModeInitialize(); TimeModeSetLive(); LiveDeviceHasNoStats(); ret = RunModeSetIPSAutoFp(IPFWGetThread, "ReceiveIPFW", "VerdictIPFW", "DecodeIPFW"); #endif /* IPFW */ return ret; } int RunModeIpsIPFWWorker(void) { SCEnter(); int ret = 0; #ifdef IPFW RunModeInitialize(); TimeModeSetLive(); LiveDeviceHasNoStats(); ret = RunModeSetIPSWorker(IPFWGetThread, "ReceiveIPFW", "VerdictIPFW", "DecodeIPFW"); #endif /* IPFW */ return ret; } suricata-3.2.1/src/source-napatech.c0000644000000000000000000003313013051004444014226 00000000000000/* Copyright (C) 2012-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author nPulse Technologies, LLC. * \author Matt Keeler * * Support for NAPATECH adapter with the 3GD Driver/API. * Requires libntapi from Napatech A/S. * */ #include "suricata-common.h" #include "suricata.h" #include "threadvars.h" #include "util-optimize.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "tm-modules.h" #include "util-privs.h" #include "tmqh-packetpool.h" #ifndef HAVE_NAPATECH TmEcode NoNapatechSupportExit(ThreadVars *, void *, void **); void TmModuleNapatechStreamRegister (void) { tmm_modules[TMM_RECEIVENAPATECH].name = "NapatechStream"; tmm_modules[TMM_RECEIVENAPATECH].ThreadInit = NoNapatechSupportExit; tmm_modules[TMM_RECEIVENAPATECH].Func = NULL; tmm_modules[TMM_RECEIVENAPATECH].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVENAPATECH].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVENAPATECH].RegisterTests = NULL; tmm_modules[TMM_RECEIVENAPATECH].cap_flags = SC_CAP_NET_ADMIN; } void TmModuleNapatechDecodeRegister (void) { tmm_modules[TMM_DECODENAPATECH].name = "NapatechDecode"; tmm_modules[TMM_DECODENAPATECH].ThreadInit = NoNapatechSupportExit; tmm_modules[TMM_DECODENAPATECH].Func = NULL; tmm_modules[TMM_DECODENAPATECH].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENAPATECH].ThreadDeinit = NULL; tmm_modules[TMM_DECODENAPATECH].RegisterTests = NULL; tmm_modules[TMM_DECODENAPATECH].cap_flags = 0; tmm_modules[TMM_DECODENAPATECH].flags = TM_FLAG_DECODE_TM; } TmEcode NoNapatechSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NAPATECH_NOSUPPORT, "Error creating thread %s: you do not have support for Napatech adapter " "enabled please recompile with --enable-napatech", tv->name); exit(EXIT_FAILURE); } #else /* Implied we do have NAPATECH support */ #include "source-napatech.h" #include extern int max_pending_packets; typedef struct NapatechThreadVars_ { ThreadVars *tv; NtNetStreamRx_t rx_stream; uint64_t stream_id; int hba; uint64_t pkts; uint64_t drops; uint64_t bytes; TmSlot *slot; } NapatechThreadVars; TmEcode NapatechStreamThreadInit(ThreadVars *, void *, void **); void NapatechStreamThreadExitStats(ThreadVars *, void *); TmEcode NapatechStreamLoop(ThreadVars *tv, void *data, void *slot); TmEcode NapatechDecodeThreadInit(ThreadVars *, void *, void **); TmEcode NapatechDecodeThreadDeinit(ThreadVars *tv, void *data); TmEcode NapatechDecode(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); /** * \brief Register the Napatech receiver (reader) module. */ void TmModuleNapatechStreamRegister(void) { tmm_modules[TMM_RECEIVENAPATECH].name = "NapatechStream"; tmm_modules[TMM_RECEIVENAPATECH].ThreadInit = NapatechStreamThreadInit; tmm_modules[TMM_RECEIVENAPATECH].Func = NULL; tmm_modules[TMM_RECEIVENAPATECH].PktAcqLoop = NapatechStreamLoop; tmm_modules[TMM_RECEIVENAPATECH].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVENAPATECH].ThreadExitPrintStats = NapatechStreamThreadExitStats; tmm_modules[TMM_RECEIVENAPATECH].ThreadDeinit = NapatechStreamThreadDeinit; tmm_modules[TMM_RECEIVENAPATECH].RegisterTests = NULL; tmm_modules[TMM_RECEIVENAPATECH].cap_flags = SC_CAP_NET_RAW; tmm_modules[TMM_RECEIVENAPATECH].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Register the Napatech decoder module. */ void TmModuleNapatechDecodeRegister(void) { tmm_modules[TMM_DECODENAPATECH].name = "NapatechDecode"; tmm_modules[TMM_DECODENAPATECH].ThreadInit = NapatechDecodeThreadInit; tmm_modules[TMM_DECODENAPATECH].Func = NapatechDecode; tmm_modules[TMM_DECODENAPATECH].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENAPATECH].ThreadDeinit = NapatechDecodeThreadDeinit; tmm_modules[TMM_DECODENAPATECH].RegisterTests = NULL; tmm_modules[TMM_DECODENAPATECH].cap_flags = 0; tmm_modules[TMM_DECODENAPATECH].flags = TM_FLAG_DECODE_TM; } /** * \brief Initialize the Napatech receiver thread, generate a single * NapatechThreadVar structure for each thread, this will * contain a NtNetStreamRx_t stream handle which is used when the * thread executes to acquire the packets. * * \param tv Thread variable to ThreadVars * \param initdata Initial data to the adapter passed from the user, * this is processed by the user. * * For now, we assume that we have only a single name for the NAPATECH * adapter. * * \param data data pointer gets populated with * */ TmEcode NapatechStreamThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); struct NapatechStreamDevConf *conf = (struct NapatechStreamDevConf *)initdata; uintmax_t stream_id = conf->stream_id; *data = NULL; SCLogInfo("Napatech Thread Stream ID:%lu", stream_id); NapatechThreadVars *ntv = SCMalloc(sizeof(NapatechThreadVars)); if (unlikely(ntv == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for NAPATECH thread vars."); exit(EXIT_FAILURE); } memset(ntv, 0, sizeof (NapatechThreadVars)); ntv->stream_id = stream_id; ntv->tv = tv; ntv->hba = conf->hba; SCLogInfo("Started processing packets from NAPATECH Stream: %lu", ntv->stream_id); *data = (void *)ntv; SCReturnInt(TM_ECODE_OK); } /** * \brief Main Napatech reading Loop function */ TmEcode NapatechStreamLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); int32_t status; char errbuf[100]; uint64_t pkt_ts; NtNetBuf_t packet_buffer; NapatechThreadVars *ntv = (NapatechThreadVars *)data; NtNetRx_t stat_cmd; SCLogInfo("Opening NAPATECH Stream: %lu for processing", ntv->stream_id); if ((status = NT_NetRxOpen(&(ntv->rx_stream), "SuricataStream", NT_NET_INTERFACE_PACKET, ntv->stream_id, ntv->hba)) != NT_SUCCESS) { NT_ExplainError(status, errbuf, sizeof(errbuf)); SCLogError(SC_ERR_NAPATECH_OPEN_FAILED, "Failed to open NAPATECH Stream: %lu - %s", ntv->stream_id, errbuf); SCFree(ntv); SCReturnInt(TM_ECODE_FAILED); } stat_cmd.cmd = NT_NETRX_READ_CMD_STREAM_DROP; SCLogInfo("Napatech Packet Stream Loop Started for Stream ID: %lu", ntv->stream_id); TmSlot *s = (TmSlot *)slot; ntv->slot = s->slot_next; while (!(suricata_ctl_flags & SURICATA_STOP)) { /* make sure we have at least one packet in the packet pool, to prevent * us from alloc'ing packets at line rate */ PacketPoolWait(); /* * Napatech returns packets 1 at a time */ status = NT_NetRxGet(ntv->rx_stream, &packet_buffer, 1000); if (unlikely(status == NT_STATUS_TIMEOUT || status == NT_STATUS_TRYAGAIN)) { /* * no frames currently available */ continue; } else if (unlikely(status != NT_SUCCESS)) { SCLogError(SC_ERR_NAPATECH_STREAM_NEXT_FAILED, "Failed to read from Napatech Stream: %lu", ntv->stream_id); SCReturnInt(TM_ECODE_FAILED); } Packet *p = PacketGetFromQueueOrAlloc(); if (unlikely(p == NULL)) { NT_NetRxRelease(ntv->rx_stream, packet_buffer); SCReturnInt(TM_ECODE_FAILED); } pkt_ts = NT_NET_GET_PKT_TIMESTAMP(packet_buffer); /* * Handle the different timestamp forms that the napatech cards could use * - NT_TIMESTAMP_TYPE_NATIVE is not supported due to having an base of 0 as opposed to NATIVE_UNIX which has a base of 1/1/1970 */ switch(NT_NET_GET_PKT_TIMESTAMP_TYPE(packet_buffer)) { case NT_TIMESTAMP_TYPE_NATIVE_UNIX: p->ts.tv_sec = pkt_ts / 100000000; p->ts.tv_usec = ((pkt_ts % 100000000) / 100) + (pkt_ts % 100) > 50 ? 1 : 0; break; case NT_TIMESTAMP_TYPE_PCAP: p->ts.tv_sec = pkt_ts >> 32; p->ts.tv_usec = pkt_ts & 0xFFFFFFFF; break; case NT_TIMESTAMP_TYPE_PCAP_NANOTIME: p->ts.tv_sec = pkt_ts >> 32; p->ts.tv_usec = ((pkt_ts & 0xFFFFFFFF) / 1000) + (pkt_ts % 1000) > 500 ? 1 : 0; break; case NT_TIMESTAMP_TYPE_NATIVE_NDIS: /* number of seconds between 1/1/1601 and 1/1/1970 */ p->ts.tv_sec = (pkt_ts / 100000000) - 11644473600; p->ts.tv_usec = ((pkt_ts % 100000000) / 100) + (pkt_ts % 100) > 50 ? 1 : 0; break; default: SCLogError(SC_ERR_NAPATECH_TIMESTAMP_TYPE_NOT_SUPPORTED, "Packet from Napatech Stream: %lu does not have a supported timestamp format", ntv->stream_id); NT_NetRxRelease(ntv->rx_stream, packet_buffer); SCReturnInt(TM_ECODE_FAILED); } SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec); p->datalink = LINKTYPE_ETHERNET; ntv->pkts++; ntv->bytes += NT_NET_GET_PKT_WIRE_LENGTH(packet_buffer); // Update drop counter if (unlikely((status = NT_NetRxRead(ntv->rx_stream, &stat_cmd)) != NT_SUCCESS)) { NT_ExplainError(status, errbuf, sizeof(errbuf)); SCLogWarning(SC_ERR_NAPATECH_STAT_DROPS_FAILED, "Couldn't retrieve drop statistics from the RX stream: %lu - %s", ntv->stream_id, errbuf); } else { ntv->drops += stat_cmd.u.streamDrop.pktsDropped; } if (unlikely(PacketCopyData(p, (uint8_t *)NT_NET_GET_PKT_L2_PTR(packet_buffer), NT_NET_GET_PKT_WIRE_LENGTH(packet_buffer)))) { TmqhOutputPacketpool(ntv->tv, p); NT_NetRxRelease(ntv->rx_stream, packet_buffer); SCReturnInt(TM_ECODE_FAILED); } if (unlikely(TmThreadsSlotProcessPkt(ntv->tv, ntv->slot, p) != TM_ECODE_OK)) { TmqhOutputPacketpool(ntv->tv, p); NT_NetRxRelease(ntv->rx_stream, packet_buffer); SCReturnInt(TM_ECODE_FAILED); } NT_NetRxRelease(ntv->rx_stream, packet_buffer); StatsSyncCountersIfSignalled(tv); } SCReturnInt(TM_ECODE_OK); } /** * \brief Print some stats to the log at program exit. * * \param tv Pointer to ThreadVars. * \param data Pointer to data, ErfFileThreadVars. */ void NapatechStreamThreadExitStats(ThreadVars *tv, void *data) { NapatechThreadVars *ntv = (NapatechThreadVars *)data; double percent = 0; if (ntv->drops > 0) percent = (((double) ntv->drops) / (ntv->pkts+ntv->drops)) * 100; SCLogNotice("Stream: %lu; Packets: %"PRIu64"; Drops: %"PRIu64" (%5.2f%%); Bytes: %"PRIu64, ntv->stream_id, ntv->pkts, ntv->drops, percent, ntv->bytes); } /** * \brief Deinitializes the NAPATECH card. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PcapThreadVars for ptv */ TmEcode NapatechStreamThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); NapatechThreadVars *ntv = (NapatechThreadVars *)data; SCLogDebug("Closing Napatech Stream: %d", ntv->stream_id); NT_NetRxClose(ntv->rx_stream); SCReturnInt(TM_ECODE_OK); } /** Decode Napatech */ /** * \brief This function passes off to link type decoders. * * NapatechDecode reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param t pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into PcapThreadVars for ptv * \param pq pointer to the current PacketQueue */ TmEcode NapatechDecode(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); switch (p->datalink) { case LINKTYPE_ETHERNET: DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; default: SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module NapatechDecode", p->datalink); break; } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } TmEcode NapatechDecodeThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if(dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode NapatechDecodeThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* HAVE_NAPATECH */ suricata-3.2.1/src/output-json-file.h0000644000000000000000000000162013051004444014375 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_FILE_H__ #define __OUTPUT_JSON_FILE_H__ void JsonFileLogRegister(void); #endif /* __OUTPUT_JSON_FILE_H__ */ suricata-3.2.1/src/util-binsearch.h0000644000000000000000000000203413051004444014062 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_BINSEARCH_H__ #define __UTIL_BINSEARCH_H__ void BinSearchInit (void); uint8_t *BinSearch(const uint8_t *, size_t, const uint8_t *, size_t); uint8_t *BinSearchNocase(const uint8_t *, size_t, const uint8_t *, size_t); #endif /* __UTIL_BINSEARCH_H__ */ suricata-3.2.1/src/detect-icmp-id.c0000644000000000000000000003542413051004444013745 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias Galvan * * Implements the icmp_id keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-icmp-id.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #define PARSE_REGEX "^\\s*(\"\\s*)?([0-9]+)(\\s*\")?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIcmpIdMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIcmpIdSetup(DetectEngineCtx *, Signature *, char *); void DetectIcmpIdRegisterTests(void); void DetectIcmpIdFree(void *); static int PrefilterSetupIcmpId(SigGroupHead *sgh); static _Bool PrefilterIcmpIdIsPrefilterable(const Signature *s); /** * \brief Registration function for icode: icmp_id */ void DetectIcmpIdRegister (void) { sigmatch_table[DETECT_ICMP_ID].name = "icmp_id"; sigmatch_table[DETECT_ICMP_ID].desc = "check for a ICMP id"; sigmatch_table[DETECT_ICMP_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-id"; sigmatch_table[DETECT_ICMP_ID].Match = DetectIcmpIdMatch; sigmatch_table[DETECT_ICMP_ID].Setup = DetectIcmpIdSetup; sigmatch_table[DETECT_ICMP_ID].Free = DetectIcmpIdFree; sigmatch_table[DETECT_ICMP_ID].RegisterTests = DetectIcmpIdRegisterTests; sigmatch_table[DETECT_ICMP_ID].SupportsPrefilter = PrefilterIcmpIdIsPrefilterable; sigmatch_table[DETECT_ICMP_ID].SetupPrefilter = PrefilterSetupIcmpId; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline _Bool GetIcmpId(Packet *p, uint16_t *id) { if (PKT_IS_PSEUDOPKT(p)) return FALSE; uint16_t pid; if (PKT_IS_ICMPV4(p)) { switch (ICMPV4_GET_TYPE(p)){ case ICMP_ECHOREPLY: case ICMP_ECHO: case ICMP_TIMESTAMP: case ICMP_TIMESTAMPREPLY: case ICMP_INFO_REQUEST: case ICMP_INFO_REPLY: case ICMP_ADDRESS: case ICMP_ADDRESSREPLY: SCLogDebug("ICMPV4_GET_ID(p) %"PRIu16" (network byte order), " "%"PRIu16" (host byte order)", ICMPV4_GET_ID(p), ntohs(ICMPV4_GET_ID(p))); pid = ICMPV4_GET_ID(p); break; default: SCLogDebug("Packet has no id field"); return FALSE; } } else if (PKT_IS_ICMPV6(p)) { switch (ICMPV6_GET_TYPE(p)) { case ICMP6_ECHO_REQUEST: case ICMP6_ECHO_REPLY: SCLogDebug("ICMPV6_GET_ID(p) %"PRIu16" (network byte order), " "%"PRIu16" (host byte order)", ICMPV6_GET_ID(p), ntohs(ICMPV6_GET_ID(p))); pid = ICMPV6_GET_ID(p); break; default: SCLogDebug("Packet has no id field"); return FALSE; } } else { SCLogDebug("Packet not ICMPV4 nor ICMPV6"); return FALSE; } *id = pid; return TRUE; } /** * \brief This function is used to match icmp_id rule option set on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectIcmpIdData * * \retval 0 no match * \retval 1 match */ int DetectIcmpIdMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { uint16_t pid; if (GetIcmpId(p, &pid) == FALSE) return 0; const DetectIcmpIdData *iid = (const DetectIcmpIdData *)ctx; if (pid == iid->id) return 1; return 0; } /** * \brief This function is used to parse icmp_id option passed via icmp_id: keyword * * \param icmpidstr Pointer to the user provided icmp_id options * * \retval iid pointer to DetectIcmpIdData on success * \retval NULL on failure */ DetectIcmpIdData *DetectIcmpIdParse (char *icmpidstr) { DetectIcmpIdData *iid = NULL; char *substr[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, icmpidstr, strlen(icmpidstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "Parse error %s", icmpidstr); goto error; } int i; const char *str_ptr; for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)icmpidstr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } substr[i-1] = (char *)str_ptr; } iid = SCMalloc(sizeof(DetectIcmpIdData)); if (unlikely(iid == NULL)) goto error; iid->id = 0; if (substr[0]!= NULL && strlen(substr[0]) != 0) { if (substr[2] == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing close quote in input"); goto error; } } else { if (substr[2] != NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing open quote in input"); goto error; } } /** \todo can ByteExtractStringUint16 do this? */ uint16_t id = 0; if (ByteExtractStringUint16(&id, 10, 0, substr[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp id %s is not " "valid", substr[1]); goto error; } iid->id = htons(id); for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } return iid; error: for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } if (iid != NULL) DetectIcmpIdFree(iid); return NULL; } /** * \brief this function is used to add the parsed icmp_id data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param icmpidstr pointer to the user provided icmp_id option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectIcmpIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpidstr) { DetectIcmpIdData *iid = NULL; SigMatch *sm = NULL; iid = DetectIcmpIdParse(icmpidstr); if (iid == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ICMP_ID; sm->ctx = (SigMatchCtx *)iid; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (iid != NULL) DetectIcmpIdFree(iid); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectIcmpIdData * * \param ptr pointer to DetectIcmpIdData */ void DetectIcmpIdFree (void *ptr) { DetectIcmpIdData *iid = (DetectIcmpIdData *)ptr; SCFree(iid); } /* prefilter code */ static void PrefilterPacketIcmpIdMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; uint16_t pid; if (GetIcmpId(p, &pid) == FALSE) return; if (pid == ctx->v1.u16[0]) { SCLogDebug("packet matches ICMP ID %u", ctx->v1.u16[0]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketIcmpIdSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectIcmpIdData *a = smctx; v->u16[0] = a->id; } static _Bool PrefilterPacketIcmpIdCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectIcmpIdData *a = smctx; if (v.u16[0] == a->id) return TRUE; return FALSE; } static int PrefilterSetupIcmpId(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_ICMP_ID, PrefilterPacketIcmpIdSet, PrefilterPacketIcmpIdCompare, PrefilterPacketIcmpIdMatch); } static _Bool PrefilterIcmpIdIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ICMP_ID: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \test DetectIcmpIdParseTest01 is a test for setting a valid icmp_id value */ int DetectIcmpIdParseTest01 (void) { DetectIcmpIdData *iid = NULL; iid = DetectIcmpIdParse("300"); if (iid != NULL && iid->id == htons(300)) { DetectIcmpIdFree(iid); return 1; } return 0; } /** * \test DetectIcmpIdParseTest02 is a test for setting a valid icmp_id value * with spaces all around */ int DetectIcmpIdParseTest02 (void) { DetectIcmpIdData *iid = NULL; iid = DetectIcmpIdParse(" 300 "); if (iid != NULL && iid->id == htons(300)) { DetectIcmpIdFree(iid); return 1; } return 0; } /** * \test DetectIcmpIdParseTest03 is a test for setting a valid icmp_id value * with quotation marks */ int DetectIcmpIdParseTest03 (void) { DetectIcmpIdData *iid = NULL; iid = DetectIcmpIdParse("\"300\""); if (iid != NULL && iid->id == htons(300)) { DetectIcmpIdFree(iid); return 1; } return 0; } /** * \test DetectIcmpIdParseTest04 is a test for setting a valid icmp_id value * with quotation marks and spaces all around */ int DetectIcmpIdParseTest04 (void) { DetectIcmpIdData *iid = NULL; iid = DetectIcmpIdParse(" \" 300 \""); if (iid != NULL && iid->id == htons(300)) { DetectIcmpIdFree(iid); return 1; } return 0; } /** * \test DetectIcmpIdParseTest05 is a test for setting an invalid icmp_id * value with missing quotation marks */ int DetectIcmpIdParseTest05 (void) { DetectIcmpIdData *iid = NULL; iid = DetectIcmpIdParse("\"300"); if (iid == NULL) { DetectIcmpIdFree(iid); return 1; } return 0; } /** * \test DetectIcmpIdMatchTest01 is a test for checking the working of * icmp_id keyword by creating 2 rules and matching a crafted packet * against them. Only the first one shall trigger. */ int DetectIcmpIdMatchTest01 (void) { int result = 0; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(ThreadVars)); p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP); p->icmpv4vars.id = htons(21781); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any (icmp_id:21781; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert icmp any any -> any any (icmp_id:21782; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } /** * \test DetectIcmpIdMatchTest02 is a test for checking the working of * icmp_id keyword by creating 1 rule and matching a crafted packet * against them. The packet is an ICMP packet with no "id" field, * therefore the rule should not trigger. */ int DetectIcmpIdMatchTest02 (void) { int result = 0; uint8_t raw_icmpv4[] = { 0x0b, 0x00, 0x8a, 0xdf, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x14, 0x25, 0x0c, 0x00, 0x00, 0xff, 0x11, 0x00, 0x00, 0x85, 0x64, 0xea, 0x5b, 0x51, 0xa6, 0xbb, 0x35, 0x59, 0x8a, 0x5a, 0xe2, 0x00, 0x14, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature *s = NULL; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(ThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.addr_data32[0] = 0x01020304; p->dst.addr_data32[0] = 0x04030201; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&th_v, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any (icmp_id:0; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FlowShutdown(); end: SCFree(p); return result; } #endif /* UNITTESTS */ void DetectIcmpIdRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("DetectIcmpIdParseTest01", DetectIcmpIdParseTest01); UtRegisterTest("DetectIcmpIdParseTest02", DetectIcmpIdParseTest02); UtRegisterTest("DetectIcmpIdParseTest03", DetectIcmpIdParseTest03); UtRegisterTest("DetectIcmpIdParseTest04", DetectIcmpIdParseTest04); UtRegisterTest("DetectIcmpIdParseTest05", DetectIcmpIdParseTest05); UtRegisterTest("DetectIcmpIdMatchTest01", DetectIcmpIdMatchTest01); UtRegisterTest("DetectIcmpIdMatchTest02", DetectIcmpIdMatchTest02); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-buffer.h0000644000000000000000000001610413051004444013400 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_BUFFER_H__ #define __UTIL_BUFFER_H__ typedef struct MemBuffer_ { uint8_t *buffer; uint32_t size; uint32_t offset; } MemBuffer; MemBuffer *MemBufferCreateNew(uint32_t size); int MemBufferExpand(MemBuffer **buffer, uint32_t expand_by); void MemBufferFree(MemBuffer *buffer); /** * \brief Reset the mem buffer. * * \param mem_buffer Pointer to the mem buffer instance. */ #define MemBufferReset(mem_buffer) do { \ (mem_buffer)->buffer[0] = 0; \ (mem_buffer)->offset = 0; \ } while (0) /** * \brief Get the MemBuffers underlying buffer. */ #define MEMBUFFER_BUFFER(mem_buffer) (mem_buffer)->buffer /** * \brief Get the MemBuffers current offset. */ #define MEMBUFFER_OFFSET(mem_buffer) (mem_buffer)->offset /** * \brief Get the MemBuffers current size. */ #define MEMBUFFER_SIZE(mem_buffer) (mem_buffer)->size /** * \brief Write a buffer to the file pointer. * * Accepted buffers can contain both printable and non-printable * characters. Printable characters are written in the printable * format and the non-printable chars are written in hex codes * using the |XX| format. * * For example this would be the kind of output in the file - * onetwo|EF|three|ED|five * * \param buffer Pointer to the src MemBuffer instance to write. * \param fp Pointer to the file file instance to write to. */ #define MemBufferPrintToFP(buffer, fp) do { \ uint32_t i; \ \ for (i = 0; i < (buffer)->offset; i++) { \ if (isprint(buffer->buffer[i])) \ fprintf(fp, "%c", (buffer)->buffer[i]); \ else \ fprintf(fp, "|%02X|", (buffer)->buffer[i]); \ } \ } while (0) /** * \brief Write a buffer to the file pointer as a printable char string. * * \param buffer Pointer to the src MemBuffer instance to write. * \param fp Pointer to the file file instance to write to. */ #define MemBufferPrintToFPAsString(mem_buffer, fp) ({ \ fwrite((mem_buffer)->buffer, sizeof(uint8_t), (mem_buffer)->offset, fp); \ }) /** * \brief Write a buffer in hex format. * * \param buffer Pointer to the src MemBuffer instance to write. * \param fp Pointer to the file file instance to write to. */ #define MemBufferPrintToFPAsHex(buffer, fp) do { \ uint32_t i; \ \ for (i = 0; i < (buffer)->offset; i++) { \ if (((buffer)->offset % 8) == 0) \ fprintf(fp, "\n"); \ fprintf(fp, " %02X", (buffer)->buffer[i]); \ } \ } while (0) /** * \brief Write a raw buffer to the MemBuffer dst. * * When we say raw buffer it indicates a buffer that need not be * purely a string buffer. It can be a pure string buffer or not or * a mixture of both. Hence we don't accept any format strings. * * If the remaining space on the buffer is lesser than the length of * the buffer to write, it is truncated to fit into the empty space. * * Also after every write a '\0' is appended. This would indicate * that the total available space to write in the buffer is * MemBuffer->size - 1 and not Membuffer->size. The reason we * append the '\0' is for supporting writing pure string buffers * as well, that can later be used by other string handling funcs. * * \param raw_buffer The buffer to write. * \param raw_buffer_len Length of the above buffer. */ #define MemBufferWriteRaw(dst, raw_buffer, raw_buffer_len) do { \ uint32_t write_len; \ \ if (((raw_buffer_len) >= (dst)->size - (dst)->offset)) { \ SCLogDebug("Truncating data write since it exceeded buffer limit of " \ "- %"PRIu32, (dst)->size); \ write_len = ((dst)->size - (dst)->offset) - 1; \ } else { \ write_len = (raw_buffer_len); \ } \ \ memcpy((dst)->buffer + (dst)->offset, (raw_buffer), write_len); \ (dst)->offset += write_len; \ dst->buffer[dst->offset] = '\0'; \ } while (0) /** * \brief Write a string buffer to the Membuffer dst. * * This function takes a format string and arguments for the format * string like sprintf. * * An example usage of this is - * MemBufferWriteString(mem_buffer_instance, \"%d - %s\", 10, \"one\"); * * \param dst The dst MemBuffer instance. * \param format The format string. * \param ... Variable arguments. */ #define MemBufferWriteString(dst, ...) do { \ int cw = snprintf((char *)(dst)->buffer + (dst)->offset, \ (dst)->size - (dst)->offset, \ __VA_ARGS__); \ if (cw >= 0) { \ if ( ((dst)->offset + cw) >= (dst)->size) { \ SCLogDebug("Truncating data write since it exceeded buffer " \ "limit of - %"PRIu32"\n", (dst)->size); \ (dst)->offset = (dst)->size - 1; \ } else { \ (dst->offset) += cw; \ } \ } \ } while (0) #endif /* __UTIL_BUFFER_H__ */ suricata-3.2.1/src/detect-uricontent.c0000644000000000000000000016003313051004444014610 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh * * Simple uricontent match part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-content.h" #include "detect-http-uri.h" #include "detect-uricontent.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "flow.h" #include "detect-flow.h" #include "flow-var.h" #include "flow-util.h" #include "threads.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "util-mpm.h" #include "util-print.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-binsearch.h" #include "util-spm.h" #include "conf.h" /* prototypes */ static int DetectUricontentSetup (DetectEngineCtx *, Signature *, char *); void HttpUriRegisterTests(void); int DetectAppLayerUricontentMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t , void *, Signature *, SigMatch *); void DetectUricontentFree(void *); /** * \brief Registration function for uricontent: keyword */ void DetectUricontentRegister (void) { sigmatch_table[DETECT_URICONTENT].name = "uricontent"; sigmatch_table[DETECT_URICONTENT].AppLayerMatch = NULL; sigmatch_table[DETECT_URICONTENT].Match = NULL; sigmatch_table[DETECT_URICONTENT].Setup = DetectUricontentSetup; sigmatch_table[DETECT_URICONTENT].Free = DetectUricontentFree; sigmatch_table[DETECT_URICONTENT].RegisterTests = HttpUriRegisterTests; sigmatch_table[DETECT_URICONTENT].flags |= SIGMATCH_PAYLOAD; } /** * \brief this function will Free memory associated with DetectContentData * * \param cd pointer to DetectUricotentData */ void DetectUricontentFree(void *ptr) { SCEnter(); DetectContentData *cd = (DetectContentData *)ptr; if (cd == NULL) SCReturn; SpmDestroyCtx(cd->spm_ctx); SCFree(cd); SCReturn; } /** * \brief Helper function to print a DetectContentData */ void DetectUricontentPrint(DetectContentData *cd) { int i = 0; if (cd == NULL) { SCLogDebug("Detect UricontentData \"cd\" is NULL"); return; } char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1); if (unlikely(tmpstr == NULL)) return; if (tmpstr != NULL) { for (i = 0; i < cd->content_len; i++) { if (isprint(cd->content[i])) tmpstr[i] = cd->content[i]; else tmpstr[i] = '.'; } tmpstr[i] = '\0'; SCLogDebug("Uricontent: \"%s\"", tmpstr); SCFree(tmpstr); } else { SCLogDebug("Uricontent: "); for (i = 0; i < cd->content_len; i++) SCLogDebug("%c", cd->content[i]); } SCLogDebug("Uricontent_id: %"PRIu32, cd->id); SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len); SCLogDebug("Depth: %"PRIu16, cd->depth); SCLogDebug("Offset: %"PRIu16, cd->offset); SCLogDebug("Within: %"PRIi32, cd->within); SCLogDebug("Distance: %"PRIi32, cd->distance); SCLogDebug("flags: %u ", cd->flags); SCLogDebug("negated: %s ", cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); SCLogDebug("relative match next: %s ", cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false"); SCLogDebug("-----------"); } /** * \brief Creates a SigMatch for the uricontent keyword being sent as argument, * and appends it to the Signature(s). * * \param de_ctx Pointer to the detection engine context * \param s Pointer to signature for the current Signature being parsed * from the rules * \param contentstr Pointer to the string holding the keyword value * * \retval 0 on success, -1 on failure */ int DetectUricontentSetup(DetectEngineCtx *de_ctx, Signature *s, char *contentstr) { SCEnter(); char *legacy = NULL; if (ConfGet("legacy.uricontent", &legacy) == 1) { if (strcasecmp("disabled", legacy) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "uriconent deprecated. To " "use a rule with \"uricontent\", either set the " "option - \"legacy.uricontent\" in the conf to " "\"enabled\" OR replace uricontent with " "\'content:%s; http_uri;\'.", contentstr); goto error; } else if (strcasecmp("enabled", legacy) == 0) { ; } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid value found " "for legacy.uriconent - \"%s\". Valid values are " "\"enabled\" OR \"disabled\".", legacy); goto error; } } if (DetectContentSetup(de_ctx, s, contentstr) < 0) goto error; if (DetectHttpUriSetup(de_ctx, s, NULL) < 0) goto error; SCReturnInt(0); error: SCReturnInt(-1); } /* * UNITTTESTS */ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** \test Test case where path traversal has been sent as a path string in the * HTTP URL and normalized path string is checked */ static int HTTPUriTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "GET /../../images.gif HTTP/1.1\r\nHost: www.ExA" "mPlE.cOM\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("AppLayerParse failed: r(%d) != 0: ", r); goto end; } HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); if (tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { goto end; } if ((tx->request_hostname == NULL) || (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0)) { goto end; } if ((tx->parsed_uri->path == NULL) || (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); return result; } /** \test Test case where path traversal has been sent in special characters in * HEX encoding in the HTTP URL and normalized path string is checked */ static int HTTPUriTest02(void) { int result = 0; Flow f; HtpState *htp_state = NULL; uint8_t httpbuf1[] = "GET /%2e%2e/images.gif HTTP/1.1\r\nHost: www.ExA" "mPlE.cOM\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("AppLayerParse failed: r(%d) != 0: ", r); goto end; } htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); if (tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { goto end; } if ((tx->request_hostname == NULL) || (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0)) { goto end; } if ((tx->parsed_uri->path == NULL) || (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); return result; } /** \test Test case where NULL character has been sent in HEX encoding in the * HTTP URL and normalized path string is checked */ static int HTTPUriTest03(void) { int result = 0; Flow f; HtpState *htp_state = NULL; uint8_t httpbuf1[] = "GET%00 /images.gif HTTP/1.1\r\nHost: www.ExA" "mPlE.cOM\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("AppLayerParse failed: r(%d) != 0: ", r); goto end; } htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); if (tx->request_method_number != HTP_M_UNKNOWN || tx->request_protocol_number != HTP_PROTOCOL_1_1) { goto end; } if ((tx->request_hostname == NULL) || (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0)) { goto end; } if ((tx->parsed_uri->path == NULL) || (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); return result; } /** \test Test case where self referencing directories request has been sent * in the HTTP URL and normalized path string is checked */ static int HTTPUriTest04(void) { int result = 0; Flow f; HtpState *htp_state = NULL; uint8_t httpbuf1[] = "GET /./././images.gif HTTP/1.1\r\nHost: www.ExA" "mPlE.cOM\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("AppLayerParse failed: r(%d) != 0: ", r); goto end; } htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, 0); if (tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { goto end; } if ((tx->request_hostname == NULL) || (bstr_cmp_c(tx->request_hostname, "www.example.com") != 0)) { goto end; } if ((tx->parsed_uri->path == NULL) || (bstr_cmp_c(tx->parsed_uri->path, "/images.gif") != 0)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); FLOWLOCK_UNLOCK(&f); FLOW_DESTROY(&f); return result; } /** * \test Checks if a uricontent is registered in a Signature */ int DetectUriSigTest01(void) { SigMatch *sm = NULL; int result = 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *s = NULL; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\" Test uricontent\"; " "content:\"me\"; uricontent:\"me\"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); BUG_ON(de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL); sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type == DETECT_CONTENT) { result = 1; } else { result = 0; } end: if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check the signature working to alert when http_cookie is matched . */ static int DetectUriSigTest02(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"foo\"; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"oisf\"; sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig: 1 alerted, but it should not\n"); goto end; } else if (!PacketAlertCheck(p, 2)) { printf("sig: 2 did not alerted, but it should\n"); goto end; } else if ((PacketAlertCheck(p, 3))) { printf("sig: 3 alerted, but it should not\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); //if (http_state != NULL) HTPStateFree(http_state); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check the working of search once per packet only in applayer * match */ static int DetectUriSigTest03(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t httpbuf1[] = "POST /one HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "POST /oneself HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"foo\"; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"self\"; sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted, but it should not: "); goto end; } else if (!PacketAlertCheck(p, 2)) { printf("sig 2 did not alert, but it should: "); goto end; } else if ((PacketAlertCheck(p, 3))) { printf("sig 3 alerted, but it should not: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sig 1 alerted, but it should not (chunk 2): "); goto end; } else if (!PacketAlertCheck(p, 2)) { printf("sig 2 alerted, but it should not (chunk 2): "); goto end; } else if (!(PacketAlertCheck(p, 3))) { printf("sig 3 did not alert, but it should (chunk 2): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Check that modifiers of content apply only to content keywords * and the same for uricontent modifiers */ static int DetectUriSigTest04(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"foo\"; sid:1;)"); if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 1 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";sid:1;)"); if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 2 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; sid:1;)"); if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 3 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "content:\"foo\"; uricontent:\"bar\";" " depth:10; offset: 5; sid:1;)"); if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 4 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; within:3; sid:1;)"); if (s != NULL) { printf("sig 5 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; distance:3; sid:1;)"); if (s != NULL) { printf("sig 6 failed to parse: "); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; content:" "\"two_contents\"; within:30; sid:1;)"); if (s == NULL) { goto end; } else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 7 failed to parse: "); DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; uricontent:" "\"two_uricontents\"; within:30; sid:1;)"); if (s == NULL) { goto end; } else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 8 failed to parse: "); DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; content:" "\"two_contents\"; distance:30; sid:1;)"); if (s == NULL) { goto end; } else if ( s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 9 failed to parse: "); DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; uricontent:" "\"two_uricontents\"; distance:30; sid:1;)"); if (s == NULL) { goto end; } else if ( s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse: "); DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } s = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; uricontent:" "\"two_uricontents\"; distance:30; " "within:60; content:\"two_contents\";" " within:70; distance:45; sid:1;)"); if (s == NULL) { printf("sig 10 failed to parse: "); goto end; } if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("umatch %p or pmatch %p: ", s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_PMATCH]); goto end; } if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse, content not setup properly: "); DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx); DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check the modifiers for uricontent and content * match */ static int DetectUriSigTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Flow f; HtpState *http_state = NULL; uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); p->tcph->th_seq = htonl(1000); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; f.proto = p->proto; StreamTcpInitConfig(TRUE); StreamMsg *stream_msg = StreamMsgGetFromPool(); if (stream_msg == NULL) { printf("no stream_msg: "); goto end; } memcpy(stream_msg->data, httpbuf1, httplen1); stream_msg->data_len = httplen1; ssn.toserver_smsg_head = stream_msg; ssn.toserver_smsg_tail = stream_msg; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; uricontent:\"foo\"; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; uricontent:\"one\"; content:\"two\"; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; uricontent:\"one\"; offset:1; depth:10; " "uricontent:\"two\"; distance:1; within: 4; uricontent:\"three\"; " "distance:1; within: 6; sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } if ((PacketAlertCheck(p, 1))) { printf("sig: 1 alerted, but it should not: "); goto end; } else if (! PacketAlertCheck(p, 2)) { printf("sig: 2 did not alert, but it should: "); goto end; } else if (! (PacketAlertCheck(p, 3))) { printf("sig: 3 did not alert, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check the modifiers for uricontent and content * match */ static int DetectUriSigTest06(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Flow f; HtpState *http_state = NULL; uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; TCPHdr tcp_hdr; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); memset(&tcp_hdr, 0, sizeof(tcp_hdr)); p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); p->tcph->th_seq = htonl(1000); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; f.proto = p->proto; StreamTcpInitConfig(TRUE); StreamMsg *stream_msg = StreamMsgGetFromPool(); if (stream_msg == NULL) { printf("no stream_msg: "); goto end; } memcpy(stream_msg->data, httpbuf1, httplen1); stream_msg->data_len = httplen1; ssn.toserver_smsg_head = stream_msg; ssn.toserver_smsg_tail = stream_msg; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"foo\"; content:\"bar\"; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; offset:1; depth:10; " "content:\"one\"; offset:1; depth:10; " "uricontent:\"two\"; distance:1; within: 4; " "content:\"two\"; distance:1; within: 4; " "uricontent:\"three\"; distance:1; within: 6; " "content:\"/three\"; distance:0; within: 7; " "sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; offset:1; depth:10; " "uricontent:\"two\"; distance:1; within: 4; " "uricontent:\"three\"; distance:1; within: 6; " "sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } if ((PacketAlertCheck(p, 1))) { printf("sig: 1 alerted, but it should not:"); goto end; } else if (! PacketAlertCheck(p, 2)) { printf("sig: 2 did not alert, but it should:"); goto end; } else if (! (PacketAlertCheck(p, 3))) { printf("sig: 3 did not alert, but it should:"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check the modifiers for uricontent and content * match */ static int DetectUriSigTest07(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t httpbuf1[] = "POST /one/two/three HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\nCookie:" " hellocatch\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(httpbuf1, httplen1, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"foo\"; content:\"bar\"; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; offset:1; depth:10; " "content:\"one\"; offset:1; depth:10; " "uricontent:\"two\"; distance:3; within: 4; " "content:\"two\"; distance:1; within: 4; " "uricontent:\"three\"; distance:1; within: 6; " "content:\"/three\"; distance:0; within: 7; " "sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:" "\" Test uricontent\"; " "uricontent:\"one\"; offset:1; depth:10; " "uricontent:\"two\"; distance:1; within: 4; " "uricontent:\"six\"; distance:1; within: 6; " "sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } if (PacketAlertCheck(p, 1)) { printf("sig: 1 alerted, but it should not:"); goto end; } else if (PacketAlertCheck(p, 2)) { printf("sig: 2 alerted, but it should not:"); goto end; } else if (PacketAlertCheck(p, 3)) { printf("sig: 3 alerted, but it should not:"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test content for dce sig. */ int DetectUriSigTest08(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectUriSigTest09(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectUriSigTest10(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"boo; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectUriSigTest11(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:boo\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriSigTest12(void) { DetectEngineCtx *de_ctx = NULL; DetectContentData *ud = 0; Signature *s = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent: !\"boo\"; sid:238012;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx == NULL) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx == NULL: "); goto end; } ud = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest13(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest14(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest15(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"af|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest16(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest17(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"aast|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest18(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"aast|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest19(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"aast|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest20(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af|asdf\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest21(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af|af|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af|af|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; uricontent:\"|af|af|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectUriContentParseTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; uricontent:\"\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void HttpUriRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HTTPUriTest01", HTTPUriTest01); UtRegisterTest("HTTPUriTest02", HTTPUriTest02); UtRegisterTest("HTTPUriTest03", HTTPUriTest03); UtRegisterTest("HTTPUriTest04", HTTPUriTest04); UtRegisterTest("DetectUriSigTest01", DetectUriSigTest01); UtRegisterTest("DetectUriSigTest02", DetectUriSigTest02); UtRegisterTest("DetectUriSigTest03", DetectUriSigTest03); UtRegisterTest("DetectUriSigTest04 - Modifiers", DetectUriSigTest04); UtRegisterTest("DetectUriSigTest05 - Inspection", DetectUriSigTest05); UtRegisterTest("DetectUriSigTest06 - Inspection", DetectUriSigTest06); UtRegisterTest("DetectUriSigTest07 - Inspection", DetectUriSigTest07); UtRegisterTest("DetectUriSigTest08", DetectUriSigTest08); UtRegisterTest("DetectUriSigTest09", DetectUriSigTest09); UtRegisterTest("DetectUriSigTest10", DetectUriSigTest10); UtRegisterTest("DetectUriSigTest11", DetectUriSigTest11); UtRegisterTest("DetectUriSigTest12", DetectUriSigTest12); UtRegisterTest("DetectUriContentParseTest13", DetectUriContentParseTest13); UtRegisterTest("DetectUriContentParseTest14", DetectUriContentParseTest14); UtRegisterTest("DetectUriContentParseTest15", DetectUriContentParseTest15); UtRegisterTest("DetectUriContentParseTest16", DetectUriContentParseTest16); UtRegisterTest("DetectUriContentParseTest17", DetectUriContentParseTest17); UtRegisterTest("DetectUriContentParseTest18", DetectUriContentParseTest18); UtRegisterTest("DetectUriContentParseTest19", DetectUriContentParseTest19); UtRegisterTest("DetectUriContentParseTest20", DetectUriContentParseTest20); UtRegisterTest("DetectUriContentParseTest21", DetectUriContentParseTest21); UtRegisterTest("DetectUriContentParseTest22", DetectUriContentParseTest22); UtRegisterTest("DetectUriContentParseTest23", DetectUriContentParseTest23); UtRegisterTest("DetectUriContentParseTest24", DetectUriContentParseTest24); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-host-info.h0000644000000000000000000000162713051004444014041 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __UTIL_HOST_INFO_H__ #define __UTIL_HOST_INFO_H__ int SCKernelVersionIsAtLeast(int major, int minor); #endif /* __UTIL_HOST_INFO_H__ */ suricata-3.2.1/src/detect-ssh-software-version.h0000644000000000000000000000231313051004444016527 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __DETECT_SSH_SOFTWARE_VERSION_H__ #define __DETECT_SSH_SOFTWARE_VERSION_H__ typedef struct DetectSshSoftwareVersionData_ { uint8_t *software_ver; /** ssh version to match */ uint16_t len; /** ssh version length to match */ } DetectSshSoftwareVersionData; /* prototypes */ void DetectSshSoftwareVersionRegister(void); void DetectSshSoftwareVersionRegisterTests(void); #endif /* __DETECT_SSH_SOFTWARE_VERSION_H__ */ suricata-3.2.1/src/detect-engine-analyzer.h0000644000000000000000000000245013051004444015511 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eileen Donlon */ #ifndef __DETECT_ENGINE_ANALYZER_H__ #define __DETECT_ENGINE_ANALYZER_H__ #include int SetupFPAnalyzer(void); void CleanupFPAnalyzer(void); int SetupRuleAnalyzer(void); void CleanupRuleAnalyzer (void); int PerCentEncodingSetup (); int PerCentEncodingMatch (uint8_t *content, uint8_t content_len); void EngineAnalysisFP(Signature *s, char *line); void EngineAnalysisRules(const Signature *s, const char *line); void EngineAnalysisRulesFailure(char *line, char *file, int lineno); #endif /* __DETECT_ENGINE_ANALYZER_H__ */ suricata-3.2.1/src/detect-app-layer-protocol.c0000644000000000000000000004530313051004444016151 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "detect-engine.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" #include "detect-parse.h" #include "detect-app-layer-protocol.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" static void DetectAppLayerProtocolRegisterTests(void); static int DetectAppLayerProtocolPacketMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); int r = 0; const DetectAppLayerProtocolData *data = (const DetectAppLayerProtocolData *)ctx; /* if the sig is PD-only we only match when PD packet flags are set */ if ((s->flags & SIG_FLAG_PDONLY) && (p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) { SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); SCReturnInt(0); } const Flow *f = p->flow; if (f == NULL) { SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt); SCReturnInt(0); } /* unknown means protocol detection isn't ready yet */ if ((f->alproto_ts != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOSERVER)) { SCLogDebug("toserver packet %"PRIu64": looking for %u/neg %u, got %u", p->pcap_cnt, data->alproto, data->negated, f->alproto_ts); r = (data->negated) ? (f->alproto_ts != data->alproto) : (f->alproto_ts == data->alproto); } else if ((f->alproto_tc != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOCLIENT)) { SCLogDebug("toclient packet %"PRIu64": looking for %u/neg %u, got %u", p->pcap_cnt, data->alproto, data->negated, f->alproto_tc); r = (data->negated) ? (f->alproto_tc != data->alproto) : (f->alproto_tc == data->alproto); } else { SCLogDebug("packet %"PRIu64": default case: direction %02x, approtos %u/%u/%u", p->pcap_cnt, p->flowflags & (FLOW_PKT_TOCLIENT|FLOW_PKT_TOSERVER), f->alproto, f->alproto_ts, f->alproto_tc); } SCReturnInt(r); } static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg) { DetectAppLayerProtocolData *data; AppProto alproto = ALPROTO_UNKNOWN; uint8_t negated = 0; if (arg == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-protocol keyword " "supplied with no arguments. This keyword needs " "an argument."); return NULL; } while (*arg != '\0' && isspace((unsigned char)*arg)) arg++; if (arg[0] == '!') { negated = 1; arg++; } while (*arg != '\0' && isspace((unsigned char)*arg)) arg++; if (strcmp(arg, "failed") == 0) { alproto = ALPROTO_FAILED; } else { alproto = AppLayerGetProtoByName((char *)arg); if (alproto == ALPROTO_UNKNOWN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-protocol " "keyword supplied with unknown protocol \"%s\"", arg); return NULL; } } data = SCMalloc(sizeof(DetectAppLayerProtocolData)); if (unlikely(data == NULL)) return NULL; data->alproto = alproto; data->negated = negated; return data; } static _Bool HasConflicts(const DetectAppLayerProtocolData *us, const DetectAppLayerProtocolData *them) { /* mixing negated and non negated is illegal */ if (them->negated ^ us->negated) return TRUE; /* multiple non-negated is illegal */ if (!us->negated) return TRUE; /* duplicate option */ if (us->alproto == them->alproto) return TRUE; /* all good */ return FALSE; } static int DetectAppLayerProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectAppLayerProtocolData *data = NULL; SigMatch *sm = NULL; if (s->alproto != ALPROTO_UNKNOWN) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Either we already " "have the rule match on an app layer protocol set through " "other keywords that match on this protocol, or have " "already seen a non-negated app-layer-protocol."); goto error; } data = DetectAppLayerProtocolParse(arg); if (data == NULL) goto error; SigMatch *tsm = s->sm_lists[DETECT_SM_LIST_MATCH]; for ( ; tsm != NULL; tsm = tsm->next) { if (tsm->type == DETECT_AL_APP_LAYER_PROTOCOL) { const DetectAppLayerProtocolData *them = (const DetectAppLayerProtocolData *)tsm->ctx; if (HasConflicts(data, them)) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "can't mix " "positive app-layer-protocol match with negated " "match or match for 'failed'."); goto error; } } } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_APP_LAYER_PROTOCOL; sm->ctx = (void *)data; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (data != NULL) SCFree(data); return -1; } static void DetectAppLayerProtocolFree(void *ptr) { SCFree(ptr); return; } /** \internal * \brief prefilter function for protocol detect matching */ static void PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) { SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt); SCReturn; } if (p->flow == NULL) { SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt); SCReturn; } if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) { SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); SCReturn; } if ((p->flags & PKT_PROTO_DETECT_TS_DONE) && (p->flowflags & FLOW_PKT_TOSERVER)) { int r = (ctx->v1.u16[0] == p->flow->alproto_ts) ^ ctx->v1.u8[2]; if (r) { PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } else if ((p->flags & PKT_PROTO_DETECT_TC_DONE) && (p->flowflags & FLOW_PKT_TOCLIENT)) { int r = (ctx->v1.u16[0] == p->flow->alproto_tc) ^ ctx->v1.u8[2]; if (r) { PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } } static void PrefilterPacketAppProtoSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectAppLayerProtocolData *a = smctx; v->u16[0] = a->alproto; v->u8[2] = (uint8_t)a->negated; } static _Bool PrefilterPacketAppProtoCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectAppLayerProtocolData *a = smctx; if (v.u16[0] == a->alproto && v.u8[2] == (uint8_t)a->negated) return TRUE; return FALSE; } static int PrefilterSetupAppProto(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_AL_APP_LAYER_PROTOCOL, PrefilterPacketAppProtoSet, PrefilterPacketAppProtoCompare, PrefilterPacketAppProtoMatch); } static _Bool PrefilterAppProtoIsPrefilterable(const Signature *s) { if (s->flags & SIG_FLAG_PDONLY) { SCLogDebug("prefilter on PD %u", s->id); return TRUE; } return FALSE; } void DetectAppLayerProtocolRegister(void) { sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].name = "app-layer-protocol"; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Match = DetectAppLayerProtocolPacketMatch; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Setup = DetectAppLayerProtocolSetup; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].Free = DetectAppLayerProtocolFree; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].RegisterTests = DetectAppLayerProtocolRegisterTests; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].SetupPrefilter = PrefilterSetupAppProto; sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].SupportsPrefilter = PrefilterAppProtoIsPrefilterable; return; } /**********************************Unittests***********************************/ #ifdef UNITTESTS static int DetectAppLayerProtocolTest01(void) { DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http"); FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated != 0); DetectAppLayerProtocolFree(data); PASS; } static int DetectAppLayerProtocolTest02(void) { DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("!http"); FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated == 0); DetectAppLayerProtocolFree(data); PASS; } static int DetectAppLayerProtocolTest03(void) { Signature *s = NULL; DetectAppLayerProtocolData *data = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:http; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF(s->alproto != ALPROTO_UNKNOWN); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest04(void) { Signature *s = NULL; DetectAppLayerProtocolData *data = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:!http; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF(s->alproto != ALPROTO_UNKNOWN); FAIL_IF(s->flags & SIG_FLAG_APPLAYER); FAIL_IF_NOT(s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated == 0); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest05(void) { Signature *s = NULL; DetectAppLayerProtocolData *data = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF(s->alproto != ALPROTO_UNKNOWN); FAIL_IF(s->flags & SIG_FLAG_APPLAYER); FAIL_IF_NOT(s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated == 0); data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->next->ctx; FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_SMTP); FAIL_IF(data->negated == 0); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest06(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(app-layer-protocol:smtp; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest07(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(app-layer-protocol:!smtp; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest08(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest09(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest10(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest11(void) { DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed"); FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_FAILED); FAIL_IF(data->negated != 0); DetectAppLayerProtocolFree(data); PASS; } static int DetectAppLayerProtocolTest12(void) { DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("!failed"); FAIL_IF_NULL(data); FAIL_IF(data->alproto != ALPROTO_FAILED); FAIL_IF(data->negated == 0); DetectAppLayerProtocolFree(data); PASS; } static int DetectAppLayerProtocolTest13(void) { Signature *s = NULL; DetectAppLayerProtocolData *data = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:failed; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF(s->alproto != ALPROTO_UNKNOWN); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF(data->alproto != ALPROTO_FAILED); FAIL_IF(data->negated); DetectEngineCtxFree(de_ctx); PASS; } static int DetectAppLayerProtocolTest14(void) { DetectAppLayerProtocolData *data = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; Signature *s1 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:http; flowbits:set,blah; sid:1;)"); FAIL_IF_NULL(s1); FAIL_IF(s1->alproto != ALPROTO_UNKNOWN); FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData *)s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated); Signature *s2 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:http; flow:to_client; sid:2;)"); FAIL_IF_NULL(s2); FAIL_IF(s2->alproto != ALPROTO_UNKNOWN); FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData *)s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated); /* flow:established and other options not supported for PD-only */ Signature *s3 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(app-layer-protocol:http; flow:to_client,established; sid:3;)"); FAIL_IF_NULL(s3); FAIL_IF(s3->alproto != ALPROTO_UNKNOWN); FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]); FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx); data = (DetectAppLayerProtocolData *)s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx; FAIL_IF(data->alproto != ALPROTO_HTTP); FAIL_IF(data->negated); SigGroupBuild(de_ctx); FAIL_IF_NOT(s1->flags & SIG_FLAG_PDONLY); FAIL_IF_NOT(s2->flags & SIG_FLAG_PDONLY); FAIL_IF(s3->flags & SIG_FLAG_PDONLY); // failure now DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ static void DetectAppLayerProtocolRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectAppLayerProtocolTest01", DetectAppLayerProtocolTest01); UtRegisterTest("DetectAppLayerProtocolTest02", DetectAppLayerProtocolTest02); UtRegisterTest("DetectAppLayerProtocolTest03", DetectAppLayerProtocolTest03); UtRegisterTest("DetectAppLayerProtocolTest04", DetectAppLayerProtocolTest04); UtRegisterTest("DetectAppLayerProtocolTest05", DetectAppLayerProtocolTest05); UtRegisterTest("DetectAppLayerProtocolTest06", DetectAppLayerProtocolTest06); UtRegisterTest("DetectAppLayerProtocolTest07", DetectAppLayerProtocolTest07); UtRegisterTest("DetectAppLayerProtocolTest08", DetectAppLayerProtocolTest08); UtRegisterTest("DetectAppLayerProtocolTest09", DetectAppLayerProtocolTest09); UtRegisterTest("DetectAppLayerProtocolTest10", DetectAppLayerProtocolTest10); UtRegisterTest("DetectAppLayerProtocolTest11", DetectAppLayerProtocolTest11); UtRegisterTest("DetectAppLayerProtocolTest12", DetectAppLayerProtocolTest12); UtRegisterTest("DetectAppLayerProtocolTest13", DetectAppLayerProtocolTest13); UtRegisterTest("DetectAppLayerProtocolTest14", DetectAppLayerProtocolTest14); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-decode-der-get.c0000644000000000000000000002573613051004444014705 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * */ #include "suricata-common.h" #include "util-decode-der.h" #include "util-decode-der-get.h" static const uint8_t SEQ_IDX_ISSUER[] = { 0, 2 }; static const uint8_t SEQ_IDX_VALIDITY[] = { 0, 3 }; static const uint8_t SEQ_IDX_SUBJECT[] = { 0, 4 }; static const char *Oid2ShortStr(const char *oid) { if (strcmp(oid, "1.2.840.113549.1.9.1") == 0) return "emailAddress"; if (strcmp(oid, "2.5.4.3") == 0) return "CN"; if (strcmp(oid, "2.5.4.5") == 0) return "serialNumber"; if (strcmp(oid, "2.5.4.6") == 0) return "C"; if (strcmp(oid, "2.5.4.7") == 0) return "L"; if (strcmp(oid, "2.5.4.8") == 0) return "ST"; if (strcmp(oid, "2.5.4.10") == 0) return "O"; if (strcmp(oid, "2.5.4.11") == 0) return "OU"; if (strcmp(oid, "0.9.2342.19200300.100.1.25") == 0) return "DC"; return "unknown"; } static time_t GentimeToTime(char *gentime) { time_t time; struct tm tm; /* GeneralizedTime values MUST be expressed in Greenwich Mean Time * (Zulu) and MUST include seconds (rfc5280 4.1.2.5.2). It MUST NOT * include fractional seconds. It should therefore be on the format * YYYYmmddHHMMSSZ. */ if (strlen(gentime) != 15) goto error; memset(&tm, 0, sizeof(tm)); strptime(gentime, "%Y%m%d%H%M%SZ", &tm); time = SCMkTimeUtc(&tm); if (time < 0) goto error; return time; error: return -1; } static time_t UtctimeToTime(char *utctime) { time_t time; unsigned int year; char yy[3]; char buf[20]; /* UTCTime values MUST be expressed in Greenwich Mean Time (Zulu) * and MUST include seconds (rfc5280 4.1.2.5.1). It should * therefore be on the format YYmmddHHMMSSZ. */ if (strlen(utctime) != 13) goto error; /* UTCTime use two digits to represent the year. The year field (YY) * should be interpreted as 19YY when it is greater than or equal to * 50. If it is less than 50 it should be interpreted as 20YY. * Because of this, GeneralizedTime must be used for dates in the * year 2050 or later. */ strlcpy(yy, utctime, sizeof(yy)); year = strtol(yy, NULL, 10); if (year >= 50) snprintf(buf, sizeof(buf), "%i%s", 19, utctime); else snprintf(buf, sizeof(buf), "%i%s", 20, utctime); time = GentimeToTime(buf); if (time == -1) goto error; return time; error: return -1; } /** * \brief Iterate through an ASN.1 structure, following the index sequence. * Context specific elements are skipped. * * \retval The matching node, or NULL */ const Asn1Generic * Asn1DerGet(const Asn1Generic *top, const uint8_t *seq_index, const uint32_t seqsz, uint32_t *errcode) { const Asn1Generic * node; uint8_t idx, i; uint8_t offset = 0; if (errcode) *errcode = ERR_DER_MISSING_ELEMENT; node = top; if (node == NULL || seq_index == NULL) return NULL; for (offset=0; offsetdata == NULL) return NULL; /* skip context-specific elements */ while (node->data->header.cls == ASN1_CLASS_CONTEXTSPEC) { node = node->next; if (node == NULL || node->data == NULL) return NULL; } node = node->next; if (node == NULL || node->data == NULL) return NULL; } /* skip context-specific elements */ if (node == NULL || node->data == NULL) return NULL; while (node->data->header.cls == ASN1_CLASS_CONTEXTSPEC) { node = node->next; if (node == NULL || node->data == NULL) return NULL; } node = node->data; } if (errcode) *errcode = 0; return node; } int Asn1DerGetValidity(const Asn1Generic *cert, time_t *not_before, time_t *not_after, uint32_t *errcode) { const Asn1Generic *node, *it; int rc = -1; if (errcode) *errcode = ERR_DER_MISSING_ELEMENT; node = Asn1DerGet(cert, SEQ_IDX_VALIDITY, sizeof(SEQ_IDX_VALIDITY), errcode); if ((node == NULL) || node->type != ASN1_SEQUENCE) goto validity_error; it = node->data; if (it == NULL || it->str == NULL) goto validity_error; if (it->type == ASN1_UTCTIME) *not_before = UtctimeToTime(it->str); else if (it->type == ASN1_GENERALIZEDTIME) *not_before = GentimeToTime(it->str); else goto validity_error; if (*not_before == -1) goto validity_error; if (node->next == NULL) goto validity_error; it = node->next->data; if (it == NULL || it->str == NULL) goto validity_error; if (it->type == ASN1_UTCTIME) *not_after = UtctimeToTime(it->str); else if (it->type == ASN1_GENERALIZEDTIME) *not_after = GentimeToTime(it->str); else goto validity_error; if (*not_after == -1) goto validity_error; rc = 0; validity_error: return rc; } int Asn1DerGetIssuerDN(const Asn1Generic *cert, char *buffer, uint32_t length, uint32_t *errcode) { const Asn1Generic *node_oid; const Asn1Generic *node; const Asn1Generic *it; const Asn1Generic *node_set; const Asn1Generic *node_str; const char *shortname; int rc = -1; const char *separator = ", "; if (errcode) *errcode = ERR_DER_MISSING_ELEMENT; if (length < 10) goto issuer_dn_error; buffer[0] = '\0'; node = Asn1DerGet(cert, SEQ_IDX_ISSUER, sizeof(SEQ_IDX_ISSUER), errcode); if ((node == NULL) || node->type != ASN1_SEQUENCE) goto issuer_dn_error; it = node; while (it != NULL) { if (it->data == NULL) goto issuer_dn_error; node_set = it->data; if (node_set->type != ASN1_SET || node_set->data == NULL) goto issuer_dn_error; node = node_set->data; if (node->type != ASN1_SEQUENCE || node->data == NULL) goto issuer_dn_error; node_oid = node->data; if (node_oid->str == NULL || node_oid->type != ASN1_OID) goto issuer_dn_error; shortname = Oid2ShortStr(node_oid->str); if (node->next == NULL) goto issuer_dn_error; node = node->next; node_str = node->data; if (node_str == NULL || node_str->str == NULL) goto issuer_dn_error; switch (node_str->type) { case ASN1_PRINTSTRING: case ASN1_IA5STRING: case ASN1_T61STRING: case ASN1_UTF8STRING: case ASN1_OCTETSTRING: strlcat(buffer, shortname, length); strlcat(buffer, "=", length); strlcat(buffer, node_str->str, length); break; default: if (errcode) *errcode = ERR_DER_UNSUPPORTED_STRING; goto issuer_dn_error; } if (strcmp(shortname,"CN") == 0) separator = "/"; if (it->next != NULL) strlcat(buffer, separator, length); it = it->next; } if (errcode) *errcode = 0; rc = 0; issuer_dn_error: return rc; } int Asn1DerGetSubjectDN(const Asn1Generic *cert, char *buffer, uint32_t length, uint32_t *errcode) { const Asn1Generic *node_oid; const Asn1Generic *node; const Asn1Generic *it; const Asn1Generic *node_set; const Asn1Generic *node_str; const char *shortname; int rc = -1; const char *separator = ", "; if (errcode) *errcode = ERR_DER_MISSING_ELEMENT; if (length < 10) goto subject_dn_error; buffer[0] = '\0'; node = Asn1DerGet(cert, SEQ_IDX_SUBJECT, sizeof(SEQ_IDX_SUBJECT), errcode); if ((node == NULL) || node->type != ASN1_SEQUENCE) goto subject_dn_error; it = node; while (it != NULL) { if (it == NULL || it->data == NULL) goto subject_dn_error; node_set = it->data; if (node_set->type != ASN1_SET || node_set->data == NULL) goto subject_dn_error; node = node_set->data; if (node->type != ASN1_SEQUENCE || node->data == NULL) goto subject_dn_error; node_oid = node->data; if (node_oid->str == NULL || node_oid->type != ASN1_OID) goto subject_dn_error; shortname = Oid2ShortStr(node_oid->str); if (node->next == NULL) goto subject_dn_error; node = node->next; node_str = node->data; if (node_str == NULL || node_str->str == NULL) goto subject_dn_error; switch (node_str->type) { case ASN1_PRINTSTRING: case ASN1_IA5STRING: case ASN1_T61STRING: case ASN1_UTF8STRING: case ASN1_OCTETSTRING: strlcat(buffer, shortname, length); strlcat(buffer, "=", length); strlcat(buffer, node_str->str, length); break; default: if (errcode) *errcode = ERR_DER_UNSUPPORTED_STRING; goto subject_dn_error; } if (strcmp(shortname,"CN") == 0) separator = "/"; if (it->next != NULL) strlcat(buffer, separator, length); it = it->next; } if (errcode) *errcode = 0; rc = 0; subject_dn_error: return rc; } suricata-3.2.1/src/app-layer-dnp3.c0000644000000000000000000022733113051004444013711 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "stream.h" #include "util-byte.h" #include "util-unittest.h" #include "util-hashlist.h" #include "util-print.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-detect-proto.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" /* For hexdump(). */ #include "app-layer-dcerpc-common.h" /* Default number of unreplied requests to be considered a flood. */ #define DNP3_DEFAULT_REQ_FLOOD_COUNT 500 #define DNP3_DEFAULT_PORT "20000" /* Expected values for the start bytes. */ #define DNP3_START_BYTE0 0x05 #define DNP3_START_BYTE1 0x64 /* Minimum length for a DNP3 frame. */ #define DNP3_MIN_LEN 5 /* Length of each CRC. */ #define DNP3_CRC_LEN 2 /* DNP3 block size. After the link header a CRC is inserted after * after 16 bytes of data. */ #define DNP3_BLOCK_SIZE 16 /* Maximum transport layer sequence number. */ #define DNP3_MAX_TRAN_SEQNO 64 /* Maximum application layer sequence number. */ #define DNP3_MAX_APP_SEQNO 16 /* The number of bytes in the header that are counted as part of the * header length field. */ #define DNP3_LINK_HDR_LEN 5 /* Link function codes. */ enum { DNP3_LINK_FC_CONFIRMED_USER_DATA = 3, DNP3_LINK_FC_UNCONFIRMED_USER_DATA }; /* Reserved addresses. */ #define DNP3_RESERVED_ADDR_MIN 0xfff0 #define DNP3_RESERVED_ADDR_MAX 0xfffb /* Source addresses must be < 0xfff0. */ #define DNP3_SRC_ADDR_MAX 0xfff0 #define DNP3_OBJ_TIME_SIZE 6 /* AKA UINT48. */ #define DNP3_OBJ_G12_V1_SIZE 11 #define DNP3_OBJ_G12_V2_SIZE 11 #define DNP3_OBJ_G12_V3_SIZE 1 /* Extract the prefix code from the object qualifier. */ #define DNP3_OBJ_PREFIX(x) ((x >> 4) & 0x7) /* Extract the range code from the object qualifier. */ #define DNP3_OBJ_RANGE(x) (x & 0xf) /* Decoder event map. */ SCEnumCharMap dnp3_decoder_event_table[] = { {"FLOODED", DNP3_DECODER_EVENT_FLOODED}, {"LEN_TOO_SMALL", DNP3_DECODER_EVENT_LEN_TOO_SMALL}, {"BAD_LINK_CRC", DNP3_DECODER_EVENT_BAD_LINK_CRC}, {"BAD_TRANSPORT_CRC", DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC}, {"MALFORMED", DNP3_DECODER_EVENT_MALFORMED}, {"UNKNOWN_OBJECT", DNP3_DECODER_EVENT_UNKNOWN_OBJECT}, {NULL, -1}, }; /* Some DNP3 servers start with a banner. */ static const char banner[] = "DNP3"; /* Calculate the next transport sequence number. */ #define NEXT_TH_SEQNO(current) ((current + 1) % DNP3_MAX_TRAN_SEQNO) /* Calculate the next application sequence number. */ #define NEXT_APP_SEQNO(current) ((current + 1) % DNP3_MAX_APP_SEQNO) /* CRC table generated by pycrc - http://github.com/tpircher/pycrc. * - Polynomial: 0x3d65. */ static const uint16_t crc_table[256] = { 0x0000, 0x365e, 0x6cbc, 0x5ae2, 0xd978, 0xef26, 0xb5c4, 0x839a, 0xff89, 0xc9d7, 0x9335, 0xa56b, 0x26f1, 0x10af, 0x4a4d, 0x7c13, 0xb26b, 0x8435, 0xded7, 0xe889, 0x6b13, 0x5d4d, 0x07af, 0x31f1, 0x4de2, 0x7bbc, 0x215e, 0x1700, 0x949a, 0xa2c4, 0xf826, 0xce78, 0x29af, 0x1ff1, 0x4513, 0x734d, 0xf0d7, 0xc689, 0x9c6b, 0xaa35, 0xd626, 0xe078, 0xba9a, 0x8cc4, 0x0f5e, 0x3900, 0x63e2, 0x55bc, 0x9bc4, 0xad9a, 0xf778, 0xc126, 0x42bc, 0x74e2, 0x2e00, 0x185e, 0x644d, 0x5213, 0x08f1, 0x3eaf, 0xbd35, 0x8b6b, 0xd189, 0xe7d7, 0x535e, 0x6500, 0x3fe2, 0x09bc, 0x8a26, 0xbc78, 0xe69a, 0xd0c4, 0xacd7, 0x9a89, 0xc06b, 0xf635, 0x75af, 0x43f1, 0x1913, 0x2f4d, 0xe135, 0xd76b, 0x8d89, 0xbbd7, 0x384d, 0x0e13, 0x54f1, 0x62af, 0x1ebc, 0x28e2, 0x7200, 0x445e, 0xc7c4, 0xf19a, 0xab78, 0x9d26, 0x7af1, 0x4caf, 0x164d, 0x2013, 0xa389, 0x95d7, 0xcf35, 0xf96b, 0x8578, 0xb326, 0xe9c4, 0xdf9a, 0x5c00, 0x6a5e, 0x30bc, 0x06e2, 0xc89a, 0xfec4, 0xa426, 0x9278, 0x11e2, 0x27bc, 0x7d5e, 0x4b00, 0x3713, 0x014d, 0x5baf, 0x6df1, 0xee6b, 0xd835, 0x82d7, 0xb489, 0xa6bc, 0x90e2, 0xca00, 0xfc5e, 0x7fc4, 0x499a, 0x1378, 0x2526, 0x5935, 0x6f6b, 0x3589, 0x03d7, 0x804d, 0xb613, 0xecf1, 0xdaaf, 0x14d7, 0x2289, 0x786b, 0x4e35, 0xcdaf, 0xfbf1, 0xa113, 0x974d, 0xeb5e, 0xdd00, 0x87e2, 0xb1bc, 0x3226, 0x0478, 0x5e9a, 0x68c4, 0x8f13, 0xb94d, 0xe3af, 0xd5f1, 0x566b, 0x6035, 0x3ad7, 0x0c89, 0x709a, 0x46c4, 0x1c26, 0x2a78, 0xa9e2, 0x9fbc, 0xc55e, 0xf300, 0x3d78, 0x0b26, 0x51c4, 0x679a, 0xe400, 0xd25e, 0x88bc, 0xbee2, 0xc2f1, 0xf4af, 0xae4d, 0x9813, 0x1b89, 0x2dd7, 0x7735, 0x416b, 0xf5e2, 0xc3bc, 0x995e, 0xaf00, 0x2c9a, 0x1ac4, 0x4026, 0x7678, 0x0a6b, 0x3c35, 0x66d7, 0x5089, 0xd313, 0xe54d, 0xbfaf, 0x89f1, 0x4789, 0x71d7, 0x2b35, 0x1d6b, 0x9ef1, 0xa8af, 0xf24d, 0xc413, 0xb800, 0x8e5e, 0xd4bc, 0xe2e2, 0x6178, 0x5726, 0x0dc4, 0x3b9a, 0xdc4d, 0xea13, 0xb0f1, 0x86af, 0x0535, 0x336b, 0x6989, 0x5fd7, 0x23c4, 0x159a, 0x4f78, 0x7926, 0xfabc, 0xcce2, 0x9600, 0xa05e, 0x6e26, 0x5878, 0x029a, 0x34c4, 0xb75e, 0x8100, 0xdbe2, 0xedbc, 0x91af, 0xa7f1, 0xfd13, 0xcb4d, 0x48d7, 0x7e89, 0x246b, 0x1235 }; /** * \brief Compute the CRC for a buffer. * * \param buf Buffer to create CRC from. * \param len Length of buffer (number of bytes to use for CRC). */ static uint16_t DNP3ComputeCRC(const uint8_t *buf, uint32_t len) { const uint8_t *byte = buf; uint16_t crc = 0; int idx; while (len--) { idx = (crc ^ *byte) & 0xff; crc = (crc_table[idx] ^ (crc >> 8)) & 0xffff; byte++; } return ~crc & 0xffff; } /** * \brief Check the CRC of a block. * * \param block The block of data with CRC to be checked. * \param len The size of the data block. * * \retval 1 if CRC is OK, otherwise 0. */ static int DNP3CheckCRC(const uint8_t *block, uint32_t len) { uint32_t crc_offset; uint16_t crc; /* Need at least one byte plus the CRC. */ if (len < DNP3_CRC_LEN + 1) { return 0; } crc_offset = len - DNP3_CRC_LEN; crc = DNP3ComputeCRC(block, len - DNP3_CRC_LEN); if (((crc & 0xff) == block[crc_offset]) && ((crc >> 8) == block[crc_offset + 1])) { return 1; } return 0; } /** * \brief Check the CRC of the link header. * * \param header Point to the link header. * * \retval 1 if header CRC is OK, otherwise 0. */ static int DNP3CheckLinkHeaderCRC(const DNP3LinkHeader *header) { return DNP3CheckCRC((uint8_t *)header, sizeof(DNP3LinkHeader)); } /** * \brief Check user data CRCs. * * \param data Pointer to user data. * \param len Length of user data. * * \retval 1 if CRCs are OK, otherwise 0. */ static int DNP3CheckUserDataCRCs(const uint8_t *data, uint32_t len) { uint32_t offset = 0; uint32_t block_size; while (offset < len) { if (len - offset >= DNP3_BLOCK_SIZE + DNP3_CRC_LEN) { block_size = DNP3_BLOCK_SIZE + DNP3_CRC_LEN; } else { block_size = len - offset; } if (!DNP3CheckCRC(data + offset, block_size)) { /* Once failed, may as well return immediately. */ return 0; } offset += block_size; } return 1; } /** * \brief Check the DNP3 frame start bytes. * * \retval 1 if valid, 0 if not. */ static int DNP3CheckStartBytes(const DNP3LinkHeader *header) { return header->start_byte0 == DNP3_START_BYTE0 && header->start_byte1 == DNP3_START_BYTE1; } /** * \brief Check if a frame contains a banner. * * Some servers (outstations) appear to send back a banner that fails * the normal frame checks. So first check for a banner. * * \retval 1 if a banner is found, 0 if not. */ static int DNP3ContainsBanner(const uint8_t *input, uint32_t len) { return memmem(input, len, banner, strlen(banner)) != NULL; } /** * \brief DNP3 probing parser. */ static uint16_t DNP3ProbingParser(uint8_t *input, uint32_t len, uint32_t *offset) { DNP3LinkHeader *hdr = (DNP3LinkHeader *)input; /* Check that we have the minimum amount of bytes. */ if (len < sizeof(DNP3LinkHeader)) { SCLogDebug("Length too small to be a DNP3 header."); return ALPROTO_UNKNOWN; } /* May be a banner. */ if (DNP3ContainsBanner(input, len)) { SCLogDebug("Packet contains a DNP3 banner."); goto end; } /* Verify start value (from AN2013-004b). */ if (!DNP3CheckStartBytes(hdr)) { SCLogDebug("Invalid start bytes."); return ALPROTO_FAILED; } /* Verify minimum length. */ if (hdr->len < DNP3_MIN_LEN) { SCLogDebug("Packet too small to be a valid DNP3 fragment."); return ALPROTO_FAILED; } end: SCLogDebug("Detected DNP3."); return ALPROTO_DNP3; } /** * \brief Caculate the length of the transport layer with CRCs removed. * * \param input_len The length of the transport layer buffer. * * \retval The length of the buffer after CRCs are removed. */ static int DNP3CalculateTransportLengthWithoutCRCs(uint32_t input_len) { /* Too small. */ if (input_len < DNP3_CRC_LEN) { return -1; } /* Get the number of complete blocks. */ int blocks = input_len / (DNP3_BLOCK_SIZE + DNP3_CRC_LEN); /* And the number of bytes in the last block. */ int rem = input_len - (blocks * (DNP3_BLOCK_SIZE + DNP3_CRC_LEN)); if (rem) { if (rem < DNP3_CRC_LEN) { return -1; } return (blocks * DNP3_BLOCK_SIZE) + (rem - DNP3_CRC_LEN); } else { return (blocks * DNP3_BLOCK_SIZE); } } /** * \brief Reassemble the application layer by stripping the CRCs. * * Remove the CRCs from the user data blocks. The output is the user * data with the CRCs removed as well as the transport header removed, * but the input data still needs to include the transport header as * its part of the first user data block. * * If the output length passed in is non-null, the new input data will * be appended, and the output length pointer incremented as needed. * * \param input Input buffer starting at the transport header (which * will be removed from the output). * \param input_len Length of the input buffer. * \param output Pointer to output buffer (may be realloc'd). * \param output_len Pointer to output length. * * \retval 1 if reassembly was successful, otherwise 0. */ static int DNP3ReassembleApplicationLayer(const uint8_t *input, uint32_t input_len, uint8_t **output, uint32_t *output_len) { int len = DNP3CalculateTransportLengthWithoutCRCs(input_len); if (len <= 0) { return 0; } /* Remove one byte for the transport header and make sure we have * at least one byte of user data. */ if (--len < 1) { return 0; } if (*output == NULL) { *output = SCCalloc(1, len); if (unlikely(*output == NULL)) { return 0; } } else { uint8_t *ptr = SCRealloc(*output, (size_t)(*output_len + len)); if (unlikely(ptr == NULL)) { return 0; } *output = ptr; } int offset = 0, block_size; while ((uint32_t)offset < input_len) { if (input_len - offset > DNP3_BLOCK_SIZE + DNP3_CRC_LEN) { block_size = DNP3_BLOCK_SIZE + DNP3_CRC_LEN; } else { block_size = input_len - offset; } /* If handling the first block (offset is 0), trim off the * first byte which is the transport header, and not part of * the application data. */ if (offset == 0) { offset++; block_size--; } /* Need at least 3 bytes to continue. One for application * data, and 2 for the CRC. If not, return failure for * malformed frame. */ if (block_size < DNP3_CRC_LEN + 1) { SCLogDebug("Not enough data to continue."); return 0; } /* Make sure there is enough space to write into. */ if (block_size - DNP3_CRC_LEN > len) { SCLogDebug("Not enough data to continue."); return 0; } memcpy(*output + *output_len, input + offset, block_size - DNP3_CRC_LEN); *output_len += block_size - DNP3_CRC_LEN; offset += block_size; len -= block_size - DNP3_CRC_LEN; } return 1; } /** * \brief Allocate a DNP3 state object. * * The DNP3 state object represents a single DNP3 TCP session. */ static void *DNP3StateAlloc(void) { SCEnter(); DNP3State *dnp3; dnp3 = (DNP3State *)SCCalloc(1, sizeof(DNP3State)); if (unlikely(dnp3 == NULL)) { return NULL; } TAILQ_INIT(&dnp3->tx_list); SCReturnPtr(dnp3, "void"); } /** * \brief Set a DNP3 application layer event. * * Sets an event on the current transaction object. */ static void DNP3SetEvent(DNP3State *dnp3, uint8_t event) { if (dnp3 && dnp3->curr) { AppLayerDecoderEventsSetEventRaw(&dnp3->curr->decoder_events, event); dnp3->events++; } else { SCLogWarning(SC_ERR_ALPARSER, "Fail set set event, state or txn was NULL."); } } /** * \brief Set a DNP3 application layer event on a transaction. */ static void DNP3SetEventTx(DNP3Transaction *tx, uint8_t event) { AppLayerDecoderEventsSetEventRaw(&tx->decoder_events, event); tx->dnp3->events++; } /** * \brief Allocation a DNP3 transaction. */ static DNP3Transaction *DNP3TxAlloc(DNP3State *dnp3) { DNP3Transaction *tx = SCCalloc(1, sizeof(DNP3Transaction)); if (unlikely(tx == NULL)) { return NULL; } dnp3->transaction_max++; dnp3->unreplied++; dnp3->curr = tx; tx->dnp3 = dnp3; tx->tx_num = dnp3->transaction_max; TAILQ_INIT(&tx->request_objects); TAILQ_INIT(&tx->response_objects); TAILQ_INSERT_TAIL(&dnp3->tx_list, tx, next); /* Check for flood state. */ if (dnp3->unreplied > DNP3_DEFAULT_REQ_FLOOD_COUNT) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_FLOODED); dnp3->flooded = 1; } return tx; } /** * \brief Calculate the length of a link frame with CRCs. * * This is required as the length parameter in the DNP3 header does not * include the added CRCs. * * \param length The length from the DNP3 link header. * * \retval The length of the frame with CRCs included or 0 if the length isn't * long enough to be a valid DNP3 frame. */ static uint32_t DNP3CalculateLinkLength(uint8_t length) { uint32_t frame_len = 0; int rem; /* Fail early if the length is less than the minimum size. */ if (length < DNP3_LINK_HDR_LEN) { return 0; } /* Subtract the 5 bytes of the header that are included in the * length. */ length -= DNP3_LINK_HDR_LEN; rem = length % DNP3_BLOCK_SIZE; frame_len = (length / DNP3_BLOCK_SIZE) * (DNP3_BLOCK_SIZE + DNP3_CRC_LEN); if (rem) { frame_len += rem + DNP3_CRC_LEN; } return frame_len + sizeof(DNP3LinkHeader); } /** * \brief Check if the link function code specifies user data. * * \param header Point to link header. * * \retval 1 if frame contains user data, otherwise 0. */ static int DNP3IsUserData(const DNP3LinkHeader *header) { switch (DNP3_LINK_FC(header->control)) { case DNP3_LINK_FC_CONFIRMED_USER_DATA: case DNP3_LINK_FC_UNCONFIRMED_USER_DATA: return 1; default: return 0; } } /** * \brief Check if the frame has user data. * * Check if the DNP3 frame actually has user data by checking if data * exists after the headers. * * \retval 1 if user data exists, otherwise 0. */ static int DNP3HasUserData(const DNP3LinkHeader *header) { if (DNP3_LINK_DIR(header->control)) { return header->len >= DNP3_LINK_HDR_LEN + sizeof(DNP3TransportHeader) + sizeof(DNP3ApplicationHeader); } else { return header->len >= DNP3_LINK_HDR_LEN + sizeof(DNP3TransportHeader) + sizeof(DNP3ApplicationHeader) + sizeof(DNP3InternalInd); } } /** * \brief Reset a DNP3Buffer. */ static void DNP3BufferReset(DNP3Buffer *buffer) { buffer->offset = 0; buffer->len = 0; } /** * \brief Add data to a DNP3 buffer, enlarging the buffer if required. * * \param buffer Buffer to add data data. * \param data Data to be added to buffer. * \param len Size of data to be added to buffer. * * \param 1 if data was added successful, otherwise 0. */ static int DNP3BufferAdd(DNP3Buffer *buffer, const uint8_t *data, uint32_t len) { if (buffer->size == 0) { buffer->buffer = SCCalloc(1, len); if (unlikely(buffer->buffer == NULL)) { return 0; } buffer->size = len; } else if (buffer->len + len > buffer->size) { uint8_t *tmp = SCRealloc(buffer->buffer, buffer->len + len); if (unlikely(tmp == NULL)) { return 0; } buffer->buffer = tmp; buffer->size = buffer->len + len; } memcpy(buffer->buffer + buffer->len, data, len); buffer->len += len; return 1; } /** * \brief Trim a DNP3 buffer. * * Trimming a buffer moves the data in the buffer up to the front of * the buffer freeing up room at the end for more incoming data. * * \param buffer The buffer to trim. */ static void DNP3BufferTrim(DNP3Buffer *buffer) { if (buffer->offset == buffer->len) { DNP3BufferReset(buffer); } else if (buffer->offset > 0) { memmove(buffer->buffer, buffer->buffer + buffer->offset, buffer->len - buffer->offset); buffer->len = buffer->len - buffer->offset; buffer->offset = 0; } } /** * \brief Free a DNP3 object. */ static void DNP3ObjectFree(DNP3Object *object) { if (object->points != NULL) { DNP3FreeObjectPointList(object->group, object->variation, object->points); } SCFree(object); } /** * \breif Allocate a DNP3 object. */ static DNP3Object *DNP3ObjectAlloc(void) { DNP3Object *object = SCCalloc(1, sizeof(*object)); if (unlikely(object == NULL)) { return NULL; } object->points = DNP3PointListAlloc(); if (object->points == NULL) { DNP3ObjectFree(object); return NULL; } return object; } /** * \brief Decode DNP3 application objects. * * This function decoded known DNP3 application objects. As the * protocol isn't self describing, we can only decode the buffer while * the application objects are known. As soon as an unknown * group/variation is hit, we must stop processing. * * \param buf the input buffer * \param len length of the input buffer * \param objects pointer to list where decoded objects will be stored. * * \retval 1 if all objects decoded, 0 if all objects could not be decoded ( * unknown group/variations) */ static int DNP3DecodeApplicationObjects(DNP3Transaction *tx, const uint8_t *buf, uint32_t len, DNP3ObjectList *objects) { int retval = 0; if (buf == NULL || len == 0) { return 1; } while (len) { uint32_t offset = 0; if (len < sizeof(DNP3ObjHeader)) { goto done; } DNP3ObjHeader *header = (DNP3ObjHeader *)buf; offset += sizeof(DNP3ObjHeader); DNP3Object *object = DNP3ObjectAlloc(); if (unlikely(object == NULL)) { goto done; } TAILQ_INSERT_TAIL(objects, object, next); object->group = header->group; object->variation = header->variation; object->qualifier = header->qualifier; object->prefix_code = DNP3_OBJ_PREFIX(header->qualifier); object->range_code = DNP3_OBJ_RANGE(header->qualifier); /* IEEE 1815-2012, Table 4-5. */ switch (object->range_code) { case 0x00: case 0x03: { /* 1 octet start and stop indexes OR 1 octet start and * stop virtual addresses. */ if (offset + (sizeof(uint8_t) * 2) > len) { /* Not enough data. */ SCLogDebug("Not enough data."); goto not_enough_data; } object->start = buf[offset++]; object->stop = buf[offset++]; object->count = object->stop - object->start + 1; break; } case 0x01: case 0x04: { /* 2 octet start and stop indexes OR 2 octect start * and stop virtual addresses. */ if (offset + (sizeof(uint16_t) * 2) > len) { /* Not enough data. */ SCLogDebug("Not enough data."); goto not_enough_data; } object->start = DNP3_SWAP16(*(uint16_t *)(buf + offset)); offset += sizeof(uint16_t); object->stop = DNP3_SWAP16(*(uint16_t *)(buf + offset)); offset += sizeof(uint16_t); object->count = object->stop - object->start + 1; break; } case 0x02: case 0x05: { /* 4 octet start and stop indexes OR 4 octect start * and stop virtual addresses. */ if (offset + (sizeof(uint32_t) * 2) > len) { /* Not enough data. */ SCLogDebug("Not enough data."); goto not_enough_data; } object->start = DNP3_SWAP32(*(uint32_t *)(buf + offset)); offset += sizeof(uint32_t); object->stop = DNP3_SWAP32(*(uint32_t *)(buf + offset)); offset += sizeof(uint32_t); object->count = object->stop - object->start + 1; break; } case 0x06: /* No range field. */ object->count = 0; break; case 0x07: /* 1 octet count of objects. */ if (offset + sizeof(uint8_t) > len) { SCLogDebug("Not enough data."); goto not_enough_data; } object->count = buf[offset]; offset += sizeof(uint8_t); break; case 0x08: { /* 2 octet count of objects. */ if (offset + sizeof(uint16_t) > len) { SCLogDebug("Not enough data."); goto not_enough_data; } object->count = DNP3_SWAP16(*(uint16_t *)(buf + offset)); offset += sizeof(uint16_t); break; } case 0x09: { /* 4 octet count of objects. */ if (offset + sizeof(uint32_t) > len) { SCLogDebug("Not enough data."); goto not_enough_data; } object->count = DNP3_SWAP32(*(uint32_t *)(buf + offset)); offset += sizeof(uint32_t); break; } case 0x0b: { if (offset + sizeof(uint8_t) > len) { /* Not enough data. */ SCLogDebug("Not enough data."); goto not_enough_data; } object->count = *(uint8_t *)(buf + offset); offset += sizeof(uint8_t); break; } default: SCLogDebug("Range code 0x%02x is reserved.", object->range_code); goto done; } buf += offset; len -= offset; if (object->variation == 0 || object->count == 0) { goto next; } int event = DNP3DecodeObject(header->group, header->variation, &buf, &len, object->prefix_code, object->start, object->count, object->points); if (event) { DNP3SetEventTx(tx, DNP3_DECODER_EVENT_UNKNOWN_OBJECT); goto done; } next: continue; } /* All objects were decoded. */ retval = 1; not_enough_data: done: return retval; } /** * \brief Handle DNP3 request user data. * * \param dnp3 the current DNP3State * \param input pointer to the DNP3 frame (starting with link header) * \param input_len length of the input frame */ static void DNP3HandleUserDataRequest(DNP3State *dnp3, const uint8_t *input, uint32_t input_len) { DNP3LinkHeader *lh; DNP3TransportHeader th; DNP3ApplicationHeader *ah; DNP3Transaction *tx = NULL, *ttx; lh = (DNP3LinkHeader *)input; if (!DNP3CheckUserDataCRCs(input + sizeof(DNP3LinkHeader), input_len - sizeof(DNP3LinkHeader))) { return; } th = input[sizeof(DNP3LinkHeader)]; if (!DNP3_TH_FIR(th)) { TAILQ_FOREACH(ttx, &dnp3->tx_list, next) { if (ttx->request_lh.src == lh->src && ttx->request_lh.dst == lh->dst && ttx->has_request && !ttx->request_done && NEXT_TH_SEQNO(DNP3_TH_SEQ(ttx->request_th)) == DNP3_TH_SEQ(th)) { tx = ttx; break; } } if (tx == NULL) { return; } /* Update the saved transport header so subsequent segments * will be matched to this sequence number. */ tx->response_th = th; } else { ah = (DNP3ApplicationHeader *)(input + sizeof(DNP3LinkHeader) + sizeof(DNP3TransportHeader)); /* Ignore confirms - for now. */ if (ah->function_code == DNP3_APP_FC_CONFIRM) { return; } /* Create a transaction. */ tx = DNP3TxAlloc(dnp3); if (unlikely(tx == NULL)) { return; } tx->request_lh = *lh; tx->request_th = th; tx->request_ah = *ah; tx->has_request = 1; } if (!DNP3ReassembleApplicationLayer(input + sizeof(DNP3LinkHeader), input_len - sizeof(DNP3LinkHeader), &tx->request_buffer, &tx->request_buffer_len)) { /* Malformed, set event and mark as done. */ DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_MALFORMED); tx->request_done = 1; return; } /* If this is not the final segment, just return. */ if (!DNP3_TH_FIN(th)) { return; } tx->request_done = 1; /* Some function codes do not expect a reply. */ switch (tx->request_ah.function_code) { case DNP3_APP_FC_CONFIRM: case DNP3_APP_FC_DIR_OPERATE_NR: case DNP3_APP_FC_FREEZE_NR: case DNP3_APP_FC_FREEZE_CLEAR_NR: case DNP3_APP_FC_FREEZE_AT_TIME_NR: case DNP3_APP_FC_AUTH_REQ_NR: tx->response_done = 1; default: break; } if (DNP3DecodeApplicationObjects( tx, tx->request_buffer + sizeof(DNP3ApplicationHeader), tx->request_buffer_len - sizeof(DNP3ApplicationHeader), &tx->request_objects)) { tx->request_complete = 1; } } static void DNP3HandleUserDataResponse(DNP3State *dnp3, const uint8_t *input, uint32_t input_len) { DNP3LinkHeader *lh; DNP3TransportHeader th; DNP3ApplicationHeader *ah; DNP3InternalInd *iin; DNP3Transaction *tx = NULL, *ttx; uint32_t offset = 0; lh = (DNP3LinkHeader *)input; offset += sizeof(DNP3LinkHeader); if (!DNP3CheckUserDataCRCs(input + offset, input_len - offset)) { return; } th = input[offset++]; if (!DNP3_TH_FIR(th)) { TAILQ_FOREACH(ttx, &dnp3->tx_list, next) { if (ttx->response_lh.src == lh->src && ttx->response_lh.dst == lh->dst && ttx->has_response && !ttx->response_done && NEXT_TH_SEQNO(DNP3_TH_SEQ(ttx->response_th)) == DNP3_TH_SEQ(th)) { tx = ttx; break; } } if (tx == NULL) { return; } /* Replace the transport header in the transaction with this * one in case there are more frames. */ tx->response_th = th; } else { ah = (DNP3ApplicationHeader *)(input + offset); offset += sizeof(DNP3ApplicationHeader); iin = (DNP3InternalInd *)(input + offset); if (ah->function_code == DNP3_APP_FC_UNSOLICITED_RESP) { tx = DNP3TxAlloc(dnp3); if (unlikely(tx == NULL)) { return; } /* There is no request associated with an unsolicited * response, so mark the request done as far as * transaction state handling is concerned. */ tx->request_done = 1; } else { /* Find transaction. */ TAILQ_FOREACH(ttx, &dnp3->tx_list, next) { if (ttx->has_request && ttx->request_done && ttx->request_lh.src == lh->dst && ttx->request_lh.dst == lh->src && !ttx->has_response && !ttx->response_done && DNP3_APP_SEQ(ttx->request_ah.control) == DNP3_APP_SEQ(ah->control)) { tx = ttx; break; } } if (tx == NULL) { return; } } tx->has_response = 1; tx->response_lh = *lh; tx->response_th = th; tx->response_ah = *ah; tx->response_iin = *iin; } if (!DNP3ReassembleApplicationLayer(input + sizeof(DNP3LinkHeader), input_len - sizeof(DNP3LinkHeader), &tx->response_buffer, &tx->response_buffer_len)) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_MALFORMED); return; } if (!DNP3_TH_FIN(th)) { return; } tx->response_done = 1; offset = sizeof(DNP3ApplicationHeader) + sizeof(DNP3InternalInd); if (DNP3DecodeApplicationObjects(tx, tx->response_buffer + offset, tx->response_buffer_len - offset, &tx->response_objects)) { tx->response_complete = 1; } } /** * \brief Decode the DNP3 request link layer. * * \retval number of bytes processed or -1 if the data stream does not look * like DNP3. */ static int DNP3HandleRequestLinkLayer(DNP3State *dnp3, const uint8_t *input, uint32_t input_len) { SCEnter(); uint32_t processed = 0; while (input_len) { /* Need at least enough bytes for a DNP3 header. */ if (input_len < sizeof(DNP3LinkHeader)) { break; } DNP3LinkHeader *header = (DNP3LinkHeader *)input; if (!DNP3CheckStartBytes(header)) { goto error; } if (!DNP3CheckLinkHeaderCRC(header)) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_BAD_LINK_CRC); goto error; } uint32_t frame_len = DNP3CalculateLinkLength(header->len); if (frame_len == 0) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_LEN_TOO_SMALL); goto error; } if (input_len < frame_len) { /* Insufficient data, just break - will wait for more data. */ break; } /* Ignore non-user data for now. */ if (!DNP3IsUserData(header)) { goto next; } /* Make sure the header length is large enough for transport and * application headers. */ if (!DNP3HasUserData(header)) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_LEN_TOO_SMALL); goto next; } if (!DNP3CheckUserDataCRCs(input + sizeof(DNP3LinkHeader), frame_len - sizeof(DNP3LinkHeader))) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC); goto next; } DNP3HandleUserDataRequest(dnp3, input, frame_len); next: /* Advance the input buffer. */ input += frame_len; input_len -= frame_len; processed += frame_len; } SCReturnInt(processed); error: /* Error out. Should only happen if this doesn't look like a DNP3 * frame. */ SCReturnInt(-1); } /** * \brief Handle incoming request data. * * The actual request PDU parsing is done in * DNP3HandleRequestLinkLayer. This function takes care of buffering TCP * date if a segment does not contain a complete frame (or contains * multiple frames, but not the complete final frame). */ static int DNP3ParseRequest(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); DNP3State *dnp3 = (DNP3State *)state; DNP3Buffer *buffer = &dnp3->request_buffer; int processed = 0; if (input_len == 0) { SCReturnInt(1); } if (buffer->len) { if (!DNP3BufferAdd(buffer, input, input_len)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory to buffer " "DNP3 request data"); goto error; } processed = DNP3HandleRequestLinkLayer(dnp3, buffer->buffer + buffer->offset, buffer->len - buffer->offset); if (processed < 0) { goto error; } buffer->offset += processed; DNP3BufferTrim(buffer); } else { processed = DNP3HandleRequestLinkLayer(dnp3, input, input_len); if (processed < 0) { SCLogDebug("Failed to process request link layer."); goto error; } input += processed; input_len -= processed; /* Not all data was processed, buffer it. */ if (input_len) { if (!DNP3BufferAdd(buffer, input, input_len)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory to buffer DNP3 request data"); goto error; } } } SCReturnInt(1); error: /* Reset the buffer. */ DNP3BufferReset(buffer); SCReturnInt(-1); } /** * \brief Decode the DNP3 response link layer. * * \retval number of bytes processed or -1 if the data stream does not * like look DNP3. */ static int DNP3HandleResponseLinkLayer(DNP3State *dnp3, const uint8_t *input, uint32_t input_len) { SCEnter(); uint32_t processed = 0; while (input_len) { /* Need at least enough bytes for a DNP3 header. */ if (input_len < sizeof(DNP3LinkHeader)) { break; } DNP3LinkHeader *header = (DNP3LinkHeader *)input; if (!DNP3CheckStartBytes(header)) { goto error; } if (!DNP3CheckLinkHeaderCRC(header)) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_BAD_LINK_CRC); goto error; } /* Calculate the number of bytes needed to for this frame. */ uint32_t frame_len = DNP3CalculateLinkLength(header->len); if (frame_len == 0) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_LEN_TOO_SMALL); goto error; } if (input_len < frame_len) { /* Insufficient data, just break - will wait for more data. */ break; } /* Only handle user data frames for now. */ if (!DNP3IsUserData(header)) { goto next; } /* Make sure the header length is large enough for transport and * application headers. */ if (!DNP3HasUserData(header)) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_LEN_TOO_SMALL); goto error; } if (!DNP3CheckUserDataCRCs(input + sizeof(DNP3LinkHeader), frame_len - sizeof(DNP3LinkHeader))) { DNP3SetEvent(dnp3, DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC); goto next; } DNP3HandleUserDataResponse(dnp3, input, frame_len); next: /* Advance the input buffer. */ input += frame_len; input_len -= frame_len; processed += frame_len; } SCReturnInt(processed); error: /* Error out. Should only happen if the data stream no longer * looks like DNP3. */ SCReturnInt(-1); } /** * \brief Parse incoming data. * * This is the entry function for DNP3 application layer data. Its * main responsibility is buffering incoming data that cannot be * processed. * * See DNP3ParseResponsePDUs for DNP3 frame handling. */ static int DNP3ParseResponse(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); DNP3State *dnp3 = (DNP3State *)state; DNP3Buffer *buffer = &dnp3->response_buffer; int processed; if (buffer->len) { if (!DNP3BufferAdd(buffer, input, input_len)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory to buffer " "DNP3 response data"); goto error; } processed = DNP3HandleResponseLinkLayer(dnp3, buffer->buffer + buffer->offset, buffer->len - buffer->offset); if (processed < 0) { goto error; } buffer->offset += processed; DNP3BufferTrim(buffer); } else { /* Check if this is a banner, ignore if it is. */ if (DNP3ContainsBanner(input, input_len)) { goto done; } processed = DNP3HandleResponseLinkLayer(dnp3, input, input_len); if (processed < 0) { goto error; } input += processed; input_len -= processed; /* Not all data was processed, buffer it. */ if (input_len) { if (!DNP3BufferAdd(buffer, input, input_len)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory to buffer DNP3 response data"); goto error; } } } done: SCReturnInt(1); error: /* An error occurred while processing DNP3 frames. Dump the * buffer as we can't be assured that they are valid anymore. */ DNP3BufferReset(buffer); SCReturnInt(-1); } static AppLayerDecoderEvents *DNP3GetEvents(void *state, uint64_t tx_id) { DNP3State *dnp3 = state; DNP3Transaction *tx; uint64_t tx_num = tx_id + 1; if (dnp3->curr && dnp3->curr->tx_num == tx_num) { return dnp3->curr->decoder_events; } TAILQ_FOREACH(tx, &dnp3->tx_list, next) { if (tx->tx_num == tx_num) { return tx->decoder_events; } } return NULL; } static int DNP3HasEvents(void *state) { SCEnter(); uint16_t events = (((DNP3State *)state)->events); SCReturnInt((events > 0)); } static void *DNP3GetTx(void *alstate, uint64_t tx_id) { SCEnter(); DNP3State *dnp3 = (DNP3State *)alstate; DNP3Transaction *tx = NULL; uint64_t tx_num = tx_id + 1; if (dnp3->curr && dnp3->curr->tx_num == (tx_num)) { SCReturnPtr(dnp3->curr, "void"); } TAILQ_FOREACH(tx, &dnp3->tx_list, next) { if (tx_num != tx->tx_num) { continue; } SCReturnPtr(tx, "void"); } SCReturnPtr(NULL, "void"); } static uint64_t DNP3GetTxCnt(void *state) { SCEnter(); uint64_t count = ((uint64_t)((DNP3State *)state)->transaction_max); SCReturnUInt(count); } /** * \brief Free all the objects in a DNP3ObjectList. */ static void DNP3TxFreeObjectList(DNP3ObjectList *objects) { DNP3Object *object; while ((object = TAILQ_FIRST(objects)) != NULL) { TAILQ_REMOVE(objects, object, next); DNP3ObjectFree(object); } } /** * \brief Free a DNP3 transaction. */ static void DNP3TxFree(DNP3Transaction *tx) { SCEnter(); if (tx->request_buffer != NULL) { SCFree(tx->request_buffer); } if (tx->response_buffer != NULL) { SCFree(tx->response_buffer); } AppLayerDecoderEventsFreeEvents(&tx->decoder_events); if (tx->de_state != NULL) { DetectEngineStateFree(tx->de_state); } DNP3TxFreeObjectList(&tx->request_objects); DNP3TxFreeObjectList(&tx->response_objects); SCFree(tx); SCReturn; } /** * \brief Free a transaction by ID on a specific DNP3 state. * * This function is called by the app-layer to free a transaction on a * specific DNP3 state object. */ static void DNP3StateTxFree(void *state, uint64_t tx_id) { SCEnter(); DNP3State *dnp3 = state; DNP3Transaction *tx = NULL, *ttx; uint64_t tx_num = tx_id + 1; TAILQ_FOREACH_SAFE(tx, &dnp3->tx_list, next, ttx) { if (tx->tx_num != tx_num) { continue; } if (tx == dnp3->curr) { dnp3->curr = NULL; } if (tx->decoder_events != NULL) { if (tx->decoder_events->cnt <= dnp3->events) { dnp3->events -= tx->decoder_events->cnt; } else { dnp3->events = 0; } } dnp3->unreplied--; /* Check flood state. */ if (dnp3->flooded && dnp3->unreplied < DNP3_DEFAULT_REQ_FLOOD_COUNT) { dnp3->flooded = 0; } TAILQ_REMOVE(&dnp3->tx_list, tx, next); DNP3TxFree(tx); break; } SCReturn; } /** * \brief Free a DNP3 state. */ static void DNP3StateFree(void *state) { SCEnter(); DNP3State *dnp3 = state; DNP3Transaction *tx; if (state != NULL) { while ((tx = TAILQ_FIRST(&dnp3->tx_list)) != NULL) { TAILQ_REMOVE(&dnp3->tx_list, tx, next); DNP3TxFree(tx); } if (dnp3->request_buffer.buffer != NULL) { SCFree(dnp3->request_buffer.buffer); } if (dnp3->response_buffer.buffer != NULL) { SCFree(dnp3->response_buffer.buffer); } SCFree(dnp3); } SCReturn; } /** * \brief Called by the app-layer to get the state progress. */ static int DNP3GetAlstateProgress(void *tx, uint8_t direction) { DNP3Transaction *dnp3tx = (DNP3Transaction *)tx; DNP3State *dnp3 = dnp3tx->dnp3; int retval = 0; /* If flooded, "ack" old transactions. */ if (dnp3->flooded && (dnp3->transaction_max - dnp3tx->tx_num >= DNP3_DEFAULT_REQ_FLOOD_COUNT)) { SCLogDebug("flooded: returning tx as done."); SCReturnInt(1); } if (direction & STREAM_TOCLIENT && dnp3tx->response_done) { retval = 1; } else if (direction & STREAM_TOSERVER && dnp3tx->request_done) { retval = 1; } SCReturnInt(retval); } /** * \brief App-layer support. */ static int DNP3GetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } /** * \brief App-layer support. */ static int DNP3StateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, dnp3_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "Event \"%s\" not present in " "the DNP3 enum event map table.", event_name); return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } /** * \brief App-layer support. */ static DetectEngineState *DNP3GetTxDetectState(void *vtx) { DNP3Transaction *tx = vtx; return tx->de_state; } /** * \brief App-layer support. */ static int DNP3SetTxDetectState(void *state, void *vtx, DetectEngineState *s) { DNP3Transaction *tx = vtx; tx->de_state = s; return 0; } static void DNP3SetTxLogged(void *alstate, void *vtx, uint32_t logger) { DNP3Transaction *tx = (DNP3Transaction *)vtx; tx->logged |= logger; } static int DNP3GetTxLogged(void *alstate, void *vtx, uint32_t logger) { DNP3Transaction *tx = (DNP3Transaction *)vtx; if (tx->logged & logger) { return 1; } return 0; } /** * \brief Check if the prefix code is a size prefix. * * \retval 1 if the prefix_code specifies a size prefix, 0 if not. */ int DNP3PrefixIsSize(uint8_t prefix_code) { switch (prefix_code) { case 0x04: case 0x05: case 0x06: return 1; break; default: return 0; } } /** * \brief Register the DNP3 application protocol parser. */ void RegisterDNP3Parsers(void) { SCEnter(); char *proto_name = "dnp3"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_DNP3, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, DNP3_DEFAULT_PORT, ALPROTO_DNP3, 0, sizeof(DNP3LinkHeader), STREAM_TOSERVER, DNP3ProbingParser, NULL); } else { if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_DNP3, 0, sizeof(DNP3LinkHeader), DNP3ProbingParser, NULL)) { #ifndef AFLFUZZ_APPLAYER return; #endif } } } else { SCLogConfig("Protocol detection and parser disabled for DNP3."); SCReturn; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { SCLogConfig("Registering DNP3/tcp parsers."); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DNP3, STREAM_TOSERVER, DNP3ParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DNP3, STREAM_TOCLIENT, DNP3ParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DNP3, DNP3StateAlloc, DNP3StateFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_DNP3, DNP3HasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_DNP3, NULL, DNP3GetTxDetectState, DNP3SetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetTxCnt); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_DNP3, DNP3StateTxFree); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_DNP3, DNP3GetAlstateProgressCompletionStatus); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_DNP3, DNP3StateGetEventInfo); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetTxLogged, DNP3SetTxLogged); } else { SCLogConfig("Parser disabled for protocol %s. " "Protocol detection still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_DNP3, DNP3ParserRegisterTests); #endif SCReturn; } #ifdef UNITTESTS #include "flow-util.h" #include "stream-tcp.h" /** * \brief Utility function to fix CRCs when mangling a frame. */ static void DNP3FixCrc(uint8_t *data, uint32_t len) { uint32_t block_size; while (len) { if (len >= DNP3_BLOCK_SIZE + DNP3_CRC_LEN) { block_size = DNP3_BLOCK_SIZE; } else { block_size = len - DNP3_CRC_LEN; } uint16_t crc = DNP3ComputeCRC(data, block_size); data[block_size + 1] = (crc >> 8) & 0xff; data[block_size] = crc & 0xff; data += block_size + DNP3_CRC_LEN; len -= block_size + DNP3_CRC_LEN; } } /** * \test Test CRC checking on partial and full blocks. */ static int DNP3ParserTestCheckCRC(void) { uint8_t request[] = { /* DNP3 start. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer - segment 1. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* Application layer - segment 2. */ 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; /* Check link header CRC. */ FAIL_IF(!DNP3CheckCRC(request, sizeof(DNP3LinkHeader))); /* Check first application layer segment. */ FAIL_IF(!DNP3CheckCRC(request + sizeof(DNP3LinkHeader), DNP3_BLOCK_SIZE + DNP3_CRC_LEN)); /* Change a byte in link header, should fail now. */ request[2]++; FAIL_IF(DNP3CheckCRC(request, sizeof(DNP3LinkHeader))); /* Change a byte in the first application segment, should fail * now. */ request[sizeof(DNP3LinkHeader) + 3]++; FAIL_IF(DNP3CheckCRC(request + sizeof(DNP3LinkHeader), DNP3_BLOCK_SIZE + DNP3_CRC_LEN)); PASS; } /** * \test Test validation of all CRCs in user data. */ static int DNP3CheckUserDataCRCsTest(void) { /* Multi-block data with valid CRCs. */ uint8_t data_valid[] = { 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, /* CRC. */ }; FAIL_IF(!DNP3CheckUserDataCRCs(data_valid, sizeof(data_valid))); /* Multi-block data with one non-crc byte altered. */ uint8_t data_invalid[] = { 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0x00, 0x00, 0x00, 0x00, 0x01, /* Invalid byte. */ 0xff, 0xff, /* CRC. */ }; FAIL_IF(DNP3CheckUserDataCRCs(data_invalid, sizeof(data_invalid))); /* 1 byte - need at least 3. */ uint8_t one_byte_nocrc[] = { 0x01 }; FAIL_IF(DNP3CheckUserDataCRCs(one_byte_nocrc, sizeof(one_byte_nocrc))); /* 2 bytes - need at least 3. */ uint8_t two_byte_nocrc[] = { 0x01, 0x02 }; FAIL_IF(DNP3CheckUserDataCRCs(two_byte_nocrc, sizeof(two_byte_nocrc))); /* 3 bytes, valid CRC. */ uint8_t three_bytes_good_crc[] = { 0x00, 0x00, 0x00 }; *(uint16_t *)(three_bytes_good_crc + 1) = DNP3ComputeCRC( three_bytes_good_crc, 1); FAIL_IF(!DNP3CheckUserDataCRCs(three_bytes_good_crc, sizeof(three_bytes_good_crc))); PASS; } /** * \test Test the link layer length calculation. * * Test the calculation that converts the link provided in the DNP3 * header to the actual length of the frame. That is the length with * CRCs as the length in the header does not include CRCs. */ static int DNP3CalculateLinkLengthTest(void) { /* These are invalid. */ FAIL_IF(DNP3CalculateLinkLength(0) != 0); FAIL_IF(DNP3CalculateLinkLength(1) != 0); FAIL_IF(DNP3CalculateLinkLength(2) != 0); FAIL_IF(DNP3CalculateLinkLength(3) != 0); FAIL_IF(DNP3CalculateLinkLength(4) != 0); /* This is the minimum size. */ FAIL_IF(DNP3CalculateLinkLength(5) != 10); /* 1 full user data blocks of data. */ FAIL_IF(DNP3CalculateLinkLength(21) != 28); /* 2 full user data blocks of data. */ FAIL_IF(DNP3CalculateLinkLength(37) != 46); /* 2 full user data blocks, plus one more byte. */ /* 2 full user data blocks of data. */ FAIL_IF(DNP3CalculateLinkLength(38) != 49); /* The maximum size. */ FAIL_IF(DNP3CalculateLinkLength(255) != 292); PASS; } /** * \test The conversion of length with CRCs to the length without * CRCs. */ static int DNP3CalculateTransportLengthWithoutCRCsTest(void) { FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(0) != -1); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(1) != -1); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(2) != 0); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(3) != 1); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(16) != 14); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(17) != 15); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(18) != 16); /* 19 bytes is not enough for a second block. */ FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(19) != -1); /* 20 bytes really isn't enough either, but is large enough to * satisfy the CRC on the second block. */ FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(20) != 16); FAIL_IF(DNP3CalculateTransportLengthWithoutCRCs(21) != 17); PASS; } /** * \test Test the validation of the link header CRC. */ static int DNP3ParserCheckLinkHeaderCRC(void) { /* DNP3 frame with valid headers and CRCs. */ uint8_t request[] = { /* DNP3 start. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; DNP3LinkHeader *header = (DNP3LinkHeader *)request; FAIL_IF(!DNP3CheckLinkHeaderCRC(header)); /* Alter a byte in the header. */ request[4] = 0; FAIL_IF(DNP3CheckLinkHeaderCRC(header)); PASS; } /** * \test Test removal of CRCs from user data. */ static int DNP3ReassembleApplicationLayerTest01(void) { uint32_t reassembled_len = 0; uint8_t *output = NULL; uint8_t payload[] = { 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, /* CRC. */ }; uint8_t expected[] = { 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, /* CRC removed. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, /* CRC removed. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, /* CRC removed. */ 0x00, 0x00, 0x00, 0x00, 0x00 /* CRC removed. */ }; /* Valid frame. */ FAIL_IF(!DNP3ReassembleApplicationLayer(payload, sizeof(payload), &output, &reassembled_len)); FAIL_IF(output == NULL); FAIL_IF(reassembled_len != sizeof(expected)); FAIL_IF(memcmp(expected, output, reassembled_len)); SCFree(output); /* 1 byte, invalid. */ reassembled_len = 0; output = NULL; FAIL_IF(DNP3ReassembleApplicationLayer(payload, 1, &output, &reassembled_len)); FAIL_IF(output != NULL); FAIL_IF(reassembled_len != 0); /* 2 bytes, invalid. */ reassembled_len = 0; output = NULL; FAIL_IF(DNP3ReassembleApplicationLayer(payload, 2, &output, &reassembled_len)); FAIL_IF(output != NULL); FAIL_IF(reassembled_len != 0); /* 3 bytes, minimum - but that would only be the transport header * which isn't included in the output. */ reassembled_len = 0; output = NULL; FAIL_IF(DNP3ReassembleApplicationLayer(payload, 3, &output, &reassembled_len)); FAIL_IF(output != NULL); FAIL_IF(reassembled_len != 0); /* 4 bytes is the minimum to get any reassembled data. */ reassembled_len = 0; output = NULL; FAIL_IF(!DNP3ReassembleApplicationLayer(payload, 4, &output, &reassembled_len)); FAIL_IF(output == NULL); FAIL_IF(reassembled_len != 1); /* Last block too short (by 1 byte) for data + CRC. */ uint8_t short_payload1[] = { 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0x00, 0x00 }; reassembled_len = 0; FAIL_IF(DNP3ReassembleApplicationLayer(short_payload1, sizeof(short_payload1), &output, &reassembled_len)); /* Last block too short (by 2 bytes) for data + CRC. */ uint8_t short_payload2[] = { 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0xff, 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, /* CRC. */ 0x00, }; reassembled_len = 0; FAIL_IF(DNP3ReassembleApplicationLayer(short_payload2, sizeof(short_payload2), &output, &reassembled_len)); PASS; } /** * \test Test the probing parser. */ static int DNP3ProbingParserTest(void) { uint8_t pkt[] = { 0x05, 0x64, 0x05, 0xc9, 0x03, 0x00, 0x04, 0x00, 0xbd, 0x71 }; /* Valid frame. */ FAIL_IF(DNP3ProbingParser(pkt, sizeof(pkt), NULL) != ALPROTO_DNP3); /* Send too little bytes. */ FAIL_IF(DNP3ProbingParser(pkt, sizeof(DNP3LinkHeader) - 1, NULL) != ALPROTO_UNKNOWN); /* Bad start bytes. */ pkt[0] = 0x06; FAIL_IF(DNP3ProbingParser(pkt, sizeof(pkt), NULL) != ALPROTO_FAILED); /* Restore start byte. */ pkt[0] = 0x05; /* Set the length to a value less than the minimum length of 5. */ pkt[2] = 0x03; FAIL_IF(DNP3ProbingParser(pkt, sizeof(pkt), NULL) != ALPROTO_FAILED); /* Send a banner. */ char mybanner[] = "Welcome to DNP3 SCADA."; FAIL_IF(DNP3ProbingParser((uint8_t *)mybanner, sizeof(mybanner), NULL) != ALPROTO_DNP3); PASS; } /** * \test Test a basic request/response. */ int DNP3ParserTestRequestResponse(void) { DNP3State *state = NULL; uint8_t request[] = { /* DNP3 start. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; uint8_t response[] = { /* DNP3 start. */ 0x05, 0x64, 0x1c, 0x44, 0x01, 0x00, 0x02, 0x00, 0xe2, 0x59, /* Transport header. */ 0xc3, /* Application layer. */ 0xc9, 0x81, 0x00, 0x00, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x7a, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow flow; TcpSession ssn; memset(&flow, 0, sizeof(flow)); memset(&ssn, 0, sizeof(ssn)); flow.protoctx = (void *)&ssn; flow.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request))); SCMutexUnlock(&flow.m); state = flow.alstate; FAIL_IF(state == NULL); FAIL_IF(DNP3HasEvents(state)); DNP3Transaction *tx = DNP3GetTx(state, 0); FAIL_IF(tx == NULL); FAIL_IF(tx->tx_num != 1); FAIL_IF(tx != state->curr); FAIL_IF(tx->request_buffer == NULL); FAIL_IF(tx->request_buffer_len != 20); FAIL_IF(tx->request_ah.function_code != DNP3_APP_FC_DIR_OPERATE); SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOCLIENT, response, sizeof(response))); SCMutexUnlock(&flow.m); FAIL_IF(DNP3GetTx(state, 0) != tx); FAIL_IF(!tx->response_done); FAIL_IF(tx->response_buffer == NULL); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&flow); DNP3StateFree(state); PASS; } /** * \test Test an unsolicited response from an outstation. * * This is kind of like a request initiated from the "server". */ static int DNP3ParserTestUnsolicitedResponseConfirm(void) { DNP3State *state = NULL; /* Unsolicited response with confirm bit set. */ uint8_t response[] = { 0x05, 0x64, 0x16, 0x44, 0x01, 0x00, 0x02, 0x00, 0x89, 0xe5, 0xc4, 0xfa, 0x82, 0x00, 0x00, 0x02, 0x02, 0x17, 0x01, 0x01, 0x81, 0xa7, 0x75, 0xd8, 0x32, 0x4c, 0x81, 0x3e, 0x01, 0xa1, 0xc9 }; /* Confirm. */ uint8_t confirm[] = { 0x05, 0x64, 0x08, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xd3, 0xb7, 0xc0, 0xda, 0x00, 0x6a, 0x3d }; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow flow; TcpSession ssn; memset(&flow, 0, sizeof(flow)); memset(&ssn, 0, sizeof(ssn)); flow.protoctx = (void *)&ssn; flow.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOCLIENT, response, sizeof(response))); SCMutexUnlock(&flow.m); state = flow.alstate; FAIL_IF(state == NULL); FAIL_IF(DNP3HasEvents(state)); DNP3Transaction *tx = DNP3GetTx(state, 0); FAIL_IF(tx == NULL); FAIL_IF(tx->tx_num != 1); FAIL_IF(tx != state->curr); FAIL_IF(tx->request_buffer != NULL); FAIL_IF(tx->response_buffer == NULL); FAIL_IF(!tx->response_done); FAIL_IF(tx->response_ah.function_code != DNP3_APP_FC_UNSOLICITED_RESP); SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, confirm, sizeof(confirm))); SCMutexUnlock(&flow.m); FAIL_IF(DNP3GetTx(state, 0) != tx); FAIL_IF(!tx->response_done); FAIL_IF(tx->response_buffer == NULL); /* FAIL_IF(tx->iin1 != 0 || tx->iin2 != 0); */ AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&flow); DNP3StateFree(state); PASS; } /** * \test Test flood state. */ int DNP3ParserTestFlooded(void) { DNP3State *state = NULL; uint8_t request[] = { /* DNP3 start. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow flow; TcpSession ssn; memset(&flow, 0, sizeof(flow)); memset(&ssn, 0, sizeof(ssn)); flow.protoctx = (void *)&ssn; flow.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request))); SCMutexUnlock(&flow.m); state = flow.alstate; FAIL_IF(state == NULL); FAIL_IF(DNP3HasEvents(state)); DNP3Transaction *tx = DNP3GetTx(state, 0); FAIL_IF(tx == NULL); FAIL_IF(tx->tx_num != 1); FAIL_IF(tx != state->curr); FAIL_IF(tx->request_buffer == NULL); FAIL_IF(tx->request_buffer_len != 20); /* FAIL_IF(tx->app_function_code != DNP3_APP_FC_DIR_OPERATE); */ FAIL_IF(tx->response_done); for (int i = 0; i < DNP3_DEFAULT_REQ_FLOOD_COUNT - 1; i++) { SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request))); SCMutexUnlock(&flow.m); } FAIL_IF(state->flooded); FAIL_IF(DNP3GetAlstateProgress(tx, 0)); /* One more request should trip us into flooded state. */ SCMutexLock(&flow.m); FAIL_IF(AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request, sizeof(request))); SCMutexUnlock(&flow.m); FAIL_IF(!state->flooded); /* Progress for the oldest tx should return 1. */ FAIL_IF(!DNP3GetAlstateProgress(tx, 0)); /* But progress for the current state should still return 0. */ FAIL_IF(DNP3GetAlstateProgress(state->curr, 0)); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&flow); DNP3StateFree(state); PASS; } /** * \test Test parsing of partial frames. * * As DNP3 operates over TCP, it is possible that a partial DNP3 frame * is received. Test that the partial frame will be buffered until the * remainder is seen. */ static int DNP3ParserTestPartialFrame(void) { DNP3State *state = NULL; DNP3Transaction *tx; int r; uint8_t request_partial1[] = { /* DNP3 start. */ 0x05, 0x64, 0x1a, 0xc4, 0x02, 0x00, 0x01, 0x00, 0xa5, 0xe9, /* Transport header. */ 0xff, /* Application layer. */ 0xc9, 0x05, 0x0c, 0x01, 0x28, 0x01, 0x00, 0x00, }; uint8_t request_partial2[] = { /* Remainder of application layer. */ 0x00, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x72, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; uint8_t response_partial1[] = { /* DNP3 start. */ 0x05, 0x64, 0x1c, 0x44, 0x01, 0x00, 0x02, 0x00, 0xe2, 0x59, /* Transport header. */ 0xc3, /* Application layer. */ 0xc9, 0x81, 0x00, 0x00, 0x0c, 0x01, 0x28, 0x01, }; uint8_t response_partial2[] = { 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x00, 0x7a, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff }; /* Boiler plate for app layer setup. */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow flow; TcpSession ssn; memset(&flow, 0, sizeof(flow)); memset(&ssn, 0, sizeof(ssn)); flow.protoctx = (void *)&ssn; flow.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); /* Pass in the first partial frame. */ SCMutexLock(&flow.m); r = AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request_partial1, sizeof(request_partial1)); SCMutexUnlock(&flow.m); FAIL_IF(r != 0); /* Frame should just be buffered, but not yet processed. */ state = flow.alstate; FAIL_IF(state == NULL); FAIL_IF(state->request_buffer.len != sizeof(request_partial1)); FAIL_IF(state->request_buffer.offset != 0); FAIL_IF(memcmp(state->request_buffer.buffer, request_partial1, sizeof(request_partial1))); /* There should not be a transaction yet. */ FAIL_IF(state->transaction_max != 0); FAIL_IF(DNP3GetTx(state, 0) != NULL); /* Send the second partial. */ SCMutexLock(&flow.m); r = AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOSERVER, request_partial2, sizeof(request_partial2)); SCMutexUnlock(&flow.m); FAIL_IF(r != 0); /* The second partial completed the frame, the buffer should now * be clear. */ FAIL_IF(state->request_buffer.len != 0); FAIL_IF(state->request_buffer.offset != 0); /* Should now have a complete transaction. */ tx = DNP3GetTx(state, 0); FAIL_IF(tx == NULL); FAIL_IF(tx->tx_num != 1); FAIL_IF(tx != state->curr); FAIL_IF(tx->request_buffer == NULL); FAIL_IF(tx->request_buffer_len != 20); FAIL_IF(tx->request_ah.function_code != DNP3_APP_FC_DIR_OPERATE); /* Send partial response. */ SCMutexLock(&flow.m); r = AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOCLIENT, response_partial1, sizeof(response_partial1)); SCMutexUnlock(&flow.m); FAIL_IF(r != 0); FAIL_IF(state->response_buffer.len != sizeof(response_partial1)); FAIL_IF(state->response_buffer.offset != 0); FAIL_IF(tx->response_done); /* Send rest of response. */ SCMutexLock(&flow.m); r = AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOCLIENT, response_partial2, sizeof(response_partial2)); SCMutexUnlock(&flow.m); FAIL_IF(r != 0); /* Buffer should now be empty. */ FAIL_IF(state->response_buffer.len != 0); FAIL_IF(state->response_buffer.offset != 0); /* Transaction should be replied to now. */ FAIL_IF(!tx->response_done); FAIL_IF(tx->response_buffer == NULL); FAIL_IF(tx->response_buffer_len == 0); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&flow); DNP3StateFree(state); PASS; } /** * \test Test multiple DNP3 frames in one TCP read. */ static int DNP3ParserTestMultiFrame(void) { DNP3State *state = NULL; /* Unsolicited response 1. */ uint8_t unsol_response1[] = { 0x05, 0x64, 0x16, 0x44, 0x01, 0x00, 0x02, 0x00, 0x89, 0xe5, 0xc4, 0xfa, 0x82, 0x00, 0x00, 0x02, 0x02, 0x17, 0x01, 0x01, 0x81, 0xa7, 0x75, 0xd8, 0x32, 0x4c, 0x81, 0x3e, 0x01, 0xa1, 0xc9, }; /* Unsolicited response 2. */ uint8_t unsol_response2[] = { 0x05, 0x64, 0x16, 0x44, 0x01, 0x00, 0x02, 0x00, 0x89, 0xe5, 0xc5, 0xfb, 0x82, 0x00, 0x00, 0x02, 0x02, 0x17, 0x01, 0x0c, 0x01, 0xd8, 0x75, 0xd8, 0x32, 0x4c, 0xc9, 0x3c, 0x01, 0xa1, 0xc9, }; uint8_t combined[sizeof(unsol_response1) + sizeof(unsol_response2)]; memcpy(combined, unsol_response1, sizeof(unsol_response1)); memcpy(combined + sizeof(unsol_response1), unsol_response2, sizeof(unsol_response2)); /* Setup. */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); Flow flow; TcpSession ssn; int r; memset(&flow, 0, sizeof(flow)); memset(&ssn, 0, sizeof(ssn)); flow.protoctx = (void *)&ssn; flow.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCMutexLock(&flow.m); r = AppLayerParserParse(NULL, alp_tctx, &flow, ALPROTO_DNP3, STREAM_TOCLIENT, combined, sizeof(combined)); SCMutexUnlock(&flow.m); FAIL_IF(r != 0); state = flow.alstate; FAIL_IF(state == NULL); FAIL_IF(state->transaction_max != 2); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&flow); DNP3StateFree(state); PASS; } /** * \test Test the parsing of a request PDU. * * The PDU under test contains a single read request object: * - Group: 1 * - Variation: 0 * - Count: 0 */ static int DNP3ParserTestParsePDU01(void) { /* Frame to be tested. This frame is a DNP3 request with one read * request data object, group 1, variation 0. */ const uint8_t pkt[] = { 0x05, 0x64, 0x0b, 0xc4, 0x17, 0x00, 0xef, 0xff, 0xc4, 0x8f, 0xe1, 0xc8, 0x01, 0x01, 0x00, 0x06, 0x77, 0x6e }; DNP3State *dnp3state = DNP3StateAlloc(); int pdus = DNP3HandleRequestLinkLayer(dnp3state, pkt, sizeof(pkt)); FAIL_IF(pdus < 1); DNP3Transaction *dnp3tx = DNP3GetTx(dnp3state, 0); FAIL_IF_NULL(dnp3tx); FAIL_IF(!dnp3tx->has_request); FAIL_IF(TAILQ_EMPTY(&dnp3tx->request_objects)); DNP3Object *object = TAILQ_FIRST(&dnp3tx->request_objects); FAIL_IF(object->group != 1 || object->variation != 0); FAIL_IF(object->count != 0); DNP3StateFree(dnp3state); PASS; } /** * \test Test the decode of a DNP3 fragment with a single 70:3 object. */ static int DNP3ParserDecodeG70V3Test(void) { const uint8_t pkt[] = { 0x05, 0x64, 0x63, 0xc4, 0x04, 0x00, 0x03, 0x00, 0xc7, 0xee, 0xc7, 0xc9, 0x1b, 0x46, 0x03, 0x5b, 0x01, 0x55, 0x00, 0x1a, 0x00, 0x3b, 0x00, 0x00, 0x00, 0x00, 0x9e, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x1e, 0x00, 0x43, 0x3a, 0x2f, 0x74, 0x65, 0x6d, 0x70, 0x2f, 0x44, 0x4e, 0x50, 0x44, 0x65, 0x67, 0x7d, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x93, 0x0c, 0x6e, 0x20, 0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e, 0x20, 0x74, 0x6f, 0x20, 0x52, 0x65, 0x6d, 0x35, 0x20, 0x6f, 0x74, 0x65, 0x20, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x78, 0x6d, 0x6c, 0xc4, 0x8b }; DNP3State *dnp3state = DNP3StateAlloc(); FAIL_IF_NULL(dnp3state); int bytes = DNP3HandleRequestLinkLayer(dnp3state, pkt, sizeof(pkt)); FAIL_IF(bytes != sizeof(pkt)); FAIL_IF(DNP3HasEvents(dnp3state)); DNP3Transaction *tx = DNP3GetTx(dnp3state, 0); FAIL_IF_NULL(tx); FAIL_IF_NOT(tx->has_request); DNP3Object *obj = TAILQ_FIRST(&tx->request_objects); FAIL_IF_NULL(obj); FAIL_IF_NOT(obj->group == 70); FAIL_IF_NOT(obj->variation == 3); FAIL_IF_NOT(obj->prefix_code == 0x5); FAIL_IF_NOT(obj->range_code == 0xb); FAIL_IF_NOT(obj->count == 1); DNP3Point *point = TAILQ_FIRST(obj->points); FAIL_IF_NULL(point); FAIL_IF_NOT(point->prefix == 85); FAIL_IF_NOT(point->size == 85); FAIL_IF_NULL(point->data); DNP3ObjectG70V3 *data = point->data; FAIL_IF_NOT(strcmp( data->filename, "C:/temp/DNPDeviceConfiguration written to Remote Device.xml") == 0); DNP3StateFree(dnp3state); PASS; } /** * \brief Test that an alert is raised on an unknown object. */ static int DNP3ParserUnknownEventAlertTest(void) { /* Valid DNP3 frame with 70:3 object. */ uint8_t pkt[] = { 0x05, 0x64, 0x63, 0xc4, 0x04, 0x00, 0x03, 0x00, 0xc7, 0xee, 0xc7, 0xc9, 0x1b, /* Object and variation. Originally 70:3, now 70:99, an * unknown object. */ 0x46, 0x63, 0x5b, 0x01, 0x55, 0x00, 0x1a, 0x00, 0x3b, 0x00, 0x00, 0x00, 0x00, 0x9e, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x1e, 0x00, 0x43, 0x3a, 0x2f, 0x74, 0x65, 0x6d, 0x70, 0x2f, 0x44, 0x4e, 0x50, 0x44, 0x65, 0x67, 0x7d, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x93, 0x0c, 0x6e, 0x20, 0x77, 0x72, 0x69, 0x74, 0x74, 0x65, 0x6e, 0x20, 0x74, 0x6f, 0x20, 0x52, 0x65, 0x6d, 0x35, 0x20, 0x6f, 0x74, 0x65, 0x20, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x78, 0x6d, 0x6c, 0xc4, 0x8b }; DNP3FixCrc(pkt + 10, sizeof(pkt) - 10); DNP3State *dnp3state = DNP3StateAlloc(); FAIL_IF_NULL(dnp3state); int bytes = DNP3HandleRequestLinkLayer(dnp3state, pkt, sizeof(pkt)); FAIL_IF(bytes != sizeof(pkt)); /* Should have an event now. */ FAIL_IF_NOT(DNP3HasEvents(dnp3state)); DNP3StateFree(dnp3state); PASS; } #endif void DNP3ParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DNP3ParserTestCheckCRC", DNP3ParserTestCheckCRC); UtRegisterTest("DNP3ParserCheckLinkHeaderCRC", DNP3ParserCheckLinkHeaderCRC); UtRegisterTest("DNP3CheckUserDataCRCsTest", DNP3CheckUserDataCRCsTest); UtRegisterTest("DNP3CalculateLinkLengthTest", DNP3CalculateLinkLengthTest); UtRegisterTest("DNP3CalculateTransportLengthWithoutCRCsTest", DNP3CalculateTransportLengthWithoutCRCsTest); UtRegisterTest("DNP3ReassembleApplicationLayerTest01", DNP3ReassembleApplicationLayerTest01); UtRegisterTest("DNP3ProbingParserTest", DNP3ProbingParserTest); UtRegisterTest("DNP3ParserTestRequestResponse", DNP3ParserTestRequestResponse); UtRegisterTest("DNP3ParserTestUnsolicitedResponseConfirm", DNP3ParserTestUnsolicitedResponseConfirm); UtRegisterTest("DNP3ParserTestPartialFrame", DNP3ParserTestPartialFrame); UtRegisterTest("DNP3ParserTestMultiFrame", DNP3ParserTestMultiFrame); UtRegisterTest("DNP3ParserTestFlooded", DNP3ParserTestFlooded); UtRegisterTest("DNP3ParserTestParsePDU01", DNP3ParserTestParsePDU01); UtRegisterTest("DNP3ParserDecodeG70V3Test", DNP3ParserDecodeG70V3Test); UtRegisterTest("DNP3ParserUnknownEventAlertTest", DNP3ParserUnknownEventAlertTest); #endif } suricata-3.2.1/src/log-file.c0000644000000000000000000003335713051004444012656 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Log files we track. * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threadvars.h" #include "tm-modules.h" #include "threads.h" #include "app-layer-parser.h" #include "detect-filemagic.h" #include "stream.h" #include "util-print.h" #include "util-unittest.h" #include "util-privs.h" #include "util-debug.h" #include "util-atomic.h" #include "util-file.h" #include "util-time.h" #include "output.h" #include "log-file.h" #include "util-logopenfile.h" #include "app-layer-htp.h" #include "app-layer-smtp.h" #include "util-decode-mime.h" #include "util-memcmp.h" #include "stream-tcp-reassemble.h" #define MODULE_NAME "LogFileLog" #define DEFAULT_LOG_FILENAME "files-json.log" typedef struct LogFileLogThread_ { LogFileCtx *file_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t file_cnt; } LogFileLogThread; static void LogFileMetaGetUri(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud != NULL) { if (tx_ud->request_uri_normalized != NULL) { PrintRawJsonFp(fp, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); return; } } } } fprintf(fp, ""); } static void LogFileMetaGetHost(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL && tx->request_hostname != NULL) { PrintRawJsonFp(fp, (uint8_t *)bstr_ptr(tx->request_hostname), bstr_len(tx->request_hostname)); return; } } fprintf(fp, ""); } static void LogFileMetaGetReferer(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { htp_header_t *h = NULL; h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Referer"); if (h != NULL) { PrintRawJsonFp(fp, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value)); return; } } } fprintf(fp, ""); } static void LogFileMetaGetUserAgent(FILE *fp, const Packet *p, const File *ff) { HtpState *htp_state = (HtpState *)p->flow->alstate; if (htp_state != NULL) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, ff->txid); if (tx != NULL) { htp_header_t *h = NULL; h = (htp_header_t *)htp_table_get_c(tx->request_headers, "User-Agent"); if (h != NULL) { PrintRawJsonFp(fp, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value)); return; } } } fprintf(fp, ""); } static void LogFileMetaGetSmtp(FILE *fp, const Packet *p, const File *ff) { SMTPState *state = (SMTPState *) p->flow->alstate; if (state != NULL) { SMTPTransaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_SMTP, state, ff->txid); if (tx == NULL || tx->msg_tail == NULL) return; /* Message Id */ if (tx->msg_tail->msg_id != NULL) { fprintf(fp, "\"message-id\": \""); PrintRawJsonFp(fp, (uint8_t *) tx->msg_tail->msg_id, (int) tx->msg_tail->msg_id_len); fprintf(fp, "\", "); } /* Sender */ MimeDecField *field = MimeDecFindField(tx->msg_tail, "from"); if (field != NULL) { fprintf(fp, "\"sender\": \""); PrintRawJsonFp(fp, (uint8_t *) field->value, (int) field->value_len); fprintf(fp, "\", "); } } } /** * \internal * \brief Write meta data on a single line json record */ static void LogFileWriteJsonRecord(LogFileLogThread *aft, const Packet *p, const File *ff, int ipver) { SCMutexLock(&aft->file_ctx->fp_mutex); /* As writes are done via the LogFileCtx, check for rotation here. */ if (aft->file_ctx->rotation_flag) { aft->file_ctx->rotation_flag = 0; if (SCConfLogReopen(aft->file_ctx) != 0) { SCLogWarning(SC_ERR_FOPEN, "Failed to re-open log file. " "Logging for this module will be disabled."); } } /* Bail early if no file pointer to write to (in the unlikely * event file rotation failed. */ if (aft->file_ctx->fp == NULL) { SCMutexUnlock(&aft->file_ctx->fp_mutex); return; } FILE *fp = aft->file_ctx->fp; char timebuf[64]; AppProto alproto = FlowGetAppProtocol(p->flow); CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); fprintf(fp, "{ "); if (ff->file_id > 0) fprintf(fp, "\"id\": %u, ", ff->file_id); fprintf(fp, "\"timestamp\": \""); PrintRawJsonFp(fp, (uint8_t *)timebuf, strlen(timebuf)); fprintf(fp, "\", "); if (p->pcap_cnt > 0) { fprintf(fp, "\"pcap_pkt_num\": %"PRIu64", ", p->pcap_cnt); } fprintf(fp, "\"ipver\": %d, ", ipver == AF_INET ? 4 : 6); char srcip[46], dstip[46]; Port sp, dp; switch (ipver) { case AF_INET: PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); break; case AF_INET6: PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); break; default: strlcpy(srcip, "", sizeof(srcip)); strlcpy(dstip, "", sizeof(dstip)); break; } sp = p->sp; dp = p->dp; fprintf(fp, "\"srcip\": \"%s\", ", srcip); fprintf(fp, "\"dstip\": \"%s\", ", dstip); fprintf(fp, "\"protocol\": %" PRIu32 ", ", p->proto); if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) { fprintf(fp, "\"sp\": %" PRIu16 ", ", sp); fprintf(fp, "\"dp\": %" PRIu16 ", ", dp); } if (alproto == ALPROTO_HTTP) { fprintf(fp, "\"http_uri\": \""); LogFileMetaGetUri(fp, p, ff); fprintf(fp, "\", "); fprintf(fp, "\"http_host\": \""); LogFileMetaGetHost(fp, p, ff); fprintf(fp, "\", "); fprintf(fp, "\"http_referer\": \""); LogFileMetaGetReferer(fp, p, ff); fprintf(fp, "\", "); fprintf(fp, "\"http_user_agent\": \""); LogFileMetaGetUserAgent(fp, p, ff); fprintf(fp, "\", "); } else if (p->flow->alproto == ALPROTO_SMTP) { /* Only applicable to SMTP */ LogFileMetaGetSmtp(fp, p, ff); } fprintf(fp, "\"filename\": \""); PrintRawJsonFp(fp, ff->name, ff->name_len); fprintf(fp, "\", "); #ifdef HAVE_MAGIC fprintf(fp, "\"magic\": \""); if (ff->magic) { PrintRawJsonFp(fp, (uint8_t *)ff->magic, strlen(ff->magic)); } else { fprintf(fp, "unknown"); } fprintf(fp, "\", "); #endif switch (ff->state) { case FILE_STATE_CLOSED: fprintf(fp, "\"state\": \"CLOSED\", "); #ifdef HAVE_NSS if (ff->flags & FILE_MD5) { fprintf(fp, "\"md5\": \""); size_t x; for (x = 0; x < sizeof(ff->md5); x++) { fprintf(fp, "%02x", ff->md5[x]); } fprintf(fp, "\", "); } if (ff->flags & FILE_SHA1) { fprintf(fp, "\"sha1\": \""); size_t x; for (x = 0; x < sizeof(ff->sha1); x++) { fprintf(fp, "%02x", ff->sha1[x]); } fprintf(fp, "\", "); } if (ff->flags & FILE_SHA256) { fprintf(fp, "\"sha256\": \""); size_t x; for (x = 0; x < sizeof(ff->sha256); x++) { fprintf(fp, "%02x", ff->sha256[x]); } fprintf(fp, "\", "); } #endif break; case FILE_STATE_TRUNCATED: fprintf(fp, "\"state\": \"TRUNCATED\", "); break; case FILE_STATE_ERROR: fprintf(fp, "\"state\": \"ERROR\", "); break; default: fprintf(fp, "\"state\": \"UNKNOWN\", "); break; } fprintf(fp, "\"stored\": %s, ", ff->flags & FILE_STORED ? "true" : "false"); fprintf(fp, "\"size\": %"PRIu64" ", FileTrackedSize(ff)); fprintf(fp, "}\n"); fflush(fp); SCMutexUnlock(&aft->file_ctx->fp_mutex); } static int LogFileLogger(ThreadVars *tv, void *thread_data, const Packet *p, const File *ff) { SCEnter(); LogFileLogThread *aft = (LogFileLogThread *)thread_data; int ipver = -1; if (PKT_IS_IPV4(p)) { ipver = AF_INET; } else if (PKT_IS_IPV6(p)) { ipver = AF_INET6; } else { return 0; } BUG_ON(ff->flags & FILE_LOGGED); SCLogDebug("ff %p", ff); LogFileWriteJsonRecord(aft, p, ff, ipver); aft->file_cnt++; return 0; } static TmEcode LogFileLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogFileLogThread *aft = SCMalloc(sizeof(LogFileLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogFileLogThread)); if (initdata == NULL) { SCLogDebug("Error getting context for LogFile. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->file_ctx = ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } TmEcode LogFileLogThreadDeinit(ThreadVars *t, void *data) { LogFileLogThread *aft = (LogFileLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } /* clear memory */ memset(aft, 0, sizeof(LogFileLogThread)); SCFree(aft); return TM_ECODE_OK; } void LogFileLogExitPrintStats(ThreadVars *tv, void *data) { LogFileLogThread *aft = (LogFileLogThread *)data; if (aft == NULL) { return; } SCLogInfo("(%s) Files logged: %" PRIu32 "", tv->name, aft->file_cnt); } /** * \internal * * \brief deinit the log ctx and write out the waldo * * \param output_ctx output context to deinit */ static void LogFileLogDeInitCtx(OutputCtx *output_ctx) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; LogFileFreeCtx(logfile_ctx); free(output_ctx); } /** \brief Create a new http log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ static OutputCtx *LogFileLogInitCtx(ConfNode *conf) { LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { SCLogDebug("Could not create new LogFileCtx"); return NULL; } if (SCConfLogOpenGeneric(conf, logfile_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(logfile_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) return NULL; output_ctx->data = logfile_ctx; output_ctx->DeInit = LogFileLogDeInitCtx; const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore"); if (force_filestore != NULL && ConfValIsTrue(force_filestore)) { FileForceFilestoreEnable(); SCLogInfo("forcing filestore of all files"); } const char *force_magic = ConfNodeLookupChildValue(conf, "force-magic"); if (force_magic != NULL && ConfValIsTrue(force_magic)) { FileForceMagicEnable(); SCLogInfo("forcing magic lookup for logged files"); } FileForceHashParseCfg(conf); FileForceTrackingEnable(); SCReturnPtr(output_ctx, "OutputCtx"); } /** \brief Read the config set the file pointer, open the file * \param file_ctx pointer to a created LogFileCtx using LogFileNewCtx() * \param config_file for loading separate configs * \return -1 if failure, 0 if succesful * */ int LogFileLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, const char *mode) { return 0; } void LogFileLogRegister (void) { OutputRegisterFileModule(LOGGER_FILE, MODULE_NAME, "file-log", LogFileLogInitCtx, LogFileLogger, LogFileLogThreadInit, LogFileLogThreadDeinit, LogFileLogExitPrintStats); SCLogDebug("registered"); } suricata-3.2.1/src/util-affinity.c0000644000000000000000000002327613051004444013743 00000000000000/* Copyright (C) 2010-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond * * CPU affinity related code and helper. */ #include "suricata-common.h" #define _THREAD_AFFINITY #include "util-affinity.h" #include "util-cpu.h" #include "conf.h" #include "threads.h" #include "queue.h" #include "runmodes.h" ThreadsAffinityType thread_affinity[MAX_CPU_SET] = { { .name = "receive-cpu-set", .mode_flag = EXCLUSIVE_AFFINITY, .prio = PRIO_MEDIUM, .lcpu = 0, }, { .name = "worker-cpu-set", .mode_flag = EXCLUSIVE_AFFINITY, .prio = PRIO_MEDIUM, .lcpu = 0, }, { .name = "verdict-cpu-set", .mode_flag = BALANCED_AFFINITY, .prio = PRIO_MEDIUM, .lcpu = 0, }, { .name = "management-cpu-set", .mode_flag = BALANCED_AFFINITY, .prio = PRIO_MEDIUM, .lcpu = 0, }, }; int thread_affinity_init_done = 0; /** * \brief find affinity by its name * \retval a pointer to the affinity or NULL if not found */ ThreadsAffinityType * GetAffinityTypeFromName(const char *name) { int i; for (i = 0; i < MAX_CPU_SET; i++) { if (!strcmp(thread_affinity[i].name, name)) { return &thread_affinity[i]; } } return NULL; } #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun static void AffinitySetupInit() { int i, j; int ncpu = UtilCpuGetNumProcessorsConfigured(); SCLogDebug("Initialize affinity setup\n"); /* be conservative relatively to OS: use all cpus by default */ for (i = 0; i < MAX_CPU_SET; i++) { cpu_set_t *cs = &thread_affinity[i].cpu_set; CPU_ZERO(cs); for (j = 0; j < ncpu; j++) { CPU_SET(j, cs); } SCMutexInit(&thread_affinity[i].taf_mutex, NULL); } return; } static void BuildCpuset(const char *name, ConfNode *node, cpu_set_t *cpu) { ConfNode *lnode; TAILQ_FOREACH(lnode, &node->head, next) { int i; long int a,b; int stop = 0; int max = UtilCpuGetNumProcessorsOnline() - 1; if (!strcmp(lnode->val, "all")) { a = 0; b = max; stop = 1; } else if (index(lnode->val, '-') != NULL) { char *sep = index(lnode->val, '-'); char *end; a = strtoul(lnode->val, &end, 10); if (end != sep) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s: invalid cpu range (start invalid): \"%s\"", name, lnode->val); exit(EXIT_FAILURE); } b = strtol(sep + 1, &end, 10); if (end != sep + strlen(sep)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s: invalid cpu range (end invalid): \"%s\"", name, lnode->val); exit(EXIT_FAILURE); } if (a > b) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s: invalid cpu range (bad order): \"%s\"", name, lnode->val); exit(EXIT_FAILURE); } if (b > max) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s: upper bound (%ld) of cpu set is too high, only %d cpu(s)", name, b, max + 1); } } else { char *end; a = strtoul(lnode->val, &end, 10); if (end != lnode->val + strlen(lnode->val)) { SCLogError(SC_ERR_INVALID_ARGUMENT, "%s: invalid cpu range (not an integer): \"%s\"", name, lnode->val); exit(EXIT_FAILURE); } b = a; } for (i = a; i<= b; i++) { CPU_SET(i, cpu); } if (stop) break; } } #endif /* OS_WIN32 and __OpenBSD__ */ /** * \brief Extract cpu affinity configuration from current config file */ void AffinitySetupLoadFromConfig() { #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun ConfNode *root = ConfGetNode("threading.cpu-affinity"); ConfNode *affinity; if (thread_affinity_init_done == 0) { AffinitySetupInit(); thread_affinity_init_done = 1; } SCLogDebug("Load affinity from config\n"); if (root == NULL) { SCLogInfo("can't get cpu-affinity node"); return; } TAILQ_FOREACH(affinity, &root->head, next) { if (strcmp(affinity->val, "decode-cpu-set") == 0 || strcmp(affinity->val, "stream-cpu-set") == 0 || strcmp(affinity->val, "reject-cpu-set") == 0 || strcmp(affinity->val, "output-cpu-set") == 0) { continue; } const char *setname = affinity->val; if (strcmp(affinity->val, "detect-cpu-set") == 0) setname = "worker-cpu-set"; ThreadsAffinityType *taf = GetAffinityTypeFromName(setname); ConfNode *node = NULL; ConfNode *nprio = NULL; if (taf == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "unknown cpu-affinity type"); exit(EXIT_FAILURE); } else { SCLogConfig("Found affinity definition for \"%s\"", setname); } CPU_ZERO(&taf->cpu_set); node = ConfNodeLookupChild(affinity->head.tqh_first, "cpu"); if (node == NULL) { SCLogInfo("unable to find 'cpu'"); } else { BuildCpuset(setname, node, &taf->cpu_set); } CPU_ZERO(&taf->lowprio_cpu); CPU_ZERO(&taf->medprio_cpu); CPU_ZERO(&taf->hiprio_cpu); nprio = ConfNodeLookupChild(affinity->head.tqh_first, "prio"); if (nprio != NULL) { node = ConfNodeLookupChild(nprio, "low"); if (node == NULL) { SCLogDebug("unable to find 'low' prio using default value"); } else { BuildCpuset(setname, node, &taf->lowprio_cpu); } node = ConfNodeLookupChild(nprio, "medium"); if (node == NULL) { SCLogDebug("unable to find 'medium' prio using default value"); } else { BuildCpuset(setname, node, &taf->medprio_cpu); } node = ConfNodeLookupChild(nprio, "high"); if (node == NULL) { SCLogDebug("unable to find 'high' prio using default value"); } else { BuildCpuset(setname, node, &taf->hiprio_cpu); } node = ConfNodeLookupChild(nprio, "default"); if (node != NULL) { if (!strcmp(node->val, "low")) { taf->prio = PRIO_LOW; } else if (!strcmp(node->val, "medium")) { taf->prio = PRIO_MEDIUM; } else if (!strcmp(node->val, "high")) { taf->prio = PRIO_HIGH; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "unknown cpu_affinity prio"); exit(EXIT_FAILURE); } SCLogConfig("Using default prio '%s' for set '%s'", node->val, setname); } } node = ConfNodeLookupChild(affinity->head.tqh_first, "mode"); if (node != NULL) { if (!strcmp(node->val, "exclusive")) { taf->mode_flag = EXCLUSIVE_AFFINITY; } else if (!strcmp(node->val, "balanced")) { taf->mode_flag = BALANCED_AFFINITY; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "unknown cpu_affinity node"); exit(EXIT_FAILURE); } } node = ConfNodeLookupChild(affinity->head.tqh_first, "threads"); if (node != NULL) { taf->nb_threads = atoi(node->val); if (! taf->nb_threads) { SCLogError(SC_ERR_INVALID_ARGUMENT, "bad value for threads count"); exit(EXIT_FAILURE); } } } #endif /* OS_WIN32 and __OpenBSD__ */ } /** * \brief Return next cpu to use for a given thread family * \retval the cpu to used given by its id */ int AffinityGetNextCPU(ThreadsAffinityType *taf) { int ncpu = 0; #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun int iter = 0; SCMutexLock(&taf->taf_mutex); ncpu = taf->lcpu; while (!CPU_ISSET(ncpu, &taf->cpu_set) && iter < 2) { ncpu++; if (ncpu >= UtilCpuGetNumProcessorsOnline()) { ncpu = 0; iter++; } } if (iter == 2) { SCLogError(SC_ERR_INVALID_ARGUMENT, "cpu_set does not contain " "available cpus, cpu affinity conf is invalid"); } taf->lcpu = ncpu + 1; if (taf->lcpu >= UtilCpuGetNumProcessorsOnline()) taf->lcpu = 0; SCMutexUnlock(&taf->taf_mutex); SCLogDebug("Setting affinity on CPU %d", ncpu); #endif /* OS_WIN32 and __OpenBSD__ */ return ncpu; } suricata-3.2.1/src/detect-fragoffset.h0000644000000000000000000000207513051004444014552 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_FRAGOFFSET_H__ #define __DETECT_FRAGOFFSET_H__ #define FRAG_LESS 1 #define FRAG_MORE 2 typedef struct DetectFragOffsetData_ { uint16_t frag_off; uint8_t mode; } DetectFragOffsetData; /* prototypes */ void DetectFragOffsetRegister(void); #endif /* __DETECT_FRAGOFFSET__ */ suricata-3.2.1/src/output-json-flow.h0000644000000000000000000000161413051004444014430 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * Victor Julien */ #ifndef __OUTPUT_JSON_FLOW_H__ #define __OUTPUT_JSON_FLOW_H__ void JsonFlowLogRegister(void); #endif /* __OUTPUT_JSON_FLOW_H__ */ suricata-3.2.1/src/output-lua.c0000644000000000000000000007305113051004444013272 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "app-layer-ssh.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" #include "util-lua-http.h" #include "util-lua-dns.h" #include "util-lua-tls.h" #include "util-lua-ssh.h" #include "util-lua-smtp.h" #define MODULE_NAME "LuaLog" /** \brief structure containing global config * The OutputLuaLogInitSub which is run per script * can access this to get global config info through * it's parent_ctx->data ptr. */ typedef struct LogLuaMasterCtx_ { char path[PATH_MAX]; /**< contains script-dir */ } LogLuaMasterCtx; typedef struct LogLuaCtx_ { SCMutex m; lua_State *luastate; int deinit_once; } LogLuaCtx; typedef struct LogLuaThreadCtx_ { LogLuaCtx *lua_ctx; } LogLuaThreadCtx; static TmEcode LuaLogThreadInit(ThreadVars *t, void *initdata, void **data); static TmEcode LuaLogThreadDeinit(ThreadVars *t, void *data); /** \internal * \brief TX logger for lua scripts * * A single call to this function will run one script on a single * transaction. * * NOTE: The flow (f) also referenced by p->flow is locked. */ static int LuaTxLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *alstate, void *txptr, uint64_t tx_id) { SCEnter(); LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; SCMutexLock(&td->lua_ctx->m); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetPacket(td->lua_ctx->luastate, (Packet *)p); LuaStateSetTX(td->lua_ctx->luastate, txptr); LuaStateSetFlow(td->lua_ctx->luastate, f); /* prepare data to pass to script */ lua_getglobal(td->lua_ctx->luastate, "log"); lua_newtable(td->lua_ctx->luastate); LuaPushTableKeyValueInt(td->lua_ctx->luastate, "tx_id", (int)(tx_id)); int retval = lua_pcall(td->lua_ctx->luastate, 1, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); SCReturnInt(0); } /** \internal * \brief Streaming logger for lua scripts * * Hooks into the Streaming Logger API. Gets called for each chunk of new * streaming data. */ static int LuaStreamingLogger(ThreadVars *tv, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags) { SCEnter(); void *txptr = NULL; LuaStreamingBuffer b = { data, data_len, flags }; SCLogDebug("flags %02x", flags); if (flags & OUTPUT_STREAMING_FLAG_TRANSACTION) { if (f && f->alstate) txptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, tx_id); } LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; SCMutexLock(&td->lua_ctx->m); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); if (flags & OUTPUT_STREAMING_FLAG_TRANSACTION) LuaStateSetTX(td->lua_ctx->luastate, txptr); LuaStateSetFlow(td->lua_ctx->luastate, (Flow *)f); LuaStateSetStreamingBuffer(td->lua_ctx->luastate, &b); /* prepare data to pass to script */ lua_getglobal(td->lua_ctx->luastate, "log"); lua_newtable(td->lua_ctx->luastate); if (flags & OUTPUT_STREAMING_FLAG_TRANSACTION) LuaPushTableKeyValueInt(td->lua_ctx->luastate, "tx_id", (int)(tx_id)); int retval = lua_pcall(td->lua_ctx->luastate, 1, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); SCReturnInt(TM_ECODE_OK); } /** \internal * \brief Packet Logger for lua scripts, for alerts * * A single call to this function will run one script for a single * packet. If it is called, it means that the registered condition * function has returned TRUE. * * The script is called once for each alert stored in the packet. * * NOTE: p->flow is UNlocked */ static int LuaPacketLoggerAlerts(ThreadVars *tv, void *thread_data, const Packet *p) { LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); if (!(PKT_IS_IPV4(p)) && !(PKT_IS_IPV6(p))) { /* decoder event */ goto not_supported; } char proto[16] = ""; if (SCProtoNameValid(IP_GET_IPPROTO(p)) == TRUE) { strlcpy(proto, known_proto[IP_GET_IPPROTO(p)], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "PROTO:%03" PRIu32, IP_GET_IPPROTO(p)); } /* loop through alerts stored in the packet */ SCMutexLock(&td->lua_ctx->m); uint16_t cnt; for (cnt = 0; cnt < p->alerts.cnt; cnt++) { const PacketAlert *pa = &p->alerts.alerts[cnt]; if (unlikely(pa->s == NULL)) { continue; } lua_getglobal(td->lua_ctx->luastate, "log"); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetPacket(td->lua_ctx->luastate, (Packet *)p); LuaStateSetFlow(td->lua_ctx->luastate, p->flow); LuaStateSetPacketAlert(td->lua_ctx->luastate, (PacketAlert *)pa); /* prepare data to pass to script */ //lua_newtable(td->lua_ctx->luastate); int retval = lua_pcall(td->lua_ctx->luastate, 0, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } } SCMutexUnlock(&td->lua_ctx->m); not_supported: SCReturnInt(0); } static int LuaPacketConditionAlerts(ThreadVars *tv, const Packet *p) { if (p->alerts.cnt > 0) return TRUE; return FALSE; } /** \internal * \brief Packet Logger for lua scripts, for ssh * * A single call to this function will run one script for a single * packet. If it is called, it means that the registered condition * function has returned TRUE. * * The script is called once for each packet. */ static int LuaPacketLoggerSsh(ThreadVars *tv, void *thread_data, const Packet *p) { LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; char timebuf[64]; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); SCMutexLock(&td->lua_ctx->m); lua_getglobal(td->lua_ctx->luastate, "log"); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetPacket(td->lua_ctx->luastate, (Packet *)p); LuaStateSetFlow(td->lua_ctx->luastate, p->flow); int retval = lua_pcall(td->lua_ctx->luastate, 0, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); SshState *ssh_state = (SshState *)FlowGetAppState(p->flow); if (ssh_state != NULL) ssh_state->cli_hdr.flags |= SSH_FLAG_STATE_LOGGED_LUA; SCReturnInt(0); } static int LuaPacketConditionSsh(ThreadVars *tv, const Packet *p) { if (p->flow == NULL) { return FALSE; } if (!(PKT_IS_IPV4(p)) && !(PKT_IS_IPV6(p))) { return FALSE; } if (!(PKT_IS_TCP(p))) { return FALSE; } uint16_t proto = FlowGetAppProtocol(p->flow); if (proto != ALPROTO_SSH) goto dontlog; SshState *ssh_state = (SshState *)FlowGetAppState(p->flow); if (ssh_state == NULL) { SCLogDebug("no ssh state, so no request logging"); goto dontlog; } if (ssh_state->cli_hdr.software_version == NULL || ssh_state->srv_hdr.software_version == NULL) goto dontlog; /* We only log the state once */ if (ssh_state->cli_hdr.flags & SSH_FLAG_STATE_LOGGED_LUA) goto dontlog; return TRUE; dontlog: return FALSE; } /** \internal * \brief Packet Logger for lua scripts, for packets * * A single call to this function will run one script for a single * packet. If it is called, it means that the registered condition * function has returned TRUE. * * The script is called once for each packet. * * NOTE: p->flow is UNlocked */ static int LuaPacketLogger(ThreadVars *tv, void *thread_data, const Packet *p) { LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; char timebuf[64]; if ((!(PKT_IS_IPV4(p))) && (!(PKT_IS_IPV6(p)))) { goto not_supported; } CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); char proto[16] = ""; if (SCProtoNameValid(IP_GET_IPPROTO(p)) == TRUE) { strlcpy(proto, known_proto[IP_GET_IPPROTO(p)], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "PROTO:%03" PRIu32, IP_GET_IPPROTO(p)); } /* loop through alerts stored in the packet */ SCMutexLock(&td->lua_ctx->m); lua_getglobal(td->lua_ctx->luastate, "log"); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetPacket(td->lua_ctx->luastate, (Packet *)p); LuaStateSetFlow(td->lua_ctx->luastate, p->flow); /* prepare data to pass to script */ lua_newtable(td->lua_ctx->luastate); int retval = lua_pcall(td->lua_ctx->luastate, 1, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); not_supported: SCReturnInt(0); } static int LuaPacketCondition(ThreadVars *tv, const Packet *p) { return TRUE; } /** \internal * \brief File API Logger function for Lua scripts * * Executes a script once for one file. * * TODO non-http support * * NOTE p->flow is locked at this point */ static int LuaFileLogger(ThreadVars *tv, void *thread_data, const Packet *p, const File *ff) { SCEnter(); LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; if ((!(PKT_IS_IPV4(p))) && (!(PKT_IS_IPV6(p)))) return 0; BUG_ON(ff->flags & FILE_LOGGED); SCLogDebug("ff %p", ff); /* Get the TX so the script can get more context about it. * TODO hardcoded to HTTP currently */ void *txptr = NULL; if (p->flow && p->flow->alstate) txptr = AppLayerParserGetTx(p->proto, ALPROTO_HTTP, p->flow->alstate, ff->txid); SCMutexLock(&td->lua_ctx->m); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetPacket(td->lua_ctx->luastate, (Packet *)p); LuaStateSetTX(td->lua_ctx->luastate, txptr); LuaStateSetFlow(td->lua_ctx->luastate, p->flow); LuaStateSetFile(td->lua_ctx->luastate, (File *)ff); /* get the lua function to call */ lua_getglobal(td->lua_ctx->luastate, "log"); int retval = lua_pcall(td->lua_ctx->luastate, 0, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); return 0; } /** \internal * \brief Flow API Logger function for Lua scripts * * Executes a script once for one flow * * Note: flow 'f' is locked */ static int LuaFlowLogger(ThreadVars *tv, void *thread_data, Flow *f) { SCEnter(); LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; SCLogDebug("f %p", f); SCMutexLock(&td->lua_ctx->m); LuaStateSetThreadVars(td->lua_ctx->luastate, tv); LuaStateSetFlow(td->lua_ctx->luastate, f); /* get the lua function to call */ lua_getglobal(td->lua_ctx->luastate, "log"); int retval = lua_pcall(td->lua_ctx->luastate, 0, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); return 0; } static int LuaStatsLogger(ThreadVars *tv, void *thread_data, const StatsTable *st) { SCEnter(); LogLuaThreadCtx *td = (LogLuaThreadCtx *)thread_data; SCMutexLock(&td->lua_ctx->m); lua_State *luastate = td->lua_ctx->luastate; /* get the lua function to call */ lua_getglobal(td->lua_ctx->luastate, "log"); /* create lua array, which is really just a table. The key is an int (1-x), * the value another table with named fields: name, tm_name, value, pvalue. * { 1, { name=, tmname=, value=, pvalue=}} * { 2, { name=, tmname=, value=, pvalue=}} * etc */ lua_newtable(luastate); uint32_t u = 0; for (; u < st->nstats; u++) { lua_pushinteger(luastate, u + 1); lua_newtable(luastate); lua_pushstring(luastate, "name"); lua_pushstring(luastate, st->stats[u].name); lua_settable(luastate, -3); lua_pushstring(luastate, "tmname"); lua_pushstring(luastate, st->stats[u].tm_name); lua_settable(luastate, -3); lua_pushstring(luastate, "value"); lua_pushinteger(luastate, st->stats[u].value); lua_settable(luastate, -3); lua_pushstring(luastate, "pvalue"); lua_pushinteger(luastate, st->stats[u].pvalue); lua_settable(luastate, -3); lua_settable(luastate, -3); } int retval = lua_pcall(td->lua_ctx->luastate, 1, 0, 0); if (retval != 0) { SCLogInfo("failed to run script: %s", lua_tostring(td->lua_ctx->luastate, -1)); } SCMutexUnlock(&td->lua_ctx->m); return 0; } typedef struct LogLuaScriptOptions_ { AppProto alproto; int packet; int alerts; int file; int streaming; int tcp_data; int http_body; int flow; int stats; } LogLuaScriptOptions; /** \brief load and evaluate the script * * This function parses the script, checks if all the required functions * are defined and runs the 'init' function. The init function will inform * us what the scripts needs are. * * \param filename filename of lua script file * \param options struct to pass script requirements/options back to caller * \retval errcode 0 ok, -1 error */ static int LuaScriptInit(const char *filename, LogLuaScriptOptions *options) { int status; lua_State *luastate = LuaGetState(); if (luastate == NULL) goto error; luaL_openlibs(luastate); /* hackish, needed to allow unittests to pass buffers as scripts instead of files */ #if 0//def UNITTESTS if (ut_script != NULL) { status = luaL_loadbuffer(luastate, ut_script, strlen(ut_script), "unittest"); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(luastate, -1)); goto error; } } else { #endif status = luaL_loadfile(luastate, filename); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(luastate, -1)); goto error; } #if 0//def UNITTESTS } #endif /* prime the script (or something) */ if (lua_pcall(luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't prime file: %s", lua_tostring(luastate, -1)); goto error; } lua_getglobal(luastate, "init"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no init function in script"); goto error; } lua_newtable(luastate); /* stack at -1 */ if (lua_gettop(luastate) == 0 || lua_type(luastate, 2) != LUA_TTABLE) { SCLogError(SC_ERR_LUA_ERROR, "no table setup"); goto error; } lua_pushliteral(luastate, "script_api_ver"); lua_pushnumber (luastate, 1); lua_settable(luastate, -3); if (lua_pcall(luastate, 1, 1, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't run script 'init' function: %s", lua_tostring(luastate, -1)); goto error; } /* process returns from script */ if (lua_gettop(luastate) == 0) { SCLogError(SC_ERR_LUA_ERROR, "init function in script should return table, nothing returned"); goto error; } if (lua_type(luastate, 1) != LUA_TTABLE) { SCLogError(SC_ERR_LUA_ERROR, "init function in script should return table, returned is not table"); goto error; } lua_pushnil(luastate); const char *k, *v; while (lua_next(luastate, -2)) { k = lua_tostring(luastate, -2); if (k == NULL) continue; v = lua_tostring(luastate, -1); lua_pop(luastate, 1); if (v == NULL) continue; SCLogDebug("k='%s', v='%s'", k, v); if (strcmp(k,"protocol") == 0 && strcmp(v, "http") == 0) options->alproto = ALPROTO_HTTP; else if (strcmp(k,"protocol") == 0 && strcmp(v, "dns") == 0) options->alproto = ALPROTO_DNS; else if (strcmp(k,"protocol") == 0 && strcmp(v, "tls") == 0) options->alproto = ALPROTO_TLS; else if (strcmp(k,"protocol") == 0 && strcmp(v, "ssh") == 0) options->alproto = ALPROTO_SSH; else if (strcmp(k,"protocol") == 0 && strcmp(v, "smtp") == 0) options->alproto = ALPROTO_SMTP; else if (strcmp(k, "type") == 0 && strcmp(v, "packet") == 0) options->packet = 1; else if (strcmp(k, "filter") == 0 && strcmp(v, "alerts") == 0) options->alerts = 1; else if (strcmp(k, "type") == 0 && strcmp(v, "file") == 0) options->file = 1; else if (strcmp(k, "type") == 0 && strcmp(v, "streaming") == 0) options->streaming = 1; else if (strcmp(k, "type") == 0 && strcmp(v, "flow") == 0) options->flow = 1; else if (strcmp(k, "filter") == 0 && strcmp(v, "tcp") == 0) options->tcp_data = 1; else if (strcmp(k, "type") == 0 && strcmp(v, "stats") == 0) options->stats = 1; else SCLogInfo("unknown key and/or value: k='%s', v='%s'", k, v); } if (((options->alproto != ALPROTO_UNKNOWN)) + options->packet + options->file > 1) { SCLogError(SC_ERR_LUA_ERROR, "invalid combination of 'needs' in the script"); goto error; } lua_getglobal(luastate, "setup"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no setup function in script"); goto error; } lua_getglobal(luastate, "log"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no log function in script"); goto error; } lua_getglobal(luastate, "deinit"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no deinit function in script"); goto error; } /* pop the table */ lua_pop(luastate, 1); LuaReturnState(luastate); return 0; error: if (luastate) LuaReturnState(luastate); return -1; } /** \brief setup a luastate for use at runtime * * This loads the script, primes it and then runs the 'setup' function. * * \retval state Returns the set up luastate on success, NULL on error */ static lua_State *LuaScriptSetup(const char *filename) { lua_State *luastate = LuaGetState(); if (luastate == NULL) { SCLogError(SC_ERR_LUA_ERROR, "luaL_newstate failed"); goto error; } luaL_openlibs(luastate); int status; /* hackish, needed to allow unittests to pass buffers as scripts instead of files */ #if 0//def UNITTESTS if (ut_script != NULL) { status = luaL_loadbuffer(t->luastate, ut_script, strlen(ut_script), "unittest"); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(t->luastate, -1)); goto error; } } else { #endif status = luaL_loadfile(luastate, filename); if (status) { SCLogError(SC_ERR_LUA_ERROR, "couldn't load file: %s", lua_tostring(luastate, -1)); goto error; } #if 0//def UNITTESTS } #endif /* prime the script */ if (lua_pcall(luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't prime file: %s", lua_tostring(luastate, -1)); goto error; } lua_getglobal(luastate, "setup"); /* register functions common to all */ LuaRegisterFunctions(luastate); /* unconditionally register http function. They will only work * if the tx is registered in the state at runtime though. */ LuaRegisterHttpFunctions(luastate); LuaRegisterDnsFunctions(luastate); LuaRegisterTlsFunctions(luastate); LuaRegisterSshFunctions(luastate); LuaRegisterSmtpFunctions(luastate); if (lua_pcall(luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't run script 'setup' function: %s", lua_tostring(luastate, -1)); goto error; } SCLogDebug("lua_State %p is set up", luastate); return luastate; error: if (luastate) LuaReturnState(luastate); return NULL; } static void LogLuaSubFree(OutputCtx *oc) { if (oc->data) SCFree(oc->data); SCFree(oc); } /** \brief initialize output for a script instance * * Runs script 'setup' function. */ static OutputCtx *OutputLuaLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { if (conf == NULL) return NULL; LogLuaCtx *lua_ctx = SCMalloc(sizeof(LogLuaCtx)); if (unlikely(lua_ctx == NULL)) return NULL; memset(lua_ctx, 0x00, sizeof(*lua_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(lua_ctx); return NULL; } SCMutexInit(&lua_ctx->m, NULL); const char *dir = ""; if (parent_ctx && parent_ctx->data) { LogLuaMasterCtx *mc = parent_ctx->data; dir = mc->path; } char path[PATH_MAX] = ""; snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", conf->val); SCLogDebug("script full path %s", path); SCMutexLock(&lua_ctx->m); lua_ctx->luastate = LuaScriptSetup(path); SCMutexUnlock(&lua_ctx->m); if (lua_ctx->luastate == NULL) goto error; SCLogDebug("lua_ctx %p", lua_ctx); output_ctx->data = lua_ctx; output_ctx->DeInit = LogLuaSubFree; return output_ctx; error: SCMutexDestroy(&lua_ctx->m); SCFree(lua_ctx); SCFree(output_ctx); return NULL; } static void LogLuaMasterFree(OutputCtx *oc) { if (oc->data) SCFree(oc->data); OutputModule *om, *tom; TAILQ_FOREACH_SAFE(om, &oc->submodules, entries, tom) { SCFree(om); } SCFree(oc); } /** \internal * \brief initialize output instance for lua module * * Parses nested script list, primes them to find out what they * inspect, then fills the OutputCtx::submodules list with the * proper Logger function for the data type the script needs. */ static OutputCtx *OutputLuaLogInit(ConfNode *conf) { const char *dir = ConfNodeLookupChildValue(conf, "scripts-dir"); if (dir == NULL) dir = ""; ConfNode *scripts = ConfNodeLookupChild(conf, "scripts"); if (scripts == NULL) { /* No "outputs" section in the configuration. */ SCLogInfo("scripts not defined"); return NULL; } /* global output ctx setup */ OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { return NULL; } output_ctx->DeInit = LogLuaMasterFree; output_ctx->data = SCCalloc(1, sizeof(LogLuaMasterCtx)); if (unlikely(output_ctx->data == NULL)) { SCFree(output_ctx); return NULL; } LogLuaMasterCtx *master_config = output_ctx->data; strlcpy(master_config->path, dir, sizeof(master_config->path)); TAILQ_INIT(&output_ctx->submodules); /* check the enables scripts and set them up as submodules */ ConfNode *script; TAILQ_FOREACH(script, &scripts->head, next) { SCLogInfo("enabling script %s", script->val); LogLuaScriptOptions opts; memset(&opts, 0x00, sizeof(opts)); char path[PATH_MAX] = ""; snprintf(path, sizeof(path),"%s%s%s", dir, strlen(dir) ? "/" : "", script->val); SCLogDebug("script full path %s", path); int r = LuaScriptInit(path, &opts); if (r != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't initialize scipt"); goto error; } /* create an OutputModule for this script, based * on it's needs. */ OutputModule *om = SCCalloc(1, sizeof(*om)); if (om == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "calloc() failed"); goto error; } om->name = MODULE_NAME; om->conf_name = script->val; om->InitSubFunc = OutputLuaLogInitSub; om->ThreadInit = LuaLogThreadInit; om->ThreadDeinit = LuaLogThreadDeinit; if (opts.alproto == ALPROTO_HTTP && opts.streaming) { om->StreamingLogFunc = LuaStreamingLogger; om->alproto = ALPROTO_HTTP; AppLayerHtpEnableRequestBodyCallback(); AppLayerHtpEnableResponseBodyCallback(); } else if (opts.alproto == ALPROTO_HTTP) { om->TxLogFunc = LuaTxLogger; om->alproto = ALPROTO_HTTP; om->ts_log_progress = -1; om->tc_log_progress = -1; AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP); } else if (opts.alproto == ALPROTO_TLS) { om->TxLogFunc = LuaTxLogger; om->alproto = ALPROTO_TLS; om->tc_log_progress = TLS_HANDSHAKE_DONE; om->ts_log_progress = TLS_HANDSHAKE_DONE; } else if (opts.alproto == ALPROTO_DNS) { om->TxLogFunc = LuaTxLogger; om->alproto = ALPROTO_DNS; om->ts_log_progress = -1; om->tc_log_progress = -1; AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_DNS); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DNS); } else if (opts.alproto == ALPROTO_SSH) { om->PacketLogFunc = LuaPacketLoggerSsh; om->PacketConditionFunc = LuaPacketConditionSsh; } else if (opts.alproto == ALPROTO_SMTP) { om->TxLogFunc = LuaTxLogger; om->alproto = ALPROTO_SMTP; om->ts_log_progress = -1; om->tc_log_progress = -1; AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_SMTP); } else if (opts.packet && opts.alerts) { om->PacketLogFunc = LuaPacketLoggerAlerts; om->PacketConditionFunc = LuaPacketConditionAlerts; } else if (opts.packet && opts.alerts == 0) { om->PacketLogFunc = LuaPacketLogger; om->PacketConditionFunc = LuaPacketCondition; } else if (opts.file) { om->FileLogFunc = LuaFileLogger; AppLayerHtpNeedFileInspection(); } else if (opts.streaming && opts.tcp_data) { om->StreamingLogFunc = LuaStreamingLogger; } else if (opts.flow) { om->FlowLogFunc = LuaFlowLogger; } else if (opts.stats) { om->StatsLogFunc = LuaStatsLogger; } else { SCLogError(SC_ERR_LUA_ERROR, "failed to setup thread module"); SCFree(om); goto error; } TAILQ_INSERT_TAIL(&output_ctx->submodules, om, entries); } return output_ctx; error: if (output_ctx->DeInit) output_ctx->DeInit(output_ctx); return NULL; } /** \internal * \brief Run the scripts 'deinit' function */ static void OutputLuaLogDoDeinit(LogLuaCtx *lua_ctx) { lua_State *luastate = lua_ctx->luastate; lua_getglobal(luastate, "deinit"); if (lua_type(luastate, -1) != LUA_TFUNCTION) { SCLogError(SC_ERR_LUA_ERROR, "no deinit function in script"); return; } //LuaPrintStack(luastate); if (lua_pcall(luastate, 0, 0, 0) != 0) { SCLogError(SC_ERR_LUA_ERROR, "couldn't run script 'deinit' function: %s", lua_tostring(luastate, -1)); return; } LuaReturnState(luastate); } /** \internal * \brief Initialize the thread storage for lua * * Currently only stores a pointer to the global LogLuaCtx */ static TmEcode LuaLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogLuaThreadCtx *td = SCMalloc(sizeof(*td)); if (unlikely(td == NULL)) return TM_ECODE_FAILED; memset(td, 0, sizeof(*td)); if (initdata == NULL) { SCLogDebug("Error getting context for LuaLog. \"initdata\" argument NULL"); SCFree(td); return TM_ECODE_FAILED; } LogLuaCtx *lua_ctx = ((OutputCtx *)initdata)->data; SCLogDebug("lua_ctx %p", lua_ctx); td->lua_ctx = lua_ctx; *data = (void *)td; return TM_ECODE_OK; } /** \internal * \brief Deinit the thread storage for lua * * Calls OutputLuaLogDoDeinit if no-one else already did. */ static TmEcode LuaLogThreadDeinit(ThreadVars *t, void *data) { LogLuaThreadCtx *td = (LogLuaThreadCtx *)data; if (td == NULL) { return TM_ECODE_OK; } SCMutexLock(&td->lua_ctx->m); if (td->lua_ctx->deinit_once == 0) { OutputLuaLogDoDeinit(td->lua_ctx); td->lua_ctx->deinit_once = 1; } SCMutexUnlock(&td->lua_ctx->m); /* clear memory */ memset(td, 0, sizeof(*td)); SCFree(td); return TM_ECODE_OK; } void LuaLogRegister(void) { /* register as separate module */ OutputRegisterModule(MODULE_NAME, "lua", OutputLuaLogInit); } #else void LuaLogRegister (void) { /* no-op */ } #endif suricata-3.2.1/src/defrag.h0000644000000000000000000001011213051004444012375 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited, Jason Ish */ #ifndef __DEFRAG_H__ #define __DEFRAG_H__ #include "util-pool.h" /** * A context for an instance of a fragmentation re-assembler, in case * we ever need more than one. */ typedef struct DefragContext_ { Pool *frag_pool; /**< Pool of fragments. */ SCMutex frag_pool_lock; time_t timeout; /**< Default timeout. */ } DefragContext; /** * Storage for an individual fragment. */ typedef struct Frag_ { uint16_t offset; /**< The offset of this fragment, already * multiplied by 8. */ uint16_t len; /**< The length of this fragment. */ uint8_t hlen; /**< The length of this fragments IP header. */ uint8_t more_frags:4; /**< More frags? */ uint8_t skip:4; /**< Skip this fragment during re-assembly. */ uint16_t ip_hdr_offset; /**< Offset in the packet where the IP * header starts. */ uint16_t frag_hdr_offset; /**< Offset in the packet where the frag * header starts. */ uint16_t data_offset; /**< Offset to the packet data. */ uint16_t data_len; /**< Length of data. */ uint16_t ltrim; /**< Number of leading bytes to trim when * re-assembling the packet. */ uint8_t *pkt; /**< The actual packet. */ #ifdef DEBUG uint64_t pcap_cnt; /**< pcap_cnt of original packet */ #endif TAILQ_ENTRY(Frag_) next; /**< Pointer to next fragment for tailq. */ } Frag; /** * A defragmentation tracker. Used to track fragments that make up a * single packet. */ typedef struct DefragTracker_ { SCMutex lock; /**< Mutex for locking list operations on * this tracker. */ uint16_t vlan_id[2]; /**< VLAN ID tracker applies to. */ uint32_t id; /**< IP ID for this tracker. 32 bits for IPv6, 16 * for IPv4. */ uint8_t proto; /**< IP protocol for this tracker. */ uint8_t policy; /**< Reassembly policy this tracker will use. */ uint8_t af; /**< Address family for this tracker, AF_INET or * AF_INET6. */ uint8_t seen_last; /**< Has this tracker seen the last fragment? */ uint8_t remove; /**< remove */ Address src_addr; /**< Source address for this tracker. */ Address dst_addr; /**< Destination address for this tracker. */ struct timeval timeout; /**< When this tracker will timeout. */ uint32_t host_timeout; /**< Host timeout, statically assigned from the yaml */ /** use cnt, reference counter */ SC_ATOMIC_DECLARE(unsigned int, use_cnt); TAILQ_HEAD(frag_tailq, Frag_) frags; /**< Head of list of fragments. */ /** hash pointers, protected by hash row mutex/spin */ struct DefragTracker_ *hnext; struct DefragTracker_ *hprev; /** list pointers, protected by tracker-queue mutex/spin */ struct DefragTracker_ *lnext; struct DefragTracker_ *lprev; } DefragTracker; void DefragInit(void); void DefragDestroy(void); void DefragReload(void); /**< use only in unittests */ uint8_t DefragGetOsPolicy(Packet *); void DefragTrackerFreeFrags(DefragTracker *); Packet *Defrag(ThreadVars *, DecodeThreadVars *, Packet *, PacketQueue *); void DefragRegisterTests(void); #endif /* __DEFRAG_H__ */ suricata-3.2.1/src/detect-http-client-body.h0000644000000000000000000000166713051004444015620 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_HTTP_CLIENT_BODY_H__ #define __DETECT_HTTP_CLIENT_BODY_H__ void DetectHttpClientBodyRegister(void); #endif /* __DETECT_HTTP_CLIENT_BODY_H__ */ suricata-3.2.1/src/detect-rawbytes.h0000644000000000000000000000164713051004444014270 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_RAWBYTES_H__ #define __DETECT_RAWBYTES_H__ /* prototypes */ void DetectRawbytesRegister (void); #endif /* __DETECT_RAWBYTES_H__ */ suricata-3.2.1/src/runmode-unix-socket.h0000644000000000000000000000274013051004444015075 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #ifndef __RUNMODE_UNIX_SOCKET_H__ #define __RUNMODE_UNIX_SOCKET_H__ int RunModeUnixSocketSingle(void); void RunModeUnixSocketRegister(void); const char *RunModeUnixSocketGetDefaultMode(void); int RunModeUnixSocketIsActive(void); void UnixSocketPcapFile(TmEcode tm); #ifdef BUILD_UNIX_SOCKET TmEcode UnixSocketRegisterTenantHandler(json_t *cmd, json_t* answer, void *data); TmEcode UnixSocketUnregisterTenantHandler(json_t *cmd, json_t* answer, void *data); TmEcode UnixSocketRegisterTenant(json_t *cmd, json_t* answer, void *data); TmEcode UnixSocketReloadTenant(json_t *cmd, json_t* answer, void *data); TmEcode UnixSocketUnregisterTenant(json_t *cmd, json_t* answer, void *data); #endif #endif /* __RUNMODE_UNIX_SOCKET_H__ */ suricata-3.2.1/src/output-json-dnp3.c0000644000000000000000000003107313051004444014322 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-buffer.h" #include "util-crypt.h" #include "util-debug.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" #include "detect-dnp3.h" #include "output.h" #include "output-json.h" #include "output-json-dnp3-objects.h" #ifdef HAVE_LIBJANSSON #include typedef struct LogDNP3FileCtx_ { LogFileCtx *file_ctx; uint32_t flags; uint8_t include_object_data; } LogDNP3FileCtx; typedef struct LogDNP3LogThread_ { LogDNP3FileCtx *dnp3log_ctx; uint32_t count; MemBuffer *buffer; } LogDNP3LogThread; static json_t *JsonDNP3LogLinkControl(uint8_t lc) { json_t *lcjs = json_object(); if (unlikely(lcjs == NULL)) { return NULL; } json_object_set_new(lcjs, "dir", json_boolean(DNP3_LINK_DIR(lc))); json_object_set_new(lcjs, "pri", json_boolean(DNP3_LINK_PRI(lc))); json_object_set_new(lcjs, "fcb", json_boolean(DNP3_LINK_FCB(lc))); json_object_set_new(lcjs, "fcv", json_boolean(DNP3_LINK_FCV(lc))); json_object_set_new(lcjs, "function_code", json_integer(DNP3_LINK_FC(lc))); return lcjs; } static json_t *JsonDNP3LogIin(uint16_t iin) { json_t *iinjs = json_object(); if (unlikely(iinjs == NULL)) { return NULL; } json_t *indicators = json_array(); if (unlikely(indicators == NULL)) { json_decref(iinjs); return NULL; } if (iin) { int mapping = 0; do { if (iin & DNP3IndicatorsMap[mapping].value) { json_array_append_new(indicators, json_string(DNP3IndicatorsMap[mapping].name)); } mapping++; } while (DNP3IndicatorsMap[mapping].name != NULL); } json_object_set_new(iinjs, "indicators", indicators); return iinjs; } static json_t *JsonDNP3LogApplicationControl(uint8_t ac) { json_t *acjs = json_object(); if (unlikely(acjs == NULL)) { return NULL; } json_object_set_new(acjs, "fir", json_boolean(DNP3_APP_FIR(ac))); json_object_set_new(acjs, "fin", json_boolean(DNP3_APP_FIN(ac))); json_object_set_new(acjs, "con", json_boolean(DNP3_APP_CON(ac))); json_object_set_new(acjs, "uns", json_boolean(DNP3_APP_UNS(ac))); json_object_set_new(acjs, "sequence", json_integer(DNP3_APP_SEQ(ac))); return acjs; } /** * \brief Log the items (points) for an object. * * TODO: Autogenerate this function based on object definitions. */ static json_t *JsonDNP3LogObjectItems(DNP3Object *object) { DNP3Point *item; json_t *jsitems; if (unlikely((jsitems = json_array()) == NULL)) { return NULL; } TAILQ_FOREACH(item, object->points, next) { json_t *js = json_object(); if (unlikely(js == NULL)) { break; } json_object_set_new(js, "prefix", json_integer(item->prefix)); json_object_set_new(js, "index", json_integer(item->index)); if (DNP3PrefixIsSize(object->prefix_code)) { json_object_set_new(js, "size", json_integer(item->size)); } OutputJsonDNP3SetItem(js, object, item); json_array_append_new(jsitems, js); } return jsitems; } /** * \brief Log the application layer objects. * * \param objects A list of DNP3 objects. * * \retval a json_t pointer containing the logged DNP3 objects. */ static json_t *JsonDNP3LogObjects(DNP3ObjectList *objects) { DNP3Object *object; json_t *js = json_array(); if (unlikely(js == NULL)) { return NULL; } TAILQ_FOREACH(object, objects, next) { json_t *objs = json_object(); if (unlikely(objs == NULL)) { goto error; } json_object_set_new(objs, "group", json_integer(object->group)); json_object_set_new(objs, "variation", json_integer(object->variation)); json_object_set_new(objs, "qualifier", json_integer(object->qualifier)); json_object_set_new(objs, "prefix_code", json_integer(object->prefix_code)); json_object_set_new(objs, "range_code", json_integer(object->range_code)); json_object_set_new(objs, "start", json_integer(object->start)); json_object_set_new(objs, "stop", json_integer(object->stop)); json_object_set_new(objs, "count", json_integer(object->count)); if (object->points != NULL && !TAILQ_EMPTY(object->points)) { json_t *points = JsonDNP3LogObjectItems(object); if (points != NULL) { json_object_set_new(objs, "points", points); } } json_array_append_new(js, objs); } return js; error: json_decref(js); return NULL; } json_t *JsonDNP3LogRequest(DNP3Transaction *dnp3tx) { json_t *dnp3js = json_object(); if (dnp3js == NULL) { return NULL;; } json_object_set_new(dnp3js, "type", json_string("request")); json_t *lcjs = JsonDNP3LogLinkControl(dnp3tx->request_lh.control); if (lcjs != NULL) { json_object_set_new(dnp3js, "control", lcjs); } json_object_set_new(dnp3js, "src", json_integer(dnp3tx->request_lh.src)); json_object_set_new(dnp3js, "dst", json_integer(dnp3tx->request_lh.dst)); /* DNP3 application layer. */ json_t *al = json_object(); if (al == NULL) { goto error; } json_object_set_new(dnp3js, "application", al); json_t *acjs = JsonDNP3LogApplicationControl(dnp3tx->request_ah.control); if (acjs != NULL) { json_object_set_new(al, "control", acjs); } json_object_set_new(al, "function_code", json_integer(dnp3tx->request_ah.function_code)); json_t *objects = JsonDNP3LogObjects(&dnp3tx->request_objects); if (objects != NULL) { json_object_set_new(al, "objects", objects); } json_object_set_new(al, "complete", json_boolean(dnp3tx->request_complete)); return dnp3js; error: json_decref(dnp3js); return NULL; } json_t *JsonDNP3LogResponse(DNP3Transaction *dnp3tx) { json_t *dnp3js = json_object(); if (dnp3js == NULL) { return NULL; } if (dnp3tx->response_ah.function_code == DNP3_APP_FC_UNSOLICITED_RESP) { json_object_set_new(dnp3js, "type", json_string("unsolicited_response")); } else { json_object_set_new(dnp3js, "type", json_string("response")); } json_t *lcjs = JsonDNP3LogLinkControl(dnp3tx->response_lh.control); if (lcjs != NULL) { json_object_set_new(dnp3js, "control", lcjs); } json_object_set_new(dnp3js, "src", json_integer(dnp3tx->response_lh.src)); json_object_set_new(dnp3js, "dst", json_integer(dnp3tx->response_lh.dst)); /* DNP3 application layer. */ json_t *al = json_object(); if (al == NULL) { goto error; } json_object_set_new(dnp3js, "application", al); json_t *acjs = JsonDNP3LogApplicationControl(dnp3tx->response_ah.control); if (acjs != NULL) { json_object_set_new(al, "control", acjs); } json_object_set_new(al, "function_code", json_integer(dnp3tx->response_ah.function_code)); json_t *iinjs = JsonDNP3LogIin(dnp3tx->response_iin.iin1 << 8 | dnp3tx->response_iin.iin2); if (iinjs != NULL) { json_object_set_new(dnp3js, "iin", iinjs); } json_t *objects = JsonDNP3LogObjects(&dnp3tx->response_objects); if (objects != NULL) { json_object_set_new(al, "objects", objects); } json_object_set_new(al, "complete", json_boolean(dnp3tx->response_complete)); return dnp3js; error: json_decref(dnp3js); return NULL; } static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id) { SCEnter(); LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data; DNP3Transaction *tx = vtx; MemBuffer *buffer = (MemBuffer *)thread->buffer; MemBufferReset(buffer); if (tx->has_request && tx->request_done) { json_t *js = CreateJSONHeader((Packet *)p, 1, "dnp3"); if (unlikely(js == NULL)) { return TM_ECODE_OK; } json_t *dnp3js = JsonDNP3LogRequest(tx); if (dnp3js != NULL) { json_object_set_new(js, "dnp3", dnp3js); OutputJSONBuffer(js, thread->dnp3log_ctx->file_ctx, &buffer); } json_decref(js); } SCReturnInt(TM_ECODE_OK); } static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id) { SCEnter(); LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data; DNP3Transaction *tx = vtx; MemBuffer *buffer = (MemBuffer *)thread->buffer; MemBufferReset(buffer); if (tx->has_response && tx->response_done) { json_t *js = CreateJSONHeader((Packet *)p, 1, "dnp3"); if (unlikely(js == NULL)) { return TM_ECODE_OK; } json_t *dnp3js = JsonDNP3LogResponse(tx); if (dnp3js != NULL) { json_object_set_new(js, "dnp3", dnp3js); OutputJSONBuffer(js, thread->dnp3log_ctx->file_ctx, &buffer); } json_decref(js); } SCReturnInt(TM_ECODE_OK); } static void OutputDNP3LogDeInitCtxSub(OutputCtx *output_ctx) { SCLogDebug("cleaning up sub output_ctx %p", output_ctx); LogDNP3FileCtx *dnp3log_ctx = (LogDNP3FileCtx *)output_ctx->data; SCFree(dnp3log_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "dnp3.json" static OutputCtx *OutputDNP3LogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { AlertJsonThread *ajt = parent_ctx->data; LogDNP3FileCtx *dnp3log_ctx = SCCalloc(1, sizeof(*dnp3log_ctx)); if (unlikely(dnp3log_ctx == NULL)) { return NULL; } dnp3log_ctx->file_ctx = ajt->file_ctx; OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); if (unlikely(output_ctx == NULL)) { SCFree(dnp3log_ctx); return NULL; } output_ctx->data = dnp3log_ctx; output_ctx->DeInit = OutputDNP3LogDeInitCtxSub; SCLogInfo("DNP3 log sub-module initialized."); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_DNP3); return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, void *initdata, void **data) { LogDNP3LogThread *thread = SCCalloc(1, sizeof(*thread)); if (unlikely(thread == NULL)) { return TM_ECODE_FAILED; } if (initdata == NULL) { SCLogDebug("Error getting context for DNP3. \"initdata\" is NULL."); SCFree(thread); return TM_ECODE_FAILED; } thread->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (unlikely(thread->buffer == NULL)) { SCFree(thread); return TM_ECODE_FAILED; } thread->dnp3log_ctx = ((OutputCtx *)initdata)->data; *data = (void *)thread; return TM_ECODE_OK; } static TmEcode JsonDNP3LogThreadDeinit(ThreadVars *t, void *data) { LogDNP3LogThread *thread = (LogDNP3LogThread *)data; if (thread == NULL) { return TM_ECODE_OK; } if (thread->buffer != NULL) { MemBufferFree(thread->buffer); } SCFree(thread); return TM_ECODE_OK; } void JsonDNP3LogRegister(void) { /* Register direction aware eve sub-modules. */ OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_DNP3, "eve-log", "JsonDNP3Log", "eve-log.dnp3", OutputDNP3LogInitSub, ALPROTO_DNP3, JsonDNP3LoggerToServer, 0, 1, JsonDNP3LogThreadInit, JsonDNP3LogThreadDeinit, NULL); OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_DNP3, "eve-log", "JsonDNP3Log", "eve-log.dnp3", OutputDNP3LogInitSub, ALPROTO_DNP3, JsonDNP3LoggerToClient, 1, 1, JsonDNP3LogThreadInit, JsonDNP3LogThreadDeinit, NULL); } #else void JsonDNP3LogRegister (void) { } #endif suricata-3.2.1/src/runmode-nflog.c0000644000000000000000000001576413051004444013736 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo */ #include "suricata-common.h" #include "config.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-nflog.h" #include "util-debug.h" #include "util-device.h" #include "util-runmodes.h" #include "util-misc.h" #include "source-nflog.h" static const char *default_mode = NULL; const char *RunModeIdsNflogGetDefaultMode(void) { return default_mode; } void RunModeIdsNflogRegister(void) { default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_NFLOG, "autofp", "Multi threaded nflog mode", RunModeIdsNflogAutoFp); RunModeRegisterNewRunMode(RUNMODE_NFLOG, "single", "Single threaded nflog mode", RunModeIdsNflogSingle); RunModeRegisterNewRunMode(RUNMODE_NFLOG, "workers", "Workers nflog mode", RunModeIdsNflogWorkers); return; } static void NflogDerefConfig(void *data) { NflogGroupConfig *nflogconf = (NflogGroupConfig *)data; SCFree(nflogconf); } void *ParseNflogConfig(const char *group) { ConfNode *group_root; ConfNode *group_default = NULL; ConfNode *nflog_node; NflogGroupConfig *nflogconf = SCMalloc(sizeof(*nflogconf)); intmax_t bufsize; intmax_t bufsize_max; intmax_t qthreshold; intmax_t qtimeout; int boolval; if (unlikely(nflogconf == NULL)) return NULL; if (group == NULL) { SCFree(nflogconf); return NULL; } nflogconf->DerefFunc = NflogDerefConfig; nflog_node = ConfGetNode("nflog"); if (nflog_node == NULL) { SCLogInfo("Unable to find nflog config using default value"); return nflogconf; } group_root = ConfNodeLookupKeyValue(nflog_node, "group", group); group_default = ConfNodeLookupKeyValue(nflog_node, "group", "default"); if (group_root == NULL && group_default == NULL) { SCLogInfo("Unable to find nflog config for " "group \"%s\" or \"default\", using default value", group); return nflogconf; } nflogconf->nful_overrun_warned = 0; strlcpy(nflogconf->numgroup, group, sizeof(nflogconf->numgroup)); if (ParseSizeStringU16(group, &nflogconf->group) < 0) { SCLogError(SC_ERR_NFLOG_GROUP, "NFLOG's group number invalid."); exit(EXIT_FAILURE); } boolval = ConfGetChildValueIntWithDefault(group_root, group_default, "buffer-size", &bufsize); if (boolval) nflogconf->nlbufsiz = bufsize; else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid buffer-size value"); SCFree(nflogconf); return NULL; } boolval = ConfGetChildValueIntWithDefault(group_root, group_default, "max-size", &bufsize_max); if (boolval) nflogconf->nlbufsiz_max = bufsize_max; else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid max-size value"); SCFree(nflogconf); return NULL; } if (nflogconf->nlbufsiz > nflogconf->nlbufsiz_max) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "buffer-size value larger " "than max-size value, adjusting buffer-size"); nflogconf->nlbufsiz = nflogconf->nlbufsiz_max; } boolval = ConfGetChildValueIntWithDefault(group_root, group_default, "qthreshold", &qthreshold); if (boolval) nflogconf->qthreshold = qthreshold; else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qthreshold value"); SCFree(nflogconf); return NULL; } boolval = ConfGetChildValueIntWithDefault(group_root, group_default, "qtimeout", &qtimeout); if (boolval) nflogconf->qtimeout = qtimeout; else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid qtimeout value"); SCFree(nflogconf); return NULL; } return nflogconf; } int NflogConfigGeThreadsCount(void *conf) { /* for each nflog group there is no reason to use more than 1 thread */ return 1; } int RunModeIdsNflogAutoFp(void) { SCEnter(); #ifdef HAVE_NFLOG int ret = 0; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureAutoFp(ParseNflogConfig, NflogConfigGeThreadsCount, "ReceiveNFLOG", "DecodeNFLOG", thread_name_autofp, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsNflogAutoFp initialised"); #endif /* HAVE_NFLOG */ SCReturnInt(0); } int RunModeIdsNflogSingle(void) { SCEnter(); #ifdef HAVE_NFLOG int ret = 0; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureSingle(ParseNflogConfig, NflogConfigGeThreadsCount, "ReceiveNFLOG", "DecodeNFLOG", thread_name_single, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsNflogSingle initialised"); #endif /* HAVE_NFLOG */ SCReturnInt(0); } int RunModeIdsNflogWorkers(void) { SCEnter(); #ifdef HAVE_NFLOG int ret = 0; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureWorkers(ParseNflogConfig, NflogConfigGeThreadsCount, "ReceiveNFLOG", "DecodeNFLOG", thread_name_workers, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsNflogWorkers initialised"); #endif /* HAVE_NFLOG */ SCReturnInt(0); } suricata-3.2.1/src/log-httplog.h0000644000000000000000000000200713051004444013411 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_HTTPLOG_H__ #define __LOG_HTTPLOG_H__ void LogHttpLogRegister(void); void TmModuleLogHttpLogIPv4Register (void); void TmModuleLogHttpLogIPv6Register (void); OutputCtx *LogHttpLogInitCtx(ConfNode *); #endif /* __LOG_HTTPLOG_H__ */ suricata-3.2.1/src/util-rule-vars.c0000644000000000000000000004254413051004444014051 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Rule variable utility functions */ #include "suricata-common.h" #include "conf.h" #include "conf-yaml-loader.h" #include "detect.h" #include "detect-content.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-rule-vars.h" #include "util-enum.h" #include "util-debug.h" #include "util-unittest.h" /** An enum-string map, that maps the different vars type in the yaml conf * type with the mapping path in the yaml conf file */ SCEnumCharMap sc_rule_vars_type_map[ ] = { { "vars.address-groups", SC_RULE_VARS_ADDRESS_GROUPS }, { "vars.port-groups", SC_RULE_VARS_PORT_GROUPS } }; /** * \internal * \brief Retrieves a value for a yaml mapping. The sequence from the yaml * conf file, from which the conf value has to be retrieved can be * specified by supplying a SCRuleVarsType enum. The string mapping * for each of the SCRuleVarsType is present in sc_rule_vars_type_map. * * \param conf_var_name Pointer to a character string containing the conf var * name, whose value has to be retrieved from the yaml * conf file. * \param conf_vars_type Holds an enum value that indicates the kind of yaml * mapping that has to be retrieved. Can be one of the * values in SCRuleVarsType. * * \retval conf_var_name_value Pointer to the string containing the conf value * on success; NULL on failure. */ char *SCRuleVarsGetConfVar(const DetectEngineCtx *de_ctx, const char *conf_var_name, SCRuleVarsType conf_vars_type) { SCEnter(); const char *conf_var_type_name = NULL; char conf_var_full_name[2048]; char *conf_var_full_name_value = NULL; if (conf_var_name == NULL) goto end; while (conf_var_name[0] != '\0' && isspace((unsigned char)conf_var_name[0])) { conf_var_name++; } (conf_var_name[0] == '$') ? conf_var_name++ : conf_var_name; conf_var_type_name = SCMapEnumValueToName(conf_vars_type, sc_rule_vars_type_map); if (conf_var_type_name == NULL) goto end; if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) { if (snprintf(conf_var_full_name, sizeof(conf_var_full_name), "%s.%s.%s", de_ctx->config_prefix, conf_var_type_name, conf_var_name) < 0) { goto end; } } else { if (snprintf(conf_var_full_name, sizeof(conf_var_full_name), "%s.%s", conf_var_type_name, conf_var_name) < 0) { goto end; } } if (ConfGet(conf_var_full_name, &conf_var_full_name_value) != 1) { SCLogError(SC_ERR_UNDEFINED_VAR, "Variable \"%s\" is not defined in " "configuration file", conf_var_name); goto end; } SCLogDebug("Value obtained from the yaml conf file, for the var " "\"%s\" is \"%s\"", conf_var_name, conf_var_full_name_value); end: SCReturnCharPtr(conf_var_full_name_value); } /**********************************Unittests***********************************/ #ifdef UNITTESTS static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "default-log-dir: /var/log/suricata\n" "\n" "logging:\n" "\n" " default-log-level: debug\n" "\n" " default-format: \"<%t> - <%l>\"\n" "\n" " default-startup-message: Your IDS has started.\n" "\n" " default-output-filter:\n" "\n" " output:\n" "\n" " - interface: console\n" " log-level: info\n" "\n" " - interface: file\n" " filename: /var/log/suricata.log\n" "\n" " - interface: syslog\n" " facility: local5\n" " format: \"%l\"\n" "\n" "pfring:\n" "\n" " interface: eth0\n" "\n" " clusterid: 99\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:" "13c5:5AFE::/64,2001:888:13c5:CAFE::/64]\"\n" "\n" " EXTERNAL_NET: \"[!192.168.0.0/16,2000::/3]\"\n" "\n" " HTTP_SERVERS: \"!192.168.0.0/16\"\n" "\n" " SMTP_SERVERS: \"!192.168.0.0/16\"\n" "\n" " SQL_SERVERS: \"!192.168.0.0/16\"\n" "\n" " DNS_SERVERS: any\n" "\n" " TELNET_SERVERS: any\n" "\n" " AIM_SERVERS: any\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n" " SHELLCODE_PORTS: 80\n" "\n" " ORACLE_PORTS: 1521\n" "\n" " SSH_PORTS: 22\n" "\n"; /** * \test Check that valid address and port group vars are correctly retrieved * from the configuration. */ int SCRuleVarsPositiveTest01(void) { int result = 1; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); /* check for address-groups */ result &= (SCRuleVarsGetConfVar(NULL,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS), "[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:13c5:" "5AFE::/64,2001:888:13c5:CAFE::/64]") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$EXTERNAL_NET", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$EXTERNAL_NET", SC_RULE_VARS_ADDRESS_GROUPS), "[!192.168.0.0/16,2000::/3]") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$HTTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$HTTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "!192.168.0.0/16") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$SMTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$SMTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "!192.168.0.0/16") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$SQL_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$SQL_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "!192.168.0.0/16") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$DNS_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$DNS_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "any") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$TELNET_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$TELNET_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "any") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "any") == 0); /* Test that a leading space is stripped. */ result &= (SCRuleVarsGetConfVar(NULL," $AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL," $AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS), "any") == 0); /* check for port-groups */ result &= (SCRuleVarsGetConfVar(NULL,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS), "80:81,88") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$SHELLCODE_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$SHELLCODE_PORTS", SC_RULE_VARS_PORT_GROUPS), "80") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$ORACLE_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$ORACLE_PORTS", SC_RULE_VARS_PORT_GROUPS), "1521") == 0); result &= (SCRuleVarsGetConfVar(NULL,"$SSH_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$SSH_PORTS", SC_RULE_VARS_PORT_GROUPS), "22") == 0); ConfDeInit(); ConfRestoreContextBackup(); return result; } /** * \test Check that invalid address and port groups are properly handled by the * API. */ int SCRuleVarsNegativeTest02(void) { int result = 1; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); result &= (SCRuleVarsGetConfVar(NULL,"$HOME_NETW", SC_RULE_VARS_ADDRESS_GROUPS) == NULL); result &= (SCRuleVarsGetConfVar(NULL,"$home_net", SC_RULE_VARS_ADDRESS_GROUPS) == NULL); result &= (SCRuleVarsGetConfVar(NULL,"$TOMCAT_PORTSW", SC_RULE_VARS_PORT_GROUPS) == NULL); result &= (SCRuleVarsGetConfVar(NULL,"$tomcat_ports", SC_RULE_VARS_PORT_GROUPS) == NULL); ConfDeInit(); ConfRestoreContextBackup(); return result; } /** * \test Check that Signatures with valid address and port groups are parsed * without any errors by the Signature parsing API. */ int SCRuleVarsPositiveTest03(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; /* s = SigInit(de_ctx, "alert tcp $HTTP_SERVERS any -> any any (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $SMTP_SERVERS any -> $HTTP_SERVERS any (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $AIM_SERVERS any -> $AIM_SERVERS any (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $TELNET_SERVERS any -> any $SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $TELNET_SERVERS any -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $TELNET_SERVERS 80 -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $TELNET_SERVERS !80 -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !$HTTP_SERVERS !80 -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp 192.168.1.2 any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !192.168.1.2 any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !192.168.1.2 any -> any !$HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !192.168.1.2 any -> !$HTTP_SERVERS !$HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !192.168.1.2 $HTTP_PORTS -> !$HTTP_SERVERS !$HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp [!192.168.24.0/23,!167.12.0.0/24] any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp ![192.168.24.0/23,!167.12.0.0/24] any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp [$HOME_NET,!192.168.1.2] $HTTP_PORTS -> !$HTTP_SERVERS !$HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp [[192.168.1.3,$EXTERNAL_NET],192.168.2.5] $HTTP_PORTS -> !$HTTP_SERVERS !$HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp [[192.168.1.3,$EXTERNAL_NET],192.168.2.5] $HTTP_PORTS -> !$HTTP_SERVERS [80,[!$HTTP_PORTS,$ORACLE_PORTS]] (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); */ s = SigInit(de_ctx, "alert tcp [$HTTP_SERVERS,$HOME_NET,192.168.2.5] $HTTP_PORTS -> $EXTERNAL_NET [80,[!$HTTP_PORTS,$ORACLE_PORTS]] (msg:\"Rule Vars Test\"; sid:1;)"); if (s == NULL) goto end; SigFree(s); result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check that Signatures with invalid address and port groups, are * are invalidated by the Singature parsing API. */ int SCRuleVarsNegativeTest04(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx, "alert tcp $HTTP_SERVER any -> any any (msg:\"Rule Vars Test\"; sid:1;)"); if (s != NULL) goto end; s = SigInit(de_ctx, "alert tcp $http_servers any -> any any (msg:\"Rule Vars Test\"; sid:1;)"); if (s != NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp $http_servers any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s != NULL) goto end; SigFree(s); s = SigInit(de_ctx, "alert tcp !$TELNET_SERVERS !80 -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)"); if (s != NULL) goto end; SigFree(s); result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } static const char *dummy_mt_conf_string = "%YAML 1.1\n" "---\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[1.2.3.4]\"\n" " port-groups:\n" " HTTP_PORTS: \"12345\"\n" "multi-detect:\n" " 0:\n" " vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[8.8.8.8]\"\n" " port-groups:\n" " HTTP_PORTS: \"54321\"\n" "\n"; /** * \test Check that valid address and port group vars are correctly retrieved * from the configuration. */ int SCRuleVarsMTest01(void) { int result = 0; DetectEngineCtx *de_ctx = NULL; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_mt_conf_string, strlen(dummy_mt_conf_string)); if ( (de_ctx = DetectEngineCtxInit()) == NULL) return 0; de_ctx->flags |= DE_QUIET; snprintf(de_ctx->config_prefix, sizeof(de_ctx->config_prefix), "multi-detect.0"); /* check for address-groups */ result = (SCRuleVarsGetConfVar(de_ctx,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(de_ctx,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS), "[8.8.8.8]") == 0); if (result == 0) goto end; result = (SCRuleVarsGetConfVar(NULL,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS), "[1.2.3.4]") == 0); if (result == 0) goto end; /* check for port-groups */ result = (SCRuleVarsGetConfVar(de_ctx,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(de_ctx,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS), "54321") == 0); if (result == 0) goto end; result = (SCRuleVarsGetConfVar(NULL,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS) != NULL && strcmp(SCRuleVarsGetConfVar(NULL,"$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS), "12345") == 0); if (result == 0) goto end; end: ConfDeInit(); ConfRestoreContextBackup(); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void SCRuleVarsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCRuleVarsPositiveTest01", SCRuleVarsPositiveTest01); UtRegisterTest("SCRuleVarsNegativeTest02", SCRuleVarsNegativeTest02); UtRegisterTest("SCRuleVarsPositiveTest03", SCRuleVarsPositiveTest03); UtRegisterTest("SCRuleVarsNegativeTest04", SCRuleVarsNegativeTest04); UtRegisterTest("SCRuleVarsMTest01", SCRuleVarsMTest01); #endif return; } suricata-3.2.1/src/util-logopenfile-tile.c0000644000000000000000000002540313051004444015362 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Ken Steele, Tilera Corporation * * File-like output for logging on Tilera PCIe cards (TILEncore-Gx) * add the option to send logs across PCIe and then write the output * files on the host system. * */ #include #include "suricata-common.h" /* errno.h, string.h, etc. */ #include "tm-modules.h" /* LogFileCtx */ #include "conf.h" /* ConfNode, etc. */ #include "util-atomic.h" #include "util-logopenfile-tile.h" #ifdef __tile__ #include #include #if MDE_VERSION_CODE >= MDE_VERSION(4,1,0) #include #else #include #endif /* * Tilera trio (PCIe) configuration. */ static gxio_trio_context_t trio_context_body; static gxio_trio_context_t* trio_context = &trio_context_body; /* * gxpci contexts used for log relay */ static gxpci_context_t gxpci_context_body; static gxpci_context_t *gxpci_context = &gxpci_context_body; /* The TRIO index. */ static int trio_index = 0; /* The queue index of a packet queue. */ static unsigned int queue_index = 0; /* The local PCIe MAC index. */ static int loc_mac; /* * Code for writing files over PCIe to host on Tilera TILEncore PCIe cards. */ #define OP_OPEN 1 #define OP_WRITE 2 #define OP_CLOSE 3 /** Maximum number of commands in one PCIe function call */ #define MAX_CMDS_BATCH 64 typedef struct { uint32_t magic; uint32_t fileno; uint32_t op; uint32_t seq; uint32_t len; uint32_t next_offset; char buf[]; } __attribute__((__packed__)) PcieMsg; static int gxpci_fileno = 0; static int pcie_initialized = 0; /* Allocate a Huge page of memory, registered with Trio, into which data to be sent over PCIe is written. Each write starts at wc_pos. */ static char *log_mem = NULL; static uint64_t wr_pos; /* write position within log_mem */ static SCMutex raw_mutex __attribute__((aligned(64))); static SCMutex pcie_mutex __attribute__((aligned(64))); #define CHECK_SEQ_NUM 1 #ifdef CHECK_SEQ_NUM static uint32_t raw_seq = 0; #endif static uint32_t comps_rcvd = 0; /* Block of memory registered with PCIe DMA engine as a source for * PCIe data transfers. Must be <= Huge Page size (16 MB). * Must be large enough that it can't wrap before first PCIe transfer * has completed. */ #define PCIE_MEMORY_BLOCK_SIZE (4 * 1024 * 1024) /* Send a buffer over PCIe to Host memory. * len must be smaller than one Packet Queue transfer block. * TODO: Check errors */ static void TilePcieDMABuf(void *buf, uint32_t len) { gxpci_comp_t comp[MAX_CMDS_BATCH]; gxpci_cmd_t cmd; int result; int credits; SCMutexLock(&pcie_mutex); #ifdef CHECK_SEQ_NUM ((PcieMsg *)buf)->seq = ++raw_seq; __insn_mf(); #endif /* Wait for credits to be available for more PCIe writes. */ do { result = gxpci_get_comps(gxpci_context, comp, 0, MAX_CMDS_BATCH); if (result) { if (unlikely(result == GXPCI_ERESET)) { SCLogInfo("gxpci channel is reset"); return; } else { __sync_fetch_and_add(&comps_rcvd, result); } } credits = gxpci_get_cmd_credits(gxpci_context); if (unlikely(credits == GXPCI_ERESET)) { SCLogInfo("gxpci channel is reset"); return; } } while (credits == 0); cmd.buffer = buf; /* Round transfer size up to next host cache-line. This will * transfer more data, but is more efficient. */ cmd.size = (len + (CLS - 1)) & ~(CLS - 1); __insn_mf(); /* Loop until the command is sent. */ do { /* Send PCIe command to packet queue from tile to host. */ result = gxpci_pq_t2h_cmd(gxpci_context, &cmd); if (result == 0) break; if (result == GXPCI_ERESET) { SCLogInfo("gxpci channel is reset"); break; } /* Not enough credits to send command? */ if (result == GXPCI_ECREDITS) continue; } while (1); SCMutexUnlock(&pcie_mutex); } /* Allocate a buffer for data that can be sent over PCIe. Reserves * space at the beginning for the Pcie msg. The buffer is allocated * from a 4MB pool on one huge page. The allocation simply walks * throught the buffer sequentially. This removes the need to free * the buffers, as they simply age out. */ static PcieMsg *TilePcieAllocateBuffer(size_t size) { size += sizeof(PcieMsg); /* Round up to cache-line size */ size = (size + (CLS - 1)) & ~(CLS - 1); PcieMsg *pmsg; SCMutexLock(&raw_mutex); pmsg = (PcieMsg *)&log_mem[wr_pos]; wr_pos += size; if (wr_pos > PCIE_MEMORY_BLOCK_SIZE) { /* Don't have enough space at the end of the memory block, so * wrap to the start. */ pmsg = (PcieMsg *)&log_mem[0]; wr_pos = size; } SCMutexUnlock(&raw_mutex); return pmsg; } static void PcieWriteOpen(PcieFile *fp, const char *path, const char append) { /* Need space for file name, file mode character and string termination */ const int buffer_size = strlen(path) + 2; /* Allocate space in the PCIe output buffer */ PcieMsg *p = TilePcieAllocateBuffer(buffer_size); p->magic = 5555; p->fileno = fp->fileno; p->op = OP_OPEN; p->len = offsetof(PcieMsg, buf); /* Format is one character Mode, followed by file path. */ p->len += snprintf(p->buf, buffer_size, "%c%s", append, path); TilePcieDMABuf(p, p->len); } static int TilePcieWrite(const char *buffer, int buffer_len, LogFileCtx *log_ctx) { PcieFile *fp = log_ctx->pcie_fp; /* Allocate space in the PCIe output buffer */ PcieMsg *p = TilePcieAllocateBuffer(buffer_len); p->magic = 5555; p->fileno = fp->fileno; p->op = OP_WRITE; p->len = offsetof(PcieMsg, buf); p->len += buffer_len; p->next_offset = 0; /* Can remove the need for this memcpy later. */ memcpy(p->buf, buffer, buffer_len); TilePcieDMABuf(p, p->len); return buffer_len; } static PcieFile *TileOpenPcieFpInternal(const char *path, const char append_char) { int result; PcieFile *fp; /* Only initialize once */ if (SCAtomicCompareAndSwap(&pcie_initialized, 0, 1)) { SCMutexInit(&raw_mutex, NULL); SCMutexInit(&pcie_mutex, NULL); SCLogInfo("Initializing Tile-Gx PCIe index %d / %d, queue: %d", trio_index, loc_mac, queue_index); result = gxio_trio_init(trio_context, trio_index); if (result < 0) { pcie_initialized = 0; SCLogError(SC_ERR_PCIE_INIT_FAILED, "gxio_trio_init() failed: %d: %s", result, gxio_strerror(result)); return NULL; } result = gxpci_init(trio_context, gxpci_context, trio_index, loc_mac); if (result < 0) { pcie_initialized = 0; SCLogError(SC_ERR_PCIE_INIT_FAILED, "gxpci_init() failed: %d: %s", result, gxpci_strerror(result)); return NULL; } /* * This indicates that we need to allocate an ASID ourselves, * instead of using one that is allocated somewhere else. */ int asid = GXIO_ASID_NULL; result = gxpci_open_queue(gxpci_context, asid, GXPCI_PQ_T2H, 0, queue_index, 0, 0); if (result < 0) { pcie_initialized = 0; SCLogError(SC_ERR_PCIE_INIT_FAILED, "gxpci_open_queue() failed: %d: %s", result, gxpci_strerror(result)); return NULL; } /* * Allocate and register data buffer */ size_t hugepagesz = tmc_alloc_get_huge_pagesize(); tmc_alloc_t alloc = TMC_ALLOC_INIT; tmc_alloc_set_huge(&alloc); tmc_alloc_set_home(&alloc, TMC_ALLOC_HOME_HASH); tmc_alloc_set_pagesize_exact(&alloc, hugepagesz); log_mem = tmc_alloc_map(&alloc, hugepagesz); BUG_ON(PCIE_MEMORY_BLOCK_SIZE > hugepagesz); result = gxpci_iomem_register(gxpci_context, log_mem, hugepagesz); if (result < 0) { pcie_initialized = 0; SCLogError(SC_ERR_PCIE_INIT_FAILED, "gxpci_iomem_register() failed: %d: %s", result, gxpci_strerror(result)); return NULL; } } fp = SCMalloc(sizeof(PcieFile)); if (fp == NULL) { SCLogError(SC_ERR_PCIE_INIT_FAILED, "Failed to Allocate memory for PCIe file pointer"); return NULL; } /* Sequentially allocate File descriptor numbers. Not currently ever freed */ fp->fileno = SCAtomicFetchAndAdd(&gxpci_fileno, 1); PcieWriteOpen(fp, path, append_char); return fp; } /** \brief Close a PCIe file * \param PCIe file desriptor */ static void TileClosePcieFp(LogFileCtx *log_ctx) { SCLogInfo("Closing Tile-Gx PCIe: %s", log_ctx->filename); /* TODO: Need to count open files and close when reaches zero. */ SCMutexLock(&pcie_mutex); if (gxpci_context) { gxpci_destroy(gxpci_context); gxpci_context = NULL; } SCMutexUnlock(&pcie_mutex); free(log_ctx->pcie_fp); } /** \brief open the indicated file remotely over PCIe to a host * \param path filesystem path to open * \param append_setting open file with O_APPEND: "yes" or "no" * \retval FILE* on success * \retval NULL on error */ PcieFile *TileOpenPcieFp(LogFileCtx *log_ctx, const char *path, const char *append_setting) { PcieFile *ret = NULL; if (ConfValIsTrue(append_setting)) { ret = TileOpenPcieFpInternal(path, 'a'); } else { ret = TileOpenPcieFpInternal(path, 'w'); } /* Override the default Write and Close functions * with PCIe Write and Close functions. */ log_ctx->Write = TilePcieWrite; log_ctx->Close = TileClosePcieFp; if (ret == NULL) SCLogError(SC_ERR_FOPEN, "Error opening PCIe file: \"%s\": %s", path, strerror(errno)); return ret; } #endif /* __tilegx__ */ suricata-3.2.1/src/host-timeout.h0000644000000000000000000000170413051004444013615 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __HOST_TIMEOUT_H__ #define __HOST_TIMEOUT_H__ uint32_t HostTimeoutHash(struct timeval *ts); uint32_t HostGetSpareCount(void); uint32_t HostGetActiveCount(void); #endif suricata-3.2.1/src/ippair-timeout.h0000644000000000000000000000171513051004444014126 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __IPPAIR_TIMEOUT_H__ #define __IPPAIR_TIMEOUT_H__ uint32_t IPPairTimeoutHash(struct timeval *ts); uint32_t IPPairGetSpareCount(void); uint32_t IPPairGetActiveCount(void); #endif suricata-3.2.1/src/output-json.c0000644000000000000000000004245013051004444013461 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Logs detection and monitoring events in JSON format. * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "app-layer-parser.h" #include "util-classification-config.h" #include "util-syslog.h" #include "output.h" #include "output-json.h" #include "util-byte.h" #include "util-privs.h" #include "util-print.h" #include "util-proto-name.h" #include "util-optimize.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-device.h" #ifndef HAVE_LIBJANSSON /** Handle the case where no JSON support is compiled in. * */ int OutputJsonOpenFileCtx(LogFileCtx *, char *); void OutputJsonRegister (void) { SCLogDebug("Can't register JSON output - JSON support was disabled during build."); } #else /* implied we do have JSON support */ #define DEFAULT_LOG_FILENAME "eve.json" #define DEFAULT_ALERT_SYSLOG_FACILITY_STR "local0" #define DEFAULT_ALERT_SYSLOG_FACILITY LOG_LOCAL0 #define DEFAULT_ALERT_SYSLOG_LEVEL LOG_INFO #define MODULE_NAME "OutputJSON" #define OUTPUT_BUFFER_SIZE 65536 static void OutputJsonDeInitCtx(OutputCtx *); void OutputJsonRegister (void) { OutputRegisterModule(MODULE_NAME, "eve-log", OutputJsonInitCtx); } /* Default Sensor ID value */ static int64_t sensor_id = -1; /* -1 = not defined */ /** \brief jsonify tcp flags field * Only add 'true' fields in an attempt to keep things reasonably compact. */ void JsonTcpFlags(uint8_t flags, json_t *js) { if (flags & TH_SYN) json_object_set_new(js, "syn", json_true()); if (flags & TH_FIN) json_object_set_new(js, "fin", json_true()); if (flags & TH_RST) json_object_set_new(js, "rst", json_true()); if (flags & TH_PUSH) json_object_set_new(js, "psh", json_true()); if (flags & TH_ACK) json_object_set_new(js, "ack", json_true()); if (flags & TH_URG) json_object_set_new(js, "urg", json_true()); if (flags & TH_ECN) json_object_set_new(js, "ecn", json_true()); if (flags & TH_CWR) json_object_set_new(js, "cwr", json_true()); } void CreateJSONFlowId(json_t *js, const Flow *f) { if (f == NULL) return; int64_t flow_id = FlowGetId(f); /* reduce to 51 bits as Javascript and even JSON often seem to * max out there. */ flow_id &= 0x7ffffffffffffLL; json_object_set_new(js, "flow_id", json_integer(flow_id)); } json_t *CreateJSONHeader(const Packet *p, int direction_sensitive, const char *event_type) { char timebuf[64]; char srcip[46], dstip[46]; Port sp, dp; json_t *js = json_object(); if (unlikely(js == NULL)) return NULL; CreateIsoTimeString(&p->ts, timebuf, sizeof(timebuf)); srcip[0] = '\0'; dstip[0] = '\0'; if (direction_sensitive) { if ((PKT_IS_TOSERVER(p))) { if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); } sp = p->sp; dp = p->dp; } else { if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), dstip, sizeof(dstip)); } sp = p->dp; dp = p->sp; } } else { if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); } sp = p->sp; dp = p->dp; } char proto[16]; if (SCProtoNameValid(IP_GET_IPPROTO(p)) == TRUE) { strlcpy(proto, known_proto[IP_GET_IPPROTO(p)], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "%03" PRIu32, IP_GET_IPPROTO(p)); } /* time & tx */ json_object_set_new(js, "timestamp", json_string(timebuf)); CreateJSONFlowId(js, (const Flow *)p->flow); /* sensor id */ if (sensor_id >= 0) json_object_set_new(js, "sensor_id", json_integer(sensor_id)); /* input interface */ if (p->livedev) { json_object_set_new(js, "in_iface", json_string(p->livedev->dev)); } /* pcap_cnt */ if (p->pcap_cnt != 0) { json_object_set_new(js, "pcap_cnt", json_integer(p->pcap_cnt)); } if (event_type) { json_object_set_new(js, "event_type", json_string(event_type)); } /* vlan */ if (p->vlan_idx > 0) { json_t *js_vlan; switch (p->vlan_idx) { case 1: json_object_set_new(js, "vlan", json_integer(VLAN_GET_ID1(p))); break; case 2: js_vlan = json_array(); if (unlikely(js != NULL)) { json_array_append_new(js_vlan, json_integer(VLAN_GET_ID1(p))); json_array_append_new(js_vlan, json_integer(VLAN_GET_ID2(p))); json_object_set_new(js, "vlan", js_vlan); } break; default: /* shouldn't get here */ break; } } /* tuple */ json_object_set_new(js, "src_ip", json_string(srcip)); switch(p->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "src_port", json_integer(sp)); break; } json_object_set_new(js, "dest_ip", json_string(dstip)); switch(p->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "dest_port", json_integer(dp)); break; } json_object_set_new(js, "proto", json_string(proto)); switch (p->proto) { case IPPROTO_ICMP: if (p->icmpv4h) { json_object_set_new(js, "icmp_type", json_integer(p->icmpv4h->type)); json_object_set_new(js, "icmp_code", json_integer(p->icmpv4h->code)); } break; case IPPROTO_ICMPV6: if (p->icmpv6h) { json_object_set_new(js, "icmp_type", json_integer(p->icmpv6h->type)); json_object_set_new(js, "icmp_code", json_integer(p->icmpv6h->code)); } break; } return js; } json_t *CreateJSONHeaderWithTxId(const Packet *p, int direction_sensitive, const char *event_type, uint64_t tx_id) { json_t *js = CreateJSONHeader(p, direction_sensitive, event_type); if (unlikely(js == NULL)) return NULL; /* tx id for correlation with other events */ json_object_set_new(js, "tx_id", json_integer(tx_id)); return js; } int OutputJSONMemBufferCallback(const char *str, size_t size, void *data) { OutputJSONMemBufferWrapper *wrapper = data; MemBuffer **memb = wrapper->buffer; if (MEMBUFFER_OFFSET(*memb) + size >= MEMBUFFER_SIZE(*memb)) { MemBufferExpand(memb, wrapper->expand_by); } MemBufferWriteRaw((*memb), str, size); return 0; } int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer) { if (file_ctx->sensor_name) { json_object_set_new(js, "host", json_string(file_ctx->sensor_name)); } if (file_ctx->prefix) { MemBufferWriteRaw((*buffer), file_ctx->prefix, file_ctx->prefix_len); } OutputJSONMemBufferWrapper wrapper = { .buffer = buffer, .expand_by = OUTPUT_BUFFER_SIZE }; int r = json_dump_callback(js, OutputJSONMemBufferCallback, &wrapper, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); if (r != 0) return TM_ECODE_OK; LogFileWrite(file_ctx, *buffer); return 0; } /** * \brief Create a new LogFileCtx for "fast" output style. * \param conf The configuration node for this output. * \return A LogFileCtx pointer on success, NULL on failure. */ OutputCtx *OutputJsonInitCtx(ConfNode *conf) { OutputJsonCtx *json_ctx = SCCalloc(1, sizeof(OutputJsonCtx));; /* First lookup a sensor-name value in this outputs configuration * node (deprecated). If that fails, lookup the global one. */ const char *sensor_name = ConfNodeLookupChildValue(conf, "sensor-name"); if (sensor_name != NULL) { SCLogWarning(SC_ERR_DEPRECATED_CONF, "Found deprecated eve-log setting \"sensor-name\". " "Please set sensor-name globally."); } else { (void)ConfGet("sensor-name", (char **)&sensor_name); } if (unlikely(json_ctx == NULL)) { SCLogDebug("AlertJsonInitCtx: Could not create new LogFileCtx"); return NULL; } json_ctx->file_ctx = LogFileNewCtx(); if (unlikely(json_ctx->file_ctx == NULL)) { SCLogDebug("AlertJsonInitCtx: Could not create new LogFileCtx"); SCFree(json_ctx); return NULL; } if (sensor_name) { json_ctx->file_ctx->sensor_name = SCStrdup(sensor_name); if (json_ctx->file_ctx->sensor_name == NULL) { LogFileFreeCtx(json_ctx->file_ctx); SCFree(json_ctx); return NULL; } } else { json_ctx->file_ctx->sensor_name = NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(json_ctx->file_ctx); SCFree(json_ctx); return NULL; } output_ctx->data = json_ctx; output_ctx->DeInit = OutputJsonDeInitCtx; if (conf) { const char *output_s = ConfNodeLookupChildValue(conf, "filetype"); // Backwards compatibility if (output_s == NULL) { output_s = ConfNodeLookupChildValue(conf, "type"); } if (output_s != NULL) { if (strcmp(output_s, "file") == 0 || strcmp(output_s, "regular") == 0) { json_ctx->json_out = LOGFILE_TYPE_FILE; } else if (strcmp(output_s, "syslog") == 0) { json_ctx->json_out = LOGFILE_TYPE_SYSLOG; } else if (strcmp(output_s, "unix_dgram") == 0) { json_ctx->json_out = LOGFILE_TYPE_UNIX_DGRAM; } else if (strcmp(output_s, "unix_stream") == 0) { json_ctx->json_out = LOGFILE_TYPE_UNIX_STREAM; } else if (strcmp(output_s, "redis") == 0) { #ifdef HAVE_LIBHIREDIS json_ctx->json_out = LOGFILE_TYPE_REDIS; #else SCLogError(SC_ERR_INVALID_ARGUMENT, "redis JSON output option is not compiled"); exit(EXIT_FAILURE); #endif } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid JSON output option: %s", output_s); exit(EXIT_FAILURE); } } const char *prefix = ConfNodeLookupChildValue(conf, "prefix"); if (prefix != NULL) { SCLogInfo("Using prefix '%s' for JSON messages", prefix); json_ctx->file_ctx->prefix = SCStrdup(prefix); if (json_ctx->file_ctx->prefix == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for eve-log.prefix setting."); exit(EXIT_FAILURE); } json_ctx->file_ctx->prefix_len = strlen(prefix); } if (json_ctx->json_out == LOGFILE_TYPE_FILE || json_ctx->json_out == LOGFILE_TYPE_UNIX_DGRAM || json_ctx->json_out == LOGFILE_TYPE_UNIX_STREAM) { if (SCConfLogOpenGeneric(conf, json_ctx->file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(json_ctx->file_ctx); SCFree(json_ctx); SCFree(output_ctx); return NULL; } OutputRegisterFileRotationFlag(&json_ctx->file_ctx->rotation_flag); const char *format_s = ConfNodeLookupChildValue(conf, "format"); if (format_s != NULL) { if (strcmp(format_s, "indent") == 0) { json_ctx->format = INDENT; } else if (strcmp(format_s, "compact") == 0) { json_ctx->format = COMPACT; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid JSON format option: %s", format_s); exit(EXIT_FAILURE); } } } else if (json_ctx->json_out == LOGFILE_TYPE_SYSLOG) { const char *facility_s = ConfNodeLookupChildValue(conf, "facility"); if (facility_s == NULL) { facility_s = DEFAULT_ALERT_SYSLOG_FACILITY_STR; } int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap()); if (facility == -1) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog facility: \"%s\"," " now using \"%s\" as syslog facility", facility_s, DEFAULT_ALERT_SYSLOG_FACILITY_STR); facility = DEFAULT_ALERT_SYSLOG_FACILITY; } const char *level_s = ConfNodeLookupChildValue(conf, "level"); if (level_s != NULL) { int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap()); if (level != -1) { json_ctx->file_ctx->syslog_setup.alert_syslog_level = level; } } const char *ident = ConfNodeLookupChildValue(conf, "identity"); /* if null we just pass that to openlog, which will then * figure it out by itself. */ openlog(ident, LOG_PID|LOG_NDELAY, facility); } #ifdef HAVE_LIBHIREDIS else if (json_ctx->json_out == LOGFILE_TYPE_REDIS) { ConfNode *redis_node = ConfNodeLookupChild(conf, "redis"); if (!json_ctx->file_ctx->sensor_name) { char hostname[1024]; gethostname(hostname, 1023); json_ctx->file_ctx->sensor_name = SCStrdup(hostname); } if (json_ctx->file_ctx->sensor_name == NULL) { LogFileFreeCtx(json_ctx->file_ctx); SCFree(json_ctx); SCFree(output_ctx); return NULL; } if (SCConfLogOpenRedis(redis_node, json_ctx->file_ctx) < 0) { LogFileFreeCtx(json_ctx->file_ctx); SCFree(json_ctx); SCFree(output_ctx); return NULL; } } #endif const char *sensor_id_s = ConfNodeLookupChildValue(conf, "sensor-id"); if (sensor_id_s != NULL) { if (ByteExtractStringUint64((uint64_t *)&sensor_id, 10, 0, sensor_id_s) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize JSON output, " "invalid sensor-is: %s", sensor_id_s); exit(EXIT_FAILURE); } } json_ctx->file_ctx->type = json_ctx->json_out; } SCLogDebug("returning output_ctx %p", output_ctx); return output_ctx; } static void OutputJsonDeInitCtx(OutputCtx *output_ctx) { OutputJsonCtx *json_ctx = (OutputJsonCtx *)output_ctx->data; LogFileCtx *logfile_ctx = json_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(json_ctx); SCFree(output_ctx); } #endif suricata-3.2.1/src/detect-filesha1.h0000644000000000000000000000173413051004444014121 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva */ #ifndef __DETECT_FILESHA1_H__ #define __DETECT_FILESHA1_H__ /* prototypes */ void DetectFileSha1Register (void); #endif /* __DETECT_FILESHA1_H__ */ suricata-3.2.1/src/util-spm-bm.h0000644000000000000000000000314213051004444013320 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * */ #ifndef __UTIL_SPM_BM__ #define __UTIL_SPM_BM__ #include "suricata-common.h" #include "suricata.h" #define ALPHABET_SIZE 256 /* Context for booyer moore */ typedef struct BmCtx_ { uint16_t bmBc[ALPHABET_SIZE]; uint16_t *bmGs; // = SCMalloc(sizeof(int32_t)*(needlelen + 1)); } BmCtx; /** Prepare and return a Boyer Moore context */ BmCtx *BoyerMooreCtxInit(const uint8_t *needle, uint16_t needle_len); BmCtx *BoyerMooreNocaseCtxInit(uint8_t *needle, uint16_t needle_len); void BoyerMooreCtxToNocase(BmCtx *, uint8_t *, uint16_t); uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx); uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx); void BoyerMooreCtxDeInit(BmCtx *); void SpmBMRegister(void); #endif /* __UTIL_SPM_BM__ */ suricata-3.2.1/src/detect-reference.c0000644000000000000000000002270613051004444014360 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * \author Anoop Saldanha * * Implements the reference keyword support */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "decode.h" #include "flow-var.h" #include "decode-events.h" #include "stream-tcp.h" #include "util-reference-config.h" #include "detect-reference.h" #include "util-unittest.h" #include "util-byte.h" #include "util-debug.h" #define PARSE_REGEX "^\\s*([A-Za-z0-9]+)\\s*,\"?\\s*\"?\\s*([a-zA-Z0-9\\-_\\.\\/\\?\\=]+)\"?\\s*\"?" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectReferenceSetup(DetectEngineCtx *, Signature *s, char *str); /** * \brief Registration function for the reference: keyword */ void DetectReferenceRegister(void) { sigmatch_table[DETECT_REFERENCE].name = "reference"; sigmatch_table[DETECT_REFERENCE].desc = "direct to places where information about the rule can be found"; sigmatch_table[DETECT_REFERENCE].url = DOC_URL DOC_VERSION "/rules/meta.html#reference"; sigmatch_table[DETECT_REFERENCE].Match = NULL; sigmatch_table[DETECT_REFERENCE].Setup = DetectReferenceSetup; sigmatch_table[DETECT_REFERENCE].Free = NULL; sigmatch_table[DETECT_REFERENCE].RegisterTests = ReferenceRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief Free a Reference object */ void DetectReferenceFree(DetectReference *ref) { SCEnter(); if (ref->reference != NULL) { SCFree(ref->reference); } SCFree(ref); SCReturn; } /** * \internal * \brief This function is used to parse reference options passed via reference: keyword * * \param rawstr Pointer to the user provided reference options. * * \retval ref Pointer to signature reference on success. * \retval NULL On failure. */ static DetectReference *DetectReferenceParse(char *rawstr, DetectEngineCtx *de_ctx) { SCEnter(); DetectReference *ref = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char key[64] = ""; char content[1024] = ""; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unable to parse \"reference\" " "keyword argument - \"%s\". Invalid argument.", rawstr); goto error; } ref = SCMalloc(sizeof(DetectReference)); if (unlikely(ref == NULL)) { goto error; } memset(ref, 0, sizeof(DetectReference)); res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, key, sizeof(key)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, content, sizeof(content)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (strlen(key) == 0 || strlen(content) == 0) goto error; SCRConfReference *lookup_ref_conf = SCRConfGetReference(key, de_ctx); if (lookup_ref_conf != NULL) { ref->key = lookup_ref_conf->url; } else { SCLogError(SC_ERR_REFERENCE_UNKNOWN, "unknown reference key \"%s\". " "Supported keys are defined in reference.config file. Please " "have a look at the conf param \"reference-config-file\"", key); goto error; } /* make a copy so we can free pcre's substring */ ref->reference = SCStrdup((char *)content); if (ref->reference == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "strdup failed: %s", strerror(errno)); goto error; } /* free the substrings */ SCReturnPtr(ref, "Reference"); error: if (ref != NULL) DetectReferenceFree(ref); SCReturnPtr(NULL, "Reference"); } /** * \internal * \brief Used to add the parsed reference into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param m Pointer to the Current SigMatch. * \param rawstr Pointer to the user provided reference options. * * \retval 0 On Success. * \retval -1 On Failure. */ static int DetectReferenceSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { SCEnter(); DetectReference *ref = NULL; DetectReference *sig_refs = NULL; ref = DetectReferenceParse(rawstr, de_ctx); if (ref == NULL) goto error; SCLogDebug("ref %s %s", ref->key, ref->reference); if (s->references == NULL) { s->references = ref; } else { sig_refs = s->references; while (sig_refs->next != NULL) { sig_refs = sig_refs->next; } sig_refs->next = ref; ref->next = NULL; } SCReturnInt(0); error: SCReturnInt(-1); } /***************************************Unittests******************************/ #ifdef UNITTESTS /** * \test one valid reference. * * \retval 1 on succces. * \retval 0 on failure. */ static int DetectReferenceParseTest01(void) { int result = 0; Signature *s = NULL; DetectReference *ref = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto cleanup; } de_ctx->flags |= DE_QUIET; FILE *fd = SCRConfGenerateValidDummyReferenceConfigFD01(); SCRConfLoadReferenceConfigFile(de_ctx, fd); s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(msg:\"One reference\"; reference:one,001-2010; sid:2;)"); if (s == NULL) { goto cleanup; } if (s->references == NULL) { goto cleanup; } ref = s->references; if (strcmp(ref->key, "http://www.one.com") != 0 || strcmp(ref->reference, "001-2010") != 0) { goto cleanup; } result = 1; cleanup: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return result; } /** * \test for two valid references. * * \retval 1 on succces. * \retval 0 on failure. */ static int DetectReferenceParseTest02(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto cleanup; } de_ctx->flags |= DE_QUIET; FILE *fd = SCRConfGenerateValidDummyReferenceConfigFD01(); SCRConfLoadReferenceConfigFile(de_ctx, fd); s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(msg:\"Two references\"; " "reference:one,openinfosecdoundation.txt; " "reference:two,001-2010; sid:2;)"); if (s == NULL) { printf("sig parse failed: "); goto cleanup; } if (s->references == NULL || s->references->next == NULL) { printf("no ref or not enough refs: "); goto cleanup; } if (strcmp(s->references->key, "http://www.one.com") != 0 || strcmp(s->references->reference, "openinfosecdoundation.txt") != 0) { printf("first ref failed: "); goto cleanup; } if (strcmp(s->references->next->key, "http://www.two.com") != 0 || strcmp(s->references->next->reference, "001-2010") != 0) { printf("second ref failed: "); goto cleanup; } result = 1; cleanup: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return result; } /** * \test parsing: invalid reference. * * \retval 1 on succces. * \retval 0 on failure. */ static int DetectReferenceParseTest03(void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto cleanup; } de_ctx->flags |= DE_QUIET; FILE *fd =SCRConfGenerateValidDummyReferenceConfigFD01(); SCRConfLoadReferenceConfigFile(de_ctx, fd); s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(msg:\"invalid ref\"; " "reference:unknownkey,001-2010; sid:2;)"); if (s != NULL) { printf("sig parsed even though it's invalid: "); goto cleanup; } result = 1; cleanup: if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return result; } #endif /* UNITTESTS */ void ReferenceRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectReferenceParseTest01", DetectReferenceParseTest01); UtRegisterTest("DetectReferenceParseTest02", DetectReferenceParseTest02); UtRegisterTest("DetectReferenceParseTest03", DetectReferenceParseTest03); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-enum.c0000644000000000000000000000502513051004444013066 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include #include #include "util-enum.h" /** * \brief Maps a string name to an enum value from the supplied table. Please * specify the last element of any map table with a {NULL, -1}. If * missing, you will be welcomed with a segfault :) * * \param enum_name Character string that has to be mapped to an enum value * from the table * \param table Enum-Char table, from which the mapping is retrieved * * \retval result The enum_value for the enum_name string or -1 on failure */ int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table) { int result = -1; if (enum_name == NULL || table == NULL) { printf("Invalid argument(s) passed into SCMapEnumNameToValue\n"); return -1; } for (; table->enum_name != NULL; table++) { if (strcasecmp(table->enum_name, enum_name) == 0) { result = table->enum_value; break; } } return result; } /** * \brief Maps an enum value to a string name, from the supplied table * * \param enum_value Enum_value that has to be mapped to a string_value * from the table * \param table Enum-Char table, from which the mapping is retrieved * * \retval result The enum_name for the enum_value supplied or NULL on failure */ const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table) { if (table == NULL) { printf("Invalid argument(s) passed into SCMapEnumValueToName\n"); return NULL; } for (; table->enum_name != NULL; table++) { if (table->enum_value == enum_value) { return table->enum_name; } } printf("A enum by the value %d doesn't exist in this table\n", enum_value); return NULL; } suricata-3.2.1/src/detect-dce-stub-data.h0000644000000000000000000000172613051004444015043 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_DCE_STUB_DATA_H__ #define __DETECT_DCE_STUB_DATA_H__ void DetectDceStubDataRegister(void); void DetectDceStubDataRegisterTests(void); #endif /* __DETECT_DCE_STUB_DATA_H__ */ suricata-3.2.1/src/detect-http-method.c0000644000000000000000000006170113051004444014655 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Brian Rectanus * * Implements the http_method keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-method.h" #include "detect-engine-hmd.h" #include "stream-tcp.h" static int DetectHttpMethodSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpMethodRegisterTests(void); void DetectHttpMethodFree(void *); /** * \brief Registration function for keyword: http_method */ void DetectHttpMethodRegister(void) { sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method"; sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer"; sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL; sigmatch_table[DETECT_AL_HTTP_METHOD].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup; sigmatch_table[DETECT_AL_HTTP_METHOD].Free = DetectHttpMethodFree; sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests; sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_method", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HMDMATCH, 4, PrefilterTxMethodRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HMDMATCH, DetectEngineInspectHttpMethod); SCLogDebug("registering http_method rule option"); } /** * \brief This function is used to add the parsed "http_method" option * into the current signature. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Current Signature. * \param str Pointer to the user provided option string. * * \retval 0 on Success. * \retval -1 on Failure. */ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectEngineContentModifierBufferSetup(de_ctx, s, str, DETECT_AL_HTTP_METHOD, DETECT_SM_LIST_HMDMATCH, ALPROTO_HTTP, NULL); } /** * \brief this function will free memory associated with DetectContentData * * \param id_d pointer to DetectContentData */ void DetectHttpMethodFree(void *ptr) { DetectContentData *data = (DetectContentData *)ptr; if (data->content != NULL) SCFree(data->content); SCFree(data); } /** * \retval 1 valid * \retval 0 invalid */ int DetectHttpMethodValidateRule(const Signature *s) { if (s->alproto != ALPROTO_HTTP) return 1; if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) { const SigMatch *sm = s->sm_lists[DETECT_SM_LIST_HMDMATCH]; for ( ; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; const DetectContentData *cd = (const DetectContentData *)sm->ctx; if (cd->content && cd->content_len) { if (cd->content[cd->content_len-1] == 0x20) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method pattern with trailing space"); return 0; } else if (cd->content[0] == 0x20) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method pattern with leading space"); return 0; } else if (cd->content[cd->content_len-1] == 0x09) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method pattern with trailing tab"); return 0; } else if (cd->content[0] == 0x09) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method pattern with leading tab"); return 0; } } } } return 1; } #ifdef UNITTESTS /* UNITTESTS */ #include "stream-tcp-reassemble.h" /** \test Check a signature with content */ int DetectHttpMethodTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"GET\"; " "http_method; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { printf("sig parse failed: "); } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature without content (fail) */ int DetectHttpMethodTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "http_method; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with parameter (fail) */ int DetectHttpMethodTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"foobar\"; " "http_method:\"GET\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with fast_pattern (should work) */ int DetectHttpMethodTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"GET\"; " "fast_pattern; " "http_method; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with rawbytes (fail) */ int DetectHttpMethodTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"GET\"; " "rawbytes; " "http_method; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test setting the nocase flag */ static int DetectHttpMethodTest12(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; if (DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(content:\"one\"; http_method; nocase; sid:1;)") == NULL) { printf("DetectEngineAppend == NULL: "); goto end; } if (DetectEngineAppendSig(de_ctx, "alert http any any -> any any " "(content:\"one\"; nocase; http_method; sid:2;)") == NULL) { printf("DetectEngineAppend == NULL: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH] == NULL: "); goto end; } DetectContentData *hmd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; DetectContentData *hmd2 = (DetectContentData *)de_ctx->sig_list->next->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (!(hmd1->flags & DETECT_CONTENT_NOCASE)) { printf("nocase flag not set on sig 1: "); goto end; } if (!(hmd2->flags & DETECT_CONTENT_NOCASE)) { printf("nocase flag not set on sig 2: "); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with method + within and pcre with /M (should work) */ int DetectHttpMethodTest13(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "pcre:\"/HE/M\"; " "content:\"AD\"; " "within:2; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with method + within and pcre without /M (should fail) */ int DetectHttpMethodTest14(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "pcre:\"/HE/\"; " "content:\"AD\"; " "http_method; within:2; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with method + within and pcre with /M (should work) */ int DetectHttpMethodTest15(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "pcre:\"/HE/M\"; " "content:\"AD\"; " "http_method; within:2; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check a signature with an known request method */ static int DetectHttpMethodSigTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\n" "Host: foo.bar.tld\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"GET\"; " "http_method; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"POST\"; " "http_method; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { SCLogDebug("no http state: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { goto end; } if (PacketAlertCheck(p, 2)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check a signature with an unknown request method */ static int DetectHttpMethodSigTest02(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "FOO / HTTP/1.0\r\n" "Host: foo.bar.tld\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"FOO\"; " "http_method; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"BAR\"; " "http_method; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { SCLogDebug("no http state: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { goto end; } if (PacketAlertCheck(p, 2)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *) det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check a signature against an unparsable request */ static int DetectHttpMethodSigTest03(void) { int result = 0; Flow f; uint8_t httpbuf1[] = " "; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "content:\"GET\"; " "http_method; sid:1;)"); if (s == NULL) { SCLogDebug("Bad signature"); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { SCLogDebug("no http state: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test Check a signature with an request method and negation of the same */ static int DetectHttpMethodSigTest04(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\n" "Host: foo.bar.tld\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Testing http_method\"; " "content:\"GET\"; http_method; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Testing http_method\"; " "content:!\"GET\"; http_method; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { SCLogDebug("no http state: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sid 2 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *) det_ctx); } if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectHttpMethod */ void DetectHttpMethodRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ SCLogDebug("Registering tests for DetectHttpMethod..."); UtRegisterTest("DetectHttpMethodTest01", DetectHttpMethodTest01); UtRegisterTest("DetectHttpMethodTest02", DetectHttpMethodTest02); UtRegisterTest("DetectHttpMethodTest03", DetectHttpMethodTest03); UtRegisterTest("DetectHttpMethodTest04", DetectHttpMethodTest04); UtRegisterTest("DetectHttpMethodTest05", DetectHttpMethodTest05); UtRegisterTest("DetectHttpMethodTest12 -- nocase flag", DetectHttpMethodTest12); UtRegisterTest("DetectHttpMethodTest13", DetectHttpMethodTest13); UtRegisterTest("DetectHttpMethodTest14", DetectHttpMethodTest14); UtRegisterTest("DetectHttpMethodTest15", DetectHttpMethodTest15); UtRegisterTest("DetectHttpMethodSigTest01", DetectHttpMethodSigTest01); UtRegisterTest("DetectHttpMethodSigTest02", DetectHttpMethodSigTest02); UtRegisterTest("DetectHttpMethodSigTest03", DetectHttpMethodSigTest03); UtRegisterTest("DetectHttpMethodSigTest04", DetectHttpMethodSigTest04); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-strlcatu.c0000644000000000000000000000526213051004444013766 00000000000000/* * Copyright (c) 1998 Todd C. Miller * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* $Id: strlcatu.c,v 1.4 2003/10/20 15:03:27 chrisgreen Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" #endif #ifndef HAVE_STRLCAT #if defined(LIBC_SCCS) && !defined(lint) static char *rcsid = "$OpenBSD: strlcat.c,v 1.5 2001/01/13 16:17:24 millert Exp $"; #endif /* LIBC_SCCS and not lint */ #include #include /* * Appends src to string dst of size siz (unlike strncat, siz is the * full size of dst, not space left). At most siz-1 characters * will be copied. Always NUL terminates (unless siz <= strlen(dst)). * Returns strlen(initial dst) + strlen(src); if retval >= siz, * truncation occurred. */ size_t strlcat(dst, src, siz) char *dst; const char *src; size_t siz; { register char *d = dst; register const char *s = src; register size_t n = siz; size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; if (n == 0) return(dlen + strlen(s)); while (*s != '\0') { if (n != 1) { *d++ = *s; n--; } s++; } *d = '\0'; return(dlen + (s - src)); /* count does not include NUL */ } #endif suricata-3.2.1/src/detect-dns-query.h0000644000000000000000000000166613051004444014360 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_DNS_QUERY_H__ #define __DETECT_DNS_QUERY_H__ #include "app-layer-dns-common.h" void DetectDnsQueryRegister (void); #endif /* __DETECT_DNS_QUERY_H__ */ suricata-3.2.1/src/output-json-stats.h0000644000000000000000000000216213051004444014616 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_COUNTERS_H__ #define __OUTPUT_JSON_COUNTERS_H__ #include "output-stats.h" #define JSON_STATS_TOTALS (1<<0) #define JSON_STATS_THREADS (1<<1) #define JSON_STATS_DELTAS (1<<2) #ifdef HAVE_LIBJANSSON json_t *StatsToJSON(const StatsTable *st, uint8_t flags); #endif void JsonStatsLogRegister(void); #endif /* __OUTPUT_JSON_COUNTERS_H__ */ suricata-3.2.1/src/output-json-stats.c0000644000000000000000000002664213051004444014622 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Implements JSON stats counters logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "output-json.h" #include "output-json-stats.h" #define MODULE_NAME "JsonStatsLog" #ifdef HAVE_LIBJANSSON typedef struct OutputStatsCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } OutputStatsCtx; typedef struct JsonStatsLogThread_ { OutputStatsCtx *statslog_ctx; MemBuffer *buffer; } JsonStatsLogThread; static json_t *OutputStats2Json(json_t *js, const char *key) { void *iter; const char *dot = index(key, '.'); if (dot == NULL) return NULL; size_t predot_len = (dot - key) + 1; char s[predot_len]; strlcpy(s, key, predot_len); iter = json_object_iter_at(js, s); const char *s2 = index(dot+1, '.'); json_t *value = json_object_iter_value(iter); if (value == NULL) { value = json_object(); json_object_set_new(js, s, value); } if (s2 != NULL) { return OutputStats2Json(value, &key[dot-key+1]); } return value; } /** \brief turn StatsTable into a json object * \param flags JSON_STATS_* flags for controlling output */ json_t *StatsToJSON(const StatsTable *st, uint8_t flags) { const char delta_suffix[] = "_delta"; struct timeval tval; gettimeofday(&tval, NULL); json_t *js_stats = json_object(); if (unlikely(js_stats == NULL)) { return NULL; } /* Uptime, in seconds. */ json_object_set_new(js_stats, "uptime", json_integer((int)difftime(tval.tv_sec, st->start_time))); uint32_t u = 0; if (flags & JSON_STATS_TOTALS) { for (u = 0; u < st->nstats; u++) { if (st->stats[u].name == NULL) continue; const char *name = st->stats[u].name; const char *shortname = name; if (rindex(name, '.') != NULL) { shortname = &name[rindex(name, '.') - name + 1]; } json_t *js_type = OutputStats2Json(js_stats, name); if (js_type != NULL) { json_object_set_new(js_type, shortname, json_integer(st->stats[u].value)); if (flags & JSON_STATS_DELTAS) { char deltaname[strlen(shortname) + strlen(delta_suffix) + 1]; snprintf(deltaname, sizeof(deltaname), "%s%s", shortname, delta_suffix); json_object_set_new(js_type, deltaname, json_integer(st->stats[u].value - st->stats[u].pvalue)); } } } } /* per thread stats - stored in a "threads" object. */ if (st->tstats != NULL && (flags & JSON_STATS_THREADS)) { /* for each thread (store) */ json_t *threads = json_object(); if (unlikely(threads == NULL)) { json_decref(js_stats); return NULL; } uint32_t x; for (x = 0; x < st->ntstats; x++) { uint32_t offset = x * st->nstats; /* for each counter */ for (u = offset; u < (offset + st->nstats); u++) { if (st->tstats[u].name == NULL) continue; char str[256]; snprintf(str, sizeof(str), "%s.%s", st->tstats[u].tm_name, st->tstats[u].name); char *shortname = &str[rindex(str, '.') - str + 1]; json_t *js_type = OutputStats2Json(threads, str); if (js_type != NULL) { json_object_set_new(js_type, shortname, json_integer(st->tstats[u].value)); if (flags & JSON_STATS_DELTAS) { char deltaname[strlen(shortname) + strlen(delta_suffix) + 1]; snprintf(deltaname, sizeof(deltaname), "%s%s", shortname, delta_suffix); json_object_set_new(js_type, deltaname, json_integer(st->tstats[u].value - st->tstats[u].pvalue)); } } } } json_object_set_new(js_stats, "threads", threads); } return js_stats; } static int JsonStatsLogger(ThreadVars *tv, void *thread_data, const StatsTable *st) { SCEnter(); JsonStatsLogThread *aft = (JsonStatsLogThread *)thread_data; struct timeval tval; gettimeofday(&tval, NULL); json_t *js = json_object(); if (unlikely(js == NULL)) return 0; char timebuf[64]; CreateIsoTimeString(&tval, timebuf, sizeof(timebuf)); json_object_set_new(js, "timestamp", json_string(timebuf)); json_object_set_new(js, "event_type", json_string("stats")); json_t *js_stats = StatsToJSON(st, aft->statslog_ctx->flags); if (js_stats == NULL) { json_decref(js); return 0; } json_object_set_new(js, "stats", js_stats); OutputJSONBuffer(js, aft->statslog_ctx->file_ctx, &aft->buffer); MemBufferReset(aft->buffer); json_object_clear(js_stats); json_object_del(js, "stats"); json_object_clear(js); json_decref(js); SCReturnInt(0); } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonStatsLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonStatsLogThread *aft = SCMalloc(sizeof(JsonStatsLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonStatsLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogStats. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->statslog_ctx = ((OutputCtx *)initdata)->data; aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonStatsLogThreadDeinit(ThreadVars *t, void *data) { JsonStatsLogThread *aft = (JsonStatsLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonStatsLogThread)); SCFree(aft); return TM_ECODE_OK; } static void OutputStatsLogDeinit(OutputCtx *output_ctx) { OutputStatsCtx *stats_ctx = output_ctx->data; LogFileCtx *logfile_ctx = stats_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(stats_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "stats.json" OutputCtx *OutputStatsLogInit(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_STATS_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } OutputStatsCtx *stats_ctx = SCMalloc(sizeof(OutputStatsCtx)); if (unlikely(stats_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } stats_ctx->flags = JSON_STATS_TOTALS; if (conf != NULL) { const char *totals = ConfNodeLookupChildValue(conf, "totals"); const char *threads = ConfNodeLookupChildValue(conf, "threads"); const char *deltas = ConfNodeLookupChildValue(conf, "deltas"); SCLogDebug("totals %s threads %s deltas %s", totals, threads, deltas); if (totals != NULL && ConfValIsFalse(totals)) { stats_ctx->flags &= ~JSON_STATS_TOTALS; } if (threads != NULL && ConfValIsTrue(threads)) { stats_ctx->flags |= JSON_STATS_THREADS; } if (deltas != NULL && ConfValIsTrue(deltas)) { stats_ctx->flags |= JSON_STATS_DELTAS; } SCLogDebug("stats_ctx->flags %08x", stats_ctx->flags); } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(stats_ctx); return NULL; } stats_ctx->file_ctx = file_ctx; output_ctx->data = stats_ctx; output_ctx->DeInit = OutputStatsLogDeinit; return output_ctx; } static void OutputStatsLogDeinitSub(OutputCtx *output_ctx) { OutputStatsCtx *stats_ctx = output_ctx->data; SCFree(stats_ctx); SCFree(output_ctx); } OutputCtx *OutputStatsLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { AlertJsonThread *ajt = parent_ctx->data; OutputStatsCtx *stats_ctx = SCMalloc(sizeof(OutputStatsCtx)); if (unlikely(stats_ctx == NULL)) return NULL; stats_ctx->flags = JSON_STATS_TOTALS; if (conf != NULL) { const char *totals = ConfNodeLookupChildValue(conf, "totals"); const char *threads = ConfNodeLookupChildValue(conf, "threads"); const char *deltas = ConfNodeLookupChildValue(conf, "deltas"); SCLogDebug("totals %s threads %s deltas %s", totals, threads, deltas); if ((totals != NULL && ConfValIsFalse(totals)) && (threads != NULL && ConfValIsFalse(threads))) { SCFree(stats_ctx); SCLogError(SC_ERR_JSON_STATS_LOG_NEGATED, "Cannot disable both totals and threads in stats logging"); return NULL; } if (totals != NULL && ConfValIsFalse(totals)) { stats_ctx->flags &= ~JSON_STATS_TOTALS; } if (threads != NULL && ConfValIsTrue(threads)) { stats_ctx->flags |= JSON_STATS_THREADS; } if (deltas != NULL && ConfValIsTrue(deltas)) { stats_ctx->flags |= JSON_STATS_DELTAS; } SCLogDebug("stats_ctx->flags %08x", stats_ctx->flags); } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(stats_ctx); return NULL; } stats_ctx->file_ctx = ajt->file_ctx; output_ctx->data = stats_ctx; output_ctx->DeInit = OutputStatsLogDeinitSub; return output_ctx; } void JsonStatsLogRegister(void) { /* register as separate module */ OutputRegisterStatsModule(LOGGER_JSON_STATS, MODULE_NAME, "stats-json", OutputStatsLogInit, JsonStatsLogger, JsonStatsLogThreadInit, JsonStatsLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterStatsSubModule(LOGGER_JSON_STATS, "eve-log", MODULE_NAME, "eve-log.stats", OutputStatsLogInitSub, JsonStatsLogger, JsonStatsLogThreadInit, JsonStatsLogThreadDeinit, NULL); } #else void JsonStatsLogRegister (void) { } #endif suricata-3.2.1/src/detect-flowbits.c0000644000000000000000000004751113051004444014254 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Breno Silva * * Implements the flowbits keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "threads.h" #include "flow.h" #include "flow-bit.h" #include "flow-util.h" #include "detect-flowbits.h" #include "util-spm.h" #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "util-var-name.h" #include "util-unittest.h" #include "util-debug.h" #define PARSE_REGEX "([a-z]+)(?:,\\s*(.*))?" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectFlowbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFlowbitSetup (DetectEngineCtx *, Signature *, char *); void DetectFlowbitFree (void *); void FlowBitsRegisterTests(void); void DetectFlowbitsRegister (void) { sigmatch_table[DETECT_FLOWBITS].name = "flowbits"; sigmatch_table[DETECT_FLOWBITS].desc = "operate on flow flag"; sigmatch_table[DETECT_FLOWBITS].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flowbits"; sigmatch_table[DETECT_FLOWBITS].Match = DetectFlowbitMatch; sigmatch_table[DETECT_FLOWBITS].Setup = DetectFlowbitSetup; sigmatch_table[DETECT_FLOWBITS].Free = DetectFlowbitFree; sigmatch_table[DETECT_FLOWBITS].RegisterTests = FlowBitsRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_FLOWBITS].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static int DetectFlowbitMatchToggle (Packet *p, const DetectFlowbitsData *fd) { if (p->flow == NULL) return 0; FlowBitToggle(p->flow,fd->idx); return 1; } static int DetectFlowbitMatchUnset (Packet *p, const DetectFlowbitsData *fd) { if (p->flow == NULL) return 0; FlowBitUnset(p->flow,fd->idx); return 1; } static int DetectFlowbitMatchSet (Packet *p, const DetectFlowbitsData *fd) { if (p->flow == NULL) return 0; FlowBitSet(p->flow,fd->idx); return 1; } static int DetectFlowbitMatchIsset (Packet *p, const DetectFlowbitsData *fd) { if (p->flow == NULL) return 0; return FlowBitIsset(p->flow,fd->idx); } static int DetectFlowbitMatchIsnotset (Packet *p, const DetectFlowbitsData *fd) { if (p->flow == NULL) return 0; return FlowBitIsnotset(p->flow,fd->idx); } /* * returns 0: no match * 1: match * -1: error */ int DetectFlowbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectFlowbitsData *fd = (const DetectFlowbitsData *)ctx; if (fd == NULL) return 0; switch (fd->cmd) { case DETECT_FLOWBITS_CMD_ISSET: return DetectFlowbitMatchIsset(p,fd); case DETECT_FLOWBITS_CMD_ISNOTSET: return DetectFlowbitMatchIsnotset(p,fd); case DETECT_FLOWBITS_CMD_SET: return DetectFlowbitMatchSet(p,fd); case DETECT_FLOWBITS_CMD_UNSET: return DetectFlowbitMatchUnset(p,fd); case DETECT_FLOWBITS_CMD_TOGGLE: return DetectFlowbitMatchToggle(p,fd); default: SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", fd->cmd); return 0; } return 0; } static int DetectFlowbitParse(char *str, char *cmd, int cmd_len, char *name, int name_len) { const int max_substrings = 30; int count, rc; int ov[max_substrings]; count = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, max_substrings); if (count != 2 && count != 3) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for flowbits.", str); return 0; } rc = pcre_copy_substring((char *)str, ov, max_substrings, 1, cmd, cmd_len); if (rc < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return 0; } if (count == 3) { rc = pcre_copy_substring((char *)str, ov, max_substrings, 2, name, name_len); if (rc < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return 0; } /* Trim trailing whitespace. */ while (strlen(name) > 0 && isblank(name[strlen(name) - 1])) { name[strlen(name) - 1] = '\0'; } /* Validate name, spaces are not allowed. */ for (size_t i = 0; i < strlen(name); i++) { if (isblank(name[i])) { SCLogError(SC_ERR_INVALID_SIGNATURE, "spaces not allowed in flowbit names"); return 0; } } } return 1; } int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectFlowbitsData *cd = NULL; SigMatch *sm = NULL; uint8_t fb_cmd = 0; char fb_cmd_str[16] = "", fb_name[256] = ""; if (!DetectFlowbitParse(rawstr, fb_cmd_str, sizeof(fb_cmd_str), fb_name, sizeof(fb_name))) { return -1; } if (strcmp(fb_cmd_str,"noalert") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_NOALERT; } else if (strcmp(fb_cmd_str,"isset") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_ISSET; } else if (strcmp(fb_cmd_str,"isnotset") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_ISNOTSET; } else if (strcmp(fb_cmd_str,"set") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_SET; } else if (strcmp(fb_cmd_str,"unset") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_UNSET; } else if (strcmp(fb_cmd_str,"toggle") == 0) { fb_cmd = DETECT_FLOWBITS_CMD_TOGGLE; } else { SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str); goto error; } switch (fb_cmd) { case DETECT_FLOWBITS_CMD_NOALERT: if (strlen(fb_name) != 0) goto error; s->flags |= SIG_FLAG_NOALERT; return 0; case DETECT_FLOWBITS_CMD_ISNOTSET: case DETECT_FLOWBITS_CMD_ISSET: case DETECT_FLOWBITS_CMD_SET: case DETECT_FLOWBITS_CMD_UNSET: case DETECT_FLOWBITS_CMD_TOGGLE: default: if (strlen(fb_name) == 0) goto error; break; } cd = SCMalloc(sizeof(DetectFlowbitsData)); if (unlikely(cd == NULL)) goto error; cd->idx = VariableNameGetIdx(de_ctx, fb_name, VAR_TYPE_FLOW_BIT); cd->cmd = fb_cmd; SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)"); /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLOWBITS; sm->ctx = (SigMatchCtx *)cd; switch (fb_cmd) { /* case DETECT_FLOWBITS_CMD_NOALERT can't happen here */ case DETECT_FLOWBITS_CMD_ISNOTSET: case DETECT_FLOWBITS_CMD_ISSET: /* checks, so packet list */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); break; case DETECT_FLOWBITS_CMD_SET: case DETECT_FLOWBITS_CMD_UNSET: case DETECT_FLOWBITS_CMD_TOGGLE: /* modifiers, only run when entire sig has matched */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); break; } return 0; error: if (cd != NULL) SCFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectFlowbitFree (void *ptr) { DetectFlowbitsData *fd = (DetectFlowbitsData *)ptr; if (fd == NULL) return; SCFree(fd); } #ifdef UNITTESTS static int FlowBitsTestParse01(void) { char command[16] = "", name[16] = ""; /* Single argument version. */ FAIL_IF(!DetectFlowbitParse("noalert", command, sizeof(command), name, sizeof(name))); FAIL_IF(strcmp(command, "noalert") != 0); /* No leading or trailing spaces. */ FAIL_IF(!DetectFlowbitParse("set,flowbit", command, sizeof(command), name, sizeof(name))); FAIL_IF(strcmp(command, "set") != 0); FAIL_IF(strcmp(name, "flowbit") != 0); /* Leading space. */ FAIL_IF(!DetectFlowbitParse("set, flowbit", command, sizeof(command), name, sizeof(name))); FAIL_IF(strcmp(command, "set") != 0); FAIL_IF(strcmp(name, "flowbit") != 0); /* Trailing space. */ FAIL_IF(!DetectFlowbitParse("set,flowbit ", command, sizeof(command), name, sizeof(name))); FAIL_IF(strcmp(command, "set") != 0); FAIL_IF(strcmp(name, "flowbit") != 0); /* Leading and trailing space. */ FAIL_IF(!DetectFlowbitParse("set, flowbit ", command, sizeof(command), name, sizeof(name))); FAIL_IF(strcmp(command, "set") != 0); FAIL_IF(strcmp(name, "flowbit") != 0); /* Spaces are not allowed in the name. */ FAIL_IF(DetectFlowbitParse("set,namewith space", command, sizeof(command), name, sizeof(name))); PASS; } /** * \test FlowBitsTestSig01 is a test for a valid noalert flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig01(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Noalert\"; flowbits:noalert,wrongusage; content:\"GET \"; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test FlowBitsTestSig02 is a test for a valid isset,set,isnotset,unset,toggle flowbits options * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig02(void) { Signature *s = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset rule need an option\"; flowbits:isset; content:\"GET \"; sid:1;)"); FAIL_IF_NOT_NULL(s); s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isnotset rule need an option\"; flowbits:isnotset; content:\"GET \"; sid:2;)"); FAIL_IF_NOT_NULL(s); s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"set rule need an option\"; flowbits:set; content:\"GET \"; sid:3;)"); FAIL_IF_NOT_NULL(s); s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"unset rule need an option\"; flowbits:unset; content:\"GET \"; sid:4;)"); FAIL_IF_NOT_NULL(s); s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"toggle rule need an option\"; flowbits:toggle; content:\"GET \"; sid:5;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test FlowBitsTestSig03 is a test for a invalid flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig03(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Unknown cmd\"; flowbits:wrongcmd; content:\"GET \"; sid:1;)"); FAIL_IF_NOT_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } /** * \test FlowBitsTestSig04 is a test check idx value * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig04(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; int idx = 0; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"isset option\"; flowbits:isset,fbt; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); idx = VariableNameGetIdx(de_ctx, "fbt", VAR_TYPE_FLOW_BIT); FAIL_IF(idx != 1); DetectEngineCtxFree(de_ctx); PASS; } /** * \test FlowBitsTestSig05 is a test check noalert flag * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig05(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Noalert\"; flowbits:noalert; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); FAIL_IF((s->flags & SIG_FLAG_NOALERT) != SIG_FLAG_NOALERT); DetectEngineCtxFree(de_ctx); PASS; } /** * \test FlowBitsTestSig06 is a test set flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig06(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; GenericVar flowvar, *gv = NULL; int result = 0; int idx = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p->flow = &f; p->flow->flowvar = &flowvar; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->flags |= PKT_HAS_FLOW; p->flowflags |= FLOW_PKT_TOSERVER; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,myflow; sid:10;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); idx = VariableNameGetIdx(de_ctx, "myflow", VAR_TYPE_FLOW_BIT); gv = p->flow->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_FLOWBITS && gv->idx == idx) { result = 1; } } FAIL_IF_NOT(result); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); PASS; } /** * \test FlowBitsTestSig07 is a test unset flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig07(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; GenericVar flowvar, *gv = NULL; int result = 0; int idx = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p->flow = &f; p->flow->flowvar = &flowvar; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,myflow2; sid:10;)"); FAIL_IF_NULL(s); s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit unset\"; flowbits:unset,myflow2; sid:11;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); idx = VariableNameGetIdx(de_ctx, "myflow", VAR_TYPE_FLOW_BIT); gv = p->flow->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_FLOWBITS && gv->idx == idx) { result = 1; } } FAIL_IF(result); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); PASS; } /** * \test FlowBitsTestSig08 is a test toogle flowbits option * * \retval 1 on succces * \retval 0 on failure */ static int FlowBitsTestSig08(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; GenericVar flowvar, *gv = NULL; int result = 0; int idx = 0; memset(p, 0, SIZE_OF_PACKET); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(Flow)); memset(&flowvar, 0, sizeof(GenericVar)); FLOW_INITIALIZE(&f); p->flow = &f; p->flow->flowvar = &flowvar; p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit set\"; flowbits:set,myflow2; sid:10;)"); FAIL_IF_NULL(s); s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Flowbit unset\"; flowbits:toggle,myflow2; sid:11;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); idx = VariableNameGetIdx(de_ctx, "myflow", VAR_TYPE_FLOW_BIT); gv = p->flow->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_FLOWBITS && gv->idx == idx) { result = 1; } } FAIL_IF(result); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if(gv) GenericVarFree(gv); FLOW_DESTROY(&f); SCFree(p); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for FlowBits */ void FlowBitsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("FlowBitsTestParse01", FlowBitsTestParse01); UtRegisterTest("FlowBitsTestSig01", FlowBitsTestSig01); UtRegisterTest("FlowBitsTestSig02", FlowBitsTestSig02); UtRegisterTest("FlowBitsTestSig03", FlowBitsTestSig03); UtRegisterTest("FlowBitsTestSig04", FlowBitsTestSig04); UtRegisterTest("FlowBitsTestSig05", FlowBitsTestSig05); UtRegisterTest("FlowBitsTestSig06", FlowBitsTestSig06); UtRegisterTest("FlowBitsTestSig07", FlowBitsTestSig07); UtRegisterTest("FlowBitsTestSig08", FlowBitsTestSig08); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-lua-extensions.c0000644000000000000000000003644313051004444015403 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Functions to expose to the lua scripts. */ #include "suricata-common.h" #include "conf.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-flowvar.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "stream-tcp.h" #include "detect-lua.h" #include "queue.h" #include "util-cpu.h" #include "app-layer-parser.h" #ifdef HAVE_LUA #include "util-lua.h" #include "util-lua-common.h" #include "util-lua-http.h" #include "util-lua-dns.h" #include "util-lua-tls.h" #include "util-lua-ssh.h" #include "util-lua-smtp.h" #include "util-lua-dnp3.h" static const char luaext_key_ld[] = "suricata:luadata"; static const char luaext_key_det_ctx[] = "suricata:det_ctx"; static int LuaGetFlowvar(lua_State *luastate) { uint16_t idx; int id; Flow *f; FlowVar *fv; DetectLuaData *ld; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowvar idx */ if (!lua_isnumber(luastate, 1)) { lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWVARS) { lua_pushnil(luastate); lua_pushstring(luastate, "flowvar id out of range"); return 2; } idx = ld->flowvar[id]; if (idx == 0) { lua_pushnil(luastate); lua_pushstring(luastate, "flowvar id uninitialized"); return 2; } fv = FlowVarGet(f, idx); if (fv == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow var"); return 2; } LuaPushStringBuffer(luastate, (const uint8_t *)fv->data.fv_str.value, (size_t)fv->data.fv_str.value_len); return 1; } int LuaSetFlowvar(lua_State *luastate) { uint16_t idx; int id; Flow *f; const char *str; int len; uint8_t *buffer; DetectEngineThreadCtx *det_ctx; DetectLuaData *ld; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need det_ctx */ lua_pushlightuserdata(luastate, (void *)&luaext_key_det_ctx); lua_gettable(luastate, LUA_REGISTRYINDEX); det_ctx = lua_touserdata(luastate, -1); SCLogDebug("det_ctx %p", det_ctx); if (det_ctx == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no det_ctx"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowvar idx */ if (!lua_isnumber(luastate, 1)) { lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWVARS) { lua_pushnil(luastate); lua_pushstring(luastate, "flowvar id out of range"); return 2; } if (!lua_isstring(luastate, 2)) { lua_pushnil(luastate); lua_pushstring(luastate, "2nd arg not a string"); return 2; } str = lua_tostring(luastate, 2); if (str == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "null string"); return 2; } if (!lua_isnumber(luastate, 3)) { lua_pushnil(luastate); lua_pushstring(luastate, "3rd arg not a number"); return 2; } len = lua_tonumber(luastate, 3); if (len < 0 || len > 0xffff) { lua_pushnil(luastate); lua_pushstring(luastate, "len out of range: max 64k"); return 2; } idx = ld->flowvar[id]; if (idx == 0) { lua_pushnil(luastate); lua_pushstring(luastate, "flowvar id uninitialized"); return 2; } buffer = SCMalloc(len+1); if (unlikely(buffer == NULL)) { lua_pushnil(luastate); lua_pushstring(luastate, "out of memory"); return 2; } memcpy(buffer, str, len); buffer[len] = '\0'; FlowVarAddStr(f, idx, buffer, len); //SCLogInfo("stored:"); //PrintRawDataFp(stdout,buffer,len); return 0; } static int LuaGetFlowint(lua_State *luastate) { uint16_t idx; int id; Flow *f; FlowVar *fv; DetectLuaData *ld; uint32_t number; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowint idx */ if (!lua_isnumber(luastate, 1)) { SCLogDebug("1st arg not a number"); lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWINTS) { SCLogDebug("id %d", id); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id out of range"); return 2; } idx = ld->flowint[id]; if (idx == 0) { SCLogDebug("idx %u", idx); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id uninitialized"); return 2; } /* lookup var */ fv = FlowVarGet(f, idx); if (fv == NULL) { SCLogDebug("fv NULL"); lua_pushnil(luastate); lua_pushstring(luastate, "no flow var"); return 2; } number = fv->data.fv_int.value; /* return value through luastate, as a luanumber */ lua_pushnumber(luastate, (lua_Number)number); SCLogDebug("retrieved flow:%p idx:%u value:%u", f, idx, number); return 1; } int LuaSetFlowint(lua_State *luastate) { uint16_t idx; int id; Flow *f; DetectEngineThreadCtx *det_ctx; DetectLuaData *ld; uint32_t number; lua_Number luanumber; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need det_ctx */ lua_pushlightuserdata(luastate, (void *)&luaext_key_det_ctx); lua_gettable(luastate, LUA_REGISTRYINDEX); det_ctx = lua_touserdata(luastate, -1); SCLogDebug("det_ctx %p", det_ctx); if (det_ctx == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no det_ctx"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowint idx */ if (!lua_isnumber(luastate, 1)) { lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWVARS) { lua_pushnil(luastate); lua_pushstring(luastate, "flowint id out of range"); return 2; } if (!lua_isnumber(luastate, 2)) { lua_pushnil(luastate); lua_pushstring(luastate, "2nd arg not a number"); return 2; } luanumber = lua_tonumber(luastate, 2); if (luanumber < 0 || id > (double)UINT_MAX) { lua_pushnil(luastate); lua_pushstring(luastate, "value out of range, value must be unsigned 32bit int"); return 2; } number = (uint32_t)luanumber; idx = ld->flowint[id]; if (idx == 0) { lua_pushnil(luastate); lua_pushstring(luastate, "flowint id uninitialized"); return 2; } FlowVarAddInt(f, idx, number); SCLogDebug("stored flow:%p idx:%u value:%u", f, idx, number); return 0; } static int LuaIncrFlowint(lua_State *luastate) { uint16_t idx; int id; Flow *f; FlowVar *fv; DetectLuaData *ld; uint32_t number; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowint idx */ if (!lua_isnumber(luastate, 1)) { SCLogDebug("1st arg not a number"); lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWINTS) { SCLogDebug("id %d", id); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id out of range"); return 2; } idx = ld->flowint[id]; if (idx == 0) { SCLogDebug("idx %u", idx); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id uninitialized"); return 2; } /* lookup var */ fv = FlowVarGet(f, idx); if (fv == NULL) { number = 1; } else { number = fv->data.fv_int.value; if (number < UINT_MAX) number++; } FlowVarAddIntNoLock(f, idx, number); /* return value through luastate, as a luanumber */ lua_pushnumber(luastate, (lua_Number)number); SCLogDebug("incremented flow:%p idx:%u value:%u", f, idx, number); return 1; } static int LuaDecrFlowint(lua_State *luastate) { uint16_t idx; int id; Flow *f; FlowVar *fv; DetectLuaData *ld; uint32_t number; /* need lua data for id -> idx conversion */ lua_pushlightuserdata(luastate, (void *)&luaext_key_ld); lua_gettable(luastate, LUA_REGISTRYINDEX); ld = lua_touserdata(luastate, -1); SCLogDebug("ld %p", ld); if (ld == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "internal error: no ld"); return 2; } /* need flow and lock hint */ f = LuaStateGetFlow(luastate); if (f == NULL) { lua_pushnil(luastate); lua_pushstring(luastate, "no flow"); return 2; } /* need flowint idx */ if (!lua_isnumber(luastate, 1)) { SCLogDebug("1st arg not a number"); lua_pushnil(luastate); lua_pushstring(luastate, "1st arg not a number"); return 2; } id = lua_tonumber(luastate, 1); if (id < 0 || id >= DETECT_LUAJIT_MAX_FLOWINTS) { SCLogDebug("id %d", id); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id out of range"); return 2; } idx = ld->flowint[id]; if (idx == 0) { SCLogDebug("idx %u", idx); lua_pushnil(luastate); lua_pushstring(luastate, "flowint id uninitialized"); return 2; } /* lookup var */ fv = FlowVarGet(f, idx); if (fv == NULL) { number = 0; } else { number = fv->data.fv_int.value; if (number > 0) number--; } FlowVarAddIntNoLock(f, idx, number); /* return value through luastate, as a luanumber */ lua_pushnumber(luastate, (lua_Number)number); SCLogDebug("decremented flow:%p idx:%u value:%u", f, idx, number); return 1; } void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *ld, DetectEngineThreadCtx *det_ctx, Flow *f, Packet *p, uint8_t flags) { SCLogDebug("det_ctx %p, f %p", det_ctx, f); /* lua keyword data */ lua_pushlightuserdata(lua_state, (void *)&luaext_key_ld); lua_pushlightuserdata(lua_state, (void *)ld); lua_settable(lua_state, LUA_REGISTRYINDEX); /* detection engine thread ctx */ lua_pushlightuserdata(lua_state, (void *)&luaext_key_det_ctx); lua_pushlightuserdata(lua_state, (void *)det_ctx); lua_settable(lua_state, LUA_REGISTRYINDEX); LuaStateSetFlow(lua_state, f); if (det_ctx->tx_id_set) { if (f && f->alstate) { void *txptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, det_ctx->tx_id); if (txptr) { LuaStateSetTX(lua_state, txptr); } } } if (p != NULL) LuaStateSetPacket(lua_state, p); LuaStateSetDirection(lua_state, (flags & STREAM_TOSERVER)); } /** * \brief Register Suricata Lua functions */ int LuaRegisterExtensions(lua_State *lua_state) { lua_pushcfunction(lua_state, LuaGetFlowvar); lua_setglobal(lua_state, "ScFlowvarGet"); lua_pushcfunction(lua_state, LuaSetFlowvar); lua_setglobal(lua_state, "ScFlowvarSet"); lua_pushcfunction(lua_state, LuaGetFlowint); lua_setglobal(lua_state, "ScFlowintGet"); lua_pushcfunction(lua_state, LuaSetFlowint); lua_setglobal(lua_state, "ScFlowintSet"); lua_pushcfunction(lua_state, LuaIncrFlowint); lua_setglobal(lua_state, "ScFlowintIncr"); lua_pushcfunction(lua_state, LuaDecrFlowint); lua_setglobal(lua_state, "ScFlowintDecr"); LuaRegisterFunctions(lua_state); LuaRegisterHttpFunctions(lua_state); LuaRegisterDnsFunctions(lua_state); LuaRegisterTlsFunctions(lua_state); LuaRegisterSshFunctions(lua_state); LuaRegisterSmtpFunctions(lua_state); LuaRegisterDNP3Functions(lua_state); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/app-layer-template.c0000644000000000000000000004164513051004444014662 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* * TODO: Update \author in this file and app-layer-template.h. * TODO: Implement your app-layer logic with unit tests. * TODO: Remove SCLogNotice statements or convert to debug. */ /** * \file * * \author FirstName LastName * * Template application layer detector and parser for learning and * template pruposes. * * This template implements a simple application layer for something * like the echo protocol running on port 7. */ #include "suricata-common.h" #include "stream.h" #include "conf.h" #include "util-unittest.h" #include "app-layer-detect-proto.h" #include "app-layer-parser.h" #include "app-layer-template.h" /* The default port to probe for echo traffic if not provided in the * configuration file. */ #define TEMPLATE_DEFAULT_PORT "7" /* The minimum size for an echo message. For some protocols this might * be the size of a header. */ #define TEMPLATE_MIN_FRAME_LEN 1 /* Enum of app-layer events for an echo protocol. Normally you might * have events for errors in parsing data, like unexpected data being * received. For echo we'll make something up, and log an app-layer * level alert if an empty message is received. * * Example rule: * * alert template any any -> any any (msg:"SURICATA Template empty message"; \ * app-layer-event:template.empty_message; sid:X; rev:Y;) */ enum { TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE, }; SCEnumCharMap template_decoder_event_table[] = { {"EMPTY_MESSAGE", TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE}, }; static TemplateTransaction *TemplateTxAlloc(TemplateState *echo) { TemplateTransaction *tx = SCCalloc(1, sizeof(TemplateTransaction)); if (unlikely(tx == NULL)) { return NULL; } /* Increment the transaction ID on the state each time one is * allocated. */ tx->tx_id = echo->transaction_max++; TAILQ_INSERT_TAIL(&echo->tx_list, tx, next); return tx; } static void TemplateTxFree(void *tx) { TemplateTransaction *templatetx = tx; if (templatetx->request_buffer != NULL) { SCFree(templatetx->request_buffer); } if (templatetx->response_buffer != NULL) { SCFree(templatetx->response_buffer); } AppLayerDecoderEventsFreeEvents(&templatetx->decoder_events); SCFree(tx); } static void *TemplateStateAlloc(void) { SCLogNotice("Allocating template state."); TemplateState *state = SCCalloc(1, sizeof(TemplateState)); if (unlikely(state == NULL)) { return NULL; } TAILQ_INIT(&state->tx_list); return state; } static void TemplateStateFree(void *state) { TemplateState *template_state = state; TemplateTransaction *tx; SCLogNotice("Freeing template state."); while ((tx = TAILQ_FIRST(&template_state->tx_list)) != NULL) { TAILQ_REMOVE(&template_state->tx_list, tx, next); TemplateTxFree(tx); } SCFree(template_state); } /** * \brief Callback from the application layer to have a transaction freed. * * \param state a void pointer to the TemplateState object. * \param tx_id the transaction ID to free. */ static void TemplateStateTxFree(void *state, uint64_t tx_id) { TemplateState *echo = state; TemplateTransaction *tx = NULL, *ttx; SCLogNotice("Freeing transaction %"PRIu64, tx_id); TAILQ_FOREACH_SAFE(tx, &echo->tx_list, next, ttx) { /* Continue if this is not the transaction we are looking * for. */ if (tx->tx_id != tx_id) { continue; } /* Remove and free the transaction. */ TAILQ_REMOVE(&echo->tx_list, tx, next); TemplateTxFree(tx); return; } SCLogNotice("Transaction %"PRIu64" not found.", tx_id); } static int TemplateStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, template_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "template enum map table.", event_name); /* This should be treated as fatal. */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } static AppLayerDecoderEvents *TemplateGetEvents(void *state, uint64_t tx_id) { TemplateState *template_state = state; TemplateTransaction *tx; TAILQ_FOREACH(tx, &template_state->tx_list, next) { if (tx->tx_id == tx_id) { return tx->decoder_events; } } return NULL; } static int TemplateHasEvents(void *state) { TemplateState *echo = state; return echo->events; } /** * \brief Probe the input to see if it looks like echo. * * \retval ALPROTO_TEMPLATE if it looks like echo, otherwise * ALPROTO_UNKNOWN. */ static AppProto TemplateProbingParser(uint8_t *input, uint32_t input_len, uint32_t *offset) { /* Very simple test - if there is input, this is echo. */ if (input_len >= TEMPLATE_MIN_FRAME_LEN) { SCLogNotice("Detected as ALPROTO_TEMPLATE."); return ALPROTO_TEMPLATE; } SCLogNotice("Protocol not detected as ALPROTO_TEMPLATE."); return ALPROTO_UNKNOWN; } static int TemplateParseRequest(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { TemplateState *echo = state; SCLogNotice("Parsing echo request: len=%"PRIu32, input_len); /* Likely connection closed, we can just return here. */ if ((input == NULL || input_len == 0) && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { return 0; } /* Probably don't want to create a transaction in this case * either. */ if (input == NULL || input_len == 0) { return 0; } /* Normally you would parse out data here and store it in the * transaction object, but as this is echo, we'll just record the * request data. */ /* Also, if this protocol may have a "protocol data unit" span * multiple chunks of data, which is always a possibility with * TCP, you may need to do some buffering here. * * For the sake of simplicity, buffering is left out here, but * even for an echo protocol we may want to buffer until a new * line is seen, assuming its text based. */ /* Allocate a transaction. * * But note that if a "protocol data unit" is not received in one * chunk of data, and the buffering is done on the transaction, we * may need to look for the transaction that this newly recieved * data belongs to. */ TemplateTransaction *tx = TemplateTxAlloc(echo); if (unlikely(tx == NULL)) { SCLogNotice("Failed to allocate new Template tx."); goto end; } SCLogNotice("Allocated Template tx %"PRIu64".", tx->tx_id); /* Make a copy of the request. */ tx->request_buffer = SCCalloc(1, input_len); if (unlikely(tx->request_buffer == NULL)) { goto end; } memcpy(tx->request_buffer, input, input_len); tx->request_buffer_len = input_len; /* Here we check for an empty message and create an app-layer * event. */ if ((input_len == 1 && tx->request_buffer[0] == '\n') || (input_len == 2 && tx->request_buffer[0] == '\r')) { SCLogNotice("Creating event for empty message."); AppLayerDecoderEventsSetEventRaw(&tx->decoder_events, TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE); echo->events++; } end: return 0; } static int TemplateParseResponse(Flow *f, void *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { TemplateState *echo = state; TemplateTransaction *tx = NULL, *ttx;; SCLogNotice("Parsing Template response."); /* Likely connection closed, we can just return here. */ if ((input == NULL || input_len == 0) && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { return 0; } /* Probably don't want to create a transaction in this case * either. */ if (input == NULL || input_len == 0) { return 0; } /* Look up the existing transaction for this response. In the case * of echo, it will be the most recent transaction on the * TemplateState object. */ /* We should just grab the last transaction, but this is to * illustrate how you might traverse the transaction list to find * the transaction associated with this response. */ TAILQ_FOREACH(ttx, &echo->tx_list, next) { tx = ttx; } if (tx == NULL) { SCLogNotice("Failed to find transaction for response on echo state %p.", echo); goto end; } SCLogNotice("Found transaction %"PRIu64" for response on echo state %p.", tx->tx_id, echo); /* If the protocol requires multiple chunks of data to complete, you may * run into the case where you have existing response data. * * In this case, we just log that there is existing data and free it. But * you might want to realloc the buffer and append the data. */ if (tx->response_buffer != NULL) { SCLogNotice("WARNING: Transaction already has response data, " "existing data will be overwritten."); SCFree(tx->response_buffer); } /* Make a copy of the response. */ tx->response_buffer = SCCalloc(1, input_len); if (unlikely(tx->response_buffer == NULL)) { goto end; } memcpy(tx->response_buffer, input, input_len); tx->response_buffer_len = input_len; /* Set the response_done flag for transaction state checking in * TemplateGetStateProgress(). */ tx->response_done = 1; end: return 0; } static uint64_t TemplateGetTxCnt(void *state) { TemplateState *echo = state; SCLogNotice("Current tx count is %"PRIu64".", echo->transaction_max); return echo->transaction_max; } static void *TemplateGetTx(void *state, uint64_t tx_id) { TemplateState *echo = state; TemplateTransaction *tx; SCLogNotice("Requested tx ID %"PRIu64".", tx_id); TAILQ_FOREACH(tx, &echo->tx_list, next) { if (tx->tx_id == tx_id) { SCLogNotice("Transaction %"PRIu64" found, returning tx object %p.", tx_id, tx); return tx; } } SCLogNotice("Transaction ID %"PRIu64" not found.", tx_id); return NULL; } static void TemplateSetTxLogged(void *state, void *vtx, uint32_t logger) { TemplateTransaction *tx = (TemplateTransaction *)vtx; tx->logged |= logger; } static int TemplateGetTxLogged(void *state, void *vtx, uint32_t logger) { TemplateTransaction *tx = (TemplateTransaction *)vtx; if (tx->logged & logger) return 1; return 0; } /** * \brief Called by the application layer. * * In most cases 1 can be returned here. */ static int TemplateGetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } /** * \brief Return the state of a transaction in a given direction. * * In the case of the echo protocol, the existence of a transaction * means that the request is done. However, some protocols that may * need multiple chunks of data to complete the request may need more * than just the existence of a transaction for the request to be * considered complete. * * For the response to be considered done, the response for a request * needs to be seen. The response_done flag is set on response for * checking here. */ static int TemplateGetStateProgress(void *tx, uint8_t direction) { TemplateTransaction *echotx = tx; SCLogNotice("Transaction progress requested for tx ID %"PRIu64 ", direction=0x%02x", echotx->tx_id, direction); if (direction & STREAM_TOCLIENT && echotx->response_done) { return 1; } else if (direction & STREAM_TOSERVER) { /* For echo, just the existence of the transaction means the * request is done. */ return 1; } return 0; } /** * \brief ??? */ static DetectEngineState *TemplateGetTxDetectState(void *vtx) { TemplateTransaction *tx = vtx; return tx->de_state; } /** * \brief ??? */ static int TemplateSetTxDetectState(void *state, void *vtx, DetectEngineState *s) { TemplateTransaction *tx = vtx; tx->de_state = s; return 0; } void RegisterTemplateParsers(void) { char *proto_name = "template"; /* TEMPLATE_START_REMOVE */ if (ConfGetNode("app-layer.protocols.template") == NULL) { return; } /* TEMPLATE_END_REMOVE */ /* Check if Template TCP detection is enabled. If it does not exist in * the configuration file then it will be enabled by default. */ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { SCLogNotice("Template TCP protocol detection enabled."); AppLayerProtoDetectRegisterProtocol(ALPROTO_TEMPLATE, proto_name); if (RunmodeIsUnittests()) { SCLogNotice("Unittest mode, registeringd default configuration."); AppLayerProtoDetectPPRegister(IPPROTO_TCP, TEMPLATE_DEFAULT_PORT, ALPROTO_TEMPLATE, 0, TEMPLATE_MIN_FRAME_LEN, STREAM_TOSERVER, TemplateProbingParser, NULL); } else { if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_TEMPLATE, 0, TEMPLATE_MIN_FRAME_LEN, TemplateProbingParser, NULL)) { SCLogNotice("No echo app-layer configuration, enabling echo" " detection TCP detection on port %s.", TEMPLATE_DEFAULT_PORT); AppLayerProtoDetectPPRegister(IPPROTO_TCP, TEMPLATE_DEFAULT_PORT, ALPROTO_TEMPLATE, 0, TEMPLATE_MIN_FRAME_LEN, STREAM_TOSERVER, TemplateProbingParser, NULL); } } } else { SCLogNotice("Protocol detecter and parser disabled for Template."); return; } if (AppLayerParserConfParserEnabled("udp", proto_name)) { SCLogNotice("Registering Template protocol parser."); /* Register functions for state allocation and freeing. A * state is allocated for every new Template flow. */ AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateStateAlloc, TemplateStateFree); /* Register request parser for parsing frame from server to client. */ AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEMPLATE, STREAM_TOSERVER, TemplateParseRequest); /* Register response parser for parsing frames from server to client. */ AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEMPLATE, STREAM_TOCLIENT, TemplateParseResponse); /* Register a function to be called by the application layer * when a transaction is to be freed. */ AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateStateTxFree); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetTxLogged, TemplateSetTxLogged); /* Register a function to return the current transaction count. */ AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetTxCnt); /* Transaction handling. */ AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_TEMPLATE, TemplateGetAlstateProgressCompletionStatus); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetStateProgress); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetTx); /* Application layer event handling. */ AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateHasEvents); /* What is this being registered for? */ AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_TEMPLATE, NULL, TemplateGetTxDetectState, TemplateSetTxDetectState); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateStateGetEventInfo); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetEvents); } else { SCLogNotice("Template protocol parsing disabled."); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateParserRegisterTests); #endif } #ifdef UNITTESTS #endif void TemplateParserRegisterTests(void) { #ifdef UNITTESTS #endif } suricata-3.2.1/src/util-lua-dnp3.c0000644000000000000000000001347613051004444013556 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" #include "util-lua-dnp3-objects.h" /** * \brief Helper macro to push key and integer value onto a table. */ #define LUA_PUSHT_INT(l, k, v) do { \ lua_pushliteral(luastate, k); \ lua_pushinteger(luastate, v); \ lua_settable(luastate, -3); \ } while (0); static void DNP3PushPoints(lua_State *luastate, DNP3Object *object) { DNP3Point *point; int i = 1; TAILQ_FOREACH(point, object->points, next) { lua_pushinteger(luastate, i++); lua_newtable(luastate); lua_pushliteral(luastate, "index"); lua_pushinteger(luastate, point->index); lua_settable(luastate, -3); DNP3PushPoint(luastate, object, point); lua_settable(luastate, -3); } } static void DNP3PushObjects(lua_State *luastate, DNP3ObjectList *objects) { DNP3Object *object = NULL; int i = 1; TAILQ_FOREACH(object, objects, next) { lua_pushinteger(luastate, i++); lua_newtable(luastate); lua_pushliteral(luastate, "group"); lua_pushinteger(luastate, object->group); lua_settable(luastate, -3); lua_pushliteral(luastate, "variation"); lua_pushinteger(luastate, object->variation); lua_settable(luastate, -3); lua_pushliteral(luastate, "points"); lua_newtable(luastate); DNP3PushPoints(luastate, object); lua_settable(luastate, -3); lua_settable(luastate, -3); } } static void DNP3PushLinkHeader(lua_State *luastate, DNP3LinkHeader *header) { LUA_PUSHT_INT(luastate, "len", header->len); LUA_PUSHT_INT(luastate, "control", header->control); LUA_PUSHT_INT(luastate, "dst", header->dst); LUA_PUSHT_INT(luastate, "src", header->src); LUA_PUSHT_INT(luastate, "crc", header->crc); } static void DNP3PushApplicationHeader(lua_State *luastate, DNP3ApplicationHeader *header) { LUA_PUSHT_INT(luastate, "control", header->control); LUA_PUSHT_INT(luastate, "function_code", header->function_code); } static void DNP3PushRequest(lua_State *luastate, DNP3Transaction *tx) { /* Link header. */ lua_pushliteral(luastate, "link_header"); lua_newtable(luastate); DNP3PushLinkHeader(luastate, &tx->request_lh); lua_settable(luastate, -3); /* Transport header. */ LUA_PUSHT_INT(luastate, "transport_header", tx->request_th); /* Application header. */ lua_pushliteral(luastate, "application_header"); lua_newtable(luastate); DNP3PushApplicationHeader(luastate, &tx->request_ah); lua_settable(luastate, -3); lua_pushliteral(luastate, "objects"); lua_newtable(luastate); DNP3PushObjects(luastate, &tx->request_objects); lua_settable(luastate, -3); } static void DNP3PushResponse(lua_State *luastate, DNP3Transaction *tx) { /* Link header. */ lua_pushliteral(luastate, "link_header"); lua_newtable(luastate); DNP3PushLinkHeader(luastate, &tx->response_lh); lua_settable(luastate, -3); /* Transport header. */ LUA_PUSHT_INT(luastate, "transport_header", tx->response_th); /* Application header. */ lua_pushliteral(luastate, "application_header"); lua_newtable(luastate); DNP3PushApplicationHeader(luastate, &tx->response_ah); lua_settable(luastate, -3); /* Internal indicators. */ LUA_PUSHT_INT(luastate, "indicators", tx->response_iin.iin1 << 8 | tx->response_iin.iin2); lua_pushliteral(luastate, "objects"); lua_newtable(luastate); DNP3PushObjects(luastate, &tx->response_objects); lua_settable(luastate, -3); } static int DNP3GetTx(lua_State *luastate) { if (!LuaStateNeedProto(luastate, ALPROTO_DNP3)) { return LuaCallbackError(luastate, "error: protocol not dnp3"); } DNP3Transaction *tx = LuaStateGetTX(luastate); if (tx == NULL) { return LuaCallbackError(luastate, "error: no tx"); } lua_newtable(luastate); lua_pushliteral(luastate, "tx_num"); lua_pushinteger(luastate, tx->tx_num); lua_settable(luastate, -3); LUA_PUSHT_INT(luastate, "has_request", tx->has_request); if (tx->has_request) { lua_pushliteral(luastate, "request"); lua_newtable(luastate); LUA_PUSHT_INT(luastate, "done", tx->request_done); LUA_PUSHT_INT(luastate, "complete", tx->request_complete); DNP3PushRequest(luastate, tx); lua_settable(luastate, -3); } LUA_PUSHT_INT(luastate, "has_response", tx->has_response); if (tx->has_response) { lua_pushliteral(luastate, "response"); lua_newtable(luastate); LUA_PUSHT_INT(luastate, "done", tx->response_done); LUA_PUSHT_INT(luastate, "complete", tx->response_complete); DNP3PushResponse(luastate, tx); lua_settable(luastate, -3); } return 1; } int LuaRegisterDNP3Functions(lua_State *luastate) { lua_pushcfunction(luastate, DNP3GetTx); lua_setglobal(luastate, "DNP3GetTx"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/app-layer-ssl.c0000644000000000000000000044214113051004444013644 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Pierre Chifflier * \author Mats Klepsland * */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-ssl.h" #include "app-layer-tls-handshake.h" #include "decode-events.h" #include "conf.h" #include "util-spm.h" #include "util-unittest.h" #include "util-debug.h" #include "util-print.h" #include "util-pool.h" #include "util-byte.h" #include "flow-util.h" #include "flow-private.h" SCEnumCharMap tls_decoder_event_table[ ] = { /* TLS protocol messages */ { "INVALID_SSLV2_HEADER", TLS_DECODER_EVENT_INVALID_SSLV2_HEADER }, { "INVALID_TLS_HEADER", TLS_DECODER_EVENT_INVALID_TLS_HEADER }, { "INVALID_RECORD_VERSION", TLS_DECODER_EVENT_INVALID_RECORD_VERSION }, { "INVALID_RECORD_TYPE", TLS_DECODER_EVENT_INVALID_RECORD_TYPE }, { "INVALID_HANDSHAKE_MESSAGE", TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE }, { "HEARTBEAT_MESSAGE", TLS_DECODER_EVENT_HEARTBEAT }, { "INVALID_HEARTBEAT_MESSAGE", TLS_DECODER_EVENT_INVALID_HEARTBEAT }, { "OVERFLOW_HEARTBEAT_MESSAGE", TLS_DECODER_EVENT_OVERFLOW_HEARTBEAT }, { "DATALEAK_HEARTBEAT_MISMATCH", TLS_DECODER_EVENT_DATALEAK_HEARTBEAT_MISMATCH }, { "HANDSHAKE_INVALID_LENGTH", TLS_DECODER_EVENT_HANDSHAKE_INVALID_LENGTH }, { "MULTIPLE_SNI_EXTENSIONS", TLS_DECODER_EVENT_MULTIPLE_SNI_EXTENSIONS }, { "INVALID_SNI_TYPE", TLS_DECODER_EVENT_INVALID_SNI_TYPE }, { "INVALID_SNI_LENGTH", TLS_DECODER_EVENT_INVALID_SNI_LENGTH }, { "TOO_MANY_RECORDS_IN_PACKET", TLS_DECODER_EVENT_TOO_MANY_RECORDS_IN_PACKET }, /* certificate decoding messages */ { "INVALID_CERTIFICATE", TLS_DECODER_EVENT_INVALID_CERTIFICATE }, { "CERTIFICATE_MISSING_ELEMENT", TLS_DECODER_EVENT_CERTIFICATE_MISSING_ELEMENT }, { "CERTIFICATE_UNKNOWN_ELEMENT", TLS_DECODER_EVENT_CERTIFICATE_UNKNOWN_ELEMENT }, { "CERTIFICATE_INVALID_LENGTH", TLS_DECODER_EVENT_CERTIFICATE_INVALID_LENGTH }, { "CERTIFICATE_INVALID_STRING", TLS_DECODER_EVENT_CERTIFICATE_INVALID_STRING }, { "ERROR_MESSAGE_ENCOUNTERED", TLS_DECODER_EVENT_ERROR_MSG_ENCOUNTERED }, /* used as a generic error event */ { "INVALID_SSL_RECORD", TLS_DECODER_EVENT_INVALID_SSL_RECORD }, { NULL, -1 }, }; /* by default we keep tracking */ #define SSL_CONFIG_DEFAULT_NOREASSEMBLE 0 typedef struct SslConfig_ { int no_reassemble; } SslConfig; SslConfig ssl_config; /* SSLv3 record types */ #define SSLV3_CHANGE_CIPHER_SPEC 20 #define SSLV3_ALERT_PROTOCOL 21 #define SSLV3_HANDSHAKE_PROTOCOL 22 #define SSLV3_APPLICATION_PROTOCOL 23 #define SSLV3_HEARTBEAT_PROTOCOL 24 /* SSLv3 handshake protocol types */ #define SSLV3_HS_HELLO_REQUEST 0 #define SSLV3_HS_CLIENT_HELLO 1 #define SSLV3_HS_SERVER_HELLO 2 #define SSLV3_HS_NEW_SESSION_TICKET 4 #define SSLV3_HS_CERTIFICATE 11 #define SSLV3_HS_SERVER_KEY_EXCHANGE 12 #define SSLV3_HS_CERTIFICATE_REQUEST 13 #define SSLV3_HS_SERVER_HELLO_DONE 14 #define SSLV3_HS_CERTIFICATE_VERIFY 15 #define SSLV3_HS_CLIENT_KEY_EXCHANGE 16 #define SSLV3_HS_FINISHED 20 #define SSLV3_HS_CERTIFICATE_URL 21 #define SSLV3_HS_CERTIFICATE_STATUS 22 /* SSLv2 protocol message types */ #define SSLV2_MT_ERROR 0 #define SSLV2_MT_CLIENT_HELLO 1 #define SSLV2_MT_CLIENT_MASTER_KEY 2 #define SSLV2_MT_CLIENT_FINISHED 3 #define SSLV2_MT_SERVER_HELLO 4 #define SSLV2_MT_SERVER_VERIFY 5 #define SSLV2_MT_SERVER_FINISHED 6 #define SSLV2_MT_REQUEST_CERTIFICATE 7 #define SSLV2_MT_CLIENT_CERTIFICATE 8 #define SSLV3_RECORD_HDR_LEN 5 #define SSLV3_MESSAGE_HDR_LEN 4 #define SSLV3_CLIENT_HELLO_VERSION_LEN 2 #define SSLV3_CLIENT_HELLO_RANDOM_LEN 32 /* TLS heartbeat protocol types */ #define TLS_HB_REQUEST 1 #define TLS_HB_RESPONSE 2 #define SSL_PACKET_MAX_RECORDS 255 #define HAS_SPACE(n) ((uint32_t)((input) + (n) - (initial_input)) > (uint32_t)(input_len)) ? 0 : 1 static void SSLParserReset(SSLState *ssl_state) { ssl_state->curr_connp->bytes_processed = 0; } void SSLSetEvent(SSLState *ssl_state, uint8_t event) { if (ssl_state == NULL) { SCLogDebug("Could not set decoder event: %u", event); return; } AppLayerDecoderEventsSetEventRaw(&ssl_state->decoder_events, event); ssl_state->events++; } AppLayerDecoderEvents *SSLGetEvents(void *state, uint64_t id) { SSLState *ssl_state = (SSLState *)state; return ssl_state->decoder_events; } int SSLHasEvents(void *state) { SSLState *ssl_state = (SSLState *)state; return (ssl_state->events > 0); } int SSLStateHasTxDetectState(void *state) { SSLState *ssl_state = (SSLState *)state; if (ssl_state->de_state) return 1; return 0; } int SSLSetTxDetectState(void *state, void *vtx, DetectEngineState *de_state) { SSLState *ssl_state = (SSLState *)state; ssl_state->de_state = de_state; return 0; } DetectEngineState *SSLGetTxDetectState(void *vtx) { SSLState *ssl_state = (SSLState *)vtx; return ssl_state->de_state; } void *SSLGetTx(void *state, uint64_t tx_id) { SSLState *ssl_state = (SSLState *)state; return ssl_state; } uint64_t SSLGetTxCnt(void *state) { /* single tx */ return 1; } void SSLSetTxLogged(void *state, void *tx, uint32_t logger) { SSLState *ssl_state = (SSLState *)state; if (ssl_state) ssl_state->logged |= logger; } int SSLGetTxLogged(void *state, void *tx, uint32_t logger) { SSLState *ssl_state = (SSLState *)state; if (ssl_state && (ssl_state->logged & logger)) return 1; return 0; } int SSLGetAlstateProgressCompletionStatus(uint8_t direction) { return TLS_STATE_FINISHED; } int SSLGetAlstateProgress(void *tx, uint8_t direction) { SSLState *ssl_state = (SSLState *)tx; /* we don't care about direction, only that app-layer parser is done and have sent an EOF */ if (ssl_state->flags & SSL_AL_FLAG_STATE_FINISHED) { return TLS_STATE_FINISHED; } /* we want the logger to log when the handshake is done, even if the state is not finished */ if (ssl_state->flags & SSL_AL_FLAG_HANDSHAKE_DONE) { return TLS_HANDSHAKE_DONE; } if (direction == STREAM_TOSERVER && (ssl_state->server_connp.cert0_subject != NULL || ssl_state->server_connp.cert0_issuerdn != NULL)) { return TLS_STATE_CERT_READY; } return TLS_STATE_IN_PROGRESS; } static int TLSDecodeHandshakeHello(SSLState *ssl_state, uint8_t *input, uint32_t input_len) { uint8_t *initial_input = input; /* only parse the message if it is complete */ if (input_len < ssl_state->curr_connp->message_length || input_len < 40) return 0; /* skip version */ input += SSLV3_CLIENT_HELLO_VERSION_LEN; /* skip random */ input += SSLV3_CLIENT_HELLO_RANDOM_LEN; if (!(HAS_SPACE(1))) goto invalid_length; /* skip session id */ uint8_t session_id_length = *(input++); input += session_id_length; if (!(HAS_SPACE(2))) goto invalid_length; /* skip cipher suites */ uint16_t cipher_suites_length = input[0] << 8 | input[1]; input += 2; input += cipher_suites_length; if (!(HAS_SPACE(1))) goto invalid_length; /* skip compression methods */ uint8_t compression_methods_length = *(input++); input += compression_methods_length; /* extensions are optional (RFC5246 section 7.4.1.2) */ if (!(HAS_SPACE(2))) goto end; uint16_t extensions_len = input[0] << 8 | input[1]; input += 2; if (!(HAS_SPACE(extensions_len))) goto invalid_length; uint16_t processed_len = 0; while (processed_len < extensions_len) { if (!(HAS_SPACE(2))) goto invalid_length; uint16_t ext_type = input[0] << 8 | input[1]; input += 2; if (!(HAS_SPACE(2))) goto invalid_length; uint16_t ext_len = input[0] << 8 | input[1]; input += 2; switch (ext_type) { case SSL_EXTENSION_SNI: { /* there must not be more than one extension of the same type (RFC5246 section 7.4.1.4) */ if (ssl_state->curr_connp->sni) { SCLogDebug("Multiple SNI extensions"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_MULTIPLE_SNI_EXTENSIONS); return -1; } /* skip sni_list_length */ input += 2; if (!(HAS_SPACE(1))) goto invalid_length; uint8_t sni_type = *(input++); /* currently the only type allowed is host_name (RFC6066 section 3) */ if (sni_type != SSL_SNI_TYPE_HOST_NAME) { SCLogDebug("Unknown SNI type"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SNI_TYPE); return -1; } if (!(HAS_SPACE(2))) goto invalid_length; uint16_t sni_len = input[0] << 8 | input[1]; input += 2; if (!(HAS_SPACE(sni_len))) goto invalid_length; /* host_name contains the fully qualified domain name, and should therefore be limited by the maximum domain name length */ if (sni_len > 255) { SCLogDebug("SNI length >255"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SNI_LENGTH); return -1; } size_t sni_strlen = sni_len + 1; ssl_state->curr_connp->sni = SCMalloc(sni_strlen); if (unlikely(ssl_state->curr_connp->sni == NULL)) goto end; memcpy(ssl_state->curr_connp->sni, input, sni_strlen - 1); ssl_state->curr_connp->sni[sni_strlen-1] = 0; input += sni_len; break; } default: { input += ext_len; break; } } processed_len += ext_len + 4; } end: return 0; invalid_length: SCLogDebug("TLS handshake invalid length"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_HANDSHAKE_INVALID_LENGTH); return 0; } static int SSLv3ParseHandshakeType(SSLState *ssl_state, uint8_t *input, uint32_t input_len) { void *ptmp; uint8_t *initial_input = input; uint32_t parsed = 0; int rc; if (input_len == 0) { return 0; } switch (ssl_state->curr_connp->handshake_type) { case SSLV3_HS_CLIENT_HELLO: ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO; rc = TLSDecodeHandshakeHello(ssl_state, input, input_len); if (rc < 0) return rc; break; case SSLV3_HS_SERVER_HELLO: ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO; break; case SSLV3_HS_SERVER_KEY_EXCHANGE: ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_KEYX; break; case SSLV3_HS_CLIENT_KEY_EXCHANGE: ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX; break; case SSLV3_HS_CERTIFICATE: if (ssl_state->curr_connp->trec == NULL) { ssl_state->curr_connp->trec_len = 2 * ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN + 1; ssl_state->curr_connp->trec = SCMalloc(ssl_state->curr_connp->trec_len); } if (ssl_state->curr_connp->trec_pos + input_len >= ssl_state->curr_connp->trec_len) { ssl_state->curr_connp->trec_len = ssl_state->curr_connp->trec_len + 2 * input_len + 1; ptmp = SCRealloc(ssl_state->curr_connp->trec, ssl_state->curr_connp->trec_len); if (unlikely(ptmp == NULL)) { SCFree(ssl_state->curr_connp->trec); } ssl_state->curr_connp->trec = ptmp; } if (unlikely(ssl_state->curr_connp->trec == NULL)) { ssl_state->curr_connp->trec_len = 0; /* error, skip packet */ parsed += input_len; (void)parsed; /* for scan-build */ ssl_state->curr_connp->bytes_processed += input_len; return -1; } uint32_t write_len = 0; if ((ssl_state->curr_connp->bytes_processed + input_len) > ssl_state->curr_connp->record_length + (SSLV3_RECORD_HDR_LEN)) { if ((ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) < ssl_state->curr_connp->bytes_processed) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } write_len = (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) - ssl_state->curr_connp->bytes_processed; } else { write_len = input_len; } memcpy(ssl_state->curr_connp->trec + ssl_state->curr_connp->trec_pos, initial_input, write_len); ssl_state->curr_connp->trec_pos += write_len; rc = DecodeTLSHandshakeServerCertificate(ssl_state, ssl_state->curr_connp->trec, ssl_state->curr_connp->trec_pos); if (rc > 0) { /* do not return normally if the packet was fragmented: we would return the size of the _entire_ message, while we expect only the number of bytes parsed bytes from the _current_ fragment */ if (write_len < (ssl_state->curr_connp->trec_pos - rc)) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } uint32_t diff = write_len - (ssl_state->curr_connp->trec_pos - rc); ssl_state->curr_connp->bytes_processed += diff; ssl_state->curr_connp->trec_pos = 0; ssl_state->curr_connp->handshake_type = 0; ssl_state->curr_connp->hs_bytes_processed = 0; ssl_state->curr_connp->message_length = 0; return diff; } else { ssl_state->curr_connp->bytes_processed += write_len; parsed += write_len; return parsed; } break; case SSLV3_HS_HELLO_REQUEST: case SSLV3_HS_CERTIFICATE_REQUEST: case SSLV3_HS_CERTIFICATE_VERIFY: case SSLV3_HS_FINISHED: case SSLV3_HS_CERTIFICATE_URL: case SSLV3_HS_CERTIFICATE_STATUS: break; case SSLV3_HS_NEW_SESSION_TICKET: SCLogDebug("new session ticket"); break; default: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } ssl_state->flags |= ssl_state->current_flags; uint32_t write_len = 0; if ((ssl_state->curr_connp->bytes_processed + input_len) >= ssl_state->curr_connp->record_length + (SSLV3_RECORD_HDR_LEN)) { if ((ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) < ssl_state->curr_connp->bytes_processed) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } write_len = (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) - ssl_state->curr_connp->bytes_processed; } else { write_len = input_len; } if ((ssl_state->curr_connp->trec_pos + write_len) >= ssl_state->curr_connp->message_length) { if (ssl_state->curr_connp->message_length < ssl_state->curr_connp->trec_pos) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } parsed += ssl_state->curr_connp->message_length - ssl_state->curr_connp->trec_pos; ssl_state->curr_connp->bytes_processed += ssl_state->curr_connp->message_length - ssl_state->curr_connp->trec_pos; ssl_state->curr_connp->handshake_type = 0; ssl_state->curr_connp->hs_bytes_processed = 0; ssl_state->curr_connp->message_length = 0; ssl_state->curr_connp->trec_pos = 0; return parsed; } else { ssl_state->curr_connp->trec_pos += write_len; ssl_state->curr_connp->bytes_processed += write_len; parsed += write_len; return parsed; } } static int SSLv3ParseHandshakeProtocol(SSLState *ssl_state, uint8_t *input, uint32_t input_len) { uint8_t *initial_input = input; int retval; if (input_len == 0 || ssl_state->curr_connp->bytes_processed == (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN)) { return 0; } switch (ssl_state->curr_connp->hs_bytes_processed) { case 0: ssl_state->curr_connp->handshake_type = *(input++); ssl_state->curr_connp->bytes_processed++; ssl_state->curr_connp->hs_bytes_processed++; if (--input_len == 0 || ssl_state->curr_connp->bytes_processed == (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN)) { return (input - initial_input); } /* fall through */ case 1: ssl_state->curr_connp->message_length = *(input++) << 16; ssl_state->curr_connp->bytes_processed++; ssl_state->curr_connp->hs_bytes_processed++; if (--input_len == 0 || ssl_state->curr_connp->bytes_processed == (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN)) { return (input - initial_input); } /* fall through */ case 2: ssl_state->curr_connp->message_length |= *(input++) << 8; ssl_state->curr_connp->bytes_processed++; ssl_state->curr_connp->hs_bytes_processed++; if (--input_len == 0 || ssl_state->curr_connp->bytes_processed == (ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN)) { return (input - initial_input); } /* fall through */ case 3: ssl_state->curr_connp->message_length |= *(input++); ssl_state->curr_connp->bytes_processed++; ssl_state->curr_connp->hs_bytes_processed++; --input_len; /* fall through */ } retval = SSLv3ParseHandshakeType(ssl_state, input, input_len); if (retval < 0) { return retval; } input += retval; return (input - initial_input); } /** * \internal * \brief TLS Heartbeat parser (see RFC 6520) * * \param sslstate Pointer to the SSL state. * \param input Pointer to the received input data. * \param input_len Length in bytes of the received data. * \param direction 1 toclient, 0 toserver * * \retval The number of bytes parsed on success, 0 if nothing parsed, -1 on failure. */ static int SSLv3ParseHeartbeatProtocol(SSLState *ssl_state, uint8_t *input, uint32_t input_len, uint8_t direction) { uint8_t hb_type; uint16_t payload_len; uint16_t padding_len; /* expect at least 3 bytes: heartbeat type (1) + length (2) */ if (input_len < 3) { return 0; } hb_type = *input++; if (!(ssl_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC)) { if (!(hb_type == TLS_HB_REQUEST || hb_type == TLS_HB_RESPONSE)) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_HEARTBEAT); return -1; } } if ((ssl_state->flags & SSL_AL_FLAG_HB_INFLIGHT) == 0) { ssl_state->flags |= SSL_AL_FLAG_HB_INFLIGHT; if (direction) { SCLogDebug("HeartBeat Record type sent in the toclient direction!"); ssl_state->flags |= SSL_AL_FLAG_HB_SERVER_INIT; } else { SCLogDebug("HeartBeat Record type sent in the toserver direction!"); ssl_state->flags |= SSL_AL_FLAG_HB_CLIENT_INIT; } /* if we reach this point, then we can assume that the HB request is encrypted. If so, let's set the HB record length */ if (ssl_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) { ssl_state->hb_record_len = ssl_state->curr_connp->record_length; SCLogDebug("Encrypted HeartBeat Request In-flight. Storing len %u", ssl_state->hb_record_len); return (ssl_state->curr_connp->record_length - 3); } payload_len = (*input++) << 8; payload_len |= (*input++); /* check that the requested payload length is really present in the record (CVE-2014-0160) */ if ((uint32_t)(payload_len+3) > ssl_state->curr_connp->record_length) { SCLogDebug("We have a short record in HeartBeat Request"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_OVERFLOW_HEARTBEAT); return -1; } /* check the padding length. It must be at least 16 bytes (RFC 6520, section 4) */ padding_len = ssl_state->curr_connp->record_length - payload_len - 3; if (padding_len < 16) { SCLogDebug("We have a short record in HeartBeat Request"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_HEARTBEAT); return -1; } /* we don't have the payload */ if (input_len < payload_len + padding_len) { return 0; } /* OpenSSL still seems to discard multiple in-flight heartbeats although some tools send multiple at once */ } else if (direction == 1 && (ssl_state->flags & SSL_AL_FLAG_HB_INFLIGHT) && (ssl_state->flags & SSL_AL_FLAG_HB_SERVER_INIT)) { SCLogDebug("Multiple in-flight server initiated HeartBeats"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_HEARTBEAT); return -1; } else if (direction == 0 && (ssl_state->flags & SSL_AL_FLAG_HB_INFLIGHT) && (ssl_state->flags & SSL_AL_FLAG_HB_CLIENT_INIT)) { SCLogDebug("Multiple in-flight client initiated HeartBeats"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_HEARTBEAT); return -1; } else { /* we have a HB record in the opposite direction of the request, let's reset our flags */ ssl_state->flags &= ~SSL_AL_FLAG_HB_INFLIGHT; ssl_state->flags &= ~SSL_AL_FLAG_HB_SERVER_INIT; ssl_state->flags &= ~SSL_AL_FLAG_HB_CLIENT_INIT; /* if we reach this point, then we can assume that the HB request is encrypted. If so, let's set the HB record length */ if (ssl_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) { /* check to see if the encrypted response is longer than the encrypted request */ if (ssl_state->hb_record_len > 0 && ssl_state->hb_record_len < ssl_state->curr_connp->record_length) { SCLogDebug("My heart is bleeding.. OpenSSL HeartBleed response (%u)", ssl_state->hb_record_len); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_DATALEAK_HEARTBEAT_MISMATCH); ssl_state->hb_record_len = 0; return -1; } } /* reset the HB record length in case we have a legit HB followed by a bad one */ ssl_state->hb_record_len = 0; } /* skip the HeartBeat, 3 bytes were already parsed, e.g |18 03 02| for TLS 1.2 */ return (ssl_state->curr_connp->record_length - 3); } static int SSLv3ParseRecord(uint8_t direction, SSLState *ssl_state, uint8_t *input, uint32_t input_len) { uint8_t *initial_input = input; if (input_len == 0) { return 0; } switch (ssl_state->curr_connp->bytes_processed) { case 0: if (input_len >= 5) { ssl_state->curr_connp->content_type = input[0]; ssl_state->curr_connp->version = input[1] << 8; ssl_state->curr_connp->version |= input[2]; ssl_state->curr_connp->record_length = input[3] << 8; ssl_state->curr_connp->record_length |= input[4]; ssl_state->curr_connp->bytes_processed += SSLV3_RECORD_HDR_LEN; return SSLV3_RECORD_HDR_LEN; } else { ssl_state->curr_connp->content_type = *(input++); if (--input_len == 0) break; } /* fall through */ case 1: ssl_state->curr_connp->version = *(input++) << 8; if (--input_len == 0) break; /* fall through */ case 2: ssl_state->curr_connp->version |= *(input++); if (--input_len == 0) break; /* fall through */ case 3: ssl_state->curr_connp->record_length = *(input++) << 8; if (--input_len == 0) break; /* fall through */ case 4: ssl_state->curr_connp->record_length |= *(input++); if (--input_len == 0) break; /* fall through */ } ssl_state->curr_connp->bytes_processed += (input - initial_input); return (input - initial_input); } static int SSLv2ParseRecord(uint8_t direction, SSLState *ssl_state, uint8_t *input, uint32_t input_len) { uint8_t *initial_input = input; if (input_len == 0) { return 0; } if (ssl_state->curr_connp->record_lengths_length == 2) { switch (ssl_state->curr_connp->bytes_processed) { case 0: if (input_len >= ssl_state->curr_connp->record_lengths_length + 1) { ssl_state->curr_connp->record_length = (0x7f & input[0]) << 8 | input[1]; ssl_state->curr_connp->content_type = input[2]; ssl_state->curr_connp->version = SSL_VERSION_2; ssl_state->curr_connp->bytes_processed += 3; return 3; } else { ssl_state->curr_connp->record_length = (0x7f & *(input++)) << 8; if (--input_len == 0) break; } /* fall through */ case 1: ssl_state->curr_connp->record_length |= *(input++); if (--input_len == 0) break; /* fall through */ case 2: ssl_state->curr_connp->content_type = *(input++); ssl_state->curr_connp->version = SSL_VERSION_2; if (--input_len == 0) break; /* fall through */ } } else { switch (ssl_state->curr_connp->bytes_processed) { case 0: if (input_len >= ssl_state->curr_connp->record_lengths_length + 1) { ssl_state->curr_connp->record_length = (0x3f & input[0]) << 8 | input[1]; ssl_state->curr_connp->content_type = input[3]; ssl_state->curr_connp->version = SSL_VERSION_2; ssl_state->curr_connp->bytes_processed += 4; return 4; } else { ssl_state->curr_connp->record_length = (0x3f & *(input++)) << 8; if (--input_len == 0) break; } /* fall through */ case 1: ssl_state->curr_connp->record_length |= *(input++); if (--input_len == 0) break; /* fall through */ case 2: /* padding */ input++; if (--input_len == 0) break; /* fall through */ case 3: ssl_state->curr_connp->content_type = *(input++); ssl_state->curr_connp->version = SSL_VERSION_2; if (--input_len == 0) break; /* fall through */ } } ssl_state->curr_connp->bytes_processed += (input - initial_input); return (input - initial_input); } static int SSLv2Decode(uint8_t direction, SSLState *ssl_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { int retval = 0; uint8_t *initial_input = input; if (ssl_state->curr_connp->bytes_processed == 0) { if (input[0] & 0x80) { ssl_state->curr_connp->record_lengths_length = 2; } else { ssl_state->curr_connp->record_lengths_length = 3; } } /* the +1 is because we read one extra byte inside SSLv2ParseRecord to read the msg_type */ if (ssl_state->curr_connp->bytes_processed < (ssl_state->curr_connp->record_lengths_length + 1)) { retval = SSLv2ParseRecord(direction, ssl_state, input, input_len); if (retval == -1) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSLV2_HEADER); return -1; } else { input += retval; input_len -= retval; } } if (input_len == 0) { return (input - initial_input); } /* record_length should never be zero */ if (ssl_state->curr_connp->record_length == 0) { SCLogDebug("SSLv2 record length is zero"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSLV2_HEADER); return -1; } /* record_lenghts_length should never be zero */ if (ssl_state->curr_connp->record_lengths_length == 0) { SCLogDebug("SSLv2 record lengths length is zero"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSLV2_HEADER); return -1; } switch (ssl_state->curr_connp->content_type) { case SSLV2_MT_ERROR: SCLogDebug("SSLV2_MT_ERROR msg_type received. Error encountered " "in establishing the sslv2 session, may be version"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_ERROR_MSG_ENCOUNTERED); break; case SSLV2_MT_CLIENT_HELLO: ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO; ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS; if (ssl_state->curr_connp->record_lengths_length == 3) { switch (ssl_state->curr_connp->bytes_processed) { case 4: if (input_len >= 6) { ssl_state->curr_connp->session_id_length = input[4] << 8; ssl_state->curr_connp->session_id_length |= input[5]; input += 6; input_len -= 6; ssl_state->curr_connp->bytes_processed += 6; if (ssl_state->curr_connp->session_id_length == 0) { ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID; } break; } else { input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; } /* fall through */ case 5: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; /* fall through */ case 6: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; /* fall through */ case 7: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; /* fall through */ case 8: ssl_state->curr_connp->session_id_length = *(input++) << 8; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; /* fall through */ case 9: ssl_state->curr_connp->session_id_length |= *(input++); ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; /* fall through */ } } else { switch (ssl_state->curr_connp->bytes_processed) { case 3: if (input_len >= 6) { ssl_state->curr_connp->session_id_length = input[4] << 8; ssl_state->curr_connp->session_id_length |= input[5]; input += 6; input_len -= 6; ssl_state->curr_connp->bytes_processed += 6; if (ssl_state->curr_connp->session_id_length == 0) { ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID; } break; } else { input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; } case 4: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; case 5: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; case 6: input++; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; case 7: ssl_state->curr_connp->session_id_length = *(input++) << 8; ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; case 8: ssl_state->curr_connp->session_id_length |= *(input++); ssl_state->curr_connp->bytes_processed++; if (--input_len == 0) break; } } break; case SSLV2_MT_CLIENT_MASTER_KEY: if (!(ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS)) { SCLogDebug("Client hello is not seen before master key " "message!"); } ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY; break; case SSLV2_MT_CLIENT_CERTIFICATE: if (direction == 1) { SCLogDebug("Incorrect SSL Record type sent in the toclient " "direction!"); } else { ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX; } /* fall through */ case SSLV2_MT_SERVER_VERIFY: case SSLV2_MT_SERVER_FINISHED: if (direction == 0 && !(ssl_state->curr_connp->content_type & SSLV2_MT_CLIENT_CERTIFICATE)) { SCLogDebug("Incorrect SSL Record type sent in the toserver " "direction!"); } /* fall through */ case SSLV2_MT_CLIENT_FINISHED: case SSLV2_MT_REQUEST_CERTIFICATE: /* both client hello and server hello must be seen */ if ((ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) && (ssl_state->flags & SSL_AL_FLAG_SSL_SERVER_HS)) { if (direction == 0) { if (ssl_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) { ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED; SCLogDebug("SSLv2 client side has started the encryption"); } else if (ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY) { ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED; SCLogDebug("SSLv2 client side has started the encryption"); } } else { ssl_state->current_flags = SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED; SCLogDebug("SSLv2 Server side has started the encryption"); } if ((ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED) && (ssl_state->flags & SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED)) { AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION); if (ssl_config.no_reassemble == 1) AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_REASSEMBLY); SCLogDebug("SSLv2 No reassembly & inspection has been set"); } } break; case SSLV2_MT_SERVER_HELLO: ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO; ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS; break; } ssl_state->flags |= ssl_state->current_flags; if (input_len + ssl_state->curr_connp->bytes_processed >= (ssl_state->curr_connp->record_length + ssl_state->curr_connp->record_lengths_length)) { /* looks like we have another record after this */ uint32_t diff = ssl_state->curr_connp->record_length + ssl_state->curr_connp->record_lengths_length + - ssl_state->curr_connp->bytes_processed; input += diff; SSLParserReset(ssl_state); return (input - initial_input); /* we still don't have the entire record for the one we are currently parsing */ } else { input += input_len; ssl_state->curr_connp->bytes_processed += input_len; return (input - initial_input); } } static int SSLv3Decode(uint8_t direction, SSLState *ssl_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { int retval = 0; uint32_t parsed = 0; if (ssl_state->curr_connp->bytes_processed < SSLV3_RECORD_HDR_LEN) { retval = SSLv3ParseRecord(direction, ssl_state, input, input_len); if (retval < 0) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_TLS_HEADER); return -1; } else { parsed += retval; input_len -= retval; } } if (input_len == 0) { return parsed; } /* check record version */ if (ssl_state->curr_connp->version < SSL_VERSION_3 || ssl_state->curr_connp->version > TLS_VERSION_12) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_RECORD_VERSION); return -1; } /* record_length should never be zero */ if (ssl_state->curr_connp->record_length == 0) { SCLogDebug("SSLv3 Record length is 0"); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_TLS_HEADER); return -1; } switch (ssl_state->curr_connp->content_type) { /* we don't need any data from these types */ case SSLV3_CHANGE_CIPHER_SPEC: ssl_state->flags |= SSL_AL_FLAG_CHANGE_CIPHER_SPEC; if (direction) ssl_state->flags |= SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC; else ssl_state->flags |= SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC; break; case SSLV3_ALERT_PROTOCOL: break; case SSLV3_APPLICATION_PROTOCOL: if ((ssl_state->flags & SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC) && (ssl_state->flags & SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC)) { /* AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION); if (ssl_config.no_reassemble == 1) AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_REASSEMBLY); */ AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD); } /* if we see (encrypted) aplication data, then this means the handshake must be done */ ssl_state->flags |= SSL_AL_FLAG_HANDSHAKE_DONE; /* Encrypted data, reassembly not asked, bypass asked, let's sacrifice * heartbeat lke inspection to be able to be able to bypass the flow */ if (ssl_config.no_reassemble == 1) { AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_REASSEMBLY); AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION); } break; case SSLV3_HANDSHAKE_PROTOCOL: if (ssl_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) break; if (ssl_state->curr_connp->record_length < 4) { SSLParserReset(ssl_state); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } retval = SSLv3ParseHandshakeProtocol(ssl_state, input + parsed, input_len); if (retval < 0) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_HANDSHAKE_MESSAGE); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } else { if ((uint32_t)retval > input_len) { SCLogDebug("Error parsing SSLv3.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } parsed += retval; input_len -= retval; (void)input_len; /* for scan-build */ if (ssl_state->curr_connp->bytes_processed == ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) { SSLParserReset(ssl_state); } SCLogDebug("trigger RAW! (post HS)"); AppLayerParserTriggerRawStreamReassembly(ssl_state->f); return parsed; } break; case SSLV3_HEARTBEAT_PROTOCOL: retval = SSLv3ParseHeartbeatProtocol(ssl_state, input + parsed, input_len, direction); if (retval < 0) return -1; break; default: /* \todo fix the event from invalid rule to unknown rule */ SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_RECORD_TYPE); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } if (input_len + ssl_state->curr_connp->bytes_processed >= ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) { if ((ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) < ssl_state->curr_connp->bytes_processed) { /* defensive checks. Something is wrong. */ SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } SCLogDebug("record complete, trigger RAW"); AppLayerParserTriggerRawStreamReassembly(ssl_state->f); /* looks like we have another record */ uint32_t diff = ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN - ssl_state->curr_connp->bytes_processed; parsed += diff; SSLParserReset(ssl_state); return parsed; /* we still don't have the entire record for the one we are currently parsing */ } else { parsed += input_len; ssl_state->curr_connp->bytes_processed += input_len; return parsed; } } /** * \internal * \brief SSLv2, SSLv23, SSLv3, TLSv1.1, TLSv1.2, TLSv1.3 parser. * * On parsing error, this should be the only function that should reset * the parser state, to avoid multiple functions in the chain reseting * the parser state. * * \param direction 0 for toserver, 1 for toclient. * \param alstate Pointer to the state. * \param pstate Application layer parser state for this session. * \param input Pointer the received input data. * \param input_len Length in bytes of the received data. * \param output Pointer to the list of parsed output elements. * * \todo On reaching an inconsistent state, check if the input has * another new record, instead of just returning after the reset * * \retval >=0 On success. */ static int SSLDecode(Flow *f, uint8_t direction, void *alstate, AppLayerParserState *pstate, uint8_t *input, uint32_t ilen) { SSLState *ssl_state = (SSLState *)alstate; int retval = 0; uint8_t counter = 0; int32_t input_len = (int32_t)ilen; ssl_state->f = f; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { /* flag session as finished if APP_LAYER_PARSER_EOF is set */ ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED; SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } if (direction == 0) ssl_state->curr_connp = &ssl_state->client_connp; else ssl_state->curr_connp = &ssl_state->server_connp; /* If entering on a new record, reset the current flags. */ if (ssl_state->curr_connp->bytes_processed == 0) { ssl_state->current_flags = 0; } /* if we have more than one record */ while (input_len > 0) { if (counter++ == SSL_PACKET_MAX_RECORDS) { SCLogDebug("Looks like we have looped quite a bit. Reset state " "and get out of here"); SSLParserReset(ssl_state); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_TOO_MANY_RECORDS_IN_PACKET); return -1; } /* ssl_state->bytes_processed is zero for a fresh record or positive to indicate a record currently being parsed */ switch (ssl_state->curr_connp->bytes_processed) { /* fresh record */ case 0: /* only SSLv2, has one of the top 2 bits set */ if ((input[0] & 0x80) || (input[0] & 0x40)) { SCLogDebug("SSLv2 detected"); ssl_state->curr_connp->version = SSL_VERSION_2; retval = SSLv2Decode(direction, ssl_state, pstate, input, input_len); if (retval < 0) { SCLogDebug("Error parsing SSLv2.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } else { input_len -= retval; input += retval; } } else { SCLogDebug("SSLv3.x detected"); /* we will keep it this way till our record parser tells us what exact version this is */ ssl_state->curr_connp->version = TLS_VERSION_UNKNOWN; retval = SSLv3Decode(direction, ssl_state, pstate, input, input_len); if (retval < 0) { SCLogDebug("Error parsing SSLv3.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); return -1; } else { input_len -= retval; input += retval; if (ssl_state->curr_connp->bytes_processed == SSLV3_RECORD_HDR_LEN && ssl_state->curr_connp->record_length == 0) { /* empty record */ SSLParserReset(ssl_state); } } } break; default: /* we would have established by now if we are dealing with * SSLv2 or above */ if (ssl_state->curr_connp->version == SSL_VERSION_2) { SCLogDebug("Continuing parsing SSLv2 record from where we " "previously left off"); retval = SSLv2Decode(direction, ssl_state, pstate, input, input_len); if (retval < 0) { SCLogDebug("Error parsing SSLv2.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); return 0; } else { input_len -= retval; input += retval; } } else { SCLogDebug("Continuing parsing SSLv3.x record from where we " "previously left off"); retval = SSLv3Decode(direction, ssl_state, pstate, input, input_len); if (retval < 0) { SCLogDebug("Error parsing SSLv3.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); return 0; } else { if (retval > input_len) { SCLogDebug("Error parsing SSLv3.x. Reseting parser " "state. Let's get outta here"); SSLParserReset(ssl_state); } input_len -= retval; input += retval; if (ssl_state->curr_connp->bytes_processed == SSLV3_RECORD_HDR_LEN && ssl_state->curr_connp->record_length == 0) { /* empty record */ SSLParserReset(ssl_state); } } } break; } /* switch (ssl_state->curr_connp->bytes_processed) */ } /* while (input_len) */ /* mark handshake as done if we have subject and issuer */ if (ssl_state->server_connp.cert0_subject && ssl_state->server_connp.cert0_issuerdn) ssl_state->flags |= SSL_AL_FLAG_HANDSHAKE_DONE; /* flag session as finished if APP_LAYER_PARSER_EOF is set */ if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED; return 1; } int SSLParseClientRecord(Flow *f, void *alstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return SSLDecode(f, 0 /* toserver */, alstate, pstate, input, input_len); } int SSLParseServerRecord(Flow *f, void *alstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return SSLDecode(f, 1 /* toclient */, alstate, pstate, input, input_len); } /** * \internal * \brief Function to allocate the SSL state memory. */ void *SSLStateAlloc(void) { SSLState *ssl_state = SCMalloc(sizeof(SSLState)); if (unlikely(ssl_state == NULL)) return NULL; memset(ssl_state, 0, sizeof(SSLState)); ssl_state->client_connp.cert_log_flag = 0; ssl_state->server_connp.cert_log_flag = 0; TAILQ_INIT(&ssl_state->server_connp.certs); return (void *)ssl_state; } /** * \internal * \brief Function to free the SSL state memory. */ void SSLStateFree(void *p) { SSLState *ssl_state = (SSLState *)p; SSLCertsChain *item; if (ssl_state->client_connp.trec) SCFree(ssl_state->client_connp.trec); if (ssl_state->client_connp.cert0_subject) SCFree(ssl_state->client_connp.cert0_subject); if (ssl_state->client_connp.cert0_issuerdn) SCFree(ssl_state->client_connp.cert0_issuerdn); if (ssl_state->client_connp.cert0_fingerprint) SCFree(ssl_state->client_connp.cert0_fingerprint); if (ssl_state->client_connp.sni) SCFree(ssl_state->client_connp.sni); if (ssl_state->server_connp.trec) SCFree(ssl_state->server_connp.trec); if (ssl_state->server_connp.cert0_subject) SCFree(ssl_state->server_connp.cert0_subject); if (ssl_state->server_connp.cert0_issuerdn) SCFree(ssl_state->server_connp.cert0_issuerdn); if (ssl_state->server_connp.cert0_fingerprint) SCFree(ssl_state->server_connp.cert0_fingerprint); if (ssl_state->server_connp.sni) SCFree(ssl_state->server_connp.sni); AppLayerDecoderEventsFreeEvents(&ssl_state->decoder_events); if (ssl_state->de_state != NULL) { DetectEngineStateFree(ssl_state->de_state); } /* Free certificate chain */ while ((item = TAILQ_FIRST(&ssl_state->server_connp.certs))) { TAILQ_REMOVE(&ssl_state->server_connp.certs, item, next); SCFree(item); } TAILQ_INIT(&ssl_state->server_connp.certs); SCFree(ssl_state); return; } void SSLStateTransactionFree(void *state, uint64_t tx_id) { /* do nothing */ } static uint16_t SSLProbingParser(uint8_t *input, uint32_t ilen, uint32_t *offset) { /* probably a rst/fin sending an eof */ if (ilen == 0) return ALPROTO_UNKNOWN; /* for now just the 3 byte header ones */ /* \todo Detect the 2 byte ones */ if ((input[0] & 0x80) && (input[2] == 0x01)) { return ALPROTO_TLS; } return ALPROTO_FAILED; } int SSLStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, tls_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "ssl's enum map table.", event_name); /* yes this is fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } static int SSLRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 00 02|", 5, 2, STREAM_TOSERVER) < 0) { return -1; } /** SSLv3 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 03 00|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 00|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } /** TLSv1 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 03 01|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 01|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } /** TLSv1.1 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 03 02|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 02|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } /** TLSv1.2 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 03 03|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 03|", 3, 0, STREAM_TOSERVER) < 0) { return -1; } /***** toclient direction *****/ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|15 03 00|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 00|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|17 03 00|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } /** TLSv1 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|15 03 01|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 01|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|17 03 01|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } /** TLSv1.1 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|15 03 02|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 02|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|17 03 02|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } /** TLSv1.2 */ if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|15 03 03|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|16 03 03|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|17 03 03|", 3, 0, STREAM_TOCLIENT) < 0) { return -1; } /* Subsection - SSLv2 style record by client, but informing the server * the max version it supports. * Updated by Anoop Saldanha. Disabled it for now. We'll get back to * it after some tests */ #if 0 if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|01 03 00|", 5, 2, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_TLS, "|00 02|", 7, 5, STREAM_TOCLIENT) < 0) { return -1; } #endif return 0; } /** * \brief Function to register the SSL protocol parser and other functions */ void RegisterSSLParsers(void) { char *proto_name = "tls"; /** SSLv2 and SSLv23*/ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_TLS, proto_name); if (SSLRegisterPatternsForProtocolDetection() < 0) return; if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, "443", ALPROTO_TLS, 0, 3, STREAM_TOSERVER, SSLProbingParser, NULL); } else { AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_TLS, 0, 3, SSLProbingParser, NULL); } } else { SCLogInfo("Protocol detection and parser disabled for %s protocol", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TLS, STREAM_TOSERVER, SSLParseClientRecord); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TLS, STREAM_TOCLIENT, SSLParseServerRecord); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_TLS, SSLStateGetEventInfo); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_TLS, SSLStateAlloc, SSLStateFree); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_TLS, STREAM_TOSERVER); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_TLS, SSLStateTransactionFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_TLS, SSLGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_TLS, SSLHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_TLS, SSLStateHasTxDetectState, SSLGetTxDetectState, SSLSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_TLS, SSLGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_TLS, SSLGetTxCnt); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_TLS, SSLGetAlstateProgress); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_TLS, SSLGetTxLogged, SSLSetTxLogged); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_TLS, SSLGetAlstateProgressCompletionStatus); /* Get the value of no reassembly option from the config file */ if (ConfGetNode("app-layer.protocols.tls.no-reassemble") == NULL) { if (ConfGetBool("tls.no-reassemble", &ssl_config.no_reassemble) != 1) ssl_config.no_reassemble = SSL_CONFIG_DEFAULT_NOREASSEMBLE; } else { if (ConfGetBool("app-layer.protocols.tls.no-reassemble", &ssl_config.no_reassemble) != 1) ssl_config.no_reassemble = SSL_CONFIG_DEFAULT_NOREASSEMBLE; } } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_TLS, SSLParserRegisterTests); #endif return; } /***************************************Unittests******************************/ #ifdef UNITTESTS /** *\test Send a get request in one chunk. */ static int SSLParserTest01(void) { Flow f; uint8_t tlsbuf[] = { 0x16, 0x03, 0x01 }; uint32_t tlslen = sizeof(tlsbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_EOF, tlsbuf, tlslen); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** \test Send a get request in two chunks. */ static int SSLParserTest02(void) { Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03, 0x01 }; uint32_t tlslen2 = sizeof(tlsbuf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** \test Send a get request in three chunks. */ static int SSLParserTest03(void) { Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03 }; uint32_t tlslen2 = sizeof(tlsbuf2); uint8_t tlsbuf3[] = { 0x01 }; uint32_t tlslen3 = sizeof(tlsbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf3, tlslen3); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** \test Send a get request in three chunks + more data. */ static int SSLParserTest04(void) { Flow f; uint8_t tlsbuf1[] = { 0x16 }; uint32_t tlslen1 = sizeof(tlsbuf1); uint8_t tlsbuf2[] = { 0x03 }; uint32_t tlslen2 = sizeof(tlsbuf2); uint8_t tlsbuf3[] = { 0x01 }; uint32_t tlslen3 = sizeof(tlsbuf3); uint8_t tlsbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x01 }; uint32_t tlslen4 = sizeof(tlsbuf4); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf2, tlslen2); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf3, tlslen3); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf4, tlslen4); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } #if 0 /** \test Test the setting up of no reassembly and no payload inspection flag * after detection of the TLS handshake completion */ static int SSLParserTest05(void) { int result = 1; Flow f; uint8_t tlsbuf[] = { 0x16, 0x03, 0x01, 0x00, 0x01 }; uint32_t tlslen = sizeof(tlsbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x17; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } SSLState *ssl_state = f.alstate; if (ssl_state == NULL) { printf("no tls state: "); result = 0; goto end; } if (ssl_state->client_connp.content_type != 0x17) { printf("expected content_type %" PRIu8 ", got %" PRIu8 ": ", 0x17, ssl_state->client_connp.content_type); result = 0; goto end; } if (ssl_state->client_connp.version != TLS_VERSION_10) { printf("expected version %04" PRIu16 ", got %04" PRIu16 ": ", TLS_VERSION_10, ssl_state->client_connp.client_version); result = 0; goto end; } AppLayerParserStateStore *parser_state_store = (AppLayerParserStateStore *) ssn.alparser; AppLayerParserState *parser_state = &parser_state_store->to_server; if (!(parser_state->flags & APP_LAYER_PARSER_NO_INSPECTION) && !(ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) && !(ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("The flags should be set\n"); result = 0; goto end; } if (!(f.flags & FLOW_NOPAYLOAD_INSPECTION)) { printf("The flags should be set\n"); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif #if 0 /** \test Test the setting up of no reassembly and no payload inspection flag * after detection of the valid TLS handshake completion, the rouge * 0x17 packet will not be considered in the detection process */ static int SSLParserTest06(void) { int result = 1; Flow f; uint8_t tlsbuf[] = { 0x16, 0x03, 0x01, 0x00, 0x01 }; uint32_t tlslen = sizeof(tlsbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x17; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } SSLState *ssl_state = f.alstate; if (ssl_state == NULL) { printf("no tls state: "); result = 0; goto end; } if (ssl_state->client_connp.content_type != 0x17) { printf("expected content_type %" PRIu8 ", got %" PRIu8 ": ", 0x17, ssl_state->client_connp._content_type); result = 0; goto end; } if (ssl_state->client_connp.version != TLS_VERSION_10) { printf("expected version %04" PRIu16 ", got %04" PRIu16 ": ", TLS_VERSION_10, ssl_state->client_connp.version); result = 0; goto end; } AppLayerParserStateStore *parser_state_store = (AppLayerParserStateStore *) ssn.alparser; AppLayerParserState *parser_state = &parser_state_store->to_server; if ((parser_state->flags & APP_LAYER_PARSER_NO_INSPECTION) || (ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || (ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("The flags should not be set\n"); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x17; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } if (!(parser_state->flags & APP_LAYER_PARSER_NO_INSPECTION) && !(ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) && !(ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("The flags should be set\n"); result = 0; goto end; } if (!(f.flags & FLOW_NOPAYLOAD_INSPECTION)) { printf("The flags should be set\n"); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif /** \test multimsg test */ static int SSLParserMultimsgTest01(void) { Flow f; /* 3 msgs */ uint8_t tlsbuf1[] = { 0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00, 0x82, 0x00, 0x80, 0xd3, 0x6f, 0x1f, 0x63, 0x82, 0x8d, 0x75, 0x77, 0x8c, 0x91, 0xbc, 0xa1, 0x3d, 0xbb, 0xe1, 0xb5, 0xd3, 0x31, 0x92, 0x59, 0x2b, 0x2c, 0x43, 0x96, 0xa3, 0xaa, 0x23, 0x92, 0xd0, 0x91, 0x2a, 0x5e, 0x10, 0x5b, 0xc8, 0xc1, 0xe2, 0xd3, 0x5c, 0x8b, 0x8c, 0x91, 0x9e, 0xc2, 0xf2, 0x9c, 0x3c, 0x4f, 0x37, 0x1e, 0x20, 0x5e, 0x33, 0xd5, 0xf0, 0xd6, 0xaf, 0x89, 0xf5, 0xcc, 0xb2, 0xcf, 0xc1, 0x60, 0x3a, 0x46, 0xd5, 0x4e, 0x2a, 0xb6, 0x6a, 0xb9, 0xfc, 0x32, 0x8b, 0xe0, 0x6e, 0xa0, 0xed, 0x25, 0xa0, 0xa4, 0x82, 0x81, 0x73, 0x90, 0xbf, 0xb5, 0xde, 0xeb, 0x51, 0x8d, 0xde, 0x5b, 0x6f, 0x94, 0xee, 0xba, 0xe5, 0x69, 0xfa, 0x1a, 0x80, 0x30, 0x54, 0xeb, 0x12, 0x01, 0xb9, 0xfe, 0xbf, 0x82, 0x95, 0x01, 0x7b, 0xb0, 0x97, 0x14, 0xc2, 0x06, 0x3c, 0x69, 0xfb, 0x1c, 0x66, 0x47, 0x17, 0xd9, 0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0xf6, 0xbc, 0x0d, 0x6f, 0xe8, 0xbb, 0xaa, 0xbf, 0x14, 0xeb, 0x7b, 0xcc, 0x6c, 0x28, 0xb0, 0xfc, 0xa6, 0x01, 0x2a, 0x97, 0x96, 0x17, 0x5e, 0xe8, 0xb4, 0x4e, 0x78, 0xc9, 0x04, 0x65, 0x53, 0xb6, 0x93, 0x3d, 0xeb, 0x44, 0xee, 0x86, 0xf9, 0x80, 0x49, 0x45, 0x21, 0x34, 0xd1, 0xee, 0xc8, 0x9c }; uint32_t tlslen1 = sizeof(tlsbuf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf1, tlslen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != TLS_VERSION_10); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** \test multimsg test server */ static int SSLParserMultimsgTest02(void) { Flow f; /* 3 msgs */ uint8_t tlsbuf1[] = { 0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00, 0x82, 0x00, 0x80, 0xd3, 0x6f, 0x1f, 0x63, 0x82, 0x8d, 0x75, 0x77, 0x8c, 0x91, 0xbc, 0xa1, 0x3d, 0xbb, 0xe1, 0xb5, 0xd3, 0x31, 0x92, 0x59, 0x2b, 0x2c, 0x43, 0x96, 0xa3, 0xaa, 0x23, 0x92, 0xd0, 0x91, 0x2a, 0x5e, 0x10, 0x5b, 0xc8, 0xc1, 0xe2, 0xd3, 0x5c, 0x8b, 0x8c, 0x91, 0x9e, 0xc2, 0xf2, 0x9c, 0x3c, 0x4f, 0x37, 0x1e, 0x20, 0x5e, 0x33, 0xd5, 0xf0, 0xd6, 0xaf, 0x89, 0xf5, 0xcc, 0xb2, 0xcf, 0xc1, 0x60, 0x3a, 0x46, 0xd5, 0x4e, 0x2a, 0xb6, 0x6a, 0xb9, 0xfc, 0x32, 0x8b, 0xe0, 0x6e, 0xa0, 0xed, 0x25, 0xa0, 0xa4, 0x82, 0x81, 0x73, 0x90, 0xbf, 0xb5, 0xde, 0xeb, 0x51, 0x8d, 0xde, 0x5b, 0x6f, 0x94, 0xee, 0xba, 0xe5, 0x69, 0xfa, 0x1a, 0x80, 0x30, 0x54, 0xeb, 0x12, 0x01, 0xb9, 0xfe, 0xbf, 0x82, 0x95, 0x01, 0x7b, 0xb0, 0x97, 0x14, 0xc2, 0x06, 0x3c, 0x69, 0xfb, 0x1c, 0x66, 0x47, 0x17, 0xd9, 0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01, 0x00, 0x30, 0xf6, 0xbc, 0x0d, 0x6f, 0xe8, 0xbb, 0xaa, 0xbf, 0x14, 0xeb, 0x7b, 0xcc, 0x6c, 0x28, 0xb0, 0xfc, 0xa6, 0x01, 0x2a, 0x97, 0x96, 0x17, 0x5e, 0xe8, 0xb4, 0x4e, 0x78, 0xc9, 0x04, 0x65, 0x53, 0xb6, 0x93, 0x3d, 0xeb, 0x44, 0xee, 0x86, 0xf9, 0x80, 0x49, 0x45, 0x21, 0x34, 0xd1, 0xee, 0xc8, 0x9c }; uint32_t tlslen1 = sizeof(tlsbuf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf1, tlslen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->server_connp.content_type != 0x16); FAIL_IF(ssl_state->server_connp.version != 0x0301); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Test the detection of SSLv3 protocol from the given packet */ static int SSLParserTest07(void) { Flow f; uint8_t tlsbuf[] = { 0x16, 0x03, 0x00, 0x00, 0x4c, 0x01, 0x00, 0x00, 0x48, 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t tlslen = sizeof(tlsbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } #if 0 /** \test Test the setting up of no reassembly and no payload inspection flag * after detection of the SSLv3 handshake completion */ static int SSLParserTest08(void) { int result = 1; Flow f; uint8_t tlsbuf[] = { 0x16, 0x03, 0x00, 0x00, 0x01 }; uint32_t tlslen = sizeof(tlsbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x14; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } tlsbuf[0] = 0x17; r = AppLayerParserParse(alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, tlsbuf, tlslen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; goto end; } SSLState *ssl_state = f.alstate; if (ssl_state == NULL) { printf("no tls state: "); result = 0; goto end; } if (ssl_state->client_connp.content_type != 0x17) { printf("expected content_type %" PRIu8 ", got %" PRIu8 ": ", 0x17, ssl_state->client_connp.content_type); result = 0; goto end; } if (ssl_state->client_connp.version != SSL_VERSION_3) { printf("expected version %04" PRIu16 ", got %04" PRIu16 ": ", SSL_VERSION_3, ssl_state->client_connp.version); result = 0; goto end; } AppLayerParserStateStore *parser_state_store = (AppLayerParserStateStore *) ssn.alparser; AppLayerParserState *parser_state = &parser_state_store->to_server; if (!(parser_state->flags & APP_LAYER_PARSER_NO_INSPECTION) && !(ssn.client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) && !(ssn.server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { printf("The flags should be set\n"); result = 0; goto end; } if (!(f.flags & FLOW_NOPAYLOAD_INSPECTION)) { printf("The flags should be set\n"); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest09(void) { Flow f; uint8_t buf1[] = { 0x16, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x03, 0x00, 0x00, 0x4c, 0x01, 0x00, 0x00, 0x48, 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest10(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x00, 0x00, 0x4c, 0x01, 0x00, 0x00, 0x48, 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest11(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x4c, 0x01, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x00, 0x00, 0x48, 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest12(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x4c, 0x01, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x00, 0x00, 0x48, }; uint32_t buf2_len = sizeof(buf2); uint8_t buf3[] = { 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t buf3_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf3, buf3_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest13(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x4c, 0x01, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x00, 0x00, 0x48, }; uint32_t buf2_len = sizeof(buf2); uint8_t buf3[] = { 0x03, 0x00, 0x57, 0x04, 0x9f, 0x8c, 0x66, 0x61, 0xf6, 0x3d, 0x4f, }; uint32_t buf3_len = sizeof(buf3); uint8_t buf4[] = { 0xbf, 0xbb, 0xa7, 0x47, 0x21, 0x76, 0x6c, 0x21, 0x08, 0x9f, 0xef, 0x3d, 0x0e, 0x5f, 0x65, 0x1a, 0xe1, 0x93, 0xb8, 0xaf, 0xd2, 0x82, 0xbd, 0x00, 0x00, 0x06, 0x00, 0x0a, 0x00, 0x16, 0x00, 0xff, 0x01, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, 0x00, 0x00, 0x10, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x65, 0x66, 0x67, 0x68, 0x2e, 0x6e, 0x6f }; uint32_t buf4_len = sizeof(buf4); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf3, buf3_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf4, buf4_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest14(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x00, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x16, 0x03, 0x00, 0x00, 0x00, }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest15(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x01, 0x01, }; uint32_t buf1_len = sizeof(buf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r == 0); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest16(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x02, 0x01, 0x00 }; uint32_t buf1_len = sizeof(buf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r == 0); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest17(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x03, 0x01, 0x00, 0x00 }; uint32_t buf1_len = sizeof(buf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r == 0); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest18(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x04, 0x01, 0x00, 0x00, 0x6b, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x16, 0x03, 0x00, 0x00, 0x00, }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest19(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x04, 0x01, 0x00, 0x00, 0x6b, 0x16, 0x03, 0x00, 0x00, 0x00, }; uint32_t buf1_len = sizeof(buf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest20(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x03, 0x01, 0x00, 0x00, 0x16, 0x03, 0x00, 0x00, 0x00, }; uint32_t buf1_len = sizeof(buf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r == 0); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test SSLv2 Record parsing. */ static int SSLParserTest21(void) { Flow f; uint8_t buf[] = { 0x80, 0x31, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, }; uint32_t buf_len = sizeof(buf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_EOF, buf, buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->client_connp.content_type != SSLV2_MT_CLIENT_HELLO); FAIL_IF(app_state->client_connp.version != SSL_VERSION_2); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test SSLv2 Record parsing. */ static int SSLParserTest22(void) { Flow f; uint8_t buf[] = { 0x80, 0x31, 0x04, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x10, 0x07, 0x00, 0xc0, 0x05, 0x00, 0x80, 0x03, 0x00, 0x80, 0x01, 0x00, 0x80, 0x08, 0x00, 0x80, 0x06, 0x00, 0x40, 0x04, 0x00, 0x80, 0x02, 0x00, 0x80, 0x76, 0x64, 0x75, 0x2d, 0xa7, 0x98, 0xfe, 0xc9, 0x12, 0x92, 0xc1, 0x2f, 0x34, 0x84, 0x20, 0xc5}; uint32_t buf_len = sizeof(buf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); //AppLayerDetectProtoThreadInit(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT | STREAM_EOF, buf, buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->server_connp.content_type != SSLV2_MT_SERVER_HELLO); FAIL_IF(app_state->server_connp.version != SSL_VERSION_2); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test SSLv2 Record parsing. */ static int SSLParserTest23(void) { Flow f; uint8_t chello_buf[] = { 0x80, 0x67, 0x01, 0x03, 0x00, 0x00, 0x4e, 0x00, 0x00, 0x00, 0x10, 0x01, 0x00, 0x80, 0x03, 0x00, 0x80, 0x07, 0x00, 0xc0, 0x06, 0x00, 0x40, 0x02, 0x00, 0x80, 0x04, 0x00, 0x80, 0x00, 0x00, 0x39, 0x00, 0x00, 0x38, 0x00, 0x00, 0x35, 0x00, 0x00, 0x33, 0x00, 0x00, 0x32, 0x00, 0x00, 0x04, 0x00, 0x00, 0x05, 0x00, 0x00, 0x2f, 0x00, 0x00, 0x16, 0x00, 0x00, 0x13, 0x00, 0xfe, 0xff, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x15, 0x00, 0x00, 0x12, 0x00, 0xfe, 0xfe, 0x00, 0x00, 0x09, 0x00, 0x00, 0x64, 0x00, 0x00, 0x62, 0x00, 0x00, 0x03, 0x00, 0x00, 0x06, 0xa8, 0xb8, 0x93, 0xbb, 0x90, 0xe9, 0x2a, 0xa2, 0x4d, 0x6d, 0xcc, 0x1c, 0xe7, 0x2a, 0x80, 0x21 }; uint32_t chello_buf_len = sizeof(chello_buf); uint8_t shello_buf[] = { 0x16, 0x03, 0x00, 0x00, 0x4a, 0x02, 0x00, 0x00, 0x46, 0x03, 0x00, 0x44, 0x4c, 0x94, 0x8f, 0xfe, 0x81, 0xed, 0x93, 0x65, 0x02, 0x88, 0xa3, 0xf8, 0xeb, 0x63, 0x86, 0x0e, 0x2c, 0xf6, 0x8d, 0xd0, 0x0f, 0x2c, 0x2a, 0xd6, 0x4f, 0xcd, 0x2d, 0x3c, 0x16, 0xd7, 0xd6, 0x20, 0xa0, 0xfb, 0x60, 0x86, 0x3d, 0x1e, 0x76, 0xf3, 0x30, 0xfe, 0x0b, 0x01, 0xfd, 0x1a, 0x01, 0xed, 0x95, 0xf6, 0x7b, 0x8e, 0xc0, 0xd4, 0x27, 0xbf, 0xf0, 0x6e, 0xc7, 0x56, 0xb1, 0x47, 0xce, 0x98, 0x00, 0x35, 0x00, 0x16, 0x03, 0x00, 0x03, 0x44, 0x0b, 0x00, 0x03, 0x40, 0x00, 0x03, 0x3d, 0x00, 0x03, 0x3a, 0x30, 0x82, 0x03, 0x36, 0x30, 0x82, 0x02, 0x9f, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x30, 0x81, 0xa9, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x58, 0x59, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x44, 0x65, 0x73, 0x65, 0x72, 0x74, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x54, 0x6f, 0x77, 0x6e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x2c, 0x20, 0x4c, 0x74, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x15, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x20, 0x43, 0x41, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0f, 0x63, 0x61, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x33, 0x30, 0x33, 0x30, 0x35, 0x31, 0x36, 0x34, 0x37, 0x34, 0x35, 0x5a, 0x17, 0x0d, 0x30, 0x38, 0x30, 0x33, 0x30, 0x33, 0x31, 0x36, 0x34, 0x37, 0x34, 0x35, 0x5a, 0x30, 0x81, 0xa7, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x58, 0x59, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0c, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x44, 0x65, 0x73, 0x65, 0x72, 0x74, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x54, 0x6f, 0x77, 0x6e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x53, 0x6e, 0x61, 0x6b, 0x65, 0x20, 0x4f, 0x69, 0x6c, 0x2c, 0x20, 0x4c, 0x74, 0x64, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0e, 0x57, 0x65, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x54, 0x65, 0x61, 0x6d, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x77, 0x77, 0x77, 0x2e, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x10, 0x77, 0x77, 0x77, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xa4, 0x6e, 0x53, 0x14, 0x0a, 0xde, 0x2c, 0xe3, 0x60, 0x55, 0x9a, 0xf2, 0x42, 0xa6, 0xaf, 0x47, 0x12, 0x2f, 0x17, 0xce, 0xfa, 0xba, 0xdc, 0x4e, 0x63, 0x56, 0x34, 0xb9, 0xba, 0x73, 0x4b, 0x78, 0x44, 0x3d, 0xc6, 0x6c, 0x69, 0xa4, 0x25, 0xb3, 0x61, 0x02, 0x9d, 0x09, 0x04, 0x3f, 0x72, 0x3d, 0xd8, 0x27, 0xd3, 0xb0, 0x5a, 0x45, 0x77, 0xb7, 0x36, 0xe4, 0x26, 0x23, 0xcc, 0x12, 0xb8, 0xae, 0xde, 0xa7, 0xb6, 0x3a, 0x82, 0x3c, 0x7c, 0x24, 0x59, 0x0a, 0xf8, 0x96, 0x43, 0x8b, 0xa3, 0x29, 0x36, 0x3f, 0x91, 0x7f, 0x5d, 0xc7, 0x23, 0x94, 0x29, 0x7f, 0x0a, 0xce, 0x0a, 0xbd, 0x8d, 0x9b, 0x2f, 0x19, 0x17, 0xaa, 0xd5, 0x8e, 0xec, 0x66, 0xa2, 0x37, 0xeb, 0x3f, 0x57, 0x53, 0x3c, 0xf2, 0xaa, 0xbb, 0x79, 0x19, 0x4b, 0x90, 0x7e, 0xa7, 0xa3, 0x99, 0xfe, 0x84, 0x4c, 0x89, 0xf0, 0x3d, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x6e, 0x30, 0x6c, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x14, 0x30, 0x12, 0x81, 0x10, 0x77, 0x77, 0x77, 0x40, 0x73, 0x6e, 0x61, 0x6b, 0x65, 0x6f, 0x69, 0x6c, 0x2e, 0x64, 0x6f, 0x6d, 0x30, 0x3a, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x0d, 0x04, 0x2d, 0x16, 0x2b, 0x6d, 0x6f, 0x64, 0x5f, 0x73, 0x73, 0x6c, 0x20, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x20, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x30, 0x11, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x01, 0x04, 0x04, 0x03, 0x02, 0x06, 0x40, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0xae, 0x79, 0x79, 0x22, 0x90, 0x75, 0xfd, 0xa6, 0xd5, 0xc4, 0xb8, 0xc4, 0x99, 0x4e, 0x1c, 0x05, 0x7c, 0x91, 0x59, 0xbe, 0x89, 0x0d, 0x3d, 0xc6, 0x8c, 0xa3, 0xcf, 0xf6, 0xba, 0x23, 0xdf, 0xb8, 0xae, 0x44, 0x68, 0x8a, 0x8f, 0xb9, 0x8b, 0xcb, 0x12, 0xda, 0xe6, 0xa2, 0xca, 0xa5, 0xa6, 0x55, 0xd9, 0xd2, 0xa1, 0xad, 0xba, 0x9b, 0x2c, 0x44, 0x95, 0x1d, 0x4a, 0x90, 0x59, 0x7f, 0x83, 0xae, 0x81, 0x5e, 0x3f, 0x92, 0xe0, 0x14, 0x41, 0x82, 0x4e, 0x7f, 0x53, 0xfd, 0x10, 0x23, 0xeb, 0x8a, 0xeb, 0xe9, 0x92, 0xea, 0x61, 0xf2, 0x8e, 0x19, 0xa1, 0xd3, 0x49, 0xc0, 0x84, 0x34, 0x1e, 0x2e, 0x6e, 0xf6, 0x98, 0xe2, 0x87, 0x53, 0xd6, 0x55, 0xd9, 0x1a, 0x8a, 0x92, 0x5c, 0xad, 0xdc, 0x1e, 0x1c, 0x30, 0xa7, 0x65, 0x9d, 0xc2, 0x4f, 0x60, 0xd2, 0x6f, 0xdb, 0xe0, 0x9f, 0x9e, 0xbc, 0x41, 0x16, 0x03, 0x00, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00 }; uint32_t shello_buf_len = sizeof(shello_buf); uint8_t client_change_cipher_spec_buf[] = { 0x16, 0x03, 0x00, 0x00, 0x84, 0x10, 0x00, 0x00, 0x80, 0x65, 0x51, 0x2d, 0xa6, 0xd4, 0xa7, 0x38, 0xdf, 0xac, 0x79, 0x1f, 0x0b, 0xd9, 0xb2, 0x61, 0x7d, 0x73, 0x88, 0x32, 0xd9, 0xf2, 0x62, 0x3a, 0x8b, 0x11, 0x04, 0x75, 0xca, 0x42, 0xff, 0x4e, 0xd9, 0xcc, 0xb9, 0xfa, 0x86, 0xf3, 0x16, 0x2f, 0x09, 0x73, 0x51, 0x66, 0xaa, 0x29, 0xcd, 0x80, 0x61, 0x0f, 0xe8, 0x13, 0xce, 0x5b, 0x8e, 0x0a, 0x23, 0xf8, 0x91, 0x5e, 0x5f, 0x54, 0x70, 0x80, 0x8e, 0x7b, 0x28, 0xef, 0xb6, 0x69, 0xb2, 0x59, 0x85, 0x74, 0x98, 0xe2, 0x7e, 0xd8, 0xcc, 0x76, 0x80, 0xe1, 0xb6, 0x45, 0x4d, 0xc7, 0xcd, 0x84, 0xce, 0xb4, 0x52, 0x79, 0x74, 0xcd, 0xe6, 0xd7, 0xd1, 0x9c, 0xad, 0xef, 0x63, 0x6c, 0x0f, 0xf7, 0x05, 0xe4, 0x4d, 0x1a, 0xd3, 0xcb, 0x9c, 0xd2, 0x51, 0xb5, 0x61, 0xcb, 0xff, 0x7c, 0xee, 0xc7, 0xbc, 0x5e, 0x15, 0xa3, 0xf2, 0x52, 0x0f, 0xbb, 0x32, 0x14, 0x03, 0x00, 0x00, 0x01, 0x01, 0x16, 0x03, 0x00, 0x00, 0x40, 0xa9, 0xd8, 0xd7, 0x35, 0xbc, 0x39, 0x56, 0x98, 0xad, 0x87, 0x61, 0x2a, 0xc4, 0x8f, 0xcc, 0x03, 0xcb, 0x93, 0x80, 0x81, 0xb0, 0x4a, 0xc4, 0xd2, 0x09, 0x71, 0x3e, 0x90, 0x3c, 0x8d, 0xe0, 0x95, 0x44, 0xfe, 0x56, 0xd1, 0x7e, 0x88, 0xe2, 0x48, 0xfd, 0x76, 0x70, 0x76, 0xe2, 0xcd, 0x06, 0xd0, 0xf3, 0x9d, 0x13, 0x79, 0x67, 0x1e, 0x37, 0xf6, 0x98, 0xbe, 0x59, 0x18, 0x4c, 0xfc, 0x75, 0x56 }; uint32_t client_change_cipher_spec_buf_len = sizeof(client_change_cipher_spec_buf); uint8_t server_change_cipher_spec_buf[] = { 0x14, 0x03, 0x00, 0x00, 0x01, 0x01, 0x16, 0x03, 0x00, 0x00, 0x40, 0xce, 0x7c, 0x92, 0x43, 0x59, 0xcc, 0x3d, 0x90, 0x91, 0x9c, 0x58, 0xf0, 0x7a, 0xce, 0xae, 0x0d, 0x08, 0xe0, 0x76, 0xb4, 0x86, 0xb1, 0x15, 0x5b, 0x32, 0xb8, 0x77, 0x53, 0xe7, 0xa6, 0xf9, 0xd0, 0x95, 0x5f, 0xaa, 0x07, 0xc3, 0x96, 0x7c, 0xc9, 0x88, 0xc2, 0x7a, 0x20, 0x89, 0x4f, 0xeb, 0xeb, 0xb6, 0x19, 0xef, 0xaa, 0x27, 0x73, 0x9d, 0xa6, 0xb4, 0x9f, 0xeb, 0x34, 0xe2, 0x4d, 0x9f, 0x6b }; uint32_t server_change_cipher_spec_buf_len = sizeof(server_change_cipher_spec_buf); uint8_t toserver_app_data_buf[] = { 0x17, 0x03, 0x00, 0x01, 0xb0, 0x4a, 0xc3, 0x3e, 0x9d, 0x77, 0x78, 0x01, 0x2c, 0xb4, 0xbc, 0x4c, 0x9a, 0x84, 0xd7, 0xb9, 0x90, 0x0c, 0x21, 0x10, 0xf0, 0xfa, 0x00, 0x7c, 0x16, 0xbb, 0x77, 0xfb, 0x72, 0x42, 0x4f, 0xad, 0x50, 0x4a, 0xd0, 0xaa, 0x6f, 0xaa, 0x44, 0x6c, 0x62, 0x94, 0x1b, 0xc5, 0xfe, 0xe9, 0x1c, 0x5e, 0xde, 0x85, 0x0b, 0x0e, 0x05, 0xe4, 0x18, 0x6e, 0xd2, 0xd3, 0xb5, 0x20, 0xab, 0x81, 0xfd, 0x18, 0x9a, 0x73, 0xb8, 0xd7, 0xef, 0xc3, 0xdd, 0x74, 0xd7, 0x9c, 0x1e, 0x6f, 0x21, 0x6d, 0xf8, 0x24, 0xca, 0x3c, 0x70, 0x78, 0x36, 0x12, 0x7a, 0x8a, 0x9c, 0xac, 0x4e, 0x1c, 0xa8, 0xfb, 0x27, 0x30, 0xba, 0x9a, 0xf4, 0x2f, 0x0a, 0xab, 0x80, 0x6a, 0xa1, 0x60, 0x74, 0xf0, 0xe3, 0x91, 0x84, 0xe7, 0x90, 0x88, 0xcc, 0xf0, 0x95, 0x7b, 0x0a, 0x22, 0xf2, 0xf9, 0x27, 0xe0, 0xdd, 0x38, 0x0c, 0xfd, 0xe9, 0x03, 0x71, 0xdc, 0x70, 0xa4, 0x6e, 0xdf, 0xe3, 0x72, 0x9e, 0xa1, 0xf0, 0xc9, 0x00, 0xd6, 0x03, 0x55, 0x6a, 0x67, 0x5d, 0x9c, 0xb8, 0x75, 0x01, 0xb0, 0x01, 0x9f, 0xe6, 0xd2, 0x44, 0x18, 0xbc, 0xca, 0x7a, 0x10, 0x39, 0xa6, 0xcf, 0x15, 0xc7, 0xf5, 0x35, 0xd4, 0xb3, 0x6d, 0x91, 0x23, 0x84, 0x99, 0xba, 0xb0, 0x7e, 0xd0, 0xc9, 0x4c, 0xbf, 0x3f, 0x33, 0x68, 0x37, 0xb7, 0x7d, 0x44, 0xb0, 0x0b, 0x2c, 0x0f, 0xd0, 0x75, 0xa2, 0x6b, 0x5b, 0xe1, 0x9f, 0xd4, 0x69, 0x9a, 0x14, 0xc8, 0x29, 0xb7, 0xd9, 0x10, 0xbb, 0x99, 0x30, 0x9a, 0xfb, 0xcc, 0x13, 0x1f, 0x76, 0x4e, 0xe6, 0xdf, 0x14, 0xaa, 0xd5, 0x60, 0xbf, 0x91, 0x49, 0x0d, 0x64, 0x42, 0x29, 0xa8, 0x64, 0x27, 0xd4, 0x5e, 0x1b, 0x18, 0x03, 0xa8, 0x73, 0xd6, 0x05, 0x6e, 0xf7, 0x50, 0xb0, 0x09, 0x6b, 0x69, 0x7a, 0x12, 0x28, 0x58, 0xef, 0x5a, 0x86, 0x11, 0xde, 0x71, 0x71, 0x9f, 0xca, 0xbd, 0x79, 0x2a, 0xc2, 0xe5, 0x9b, 0x5e, 0x32, 0xe7, 0xcb, 0x97, 0x6e, 0xa0, 0xea, 0xa4, 0xa4, 0x6a, 0x32, 0xf9, 0x37, 0x39, 0xd8, 0x37, 0x6d, 0x63, 0xf3, 0x08, 0x1c, 0xdd, 0x06, 0xdd, 0x2c, 0x2b, 0x9f, 0x04, 0x88, 0x5f, 0x36, 0x42, 0xc1, 0xb1, 0xc7, 0xe8, 0x2d, 0x5d, 0xa4, 0x6c, 0xe5, 0x60, 0x94, 0xae, 0xd0, 0x90, 0x1e, 0x88, 0xa0, 0x87, 0x52, 0xfb, 0xed, 0x97, 0xa5, 0x25, 0x5a, 0xb7, 0x55, 0xc5, 0x13, 0x07, 0x85, 0x27, 0x40, 0xed, 0xb8, 0xa0, 0x26, 0x13, 0x44, 0x0c, 0xfc, 0xcc, 0x5a, 0x09, 0xe5, 0x44, 0xb5, 0x63, 0xa1, 0x43, 0x51, 0x23, 0x4f, 0x17, 0x21, 0x89, 0x2e, 0x58, 0xfd, 0xf9, 0x63, 0x74, 0x04, 0x70, 0x1e, 0x7d, 0xd0, 0x66, 0xba, 0x40, 0x5e, 0x45, 0xdc, 0x39, 0x7c, 0x53, 0x0f, 0xa8, 0x38, 0xb2, 0x13, 0x99, 0x27, 0xd9, 0x4a, 0x51, 0xe9, 0x9f, 0x2a, 0x92, 0xbb, 0x9c, 0x90, 0xab, 0xfd, 0xf1, 0xb7, 0x40, 0x05, 0xa9, 0x7a, 0x20, 0x63, 0x36, 0xc1, 0xef, 0xb9, 0xad, 0xa2, 0xe0, 0x1d, 0x20, 0x4f, 0xb2, 0x34, 0xbd, 0xea, 0x07, 0xac, 0x21, 0xce, 0xf6, 0x8a, 0xa2, 0x9e, 0xcd, 0xfa }; uint32_t toserver_app_data_buf_len = sizeof(toserver_app_data_buf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); //AppLayerDetectProtoThreadInit(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER | STREAM_START, chello_buf, chello_buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->client_connp.content_type != SSLV2_MT_CLIENT_HELLO); FAIL_IF(app_state->client_connp.version != SSL_VERSION_2); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) == 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, shello_buf, shello_buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FAIL_IF(app_state->server_connp.content_type != SSLV3_HANDSHAKE_PROTOCOL); FAIL_IF(app_state->server_connp.version != SSL_VERSION_3); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) == 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_change_cipher_spec_buf, client_change_cipher_spec_buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* with multiple records the client content type hold the type from the last * record */ FAIL_IF(app_state->client_connp.content_type != SSLV3_HANDSHAKE_PROTOCOL); FAIL_IF(app_state->client_connp.version != SSL_VERSION_3); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_KEYX) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) == 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_change_cipher_spec_buf, server_change_cipher_spec_buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* with multiple records the serve content type hold the type from the last * record */ FAIL_IF(app_state->server_connp.content_type != SSLV3_HANDSHAKE_PROTOCOL); FAIL_IF(app_state->server_connp.version != SSL_VERSION_3); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_KEYX) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) == 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, toserver_app_data_buf, toserver_app_data_buf_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FAIL_IF(app_state->client_connp.content_type != SSLV3_APPLICATION_PROTOCOL); FAIL_IF(app_state->client_connp.version != SSL_VERSION_3); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_CLIENT_HS) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_STATE_CLIENT_KEYX) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC) == 0); FAIL_IF((app_state->flags & SSL_AL_FLAG_CHANGE_CIPHER_SPEC) == 0); FAIL_IF_NOT(f.flags & FLOW_NOPAYLOAD_INSPECTION); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Tests the parser for handling fragmented records. */ static int SSLParserTest24(void) { Flow f; uint8_t buf1[] = { 0x16, 0x03, 0x00, 0x00, 0x6f, 0x01, 0x00, 0x00, 0x6b, 0x03, }; uint32_t buf1_len = sizeof(buf1); uint8_t buf2[] = { 0x00, 0x4b, 0x2f, 0xdc, 0x4e, 0xe6, 0x95, 0xf1, 0xa0, 0xc7, 0xcf, 0x8e, 0xf6, 0xeb, 0x22, 0x6d, 0xce, 0x9c, 0x44, 0xfb, 0xc8, 0xa0, 0x44, 0x31, 0x15, 0x4c, 0xe9, 0x97, 0xa7, 0xa1, 0xfe, 0xea, 0xcc, 0x20, 0x4b, 0x5d, 0xfb, 0xa5, 0x63, 0x7a, 0x73, 0x95, 0xf7, 0xff, 0x42, 0xac, 0x8f, 0x46, 0xed, 0xe4, 0xb1, 0x35, 0x35, 0x78, 0x1a, 0x9d, 0xaf, 0x10, 0xc5, 0x52, 0xf3, 0x7b, 0xfb, 0xb5, 0xe9, 0xa8, 0x00, 0x24, 0x00, 0x88, 0x00, 0x87, 0x00, 0x39, 0x00, 0x38, 0x00, 0x84, 0x00, 0x35, 0x00, 0x45, 0x00, 0x44, 0x00, 0x33, 0x00, 0x32, 0x00, 0x96, 0x00, 0x41, 0x00, 0x2f, 0x00, 0x16, 0x00, 0x13, 0xfe, 0xff, 0x00, 0x0a, 0x00, 0x02, 0x01, 0x00 }; uint32_t buf2_len = sizeof(buf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf1, buf1_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf2, buf2_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.content_type != 0x16); FAIL_IF(ssl_state->client_connp.version != SSL_VERSION_3); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } /** * \test Test for bug #955 and CVE-2013-5919. The data is from the * pcap that was used to report this issue. */ static int SSLParserTest25(void) { Flow f; uint8_t client_hello[] = { 0x16, 0x03, 0x01, 0x00, 0xd3, 0x01, 0x00, 0x00, 0xcf, 0x03, 0x01, 0x51, 0x60, 0xc2, 0x15, 0x36, 0x73, 0xf5, 0xb8, 0x58, 0x55, 0x3b, 0x68, 0x12, 0x7d, 0xe3, 0x28, 0xa3, 0xe1, 0x02, 0x79, 0x2d, 0x12, 0xe1, 0xf4, 0x24, 0x12, 0xa2, 0x9e, 0xf1, 0x08, 0x49, 0x68, 0x20, 0x0e, 0x96, 0x46, 0x3d, 0x84, 0x5a, 0xc6, 0x55, 0xeb, 0x3b, 0x53, 0x77, 0xf4, 0x8e, 0xf4, 0xd2, 0x8b, 0xec, 0xd6, 0x99, 0x63, 0x64, 0x62, 0xf8, 0x3f, 0x3b, 0xd5, 0x35, 0x45, 0x1b, 0x16, 0xac, 0x00, 0x46, 0x00, 0x04, 0x00, 0x05, 0x00, 0x2f, 0x00, 0x35, 0xc0, 0x02, 0xc0, 0x04, 0xc0, 0x05, 0xc0, 0x0c, 0xc0, 0x0e, 0xc0, 0x0f, 0xc0, 0x07, 0xc0, 0x09, 0xc0, 0x0a, 0xc0, 0x11, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x32, 0x00, 0x38, 0x00, 0x0a, 0xc0, 0x03, 0xc0, 0x0d, 0xc0, 0x08, 0xc0, 0x12, 0x00, 0x16, 0x00, 0x13, 0x00, 0x09, 0x00, 0x15, 0x00, 0x12, 0x00, 0x03, 0x00, 0x08, 0x00, 0x14, 0x00, 0x11, 0x00, 0xff, 0x01, 0x00, 0x00, 0x40, 0x00, 0x0b, 0x00, 0x04, 0x03, 0x00, 0x01, 0x02, 0x00, 0x0a, 0x00, 0x34, 0x00, 0x32, 0x00, 0x0e, 0x00, 0x0d, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x0c, 0x00, 0x18, 0x00, 0x09, 0x00, 0x0a, 0x00, 0x16, 0x00, 0x17, 0x00, 0x08, 0x00, 0x06, 0x00, 0x07, 0x00, 0x14, 0x00, 0x15, 0x00, 0x04, 0x00, 0x05, 0x00, 0x12, 0x00, 0x13, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x0f, 0x00, 0x10, 0x00, 0x11 }; uint32_t client_hello_len = sizeof(client_hello); uint8_t server_hello_certificate_done[] = { 0x16, 0x03, 0x01, 0x00, 0x51, 0x02, 0x00, 0x00, 0x4d, 0x03, 0x01, 0x51, 0x60, 0xc2, 0x17, 0xb7, 0x81, 0xaa, 0x27, 0xa1, 0xd5, 0xfa, 0x14, 0xc1, 0xe0, 0x05, 0xab, 0x75, 0xf2, 0x51, 0xe7, 0x6e, 0xe6, 0xf9, 0xc4, 0x8f, 0x16, 0x08, 0x26, 0x6c, 0x1b, 0x86, 0x90, 0x20, 0x0a, 0x38, 0x90, 0x2d, 0x17, 0x7d, 0xb7, 0x6b, 0x6b, 0xe5, 0xeb, 0x61, 0x90, 0x35, 0xf8, 0xcd, 0xb1, 0x2a, 0x69, 0x6e, 0x0e, 0x3e, 0x5f, 0x90, 0xdc, 0x2f, 0x51, 0x45, 0x68, 0x63, 0xe3, 0xb3, 0x00, 0x05, 0x00, 0x00, 0x05, 0xff, 0x01, 0x00, 0x01, 0x00, 0x16, 0x03, 0x01, 0x07, 0x60, 0x0b, 0x00, 0x07, 0x5c, 0x00, 0x07, 0x59, 0x00, 0x03, 0xcc, 0x30, 0x82, 0x03, 0xc8, 0x30, 0x82, 0x03, 0x31, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x01, 0x7f, 0x77, 0xde, 0xb3, 0xbc, 0xbb, 0x23, 0x5d, 0x44, 0xcc, 0xc7, 0xdb, 0xa6, 0x2e, 0x72, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x81, 0xba, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x16, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x54, 0x72, 0x75, 0x73, 0x74, 0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0e, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x33, 0x30, 0x31, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x2a, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x33, 0x31, 0x49, 0x30, 0x47, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x40, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x50, 0x53, 0x20, 0x49, 0x6e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x62, 0x79, 0x20, 0x52, 0x65, 0x66, 0x2e, 0x20, 0x4c, 0x49, 0x41, 0x42, 0x49, 0x4c, 0x49, 0x54, 0x59, 0x20, 0x4c, 0x54, 0x44, 0x2e, 0x28, 0x63, 0x29, 0x39, 0x37, 0x20, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x32, 0x30, 0x36, 0x32, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x33, 0x31, 0x32, 0x33, 0x31, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x68, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x09, 0x50, 0x61, 0x6c, 0x6f, 0x20, 0x41, 0x6c, 0x74, 0x6f, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x46, 0x61, 0x63, 0x65, 0x62, 0x6f, 0x6f, 0x6b, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x02, 0x14, 0x0e, 0x2a, 0x2e, 0x66, 0x61, 0x63, 0x65, 0x62, 0x6f, 0x6f, 0x6b, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xae, 0x94, 0xb1, 0x71, 0xe2, 0xde, 0xcc, 0xc1, 0x69, 0x3e, 0x05, 0x10, 0x63, 0x24, 0x01, 0x02, 0xe0, 0x68, 0x9a, 0xe8, 0x3c, 0x39, 0xb6, 0xb3, 0xe7, 0x4b, 0x97, 0xd4, 0x8d, 0x7b, 0x23, 0x68, 0x91, 0x00, 0xb0, 0xb4, 0x96, 0xee, 0x62, 0xf0, 0xe6, 0xd3, 0x56, 0xbc, 0xf4, 0xaa, 0x0f, 0x50, 0x64, 0x34, 0x02, 0xf5, 0xd1, 0x76, 0x6a, 0xa9, 0x72, 0x83, 0x5a, 0x75, 0x64, 0x72, 0x3f, 0x39, 0xbb, 0xef, 0x52, 0x90, 0xde, 0xd9, 0xbc, 0xdb, 0xf9, 0xd3, 0xd5, 0x5d, 0xfa, 0xd2, 0x3a, 0xa0, 0x3d, 0xc6, 0x04, 0xc5, 0x4d, 0x29, 0xcf, 0x1d, 0x4b, 0x3b, 0xdb, 0xd1, 0xa8, 0x09, 0xcf, 0xae, 0x47, 0xb4, 0x4c, 0x7e, 0xae, 0x17, 0xc5, 0x10, 0x9b, 0xee, 0x24, 0xa9, 0xcf, 0x4a, 0x8d, 0x91, 0x1b, 0xb0, 0xfd, 0x04, 0x15, 0xae, 0x4c, 0x3f, 0x43, 0x0a, 0xa1, 0x2a, 0x55, 0x7e, 0x2a, 0xe1, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x1e, 0x30, 0x82, 0x01, 0x1a, 0x30, 0x09, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x02, 0x30, 0x00, 0x30, 0x44, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x3d, 0x30, 0x3b, 0x30, 0x39, 0x06, 0x0b, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x45, 0x01, 0x07, 0x17, 0x03, 0x30, 0x2a, 0x30, 0x28, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x00, 0x01, 0x16, 0x1c, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x70, 0x61, 0x30, 0x3c, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x35, 0x30, 0x33, 0x30, 0x31, 0xa0, 0x2f, 0xa0, 0x2d, 0x86, 0x2b, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x53, 0x56, 0x52, 0x49, 0x6e, 0x74, 0x6c, 0x2d, 0x63, 0x72, 0x6c, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x53, 0x56, 0x52, 0x49, 0x6e, 0x74, 0x6c, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x05, 0xa0, 0x30, 0x34, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x28, 0x30, 0x26, 0x30, 0x24, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x27, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x20, 0x30, 0x1e, 0x82, 0x0e, 0x2a, 0x2e, 0x66, 0x61, 0x63, 0x65, 0x62, 0x6f, 0x6f, 0x6b, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0c, 0x66, 0x61, 0x63, 0x65, 0x62, 0x6f, 0x6f, 0x6b, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x5b, 0x6c, 0x2b, 0x75, 0xf8, 0xed, 0x30, 0xaa, 0x51, 0xaa, 0xd3, 0x6a, 0xba, 0x59, 0x5e, 0x55, 0x51, 0x41, 0x95, 0x1f, 0x81, 0xa5, 0x3b, 0x44, 0x79, 0x10, 0xac, 0x1f, 0x76, 0xff, 0x78, 0xfc, 0x27, 0x81, 0x61, 0x6b, 0x58, 0xf3, 0x12, 0x2a, 0xfc, 0x1c, 0x87, 0x01, 0x04, 0x25, 0xe9, 0xed, 0x43, 0xdf, 0x1a, 0x7b, 0xa6, 0x49, 0x80, 0x60, 0x67, 0xe2, 0x68, 0x8a, 0xf0, 0x3d, 0xb5, 0x8c, 0x7d, 0xf4, 0xee, 0x03, 0x30, 0x9a, 0x6a, 0xfc, 0x24, 0x7c, 0xcb, 0x13, 0x4d, 0xc3, 0x3e, 0x54, 0xc6, 0xbc, 0x1d, 0x51, 0x33, 0xa5, 0x32, 0xa7, 0x32, 0x73, 0xb1, 0xd7, 0x9c, 0xad, 0xc0, 0x8e, 0x7e, 0x1a, 0x83, 0x11, 0x6d, 0x34, 0x52, 0x33, 0x40, 0xb0, 0x30, 0x54, 0x27, 0xa2, 0x17, 0x42, 0x82, 0x7c, 0x98, 0x91, 0x66, 0x98, 0xee, 0x7e, 0xaf, 0x8c, 0x3b, 0xdd, 0x71, 0x70, 0x08, 0x17, 0x00, 0x03, 0x87, 0x30, 0x82, 0x03, 0x83, 0x30, 0x82, 0x02, 0xec, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x10, 0x46, 0xfc, 0xeb, 0xba, 0xb4, 0xd0, 0x2f, 0x0f, 0x92, 0x60, 0x98, 0x23, 0x3f, 0x93, 0x07, 0x8f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x5f, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x37, 0x30, 0x35, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x2e, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x33, 0x20, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x20, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x64, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x39, 0x37, 0x30, 0x34, 0x31, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x32, 0x34, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x81, 0xba, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x16, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x54, 0x72, 0x75, 0x73, 0x74, 0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0e, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x33, 0x30, 0x31, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x2a, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x33, 0x31, 0x49, 0x30, 0x47, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x40, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x50, 0x53, 0x20, 0x49, 0x6e, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x62, 0x79, 0x20, 0x52, 0x65, 0x66, 0x2e, 0x20, 0x4c, 0x49, 0x41, 0x42, 0x49, 0x4c, 0x49, 0x54, 0x59, 0x20, 0x4c, 0x54, 0x44, 0x2e, 0x28, 0x63, 0x29, 0x39, 0x37, 0x20, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xd8, 0x82, 0x80, 0xe8, 0xd6, 0x19, 0x02, 0x7d, 0x1f, 0x85, 0x18, 0x39, 0x25, 0xa2, 0x65, 0x2b, 0xe1, 0xbf, 0xd4, 0x05, 0xd3, 0xbc, 0xe6, 0x36, 0x3b, 0xaa, 0xf0, 0x4c, 0x6c, 0x5b, 0xb6, 0xe7, 0xaa, 0x3c, 0x73, 0x45, 0x55, 0xb2, 0xf1, 0xbd, 0xea, 0x97, 0x42, 0xed, 0x9a, 0x34, 0x0a, 0x15, 0xd4, 0xa9, 0x5c, 0xf5, 0x40, 0x25, 0xdd, 0xd9, 0x07, 0xc1, 0x32, 0xb2, 0x75, 0x6c, 0xc4, 0xca, 0xbb, 0xa3, 0xfe, 0x56, 0x27, 0x71, 0x43, 0xaa, 0x63, 0xf5, 0x30, 0x3e, 0x93, 0x28, 0xe5, 0xfa, 0xf1, 0x09, 0x3b, 0xf3, 0xb7, 0x4d, 0x4e, 0x39, 0xf7, 0x5c, 0x49, 0x5a, 0xb8, 0xc1, 0x1d, 0xd3, 0xb2, 0x8a, 0xfe, 0x70, 0x30, 0x95, 0x42, 0xcb, 0xfe, 0x2b, 0x51, 0x8b, 0x5a, 0x3c, 0x3a, 0xf9, 0x22, 0x4f, 0x90, 0xb2, 0x02, 0xa7, 0x53, 0x9c, 0x4f, 0x34, 0xe7, 0xab, 0x04, 0xb2, 0x7b, 0x6f, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xe3, 0x30, 0x81, 0xe0, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x00, 0x30, 0x44, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x3d, 0x30, 0x3b, 0x30, 0x39, 0x06, 0x0b, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x45, 0x01, 0x07, 0x01, 0x01, 0x30, 0x2a, 0x30, 0x28, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1c, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x50, 0x53, 0x30, 0x34, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x2d, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x04, 0x01, 0x06, 0x0a, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x45, 0x01, 0x08, 0x01, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x11, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x01, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x31, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x2a, 0x30, 0x28, 0x30, 0x26, 0xa0, 0x24, 0xa0, 0x22, 0x86, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x63, 0x61, 0x33, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x40, 0x8e, 0x49, 0x97, 0x96, 0x8a, 0x73, 0xdd, 0x8e, 0x4d, 0xef, 0x3e, 0x61, 0xb7, 0xca, 0xa0, 0x62, 0xad, 0xf4, 0x0e, 0x0a, 0xbb, 0x75, 0x3d, 0xe2, 0x6e, 0xd8, 0x2c, 0xc7, 0xbf, 0xf4, 0xb9, 0x8c, 0x36, 0x9b, 0xca, 0xa2, 0xd0, 0x9c, 0x72, 0x46, 0x39, 0xf6, 0xa6, 0x82, 0x03, 0x65, 0x11, 0xc4, 0xbc, 0xbf, 0x2d, 0xa6, 0xf5, 0xd9, 0x3b, 0x0a, 0xb5, 0x98, 0xfa, 0xb3, 0x78, 0xb9, 0x1e, 0xf2, 0x2b, 0x4c, 0x62, 0xd5, 0xfd, 0xb2, 0x7a, 0x1d, 0xdf, 0x33, 0xfd, 0x73, 0xf9, 0xa5, 0xd8, 0x2d, 0x8c, 0x2a, 0xea, 0xd1, 0xfc, 0xb0, 0x28, 0xb6, 0xe9, 0x49, 0x48, 0x13, 0x4b, 0x83, 0x8a, 0x1b, 0x48, 0x7b, 0x24, 0xf7, 0x38, 0xde, 0x6f, 0x41, 0x54, 0xb8, 0xab, 0x57, 0x6b, 0x06, 0xdf, 0xc7, 0xa2, 0xd4, 0xa9, 0xf6, 0xf1, 0x36, 0x62, 0x80, 0x88, 0xf2, 0x8b, 0x75, 0xd6, 0x80, 0x75, 0x16, 0x03, 0x01, 0x00, 0x04, 0x0e, 0x00, 0x00, 0x00 }; uint32_t server_hello_certificate_done_len = sizeof(server_hello_certificate_done); uint8_t client_key_exchange_cipher_enc_hs[] = { 0x16, 0x03, 0x01, 0x00, 0x86, 0x10, 0x00, 0x00, 0x80, 0x00, 0x80, 0x14, 0x2b, 0x2f, 0x9f, 0x02, 0x1d, 0x4e, 0x0d, 0xa7, 0x41, 0x0f, 0x99, 0xc5, 0xe9, 0x49, 0x22, 0x14, 0xa0, 0x42, 0x7b, 0xb4, 0x6d, 0x4f, 0x82, 0x3c, 0x3a, 0x6e, 0xed, 0xd5, 0x6e, 0x72, 0x71, 0xae, 0x00, 0x4a, 0x9a, 0xc9, 0x0e, 0x2d, 0x08, 0xa2, 0xd3, 0x3a, 0xb0, 0xb2, 0x1a, 0x56, 0x01, 0x7c, 0x9a, 0xfa, 0xfb, 0x1a, 0xd7, 0x7e, 0x20, 0x68, 0x51, 0xd0, 0xfe, 0xd9, 0xdc, 0xa7, 0x0b, 0xeb, 0x1a, 0xb6, 0xd3, 0xc7, 0x17, 0x1f, 0xf3, 0x6e, 0x91, 0xdd, 0x06, 0x0d, 0x48, 0xde, 0xcd, 0x0c, 0x36, 0x8c, 0x83, 0x29, 0x9a, 0x40, 0x03, 0xcd, 0xf3, 0x1b, 0xdb, 0xd8, 0x44, 0x6b, 0x75, 0xf3, 0x5a, 0x9f, 0x26, 0x1a, 0xc4, 0x16, 0x35, 0x8f, 0xc1, 0x15, 0x19, 0xa9, 0xdf, 0x07, 0xa9, 0xe5, 0x56, 0x45, 0x6d, 0xca, 0x20, 0x3c, 0xcf, 0x8e, 0xbe, 0x44, 0x68, 0x73, 0xc8, 0x0b, 0xc7, 0x14, 0x03, 0x01, 0x00, 0x01, 0x01, 0x16, 0x03, 0x01, 0x00, 0x24, 0xf9, 0x7e, 0x28, 0x77, 0xa9, 0x9a, 0x08, 0x0c, 0x2e, 0xa9, 0x09, 0x15, 0x27, 0xcd, 0x93, 0x5f, 0xc0, 0x32, 0x0a, 0x8d, 0x62, 0xd3, 0x54, 0x79, 0x6b, 0x51, 0xd7, 0xba, 0x02, 0xd6, 0xdb, 0x66, 0xe8, 0x97, 0x5d, 0x7a }; uint32_t client_key_exchange_cipher_enc_hs_len = sizeof(client_key_exchange_cipher_enc_hs); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, client_hello_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SSLState *ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); FAIL_IF(ssl_state->client_connp.bytes_processed != 0); FAIL_IF(ssl_state->client_connp.hs_bytes_processed != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello_certificate_done, server_hello_certificate_done_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); FAIL_IF(ssl_state->client_connp.bytes_processed != 0); FAIL_IF(ssl_state->client_connp.hs_bytes_processed != 0); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_key_exchange_cipher_enc_hs, client_key_exchange_cipher_enc_hs_len); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* The reason hs_bytes_processed is 2 is because, the record * immediately after the client key exchange is 2 bytes long, * and next time we see a new handshake, it is after we have * seen a change cipher spec. Hence when we process the * handshake, we immediately break and don't parse the pdu from * where we left off, and leave the hs_bytes_processed var * isn't reset. */ FAIL_IF(ssl_state->client_connp.bytes_processed != 0); FAIL_IF(ssl_state->client_connp.hs_bytes_processed != 2); AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); PASS; } #endif /* UNITTESTS */ void SSLParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SSLParserTest01", SSLParserTest01); UtRegisterTest("SSLParserTest02", SSLParserTest02); UtRegisterTest("SSLParserTest03", SSLParserTest03); UtRegisterTest("SSLParserTest04", SSLParserTest04); /* Updated by Anoop Saldanha. Faulty tests. Disable it for now */ //UtRegisterTest("SSLParserTest05", SSLParserTest05, 1); //UtRegisterTest("SSLParserTest06", SSLParserTest06, 1); UtRegisterTest("SSLParserTest07", SSLParserTest07); //UtRegisterTest("SSLParserTest08", SSLParserTest08, 1); UtRegisterTest("SSLParserTest09", SSLParserTest09); UtRegisterTest("SSLParserTest10", SSLParserTest10); UtRegisterTest("SSLParserTest11", SSLParserTest11); UtRegisterTest("SSLParserTest12", SSLParserTest12); UtRegisterTest("SSLParserTest13", SSLParserTest13); UtRegisterTest("SSLParserTest14", SSLParserTest14); UtRegisterTest("SSLParserTest15", SSLParserTest15); UtRegisterTest("SSLParserTest16", SSLParserTest16); UtRegisterTest("SSLParserTest17", SSLParserTest17); UtRegisterTest("SSLParserTest18", SSLParserTest18); UtRegisterTest("SSLParserTest19", SSLParserTest19); UtRegisterTest("SSLParserTest20", SSLParserTest20); UtRegisterTest("SSLParserTest21", SSLParserTest21); UtRegisterTest("SSLParserTest22", SSLParserTest22); UtRegisterTest("SSLParserTest23", SSLParserTest23); UtRegisterTest("SSLParserTest24", SSLParserTest24); UtRegisterTest("SSLParserTest25", SSLParserTest25); UtRegisterTest("SSLParserMultimsgTest01", SSLParserMultimsgTest01); UtRegisterTest("SSLParserMultimsgTest02", SSLParserMultimsgTest02); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-decode-der.c0000644000000000000000000006510713051004444014124 00000000000000/* * Copyright (C) 2011-2015 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * */ /* * An ASN.1 Parser for DER-encoded structures. * This parser is not written to be complete or fast, but is rather * focused on stability and security. * It does not support all ASN.1 structure, only a meaningful subset * to decode x509v3 certificates (See RFC 3280). * * References (like 8.19.4) are relative to the ISO/IEC 8825-1:2003 document * */ #include "suricata-common.h" #include "util-decode-der.h" #define MAX_OID_LENGTH 256 static Asn1Generic * DecodeAsn1DerBitstring(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerBoolean(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerIA5String(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerInteger(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerNull(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerOctetString(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerUTF8String(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerOid(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerPrintableString(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerSequence(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerSet(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerT61String(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerUTCTime(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * DecodeAsn1DerGeneralizedTime(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode); static Asn1Generic * Asn1GenericNew(void) { Asn1Generic *obj; obj = SCMalloc(sizeof(Asn1Generic)); if (obj != NULL) memset(obj, 0, sizeof(Asn1Generic)); return obj; } /** * \retval r 0 ok, -1 error */ static int Asn1SequenceAppend(Asn1Generic *seq, Asn1Generic *node) { Asn1Generic *it, *new_container; if (seq->data == NULL) { seq->data = node; return 0; } new_container = Asn1GenericNew(); if (new_container == NULL) return -1; new_container->data = node; for (it=seq; it->next != NULL; it=it->next) ; it->next = new_container; return 0; } static Asn1Generic * DecodeAsn1DerGeneric(const unsigned char *buffer, uint32_t max_size, uint8_t depth, int seq_index, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t numbytes, el_max_size; Asn1ElementType el; uint8_t c; uint32_t i; Asn1Generic *child; uint8_t el_type; el.cls = (d_ptr[0] & 0xc0) >> 6; el.pc = (d_ptr[0] & 0x20) >> 5; el.tag = (d_ptr[0] & 0x1f); el_type = el.tag; if (el.tag == 0x1f) return NULL; switch (el.cls) { case ASN1_CLASS_CONTEXTSPEC: /* get element type from definition, see: http://www.ietf.org/rfc/rfc3280.txt */ if (depth == 2 && el.tag == 0) { /* TBSCertificate */ el_type = ASN1_SEQUENCE; break; } if (depth == 2 && el.tag == 1) { /* issuerUniqueID */ el_type = ASN1_BITSTRING; break; } if (depth == 2 && el.tag == 2) { /* subjectUniqueID */ el_type = ASN1_BITSTRING; break; } if (depth == 2 && el.tag == 3) { /* extensions */ el_type = ASN1_SEQUENCE; break; } /* unknown context specific value - do not decode */ break; }; el_max_size = max_size - (d_ptr-buffer); switch (el_type) { case ASN1_INTEGER: child = DecodeAsn1DerInteger(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_BOOLEAN: child = DecodeAsn1DerBoolean(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_NULL: child = DecodeAsn1DerNull(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_BITSTRING: child = DecodeAsn1DerBitstring(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_OID: child = DecodeAsn1DerOid(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_IA5STRING: child = DecodeAsn1DerIA5String(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_OCTETSTRING: child = DecodeAsn1DerOctetString(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_UTF8STRING: child = DecodeAsn1DerUTF8String(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_PRINTSTRING: child = DecodeAsn1DerPrintableString(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_SEQUENCE: child = DecodeAsn1DerSequence(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_SET: child = DecodeAsn1DerSet(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_T61STRING: child = DecodeAsn1DerT61String(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_UTCTIME: child = DecodeAsn1DerUTCTime(d_ptr, el_max_size, depth+1, errcode); break; case ASN1_GENERALIZEDTIME: child = DecodeAsn1DerGeneralizedTime(d_ptr, el_max_size, depth+1, errcode); break; default: /* unknown ASN.1 type */ child = NULL; child = Asn1GenericNew(); if (child == NULL) break; child->type = el.tag; /* total sequence length */ const unsigned char * save_d_ptr = d_ptr; d_ptr++; c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { child->length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; if (numbytes > el_max_size) { SCFree(child); if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; return NULL; } child->length = 0; d_ptr++; for (i=0; ilength = child->length<<8 | d_ptr[0]; d_ptr++; } } /* fix the length for unknown objects, else sequence parsing will fail */ child->length += (d_ptr - save_d_ptr); if (child->length > max_size - (d_ptr - buffer)) { SCFree(child); return NULL; } break; }; if (child == NULL) return NULL; /* child length should never be zero */ if (child->length == 0) { SCFree(child); return NULL; } child->header = el; return child; } static Asn1Generic * DecodeAsn1DerInteger(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint8_t numbytes; uint32_t value; uint32_t i; Asn1Generic *a; numbytes = d_ptr[1]; if (numbytes > size) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; return NULL; } d_ptr += 2; value = 0; /* Here we need to ensure that numbytes is less than 4 so integer affectation is possible. We set the value to 0xffffffff which is by convention the unknown value. In this case, the hexadecimal value must be used. */ if (numbytes > 4) { value = 0xffffffff; } else { for (i=0; itype = ASN1_INTEGER; a->length = (d_ptr - buffer) + numbytes; a->value = value; a->str = SCMalloc(2*numbytes + 1); if (a->str == NULL) { SCFree(a); return NULL; } for (i=0; istr + 2*i, 2*(numbytes-i)+1, "%02X", d_ptr[i]); } a->str[2*numbytes]= '\0'; return a; } static int DecodeAsn1BuildValue(const unsigned char **d_ptr, uint32_t *val, uint8_t numbytes, uint32_t *errcode) { int i; uint32_t value = 0; if (numbytes > 4) { if (errcode) *errcode = ERR_DER_INVALID_SIZE; /* too big won't fit: set it to 0xffffffff by convention */ value = 0xffffffff; *val = value; return -1; } else { for (i=0; itype = ASN1_BOOLEAN; a->length = (d_ptr - buffer); a->value = value; return a; } static Asn1Generic * DecodeAsn1DerNull(const unsigned char *buffer, uint32_t size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint8_t numbytes; uint32_t value; Asn1Generic *a; numbytes = d_ptr[1]; d_ptr += 2; if (DecodeAsn1BuildValue(&d_ptr, &value, numbytes, errcode) == -1) { return NULL; } a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_NULL; a->length = (d_ptr - buffer); a->value = 0; return a; } static Asn1Generic * DecodeAsn1DerBitstring(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t length; uint8_t numbytes, c; Asn1Generic *a; d_ptr++; /* size */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &length, numbytes, errcode) == -1) { return NULL; } } if (length > max_size) return NULL; a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_BITSTRING; a->strlen = length; a->str = SCMalloc(length); if (a->str == NULL) { SCFree(a); return NULL; } memcpy(a->str, (const char*)d_ptr, length); d_ptr += length; a->length = (d_ptr - buffer); return a; } static Asn1Generic * DecodeAsn1DerOid(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t oid_length, oid_value; uint8_t numbytes, c; Asn1Generic *a; uint32_t i; d_ptr++; /* size */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { oid_length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &oid_length, numbytes, errcode) == -1) { return NULL; } } if (oid_length > max_size) return NULL; a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_OID; a->str = SCMalloc(MAX_OID_LENGTH); if (a->str == NULL) { SCFree(a); return NULL; } /* first element = X*40 + Y (See 8.19.4) */ snprintf(a->str, MAX_OID_LENGTH, "%d.%d", (d_ptr[0]/40), (d_ptr[0]%40)); d_ptr++; /* sub-identifiers are multi-valued, coded and 7 bits, first bit of the 8bits is used to indicate, if a new value is starting */ for (i=1; istr); c = d_ptr[0]; oid_value = 0; while ( istr + s, MAX_OID_LENGTH - s, ".%d", oid_value); } a->length = (d_ptr - buffer); return a; } static Asn1Generic * DecodeAsn1DerIA5String(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t length, numbytes; Asn1Generic *a; unsigned char c; d_ptr++; /* total sequence length */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &length, numbytes, errcode) == -1) { return NULL; } } if (length == UINT32_MAX || length > max_size) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; return NULL; } a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_IA5STRING; a->strlen = length; a->str = SCMalloc(length+1); if (a->str == NULL) { SCFree(a); return NULL; } memcpy(a->str, (const char*)d_ptr, length); a->str[length] = 0; d_ptr += length; a->length = (d_ptr - buffer); return a; } static Asn1Generic * DecodeAsn1DerOctetString(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t length, numbytes; Asn1Generic *a; unsigned char c; d_ptr++; /* total sequence length */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &length, numbytes, errcode) == -1) { return NULL; } } if (length == UINT32_MAX || length > max_size) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; return NULL; } a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_OCTETSTRING; a->strlen = length; /* add one to the octet string for the 0. This will then allow us to use the string in printf */ a->str = SCMalloc(length + 1); if (a->str == NULL) { SCFree(a); return NULL; } memcpy(a->str, (const char*)d_ptr, length); a->str[length] = 0; d_ptr += length; a->length = (d_ptr - buffer); return a; } static Asn1Generic * DecodeAsn1DerUTF8String(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { Asn1Generic *a = DecodeAsn1DerOctetString(buffer, max_size, depth, errcode); if (a != NULL) a->type = ASN1_UTF8STRING; return a; } static Asn1Generic * DecodeAsn1DerPrintableString(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t length, numbytes; Asn1Generic *a; unsigned char c; d_ptr++; /* total sequence length */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &length, numbytes, errcode) == -1) { return NULL; } } if (length == UINT32_MAX || length > max_size) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; return NULL; } a = Asn1GenericNew(); if (a == NULL) return NULL; a->type = ASN1_PRINTSTRING; a->strlen = length; a->str = SCMalloc(length+1); if (a->str == NULL) { SCFree(a); return NULL; } memcpy(a->str, (const char*)d_ptr, length); a->str[length] = 0; d_ptr += length; a->length = (d_ptr - buffer); return a; } static Asn1Generic * DecodeAsn1DerSequence(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t d_length, parsed_bytes, numbytes, el_max_size; uint8_t c; uint32_t seq_index; Asn1Generic *node; d_ptr++; node = Asn1GenericNew(); if (node == NULL) return NULL; node->type = ASN1_SEQUENCE; /* total sequence length */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { d_length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &d_length, numbytes, errcode) == -1) { SCFree(node); return NULL; } } node->length = d_length + (d_ptr - buffer); if (node->length > max_size || node->length < d_length /* wrap */) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; SCFree(node); return NULL; } parsed_bytes = 0; seq_index = 0; /* decode child elements */ while (parsed_bytes < d_length) { el_max_size = max_size - (d_ptr-buffer); Asn1Generic *child = DecodeAsn1DerGeneric(d_ptr, el_max_size, depth, seq_index, errcode); if (child == NULL) { if (errcode && *errcode != 0) { DerFree(node); return NULL; } break; } int ret = Asn1SequenceAppend(node, child); if (ret == -1) { DerFree(child); break; } parsed_bytes += child->length; d_ptr += child->length; seq_index++; } return (Asn1Generic *)node; } static Asn1Generic * DecodeAsn1DerSet(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t d_length, numbytes, el_max_size; uint8_t c; uint32_t seq_index; Asn1Generic *node; Asn1Generic *child; d_ptr++; node = Asn1GenericNew(); if (node == NULL) return NULL; node->type = ASN1_SET; node->data = NULL; /* total sequence length */ c = d_ptr[0]; /* short form 8.1.3.4 */ if ((c & (1<<7))>>7 == 0) { d_length = c; d_ptr++; /* long form 8.1.3.5 */ } else { numbytes = c & 0x7f; d_ptr++; if (DecodeAsn1BuildValue(&d_ptr, &d_length, numbytes, errcode) == -1) { SCFree(node); return NULL; } } node->length = d_length + (d_ptr - buffer); if (node->length > max_size || node->length < d_length /* wrap */) { if (errcode) *errcode = ERR_DER_ELEMENT_SIZE_TOO_BIG; SCFree(node); return NULL; } seq_index = 0; el_max_size = max_size - (d_ptr-buffer); child = DecodeAsn1DerGeneric(d_ptr, el_max_size, depth, seq_index, errcode); if (child == NULL) { DerFree(node); return NULL; } node->data = child; return (Asn1Generic *)node; } static Asn1Generic * DecodeAsn1DerT61String(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { Asn1Generic *a; a = DecodeAsn1DerIA5String(buffer, max_size, depth, errcode); if (a != NULL) a->type = ASN1_T61STRING; return a; } static Asn1Generic * DecodeAsn1DerUTCTime(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { Asn1Generic *a; a = DecodeAsn1DerIA5String(buffer, max_size, depth, errcode); if (a != NULL) a->type = ASN1_UTCTIME; return a; } static Asn1Generic * DecodeAsn1DerGeneralizedTime(const unsigned char *buffer, uint32_t max_size, uint8_t depth, uint32_t *errcode) { Asn1Generic *a; a = DecodeAsn1DerIA5String(buffer, max_size, depth, errcode); if (a != NULL) a->type = ASN1_GENERALIZEDTIME; return a; } Asn1Generic * DecodeDer(const unsigned char *buffer, uint32_t size, uint32_t *errcode) { const unsigned char *d_ptr = buffer; uint32_t d_length, numbytes; Asn1Generic *cert; uint8_t c; if (size < 2) return NULL; /* check that buffer is an ASN.1 structure (basic checks) */ if (d_ptr[0] != 0x30 && d_ptr[1] != 0x82) /* Sequence */ return NULL; c = d_ptr[1]; if ((c & (1<<7))>>7 != 1) return NULL; numbytes = c & 0x7f; d_ptr += 2; if (DecodeAsn1BuildValue(&d_ptr, &d_length, numbytes, errcode) == -1) { return NULL; } if (d_length+(d_ptr-buffer) != size) return NULL; if (errcode) *errcode = 0; cert = DecodeAsn1DerGeneric(buffer, size, 0 /* depth */, 0, errcode); return cert; } #ifdef AFLFUZZ_DER int DerParseDataFromFile(char *filename) { uint8_t buffer[65536]; uint32_t errcode = 0; #ifdef AFLFUZZ_PERSISTANT_MODE while (__AFL_LOOP(1000)) { /* reset state */ memset(buffer, 0, sizeof(buffer)); #endif /* AFLFUZZ_PERSISTANT_MODE */ FILE *fp = fopen(filename, "r"); BUG_ON(fp == NULL); size_t result = fread(&buffer, 1, sizeof(buffer), fp); DecodeDer(buffer, result, &errcode); fclose(fp); #ifdef AFLFUZZ_PERSISTANT_MODE } #endif /* AFLFUZZ_PERSISTANT_MODE */ return 0; } #endif /* AFLFUZZ_DER */ void DerFree(Asn1Generic *a) { Asn1Generic *it, *n; if (a == NULL) return; it = a; while (it) { n = it->next; if (it->data) { DerFree(it->data); } if (it->str) SCFree(it->str); memset(it, 0xff, sizeof(Asn1Generic)); SCFree(it); it = n; } } suricata-3.2.1/src/detect-engine-uri.h0000644000000000000000000000261313051004444014464 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien * \author Pablo Rincon Crespo */ #ifndef __DETECT_ENGINE_URICONTENT_H__ #define __DETECT_ENGINE_URICONTENT_H__ int PrefilterTxUriRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpUri(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void UriRegisterTests(void); #endif /* __DETECT_ENGINE_URICONTENT_H__ */ suricata-3.2.1/src/util-spm-hs.h0000644000000000000000000000170213051004444013334 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Justin Viiret * * Single pattern matcher that uses the Hyperscan regex matcher. */ #ifndef __UTIL_SPM_HS_H__ #define __UTIL_SPM_HS_H__ void SpmHSRegister(void); #endif /* __UTIL_SPM_HS_H__ */ suricata-3.2.1/src/tm-threads.h0000644000000000000000000001727613051004444013237 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __TM_THREADS_H__ #define __TM_THREADS_H__ #include "tmqh-packetpool.h" #include "tm-threads-common.h" #include "tm-modules.h" #define TM_QUEUE_NAME_MAX 16 #define TM_THREAD_NAME_MAX 16 typedef TmEcode (*TmSlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); typedef struct TmSlot_ { /* the TV holding this slot */ ThreadVars *tv; /* function pointers */ SC_ATOMIC_DECLARE(TmSlotFunc, SlotFunc); TmEcode (*PktAcqLoop)(ThreadVars *, void *, void *); TmEcode (*SlotThreadInit)(ThreadVars *, void *, void **); void (*SlotThreadExitPrintStats)(ThreadVars *, void *); TmEcode (*SlotThreadDeinit)(ThreadVars *, void *); /* data storage */ void *slot_initdata; SC_ATOMIC_DECLARE(void *, slot_data); /* queue filled by the SlotFunc with packets that will * be processed futher _before_ the current packet. * The locks in the queue are NOT used */ PacketQueue slot_pre_pq; /* queue filled by the SlotFunc with packets that will * be processed futher _after_ the current packet. The * locks in the queue are NOT used */ PacketQueue slot_post_pq; /* store the thread module id */ int tm_id; /* slot id, only used my TmVarSlot to know what the first slot is */ int id; /* linked list, only used when you have multiple slots(used by TmVarSlot) */ struct TmSlot_ *slot_next; /* just called once, so not perf critical */ TmEcode (*Management)(ThreadVars *, void *); } TmSlot; extern ThreadVars *tv_root[TVT_MAX]; extern SCMutex tv_root_lock; void TmSlotSetFuncAppend(ThreadVars *, TmModule *, void *); void TmSlotSetFuncAppendDelayed(ThreadVars *, TmModule *, void *, int delayed); TmSlot *TmSlotGetSlotForTM(int); ThreadVars *TmThreadCreate(const char *, char *, char *, char *, char *, char *, void *(fn_p)(void *), int); ThreadVars *TmThreadCreatePacketHandler(const char *, char *, char *, char *, char *, char *); ThreadVars *TmThreadCreateMgmtThread(const char *name, void *(fn_p)(void *), int); ThreadVars *TmThreadCreateMgmtThreadByName(const char *name, char *module, int mucond); ThreadVars *TmThreadCreateCmdThreadByName(const char *name, char *module, int mucond); TmEcode TmThreadSpawn(ThreadVars *); void TmThreadSetFlags(ThreadVars *, uint8_t); void TmThreadKillThread(ThreadVars *); void TmThreadKillThreadsFamily(int family); void TmThreadKillThreads(void); void TmThreadClearThreadsFamily(int family); void TmThreadAppend(ThreadVars *, int); void TmThreadRemove(ThreadVars *, int); void TmThreadSetGroupName(ThreadVars *tv, const char *name); TmEcode TmThreadSetCPUAffinity(ThreadVars *, uint16_t); TmEcode TmThreadSetThreadPriority(ThreadVars *, int); TmEcode TmThreadSetCPU(ThreadVars *, uint8_t); TmEcode TmThreadSetupOptions(ThreadVars *); void TmThreadSetPrio(ThreadVars *); int TmThreadGetNbThreads(uint8_t type); void TmThreadInitMC(ThreadVars *); void TmThreadTestThreadUnPaused(ThreadVars *); void TmThreadContinue(ThreadVars *); void TmThreadContinueThreads(void); void TmThreadPause(ThreadVars *); void TmThreadPauseThreads(void); void TmThreadCheckThreadState(void); TmEcode TmThreadWaitOnThreadInit(void); ThreadVars *TmThreadsGetCallingThread(void); int TmThreadsCheckFlag(ThreadVars *, uint16_t); void TmThreadsSetFlag(ThreadVars *, uint16_t); void TmThreadsUnsetFlag(ThreadVars *, uint16_t); void TmThreadWaitForFlag(ThreadVars *, uint16_t); TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot); ThreadVars *TmThreadsGetTVContainingSlot(TmSlot *); void TmThreadDisablePacketThreads(void); void TmThreadDisableReceiveThreads(void); TmSlot *TmThreadGetFirstTmSlotForPartialPattern(const char *); uint32_t TmThreadCountThreadsByTmmFlags(uint8_t flags); /** * \brief Process the rest of the functions (if any) and queue. */ static inline TmEcode TmThreadsSlotProcessPkt(ThreadVars *tv, TmSlot *s, Packet *p) { TmEcode r = TM_ECODE_OK; if (s == NULL) { tv->tmqh_out(tv, p); return r; } if (TmThreadsSlotVarRun(tv, p, s) == TM_ECODE_FAILED) { TmqhOutputPacketpool(tv, p); TmSlot *slot = s; while (slot != NULL) { SCMutexLock(&slot->slot_post_pq.mutex_q); TmqhReleasePacketsToPacketPool(&slot->slot_post_pq); SCMutexUnlock(&slot->slot_post_pq.mutex_q); slot = slot->slot_next; } TmThreadsSetFlag(tv, THV_FAILED); r = TM_ECODE_FAILED; } else { tv->tmqh_out(tv, p); /* post process pq */ TmSlot *slot = s; while (slot != NULL) { if (slot->slot_post_pq.top != NULL) { while (1) { SCMutexLock(&slot->slot_post_pq.mutex_q); Packet *extra_p = PacketDequeue(&slot->slot_post_pq); SCMutexUnlock(&slot->slot_post_pq.mutex_q); if (extra_p == NULL) break; if (slot->slot_next != NULL) { r = TmThreadsSlotVarRun(tv, extra_p, slot->slot_next); if (r == TM_ECODE_FAILED) { SCMutexLock(&slot->slot_post_pq.mutex_q); TmqhReleasePacketsToPacketPool(&slot->slot_post_pq); SCMutexUnlock(&slot->slot_post_pq.mutex_q); TmqhOutputPacketpool(tv, extra_p); TmThreadsSetFlag(tv, THV_FAILED); break; } } tv->tmqh_out(tv, extra_p); } } /* if (slot->slot_post_pq.top != NULL) */ slot = slot->slot_next; } /* while (slot != NULL) */ } return r; } /** \brief inject packet if THV_CAPTURE_INJECT_PKT is set * Allow caller to supply their own packet * * Meant for detect reload process that interupts an sleeping capture thread * to force a packet through the engine to complete a reload */ static inline void TmThreadsCaptureInjectPacket(ThreadVars *tv, TmSlot *slot, Packet *p) { if (TmThreadsCheckFlag(tv, THV_CAPTURE_INJECT_PKT)) { TmThreadsUnsetFlag(tv, THV_CAPTURE_INJECT_PKT); if (p == NULL) p = PacketGetFromQueueOrAlloc(); if (p != NULL) { p->flags |= PKT_PSEUDO_STREAM_END; if (TmThreadsSlotProcessPkt(tv, slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(tv, p); } } } } void TmThreadsListThreads(void); int TmThreadsRegisterThread(ThreadVars *tv, const int type); void TmThreadsUnregisterThread(const int id); int TmThreadsInjectPacketsById(Packet **, int id); void TmThreadsSetThreadTimestamp(const int id, const struct timeval *ts); void TmreadsGetMinimalTimestamp(struct timeval *ts); #endif /* __TM_THREADS_H__ */ suricata-3.2.1/src/util-lua.c0000644000000000000000000002141013051004444012677 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Common function for Lua */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" lua_State *LuaGetState(void) { lua_State *s = NULL; #ifdef HAVE_LUAJIT s = LuajitGetState(); #else s = luaL_newstate(); #endif return s; } void LuaReturnState(lua_State *s) { if (s != NULL) { #ifdef HAVE_LUAJIT LuajitReturnState(s); #else lua_close(s); #endif } } /* key for tv (threadvars) pointer */ const char lua_ext_key_tv[] = "suricata:lua:tv:ptr"; /* key for tx pointer */ const char lua_ext_key_tx[] = "suricata:lua:tx:ptr"; /* key for p (packet) pointer */ const char lua_ext_key_p[] = "suricata:lua:pkt:ptr"; /* key for f (flow) pointer */ const char lua_ext_key_flow[] = "suricata:lua:flow:ptr"; /* key for flow lock hint bool */ const char lua_ext_key_flow_lock_hint[] = "suricata:lua:flow:lock_hint"; /* key for direction */ const char lua_ext_key_direction[] = "suricata:lua:direction"; /* key for pa (packet alert) pointer */ const char lua_ext_key_pa[] = "suricata:lua:pkt:alert:ptr"; /* key for file pointer */ const char lua_ext_key_file[] = "suricata:lua:file:ptr"; /* key for streaming buffer pointer */ const char lua_ext_key_streaming_buffer[] = "suricata:lua:streaming_buffer:ptr"; /** \brief get tv pointer from the lua state */ ThreadVars *LuaStateGetThreadVars(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tv); lua_gettable(luastate, LUA_REGISTRYINDEX); void *tv = lua_touserdata(luastate, -1); return (ThreadVars *)tv; } void LuaStateSetThreadVars(lua_State *luastate, ThreadVars *tv) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tv); lua_pushlightuserdata(luastate, (void *)tv); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief get packet pointer from the lua state */ Packet *LuaStateGetPacket(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_p); lua_gettable(luastate, LUA_REGISTRYINDEX); void *p = lua_touserdata(luastate, -1); return (Packet *)p; } void LuaStateSetPacket(lua_State *luastate, Packet *p) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_p); lua_pushlightuserdata(luastate, (void *)p); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief get tx pointer from the lua state */ void *LuaStateGetTX(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tx); lua_gettable(luastate, LUA_REGISTRYINDEX); void *tx = lua_touserdata(luastate, -1); return tx; } void LuaStateSetTX(lua_State *luastate, void *txptr) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tx); lua_pushlightuserdata(luastate, (void *)txptr); lua_settable(luastate, LUA_REGISTRYINDEX); } Flow *LuaStateGetFlow(lua_State *luastate) { Flow *f = NULL; lua_pushlightuserdata(luastate, (void *)&lua_ext_key_flow); lua_gettable(luastate, LUA_REGISTRYINDEX); f = lua_touserdata(luastate, -1); /* need flow lock hint */ lua_pushlightuserdata(luastate, (void *)&lua_ext_key_flow_lock_hint); lua_gettable(luastate, LUA_REGISTRYINDEX); return f; } void LuaStateSetFlow(lua_State *luastate, Flow *f) { /* flow */ lua_pushlightuserdata(luastate, (void *)&lua_ext_key_flow); lua_pushlightuserdata(luastate, (void *)f); lua_settable(luastate, LUA_REGISTRYINDEX); /* flow lock status hint */ lua_pushlightuserdata(luastate, (void *)&lua_ext_key_flow_lock_hint); /* locking is not required, set to 0 for backwards compatibility */ lua_pushboolean(luastate, 0); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief get packet alert pointer from the lua state */ PacketAlert *LuaStateGetPacketAlert(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_pa); lua_gettable(luastate, LUA_REGISTRYINDEX); void *pa = lua_touserdata(luastate, -1); return (PacketAlert *)pa; } void LuaStateSetPacketAlert(lua_State *luastate, PacketAlert *pa) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_pa); lua_pushlightuserdata(luastate, (void *)pa); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief get file pointer from the lua state */ File *LuaStateGetFile(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_file); lua_gettable(luastate, LUA_REGISTRYINDEX); void *file = lua_touserdata(luastate, -1); return (File *)file; } void LuaStateSetFile(lua_State *luastate, File *file) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_file); lua_pushlightuserdata(luastate, (void *)file); lua_settable(luastate, LUA_REGISTRYINDEX); } LuaStreamingBuffer *LuaStateGetStreamingBuffer(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_streaming_buffer); lua_gettable(luastate, LUA_REGISTRYINDEX); void *b = lua_touserdata(luastate, -1); return (LuaStreamingBuffer *)b; } void LuaStateSetStreamingBuffer(lua_State *luastate, LuaStreamingBuffer *b) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_streaming_buffer); lua_pushlightuserdata(luastate, (void *)b); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief get packet pointer from the lua state */ int LuaStateGetDirection(lua_State *luastate) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_direction); lua_gettable(luastate, LUA_REGISTRYINDEX); int dir = lua_toboolean(luastate, -1); return dir; } void LuaStateSetDirection(lua_State *luastate, int direction) { lua_pushlightuserdata(luastate, (void *)&lua_ext_key_direction); lua_pushboolean(luastate, direction); lua_settable(luastate, LUA_REGISTRYINDEX); } /** \brief dump stack from lua state to screen */ void LuaPrintStack(lua_State *state) { int size = lua_gettop(state); int i; for (i = 1; i <= size; i++) { int type = lua_type(state, i); printf("Stack size=%d, level=%d, type=%d, ", size, i, type); switch (type) { case LUA_TFUNCTION: printf("function %s", lua_tostring(state, i) ? "true" : "false"); break; case LUA_TBOOLEAN: printf("bool %s", lua_toboolean(state, i) ? "true" : "false"); break; case LUA_TNUMBER: printf("number %g", lua_tonumber(state, i)); break; case LUA_TSTRING: printf("string `%s'", lua_tostring(state, i)); break; case LUA_TTABLE: printf("table `%s'", lua_tostring(state, i)); break; default: printf("other %s", lua_typename(state, type)); break; } printf("\n"); } } int LuaPushStringBuffer(lua_State *luastate, const uint8_t *input, size_t input_len) { if (input_len % 4 != 0) { /* we're using a buffer sized at a multiple of 4 as lua_pushlstring generates * invalid read errors in valgrind otherwise. Adding in a nul to be sure. * * Buffer size = len + 1 (for nul) + whatever makes it a multiple of 4 */ size_t buflen = input_len + 1 + ((input_len + 1) % 4); uint8_t buf[buflen]; memset(buf, 0x00, buflen); memcpy(buf, input, input_len); buf[input_len] = '\0'; /* return value through luastate, as a luastring */ lua_pushlstring(luastate, (char *)buf, input_len); } else { lua_pushlstring(luastate, (char *)input, input_len); } return 1; } int LuaPushInteger(lua_State *luastate, lua_Integer n) { lua_pushinteger(luastate, n); return 1; } #endif /* HAVE_LUA */ suricata-3.2.1/src/detect-id.c0000644000000000000000000002627113051004444013017 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Implements the id keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-prefilter-common.h" #include "detect-id.h" #include "flow.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" /** * \brief Regex for parsing "id" option, matching number or "number" */ #define PARSE_REGEX "^\\s*([0-9]{1,5}|\"[0-9]{1,5}\")\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIdMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIdSetup (DetectEngineCtx *, Signature *, char *); void DetectIdRegisterTests(void); void DetectIdFree(void *); static int PrefilterSetupId(SigGroupHead *sgh); static _Bool PrefilterIdIsPrefilterable(const Signature *s); /** * \brief Registration function for keyword: id */ void DetectIdRegister (void) { sigmatch_table[DETECT_ID].name = "id"; sigmatch_table[DETECT_ID].desc = "match on a specific IP ID value"; sigmatch_table[DETECT_ID].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#id"; sigmatch_table[DETECT_ID].Match = DetectIdMatch; sigmatch_table[DETECT_ID].Setup = DetectIdSetup; sigmatch_table[DETECT_ID].Free = DetectIdFree; sigmatch_table[DETECT_ID].RegisterTests = DetectIdRegisterTests; sigmatch_table[DETECT_ID].SupportsPrefilter = PrefilterIdIsPrefilterable; sigmatch_table[DETECT_ID].SetupPrefilter = PrefilterSetupId; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to match the specified id on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectIdData * * \retval 0 no match * \retval 1 match */ int DetectIdMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectIdData *id_d = (const DetectIdData *)ctx; /** * To match a ipv4 packet with a "id" rule */ if (!PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) { return 0; } if (id_d->id == IPV4_GET_IPID(p)) { SCLogDebug("IPV4 Proto and matched with ip_id: %u.\n", id_d->id); return 1; } return 0; } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectIdData on success * \retval NULL on failure */ DetectIdData *DetectIdParse (char *idstr) { uint32_t temp; DetectIdData *id_d = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, idstr, strlen(idstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid id option. The id option value must be" " in the range %u - %u", DETECT_IPID_MIN, DETECT_IPID_MAX); goto error; } if (ret > 1) { char copy_str[128] = ""; char *tmp_str; res = pcre_copy_substring((char *)idstr, ov, MAX_SUBSTRINGS, 1, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } tmp_str = copy_str; /* Let's see if we need to scape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } /* ok, fill the id data */ temp = atoi((char *)tmp_str); if (temp > DETECT_IPID_MAX) { SCLogError(SC_ERR_INVALID_VALUE, "\"id\" option must be in " "the range %u - %u", DETECT_IPID_MIN, DETECT_IPID_MAX); goto error; } /* We have a correct id option */ id_d = SCMalloc(sizeof(DetectIdData)); if (unlikely(id_d == NULL)) goto error; id_d->id = temp; SCLogDebug("detect-id: will look for ip_id: %u\n", id_d->id); } return id_d; error: if (id_d != NULL) DetectIdFree(id_d); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ int DetectIdSetup (DetectEngineCtx *de_ctx, Signature *s, char *idstr) { DetectIdData *id_d = NULL; SigMatch *sm = NULL; id_d = DetectIdParse(idstr); if (id_d == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ID; sm->ctx = (SigMatchCtx *)id_d; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (id_d != NULL) DetectIdFree(id_d); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectIdData * * \param id_d pointer to DetectIdData */ void DetectIdFree(void *ptr) { DetectIdData *id_d = (DetectIdData *)ptr; SCFree(id_d); } /* prefilter code */ static void PrefilterPacketIdMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (!PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) { return; } if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; if (IPV4_GET_IPID(p) == ctx->v1.u16[0]) { SCLogDebug("packet matches IP id %u", ctx->v1.u16[0]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketIdSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectIdData *a = smctx; v->u16[0] = a->id; } static _Bool PrefilterPacketIdCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectIdData *a = smctx; if (v.u16[0] == a->id) return TRUE; return FALSE; } static int PrefilterSetupId(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_ID, PrefilterPacketIdSet, PrefilterPacketIdCompare, PrefilterPacketIdMatch); } static _Bool PrefilterIdIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ID: return TRUE; } } return FALSE; } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectIdTestParse01 is a test to make sure that we parse the "id" * option correctly when given valid id option */ int DetectIdTestParse01 (void) { DetectIdData *id_d = NULL; id_d = DetectIdParse(" 35402 "); if (id_d != NULL &&id_d->id==35402) { DetectIdFree(id_d); return 1; } return 0; } /** * \test DetectIdTestParse02 is a test to make sure that we parse the "id" * option correctly when given an invalid id option * it should return id_d = NULL */ int DetectIdTestParse02 (void) { DetectIdData *id_d = NULL; id_d = DetectIdParse("65537"); if (id_d == NULL) { DetectIdFree(id_d); return 1; } return 0; } /** * \test DetectIdTestParse03 is a test to make sure that we parse the "id" * option correctly when given an invalid id option * it should return id_d = NULL */ int DetectIdTestParse03 (void) { DetectIdData *id_d = NULL; id_d = DetectIdParse("12what?"); if (id_d == NULL) { DetectIdFree(id_d); return 1; } return 0; } /** * \test DetectIdTestParse04 is a test to make sure that we parse the "id" * option correctly when given valid id option but wrapped with "'s */ int DetectIdTestParse04 (void) { DetectIdData *id_d = NULL; /* yep, look if we trim blank spaces correctly and ignore "'s */ id_d = DetectIdParse(" \"35402\" "); if (id_d != NULL &&id_d->id==35402) { DetectIdFree(id_d); return 1; } return 0; } /** * \test DetectIdTestSig01 * \brief Test to check "id" keyword with constructed packets */ int DetectIdTestMatch01(void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_UDP); p[2] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_ICMP); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; /* TCP IP id = 1234 */ p[0]->ip4h->ip_id = htons(1234); /* UDP IP id = 5678 */ p[1]->ip4h->ip_id = htons(5678); /* UDP IP id = 91011 */ p[2]->ip4h->ip_id = htons(5101); char *sigs[3]; sigs[0]= "alert ip any any -> any any (msg:\"Testing id 1\"; id:1234; sid:1;)"; sigs[1]= "alert ip any any -> any any (msg:\"Testing id 2\"; id:5678; sid:2;)"; sigs[2]= "alert ip any any -> any any (msg:\"Testing id 3\"; id:5101; sid:3;)"; uint32_t sid[3] = {1, 2, 3}; uint32_t results[3][3] = { /* packet 0 match sid 1 but should not match sid 2 */ {1, 0, 0}, /* packet 1 should not match */ {0, 1, 0}, /* packet 2 should not match */ {0, 0, 1} }; result = UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 3); UTHFreePackets(p, 3); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectId */ void DetectIdRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectIdTestParse01", DetectIdTestParse01); UtRegisterTest("DetectIdTestParse02", DetectIdTestParse02); UtRegisterTest("DetectIdTestParse03", DetectIdTestParse03); UtRegisterTest("DetectIdTestParse04", DetectIdTestParse04); UtRegisterTest("DetectIdTestMatch01", DetectIdTestMatch01); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-crypt.h0000644000000000000000000000562713051004444013300 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Roliers Jean-Paul * * Implements cryptographic functions. * Based on the libtomcrypt library ( http://libtom.org/?page=features&newsitems=5&whatfile=crypt ) */ #ifndef UTIL_CRYPT_H_ #define UTIL_CRYPT_H_ #include "suricata-common.h" typedef enum { SC_SHA_1_OK, SC_SHA_1_NOK, SC_SHA_1_INVALID_ARG, SC_BASE64_OK, SC_BASE64_INVALID_ARG, SC_BASE64_OVERFLOW, } CryptId; #ifndef HAVE_NSS #define LOAD32H(x, y) \ { x = ((unsigned long)((y)[0] & 255)<<24) | \ ((unsigned long)((y)[1] & 255)<<16) | \ ((unsigned long)((y)[2] & 255)<<8) | \ ((unsigned long)((y)[3] & 255)); } #define STORE64H(x, y) \ { (y)[0] = (unsigned char)(((x)>>56)&255); (y)[1] = (unsigned char)(((x)>>48)&255); \ (y)[2] = (unsigned char)(((x)>>40)&255); (y)[3] = (unsigned char)(((x)>>32)&255); \ (y)[4] = (unsigned char)(((x)>>24)&255); (y)[5] = (unsigned char)(((x)>>16)&255); \ (y)[6] = (unsigned char)(((x)>>8)&255); (y)[7] = (unsigned char)((x)&255); } #define STORE32H(x, y) \ { (y)[0] = (unsigned char)(((x)>>24)&255); (y)[1] = (unsigned char)(((x)>>16)&255); \ (y)[2] = (unsigned char)(((x)>>8)&255); (y)[3] = (unsigned char)((x)&255); } #define ROL(x, y) ( (((unsigned long)(x)<<(unsigned long)((y)&31)) | (((unsigned long)(x)&0xFFFFFFFFUL)>>(unsigned long)(32-((y)&31)))) & 0xFFFFFFFFUL) #define ROLc(x, y) ( (((unsigned long)(x)<<(unsigned long)((y)&31)) | (((unsigned long)(x)&0xFFFFFFFFUL)>>(unsigned long)(32-((y)&31)))) & 0xFFFFFFFFUL) #ifndef MIN #define MIN(x, y) ( ((x)<(y))?(x):(y) ) #endif typedef struct Sha1State_ { uint64_t length; uint32_t state[5], curlen; unsigned char buf[64]; } Sha1State; typedef union HashState_ { char dummy[1]; Sha1State sha1; void *data; } HashState; #endif /* don't HAVE_NSS */ unsigned char* ComputeSHA1(unsigned char* buff, int bufflen); int Base64Encode(const unsigned char *in, unsigned long inlen, unsigned char *out, unsigned long *outlen); #endif /* UTIL_CRYPT_H_ */ suricata-3.2.1/src/detect-dsize.c0000644000000000000000000005242513051004444013541 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the dsize keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "flow-var.h" #include "detect-dsize.h" #include "util-unittest.h" #include "util-debug.h" #include "util-byte.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" /** * dsize:[<>]<0-65535>[<><0-65535>]; */ #define PARSE_REGEX "^\\s*(<|>)?\\s*([0-9]{1,5})\\s*(?:(<>)\\s*([0-9]{1,5}))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectDsizeMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectDsizeSetup (DetectEngineCtx *, Signature *s, char *str); void DsizeRegisterTests(void); static void DetectDsizeFree(void *); static int PrefilterSetupDsize(SigGroupHead *sgh); static _Bool PrefilterDsizeIsPrefilterable(const Signature *s); /** * \brief Registration function for dsize: keyword */ void DetectDsizeRegister (void) { sigmatch_table[DETECT_DSIZE].name = "dsize"; sigmatch_table[DETECT_DSIZE].desc = "match on the size of the packet payload"; sigmatch_table[DETECT_DSIZE].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#dsize"; sigmatch_table[DETECT_DSIZE].Match = DetectDsizeMatch; sigmatch_table[DETECT_DSIZE].Setup = DetectDsizeSetup; sigmatch_table[DETECT_DSIZE].Free = DetectDsizeFree; sigmatch_table[DETECT_DSIZE].RegisterTests = DsizeRegisterTests; sigmatch_table[DETECT_DSIZE].SupportsPrefilter = PrefilterDsizeIsPrefilterable; sigmatch_table[DETECT_DSIZE].SetupPrefilter = PrefilterSetupDsize; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline int DsizeMatch(const uint16_t psize, const uint8_t mode, const uint16_t dsize, const uint16_t dsize2) { if (mode == DETECTDSIZE_EQ && dsize == psize) return 1; else if (mode == DETECTDSIZE_LT && psize < dsize) return 1; else if (mode == DETECTDSIZE_GT && psize > dsize) return 1; else if (mode == DETECTDSIZE_RA && psize > dsize && psize < dsize2) return 1; return 0; } /** * \internal * \brief This function is used to match flags on a packet with those passed via dsize: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the Signature * \param m pointer to the sigmatch * * \retval 0 no match * \retval 1 match */ int DetectDsizeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); int ret = 0; if (PKT_IS_PSEUDOPKT(p)) { SCReturnInt(0); } const DetectDsizeData *dd = (const DetectDsizeData *)ctx; SCLogDebug("p->payload_len %"PRIu16"", p->payload_len); ret = DsizeMatch(p->payload_len, dd->mode, dd->dsize, dd->dsize2); SCReturnInt(ret); } /** * \internal * \brief This function is used to parse dsize options passed via dsize: keyword * * \param rawstr Pointer to the user provided dsize options * * \retval dd pointer to DetectDsizeData on success * \retval NULL on failure */ DetectDsizeData *DetectDsizeParse (char *rawstr) { DetectDsizeData *dd = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char mode[2] = ""; char value1[6] = ""; char value2[6] = ""; char range[3] = ""; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 5) { SCLogError(SC_ERR_PCRE_MATCH,"Parse error %s", rawstr); goto error; } res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, mode, sizeof(mode)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed"); goto error; } SCLogDebug("mode \"%s\"", mode); res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, value1, sizeof(value1)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed"); goto error; } SCLogDebug("value1 \"%s\"", value1); if (ret > 3) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, range, sizeof(range)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed"); goto error; } SCLogDebug("range \"%s\"", range); if (ret > 4) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, value2, sizeof(value2)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed"); goto error; } SCLogDebug("value2 \"%s\"", value2); } } dd = SCMalloc(sizeof(DetectDsizeData)); if (unlikely(dd == NULL)) goto error; dd->dsize = 0; dd->dsize2 = 0; dd->mode = DETECTDSIZE_EQ; // default if (strlen(mode) > 0) { if (mode[0] == '<') dd->mode = DETECTDSIZE_LT; else if (mode[0] == '>') dd->mode = DETECTDSIZE_GT; else dd->mode = DETECTDSIZE_EQ; } if (strcmp("<>", range) == 0) { if (strlen(mode) != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Range specified but mode also set"); goto error; } dd->mode = DETECTDSIZE_RA; } /** set the first dsize value */ if (ByteExtractStringUint16(&dd->dsize,10,strlen(value1),value1) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid size value1:\"%s\"", value1); goto error; } /** set the second dsize value if specified */ if (strlen(value2) > 0) { if (dd->mode != DETECTDSIZE_RA) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Multiple dsize values specified but mode is not range"); goto error; } if (ByteExtractStringUint16(&dd->dsize2,10,strlen(value2),value2) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size value2:\"%s\"",value2); goto error; } if (dd->dsize2 <= dd->dsize) { SCLogError(SC_ERR_INVALID_ARGUMENT,"dsize2:%"PRIu16" <= dsize:%"PRIu16"",dd->dsize2,dd->dsize); goto error; } } SCLogDebug("dsize parsed successfully dsize: %"PRIu16" dsize2: %"PRIu16"",dd->dsize,dd->dsize2); return dd; error: if (dd) SCFree(dd); return NULL; } /** * \internal * \brief this function is used to add the parsed dsize into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided flags options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectDsizeData *dd = NULL; SigMatch *sm = NULL; if (SigMatchGetLastSMFromLists(s, 2, DETECT_DSIZE, s->sm_lists_tail[DETECT_SM_LIST_MATCH]) != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use 2 or more dsizes in " "the same sig. Invalidating signature."); goto error; } SCLogDebug("\'%s\'", rawstr); dd = DetectDsizeParse(rawstr); if (dd == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Parsing \'%s\' failed", rawstr); goto error; } /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL){ SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for SigMatch"); SCFree(dd); goto error; } sm->type = DETECT_DSIZE; sm->ctx = (SigMatchCtx *)dd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); SCLogDebug("dd->dsize %"PRIu16", dd->dsize2 %"PRIu16", dd->mode %"PRIu8"", dd->dsize, dd->dsize2, dd->mode); /* tell the sig it has a dsize to speed up engine init */ s->flags |= SIG_FLAG_REQUIRE_PACKET; s->flags |= SIG_FLAG_DSIZE; if (s->dsize_sm == NULL) { s->dsize_sm = sm; } return 0; error: return -1; } /** * \internal * \brief this function will free memory associated with DetectDsizeData * * \param de pointer to DetectDsizeData */ void DetectDsizeFree(void *de_ptr) { DetectDsizeData *dd = (DetectDsizeData *)de_ptr; if(dd) SCFree(dd); } /* prefilter code */ static void PrefilterPacketDsizeMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (PKT_IS_PSEUDOPKT(p)) { SCReturn; } const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; const uint16_t dsize = p->payload_len; if (DsizeMatch(dsize, ctx->v1.u8[0], ctx->v1.u16[1], ctx->v1.u16[2])) { SCLogDebug("packet matches dsize %u", dsize); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketDsizeSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectDsizeData *a = smctx; v->u8[0] = a->mode; v->u16[1] = a->dsize; v->u16[2] = a->dsize2; } static _Bool PrefilterPacketDsizeCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectDsizeData *a = smctx; if (v.u8[0] == a->mode && v.u16[1] == a->dsize && v.u16[2] == a->dsize2) return TRUE; return FALSE; } static int PrefilterSetupDsize(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_DSIZE, PrefilterPacketDsizeSet, PrefilterPacketDsizeCompare, PrefilterPacketDsizeMatch); } static _Bool PrefilterDsizeIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_DSIZE: return TRUE; } } return FALSE; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS #include "detect-engine.h" /** * \test this is a test for a valid dsize value 1 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse01 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1"); if (dd) { DetectDsizeFree(dd); return 1; } return 0; } /** * \test this is a test for a valid dsize value >10 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse02 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse(">10"); if (dd) { DetectDsizeFree(dd); return 1; } return 0; } /** * \test this is a test for a valid dsize value <100 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse03 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("<100"); if (dd) { DetectDsizeFree(dd); return 1; } return 0; } /** * \test this is a test for a valid dsize value 1<>2 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse04 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1<>2"); if (dd) { DetectDsizeFree(dd); return 1; } return 0; } /** * \test this is a test for a valid dsize value 1 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse05 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1"); if (dd) { if (dd->dsize == 1) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is a test for a valid dsize value >10 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse06 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse(">10"); if (dd) { if (dd->dsize == 10 && dd->mode == DETECTDSIZE_GT) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is a test for a valid dsize value <100 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse07 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("<100"); if (dd) { if (dd->dsize == 100 && dd->mode == DETECTDSIZE_LT) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is a test for a valid dsize value 1<>2 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse08 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1<>2"); if (dd) { if (dd->dsize == 1 && dd->dsize2 == 2 && dd->mode == DETECTDSIZE_RA) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is a test for a invalid dsize value A * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse09 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("A"); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a invalid dsize value >10<>10 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse10 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse(">10<>10"); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a invalid dsize value <>10 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse11 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("<>10"); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a invalid dsize value 1<> * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse12 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1<>"); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a valid dsize value 1 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse13 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("1"); if (dd) { if (dd->dsize2 == 0) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is a test for a invalid dsize value "" * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse14 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse(""); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a invalid dsize value " " * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse15 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse(" "); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a invalid dsize value 2<>1 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse16 (void) { DetectDsizeData *dd = NULL; dd = DetectDsizeParse("2<>1"); if (dd) { DetectDsizeFree(dd); return 0; } return 1; } /** * \test this is a test for a valid dsize value 1 <> 2 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse17 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse(" 1 <> 2 "); if (dd) { if (dd->dsize == 1 && dd->dsize2 == 2 && dd->mode == DETECTDSIZE_RA) result = 1; DetectDsizeFree(dd); } return result; } /** * \test this is test for a valid dsize value > 2 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse18 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("> 2 "); if (dd) { if (dd->dsize == 2 && dd->mode == DETECTDSIZE_GT) result = 1; DetectDsizeFree(dd); } return result; } /** * \test test for a valid dsize value < 12 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse19 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse("< 12 "); if (dd) { if (dd->dsize == 12 && dd->mode == DETECTDSIZE_LT) result = 1; DetectDsizeFree(dd); } return result; } /** * \test test for a valid dsize value 12 * * \retval 1 on succces * \retval 0 on failure */ int DsizeTestParse20 (void) { int result = 0; DetectDsizeData *dd = NULL; dd = DetectDsizeParse(" 12 "); if (dd) { if (dd->dsize == 12 && dd->mode == DETECTDSIZE_EQ) result = 1; DetectDsizeFree(dd); } return result; } /** * \test DetectDsizeIcmpv6Test01 is a test for checking the working of * dsize keyword by creating 2 rules and matching a crafted packet * against them. Only the first one shall trigger. */ int DetectDsizeIcmpv6Test01 (void) { int result = 0; static uint8_t raw_icmpv6[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00, 0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; IPV6Hdr ip6h; ThreadVars tv; DecodeThreadVars dtv; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip6h, 0, sizeof(IPV6Hdr)); memset(&th_v, 0, sizeof(ThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET6; p->dst.family = AF_INET6; p->ip6h = &ip6h; DecodeIPV6(&tv, &dtv, p, raw_icmpv6, sizeof(raw_icmpv6), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(msg:\"ICMP Large ICMP Packet\"; dsize:>8; sid:1; rev:4;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert icmp any any -> any any " "(msg:\"ICMP Large ICMP Packet\"; dsize:>800; sid:2; rev:4;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); PACKET_RECYCLE(p); FlowShutdown(); end: SCFree(p); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for dsize */ void DsizeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DsizeTestParse01", DsizeTestParse01); UtRegisterTest("DsizeTestParse02", DsizeTestParse02); UtRegisterTest("DsizeTestParse03", DsizeTestParse03); UtRegisterTest("DsizeTestParse04", DsizeTestParse04); UtRegisterTest("DsizeTestParse05", DsizeTestParse05); UtRegisterTest("DsizeTestParse06", DsizeTestParse06); UtRegisterTest("DsizeTestParse07", DsizeTestParse07); UtRegisterTest("DsizeTestParse08", DsizeTestParse08); UtRegisterTest("DsizeTestParse09", DsizeTestParse09); UtRegisterTest("DsizeTestParse10", DsizeTestParse10); UtRegisterTest("DsizeTestParse11", DsizeTestParse11); UtRegisterTest("DsizeTestParse12", DsizeTestParse12); UtRegisterTest("DsizeTestParse13", DsizeTestParse13); UtRegisterTest("DsizeTestParse14", DsizeTestParse14); UtRegisterTest("DsizeTestParse15", DsizeTestParse15); UtRegisterTest("DsizeTestParse16", DsizeTestParse16); UtRegisterTest("DsizeTestParse17", DsizeTestParse17); UtRegisterTest("DsizeTestParse18", DsizeTestParse18); UtRegisterTest("DsizeTestParse19", DsizeTestParse19); UtRegisterTest("DsizeTestParse20", DsizeTestParse20); UtRegisterTest("DetectDsizeIcmpv6Test01", DetectDsizeIcmpv6Test01); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-json-dnp3-objects.c0000644000000000000000000035655613051004444015771 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * DO NOT EDIT. THIS FILE IS AUTO-GENERATED. * * Generated by command: * ./scripts/dnp3-gen/dnp3-gen.py */ #include "suricata-common.h" #include "util-crypt.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" #ifdef HAVE_LIBJANSSON void OutputJsonDNP3SetItem(json_t *js, DNP3Object *object, DNP3Point *point) { switch (DNP3_OBJECT_CODE(object->group, object->variation)) { case DNP3_OBJECT_CODE(1, 1): { DNP3ObjectG1V1 *data = point->data; json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(1, 2): { DNP3ObjectG1V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "reserved", json_integer(data->reserved)); json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(2, 1): { DNP3ObjectG2V1 *data = point->data; json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(2, 2): { DNP3ObjectG2V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "reserved", json_integer(data->reserved)); json_object_set_new(js, "state", json_integer(data->state)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(2, 3): { DNP3ObjectG2V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "reserved", json_integer(data->reserved)); json_object_set_new(js, "state", json_integer(data->state)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(3, 1): { DNP3ObjectG3V1 *data = point->data; json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(3, 2): { DNP3ObjectG3V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(4, 1): { DNP3ObjectG4V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(4, 2): { DNP3ObjectG4V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "state", json_integer(data->state)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(4, 3): { DNP3ObjectG4V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "chatter_filter", json_integer(data->chatter_filter)); json_object_set_new(js, "state", json_integer(data->state)); json_object_set_new(js, "relative_time_ms", json_integer(data->relative_time_ms)); break; } case DNP3_OBJECT_CODE(10, 1): { DNP3ObjectG10V1 *data = point->data; json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(10, 2): { DNP3ObjectG10V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(11, 1): { DNP3ObjectG11V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(11, 2): { DNP3ObjectG11V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "state", json_integer(data->state)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(12, 1): { DNP3ObjectG12V1 *data = point->data; json_object_set_new(js, "op_type", json_integer(data->op_type)); json_object_set_new(js, "qu", json_integer(data->qu)); json_object_set_new(js, "cr", json_integer(data->cr)); json_object_set_new(js, "tcc", json_integer(data->tcc)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "ontime", json_integer(data->ontime)); json_object_set_new(js, "offtime", json_integer(data->offtime)); json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved", json_integer(data->reserved)); break; } case DNP3_OBJECT_CODE(12, 2): { DNP3ObjectG12V2 *data = point->data; json_object_set_new(js, "op_type", json_integer(data->op_type)); json_object_set_new(js, "qu", json_integer(data->qu)); json_object_set_new(js, "cr", json_integer(data->cr)); json_object_set_new(js, "tcc", json_integer(data->tcc)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "ontime", json_integer(data->ontime)); json_object_set_new(js, "offtime", json_integer(data->offtime)); json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved", json_integer(data->reserved)); break; } case DNP3_OBJECT_CODE(12, 3): { DNP3ObjectG12V3 *data = point->data; json_object_set_new(js, "point", json_integer(data->point)); break; } case DNP3_OBJECT_CODE(13, 1): { DNP3ObjectG13V1 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "commanded_state", json_integer(data->commanded_state)); break; } case DNP3_OBJECT_CODE(13, 2): { DNP3ObjectG13V2 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "commanded_state", json_integer(data->commanded_state)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(20, 1): { DNP3ObjectG20V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 2): { DNP3ObjectG20V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 3): { DNP3ObjectG20V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 4): { DNP3ObjectG20V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 5): { DNP3ObjectG20V5 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 6): { DNP3ObjectG20V6 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 7): { DNP3ObjectG20V7 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(20, 8): { DNP3ObjectG20V8 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 1): { DNP3ObjectG21V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 2): { DNP3ObjectG21V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 3): { DNP3ObjectG21V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 4): { DNP3ObjectG21V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 5): { DNP3ObjectG21V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(21, 6): { DNP3ObjectG21V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(21, 7): { DNP3ObjectG21V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(21, 8): { DNP3ObjectG21V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(21, 9): { DNP3ObjectG21V9 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 10): { DNP3ObjectG21V10 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 11): { DNP3ObjectG21V11 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(21, 12): { DNP3ObjectG21V12 *data = point->data; json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(22, 1): { DNP3ObjectG22V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(22, 2): { DNP3ObjectG22V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(22, 3): { DNP3ObjectG22V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(22, 4): { DNP3ObjectG22V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(22, 5): { DNP3ObjectG22V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(22, 6): { DNP3ObjectG22V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(22, 7): { DNP3ObjectG22V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(22, 8): { DNP3ObjectG22V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(23, 1): { DNP3ObjectG23V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(23, 2): { DNP3ObjectG23V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(23, 3): { DNP3ObjectG23V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(23, 4): { DNP3ObjectG23V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); break; } case DNP3_OBJECT_CODE(23, 5): { DNP3ObjectG23V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(23, 6): { DNP3ObjectG23V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(23, 7): { DNP3ObjectG23V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(23, 8): { DNP3ObjectG23V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "rollover", json_integer(data->rollover)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "count", json_integer(data->count)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(30, 1): { DNP3ObjectG30V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(30, 2): { DNP3ObjectG30V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(30, 3): { DNP3ObjectG30V3 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(30, 4): { DNP3ObjectG30V4 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(30, 5): { DNP3ObjectG30V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(30, 6): { DNP3ObjectG30V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(31, 1): { DNP3ObjectG31V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(31, 2): { DNP3ObjectG31V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(31, 3): { DNP3ObjectG31V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(31, 4): { DNP3ObjectG31V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(31, 5): { DNP3ObjectG31V5 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(31, 6): { DNP3ObjectG31V6 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(31, 7): { DNP3ObjectG31V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(31, 8): { DNP3ObjectG31V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(32, 1): { DNP3ObjectG32V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(32, 2): { DNP3ObjectG32V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(32, 3): { DNP3ObjectG32V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(32, 4): { DNP3ObjectG32V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(32, 5): { DNP3ObjectG32V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(32, 6): { DNP3ObjectG32V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(32, 7): { DNP3ObjectG32V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(32, 8): { DNP3ObjectG32V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(33, 1): { DNP3ObjectG33V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(33, 2): { DNP3ObjectG33V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(33, 3): { DNP3ObjectG33V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(33, 4): { DNP3ObjectG33V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(33, 5): { DNP3ObjectG33V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(33, 6): { DNP3ObjectG33V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(33, 7): { DNP3ObjectG33V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(33, 8): { DNP3ObjectG33V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(34, 1): { DNP3ObjectG34V1 *data = point->data; json_object_set_new(js, "deadband_value", json_integer(data->deadband_value)); break; } case DNP3_OBJECT_CODE(34, 2): { DNP3ObjectG34V2 *data = point->data; json_object_set_new(js, "deadband_value", json_integer(data->deadband_value)); break; } case DNP3_OBJECT_CODE(34, 3): { DNP3ObjectG34V3 *data = point->data; json_object_set_new(js, "deadband_value", json_real(data->deadband_value)); break; } case DNP3_OBJECT_CODE(40, 1): { DNP3ObjectG40V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(40, 2): { DNP3ObjectG40V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(40, 3): { DNP3ObjectG40V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(40, 4): { DNP3ObjectG40V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(41, 1): { DNP3ObjectG41V1 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "control_status", json_integer(data->control_status)); break; } case DNP3_OBJECT_CODE(41, 2): { DNP3ObjectG41V2 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "control_status", json_integer(data->control_status)); break; } case DNP3_OBJECT_CODE(41, 3): { DNP3ObjectG41V3 *data = point->data; json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "control_status", json_integer(data->control_status)); break; } case DNP3_OBJECT_CODE(41, 4): { DNP3ObjectG41V4 *data = point->data; json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "control_status", json_integer(data->control_status)); break; } case DNP3_OBJECT_CODE(42, 1): { DNP3ObjectG42V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(42, 2): { DNP3ObjectG42V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(42, 3): { DNP3ObjectG42V3 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(42, 4): { DNP3ObjectG42V4 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_integer(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(42, 5): { DNP3ObjectG42V5 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(42, 6): { DNP3ObjectG42V6 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); break; } case DNP3_OBJECT_CODE(42, 7): { DNP3ObjectG42V7 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(42, 8): { DNP3ObjectG42V8 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "over_range", json_integer(data->over_range)); json_object_set_new(js, "reference_err", json_integer(data->reference_err)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "value", json_real(data->value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(43, 1): { DNP3ObjectG43V1 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_integer(data->commanded_value)); break; } case DNP3_OBJECT_CODE(43, 2): { DNP3ObjectG43V2 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_integer(data->commanded_value)); break; } case DNP3_OBJECT_CODE(43, 3): { DNP3ObjectG43V3 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_integer(data->commanded_value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(43, 4): { DNP3ObjectG43V4 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_integer(data->commanded_value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(43, 5): { DNP3ObjectG43V5 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_real(data->commanded_value)); break; } case DNP3_OBJECT_CODE(43, 6): { DNP3ObjectG43V6 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_real(data->commanded_value)); break; } case DNP3_OBJECT_CODE(43, 7): { DNP3ObjectG43V7 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_real(data->commanded_value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(43, 8): { DNP3ObjectG43V8 *data = point->data; json_object_set_new(js, "status_code", json_integer(data->status_code)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "commanded_value", json_real(data->commanded_value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(50, 1): { DNP3ObjectG50V1 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(50, 2): { DNP3ObjectG50V2 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); json_object_set_new(js, "interval", json_integer(data->interval)); break; } case DNP3_OBJECT_CODE(50, 3): { DNP3ObjectG50V3 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(50, 4): { DNP3ObjectG50V4 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); json_object_set_new(js, "interval_count", json_integer(data->interval_count)); json_object_set_new(js, "interval_units", json_integer(data->interval_units)); break; } case DNP3_OBJECT_CODE(51, 1): { DNP3ObjectG51V1 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(51, 2): { DNP3ObjectG51V2 *data = point->data; json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } case DNP3_OBJECT_CODE(52, 1): { DNP3ObjectG52V1 *data = point->data; json_object_set_new(js, "delay_secs", json_integer(data->delay_secs)); break; } case DNP3_OBJECT_CODE(52, 2): { DNP3ObjectG52V2 *data = point->data; json_object_set_new(js, "delay_ms", json_integer(data->delay_ms)); break; } case DNP3_OBJECT_CODE(70, 1): { DNP3ObjectG70V1 *data = point->data; json_object_set_new(js, "filename_size", json_integer(data->filename_size)); json_object_set_new(js, "filetype_code", json_integer(data->filetype_code)); json_object_set_new(js, "attribute_code", json_integer(data->attribute_code)); json_object_set_new(js, "start_record", json_integer(data->start_record)); json_object_set_new(js, "end_record", json_integer(data->end_record)); json_object_set_new(js, "file_size", json_integer(data->file_size)); json_object_set_new(js, "created_timestamp", json_integer(data->created_timestamp)); json_object_set_new(js, "permission", json_integer(data->permission)); json_object_set_new(js, "file_id", json_integer(data->file_id)); json_object_set_new(js, "owner_id", json_integer(data->owner_id)); json_object_set_new(js, "group_id", json_integer(data->group_id)); json_object_set_new(js, "file_function_code", json_integer(data->file_function_code)); json_object_set_new(js, "status_code", json_integer(data->status_code)); if (data->filename_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->filename_size + 1]; memcpy(tmpbuf, data->filename, data->filename_size); tmpbuf[data->filename_size] = '\0'; json_object_set_new(js, "filename", json_string(tmpbuf)); } else { json_object_set_new(js, "filename", json_string("")); } json_object_set_new(js, "data_size", json_integer(data->data_size)); if (data->data_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->data_size + 1]; memcpy(tmpbuf, data->data, data->data_size); tmpbuf[data->data_size] = '\0'; json_object_set_new(js, "data", json_string(tmpbuf)); } else { json_object_set_new(js, "data", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 2): { DNP3ObjectG70V2 *data = point->data; json_object_set_new(js, "username_offset", json_integer(data->username_offset)); json_object_set_new(js, "username_size", json_integer(data->username_size)); json_object_set_new(js, "password_offset", json_integer(data->password_offset)); json_object_set_new(js, "password_size", json_integer(data->password_size)); json_object_set_new(js, "authentication_key", json_integer(data->authentication_key)); if (data->username_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->username_size + 1]; memcpy(tmpbuf, data->username, data->username_size); tmpbuf[data->username_size] = '\0'; json_object_set_new(js, "username", json_string(tmpbuf)); } else { json_object_set_new(js, "username", json_string("")); } if (data->password_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->password_size + 1]; memcpy(tmpbuf, data->password, data->password_size); tmpbuf[data->password_size] = '\0'; json_object_set_new(js, "password", json_string(tmpbuf)); } else { json_object_set_new(js, "password", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 3): { DNP3ObjectG70V3 *data = point->data; json_object_set_new(js, "filename_offset", json_integer(data->filename_offset)); json_object_set_new(js, "filename_size", json_integer(data->filename_size)); json_object_set_new(js, "created", json_integer(data->created)); json_object_set_new(js, "permissions", json_integer(data->permissions)); json_object_set_new(js, "authentication_key", json_integer(data->authentication_key)); json_object_set_new(js, "file_size", json_integer(data->file_size)); json_object_set_new(js, "operational_mode", json_integer(data->operational_mode)); json_object_set_new(js, "maximum_block_size", json_integer(data->maximum_block_size)); json_object_set_new(js, "request_id", json_integer(data->request_id)); if (data->filename_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->filename_size + 1]; memcpy(tmpbuf, data->filename, data->filename_size); tmpbuf[data->filename_size] = '\0'; json_object_set_new(js, "filename", json_string(tmpbuf)); } else { json_object_set_new(js, "filename", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 4): { DNP3ObjectG70V4 *data = point->data; json_object_set_new(js, "file_handle", json_integer(data->file_handle)); json_object_set_new(js, "file_size", json_integer(data->file_size)); json_object_set_new(js, "maximum_block_size", json_integer(data->maximum_block_size)); json_object_set_new(js, "request_id", json_integer(data->request_id)); json_object_set_new(js, "status_code", json_integer(data->status_code)); if (data->optional_text_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->optional_text_len + 1]; memcpy(tmpbuf, data->optional_text, data->optional_text_len); tmpbuf[data->optional_text_len] = '\0'; json_object_set_new(js, "optional_text", json_string(tmpbuf)); } else { json_object_set_new(js, "optional_text", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 5): { DNP3ObjectG70V5 *data = point->data; json_object_set_new(js, "file_handle", json_integer(data->file_handle)); json_object_set_new(js, "block_number", json_integer(data->block_number)); if (data->file_data_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->file_data_len + 1]; memcpy(tmpbuf, data->file_data, data->file_data_len); tmpbuf[data->file_data_len] = '\0'; json_object_set_new(js, "file_data", json_string(tmpbuf)); } else { json_object_set_new(js, "file_data", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 6): { DNP3ObjectG70V6 *data = point->data; json_object_set_new(js, "file_handle", json_integer(data->file_handle)); json_object_set_new(js, "block_number", json_integer(data->block_number)); json_object_set_new(js, "status_code", json_integer(data->status_code)); if (data->optional_text_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->optional_text_len + 1]; memcpy(tmpbuf, data->optional_text, data->optional_text_len); tmpbuf[data->optional_text_len] = '\0'; json_object_set_new(js, "optional_text", json_string(tmpbuf)); } else { json_object_set_new(js, "optional_text", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 7): { DNP3ObjectG70V7 *data = point->data; json_object_set_new(js, "filename_offset", json_integer(data->filename_offset)); json_object_set_new(js, "filename_size", json_integer(data->filename_size)); json_object_set_new(js, "file_type", json_integer(data->file_type)); json_object_set_new(js, "file_size", json_integer(data->file_size)); json_object_set_new(js, "created_timestamp", json_integer(data->created_timestamp)); json_object_set_new(js, "permissions", json_integer(data->permissions)); json_object_set_new(js, "request_id", json_integer(data->request_id)); if (data->filename_size > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->filename_size + 1]; memcpy(tmpbuf, data->filename, data->filename_size); tmpbuf[data->filename_size] = '\0'; json_object_set_new(js, "filename", json_string(tmpbuf)); } else { json_object_set_new(js, "filename", json_string("")); } break; } case DNP3_OBJECT_CODE(70, 8): { DNP3ObjectG70V8 *data = point->data; if (data->file_specification_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->file_specification_len + 1]; memcpy(tmpbuf, data->file_specification, data->file_specification_len); tmpbuf[data->file_specification_len] = '\0'; json_object_set_new(js, "file_specification", json_string(tmpbuf)); } else { json_object_set_new(js, "file_specification", json_string("")); } break; } case DNP3_OBJECT_CODE(80, 1): { DNP3ObjectG80V1 *data = point->data; json_object_set_new(js, "state", json_integer(data->state)); break; } case DNP3_OBJECT_CODE(81, 1): { DNP3ObjectG81V1 *data = point->data; json_object_set_new(js, "fill_percentage", json_integer(data->fill_percentage)); json_object_set_new(js, "overflow_state", json_integer(data->overflow_state)); json_object_set_new(js, "group", json_integer(data->group)); json_object_set_new(js, "variation", json_integer(data->variation)); break; } case DNP3_OBJECT_CODE(83, 1): { DNP3ObjectG83V1 *data = point->data; json_object_set_new(js, "data->vendor_code", json_string(data->vendor_code)); json_object_set_new(js, "object_id", json_integer(data->object_id)); json_object_set_new(js, "length", json_integer(data->length)); unsigned long data_objects_b64_len = data->length * 2; uint8_t data_objects_b64[data_objects_b64_len]; Base64Encode(data->data_objects, data->length, data_objects_b64, &data_objects_b64_len); json_object_set_new(js, "data->data_objects", json_string((char *)data_objects_b64)); break; } case DNP3_OBJECT_CODE(86, 2): { DNP3ObjectG86V2 *data = point->data; json_object_set_new(js, "rd", json_integer(data->rd)); json_object_set_new(js, "wr", json_integer(data->wr)); json_object_set_new(js, "st", json_integer(data->st)); json_object_set_new(js, "ev", json_integer(data->ev)); json_object_set_new(js, "df", json_integer(data->df)); json_object_set_new(js, "padding0", json_integer(data->padding0)); json_object_set_new(js, "padding1", json_integer(data->padding1)); json_object_set_new(js, "padding2", json_integer(data->padding2)); break; } case DNP3_OBJECT_CODE(102, 1): { DNP3ObjectG102V1 *data = point->data; json_object_set_new(js, "value", json_integer(data->value)); break; } case DNP3_OBJECT_CODE(120, 1): { DNP3ObjectG120V1 *data = point->data; json_object_set_new(js, "csq", json_integer(data->csq)); json_object_set_new(js, "usr", json_integer(data->usr)); json_object_set_new(js, "mal", json_integer(data->mal)); json_object_set_new(js, "reason", json_integer(data->reason)); unsigned long challenge_data_b64_len = data->challenge_data_len * 2; uint8_t challenge_data_b64[challenge_data_b64_len]; Base64Encode(data->challenge_data, data->challenge_data_len, challenge_data_b64, &challenge_data_b64_len); json_object_set_new(js, "data->challenge_data", json_string((char *)challenge_data_b64)); break; } case DNP3_OBJECT_CODE(120, 2): { DNP3ObjectG120V2 *data = point->data; json_object_set_new(js, "csq", json_integer(data->csq)); json_object_set_new(js, "usr", json_integer(data->usr)); unsigned long mac_value_b64_len = data->mac_value_len * 2; uint8_t mac_value_b64[mac_value_b64_len]; Base64Encode(data->mac_value, data->mac_value_len, mac_value_b64, &mac_value_b64_len); json_object_set_new(js, "data->mac_value", json_string((char *)mac_value_b64)); break; } case DNP3_OBJECT_CODE(120, 3): { DNP3ObjectG120V3 *data = point->data; json_object_set_new(js, "csq", json_integer(data->csq)); json_object_set_new(js, "user_number", json_integer(data->user_number)); break; } case DNP3_OBJECT_CODE(120, 4): { DNP3ObjectG120V4 *data = point->data; json_object_set_new(js, "user_number", json_integer(data->user_number)); break; } case DNP3_OBJECT_CODE(120, 5): { DNP3ObjectG120V5 *data = point->data; json_object_set_new(js, "ksq", json_integer(data->ksq)); json_object_set_new(js, "user_number", json_integer(data->user_number)); json_object_set_new(js, "key_wrap_alg", json_integer(data->key_wrap_alg)); json_object_set_new(js, "key_status", json_integer(data->key_status)); json_object_set_new(js, "mal", json_integer(data->mal)); json_object_set_new(js, "challenge_data_len", json_integer(data->challenge_data_len)); unsigned long challenge_data_b64_len = data->challenge_data_len * 2; uint8_t challenge_data_b64[challenge_data_b64_len]; Base64Encode(data->challenge_data, data->challenge_data_len, challenge_data_b64, &challenge_data_b64_len); json_object_set_new(js, "data->challenge_data", json_string((char *)challenge_data_b64)); unsigned long mac_value_b64_len = data->mac_value_len * 2; uint8_t mac_value_b64[mac_value_b64_len]; Base64Encode(data->mac_value, data->mac_value_len, mac_value_b64, &mac_value_b64_len); json_object_set_new(js, "data->mac_value", json_string((char *)mac_value_b64)); break; } case DNP3_OBJECT_CODE(120, 6): { DNP3ObjectG120V6 *data = point->data; json_object_set_new(js, "ksq", json_integer(data->ksq)); json_object_set_new(js, "usr", json_integer(data->usr)); unsigned long wrapped_key_data_b64_len = data->wrapped_key_data_len * 2; uint8_t wrapped_key_data_b64[wrapped_key_data_b64_len]; Base64Encode(data->wrapped_key_data, data->wrapped_key_data_len, wrapped_key_data_b64, &wrapped_key_data_b64_len); json_object_set_new(js, "data->wrapped_key_data", json_string((char *)wrapped_key_data_b64)); break; } case DNP3_OBJECT_CODE(120, 7): { DNP3ObjectG120V7 *data = point->data; json_object_set_new(js, "sequence_number", json_integer(data->sequence_number)); json_object_set_new(js, "usr", json_integer(data->usr)); json_object_set_new(js, "association_id", json_integer(data->association_id)); json_object_set_new(js, "error_code", json_integer(data->error_code)); json_object_set_new(js, "time_of_error", json_integer(data->time_of_error)); if (data->error_text_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->error_text_len + 1]; memcpy(tmpbuf, data->error_text, data->error_text_len); tmpbuf[data->error_text_len] = '\0'; json_object_set_new(js, "error_text", json_string(tmpbuf)); } else { json_object_set_new(js, "error_text", json_string("")); } break; } case DNP3_OBJECT_CODE(120, 8): { DNP3ObjectG120V8 *data = point->data; json_object_set_new(js, "key_change_method", json_integer(data->key_change_method)); json_object_set_new(js, "certificate_type", json_integer(data->certificate_type)); unsigned long certificate_b64_len = data->certificate_len * 2; uint8_t certificate_b64[certificate_b64_len]; Base64Encode(data->certificate, data->certificate_len, certificate_b64, &certificate_b64_len); json_object_set_new(js, "data->certificate", json_string((char *)certificate_b64)); break; } case DNP3_OBJECT_CODE(120, 9): { DNP3ObjectG120V9 *data = point->data; unsigned long mac_value_b64_len = data->mac_value_len * 2; uint8_t mac_value_b64[mac_value_b64_len]; Base64Encode(data->mac_value, data->mac_value_len, mac_value_b64, &mac_value_b64_len); json_object_set_new(js, "data->mac_value", json_string((char *)mac_value_b64)); break; } case DNP3_OBJECT_CODE(120, 10): { DNP3ObjectG120V10 *data = point->data; json_object_set_new(js, "key_change_method", json_integer(data->key_change_method)); json_object_set_new(js, "operation", json_integer(data->operation)); json_object_set_new(js, "scs", json_integer(data->scs)); json_object_set_new(js, "user_role", json_integer(data->user_role)); json_object_set_new(js, "user_role_expiry_interval", json_integer(data->user_role_expiry_interval)); json_object_set_new(js, "username_len", json_integer(data->username_len)); json_object_set_new(js, "user_public_key_len", json_integer(data->user_public_key_len)); json_object_set_new(js, "certification_data_len", json_integer(data->certification_data_len)); if (data->username_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->username_len + 1]; memcpy(tmpbuf, data->username, data->username_len); tmpbuf[data->username_len] = '\0'; json_object_set_new(js, "username", json_string(tmpbuf)); } else { json_object_set_new(js, "username", json_string("")); } unsigned long user_public_key_b64_len = data->user_public_key_len * 2; uint8_t user_public_key_b64[user_public_key_b64_len]; Base64Encode(data->user_public_key, data->user_public_key_len, user_public_key_b64, &user_public_key_b64_len); json_object_set_new(js, "data->user_public_key", json_string((char *)user_public_key_b64)); unsigned long certification_data_b64_len = data->certification_data_len * 2; uint8_t certification_data_b64[certification_data_b64_len]; Base64Encode(data->certification_data, data->certification_data_len, certification_data_b64, &certification_data_b64_len); json_object_set_new(js, "data->certification_data", json_string((char *)certification_data_b64)); break; } case DNP3_OBJECT_CODE(120, 11): { DNP3ObjectG120V11 *data = point->data; json_object_set_new(js, "key_change_method", json_integer(data->key_change_method)); json_object_set_new(js, "username_len", json_integer(data->username_len)); json_object_set_new(js, "master_challenge_data_len", json_integer(data->master_challenge_data_len)); if (data->username_len > 0) { /* First create a null terminated string as not all versions * of jansson have json_stringn. */ char tmpbuf[data->username_len + 1]; memcpy(tmpbuf, data->username, data->username_len); tmpbuf[data->username_len] = '\0'; json_object_set_new(js, "username", json_string(tmpbuf)); } else { json_object_set_new(js, "username", json_string("")); } unsigned long master_challenge_data_b64_len = data->master_challenge_data_len * 2; uint8_t master_challenge_data_b64[master_challenge_data_b64_len]; Base64Encode(data->master_challenge_data, data->master_challenge_data_len, master_challenge_data_b64, &master_challenge_data_b64_len); json_object_set_new(js, "data->master_challenge_data", json_string((char *)master_challenge_data_b64)); break; } case DNP3_OBJECT_CODE(120, 12): { DNP3ObjectG120V12 *data = point->data; json_object_set_new(js, "ksq", json_integer(data->ksq)); json_object_set_new(js, "user_number", json_integer(data->user_number)); json_object_set_new(js, "challenge_data_len", json_integer(data->challenge_data_len)); unsigned long challenge_data_b64_len = data->challenge_data_len * 2; uint8_t challenge_data_b64[challenge_data_b64_len]; Base64Encode(data->challenge_data, data->challenge_data_len, challenge_data_b64, &challenge_data_b64_len); json_object_set_new(js, "data->challenge_data", json_string((char *)challenge_data_b64)); break; } case DNP3_OBJECT_CODE(120, 13): { DNP3ObjectG120V13 *data = point->data; json_object_set_new(js, "ksq", json_integer(data->ksq)); json_object_set_new(js, "user_number", json_integer(data->user_number)); json_object_set_new(js, "encrypted_update_key_len", json_integer(data->encrypted_update_key_len)); unsigned long encrypted_update_key_data_b64_len = data->encrypted_update_key_len * 2; uint8_t encrypted_update_key_data_b64[encrypted_update_key_data_b64_len]; Base64Encode(data->encrypted_update_key_data, data->encrypted_update_key_len, encrypted_update_key_data_b64, &encrypted_update_key_data_b64_len); json_object_set_new(js, "data->encrypted_update_key_data", json_string((char *)encrypted_update_key_data_b64)); break; } case DNP3_OBJECT_CODE(120, 14): { DNP3ObjectG120V14 *data = point->data; unsigned long digital_signature_b64_len = data->digital_signature_len * 2; uint8_t digital_signature_b64[digital_signature_b64_len]; Base64Encode(data->digital_signature, data->digital_signature_len, digital_signature_b64, &digital_signature_b64_len); json_object_set_new(js, "data->digital_signature", json_string((char *)digital_signature_b64)); break; } case DNP3_OBJECT_CODE(120, 15): { DNP3ObjectG120V15 *data = point->data; unsigned long mac_b64_len = data->mac_len * 2; uint8_t mac_b64[mac_b64_len]; Base64Encode(data->mac, data->mac_len, mac_b64, &mac_b64_len); json_object_set_new(js, "data->mac", json_string((char *)mac_b64)); break; } case DNP3_OBJECT_CODE(121, 1): { DNP3ObjectG121V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "association_id", json_integer(data->association_id)); json_object_set_new(js, "count_value", json_integer(data->count_value)); break; } case DNP3_OBJECT_CODE(122, 1): { DNP3ObjectG122V1 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "association_id", json_integer(data->association_id)); json_object_set_new(js, "count_value", json_integer(data->count_value)); break; } case DNP3_OBJECT_CODE(122, 2): { DNP3ObjectG122V2 *data = point->data; json_object_set_new(js, "online", json_integer(data->online)); json_object_set_new(js, "restart", json_integer(data->restart)); json_object_set_new(js, "comm_lost", json_integer(data->comm_lost)); json_object_set_new(js, "remote_forced", json_integer(data->remote_forced)); json_object_set_new(js, "local_forced", json_integer(data->local_forced)); json_object_set_new(js, "reserved0", json_integer(data->reserved0)); json_object_set_new(js, "discontinuity", json_integer(data->discontinuity)); json_object_set_new(js, "reserved1", json_integer(data->reserved1)); json_object_set_new(js, "association_id", json_integer(data->association_id)); json_object_set_new(js, "count_value", json_integer(data->count_value)); json_object_set_new(js, "timestamp", json_integer(data->timestamp)); break; } default: SCLogDebug("Unknown object: %d:%d", object->group, object->variation); break; } } #endif /* HAVE_LIBJANSSON */ suricata-3.2.1/src/detect-urilen.c0000644000000000000000000004457413051004444013727 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * Implements the urilen keyword */ #include "suricata-common.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-urilen.h" #include "util-debug.h" #include "util-byte.h" #include "flow-util.h" #include "stream-tcp.h" /** * \brief Regex for parsing our urilen */ #define PARSE_REGEX "^(?:\\s*)(<|>)?(?:\\s*)([0-9]{1,5})(?:\\s*)(?:(<>)(?:\\s*)([0-9]{1,5}))?\\s*(?:,\\s*(norm|raw))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; /*prototypes*/ static int DetectUrilenSetup (DetectEngineCtx *, Signature *, char *); void DetectUrilenFree (void *); void DetectUrilenRegisterTests (void); /** * \brief Registration function for urilen: keyword */ void DetectUrilenRegister(void) { sigmatch_table[DETECT_AL_URILEN].name = "urilen"; sigmatch_table[DETECT_AL_URILEN].desc = "match on the length of the HTTP uri"; sigmatch_table[DETECT_AL_URILEN].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#urilen"; sigmatch_table[DETECT_AL_URILEN].Match = NULL; sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = NULL /**< We handle this at detect-engine-uri.c now */; sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup; sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree; sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests; sigmatch_table[DETECT_AL_URILEN].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to parse urilen options passed via urilen: keyword * * \param urilenstr Pointer to the user provided urilen options * * \retval urilend pointer to DetectUrilenData on success * \retval NULL on failure */ DetectUrilenData *DetectUrilenParse (char *urilenstr) { DetectUrilenData *urilend = NULL; char *arg1 = NULL; char *arg2 = NULL; char *arg3 = NULL; char *arg4 = NULL; char *arg5 = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, urilenstr, strlen(urilenstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 6) { SCLogError(SC_ERR_PCRE_PARSE, "urilen option pcre parse error: \"%s\"", urilenstr); goto error; } const char *str_ptr; SCLogDebug("ret %d", ret); res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg1 = (char *) str_ptr; SCLogDebug("Arg1 \"%s\"", arg1); res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg2 = (char *) str_ptr; SCLogDebug("Arg2 \"%s\"", arg2); if (ret > 3) { res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg3 = (char *) str_ptr; SCLogDebug("Arg3 \"%s\"", arg3); if (ret > 4) { res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 4, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg4 = (char *) str_ptr; SCLogDebug("Arg4 \"%s\"", arg4); } if (ret > 5) { res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 5, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg5 = (char *) str_ptr; SCLogDebug("Arg5 \"%s\"", arg5); } } urilend = SCMalloc(sizeof (DetectUrilenData)); if (unlikely(urilend == NULL)) goto error; memset(urilend, 0, sizeof(DetectUrilenData)); if (arg1[0] == '<') urilend->mode = DETECT_URILEN_LT; else if (arg1[0] == '>') urilend->mode = DETECT_URILEN_GT; else urilend->mode = DETECT_URILEN_EQ; if (arg3 != NULL && strcmp("<>", arg3) == 0) { if (strlen(arg1) != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Range specified but mode also set"); goto error; } urilend->mode = DETECT_URILEN_RA; } /** set the first urilen value */ if (ByteExtractStringUint16(&urilend->urilen1,10,strlen(arg2),arg2) <= 0){ SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg2); goto error; } /** set the second urilen value if specified */ if (arg4 != NULL && strlen(arg4) > 0) { if (urilend->mode != DETECT_URILEN_RA) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Multiple urilen values specified" " but mode is not range"); goto error; } if(ByteExtractStringUint16(&urilend->urilen2,10,strlen(arg4),arg4) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg4); goto error; } if (urilend->urilen2 <= urilend->urilen1){ SCLogError(SC_ERR_INVALID_ARGUMENT,"urilen2:%"PRIu16" <= urilen:" "%"PRIu16"",urilend->urilen2,urilend->urilen1); goto error; } } if (arg5 != NULL) { if (strcasecmp("raw", arg5) == 0) { urilend->raw_buffer = 1; } } pcre_free_substring(arg1); pcre_free_substring(arg2); if (arg3 != NULL) pcre_free_substring(arg3); if (arg4 != NULL) pcre_free_substring(arg4); if (arg5 != NULL) pcre_free_substring(arg5); return urilend; error: if (urilend) SCFree(urilend); if (arg1 != NULL) SCFree(arg1); if (arg2 != NULL) SCFree(arg2); if (arg3 != NULL) SCFree(arg3); if (arg4 != NULL) SCFree(arg4); return NULL; } /** * \brief this function is used to parse urilen data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param urilenstr pointer to the user provided urilen options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, char *urilenstr) { SCEnter(); DetectUrilenData *urilend = NULL; SigMatch *sm = NULL; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains a non http " "alproto set"); goto error; } urilend = DetectUrilenParse(urilenstr); if (urilend == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_URILEN; sm->ctx = (void *)urilend; if (urilend->raw_buffer) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRUDMATCH); else SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_UMATCH); /* Flagged the signature as to inspect the app layer data */ s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_HTTP; SCReturnInt(0); error: DetectUrilenFree(urilend); SCReturnInt(-1); } /** * \brief this function will free memory associated with DetectUrilenData * * \param ptr pointer to DetectUrilenData */ void DetectUrilenFree(void *ptr) { if (ptr == NULL) return; DetectUrilenData *urilend = (DetectUrilenData *)ptr; SCFree(urilend); } #ifdef UNITTESTS #include "stream.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "app-layer-parser.h" /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest01(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse("10"); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_EQ && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest02(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse(" < 10 "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest03(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse(" > 10 "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest04(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse(" 5 <> 10 "); if (urilend != NULL) { if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && urilend->mode == DETECT_URILEN_RA && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest05(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse("5<>10,norm"); if (urilend != NULL) { if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && urilend->mode == DETECT_URILEN_RA && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest06(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse("5<>10,raw"); if (urilend != NULL) { if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && urilend->mode == DETECT_URILEN_RA && urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest07(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse(">10, norm "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest08(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse("<10, norm "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && !urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest09(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse(">10, raw "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** \test Test the Urilen keyword setup */ static int DetectUrilenParseTest10(void) { int ret = 0; DetectUrilenData *urilend = NULL; urilend = DetectUrilenParse("<10, raw "); if (urilend != NULL) { if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && urilend->raw_buffer) ret = 1; DetectUrilenFree(urilend); } return ret; } /** * \brief this function is used to initialize the detection engine context and * setup the signature with passed values. * */ static int DetectUrilenInitTest(DetectEngineCtx **de_ctx, Signature **sig, DetectUrilenData **urilend, char *str) { char fullstr[1024]; int result = 0; *de_ctx = NULL; *sig = NULL; if (snprintf(fullstr, 1024, "alert ip any any -> any any (msg:\"Urilen " "test\"; urilen:%s; sid:1;)", str) >= 1024) { goto end; } *de_ctx = DetectEngineCtxInit(); if (*de_ctx == NULL) { goto end; } (*de_ctx)->flags |= DE_QUIET; (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); if ((*de_ctx)->sig_list == NULL) { goto end; } *sig = (*de_ctx)->sig_list; *urilend = DetectUrilenParse(str); result = 1; end: return result; } /** * \test DetectUrilenSetpTest01 is a test for setting up an valid urilen values * with valid "<>" operator and include spaces arround the given values. * In the test the values are setup with initializing the detection engine * context and setting up the signature itself. */ static int DetectUrilenSetpTest01(void) { DetectUrilenData *urilend = NULL; uint8_t res = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = NULL; res = DetectUrilenInitTest(&de_ctx, &sig, &urilend, "1 <> 2 "); if (res == 0) { goto end; } if(urilend == NULL) goto cleanup; if (urilend != NULL) { if (urilend->urilen1 == 1 && urilend->urilen2 == 2 && urilend->mode == DETECT_URILEN_RA) res = 1; } cleanup: if (urilend) SCFree(urilend); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return res; } /** \test Check a signature with gievn urilen */ static int DetectUrilenSigTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST /suricata HTTP/1.0\r\n" "Host: foo.bar.tld\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing urilen\"; " "urilen: <5; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_method\"; " "urilen: >5; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); HtpState *htp_state = f.alstate; if (htp_state == NULL) { SCLogDebug("no http state: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sid 1 alerted, but should not have: \n"); goto end; } if (!PacketAlertCheck(p, 2)) { printf("sid 2 did not alerted, but should have: \n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectUrilen */ void DetectUrilenRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectUrilenParseTest01", DetectUrilenParseTest01); UtRegisterTest("DetectUrilenParseTest02", DetectUrilenParseTest02); UtRegisterTest("DetectUrilenParseTest03", DetectUrilenParseTest03); UtRegisterTest("DetectUrilenParseTest04", DetectUrilenParseTest04); UtRegisterTest("DetectUrilenParseTest05", DetectUrilenParseTest05); UtRegisterTest("DetectUrilenParseTest06", DetectUrilenParseTest06); UtRegisterTest("DetectUrilenParseTest07", DetectUrilenParseTest07); UtRegisterTest("DetectUrilenParseTest08", DetectUrilenParseTest08); UtRegisterTest("DetectUrilenParseTest09", DetectUrilenParseTest09); UtRegisterTest("DetectUrilenParseTest10", DetectUrilenParseTest10); UtRegisterTest("DetectUrilenSetpTest01", DetectUrilenSetpTest01); UtRegisterTest("DetectUrilenSigTest01", DetectUrilenSigTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-mpm-hs.h0000644000000000000000000000403013051004444013323 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jim Xu * \author Justin Viiret * * MPM pattern matcher that calls the Hyperscan regex matcher. */ #ifndef __UTIL_MPM_HS__H__ #define __UTIL_MPM_HS__H__ typedef struct SCHSPattern_ { /* length of the pattern */ uint16_t len; /* flags describing the pattern */ uint8_t flags; /* holds the original pattern that was added */ uint8_t *original_pat; /* pattern id */ uint32_t id; uint16_t offset; uint16_t depth; /* sid(s) for this pattern */ uint32_t sids_size; SigIntId *sids; /* only used at ctx init time, when this structure is part of a hash * table. */ struct SCHSPattern_ *next; } SCHSPattern; typedef struct SCHSCtx_ { /* hash used during ctx initialization */ SCHSPattern **init_hash; /* pattern database and pattern arrays. */ void *pattern_db; /* size of database, for accounting. */ size_t hs_db_size; } SCHSCtx; typedef struct SCHSThreadCtx_ { /* Hyperscan scratch space region for this thread, capable of handling any * database that has been compiled. */ void *scratch; /* size of scratch space, for accounting. */ size_t scratch_size; } SCHSThreadCtx; void MpmHSRegister(void); void MpmHSGlobalCleanup(void); #endif /* __UTIL_MPM_HS__H__ */ suricata-3.2.1/src/detect-http-raw-header.c0000644000000000000000000013431613051004444015417 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Pablo Rincon * * Implements support for http_raw_header keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-raw-header.h" #include "detect-engine-hrhd.h" #include "stream-tcp.h" int DetectHttpRawHeaderSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpRawHeaderRegisterTests(void); void DetectHttpRawHeaderFree(void *); /** * \brief Registers the keyword handlers for the "http_raw_header" keyword. */ void DetectHttpRawHeaderRegister(void) { sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].name = "http_raw_header"; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Match = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetup; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Free = DetectHttpRawHeaderFree; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpRawHeaderRegisterTests; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_raw_header", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHDMATCH, 2, PrefilterTxRequestHeadersRawRegister); DetectMpmAppLayerRegister("http_raw_header", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HRHDMATCH, 2, PrefilterTxResponseHeadersRawRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHDMATCH, DetectEngineInspectHttpRawHeader); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HRHDMATCH, DetectEngineInspectHttpRawHeader); return; } /** * \brief this function clears the memory of http_raw_header modifier keyword * * \param ptr Pointer to the Detection Header Data */ void DetectHttpRawHeaderFree(void *ptr) { DetectContentData *cd = (DetectContentData *)ptr; if (cd == NULL) return; if (cd->content != NULL) SCFree(cd->content); SCFree(cd); return; } /** * \brief The setup function for the http_raw_header keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param m Pointer to the head of the SigMatchs for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success. * \retval -1 On failure. */ int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_RAW_HEADER, DETECT_SM_LIST_HRHDMATCH, ALPROTO_HTTP, NULL); } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_header is correctly parsed * and the keyword is registered. */ static int DetectHttpRawHeaderTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; flow:to_server; " "content:\"one\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { printf("Error parsing signature: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH]; if (sm != NULL) { result &= (sm->type == DETECT_CONTENT); result &= (sm->next == NULL); } else { result = 0; printf("Error updating content pattern to http_header pattern: "); } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_header entry is * parsed. */ static int DetectHttpRawHeaderTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; flow:to_server; " "content:\"one\"; http_raw_header:; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a http_header * is invalidated. */ static int DetectHttpRawHeaderTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; flow:to_server; " "http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_header is invalidated. */ static int DetectHttpRawHeaderTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; flow:to_server; " "content:\"one\"; rawbytes; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_header is invalidated. */ static int DetectHttpRawHeaderTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_header\"; flow:to_server; " "content:\"one\"; nocase; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; else printf("Error parsing signature: "); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpRawHeaderTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"Content-Type: text/html\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpRawHeaderTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozi"; uint8_t http2_buf[] = "lla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\nContent-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy message body1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"Mozilla\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ( (PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpRawHeaderTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n"; uint8_t http2_buf[] = "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"Gecko/20091221 Firefox/3.5.7\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpRawHeaderTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"; uint8_t http2_buf[] = "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy body\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"Firefox/3.5.7|0D 0A|Content\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_header content matches against a http request * against a case insensitive pattern. */ static int DetectHttpRawHeaderTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n"; uint8_t http2_buf[] = "Content-Type: text/html\r\n" "Content-Length: 67\r\n" "\r\n" "This is dummy body"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"firefox/3.5.7|0D 0A|content\"; nocase; http_raw_header;" "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_header content matches against a * http request which doesn't hold the content. */ static int DetectHttpRawHeaderTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"lalalalala\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_header content matches against a * http request which holds hold the content. */ static int DetectHttpRawHeaderTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 26\r\n" "\r\n" "This is dummy message body\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"User-Agent: Mozilla/5.0 \"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectHttpRawHeaderTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "Content-Type: text/html\r\n" "Content-Length: 100\r\n" "\r\n" "longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"Host: www.openinfosecfoundation.org\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } int DetectHttpRawHeaderTest20(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; " "content:\"two\"; distance:0; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL\n"); goto end; } DetectContentData *hrhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; DetectContentData *hrhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (hrhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hrhd1->content, "one", hrhd1->content_len) != 0 || hrhd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hrhd2->content, "two", hrhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest21(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; " "content:\"two\"; within:5; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL\n"); goto end; } DetectContentData *hrhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; DetectContentData *hrhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (hrhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hrhd1->content, "one", hrhd1->content_len) != 0 || hrhd2->flags != DETECT_CONTENT_WITHIN || memcmp(hrhd2->content, "two", hrhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; within:5; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; pcre:/one/D; " "content:\"two\"; within:5; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhd2->flags != DETECT_CONTENT_WITHIN || memcmp(hhd2->content, "two", hhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"two\"; http_raw_header; " "pcre:/one/DR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || hhd1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(hhd1->content, "two", hhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpRawHeaderTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; pcre:/one/D; " "content:\"two\"; distance:5; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; DetectContentData *hhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhd2->flags != DETECT_CONTENT_DISTANCE || memcmp(hhd2->content, "two", hhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectHttpRawHeaderRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpRawHeaderTest01", DetectHttpRawHeaderTest01); UtRegisterTest("DetectHttpRawHeaderTest02", DetectHttpRawHeaderTest02); UtRegisterTest("DetectHttpRawHeaderTest03", DetectHttpRawHeaderTest03); UtRegisterTest("DetectHttpRawHeaderTest04", DetectHttpRawHeaderTest04); UtRegisterTest("DetectHttpRawHeaderTest05", DetectHttpRawHeaderTest05); UtRegisterTest("DetectHttpRawHeaderTest06", DetectHttpRawHeaderTest06); UtRegisterTest("DetectHttpRawHeaderTest07", DetectHttpRawHeaderTest07); UtRegisterTest("DetectHttpRawHeaderTest08", DetectHttpRawHeaderTest08); UtRegisterTest("DetectHttpRawHeaderTest09", DetectHttpRawHeaderTest09); UtRegisterTest("DetectHttpRawHeaderTest10", DetectHttpRawHeaderTest10); UtRegisterTest("DetectHttpRawHeaderTest11", DetectHttpRawHeaderTest11); UtRegisterTest("DetectHttpRawHeaderTest12", DetectHttpRawHeaderTest12); UtRegisterTest("DetectHttpRawHeaderTest13", DetectHttpRawHeaderTest13); UtRegisterTest("DetectHttpRawHeaderTest20", DetectHttpRawHeaderTest20); UtRegisterTest("DetectHttpRawHeaderTest21", DetectHttpRawHeaderTest21); UtRegisterTest("DetectHttpRawHeaderTest22", DetectHttpRawHeaderTest22); UtRegisterTest("DetectHttpRawHeaderTest23", DetectHttpRawHeaderTest23); UtRegisterTest("DetectHttpRawHeaderTest24", DetectHttpRawHeaderTest24); UtRegisterTest("DetectHttpRawHeaderTest25", DetectHttpRawHeaderTest25); UtRegisterTest("DetectHttpRawHeaderTest26", DetectHttpRawHeaderTest26); UtRegisterTest("DetectHttpRawHeaderTest27", DetectHttpRawHeaderTest27); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/threadvars.h0000644000000000000000000000775313051004444013331 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __THREADVARS_H__ #define __THREADVARS_H__ #include "util-affinity.h" #include "tm-queues.h" #include "counters.h" #include "threads.h" struct TmSlot_; /** Thread flags set and read by threads to control the threads */ #define THV_USE 1 /** thread is in use */ #define THV_INIT_DONE (1 << 1) /** thread initialization done */ #define THV_PAUSE (1 << 2) /** signal thread to pause itself */ #define THV_PAUSED (1 << 3) /** the thread is paused atm */ #define THV_KILL (1 << 4) /** thread has been asked to cleanup and exit */ #define THV_FAILED (1 << 5) /** thread has encountered an error and failed */ #define THV_CLOSED (1 << 6) /** thread done, should be joinable */ /* used to indicate the thread is going through de-init. Introduced as more * of a hack for solving stream-timeout-shutdown. Is set by the main thread. */ #define THV_DEINIT (1 << 7) #define THV_RUNNING_DONE (1 << 8) /** thread has completed running and is entering * the de-init phase */ #define THV_KILL_PKTACQ (1 << 9) /**< flag thread to stop packet acq */ #define THV_FLOW_LOOP (1 << 10) /**< thread is in flow shutdown loop */ /** signal thread's capture method to create a fake packet to force through * the engine. This is to force timely handling of maintenance taks like * rule reloads even if no packets are read by the capture method. */ #define THV_CAPTURE_INJECT_PKT (1<<11) /** \brief Per thread variable structure */ typedef struct ThreadVars_ { pthread_t t; char name[16]; char *thread_group_name; SC_ATOMIC_DECLARE(unsigned int, flags); /** TmModule::flags for each module part of this thread */ uint8_t tmm_flags; /** local id */ int id; /** queue's */ Tmq *inq; Tmq *outq; void *outctx; char *outqh_name; /** queue handlers */ struct Packet_ * (*tmqh_in)(struct ThreadVars_ *); void (*InShutdownHandler)(struct ThreadVars_ *); void (*tmqh_out)(struct ThreadVars_ *, struct Packet_ *); /** slot functions */ void *(*tm_func)(void *); struct TmSlot_ *tm_slots; /** stream packet queue for flow time out injection */ struct PacketQueue_ *stream_pq; uint8_t thread_setup_flags; /** the type of thread as defined in tm-threads.h (TVT_PPT, TVT_MGMT) */ uint8_t type; uint16_t cpu_affinity; /** cpu or core number to set affinity to */ uint16_t rank; int thread_priority; /** priority (real time) for this thread. Look at threads.h */ /* counters */ /** public counter store: counter syncs update this */ StatsPublicThreadContext perf_public_ctx; /** private counter store: counter updates modify this */ StatsPrivateThreadContext perf_private_ctx; SCCtrlMutex *ctrl_mutex; SCCtrlCondT *ctrl_cond; uint8_t cap_flags; /**< Flags to indicate the capabilities of all the TmModules resgitered under this thread */ struct ThreadVars_ *next; struct ThreadVars_ *prev; } ThreadVars; /** Thread setup flags: */ #define THREAD_SET_AFFINITY 0x01 /** CPU/Core affinity */ #define THREAD_SET_PRIORITY 0x02 /** Real time priority */ #define THREAD_SET_AFFTYPE 0x04 /** Priority and affinity */ #endif /* __THREADVARS_H__ */ suricata-3.2.1/src/detect-engine-iponly.h0000644000000000000000000000404113051004444015174 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_IPONLY_H__ #define __DETECT_ENGINE_IPONLY_H__ /** * SigNumArray is a bit array representing signatures * it can be used linked to src/dst address to indicate * which signatures apply to this addres * at IP Only we store SigNumArrays at the radix trees */ typedef struct SigNumArray_ { uint8_t *array; /* bit array of sig nums */ uint32_t size; /* size in bytes of the array */ } SigNumArray; void IPOnlyCIDRListFree(IPOnlyCIDRItem *tmphead); int IPOnlySigParseAddress(const DetectEngineCtx *, Signature *, const char *, char); void IPOnlyMatchPacket(ThreadVars *tv, DetectEngineCtx *, DetectEngineThreadCtx *, DetectEngineIPOnlyCtx *, DetectEngineIPOnlyThreadCtx *, Packet *); void IPOnlyInit(DetectEngineCtx *, DetectEngineIPOnlyCtx *); void IPOnlyPrint(DetectEngineCtx *, DetectEngineIPOnlyCtx *); void IPOnlyDeinit(DetectEngineCtx *, DetectEngineIPOnlyCtx *); void IPOnlyPrepare(DetectEngineCtx *); void DetectEngineIPOnlyThreadInit(DetectEngineCtx *, DetectEngineIPOnlyThreadCtx *); void DetectEngineIPOnlyThreadDeinit(DetectEngineIPOnlyThreadCtx *); void IPOnlyAddSignature(DetectEngineCtx *, DetectEngineIPOnlyCtx *, Signature *); void IPOnlyRegisterTests(void); #endif /* __DETECT_ENGINE_IPONLY_H__ */ suricata-3.2.1/src/detect-ssh-proto-version.c0000644000000000000000000004777613051004444016061 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Implements the ssh.protoversion keyword * You can specify a concrete version like ssh.protoversion: 1.66 * or search for protoversion 2 compat (1.99 is considered as 2) like * ssh.protoversion:2_compat * or just the beginning of the string like ssh.protoversion:"1." */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ssh.h" #include "detect-ssh-proto-version.h" #include "stream-tcp.h" /** * \brief Regex for parsing the protoversion string */ #define PARSE_REGEX "^\\s*\"?\\s*([0-9]+([\\.\\-0-9]+)?|2_compat)\\s*\"?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectSshVersionMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectSshVersionSetup (DetectEngineCtx *, Signature *, char *); void DetectSshVersionRegisterTests(void); void DetectSshVersionFree(void *); /** * \brief Registration function for keyword: ssh.protoversion */ void DetectSshVersionRegister(void) { sigmatch_table[DETECT_AL_SSH_PROTOVERSION].name = "ssh.protoversion"; sigmatch_table[DETECT_AL_SSH_PROTOVERSION].Match = NULL; sigmatch_table[DETECT_AL_SSH_PROTOVERSION].AppLayerMatch = DetectSshVersionMatch; sigmatch_table[DETECT_AL_SSH_PROTOVERSION].Setup = DetectSshVersionSetup; sigmatch_table[DETECT_AL_SSH_PROTOVERSION].Free = DetectSshVersionFree; sigmatch_table[DETECT_AL_SSH_PROTOVERSION].RegisterTests = DetectSshVersionRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief match the specified version on a ssh session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectSshVersionData * * \retval 0 no match * \retval 1 match */ int DetectSshVersionMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectSshVersionData *ssh = (DetectSshVersionData *)m->ctx; SshState *ssh_state = (SshState *)state; if (ssh_state == NULL) { SCLogDebug("no ssh state, no match"); SCReturnInt(0); } int ret = 0; if ((flags & STREAM_TOCLIENT) && (ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { if (ssh->flags & SSH_FLAG_PROTOVERSION_2_COMPAT) { SCLogDebug("looking for ssh server protoversion 2 compat"); if (strncmp((char *) ssh_state->srv_hdr.proto_version, "2", 1) == 0 || strncmp((char *) ssh_state->srv_hdr.proto_version, "2.", 2) == 0 || strncmp((char *) ssh_state->srv_hdr.proto_version, "1.99", 4) == 0) ret = 1; } else { SCLogDebug("looking for ssh server protoversion %s length %"PRIu16"", ssh->ver, ssh->len); ret = (strncmp((char *) ssh_state->srv_hdr.proto_version, (char *) ssh->ver, ssh->len) == 0)? 1 : 0; } } else if ((flags & STREAM_TOSERVER) && (ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { if (ssh->flags & SSH_FLAG_PROTOVERSION_2_COMPAT) { SCLogDebug("looking for client ssh client protoversion 2 compat"); if (strncmp((char *) ssh_state->cli_hdr.proto_version, "2", 1) == 0 || strncmp((char *) ssh_state->cli_hdr.proto_version, "2.", 2) == 0 || strncmp((char *) ssh_state->cli_hdr.proto_version, "1.99", 4) == 0) ret = 1; } else { SCLogDebug("looking for ssh client protoversion %s length %"PRIu16"", ssh->ver, ssh->len); ret = (strncmp((char *) ssh_state->cli_hdr.proto_version, (char *) ssh->ver, ssh->len) == 0)? 1 : 0; } } SCReturnInt(ret); } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectSshVersionData on success * \retval NULL on failure */ DetectSshVersionData *DetectSshVersionParse (char *str) { DetectSshVersionData *ssh = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.protoversion option"); goto error; } if (ret > 1) { const char *str_ptr; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ ssh = SCMalloc(sizeof(DetectSshVersionData)); if (unlikely(ssh == NULL)) goto error; memset(ssh, 0x00, sizeof(DetectSshVersionData)); /* If we expect a protocol version 2 or 1.99 (considered 2, we * will compare it with both strings) */ if (strcmp("2_compat", str_ptr) == 0) { ssh->flags |= SSH_FLAG_PROTOVERSION_2_COMPAT; SCLogDebug("will look for ssh protocol version 2 (2, 2.0, 1.99 that's considered as 2"); return ssh; } ssh->ver = (uint8_t *)SCStrdup((char*)str_ptr); if (ssh->ver == NULL) { goto error; } ssh->len = strlen((char *) ssh->ver); SCLogDebug("will look for ssh %s", ssh->ver); } return ssh; error: if (ssh != NULL) DetectSshVersionFree(ssh); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectSshVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectSshVersionData *ssh = NULL; SigMatch *sm = NULL; ssh = DetectSshVersionParse(str); if (ssh == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_SSH) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_SSH_PROTOVERSION; sm->ctx = (void *)ssh; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_SSH; return 0; error: if (ssh != NULL) DetectSshVersionFree(ssh); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectSshVersionData * * \param id_d pointer to DetectSshVersionData */ void DetectSshVersionFree(void *ptr) { DetectSshVersionData *id_d = (DetectSshVersionData *)ptr; SCFree(id_d); } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectSshVersionTestParse01 is a test to make sure that we parse * a proto version correctly */ int DetectSshVersionTestParse01 (void) { DetectSshVersionData *ssh = NULL; ssh = DetectSshVersionParse("1.0"); if (ssh != NULL && strncmp((char *) ssh->ver, "1.0", 3) == 0) { DetectSshVersionFree(ssh); return 1; } return 0; } /** * \test DetectSshVersionTestParse02 is a test to make sure that we parse * the proto version (compatible with proto version 2) correctly */ int DetectSshVersionTestParse02 (void) { DetectSshVersionData *ssh = NULL; ssh = DetectSshVersionParse("2_compat"); if (ssh->flags & SSH_FLAG_PROTOVERSION_2_COMPAT) { DetectSshVersionFree(ssh); return 1; } return 0; } /** * \test DetectSshVersionTestParse03 is a test to make sure that we * don't return a ssh_data with an invalid value specified */ int DetectSshVersionTestParse03 (void) { DetectSshVersionData *ssh = NULL; ssh = DetectSshVersionParse("2_com"); if (ssh != NULL) { DetectSshVersionFree(ssh); return 0; } ssh = DetectSshVersionParse(""); if (ssh != NULL) { DetectSshVersionFree(ssh); return 0; } ssh = DetectSshVersionParse(".1"); if (ssh != NULL) { DetectSshVersionFree(ssh); return 0; } ssh = DetectSshVersionParse("lalala"); if (ssh != NULL) { DetectSshVersionFree(ssh); return 0; } return 1; } #include "stream-tcp-reassemble.h" /** \test Send a get request in three chunks + more data. */ static int DetectSshVersionTestDetect01(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "10-PuTTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.protoversion:1.10; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ( !(PacketAlertCheck(p, 1))) { printf("Error, the sig should match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } /** \test Send a get request in three chunks + more data. */ static int DetectSshVersionTestDetect02(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "99-PuTTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.protoversion:2_compat; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ( !(PacketAlertCheck(p, 1))) { printf("Error, the sig should match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } /** \test Send a get request in three chunks + more data. */ static int DetectSshVersionTestDetect03(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "7-PuTTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.protoversion:2_compat; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("Error, 1.7 version is not 2 compat, so the sig should not match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectSshVersion */ void DetectSshVersionRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectSshVersionTestParse01", DetectSshVersionTestParse01); UtRegisterTest("DetectSshVersionTestParse02", DetectSshVersionTestParse02); UtRegisterTest("DetectSshVersionTestParse03", DetectSshVersionTestParse03); UtRegisterTest("DetectSshVersionTestDetect01", DetectSshVersionTestDetect01); UtRegisterTest("DetectSshVersionTestDetect02", DetectSshVersionTestDetect02); UtRegisterTest("DetectSshVersionTestDetect03", DetectSshVersionTestDetect03); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-prefilter-common.c0000644000000000000000000003033413051004444017143 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" typedef struct PrefilterPacketHeaderHashCtx_ { PrefilterPacketHeaderValue v1; uint16_t type; /**< PREFILTER_EXTRA_MATCH_* */ uint16_t value; uint32_t cnt; } PrefilterPacketHeaderHashCtx; static uint32_t PrefilterPacketHeaderHashFunc(HashListTable *ht, void *data, uint16_t datalen) { PrefilterPacketHeaderCtx *ctx = data; uint64_t hash = ctx->v1.u64 + ctx->type + ctx->value; hash %= ht->array_size; return hash; } static char PrefilterPacketHeaderCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { PrefilterPacketHeaderHashCtx *ctx1 = data1; PrefilterPacketHeaderHashCtx *ctx2 = data2; return (ctx1->v1.u64 == ctx2->v1.u64 && ctx1->type == ctx2->type && ctx1->value == ctx2->value); } static void PrefilterPacketHeaderFreeFunc(void *ptr) { SCFree(ptr); } static void PrefilterPacketHeaderFree(void *pectx) { PrefilterPacketHeaderCtx *ctx = pectx; SCFree(ctx->sigs_array); SCFree(ctx); } static void PrefilterPacketU8HashCtxFree(void *vctx) { PrefilterPacketU8HashCtx *ctx = vctx; int i; for (i = 0; i < 256; i++) { SigsArray *sa = ctx->array[i]; if (sa == NULL) continue; SCFree(sa->sigs); SCFree(sa); } SCFree(ctx); } static void GetExtraMatch(const Signature *s, uint16_t *type, uint16_t *value) { if (s->sp != NULL && s->sp->next == NULL && s->sp->port == s->sp->port2 && !(s->sp->flags & PORT_FLAG_NOT)) { *type = PREFILTER_EXTRA_MATCH_SRCPORT; *value = s->sp->port; } else if (s->alproto != ALPROTO_UNKNOWN) { *type = PREFILTER_EXTRA_MATCH_ALPROTO; *value = s->alproto; } else if (s->dp != NULL && s->dp->next == NULL && s->dp->port == s->dp->port2 && !(s->dp->flags & PORT_FLAG_NOT)) { *type = PREFILTER_EXTRA_MATCH_DSTPORT; *value = s->dp->port; } } /** \internal */ static int SetupEngineForPacketHeader(SigGroupHead *sgh, int sm_type, PrefilterPacketHeaderHashCtx *hctx, _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { Signature *s = NULL; uint32_t sig = 0; uint32_t sig_offset = 0; PrefilterPacketHeaderCtx *ctx = SCCalloc(1, sizeof(PrefilterPacketHeaderCtx)); if (ctx == NULL) return -1; ctx->v1 = hctx->v1; ctx->type = hctx->type; ctx->value = hctx->value; ctx->sigs_cnt = hctx->cnt; ctx->sigs_array = SCCalloc(ctx->sigs_cnt, sizeof(SigIntId)); if (ctx->sigs_array == NULL) { SCFree(ctx); return -1; } for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (s->prefilter_sm == NULL || s->prefilter_sm->type != sm_type) continue; uint16_t type = 0; uint16_t value = 0; GetExtraMatch(s, &type, &value); if (Compare(ctx->v1, s->prefilter_sm->ctx) && ctx->type == type && ctx->value == value) { SCLogDebug("appending sid %u on %u", s->id, sig_offset); ctx->sigs_array[sig_offset] = s->num; sig_offset++; s->flags |= SIG_FLAG_PREFILTER; } } SCLogDebug("%s: ctx %p extra type %u extra value %u, sig cnt %u", sigmatch_table[sm_type].name, ctx, ctx->type, ctx->value, ctx->sigs_cnt); PrefilterAppendEngine(sgh, Match, ctx, PrefilterPacketHeaderFree, sigmatch_table[sm_type].name); return 0; } /** \internal * \brief apply signature to each value */ static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderValue v, Signature *s) { switch (v.u8[0]) { case PREFILTER_U8HASH_MODE_EQ: { SigsArray *sa = ctx->array[v.u8[1]]; sa->sigs[sa->offset++] = s->num; break; } case PREFILTER_U8HASH_MODE_LT: { uint8_t x = v.u8[1] - 1; do { SigsArray *sa = ctx->array[x]; sa->sigs[sa->offset++] = s->num; } while (x--); break; } case PREFILTER_U8HASH_MODE_GT: { int x = v.u8[1] + 1; do { SigsArray *sa = ctx->array[x]; sa->sigs[sa->offset++] = s->num; } while (++x < 256); break; } case PREFILTER_U8HASH_MODE_RA: { int x = v.u8[1] + 1; do { SigsArray *sa = ctx->array[x]; sa->sigs[sa->offset++] = s->num; } while (++x < v.u8[2]); break; } } } /** \internal * \brief turn values into a u8 hash map * \todo improve error handling * \todo deduplicate sigs arrays */ static int SetupEngineForPacketHeaderPrefilterPacketU8HashCtx(SigGroupHead *sgh, int sm_type, uint32_t *counts, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { Signature *s = NULL; uint32_t sig = 0; uint32_t cnt = 0; PrefilterPacketU8HashCtx *ctx = SCCalloc(1, sizeof(PrefilterPacketU8HashCtx)); if (ctx == NULL) return -1; int i; for (i = 0; i < 256; i++) { if (counts[i] == 0) continue; ctx->array[i] = SCCalloc(1, sizeof(SigsArray)); BUG_ON(ctx->array[i] == NULL); ctx->array[i]->cnt = counts[i]; ctx->array[i]->sigs = SCCalloc(ctx->array[i]->cnt, sizeof(SigIntId)); BUG_ON(ctx->array[i]->sigs == NULL); } for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (s->prefilter_sm == NULL || s->prefilter_sm->type != sm_type) continue; PrefilterPacketHeaderValue v; memset(&v, 0, sizeof(v)); Set(&v, s->prefilter_sm->ctx); ApplyToU8Hash(ctx, v, s); s->flags |= SIG_FLAG_PREFILTER; cnt++; } if (cnt) { PrefilterAppendEngine(sgh, Match, ctx, PrefilterPacketU8HashCtxFree, sigmatch_table[sm_type].name); } else { PrefilterPacketU8HashCtxFree(ctx); } return 0; } /** \internal * \brief setup a engine for each unique value */ static void SetupSingle(HashListTable *hash_table, SigGroupHead *sgh, int sm_type, _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { HashListTableBucket *hb = HashListTableGetListHead(hash_table); for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) { PrefilterPacketHeaderHashCtx *ctx = HashListTableGetListData(hb); SetupEngineForPacketHeader(sgh, sm_type, ctx, Compare, Match); } } /** \internal * \brief setup a single engine with a hash map for u8 values */ static void SetupU8Hash(HashListTable *hash_table, SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { uint32_t counts[256]; memset(&counts, 0, sizeof(counts)); HashListTableBucket *hb = HashListTableGetListHead(hash_table); for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) { PrefilterPacketHeaderHashCtx *ctx = HashListTableGetListData(hb); switch (ctx->v1.u8[0]) { case PREFILTER_U8HASH_MODE_EQ: counts[ctx->v1.u8[1]] += ctx->cnt; break; case PREFILTER_U8HASH_MODE_LT: { uint8_t v = ctx->v1.u8[1] - 1; do { counts[v] += ctx->cnt; } while (v--); break; } case PREFILTER_U8HASH_MODE_GT: { int v = ctx->v1.u8[1] + 1; do { counts[v] += ctx->cnt; } while (++v < 256); break; } case PREFILTER_U8HASH_MODE_RA: { int v = ctx->v1.u8[1] + 1; do { counts[v] += ctx->cnt; } while (++v < ctx->v1.u8[2]); break; } } } SetupEngineForPacketHeaderPrefilterPacketU8HashCtx(sgh, sm_type, counts, Set, Compare, Match); } static int PrefilterSetupPacketHeaderCommon(SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), _Bool u8hash) { Signature *s = NULL; uint32_t sig = 0; if (sgh == NULL) return 0; /* first count how many engines we will need */ HashListTable *hash_table = HashListTableInit(4096, PrefilterPacketHeaderHashFunc, PrefilterPacketHeaderCompareFunc, PrefilterPacketHeaderFreeFunc); if (hash_table == NULL) return -1; for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; if (s == NULL) continue; if (s->prefilter_sm == NULL || s->prefilter_sm->type != sm_type) continue; PrefilterPacketHeaderHashCtx ctx; memset(&ctx, 0, sizeof(ctx)); Set(&ctx.v1, s->prefilter_sm->ctx); GetExtraMatch(s, &ctx.type, &ctx.value); PrefilterPacketHeaderHashCtx *rctx = HashListTableLookup(hash_table, (void *)&ctx, 0); if (rctx != 0) { rctx->cnt++; } else { PrefilterPacketHeaderHashCtx *actx = SCCalloc(1, sizeof(*actx)); if (actx == NULL) goto error; Set(&actx->v1, s->prefilter_sm->ctx); actx->cnt = 1; actx->type = ctx.type; actx->value = ctx.value; int ret = HashListTableAdd(hash_table, actx, 0); if (ret != 0) { SCFree(actx); goto error; } } } if (u8hash == FALSE) { SetupSingle(hash_table, sgh, sm_type, Compare, Match); } else { SetupU8Hash(hash_table, sgh, sm_type, Set, Compare, Match); } HashListTableFree(hash_table); return 0; error: HashListTableFree(hash_table); return -1; } int PrefilterSetupPacketHeaderU8Hash(SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { return PrefilterSetupPacketHeaderCommon(sgh, sm_type, Set, Compare, Match, TRUE); } int PrefilterSetupPacketHeader(SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)) { return PrefilterSetupPacketHeaderCommon(sgh, sm_type, Set, Compare, Match, FALSE); } suricata-3.2.1/src/detect-window.c0000644000000000000000000002271313051004444013727 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Implements the window keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-window.h" #include "flow.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" /** * \brief Regex for parsing our window option */ #define PARSE_REGEX "^\\s*([!])?\\s*([0-9]{1,9}+)\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectWindowMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); int DetectWindowSetup(DetectEngineCtx *, Signature *, char *); void DetectWindowRegisterTests(void); void DetectWindowFree(void *); /** * \brief Registration function for window: keyword */ void DetectWindowRegister (void) { sigmatch_table[DETECT_WINDOW].name = "window"; sigmatch_table[DETECT_WINDOW].desc = "check for a specific TCP window size"; sigmatch_table[DETECT_WINDOW].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#window"; sigmatch_table[DETECT_WINDOW].Match = DetectWindowMatch; sigmatch_table[DETECT_WINDOW].Setup = DetectWindowSetup; sigmatch_table[DETECT_WINDOW].Free = DetectWindowFree; sigmatch_table[DETECT_WINDOW].RegisterTests = DetectWindowRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to match the window size on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectWindowData * * \retval 0 no match * \retval 1 match */ int DetectWindowMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectWindowData *wd = (const DetectWindowData *)ctx; if ( !(PKT_IS_TCP(p)) || wd == NULL || PKT_IS_PSEUDOPKT(p)) { return 0; } if ( (!wd->negated && wd->size == TCP_GET_WINDOW(p)) || (wd->negated && wd->size != TCP_GET_WINDOW(p))) { return 1; } return 0; } /** * \brief This function is used to parse window options passed via window: keyword * * \param windowstr Pointer to the user provided window options (negation! and size) * * \retval wd pointer to DetectWindowData on success * \retval NULL on failure */ DetectWindowData *DetectWindowParse(char *windowstr) { DetectWindowData *wd = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, windowstr, strlen(windowstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, windowstr); goto error; } wd = SCMalloc(sizeof(DetectWindowData)); if (unlikely(wd == NULL)) goto error; if (ret > 1) { char copy_str[128] = ""; res = pcre_copy_substring((char *)windowstr, ov, MAX_SUBSTRINGS, 1, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } /* Detect if it's negated */ if (copy_str[0] == '!') wd->negated = 1; else wd->negated = 0; if (ret > 2) { res = pcre_copy_substring((char *)windowstr, ov, MAX_SUBSTRINGS, 2, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } /* Get the window size if it's a valid value (in packets, we * should alert if this doesn't happend from decode) */ if (-1 == ByteExtractStringUint16(&wd->size, 10, 0, copy_str)) { goto error; } } } return wd; error: if (wd != NULL) DetectWindowFree(wd); return NULL; } /** * \brief this function is used to add the parsed window sizedata into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param windowstr pointer to the user provided window options * * \retval 0 on Success * \retval -1 on Failure */ int DetectWindowSetup (DetectEngineCtx *de_ctx, Signature *s, char *windowstr) { DetectWindowData *wd = NULL; SigMatch *sm = NULL; wd = DetectWindowParse(windowstr); if (wd == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_WINDOW; sm->ctx = (SigMatchCtx *)wd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (wd != NULL) DetectWindowFree(wd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectWindowData * * \param wd pointer to DetectWindowData */ void DetectWindowFree(void *ptr) { DetectWindowData *wd = (DetectWindowData *)ptr; SCFree(wd); } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectWindowTestParse01 is a test to make sure that we set the size correctly * when given valid window opt */ int DetectWindowTestParse01 (void) { int result = 0; DetectWindowData *wd = NULL; wd = DetectWindowParse("35402"); if (wd != NULL &&wd->size==35402) { DetectWindowFree(wd); result = 1; } return result; } /** * \test DetectWindowTestParse02 is a test for setting the window opt negated */ int DetectWindowTestParse02 (void) { int result = 0; DetectWindowData *wd = NULL; wd = DetectWindowParse("!35402"); if (wd != NULL) { if (wd->negated == 1 && wd->size==35402) { result = 1; } else { printf("expected wd->negated=1 and wd->size=35402\n"); } DetectWindowFree(wd); } return result; } /** * \test DetectWindowTestParse03 is a test to check for an empty value */ int DetectWindowTestParse03 (void) { int result = 0; DetectWindowData *wd = NULL; wd = DetectWindowParse(""); if (wd == NULL) { result = 1; } else { printf("expected a NULL pointer (It was an empty string)\n"); } DetectWindowFree(wd); return result; } /** * \test DetectWindowTestParse03 is a test to check for a big value */ int DetectWindowTestParse04 (void) { int result = 0; DetectWindowData *wd = NULL; wd = DetectWindowParse("1235402"); if (wd != NULL) { printf("expected a NULL pointer (It was exceeding the MAX window size)\n"); DetectWindowFree(wd); }else result=1; return result; } /** * \test DetectWindowTestPacket01 is a test to check window with constructed packets */ int DetectWindowTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"Hi all!"; uint16_t buflen = strlen((char *)buf); Packet *p[3]; p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[1] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p[2] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_ICMP); if (p[0] == NULL || p[1] == NULL ||p[2] == NULL) goto end; /* TCP wwindow = 40 */ p[0]->tcph->th_win = htons(40); /* TCP window = 41 */ p[1]->tcph->th_win = htons(41); char *sigs[2]; sigs[0]= "alert tcp any any -> any any (msg:\"Testing window 1\"; window:40; sid:1;)"; sigs[1]= "alert tcp any any -> any any (msg:\"Testing window 2\"; window:41; sid:2;)"; uint32_t sid[2] = {1, 2}; uint32_t results[3][2] = { /* packet 0 match sid 1 but should not match sid 2 */ {1, 0}, /* packet 1 should not match */ {0, 1}, /* packet 2 should not match */ {0, 0} }; result = UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 2); UTHFreePackets(p, 3); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectWindow */ void DetectWindowRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectWindowTestParse01", DetectWindowTestParse01); UtRegisterTest("DetectWindowTestParse02", DetectWindowTestParse02); UtRegisterTest("DetectWindowTestParse03", DetectWindowTestParse03); UtRegisterTest("DetectWindowTestParse04", DetectWindowTestParse04); UtRegisterTest("DetectWindowTestPacket01", DetectWindowTestPacket01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-fragbits.h0000644000000000000000000000271013051004444014221 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_FRAGBITS_H__ #define __DETECT_FRAGBITS_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" /** * \struct DetectFragBitsData_ * DetectFragBitsData_ is used to store fragbits: input value */ /** * \typedef DetectFragBitsData * A typedef for DetectFragBitsData_ */ typedef struct DetectFragBitsData_ { uint8_t fragbits; /**< IP fragbits */ uint8_t modifier; /**< !(1) +(2) *(3) modifiers */ } DetectFragBitsData; /** * Registration function for fragbits: keyword */ void DetectFragBitsRegister (void); /** * This function registers unit tests for FragBits */ void FragBitsRegisterTests(void); #endif /*__DETECT_FRAGBITS_H__ */ suricata-3.2.1/src/output-streaming.c0000644000000000000000000003626013051004444014503 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Logger for streaming data */ #include "suricata-common.h" #include "tm-modules.h" #include "output.h" #include "output-streaming.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "util-print.h" #include "conf.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; uint32_t loggers; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputStreamingLogger_ { StreamingLogger LogFunc; OutputCtx *output_ctx; struct OutputStreamingLogger_ *next; const char *name; LoggerId logger_id; enum OutputStreamingType type; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; } OutputStreamingLogger; static OutputStreamingLogger *list = NULL; int OutputRegisterStreamingLogger(LoggerId id, const char *name, StreamingLogger LogFunc, OutputCtx *output_ctx, enum OutputStreamingType type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputStreamingLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->output_ctx = output_ctx; op->name = name; op->logger_id = id; op->type = type; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (list == NULL) list = op; else { OutputStreamingLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterStreamingLogger happy"); return 0; } typedef struct StreamerCallbackData_ { OutputStreamingLogger *logger; OutputLoggerThreadStore *store; ThreadVars *tv; Packet *p; enum OutputStreamingType type; } StreamerCallbackData; int Streamer(void *cbdata, Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags) { StreamerCallbackData *streamer_cbdata = (StreamerCallbackData *)cbdata; BUG_ON(streamer_cbdata == NULL); OutputStreamingLogger *logger = streamer_cbdata->logger; OutputLoggerThreadStore *store = streamer_cbdata->store; ThreadVars *tv = streamer_cbdata->tv; #ifdef PROFILING Packet *p = streamer_cbdata->p; #endif BUG_ON(logger == NULL); BUG_ON(store == NULL); while (logger && store) { BUG_ON(logger->LogFunc == NULL); if (logger->type == streamer_cbdata->type) { SCLogDebug("logger %p", logger); PACKET_PROFILING_LOGGER_START(p, logger->logger_id); logger->LogFunc(tv, store->thread_data, (const Flow *)f, data, data_len, tx_id, flags); PACKET_PROFILING_LOGGER_END(p, logger->logger_id); } logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } return 0; } /** \brief Http Body Iterator for logging * * Global logic: * * - For each tx * - For each body chunk * - Invoke Streamer */ int HttpBodyIterator(Flow *f, int close, void *cbdata, uint8_t iflags) { SCLogDebug("called with %p, %d, %p, %02x", f, close, cbdata, iflags); HtpState *s = f->alstate; if (s != NULL && s->conn != NULL) { int tx_progress_done_value_ts = AppLayerParserGetStateProgressCompletionStatus(ALPROTO_HTTP, STREAM_TOSERVER); int tx_progress_done_value_tc = AppLayerParserGetStateProgressCompletionStatus(ALPROTO_HTTP, STREAM_TOCLIENT); // for each tx uint64_t tx_id = 0; uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate); SCLogDebug("s->conn %p", s->conn); for (tx_id = 0; tx_id < total_txs; tx_id++) { // TODO optimization store log tx htp_tx_t *tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, tx_id); if (tx != NULL) { int tx_done = 0; int tx_logged = 0; int tx_progress_ts = AppLayerParserGetStateProgress( IPPROTO_TCP, ALPROTO_HTTP, tx, FlowGetDisruptionFlags(f, STREAM_TOSERVER)); if (tx_progress_ts >= tx_progress_done_value_ts) { int tx_progress_tc = AppLayerParserGetStateProgress( IPPROTO_TCP, ALPROTO_HTTP, tx, FlowGetDisruptionFlags(f, STREAM_TOCLIENT)); if (tx_progress_tc >= tx_progress_done_value_tc) { tx_done = 1; } } SCLogDebug("tx %p", tx); HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud != NULL) { SCLogDebug("htud %p", htud); HtpBody *body = NULL; if (iflags & OUTPUT_STREAMING_FLAG_TOCLIENT) body = &htud->request_body; else if (iflags & OUTPUT_STREAMING_FLAG_TOSERVER) body = &htud->response_body; if (body == NULL) { SCLogDebug("no body"); goto next; } if (body->first == NULL) { SCLogDebug("no body chunks"); goto next; } if (body->last->logged == 1) { SCLogDebug("all logged already"); goto next; } // for each chunk HtpBodyChunk *chunk = body->first; for ( ; chunk != NULL; chunk = chunk->next) { if (chunk->logged) { SCLogDebug("logged %d", chunk->logged); continue; } uint8_t flags = iflags | OUTPUT_STREAMING_FLAG_TRANSACTION; if (chunk->sbseg.stream_offset == 0) flags |= OUTPUT_STREAMING_FLAG_OPEN; /* if we need to close and we're at the last segment in the list * we add the 'close' flag so the logger can close up. */ if ((tx_done || close) && chunk->next == NULL) { flags |= OUTPUT_STREAMING_FLAG_CLOSE; } const uint8_t *data = NULL; uint32_t data_len = 0; StreamingBufferSegmentGetData(body->sb, &chunk->sbseg, &data, &data_len); // invoke Streamer Streamer(cbdata, f, data, data_len, tx_id, flags); //PrintRawDataFp(stdout, data, data_len); chunk->logged = 1; tx_logged = 1; } next: /* if we need to close we need to invoke the Streamer for sure. If we * logged no chunks, we call the Streamer with NULL data so it can * close up. */ if (tx_logged == 0 && (close||tx_done)) { Streamer(cbdata, f, NULL, 0, tx_id, OUTPUT_STREAMING_FLAG_CLOSE|OUTPUT_STREAMING_FLAG_TRANSACTION); } } } } } return 0; } int StreamIterator(Flow *f, TcpStream *stream, int close, void *cbdata, uint8_t iflags) { SCLogDebug("called with %p, %d, %p, %02x", f, close, cbdata, iflags); int logged = 0; /* optimization: don't iterate list if we've logged all, * so check the last segment's flags */ if (stream->seg_list_tail != NULL && (!(stream->seg_list_tail->flags & SEGMENTTCP_FLAG_LOGAPI_PROCESSED))) { TcpSegment *seg = stream->seg_list; while (seg) { uint8_t flags = iflags; if (seg->flags & SEGMENTTCP_FLAG_LOGAPI_PROCESSED) { seg = seg->next; continue; } if (SEQ_GT(seg->seq + seg->payload_len, stream->last_ack)) { SCLogDebug("seg not (fully) acked yet"); break; } if (seg->seq == stream->isn + 1) flags |= OUTPUT_STREAMING_FLAG_OPEN; /* if we need to close and we're at the last segment in the list * we add the 'close' flag so the logger can close up. */ if (close && seg->next == NULL) flags |= OUTPUT_STREAMING_FLAG_CLOSE; Streamer(cbdata, f, seg->payload, (uint32_t)seg->payload_len, 0, flags); seg->flags |= SEGMENTTCP_FLAG_LOGAPI_PROCESSED; seg = seg->next; logged = 1; } } /* if we need to close we need to invoke the Streamer for sure. If we * logged no segments, we call the Streamer with NULL data so it can * close up. */ if (logged == 0 && close) { Streamer(cbdata, f, NULL, 0, 0, OUTPUT_STREAMING_FLAG_CLOSE); } return 0; } static TmEcode OutputStreamingLog(ThreadVars *tv, Packet *p, void *thread_data) { BUG_ON(thread_data == NULL); if (list == NULL) { /* No child loggers. */ return TM_ECODE_OK; } OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputStreamingLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; StreamerCallbackData streamer_cbdata = { logger, store, tv, p , 0}; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); uint8_t flags = 0; Flow * const f = p->flow; /* no flow, no streaming */ if (f == NULL) { SCReturnInt(TM_ECODE_OK); } if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= OUTPUT_STREAMING_FLAG_TOCLIENT; else flags |= OUTPUT_STREAMING_FLAG_TOSERVER; if (op_thread_data->loggers & (1<protoctx; if (ssn) { int close = (ssn->state >= TCP_CLOSED); close |= ((p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0); SCLogDebug("close ? %s", close ? "yes" : "no"); TcpStream *stream = flags & OUTPUT_STREAMING_FLAG_TOSERVER ? &ssn->client : &ssn->server; streamer_cbdata.type = STREAMING_TCP_DATA; StreamIterator(p->flow, stream, close, (void *)&streamer_cbdata, flags); } } if (op_thread_data->loggers & (1<alproto == ALPROTO_HTTP && f->alstate != NULL) { int close = 0; TcpSession *ssn = f->protoctx; if (ssn) { close = (ssn->state >= TCP_CLOSED); close |= ((p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0); } SCLogDebug("close ? %s", close ? "yes" : "no"); streamer_cbdata.type = STREAMING_HTTP_BODIES; HttpBodyIterator(f, close, (void *)&streamer_cbdata, flags); } } return TM_ECODE_OK; } /** \brief thread init for the tx logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputStreamingLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputStreamingLogThreadInit happy (*data %p)", *data); OutputStreamingLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogInfo("%s is now set up", logger->name); } } td->loggers |= (1<type); logger = logger->next; } return TM_ECODE_OK; } static TmEcode OutputStreamingLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputStreamingLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); logger = logger->next; store = next_store; } SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputStreamingLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputStreamingLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputStreamingLoggerRegister(void) { OutputRegisterRootLogger(OutputStreamingLogThreadInit, OutputStreamingLogThreadDeinit, OutputStreamingLogExitPrintStats, OutputStreamingLog); } void OutputStreamingShutdown(void) { OutputStreamingLogger *logger = list; while (logger) { OutputStreamingLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/detect-http-stat-code.h0000644000000000000000000000215613051004444015264 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_HTTP_STAT_CODE_H #define _DETECT_HTTP_STAT_CODE_H /* prototypes */ int DetectHttpStatCodeMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t , void *, Signature *, SigMatch *); void DetectHttpStatCodeRegister(void); #endif /* _DETECT_HTTP_STAT_CODE_H */ suricata-3.2.1/src/output-json-dnp3-objects.h0000644000000000000000000000171013051004444015751 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __OUTPUT_JSON_DNP3_OBJECTS_H__ #define __OUTPUT_JSON_DNP3_OBJECTS_H__ #ifdef HAVE_LIBJANSSON void OutputJsonDNP3SetItem(json_t *js, DNP3Object *object, DNP3Point *item); #endif /* HAVE_LIBJANSSON */ #endif /* __OUTPUT_JSON_DNP3_OBJECTS_H__ */ suricata-3.2.1/src/flow-timeout.h0000644000000000000000000000211413051004444013603 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __FLOW_TIMEOUT_H__ #define __FLOW_TIMEOUT_H__ int FlowForceReassemblyForFlow(Flow *f, int server, int client); int FlowForceReassemblyNeedReassembly(Flow *f, int *server, int *client); void FlowForceReassembly(void); void FlowForceReassemblySetup(int detect_disabled); #endif /* __FLOW_TIMEOUT_H__ */ suricata-3.2.1/src/detect-icmp-seq.c0000644000000000000000000002755013051004444014142 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the icmp_seq keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-icmp-seq.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #define PARSE_REGEX "^\\s*(\"\\s*)?([0-9]+)(\\s*\")?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIcmpSeqMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIcmpSeqSetup(DetectEngineCtx *, Signature *, char *); void DetectIcmpSeqRegisterTests(void); void DetectIcmpSeqFree(void *); static int PrefilterSetupIcmpSeq(SigGroupHead *sgh); static _Bool PrefilterIcmpSeqIsPrefilterable(const Signature *s); /** * \brief Registration function for icmp_seq */ void DetectIcmpSeqRegister (void) { sigmatch_table[DETECT_ICMP_SEQ].name = "icmp_seq"; sigmatch_table[DETECT_ICMP_SEQ].desc = "check for a ICMP sequence number"; sigmatch_table[DETECT_ICMP_SEQ].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmp-seq"; sigmatch_table[DETECT_ICMP_SEQ].Match = DetectIcmpSeqMatch; sigmatch_table[DETECT_ICMP_SEQ].Setup = DetectIcmpSeqSetup; sigmatch_table[DETECT_ICMP_SEQ].Free = DetectIcmpSeqFree; sigmatch_table[DETECT_ICMP_SEQ].RegisterTests = DetectIcmpSeqRegisterTests; sigmatch_table[DETECT_ICMP_SEQ].SupportsPrefilter = PrefilterIcmpSeqIsPrefilterable; sigmatch_table[DETECT_ICMP_SEQ].SetupPrefilter = PrefilterSetupIcmpSeq; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline _Bool GetIcmpSeq(Packet *p, uint16_t *seq) { uint16_t seqn; if (PKT_IS_PSEUDOPKT(p)) return FALSE; if (PKT_IS_ICMPV4(p)) { switch (ICMPV4_GET_TYPE(p)){ case ICMP_ECHOREPLY: case ICMP_ECHO: case ICMP_TIMESTAMP: case ICMP_TIMESTAMPREPLY: case ICMP_INFO_REQUEST: case ICMP_INFO_REPLY: case ICMP_ADDRESS: case ICMP_ADDRESSREPLY: SCLogDebug("ICMPV4_GET_SEQ(p) %"PRIu16" (network byte order), " "%"PRIu16" (host byte order)", ICMPV4_GET_SEQ(p), ntohs(ICMPV4_GET_SEQ(p))); seqn = ICMPV4_GET_SEQ(p); break; default: SCLogDebug("Packet has no seq field"); return FALSE; } } else if (PKT_IS_ICMPV6(p)) { switch (ICMPV6_GET_TYPE(p)) { case ICMP6_ECHO_REQUEST: case ICMP6_ECHO_REPLY: SCLogDebug("ICMPV6_GET_SEQ(p) %"PRIu16" (network byte order), " "%"PRIu16" (host byte order)", ICMPV6_GET_SEQ(p), ntohs(ICMPV6_GET_SEQ(p))); seqn = ICMPV6_GET_SEQ(p); break; default: SCLogDebug("Packet has no seq field"); return FALSE; } } else { SCLogDebug("Packet not ICMPV4 nor ICMPV6"); return FALSE; } *seq = seqn; return TRUE; } /** * \brief This function is used to match icmp_seq rule option set on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectIcmpSeqData * * \retval 0 no match * \retval 1 match */ int DetectIcmpSeqMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { uint16_t seqn; if (GetIcmpSeq(p, &seqn) == FALSE) return 0; const DetectIcmpSeqData *iseq = (const DetectIcmpSeqData *)ctx; if (seqn == iseq->seq) return 1; return 0; } /** * \brief This function is used to parse icmp_seq option passed via icmp_seq: keyword * * \param icmpseqstr Pointer to the user provided icmp_seq options * * \retval iseq pointer to DetectIcmpSeqData on success * \retval NULL on failure */ DetectIcmpSeqData *DetectIcmpSeqParse (char *icmpseqstr) { DetectIcmpSeqData *iseq = NULL; char *substr[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i; const char *str_ptr; ret = pcre_exec(parse_regex, parse_regex_study, icmpseqstr, strlen(icmpseqstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH,"Parse error %s", icmpseqstr); goto error; } for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)icmpseqstr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed"); goto error; } substr[i-1] = (char *)str_ptr; } iseq = SCMalloc(sizeof(DetectIcmpSeqData)); if (unlikely(iseq == NULL)) goto error; iseq->seq = 0; if (substr[0] != NULL && strlen(substr[0]) != 0) { if (substr[2] == NULL) { SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input"); goto error; } } else { if (substr[2] != NULL) { SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input"); goto error; } } uint16_t seq = 0; if (ByteExtractStringUint16(&seq, 10, 0, substr[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp seq %s is not " "valid", substr[1]); goto error; } iseq->seq = htons(seq); for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } return iseq; error: for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } if (iseq != NULL) DetectIcmpSeqFree(iseq); return NULL; } /** * \brief this function is used to add the parsed icmp_seq data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param icmpseqstr pointer to the user provided icmp_seq option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectIcmpSeqSetup (DetectEngineCtx *de_ctx, Signature *s, char *icmpseqstr) { DetectIcmpSeqData *iseq = NULL; SigMatch *sm = NULL; iseq = DetectIcmpSeqParse(icmpseqstr); if (iseq == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ICMP_SEQ; sm->ctx = (SigMatchCtx *)iseq; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (iseq != NULL) DetectIcmpSeqFree(iseq); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectIcmpSeqData * * \param ptr pointer to DetectIcmpSeqData */ void DetectIcmpSeqFree (void *ptr) { DetectIcmpSeqData *iseq = (DetectIcmpSeqData *)ptr; SCFree(iseq); } /* prefilter code */ static void PrefilterPacketIcmpSeqMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; uint16_t seqn; if (GetIcmpSeq(p, &seqn) == FALSE) return; if (seqn == ctx->v1.u16[0]) { SCLogDebug("packet matches ICMP SEQ %u", ctx->v1.u16[0]); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketIcmpSeqSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectIcmpSeqData *a = smctx; v->u16[0] = a->seq; } static _Bool PrefilterPacketIcmpSeqCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectIcmpSeqData *a = smctx; if (v.u16[0] == a->seq) return TRUE; return FALSE; } static int PrefilterSetupIcmpSeq(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_ICMP_SEQ, PrefilterPacketIcmpSeqSet, PrefilterPacketIcmpSeqCompare, PrefilterPacketIcmpSeqMatch); } static _Bool PrefilterIcmpSeqIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ICMP_SEQ: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \test DetectIcmpSeqParseTest01 is a test for setting a valid icmp_seq value */ int DetectIcmpSeqParseTest01 (void) { DetectIcmpSeqData *iseq = NULL; iseq = DetectIcmpSeqParse("300"); if (iseq != NULL && htons(iseq->seq) == 300) { DetectIcmpSeqFree(iseq); return 1; } return 0; } /** * \test DetectIcmpSeqParseTest02 is a test for setting a valid icmp_seq value * with spaces all around */ int DetectIcmpSeqParseTest02 (void) { DetectIcmpSeqData *iseq = NULL; iseq = DetectIcmpSeqParse(" 300 "); if (iseq != NULL && htons(iseq->seq) == 300) { DetectIcmpSeqFree(iseq); return 1; } return 0; } /** * \test DetectIcmpSeqParseTest03 is a test for setting an invalid icmp_seq value */ int DetectIcmpSeqParseTest03 (void) { DetectIcmpSeqData *iseq = NULL; iseq = DetectIcmpSeqParse("badc"); if (iseq != NULL) { DetectIcmpSeqFree(iseq); return 0; } return 1; } /** * \test DetectIcmpSeqMatchTest01 is a test for checking the working of * icmp_seq keyword by creating 2 rules and matching a crafted packet * against them. Only the first one shall trigger. */ int DetectIcmpSeqMatchTest01 (void) { int result = 0; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP); p->icmpv4vars.seq = htons(2216); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any (icmp_seq:2216; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert icmp any any -> any any (icmp_seq:5000; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } #endif /* UNITTESTS */ void DetectIcmpSeqRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("DetectIcmpSeqParseTest01", DetectIcmpSeqParseTest01); UtRegisterTest("DetectIcmpSeqParseTest02", DetectIcmpSeqParseTest02); UtRegisterTest("DetectIcmpSeqParseTest03", DetectIcmpSeqParseTest03); UtRegisterTest("DetectIcmpSeqMatchTest01", DetectIcmpSeqMatchTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/tmqh-ringbuffer.h0000644000000000000000000000167013051004444014256 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TMQH_RINGBUFFER_H__ #define __TMQH_RINGBUFFER_H__ void TmqhRingBufferRegister (void); void TmqhRingBufferDestroy (void); #endif /* __TMQH_RINGBUFFER_H__ */ suricata-3.2.1/src/output-packet.h0000644000000000000000000000301113051004444013752 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Packet Logger Output registration functions */ #ifndef __OUTPUT_PACKET_H__ #define __OUTPUT_PACKET_H__ #include "decode.h" #include "output.h" /** packet logger function pointer type */ typedef int (*PacketLogger)(ThreadVars *, void *thread_data, const Packet *); /** packet logger condition function pointer type, * must return true for packets that should be logged */ typedef int (*PacketLogCondition)(ThreadVars *, const Packet *); int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *, ThreadInitFunc, ThreadDeinitFunc, ThreadExitPrintStatsFunc); void OutputPacketLoggerRegister(void); void OutputPacketShutdown(void); #endif /* __OUTPUT_PACKET_H__ */ suricata-3.2.1/src/flow-util.h0000644000000000000000000001102213051004444013070 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_UTIL_H__ #define __FLOW_UTIL_H__ #include "detect-engine-state.h" #include "tmqh-flow.h" #define COPY_TIMESTAMP(src,dst) ((dst)->tv_sec = (src)->tv_sec, (dst)->tv_usec = (src)->tv_usec) #define RESET_COUNTERS(f) do { \ (f)->todstpktcnt = 0; \ (f)->tosrcpktcnt = 0; \ (f)->todstbytecnt = 0; \ (f)->tosrcbytecnt = 0; \ } while (0) #define FLOW_INITIALIZE(f) do { \ (f)->sp = 0; \ (f)->dp = 0; \ (f)->proto = 0; \ SC_ATOMIC_INIT((f)->flow_state); \ SC_ATOMIC_INIT((f)->use_cnt); \ (f)->tenant_id = 0; \ (f)->probing_parser_toserver_alproto_masks = 0; \ (f)->probing_parser_toclient_alproto_masks = 0; \ (f)->flags = 0; \ (f)->file_flags = 0; \ (f)->lastts.tv_sec = 0; \ (f)->lastts.tv_usec = 0; \ FLOWLOCK_INIT((f)); \ (f)->protoctx = NULL; \ (f)->flow_end_flags = 0; \ (f)->alproto = 0; \ (f)->alproto_ts = 0; \ (f)->alproto_tc = 0; \ (f)->de_ctx_id = 0; \ (f)->thread_id = 0; \ (f)->detect_alversion[0] = 0; \ (f)->detect_alversion[1] = 0; \ (f)->alparser = NULL; \ (f)->alstate = NULL; \ (f)->de_state = NULL; \ (f)->sgh_toserver = NULL; \ (f)->sgh_toclient = NULL; \ (f)->flowvar = NULL; \ (f)->hnext = NULL; \ (f)->hprev = NULL; \ (f)->lnext = NULL; \ (f)->lprev = NULL; \ RESET_COUNTERS((f)); \ } while (0) /** \brief macro to recycle a flow before it goes into the spare queue for reuse. * * Note that the lnext, lprev, hnext, hprev fields are untouched, those are * managed by the queueing code. Same goes for fb (FlowBucket ptr) field. */ #define FLOW_RECYCLE(f) do { \ FlowCleanupAppLayer((f)); \ (f)->sp = 0; \ (f)->dp = 0; \ (f)->proto = 0; \ SC_ATOMIC_RESET((f)->flow_state); \ SC_ATOMIC_RESET((f)->use_cnt); \ (f)->tenant_id = 0; \ (f)->probing_parser_toserver_alproto_masks = 0; \ (f)->probing_parser_toclient_alproto_masks = 0; \ (f)->flags = 0; \ (f)->file_flags = 0; \ (f)->lastts.tv_sec = 0; \ (f)->lastts.tv_usec = 0; \ (f)->protoctx = NULL; \ (f)->flow_end_flags = 0; \ (f)->alparser = NULL; \ (f)->alstate = NULL; \ (f)->alproto = 0; \ (f)->alproto_ts = 0; \ (f)->alproto_tc = 0; \ (f)->de_ctx_id = 0; \ (f)->thread_id = 0; \ (f)->detect_alversion[0] = 0; \ (f)->detect_alversion[1] = 0; \ if ((f)->de_state != NULL) { \ DetectEngineStateReset((f)->de_state, (STREAM_TOSERVER | STREAM_TOCLIENT)); \ } \ (f)->sgh_toserver = NULL; \ (f)->sgh_toclient = NULL; \ GenericVarFree((f)->flowvar); \ (f)->flowvar = NULL; \ RESET_COUNTERS((f)); \ } while(0) #define FLOW_DESTROY(f) do { \ FlowCleanupAppLayer((f)); \ SC_ATOMIC_DESTROY((f)->flow_state); \ SC_ATOMIC_DESTROY((f)->use_cnt); \ \ FLOWLOCK_DESTROY((f)); \ if ((f)->de_state != NULL) { \ DetectEngineStateFlowFree((f)->de_state); \ } \ GenericVarFree((f)->flowvar); \ } while(0) /** \brief check if a memory alloc would fit in the memcap * * \param size memory allocation size to check * * \retval 1 it fits * \retval 0 no fit */ #define FLOW_CHECK_MEMCAP(size) \ ((((uint64_t)SC_ATOMIC_GET(flow_memuse) + (uint64_t)(size)) <= flow_config.memcap)) Flow *FlowAlloc(void); Flow *FlowAllocDirect(void); void FlowFree(Flow *); uint8_t FlowGetProtoMapping(uint8_t); void FlowInit(Flow *, const Packet *); uint8_t FlowGetReverseProtoMapping(uint8_t rproto); #endif /* __FLOW_UTIL_H__ */ suricata-3.2.1/src/util-running-modes.c0000644000000000000000000000323413051004444014707 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #include "suricata-common.h" #include "config.h" #include "app-layer-detect-proto.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-cuda.h" #include "util-unittest.h" #include "util-debug.h" #include "conf-yaml-loader.h" int ListKeywords(const char *keyword_info) { if (ConfYamlLoadFile(DEFAULT_CONF_FILE) != -1) SCLogLoadConfig(0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); SigTableSetup(); /* load the rule keywords */ SigTableList(keyword_info); exit(EXIT_SUCCESS); } int ListAppLayerProtocols() { if (ConfYamlLoadFile(DEFAULT_CONF_FILE) != -1) SCLogLoadConfig(0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); AppLayerListSupportedProtocols(); exit(EXIT_SUCCESS); } #ifdef __SC_CUDA_SUPPORT__ int ListCudaCards() { SCCudaInitCudaEnvironment(); SCCudaListCards(); exit(EXIT_SUCCESS); } #endif suricata-3.2.1/src/detect-ttl.c0000644000000000000000000004345613051004444013232 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * Implements the ttl keyword */ #include "suricata-common.h" #include "stream-tcp.h" #include "util-unittest.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-ttl.h" #include "util-debug.h" /** * \brief Regex for parsing our flow options */ #define PARSE_REGEX "^\\s*([0-9]*)?\\s*([<>=-]+)?\\s*([0-9]+)?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; /*prototypes*/ int DetectTtlMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectTtlSetup (DetectEngineCtx *, Signature *, char *); void DetectTtlFree (void *); void DetectTtlRegisterTests (void); static int PrefilterSetupTtl(SigGroupHead *sgh); static _Bool PrefilterTtlIsPrefilterable(const Signature *s); /** * \brief Registration function for ttl: keyword */ void DetectTtlRegister(void) { sigmatch_table[DETECT_TTL].name = "ttl"; sigmatch_table[DETECT_TTL].desc = "check for a specific IP time-to-live value"; sigmatch_table[DETECT_TTL].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#ttl"; sigmatch_table[DETECT_TTL].Match = DetectTtlMatch; sigmatch_table[DETECT_TTL].Setup = DetectTtlSetup; sigmatch_table[DETECT_TTL].Free = DetectTtlFree; sigmatch_table[DETECT_TTL].RegisterTests = DetectTtlRegisterTests; sigmatch_table[DETECT_TTL].SupportsPrefilter = PrefilterTtlIsPrefilterable; sigmatch_table[DETECT_TTL].SetupPrefilter = PrefilterSetupTtl; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); return; } static inline int TtlMatch(const uint8_t pttl, const uint8_t mode, const uint8_t dttl1, const uint8_t dttl2) { if (mode == DETECT_TTL_EQ && pttl == dttl1) return 1; else if (mode == DETECT_TTL_LT && pttl < dttl1) return 1; else if (mode == DETECT_TTL_GT && pttl > dttl1) return 1; else if (mode == DETECT_TTL_RA && (pttl > dttl1 && pttl < dttl2)) return 1; return 0; } /** * \brief This function is used to match TTL rule option on a packet with those passed via ttl: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectTtlData * * \retval 0 no match * \retval 1 match */ int DetectTtlMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { if (PKT_IS_PSEUDOPKT(p)) return 0; uint8_t pttl; if (PKT_IS_IPV4(p)) { pttl = IPV4_GET_IPTTL(p); } else if (PKT_IS_IPV6(p)) { pttl = IPV6_GET_HLIM(p); } else { SCLogDebug("Packet is of not IPv4 or IPv6"); return 0; } const DetectTtlData *ttld = (const DetectTtlData *)ctx; return TtlMatch(pttl, ttld->mode, ttld->ttl1, ttld->ttl2); } /** * \brief This function is used to parse ttl options passed via ttl: keyword * * \param ttlstr Pointer to the user provided ttl options * * \retval ttld pointer to DetectTtlData on success * \retval NULL on failure */ DetectTtlData *DetectTtlParse (char *ttlstr) { DetectTtlData *ttld = NULL; char *arg1 = NULL; char *arg2 = NULL; char *arg3 = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, ttlstr, strlen(ttlstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 "", ret); goto error; } const char *str_ptr; res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg1 = (char *) str_ptr; SCLogDebug("Arg1 \"%s\"", arg1); if (ret >= 3) { res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg2 = (char *) str_ptr; SCLogDebug("Arg2 \"%s\"", arg2); if (ret >= 4) { res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg3 = (char *) str_ptr; SCLogDebug("Arg3 \"%s\"", arg3); } } ttld = SCMalloc(sizeof (DetectTtlData)); if (unlikely(ttld == NULL)) goto error; ttld->ttl1 = 0; ttld->ttl2 = 0; if (arg2 != NULL) { /*set the values*/ switch(arg2[0]) { case '<': if (arg3 == NULL) goto error; ttld->mode = DETECT_TTL_LT; ttld->ttl1 = (uint8_t) atoi(arg3); SCLogDebug("ttl is %"PRIu8"",ttld->ttl1); if (strlen(arg1) > 0) goto error; break; case '>': if (arg3 == NULL) goto error; ttld->mode = DETECT_TTL_GT; ttld->ttl1 = (uint8_t) atoi(arg3); SCLogDebug("ttl is %"PRIu8"",ttld->ttl1); if (strlen(arg1) > 0) goto error; break; case '-': if (arg1 == NULL || strlen(arg1)== 0) goto error; if (arg3 == NULL || strlen(arg3)== 0) goto error; ttld->mode = DETECT_TTL_RA; ttld->ttl1 = (uint8_t) atoi(arg1); ttld->ttl2 = (uint8_t) atoi(arg3); SCLogDebug("ttl is %"PRIu8" to %"PRIu8"",ttld->ttl1, ttld->ttl2); if (ttld->ttl1 >= ttld->ttl2) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid ttl range. "); goto error; } break; default: ttld->mode = DETECT_TTL_EQ; if ((arg2 != NULL && strlen(arg2) > 0) || (arg3 != NULL && strlen(arg3) > 0) || (arg1 == NULL ||strlen(arg1) == 0)) goto error; ttld->ttl1 = (uint8_t) atoi(arg1); break; } } else { ttld->mode = DETECT_TTL_EQ; if ((arg3 != NULL && strlen(arg3) > 0) || (arg1 == NULL ||strlen(arg1) == 0)) goto error; ttld->ttl1 = (uint8_t) atoi(arg1); } SCFree(arg1); SCFree(arg2); SCFree(arg3); return ttld; error: if (ttld) SCFree(ttld); if (arg1) SCFree(arg1); if (arg2) SCFree(arg2); if (arg3) SCFree(arg3); return NULL; } /** * \brief this function is used to attld the parsed ttl data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param ttlstr pointer to the user provided ttl options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectTtlSetup (DetectEngineCtx *de_ctx, Signature *s, char *ttlstr) { DetectTtlData *ttld = NULL; SigMatch *sm = NULL; ttld = DetectTtlParse(ttlstr); if (ttld == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_TTL; sm->ctx = (SigMatchCtx *)ttld; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (ttld != NULL) DetectTtlFree(ttld); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectTtlData * * \param ptr pointer to DetectTtlData */ void DetectTtlFree(void *ptr) { DetectTtlData *ttld = (DetectTtlData *)ptr; SCFree(ttld); } /* prefilter code */ static void PrefilterPacketTtlMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (PKT_IS_PSEUDOPKT(p)) { SCReturn; } uint8_t pttl; if (PKT_IS_IPV4(p)) { pttl = IPV4_GET_IPTTL(p); } else if (PKT_IS_IPV6(p)) { pttl = IPV6_GET_HLIM(p); } else { SCLogDebug("Packet is of not IPv4 or IPv6"); return; } const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; if (TtlMatch(pttl, ctx->v1.u8[0], ctx->v1.u8[1], ctx->v1.u8[2])) { SCLogDebug("packet matches ttl/hl %u", pttl); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketTtlSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectTtlData *a = smctx; v->u8[0] = a->mode; v->u8[1] = a->ttl1; v->u8[2] = a->ttl2; } static _Bool PrefilterPacketTtlCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectTtlData *a = smctx; if (v.u8[0] == a->mode && v.u8[1] == a->ttl1 && v.u8[2] == a->ttl2) return TRUE; return FALSE; } static int PrefilterSetupTtl(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_TTL, PrefilterPacketTtlSet, PrefilterPacketTtlCompare, PrefilterPacketTtlMatch); } static _Bool PrefilterTtlIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_TTL: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \brief this function is used to initialize the detection engine context and * setup the signature with passed values. * */ static int DetectTtlInitTest(DetectEngineCtx **de_ctx, Signature **sig, DetectTtlData **ttld, char *str) { char fullstr[1024]; int result = 0; *de_ctx = NULL; *sig = NULL; if (snprintf(fullstr, 1024, "alert ip any any -> any any (msg:\"Ttl test\"; ttl:%s; sid:1;)", str) >= 1024) { goto end; } *de_ctx = DetectEngineCtxInit(); if (*de_ctx == NULL) { goto end; } (*de_ctx)->flags |= DE_QUIET; (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); if ((*de_ctx)->sig_list == NULL) { goto end; } *sig = (*de_ctx)->sig_list; *ttld = DetectTtlParse(str); result = 1; end: return result; } /** * \test DetectTtlParseTest01 is a test for setting up an valid ttl value. */ static int DetectTtlParseTest01 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse("10"); if (ttld != NULL) { if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_EQ) res = 1; DetectTtlFree(ttld); } return res; } /** * \test DetectTtlParseTest02 is a test for setting up an valid ttl value with * "<" operator. */ static int DetectTtlParseTest02 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse("<10"); if (ttld != NULL) { if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_LT) res = 1; DetectTtlFree(ttld); } return res; } /** * \test DetectTtlParseTest03 is a test for setting up an valid ttl values with * "-" operator. */ static int DetectTtlParseTest03 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse("1-2"); if (ttld != NULL) { if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) res = 1; DetectTtlFree(ttld); } return res; } /** * \test DetectTtlParseTest04 is a test for setting up an valid ttl value with * ">" operator and include spaces arround the given values. */ static int DetectTtlParseTest04 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse(" > 10 "); if (ttld != NULL) { if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_GT) res = 1; DetectTtlFree(ttld); } return res; } /** * \test DetectTtlParseTest05 is a test for setting up an valid ttl values with * "-" operator and include spaces arround the given values. */ static int DetectTtlParseTest05 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse(" 1 - 2 "); if (ttld != NULL) { if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) res = 1; DetectTtlFree(ttld); } return res; } /** * \test DetectTtlParseTest06 is a test for setting up an valid ttl values with * invalid "=" operator and include spaces arround the given values. */ static int DetectTtlParseTest06 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse(" 1 = 2 "); if (ttld == NULL) res = 1; if (ttld) SCFree(ttld); return res; } /** * \test DetectTtlParseTest07 is a test for setting up an valid ttl values with * invalid "<>" operator and include spaces arround the given values. */ static int DetectTtlParseTest07 (void) { DetectTtlData *ttld = NULL; uint8_t res = 0; ttld = DetectTtlParse(" 1<>2 "); if (ttld == NULL) res = 1; if (ttld) SCFree(ttld); return res; } /** * \test DetectTtlSetpTest01 is a test for setting up an valid ttl values with * valid "-" operator and include spaces arround the given values. In the * test the values are setup with initializing the detection engine context * setting up the signature itself. */ static int DetectTtlSetpTest01(void) { DetectTtlData *ttld = NULL; uint8_t res = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = NULL; res = DetectTtlInitTest(&de_ctx, &sig, &ttld, "1 - 2 "); if (res == 0) { goto end; } if(ttld == NULL) goto cleanup; if (ttld != NULL) { if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) res = 1; } cleanup: if (ttld) SCFree(ttld); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return res; } /** * \test DetectTtlTestSig01 is a test for checking the working of ttl keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. */ static int DetectTtlTestSig1(void) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; IPV4Hdr ip4h; memset(&th_v, 0, sizeof(th_v)); memset(&ip4h, 0, sizeof(ip4h)); p->src.family = AF_INET; p->dst.family = AF_INET; p->proto = IPPROTO_TCP; ip4h.ip_ttl = 15; p->ip4h = &ip4h; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"with in ttl limit\"; ttl: >16; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Less than 17\"; ttl: <17; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Greater than 5\"; ttl:15; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Equals tcp\"; ttl: 1-30; sid:4;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { printf("sid 2 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 3) == 0) { printf("sid 3 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { printf("sid 4 did not alert, but should have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectTtl */ void DetectTtlRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTtlParseTest01", DetectTtlParseTest01); UtRegisterTest("DetectTtlParseTest02", DetectTtlParseTest02); UtRegisterTest("DetectTtlParseTest03", DetectTtlParseTest03); UtRegisterTest("DetectTtlParseTest04", DetectTtlParseTest04); UtRegisterTest("DetectTtlParseTest05", DetectTtlParseTest05); UtRegisterTest("DetectTtlParseTest06", DetectTtlParseTest06); UtRegisterTest("DetectTtlParseTest07", DetectTtlParseTest07); UtRegisterTest("DetectTtlSetpTest01", DetectTtlSetpTest01); UtRegisterTest("DetectTtlTestSig1", DetectTtlTestSig1); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-threshold-config.h0000644000000000000000000000214213051004444015363 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva Pinto */ #ifndef __UTIL_THRESHOLD_CONFIG_H__ #define __UTIL_THRESHOLD_CONFIG_H__ void SCThresholdConfDeInitContext(DetectEngineCtx *, FILE *); void SCThresholdConfParseFile(DetectEngineCtx *, FILE *); int SCThresholdConfInitContext(DetectEngineCtx *, FILE *); void SCThresholdConfRegisterTests(); #endif /* __UTIL_THRESHOLD_CONFIG_H__ */ suricata-3.2.1/src/detect-http-request-line.h0000644000000000000000000000166613051004444016023 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_HTTP_REQUEST_LINE_H__ #define __DETECT_HTTP_REQUEST_LINE_H__ void DetectHttpRequestLineRegister(void); #endif /* __DETECT_HTTP_REQUEST_LINE_H__ */ suricata-3.2.1/src/detect-flags.h0000644000000000000000000000314413051004444013516 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_FLAGS_H__ #define __DETECT_FLAGS_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" /** * \struct DetectFlagsData_ * DetectFlagsData_ is used to store flags: input value */ /** * \typedef DetectFlagsData * A typedef for DetectFlagsData_ */ typedef struct DetectFlagsData_ { uint8_t flags; /**< TCP flags */ uint8_t modifier; /**< !(1) +(2) *(3) modifiers */ uint8_t ignored_flags; /**< Ignored TCP flags defined by modifer , */ } DetectFlagsData; /** * Registration function for flags: keyword */ void DetectFlagsRegister (void); /** * This function registers unit tests for Flags */ void FlagsRegisterTests(void); int DetectFlagsSignatureNeedsSynPackets(const Signature *s); int DetectFlagsSignatureNeedsSynOnlyPackets(const Signature *s); #endif /*__DETECT_FLAGS_H__ */ suricata-3.2.1/src/detect-http-request-line.c0000644000000000000000000002370113051004444016010 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Victor Julien * * Implements support for the http_request_line keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-engine-prefilter.h" #include "detect-engine-content-inspection.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "stream-tcp.h" #include "detect-http-request-line.h" int DetectHttpRequestLineSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpRequestLineRegisterTests(void); void DetectHttpRequestLineFree(void *); static int PrefilterTxHttpRequestLineRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); static int DetectEngineInspectHttpRequestLine(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); /** * \brief Registers the keyword handlers for the "http_request_line" keyword. */ void DetectHttpRequestLineRegister(void) { sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].name = "http_request_line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].desc = "content modifier to match only on the HTTP request line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_request-line"; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Match = NULL; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Setup = DetectHttpRequestLineSetup; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].RegisterTests = DetectHttpRequestLineRegisterTests; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_request_line", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HTTP_REQLINEMATCH, 2, PrefilterTxHttpRequestLineRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HTTP_REQLINEMATCH, DetectEngineInspectHttpRequestLine); return; } /** * \brief The setup function for the http_request_line keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to the signature for the current Signature being * parsed from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpRequestLineSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { s->list = DETECT_SM_LIST_HTTP_REQLINEMATCH; s->alproto = ALPROTO_HTTP; return 0; } /** \brief HTTP request line Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpRequestLine(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_line == NULL) return; const uint32_t buffer_len = bstr_len(tx->request_line); const uint8_t *buffer = bstr_ptr(tx->request_line); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } static int PrefilterTxHttpRequestLineRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestLine, ALPROTO_HTTP, HTP_REQUEST_LINE, mpm_ctx, NULL, "http_request_line"); } /** * \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags app layer flags * \param state App layer state * * \retval 0 no match. * \retval 1 match. * \retval 2 Sig can't match. */ static int DetectEngineInspectHttpRequestLine(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_line == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_REQUEST_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; /* Inspect all the uricontents fetched on each * transaction at the app layer */ int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HTTP_REQLINEMATCH], f, bstr_ptr(tx->request_line), bstr_len(tx->request_line), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_request_line is correctly parsed * and the keyword is registered. */ static int DetectHttpRequestLineTest01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(http_request_line; content:\"GET /\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); DetectEngineCtxFree(de_ctx); PASS; } /** *\test Test that the http_request_line content matches against a http request * which holds the content. */ static int DetectHttpRequestLineTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); FAIL_IF_NULL(alp_tctx); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FAIL_IF_NULL(p); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(http_request_line; content:\"GET /index.html HTTP/1.0\"; " "sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(&th_v, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); FAIL_IF(r != 0); http_state = f.alstate; FAIL_IF_NULL(http_state); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } #endif /* UNITTESTS */ void DetectHttpRequestLineRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpRequestLineTest01", DetectHttpRequestLineTest01); UtRegisterTest("DetectHttpRequestLineTest02", DetectHttpRequestLineTest02); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/app-layer-htp-body.c0000644000000000000000000001614013051004444014565 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh * \author Pablo Rincon * \author Brian Rectanus * * This file provides a HTTP protocol support for the engine using HTP library. */ #include "suricata.h" #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-radix-tree.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "util-spm.h" #include "util-debug.h" #include "app-layer-htp-file.h" #include "util-time.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow-util.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-parse.h" #include "conf.h" #include "util-memcmp.h" static StreamingBufferConfig default_cfg = { 0, 0, 3072, HTPMalloc, HTPCalloc, HTPRealloc, HTPFree }; /** * \brief Append a chunk of body to the HtpBody struct * * \param body pointer to the HtpBody holding the list * \param data pointer to the data of the chunk * \param len length of the chunk pointed by data * * \retval 0 ok * \retval -1 error */ int HtpBodyAppendChunk(const HTPCfgDir *hcfg, HtpBody *body, const uint8_t *data, uint32_t len) { SCEnter(); HtpBodyChunk *bd = NULL; if (len == 0 || data == NULL) { SCReturnInt(0); } if (body->sb == NULL) { const StreamingBufferConfig *cfg = hcfg ? &hcfg->sbcfg : &default_cfg; body->sb = StreamingBufferInit(cfg); if (body->sb == NULL) SCReturnInt(-1); } if (body->first == NULL) { /* New chunk */ bd = (HtpBodyChunk *)HTPCalloc(1, sizeof(HtpBodyChunk)); if (bd == NULL) { SCReturnInt(-1); } if (StreamingBufferAppend(body->sb, &bd->sbseg, data, len) != 0) { HTPFree(bd, sizeof(HtpBodyChunk)); SCReturnInt(-1); } body->first = body->last = bd; body->content_len_so_far = len; } else { bd = (HtpBodyChunk *)HTPCalloc(1, sizeof(HtpBodyChunk)); if (bd == NULL) { SCReturnInt(-1); } if (StreamingBufferAppend(body->sb, &bd->sbseg, data, len) != 0) { HTPFree(bd, sizeof(HtpBodyChunk)); SCReturnInt(-1); } body->last->next = bd; body->last = bd; body->content_len_so_far += len; } SCLogDebug("body %p", body); SCReturnInt(0); } /** * \brief Print the information and chunks of a Body * \param body pointer to the HtpBody holding the list * \retval none */ void HtpBodyPrint(HtpBody *body) { if (SCLogDebugEnabled()||1) { SCEnter(); if (body->first == NULL) return; HtpBodyChunk *cur = NULL; SCLogDebug("--- Start body chunks at %p ---", body); printf("--- Start body chunks at %p ---\n", body); for (cur = body->first; cur != NULL; cur = cur->next) { const uint8_t *data = NULL; uint32_t data_len = 0; StreamingBufferSegmentGetData(body->sb, &cur->sbseg, &data, &data_len); SCLogDebug("Body %p; data %p, len %"PRIu32, body, data, data_len); printf("Body %p; data %p, len %"PRIu32"\n", body, data, data_len); PrintRawDataFp(stdout, data, data_len); } SCLogDebug("--- End body chunks at %p ---", body); } } /** * \brief Free the information held in the request body * \param body pointer to the HtpBody holding the list * \retval none */ void HtpBodyFree(HtpBody *body) { SCEnter(); SCLogDebug("removing chunks of body %p", body); HtpBodyChunk *cur = NULL; HtpBodyChunk *prev = NULL; prev = body->first; while (prev != NULL) { cur = prev->next; HTPFree(prev, sizeof(HtpBodyChunk)); prev = cur; } body->first = body->last = NULL; StreamingBufferFree(body->sb); } /** * \brief Free request body chunks that are already fully parsed. * * \param state htp_state, with reference to our config * \param body the body to prune * \param direction STREAM_TOSERVER (request), STREAM_TOCLIENT (response) * * \retval none */ void HtpBodyPrune(HtpState *state, HtpBody *body, int direction) { SCEnter(); if (body == NULL || body->first == NULL) { SCReturn; } if (body->body_parsed == 0) { SCReturn; } /* get the configured inspect sizes. Default to response values */ uint32_t min_size = state->cfg->response.inspect_min_size; uint32_t window = state->cfg->response.inspect_window; if (direction == STREAM_TOSERVER) { min_size = state->cfg->request.inspect_min_size; window = state->cfg->request.inspect_window; } uint64_t max_window = ((min_size > window) ? min_size : window); uint64_t in_flight = body->content_len_so_far - body->body_inspected; /* Special case. If body_inspected is not being updated, we make sure that * we prune the body. We allow for some extra size/room as we may be called * multiple times on uninspected body chunk additions if a large block of * data was ack'd at once. Want to avoid pruning before inspection. */ if (in_flight > (max_window * 3)) { body->body_inspected = body->content_len_so_far - max_window; } else if (body->body_inspected < max_window) { SCReturn; } uint64_t left_edge = body->body_inspected; if (left_edge <= min_size || left_edge <= window) left_edge = 0; if (left_edge) left_edge -= window; if (left_edge) { SCLogDebug("sliding body to offset %"PRIu64, left_edge); StreamingBufferSlideToOffset(body->sb, left_edge); } SCLogDebug("pruning chunks of body %p", body); HtpBodyChunk *cur = body->first; while (cur != NULL) { HtpBodyChunk *next = cur->next; SCLogDebug("cur %p", cur); if (!StreamingBufferSegmentIsBeforeWindow(body->sb, &cur->sbseg)) { SCLogDebug("not removed"); break; } body->first = next; if (body->last == cur) { body->last = next; } HTPFree(cur, sizeof(HtpBodyChunk)); cur = next; SCLogDebug("removed"); } SCReturn; } suricata-3.2.1/src/detect-ttl.h0000644000000000000000000000261013051004444013222 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_TTL_H #define _DETECT_TTL_H #define DETECT_TTL_LT 0 /**< "less than" operator */ #define DETECT_TTL_EQ 1 /**< "equals" operator (default) */ #define DETECT_TTL_GT 2 /**< "greater than" operator */ #define DETECT_TTL_RA 3 /**< "range" operator */ typedef struct DetectTtlData_ { uint8_t ttl1; /**< first ttl value in the signature*/ uint8_t ttl2; /**< second ttl value in the signature, in case of range operator*/ uint8_t mode; /**< operator used in the signature */ }DetectTtlData; void DetectTtlRegister(void); #endif /* _DETECT_TTL_H */ suricata-3.2.1/src/util-ringbuffer.h0000644000000000000000000001142213051004444014256 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * See the .c file for a full explanation. */ #ifndef __UTIL_RINGBUFFER_H__ #include "util-atomic.h" #include "threads.h" /** When the ringbuffer is full we have two options, either we spin & sleep * or we use a pthread condition to wait. * * \warning this approach isn't working due to a race condition between the * time it takes for a thread to enter the condwait and the * signalling. I've obverved the following case: T1 sees that the * ringbuffer is empty, so it decides to start the wait condition. * While it is acquiring the lock and entering the wait, T0 puts a * number of items in the buffer. For each of these it signals T1. * However, as that thread isn't in the "wait" mode yet, the signals * are lost. T0 now is done as well and enters it's own wait * condition. T1 completes it's "wait" initialization. It waits for * signals, but T0 won't be able to send them as it's waiting itself. */ //#define RINGBUFFER_MUTEX_WAIT /** \brief ring buffer api * * Ring buffer api for a single writer and a single reader. It uses a * read and write pointer. Only the read ptr needs atomic updating. */ #define RING_BUFFER_8_SIZE 256 typedef struct RingBuffer8_ { SC_ATOMIC_DECLARE(unsigned char, write); /**< idx where we put data */ SC_ATOMIC_DECLARE(unsigned char, read); /**< idx where we read data */ uint8_t shutdown; #ifdef RINGBUFFER_MUTEX_WAIT SCCondT wait_cond; SCMutex wait_mutex; #endif /* RINGBUFFER_MUTEX_WAIT */ SCSpinlock spin; /**< lock protecting writes for multi writer mode*/ void *array[RING_BUFFER_8_SIZE]; } RingBuffer8; #define RING_BUFFER_16_SIZE 65536 typedef struct RingBuffer16_ { SC_ATOMIC_DECLARE(unsigned short, write); /**< idx where we put data */ SC_ATOMIC_DECLARE(unsigned short, read); /**< idx where we read data */ uint8_t shutdown; #ifdef RINGBUFFER_MUTEX_WAIT SCCondT wait_cond; SCMutex wait_mutex; #endif /* RINGBUFFER_MUTEX_WAIT */ SCSpinlock spin; /**< lock protecting writes for multi writer mode*/ void *array[RING_BUFFER_16_SIZE]; } RingBuffer16; RingBuffer8 *RingBuffer8Init(void); void RingBuffer8Destroy(RingBuffer8 *); RingBuffer16 *RingBufferInit(void); void RingBufferDestroy(RingBuffer16 *); int RingBufferIsEmpty(RingBuffer16 *); int RingBufferIsFull(RingBuffer16 *); uint16_t RingBufferSize(RingBuffer16 *); void RingBuffer8Shutdown(RingBuffer8 *); void RingBufferShutdown(RingBuffer16 *); void RingBufferWait(RingBuffer16 *rb); /** Single Reader, Single Writer ring buffer, fixed at * 256 items so we can use unsigned char's that just * wrap around */ void *RingBufferSrSw8Get(RingBuffer8 *); int RingBufferSrSw8Put(RingBuffer8 *, void *); /** Multiple Reader, Single Writer ring buffer, fixed at * 256 items so we can use unsigned char's that just * wrap around */ void *RingBufferMrSw8Get(RingBuffer8 *); int RingBufferMrSw8Put(RingBuffer8 *, void *); /** Multiple Reader, Single Writer ring buffer, fixed at * 65536 items so we can use unsigned shorts that just * wrap around */ void *RingBufferMrSwGet(RingBuffer16 *); int RingBufferMrSwPut(RingBuffer16 *, void *); /** Single Reader, Single Writer ring buffer, fixed at * 65536 items so we can use unsigned shorts that just * wrap around */ void *RingBufferSrSwGet(RingBuffer16 *); int RingBufferSrSwPut(RingBuffer16 *, void *); /** Multiple Reader, Multi Writer ring buffer, fixed at * 256 items so we can use unsigned char's that just * wrap around */ void *RingBufferMrMw8Get(RingBuffer8 *); int RingBufferMrMw8Put(RingBuffer8 *, void *); /** Multiple Reader, Multi Writer ring buffer, fixed at * 65536 items so we can use unsigned char's that just * wrap around */ void *RingBufferMrMwGet(RingBuffer16 *); void *RingBufferMrMwGetNoWait(RingBuffer16 *); int RingBufferMrMwPut(RingBuffer16 *, void *); void *RingBufferSrMw8Get(RingBuffer8 *); int RingBufferSrMw8Put(RingBuffer8 *, void *); void DetectRingBufferRegisterTests(void); #endif /* __UTIL_RINGBUFFER_H__ */ suricata-3.2.1/src/util-byte.c0000644000000000000000000003505713051004444013075 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Byte utility functions */ #include "suricata-common.h" #include "util-byte.h" #include "util-unittest.h" #include "util-debug.h" /** \brief Turn byte array into string. * * All non-printables are copied over, except for '\0', which is * turned into literal \0 in the string. * * \param bytes byte array * \param nbytes number of bytes * \return string nul-terminated string or NULL on error */ char *BytesToString(const uint8_t *bytes, size_t nbytes) { size_t n = nbytes + 1; size_t nulls = 0; size_t u; for (u = 0; u < nbytes; u++) { if (bytes[u] == '\0') nulls++; } n += nulls; char *string = SCCalloc(1, n); if (string == NULL) return NULL; if (nulls == 0) { /* no nulls */ memcpy(string, bytes, nbytes); } else { /* nulls present */ char *dst = string; for (u = 0; u < nbytes; u++) { if (bytes[u] == '\0') { *dst++ = '\\'; *dst++ = '0'; } else { *dst++ = bytes[u]; } } } return string; } int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) { uint64_t i64; int ret; /* Uint64 is limited to 8 bytes */ if (len > 8) { /** \todo Need standard return values */ return -1; } ret = ByteExtract(&i64, e, len, bytes); if (ret <= 0) { return ret; } *res = (uint64_t)i64; return ret; } int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes) { uint64_t i64; int ret; /* Uint32 is limited to 4 bytes */ if (len > 4) { /** \todo Need standard return values */ return -1; } ret = ByteExtract(&i64, e, len, bytes); if (ret <= 0) { return ret; } *res = (uint32_t)i64; return ret; } int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes) { uint64_t i64; int ret; /* Uint16 is limited to 2 bytes */ if (len > 2) { /** \todo Need standard return values */ return -1; } ret = ByteExtract(&i64, e, len, bytes); if (ret <= 0) { return ret; } *res = (uint16_t)i64; return ret; } int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str) { const char *ptr = str; char *endptr = NULL; /* 23 - This is the largest string (octal, with a zero prefix) that * will not overflow uint64_t. The only way this length * could be over 23 and still not overflow is if it were zero * prefixed and we only support 1 byte of zero prefix for octal. * * "01777777777777777777777" = 0xffffffffffffffff */ char strbuf[24]; if (len > 23) { SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); return -1; } if (len) { /* Extract out the string so it can be null terminated */ memcpy(strbuf, str, len); strbuf[len] = '\0'; ptr = strbuf; } errno = 0; *res = strtoull(ptr, &endptr, base); if (errno == ERANGE) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); return -1; /* If there is no numeric value in the given string then strtoull(), makes endptr equals to ptr and return 0 as result */ } else if (endptr == ptr && *res == 0) { SCLogDebug("No numeric value"); return -1; } else if (endptr == ptr) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); return -1; } /* This will interfere with some rules that do not know the length * in advance and instead are just using the max. */ #if 0 else if (len && *endptr != '\0') { fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n"); return -1; } #endif return (endptr - ptr); } int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str) { return ByteExtractString(res, base, len, str); } int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str) { uint64_t i64; int ret; ret = ByteExtractString(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (uint32_t)i64; if ((uint64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIu64 " > %" PRIuMAX ")", i64, (uintmax_t)UINT_MAX); return -1; } return ret; } int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str) { uint64_t i64; int ret; ret = ByteExtractString(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (uint16_t)i64; if ((uint64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIu64 " > %" PRIuMAX ")", i64, (uintmax_t)USHRT_MAX); return -1; } return ret; } int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str) { uint64_t i64; int ret; ret = ByteExtractString(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (uint8_t)i64; if ((uint64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIu64 " > %" PRIuMAX ")", i64, (uintmax_t)UCHAR_MAX); return -1; } return ret; } int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str) { const char *ptr = str; char *endptr; /* 23 - This is the largest string (octal, with a zero prefix) that * will not overflow int64_t. The only way this length * could be over 23 and still not overflow is if it were zero * prefixed and we only support 1 byte of zero prefix for octal. * * "-0777777777777777777777" = 0xffffffffffffffff */ char strbuf[24]; if (len > 23) { SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)"); return -1; } if (len) { /* Extract out the string so it can be null terminated */ memcpy(strbuf, str, len); strbuf[len] = '\0'; ptr = strbuf; } errno = 0; *res = strtoll(ptr, &endptr, base); if (errno == ERANGE) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range"); return -1; } else if (endptr == str) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value"); return -1; } /* This will interfere with some rules that do not know the length * in advance and instead are just using the max. */ #if 0 else if (len && *endptr != '\0') { fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n"); return -1; } #endif //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res); return (endptr - ptr); } int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str) { return ByteExtractStringSigned(res, base, len, str); } int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str) { int64_t i64; int ret; ret = ByteExtractStringSigned(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (int32_t)i64; if ((int64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIi64 " > %" PRIiMAX ")\n", i64, (intmax_t)INT_MAX); return -1; } return ret; } int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str) { int64_t i64; int ret; ret = ByteExtractStringSigned(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (int16_t)i64; if ((int64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIi64 " > %" PRIiMAX ")\n", i64, (intmax_t)SHRT_MAX); return -1; } return ret; } int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str) { int64_t i64; int ret; ret = ByteExtractStringSigned(&i64, base, len, str); if (ret <= 0) { return ret; } *res = (int8_t)i64; if ((int64_t)(*res) != i64) { SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range " "(%" PRIi64 " > %" PRIiMAX ")\n", i64, (intmax_t)CHAR_MAX); return -1; } return ret; } /* UNITTESTS */ #ifdef UNITTESTS static int ByteTest01 (void) { uint16_t val = 0x0102; uint16_t i16 = 0xbfbf; uint8_t bytes[2] = { 0x02, 0x01 }; int ret = ByteExtractUint16(&i16, BYTE_LITTLE_ENDIAN, sizeof(bytes), bytes); if ((ret == 2) && (i16 == val)) { return 1; } return 0; } static int ByteTest02 (void) { uint16_t val = 0x0102; uint16_t i16 = 0xbfbf; uint8_t bytes[2] = { 0x01, 0x02 }; int ret = ByteExtractUint16(&i16, BYTE_BIG_ENDIAN, sizeof(bytes), bytes); if ((ret == 2) && (i16 == val)) { return 1; } return 0; } static int ByteTest03 (void) { uint32_t val = 0x01020304; uint32_t i32 = 0xbfbfbfbf; uint8_t bytes[4] = { 0x04, 0x03, 0x02, 0x01 }; int ret = ByteExtractUint32(&i32, BYTE_LITTLE_ENDIAN, sizeof(bytes), bytes); if ((ret == 4) && (i32 == val)) { return 1; } return 0; } static int ByteTest04 (void) { uint32_t val = 0x01020304; uint32_t i32 = 0xbfbfbfbf; uint8_t bytes[4] = { 0x01, 0x02, 0x03, 0x04 }; int ret = ByteExtractUint32(&i32, BYTE_BIG_ENDIAN, sizeof(bytes), bytes); if ((ret == 4) && (i32 == val)) { return 1; } return 0; } static int ByteTest05 (void) { uint64_t val = 0x0102030405060708ULL; uint64_t i64 = 0xbfbfbfbfbfbfbfbfULL; uint8_t bytes[8] = { 0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01 }; int ret = ByteExtractUint64(&i64, BYTE_LITTLE_ENDIAN, sizeof(bytes), bytes); if ((ret == 8) && (i64 == val)) { return 1; } return 0; } static int ByteTest06 (void) { uint64_t val = 0x0102030405060708ULL; uint64_t i64 = 0xbfbfbfbfbfbfbfbfULL; uint8_t bytes[8] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 }; int ret = ByteExtractUint64(&i64, BYTE_BIG_ENDIAN, sizeof(bytes), bytes); if ((ret == 8) && (i64 == val)) { return 1; } return 0; } static int ByteTest07 (void) { const char *str = "1234567890"; uint64_t val = 1234567890; uint64_t i64 = 0xbfbfbfbfbfbfbfbfULL; int ret = ByteExtractStringUint64(&i64, 10, strlen(str), str); if ((ret == 10) && (i64 == val)) { return 1; } return 0; } static int ByteTest08 (void) { const char *str = "1234567890"; uint32_t val = 1234567890; uint32_t i32 = 0xbfbfbfbf; int ret = ByteExtractStringUint32(&i32, 10, strlen(str), str); if ((ret == 10) && (i32 == val)) { return 1; } return 0; } static int ByteTest09 (void) { const char *str = "12345"; uint16_t val = 12345; uint16_t i16 = 0xbfbf; int ret = ByteExtractStringUint16(&i16, 10, strlen(str), str); if ((ret == 5) && (i16 == val)) { return 1; } return 0; } static int ByteTest10 (void) { const char *str = "123"; uint8_t val = 123; uint8_t i8 = 0xbf; int ret = ByteExtractStringUint8(&i8, 10, strlen(str), str); if ((ret == 3) && (i8 == val)) { return 1; } return 0; } static int ByteTest11 (void) { const char *str = "-1234567890"; int64_t val = -1234567890; int64_t i64 = 0xbfbfbfbfbfbfbfbfULL; int ret = ByteExtractStringInt64(&i64, 10, strlen(str), str); if ((ret == 11) && (i64 == val)) { return 1; } return 0; } static int ByteTest12 (void) { const char *str = "-1234567890"; int32_t val = -1234567890; int32_t i32 = 0xbfbfbfbf; int ret = ByteExtractStringInt32(&i32, 10, strlen(str), str); if ((ret == 11) && (i32 == val)) { return 1; } return 0; } static int ByteTest13 (void) { const char *str = "-12345"; int16_t val = -12345; int16_t i16 = 0xbfbf; int ret = ByteExtractStringInt16(&i16, 10, strlen(str), str); if ((ret == 6) && (i16 == val)) { return 1; } return 0; } static int ByteTest14 (void) { const char *str = "-123"; int8_t val = -123; int8_t i8 = 0xbf; int ret = ByteExtractStringInt8(&i8, 10, strlen(str), str); if ((ret == 4) && (i8 == val)) { return 1; } return 0; } /** \test max u32 value */ static int ByteTest15 (void) { const char *str = "4294967295"; uint32_t val = 4294967295UL; uint32_t u32 = 0xffffffff; int ret = ByteExtractStringUint32(&u32, 10, strlen(str), str); if ((ret == 10) && (u32 == val)) { return 1; } return 0; } /** \test max u32 value + 1 */ static int ByteTest16 (void) { const char *str = "4294967296"; uint32_t u32 = 0; int ret = ByteExtractStringUint32(&u32, 10, strlen(str), str); if (ret != 0) { return 1; } return 0; } #endif /* UNITTESTS */ void ByteRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ByteTest01", ByteTest01); UtRegisterTest("ByteTest02", ByteTest02); UtRegisterTest("ByteTest03", ByteTest03); UtRegisterTest("ByteTest04", ByteTest04); UtRegisterTest("ByteTest05", ByteTest05); UtRegisterTest("ByteTest06", ByteTest06); UtRegisterTest("ByteTest07", ByteTest07); UtRegisterTest("ByteTest08", ByteTest08); UtRegisterTest("ByteTest09", ByteTest09); UtRegisterTest("ByteTest10", ByteTest10); UtRegisterTest("ByteTest11", ByteTest11); UtRegisterTest("ByteTest12", ByteTest12); UtRegisterTest("ByteTest13", ByteTest13); UtRegisterTest("ByteTest14", ByteTest14); UtRegisterTest("ByteTest15", ByteTest15); UtRegisterTest("ByteTest16", ByteTest16); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-flowbits.h0000644000000000000000000000251113051004444014250 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Breno Silva */ #ifndef __DETECT_FLOWBITS_H__ #define __DETECT_FLOWBITS_H__ #define DETECT_FLOWBITS_CMD_SET 0 #define DETECT_FLOWBITS_CMD_TOGGLE 1 #define DETECT_FLOWBITS_CMD_UNSET 2 #define DETECT_FLOWBITS_CMD_ISNOTSET 3 #define DETECT_FLOWBITS_CMD_ISSET 4 #define DETECT_FLOWBITS_CMD_NOALERT 5 #define DETECT_FLOWBITS_CMD_MAX 6 typedef struct DetectFlowbitsData_ { uint16_t idx; uint8_t cmd; } DetectFlowbitsData; /* prototypes */ void DetectFlowbitsRegister (void); #endif /* __DETECT_FLOWBITS_H__ */ suricata-3.2.1/src/util-clock.h0000644000000000000000000000233213051004444013220 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_CLOCK_H__ #define __UTIL_CLOCK_H__ #include /* Feel free to add more macros */ #define CLOCK_INIT clock_t clo1, clo2; clo1 = clo2 = 0; #define CLOCK_START clo1 = clock() #define CLOCK_END clo2 = clock() #define CLOCK_PRINT_SEC printf("Seconds spent: %.4fs\n", ((clo2 - clo1)/(double)CLOCKS_PER_SEC)) #define GET_CLOCK_END_SECS ((clo1 - clo2)/(double)CLOCKS_PER_SEC) #endif /*__UTIL_CLOCK_H__ */ suricata-3.2.1/src/decode-sll.c0000644000000000000000000000414613051004444013165 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decodes Sll */ #include "suricata-common.h" #include "decode.h" #include "decode-sll.h" #include "decode-events.h" #include "util-debug.h" int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_sll); if (unlikely(len < SLL_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, SLL_PKT_TOO_SMALL); return TM_ECODE_FAILED; } SllHdr *sllh = (SllHdr *)pkt; if (unlikely(sllh == NULL)) return TM_ECODE_FAILED; SCLogDebug("p %p pkt %p sll_protocol %04x", p, pkt, ntohs(sllh->sll_protocol)); switch (ntohs(sllh->sll_protocol)) { case ETHERNET_TYPE_IP: DecodeIPV4(tv, dtv, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq); break; case ETHERNET_TYPE_IPV6: DecodeIPV6(tv, dtv, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq); break; case ETHERNET_TYPE_VLAN: DecodeVLAN(tv, dtv, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq); break; default: SCLogDebug("p %p pkt %p sll type %04x not supported", p, pkt, ntohs(sllh->sll_protocol)); } return TM_ECODE_OK; } /** * @} */ suricata-3.2.1/src/detect-file-data.c0000644000000000000000000002105013051004444014237 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-engine-filedata-smtp.h" #include "detect-engine-hsbd.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectFiledataSetup (DetectEngineCtx *, Signature *, char *); static void DetectFiledataRegisterTests(void); /** * \brief Registration function for keyword: file_data */ void DetectFiledataRegister(void) { sigmatch_table[DETECT_FILE_DATA].name = "file_data"; sigmatch_table[DETECT_FILE_DATA].desc = "make content keywords match on HTTP response body"; sigmatch_table[DETECT_FILE_DATA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#file-data"; sigmatch_table[DETECT_FILE_DATA].Match = NULL; sigmatch_table[DETECT_FILE_DATA].AppLayerMatch = NULL; sigmatch_table[DETECT_FILE_DATA].Setup = DetectFiledataSetup; sigmatch_table[DETECT_FILE_DATA].Free = NULL; sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests; sigmatch_table[DETECT_FILE_DATA].flags = SIGMATCH_NOOPT; DetectMpmAppLayerRegister("file_data", SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, 2, PrefilterTxSmtpFiledataRegister); DetectMpmAppLayerRegister("file_data", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, 2, PrefilterTxHttpResponseBodyRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, DetectEngineInspectHttpServerBody); DetectAppLayerInspectEngineRegister(ALPROTO_SMTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, DetectEngineInspectSMTPFiledata); } /** * \brief this function is used to parse filedata options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filestore" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); if (!DetectProtoContainsProto(&s->proto, IPPROTO_TCP) && s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP && s->alproto != ALPROTO_SMTP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); return -1; } if (s->alproto == ALPROTO_HTTP && (s->init_flags & SIG_FLAG_INIT_FLOW) && (s->flags & SIG_FLAG_TOSERVER) && !(s->flags & SIG_FLAG_TOCLIENT)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_server or from_client with http."); return -1; } if (s->alproto == ALPROTO_SMTP && (s->init_flags & SIG_FLAG_INIT_FLOW) && !(s->flags & SIG_FLAG_TOSERVER) && (s->flags & SIG_FLAG_TOCLIENT)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_client or from_server with smtp."); return -1; } s->list = DETECT_SM_LIST_FILEDATA; return 0; } #ifdef UNITTESTS static int DetectFiledataParseTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content is still in FILEDATA list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int DetectFiledataParseTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content is still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int DetectFiledataParseTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any 25 " "(msg:\"test\"; flow:to_server,established; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content is still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test the file_data fails with flow:to_server. */ static int DetectFiledataParseTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any " "(msg:\"test\"; flow:to_client,established; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 1; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test the file_data fails with flow:to_server. */ static int DetectFiledataParseTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"test\"; flow:to_server,established; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 1; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif void DetectFiledataRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFiledataParseTest01", DetectFiledataParseTest01); UtRegisterTest("DetectFiledataParseTest02", DetectFiledataParseTest02); UtRegisterTest("DetectFiledataParseTest03", DetectFiledataParseTest03); UtRegisterTest("DetectFiledataParseTest04", DetectFiledataParseTest04); UtRegisterTest("DetectFiledataParseTest05", DetectFiledataParseTest05); #endif } suricata-3.2.1/src/detect-http-stat-msg.h0000644000000000000000000000211713051004444015135 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_HTTP_STAT_MSG_H #define _DETECT_HTTP_STAT_MSG_H /* prototypes */ int DetectHttpStatMsgMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t , void *, Signature *, SigMatch *); void DetectHttpStatMsgRegister(void); #endif /* _DETECT_HTTP_STAT_MSG_H */ suricata-3.2.1/src/decode-events.h0000644000000000000000000002614013051004444013702 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #ifndef __DECODE_EVENTS_H__ #define __DECODE_EVENTS_H__ /* packet decoder events */ enum { /* IPV4 EVENTS */ IPV4_PKT_TOO_SMALL = 0, /**< ipv4 pkt smaller than minimum header size */ IPV4_HLEN_TOO_SMALL, /**< ipv4 header smaller than minimum size */ IPV4_IPLEN_SMALLER_THAN_HLEN, /**< ipv4 pkt len smaller than ip header size */ IPV4_TRUNC_PKT, /**< truncated ipv4 packet */ /* IPV4 OPTIONS */ IPV4_OPT_INVALID, /**< invalid ip options */ IPV4_OPT_INVALID_LEN, /**< ip options with invalid len */ IPV4_OPT_MALFORMED, /**< malformed ip options */ IPV4_OPT_PAD_REQUIRED, /**< pad bytes are needed in ip options */ IPV4_OPT_EOL_REQUIRED, /**< "end of list" needed in ip options */ IPV4_OPT_DUPLICATE, /**< duplicated ip option */ IPV4_OPT_UNKNOWN, /**< unknown ip option */ IPV4_WRONG_IP_VER, /**< wrong ip version in ip options */ IPV4_WITH_ICMPV6, /**< IPv4 packet with ICMPv6 header */ /* ICMP EVENTS */ ICMPV4_PKT_TOO_SMALL, /**< icmpv4 packet smaller than minimum size */ ICMPV4_UNKNOWN_TYPE, /**< icmpv4 unknown type */ ICMPV4_UNKNOWN_CODE, /**< icmpv4 unknown code */ ICMPV4_IPV4_TRUNC_PKT, /**< truncated icmpv4 packet */ ICMPV4_IPV4_UNKNOWN_VER, /**< unknown version in icmpv4 packet*/ /* ICMPv6 EVENTS */ ICMPV6_UNKNOWN_TYPE, /**< icmpv6 unknown type */ ICMPV6_UNKNOWN_CODE, /**< icmpv6 unknown code */ ICMPV6_PKT_TOO_SMALL, /**< icmpv6 smaller than minimum size */ ICMPV6_IPV6_UNKNOWN_VER, /**< unknown version in icmpv6 packet */ ICMPV6_IPV6_TRUNC_PKT, /**< truncated icmpv6 packet */ ICMPV6_MLD_MESSAGE_WITH_INVALID_HL, /**< invalid MLD that doesn't have HL 1 */ ICMPV6_UNASSIGNED_TYPE, /**< unsassigned ICMPv6 type */ ICMPV6_EXPERIMENTATION_TYPE, /**< uprivate experimentation ICMPv6 type */ /* IPV6 EVENTS */ IPV6_PKT_TOO_SMALL, /**< ipv6 packet smaller than minimum size */ IPV6_TRUNC_PKT, /**< truncated ipv6 packet */ IPV6_TRUNC_EXTHDR, /**< truncated ipv6 extension header */ IPV6_EXTHDR_DUPL_FH, /**< duplicated "fragment" header in ipv6 extension headers */ IPV6_EXTHDR_USELESS_FH, /**< useless FH: offset 0 + no more fragments */ IPV6_EXTHDR_DUPL_RH, /**< duplicated "routing" header in ipv6 extension headers */ IPV6_EXTHDR_DUPL_HH, /**< duplicated "hop-by-hop" header in ipv6 extension headers */ IPV6_EXTHDR_DUPL_DH, /**< duplicated "destination" header in ipv6 extension headers */ IPV6_EXTHDR_DUPL_AH, /**< duplicated "authentication" header in ipv6 extension headers */ IPV6_EXTHDR_DUPL_EH, /**< duplicated "ESP" header in ipv6 extension headers */ IPV6_EXTHDR_INVALID_OPTLEN, /**< the opt len in an hop or dst hdr is invalid. */ IPV6_WRONG_IP_VER, /**< wrong version in ipv6 */ IPV6_EXTHDR_AH_RES_NOT_NULL, /**< AH hdr reserved fields not null (rfc 4302) */ IPV6_HOPOPTS_UNKNOWN_OPT, /**< unknown HOP opt */ IPV6_HOPOPTS_ONLY_PADDING, /**< all options in HOP opts are padding */ IPV6_DSTOPTS_UNKNOWN_OPT, /**< unknown DST opt */ IPV6_DSTOPTS_ONLY_PADDING, /**< all options in DST opts are padding */ IPV6_EXTHDR_RH_TYPE_0, /**< RH 0 is deprecated as per rfc5095 */ IPV6_EXTHDR_ZERO_LEN_PADN, /**< padN w/o data (0 len) */ IPV6_FH_NON_ZERO_RES_FIELD, /**< reserved field not zero */ IPV6_DATA_AFTER_NONE_HEADER, /**< data after 'none' (59) header */ IPV6_UNKNOWN_NEXT_HEADER, /**< unknown/unsupported next header */ IPV6_WITH_ICMPV4, /**< IPv6 packet with ICMPv4 header */ /* TCP EVENTS */ TCP_PKT_TOO_SMALL, /**< tcp packet smaller than minimum size */ TCP_HLEN_TOO_SMALL, /**< tcp header smaller than minimum size */ TCP_INVALID_OPTLEN, /**< invalid len in tcp options */ /* TCP OPTIONS */ TCP_OPT_INVALID_LEN, /**< tcp option with invalid len */ TCP_OPT_DUPLICATE, /**< duplicated tcp option */ /* UDP EVENTS */ UDP_PKT_TOO_SMALL, /**< udp packet smaller than minimum size */ UDP_HLEN_TOO_SMALL, /**< udp header smaller than minimum size */ UDP_HLEN_INVALID, /**< invalid len of upd header */ /* SLL EVENTS */ SLL_PKT_TOO_SMALL, /**< sll packet smaller than minimum size */ /* ETHERNET EVENTS */ ETHERNET_PKT_TOO_SMALL, /**< ethernet packet smaller than minimum size */ /* PPP EVENTS */ PPP_PKT_TOO_SMALL, /**< ppp packet smaller than minimum size */ PPPVJU_PKT_TOO_SMALL, /**< ppp vj uncompressed packet smaller than minimum size */ PPPIPV4_PKT_TOO_SMALL, /**< ppp ipv4 packet smaller than minimum size */ PPPIPV6_PKT_TOO_SMALL, /**< ppp ipv6 packet smaller than minimum size */ PPP_WRONG_TYPE, /**< wrong type in ppp frame */ PPP_UNSUP_PROTO, /**< protocol not supported for ppp */ /* PPPOE EVENTS */ PPPOE_PKT_TOO_SMALL, /**< pppoe packet smaller than minimum size */ PPPOE_WRONG_CODE, /**< wrong code for pppoe */ PPPOE_MALFORMED_TAGS, /**< malformed tags in pppoe */ /* GRE EVENTS */ GRE_PKT_TOO_SMALL, /**< gre packet smaller than minimum size */ GRE_WRONG_VERSION, /**< wrong version in gre header */ GRE_VERSION0_RECUR, /**< gre v0 recursion control */ GRE_VERSION0_FLAGS, /**< gre v0 flags */ GRE_VERSION0_HDR_TOO_BIG, /**< gre v0 header bigger than maximum size */ GRE_VERSION0_MALFORMED_SRE_HDR, /**< gre v0 malformed source route entry header */ GRE_VERSION1_CHKSUM, /**< gre v1 checksum */ GRE_VERSION1_ROUTE, /**< gre v1 routing */ GRE_VERSION1_SSR, /**< gre v1 strict source route */ GRE_VERSION1_RECUR, /**< gre v1 recursion control */ GRE_VERSION1_FLAGS, /**< gre v1 flags */ GRE_VERSION1_NO_KEY, /**< gre v1 no key present in header */ GRE_VERSION1_WRONG_PROTOCOL, /**< gre v1 wrong protocol */ GRE_VERSION1_MALFORMED_SRE_HDR, /**< gre v1 malformed source route entry header */ GRE_VERSION1_HDR_TOO_BIG, /**< gre v1 header too big */ /* VLAN EVENTS */ VLAN_HEADER_TOO_SMALL, /**< vlan header smaller than minimum size */ VLAN_UNKNOWN_TYPE, /**< vlan unknown type */ VLAN_HEADER_TOO_MANY_LAYERS, /* RAW EVENTS */ IPRAW_INVALID_IPV, /**< invalid ip version in ip raw */ /* LINKTYPE NULL EVENTS */ LTNULL_PKT_TOO_SMALL, /**< pkt too small for lt:null */ LTNULL_UNSUPPORTED_TYPE, /**< pkt has a type that the decoder doesn't support */ /* SCTP EVENTS */ SCTP_PKT_TOO_SMALL, /**< sctp packet smaller than minimum size */ /* Fragmentation reasembly events. */ IPV4_FRAG_PKT_TOO_LARGE, IPV6_FRAG_PKT_TOO_LARGE, IPV4_FRAG_OVERLAP, IPV6_FRAG_OVERLAP, /* Fragment ignored due to internal error */ IPV4_FRAG_IGNORED, IPV6_FRAG_IGNORED, /* IPv4 in IPv6 events */ IPV4_IN_IPV6_PKT_TOO_SMALL, IPV4_IN_IPV6_WRONG_IP_VER, /* IPv6 in IPv6 events */ IPV6_IN_IPV6_PKT_TOO_SMALL, IPV6_IN_IPV6_WRONG_IP_VER, /* MPLS decode events. */ MPLS_HEADER_TOO_SMALL, MPLS_BAD_LABEL_ROUTER_ALERT, MPLS_BAD_LABEL_IMPLICIT_NULL, MPLS_BAD_LABEL_RESERVED, MPLS_UNKNOWN_PAYLOAD_TYPE, /* ERSPAN events */ ERSPAN_HEADER_TOO_SMALL, ERSPAN_UNSUPPORTED_VERSION, ERSPAN_TOO_MANY_VLAN_LAYERS, /* Cisco Fabric Path/DCE events. */ DCE_PKT_TOO_SMALL, /* END OF DECODE EVENTS ON SINGLE PACKET */ DECODE_EVENT_PACKET_MAX, /* STREAM EVENTS */ STREAM_3WHS_ACK_IN_WRONG_DIR, STREAM_3WHS_ASYNC_WRONG_SEQ, STREAM_3WHS_RIGHT_SEQ_WRONG_ACK_EVASION, STREAM_3WHS_SYNACK_IN_WRONG_DIRECTION, STREAM_3WHS_SYNACK_RESEND_WITH_DIFFERENT_ACK, STREAM_3WHS_SYNACK_RESEND_WITH_DIFF_SEQ, STREAM_3WHS_SYNACK_TOSERVER_ON_SYN_RECV, STREAM_3WHS_SYNACK_WITH_WRONG_ACK, STREAM_3WHS_SYNACK_FLOOD, STREAM_3WHS_SYN_RESEND_DIFF_SEQ_ON_SYN_RECV, STREAM_3WHS_SYN_TOCLIENT_ON_SYN_RECV, STREAM_3WHS_WRONG_SEQ_WRONG_ACK, STREAM_4WHS_SYNACK_WITH_WRONG_ACK, STREAM_4WHS_SYNACK_WITH_WRONG_SYN, STREAM_4WHS_WRONG_SEQ, STREAM_4WHS_INVALID_ACK, STREAM_CLOSEWAIT_ACK_OUT_OF_WINDOW, STREAM_CLOSEWAIT_FIN_OUT_OF_WINDOW, STREAM_CLOSEWAIT_PKT_BEFORE_LAST_ACK, STREAM_CLOSEWAIT_INVALID_ACK, STREAM_CLOSING_ACK_WRONG_SEQ, STREAM_CLOSING_INVALID_ACK, STREAM_EST_PACKET_OUT_OF_WINDOW, STREAM_EST_PKT_BEFORE_LAST_ACK, STREAM_EST_SYNACK_RESEND, STREAM_EST_SYNACK_RESEND_WITH_DIFFERENT_ACK, STREAM_EST_SYNACK_RESEND_WITH_DIFF_SEQ, STREAM_EST_SYNACK_TOSERVER, STREAM_EST_SYN_RESEND, STREAM_EST_SYN_RESEND_DIFF_SEQ, STREAM_EST_SYN_TOCLIENT, STREAM_EST_INVALID_ACK, STREAM_FIN_INVALID_ACK, STREAM_FIN1_ACK_WRONG_SEQ, STREAM_FIN1_FIN_WRONG_SEQ, STREAM_FIN1_INVALID_ACK, STREAM_FIN2_ACK_WRONG_SEQ, STREAM_FIN2_FIN_WRONG_SEQ, STREAM_FIN2_INVALID_ACK, STREAM_FIN_BUT_NO_SESSION, STREAM_FIN_OUT_OF_WINDOW, STREAM_LASTACK_ACK_WRONG_SEQ, STREAM_LASTACK_INVALID_ACK, STREAM_RST_BUT_NO_SESSION, STREAM_TIMEWAIT_ACK_WRONG_SEQ, STREAM_TIMEWAIT_INVALID_ACK, STREAM_SHUTDOWN_SYN_RESEND, STREAM_PKT_INVALID_TIMESTAMP, STREAM_PKT_INVALID_ACK, STREAM_PKT_BROKEN_ACK, STREAM_RST_INVALID_ACK, STREAM_PKT_RETRANSMISSION, STREAM_PKT_BAD_WINDOW_UPDATE, STREAM_REASSEMBLY_SEGMENT_BEFORE_BASE_SEQ, STREAM_REASSEMBLY_NO_SEGMENT, STREAM_REASSEMBLY_SEQ_GAP, STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA, /* should always be last! */ DECODE_EVENT_MAX, }; #define EVENT_IS_DECODER_PACKET_ERROR(e) \ ((e) < (DECODE_EVENT_PACKET_MAX)) /* supported decoder events */ struct DecodeEvents_ { char *event_name; uint8_t code; }; extern const struct DecodeEvents_ DEvents[DECODE_EVENT_MAX]; #endif /* __DECODE_EVENTS_H__ */ suricata-3.2.1/src/app-layer-smtp.c0000644000000000000000000053163613051004444014036 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata.h" #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-detect-proto.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-smtp.h" #include "util-mpm.h" #include "util-debug.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" #include "flow-util.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-parse.h" #include "decode-events.h" #include "conf.h" #include "util-mem.h" #include "util-misc.h" /* content-limit default value */ #define FILEDATA_CONTENT_LIMIT 100000 /* content-inspect-min-size default value */ #define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768 /* content-inspect-window default value */ #define FILEDATA_CONTENT_INSPECT_WINDOW 4096 #define SMTP_MAX_REQUEST_AND_REPLY_LINE_LENGTH 510 #define SMTP_COMMAND_BUFFER_STEPS 5 /* we are in process of parsing a fresh command. Just a placeholder. If we * are not in STATE_COMMAND_DATA_MODE, we have to be in this mode */ #define SMTP_PARSER_STATE_COMMAND_MODE 0x00 /* we are in mode of parsing a command's data. Used when we are parsing tls * or accepting the rfc 2822 mail after DATA command */ #define SMTP_PARSER_STATE_COMMAND_DATA_MODE 0x01 /* Used when we are still in the process of parsing a server command. Used * with multi-line replies and the stream is fragmented before all the lines * for a response is seen */ #define SMTP_PARSER_STATE_PARSING_SERVER_RESPONSE 0x02 /* Used to indicate that the parser has seen the first reply */ #define SMTP_PARSER_STATE_FIRST_REPLY_SEEN 0x04 /* Used to indicate that the parser is parsing a multiline reply */ #define SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY 0x08 /* Various SMTP commands * We currently have var-ified just STARTTLS and DATA, since we need to them * for state transitions. The rest are just indicate as OTHER_CMD. Other * commands would be introduced as and when needed */ #define SMTP_COMMAND_STARTTLS 1 #define SMTP_COMMAND_DATA 2 #define SMTP_COMMAND_BDAT 3 /* not an actual command per se, but the mode where we accept the mail after * DATA has it's own reply code for completion, from the server. We give this * stage a pseudo command of it's own, so that we can add this to the command * buffer to match with the reply */ #define SMTP_COMMAND_DATA_MODE 4 /* All other commands are represented by this var */ #define SMTP_COMMAND_OTHER_CMD 5 /* Different EHLO extensions. Not used now. */ #define SMTP_EHLO_EXTENSION_PIPELINING #define SMTP_EHLO_EXTENSION_SIZE #define SMTP_EHLO_EXTENSION_DSN #define SMTP_EHLO_EXTENSION_STARTTLS #define SMTP_EHLO_EXTENSION_8BITMIME SCEnumCharMap smtp_decoder_event_table[ ] = { { "INVALID_REPLY", SMTP_DECODER_EVENT_INVALID_REPLY }, { "UNABLE_TO_MATCH_REPLY_WITH_REQUEST", SMTP_DECODER_EVENT_UNABLE_TO_MATCH_REPLY_WITH_REQUEST }, { "MAX_COMMAND_LINE_LEN_EXCEEDED", SMTP_DECODER_EVENT_MAX_COMMAND_LINE_LEN_EXCEEDED }, { "MAX_REPLY_LINE_LEN_EXCEEDED", SMTP_DECODER_EVENT_MAX_REPLY_LINE_LEN_EXCEEDED }, { "INVALID_PIPELINED_SEQUENCE", SMTP_DECODER_EVENT_INVALID_PIPELINED_SEQUENCE }, { "BDAT_CHUNK_LEN_EXCEEDED", SMTP_DECODER_EVENT_BDAT_CHUNK_LEN_EXCEEDED }, { "NO_SERVER_WELCOME_MESSAGE", SMTP_DECODER_EVENT_NO_SERVER_WELCOME_MESSAGE }, { "TLS_REJECTED", SMTP_DECODER_EVENT_TLS_REJECTED }, { "DATA_COMMAND_REJECTED", SMTP_DECODER_EVENT_DATA_COMMAND_REJECTED }, /* MIME Events */ { "MIME_PARSE_FAILED", SMTP_DECODER_EVENT_MIME_PARSE_FAILED }, { "MIME_MALFORMED_MSG", SMTP_DECODER_EVENT_MIME_MALFORMED_MSG }, { "MIME_INVALID_BASE64", SMTP_DECODER_EVENT_MIME_INVALID_BASE64 }, { "MIME_INVALID_QP", SMTP_DECODER_EVENT_MIME_INVALID_QP }, { "MIME_LONG_LINE", SMTP_DECODER_EVENT_MIME_LONG_LINE }, { "MIME_LONG_ENC_LINE", SMTP_DECODER_EVENT_MIME_LONG_ENC_LINE }, { "MIME_LONG_HEADER_NAME", SMTP_DECODER_EVENT_MIME_LONG_HEADER_NAME }, { "MIME_LONG_HEADER_VALUE", SMTP_DECODER_EVENT_MIME_LONG_HEADER_VALUE }, { "MIME_LONG_BOUNDARY", SMTP_DECODER_EVENT_MIME_BOUNDARY_TOO_LONG }, /* Invalid behavior or content */ { "DUPLICATE_FIELDS", SMTP_DECODER_EVENT_DUPLICATE_FIELDS }, { "UNPARSABLE_CONTENT", SMTP_DECODER_EVENT_UNPARSABLE_CONTENT }, { NULL, -1 }, }; typedef struct SMTPThreadCtx_ { MpmThreadCtx *smtp_mpm_thread_ctx; PrefilterRuleStore *pmq; } SMTPThreadCtx; #define SMTP_MPM mpm_default_matcher static MpmCtx *smtp_mpm_ctx = NULL; /* smtp reply codes. If an entry is made here, please make a simultaneous * entry in smtp_reply_map */ enum { SMTP_REPLY_211, SMTP_REPLY_214, SMTP_REPLY_220, SMTP_REPLY_221, SMTP_REPLY_235, SMTP_REPLY_250, SMTP_REPLY_251, SMTP_REPLY_252, SMTP_REPLY_334, SMTP_REPLY_354, SMTP_REPLY_421, SMTP_REPLY_450, SMTP_REPLY_451, SMTP_REPLY_452, SMTP_REPLY_455, SMTP_REPLY_500, SMTP_REPLY_501, SMTP_REPLY_502, SMTP_REPLY_503, SMTP_REPLY_504, SMTP_REPLY_550, SMTP_REPLY_551, SMTP_REPLY_552, SMTP_REPLY_553, SMTP_REPLY_554, SMTP_REPLY_555, }; SCEnumCharMap smtp_reply_map[ ] = { { "211", SMTP_REPLY_211 }, { "214", SMTP_REPLY_214 }, { "220", SMTP_REPLY_220 }, { "221", SMTP_REPLY_221 }, { "235", SMTP_REPLY_235 }, { "250", SMTP_REPLY_250 }, { "251", SMTP_REPLY_251 }, { "252", SMTP_REPLY_252 }, { "334", SMTP_REPLY_334 }, { "354", SMTP_REPLY_354 }, { "421", SMTP_REPLY_421 }, { "450", SMTP_REPLY_450 }, { "451", SMTP_REPLY_451 }, { "452", SMTP_REPLY_452 }, { "455", SMTP_REPLY_455 }, { "500", SMTP_REPLY_500 }, { "501", SMTP_REPLY_501 }, { "502", SMTP_REPLY_502 }, { "503", SMTP_REPLY_503 }, { "504", SMTP_REPLY_504 }, { "550", SMTP_REPLY_550 }, { "551", SMTP_REPLY_551 }, { "552", SMTP_REPLY_552 }, { "553", SMTP_REPLY_553 }, { "554", SMTP_REPLY_554 }, { "555", SMTP_REPLY_555 }, { NULL, -1 }, }; /* Create SMTP config structure */ SMTPConfig smtp_config = { 0, { 0, 0, 0, 0, 0 }, 0, 0, 0, STREAMING_BUFFER_CONFIG_INITIALIZER}; static SMTPString *SMTPStringAlloc(void); /** * \brief Configure SMTP Mime Decoder by parsing out mime section of YAML * config file * * \return none */ static void SMTPConfigure(void) { SCEnter(); int ret = 0, val; intmax_t imval; uint32_t content_limit = 0; uint32_t content_inspect_min_size = 0; uint32_t content_inspect_window = 0; ConfNode *config = ConfGetNode("app-layer.protocols.smtp.mime"); if (config != NULL) { ret = ConfGetChildValueBool(config, "decode-mime", &val); if (ret) { smtp_config.decode_mime = val; } ret = ConfGetChildValueBool(config, "decode-base64", &val); if (ret) { smtp_config.mime_config.decode_base64 = val; } ret = ConfGetChildValueBool(config, "decode-quoted-printable", &val); if (ret) { smtp_config.mime_config.decode_quoted_printable = val; } ret = ConfGetChildValueInt(config, "header-value-depth", &imval); if (ret) { smtp_config.mime_config.header_value_depth = (uint32_t) imval; } ret = ConfGetChildValueBool(config, "extract-urls", &val); if (ret) { smtp_config.mime_config.extract_urls = val; } ret = ConfGetChildValueBool(config, "body-md5", &val); if (ret) { smtp_config.mime_config.body_md5 = val; } } /* Pass mime config data to MimeDec API */ MimeDecSetConfig(&smtp_config.mime_config); smtp_config.content_limit = FILEDATA_CONTENT_LIMIT; smtp_config.content_inspect_window = FILEDATA_CONTENT_INSPECT_WINDOW; smtp_config.content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE; ConfNode *t = ConfGetNode("app-layer.protocols.smtp.inspected-tracker"); ConfNode *p = NULL; if (t != NULL) { TAILQ_FOREACH(p, &t->head, next) { if (strcasecmp("content-limit", p->name) == 0) { if (ParseSizeStringU32(p->val, &content_limit) < 0) { SCLogWarning(SC_ERR_SIZE_PARSE, "parsing content-limit %s failed", p->val); content_limit = FILEDATA_CONTENT_LIMIT; } smtp_config.content_limit = content_limit; } if (strcasecmp("content-inspect-min-size", p->name) == 0) { if (ParseSizeStringU32(p->val, &content_inspect_min_size) < 0) { SCLogWarning(SC_ERR_SIZE_PARSE, "parsing content-inspect-min-size %s failed", p->val); content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE; } smtp_config.content_inspect_min_size = content_inspect_min_size; } if (strcasecmp("content-inspect-window", p->name) == 0) { if (ParseSizeStringU32(p->val, &content_inspect_window) < 0) { SCLogWarning(SC_ERR_SIZE_PARSE, "parsing content-inspect-window %s failed", p->val); content_inspect_window = FILEDATA_CONTENT_INSPECT_WINDOW; } smtp_config.content_inspect_window = content_inspect_window; } } } smtp_config.sbcfg.buf_size = content_limit ? content_limit : 256; SCReturn; } void SMTPSetEvent(SMTPState *s, uint8_t e) { SCLogDebug("setting event %u", e); if (s->curr_tx != NULL) { AppLayerDecoderEventsSetEventRaw(&s->curr_tx->decoder_events, e); // s->events++; return; } SCLogDebug("couldn't set event %u", e); } static SMTPTransaction *SMTPTransactionCreate(void) { SMTPTransaction *tx = SCCalloc(1, sizeof(*tx)); if (tx == NULL) { return NULL; } TAILQ_INIT(&tx->rcpt_to_list); tx->mime_state = NULL; return tx; } /** \internal * \brief update inspected tracker if it gets to far behind * * As smtp uses the FILE_USE_DETECT flag in the file API, we are responsible * for making sure that File::content_inspected is not getting too far * behind. */ static void SMTPPruneFiles(FileContainer *files) { SCLogDebug("cfg: win %"PRIu32" min_size %"PRIu32, smtp_config.content_inspect_window, smtp_config.content_inspect_min_size); File *file = files->head; while (file) { SCLogDebug("file %p", file); uint32_t window = smtp_config.content_inspect_window; if (file->sb->stream_offset == 0) window = MAX(window, smtp_config.content_inspect_min_size); uint64_t file_size = FileDataSize(file); uint64_t data_size = file_size - file->sb->stream_offset; SCLogDebug("window %"PRIu32", file_size %"PRIu64", data_size %"PRIu64, window, file_size, data_size); if (data_size > (window * 3)) { uint64_t left_edge = file_size - window; SCLogDebug("file->content_inspected now %"PRIu64, left_edge); file->content_inspected = left_edge; } file = file->next; } } static void FlagDetectStateNewFile(SMTPTransaction *tx) { if (tx && tx->de_state) { SCLogDebug("DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW set"); tx->de_state->dir_state[0].flags |= DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW; } else if (tx == NULL) { SCLogDebug("DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW NOT set, no TX"); } else if (tx->de_state == NULL) { SCLogDebug("DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW NOT set, no TX DESTATE"); } } int SMTPProcessDataChunk(const uint8_t *chunk, uint32_t len, MimeDecParseState *state) { SCEnter(); int ret = MIME_DEC_OK; Flow *flow = (Flow *) state->data; SMTPState *smtp_state = (SMTPState *) flow->alstate; MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data; FileContainer *files = NULL; uint16_t flags = FileFlowToFlags(flow, STREAM_TOSERVER); /* we depend on detection engine for file pruning */ flags |= FILE_USE_DETECT; /* Find file */ if (entity->ctnt_flags & CTNT_IS_ATTACHMENT) { /* Make sure file container allocated */ if (smtp_state->files_ts == NULL) { smtp_state->files_ts = FileContainerAlloc(); if (smtp_state->files_ts == NULL) { ret = MIME_DEC_ERR_MEM; SCLogError(SC_ERR_MEM_ALLOC, "Could not create file container"); SCReturnInt(ret); } } files = smtp_state->files_ts; /* Open file if necessary */ if (state->body_begin) { if (SCLogDebugEnabled()) { SCLogDebug("Opening file...%u bytes", len); printf("File - "); for (uint32_t i = 0; i < entity->filename_len; i++) { printf("%c", entity->filename[i]); } printf("\n"); } /* Set storage flag if applicable since only the first file in the * flow seems to be processed by the 'filestore' detector */ if (files->head != NULL && (files->head->flags & FILE_STORE)) { flags |= FILE_STORE; } if (FileOpenFile(files, &smtp_config.sbcfg, (uint8_t *) entity->filename, entity->filename_len, (uint8_t *) chunk, len, flags) == NULL) { ret = MIME_DEC_ERR_DATA; SCLogDebug("FileOpenFile() failed"); } FlagDetectStateNewFile(smtp_state->curr_tx); /* If close in the same chunk, then pass in empty bytes */ if (state->body_end) { SCLogDebug("Closing file...%u bytes", len); if (files->tail->state == FILE_STATE_OPENED) { ret = FileCloseFile(files, (uint8_t *) NULL, 0, flags); if (ret != 0) { SCLogDebug("FileCloseFile() failed: %d", ret); ret = MIME_DEC_ERR_DATA; } } else { SCLogDebug("File already closed"); } } } else if (state->body_end) { /* Close file */ SCLogDebug("Closing file...%u bytes", len); if (files && files->tail && files->tail->state == FILE_STATE_OPENED) { ret = FileCloseFile(files, (uint8_t *) chunk, len, flags); if (ret != 0) { SCLogDebug("FileCloseFile() failed: %d", ret); ret = MIME_DEC_ERR_DATA; } } else { SCLogDebug("File already closed"); } } else { /* Append data chunk to file */ SCLogDebug("Appending file...%u bytes", len); /* 0 is ok, -2 is not stored, -1 is error */ ret = FileAppendData(files, (uint8_t *) chunk, len); if (ret == -2) { ret = 0; SCLogDebug("FileAppendData() - file no longer being extracted"); } else if (ret < 0) { SCLogDebug("FileAppendData() failed: %d", ret); ret = MIME_DEC_ERR_DATA; } } if (ret == 0) { SCLogDebug("Successfully processed file data!"); } } else { SCLogDebug("Body not a Ctnt_attachment"); } if (files != NULL) { SMTPPruneFiles(files); FilePrune(files); } SCReturnInt(ret); } /** * \internal * \brief Get the next line from input. It doesn't do any length validation. * * \param state The smtp state. * * \retval 0 On suceess. * \retval -1 Either when we don't have any new lines to supply anymore or * on failure. */ static int SMTPGetLine(SMTPState *state) { SCEnter(); void *ptmp; /* we have run out of input */ if (state->input_len <= 0) return -1; /* toserver */ if (state->direction == 0) { if (state->ts_current_line_lf_seen == 1) { /* we have seen the lf for the previous line. Clear the parser * details to parse new line */ state->ts_current_line_lf_seen = 0; if (state->ts_current_line_db == 1) { state->ts_current_line_db = 0; SCFree(state->ts_db); state->ts_db = NULL; state->ts_db_len = 0; state->current_line = NULL; state->current_line_len = 0; } } uint8_t *lf_idx = memchr(state->input, 0x0a, state->input_len); if (lf_idx == NULL) { /* fragmented lines. Decoder event for special cases. Not all * fragmented lines should be treated as a possible evasion * attempt. With multi payload smtp chunks we can have valid * cases of fragmentation. But within the same segment chunk * if we see fragmentation then it's definitely something you * should alert about */ if (state->ts_current_line_db == 0) { state->ts_db = SCMalloc(state->input_len); if (state->ts_db == NULL) { return -1; } state->ts_current_line_db = 1; memcpy(state->ts_db, state->input, state->input_len); state->ts_db_len = state->input_len; } else { ptmp = SCRealloc(state->ts_db, (state->ts_db_len + state->input_len)); if (ptmp == NULL) { SCFree(state->ts_db); state->ts_db = NULL; state->ts_db_len = 0; return -1; } state->ts_db = ptmp; memcpy(state->ts_db + state->ts_db_len, state->input, state->input_len); state->ts_db_len += state->input_len; } /* else */ state->input += state->input_len; state->input_len = 0; return -1; } else { state->ts_current_line_lf_seen = 1; if (state->ts_current_line_db == 1) { ptmp = SCRealloc(state->ts_db, (state->ts_db_len + (lf_idx + 1 - state->input))); if (ptmp == NULL) { SCFree(state->ts_db); state->ts_db = NULL; state->ts_db_len = 0; return -1; } state->ts_db = ptmp; memcpy(state->ts_db + state->ts_db_len, state->input, (lf_idx + 1 - state->input)); state->ts_db_len += (lf_idx + 1 - state->input); if (state->ts_db_len > 1 && state->ts_db[state->ts_db_len - 2] == 0x0D) { state->ts_db_len -= 2; state->current_line_delimiter_len = 2; } else { state->ts_db_len -= 1; state->current_line_delimiter_len = 1; } state->current_line = state->ts_db; state->current_line_len = state->ts_db_len; } else { state->current_line = state->input; state->current_line_len = lf_idx - state->input; if (state->input != lf_idx && *(lf_idx - 1) == 0x0D) { state->current_line_len--; state->current_line_delimiter_len = 2; } else { state->current_line_delimiter_len = 1; } } state->input_len -= (lf_idx - state->input) + 1; state->input = (lf_idx + 1); return 0; } /* toclient */ } else { if (state->tc_current_line_lf_seen == 1) { /* we have seen the lf for the previous line. Clear the parser * details to parse new line */ state->tc_current_line_lf_seen = 0; if (state->tc_current_line_db == 1) { state->tc_current_line_db = 0; SCFree(state->tc_db); state->tc_db = NULL; state->tc_db_len = 0; state->current_line = NULL; state->current_line_len = 0; } } uint8_t *lf_idx = memchr(state->input, 0x0a, state->input_len); if (lf_idx == NULL) { /* fragmented lines. Decoder event for special cases. Not all * fragmented lines should be treated as a possible evasion * attempt. With multi payload smtp chunks we can have valid * cases of fragmentation. But within the same segment chunk * if we see fragmentation then it's definitely something you * should alert about */ if (state->tc_current_line_db == 0) { state->tc_db = SCMalloc(state->input_len); if (state->tc_db == NULL) { return -1; } state->tc_current_line_db = 1; memcpy(state->tc_db, state->input, state->input_len); state->tc_db_len = state->input_len; } else { ptmp = SCRealloc(state->tc_db, (state->tc_db_len + state->input_len)); if (ptmp == NULL) { SCFree(state->tc_db); state->tc_db = NULL; state->tc_db_len = 0; return -1; } state->tc_db = ptmp; memcpy(state->tc_db + state->tc_db_len, state->input, state->input_len); state->tc_db_len += state->input_len; } /* else */ state->input += state->input_len; state->input_len = 0; return -1; } else { state->tc_current_line_lf_seen = 1; if (state->tc_current_line_db == 1) { ptmp = SCRealloc(state->tc_db, (state->tc_db_len + (lf_idx + 1 - state->input))); if (ptmp == NULL) { SCFree(state->tc_db); state->tc_db = NULL; state->tc_db_len = 0; return -1; } state->tc_db = ptmp; memcpy(state->tc_db + state->tc_db_len, state->input, (lf_idx + 1 - state->input)); state->tc_db_len += (lf_idx + 1 - state->input); if (state->tc_db_len > 1 && state->tc_db[state->tc_db_len - 2] == 0x0D) { state->tc_db_len -= 2; state->current_line_delimiter_len = 2; } else { state->tc_db_len -= 1; state->current_line_delimiter_len = 1; } state->current_line = state->tc_db; state->current_line_len = state->tc_db_len; } else { state->current_line = state->input; state->current_line_len = lf_idx - state->input; if (state->input != lf_idx && *(lf_idx - 1) == 0x0D) { state->current_line_len--; state->current_line_delimiter_len = 2; } else { state->current_line_delimiter_len = 1; } } state->input_len -= (lf_idx - state->input) + 1; state->input = (lf_idx + 1); return 0; } /* else - if (lf_idx == NULL) */ } } static int SMTPInsertCommandIntoCommandBuffer(uint8_t command, SMTPState *state, Flow *f) { SCEnter(); void *ptmp; if (state->cmds_cnt >= state->cmds_buffer_len) { int increment = SMTP_COMMAND_BUFFER_STEPS; if ((int)(state->cmds_buffer_len + SMTP_COMMAND_BUFFER_STEPS) > (int)USHRT_MAX) { increment = USHRT_MAX - state->cmds_buffer_len; } ptmp = SCRealloc(state->cmds, sizeof(uint8_t) * (state->cmds_buffer_len + increment)); if (ptmp == NULL) { SCFree(state->cmds); state->cmds = NULL; SCLogDebug("SCRealloc failure"); return -1; } state->cmds = ptmp; state->cmds_buffer_len += increment; } if (state->cmds_cnt >= 1 && ((state->cmds[state->cmds_cnt - 1] == SMTP_COMMAND_STARTTLS) || (state->cmds[state->cmds_cnt - 1] == SMTP_COMMAND_DATA))) { /* decoder event */ SMTPSetEvent(state, SMTP_DECODER_EVENT_INVALID_PIPELINED_SEQUENCE); /* we have to have EHLO, DATA, VRFY, EXPN, TURN, QUIT, NOOP, * STARTTLS as the last command in pipelined mode */ } /** \todo decoder event */ if ((int)(state->cmds_cnt + 1) > (int)USHRT_MAX) { SCLogDebug("command buffer overflow"); return -1; } state->cmds[state->cmds_cnt] = command; state->cmds_cnt++; return 0; } static int SMTPProcessCommandBDAT(SMTPState *state, Flow *f, AppLayerParserState *pstate) { SCEnter(); state->bdat_chunk_idx += (state->current_line_len + state->current_line_delimiter_len); if (state->bdat_chunk_idx > state->bdat_chunk_len) { state->parser_state &= ~SMTP_PARSER_STATE_COMMAND_DATA_MODE; /* decoder event */ SMTPSetEvent(state, SMTP_DECODER_EVENT_BDAT_CHUNK_LEN_EXCEEDED); SCReturnInt(-1); } else if (state->bdat_chunk_idx == state->bdat_chunk_len) { state->parser_state &= ~SMTP_PARSER_STATE_COMMAND_DATA_MODE; } SCReturnInt(0); } static int SMTPProcessCommandDATA(SMTPState *state, Flow *f, AppLayerParserState *pstate) { SCEnter(); if (!(state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { /* looks like are still waiting for a confirmination from the server */ return 0; } if (state->current_line_len == 1 && state->current_line[0] == '.') { state->parser_state &= ~SMTP_PARSER_STATE_COMMAND_DATA_MODE; /* kinda like a hack. The mail sent in DATA mode, would be * acknowledged with a reply. We insert a dummy command to * the command buffer to be used by the reply handler to match * the reply received */ SMTPInsertCommandIntoCommandBuffer(SMTP_COMMAND_DATA_MODE, state, f); if (smtp_config.decode_mime && state->curr_tx->mime_state != NULL) { /* Complete parsing task */ int ret = MimeDecParseComplete(state->curr_tx->mime_state); if (ret != MIME_DEC_OK) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_PARSE_FAILED); SCLogDebug("MimeDecParseComplete() function failed"); } /* Generate decoder events */ MimeDecEntity *msg = state->curr_tx->mime_state->msg; if (msg->anomaly_flags & ANOM_INVALID_BASE64) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_INVALID_BASE64); } if (msg->anomaly_flags & ANOM_INVALID_QP) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_INVALID_QP); } if (msg->anomaly_flags & ANOM_LONG_LINE) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_LONG_LINE); } if (msg->anomaly_flags & ANOM_LONG_ENC_LINE) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_LONG_ENC_LINE); } if (msg->anomaly_flags & ANOM_LONG_HEADER_NAME) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_LONG_HEADER_NAME); } if (msg->anomaly_flags & ANOM_LONG_HEADER_VALUE) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_LONG_HEADER_VALUE); } if (msg->anomaly_flags & ANOM_MALFORMED_MSG) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_MALFORMED_MSG); } if (msg->anomaly_flags & ANOM_LONG_BOUNDARY) { SMTPSetEvent(state, SMTP_DECODER_EVENT_MIME_BOUNDARY_TOO_LONG); } } state->curr_tx->done = 1; SCLogDebug("marked tx as done"); } /* If DATA, then parse out a MIME message */ if (state->current_command == SMTP_COMMAND_DATA && (state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { if (smtp_config.decode_mime && state->curr_tx->mime_state) { int ret = MimeDecParseLine((const uint8_t *) state->current_line, state->current_line_len, state->current_line_delimiter_len, state->curr_tx->mime_state); if (ret != MIME_DEC_OK) { SCLogDebug("MimeDecParseLine() function returned an error code: %d", ret); } } } return 0; } static int SMTPProcessCommandSTARTTLS(SMTPState *state, Flow *f, AppLayerParserState *pstate) { return 0; } static int SMTPProcessReply(SMTPState *state, Flow *f, AppLayerParserState *pstate, SMTPThreadCtx *td) { SCEnter(); uint64_t reply_code = 0; /* the reply code has to contain at least 3 bytes, to hold the 3 digit * reply code */ if (state->current_line_len < 3) { /* decoder event */ SMTPSetEvent(state, SMTP_DECODER_EVENT_INVALID_REPLY); return -1; } if (state->current_line_len >= 4) { if (state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY) { if (state->current_line[3] != '-') { state->parser_state &= ~SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY; } } else { if (state->current_line[3] == '-') { state->parser_state |= SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY; } } } else { if (state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY) { state->parser_state &= ~SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY; } } /* I don't like this pmq reset here. We'll devise a method later, that * should make the use of the mpm very efficient */ PmqReset(td->pmq); int mpm_cnt = mpm_table[SMTP_MPM].Search(smtp_mpm_ctx, td->smtp_mpm_thread_ctx, td->pmq, state->current_line, 3); if (mpm_cnt == 0) { /* set decoder event - reply code invalid */ SMTPSetEvent(state, SMTP_DECODER_EVENT_INVALID_REPLY); SCLogDebug("invalid reply code %02x %02x %02x", state->current_line[0], state->current_line[1], state->current_line[2]); SCReturnInt(-1); } reply_code = smtp_reply_map[td->pmq->rule_id_array[0]].enum_value; if (state->cmds_idx == state->cmds_cnt) { if (!(state->parser_state & SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { /* the first server reply can be a multiline message. Let's * flag the fact that we have seen the first reply only at the end * of a multiline reply */ if (!(state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY)) state->parser_state |= SMTP_PARSER_STATE_FIRST_REPLY_SEEN; if (reply_code == SMTP_REPLY_220) SCReturnInt(0); else { SMTPSetEvent(state, SMTP_DECODER_EVENT_INVALID_REPLY); SCReturnInt(0); } } else { /* decoder event - unable to match reply with request */ SCLogDebug("unable to match reply with request"); SCReturnInt(0); } } if (state->cmds_cnt == 0) { /* reply but not a command we have stored, fall through */ } else if (state->cmds[state->cmds_idx] == SMTP_COMMAND_STARTTLS) { if (reply_code == SMTP_REPLY_220) { /* we are entering STARRTTLS data mode */ state->parser_state |= SMTP_PARSER_STATE_COMMAND_DATA_MODE; AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION | APP_LAYER_PARSER_NO_REASSEMBLY); } else { /* decoder event */ SMTPSetEvent(state, SMTP_DECODER_EVENT_TLS_REJECTED); } } else if (state->cmds[state->cmds_idx] == SMTP_COMMAND_DATA) { if (reply_code == SMTP_REPLY_354) { /* Next comes the mail for the DATA command in toserver direction */ state->parser_state |= SMTP_PARSER_STATE_COMMAND_DATA_MODE; } else { /* decoder event */ SMTPSetEvent(state, SMTP_DECODER_EVENT_DATA_COMMAND_REJECTED); } } else { /* we don't care for any other command for now */ /* check if reply falls in the valid list of replies for SMTP. If not * decoder event */ } /* if it is a multi-line reply, we need to move the index only once for all * the line of the reply. We unset the multiline flag on the last * line of the multiline reply, following which we increment the index */ if (!(state->parser_state & SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY)) { state->cmds_idx++; } /* if we have matched all the buffered commands, reset the cnt and index */ if (state->cmds_idx == state->cmds_cnt) { state->cmds_cnt = 0; state->cmds_idx = 0; } return 0; } static int SMTPParseCommandBDAT(SMTPState *state) { SCEnter(); int i = 4; while (i < state->current_line_len) { if (state->current_line[i] != ' ') { break; } i++; } if (i == 4) { /* decoder event */ return -1; } if (i == state->current_line_len) { /* decoder event */ return -1; } char *endptr = NULL; state->bdat_chunk_len = strtoul((const char *)state->current_line + i, (char **)&endptr, 10); if ((uint8_t *)endptr == state->current_line + i) { /* decoder event */ return -1; } return 0; } static int SMTPParseCommandWithParam(SMTPState *state, uint8_t prefix_len, uint8_t **target, uint16_t *target_len) { int i = prefix_len + 1; int spc_i = 0; while (i < state->current_line_len) { if (state->current_line[i] != ' ') { break; } i++; } /* rfc1870: with the size extension the mail from can be followed by an option. We use the space separator to detect it. */ spc_i = i; while (spc_i < state->current_line_len) { if (state->current_line[spc_i] == ' ') { break; } spc_i++; } *target = SCMalloc(spc_i - i + 1); if (*target == NULL) return -1; memcpy(*target, state->current_line + i, spc_i - i); (*target)[spc_i - i] = '\0'; *target_len = spc_i - i; return 0; } static int SMTPParseCommandHELO(SMTPState *state) { if (state->helo) { SMTPSetEvent(state, SMTP_DECODER_EVENT_DUPLICATE_FIELDS); return 0; } return SMTPParseCommandWithParam(state, 4, &state->helo, &state->helo_len); } static int SMTPParseCommandMAILFROM(SMTPState *state) { if (state->curr_tx->mail_from) { SMTPSetEvent(state, SMTP_DECODER_EVENT_DUPLICATE_FIELDS); return 0; } return SMTPParseCommandWithParam(state, 9, &state->curr_tx->mail_from, &state->curr_tx->mail_from_len); } static int SMTPParseCommandRCPTTO(SMTPState *state) { uint8_t *rcptto; uint16_t rcptto_len; if (SMTPParseCommandWithParam(state, 7, &rcptto, &rcptto_len) == 0) { SMTPString *rcptto_str = SMTPStringAlloc(); if (rcptto_str) { rcptto_str->str = rcptto; rcptto_str->len = rcptto_len; TAILQ_INSERT_TAIL(&state->curr_tx->rcpt_to_list, rcptto_str, next); } else { SCFree(rcptto); return -1; } } else { return -1; } return 0; } /* consider 'rset' and 'quit' to be part of the existing state */ static int NoNewTx(SMTPState *state) { if (!(state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { if (state->current_line_len >= 4 && SCMemcmpLowercase("rset", state->current_line, 4) == 0) { return 1; } else if (state->current_line_len >= 4 && SCMemcmpLowercase("quit", state->current_line, 4) == 0) { return 1; } } return 0; } static int SMTPProcessRequest(SMTPState *state, Flow *f, AppLayerParserState *pstate) { SCEnter(); SMTPTransaction *tx = state->curr_tx; if (state->curr_tx == NULL || (state->curr_tx->done && !NoNewTx(state))) { tx = SMTPTransactionCreate(); if (tx == NULL) return -1; state->curr_tx = tx; TAILQ_INSERT_TAIL(&state->tx_list, tx, next); tx->tx_id = state->tx_cnt++; } if (!(state->parser_state & SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { SMTPSetEvent(state, SMTP_DECODER_EVENT_NO_SERVER_WELCOME_MESSAGE); } /* there are 2 commands that can push it into this COMMAND_DATA mode - * STARTTLS and DATA */ if (!(state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { int r = 0; if (state->current_line_len >= 8 && SCMemcmpLowercase("starttls", state->current_line, 8) == 0) { state->current_command = SMTP_COMMAND_STARTTLS; } else if (state->current_line_len >= 4 && SCMemcmpLowercase("data", state->current_line, 4) == 0) { state->current_command = SMTP_COMMAND_DATA; if (smtp_config.decode_mime) { if (tx->mime_state) { /* We have 2 chained mails and did not detect the end * of first one. So we start a new transaction. */ tx->mime_state->state_flag = PARSE_ERROR; SMTPSetEvent(state, SMTP_DECODER_EVENT_UNPARSABLE_CONTENT); tx = SMTPTransactionCreate(); if (tx == NULL) return -1; state->curr_tx = tx; TAILQ_INSERT_TAIL(&state->tx_list, tx, next); tx->tx_id = state->tx_cnt++; } tx->mime_state = MimeDecInitParser(f, SMTPProcessDataChunk); if (tx->mime_state == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "MimeDecInitParser() failed to " "allocate data"); return MIME_DEC_ERR_MEM; } /* Add new MIME message to end of list */ if (tx->msg_head == NULL) { tx->msg_head = tx->mime_state->msg; tx->msg_tail = tx->mime_state->msg; } else { tx->msg_tail->next = tx->mime_state->msg; tx->msg_tail = tx->mime_state->msg; } } } else if (state->current_line_len >= 4 && SCMemcmpLowercase("bdat", state->current_line, 4) == 0) { r = SMTPParseCommandBDAT(state); if (r == -1) { SCReturnInt(-1); } state->current_command = SMTP_COMMAND_BDAT; state->parser_state |= SMTP_PARSER_STATE_COMMAND_DATA_MODE; } else if (state->current_line_len >= 4 && ((SCMemcmpLowercase("helo", state->current_line, 4) == 0) || SCMemcmpLowercase("ehlo", state->current_line, 4) == 0)) { r = SMTPParseCommandHELO(state); if (r == -1) { SCReturnInt(-1); } state->current_command = SMTP_COMMAND_OTHER_CMD; } else if (state->current_line_len >= 9 && SCMemcmpLowercase("mail from", state->current_line, 9) == 0) { r = SMTPParseCommandMAILFROM(state); if (r == -1) { SCReturnInt(-1); } state->current_command = SMTP_COMMAND_OTHER_CMD; } else if (state->current_line_len >= 7 && SCMemcmpLowercase("rcpt to", state->current_line, 7) == 0) { r = SMTPParseCommandRCPTTO(state); if (r == -1) { SCReturnInt(-1); } state->current_command = SMTP_COMMAND_OTHER_CMD; } else { state->current_command = SMTP_COMMAND_OTHER_CMD; } /* Every command is inserted into a command buffer, to be matched * against reply(ies) sent by the server */ if (SMTPInsertCommandIntoCommandBuffer(state->current_command, state, f) == -1) { SCReturnInt(-1); } SCReturnInt(r); } switch (state->current_command) { case SMTP_COMMAND_STARTTLS: return SMTPProcessCommandSTARTTLS(state, f, pstate); case SMTP_COMMAND_DATA: return SMTPProcessCommandDATA(state, f, pstate); case SMTP_COMMAND_BDAT: return SMTPProcessCommandBDAT(state, f, pstate); default: /* we have nothing to do with any other command at this instant. * Just let it go through */ SCReturnInt(0); } } static int SMTPParse(int direction, Flow *f, SMTPState *state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, SMTPThreadCtx *thread_data) { SCEnter(); if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } state->input = input; state->input_len = input_len; state->direction = direction; /* toserver */ if (direction == 0) { while (SMTPGetLine(state) >= 0) { if (SMTPProcessRequest(state, f, pstate) == -1) SCReturnInt(-1); } /* toclient */ } else { while (SMTPGetLine(state) >= 0) { if (SMTPProcessReply(state, f, pstate, thread_data) == -1) SCReturnInt(-1); } } SCReturnInt(0); } static int SMTPParseClientRecord(Flow *f, void *alstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); /* first arg 0 is toserver */ return SMTPParse(0, f, alstate, pstate, input, input_len, local_data); } static int SMTPParseServerRecord(Flow *f, void *alstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); /* first arg 1 is toclient */ return SMTPParse(1, f, alstate, pstate, input, input_len, local_data); return 0; } /** * \internal * \brief Function to allocate SMTP state memory. */ void *SMTPStateAlloc(void) { SMTPState *smtp_state = SCMalloc(sizeof(SMTPState)); if (unlikely(smtp_state == NULL)) return NULL; memset(smtp_state, 0, sizeof(SMTPState)); smtp_state->cmds = SCMalloc(sizeof(uint8_t) * SMTP_COMMAND_BUFFER_STEPS); if (smtp_state->cmds == NULL) { SCFree(smtp_state); return NULL; } smtp_state->cmds_buffer_len = SMTP_COMMAND_BUFFER_STEPS; TAILQ_INIT(&smtp_state->tx_list); return smtp_state; } static SMTPString *SMTPStringAlloc(void) { SMTPString *smtp_string = SCMalloc(sizeof(SMTPString)); if (unlikely(smtp_string == NULL)) return NULL; memset(smtp_string, 0, sizeof(SMTPString)); return smtp_string; } static void SMTPStringFree(SMTPString *str) { if (str->str) { SCFree(str->str); } SCFree(str); } static void *SMTPLocalStorageAlloc(void) { /* needed by the mpm */ SMTPThreadCtx *td = SCCalloc(1, sizeof(*td)); if (td == NULL) { exit(EXIT_FAILURE); } td->pmq = SCCalloc(1, sizeof(*td->pmq)); if (td->pmq == NULL) { exit(EXIT_FAILURE); } PmqSetup(td->pmq); td->smtp_mpm_thread_ctx = SCCalloc(1, sizeof(MpmThreadCtx)); if (unlikely(td->smtp_mpm_thread_ctx == NULL)) { exit(EXIT_FAILURE); } MpmInitThreadCtx(td->smtp_mpm_thread_ctx, SMTP_MPM); return td; } static void SMTPLocalStorageFree(void *ptr) { SMTPThreadCtx *td = ptr; if (td != NULL) { if (td->pmq != NULL) { PmqFree(td->pmq); SCFree(td->pmq); } if (td->smtp_mpm_thread_ctx != NULL) { mpm_table[SMTP_MPM].DestroyThreadCtx(smtp_mpm_ctx, td->smtp_mpm_thread_ctx); SCFree(td->smtp_mpm_thread_ctx); } SCFree(td); } return; } static void SMTPTransactionFree(SMTPTransaction *tx, SMTPState *state) { if (tx->mime_state != NULL) { MimeDecDeInitParser(tx->mime_state); } /* Free list of MIME message recursively */ MimeDecFreeEntity(tx->msg_head); if (tx->decoder_events != NULL) AppLayerDecoderEventsFreeEvents(&tx->decoder_events); if (tx->de_state != NULL) DetectEngineStateFree(tx->de_state); if (tx->mail_from) SCFree(tx->mail_from); SMTPString *str = NULL; while ((str = TAILQ_FIRST(&tx->rcpt_to_list))) { TAILQ_REMOVE(&tx->rcpt_to_list, str, next); SMTPStringFree(str); } #if 0 if (tx->decoder_events->cnt <= smtp_state->events) smtp_state->events -= tx->decoder_events->cnt; else smtp_state->events = 0; #endif SCFree(tx); } /** * \internal * \brief Function to free SMTP state memory. */ static void SMTPStateFree(void *p) { SMTPState *smtp_state = (SMTPState *)p; if (smtp_state->cmds != NULL) { SCFree(smtp_state->cmds); } if (smtp_state->ts_current_line_db) { SCFree(smtp_state->ts_db); } if (smtp_state->tc_current_line_db) { SCFree(smtp_state->tc_db); } if (smtp_state->helo) { SCFree(smtp_state->helo); } FileContainerFree(smtp_state->files_ts); SMTPTransaction *tx = NULL; while ((tx = TAILQ_FIRST(&smtp_state->tx_list))) { TAILQ_REMOVE(&smtp_state->tx_list, tx, next); SMTPTransactionFree(tx, smtp_state); } SCFree(smtp_state); return; } static void SMTPSetMpmState(void) { smtp_mpm_ctx = SCMalloc(sizeof(MpmCtx)); if (unlikely(smtp_mpm_ctx == NULL)) { exit(EXIT_FAILURE); } memset(smtp_mpm_ctx, 0, sizeof(MpmCtx)); MpmInitCtx(smtp_mpm_ctx, SMTP_MPM); uint32_t i = 0; for (i = 0; i < sizeof(smtp_reply_map)/sizeof(SCEnumCharMap) - 1; i++) { SCEnumCharMap *map = &smtp_reply_map[i]; /* The third argument is 3, because reply code is always 3 bytes. */ MpmAddPatternCI(smtp_mpm_ctx, (uint8_t *)map->enum_name, 3, 0 /* defunct */, 0 /* defunct */, i /* pattern id */, i /* rule id */ , 0 /* no flags */); } mpm_table[SMTP_MPM].Prepare(smtp_mpm_ctx); } static void SMTPFreeMpmState(void) { if (smtp_mpm_ctx != NULL) { mpm_table[SMTP_MPM].DestroyCtx(smtp_mpm_ctx); SCFree(smtp_mpm_ctx); smtp_mpm_ctx = NULL; } } int SMTPStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, smtp_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "smtp's enum map table.", event_name); /* yes this is fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } static int SMTPRegisterPatternsForProtocolDetection(void) { if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_SMTP, "EHLO", 4, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_SMTP, "HELO", 4, 0, STREAM_TOSERVER) < 0) { return -1; } if (AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_SMTP, "QUIT", 4, 0, STREAM_TOSERVER) < 0) { return -1; } return 0; } static void SMTPStateTransactionFree (void *state, uint64_t tx_id) { SMTPState *smtp_state = state; SMTPTransaction *tx = NULL; TAILQ_FOREACH(tx, &smtp_state->tx_list, next) { if (tx_id < tx->tx_id) break; else if (tx_id > tx->tx_id) continue; if (tx == smtp_state->curr_tx) smtp_state->curr_tx = NULL; TAILQ_REMOVE(&smtp_state->tx_list, tx, next); SMTPTransactionFree(tx, state); break; } } /** \retval cnt highest tx id */ static uint64_t SMTPStateGetTxCnt(void *state) { uint64_t cnt = 0; SMTPState *smtp_state = state; if (smtp_state) { cnt = smtp_state->tx_cnt; } SCLogDebug("returning %"PRIu64, cnt); return cnt; } static void *SMTPStateGetTx(void *state, uint64_t id) { SMTPState *smtp_state = state; if (smtp_state) { SMTPTransaction *tx = NULL; if (smtp_state->curr_tx == NULL) return NULL; if (smtp_state->curr_tx->tx_id == id) return smtp_state->curr_tx; TAILQ_FOREACH(tx, &smtp_state->tx_list, next) { if (tx->tx_id == id) return tx; } } return NULL; } static void SMTPStateSetTxLogged(void *state, void *vtx, uint32_t logger) { SMTPTransaction *tx = vtx; tx->logged |= logger; } static int SMTPStateGetTxLogged(void *state, void *vtx, uint32_t logger) { SMTPTransaction *tx = vtx; if (tx->logged & logger) return 1; return 0; } static int SMTPStateGetAlstateProgressCompletionStatus(uint8_t direction) { return 1; } static int SMTPStateGetAlstateProgress(void *vtx, uint8_t direction) { SMTPTransaction *tx = vtx; return tx->done; } static FileContainer *SMTPStateGetFiles(void *state, uint8_t direction) { if (state == NULL) return NULL; SMTPState *smtp_state = (SMTPState *)state; if (direction & STREAM_TOCLIENT) { SCReturnPtr(NULL, "FileContainer"); } else { SCLogDebug("smtp_state->files_ts %p", smtp_state->files_ts); SCReturnPtr(smtp_state->files_ts, "FileContainer"); } } static void SMTPStateTruncate(void *state, uint8_t direction) { FileContainer *fc = SMTPStateGetFiles(state, direction); if (fc != NULL) { SCLogDebug("truncating stream, closing files in %s direction (container %p)", direction & STREAM_TOCLIENT ? "STREAM_TOCLIENT" : "STREAM_TOSERVER", fc); FileTruncateAllOpenFiles(fc); } } static AppLayerDecoderEvents *SMTPGetEvents(void *state, uint64_t tx_id) { SCLogDebug("get SMTP events for TX %"PRIu64, tx_id); SMTPTransaction *tx = SMTPStateGetTx(state, tx_id); if (tx != NULL) { return tx->decoder_events; } return NULL; } static DetectEngineState *SMTPGetTxDetectState(void *vtx) { SMTPTransaction *tx = (SMTPTransaction *)vtx; return tx->de_state; } static int SMTPSetTxDetectState(void *state, void *vtx, DetectEngineState *s) { SMTPTransaction *tx = (SMTPTransaction *)vtx; tx->de_state = s; return 0; } /** * \brief Register the SMTP Protocol parser. */ void RegisterSMTPParsers(void) { char *proto_name = "smtp"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_SMTP, proto_name); if (SMTPRegisterPatternsForProtocolDetection() < 0 ) return; } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateAlloc, SMTPStateFree); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMTP, STREAM_TOSERVER, SMTPParseClientRecord); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMTP, STREAM_TOCLIENT, SMTPParseServerRecord); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetEventInfo); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPGetEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_SMTP, NULL, SMTPGetTxDetectState, SMTPSetTxDetectState); AppLayerParserRegisterLocalStorageFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPLocalStorageAlloc, SMTPLocalStorageFree); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateTransactionFree); AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetFiles); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetAlstateProgress); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetTxCnt); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetTx); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateGetTxLogged, SMTPStateSetTxLogged); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_SMTP, SMTPStateGetAlstateProgressCompletionStatus); AppLayerParserRegisterTruncateFunc(IPPROTO_TCP, ALPROTO_SMTP, SMTPStateTruncate); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } SMTPSetMpmState(); SMTPConfigure(); #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMTP, SMTPParserRegisterTests); #endif return; } /** * \brief Free memory allocated for global SMTP parser state. */ void SMTPParserCleanup(void) { SMTPFreeMpmState(); } /***************************************Unittests******************************/ #ifdef UNITTESTS static void SMTPTestInitConfig(void) { MimeDecSetConfig(&smtp_config.mime_config); smtp_config.content_limit = FILEDATA_CONTENT_LIMIT; smtp_config.content_inspect_window = FILEDATA_CONTENT_INSPECT_WINDOW; smtp_config.content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE; smtp_config.sbcfg.buf_size = FILEDATA_CONTENT_INSPECT_WINDOW; } /* * \test Test STARTTLS. */ static int SMTPParserTest01(void) { int result = 0; Flow f; int r = 0; /* 220 mx.google.com ESMTP d15sm986283wfl.6 */ uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x6d, 0x78, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x64, 0x31, 0x35, 0x73, 0x6d, 0x39, 0x38, 0x36, 0x32, 0x38, 0x33, 0x77, 0x66, 0x6c, 0x2e, 0x36, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO [192.168.0.158] */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x5b, 0x31, 0x39, 0x32, 0x2e, 0x31, 0x36, 0x38, 0x2e, 0x30, 0x2e, 0x31, 0x35, 0x38, 0x5d, 0x0d, 0x0a }; uint32_t request1_len = sizeof(request1); /* 250-mx.google.com at your service, [117.198.115.50] * 250-SIZE 35882577 * 250-8BITMIME * 250-STARTTLS * 250 ENHANCEDSTATUSCODES */ uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x6d, 0x78, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x61, 0x74, 0x20, 0x79, 0x6f, 0x75, 0x72, 0x20, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2c, 0x20, 0x5b, 0x31, 0x31, 0x37, 0x2e, 0x31, 0x39, 0x38, 0x2e, 0x31, 0x31, 0x35, 0x2e, 0x35, 0x30, 0x5d, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x33, 0x35, 0x38, 0x38, 0x32, 0x35, 0x37, 0x37, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x42, 0x49, 0x54, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x54, 0x41, 0x52, 0x54, 0x54, 0x4c, 0x53, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x45, 0x4e, 0x48, 0x41, 0x4e, 0x43, 0x45, 0x44, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x43, 0x4f, 0x44, 0x45, 0x53, 0x0d, 0x0a }; uint32_t reply1_len = sizeof(reply1); /* STARTTLS */ uint8_t request2[] = { 0x53, 0x54, 0x41, 0x52, 0x54, 0x54, 0x4c, 0x53, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); /* 220 2.0.0 Ready to start TLS */ uint8_t reply2[] = { 0x32, 0x32, 0x30, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x52, 0x65, 0x61, 0x64, 0x79, 0x20, 0x74, 0x6f, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x54, 0x4c, 0x53, 0x0d, 0x0a }; uint32_t reply2_len = sizeof(reply2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_STARTTLS || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } if (!(f.flags & FLOW_NOPAYLOAD_INSPECTION) || !(ssn.flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) || !(((TcpSession *)f.protoctx)->server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || !(((TcpSession *)f.protoctx)->client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Test multiple DATA commands(full mail transactions). */ static int SMTPParserTest02(void) { int result = 0; Flow f; int r = 0; /* 220 mx.google.com ESMTP d15sm986283wfl.6 */ uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x6d, 0x78, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x64, 0x31, 0x35, 0x73, 0x6d, 0x39, 0x38, 0x36, 0x32, 0x38, 0x33, 0x77, 0x66, 0x6c, 0x2e, 0x36, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO boo.com */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request1_len = sizeof(request1); /* 250-mx.google.com at your service, [117.198.115.50] * 250-SIZE 35882577 * 250-8BITMIME * 250-STARTTLS * 250 ENHANCEDSTATUSCODES */ uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x50, 0x49, 0x50, 0x45, 0x4c, 0x49, 0x4e, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x31, 0x30, 0x32, 0x34, 0x30, 0x30, 0x30, 0x30, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x56, 0x52, 0x46, 0x59, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x54, 0x52, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x4e, 0x48, 0x41, 0x4e, 0x43, 0x45, 0x44, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x43, 0x4f, 0x44, 0x45, 0x53, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x42, 0x49, 0x54, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x44, 0x53, 0x4e, 0x0d, 0x0a }; uint32_t reply1_len = sizeof(reply1); /* MAIL FROM:asdff@asdf.com */ uint8_t request2[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); /* 250 2.1.0 Ok */ uint8_t reply2[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply2_len = sizeof(reply2); /* RCPT TO:bimbs@gmail.com */ uint8_t request3[] = { 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request3_len = sizeof(request3); /* 250 2.1.5 Ok */ uint8_t reply3[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x35, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply3_len = sizeof(reply3); /* DATA */ uint8_t request4[] = { 0x44, 0x41, 0x54, 0x41, 0x0d, 0x0a }; uint32_t request4_len = sizeof(request4); /* 354 End data with .|| */ uint8_t reply4[] = { 0x33, 0x35, 0x34, 0x20, 0x45, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x2e, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x0d, 0x0a }; uint32_t reply4_len = sizeof(reply4); /* FROM:asdff@asdf.com */ uint8_t request5_1[] = { 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request5_1_len = sizeof(request5_1); /* TO:bimbs@gmail.com */ uint8_t request5_2[] = { 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request5_2_len = sizeof(request5_2); /* */ uint8_t request5_3[] = { 0x0d, 0x0a }; uint32_t request5_3_len = sizeof(request5_3); /* this is test mail1 */ uint8_t request5_4[] = { 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x61, 0x69, 0x6c, 0x31, 0x0d, 0x0a }; uint32_t request5_4_len = sizeof(request5_4); /* . */ uint8_t request5_5[] = { 0x2e, 0x0d, 0x0a }; uint32_t request5_5_len = sizeof(request5_5); /* 250 2.0.0 Ok: queued as 6A1AF20BF2 */ uint8_t reply5[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x3a, 0x20, 0x71, 0x75, 0x65, 0x75, 0x65, 0x64, 0x20, 0x61, 0x73, 0x20, 0x36, 0x41, 0x31, 0x41, 0x46, 0x32, 0x30, 0x42, 0x46, 0x32, 0x0d, 0x0a }; uint32_t reply5_len = sizeof(reply5); /* MAIL FROM:asdfg@asdf.com */ uint8_t request6[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x67, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request6_len = sizeof(request6); /* 250 2.1.0 Ok */ uint8_t reply6[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply6_len = sizeof(reply6); /* RCPT TO:bimbs@gmail.com */ uint8_t request7[] = { 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request7_len = sizeof(request7); /* 250 2.1.5 Ok */ uint8_t reply7[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x35, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply7_len = sizeof(reply7); /* DATA */ uint8_t request8[] = { 0x44, 0x41, 0x54, 0x41, 0x0d, 0x0a }; uint32_t request8_len = sizeof(request8); /* 354 End data with .|| */ uint8_t reply8[] = { 0x33, 0x35, 0x34, 0x20, 0x45, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x2e, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x0d, 0x0a }; uint32_t reply8_len = sizeof(reply8); /* FROM:asdfg@gmail.com */ uint8_t request9_1[] = { 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x67, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request9_1_len = sizeof(request9_1); /* TO:bimbs@gmail.com */ uint8_t request9_2[] = { 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request9_2_len = sizeof(request9_2); /* */ uint8_t request9_3[] = { 0x0d, 0x0a }; uint32_t request9_3_len = sizeof(request9_3); /* this is test mail2 */ uint8_t request9_4[] = { 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x61, 0x69, 0x6c, 0x32, 0x0d, 0x0a }; uint32_t request9_4_len = sizeof(request9_4); /* . */ uint8_t request9_5[] = { 0x2e, 0x0d, 0x0a }; uint32_t request9_5_len = sizeof(request9_5); /* 250 2.0.0 Ok: queued as 28CFF20BF2 */ uint8_t reply9[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x3a, 0x20, 0x71, 0x75, 0x65, 0x75, 0x65, 0x64, 0x20, 0x61, 0x73, 0x20, 0x32, 0x38, 0x43, 0x46, 0x46, 0x32, 0x30, 0x42, 0x46, 0x32, 0x0d, 0x0a }; uint32_t reply9_len = sizeof(reply9); /* QUIT */ uint8_t request10[] = { 0x51, 0x55, 0x49, 0x54, 0x0d, 0x0a }; uint32_t request10_len = sizeof(request10); /* 221 2.0.0 Bye */ uint8_t reply10[] = { 0x32, 0x32, 0x31, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x42, 0x79, 0x65, 0x0d, 0x0a }; uint32_t reply10_len = sizeof(reply10); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply3, reply3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request4, request4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply4, reply4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5_1, request5_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5_2, request5_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5_3, request5_3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5_4, request5_4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5_5, request5_5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA_MODE || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply5, reply5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request6, request6_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply6, reply6_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request7, request7_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply7, reply7_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request8, request8_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply8, reply8_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request9_1, request9_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request9_2, request9_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request9_3, request9_3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request9_4, request9_4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request9_5, request9_5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA_MODE || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply9, reply9_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request10, request10_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply10, reply10_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Testing parsing pipelined commands. */ static int SMTPParserTest03(void) { int result = 0; Flow f; int r = 0; /* 220 poona_slack_vm1.localdomain ESMTP Postfix */ uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x50, 0x6f, 0x73, 0x74, 0x66, 0x69, 0x78, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO boo.com */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0a }; uint32_t request1_len = sizeof(request1); /* 250-poona_slack_vm1.localdomain * 250-PIPELINING * 250-SIZE 10240000 * 250-VRFY * 250-ETRN * 250-ENHANCEDSTATUSCODES * 250-8BITMIME * 250 DSN */ uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x50, 0x49, 0x50, 0x45, 0x4c, 0x49, 0x4e, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x31, 0x30, 0x32, 0x34, 0x30, 0x30, 0x30, 0x30, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x56, 0x52, 0x46, 0x59, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x54, 0x52, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x4e, 0x48, 0x41, 0x4e, 0x43, 0x45, 0x44, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x43, 0x4f, 0x44, 0x45, 0x53, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x42, 0x49, 0x54, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x44, 0x53, 0x4e, 0x0d, 0x0a }; uint32_t reply1_len = sizeof(reply1); /* MAIL FROM:pbsf@asdfs.com * RCPT TO:pbsf@asdfs.com * DATA */ uint8_t request2[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x70, 0x62, 0x73, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x70, 0x62, 0x73, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, 0x44, 0x41, 0x54, 0x41, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); /* 250 2.1.0 Ok * 250 2.1.5 Ok * 354 End data with .|| */ uint8_t reply2[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x35, 0x20, 0x4f, 0x6b, 0x0d, 0x0a, 0x33, 0x35, 0x34, 0x20, 0x45, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x2e, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x0d, 0x0a }; uint32_t reply2_len = sizeof(reply2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 3 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->cmds[1] != SMTP_COMMAND_OTHER_CMD || smtp_state->cmds[2] != SMTP_COMMAND_DATA || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test smtp with just delimter instead of . */ static int SMTPParserTest04(void) { int result = 0; Flow f; int r = 0; /* 220 poona_slack_vm1.localdomain ESMTP Postfix */ uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x50, 0x6f, 0x73, 0x74, 0x66, 0x69, 0x78, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO boo.com */ uint8_t request1[] = { 0x32, 0x32, 0x30, 0x20, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x50, 0x6f, 0x73, 0x74, 0x66, 0x69, 0x78, 0x0d, 0x0a }; uint32_t request1_len = sizeof(request1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test STARTTLS fail. */ static int SMTPParserTest05(void) { int result = 0; Flow f; int r = 0; /* 220 poona_slack_vm1.localdomain ESMTP Postfix */ uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x50, 0x6f, 0x73, 0x74, 0x66, 0x69, 0x78, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO boo.com */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request1_len = sizeof(request1); /* 250-poona_slack_vm1.localdomain * 250-PIPELINING * 250-SIZE 10240000 * 250-VRFY * 250-ETRN * 250-ENHANCEDSTATUSCODES * 250-8BITMIME * 250 DSN */ uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x50, 0x49, 0x50, 0x45, 0x4c, 0x49, 0x4e, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x31, 0x30, 0x32, 0x34, 0x30, 0x30, 0x30, 0x30, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x56, 0x52, 0x46, 0x59, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x54, 0x52, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x4e, 0x48, 0x41, 0x4e, 0x43, 0x45, 0x44, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x43, 0x4f, 0x44, 0x45, 0x53, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x42, 0x49, 0x54, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x44, 0x53, 0x4e, 0x0d, 0x0a }; uint32_t reply1_len = sizeof(reply1); /* STARTTLS */ uint8_t request2[] = { 0x53, 0x54, 0x41, 0x52, 0x54, 0x54, 0x4c, 0x53, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); /* 502 5.5.2 Error: command not recognized */ uint8_t reply2[] = { 0x35, 0x30, 0x32, 0x20, 0x35, 0x2e, 0x35, 0x2e, 0x32, 0x20, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x3a, 0x20, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x72, 0x65, 0x63, 0x6f, 0x67, 0x6e, 0x69, 0x7a, 0x65, 0x64, 0x0d, 0x0a }; uint32_t reply2_len = sizeof(reply2); /* QUIT */ uint8_t request3[] = { 0x51, 0x55, 0x49, 0x54, 0x0d, 0x0a }; uint32_t request3_len = sizeof(request3); /* 221 2.0.0 Bye */ uint8_t reply3[] = { 0x32, 0x32, 0x31, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x42, 0x79, 0x65, 0x0d, 0x0a }; uint32_t reply3_len = sizeof(reply3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_STARTTLS || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } if ((f.flags & FLOW_NOPAYLOAD_INSPECTION) || (ssn.flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) || (((TcpSession *)f.protoctx)->server.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) || (((TcpSession *)f.protoctx)->client.flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) { goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply3, reply3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Test multiple DATA commands(full mail transactions). */ static int SMTPParserTest06(void) { int result = 0; Flow f; int r = 0; uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x62, 0x61, 0x79, 0x30, 0x2d, 0x6d, 0x63, 0x36, 0x2d, 0x66, 0x31, 0x30, 0x2e, 0x62, 0x61, 0x79, 0x30, 0x2e, 0x68, 0x6f, 0x74, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x53, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x73, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x74, 0x65, 0x64, 0x20, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x72, 0x63, 0x69, 0x61, 0x6c, 0x20, 0x6f, 0x72, 0x20, 0x62, 0x75, 0x6c, 0x6b, 0x20, 0x65, 0x2d, 0x6d, 0x61, 0x69, 0x6c, 0x20, 0x74, 0x6f, 0x20, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x27, 0x73, 0x20, 0x63, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x72, 0x20, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x20, 0x69, 0x73, 0x20, 0x70, 0x72, 0x6f, 0x68, 0x69, 0x62, 0x69, 0x74, 0x65, 0x64, 0x2e, 0x20, 0x4f, 0x74, 0x68, 0x65, 0x72, 0x20, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x20, 0x61, 0x72, 0x65, 0x20, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x20, 0x61, 0x74, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x63, 0x79, 0x2e, 0x6d, 0x73, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x41, 0x6e, 0x74, 0x69, 0x2d, 0x73, 0x70, 0x61, 0x6d, 0x2f, 0x2e, 0x20, 0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x20, 0x69, 0x6e, 0x20, 0x75, 0x73, 0x65, 0x20, 0x6f, 0x66, 0x20, 0x65, 0x71, 0x75, 0x69, 0x70, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x65, 0x64, 0x20, 0x69, 0x6e, 0x20, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x20, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x2e, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x31, 0x36, 0x20, 0x46, 0x65, 0x62, 0x20, 0x32, 0x30, 0x30, 0x37, 0x20, 0x30, 0x35, 0x3a, 0x30, 0x33, 0x3a, 0x32, 0x33, 0x20, 0x2d, 0x30, 0x38, 0x30, 0x30, 0x20, 0x0d, 0x0a }; uint32_t welcome_reply_len = sizeof(welcome_reply); uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x45, 0x58, 0x43, 0x48, 0x41, 0x4e, 0x47, 0x45, 0x32, 0x2e, 0x63, 0x67, 0x63, 0x65, 0x6e, 0x74, 0x2e, 0x6d, 0x69, 0x61, 0x6d, 0x69, 0x2e, 0x65, 0x64, 0x75, 0x0d, 0x0a }; uint32_t request1_len = sizeof(request1); uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x62, 0x61, 0x79, 0x30, 0x2d, 0x6d, 0x63, 0x36, 0x2d, 0x66, 0x31, 0x30, 0x2e, 0x62, 0x61, 0x79, 0x30, 0x2e, 0x68, 0x6f, 0x74, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x28, 0x33, 0x2e, 0x33, 0x2e, 0x31, 0x2e, 0x34, 0x29, 0x20, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x5b, 0x31, 0x32, 0x39, 0x2e, 0x31, 0x37, 0x31, 0x2e, 0x33, 0x32, 0x2e, 0x35, 0x39, 0x5d, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x32, 0x39, 0x36, 0x39, 0x36, 0x30, 0x30, 0x30, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x50, 0x49, 0x50, 0x45, 0x4c, 0x49, 0x4e, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x62, 0x69, 0x74, 0x6d, 0x69, 0x6d, 0x65, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x42, 0x49, 0x4e, 0x41, 0x52, 0x59, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x43, 0x48, 0x55, 0x4e, 0x4b, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x41, 0x55, 0x54, 0x48, 0x20, 0x4c, 0x4f, 0x47, 0x49, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x41, 0x55, 0x54, 0x48, 0x3d, 0x4c, 0x4f, 0x47, 0x49, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a }; uint32_t reply1_len = sizeof(reply1); /* MAIL FROM:asdff@asdf.com */ uint8_t request2[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); /* 250 2.1.0 Ok */ uint8_t reply2[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply2_len = sizeof(reply2); /* RCPT TO:bimbs@gmail.com */ uint8_t request3[] = { 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; uint32_t request3_len = sizeof(request3); /* 250 2.1.5 Ok */ uint8_t reply3[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x35, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; uint32_t reply3_len = sizeof(reply3); /* BDAT 51 */ uint8_t request4[] = { 0x42, 0x44, 0x41, 0x54, 0x20, 0x35, 0x31, 0x0d, 0x0a, }; uint32_t request4_len = sizeof(request4); uint8_t request5[] = { 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x0d, 0x0a, }; uint32_t request5_len = sizeof(request5); uint8_t request6[] = { 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x66, 0x0d, 0x0a, }; uint32_t request6_len = sizeof(request6); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply3, reply3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request4, request4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_BDAT || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE) || smtp_state->bdat_chunk_len != 51 || smtp_state->bdat_chunk_idx != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5, request5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE) || smtp_state->bdat_chunk_len != 51 || smtp_state->bdat_chunk_idx != 32) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request6, request6_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN || smtp_state->bdat_chunk_len != 51 || smtp_state->bdat_chunk_idx != 51) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test retrieving lines when frag'ed. */ static int SMTPParserTest07(void) { int result = 0; Flow f; int r = 0; const char *request1_str = "EHLO boo.com"; /* EHLO boo.com */ uint8_t request1_1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, }; int32_t request1_1_len = sizeof(request1_1); /* */ uint8_t request1_2[] = { 0x0a }; int32_t request1_2_len = sizeof(request1_2); /* EHLO boo.com */ uint8_t request2[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_1, request1_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->current_line != NULL || smtp_state->current_line_len != 0 || smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != request1_1_len || memcmp(smtp_state->ts_db, request1_1, request1_1_len) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_2, request1_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->ts_db, request1_str, strlen(request1_str)) != 0 || smtp_state->current_line != smtp_state->ts_db || smtp_state->current_line_len != smtp_state->ts_db_len) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 0 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || smtp_state->current_line == NULL || smtp_state->current_line_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->current_line, request1_str, strlen(request1_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test retrieving lines when frag'ed. */ static int SMTPParserTest08(void) { int result = 0; Flow f; int r = 0; const char *request1_str = "EHLO boo.com"; /* EHLO boo.com */ uint8_t request1_1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, }; int32_t request1_1_len = sizeof(request1_1); /* */ uint8_t request1_2[] = { 0x0d, 0x0a }; int32_t request1_2_len = sizeof(request1_2); /* EHLO boo.com */ uint8_t request2[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_1, request1_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->current_line != NULL || smtp_state->current_line_len != 0 || smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != request1_1_len || memcmp(smtp_state->ts_db, request1_1, request1_1_len) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_2, request1_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->ts_db, request1_str, strlen(request1_str)) != 0 || smtp_state->current_line != smtp_state->ts_db || smtp_state->current_line_len != smtp_state->ts_db_len) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 0 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || smtp_state->current_line == NULL || smtp_state->current_line_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->current_line, request1_str, strlen(request1_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test retrieving lines when frag'ed. */ static int SMTPParserTest09(void) { int result = 0; Flow f; int r = 0; const char *request1_str = "EHLO boo.com"; /* EHLO boo. */ uint8_t request1_1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, }; int32_t request1_1_len = sizeof(request1_1); /* com */ uint8_t request1_2[] = { 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; int32_t request1_2_len = sizeof(request1_2); /* EHLO boo.com */ uint8_t request2[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_1, request1_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->current_line != NULL || smtp_state->current_line_len != 0 || smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != request1_1_len || memcmp(smtp_state->ts_db, request1_1, request1_1_len) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_2, request1_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->ts_db, request1_str, strlen(request1_str)) != 0 || smtp_state->current_line != smtp_state->ts_db || smtp_state->current_line_len != smtp_state->ts_db_len) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 0 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || smtp_state->current_line == NULL || smtp_state->current_line_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->current_line, request1_str, strlen(request1_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test retrieving lines when frag'ed. */ static int SMTPParserTest10(void) { int result = 0; Flow f; int r = 0; const char *request1_str = ""; /* EHLO boo. */ uint8_t request1_1[] = { 0x0d, }; int32_t request1_1_len = sizeof(request1_1); /* com */ uint8_t request1_2[] = { 0x0a, }; int32_t request1_2_len = sizeof(request1_2); const char *request2_str = "EHLO boo.com"; /* EHLO boo.com */ uint8_t request2[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_1, request1_1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->current_line != NULL || smtp_state->current_line_len != 0 || smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != request1_1_len || memcmp(smtp_state->ts_db, request1_1, request1_1_len) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1_2, request1_2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 1 || smtp_state->ts_db == NULL || smtp_state->ts_db_len != (int32_t)strlen(request1_str) || memcmp(smtp_state->ts_db, request1_str, strlen(request1_str)) != 0 || smtp_state->current_line != smtp_state->ts_db || smtp_state->current_line_len != smtp_state->ts_db_len) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 0 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || smtp_state->current_line == NULL || smtp_state->current_line_len != (int32_t)strlen(request2_str) || memcmp(smtp_state->current_line, request2_str, strlen(request2_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /* * \test Test retrieving lines when frag'ed. */ static int SMTPParserTest11(void) { int result = 0; Flow f; int r = 0; const char *request1_str = ""; /* EHLO boo. */ uint8_t request1[] = { 0x0a, }; int32_t request1_len = sizeof(request1); const char *request2_str = "EHLO boo.com"; /* EHLO boo.com */ uint8_t request2[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request2_len = sizeof(request2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->current_line == NULL || smtp_state->current_line_len != 0 || smtp_state->ts_current_line_db == 1 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || memcmp(smtp_state->current_line, request1_str, strlen(request1_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->ts_current_line_db != 0 || smtp_state->ts_db != NULL || smtp_state->ts_db_len != 0 || smtp_state->current_line == NULL || smtp_state->current_line_len != (int32_t)strlen(request2_str) || memcmp(smtp_state->current_line, request2_str, strlen(request2_str)) != 0) { printf("smtp parser in inconsistent state\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SMTPParserTest12(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; SMTPState *smtp_state = NULL; int r = 0; /* EHLO boo.com */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request1_len = sizeof(request1); /* 388 */ uint8_t reply1[] = { 0x31, 0x38, 0x38, 0x0d, 0x0a, }; uint32_t reply1_len = sizeof(reply1); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SMTP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx,"alert tcp any any -> any any " "(msg:\"SMTP event handling\"; " "app-layer-event: smtp.invalid_reply; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER | STREAM_START, request1, request1_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched. It shouldn't match: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT | STREAM_TOCLIENT, reply1, reply1_len); if (r == 0) { printf("AppLayerParse for smtp failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int SMTPParserTest13(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; SMTPState *smtp_state = NULL; int r = 0; /* EHLO boo.com */ uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, }; int32_t request1_len = sizeof(request1); /* 250 */ uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x0d, 0x0a, }; uint32_t reply1_len = sizeof(reply1); /* MAIL FROM:pbsf@asdfs.com * RCPT TO:pbsf@asdfs.com * DATA * STARTTLS */ uint8_t request2[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x70, 0x62, 0x73, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x70, 0x62, 0x73, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a, 0x44, 0x41, 0x54, 0x41, 0x0d, 0x0a, 0x53, 0x54, 0x41, 0x52, 0x54, 0x54, 0x4c, 0x53, 0x0d, 0x0a }; uint32_t request2_len = sizeof(request2); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SMTP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"SMTP event handling\"; " "app-layer-event: " "smtp.invalid_pipelined_sequence; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER | STREAM_START, request1, request1_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched. It shouldn't match: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched. It shouldn't match: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match. Should have matched: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test DATA command w/MIME message. */ static int SMTPParserTest14(void) { int result = 0; Flow f; int r = 0; /* 220 mx.google.com ESMTP d15sm986283wfl.6 */ static uint8_t welcome_reply[] = { 0x32, 0x32, 0x30, 0x20, 0x6d, 0x78, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x45, 0x53, 0x4d, 0x54, 0x50, 0x20, 0x64, 0x31, 0x35, 0x73, 0x6d, 0x39, 0x38, 0x36, 0x32, 0x38, 0x33, 0x77, 0x66, 0x6c, 0x2e, 0x36, 0x0d, 0x0a }; static uint32_t welcome_reply_len = sizeof(welcome_reply); /* EHLO boo.com */ static uint8_t request1[] = { 0x45, 0x48, 0x4c, 0x4f, 0x20, 0x62, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; static uint32_t request1_len = sizeof(request1); /* 250-mx.google.com at your service, [117.198.115.50] * 250-SIZE 35882577 * 250-8BITMIME * 250-STARTTLS * 250 ENHANCEDSTATUSCODES */ static uint8_t reply1[] = { 0x32, 0x35, 0x30, 0x2d, 0x70, 0x6f, 0x6f, 0x6e, 0x61, 0x5f, 0x73, 0x6c, 0x61, 0x63, 0x6b, 0x5f, 0x76, 0x6d, 0x31, 0x2e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x50, 0x49, 0x50, 0x45, 0x4c, 0x49, 0x4e, 0x49, 0x4e, 0x47, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x53, 0x49, 0x5a, 0x45, 0x20, 0x31, 0x30, 0x32, 0x34, 0x30, 0x30, 0x30, 0x30, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x56, 0x52, 0x46, 0x59, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x54, 0x52, 0x4e, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x45, 0x4e, 0x48, 0x41, 0x4e, 0x43, 0x45, 0x44, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x43, 0x4f, 0x44, 0x45, 0x53, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x2d, 0x38, 0x42, 0x49, 0x54, 0x4d, 0x49, 0x4d, 0x45, 0x0d, 0x0a, 0x32, 0x35, 0x30, 0x20, 0x44, 0x53, 0x4e, 0x0d, 0x0a }; static uint32_t reply1_len = sizeof(reply1); /* MAIL FROM:asdff@asdf.com */ static uint8_t request2[] = { 0x4d, 0x41, 0x49, 0x4c, 0x20, 0x46, 0x52, 0x4f, 0x4d, 0x3a, 0x61, 0x73, 0x64, 0x66, 0x66, 0x40, 0x61, 0x73, 0x64, 0x66, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; static uint32_t request2_len = sizeof(request2); /* 250 2.1.0 Ok */ static uint8_t reply2[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; static uint32_t reply2_len = sizeof(reply2); /* RCPT TO:bimbs@gmail.com */ static uint8_t request3[] = { 0x52, 0x43, 0x50, 0x54, 0x20, 0x54, 0x4f, 0x3a, 0x62, 0x69, 0x6d, 0x62, 0x73, 0x40, 0x67, 0x6d, 0x61, 0x69, 0x6c, 0x2e, 0x63, 0x6f, 0x6d, 0x0d, 0x0a }; static uint32_t request3_len = sizeof(request3); /* 250 2.1.5 Ok */ static uint8_t reply3[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x31, 0x2e, 0x35, 0x20, 0x4f, 0x6b, 0x0d, 0x0a }; static uint32_t reply3_len = sizeof(reply3); /* DATA */ static uint8_t request4[] = { 0x44, 0x41, 0x54, 0x41, 0x0d, 0x0a }; static uint32_t request4_len = sizeof(request4); /* 354 End data with .|| */ static uint8_t reply4[] = { 0x33, 0x35, 0x34, 0x20, 0x45, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x74, 0x61, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x2e, 0x3c, 0x43, 0x52, 0x3e, 0x3c, 0x4c, 0x46, 0x3e, 0x0d, 0x0a }; static uint32_t reply4_len = sizeof(reply4); /* MIME_MSG */ static uint64_t filesize = 133; static uint8_t request4_msg[] = { 0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, 0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x2F, 0x6F, 0x63, 0x74, 0x65, 0x74, 0x2D, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x72, 0x61, 0x6E, 0x73, 0x66, 0x65, 0x72, 0x2D, 0x45, 0x6E, 0x63, 0x6F, 0x64, 0x69, 0x6E, 0x67, 0x3A, 0x20, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x44, 0x69, 0x73, 0x70, 0x6F, 0x73, 0x69, 0x74, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x61, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6D, 0x65, 0x6E, 0x74, 0x3B, 0x20, 0x66, 0x69, 0x6C, 0x65, 0x6E, 0x61, 0x6D, 0x65, 0x3D, 0x22, 0x74, 0x65, 0x73, 0x74, 0x2E, 0x65, 0x78, 0x65, 0x22, 0x3B, 0x0D, 0x0A, 0x0D, 0x0A, 0x54, 0x56, 0x6F, 0x41, 0x41, 0x46, 0x42, 0x46, 0x41, 0x41, 0x42, 0x4D, 0x41, 0x51, 0x45, 0x41, 0x61, 0x69, 0x70, 0x59, 0x77, 0x77, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x41, 0x41, 0x44, 0x41, 0x51, 0x73, 0x42, 0x43, 0x41, 0x41, 0x42, 0x41, 0x41, 0x43, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x48, 0x6B, 0x41, 0x41, 0x41, 0x41, 0x4D, 0x41, 0x41, 0x41, 0x41, 0x65, 0x51, 0x41, 0x41, 0x41, 0x41, 0x77, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x45, 0x41, 0x41, 0x42, 0x41, 0x41, 0x41, 0x41, 0x41, 0x51, 0x41, 0x41, 0x41, 0x42, 0x30, 0x41, 0x41, 0x41, 0x41, 0x49, 0x41, 0x41, 0x41, 0x41, 0x41, 0x51, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x41, 0x45, 0x41, 0x41, 0x49, 0x67, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x67, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x63, 0x58, 0x44, 0x59, 0x32, 0x4C, 0x6A, 0x6B, 0x7A, 0x4C, 0x6A, 0x59, 0x34, 0x4C, 0x6A, 0x5A, 0x63, 0x65, 0x67, 0x41, 0x41, 0x4F, 0x41, 0x3D, 0x3D, 0x0D,0x0A }; static uint32_t request4_msg_len = sizeof(request4_msg); /* DATA COMPLETED */ static uint8_t request4_end[] = { 0x0d, 0x0a, 0x2e, 0x0d, 0x0a }; static uint32_t request4_end_len = sizeof(request4_end); /* 250 2.0.0 Ok: queued as 6A1AF20BF2 */ static uint8_t reply4_end[] = { 0x32, 0x35, 0x30, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x4f, 0x6b, 0x3a, 0x20, 0x71, 0x75, 0x65, 0x75, 0x65, 0x64, 0x20, 0x61, 0x73, 0x20, 0x36, 0x41, 0x31, 0x41, 0x46, 0x32, 0x30, 0x42, 0x46, 0x32, 0x0d, 0x0a }; static uint32_t reply4_end_len = sizeof(reply4_end); /* QUIT */ static uint8_t request5[] = { 0x51, 0x55, 0x49, 0x54, 0x0d, 0x0a }; static uint32_t request5_len = sizeof(request5); /* 221 2.0.0 Bye */ static uint8_t reply5[] = { 0x32, 0x32, 0x31, 0x20, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x20, 0x42, 0x79, 0x65, 0x0d, 0x0a }; static uint32_t reply5_len = sizeof(reply5); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SMTPTestInitConfig(); FLOWLOCK_WRLOCK(&f); /* Welcome reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, welcome_reply, welcome_reply_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMTPState *smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request1, request1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* EHLO Reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply1, reply1_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } if ((smtp_state->helo_len != 7) || strncmp("boo.com", (char *)smtp_state->helo, 7)) { printf("incorrect parsing of HELO field '%s' (%d)\n", smtp_state->helo, smtp_state->helo_len); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* MAIL FROM Request */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request2, request2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* MAIL FROM Reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply2, reply2_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } if ((smtp_state->curr_tx->mail_from_len != 14) || strncmp("asdff@asdf.com", (char *)smtp_state->curr_tx->mail_from, 14)) { printf("incorrect parsing of MAIL FROM field '%s' (%d)\n", smtp_state->curr_tx->mail_from, smtp_state->curr_tx->mail_from_len); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* RCPT TO Request */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request3, request3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* RCPT TO Reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply3, reply3_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } /* Enable mime decoding */ smtp_config.decode_mime = 1; smtp_config.mime_config.decode_base64 = 1; smtp_config.mime_config.decode_quoted_printable = 1; MimeDecSetConfig(&smtp_config.mime_config); FLOWLOCK_WRLOCK(&f); /* DATA request */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request4, request4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* Data reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply4, reply4_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* DATA message */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request4_msg, request4_msg_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->curr_tx->mime_state == NULL || smtp_state->curr_tx->msg_head == NULL || /* MIME data structures */ smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN | SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* DATA . request */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request4_end, request4_end_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_DATA_MODE || smtp_state->curr_tx->mime_state == NULL || smtp_state->curr_tx->msg_head == NULL || /* MIME data structures */ smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } SMTPState *state = (SMTPState *) f.alstate; FileContainer *files = state->files_ts; if (files != NULL && files->head != NULL) { File *file = files->head; if(strncmp((const char *)file->name, "test.exe", 8) != 0){ printf("smtp-mime file name is incorrect"); goto end; } if (FileTrackedSize(file) != filesize){ printf("smtp-mime file size %"PRIu64" is incorrect", FileDataSize(file)); goto end; } static uint8_t org_binary[] = { 0x4D, 0x5A, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x01, 0x00, 0x6A, 0x2A, 0x58, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x03, 0x01, 0x0B, 0x01, 0x08, 0x00, 0x01, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x04, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x01, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x5C, 0x5C, 0x36, 0x36, 0x2E, 0x39, 0x33, 0x2E, 0x36, 0x38, 0x2E, 0x36, 0x5C, 0x7A, 0x00, 0x00, 0x38,}; if (StreamingBufferCompareRawData(file->sb, org_binary, sizeof(org_binary)) != 1) { printf("smtp-mime file data incorrect\n"); goto end; } } FLOWLOCK_WRLOCK(&f); /* DATA . reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply4_end, reply4_end_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* QUIT Request */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, request5, request5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 1 || smtp_state->cmds_idx != 0 || smtp_state->cmds[0] != SMTP_COMMAND_OTHER_CMD || smtp_state->parser_state != SMTP_PARSER_STATE_FIRST_REPLY_SEEN) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } FLOWLOCK_WRLOCK(&f); /* QUIT Reply */ r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOCLIENT, reply5, reply5_len); if (r != 0) { printf("smtp check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smtp_state->input_len != 0 || smtp_state->cmds_cnt != 0 || smtp_state->cmds_idx != 0 || smtp_state->parser_state != (SMTP_PARSER_STATE_FIRST_REPLY_SEEN)) { printf("smtp parser in inconsistent state l.%d\n", __LINE__); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SMTPProcessDataChunkTest01(void){ Flow f; FLOW_INITIALIZE(&f); f.file_flags = FLOWFILE_NO_STORE_TS; MimeDecParseState *state = MimeDecInitParser(&f, NULL); int ret; ret = SMTPProcessDataChunk(NULL, 0, state); return ret == 0; } static int SMTPProcessDataChunkTest02(void){ char mimemsg[] = {0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, 0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, 0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6F, 0x6E, 0x2F, 0x6F, 0x63, 0x74, 0x65, 0x74, 0x2D, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x72, 0x61, 0x6E, 0x73, 0x66, 0x65, 0x72, 0x2D, 0x45, 0x6E, 0x63, 0x6F, 0x64, 0x69, 0x6E, 0x67, 0x3A, 0x20, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x44, 0x69, 0x73, 0x70, 0x6F, 0x73, 0x69, 0x74, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x61, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6D, 0x65, 0x6E, 0x74, 0x3B, 0x20, 0x66, 0x69, 0x6C, 0x65, 0x6E, 0x61, 0x6D, 0x65, 0x3D, 0x22, 0x74, 0x65, 0x73, 0x74, 0x2E, 0x65, 0x78, 0x65, 0x22, 0x3B, 0x0D, 0x0A, 0x0D, 0x0A, 0x54, 0x56, 0x6F, 0x41, 0x41, 0x46, 0x42, 0x46, 0x41, 0x41, 0x42, 0x4D, 0x41, 0x51, 0x45, 0x41, 0x61, 0x69, 0x70, 0x59, 0x77, 0x77, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x41, 0x41, 0x44, 0x41, 0x51, 0x73, 0x42, 0x43, 0x41, 0x41, 0x42, 0x41, 0x41, 0x43, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x48, 0x6B, 0x41, 0x41, 0x41, 0x41, 0x4D, 0x41, 0x41, 0x41, 0x41, 0x65, 0x51, 0x41, 0x41, 0x41, 0x41, 0x77, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x45, 0x41, 0x41, 0x42, 0x41, 0x41, 0x41, 0x41, 0x41, 0x51, 0x41, 0x41, 0x41, 0x42, 0x30, 0x41, 0x41, 0x41, 0x41, 0x49, 0x41, 0x41, 0x41, 0x41, 0x41, 0x51, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x41, 0x45, 0x41, 0x41, 0x49, 0x67, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x67, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x42, 0x63, 0x58, 0x44, 0x59, 0x32, 0x4C, 0x6A, 0x6B, 0x7A, 0x4C, 0x6A, 0x59, 0x34, 0x4C, 0x6A, 0x5A, 0x63, 0x65, 0x67, 0x41, 0x41, 0x4F, 0x41, 0x3D, 0x3D, 0x0D, 0x0A,}; Flow f; FLOW_INITIALIZE(&f); f.alstate = SMTPStateAlloc(); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; state->body_begin = 1; int ret; ret = SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state); return ret == 0; } static int SMTPProcessDataChunkTest03(void){ char mimemsg[] = {0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, }; char mimemsg2[] = {0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, }; char mimemsg3[] = {0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, }; char mimemsg4[] = {0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, }; char mimemsg5[] = {0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, }; char mimemsg6[] = {0x74, 0x69, 0x6F, 0x6E, 0x2F, 0x6F, 0x63, 0x74, }; char mimemsg7[] = {0x65, 0x74, 0x2D, 0x73, 0x74, 0x72, 0x65, 0x61, }; char mimemsg8[] = {0x6D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, }; char mimemsg9[] = {0x6E, 0x74, 0x2D, 0x54, 0x72, 0x61, 0x6E, 0x73, }; char mimemsg10[] = {0x66, 0x65, 0x72, 0x2D, 0x45, 0x6E, 0x63, 0x6F, }; char mimemsg11[] = {0x64, 0x69, 0x6E, 0x67, 0x3A, 0x20, 0x62, 0x61, }; char mimemsg12[] = {0x73, 0x65, 0x36, 0x34, 0x0D, 0x0A, 0x43, 0x6F, }; Flow f; FLOW_INITIALIZE(&f); f.alstate = SMTPStateAlloc(); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; int ret; state->body_begin = 1; ret = SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state); if(ret) goto end; state->body_begin = 0; ret = SMTPProcessDataChunk((uint8_t *)mimemsg2, sizeof(mimemsg2), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg3, sizeof(mimemsg3), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg4, sizeof(mimemsg4), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg5, sizeof(mimemsg5), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg6, sizeof(mimemsg6), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg7, sizeof(mimemsg7), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg8, sizeof(mimemsg8), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg9, sizeof(mimemsg9), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg10, sizeof(mimemsg10), state); if(ret) goto end; ret = SMTPProcessDataChunk((uint8_t *)mimemsg11, sizeof(mimemsg11), state); if(ret) goto end; state->body_end = 1; ret = SMTPProcessDataChunk((uint8_t *)mimemsg12, sizeof(mimemsg12), state); if(ret) goto end; end: return ret == 0; } static int SMTPProcessDataChunkTest04(void){ char mimemsg[] = {0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, }; char mimemsg2[] = {0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, }; char mimemsg3[] = {0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, }; char mimemsg4[] = {0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, }; char mimemsg5[] = {0x20, 0x61, 0x70, 0x70, 0x6C, 0x69, 0x63, 0x61, }; char mimemsg6[] = {0x74, 0x69, 0x6F, 0x6E, 0x2F, 0x6F, 0x63, 0x74, }; char mimemsg7[] = {0x65, 0x74, 0x2D, 0x73, 0x74, 0x72, 0x65, 0x61, }; char mimemsg8[] = {0x6D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, }; char mimemsg9[] = {0x6E, 0x74, 0x2D, 0x54, 0x72, 0x61, 0x6E, 0x73, }; char mimemsg10[] = {0x66, 0x65, 0x72, 0x2D, 0x45, 0x6E, 0x63, 0x6F, }; char mimemsg11[] = {0x64, 0x69, 0x6E, 0x67, 0x3A, 0x20, 0x62, 0x61, }; Flow f; FLOW_INITIALIZE(&f); f.alstate = SMTPStateAlloc(); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; int ret = MIME_DEC_OK; state->body_begin = 1; if(SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg2, sizeof(mimemsg2), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg3, sizeof(mimemsg3), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg4, sizeof(mimemsg4), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg5, sizeof(mimemsg5), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg6, sizeof(mimemsg6), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg7, sizeof(mimemsg7), state) != 0) goto end; state->body_begin = 0; state->body_end = 1; if(SMTPProcessDataChunk((uint8_t *)mimemsg8, sizeof(mimemsg8), state) != 0) goto end; state->body_end = 0; if(SMTPProcessDataChunk((uint8_t *)mimemsg9, sizeof(mimemsg9), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg10, sizeof(mimemsg10), state) != 0) goto end; if(SMTPProcessDataChunk((uint8_t *)mimemsg11, sizeof(mimemsg11), state) != 0) goto end; end: return ret == 0; } static int SMTPProcessDataChunkTest05(void){ char mimemsg[] = {0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, 0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, 0x6A, 0x6B, 0x7A, 0x4C, 0x6A, 0x59, 0x34, 0x4C, 0x6A, 0x5A, 0x63, 0x65, 0x67, 0x41, 0x41, 0x4F, 0x41, 0x3D, 0x3D, 0x0D, 0x0A,}; Flow f; int ret; FLOW_INITIALIZE(&f); f.alstate = SMTPStateAlloc(); FAIL_IF(f.alstate == NULL); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; FAIL_IF(state == NULL); state->body_begin = 1; ret = SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state); FAIL_IF(ret != 0); state->body_begin = 0; SMTPState *smtp_state = (SMTPState *)((Flow *)state->data)->alstate; FileContainer *files = smtp_state->files_ts; FAIL_IF(files == NULL); File *file = files->head; FAIL_IF(file == NULL); ret = SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state); FAIL_IF(ret != 0); FAIL_IF((uint32_t)FileDataSize(file) != 106); SMTPStateFree(smtp_state); FLOW_DESTROY(&f); PASS; } #endif /* UNITTESTS */ void SMTPParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SMTPParserTest01", SMTPParserTest01); UtRegisterTest("SMTPParserTest02", SMTPParserTest02); UtRegisterTest("SMTPParserTest03", SMTPParserTest03); UtRegisterTest("SMTPParserTest04", SMTPParserTest04); UtRegisterTest("SMTPParserTest05", SMTPParserTest05); UtRegisterTest("SMTPParserTest06", SMTPParserTest06); UtRegisterTest("SMTPParserTest07", SMTPParserTest07); UtRegisterTest("SMTPParserTest08", SMTPParserTest08); UtRegisterTest("SMTPParserTest09", SMTPParserTest09); UtRegisterTest("SMTPParserTest10", SMTPParserTest10); UtRegisterTest("SMTPParserTest11", SMTPParserTest11); UtRegisterTest("SMTPParserTest12", SMTPParserTest12); UtRegisterTest("SMTPParserTest13", SMTPParserTest13); UtRegisterTest("SMTPParserTest14", SMTPParserTest14); UtRegisterTest("SMTPProcessDataChunkTest01", SMTPProcessDataChunkTest01); UtRegisterTest("SMTPProcessDataChunkTest02", SMTPProcessDataChunkTest02); UtRegisterTest("SMTPProcessDataChunkTest03", SMTPProcessDataChunkTest03); UtRegisterTest("SMTPProcessDataChunkTest04", SMTPProcessDataChunkTest04); UtRegisterTest("SMTPProcessDataChunkTest05", SMTPProcessDataChunkTest05); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/detect-http-server-body.h0000644000000000000000000000166713051004444015650 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_HTTP_SERVER_BODY_H__ #define __DETECT_HTTP_SERVER_BODY_H__ void DetectHttpServerBodyRegister(void); #endif /* __DETECT_HTTP_SERVER_BODY_H__ */ suricata-3.2.1/src/detect-tls-version.h0000644000000000000000000000204013051004444014701 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_TLS_VERSION_H__ #define __DETECT_TLS_VERSION_H__ typedef struct DetectTlsVersionData_ { uint16_t ver; /** tls version to match */ } DetectTlsVersionData; /* prototypes */ void DetectTlsVersionRegister (void); #endif /* __DETECT_TLS_VERSION_H__ */ suricata-3.2.1/src/util-lua-ssh.h0000644000000000000000000000170313051004444013502 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland */ #ifndef __UTIL_LUA_SSH_H__ #define __UTIL_LUA_SSH_H__ #ifdef HAVE_LUA int LuaRegisterSshFunctions(lua_State *luastate); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_SSH_H__ */ suricata-3.2.1/src/decode-icmpv4.c0000644000000000000000000006027013051004444013575 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode ICMPv4 */ #include "suricata-common.h" #include "decode.h" #include "decode-events.h" #include "decode-ipv4.h" #include "decode-icmpv4.h" #include "flow.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "util-print.h" /** * Note, this is the IP header, plus a bit of the original packet, not the whole thing! */ int DecodePartialIPV4( Packet* p, uint8_t* partial_packet, uint16_t len ) { /** Check the sizes, the header must fit at least */ if (len < IPV4_HEADER_LEN) { SCLogDebug("DecodePartialIPV4: ICMPV4_IPV4_TRUNC_PKT"); ENGINE_SET_INVALID_EVENT(p, ICMPV4_IPV4_TRUNC_PKT); return -1; } IPV4Hdr *icmp4_ip4h = (IPV4Hdr*)partial_packet; /** Check the embedded version */ if (IPV4_GET_RAW_VER(icmp4_ip4h) != 4) { /** Check the embedded version */ SCLogDebug("DecodePartialIPV4: ICMPv4 contains Unknown IPV4 version " "ICMPV4_IPV4_UNKNOWN_VER"); ENGINE_SET_INVALID_EVENT(p, ICMPV4_IPV4_UNKNOWN_VER); return -1; } /** We need to fill icmpv4vars */ p->icmpv4vars.emb_ipv4h = icmp4_ip4h; /** Get the IP address from the contained packet */ p->icmpv4vars.emb_ip4_src = IPV4_GET_RAW_IPSRC(icmp4_ip4h); p->icmpv4vars.emb_ip4_dst = IPV4_GET_RAW_IPDST(icmp4_ip4h); p->icmpv4vars.emb_ip4_hlen=IPV4_GET_RAW_HLEN(icmp4_ip4h) << 2; switch (IPV4_GET_RAW_IPPROTO(icmp4_ip4h)) { case IPPROTO_TCP: if (len >= IPV4_HEADER_LEN + TCP_HEADER_LEN ) { p->icmpv4vars.emb_tcph = (TCPHdr*)(partial_packet + IPV4_HEADER_LEN); p->icmpv4vars.emb_sport = ntohs(p->icmpv4vars.emb_tcph->th_sport); p->icmpv4vars.emb_dport = ntohs(p->icmpv4vars.emb_tcph->th_dport); p->icmpv4vars.emb_ip4_proto = IPPROTO_TCP; SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->TCP header sport: " "%"PRIu8" dport %"PRIu8"", p->icmpv4vars.emb_sport, p->icmpv4vars.emb_dport); } else if (len >= IPV4_HEADER_LEN + 4) { /* only access th_sport and th_dport */ TCPHdr *emb_tcph = (TCPHdr*)(partial_packet + IPV4_HEADER_LEN); p->icmpv4vars.emb_tcph = NULL; p->icmpv4vars.emb_sport = ntohs(emb_tcph->th_sport); p->icmpv4vars.emb_dport = ntohs(emb_tcph->th_dport); p->icmpv4vars.emb_ip4_proto = IPPROTO_TCP; SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->TCP partial header sport: " "%"PRIu8" dport %"PRIu8"", p->icmpv4vars.emb_sport, p->icmpv4vars.emb_dport); } else { SCLogDebug("DecodePartialIPV4: Warning, ICMPV4->IPV4->TCP " "header Didn't fit in the packet!"); p->icmpv4vars.emb_sport = 0; p->icmpv4vars.emb_dport = 0; } break; case IPPROTO_UDP: if (len >= IPV4_HEADER_LEN + UDP_HEADER_LEN ) { p->icmpv4vars.emb_udph = (UDPHdr*)(partial_packet + IPV4_HEADER_LEN); p->icmpv4vars.emb_sport = ntohs(p->icmpv4vars.emb_udph->uh_sport); p->icmpv4vars.emb_dport = ntohs(p->icmpv4vars.emb_udph->uh_dport); p->icmpv4vars.emb_ip4_proto = IPPROTO_UDP; SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->UDP header sport: " "%"PRIu8" dport %"PRIu8"", p->icmpv4vars.emb_sport, p->icmpv4vars.emb_dport); } else { SCLogDebug("DecodePartialIPV4: Warning, ICMPV4->IPV4->UDP " "header Didn't fit in the packet!"); p->icmpv4vars.emb_sport = 0; p->icmpv4vars.emb_dport = 0; } break; case IPPROTO_ICMP: if (len >= IPV4_HEADER_LEN + ICMPV4_HEADER_LEN ) { p->icmpv4vars.emb_icmpv4h = (ICMPV4Hdr*)(partial_packet + IPV4_HEADER_LEN); p->icmpv4vars.emb_sport = 0; p->icmpv4vars.emb_dport = 0; p->icmpv4vars.emb_ip4_proto = IPPROTO_ICMP; SCLogDebug("DecodePartialIPV4: ICMPV4->IPV4->ICMP header"); } break; } /* debug print */ #ifdef DEBUG char s[16], d[16]; PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_src), s, sizeof(s)); PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_dst), d, sizeof(d)); SCLogDebug("ICMPv4 embedding IPV4 %s->%s - PROTO: %" PRIu32 " ID: %" PRIu32 "", s,d, IPV4_GET_RAW_IPPROTO(icmp4_ip4h), IPV4_GET_RAW_IPID(icmp4_ip4h)); #endif return 0; } /** DecodeICMPV4 * \brief Main ICMPv4 decoding function */ int DecodeICMPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_icmpv4); if (len < ICMPV4_HEADER_LEN) { ENGINE_SET_INVALID_EVENT(p, ICMPV4_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->icmpv4h = (ICMPV4Hdr *)pkt; SCLogDebug("ICMPV4 TYPE %" PRIu32 " CODE %" PRIu32 "", p->icmpv4h->type, p->icmpv4h->code); p->proto = IPPROTO_ICMP; p->type = p->icmpv4h->type; p->code = p->icmpv4h->code; p->payload = pkt + ICMPV4_HEADER_LEN; p->payload_len = len - ICMPV4_HEADER_LEN; ICMPV4ExtHdr* icmp4eh = (ICMPV4ExtHdr*) p->icmpv4h; switch (p->icmpv4h->type) { case ICMP_ECHOREPLY: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_DEST_UNREACH: if (p->icmpv4h->code > NR_ICMP_UNREACH) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } else { /* parse IP header plus 64 bytes */ if (len > ICMPV4_HEADER_PKT_OFFSET) { if (DecodePartialIPV4(p, (uint8_t *)(pkt + ICMPV4_HEADER_PKT_OFFSET), len - ICMPV4_HEADER_PKT_OFFSET ) == 0) { /* ICMP ICMP_DEST_UNREACH influence TCP/UDP flows */ if (ICMPV4_DEST_UNREACH_IS_VALID(p)) { FlowSetupPacket(p); } } } } break; case ICMP_SOURCE_QUENCH: if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } else { // parse IP header plus 64 bytes if (len >= ICMPV4_HEADER_PKT_OFFSET) DecodePartialIPV4( p, (uint8_t*) (pkt + ICMPV4_HEADER_PKT_OFFSET), len - ICMPV4_HEADER_PKT_OFFSET ); } break; case ICMP_REDIRECT: if (p->icmpv4h->code>ICMP_REDIR_HOSTTOS) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } else { // parse IP header plus 64 bytes if (len > ICMPV4_HEADER_PKT_OFFSET) DecodePartialIPV4( p, (uint8_t*) (pkt + ICMPV4_HEADER_PKT_OFFSET), len - ICMPV4_HEADER_PKT_OFFSET ); } break; case ICMP_ECHO: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_TIME_EXCEEDED: if (p->icmpv4h->code>ICMP_EXC_FRAGTIME) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } else { // parse IP header plus 64 bytes if (len > ICMPV4_HEADER_PKT_OFFSET) DecodePartialIPV4( p, (uint8_t*) (pkt + ICMPV4_HEADER_PKT_OFFSET), len - ICMPV4_HEADER_PKT_OFFSET ); } break; case ICMP_PARAMETERPROB: if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } else { // parse IP header plus 64 bytes if (len > ICMPV4_HEADER_PKT_OFFSET) DecodePartialIPV4( p, (uint8_t*) (pkt + ICMPV4_HEADER_PKT_OFFSET), len - ICMPV4_HEADER_PKT_OFFSET ); } break; case ICMP_TIMESTAMP: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_TIMESTAMPREPLY: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_INFO_REQUEST: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_INFO_REPLY: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_ADDRESS: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; case ICMP_ADDRESSREPLY: p->icmpv4vars.id=icmp4eh->id; p->icmpv4vars.seq=icmp4eh->seq; if (p->icmpv4h->code!=0) { ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_CODE); } break; default: ENGINE_SET_EVENT(p,ICMPV4_UNKNOWN_TYPE); } return TM_ECODE_OK; } #ifdef UNITTESTS /** DecodeICMPV4test01 * \brief * \retval 1 Expected test value */ static int DecodeICMPV4test01(void) { uint8_t raw_icmpv4[] = { 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x04, 0x52, 0xab, 0x86, 0x4a, 0x84, 0x50, 0x0e, 0x00, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab, 0xab }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL!=p->icmpv4h) { if (p->icmpv4h->type==8 && p->icmpv4h->code==0) { ret = 1; } } FlowShutdown(); SCFree(p); return ret; } /** DecodeICMPV4test02 * \brief * \retval 1 Expected test value */ static int DecodeICMPV4test02(void) { uint8_t raw_icmpv4[] = { 0x00, 0x00, 0x57, 0x64, 0xfb, 0x55, 0x00, 0x03, 0x43, 0xab, 0x86, 0x4a, 0xf6, 0x49, 0x02, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL!=p->icmpv4h) { if (p->icmpv4h->type==0 && p->icmpv4h->code==0) { ret = 1; } } FlowShutdown(); SCFree(p); return ret; } /** DecodeICMPV4test03 * \brief TTL exceeded * \retval Expected test value: 1 */ static int DecodeICMPV4test03(void) { uint8_t raw_icmpv4[] = { 0x0b, 0x00, 0x6a, 0x3d, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x64, 0x15, 0x00, 0x00, 0x01, 0x11, 0xde, 0xfd, 0xc0, 0xa8, 0x01, 0x0d, 0xd1, 0x55, 0xe3, 0x93, 0x8b, 0x12, 0x82, 0xaa, 0x00, 0x28, 0x7c, 0xdd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL == p->icmpv4h) { printf("NULL == p->icmpv4h: "); goto end; } /* check it's type 11 code 0 */ if (p->icmpv4h->type != 11 || p->icmpv4h->code != 0) { printf("p->icmpv4h->type %u, p->icmpv4h->code %u: ", p->icmpv4h->type, p->icmpv4h->code); goto end; } /* check it's source port 35602 to port 33450 */ if (p->icmpv4vars.emb_sport != 35602 || p->icmpv4vars.emb_dport != 33450) { printf("p->icmpv4vars.emb_sport %u, p->icmpv4vars.emb_dport %u: ", p->icmpv4vars.emb_sport, p->icmpv4vars.emb_dport); goto end; } /* check the src,dst IPs contained inside */ char s[16], d[16]; PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_src), s, sizeof(s)); PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_dst), d, sizeof(d)); /* ICMPv4 embedding IPV4 192.168.1.13->209.85.227.147 pass */ if (strcmp(s, "192.168.1.13") == 0 && strcmp(d, "209.85.227.147") == 0) { ret = 1; } else { printf("s %s, d %s: ", s, d); } end: FlowShutdown(); SCFree(p); return ret; } /** DecodeICMPV4test04 * \brief dest. unreachable, administratively prohibited * \retval 1 Expected test value */ static int DecodeICMPV4test04(void) { uint8_t raw_icmpv4[] = { 0x03, 0x0a, 0x36, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x62, 0xee, 0x40, 0x00, 0x33, 0x06, 0xb4, 0x8f, 0xc0, 0xa8, 0x01, 0x0d, 0x58, 0x60, 0x16, 0x29, 0xb1, 0x0a, 0x00, 0x32, 0x3e, 0x36, 0x38, 0x7c, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0xd0, 0x72, 0x04, 0x00, 0x00, 0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL == p->icmpv4h) { goto end; } /* check the type,code pair is correct - type 3, code 10 */ if (p->icmpv4h->type != 3 || p->icmpv4h->code != 10) { goto end; } /* check it's src port 45322 to dst port 50 */ if (p->icmpv4vars.emb_sport != 45322 || p->icmpv4vars.emb_dport != 50) { goto end; } // check the src,dst IPs contained inside char s[16], d[16]; PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_src), s, sizeof(s)); PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_dst), d, sizeof(d)); // ICMPv4 embedding IPV4 192.168.1.13->88.96.22.41 if (strcmp(s, "192.168.1.13") == 0 && strcmp(d, "88.96.22.41") == 0) { ret = 1; } end: FlowShutdown(); SCFree(p); return ret; } /** DecodeICMPV4test05 * \brief dest. unreachable, administratively prohibited * \retval 1 Expected test value */ static int DecodeICMPV4test05(void) { uint8_t raw_icmpv4[] = { 0x0b, 0x00, 0x5c, 0x46, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x30, 0x02, 0x17, 0x40, 0x00, 0x01, 0x06, 0xd6, 0xbd, 0xc0, 0xa8, 0x02, 0x05, 0x3d, 0x23, 0xa1, 0x23, 0x04, 0x18, 0x00, 0x50, 0xd2, 0x08, 0xc2, 0x48, }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL == p->icmpv4h) { goto end; } /* check the type,code pair is correct - type 11, code 0 */ if (p->icmpv4h->type != 11 || p->icmpv4h->code != 0) { goto end; } /* check it's src port 1048 to dst port 80 */ if (p->icmpv4vars.emb_sport != 1048 || p->icmpv4vars.emb_dport != 80) { goto end; } // check the src,dst IPs contained inside char s[16], d[16]; PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_src), s, sizeof(s)); PrintInet(AF_INET, &(p->icmpv4vars.emb_ip4_dst), d, sizeof(d)); // ICMPv4 embedding IPV4 192.168.2.5->61.35.161.35 if (strcmp(s, "192.168.2.5") == 0 && strcmp(d, "61.35.161.35") == 0) { ret = 1; } end: FlowShutdown(); SCFree(p); return ret; } static int ICMPV4CalculateValidChecksumtest05(void) { uint16_t csum = 0; uint8_t raw_icmpv4[] = { 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c, 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37}; csum = *( ((uint16_t *)raw_icmpv4) + 1); return (csum == ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4, sizeof(raw_icmpv4))); } static int ICMPV4CalculateInvalidChecksumtest06(void) { uint16_t csum = 0; uint8_t raw_icmpv4[] = { 0x08, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c, 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38}; csum = *( ((uint16_t *)raw_icmpv4) + 1); return (csum != ICMPV4CalculateChecksum((uint16_t *)raw_icmpv4, sizeof(raw_icmpv4))); } static int ICMPV4InvalidType07(void) { uint8_t raw_icmpv4[] = { 0xff, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c, 0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38}; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if(ENGINE_ISSET_EVENT(p,ICMPV4_UNKNOWN_TYPE)) { ret = 1; } FlowShutdown(); SCFree(p); return ret; } /** DecodeICMPV4test08 * \brief * \retval 1 Expected test value - what we really want is not to segfault */ static int DecodeICMPV4test08(void) { uint8_t raw_icmpv4[] = { 0x08, 0x00, 0x78, 0x47, 0xfc, 0x55, 0x00, 0x00 }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; int ret = 0; IPV4Hdr ip4h; memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");; p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; p->ip4h = &ip4h; DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL); if (NULL!=p->icmpv4h) { if (p->icmpv4h->type==8 && p->icmpv4h->code==0) { ret = 1; } } FlowShutdown(); SCFree(p); return ret; } #endif /* UNITTESTS */ /** * \brief Registers ICMPV4 unit test */ void DecodeICMPV4RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeICMPV4test01", DecodeICMPV4test01); UtRegisterTest("DecodeICMPV4test02", DecodeICMPV4test02); UtRegisterTest("DecodeICMPV4test03", DecodeICMPV4test03); UtRegisterTest("DecodeICMPV4test04", DecodeICMPV4test04); UtRegisterTest("DecodeICMPV4test05", DecodeICMPV4test05); UtRegisterTest("ICMPV4CalculateValidChecksumtest05", ICMPV4CalculateValidChecksumtest05); UtRegisterTest("ICMPV4CalculateInvalidChecksumtest06", ICMPV4CalculateInvalidChecksumtest06); UtRegisterTest("DecodeICMPV4InvalidType", ICMPV4InvalidType07); UtRegisterTest("DecodeICMPV4test08", DecodeICMPV4test08); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-pktvar.c0000644000000000000000000001510513051004444013724 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the pktvar keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "threads.h" #include "pkt-var.h" #include "detect-pktvar.h" #include "util-spm.h" #include "util-debug.h" #define PARSE_REGEX "(.*),(.*)" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectPktvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectPktvarSetup (DetectEngineCtx *, Signature *, char *); void DetectPktvarRegister (void) { sigmatch_table[DETECT_PKTVAR].name = "pktvar"; sigmatch_table[DETECT_PKTVAR].Match = DetectPktvarMatch; sigmatch_table[DETECT_PKTVAR].Setup = DetectPktvarSetup; sigmatch_table[DETECT_PKTVAR].Free = NULL; sigmatch_table[DETECT_PKTVAR].RegisterTests = NULL; sigmatch_table[DETECT_PKTVAR].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /* * returns 0: no match * 1: match * -1: error */ int DetectPktvarMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { int ret = 0; const DetectPktvarData *pd = (const DetectPktvarData *)ctx; PktVar *pv = PktVarGet(p, pd->name); if (pv != NULL) { uint8_t *ptr = SpmSearch(pv->value, pv->value_len, pd->content, pd->content_len); if (ptr != NULL) ret = 1; } return ret; } static int DetectPktvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectPktvarData *cd = NULL; SigMatch *sm = NULL; char *str = rawstr; char dubbed = 0; uint16_t len; char *varname = NULL, *varcontent = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 3) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for pktvar.", rawstr); return -1; } const char *str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } varname = (char *)str_ptr; if (ret > 2) { res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } varcontent = (char *)str_ptr; } SCLogDebug("varname %s, varcontent %s", varname, varcontent); if (varcontent[0] == '\"' && varcontent[strlen(varcontent)-1] == '\"') { str = SCStrdup(varcontent+1); if (unlikely(str == NULL)) { return -1; } str[strlen(varcontent)-2] = '\0'; dubbed = 1; } len = strlen(str); if (len == 0) { if (dubbed) SCFree(str); return -1; } cd = SCMalloc(sizeof(DetectPktvarData)); if (unlikely(cd == NULL)) goto error; char converted = 0; { uint16_t i, x; uint8_t bin = 0, binstr[3] = "", binpos = 0; for (i = 0, x = 0; i < len; i++) { // printf("str[%02u]: %c\n", i, str[i]); if (str[i] == '|') { if (bin) { bin = 0; } else { bin = 1; } } else { if (bin) { if (isdigit((unsigned char)str[i]) || str[i] == 'A' || str[i] == 'a' || str[i] == 'B' || str[i] == 'b' || str[i] == 'C' || str[i] == 'c' || str[i] == 'D' || str[i] == 'd' || str[i] == 'E' || str[i] == 'e' || str[i] == 'F' || str[i] == 'f') { // printf("part of binary: %c\n", str[i]); binstr[binpos] = (char)str[i]; binpos++; if (binpos == 2) { uint8_t c = strtol((char *)binstr, (char **) NULL, 16) & 0xFF; binpos = 0; str[x] = c; x++; converted = 1; } } else if (str[i] == ' ') { // printf("space as part of binary string\n"); } } else { str[x] = str[i]; x++; } } } #ifdef DEBUG if (SCLogDebugEnabled()) { for (i = 0; i < x; i++) { if (isprint((unsigned char)str[i])) printf("%c", str[i]); else printf("\\x%02u", str[i]); } printf("\n"); } #endif if (converted) len = x; } /* coverity[alloc_strlen : FALSE] * not an actual string, but a byte array */ cd->content = SCMalloc(len); if (cd->content == NULL) { SCFree(cd); if (dubbed) SCFree(str); return -1; } cd->name = SCStrdup(varname); if (cd->name == NULL) { SCFree(cd); if (dubbed) SCFree(str); return -1; } memcpy(cd->content, str, len); cd->content_len = len; cd->flags = 0; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_PKTVAR; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); if (dubbed) SCFree(str); return 0; error: if (dubbed) SCFree(str); if (cd) { if (cd->name) SCFree(cd->name); SCFree(cd); } if (sm) SCFree(sm); return -1; } suricata-3.2.1/src/detect-pkt-data.c0000644000000000000000000000754213051004444014130 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Xavier Lange * */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-spm-bm.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectPktDataSetup (DetectEngineCtx *, Signature *, char *); static void DetectPktDataTestRegister(void); /** * \brief Registration function for keyword: file_data */ void DetectPktDataRegister(void) { sigmatch_table[DETECT_PKT_DATA].name = "pkt_data"; sigmatch_table[DETECT_PKT_DATA].Match = NULL; sigmatch_table[DETECT_PKT_DATA].AppLayerMatch = NULL; sigmatch_table[DETECT_PKT_DATA].Setup = DetectPktDataSetup; sigmatch_table[DETECT_PKT_DATA].Free = NULL; sigmatch_table[DETECT_PKT_DATA].RegisterTests = DetectPktDataTestRegister; sigmatch_table[DETECT_PKT_DATA].flags = SIGMATCH_NOOPT; } /** * \brief this function is used to parse pkt_data options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filestore" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectPktDataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); s->list = DETECT_SM_LIST_NOTSET; return 0; } #ifdef UNITTESTS /************************************Unittests*********************************/ static int DetectPktDataTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; Signature *sig = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; content:\"in file data\";" " pkt_data; content:\"in pkt data\";)"); de_ctx->sig_list = sig; if (de_ctx->sig_list == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE,"could not load test signature"); goto end; } /* sm should be in the MATCH list */ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { printf("sm not in DETECT_SM_LIST_FILEDATA: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { printf("sm not in DETECT_SM_LIST_PMATCH: "); goto end; } if (sm->type != DETECT_CONTENT) { printf("sm type not DETECT_AL_HTTP_SERVER_BODY: "); goto end; } if (sm->next != NULL) { goto end; } if (sig->list != DETECT_SM_LIST_NOTSET) { printf("sticky buffer set: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif static void DetectPktDataTestRegister(void) { #ifdef UNITTESTS UtRegisterTest("DetectPktDataTest01", DetectPktDataTest01); #endif } suricata-3.2.1/src/detect-engine-tls.h0000644000000000000000000000430213051004444014464 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Mats Klepsland */ #ifndef __DETECT_ENGINE_TLS_H__ #define __DETECT_ENGINE_TLS_H__ int PrefilterTxTlsSniRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxTlsIssuerRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxTlsSubjectRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectTlsSni(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); int DetectEngineInspectTlsIssuer(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); int DetectEngineInspectTlsSubject(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); int DetectEngineInspectTlsValidity(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); #endif /* __DETECT_ENGINE_TLS_H__ */ suricata-3.2.1/src/source-nflog.c0000644000000000000000000004024013051004444013550 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo * * Netfilter's netfilter_log support */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "tm-modules.h" #include "tm-queuehandlers.h" #include "tmqh-packetpool.h" #include "runmodes.h" #include "util-error.h" #include "util-device.h" #ifndef HAVE_NFLOG /** Handle the case where no NFLOG support is compiled in. * */ TmEcode NoNFLOGSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveNFLOGRegister (void) { tmm_modules[TMM_RECEIVENFLOG].name = "ReceiveNFLOG"; tmm_modules[TMM_RECEIVENFLOG].ThreadInit = NoNFLOGSupportExit; } void TmModuleDecodeNFLOGRegister (void) { tmm_modules[TMM_DECODENFLOG].name = "DecodeNFLOG"; tmm_modules[TMM_DECODENFLOG].ThreadInit = NoNFLOGSupportExit; } TmEcode NoNFLOGSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NFLOG_NOSUPPORT,"Error creating thread %s: you do not have support for nflog " "enabled please recompile with --enable-nflog", tv->name); exit(EXIT_FAILURE); } #else /* implied we do have NFLOG support */ #include "source-nflog.h" TmEcode ReceiveNFLOGThreadInit(ThreadVars *, void *, void **); TmEcode ReceiveNFLOGThreadDeinit(ThreadVars *, void *); TmEcode ReceiveNFLOGLoop(ThreadVars *, void *, void *); void ReceiveNFLOGThreadExitStats(ThreadVars *, void *); TmEcode DecodeNFLOGThreadInit(ThreadVars *, void *, void **); TmEcode DecodeNFLOGThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeNFLOG(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); static int runmode_workers; /* Structure to hold thread specific variables */ typedef struct NFLOGThreadVars_ { ThreadVars *tv; TmSlot *slot; char *data; int datalen; uint16_t group; uint32_t nlbufsiz; uint32_t nlbufsiz_max; uint32_t qthreshold; uint32_t qtimeout; struct nflog_handle *h; struct nflog_g_handle *gh; LiveDevice *livedev; int nful_overrun_warned; /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; uint16_t capture_kernel_packets; uint16_t capture_kernel_drops; } NFLOGThreadVars; /** * \brief Registration function for ReceiveNFLOG */ void TmModuleReceiveNFLOGRegister (void) { tmm_modules[TMM_RECEIVENFLOG].name = "ReceiveNFLOG"; tmm_modules[TMM_RECEIVENFLOG].ThreadInit = ReceiveNFLOGThreadInit; tmm_modules[TMM_RECEIVENFLOG].Func = NULL; tmm_modules[TMM_RECEIVENFLOG].PktAcqLoop = ReceiveNFLOGLoop; tmm_modules[TMM_RECEIVENFLOG].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVENFLOG].ThreadExitPrintStats = ReceiveNFLOGThreadExitStats; tmm_modules[TMM_RECEIVENFLOG].ThreadDeinit = ReceiveNFLOGThreadDeinit; tmm_modules[TMM_RECEIVENFLOG].RegisterTests = NULL; tmm_modules[TMM_RECEIVENFLOG].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registration function for DecodeNFLOG */ void TmModuleDecodeNFLOGRegister (void) { tmm_modules[TMM_DECODENFLOG].name = "DecodeNFLOG"; tmm_modules[TMM_DECODENFLOG].ThreadInit = DecodeNFLOGThreadInit; tmm_modules[TMM_DECODENFLOG].Func = DecodeNFLOG; tmm_modules[TMM_DECODENFLOG].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENFLOG].ThreadDeinit = DecodeNFLOGThreadDeinit; tmm_modules[TMM_DECODENFLOG].RegisterTests = NULL; tmm_modules[TMM_DECODENFLOG].flags = TM_FLAG_DECODE_TM; } /** * \brief NFLOG callback function * This function setup a packet from a nflog message */ static int NFLOGCallback(struct nflog_g_handle *gh, struct nfgenmsg *msg, struct nflog_data *nfa, void *data) { NFLOGThreadVars *ntv = (NFLOGThreadVars *) data; struct nfulnl_msg_packet_hdr *ph; char *payload; int ret; /* grab a packet*/ Packet *p = PacketGetFromQueueOrAlloc(); if (p == NULL) return -1; PKT_SET_SRC(p, PKT_SRC_WIRE); ph = nflog_get_msg_packet_hdr(nfa); if (ph != NULL) { p->nflog_v.hw_protocol = ph->hw_protocol; } p->nflog_v.ifi = nflog_get_indev(nfa); p->nflog_v.ifo = nflog_get_outdev(nfa); ret = nflog_get_payload(nfa, &payload); if (ret > 0) { if (ret > 65536) { SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "NFLOG sent too big packet"); SET_PKT_LEN(p, 0); } else if (runmode_workers) PacketSetData(p, (uint8_t *)payload, ret); else PacketCopyData(p, (uint8_t *)payload, ret); } else if (ret == -1) SET_PKT_LEN(p, 0); ret = nflog_get_timestamp(nfa, &p->ts); if (ret != 0) { memset(&p->ts, 0, sizeof(struct timeval)); gettimeofday(&p->ts, NULL); } p->datalink = DLT_RAW; #ifdef COUNTERS ntv->pkts++; ntv->bytes += GET_PKT_LEN(p); #endif (void) SC_ATOMIC_ADD(ntv->livedev->pkts, 1); if (TmThreadsSlotProcessPkt(ntv->tv, ntv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ntv->tv, p); return -1; } return 0; } /** * \brief Receives packet from a nflog group via libnetfilter_log * This is a setup function for recieving packets via libnetfilter_log. * \param tv pointer to ThreadVars * \param initdata pointer to the group passed from the user * \param data pointer gets populated with NFLOGThreadVars * \retvalTM_ECODE_OK on success * \retval TM_ECODE_FAILED on error */ TmEcode ReceiveNFLOGThreadInit(ThreadVars *tv, void *initdata, void **data) { NflogGroupConfig *nflconfig = initdata; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } NFLOGThreadVars *ntv = SCMalloc(sizeof(NFLOGThreadVars)); if (unlikely(ntv == NULL)) { nflconfig->DerefFunc(nflconfig); SCReturnInt(TM_ECODE_FAILED); } memset(ntv, 0, sizeof(NFLOGThreadVars)); ntv->tv = tv; ntv->group = nflconfig->group; ntv->nlbufsiz = nflconfig->nlbufsiz; ntv->nlbufsiz_max = nflconfig->nlbufsiz_max; ntv->qthreshold = nflconfig->qthreshold; ntv->qtimeout = nflconfig->qtimeout; ntv->nful_overrun_warned = nflconfig->nful_overrun_warned; ntv->h = nflog_open(); if (ntv->h == NULL) { SCLogError(SC_ERR_NFLOG_OPEN, "nflog_open() failed"); SCFree(ntv); return TM_ECODE_FAILED; } SCLogDebug("binding netfilter_log as nflog handler for AF_INET and AF_INET6"); if (nflog_bind_pf(ntv->h, AF_INET) < 0) { SCLogError(SC_ERR_NFLOG_BIND, "nflog_bind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nflog_bind_pf(ntv->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFLOG_BIND, "nflog_bind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } ntv->gh = nflog_bind_group(ntv->h, ntv->group); if (!ntv->gh) { SCLogError(SC_ERR_NFLOG_OPEN, "nflog_bind_group() failed"); SCFree(ntv); return TM_ECODE_FAILED; } if (nflog_set_mode(ntv->gh, NFULNL_COPY_PACKET, 0xFFFF) < 0) { SCLogError(SC_ERR_NFLOG_SET_MODE, "can't set packet_copy mode"); SCFree(ntv); return TM_ECODE_FAILED; } nflog_callback_register(ntv->gh, &NFLOGCallback, (void *)ntv); if (ntv->nlbufsiz < ntv->nlbufsiz_max) ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz); else { SCLogError(SC_ERR_NFLOG_MAX_BUFSIZ, "Maximum buffer size (%d) in NFLOG " "has been reached", ntv->nlbufsiz); return TM_ECODE_FAILED; } if (nflog_set_qthresh(ntv->gh, ntv->qthreshold) >= 0) SCLogDebug("NFLOG netlink queue threshold has been set to %d", ntv->qthreshold); else SCLogDebug("NFLOG netlink queue threshold can't be set to %d", ntv->qthreshold); if (nflog_set_timeout(ntv->gh, ntv->qtimeout) >= 0) SCLogDebug("NFLOG netlink queue timeout has been set to %d", ntv->qtimeout); else SCLogDebug("NFLOG netlink queue timeout can't be set to %d", ntv->qtimeout); ntv->livedev = LiveGetDevice(nflconfig->numgroup); if (ntv->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to find Live device"); SCFree(ntv); SCReturnInt(TM_ECODE_FAILED); } /* set a timeout to the socket so we can check for a signal * in case we don't get packets for a longer period. */ struct timeval timev; timev.tv_sec = 1; timev.tv_usec = 0; int fd = nflog_fd(ntv->h); if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timev, sizeof(timev)) == -1) { SCLogWarning(SC_WARN_NFLOG_SETSOCKOPT, "can't set socket " "timeout: %s", strerror(errno)); } #ifdef PACKET_STATISTICS ntv->capture_kernel_packets = StatsRegisterCounter("capture.kernel_packets", ntv->tv); ntv->capture_kernel_drops = StatsRegisterCounter("capture.kernel_drops", ntv->tv); #endif char *active_runmode = RunmodeGetActive(); if (active_runmode && !strcmp("workers", active_runmode)) runmode_workers = 1; else runmode_workers = 0; #define T_DATA_SIZE 70000 ntv->data = SCMalloc(T_DATA_SIZE); if (ntv->data == NULL) { nflconfig->DerefFunc(nflconfig); SCFree(ntv); SCReturnInt(TM_ECODE_FAILED); } ntv->datalen = T_DATA_SIZE; #undef T_DATA_SIZE *data = (void *)ntv; nflconfig->DerefFunc(nflconfig); SCReturnInt(TM_ECODE_OK); } /** * \brief DeInit function unbind group and close nflog's handle * \param tv pointer to ThreadVars * \param data pointer that gets cast into NFLogThreadVars * \retval TM_ECODE_OK is always returned */ TmEcode ReceiveNFLOGThreadDeinit(ThreadVars *tv, void *data) { NFLOGThreadVars *ntv = (NFLOGThreadVars *)data; SCLogDebug("closing nflog group %d", ntv->group); if (nflog_unbind_pf(ntv->h, AF_INET) < 0) { SCLogError(SC_ERR_NFLOG_UNBIND, "nflog_unbind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nflog_unbind_pf(ntv->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFLOG_UNBIND, "nflog_unbind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } if (ntv->gh) { nflog_unbind_group(ntv->gh); ntv->gh = NULL; } if (ntv->h) { nflog_close(ntv->h); ntv->h = NULL; } SCReturnInt(TM_ECODE_OK); } /** * \brief Increases netlink buffer size * * This function netlink's buffer size until * the max buffer size is reached * * \param data pointer that gets cast into NFLOGThreadVars * \param size netlink buffer size */ static int NFLOGSetnlbufsiz(void *data, unsigned int size) { SCEnter(); NFLOGThreadVars *ntv = (NFLOGThreadVars *)data; if (size < ntv->nlbufsiz_max) { ntv->nlbufsiz = nfnl_rcvbufsiz(nflog_nfnlh(ntv->h), ntv->nlbufsiz); return 1; } SCLogWarning(SC_WARN_NFLOG_MAXBUFSIZ_REACHED, "Maximum buffer size (%d) in NFLOG has been " "reached. Please, consider raising " "`buffer-size` and `max-size` in nflog configuration", ntv->nlbufsiz); return 0; } /** * \brief Recieves packets from a group via libnetfilter_log. * * This function recieves packets from a group and passes * the packet on to the nflog callback function. * * \param tv pointer to ThreadVars * \param data pointer that gets cast into NFLOGThreadVars * \param slot slot containing task information * \retval TM_ECODE_OK on success * \retval TM_ECODE_FAILED on failure */ TmEcode ReceiveNFLOGLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); NFLOGThreadVars *ntv = (NFLOGThreadVars *)data; int rv, fd; int ret = -1; ntv->slot = ((TmSlot *) slot)->slot_next; fd = nflog_fd(ntv->h); if (fd < 0) { SCLogError(SC_ERR_NFLOG_FD, "Can't obtain a file descriptor"); SCReturnInt(TM_ECODE_FAILED); } while (1) { if (suricata_ctl_flags != 0) break; rv = recv(fd, ntv->data, ntv->datalen, 0); if (rv < 0) { /*We received an error on socket read */ if (errno == EINTR || errno == EWOULDBLOCK) { /*Nothing for us to process */ continue; } else if (errno == ENOBUFS) { if (!ntv->nful_overrun_warned) { int s = ntv->nlbufsiz * 2; if (NFLOGSetnlbufsiz((void *)ntv, s)) { SCLogWarning(SC_WARN_NFLOG_LOSING_EVENTS, "We are losing events, " "increasing buffer size " "to %d", ntv->nlbufsiz); } else { ntv->nful_overrun_warned = 1; } } continue; } else { SCLogWarning(SC_WARN_NFLOG_RECV, "Read from NFLOG fd failed: %s", strerror(errno)); SCReturnInt(TM_ECODE_FAILED); } } ret = nflog_handle_packet(ntv->h, ntv->data, rv); if (ret != 0) SCLogWarning(SC_ERR_NFLOG_HANDLE_PKT, "nflog_handle_packet error %" PRId32 "", ret); StatsSyncCountersIfSignalled(tv); } SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats to the screen at exit * \param tv pointer to ThreadVars * \param data pointer that gets cast into NFLOGThreadVars */ void ReceiveNFLOGThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); NFLOGThreadVars *ntv = (NFLOGThreadVars *)data; SCLogNotice("(%s) Pkts %" PRIu32 ", Bytes %" PRIu64 "", tv->name, ntv->pkts, ntv->bytes); } /** * \brief Decode IPv4/v6 packets. * * \param tv pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into NFLOGThreadVars for ptv * \param pq pointer to the current PacketQueue * * \retval TM_ECODE_OK is always returned */ TmEcode DecodeNFLOG(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); IPV4Hdr *ip4h = (IPV4Hdr *)GET_PKT_DATA(p); IPV6Hdr *ip6h = (IPV6Hdr *)GET_PKT_DATA(p); DecodeThreadVars *dtv = (DecodeThreadVars *)data; DecodeUpdatePacketCounters(tv, dtv, p); if (IPV4_GET_RAW_VER(ip4h) == 4) { SCLogDebug("IPv4 packet"); DecodeIPV4(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else if(IPV6_GET_RAW_VER(ip6h) == 6) { SCLogDebug("IPv6 packet"); DecodeIPV6(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else { SCLogDebug("packet unsupported by NFLOG, first byte: %02x", *GET_PKT_DATA(p)); } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } /** * \brief This an Init function for DecodeNFLOG * * \param tv pointer to ThreadVars * \param initdata pointer to initilization data. * \param data pointer that gets cast into NFLOGThreadVars * \retval TM_ECODE_OK is returned on success * \retval TM_ECODE_FAILED is returned on error */ TmEcode DecodeNFLOGThreadInit(ThreadVars *tv, void *initdata, void **data) { DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodeNFLOGThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* NFLOG */ suricata-3.2.1/src/detect-template-buffer.h0000644000000000000000000000171413051004444015505 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author FirstName LastName */ #ifndef __DETECT_TEMPLATE_BUFFER_H__ #define __DETECT_TEMPLATE_BUFFER_H__ #include "app-layer-template.h" void DetectTemplateBufferRegister(void); #endif /* __DETECT_TEMPLATE_BUFFER_H__ */ suricata-3.2.1/src/output-json-alert.h0000644000000000000000000000207013051004444014565 00000000000000/* Copyright (C) 2013-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Logs alerts in JSON format. * */ #ifndef __OUTPUT_JSON_ALERT_H__ #define __OUTPUT_JSON_ALERT_H__ void JsonAlertLogRegister(void); #ifdef HAVE_LIBJANSSON void AlertJsonHeader(const Packet *p, const PacketAlert *pa, json_t *js); #endif /* HAVE_LIBJANSSON */ #endif /* __OUTPUT_JSON_ALERT_H__ */ suricata-3.2.1/src/detect-stream_size.c0000644000000000000000000003354413051004444014751 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh * * Stream size for the engine. */ #include "suricata-common.h" #include "stream-tcp.h" #include "util-unittest.h" #include "detect.h" #include "detect-parse.h" #include "flow.h" #include "detect-stream_size.h" #include "stream-tcp-private.h" #include "util-debug.h" /** * \brief Regex for parsing our flow options */ #define PARSE_REGEX "^\\s*([A-z_]+)\\s*,\\s*([<=>!]+)\\s*,\\s*([0-9]+)\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; /*prototypes*/ int DetectStreamSizeMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectStreamSizeSetup (DetectEngineCtx *, Signature *, char *); void DetectStreamSizeFree(void *); void DetectStreamSizeRegisterTests(void); /** * \brief Registration function for stream_size: keyword */ void DetectStreamSizeRegister(void) { sigmatch_table[DETECT_STREAM_SIZE].name = "stream_size"; sigmatch_table[DETECT_STREAM_SIZE].desc = "match on amount of bytes of a stream"; sigmatch_table[DETECT_STREAM_SIZE].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#stream-size"; sigmatch_table[DETECT_STREAM_SIZE].Match = DetectStreamSizeMatch; sigmatch_table[DETECT_STREAM_SIZE].Setup = DetectStreamSizeSetup; sigmatch_table[DETECT_STREAM_SIZE].Free = DetectStreamSizeFree; sigmatch_table[DETECT_STREAM_SIZE].RegisterTests = DetectStreamSizeRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief Function to comapre the stream size against defined size in the user * options. * * \param diff The stream size of server or client stream. * \param stream_size User defined stream size * \param mode The mode defined by user. * * \retval 1 on success and 0 on failure. */ static int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { int ret = 0; switch (mode) { case DETECTSSIZE_LT: if (diff < stream_size) ret = 1; break; case DETECTSSIZE_LEQ: if (diff <= stream_size) ret = 1; break; case DETECTSSIZE_EQ: if (diff == stream_size) ret = 1; break; case DETECTSSIZE_NEQ: if (diff != stream_size) ret = 1; break; case DETECTSSIZE_GEQ: if (diff >= stream_size) ret = 1; break; case DETECTSSIZE_GT: if (diff > stream_size) ret = 1; break; } return ret; } /** * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectStreamSizeData * * \retval 0 no match * \retval 1 match */ int DetectStreamSizeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { int ret = 0; const DetectStreamSizeData *sd = (const DetectStreamSizeData *)ctx; if (!(PKT_IS_TCP(p))) return ret; uint32_t csdiff = 0; uint32_t ssdiff = 0; if (p->flow == NULL) return ret; TcpSession *ssn = (TcpSession *)p->flow->protoctx; if (ssn == NULL) return ret; if (sd->flags & STREAM_SIZE_SERVER) { /* get the server stream size */ ssdiff = ssn->server.next_seq - ssn->server.isn; ret = DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode); } else if (sd->flags & STREAM_SIZE_CLIENT) { /* get the client stream size */ csdiff = ssn->client.next_seq - ssn->client.isn; ret = DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode); } else if (sd->flags & STREAM_SIZE_BOTH) { ssdiff = ssn->server.next_seq - ssn->server.isn; csdiff = ssn->client.next_seq - ssn->client.isn; if (DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode) && DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode)) ret = 1; } else if (sd->flags & STREAM_SIZE_EITHER) { ssdiff = ssn->server.next_seq - ssn->server.isn; csdiff = ssn->client.next_seq - ssn->client.isn; if (DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode) || DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode)) ret = 1; } return ret; } /** * \brief This function is used to parse stream options passed via stream_size: keyword * * \param streamstr Pointer to the user provided stream_size options * * \retval sd pointer to DetectStreamSizeData on success * \retval NULL on failure */ DetectStreamSizeData *DetectStreamSizeParse (char *streamstr) { DetectStreamSizeData *sd = NULL; char *arg = NULL; char *value = NULL; char *mode = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, streamstr, strlen(streamstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, streamstr); goto error; } const char *str_ptr; res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg = (char *)str_ptr; res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } mode = (char *)str_ptr; res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } value = (char *)str_ptr; sd = SCMalloc(sizeof(DetectStreamSizeData)); if (unlikely(sd == NULL)) goto error; sd->ssize = 0; sd->flags = 0; if (strlen(mode) == 0) goto error; if (mode[0] == '=') { sd->mode = DETECTSSIZE_EQ; } else if (mode[0] == '<') { sd->mode = DETECTSSIZE_LT; if (strcmp("<=", mode) == 0) sd->mode = DETECTSSIZE_LEQ; } else if (mode[0] == '>') { sd->mode = DETECTSSIZE_GT; if (strcmp(">=", mode) == 0) sd->mode = DETECTSSIZE_GEQ; } else if (strcmp("!=", mode) == 0) { sd->mode = DETECTSSIZE_NEQ; } else { SCLogError(SC_ERR_INVALID_OPERATOR, "Invalid operator"); goto error; } /* set the value */ sd->ssize = (uint32_t)atoi(value); /* inspect our options and set the flags */ if (strcmp(arg, "server") == 0) { sd->flags |= STREAM_SIZE_SERVER; } else if (strcmp(arg, "client") == 0) { sd->flags |= STREAM_SIZE_CLIENT; } else if ((strcmp(arg, "both") == 0)) { sd->flags |= STREAM_SIZE_BOTH; } else if (strcmp(arg, "either") == 0) { sd->flags |= STREAM_SIZE_EITHER; } else { goto error; } SCFree(mode); SCFree(arg); SCFree(value); return sd; error: if (mode != NULL) SCFree(mode); if (arg != NULL) SCFree(arg); if (value != NULL) SCFree(value); if (sd != NULL) DetectStreamSizeFree(sd); return NULL; } /** * \brief this function is used to add the parsed stream size data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param streamstr pointer to the user provided stream size options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectStreamSizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *streamstr) { DetectStreamSizeData *sd = NULL; SigMatch *sm = NULL; sd = DetectStreamSizeParse(streamstr); if (sd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_STREAM_SIZE; sm->ctx = (SigMatchCtx *)sd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (sd != NULL) DetectStreamSizeFree(sd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectStreamSizeData * * \param ptr pointer to DetectStreamSizeData */ void DetectStreamSizeFree(void *ptr) { DetectStreamSizeData *sd = (DetectStreamSizeData *)ptr; SCFree(sd); } #ifdef UNITTESTS /** * \test DetectStreamSizeParseTest01 is a test to make sure that we parse the * user options correctly, when given valid stream_size options. */ static int DetectStreamSizeParseTest01 (void) { int result = 0; DetectStreamSizeData *sd = NULL; sd = DetectStreamSizeParse("server,<,6"); if (sd != NULL) { if (sd->flags & STREAM_SIZE_SERVER && sd->mode == DETECTSSIZE_LT && sd->ssize == 6) result = 1; DetectStreamSizeFree(sd); } return result; } /** * \test DetectStreamSizeParseTest02 is a test to make sure that we detect the * invalid stream_size options. */ static int DetectStreamSizeParseTest02 (void) { int result = 1; DetectStreamSizeData *sd = NULL; sd = DetectStreamSizeParse("invalidoption,<,6"); if (sd != NULL) { printf("expected: NULL got 0x%02X %" PRIu32 ": ",sd->flags, sd->ssize); result = 0; DetectStreamSizeFree(sd); } return result; } /** * \test DetectStreamSizeParseTest03 is a test to make sure that we match the * packet correctly provided valid stream size. */ static int DetectStreamSizeParseTest03 (void) { int result = 0; DetectStreamSizeData *sd = NULL; TcpSession ssn; ThreadVars tv; DetectEngineThreadCtx dtx; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature s; SigMatch sm; TcpStream client; Flow f; TCPHdr tcph; memset(&ssn, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof(ThreadVars)); memset(&dtx, 0, sizeof(DetectEngineThreadCtx)); memset(&s, 0, sizeof(Signature)); memset(&sm, 0, sizeof(SigMatch)); memset(&client, 0, sizeof(TcpStream)); memset(&f, 0, sizeof(Flow)); memset(&tcph, 0, sizeof(TCPHdr)); sd = DetectStreamSizeParse("client,>,8"); if (sd != NULL) { if (!(sd->flags & STREAM_SIZE_CLIENT)) { printf("sd->flags not STREAM_SIZE_CLIENT: "); DetectStreamSizeFree(sd); SCFree(p); return 0; } if (sd->mode != DETECTSSIZE_GT) { printf("sd->mode not DETECTSSIZE_GT: "); DetectStreamSizeFree(sd); SCFree(p); return 0; } if (sd->ssize != 8) { printf("sd->ssize is %"PRIu32", not 8: ", sd->ssize); DetectStreamSizeFree(sd); SCFree(p); return 0; } } else { printf("sd == NULL: "); SCFree(p); return 0; } client.next_seq = 20; client.isn = 10; ssn.client = client; f.protoctx = &ssn; p->flow = &f; p->tcph = &tcph; sm.ctx = (SigMatchCtx*)sd; result = DetectStreamSizeMatch(&tv, &dtx, p, &s, sm.ctx); if (result == 0) { printf("result 0 != 1: "); } DetectStreamSizeFree(sd); SCFree(p); return result; } /** * \test DetectStreamSizeParseTest04 is a test to make sure that we match the * stream_size against invalid packet parameters. */ static int DetectStreamSizeParseTest04 (void) { int result = 0; DetectStreamSizeData *sd = NULL; TcpSession ssn; ThreadVars tv; DetectEngineThreadCtx dtx; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; Signature s; SigMatch sm; TcpStream client; Flow f; IPV4Hdr ip4h; memset(&ssn, 0, sizeof(TcpSession)); memset(&tv, 0, sizeof(ThreadVars)); memset(&dtx, 0, sizeof(DetectEngineThreadCtx)); memset(&s, 0, sizeof(Signature)); memset(&sm, 0, sizeof(SigMatch)); memset(&client, 0, sizeof(TcpStream)); memset(&f, 0, sizeof(Flow)); memset(&ip4h, 0, sizeof(IPV4Hdr)); sd = DetectStreamSizeParse(" client , > , 8 "); if (sd != NULL) { if (!(sd->flags & STREAM_SIZE_CLIENT) && sd->mode != DETECTSSIZE_GT && sd->ssize != 8) { SCFree(p); return 0; } } else { SCFree(p); return 0; } client.next_seq = 20; client.isn = 12; ssn.client = client; f.protoctx = &ssn; p->flow = &f; p->ip4h = &ip4h; sm.ctx = (SigMatchCtx*)sd; if (!DetectStreamSizeMatch(&tv, &dtx, p, &s, sm.ctx)) result = 1; SCFree(p); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectStreamSize */ void DetectStreamSizeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectStreamSizeParseTest01", DetectStreamSizeParseTest01); UtRegisterTest("DetectStreamSizeParseTest02", DetectStreamSizeParseTest02); UtRegisterTest("DetectStreamSizeParseTest03", DetectStreamSizeParseTest03); UtRegisterTest("DetectStreamSizeParseTest04", DetectStreamSizeParseTest04); #endif /* UNITTESTS */ } suricata-3.2.1/src/output-stats.h0000644000000000000000000000373113051004444013652 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Stats Logger Output registration functions */ #ifndef __OUTPUT_STATS_H__ #define __OUTPUT_STATS_H__ typedef struct StatsRecord_ { const char *name; const char *tm_name; uint64_t value; /**< total value */ uint64_t pvalue; /**< prev value (may be higher for memuse counters) */ } StatsRecord; typedef struct StatsTable_ { StatsRecord *stats; /**< array of global stats, indexed by counters gid */ StatsRecord *tstats; /**< array of arrays with per thread stats */ uint32_t nstats; /**< size in records of 'stats' */ uint32_t ntstats; /**< number of threads for which tstats stores stats */ time_t start_time; struct timeval ts; } StatsTable; TmEcode OutputStatsLog(ThreadVars *tv, void *thread_data, StatsTable *st); typedef int (*StatsLogger)(ThreadVars *, void *thread_data, const StatsTable *); int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void TmModuleStatsLoggerRegister (void); int OutputStatsLoggersRegistered(void); void OutputStatsShutdown(void); #endif /* __OUTPUT_STATS_H__ */ suricata-3.2.1/src/flow-manager.h0000644000000000000000000000317613051004444013540 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __FLOW_MANAGER_H__ #define __FLOW_MANAGER_H__ #define FlowTimeoutsReset() FlowTimeoutsInit() void FlowTimeoutsInit(void); void FlowTimeoutsEmergency(void); /** flow manager scheduling condition */ SCCtrlCondT flow_manager_ctrl_cond; SCCtrlMutex flow_manager_ctrl_mutex; #define FlowWakeupFlowManagerThread() SCCtrlCondSignal(&flow_manager_ctrl_cond) void FlowManagerThreadSpawn(void); void FlowDisableFlowManagerThread(void); void FlowMgrRegisterTests (void); /** flow recycler scheduling condition */ SCCtrlCondT flow_recycler_ctrl_cond; SCCtrlMutex flow_recycler_ctrl_mutex; #define FlowWakeupFlowRecyclerThread() \ SCCtrlCondSignal(&flow_recycler_ctrl_cond) void FlowRecyclerThreadSpawn(void); void FlowDisableFlowRecyclerThread(void); void TmModuleFlowManagerRegister (void); void TmModuleFlowRecyclerRegister (void); #endif /* __FLOW_MANAGER_H__ */ suricata-3.2.1/src/detect-engine-address.c0000644000000000000000000044337013051004444015316 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Address part of the detection engine. * * \todo Move this out of the detection plugin structure * rename to detect-engine-address.c */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "flow-var.h" #include "util-cidr.h" #include "util-unittest.h" #include "util-rule-vars.h" #include "conf.h" #include "conf-yaml-loader.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "detect-engine-address-ipv4.h" #include "detect-engine-address-ipv6.h" #include "detect-engine-port.h" #include "util-debug.h" #include "util-print.h" #include "util-var.h" /* prototypes */ void DetectAddressPrint(DetectAddress *); static int DetectAddressCutNot(DetectAddress *, DetectAddress **); static int DetectAddressCut(DetectEngineCtx *, DetectAddress *, DetectAddress *, DetectAddress **); int DetectAddressMergeNot(DetectAddressHead *gh, DetectAddressHead *ghn); /** * \brief Creates and returns a new instance of a DetectAddress. * * \retval ag Pointer to the newly created DetectAddress on success; * NULL on failure. */ DetectAddress *DetectAddressInit(void) { DetectAddress *ag = SCMalloc(sizeof(DetectAddress)); if (unlikely(ag == NULL)) return NULL; memset(ag, 0, sizeof(DetectAddress)); return ag; } /** * \brief Frees a DetectAddress instance. * * \param ag Pointer to the DetectAddress instance to be freed. */ void DetectAddressFree(DetectAddress *ag) { if (ag == NULL) return; SCFree(ag); return; } /** * \brief Copies the contents of one Address group in DetectAddress and returns * a new instance of the DetectAddress that contains the copied address. * * \param orig Pointer to the instance of DetectAddress that contains the * address data to be copied to the new instance. * * \retval ag Pointer to the new instance of DetectAddress that contains the * copied address. */ DetectAddress *DetectAddressCopy(DetectAddress *orig) { DetectAddress *ag = DetectAddressInit(); if (ag == NULL) return NULL; ag->flags = orig->flags; COPY_ADDRESS(&orig->ip, &ag->ip); COPY_ADDRESS(&orig->ip2, &ag->ip2); return ag; } /** * \brief Used to check if a DetectAddress list contains an instance with * a similar DetectAddress. The comparison done is not the one that * checks the memory for the same instance, but one that checks that the * two instances hold the same content. * * \param head Pointer to the DetectAddress list. * \param ad Pointer to the DetectAddress that has to be checked for in * the DetectAddress list. * * \retval cur Returns a pointer to the DetectAddress on a match; NULL if * no match. */ DetectAddress *DetectAddressLookupInList(DetectAddress *head, DetectAddress *gr) { DetectAddress *cur; if (head != NULL) { for (cur = head; cur != NULL; cur = cur->next) { if (DetectAddressCmp(cur, gr) == ADDRESS_EQ) return cur; } } return NULL; } /** * \brief Prints the address data information for all the DetectAddress * instances in the DetectAddress list sent as the argument. * * \param head Pointer to a list of DetectAddress instances. */ void DetectAddressPrintList(DetectAddress *head) { DetectAddress *cur; SCLogInfo("list:"); if (head != NULL) { for (cur = head; cur != NULL; cur = cur->next) { DetectAddressPrint(cur); } } SCLogInfo("endlist"); return; } /** * \brief Frees a list of DetectAddress instances. * * \param head Pointer to a list of DetectAddress instances to be freed. */ void DetectAddressCleanupList(DetectAddress *head) { DetectAddress *cur, *next; if (head == NULL) return; for (cur = head; cur != NULL; ) { next = cur->next; cur->next = NULL; DetectAddressFree(cur); cur = next; } return; } /** * \brief Do a sorted insert, where the top of the list should be the biggest * network/range. * * XXX current sorting only works for overlapping nets * * \param head Pointer to the list of DetectAddress. * \param ag Pointer to the DetectAddress that has to be added to the * above list. * * \retval 0 On successfully inserting the DetectAddress. * \retval -1 On failure. */ int DetectAddressAdd(DetectAddress **head, DetectAddress *ag) { DetectAddress *cur, *prev_cur = NULL; int r = 0; if (*head != NULL) { for (cur = *head; cur != NULL; cur = cur->next) { prev_cur = cur; r = DetectAddressCmp(ag, cur); if (r == ADDRESS_EB) { /* insert here */ ag->prev = cur->prev; ag->next = cur; cur->prev = ag; if (*head == cur) *head = ag; else ag->prev->next = ag; return 0; } } ag->prev = prev_cur; if (prev_cur != NULL) prev_cur->next = ag; } else { *head = ag; } return 0; } /** * \internal * \brief Helper function for DetectAddressInsert. Sets one of the * DetectAddressHead head pointers, to the DetectAddress argument * based on its address family. * * \param gh Pointer to the DetectAddressHead. * \param newhead Pointer to the DetectAddress. * * \retval 0 On success. * \retval -1 On failure. */ static int SetHeadPtr(DetectAddressHead *gh, DetectAddress *newhead) { if (newhead->flags & ADDRESS_FLAG_ANY) { gh->any_head = newhead; } else if (newhead->ip.family == AF_INET) { gh->ipv4_head = newhead; } else if (newhead->ip.family == AF_INET6) { gh->ipv6_head = newhead; } else { SCLogDebug("newhead->family %u not supported", newhead->ip.family); return -1; } return 0; } /** * \internal * \brief Returns the DetectAddress head from the DetectAddressHeads, * based on the address family of the incoming DetectAddress arg. * * \param gh Pointer to the DetectAddressHead. * \param new Pointer to the DetectAddress. * * \retval head Pointer to the DetectAddress(the head from * DetectAddressHead). */ static DetectAddress *GetHeadPtr(DetectAddressHead *gh, DetectAddress *new) { DetectAddress *head = NULL; if (new->flags & ADDRESS_FLAG_ANY) head = gh->any_head; else if (new->ip.family == AF_INET) head = gh->ipv4_head; else if (new->ip.family == AF_INET6) head = gh->ipv6_head; return head; } /** * \brief Same as DetectAddressInsert, but then for inserting a address group * object. This also makes sure SigGroupContainer lists are handled * correctly. * * \param de_ctx Pointer to the detection engine context. * \param gh Pointer to the DetectAddressHead list to which it has to * be inserted. * \param new Pointer to the DetectAddress, that has to be inserted. * * \retval 1 On successfully inserting it. * \retval -1 On error. * \retval 0 Not inserted, memory of new is freed. */ int DetectAddressInsert(DetectEngineCtx *de_ctx, DetectAddressHead *gh, DetectAddress *new) { DetectAddress *head = NULL; DetectAddress *cur = NULL; DetectAddress *c = NULL; int r = 0; if (new == NULL) return 0; BUG_ON(new->ip.family == 0 && !(new->flags & ADDRESS_FLAG_ANY)); /* get our head ptr based on the address we want to insert */ head = GetHeadPtr(gh, new); /* see if it already exists or overlaps with existing ag's */ if (head != NULL) { cur = NULL; for (cur = head; cur != NULL; cur = cur->next) { r = DetectAddressCmp(new, cur); BUG_ON(r == ADDRESS_ER); /* if so, handle that */ if (r == ADDRESS_EQ) { /* exact overlap/match */ if (cur != new) { DetectAddressFree(new); return 0; } return 1; } else if (r == ADDRESS_GT) { /* only add it now if we are bigger than the last group. * Otherwise we'll handle it later. */ if (cur->next == NULL) { /* put in the list */ new->prev = cur; cur->next = new; return 1; } } else if (r == ADDRESS_LT) { /* see if we need to insert the ag anywhere put in the list */ if (cur->prev != NULL) cur->prev->next = new; new->prev = cur->prev; new->next = cur; cur->prev = new; /* update head if required */ if (head == cur) { head = new; if (SetHeadPtr(gh, head) < 0) goto error; } return 1; /* alright, those were the simple cases, lets handle the more * complex ones now */ } else if (r == ADDRESS_ES) { c = NULL; r = DetectAddressCut(de_ctx, cur, new, &c); if (r == -1) goto error; DetectAddressInsert(de_ctx, gh, new); if (c != NULL) DetectAddressInsert(de_ctx, gh, c); return 1; } else if (r == ADDRESS_EB) { c = NULL; r = DetectAddressCut(de_ctx, cur, new, &c); if (r == -1) goto error; DetectAddressInsert(de_ctx, gh, new); if (c != NULL) DetectAddressInsert(de_ctx, gh, c); return 1; } else if (r == ADDRESS_LE) { c = NULL; r = DetectAddressCut(de_ctx, cur, new, &c); if (r == -1) goto error; DetectAddressInsert(de_ctx, gh, new); if (c != NULL) DetectAddressInsert(de_ctx, gh, c); return 1; } else if (r == ADDRESS_GE) { c = NULL; r = DetectAddressCut(de_ctx, cur,new,&c); if (r == -1) goto error; DetectAddressInsert(de_ctx, gh, new); if (c != NULL) DetectAddressInsert(de_ctx, gh, c); return 1; } } /* head is NULL, so get a group and set head to it */ } else { head = new; if (SetHeadPtr(gh, head) < 0) { SCLogDebug("SetHeadPtr failed"); goto error; } } return 1; error: /* XXX */ return -1; } /** * \brief Join two addresses groups together. * * \param de_ctx Pointer to the detection engine context. * \param target Pointer to the target address group. * \param source Pointer to the source address group. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressJoin(DetectEngineCtx *de_ctx, DetectAddress *target, DetectAddress *source) { if (target == NULL || source == NULL) return -1; if (target->ip.family != source->ip.family) return -1; if (target->ip.family == AF_INET) return DetectAddressJoinIPv4(de_ctx, target, source); else if (target->ip.family == AF_INET6) return DetectAddressJoinIPv6(de_ctx, target, source); return -1; } /** * \internal * \brief Creates a cidr ipv6 netblock, based on the cidr netblock value. * * For example if we send a cidr of 7 as argument, an ipv6 address * mask of the value FE:00:00:00:00:00:00:00 is created and updated * in the argument struct in6_addr *in6. * * \todo I think for the final section: while (cidr > 0), we can simply * replace it with a * if (cidr > 0) { * in6->s6_addr[i] = -1 << (8 - cidr); * * \param cidr The value of the cidr. * \param in6 Pointer to an ipv6 address structure(struct in6_addr) which will * hold the cidr netblock result. */ static void DetectAddressParseIPv6CIDR(int cidr, struct in6_addr *in6) { int i = 0; memset(in6, 0, sizeof(struct in6_addr)); while (cidr > 8) { in6->s6_addr[i] = 0xff; cidr -= 8; i++; } while (cidr > 0) { in6->s6_addr[i] |= 0x80; if (--cidr > 0) in6->s6_addr[i] = in6->s6_addr[i] >> 1; } return; } /** * \internal * \brief Parses an ipv4/ipv6 address string and updates the result into the * DetectAddress instance sent as the argument. * * \param dd Pointer to the DetectAddress instance which should be updated with * the address range details from the parsed ip string. * \param str Pointer to address string that has to be parsed. * * \retval 0 On successfully parsing the address string. * \retval -1 On failure. */ int DetectAddressParseString(DetectAddress *dd, char *str) { char *ip = NULL; char *ip2 = NULL; char *mask = NULL; int r = 0; char ipstr[256]; while (*str != '\0' && *str == ' ') str++; /* first handle 'any' */ if (strcasecmp(str, "any") == 0) { dd->flags |= ADDRESS_FLAG_ANY; SCLogDebug("address is \'any\'"); return 0; } strlcpy(ipstr, str, sizeof(ipstr)); SCLogDebug("str %s", str); /* we work with a copy so that we can put a * nul-termination in it later */ ip = ipstr; /* handle the negation case */ if (ip[0] == '!') { dd->flags |= ADDRESS_FLAG_NOT; ip++; } /* see if the address is an ipv4 or ipv6 address */ if ((strchr(str, ':')) == NULL) { /* IPv4 Address */ struct in_addr in; dd->ip.family = AF_INET; if ((mask = strchr(ip, '/')) != NULL) { /* 1.2.3.4/xxx format (either dotted or cidr notation */ ip[mask - ip] = '\0'; mask++; uint32_t ip4addr = 0; uint32_t netmask = 0; size_t u = 0; if ((strchr (mask, '.')) == NULL) { /* 1.2.3.4/24 format */ for (u = 0; u < strlen(mask); u++) { if(!isdigit((unsigned char)mask[u])) goto error; } int cidr = atoi(mask); if (cidr < 0 || cidr > 32) goto error; netmask = CIDRGet(cidr); } else { /* 1.2.3.4/255.255.255.0 format */ r = inet_pton(AF_INET, mask, &in); if (r <= 0) goto error; netmask = in.s_addr; } r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; ip4addr = in.s_addr; dd->ip.addr_data32[0] = dd->ip2.addr_data32[0] = ip4addr & netmask; dd->ip2.addr_data32[0] |=~ netmask; } else if ((ip2 = strchr(ip, '-')) != NULL) { /* 1.2.3.4-1.2.3.6 range format */ ip[ip2 - ip] = '\0'; ip2++; r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; dd->ip.addr_data32[0] = in.s_addr; r = inet_pton(AF_INET, ip2, &in); if (r <= 0) goto error; dd->ip2.addr_data32[0] = in.s_addr; /* a > b is illegal, a = b is ok */ if (ntohl(dd->ip.addr_data32[0]) > ntohl(dd->ip2.addr_data32[0])) goto error; } else { /* 1.2.3.4 format */ r = inet_pton(AF_INET, ip, &in); if (r <= 0) goto error; /* single host */ dd->ip.addr_data32[0] = in.s_addr; dd->ip2.addr_data32[0] = in.s_addr; } } else { /* IPv6 Address */ struct in6_addr in6, mask6; uint32_t ip6addr[4], netmask[4]; dd->ip.family = AF_INET6; if ((mask = strchr(ip, '/')) != NULL) { ip[mask - ip] = '\0'; mask++; int cidr = atoi(mask); if (cidr < 0 || cidr > 128) goto error; r = inet_pton(AF_INET6, ip, &in6); if (r <= 0) goto error; memcpy(&ip6addr, &in6.s6_addr, sizeof(ip6addr)); DetectAddressParseIPv6CIDR(cidr, &mask6); memcpy(&netmask, &mask6.s6_addr, sizeof(netmask)); dd->ip2.addr_data32[0] = dd->ip.addr_data32[0] = ip6addr[0] & netmask[0]; dd->ip2.addr_data32[1] = dd->ip.addr_data32[1] = ip6addr[1] & netmask[1]; dd->ip2.addr_data32[2] = dd->ip.addr_data32[2] = ip6addr[2] & netmask[2]; dd->ip2.addr_data32[3] = dd->ip.addr_data32[3] = ip6addr[3] & netmask[3]; dd->ip2.addr_data32[0] |=~ netmask[0]; dd->ip2.addr_data32[1] |=~ netmask[1]; dd->ip2.addr_data32[2] |=~ netmask[2]; dd->ip2.addr_data32[3] |=~ netmask[3]; } else if ((ip2 = strchr(ip, '-')) != NULL) { /* 2001::1-2001::4 range format */ ip[ip2 - ip] = '\0'; ip2++; r = inet_pton(AF_INET6, ip, &in6); if (r <= 0) goto error; memcpy(&dd->ip.address, &in6.s6_addr, sizeof(ip6addr)); r = inet_pton(AF_INET6, ip2, &in6); if (r <= 0) goto error; memcpy(&dd->ip2.address, &in6.s6_addr, sizeof(ip6addr)); /* a > b is illegal, a=b is ok */ if (AddressIPv6Gt(&dd->ip, &dd->ip2)) goto error; } else { r = inet_pton(AF_INET6, ip, &in6); if (r <= 0) goto error; memcpy(&dd->ip.address, &in6.s6_addr, sizeof(dd->ip.address)); memcpy(&dd->ip2.address, &in6.s6_addr, sizeof(dd->ip2.address)); } } BUG_ON(dd->ip.family == 0); return 0; error: return -1; } /** * \internal * \brief Simply parse an address and return a DetectAddress instance containing * the address ranges of the parsed ip addressstring * * \param str Pointer to a character string containing the ip address * * \retval dd Pointer to the DetectAddress instance containing the address * range details from the parsed ip string */ static DetectAddress *DetectAddressParseSingle(char *str) { DetectAddress *dd; SCLogDebug("str %s", str); dd = DetectAddressInit(); if (dd == NULL) goto error; if (DetectAddressParseString(dd, str) < 0) { SCLogDebug("AddressParse failed"); goto error; } return dd; error: if (dd != NULL) DetectAddressFree(dd); return NULL; } /** * \brief Setup a single address string, parse it and add the resulting * Address-Range(s) to the AddessHead(DetectAddressHead instance). * * \param gh Pointer to the Address-Head(DetectAddressHead) to which the * resulting Address-Range(s) from the parsed ip string has to * be added. * \param s Pointer to the ip address string to be parsed. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressSetup(DetectAddressHead *gh, char *s) { DetectAddress *ad = NULL; DetectAddress *ad2 = NULL; int r = 0; char any = FALSE; SCLogDebug("gh %p, s %s", gh, s); /* parse the address */ ad = DetectAddressParseSingle(s); if (ad == NULL) { SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC, "failed to parse address \"%s\"", s); return -1; } if (ad->flags & ADDRESS_FLAG_ANY) any = TRUE; /* handle the not case, we apply the negation then insert the part(s) */ if (ad->flags & ADDRESS_FLAG_NOT) { ad2 = NULL; if (DetectAddressCutNot(ad, &ad2) < 0) { SCLogDebug("DetectAddressCutNot failed"); goto error; } /* normally a 'not' will result in two ad's unless the 'not' is on the start or end * of the address space (e.g. 0.0.0.0 or 255.255.255.255). */ if (ad2 != NULL) { if (DetectAddressInsert(NULL, gh, ad2) < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } } } r = DetectAddressInsert(NULL, gh, ad); if (r < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } SCLogDebug("r %d",r); /* if any, insert 0.0.0.0/0 and ::/0 as well */ if (r == 1 && any == TRUE) { SCLogDebug("adding 0.0.0.0/0 and ::/0 as we\'re handling \'any\'"); ad = DetectAddressParseSingle("0.0.0.0/0"); if (ad == NULL) goto error; BUG_ON(ad->ip.family == 0); if (DetectAddressInsert(NULL, gh, ad) < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } ad = DetectAddressParseSingle("::/0"); if (ad == NULL) goto error; BUG_ON(ad->ip.family == 0); if (DetectAddressInsert(NULL, gh, ad) < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } } return 0; error: SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC, "DetectAddressSetup error"); /* XXX cleanup */ return -1; } /** * \brief Parses an address string and updates the 2 address heads with the * address data. * * \todo We don't seem to be handling negated cases, like [addr,![!addr,addr]], * since we pass around negate without keeping a count of ! with depth. * Can solve this by keeping a count of the negations with depth, so that * an even no of negations would count as no negation and an odd no of * negations would count as a negation. * * \param gh Pointer to the address head that should hold address ranges * that are not negated. * \param ghn Pointer to the address head that should hold address ranges * that are negated. * \param s Pointer to the character string holding the address to be * parsed. * \param negate Flag that indicates if the received address string is negated * or not. 0 if it is not, 1 it it is. * * \retval 0 On successfully parsing. * \retval -1 On failure. */ static int DetectAddressParse2(const DetectEngineCtx *de_ctx, DetectAddressHead *gh, DetectAddressHead *ghn, const char *s, int negate, ResolvedVariablesList *var_list) { size_t x = 0; size_t u = 0; int o_set = 0, n_set = 0, d_set = 0; int depth = 0; size_t size = strlen(s); char address[8196] = ""; char *rule_var_address = NULL; char *temp_rule_var_address = NULL; SCLogDebug("s %s negate %s", s, negate ? "true" : "false"); for (u = 0, x = 0; u < size && x < sizeof(address); u++) { if (x == (sizeof(address) - 1)) { SCLogError(SC_ERR_ADDRESS_ENGINE_GENERIC, "Hit the address buffer" " limit for the supplied address. Invalidating sig. " "Please file a bug report on this."); goto error; } address[x] = s[u]; x++; if (!o_set && s[u] == '!') { n_set = 1; x--; } else if (s[u] == '[') { if (!o_set) { o_set = 1; x = 0; } depth++; } else if (s[u] == ']') { if (depth == 1) { address[x - 1] = '\0'; x = 0; SCLogDebug("address %s negate %d, n_set %d", address, negate, n_set); if (((negate + n_set) % 2) == 0) { /* normal block */ SCLogDebug("normal block"); if (DetectAddressParse2(de_ctx, gh, ghn, address, (negate + n_set) % 2, var_list) < 0) goto error; } else { /* negated block * * Extra steps are necessary. First consider it as a normal * (non-negated) range. Merge the + and - ranges if * applicable. Then insert the result into the ghn list. */ SCLogDebug("negated block"); DetectAddressHead tmp_gh = { NULL, NULL, NULL }; DetectAddressHead tmp_ghn = { NULL, NULL, NULL }; if (DetectAddressParse2(de_ctx, &tmp_gh, &tmp_ghn, address, 0, var_list) < 0) goto error; DetectAddress *tmp_ad; DetectAddress *tmp_ad2; #ifdef DEBUG SCLogDebug("tmp_gh: IPv4"); for (tmp_ad = tmp_gh.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } SCLogDebug("tmp_ghn: IPv4"); for (tmp_ad = tmp_ghn.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } SCLogDebug("tmp_gh: IPv6"); for (tmp_ad = tmp_gh.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } SCLogDebug("tmp_ghn: IPv6"); for (tmp_ad = tmp_ghn.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } #endif if (DetectAddressMergeNot(&tmp_gh, &tmp_ghn) < 0) goto error; SCLogDebug("merged succesfully"); /* insert the IPv4 addresses into the negated list */ for (tmp_ad = tmp_gh.ipv4_head; tmp_ad; tmp_ad = tmp_ad->next) { /* work with a copy of the address group */ tmp_ad2 = DetectAddressCopy(tmp_ad); if (tmp_ad2 == NULL) { SCLogDebug("DetectAddressCopy failed"); goto error; } DetectAddressPrint(tmp_ad2); DetectAddressInsert(NULL, ghn, tmp_ad2); } /* insert the IPv6 addresses into the negated list */ for (tmp_ad = tmp_gh.ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { /* work with a copy of the address group */ tmp_ad2 = DetectAddressCopy(tmp_ad); if (tmp_ad2 == NULL) { SCLogDebug("DetectAddressCopy failed"); goto error; } DetectAddressPrint(tmp_ad2); DetectAddressInsert(NULL, ghn, tmp_ad2); } DetectAddressHeadCleanup(&tmp_gh); DetectAddressHeadCleanup(&tmp_ghn); } n_set = 0; } depth--; } else if (depth == 0 && s[u] == ',') { if (o_set == 1) { o_set = 0; } else if (d_set == 1) { address[x - 1] = '\0'; rule_var_address = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_ADDRESS_GROUPS); if (rule_var_address == NULL) goto error; if (strlen(rule_var_address) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved " "to nothing. This is likely a misconfiguration. " "Note that a negated address needs to be quoted, " "\"!$HOME_NET\" instead of !$HOME_NET. See issue #295.", s); goto error; } SCLogDebug("rule_var_address %s", rule_var_address); temp_rule_var_address = rule_var_address; if ((negate + n_set) % 2) { temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3); if (unlikely(temp_rule_var_address == NULL)) goto error; snprintf(temp_rule_var_address, strlen(rule_var_address) + 3, "[%s]", rule_var_address); } if (DetectAddressParse2(de_ctx, gh, ghn, temp_rule_var_address, (negate + n_set) % 2, var_list) < 0) { if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); goto error; } d_set = 0; n_set = 0; if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); } else { address[x - 1] = '\0'; if (!((negate + n_set) % 2)) { SCLogDebug("DetectAddressSetup into gh, %s", address); if (DetectAddressSetup(gh, address) < 0) goto error; } else { SCLogDebug("DetectAddressSetup into ghn, %s", address); if (DetectAddressSetup(ghn, address) < 0) goto error; } n_set = 0; } x = 0; } else if (depth == 0 && s[u] == '$') { d_set = 1; } else if (depth == 0 && u == size - 1) { if (x == sizeof(address)) { address[x - 1] = '\0'; } else { address[x] = '\0'; } x = 0; if (AddVariableToResolveList(var_list, address) == -1) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Found a loop in a address " "groups declaration. This is likely a misconfiguration."); goto error; } if (d_set == 1) { rule_var_address = SCRuleVarsGetConfVar(de_ctx, address, SC_RULE_VARS_ADDRESS_GROUPS); if (rule_var_address == NULL) goto error; if (strlen(rule_var_address) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "variable %s resolved " "to nothing. This is likely a misconfiguration. " "Note that a negated address needs to be quoted, " "\"!$HOME_NET\" instead of !$HOME_NET. See issue #295.", s); goto error; } SCLogDebug("rule_var_address %s", rule_var_address); temp_rule_var_address = rule_var_address; if ((negate + n_set) % 2) { temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3); if (unlikely(temp_rule_var_address == NULL)) goto error; snprintf(temp_rule_var_address, strlen(rule_var_address) + 3, "[%s]", rule_var_address); } if (DetectAddressParse2(de_ctx, gh, ghn, temp_rule_var_address, (negate + n_set) % 2, var_list) < 0) { SCLogDebug("DetectAddressParse2 hates us"); if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); goto error; } d_set = 0; if (temp_rule_var_address != rule_var_address) SCFree(temp_rule_var_address); } else { if (!((negate + n_set) % 2)) { SCLogDebug("DetectAddressSetup into gh, %s", address); if (DetectAddressSetup(gh, address) < 0) { SCLogDebug("DetectAddressSetup gh fail"); goto error; } } else { SCLogDebug("DetectAddressSetup into ghn, %s", address); if (DetectAddressSetup(ghn, address) < 0) { SCLogDebug("DetectAddressSetup ghn fail"); goto error; } } } n_set = 0; } } if (depth > 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not every address block was " "properly closed in \"%s\", %d missing closing brackets (]). " "Note: problem might be in a variable.", s, depth); goto error; } else if (depth < 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not every address block was " "properly opened in \"%s\", %d missing opening brackets ([). " "Note: problem might be in a variable.", s, depth*-1); goto error; } return 0; error: return -1; } /** * \internal * \brief See if the addresses and ranges in an address head cover the * entire ip space. * * \param gh Pointer to the DetectAddressHead to check. * * \retval 0 No. * \retval 1 Yes. * * \todo do the same for IPv6 */ static int DetectAddressIsCompleteIPSpace(DetectAddressHead *gh) { int r = DetectAddressIsCompleteIPSpaceIPv4(gh->ipv4_head); if (r == 1) return 1; return 0; } /** * \brief Merge the + and the - list (+ positive match, - 'not' match) * * \param gh Pointer to the address head containing the non-NOT groups. * \param ghn Pointer to the address head containing the NOT groups. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressMergeNot(DetectAddressHead *gh, DetectAddressHead *ghn) { DetectAddress *ad; DetectAddress *ag, *ag2; int r = 0; SCLogDebug("gh->ipv4_head %p, ghn->ipv4_head %p", gh->ipv4_head, ghn->ipv4_head); /* check if the negated list covers the entire ip space. If so * the user screwed up the rules/vars. */ if (DetectAddressIsCompleteIPSpace(ghn) == 1) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Complete IP space negated. " "Rule address range is NIL. Probably have a !any or " "an address range that supplies a NULL address range"); goto error; } /* step 0: if the gh list is empty, but the ghn list isn't we have a pure * not thingy. In that case we add a 0.0.0.0/0 first. */ if (gh->ipv4_head == NULL && ghn->ipv4_head != NULL) { r = DetectAddressSetup(gh, "0.0.0.0/0"); if (r < 0) { SCLogDebug("DetectAddressSetup for 0.0.0.0/0 failed"); goto error; } } /* ... or ::/0 for ipv6 */ if (gh->ipv6_head == NULL && ghn->ipv6_head != NULL) { r = DetectAddressSetup(gh, "::/0"); if (r < 0) { SCLogDebug("DetectAddressSetup for ::/0 failed"); goto error; } } /* step 1: insert our ghn members into the gh list */ for (ag = ghn->ipv4_head; ag != NULL; ag = ag->next) { /* work with a copy of the ad so we can easily clean up the ghn group * later. */ ad = DetectAddressCopy(ag); if (ad == NULL) { SCLogDebug("DetectAddressCopy failed"); goto error; } r = DetectAddressInsert(NULL, gh, ad); if (r < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } } /* ... and the same for ipv6 */ for (ag = ghn->ipv6_head; ag != NULL; ag = ag->next) { /* work with a copy of the ad so we can easily clean up the ghn group * later. */ ad = DetectAddressCopy(ag); if (ad == NULL) { SCLogDebug("DetectAddressCopy failed"); goto error; } r = DetectAddressInsert(NULL, gh, ad); if (r < 0) { SCLogDebug("DetectAddressInsert failed"); goto error; } } #ifdef DEBUG DetectAddress *tmp_ad; for (tmp_ad = gh->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } #endif int ipv4_applied = 0; int ipv6_applied = 0; /* step 2: pull the address blocks that match our 'not' blocks */ for (ag = ghn->ipv4_head; ag != NULL; ag = ag->next) { SCLogDebug("ag %p", ag); DetectAddressPrint(ag); int applied = 0; for (ag2 = gh->ipv4_head; ag2 != NULL; ) { SCLogDebug("ag2 %p", ag2); DetectAddressPrint(ag2); r = DetectAddressCmp(ag, ag2); /* XXX more ??? */ if (r == ADDRESS_EQ || r == ADDRESS_EB) { if (ag2->prev == NULL) gh->ipv4_head = ag2->next; else ag2->prev->next = ag2->next; if (ag2->next != NULL) ag2->next->prev = ag2->prev; /* store the next ptr and remove the group */ DetectAddress *next_ag2 = ag2->next; DetectAddressFree(ag2); ag2 = next_ag2; applied = 1; } else { ag2 = ag2->next; } } if (applied) { ipv4_applied++; } } /* ... and the same for ipv6 */ for (ag = ghn->ipv6_head; ag != NULL; ag = ag->next) { int applied = 0; for (ag2 = gh->ipv6_head; ag2 != NULL; ) { r = DetectAddressCmp(ag, ag2); if (r == ADDRESS_EQ || r == ADDRESS_EB) { /* XXX more ??? */ if (ag2->prev == NULL) gh->ipv6_head = ag2->next; else ag2->prev->next = ag2->next; if (ag2->next != NULL) ag2->next->prev = ag2->prev; /* store the next ptr and remove the group */ DetectAddress *next_ag2 = ag2->next; DetectAddressFree(ag2); ag2 = next_ag2; SCLogDebug("applied"); applied = 1; } else { ag2 = ag2->next; } } if (applied) { ipv6_applied++; } } #ifdef DEBUG for (tmp_ad = gh->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } for (tmp_ad = ghn->ipv6_head; tmp_ad; tmp_ad = tmp_ad->next) { DetectAddressPrint(tmp_ad); } #endif if (ghn->ipv4_head != NULL || ghn->ipv6_head != NULL) { int cnt = 0; for (ad = ghn->ipv4_head; ad; ad = ad->next) cnt++; if (ipv4_applied != cnt) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not all IPv4 negations " "could be applied: %d != %d", cnt, ipv4_applied); goto error; } cnt = 0; for (ad = ghn->ipv6_head; ad; ad = ad->next) cnt++; if (ipv6_applied != cnt) { SCLogError(SC_ERR_INVALID_SIGNATURE, "not all IPv6 negations " "could be applied: %d != %d", cnt, ipv6_applied); goto error; } } /* if the result is that we have no addresses we return error */ if (gh->ipv4_head == NULL && gh->ipv6_head == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "no addresses left after " "merging addresses and negated addresses"); goto error; } return 0; error: return -1; } int DetectAddressTestConfVars(void) { SCLogDebug("Testing address conf vars for any misconfigured values"); ResolvedVariablesList var_list = TAILQ_HEAD_INITIALIZER(var_list); ConfNode *address_vars_node = ConfGetNode("vars.address-groups"); if (address_vars_node == NULL) { return 0; } ConfNode *seq_node; TAILQ_FOREACH(seq_node, &address_vars_node->head, next) { SCLogDebug("Testing %s - %s", seq_node->name, seq_node->val); DetectAddressHead *gh = DetectAddressHeadInit(); if (gh == NULL) { goto error; } DetectAddressHead *ghn = DetectAddressHeadInit(); if (ghn == NULL) { goto error; } if (seq_node->val == NULL) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Address var \"%s\" probably has a sequence(something " "in brackets) value set without any quotes. Please " "quote it using \"..\".", seq_node->name); goto error; } int r = DetectAddressParse2(NULL, gh, ghn, seq_node->val, /* start with negate no */0, &var_list); CleanVariableResolveList(&var_list); if (r < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "failed to parse address var \"%s\" with value \"%s\". " "Please check it's syntax", seq_node->name, seq_node->val); goto error; } if (DetectAddressIsCompleteIPSpace(ghn)) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "address var - \"%s\" has the complete IP space negated " "with it's value \"%s\". Rule address range is NIL. " "Probably have a !any or an address range that supplies " "a NULL address range", seq_node->name, seq_node->val); goto error; } if (gh != NULL) DetectAddressHeadFree(gh); if (ghn != NULL) DetectAddressHeadFree(ghn); } return 0; error: return -1; } #include "util-hash-lookup3.h" typedef struct DetectAddressMap_ { char *string; DetectAddressHead *address; } DetectAddressMap; static uint32_t DetectAddressMapHashFunc(HashListTable *ht, void *data, uint16_t datalen) { const DetectAddressMap *map = (DetectAddressMap *)data; uint32_t hash = 0; hash = hashlittle_safe(map->string, strlen(map->string), 0); hash %= ht->array_size; return hash; } static char DetectAddressMapCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { DetectAddressMap *map1 = (DetectAddressMap *)data1; DetectAddressMap *map2 = (DetectAddressMap *)data2; int r = (strcmp(map1->string, map2->string) == 0); return r; } static void DetectAddressMapFreeFunc(void *data) { DetectAddressMap *map = (DetectAddressMap *)data; if (map != NULL) { DetectAddressHeadFree(map->address); SCFree(map->string); } SCFree(map); } int DetectAddressMapInit(DetectEngineCtx *de_ctx) { de_ctx->address_table = HashListTableInit(4096, DetectAddressMapHashFunc, DetectAddressMapCompareFunc, DetectAddressMapFreeFunc); if (de_ctx->address_table == NULL) return -1; return 0; } void DetectAddressMapFree(DetectEngineCtx *de_ctx) { if (de_ctx->address_table == NULL) return; HashListTableFree(de_ctx->address_table); de_ctx->address_table = NULL; return; } int DetectAddressMapAdd(DetectEngineCtx *de_ctx, const char *string, DetectAddressHead *address) { DetectAddressMap *map = SCCalloc(1, sizeof(*map)); if (map == NULL) return -1; map->string = SCStrdup(string); if (map->string == NULL) { SCFree(map); return -1; } map->address = address; BUG_ON(HashListTableAdd(de_ctx->address_table, (void *)map, 0) != 0); return 0; } const DetectAddressHead *DetectAddressMapLookup(DetectEngineCtx *de_ctx, const char *string) { DetectAddressMap map = { (char *)string, NULL }; const DetectAddressMap *res = HashListTableLookup(de_ctx->address_table, &map, 0); if (res == NULL) return NULL; else { return (const DetectAddressHead *)res->address; } } /** * \brief Parses an address group sent as a character string and updates the * DetectAddressHead sent as the argument with the relevant address * ranges from the parsed string. * * \param gh Pointer to the DetectAddressHead. * \param str Pointer to the character string containing the address group * that has to be parsed. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressParse(const DetectEngineCtx *de_ctx, DetectAddressHead *gh, const char *str) { int r; DetectAddressHead *ghn = NULL; SCLogDebug("gh %p, str %s", gh, str); if (str == NULL) { SCLogDebug("DetectAddressParse can not be run with NULL address"); goto error; } ghn = DetectAddressHeadInit(); if (ghn == NULL) { SCLogDebug("DetectAddressHeadInit for ghn failed"); goto error; } r = DetectAddressParse2(de_ctx, gh, ghn, str, /* start with negate no */0, NULL); if (r < 0) { SCLogDebug("DetectAddressParse2 returned %d", r); goto error; } SCLogDebug("gh->ipv4_head %p, ghn->ipv4_head %p", gh->ipv4_head, ghn->ipv4_head); /* merge the 'not' address groups */ if (DetectAddressMergeNot(gh, ghn) < 0) { SCLogDebug("DetectAddressMergeNot failed"); goto error; } /* free the temp negate head */ DetectAddressHeadFree(ghn); return 0; error: if (ghn != NULL) DetectAddressHeadFree(ghn); return -1; } const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, const char *string) { const DetectAddressHead *h = DetectAddressMapLookup(de_ctx, string); if (h != NULL) { SCLogDebug("found: %s :: %p", string, h); return h; } SCLogDebug("%s not found", string); DetectAddressHead *head = DetectAddressHeadInit(); if (head == NULL) return NULL; if (DetectAddressParse(de_ctx, head, string) == -1) { DetectAddressHeadFree(head); return NULL; } DetectAddressMapAdd((DetectEngineCtx *)de_ctx, string, head); return head; } /** * \brief Returns a new instance of DetectAddressHead. * * \retval gh Pointer to the new instance of DetectAddressHead. */ DetectAddressHead *DetectAddressHeadInit(void) { DetectAddressHead *gh = SCMalloc(sizeof(DetectAddressHead)); if (unlikely(gh == NULL)) return NULL; memset(gh, 0, sizeof(DetectAddressHead)); return gh; } /** * \brief Cleans a DetectAddressHead. The functions frees the 3 address * group heads(any, ipv4 and ipv6) inside the DetectAddressHead * instance. * * \param gh Pointer to the DetectAddressHead instance that has to be * cleaned. */ void DetectAddressHeadCleanup(DetectAddressHead *gh) { if (gh != NULL) { if (gh->any_head != NULL) { DetectAddressCleanupList(gh->any_head); gh->any_head = NULL; } if (gh->ipv4_head != NULL) { DetectAddressCleanupList(gh->ipv4_head); gh->ipv4_head = NULL; } if (gh->ipv6_head != NULL) { DetectAddressCleanupList(gh->ipv6_head); gh->ipv6_head = NULL; } } return; } /** * \brief Frees a DetectAddressHead instance. * * \param gh Pointer to the DetectAddressHead instance to be freed. */ void DetectAddressHeadFree(DetectAddressHead *gh) { if (gh != NULL) { DetectAddressHeadCleanup(gh); SCFree(gh); } return; } /** * \brief Dispatcher function that calls the ipv4 and ipv6 address cut functions. * Have a look at DetectAddressCutIPv4() and DetectAddressCutIPv6() for * explanations on what these functions do. * * \param de_ctx Pointer to the DetectEngineCtx. * \param a Pointer the the first address to be cut. * \param b Pointer to the second address to be cut. * \param c Pointer to a pointer to a third DetectAddressData, in case the * ranges from a and b, demand a third address range. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressCut(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c) { if (a->ip.family == AF_INET) return DetectAddressCutIPv4(de_ctx, a, b, c); else if (a->ip.family == AF_INET6) return DetectAddressCutIPv6(de_ctx, a, b, c); return -1; } /** * \brief Cuts a negated address range with respect to the entire ip range, and * supplies with the address range that doesn't belong to the negated * address range. * * There are 2 cases here - * * The first case includes the address being located at the extreme ends * of the ip space, in which we get a single range. * For example: !0.0.0.0, in which case we get 0.0.0.1 to 255.255.255.255. * * The second case includes the address not present at either of the * ip space extremes, in which case we get 2 ranges. The second range * would be supplied back with the argument "b" supplied to this function. * For example: !10.20.30.40, in which case we the 2 ranges, 0.0.0.0 - * 10.20.30.39 and 10.20.30.41 - 255.255.255.255. * * The above negation cases can similarly be extended to ranges, i.e. * ![0.0.0.0 - 10.20.30.40], ![255.255.240.240 - 255.255.255.255] and * ![10.20.30.40 - 10.20.30.50]. * * * \param a Pointer to the DetectAddressData instance, that contains the negated * address range that has to be cut. * \param b Pointer to a pointer to a DetectAddressData instance, that should be * filled with the address range, if the argument "a", doesn't fall at * the extreme ends of the ip address space. * * \retval 0 On success. * \retval -1 On failure. */ int DetectAddressCutNot(DetectAddress *a, DetectAddress **b) { if (a->ip.family == AF_INET) return DetectAddressCutNotIPv4(a, b); else if (a->ip.family == AF_INET6) return DetectAddressCutNotIPv6(a, b); return -1; } /** * \brief Used to compare 2 address ranges. * * \param a Pointer to the first DetectAddressData to be compared. * \param b Pointer to the second DetectAddressData to be compared. */ int DetectAddressCmp(DetectAddress *a, DetectAddress *b) { if (a->ip.family != b->ip.family) return ADDRESS_ER; /* check any */ if ((a->flags & ADDRESS_FLAG_ANY) && (b->flags & ADDRESS_FLAG_ANY)) return ADDRESS_EQ; else if (a->ip.family == AF_INET) return DetectAddressCmpIPv4(a, b); else if (a->ip.family == AF_INET6) return DetectAddressCmpIPv6(a, b); return ADDRESS_ER; } /** * \brief Match a packets address against a signatures addrs array * * \param addrs array of DetectMatchAddressIPv4's * \param addrs_cnt array size in members * \param a packets address * * \retval 0 no match * \retval 1 match * * \note addresses in addrs are in host order * * \todo array should be ordered, so we can break out of the loop */ int DetectAddressMatchIPv4(DetectMatchAddressIPv4 *addrs, uint16_t addrs_cnt, Address *a) { SCEnter(); if (addrs == NULL || addrs_cnt == 0) { SCReturnInt(0); } uint16_t idx; for (idx = 0; idx < addrs_cnt; idx++) { if (ntohl(a->addr_data32[0]) >= addrs[idx].ip && ntohl(a->addr_data32[0]) <= addrs[idx].ip2) { SCReturnInt(1); } } SCReturnInt(0); } /** * \brief Match a packets address against a signatures addrs array * * \param addrs array of DetectMatchAddressIPv6's * \param addrs_cnt array size in members * \param a packets address * * \retval 0 no match * \retval 1 match * * \note addresses in addrs are in host order * * \todo array should be ordered, so we can break out of the loop */ int DetectAddressMatchIPv6(DetectMatchAddressIPv6 *addrs, uint16_t addrs_cnt, Address *a) { SCEnter(); if (addrs == NULL || addrs_cnt == 0) { SCReturnInt(0); } uint16_t idx; int i = 0; uint16_t result1, result2; /* See if the packet address is within the range of any entry in the * signature's address match array. */ for (idx = 0; idx < addrs_cnt; idx++) { result1 = result2 = 0; /* See if packet address equals either limit. Return 1 if true. */ if (ntohl(a->addr_data32[0]) == addrs[idx].ip[0] && ntohl(a->addr_data32[1]) == addrs[idx].ip[1] && ntohl(a->addr_data32[2]) == addrs[idx].ip[2] && ntohl(a->addr_data32[3]) == addrs[idx].ip[3]) { SCReturnInt(1); } if (ntohl(a->addr_data32[0]) == addrs[idx].ip2[0] && ntohl(a->addr_data32[1]) == addrs[idx].ip2[1] && ntohl(a->addr_data32[2]) == addrs[idx].ip2[2] && ntohl(a->addr_data32[3]) == addrs[idx].ip2[3]) { SCReturnInt(1); } /* See if packet address is greater than lower limit * of the current signature address match pair. */ for (i = 0; i < 4; i++) { if (ntohl(a->addr_data32[i]) > addrs[idx].ip[i]) { result1 = 1; break; } if (ntohl(a->addr_data32[i]) < addrs[idx].ip[i]) { result1 = 0; break; } } /* If not greater than lower limit, try next address match entry */ if (result1 == 0) continue; /* See if packet address is less than upper limit * of the current signature address match pair. */ for (i = 0; i < 4; i++) { if (ntohl(a->addr_data32[i]) < addrs[idx].ip2[i]) { result2 = 1; break; } if (ntohl(a->addr_data32[i]) > addrs[idx].ip2[i]) { result2 = 0; break; } } /* Return a match if packet address is between the two * signature address match limits. */ if (result1 == 1 && result2 == 1) SCReturnInt(1); } SCReturnInt(0); } /** * \brief Check if a particular address(ipv4 or ipv6) matches the address * range in the DetectAddress instance. * * We basically check that the address falls inbetween the address * range in DetectAddress. * * \param dd Pointer to the DetectAddress instance. * \param a Pointer to an Address instance. * * \param 1 On a match. * \param 0 On no match. */ int DetectAddressMatch(DetectAddress *dd, Address *a) { SCEnter(); if (dd->ip.family != a->family) { SCReturnInt(0); } //DetectAddressPrint(dd); //AddressDebugPrint(a); switch (a->family) { case AF_INET: /* XXX figure out a way to not need to do this ntohl if we switch to * Address inside DetectAddressData we can do uint8_t checks */ if (ntohl(a->addr_data32[0]) >= ntohl(dd->ip.addr_data32[0]) && ntohl(a->addr_data32[0]) <= ntohl(dd->ip2.addr_data32[0])) { SCReturnInt(1); } else { SCReturnInt(0); } break; case AF_INET6: if (AddressIPv6Ge(a, &dd->ip) == 1 && AddressIPv6Le(a, &dd->ip2) == 1) { SCReturnInt(1); } else { SCReturnInt(0); } break; default: SCLogDebug("What other address type can we have :-/"); break; } SCReturnInt(0); } /** * \brief Prints the address data held by the DetectAddress. If the * address data family is any, we print "ANY". If the address data * family is IPv4, we print the the ipv4 address and mask, and if the * address data family is IPv6, we print the ipv6 address and mask. * * \param ad Pointer to the DetectAddress instance to be printed. */ void DetectAddressPrint(DetectAddress *gr) { if (gr == NULL) return; if (gr->flags & ADDRESS_FLAG_ANY) { SCLogDebug("ANY"); } else if (gr->ip.family == AF_INET) { struct in_addr in; char ip[16], mask[16]; memcpy(&in, &gr->ip.addr_data32[0], sizeof(in)); PrintInet(AF_INET, &in, ip, sizeof(ip)); memcpy(&in, &gr->ip2.addr_data32[0], sizeof(in)); PrintInet(AF_INET, &in, mask, sizeof(mask)); SCLogDebug("%s/%s", ip, mask); // printf("%s/%s", ip, mask); } else if (gr->ip.family == AF_INET6) { struct in6_addr in6; char ip[66], mask[66]; memcpy(&in6, &gr->ip.addr_data32, sizeof(in6)); PrintInet(AF_INET6, &in6, ip, sizeof(ip)); memcpy(&in6, &gr->ip2.addr_data32, sizeof(in6)); PrintInet(AF_INET6, &in6, mask, sizeof(mask)); SCLogDebug("%s/%s", ip, mask); // printf("%s/%s", ip, mask); } return; } /** * \brief Find the group matching address in a group head. * * \param gh Pointer to the address group head(DetectAddressHead instance). * \param a Pointer to an Address instance. * * \retval g On success pointer to an DetectAddress if we find a match * for the Address "a", in the DetectAddressHead "gh". */ DetectAddress *DetectAddressLookupInHead(const DetectAddressHead *gh, Address *a) { SCEnter(); DetectAddress *g; if (gh == NULL) { SCReturnPtr(NULL, "DetectAddress"); } /* XXX should we really do this check every time we run this function? */ if (a->family == AF_INET) { SCLogDebug("IPv4"); g = gh->ipv4_head; } else if (a->family == AF_INET6) { SCLogDebug("IPv6"); g = gh->ipv6_head; } else { SCLogDebug("ANY"); g = gh->any_head; } for ( ; g != NULL; g = g->next) { if (DetectAddressMatch(g,a) == 1) { SCReturnPtr(g, "DetectAddress"); } } SCReturnPtr(NULL, "DetectAddress"); } /********************************Unittests*************************************/ #ifdef UNITTESTS static int UTHValidateDetectAddress(DetectAddress *ad, const char *one, const char *two) { char str1[46] = "", str2[46] = ""; if (ad == NULL) return FALSE; switch(ad->ip.family) { case AF_INET: PrintInet(AF_INET, (const void *)&ad->ip.addr_data32[0], str1, sizeof(str1)); SCLogDebug("%s", str1); PrintInet(AF_INET, (const void *)&ad->ip2.addr_data32[0], str2, sizeof(str2)); SCLogDebug("%s", str2); if (strcmp(str1, one) != 0) { SCLogInfo("%s != %s", str1, one); return FALSE; } if (strcmp(str2, two) != 0) { SCLogInfo("%s != %s", str2, two); return FALSE; } return TRUE; break; case AF_INET6: PrintInet(AF_INET6, (const void *)&ad->ip.addr_data32[0], str1, sizeof(str1)); SCLogDebug("%s", str1); PrintInet(AF_INET6, (const void *)&ad->ip2.addr_data32[0], str2, sizeof(str2)); SCLogDebug("%s", str2); if (strcmp(str1, one) != 0) { SCLogInfo("%s != %s", str1, one); return FALSE; } if (strcmp(str2, two) != 0) { SCLogInfo("%s != %s", str2, two); return FALSE; } return TRUE; break; } return FALSE; } typedef struct UTHValidateDetectAddressHeadRange_ { const char *one; const char *two; } UTHValidateDetectAddressHeadRange; int UTHValidateDetectAddressHead(DetectAddressHead *gh, int nranges, UTHValidateDetectAddressHeadRange *expectations) { int expect = nranges; int have = 0; if (gh == NULL) return FALSE; DetectAddress *ad = NULL; ad = gh->ipv4_head; if (ad == NULL) ad = gh->ipv6_head; while (have < expect) { if (ad == NULL) { printf("bad head: have %d ranges, expected %d: ", have, expect); return FALSE; } if (UTHValidateDetectAddress(ad, expectations[have].one, expectations[have].two) == FALSE) return FALSE; ad = ad->next; have++; } return TRUE; } int AddressTestParse01(void) { DetectAddress *dd = DetectAddressParseSingle("1.2.3.4"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse02(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("1.2.3.4"); if (dd) { if (dd->ip2.addr_data32[0] != ntohl(16909060) || dd->ip.addr_data32[0] != ntohl(16909060)) { result = 0; } printf("ip %"PRIu32", ip2 %"PRIu32"\n", dd->ip.addr_data32[0], dd->ip2.addr_data32[0]); DetectAddressFree(dd); return result; } return 0; } int AddressTestParse03(void) { DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/255.255.255.0"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse04(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/255.255.255.0"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(16909056)|| dd->ip2.addr_data32[0] != ntohl(16909311)) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse05(void) { DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/24"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse06(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("1.2.3.4/24"); if (dd) { if (dd->ip2.addr_data32[0] != ntohl(16909311) || dd->ip.addr_data32[0] != ntohl(16909056)) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse07(void) { DetectAddress *dd = DetectAddressParseSingle("2001::/3"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse08(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::/3"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(536870912) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != ntohl(1073741823) || dd->ip2.addr_data32[1] != 0xFFFFFFFF || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { DetectAddressPrint(dd); result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse09(void) { DetectAddress *dd = DetectAddressParseSingle("2001::1/128"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse10(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::/128"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 || dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != 0x00000000) { DetectAddressPrint(dd); result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse11(void) { DetectAddress *dd = DetectAddressParseSingle("2001::/48"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse12(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::/48"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != ntohl(65535) || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { DetectAddressPrint(dd); result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse13(void) { DetectAddress *dd = DetectAddressParseSingle("2001::/16"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse14(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::/16"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != ntohl(537001983) || dd->ip2.addr_data32[1] != 0xFFFFFFFF || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse15(void) { DetectAddress *dd = DetectAddressParseSingle("2001::/0"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse16(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::/0"); if (dd) { if (dd->ip.addr_data32[0] != 0x00000000 || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse17(void) { DetectAddress *dd = DetectAddressParseSingle("1.2.3.4-1.2.3.6"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse18(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("1.2.3.4-1.2.3.6"); if (dd) { if (dd->ip2.addr_data32[0] != ntohl(16909062) || dd->ip.addr_data32[0] != ntohl(16909060)) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse19(void) { DetectAddress *dd = DetectAddressParseSingle("1.2.3.6-1.2.3.4"); if (dd) { DetectAddressFree(dd); return 0; } return 1; } int AddressTestParse20(void) { DetectAddress *dd = DetectAddressParseSingle("2001::1-2001::4"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse21(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("2001::1-2001::4"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(536936448) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != ntohl(1) || dd->ip2.addr_data32[0] != ntohl(536936448) || dd->ip2.addr_data32[1] != 0x00000000 || dd->ip2.addr_data32[2] != 0x00000000 || dd->ip2.addr_data32[3] != ntohl(4)) { result = 0; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse22(void) { DetectAddress *dd = DetectAddressParseSingle("2001::4-2001::1"); if (dd) { DetectAddressFree(dd); return 0; } return 1; } int AddressTestParse23(void) { DetectAddress *dd = DetectAddressParseSingle("any"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse24(void) { DetectAddress *dd = DetectAddressParseSingle("Any"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse25(void) { DetectAddress *dd = DetectAddressParseSingle("ANY"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse26(void) { int result = 0; DetectAddress *dd = DetectAddressParseSingle("any"); if (dd) { if (dd->flags & ADDRESS_FLAG_ANY) result = 1; DetectAddressFree(dd); return result; } return 0; } int AddressTestParse27(void) { DetectAddress *dd = DetectAddressParseSingle("!192.168.0.1"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse28(void) { int result = 0; DetectAddress *dd = DetectAddressParseSingle("!1.2.3.4"); if (dd) { if (dd->flags & ADDRESS_FLAG_NOT && dd->ip.addr_data32[0] == ntohl(16909060)) { result = 1; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse29(void) { DetectAddress *dd = DetectAddressParseSingle("!1.2.3.0/24"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse30(void) { int result = 0; DetectAddress *dd = DetectAddressParseSingle("!1.2.3.4/24"); if (dd) { if (dd->flags & ADDRESS_FLAG_NOT && dd->ip.addr_data32[0] == ntohl(16909056) && dd->ip2.addr_data32[0] == ntohl(16909311)) { result = 1; } DetectAddressFree(dd); return result; } return 0; } /** * \test make sure !any is rejected */ int AddressTestParse31(void) { DetectAddress *dd = DetectAddressParseSingle("!any"); if (dd) { DetectAddressFree(dd); return 0; } return 1; } int AddressTestParse32(void) { DetectAddress *dd = DetectAddressParseSingle("!2001::1"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse33(void) { int result = 0; DetectAddress *dd = DetectAddressParseSingle("!2001::1"); if (dd) { if (dd->flags & ADDRESS_FLAG_NOT && dd->ip.addr_data32[0] == ntohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 && dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == ntohl(1)) { result = 1; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse34(void) { DetectAddress *dd = DetectAddressParseSingle("!2001::/16"); if (dd) { DetectAddressFree(dd); return 1; } return 0; } int AddressTestParse35(void) { int result = 0; DetectAddress *dd = DetectAddressParseSingle("!2001::/16"); if (dd) { if (dd->flags & ADDRESS_FLAG_NOT && dd->ip.addr_data32[0] == ntohl(536936448) && dd->ip.addr_data32[1] == 0x00000000 && dd->ip.addr_data32[2] == 0x00000000 && dd->ip.addr_data32[3] == 0x00000000 && dd->ip2.addr_data32[0] == ntohl(537001983) && dd->ip2.addr_data32[1] == 0xFFFFFFFF && dd->ip2.addr_data32[2] == 0xFFFFFFFF && dd->ip2.addr_data32[3] == 0xFFFFFFFF) { result = 1; } DetectAddressFree(dd); return result; } return 0; } int AddressTestParse36(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("ffff::/16"); if (dd) { if (dd->ip.addr_data32[0] != ntohl(0xFFFF0000) || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { DetectAddressPrint(dd); result = 0; } DetectAddressPrint(dd); DetectAddressFree(dd); return result; } return 0; } int AddressTestParse37(void) { int result = 1; DetectAddress *dd = DetectAddressParseSingle("::/0"); if (dd) { if (dd->ip.addr_data32[0] != 0x00000000 || dd->ip.addr_data32[1] != 0x00000000 || dd->ip.addr_data32[2] != 0x00000000 || dd->ip.addr_data32[3] != 0x00000000 || dd->ip2.addr_data32[0] != 0xFFFFFFFF || dd->ip2.addr_data32[1] != 0xFFFFFFFF || dd->ip2.addr_data32[2] != 0xFFFFFFFF || dd->ip2.addr_data32[3] != 0xFFFFFFFF) { DetectAddressPrint(dd); result = 0; } DetectAddressPrint(dd); DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch01(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.3.4", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("1.2.3.4/24"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch02(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.3.127", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("1.2.3.4/25"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch03(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.3.128", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("1.2.3.4/25"); if (dd) { if (DetectAddressMatch(dd, &a) == 1) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch04(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.2.255", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("1.2.3.4/25"); if (dd) { if (DetectAddressMatch(dd, &a) == 1) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch05(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.3.4", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("1.2.3.4/32"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch06(void) { DetectAddress *dd = NULL; int result = 1; struct in_addr in; Address a; if (inet_pton(AF_INET, "1.2.3.4", &in) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET; a.addr_data32[0] = in.s_addr; dd = DetectAddressParseSingle("0.0.0.0/0.0.0.0"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch07(void) { DetectAddress *dd = NULL; int result = 1; struct in6_addr in6; Address a; if (inet_pton(AF_INET6, "2001::1", &in6) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET6; memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr)); dd = DetectAddressParseSingle("2001::/3"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch08(void) { DetectAddress *dd = NULL; int result = 1; struct in6_addr in6; Address a; if (inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET6; memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr)); dd = DetectAddressParseSingle("2001::/3"); if (dd) { if (DetectAddressMatch(dd, &a) == 1) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch09(void) { DetectAddress *dd = NULL; int result = 1; struct in6_addr in6; Address a; if (inet_pton(AF_INET6, "2001::2", &in6) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET6; memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr)); dd = DetectAddressParseSingle("2001::1/128"); if (dd) { if (DetectAddressMatch(dd, &a) == 1) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch10(void) { DetectAddress *dd = NULL; int result = 1; struct in6_addr in6; Address a; if (inet_pton(AF_INET6, "2001::2", &in6) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET6; memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr)); dd = DetectAddressParseSingle("2001::1/126"); if (dd) { if (DetectAddressMatch(dd, &a) == 0) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestMatch11(void) { DetectAddress *dd = NULL; int result = 1; struct in6_addr in6; Address a; if (inet_pton(AF_INET6, "2001::3", &in6) != 1) return 0; memset(&a, 0, sizeof(Address)); a.family = AF_INET6; memcpy(&a.addr_data32, &in6.s6_addr, sizeof(in6.s6_addr)); dd = DetectAddressParseSingle("2001::1/127"); if (dd) { if (DetectAddressMatch(dd, &a) == 1) result = 0; DetectAddressFree(dd); return result; } return 0; } int AddressTestCmp01(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EQ) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp02(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.0.0/255.255.0.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EB) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp03(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.0.0/255.255.0.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_ES) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp04(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.1.0/255.255.255.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_LT) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp05(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.1.0/255.255.255.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.0.0/255.255.255.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_GT) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp06(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.1.0/255.255.0.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.0.0/255.255.0.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EQ) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmpIPv407(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.1.0/255.255.255.0"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.1.128-192.168.2.128"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_LE) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmpIPv408(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("192.168.1.128-192.168.2.128"); if (da == NULL) goto error; db = DetectAddressParseSingle("192.168.1.0/255.255.255.0"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_GE) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp07(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001::/3"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001::1/3"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EQ) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp08(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001::/3"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001::/8"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EB) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp09(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001::/8"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001::/3"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_ES) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp10(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001:1:2:3:0:0:0:0/64"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001:1:2:4:0:0:0:0/64"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_LT) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp11(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001:1:2:4:0:0:0:0/64"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001:1:2:3:0:0:0:0/64"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_GT) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestCmp12(void) { DetectAddress *da = NULL, *db = NULL; int result = 1; da = DetectAddressParseSingle("2001:1:2:3:1:0:0:0/64"); if (da == NULL) goto error; db = DetectAddressParseSingle("2001:1:2:3:2:0:0:0/64"); if (db == NULL) goto error; if (DetectAddressCmp(da, db) != ADDRESS_EQ) result = 0; DetectAddressFree(da); DetectAddressFree(db); return result; error: if (da) DetectAddressFree(da); if (db) DetectAddressFree(db); return 0; } int AddressTestAddressGroupSetup01(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.4"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup02(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.4"); if (r == 0 && gh->ipv4_head != NULL) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup03(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.4"); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.3"); if (r == 0 && gh->ipv4_head != prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup04(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.4"); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.3"); if (r == 0 && gh->ipv4_head != prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) { DetectAddress *ph = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.2"); if (r == 0 && gh->ipv4_head != ph && gh->ipv4_head != NULL && gh->ipv4_head->next == ph) { result = 1; } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup05(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.2"); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.3"); if (r == 0 && gh->ipv4_head == prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next != prev_head) { DetectAddress *ph = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.4"); if (r == 0 && gh->ipv4_head == ph && gh->ipv4_head != NULL && gh->ipv4_head->next != ph) { result = 1; } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup06(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "1.2.3.2"); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; r = DetectAddressParse(NULL, gh, "1.2.3.2"); if (r == 0 && gh->ipv4_head == prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup07(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.0.0.0/8"); if (r == 0 && gh->ipv4_head != NULL) { r = DetectAddressParse(NULL, gh, "10.10.10.10"); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup08(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.10.10.10"); if (r == 0 && gh->ipv4_head != NULL) { r = DetectAddressParse(NULL, gh, "10.0.0.0/8"); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup09(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); if (r == 0 && gh->ipv4_head != NULL) { r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup10(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); if (r == 0 && gh->ipv4_head != NULL) { r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup11(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); if (r == 0) { r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); if (r == 0) { r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; /* result should be: * 0.0.0.0/10.10.9.255 * 10.10.10.0/10.10.10.9 * 10.10.10.10/10.10.10.255 * 10.10.11.0/10.10.11.1 * 10.10.11.2/255.255.255.255 */ if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) && two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) && three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) && four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) && five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup12 (void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); if (r == 0) { r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); if (r == 0) { r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; /* result should be: * 0.0.0.0/10.10.9.255 * 10.10.10.0/10.10.10.9 * 10.10.10.10/10.10.10.255 * 10.10.11.0/10.10.11.1 * 10.10.11.2/255.255.255.255 */ if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) && two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) && three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) && four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) && five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup13(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); if (r == 0) { r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); if (r == 0) { r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; /* result should be: * 0.0.0.0/10.10.9.255 * 10.10.10.0/10.10.10.9 * 10.10.10.10/10.10.10.255 * 10.10.11.0/10.10.11.1 * 10.10.11.2/255.255.255.255 */ if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(168430079) && two->ip.addr_data32[0] == ntohl(168430080) && two->ip2.addr_data32[0] == ntohl(168430089) && three->ip.addr_data32[0] == ntohl(168430090) && three->ip2.addr_data32[0] == ntohl(168430335) && four->ip.addr_data32[0] == ntohl(168430336) && four->ip2.addr_data32[0] == ntohl(168430337) && five->ip.addr_data32[0] == ntohl(168430338) && five->ip2.addr_data32[0] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetupIPv414(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "!1.2.3.4"); if (r == 0) { DetectAddress *one = gh->ipv4_head; DetectAddress *two = one ? one->next : NULL; if (one && two) { /* result should be: * 0.0.0.0/1.2.3.3 * 1.2.3.5/255.255.255.255 */ if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(16909059) && two->ip.addr_data32[0] == ntohl(16909061) && two->ip2.addr_data32[0] == 0xFFFFFFFF) { result = 1; } else { printf("unexpected addresses: "); } } else { printf("one %p two %p: ", one, two); } } else { printf("DetectAddressParse returned %d, expected 0: ", r); } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetupIPv415(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "!0.0.0.0"); if (r == 0) { DetectAddress *one = gh->ipv4_head; if (one && one->next == NULL) { /* result should be: * 0.0.0.1/255.255.255.255 */ if (one->ip.addr_data32[0] == ntohl(1) && one->ip2.addr_data32[0] == 0xFFFFFFFF) result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetupIPv416(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "!255.255.255.255"); if (r == 0) { DetectAddress *one = gh->ipv4_head; if (one && one->next == NULL) { /* result should be: * 0.0.0.0/255.255.255.254 */ if (one->ip.addr_data32[0] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(4294967294)) result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup14(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::1"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup15(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::1"); if (r == 0 && gh->ipv6_head != NULL) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup16(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4"); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::3"); if (r == 0 && gh->ipv6_head != prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup17(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4"); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::3"); if (r == 0 && gh->ipv6_head != prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) { DetectAddress *ph = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::2"); if (r == 0 && gh->ipv6_head != ph && gh->ipv6_head != NULL && gh->ipv6_head->next == ph) { result = 1; } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup18(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::2"); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::3"); if (r == 0 && gh->ipv6_head == prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next != prev_head) { DetectAddress *ph = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::4"); if (r == 0 && gh->ipv6_head == ph && gh->ipv6_head != NULL && gh->ipv6_head->next != ph) { result = 1; } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup19(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::2"); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; r = DetectAddressParse(NULL, gh, "2001::2"); if (r == 0 && gh->ipv6_head == prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup20(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2000::/3"); if (r == 0 && gh->ipv6_head != NULL) { r = DetectAddressParse(NULL, gh, "2001::4"); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup21(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4"); if (r == 0 && gh->ipv6_head != NULL) { r = DetectAddressParse(NULL, gh, "2000::/3"); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup22(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2000::/3"); if (r == 0 && gh->ipv6_head != NULL) { r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup23(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); if (r == 0 && gh->ipv6_head != NULL) { r = DetectAddressParse(NULL, gh, "2000::/3"); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { result = 1; } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup24(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); if (r == 0) { r = DetectAddressParse(NULL, gh, "2001::/3"); if (r == 0) { r = DetectAddressParse(NULL, gh, "::/0"); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; if (one->ip.addr_data32[0] == 0x00000000 && one->ip.addr_data32[1] == 0x00000000 && one->ip.addr_data32[2] == 0x00000000 && one->ip.addr_data32[3] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(536870911) && one->ip2.addr_data32[1] == 0xFFFFFFFF && one->ip2.addr_data32[2] == 0xFFFFFFFF && one->ip2.addr_data32[3] == 0xFFFFFFFF && two->ip.addr_data32[0] == ntohl(536870912) && two->ip.addr_data32[1] == 0x00000000 && two->ip.addr_data32[2] == 0x00000000 && two->ip.addr_data32[3] == 0x00000000 && two->ip2.addr_data32[0] == ntohl(536936448) && two->ip2.addr_data32[1] == 0x00000000 && two->ip2.addr_data32[2] == 0x00000000 && two->ip2.addr_data32[3] == ntohl(3) && three->ip.addr_data32[0] == ntohl(536936448) && three->ip.addr_data32[1] == 0x00000000 && three->ip.addr_data32[2] == 0x00000000 && three->ip.addr_data32[3] == ntohl(4) && three->ip2.addr_data32[0] == ntohl(536936448) && three->ip2.addr_data32[1] == 0x00000000 && three->ip2.addr_data32[2] == 0x00000000 && three->ip2.addr_data32[3] == ntohl(6) && four->ip.addr_data32[0] == ntohl(536936448) && four->ip.addr_data32[1] == 0x00000000 && four->ip.addr_data32[2] == 0x00000000 && four->ip.addr_data32[3] == ntohl(7) && four->ip2.addr_data32[0] == ntohl(1073741823) && four->ip2.addr_data32[1] == 0xFFFFFFFF && four->ip2.addr_data32[2] == 0xFFFFFFFF && four->ip2.addr_data32[3] == 0xFFFFFFFF && five->ip.addr_data32[0] == ntohl(1073741824) && five->ip.addr_data32[1] == 0x00000000 && five->ip.addr_data32[2] == 0x00000000 && five->ip.addr_data32[3] == 0x00000000 && five->ip2.addr_data32[0] == 0xFFFFFFFF && five->ip2.addr_data32[1] == 0xFFFFFFFF && five->ip2.addr_data32[2] == 0xFFFFFFFF && five->ip2.addr_data32[3] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup25(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); if (r == 0) { r = DetectAddressParse(NULL, gh, "::/0"); if (r == 0) { r = DetectAddressParse(NULL, gh, "2001::/3"); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; if (one->ip.addr_data32[0] == 0x00000000 && one->ip.addr_data32[1] == 0x00000000 && one->ip.addr_data32[2] == 0x00000000 && one->ip.addr_data32[3] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(536870911) && one->ip2.addr_data32[1] == 0xFFFFFFFF && one->ip2.addr_data32[2] == 0xFFFFFFFF && one->ip2.addr_data32[3] == 0xFFFFFFFF && two->ip.addr_data32[0] == ntohl(536870912) && two->ip.addr_data32[1] == 0x00000000 && two->ip.addr_data32[2] == 0x00000000 && two->ip.addr_data32[3] == 0x00000000 && two->ip2.addr_data32[0] == ntohl(536936448) && two->ip2.addr_data32[1] == 0x00000000 && two->ip2.addr_data32[2] == 0x00000000 && two->ip2.addr_data32[3] == ntohl(3) && three->ip.addr_data32[0] == ntohl(536936448) && three->ip.addr_data32[1] == 0x00000000 && three->ip.addr_data32[2] == 0x00000000 && three->ip.addr_data32[3] == ntohl(4) && three->ip2.addr_data32[0] == ntohl(536936448) && three->ip2.addr_data32[1] == 0x00000000 && three->ip2.addr_data32[2] == 0x00000000 && three->ip2.addr_data32[3] == ntohl(6) && four->ip.addr_data32[0] == ntohl(536936448) && four->ip.addr_data32[1] == 0x00000000 && four->ip.addr_data32[2] == 0x00000000 && four->ip.addr_data32[3] == ntohl(7) && four->ip2.addr_data32[0] == ntohl(1073741823) && four->ip2.addr_data32[1] == 0xFFFFFFFF && four->ip2.addr_data32[2] == 0xFFFFFFFF && four->ip2.addr_data32[3] == 0xFFFFFFFF && five->ip.addr_data32[0] == ntohl(1073741824) && five->ip.addr_data32[1] == 0x00000000 && five->ip.addr_data32[2] == 0x00000000 && five->ip.addr_data32[3] == 0x00000000 && five->ip2.addr_data32[0] == 0xFFFFFFFF && five->ip2.addr_data32[1] == 0xFFFFFFFF && five->ip2.addr_data32[2] == 0xFFFFFFFF && five->ip2.addr_data32[3] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup26(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "::/0"); if (r == 0) { r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); if (r == 0) { r = DetectAddressParse(NULL, gh, "2001::/3"); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, *five = four->next; if (one->ip.addr_data32[0] == 0x00000000 && one->ip.addr_data32[1] == 0x00000000 && one->ip.addr_data32[2] == 0x00000000 && one->ip.addr_data32[3] == 0x00000000 && one->ip2.addr_data32[0] == ntohl(536870911) && one->ip2.addr_data32[1] == 0xFFFFFFFF && one->ip2.addr_data32[2] == 0xFFFFFFFF && one->ip2.addr_data32[3] == 0xFFFFFFFF && two->ip.addr_data32[0] == ntohl(536870912) && two->ip.addr_data32[1] == 0x00000000 && two->ip.addr_data32[2] == 0x00000000 && two->ip.addr_data32[3] == 0x00000000 && two->ip2.addr_data32[0] == ntohl(536936448) && two->ip2.addr_data32[1] == 0x00000000 && two->ip2.addr_data32[2] == 0x00000000 && two->ip2.addr_data32[3] == ntohl(3) && three->ip.addr_data32[0] == ntohl(536936448) && three->ip.addr_data32[1] == 0x00000000 && three->ip.addr_data32[2] == 0x00000000 && three->ip.addr_data32[3] == ntohl(4) && three->ip2.addr_data32[0] == ntohl(536936448) && three->ip2.addr_data32[1] == 0x00000000 && three->ip2.addr_data32[2] == 0x00000000 && three->ip2.addr_data32[3] == ntohl(6) && four->ip.addr_data32[0] == ntohl(536936448) && four->ip.addr_data32[1] == 0x00000000 && four->ip.addr_data32[2] == 0x00000000 && four->ip.addr_data32[3] == ntohl(7) && four->ip2.addr_data32[0] == ntohl(1073741823) && four->ip2.addr_data32[1] == 0xFFFFFFFF && four->ip2.addr_data32[2] == 0xFFFFFFFF && four->ip2.addr_data32[3] == 0xFFFFFFFF && five->ip.addr_data32[0] == ntohl(1073741824) && five->ip.addr_data32[1] == 0x00000000 && five->ip.addr_data32[2] == 0x00000000 && five->ip.addr_data32[3] == 0x00000000 && five->ip2.addr_data32[0] == 0xFFFFFFFF && five->ip2.addr_data32[1] == 0xFFFFFFFF && five->ip2.addr_data32[2] == 0xFFFFFFFF && five->ip2.addr_data32[3] == 0xFFFFFFFF) { result = 1; } } } } DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup27(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.2.3.4]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup28(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup29(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1,10.10.10.10]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup30(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,2.3.4.5],4.3.2.1,[10.10.10.10,11.11.11.11]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup31(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,[2.3.4.5,3.4.5.6]],4.3.2.1,[10.10.10.10,[11.11.11.11,12.12.12.12]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup32(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,[2.3.4.5,[3.4.5.6,4.5.6.7]]],4.3.2.1,[10.10.10.10,[11.11.11.11,[12.12.12.12,13.13.13.13]]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup33(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "![1.1.1.1,[2.2.2.2,[3.3.3.3,4.4.4.4]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup34(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,![1.1.1.1,[1.2.1.1,1.3.1.1]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup35(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,![1.1.1.1,2.2.2.2]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup36 (void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,[3.0.0.0/8,!1.1.1.1]]]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } int AddressTestAddressGroupSetup37(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[0.0.0.0/0,::/0]"); if (r == 0) result = 1; DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup38(void) { UTHValidateDetectAddressHeadRange expectations[3] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.14.0", "192.168.14.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "![192.168.0.0/16,!192.168.14.0/24]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 3, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup39(void) { UTHValidateDetectAddressHeadRange expectations[3] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.14.0", "192.168.14.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,!192.168.14.0/24]]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 3, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup40(void) { UTHValidateDetectAddressHeadRange expectations[3] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.14.0", "192.168.14.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,[!192.168.14.0/24]]]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 3, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup41(void) { UTHValidateDetectAddressHeadRange expectations[3] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.14.0", "192.168.14.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.14.0/24]]]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 3, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup42(void) { UTHValidateDetectAddressHeadRange expectations[1] = { { "2000:0000:0000:0000:0000:0000:0000:0000", "3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[2001::/3]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 1, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup43(void) { UTHValidateDetectAddressHeadRange expectations[2] = { { "2000:0000:0000:0000:0000:0000:0000:0000", "2fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" }, { "3800:0000:0000:0000:0000:0000:0000:0000", "3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[2001::/3,!3000::/5]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 2, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup44(void) { UTHValidateDetectAddressHeadRange expectations[2] = { { "3ffe:ffff:7654:feda:1245:ba98:0000:0000", "3ffe:ffff:7654:feda:1245:ba98:ffff:ffff" }}; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "3ffe:ffff:7654:feda:1245:ba98:3210:4562/96"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 1, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup45(void) { int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[192.168.1.3,!192.168.0.0/16]"); if (r != 0) { result = 1; } DetectAddressHeadFree(gh); } return result; } static int AddressTestAddressGroupSetup46(void) { UTHValidateDetectAddressHeadRange expectations[4] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.1.0", "192.168.1.255" }, { "192.168.3.0", "192.168.3.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24]]]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 4, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } /** \test net with some negations, then all negated */ static int AddressTestAddressGroupSetup47(void) { UTHValidateDetectAddressHeadRange expectations[5] = { { "0.0.0.0", "192.167.255.255" }, { "192.168.1.0", "192.168.1.255" }, { "192.168.3.0", "192.168.3.255" }, { "192.168.5.0", "192.168.5.255" }, { "192.169.0.0", "255.255.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 5, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } /** \test same as AddressTestAddressGroupSetup47, but not negated */ static int AddressTestAddressGroupSetup48(void) { UTHValidateDetectAddressHeadRange expectations[4] = { { "192.168.0.0", "192.168.0.255" }, { "192.168.2.0", "192.168.2.255" }, { "192.168.4.0", "192.168.4.255" }, { "192.168.6.0", "192.168.255.255" } }; int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { int r = DetectAddressParse(NULL, gh, "[192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]"); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 4, expectations) == TRUE) result = 1; } DetectAddressHeadFree(gh); } return result; } int AddressTestCutIPv401(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0/255.255.255.0"); b = DetectAddressParseSingle("1.2.2.0-1.2.3.4"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv402(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0/255.255.255.0"); b = DetectAddressParseSingle("1.2.2.0-1.2.3.4"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c == NULL) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv403(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0/255.255.255.0"); b = DetectAddressParseSingle("1.2.2.0-1.2.3.4"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c == NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16908800) || a->ip2.addr_data32[0] != ntohl(16909055)) goto error; if (b->ip.addr_data32[0] != ntohl(16909056) || b->ip2.addr_data32[0] != ntohl(16909060)) goto error; if (c->ip.addr_data32[0] != ntohl(16909061) || c->ip2.addr_data32[0] != ntohl(16909311)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv404(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.3-1.2.3.6"); b = DetectAddressParseSingle("1.2.3.0-1.2.3.5"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c == NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058)) goto error; if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909061)) goto error; if (c->ip.addr_data32[0] != ntohl(16909062) || c->ip2.addr_data32[0] != ntohl(16909062)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv405(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.3-1.2.3.6"); b = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c == NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058)) goto error; if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909062)) goto error; if (c->ip.addr_data32[0] != ntohl(16909063) || c->ip2.addr_data32[0] != ntohl(16909065)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv406(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); b = DetectAddressParseSingle("1.2.3.3-1.2.3.6"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c == NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058)) goto error; if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909062)) goto error; if (c->ip.addr_data32[0] != ntohl(16909063) || c->ip2.addr_data32[0] != ntohl(16909065)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv407(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0-1.2.3.6"); b = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c != NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909062)) goto error; if (b->ip.addr_data32[0] != ntohl(16909063) || b->ip2.addr_data32[0] != ntohl(16909065)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv408(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.3-1.2.3.9"); b = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c != NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058)) goto error; if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909065)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv409(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); b = DetectAddressParseSingle("1.2.3.0-1.2.3.6"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c != NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909062)) goto error; if (b->ip.addr_data32[0] != ntohl(16909063) || b->ip2.addr_data32[0] != ntohl(16909065)) goto error; DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestCutIPv410(void) { DetectAddress *a, *b, *c; a = DetectAddressParseSingle("1.2.3.0-1.2.3.9"); b = DetectAddressParseSingle("1.2.3.3-1.2.3.9"); if (DetectAddressCut(NULL, a, b, &c) == -1) goto error; if (c != NULL) goto error; if (a->ip.addr_data32[0] != ntohl(16909056) || a->ip2.addr_data32[0] != ntohl(16909058)) goto error; if (b->ip.addr_data32[0] != ntohl(16909059) || b->ip2.addr_data32[0] != ntohl(16909065)) goto error; printf("ip %u ip2 %u ", htonl(a->ip.addr_data32[0]), htonl(a->ip2.addr_data32[0])); DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 1; error: DetectAddressFree(a); DetectAddressFree(b); DetectAddressFree(c); return 0; } int AddressTestParseInvalidMask01(void) { int result = 1; DetectAddress *dd = NULL; dd = DetectAddressParseSingle("192.168.2.0/33"); if (dd != NULL) { DetectAddressFree(dd); result = 0; } return result; } int AddressTestParseInvalidMask02(void) { int result = 1; DetectAddress *dd = NULL; dd = DetectAddressParseSingle("192.168.2.0/255.255.257.0"); if (dd != NULL) { DetectAddressFree(dd); result = 0; } return result; } int AddressTestParseInvalidMask03(void) { int result = 1; DetectAddress *dd = NULL; dd = DetectAddressParseSingle("192.168.2.0/blue"); if (dd != NULL) { DetectAddressFree(dd); result = 0; } return result; } int AddressConfVarsTest01(void) { static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"any\"\n" "\n" " EXTERNAL_NET: \"!any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"any\"\n" "\n" " SHELLCODE_PORTS: \"!any\"\n" "\n"; int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if (DetectAddressTestConfVars() < 0 && DetectPortTestConfVars() < 0) result = 1; ConfDeInit(); ConfRestoreContextBackup(); return result; } int AddressConfVarsTest02(void) { static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"any\"\n" "\n" " EXTERNAL_NET: \"any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"any\"\n" "\n" " SHELLCODE_PORTS: \"!any\"\n" "\n"; int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if (DetectAddressTestConfVars() == 0 && DetectPortTestConfVars() < 0) result = 1; ConfDeInit(); ConfRestoreContextBackup(); return result; } int AddressConfVarsTest03(void) { static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"any\"\n" "\n" " EXTERNAL_NET: \"!$HOME_NET\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"any\"\n" "\n" " SHELLCODE_PORTS: \"!$HTTP_PORTS\"\n" "\n"; int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if (DetectAddressTestConfVars() < 0 && DetectPortTestConfVars() < 0) result = 1; ConfDeInit(); ConfRestoreContextBackup(); return result; } int AddressConfVarsTest04(void) { static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"any\"\n" "\n" " EXTERNAL_NET: \"$HOME_NET\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"any\"\n" "\n" " SHELLCODE_PORTS: \"$HTTP_PORTS\"\n" "\n"; int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if (DetectAddressTestConfVars() == 0 && DetectPortTestConfVars() == 0) result = 1; ConfDeInit(); ConfRestoreContextBackup(); return result; } int AddressConfVarsTest05(void) { static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"any\"\n" "\n" " EXTERNAL_NET: [192.168.0.1]\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"any\"\n" "\n" " SHELLCODE_PORTS: [80]\n" "\n"; int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); if (DetectAddressTestConfVars() != -1 && DetectPortTestConfVars() != -1) goto end; result = 1; end: ConfDeInit(); ConfRestoreContextBackup(); return result; } #endif /* UNITTESTS */ void DetectAddressTests(void) { #ifdef UNITTESTS DetectAddressIPv4Tests(); DetectAddressIPv6Tests(); UtRegisterTest("AddressTestParse01", AddressTestParse01); UtRegisterTest("AddressTestParse02", AddressTestParse02); UtRegisterTest("AddressTestParse03", AddressTestParse03); UtRegisterTest("AddressTestParse04", AddressTestParse04); UtRegisterTest("AddressTestParse05", AddressTestParse05); UtRegisterTest("AddressTestParse06", AddressTestParse06); UtRegisterTest("AddressTestParse07", AddressTestParse07); UtRegisterTest("AddressTestParse08", AddressTestParse08); UtRegisterTest("AddressTestParse09", AddressTestParse09); UtRegisterTest("AddressTestParse10", AddressTestParse10); UtRegisterTest("AddressTestParse11", AddressTestParse11); UtRegisterTest("AddressTestParse12", AddressTestParse12); UtRegisterTest("AddressTestParse13", AddressTestParse13); UtRegisterTest("AddressTestParse14", AddressTestParse14); UtRegisterTest("AddressTestParse15", AddressTestParse15); UtRegisterTest("AddressTestParse16", AddressTestParse16); UtRegisterTest("AddressTestParse17", AddressTestParse17); UtRegisterTest("AddressTestParse18", AddressTestParse18); UtRegisterTest("AddressTestParse19", AddressTestParse19); UtRegisterTest("AddressTestParse20", AddressTestParse20); UtRegisterTest("AddressTestParse21", AddressTestParse21); UtRegisterTest("AddressTestParse22", AddressTestParse22); UtRegisterTest("AddressTestParse23", AddressTestParse23); UtRegisterTest("AddressTestParse24", AddressTestParse24); UtRegisterTest("AddressTestParse25", AddressTestParse25); UtRegisterTest("AddressTestParse26", AddressTestParse26); UtRegisterTest("AddressTestParse27", AddressTestParse27); UtRegisterTest("AddressTestParse28", AddressTestParse28); UtRegisterTest("AddressTestParse29", AddressTestParse29); UtRegisterTest("AddressTestParse30", AddressTestParse30); UtRegisterTest("AddressTestParse31", AddressTestParse31); UtRegisterTest("AddressTestParse32", AddressTestParse32); UtRegisterTest("AddressTestParse33", AddressTestParse33); UtRegisterTest("AddressTestParse34", AddressTestParse34); UtRegisterTest("AddressTestParse35", AddressTestParse35); UtRegisterTest("AddressTestParse36", AddressTestParse36); UtRegisterTest("AddressTestParse37", AddressTestParse37); UtRegisterTest("AddressTestMatch01", AddressTestMatch01); UtRegisterTest("AddressTestMatch02", AddressTestMatch02); UtRegisterTest("AddressTestMatch03", AddressTestMatch03); UtRegisterTest("AddressTestMatch04", AddressTestMatch04); UtRegisterTest("AddressTestMatch05", AddressTestMatch05); UtRegisterTest("AddressTestMatch06", AddressTestMatch06); UtRegisterTest("AddressTestMatch07", AddressTestMatch07); UtRegisterTest("AddressTestMatch08", AddressTestMatch08); UtRegisterTest("AddressTestMatch09", AddressTestMatch09); UtRegisterTest("AddressTestMatch10", AddressTestMatch10); UtRegisterTest("AddressTestMatch11", AddressTestMatch11); UtRegisterTest("AddressTestCmp01", AddressTestCmp01); UtRegisterTest("AddressTestCmp02", AddressTestCmp02); UtRegisterTest("AddressTestCmp03", AddressTestCmp03); UtRegisterTest("AddressTestCmp04", AddressTestCmp04); UtRegisterTest("AddressTestCmp05", AddressTestCmp05); UtRegisterTest("AddressTestCmp06", AddressTestCmp06); UtRegisterTest("AddressTestCmpIPv407", AddressTestCmpIPv407); UtRegisterTest("AddressTestCmpIPv408", AddressTestCmpIPv408); UtRegisterTest("AddressTestCmp07", AddressTestCmp07); UtRegisterTest("AddressTestCmp08", AddressTestCmp08); UtRegisterTest("AddressTestCmp09", AddressTestCmp09); UtRegisterTest("AddressTestCmp10", AddressTestCmp10); UtRegisterTest("AddressTestCmp11", AddressTestCmp11); UtRegisterTest("AddressTestCmp12", AddressTestCmp12); UtRegisterTest("AddressTestAddressGroupSetup01", AddressTestAddressGroupSetup01); UtRegisterTest("AddressTestAddressGroupSetup02", AddressTestAddressGroupSetup02); UtRegisterTest("AddressTestAddressGroupSetup03", AddressTestAddressGroupSetup03); UtRegisterTest("AddressTestAddressGroupSetup04", AddressTestAddressGroupSetup04); UtRegisterTest("AddressTestAddressGroupSetup05", AddressTestAddressGroupSetup05); UtRegisterTest("AddressTestAddressGroupSetup06", AddressTestAddressGroupSetup06); UtRegisterTest("AddressTestAddressGroupSetup07", AddressTestAddressGroupSetup07); UtRegisterTest("AddressTestAddressGroupSetup08", AddressTestAddressGroupSetup08); UtRegisterTest("AddressTestAddressGroupSetup09", AddressTestAddressGroupSetup09); UtRegisterTest("AddressTestAddressGroupSetup10", AddressTestAddressGroupSetup10); UtRegisterTest("AddressTestAddressGroupSetup11", AddressTestAddressGroupSetup11); UtRegisterTest("AddressTestAddressGroupSetup12", AddressTestAddressGroupSetup12); UtRegisterTest("AddressTestAddressGroupSetup13", AddressTestAddressGroupSetup13); UtRegisterTest("AddressTestAddressGroupSetupIPv414", AddressTestAddressGroupSetupIPv414); UtRegisterTest("AddressTestAddressGroupSetupIPv415", AddressTestAddressGroupSetupIPv415); UtRegisterTest("AddressTestAddressGroupSetupIPv416", AddressTestAddressGroupSetupIPv416); UtRegisterTest("AddressTestAddressGroupSetup14", AddressTestAddressGroupSetup14); UtRegisterTest("AddressTestAddressGroupSetup15", AddressTestAddressGroupSetup15); UtRegisterTest("AddressTestAddressGroupSetup16", AddressTestAddressGroupSetup16); UtRegisterTest("AddressTestAddressGroupSetup17", AddressTestAddressGroupSetup17); UtRegisterTest("AddressTestAddressGroupSetup18", AddressTestAddressGroupSetup18); UtRegisterTest("AddressTestAddressGroupSetup19", AddressTestAddressGroupSetup19); UtRegisterTest("AddressTestAddressGroupSetup20", AddressTestAddressGroupSetup20); UtRegisterTest("AddressTestAddressGroupSetup21", AddressTestAddressGroupSetup21); UtRegisterTest("AddressTestAddressGroupSetup22", AddressTestAddressGroupSetup22); UtRegisterTest("AddressTestAddressGroupSetup23", AddressTestAddressGroupSetup23); UtRegisterTest("AddressTestAddressGroupSetup24", AddressTestAddressGroupSetup24); UtRegisterTest("AddressTestAddressGroupSetup25", AddressTestAddressGroupSetup25); UtRegisterTest("AddressTestAddressGroupSetup26", AddressTestAddressGroupSetup26); UtRegisterTest("AddressTestAddressGroupSetup27", AddressTestAddressGroupSetup27); UtRegisterTest("AddressTestAddressGroupSetup28", AddressTestAddressGroupSetup28); UtRegisterTest("AddressTestAddressGroupSetup29", AddressTestAddressGroupSetup29); UtRegisterTest("AddressTestAddressGroupSetup30", AddressTestAddressGroupSetup30); UtRegisterTest("AddressTestAddressGroupSetup31", AddressTestAddressGroupSetup31); UtRegisterTest("AddressTestAddressGroupSetup32", AddressTestAddressGroupSetup32); UtRegisterTest("AddressTestAddressGroupSetup33", AddressTestAddressGroupSetup33); UtRegisterTest("AddressTestAddressGroupSetup34", AddressTestAddressGroupSetup34); UtRegisterTest("AddressTestAddressGroupSetup35", AddressTestAddressGroupSetup35); UtRegisterTest("AddressTestAddressGroupSetup36", AddressTestAddressGroupSetup36); UtRegisterTest("AddressTestAddressGroupSetup37", AddressTestAddressGroupSetup37); UtRegisterTest("AddressTestAddressGroupSetup38", AddressTestAddressGroupSetup38); UtRegisterTest("AddressTestAddressGroupSetup39", AddressTestAddressGroupSetup39); UtRegisterTest("AddressTestAddressGroupSetup40", AddressTestAddressGroupSetup40); UtRegisterTest("AddressTestAddressGroupSetup41", AddressTestAddressGroupSetup41); UtRegisterTest("AddressTestAddressGroupSetup42", AddressTestAddressGroupSetup42); UtRegisterTest("AddressTestAddressGroupSetup43", AddressTestAddressGroupSetup43); UtRegisterTest("AddressTestAddressGroupSetup44", AddressTestAddressGroupSetup44); UtRegisterTest("AddressTestAddressGroupSetup45", AddressTestAddressGroupSetup45); UtRegisterTest("AddressTestAddressGroupSetup46", AddressTestAddressGroupSetup46); UtRegisterTest("AddressTestAddressGroupSetup47", AddressTestAddressGroupSetup47); UtRegisterTest("AddressTestAddressGroupSetup48", AddressTestAddressGroupSetup48); UtRegisterTest("AddressTestCutIPv401", AddressTestCutIPv401); UtRegisterTest("AddressTestCutIPv402", AddressTestCutIPv402); UtRegisterTest("AddressTestCutIPv403", AddressTestCutIPv403); UtRegisterTest("AddressTestCutIPv404", AddressTestCutIPv404); UtRegisterTest("AddressTestCutIPv405", AddressTestCutIPv405); UtRegisterTest("AddressTestCutIPv406", AddressTestCutIPv406); UtRegisterTest("AddressTestCutIPv407", AddressTestCutIPv407); UtRegisterTest("AddressTestCutIPv408", AddressTestCutIPv408); UtRegisterTest("AddressTestCutIPv409", AddressTestCutIPv409); UtRegisterTest("AddressTestCutIPv410", AddressTestCutIPv410); UtRegisterTest("AddressTestParseInvalidMask01", AddressTestParseInvalidMask01); UtRegisterTest("AddressTestParseInvalidMask02", AddressTestParseInvalidMask02); UtRegisterTest("AddressTestParseInvalidMask03", AddressTestParseInvalidMask03); UtRegisterTest("AddressConfVarsTest01 ", AddressConfVarsTest01); UtRegisterTest("AddressConfVarsTest02 ", AddressConfVarsTest02); UtRegisterTest("AddressConfVarsTest03 ", AddressConfVarsTest03); UtRegisterTest("AddressConfVarsTest04 ", AddressConfVarsTest04); UtRegisterTest("AddressConfVarsTest05 ", AddressConfVarsTest05); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-mpm.h0000644000000000000000000001646013051004444012725 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_MPM_H__ #define __UTIL_MPM_H__ #include "util-prefilter.h" #define MPM_INIT_HASH_SIZE 65536 enum { MPM_NOTSET = 0, /* aho-corasick */ MPM_AC, #ifdef __SC_CUDA_SUPPORT__ MPM_AC_CUDA, #endif MPM_AC_BS, MPM_AC_TILE, MPM_HS, /* table size */ MPM_TABLE_SIZE, }; /* Internal Pattern Index: 0 to pattern_cnt-1 */ typedef uint32_t MpmPatternIndex; typedef struct MpmThreadCtx_ { void *ctx; uint32_t memory_cnt; uint32_t memory_size; } MpmThreadCtx; typedef struct MpmPattern_ { /* length of the pattern */ uint16_t len; /* flags decribing the pattern */ uint8_t flags; /* holds the original pattern that was added */ uint8_t *original_pat; /* case sensitive */ uint8_t *cs; /* case INsensitive */ uint8_t *ci; /* pattern id */ uint32_t id; /* sid(s) for this pattern */ uint32_t sids_size; SigIntId *sids; struct MpmPattern_ *next; } MpmPattern; typedef struct MpmCtx_ { void *ctx; uint16_t mpm_type; /* Indicates if this a global mpm_ctx. Global mpm_ctx is the one that * is instantiated when we use "single". Non-global is "full", i.e. * one per sgh. We are using a uint16_t here to avoiding using a pad. * You can use a uint8_t here as well. */ uint16_t global; /* unique patterns */ uint32_t pattern_cnt; uint16_t minlen; uint16_t maxlen; uint32_t memory_cnt; uint32_t memory_size; uint32_t max_pat_id; /* hash used during ctx initialization */ MpmPattern **init_hash; } MpmCtx; /* if we want to retrieve an unique mpm context from the mpm context factory * we should supply this as the key */ #define MPM_CTX_FACTORY_UNIQUE_CONTEXT -1 typedef struct MpmCtxFactoryItem_ { const char *name; MpmCtx *mpm_ctx_ts; MpmCtx *mpm_ctx_tc; int32_t id; } MpmCtxFactoryItem; typedef struct MpmCtxFactoryContainer_ { MpmCtxFactoryItem *items; int32_t no_of_items; } MpmCtxFactoryContainer; /** pattern is case insensitive */ #define MPM_PATTERN_FLAG_NOCASE 0x01 /** pattern is negated */ #define MPM_PATTERN_FLAG_NEGATED 0x02 /** pattern has a depth setting */ #define MPM_PATTERN_FLAG_DEPTH 0x04 /** pattern has an offset setting */ #define MPM_PATTERN_FLAG_OFFSET 0x08 /** one byte pattern (used in b2g) */ #define MPM_PATTERN_ONE_BYTE 0x10 /** the ctx uses it's own internal id instead of * what is passed through the API */ #define MPM_PATTERN_CTX_OWNS_ID 0x20 typedef struct MpmTableElmt_ { const char *name; void (*InitCtx)(struct MpmCtx_ *); void (*InitThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *); void (*DestroyCtx)(struct MpmCtx_ *); void (*DestroyThreadCtx)(struct MpmCtx_ *, struct MpmThreadCtx_ *); /** function pointers for adding patterns to the mpm ctx. * * \param mpm_ctx Mpm context to add the pattern to * \param pattern pointer to the pattern * \param pattern_len length of the pattern in bytes * \param offset pattern offset setting * \param depth pattern depth setting * \param pid pattern id * \param sid signature _internal_ id * \param flags pattern flags */ int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int (*Prepare)(struct MpmCtx_ *); uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint16_t); void (*PrintCtx)(struct MpmCtx_ *); void (*PrintThreadCtx)(struct MpmThreadCtx_ *); void (*RegisterUnittests)(void); uint8_t flags; } MpmTableElmt; MpmTableElmt mpm_table[MPM_TABLE_SIZE]; int mpm_default_matcher; /* macros decides if cuda is enabled for the platform or not */ #ifdef __SC_CUDA_SUPPORT__ /* the min size limit of a payload(or any other data) to be buffered */ #define UTIL_MPM_CUDA_DATA_BUFFER_SIZE_MIN_LIMIT_DEFAULT 0 /* the max size limit of a payload(or any other data) to be buffered */ #define UTIL_MPM_CUDA_DATA_BUFFER_SIZE_MAX_LIMIT_DEFAULT 1500 /* Default value for data buffer used by cuda mpm engine for CudaBuffer reg */ #define UTIL_MPM_CUDA_CUDA_BUFFER_DBUFFER_SIZE_DEFAULT 500 * 1024 * 1024 /* Default value for the max data chunk that would be sent to gpu */ #define UTIL_MPM_CUDA_GPU_TRANSFER_SIZE 50 * 1024 * 1024 /* Default value for offset/pointer buffer to be used by cuda mpm * engine for CudaBuffer reg */ #define UTIL_MPM_CUDA_CUDA_BUFFER_OPBUFFER_ITEMS_DEFAULT 500000 #define UTIL_MPM_CUDA_BATCHING_TIMEOUT_DEFAULT 2000 #define UTIL_MPM_CUDA_CUDA_STREAMS_DEFAULT 2 #define UTIL_MPM_CUDA_DEVICE_ID_DEFAULT 0 /** * \brief Cuda configuration for "mpm" profile. We can further extend this * to have conf for specific mpms. For now its common for all mpms. */ typedef struct MpmCudaConf_ { uint16_t data_buffer_size_min_limit; uint16_t data_buffer_size_max_limit; uint32_t cb_buffer_size; uint32_t gpu_transfer_size; int batching_timeout; int device_id; int cuda_streams; } MpmCudaConf; void MpmCudaEnvironmentSetup(); #endif /* __SC_CUDA_SUPPORT__ */ struct DetectEngineCtx_; int32_t MpmFactoryRegisterMpmCtxProfile(struct DetectEngineCtx_ *, const char *); void MpmFactoryReClaimMpmCtx(const struct DetectEngineCtx_ *, MpmCtx *); MpmCtx *MpmFactoryGetMpmCtxForProfile(const struct DetectEngineCtx_ *, int32_t, int); void MpmFactoryDeRegisterAllMpmCtxProfiles(struct DetectEngineCtx_ *); int32_t MpmFactoryIsMpmCtxAvailable(const struct DetectEngineCtx_ *, const MpmCtx *); int PmqSetup(PrefilterRuleStore *); void PmqReset(PrefilterRuleStore *); void PmqCleanup(PrefilterRuleStore *); void PmqFree(PrefilterRuleStore *); void MpmTableSetup(void); void MpmRegisterTests(void); void MpmInitCtx(MpmCtx *mpm_ctx, uint16_t matcher); void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t); int MpmAddPatternCS(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags); int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags); void MpmFreePattern(MpmCtx *mpm_ctx, MpmPattern *p); int MpmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags); #endif /* __UTIL_MPM_H__ */ suricata-3.2.1/src/util-ip.c0000644000000000000000000000653313051004444012537 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Duarte Silva * * IP addresses related utility functions */ #include "suricata-common.h" /** * \brief Validates an IPV4 address and returns the network endian arranged * version of the IPV4 address * * \param addr Pointer to a character string containing an IPV4 address. A * valid IPV4 address is a character string containing a dotted * format of "ddd.ddd.ddd.ddd" * * \retval Pointer to an in_addr instance containing the network endian format * of the IPV4 address * \retval NULL if the IPV4 address is invalid */ struct in_addr *ValidateIPV4Address(const char *addr_str) { struct in_addr *addr = NULL; if ( (addr = SCMalloc(sizeof(struct in_addr))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in ValidateIPV4Address. Exiting..."); exit(EXIT_FAILURE); } if (inet_pton(AF_INET, addr_str, addr) <= 0) { SCFree(addr); return NULL; } return addr; } /** * \brief Validates an IPV6 address and returns the network endian arranged * version of the IPV6 addresss * * \param addr Pointer to a character string containing an IPV6 address * * \retval Pointer to a in6_addr instance containing the network endian format * of the IPV6 address * \retval NULL if the IPV6 address is invalid */ struct in6_addr *ValidateIPV6Address(const char *addr_str) { struct in6_addr *addr = NULL; if ( (addr = SCMalloc(sizeof(struct in6_addr))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in ValidateIPV6Address. Exiting..."); exit(EXIT_FAILURE); } if (inet_pton(AF_INET6, addr_str, addr) <= 0) { SCFree(addr); return NULL; } return addr; } /** * \brief Culls the non-netmask portion of the IP address. For example an IP * address 192.168.240.1 would be chopped to 192.168.224.0 against a * netmask value of 19. * * \param stream Pointer the IP address that has to be masked * \param netmask The netmask value (cidr) to which the IP address has to be culled * \param key_bitlen The bitlen of the stream */ void MaskIPNetblock(uint8_t *stream, uint8_t netmask, uint16_t key_bitlen) { uint32_t mask = 0; int i = 0; int bytes = key_bitlen / 8; for (i = 0; i < bytes; i++) { mask = UINT_MAX; if ( ((i + 1) * 8) > netmask) { if ( ((i + 1) * 8 - netmask) < 8) mask = UINT_MAX << ((i + 1) * 8 - netmask); else mask = 0; } stream[i] &= mask; } return; } suricata-3.2.1/src/runmode-unix-socket.c0000644000000000000000000006103213051004444015067 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-pcap-file.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "unix-manager.h" #include "detect-engine.h" #include "flow-manager.h" #include "flow-timeout.h" #include "stream-tcp.h" #include "host.h" #include "defrag.h" #include "ippair.h" #include "app-layer.h" #include "util-profiling.h" #include "conf-yaml-loader.h" static const char *default_mode = NULL; int unix_socket_mode_is_running = 0; typedef struct PcapFiles_ { char *filename; char *output_dir; int tenant_id; TAILQ_ENTRY(PcapFiles_) next; } PcapFiles; typedef struct PcapCommand_ { TAILQ_HEAD(, PcapFiles_) files; int running; char *currentfile; } PcapCommand; const char *RunModeUnixSocketGetDefaultMode(void) { return default_mode; } #ifdef BUILD_UNIX_SOCKET static int unix_manager_file_task_running = 0; static int unix_manager_file_task_failed = 0; /** * \brief return list of files in the queue * * \retval 0 in case of error, 1 in case of success */ static TmEcode UnixSocketPcapFilesList(json_t *cmd, json_t* answer, void *data) { PcapCommand *this = (PcapCommand *) data; int i = 0; PcapFiles *file; json_t *jdata; json_t *jarray; jdata = json_object(); if (jdata == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } jarray = json_array(); if (jarray == NULL) { json_decref(jdata); json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } TAILQ_FOREACH(file, &this->files, next) { json_array_append_new(jarray, json_string(file->filename)); i++; } json_object_set_new(jdata, "count", json_integer(i)); json_object_set_new(jdata, "files", jarray); json_object_set_new(answer, "message", jdata); return TM_ECODE_OK; } static TmEcode UnixSocketPcapFilesNumber(json_t *cmd, json_t* answer, void *data) { PcapCommand *this = (PcapCommand *) data; int i = 0; PcapFiles *file; TAILQ_FOREACH(file, &this->files, next) { i++; } json_object_set_new(answer, "message", json_integer(i)); return TM_ECODE_OK; } static TmEcode UnixSocketPcapCurrent(json_t *cmd, json_t* answer, void *data) { PcapCommand *this = (PcapCommand *) data; if (this->currentfile) { json_object_set_new(answer, "message", json_string(this->currentfile)); } else { json_object_set_new(answer, "message", json_string("None")); } return TM_ECODE_OK; } static void PcapFilesFree(PcapFiles *cfile) { if (cfile == NULL) return; if (cfile->filename) SCFree(cfile->filename); if (cfile->output_dir) SCFree(cfile->output_dir); SCFree(cfile); } /** * \brief Add file to file queue * * \param this a UnixCommand:: structure * \param filename absolute filename * \param output_dir absolute name of directory where log will be put * * \retval 0 in case of error, 1 in case of success */ static TmEcode UnixListAddFile(PcapCommand *this, const char *filename, const char *output_dir, int tenant_id) { PcapFiles *cfile = NULL; if (filename == NULL || this == NULL) return TM_ECODE_FAILED; cfile = SCMalloc(sizeof(PcapFiles)); if (unlikely(cfile == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate new file"); return TM_ECODE_FAILED; } memset(cfile, 0, sizeof(PcapFiles)); cfile->filename = SCStrdup(filename); if (unlikely(cfile->filename == NULL)) { SCFree(cfile); SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup filename"); return TM_ECODE_FAILED; } if (output_dir) { cfile->output_dir = SCStrdup(output_dir); if (unlikely(cfile->output_dir == NULL)) { SCFree(cfile->filename); SCFree(cfile); SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup output_dir"); return TM_ECODE_FAILED; } } cfile->tenant_id = tenant_id; TAILQ_INSERT_TAIL(&this->files, cfile, next); return TM_ECODE_OK; } /** * \brief Command to add a file to treatment list * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketAddPcapFile(json_t *cmd, json_t* answer, void *data) { PcapCommand *this = (PcapCommand *) data; int ret; const char *filename; const char *output_dir; int tenant_id = 0; #ifdef OS_WIN32 struct _stat st; #else struct stat st; #endif /* OS_WIN32 */ json_t *jarg = json_object_get(cmd, "filename"); if(!json_is_string(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("command is not a string")); return TM_ECODE_FAILED; } filename = json_string_value(jarg); #ifdef OS_WIN32 if(_stat(filename, &st) != 0) { #else if(stat(filename, &st) != 0) { #endif /* OS_WIN32 */ json_object_set_new(answer, "message", json_string("File does not exist")); return TM_ECODE_FAILED; } json_t *oarg = json_object_get(cmd, "output-dir"); if (oarg != NULL) { if(!json_is_string(oarg)) { SCLogInfo("error: output dir is not a string"); json_object_set_new(answer, "message", json_string("output dir is not a string")); return TM_ECODE_FAILED; } output_dir = json_string_value(oarg); } else { SCLogInfo("error: can't get output-dir"); json_object_set_new(answer, "message", json_string("output dir param is mandatory")); return TM_ECODE_FAILED; } #ifdef OS_WIN32 if(_stat(output_dir, &st) != 0) { #else if(stat(output_dir, &st) != 0) { #endif /* OS_WIN32 */ json_object_set_new(answer, "message", json_string("Output directory does not exist")); return TM_ECODE_FAILED; } json_t *targ = json_object_get(cmd, "tenant"); if (targ != NULL) { if(!json_is_number(targ)) { json_object_set_new(answer, "message", json_string("tenant is not a number")); return TM_ECODE_FAILED; } tenant_id = json_number_value(targ); } ret = UnixListAddFile(this, filename, output_dir, tenant_id); switch(ret) { case TM_ECODE_FAILED: json_object_set_new(answer, "message", json_string("Unable to add file to list")); return TM_ECODE_FAILED; case TM_ECODE_OK: SCLogInfo("Added file '%s' to list", filename); json_object_set_new(answer, "message", json_string("Successfully added file to list")); return TM_ECODE_OK; } return TM_ECODE_OK; } /** * \brief Handle the file queue * * This function check if there is currently a file * being parse. If it is not the case, it will start to * work on a new file. This implies to start a new 'pcap-file' * running mode after having set the file and the output dir. * This function also handles the cleaning of the previous * running mode. * * \param this a UnixCommand:: structure * \retval 0 in case of error, 1 in case of success */ TmEcode UnixSocketPcapFilesCheck(void *data) { PcapCommand *this = (PcapCommand *) data; if (unix_manager_file_task_running == 1) { return TM_ECODE_OK; } if ((unix_manager_file_task_failed == 1) || (this->running == 1)) { if (unix_manager_file_task_failed) { SCLogInfo("Preceeding task failed, cleaning the running mode"); } unix_manager_file_task_failed = 0; this->running = 0; if (this->currentfile) { SCFree(this->currentfile); } this->currentfile = NULL; PostRunDeinit(RUNMODE_PCAP_FILE, NULL /* no ts */); } if (TAILQ_EMPTY(&this->files)) { // nothing to do return TM_ECODE_OK; } PcapFiles *cfile = TAILQ_FIRST(&this->files); TAILQ_REMOVE(&this->files, cfile, next); SCLogInfo("Starting run for '%s'", cfile->filename); unix_manager_file_task_running = 1; this->running = 1; if (ConfSet("pcap-file.file", cfile->filename) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Can not set working file to '%s'", cfile->filename); PcapFilesFree(cfile); return TM_ECODE_FAILED; } if (cfile->output_dir) { if (ConfSet("default-log-dir", cfile->output_dir) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Can not set output dir to '%s'", cfile->output_dir); PcapFilesFree(cfile); return TM_ECODE_FAILED; } } if (cfile->tenant_id > 0) { char tstr[16]; snprintf(tstr, sizeof(tstr), "%d", cfile->tenant_id); if (ConfSet("pcap-file.tenant-id", tstr) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Can not set working tenant-id to '%s'", tstr); PcapFilesFree(cfile); return TM_ECODE_FAILED; } } else { SCLogInfo("pcap-file.tenant-id not set"); } this->currentfile = SCStrdup(cfile->filename); if (unlikely(this->currentfile == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed file name allocation"); return TM_ECODE_FAILED; } PcapFilesFree(cfile); PreRunInit(RUNMODE_PCAP_FILE); PreRunPostPrivsDropInit(RUNMODE_PCAP_FILE); RunModeDispatch(RUNMODE_PCAP_FILE, NULL); /* Un-pause all the paused threads */ TmThreadContinueThreads(); return TM_ECODE_OK; } #endif void RunModeUnixSocketRegister(void) { #ifdef BUILD_UNIX_SOCKET RunModeRegisterNewRunMode(RUNMODE_UNIX_SOCKET, "single", "Unix socket mode", RunModeUnixSocketSingle); default_mode = "single"; #endif return; } void UnixSocketPcapFile(TmEcode tm) { #ifdef BUILD_UNIX_SOCKET switch (tm) { case TM_ECODE_DONE: unix_manager_file_task_running = 0; break; case TM_ECODE_FAILED: unix_manager_file_task_running = 0; unix_manager_file_task_failed = 1; break; case TM_ECODE_OK: break; } #endif } #ifdef BUILD_UNIX_SOCKET /** * \brief Command to add a tenant handler * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketRegisterTenantHandler(json_t *cmd, json_t* answer, void *data) { const char *htype; json_int_t traffic_id = -1; if (!(DetectEngineMultiTenantEnabled())) { SCLogInfo("error: multi-tenant support not enabled"); json_object_set_new(answer, "message", json_string("multi-tenant support not enabled")); return TM_ECODE_FAILED; } /* 1 get tenant id */ json_t *jarg = json_object_get(cmd, "id"); if (!json_is_integer(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("id is not an integer")); return TM_ECODE_FAILED; } int tenant_id = json_integer_value(jarg); /* 2 get tenant handler type */ jarg = json_object_get(cmd, "htype"); if (!json_is_string(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("command is not a string")); return TM_ECODE_FAILED; } htype = json_string_value(jarg); SCLogDebug("add-tenant-handler: %d %s", tenant_id, htype); /* 3 get optional hargs */ json_t *hargs = json_object_get(cmd, "hargs"); if (hargs != NULL) { if (!json_is_integer(hargs)) { SCLogInfo("error: hargs not a number"); json_object_set_new(answer, "message", json_string("hargs not a number")); return TM_ECODE_FAILED; } traffic_id = json_integer_value(hargs); } /* 4 add to system */ int r = -1; if (strcmp(htype, "pcap") == 0) { r = DetectEngineTentantRegisterPcapFile(tenant_id); } else if (strcmp(htype, "vlan") == 0) { if (traffic_id < 0) { json_object_set_new(answer, "message", json_string("vlan requires argument")); return TM_ECODE_FAILED; } if (traffic_id > USHRT_MAX) { json_object_set_new(answer, "message", json_string("vlan argument out of range")); return TM_ECODE_FAILED; } SCLogInfo("VLAN handler: id %u maps to tenant %u", (uint32_t)traffic_id, tenant_id); r = DetectEngineTentantRegisterVlanId(tenant_id, (uint32_t)traffic_id); } if (r != 0) { json_object_set_new(answer, "message", json_string("handler setup failure")); return TM_ECODE_FAILED; } if (DetectEngineMTApply() < 0) { json_object_set_new(answer, "message", json_string("couldn't apply settings")); // TODO cleanup return TM_ECODE_FAILED; } json_object_set_new(answer, "message", json_string("handler added")); return TM_ECODE_OK; } /** * \brief Command to remove a tenant handler * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketUnregisterTenantHandler(json_t *cmd, json_t* answer, void *data) { const char *htype; json_int_t traffic_id = -1; if (!(DetectEngineMultiTenantEnabled())) { SCLogInfo("error: multi-tenant support not enabled"); json_object_set_new(answer, "message", json_string("multi-tenant support not enabled")); return TM_ECODE_FAILED; } /* 1 get tenant id */ json_t *jarg = json_object_get(cmd, "id"); if (!json_is_integer(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("id is not an integer")); return TM_ECODE_FAILED; } int tenant_id = json_integer_value(jarg); /* 2 get tenant handler type */ jarg = json_object_get(cmd, "htype"); if (!json_is_string(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("command is not a string")); return TM_ECODE_FAILED; } htype = json_string_value(jarg); SCLogDebug("add-tenant-handler: %d %s", tenant_id, htype); /* 3 get optional hargs */ json_t *hargs = json_object_get(cmd, "hargs"); if (hargs != NULL) { if (!json_is_integer(hargs)) { SCLogInfo("error: hargs not a number"); json_object_set_new(answer, "message", json_string("hargs not a number")); return TM_ECODE_FAILED; } traffic_id = json_integer_value(hargs); } /* 4 add to system */ int r = -1; if (strcmp(htype, "pcap") == 0) { r = DetectEngineTentantUnregisterPcapFile(tenant_id); } else if (strcmp(htype, "vlan") == 0) { if (traffic_id < 0) { json_object_set_new(answer, "message", json_string("vlan requires argument")); return TM_ECODE_FAILED; } if (traffic_id > USHRT_MAX) { json_object_set_new(answer, "message", json_string("vlan argument out of range")); return TM_ECODE_FAILED; } SCLogInfo("VLAN handler: id %u maps to tenant %u", (uint32_t)traffic_id, tenant_id); r = DetectEngineTentantUnregisterVlanId(tenant_id, (uint32_t)traffic_id); } if (r != 0) { json_object_set_new(answer, "message", json_string("handler unregister failure")); return TM_ECODE_FAILED; } /* 5 apply it */ if (DetectEngineMTApply() < 0) { json_object_set_new(answer, "message", json_string("couldn't apply settings")); // TODO cleanup return TM_ECODE_FAILED; } json_object_set_new(answer, "message", json_string("handler added")); return TM_ECODE_OK; } /** * \brief Command to add a tenant * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketRegisterTenant(json_t *cmd, json_t* answer, void *data) { const char *filename; #ifdef OS_WIN32 struct _stat st; #else struct stat st; #endif /* OS_WIN32 */ if (!(DetectEngineMultiTenantEnabled())) { SCLogInfo("error: multi-tenant support not enabled"); json_object_set_new(answer, "message", json_string("multi-tenant support not enabled")); return TM_ECODE_FAILED; } /* 1 get tenant id */ json_t *jarg = json_object_get(cmd, "id"); if (!json_is_integer(jarg)) { json_object_set_new(answer, "message", json_string("id is not an integer")); return TM_ECODE_FAILED; } int tenant_id = json_integer_value(jarg); /* 2 get tenant yaml */ jarg = json_object_get(cmd, "filename"); if (!json_is_string(jarg)) { json_object_set_new(answer, "message", json_string("command is not a string")); return TM_ECODE_FAILED; } filename = json_string_value(jarg); #ifdef OS_WIN32 if(_stat(filename, &st) != 0) { #else if(stat(filename, &st) != 0) { #endif /* OS_WIN32 */ json_object_set_new(answer, "message", json_string("file does not exist")); return TM_ECODE_FAILED; } SCLogDebug("add-tenant: %d %s", tenant_id, filename); /* setup the yaml in this loop so that it's not done by the loader * threads. ConfYamlLoadFileWithPrefix is not thread safe. */ char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d", tenant_id); if (ConfYamlLoadFileWithPrefix(filename, prefix) != 0) { SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to load yaml %s", filename); json_object_set_new(answer, "message", json_string("failed to load yaml")); return TM_ECODE_FAILED; } /* 3 load into the system */ if (DetectEngineLoadTenantBlocking(tenant_id, filename) != 0) { json_object_set_new(answer, "message", json_string("adding tenant failed")); return TM_ECODE_FAILED; } /* 4 apply to the running system */ if (DetectEngineMTApply() < 0) { json_object_set_new(answer, "message", json_string("couldn't apply settings")); // TODO cleanup return TM_ECODE_FAILED; } json_object_set_new(answer, "message", json_string("adding tenant succeeded")); return TM_ECODE_OK; } static int reload_cnt = 1; /** * \brief Command to reload a tenant * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketReloadTenant(json_t *cmd, json_t* answer, void *data) { const char *filename; #ifdef OS_WIN32 struct _stat st; #else struct stat st; #endif /* OS_WIN32 */ if (!(DetectEngineMultiTenantEnabled())) { SCLogInfo("error: multi-tenant support not enabled"); json_object_set_new(answer, "message", json_string("multi-tenant support not enabled")); return TM_ECODE_FAILED; } /* 1 get tenant id */ json_t *jarg = json_object_get(cmd, "id"); if (!json_is_integer(jarg)) { json_object_set_new(answer, "message", json_string("id is not an integer")); return TM_ECODE_FAILED; } int tenant_id = json_integer_value(jarg); /* 2 get tenant yaml */ jarg = json_object_get(cmd, "filename"); if (!json_is_string(jarg)) { json_object_set_new(answer, "message", json_string("command is not a string")); return TM_ECODE_FAILED; } filename = json_string_value(jarg); #ifdef OS_WIN32 if(_stat(filename, &st) != 0) { #else if(stat(filename, &st) != 0) { #endif /* OS_WIN32 */ json_object_set_new(answer, "message", json_string("file does not exist")); return TM_ECODE_FAILED; } SCLogDebug("reload-tenant: %d %s", tenant_id, filename); char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d.reload.%d", tenant_id, reload_cnt); SCLogInfo("prefix %s", prefix); if (ConfYamlLoadFileWithPrefix(filename, prefix) != 0) { json_object_set_new(answer, "message", json_string("failed to load yaml")); return TM_ECODE_FAILED; } /* 3 load into the system */ if (DetectEngineReloadTenantBlocking(tenant_id, filename, reload_cnt) != 0) { json_object_set_new(answer, "message", json_string("reload tenant failed")); return TM_ECODE_FAILED; } reload_cnt++; /* apply to the running system */ if (DetectEngineMTApply() < 0) { json_object_set_new(answer, "message", json_string("couldn't apply settings")); // TODO cleanup return TM_ECODE_FAILED; } json_object_set_new(answer, "message", json_string("reloading tenant succeeded")); return TM_ECODE_OK; } /** * \brief Command to remove a tenant * * \param cmd the content of command Arguments as a json_t object * \param answer the json_t object that has to be used to answer * \param data pointer to data defining the context here a PcapCommand:: */ TmEcode UnixSocketUnregisterTenant(json_t *cmd, json_t* answer, void *data) { if (!(DetectEngineMultiTenantEnabled())) { SCLogInfo("error: multi-tenant support not enabled"); json_object_set_new(answer, "message", json_string("multi-tenant support not enabled")); return TM_ECODE_FAILED; } /* 1 get tenant id */ json_t *jarg = json_object_get(cmd, "id"); if (!json_is_integer(jarg)) { SCLogInfo("error: command is not a string"); json_object_set_new(answer, "message", json_string("id is not an integer")); return TM_ECODE_FAILED; } int tenant_id = json_integer_value(jarg); SCLogInfo("remove-tenant: %d TODO", tenant_id); /* 2 remove it from the system */ char prefix[64]; snprintf(prefix, sizeof(prefix), "multi-detect.%d", tenant_id); DetectEngineCtx *de_ctx = DetectEngineGetByTenantId(tenant_id); if (de_ctx == NULL) { json_object_set_new(answer, "message", json_string("tenant detect engine not found")); return TM_ECODE_FAILED; } /* move to free list */ DetectEngineMoveToFreeList(de_ctx); DetectEngineDeReference(&de_ctx); /* update the threads */ if (DetectEngineMTApply() < 0) { json_object_set_new(answer, "message", json_string("couldn't apply settings")); // TODO cleanup return TM_ECODE_FAILED; } /* walk free list, freeing the removed de_ctx */ DetectEnginePruneFreeList(); json_object_set_new(answer, "message", json_string("work in progress")); return TM_ECODE_OK; } #endif /* BUILD_UNIX_SOCKET */ /** * \brief Single thread version of the Pcap file processing. */ int RunModeUnixSocketSingle(void) { #ifdef BUILD_UNIX_SOCKET PcapCommand *pcapcmd = SCMalloc(sizeof(PcapCommand)); if (unlikely(pcapcmd == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can not allocate pcap command"); return 1; } TAILQ_INIT(&pcapcmd->files); pcapcmd->running = 0; pcapcmd->currentfile = NULL; UnixManagerThreadSpawn(1); unix_socket_mode_is_running = 1; UnixManagerRegisterCommand("pcap-file", UnixSocketAddPcapFile, pcapcmd, UNIX_CMD_TAKE_ARGS); UnixManagerRegisterCommand("pcap-file-number", UnixSocketPcapFilesNumber, pcapcmd, 0); UnixManagerRegisterCommand("pcap-file-list", UnixSocketPcapFilesList, pcapcmd, 0); UnixManagerRegisterCommand("pcap-current", UnixSocketPcapCurrent, pcapcmd, 0); UnixManagerRegisterBackgroundTask(UnixSocketPcapFilesCheck, pcapcmd); #endif return 0; } int RunModeUnixSocketIsActive(void) { return unix_socket_mode_is_running; } suricata-3.2.1/src/decode-template.c0000644000000000000000000000547313051004444014212 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author XXX Your Name * * Decodes XXX describe the protocol */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "decode-events.h" #include "decode-template.h" #include "util-unittest.h" #include "util-debug.h" /** * \brief Function to decode XXX packets * \param tv thread vars * \param dtv decoder thread vars * \param p packet * \param pkt raw packet data * \param len length in bytes of pkt array * \retval TM_ECODE_OK or TM_ECODE_FAILED on serious error */ int DecodeTEMPLATE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq) { /* TODO add counter for your type of packet to DecodeThreadVars, * and register it in DecodeRegisterPerfCounters */ //StatsIncr(tv, dtv->counter_template); /* Validation: make sure that the input data is big enough to hold * the header */ if (len < sizeof(TemplateHdr)) { /* in case of errors, we set events. Events are defined in * decode-events.h, and are then exposed to the detection * engine through detect-engine-events.h */ //ENGINE_SET_EVENT(p,TEMPLATE_HEADER_TOO_SMALL); return TM_ECODE_FAILED; } /* Now we can access the header */ const TemplateHdr *hdr = (const TemplateHdr *)pkt; /* lets assume we have UDP encapsulated */ if (hdr->proto == 17) { /* we need to pass on the pkt and it's length minus the current * header */ size_t hdr_len = sizeof(TemplateHdr); /* in this example it's clear that hdr_len can't be bigger than * 'len', but in more complex cases checking that we can't underflow * len is very important if (hdr_len < len) { */ /* invoke the next decoder on the remainder of the data */ return DecodeUDP(tv, dtv, p, (uint8_t *)pkt + hdr_len, len - hdr_len, pq); //} } else { //ENGINE_SET_EVENT(p,TEMPLATE_UNSUPPORTED_PROTOCOL); return TM_ECODE_FAILED; } return TM_ECODE_OK; } /** * @} */ suricata-3.2.1/src/defrag-queue.h0000644000000000000000000000472013051004444013527 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DEFRAG_QUEUE_H__ #define __DEFRAG_QUEUE_H__ #include "suricata-common.h" #include "defrag.h" /** Spinlocks or Mutex for the defrag tracker queues. */ //#define DQLOCK_SPIN #define DQLOCK_MUTEX #ifdef DQLOCK_SPIN #ifdef DQLOCK_MUTEX #error Cannot enable both DQLOCK_SPIN and DQLOCK_MUTEX #endif #endif /* Define a queue for storing defrag trackers */ typedef struct DefragTrackerQueue_ { DefragTracker *top; DefragTracker *bot; uint32_t len; #ifdef DBG_PERF uint32_t dbg_maxlen; #endif /* DBG_PERF */ #ifdef DQLOCK_MUTEX SCMutex m; #elif defined DQLOCK_SPIN SCSpinlock s; #else #error Enable DQLOCK_SPIN or DQLOCK_MUTEX #endif } DefragTrackerQueue; #ifdef DQLOCK_SPIN #define DQLOCK_INIT(q) SCSpinInit(&(q)->s, 0) #define DQLOCK_DESTROY(q) SCSpinDestroy(&(q)->s) #define DQLOCK_LOCK(q) SCSpinLock(&(q)->s) #define DQLOCK_TRYLOCK(q) SCSpinTrylock(&(q)->s) #define DQLOCK_UNLOCK(q) SCSpinUnlock(&(q)->s) #elif defined DQLOCK_MUTEX #define DQLOCK_INIT(q) SCMutexInit(&(q)->m, NULL) #define DQLOCK_DESTROY(q) SCMutexDestroy(&(q)->m) #define DQLOCK_LOCK(q) SCMutexLock(&(q)->m) #define DQLOCK_TRYLOCK(q) SCMutexTrylock(&(q)->m) #define DQLOCK_UNLOCK(q) SCMutexUnlock(&(q)->m) #else #error Enable DQLOCK_SPIN or DQLOCK_MUTEX #endif /* prototypes */ DefragTrackerQueue *DefragTrackerQueueNew(); DefragTrackerQueue *DefragTrackerQueueInit(DefragTrackerQueue *); void DefragTrackerQueueDestroy (DefragTrackerQueue *); void DefragTrackerEnqueue (DefragTrackerQueue *, DefragTracker *); DefragTracker *DefragTrackerDequeue (DefragTrackerQueue *); uint32_t DefragTrackerQueueLen(DefragTrackerQueue *); #endif /* __DEFRAG_QUEUE_H__ */ suricata-3.2.1/src/app-layer.h0000644000000000000000000000732013051004444013046 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \author Victor Julien * \author Anoop Saldanha */ #ifndef __APP_LAYER_H__ #define __APP_LAYER_H__ #include "threadvars.h" #include "decode.h" #include "flow.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream.h" #include "util-profiling.h" #define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER \ (~STREAM_TOSERVER & ~STREAM_TOCLIENT) /***** L7 layer dispatchers *****/ /** * \brief Handles reassembled tcp stream. */ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream *stream, uint8_t *data, uint32_t data_len, uint8_t flags); /** * \brief Handles an udp chunk. */ int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f); /***** Utility *****/ /** * \brief Given a protocol string, returns the corresponding internal * protocol id. * * \param The internal protocol id. */ AppProto AppLayerGetProtoByName(char *alproto_name); /** * \brief Given the internal protocol id, returns a string representation * of the protocol. * * \param alproto The internal protocol id. * * \retval String representation of the protocol. */ char *AppLayerGetProtoName(AppProto alproto); void AppLayerListSupportedProtocols(void); /***** Setup/General Registration *****/ /** * \brief Setup the app layer. * * Includes protocol detection setup and the protocol parser setup. * * \retval 0 On success. * \retval -1 On failure. */ int AppLayerSetup(void); /** * \brief De initializes the app layer. * * Includes de initializing protocol detection and the protocol parser. */ int AppLayerDeSetup(void); /** * \brief Creates a new app layer thread context. * * \retval Pointer to the newly create thread context, on success; * NULL, on failure. */ AppLayerThreadCtx *AppLayerGetCtxThread(ThreadVars *tv); /** * \brief Destroys the context created by AppLayeGetCtxThread(). * * \param tctx Pointer to the thread context to destroy. */ void AppLayerDestroyCtxThread(AppLayerThreadCtx *tctx); /** * \brief Registers per flow counters for all protocols * */ void AppLayerRegisterThreadCounters(ThreadVars *tv); /***** Profiling *****/ void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx); static inline void AppLayerProfilingReset(AppLayerThreadCtx *app_tctx) { #ifdef PROFILING AppLayerProfilingResetInternal(app_tctx); #endif } void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p); static inline void AppLayerProfilingStore(AppLayerThreadCtx *app_tctx, Packet *p) { #ifdef PROFILING AppLayerProfilingStoreInternal(app_tctx, p); #endif } void AppLayerRegisterGlobalCounters(void); /***** Unittests *****/ #ifdef UNITTESTS void AppLayerUnittestsRegister(void); #endif void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step); #endif suricata-3.2.1/src/defrag-hash.c0000644000000000000000000005306613051004444013330 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "conf.h" #include "defrag-hash.h" #include "defrag-queue.h" #include "defrag-config.h" #include "util-random.h" #include "util-byte.h" #include "util-misc.h" #include "util-hash-lookup3.h" static DefragTracker *DefragTrackerGetUsedDefragTracker(void); /** queue with spare tracker */ static DefragTrackerQueue defragtracker_spare_q; uint32_t DefragTrackerSpareQueueGetSize(void) { return DefragTrackerQueueLen(&defragtracker_spare_q); } void DefragTrackerMoveToSpare(DefragTracker *h) { DefragTrackerEnqueue(&defragtracker_spare_q, h); (void) SC_ATOMIC_SUB(defragtracker_counter, 1); } DefragTracker *DefragTrackerAlloc(void) { if (!(DEFRAG_CHECK_MEMCAP(sizeof(DefragTracker)))) { return NULL; } (void) SC_ATOMIC_ADD(defrag_memuse, sizeof(DefragTracker)); DefragTracker *dt = SCMalloc(sizeof(DefragTracker)); if (unlikely(dt == NULL)) goto error; memset(dt, 0x00, sizeof(DefragTracker)); SCMutexInit(&dt->lock, NULL); SC_ATOMIC_INIT(dt->use_cnt); return dt; error: return NULL; } void DefragTrackerFree(DefragTracker *dt) { if (dt != NULL) { DefragTrackerClearMemory(dt); SCMutexDestroy(&dt->lock); SCFree(dt); (void) SC_ATOMIC_SUB(defrag_memuse, sizeof(DefragTracker)); } } #define DefragTrackerIncrUsecnt(dt) \ SC_ATOMIC_ADD((dt)->use_cnt, 1) #define DefragTrackerDecrUsecnt(dt) \ SC_ATOMIC_SUB((dt)->use_cnt, 1) static void DefragTrackerInit(DefragTracker *dt, Packet *p) { /* copy address */ COPY_ADDRESS(&p->src, &dt->src_addr); COPY_ADDRESS(&p->dst, &dt->dst_addr); if (PKT_IS_IPV4(p)) { dt->id = (int32_t)IPV4_GET_IPID(p); dt->af = AF_INET; } else { dt->id = (int32_t)IPV6_EXTHDR_GET_FH_ID(p); dt->af = AF_INET6; } dt->proto = IP_GET_IPPROTO(p); dt->vlan_id[0] = p->vlan_id[0]; dt->vlan_id[1] = p->vlan_id[1]; dt->policy = DefragGetOsPolicy(p); dt->host_timeout = DefragPolicyGetHostTimeout(p); dt->remove = 0; dt->seen_last = 0; TAILQ_INIT(&dt->frags); (void) DefragTrackerIncrUsecnt(dt); } void DefragTrackerRelease(DefragTracker *t) { (void) DefragTrackerDecrUsecnt(t); SCMutexUnlock(&t->lock); } void DefragTrackerClearMemory(DefragTracker *dt) { DefragTrackerFreeFrags(dt); SC_ATOMIC_DESTROY(dt->use_cnt); } #define DEFRAG_DEFAULT_HASHSIZE 4096 #define DEFRAG_DEFAULT_MEMCAP 16777216 #define DEFRAG_DEFAULT_PREALLOC 1000 /** \brief initialize the configuration * \warning Not thread safe */ void DefragInitConfig(char quiet) { SCLogDebug("initializing defrag engine..."); memset(&defrag_config, 0, sizeof(defrag_config)); //SC_ATOMIC_INIT(flow_flags); SC_ATOMIC_INIT(defragtracker_counter); SC_ATOMIC_INIT(defrag_memuse); SC_ATOMIC_INIT(defragtracker_prune_idx); DefragTrackerQueueInit(&defragtracker_spare_q); #ifndef AFLFUZZ_NO_RANDOM unsigned int seed = RandomTimePreseed(); /* set defaults */ defrag_config.hash_rand = (int)(DEFRAG_DEFAULT_HASHSIZE * (rand_r(&seed) / RAND_MAX + 1.0)); #endif defrag_config.hash_size = DEFRAG_DEFAULT_HASHSIZE; defrag_config.memcap = DEFRAG_DEFAULT_MEMCAP; defrag_config.prealloc = DEFRAG_DEFAULT_PREALLOC; /* Check if we have memcap and hash_size defined at config */ char *conf_val; uint32_t configval = 0; /** set config values for memcap, prealloc and hash_size */ if ((ConfGet("defrag.memcap", &conf_val)) == 1) { if (ParseSizeStringU64(conf_val, &defrag_config.memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing defrag.memcap " "from conf file - %s. Killing engine", conf_val); exit(EXIT_FAILURE); } } if ((ConfGet("defrag.hash-size", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { defrag_config.hash_size = configval; } else { WarnInvalidConfEntry("defrag.hash-size", "%"PRIu32, defrag_config.hash_size); } } if ((ConfGet("defrag.trackers", &conf_val)) == 1) { if (ByteExtractStringUint32(&configval, 10, strlen(conf_val), conf_val) > 0) { defrag_config.prealloc = configval; } else { WarnInvalidConfEntry("defrag.trackers", "%"PRIu32, defrag_config.prealloc); } } SCLogDebug("DefragTracker config from suricata.yaml: memcap: %"PRIu64", hash-size: " "%"PRIu32", prealloc: %"PRIu32, defrag_config.memcap, defrag_config.hash_size, defrag_config.prealloc); /* alloc hash memory */ uint64_t hash_size = defrag_config.hash_size * sizeof(DefragTrackerHashRow); if (!(DEFRAG_CHECK_MEMCAP(hash_size))) { SCLogError(SC_ERR_DEFRAG_INIT, "allocating defrag hash failed: " "max defrag memcap is smaller than projected hash size. " "Memcap: %"PRIu64", Hash table size %"PRIu64". Calculate " "total hash size by multiplying \"defrag.hash-size\" with %"PRIuMAX", " "which is the hash bucket size.", defrag_config.memcap, hash_size, (uintmax_t)sizeof(DefragTrackerHashRow)); exit(EXIT_FAILURE); } defragtracker_hash = SCCalloc(defrag_config.hash_size, sizeof(DefragTrackerHashRow)); if (unlikely(defragtracker_hash == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in DefragTrackerInitConfig. Exiting..."); exit(EXIT_FAILURE); } memset(defragtracker_hash, 0, defrag_config.hash_size * sizeof(DefragTrackerHashRow)); uint32_t i = 0; for (i = 0; i < defrag_config.hash_size; i++) { DRLOCK_INIT(&defragtracker_hash[i]); } (void) SC_ATOMIC_ADD(defrag_memuse, (defrag_config.hash_size * sizeof(DefragTrackerHashRow))); if (quiet == FALSE) { SCLogConfig("allocated %llu bytes of memory for the defrag hash... " "%" PRIu32 " buckets of size %" PRIuMAX "", SC_ATOMIC_GET(defrag_memuse), defrag_config.hash_size, (uintmax_t)sizeof(DefragTrackerHashRow)); } if ((ConfGet("defrag.prealloc", &conf_val)) == 1) { if (ConfValIsTrue(conf_val)) { /* pre allocate defrag trackers */ for (i = 0; i < defrag_config.prealloc; i++) { if (!(DEFRAG_CHECK_MEMCAP(sizeof(DefragTracker)))) { SCLogError(SC_ERR_DEFRAG_INIT, "preallocating defrag trackers failed: " "max defrag memcap reached. Memcap %"PRIu64", " "Memuse %"PRIu64".", defrag_config.memcap, ((uint64_t)SC_ATOMIC_GET(defrag_memuse) + (uint64_t)sizeof(DefragTracker))); exit(EXIT_FAILURE); } DefragTracker *h = DefragTrackerAlloc(); if (h == NULL) { SCLogError(SC_ERR_DEFRAG_INIT, "preallocating defrag failed: %s", strerror(errno)); exit(EXIT_FAILURE); } DefragTrackerEnqueue(&defragtracker_spare_q,h); } if (quiet == FALSE) { SCLogConfig("preallocated %" PRIu32 " defrag trackers of size %" PRIuMAX "", defragtracker_spare_q.len, (uintmax_t)sizeof(DefragTracker)); } } } if (quiet == FALSE) { SCLogConfig("defrag memory usage: %llu bytes, maximum: %"PRIu64, SC_ATOMIC_GET(defrag_memuse), defrag_config.memcap); } return; } /** \brief print some defrag stats * \warning Not thread safe */ static void DefragTrackerPrintStats (void) { } /** \brief shutdown the flow engine * \warning Not thread safe */ void DefragHashShutdown(void) { DefragTracker *dt; uint32_t u; DefragTrackerPrintStats(); /* free spare queue */ while((dt = DefragTrackerDequeue(&defragtracker_spare_q))) { BUG_ON(SC_ATOMIC_GET(dt->use_cnt) > 0); DefragTrackerFree(dt); } /* clear and free the hash */ if (defragtracker_hash != NULL) { for (u = 0; u < defrag_config.hash_size; u++) { dt = defragtracker_hash[u].head; while (dt) { DefragTracker *n = dt->hnext; DefragTrackerClearMemory(dt); DefragTrackerFree(dt); dt = n; } DRLOCK_DESTROY(&defragtracker_hash[u]); } SCFree(defragtracker_hash); defragtracker_hash = NULL; } (void) SC_ATOMIC_SUB(defrag_memuse, defrag_config.hash_size * sizeof(DefragTrackerHashRow)); DefragTrackerQueueDestroy(&defragtracker_spare_q); SC_ATOMIC_DESTROY(defragtracker_prune_idx); SC_ATOMIC_DESTROY(defrag_memuse); SC_ATOMIC_DESTROY(defragtracker_counter); //SC_ATOMIC_DESTROY(flow_flags); return; } /** \brief compare two raw ipv6 addrs * * \note we don't care about the real ipv6 ip's, this is just * to consistently fill the DefragHashKey6 struct, without all * the ntohl calls. * * \warning do not use elsewhere unless you know what you're doing. * detect-engine-address-ipv6.c's AddressIPv6GtU32 is likely * what you are looking for. */ static inline int DefragHashRawAddressIPv6GtU32(uint32_t *a, uint32_t *b) { int i; for (i = 0; i < 4; i++) { if (a[i] > b[i]) return 1; if (a[i] < b[i]) break; } return 0; } typedef struct DefragHashKey4_ { union { struct { uint32_t src, dst; uint32_t id; uint16_t vlan_id[2]; }; uint32_t u32[4]; }; } DefragHashKey4; typedef struct DefragHashKey6_ { union { struct { uint32_t src[4], dst[4]; uint32_t id; uint16_t vlan_id[2]; }; uint32_t u32[10]; }; } DefragHashKey6; /* calculate the hash key for this packet * * we're using: * hash_rand -- set at init time * source address * destination address * id * vlan_id */ static inline uint32_t DefragHashGetKey(Packet *p) { uint32_t key; if (p->ip4h != NULL) { DefragHashKey4 dhk; if (p->src.addr_data32[0] > p->dst.addr_data32[0]) { dhk.src = p->src.addr_data32[0]; dhk.dst = p->dst.addr_data32[0]; } else { dhk.src = p->dst.addr_data32[0]; dhk.dst = p->src.addr_data32[0]; } dhk.id = (uint32_t)IPV4_GET_IPID(p); dhk.vlan_id[0] = p->vlan_id[0]; dhk.vlan_id[1] = p->vlan_id[1]; uint32_t hash = hashword(dhk.u32, 4, defrag_config.hash_rand); key = hash % defrag_config.hash_size; } else if (p->ip6h != NULL) { DefragHashKey6 dhk; if (DefragHashRawAddressIPv6GtU32(p->src.addr_data32, p->dst.addr_data32)) { dhk.src[0] = p->src.addr_data32[0]; dhk.src[1] = p->src.addr_data32[1]; dhk.src[2] = p->src.addr_data32[2]; dhk.src[3] = p->src.addr_data32[3]; dhk.dst[0] = p->dst.addr_data32[0]; dhk.dst[1] = p->dst.addr_data32[1]; dhk.dst[2] = p->dst.addr_data32[2]; dhk.dst[3] = p->dst.addr_data32[3]; } else { dhk.src[0] = p->dst.addr_data32[0]; dhk.src[1] = p->dst.addr_data32[1]; dhk.src[2] = p->dst.addr_data32[2]; dhk.src[3] = p->dst.addr_data32[3]; dhk.dst[0] = p->src.addr_data32[0]; dhk.dst[1] = p->src.addr_data32[1]; dhk.dst[2] = p->src.addr_data32[2]; dhk.dst[3] = p->src.addr_data32[3]; } dhk.id = IPV6_EXTHDR_GET_FH_ID(p); dhk.vlan_id[0] = p->vlan_id[0]; dhk.vlan_id[1] = p->vlan_id[1]; uint32_t hash = hashword(dhk.u32, 10, defrag_config.hash_rand); key = hash % defrag_config.hash_size; } else key = 0; return key; } /* Since two or more trackers can have the same hash key, we need to compare * the tracker with the current tracker key. */ #define CMP_DEFRAGTRACKER(d1,d2,id) \ (((CMP_ADDR(&(d1)->src_addr, &(d2)->src) && \ CMP_ADDR(&(d1)->dst_addr, &(d2)->dst)) || \ (CMP_ADDR(&(d1)->src_addr, &(d2)->dst) && \ CMP_ADDR(&(d1)->dst_addr, &(d2)->src))) && \ (d1)->proto == IP_GET_IPPROTO(p) && \ (d1)->id == (id) && \ (d1)->vlan_id[0] == (d2)->vlan_id[0] && \ (d1)->vlan_id[1] == (d2)->vlan_id[1]) static inline int DefragTrackerCompare(DefragTracker *t, Packet *p) { uint32_t id; if (PKT_IS_IPV4(p)) { id = (uint32_t)IPV4_GET_IPID(p); } else { id = IPV6_EXTHDR_GET_FH_ID(p); } return CMP_DEFRAGTRACKER(t, p, id); } /** * \brief Get a new defrag tracker * * Get a new defrag tracker. We're checking memcap first and will try to make room * if the memcap is reached. * * \retval dt *LOCKED* tracker on succes, NULL on error. */ static DefragTracker *DefragTrackerGetNew(Packet *p) { DefragTracker *dt = NULL; /* get a tracker from the spare queue */ dt = DefragTrackerDequeue(&defragtracker_spare_q); if (dt == NULL) { /* If we reached the max memcap, we get a used tracker */ if (!(DEFRAG_CHECK_MEMCAP(sizeof(DefragTracker)))) { /* declare state of emergency */ //if (!(SC_ATOMIC_GET(defragtracker_flags) & DEFRAG_EMERGENCY)) { // SC_ATOMIC_OR(defragtracker_flags, DEFRAG_EMERGENCY); /* under high load, waking up the flow mgr each time leads * to high cpu usage. Flows are not timed out much faster if * we check a 1000 times a second. */ // FlowWakeupFlowManagerThread(); //} dt = DefragTrackerGetUsedDefragTracker(); if (dt == NULL) { return NULL; } /* freed a tracker, but it's unlocked */ } else { /* now see if we can alloc a new tracker */ dt = DefragTrackerAlloc(); if (dt == NULL) { return NULL; } /* tracker is initialized but *unlocked* */ } } else { /* tracker has been recycled before it went into the spare queue */ /* tracker is initialized (recylced) but *unlocked* */ } (void) SC_ATOMIC_ADD(defragtracker_counter, 1); SCMutexLock(&dt->lock); return dt; } /* DefragGetTrackerFromHash * * Hash retrieval function for trackers. Looks up the hash bucket containing the * tracker pointer. Then compares the packet with the found tracker to see if it is * the tracker we need. If it isn't, walk the list until the right tracker is found. * * returns a *LOCKED* tracker or NULL */ DefragTracker *DefragGetTrackerFromHash (Packet *p) { DefragTracker *dt = NULL; /* get the key to our bucket */ uint32_t key = DefragHashGetKey(p); /* get our hash bucket and lock it */ DefragTrackerHashRow *hb = &defragtracker_hash[key]; DRLOCK_LOCK(hb); /* see if the bucket already has a tracker */ if (hb->head == NULL) { dt = DefragTrackerGetNew(p); if (dt == NULL) { DRLOCK_UNLOCK(hb); return NULL; } /* tracker is locked */ hb->head = dt; hb->tail = dt; /* got one, now lock, initialize and return */ DefragTrackerInit(dt,p); DRLOCK_UNLOCK(hb); return dt; } /* ok, we have a tracker in the bucket. Let's find out if it is our tracker */ dt = hb->head; /* see if this is the tracker we are looking for */ if (dt->remove || DefragTrackerCompare(dt, p) == 0) { DefragTracker *pdt = NULL; /* previous tracker */ while (dt) { pdt = dt; dt = dt->hnext; if (dt == NULL) { dt = pdt->hnext = DefragTrackerGetNew(p); if (dt == NULL) { DRLOCK_UNLOCK(hb); return NULL; } hb->tail = dt; /* tracker is locked */ dt->hprev = pdt; /* initialize and return */ DefragTrackerInit(dt,p); DRLOCK_UNLOCK(hb); return dt; } if (DefragTrackerCompare(dt, p) != 0) { /* we found our tracker, lets put it on top of the * hash list -- this rewards active trackers */ if (dt->hnext) { dt->hnext->hprev = dt->hprev; } if (dt->hprev) { dt->hprev->hnext = dt->hnext; } if (dt == hb->tail) { hb->tail = dt->hprev; } dt->hnext = hb->head; dt->hprev = NULL; hb->head->hprev = dt; hb->head = dt; /* found our tracker, lock & return */ SCMutexLock(&dt->lock); (void) DefragTrackerIncrUsecnt(dt); DRLOCK_UNLOCK(hb); return dt; } } } /* lock & return */ SCMutexLock(&dt->lock); (void) DefragTrackerIncrUsecnt(dt); DRLOCK_UNLOCK(hb); return dt; } /** \brief look up a tracker in the hash * * \param a address to look up * * \retval h *LOCKED* tracker or NULL */ DefragTracker *DefragLookupTrackerFromHash (Packet *p) { DefragTracker *dt = NULL; /* get the key to our bucket */ uint32_t key = DefragHashGetKey(p); /* get our hash bucket and lock it */ DefragTrackerHashRow *hb = &defragtracker_hash[key]; DRLOCK_LOCK(hb); /* see if the bucket already has a tracker */ if (hb->head == NULL) { DRLOCK_UNLOCK(hb); return dt; } /* ok, we have a tracker in the bucket. Let's find out if it is our tracker */ dt = hb->head; /* see if this is the tracker we are looking for */ if (DefragTrackerCompare(dt, p) == 0) { while (dt) { dt = dt->hnext; if (dt == NULL) { DRLOCK_UNLOCK(hb); return dt; } if (DefragTrackerCompare(dt, p) != 0) { /* we found our tracker, lets put it on top of the * hash list -- this rewards active tracker */ if (dt->hnext) { dt->hnext->hprev = dt->hprev; } if (dt->hprev) { dt->hprev->hnext = dt->hnext; } if (dt == hb->tail) { hb->tail = dt->hprev; } dt->hnext = hb->head; dt->hprev = NULL; hb->head->hprev = dt; hb->head = dt; /* found our tracker, lock & return */ SCMutexLock(&dt->lock); (void) DefragTrackerIncrUsecnt(dt); DRLOCK_UNLOCK(hb); return dt; } } } /* lock & return */ SCMutexLock(&dt->lock); (void) DefragTrackerIncrUsecnt(dt); DRLOCK_UNLOCK(hb); return dt; } /** \internal * \brief Get a tracker from the hash directly. * * Called in conditions where the spare queue is empty and memcap is reached. * * Walks the hash until a tracker can be freed. "defragtracker_prune_idx" atomic int makes * sure we don't start at the top each time since that would clear the top of * the hash leading to longer and longer search times under high pressure (observed). * * \retval dt tracker or NULL */ static DefragTracker *DefragTrackerGetUsedDefragTracker(void) { uint32_t idx = SC_ATOMIC_GET(defragtracker_prune_idx) % defrag_config.hash_size; uint32_t cnt = defrag_config.hash_size; while (cnt--) { if (++idx >= defrag_config.hash_size) idx = 0; DefragTrackerHashRow *hb = &defragtracker_hash[idx]; if (DRLOCK_TRYLOCK(hb) != 0) continue; DefragTracker *dt = hb->tail; if (dt == NULL) { DRLOCK_UNLOCK(hb); continue; } if (SCMutexTrylock(&dt->lock) != 0) { DRLOCK_UNLOCK(hb); continue; } /** never prune a tracker that is used by a packets * we are currently processing in one of the threads */ if (SC_ATOMIC_GET(dt->use_cnt) > 0) { DRLOCK_UNLOCK(hb); SCMutexUnlock(&dt->lock); continue; } /* remove from the hash */ if (dt->hprev != NULL) dt->hprev->hnext = dt->hnext; if (dt->hnext != NULL) dt->hnext->hprev = dt->hprev; if (hb->head == dt) hb->head = dt->hnext; if (hb->tail == dt) hb->tail = dt->hprev; dt->hnext = NULL; dt->hprev = NULL; DRLOCK_UNLOCK(hb); DefragTrackerClearMemory(dt); SCMutexUnlock(&dt->lock); (void) SC_ATOMIC_ADD(defragtracker_prune_idx, (defrag_config.hash_size - cnt)); return dt; } return NULL; } suricata-3.2.1/src/detect-byte-extract.h0000644000000000000000000000454113051004444015037 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_BYTEEXTRACT_H__ #define __DETECT_BYTEEXTRACT_H__ /* flags */ #define DETECT_BYTE_EXTRACT_FLAG_RELATIVE 0x01 #define DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER 0x02 #define DETECT_BYTE_EXTRACT_FLAG_STRING 0x04 #define DETECT_BYTE_EXTRACT_FLAG_ALIGN 0x08 #define DETECT_BYTE_EXTRACT_FLAG_ENDIAN 0x10 /* endian value to be used. Would be stored in DetectByteParseData->endian */ #define DETECT_BYTE_EXTRACT_ENDIAN_NONE 0 #define DETECT_BYTE_EXTRACT_ENDIAN_BIG 1 #define DETECT_BYTE_EXTRACT_ENDIAN_LITTLE 2 #define DETECT_BYTE_EXTRACT_ENDIAN_DCE 3 /** * \brief Holds data related to byte_extract keyword. */ typedef struct DetectByteExtractData_ { /* local id used by other keywords in the sig to reference this */ uint8_t local_id; uint8_t nbytes; int16_t pad; int32_t offset; const char *name; uint8_t flags; uint8_t endian; uint8_t base; uint8_t align_value; uint16_t multiplier_value; /* unique id used to reference this byte_extract keyword */ uint16_t id; } DetectByteExtractData; void DetectByteExtractRegister(void); int DetectByteExtractSetup(DetectEngineCtx *, Signature *, char *); void DetectByteExtractFree(void *); int DetectByteExtractMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); SigMatch *DetectByteExtractRetrieveSMVar(const char *, Signature *); int DetectByteExtractDoMatch(DetectEngineThreadCtx *, SigMatch *, Signature *, uint8_t *, uint16_t, uint64_t *, uint8_t); #endif /* __DETECT_BYTEEXTRACT_H__ */ suricata-3.2.1/src/detect-engine-alert.h0000644000000000000000000000241513051004444014774 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_ALERT_H__ #define __DETECT_ENGINE_ALERT_H__ #include "suricata-common.h" #include "decode.h" #include "detect.h" void PacketAlertFinalize(DetectEngineCtx *, DetectEngineThreadCtx *, Packet *); int PacketAlertAppend(DetectEngineThreadCtx *, Signature *, Packet *, uint64_t tx_id, uint8_t); int PacketAlertCheck(Packet *, uint32_t); int PacketAlertRemove(Packet *, uint16_t); void PacketAlertTagInit(void); PacketAlert *PacketAlertGetTag(void); #endif /* __DETECT_ENGINE_ALERT_H__ */ suricata-3.2.1/src/util-lua-dns.c0000644000000000000000000002345513051004444013474 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-dns-common.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" static int DnsGetDnsRrname(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &tx->query_list, next) { char *c; size_t input_len; c = BytesToString((uint8_t *)((uint8_t *)query + sizeof(DNSQueryEntry)), query->len); if (c != NULL) { int ret; input_len = strlen(c); /* sanity check */ if (input_len > (size_t)(2 * query->len)) { SCFree(c); return LuaCallbackError(luastate, "invalid length"); } ret = LuaPushStringBuffer(luastate, (uint8_t *)c, input_len); SCFree(c); return ret; } } return LuaCallbackError(luastate, "no query"); } static int DnsGetTxid(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); lua_pushinteger(luastate, tx->tx_id); return 1; } static int DnsGetRcode(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); if (tx->rcode) { char rcode[16] = ""; DNSCreateRcodeString(tx->rcode, rcode, sizeof(rcode)); return LuaPushStringBuffer(luastate, (const uint8_t *)rcode, strlen(rcode)); } else { return 0; } } static int DnsGetRecursionDesired(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); lua_pushboolean(luastate, tx->recursion_desired); return 1; } static int DnsGetQueryTable(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); uint32_t u = 0; lua_newtable(luastate); DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &tx->query_list, next) { lua_pushinteger(luastate, u++); lua_newtable(luastate); char record[16] = ""; DNSCreateTypeString(query->type, record, sizeof(record)); lua_pushstring(luastate, "type"); lua_pushstring(luastate, record); lua_settable(luastate, -3); { char *c; size_t input_len; c = BytesToString((uint8_t *)((uint8_t *)query + sizeof(DNSQueryEntry)), query->len); if (c != NULL) { input_len = strlen(c); /* sanity check */ if (input_len > (size_t)(2 * query->len)) { SCFree(c); return LuaCallbackError(luastate, "invalid length"); } lua_pushstring(luastate, "rrname"); LuaPushStringBuffer(luastate, (uint8_t *)c, input_len); lua_settable(luastate, -3); SCFree(c); } } lua_settable(luastate, -3); } return 1; } static int DnsGetAnswerTable(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); uint32_t u = 0; lua_newtable(luastate); DNSAnswerEntry *answer = NULL; TAILQ_FOREACH(answer, &tx->answer_list, next) { lua_pushinteger(luastate, u++); lua_newtable(luastate); char record[16] = ""; DNSCreateTypeString(answer->type, record, sizeof(record)); lua_pushstring(luastate, "type"); lua_pushstring(luastate, record); lua_settable(luastate, -3); lua_pushstring(luastate, "ttl"); lua_pushinteger(luastate, answer->ttl); lua_settable(luastate, -3); { uint8_t *ptr = (uint8_t *)((uint8_t *)answer + sizeof(DNSAnswerEntry)); lua_pushstring(luastate, "rrname"); LuaPushStringBuffer(luastate, ptr, answer->fqdn_len); lua_settable(luastate, -3); ptr = (uint8_t *)((uint8_t *)answer + sizeof(DNSAnswerEntry) + answer->fqdn_len); if (answer->type == DNS_RECORD_TYPE_A) { char a[16] = ""; if (answer->data_len == 4) { PrintInet(AF_INET, (const void *)ptr, a, sizeof(a)); } lua_pushstring(luastate, "addr"); LuaPushStringBuffer(luastate, (uint8_t *)a, strlen(a)); lua_settable(luastate, -3); } else if (answer->type == DNS_RECORD_TYPE_AAAA) { char a[46] = ""; if (answer->data_len == 16) { PrintInet(AF_INET6, (const void *)ptr, a, sizeof(a)); } lua_pushstring(luastate, "addr"); LuaPushStringBuffer(luastate, (uint8_t *)a, strlen(a)); lua_settable(luastate, -3); } else if (answer->data_len == 0) { /* not setting 'addr' */ } else { lua_pushstring(luastate, "addr"); LuaPushStringBuffer(luastate, (uint8_t *)ptr, answer->data_len); lua_settable(luastate, -3); } } lua_settable(luastate, -3); } return 1; } static int DnsGetAuthorityTable(lua_State *luastate) { if (!(LuaStateNeedProto(luastate, ALPROTO_DNS))) return LuaCallbackError(luastate, "error: protocol not dns"); DNSTransaction *tx = LuaStateGetTX(luastate); if (tx == NULL) return LuaCallbackError(luastate, "internal error: no tx"); uint32_t u = 0; lua_newtable(luastate); DNSAnswerEntry *answer = NULL; TAILQ_FOREACH(answer, &tx->authority_list, next) { lua_pushinteger(luastate, u++); lua_newtable(luastate); char record[16] = ""; DNSCreateTypeString(answer->type, record, sizeof(record)); lua_pushstring(luastate, "type"); lua_pushstring(luastate, record); lua_settable(luastate, -3); lua_pushstring(luastate, "ttl"); lua_pushinteger(luastate, answer->ttl); lua_settable(luastate, -3); { char *c; size_t input_len; c = BytesToString((uint8_t *)((uint8_t *)answer + sizeof(DNSAnswerEntry)), answer->fqdn_len); if (c != NULL) { input_len = strlen(c); /* sanity check */ if (input_len > (size_t)(2 * answer->fqdn_len)) { SCFree(c); return LuaCallbackError(luastate, "invalid length"); } lua_pushstring(luastate, "rrname"); LuaPushStringBuffer(luastate, (uint8_t *)c, input_len); lua_settable(luastate, -3); SCFree(c); } } lua_settable(luastate, -3); } return 1; } /** \brief register http lua extensions in a luastate */ int LuaRegisterDnsFunctions(lua_State *luastate) { /* registration of the callbacks */ lua_pushcfunction(luastate, DnsGetDnsRrname); lua_setglobal(luastate, "DnsGetDnsRrname"); lua_pushcfunction(luastate, DnsGetQueryTable); lua_setglobal(luastate, "DnsGetQueries"); lua_pushcfunction(luastate, DnsGetAnswerTable); lua_setglobal(luastate, "DnsGetAnswers"); lua_pushcfunction(luastate, DnsGetAuthorityTable); lua_setglobal(luastate, "DnsGetAuthorities"); lua_pushcfunction(luastate, DnsGetTxid); lua_setglobal(luastate, "DnsGetTxid"); lua_pushcfunction(luastate, DnsGetRcode); lua_setglobal(luastate, "DnsGetRcode"); lua_pushcfunction(luastate, DnsGetRecursionDesired); lua_setglobal(luastate, "DnsGetRecursionDesired"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/stream-tcp-private.h0000644000000000000000000002412413051004444014704 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __STREAM_TCP_PRIVATE_H__ #define __STREAM_TCP_PRIVATE_H__ #include "decode.h" #include "util-pool.h" #include "util-pool-thread.h" #define STREAMTCP_QUEUE_FLAG_TS 0x01 #define STREAMTCP_QUEUE_FLAG_WS 0x02 #define STREAMTCP_QUEUE_FLAG_SACK 0x04 /** currently only SYN/ACK */ typedef struct TcpStateQueue_ { uint8_t flags; uint8_t wscale; uint16_t win; uint32_t seq; uint32_t ack; uint32_t ts; uint32_t pkt_ts; struct TcpStateQueue_ *next; } TcpStateQueue; typedef struct StreamTcpSackRecord_ { uint32_t le; /**< left edge, host order */ uint32_t re; /**< right edge, host order */ struct StreamTcpSackRecord_ *next; } StreamTcpSackRecord; typedef struct TcpSegment_ { uint8_t *payload; uint16_t payload_len; /**< actual size of the payload */ uint16_t pool_size; /**< size of the memory */ uint32_t seq; struct TcpSegment_ *next; struct TcpSegment_ *prev; /* coccinelle: TcpSegment:flags:SEGMENTTCP_FLAG */ uint8_t flags; } TcpSegment; typedef struct TcpStream_ { uint16_t flags:12; /**< Flag specific to the stream e.g. Timestamp */ /* coccinelle: TcpStream:flags:STREAMTCP_STREAM_FLAG_ */ uint16_t wscale:4; /**< wscale setting in this direction, 4 bits as max val is 15 */ uint8_t os_policy; /**< target based OS policy used for reassembly and handling packets*/ uint8_t tcp_flags; /**< TCP flags seen */ uint32_t isn; /**< initial sequence number */ uint32_t next_seq; /**< next expected sequence number */ uint32_t last_ack; /**< last ack'd sequence number in this stream */ uint32_t next_win; /**< next max seq within window */ uint32_t window; /**< current window setting, after wscale is applied */ uint32_t last_ts; /**< Time stamp (TSVAL) of the last seen packet for this stream*/ uint32_t last_pkt_ts; /**< Time of last seen packet for this stream (needed for PAWS update) This will be used to validate the last_ts, when connection has been idle for longer time.(RFC 1323)*/ /* reassembly */ uint32_t ra_app_base_seq; /**< reassembled seq. We've reassembled up to this point. */ uint32_t ra_raw_base_seq; /**< reassembled seq. We've reassembled up to this point. */ TcpSegment *seg_list; /**< list of TCP segments that are not yet (fully) used in reassembly */ TcpSegment *seg_list_tail; /**< Last segment in the reassembled stream seg list*/ StreamTcpSackRecord *sack_head; /**< head of list of SACK records */ StreamTcpSackRecord *sack_tail; /**< tail of list of SACK records */ } TcpStream; /* from /usr/include/netinet/tcp.h */ enum { TCP_NONE, TCP_LISTEN, TCP_SYN_SENT, TCP_SYN_RECV, TCP_ESTABLISHED, TCP_FIN_WAIT1, TCP_FIN_WAIT2, TCP_TIME_WAIT, TCP_LAST_ACK, TCP_CLOSE_WAIT, TCP_CLOSING, TCP_CLOSED, }; /* * Per SESSION flags */ /** Flag for mid stream session */ #define STREAMTCP_FLAG_MIDSTREAM 0x0001 /** Flag for mid stream established session */ #define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED 0x0002 /** Flag for mid session when syn/ack is received */ #define STREAMTCP_FLAG_MIDSTREAM_SYNACK 0x0004 /** Flag for TCP Timestamp option */ #define STREAMTCP_FLAG_TIMESTAMP 0x0008 /** Server supports wscale (even though it can be 0) */ #define STREAMTCP_FLAG_SERVER_WSCALE 0x0010 /** 'Raw' reassembly is disabled for this ssn. */ #define STREAMTCP_FLAG_DISABLE_RAW 0x0020 /** Flag to indicate that the session is handling asynchronous stream.*/ #define STREAMTCP_FLAG_ASYNC 0x0040 /** Flag to indicate we're dealing with 4WHS: SYN, SYN, SYN/ACK, ACK * (http://www.breakingpointsystems.com/community/blog/tcp-portals-the-three-way-handshake-is-a-lie) */ #define STREAMTCP_FLAG_4WHS 0x0080 /** Flag to indicate that this session is possible trying to evade the detection * (http://www.packetstan.com/2010/06/recently-ive-been-on-campaign-to-make.html) */ #define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT 0x0100 /** Flag to indicate the client (SYN pkt) permits SACK */ #define STREAMTCP_FLAG_CLIENT_SACKOK 0x0200 /** Flag to indicate both sides of the session permit SACK (SYN + SYN/ACK) */ #define STREAMTCP_FLAG_SACKOK 0x0400 /** Flag for triggering RAW reassembly before the size limit is reached or the stream reaches EOF. */ #define STREAMTCP_FLAG_TRIGGER_RAW_REASSEMBLY 0x0800 /** 3WHS confirmed by server -- if suri sees 3whs ACK but server doesn't (pkt * is lost on the way to server), SYN/ACK is retransmitted. If server sends * normal packet we assume 3whs to be completed. Only used for SYN/ACK resend * event. */ #define STREAMTCP_FLAG_3WHS_CONFIRMED 0x1000 /** App Layer tracking/reassembly is disabled */ #define STREAMTCP_FLAG_APP_LAYER_DISABLED 0x2000 /* * Per STREAM flags */ /** stream is in a gap state */ #define STREAMTCP_STREAM_FLAG_GAP 0x0001 /** Flag to avoid stream reassembly/app layer inspection for the stream */ #define STREAMTCP_STREAM_FLAG_NOREASSEMBLY 0x0002 /** we received a keep alive */ #define STREAMTCP_STREAM_FLAG_KEEPALIVE 0x0004 /** Stream has reached it's reassembly depth, all further packets are ignored */ #define STREAMTCP_STREAM_FLAG_DEPTH_REACHED 0x0008 // vacancy /** Stream supports TIMESTAMP -- used to set ssn STREAMTCP_FLAG_TIMESTAMP * flag. */ #define STREAMTCP_STREAM_FLAG_TIMESTAMP 0x0020 /** Flag to indicate the zero value of timestamp */ #define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP 0x0040 /** App proto detection completed */ #define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED 0x0080 /** App proto detection skipped */ #define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED 0x0100 /** Raw reassembly disabled for new segments */ #define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED 0x0200 // vacancy 2x /** NOTE: flags field is 12 bits */ /* * Per SEGMENT flags */ /** Flag to indicate that the current segment has been processed by the * reassembly code and should be deleted after app layer protocol has been * detected. */ #define SEGMENTTCP_FLAG_RAW_PROCESSED 0x01 /** App Layer reassembly code is done with this segment */ #define SEGMENTTCP_FLAG_APPLAYER_PROCESSED 0x02 /** Log API (streaming) has processed this segment */ #define SEGMENTTCP_FLAG_LOGAPI_PROCESSED 0x04 #define PAWS_24DAYS 2073600 /**< 24 days in seconds */ #define PKT_IS_IN_RIGHT_DIR(ssn, p) ((ssn)->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK ? \ PKT_IS_TOSERVER(p) ? (p)->flowflags &= ~FLOW_PKT_TOSERVER \ (p)->flowflags |= FLOW_PKT_TOCLIENT : (p)->flowflags &= ~FLOW_PKT_TOCLIENT \ (p)->flowflags |= FLOW_PKT_TOSERVER : 0) /* Macro's for comparing Sequence numbers * Page 810 from TCP/IP Illustrated, Volume 2. */ #define SEQ_EQ(a,b) ((int32_t)((a) - (b)) == 0) #define SEQ_LT(a,b) ((int32_t)((a) - (b)) < 0) #define SEQ_LEQ(a,b) ((int32_t)((a) - (b)) <= 0) #define SEQ_GT(a,b) ((int32_t)((a) - (b)) > 0) #define SEQ_GEQ(a,b) ((int32_t)((a) - (b)) >= 0) #define STREAMTCP_SET_RA_BASE_SEQ(stream, seq) { \ do { \ (stream)->ra_raw_base_seq = (seq); \ (stream)->ra_app_base_seq = (seq); \ } while(0); \ } #define StreamTcpSetEvent(p, e) { \ SCLogDebug("setting event %"PRIu8" on pkt %p (%"PRIu64")", (e), p, (p)->pcap_cnt); \ ENGINE_SET_EVENT((p), (e)); \ } typedef struct TcpSession_ { PoolThreadReserved res; uint8_t state; uint8_t queue_len; /**< length of queue list below */ int8_t data_first_seen_dir; /** track all the tcp flags we've seen */ uint8_t tcp_packet_flags; /* coccinelle: TcpSession:flags:STREAMTCP_FLAG */ uint16_t flags; uint32_t reassembly_depth; /**< reassembly depth for the stream */ TcpStream server; TcpStream client; struct StreamMsg_ *toserver_smsg_head; /**< list of stream msgs (for detection inspection) */ struct StreamMsg_ *toserver_smsg_tail; /**< list of stream msgs (for detection inspection) */ struct StreamMsg_ *toclient_smsg_head; /**< list of stream msgs (for detection inspection) */ struct StreamMsg_ *toclient_smsg_tail; /**< list of stream msgs (for detection inspection) */ TcpStateQueue *queue; /**< list of SYN/ACK candidates */ } TcpSession; #define StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream) \ ((stream)->flags |= STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED) #define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream) \ ((stream)->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED) #define StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream) \ ((stream)->flags &= ~STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED); #define StreamTcpDisableAppLayerReassembly(ssn) do { \ SCLogDebug("setting STREAMTCP_FLAG_APP_LAYER_DISABLED on ssn %p", ssn); \ ((ssn)->flags |= STREAMTCP_FLAG_APP_LAYER_DISABLED); \ } while (0); #endif /* __STREAM_TCP_PRIVATE_H__ */ suricata-3.2.1/src/output-stats.c0000644000000000000000000001466713051004444013657 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Stats Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output-stats.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputStatsLogger_ { StatsLogger LogFunc; OutputCtx *output_ctx; struct OutputStatsLogger_ *next; const char *name; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; } OutputStatsLogger; static OutputStatsLogger *list = NULL; int OutputRegisterStatsLogger(const char *name, StatsLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputStatsLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->output_ctx = output_ctx; op->name = name; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (list == NULL) list = op; else { OutputStatsLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterStatsLogger happy"); return 0; } TmEcode OutputStatsLog(ThreadVars *tv, void *thread_data, StatsTable *st) { BUG_ON(thread_data == NULL); BUG_ON(list == NULL); OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputStatsLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); logger = list; store = op_thread_data->store; while (logger && store) { BUG_ON(logger->LogFunc == NULL); logger->LogFunc(tv, store->thread_data, st); logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } return TM_ECODE_OK; } /** \brief thread init for the tx logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputStatsLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputStatsLogThreadInit happy (*data %p)", *data); OutputStatsLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } SCLogDebug("OutputStatsLogThreadInit happy (*data %p)", *data); return TM_ECODE_OK; } static TmEcode OutputStatsLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputStatsLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputStatsLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputStatsLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void TmModuleStatsLoggerRegister (void) { tmm_modules[TMM_STATSLOGGER].name = "__stats_logger__"; tmm_modules[TMM_STATSLOGGER].ThreadInit = OutputStatsLogThreadInit; tmm_modules[TMM_STATSLOGGER].ThreadExitPrintStats = OutputStatsLogExitPrintStats; tmm_modules[TMM_STATSLOGGER].ThreadDeinit = OutputStatsLogThreadDeinit; tmm_modules[TMM_STATSLOGGER].cap_flags = 0; } int OutputStatsLoggersRegistered(void) { if (list != NULL) return 1; return 0; } void OutputStatsShutdown(void) { OutputStatsLogger *logger = list; while (logger) { OutputStatsLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/respond-reject-libnet11.c0000644000000000000000000004656013051004444015521 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author William Metcalf * * RespondRejectLibnet11 used to send out libnet based * TCP resets and ICMP unreachables. * * \todo calculate TTL base on average from stream tracking * \todo come up with a way for users to specify icmp unreachable type * \todo Possibly default to port unreachable for UDP traffic this seems * to be the default in flexresp and iptables * \todo implement ipv6 resets * \todo implement pre-alloc resets for speed */ #include "suricata-common.h" #include "decode.h" #include "decode-ipv4.h" #include "decode-tcp.h" #include "decode-sctp.h" #include "decode-udp.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "action-globals.h" #include "respond-reject.h" #include "respond-reject-libnet11.h" #include "util-device.h" #ifdef HAVE_LIBNET11 #ifndef HAVE_LIBNET_INIT_CONST #define LIBNET_INIT_CAST (char *) #else #define LIBNET_INIT_CAST #endif /** set to true in main if we're setting caps. We need it here if we're using * reject rules as libnet 1.1 is not compatible with caps. */ extern int sc_set_caps; #include extern uint8_t host_mode; typedef struct Libnet11Packet_ { uint32_t ack, seq; uint16_t window, dsize; uint8_t ttl; uint16_t id; uint32_t flow; uint8_t class; struct libnet_in6_addr src6, dst6; uint32_t src4, dst4; uint16_t sp, dp; size_t len; } Libnet11Packet; int RejectSendLibnet11L3IPv4TCP(ThreadVars *tv, Packet *p, void *data, int dir) { Libnet11Packet lpacket; libnet_t *c; /* libnet context */ char ebuf[LIBNET_ERRBUF_SIZE]; int result; const char *devname = NULL; /* fill in struct defaults */ lpacket.ttl = 0; lpacket.id = 0; lpacket.flow = 0; lpacket.class = 0; if (IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) && (p->livedev)) { devname = p->livedev->dev; SCLogDebug("Will emit reject packet on dev %s", devname); } if ((c = libnet_init(LIBNET_RAW4, LIBNET_INIT_CAST devname, ebuf)) == NULL) { SCLogError(SC_ERR_LIBNET_INIT,"libnet_init failed: %s", ebuf); return 1; } if (p->tcph == NULL) return 1; /* save payload len */ lpacket.dsize = p->payload_len; switch (dir) { case REJECT_DIR_SRC: SCLogDebug("sending a tcp reset to src"); /* We follow http://tools.ietf.org/html/rfc793#section-3.4 : * If packet has no ACK, the seq number is 0 and the ACK is built * the normal way. If packet has a ACK, the seq of the RST packet * is equal to the ACK of incoming packet and the ACK is build * using packet sequence number and size of the data. */ if (TCP_GET_ACK(p) == 0) { lpacket.seq = 0; lpacket.ack = TCP_GET_SEQ(p) + lpacket.dsize + 1; } else { lpacket.seq = TCP_GET_ACK(p); lpacket.ack = TCP_GET_SEQ(p) + lpacket.dsize; } lpacket.sp = TCP_GET_DST_PORT(p); lpacket.dp = TCP_GET_SRC_PORT(p); lpacket.src4 = GET_IPV4_DST_ADDR_U32(p); lpacket.dst4 = GET_IPV4_SRC_ADDR_U32(p); break; case REJECT_DIR_DST: SCLogDebug("sending a tcp reset to dst"); lpacket.seq = TCP_GET_SEQ(p); lpacket.ack = TCP_GET_ACK(p); lpacket.sp = TCP_GET_SRC_PORT(p); lpacket.dp = TCP_GET_DST_PORT(p); lpacket.src4 = GET_IPV4_SRC_ADDR_U32(p); lpacket.dst4 = GET_IPV4_DST_ADDR_U32(p); break; default: SCLogError(SC_ERR_LIBNET_INVALID_DIR, "reset not src or dst returning"); return 1; } lpacket.window = TCP_GET_WINDOW(p); //lpacket.seq += lpacket.dsize; /* TODO come up with ttl calc function */ lpacket.ttl = 64; /* build the package */ if ((libnet_build_tcp( lpacket.sp, /* source port */ lpacket.dp, /* dst port */ lpacket.seq, /* seq number */ lpacket.ack, /* ack number */ TH_RST|TH_ACK, /* flags */ lpacket.window, /* window size */ 0, /* checksum */ 0, /* urgent flag */ LIBNET_TCP_H, /* header length */ NULL, /* payload */ 0, /* payload length */ c, /* libnet context */ 0)) < 0) /* libnet ptag */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_tcp %s", libnet_geterror(c)); goto cleanup; } if ((libnet_build_ipv4( LIBNET_TCP_H + LIBNET_IPV4_H, /* entire packet length */ 0, /* tos */ lpacket.id, /* ID */ 0, /* fragmentation flags and offset */ lpacket.ttl, /* TTL */ IPPROTO_TCP, /* protocol */ 0, /* checksum */ lpacket.src4, /* source address */ lpacket.dst4, /* destination address */ NULL, /* pointer to packet data (or NULL) */ 0, /* payload length */ c, /* libnet context pointer */ 0)) < 0) /* packet id */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_ipv4 %s", libnet_geterror(c)); goto cleanup; } result = libnet_write(c); if (result == -1) { SCLogError(SC_ERR_LIBNET_WRITE_FAILED,"libnet_write failed: %s", libnet_geterror(c)); goto cleanup; } cleanup: libnet_destroy (c); return 0; } int RejectSendLibnet11L3IPv4ICMP(ThreadVars *tv, Packet *p, void *data, int dir) { Libnet11Packet lpacket; libnet_t *c; /* libnet context */ char ebuf[LIBNET_ERRBUF_SIZE]; int result; const char *devname = NULL; /* fill in struct defaults */ lpacket.ttl = 0; lpacket.id = 0; lpacket.flow = 0; lpacket.class = 0; lpacket.len = (IPV4_GET_HLEN(p) + p->payload_len); if (IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) && (p->livedev)) { devname = p->livedev->dev; } if ((c = libnet_init(LIBNET_RAW4, LIBNET_INIT_CAST devname, ebuf)) == NULL) { SCLogError(SC_ERR_LIBNET_INIT,"libnet_inint failed: %s", ebuf); return 1; } switch (dir) { case REJECT_DIR_SRC: lpacket.src4 = GET_IPV4_DST_ADDR_U32(p); lpacket.dst4 = GET_IPV4_SRC_ADDR_U32(p); break; case REJECT_DIR_DST: lpacket.src4 = GET_IPV4_SRC_ADDR_U32(p); lpacket.dst4 = GET_IPV4_DST_ADDR_U32(p); break; default: SCLogError(SC_ERR_LIBNET_INVALID_DIR, "reset not src or dst returning"); return 1; } /* TODO come up with ttl calc function */ lpacket.ttl = 64; /* build the package */ if ((libnet_build_icmpv4_unreach( ICMP_DEST_UNREACH, /* type */ ICMP_HOST_ANO, /* code */ 0, /* checksum */ (uint8_t *)p->ip4h, /* payload */ lpacket.len, /* payload length */ c, /* libnet context */ 0)) < 0) /* libnet ptag */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_icmpv4_unreach %s", libnet_geterror(c)); goto cleanup; } if ((libnet_build_ipv4( LIBNET_ICMPV4_H + LIBNET_IPV4_H + lpacket.len, /* entire packet length */ 0, /* tos */ lpacket.id, /* ID */ 0, /* fragmentation flags and offset */ lpacket.ttl, /* TTL */ IPPROTO_ICMP, /* protocol */ 0, /* checksum */ lpacket.src4, /* source address */ lpacket.dst4, /* destination address */ NULL, /* pointer to packet data (or NULL) */ 0, /* payload length */ c, /* libnet context pointer */ 0)) < 0) /* packet id */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_ipv4 %s", libnet_geterror(c)); goto cleanup; } result = libnet_write(c); if (result == -1) { SCLogError(SC_ERR_LIBNET_WRITE_FAILED,"libnet_write_raw_ipv4 failed: %s", libnet_geterror(c)); goto cleanup; } cleanup: libnet_destroy (c); return 0; } int RejectSendLibnet11L3IPv6TCP(ThreadVars *tv, Packet *p, void *data, int dir) { Libnet11Packet lpacket; libnet_t *c; /* libnet context */ char ebuf[LIBNET_ERRBUF_SIZE]; int result; const char *devname = NULL; /* fill in struct defaults */ lpacket.ttl = 0; lpacket.id = 0; lpacket.flow = 0; lpacket.class = 0; if (IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) && (p->livedev)) { devname = p->livedev->dev; } if ((c = libnet_init(LIBNET_RAW6, LIBNET_INIT_CAST devname, ebuf)) == NULL) { SCLogError(SC_ERR_LIBNET_INIT,"libnet_init failed: %s", ebuf); return 1; } if (p->tcph == NULL) return 1; /* save payload len */ lpacket.dsize = p->payload_len; switch (dir) { case REJECT_DIR_SRC: SCLogDebug("sending a tcp reset to src"); /* We follow http://tools.ietf.org/html/rfc793#section-3.4 : * If packet has no ACK, the seq number is 0 and the ACK is built * the normal way. If packet has a ACK, the seq of the RST packet * is equal to the ACK of incoming packet and the ACK is build * using packet sequence number and size of the data. */ if (TCP_GET_ACK(p) == 0) { lpacket.seq = 0; lpacket.ack = TCP_GET_SEQ(p) + lpacket.dsize + 1; } else { lpacket.seq = TCP_GET_ACK(p); lpacket.ack = TCP_GET_SEQ(p) + lpacket.dsize; } lpacket.sp = TCP_GET_DST_PORT(p); lpacket.dp = TCP_GET_SRC_PORT(p); memcpy(lpacket.src6.libnet_s6_addr, GET_IPV6_DST_ADDR(p), 16); memcpy(lpacket.dst6.libnet_s6_addr, GET_IPV6_SRC_ADDR(p), 16); break; case REJECT_DIR_DST: SCLogDebug("sending a tcp reset to dst"); lpacket.seq = TCP_GET_SEQ(p); lpacket.ack = TCP_GET_ACK(p); lpacket.sp = TCP_GET_SRC_PORT(p); lpacket.dp = TCP_GET_DST_PORT(p); memcpy(lpacket.src6.libnet_s6_addr, GET_IPV6_SRC_ADDR(p), 16); memcpy(lpacket.dst6.libnet_s6_addr, GET_IPV6_DST_ADDR(p), 16); break; default: SCLogError(SC_ERR_LIBNET_INVALID_DIR, "reset not src or dst returning"); return 1; } lpacket.window = TCP_GET_WINDOW(p); //lpacket.seq += lpacket.dsize; /* TODO come up with ttl calc function */ lpacket.ttl = 64; /* build the package */ if ((libnet_build_tcp( lpacket.sp, /* source port */ lpacket.dp, /* dst port */ lpacket.seq, /* seq number */ lpacket.ack, /* ack number */ TH_RST|TH_ACK, /* flags */ lpacket.window, /* window size */ 0, /* checksum */ 0, /* urgent flag */ LIBNET_TCP_H, /* header length */ NULL, /* payload */ 0, /* payload length */ c, /* libnet context */ 0)) < 0) /* libnet ptag */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_tcp %s", libnet_geterror(c)); goto cleanup; } if ((libnet_build_ipv6( lpacket.class, /* traffic class */ lpacket.flow, /* Flow label */ LIBNET_TCP_H, /* payload length */ IPPROTO_TCP, /* next header */ lpacket.ttl, /* TTL */ lpacket.src6, /* source address */ lpacket.dst6, /* destination address */ NULL, /* pointer to packet data (or NULL) */ 0, /* payload length */ c, /* libnet context pointer */ 0)) < 0) /* packet id */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_ipv6 %s", libnet_geterror(c)); goto cleanup; } result = libnet_write(c); if (result == -1) { SCLogError(SC_ERR_LIBNET_WRITE_FAILED,"libnet_write failed: %s", libnet_geterror(c)); goto cleanup; } cleanup: libnet_destroy (c); return 0; } #ifdef HAVE_LIBNET_ICMPV6_UNREACH int RejectSendLibnet11L3IPv6ICMP(ThreadVars *tv, Packet *p, void *data, int dir) { Libnet11Packet lpacket; libnet_t *c; /* libnet context */ char ebuf[LIBNET_ERRBUF_SIZE]; int result; const char *devname = NULL; /* fill in struct defaults */ lpacket.ttl = 0; lpacket.id = 0; lpacket.flow = 0; lpacket.class = 0; lpacket.len = IPV6_GET_PLEN(p) + IPV6_HEADER_LEN; if (IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) && (p->livedev)) { devname = p->livedev->dev; } if ((c = libnet_init(LIBNET_RAW6, LIBNET_INIT_CAST devname, ebuf)) == NULL) { SCLogError(SC_ERR_LIBNET_INIT,"libnet_inint failed: %s", ebuf); return 1; } switch (dir) { case REJECT_DIR_SRC: memcpy(lpacket.src6.libnet_s6_addr, GET_IPV6_DST_ADDR(p), 16); memcpy(lpacket.dst6.libnet_s6_addr, GET_IPV6_SRC_ADDR(p), 16); break; case REJECT_DIR_DST: memcpy(lpacket.src6.libnet_s6_addr, GET_IPV6_SRC_ADDR(p), 16); memcpy(lpacket.dst6.libnet_s6_addr, GET_IPV6_DST_ADDR(p), 16); break; default: SCLogError(SC_ERR_LIBNET_INVALID_DIR, "reset not src or dst returning"); return 1; } /* TODO come up with ttl calc function */ lpacket.ttl = 64; /* build the package */ if ((libnet_build_icmpv6_unreach( ICMP6_DST_UNREACH, /* type */ ICMP6_DST_UNREACH_ADMIN, /* code */ 0, /* checksum */ (uint8_t *)p->ip6h, /* payload */ lpacket.len, /* payload length */ c, /* libnet context */ 0)) < 0) /* libnet ptag */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_icmpv6_unreach %s", libnet_geterror(c)); goto cleanup; } if ((libnet_build_ipv6( lpacket.class, /* traffic class */ lpacket.flow, /* Flow label */ LIBNET_ICMPV6_H + lpacket.len, /* IPv6 payload length */ IPPROTO_ICMPV6, /* next header */ lpacket.ttl, /* TTL */ lpacket.src6, /* source address */ lpacket.dst6, /* destination address */ NULL, /* pointer to packet data (or NULL) */ 0, /* payload length */ c, /* libnet context pointer */ 0)) < 0) /* packet id */ { SCLogError(SC_ERR_LIBNET_BUILD_FAILED,"libnet_build_ipv6 %s", libnet_geterror(c)); goto cleanup; } result = libnet_write(c); if (result == -1) { SCLogError(SC_ERR_LIBNET_WRITE_FAILED,"libnet_write_raw_ipv6 failed: %s", libnet_geterror(c)); goto cleanup; } cleanup: libnet_destroy (c); return 0; } #else /* HAVE_LIBNET_ICMPV6_UNREACH */ int RejectSendLibnet11L3IPv6ICMP(ThreadVars *tv, Packet *p, void *data, int dir) { SCLogError(SC_ERR_LIBNET_NOT_ENABLED, "Libnet ICMPv6 based rejects are disabled." "Usually this means that you don't have a patched libnet installed," " or configure couldn't find it."); return 0; } #endif /* HAVE_LIBNET_ICMPV6_UNREACH */ #else int RejectSendLibnet11L3IPv4TCP(ThreadVars *tv, Packet *p, void *data, int dir) { SCLogError(SC_ERR_LIBNET_NOT_ENABLED, "Libnet based rejects are disabled." "Usually this means that you don't have libnet installed," " or configure couldn't find it."); return 0; } int RejectSendLibnet11L3IPv4ICMP(ThreadVars *tv, Packet *p, void *data, int dir) { SCLogError(SC_ERR_LIBNET_NOT_ENABLED, "Libnet based rejects are disabled." "Usually this means that you don't have libnet installed," " or configure couldn't find it."); return 0; } int RejectSendLibnet11L3IPv6TCP(ThreadVars *tv, Packet *p, void *data, int dir) { SCLogError(SC_ERR_LIBNET_NOT_ENABLED, "Libnet based rejects are disabled." "Usually this means that you don't have libnet installed," " or configure couldn't find it."); return 0; } int RejectSendLibnet11L3IPv6ICMP(ThreadVars *tv, Packet *p, void *data, int dir) { SCLogError(SC_ERR_LIBNET_NOT_ENABLED, "Libnet based rejects are disabled." "Usually this means that you don't have libnet installed," " or configure couldn't find it."); return 0; } #endif /* HAVE_LIBNET11 */ suricata-3.2.1/src/util-enum.h0000644000000000000000000000206213051004444013071 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_ENUM_H__ #define __UTIL_ENUM_H__ typedef struct SCEnumCharMap_ { char *enum_name; int enum_value; } SCEnumCharMap; int SCMapEnumNameToValue(const char *, SCEnumCharMap *); const char * SCMapEnumValueToName(int, SCEnumCharMap *); #endif /* __UTIL_ENUM_H__ */ suricata-3.2.1/src/runmode-nflog.h0000644000000000000000000000204113051004444013723 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo */ #ifndef __RUNMODE_NFLOG_H__ #define __RUNMODE_NFLOG_H__ int RunModeIdsNflogAutoFp(void); int RunModeIdsNflogSingle(void); int RunModeIdsNflogWorkers(void); void RunModeIdsNflogRegister(void); const char *RunModeIdsNflogGetDefaultMode(void); #endif /* __RUNMODE_NFLOG_H__ */ suricata-3.2.1/src/util-hyperscan.c0000644000000000000000000000312413051004444014114 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Justin Viiret * * Support functions for Hyperscan library integration. */ #include "suricata-common.h" #include "suricata.h" #ifdef BUILD_HYPERSCAN /** * \internal * \brief Convert a pattern into a regex string accepted by the Hyperscan * compiler. * * For simplicity, we just take each byte of the original pattern and render it * with a hex escape (i.e. ' ' -> "\x20")/ */ char *HSRenderPattern(const uint8_t *pat, uint16_t pat_len) { if (pat == NULL) { return NULL; } const size_t hex_len = (pat_len * 4) + 1; char *str = SCMalloc(hex_len); if (str == NULL) { return NULL; } memset(str, 0, hex_len); char *sp = str; for (uint16_t i = 0; i < pat_len; i++) { snprintf(sp, 5, "\\x%02x", pat[i]); sp += 4; } *sp = '\0'; return str; } #endif /* BUILD_HYPERSCAN */ suricata-3.2.1/src/util-memcpy.h0000644000000000000000000000241313051004444013417 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele * * Memcpy_tolower() * */ #ifndef __UTIL_MEMCPY_H__ #define __UTIL_MEMCPY_H__ /** * \internal * \brief Does a memcpy of the input string to lowercase. * * \param d Pointer to the target area for memcpy. * \param s Pointer to the src string for memcpy. * \param len len of the string sent in s. */ static inline void memcpy_tolower(uint8_t *d, const uint8_t *s, uint16_t len) { uint16_t i; for (i = 0; i < len; i++) d[i] = u8_tolower(s[i]); return; } #endif /* __UTIL_MEMCPY_H__ */ suricata-3.2.1/src/detect-engine-hhhd.h0000644000000000000000000000253013051004444014576 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HHHD_H__ #define __DETECT_ENGINE_HHHD_H__ #include "app-layer-htp.h" int PrefilterTxHostnameRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpHH(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpHHRegisterTests(void); #endif /* __DETECT_ENGINE_HHHD_H__ */ suricata-3.2.1/src/detect-threshold.c0000644000000000000000000012257113051004444014417 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup threshold * @{ */ /** * \file * * \author Breno Silva * \author Victor Julien * * Implements the threshold keyword. * * The feature depends on what is provided * by detect-engine-threshold.c and util-threshold-config.c */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "host.h" #include "host-storage.h" #include "detect.h" #include "detect-parse.h" #include "flow-var.h" #include "decode-events.h" #include "stream-tcp.h" #include "detect-threshold.h" #include "detect-engine-threshold.h" #include "detect-engine-address.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-debug.h" #ifdef UNITTESTS #include "util-cpu.h" #endif #define PARSE_REGEX "^\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*,\\s*(track|type|count|seconds)\\s+(limit|both|threshold|by_dst|by_src|\\d+)\\s*" static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectThresholdMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectThresholdSetup(DetectEngineCtx *, Signature *, char *); static void DetectThresholdFree(void *); /** * \brief Registration function for threshold: keyword */ void DetectThresholdRegister(void) { sigmatch_table[DETECT_THRESHOLD].name = "threshold"; sigmatch_table[DETECT_THRESHOLD].desc = "control the rule's alert frequency"; sigmatch_table[DETECT_THRESHOLD].url = DOC_URL DOC_VERSION "/rules/thresholding.html#threshold"; sigmatch_table[DETECT_THRESHOLD].Match = DetectThresholdMatch; sigmatch_table[DETECT_THRESHOLD].Setup = DetectThresholdSetup; sigmatch_table[DETECT_THRESHOLD].Free = DetectThresholdFree; sigmatch_table[DETECT_THRESHOLD].RegisterTests = ThresholdRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_THRESHOLD].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static int DetectThresholdMatch(ThreadVars *thv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { return 1; } /** * \internal * \brief This function is used to parse threshold options passed via threshold: keyword * * \param rawstr Pointer to the user provided threshold options * * \retval de pointer to DetectThresholdData on success * \retval NULL on failure */ static DetectThresholdData *DetectThresholdParse(char *rawstr) { DetectThresholdData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; char *args[9] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }; char *copy_str = NULL, *threshold_opt = NULL; int second_found = 0, count_found = 0; int type_found = 0, track_found = 0; int second_pos = 0, count_pos = 0; uint16_t pos = 0; int i = 0; copy_str = SCStrdup(rawstr); if (unlikely(copy_str == NULL)) { goto error; } char *saveptr = NULL; for (pos = 0, threshold_opt = strtok_r(copy_str,",", &saveptr); pos < strlen(copy_str) && threshold_opt != NULL; pos++, threshold_opt = strtok_r(NULL,"," , &saveptr)) { if(strstr(threshold_opt,"count")) count_found++; if(strstr(threshold_opt,"second")) second_found++; if(strstr(threshold_opt,"type")) type_found++; if(strstr(threshold_opt,"track")) track_found++; } SCFree(copy_str); copy_str = NULL; if(count_found != 1 || second_found != 1 || type_found != 1 || track_found != 1) goto error; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 5) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } de = SCMalloc(sizeof(DetectThresholdData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectThresholdData)); for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS,i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i] = (char *)str_ptr; if (strncasecmp(args[i],"limit",strlen("limit")) == 0) de->type = TYPE_LIMIT; if (strncasecmp(args[i],"both",strlen("both")) == 0) de->type = TYPE_BOTH; if (strncasecmp(args[i],"threshold",strlen("threshold")) == 0) de->type = TYPE_THRESHOLD; if (strncasecmp(args[i],"by_dst",strlen("by_dst")) == 0) de->track = TRACK_DST; if (strncasecmp(args[i],"by_src",strlen("by_src")) == 0) de->track = TRACK_SRC; if (strncasecmp(args[i],"count",strlen("count")) == 0) count_pos = i+1; if (strncasecmp(args[i],"seconds",strlen("seconds")) == 0) second_pos = i+1; } if (args[count_pos] == NULL || args[second_pos] == NULL) { goto error; } if (ByteExtractStringUint32(&de->count, 10, strlen(args[count_pos]), args[count_pos]) <= 0) { goto error; } if (ByteExtractStringUint32(&de->seconds, 10, strlen(args[second_pos]), args[second_pos]) <= 0) { goto error; } for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } return de; error: for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } if (de != NULL) SCFree(de); return NULL; } /** * \internal * \brief this function is used to add the parsed threshold into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided threshold options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectThresholdSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectThresholdData *de = NULL; SigMatch *sm = NULL; SigMatch *tmpm = NULL; /* checks if there is a previous instance of detection_filter */ tmpm = SigMatchGetLastSMFromLists(s, 2, DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_MATCH]); if (tmpm != NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"detection_filter\" and \"threshold\" are not allowed in the same rule"); SCReturnInt(-1); } de = DetectThresholdParse(rawstr); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_THRESHOLD; sm->ctx = (SigMatchCtx *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_THRESHOLD); return 0; error: if (de) SCFree(de); if (sm) SCFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with DetectThresholdData * * \param de pointer to DetectThresholdData */ static void DetectThresholdFree(void *de_ptr) { DetectThresholdData *de = (DetectThresholdData *)de_ptr; if (de) { DetectAddressHeadCleanup(&de->addrs); SCFree(de); } } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" #include "util-time.h" #include "util-hashlist.h" /** * \test ThresholdTestParse01 is a test for a valid threshold options * * \retval 1 on succces * \retval 0 on failure */ static int ThresholdTestParse01(void) { DetectThresholdData *de = NULL; de = DetectThresholdParse("type limit,track by_dst,count 10,seconds 60"); if (de && (de->type == TYPE_LIMIT) && (de->track == TRACK_DST) && (de->count == 10) && (de->seconds == 60)) { DetectThresholdFree(de); return 1; } return 0; } /** * \test ThresholdTestParse02 is a test for a invalid threshold options * * \retval 1 on succces * \retval 0 on failure */ static int ThresholdTestParse02(void) { DetectThresholdData *de = NULL; de = DetectThresholdParse("type any,track by_dst,count 10,seconds 60"); if (de && (de->type == TYPE_LIMIT) && (de->track == TRACK_DST) && (de->count == 10) && (de->seconds == 60)) { DetectThresholdFree(de); return 0; } return 1; } /** * \test ThresholdTestParse03 is a test for a valid threshold options in any order * * \retval 1 on succces * \retval 0 on failure */ static int ThresholdTestParse03(void) { DetectThresholdData *de = NULL; de = DetectThresholdParse("track by_dst, type limit, seconds 60, count 10"); if (de && (de->type == TYPE_LIMIT) && (de->track == TRACK_DST) && (de->count == 10) && (de->seconds == 60)) { DetectThresholdFree(de); return 1; } return 0; } /** * \test ThresholdTestParse04 is a test for an invalid threshold options in any order * * \retval 1 on succces * \retval 0 on failure */ static int ThresholdTestParse04(void) { DetectThresholdData *de = NULL; de = DetectThresholdParse("count 10, track by_dst, seconds 60, type both, count 10"); if (de && (de->type == TYPE_BOTH) && (de->track == TRACK_DST) && (de->count == 10) && (de->seconds == 60)) { DetectThresholdFree(de); return 0; } return 1; } /** * \test ThresholdTestParse05 is a test for a valid threshold options in any order * * \retval 1 on succces * \retval 0 on failure */ static int ThresholdTestParse05(void) { DetectThresholdData *de = NULL; de = DetectThresholdParse("count 10, track by_dst, seconds 60, type both"); if (de && (de->type == TYPE_BOTH) && (de->track == TRACK_DST) && (de->count == 10) && (de->seconds == 60)) { DetectThresholdFree(de); return 1; } return 0; } /** * \test DetectThresholdTestSig1 is a test for checking the working of limit keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectThresholdTestSig1(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit\"; content:\"A\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); if (s->flags & SIG_FLAG_IPONLY) { printf("signature is ip-only: "); goto end; } DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); if (alerts != 1) { printf("alerts %"PRIi32", expected 1: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 2) { printf("alerts %"PRIi32", expected 2: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 3) { printf("alerts %"PRIi32", expected 3: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 4) { printf("alerts %"PRIi32", expected 4: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %"PRIi32", expected 5: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %"PRIi32", expected 5: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %"PRIi32", expected 5: ", alerts); } SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts != 5) { printf("alerts %"PRIi32", expected 5: ", alerts); } if(alerts == 5) result = 1; else printf("alerts %"PRIi32", expected 5: ", alerts); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); HostShutdown(); end: return result; } /** * \test DetectThresholdTestSig2 is a test for checking the working of threshold keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectThresholdTestSig2(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold\"; threshold: type threshold, track by_dst, count 5, seconds 60; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); if (alerts == 2) result = 1; else goto cleanup; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test DetectThresholdTestSig3 is a test for checking the working of limit keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectThresholdTestSig3(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; struct timeval ts; DetectThresholdEntry *lookup_tsh = NULL; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); Host *host = HostLookupHostFromHash(&p->dst); if (host == NULL) { printf("host not found: "); goto cleanup; } if (!(ThresholdHostHasThreshold(host))) { HostRelease(host); printf("host has no threshold: "); goto cleanup; } HostRelease(host); TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); host = HostLookupHostFromHash(&p->dst); if (host == NULL) { printf("host not found: "); goto cleanup; } HostRelease(host); lookup_tsh = HostGetStorageById(host, ThresholdHostStorageId()); if (lookup_tsh == NULL) { HostRelease(host); printf("lookup_tsh is NULL: "); goto cleanup; } alerts = lookup_tsh->current_count; if (alerts == 3) result = 1; else { printf("alerts %u != 3: ", alerts); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test DetectThresholdTestSig4 is a test for checking the working of both keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectThresholdTestSig4(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold both\"; threshold: type both, track by_dst, count 2, seconds 60; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); if (alerts == 2) result = 1; else goto cleanup; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test DetectThresholdTestSig5 is a test for checking the working of limit keyword * by setting up the signature and later testing its working by matching * the received packet against the sig. * * \retval 1 on succces * \retval 0 on failure */ static int DetectThresholdTestSig5(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); if(alerts == 10) result = 1; else { printf("alerts %d != 10: ", alerts); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } static int DetectThresholdTestSig6Ticks(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit sid 1\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert tcp any any -> any 80 (msg:\"Threshold limit sid 1000\"; threshold: type limit, track by_dst, count 5, seconds 60; sid:1000;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); uint64_t ticks_start = 0; uint64_t ticks_end = 0; ticks_start = UtilCpuGetTicks(); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 1); alerts += PacketAlertCheck(p, 1000); ticks_end = UtilCpuGetTicks(); printf("test run %"PRIu64"\n", (ticks_end - ticks_start)); if(alerts == 10) result = 1; else goto cleanup; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig7(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type limit, track by_src, count 1, seconds 300; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 1 && drops == 6) result = 1; else { if (alerts != 1) printf("alerts: %d != 1: ", alerts); if (drops != 6) printf("drops: %d != 6: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig8(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type limit, track by_src, count 2, seconds 300; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 2 && drops == 6) result = 1; else { if (alerts != 1) printf("alerts: %d != 1: ", alerts); if (drops != 6) printf("drops: %d != 6: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig9(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type threshold, track by_src, count 3, seconds 100; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 2 && drops == 2) result = 1; else { if (alerts != 2) printf("alerts: %d != 2: ", alerts); if (drops != 2) printf("drops: %d != 2: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig10(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type threshold, track by_src, count 5, seconds 300; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 1 && drops == 1) result = 1; else { if (alerts != 1) printf("alerts: %d != 1: ", alerts); if (drops != 1) printf("drops: %d != 1: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig11(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type both, track by_src, count 3, seconds 300; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 1 && drops == 4) result = 1; else { if (alerts != 1) printf("alerts: %d != 1: ", alerts); if (drops != 4) printf("drops: %d != 4: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } /** * \test Test drop action being set even if thresholded */ static int DetectThresholdTestSig12(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; int alerts = 0; int drops = 0; struct timeval ts; HostInitConfig(HOST_QUIET); memset (&ts, 0, sizeof(struct timeval)); TimeGet(&ts); memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketReal((uint8_t *)"A",1,IPPROTO_TCP, "1.1.1.1", "2.2.2.2", 1024, 80); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"drop tcp any any -> any 80 (threshold: type both, track by_src, count 5, seconds 300; sid:10;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts = PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; TimeSetIncrementTime(200); TimeGet(&p->ts); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); alerts += PacketAlertCheck(p, 10); drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); p->action = 0; if (alerts == 1 && drops == 2) result = 1; else { if (alerts != 1) printf("alerts: %d != 1: ", alerts); if (drops != 2) printf("drops: %d != 2: ", drops); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void*)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); HostShutdown(); return result; } #endif /* UNITTESTS */ void ThresholdRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("ThresholdTestParse01", ThresholdTestParse01); UtRegisterTest("ThresholdTestParse02", ThresholdTestParse02); UtRegisterTest("ThresholdTestParse03", ThresholdTestParse03); UtRegisterTest("ThresholdTestParse04", ThresholdTestParse04); UtRegisterTest("ThresholdTestParse05", ThresholdTestParse05); UtRegisterTest("DetectThresholdTestSig1", DetectThresholdTestSig1); UtRegisterTest("DetectThresholdTestSig2", DetectThresholdTestSig2); UtRegisterTest("DetectThresholdTestSig3", DetectThresholdTestSig3); UtRegisterTest("DetectThresholdTestSig4", DetectThresholdTestSig4); UtRegisterTest("DetectThresholdTestSig5", DetectThresholdTestSig5); UtRegisterTest("DetectThresholdTestSig6Ticks", DetectThresholdTestSig6Ticks); UtRegisterTest("DetectThresholdTestSig7", DetectThresholdTestSig7); UtRegisterTest("DetectThresholdTestSig8", DetectThresholdTestSig8); UtRegisterTest("DetectThresholdTestSig9", DetectThresholdTestSig9); UtRegisterTest("DetectThresholdTestSig10", DetectThresholdTestSig10); UtRegisterTest("DetectThresholdTestSig11", DetectThresholdTestSig11); UtRegisterTest("DetectThresholdTestSig12", DetectThresholdTestSig12); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/decode-ipv4.c0000644000000000000000000015210013051004444013247 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * \author Brian Rectanus * * Decode IPv4 */ #include "suricata-common.h" #include "packet-queue.h" #include "decode.h" #include "decode-ipv4.h" #include "decode-events.h" #include "defrag.h" #include "pkt-var.h" #include "host.h" #include "util-unittest.h" #include "util-debug.h" #include "util-optimize.h" #include "util-print.h" #include "util-profiling.h" /* Generic validation * * [--type--][--len---] * * \todo This function needs removed in favor of specific validation. * * See: RFC 791 */ static int IPV4OptValidateGeneric(Packet *p, const IPV4Opt *o) { switch (o->type) { /* See: RFC 4782 */ case IPV4_OPT_QS: if (o->len < IPV4_OPT_QS_MIN) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } break; /* See: RFC 1108 */ case IPV4_OPT_SEC: if (o->len != IPV4_OPT_SEC_LEN) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } break; case IPV4_OPT_SID: if (o->len != IPV4_OPT_SID_LEN) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } break; /* See: RFC 2113 */ case IPV4_OPT_RTRALT: if (o->len != IPV4_OPT_RTRALT_LEN) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } break; default: /* Should never get here unless there is a coding error */ ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_UNKNOWN); return -1; } return 0; } /* Validate route type options * * [--type--][--len---][--ptr---][address1]...[addressN] * * See: RFC 791 */ static int IPV4OptValidateRoute(Packet *p, const IPV4Opt *o) { uint8_t ptr; /* Check length */ if (unlikely(o->len < IPV4_OPT_ROUTE_MIN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } /* Data is required */ if (unlikely(o->data == NULL)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } ptr = *o->data; /* Address pointer is 1 based and points at least after type+len+ptr, * must be a incremented by 4 bytes (address size) and cannot extend * past option length. */ if (unlikely((ptr < 4) || (ptr % 4) || (ptr > o->len + 1))) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } return 0; } /* Validate timestamp type options * * [--type--][--len---][--ptr---][ovfl][flag][rec1----...]...[recN----...] * NOTE: rec could be 4 (ts only) or 8 (ip+ts) bytes in length. * * See: RFC 781 */ static int IPV4OptValidateTimestamp(Packet *p, const IPV4Opt *o) { uint8_t ptr; uint8_t flag; uint8_t rec_size; /* Check length */ if (unlikely(o->len < IPV4_OPT_TS_MIN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } /* Data is required */ if (unlikely(o->data == NULL)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } ptr = *o->data; /* We need the flag to determine what is in the option payload */ if (unlikely(ptr < 5)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } flag = *(o->data + 3) & 0x00ff; /* A flag of 1|3 means we have both the ip+ts in each record */ rec_size = ((flag == 1) || (flag == 3)) ? 8 : 4; /* Address pointer is 1 based and points at least after * type+len+ptr+ovfl+flag, must be incremented by by the rec_size * and cannot extend past option length. */ if (unlikely(((ptr - 5) % rec_size) || (ptr > o->len + 1))) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } return 0; } /* Validate CIPSO option * * [--type--][--len---][--doi---][tags--...] * * See: draft-ietf-cipso-ipsecurity-01.txt * See: FIPS 188 (tags 6 & 7) */ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) { // uint32_t doi; uint8_t *tag; uint16_t len; /* Check length */ if (unlikely(o->len < IPV4_OPT_CIPSO_MIN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } /* Data is required */ if (unlikely(o->data == NULL)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } // doi = *o->data; tag = o->data + 4; len = o->len - 1 - 1 - 4; /* Length of tags after header */ #if 0 /* Domain of Interest (DOI) of 0 is reserved and thus invalid */ /** \todo Aparently a DOI of zero is fine in practice - verify. */ if (doi == 0) { ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED); return -1; } #endif /* NOTE: We know len has passed min tests prior to this call */ /* Check that tags are formatted correctly * [-ttype--][--tlen--][-tagdata-...] */ while (len) { uint8_t ttype; uint8_t tlen; /* Tag header must fit within option length */ if (unlikely(len < 2)) { //printf("CIPSO tag header too large %" PRIu16 " < 2\n", len); ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } /* Tag header is type+len */ ttype = *(tag++); tlen = *(tag++); /* Tag length must fit within the option length */ if (unlikely(tlen > len)) { //printf("CIPSO tag len too large %" PRIu8 " > %" PRIu16 "\n", tlen, len); ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } switch(ttype) { case 1: case 2: case 5: case 6: case 7: /* Tag is at least 4 and at most the remainder of option len */ if (unlikely((tlen < 4) || (tlen > len))) { //printf("CIPSO tag %" PRIu8 " bad tlen=%" PRIu8 " len=%" PRIu8 "\n", ttype, tlen, len); ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } /* The alignment octet is always 0 except tag * type 7, which has no such field. */ if (unlikely((ttype != 7) && (*tag != 0))) { //printf("CIPSO tag %" PRIu8 " ao=%" PRIu8 "\n", ttype, tlen); ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); return -1; } /* Skip the rest of the tag payload */ tag += tlen - 2; len -= tlen; continue; case 0: /* Tag type 0 is reserved and thus invalid */ /** \todo Wireshark marks this a padding, but spec says reserved. */ ENGINE_SET_INVALID_EVENT(p,IPV4_OPT_MALFORMED); return -1; default: //printf("CIPSO tag %" PRIu8 " unknown tag\n", ttype); ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED); /** \todo May not want to return error here on unknown tag type (at least not for 3|4) */ return -1; } } return 0; } typedef struct IPV4Options_ { IPV4Opt o_rr; IPV4Opt o_qs; IPV4Opt o_ts; IPV4Opt o_sec; IPV4Opt o_lsrr; IPV4Opt o_cipso; IPV4Opt o_sid; IPV4Opt o_ssrr; IPV4Opt o_rtralt; } IPV4Options; /** * Decode/Validate IPv4 Options. */ static int DecodeIPV4Options(Packet *p, uint8_t *pkt, uint16_t len, IPV4Options *opts) { uint16_t plen = len; #ifdef DEBUG if (SCLogDebugEnabled()) { uint16_t i; char buf[256] = ""; int offset = 0; for (i = 0; i < len; i++) { offset += snprintf(buf + offset, (sizeof(buf) - offset), "%02" PRIx8 " ", pkt[i]); } SCLogDebug("IPV4OPTS: { %s}", buf); } #endif /* Options length must be padded to 8byte boundary */ if (plen % 8) { ENGINE_SET_EVENT(p,IPV4_OPT_PAD_REQUIRED); /* Warn - we can keep going */ } while (plen) { p->ip4vars.opt_cnt++; /* single byte options */ if (*pkt == IPV4_OPT_EOL) { /** \todo What if more data exist after EOL (possible covert channel or data leakage)? */ SCLogDebug("IPV4OPT %" PRIu16 " len 1 @ %" PRIu16 "/%" PRIu16 "", *pkt, (len - plen), (len - 1)); p->ip4vars.opts_set |= IPV4_OPT_FLAG_EOL; break; } else if (*pkt == IPV4_OPT_NOP) { SCLogDebug("IPV4OPT %" PRIu16 " len 1 @ %" PRIu16 "/%" PRIu16 "", *pkt, (len - plen), (len - 1)); pkt++; plen--; p->ip4vars.opts_set |= IPV4_OPT_FLAG_NOP; /* multibyte options */ } else { if (unlikely(plen < 2)) { /** \todo What if padding is non-zero (possible covert channel or data leakage)? */ /** \todo Spec seems to indicate EOL required if there is padding */ ENGINE_SET_EVENT(p,IPV4_OPT_EOL_REQUIRED); break; } /* Option length is too big for packet */ if (unlikely(*(pkt+1) > plen)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } IPV4Opt opt = {*pkt, *(pkt+1), plen > 2 ? (pkt + 2) : NULL }; /* we already know that the total options len is valid, * so here the len of the specific option must be bad. * Also check for invalid lengths 0 and 1. */ if (unlikely(opt.len > plen || opt.len < 2)) { ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN); return -1; } /* we are parsing the most commonly used opts to prevent * us from having to walk the opts list for these all the * time. */ /** \todo Figure out which IP options are more common and list them first */ switch (opt.type) { case IPV4_OPT_TS: if (opts->o_ts.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateTimestamp(p, &opt)) { return -1; } opts->o_ts = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_TS; break; case IPV4_OPT_RR: if (opts->o_rr.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateRoute(p, &opt) != 0) { return -1; } opts->o_rr = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_RR; break; case IPV4_OPT_QS: if (opts->o_qs.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateGeneric(p, &opt)) { return -1; } opts->o_qs = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_QS; break; case IPV4_OPT_SEC: if (opts->o_sec.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateGeneric(p, &opt)) { return -1; } opts->o_sec = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_SEC; break; case IPV4_OPT_LSRR: if (opts->o_lsrr.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateRoute(p, &opt) != 0) { return -1; } opts->o_lsrr = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_LSRR; break; case IPV4_OPT_CIPSO: if (opts->o_cipso.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateCIPSO(p, &opt) != 0) { return -1; } opts->o_cipso = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_CIPSO; break; case IPV4_OPT_SID: if (opts->o_sid.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateGeneric(p, &opt)) { return -1; } opts->o_sid = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_SID; break; case IPV4_OPT_SSRR: if (opts->o_ssrr.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateRoute(p, &opt) != 0) { return -1; } opts->o_ssrr = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_SSRR; break; case IPV4_OPT_RTRALT: if (opts->o_rtralt.type != 0) { ENGINE_SET_EVENT(p,IPV4_OPT_DUPLICATE); /* Warn - we can keep going */ break; } else if (IPV4OptValidateGeneric(p, &opt)) { return -1; } opts->o_rtralt = opt; p->ip4vars.opts_set |= IPV4_OPT_FLAG_RTRALT; break; default: SCLogDebug("IPV4OPT (%" PRIu8 ") len %" PRIu8, opt.type, opt.len); ENGINE_SET_EVENT(p,IPV4_OPT_INVALID); /* Warn - we can keep going */ break; } pkt += opt.len; plen -= opt.len; } } return 0; } static int DecodeIPV4Packet(Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_PKT_TOO_SMALL); return -1; } if (unlikely(IP_GET_RAW_VER(pkt) != 4)) { SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt)); ENGINE_SET_INVALID_EVENT(p, IPV4_WRONG_IP_VER); return -1; } p->ip4h = (IPV4Hdr *)pkt; if (unlikely(IPV4_GET_HLEN(p) < IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_HLEN_TOO_SMALL); return -1; } if (unlikely(IPV4_GET_IPLEN(p) < IPV4_GET_HLEN(p))) { ENGINE_SET_INVALID_EVENT(p, IPV4_IPLEN_SMALLER_THAN_HLEN); return -1; } if (unlikely(len < IPV4_GET_IPLEN(p))) { ENGINE_SET_INVALID_EVENT(p, IPV4_TRUNC_PKT); return -1; } /* set the address struct */ SET_IPV4_SRC_ADDR(p,&p->src); SET_IPV4_DST_ADDR(p,&p->dst); /* save the options len */ uint8_t ip_opt_len = IPV4_GET_HLEN(p) - IPV4_HEADER_LEN; if (ip_opt_len > 0) { IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); DecodeIPV4Options(p, pkt + IPV4_HEADER_LEN, ip_opt_len, &opts); } return 0; } int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_ipv4); SCLogDebug("pkt %p len %"PRIu16"", pkt, len); /* do the actual decoding */ if (unlikely(DecodeIPV4Packet (p, pkt, len) < 0)) { SCLogDebug("decoding IPv4 packet failed"); p->ip4h = NULL; return TM_ECODE_FAILED; } p->proto = IPV4_GET_IPPROTO(p); /* If a fragment, pass off for re-assembly. */ if (unlikely(IPV4_GET_IPOFFSET(p) > 0 || IPV4_GET_MF(p) == 1)) { Packet *rp = Defrag(tv, dtv, p, pq); if (rp != NULL) { PacketEnqueue(pq, rp); } p->flags |= PKT_IS_FRAGMENT; return TM_ECODE_OK; } /* do hdr test, process hdr rules */ #ifdef DEBUG if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */ /* debug print */ char s[16], d[16]; PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), s, sizeof(s)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), d, sizeof(d)); SCLogDebug("IPV4 %s->%s PROTO: %" PRIu32 " OFFSET: %" PRIu32 " RF: %" PRIu32 " DF: %" PRIu32 " MF: %" PRIu32 " ID: %" PRIu32 "", s,d, IPV4_GET_IPPROTO(p), IPV4_GET_IPOFFSET(p), IPV4_GET_RF(p), IPV4_GET_DF(p), IPV4_GET_MF(p), IPV4_GET_IPID(p)); } #endif /* DEBUG */ /* check what next decoder to invoke */ switch (IPV4_GET_IPPROTO(p)) { case IPPROTO_TCP: DecodeTCP(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); break; case IPPROTO_UDP: DecodeUDP(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); break; case IPPROTO_ICMP: DecodeICMPV4(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); break; case IPPROTO_GRE: DecodeGRE(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); break; case IPPROTO_SCTP: DecodeSCTP(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); break; case IPPROTO_IPV6: { if (pq != NULL) { /* spawn off tunnel packet */ Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), DECODE_TUNNEL_IPV6, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV4); PacketEnqueue(pq,tp); } } break; } case IPPROTO_IP: /* check PPP VJ uncompressed packets and decode tcp dummy */ if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP) { DecodeTCP(tv, dtv, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), pq); } break; case IPPROTO_ICMPV6: ENGINE_SET_INVALID_EVENT(p, IPV4_WITH_ICMPV6); break; } return TM_ECODE_OK; } /* UNITTESTS */ #ifdef UNITTESTS /** \test IPV4 with no options. */ int DecodeIPV4OptionsNONETest01(void) { uint8_t raw_opts[] = { }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); SCFree(p); PASS; } /** \test IPV4 with EOL option. */ int DecodeIPV4OptionsEOLTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_EOL, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF (rc != 0); SCFree(p); PASS; } /** \test IPV4 with NOP option. */ int DecodeIPV4OptionsNOPTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_NOP, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF (rc != 0); SCFree(p); PASS; } /** \test IPV4 with RR option. */ int DecodeIPV4OptionsRRTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_RR, 0x27, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_rr.type != IPV4_OPT_RR); SCFree(p); PASS; } /** \test IPV4 with RR option (len too large). */ int DecodeIPV4OptionsRRTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_RR, 0xff, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_rr.type != 0); SCFree(p); PASS; } /** \test IPV4 with RR option (ptr too large). */ int DecodeIPV4OptionsRRTest03(void) { uint8_t raw_opts[] = { IPV4_OPT_RR, 0x27, 0xff, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_rr.type != 0); SCFree(p); PASS; } /** \test IPV4 with RR option (ptr not in 4 byte increment). */ int DecodeIPV4OptionsRRTest04(void) { uint8_t raw_opts[] = { IPV4_OPT_RR, 0x27, 0x05, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_rr.type != 0); SCFree(p); PASS; } /** \test IPV4 with QS option. */ int DecodeIPV4OptionsQSTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_QS, 0x08, 0x0d, 0x00, 0xbe, 0xef, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_qs.type != IPV4_OPT_QS); SCFree(p); PASS; } /** \test IPV4 with QS option (len too small) */ int DecodeIPV4OptionsQSTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_QS, 0x07, 0x0d, 0x00, 0xbe, 0xef, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_qs.type != 0); SCFree(p); PASS; } /** \test IPV4 with TS option. */ int DecodeIPV4OptionsTSTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_TS, 0x24, 0x0d, 0x01, 0x0a, 0x0a, 0x0a, 0x69, 0x04, 0xce, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_ts.type != IPV4_OPT_TS); SCFree(p); PASS; } /** \test IPV4 with TS option (ptr too small). */ int DecodeIPV4OptionsTSTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_TS, 0x24, 0x04, 0x01, 0x0a, 0x0a, 0x0a, 0x69, 0x04, 0xce, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ts.type != 0); SCFree(p); PASS; } /** \test IPV4 with TS option (ptr too large). */ int DecodeIPV4OptionsTSTest03(void) { uint8_t raw_opts[] = { IPV4_OPT_TS, 0x24, 0xff, 0x01, 0x0a, 0x0a, 0x0a, 0x69, 0x04, 0xce, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ts.type != 0); SCFree(p); PASS; } /** \test IPV4 with TS option (ptr not valid). */ int DecodeIPV4OptionsTSTest04(void) { uint8_t raw_opts[] = { IPV4_OPT_TS, 0x24, 0x0a, 0x01, 0x0a, 0x0a, 0x0a, 0x69, 0x04, 0xce, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ts.type != 0); SCFree(p); PASS; } /** \test IPV4 with SEC option. */ int DecodeIPV4OptionsSECTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_SEC, 0x0b, 0xf1, 0x35, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_sec.type != IPV4_OPT_SEC); SCFree(p); PASS; } /** \test IPV4 with SEC option (invalid length). */ int DecodeIPV4OptionsSECTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_SEC, 0x0a, 0xf1, 0x35, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_sec.type != 0); SCFree(p); PASS; } /** \test IPV4 with LSRR option. */ int DecodeIPV4OptionsLSRRTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_LSRR, 0x27, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_lsrr.type != IPV4_OPT_LSRR); SCFree(p); PASS; } /** \test IPV4 with LSRR option (len too large). */ int DecodeIPV4OptionsLSRRTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_LSRR, 0xff, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_lsrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with LSRR option (ptr too large). */ int DecodeIPV4OptionsLSRRTest03(void) { uint8_t raw_opts[] = { IPV4_OPT_LSRR, 0x27, 0xff, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_lsrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with LSRR option (ptr not in 4 byte increment). */ int DecodeIPV4OptionsLSRRTest04(void) { uint8_t raw_opts[] = { IPV4_OPT_LSRR, 0x27, 0x05, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_lsrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with CIPSO option. */ int DecodeIPV4OptionsCIPSOTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_CIPSO, 0x18, 0x00, 0x00, 0x00, 0x05, 0x05, 0x12, 0x00, 0x03, 0x00, 0xef, 0x00, 0xef, 0x00, 0x06, 0x00, 0x04, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_cipso.type != IPV4_OPT_CIPSO); SCFree(p); PASS; } /** \test IPV4 with SID option. */ int DecodeIPV4OptionsSIDTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_SID, 0x04, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_sid.type != IPV4_OPT_SID); SCFree(p); PASS; } /** \test IPV4 with SID option (len invalid. */ int DecodeIPV4OptionsSIDTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_SID, 0x05, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_sid.type != 0); SCFree(p); PASS; } /** \test IPV4 with SSRR option. */ int DecodeIPV4OptionsSSRRTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_SSRR, 0x27, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_ssrr.type != IPV4_OPT_SSRR); SCFree(p); PASS; } /** \test IPV4 with SSRR option (len too large). */ int DecodeIPV4OptionsSSRRTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_SSRR, 0xff, 0x08, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ssrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with SSRR option (ptr too large). */ int DecodeIPV4OptionsSSRRTest03(void) { uint8_t raw_opts[] = { IPV4_OPT_SSRR, 0x27, 0xff, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ssrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with SSRR option (ptr not in 4 byte increment). */ int DecodeIPV4OptionsSSRRTest04(void) { uint8_t raw_opts[] = { IPV4_OPT_SSRR, 0x27, 0x05, 0xc0, 0xa8, 0x2a, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_ssrr.type != 0); SCFree(p); PASS; } /** \test IPV4 with RTRALT option. */ int DecodeIPV4OptionsRTRALTTest01(void) { uint8_t raw_opts[] = { IPV4_OPT_RTRALT, 0x04, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc != 0); FAIL_IF(opts.o_rtralt.type != IPV4_OPT_RTRALT); SCFree(p); PASS; } /** \test IPV4 with RTRALT option (len invalid. */ int DecodeIPV4OptionsRTRALTTest02(void) { uint8_t raw_opts[] = { IPV4_OPT_RTRALT, 0x05, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); FAIL_IF(unlikely(p == NULL)); IPV4Options opts; memset(&opts, 0x00, sizeof(opts)); int rc = DecodeIPV4Options(p, raw_opts, sizeof(raw_opts), &opts); FAIL_IF(rc == 0); FAIL_IF(opts.o_rtralt.type != 0); SCFree(p); PASS; } static int IPV4CalculateValidChecksumtest01(void) { uint16_t csum = 0; uint8_t raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x03}; csum = *( ((uint16_t *)raw_ipv4) + 5); return (csum == IPV4CalculateChecksum((uint16_t *)raw_ipv4, sizeof(raw_ipv4))); } static int IPV4CalculateInvalidChecksumtest02(void) { uint16_t csum = 0; uint8_t raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x07}; csum = *( ((uint16_t *)raw_ipv4) + 5); return (csum != IPV4CalculateChecksum((uint16_t *)raw_ipv4, sizeof(raw_ipv4))); } /** * \test IPV4 defrag and packet recursion level test */ int DecodeIPV4DefragTest01(void) { uint8_t pkt1[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x1c, 0xe9, 0xef, 0x20, 0x00, 0x40, 0x06, 0x9a, 0xc8, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e }; uint8_t pkt2[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x1c, 0xe9, 0xef, 0x20, 0x01, 0x40, 0x06, 0x9a, 0xc7, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00 }; uint8_t pkt3[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x18, 0xe9, 0xef, 0x00, 0x02, 0x40, 0x06, 0xba, 0xca, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0xb1, 0xa3, 0x00, 0x00 }; uint8_t tunnel_pkt[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x28, 0xe9, 0xef, 0x00, 0x00, 0x40, 0x06, 0xba, 0xbc, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, 0xb1, 0xa3, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; int result = 1; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); FlowInitConfig(FLOW_QUIET); DefragInit(); PacketCopyData(p, pkt1, sizeof(pkt1)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt2, sizeof(pkt2)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt3, sizeof(pkt3)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } Packet *tp = PacketDequeue(&pq); if (tp == NULL) { printf("Failed to get defragged pseudo packet\n"); result = 0; goto end; } if (tp->recursion_level != p->recursion_level) { printf("defragged pseudo packet's and parent packet's recursion " "level don't match\n %d != %d", tp->recursion_level, p->recursion_level); result = 0; goto end; } if (tp->ip4h == NULL || tp->tcph == NULL) { printf("pseudo packet's ip header and tcp header shouldn't be NULL, " "but it is\n"); result = 0; goto end; } if (GET_PKT_LEN(tp) != sizeof(tunnel_pkt)) { printf("defragged pseudo packet's and parent packet's pkt lens " "don't match\n %u != %"PRIuMAX, GET_PKT_LEN(tp), (uintmax_t)sizeof(tunnel_pkt)); result = 0; goto end; } if (memcmp(GET_PKT_DATA(tp), tunnel_pkt, sizeof(tunnel_pkt)) != 0) { result = 0; goto end; } PACKET_RECYCLE(tp); SCFree(tp); end: DefragDestroy(); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \test Don't send IPv4 fragments to the upper layer decoder and * and packet recursion level test. */ int DecodeIPV4DefragTest02(void) { uint8_t pkt1[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x24, 0xe9, 0xef, 0x20, 0x00, 0x40, 0x06, 0x9a, 0xc8, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, /* first frag */ 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, }; uint8_t pkt2[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x2c, 0xe9, 0xef, 0x20, 0x02, 0x40, 0x06, 0xba, 0xca, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, /* second frag */ 0xb1, 0xa3, 0x00, 0x10, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, 0xb1, 0xa3, 0x00, 0x10, 0x01, 0x02, 0x03, 0x04 }; uint8_t pkt3[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x16, 0xe9, 0xef, 0x00, 0x05, 0x40, 0x06, 0xba, 0xca, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, /* final frag */ 0xb1, 0xa3, }; uint8_t tunnel_pkt[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3e, 0xe9, 0xef, 0x00, 0x00, 0x40, 0x06, 0xba, 0xae, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, 0xb1, 0xa3, 0x00, 0x10, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, 0xb1, 0xa3, 0x00, 0x10, 0x01, 0x02, 0x03, 0x04, 0xb1, 0xa3, }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; int result = 0; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); FlowInitConfig(FLOW_QUIET); DefragInit(); PacketCopyData(p, pkt1, sizeof(pkt1)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt2, sizeof(pkt2)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); goto end; } PACKET_RECYCLE(p); p->recursion_level = 3; PacketCopyData(p, pkt3, sizeof(pkt3)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); goto end; } Packet *tp = PacketDequeue(&pq); if (tp == NULL) { printf("Failed to get defragged pseudo packet\n"); goto end; } if (tp->recursion_level != p->recursion_level) { printf("defragged pseudo packet's and parent packet's recursion " "level don't match %d != %d: ", tp->recursion_level, p->recursion_level); goto end; } if (tp->ip4h == NULL || tp->tcph == NULL) { printf("pseudo packet's ip header and tcp header shouldn't be NULL, " "but it is\n"); goto end; } if (GET_PKT_LEN(tp) != sizeof(tunnel_pkt)) { printf("defragged pseudo packet's and parent packet's pkt lens " "don't match %u != %"PRIuMAX": ", GET_PKT_LEN(tp), (uintmax_t)sizeof(tunnel_pkt)); goto end; } if (memcmp(GET_PKT_DATA(tp), tunnel_pkt, sizeof(tunnel_pkt)) != 0) { goto end; } result = 1; PACKET_RECYCLE(tp); SCFree(tp); end: DefragDestroy(); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \test IPV4 defrag and flow retrieval test. */ int DecodeIPV4DefragTest03(void) { uint8_t pkt[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x28, 0xe9, 0xee, 0x00, 0x00, 0x40, 0x06, 0xba, 0xbd, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5d, 0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x80, 0x00, 0x0c, 0xee, 0x00, 0x00 }; uint8_t pkt1[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x1c, 0xe9, 0xef, 0x20, 0x00, 0x40, 0x06, 0x9a, 0xc8, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e }; uint8_t pkt2[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x1c, 0xe9, 0xef, 0x20, 0x01, 0x40, 0x06, 0x9a, 0xc7, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00 }; uint8_t pkt3[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x18, 0xe9, 0xef, 0x00, 0x02, 0x40, 0x06, 0xba, 0xca, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0xb1, 0xa3, 0x00, 0x00 }; uint8_t tunnel_pkt[] = { 0x00, 0x50, 0x56, 0x00, 0x03, 0x05, 0xde, 0xad, 0x01, 0xa3, 0xa2, 0x2f, 0x08, 0x00, 0x45, 0x00, 0x00, 0x28, 0xe9, 0xef, 0x00, 0x00, 0x40, 0x06, 0xba, 0xbc, 0x0a, 0x00, 0xe1, 0x17, 0x0a, 0x00, 0xe1, 0x0c, 0x6e, 0x12, 0x01, 0xbd, 0x5b, 0xa3, 0x81, 0x5e, 0xac, 0xb0, 0xae, 0x8a, 0x50, 0x10, 0x80, 0x00, 0xb1, 0xa3, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; int result = 1; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&pq, 0, sizeof(PacketQueue)); FlowInitConfig(FLOW_QUIET); DefragInit(); PacketCopyData(p, pkt, sizeof(pkt)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph == NULL) { printf("tcp header shouldn't be NULL, but it is\n"); result = 0; goto end; } if (!(p->flags & PKT_WANTS_FLOW)) { printf("packet flow shouldn't be NULL\n"); result = 0; goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt1, sizeof(pkt1)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt2, sizeof(pkt2)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } PACKET_RECYCLE(p); PacketCopyData(p, pkt3, sizeof(pkt3)); DecodeIPV4(&tv, &dtv, p, GET_PKT_DATA(p) + ETHERNET_HEADER_LEN, GET_PKT_LEN(p) - ETHERNET_HEADER_LEN, &pq); if (p->tcph != NULL) { printf("tcp header should be NULL for ip fragment, but it isn't\n"); result = 0; goto end; } Packet *tp = PacketDequeue(&pq); if (tp == NULL) { printf("Failed to get defragged pseudo packet\n"); result = 0; goto end; } if (!(tp->flags & PKT_WANTS_FLOW)) { result = 0; goto end; } if (tp->flow_hash != p->flow_hash) { result = 0; goto end; } if (tp->recursion_level != p->recursion_level) { printf("defragged pseudo packet's and parent packet's recursion " "level don't match\n %d != %d", tp->recursion_level, p->recursion_level); result = 0; goto end; } if (tp->ip4h == NULL || tp->tcph == NULL) { printf("pseudo packet's ip header and tcp header shouldn't be NULL, " "but it is\n"); result = 0; goto end; } if (GET_PKT_LEN(tp) != sizeof(tunnel_pkt)) { printf("defragged pseudo packet's and parent packet's pkt lens " "don't match\n %u != %"PRIuMAX, GET_PKT_LEN(tp), (uintmax_t)sizeof(tunnel_pkt)); result = 0; goto end; } if (memcmp(GET_PKT_DATA(tp), tunnel_pkt, sizeof(tunnel_pkt)) != 0) { result = 0; goto end; } PACKET_RECYCLE(tp); SCFree(tp); end: DefragDestroy(); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } #endif /* UNITTESTS */ void DecodeIPV4RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeIPV4OptionsNONETest01", DecodeIPV4OptionsNONETest01); UtRegisterTest("DecodeIPV4OptionsEOLTest01", DecodeIPV4OptionsEOLTest01); UtRegisterTest("DecodeIPV4OptionsNOPTest01", DecodeIPV4OptionsNOPTest01); UtRegisterTest("DecodeIPV4OptionsRRTest01", DecodeIPV4OptionsRRTest01); UtRegisterTest("DecodeIPV4OptionsRRTest02", DecodeIPV4OptionsRRTest02); UtRegisterTest("DecodeIPV4OptionsRRTest03", DecodeIPV4OptionsRRTest03); UtRegisterTest("DecodeIPV4OptionsRRTest04", DecodeIPV4OptionsRRTest04); UtRegisterTest("DecodeIPV4OptionsQSTest01", DecodeIPV4OptionsQSTest01); UtRegisterTest("DecodeIPV4OptionsQSTest02", DecodeIPV4OptionsQSTest02); UtRegisterTest("DecodeIPV4OptionsTSTest01", DecodeIPV4OptionsTSTest01); UtRegisterTest("DecodeIPV4OptionsTSTest02", DecodeIPV4OptionsTSTest02); UtRegisterTest("DecodeIPV4OptionsTSTest03", DecodeIPV4OptionsTSTest03); UtRegisterTest("DecodeIPV4OptionsTSTest04", DecodeIPV4OptionsTSTest04); UtRegisterTest("DecodeIPV4OptionsSECTest01", DecodeIPV4OptionsSECTest01); UtRegisterTest("DecodeIPV4OptionsSECTest02", DecodeIPV4OptionsSECTest02); UtRegisterTest("DecodeIPV4OptionsLSRRTest01", DecodeIPV4OptionsLSRRTest01); UtRegisterTest("DecodeIPV4OptionsLSRRTest02", DecodeIPV4OptionsLSRRTest02); UtRegisterTest("DecodeIPV4OptionsLSRRTest03", DecodeIPV4OptionsLSRRTest03); UtRegisterTest("DecodeIPV4OptionsLSRRTest04", DecodeIPV4OptionsLSRRTest04); UtRegisterTest("DecodeIPV4OptionsCIPSOTest01", DecodeIPV4OptionsCIPSOTest01); UtRegisterTest("DecodeIPV4OptionsSIDTest01", DecodeIPV4OptionsSIDTest01); UtRegisterTest("DecodeIPV4OptionsSIDTest02", DecodeIPV4OptionsSIDTest02); UtRegisterTest("DecodeIPV4OptionsSSRRTest01", DecodeIPV4OptionsSSRRTest01); UtRegisterTest("DecodeIPV4OptionsSSRRTest02", DecodeIPV4OptionsSSRRTest02); UtRegisterTest("DecodeIPV4OptionsSSRRTest03", DecodeIPV4OptionsSSRRTest03); UtRegisterTest("DecodeIPV4OptionsSSRRTest04", DecodeIPV4OptionsSSRRTest04); UtRegisterTest("DecodeIPV4OptionsRTRALTTest01", DecodeIPV4OptionsRTRALTTest01); UtRegisterTest("DecodeIPV4OptionsRTRALTTest02", DecodeIPV4OptionsRTRALTTest02); UtRegisterTest("IPV4CalculateValidChecksumtest01", IPV4CalculateValidChecksumtest01); UtRegisterTest("IPV4CalculateInvalidChecksumtest02", IPV4CalculateInvalidChecksumtest02); UtRegisterTest("DecodeIPV4DefragTest01", DecodeIPV4DefragTest01); UtRegisterTest("DecodeIPV4DefragTest02", DecodeIPV4DefragTest02); UtRegisterTest("DecodeIPV4DefragTest03", DecodeIPV4DefragTest03); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-engine-enip.h0000644000000000000000000000251013051004444014614 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Kevin Wong */ #ifndef __DETECT_ENGINE_ENIP_H__ #define __DETECT_ENGINE_ENIP_H__ int DetectEngineInspectCIP(ThreadVars *, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, void *, uint64_t); int DetectEngineInspectENIP(ThreadVars *, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, void *, uint64_t); void DetectEngineInspectENIPRegisterTests(void); #endif /* __DETECT_ENGINE_ENIP_H__ */ suricata-3.2.1/src/util-reference-config.h0000644000000000000000000000350413051004444015330 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_REFERENCE_CONFIG_H__ #define __UTIL_REFERENCE_CONFIG_H__ /** * \brief Holds a reference from the file - reference.config. */ typedef struct SCRConfReference_ { /* The system name. This is the primary key for a reference. */ char *system; /* The url for the above reference */ char *url; } SCRConfReference; SCRConfReference *SCRConfAllocSCRConfReference(const char *, const char *); void SCRConfDeAllocSCRConfReference(SCRConfReference *); int SCRConfLoadReferenceConfigFile(DetectEngineCtx *, FILE *); void SCRConfDeInitContext(DetectEngineCtx *); SCRConfReference *SCRConfGetReference(const char *, DetectEngineCtx *); void SCRConfRegisterTests(void); /* these below functions are only used by unittests */ FILE *SCRConfGenerateValidDummyReferenceConfigFD01(void); FILE *SCRConfGenerateInValidDummyReferenceConfigFD02(void); FILE *SCRConfGenerateInValidDummyReferenceConfigFD03(void); void SCReferenceConfInit(void); void SCReferenceConfDeinit(void); #endif /* __UTIL_REFERENCE_CONFIG_H__ */ suricata-3.2.1/src/win32-misc.h0000644000000000000000000000231513051004444013046 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jan Jezek */ #ifndef __WIN32_MISC_H__ #define __WIN32_MISC_H__ #define index strchr #define rindex strrchr #define bzero(s, n) memset(s, 0, n) #ifndef O_NOFOLLOW #define O_NOFOLLOW 0 #endif /* O_NOFOLLOW */ void setenv(const char *name, const char *value, int overwrite); void unsetenv(const char *name); const char* inet_ntop(int af, const void *src, char *dst, uint32_t cnt); int inet_pton(int af, const char *src, void *dst); #define geteuid() (0) #endif suricata-3.2.1/src/app-layer-htp.c0000644000000000000000000064505713051004444013651 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Victor Julien * \author Gurvinder Singh * \author Pablo Rincon * \author Brian Rectanus * \author Anoop Saldanha * * This file provides a HTTP protocol support for the engine using HTP library. */ #include "suricata.h" #include "suricata-common.h" #include "conf.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "counters.h" #include "util-print.h" #include "util-pool.h" #include "util-radix-tree.h" #include "util-file.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-htp-body.h" #include "app-layer-htp-file.h" #include "app-layer-htp-libhtp.h" #include "app-layer-htp-xff.h" #include "util-spm.h" #include "util-debug.h" #include "util-time.h" #include "util-misc.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow-util.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-parse.h" #include "decode-events.h" #include "util-memcmp.h" //#define PRINT /** Fast lookup tree (radix) for the various HTP configurations */ static SCRadixTree *cfgtree; /** List of HTP configurations. */ static HTPCfgRec cfglist; #ifdef DEBUG static SCMutex htp_state_mem_lock = SCMUTEX_INITIALIZER; static uint64_t htp_state_memuse = 0; static uint64_t htp_state_memcnt = 0; #endif SCEnumCharMap http_decoder_event_table[ ] = { { "UNKNOWN_ERROR", HTTP_DECODER_EVENT_UNKNOWN_ERROR}, { "GZIP_DECOMPRESSION_FAILED", HTTP_DECODER_EVENT_GZIP_DECOMPRESSION_FAILED}, { "REQUEST_FIELD_MISSING_COLON", HTTP_DECODER_EVENT_REQUEST_FIELD_MISSING_COLON}, { "RESPONSE_FIELD_MISSING_COLON", HTTP_DECODER_EVENT_RESPONSE_FIELD_MISSING_COLON}, { "INVALID_REQUEST_CHUNK_LEN", HTTP_DECODER_EVENT_INVALID_REQUEST_CHUNK_LEN}, { "INVALID_RESPONSE_CHUNK_LEN", HTTP_DECODER_EVENT_INVALID_RESPONSE_CHUNK_LEN}, { "INVALID_TRANSFER_ENCODING_VALUE_IN_REQUEST", HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_REQUEST}, { "INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE", HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE}, { "INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST", HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST}, { "INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE", HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE}, { "100_CONTINUE_ALREADY_SEEN", HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN}, { "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST", HTTP_DECODER_EVENT_UNABLE_TO_MATCH_RESPONSE_TO_REQUEST}, { "INVALID_SERVER_PORT_IN_REQUEST", HTTP_DECODER_EVENT_INVALID_SERVER_PORT_IN_REQUEST}, { "INVALID_AUTHORITY_PORT", HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT}, { "REQUEST_HEADER_INVALID", HTTP_DECODER_EVENT_REQUEST_HEADER_INVALID}, { "RESPONSE_HEADER_INVALID", HTTP_DECODER_EVENT_RESPONSE_HEADER_INVALID}, { "MISSING_HOST_HEADER", HTTP_DECODER_EVENT_MISSING_HOST_HEADER}, { "HOST_HEADER_AMBIGUOUS", HTTP_DECODER_EVENT_HOST_HEADER_AMBIGUOUS}, { "INVALID_REQUEST_FIELD_FOLDING", HTTP_DECODER_EVENT_INVALID_REQUEST_FIELD_FOLDING}, { "INVALID_RESPONSE_FIELD_FOLDING", HTTP_DECODER_EVENT_INVALID_RESPONSE_FIELD_FOLDING}, { "REQUEST_FIELD_TOO_LONG", HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG}, { "RESPONSE_FIELD_TOO_LONG", HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG}, { "REQUEST_SERVER_PORT_TCP_PORT_MISMATCH", HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH}, { "REQUEST_URI_HOST_INVALID", HTTP_DECODER_EVENT_URI_HOST_INVALID}, { "REQUEST_HEADER_HOST_INVALID", HTTP_DECODER_EVENT_HEADER_HOST_INVALID}, { "URI_DELIM_NON_COMPLIANT", HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT}, { "METHOD_DELIM_NON_COMPLIANT", HTTP_DECODER_EVENT_METHOD_DELIM_NON_COMPLIANT}, { "REQUEST_LINE_LEADING_WHITESPACE", HTTP_DECODER_EVENT_REQUEST_LINE_LEADING_WHITESPACE}, /* suricata warnings/errors */ { "MULTIPART_GENERIC_ERROR", HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR}, { "MULTIPART_NO_FILEDATA", HTTP_DECODER_EVENT_MULTIPART_NO_FILEDATA}, { "MULTIPART_INVALID_HEADER", HTTP_DECODER_EVENT_MULTIPART_INVALID_HEADER}, { NULL, -1 }, }; static void *HTPStateGetTx(void *alstate, uint64_t tx_id); static int HTPStateGetAlstateProgress(void *tx, uint8_t direction); static uint64_t HTPStateGetTxCnt(void *alstate); static int HTPStateGetAlstateProgressCompletionStatus(uint8_t direction); #ifdef DEBUG /** * \internal * * \brief Lookup the HTP personality string from the numeric personality. * * \todo This needs to be a libhtp function. */ static const char *HTPLookupPersonalityString(int p) { #define CASE_HTP_PERSONALITY_STRING(p) \ case HTP_SERVER_ ## p: return #p switch (p) { CASE_HTP_PERSONALITY_STRING(MINIMAL); CASE_HTP_PERSONALITY_STRING(GENERIC); CASE_HTP_PERSONALITY_STRING(IDS); CASE_HTP_PERSONALITY_STRING(IIS_4_0); CASE_HTP_PERSONALITY_STRING(IIS_5_0); CASE_HTP_PERSONALITY_STRING(IIS_5_1); CASE_HTP_PERSONALITY_STRING(IIS_6_0); CASE_HTP_PERSONALITY_STRING(IIS_7_0); CASE_HTP_PERSONALITY_STRING(IIS_7_5); CASE_HTP_PERSONALITY_STRING(APACHE_2); } return NULL; } #endif /* DEBUG */ /** * \internal * * \brief Lookup the numeric HTP personality from a string. * * \todo This needs to be a libhtp function. */ static int HTPLookupPersonality(const char *str) { #define IF_HTP_PERSONALITY_NUM(p) \ if (strcasecmp(#p, str) == 0) return HTP_SERVER_ ## p IF_HTP_PERSONALITY_NUM(MINIMAL); IF_HTP_PERSONALITY_NUM(GENERIC); IF_HTP_PERSONALITY_NUM(IDS); IF_HTP_PERSONALITY_NUM(IIS_4_0); IF_HTP_PERSONALITY_NUM(IIS_5_0); IF_HTP_PERSONALITY_NUM(IIS_5_1); IF_HTP_PERSONALITY_NUM(IIS_6_0); IF_HTP_PERSONALITY_NUM(IIS_7_0); IF_HTP_PERSONALITY_NUM(IIS_7_5); IF_HTP_PERSONALITY_NUM(APACHE_2); if (strcasecmp("TOMCAT_6_0", str) == 0) { SCLogError(SC_WARN_OPTION_OBSOLETE, "Personality %s no " "longer supported by libhtp.", str); return -1; } else if ((strcasecmp("APACHE", str) == 0) || (strcasecmp("APACHE_2_2", str) == 0)) { SCLogWarning(SC_WARN_OPTION_OBSOLETE, "Personality %s no " "longer supported by libhtp, failing back to " "Apache2 personality.", str); return HTP_SERVER_APACHE_2; } return -1; } void HTPSetEvent(HtpState *s, HtpTxUserData *htud, uint8_t e) { SCLogDebug("setting event %u", e); if (htud) { AppLayerDecoderEventsSetEventRaw(&htud->decoder_events, e); s->events++; return; } htp_tx_t *tx = HTPStateGetTx(s, s->transaction_cnt); if (tx != NULL) { htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud != NULL) { AppLayerDecoderEventsSetEventRaw(&htud->decoder_events, e); s->events++; return; } } SCLogDebug("couldn't set event %u", e); } static int HTPHasEvents(void *state) { HtpState *htp_state = (HtpState *)state; return (htp_state->events > 0); } static AppLayerDecoderEvents *HTPGetEvents(void *state, uint64_t tx_id) { SCLogDebug("get HTTP events for TX %"PRIu64, tx_id); HtpState *s = (HtpState *)state; htp_tx_t *tx = HTPStateGetTx(s, tx_id); if (tx != NULL) { HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud != NULL) { SCLogDebug("has htud, htud->decoder_events %p", htud->decoder_events); return htud->decoder_events; } } return NULL; } /** \brief Function to allocates the HTTP state memory and also creates the HTTP * connection parser to be used by the HTP library */ static void *HTPStateAlloc(void) { SCEnter(); HtpState *s = HTPMalloc(sizeof(HtpState)); if (unlikely(s == NULL)) { SCReturnPtr(NULL, "void"); } memset(s, 0x00, sizeof(HtpState)); #ifdef DEBUG SCMutexLock(&htp_state_mem_lock); htp_state_memcnt++; htp_state_memuse += sizeof(HtpState); SCLogDebug("htp memory %"PRIu64" (%"PRIu64")", htp_state_memuse, htp_state_memcnt); SCMutexUnlock(&htp_state_mem_lock); #endif SCReturnPtr((void *)s, "void"); } static void HtpTxUserDataFree(HtpState *state, HtpTxUserData *htud) { if (likely(htud)) { HtpBodyFree(&htud->request_body); HtpBodyFree(&htud->response_body); bstr_free(htud->request_uri_normalized); if (htud->request_headers_raw) HTPFree(htud->request_headers_raw, htud->request_headers_raw_len); if (htud->response_headers_raw) HTPFree(htud->response_headers_raw, htud->response_headers_raw_len); AppLayerDecoderEventsFreeEvents(&htud->decoder_events); if (htud->boundary) HTPFree(htud->boundary, htud->boundary_len); if (htud->de_state != NULL) { if (likely(state != NULL)) { // should be impossible that it's null BUG_ON(state->tx_with_detect_state_cnt == 0); state->tx_with_detect_state_cnt--; } DetectEngineStateFree(htud->de_state); } HTPFree(htud, sizeof(HtpTxUserData)); } } /** \brief Function to frees the HTTP state memory and also frees the HTTP * connection parser memory which was used by the HTP library */ void HTPStateFree(void *state) { SCEnter(); HtpState *s = (HtpState *)state; if (s == NULL) { SCReturn; } /* Unset the body inspection */ s->flags &=~ HTP_FLAG_NEW_BODY_SET; /* free the connection parser memory used by HTP library */ if (s->connp != NULL) { SCLogDebug("freeing HTP state"); uint64_t tx_id; uint64_t total_txs = HTPStateGetTxCnt(state); /* free the list of body chunks */ if (s->conn != NULL) { for (tx_id = 0; tx_id < total_txs; tx_id++) { htp_tx_t *tx = HTPStateGetTx(s, tx_id); if (tx != NULL) { HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); HtpTxUserDataFree(s, htud); htp_tx_set_user_data(tx, NULL); } } } htp_connp_destroy_all(s->connp); } BUG_ON(s->tx_with_detect_state_cnt > 0); FileContainerFree(s->files_ts); FileContainerFree(s->files_tc); HTPFree(s, sizeof(HtpState)); #ifdef DEBUG SCMutexLock(&htp_state_mem_lock); htp_state_memcnt--; htp_state_memuse -= sizeof(HtpState); SCLogDebug("htp memory %"PRIu64" (%"PRIu64")", htp_state_memuse, htp_state_memcnt); SCMutexUnlock(&htp_state_mem_lock); #endif SCReturn; } /** * \brief HTP transaction cleanup callback * * \warning We cannot actually free the transactions here. It seems that * HTP only accepts freeing of transactions in the response callback. */ static void HTPStateTransactionFree(void *state, uint64_t id) { SCEnter(); HtpState *s = (HtpState *)state; SCLogDebug("state %p, id %"PRIu64, s, id); htp_tx_t *tx = HTPStateGetTx(s, id); if (tx != NULL) { /* This will remove obsolete body chunks */ HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); HtpTxUserDataFree(s, htud); htp_tx_set_user_data(tx, NULL); /* hack: even if libhtp considers the tx incomplete, we want to * free it here. htp_tx_destroy however, will refuse to do this. * As htp_tx_destroy_incomplete isn't available in the public API, * we hack around it here. */ if (unlikely(!( tx->request_progress == HTP_REQUEST_COMPLETE && tx->response_progress == HTP_RESPONSE_COMPLETE))) { tx->request_progress = HTP_REQUEST_COMPLETE; tx->response_progress = HTP_RESPONSE_COMPLETE; } htp_tx_destroy(tx); } } /** * \brief Sets a flag that informs the HTP app layer that some module in the * engine needs the http request body data. * \initonly */ void AppLayerHtpEnableRequestBodyCallback(void) { SCEnter(); SC_ATOMIC_OR(htp_config_flags, HTP_REQUIRE_REQUEST_BODY); SCReturn; } /** * \brief Sets a flag that informs the HTP app layer that some module in the * engine needs the http request body data. * \initonly */ void AppLayerHtpEnableResponseBodyCallback(void) { SCEnter(); SC_ATOMIC_OR(htp_config_flags, HTP_REQUIRE_RESPONSE_BODY); SCReturn; } /** * \brief Sets a flag that informs the HTP app layer that some module in the * engine needs the http request multi part header. * * \initonly */ void AppLayerHtpNeedMultipartHeader(void) { SCEnter(); AppLayerHtpEnableRequestBodyCallback(); SC_ATOMIC_OR(htp_config_flags, HTP_REQUIRE_REQUEST_MULTIPART); SCReturn; } /** * \brief Sets a flag that informs the HTP app layer that some module in the * engine needs the http request file. * * \initonly */ void AppLayerHtpNeedFileInspection(void) { SCEnter(); AppLayerHtpNeedMultipartHeader(); AppLayerHtpEnableRequestBodyCallback(); AppLayerHtpEnableResponseBodyCallback(); SC_ATOMIC_OR(htp_config_flags, HTP_REQUIRE_REQUEST_FILE); SCReturn; } /* below error messages updated up to libhtp 0.5.7 (git 379632278b38b9a792183694a4febb9e0dbd1e7a) */ struct { char *msg; int de; } htp_errors[] = { { "GZip decompressor: inflateInit2 failed", HTTP_DECODER_EVENT_GZIP_DECOMPRESSION_FAILED}, { "Request field invalid: colon missing", HTTP_DECODER_EVENT_REQUEST_FIELD_MISSING_COLON}, { "Response field invalid: missing colon", HTTP_DECODER_EVENT_RESPONSE_FIELD_MISSING_COLON}, { "Request chunk encoding: Invalid chunk length", HTTP_DECODER_EVENT_INVALID_REQUEST_CHUNK_LEN}, { "Response chunk encoding: Invalid chunk length", HTTP_DECODER_EVENT_INVALID_RESPONSE_CHUNK_LEN}, /* { "Invalid T-E value in request", HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_REQUEST}, <- tx flag HTP_REQUEST_INVALID_T_E { "Invalid T-E value in response", HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE}, <- nothing to replace it */ /* { "Invalid C-L field in request", HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST}, <- tx flag HTP_REQUEST_INVALID_C_L */ { "Invalid C-L field in response", HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE}, { "Already seen 100-Continue", HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN}, { "Unable to match response to request", HTTP_DECODER_EVENT_UNABLE_TO_MATCH_RESPONSE_TO_REQUEST}, { "Invalid server port information in request", HTTP_DECODER_EVENT_INVALID_SERVER_PORT_IN_REQUEST}, /* { "Invalid authority port", HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT}, htp no longer returns this error */ { "Request buffer over", HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG}, { "Response buffer over", HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG}, }; struct { char *msg; int de; } htp_warnings[] = { { "GZip decompressor:", HTTP_DECODER_EVENT_GZIP_DECOMPRESSION_FAILED}, { "Request field invalid", HTTP_DECODER_EVENT_REQUEST_HEADER_INVALID}, { "Response field invalid", HTTP_DECODER_EVENT_RESPONSE_HEADER_INVALID}, { "Request header name is not a token", HTTP_DECODER_EVENT_REQUEST_HEADER_INVALID}, { "Response header name is not a token", HTTP_DECODER_EVENT_RESPONSE_HEADER_INVALID}, /* { "Host information in request headers required by HTTP/1.1", HTTP_DECODER_EVENT_MISSING_HOST_HEADER}, <- tx flag HTP_HOST_MISSING { "Host information ambiguous", HTTP_DECODER_EVENT_HOST_HEADER_AMBIGUOUS}, <- tx flag HTP_HOST_AMBIGUOUS */ { "Invalid request field folding", HTTP_DECODER_EVENT_INVALID_REQUEST_FIELD_FOLDING}, { "Invalid response field folding", HTTP_DECODER_EVENT_INVALID_RESPONSE_FIELD_FOLDING}, /* line is now: htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Request server port=%d number differs from the actual TCP port=%d", port, connp->conn->server_port); * luckily, "Request server port=" is unique */ /* { "Request server port number differs from the actual TCP port", HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH}, */ { "Request server port=", HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH}, { "Request line: URI contains non-compliant delimiter", HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT}, { "Request line: non-compliant delimiter between Method and URI", HTTP_DECODER_EVENT_METHOD_DELIM_NON_COMPLIANT}, { "Request line: leading whitespace", HTTP_DECODER_EVENT_REQUEST_LINE_LEADING_WHITESPACE}, }; #define HTP_ERROR_MAX (sizeof(htp_errors) / sizeof(htp_errors[0])) #define HTP_WARNING_MAX (sizeof(htp_warnings) / sizeof(htp_warnings[0])) /** * \internal * * \brief Get the warning id for the warning msg. * * \param msg warning message * * \retval id the id or 0 in case of not found */ static int HTPHandleWarningGetId(const char *msg) { SCLogDebug("received warning \"%s\"", msg); size_t idx; for (idx = 0; idx < HTP_WARNING_MAX; idx++) { if (strncmp(htp_warnings[idx].msg, msg, strlen(htp_warnings[idx].msg)) == 0) { return htp_warnings[idx].de; } } return 0; } /** * \internal * * \brief Get the error id for the error msg. * * \param msg error message * * \retval id the id or 0 in case of not found */ static int HTPHandleErrorGetId(const char *msg) { SCLogDebug("received error \"%s\"", msg); size_t idx; for (idx = 0; idx < HTP_ERROR_MAX; idx++) { if (strncmp(htp_errors[idx].msg, msg, strlen(htp_errors[idx].msg)) == 0) { return htp_errors[idx].de; } } return 0; } /** * \internal * * \brief Check state for errors, warnings and add any as events * * \param s state */ static void HTPHandleError(HtpState *s) { if (s == NULL || s->conn == NULL || s->conn->messages == NULL) { return; } size_t size = htp_list_size(s->conn->messages); size_t msg; for (msg = s->htp_messages_offset; msg < size; msg++) { htp_log_t *log = htp_list_get(s->conn->messages, msg); if (log == NULL) continue; HtpTxUserData *htud = NULL; htp_tx_t *tx = log->tx; // will be NULL in <=0.5.9 if (tx != NULL) htud = (HtpTxUserData *) htp_tx_get_user_data(tx); SCLogDebug("message %s", log->msg); int id = HTPHandleErrorGetId(log->msg); if (id == 0) { id = HTPHandleWarningGetId(log->msg); if (id == 0) id = HTTP_DECODER_EVENT_UNKNOWN_ERROR; } if (id > 0) { HTPSetEvent(s, htud, id); } } s->htp_messages_offset = (uint16_t)msg; SCLogDebug("s->htp_messages_offset %u", s->htp_messages_offset); } static inline void HTPErrorCheckTxRequestFlags(HtpState *s, htp_tx_t *tx) { #ifdef DEBUG BUG_ON(s == NULL || tx == NULL); #endif if (tx->flags & ( HTP_REQUEST_INVALID_T_E|HTP_REQUEST_INVALID_C_L| HTP_HOST_MISSING|HTP_HOST_AMBIGUOUS|HTP_HOSTU_INVALID| HTP_HOSTH_INVALID)) { HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud == NULL) return; if (tx->flags & HTP_REQUEST_INVALID_T_E) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_REQUEST); if (tx->flags & HTP_REQUEST_INVALID_C_L) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST); if (tx->flags & HTP_HOST_MISSING) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_MISSING_HOST_HEADER); if (tx->flags & HTP_HOST_AMBIGUOUS) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_HOST_HEADER_AMBIGUOUS); if (tx->flags & HTP_HOSTU_INVALID) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_URI_HOST_INVALID); if (tx->flags & HTP_HOSTH_INVALID) HTPSetEvent(s, htud, HTTP_DECODER_EVENT_HEADER_HOST_INVALID); } } /** * \brief Function to handle the reassembled data from client and feed it to * the HTP library to process it. * * \param flow Pointer to the flow the data belong to * \param htp_state Pointer the state in which the parsed value to be stored * \param pstate Application layer parser state for this session * \param input Pointer the received HTTP client data * \param input_len Length in bytes of the received data * \param output Pointer to the output (not used in this function) * * \retval On success returns 1 or on failure returns -1. */ static int HTPHandleRequestData(Flow *f, void *htp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); int r = -1; int ret = 1; //PrintRawDataFp(stdout, input, input_len); HtpState *hstate = (HtpState *)htp_state; hstate->f = f; /* On the first invocation, create the connection parser structure to * be used by HTP library. This is looked up via IP in the radix * tree. Failing that, the default HTP config is used. */ if (NULL == hstate->conn) { HTPCfgRec *htp_cfg_rec = &cfglist; htp_cfg_t *htp = cfglist.cfg; /* Default to the global HTP config */ void *user_data = NULL; if (FLOW_IS_IPV4(f)) { SCLogDebug("Looking up HTP config for ipv4 %08x", *GET_IPV4_DST_ADDR_PTR(f)); (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)GET_IPV4_DST_ADDR_PTR(f), cfgtree, &user_data); } else if (FLOW_IS_IPV6(f)) { SCLogDebug("Looking up HTP config for ipv6"); (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)GET_IPV6_DST_ADDR(f), cfgtree, &user_data); } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "unknown address family, bug!"); goto error; } if (user_data != NULL) { htp_cfg_rec = user_data; htp = htp_cfg_rec->cfg; SCLogDebug("LIBHTP using config: %p", htp); } else { SCLogDebug("Using default HTP config: %p", htp); } if (NULL == htp) { #ifdef DEBUG_VALIDATION BUG_ON(htp == NULL); #endif /* should never happen if HTPConfigure is properly invoked */ goto error; } hstate->connp = htp_connp_create(htp); if (hstate->connp == NULL) { goto error; } hstate->conn = htp_connp_get_connection(hstate->connp); htp_connp_set_user_data(hstate->connp, (void *)hstate); hstate->cfg = htp_cfg_rec; SCLogDebug("New hstate->connp %p", hstate->connp); } /* the code block above should make sure connp is never NULL here */ #ifdef DEBUG_VALIDATION BUG_ON(hstate->connp == NULL); #endif /* Unset the body inspection (the callback should * reactivate it if necessary) */ hstate->flags &=~ HTP_FLAG_NEW_BODY_SET; /* Open the HTTP connection on receiving the first request */ if (!(hstate->flags & HTP_FLAG_STATE_OPEN)) { SCLogDebug("opening htp handle at %p", hstate->connp); htp_connp_open(hstate->connp, NULL, f->sp, NULL, f->dp, &f->startts); hstate->flags |= HTP_FLAG_STATE_OPEN; } else { SCLogDebug("using existing htp handle at %p", hstate->connp); } htp_time_t ts = { f->lastts.tv_sec, f->lastts.tv_usec }; /* pass the new data to the htp parser */ if (input_len > 0) { r = htp_connp_req_data(hstate->connp, &ts, input, input_len); switch(r) { case HTP_STREAM_ERROR: hstate->flags |= HTP_FLAG_STATE_ERROR; hstate->flags &= ~HTP_FLAG_STATE_DATA; hstate->flags &= ~HTP_FLAG_NEW_BODY_SET; ret = -1; break; case HTP_STREAM_DATA: case HTP_STREAM_DATA_OTHER: hstate->flags |= HTP_FLAG_STATE_DATA; break; case HTP_STREAM_TUNNEL: break; default: hstate->flags &= ~HTP_FLAG_STATE_DATA; hstate->flags &= ~HTP_FLAG_NEW_BODY_SET; } HTPHandleError(hstate); } /* if the TCP connection is closed, then close the HTTP connection */ if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) && !(hstate->flags & HTP_FLAG_STATE_CLOSED_TS)) { htp_connp_close(hstate->connp, &ts); hstate->flags |= HTP_FLAG_STATE_CLOSED_TS; SCLogDebug("stream eof encountered, closing htp handle for ts"); } SCLogDebug("hstate->connp %p", hstate->connp); SCReturnInt(ret); error: SCReturnInt(-1); } /** * \brief Function to handle the reassembled data from server and feed it to * the HTP library to process it. * * \param flow Pointer to the flow the data belong to * \param htp_state Pointer the state in which the parsed value to be stored * \param pstate Application layer parser state for this session * \param input Pointer the received HTTP server data * \param input_len Length in bytes of the received data * \param output Pointer to the output (not used in this function) * * \retval On success returns 1 or on failure returns -1 */ static int HTPHandleResponseData(Flow *f, void *htp_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); int r = -1; int ret = 1; HtpState *hstate = (HtpState *)htp_state; hstate->f = f; if (hstate->connp == NULL) { SCLogDebug("HTP state has no connp"); /* till we have the new libhtp changes that allow response first, * let's take response in first. */ //BUG_ON(1); SCReturnInt(-1); } /* Unset the body inspection (the callback should * reactivate it if necessary) */ hstate->flags &=~ HTP_FLAG_NEW_BODY_SET; htp_time_t ts = { f->lastts.tv_sec, f->lastts.tv_usec }; if (input_len > 0) { r = htp_connp_res_data(hstate->connp, &ts, input, input_len); switch(r) { case HTP_STREAM_ERROR: hstate->flags = HTP_FLAG_STATE_ERROR; hstate->flags &= ~HTP_FLAG_STATE_DATA; hstate->flags &= ~HTP_FLAG_NEW_BODY_SET; ret = -1; break; case HTP_STREAM_DATA: case HTP_STREAM_DATA_OTHER: hstate->flags |= HTP_FLAG_STATE_DATA; break; case HTP_STREAM_TUNNEL: break; default: hstate->flags &= ~HTP_FLAG_STATE_DATA; hstate->flags &= ~HTP_FLAG_NEW_BODY_SET; } HTPHandleError(hstate); } /* if we the TCP connection is closed, then close the HTTP connection */ if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) && !(hstate->flags & HTP_FLAG_STATE_CLOSED_TC)) { htp_connp_close(hstate->connp, &ts); hstate->flags |= HTP_FLAG_STATE_CLOSED_TC; } SCLogDebug("hstate->connp %p", hstate->connp); SCReturnInt(ret); } /** * \param name /Lowercase/ version of the variable name */ static int HTTPParseContentDispositionHeader(uint8_t *name, size_t name_len, uint8_t *data, size_t len, uint8_t **retptr, size_t *retlen) { #ifdef PRINT printf("DATA START: \n"); PrintRawDataFp(stdout, data, len); printf("DATA END: \n"); #endif size_t x; int quote = 0; for (x = 0; x < len; x++) { if (!(isspace(data[x]))) break; } if (x >= len) return 0; uint8_t *line = data+x; size_t line_len = len-x; size_t offset = 0; #ifdef PRINT printf("LINE START: \n"); PrintRawDataFp(stdout, line, line_len); printf("LINE END: \n"); #endif for (x = 0 ; x < line_len; x++) { if (x > 0) { if (line[x - 1] != '\\' && line[x] == '\"') { quote++; } if (((line[x - 1] != '\\' && line[x] == ';') || ((x + 1) == line_len)) && (quote == 0 || quote % 2 == 0)) { uint8_t *token = line + offset; size_t token_len = x - offset; if ((x + 1) == line_len) { token_len++; } offset = x + 1; while (offset < line_len && isspace(line[offset])) { x++; offset++; } #ifdef PRINT printf("TOKEN START: \n"); PrintRawDataFp(stdout, token, token_len); printf("TOKEN END: \n"); #endif if (token_len > name_len) { if (name == NULL || SCMemcmpLowercase(name, token, name_len) == 0) { uint8_t *value = token + name_len; size_t value_len = token_len - name_len; if (value[0] == '\"') { value++; value_len--; } if (value[value_len-1] == '\"') { value_len--; } #ifdef PRINT printf("VALUE START: \n"); PrintRawDataFp(stdout, value, value_len); printf("VALUE END: \n"); #endif *retptr = value; *retlen = value_len; return 1; } } } } } return 0; } /** * \param name /Lowercase/ version of the variable name */ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len, uint8_t *data, size_t len, uint8_t **retptr, size_t *retlen) { SCEnter(); #ifdef PRINT printf("DATA START: \n"); PrintRawDataFp(stdout, data, len); printf("DATA END: \n"); #endif size_t x; int quote = 0; for (x = 0; x < len; x++) { if (!(isspace(data[x]))) break; } if (x >= len) { SCReturnInt(0); } uint8_t *line = data+x; size_t line_len = len-x; size_t offset = 0; #ifdef PRINT printf("LINE START: \n"); PrintRawDataFp(stdout, line, line_len); printf("LINE END: \n"); #endif for (x = 0 ; x < line_len; x++) { if (x > 0) { if (line[x - 1] != '\\' && line[x] == '\"') { quote++; } if (((line[x - 1] != '\\' && line[x] == ';') || ((x + 1) == line_len)) && (quote == 0 || quote % 2 == 0)) { uint8_t *token = line + offset; size_t token_len = x - offset; if ((x + 1) == line_len) { token_len++; } offset = x + 1; while (offset < line_len && isspace(line[offset])) { x++; offset++; } #ifdef PRINT printf("TOKEN START: \n"); PrintRawDataFp(stdout, token, token_len); printf("TOKEN END: \n"); #endif if (token_len > name_len) { if (name == NULL || SCMemcmpLowercase(name, token, name_len) == 0) { uint8_t *value = token + name_len; size_t value_len = token_len - name_len; if (value[0] == '\"') { value++; value_len--; } if (value[value_len-1] == '\"') { value_len--; } #ifdef PRINT printf("VALUE START: \n"); PrintRawDataFp(stdout, value, value_len); printf("VALUE END: \n"); #endif *retptr = value; *retlen = value_len; SCReturnInt(1); } } } } } SCReturnInt(0); } /** * \brief setup multipart parsing: extract boundary and store it * * \param d HTTP transaction * \param htud transaction userdata * * \retval 1 ok, multipart set up * \retval 0 ok, not multipart though * \retval -1 error: problem with the boundary * * If the request contains a multipart message, this function will * set the HTP_BOUNDARY_SET in the transaction. */ static int HtpRequestBodySetupMultipart(htp_tx_data_t *d, HtpTxUserData *htud) { htp_header_t *h = (htp_header_t *)htp_table_get_c(d->tx->request_headers, "Content-Type"); if (h != NULL && bstr_len(h->value) > 0) { uint8_t *boundary = NULL; size_t boundary_len = 0; int r = HTTPParseContentTypeHeader((uint8_t *)"boundary=", 9, (uint8_t *) bstr_ptr(h->value), bstr_len(h->value), &boundary, &boundary_len); if (r == 1) { #ifdef PRINT printf("BOUNDARY START: \n"); PrintRawDataFp(stdout, boundary, boundary_len); printf("BOUNDARY END: \n"); #endif if (boundary_len < HTP_BOUNDARY_MAX) { htud->boundary = HTPMalloc(boundary_len); if (htud->boundary == NULL) { return -1; } htud->boundary_len = (uint8_t)boundary_len; memcpy(htud->boundary, boundary, boundary_len); htud->tsflags |= HTP_BOUNDARY_SET; } else { SCLogDebug("invalid boundary"); return -1; } SCReturnInt(1); } //SCReturnInt(1); } SCReturnInt(0); } #define C_D_HDR "content-disposition:" #define C_D_HDR_LEN 20 #define C_T_HDR "content-type:" #define C_T_HDR_LEN 13 static void HtpRequestBodyMultipartParseHeader(HtpState *hstate, HtpTxUserData *htud, uint8_t *header, uint32_t header_len, uint8_t **filename, uint16_t *filename_len, uint8_t **filetype, uint16_t *filetype_len) { uint8_t *fn = NULL; size_t fn_len = 0; uint8_t *ft = NULL; size_t ft_len = 0; #ifdef PRINT printf("HEADER START: \n"); PrintRawDataFp(stdout, header, header_len); printf("HEADER END: \n"); #endif while (header_len > 0) { uint8_t *next_line = Bs2bmSearch(header, header_len, (uint8_t *)"\r\n", 2); uint8_t *line = header; uint32_t line_len; if (next_line == NULL) { line_len = header_len; } else { line_len = next_line - header; } uint8_t *sc = (uint8_t *)memchr(line, ':', line_len); if (sc == NULL) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_INVALID_HEADER); /* if the : we found is the final char, it means we have * no value */ } else if (line_len > 0 && sc == &line[line_len - 1]) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_INVALID_HEADER); } else { #ifdef PRINT printf("LINE START: \n"); PrintRawDataFp(stdout, line, line_len); printf("LINE END: \n"); #endif if (line_len >= C_D_HDR_LEN && SCMemcmpLowercase(C_D_HDR, line, C_D_HDR_LEN) == 0) { uint8_t *value = line + C_D_HDR_LEN; uint32_t value_len = line_len - C_D_HDR_LEN; /* parse content-disposition */ (void)HTTPParseContentDispositionHeader((uint8_t *)"filename=", 9, value, value_len, &fn, &fn_len); } else if (line_len >= C_T_HDR_LEN && SCMemcmpLowercase(C_T_HDR, line, C_T_HDR_LEN) == 0) { SCLogDebug("content-type line"); uint8_t *value = line + C_T_HDR_LEN; uint32_t value_len = line_len - C_T_HDR_LEN; (void)HTTPParseContentTypeHeader(NULL, 0, value, value_len, &ft, &ft_len); } } if (next_line == NULL) { SCLogDebug("no next_line"); break; } header_len -= ((next_line + 2) - header); header = next_line + 2; } /* while (header_len > 0) */ if (fn_len > USHRT_MAX) fn_len = USHRT_MAX; if (ft_len > USHRT_MAX) ft_len = USHRT_MAX; *filename = fn; *filename_len = fn_len; *filetype = ft; *filetype_len = ft_len; } /** * \brief Create a single buffer from the HtpBodyChunks in our list * * \param htud transaction user data * \param chunks_buffers pointer to pass back the buffer to the caller * \param chunks_buffer_len pointer to pass back the buffer length to the caller */ static void HtpRequestBodyReassemble(HtpTxUserData *htud, const uint8_t **chunks_buffer, uint32_t *chunks_buffer_len) { StreamingBufferGetDataAtOffset(htud->request_body.sb, chunks_buffer, chunks_buffer_len, htud->request_body.body_parsed); } static void FlagDetectStateNewFile(HtpTxUserData *tx, int dir) { if (tx && tx->de_state) { if (dir == STREAM_TOSERVER) { SCLogDebug("DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW set"); tx->de_state->dir_state[0].flags |= DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW; } else if (STREAM_TOCLIENT) { SCLogDebug("DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW set"); tx->de_state->dir_state[1].flags |= DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW; } } } /** * \brief Setup boundary buffers */ static void HtpRequestBodySetupBoundary(HtpTxUserData *htud, uint8_t *boundary, uint32_t boundary_len) { memset(boundary, '-', boundary_len); memcpy(boundary + 2, htud->boundary, htud->boundary_len); } int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud, void *tx, const uint8_t *chunks_buffer, uint32_t chunks_buffer_len) { int result = 0; uint8_t boundary[htud->boundary_len + 4]; /**< size limited to HTP_BOUNDARY_MAX + 4 */ uint8_t expected_boundary_len = htud->boundary_len + 2; uint8_t expected_boundary_end_len = htud->boundary_len + 4; int tx_progress = 0; #ifdef PRINT printf("CHUNK START: \n"); PrintRawDataFp(stdout, chunks_buffer, chunks_buffer_len); printf("CHUNK END: \n"); #endif HtpRequestBodySetupBoundary(htud, boundary, htud->boundary_len + 4); /* search for the header start, header end and form end */ uint8_t *header_start = Bs2bmSearch(chunks_buffer, chunks_buffer_len, boundary, expected_boundary_len); uint8_t *header_end = NULL; if (header_start != NULL) { header_end = Bs2bmSearch(header_start, chunks_buffer_len - (header_start - chunks_buffer), (uint8_t *)"\r\n\r\n", 4); } uint8_t *form_end = Bs2bmSearch(chunks_buffer, chunks_buffer_len, boundary, expected_boundary_end_len); SCLogDebug("header_start %p, header_end %p, form_end %p", header_start, header_end, form_end); /* we currently only handle multipart for ts. When we support it for tc, * we will need to supply right direction */ tx_progress = AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, STREAM_TOSERVER); /* if we're in the file storage process, deal with that now */ if (htud->tsflags & HTP_FILENAME_SET) { if (header_start != NULL || form_end != NULL || (tx_progress > HTP_REQUEST_BODY)) { SCLogDebug("reached the end of the file"); const uint8_t *filedata = chunks_buffer; uint32_t filedata_len = 0; uint8_t flags = 0; if (header_start < form_end || (header_start != NULL && form_end == NULL)) { filedata_len = header_start - filedata - 2; /* 0d 0a */ } else if (form_end != NULL && form_end < header_start) { filedata_len = form_end - filedata; } else if (form_end != NULL && form_end == header_start) { filedata_len = form_end - filedata - 2; /* 0d 0a */ } else if (tx_progress > HTP_RESPONSE_BODY) { filedata_len = chunks_buffer_len; flags = FILE_TRUNCATED; } if (filedata_len > chunks_buffer_len) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR); goto end; } #ifdef PRINT printf("FILEDATA (final chunk) START: \n"); PrintRawDataFp(stdout, filedata, filedata_len); printf("FILEDATA (final chunk) END: \n"); #endif if (!(htud->tsflags & HTP_DONTSTORE)) { if (HTPFileClose(hstate, filedata, filedata_len, flags, STREAM_TOSERVER) == -1) { goto end; } } htud->tsflags &=~ HTP_FILENAME_SET; /* fall through */ } else { SCLogDebug("not yet at the end of the file"); if (chunks_buffer_len > expected_boundary_end_len) { const uint8_t *filedata = chunks_buffer; uint32_t filedata_len = chunks_buffer_len - expected_boundary_len; #ifdef PRINT printf("FILEDATA (part) START: \n"); PrintRawDataFp(stdout, filedata, filedata_len); printf("FILEDATA (part) END: \n"); #endif if (!(htud->tsflags & HTP_DONTSTORE)) { result = HTPFileStoreChunk(hstate, filedata, filedata_len, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { /* we know for sure we're not storing the file */ htud->tsflags |= HTP_DONTSTORE; } } htud->request_body.body_parsed += filedata_len; } else { SCLogDebug("chunk too small to already process in part"); } goto end; } } while (header_start != NULL && header_end != NULL && header_end != form_end && header_start < (chunks_buffer + chunks_buffer_len) && header_end < (chunks_buffer + chunks_buffer_len) && header_start < header_end) { uint8_t *filename = NULL; uint16_t filename_len = 0; uint8_t *filetype = NULL; uint16_t filetype_len = 0; uint32_t header_len = header_end - header_start; SCLogDebug("header_len %u", header_len); uint8_t *header = header_start; /* skip empty records */ if (expected_boundary_len == header_len) { goto next; } else if ((uint32_t)(expected_boundary_len + 2) <= header_len) { header_len -= (expected_boundary_len + 2); header = header_start + (expected_boundary_len + 2); // + for 0d 0a } HtpRequestBodyMultipartParseHeader(hstate, htud, header, header_len, &filename, &filename_len, &filetype, &filetype_len); if (filename != NULL) { uint8_t *filedata = NULL; uint32_t filedata_len = 0; SCLogDebug("we have a filename"); htud->tsflags |= HTP_FILENAME_SET; htud->tsflags &= ~HTP_DONTSTORE; SCLogDebug("header_end %p", header_end); SCLogDebug("form_end %p", form_end); /* everything until the final boundary is the file */ if (form_end != NULL) { filedata = header_end + 4; if (form_end == filedata) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_NO_FILEDATA); goto end; } else if (form_end < filedata) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR); goto end; } filedata_len = form_end - (header_end + 4 + 2); SCLogDebug("filedata_len %"PRIuMAX, (uintmax_t)filedata_len); /* or is it? */ uint8_t *header_next = Bs2bmSearch(filedata, filedata_len, boundary, expected_boundary_len); if (header_next != NULL) { filedata_len -= (form_end - header_next); } if (filedata_len > chunks_buffer_len) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR); goto end; } SCLogDebug("filedata_len %"PRIuMAX, (uintmax_t)filedata_len); #ifdef PRINT printf("FILEDATA START: \n"); PrintRawDataFp(stdout, filedata, filedata_len); printf("FILEDATA END: \n"); #endif result = HTPFileOpen(hstate, filename, filename_len, filedata, filedata_len, hstate->transaction_cnt, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { htud->tsflags |= HTP_DONTSTORE; } else { if (HTPFileClose(hstate, NULL, 0, 0, STREAM_TOSERVER) == -1) { goto end; } } FlagDetectStateNewFile(htud, STREAM_TOSERVER); htud->request_body.body_parsed += (header_end - chunks_buffer); htud->tsflags &= ~HTP_FILENAME_SET; } else { SCLogDebug("chunk doesn't contain form end"); filedata = header_end + 4; filedata_len = chunks_buffer_len - (filedata - chunks_buffer); SCLogDebug("filedata_len %u (chunks_buffer_len %u)", filedata_len, chunks_buffer_len); if (filedata_len > chunks_buffer_len) { HTPSetEvent(hstate, htud, HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR); goto end; } #ifdef PRINT printf("FILEDATA START: \n"); PrintRawDataFp(stdout, filedata, filedata_len); printf("FILEDATA END: \n"); #endif /* form doesn't end in this chunk, but part might. Lets * see if have another coming up */ uint8_t *header_next = Bs2bmSearch(filedata, filedata_len, boundary, expected_boundary_len); SCLogDebug("header_next %p", header_next); if (header_next == NULL) { /* no, but we'll handle the file data when we see the * form_end */ SCLogDebug("more file data to come"); uint32_t offset = (header_end + 4) - chunks_buffer; SCLogDebug("offset %u", offset); htud->request_body.body_parsed += offset; result = HTPFileOpen(hstate, filename, filename_len, NULL, 0, hstate->transaction_cnt, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { htud->tsflags |= HTP_DONTSTORE; } FlagDetectStateNewFile(htud, STREAM_TOSERVER); } else if (header_next - filedata > 2) { filedata_len = header_next - filedata - 2; SCLogDebug("filedata_len %u", filedata_len); result = HTPFileOpen(hstate, filename, filename_len, filedata, filedata_len, hstate->transaction_cnt, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { htud->tsflags |= HTP_DONTSTORE; } else { if (HTPFileClose(hstate, NULL, 0, 0, STREAM_TOSERVER) == -1) { goto end; } } FlagDetectStateNewFile(htud, STREAM_TOSERVER); htud->tsflags &= ~HTP_FILENAME_SET; htud->request_body.body_parsed += (header_end - chunks_buffer); } } } next: SCLogDebug("header_start %p, header_end %p, form_end %p", header_start, header_end, form_end); /* Search next boundary entry after the start of body */ uint32_t cursizeread = header_end - chunks_buffer; header_start = Bs2bmSearch(header_end + 4, chunks_buffer_len - (cursizeread + 4), boundary, expected_boundary_len); if (header_start != NULL) { header_end = Bs2bmSearch(header_end + 4, chunks_buffer_len - (cursizeread + 4), (uint8_t *) "\r\n\r\n", 4); } } /* if we're parsing the multipart and we're not currently processing a * file, we move the body pointer forward. */ if (form_end == NULL && !(htud->tsflags & HTP_FILENAME_SET) && header_start == NULL) { if (chunks_buffer_len > expected_boundary_end_len) { uint32_t move = chunks_buffer_len - expected_boundary_end_len + 1; htud->request_body.body_parsed += move; SCLogDebug("form not ready, file not set, parsing non-file " "record: moved %u", move); } } end: SCLogDebug("htud->request_body.body_parsed %"PRIu64, htud->request_body.body_parsed); return 0; } /** \brief setup things for put request * \todo really needed? */ int HtpRequestBodySetupPUT(htp_tx_data_t *d, HtpTxUserData *htud) { // if (d->tx->parsed_uri == NULL || d->tx->parsed_uri->path == NULL) { // return -1; // } /* filename is d->tx->parsed_uri->path */ return 0; } /** \internal * \brief Handle POST, no multipart body data */ static int HtpRequestBodyHandlePOST(HtpState *hstate, HtpTxUserData *htud, htp_tx_t *tx, uint8_t *data, uint32_t data_len) { int result = 0; /* see if we need to open the file */ if (!(htud->tsflags & HTP_FILENAME_SET)) { uint8_t *filename = NULL; size_t filename_len = 0; /* get the name */ if (tx->parsed_uri != NULL && tx->parsed_uri->path != NULL) { filename = (uint8_t *)bstr_ptr(tx->parsed_uri->path); filename_len = bstr_len(tx->parsed_uri->path); } if (filename != NULL) { result = HTPFileOpen(hstate, filename, (uint32_t)filename_len, data, data_len, hstate->transaction_cnt, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { htud->tsflags |= HTP_DONTSTORE; } else { FlagDetectStateNewFile(htud, STREAM_TOSERVER); htud->tsflags |= HTP_FILENAME_SET; htud->tsflags &= ~HTP_DONTSTORE; } } } else { /* otherwise, just store the data */ if (!(htud->tsflags & HTP_DONTSTORE)) { result = HTPFileStoreChunk(hstate, data, data_len, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { /* we know for sure we're not storing the file */ htud->tsflags |= HTP_DONTSTORE; } } } return 0; end: return -1; } /** \internal * \brief Handle PUT body data */ static int HtpRequestBodyHandlePUT(HtpState *hstate, HtpTxUserData *htud, htp_tx_t *tx, uint8_t *data, uint32_t data_len) { int result = 0; /* see if we need to open the file */ if (!(htud->tsflags & HTP_FILENAME_SET)) { uint8_t *filename = NULL; size_t filename_len = 0; /* get the name */ if (tx->parsed_uri != NULL && tx->parsed_uri->path != NULL) { filename = (uint8_t *)bstr_ptr(tx->parsed_uri->path); filename_len = bstr_len(tx->parsed_uri->path); } if (filename != NULL) { result = HTPFileOpen(hstate, filename, (uint32_t)filename_len, data, data_len, hstate->transaction_cnt, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { htud->tsflags |= HTP_DONTSTORE; } else { FlagDetectStateNewFile(htud, STREAM_TOSERVER); htud->tsflags |= HTP_FILENAME_SET; htud->tsflags &= ~HTP_DONTSTORE; } } } else { /* otherwise, just store the data */ if (!(htud->tsflags & HTP_DONTSTORE)) { result = HTPFileStoreChunk(hstate, data, data_len, STREAM_TOSERVER); if (result == -1) { goto end; } else if (result == -2) { /* we know for sure we're not storing the file */ htud->tsflags |= HTP_DONTSTORE; } } } return 0; end: return -1; } int HtpResponseBodyHandle(HtpState *hstate, HtpTxUserData *htud, htp_tx_t *tx, uint8_t *data, uint32_t data_len) { SCEnter(); int result = 0; /* see if we need to open the file */ if (!(htud->tcflags & HTP_FILENAME_SET)) { SCLogDebug("setting up file name"); uint8_t *filename = NULL; size_t filename_len = 0; /* try Content-Disposition header first */ htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, "Content-Disposition"); if (h != NULL && bstr_len(h->value) > 0) { /* parse content-disposition */ (void)HTTPParseContentDispositionHeader((uint8_t *)"filename=", 9, (uint8_t *) bstr_ptr(h->value), bstr_len(h->value), &filename, &filename_len); } /* fall back to name from the uri */ if (filename == NULL) { /* get the name */ if (tx->parsed_uri != NULL && tx->parsed_uri->path != NULL) { filename = (uint8_t *)bstr_ptr(tx->parsed_uri->path); filename_len = bstr_len(tx->parsed_uri->path); } } if (filename != NULL) { result = HTPFileOpen(hstate, filename, (uint32_t)filename_len, data, data_len, hstate->transaction_cnt, STREAM_TOCLIENT); SCLogDebug("result %d", result); if (result == -1) { goto end; } else if (result == -2) { htud->tcflags |= HTP_DONTSTORE; } else { FlagDetectStateNewFile(htud, STREAM_TOCLIENT); htud->tcflags |= HTP_FILENAME_SET; htud->tcflags &= ~HTP_DONTSTORE; } } } else { /* otherwise, just store the data */ if (!(htud->tcflags & HTP_DONTSTORE)) { result = HTPFileStoreChunk(hstate, data, data_len, STREAM_TOCLIENT); SCLogDebug("result %d", result); if (result == -1) { goto end; } else if (result == -2) { /* we know for sure we're not storing the file */ htud->tcflags |= HTP_DONTSTORE; } } } htud->response_body.body_parsed += data_len; return 0; end: return -1; } /** * \brief Function callback to append chunks for Requests * \param d pointer to the htp_tx_data_t structure (a chunk from htp lib) * \retval int HTP_OK if all goes well */ int HTPCallbackRequestBodyData(htp_tx_data_t *d) { SCEnter(); if (!(SC_ATOMIC_GET(htp_config_flags) & HTP_REQUIRE_REQUEST_BODY)) SCReturnInt(HTP_OK); if (d->data == NULL || d->len == 0) SCReturnInt(HTP_OK); #ifdef PRINT printf("HTPBODY START: \n"); PrintRawDataFp(stdout, (uint8_t *)d->data, d->len); printf("HTPBODY END: \n"); #endif HtpState *hstate = htp_connp_get_user_data(d->tx->connp); if (hstate == NULL) { SCReturnInt(HTP_ERROR); } SCLogDebug("New request body data available at %p -> %p -> %p, bodylen " "%"PRIu32"", hstate, d, d->data, (uint32_t)d->len); HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(d->tx); if (tx_ud == NULL) { tx_ud = HTPMalloc(sizeof(HtpTxUserData)); if (unlikely(tx_ud == NULL)) { SCReturnInt(HTP_OK); } memset(tx_ud, 0, sizeof(HtpTxUserData)); /* Set the user data for handling body chunks on this transaction */ htp_tx_set_user_data(d->tx, tx_ud); } if (!tx_ud->response_body_init) { tx_ud->response_body_init = 1; tx_ud->operation = HTP_BODY_REQUEST; if (d->tx->request_method_number == HTP_M_POST) { SCLogDebug("POST"); int r = HtpRequestBodySetupMultipart(d, tx_ud); if (r == 1) { tx_ud->request_body_type = HTP_BODY_REQUEST_MULTIPART; } else if (r == 0) { tx_ud->request_body_type = HTP_BODY_REQUEST_POST; SCLogDebug("not multipart"); } } else if (d->tx->request_method_number == HTP_M_PUT) { if (HtpRequestBodySetupPUT(d, tx_ud) == 0) { tx_ud->request_body_type = HTP_BODY_REQUEST_PUT; } } } /* see if we can get rid of htp body chunks */ HtpBodyPrune(hstate, &tx_ud->request_body, STREAM_TOSERVER); SCLogDebug("tx_ud->request_body.content_len_so_far %"PRIu64, tx_ud->request_body.content_len_so_far); SCLogDebug("hstate->cfg->request.body_limit %u", hstate->cfg->request.body_limit); /* within limits, add the body chunk to the state. */ if (hstate->cfg->request.body_limit == 0 || tx_ud->request_body.content_len_so_far < hstate->cfg->request.body_limit) { uint32_t len = (uint32_t)d->len; if (hstate->cfg->request.body_limit > 0 && (tx_ud->request_body.content_len_so_far + len) > hstate->cfg->request.body_limit) { len = hstate->cfg->request.body_limit - tx_ud->request_body.content_len_so_far; BUG_ON(len > (uint32_t)d->len); } SCLogDebug("len %u", len); HtpBodyAppendChunk(&hstate->cfg->request, &tx_ud->request_body, d->data, len); const uint8_t *chunks_buffer = NULL; uint32_t chunks_buffer_len = 0; if (tx_ud->request_body_type == HTP_BODY_REQUEST_MULTIPART) { /* multi-part body handling starts here */ if (!(tx_ud->tsflags & HTP_BOUNDARY_SET)) { goto end; } HtpRequestBodyReassemble(tx_ud, &chunks_buffer, &chunks_buffer_len); if (chunks_buffer == NULL) { goto end; } #ifdef PRINT printf("REASSCHUNK START: \n"); PrintRawDataFp(stdout, chunks_buffer, chunks_buffer_len); printf("REASSCHUNK END: \n"); #endif HtpRequestBodyHandleMultipart(hstate, tx_ud, d->tx, chunks_buffer, chunks_buffer_len); } else if (tx_ud->request_body_type == HTP_BODY_REQUEST_POST) { HtpRequestBodyHandlePOST(hstate, tx_ud, d->tx, (uint8_t *)d->data, (uint32_t)d->len); } else if (tx_ud->request_body_type == HTP_BODY_REQUEST_PUT) { HtpRequestBodyHandlePUT(hstate, tx_ud, d->tx, (uint8_t *)d->data, (uint32_t)d->len); } } end: /* set the new chunk flag */ hstate->flags |= HTP_FLAG_NEW_BODY_SET; SCReturnInt(HTP_OK); } /** * \brief Function callback to append chunks for Responses * \param d pointer to the htp_tx_data_t structure (a chunk from htp lib) * \retval int HTP_OK if all goes well */ int HTPCallbackResponseBodyData(htp_tx_data_t *d) { SCEnter(); if (!(SC_ATOMIC_GET(htp_config_flags) & HTP_REQUIRE_RESPONSE_BODY)) SCReturnInt(HTP_OK); if (d->data == NULL || d->len == 0) SCReturnInt(HTP_OK); HtpState *hstate = htp_connp_get_user_data(d->tx->connp); if (hstate == NULL) { SCReturnInt(HTP_ERROR); } SCLogDebug("New response body data available at %p -> %p -> %p, bodylen " "%"PRIu32"", hstate, d, d->data, (uint32_t)d->len); HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(d->tx); if (tx_ud == NULL) { tx_ud = HTPMalloc(sizeof(HtpTxUserData)); if (unlikely(tx_ud == NULL)) { SCReturnInt(HTP_OK); } memset(tx_ud, 0, sizeof(HtpTxUserData)); /* Set the user data for handling body chunks on this transaction */ htp_tx_set_user_data(d->tx, tx_ud); } if (!tx_ud->request_body_init) { tx_ud->request_body_init = 1; tx_ud->operation = HTP_BODY_RESPONSE; } /* see if we can get rid of htp body chunks */ HtpBodyPrune(hstate, &tx_ud->response_body, STREAM_TOCLIENT); SCLogDebug("tx_ud->response_body.content_len_so_far %"PRIu64, tx_ud->response_body.content_len_so_far); SCLogDebug("hstate->cfg->response.body_limit %u", hstate->cfg->response.body_limit); /* within limits, add the body chunk to the state. */ if (hstate->cfg->response.body_limit == 0 || tx_ud->response_body.content_len_so_far < hstate->cfg->response.body_limit) { uint32_t len = (uint32_t)d->len; if (hstate->cfg->response.body_limit > 0 && (tx_ud->response_body.content_len_so_far + len) > hstate->cfg->response.body_limit) { len = hstate->cfg->response.body_limit - tx_ud->response_body.content_len_so_far; BUG_ON(len > (uint32_t)d->len); } SCLogDebug("len %u", len); HtpBodyAppendChunk(&hstate->cfg->response, &tx_ud->response_body, d->data, len); HtpResponseBodyHandle(hstate, tx_ud, d->tx, (uint8_t *)d->data, (uint32_t)d->len); } else { if (tx_ud->tcflags & HTP_FILENAME_SET) { SCLogDebug("closing file that was being stored"); (void)HTPFileClose(hstate, NULL, 0, FILE_TRUNCATED, STREAM_TOCLIENT); tx_ud->tcflags &= ~HTP_FILENAME_SET; } } /* set the new chunk flag */ hstate->flags |= HTP_FLAG_NEW_BODY_SET; SCReturnInt(HTP_OK); } /** * \brief Print the stats of the HTTP requests */ void HTPAtExitPrintStats(void) { #ifdef DEBUG SCEnter(); SCMutexLock(&htp_state_mem_lock); SCLogDebug("http_state_memcnt %"PRIu64", http_state_memuse %"PRIu64"", htp_state_memcnt, htp_state_memuse); SCMutexUnlock(&htp_state_mem_lock); SCReturn; #endif } /** \brief Clears the HTTP server configuration memory used by HTP library */ void HTPFreeConfig(void) { SCEnter(); if (!AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "http") || !AppLayerParserConfParserEnabled("tcp", "http")) { SCReturn; } HTPCfgRec *nextrec = cfglist.next; SCRadixReleaseRadixTree(cfgtree); cfgtree = NULL; htp_config_destroy(cfglist.cfg); while (nextrec != NULL) { HTPCfgRec *htprec = nextrec; nextrec = nextrec->next; htp_config_destroy(htprec->cfg); SCFree(htprec); } SCReturn; } static int HTPCallbackRequestHasTrailer(htp_tx_t *tx) { HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (htud != NULL) { htud->request_has_trailers = 1; } return HTP_OK; } static int HTPCallbackResponseHasTrailer(htp_tx_t *tx) { HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (htud != NULL) { htud->response_has_trailers = 1; } return HTP_OK; } /** * \brief callback for request to store the recent incoming request in to the recent_in_tx for the given htp state * \param connp pointer to the current connection parser which has the htp * state in it as user data */ static int HTPCallbackRequest(htp_tx_t *tx) { SCEnter(); if (tx == NULL) { SCReturnInt(HTP_ERROR); } HtpState *hstate = htp_connp_get_user_data(tx->connp); if (hstate == NULL) { SCReturnInt(HTP_ERROR); } SCLogDebug("transaction_cnt %"PRIu64", list_size %"PRIu64, hstate->transaction_cnt, HTPStateGetTxCnt(hstate)); SCLogDebug("HTTP request completed"); HTPErrorCheckTxRequestFlags(hstate, tx); HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (htud != NULL) { if (htud->tsflags & HTP_FILENAME_SET) { SCLogDebug("closing file that was being stored"); (void)HTPFileClose(hstate, NULL, 0, 0, STREAM_TOSERVER); htud->tsflags &= ~HTP_FILENAME_SET; } } /* request done, do raw reassembly now to inspect state and stream * at the same time. */ AppLayerParserTriggerRawStreamReassembly(hstate->f); SCReturnInt(HTP_OK); } /** * \brief callback for response to remove the recent received requests from the recent_in_tx for the given htp state * \param connp pointer to the current connection parser which has the htp * state in it as user data */ static int HTPCallbackResponse(htp_tx_t *tx) { SCEnter(); HtpState *hstate = htp_connp_get_user_data(tx->connp); if (hstate == NULL) { SCReturnInt(HTP_ERROR); } /* we have one whole transaction now */ hstate->transaction_cnt++; /* Unset the body inspection (if any) */ hstate->flags &=~ HTP_FLAG_NEW_BODY_SET; HtpTxUserData *htud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (htud != NULL) { if (htud->tcflags & HTP_FILENAME_SET) { SCLogDebug("closing file that was being stored"); (void)HTPFileClose(hstate, NULL, 0, 0, STREAM_TOCLIENT); htud->tcflags &= ~HTP_FILENAME_SET; } } /* response done, do raw reassembly now to inspect state and stream * at the same time. */ AppLayerParserTriggerRawStreamReassembly(hstate->f); SCReturnInt(HTP_OK); } static int HTPCallbackRequestLine(htp_tx_t *tx) { HtpTxUserData *tx_ud; bstr *request_uri_normalized; HtpState *hstate = htp_connp_get_user_data(tx->connp); const HTPCfgRec *cfg = hstate->cfg; request_uri_normalized = SCHTPGenerateNormalizedUri(tx, tx->parsed_uri, cfg->uri_include_all); if (request_uri_normalized == NULL) return HTP_OK; tx_ud = htp_tx_get_user_data(tx); if (likely(tx_ud == NULL)) { tx_ud = HTPMalloc(sizeof(*tx_ud)); if (unlikely(tx_ud == NULL)) { bstr_free(request_uri_normalized); return HTP_OK; } memset(tx_ud, 0, sizeof(*tx_ud)); htp_tx_set_user_data(tx, tx_ud); } if (unlikely(tx_ud->request_uri_normalized != NULL)) bstr_free(tx_ud->request_uri_normalized); tx_ud->request_uri_normalized = request_uri_normalized; if (tx->flags) { HTPErrorCheckTxRequestFlags(hstate, tx); } return HTP_OK; } static int HTPCallbackDoubleDecodeQuery(htp_tx_t *tx) { if (tx->parsed_uri == NULL || tx->parsed_uri->query == NULL) return HTP_OK; uint64_t flags = 0; htp_urldecode_inplace(tx->cfg, HTP_DECODER_URLENCODED, tx->parsed_uri->query, &flags); return HTP_OK; } static int HTPCallbackDoubleDecodePath(htp_tx_t *tx) { if (tx->parsed_uri == NULL || tx->parsed_uri->path == NULL) return HTP_OK; uint64_t flags = 0; htp_urldecode_inplace(tx->cfg, HTP_DECODER_URL_PATH, tx->parsed_uri->path, &flags); return HTP_OK; } static int HTPCallbackRequestHeaderData(htp_tx_data_t *tx_data) { void *ptmp; if (tx_data->len == 0 || tx_data->tx == NULL) return HTP_OK; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx_data->tx); if (tx_ud == NULL) { tx_ud = HTPMalloc(sizeof(*tx_ud)); if (unlikely(tx_ud == NULL)) return HTP_OK; memset(tx_ud, 0, sizeof(*tx_ud)); htp_tx_set_user_data(tx_data->tx, tx_ud); } ptmp = HTPRealloc(tx_ud->request_headers_raw, tx_ud->request_headers_raw_len, tx_ud->request_headers_raw_len + tx_data->len); if (ptmp == NULL) { /* error: we're freeing the entire user data */ HtpState *hstate = htp_connp_get_user_data(tx_data->tx->connp); HtpTxUserDataFree(hstate, tx_ud); htp_tx_set_user_data(tx_data->tx, NULL); return HTP_OK; } tx_ud->request_headers_raw = ptmp; memcpy(tx_ud->request_headers_raw + tx_ud->request_headers_raw_len, tx_data->data, tx_data->len); tx_ud->request_headers_raw_len += tx_data->len; if (tx_data->tx && tx_data->tx->flags) { HtpState *hstate = htp_connp_get_user_data(tx_data->tx->connp); HTPErrorCheckTxRequestFlags(hstate, tx_data->tx); } return HTP_OK; } static int HTPCallbackResponseHeaderData(htp_tx_data_t *tx_data) { void *ptmp; if (tx_data->len == 0 || tx_data->tx == NULL) return HTP_OK; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx_data->tx); if (tx_ud == NULL) { tx_ud = HTPMalloc(sizeof(*tx_ud)); if (unlikely(tx_ud == NULL)) return HTP_OK; memset(tx_ud, 0, sizeof(*tx_ud)); htp_tx_set_user_data(tx_data->tx, tx_ud); } ptmp = HTPRealloc(tx_ud->response_headers_raw, tx_ud->response_headers_raw_len, tx_ud->response_headers_raw_len + tx_data->len); if (ptmp == NULL) { /* error: we're freeing the entire user data */ HtpState *hstate = htp_connp_get_user_data(tx_data->tx->connp); HtpTxUserDataFree(hstate, tx_ud); htp_tx_set_user_data(tx_data->tx, NULL); return HTP_OK; } tx_ud->response_headers_raw = ptmp; memcpy(tx_ud->response_headers_raw + tx_ud->response_headers_raw_len, tx_data->data, tx_data->len); tx_ud->response_headers_raw_len += tx_data->len; return HTP_OK; } /* * We have a similar set function called HTPConfigSetDefaultsPhase1. */ static void HTPConfigSetDefaultsPhase1(HTPCfgRec *cfg_prec) { cfg_prec->uri_include_all = FALSE; cfg_prec->request.body_limit = HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT; cfg_prec->response.body_limit = HTP_CONFIG_DEFAULT_RESPONSE_BODY_LIMIT; cfg_prec->request.inspect_min_size = HTP_CONFIG_DEFAULT_REQUEST_INSPECT_MIN_SIZE; cfg_prec->request.inspect_window = HTP_CONFIG_DEFAULT_REQUEST_INSPECT_WINDOW; cfg_prec->response.inspect_min_size = HTP_CONFIG_DEFAULT_RESPONSE_INSPECT_MIN_SIZE; cfg_prec->response.inspect_window = HTP_CONFIG_DEFAULT_RESPONSE_INSPECT_WINDOW; #ifndef AFLFUZZ_NO_RANDOM cfg_prec->randomize = HTP_CONFIG_DEFAULT_RANDOMIZE; #else cfg_prec->randomize = 0; #endif cfg_prec->randomize_range = HTP_CONFIG_DEFAULT_RANDOMIZE_RANGE; htp_config_register_request_header_data(cfg_prec->cfg, HTPCallbackRequestHeaderData); htp_config_register_request_trailer_data(cfg_prec->cfg, HTPCallbackRequestHeaderData); htp_config_register_response_header_data(cfg_prec->cfg, HTPCallbackResponseHeaderData); htp_config_register_response_trailer_data(cfg_prec->cfg, HTPCallbackResponseHeaderData); htp_config_register_request_trailer(cfg_prec->cfg, HTPCallbackRequestHasTrailer); htp_config_register_response_trailer(cfg_prec->cfg, HTPCallbackResponseHasTrailer); htp_config_register_request_body_data(cfg_prec->cfg, HTPCallbackRequestBodyData); htp_config_register_response_body_data(cfg_prec->cfg, HTPCallbackResponseBodyData); htp_config_register_request_complete(cfg_prec->cfg, HTPCallbackRequest); htp_config_register_response_complete(cfg_prec->cfg, HTPCallbackResponse); htp_config_set_parse_request_cookies(cfg_prec->cfg, 0); htp_config_set_parse_request_auth(cfg_prec->cfg, 0); /* don't convert + to space by default */ htp_config_set_plusspace_decode(cfg_prec->cfg, HTP_DECODER_URLENCODED, 0); /* libhtp <= 0.5.9 doesn't use soft limit, but it's impossible to set * only the hard limit. So we set both here to the (current) htp defaults. * The reason we do this is that if the user sets the hard limit in the * config, we have to set the soft limit as well. If libhtp starts using * the soft limit in the future, we at least make sure we control what * it's value is. */ htp_config_set_field_limits(cfg_prec->cfg, (size_t)HTP_CONFIG_DEFAULT_FIELD_LIMIT_SOFT, (size_t)HTP_CONFIG_DEFAULT_FIELD_LIMIT_HARD); return; } /* * We have this splitup so that in case double decoding has been enabled * for query and path, they would be called first on the callback queue, * before the callback set by Phase2() is called. We need this, since * the callback in Phase2() generates the normalized uri which utilizes * the query and path. */ static void HTPConfigSetDefaultsPhase2(char *name, HTPCfgRec *cfg_prec) { /* randomize inspection size if needed */ if (cfg_prec->randomize) { int rdrange = cfg_prec->randomize_range; cfg_prec->request.inspect_min_size += (int) (cfg_prec->request.inspect_min_size * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); cfg_prec->request.inspect_window += (int) (cfg_prec->request.inspect_window * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); SCLogConfig("'%s' server has 'request-body-minimal-inspect-size' set to" " %d and 'request-body-inspect-window' set to %d after" " randomization.", name, cfg_prec->request.inspect_min_size, cfg_prec->request.inspect_window); cfg_prec->response.inspect_min_size += (int) (cfg_prec->response.inspect_min_size * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); cfg_prec->response.inspect_window += (int) (cfg_prec->response.inspect_window * (random() * 1.0 / RAND_MAX - 0.5) * rdrange / 100); SCLogConfig("'%s' server has 'response-body-minimal-inspect-size' set to" " %d and 'response-body-inspect-window' set to %d after" " randomization.", name, cfg_prec->response.inspect_min_size, cfg_prec->response.inspect_window); } htp_config_register_request_line(cfg_prec->cfg, HTPCallbackRequestLine); cfg_prec->request.sbcfg.flags = 0; cfg_prec->request.sbcfg.buf_size = cfg_prec->request.inspect_window ? cfg_prec->request.inspect_window : 256; cfg_prec->request.sbcfg.buf_slide = 0; cfg_prec->request.sbcfg.Malloc = HTPMalloc; cfg_prec->request.sbcfg.Calloc = HTPCalloc; cfg_prec->request.sbcfg.Realloc = HTPRealloc; cfg_prec->request.sbcfg.Free = HTPFree; cfg_prec->response.sbcfg.flags = 0; cfg_prec->response.sbcfg.buf_size = cfg_prec->response.inspect_window ? cfg_prec->response.inspect_window : 256; cfg_prec->response.sbcfg.buf_slide = 0; cfg_prec->response.sbcfg.Malloc = HTPMalloc; cfg_prec->response.sbcfg.Calloc = HTPCalloc; cfg_prec->response.sbcfg.Realloc = HTPRealloc; cfg_prec->response.sbcfg.Free = HTPFree; return; } static void HTPConfigParseParameters(HTPCfgRec *cfg_prec, ConfNode *s, SCRadixTree *tree) { if (cfg_prec == NULL || s == NULL || tree == NULL) return; ConfNode *p = NULL; /* Default Parameters */ TAILQ_FOREACH(p, &s->head, next) { if (strcasecmp("address", p->name) == 0) { ConfNode *pval; /* Addresses */ TAILQ_FOREACH(pval, &p->head, next) { SCLogDebug("LIBHTP server %s: %s=%s", s->name, p->name, pval->val); /* IPV6 or IPV4? */ if (strchr(pval->val, ':') != NULL) { SCLogDebug("LIBHTP adding ipv6 server %s at %s: %p", s->name, pval->val, cfg_prec->cfg); if (SCRadixAddKeyIPV6String(pval->val, tree, cfg_prec) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "LIBHTP failed to " "add ipv6 server %s, ignoring", pval->val); } } else { SCLogDebug("LIBHTP adding ipv4 server %s at %s: %p", s->name, pval->val, cfg_prec->cfg); if (SCRadixAddKeyIPV4String(pval->val, tree, cfg_prec) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "LIBHTP failed " "to add ipv4 server %s, ignoring", pval->val); } } /* else - if (strchr(pval->val, ':') != NULL) */ } /* TAILQ_FOREACH(pval, &p->head, next) */ } else if (strcasecmp("personality", p->name) == 0) { /* Personalities */ int personality = HTPLookupPersonality(p->val); SCLogDebug("LIBHTP default: %s = %s", p->name, p->val); SCLogDebug("LIBHTP default: %s = %s", p->name, p->val); if (personality >= 0) { SCLogDebug("LIBHTP default: %s=%s (%d)", p->name, p->val, personality); if (htp_config_set_server_personality(cfg_prec->cfg, personality) == HTP_ERROR){ SCLogWarning(SC_ERR_INVALID_VALUE, "LIBHTP Failed adding " "personality \"%s\", ignoring", p->val); } else { SCLogDebug("LIBHTP personality set to %s", HTPLookupPersonalityString(personality)); } /* The IDS personality by default converts the path (and due to * our query string callback also the query string) to lowercase. * Signatures do not expect this, so override it. */ htp_config_set_convert_lowercase(cfg_prec->cfg, HTP_DECODER_URL_PATH, 0); } else { SCLogWarning(SC_ERR_UNKNOWN_VALUE, "LIBHTP Unknown personality " "\"%s\", ignoring", p->val); continue; } } else if (strcasecmp("request-body-limit", p->name) == 0 || strcasecmp("request_body_limit", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->request.body_limit) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing request-body-limit " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("response-body-limit", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->response.body_limit) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing response-body-limit " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("request-body-minimal-inspect-size", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->request.inspect_min_size) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing request-body-minimal-inspect-size " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("request-body-inspect-window", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->request.inspect_window) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing request-body-inspect-window " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("double-decode-path", p->name) == 0) { if (ConfValIsTrue(p->val)) { htp_config_register_request_line(cfg_prec->cfg, HTPCallbackDoubleDecodeQuery); } } else if (strcasecmp("double-decode-query", p->name) == 0) { if (ConfValIsTrue(p->val)) { htp_config_register_request_line(cfg_prec->cfg, HTPCallbackDoubleDecodePath); } } else if (strcasecmp("response-body-minimal-inspect-size", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->response.inspect_min_size) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing response-body-minimal-inspect-size " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("response-body-inspect-window", p->name) == 0) { if (ParseSizeStringU32(p->val, &cfg_prec->response.inspect_window) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing response-body-inspect-window " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } } else if (strcasecmp("response-body-decompress-layer-limit", p->name) == 0) { uint32_t value = 2; if (ParseSizeStringU32(p->val, &value) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing response-body-inspect-window " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } #ifdef HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT htp_config_set_response_decompression_layer_limit(cfg_prec->cfg, value); #else SCLogWarning(SC_WARN_OUTDATED_LIBHTP, "can't set response-body-decompress-layer-limit " "to %u, libhtp version too old", value); #endif } else if (strcasecmp("path-convert-backslash-separators", p->name) == 0) { htp_config_set_backslash_convert_slashes(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-bestfit-replacement-char", p->name) == 0) { if (strlen(p->val) == 1) { htp_config_set_bestfit_replacement_byte(cfg_prec->cfg, HTP_DECODER_URL_PATH, p->val[0]); } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry " "for libhtp param path-bestfit-replacement-char"); } } else if (strcasecmp("path-convert-lowercase", p->name) == 0) { htp_config_set_convert_lowercase(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-nul-encoded-terminates", p->name) == 0) { htp_config_set_nul_encoded_terminates(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-nul-raw-terminates", p->name) == 0) { htp_config_set_nul_raw_terminates(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-separators-compress", p->name) == 0) { htp_config_set_path_separators_compress(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-separators-decode", p->name) == 0) { htp_config_set_path_separators_decode(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-u-encoding-decode", p->name) == 0) { htp_config_set_u_encoding_decode(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("path-url-encoding-invalid-handling", p->name) == 0) { enum htp_url_encoding_handling_t handling; if (strcasecmp(p->val, "preserve_percent") == 0) { handling = HTP_URL_DECODE_PRESERVE_PERCENT; } else if (strcasecmp(p->val, "remove_percent") == 0) { handling = HTP_URL_DECODE_REMOVE_PERCENT; } else if (strcasecmp(p->val, "decode_invalid") == 0) { handling = HTP_URL_DECODE_PROCESS_INVALID; } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry " "for libhtp param path-url-encoding-invalid-handling"); return; } htp_config_set_url_encoding_invalid_handling(cfg_prec->cfg, HTP_DECODER_URL_PATH, handling); } else if (strcasecmp("path-utf8-convert-bestfit", p->name) == 0) { htp_config_set_utf8_convert_bestfit(cfg_prec->cfg, HTP_DECODER_URL_PATH, ConfValIsTrue(p->val)); } else if (strcasecmp("uri-include-all", p->name) == 0) { cfg_prec->uri_include_all = ConfValIsTrue(p->val); SCLogDebug("uri-include-all %s", cfg_prec->uri_include_all ? "enabled" : "disabled"); } else if (strcasecmp("query-plusspace-decode", p->name) == 0) { htp_config_set_plusspace_decode(cfg_prec->cfg, HTP_DECODER_URLENCODED, ConfValIsTrue(p->val)); } else if (strcasecmp("meta-field-limit", p->name) == 0) { uint32_t limit = 0; if (ParseSizeStringU32(p->val, &limit) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error meta-field-limit " "from conf file - %s. Killing engine", p->val); exit(EXIT_FAILURE); } if (limit == 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error meta-field-limit " "from conf file cannot be 0. Killing engine"); exit(EXIT_FAILURE); } /* set default soft-limit with our new hard limit */ htp_config_set_field_limits(cfg_prec->cfg, (size_t)HTP_CONFIG_DEFAULT_FIELD_LIMIT_SOFT, (size_t)limit); } else if (strcasecmp("randomize-inspection-sizes", p->name) == 0) { #ifndef AFLFUZZ_NO_RANDOM cfg_prec->randomize = ConfValIsTrue(p->val); #endif } else if (strcasecmp("randomize-inspection-range", p->name) == 0) { uint32_t range = atoi(p->val); if (range > 100) { SCLogError(SC_ERR_SIZE_PARSE, "Invalid value for randomize" " inspection range setting from conf file - %s." " It should be inferior to 100." " Killing engine", p->val); exit(EXIT_FAILURE); } cfg_prec->randomize_range = range; } else if (strcasecmp("http-body-inline", p->name) == 0) { if (ConfValIsTrue(p->val)) { cfg_prec->http_body_inline = 1; } else if (ConfValIsFalse(p->val)) { cfg_prec->http_body_inline = 0; } else { if (strcmp("auto", p->val) != 0) { WarnInvalidConfEntry("http_body_inline", "%s", "auto"); } if (EngineModeIsIPS()) { cfg_prec->http_body_inline = 1; } else { cfg_prec->http_body_inline = 0; } } } else { SCLogWarning(SC_ERR_UNKNOWN_VALUE, "LIBHTP Ignoring unknown " "default config: %s", p->name); } } /* TAILQ_FOREACH(p, &default_config->head, next) */ return; } void HTPConfigure(void) { SCEnter(); cfglist.next = NULL; cfgtree = SCRadixCreateRadixTree(NULL, NULL); if (NULL == cfgtree) exit(EXIT_FAILURE); /* Default Config */ cfglist.cfg = htp_config_create(); if (NULL == cfglist.cfg) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to create HTP default config"); exit(EXIT_FAILURE); } SCLogDebug("LIBHTP default config: %p", cfglist.cfg); HTPConfigSetDefaultsPhase1(&cfglist); if (ConfGetNode("app-layer.protocols.http.libhtp") == NULL) { HTPConfigParseParameters(&cfglist, ConfGetNode("libhtp.default-config"), cfgtree); } else { HTPConfigParseParameters(&cfglist, ConfGetNode("app-layer.protocols.http.libhtp.default-config"), cfgtree); } HTPConfigSetDefaultsPhase2("default", &cfglist); HTPParseMemcap(); /* Read server config and create a parser for each IP in radix tree */ ConfNode *server_config = ConfGetNode("app-layer.protocols.http.libhtp.server-config"); if (server_config == NULL) { server_config = ConfGetNode("libhtp.server-config"); if (server_config == NULL) { SCLogDebug("LIBHTP Configuring %p", server_config); SCReturn; } } SCLogDebug("LIBHTP Configuring %p", server_config); ConfNode *si; /* Server Nodes */ TAILQ_FOREACH(si, &server_config->head, next) { /* Need the named node, not the index */ ConfNode *s = TAILQ_FIRST(&si->head); if (NULL == s) { SCLogDebug("LIBHTP s NULL"); continue; } SCLogDebug("LIBHTP server %s", s->name); HTPCfgRec *nextrec = cfglist.next; HTPCfgRec *htprec = SCMalloc(sizeof(HTPCfgRec)); if (NULL == htprec) exit(EXIT_FAILURE); memset(htprec, 0x00, sizeof(*htprec)); cfglist.next = htprec; cfglist.next->next = nextrec; cfglist.next->cfg = htp_config_create(); if (NULL == cfglist.next->cfg) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to create HTP server config"); exit(EXIT_FAILURE); } HTPConfigSetDefaultsPhase1(htprec); HTPConfigParseParameters(htprec, s, cfgtree); HTPConfigSetDefaultsPhase2(s->name, htprec); } SCReturn; } void AppLayerHtpPrintStats(void) { #ifdef DEBUG SCMutexLock(&htp_state_mem_lock); SCLogPerf("htp memory %"PRIu64" (%"PRIu64")", htp_state_memuse, htp_state_memcnt); SCMutexUnlock(&htp_state_mem_lock); #endif } /** \internal * \brief get files callback * \param state state ptr * \param direction flow direction * \retval files files ptr */ static FileContainer *HTPStateGetFiles(void *state, uint8_t direction) { if (state == NULL) return NULL; HtpState *http_state = (HtpState *)state; if (direction & STREAM_TOCLIENT) { SCReturnPtr(http_state->files_tc, "FileContainer"); } else { SCReturnPtr(http_state->files_ts, "FileContainer"); } } static int HTPStateGetAlstateProgress(void *tx, uint8_t direction) { if (direction & STREAM_TOSERVER) return ((htp_tx_t *)tx)->request_progress; else return ((htp_tx_t *)tx)->response_progress; } static uint64_t HTPStateGetTxCnt(void *alstate) { HtpState *http_state = (HtpState *)alstate; if (http_state != NULL && http_state->conn != NULL) return (uint64_t)htp_list_size(http_state->conn->transactions); else return 0ULL; } static void *HTPStateGetTx(void *alstate, uint64_t tx_id) { HtpState *http_state = (HtpState *)alstate; if (http_state != NULL && http_state->conn != NULL) return htp_list_get(http_state->conn->transactions, tx_id); else return NULL; } static void HTPStateSetTxLogged(void *alstate, void *vtx, uint32_t logger) { htp_tx_t *tx = (htp_tx_t *)vtx; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud) tx_ud->logged |= logger; } static int HTPStateGetTxLogged(void *alstate, void *vtx, uint32_t logger) { htp_tx_t *tx = (htp_tx_t *)vtx; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud && (tx_ud->logged & logger)) return 1; return 0; } static int HTPStateGetAlstateProgressCompletionStatus(uint8_t direction) { return (direction & STREAM_TOSERVER) ? HTP_REQUEST_COMPLETE : HTP_RESPONSE_COMPLETE; } int HTPStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type) { *event_id = SCMapEnumNameToValue(event_name, http_decoder_event_table); if (*event_id == -1) { SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in " "http's enum map table.", event_name); /* this should be treated as fatal */ return -1; } *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION; return 0; } static void HTPStateTruncate(void *state, uint8_t direction) { FileContainer *fc = HTPStateGetFiles(state, direction); if (fc != NULL) { FileTruncateAllOpenFiles(fc); } } static int HTPStateHasTxDetectState(void *alstate) { HtpState *htp_state = (HtpState *)alstate; return (htp_state->tx_with_detect_state_cnt > 0); } static DetectEngineState *HTPGetTxDetectState(void *vtx) { htp_tx_t *tx = (htp_tx_t *)vtx; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); return tx_ud ? tx_ud->de_state : NULL; } static int HTPSetTxDetectState(void *alstate, void *vtx, DetectEngineState *s) { HtpState *htp_state = (HtpState *)alstate; htp_tx_t *tx = (htp_tx_t *)vtx; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud == NULL) { tx_ud = HTPMalloc(sizeof(*tx_ud)); if (unlikely(tx_ud == NULL)) return -ENOMEM; memset(tx_ud, 0, sizeof(*tx_ud)); htp_tx_set_user_data(tx, tx_ud); } htp_state->tx_with_detect_state_cnt++; tx_ud->de_state = s; return 0; } static int HTPRegisterPatternsForProtocolDetection(void) { char *methods[] = { "GET", "PUT", "POST", "HEAD", "TRACE", "OPTIONS", "CONNECT", "DELETE", "PATCH", "PROPFIND", "PROPPATCH", "MKCOL", "COPY", "MOVE", "LOCK", "UNLOCK", "CHECKOUT", "UNCHECKOUT", "CHECKIN", "UPDATE", "LABEL", "REPORT", "MKWORKSPACE", "MKACTIVITY", "MERGE", "INVALID", "VERSION-CONTROL", "BASELINE-CONTROL", NULL}; char *spacings[] = { "|20|", "|09|", NULL }; char *versions[] = { "HTTP/0.9", "HTTP/1.0", "HTTP/1.1", NULL }; uint methods_pos; uint spacings_pos; uint versions_pos; int register_result; char method_buffer[32] = ""; /* Loop through all the methods ands spacings and register the patterns */ for (methods_pos = 0; methods[methods_pos]; methods_pos++) { for (spacings_pos = 0; spacings[spacings_pos]; spacings_pos++) { /* Combine the method name and the spacing */ snprintf(method_buffer, sizeof(method_buffer), "%s%s", methods[methods_pos], spacings[spacings_pos]); /* Register the new method+spacing pattern * 3 is subtracted from the length since the spacing is hex typed as |xx| * but the pattern matching should only be one char */ register_result = AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_HTTP, method_buffer, strlen(method_buffer)-3, 0, STREAM_TOSERVER); if (register_result < 0) { return -1; } } } /* Loop through all the http verions patterns that are TO_CLIENT */ for (versions_pos = 0; versions[versions_pos]; versions_pos++) { register_result = AppLayerProtoDetectPMRegisterPatternCI(IPPROTO_TCP, ALPROTO_HTTP, versions[versions_pos], strlen(versions[versions_pos]), 0, STREAM_TOCLIENT); if (register_result < 0) { return -1; } } return 0; } /** * \brief Register the HTTP protocol and state handling functions to APP layer * of the engine. */ void RegisterHTPParsers(void) { SCEnter(); char *proto_name = "http"; /** HTTP */ if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_HTTP, proto_name); if (HTPRegisterPatternsForProtocolDetection() < 0) return; } else { SCLogInfo("Protocol detection and parser disabled for %s protocol", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_HTTP, HTPStateAlloc, HTPStateFree); AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPStateTransactionFree); AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetFiles); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetAlstateProgress); AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetTxCnt); AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetTx); AppLayerParserRegisterLoggerFuncs(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetTxLogged, HTPStateSetTxLogged); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_HTTP, HTPStateGetAlstateProgressCompletionStatus); AppLayerParserRegisterHasEventsFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPHasEvents); AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPGetEvents); AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_HTTP, HTPStateGetEventInfo); AppLayerParserRegisterTruncateFunc(IPPROTO_TCP, ALPROTO_HTTP, HTPStateTruncate); AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_HTTP, HTPStateHasTxDetectState, HTPGetTxDetectState, HTPSetTxDetectState); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_HTTP, STREAM_TOSERVER, HTPHandleRequestData); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_HTTP, STREAM_TOCLIENT, HTPHandleResponseData); SC_ATOMIC_INIT(htp_config_flags); AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_HTTP, STREAM_TOSERVER); HTPConfigure(); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_HTTP, HTPParserRegisterTests); #endif SCReturn; } #ifdef UNITTESTS static HTPCfgRec cfglist_backup; void HtpConfigCreateBackup(void) { cfglist_backup = cfglist; return; } void HtpConfigRestoreBackup(void) { cfglist = cfglist_backup; return; } /** \test Test case where chunks are sent in smaller chunks and check the * response of the parser from HTP library. */ int HTPParserTest01(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Victor/1.0\r\n\r\nPost" " Data is c0oL!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (strcmp(bstr_util_strdup_to_c(h->value), "Victor/1.0") || tx->request_method_number != HTP_M_POST || tx->request_protocol_number != HTP_PROTOCOL_1_0) { printf("expected header value: Victor/1.0 and got %s: and expected" " method: POST and got %s, expected protocol number HTTP/1.0" " and got: %s \n", bstr_util_strdup_to_c(h->value), bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test case where chunks are sent in smaller chunks and check the * response of the parser from HTP library. */ static int HTPParserTest01a(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = " POST / HTTP/1.0\r\nUser-Agent: Victor/1.0\r\n\r\nPost" " Data is c0oL!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (strcmp(bstr_util_strdup_to_c(h->value), "Victor/1.0") || tx->request_method_number != HTP_M_POST || tx->request_protocol_number != HTP_PROTOCOL_1_0) { printf("expected header value: Victor/1.0 and got %s: and expected" " method: POST and got %s, expected protocol number HTTP/1.0" " and got: %s \n", bstr_util_strdup_to_c(h->value), bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test See how it deals with an incomplete request. */ int HTPParserTest02(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if ((tx->request_method) != NULL || h != NULL) { printf("expected method NULL, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test Test case where method is invalid and data is sent in smaller chunks * and check the response of the parser from HTP library. */ int HTPParserTest03(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "HELLO / HTTP/1.0\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_UNKNOWN || h != NULL || tx->request_protocol_number != HTP_PROTOCOL_1_0) { printf("expected method M_UNKNOWN and got %s: , expected protocol " "HTTP/1.0 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test case where invalid data is sent and check the response of the * parser from HTP library. */ int HTPParserTest04(void) { int result = 0; Flow *f = NULL; HtpState *htp_state = NULL; uint8_t httpbuf1[] = "World!\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_UNKNOWN || h != NULL || tx->request_protocol_number != HTP_PROTOCOL_0_9) { printf("expected method M_UNKNOWN and got %s: , expected protocol " "NULL and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test both sides of a http stream mixed up to see if the HTP parser * properly parsed them and also keeps them separated. */ int HTPParserTest05(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "Post D"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "ata is c0oL!"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.0 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "post R"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint8_t httpbuf6[] = "esults are tha bomb!"; uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_EOF, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_POST || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_0) { printf("expected method M_POST and got %s: , expected protocol " "HTTP/1.0 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.0 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test Test proper chunked encoded response body */ int HTPParserTest06(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /ld/index.php?id=412784631&cid=0064&version=4&" "name=try HTTP/1.1\r\nAccept: */*\r\nUser-Agent: " "LD-agent\r\nHost: 209.205.196.16\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 OK\r\nDate: Sat, 03 Oct 2009 10:16:02 " "GMT\r\n" "Server: Apache/1.3.37 (Unix) mod_ssl/2.8.28 " "OpenSSL/0.9.7a PHP/4.4.7 mod_perl/1.29 " "FrontPage/5.0.2.2510\r\n" "X-Powered-By: PHP/4.4.7\r\nTransfer-Encoding: " "chunked\r\n" "Content-Type: text/html\r\n\r\n" "580\r\n" "W2dyb3VwMV0NCnBob25lMT1wMDB3ODgyMTMxMzAyMTINCmxvZ2lu" "MT0NCnBhc3N3b3JkMT0NCnBob25lMj1wMDB3ODgyMTMxMzAyMTIN" "CmxvZ2luMj0NCnBhc3N3b3JkMj0NCnBob25lMz0NCmxvZ2luMz0N" "CnBhc3N3b3JkMz0NCnBob25lND0NCmxvZ2luND0NCnBhc3N3b3Jk" "ND0NCnBob25lNT0NCmxvZ2luNT0NCnBhc3N3b3JkNT0NCnBob25l" "Nj0NCmxvZ2luNj0NCnBhc3N3b3JkNj0NCmNhbGxfdGltZTE9MzIN" "CmNhbGxfdGltZTI9MjMyDQpkYXlfbGltaXQ9NQ0KbW9udGhfbGlt" "aXQ9MTUNCltncm91cDJdDQpwaG9uZTE9DQpsb2dpbjE9DQpwYXNz" "d29yZDE9DQpwaG9uZTI9DQpsb2dpbjI9DQpwYXNzd29yZDI9DQpw" "aG9uZTM9DQpsb2dpbjM9DQpwYXNzd29yZDM9DQpwaG9uZTQ9DQps" "b2dpbjQ9DQpwYXNzd29yZDQ9DQpwaG9uZTU9DQpsb2dpbjU9DQpw" "YXNzd29yZDU9DQpwaG9uZTY9DQpsb2dpbjY9DQpwYXNzd29yZDY9" "DQpjYWxsX3RpbWUxPQ0KY2FsbF90aW1lMj0NCmRheV9saW1pdD0N" "Cm1vbnRoX2xpbWl0PQ0KW2dyb3VwM10NCnBob25lMT0NCmxvZ2lu" "MT0NCnBhc3N3b3JkMT0NCnBob25lMj0NCmxvZ2luMj0NCnBhc3N3" "b3JkMj0NCnBob25lMz0NCmxvZ2luMz0NCnBhc3N3b3JkMz0NCnBo" "b25lND0NCmxvZ2luND0NCnBhc3N3b3JkND0NCnBob25lNT0NCmxv" "Z2luNT0NCnBhc3N3b3JkNT0NCnBob25lNj0NCmxvZ2luNj0NCnBh" "c3N3b3JkNj0NCmNhbGxfdGltZTE9DQpjYWxsX3RpbWUyPQ0KZGF5" "X2xpbWl0PQ0KbW9udGhfbGltaXQ9DQpbZ3JvdXA0XQ0KcGhvbmUx" "PQ0KbG9naW4xPQ0KcGFzc3dvcmQxPQ0KcGhvbmUyPQ0KbG9naW4y" "PQ0KcGFzc3dvcmQyPQ0KcGhvbmUzPQ0KbG9naW4zPQ0KcGFzc3dv" "cmQzPQ0KcGhvbmU0PQ0KbG9naW40PQ0KcGFzc3dvcmQ0PQ0KcGhv" "bmU1PQ0KbG9naW41PQ0KcGFzc3dvcmQ1PQ0KcGhvbmU2PQ0KbG9n" "aW42PQ0KcGFzc3dvcmQ2PQ0KY2FsbF90aW1lMT0NCmNhbGxfdGlt" "ZTI9DQpkYXlfbGltaXQ9DQptb250aF9saW1pdD0NCltmaWxlc10N" "Cmxpbms9aHR0cDovLzIwOS4yMDUuMTk2LjE2L2xkL2dldGJvdC5w" "aHA=\r\n0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_GET || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200 || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected response 200 OK and got %"PRId32" %s: , expected proto" "col HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test */ int HTPParserTest07(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /awstats.pl?/migratemigrate%20=%20| HTTP/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref[] = "/awstats.pl?/migratemigrate = |"; size_t reflen = sizeof(ref) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } #include "conf-yaml-loader.h" /** \test Abort */ int HTPParserTest08(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /secondhouse/image/js/\%ce\%de\%ce\%fd_RentCity.js?v=2011.05.02 HTTP/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); HtpState *htp_state = NULL; int r = 0; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint8_t flags = 0; flags = STREAM_TOSERVER|STREAM_START|STREAM_EOF; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk returned %" PRId32 ", expected" " 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { //printf("uri %s\n", bstr_util_strdup_to_c(tx->request_uri_normalized)); PrintRawDataFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); UTHFreeFlow(f); return result; } /** \test Abort */ int HTPParserTest09(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /secondhouse/image/js/\%ce\%de\%ce\%fd_RentCity.js?v=2011.05.02 HTTP/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: Apache_2_2\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); HtpState *htp_state = NULL; int r = 0; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint8_t flags = 0; flags = STREAM_TOSERVER|STREAM_START|STREAM_EOF; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk returned %" PRId32 ", expected" " 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { //printf("uri %s\n", bstr_util_strdup_to_c(tx->request_uri_normalized)); PrintRawDataFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); UTHFreeFlow(f); return result; } /** \test Host:www.google.com <- missing space between name:value (rfc violation) */ int HTPParserTest10(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\nHost:www.google.com\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (h == NULL) { goto end; } char *name = bstr_util_strdup_to_c(h->name); if (name == NULL) { goto end; } if (strcmp(name, "Host") != 0) { printf("header name not \"Host\", instead \"%s\": ", name); free(name); goto end; } free(name); char *value = bstr_util_strdup_to_c(h->value); if (value == NULL) { goto end; } if (strcmp(value, "www.google.com") != 0) { printf("header value not \"www.google.com\", instead \"%s\": ", value); free(value); goto end; } free(value); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test double encoding in path */ static int HTPParserTest11(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /%2500 HTTP/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (tx != NULL && tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (4 != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be 2, is %"PRIuMAX, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (bstr_ptr(tx_ud->request_uri_normalized)[0] != '/' || bstr_ptr(tx_ud->request_uri_normalized)[1] != '%' || bstr_ptr(tx_ud->request_uri_normalized)[2] != '0' || bstr_ptr(tx_ud->request_uri_normalized)[3] != '0') { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test double encoding in query */ static int HTPParserTest12(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /?a=%2500 HTTP/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (7 != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be 5, is %"PRIuMAX, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (bstr_ptr(tx_ud->request_uri_normalized)[0] != '/' || bstr_ptr(tx_ud->request_uri_normalized)[1] != '?' || bstr_ptr(tx_ud->request_uri_normalized)[2] != 'a' || bstr_ptr(tx_ud->request_uri_normalized)[3] != '=' || bstr_ptr(tx_ud->request_uri_normalized)[4] != '%' || bstr_ptr(tx_ud->request_uri_normalized)[5] != '0' || bstr_ptr(tx_ud->request_uri_normalized)[6] != '0') { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Host:www.google.com0dName: Value0d0a <- missing space between name:value (rfc violation) */ int HTPParserTest13(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET / HTTP/1.0\r\nHost:www.google.com\rName: Value\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (h == NULL) { goto end; } char *name = bstr_util_strdup_to_c(h->name); if (name == NULL) { goto end; } if (strcmp(name, "Host") != 0) { printf("header name not \"Host\", instead \"%s\": ", name); free(name); goto end; } free(name); char *value = bstr_util_strdup_to_c(h->value); if (value == NULL) { goto end; } if (strcmp(value, "www.google.com\rName: Value") != 0) { printf("header value not \"www.google.com\", instead \""); PrintRawUriFp(stdout, (uint8_t *)value, strlen(value)); printf("\": "); free(value); goto end; } free(value); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test basic config */ int HTPParserConfigTest01(void) { int ret = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ \n\ server-config:\n\ \n\ - apache-tomcat:\n\ address: [192.168.1.0/24, 127.0.0.0/8, \"::1\"]\n\ personality: Tomcat_6_0\n\ \n\ - iis7:\n\ address: \n\ - 192.168.0.0/24\n\ - 192.168.10.0/24\n\ personality: IIS_7_0\n\ "; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(input, strlen(input)); ConfNode *outputs; outputs = ConfGetNode("libhtp.default-config.personality"); if (outputs == NULL) { goto end; } outputs = ConfGetNode("libhtp.server-config"); if (outputs == NULL) { goto end; } ConfNode *node = TAILQ_FIRST(&outputs->head); if (node == NULL) { goto end; } if (strcmp(node->name, "0") != 0) { goto end; } node = TAILQ_FIRST(&node->head); if (node == NULL) { goto end; } if (strcmp(node->name, "apache-tomcat") != 0) { goto end; } int i = 0; ConfNode *n; ConfNode *node2 = ConfNodeLookupChild(node, "personality"); if (node2 == NULL) { goto end; } if (strcmp(node2->val, "Tomcat_6_0") != 0) { goto end; } node = ConfNodeLookupChild(node, "address"); if (node == NULL) { goto end; } TAILQ_FOREACH(n, &node->head, next) { if (n == NULL) { goto end; } switch(i) { case 0: if (strcmp(n->name, "0") != 0) { goto end; } if (strcmp(n->val, "192.168.1.0/24") != 0) { goto end; } break; case 1: if (strcmp(n->name, "1") != 0) { goto end; } if (strcmp(n->val, "127.0.0.0/8") != 0) { goto end; } break; case 2: if (strcmp(n->name, "2") != 0) { goto end; } if (strcmp(n->val, "::1") != 0) { goto end; } break; default: goto end; } i++; } outputs = ConfGetNode("libhtp.server-config"); if (outputs == NULL) { goto end; } node = TAILQ_FIRST(&outputs->head); node = TAILQ_NEXT(node, next); if (node == NULL) { goto end; } if (strcmp(node->name, "1") != 0) { goto end; } node = TAILQ_FIRST(&node->head); if (node == NULL) { goto end; } if (strcmp(node->name, "iis7") != 0) { goto end; } node2 = ConfNodeLookupChild(node, "personality"); if (node2 == NULL) { goto end; } if (strcmp(node2->val, "IIS_7_0") != 0) { goto end; } node = ConfNodeLookupChild(node, "address"); if (node == NULL) { goto end; } i = 0; TAILQ_FOREACH(n, &node->head, next) { if (n == NULL) { goto end; } switch(i) { case 0: if (strcmp(n->name, "0") != 0) { goto end; } if (strcmp(n->val, "192.168.0.0/24") != 0) { goto end; } break; case 1: if (strcmp(n->name, "1") != 0) { goto end; } if (strcmp(n->val, "192.168.10.0/24") != 0) { goto end; } break; default: goto end; } i++; } ret = 1; end: ConfDeInit(); ConfRestoreContextBackup(); return ret; } /** \test Test config builds radix correctly */ int HTPParserConfigTest02(void) { int ret = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ \n\ server-config:\n\ \n\ - apache-tomcat:\n\ address: [192.168.1.0/24, 127.0.0.0/8, \"::1\"]\n\ personality: Tomcat_6_0\n\ \n\ - iis7:\n\ address: \n\ - 192.168.0.0/24\n\ - 192.168.10.0/24\n\ personality: IIS_7_0\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); if (cfglist.cfg == NULL) { printf("No default config created.\n"); goto end; } if (cfgtree == NULL) { printf("No config tree created.\n"); goto end; } htp_cfg_t *htp = cfglist.cfg; uint8_t buf[128]; const char *addr; void *user_data = NULL; addr = "192.168.10.42"; if (inet_pton(AF_INET, addr, buf) == 1) { (void)SCRadixFindKeyIPV4BestMatch(buf, cfgtree, &user_data); if (user_data != NULL) { HTPCfgRec *htp_cfg_rec = user_data; htp = htp_cfg_rec->cfg; SCLogDebug("LIBHTP using config: %p", htp); } if (htp == NULL) { printf("Could not get config for: %s\n", addr); goto end; } } else { printf("Failed to parse address: %s\n", addr); goto end; } user_data = NULL; addr = "::1"; if (inet_pton(AF_INET6, addr, buf) == 1) { (void)SCRadixFindKeyIPV6BestMatch(buf, cfgtree, &user_data); if (user_data != NULL) { HTPCfgRec *htp_cfg_rec = user_data; htp = htp_cfg_rec->cfg; SCLogDebug("LIBHTP using config: %p", htp); } if (htp == NULL) { printf("Could not get config for: %s\n", addr); goto end; } } else { printf("Failed to parse address: %s\n", addr); goto end; } ret = 1; end: HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); return ret; } /** \test Test traffic is handled by the correct htp config */ int HTPParserConfigTest03(void) { int result = 1; Flow *f = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Victor/1.0\r\n\r\nPost" " Data is c0oL!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ \n\ server-config:\n\ \n\ - apache-tomcat:\n\ address: [192.168.1.0/24, 127.0.0.0/8, \"::1\"]\n\ personality: Tomcat_6_0\n\ \n\ - iis7:\n\ address: \n\ - 192.168.0.0/24\n\ - 192.168.10.0/24\n\ personality: IIS_7_0\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "192.168.10.42"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; htp_cfg_t *htp = cfglist.cfg; void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)f->dst.addr_data32, cfgtree, &user_data); if (user_data != NULL) { HTPCfgRec *htp_cfg_rec = user_data; htp = htp_cfg_rec->cfg; SCLogDebug("LIBHTP using config: %p", htp); } if (htp == NULL) { printf("Could not get config for: %s\n", addr); goto end; } StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } if (HTPStateGetTxCnt(htp_state) != 2) { printf("HTPStateGetTxCnt(htp_state) failure\n"); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; if (tx->cfg != htp) { printf("wrong HTP config (%p instead of %p - default=%p): ", tx->cfg, htp, cfglist.cfg); goto end; } tx = HTPStateGetTx(htp_state, 1); if (tx == NULL) goto end; if (tx->cfg != htp) { printf("wrong HTP config (%p instead of %p - default=%p): ", tx->cfg, htp, cfglist.cfg); goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /* disabled when we upgraded to libhtp 0.5.x */ #if 0 int HTPParserConfigTest04(void) { int result = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ path-control-char-handling: status_400\n\ path-convert-utf8: yes\n\ path-invalid-encoding-handling: remove_percent\n\ \n\ server-config:\n\ \n\ - apache-tomcat:\n\ personality: Tomcat_6_0\n\ path-invalid-utf8-handling: none\n\ path-nul-encoded-handling: status_404\n\ path-nul-raw-handling: status_400\n\ \n\ - iis7:\n\ personality: IIS_7_0\n\ path-replacement-char: o\n\ path-unicode-mapping: status_400\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); HTPCfgRec *cfg_rec = &cfglist; if (cfg_rec->cfg->path_control_char_handling != STATUS_400 || cfg_rec->cfg->path_convert_utf8 != 1 || cfg_rec->cfg->path_invalid_encoding_handling != URL_DECODER_REMOVE_PERCENT) { printf("failed 1\n"); goto end; } cfg_rec = cfg_rec->next; if (cfg_rec->cfg->bestfit_replacement_char != 'o' || cfg_rec->cfg->path_unicode_mapping != STATUS_400) { printf("failed 2\n"); goto end; } cfg_rec = cfg_rec->next; if (cfg_rec->cfg->path_invalid_utf8_handling != NONE || cfg_rec->cfg->path_nul_encoded_handling != STATUS_404 || cfg_rec->cfg->path_nul_raw_handling != STATUS_400) { printf("failed 3\n"); goto end; } result = 1; end: HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); return result; } #endif /** \test Test %2f decoding in profile Apache_2_2 * * %2f in path is left untouched * %2f in query string is normalized to %2F * %252f in query string is decoded/normalized to %2F */ static int HTPParserDecodingTest01(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /abc%2fdef HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n" "GET /abc/def?ghi%2fjkl HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n" "GET /abc/def?ghi%252fjkl HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: Apache_2\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/abc%2fdef"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } uint8_t ref2[] = "/abc/def?ghi/jkl"; reflen = sizeof(ref2) - 1; tx = HTPStateGetTx(htp_state, 1); if (tx == NULL) goto end; tx_ud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref2, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref2, reflen); printf("\": "); goto end; } } uint8_t ref3[] = "/abc/def?ghi%2fjkl"; reflen = sizeof(ref3) - 1; tx = HTPStateGetTx(htp_state, 2); if (tx == NULL) goto end; tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref3, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref3, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test %2f decoding in profile IDS * * %2f in path decoded to / * %2f in query string is decoded to / * %252f in query string is decoded to %2F */ static int HTPParserDecodingTest02(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /abc%2fdef HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n" "GET /abc/def?ghi%2fjkl HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n" "GET /abc/def?ghi%252fjkl HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: no\n\ double-decode-query: no\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/abc/def"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } uint8_t ref2[] = "/abc/def?ghi/jkl"; reflen = sizeof(ref2) - 1; tx = HTPStateGetTx(htp_state, 1); if (tx == NULL) goto end; tx_ud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref2, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref2, reflen); printf("\": "); goto end; } } uint8_t ref3[] = "/abc/def?ghi%2fjkl"; reflen = sizeof(ref3) - 1; tx = HTPStateGetTx(htp_state, 2); if (tx == NULL) goto end; tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX" (3): ", (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref3, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref3, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test %2f decoding in profile IDS with double-decode-* options * * %252f in path decoded to / * %252f in query string is decoded to / */ static int HTPParserDecodingTest03(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /abc%252fdef HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n" "GET /abc/def?ghi%252fjkl HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: yes\n\ double-decode-query: yes\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/abc/def"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } uint8_t ref2[] = "/abc/def?ghi/jkl"; reflen = sizeof(ref2) - 1; tx = HTPStateGetTx(htp_state, 1); if (tx == NULL) goto end; tx_ud = (HtpTxUserData *)htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref2, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref2, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test http:// in query profile IDS */ static int HTPParserDecodingTest04(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /abc/def?a=http://www.abc.com/ HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: yes\n\ double-decode-query: yes\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/abc/def?a=http://www.abc.com/"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test \ char in query profile IDS. Bug 739 */ static int HTPParserDecodingTest05(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /index?id=\\\" HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: yes\n\ double-decode-query: yes\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/index?id=\\\""; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test + char in query. Bug 1035 */ static int HTPParserDecodingTest06(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /put.php?ip=1.2.3.4&port=+6000 HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: yes\n\ double-decode-query: yes\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/put.php?ip=1.2.3.4&port=+6000"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test + char in query. Bug 1035 */ static int HTPParserDecodingTest07(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET /put.php?ip=1.2.3.4&port=+6000 HTTP/1.1\r\nHost: www.domain.ltd\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: yes\n\ double-decode-query: yes\n\ query-plusspace-decode: yes\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/put.php?ip=1.2.3.4&port= 6000"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test 'proxy' URI normalization. Ticket 1008 */ static int HTPParserDecodingTest08(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET http://suricata-ids.org/blah/ HTTP/1.1\r\nHost: suricata-ids.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "/blah/"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test Test 'proxy' URI normalization. Ticket 1008 */ static int HTPParserDecodingTest09(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "GET http://suricata-ids.org/blah/ HTTP/1.1\r\nHost: suricata-ids.org\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ uri-include-all: true\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); char *addr = "4.3.2.1"; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", addr, 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < httplen1; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (httplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, &httpbuf1[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } uint8_t ref1[] = "http://suricata-ids.org/blah/"; size_t reflen = sizeof(ref1) - 1; htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL) goto end; HtpTxUserData *tx_ud = (HtpTxUserData *) htp_tx_get_user_data(tx); if (tx_ud != NULL && tx_ud->request_uri_normalized != NULL) { if (reflen != bstr_len(tx_ud->request_uri_normalized)) { printf("normalized uri len should be %"PRIuMAX", is %"PRIuMAX, (uintmax_t)reflen, (uintmax_t)bstr_len(tx_ud->request_uri_normalized)); goto end; } if (memcmp(bstr_ptr(tx_ud->request_uri_normalized), ref1, bstr_len(tx_ud->request_uri_normalized)) != 0) { printf("normalized uri \""); PrintRawUriFp(stdout, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized)); printf("\" != \""); PrintRawUriFp(stdout, ref1, reflen); printf("\": "); goto end; } } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test BG box crash -- chunks are messed up. Observed for real. */ static int HTPBodyReassemblyTest01(void) { int result = 0; HtpTxUserData htud; memset(&htud, 0x00, sizeof(htud)); HtpState hstate; memset(&hstate, 0x00, sizeof(hstate)); Flow flow; memset(&flow, 0x00, sizeof(flow)); AppLayerParserState *parser = AppLayerParserStateAlloc(); htp_tx_t tx; memset(&tx, 0, sizeof(tx)); hstate.f = &flow; flow.alparser = parser; uint8_t chunk1[] = "--e5a320f21416a02493a0a6f561b1c494\r\nContent-Disposition: form-data; name=\"uploadfile\"; filename=\"D2GUef.jpg\"\r"; uint8_t chunk2[] = "POST /uri HTTP/1.1\r\nHost: hostname.com\r\nKeep-Alive: 115\r\nAccept-Charset: utf-8\r\nUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nConnection: keep-alive\r\nContent-length: 68102\r\nReferer: http://otherhost.com\r\nAccept-Encoding: gzip\r\nContent-Type: multipart/form-data; boundary=e5a320f21416a02493a0a6f561b1c494\r\nCookie: blah\r\nAccept-Language: us\r\n\r\n--e5a320f21416a02493a0a6f561b1c494\r\nContent-Disposition: form-data; name=\"uploadfile\"; filename=\"D2GUef.jpg\"\r"; int r = HtpBodyAppendChunk(NULL, &htud.request_body, chunk1, sizeof(chunk1)-1); BUG_ON(r != 0); r = HtpBodyAppendChunk(NULL, &htud.request_body, chunk2, sizeof(chunk2)-1); BUG_ON(r != 0); const uint8_t *chunks_buffer = NULL; uint32_t chunks_buffer_len = 0; HtpRequestBodyReassemble(&htud, &chunks_buffer, &chunks_buffer_len); if (chunks_buffer == NULL) { goto end; } #ifdef PRINT printf("REASSCHUNK START: \n"); PrintRawDataFp(stdout, chunks_buffer, chunks_buffer_len); printf("REASSCHUNK END: \n"); #endif HtpRequestBodyHandleMultipart(&hstate, &htud, &tx, chunks_buffer, chunks_buffer_len); if (htud.request_body.content_len_so_far != 669) { printf("htud.request_body.content_len_so_far %"PRIu64": ", htud.request_body.content_len_so_far); goto end; } if (hstate.files_ts != NULL) goto end; result = 1; end: return result; } /** \test BG crash */ static int HTPSegvTest01(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /uri HTTP/1.1\r\nHost: hostname.com\r\nKeep-Alive: 115\r\nAccept-Charset: utf-8\r\nUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nConnection: keep-alive\r\nContent-length: 68102\r\nReferer: http://otherhost.com\r\nAccept-Encoding: gzip\r\nContent-Type: multipart/form-data; boundary=e5a320f21416a02493a0a6f561b1c494\r\nCookie: blah\r\nAccept-Language: us\r\n\r\n--e5a320f21416a02493a0a6f561b1c494\r\nContent-Disposition: form-data; name=\"uploadfile\"; filename=\"D2GUef.jpg\"\r"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: no\n\ double-decode-query: no\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ "; ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 1 again <<<<\n"); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetDecoderEvents(f->alparser); if (decoder_events != NULL) { printf("app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test Test really long request, this should result in HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG */ int HTPParserTest14(void) { int result = 0; Flow *f = NULL; char *httpbuf = NULL; size_t len = 18887; TcpSession ssn; HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: no\n\ double-decode-query: no\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ "; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); httpbuf = SCMalloc(len); if (unlikely(httpbuf == NULL)) goto end; memset(httpbuf, 0x00, len); /* create the request with a longer than 18k cookie */ strlcpy(httpbuf, "GET /blah/ HTTP/1.1\r\n" "Host: myhost.lan\r\n" "Connection: keep-alive\r\n" "Accept: */*\r\n" "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36\r\n" "Referer: http://blah.lan/\r\n" "Accept-Encoding: gzip,deflate,sdch\r\nAccept-Language: en-US,en;q=0.8\r\n" "Cookie: ", len); size_t o = strlen(httpbuf); for ( ; o < len - 4; o++) { httpbuf[o] = 'A'; } httpbuf[len - 4] = '\r'; httpbuf[len - 3] = '\n'; httpbuf[len - 2] = '\r'; httpbuf[len - 1] = '\n'; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < len; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (len - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, (uint8_t *)&httpbuf[u], 1); if (u < 18294) { /* first 18294 bytes should result in 0 */ if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } } else if (u == 18294UL) { /* byte 18294 should result in error */ if (r != -1) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " -1: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } /* break out, htp state is in error state now */ FLOWLOCK_UNLOCK(f); break; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL || tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events == NULL) { printf("no app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); if (decoder_events->events[0] != HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG) { printf("HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG not set: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); if (httpbuf != NULL) SCFree(httpbuf); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); return result; } /** \test Test really long request (same as HTPParserTest14), now with config * update to allow it */ int HTPParserTest15(void) { int result = 0; Flow *f = NULL; char *httpbuf = NULL; size_t len = 18887; TcpSession ssn; HtpState *htp_state = NULL; int r = 0; char input[] = "\ %YAML 1.1\n\ ---\n\ libhtp:\n\ \n\ default-config:\n\ personality: IDS\n\ double-decode-path: no\n\ double-decode-query: no\n\ request-body-limit: 0\n\ response-body-limit: 0\n\ meta-field-limit: 20000\n\ "; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); ConfCreateContextBackup(); ConfInit(); HtpConfigCreateBackup(); ConfYamlLoadString(input, strlen(input)); HTPConfigure(); httpbuf = SCMalloc(len); if (unlikely(httpbuf == NULL)) goto end; memset(httpbuf, 0x00, len); /* create the request with a longer than 18k cookie */ strlcpy(httpbuf, "GET /blah/ HTTP/1.1\r\n" "Host: myhost.lan\r\n" "Connection: keep-alive\r\n" "Accept: */*\r\n" "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36\r\n" "Referer: http://blah.lan/\r\n" "Accept-Encoding: gzip,deflate,sdch\r\nAccept-Language: en-US,en;q=0.8\r\n" "Cookie: ", len); size_t o = strlen(httpbuf); for ( ; o < len - 4; o++) { httpbuf[o] = 'A'; } httpbuf[len - 4] = '\r'; httpbuf[len - 3] = '\n'; httpbuf[len - 2] = '\r'; httpbuf[len - 1] = '\n'; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint32_t u; for (u = 0; u < len; u++) { uint8_t flags = 0; if (u == 0) flags = STREAM_TOSERVER|STREAM_START; else if (u == (len - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else flags = STREAM_TOSERVER; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, (uint8_t *)&httpbuf[u], 1); if (r != 0) { printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected" " 0: ", u, r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); } htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL || tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events != NULL) { printf("app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); if (httpbuf != NULL) SCFree(httpbuf); HTPFreeConfig(); ConfDeInit(); ConfRestoreContextBackup(); HtpConfigRestoreBackup(); return result; } /** \test Test unusual delims in request line HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG */ int HTPParserTest16(void) { int result = 0; Flow *f = NULL; TcpSession ssn; HtpState *htp_state = NULL; int r = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); uint8_t httpbuf[] = "GET\f/blah/\fHTTP/1.1\r\n" "Host: myhost.lan\r\n" "Connection: keep-alive\r\n" "Accept: */*\r\n" "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36\r\n" "Referer: http://blah.lan/\r\n" "Accept-Encoding: gzip,deflate,sdch\r\nAccept-Language: en-US,en;q=0.8\r\n" "Cookie: blah\r\n\r\n"; size_t len = sizeof(httpbuf) - 1; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); uint8_t flags = STREAM_TOSERVER|STREAM_START|STREAM_EOF; FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, flags, (uint8_t *)httpbuf, len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); htp_state = f->alstate; if (htp_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(htp_state, 0); if (tx == NULL || tx->request_method_number != HTP_M_GET || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", tx ? bstr_util_strdup_to_c(tx->request_method) : "tx null", tx ? bstr_util_strdup_to_c(tx->request_protocol) : "tx null"); goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events == NULL) { printf("no app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); if (decoder_events->events[0] != HTTP_DECODER_EVENT_METHOD_DELIM_NON_COMPLIANT) { printf("HTTP_DECODER_EVENT_METHOD_DELIM_NON_COMPLIANT not set: "); goto end; } if (decoder_events->events[1] != HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT) { printf("HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT not set: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (htp_state != NULL) HTPStateFree(htp_state); UTHFreeFlow(f); return result; } /** \test CONNECT with plain text HTTP being tunneled */ int HTPParserTest17(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; /* CONNECT setup */ uint8_t httpbuf1[] = "CONNECT abc:443 HTTP/1.1\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ /* plain text HTTP */ uint8_t httpbuf3[] = "GET / HTTP/1.1\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "HTTP/1.1 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); if (tx == NULL) goto end; htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_CONNECT || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_POST and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } tx = HTPStateGetTx(http_state, 1); if (tx == NULL) goto end; h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_GET || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test CONNECT with plain text HTTP being tunneled */ int HTPParserTest18(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; /* CONNECT setup */ uint8_t httpbuf1[] = "CONNECT abc:443 HTTP/1.1\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ /* plain text HTTP */ uint8_t httpbuf3[] = "GE"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "T / HTTP/1.1\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "HTTP/1.1 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); if (tx == NULL) goto end; htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_CONNECT || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_POST and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } tx = HTPStateGetTx(http_state, 1); if (tx == NULL) goto end; h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_GET || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_GET and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test CONNECT with TLS content (start of it at least) */ int HTPParserTest19(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; /* CONNECT setup */ uint8_t httpbuf1[] = "CONNECT abc:443 HTTP/1.1\r\nUser-Agent: Victor/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.1 200 OK\r\nServer: VictorServer/1.0\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ /* start of TLS/SSL */ uint8_t httpbuf3[] = "\x16\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOCLIENT | STREAM_START, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } htp_tx_t *tx = HTPStateGetTx(http_state, 0); if (tx == NULL) goto end; htp_header_t *h = htp_table_get_index(tx->request_headers, 0, NULL); if (tx->request_method_number != HTP_M_CONNECT || h == NULL || tx->request_protocol_number != HTP_PROTOCOL_1_1) { printf("expected method M_POST and got %s: , expected protocol " "HTTP/1.1 and got %s \n", bstr_util_strdup_to_c(tx->request_method), bstr_util_strdup_to_c(tx->request_protocol)); goto end; } if (tx->response_status_number != 200) { printf("expected response 200 OK and got %"PRId32" %s: , expected protocol " "HTTP/1.1 and got %s \n", tx->response_status_number, bstr_util_strdup_to_c(tx->response_message), bstr_util_strdup_to_c(tx->response_protocol)); goto end; } /* no new tx should have been set up for the tunneled data */ tx = HTPStateGetTx(http_state, 1); if (tx != NULL) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } #endif /* UNITTESTS */ /** * \brief Register the Unit tests for the HTTP protocol */ void HTPParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HTPParserTest01", HTPParserTest01); UtRegisterTest("HTPParserTest01a", HTPParserTest01a); UtRegisterTest("HTPParserTest02", HTPParserTest02); UtRegisterTest("HTPParserTest03", HTPParserTest03); UtRegisterTest("HTPParserTest04", HTPParserTest04); UtRegisterTest("HTPParserTest05", HTPParserTest05); UtRegisterTest("HTPParserTest06", HTPParserTest06); UtRegisterTest("HTPParserTest07", HTPParserTest07); UtRegisterTest("HTPParserTest08", HTPParserTest08); UtRegisterTest("HTPParserTest09", HTPParserTest09); UtRegisterTest("HTPParserTest10", HTPParserTest10); UtRegisterTest("HTPParserTest11", HTPParserTest11); UtRegisterTest("HTPParserTest12", HTPParserTest12); UtRegisterTest("HTPParserTest13", HTPParserTest13); UtRegisterTest("HTPParserConfigTest01", HTPParserConfigTest01); UtRegisterTest("HTPParserConfigTest02", HTPParserConfigTest02); UtRegisterTest("HTPParserConfigTest03", HTPParserConfigTest03); #if 0 /* disabled when we upgraded to libhtp 0.5.x */ UtRegisterTest("HTPParserConfigTest04", HTPParserConfigTest04, 1); #endif UtRegisterTest("HTPParserDecodingTest01", HTPParserDecodingTest01); UtRegisterTest("HTPParserDecodingTest02", HTPParserDecodingTest02); UtRegisterTest("HTPParserDecodingTest03", HTPParserDecodingTest03); UtRegisterTest("HTPParserDecodingTest04", HTPParserDecodingTest04); UtRegisterTest("HTPParserDecodingTest05", HTPParserDecodingTest05); UtRegisterTest("HTPParserDecodingTest06", HTPParserDecodingTest06); UtRegisterTest("HTPParserDecodingTest07", HTPParserDecodingTest07); UtRegisterTest("HTPParserDecodingTest08", HTPParserDecodingTest08); UtRegisterTest("HTPParserDecodingTest09", HTPParserDecodingTest09); UtRegisterTest("HTPBodyReassemblyTest01", HTPBodyReassemblyTest01); UtRegisterTest("HTPSegvTest01", HTPSegvTest01); UtRegisterTest("HTPParserTest14", HTPParserTest14); UtRegisterTest("HTPParserTest15", HTPParserTest15); UtRegisterTest("HTPParserTest16", HTPParserTest16); UtRegisterTest("HTPParserTest17", HTPParserTest17); UtRegisterTest("HTPParserTest18", HTPParserTest18); UtRegisterTest("HTPParserTest19", HTPParserTest19); HTPFileParserRegisterTests(); HTPXFFParserRegisterTests(); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-spm-bs2bm.c0000644000000000000000000001337613051004444013734 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Bs2Bm use a simple context array to determine the charactes * that are not present on the pattern. This way on partial matches * broken by a char not present, we can skip to the next character * making less checks */ #include "suricata-common.h" #include "suricata.h" #include "util-spm-bs2bm.h" /** * \brief Array setup function for Bs2Bm of bad characters index (not found at the needle) * * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * \param badchars pointer to an empty array of bachars. The array prepared contains * characters that can't be inside the needle_len. So the skips can be * faster */ void Bs2BmBadchars(const uint8_t *needle, uint16_t needle_len, uint8_t *badchars) { uint32_t i; for (i = 0; i < ALPHABET_SIZE; i++) badchars[i] = 1; /* set to 0 the values where index as ascii is present * because they are not badchars */ for (i = 0; i < needle_len; i++) badchars[needle[i]] = 0; } /** * \brief Array setup function for Bs2BmNocase of bad characters index (not found at the needle) * * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * \param badchars pointer to an empty array of bachars. The array prepared contains * characters that can't be inside the needle_len. So the skips can be * faster */ void Bs2BmBadcharsNocase(const uint8_t *needle, uint16_t needle_len, uint8_t *badchars) { uint32_t i; for (i = 0; i < ALPHABET_SIZE; i++) badchars[i] = 1; /* set to 0 the values where index as ascii is present * because they are not badchars */ for (i = 0; i < needle_len; i++) { badchars[u8_tolower(needle[i])] = 0; } } /** * \brief Basic search with a bad characters array. The array badchars contains * flags at character's ascii index that can't be inside the needle. So the skips can be * faster * * \param haystack pointer to the buffer to search in * \param haystack_len length limit of the buffer * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() * * \retval ptr to start of the match; NULL if no match */ uint8_t * Bs2Bm(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len, uint8_t badchars[]) { const uint8_t *h, *n; const uint8_t *hmax = haystack + haystack_len; const uint8_t *nmax = needle + needle_len; if (needle_len == 0 || needle_len > haystack_len) return NULL; for (n = needle; nmax - n <= hmax - haystack; haystack++) { if (*haystack != *n) { continue; } /* one byte needles */ if (needle_len == 1) return (uint8_t *)haystack; for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { if (*h != *n) { if (badchars[*h] == 1) { /* skip it! */ haystack = h; } break; } /* if we run out of needle we fully matched */ if (n == nmax - 1 ) { return (uint8_t *)haystack; } } n = needle; } return NULL; } /** * \brief Basic search case less with a bad characters array. The array badchars contains * flags at character's ascii index that can't be inside the needle. So the skips can be * faster * * \param haystack pointer to the buffer to search in * \param haystack_len length limit of the buffer * \param neddle pointer to the pattern we ar searching for * \param needle_len length limit of the needle * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars() * * \retval ptr to start of the match; NULL if no match */ uint8_t *Bs2BmNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint16_t needle_len, uint8_t badchars[]) { const uint8_t *h, *n; const uint8_t *hmax = haystack + haystack_len; const uint8_t *nmax = needle + needle_len; if (needle_len == 0 || needle_len > haystack_len) return NULL; for (n = needle; nmax - n <= hmax - haystack; haystack++) { if (u8_tolower(*haystack) != u8_tolower(*n)) { continue; } /* one byte needles */ if (needle_len == 1) return (uint8_t *)haystack; for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) { if (u8_tolower(*h) != u8_tolower(*n)) { if (badchars[u8_tolower(*h)] == 1) { /* skip it! */ haystack = h; } break; } /* if we run out of needle we fully matched */ if (n == nmax - 1) { return (uint8_t *)haystack; } } n = needle; } return NULL; } suricata-3.2.1/src/detect-noalert.c0000644000000000000000000000307313051004444014062 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the noalert keyword */ #include "suricata-common.h" #include "detect.h" #include "util-debug.h" static int DetectNoalertSetup (DetectEngineCtx *, Signature *, char *); void DetectNoalertRegister (void) { sigmatch_table[DETECT_NOALERT].name = "noalert"; sigmatch_table[DETECT_NOALERT].Match = NULL; sigmatch_table[DETECT_NOALERT].Setup = DetectNoalertSetup; sigmatch_table[DETECT_NOALERT].Free = NULL; sigmatch_table[DETECT_NOALERT].RegisterTests = NULL; sigmatch_table[DETECT_NOALERT].flags |= SIGMATCH_NOOPT; } static int DetectNoalertSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr) { if (nullstr != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "nocase has no value"); return -1; } s->flags |= SIG_FLAG_NOALERT; return 0; } suricata-3.2.1/src/flow-queue.h0000644000000000000000000000440413051004444013245 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __FLOW_QUEUE_H__ #define __FLOW_QUEUE_H__ #include "suricata-common.h" #include "flow.h" /** Spinlocks or Mutex for the flow queues. */ //#define FQLOCK_SPIN #define FQLOCK_MUTEX #ifdef FQLOCK_SPIN #ifdef FQLOCK_MUTEX #error Cannot enable both FQLOCK_SPIN and FQLOCK_MUTEX #endif #endif /* Define a queue for storing flows */ typedef struct FlowQueue_ { Flow *top; Flow *bot; uint32_t len; #ifdef DBG_PERF uint32_t dbg_maxlen; #endif /* DBG_PERF */ #ifdef FQLOCK_MUTEX SCMutex m; #elif defined FQLOCK_SPIN SCSpinlock s; #else #error Enable FQLOCK_SPIN or FQLOCK_MUTEX #endif } FlowQueue; #ifdef FQLOCK_SPIN #define FQLOCK_INIT(q) SCSpinInit(&(q)->s, 0) #define FQLOCK_DESTROY(q) SCSpinDestroy(&(q)->s) #define FQLOCK_LOCK(q) SCSpinLock(&(q)->s) #define FQLOCK_TRYLOCK(q) SCSpinTrylock(&(q)->s) #define FQLOCK_UNLOCK(q) SCSpinUnlock(&(q)->s) #elif defined FQLOCK_MUTEX #define FQLOCK_INIT(q) SCMutexInit(&(q)->m, NULL) #define FQLOCK_DESTROY(q) SCMutexDestroy(&(q)->m) #define FQLOCK_LOCK(q) SCMutexLock(&(q)->m) #define FQLOCK_TRYLOCK(q) SCMutexTrylock(&(q)->m) #define FQLOCK_UNLOCK(q) SCMutexUnlock(&(q)->m) #else #error Enable FQLOCK_SPIN or FQLOCK_MUTEX #endif /* prototypes */ FlowQueue *FlowQueueNew(); FlowQueue *FlowQueueInit(FlowQueue *); void FlowQueueDestroy (FlowQueue *); void FlowEnqueue (FlowQueue *, Flow *); Flow *FlowDequeue (FlowQueue *); void FlowMoveToSpare(Flow *); #endif /* __FLOW_QUEUE_H__ */ suricata-3.2.1/src/decode.h0000644000000000000000000011125113051004444012376 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_H__ #define __DECODE_H__ //#define DBG_THREADS #define COUNTERS #include "suricata-common.h" #include "threadvars.h" #include "decode-events.h" #include "flow-worker.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda-buffer.h" #include "util-cuda-vars.h" #endif /* __SC_CUDA_SUPPORT__ */ typedef enum { CHECKSUM_VALIDATION_DISABLE, CHECKSUM_VALIDATION_ENABLE, CHECKSUM_VALIDATION_AUTO, CHECKSUM_VALIDATION_RXONLY, CHECKSUM_VALIDATION_KERNEL, } ChecksumValidationMode; enum PktSrcEnum { PKT_SRC_WIRE = 1, PKT_SRC_DECODER_GRE, PKT_SRC_DECODER_IPV4, PKT_SRC_DECODER_IPV6, PKT_SRC_DECODER_TEREDO, PKT_SRC_DEFRAG, PKT_SRC_STREAM_TCP_STREAM_END_PSEUDO, PKT_SRC_FFR, }; #include "source-nflog.h" #include "source-nfq.h" #include "source-ipfw.h" #include "source-pcap.h" #include "source-af-packet.h" #include "source-mpipe.h" #include "source-netmap.h" #include "action-globals.h" #include "decode-erspan.h" #include "decode-ethernet.h" #include "decode-gre.h" #include "decode-ppp.h" #include "decode-pppoe.h" #include "decode-sll.h" #include "decode-ipv4.h" #include "decode-ipv6.h" #include "decode-icmpv4.h" #include "decode-icmpv6.h" #include "decode-tcp.h" #include "decode-udp.h" #include "decode-sctp.h" #include "decode-raw.h" #include "decode-null.h" #include "decode-vlan.h" #include "decode-mpls.h" #include "detect-reference.h" #include "app-layer-protos.h" /* forward declarations */ struct DetectionEngineThreadCtx_; typedef struct AppLayerThreadCtx_ AppLayerThreadCtx; struct PktPool_; /* declare these here as they are called from the * PACKET_RECYCLE and PACKET_CLEANUP macro's. */ typedef struct AppLayerDecoderEvents_ AppLayerDecoderEvents; void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events); void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events); /* Address */ typedef struct Address_ { char family; union { uint32_t address_un_data32[4]; /* type-specific field */ uint16_t address_un_data16[8]; /* type-specific field */ uint8_t address_un_data8[16]; /* type-specific field */ } address; } Address; #define addr_data32 address.address_un_data32 #define addr_data16 address.address_un_data16 #define addr_data8 address.address_un_data8 #define COPY_ADDRESS(a, b) do { \ (b)->family = (a)->family; \ (b)->addr_data32[0] = (a)->addr_data32[0]; \ (b)->addr_data32[1] = (a)->addr_data32[1]; \ (b)->addr_data32[2] = (a)->addr_data32[2]; \ (b)->addr_data32[3] = (a)->addr_data32[3]; \ } while (0) /* Set the IPv4 addresses into the Addrs of the Packet. * Make sure p->ip4h is initialized and validated. * * We set the rest of the struct to 0 so we can * prevent using memset. */ #define SET_IPV4_SRC_ADDR(p, a) do { \ (a)->family = AF_INET; \ (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) #define SET_IPV4_DST_ADDR(p, a) do { \ (a)->family = AF_INET; \ (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) /* clear the address structure by setting all fields to 0 */ #define CLEAR_ADDR(a) do { \ (a)->family = 0; \ (a)->addr_data32[0] = 0; \ (a)->addr_data32[1] = 0; \ (a)->addr_data32[2] = 0; \ (a)->addr_data32[3] = 0; \ } while (0) /* Set the IPv6 addressesinto the Addrs of the Packet. * Make sure p->ip6h is initialized and validated. */ #define SET_IPV6_SRC_ADDR(p, a) do { \ (a)->family = AF_INET6; \ (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \ (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \ (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \ (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \ } while (0) #define SET_IPV6_DST_ADDR(p, a) do { \ (a)->family = AF_INET6; \ (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \ (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \ (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \ (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \ } while (0) /* Set the TCP ports into the Ports of the Packet. * Make sure p->tcph is initialized and validated. */ #define SET_TCP_SRC_PORT(pkt, prt) do { \ SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \ } while (0) #define SET_TCP_DST_PORT(pkt, prt) do { \ SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \ } while (0) /* Set the UDP ports into the Ports of the Packet. * Make sure p->udph is initialized and validated. */ #define SET_UDP_SRC_PORT(pkt, prt) do { \ SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \ } while (0) #define SET_UDP_DST_PORT(pkt, prt) do { \ SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \ } while (0) /* Set the SCTP ports into the Ports of the Packet. * Make sure p->sctph is initialized and validated. */ #define SET_SCTP_SRC_PORT(pkt, prt) do { \ SET_PORT(SCTP_GET_SRC_PORT((pkt)), *(prt)); \ } while (0) #define SET_SCTP_DST_PORT(pkt, prt) do { \ SET_PORT(SCTP_GET_DST_PORT((pkt)), *(prt)); \ } while (0) #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0]) #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0]) #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32) #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32) #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32) #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32) #define GET_TCP_SRC_PORT(p) ((p)->sp) #define GET_TCP_DST_PORT(p) ((p)->dp) #define GET_PKT_LEN(p) ((p)->pktlen) #define GET_PKT_DATA(p) ((((p)->ext_pkt) == NULL ) ? (uint8_t *)((p) + 1) : (p)->ext_pkt) #define GET_PKT_DIRECT_DATA(p) (uint8_t *)((p) + 1) #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size) #define SET_PKT_LEN(p, len) do { \ (p)->pktlen = (len); \ } while (0) /* Port is just a uint16_t */ typedef uint16_t Port; #define SET_PORT(v, p) ((p) = (v)) #define COPY_PORT(a,b) ((b) = (a)) #define CMP_ADDR(a1, a2) \ (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \ (a1)->addr_data32[2] == (a2)->addr_data32[2] && \ (a1)->addr_data32[1] == (a2)->addr_data32[1] && \ (a1)->addr_data32[0] == (a2)->addr_data32[0])) #define CMP_PORT(p1, p2) \ ((p1) == (p2)) /*Given a packet pkt offset to the start of the ip header in a packet *We determine the ip version. */ #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4)) #define PKT_IS_IPV4(p) (((p)->ip4h != NULL)) #define PKT_IS_IPV6(p) (((p)->ip6h != NULL)) #define PKT_IS_TCP(p) (((p)->tcph != NULL)) #define PKT_IS_UDP(p) (((p)->udph != NULL)) #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL)) #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL)) #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER)) #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT)) #define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p))) /* Retrieve proto regardless of IP version */ #define IP_GET_IPPROTO(p) \ (p->proto ? p->proto : \ (PKT_IS_IPV4((p))? IPV4_GET_IPPROTO((p)) : (PKT_IS_IPV6((p))? IPV6_GET_L4PROTO((p)) : 0))) /* structure to store the sids/gids/etc the detection engine * found in this packet */ typedef struct PacketAlert_ { SigIntId num; /* Internal num, used for sorting */ uint8_t action; /* Internal num, used for sorting */ uint8_t flags; struct Signature_ *s; uint64_t tx_id; } PacketAlert; /** After processing an alert by the thresholding module, if at * last it gets triggered, we might want to stick the drop action to * the flow on IPS mode */ #define PACKET_ALERT_FLAG_DROP_FLOW 0x01 /** alert was generated based on state */ #define PACKET_ALERT_FLAG_STATE_MATCH 0x02 /** alert was generated based on stream */ #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04 /** alert is in a tx, tx_id set */ #define PACKET_ALERT_FLAG_TX 0x08 /** action was changed by rate_filter */ #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10 #define PACKET_ALERT_MAX 15 typedef struct PacketAlerts_ { uint16_t cnt; PacketAlert alerts[PACKET_ALERT_MAX]; /* single pa used when we're dropping, * so we can log it out in the drop log. */ PacketAlert drop; } PacketAlerts; /** number of decoder events we support per packet. Power of 2 minus 1 * for memory layout */ #define PACKET_ENGINE_EVENT_MAX 15 /** data structure to store decoder, defrag and stream events */ typedef struct PacketEngineEvents_ { uint8_t cnt; /**< number of events */ uint8_t events[PACKET_ENGINE_EVENT_MAX]; /**< array of events */ } PacketEngineEvents; typedef struct PktVar_ { const char *name; struct PktVar_ *next; /* right now just implement this as a list, * in the long run we have thing of something * faster. */ uint8_t *value; uint16_t value_len; } PktVar; #ifdef PROFILING /** \brief Per TMM stats storage */ typedef struct PktProfilingTmmData_ { uint64_t ticks_start; uint64_t ticks_end; #ifdef PROFILE_LOCKING uint64_t mutex_lock_cnt; uint64_t mutex_lock_wait_ticks; uint64_t mutex_lock_contention; uint64_t spin_lock_cnt; uint64_t spin_lock_wait_ticks; uint64_t spin_lock_contention; uint64_t rww_lock_cnt; uint64_t rww_lock_wait_ticks; uint64_t rww_lock_contention; uint64_t rwr_lock_cnt; uint64_t rwr_lock_wait_ticks; uint64_t rwr_lock_contention; #endif } PktProfilingTmmData; typedef struct PktProfilingData_ { uint64_t ticks_start; uint64_t ticks_end; } PktProfilingData; typedef struct PktProfilingDetectData_ { uint64_t ticks_start; uint64_t ticks_end; uint64_t ticks_spent; } PktProfilingDetectData; typedef struct PktProfilingAppData_ { uint64_t ticks_spent; } PktProfilingAppData; typedef struct PktProfilingLoggerData_ { uint64_t ticks_start; uint64_t ticks_end; uint64_t ticks_spent; } PktProfilingLoggerData; typedef struct PktProfilingPrefilterEngine_ { uint64_t ticks_spent; } PktProfilingPrefilterEngine; typedef struct PktProfilingPrefilterData_ { PktProfilingPrefilterEngine *engines; uint32_t size; /**< array size */ } PktProfilingPrefilterData; /** \brief Per pkt stats storage */ typedef struct PktProfiling_ { uint64_t ticks_start; uint64_t ticks_end; PktProfilingTmmData tmm[TMM_SIZE]; PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]; PktProfilingAppData app[ALPROTO_MAX]; PktProfilingDetectData detect[PROF_DETECT_SIZE]; PktProfilingLoggerData logger[LOGGER_SIZE]; PktProfilingPrefilterData prefilter; uint64_t proto_detect; } PktProfiling; #endif /* PROFILING */ /* forward declartion since Packet struct definition requires this */ struct PacketQueue_; /* sizes of the members: * src: 17 bytes * dst: 17 bytes * sp/type: 1 byte * dp/code: 1 byte * proto: 1 byte * recurs: 1 byte * * sum of above: 38 bytes * * flow ptr: 4/8 bytes * flags: 1 byte * flowflags: 1 byte * * sum of above 44/48 bytes */ typedef struct Packet_ { /* Addresses, Ports and protocol * these are on top so we can use * the Packet as a hash key */ Address src; Address dst; union { Port sp; uint8_t type; }; union { Port dp; uint8_t code; }; uint8_t proto; /* make sure we can't be attacked on when the tunneled packet * has the exact same tuple as the lower levels */ uint8_t recursion_level; uint16_t vlan_id[2]; uint8_t vlan_idx; /* flow */ uint8_t flowflags; /* coccinelle: Packet:flowflags:FLOW_PKT_ */ /* Pkt Flags */ uint32_t flags; struct Flow_ *flow; /* raw hash value for looking up the flow, will need to modulated to the * hash size still */ uint32_t flow_hash; struct timeval ts; union { /* nfq stuff */ #ifdef HAVE_NFLOG NFLOGPacketVars nflog_v; #endif /* HAVE_NFLOG */ #ifdef NFQ NFQPacketVars nfq_v; #endif /* NFQ */ #ifdef IPFW IPFWPacketVars ipfw_v; #endif /* IPFW */ #ifdef AF_PACKET AFPPacketVars afp_v; #endif #ifdef HAVE_MPIPE /* tilegx mpipe stuff */ MpipePacketVars mpipe_v; #endif #ifdef HAVE_NETMAP NetmapPacketVars netmap_v; #endif /** libpcap vars: shared by Pcap Live mode and Pcap File mode */ PcapPacketVars pcap_v; }; /** The release function for packet structure and data */ void (*ReleasePacket)(struct Packet_ *); /** The function triggering bypass the flow in the capture method. * Return 1 for success and 0 on error */ int (*BypassPacketsFlow)(struct Packet_ *); /* pkt vars */ PktVar *pktvar; /* header pointers */ EthernetHdr *ethh; /* Checksum for IP packets. */ int32_t level3_comp_csum; /* Check sum for TCP, UDP or ICMP packets */ int32_t level4_comp_csum; IPV4Hdr *ip4h; IPV6Hdr *ip6h; /* IPv4 and IPv6 are mutually exclusive */ union { IPV4Vars ip4vars; struct { IPV6Vars ip6vars; IPV6ExtHdrs ip6eh; }; }; /* Can only be one of TCP, UDP, ICMP at any given time */ union { TCPVars tcpvars; ICMPV4Vars icmpv4vars; ICMPV6Vars icmpv6vars; } l4vars; #define tcpvars l4vars.tcpvars #define icmpv4vars l4vars.icmpv4vars #define icmpv6vars l4vars.icmpv6vars TCPHdr *tcph; UDPHdr *udph; SCTPHdr *sctph; ICMPV4Hdr *icmpv4h; ICMPV6Hdr *icmpv6h; PPPHdr *ppph; PPPOESessionHdr *pppoesh; PPPOEDiscoveryHdr *pppoedh; GREHdr *greh; VLANHdr *vlanh[2]; /* ptr to the payload of the packet * with it's length. */ uint8_t *payload; uint16_t payload_len; /* IPS action to take */ uint8_t action; uint8_t pkt_src; /* storage: set to pointer to heap and extended via allocation if necessary */ uint32_t pktlen; uint8_t *ext_pkt; /* Incoming interface */ struct LiveDevice_ *livedev; PacketAlerts alerts; struct Host_ *host_src; struct Host_ *host_dst; /** packet number in the pcap file, matches wireshark */ uint64_t pcap_cnt; /* engine events */ PacketEngineEvents events; AppLayerDecoderEvents *app_layer_events; /* double linked list ptrs */ struct Packet_ *next; struct Packet_ *prev; /** data linktype in host order */ int datalink; /* used to hold flowbits only if debuglog is enabled */ int debuglog_flowbits_names_len; const char **debuglog_flowbits_names; /* tunnel/encapsulation handling */ struct Packet_ *root; /* in case of tunnel this is a ptr * to the 'real' packet, the one we * need to set the verdict on -- * It should always point to the lowest * packet in a encapsulated packet */ /** mutex to protect access to: * - tunnel_rtv_cnt * - tunnel_tpr_cnt */ SCMutex tunnel_mutex; /* ready to set verdict counter, only set in root */ uint16_t tunnel_rtv_cnt; /* tunnel packet ref count */ uint16_t tunnel_tpr_cnt; /** tenant id for this packet, if any. If 0 then no tenant was assigned. */ uint32_t tenant_id; /* The Packet pool from which this packet was allocated. Used when returning * the packet to its owner's stack. If NULL, then allocated with malloc. */ struct PktPool_ *pool; #ifdef PROFILING PktProfiling *profile; #endif #ifdef __SC_CUDA_SUPPORT__ CudaPacketVars cuda_pkt_vars; #endif } #ifdef HAVE_MPIPE /* mPIPE requires packet buffers to be aligned to 128 byte boundaries. */ __attribute__((aligned(128))) #endif Packet; /** highest mtu of the interfaces we monitor */ extern int g_default_mtu; #define DEFAULT_MTU 1500 #define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */ #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN) /* storage: maximum ip packet size + link header */ #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28) uint32_t default_packet_size; #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet)) typedef struct PacketQueue_ { Packet *top; Packet *bot; uint32_t len; #ifdef DBG_PERF uint32_t dbg_maxlen; #endif /* DBG_PERF */ SCMutex mutex_q; SCCondT cond_q; } PacketQueue; /** \brief Structure to hold thread specific data for all decode modules */ typedef struct DecodeThreadVars_ { /** Specific context for udp protocol detection (here atm) */ AppLayerThreadCtx *app_tctx; int vlan_disabled; /** stats/counters */ uint16_t counter_pkts; uint16_t counter_bytes; uint16_t counter_avg_pkt_size; uint16_t counter_max_pkt_size; uint16_t counter_invalid; uint16_t counter_eth; uint16_t counter_ipv4; uint16_t counter_ipv6; uint16_t counter_tcp; uint16_t counter_udp; uint16_t counter_icmpv4; uint16_t counter_icmpv6; uint16_t counter_sll; uint16_t counter_raw; uint16_t counter_null; uint16_t counter_sctp; uint16_t counter_ppp; uint16_t counter_gre; uint16_t counter_vlan; uint16_t counter_vlan_qinq; uint16_t counter_pppoe; uint16_t counter_teredo; uint16_t counter_mpls; uint16_t counter_ipv4inipv6; uint16_t counter_ipv6inipv6; uint16_t counter_erspan; /** frag stats - defrag runs in the context of the decoder. */ uint16_t counter_defrag_ipv4_fragments; uint16_t counter_defrag_ipv4_reassembled; uint16_t counter_defrag_ipv4_timeouts; uint16_t counter_defrag_ipv6_fragments; uint16_t counter_defrag_ipv6_reassembled; uint16_t counter_defrag_ipv6_timeouts; uint16_t counter_defrag_max_hit; uint16_t counter_flow_memcap; uint16_t counter_invalid_events[DECODE_EVENT_PACKET_MAX]; /* thread data for flow logging api: only used at forced * flow recycle during lookups */ void *output_flow_thread_data; #ifdef __SC_CUDA_SUPPORT__ CudaThreadVars cuda_vars; #endif } DecodeThreadVars; typedef struct CaptureStats_ { uint16_t counter_ips_accepted; uint16_t counter_ips_blocked; uint16_t counter_ips_rejected; uint16_t counter_ips_replaced; } CaptureStats; void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p); void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s); #define PACKET_CLEAR_L4VARS(p) do { \ memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \ } while (0) /** * \brief reset these to -1(indicates that the packet is fresh from the queue) */ #define PACKET_RESET_CHECKSUMS(p) do { \ (p)->level3_comp_csum = -1; \ (p)->level4_comp_csum = -1; \ } while (0) /* if p uses extended data, free them */ #define PACKET_FREE_EXTDATA(p) do { \ if ((p)->ext_pkt) { \ if (!((p)->flags & PKT_ZERO_COPY)) { \ SCFree((p)->ext_pkt); \ } \ (p)->ext_pkt = NULL; \ } \ } while(0) /** * \brief Initialize a packet structure for use. */ #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda-handlers.h" #include "util-mpm.h" #define PACKET_INITIALIZE(p) do { \ memset((p), 0x00, SIZE_OF_PACKET); \ SCMutexInit(&(p)->tunnel_mutex, NULL); \ PACKET_RESET_CHECKSUMS((p)); \ (p)->livedev = NULL; \ SCMutexInit(&(p)->cuda_pkt_vars.cuda_mutex, NULL); \ SCCondInit(&(p)->cuda_pkt_vars.cuda_cond, NULL); \ } while (0) #else #define PACKET_INITIALIZE(p) { \ SCMutexInit(&(p)->tunnel_mutex, NULL); \ PACKET_RESET_CHECKSUMS((p)); \ (p)->livedev = NULL; \ } #endif #define PACKET_RELEASE_REFS(p) do { \ FlowDeReference(&((p)->flow)); \ HostDeReference(&((p)->host_src)); \ HostDeReference(&((p)->host_dst)); \ } while (0) /** * \brief Recycle a packet structure for reuse. */ #define PACKET_REINIT(p) do { \ CLEAR_ADDR(&(p)->src); \ CLEAR_ADDR(&(p)->dst); \ (p)->sp = 0; \ (p)->dp = 0; \ (p)->proto = 0; \ (p)->recursion_level = 0; \ PACKET_FREE_EXTDATA((p)); \ (p)->flags = (p)->flags & PKT_ALLOC; \ (p)->flowflags = 0; \ (p)->pkt_src = 0; \ (p)->vlan_id[0] = 0; \ (p)->vlan_id[1] = 0; \ (p)->vlan_idx = 0; \ (p)->ts.tv_sec = 0; \ (p)->ts.tv_usec = 0; \ (p)->datalink = 0; \ (p)->action = 0; \ if ((p)->pktvar != NULL) { \ PktVarFree((p)->pktvar); \ (p)->pktvar = NULL; \ } \ (p)->ethh = NULL; \ if ((p)->ip4h != NULL) { \ CLEAR_IPV4_PACKET((p)); \ } \ if ((p)->ip6h != NULL) { \ CLEAR_IPV6_PACKET((p)); \ } \ if ((p)->tcph != NULL) { \ CLEAR_TCP_PACKET((p)); \ } \ if ((p)->udph != NULL) { \ CLEAR_UDP_PACKET((p)); \ } \ if ((p)->sctph != NULL) { \ CLEAR_SCTP_PACKET((p)); \ } \ if ((p)->icmpv4h != NULL) { \ CLEAR_ICMPV4_PACKET((p)); \ } \ if ((p)->icmpv6h != NULL) { \ CLEAR_ICMPV6_PACKET((p)); \ } \ (p)->ppph = NULL; \ (p)->pppoesh = NULL; \ (p)->pppoedh = NULL; \ (p)->greh = NULL; \ (p)->vlanh[0] = NULL; \ (p)->vlanh[1] = NULL; \ (p)->payload = NULL; \ (p)->payload_len = 0; \ (p)->BypassPacketsFlow = NULL; \ (p)->pktlen = 0; \ (p)->alerts.cnt = 0; \ (p)->alerts.drop.action = 0; \ (p)->pcap_cnt = 0; \ (p)->tunnel_rtv_cnt = 0; \ (p)->tunnel_tpr_cnt = 0; \ (p)->events.cnt = 0; \ AppLayerDecoderEventsResetEvents((p)->app_layer_events); \ (p)->next = NULL; \ (p)->prev = NULL; \ (p)->root = NULL; \ (p)->livedev = NULL; \ PACKET_RESET_CHECKSUMS((p)); \ PACKET_PROFILING_RESET((p)); \ p->tenant_id = 0; \ } while (0) #define PACKET_RECYCLE(p) do { \ PACKET_RELEASE_REFS((p)); \ PACKET_REINIT((p)); \ } while (0) /** * \brief Cleanup a packet so that we can free it. No memset needed.. */ #define PACKET_DESTRUCTOR(p) do { \ if ((p)->pktvar != NULL) { \ PktVarFree((p)->pktvar); \ } \ PACKET_FREE_EXTDATA((p)); \ SCMutexDestroy(&(p)->tunnel_mutex); \ AppLayerDecoderEventsFreeEvents(&(p)->app_layer_events); \ PACKET_PROFILING_RESET((p)); \ } while (0) /* macro's for setting the action * handle the case of a root packet * for tunnels */ #define PACKET_SET_ACTION(p, a) do { \ ((p)->root ? \ ((p)->root->action = a) : \ ((p)->action = a)); \ } while (0) #define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT) #define PACKET_ACCEPT(p) PACKET_SET_ACTION(p, ACTION_ACCEPT) #define PACKET_DROP(p) PACKET_SET_ACTION(p, ACTION_DROP) #define PACKET_REJECT(p) PACKET_SET_ACTION(p, (ACTION_REJECT|ACTION_DROP)) #define PACKET_REJECT_DST(p) PACKET_SET_ACTION(p, (ACTION_REJECT_DST|ACTION_DROP)) #define PACKET_REJECT_BOTH(p) PACKET_SET_ACTION(p, (ACTION_REJECT_BOTH|ACTION_DROP)) #define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS) #define PACKET_TEST_ACTION(p, a) \ ((p)->root ? \ ((p)->root->action & a) : \ ((p)->action & a)) #define PACKET_UPDATE_ACTION(p, a) do { \ ((p)->root ? \ ((p)->root->action |= a) : \ ((p)->action |= a)); \ } while (0) #define TUNNEL_INCR_PKT_RTV(p) do { \ SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \ SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ } while (0) #define TUNNEL_INCR_PKT_TPR(p) do { \ SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ ((p)->root ? (p)->root->tunnel_tpr_cnt++ : (p)->tunnel_tpr_cnt++); \ SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ } while (0) #define TUNNEL_DECR_PKT_TPR(p) do { \ SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ ((p)->root ? (p)->root->tunnel_tpr_cnt-- : (p)->tunnel_tpr_cnt--); \ SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \ } while (0) #define TUNNEL_DECR_PKT_TPR_NOLOCK(p) do { \ ((p)->root ? (p)->root->tunnel_tpr_cnt-- : (p)->tunnel_tpr_cnt--); \ } while (0) #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt) #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt) #define IS_TUNNEL_PKT(p) (((p)->flags & PKT_TUNNEL)) #define SET_TUNNEL_PKT(p) ((p)->flags |= PKT_TUNNEL) #define UNSET_TUNNEL_PKT(p) ((p)->flags &= ~PKT_TUNNEL) #define IS_TUNNEL_ROOT_PKT(p) (IS_TUNNEL_PKT(p) && (p)->root == NULL) #define IS_TUNNEL_PKT_VERDICTED(p) (((p)->flags & PKT_TUNNEL_VERDICTED)) #define SET_TUNNEL_PKT_VERDICTED(p) ((p)->flags |= PKT_TUNNEL_VERDICTED) enum DecodeTunnelProto { DECODE_TUNNEL_ETHERNET, DECODE_TUNNEL_ERSPAN, DECODE_TUNNEL_VLAN, DECODE_TUNNEL_IPV4, DECODE_TUNNEL_IPV6, DECODE_TUNNEL_PPP, }; Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint16_t len, enum DecodeTunnelProto proto, PacketQueue *pq); Packet *PacketDefragPktSetup(Packet *parent, uint8_t *pkt, uint16_t len, uint8_t proto); void PacketDefragPktSetupParent(Packet *parent); void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *); Packet *PacketGetFromQueueOrAlloc(void); Packet *PacketGetFromAlloc(void); void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p); void PacketFree(Packet *p); void PacketFreeOrRelease(Packet *p); int PacketCallocExtPkt(Packet *p, int datalen); int PacketCopyData(Packet *p, uint8_t *pktdata, int pktlen); int PacketSetData(Packet *p, uint8_t *pktdata, int pktlen); int PacketCopyDataOffset(Packet *p, int offset, uint8_t *data, int datalen); const char *PktSrcToString(enum PktSrcEnum pkt_src); void PacketBypassCallback(Packet *p); DecodeThreadVars *DecodeThreadVarsAlloc(ThreadVars *); void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *); void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p); /* decoder functions */ int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeTunnel(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *, enum DecodeTunnelProto) __attribute__ ((warn_unused_result)); int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *); void AddressDebugPrint(Address *); #ifdef AFLFUZZ_DECODER typedef int (*DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq); int DecoderParseDataFromFile(char *filename, DecoderFunc Decoder); int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder); #endif /** \brief Set the No payload inspection Flag for the packet. * * \param p Packet to set the flag in */ #define DecodeSetNoPayloadInspectionFlag(p) do { \ (p)->flags |= PKT_NOPAYLOAD_INSPECTION; \ } while (0) #define DecodeUnsetNoPayloadInspectionFlag(p) do { \ (p)->flags &= ~PKT_NOPAYLOAD_INSPECTION; \ } while (0) /** \brief Set the No packet inspection Flag for the packet. * * \param p Packet to set the flag in */ #define DecodeSetNoPacketInspectionFlag(p) do { \ (p)->flags |= PKT_NOPACKET_INSPECTION; \ } while (0) #define DecodeUnsetNoPacketInspectionFlag(p) do { \ (p)->flags &= ~PKT_NOPACKET_INSPECTION; \ } while (0) #define ENGINE_SET_EVENT(p, e) do { \ SCLogDebug("p %p event %d", (p), e); \ if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \ (p)->events.events[(p)->events.cnt] = e; \ (p)->events.cnt++; \ } \ } while(0) #define ENGINE_SET_INVALID_EVENT(p, e) do { \ p->flags |= PKT_IS_INVALID; \ ENGINE_SET_EVENT(p, e); \ } while(0) #define ENGINE_ISSET_EVENT(p, e) ({ \ int r = 0; \ uint8_t u; \ for (u = 0; u < (p)->events.cnt; u++) { \ if ((p)->events.events[u] == (e)) { \ r = 1; \ break; \ } \ } \ r; \ }) #ifndef IPPROTO_IPIP #define IPPROTO_IPIP 4 #endif /* older libcs don't contain a def for IPPROTO_DCCP * inside of * if it isn't defined let's define it here. */ #ifndef IPPROTO_DCCP #define IPPROTO_DCCP 33 #endif /* older libcs don't contain a def for IPPROTO_SCTP * inside of * if it isn't defined let's define it here. */ #ifndef IPPROTO_SCTP #define IPPROTO_SCTP 132 #endif #ifndef IPPROTO_MH #define IPPROTO_MH 135 #endif /* Host Identity Protocol (rfc 5201) */ #ifndef IPPROTO_HIP #define IPPROTO_HIP 139 #endif #ifndef IPPROTO_SHIM6 #define IPPROTO_SHIM6 140 #endif /* pcap provides this, but we don't want to depend on libpcap */ #ifndef DLT_EN10MB #define DLT_EN10MB 1 #endif /* taken from pcap's bpf.h */ #ifndef DLT_RAW #ifdef __OpenBSD__ #define DLT_RAW 14 /* raw IP */ #else #define DLT_RAW 12 /* raw IP */ #endif #endif #ifndef DLT_NULL #define DLT_NULL 0 #endif /** libpcap shows us the way to linktype codes * \todo we need more & maybe put them in a separate file? */ #define LINKTYPE_NULL DLT_NULL #define LINKTYPE_ETHERNET DLT_EN10MB #define LINKTYPE_LINUX_SLL 113 #define LINKTYPE_PPP 9 #define LINKTYPE_RAW DLT_RAW #define PPP_OVER_GRE 11 #define VLAN_OVER_GRE 13 /*Packet Flags*/ #define PKT_NOPACKET_INSPECTION (1) /**< Flag to indicate that packet header or contents should not be inspected*/ #define PKT_NOPAYLOAD_INSPECTION (1<<2) /**< Flag to indicate that packet contents should not be inspected*/ #define PKT_ALLOC (1<<3) /**< Packet was alloc'd this run, needs to be freed */ #define PKT_HAS_TAG (1<<4) /**< Packet has matched a tag */ #define PKT_STREAM_ADD (1<<5) /**< Packet payload was added to reassembled stream */ #define PKT_STREAM_EST (1<<6) /**< Packet is part of establised stream */ #define PKT_STREAM_EOF (1<<7) /**< Stream is in eof state */ #define PKT_HAS_FLOW (1<<8) #define PKT_PSEUDO_STREAM_END (1<<9) /**< Pseudo packet to end the stream */ #define PKT_STREAM_MODIFIED (1<<10) /**< Packet is modified by the stream engine, we need to recalc the csum and reinject/replace */ #define PKT_MARK_MODIFIED (1<<11) /**< Packet mark is modified */ #define PKT_STREAM_NOPCAPLOG (1<<12) /**< Exclude packet from pcap logging as it's part of a stream that has reassembly depth reached. */ #define PKT_TUNNEL (1<<13) #define PKT_TUNNEL_VERDICTED (1<<14) #define PKT_IGNORE_CHECKSUM (1<<15) /**< Packet checksum is not computed (TX packet for example) */ #define PKT_ZERO_COPY (1<<16) /**< Packet comes from zero copy (ext_pkt must not be freed) */ #define PKT_HOST_SRC_LOOKED_UP (1<<17) #define PKT_HOST_DST_LOOKED_UP (1<<18) #define PKT_IS_FRAGMENT (1<<19) /**< Packet is a fragment */ #define PKT_IS_INVALID (1<<20) #define PKT_PROFILE (1<<21) /** indication by decoder that it feels the packet should be handled by * flow engine: Packet::flow_hash will be set */ #define PKT_WANTS_FLOW (1<<22) /** protocol detection done */ #define PKT_PROTO_DETECT_TS_DONE (1<<23) #define PKT_PROTO_DETECT_TC_DONE (1<<24) #define PKT_REBUILT_FRAGMENT (1<<25) /**< Packet is rebuilt from * fragments. */ /** \brief return 1 if the packet is a pseudo packet */ #define PKT_IS_PSEUDOPKT(p) ((p)->flags & PKT_PSEUDO_STREAM_END) #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val) #endif /* __DECODE_H__ */ suricata-3.2.1/src/util-rohash.h0000644000000000000000000000264413051004444013417 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_ROHASH_H__ #define __UTIL_ROHASH_H__ #include "queue.h" typedef struct ROHashTable_ { uint8_t locked; uint8_t hash_bits; uint16_t item_size; uint32_t items; void *data; TAILQ_HEAD(, ROHashTableItem_) head; } ROHashTable; /* init time */ ROHashTable *ROHashInit(uint8_t hash_bits, uint16_t item_size); int ROHashInitFinalize(ROHashTable *table); void ROHashFree(ROHashTable *table); int ROHashInitQueueValue(ROHashTable *table, void *value, uint16_t size); uint32_t ROHashMemorySize(ROHashTable *table); /* run time */ void *ROHashLookup(ROHashTable *table, void *data, uint16_t size); #endif /* __UTIL_ROHASH_H__ */ suricata-3.2.1/src/util-pidfile.c0000644000000000000000000000720213051004444013535 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * \author Victor Julien * * Utility code for dealing with a pidfile. * Adaptation of Steve Grubbs patch to our coding guidelines * (thanks for the patch Steve ;) */ #include "suricata-common.h" #include "util-pidfile.h" /** * \brief Write a pid file (used at the startup) * This commonly needed by the init scripts * * \param pointer to the name of the pid file to write (optarg) * * \retval 0 if succes * \retval -1 on failure */ int SCPidfileCreate(const char *pidfile) { SCEnter(); int pidfd = 0; char val[16]; size_t len = snprintf(val, sizeof(val), "%"PRIuMAX"\n", (uintmax_t)getpid()); if (len <= 0) { SCLogError(SC_ERR_PIDFILE_SNPRINTF, "Pid error (%s)", strerror(errno)); SCReturnInt(-1); } pidfd = open(pidfile, O_CREAT | O_TRUNC | O_NOFOLLOW | O_WRONLY, 0644); if (pidfd < 0) { SCLogError(SC_ERR_PIDFILE_OPEN, "unable to set pidfile '%s': %s", pidfile, strerror(errno)); SCReturnInt(-1); } ssize_t r = write(pidfd, val, (unsigned int)len); if (r == -1) { SCLogError(SC_ERR_PIDFILE_WRITE, "unable to write pidfile: %s", strerror(errno)); close(pidfd); SCReturnInt(-1); } else if ((size_t)r != len) { SCLogError(SC_ERR_PIDFILE_WRITE, "unable to write pidfile: wrote" " %"PRIdMAX" of %"PRIuMAX" bytes.", (intmax_t)r, (uintmax_t)len); close(pidfd); SCReturnInt(-1); } close(pidfd); SCReturnInt(0); } /** * \brief Remove the pid file (used at the startup) * * \param pointer to the name of the pid file to write (optarg) */ void SCPidfileRemove(const char *pid_filename) { if (pid_filename != NULL) { /* we ignore the result, the user may have removed the file already. */ (void)unlink(pid_filename); } } /** * \brief Check a pid file (used at the startup) * This commonly needed by the init scripts * * \param pointer to the name of the pid file to write (optarg) * * \retval 0 if succes * \retval -1 on failure */ int SCPidfileTestRunning(const char *pid_filename) { if (access(pid_filename, F_OK) == 0) { /* Check if the existing process is still alive. */ pid_t pidv; FILE *pf; pf = fopen(pid_filename, "r"); if (pf == NULL) { SCLogError(SC_ERR_INITIALIZATION, "pid file '%s' exists and can not be read. Aborting!", pid_filename); return -1; } if (fscanf(pf, "%d", &pidv) == 1 && kill(pidv, 0) == 0) { fclose(pf); SCLogError(SC_ERR_INITIALIZATION, "pid file '%s' exists. Is Suricata already running? Aborting!", pid_filename); return -1; } if (pf != NULL) fclose(pf); } return 0; } suricata-3.2.1/src/runmodes.h0000644000000000000000000000617613051004444013020 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODES_H__ #define __RUNMODES_H__ /* Run mode */ enum RunModes { RUNMODE_UNKNOWN = 0, RUNMODE_PCAP_DEV, RUNMODE_PCAP_FILE, RUNMODE_PFRING, RUNMODE_NFQ, RUNMODE_NFLOG, RUNMODE_IPFW, RUNMODE_ERF_FILE, RUNMODE_DAG, RUNMODE_AFP_DEV, RUNMODE_NETMAP, RUNMODE_TILERA_MPIPE, RUNMODE_UNITTEST, RUNMODE_NAPATECH, RUNMODE_UNIX_SOCKET, RUNMODE_USER_MAX, /* Last standard running mode */ RUNMODE_LIST_KEYWORDS, RUNMODE_LIST_APP_LAYERS, RUNMODE_LIST_CUDA_CARDS, RUNMODE_LIST_RUNMODES, RUNMODE_PRINT_VERSION, RUNMODE_PRINT_BUILDINFO, RUNMODE_PRINT_USAGE, RUNMODE_DUMP_CONFIG, RUNMODE_CONF_TEST, RUNMODE_LIST_UNITTEST, RUNMODE_ENGINE_ANALYSIS, #ifdef OS_WIN32 RUNMODE_INSTALL_SERVICE, RUNMODE_REMOVE_SERVICE, RUNMODE_CHANGE_SERVICE_PARAMS, #endif RUNMODE_MAX, }; /* Run Mode Global Thread Names */ extern const char *thread_name_autofp; extern const char *thread_name_single; extern const char *thread_name_workers; extern const char *thread_name_verdict; extern const char *thread_name_flow_mgr; extern const char *thread_name_flow_rec; extern const char *thread_name_unix_socket; extern const char *thread_name_detect_loader; extern const char *thread_name_counter_stats; extern const char *thread_name_counter_wakeup; char *RunmodeGetActive(void); const char *RunModeGetMainMode(void); void RunModeListRunmodes(void); void RunModeDispatch(int, const char *); void RunModeRegisterRunModes(void); void RunModeRegisterNewRunMode(int, const char *, const char *, int (*RunModeFunc)(void)); void RunModeInitialize(void); void RunModeInitializeOutputs(void); void RunModeShutDown(void); /* bool indicating if file logger is enabled */ int RunModeOutputFileEnabled(void); /* bool indicating if filedata logger is enabled */ int RunModeOutputFiledataEnabled(void); #include "runmode-pcap.h" #include "runmode-pcap-file.h" #include "runmode-pfring.h" #include "runmode-tile.h" #include "runmode-nfq.h" #include "runmode-ipfw.h" #include "runmode-erf-file.h" #include "runmode-erf-dag.h" #include "runmode-napatech.h" #include "runmode-af-packet.h" #include "runmode-nflog.h" #include "runmode-unix-socket.h" #include "runmode-netmap.h" int threading_set_cpu_affinity; extern float threading_detect_ratio; extern int debuglog_enabled; #endif /* __RUNMODES_H__ */ suricata-3.2.1/src/util-cpu.c0000644000000000000000000001561513051004444012717 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Retrieve CPU information (configured CPUs, online CPUs) */ #include "suricata-common.h" #include "util-error.h" #include "util-debug.h" /** * Ok, if they should use sysconf, check that they have the macro's * (syscalls) defined; * * Note: For windows it's different; Check the following: * SYSTEM_INFO info; * GetSystemInfo(&info); * -> info.dwNumberOfProcessors; */ #ifdef _SC_NPROCESSORS_CONF #define SYSCONF_NPROCESSORS_CONF_COMPAT #endif #ifdef _SC_NPROCESSORS_ONLN #define SYSCONF_NPROCESSORS_ONLN_COMPAT #endif /* This one is available on Solaris 10 */ #ifdef _SC_NPROCESSORS_MAX #define SYSCONF_NPROCESSORS_MAX_COMPAT #endif /** * \brief Get the number of cpus configured in the system * \retval 0 if the syscall is not available or we have an error; * otherwise it will return the number of cpus configured */ uint16_t UtilCpuGetNumProcessorsConfigured() { #ifdef SYSCONF_NPROCESSORS_CONF_COMPAT long nprocs = -1; nprocs = sysconf(_SC_NPROCESSORS_CONF); if (nprocs < 1) { SCLogError(SC_ERR_SYSCALL, "Couldn't retrieve the number of cpus " "configured (%s)", strerror(errno)); return 0; } if (nprocs > UINT16_MAX) { SCLogDebug("It seems that there are more than %"PRIu16" CPUs " "configured on this system. You can modify util-cpu.{c,h} " "to use uint32_t to support it", UINT16_MAX); return UINT16_MAX; } return (uint16_t)nprocs; #elif OS_WIN32 long nprocs = -1; const char* envvar = getenv("NUMBER_OF_PROCESSORS"); nprocs = (NULL != envvar) ? atoi(envvar) : 0; if (nprocs < 1) { SCLogError(SC_ERR_SYSCALL, "Couldn't retrieve the number of cpus " "configured from the NUMBER_OF_PROCESSORS environment variable"); return 0; } return (uint16_t)nprocs; #else SCLogError(SC_ERR_SYSCONF, "Couldn't retrieve the number of cpus " "configured, sysconf macro unavailable"); return 0; #endif } /** * \brief Get the number of cpus online in the system * \retval 0 if the syscall is not available or we have an error; * otherwise it will return the number of cpus online */ uint16_t UtilCpuGetNumProcessorsOnline() { #ifdef SYSCONF_NPROCESSORS_ONLN_COMPAT long nprocs = -1; nprocs = sysconf(_SC_NPROCESSORS_ONLN); if (nprocs < 1) { SCLogError(SC_ERR_SYSCALL, "Couldn't retrieve the number of cpus " "online (%s)", strerror(errno)); return 0; } if (nprocs > UINT16_MAX) { SCLogDebug("It seems that there are more than %"PRIu16" CPUs online. " "You can modify util-cpu.{c,h} to use uint32_t to " "support it", UINT16_MAX); return UINT16_MAX; } return nprocs; #elif OS_WIN32 return UtilCpuGetNumProcessorsConfigured(); #else SCLogError(SC_ERR_SYSCONF, "Couldn't retrieve the number of cpus online, " "synconf macro unavailable"); return 0; #endif } /** * \brief Get the maximum number of cpus allowed in the system * This syscall is present on Solaris, but it's not on linux * or macosx. Maybe you should look at UtilCpuGetNumProcessorsConfigured() * \retval 0 if the syscall is not available or we have an error; * otherwise it will return the number of cpus allowed */ uint16_t UtilCpuGetNumProcessorsMax() { #ifdef SYSCONF_NPROCESSORS_MAX_COMPAT long nprocs = -1; nprocs = sysconf(_SC_NPROCESSORS_MAX); if (nprocs < 1) { SCLogError(SC_ERR_SYSCALL, "Couldn't retrieve the maximum number of cpus " "allowed by the system (%s)", strerror(errno)); return 0; } if (nprocs > UINT16_MAX) { SCLogDebug("It seems that the system support more that %"PRIu16" CPUs. You " "can modify util-cpu.{c,h} to use uint32_t to support it", UINT16_MAX); return UINT16_MAX; } return (uint16_t)nprocs; #else SCLogError(SC_ERR_SYSCONF, "Couldn't retrieve the maximum number of cpus allowed by " "the system, synconf macro unavailable"); return 0; #endif } /** * \brief Print a summary of CPUs detected (configured and online) */ void UtilCpuPrintSummary() { uint16_t cpus_conf = UtilCpuGetNumProcessorsConfigured(); uint16_t cpus_online = UtilCpuGetNumProcessorsOnline(); SCLogDebug("CPUs Summary: "); if (cpus_conf > 0) SCLogDebug("CPUs configured: %"PRIu16, cpus_conf); if (cpus_online > 0) SCLogInfo("CPUs/cores online: %"PRIu16, cpus_online); if (cpus_online == 0 && cpus_conf == 0) SCLogInfo("Couldn't retireve any information of CPU's, please, send your operating " "system info and check util-cpu.{c,h}"); } /** * Get the current number of ticks from the CPU. * * \todo We'll have to deal with removig ticks from the extra cpuids inbetween * 2 calls. */ #if defined(__tile__) #include uint64_t UtilCpuGetTicks(void) { return get_cycle_count(); } #else uint64_t UtilCpuGetTicks(void) { uint64_t val; #if defined(__GNUC__) && (defined(__x86_64) || defined(_X86_64_) || defined(ia_64) || defined(__i386__)) #if defined(__x86_64) || defined(_X86_64_) || defined(ia_64) __asm__ __volatile__ ( "xorl %%eax,%%eax\n\t" "cpuid\n\t" ::: "%rax", "%rbx", "%rcx", "%rdx"); #else __asm__ __volatile__ ( "xorl %%eax,%%eax\n\t" "pushl %%ebx\n\t" "cpuid\n\t" "popl %%ebx\n\t" ::: "%eax", "%ecx", "%edx"); #endif uint32_t a, d; __asm__ __volatile__ ("rdtsc" : "=a" (a), "=d" (d)); val = ((uint64_t)a) | (((uint64_t)d) << 32); #if defined(__x86_64) || defined(_X86_64_) || defined(ia_64) __asm__ __volatile__ ( "xorl %%eax,%%eax\n\t" "cpuid\n\t" ::: "%rax", "%rbx", "%rcx", "%rdx"); #else __asm__ __volatile__ ( "xorl %%eax,%%eax\n\t" "pushl %%ebx\n\t" "cpuid\n\t" "popl %%ebx\n\t" ::: "%eax", "%ecx", "%edx"); #endif #else /* #if defined(__GNU__) */ //#warning Using inferior version of UtilCpuGetTicks struct timeval now; gettimeofday(&now, NULL); val = (now.tv_sec * 1000000) + now.tv_usec; #endif return val; } #endif /* __tile__ */ suricata-3.2.1/src/pkt-var.h0000644000000000000000000000177113051004444012544 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __PKT_VAR_H__ #define __PKT_VAR_H__ void PktVarAdd(Packet *, const char *, uint8_t *, uint16_t); PktVar *PktVarGet(Packet *, const char *); void PktVarFree(PktVar *); void PktVarPrint(PktVar *); #endif /* __PKT_VAR_H__ */ suricata-3.2.1/src/detect-tls.h0000644000000000000000000000400113051004444013215 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier */ #ifndef __DETECT_TLS_H__ #define __DETECT_TLS_H__ typedef struct DetectTlsData_ { uint16_t ver; /** tls version to match */ uint32_t flags; /** flags containing match variant (Negation for example) */ char * subject; /** tls certificate subject substring to match */ char * issuerdn; /** tls certificate issuerDN substring to match */ char * fingerprint; /** tls fingerprint substring to match */ } DetectTlsData; /* prototypes */ void DetectTlsRegister (void); #endif /* __DETECT_TLS_H__ */ suricata-3.2.1/src/detect-sameip.h0000644000000000000000000000163513051004444013703 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __DETECT_SAMEIP_H__ #define __DETECT_SAMEIP_H__ /* prototypes */ void DetectSameipRegister(void); #endif /* __DETECT_SAMEIP_H__ */ suricata-3.2.1/src/detect-engine-event.c0000644000000000000000000002473313051004444015010 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the decode-event keyword */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "flow-var.h" #include "decode-events.h" #include "util-debug.h" #include "stream-tcp.h" /* Need to get the DEvents[] array */ #include "detect-engine-event.h" #include "util-unittest.h" #define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z0-9_+.]+$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectEngineEventMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectEngineEventSetup (DetectEngineCtx *, Signature *, char *); static int DetectDecodeEventSetup (DetectEngineCtx *, Signature *, char *); static int DetectStreamEventSetup (DetectEngineCtx *, Signature *, char *); static void DetectEngineEventFree (void *); void EngineEventRegisterTests(void); /** * \brief Registration function for decode-event: keyword */ void DetectEngineEventRegister (void) { sigmatch_table[DETECT_ENGINE_EVENT].name = "engine-event"; sigmatch_table[DETECT_ENGINE_EVENT].Match = DetectEngineEventMatch; sigmatch_table[DETECT_ENGINE_EVENT].Setup = DetectEngineEventSetup; sigmatch_table[DETECT_ENGINE_EVENT].Free = DetectEngineEventFree; sigmatch_table[DETECT_ENGINE_EVENT].RegisterTests = EngineEventRegisterTests; sigmatch_table[DETECT_DECODE_EVENT].name = "decode-event"; sigmatch_table[DETECT_DECODE_EVENT].Match = DetectEngineEventMatch; sigmatch_table[DETECT_DECODE_EVENT].Setup = DetectDecodeEventSetup; sigmatch_table[DETECT_DECODE_EVENT].Free = DetectEngineEventFree; sigmatch_table[DETECT_DECODE_EVENT].flags |= SIGMATCH_DEONLY_COMPAT; sigmatch_table[DETECT_STREAM_EVENT].name = "stream-event"; sigmatch_table[DETECT_STREAM_EVENT].Match = DetectEngineEventMatch; sigmatch_table[DETECT_STREAM_EVENT].Setup = DetectStreamEventSetup; sigmatch_table[DETECT_STREAM_EVENT].Free = DetectEngineEventFree; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to match decoder event flags set on a packet with those passed via decode-event: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the Signature * \param m pointer to the sigmatch * * \retval 0 no match * \retval 1 match */ int DetectEngineEventMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); const DetectEngineEventData *de = (const DetectEngineEventData *)ctx; if (ENGINE_ISSET_EVENT(p, de->event)) { SCLogDebug("de->event matched %u", de->event); SCReturnInt(1); } SCReturnInt(0); } /** * \brief This function is used to parse decoder events options passed via decode-event: keyword * * \param rawstr Pointer to the user provided decode-event options * * \retval de pointer to DetectFlowData on success * \retval NULL on failure */ DetectEngineEventData *DetectEngineEventParse (char *rawstr) { int i; DetectEngineEventData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0, found = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } char copy_str[128] = ""; res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, copy_str, sizeof(copy_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } for (i = 0; DEvents[i].event_name != NULL; i++) { if (strcasecmp(DEvents[i].event_name,copy_str) == 0) { found = 1; break; } } if (found == 0) { SCLogError(SC_ERR_UNKNOWN_DECODE_EVENT, "unknown decode event \"%s\"", copy_str); goto error; } de = SCMalloc(sizeof(DetectEngineEventData)); if (unlikely(de == NULL)) goto error; de->event = DEvents[i].code; if (de->event == STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA) { StreamTcpReassembleConfigEnableOverlapCheck(); } return de; error: if (de) SCFree(de); return NULL; } /** * \brief this function is used to add the parsed decode-event into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided decode-event options * * \retval 0 on Success * \retval -1 on Failure */ static int _DetectEngineEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr, int smtype) { DetectEngineEventData *de = NULL; SigMatch *sm = NULL; de = DetectEngineEventParse(rawstr); if (de == NULL) goto error; SCLogDebug("rawstr %s %u", rawstr, de->event); sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = smtype; sm->ctx = (SigMatchCtx *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (de) SCFree(de); if (sm) SCFree(sm); return -1; } static int DetectEngineEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { return _DetectEngineEventSetup (de_ctx, s, rawstr, DETECT_ENGINE_EVENT); } /** * \brief this function will free memory associated with DetectEngineEventData * * \param de pointer to DetectEngineEventData */ static void DetectEngineEventFree(void *ptr) { DetectEngineEventData *de = (DetectEngineEventData *)ptr; if (de) SCFree(de); } /** * \brief this function Setup the 'decode-event' keyword by setting the correct * signature type */ static int DetectDecodeEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char drawstr[MAX_SUBSTRINGS * 2] = "decoder."; /* decoder:$EVENT alias command develop as decode-event:decoder.$EVENT */ strlcat(drawstr, rawstr, 2 * MAX_SUBSTRINGS - strlen("decoder.") - 1); return _DetectEngineEventSetup(de_ctx, s, drawstr, DETECT_DECODE_EVENT); } /** * \brief this function Setup the 'stream-event' keyword by resolving the alias */ static int DetectStreamEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char srawstr[MAX_SUBSTRINGS * 2] = "stream."; /* stream:$EVENT alias command develop as decode-event:stream.$EVENT */ strlcat(srawstr, rawstr, 2 * MAX_SUBSTRINGS - strlen("stream.") - 1); return DetectEngineEventSetup(de_ctx, s, srawstr); } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS /** * \test EngineEventTestParse01 is a test for a valid decode-event value */ int EngineEventTestParse01 (void) { DetectEngineEventData *de = NULL; de = DetectEngineEventParse("decoder.ipv4.pkt_too_small"); if (de) { DetectEngineEventFree(de); return 1; } return 0; } /** * \test EngineEventTestParse02 is a test for a valid upper + lower case decode-event value */ int EngineEventTestParse02 (void) { DetectEngineEventData *de = NULL; de = DetectEngineEventParse("decoder.PPP.pkt_too_small"); if (de) { DetectEngineEventFree(de); return 1; } return 0; } /** * \test EngineEventTestParse03 is a test for a valid upper case decode-event value */ int EngineEventTestParse03 (void) { DetectEngineEventData *de = NULL; de = DetectEngineEventParse("decoder.IPV6.PKT_TOO_SMALL"); if (de) { DetectEngineEventFree(de); return 1; } return 0; } /** * \test EngineEventTestParse04 is a test for an invalid upper case decode-event value */ int EngineEventTestParse04 (void) { DetectEngineEventData *de = NULL; de = DetectEngineEventParse("decoder.IPV6.INVALID_EVENT"); if (de) { DetectEngineEventFree(de); return 0; } return 1; } /** * \test EngineEventTestParse05 is a test for an invalid char into the decode-event value */ int EngineEventTestParse05 (void) { DetectEngineEventData *de = NULL; de = DetectEngineEventParse("decoder.IPV-6,INVALID_CHAR"); if (de) { DetectEngineEventFree(de); return 0; } return 1; } /** * \test EngineEventTestParse06 is a test for match function with valid decode-event value */ int EngineEventTestParse06 (void) { Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; int ret = 0; DetectEngineEventData *de = NULL; SigMatch *sm = NULL; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); ENGINE_SET_EVENT(p,PPP_PKT_TOO_SMALL); de = DetectEngineEventParse("decoder.ppp.pkt_too_small"); if (de == NULL) goto error; de->event = PPP_PKT_TOO_SMALL; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_DECODE_EVENT; sm->ctx = (SigMatchCtx *)de; ret = DetectEngineEventMatch(&tv,NULL,p,NULL,sm->ctx); if(ret) { SCFree(p); return 1; } error: if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for EngineEvent */ void EngineEventRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("EngineEventTestParse01", EngineEventTestParse01); UtRegisterTest("EngineEventTestParse02", EngineEventTestParse02); UtRegisterTest("EngineEventTestParse03", EngineEventTestParse03); UtRegisterTest("EngineEventTestParse04", EngineEventTestParse04); UtRegisterTest("EngineEventTestParse05", EngineEventTestParse05); UtRegisterTest("EngineEventTestParse06", EngineEventTestParse06); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-streaming-buffer.h0000644000000000000000000001255013051004444015370 00000000000000/* Copyright (C) 2015-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* * This API is meant to be used with streaming data. A single memory * block is used to store the data. StreamingBufferSegment points to * chunk of data in the single StreamingBuffer. It points by offset * and length, so no pointers. The buffer is resized on demand and * slides forward, either automatically or manually. * * When a segment needs it's data it uses StreamingBufferSegmentGetData * which takes care of checking if the segment still has a valid offset * and length. * * The StreamingBuffer::stream_offset is an absolute offset since the * start of the data streaming. * * Similarly, StreamingBufferSegment::stream_offset is also an absolute * offset. * * Using the segments is optional. * * * stream_offset buf_offset stream_offset + buf_size * ^ ^ ^ * | | | * | | | * +--------------------------------------------+ * | data | empty | * | xxxxxxxxxx | | * +------^--------^--------+-------------------+ * | | * | | * | | * | | * | | * +------+--------+-------+ * | StreamingBufferSegment| * +-----------+-----------+ * | offset | len | * +-----------+-----------+ */ #ifndef __UTIL_STREAMING_BUFFER_H__ #define __UTIL_STREAMING_BUFFER_H__ #define STREAMING_BUFFER_NOFLAGS 0 #define STREAMING_BUFFER_AUTOSLIDE (1<<0) typedef struct StreamingBufferConfig_ { uint32_t flags; uint32_t buf_slide; uint32_t buf_size; void *(*Malloc)(size_t size); void *(*Calloc)(size_t n, size_t size); void *(*Realloc)(void *ptr, size_t orig_size, size_t size); void (*Free)(void *ptr, size_t size); } StreamingBufferConfig; #define STREAMING_BUFFER_CONFIG_INITIALIZER { 0, 0, 0, NULL, NULL, NULL, NULL, } typedef struct StreamingBuffer_ { const StreamingBufferConfig *cfg; uint64_t stream_offset; /**< offset of the start of the memory block */ uint8_t *buf; /**< memory block for reassembly */ uint32_t buf_size; /**< size of memory block */ uint32_t buf_offset; /**< how far we are in buf_size */ #ifdef DEBUG uint32_t buf_size_max; #endif } StreamingBuffer; #ifndef DEBUG #define STREAMING_BUFFER_INITIALIZER(cfg) { (cfg), 0, NULL, 0, 0, }; #else #define STREAMING_BUFFER_INITIALIZER(cfg) { (cfg), 0, NULL, 0, 0, 0 }; #endif typedef struct StreamingBufferSegment_ { uint64_t stream_offset; uint32_t segment_len; } __attribute__((__packed__)) StreamingBufferSegment; StreamingBuffer *StreamingBufferInit(const StreamingBufferConfig *cfg); void StreamingBufferClear(StreamingBuffer *sb); void StreamingBufferFree(StreamingBuffer *sb); void StreamingBufferSlide(StreamingBuffer *sb, uint32_t slide); void StreamingBufferSlideToOffset(StreamingBuffer *sb, uint64_t offset); StreamingBufferSegment *StreamingBufferAppendRaw(StreamingBuffer *sb, const uint8_t *data, uint32_t data_len) __attribute__((warn_unused_result)); int StreamingBufferAppend(StreamingBuffer *sb, StreamingBufferSegment *seg, const uint8_t *data, uint32_t data_len) __attribute__((warn_unused_result)); int StreamingBufferAppendNoTrack(StreamingBuffer *sb, const uint8_t *data, uint32_t data_len) __attribute__((warn_unused_result)); int StreamingBufferInsertAt(StreamingBuffer *sb, StreamingBufferSegment *seg, const uint8_t *data, uint32_t data_len, uint64_t offset) __attribute__((warn_unused_result)); void StreamingBufferSegmentGetData(const StreamingBuffer *sb, const StreamingBufferSegment *seg, const uint8_t **data, uint32_t *data_len); int StreamingBufferSegmentCompareRawData(const StreamingBuffer *sb, const StreamingBufferSegment *seg, const uint8_t *rawdata, uint32_t rawdata_len); int StreamingBufferCompareRawData(const StreamingBuffer *sb, const uint8_t *rawdata, uint32_t rawdata_len); int StreamingBufferGetData(const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t *stream_offset); int StreamingBufferGetDataAtOffset (const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t offset); int StreamingBufferSegmentIsBeforeWindow(const StreamingBuffer *sb, const StreamingBufferSegment *seg); void StreamingBufferRegisterTests(void); #endif /* __UTIL_STREAMING_BUFFER_H__ */ suricata-3.2.1/src/runmode-pfring.c0000644000000000000000000004116313051004444014106 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-pfring.h" #include "source-pfring.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" #include "util-device.h" static const char *default_mode_autofp = NULL; #define PFRING_CONF_V1 1 #define PFRING_CONF_V2 2 const char *RunModeIdsPfringGetDefaultMode(void) { #ifdef HAVE_PFRING return default_mode_autofp; #else return NULL; #endif } void RunModeIdsPfringRegister(void) { default_mode_autofp = "autofp"; RunModeRegisterNewRunMode(RUNMODE_PFRING, "autofp", "Multi threaded pfring mode. Packets from " "each flow are assigned to a single detect " "thread, unlike \"pfring_auto\" where packets " "from the same flow can be processed by any " "detect thread", RunModeIdsPfringAutoFp); RunModeRegisterNewRunMode(RUNMODE_PFRING, "single", "Single threaded pfring mode", RunModeIdsPfringSingle); RunModeRegisterNewRunMode(RUNMODE_PFRING, "workers", "Workers pfring mode, each thread does all" " tasks from acquisition to logging", RunModeIdsPfringWorkers); return; } void PfringDerefConfig(void *conf) { PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf; if (SC_ATOMIC_SUB(pfp->ref, 1) == 0) { if (pfp->bpf_filter) { SCFree(pfp->bpf_filter); } SCFree(pfp); } } /** * \brief extract information from config file * * The returned structure will be freed by the thread init function. * This is thus necessary to or copy the structure before giving it * to thread or to reparse the file for each thread (and thus have * new structure. * * If old config system is used, then return the smae parameters * value for each interface. * * \return a PfringIfaceConfig corresponding to the interface name */ void *OldParsePfringConfig(const char *iface) { char *threadsstr = NULL; PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf)); char *tmpclusterid; #ifdef HAVE_PFRING char *tmpctype = NULL; cluster_type default_ctype = CLUSTER_ROUND_ROBIN; #endif if (unlikely(pfconf == NULL)) { return NULL; } if (iface == NULL) { SCFree(pfconf); return NULL; } strlcpy(pfconf->iface, iface, sizeof(pfconf->iface)); pfconf->flags = 0; pfconf->threads = 1; pfconf->cluster_id = 1; #ifdef HAVE_PFRING pfconf->ctype = default_ctype; #endif pfconf->DerefFunc = PfringDerefConfig; pfconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; SC_ATOMIC_INIT(pfconf->ref); (void) SC_ATOMIC_ADD(pfconf->ref, 1); /* Find initial node */ if (ConfGet("pfring.threads", &threadsstr) != 1) { pfconf->threads = 1; } else { if (threadsstr != NULL) { pfconf->threads = (uint8_t)atoi(threadsstr); } } if (pfconf->threads == 0) { pfconf->threads = 1; } SC_ATOMIC_RESET(pfconf->ref); (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads); if (strncmp(pfconf->iface, "zc", 2) == 0) { SCLogInfo("ZC interface detected, not setting cluster-id"); } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) { SCLogInfo("DNA interface detected, not setting cluster-id"); } else if (ConfGet("pfring.cluster-id", &tmpclusterid) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Could not get cluster-id from config"); } else { pfconf->cluster_id = (uint16_t)atoi(tmpclusterid); pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER; SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id); } #ifdef HAVE_PFRING if (strncmp(pfconf->iface, "zc", 2) == 0) { SCLogInfo("ZC interface detected, not setting cluster type for PF_RING (iface %s)", pfconf->iface); } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) { SCLogInfo("DNA interface detected, not setting cluster type for PF_RING (iface %s)", pfconf->iface); } else if (ConfGet("pfring.cluster-type", &tmpctype) != 1) { SCLogError(SC_ERR_GET_CLUSTER_TYPE_FAILED,"Could not get cluster-type from config"); } else if (strcmp(tmpctype, "cluster_round_robin") == 0) { SCLogInfo("Using round-robin cluster mode for PF_RING (iface %s)", pfconf->iface); pfconf->ctype = (cluster_type)tmpctype; } else if (strcmp(tmpctype, "cluster_flow") == 0) { SCLogInfo("Using flow cluster mode for PF_RING (iface %s)", pfconf->iface); pfconf->ctype = (cluster_type)tmpctype; } else { SCLogError(SC_ERR_INVALID_CLUSTER_TYPE,"invalid cluster-type %s",tmpctype); SCFree(pfconf); return NULL; } #endif /* HAVE_PFRING */ return pfconf; } /** * \brief extract information from config file * * The returned structure will be freed by the thread init function. * This is thus necessary to or copy the structure before giving it * to thread or to reparse the file for each thread (and thus have * new structure. * * If old config system is used, then return the smae parameters * value for each interface. * * \return a PfringIfaceConfig corresponding to the interface name */ void *ParsePfringConfig(const char *iface) { char *threadsstr = NULL; ConfNode *if_root; ConfNode *if_default = NULL; ConfNode *pf_ring_node; PfringIfaceConfig *pfconf = SCMalloc(sizeof(*pfconf)); char *tmpclusterid; char *tmpctype = NULL; #ifdef HAVE_PFRING cluster_type default_ctype = CLUSTER_ROUND_ROBIN; int getctype = 0; #endif char *bpf_filter = NULL; if (unlikely(pfconf == NULL)) { return NULL; } if (iface == NULL) { SCFree(pfconf); return NULL; } memset(pfconf, 0, sizeof(PfringIfaceConfig)); strlcpy(pfconf->iface, iface, sizeof(pfconf->iface)); pfconf->threads = 1; pfconf->cluster_id = 1; #ifdef HAVE_PFRING pfconf->ctype = (cluster_type)default_ctype; #endif pfconf->DerefFunc = PfringDerefConfig; SC_ATOMIC_INIT(pfconf->ref); (void) SC_ATOMIC_ADD(pfconf->ref, 1); /* Find initial node */ pf_ring_node = ConfGetNode("pfring"); if (pf_ring_node == NULL) { SCLogInfo("Unable to find pfring config using default value"); return pfconf; } if_root = ConfFindDeviceConfig(pf_ring_node, iface); if_default = ConfFindDeviceConfig(pf_ring_node, "default"); if (if_root == NULL && if_default == NULL) { SCLogInfo("Unable to find pfring config for " "interface %s, using default value or 1.0 " "configuration system. ", iface); return pfconf; } /* If there is no setting for current interface use default one as main iface */ if (if_root == NULL) { if_root = if_default; if_default = NULL; } if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) { pfconf->threads = 1; } else { if (threadsstr != NULL) { pfconf->threads = (uint8_t)atoi(threadsstr); } } if (pfconf->threads == 0) { pfconf->threads = 1; } SC_ATOMIC_RESET(pfconf->ref); (void) SC_ATOMIC_ADD(pfconf->ref, pfconf->threads); /* command line value has precedence */ if (ConfGet("pfring.cluster-id", &tmpclusterid) == 1) { pfconf->cluster_id = (uint16_t)atoi(tmpclusterid); pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER; SCLogDebug("Going to use command-line provided cluster-id %" PRId32, pfconf->cluster_id); } else { if (strncmp(pfconf->iface, "zc", 2) == 0) { SCLogInfo("ZC interface detected, not setting cluster-id for PF_RING (iface %s)", pfconf->iface); } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) { SCLogInfo("DNA interface detected, not setting cluster-id for PF_RING (iface %s)", pfconf->iface); } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-id", &tmpclusterid) != 1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Could not get cluster-id from config"); } else { pfconf->cluster_id = (uint16_t)atoi(tmpclusterid); pfconf->flags |= PFRING_CONF_FLAGS_CLUSTER; SCLogDebug("Going to use cluster-id %" PRId32, pfconf->cluster_id); } } /*load pfring bpf filter*/ /* command line value has precedence */ if (ConfGet("bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { pfconf->bpf_filter = SCStrdup(bpf_filter); if (unlikely(pfconf->bpf_filter == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate BPF filter string"); } else { SCLogDebug("Going to use command-line provided bpf filter %s", pfconf->bpf_filter); } } } else { if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { pfconf->bpf_filter = SCStrdup(bpf_filter); if (unlikely(pfconf->bpf_filter == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Can't allocate BPF filter string"); } else { SCLogDebug("Going to use bpf filter %s", pfconf->bpf_filter); } } } } #ifdef HAVE_PFRING if (ConfGet("pfring.cluster-type", &tmpctype) == 1) { SCLogDebug("Going to use command-line provided cluster-type"); getctype = 1; } else { if (strncmp(pfconf->iface, "zc", 2) == 0) { SCLogInfo("ZC interface detected, not setting cluster type for PF_RING (iface %s)", pfconf->iface); } else if ((pfconf->threads == 1) && (strncmp(pfconf->iface, "dna", 3) == 0)) { SCLogInfo("DNA interface detected, not setting cluster type for PF_RING (iface %s)", pfconf->iface); } else if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-type", &tmpctype) != 1) { SCLogError(SC_ERR_GET_CLUSTER_TYPE_FAILED, "Could not get cluster-type from config"); } else { getctype = 1; } } if (getctype) { if (strcmp(tmpctype, "cluster_round_robin") == 0) { SCLogInfo("Using round-robin cluster mode for PF_RING (iface %s)", pfconf->iface); pfconf->ctype = CLUSTER_ROUND_ROBIN; } else if (strcmp(tmpctype, "cluster_flow") == 0) { SCLogInfo("Using flow cluster mode for PF_RING (iface %s)", pfconf->iface); pfconf->ctype = CLUSTER_FLOW; } else { SCLogError(SC_ERR_INVALID_CLUSTER_TYPE, "invalid cluster-type %s", tmpctype); SCFree(pfconf); return NULL; } } #endif /* HAVE_PFRING */ if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) { if (strcmp(tmpctype, "auto") == 0) { pfconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (ConfValIsTrue(tmpctype)) { pfconf->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(tmpctype)) { pfconf->checksum_mode = CHECKSUM_VALIDATION_DISABLE; } else if (strcmp(tmpctype, "rx-only") == 0) { pfconf->checksum_mode = CHECKSUM_VALIDATION_RXONLY; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid value for checksum-checks for %s", pfconf->iface); } } return pfconf; } int PfringConfigGeThreadsCount(void *conf) { PfringIfaceConfig *pfp = (PfringIfaceConfig *)conf; return pfp->threads; } int PfringConfLevel() { char *def_dev; /* 1.0 config should return a string */ if (ConfGet("pfring.interface", &def_dev) != 1) { return PFRING_CONF_V2; } else { return PFRING_CONF_V1; } return PFRING_CONF_V2; } #ifdef HAVE_PFRING static int GetDevAndParser(char **live_dev, ConfigIfaceParserFunc *parser) { ConfGet("pfring.live-interface", live_dev); /* determine which config type we have */ if (PfringConfLevel() > PFRING_CONF_V1) { *parser = ParsePfringConfig; } else { SCLogInfo("Using 1.0 style configuration for pfring"); *parser = OldParsePfringConfig; /* In v1: try to get interface name from config */ if (*live_dev == NULL) { if (ConfGet("pfring.interface", live_dev) == 1) { SCLogInfo("Using interface %s", *live_dev); LiveRegisterDevice(*live_dev); } else { SCLogInfo("No interface found, problem incoming"); *live_dev = NULL; } } } return 0; } #endif int RunModeIdsPfringAutoFp(void) { SCEnter(); /* We include only if pfring is enabled */ #ifdef HAVE_PFRING int ret; char *live_dev = NULL; ConfigIfaceParserFunc tparser; RunModeInitialize(); TimeModeSetLive(); ret = GetDevAndParser(&live_dev, &tparser); if (ret != 0) { SCLogError(SC_ERR_MISSING_CONFIG_PARAM, "Unable to get parser and interface params"); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureAutoFp(tparser, PfringConfigGeThreadsCount, "ReceivePfring", "DecodePfring", thread_name_autofp, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPfringAutoFp initialised"); #endif /* HAVE_PFRING */ return 0; } int RunModeIdsPfringSingle(void) { SCEnter(); /* We include only if pfring is enabled */ #ifdef HAVE_PFRING int ret; char *live_dev = NULL; ConfigIfaceParserFunc tparser; RunModeInitialize(); TimeModeSetLive(); ret = GetDevAndParser(&live_dev, &tparser); if (ret != 0) { SCLogError(SC_ERR_MISSING_CONFIG_PARAM, "Unable to get parser and interface params"); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureSingle(tparser, PfringConfigGeThreadsCount, "ReceivePfring", "DecodePfring", thread_name_single, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPfringSingle initialised"); #endif /* HAVE_PFRING */ return 0; } int RunModeIdsPfringWorkers(void) { SCEnter(); /* We include only if pfring is enabled */ #ifdef HAVE_PFRING int ret; char *live_dev = NULL; ConfigIfaceParserFunc tparser; RunModeInitialize(); TimeModeSetLive(); ret = GetDevAndParser(&live_dev, &tparser); if (ret != 0) { SCLogError(SC_ERR_MISSING_CONFIG_PARAM, "Unable to get parser and interface params"); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureWorkers(tparser, PfringConfigGeThreadsCount, "ReceivePfring", "DecodePfring", thread_name_workers, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPfringWorkers initialised"); #endif /* HAVE_PFRING */ return 0; } suricata-3.2.1/src/detect-tls-cert-issuer.c0000644000000000000000000004551313051004444015470 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland * * Implements support for tls_cert_issuer keyword. */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-tls.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectTlsIssuerSetup(DetectEngineCtx *, Signature *, char *); static void DetectTlsIssuerRegisterTests(void); /** * \brief Registration function for keyword: tls_cert_issuer */ void DetectTlsIssuerRegister(void) { sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].name = "tls_cert_issuer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].desc = "content modifier to match specifically and only on the TLS cert issuer buffer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tls-cert-issuer"; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Match = NULL; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Setup = DetectTlsIssuerSetup; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Free = NULL; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].RegisterTests = DetectTlsIssuerRegisterTests; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_cert_issuer", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSISSUER_MATCH, 2, PrefilterTxTlsIssuerRegister); DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSISSUER_MATCH, DetectEngineInspectTlsIssuer); } /** * \brief this function setup the tls_cert_issuer modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success */ static int DetectTlsIssuerSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { s->list = DETECT_SM_LIST_TLSISSUER_MATCH; s->alproto = ALPROTO_TLS; return 0; } #ifdef UNITTESTS /** * \test Test that a signature containing a tls_cert_issuer is correctly parsed * and that the keyword is registered. */ static int DetectTlsIssuerTest01(void) { DetectEngineCtx *de_ctx = NULL; SigMatch *sm = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tls any any -> any any " "(msg:\"Testing tls_cert_issuer\"; " "tls_cert_issuer; content:\"test\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); /* sm should not be in the MATCH list */ sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]; FAIL_IF_NOT_NULL(sm); sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_TLSISSUER_MATCH]; FAIL_IF_NULL(sm); FAIL_IF(sm->type != DETECT_CONTENT); FAIL_IF_NOT_NULL(sm->next); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test Test matching for google in the issuer of a certificate * */ static int DetectTlsIssuerTest02(void) { /* client hello */ uint8_t client_hello[] = { 0x16, 0x03, 0x01, 0x00, 0xc8, 0x01, 0x00, 0x00, 0xc4, 0x03, 0x03, 0xd6, 0x08, 0x5a, 0xa2, 0x86, 0x5b, 0x85, 0xd4, 0x40, 0xab, 0xbe, 0xc0, 0xbc, 0x41, 0xf2, 0x26, 0xf0, 0xfe, 0x21, 0xee, 0x8b, 0x4c, 0x7e, 0x07, 0xc8, 0xec, 0xd2, 0x00, 0x46, 0x4c, 0xeb, 0xb7, 0x00, 0x00, 0x16, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x33, 0x00, 0x39, 0x00, 0x2f, 0x00, 0x35, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x12, 0x00, 0x10, 0x00, 0x00, 0x0d, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x33, 0x74, 0x00, 0x00, 0x00, 0x10, 0x00, 0x29, 0x00, 0x27, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x36, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x35, 0x05, 0x68, 0x32, 0x2d, 0x31, 0x34, 0x02, 0x68, 0x32, 0x08, 0x73, 0x70, 0x64, 0x79, 0x2f, 0x33, 0x2e, 0x31, 0x08, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00, 0x14, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x02, 0x03, 0x04, 0x02, 0x02, 0x02 }; /* server hello */ uint8_t server_hello[] = { 0x16, 0x03, 0x03, 0x00, 0x48, 0x02, 0x00, 0x00, 0x44, 0x03, 0x03, 0x57, 0x91, 0xb8, 0x63, 0xdd, 0xdb, 0xbb, 0x23, 0xcf, 0x0b, 0x43, 0x02, 0x1d, 0x46, 0x11, 0x27, 0x5c, 0x98, 0xcf, 0x67, 0xe1, 0x94, 0x3d, 0x62, 0x7d, 0x38, 0x48, 0x21, 0x23, 0xa5, 0x62, 0x31, 0x00, 0xc0, 0x2f, 0x00, 0x00, 0x1c, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x10, 0x00, 0x05, 0x00, 0x03, 0x02, 0x68, 0x32, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00 }; /* certificate */ uint8_t certificate[] = { 0x16, 0x03, 0x03, 0x04, 0x93, 0x0b, 0x00, 0x04, 0x8f, 0x00, 0x04, 0x8c, 0x00, 0x04, 0x89, 0x30, 0x82, 0x04, 0x85, 0x30, 0x82, 0x03, 0x6d, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x5c, 0x19, 0xb7, 0xb1, 0x32, 0x3b, 0x1c, 0xa1, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x49, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x1c, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x47, 0x32, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x37, 0x31, 0x33, 0x31, 0x33, 0x32, 0x34, 0x35, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x36, 0x31, 0x30, 0x30, 0x35, 0x31, 0x33, 0x31, 0x36, 0x30, 0x30, 0x5a, 0x30, 0x65, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65, 0x77, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa5, 0x0a, 0xb9, 0xb1, 0xca, 0x36, 0xd1, 0xae, 0x22, 0x38, 0x07, 0x06, 0xc9, 0x1a, 0x56, 0x4f, 0xbb, 0xdf, 0xa8, 0x6d, 0xbd, 0xee, 0x76, 0x16, 0xbc, 0x53, 0x3c, 0x03, 0x6a, 0x5c, 0x94, 0x50, 0x87, 0x2f, 0x28, 0xb4, 0x4e, 0xd5, 0x9b, 0x8f, 0xfe, 0x02, 0xde, 0x2a, 0x83, 0x01, 0xf9, 0x45, 0x61, 0x0e, 0x66, 0x0e, 0x24, 0x22, 0xe2, 0x59, 0x66, 0x0d, 0xd3, 0xe9, 0x77, 0x8a, 0x7e, 0x42, 0xaa, 0x5a, 0xf9, 0x05, 0xbf, 0x30, 0xc7, 0x03, 0x2b, 0xdc, 0xa6, 0x9c, 0xe0, 0x9f, 0x0d, 0xf1, 0x28, 0x19, 0xf8, 0xf2, 0x02, 0xfa, 0xbd, 0x62, 0xa0, 0xf3, 0x02, 0x2b, 0xcd, 0xf7, 0x09, 0x04, 0x3b, 0x52, 0xd8, 0x65, 0x4b, 0x4a, 0x70, 0xe4, 0x57, 0xc9, 0x2e, 0x2a, 0xf6, 0x9c, 0x6e, 0xd8, 0xde, 0x01, 0x52, 0xc9, 0x6f, 0xe9, 0xef, 0x82, 0xbc, 0x0b, 0x95, 0xb2, 0xef, 0xcb, 0x91, 0xa6, 0x0b, 0x2d, 0x14, 0xc6, 0x00, 0xa9, 0x33, 0x86, 0x64, 0x00, 0xd4, 0x92, 0x19, 0x53, 0x3d, 0xfd, 0xcd, 0xc6, 0x1a, 0xf2, 0x0e, 0x67, 0xc2, 0x1d, 0x2c, 0xe0, 0xe8, 0x29, 0x97, 0x1c, 0xb6, 0xc4, 0xb2, 0x02, 0x0c, 0x83, 0xb8, 0x60, 0x61, 0xf5, 0x61, 0x2d, 0x73, 0x5e, 0x85, 0x4d, 0xbd, 0x0d, 0xe7, 0x1a, 0x37, 0x56, 0x8d, 0xe5, 0x50, 0x0c, 0xc9, 0x64, 0x4c, 0x11, 0xea, 0xf3, 0xcb, 0x26, 0x34, 0xbd, 0x02, 0xf5, 0xc1, 0xfb, 0xa2, 0xec, 0x27, 0xbb, 0x60, 0xbe, 0x0b, 0xf6, 0xe7, 0x3c, 0x2d, 0xc9, 0xe7, 0xb0, 0x30, 0x28, 0x17, 0x3d, 0x90, 0xf1, 0x63, 0x8e, 0x49, 0xf7, 0x15, 0x78, 0x21, 0xcc, 0x45, 0xe6, 0x86, 0xb2, 0xd8, 0xb0, 0x2e, 0x5a, 0xb0, 0x58, 0xd3, 0xb6, 0x11, 0x40, 0xae, 0x81, 0x1f, 0x6b, 0x7a, 0xaf, 0x40, 0x50, 0xf9, 0x2e, 0x81, 0x8b, 0xec, 0x26, 0x11, 0x3f, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x53, 0x30, 0x82, 0x01, 0x4f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x1a, 0x30, 0x18, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x82, 0x09, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6f, 0x30, 0x68, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30, 0x5a, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0xc6, 0x53, 0x87, 0x42, 0x2d, 0xc8, 0xee, 0x7a, 0x62, 0x1e, 0x83, 0xdb, 0x0d, 0xe2, 0x32, 0xeb, 0x8b, 0xaf, 0x69, 0x40, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b, 0xbc, 0xf6, 0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6, 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81, 0x2f, 0x30, 0x21, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x1a, 0x30, 0x18, 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x05, 0x01, 0x30, 0x08, 0x06, 0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x02, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x29, 0x30, 0x27, 0x30, 0x25, 0xa0, 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x7b, 0x27, 0x00, 0x46, 0x8f, 0xfd, 0x5b, 0xff, 0xcb, 0x05, 0x9b, 0xf7, 0xf1, 0x68, 0xf6, 0x9a, 0x7b, 0xba, 0x53, 0xdf, 0x63, 0xed, 0x11, 0x94, 0x39, 0xf2, 0xd0, 0x20, 0xcd, 0xa3, 0xc4, 0x98, 0xa5, 0x10, 0x74, 0xe7, 0x10, 0x6d, 0x07, 0xf8, 0x33, 0x87, 0x05, 0x43, 0x0e, 0x64, 0x77, 0x09, 0x18, 0x4f, 0x38, 0x2e, 0x45, 0xae, 0xa8, 0x34, 0x3a, 0xa8, 0x33, 0xac, 0x9d, 0xdd, 0x25, 0x91, 0x59, 0x43, 0xbe, 0x0f, 0x87, 0x16, 0x2f, 0xb5, 0x27, 0xfd, 0xce, 0x2f, 0x35, 0x5d, 0x12, 0xa1, 0x66, 0xac, 0xf7, 0x95, 0x38, 0x0f, 0xe5, 0xb1, 0x18, 0x18, 0xe6, 0x80, 0x52, 0x31, 0x8a, 0x66, 0x02, 0x52, 0x1a, 0xa4, 0x32, 0x6a, 0x61, 0x05, 0xcf, 0x1d, 0xf9, 0x90, 0x73, 0xf0, 0xeb, 0x20, 0x31, 0x7b, 0x2e, 0xc0, 0xb0, 0xfb, 0x5c, 0xcc, 0xdc, 0x76, 0x55, 0x72, 0xaf, 0xb1, 0x05, 0xf4, 0xad, 0xf9, 0xd7, 0x73, 0x5c, 0x2c, 0xbf, 0x0d, 0x84, 0x18, 0x01, 0x1d, 0x4d, 0x08, 0xa9, 0x4e, 0x37, 0xb7, 0x58, 0xc4, 0x05, 0x0e, 0x65, 0x63, 0xd2, 0x88, 0x02, 0xf5, 0x82, 0x17, 0x08, 0xd5, 0x8f, 0x80, 0xc7, 0x82, 0x29, 0xbb, 0xe1, 0x04, 0xbe, 0xf6, 0xe1, 0x8c, 0xbc, 0x3a, 0xf8, 0xf9, 0x56, 0xda, 0xdc, 0x8e, 0xc6, 0xe6, 0x63, 0x98, 0x12, 0x08, 0x41, 0x2c, 0x9d, 0x7c, 0x82, 0x0d, 0x1e, 0xea, 0xba, 0xde, 0x32, 0x09, 0xda, 0x52, 0x24, 0x4f, 0xcc, 0xb6, 0x09, 0x33, 0x8b, 0x00, 0xf9, 0x83, 0xb3, 0xc6, 0xa4, 0x90, 0x49, 0x83, 0x2d, 0x36, 0xd9, 0x11, 0x78, 0xd0, 0x62, 0x9f, 0xc4, 0x8f, 0x84, 0xba, 0x7f, 0xaa, 0x04, 0xf1, 0xd9, 0xa4, 0xad, 0x5d, 0x63, 0xee, 0x72, 0xc6, 0x4d, 0xd1, 0x4b, 0x41, 0x8f, 0x40, 0x0f, 0x7d, 0xcd, 0xb8, 0x2e, 0x5b, 0x6e, 0x21, 0xc9, 0x3d }; Flow f; SSLState *ssl_state = NULL; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(client_hello, sizeof(client_hello), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 51251, 443); p2 = UTHBuildPacketReal(server_hello, sizeof(server_hello), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); p3 = UTHBuildPacketReal(certificate, sizeof(certificate), IPPROTO_TCP, "192.168.1.1", "192.168.1.5", 443, 51251); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_TLS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->pcap_cnt = 3; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_cert_issuer\"; " "tls_cert_issuer; content:\"google\"; nocase; " "sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, client_hello, sizeof(client_hello)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); SigMatchSignatures(&tv, de_ctx, det_ctx, p1); FAIL_IF(PacketAlertCheck(p1, 1)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, server_hello, sizeof(server_hello)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p2); FAIL_IF(PacketAlertCheck(p2, 1)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOCLIENT, certificate, sizeof(certificate)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); SigMatchSignatures(&tv, de_ctx, det_ctx, p3); FAIL_IF_NOT(PacketAlertCheck(p3, 1)); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); PASS; } #endif static void DetectTlsIssuerRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTlsIssuerTest01", DetectTlsIssuerTest01); UtRegisterTest("DetectTlsIssuerTest02", DetectTlsIssuerTest02); #endif } suricata-3.2.1/src/runmode-erf-dag.c0000644000000000000000000000662213051004444014127 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-erf-dag.h" #include "output.h" #include "detect-engine.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" static const char *default_mode; static int DagConfigGetThreadCount(void *conf) { return 1; } static void *ParseDagConfig(const char *iface) { return (void *)iface; } const char *RunModeErfDagGetDefaultMode(void) { return default_mode; } void RunModeErfDagRegister(void) { default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_DAG, "autofp", "Multi threaded DAG mode. Packets from " "each flow are assigned to a single detect " "thread, unlike \"dag_auto\" where packets " "from the same flow can be processed by any " "detect thread", RunModeIdsErfDagAutoFp); RunModeRegisterNewRunMode(RUNMODE_DAG, "single", "Singled threaded DAG mode", RunModeIdsErfDagSingle); RunModeRegisterNewRunMode(RUNMODE_DAG, "workers", "Workers DAG mode, each thread does all " " tasks from acquisition to logging", RunModeIdsErfDagWorkers); return; } int RunModeIdsErfDagSingle(void) { int ret; SCEnter(); RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureSingle(ParseDagConfig, DagConfigGetThreadCount, "ReceiveErfDag", "DecodeErfDag", thread_name_single, NULL); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "DAG single runmode failed to start"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsDagSingle initialised"); SCReturnInt(0); } int RunModeIdsErfDagAutoFp(void) { int ret; SCEnter(); RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureAutoFp(ParseDagConfig, DagConfigGetThreadCount, "ReceiveErfDag", "DecodeErfDag", thread_name_autofp, NULL); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "DAG autofp runmode failed to start"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsDagAutoFp initialised"); SCReturnInt(0); } int RunModeIdsErfDagWorkers(void) { int ret; SCEnter(); RunModeInitialize(); TimeModeSetLive(); ret = RunModeSetLiveCaptureWorkers(ParseDagConfig, DagConfigGetThreadCount, "ReceiveErfDag", "DecodeErfDag", thread_name_workers, NULL); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "DAG workers runmode failed to start"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsErfDagWorkers initialised"); SCReturnInt(0); } suricata-3.2.1/src/detect-engine-address-ipv6.h0000644000000000000000000000271613051004444016200 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_ADDRESS_IPV6_H__ #define __DETECT_ENGINE_ADDRESS_IPV6_H__ int AddressIPv6Lt(Address *, Address *); int AddressIPv6Gt(Address *, Address *); int AddressIPv6Eq(Address *, Address *); int AddressIPv6Le(Address *, Address *); int AddressIPv6Ge(Address *, Address *); int DetectAddressCutNotIPv6(DetectAddress *, DetectAddress **); int DetectAddressCmpIPv6(DetectAddress *a, DetectAddress *b); int DetectAddressCutIPv6(DetectEngineCtx *, DetectAddress *, DetectAddress *, DetectAddress **); int DetectAddressJoinIPv6(DetectEngineCtx *, DetectAddress *, DetectAddress *); void DetectAddressIPv6Tests(void); #endif /* __DETECT_ENGINE_ADDRESS_IPV6_H__ */ suricata-3.2.1/src/runmode-erf-file.h0000644000000000000000000000200513051004444014307 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_ERF_FILE_H__ #define __RUNMODE_ERF_FILE_H__ int RunModeErfFileSingle(void); int RunModeErfFileAutoFp(void); void RunModeErfFileRegister(void); const char *RunModeErfFileGetDefaultMode(void); #endif /* __RUNMODE_ERF_FILE_H__ */ suricata-3.2.1/src/detect-asn1.h0000644000000000000000000000301113051004444013255 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-asn1.h * * \author Pablo Rincon Crespo * * Implements "asn1" keyword */ #ifndef __DETECT_ASN1_H__ #define __DETECT_ASN1_H__ /* Function check flags */ #define ASN1_BITSTRING_OVF 0x01 #define ASN1_DOUBLE_OVF 0x02 #define ASN1_OVERSIZE_LEN 0x04 #define ASN1_ABSOLUTE_OFFSET 0x10 #define ASN1_RELATIVE_OFFSET 0x20 typedef struct DetectAsn1Data_ { uint8_t flags; /* flags indicating the checks loaded */ uint32_t oversize_length; /* Length argument if needed */ int32_t absolute_offset; /* Length argument if needed */ int32_t relative_offset; /* Length argument if needed */ } DetectAsn1Data; /* prototypes */ void DetectAsn1Register (void); #endif /* __DETECT_ASN1_H__ */ suricata-3.2.1/src/decode-tcp.c0000644000000000000000000004070413051004444013161 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode TCP */ #include "suricata-common.h" #include "decode.h" #include "decode-tcp.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" #include "util-optimize.h" #include "flow.h" #include "util-profiling.h" #include "pkt-var.h" #include "host.h" #define SET_OPTS(dst, src) \ (dst).type = (src).type; \ (dst).len = (src).len; \ (dst).data = (src).data static int DecodeTCPOptions(Packet *p, uint8_t *pkt, uint16_t len) { uint8_t tcp_opt_cnt = 0; TCPOpt tcp_opts[TCP_OPTMAX]; uint16_t plen = len; while (plen) { /* single byte options */ if (*pkt == TCP_OPT_EOL) { break; } else if (*pkt == TCP_OPT_NOP) { pkt++; plen--; /* multibyte options */ } else { if (plen < 2) { break; } /* we already know that the total options len is valid, * so here the len of the specific option must be bad. * Also check for invalid lengths 0 and 1. */ if (unlikely(*(pkt+1) > plen || *(pkt+1) < 2)) { ENGINE_SET_INVALID_EVENT(p, TCP_OPT_INVALID_LEN); return -1; } tcp_opts[tcp_opt_cnt].type = *pkt; tcp_opts[tcp_opt_cnt].len = *(pkt+1); if (plen > 2) tcp_opts[tcp_opt_cnt].data = (pkt+2); else tcp_opts[tcp_opt_cnt].data = NULL; /* we are parsing the most commonly used opts to prevent * us from having to walk the opts list for these all the * time. */ switch (tcp_opts[tcp_opt_cnt].type) { case TCP_OPT_WS: if (tcp_opts[tcp_opt_cnt].len != TCP_OPT_WS_LEN) { ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN); } else { if (p->tcpvars.ws.type != 0) { ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE); } else { SET_OPTS(p->tcpvars.ws, tcp_opts[tcp_opt_cnt]); } } break; case TCP_OPT_MSS: if (tcp_opts[tcp_opt_cnt].len != TCP_OPT_MSS_LEN) { ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN); } else { if (p->tcpvars.mss.type != 0) { ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE); } else { SET_OPTS(p->tcpvars.mss, tcp_opts[tcp_opt_cnt]); } } break; case TCP_OPT_SACKOK: if (tcp_opts[tcp_opt_cnt].len != TCP_OPT_SACKOK_LEN) { ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN); } else { if (p->tcpvars.sackok.type != 0) { ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE); } else { SET_OPTS(p->tcpvars.sackok, tcp_opts[tcp_opt_cnt]); } } break; case TCP_OPT_TS: if (tcp_opts[tcp_opt_cnt].len != TCP_OPT_TS_LEN) { ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN); } else { if (p->tcpvars.ts_set) { ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE); } else { uint32_t values[2]; memcpy(&values, tcp_opts[tcp_opt_cnt].data, sizeof(values)); p->tcpvars.ts_val = ntohl(values[0]); p->tcpvars.ts_ecr = ntohl(values[1]); p->tcpvars.ts_set = TRUE; } } break; case TCP_OPT_SACK: SCLogDebug("SACK option, len %u", tcp_opts[tcp_opt_cnt].len); if (tcp_opts[tcp_opt_cnt].len < TCP_OPT_SACK_MIN_LEN || tcp_opts[tcp_opt_cnt].len > TCP_OPT_SACK_MAX_LEN || !((tcp_opts[tcp_opt_cnt].len - 2) % 8 == 0)) { ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN); } else { if (p->tcpvars.sack.type != 0) { ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE); } else { SET_OPTS(p->tcpvars.sack, tcp_opts[tcp_opt_cnt]); } } break; } pkt += tcp_opts[tcp_opt_cnt].len; plen -= (tcp_opts[tcp_opt_cnt].len); tcp_opt_cnt++; } } return 0; } static int DecodeTCPPacket(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < TCP_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, TCP_PKT_TOO_SMALL); return -1; } p->tcph = (TCPHdr *)pkt; uint8_t hlen = TCP_GET_HLEN(p); if (unlikely(len < hlen)) { ENGINE_SET_INVALID_EVENT(p, TCP_HLEN_TOO_SMALL); return -1; } uint8_t tcp_opt_len = hlen - TCP_HEADER_LEN; if (unlikely(tcp_opt_len > TCP_OPTLENMAX)) { ENGINE_SET_INVALID_EVENT(p, TCP_INVALID_OPTLEN); return -1; } if (likely(tcp_opt_len > 0)) { DecodeTCPOptions(p, pkt + TCP_HEADER_LEN, tcp_opt_len); } SET_TCP_SRC_PORT(p,&p->sp); SET_TCP_DST_PORT(p,&p->dp); p->proto = IPPROTO_TCP; p->payload = pkt + hlen; p->payload_len = len - hlen; return 0; } int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_tcp); if (unlikely(DecodeTCPPacket(tv, p,pkt,len) < 0)) { SCLogDebug("invalid TCP packet"); p->tcph = NULL; return TM_ECODE_FAILED; } #ifdef DEBUG SCLogDebug("TCP sp: %" PRIu32 " -> dp: %" PRIu32 " - HLEN: %" PRIu32 " LEN: %" PRIu32 " %s%s%s%s%s", GET_TCP_SRC_PORT(p), GET_TCP_DST_PORT(p), TCP_GET_HLEN(p), len, TCP_HAS_SACKOK(p) ? "SACKOK " : "", TCP_HAS_SACK(p) ? "SACK " : "", TCP_HAS_WSCALE(p) ? "WS " : "", TCP_HAS_TS(p) ? "TS " : "", TCP_HAS_MSS(p) ? "MSS " : ""); #endif FlowSetupPacket(p); return TM_ECODE_OK; } #ifdef UNITTESTS static int TCPCalculateValidChecksumtest01(void) { uint16_t csum = 0; uint8_t raw_ipshdr[] = { 0x40, 0x8e, 0x7e, 0xb2, 0xc0, 0xa8, 0x01, 0x03}; uint8_t raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0xa0, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 02}; csum = *( ((uint16_t *)raw_tcp) + 8); return (csum == TCPCalculateChecksum((uint16_t *) raw_ipshdr, (uint16_t *)raw_tcp, sizeof(raw_tcp))); } static int TCPCalculateInvalidChecksumtest02(void) { uint16_t csum = 0; uint8_t raw_ipshdr[] = { 0x40, 0x8e, 0x7e, 0xb2, 0xc0, 0xa8, 0x01, 0x03}; uint8_t raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0xa0, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 03}; csum = *( ((uint16_t *)raw_tcp) + 8); return (csum != TCPCalculateChecksum((uint16_t *) raw_ipshdr, (uint16_t *)raw_tcp, sizeof(raw_tcp))); } static int TCPV6CalculateValidChecksumtest03(void) { uint16_t csum = 0; static uint8_t raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x80, 0x10, 0x21, 0x5c, 0xc2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x27}; csum = *( ((uint16_t *)(raw_ipv6 + 70))); return (csum == TCPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 32)); } static int TCPV6CalculateInvalidChecksumtest04(void) { uint16_t csum = 0; static uint8_t raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x80, 0x10, 0x21, 0x5c, 0xc2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x28}; csum = *( ((uint16_t *)(raw_ipv6 + 70))); return (csum != TCPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8), (uint16_t *)(raw_ipv6 + 54), 32)); } /** \test Get the wscale of 2 */ static int TCPGetWscaleTest01(void) { int retval = 0; static uint8_t raw_tcp[] = {0xda, 0xc1, 0x00, 0x50, 0xb6, 0x21, 0x7f, 0x58, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0xd0, 0x8a, 0xaf, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x62, 0x88, 0x28, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x02}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; IPV4Hdr ip4h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->src.family = AF_INET; p->dst.family = AF_INET; p->ip4h = &ip4h; FlowInitConfig(FLOW_QUIET); DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp), NULL); if (p->tcph == NULL) { printf("tcp packet decode failed: "); goto end; } uint8_t wscale = TCP_GET_WSCALE(p); if (wscale != 2) { printf("wscale %"PRIu8", expected 2: ", wscale); goto end; } retval = 1; end: PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return retval; } /** \test Get the wscale of 15, so see if return 0 properly */ static int TCPGetWscaleTest02(void) { int retval = 0; static uint8_t raw_tcp[] = {0xda, 0xc1, 0x00, 0x50, 0xb6, 0x21, 0x7f, 0x58, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x16, 0xd0, 0x8a, 0xaf, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x00, 0x62, 0x88, 0x28, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x0f}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; IPV4Hdr ip4h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->src.family = AF_INET; p->dst.family = AF_INET; p->ip4h = &ip4h; FlowInitConfig(FLOW_QUIET); DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp), NULL); if (p->tcph == NULL) { printf("tcp packet decode failed: "); goto end; } uint8_t wscale = TCP_GET_WSCALE(p); if (wscale != 0) { printf("wscale %"PRIu8", expected 0: ", wscale); goto end; } retval = 1; end: PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return retval; } /** \test Get the wscale, but it's missing, so see if return 0 properly */ static int TCPGetWscaleTest03(void) { int retval = 0; static uint8_t raw_tcp[] = {0xda, 0xc1, 0x00, 0x50, 0xb6, 0x21, 0x7f, 0x59, 0xdd, 0xa3, 0x6f, 0xf8, 0x80, 0x10, 0x05, 0xb4, 0x7c, 0x70, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x62, 0x88, 0x9e, 0x00, 0x00, 0x00, 0x00}; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; IPV4Hdr ip4h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->src.family = AF_INET; p->dst.family = AF_INET; p->ip4h = &ip4h; FlowInitConfig(FLOW_QUIET); DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp), NULL); if (p->tcph == NULL) { printf("tcp packet decode failed: "); goto end; } uint8_t wscale = TCP_GET_WSCALE(p); if (wscale != 0) { printf("wscale %"PRIu8", expected 0: ", wscale); goto end; } retval = 1; end: PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return retval; } static int TCPGetSackTest01(void) { int retval = 0; static uint8_t raw_tcp[] = { 0x00, 0x50, 0x06, 0xa6, 0xfa, 0x87, 0x0b, 0xf5, 0xf1, 0x59, 0x02, 0xe0, 0xa0, 0x10, 0x3e, 0xbc, 0x1d, 0xe7, 0x00, 0x00, 0x01, 0x01, 0x05, 0x12, 0xf1, 0x59, 0x13, 0xfc, 0xf1, 0x59, 0x1f, 0x64, 0xf1, 0x59, 0x08, 0x94, 0xf1, 0x59, 0x0e, 0x48 }; static uint8_t raw_tcp_sack[] = { 0xf1, 0x59, 0x13, 0xfc, 0xf1, 0x59, 0x1f, 0x64, 0xf1, 0x59, 0x08, 0x94, 0xf1, 0x59, 0x0e, 0x48 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; IPV4Hdr ip4h; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ip4h, 0, sizeof(IPV4Hdr)); p->src.family = AF_INET; p->dst.family = AF_INET; p->ip4h = &ip4h; FlowInitConfig(FLOW_QUIET); DecodeTCP(&tv, &dtv, p, raw_tcp, sizeof(raw_tcp), NULL); if (p->tcph == NULL) { printf("tcp packet decode failed: "); goto end; } if (!TCP_HAS_SACK(p)) { printf("tcp packet sack not decoded: "); goto end; } int sack = TCP_GET_SACK_CNT(p); if (sack != 2) { printf("expected 2 sack records, got %u: ", TCP_GET_SACK_CNT(p)); goto end; } uint8_t *sackptr = TCP_GET_SACK_PTR(p); if (sackptr == NULL) { printf("no sack data: "); goto end; } if (memcmp(sackptr, raw_tcp_sack, 16) != 0) { printf("malformed sack data: "); goto end; } retval = 1; end: PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return retval; } #endif /* UNITTESTS */ void DecodeTCPRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("TCPCalculateValidChecksumtest01", TCPCalculateValidChecksumtest01); UtRegisterTest("TCPCalculateInvalidChecksumtest02", TCPCalculateInvalidChecksumtest02); UtRegisterTest("TCPV6CalculateValidChecksumtest03", TCPV6CalculateValidChecksumtest03); UtRegisterTest("TCPV6CalculateInvalidChecksumtest04", TCPV6CalculateInvalidChecksumtest04); UtRegisterTest("TCPGetWscaleTest01", TCPGetWscaleTest01); UtRegisterTest("TCPGetWscaleTest02", TCPGetWscaleTest02); UtRegisterTest("TCPGetWscaleTest03", TCPGetWscaleTest03); UtRegisterTest("TCPGetSackTest01", TCPGetSackTest01); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/output-json-ssh.h0000644000000000000000000000176513051004444014265 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __OUTPUT_JSON_SSH_H__ #define __OUTPUT_JSON_SSH_H__ void JsonSshLogRegister(void); #ifdef HAVE_LIBJANSSON #include "app-layer-ssh.h" void JsonSshLogJSON(json_t *js, SshState *tx); #endif #endif /* __OUTPUT_JSON_SSH_H__ */ suricata-3.2.1/src/util-pidfile.h0000644000000000000000000000202713051004444013542 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * \author Victor Julien */ #ifndef __UTIL_PID_H__ #define __UTIL_PID_H__ int SCPidfileCreate(const char *); void SCPidfileRemove(const char *); int SCPidfileTestRunning(const char *pid_filename); #endif /* __UTIL_PID_H__ */ suricata-3.2.1/src/tmqh-packetpool.c0000644000000000000000000004265213051004444014266 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Packetpool queue handlers. Packet pool is implemented as a stack. */ #include "suricata.h" #include "packet-queue.h" #include "decode.h" #include "detect.h" #include "detect-uricontent.h" #include "threads.h" #include "threadvars.h" #include "flow.h" #include "flow-util.h" #include "host.h" #include "stream.h" #include "stream-tcp-reassemble.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "tm-modules.h" #include "pkt-var.h" #include "tmqh-packetpool.h" #include "util-debug.h" #include "util-error.h" #include "util-profiling.h" #include "util-device.h" /* Number of freed packet to save for one pool before freeing them. */ #define MAX_PENDING_RETURN_PACKETS 32 static uint32_t max_pending_return_packets = MAX_PENDING_RETURN_PACKETS; #ifdef TLS __thread PktPool thread_pkt_pool; static inline PktPool *GetThreadPacketPool(void) { return &thread_pkt_pool; } #else /* __thread not supported. */ static pthread_key_t pkt_pool_thread_key; static SCMutex pkt_pool_thread_key_mutex = SCMUTEX_INITIALIZER; static int pkt_pool_thread_key_initialized = 0; static void PktPoolThreadDestroy(void * buf) { SCFreeAligned(buf); } static void TmqhPacketPoolInit(void) { SCMutexLock(&pkt_pool_thread_key_mutex); if (pkt_pool_thread_key_initialized) { /* Key has already been created. */ SCMutexUnlock(&pkt_pool_thread_key_mutex); return; } /* Create the pthread Key that is used to look up thread specific * data buffer. Needs to be created only once. */ int r = pthread_key_create(&pkt_pool_thread_key, PktPoolThreadDestroy); if (r != 0) { SCLogError(SC_ERR_MEM_ALLOC, "pthread_key_create failed with %d", r); exit(EXIT_FAILURE); } pkt_pool_thread_key_initialized = 1; SCMutexUnlock(&pkt_pool_thread_key_mutex); } static PktPool *ThreadPacketPoolCreate(void) { TmqhPacketPoolInit(); /* Create a new pool for this thread. */ PktPool* pool = (PktPool*)SCMallocAligned(sizeof(PktPool), CLS); if (pool == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "malloc failed"); exit(EXIT_FAILURE); } memset(pool,0x0,sizeof(*pool)); int r = pthread_setspecific(pkt_pool_thread_key, pool); if (r != 0) { SCLogError(SC_ERR_MEM_ALLOC, "pthread_setspecific failed with %d", r); exit(EXIT_FAILURE); } return pool; } static inline PktPool *GetThreadPacketPool(void) { PktPool* pool = (PktPool*)pthread_getspecific(pkt_pool_thread_key); if (pool == NULL) pool = ThreadPacketPoolCreate(); return pool; } #endif /** * \brief TmqhPacketpoolRegister * \initonly */ void TmqhPacketpoolRegister (void) { tmqh_table[TMQH_PACKETPOOL].name = "packetpool"; tmqh_table[TMQH_PACKETPOOL].InHandler = TmqhInputPacketpool; tmqh_table[TMQH_PACKETPOOL].OutHandler = TmqhOutputPacketpool; } static int PacketPoolIsEmpty(PktPool *pool) { /* Check local stack first. */ if (pool->head || pool->return_stack.head) return 0; return 1; } void PacketPoolWait(void) { PktPool *my_pool = GetThreadPacketPool(); if (PacketPoolIsEmpty(my_pool)) { SCMutexLock(&my_pool->return_stack.mutex); SC_ATOMIC_ADD(my_pool->return_stack.sync_now, 1); SCCondWait(&my_pool->return_stack.cond, &my_pool->return_stack.mutex); SCMutexUnlock(&my_pool->return_stack.mutex); } while(PacketPoolIsEmpty(my_pool)) cc_barrier(); } /** \brief Wait until we have the requested ammount of packets in the pool * * In some cases waiting for packets is undesirable. Especially when * a wait would happen under a lock of some kind, other parts of the * engine could have to wait. * * This function only returns when at least N packets are in our pool. * * \param n number of packets needed */ void PacketPoolWaitForN(int n) { PktPool *my_pool = GetThreadPacketPool(); Packet *p = NULL; while (1) { int i = 0; PacketPoolWait(); /* count packets in our stack */ p = my_pool->head; while (p != NULL) { if (++i == n) return; p = p->next; } /* continue counting in the return stack */ if (my_pool->return_stack.head != NULL) { SCMutexLock(&my_pool->return_stack.mutex); p = my_pool->return_stack.head; while (p != NULL) { if (++i == n) { SCMutexUnlock(&my_pool->return_stack.mutex); return; } p = p->next; } SCMutexUnlock(&my_pool->return_stack.mutex); /* or signal that we need packets and wait */ } else { SCMutexLock(&my_pool->return_stack.mutex); SC_ATOMIC_ADD(my_pool->return_stack.sync_now, 1); SCCondWait(&my_pool->return_stack.cond, &my_pool->return_stack.mutex); SCMutexUnlock(&my_pool->return_stack.mutex); } } } /** \brief a initialized packet * * \warning Use *only* at init, not at packet runtime */ static void PacketPoolStorePacket(Packet *p) { /* Clear the PKT_ALLOC flag, since that indicates to push back * onto the ring buffer. */ p->flags &= ~PKT_ALLOC; p->pool = GetThreadPacketPool(); p->ReleasePacket = PacketPoolReturnPacket; PacketPoolReturnPacket(p); } static void PacketPoolGetReturnedPackets(PktPool *pool) { SCMutexLock(&pool->return_stack.mutex); /* Move all the packets from the locked return stack to the local stack. */ pool->head = pool->return_stack.head; pool->return_stack.head = NULL; SCMutexUnlock(&pool->return_stack.mutex); } /** \brief Get a new packet from the packet pool * * Only allocates from the thread's local stack, or mallocs new packets. * If the local stack is empty, first move all the return stack packets to * the local stack. * \retval Packet pointer, or NULL on failure. */ Packet *PacketPoolGetPacket(void) { PktPool *pool = GetThreadPacketPool(); #ifdef DEBUG_VALIDATION BUG_ON(pool->initialized == 0); BUG_ON(pool->destroyed == 1); #endif /* DEBUG_VALIDATION */ if (pool->head) { /* Stack is not empty. */ Packet *p = pool->head; pool->head = p->next; p->pool = pool; PACKET_REINIT(p); return p; } /* Local Stack is empty, so check the return stack, which requires * locking. */ PacketPoolGetReturnedPackets(pool); /* Try to allocate again. Need to check for not empty again, since the * return stack might have been empty too. */ if (pool->head) { /* Stack is not empty. */ Packet *p = pool->head; pool->head = p->next; p->pool = pool; PACKET_REINIT(p); return p; } /* Failed to allocate a packet, so return NULL. */ /* Optionally, could allocate a new packet here. */ return NULL; } /** \brief Return packet to Packet pool * */ void PacketPoolReturnPacket(Packet *p) { PktPool *my_pool = GetThreadPacketPool(); PACKET_RELEASE_REFS(p); PktPool *pool = p->pool; if (pool == NULL) { PacketFree(p); return; } #ifdef DEBUG_VALIDATION BUG_ON(pool->initialized == 0); BUG_ON(pool->destroyed == 1); BUG_ON(my_pool->initialized == 0); BUG_ON(my_pool->destroyed == 1); #endif /* DEBUG_VALIDATION */ if (pool == my_pool) { /* Push back onto this thread's own stack, so no locking. */ p->next = my_pool->head; my_pool->head = p; } else { PktPool *pending_pool = my_pool->pending_pool; if (pending_pool == NULL) { /* No pending packet, so store the current packet. */ p->next = NULL; my_pool->pending_pool = pool; my_pool->pending_head = p; my_pool->pending_tail = p; my_pool->pending_count = 1; } else if (pending_pool == pool) { /* Another packet for the pending pool list. */ p->next = my_pool->pending_head; my_pool->pending_head = p; my_pool->pending_count++; if (SC_ATOMIC_GET(pool->return_stack.sync_now) || my_pool->pending_count > max_pending_return_packets) { /* Return the entire list of pending packets. */ SCMutexLock(&pool->return_stack.mutex); my_pool->pending_tail->next = pool->return_stack.head; pool->return_stack.head = my_pool->pending_head; SC_ATOMIC_RESET(pool->return_stack.sync_now); SCMutexUnlock(&pool->return_stack.mutex); SCCondSignal(&pool->return_stack.cond); /* Clear the list of pending packets to return. */ my_pool->pending_pool = NULL; my_pool->pending_head = NULL; my_pool->pending_tail = NULL; my_pool->pending_count = 0; } } else { /* Push onto return stack for this pool */ SCMutexLock(&pool->return_stack.mutex); p->next = pool->return_stack.head; pool->return_stack.head = p; SC_ATOMIC_RESET(pool->return_stack.sync_now); SCMutexUnlock(&pool->return_stack.mutex); SCCondSignal(&pool->return_stack.cond); } } } void PacketPoolInitEmpty(void) { #ifndef TLS TmqhPacketPoolInit(); #endif PktPool *my_pool = GetThreadPacketPool(); #ifdef DEBUG_VALIDATION BUG_ON(my_pool->initialized); my_pool->initialized = 1; my_pool->destroyed = 0; #endif /* DEBUG_VALIDATION */ SCMutexInit(&my_pool->return_stack.mutex, NULL); SCCondInit(&my_pool->return_stack.cond, NULL); SC_ATOMIC_INIT(my_pool->return_stack.sync_now); } void PacketPoolInit(void) { extern intmax_t max_pending_packets; #ifndef TLS TmqhPacketPoolInit(); #endif PktPool *my_pool = GetThreadPacketPool(); #ifdef DEBUG_VALIDATION BUG_ON(my_pool->initialized); my_pool->initialized = 1; my_pool->destroyed = 0; #endif /* DEBUG_VALIDATION */ SCMutexInit(&my_pool->return_stack.mutex, NULL); SCCondInit(&my_pool->return_stack.cond, NULL); SC_ATOMIC_INIT(my_pool->return_stack.sync_now); /* pre allocate packets */ SCLogDebug("preallocating packets... packet size %" PRIuMAX "", (uintmax_t)SIZE_OF_PACKET); int i = 0; for (i = 0; i < max_pending_packets; i++) { Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) { SCLogError(SC_ERR_FATAL, "Fatal error encountered while allocating a packet. Exiting..."); exit(EXIT_FAILURE); } PacketPoolStorePacket(p); } //SCLogInfo("preallocated %"PRIiMAX" packets. Total memory %"PRIuMAX"", // max_pending_packets, (uintmax_t)(max_pending_packets*SIZE_OF_PACKET)); } void PacketPoolDestroy(void) { Packet *p = NULL; PktPool *my_pool = GetThreadPacketPool(); #ifdef DEBUG_VALIDATION BUG_ON(my_pool->destroyed); #endif /* DEBUG_VALIDATION */ if (my_pool && my_pool->pending_pool != NULL) { p = my_pool->pending_head; while (p) { Packet *next_p = p->next; PacketFree(p); p = next_p; my_pool->pending_count--; } #ifdef DEBUG_VALIDATION BUG_ON(my_pool->pending_count); #endif /* DEBUG_VALIDATION */ my_pool->pending_pool = NULL; my_pool->pending_head = NULL; my_pool->pending_tail = NULL; } while ((p = PacketPoolGetPacket()) != NULL) { PacketFree(p); } SC_ATOMIC_DESTROY(my_pool->return_stack.sync_now); #ifdef DEBUG_VALIDATION my_pool->initialized = 0; my_pool->destroyed = 1; #endif /* DEBUG_VALIDATION */ } Packet *TmqhInputPacketpool(ThreadVars *tv) { return PacketPoolGetPacket(); } void TmqhOutputPacketpool(ThreadVars *t, Packet *p) { int proot = 0; SCEnter(); SCLogDebug("Packet %p, p->root %p, alloced %s", p, p->root, p->flags & PKT_ALLOC ? "true" : "false"); if (IS_TUNNEL_PKT(p)) { SCLogDebug("Packet %p is a tunnel packet: %s", p,p->root ? "upper layer" : "tunnel root"); /* get a lock to access root packet fields */ SCMutex *m = p->root ? &p->root->tunnel_mutex : &p->tunnel_mutex; SCMutexLock(m); if (IS_TUNNEL_ROOT_PKT(p)) { SCLogDebug("IS_TUNNEL_ROOT_PKT == TRUE"); if (TUNNEL_PKT_TPR(p) == 0) { SCLogDebug("TUNNEL_PKT_TPR(p) == 0, no more tunnel packet " "depending on this root"); /* if this packet is the root and there are no * more tunnel packets, return it to the pool */ /* fall through */ } else { SCLogDebug("tunnel root Packet %p: TUNNEL_PKT_TPR(p) > 0, so " "packets are still depending on this root, setting " "p->tunnel_verdicted == 1", p); /* if this is the root and there are more tunnel * packets, return this to the pool. It's still referenced * by the tunnel packets, and we will return it * when we handle them */ SET_TUNNEL_PKT_VERDICTED(p); PACKET_PROFILING_END(p); SCMutexUnlock(m); SCReturn; } } else { SCLogDebug("NOT IS_TUNNEL_ROOT_PKT, so tunnel pkt"); /* the p->root != NULL here seems unnecessary: IS_TUNNEL_PKT checks * that p->tunnel_pkt == 1, IS_TUNNEL_ROOT_PKT checks that + * p->root == NULL. So when we are here p->root can only be * non-NULL, right? CLANG thinks differently. May be a FP, but * better safe than sorry. VJ */ if (p->root != NULL && IS_TUNNEL_PKT_VERDICTED(p->root) && TUNNEL_PKT_TPR(p) == 1) { SCLogDebug("p->root->tunnel_verdicted == 1 && TUNNEL_PKT_TPR(p) == 1"); /* the root is ready and we are the last tunnel packet, * lets enqueue them both. */ TUNNEL_DECR_PKT_TPR_NOLOCK(p); /* handle the root */ SCLogDebug("setting proot = 1 for root pkt, p->root %p " "(tunnel packet %p)", p->root, p); proot = 1; /* fall through */ } else { /* root not ready yet, so get rid of the tunnel pkt only */ SCLogDebug("NOT p->root->tunnel_verdicted == 1 && " "TUNNEL_PKT_TPR(p) == 1 (%" PRIu32 ")", TUNNEL_PKT_TPR(p)); TUNNEL_DECR_PKT_TPR_NOLOCK(p); /* fall through */ } } SCMutexUnlock(m); SCLogDebug("tunnel stuff done, move on (proot %d)", proot); } FlowDeReference(&p->flow); /* we're done with the tunnel root now as well */ if (proot == 1) { SCLogDebug("getting rid of root pkt... alloc'd %s", p->root->flags & PKT_ALLOC ? "true" : "false"); FlowDeReference(&p->root->flow); p->root->ReleasePacket(p->root); p->root = NULL; } PACKET_PROFILING_END(p); p->ReleasePacket(p); SCReturn; } /** * \brief Release all the packets in the queue back to the packetpool. Mainly * used by threads that have failed, and wants to return the packets back * to the packetpool. * * \param pq Pointer to the packetqueue from which the packets have to be * returned back to the packetpool * * \warning this function assumes that the pq does not use locking */ void TmqhReleasePacketsToPacketPool(PacketQueue *pq) { Packet *p = NULL; if (pq == NULL) return; while ( (p = PacketDequeue(pq)) != NULL) TmqhOutputPacketpool(NULL, p); return; } /** * \brief Set the max_pending_return_packets value * * Set it to the max pending packets value, devided by the number * of lister threads. Normally, in autofp these are the stream/detect/log * worker threads. * * The max_pending_return_packets value needs to stay below the packet * pool size of the 'producers' (normally pkt capture threads but also * flow timeout injection ) to avoid a deadlock where all the 'workers' * keep packets in their return pools, while the capture thread can't * continue because its pool is empty. */ void PacketPoolPostRunmodes(void) { extern intmax_t max_pending_packets; uint32_t threads = TmThreadCountThreadsByTmmFlags(TM_FLAG_DETECT_TM); if (threads == 0) return; if (threads > max_pending_packets) return; uint32_t packets = (max_pending_packets / threads) - 1; if (packets < max_pending_return_packets) max_pending_return_packets = packets; SCLogDebug("detect threads %u, max packets %u, max_pending_return_packets %u", threads, (uint)threads, max_pending_return_packets); } suricata-3.2.1/src/detect-prefilter.c0000644000000000000000000000610213051004444014406 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the prefilter keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "util-debug.h" static int DetectPrefilterSetup (DetectEngineCtx *, Signature *, char *); void DetectPrefilterRegister(void) { sigmatch_table[DETECT_PREFILTER].name = "prefilter"; sigmatch_table[DETECT_PREFILTER].desc = "force a condition to be used as prefilter"; sigmatch_table[DETECT_PREFILTER].Match = NULL; sigmatch_table[DETECT_PREFILTER].Setup = DetectPrefilterSetup; sigmatch_table[DETECT_PREFILTER].Free = NULL; sigmatch_table[DETECT_PREFILTER].RegisterTests = NULL; sigmatch_table[DETECT_PREFILTER].flags |= SIGMATCH_NOOPT; } /** * \internal * \brief Apply the prefilter keyword to the last match * \param det_ctx detection engine ctx * \param s signature * \param nullstr should be null * \retval 0 ok * \retval -1 failure */ static int DetectPrefilterSetup (DetectEngineCtx *de_ctx, Signature *s, char *nullstr) { SCEnter(); SigMatch *sm = NULL; int ret = -1; if (nullstr != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "prefilter has value"); goto end; } if (s->flags & SIG_FLAG_PREFILTER) { SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter already set"); goto end; } sm = SigMatchGetLastSM(s); if (sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter needs preceding match"); goto end; } s->prefilter_sm = sm; s->flags |= SIG_FLAG_PREFILTER; /* if the sig match is content, prefilter should act like * 'fast_pattern' w/o options. */ if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if ((cd->flags & DETECT_CONTENT_NEGATED) && ((cd->flags & DETECT_CONTENT_DISTANCE) || (cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_OFFSET) || (cd->flags & DETECT_CONTENT_DEPTH))) { SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter; cannot be " "used with negated content, along with relative modifiers"); goto end; } cd->flags |= DETECT_CONTENT_FAST_PATTERN; } ret = 0; end: SCReturnInt(ret); } suricata-3.2.1/src/output-file.h0000644000000000000000000000302313051004444013425 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer File Logger Output registration functions */ #ifndef __OUTPUT_FILE_H__ #define __OUTPUT_FILE_H__ #include "decode.h" #include "util-file.h" /** packet logger function pointer type */ typedef int (*FileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *); /** packet logger condition function pointer type, * must return true for packets that should be logged */ //typedef int (*TxLogCondition)(ThreadVars *, const Packet *); int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputFileLoggerRegister(void); void OutputFileShutdown(void); #endif /* __OUTPUT_FILE_H__ */ suricata-3.2.1/src/flow-storage.h0000644000000000000000000000252613051004444013570 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow wrapper around storage api */ #ifndef __FLOW_STORAGE_H__ #define __FLOW_STORAGE_H__ #include "util-storage.h" #include "flow.h" unsigned int FlowStorageSize(void); void *FlowGetStorageById(Flow *h, int id); int FlowSetStorageById(Flow *h, int id, void *ptr); void *FlowAllocStorageById(Flow *h, int id); void FlowFreeStorageById(Flow *h, int id); void FlowFreeStorage(Flow *h); void RegisterFlowStorageTests(void); int FlowStorageRegister(const char *name, const unsigned int size, void *(*Alloc)(unsigned int), void (*Free)(void *)); #endif /* __FLOW_STORAGE_H__ */ suricata-3.2.1/src/flow-timeout.c0000644000000000000000000004506113051004444013606 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "conf.h" #include "threadvars.h" #include "tm-threads.h" #include "runmodes.h" #include "util-random.h" #include "util-time.h" #include "flow.h" #include "flow-queue.h" #include "flow-hash.h" #include "flow-util.h" #include "flow-var.h" #include "flow-private.h" #include "flow-manager.h" #include "pkt-var.h" #include "host.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-debug.h" #include "util-privs.h" #include "detect.h" #include "detect-engine-state.h" #include "stream.h" #include "app-layer-parser.h" #include "app-layer.h" #include "util-profiling.h" /** * \internal * \brief Pseudo packet setup for flow forced reassembly. * * \param direction Direction of the packet. 0 indicates toserver and 1 * indicates toclient. * \param f Pointer to the flow. * \param ssn Pointer to the tcp session. * \param dummy Indicates to create a dummy pseudo packet. Not all pseudo * packets need to force reassembly, in which case we just * set dummy ack/seq values. */ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p, int direction, Flow *f, TcpSession *ssn, int dummy) { p->tenant_id = f->tenant_id; p->datalink = DLT_RAW; p->proto = IPPROTO_TCP; FlowReference(&p->flow, f); p->flags |= PKT_STREAM_EST; p->flags |= PKT_STREAM_EOF; p->flags |= PKT_HAS_FLOW; p->flags |= PKT_PSEUDO_STREAM_END; if (f->flags & FLOW_NOPACKET_INSPECTION) { DecodeSetNoPacketInspectionFlag(p); } if (f->flags & FLOW_NOPAYLOAD_INSPECTION) { DecodeSetNoPayloadInspectionFlag(p); } if (direction == 0) p->flowflags |= FLOW_PKT_TOSERVER; else p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->payload = NULL; p->payload_len = 0; if (FLOW_IS_IPV4(f)) { if (direction == 0) { FLOW_COPY_IPV4_ADDR_TO_PACKET(&f->src, &p->src); FLOW_COPY_IPV4_ADDR_TO_PACKET(&f->dst, &p->dst); p->sp = f->sp; p->dp = f->dp; } else { FLOW_COPY_IPV4_ADDR_TO_PACKET(&f->src, &p->dst); FLOW_COPY_IPV4_ADDR_TO_PACKET(&f->dst, &p->src); p->sp = f->dp; p->dp = f->sp; } /* Check if we have enough room in direct data. We need ipv4 hdr + tcp hdr. * Force an allocation if it is not the case. */ if (GET_PKT_DIRECT_MAX_SIZE(p) < 40) { if (PacketCallocExtPkt(p, 40) == -1) { goto error; } } /* set the ip header */ p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p); /* version 4 and length 20 bytes for the tcp header */ p->ip4h->ip_verhl = 0x45; p->ip4h->ip_tos = 0; p->ip4h->ip_len = htons(40); p->ip4h->ip_id = 0; p->ip4h->ip_off = 0; p->ip4h->ip_ttl = 64; p->ip4h->ip_proto = IPPROTO_TCP; //p->ip4h->ip_csum = if (direction == 0) { p->ip4h->s_ip_src.s_addr = f->src.addr_data32[0]; p->ip4h->s_ip_dst.s_addr = f->dst.addr_data32[0]; } else { p->ip4h->s_ip_src.s_addr = f->dst.addr_data32[0]; p->ip4h->s_ip_dst.s_addr = f->src.addr_data32[0]; } /* set the tcp header */ p->tcph = (TCPHdr *)((uint8_t *)GET_PKT_DATA(p) + 20); SET_PKT_LEN(p, 40); /* ipv4 hdr + tcp hdr */ } else if (FLOW_IS_IPV6(f)) { if (direction == 0) { FLOW_COPY_IPV6_ADDR_TO_PACKET(&f->src, &p->src); FLOW_COPY_IPV6_ADDR_TO_PACKET(&f->dst, &p->dst); p->sp = f->sp; p->dp = f->dp; } else { FLOW_COPY_IPV6_ADDR_TO_PACKET(&f->src, &p->dst); FLOW_COPY_IPV6_ADDR_TO_PACKET(&f->dst, &p->src); p->sp = f->dp; p->dp = f->sp; } /* Check if we have enough room in direct data. We need ipv6 hdr + tcp hdr. * Force an allocation if it is not the case. */ if (GET_PKT_DIRECT_MAX_SIZE(p) < 60) { if (PacketCallocExtPkt(p, 60) == -1) { goto error; } } /* set the ip header */ p->ip6h = (IPV6Hdr *)GET_PKT_DATA(p); /* version 6 */ p->ip6h->s_ip6_vfc = 0x60; p->ip6h->s_ip6_flow = 0; p->ip6h->s_ip6_nxt = IPPROTO_TCP; p->ip6h->s_ip6_plen = htons(20); p->ip6h->s_ip6_hlim = 64; if (direction == 0) { p->ip6h->s_ip6_src[0] = f->src.addr_data32[0]; p->ip6h->s_ip6_src[1] = f->src.addr_data32[1]; p->ip6h->s_ip6_src[2] = f->src.addr_data32[2]; p->ip6h->s_ip6_src[3] = f->src.addr_data32[3]; p->ip6h->s_ip6_dst[0] = f->dst.addr_data32[0]; p->ip6h->s_ip6_dst[1] = f->dst.addr_data32[1]; p->ip6h->s_ip6_dst[2] = f->dst.addr_data32[2]; p->ip6h->s_ip6_dst[3] = f->dst.addr_data32[3]; } else { p->ip6h->s_ip6_src[0] = f->dst.addr_data32[0]; p->ip6h->s_ip6_src[1] = f->dst.addr_data32[1]; p->ip6h->s_ip6_src[2] = f->dst.addr_data32[2]; p->ip6h->s_ip6_src[3] = f->dst.addr_data32[3]; p->ip6h->s_ip6_dst[0] = f->src.addr_data32[0]; p->ip6h->s_ip6_dst[1] = f->src.addr_data32[1]; p->ip6h->s_ip6_dst[2] = f->src.addr_data32[2]; p->ip6h->s_ip6_dst[3] = f->src.addr_data32[3]; } /* set the tcp header */ p->tcph = (TCPHdr *)((uint8_t *)GET_PKT_DATA(p) + 40); SET_PKT_LEN(p, 60); /* ipv6 hdr + tcp hdr */ } p->tcph->th_offx2 = 0x50; p->tcph->th_flags |= TH_ACK; p->tcph->th_win = 10; p->tcph->th_urp = 0; /* to server */ if (direction == 0) { p->tcph->th_sport = htons(f->sp); p->tcph->th_dport = htons(f->dp); if (dummy) { p->tcph->th_seq = htonl(ssn->client.next_seq); p->tcph->th_ack = htonl(ssn->server.last_ack); } else { p->tcph->th_seq = htonl(ssn->client.next_seq); p->tcph->th_ack = htonl(ssn->server.seg_list_tail->seq + ssn->server.seg_list_tail->payload_len); } /* to client */ } else { p->tcph->th_sport = htons(f->dp); p->tcph->th_dport = htons(f->sp); if (dummy) { p->tcph->th_seq = htonl(ssn->server.next_seq); p->tcph->th_ack = htonl(ssn->client.last_ack); } else { p->tcph->th_seq = htonl(ssn->server.next_seq); p->tcph->th_ack = htonl(ssn->client.seg_list_tail->seq + ssn->client.seg_list_tail->payload_len); } } if (FLOW_IS_IPV4(f)) { p->tcph->th_sum = TCPCalculateChecksum(p->ip4h->s_ip_addrs, (uint16_t *)p->tcph, 20); /* calc ipv4 csum as we may log it and barnyard might reject * a wrong checksum */ p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h, IPV4_GET_RAW_HLEN(p->ip4h)); } else if (FLOW_IS_IPV6(f)) { p->tcph->th_sum = TCPCalculateChecksum(p->ip6h->s_ip6_addrs, (uint16_t *)p->tcph, 20); } memset(&p->ts, 0, sizeof(struct timeval)); TimeGet(&p->ts); AppLayerParserSetEOF(f->alparser); return p; error: FlowDeReference(&p->flow); return NULL; } static inline Packet *FlowForceReassemblyPseudoPacketGet(int direction, Flow *f, TcpSession *ssn, int dummy) { PacketPoolWait(); Packet *p = PacketPoolGetPacket(); if (p == NULL) { return NULL; } PACKET_PROFILING_START(p); return FlowForceReassemblyPseudoPacketSetup(p, direction, f, ssn, dummy); } /** * \brief Check if a flow needs forced reassembly, or any other processing * * \param f *LOCKED* flow * \param server ptr to int that should be set to 1 or 2 if we return 1 * \param client ptr to int that should be set to 1 or 2 if we return 1 * * \retval 0 no * \retval 1 yes */ int FlowForceReassemblyNeedReassembly(Flow *f, int *server, int *client) { TcpSession *ssn; if (f == NULL) { *server = *client = STREAM_HAS_UNPROCESSED_SEGMENTS_NONE; SCReturnInt(0); } /* Get the tcp session for the flow */ ssn = (TcpSession *)f->protoctx; if (ssn == NULL) { *server = *client = STREAM_HAS_UNPROCESSED_SEGMENTS_NONE; SCReturnInt(0); } *client = StreamNeedsReassembly(ssn, 0); *server = StreamNeedsReassembly(ssn, 1); /* if state is not fully closed we assume that we haven't fully * inspected the app layer state yet */ if (ssn->state >= TCP_ESTABLISHED && ssn->state != TCP_CLOSED) { if (*client != STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) *client = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; if (*server != STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) *server = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; } /* if app layer still needs some love, push through */ if (f->alproto != ALPROTO_UNKNOWN && f->alstate != NULL && AppLayerParserProtocolSupportsTxs(f->proto, f->alproto)) { uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate); if (AppLayerParserGetTransactionActive(f->proto, f->alproto, f->alparser, STREAM_TOCLIENT) < total_txs) { if (*server != STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) *server = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; } if (AppLayerParserGetTransactionActive(f->proto, f->alproto, f->alparser, STREAM_TOSERVER) < total_txs) { if (*client != STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) *client = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; } } /* nothing to do */ if (*client == STREAM_HAS_UNPROCESSED_SEGMENTS_NONE && *server == STREAM_HAS_UNPROCESSED_SEGMENTS_NONE) { SCReturnInt(0); } SCReturnInt(1); } /** * \internal * \brief Forces reassembly for flow if it needs it. * * The function requires flow to be locked beforehand. * * \param f Pointer to the flow. * \param server action required for server: 1 or 2 * \param client action required for client: 1 or 2 * * \retval 0 This flow doesn't need any reassembly processing; 1 otherwise. */ int FlowForceReassemblyForFlow(Flow *f, int server, int client) { Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; TcpSession *ssn; /* looks like we have no flows in this queue */ if (f == NULL) { return 0; } /* Get the tcp session for the flow */ ssn = (TcpSession *)f->protoctx; if (ssn == NULL) { return 0; } /* The packets we use are based on what segments in what direction are * unprocessed. * p1 if we have client segments for reassembly purpose only. If we * have no server segments p2 can be a toserver packet with dummy * seq/ack, and if we have server segments p2 has to carry out reassembly * for server segment as well, in which case we will also need a p3 in the * toclient which is now dummy since all we need it for is detection */ /* insert a pseudo packet in the toserver direction */ if (client == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) { p1 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 0); if (p1 == NULL) { goto done; } PKT_SET_SRC(p1, PKT_SRC_FFR); if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) { p2 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 0); if (p2 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); goto done; } PKT_SET_SRC(p2, PKT_SRC_FFR); p3 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1); if (p3 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); FlowDeReference(&p2->flow); TmqhOutputPacketpool(NULL, p2); goto done; } PKT_SET_SRC(p3, PKT_SRC_FFR); } else { p2 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 1); if (p2 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); goto done; } PKT_SET_SRC(p2, PKT_SRC_FFR); } } else if (client == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION) { if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) { p1 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 0); if (p1 == NULL) { goto done; } PKT_SET_SRC(p1, PKT_SRC_FFR); p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1); if (p2 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); goto done; } PKT_SET_SRC(p2, PKT_SRC_FFR); } else { p1 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 1); if (p1 == NULL) { goto done; } PKT_SET_SRC(p1, PKT_SRC_FFR); if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION) { p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1); if (p2 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); goto done; } PKT_SET_SRC(p2, PKT_SRC_FFR); } } } else { if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_REASSEMBLY) { p1 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 0); if (p1 == NULL) { goto done; } PKT_SET_SRC(p1, PKT_SRC_FFR); p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1); if (p2 == NULL) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); goto done; } PKT_SET_SRC(p2, PKT_SRC_FFR); } else if (server == STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION) { p1 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1); if (p1 == NULL) { goto done; } PKT_SET_SRC(p1, PKT_SRC_FFR); } else { /* impossible */ BUG_ON(1); } } /* inject the packet(s) into the appropriate thread */ int thread_id = (int)f->thread_id; Packet *packets[4] = { p1, p2 ? p2 : p3, p2 ? p3 : NULL, NULL }; /**< null terminated array of packets */ if (unlikely(!(TmThreadsInjectPacketsById(packets, thread_id)))) { FlowDeReference(&p1->flow); TmqhOutputPacketpool(NULL, p1); if (p2) { FlowDeReference(&p2->flow); TmqhOutputPacketpool(NULL, p2); } if (p3) { FlowDeReference(&p3->flow); TmqhOutputPacketpool(NULL, p3); } } /* done, in case of error (no packet) we still tag flow as complete * as we're probably resource stress if we couldn't get packets */ done: f->flags |= FLOW_TIMEOUT_REASSEMBLY_DONE; return 1; } /** * \internal * \brief Forces reassembly for flows that need it. * * When this function is called we're running in virtually dead engine, * so locking the flows is not strictly required. The reasons it is still * done are: * - code consistency * - silence complaining profilers * - allow us to aggressively check using debug valdation assertions * - be robust in case of future changes * - locking overhead if neglectable when no other thread fights us * * \param q The queue to process flows from. */ static inline void FlowForceReassemblyForHash(void) { Flow *f; TcpSession *ssn; int client_ok = 0; int server_ok = 0; uint32_t idx = 0; for (idx = 0; idx < flow_config.hash_size; idx++) { FlowBucket *fb = &flow_hash[idx]; PacketPoolWaitForN(9); FBLOCK_LOCK(fb); /* get the topmost flow from the QUEUE */ f = fb->head; /* we need to loop through all the flows in the queue */ while (f != NULL) { PacketPoolWaitForN(3); FLOWLOCK_WRLOCK(f); /* Get the tcp session for the flow */ ssn = (TcpSession *)f->protoctx; /* \todo Also skip flows that shouldn't be inspected */ if (ssn == NULL) { FLOWLOCK_UNLOCK(f); f = f->hnext; continue; } if (FlowForceReassemblyNeedReassembly(f, &server_ok, &client_ok) == 1) { FlowForceReassemblyForFlow(f, server_ok, client_ok); } FLOWLOCK_UNLOCK(f); /* next flow in the queue */ f = f->hnext; } FBLOCK_UNLOCK(fb); } return; } /** * \brief Force reassembly for all the flows that have unprocessed segments. */ void FlowForceReassembly(void) { /* Carry out flow reassembly for unattended flows */ FlowForceReassemblyForHash(); return; } suricata-3.2.1/src/app-layer-dnp3.h0000644000000000000000000002254613051004444013717 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __APP_LAYER_DNP3_H__ #define __APP_LAYER_DNP3_H__ #include "detect-engine-state.h" #include "util-hashlist.h" #include "util-byte.h" /** * The maximum size of a DNP3 link PDU. */ #define DNP3_MAX_LINK_PDU_LEN 292 /* DNP3 application request function codes. */ #define DNP3_APP_FC_CONFIRM 0x00 #define DNP3_APP_FC_READ 0x01 #define DNP3_APP_FC_WRITE 0x02 #define DNP3_APP_FC_SELECT 0x03 #define DNP3_APP_FC_OPERATE 0x04 #define DNP3_APP_FC_DIR_OPERATE 0x05 #define DNP3_APP_FC_DIR_OPERATE_NR 0x06 #define DNP3_APP_FC_FREEZE 0x07 #define DNP3_APP_FC_FREEZE_NR 0x08 #define DNP3_APP_FC_FREEZE_CLEAR 0x09 #define DNP3_APP_FC_FREEZE_CLEAR_NR 0x0a #define DNP3_APP_FC_FREEZE_AT_TIME 0x0b #define DNP3_APP_FC_FREEZE_AT_TIME_NR 0x0c #define DNP3_APP_FC_COLD_RESTART 0x0d #define DNP3_APP_FC_WARM_RESTART 0x0e #define DNP3_APP_FC_INITIALIZE_DATA 0x0f #define DNP3_APP_FC_INITIALIZE_APPLICATION 0x10 #define DNP3_APP_FC_START_APPLICATION 0x11 #define DNP3_APP_FC_STOP_APPLICATION 0x12 #define DNP3_APP_FC_SAVE_CONFIGURATION 0x13 #define DNP3_APP_FC_ENABLE_UNSOLICITED 0x14 #define DNP3_APP_FC_DISABLE_UNSOLICTED 0x15 #define DNP3_APP_FC_ASSIGN_CLASS 0x16 #define DNP3_APP_FC_DELAY_MEASUREMENT 0x17 #define DNP3_APP_FC_RECORD_CURRENT_TIME 0x18 #define DNP3_APP_FC_OPEN_TIME 0x19 #define DNP3_APP_FC_CLOSE_FILE 0x1a #define DNP3_APP_FC_DELETE_FILE 0x1b #define DNP3_APP_FC_GET_FILE_INFO 0x1c #define DNP3_APP_FC_AUTHENTICATE_FILE 0x1d #define DNP3_APP_FC_ABORT_FILE 0x1e #define DNP3_APP_FC_ACTIVATE_CONFIG 0x1f #define DNP3_APP_FC_AUTH_REQ 0x20 #define DNP3_APP_FC_AUTH_REQ_NR 0x21 /* DNP3 application response function codes. */ #define DNP3_APP_FC_RESPONSE 0x81 #define DNP3_APP_FC_UNSOLICITED_RESP 0x82 #define DNP3_APP_FC_AUTH_RESP 0x83 /* Extract fields from the link control octet. */ #define DNP3_LINK_DIR(control) (control & 0x80) #define DNP3_LINK_PRI(control) (control & 0x40) #define DNP3_LINK_FCB(control) (control & 0x20) #define DNP3_LINK_FCV(control) (control & 0x10) #define DNP3_LINK_FC(control) (control & 0x0f) /* Extract fields from transport layer header octet. */ #define DNP3_TH_FIN(x) (x & 0x80) #define DNP3_TH_FIR(x) (x & 0x40) #define DNP3_TH_SEQ(x) (x & 0x3f) /* Extract fields from the application control octet. */ #define DNP3_APP_FIR(x) (x & 0x80) #define DNP3_APP_FIN(x) (x & 0x40) #define DNP3_APP_CON(x) (x & 0x20) #define DNP3_APP_UNS(x) (x & 0x10) #define DNP3_APP_SEQ(x) (x & 0x0f) /* DNP3 values are stored in little endian on the wire, so swapping will be * needed on big endian architectures. */ #if __BYTE_ORDER == __BIG_ENDIAN #define DNP3_SWAP16(x) SCByteSwap16(x) #define DNP3_SWAP32(x) SCByteSwap32(x) #define DNP3_SWAP64(x) SCByteSwap64(x) #elif __BYTE_ORDER == __LITTLE_ENDIAN #define DNP3_SWAP16(x) x #define DNP3_SWAP32(x) x #define DNP3_SWAP64(x) x #endif /* DNP3 decoder events. */ enum { DNP3_DECODER_EVENT_FLOODED = 1, DNP3_DECODER_EVENT_LEN_TOO_SMALL, DNP3_DECODER_EVENT_BAD_LINK_CRC, DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC, DNP3_DECODER_EVENT_MALFORMED, DNP3_DECODER_EVENT_UNKNOWN_OBJECT, }; /** * \brief DNP3 link header. */ typedef struct DNP3LinkHeader_ { uint8_t start_byte0; /**< First check byte. */ uint8_t start_byte1; /**< Second check byte. */ uint8_t len; /**< Length of PDU without CRCs. */ uint8_t control; /**< Control flags. */ uint16_t dst; /**< DNP3 destination address. */ uint16_t src; /**< DNP3 source address. */ uint16_t crc; /**< Link header CRC. */ } __attribute__((__packed__)) DNP3LinkHeader; /** * \brief DNP3 transport header. */ typedef uint8_t DNP3TransportHeader; /** * \brief DNP3 application header. */ typedef struct DNP3ApplicationHeader_ { uint8_t control; /**< Control flags. */ uint8_t function_code; /**< Application function code. */ } __attribute__((__packed__)) DNP3ApplicationHeader; /** * \brief DNP3 internal indicators. * * Part of the application header for responses only. */ typedef struct DNP3InternalInd_ { uint8_t iin1; uint8_t iin2; } __attribute__((__packed__)) DNP3InternalInd; /** * \brief A struct used for buffering incoming data prior to reassembly. */ typedef struct DNP3Buffer_ { uint8_t *buffer; size_t size; int len; int offset; } DNP3Buffer; /** * \brief DNP3 application object header. */ typedef struct DNP3ObjHeader_ { uint8_t group; uint8_t variation; uint8_t qualifier; } __attribute__((packed)) DNP3ObjHeader; /** * \brief DNP3 object point. * * Each DNP3 object can have 0 or more points representing the values * of the object. */ typedef struct DNP3Point_ { uint32_t prefix; /**< Prefix value for point. */ uint32_t index; /**< Index of point. If the object is prefixed * with an index then this will be that * value. Otherwise this is the place the point * was in the list of points (starting at 0). */ uint32_t size; /**< Size of point if the object prefix was a * size. */ void *data; /**< Data for this point. */ TAILQ_ENTRY(DNP3Point_) next; } DNP3Point; typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList; /** * \brief Struct to hold the list of decoded objects. */ typedef struct DNP3Object_ { uint8_t group; uint8_t variation; uint8_t qualifier; uint8_t prefix_code; uint8_t range_code; uint32_t start; uint32_t stop; uint32_t count; DNP3PointList *points; /**< List of points for this object. */ TAILQ_ENTRY(DNP3Object_) next; } DNP3Object; typedef TAILQ_HEAD(DNP3ObjectList_, DNP3Object_) DNP3ObjectList; /** * \brief DNP3 transaction. */ typedef struct DNP3Transaction_ { uint64_t tx_num; /**< Internal transaction ID. */ uint32_t logged; /**< Flags indicating which loggers have logged this tx. */ struct DNP3State_ *dnp3; uint8_t has_request; uint8_t request_done; DNP3LinkHeader request_lh; DNP3TransportHeader request_th; DNP3ApplicationHeader request_ah; uint8_t *request_buffer; /**< Reassembled request * buffer. */ uint32_t request_buffer_len; uint8_t request_complete; /**< Was the decode * complete. It will not be * complete if we hit objects * we do not know. */ DNP3ObjectList request_objects; uint8_t has_response; uint8_t response_done; DNP3LinkHeader response_lh; DNP3TransportHeader response_th; DNP3ApplicationHeader response_ah; DNP3InternalInd response_iin; uint8_t *response_buffer; /**< Reassembed response * buffer. */ uint32_t response_buffer_len; uint8_t response_complete; /**< Was the decode * complete. It will not be * complete if we hit objects * we do not know. */ DNP3ObjectList response_objects; AppLayerDecoderEvents *decoder_events; /**< Per transcation * decoder events. */ DetectEngineState *de_state; TAILQ_ENTRY(DNP3Transaction_) next; } DNP3Transaction; TAILQ_HEAD(TxListHead, DNP3Transaction_); /** * \brief Per flow DNP3 state. */ typedef struct DNP3State_ { TAILQ_HEAD(, DNP3Transaction_) tx_list; DNP3Transaction *curr; /**< Current transaction. */ uint64_t transaction_max; uint16_t events; uint32_t unreplied; /**< Number of unreplied requests. */ uint8_t flooded; /**< Flag indicating flood. */ DNP3Buffer request_buffer; /**< Request buffer for buffering * incomplete request PDUs received * over TCP. */ DNP3Buffer response_buffer; /**< Response buffer for buffering * incomplete response PDUs received * over TCP. */ } DNP3State; void RegisterDNP3Parsers(void); void DNP3ParserRegisterTests(void); int DNP3PrefixIsSize(uint8_t); #endif /* __APP_LAYER_DNP3_H__ */ suricata-3.2.1/src/detect-flow.c0000644000000000000000000010314713051004444013370 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * FLOW part of the detection engine. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-prefilter-common.h" #include "flow.h" #include "flow-var.h" #include "detect-flow.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /** * \brief Regex for parsing our flow options */ #define PARSE_REGEX "^\\s*([A-z_]+)\\s*(?:,\\s*([A-z_]+))?\\s*(?:,\\s*([A-z_]+))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectFlowMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFlowSetup (DetectEngineCtx *, Signature *, char *); void DetectFlowRegisterTests(void); void DetectFlowFree(void *); static int PrefilterSetupFlow(SigGroupHead *sgh); static _Bool PrefilterFlowIsPrefilterable(const Signature *s); /** * \brief Registration function for flow: keyword */ void DetectFlowRegister (void) { sigmatch_table[DETECT_FLOW].name = "flow"; sigmatch_table[DETECT_FLOW].desc = "match on direction and state of the flow"; sigmatch_table[DETECT_FLOW].url = DOC_URL DOC_VERSION "/rules/flow-keywords.html#flow"; sigmatch_table[DETECT_FLOW].Match = DetectFlowMatch; sigmatch_table[DETECT_FLOW].Setup = DetectFlowSetup; sigmatch_table[DETECT_FLOW].Free = DetectFlowFree; sigmatch_table[DETECT_FLOW].RegisterTests = DetectFlowRegisterTests; sigmatch_table[DETECT_FLOW].SupportsPrefilter = PrefilterFlowIsPrefilterable; sigmatch_table[DETECT_FLOW].SetupPrefilter = PrefilterSetupFlow; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \param pflags packet flags (p->flags) * \param pflowflags packet flow flags (p->flowflags) * \param tflags detection flags (det_ctx->flags) * \param dflags detect flow flags * \param match_cnt number of matches to trigger */ static inline int FlowMatch(const uint32_t pflags, const uint8_t pflowflags, const uint16_t tflags, const uint16_t dflags, const uint8_t match_cnt) { uint8_t cnt = 0; if ((dflags & DETECT_FLOW_FLAG_NO_FRAG) && (!(pflags & PKT_REBUILT_FRAGMENT))) { cnt++; } else if ((dflags & DETECT_FLOW_FLAG_ONLY_FRAG) && (pflags & PKT_REBUILT_FRAGMENT)) { cnt++; } if ((dflags & DETECT_FLOW_FLAG_TOSERVER) && (pflowflags & FLOW_PKT_TOSERVER)) { cnt++; } else if ((dflags & DETECT_FLOW_FLAG_TOCLIENT) && (pflowflags & FLOW_PKT_TOCLIENT)) { cnt++; } if ((dflags & DETECT_FLOW_FLAG_ESTABLISHED) && (pflowflags & FLOW_PKT_ESTABLISHED)) { cnt++; } else if (dflags & DETECT_FLOW_FLAG_NOT_ESTABLISHED && (!(pflowflags & FLOW_PKT_ESTABLISHED))) { cnt++; } else if (dflags & DETECT_FLOW_FLAG_STATELESS) { cnt++; } if (tflags & DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH) { if (dflags & DETECT_FLOW_FLAG_ONLYSTREAM) cnt++; } else { if (dflags & DETECT_FLOW_FLAG_NOSTREAM) cnt++; } return (match_cnt == cnt) ? 1 : 0; } /** * \brief This function is used to match flow flags set on a packet with those passed via flow: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectFlowData * * \retval 0 no match * \retval 1 match */ int DetectFlowMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { SCEnter(); SCLogDebug("pkt %p", p); if (p->flowflags & FLOW_PKT_TOSERVER) { SCLogDebug("FLOW_PKT_TOSERVER"); } else if (p->flowflags & FLOW_PKT_TOCLIENT) { SCLogDebug("FLOW_PKT_TOCLIENT"); } if (p->flowflags & FLOW_PKT_ESTABLISHED) { SCLogDebug("FLOW_PKT_ESTABLISHED"); } const DetectFlowData *fd = (const DetectFlowData *)ctx; int ret = FlowMatch(p->flags, p->flowflags, det_ctx->flags, fd->flags, fd->match_cnt);; SCLogDebug("returning %" PRId32 " fd->match_cnt %" PRId32 " fd->flags 0x%02X p->flowflags 0x%02X", ret, fd->match_cnt, fd->flags, p->flowflags); SCReturnInt(ret); } /** * \brief This function is used to parse flow options passed via flow: keyword * * \param flowstr Pointer to the user provided flow options * * \retval fd pointer to DetectFlowData on success * \retval NULL on failure */ DetectFlowData *DetectFlowParse (char *flowstr) { DetectFlowData *fd = NULL; char *args[3] = {NULL,NULL,NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char str1[16] = "", str2[16] = "", str3[16] = ""; ret = pcre_exec(parse_regex, parse_regex_study, flowstr, strlen(flowstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 ", string %s", ret, flowstr); goto error; } if (ret > 1) { res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 1, str1, sizeof(str1)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } args[0] = (char *)str1; if (ret > 2) { res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 2, str2, sizeof(str2)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } args[1] = (char *)str2; } if (ret > 3) { res = pcre_copy_substring((char *)flowstr, ov, MAX_SUBSTRINGS, 3, str3, sizeof(str3)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); goto error; } args[2] = (char *)str3; } } fd = SCMalloc(sizeof(DetectFlowData)); if (unlikely(fd == NULL)) goto error; fd->flags = 0; fd->match_cnt = 0; int i; for (i = 0; i < (ret - 1); i++) { if (args[i]) { /* inspect our options and set the flags */ if (strcasecmp(args[i], "established") == 0) { if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) { SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_ESTABLISHED flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_STATELESS) { SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_STATELESS already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_ESTABLISHED; } else if (strcasecmp(args[i], "not_established") == 0) { if (fd->flags & DETECT_FLOW_FLAG_NOT_ESTABLISHED) { SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_NOT_ESTABLISHED flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_NOT_ESTABLISHED) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_NOT_ESTABLISHED, DETECT_FLOW_FLAG_ESTABLISHED already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_NOT_ESTABLISHED; } else if (strcasecmp(args[i], "stateless") == 0) { if (fd->flags & DETECT_FLOW_FLAG_STATELESS) { SCLogError(SC_ERR_FLAGS_MODIFIER, "DETECT_FLOW_FLAG_STATELESS flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_ESTABLISHED) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_STATELESS, DETECT_FLOW_FLAG_ESTABLISHED already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_STATELESS; } else if (strcasecmp(args[i], "to_client") == 0 || strcasecmp(args[i], "from_server") == 0) { if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_TOCLIENT flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set to_client, DETECT_FLOW_FLAG_TOSERVER already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_TOCLIENT; } else if (strcasecmp(args[i], "to_server") == 0 || strcasecmp(args[i], "from_client") == 0){ if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set DETECT_FLOW_FLAG_TOSERVER flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set to_server, DETECT_FLOW_FLAG_TO_CLIENT flag already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_TOSERVER; } else if (strcasecmp(args[i], "only_stream") == 0) { if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_stream flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_stream flag, DETECT_FLOW_FLAG_NOSTREAM already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_ONLYSTREAM; } else if (strcasecmp(args[i], "no_stream") == 0) { if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_stream flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_stream flag, DETECT_FLOW_FLAG_ONLYSTREAM already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_NOSTREAM; } else if (strcasecmp(args[i], "no_frag") == 0) { if (fd->flags & DETECT_FLOW_FLAG_NO_FRAG) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_frag flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set no_frag flag, only_frag already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_NO_FRAG; } else if (strcasecmp(args[i], "only_frag") == 0) { if (fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_frag flag is already set"); goto error; } else if (fd->flags & DETECT_FLOW_FLAG_NO_FRAG) { SCLogError(SC_ERR_FLAGS_MODIFIER, "cannot set only_frag flag, no_frag already set"); goto error; } fd->flags |= DETECT_FLOW_FLAG_ONLY_FRAG; } else { SCLogError(SC_ERR_INVALID_VALUE, "invalid flow option \"%s\"", args[i]); goto error; } fd->match_cnt++; //printf("args[%" PRId32 "]: %s match_cnt: %" PRId32 " flags: 0x%02X\n", i, args[i], fd->match_cnt, fd->flags); } } return fd; error: if (fd != NULL) DetectFlowFree(fd); return NULL; } /** * \brief this function is used to add the parsed flowdata into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param flowstr pointer to the user provided flow options * * \retval 0 on Success * \retval -1 on Failure */ int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, char *flowstr) { DetectFlowData *fd = NULL; SigMatch *sm = NULL; fd = DetectFlowParse(flowstr); if (fd == NULL) goto error; /*ensure only one flow option*/ if (s->init_flags & SIG_FLAG_INIT_FLOW) { SCLogError (SC_ERR_INVALID_SIGNATURE, "A signature may have only one flow option."); goto error; } /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLOW; sm->ctx = (SigMatchCtx *)fd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); /* set the signature direction flags */ if (fd->flags & DETECT_FLOW_FLAG_TOSERVER) { s->flags |= SIG_FLAG_TOSERVER; } else if (fd->flags & DETECT_FLOW_FLAG_TOCLIENT) { s->flags |= SIG_FLAG_TOCLIENT; } else { s->flags |= SIG_FLAG_TOSERVER; s->flags |= SIG_FLAG_TOCLIENT; } if (fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM) { s->flags |= SIG_FLAG_REQUIRE_STREAM; } if (fd->flags & DETECT_FLOW_FLAG_NOSTREAM) { s->flags |= SIG_FLAG_REQUIRE_PACKET; } else { s->init_flags |= SIG_FLAG_INIT_FLOW; } return 0; error: if (fd != NULL) DetectFlowFree(fd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFlowData * * \param fd pointer to DetectFlowData */ void DetectFlowFree(void *ptr) { DetectFlowData *fd = (DetectFlowData *)ptr; SCFree(fd); } static void PrefilterPacketFlowMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) return; if (FlowMatch(p->flags, p->flowflags, det_ctx->flags, ctx->v1.u8[0], ctx->v1.u8[1])) { PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketFlowSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectFlowData *fb = smctx; v->u8[0] = fb->flags; v->u8[1] = fb->match_cnt; } static _Bool PrefilterPacketFlowCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectFlowData *fb = smctx; if (v.u8[0] == fb->flags && v.u8[1] == fb->match_cnt) { return TRUE; } return FALSE; } static int PrefilterSetupFlow(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_FLOW, PrefilterPacketFlowSet, PrefilterPacketFlowCompare, PrefilterPacketFlowMatch); } static _Bool PrefilterFlowIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FLOW: return TRUE; } } return FALSE; } #ifdef UNITTESTS /** * \test DetectFlowTestParse01 is a test to make sure that we return "something" * when given valid flow opt */ int DetectFlowTestParse01 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("established"); FAIL_IF_NULL(fd); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse02 is a test for setting the established flow opt */ int DetectFlowTestParse02 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("established"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1); PASS; } /** * \test DetectFlowTestParse03 is a test for setting the stateless flow opt */ int DetectFlowTestParse03 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("stateless"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse04 is a test for setting the to_client flow opt */ int DetectFlowTestParse04 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("to_client"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse05 is a test for setting the to_server flow opt */ int DetectFlowTestParse05 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("to_server"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse06 is a test for setting the from_server flow opt */ int DetectFlowTestParse06 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse07 is a test for setting the from_client flow opt */ int DetectFlowTestParse07 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_client"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse08 is a test for setting the established,to_client flow opts */ int DetectFlowTestParse08 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("established,to_client"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed) */ int DetectFlowTestParse09 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("to_client,stateless"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed) */ int DetectFlowTestParse10 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server,stateless"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse11 is a test for setting the from_server,stateless flow opts with spaces all around */ int DetectFlowTestParse11 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse(" from_server , stateless "); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase01 is a test to make sure that we return "something" * when given valid flow opt */ int DetectFlowTestParseNocase01 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("ESTABLISHED"); FAIL_IF_NULL(fd); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase02 is a test for setting the established flow opt */ int DetectFlowTestParseNocase02 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("ESTABLISHED"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_ESTABLISHED && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase03 is a test for setting the stateless flow opt */ int DetectFlowTestParseNocase03 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("STATELESS"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_STATELESS && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase04 is a test for setting the to_client flow opt */ int DetectFlowTestParseNocase04 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("TO_CLIENT"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase05 is a test for setting the to_server flow opt */ int DetectFlowTestParseNocase05 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("TO_SERVER"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase06 is a test for setting the from_server flow opt */ int DetectFlowTestParseNocase06 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("FROM_SERVER"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase07 is a test for setting the from_client flow opt */ int DetectFlowTestParseNocase07 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("FROM_CLIENT"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags == DETECT_FLOW_FLAG_TOSERVER && fd->match_cnt == 1); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase08 is a test for setting the established,to_client flow opts */ int DetectFlowTestParseNocase08 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("ESTABLISHED,TO_CLIENT"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase09 is a test for setting the to_client,stateless flow opts (order of state,dir reversed) */ int DetectFlowTestParseNocase09 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("TO_CLIENT,STATELESS"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase10 is a test for setting the from_server,stateless flow opts (order of state,dir reversed) */ int DetectFlowTestParseNocase10 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("FROM_SERVER,STATELESS"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase11 is a test for setting the from_server,stateless flow opts with spaces all around */ int DetectFlowTestParseNocase11 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse(" FROM_SERVER , STATELESS "); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_STATELESS && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->match_cnt == 2); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse12 is a test for setting an invalid seperator : */ int DetectFlowTestParse12 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server:stateless"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse13 is a test for an invalid option */ int DetectFlowTestParse13 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("invalidoptiontest"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse14 is a test for a empty option */ int DetectFlowTestParse14 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse(""); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse15 is a test for an invalid combo of options established,stateless */ int DetectFlowTestParse15 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("established,stateless"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,to_server */ int DetectFlowTestParse16 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("to_client,to_server"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse16 is a test for an invalid combo of options to_client,from_server * flowbit flags are the same */ int DetectFlowTestParse17 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("to_client,from_server"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed) */ int DetectFlowTestParse18 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server,established,only_stream"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParseNocase18 is a test for setting the from_server,stateless,only_stream flow opts (order of state,dir reversed) */ int DetectFlowTestParseNocase18 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,ONLY_STREAM"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_ONLYSTREAM && fd->match_cnt == 3); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse19 is a test for one to many options passed to DetectFlowParse */ int DetectFlowTestParse19 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server,established,only_stream,a"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream */ int DetectFlowTestParse20 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server,established,no_stream"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse20 is a test for setting from_server, established, no_stream */ int DetectFlowTestParseNocase20 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("FROM_SERVER,ESTABLISHED,NO_STREAM"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ESTABLISHED && fd->flags & DETECT_FLOW_FLAG_TOCLIENT && fd->flags & DETECT_FLOW_FLAG_NOSTREAM && fd->match_cnt == 3); DetectFlowFree(fd); PASS; } /** * \test DetectFlowTestParse21 is a test for an invalid opt between to valid opts */ int DetectFlowTestParse21 (void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("from_server,a,no_stream"); FAIL_IF_NOT_NULL(fd); PASS; } static int DetectFlowSigTest01(void) { ThreadVars th_v; DecodeThreadVars dtv; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; uint8_t *buf = (uint8_t *)"supernovaduper"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); FAIL_IF_NULL(p); char *sig1 = "alert tcp any any -> any any (msg:\"dummy\"; " "content:\"nova\"; flow:no_stream; sid:1;)"; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig1); FAIL_IF_NULL(de_ctx->sig_list); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1) != 1); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } if (p != NULL) UTHFreePacket(p); PASS; } /** * \test Test parsing of the not_established keyword. */ static int DetectFlowTestParseNotEstablished(void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("not_established"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_NOT_ESTABLISHED); DetectFlowFree(fd); PASS; } /** * \test Test parsing of the "no_frag" flow argument. */ static int DetectFlowTestParseNoFrag(void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("no_frag"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_NO_FRAG); DetectFlowFree(fd); PASS; } /** * \test Test parsing of the "only_frag" flow argument. */ static int DetectFlowTestParseOnlyFrag(void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("only_frag"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG); DetectFlowFree(fd); PASS; } /** * \test Test that parsing of only_frag and no_frag together fails. */ static int DetectFlowTestParseNoFragOnlyFrag(void) { DetectFlowData *fd = NULL; fd = DetectFlowParse("no_frag,only_frag"); FAIL_IF_NOT_NULL(fd); PASS; } /** * \test Test no_frag matching. */ static int DetectFlowTestNoFragMatch(void) { uint32_t pflags = 0; DetectFlowData *fd = DetectFlowParse("no_frag"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_NO_FRAG); FAIL_IF_NOT(fd->match_cnt == 1); FAIL_IF_NOT(FlowMatch(pflags, 0, 0, fd->flags, fd->match_cnt)); pflags |= PKT_REBUILT_FRAGMENT; FAIL_IF(FlowMatch(pflags, 0, 0, fd->flags, fd->match_cnt)); PASS; } /** * \test Test only_frag matching. */ static int DetectFlowTestOnlyFragMatch(void) { uint32_t pflags = 0; DetectFlowData *fd = DetectFlowParse("only_frag"); FAIL_IF_NULL(fd); FAIL_IF_NOT(fd->flags & DETECT_FLOW_FLAG_ONLY_FRAG); FAIL_IF_NOT(fd->match_cnt == 1); FAIL_IF(FlowMatch(pflags, 0, 0, fd->flags, fd->match_cnt)); pflags |= PKT_REBUILT_FRAGMENT; FAIL_IF_NOT(FlowMatch(pflags, 0, 0, fd->flags, fd->match_cnt)); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFlow */ void DetectFlowRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFlowTestParse01", DetectFlowTestParse01); UtRegisterTest("DetectFlowTestParse02", DetectFlowTestParse02); UtRegisterTest("DetectFlowTestParse03", DetectFlowTestParse03); UtRegisterTest("DetectFlowTestParse04", DetectFlowTestParse04); UtRegisterTest("DetectFlowTestParse05", DetectFlowTestParse05); UtRegisterTest("DetectFlowTestParse06", DetectFlowTestParse06); UtRegisterTest("DetectFlowTestParse07", DetectFlowTestParse07); UtRegisterTest("DetectFlowTestParse08", DetectFlowTestParse08); UtRegisterTest("DetectFlowTestParse09", DetectFlowTestParse09); UtRegisterTest("DetectFlowTestParse10", DetectFlowTestParse10); UtRegisterTest("DetectFlowTestParse11", DetectFlowTestParse11); UtRegisterTest("DetectFlowTestParseNocase01", DetectFlowTestParseNocase01); UtRegisterTest("DetectFlowTestParseNocase02", DetectFlowTestParseNocase02); UtRegisterTest("DetectFlowTestParseNocase03", DetectFlowTestParseNocase03); UtRegisterTest("DetectFlowTestParseNocase04", DetectFlowTestParseNocase04); UtRegisterTest("DetectFlowTestParseNocase05", DetectFlowTestParseNocase05); UtRegisterTest("DetectFlowTestParseNocase06", DetectFlowTestParseNocase06); UtRegisterTest("DetectFlowTestParseNocase07", DetectFlowTestParseNocase07); UtRegisterTest("DetectFlowTestParseNocase08", DetectFlowTestParseNocase08); UtRegisterTest("DetectFlowTestParseNocase09", DetectFlowTestParseNocase09); UtRegisterTest("DetectFlowTestParseNocase10", DetectFlowTestParseNocase10); UtRegisterTest("DetectFlowTestParseNocase11", DetectFlowTestParseNocase11); UtRegisterTest("DetectFlowTestParse12", DetectFlowTestParse12); UtRegisterTest("DetectFlowTestParse13", DetectFlowTestParse13); UtRegisterTest("DetectFlowTestParse14", DetectFlowTestParse14); UtRegisterTest("DetectFlowTestParse15", DetectFlowTestParse15); UtRegisterTest("DetectFlowTestParse16", DetectFlowTestParse16); UtRegisterTest("DetectFlowTestParse17", DetectFlowTestParse17); UtRegisterTest("DetectFlowTestParse18", DetectFlowTestParse18); UtRegisterTest("DetectFlowTestParseNocase18", DetectFlowTestParseNocase18); UtRegisterTest("DetectFlowTestParse19", DetectFlowTestParse19); UtRegisterTest("DetectFlowTestParse20", DetectFlowTestParse20); UtRegisterTest("DetectFlowTestParseNocase20", DetectFlowTestParseNocase20); UtRegisterTest("DetectFlowTestParse21", DetectFlowTestParse21); UtRegisterTest("DetectFlowTestParseNotEstablished", DetectFlowTestParseNotEstablished); UtRegisterTest("DetectFlowTestParseNoFrag", DetectFlowTestParseNoFrag); UtRegisterTest("DetectFlowTestParseOnlyFrag", DetectFlowTestParseOnlyFrag); UtRegisterTest("DetectFlowTestParseNoFragOnlyFrag", DetectFlowTestParseNoFragOnlyFrag); UtRegisterTest("DetectFlowTestNoFragMatch", DetectFlowTestNoFragMatch); UtRegisterTest("DetectFlowTestOnlyFragMatch", DetectFlowTestOnlyFragMatch); UtRegisterTest("DetectFlowSigTest01", DetectFlowSigTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-payload.h0000644000000000000000000000246513051004444015323 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_PAYLOAD_H__ #define __DETECT_ENGINE_PAYLOAD_H__ int PrefilterPktPayloadRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterPktStreamRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectPacketPayload(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, Packet *); int DetectEngineInspectStreamPayload(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t *, uint32_t); void PayloadRegisterTests(void); #endif /* __DETECT_ENGINE_PAYLOAD_H__ */ suricata-3.2.1/src/source-nfq-prototypes.h0000644000000000000000000000177313051004444015472 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __SOURCE_NFQ_PROTOTYPES_H__ #define __SOURCE_NFQ_PROTOTYPES_H__ void TmModuleReceiveNFQRegister (void); void TmModuleVerdictNFQRegister (void); void TmModuleDecodeNFQRegister (void); #endif /* __SOURCE_NFQ_PROTOTYPES_H__ */ suricata-3.2.1/src/detect-http-response-line.h0000644000000000000000000000167213051004444016166 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_HTTP_RESPONSE_LINE_H__ #define __DETECT_HTTP_RESPONSE_LINE_H__ void DetectHttpResponseLineRegister(void); #endif /* __DETECT_HTTP_RESPONSE_LINE_H__ */ suricata-3.2.1/src/detect-engine-alert.c0000644000000000000000000002656713051004444015005 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "detect.h" #include "detect-engine-alert.h" #include "detect-engine-threshold.h" #include "detect-engine-tag.h" #include "decode.h" #include "flow.h" #include "flow-private.h" #include "util-profiling.h" /** tag signature we use for tag alerts */ static Signature g_tag_signature; /** tag packet alert structure for tag alerts */ static PacketAlert g_tag_pa; void PacketAlertTagInit(void) { memset(&g_tag_signature, 0x00, sizeof(g_tag_signature)); g_tag_signature.id = TAG_SIG_ID; g_tag_signature.gid = TAG_SIG_GEN; g_tag_signature.num = TAG_SIG_ID; g_tag_signature.rev = 1; g_tag_signature.prio = 2; memset(&g_tag_pa, 0x00, sizeof(g_tag_pa)); g_tag_pa.action = ACTION_ALERT; g_tag_pa.s = &g_tag_signature; } PacketAlert *PacketAlertGetTag(void) { return &g_tag_pa; } /** * \brief Handle a packet and check if needs a threshold logic * Also apply rule action if necessary. * * \param de_ctx Detection Context * \param sig Signature pointer * \param p Packet structure * * \retval 1 alert is not suppressed * \retval 0 alert is suppressed */ static int PacketAlertHandle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, PacketAlert *pa) { SCEnter(); int ret = 1; const DetectThresholdData *td = NULL; const SigMatch *sm; if (!(PKT_IS_IPV4(p) || PKT_IS_IPV6(p))) { SCReturnInt(1); } /* handle suppressions first */ if (s->sm_lists[DETECT_SM_LIST_SUPPRESS] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_SUPPRESS); sm = NULL; do { td = SigGetThresholdTypeIter(s, p, &sm, DETECT_SM_LIST_SUPPRESS); if (td != NULL) { SCLogDebug("td %p", td); /* PacketAlertThreshold returns 2 if the alert is suppressed but * we do need to apply rule actions to the packet. */ KEYWORD_PROFILING_START; ret = PacketAlertThreshold(de_ctx, det_ctx, td, p, s, pa); if (ret == 0 || ret == 2) { KEYWORD_PROFILING_END(det_ctx, DETECT_THRESHOLD, 0); /* It doesn't match threshold, remove it */ SCReturnInt(ret); } KEYWORD_PROFILING_END(det_ctx, DETECT_THRESHOLD, 1); } } while (sm != NULL); } /* if we're still here, consider thresholding */ if (s->sm_lists[DETECT_SM_LIST_THRESHOLD] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_THRESHOLD); sm = NULL; do { td = SigGetThresholdTypeIter(s, p, &sm, DETECT_SM_LIST_THRESHOLD); if (td != NULL) { SCLogDebug("td %p", td); /* PacketAlertThreshold returns 2 if the alert is suppressed but * we do need to apply rule actions to the packet. */ KEYWORD_PROFILING_START; ret = PacketAlertThreshold(de_ctx, det_ctx, td, p, s, pa); if (ret == 0 || ret == 2) { KEYWORD_PROFILING_END(det_ctx, DETECT_THRESHOLD ,0); /* It doesn't match threshold, remove it */ SCReturnInt(ret); } KEYWORD_PROFILING_END(det_ctx, DETECT_THRESHOLD, 1); } } while (sm != NULL); } SCReturnInt(1); } /** * \brief Check if a certain sid alerted, this is used in the test functions * * \param p Packet on which we want to check if the signature alerted or not * \param sid Signature id of the signature that thas to be checked for a match * * \retval match A value > 0 on a match; 0 on no match */ int PacketAlertCheck(Packet *p, uint32_t sid) { uint16_t i = 0; int match = 0; for (i = 0; i < p->alerts.cnt; i++) { if (p->alerts.alerts[i].s == NULL) continue; if (p->alerts.alerts[i].s->id == sid) match++; } return match; } /** * \brief Remove alert from the p->alerts.alerts array at pos * \param p Pointer to the Packet * \param pos Position in the array * \retval 0 if the number of alerts is less than pos * 1 if all goes well */ int PacketAlertRemove(Packet *p, uint16_t pos) { uint16_t i = 0; int match = 0; if (pos > p->alerts.cnt) { SCLogDebug("removing %u failed, pos > cnt %u", pos, p->alerts.cnt); return 0; } for (i = pos; i <= p->alerts.cnt - 1; i++) { memcpy(&p->alerts.alerts[i], &p->alerts.alerts[i + 1], sizeof(PacketAlert)); } // Update it, since we removed 1 p->alerts.cnt--; return match; } /** \brief append a signature match to a packet * * \param det_ctx thread detection engine ctx * \param s the signature that matched * \param p packet * \param flags alert flags * \param alert_msg ptr to StreamMsg object that the signature matched on */ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, uint64_t tx_id, uint8_t flags) { int i = 0; if (p->alerts.cnt == PACKET_ALERT_MAX) return 0; SCLogDebug("sid %"PRIu32"", s->id); /* It should be usually the last, so check it before iterating */ if (p->alerts.cnt == 0 || (p->alerts.cnt > 0 && p->alerts.alerts[p->alerts.cnt - 1].num < s->num)) { /* We just add it */ p->alerts.alerts[p->alerts.cnt].num = s->num; p->alerts.alerts[p->alerts.cnt].action = s->action; p->alerts.alerts[p->alerts.cnt].flags = flags; p->alerts.alerts[p->alerts.cnt].s = s; p->alerts.alerts[p->alerts.cnt].tx_id = tx_id; } else { /* We need to make room for this s->num (a bit ugly with memcpy but we are planning changes here)*/ for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].num > s->num; i--) { memcpy(&p->alerts.alerts[i + 1], &p->alerts.alerts[i], sizeof(PacketAlert)); } i++; /* The right place to store the alert */ p->alerts.alerts[i].num = s->num; p->alerts.alerts[i].action = s->action; p->alerts.alerts[i].flags = flags; p->alerts.alerts[i].s = s; p->alerts.alerts[i].tx_id = tx_id; } /* Update the count */ p->alerts.cnt++; return 0; } /** * \brief Check the threshold of the sigs that match, set actions, break on pass action * This function iterate the packet alerts array, removing those that didn't match * the threshold, and those that match after a signature with the action "pass". * The array is sorted by action priority/order * \param de_ctx detection engine context * \param det_ctx detection engine thread context * \param p pointer to the packet */ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { SCEnter(); int i = 0; SigMatch *sm = NULL; while (i < p->alerts.cnt) { SCLogDebug("Sig->num: %"PRIu16, p->alerts.alerts[i].num); const Signature *s = de_ctx->sig_array[p->alerts.alerts[i].num]; int res = PacketAlertHandle(de_ctx, det_ctx, s, p, &p->alerts.alerts[i]); if (res > 0) { /* Now, if we have an alert, we have to check if we want * to tag this session or src/dst host */ KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_TMATCH); sm = s->sm_lists[DETECT_SM_LIST_TMATCH]; while (sm) { /* tags are set only for alerts */ KEYWORD_PROFILING_START; sigmatch_table[sm->type].Match(NULL, det_ctx, p, (Signature *)s, sm->ctx); KEYWORD_PROFILING_END(det_ctx, sm->type, 1); sm = sm->next; } if (s->flags & SIG_FLAG_IPONLY) { if (((p->flowflags & FLOW_PKT_TOSERVER) && !(p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) || ((p->flowflags & FLOW_PKT_TOCLIENT) && !(p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET))) { SCLogDebug("testing against \"ip-only\" signatures"); if (p->flow != NULL) { /* Update flow flags for iponly */ FlowSetIPOnlyFlag(p->flow, (p->flowflags & FLOW_PKT_TOSERVER) ? 1 : 0); if (s->action & ACTION_DROP) p->flow->flags |= FLOW_ACTION_DROP; if (s->action & ACTION_REJECT) p->flow->flags |= FLOW_ACTION_DROP; if (s->action & ACTION_REJECT_DST) p->flow->flags |= FLOW_ACTION_DROP; if (s->action & ACTION_REJECT_BOTH) p->flow->flags |= FLOW_ACTION_DROP; if (s->action & ACTION_PASS) { FlowSetNoPacketInspectionFlag(p->flow); } } } } /* set actions on packet */ DetectSignatureApplyActions(p, p->alerts.alerts[i].s); if (PACKET_TEST_ACTION(p, ACTION_PASS)) { /* Ok, reset the alert cnt to end in the previous of pass * so we ignore the rest with less prio */ p->alerts.cnt = i; /* if an stream/app-layer match we enforce the pass for the flow */ if ((p->flow != NULL) && (p->alerts.alerts[i].flags & (PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_STREAM_MATCH))) { FlowSetNoPacketInspectionFlag(p->flow); } break; /* if the signature wants to drop, check if the * PACKET_ALERT_FLAG_DROP_FLOW flag is set. */ } else if ((PACKET_TEST_ACTION(p, ACTION_DROP)) && ((p->alerts.alerts[i].flags & PACKET_ALERT_FLAG_DROP_FLOW) || (s->flags & SIG_FLAG_APPLAYER)) && p->flow != NULL) { /* This will apply only on IPS mode (check StreamTcpPacket) */ p->flow->flags |= FLOW_ACTION_DROP; // XXX API? } } /* Thresholding removes this alert */ if (res == 0 || res == 2) { PacketAlertRemove(p, i); if (p->alerts.cnt == 0) break; } else { i++; } } /* At this point, we should have all the new alerts. Now check the tag * keyword context for sessions and hosts */ if (!(p->flags & PKT_PSEUDO_STREAM_END)) TagHandlePacket(de_ctx, det_ctx, p); /* Set flag on flow to indicate that it has alerts */ if (p->flow != NULL && p->alerts.cnt > 0) { FlowSetHasAlertsFlag(p->flow); } } suricata-3.2.1/src/runmode-af-packet.c0000644000000000000000000005624713051004444014465 00000000000000/* Copyright (C) 2011,2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup afppacket * * @{ */ /** * \file * * \author Eric Leblond * * AF_PACKET socket runmode * */ #include "suricata-common.h" #include "config.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-af-packet.h" #include "log-httplog.h" #include "output.h" #include "detect-engine-mpm.h" #include "alert-fastlog.h" #include "alert-prelude.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-device.h" #include "util-runmodes.h" #include "util-ioctl.h" #include "source-af-packet.h" extern int max_pending_packets; static const char *default_mode_workers = NULL; const char *RunModeAFPGetDefaultMode(void) { return default_mode_workers; } void RunModeIdsAFPRegister(void) { RunModeRegisterNewRunMode(RUNMODE_AFP_DEV, "single", "Single threaded af-packet mode", RunModeIdsAFPSingle); RunModeRegisterNewRunMode(RUNMODE_AFP_DEV, "workers", "Workers af-packet mode, each thread does all" " tasks from acquisition to logging", RunModeIdsAFPWorkers); default_mode_workers = "workers"; RunModeRegisterNewRunMode(RUNMODE_AFP_DEV, "autofp", "Multi socket AF_PACKET mode. Packets from " "each flow are assigned to a single detect " "thread.", RunModeIdsAFPAutoFp); return; } #ifdef HAVE_AF_PACKET void AFPDerefConfig(void *conf) { AFPIfaceConfig *pfp = (AFPIfaceConfig *)conf; /* Pcap config is used only once but cost of this low. */ if (SC_ATOMIC_SUB(pfp->ref, 1) == 0) { SCFree(pfp); } } /* if cluster id is not set, assign it automagically, uniq value per * interface. */ static int cluster_id_auto = 1; /** * \brief extract information from config file * * The returned structure will be freed by the thread init function. * This is thus necessary to or copy the structure before giving it * to thread or to reparse the file for each thread (and thus have * new structure. * * \return a AFPIfaceConfig corresponding to the interface name */ void *ParseAFPConfig(const char *iface) { char *threadsstr = NULL; ConfNode *if_root; ConfNode *if_default = NULL; ConfNode *af_packet_node; char *tmpclusterid; char *tmpctype; char *copymodestr; intmax_t value; int boolval; char *bpf_filter = NULL; char *out_iface = NULL; int cluster_type = PACKET_FANOUT_HASH; if (iface == NULL) { return NULL; } AFPIfaceConfig *aconf = SCCalloc(1, sizeof(*aconf)); if (unlikely(aconf == NULL)) { return NULL; } strlcpy(aconf->iface, iface, sizeof(aconf->iface)); aconf->threads = 0; SC_ATOMIC_INIT(aconf->ref); (void) SC_ATOMIC_ADD(aconf->ref, 1); aconf->buffer_size = 0; aconf->cluster_id = 1; aconf->cluster_type = cluster_type | PACKET_FANOUT_FLAG_DEFRAG; aconf->promisc = 1; aconf->checksum_mode = CHECKSUM_VALIDATION_KERNEL; aconf->DerefFunc = AFPDerefConfig; aconf->flags = AFP_RING_MODE; aconf->bpf_filter = NULL; aconf->out_iface = NULL; aconf->copy_mode = AFP_COPY_MODE_NONE; aconf->block_timeout = 10; aconf->block_size = getpagesize() << AFP_BLOCK_SIZE_DEFAULT_ORDER; if (ConfGet("bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { aconf->bpf_filter = bpf_filter; SCLogConfig("Going to use command-line provided bpf filter '%s'", aconf->bpf_filter); } } /* Find initial node */ af_packet_node = ConfGetNode("af-packet"); if (af_packet_node == NULL) { SCLogInfo("unable to find af-packet config using default values"); goto finalize; } if_root = ConfFindDeviceConfig(af_packet_node, iface); if_default = ConfFindDeviceConfig(af_packet_node, "default"); if (if_root == NULL && if_default == NULL) { SCLogInfo("unable to find af-packet config for " "interface \"%s\" or \"default\", using default values", iface); goto finalize; } /* If there is no setting for current interface use default one as main iface */ if (if_root == NULL) { if_root = if_default; if_default = NULL; } if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) { aconf->threads = 0; } else { if (threadsstr != NULL) { if (strcmp(threadsstr, "auto") == 0) { aconf->threads = 0; } else { aconf->threads = (uint8_t)atoi(threadsstr); } } } if (ConfGetChildValueWithDefault(if_root, if_default, "copy-iface", &out_iface) == 1) { if (strlen(out_iface) > 0) { aconf->out_iface = out_iface; } } if (ConfGetChildValueBoolWithDefault(if_root, if_default, "use-mmap", (int *)&boolval) == 1) { if (!boolval) { SCLogConfig("Disabling mmaped capture on iface %s", aconf->iface); aconf->flags &= ~(AFP_RING_MODE|AFP_TPACKET_V3); } } if (aconf->flags & AFP_RING_MODE) { (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "mmap-locked", (int *)&boolval); if (boolval) { SCLogConfig("Enabling locked memory for mmap on iface %s", aconf->iface); aconf->flags |= AFP_MMAP_LOCKED; } if (ConfGetChildValueBoolWithDefault(if_root, if_default, "tpacket-v3", (int *)&boolval) == 1) { if (boolval) { if (strcasecmp(RunmodeGetActive(), "workers") == 0) { #ifdef HAVE_TPACKET_V3 SCLogConfig("Enabling tpacket v3 capture on iface %s", aconf->iface); aconf->flags |= AFP_TPACKET_V3; #else SCLogNotice("System too old for tpacket v3 switching to v2"); aconf->flags &= ~AFP_TPACKET_V3; #endif } else { SCLogWarning(SC_ERR_RUNMODE, "tpacket v3 is only implemented for 'workers' runmode." " Switching to tpacket v2."); aconf->flags &= ~AFP_TPACKET_V3; } } else { aconf->flags &= ~AFP_TPACKET_V3; } } (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "use-emergency-flush", (int *)&boolval); if (boolval) { SCLogConfig("Enabling ring emergency flush on iface %s", aconf->iface); aconf->flags |= AFP_EMERGENCY_MODE; } } aconf->copy_mode = AFP_COPY_MODE_NONE; if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) { if (aconf->out_iface == NULL) { SCLogInfo("Copy mode activated but no destination" " iface. Disabling feature"); } else if (!(aconf->flags & AFP_RING_MODE)) { SCLogInfo("Copy mode activated but use-mmap " "set to no. Disabling feature"); } else if (strlen(copymodestr) <= 0) { aconf->out_iface = NULL; } else if (strcmp(copymodestr, "ips") == 0) { SCLogInfo("AF_PACKET IPS mode activated %s->%s", iface, aconf->out_iface); aconf->copy_mode = AFP_COPY_MODE_IPS; } else if (strcmp(copymodestr, "tap") == 0) { SCLogInfo("AF_PACKET TAP mode activated %s->%s", iface, aconf->out_iface); aconf->copy_mode = AFP_COPY_MODE_TAP; } else { SCLogInfo("Invalid mode (not in tap, ips)"); } } if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-id", &tmpclusterid) != 1) { aconf->cluster_id = (uint16_t)(cluster_id_auto++); } else { aconf->cluster_id = (uint16_t)atoi(tmpclusterid); SCLogDebug("Going to use cluster-id %" PRId32, aconf->cluster_id); } if (ConfGetChildValueWithDefault(if_root, if_default, "cluster-type", &tmpctype) != 1) { /* default to our safest choice: flow hashing + defrag enabled */ aconf->cluster_type = PACKET_FANOUT_HASH | PACKET_FANOUT_FLAG_DEFRAG; cluster_type = PACKET_FANOUT_HASH; } else if (strcmp(tmpctype, "cluster_round_robin") == 0) { SCLogConfig("Using round-robin cluster mode for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type = PACKET_FANOUT_LB; cluster_type = PACKET_FANOUT_LB; } else if (strcmp(tmpctype, "cluster_flow") == 0) { /* In hash mode, we also ask for defragmentation needed to * compute the hash */ uint16_t defrag = 0; int conf_val = 0; SCLogConfig("Using flow cluster mode for AF_PACKET (iface %s)", aconf->iface); ConfGetChildValueBoolWithDefault(if_root, if_default, "defrag", &conf_val); if (conf_val) { SCLogConfig("Using defrag kernel functionality for AF_PACKET (iface %s)", aconf->iface); defrag = PACKET_FANOUT_FLAG_DEFRAG; } aconf->cluster_type = PACKET_FANOUT_HASH | defrag; cluster_type = PACKET_FANOUT_HASH; } else if (strcmp(tmpctype, "cluster_cpu") == 0) { SCLogConfig("Using cpu cluster mode for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type = PACKET_FANOUT_CPU; cluster_type = PACKET_FANOUT_CPU; } else if (strcmp(tmpctype, "cluster_qm") == 0) { SCLogConfig("Using queue based cluster mode for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type = PACKET_FANOUT_QM; cluster_type = PACKET_FANOUT_QM; } else if (strcmp(tmpctype, "cluster_random") == 0) { SCLogConfig("Using random based cluster mode for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type = PACKET_FANOUT_RND; cluster_type = PACKET_FANOUT_RND; } else if (strcmp(tmpctype, "cluster_rollover") == 0) { SCLogConfig("Using rollover based cluster mode for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type = PACKET_FANOUT_ROLLOVER; cluster_type = PACKET_FANOUT_ROLLOVER; } else { SCLogWarning(SC_ERR_INVALID_CLUSTER_TYPE,"invalid cluster-type %s",tmpctype); } int conf_val = 0; ConfGetChildValueBoolWithDefault(if_root, if_default, "rollover", &conf_val); if (conf_val) { SCLogConfig("Using rollover kernel functionality for AF_PACKET (iface %s)", aconf->iface); aconf->cluster_type |= PACKET_FANOUT_FLAG_ROLLOVER; } /*load af_packet bpf filter*/ /* command line value has precedence */ if (ConfGet("bpf-filter", &bpf_filter) != 1) { if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &bpf_filter) == 1) { if (strlen(bpf_filter) > 0) { aconf->bpf_filter = bpf_filter; SCLogConfig("Going to use bpf filter %s", aconf->bpf_filter); } } } if ((ConfGetChildValueIntWithDefault(if_root, if_default, "buffer-size", &value)) == 1) { aconf->buffer_size = value; } else { aconf->buffer_size = 0; } if ((ConfGetChildValueIntWithDefault(if_root, if_default, "ring-size", &value)) == 1) { aconf->ring_size = value; } if ((ConfGetChildValueIntWithDefault(if_root, if_default, "block-size", &value)) == 1) { if (value % getpagesize()) { SCLogError(SC_ERR_INVALID_VALUE, "Block-size must be a multiple of pagesize."); } else { aconf->block_size = value; } } if ((ConfGetChildValueIntWithDefault(if_root, if_default, "block-timeout", &value)) == 1) { aconf->block_timeout = value; } else { aconf->block_timeout = 10; } (void)ConfGetChildValueBoolWithDefault(if_root, if_default, "disable-promisc", (int *)&boolval); if (boolval) { SCLogConfig("Disabling promiscuous mode on iface %s", aconf->iface); aconf->promisc = 0; } if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) { if (strcmp(tmpctype, "auto") == 0) { aconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (ConfValIsTrue(tmpctype)) { aconf->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(tmpctype)) { aconf->checksum_mode = CHECKSUM_VALIDATION_DISABLE; } else if (strcmp(tmpctype, "kernel") == 0) { aconf->checksum_mode = CHECKSUM_VALIDATION_KERNEL; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid value for checksum-checks for %s", aconf->iface); } } finalize: /* if the number of threads is not 1, we need to first check if fanout * functions on this system. */ if (aconf->threads != 1) { if (AFPIsFanoutSupported() == 0) { if (aconf->threads != 0) { SCLogNotice("fanout not supported on this system, falling " "back to 1 capture thread"); } aconf->threads = 1; } } /* try to automagically set the proper number of threads */ if (aconf->threads == 0) { /* for cluster_flow use core count */ if (cluster_type == PACKET_FANOUT_HASH) { aconf->threads = (int)UtilCpuGetNumProcessorsOnline(); SCLogPerf("%u cores, so using %u threads", aconf->threads, aconf->threads); /* for cluster_qm use RSS queue count */ } else if (cluster_type == PACKET_FANOUT_QM) { int rss_queues = GetIfaceRSSQueuesNum(iface); if (rss_queues > 0) { aconf->threads = rss_queues; SCLogPerf("%d RSS queues, so using %u threads", rss_queues, aconf->threads); } } if (aconf->threads) { SCLogPerf("Using %d AF_PACKET threads for interface %s", aconf->threads, iface); } } if (aconf->threads <= 0) { aconf->threads = 1; } SC_ATOMIC_RESET(aconf->ref); (void) SC_ATOMIC_ADD(aconf->ref, aconf->threads); if (aconf->ring_size != 0) { if (aconf->ring_size * aconf->threads < max_pending_packets) { aconf->ring_size = max_pending_packets / aconf->threads + 1; SCLogWarning(SC_ERR_AFP_CREATE, "Inefficient setup: ring-size < max_pending_packets. " "Resetting to decent value %d.", aconf->ring_size); /* We want at least that max_pending_packets packets can be handled by the * interface. This is generous if we have multiple interfaces listening. */ } } else { /* We want that max_pending_packets packets can be handled by suricata * for this interface. To take burst into account we multiply the obtained * size by 2. */ aconf->ring_size = max_pending_packets * 2 / aconf->threads; } int ltype = AFPGetLinkType(iface); switch (ltype) { case LINKTYPE_ETHERNET: /* af-packet can handle csum offloading */ if (LiveGetOffload() == 0) { if (GetIfaceOffloading(iface, 0, 1) == 1) { SCLogWarning(SC_ERR_AFP_CREATE, "Using AF_PACKET with offloading activated leads to capture problems"); } } else { DisableIfaceOffloading(LiveGetDevice(iface), 0, 1); } break; case -1: default: break; } char *active_runmode = RunmodeGetActive(); if (active_runmode && !strcmp("workers", active_runmode)) { aconf->flags |= AFP_ZERO_COPY; } else { /* If we are using copy mode we need a lock */ aconf->flags |= AFP_SOCK_PROTECT; } /* If we are in RING mode, then we can use ZERO copy * by using the data release mechanism */ if (aconf->flags & AFP_RING_MODE) { aconf->flags |= AFP_ZERO_COPY; } if (aconf->flags & AFP_ZERO_COPY) { SCLogConfig("%s: enabling zero copy mode by using data release call", iface); } return aconf; } int AFPConfigGeThreadsCount(void *conf) { AFPIfaceConfig *afp = (AFPIfaceConfig *)conf; return afp->threads; } int AFPRunModeIsIPS() { int nlive = LiveGetDeviceCount(); int ldev; ConfNode *if_root; ConfNode *if_default = NULL; ConfNode *af_packet_node; int has_ips = 0; int has_ids = 0; /* Find initial node */ af_packet_node = ConfGetNode("af-packet"); if (af_packet_node == NULL) { return 0; } if_default = ConfNodeLookupKeyValue(af_packet_node, "interface", "default"); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } char *copymodestr = NULL; if_root = ConfFindDeviceConfig(af_packet_node, live_dev); if (if_root == NULL) { if (if_default == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = if_default; } if (ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) { if (strcmp(copymodestr, "ips") == 0) { has_ips = 1; } else { has_ids = 1; } } else { has_ids = 1; } } if (has_ids && has_ips) { SCLogInfo("AF_PACKET mode using IPS and IDS mode"); for (ldev = 0; ldev < nlive; ldev++) { const char *live_dev = LiveGetDeviceName(ldev); if (live_dev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = ConfNodeLookupKeyValue(af_packet_node, "interface", live_dev); char *copymodestr = NULL; if (if_root == NULL) { if (if_default == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Problem with config file"); return 0; } if_root = if_default; } if (! ((ConfGetChildValueWithDefault(if_root, if_default, "copy-mode", ©modestr) == 1) && (strcmp(copymodestr, "ips") == 0))) { SCLogError(SC_ERR_INVALID_ARGUMENT, "AF_PACKET IPS mode used and interface '%s' is in IDS or TAP mode. " "Sniffing '%s' but expect bad result as stream-inline is activated.", live_dev, live_dev); } } } return has_ips; } #endif int RunModeIdsAFPAutoFp(void) { SCEnter(); /* We include only if AF_PACKET is enabled */ #ifdef HAVE_AF_PACKET int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("af-packet.live-interface", &live_dev); SCLogDebug("live_dev %s", live_dev); if (AFPPeersListInit() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Unable to init peers list."); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureAutoFp(ParseAFPConfig, AFPConfigGeThreadsCount, "ReceiveAFP", "DecodeAFP", thread_name_autofp, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } /* In IPS mode each threads must have a peer */ if (AFPPeersListCheck() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Some IPS capture threads did not peer."); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsAFPAutoFp initialised"); #endif /* HAVE_AF_PACKET */ SCReturnInt(0); } /** * \brief Single thread version of the AF_PACKET processing. */ int RunModeIdsAFPSingle(void) { SCEnter(); #ifdef HAVE_AF_PACKET int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("af-packet.live-interface", &live_dev); if (AFPPeersListInit() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Unable to init peers list."); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureSingle(ParseAFPConfig, AFPConfigGeThreadsCount, "ReceiveAFP", "DecodeAFP", thread_name_single, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } /* In IPS mode each threads must have a peer */ if (AFPPeersListCheck() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Some IPS capture threads did not peer."); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsAFPSingle initialised"); #endif /* HAVE_AF_PACKET */ SCReturnInt(0); } /** * \brief Workers version of the AF_PACKET processing. * * Start N threads with each thread doing all the work. * */ int RunModeIdsAFPWorkers(void) { SCEnter(); #ifdef HAVE_AF_PACKET int ret; char *live_dev = NULL; RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("af-packet.live-interface", &live_dev); if (AFPPeersListInit() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Unable to init peers list."); exit(EXIT_FAILURE); } ret = RunModeSetLiveCaptureWorkers(ParseAFPConfig, AFPConfigGeThreadsCount, "ReceiveAFP", "DecodeAFP", thread_name_workers, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } /* In IPS mode each threads must have a peer */ if (AFPPeersListCheck() != TM_ECODE_OK) { SCLogError(SC_ERR_RUNMODE, "Some IPS capture threads did not peer."); exit(EXIT_FAILURE); } SCLogDebug("RunModeIdsAFPWorkers initialised"); #endif /* HAVE_AF_PACKET */ SCReturnInt(0); } /** * @} */ suricata-3.2.1/src/util-cuda-buffer.c0000644000000000000000000012440513051004444014311 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * API has be introduced to allow buffering of data by multiple writers * asynronously. The current version only allows sequential reads. * * The API works by first registering a couple of buffers, which would * be sliced and allocated for use by the API to potential writers. * * The registration API requires 3 buffers to be registered. The data * buffer(d_buffer), into which the API buffers data, the pointer buffer * (p_buffer), which would hold the pointer var instance corresponding to * its entry in the d_buffer, and the offset buffer(o_buffer), which * holds an offset entry for the data corresponding to the pointer buffer * entry. * * A writer wishing to write data would be required to obtain a slice * using CudaBufferGetSlice. Once data has been written to the slice, * it can report back saying the slice has been written to by setting * a flag in the slice - SC_ATOMIC_SET(slice->done, 1). * * A reader wishing to retrieve the data written by writers, will do * so using the API call - CudaBufferCullCompletedSlices(). Once data * has been consumed, the reader would report back using * CudaBufferReportCulledConsumption() so that resources can be freed * to be reallocated to other writers. */ #include "suricata-common.h" #ifdef __SC_CUDA_SUPPORT__ #include "suricata.h" #include "util-atomic.h" #include "util-pool.h" #include "util-misc.h" #include "util-error.h" #include "util-debug.h" #include "util-unittest.h" #include "util-cuda-buffer.h" /* rotation limit for the buffers. This basically decides at what position * inside alloced buffer should the API rotate and start using the buffer * from the start - The right value's from 0.1-1.0. Do note that the * rotation decision is taken when the culling process takes place. * Have a look at - CudaBufferCullCompletedSlices */ #define CUDA_BUFFER_BUFFER_ROTATION_LIMIT 0.75 /* The max buffer size that be registered to CudaBufferRegisterNew */ #define CUDA_BUFFER_BUFFER_LIMIT (1 * 1024 * 1024 * 1024) /* 100,000 * 5 = 500,000 */ #define CUDA_BUFFER_ITEM_LIMIT (100000 * 5) /* a million slices to be prealloced = 100,000 * 10 */ #define CUDA_BUFFER_SLICE_POOL_PREALLOC (100000 * 10) /* we store all our slices here */ static Pool *slice_pool = NULL; /* mutex for the above slice pool */ static SCMutex slice_pool_mutex; /** * \brief Used by a consumer to report back(and thus have it freed), * once it has consumed data returned in the CudaBufferCulledInfo * instance(obtained from the call to CudaBufferCullCompletedSlices). */ void CudaBufferReportCulledConsumption(CudaBufferData *cb_data, CudaBufferCulledInfo *culled_info) { SCMutexLock(&cb_data->m); if (culled_info->d_buffer_reset) { cb_data->d_buffer_read = 0; } else { if (culled_info->no_of_items != 0) { cb_data->d_buffer_read = culled_info->d_buffer_start_offset + culled_info->d_buffer_len; } } if (culled_info->op_buffer_reset) { cb_data->op_buffer_read = 0; } else { if (culled_info->no_of_items != 0) { cb_data->op_buffer_read += culled_info->no_of_items; } } SCMutexUnlock(&cb_data->m); } /** * \brief Remove slices that are done. "Done" as in worker threads are done * writing data to it. * * \param cb_data Pointer to the CudaBufferData instance. */ void CudaBufferCullCompletedSlices(CudaBufferData *cb_data, CudaBufferCulledInfo *culled_info, uint32_t size_limit) { culled_info->no_of_items = 0; culled_info->d_buffer_reset = 0; culled_info->op_buffer_reset = 0; SCMutexLock(&cb_data->m); int buffer_reset = 0; uint32_t d_buffer_write_temp = 0; uint32_t op_buffer_write_temp = 0; if ((cb_data->d_buffer_write >= (cb_data->d_buffer_len * CUDA_BUFFER_BUFFER_ROTATION_LIMIT)) && (cb_data->d_buffer_read != 0)) { SCLogDebug("d_buffer reset"); d_buffer_write_temp = cb_data->d_buffer_write; cb_data->d_buffer_write = 0; buffer_reset = 1; culled_info->d_buffer_reset = 1; } /* reset op_buffer */ if ((cb_data->op_buffer_write >= (cb_data->op_buffer_len * CUDA_BUFFER_BUFFER_ROTATION_LIMIT)) && (cb_data->op_buffer_read != 0)) { SCLogDebug("op_buffer reset"); op_buffer_write_temp = cb_data->op_buffer_write; cb_data->op_buffer_write = 0; buffer_reset = 1; culled_info->op_buffer_reset = 1; } CudaBufferSlice *slice_temp = cb_data->slice_head; CudaBufferSlice *max_culled_slice = NULL; uint32_t curr_size = 0; while (slice_temp != NULL) { if (!SC_ATOMIC_GET(slice_temp->done)) { SCLogDebug("CudaBuffer waiting on an item to finish"); if (buffer_reset) { while (!SC_ATOMIC_GET(slice_temp->done)) usleep(1); } else { break; } } if (curr_size + (slice_temp->end_offset - slice_temp->start_offset + 1) > size_limit) { if (buffer_reset) { cb_data->op_buffer_write = op_buffer_write_temp; cb_data->d_buffer_write = d_buffer_write_temp; culled_info->d_buffer_reset = 0; culled_info->op_buffer_reset = 0; } break; } max_culled_slice = slice_temp; curr_size += (slice_temp->end_offset - slice_temp->start_offset + 1); slice_temp = slice_temp->next; } CudaBufferSlice *slice_head = cb_data->slice_head; if (max_culled_slice != NULL) { cb_data->slice_head = max_culled_slice->next; if (max_culled_slice->next == NULL) { cb_data->slice_tail = NULL; } max_culled_slice->next = NULL; } else { SCMutexUnlock(&cb_data->m); return; } culled_info->d_buffer_start_offset = slice_head->start_offset; culled_info->d_buffer_len = (max_culled_slice->end_offset - slice_head->start_offset + 1); culled_info->op_buffer_start_offset = cb_data->op_buffer_read; SCMutexUnlock(&cb_data->m); /* push out the used slices to the the slice_pool */ SCMutexLock(&slice_pool_mutex); slice_temp = slice_head; while (slice_temp != max_culled_slice) { CudaBufferSlice *tmp = slice_temp->next; PoolReturn(slice_pool, slice_temp); culled_info->no_of_items++; slice_temp = tmp; } PoolReturn(slice_pool, slice_temp); culled_info->no_of_items++; SCMutexUnlock(&slice_pool_mutex); return; } /** * \internal * \brief Adds a slice to the CudaBufferData slice list. * * We expect the CudaBufferData instance to be locked. * * \param cb_data Pointer to the CudaBufferdata instance. * \param slice Pointer to the slice to be pushed. */ static inline void CudaBufferAppendSlice(CudaBufferData *cb_data, CudaBufferSlice *slice) { slice->next = NULL; if (cb_data->slice_head == NULL) { cb_data->slice_head = slice; cb_data->slice_tail = slice; } else { cb_data->slice_tail->next = slice; cb_data->slice_tail = slice; } return; } /** * \brief Gets a new buffer slice for a consumer to write to. * * All slices returned are aligned to the next 8 byte boundary. * * \param cb_data Pointer to the CudaBufferdata instance. * \param len Length of the slice required. * \param p Pointer to the var corresponding to the data to store. * * \retval slice Pointer to the slice if successful; NULL if unsuccessful. */ CudaBufferSlice *CudaBufferGetSlice(CudaBufferData *cb_data, uint32_t len, void *p) { #define ALIGN_UP(offset, alignment) (offset) = ((offset) + (alignment) - 1) & ~((alignment) - 1) SCMutexLock(&slice_pool_mutex); CudaBufferSlice *slice = PoolGet(slice_pool); SCMutexUnlock(&slice_pool_mutex); if (slice == NULL) { return NULL; } SCMutexLock(&cb_data->m); if (cb_data->d_buffer_write < cb_data->d_buffer_read) { if (cb_data->d_buffer_write + len >= cb_data->d_buffer_read) { SCLogDebug("d_buffer full"); SCMutexUnlock(&cb_data->m); SCMutexLock(&slice_pool_mutex); PoolReturn(slice_pool, slice); SCMutexUnlock(&slice_pool_mutex); return NULL; } } else { if (cb_data->d_buffer_write + len > cb_data->d_buffer_len) { SCLogDebug("d_buffer limit hit - buffer_len - %"PRIu32, cb_data->d_buffer_len); SCMutexUnlock(&cb_data->m); SCMutexLock(&slice_pool_mutex); PoolReturn(slice_pool, slice); SCMutexUnlock(&slice_pool_mutex); return NULL; } } if (cb_data->op_buffer_write < cb_data->op_buffer_read) { if (cb_data->op_buffer_write + 1 >= cb_data->op_buffer_read) { SCLogDebug("op_buffer full"); SCMutexUnlock(&cb_data->m); SCMutexLock(&slice_pool_mutex); PoolReturn(slice_pool, slice); SCMutexUnlock(&slice_pool_mutex); return NULL; } } else { if (cb_data->op_buffer_write + 1 > cb_data->op_buffer_len) { SCLogDebug("op_buffer limit hit - buffer_len - %"PRIu32, cb_data->op_buffer_len); SCMutexUnlock(&cb_data->m); SCMutexLock(&slice_pool_mutex); PoolReturn(slice_pool, slice); SCMutexUnlock(&slice_pool_mutex); return NULL; } } slice->start_offset = cb_data->d_buffer_write; cb_data->d_buffer_write = slice->start_offset + len; ALIGN_UP(cb_data->d_buffer_write, 8); slice->end_offset = cb_data->d_buffer_write - 1; slice->buffer = cb_data->d_buffer; SC_ATOMIC_SET(slice->done, 0); CudaBufferAppendSlice(cb_data, slice); cb_data->no_of_items++; cb_data->o_buffer[cb_data->op_buffer_write] = slice->start_offset; cb_data->p_buffer[cb_data->op_buffer_write] = p; cb_data->op_buffer_write++; SCMutexUnlock(&cb_data->m); return slice; } void CudaBufferDeRegister(CudaBufferData *cb_data) { CudaBufferSlice *slice_temp = cb_data->slice_head; SCMutexLock(&slice_pool_mutex); while (slice_temp != NULL) { CudaBufferSlice *slice_temp_next = slice_temp->next; PoolReturn(slice_pool, slice_temp); slice_temp = slice_temp_next; } SCMutexUnlock(&slice_pool_mutex); SCMutexDestroy(&cb_data->m); SCFree(cb_data); return; } /** * \brief Registers a new buffer to be handled by the CudaBuffer API. * * More on what this API does can be understood from the API * docs at the start of this file. * * \param d_buffer The data buffer to work with. * \param d_buffer_len Length of d_buffer. * \param o_buffer The offset buffer. * \param p_buffer The pointer buffer. * \param op_buffer_no_of_items Length of o_buffer and p_buffer. Please * note that both o_buffer and p_buffer * should be of the same length. * \param len Length of the buffer to be assigned. */ CudaBufferData *CudaBufferRegisterNew(uint8_t *d_buffer, uint32_t d_buffer_len, uint32_t *o_buffer, void **p_buffer, uint32_t op_buffer_no_of_items) { if (d_buffer_len > CUDA_BUFFER_BUFFER_LIMIT) { SCLogError(SC_ERR_CUDA_BUFFER_ERROR, "Buffer max limit exceeded. We " "accept a max limit of %u bytes", CUDA_BUFFER_BUFFER_LIMIT); return NULL; } if ((d_buffer_len % 8) != 0) { SCLogError(SC_ERR_CUDA_BUFFER_ERROR, "Please specify a buffer length which " "is a multiple of 8"); return NULL; } CudaBufferData *new = SCMalloc(sizeof(CudaBufferData)); if (unlikely(new == NULL)) { return NULL; } memset(new, 0, sizeof(CudaBufferData)); /* payload/data buffer and set its size */ new->d_buffer = d_buffer; new->d_buffer_len = d_buffer_len; /* offset buffer and set its size */ new->o_buffer = o_buffer; new->p_buffer = p_buffer; /* common to the above 2 malloc'ed buffers */ new->op_buffer_len = op_buffer_no_of_items; /* used to lock this new instance when it's used */ SCMutexInit(&new->m, NULL); return new; } static void *CudaBufferSlicePoolAlloc(void *null) { void *ptr = SCMalloc(sizeof(CudaBufferSlice)); if (unlikely(ptr == NULL)) return NULL; memset(ptr, 0, sizeof(CudaBufferSlice)); SC_ATOMIC_INIT(((CudaBufferSlice *)ptr)->done); return ptr; } static int CudaBufferSlicePoolInit(void *data, void *init_data) { SC_ATOMIC_INIT(((CudaBufferSlice *)data)->done); return 1; } /* disabled to reflect the changes made in PoolInit */ #if 0 static void CudaBufferSlicePoolFree(void *data) { SC_ATOMIC_DESTROY(((CudaBufferSlice *)data)->done); SCFree(data); return; } #endif static void CudaBufferSlicePoolCleanup(void *data) { SC_ATOMIC_DESTROY(((CudaBufferSlice *)data)->done); return; } /** * \brief Init the API. To be called only once at startup time. */ void CudaBufferInit(void) { SCMutexInit(&slice_pool_mutex, NULL); slice_pool = PoolInit(CUDA_BUFFER_SLICE_POOL_PREALLOC, CUDA_BUFFER_SLICE_POOL_PREALLOC, sizeof(CudaBufferSlice), CudaBufferSlicePoolAlloc, CudaBufferSlicePoolInit, NULL, CudaBufferSlicePoolCleanup, NULL); if (slice_pool == NULL) { SCLogError(SC_ERR_POOL_INIT, "CudaBuffer slice_pool is not initialized"); exit(EXIT_FAILURE); } return; } /****************************Unittests***************************/ #ifdef UNITTESTS int CudaBufferTest01(void) { CudaBufferSlice *slice1, *slice2, *slice3, *slice4, *slice_temp; int result = 0; uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } /* new slice */ slice1 = CudaBufferGetSlice(data, 8, NULL); if (slice1->start_offset != 0 || slice1->end_offset != 7 || SC_ATOMIC_GET(slice1->done) != 0) { printf("failure 1\n"); goto end; } if (data->d_buffer_write != 8 || data->d_buffer_read != 0 || data->op_buffer_write != 1 || data->op_buffer_read != 0 || data->no_of_items != 1) { printf("failure 2\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 3\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 4\n"); goto end; } /* new slice */ slice2 = CudaBufferGetSlice(data, 16, NULL); if (slice2->start_offset != 8 || slice2->end_offset != 23 || SC_ATOMIC_GET(slice2->done) != 0) { printf("failure 5\n"); goto end; } if (data->d_buffer_write != 24 || data->d_buffer_read != 0 || data->op_buffer_write != 2 || data->op_buffer_read != 0 || data->no_of_items != 2) { printf("failure 6\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 7\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 8 || slice_temp->end_offset != 23 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 8\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 9\n"); goto end; } /* new slice */ slice3 = CudaBufferGetSlice(data, 36, NULL); if (slice3->start_offset != 24 || slice3->end_offset != 63 || SC_ATOMIC_GET(slice3->done) != 0) { printf("failure 10\n"); goto end; } if (data->d_buffer_write != 64 || data->d_buffer_read != 0 || data->op_buffer_write != 3 || data->op_buffer_read != 0 || data->no_of_items != 3) { printf("failure 11\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 12\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 8 || slice_temp->end_offset != 23 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 13\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 24 || slice_temp->end_offset != 63 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 14\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 15\n"); goto end; } slice4 = CudaBufferGetSlice(data, 10, NULL); if (slice4 != NULL) { printf("failure 16\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 17\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } int CudaBufferTest02(void) { CudaBufferSlice *slice1, *slice2, *slice3, *slice_temp; int result = 0; uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } slice1 = CudaBufferGetSlice(data, 8, NULL); slice2 = CudaBufferGetSlice(data, 16, NULL); if (data->d_buffer_write != 24 || data->d_buffer_read != 0 || data->op_buffer_write != 2 || data->op_buffer_read != 0 || data->no_of_items != 2) { printf("failure 1\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 2\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 8 || slice_temp->end_offset != 23 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 3\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 4\n"); goto end; } /* culling */ CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 0) { printf("failure 5\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 6\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 8 || slice_temp->end_offset != 23 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 7\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 8\n"); goto end; } SC_ATOMIC_SET(slice2->done, 1); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 0) { printf("failure 9\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 7 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 10\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 8 || slice_temp->end_offset != 23 || SC_ATOMIC_GET(slice_temp->done) != 1) { printf("failure 11\n"); goto end; } if (slice_temp->next != NULL) { printf("failure 12\n"); goto end; } SC_ATOMIC_SET(slice1->done, 1); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 2) { printf("failure 13\n"); goto end; } if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 14\n"); goto end; } if (culled_info.d_buffer_start_offset != 0 || culled_info.d_buffer_len != 24 || culled_info.op_buffer_start_offset != 0 || culled_info.d_buffer_reset != 0 || culled_info.op_buffer_reset != 0) { printf("failure 15\n"); goto end; } if (data->d_buffer_write != 24 || data->d_buffer_read != 0 || data->op_buffer_write != 2 || data->op_buffer_read != 0 || data->no_of_items != 2) { printf("failure 16\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 24 || data->d_buffer_read != 24 || data->op_buffer_write != 2 || data->op_buffer_read != 2 || data->no_of_items != 2) { printf("failure 17\n"); goto end; } /* new slice */ slice3 = CudaBufferGetSlice(data, 8, NULL); if (slice3->start_offset != 24 || slice3->end_offset != 31 || SC_ATOMIC_GET(slice3->done) != 0) { printf("failure 18\n"); goto end; } if (data->d_buffer_write != 32 || data->d_buffer_read != 24 || data->op_buffer_write != 3 || data->op_buffer_read != 2 || data->no_of_items != 3) { printf("failure 19\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 24 || slice_temp->end_offset != 31 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 20\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp != NULL) { printf("failure 21\n"); goto end; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 0) { printf("failure 22\n"); goto end; } if (data->d_buffer_write != 32 || data->d_buffer_read != 24 || data->op_buffer_write != 3 || data->op_buffer_read != 2 || data->no_of_items != 3) { printf("failure 23\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 24 || slice_temp->end_offset != 31 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 24\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp != NULL) { printf("failure 25\n"); goto end; } /* set done flag */ SC_ATOMIC_SET(slice3->done, 1); if (slice3->start_offset != 24 || slice3->end_offset != 31 || SC_ATOMIC_GET(slice3->done) != 1) { printf("failure 26\n"); goto end; } if (data->d_buffer_write != 32 || data->d_buffer_read != 24 || data->op_buffer_write != 3 || data->op_buffer_read != 2 || data->no_of_items != 3) { printf("failure 27\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 24 || slice_temp->end_offset != 31 || SC_ATOMIC_GET(slice_temp->done) != 1) { printf("failure 28\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp != NULL) { printf("failure 29\n"); goto end; } /* culling */ CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 1) { printf("failure 30\n"); goto end; } if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 31\n"); goto end; } if (culled_info.d_buffer_start_offset != 24 || culled_info.d_buffer_len != 8 || culled_info.op_buffer_start_offset != 2 || culled_info.d_buffer_reset != 0 || culled_info.op_buffer_reset != 0) { printf("failure 32\n"); goto end; } if (data->d_buffer_write != 32 || data->d_buffer_read != 24 || data->op_buffer_write != 3 || data->op_buffer_read != 2 || data->no_of_items != 3) { printf("failure 33\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 32 || data->d_buffer_read != 32 || data->op_buffer_write != 3 || data->op_buffer_read != 3 || data->no_of_items != 3) { printf("failure 34\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 35\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } int CudaBufferTest03(void) { CudaBufferSlice *slice, *slice_temp; int result = 0; uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } slice = CudaBufferGetSlice(data, 16, NULL); BUG_ON(slice == NULL); slice = CudaBufferGetSlice(data, 16, NULL); BUG_ON(slice == NULL); slice = CudaBufferGetSlice(data, 24, NULL); BUG_ON(slice == NULL); /* culling */ CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 0) { printf("failure 1\n"); goto end; } if (data->d_buffer_write != 56 || data->d_buffer_read != 0 || data->op_buffer_write != 3 || data->op_buffer_read != 0 || data->no_of_items != 3) { printf("failure 2\n"); goto end; } slice_temp = data->slice_head; if (slice_temp->start_offset != 0 || slice_temp->end_offset != 15 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 3\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 16 || slice_temp->end_offset != 31 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 4\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp->start_offset != 32 || slice_temp->end_offset != 55 || SC_ATOMIC_GET(slice_temp->done) != 0) { printf("failure 5\n"); goto end; } slice_temp = slice_temp->next; if (slice_temp != NULL) { printf("failure 6\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 7\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } int CudaBufferTest04(void) { CudaBufferSlice *slice1, *slice2, *slice3, *slice_temp; int result = 0; uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } slice1 = CudaBufferGetSlice(data, 16, NULL); slice2 = CudaBufferGetSlice(data, 16, NULL); slice3 = CudaBufferGetSlice(data, 24, NULL); SC_ATOMIC_SET(slice1->done, 1); /* culling */ CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); if (data->d_buffer_write != 56 || data->d_buffer_read != 0 || data->op_buffer_write != 3 || data->op_buffer_read != 0 || data->no_of_items != 3) { printf("failure 1\n"); goto end; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 1) { printf("failure 2\n"); goto end; } if (data->d_buffer_write != 56 || data->d_buffer_read != 0 || data->op_buffer_write != 3 || data->op_buffer_read != 0 || data->no_of_items != 3) { printf("failure 3\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 56 || data->d_buffer_read != 16 || data->op_buffer_write != 3 || data->op_buffer_read != 1 || data->no_of_items != 3) { printf("failure 4\n"); goto end; } SC_ATOMIC_SET(slice2->done, 1); SC_ATOMIC_SET(slice3->done, 1); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (culled_info.no_of_items != 2) { printf("failure 5\n"); goto end; } if (data->d_buffer_write != 0 || data->d_buffer_read != 16 || data->op_buffer_write != 3 || data->op_buffer_read != 1 || data->no_of_items != 3) { printf("failure 6\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 0 || data->d_buffer_read != 0 || data->op_buffer_write != 3 || data->op_buffer_read != 3 || data->no_of_items != 3) { printf("failure 7\n"); goto end; } slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 8\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 9\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } int CudaBufferTest05(void) { CudaBufferSlice *slice1, *slice2, *slice3, *slice_temp; int result = 0; uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } slice1 = CudaBufferGetSlice(data, 16, NULL); slice2 = CudaBufferGetSlice(data, 16, NULL); slice3 = CudaBufferGetSlice(data, 24, NULL); SC_ATOMIC_SET(slice1->done, 1); /* culling */ CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); CudaBufferReportCulledConsumption(data, &culled_info); SC_ATOMIC_SET(slice2->done, 1); SC_ATOMIC_SET(slice3->done, 1); CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); CudaBufferReportCulledConsumption(data, &culled_info); slice1 = CudaBufferGetSlice(data, 16, NULL); if (slice1 == NULL) { printf("failure 1\n"); goto end; } slice2 = CudaBufferGetSlice(data, 16, NULL); if (slice2 == NULL) { printf("failure 2\n"); goto end; } slice3 = CudaBufferGetSlice(data, 24, NULL); if (slice2 == NULL) { printf("failure 3\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 4\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } int CudaBufferTest06(void) { CudaBufferSlice *slice, *slice_temp; int result = 0; CudaBufferCulledInfo culled_info; memset(&culled_info, 0, sizeof(CudaBufferCulledInfo)); uint8_t *d_buffer = SCMalloc(sizeof(uint8_t) * 64); uint32_t *o_buffer = SCMalloc(sizeof(uint32_t) * 64); void **p_buffer = SCMalloc(sizeof(void *) * 64); if (d_buffer == NULL || o_buffer == NULL || p_buffer == NULL) { printf("failure 0\n"); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return 0; } CudaBufferData *data = CudaBufferRegisterNew(d_buffer, 64, o_buffer, p_buffer, 64); if (data == NULL) { goto end; } slice = CudaBufferGetSlice(data, 3, NULL); memcpy(slice->buffer + slice->start_offset, "one", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 3, NULL); memcpy(slice->buffer + slice->start_offset, "two", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); if (data->d_buffer_write != 16 || data->d_buffer_read != 0 || data->op_buffer_write != 2 || data->op_buffer_read != 0 || data->no_of_items != 2) { printf("failure 1\n"); goto end; } slice = CudaBufferGetSlice(data, 5, NULL); memcpy(slice->buffer + slice->start_offset, "three", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 4, NULL); memcpy(slice->buffer + slice->start_offset, "four", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 4, NULL); memcpy(slice->buffer + slice->start_offset, "five", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); if (data->d_buffer_write != 40 || data->d_buffer_read != 0 || data->op_buffer_write != 5 || data->op_buffer_read != 0 || data->no_of_items != 5) { printf("failure 2\n"); goto end; } slice = CudaBufferGetSlice(data, 3, NULL); memcpy(slice->buffer + slice->start_offset, "six", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 5, NULL); memcpy(slice->buffer + slice->start_offset, "seven", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); if (memcmp(data->d_buffer, "one", 3) != 0 || memcmp(data->d_buffer + 8, "two", 3) != 0 || memcmp(data->d_buffer + 16, "three", 5) != 0 || memcmp(data->d_buffer + 24, "four", 4) != 0 || memcmp(data->d_buffer + 32, "five", 4) != 0 || memcmp(data->d_buffer + 40, "six", 3) != 0 || memcmp(data->d_buffer + 48, "seven", 5) != 0) { printf("failure 3\n"); goto end; } if (data->d_buffer_write != 56 || data->d_buffer_read != 0 || data->op_buffer_write != 7 || data->op_buffer_read != 0 || data->no_of_items != 7) { printf("failure 4\n"); goto end; } /* culling */ CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->d_buffer_write != 56 || data->d_buffer_read != 0 || data->op_buffer_write != 7 || data->op_buffer_read != 0 || data->no_of_items != 7) { printf("failure 5\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 56 || data->d_buffer_read != 56 || data->op_buffer_write != 7 || data->op_buffer_read != 7 || data->no_of_items != 7) { printf("failure 6\n"); goto end; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->d_buffer_write != 0 || data->d_buffer_read != 56 || data->op_buffer_write != 7 || data->op_buffer_read != 7 || data->no_of_items != 7) { printf("failure 7\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 0 || data->d_buffer_read != 0 || data->op_buffer_write != 7 || data->op_buffer_read != 7 || data->no_of_items != 7) { printf("failure 8\n"); goto end; } slice = CudaBufferGetSlice(data, 5, NULL); memcpy(slice->buffer + slice->start_offset, "eight", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 4, NULL); memcpy(slice->buffer + slice->start_offset, "nine", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 3, NULL); memcpy(slice->buffer + slice->start_offset, "ten", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 6, NULL); memcpy(slice->buffer + slice->start_offset, "eleven", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); slice = CudaBufferGetSlice(data, 6, NULL); memcpy(slice->buffer + slice->start_offset, "twelve", slice->end_offset - slice->start_offset + 1); SC_ATOMIC_SET(slice->done, 1); if (data->d_buffer_write != 40 || data->d_buffer_read != 0 || data->op_buffer_write != 12 || data->op_buffer_read != 7 || data->no_of_items != 12) { printf("failure 9\n"); goto end; } if (memcmp(data->d_buffer, "eight", 5) != 0 || memcmp(data->d_buffer + 8, "nine", 4) != 0 || memcmp(data->d_buffer + 16, "ten", 3) != 0 || memcmp(data->d_buffer + 24, "eleven", 6) != 0 || memcmp(data->d_buffer + 32, "twelve", 6) != 0) { printf("failure 10\n"); goto end; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->d_buffer_write != 40 || data->d_buffer_read != 0 || data->op_buffer_write != 12 || data->op_buffer_read != 7 || data->no_of_items != 12) { printf("failure 11\n"); goto end; } CudaBufferReportCulledConsumption(data, &culled_info); if (data->d_buffer_write != 40 || data->d_buffer_read != 40 || data->op_buffer_write != 12 || data->op_buffer_read != 12 || data->no_of_items != 12) { printf("failure 12\n"); goto end; } result = 1; end: slice_temp = data->slice_head; while (slice_temp != NULL) { SC_ATOMIC_SET(slice_temp->done, 1); slice_temp = slice_temp->next; } CudaBufferCullCompletedSlices(data, &culled_info, UTIL_MPM_CUDA_GPU_TRANSFER_SIZE); if (data->slice_head != NULL || data->slice_tail != NULL) { printf("failure 13\n"); result = 0; } CudaBufferDeRegister(data); SCFree(d_buffer); SCFree(o_buffer); SCFree(p_buffer); return result; } #endif /* #ifdef UNITTESTS */ void CudaBufferRegisterUnittests(void) { #ifdef UNITTESTS UtRegisterTest("CudaBufferTest01", CudaBufferTest01); UtRegisterTest("CudaBufferTest02", CudaBufferTest02); UtRegisterTest("CudaBufferTest03", CudaBufferTest03); UtRegisterTest("CudaBufferTest04", CudaBufferTest04); UtRegisterTest("CudaBufferTest05", CudaBufferTest05); UtRegisterTest("CudaBufferTest06", CudaBufferTest06); #endif return; } #endif /* __SC_CUDA_SUPPORT__ */ suricata-3.2.1/src/detect-gid.h0000644000000000000000000000216613051004444013170 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the gid keyword */ #ifndef __DETECT_GID_H__ #define __DETECT_GID_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" /** * Registration function for gid: keyword */ void DetectGidRegister (void); /** * This function registers unit tests for Gid */ void GidRegisterTests(void); #endif /*__DETECT_GID_H__ */ suricata-3.2.1/src/output-flow.c0000644000000000000000000001426413051004444013461 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output-flow.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. http.log) with different output ctx'. */ typedef struct OutputFlowLogger_ { FlowLogger LogFunc; OutputCtx *output_ctx; struct OutputFlowLogger_ *next; const char *name; TmEcode (*ThreadInit)(ThreadVars *, void *, void **); TmEcode (*ThreadDeinit)(ThreadVars *, void *); void (*ThreadExitPrintStats)(ThreadVars *, void *); } OutputFlowLogger; static OutputFlowLogger *list = NULL; int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputFlowLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->output_ctx = output_ctx; op->name = name; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; if (list == NULL) list = op; else { OutputFlowLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterFlowLogger happy"); return 0; } /** \brief Run flow logger(s) * \note flow is already write locked */ TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f) { BUG_ON(thread_data == NULL); if (list == NULL) return TM_ECODE_OK; OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputFlowLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); logger = list; store = op_thread_data->store; while (logger && store) { BUG_ON(logger->LogFunc == NULL); SCLogDebug("logger %p", logger); //PACKET_PROFILING_LOGGER_START(p, logger->module_id); logger->LogFunc(tv, store->thread_data, f); //PACKET_PROFILING_LOGGER_END(p, logger->module_id); logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } return TM_ECODE_OK; } /** \brief thread init for the flow logger * This will run the thread init functions for the individual registered * loggers */ TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputFlowLogThreadInit happy (*data %p)", *data); OutputFlowLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } return TM_ECODE_OK; } TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFlowLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCFree(op_thread_data); return TM_ECODE_OK; } void OutputFlowLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputFlowLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputFlowShutdown(void) { OutputFlowLogger *logger = list; while (logger) { OutputFlowLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } list = NULL; } suricata-3.2.1/src/util-bloomfilter.c0000644000000000000000000001536713051004444014452 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Bitwise bloom filter implementation */ #include "suricata-common.h" #include "util-bloomfilter.h" #include "util-unittest.h" BloomFilter *BloomFilterInit(uint32_t size, uint8_t iter, uint32_t (*Hash)(const void *, uint16_t, uint8_t, uint32_t)) { BloomFilter *bf = NULL; if (size == 0 || iter == 0) goto error; if (Hash == NULL) { //printf("ERROR: BloomFilterInit no Hash function\n"); goto error; } /* setup the filter */ bf = SCMalloc(sizeof(BloomFilter)); if (unlikely(bf == NULL)) goto error; memset(bf,0,sizeof(BloomFilter)); bf->bitarray_size = size; bf->hash_iterations = iter; bf->Hash = Hash; /* setup the bitarray */ bf->bitarray = SCMalloc((bf->bitarray_size/8)+1); if (bf->bitarray == NULL) goto error; memset(bf->bitarray,0,(bf->bitarray_size/8)+1); return bf; error: if (bf != NULL) { if (bf->bitarray != NULL) SCFree(bf->bitarray); SCFree(bf); } return NULL; } void BloomFilterFree(BloomFilter *bf) { if (bf != NULL) { if (bf->bitarray != NULL) SCFree(bf->bitarray); SCFree(bf); } } void BloomFilterPrint(BloomFilter *bf) { printf("\n---------- Bloom Filter Stats -----------\n"); printf("Buckets: %" PRIu32 "\n", bf->bitarray_size); printf("Memory size: %" PRIu32 " bytes\n", bf->bitarray_size/8 + 1); printf("Hash function pointer: %p\n", bf->Hash); printf("Hash functions: %" PRIu32 "\n", bf->hash_iterations); printf("-----------------------------------------\n"); } int BloomFilterAdd(BloomFilter *bf, void *data, uint16_t datalen) { uint8_t iter = 0; uint32_t hash = 0; if (bf == NULL || data == NULL || datalen == 0) return -1; for (iter = 0; iter < bf->hash_iterations; iter++) { hash = bf->Hash(data, datalen, iter, bf->bitarray_size); bf->bitarray[hash/8] |= (1<bitarray_size/8) + 1); } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS static uint32_t BloomFilterTestHash(const void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) { uint8_t *d = (uint8_t *)data; uint32_t i; uint32_t hash = 0; for (i = 0; i < datalen; i++) { if (i == 0) hash += (((uint32_t)*d++)); else if (i == 1) hash += (((uint32_t)*d++) * datalen); else hash *= (((uint32_t)*d++) * i); } hash *= (iter + datalen); hash %= hash_size; return hash; } static int BloomFilterTestInit01 (void) { BloomFilter *bf = BloomFilterInit(1024, 4, BloomFilterTestHash); if (bf == NULL) return 0; BloomFilterFree(bf); return 1; } /* no hash function, so it should fail */ static int BloomFilterTestInit02 (void) { BloomFilter *bf = BloomFilterInit(1024, 4, NULL); if (bf == NULL) return 1; BloomFilterFree(bf); return 0; } static int BloomFilterTestInit03 (void) { int result = 0; BloomFilter *bf = BloomFilterInit(1024, 4, BloomFilterTestHash); if (bf == NULL) return 0; if (bf->Hash == BloomFilterTestHash) result = 1; BloomFilterFree(bf); return result; } static int BloomFilterTestInit04 (void) { BloomFilter *bf = BloomFilterInit(1024, 0, BloomFilterTestHash); if (bf == NULL) return 1; BloomFilterFree(bf); return 0; } static int BloomFilterTestInit05 (void) { BloomFilter *bf = BloomFilterInit(0, 4, BloomFilterTestHash); if (bf == NULL) return 1; BloomFilterFree(bf); return 0; } static int BloomFilterTestAdd01 (void) { int result = 0; BloomFilter *bf = BloomFilterInit(1024, 4, BloomFilterTestHash); if (bf == NULL) return 0; int r = BloomFilterAdd(bf, "test", 0); if (r == 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterFree(bf); return result; } static int BloomFilterTestAdd02 (void) { int result = 0; BloomFilter *bf = BloomFilterInit(1024, 4, BloomFilterTestHash); if (bf == NULL) return 0; int r = BloomFilterAdd(bf, NULL, 4); if (r == 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterFree(bf); return result; } static int BloomFilterTestFull01 (void) { int result = 0; BloomFilter *bf = BloomFilterInit(32, 4, BloomFilterTestHash); if (bf == NULL) goto end; int r = BloomFilterAdd(bf, "test", 4); if (r != 0) goto end; r = BloomFilterTest(bf, "test", 4); if (r != 1) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterFree(bf); return result; } static int BloomFilterTestFull02 (void) { int result = 0; BloomFilter *bf = BloomFilterInit(32, 4, BloomFilterTestHash); if (bf == NULL) goto end; int r = BloomFilterTest(bf, "test", 4); if (r != 0) goto end; /* all is good! */ result = 1; end: if (bf != NULL) BloomFilterFree(bf); return result; } #endif /* UNITTESTS */ void BloomFilterRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("BloomFilterTestInit01", BloomFilterTestInit01); UtRegisterTest("BloomFilterTestInit02", BloomFilterTestInit02); UtRegisterTest("BloomFilterTestInit03", BloomFilterTestInit03); UtRegisterTest("BloomFilterTestInit04", BloomFilterTestInit04); UtRegisterTest("BloomFilterTestInit05", BloomFilterTestInit05); UtRegisterTest("BloomFilterTestAdd01", BloomFilterTestAdd01); UtRegisterTest("BloomFilterTestAdd02", BloomFilterTestAdd02); UtRegisterTest("BloomFilterTestFull01", BloomFilterTestFull01); UtRegisterTest("BloomFilterTestFull02", BloomFilterTestFull02); #endif /* UNITTESTS */ } suricata-3.2.1/src/runmode-pfring.h0000644000000000000000000000211013051004444014100 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_PFRING_H__ #define __RUNMODE_PFRING_H__ #include "suricata-common.h" int RunModeIdsPfringAutoFp(void); int RunModeIdsPfringSingle(void); int RunModeIdsPfringWorkers(void); void RunModeIdsPfringRegister(void); const char *RunModeIdsPfringGetDefaultMode(void); #endif /* __RUNMODE_PFRING_H__ */ suricata-3.2.1/src/decode-sctp.c0000644000000000000000000000361713051004444013346 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Eric Leblond * * Decode SCTP */ #include "suricata-common.h" #include "decode.h" #include "decode-sctp.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" #include "util-optimize.h" #include "flow.h" static int DecodeSCTPPacket(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < SCTP_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, SCTP_PKT_TOO_SMALL); return -1; } p->sctph = (SCTPHdr *)pkt; SET_SCTP_SRC_PORT(p,&p->sp); SET_SCTP_DST_PORT(p,&p->dp); p->payload = pkt + sizeof(SCTPHdr); p->payload_len = len - sizeof(SCTPHdr); p->proto = IPPROTO_SCTP; return 0; } int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_sctp); if (unlikely(DecodeSCTPPacket(tv, p,pkt,len) < 0)) { p->sctph = NULL; return TM_ECODE_FAILED; } #ifdef DEBUG SCLogDebug("SCTP sp: %" PRIu32 " -> dp: %" PRIu32, SCTP_GET_SRC_PORT(p), SCTP_GET_DST_PORT(p)); #endif FlowSetupPacket(p); return TM_ECODE_OK; } /** * @} */ suricata-3.2.1/src/detect-engine-state.h0000644000000000000000000001716513051004444015015 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup sigstate * * @{ */ /** * \file * * \brief Data structures and function prototypes for keeping * state for the detection engine. * * \author Victor Julien * \author Anoop Saldanha */ /* On DeState and locking. * * The DeState is part of a flow, but it can't be protected by the flow lock. * Reason is we need to lock the DeState data for an entire detection run, * as we're looping through on "continued" detection and rely on only a single * detection instance setting it up on first run. We can't keep the entire flow * locked during detection for performance reasons, it would slow us down too * much. * * So a new lock was introduced. The only part of the process where we need * the flow lock is obviously when we're getting/setting the de_state ptr from * to the flow. */ #ifndef __DETECT_ENGINE_STATE_H__ #define __DETECT_ENGINE_STATE_H__ #define DETECT_ENGINE_INSPECT_SIG_NO_MATCH 0 #define DETECT_ENGINE_INSPECT_SIG_MATCH 1 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH 2 #define DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE 3 /** hack to work around a file inspection limitation. Since there can be * multiple files in a TX and the detection engine really don't know * about that, we have to give the file inspection engine a way to * indicate that one of the files matched, but that there are still * more files that have ongoing inspection. */ #define DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES 4 /** number of DeStateStoreItem's in one DeStateStore object */ #define DE_STATE_CHUNK_SIZE 15 /* per sig flags */ #define DE_STATE_FLAG_FULL_INSPECT BIT_U32(0) #define DE_STATE_FLAG_SIG_CANT_MATCH BIT_U32(1) #define DE_STATE_FLAG_DCE_PAYLOAD_INSPECT BIT_U32(2) #define DE_STATE_FLAG_FILE_TC_INSPECT BIT_U32(3) #define DE_STATE_FLAG_FILE_TS_INSPECT BIT_U32(4) /* first bit position after the built-ins */ #define DE_STATE_FLAG_BASE 5UL /* state flags */ #define DETECT_ENGINE_STATE_FLAG_FILE_STORE_DISABLED 0x0001 #define DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW 0x0002 #define DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW 0x0004 /* We have 2 possible state values to be used by ContinueDetection() while * trying to figure if we have fresh state to install or not. * * For tx based alprotos, we don't need to indicate the below values on a * per sig basis, but for non-tx based alprotos we do, since we might have * new alstate coming in, and some sigs might have already matchced in * de_state and ContinueDetection needs to inform the detection filter that * it no longer needs to inspect this sig, since ContinueDetection would * handle it. * * Wrt tx based alprotos, if we have a new tx available apart from the one * currently being inspected(and also added to de_state), we continue with * the HAS_NEW_STATE flag, while if we don't have a new tx, we set * NO_NEW_STATE, to avoid getting the sig reinspected for the already * inspected tx. */ #define DE_STATE_MATCH_HAS_NEW_STATE 0x00 #define DE_STATE_MATCH_NO_NEW_STATE 0x80 /* TX BASED (inspect engines) */ typedef struct DeStateStoreItem_ { uint32_t flags; SigIntId sid; } DeStateStoreItem; typedef struct DeStateStore_ { DeStateStoreItem store[DE_STATE_CHUNK_SIZE]; struct DeStateStore_ *next; } DeStateStore; typedef struct DetectEngineStateDirection_ { DeStateStore *head; DeStateStore *tail; SigIntId cnt; uint16_t filestore_cnt; uint8_t flags; } DetectEngineStateDirection; typedef struct DetectEngineState_ { DetectEngineStateDirection dir_state[2]; } DetectEngineState; /* FLOW BASED (AMATCH) */ typedef struct DeStateStoreFlowRule_ { SigMatch *nm; uint32_t flags; SigIntId sid; } DeStateStoreFlowRule; typedef struct DeStateStoreFlowRules_ { DeStateStoreFlowRule store[DE_STATE_CHUNK_SIZE]; struct DeStateStoreFlowRules_ *next; } DeStateStoreFlowRules; typedef struct DetectEngineStateDirectionFlow_ { DeStateStoreFlowRules *head; DeStateStoreFlowRules *tail; SigIntId cnt; uint8_t flags; } DetectEngineStateDirectionFlow; typedef struct DetectEngineStateFlow_ { DetectEngineStateDirectionFlow dir_state[2]; } DetectEngineStateFlow; /** * \brief Alloc a DetectEngineState object. * * \retval Alloc'd instance of DetectEngineState. */ DetectEngineState *DetectEngineStateAlloc(void); /** * \brief Frees a DetectEngineState object. * * \param state DetectEngineState instance to free. */ void DetectEngineStateFree(DetectEngineState *state); void DetectEngineStateFlowFree(DetectEngineStateFlow *state); /** * \brief Check if a flow already contains(newly updated as well) de state. * * \param f Pointer to the flow. * \param alversino The alversion to check against de_state's. * \param direction Direction to check. 0 - ts, 1 - tc. * * \retval 1 Has state. * \retval 0 Has no state. */ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint8_t alversion, uint8_t flags); /** * \brief Match app layer sig list against app state and store relevant match * information. * * \param tv Pointer to the threadvars. * \param de_ctx DetectEngineCtx instance. * \param det_ctx DetectEngineThreadCtx instance. * \param s Pointer to the signature. * \param f Pointer to the flow. * \param flags Flags. * \param alproto App protocol. * \param alversion Current app layer version. * * \retval >= 0 An integer value indicating the no of matches. */ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, Flow *f, uint8_t flags, AppProto alproto, uint8_t alversion); /** * \brief Continue DeState detection of the signatures stored in the state. * * \param tv Pointer to the threadvars. * \param de_ctx DetectEngineCtx instance. * \param det_ctx DetectEngineThreadCtx instance. * \param f Pointer to the flow. * \param flags Flags. * \param alproto App protocol. * \param alversion Current app layer version. */ void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, uint8_t flags, AppProto alproto, uint8_t alversion); /** * \brief Update the inspect id. * * \param f unlocked flow * \param flags direction and disruption flags */ void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags); /** * \brief Reset a DetectEngineState state. * * \param state Pointer to the state(LOCKED). * \param direction Direction flags - STREAM_TOSERVER or STREAM_TOCLIENT. */ void DetectEngineStateReset(DetectEngineStateFlow *state, uint8_t direction); void DetectEngineStateResetTxs(Flow *f); void DeStateRegisterTests(void); #endif /* __DETECT_ENGINE_STATE_H__ */ /** * @} */ suricata-3.2.1/src/win32-service.c0000644000000000000000000002455413051004444013557 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ondrej Slanina * * Windows service functions */ #ifdef OS_WIN32 #include "suricata-common.h" #include "suricata.h" #include "win32-service.h" static SERVICE_STATUS_HANDLE service_status_handle = 0; static int service_argc = 0; static char **service_argv = NULL; static int service_initialized = 0; int main(int argc, char **argv); /** * \brief Detect if running as service or console app */ int SCRunningAsService(void) { HANDLE h = INVALID_HANDLE_VALUE; if ((h = CreateFile("CONIN$", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, 0)) == INVALID_HANDLE_VALUE) { SCLogInfo("Running as service: yes"); return 1; } CloseHandle(h); SCLogInfo("Running as service: no"); return 0; } /** * \brief Detect if running as service or console app */ void SCAtExitHandler(void) { SERVICE_STATUS status = { SERVICE_WIN32, SERVICE_STOPPED, SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN, NO_ERROR, NO_ERROR, 0, 0 }; SCLogInfo("Exit handler called."); /* mark service as stopped */ if (!SetServiceStatus(service_status_handle, &status)) { SCLogWarning(SC_ERR_SVC, "Can't set service status: %d", (int)GetLastError()); } else { SCLogInfo("Service status set to: SERVICE_STOPPED"); } } /** * \brief Service handler */ static DWORD WINAPI SCServiceCtrlHandlerEx(DWORD code, DWORD etype, LPVOID edata, LPVOID context) { if (code == SERVICE_CONTROL_SHUTDOWN || code == SERVICE_CONTROL_STOP) { SERVICE_STATUS status = { SERVICE_WIN32, SERVICE_STOP_PENDING, SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN, NO_ERROR, NO_ERROR, 0, 0 }; SCLogInfo("Service control handler called with %s control code.", ((code == SERVICE_CONTROL_SHUTDOWN) ? ("SERVICE_CONTROL_SHUTDOWN") : ("SERVICE_CONTROL_STOP"))); /* mark service as stop pending */ if (!SetServiceStatus(service_status_handle, &status)) { SCLogWarning(SC_ERR_SVC, "Can't set service status: %d", (int)GetLastError()); } else { SCLogInfo("Service status set to: SERVICE_STOP_PENDING"); } /* mark engine as stopping */ EngineStop(); return NO_ERROR; } return ERROR_CALL_NOT_IMPLEMENTED; } /** * \brief Service main function */ static void WINAPI SCServiceMain(uint32_t argc, char** argv) { SERVICE_STATUS status = { SERVICE_WIN32, SERVICE_RUNNING, SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN, NO_ERROR, NO_ERROR, 0, 0 }; if ((service_status_handle = RegisterServiceCtrlHandlerEx(PROG_NAME, SCServiceCtrlHandlerEx, NULL)) == (SERVICE_STATUS_HANDLE)0) { SCLogError(SC_ERR_SVC, "Can't register service control handler: %d", (int)GetLastError()); return; } /* register exit handler */ if (atexit(SCAtExitHandler)) { SCLogWarning(SC_ERR_SVC, "Can't register exit handler: %d", (int)GetLastError()); } /* mark service as running immediately */ if (!SetServiceStatus(service_status_handle, &status)) { SCLogWarning(SC_ERR_SVC, "Can't set service status: %d", (int)GetLastError()); } else { SCLogInfo("Service status set to: SERVICE_RUNNING"); } SCLogInfo("Entering main function..."); /* suricata initialization -> main loop -> uninitialization */ main(service_argc, service_argv); SCLogInfo("Leaving main function."); /* mark service as stopped */ status.dwCurrentState = SERVICE_STOPPED; if (!SetServiceStatus(service_status_handle, &status)) { SCLogWarning(SC_ERR_SVC, "Can't set service status: %d", (int)GetLastError()); } else { SCLogInfo("Service status set to: SERVICE_STOPPED"); } } /** * \brief Init suricata service * * \param argc num of arguments * \param argv passed arguments */ int SCServiceInit(int argc, char **argv) { SERVICE_TABLE_ENTRY DispatchTable[] = { {PROG_NAME, (LPSERVICE_MAIN_FUNCTION) SCServiceMain}, {NULL, NULL} }; /* continue with suricata initialization */ if (service_initialized) { SCLogWarning(SC_ERR_SVC, "Service is already initialized."); return 0; } /* save args */ service_argc = argc; service_argv = argv; service_initialized = 1; SCLogInfo("Entering service control dispatcher..."); if (!StartServiceCtrlDispatcher(DispatchTable)) { /* exit with failure */ exit(EXIT_FAILURE); } SCLogInfo("Leaving service control dispatcher."); /* exit with success */ exit(EXIT_SUCCESS); } /** * \brief Install suricata as service * * \param argc num of arguments * \param argv passed arguments */ int SCServiceInstall(int argc, char **argv) { char path[2048]; SC_HANDLE service = NULL; SC_HANDLE scm = NULL; int ret = -1; int i = 0; do { memset(path, 0, sizeof(path)); if (GetModuleFileName(NULL, path, MAX_PATH) == 0 ){ SCLogError(SC_ERR_SVC, "Can't get path to service binary: %d", (int)GetLastError()); break; } /* skip name of binary itself */ for (i = 1; i < argc; i++) { if ((strlen(argv[i]) <= strlen("--service-install")) && (strncmp("--service-install", argv[i], strlen(argv[i])) == 0)) { continue; } strlcat(path, " ", sizeof(path) - strlen(path) - 1); strlcat(path, argv[i], sizeof(path) - strlen(path) - 1); } if ((scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS)) == NULL) { SCLogError(SC_ERR_SVC, "Can't open SCM: %d", (int)GetLastError()); break; } service = CreateService( scm, PROG_NAME, PROG_NAME, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, path, NULL, NULL, NULL, NULL, NULL); if (service == NULL) { SCLogError(SC_ERR_SVC, "Can't create service: %d", (int)GetLastError()); break; } ret = 0; } while(0); if (service) { CloseServiceHandle(service); } if (scm) { CloseServiceHandle(scm); } return ret; } /** * \brief Remove suricata service * * \param argc num of arguments * \param argv passed arguments */ int SCServiceRemove(int argc, char **argv) { SERVICE_STATUS status; SC_HANDLE service = NULL; SC_HANDLE scm = NULL; int ret = -1; do { if ((scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS)) == NULL) { SCLogError(SC_ERR_SVC, "Can't open SCM: %d", (int)GetLastError()); break; } if ((service = OpenService(scm, PROG_NAME, SERVICE_ALL_ACCESS)) == NULL) { SCLogError(SC_ERR_SVC, "Can't open service: %d", (int)GetLastError()); break; } if (!QueryServiceStatus(service, &status)) { SCLogError(SC_ERR_SVC, "Can't query service status: %d", (int)GetLastError()); break; } if (status.dwCurrentState != SERVICE_STOPPED) { SCLogError(SC_ERR_SVC, "Service isn't in stopped state: %d", (int)GetLastError()); break; } if (!DeleteService(service)) { SCLogError(SC_ERR_SVC, "Can't delete service: %d", (int)GetLastError()); break; } ret = 0; } while(0); if (service) { CloseServiceHandle(service); } if (scm) { CloseServiceHandle(scm); } return ret; } /** * \brief Change suricata service startup parameters * * \param argc num of arguments * \param argv passed arguments */ int SCServiceChangeParams(int argc, char **argv) { char path[2048]; SC_HANDLE service = NULL; SC_HANDLE scm = NULL; int ret = -1; int i = 0; do { memset(path, 0, sizeof(path)); if (GetModuleFileName(NULL, path, MAX_PATH) == 0 ){ SCLogError(SC_ERR_SVC, "Can't get path to service binary: %d", (int)GetLastError()); break; } /* skip name of binary itself */ for (i = 1; i < argc; i++) { if ((strlen(argv[i]) <= strlen("--service-change-params")) && (strncmp("--service-change-params", argv[i], strlen(argv[i])) == 0)) { continue; } strlcat(path, " ", sizeof(path) - strlen(path) - 1); strlcat(path, argv[i], sizeof(path) - strlen(path) - 1); } if ((scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS)) == NULL) { SCLogError(SC_ERR_SVC, "Can't open SCM: %d", (int)GetLastError()); break; } if ((service = OpenService(scm, PROG_NAME, SERVICE_ALL_ACCESS)) == NULL) { SCLogError(SC_ERR_SVC, "Can't open service: %d", (int)GetLastError()); break; } if (!ChangeServiceConfig( service, SERVICE_WIN32_OWN_PROCESS, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL, path, NULL, NULL, NULL, NULL, NULL, PROG_NAME)) { SCLogError(SC_ERR_SVC, "Can't change service configuration: %d", (int)GetLastError()); break; } ret = 0; } while(0); return ret; } #endif /* OS_WIN32 */ suricata-3.2.1/src/detect-engine-template.c0000644000000000000000000000420013051004444015465 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /* * TODO: Update your name below and in detect-engine-template.h. * TODO: Update description in the \file section below. * TODO: Remove SCLogNotice statements or convert to debug. */ /** * \file * * \author FirstName LastName * * Implement buffer inspection on the decoded application layer * content buffers. */ #include "suricata-common.h" #include "stream.h" #include "detect-engine-content-inspection.h" #include "app-layer-template.h" int DetectEngineInspectTemplateBuffer(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { TemplateTransaction *tx = (TemplateTransaction *)txv; int ret = 0; if (flags & STREAM_TOSERVER && tx->request_buffer != NULL) { ret = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH], f, tx->request_buffer, tx->request_buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } else if (flags & STREAM_TOCLIENT && tx->response_buffer != NULL) { ret = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH], f, tx->response_buffer, tx->response_buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } SCLogNotice("Returning %d.", ret); return ret; } suricata-3.2.1/src/detect-cipservice.h0000644000000000000000000000507213051004444014560 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong */ #ifndef _DETECT_CIPSERVICE_H #define _DETECT_CIPSERVICE_H #include "app-layer-protos.h" #include "app-layer-parser.h" #include "flow.h" #include "queue.h" #include "app-layer-enip-common.h" #define ENIP_PORT 44818 //standard EtherNet/IP port /** * CIP Service rule data structure */ typedef struct DetectCipServiceData_ { uint8_t cipservice; /* cip service type */ uint16_t cipclass; uint16_t cipattribute; uint8_t matchattribute; /* whether to match on attribute*/ uint8_t tokens; /* number of parameters*/ } DetectCipServiceData; /** * ENIP Command rule data structure */ typedef struct DetectEnipCommandData_ { uint16_t enipcommand; /* enip command */ } DetectEnipCommandData; void DetectCipServiceRegister(void); void DetectEnipCommandRegister(void); /** * link list node for storing CIP service data */ typedef struct CIPServiceData_ { uint8_t service; //cip service union { struct { uint8_t path_size; //cip path size uint16_t path_offset; //offset to cip path } request; struct { uint8_t status; } response; }; struct CIPServiceData* next; } CIPServiceData; /** * ENIP data structure */ typedef struct ENIPData_ { int direction; ENIPEncapHdr header; //encapsulation header ENIPEncapDataHdr encap_data_header; //encapsulation data header ENIPEncapAddresItem encap_addr_item; //encapsulated address item ENIPEncapDataItem encap_data_item; //encapsulated data item CIPServiceData* service_head; //head of cip service data list CIPServiceData* service_tail; //tail of cip service data list } ENIPData; /** * Add new CIPServiceData node to link list */ CIPServiceData *CreateCIPServiceData(ENIPData *enip_data); #endif /* _DETECT_CIPSERVICE_H */ suricata-3.2.1/src/detect-fast-pattern.c0000644000000000000000000224653713051004444015046 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements the fast_pattern keyword */ #include "suricata-common.h" #include "detect.h" #include "flow.h" #include "detect-content.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-fast-pattern.h" #include "util-error.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #define PARSE_REGEX "^(\\s*only\\s*)|\\s*([0-9]+)\\s*,\\s*([0-9]+)\\s*$" static pcre *parse_regex = NULL; static pcre_extra *parse_regex_study = NULL; static int DetectFastPatternSetup(DetectEngineCtx *, Signature *, char *); void DetectFastPatternRegisterTests(void); /* holds the list of sm match lists that need to be searched for a keyword * that has fp support */ SCFPSupportSMList *sm_fp_support_smlist_list = NULL; /** * \brief Lets one add a sm list id to be searched for potential fp supported * keywords later. * * \param list_id SM list id. * \param priority Priority for this list. */ void SupportFastPatternForSigMatchList(int list_id, int priority) { SCFPSupportSMList *ip = NULL; /* insertion point - ip */ for (SCFPSupportSMList *tmp = sm_fp_support_smlist_list; tmp != NULL; tmp = tmp->next) { if (list_id == tmp->list_id) { SCLogDebug("SM list already registered."); return; } if (priority <= tmp->priority) break; ip = tmp; } if (sm_fp_support_smlist_list == NULL) { SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList)); if (unlikely(new == NULL)) exit(EXIT_FAILURE); memset(new, 0, sizeof(SCFPSupportSMList)); new->list_id = list_id; new->priority = priority; sm_fp_support_smlist_list = new; return; } SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList)); if (unlikely(new == NULL)) exit(EXIT_FAILURE); memset(new, 0, sizeof(SCFPSupportSMList)); new->list_id = list_id; new->priority = priority; if (ip == NULL) { new->next = sm_fp_support_smlist_list; sm_fp_support_smlist_list = new; } else { new->next = ip->next; ip->next = new; } return; } /** * \brief Registers the keywords(SMs) that should be given fp support. */ void SupportFastPatternForSigMatchTypes(void) { SupportFastPatternForSigMatchList(DETECT_SM_LIST_PMATCH, 3); /* other types are handled by DetectMpmAppLayerRegister() */ #if 0 SCFPSupportSMList *tmp = sm_fp_support_smlist_list; while (tmp != NULL) { printf("%d - %d\n", tmp->list_id, tmp->priority); tmp = tmp->next; } #endif return; } /** * \brief Registration function for fast_pattern keyword */ void DetectFastPatternRegister(void) { sigmatch_table[DETECT_FAST_PATTERN].name = "fast_pattern"; sigmatch_table[DETECT_FAST_PATTERN].desc = "force using preceding content in the multi pattern matcher"; sigmatch_table[DETECT_FAST_PATTERN].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#fast-pattern"; sigmatch_table[DETECT_FAST_PATTERN].Match = NULL; sigmatch_table[DETECT_FAST_PATTERN].Setup = DetectFastPatternSetup; sigmatch_table[DETECT_FAST_PATTERN].Free = NULL; sigmatch_table[DETECT_FAST_PATTERN].RegisterTests = DetectFastPatternRegisterTests; sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_FAST_PATTERN].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } //static int DetectFastPatternParseArg( /** * \brief Configures the previous content context for a fast_pattern modifier * keyword used in the rule. * * \param de_ctx Pointer to the Detection Engine Context. * \param s Pointer to the Signature to which the current keyword belongs. * \param null_str Should hold an empty string always. * * \retval 0 On success. * \retval -1 On failure. */ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char arg_substr[128] = ""; DetectContentData *cd = NULL; if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_TLSSNI_MATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_TLSISSUER_MATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_TLSSUBJECT_MATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_HTTP_REQLINEMATCH] == NULL) { SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the " "rule, without a preceding content based keyword. " "Currently we provide fast_pattern support for content, " "uricontent, http_client_body, http_server_body, http_header, " "http_raw_header, http_method, http_cookie, " "http_raw_uri, http_stat_msg, http_stat_code, " "http_user_agent, http_host, http_raw_host, " "http_request_line, dns_query, " "tls_sni, tls_cert_issuer or tls_cert_subject option"); return -1; } SigMatch *pm = SigMatchGetLastSMFromLists(s, 38, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HTTP_REQLINEMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_DNSQUERYNAME_MATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_TLSSNI_MATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_TLSISSUER_MATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_TLSSUBJECT_MATCH]); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " "the rule, without a content context. Please use a " "content based keyword before using fast_pattern"); return -1; } cd = (DetectContentData *)pm->ctx; if ((cd->flags & DETECT_CONTENT_NEGATED) && ((cd->flags & DETECT_CONTENT_DISTANCE) || (cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_OFFSET) || (cd->flags & DETECT_CONTENT_DEPTH))) { /* we can't have any of these if we are having "only" */ SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be " "used with negated content, along with relative modifiers"); goto error; } if (arg == NULL|| strcmp(arg, "") == 0) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple fast_pattern " "options for the same content"); goto error; } else { /*allow only one content to have fast_pattern modifier*/ int list_id = 0; for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) { SigMatch *sm = NULL; for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *tmp_cd = (DetectContentData *)sm->ctx; if (tmp_cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern " "can be used on only one content in a rule"); goto error; } } } /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */ } } cd->flags |= DETECT_CONTENT_FAST_PATTERN; return 0; } /* Execute the regex and populate args with captures. */ ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); /* fast pattern only */ if (ret == 2) { if ((cd->flags & DETECT_CONTENT_NEGATED) || (cd->flags & DETECT_CONTENT_DISTANCE) || (cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_OFFSET) || (cd->flags & DETECT_CONTENT_DEPTH)) { /* we can't have any of these if we are having "only" */ SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be " "used with negated content or with any of the relative " "modifiers like distance, within, offset, depth"); goto error; } cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; /* fast pattern chop */ } else if (ret == 4) { res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, 2, arg_substr, sizeof(arg_substr)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed " "for fast_pattern offset"); goto error; } int offset = atoi(arg_substr); if (offset > 65535) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern offset exceeds " "limit"); goto error; } res = pcre_copy_substring((char *)arg, ov, MAX_SUBSTRINGS, 3, arg_substr, sizeof(arg_substr)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed " "for fast_pattern offset"); goto error; } int length = atoi(arg_substr); if (length > 65535) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern length exceeds " "limit"); goto error; } if (offset + length > 65535) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + offset) " "exceeds limit pattern length limit"); goto error; } if (offset + length > cd->content_len) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Fast pattern (length + " "offset (%u)) exceeds pattern length (%u)", offset + length, cd->content_len); goto error; } cd->fp_chop_offset = offset; cd->fp_chop_len = length; cd->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; } else { SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32 ", string %s", ret, arg); goto error; } //int args; //args = 0; //printf("ret-%d\n", ret); //for (args = 0; args < ret; args++) { // res = pcre_get_substring((char *)arg, ov, MAX_SUBSTRINGS, // args, &arg_substr); // if (res < 0) { // SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed " // "for arg 1"); // goto error; // } // printf("%d-%s\n", args, arg_substr); //} cd->flags |= DETECT_CONTENT_FAST_PATTERN; return 0; error: return -1; } /*----------------------------------Unittests---------------------------------*/ #ifdef UNITTESTS /** * \test Checks if a fast_pattern is registered in a Signature */ int DetectFastPatternTest01(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; tcpv4-csum:valid; fast_pattern; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature */ int DetectFastPatternTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern; " "content:\"boo\"; fast_pattern; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks that we have no fast_pattern registerd for a Signature when the * Signature doesn't contain a fast_pattern */ int DetectFastPatternTest03(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( !(((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)) { result = 1; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks that a fast_pattern is not registered in a Signature, when we * supply a fast_pattern with an argument */ int DetectFastPatternTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:boo; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks to make sure that other sigs work that should when fast_pattern is inspecting on the same payload * */ int DetectFastPatternTest14(void) { uint8_t *buf = (uint8_t *) "Dummy is our name. Oh yes. From right here " "right now, all the way to hangover. right. strings5_imp now here " "comes our dark knight strings_string5. Yes here is our dark knight"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int alertcnt = 0; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf,buflen,IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; FlowInitConfig(FLOW_QUIET); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"fast_pattern test\"; content:\"strings_string5\"; content:\"knight\"; fast_pattern; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test different content\"; content:\"Dummy is our name\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)){ alertcnt++; }else{ SCLogInfo("could not match on sig 1 with when fast_pattern is inspecting payload"); goto end; } if (PacketAlertCheck(p, 2)){ result = 1; }else{ SCLogInfo("match on sig 1 fast_pattern no match sig 2 inspecting same payload"); } end: UTHFreePackets(&p, 1); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FlowShutdown(); return result; } /** * \test Checks if a fast_pattern is registered in a Signature */ int DetectFastPatternTest15(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature */ int DetectFastPatternTest16(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest17(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; DetectContentData *cd = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest18(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; DetectContentData *cd = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest19(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:only; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest20(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; distance:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest21(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:only; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; within:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:only; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; offset:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:only; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; depth:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; content:\"two\"; distance:30; content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; within:30; content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; offset:30; content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; depth:30; content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; content:\"two\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_NEGATED && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && cd->fp_chop_offset == 0 && cd->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; fast_pattern; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; fast_pattern; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; fast_pattern; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; fast_pattern; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest37(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; content:\"oneonetwo\"; fast_pattern:3,4; content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest38(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest39(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest40(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest41(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"twotwotwo\"; fast_pattern:3,4; content:\"three\"; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest42(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; distance:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest43(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; within:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest44(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; offset:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest45(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; depth:10; content:\"threethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest46(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:65977,4; content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest47(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"twooneone\"; fast_pattern:3,65977; content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest48(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:\"two\"; fast_pattern:65534,4; content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest49(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_NEGATED && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && cd->fp_chop_offset == 3 && cd->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest50(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; distance:10; content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest51(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; within:10; content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest52(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; offset:10; content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest53(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; depth:10; content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* content fast_pattern tests ^ */ /* uricontent fast_pattern tests v */ /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest54(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"/one/\"; fast_pattern:only; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest55(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"oneoneone\"; fast_pattern:3,4; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest56(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest57(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"oneoneone\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest58(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest59(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; distance:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest60(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest61(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; within:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest62(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest63(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; offset:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest64(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:only; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest65(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; depth:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest66(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest67(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent: \"one\"; uricontent:\"two\"; distance:30; uricontent:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest68(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; within:30; uricontent:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest69(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; offset:30; uricontent:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest70(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; depth:30; uricontent:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest71(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:!\"one\"; fast_pattern; uricontent:\"two\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest72(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest73(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest74(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest75(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; uricontent:!\"one\"; fast_pattern; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest76(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest77(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest78(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest79(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest80(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest81(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; distance:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest82(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; within:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest83(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; offset:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest84(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; depth:10; uricontent:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest85(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65977,4; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest86(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"oneonetwo\"; fast_pattern:3,65977; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest87(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; fast_pattern:65534,4; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest88(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest89(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; distance:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest90(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; within:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest91(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; offset:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest92(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:!\"oneonetwo\"; fast_pattern:3,4; depth:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* uricontent fast_pattern tests ^ */ /* http_uri fast_pattern tests v */ int DetectFastPatternTest93(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest94(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_uri; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest95(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { result = 0; break; } } sm = sm->next; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest96(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest97(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (sm->type == DETECT_CONTENT) { if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest98(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest99(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; distance:10; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest100(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest101(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; within:10; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest102(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest103(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; offset:10; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest104(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:only; http_uri; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest105(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; depth:10; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest106(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"two\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest107(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent: \"one\"; uricontent:\"two\"; distance:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest108(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; within:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest109(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; offset:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest110(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; depth:30; content:\"two\"; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest111(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_uri; uricontent:\"two\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest112(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest113(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest114(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest115(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"two\"; content:!\"one\"; fast_pattern; http_uri; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest116(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest117(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest118(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest119(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest120(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest121(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest122(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest123(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest124(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; uricontent:\"two\"; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest125(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:65977,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest126(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"oneonetwo\"; fast_pattern:3,65977; http_uri; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest127(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:\"two\"; fast_pattern:65534,4; http_uri; uricontent:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest128(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest129(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; distance:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest130(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; within:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest131(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"twooneone\"; fast_pattern:3,4; http_uri; offset:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest132(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; depth:10; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest133(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; content:!\"oneonetwo\"; fast_pattern:3,4; http_uri; uricontent:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_uri fast_pattern tests ^ */ /* http_client_body fast_pattern tests v */ int DetectFastPatternTest134(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest135(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_client_body; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest136(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest137(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest138(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCBDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest139(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest140(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; distance:10; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest141(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest142(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; within:10; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest143(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest144(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; offset:10; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest145(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:only; http_client_body; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest146(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; depth:10; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest147(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"two\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest148(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; http_client_body; content:\"two\"; http_client_body; distance:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest149(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest150(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest151(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:30; content:\"two\"; fast_pattern:only; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest152(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_client_body; content:\"two\"; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest153(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest154(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest155(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest156(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_client_body; content:!\"one\"; fast_pattern; http_client_body; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest157(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest158(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest159(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest160(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest161(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest162(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest163(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest164(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest165(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; http_client_body; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest166(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65977,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest167(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"oneonetwo\"; fast_pattern:3,65977; http_client_body; content:\"three\"; distance:10; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest168(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:\"two\"; fast_pattern:65534,4; http_client_body; content:\"three\"; http_client_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest169(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest170(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; distance:10; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest171(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; within:10; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest172(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"twooneone\"; fast_pattern:3,4; http_client_body; offset:10; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest173(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; depth:10; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest174(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_client_body; content:!\"oneonetwo\"; fast_pattern:3,4; http_client_body; content:\"three\"; http_client_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_client_body fast_pattern tests ^ */ /* content fast_pattern tests v */ int DetectFastPatternTest175(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; distance:20; fast_pattern; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest176(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; within:20; fast_pattern; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest177(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; offset:20; fast_pattern; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest178(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; content:!\"one\"; depth:20; fast_pattern; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* content fast_pattern tests ^ */ /* http_header fast_pattern tests v */ int DetectFastPatternTest179(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_header; " "content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest180(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_header; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest181(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_header; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest182(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest183(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest184(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest185(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; distance:10; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest186(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest187(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; within:10; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest188(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest189(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; offset:10; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest190(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:only; http_header; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest191(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; depth:10; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest192(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"two\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest193(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; http_header; content:\"two\"; http_header; distance:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest194(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; within:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest195(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; offset:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest196(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; depth:30; content:\"two\"; fast_pattern:only; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest197(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_header; content:\"two\"; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest198(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest199(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest200(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest201(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_header; content:!\"one\"; fast_pattern; http_header; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest202(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest203(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest204(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest205(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest206(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest207(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest208(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest209(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest210(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; http_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest211(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65977,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest212(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_header; content:\"three\"; distance:10; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest213(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:\"two\"; fast_pattern:65534,4; http_header; content:\"three\"; http_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest214(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest215(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; distance:10; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest216(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; within:10; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest217(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; offset:10; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest218(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; depth:10; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest219(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_header; content:\"three\"; http_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_header fast_pattern tests ^ */ /* http_raw_header fast_pattern tests v */ int DetectFastPatternTest220(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; " "content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest221(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"/one/\"; fast_pattern:only; http_raw_header; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest222(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest223(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest224(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"oneoneone\"; fast_pattern:3,4; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest225(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest226(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; distance:10; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest227(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest228(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; within:10; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest229(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest230(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; offset:10; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest231(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:only; http_raw_header; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest232(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; depth:10; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest233(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"two\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest234(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content: \"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest235(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest236(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest237(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:30; content:\"two\"; fast_pattern:only; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest238(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:!\"one\"; fast_pattern; http_raw_header; content:\"two\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest239(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest240(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest241(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest242(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"two\"; http_raw_header; content:!\"one\"; fast_pattern; http_raw_header; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest243(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest244(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest245(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest246(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest247(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest248(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest249(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest250(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest251(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; http_raw_header; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest252(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65977,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest253(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_header; content:\"three\"; distance:10; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest254(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:\"two\"; fast_pattern:65534,4; http_raw_header; content:\"three\"; http_raw_header; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest255(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest256(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; distance:10; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest257(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; within:10; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest258(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; offset:10; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest259(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; depth:10; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest260(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(flow:to_server; content:\"one\"; http_raw_header; content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_header; content:\"three\"; http_raw_header; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_raw_header fast_pattern tests ^ */ /* http_method fast_pattern tests v */ int DetectFastPatternTest261(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_method; " "content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest262(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_method; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest263(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_method; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest264(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest265(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HMDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest266(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest267(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; distance:10; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest268(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest269(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; within:10; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest270(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest271(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; offset:10; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest272(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:only; http_method; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest273(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; depth:10; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest274(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"two\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest275(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; http_method; content:\"two\"; http_method; distance:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest276(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; within:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest277(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; offset:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest278(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; depth:30; content:\"two\"; fast_pattern:only; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest279(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_method; content:\"two\"; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest280(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest281(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest282(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest283(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_method; content:!\"one\"; fast_pattern; http_method; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest284(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest285(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest286(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest287(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest288(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest289(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest290(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest291(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest292(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; http_method; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest293(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65977,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest294(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"oneonetwo\"; fast_pattern:3,65977; http_method; content:\"three\"; distance:10; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest295(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:\"two\"; fast_pattern:65534,4; http_method; content:\"three\"; http_method; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest296(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest297(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; distance:10; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest298(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; within:10; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest299(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; offset:10; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest300(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; depth:10; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest301(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_method; content:!\"oneonetwo\"; fast_pattern:3,4; http_method; content:\"three\"; http_method; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_method fast_pattern tests ^ */ /* http_cookie fast_pattern tests v */ int DetectFastPatternTest302(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; " "content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest303(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_cookie; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest304(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest305(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest306(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HCDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest307(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest308(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; distance:10; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest309(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest310(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; within:10; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest311(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest312(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; offset:10; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest313(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:only; http_cookie; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest314(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; depth:10; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest315(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"two\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest316(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; http_cookie; content:\"two\"; http_cookie; distance:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest317(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest318(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest319(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:30; content:\"two\"; fast_pattern:only; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest320(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_cookie; content:\"two\"; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest321(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest322(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest323(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest324(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_cookie; content:!\"one\"; fast_pattern; http_cookie; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest325(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest326(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest327(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest328(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest329(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest330(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; distance:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest331(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; within:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest332(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; offset:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest333(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; http_cookie; depth:10; content:\"oneonethree\"; fast_pattern:3,4; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest334(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65977,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest335(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"oneonetwo\"; fast_pattern:3,65977; http_cookie; content:\"three\"; distance:10; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest336(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:\"two\"; fast_pattern:65534,4; http_cookie; content:\"three\"; http_cookie; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest337(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest338(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; distance:10; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest339(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; within:10; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest340(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; offset:10; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest341(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; depth:10; content:\"three2\"; http_cookie; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest342(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_cookie; content:!\"oneonetwo\"; fast_pattern:3,4; http_cookie; content:\"three\"; http_cookie; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_cookie fast_pattern tests ^ */ /* http_raw_uri fast_pattern tests v */ int DetectFastPatternTest343(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest344(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; fast_pattern:only; http_raw_uri; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest345(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest346(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest347(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRUDMATCH]; DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest348(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:only; http_raw_uri; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest349(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; distance:10; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest350(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:only; http_raw_uri; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest351(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; within:10; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest352(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:only; http_raw_uri; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest353(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; offset:10; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest354(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:only; http_raw_uri; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest355(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; depth:10; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest356(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"two\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest357(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content: \"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; distance:30; " "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest358(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; within:30; " "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest359(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; offset:30; " "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest360(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; depth:30; " "content:\"two\"; fast_pattern:only; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest361(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_raw_uri; " "content:\"two\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest362(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_uri; " "content:!\"one\"; fast_pattern; http_raw_uri; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest363(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_uri; " "content:!\"one\"; fast_pattern; http_raw_uri; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest364(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_uri; " "content:!\"one\"; fast_pattern; http_raw_uri; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest365(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_uri; " "content:!\"one\"; fast_pattern; http_raw_uri; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest366(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest367(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest368(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest369(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest370(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest371(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest372(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest373(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest374(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; http_raw_uri; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest375(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:65977,4; http_raw_uri; " "content:\"three\"; http_raw_uri; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest376(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_uri; " "content:\"three\"; distance:10; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest377(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:\"two\"; fast_pattern:65534,4; http_raw_uri; " "content:\"three\"; http_raw_uri; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest378(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest379(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; distance:10; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest380(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; within:10; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest381(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; offset:10; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest382(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; depth:10; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest383(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_uri; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_uri; " "content:\"three\"; http_raw_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_raw_uri fast_pattern tests ^ */ /* http_stat_msg fast_pattern tests v */ int DetectFastPatternTest384(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest385(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_stat_msg; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest386(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest387(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest388(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSMDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest389(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:only; http_stat_msg; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest390(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; distance:10; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest391(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:only; http_stat_msg; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest392(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; within:10; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest393(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:only; http_stat_msg; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest394(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; offset:10; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest395(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:only; http_stat_msg; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest396(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; depth:10; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest397(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"two\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest398(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; distance:30; " "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest399(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; within:30; " "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest400(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; offset:30; " "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest401(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; depth:30; " "content:\"two\"; fast_pattern:only; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest402(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_stat_msg; " "content:\"two\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest403(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_msg; " "content:!\"one\"; fast_pattern; http_stat_msg; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest404(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_msg; " "content:!\"one\"; fast_pattern; http_stat_msg; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest405(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_msg; " "content:!\"one\"; fast_pattern; http_stat_msg; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest406(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_msg; " "content:!\"one\"; fast_pattern; http_stat_msg; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest407(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest408(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest409(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest410(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest411(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest412(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest413(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest414(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest415(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; http_stat_msg; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest416(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:65977,4; http_stat_msg; " "content:\"three\"; http_stat_msg; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest417(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_msg; " "content:\"three\"; distance:10; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest418(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:\"two\"; fast_pattern:65534,4; http_stat_msg; " "content:\"three\"; http_stat_msg; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest419(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest420(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; distance:10; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest421(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; within:10; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest422(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; offset:10; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest423(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; depth:10; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest424(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_msg; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_msg; " "content:\"three\"; http_stat_msg; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_stat_msg fast_pattern tests ^ */ /* http_stat_code fast_pattern tests v */ int DetectFastPatternTest425(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest426(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_stat_code; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest427(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest428(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest429(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest430(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:only; http_stat_code; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest431(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; distance:10; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest432(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:only; http_stat_code; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest433(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; within:10; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest434(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:only; http_stat_code; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest435(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; offset:10; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest436(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:only; http_stat_code; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest437(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; depth:10; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest438(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"two\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest439(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_stat_code; " "content:\"two\"; http_stat_code; distance:30; " "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest440(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; within:30; " "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest441(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; offset:30; " "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest442(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; depth:30; " "content:\"two\"; fast_pattern:only; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest443(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_stat_code; " "content:\"two\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest444(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_code; " "content:!\"one\"; fast_pattern; http_stat_code; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest445(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_code; " "content:!\"one\"; fast_pattern; http_stat_code; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest446(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_code; " "content:!\"one\"; fast_pattern; http_stat_code; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest447(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_stat_code; " "content:!\"one\"; fast_pattern; http_stat_code; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest448(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest449(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest450(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest451(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest452(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest453(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest454(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest455(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest456(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; http_stat_code; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest457(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:65977,4; http_stat_code; " "content:\"three\"; http_stat_code; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest458(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_stat_code; " "content:\"three\"; distance:10; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest459(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:\"two\"; fast_pattern:65534,4; http_stat_code; " "content:\"three\"; http_stat_code; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest460(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest461(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; distance:10; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest462(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; within:10; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest463(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; offset:10; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest464(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; depth:10; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest465(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_stat_code; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_stat_code; " "content:\"three\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_stat_code fast_pattern tests ^ */ /* http_server_body fast_pattern tests v */ int DetectFastPatternTest466(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest467(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_server_body; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest468(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest469(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest470(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest471(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:only; http_server_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest472(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; distance:10; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest473(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:only; http_server_body; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest474(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; within:10; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest475(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:only; http_server_body; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest476(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; offset:10; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest477(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:only; http_server_body; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest478(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; depth:10; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest479(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"two\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest480(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_server_body; " "content:\"two\"; http_server_body; distance:30; " "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest481(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; within:30; " "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest482(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; offset:30; " "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest483(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; depth:30; " "content:\"two\"; fast_pattern:only; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest484(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_server_body; " "content:\"two\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest485(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_server_body; " "content:!\"one\"; fast_pattern; http_server_body; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest486(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_server_body; " "content:!\"one\"; fast_pattern; http_server_body; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest487(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_server_body; " "content:!\"one\"; fast_pattern; http_server_body; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest488(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_server_body; " "content:!\"one\"; fast_pattern; http_server_body; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest489(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest490(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest491(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest492(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest493(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest494(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest495(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest496(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest497(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; http_server_body; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest498(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:65977,4; http_server_body; " "content:\"three\"; http_server_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest499(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_server_body; " "content:\"three\"; distance:10; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest500(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:\"two\"; fast_pattern:65534,4; http_server_body; " "content:\"three\"; http_server_body; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest501(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest502(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; distance:10; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest503(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; within:10; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest504(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; offset:10; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest505(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; depth:10; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest506(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_server_body; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_server_body; " "content:\"three\"; http_server_body; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_server_body fast_pattern tests ^ */ /* file_data fast_pattern tests v */ int DetectFastPatternTest507(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest508(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; fast_pattern:only; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest509(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"oneoneone\"; fast_pattern:3,4; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest510(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest511(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"oneoneone\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest512(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:only; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest513(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; distance:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest514(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:only; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest515(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; within:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest516(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:only; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest517(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; offset:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest518(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:only; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest519(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; depth:10; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest520(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest521(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\" one\"; " "content:\"two\"; distance:30; " "content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest522(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; within:30; " "content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest523(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; offset:30; " "content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest524(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; depth:30; " "content:\"two\"; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest525(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:!\"one\"; fast_pattern; " "content:\"two\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest526(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"two\"; " "content:!\"one\"; fast_pattern; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest527(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"two\"; " "content:!\"one\"; fast_pattern; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest528(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"two\"; " "content:!\"one\"; fast_pattern; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest529(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"two\"; " "content:!\"one\"; fast_pattern; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest530(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest531(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest532(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest533(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest534(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest535(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest536(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest537(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest538(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest539(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:65977,4; " "content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest540(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"oneonetwo\"; fast_pattern:3,65977; " "content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest541(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:\"two\"; fast_pattern:65534,4; " "content:\"three\"; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest542(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest543(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; distance:10; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest544(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; within:10; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest545(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; offset:10; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest546(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; depth:10; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest547(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(file_data; content:\"one\"; " "content:!\"oneonetwo\"; fast_pattern:3,4; " "content:\"three\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* file_data fast_pattern tests ^ */ /* http_user_agent fast_pattern tests v */ int DetectFastPatternTest548(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest549(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_user_agent; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest550(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH]; if (sm != NULL) { if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest551(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest552(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HUADMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest553(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:only; http_user_agent; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest554(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; distance:10; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest555(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:only; http_user_agent; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest556(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; within:10; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest557(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:only; http_user_agent; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest558(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; offset:10; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest559(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:only; http_user_agent; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest560(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; depth:10; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest561(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"two\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest562(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_user_agent; " "content:\"two\"; http_user_agent; distance:30; " "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest563(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; within:30; " "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest564(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; offset:30; " "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest565(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; depth:30; " "content:\"two\"; fast_pattern:only; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest566(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_user_agent; " "content:\"two\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest567(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_user_agent; " "content:!\"one\"; fast_pattern; http_user_agent; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest568(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_user_agent; " "content:!\"one\"; fast_pattern; http_user_agent; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest569(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_user_agent; " "content:!\"one\"; fast_pattern; http_user_agent; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest570(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_user_agent; " "content:!\"one\"; fast_pattern; http_user_agent; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest571(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest572(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest573(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest574(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest575(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest576(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest577(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest578(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest579(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; http_user_agent; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest580(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:65977,4; http_user_agent; " "content:\"three\"; http_user_agent; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest581(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_user_agent; " "content:\"three\"; distance:10; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest582(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:\"two\"; fast_pattern:65534,4; http_user_agent; " "content:\"three\"; http_user_agent; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest583(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest584(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; distance:10; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest585(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; within:10; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest586(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; offset:10; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest587(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; depth:10; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest588(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_user_agent; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_user_agent; " "content:\"three\"; http_user_agent; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HUADMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_user_agent fast_pattern tests ^ */ /* http_host fast_pattern tests v */ int DetectFastPatternTest589(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest590(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_host; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH]; if (sm != NULL) { if ( (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest591(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_host; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH]; if (sm != NULL) { if ( (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest592(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest593(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest594(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:only; http_host; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest595(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; distance:10; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest596(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:only; http_host; within:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest597(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; within:10; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest598(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:only; http_host; offset:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest599(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; offset:10; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest600(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:only; http_host; depth:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest601(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; depth:10; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest602(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"two\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest603(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_host; " "content:\"two\"; http_host; distance:30; " "content:\"two\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest604(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; within:30; " "content:\"two\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest605(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; offset:30; " "content:\"two\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest606(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; depth:30; " "content:\"two\"; fast_pattern:only; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest607(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_host; " "content:\"two\"; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest608(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_host; " "content:!\"one\"; fast_pattern; http_host; distance:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest609(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_host; " "content:!\"one\"; fast_pattern; http_host; within:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest610(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_host; " "content:!\"one\"; fast_pattern; http_host; offset:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest611(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_host; " "content:!\"one\"; fast_pattern; http_host; depth:20; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest612(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest613(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest614(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest615(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest616(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest617(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; distance:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest618(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; within:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest619(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; offset:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest620(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; http_host; depth:10; " "content:\"oneonethree\"; fast_pattern:3,4; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest621(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:65977,4; http_host; " "content:\"three\"; http_host; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest622(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_host; " "content:\"three\"; distance:10; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest623(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; fast_pattern:65534,4; http_host; " "content:\"three\"; http_host; distance:10; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest624(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest625(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; distance:10; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest626(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; within:10; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest627(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; offset:10; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest628(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; depth:10; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest629(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_host; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_host; " "content:\"three\"; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /* http_host fast_pattern tests ^ */ /* http_rawhost fast_pattern tests v */ int DetectFastPatternTest630(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NEGATED && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest631(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH]; if (sm != NULL) { if ( (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) && (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_NOCASE)) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a fast_pattern is registered in a Signature for uricontent. */ int DetectFastPatternTest632(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; " "msg:\"Testing fast_pattern\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH]; if (sm != NULL) { if ( (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) && (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_NOCASE)) { result = 1; } else { result = 0; } } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest633(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest634(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"oneoneone\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HRHHDMATCH]; if (sm == NULL) { goto end; } DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest635(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; distance:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest636(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; distance:10; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest637(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; within:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest638(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; within:10; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest639(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; offset:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest640(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; offset:10; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest641(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; depth:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest642(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; depth:10; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest643(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest644(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\" one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; distance:30; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest645(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; within:30; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest646(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; offset:30; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest647(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; depth:30; nocase; " "content:\"two\"; fast_pattern:only; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest648(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:!\"one\"; fast_pattern; http_raw_host; nocase; " "content:\"two\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest649(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_host; nocase; " "content:!\"one\"; fast_pattern; http_raw_host; distance:20; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest650(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_host; nocase; " "content:!\"one\"; fast_pattern; http_raw_host; within:20; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest651(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_host; nocase; " "content:!\"one\"; fast_pattern; http_raw_host; offset:20; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest652(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"two\"; http_raw_host; nocase; " "content:!\"one\"; fast_pattern; http_raw_host; depth:20; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest653(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest654(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; distance:30; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest655(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; within:30; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest656(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; offset:30; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest657(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; depth:30; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest658(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; distance:10; nocase; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest659(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; within:10; nocase; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest660(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; offset:10; nocase; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest661(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; http_raw_host; depth:10; nocase; " "content:\"oneonethree\"; fast_pattern:3,4; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest662(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:65977,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest663(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"oneonetwo\"; fast_pattern:3,65977; http_raw_host; nocase; " "content:\"three\"; distance:10; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest664(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:\"two\"; fast_pattern:65534,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; distance:10; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest665(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest666(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; distance:10; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest667(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; within:10; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest668(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; offset:10; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest669(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; depth:10; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectFastPatternTest670(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_raw_host; nocase; " "content:!\"oneonetwo\"; fast_pattern:3,4; http_raw_host; nocase; " "content:\"three\"; http_raw_host; nocase; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; DetectContentData *ud = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]->prev->ctx; if (ud->flags & DETECT_CONTENT_FAST_PATTERN && ud->flags & DETECT_CONTENT_NOCASE && ud->flags & DETECT_CONTENT_NEGATED && !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; } else { result = 0; } end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * Unittest to check * - if we assign different content_ids to duplicate patterns, but one of the * patterns has a fast_pattern chop set. * - if 2 unique patterns get unique ids. * - if 2 duplicate patterns, with no chop set get unique ids. */ int DetectFastPatternTest671(void) { int no_of_sigs = 6; int result = 0; char *sigs[no_of_sigs]; Signature *s[no_of_sigs]; Signature *sig = NULL; DetectEngineCtx *de_ctx = NULL; DetectContentData *cd = NULL; SigMatch *sm = NULL; int i = 0; sigs[0] = "alert tcp any any -> any any " "(content:\"onetwothreefour\"; sid:1;)"; sigs[1] = "alert tcp any any -> any any " "(content:\"onetwothreefour\"; sid:2;)"; sigs[2] = "alert tcp any any -> any any " "(content:\"uniquepattern\"; sid:3;)"; sigs[3] = "alert tcp any any -> any any " "(content:\"onetwothreefour\"; fast_pattern:3,5; sid:4;)"; sigs[4] = "alert tcp any any -> any any " "(content:\"twoth\"; sid:5;)"; sigs[5] = "alert tcp any any -> any any " "(content:\"onetwothreefour\"; fast_pattern:0,15; sid:6;)"; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("DetectEngineCtxInit() failure\n"); goto end; } de_ctx->flags |= DE_QUIET; i = 0; s[i] = SigInit(de_ctx, sigs[i]); de_ctx->sig_list = sig = s[i]; if (sig == NULL) { printf("SigInit(de_ctx, sig1) failure\n"); goto end; } i++; for ( ; i < no_of_sigs; i++) { s[i] = SigInit(de_ctx, sigs[i]); sig->next = s[i]; sig = sig->next; if (sig == NULL) { printf("SigInit(de_ctx, sig[%d]) failure\n", i); goto end; } } SigGroupBuild(de_ctx); sm = s[0]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 0) { printf("sm = s[0]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } sm = s[1]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 0) { printf("sm = s[1]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } sm = s[2]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 1) { printf("sm = s[2]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } sm = s[3]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 2) { printf("sm = s[3]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } sm = s[4]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 2) { printf("sm = s[4]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } sm = s[5]->sm_lists[DETECT_SM_LIST_PMATCH]; cd = (DetectContentData *)sm->ctx; if (cd->id != 0) { printf("sm = s[5]->sm_lists[DETECT_SM_LIST_PMATCH] failure\n"); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } return result; } #endif void DetectFastPatternRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFastPatternTest01", DetectFastPatternTest01); UtRegisterTest("DetectFastPatternTest02", DetectFastPatternTest02); UtRegisterTest("DetectFastPatternTest03", DetectFastPatternTest03); UtRegisterTest("DetectFastPatternTest04", DetectFastPatternTest04); UtRegisterTest("DetectFastPatternTest14", DetectFastPatternTest14); UtRegisterTest("DetectFastPatternTest15", DetectFastPatternTest15); UtRegisterTest("DetectFastPatternTest16", DetectFastPatternTest16); UtRegisterTest("DetectFastPatternTest17", DetectFastPatternTest17); UtRegisterTest("DetectFastPatternTest18", DetectFastPatternTest18); UtRegisterTest("DetectFastPatternTest19", DetectFastPatternTest19); UtRegisterTest("DetectFastPatternTest20", DetectFastPatternTest20); UtRegisterTest("DetectFastPatternTest21", DetectFastPatternTest21); UtRegisterTest("DetectFastPatternTest22", DetectFastPatternTest22); UtRegisterTest("DetectFastPatternTest23", DetectFastPatternTest23); UtRegisterTest("DetectFastPatternTest24", DetectFastPatternTest24); UtRegisterTest("DetectFastPatternTest25", DetectFastPatternTest25); UtRegisterTest("DetectFastPatternTest26", DetectFastPatternTest26); UtRegisterTest("DetectFastPatternTest27", DetectFastPatternTest27); UtRegisterTest("DetectFastPatternTest28", DetectFastPatternTest28); UtRegisterTest("DetectFastPatternTest29", DetectFastPatternTest29); UtRegisterTest("DetectFastPatternTest30", DetectFastPatternTest30); UtRegisterTest("DetectFastPatternTest31", DetectFastPatternTest31); UtRegisterTest("DetectFastPatternTest32", DetectFastPatternTest32); UtRegisterTest("DetectFastPatternTest33", DetectFastPatternTest33); UtRegisterTest("DetectFastPatternTest34", DetectFastPatternTest34); UtRegisterTest("DetectFastPatternTest35", DetectFastPatternTest35); UtRegisterTest("DetectFastPatternTest36", DetectFastPatternTest36); UtRegisterTest("DetectFastPatternTest37", DetectFastPatternTest37); UtRegisterTest("DetectFastPatternTest38", DetectFastPatternTest38); UtRegisterTest("DetectFastPatternTest39", DetectFastPatternTest39); UtRegisterTest("DetectFastPatternTest40", DetectFastPatternTest40); UtRegisterTest("DetectFastPatternTest41", DetectFastPatternTest41); UtRegisterTest("DetectFastPatternTest42", DetectFastPatternTest42); UtRegisterTest("DetectFastPatternTest43", DetectFastPatternTest43); UtRegisterTest("DetectFastPatternTest44", DetectFastPatternTest44); UtRegisterTest("DetectFastPatternTest45", DetectFastPatternTest45); UtRegisterTest("DetectFastPatternTest46", DetectFastPatternTest46); UtRegisterTest("DetectFastPatternTest47", DetectFastPatternTest47); UtRegisterTest("DetectFastPatternTest48", DetectFastPatternTest48); UtRegisterTest("DetectFastPatternTest49", DetectFastPatternTest49); UtRegisterTest("DetectFastPatternTest50", DetectFastPatternTest50); UtRegisterTest("DetectFastPatternTest51", DetectFastPatternTest51); UtRegisterTest("DetectFastPatternTest52", DetectFastPatternTest52); UtRegisterTest("DetectFastPatternTest53", DetectFastPatternTest53); /* content fast_pattern tests ^ */ /* uricontent fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest54", DetectFastPatternTest54); UtRegisterTest("DetectFastPatternTest55", DetectFastPatternTest55); UtRegisterTest("DetectFastPatternTest56", DetectFastPatternTest56); UtRegisterTest("DetectFastPatternTest57", DetectFastPatternTest57); UtRegisterTest("DetectFastPatternTest58", DetectFastPatternTest58); UtRegisterTest("DetectFastPatternTest59", DetectFastPatternTest59); UtRegisterTest("DetectFastPatternTest60", DetectFastPatternTest60); UtRegisterTest("DetectFastPatternTest61", DetectFastPatternTest61); UtRegisterTest("DetectFastPatternTest62", DetectFastPatternTest62); UtRegisterTest("DetectFastPatternTest63", DetectFastPatternTest63); UtRegisterTest("DetectFastPatternTest64", DetectFastPatternTest64); UtRegisterTest("DetectFastPatternTest65", DetectFastPatternTest65); UtRegisterTest("DetectFastPatternTest66", DetectFastPatternTest66); UtRegisterTest("DetectFastPatternTest67", DetectFastPatternTest67); UtRegisterTest("DetectFastPatternTest68", DetectFastPatternTest68); UtRegisterTest("DetectFastPatternTest69", DetectFastPatternTest69); UtRegisterTest("DetectFastPatternTest70", DetectFastPatternTest70); UtRegisterTest("DetectFastPatternTest71", DetectFastPatternTest71); UtRegisterTest("DetectFastPatternTest72", DetectFastPatternTest72); UtRegisterTest("DetectFastPatternTest73", DetectFastPatternTest73); UtRegisterTest("DetectFastPatternTest74", DetectFastPatternTest74); UtRegisterTest("DetectFastPatternTest75", DetectFastPatternTest75); UtRegisterTest("DetectFastPatternTest76", DetectFastPatternTest76); UtRegisterTest("DetectFastPatternTest77", DetectFastPatternTest77); UtRegisterTest("DetectFastPatternTest78", DetectFastPatternTest78); UtRegisterTest("DetectFastPatternTest79", DetectFastPatternTest79); UtRegisterTest("DetectFastPatternTest80", DetectFastPatternTest80); UtRegisterTest("DetectFastPatternTest81", DetectFastPatternTest81); UtRegisterTest("DetectFastPatternTest82", DetectFastPatternTest82); UtRegisterTest("DetectFastPatternTest83", DetectFastPatternTest83); UtRegisterTest("DetectFastPatternTest84", DetectFastPatternTest84); UtRegisterTest("DetectFastPatternTest85", DetectFastPatternTest85); UtRegisterTest("DetectFastPatternTest86", DetectFastPatternTest86); UtRegisterTest("DetectFastPatternTest87", DetectFastPatternTest87); UtRegisterTest("DetectFastPatternTest88", DetectFastPatternTest88); UtRegisterTest("DetectFastPatternTest89", DetectFastPatternTest89); UtRegisterTest("DetectFastPatternTest90", DetectFastPatternTest90); UtRegisterTest("DetectFastPatternTest91", DetectFastPatternTest91); UtRegisterTest("DetectFastPatternTest92", DetectFastPatternTest92); /* uricontent fast_pattern tests ^ */ /* http_uri fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest93", DetectFastPatternTest93); UtRegisterTest("DetectFastPatternTest94", DetectFastPatternTest94); UtRegisterTest("DetectFastPatternTest95", DetectFastPatternTest95); UtRegisterTest("DetectFastPatternTest96", DetectFastPatternTest96); UtRegisterTest("DetectFastPatternTest97", DetectFastPatternTest97); UtRegisterTest("DetectFastPatternTest98", DetectFastPatternTest98); UtRegisterTest("DetectFastPatternTest99", DetectFastPatternTest99); UtRegisterTest("DetectFastPatternTest100", DetectFastPatternTest100); UtRegisterTest("DetectFastPatternTest101", DetectFastPatternTest101); UtRegisterTest("DetectFastPatternTest102", DetectFastPatternTest102); UtRegisterTest("DetectFastPatternTest103", DetectFastPatternTest103); UtRegisterTest("DetectFastPatternTest104", DetectFastPatternTest104); UtRegisterTest("DetectFastPatternTest105", DetectFastPatternTest105); UtRegisterTest("DetectFastPatternTest106", DetectFastPatternTest106); UtRegisterTest("DetectFastPatternTest107", DetectFastPatternTest107); UtRegisterTest("DetectFastPatternTest108", DetectFastPatternTest108); UtRegisterTest("DetectFastPatternTest109", DetectFastPatternTest109); UtRegisterTest("DetectFastPatternTest110", DetectFastPatternTest110); UtRegisterTest("DetectFastPatternTest111", DetectFastPatternTest111); UtRegisterTest("DetectFastPatternTest112", DetectFastPatternTest112); UtRegisterTest("DetectFastPatternTest113", DetectFastPatternTest113); UtRegisterTest("DetectFastPatternTest114", DetectFastPatternTest114); UtRegisterTest("DetectFastPatternTest115", DetectFastPatternTest115); UtRegisterTest("DetectFastPatternTest116", DetectFastPatternTest116); UtRegisterTest("DetectFastPatternTest117", DetectFastPatternTest117); UtRegisterTest("DetectFastPatternTest118", DetectFastPatternTest118); UtRegisterTest("DetectFastPatternTest119", DetectFastPatternTest119); UtRegisterTest("DetectFastPatternTest120", DetectFastPatternTest120); UtRegisterTest("DetectFastPatternTest121", DetectFastPatternTest121); UtRegisterTest("DetectFastPatternTest122", DetectFastPatternTest122); UtRegisterTest("DetectFastPatternTest123", DetectFastPatternTest123); UtRegisterTest("DetectFastPatternTest124", DetectFastPatternTest124); UtRegisterTest("DetectFastPatternTest125", DetectFastPatternTest125); UtRegisterTest("DetectFastPatternTest126", DetectFastPatternTest126); UtRegisterTest("DetectFastPatternTest127", DetectFastPatternTest127); UtRegisterTest("DetectFastPatternTest128", DetectFastPatternTest128); UtRegisterTest("DetectFastPatternTest129", DetectFastPatternTest129); UtRegisterTest("DetectFastPatternTest130", DetectFastPatternTest130); UtRegisterTest("DetectFastPatternTest131", DetectFastPatternTest131); UtRegisterTest("DetectFastPatternTest132", DetectFastPatternTest132); UtRegisterTest("DetectFastPatternTest133", DetectFastPatternTest133); /* http_uri fast_pattern tests ^ */ /* http_client_body fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest134", DetectFastPatternTest134); UtRegisterTest("DetectFastPatternTest135", DetectFastPatternTest135); UtRegisterTest("DetectFastPatternTest136", DetectFastPatternTest136); UtRegisterTest("DetectFastPatternTest137", DetectFastPatternTest137); UtRegisterTest("DetectFastPatternTest138", DetectFastPatternTest138); UtRegisterTest("DetectFastPatternTest139", DetectFastPatternTest139); UtRegisterTest("DetectFastPatternTest140", DetectFastPatternTest140); UtRegisterTest("DetectFastPatternTest141", DetectFastPatternTest141); UtRegisterTest("DetectFastPatternTest142", DetectFastPatternTest142); UtRegisterTest("DetectFastPatternTest143", DetectFastPatternTest143); UtRegisterTest("DetectFastPatternTest144", DetectFastPatternTest144); UtRegisterTest("DetectFastPatternTest145", DetectFastPatternTest145); UtRegisterTest("DetectFastPatternTest146", DetectFastPatternTest146); UtRegisterTest("DetectFastPatternTest147", DetectFastPatternTest147); UtRegisterTest("DetectFastPatternTest148", DetectFastPatternTest148); UtRegisterTest("DetectFastPatternTest149", DetectFastPatternTest149); UtRegisterTest("DetectFastPatternTest150", DetectFastPatternTest150); UtRegisterTest("DetectFastPatternTest151", DetectFastPatternTest151); UtRegisterTest("DetectFastPatternTest152", DetectFastPatternTest152); UtRegisterTest("DetectFastPatternTest153", DetectFastPatternTest153); UtRegisterTest("DetectFastPatternTest154", DetectFastPatternTest154); UtRegisterTest("DetectFastPatternTest155", DetectFastPatternTest155); UtRegisterTest("DetectFastPatternTest156", DetectFastPatternTest156); UtRegisterTest("DetectFastPatternTest157", DetectFastPatternTest157); UtRegisterTest("DetectFastPatternTest158", DetectFastPatternTest158); UtRegisterTest("DetectFastPatternTest159", DetectFastPatternTest159); UtRegisterTest("DetectFastPatternTest160", DetectFastPatternTest160); UtRegisterTest("DetectFastPatternTest161", DetectFastPatternTest161); UtRegisterTest("DetectFastPatternTest162", DetectFastPatternTest162); UtRegisterTest("DetectFastPatternTest163", DetectFastPatternTest163); UtRegisterTest("DetectFastPatternTest164", DetectFastPatternTest164); UtRegisterTest("DetectFastPatternTest165", DetectFastPatternTest165); UtRegisterTest("DetectFastPatternTest166", DetectFastPatternTest166); UtRegisterTest("DetectFastPatternTest167", DetectFastPatternTest167); UtRegisterTest("DetectFastPatternTest168", DetectFastPatternTest168); UtRegisterTest("DetectFastPatternTest169", DetectFastPatternTest169); UtRegisterTest("DetectFastPatternTest170", DetectFastPatternTest170); UtRegisterTest("DetectFastPatternTest171", DetectFastPatternTest171); UtRegisterTest("DetectFastPatternTest172", DetectFastPatternTest172); UtRegisterTest("DetectFastPatternTest173", DetectFastPatternTest173); UtRegisterTest("DetectFastPatternTest174", DetectFastPatternTest174); /* http_client_body fast_pattern tests ^ */ /* content fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest175", DetectFastPatternTest175); UtRegisterTest("DetectFastPatternTest176", DetectFastPatternTest176); UtRegisterTest("DetectFastPatternTest177", DetectFastPatternTest177); UtRegisterTest("DetectFastPatternTest178", DetectFastPatternTest178); /* content fast_pattern tests ^ */ /* http_header fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest179", DetectFastPatternTest179); UtRegisterTest("DetectFastPatternTest180", DetectFastPatternTest180); UtRegisterTest("DetectFastPatternTest181", DetectFastPatternTest181); UtRegisterTest("DetectFastPatternTest182", DetectFastPatternTest182); UtRegisterTest("DetectFastPatternTest183", DetectFastPatternTest183); UtRegisterTest("DetectFastPatternTest184", DetectFastPatternTest184); UtRegisterTest("DetectFastPatternTest185", DetectFastPatternTest185); UtRegisterTest("DetectFastPatternTest186", DetectFastPatternTest186); UtRegisterTest("DetectFastPatternTest187", DetectFastPatternTest187); UtRegisterTest("DetectFastPatternTest188", DetectFastPatternTest188); UtRegisterTest("DetectFastPatternTest189", DetectFastPatternTest189); UtRegisterTest("DetectFastPatternTest190", DetectFastPatternTest190); UtRegisterTest("DetectFastPatternTest191", DetectFastPatternTest191); UtRegisterTest("DetectFastPatternTest192", DetectFastPatternTest192); UtRegisterTest("DetectFastPatternTest193", DetectFastPatternTest193); UtRegisterTest("DetectFastPatternTest194", DetectFastPatternTest194); UtRegisterTest("DetectFastPatternTest195", DetectFastPatternTest195); UtRegisterTest("DetectFastPatternTest196", DetectFastPatternTest196); UtRegisterTest("DetectFastPatternTest197", DetectFastPatternTest197); UtRegisterTest("DetectFastPatternTest198", DetectFastPatternTest198); UtRegisterTest("DetectFastPatternTest199", DetectFastPatternTest199); UtRegisterTest("DetectFastPatternTest200", DetectFastPatternTest200); UtRegisterTest("DetectFastPatternTest201", DetectFastPatternTest201); UtRegisterTest("DetectFastPatternTest202", DetectFastPatternTest202); UtRegisterTest("DetectFastPatternTest203", DetectFastPatternTest203); UtRegisterTest("DetectFastPatternTest204", DetectFastPatternTest204); UtRegisterTest("DetectFastPatternTest205", DetectFastPatternTest205); UtRegisterTest("DetectFastPatternTest206", DetectFastPatternTest206); UtRegisterTest("DetectFastPatternTest207", DetectFastPatternTest207); UtRegisterTest("DetectFastPatternTest208", DetectFastPatternTest208); UtRegisterTest("DetectFastPatternTest209", DetectFastPatternTest209); UtRegisterTest("DetectFastPatternTest210", DetectFastPatternTest210); UtRegisterTest("DetectFastPatternTest211", DetectFastPatternTest211); UtRegisterTest("DetectFastPatternTest212", DetectFastPatternTest212); UtRegisterTest("DetectFastPatternTest213", DetectFastPatternTest213); UtRegisterTest("DetectFastPatternTest214", DetectFastPatternTest214); UtRegisterTest("DetectFastPatternTest215", DetectFastPatternTest215); UtRegisterTest("DetectFastPatternTest216", DetectFastPatternTest216); UtRegisterTest("DetectFastPatternTest217", DetectFastPatternTest217); UtRegisterTest("DetectFastPatternTest218", DetectFastPatternTest218); UtRegisterTest("DetectFastPatternTest219", DetectFastPatternTest219); /* http_header fast_pattern tests ^ */ /* http_raw_header fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest220", DetectFastPatternTest220); UtRegisterTest("DetectFastPatternTest221", DetectFastPatternTest221); UtRegisterTest("DetectFastPatternTest222", DetectFastPatternTest222); UtRegisterTest("DetectFastPatternTest223", DetectFastPatternTest223); UtRegisterTest("DetectFastPatternTest224", DetectFastPatternTest224); UtRegisterTest("DetectFastPatternTest225", DetectFastPatternTest225); UtRegisterTest("DetectFastPatternTest226", DetectFastPatternTest226); UtRegisterTest("DetectFastPatternTest227", DetectFastPatternTest227); UtRegisterTest("DetectFastPatternTest228", DetectFastPatternTest228); UtRegisterTest("DetectFastPatternTest229", DetectFastPatternTest229); UtRegisterTest("DetectFastPatternTest230", DetectFastPatternTest230); UtRegisterTest("DetectFastPatternTest231", DetectFastPatternTest231); UtRegisterTest("DetectFastPatternTest232", DetectFastPatternTest232); UtRegisterTest("DetectFastPatternTest233", DetectFastPatternTest233); UtRegisterTest("DetectFastPatternTest234", DetectFastPatternTest234); UtRegisterTest("DetectFastPatternTest235", DetectFastPatternTest235); UtRegisterTest("DetectFastPatternTest236", DetectFastPatternTest236); UtRegisterTest("DetectFastPatternTest237", DetectFastPatternTest237); UtRegisterTest("DetectFastPatternTest238", DetectFastPatternTest238); UtRegisterTest("DetectFastPatternTest239", DetectFastPatternTest239); UtRegisterTest("DetectFastPatternTest240", DetectFastPatternTest240); UtRegisterTest("DetectFastPatternTest241", DetectFastPatternTest241); UtRegisterTest("DetectFastPatternTest242", DetectFastPatternTest242); UtRegisterTest("DetectFastPatternTest243", DetectFastPatternTest243); UtRegisterTest("DetectFastPatternTest244", DetectFastPatternTest244); UtRegisterTest("DetectFastPatternTest245", DetectFastPatternTest245); UtRegisterTest("DetectFastPatternTest246", DetectFastPatternTest246); UtRegisterTest("DetectFastPatternTest247", DetectFastPatternTest247); UtRegisterTest("DetectFastPatternTest248", DetectFastPatternTest248); UtRegisterTest("DetectFastPatternTest249", DetectFastPatternTest249); UtRegisterTest("DetectFastPatternTest250", DetectFastPatternTest250); UtRegisterTest("DetectFastPatternTest251", DetectFastPatternTest251); UtRegisterTest("DetectFastPatternTest252", DetectFastPatternTest252); UtRegisterTest("DetectFastPatternTest253", DetectFastPatternTest253); UtRegisterTest("DetectFastPatternTest254", DetectFastPatternTest254); UtRegisterTest("DetectFastPatternTest255", DetectFastPatternTest255); UtRegisterTest("DetectFastPatternTest256", DetectFastPatternTest256); UtRegisterTest("DetectFastPatternTest257", DetectFastPatternTest257); UtRegisterTest("DetectFastPatternTest258", DetectFastPatternTest258); UtRegisterTest("DetectFastPatternTest259", DetectFastPatternTest259); UtRegisterTest("DetectFastPatternTest260", DetectFastPatternTest260); /* http_raw_header fast_pattern tests ^ */ /* http_method fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest261", DetectFastPatternTest261); UtRegisterTest("DetectFastPatternTest262", DetectFastPatternTest262); UtRegisterTest("DetectFastPatternTest263", DetectFastPatternTest263); UtRegisterTest("DetectFastPatternTest264", DetectFastPatternTest264); UtRegisterTest("DetectFastPatternTest265", DetectFastPatternTest265); UtRegisterTest("DetectFastPatternTest266", DetectFastPatternTest266); UtRegisterTest("DetectFastPatternTest267", DetectFastPatternTest267); UtRegisterTest("DetectFastPatternTest268", DetectFastPatternTest268); UtRegisterTest("DetectFastPatternTest269", DetectFastPatternTest269); UtRegisterTest("DetectFastPatternTest270", DetectFastPatternTest270); UtRegisterTest("DetectFastPatternTest271", DetectFastPatternTest271); UtRegisterTest("DetectFastPatternTest272", DetectFastPatternTest272); UtRegisterTest("DetectFastPatternTest273", DetectFastPatternTest273); UtRegisterTest("DetectFastPatternTest274", DetectFastPatternTest274); UtRegisterTest("DetectFastPatternTest275", DetectFastPatternTest275); UtRegisterTest("DetectFastPatternTest276", DetectFastPatternTest276); UtRegisterTest("DetectFastPatternTest277", DetectFastPatternTest277); UtRegisterTest("DetectFastPatternTest278", DetectFastPatternTest278); UtRegisterTest("DetectFastPatternTest279", DetectFastPatternTest279); UtRegisterTest("DetectFastPatternTest280", DetectFastPatternTest280); UtRegisterTest("DetectFastPatternTest281", DetectFastPatternTest281); UtRegisterTest("DetectFastPatternTest282", DetectFastPatternTest282); UtRegisterTest("DetectFastPatternTest283", DetectFastPatternTest283); UtRegisterTest("DetectFastPatternTest284", DetectFastPatternTest284); UtRegisterTest("DetectFastPatternTest285", DetectFastPatternTest285); UtRegisterTest("DetectFastPatternTest286", DetectFastPatternTest286); UtRegisterTest("DetectFastPatternTest287", DetectFastPatternTest287); UtRegisterTest("DetectFastPatternTest288", DetectFastPatternTest288); UtRegisterTest("DetectFastPatternTest289", DetectFastPatternTest289); UtRegisterTest("DetectFastPatternTest290", DetectFastPatternTest290); UtRegisterTest("DetectFastPatternTest291", DetectFastPatternTest291); UtRegisterTest("DetectFastPatternTest292", DetectFastPatternTest292); UtRegisterTest("DetectFastPatternTest293", DetectFastPatternTest293); UtRegisterTest("DetectFastPatternTest294", DetectFastPatternTest294); UtRegisterTest("DetectFastPatternTest295", DetectFastPatternTest295); UtRegisterTest("DetectFastPatternTest296", DetectFastPatternTest296); UtRegisterTest("DetectFastPatternTest297", DetectFastPatternTest297); UtRegisterTest("DetectFastPatternTest298", DetectFastPatternTest298); UtRegisterTest("DetectFastPatternTest299", DetectFastPatternTest299); UtRegisterTest("DetectFastPatternTest300", DetectFastPatternTest300); UtRegisterTest("DetectFastPatternTest301", DetectFastPatternTest301); /* http_method fast_pattern tests ^ */ /* http_cookie fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest302", DetectFastPatternTest302); UtRegisterTest("DetectFastPatternTest303", DetectFastPatternTest303); UtRegisterTest("DetectFastPatternTest304", DetectFastPatternTest304); UtRegisterTest("DetectFastPatternTest305", DetectFastPatternTest305); UtRegisterTest("DetectFastPatternTest306", DetectFastPatternTest306); UtRegisterTest("DetectFastPatternTest307", DetectFastPatternTest307); UtRegisterTest("DetectFastPatternTest308", DetectFastPatternTest308); UtRegisterTest("DetectFastPatternTest309", DetectFastPatternTest309); UtRegisterTest("DetectFastPatternTest310", DetectFastPatternTest310); UtRegisterTest("DetectFastPatternTest311", DetectFastPatternTest311); UtRegisterTest("DetectFastPatternTest312", DetectFastPatternTest312); UtRegisterTest("DetectFastPatternTest313", DetectFastPatternTest313); UtRegisterTest("DetectFastPatternTest314", DetectFastPatternTest314); UtRegisterTest("DetectFastPatternTest315", DetectFastPatternTest315); UtRegisterTest("DetectFastPatternTest316", DetectFastPatternTest316); UtRegisterTest("DetectFastPatternTest317", DetectFastPatternTest317); UtRegisterTest("DetectFastPatternTest318", DetectFastPatternTest318); UtRegisterTest("DetectFastPatternTest319", DetectFastPatternTest319); UtRegisterTest("DetectFastPatternTest320", DetectFastPatternTest320); UtRegisterTest("DetectFastPatternTest321", DetectFastPatternTest321); UtRegisterTest("DetectFastPatternTest322", DetectFastPatternTest322); UtRegisterTest("DetectFastPatternTest323", DetectFastPatternTest323); UtRegisterTest("DetectFastPatternTest324", DetectFastPatternTest324); UtRegisterTest("DetectFastPatternTest325", DetectFastPatternTest325); UtRegisterTest("DetectFastPatternTest326", DetectFastPatternTest326); UtRegisterTest("DetectFastPatternTest327", DetectFastPatternTest327); UtRegisterTest("DetectFastPatternTest328", DetectFastPatternTest328); UtRegisterTest("DetectFastPatternTest329", DetectFastPatternTest329); UtRegisterTest("DetectFastPatternTest330", DetectFastPatternTest330); UtRegisterTest("DetectFastPatternTest331", DetectFastPatternTest331); UtRegisterTest("DetectFastPatternTest332", DetectFastPatternTest332); UtRegisterTest("DetectFastPatternTest333", DetectFastPatternTest333); UtRegisterTest("DetectFastPatternTest334", DetectFastPatternTest334); UtRegisterTest("DetectFastPatternTest335", DetectFastPatternTest335); UtRegisterTest("DetectFastPatternTest336", DetectFastPatternTest336); UtRegisterTest("DetectFastPatternTest337", DetectFastPatternTest337); UtRegisterTest("DetectFastPatternTest338", DetectFastPatternTest338); UtRegisterTest("DetectFastPatternTest339", DetectFastPatternTest339); UtRegisterTest("DetectFastPatternTest340", DetectFastPatternTest340); UtRegisterTest("DetectFastPatternTest341", DetectFastPatternTest341); UtRegisterTest("DetectFastPatternTest342", DetectFastPatternTest342); /* http_cookie fast_pattern tests ^ */ /* http_raw_uri fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest343", DetectFastPatternTest343); UtRegisterTest("DetectFastPatternTest344", DetectFastPatternTest344); UtRegisterTest("DetectFastPatternTest345", DetectFastPatternTest345); UtRegisterTest("DetectFastPatternTest346", DetectFastPatternTest346); UtRegisterTest("DetectFastPatternTest347", DetectFastPatternTest347); UtRegisterTest("DetectFastPatternTest348", DetectFastPatternTest348); UtRegisterTest("DetectFastPatternTest349", DetectFastPatternTest349); UtRegisterTest("DetectFastPatternTest350", DetectFastPatternTest350); UtRegisterTest("DetectFastPatternTest351", DetectFastPatternTest351); UtRegisterTest("DetectFastPatternTest352", DetectFastPatternTest352); UtRegisterTest("DetectFastPatternTest353", DetectFastPatternTest353); UtRegisterTest("DetectFastPatternTest354", DetectFastPatternTest354); UtRegisterTest("DetectFastPatternTest355", DetectFastPatternTest355); UtRegisterTest("DetectFastPatternTest356", DetectFastPatternTest356); UtRegisterTest("DetectFastPatternTest357", DetectFastPatternTest357); UtRegisterTest("DetectFastPatternTest358", DetectFastPatternTest358); UtRegisterTest("DetectFastPatternTest359", DetectFastPatternTest359); UtRegisterTest("DetectFastPatternTest360", DetectFastPatternTest360); UtRegisterTest("DetectFastPatternTest361", DetectFastPatternTest361); UtRegisterTest("DetectFastPatternTest362", DetectFastPatternTest362); UtRegisterTest("DetectFastPatternTest363", DetectFastPatternTest363); UtRegisterTest("DetectFastPatternTest364", DetectFastPatternTest364); UtRegisterTest("DetectFastPatternTest365", DetectFastPatternTest365); UtRegisterTest("DetectFastPatternTest366", DetectFastPatternTest366); UtRegisterTest("DetectFastPatternTest367", DetectFastPatternTest367); UtRegisterTest("DetectFastPatternTest368", DetectFastPatternTest368); UtRegisterTest("DetectFastPatternTest369", DetectFastPatternTest369); UtRegisterTest("DetectFastPatternTest370", DetectFastPatternTest370); UtRegisterTest("DetectFastPatternTest371", DetectFastPatternTest371); UtRegisterTest("DetectFastPatternTest372", DetectFastPatternTest372); UtRegisterTest("DetectFastPatternTest373", DetectFastPatternTest373); UtRegisterTest("DetectFastPatternTest374", DetectFastPatternTest374); UtRegisterTest("DetectFastPatternTest375", DetectFastPatternTest375); UtRegisterTest("DetectFastPatternTest376", DetectFastPatternTest376); UtRegisterTest("DetectFastPatternTest377", DetectFastPatternTest377); UtRegisterTest("DetectFastPatternTest378", DetectFastPatternTest378); UtRegisterTest("DetectFastPatternTest379", DetectFastPatternTest379); UtRegisterTest("DetectFastPatternTest380", DetectFastPatternTest380); UtRegisterTest("DetectFastPatternTest381", DetectFastPatternTest381); UtRegisterTest("DetectFastPatternTest382", DetectFastPatternTest382); UtRegisterTest("DetectFastPatternTest383", DetectFastPatternTest383); /* http_raw_uri fast_pattern tests ^ */ /* http_stat_msg fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest384", DetectFastPatternTest384); UtRegisterTest("DetectFastPatternTest385", DetectFastPatternTest385); UtRegisterTest("DetectFastPatternTest386", DetectFastPatternTest386); UtRegisterTest("DetectFastPatternTest387", DetectFastPatternTest387); UtRegisterTest("DetectFastPatternTest388", DetectFastPatternTest388); UtRegisterTest("DetectFastPatternTest389", DetectFastPatternTest389); UtRegisterTest("DetectFastPatternTest390", DetectFastPatternTest390); UtRegisterTest("DetectFastPatternTest391", DetectFastPatternTest391); UtRegisterTest("DetectFastPatternTest392", DetectFastPatternTest392); UtRegisterTest("DetectFastPatternTest393", DetectFastPatternTest393); UtRegisterTest("DetectFastPatternTest394", DetectFastPatternTest394); UtRegisterTest("DetectFastPatternTest395", DetectFastPatternTest395); UtRegisterTest("DetectFastPatternTest396", DetectFastPatternTest396); UtRegisterTest("DetectFastPatternTest397", DetectFastPatternTest397); UtRegisterTest("DetectFastPatternTest398", DetectFastPatternTest398); UtRegisterTest("DetectFastPatternTest399", DetectFastPatternTest399); UtRegisterTest("DetectFastPatternTest400", DetectFastPatternTest400); UtRegisterTest("DetectFastPatternTest401", DetectFastPatternTest401); UtRegisterTest("DetectFastPatternTest402", DetectFastPatternTest402); UtRegisterTest("DetectFastPatternTest403", DetectFastPatternTest403); UtRegisterTest("DetectFastPatternTest404", DetectFastPatternTest404); UtRegisterTest("DetectFastPatternTest405", DetectFastPatternTest405); UtRegisterTest("DetectFastPatternTest406", DetectFastPatternTest406); UtRegisterTest("DetectFastPatternTest407", DetectFastPatternTest407); UtRegisterTest("DetectFastPatternTest408", DetectFastPatternTest408); UtRegisterTest("DetectFastPatternTest409", DetectFastPatternTest409); UtRegisterTest("DetectFastPatternTest410", DetectFastPatternTest410); UtRegisterTest("DetectFastPatternTest411", DetectFastPatternTest411); UtRegisterTest("DetectFastPatternTest412", DetectFastPatternTest412); UtRegisterTest("DetectFastPatternTest413", DetectFastPatternTest413); UtRegisterTest("DetectFastPatternTest414", DetectFastPatternTest414); UtRegisterTest("DetectFastPatternTest415", DetectFastPatternTest415); UtRegisterTest("DetectFastPatternTest416", DetectFastPatternTest415); UtRegisterTest("DetectFastPatternTest417", DetectFastPatternTest417); UtRegisterTest("DetectFastPatternTest418", DetectFastPatternTest418); UtRegisterTest("DetectFastPatternTest419", DetectFastPatternTest419); UtRegisterTest("DetectFastPatternTest420", DetectFastPatternTest420); UtRegisterTest("DetectFastPatternTest421", DetectFastPatternTest421); UtRegisterTest("DetectFastPatternTest422", DetectFastPatternTest422); UtRegisterTest("DetectFastPatternTest423", DetectFastPatternTest423); UtRegisterTest("DetectFastPatternTest424", DetectFastPatternTest424); /* http_stat_msg fast_pattern tests ^ */ /* http_stat_code fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest425", DetectFastPatternTest425); UtRegisterTest("DetectFastPatternTest426", DetectFastPatternTest426); UtRegisterTest("DetectFastPatternTest427", DetectFastPatternTest427); UtRegisterTest("DetectFastPatternTest428", DetectFastPatternTest428); UtRegisterTest("DetectFastPatternTest429", DetectFastPatternTest429); UtRegisterTest("DetectFastPatternTest430", DetectFastPatternTest430); UtRegisterTest("DetectFastPatternTest431", DetectFastPatternTest431); UtRegisterTest("DetectFastPatternTest432", DetectFastPatternTest432); UtRegisterTest("DetectFastPatternTest433", DetectFastPatternTest433); UtRegisterTest("DetectFastPatternTest434", DetectFastPatternTest434); UtRegisterTest("DetectFastPatternTest435", DetectFastPatternTest435); UtRegisterTest("DetectFastPatternTest436", DetectFastPatternTest436); UtRegisterTest("DetectFastPatternTest437", DetectFastPatternTest437); UtRegisterTest("DetectFastPatternTest438", DetectFastPatternTest438); UtRegisterTest("DetectFastPatternTest439", DetectFastPatternTest439); UtRegisterTest("DetectFastPatternTest440", DetectFastPatternTest440); UtRegisterTest("DetectFastPatternTest441", DetectFastPatternTest441); UtRegisterTest("DetectFastPatternTest442", DetectFastPatternTest442); UtRegisterTest("DetectFastPatternTest443", DetectFastPatternTest443); UtRegisterTest("DetectFastPatternTest444", DetectFastPatternTest444); UtRegisterTest("DetectFastPatternTest445", DetectFastPatternTest445); UtRegisterTest("DetectFastPatternTest446", DetectFastPatternTest446); UtRegisterTest("DetectFastPatternTest447", DetectFastPatternTest447); UtRegisterTest("DetectFastPatternTest448", DetectFastPatternTest448); UtRegisterTest("DetectFastPatternTest449", DetectFastPatternTest449); UtRegisterTest("DetectFastPatternTest450", DetectFastPatternTest450); UtRegisterTest("DetectFastPatternTest451", DetectFastPatternTest451); UtRegisterTest("DetectFastPatternTest452", DetectFastPatternTest452); UtRegisterTest("DetectFastPatternTest453", DetectFastPatternTest453); UtRegisterTest("DetectFastPatternTest454", DetectFastPatternTest454); UtRegisterTest("DetectFastPatternTest455", DetectFastPatternTest455); UtRegisterTest("DetectFastPatternTest456", DetectFastPatternTest456); UtRegisterTest("DetectFastPatternTest457", DetectFastPatternTest457); UtRegisterTest("DetectFastPatternTest458", DetectFastPatternTest458); UtRegisterTest("DetectFastPatternTest459", DetectFastPatternTest459); UtRegisterTest("DetectFastPatternTest460", DetectFastPatternTest460); UtRegisterTest("DetectFastPatternTest461", DetectFastPatternTest461); UtRegisterTest("DetectFastPatternTest462", DetectFastPatternTest462); UtRegisterTest("DetectFastPatternTest463", DetectFastPatternTest463); UtRegisterTest("DetectFastPatternTest464", DetectFastPatternTest464); UtRegisterTest("DetectFastPatternTest465", DetectFastPatternTest465); /* http_stat_code fast_pattern tests ^ */ /* http_server_body fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest466", DetectFastPatternTest466); UtRegisterTest("DetectFastPatternTest467", DetectFastPatternTest467); UtRegisterTest("DetectFastPatternTest468", DetectFastPatternTest468); UtRegisterTest("DetectFastPatternTest469", DetectFastPatternTest469); UtRegisterTest("DetectFastPatternTest470", DetectFastPatternTest470); UtRegisterTest("DetectFastPatternTest471", DetectFastPatternTest471); UtRegisterTest("DetectFastPatternTest472", DetectFastPatternTest472); UtRegisterTest("DetectFastPatternTest473", DetectFastPatternTest473); UtRegisterTest("DetectFastPatternTest474", DetectFastPatternTest474); UtRegisterTest("DetectFastPatternTest475", DetectFastPatternTest475); UtRegisterTest("DetectFastPatternTest476", DetectFastPatternTest476); UtRegisterTest("DetectFastPatternTest477", DetectFastPatternTest477); UtRegisterTest("DetectFastPatternTest478", DetectFastPatternTest478); UtRegisterTest("DetectFastPatternTest479", DetectFastPatternTest479); UtRegisterTest("DetectFastPatternTest480", DetectFastPatternTest480); UtRegisterTest("DetectFastPatternTest481", DetectFastPatternTest481); UtRegisterTest("DetectFastPatternTest482", DetectFastPatternTest482); UtRegisterTest("DetectFastPatternTest483", DetectFastPatternTest483); UtRegisterTest("DetectFastPatternTest484", DetectFastPatternTest484); UtRegisterTest("DetectFastPatternTest485", DetectFastPatternTest485); UtRegisterTest("DetectFastPatternTest486", DetectFastPatternTest486); UtRegisterTest("DetectFastPatternTest487", DetectFastPatternTest487); UtRegisterTest("DetectFastPatternTest488", DetectFastPatternTest488); UtRegisterTest("DetectFastPatternTest489", DetectFastPatternTest489); UtRegisterTest("DetectFastPatternTest490", DetectFastPatternTest490); UtRegisterTest("DetectFastPatternTest491", DetectFastPatternTest491); UtRegisterTest("DetectFastPatternTest492", DetectFastPatternTest492); UtRegisterTest("DetectFastPatternTest493", DetectFastPatternTest493); UtRegisterTest("DetectFastPatternTest494", DetectFastPatternTest494); UtRegisterTest("DetectFastPatternTest495", DetectFastPatternTest495); UtRegisterTest("DetectFastPatternTest496", DetectFastPatternTest496); UtRegisterTest("DetectFastPatternTest497", DetectFastPatternTest497); UtRegisterTest("DetectFastPatternTest498", DetectFastPatternTest498); UtRegisterTest("DetectFastPatternTest499", DetectFastPatternTest499); UtRegisterTest("DetectFastPatternTest500", DetectFastPatternTest500); UtRegisterTest("DetectFastPatternTest501", DetectFastPatternTest501); UtRegisterTest("DetectFastPatternTest502", DetectFastPatternTest502); UtRegisterTest("DetectFastPatternTest503", DetectFastPatternTest503); UtRegisterTest("DetectFastPatternTest504", DetectFastPatternTest504); UtRegisterTest("DetectFastPatternTest505", DetectFastPatternTest505); UtRegisterTest("DetectFastPatternTest506", DetectFastPatternTest506); /* http_server_body fast_pattern tests ^ */ /* file_data fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest507", DetectFastPatternTest507); UtRegisterTest("DetectFastPatternTest508", DetectFastPatternTest508); UtRegisterTest("DetectFastPatternTest509", DetectFastPatternTest509); UtRegisterTest("DetectFastPatternTest510", DetectFastPatternTest510); UtRegisterTest("DetectFastPatternTest511", DetectFastPatternTest511); UtRegisterTest("DetectFastPatternTest512", DetectFastPatternTest512); UtRegisterTest("DetectFastPatternTest513", DetectFastPatternTest513); UtRegisterTest("DetectFastPatternTest514", DetectFastPatternTest514); UtRegisterTest("DetectFastPatternTest515", DetectFastPatternTest515); UtRegisterTest("DetectFastPatternTest516", DetectFastPatternTest516); UtRegisterTest("DetectFastPatternTest517", DetectFastPatternTest517); UtRegisterTest("DetectFastPatternTest518", DetectFastPatternTest518); UtRegisterTest("DetectFastPatternTest519", DetectFastPatternTest519); UtRegisterTest("DetectFastPatternTest520", DetectFastPatternTest520); UtRegisterTest("DetectFastPatternTest521", DetectFastPatternTest521); UtRegisterTest("DetectFastPatternTest522", DetectFastPatternTest522); UtRegisterTest("DetectFastPatternTest523", DetectFastPatternTest523); UtRegisterTest("DetectFastPatternTest524", DetectFastPatternTest524); UtRegisterTest("DetectFastPatternTest525", DetectFastPatternTest525); UtRegisterTest("DetectFastPatternTest526", DetectFastPatternTest526); UtRegisterTest("DetectFastPatternTest527", DetectFastPatternTest527); UtRegisterTest("DetectFastPatternTest528", DetectFastPatternTest528); UtRegisterTest("DetectFastPatternTest529", DetectFastPatternTest529); UtRegisterTest("DetectFastPatternTest530", DetectFastPatternTest530); UtRegisterTest("DetectFastPatternTest531", DetectFastPatternTest531); UtRegisterTest("DetectFastPatternTest532", DetectFastPatternTest532); UtRegisterTest("DetectFastPatternTest533", DetectFastPatternTest533); UtRegisterTest("DetectFastPatternTest534", DetectFastPatternTest534); UtRegisterTest("DetectFastPatternTest535", DetectFastPatternTest535); UtRegisterTest("DetectFastPatternTest536", DetectFastPatternTest536); UtRegisterTest("DetectFastPatternTest537", DetectFastPatternTest537); UtRegisterTest("DetectFastPatternTest538", DetectFastPatternTest538); UtRegisterTest("DetectFastPatternTest539", DetectFastPatternTest539); UtRegisterTest("DetectFastPatternTest540", DetectFastPatternTest540); UtRegisterTest("DetectFastPatternTest541", DetectFastPatternTest541); UtRegisterTest("DetectFastPatternTest542", DetectFastPatternTest542); UtRegisterTest("DetectFastPatternTest543", DetectFastPatternTest543); UtRegisterTest("DetectFastPatternTest544", DetectFastPatternTest544); UtRegisterTest("DetectFastPatternTest545", DetectFastPatternTest545); UtRegisterTest("DetectFastPatternTest546", DetectFastPatternTest546); UtRegisterTest("DetectFastPatternTest547", DetectFastPatternTest547); /* file_data fast_pattern tests ^ */ /* http_user_agent fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest548", DetectFastPatternTest548); UtRegisterTest("DetectFastPatternTest549", DetectFastPatternTest549); UtRegisterTest("DetectFastPatternTest550", DetectFastPatternTest550); UtRegisterTest("DetectFastPatternTest551", DetectFastPatternTest551); UtRegisterTest("DetectFastPatternTest552", DetectFastPatternTest552); UtRegisterTest("DetectFastPatternTest553", DetectFastPatternTest553); UtRegisterTest("DetectFastPatternTest554", DetectFastPatternTest554); UtRegisterTest("DetectFastPatternTest555", DetectFastPatternTest555); UtRegisterTest("DetectFastPatternTest556", DetectFastPatternTest556); UtRegisterTest("DetectFastPatternTest557", DetectFastPatternTest557); UtRegisterTest("DetectFastPatternTest558", DetectFastPatternTest558); UtRegisterTest("DetectFastPatternTest559", DetectFastPatternTest559); UtRegisterTest("DetectFastPatternTest560", DetectFastPatternTest560); UtRegisterTest("DetectFastPatternTest561", DetectFastPatternTest561); UtRegisterTest("DetectFastPatternTest562", DetectFastPatternTest562); UtRegisterTest("DetectFastPatternTest563", DetectFastPatternTest563); UtRegisterTest("DetectFastPatternTest564", DetectFastPatternTest564); UtRegisterTest("DetectFastPatternTest565", DetectFastPatternTest565); UtRegisterTest("DetectFastPatternTest566", DetectFastPatternTest566); UtRegisterTest("DetectFastPatternTest567", DetectFastPatternTest567); UtRegisterTest("DetectFastPatternTest568", DetectFastPatternTest568); UtRegisterTest("DetectFastPatternTest569", DetectFastPatternTest569); UtRegisterTest("DetectFastPatternTest570", DetectFastPatternTest570); UtRegisterTest("DetectFastPatternTest571", DetectFastPatternTest571); UtRegisterTest("DetectFastPatternTest572", DetectFastPatternTest572); UtRegisterTest("DetectFastPatternTest573", DetectFastPatternTest573); UtRegisterTest("DetectFastPatternTest574", DetectFastPatternTest574); UtRegisterTest("DetectFastPatternTest575", DetectFastPatternTest575); UtRegisterTest("DetectFastPatternTest576", DetectFastPatternTest576); UtRegisterTest("DetectFastPatternTest577", DetectFastPatternTest577); UtRegisterTest("DetectFastPatternTest578", DetectFastPatternTest578); UtRegisterTest("DetectFastPatternTest579", DetectFastPatternTest579); UtRegisterTest("DetectFastPatternTest580", DetectFastPatternTest580); UtRegisterTest("DetectFastPatternTest581", DetectFastPatternTest581); UtRegisterTest("DetectFastPatternTest582", DetectFastPatternTest582); UtRegisterTest("DetectFastPatternTest583", DetectFastPatternTest583); UtRegisterTest("DetectFastPatternTest584", DetectFastPatternTest584); UtRegisterTest("DetectFastPatternTest585", DetectFastPatternTest585); UtRegisterTest("DetectFastPatternTest586", DetectFastPatternTest586); UtRegisterTest("DetectFastPatternTest587", DetectFastPatternTest587); UtRegisterTest("DetectFastPatternTest588", DetectFastPatternTest588); /* http_user_agent fast_pattern tests ^ */ /* http_host fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest589", DetectFastPatternTest589); UtRegisterTest("DetectFastPatternTest590", DetectFastPatternTest590); UtRegisterTest("DetectFastPatternTest591", DetectFastPatternTest591); UtRegisterTest("DetectFastPatternTest592", DetectFastPatternTest592); UtRegisterTest("DetectFastPatternTest593", DetectFastPatternTest593); UtRegisterTest("DetectFastPatternTest594", DetectFastPatternTest594); UtRegisterTest("DetectFastPatternTest595", DetectFastPatternTest595); UtRegisterTest("DetectFastPatternTest596", DetectFastPatternTest596); UtRegisterTest("DetectFastPatternTest597", DetectFastPatternTest597); UtRegisterTest("DetectFastPatternTest598", DetectFastPatternTest598); UtRegisterTest("DetectFastPatternTest599", DetectFastPatternTest599); UtRegisterTest("DetectFastPatternTest600", DetectFastPatternTest600); UtRegisterTest("DetectFastPatternTest601", DetectFastPatternTest601); UtRegisterTest("DetectFastPatternTest602", DetectFastPatternTest602); UtRegisterTest("DetectFastPatternTest603", DetectFastPatternTest603); UtRegisterTest("DetectFastPatternTest604", DetectFastPatternTest604); UtRegisterTest("DetectFastPatternTest605", DetectFastPatternTest605); UtRegisterTest("DetectFastPatternTest606", DetectFastPatternTest606); UtRegisterTest("DetectFastPatternTest607", DetectFastPatternTest607); UtRegisterTest("DetectFastPatternTest608", DetectFastPatternTest608); UtRegisterTest("DetectFastPatternTest609", DetectFastPatternTest609); UtRegisterTest("DetectFastPatternTest610", DetectFastPatternTest610); UtRegisterTest("DetectFastPatternTest611", DetectFastPatternTest611); UtRegisterTest("DetectFastPatternTest612", DetectFastPatternTest612); UtRegisterTest("DetectFastPatternTest613", DetectFastPatternTest613); UtRegisterTest("DetectFastPatternTest614", DetectFastPatternTest614); UtRegisterTest("DetectFastPatternTest615", DetectFastPatternTest615); UtRegisterTest("DetectFastPatternTest616", DetectFastPatternTest616); UtRegisterTest("DetectFastPatternTest617", DetectFastPatternTest617); UtRegisterTest("DetectFastPatternTest618", DetectFastPatternTest618); UtRegisterTest("DetectFastPatternTest619", DetectFastPatternTest619); UtRegisterTest("DetectFastPatternTest620", DetectFastPatternTest620); UtRegisterTest("DetectFastPatternTest621", DetectFastPatternTest621); UtRegisterTest("DetectFastPatternTest622", DetectFastPatternTest622); UtRegisterTest("DetectFastPatternTest623", DetectFastPatternTest623); UtRegisterTest("DetectFastPatternTest624", DetectFastPatternTest624); UtRegisterTest("DetectFastPatternTest625", DetectFastPatternTest625); UtRegisterTest("DetectFastPatternTest626", DetectFastPatternTest626); UtRegisterTest("DetectFastPatternTest627", DetectFastPatternTest627); UtRegisterTest("DetectFastPatternTest628", DetectFastPatternTest628); UtRegisterTest("DetectFastPatternTest629", DetectFastPatternTest629); /* http_host fast_pattern tests ^ */ /* http_rawhost fast_pattern tests v */ UtRegisterTest("DetectFastPatternTest630", DetectFastPatternTest630); UtRegisterTest("DetectFastPatternTest631", DetectFastPatternTest631); UtRegisterTest("DetectFastPatternTest632", DetectFastPatternTest632); UtRegisterTest("DetectFastPatternTest633", DetectFastPatternTest633); UtRegisterTest("DetectFastPatternTest634", DetectFastPatternTest634); UtRegisterTest("DetectFastPatternTest635", DetectFastPatternTest635); UtRegisterTest("DetectFastPatternTest636", DetectFastPatternTest636); UtRegisterTest("DetectFastPatternTest637", DetectFastPatternTest637); UtRegisterTest("DetectFastPatternTest638", DetectFastPatternTest638); UtRegisterTest("DetectFastPatternTest639", DetectFastPatternTest639); UtRegisterTest("DetectFastPatternTest640", DetectFastPatternTest640); UtRegisterTest("DetectFastPatternTest641", DetectFastPatternTest641); UtRegisterTest("DetectFastPatternTest642", DetectFastPatternTest642); UtRegisterTest("DetectFastPatternTest643", DetectFastPatternTest643); UtRegisterTest("DetectFastPatternTest644", DetectFastPatternTest644); UtRegisterTest("DetectFastPatternTest645", DetectFastPatternTest645); UtRegisterTest("DetectFastPatternTest646", DetectFastPatternTest646); UtRegisterTest("DetectFastPatternTest647", DetectFastPatternTest647); UtRegisterTest("DetectFastPatternTest648", DetectFastPatternTest648); UtRegisterTest("DetectFastPatternTest649", DetectFastPatternTest649); UtRegisterTest("DetectFastPatternTest650", DetectFastPatternTest650); UtRegisterTest("DetectFastPatternTest651", DetectFastPatternTest651); UtRegisterTest("DetectFastPatternTest652", DetectFastPatternTest652); UtRegisterTest("DetectFastPatternTest653", DetectFastPatternTest653); UtRegisterTest("DetectFastPatternTest654", DetectFastPatternTest654); UtRegisterTest("DetectFastPatternTest655", DetectFastPatternTest655); UtRegisterTest("DetectFastPatternTest656", DetectFastPatternTest656); UtRegisterTest("DetectFastPatternTest657", DetectFastPatternTest657); UtRegisterTest("DetectFastPatternTest658", DetectFastPatternTest658); UtRegisterTest("DetectFastPatternTest659", DetectFastPatternTest659); UtRegisterTest("DetectFastPatternTest660", DetectFastPatternTest660); UtRegisterTest("DetectFastPatternTest661", DetectFastPatternTest661); UtRegisterTest("DetectFastPatternTest662", DetectFastPatternTest662); UtRegisterTest("DetectFastPatternTest663", DetectFastPatternTest663); UtRegisterTest("DetectFastPatternTest664", DetectFastPatternTest664); UtRegisterTest("DetectFastPatternTest665", DetectFastPatternTest665); UtRegisterTest("DetectFastPatternTest666", DetectFastPatternTest666); UtRegisterTest("DetectFastPatternTest667", DetectFastPatternTest667); UtRegisterTest("DetectFastPatternTest668", DetectFastPatternTest668); UtRegisterTest("DetectFastPatternTest669", DetectFastPatternTest669); UtRegisterTest("DetectFastPatternTest670", DetectFastPatternTest670); /* Unittest to check * - if we assign different content_ids to duplicate patterns, but one of the * patterns has a fast_pattern chop set. * - if 2 unique patterns get unique ids. * - if 2 duplicate patterns, with no chop set get unique ids. */ UtRegisterTest("DetectFastPatternTest671", DetectFastPatternTest671); #endif return; } suricata-3.2.1/src/util-fix_checksum.c0000644000000000000000000000403513051004444014572 00000000000000/* * Reference: OpenBSD's pf.c. * * Copyright (c) 2001 Daniel Hartmeier * Copyright (c) 2002 - 2008 Henning Brauer * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above * copyright notice, this list of conditions and the following * disclaimer in the documentation and/or other materials provided * with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * * Effort sponsored in part by the Defense Advanced Research Projects * Agency (DARPA) and Air Force Research Laboratory, Air Force * Materiel Command, USAF, under agreement number F30602-01-2-0537. */ #include /** * \brief Fix-up an IP checksum. * * \param sum The current checksum. * \param old Value of old header parameter. * \param new Value of new header parameter. * * \retval New checksum. */ uint16_t FixChecksum(uint16_t sum, uint16_t old, uint16_t new) { uint32_t l; l = sum + old - new; l = (l >> 16) + (l & 65535); l = l & 65535; return l; } suricata-3.2.1/src/detect-engine.h0000644000000000000000000000771413051004444013676 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_H__ #define __DETECT_ENGINE_H__ #include "detect.h" #include "tm-threads.h" #include "flow-private.h" /* prototypes */ DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix); DetectEngineCtx *DetectEngineCtxInit(void); DetectEngineCtx *DetectEngineCtxInitMinimal(void); void DetectEngineCtxFree(DetectEngineCtx *); TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **); TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *); //inline uint32_t DetectEngineGetMaxSigId(DetectEngineCtx *); /* faster as a macro than a inline function on my box -- VJ */ #define DetectEngineGetMaxSigId(de_ctx) ((de_ctx)->signum) void DetectEngineResetMaxSigId(DetectEngineCtx *); void DetectEngineRegisterTests(void); const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type); int DetectEngineAddToMaster(DetectEngineCtx *de_ctx); DetectEngineCtx *DetectEngineGetCurrent(void); DetectEngineCtx *DetectEngineGetByTenantId(int tenant_id); void DetectEnginePruneFreeList(void); int DetectEngineMoveToFreeList(DetectEngineCtx *de_ctx); DetectEngineCtx *DetectEngineReference(DetectEngineCtx *); void DetectEngineDeReference(DetectEngineCtx **de_ctx); int DetectEngineReload(SCInstance *suri); int DetectEngineEnabled(void); int DetectEngineMTApply(void); int DetectEngineMultiTenantEnabled(void); int DetectEngineMultiTenantSetup(void); int DetectEngineReloadStart(void); int DetectEngineReloadIsStart(void); void DetectEngineReloadSetDone(void); int DetectEngineReloadIsDone(void); int DetectEngineLoadTenantBlocking(uint32_t tenant_id, const char *yaml); int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int reload_cnt); int DetectEngineTentantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id); int DetectEngineTentantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id); int DetectEngineTentantRegisterPcapFile(uint32_t tenant_id); int DetectEngineTentantUnregisterPcapFile(uint32_t tenant_id); int DetectEngineInspectGenericList(ThreadVars *, const DetectEngineCtx *, DetectEngineThreadCtx *, const Signature *, Flow *, const uint8_t, void *, void *, uint64_t, const int); /** * \brief Registers an app inspection engine. * * \param alproto App layer protocol for which we will register the engine. * \param direction The direction for the engine: SIG_FLAG_TOSERVER or * SIG_FLAG_TOCLIENT * \param sm_list The SigMatch list against which the engine works. * \param Callback The engine callback. */ void DetectAppLayerInspectEngineRegister(AppProto alproto, uint32_t dir, int32_t sm_list, int (*Callback)(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *sig, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)); int DetectEngineAppInspectionEngine2Signature(Signature *s); #endif /* __DETECT_ENGINE_H__ */ suricata-3.2.1/src/output-json-email-common.c0000644000000000000000000003621013051004444016031 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Eric Leblond * * Implements json common email logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "tm-threads-common.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "app-layer-parser.h" #include "output.h" #include "app-layer-smtp.h" #include "app-layer.h" #include "util-privs.h" #include "util-buffer.h" #include "util-byte.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "output-json.h" #include "output-json-email-common.h" #ifdef HAVE_LIBJANSSON #define LOG_EMAIL_DEFAULT 0 #define LOG_EMAIL_EXTENDED (1<<0) #define LOG_EMAIL_ARRAY (1<<1) /* require array handling */ #define LOG_EMAIL_COMMA (1<<2) /* require array handling */ #define LOG_EMAIL_BODY_MD5 (1<<3) #define LOG_EMAIL_SUBJECT_MD5 (1<<4) struct { char *config_field; char *email_field; uint32_t flags; } email_fields[] = { { "reply_to", "reply-to", LOG_EMAIL_DEFAULT }, { "bcc", "bcc", LOG_EMAIL_COMMA|LOG_EMAIL_EXTENDED }, { "message_id", "message-id", LOG_EMAIL_EXTENDED }, { "subject", "subject", LOG_EMAIL_EXTENDED }, { "x_mailer", "x-mailer", LOG_EMAIL_EXTENDED }, { "user_agent", "user-agent", LOG_EMAIL_EXTENDED }, { "received", "received", LOG_EMAIL_ARRAY }, { "x_originating_ip", "x-originating-ip", LOG_EMAIL_DEFAULT }, { "in_reply_to", "in-reply-to", LOG_EMAIL_DEFAULT }, { "references", "references", LOG_EMAIL_DEFAULT }, { "importance", "importance", LOG_EMAIL_DEFAULT }, { "priority", "priority", LOG_EMAIL_DEFAULT }, { "sensitivity", "sensitivity", LOG_EMAIL_DEFAULT }, { "organization", "organization", LOG_EMAIL_DEFAULT }, { "content_md5", "content-md5", LOG_EMAIL_DEFAULT }, { "date", "date", LOG_EMAIL_DEFAULT }, { NULL, NULL, LOG_EMAIL_DEFAULT}, }; static inline char *SkipWhiteSpaceTill(char *p, char *savep) { char *sp = p; if (unlikely(p == NULL)) { return NULL; } while (((*sp == '\t') || (*sp == ' ')) && (sp < savep)) { sp++; } return sp; } static json_t* JsonEmailJsonArrayFromCommaList(const uint8_t *val, size_t len) { json_t *ajs = json_array(); if (likely(ajs != NULL)) { char *savep = NULL; char *p; char *sp; char *to_line = BytesToString((uint8_t *)val, len); if (likely(to_line != NULL)) { p = strtok_r(to_line, ",", &savep); if (p == NULL) { json_decref(ajs); SCFree(to_line); return NULL; } sp = SkipWhiteSpaceTill(p, savep); json_array_append_new(ajs, json_string(sp)); while ((p = strtok_r(NULL, ",", &savep)) != NULL) { sp = SkipWhiteSpaceTill(p, savep); json_array_append_new(ajs, json_string(sp)); } } else { json_decref(ajs); return NULL; } SCFree(to_line); } return ajs; } #ifdef HAVE_NSS static void JsonEmailLogJSONMd5(OutputJsonEmailCtx *email_ctx, json_t *js, SMTPTransaction *tx) { if (email_ctx->flags & LOG_EMAIL_SUBJECT_MD5) { MimeDecField *field; MimeDecEntity *entity = tx->msg_tail; if (entity == NULL) { return; } field = MimeDecFindField(entity, "subject"); if (field != NULL) { unsigned char md5[MD5_LENGTH]; char smd5[256]; char *value = BytesToString((uint8_t *)field->value , field->value_len); if (value) { size_t i,x; HASH_HashBuf(HASH_AlgMD5, md5, (unsigned char *)value, strlen(value)); for (i = 0, x = 0; x < sizeof(md5); x++) { i += snprintf(smd5 + i, 255 - i, "%02x", md5[x]); } json_object_set_new(js, "subject_md5", json_string(smd5)); SCFree(value); } } } if (email_ctx->flags & LOG_EMAIL_BODY_MD5) { MimeDecParseState *mime_state = tx->mime_state; if (mime_state && mime_state->md5_ctx && (mime_state->state_flag == PARSE_DONE)) { size_t x; int i; char s[256]; if (likely(s != NULL)) { for (i = 0, x = 0; x < sizeof(mime_state->md5); x++) { i += snprintf(s + i, 255-i, "%02x", mime_state->md5[x]); } json_object_set_new(js, "body_md5", json_string(s)); } } } } #endif static int JsonEmailAddToJsonArray(const uint8_t *val, size_t len, void *data) { json_t *ajs = data; if (ajs == NULL) return 0; char *value = BytesToString((uint8_t *)val, len); json_array_append_new(ajs, json_string(value)); SCFree(value); return 1; } static void JsonEmailLogJSONCustom(OutputJsonEmailCtx *email_ctx, json_t *js, SMTPTransaction *tx) { int f = 0; MimeDecField *field; MimeDecEntity *entity = tx->msg_tail; if (entity == NULL) { return; } while(email_fields[f].config_field) { if (((email_ctx->fields & (1ULL<flags & LOG_EMAIL_EXTENDED) && (email_fields[f].flags & LOG_EMAIL_EXTENDED)) ) { if (email_fields[f].flags & LOG_EMAIL_ARRAY) { json_t *ajs = json_array(); if (ajs) { int found = MimeDecFindFieldsForEach(entity, email_fields[f].email_field, JsonEmailAddToJsonArray, ajs); if (found > 0) { json_object_set_new(js, email_fields[f].config_field, ajs); } else { json_decref(ajs); } } } else if (email_fields[f].flags & LOG_EMAIL_COMMA) { field = MimeDecFindField(entity, email_fields[f].email_field); if (field) { json_t *ajs = JsonEmailJsonArrayFromCommaList(field->value, field->value_len); if (ajs) { json_object_set_new(js, email_fields[f].config_field, ajs); } } } else { field = MimeDecFindField(entity, email_fields[f].email_field); if (field != NULL) { char *s = BytesToString((uint8_t *)field->value, (size_t)field->value_len); if (likely(s != NULL)) { json_object_set_new(js, email_fields[f].config_field, json_string(s)); SCFree(s); } } } } f++; } } /* JSON format logging */ json_t *JsonEmailLogJsonData(const Flow *f, void *state, void *vtx, uint64_t tx_id) { SMTPState *smtp_state; MimeDecParseState *mime_state; MimeDecEntity *entity; json_t *sjs = json_object(); if (sjs == NULL) { SCReturnPtr(NULL, "json_t"); } /* check if we have SMTP state or not */ AppProto proto = FlowGetAppProtocol(f); switch (proto) { case ALPROTO_SMTP: smtp_state = (SMTPState *)state; if (smtp_state == NULL) { SCLogDebug("no smtp state, so no request logging"); json_decref(sjs); SCReturnPtr(NULL, "json_t"); } SMTPTransaction *tx = vtx; mime_state = tx->mime_state; entity = tx->msg_tail; SCLogDebug("lets go mime_state %p, entity %p, state_flag %u", mime_state, entity, mime_state ? mime_state->state_flag : 0); break; default: /* don't know how we got here */ json_decref(sjs); SCReturnPtr(NULL, "json_t"); } if ((mime_state != NULL)) { if (entity == NULL) { json_decref(sjs); SCReturnPtr(NULL, "json_t"); } json_object_set_new(sjs, "status", json_string(MimeDecParseStateGetStatus(mime_state))); MimeDecField *field; /* From: */ field = MimeDecFindField(entity, "from"); if (field != NULL) { char *s = BytesToString((uint8_t *)field->value, (size_t)field->value_len); if (likely(s != NULL)) { //printf("From: \"%s\"\n", s); char * sp = SkipWhiteSpaceTill(s, s + strlen(s)); json_object_set_new(sjs, "from", json_string(sp)); SCFree(s); } } /* To: */ field = MimeDecFindField(entity, "to"); if (field != NULL) { json_t *ajs = JsonEmailJsonArrayFromCommaList(field->value, field->value_len); if (ajs) { json_object_set_new(sjs, "to", ajs); } } /* Cc: */ field = MimeDecFindField(entity, "cc"); if (field != NULL) { json_t *ajs = JsonEmailJsonArrayFromCommaList(field->value, field->value_len); if (ajs) { json_object_set_new(sjs, "cc", ajs); } } if (mime_state->stack == NULL || mime_state->stack->top == NULL || mime_state->stack->top->data == NULL) { json_decref(sjs); SCReturnPtr(NULL, "json_t"); } entity = (MimeDecEntity *)mime_state->stack->top->data; int attch_cnt = 0; int url_cnt = 0; json_t *js_attch = json_array(); json_t *js_url = json_array(); if (entity->url_list != NULL) { MimeDecUrl *url; for (url = entity->url_list; url != NULL; url = url->next) { char *s = BytesToString((uint8_t *)url->url, (size_t)url->url_len); if (s != NULL) { json_array_append_new(js_url, json_string(s)); SCFree(s); url_cnt += 1; } } } for (entity = entity->child; entity != NULL; entity = entity->next) { if (entity->ctnt_flags & CTNT_IS_ATTACHMENT) { char *s = BytesToString((uint8_t *)entity->filename, (size_t)entity->filename_len); json_array_append_new(js_attch, json_string(s)); SCFree(s); attch_cnt += 1; } if (entity->url_list != NULL) { MimeDecUrl *url; for (url = entity->url_list; url != NULL; url = url->next) { char *s = BytesToString((uint8_t *)url->url, (size_t)url->url_len); if (s != NULL) { json_array_append_new(js_url, json_string(s)); SCFree(s); url_cnt += 1; } } } } if (attch_cnt > 0) { json_object_set_new(sjs, "attachment", js_attch); } else { json_decref(js_attch); } if (url_cnt > 0) { json_object_set_new(sjs, "url", js_url); } else { json_decref(js_url); } SCReturnPtr(sjs, "json_t"); } json_decref(sjs); SCReturnPtr(NULL, "json_t"); } /* JSON format logging */ TmEcode JsonEmailLogJson(JsonEmailLogThread *aft, json_t *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id) { json_t *sjs = JsonEmailLogJsonData(f, state, vtx, tx_id); OutputJsonEmailCtx *email_ctx = aft->emaillog_ctx; SMTPTransaction *tx = (SMTPTransaction *) vtx; if (sjs == NULL) { SCReturnInt(TM_ECODE_FAILED); } if ((email_ctx->flags & LOG_EMAIL_EXTENDED) || (email_ctx->fields != 0)) JsonEmailLogJSONCustom(email_ctx, sjs, tx); #ifdef HAVE_NSS JsonEmailLogJSONMd5(email_ctx, sjs, tx); #endif if (sjs) { json_object_set_new(js, "email", sjs); SCReturnInt(TM_ECODE_OK); } else SCReturnInt(TM_ECODE_FAILED); } json_t *JsonEmailAddMetadata(const Flow *f, uint32_t tx_id) { SMTPState *smtp_state = (SMTPState *)FlowGetAppState(f); if (smtp_state) { SMTPTransaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_SMTP, smtp_state, tx_id); if (tx) { return JsonEmailLogJsonData(f, smtp_state, tx, tx_id); } } return NULL; } void OutputEmailInitConf(ConfNode *conf, OutputJsonEmailCtx *email_ctx) { if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended != NULL) { if (ConfValIsTrue(extended)) { email_ctx->flags = LOG_EMAIL_EXTENDED; } } email_ctx->fields = 0; ConfNode *custom; if ((custom = ConfNodeLookupChild(conf, "custom")) != NULL) { ConfNode *field; TAILQ_FOREACH(field, &custom->head, next) { if (field != NULL) { int f = 0; while(email_fields[f].config_field) { if ((strcmp(email_fields[f].config_field, field->val) == 0) || (strcasecmp(email_fields[f].email_field, field->val) == 0)) { email_ctx->fields |= (1ULL<flags = 0; ConfNode *md5_conf; if ((md5_conf = ConfNodeLookupChild(conf, "md5")) != NULL) { ConfNode *field; TAILQ_FOREACH(field, &md5_conf->head, next) { if (field != NULL) { if (strcmp("body", field->val) == 0) { SCLogInfo("Going to log the md5 sum of email body"); email_ctx->flags |= LOG_EMAIL_BODY_MD5; } if (strcmp("subject", field->val) == 0) { SCLogInfo("Going to log the md5 sum of email subject"); email_ctx->flags |= LOG_EMAIL_SUBJECT_MD5; } } } } } return; } #endif suricata-3.2.1/src/output-json-flow.c0000644000000000000000000003423513051004444014430 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements Flow JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "output-json.h" #include "stream-tcp-private.h" #ifdef HAVE_LIBJANSSON typedef struct LogJsonFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ } LogJsonFileCtx; typedef struct JsonFlowLogThread_ { LogJsonFileCtx *flowlog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t uri_cnt; MemBuffer *buffer; } JsonFlowLogThread; #define LOG_HTTP_DEFAULT 0 #define LOG_HTTP_EXTENDED 1 #define LOG_HTTP_CUSTOM 2 static json_t *CreateJSONHeaderFromFlow(Flow *f, char *event_type) { char timebuf[64]; char srcip[46], dstip[46]; Port sp, dp; json_t *js = json_object(); if (unlikely(js == NULL)) return NULL; struct timeval tv; memset(&tv, 0x00, sizeof(tv)); TimeGet(&tv); CreateIsoTimeString(&tv, timebuf, sizeof(timebuf)); srcip[0] = '\0'; dstip[0] = '\0'; if (FLOW_IS_IPV4(f)) { PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip)); } else if (FLOW_IS_IPV6(f)) { PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip)); } sp = f->sp; dp = f->dp; char proto[16]; if (SCProtoNameValid(f->proto) == TRUE) { strlcpy(proto, known_proto[f->proto], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "%03" PRIu32, f->proto); } /* time */ json_object_set_new(js, "timestamp", json_string(timebuf)); CreateJSONFlowId(js, (const Flow *)f); #if 0 // TODO /* sensor id */ if (sensor_id >= 0) json_object_set_new(js, "sensor_id", json_integer(sensor_id)); #endif if (event_type) { json_object_set_new(js, "event_type", json_string(event_type)); } #if 0 /* vlan */ if (f->vlan_id[0] > 0) { json_t *js_vlan; switch (f->vlan_idx) { case 1: json_object_set_new(js, "vlan", json_integer(f->vlan_id[0])); break; case 2: js_vlan = json_array(); if (unlikely(js != NULL)) { json_array_append_new(js_vlan, json_integer(VLAN_GET_ID1(p))); json_array_append_new(js_vlan, json_integer(VLAN_GET_ID2(p))); json_object_set_new(js, "vlan", js_vlan); } break; default: /* shouldn't get here */ break; } } #endif /* tuple */ json_object_set_new(js, "src_ip", json_string(srcip)); switch(f->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "src_port", json_integer(sp)); break; } json_object_set_new(js, "dest_ip", json_string(dstip)); switch(f->proto) { case IPPROTO_ICMP: break; case IPPROTO_UDP: case IPPROTO_TCP: case IPPROTO_SCTP: json_object_set_new(js, "dest_port", json_integer(dp)); break; } json_object_set_new(js, "proto", json_string(proto)); switch (f->proto) { case IPPROTO_ICMP: case IPPROTO_ICMPV6: json_object_set_new(js, "icmp_type", json_integer(f->type)); json_object_set_new(js, "icmp_code", json_integer(f->code)); break; } return js; } /* JSON format logging */ static void JsonFlowLogJSON(JsonFlowLogThread *aft, json_t *js, Flow *f) { #if 0 LogJsonFileCtx *flow_ctx = aft->flowlog_ctx; #endif json_t *hjs = json_object(); if (hjs == NULL) { return; } json_object_set_new(js, "app_proto", json_string(AppProtoToString(f->alproto))); if (f->alproto_ts != f->alproto) { json_object_set_new(js, "app_proto_ts", json_string(AppProtoToString(f->alproto_ts))); } if (f->alproto_tc != f->alproto) { json_object_set_new(js, "app_proto_tc", json_string(AppProtoToString(f->alproto_tc))); } json_object_set_new(hjs, "pkts_toserver", json_integer(f->todstpktcnt)); json_object_set_new(hjs, "pkts_toclient", json_integer(f->tosrcpktcnt)); json_object_set_new(hjs, "bytes_toserver", json_integer(f->todstbytecnt)); json_object_set_new(hjs, "bytes_toclient", json_integer(f->tosrcbytecnt)); char timebuf1[64], timebuf2[64]; CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1)); CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2)); json_object_set_new(hjs, "start", json_string(timebuf1)); json_object_set_new(hjs, "end", json_string(timebuf2)); int32_t age = f->lastts.tv_sec - f->startts.tv_sec; json_object_set_new(hjs, "age", json_integer(age)); if (f->flow_end_flags & FLOW_END_FLAG_EMERGENCY) json_object_set_new(hjs, "emergency", json_true()); const char *state = NULL; if (f->flow_end_flags & FLOW_END_FLAG_STATE_NEW) state = "new"; else if (f->flow_end_flags & FLOW_END_FLAG_STATE_ESTABLISHED) state = "established"; else if (f->flow_end_flags & FLOW_END_FLAG_STATE_CLOSED) state = "closed"; else if (f->flow_end_flags & FLOW_END_FLAG_STATE_BYPASSED) { state = "bypassed"; int flow_state = SC_ATOMIC_GET(f->flow_state); switch (flow_state) { case FLOW_STATE_LOCAL_BYPASSED: json_object_set_new(hjs, "bypass", json_string("local")); break; case FLOW_STATE_CAPTURE_BYPASSED: json_object_set_new(hjs, "bypass", json_string("capture")); break; default: SCLogError(SC_ERR_INVALID_VALUE, "Invalid flow state: %d, contact developers", flow_state); } } json_object_set_new(hjs, "state", json_string(state)); const char *reason = NULL; if (f->flow_end_flags & FLOW_END_FLAG_TIMEOUT) reason = "timeout"; else if (f->flow_end_flags & FLOW_END_FLAG_FORCED) reason = "forced"; else if (f->flow_end_flags & FLOW_END_FLAG_SHUTDOWN) reason = "shutdown"; json_object_set_new(hjs, "reason", json_string(reason)); json_object_set_new(hjs, "alerted", json_boolean(FlowHasAlerts(f))); json_object_set_new(js, "flow", hjs); /* TCP */ if (f->proto == IPPROTO_TCP) { json_t *tjs = json_object(); if (tjs == NULL) { return; } TcpSession *ssn = f->protoctx; char hexflags[3]; snprintf(hexflags, sizeof(hexflags), "%02x", ssn ? ssn->tcp_packet_flags : 0); json_object_set_new(tjs, "tcp_flags", json_string(hexflags)); snprintf(hexflags, sizeof(hexflags), "%02x", ssn ? ssn->client.tcp_flags : 0); json_object_set_new(tjs, "tcp_flags_ts", json_string(hexflags)); snprintf(hexflags, sizeof(hexflags), "%02x", ssn ? ssn->server.tcp_flags : 0); json_object_set_new(tjs, "tcp_flags_tc", json_string(hexflags)); JsonTcpFlags(ssn ? ssn->tcp_packet_flags : 0, tjs); if (ssn) { char *tcp_state = NULL; switch (ssn->state) { case TCP_NONE: tcp_state = "none"; break; case TCP_LISTEN: tcp_state = "listen"; break; case TCP_SYN_SENT: tcp_state = "syn_sent"; break; case TCP_SYN_RECV: tcp_state = "syn_recv"; break; case TCP_ESTABLISHED: tcp_state = "established"; break; case TCP_FIN_WAIT1: tcp_state = "fin_wait1"; break; case TCP_FIN_WAIT2: tcp_state = "fin_wait2"; break; case TCP_TIME_WAIT: tcp_state = "time_wait"; break; case TCP_LAST_ACK: tcp_state = "last_ack"; break; case TCP_CLOSE_WAIT: tcp_state = "close_wait"; break; case TCP_CLOSING: tcp_state = "closing"; break; case TCP_CLOSED: tcp_state = "closed"; break; } json_object_set_new(tjs, "state", json_string(tcp_state)); } json_object_set_new(js, "tcp", tjs); } } static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f) { SCEnter(); JsonFlowLogThread *jhl = (JsonFlowLogThread *)thread_data; /* reset */ MemBufferReset(jhl->buffer); json_t *js = CreateJSONHeaderFromFlow(f, "flow"); //TODO const if (unlikely(js == NULL)) return TM_ECODE_OK; JsonFlowLogJSON(jhl, js, f); OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer); json_object_del(js, "http"); json_object_clear(js); json_decref(js); SCReturnInt(TM_ECODE_OK); } static void OutputFlowLogDeinit(OutputCtx *output_ctx) { LogJsonFileCtx *flow_ctx = output_ctx->data; LogFileCtx *logfile_ctx = flow_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(flow_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "flow.json" OutputCtx *OutputFlowLogInit(ConfNode *conf) { SCLogInfo("hi"); LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_FLOW_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx)); if (unlikely(flow_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(flow_ctx); return NULL; } flow_ctx->file_ctx = file_ctx; output_ctx->data = flow_ctx; output_ctx->DeInit = OutputFlowLogDeinit; return output_ctx; } static void OutputFlowLogDeinitSub(OutputCtx *output_ctx) { LogJsonFileCtx *flow_ctx = output_ctx->data; SCFree(flow_ctx); SCFree(output_ctx); } OutputCtx *OutputFlowLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx)); if (unlikely(flow_ctx == NULL)) return NULL; OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(flow_ctx); return NULL; } flow_ctx->file_ctx = ojc->file_ctx; flow_ctx->flags = LOG_HTTP_DEFAULT; output_ctx->data = flow_ctx; output_ctx->DeInit = OutputFlowLogDeinitSub; return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonFlowLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonFlowLogThread *aft = SCMalloc(sizeof(JsonFlowLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonFlowLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogFlow. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->flowlog_ctx = ((OutputCtx *)initdata)->data; //TODO aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonFlowLogThreadDeinit(ThreadVars *t, void *data) { JsonFlowLogThread *aft = (JsonFlowLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonFlowLogThread)); SCFree(aft); return TM_ECODE_OK; } void JsonFlowLogRegister (void) { /* register as separate module */ OutputRegisterFlowModule(LOGGER_JSON_FLOW, "JsonFlowLog", "flow-json-log", OutputFlowLogInit, JsonFlowLogger, JsonFlowLogThreadInit, JsonFlowLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterFlowSubModule(LOGGER_JSON_FLOW, "eve-log", "JsonFlowLog", "eve-log.flow", OutputFlowLogInitSub, JsonFlowLogger, JsonFlowLogThreadInit, JsonFlowLogThreadDeinit, NULL); } #else void JsonFlowLogRegister (void) { } #endif suricata-3.2.1/src/detect-rpc.c0000644000000000000000000004223213051004444013202 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Implements RPC keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-rpc.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "util-byte.h" /** * \brief Regex for parsing our rpc options */ #define PARSE_REGEX "^\\s*([0-9]{0,10})\\s*(?:,\\s*([0-9]{0,10}|[*])\\s*(?:,\\s*([0-9]{0,10}|[*]))?)?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectRpcMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); int DetectRpcSetup (DetectEngineCtx *, Signature *, char *); void DetectRpcRegisterTests(void); void DetectRpcFree(void *); /** * \brief Registration function for rpc keyword */ void DetectRpcRegister (void) { sigmatch_table[DETECT_RPC].name = "rpc"; sigmatch_table[DETECT_RPC].desc = "match RPC procedure numbers and RPC version"; sigmatch_table[DETECT_RPC].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#rpc"; sigmatch_table[DETECT_RPC].Match = DetectRpcMatch; sigmatch_table[DETECT_RPC].Setup = DetectRpcSetup; sigmatch_table[DETECT_RPC].Free = DetectRpcFree; sigmatch_table[DETECT_RPC].RegisterTests = DetectRpcRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /* * returns 0: no match * 1: match * -1: error */ /** * \brief This function is used to match rpc request set on a packet with those passed via rpc * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectRpcData * * \retval 0 no match * \retval 1 match */ int DetectRpcMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { /* PrintRawDataFp(stdout, p->payload, p->payload_len); */ const DetectRpcData *rd = (const DetectRpcData *)ctx; char *rpcmsg = (char *)p->payload; if (PKT_IS_TCP(p)) { /* if Rpc msg too small */ if (p->payload_len < 28) { SCLogDebug("TCP packet to small for the rpc msg (%u)", p->payload_len); return 0; } rpcmsg += 4; } else if (PKT_IS_UDP(p)) { /* if Rpc msg too small */ if (p->payload_len < 24) { SCLogDebug("UDP packet to small for the rpc msg (%u)", p->payload_len); return 0; } } else { SCLogDebug("No valid proto for the rpc message"); return 0; } /* Point through the rpc msg structure. Use ntohl() to compare values */ RpcMsg *msg = (RpcMsg *)rpcmsg; /* If its not a call, no match */ if (ntohl(msg->type) != 0) { SCLogDebug("RPC message type is not a call"); return 0; } if (ntohl(msg->prog) != rd->program) return 0; if ((rd->flags & DETECT_RPC_CHECK_VERSION) && ntohl(msg->vers) != rd->program_version) return 0; if ((rd->flags & DETECT_RPC_CHECK_PROCEDURE) && ntohl(msg->proc) != rd->procedure) return 0; SCLogDebug("prog:%u pver:%u proc:%u matched", ntohl(msg->prog), ntohl(msg->vers), ntohl(msg->proc)); return 1; } /** * \brief This function is used to parse rpc options passed via rpc keyword * * \param rpcstr Pointer to the user provided rpc options * * \retval rd pointer to DetectRpcData on success * \retval NULL on failure */ DetectRpcData *DetectRpcParse (char *rpcstr) { DetectRpcData *rd = NULL; char *args[3] = {NULL,NULL,NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rpcstr, strlen(rpcstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 ", string %s", ret, rpcstr); goto error; } if (ret > 1) { const char *str_ptr; res = pcre_get_substring((char *)rpcstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[0] = (char *)str_ptr; if (ret > 2) { res = pcre_get_substring((char *)rpcstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[1] = (char *)str_ptr; } if (ret > 3) { res = pcre_get_substring((char *)rpcstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[2] = (char *)str_ptr; } } rd = SCMalloc(sizeof(DetectRpcData)); if (unlikely(rd == NULL)) goto error; rd->flags = 0; rd->program = 0; rd->program_version = 0; rd->procedure = 0; int i; for (i = 0; i < (ret -1); i++) { if (args[i]) { switch (i) { case 0: if (ByteExtractStringUint32(&rd->program, 10, strlen(args[i]), args[i]) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid size specified for the rpc program:\"%s\"", args[i]); goto error; } rd->flags |= DETECT_RPC_CHECK_PROGRAM; break; case 1: if (args[i][0] != '*') { if (ByteExtractStringUint32(&rd->program_version, 10, strlen(args[i]), args[i]) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid size specified for the rpc version:\"%s\"", args[i]); goto error; } rd->flags |= DETECT_RPC_CHECK_VERSION; } break; case 2: if (args[i][0] != '*') { if (ByteExtractStringUint32(&rd->procedure, 10, strlen(args[i]), args[i]) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid size specified for the rpc procedure:\"%s\"", args[i]); goto error; } rd->flags |= DETECT_RPC_CHECK_PROCEDURE; } break; } } else { SCLogError(SC_ERR_INVALID_VALUE, "invalid rpc option %s",args[i]); goto error; } } for (i = 0; i < (ret -1); i++){ if (args[i] != NULL) SCFree(args[i]); } return rd; error: for (i = 0; i < (ret -1) && i < 3; i++){ if (args[i] != NULL) SCFree(args[i]); } if (rd != NULL) DetectRpcFree(rd); return NULL; } /** * \brief this function is used to add the parsed rpcdata into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param rpcstr pointer to the user provided rpc options * * \retval 0 on Success * \retval -1 on Failure */ int DetectRpcSetup (DetectEngineCtx *de_ctx, Signature *s, char *rpcstr) { DetectRpcData *rd = NULL; SigMatch *sm = NULL; rd = DetectRpcParse(rpcstr); if (rd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_RPC; sm->ctx = (SigMatchCtx *)rd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (rd != NULL) DetectRpcFree(rd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectRpcData * * \param rd pointer to DetectRpcData */ void DetectRpcFree(void *ptr) { SCEnter(); if (ptr == NULL) { SCReturn; } DetectRpcData *rd = (DetectRpcData *)ptr; SCFree(rd); SCReturn; } #ifdef UNITTESTS /** * \test DetectRpcTestParse01 is a test to make sure that we return "something" * when given valid rpc opt */ int DetectRpcTestParse01 (void) { int result = 0; DetectRpcData *rd = NULL; rd = DetectRpcParse("123,444,555"); if (rd != NULL) { DetectRpcFree(rd); result = 1; } return result; } /** * \test DetectRpcTestParse02 is a test for setting the established rpc opt */ int DetectRpcTestParse02 (void) { int result = 0; DetectRpcData *rd = NULL; rd = DetectRpcParse("111,222,333"); if (rd != NULL) { if (rd->flags & DETECT_RPC_CHECK_PROGRAM && rd->flags & DETECT_RPC_CHECK_VERSION && rd->flags & DETECT_RPC_CHECK_PROCEDURE && rd->program == 111 && rd->program_version == 222 && rd->procedure == 333) { result = 1; } else { SCLogDebug("Error: Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); } DetectRpcFree(rd); } return result; } /** * \test DetectRpcTestParse03 is a test for checking the wildcards * and not specified fields */ int DetectRpcTestParse03 (void) { int result = 1; DetectRpcData *rd = NULL; rd = DetectRpcParse("111,*,333"); if (rd == NULL) return 0; if ( !(rd->flags & DETECT_RPC_CHECK_PROGRAM && !(rd->flags & DETECT_RPC_CHECK_VERSION) && rd->flags & DETECT_RPC_CHECK_PROCEDURE && rd->program == 111 && rd->program_version == 0 && rd->procedure == 333)) result = 0; SCLogDebug("rd1 Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); rd = DetectRpcParse("111,222,*"); if (rd == NULL) return 0; if ( !(rd->flags & DETECT_RPC_CHECK_PROGRAM && rd->flags & DETECT_RPC_CHECK_VERSION && !(rd->flags & DETECT_RPC_CHECK_PROCEDURE) && rd->program == 111 && rd->program_version == 222 && rd->procedure == 0)) result = 0; SCLogDebug("rd2 Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); rd = DetectRpcParse("111,*,*"); if (rd == NULL) return 0; if ( !(rd->flags & DETECT_RPC_CHECK_PROGRAM && !(rd->flags & DETECT_RPC_CHECK_VERSION) && !(rd->flags & DETECT_RPC_CHECK_PROCEDURE) && rd->program == 111 && rd->program_version == 0 && rd->procedure == 0)) result = 0; SCLogDebug("rd2 Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); rd = DetectRpcParse("111,222"); if (rd == NULL) return 0; if ( !(rd->flags & DETECT_RPC_CHECK_PROGRAM && rd->flags & DETECT_RPC_CHECK_VERSION && !(rd->flags & DETECT_RPC_CHECK_PROCEDURE) && rd->program == 111 && rd->program_version == 222 && rd->procedure == 0)) result = 0; SCLogDebug("rd2 Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); rd = DetectRpcParse("111"); if (rd == NULL) return 0; if ( !(rd->flags & DETECT_RPC_CHECK_PROGRAM && !(rd->flags & DETECT_RPC_CHECK_VERSION) && !(rd->flags & DETECT_RPC_CHECK_PROCEDURE) && rd->program == 111 && rd->program_version == 0 && rd->procedure == 0)) result = 0; SCLogDebug("rd2 Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); return result; } /** * \test DetectRpcTestParse04 is a test for check the discarding of empty options */ int DetectRpcTestParse04 (void) { int result = 0; DetectRpcData *rd = NULL; rd = DetectRpcParse(""); if (rd == NULL) { result = 1; } else { SCLogDebug("Error: Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); } return result; } /** * \test DetectRpcTestParse05 is a test for check invalid values */ int DetectRpcTestParse05 (void) { int result = 0; DetectRpcData *rd = NULL; rd = DetectRpcParse("111,aaa,*"); if (rd == NULL) { result = 1; } else { SCLogDebug("Error: Flags: %d; program: %u, version: %u, procedure: %u", rd->flags, rd->program, rd->program_version, rd->procedure); DetectRpcFree(rd); } return result; } /** * \test DetectRpcTestParse05 is a test to check the match function */ static int DetectRpcTestSig01(void) { /* RPC Call */ uint8_t buf[] = { /* XID */ 0x64,0xb2,0xb3,0x75, /* Message type: Call (0) */ 0x00,0x00,0x00,0x00, /* RPC Version (2) */ 0x00,0x00,0x00,0x02, /* Program portmap (100000) */ 0x00,0x01,0x86,0xa0, /* Program version (2) */ 0x00,0x00,0x00,0x02, /* Program procedure (3) = GETPORT */ 0x00,0x00,0x00,0x03, /* AUTH_NULL */ 0x00,0x00,0x00,0x00, /* Length 0 */ 0x00,0x00,0x00,0x00, /* VERIFIER NULL */ 0x00,0x00,0x00,0x00, /* Length 0 */ 0x00,0x00,0x00,0x00, /* Program portmap */ 0x00,0x01,0x86,0xa2, /* Version 2 */ 0x00,0x00,0x00,0x02, /* Proto UDP */ 0x00,0x00,0x00,0x11, /* Port 0 */ 0x00,0x00,0x00,0x00 }; uint16_t buflen = sizeof(buf); Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_UDP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert udp any any -> any any (msg:\"RPC Get Port Call\"; rpc:100000, 2, 3; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert udp any any -> any any (msg:\"RPC Get Port Call\"; rpc:100000, 2, *; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert udp any any -> any any (msg:\"RPC Get Port Call\"; rpc:100000, *, 3; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert udp any any -> any any (msg:\"RPC Get Port Call\"; rpc:100000, *, *; sid:4;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert udp any any -> any any (msg:\"RPC Get XXX Call.. no match\"; rpc:123456, *, 3; sid:5;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 didnt alert, but it should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { printf("sid 2 didnt alert, but it should have: "); goto cleanup; } else if (PacketAlertCheck(p, 3) == 0) { printf("sid 3 didnt alert, but it should have: "); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { printf("sid 4 didnt alert, but it should have: "); goto cleanup; } else if (PacketAlertCheck(p, 5) > 0) { printf("sid 5 did alert, but should not: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectRpc */ void DetectRpcRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectRpcTestParse01", DetectRpcTestParse01); UtRegisterTest("DetectRpcTestParse02", DetectRpcTestParse02); UtRegisterTest("DetectRpcTestParse03", DetectRpcTestParse03); UtRegisterTest("DetectRpcTestParse04", DetectRpcTestParse04); UtRegisterTest("DetectRpcTestParse05", DetectRpcTestParse05); UtRegisterTest("DetectRpcTestSig01", DetectRpcTestSig01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-ssl-version.h0000644000000000000000000000251513051004444014707 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-ssl-version.h * * \author Gurvinder Singh * */ #ifndef DETECT_SSL_VERSION_H #define DETECT_SSL_VERSION_H #define DETECT_SSL_VERSION_NEGATED 0x01 enum { SSLv2 = 0, SSLv3 = 1, TLS10 = 2, TLS11 = 3, TLS12 = 4, TLS_SIZE = 5, TLS_UNKNOWN = 6, }; typedef struct SSLVersionData_ { uint16_t ver; /** ssl version to match */ uint8_t flags; } SSLVersionData; typedef struct DetectSslVersionData_ { SSLVersionData data[TLS_SIZE]; } DetectSslVersionData; /* prototypes */ void DetectSslVersionRegister (void); #endif /* DETECT_SSL_VERSION_H */ suricata-3.2.1/src/decode-mpls.c0000644000000000000000000002245513051004444013351 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jason Ish * * MPLS decoder. */ #include "suricata-common.h" #include "decode.h" #include "util-unittest.h" #define MPLS_HEADER_LEN 4 #define MPLS_PW_LEN 4 #define MPLS_MAX_RESERVED_LABEL 15 #define MPLS_LABEL_IPV4 0 #define MPLS_LABEL_ROUTER_ALERT 1 #define MPLS_LABEL_IPV6 2 #define MPLS_LABEL_NULL 3 #define MPLS_LABEL(shim) ntohl(shim) >> 12 #define MPLS_BOTTOM(shim) ((ntohl(shim) >> 8) & 0x1) /* Inner protocol guessing values. */ #define MPLS_PROTO_ETHERNET_PW 0 #define MPLS_PROTO_IPV4 4 #define MPLS_PROTO_IPV6 6 int DecodeMPLS(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { uint32_t shim; int label; int event = 0; StatsIncr(tv, dtv->counter_mpls); do { if (len < MPLS_HEADER_LEN) { ENGINE_SET_INVALID_EVENT(p, MPLS_HEADER_TOO_SMALL); return TM_ECODE_FAILED; } shim = *(uint32_t *)pkt; pkt += MPLS_HEADER_LEN; len -= MPLS_HEADER_LEN; } while (MPLS_BOTTOM(shim) == 0); label = MPLS_LABEL(shim); if (label == MPLS_LABEL_IPV4) { return DecodeIPV4(tv, dtv, p, pkt, len, pq); } else if (label == MPLS_LABEL_ROUTER_ALERT) { /* Not valid at the bottom of the stack. */ event = MPLS_BAD_LABEL_ROUTER_ALERT; } else if (label == MPLS_LABEL_IPV6) { return DecodeIPV6(tv, dtv, p, pkt, len, pq); } else if (label == MPLS_LABEL_NULL) { /* Shouldn't appear on the wire. */ event = MPLS_BAD_LABEL_IMPLICIT_NULL; } else if (label < MPLS_MAX_RESERVED_LABEL) { event = MPLS_BAD_LABEL_RESERVED; } if (event) { goto end; } /* Best guess at inner packet. */ switch (pkt[0] >> 4) { case MPLS_PROTO_IPV4: DecodeIPV4(tv, dtv, p, pkt, len, pq); break; case MPLS_PROTO_IPV6: DecodeIPV6(tv, dtv, p, pkt, len, pq); break; case MPLS_PROTO_ETHERNET_PW: DecodeEthernet(tv, dtv, p, pkt + MPLS_PW_LEN, len - MPLS_PW_LEN, pq); break; default: ENGINE_SET_INVALID_EVENT(p, MPLS_UNKNOWN_PAYLOAD_TYPE); return TM_ECODE_OK; } end: if (event) { ENGINE_SET_EVENT(p, event); } return TM_ECODE_OK; } #ifdef UNITTESTS static int DecodeMPLSTestHeaderTooSmall(void) { int ret = 1; /* A packet that is too small to have a complete MPLS header. */ uint8_t pkt[] = { 0x00, 0x00, 0x11 }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return 0; } ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL); if (!ENGINE_ISSET_EVENT(p, MPLS_HEADER_TOO_SMALL)) { ret = 0; } SCFree(p); return ret; } static int DecodeMPLSTestBadLabelRouterAlert(void) { int ret = 1; uint8_t pkt[] = { 0x00, 0x00, 0x11, 0xff, 0x45, 0x00, 0x00, 0x64, 0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a, 0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01, 0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return 0; } ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL); if (!ENGINE_ISSET_EVENT(p, MPLS_BAD_LABEL_ROUTER_ALERT)) { ret = 0; } SCFree(p); return ret; } static int DecodeMPLSTestBadLabelImplicitNull(void) { int ret = 1; uint8_t pkt[] = { 0x00, 0x00, 0x31, 0xff, 0x45, 0x00, 0x00, 0x64, 0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a, 0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01, 0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return 0; } ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL); if (!ENGINE_ISSET_EVENT(p, MPLS_BAD_LABEL_IMPLICIT_NULL)) { ret = 0; } SCFree(p); return ret; } static int DecodeMPLSTestBadLabelReserved(void) { int ret = 1; uint8_t pkt[] = { 0x00, 0x00, 0x51, 0xff, 0x45, 0x00, 0x00, 0x64, 0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a, 0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01, 0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return 0; } ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL); if (!ENGINE_ISSET_EVENT(p, MPLS_BAD_LABEL_RESERVED)) { ret = 0; } SCFree(p); return ret; } static int DecodeMPLSTestUnknownPayloadType(void) { int ret = 1; /* Valid label: 21. * Unknown payload type: 1. */ uint8_t pkt[] = { 0x00, 0x01, 0x51, 0xff, 0x15, 0x00, 0x00, 0x64, 0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a, 0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01, 0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) { return 0; } ThreadVars tv; DecodeThreadVars dtv; memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL); if (!ENGINE_ISSET_EVENT(p, MPLS_UNKNOWN_PAYLOAD_TYPE)) { ret = 0; } SCFree(p); return ret; } #endif /* UNITTESTS */ void DecodeMPLSRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeMPLSTestHeaderTooSmall", DecodeMPLSTestHeaderTooSmall); UtRegisterTest("DecodeMPLSTestBadLabelRouterAlert", DecodeMPLSTestBadLabelRouterAlert); UtRegisterTest("DecodeMPLSTestBadLabelImplicitNull", DecodeMPLSTestBadLabelImplicitNull); UtRegisterTest("DecodeMPLSTestBadLabelReserved", DecodeMPLSTestBadLabelReserved); UtRegisterTest("DecodeMPLSTestUnknownPayloadType", DecodeMPLSTestUnknownPayloadType); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-flowint.c0000644000000000000000000012453313051004444014105 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Flowvar management for integer types, part of the detection engine * Keyword: flowint */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "threads.h" #include "flow.h" #include "flow-var.h" #include "detect-flowint.h" #include "util-spm.h" #include "util-var-name.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-sigorder.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" /* name modifiers value */ #define PARSE_REGEX "^\\s*([a-zA-Z][\\w\\d_./]+)\\s*,\\s*([+=-]{1}|==|!=|<|<=|>|>=|isset|notset)\\s*,?\\s*([a-zA-Z][\\w\\d]+|[\\d]{1,10})?\\s*$" /* Varnames must begin with a letter */ static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectFlowintMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFlowintSetup(DetectEngineCtx *, Signature *, char *); void DetectFlowintFree(void *); void DetectFlowintRegisterTests(void); void DetectFlowintRegister(void) { sigmatch_table[DETECT_FLOWINT].name = "flowint"; sigmatch_table[DETECT_FLOWINT].desc = "operate on a per-flow integer"; sigmatch_table[DETECT_FLOWINT].url = DOC_URL DOC_VERSION "/rules/flowint.html"; sigmatch_table[DETECT_FLOWINT].Match = DetectFlowintMatch; sigmatch_table[DETECT_FLOWINT].Setup = DetectFlowintSetup; sigmatch_table[DETECT_FLOWINT].Free = DetectFlowintFree; sigmatch_table[DETECT_FLOWINT].RegisterTests = DetectFlowintRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to create a flowint, add/substract values, * compare it with other flowints, etc * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the current Signature * \param m pointer to the sigmatch that we will cast into DetectFlowintData * * \retval 0 no match, when a var doesn't exist * \retval 1 match, when a var is initialized well, add/substracted, or a true * condition */ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectFlowintData *sfd = (const DetectFlowintData *)ctx; FlowVar *fv; FlowVar *fvt; uint32_t targetval; int ret = 0; /** ATM If we are going to compare the current var with another * that doesn't exist, the default value will be zero; * if you don't want this behaviour, you can use the keyword * "isset" to make it match or not before using the default * value of zero; * But it is mandatory that the current var exist, otherwise, it will * return zero(not match). */ if (sfd->targettype == FLOWINT_TARGET_VAR) { uint16_t tvar_idx = VariableNameGetIdx(det_ctx->de_ctx, sfd->target.tvar.name, VAR_TYPE_FLOW_INT); fvt = FlowVarGet(p->flow, tvar_idx); /* We don't have that variable initialized yet */ if (fvt == NULL) targetval = 0; else targetval = fvt->data.fv_int.value; } else { targetval = sfd->target.value; } SCLogDebug("Our var %s is at idx: %"PRIu16"", sfd->name, sfd->idx); if (sfd->modifier == FLOWINT_MODIFIER_SET) { FlowVarAddIntNoLock(p->flow, sfd->idx, targetval); SCLogDebug("Setting %s = %u", sfd->name, targetval); ret = 1; goto end; } fv = FlowVarGet(p->flow, sfd->idx); if (sfd->modifier == FLOWINT_MODIFIER_ISSET) { SCLogDebug(" Isset %s? = %u", sfd->name,(fv) ? 1 : 0); if (fv != NULL) ret = 1; goto end; } if (sfd->modifier == FLOWINT_MODIFIER_NOTSET) { SCLogDebug(" Not set %s? = %u", sfd->name,(fv) ? 0 : 1); if (fv == NULL) ret = 1; goto end; } if (fv != NULL && fv->datatype == FLOWVAR_TYPE_INT) { if (sfd->modifier == FLOWINT_MODIFIER_ADD) { SCLogDebug("Adding %u to %s", targetval, sfd->name); FlowVarAddIntNoLock(p->flow, sfd->idx, fv->data.fv_int.value + targetval); ret = 1; goto end; } if (sfd->modifier == FLOWINT_MODIFIER_SUB) { SCLogDebug("Substracting %u to %s", targetval, sfd->name); FlowVarAddIntNoLock(p->flow, sfd->idx, fv->data.fv_int.value - targetval); ret = 1; goto end; } switch(sfd->modifier) { case FLOWINT_MODIFIER_EQ: SCLogDebug("( %u EQ %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value == targetval); break; case FLOWINT_MODIFIER_NE: SCLogDebug("( %u NE %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value != targetval); break; case FLOWINT_MODIFIER_LT: SCLogDebug("( %u LT %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value < targetval); break; case FLOWINT_MODIFIER_LE: SCLogDebug("( %u LE %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value <= targetval); break; case FLOWINT_MODIFIER_GT: SCLogDebug("( %u GT %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value > targetval); break; case FLOWINT_MODIFIER_GE: SCLogDebug("( %u GE %u )", fv->data.fv_int.value, targetval); ret = (fv->data.fv_int.value >= targetval); break; default: SCLogDebug("Unknown Modifier!"); #ifdef DEBUG BUG_ON(1); #endif } } else { /* allow a add on a non-existing var, it will init to the "add" value, * so implying a 0 set. */ if (sfd->modifier == FLOWINT_MODIFIER_ADD) { SCLogDebug("Adding %u to %s (new var)", targetval, sfd->name); FlowVarAddIntNoLock(p->flow, sfd->idx, targetval); ret = 1; } else { SCLogDebug("Var not found!"); /* It doesn't exist because it wasn't set * or it is a string var, that we don't compare here */ ret = 0; } } end: return ret; } /** * \brief This function is used to parse a flowint option * * \param de_ctx pointer to the engine context * \param rawstr pointer to the string holding the options * * \retval NULL if invalid option * \retval DetectFlowintData pointer with the flowint parsed */ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx, char *rawstr) { DetectFlowintData *sfd = NULL; char *varname = NULL; char *varval = NULL; char *modstr = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; uint8_t modifier = FLOWINT_MODIFIER_UNKNOWN; unsigned long long value_long = 0; const char *str_ptr; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for flowint(ret = %d).", rawstr, ret); return NULL; } /* Get our flowint varname */ res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } varname = (char *)str_ptr; res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0 || str_ptr == NULL) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } modstr = (char *)str_ptr; /* Get the modifier */ if (strcmp("=", modstr) == 0) modifier = FLOWINT_MODIFIER_SET; if (strcmp("+", modstr) == 0) modifier = FLOWINT_MODIFIER_ADD; if (strcmp("-", modstr) == 0) modifier = FLOWINT_MODIFIER_SUB; if (strcmp("<", modstr) == 0) modifier = FLOWINT_MODIFIER_LT; if (strcmp("<=", modstr) == 0) modifier = FLOWINT_MODIFIER_LE; if (strcmp("!=", modstr) == 0) modifier = FLOWINT_MODIFIER_NE; if (strcmp("==", modstr) == 0) modifier = FLOWINT_MODIFIER_EQ; if (strcmp(">=", modstr) == 0) modifier = FLOWINT_MODIFIER_GE; if (strcmp(">", modstr) == 0) modifier = FLOWINT_MODIFIER_GT; if (strcmp("isset", modstr) == 0) modifier = FLOWINT_MODIFIER_ISSET; if (strcmp("notset", modstr) == 0) modifier = FLOWINT_MODIFIER_NOTSET; if (modifier == FLOWINT_MODIFIER_UNKNOWN) { SCLogError(SC_ERR_UNKNOWN_VALUE, "Unknown modifier"); goto error; } sfd = SCMalloc(sizeof(DetectFlowintData)); if (unlikely(sfd == NULL)) goto error; /* If we need another arg, check it out(isset doesn't need another arg) */ if (modifier != FLOWINT_MODIFIER_ISSET && modifier != FLOWINT_MODIFIER_NOTSET) { if (ret < 4) goto error; res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); varval = (char *)str_ptr; if (res < 0 || varval == NULL || strcmp(varval, "") == 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if (varval[0] >= '0' && varval[0] <= '9') { /* is digit, look at the regexp */ sfd->targettype = FLOWINT_TARGET_VAL; value_long = atoll(varval); if (value_long > UINT32_MAX) { SCLogDebug("DetectFlowintParse: Cannot load this value." " Values should be between 0 and %"PRIu32, UINT32_MAX); goto error; } sfd->target.value = (uint32_t) value_long; } else { sfd->targettype = FLOWINT_TARGET_VAR; sfd->target.tvar.name = SCStrdup(varval); if (unlikely(sfd->target.tvar.name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "malloc from strdup failed"); goto error; } } } else { sfd->targettype = FLOWINT_TARGET_SELF; } /* Set the name of the origin var to modify/compared with the target */ sfd->name = SCStrdup(varname); if (unlikely(sfd->name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "malloc from strdup failed"); goto error; } if (de_ctx != NULL) sfd->idx = VariableNameGetIdx(de_ctx, varname, VAR_TYPE_FLOW_INT); sfd->modifier = modifier; pcre_free_substring(varname); pcre_free_substring(modstr); if (varval) pcre_free_substring(varval); return sfd; error: if (varname) pcre_free_substring(varname); if (varval) pcre_free_substring(varval); if (modstr) pcre_free_substring(modstr); if (sfd != NULL) SCFree(sfd); return NULL; } /** * \brief This function is used to set up the SigMatch holding the flowint opt * * \param de_ctx pointer to the engine context * \param s pointer to the current Signature * \param rawstr pointer to the string holding the options * * \retval 0 if all is ok * \retval -1 if we find any problem */ static int DetectFlowintSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectFlowintData *sfd = NULL; SigMatch *sm = NULL; sfd = DetectFlowintParse(de_ctx, rawstr); if (sfd == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FLOWINT; sm->ctx = (SigMatchCtx *)sfd; switch (sfd->modifier) { case FLOWINT_MODIFIER_SET: case FLOWINT_MODIFIER_ADD: case FLOWINT_MODIFIER_SUB: SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); break; case FLOWINT_MODIFIER_LT: case FLOWINT_MODIFIER_LE: case FLOWINT_MODIFIER_NE: case FLOWINT_MODIFIER_EQ: case FLOWINT_MODIFIER_GE: case FLOWINT_MODIFIER_GT: case FLOWINT_MODIFIER_ISSET: case FLOWINT_MODIFIER_NOTSET: SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); break; default: goto error; } return 0; error: if (sfd) DetectFlowintFree(sfd); if (sm) SCFree(sm); return -1; } /** * \brief This function is used to free the data of DetectFlowintData */ void DetectFlowintFree(void *tmp) { DetectFlowintData *sfd =(DetectFlowintData*) tmp; if (sfd != NULL) { if (sfd->name != NULL) SCFree(sfd->name); if (sfd->targettype == FLOWINT_TARGET_VAR) if (sfd->target.tvar.name != NULL) SCFree(sfd->target.tvar.name); SCFree(sfd); } } /** * \brief This is a helper funtion used for debugging purposes */ void DetectFlowintPrintData(DetectFlowintData *sfd) { if (sfd == NULL) { SCLogDebug("DetectFlowintPrintData: Error, DetectFlowintData == NULL!"); return; } SCLogDebug("Varname: %s, modifier: %"PRIu8", idx: %"PRIu16" Target: ", sfd->name, sfd->modifier, sfd->idx); switch(sfd->targettype) { case FLOWINT_TARGET_VAR: SCLogDebug("target_var: %s", sfd->target.tvar.name); break; case FLOWINT_TARGET_VAL: SCLogDebug("Value: %"PRIu32"; ", sfd->target.value); break; default : SCLogDebug("DetectFlowintPrintData: Error, Targettype not known!"); } } #ifdef UNITTESTS /** * \test DetectFlowintTestParseVal01 is a test to make sure that we set the * DetectFlowint correctly for setting a valid target value */ int DetectFlowintTestParseVal01(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,=,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_SET) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar01 is a test to make sure that we set the * DetectFlowint correctly for setting a valid target variable */ int DetectFlowintTestParseVar01(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,=,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_SET) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal02 is a test to make sure that we set the * DetectFlowint correctly for adding a valid target value */ int DetectFlowintTestParseVal02(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,+,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_ADD) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar02 is a test to make sure that we set the * DetectFlowint correctly for adding a valid target variable */ int DetectFlowintTestParseVar02(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,+,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_ADD) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal03 is a test to make sure that we set the * DetectFlowint correctly for substract a valid target value */ int DetectFlowintTestParseVal03(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,-,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_SUB) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar03 is a test to make sure that we set the * DetectFlowint correctly for substract a valid target variable */ int DetectFlowintTestParseVar03(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,-,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_SUB) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal04 is a test to make sure that we set the * DetectFlowint correctly for checking if equal to a valid target value */ int DetectFlowintTestParseVal04(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,==,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_EQ) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar04 is a test to make sure that we set the * DetectFlowint correctly for checking if equal to a valid target variable */ int DetectFlowintTestParseVar04(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,==,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_EQ) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal05 is a test to make sure that we set the * DetectFlowint correctly for cheking if not equal to a valid target value */ int DetectFlowintTestParseVal05(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,!=,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_NE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar05 is a test to make sure that we set the * DetectFlowint correctly for checking if not equal to a valid target variable */ int DetectFlowintTestParseVar05(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,!=,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_NE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal06 is a test to make sure that we set the * DetectFlowint correctly for cheking if greater than a valid target value */ int DetectFlowintTestParseVal06(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, >,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_GT) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar06 is a test to make sure that we set the * DetectFlowint correctly for checking if greater than a valid target variable */ int DetectFlowintTestParseVar06(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, >,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_GT) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal07 is a test to make sure that we set the * DetectFlowint correctly for cheking if greater or equal than a valid target value */ int DetectFlowintTestParseVal07(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, >= ,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_GE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar07 is a test to make sure that we set the * DetectFlowint correctly for checking if greater or equal than a valid target variable */ int DetectFlowintTestParseVar07(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, >= ,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_GE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal08 is a test to make sure that we set the * DetectFlowint correctly for cheking if lower or equal than a valid target value */ int DetectFlowintTestParseVal08(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, <= ,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_LE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar08 is a test to make sure that we set the * DetectFlowint correctly for checking if lower or equal than a valid target variable */ int DetectFlowintTestParseVar08(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, <= ,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_LE) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVal09 is a test to make sure that we set the * DetectFlowint correctly for cheking if lower than a valid target value */ int DetectFlowintTestParseVal09(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, < ,35"); DetectFlowintPrintData(sfd); if (sfd != NULL && sfd->target.value == 35 && !strcmp(sfd->name, "myvar") && sfd->modifier == FLOWINT_MODIFIER_LT) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar09 is a test to make sure that we set the * DetectFlowint correctly for checking if lower than a valid target variable */ int DetectFlowintTestParseVar09(void) { int result = 0; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, < ,targetvar"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_VAR && sfd->target.tvar.name != NULL && !strcmp(sfd->target.tvar.name, "targetvar") && sfd->modifier == FLOWINT_MODIFIER_LT) { result = 1; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseVar09 is a test to make sure that handle the * isset keyword correctly */ int DetectFlowintTestParseIsset10(void) { int result = 1; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) return 0; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar, isset"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_SELF && sfd->modifier == FLOWINT_MODIFIER_ISSET) { result &= 1; } else { result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar, notset"); DetectFlowintPrintData(sfd); if (sfd != NULL && !strcmp(sfd->name, "myvar") && sfd->targettype == FLOWINT_TARGET_SELF && sfd->modifier == FLOWINT_MODIFIER_NOTSET) { result &= 1; } else { result = 0; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectFlowintTestParseInvalidSyntaxis01 is a test to make sure that we dont set the * DetectFlowint for a invalid input option */ int DetectFlowintTestParseInvalidSyntaxis01(void) { int result = 1; DetectFlowintData *sfd = NULL; DetectEngineCtx *de_ctx; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto error; de_ctx->flags |= DE_QUIET; sfd = DetectFlowintParse(de_ctx, "myvar,=,9999999999"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,=,9532458716234857"); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar,=,45targetvar"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,=,45targetvar "); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "657myvar,=,targetvar"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at 657myvar,=,targetvar "); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar,=<,targetvar"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,=<,targetvar "); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar,===,targetvar"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,===,targetvar "); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar,=="); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,=="); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar,"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar,"); result = 0; } if (sfd) DetectFlowintFree(sfd); sfd = DetectFlowintParse(de_ctx, "myvar"); if (sfd != NULL) { SCLogDebug("DetectFlowintTestParseInvalidSyntaxis01: ERROR: invalid option at myvar"); result = 0; } if (sfd) DetectFlowintFree(sfd); DetectEngineCtxFree(de_ctx); return result; error: if (de_ctx) DetectEngineCtxFree(de_ctx); return result; } /** \test DetectFlowintTestPacket01Real * \brief Set a counter when we see a content:"GET" * and increment it by 2 if we match a "Unauthorized" * When it reach 3(with the last +2), another counter starts * and when that counter reach 6 packets. * * All the Signatures generate an alert(its for testing) * but the ignature that increment the second counter +1, that has * a "noalert", so we can do all increments * silently until we reach 6 next packets counted */ int DetectFlowintTestPacket01Real() { Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; char *sigs[5]; sigs[0] = "alert tcp any any -> any any (msg:\"Setting a flowint counter\"; content:\"GET\"; flowint:myvar,=,1; flowint:maxvar,=,6; sid:101;)"; sigs[1] = "alert tcp any any -> any any (msg:\"Adding to flowint counter\"; content:\"Unauthorized\"; flowint: myvar,+,2; sid:102;)"; sigs[2] = "alert tcp any any -> any any (msg:\"if the flowint counter is 3 create a new counter\"; content:\"Unauthorized\"; flowint: myvar,==,3; flowint: cntpackets, =, 0; sid:103;)"; sigs[3] = "alert tcp any any -> any any (msg:\"and count the rest of the packets received without generating alerts!!!\"; flowint: myvar,==,3; flowint: cntpackets, +, 1; noalert;sid:104;)"; sigs[4] = "alert tcp any any -> any any (msg:\" and fire this when it reach 6\"; flowint: cntpackets, ==, maxvar; sid:105;)"; FAIL_IF(UTHAppendSigs(de_ctx, sigs, 5) == 0); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v,(void *) de_ctx,(void *) &det_ctx); Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80); FAIL_IF(f == NULL); f->proto = IPPROTO_TCP; p = UTHBuildPacket((uint8_t *)"GET", 3, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 101)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"Unauthorized", 12, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 102)); FAIL_IF(!PacketAlertCheck(p, 103)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"1", 1, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"X", 1, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 105)); UTHFreePacket(p); UTHFreeFlow(f); DetectEngineThreadCtxDeinit(&th_v,(void *) det_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test DetectFlowintTestPacket02Real * \brief like DetectFlowintTestPacket01Real but using isset/notset keywords */ static int DetectFlowintTestPacket02Real() { Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; char *sigs[5]; sigs[0] = "alert tcp any any -> any any (msg:\"Setting a flowint counter\"; content:\"GET\"; flowint: myvar, notset; flowint:maxvar,notset; flowint: myvar,=,1; flowint: maxvar,=,6; sid:101;)"; sigs[1] = "alert tcp any any -> any any (msg:\"Adding to flowint counter\"; content:\"Unauthorized\"; flowint:myvar,isset; flowint: myvar,+,2; sid:102;)"; sigs[2] = "alert tcp any any -> any any (msg:\"if the flowint counter is 3 create a new counter\"; content:\"Unauthorized\"; flowint: myvar, isset; flowint: myvar,==,3; flowint:cntpackets,notset; flowint: cntpackets, =, 0; sid:103;)"; sigs[3] = "alert tcp any any -> any any (msg:\"and count the rest of the packets received without generating alerts!!!\"; flowint: cntpackets,isset; flowint: cntpackets, +, 1; noalert;sid:104;)"; sigs[4] = "alert tcp any any -> any any (msg:\" and fire this when it reach 6\"; flowint: cntpackets, isset; flowint: maxvar,isset; flowint: cntpackets, ==, maxvar; sid:105;)"; FAIL_IF(UTHAppendSigs(de_ctx, sigs, 5) == 0); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v,(void *) de_ctx,(void *) &det_ctx); Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80); FAIL_IF(f == NULL); f->proto = IPPROTO_TCP; p = UTHBuildPacket((uint8_t *)"GET", 3, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 101)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"Unauthorized", 12, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 102)); FAIL_IF(!PacketAlertCheck(p, 103)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"1", 1, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"X", 1, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 105)); UTHFreePacket(p); UTHFreeFlow(f); DetectEngineThreadCtxDeinit(&th_v,(void *) det_ctx); DetectEngineCtxFree(de_ctx); PASS; } /** * \test DetectFlowintTestPacket03Real * \brief Check the behaviour of isset/notset */ int DetectFlowintTestPacket03Real() { Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF(de_ctx == NULL); de_ctx->flags |= DE_QUIET; char *sigs[3]; sigs[0] = "alert tcp any any -> any any (msg:\"check notset\"; content:\"GET\"; flowint: myvar, notset; flowint: myvar,=,0; flowint: other,=,10; sid:101;)"; sigs[1] = "alert tcp any any -> any any (msg:\"check isset\"; content:\"Unauthorized\"; flowint:myvar,isset; flowint: other,isset; sid:102;)"; sigs[2] = "alert tcp any any -> any any (msg:\"check notset\"; content:\"Unauthorized\"; flowint:lala,isset; sid:103;)"; FAIL_IF(UTHAppendSigs(de_ctx, sigs, 3) == 0); SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v,(void *) de_ctx,(void *) &det_ctx); Flow *f = UTHBuildFlow(AF_INET, "192.168.1.5", "192.168.1.1", 41424, 80); FAIL_IF(f == NULL); f->proto = IPPROTO_TCP; p = UTHBuildPacket((uint8_t *)"GET", 3, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 101)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"Unauthorized", 12, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!PacketAlertCheck(p, 102)); FAIL_IF(PacketAlertCheck(p, 103)); UTHFreePacket(p); p = UTHBuildPacket((uint8_t *)"1", 1, IPPROTO_TCP); FAIL_IF(p == NULL); p->flow = f; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 102)); FAIL_IF(PacketAlertCheck(p, 103)); UTHFreePacket(p); UTHFreeFlow(f); DetectEngineThreadCtxDeinit(&th_v,(void *) det_ctx); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFlowint */ void DetectFlowintRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectFlowintTestParseVal01", DetectFlowintTestParseVal01); UtRegisterTest("DetectFlowintTestParseVar01", DetectFlowintTestParseVar01); UtRegisterTest("DetectFlowintTestParseVal02", DetectFlowintTestParseVal02); UtRegisterTest("DetectFlowintTestParseVar02", DetectFlowintTestParseVar02); UtRegisterTest("DetectFlowintTestParseVal03", DetectFlowintTestParseVal03); UtRegisterTest("DetectFlowintTestParseVar03", DetectFlowintTestParseVar03); UtRegisterTest("DetectFlowintTestParseVal04", DetectFlowintTestParseVal04); UtRegisterTest("DetectFlowintTestParseVar04", DetectFlowintTestParseVar04); UtRegisterTest("DetectFlowintTestParseVal05", DetectFlowintTestParseVal05); UtRegisterTest("DetectFlowintTestParseVar05", DetectFlowintTestParseVar05); UtRegisterTest("DetectFlowintTestParseVal06", DetectFlowintTestParseVal06); UtRegisterTest("DetectFlowintTestParseVar06", DetectFlowintTestParseVar06); UtRegisterTest("DetectFlowintTestParseVal07", DetectFlowintTestParseVal07); UtRegisterTest("DetectFlowintTestParseVar07", DetectFlowintTestParseVar07); UtRegisterTest("DetectFlowintTestParseVal08", DetectFlowintTestParseVal08); UtRegisterTest("DetectFlowintTestParseVar08", DetectFlowintTestParseVar08); UtRegisterTest("DetectFlowintTestParseVal09", DetectFlowintTestParseVal09); UtRegisterTest("DetectFlowintTestParseVar09", DetectFlowintTestParseVar09); UtRegisterTest("DetectFlowintTestParseIsset10", DetectFlowintTestParseIsset10); UtRegisterTest("DetectFlowintTestParseInvalidSyntaxis01", DetectFlowintTestParseInvalidSyntaxis01); UtRegisterTest("DetectFlowintTestPacket01Real", DetectFlowintTestPacket01Real); UtRegisterTest("DetectFlowintTestPacket02Real", DetectFlowintTestPacket02Real); UtRegisterTest("DetectFlowintTestPacket03Real", DetectFlowintTestPacket03Real); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-luajit.h0000644000000000000000000000203413051004444013414 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_LUAJIT_H__ #define __UTIL_LUAJIT_H__ #ifdef HAVE_LUAJIT int LuajitSetupStatesPool(void); void LuajitFreeStatesPool(void); lua_State *LuajitGetState(void); void LuajitReturnState(lua_State *s); #endif /* HAVE_LUAJIT */ #endif /* __UTIL_LUAJIT_H__ */ suricata-3.2.1/src/log-pcap.h0000644000000000000000000000176213051004444012662 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf * \author Victor Julien * * Pcap packet logging module. */ #ifndef __LOG_PCAP_H__ #define __LOG_PCAP_H__ void PcapLogRegister(void); void PcapLogProfileSetup(void); #endif /* __LOG_PCAP_H__ */ suricata-3.2.1/src/runmode-netmap.h0000644000000000000000000000207213051004444014106 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Aleksey Katargin */ #ifndef __RUNMODE_NETMAP_H__ #define __RUNMODE_NETMAP_H__ int RunModeIdsNetmapSingle(void); int RunModeIdsNetmapAutoFp(void); int RunModeIdsNetmapWorkers(void); void RunModeIdsNetmapRegister(void); const char *RunModeNetmapGetDefaultMode(void); int NetmapRunModeIsIPS(); #endif /* __RUNMODE_NETMAP_H__ */ suricata-3.2.1/src/win32-syslog.h0000644000000000000000000000672113051004444013440 00000000000000/** * syslog.h does not exist in the mingw environment, this file replaces it */ /* * Copyright (c) 1982, 1986, 1988, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)syslog.h 8.1 (Berkeley) 6/2/93 */ #ifndef __WIN32_SYSLOG_H__ #define __WIN32_SYSLOG_H__ #define LOG_EMERG 0 /* system is unusable */ #define LOG_ALERT 1 /* action must be taken immediately */ #define LOG_CRIT 2 /* critical conditions */ #define LOG_ERR 3 /* error conditions */ #define LOG_WARNING 4 /* warning conditions */ #define LOG_NOTICE 5 /* normal but significant condition */ #define LOG_INFO 6 /* informational */ #define LOG_DEBUG 7 /* debug-level messages */ #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ /* * The current win32 implementation of syslog is dummy and does nothing. */ #define closelog() #define openlog(__ident, __option, __facility) #define setlogmask (__mask) #define syslog(__pri, __fmt, __param) #endif suricata-3.2.1/src/detect-engine-state.c0000644000000000000000000023445713051004444015015 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup sigstate State support * * It is possible to do matching on reconstructed applicative flow. * This is done by this code. It uses the ::Flow structure to store * the list of signatures to match on the reconstructed stream. * * The Flow::de_state is a ::DetectEngineState structure. This is * basically a containter for storage item of type ::DeStateStore. * They contains an array of ::DeStateStoreItem which store the * state of match for an individual signature identified by * DeStateStoreItem::sid. * * The state is constructed by DeStateDetectStartDetection() which * also starts the matching. Work is continued by * DeStateDetectContinueDetection(). * * Once a transaction has been analysed DeStateRestartDetection() * is used to reset the structures. * * @{ */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * \brief State based signature handling. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-dcepayload.h" #include "detect-flowvar.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "app-layer-smb.h" #include "app-layer-dcerpc-common.h" #include "app-layer-dcerpc.h" #include "app-layer-dns-common.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-profiling.h" #include "flow-util.h" /** convert enum to string */ #define CASE_CODE(E) case E: return #E /** The DetectEngineThreadCtx::de_state_sig_array contains 2 separate values: * 1. the first bit tells the prefilter engine to bypass the rule (or not) * 2. the other bits allow 'ContinueDetect' to specify an offset again the * base tx id. This offset will then be used by 'StartDetect' to not * inspect transactions again for the same signature. * * The offset in (2) has a max value due to the limited data type. If it is * set to max the code will fall back to a slower path that validates that * we're not adding duplicate rules to the detection state. */ #define MAX_STORED_TXID_OFFSET 127 /******** static internal helpers *********/ static inline int StateIsValid(uint16_t alproto, void *alstate) { if (alstate != NULL) { if (alproto == ALPROTO_HTTP) { HtpState *htp_state = (HtpState *)alstate; if (htp_state->conn != NULL) { return 1; } } else { return 1; } } return 0; } static inline int TxIsLast(uint64_t tx_id, uint64_t total_txs) { if (total_txs - tx_id <= 1) return 1; return 0; } static DeStateStore *DeStateStoreAlloc(void) { DeStateStore *d = SCMalloc(sizeof(DeStateStore)); if (unlikely(d == NULL)) return NULL; memset(d, 0, sizeof(DeStateStore)); return d; } static DeStateStoreFlowRules *DeStateStoreFlowRulesAlloc(void) { DeStateStoreFlowRules *d = SCMalloc(sizeof(DeStateStoreFlowRules)); if (unlikely(d == NULL)) return NULL; memset(d, 0, sizeof(DeStateStoreFlowRules)); return d; } static int DeStateSearchState(DetectEngineState *state, uint8_t direction, SigIntId num) { DetectEngineStateDirection *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1]; DeStateStore *tx_store = dir_state->head; SigIntId store_cnt; SigIntId state_cnt = 0; for (; tx_store != NULL; tx_store = tx_store->next) { SCLogDebug("tx_store %p", tx_store); for (store_cnt = 0; store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < dir_state->cnt; store_cnt++, state_cnt++) { DeStateStoreItem *item = &tx_store->store[store_cnt]; if (item->sid == num) { SCLogDebug("sid %u already in state: %p %p %p %u %u, direction %s", num, state, dir_state, tx_store, state_cnt, store_cnt, direction & STREAM_TOSERVER ? "toserver" : "toclient"); return 1; } } } return 0; } static void DeStateSignatureAppend(DetectEngineState *state, Signature *s, uint32_t inspect_flags, uint8_t direction) { int jump = 0; int i = 0; DetectEngineStateDirection *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1]; #ifdef DEBUG_VALIDATION BUG_ON(DeStateSearchState(state, direction, s->num)); #endif DeStateStore *store = dir_state->head; if (store == NULL) { store = DeStateStoreAlloc(); if (store != NULL) { dir_state->head = store; dir_state->tail = store; } } else { jump = dir_state->cnt / DE_STATE_CHUNK_SIZE; for (i = 0; i < jump; i++) { store = store->next; } if (store == NULL) { store = DeStateStoreAlloc(); if (store != NULL) { dir_state->tail->next = store; dir_state->tail = store; } } } if (store == NULL) return; SigIntId idx = dir_state->cnt++ % DE_STATE_CHUNK_SIZE; store->store[idx].sid = s->num; store->store[idx].flags = inspect_flags; return; } static void DeStateFlowRuleAppend(DetectEngineStateFlow *state, Signature *s, SigMatch *sm, uint32_t inspect_flags, uint8_t direction) { int jump = 0; int i = 0; DetectEngineStateDirectionFlow *dir_state = &state->dir_state[direction & STREAM_TOSERVER ? 0 : 1]; DeStateStoreFlowRules *store = dir_state->head; if (store == NULL) { store = DeStateStoreFlowRulesAlloc(); if (store != NULL) { dir_state->head = store; dir_state->tail = store; } } else { jump = dir_state->cnt / DE_STATE_CHUNK_SIZE; for (i = 0; i < jump; i++) { store = store->next; } if (store == NULL) { store = DeStateStoreFlowRulesAlloc(); if (store != NULL) { dir_state->tail->next = store; dir_state->tail = store; } } } if (store == NULL) return; SigIntId idx = dir_state->cnt++ % DE_STATE_CHUNK_SIZE; store->store[idx].sid = s->num; store->store[idx].flags = inspect_flags; store->store[idx].nm = sm; return; } static void DeStateStoreStateVersion(Flow *f, const uint8_t alversion, uint8_t direction) { f->detect_alversion[direction & STREAM_TOSERVER ? 0 : 1] = alversion; } static void DeStateStoreFileNoMatchCnt(DetectEngineState *de_state, uint16_t file_no_match, uint8_t direction) { de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt += file_no_match; return; } static int DeStateStoreFilestoreSigsCantMatch(const SigGroupHead *sgh, DetectEngineState *de_state, uint8_t direction) { if (de_state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].filestore_cnt == sgh->filestore_cnt) return 1; else return 0; } DetectEngineState *DetectEngineStateAlloc(void) { DetectEngineState *d = SCMalloc(sizeof(DetectEngineState)); if (unlikely(d == NULL)) return NULL; memset(d, 0, sizeof(DetectEngineState)); return d; } DetectEngineStateFlow *DetectEngineStateFlowAlloc(void) { DetectEngineStateFlow *d = SCMalloc(sizeof(DetectEngineStateFlow)); if (unlikely(d == NULL)) return NULL; memset(d, 0, sizeof(DetectEngineStateFlow)); return d; } void DetectEngineStateFree(DetectEngineState *state) { DeStateStore *store; DeStateStore *store_next; int i = 0; for (i = 0; i < 2; i++) { store = state->dir_state[i].head; while (store != NULL) { store_next = store->next; SCFree(store); store = store_next; } } SCFree(state); return; } void DetectEngineStateFlowFree(DetectEngineStateFlow *state) { DeStateStoreFlowRules *store; DeStateStoreFlowRules *store_next; int i = 0; for (i = 0; i < 2; i++) { store = state->dir_state[i].head; while (store != NULL) { store_next = store->next; SCFree(store); store = store_next; } } SCFree(state); return; } static int HasStoredSigs(Flow *f, uint8_t flags) { if (f->de_state != NULL && f->de_state->dir_state[flags & STREAM_TOSERVER ? 0 : 1].cnt != 0) { SCLogDebug("global sigs present"); return 1; } if (AppLayerParserProtocolSupportsTxs(f->proto, f->alproto)) { AppProto alproto = f->alproto; void *alstate = FlowGetAppState(f); if (!StateIsValid(f->alproto, alstate)) { return 0; } int state = AppLayerParserHasTxDetectState(f->proto, alproto, f->alstate); if (state == -ENOSYS) { /* proto doesn't support this API call */ /* fall through */ } else if (state == 0) { return 0; } /* if state == 1 we also fall through */ uint64_t inspect_tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, alproto, alstate); for ( ; inspect_tx_id < total_txs; inspect_tx_id++) { void *inspect_tx = AppLayerParserGetTx(f->proto, alproto, alstate, inspect_tx_id); if (inspect_tx != NULL) { DetectEngineState *tx_de_state = AppLayerParserGetTxDetectState(f->proto, alproto, inspect_tx); if (tx_de_state == NULL) { continue; } if (tx_de_state->dir_state[flags & STREAM_TOSERVER ? 0 : 1].cnt != 0) { SCLogDebug("tx %u has sigs present", (uint)inspect_tx_id); return 1; } } } } return 0; } /** \brief Check if we need to inspect this state * * State needs to be inspected if: * 1. state has been updated * 2. we already have de_state in progress * * \retval 0 no inspectable state * \retval 1 inspectable state * \retval 2 inspectable state, but no update */ int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, const uint8_t alversion, uint8_t flags) { int r = 0; if (!(flags & STREAM_EOF) && f->de_state && f->detect_alversion[flags & STREAM_TOSERVER ? 0 : 1] == alversion) { SCLogDebug("unchanged state"); r = 2; } else if (HasStoredSigs(f, flags)) { r = 1; } else { r = 0; } return r; } static int StoreState(DetectEngineThreadCtx *det_ctx, Flow *f, const uint8_t flags, const uint8_t alversion, Signature *s, SigMatch *sm, const uint32_t inspect_flags, const uint16_t file_no_match) { if (f->de_state == NULL) { f->de_state = DetectEngineStateFlowAlloc(); if (f->de_state == NULL) { return 0; } } DeStateFlowRuleAppend(f->de_state, s, sm, inspect_flags, flags); DeStateStoreStateVersion(f, alversion, flags); return 1; } static void StoreStateTxHandleFiles(DetectEngineThreadCtx *det_ctx, Flow *f, DetectEngineState *destate, const uint8_t flags, const uint64_t tx_id, const uint16_t file_no_match) { SCLogDebug("tx %u, file_no_match %u", (uint)tx_id, file_no_match); DeStateStoreFileNoMatchCnt(destate, file_no_match, flags); if (DeStateStoreFilestoreSigsCantMatch(det_ctx->sgh, destate, flags) == 1) { FileDisableStoringForTransaction(f, flags & (STREAM_TOCLIENT | STREAM_TOSERVER), tx_id); destate->dir_state[flags & STREAM_TOSERVER ? 0 : 1].flags |= DETECT_ENGINE_STATE_FLAG_FILE_STORE_DISABLED; } } static void StoreStateTxFileOnly(DetectEngineThreadCtx *det_ctx, Flow *f, const uint8_t flags, const uint64_t tx_id, void *tx, const uint16_t file_no_match) { if (AppLayerParserSupportsTxDetectState(f->proto, f->alproto)) { DetectEngineState *destate = AppLayerParserGetTxDetectState(f->proto, f->alproto, tx); if (destate == NULL) { destate = DetectEngineStateAlloc(); if (destate == NULL) return; if (AppLayerParserSetTxDetectState(f->proto, f->alproto, f->alstate, tx, destate) < 0) { DetectEngineStateFree(destate); return; } SCLogDebug("destate created for %"PRIu64, tx_id); } StoreStateTxHandleFiles(det_ctx, f, destate, flags, tx_id, file_no_match); } } /** * \param check_before_add check for duplicates before adding the sig */ static void StoreStateTx(DetectEngineThreadCtx *det_ctx, Flow *f, const uint8_t flags, const uint8_t alversion, const uint64_t tx_id, void *tx, Signature *s, SigMatch *sm, const uint32_t inspect_flags, const uint16_t file_no_match, int check_before_add) { if (AppLayerParserSupportsTxDetectState(f->proto, f->alproto)) { DetectEngineState *destate = AppLayerParserGetTxDetectState(f->proto, f->alproto, tx); if (destate == NULL) { destate = DetectEngineStateAlloc(); if (destate == NULL) return; if (AppLayerParserSetTxDetectState(f->proto, f->alproto, f->alstate, tx, destate) < 0) { DetectEngineStateFree(destate); return; } SCLogDebug("destate created for %"PRIu64, tx_id); } SCLogDebug("file_no_match %u", file_no_match); if (check_before_add == 0 || DeStateSearchState(destate, flags, s->num) == 0) DeStateSignatureAppend(destate, s, inspect_flags, flags); DeStateStoreStateVersion(f, alversion, flags); StoreStateTxHandleFiles(det_ctx, f, destate, flags, tx_id, file_no_match); } SCLogDebug("Stored for TX %"PRIu64, tx_id); } int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p, Flow *f, uint8_t flags, AppProto alproto, const uint8_t alversion) { SigMatch *sm = NULL; uint16_t file_no_match = 0; uint32_t inspect_flags = 0; int alert_cnt = 0; int dmatch = 0; SCLogDebug("rule %u", s->id); /* TX based matches (inspect engines) */ if (AppLayerParserProtocolSupportsTxs(f->proto, alproto)) { uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1; int check_before_add = 0; uint64_t tx_id = 0; uint64_t total_txs = 0; void *alstate = FlowGetAppState(f); if (!StateIsValid(alproto, alstate)) { goto end; } /* if continue detection already inspected this rule for this tx, * continue with the first not-inspected tx */ uint8_t offset = det_ctx->de_state_sig_array[s->num] & 0xef; tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); if (offset > 0) { SCLogDebug("using stored_tx_id %u instead of %u", (uint)tx_id+offset, (uint)tx_id); tx_id += offset; } if (offset == MAX_STORED_TXID_OFFSET) { check_before_add = 1; } total_txs = AppLayerParserGetTxCnt(f->proto, alproto, alstate); SCLogDebug("total_txs %"PRIu64, total_txs); SCLogDebug("starting: start tx %u, packet %u", (uint)tx_id, (uint)p->pcap_cnt); for (; tx_id < total_txs; tx_id++) { int total_matches = 0; void *tx = AppLayerParserGetTx(f->proto, alproto, alstate, tx_id); SCLogDebug("tx %p", tx); if (tx == NULL) continue; det_ctx->tx_id = tx_id; det_ctx->tx_id_set = 1; DetectEngineAppInspectionEngine *engine = s->app_inspect; SCLogDebug("engine %p", engine); inspect_flags = 0; while (engine != NULL) { SCLogDebug("engine %p", engine); SCLogDebug("inspect_flags %x", inspect_flags); if (direction == engine->dir) { KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list); int match = engine->Callback(tv, de_ctx, det_ctx, s, f, flags, alstate, tx, tx_id); SCLogDebug("engine %p match %d", engine, match); if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) { inspect_flags |= engine->inspect_flags; engine = engine->next; total_matches++; continue; } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) { /* if the file engine matched, but indicated more * files are still in progress, we don't set inspect * flags as these would end inspection for this tx */ engine = engine->next; total_matches++; continue; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) { inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; inspect_flags |= engine->inspect_flags; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE) { inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; inspect_flags |= engine->inspect_flags; file_no_match++; } break; } engine = engine->next; } SCLogDebug("inspect_flags %x", inspect_flags); /* all the engines seem to be exhausted at this point. If we * didn't have a match in one of the engines we would have * broken off and engine wouldn't be NULL. Hence the alert. */ if (engine == NULL && total_matches > 0) { if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, tx_id, PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_TX); } else { DetectSignatureApplyActions(p, s); } alert_cnt = 1; SCLogDebug("MATCH: tx %u packet %u", (uint)tx_id, (uint)p->pcap_cnt); } /* if this is the last tx in our list, and it's incomplete: then * we store the state so that ContinueDetection knows about it */ int tx_is_done = (AppLayerParserGetStateProgress(f->proto, alproto, tx, flags) >= AppLayerParserGetStateProgressCompletionStatus(alproto, flags)); /* see if we need to consider the next tx in our decision to add * a sig to the 'no inspect array'. */ int next_tx_no_progress = 0; if (!TxIsLast(tx_id, total_txs)) { void *next_tx = AppLayerParserGetTx(f->proto, alproto, alstate, tx_id+1); if (next_tx != NULL) { int c = AppLayerParserGetStateProgress(f->proto, alproto, next_tx, flags); if (c == 0) { next_tx_no_progress = 1; } } } SCLogDebug("tx %u, packet %u, rule %u, alert_cnt %u, last tx %d, tx_is_done %d, next_tx_no_progress %d", (uint)tx_id, (uint)p->pcap_cnt, s->num, alert_cnt, TxIsLast(tx_id, total_txs), tx_is_done, next_tx_no_progress); /* if we have something to store (partial match or file store info), * then we do it now. */ if (inspect_flags != 0) { if (!(TxIsLast(tx_id, total_txs)) || !tx_is_done) { if (engine == NULL || inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) { inspect_flags |= DE_STATE_FLAG_FULL_INSPECT; } /* store */ StoreStateTx(det_ctx, f, flags, alversion, tx_id, tx, s, sm, inspect_flags, file_no_match, check_before_add); } else { StoreStateTxFileOnly(det_ctx, f, flags, tx_id, tx, file_no_match); } } else { SCLogDebug("no state to store"); } if (next_tx_no_progress) break; } /* for */ /* DCERPC matches */ } else if (s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL && (alproto == ALPROTO_DCERPC || alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2)) { void *alstate = FlowGetAppState(f); if (alstate == NULL) { goto end; } KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_DMATCH); if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) { SMBState *smb_state = (SMBState *)alstate; if (smb_state->dcerpc_present && DetectEngineInspectDcePayload(de_ctx, det_ctx, s, f, flags, &smb_state->dcerpc) == 1) { inspect_flags |= DE_STATE_FLAG_DCE_PAYLOAD_INSPECT; dmatch = 1; } } else { if (DetectEngineInspectDcePayload(de_ctx, det_ctx, s, f, flags, alstate) == 1) { inspect_flags |= DE_STATE_FLAG_DCE_PAYLOAD_INSPECT; dmatch = 1; } } } int amatch = 0; /* flow based matches */ KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_AMATCH); sm = s->sm_lists[DETECT_SM_LIST_AMATCH]; if (sm != NULL) { void *alstate = FlowGetAppState(f); if (alstate == NULL) { goto end; } for ( ; sm != NULL; sm = sm->next) { if (sigmatch_table[sm->type].AppLayerMatch != NULL) { int match = 0; if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) { SMBState *smb_state = (SMBState *)alstate; if (smb_state->dcerpc_present) { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. AppLayerMatch(tv, det_ctx, f, flags, &smb_state->dcerpc, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match == 1)); } } else { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. AppLayerMatch(tv, det_ctx, f, flags, alstate, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match == 1)); } if (match == 0) { break; } else if (match == 2) { inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; break; } else if (match == 1 && sm->next == NULL) { amatch = 1; } } } } /* if AMATCH and/or DMATCH are in use, see if we need to * alert and store the state */ if ((s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL)) { /* if dmatch in use and match + amatch in use and match or if dmatch in use and match + amatch not in use or if dmatch not in use + amatch in use and match or sig can't match */ if (inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH) { inspect_flags |= DE_STATE_FLAG_FULL_INSPECT; } else { if ((amatch || s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) && (dmatch || s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL)) { if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, 0, PACKET_ALERT_FLAG_STATE_MATCH); } else { DetectSignatureApplyActions(p, s); } alert_cnt = 1; inspect_flags |= DE_STATE_FLAG_FULL_INSPECT; } } StoreState(det_ctx, f, flags, alversion, s, sm, inspect_flags, file_no_match); } end: det_ctx->tx_id = 0; det_ctx->tx_id_set = 0; return alert_cnt ? 1:0; } static int DoInspectItem(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, DeStateStoreItem *item, const uint8_t dir_state_flags, Packet *p, Flow *f, AppProto alproto, uint8_t flags, const uint64_t inspect_tx_id, const uint64_t total_txs, uint16_t *file_no_match, int inprogress, // is current tx in progress? const int next_tx_no_progress) // tx after current is still dormant { Signature *s = de_ctx->sig_array[item->sid]; SCLogDebug("file_no_match %u, sid %u", *file_no_match, s->id); /* check if a sig in state 'full inspect' needs to be reconsidered * as the result of a new file in the existing tx */ if (item->flags & DE_STATE_FLAG_FULL_INSPECT) { if (item->flags & (DE_STATE_FLAG_FILE_TC_INSPECT|DE_STATE_FLAG_FILE_TS_INSPECT)) { if ((flags & STREAM_TOCLIENT) && (dir_state_flags & DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW)) { SCLogDebug("~DE_STATE_FLAG_FILE_TC_INSPECT"); item->flags &= ~DE_STATE_FLAG_FILE_TC_INSPECT; item->flags &= ~DE_STATE_FLAG_FULL_INSPECT; item->flags &= ~DE_STATE_FLAG_SIG_CANT_MATCH; } if ((flags & STREAM_TOSERVER) && (dir_state_flags & DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW)) { SCLogDebug("~DE_STATE_FLAG_FILE_TS_INSPECT"); item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT; item->flags &= ~DE_STATE_FLAG_FULL_INSPECT; item->flags &= ~DE_STATE_FLAG_SIG_CANT_MATCH; } } if (item->flags & DE_STATE_FLAG_FULL_INSPECT) { if (TxIsLast(inspect_tx_id, total_txs) || inprogress || next_tx_no_progress) { det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_NO_NEW_STATE; SCLogDebug("skip and bypass %u: tx %u packet %u", s->id, (uint)inspect_tx_id, (uint)p->pcap_cnt); } else { SCLogDebug("just skip: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); /* make sure that if we reinspect this right now from * start detection, we skip this tx we just matched on */ uint64_t base_tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); uint64_t offset = (inspect_tx_id + 1) - base_tx_id; if (offset > MAX_STORED_TXID_OFFSET) offset = MAX_STORED_TXID_OFFSET; det_ctx->de_state_sig_array[item->sid] = (uint8_t)offset; #ifdef DEBUG_VALIDATION BUG_ON(det_ctx->de_state_sig_array[item->sid] & DE_STATE_MATCH_NO_NEW_STATE); // check that we don't set the bit #endif SCLogDebug("storing tx_id %u for this sid", (uint)inspect_tx_id + 1); } return 0; } } /* check if a sig in state 'cant match' needs to be reconsidered * as the result of a new file in the existing tx */ SCLogDebug("item->flags %x", item->flags); if (item->flags & DE_STATE_FLAG_SIG_CANT_MATCH) { SCLogDebug("DE_STATE_FLAG_SIG_CANT_MATCH"); if ((flags & STREAM_TOSERVER) && (item->flags & DE_STATE_FLAG_FILE_TS_INSPECT) && (dir_state_flags & DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW)) { SCLogDebug("unset ~DE_STATE_FLAG_FILE_TS_INSPECT ~DE_STATE_FLAG_SIG_CANT_MATCH"); item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT; item->flags &= ~DE_STATE_FLAG_SIG_CANT_MATCH; } else if ((flags & STREAM_TOCLIENT) && (item->flags & DE_STATE_FLAG_FILE_TC_INSPECT) && (dir_state_flags & DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW)) { SCLogDebug("unset ~DE_STATE_FLAG_FILE_TC_INSPECT ~DE_STATE_FLAG_SIG_CANT_MATCH"); item->flags &= ~DE_STATE_FLAG_FILE_TC_INSPECT; item->flags &= ~DE_STATE_FLAG_SIG_CANT_MATCH; } else { if (TxIsLast(inspect_tx_id, total_txs) || inprogress || next_tx_no_progress) { det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_NO_NEW_STATE; SCLogDebug("skip and bypass: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); } else { SCLogDebug("just skip: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); /* make sure that if we reinspect this right now from * start detection, we skip this tx we just matched on */ uint64_t base_tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); uint64_t offset = (inspect_tx_id + 1) - base_tx_id; if (offset > MAX_STORED_TXID_OFFSET) offset = MAX_STORED_TXID_OFFSET; det_ctx->de_state_sig_array[item->sid] = (uint8_t)offset; #ifdef DEBUG_VALIDATION BUG_ON(det_ctx->de_state_sig_array[item->sid] & DE_STATE_MATCH_NO_NEW_STATE); // check that we don't set the bit #endif SCLogDebug("storing tx_id %u for this sid", (uint)inspect_tx_id + 1); } return 0; } } uint8_t alert = 0; uint32_t inspect_flags = 0; int total_matches = 0; RULE_PROFILING_START(p); void *alstate = FlowGetAppState(f); if (!StateIsValid(alproto, alstate)) { RULE_PROFILING_END(det_ctx, s, 0, p); return -1; } det_ctx->tx_id = inspect_tx_id; det_ctx->tx_id_set = 1; SCLogDebug("inspecting: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1; DetectEngineAppInspectionEngine *engine = s->app_inspect; void *inspect_tx = AppLayerParserGetTx(f->proto, alproto, alstate, inspect_tx_id); if (inspect_tx == NULL) { RULE_PROFILING_END(det_ctx, s, 0, p); return -1; } while (engine != NULL) { if (!(item->flags & engine->inspect_flags) && direction == engine->dir) { SCLogDebug("inspect_flags %x", inspect_flags); KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list); int match = engine->Callback(tv, de_ctx, det_ctx, s, f, flags, alstate, inspect_tx, inspect_tx_id); if (match == DETECT_ENGINE_INSPECT_SIG_MATCH) { inspect_flags |= engine->inspect_flags; engine = engine->next; total_matches++; continue; } else if (match == DETECT_ENGINE_INSPECT_SIG_MATCH_MORE_FILES) { /* if the file engine matched, but indicated more * files are still in progress, we don't set inspect * flags as these would end inspection for this tx */ engine = engine->next; total_matches++; continue; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH) { inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; inspect_flags |= engine->inspect_flags; } else if (match == DETECT_ENGINE_INSPECT_SIG_CANT_MATCH_FILESTORE) { inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; inspect_flags |= engine->inspect_flags; (*file_no_match)++; } break; } engine = engine->next; } SCLogDebug("inspect_flags %x", inspect_flags); if (total_matches > 0 && (engine == NULL || inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH)) { if (engine == NULL) alert = 1; inspect_flags |= DE_STATE_FLAG_FULL_INSPECT; } item->flags |= inspect_flags; /* flag this sig to don't inspect again from the detection loop it if * there is no need for it */ if (TxIsLast(inspect_tx_id, total_txs) || inprogress || next_tx_no_progress) { det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_NO_NEW_STATE; SCLogDebug("inspected, now bypass: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); } else { /* make sure that if we reinspect this right now from * start detection, we skip this tx we just matched on */ uint64_t base_tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); uint64_t offset = (inspect_tx_id + 1) - base_tx_id; if (offset > MAX_STORED_TXID_OFFSET) offset = MAX_STORED_TXID_OFFSET; det_ctx->de_state_sig_array[item->sid] = (uint8_t)offset; #ifdef DEBUG_VALIDATION BUG_ON(det_ctx->de_state_sig_array[item->sid] & DE_STATE_MATCH_NO_NEW_STATE); // check that we don't set the bit #endif SCLogDebug("storing tx_id %u for this sid", (uint)inspect_tx_id + 1); } RULE_PROFILING_END(det_ctx, s, (alert == 1), p); if (alert) { SigMatchSignaturesRunPostMatch(tv, de_ctx, det_ctx, p, s); if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, inspect_tx_id, PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_TX); } else { PACKET_UPDATE_ACTION(p, s->action); } SCLogDebug("MATCH: tx %u packet %u", (uint)inspect_tx_id, (uint)p->pcap_cnt); } DetectFlowvarProcessList(det_ctx, f); return 1; } /** \internal * \brief Continue Detection for a single "flow" rule (AMATCH) */ static int DoInspectFlowRule(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, DeStateStoreFlowRule *item, const uint8_t dir_state_flags, Packet *p, Flow *f, AppProto alproto, uint8_t flags) { /* flag rules that are either full inspected or unable to match * in the de_state_sig_array so that prefilter filters them out */ if (item->flags & (DE_STATE_FLAG_FULL_INSPECT|DE_STATE_FLAG_SIG_CANT_MATCH)) { det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_NO_NEW_STATE; return 0; } uint8_t alert = 0; uint32_t inspect_flags = item->flags; int total_matches = 0; int full_match = 0; SigMatch *sm = NULL; Signature *s = de_ctx->sig_array[item->sid]; RULE_PROFILING_START(p); KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_AMATCH); if (item->nm != NULL) { void *alstate = FlowGetAppState(f); if (alstate == NULL) { RULE_PROFILING_END(det_ctx, s, 0 /* no match */, p); return -1; } for (sm = item->nm; sm != NULL; sm = sm->next) { if (sigmatch_table[sm->type].AppLayerMatch != NULL) { int match = 0; if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) { SMBState *smb_state = (SMBState *)alstate; if (smb_state->dcerpc_present) { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. AppLayerMatch(tv, det_ctx, f, flags, &smb_state->dcerpc, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match == 1)); } } else { KEYWORD_PROFILING_START; match = sigmatch_table[sm->type]. AppLayerMatch(tv, det_ctx, f, flags, alstate, s, sm); KEYWORD_PROFILING_END(det_ctx, sm->type, (match == 1)); } if (match == 0) break; else if (match == 2) inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; else if (match == 1) total_matches++; } } } /* AMATCH part checked out, or isn't there at all */ full_match = (sm == NULL); /* DCERPC matches */ if (s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL && (alproto == ALPROTO_DCERPC || alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) && !(item->flags & DE_STATE_FLAG_DCE_PAYLOAD_INSPECT)) { void *alstate = FlowGetAppState(f); if (alstate != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_DMATCH); if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) { SMBState *smb_state = (SMBState *)alstate; if (smb_state->dcerpc_present && DetectEngineInspectDcePayload(de_ctx, det_ctx, s, f, flags, &smb_state->dcerpc) == 1) { total_matches++; inspect_flags |= DE_STATE_FLAG_DCE_PAYLOAD_INSPECT; } } else { if (DetectEngineInspectDcePayload(de_ctx, det_ctx, s, f, flags, alstate) == 1) { total_matches++; inspect_flags |= DE_STATE_FLAG_DCE_PAYLOAD_INSPECT; } } } } /* update full_match with DMATCH result */ if (full_match && s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL) { full_match = ((inspect_flags & DE_STATE_FLAG_DCE_PAYLOAD_INSPECT) != 0); } /* check the results */ if (total_matches > 0 && (full_match || (inspect_flags & DE_STATE_FLAG_SIG_CANT_MATCH))) { if (full_match) alert = 1; inspect_flags |= DE_STATE_FLAG_FULL_INSPECT; } /* prevent the rule loop from reinspecting this rule */ det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_NO_NEW_STATE; RULE_PROFILING_END(det_ctx, s, (alert == 1), p); /* store the progress in the state */ item->flags |= inspect_flags; item->nm = sm; if (alert) { SigMatchSignaturesRunPostMatch(tv, de_ctx, det_ctx, p, s); if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, 0, PACKET_ALERT_FLAG_STATE_MATCH); } else { DetectSignatureApplyActions(p, s); } } DetectFlowvarProcessList(det_ctx, f); return 1; } void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, uint8_t flags, AppProto alproto, const uint8_t alversion) { uint16_t file_no_match = 0; SigIntId store_cnt = 0; SigIntId state_cnt = 0; uint64_t inspect_tx_id = 0; uint64_t total_txs = 0; uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1; SCLogDebug("starting continue detection for packet %"PRIu64, p->pcap_cnt); if (AppLayerParserProtocolSupportsTxs(f->proto, alproto)) { void *alstate = FlowGetAppState(f); if (!StateIsValid(alproto, alstate)) { return; } inspect_tx_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); total_txs = AppLayerParserGetTxCnt(f->proto, alproto, alstate); for ( ; inspect_tx_id < total_txs; inspect_tx_id++) { int inspect_tx_inprogress = 0; int next_tx_no_progress = 0; void *inspect_tx = AppLayerParserGetTx(f->proto, alproto, alstate, inspect_tx_id); if (inspect_tx != NULL) { int a = AppLayerParserGetStateProgress(f->proto, alproto, inspect_tx, flags); int b = AppLayerParserGetStateProgressCompletionStatus(alproto, flags); if (a < b) { inspect_tx_inprogress = 1; } SCLogDebug("tx %"PRIu64" (%"PRIu64") => %s", inspect_tx_id, total_txs, inspect_tx_inprogress ? "in progress" : "done"); DetectEngineState *tx_de_state = AppLayerParserGetTxDetectState(f->proto, alproto, inspect_tx); if (tx_de_state == NULL) { SCLogDebug("NO STATE tx %"PRIu64" (%"PRIu64")", inspect_tx_id, total_txs); continue; } DetectEngineStateDirection *tx_dir_state = &tx_de_state->dir_state[direction]; DeStateStore *tx_store = tx_dir_state->head; SCLogDebug("tx_dir_state->filestore_cnt %u", tx_dir_state->filestore_cnt); /* see if we need to consider the next tx in our decision to add * a sig to the 'no inspect array'. */ if (!TxIsLast(inspect_tx_id, total_txs)) { void *next_inspect_tx = AppLayerParserGetTx(f->proto, alproto, alstate, inspect_tx_id+1); if (next_inspect_tx != NULL) { int c = AppLayerParserGetStateProgress(f->proto, alproto, next_inspect_tx, flags); if (c == 0) { next_tx_no_progress = 1; } } } /* Loop through stored 'items' (stateful rules) and inspect them */ state_cnt = 0; for (; tx_store != NULL; tx_store = tx_store->next) { SCLogDebug("tx_store %p", tx_store); for (store_cnt = 0; store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < tx_dir_state->cnt; store_cnt++, state_cnt++) { DeStateStoreItem *item = &tx_store->store[store_cnt]; int r = DoInspectItem(tv, de_ctx, det_ctx, item, tx_dir_state->flags, p, f, alproto, flags, inspect_tx_id, total_txs, &file_no_match, inspect_tx_inprogress, next_tx_no_progress); if (r < 0) { SCLogDebug("failed"); goto end; } } } tx_dir_state->flags &= ~(DETECT_ENGINE_STATE_FLAG_FILE_TS_NEW|DETECT_ENGINE_STATE_FLAG_FILE_TC_NEW); } /* if the current tx is in progress, we won't advance to any newer * tx' just yet. */ if (inspect_tx_inprogress) { SCLogDebug("break out"); break; } } } /* continue on flow based state rules (AMATCH) */ if (f->de_state != NULL) { DetectEngineStateDirectionFlow *dir_state = &f->de_state->dir_state[direction]; DeStateStoreFlowRules *store = dir_state->head; /* Loop through stored 'items' (stateful rules) and inspect them */ for (; store != NULL; store = store->next) { for (store_cnt = 0; store_cnt < DE_STATE_CHUNK_SIZE && state_cnt < dir_state->cnt; store_cnt++, state_cnt++) { DeStateStoreFlowRule *rule = &store->store[store_cnt]; int r = DoInspectFlowRule(tv, de_ctx, det_ctx, rule, dir_state->flags, p, f, alproto, flags); if (r < 0) { goto end; } } } DeStateStoreStateVersion(f, alversion, flags); } end: det_ctx->tx_id = 0; det_ctx->tx_id_set = 0; return; } /** \brief update flow's inspection id's * * \param f unlocked flow * \param flags direction and disruption flags * * \note it is possible that f->alstate, f->alparser are NULL */ void DeStateUpdateInspectTransactionId(Flow *f, const uint8_t flags) { if (f->alparser && f->alstate) { AppLayerParserSetTransactionInspectId(f->alparser, f->proto, f->alproto, f->alstate, flags); } return; } void DetectEngineStateReset(DetectEngineStateFlow *state, uint8_t direction) { if (state != NULL) { if (direction & STREAM_TOSERVER) { state->dir_state[0].cnt = 0; state->dir_state[0].flags = 0; } if (direction & STREAM_TOCLIENT) { state->dir_state[1].cnt = 0; state->dir_state[1].flags = 0; } } return; } /** \brief Reset de state for active tx' * To be used on detect engine reload. * \param f write LOCKED flow */ void DetectEngineStateResetTxs(Flow *f) { if (AppLayerParserProtocolSupportsTxs(f->proto, f->alproto)) { void *alstate = FlowGetAppState(f); if (!StateIsValid(f->alproto, alstate)) { return; } uint64_t inspect_ts = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOCLIENT); uint64_t inspect_tc = AppLayerParserGetTransactionInspectId(f->alparser, STREAM_TOSERVER); uint64_t inspect_tx_id = MIN(inspect_ts, inspect_tc); uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, alstate); for ( ; inspect_tx_id < total_txs; inspect_tx_id++) { void *inspect_tx = AppLayerParserGetTx(f->proto, f->alproto, alstate, inspect_tx_id); if (inspect_tx != NULL) { DetectEngineState *tx_de_state = AppLayerParserGetTxDetectState(f->proto, f->alproto, inspect_tx); if (tx_de_state == NULL) { continue; } tx_de_state->dir_state[0].cnt = 0; tx_de_state->dir_state[0].filestore_cnt = 0; tx_de_state->dir_state[0].flags = 0; tx_de_state->dir_state[1].cnt = 0; tx_de_state->dir_state[1].filestore_cnt = 0; tx_de_state->dir_state[1].flags = 0; } } } } /*********Unittests*********/ #ifdef UNITTESTS static int DeStateTest01(void) { SCLogDebug("sizeof(DetectEngineState)\t\t%"PRIuMAX, (uintmax_t)sizeof(DetectEngineState)); SCLogDebug("sizeof(DeStateStore)\t\t\t%"PRIuMAX, (uintmax_t)sizeof(DeStateStore)); SCLogDebug("sizeof(DeStateStoreItem)\t\t%"PRIuMAX"", (uintmax_t)sizeof(DeStateStoreItem)); return 1; } static int DeStateTest02(void) { int result = 0; DetectEngineState *state = DetectEngineStateAlloc(); if (state == NULL) { printf("d == NULL: "); goto end; } Signature s; memset(&s, 0x00, sizeof(s)); uint8_t direction = STREAM_TOSERVER; s.num = 0; DeStateSignatureAppend(state, &s, 0, direction); s.num = 11; DeStateSignatureAppend(state, &s, 0, direction); s.num = 22; DeStateSignatureAppend(state, &s, 0, direction); s.num = 33; DeStateSignatureAppend(state, &s, 0, direction); s.num = 44; DeStateSignatureAppend(state, &s, 0, direction); s.num = 55; DeStateSignatureAppend(state, &s, 0, direction); s.num = 66; DeStateSignatureAppend(state, &s, 0, direction); s.num = 77; DeStateSignatureAppend(state, &s, 0, direction); s.num = 88; DeStateSignatureAppend(state, &s, 0, direction); s.num = 99; DeStateSignatureAppend(state, &s, 0, direction); s.num = 100; DeStateSignatureAppend(state, &s, 0, direction); s.num = 111; DeStateSignatureAppend(state, &s, 0, direction); s.num = 122; DeStateSignatureAppend(state, &s, 0, direction); s.num = 133; DeStateSignatureAppend(state, &s, 0, direction); s.num = 144; DeStateSignatureAppend(state, &s, 0, direction); s.num = 155; DeStateSignatureAppend(state, &s, 0, direction); s.num = 166; DeStateSignatureAppend(state, &s, 0, direction); if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL) { goto end; } if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 11) { goto end; } if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next == NULL) { goto end; } if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[14].sid != 144) { goto end; } if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[0].sid != 155) { goto end; } if (state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->next->store[1].sid != 166) { goto end; } result = 1; end: if (state != NULL) { DetectEngineStateFree(state); } return result; } static int DeStateTest03(void) { DetectEngineState *state = DetectEngineStateAlloc(); FAIL_IF_NULL(state); Signature s; memset(&s, 0x00, sizeof(s)); uint8_t direction = STREAM_TOSERVER; s.num = 11; DeStateSignatureAppend(state, &s, 0, direction); s.num = 22; DeStateSignatureAppend(state, &s, BIT_U32(DE_STATE_FLAG_BASE), direction); FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head == NULL); FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].sid != 11); FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[0].flags & BIT_U32(DE_STATE_FLAG_BASE)); FAIL_IF(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].sid != 22); FAIL_IF(!(state->dir_state[direction & STREAM_TOSERVER ? 0 : 1].head->store[1].flags & BIT_U32(DE_STATE_FLAG_BASE))); DetectEngineStateFree(state); PASS; } static int DeStateSigTest01(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\nContent-Length: 10\r\n\r\n"; uint8_t httpbuf4[] = "Http Body!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy\"; http_cookie; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("signature matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (http_state != NULL) { HTPStateFree(http_state); } if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test multiple pipelined http transactions */ static int DeStateSigTest02(void) { Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "User-Agent: Mozilla/1.0\r\nContent-Length: 10\r\n"; uint8_t httpbuf3[] = "Cookie: dummy\r\n\r\n"; uint8_t httpbuf4[] = "Http Body!"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf6[] = "User-Agent: Firefox/1.0\r\n"; uint8_t httpbuf7[] = "Cookie: dummy2\r\nContent-Length: 10\r\n\r\nHttp Body!"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ uint32_t httplen7 = sizeof(httpbuf7) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"/\"; http_uri; content:\"Mozilla\"; http_header; content:\"dummy\"; http_cookie; content:\"body\"; nocase; http_client_body; sid:1; rev:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; sid:2; rev:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; void *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, f.alstate, 0); FAIL_IF_NULL(tx); DetectEngineState *tx_de_state = AppLayerParserGetTxDetectState(IPPROTO_TCP, ALPROTO_HTTP, tx); FAIL_IF_NULL(tx_de_state); FAIL_IF(tx_de_state->dir_state[0].cnt != 1); FAIL_IF(tx_de_state->dir_state[0].head->store[0].flags != BIT_U32(DE_STATE_FLAG_BASE)); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))); p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf7, httplen7); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 2))); p->alerts.cnt = 0; AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } static int DeStateSigTest03(void) { uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ ThreadVars th_v; TcpSession ssn; Flow *f = NULL; Packet *p = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); FAIL_IF_NULL(f); f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->alproto = ALPROTO_HTTP; p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FAIL_IF_NULL(p); p->flow = f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); FLOWLOCK_UNLOCK(f); FAIL_IF(r != 0); http_state = f->alstate; FAIL_IF_NULL(http_state); FAIL_IF_NULL(http_state->files_ts); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); FLOWLOCK_WRLOCK(f); FileContainer *files = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, STREAM_TOSERVER); FLOWLOCK_UNLOCK(f); FAIL_IF_NULL(files); File *file = files->head; FAIL_IF_NULL(file); FAIL_IF(!(file->flags & FILE_STORE)); AppLayerParserThreadCtxFree(alp_tctx); UTHFreeFlow(f); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); PASS; } static int DeStateSigTest04(void) { uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ ThreadVars th_v; TcpSession ssn; int result = 0; Flow *f = NULL; Packet *p = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->alproto = ALPROTO_HTTP; p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } if (http_state->files_ts == NULL) { printf("no files in state: "); goto end; } FLOWLOCK_WRLOCK(f); FileContainer *files = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, STREAM_TOSERVER); if (files == NULL) { printf("no stored files: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); File *file = files->head; if (file == NULL) { printf("no file: "); goto end; } if (file->flags & FILE_STORE) { printf("file is set to store, but sig didn't match: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreeFlow(f); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); return result; } static int DeStateSigTest05(void) { uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ ThreadVars th_v; TcpSession ssn; int result = 0; Flow *f = NULL; Packet *p = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->alproto = ALPROTO_HTTP; p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } if (http_state->files_ts == NULL) { printf("no files in state: "); goto end; } FLOWLOCK_WRLOCK(f); FileContainer *files = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, STREAM_TOSERVER); if (files == NULL) { printf("no stored files: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); File *file = files->head; if (file == NULL) { printf("no file: "); goto end; } if (!(file->flags & FILE_NOSTORE)) { printf("file is not set to \"no store\": "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreeFlow(f); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); return result; } static int DeStateSigTest06(void) { uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ ThreadVars th_v; TcpSession ssn; int result = 0; Flow *f = NULL; Packet *p = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"POST\"; http_method; content:\"upload.cgi\"; http_uri; filename:\"nomatch\"; filestore; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->alproto = ALPROTO_HTTP; p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } if (http_state->files_ts == NULL) { printf("no files in state: "); goto end; } FLOWLOCK_WRLOCK(f); FileContainer *files = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, STREAM_TOSERVER); if (files == NULL) { printf("no stored files: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); File *file = files->head; if (file == NULL) { printf("no file: "); goto end; } if (!(file->flags & FILE_NOSTORE)) { printf("file is not set to \"no store\": "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreeFlow(f); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); return result; } static int DeStateSigTest07(void) { uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ ThreadVars th_v; TcpSession ssn; int result = 0; Flow *f = NULL; Packet *p = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Signature *s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any (content:\"GET\"; http_method; content:\"upload.cgi\"; http_uri; filestore; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; f->alproto = ALPROTO_HTTP; p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) goto end; p->flow = f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } if (http_state->files_ts == NULL) { printf("no files in state: "); goto end; } FLOWLOCK_WRLOCK(f); FileContainer *files = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, STREAM_TOSERVER); if (files == NULL) { printf("no stored files: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); File *file = files->head; if (file == NULL) { printf("no file: "); goto end; } if (file->flags & FILE_STORE) { printf("file is set to store, but sig didn't match: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreeFlow(f); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); return result; } #endif void DeStateRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DeStateTest01", DeStateTest01); UtRegisterTest("DeStateTest02", DeStateTest02); UtRegisterTest("DeStateTest03", DeStateTest03); UtRegisterTest("DeStateSigTest01", DeStateSigTest01); UtRegisterTest("DeStateSigTest02", DeStateSigTest02); UtRegisterTest("DeStateSigTest03", DeStateSigTest03); UtRegisterTest("DeStateSigTest04", DeStateSigTest04); UtRegisterTest("DeStateSigTest05", DeStateSigTest05); UtRegisterTest("DeStateSigTest06", DeStateSigTest06); UtRegisterTest("DeStateSigTest07", DeStateSigTest07); #endif return; } /** * @} */ suricata-3.2.1/src/log-tlsstore.c0000644000000000000000000003111513051004444013604 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Roliers Jean-Paul * \author Eric Leblond * \author Victor Julien * * Implements TLS store portion of the engine. * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-tlslog.h" #include "app-layer-ssl.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-crypt.h" #include "util-time.h" #define MODULE_NAME "LogTlsStoreLog" static char tls_logfile_base_dir[PATH_MAX] = "/tmp"; SC_ATOMIC_DECLARE(unsigned int, cert_id); static char logging_dir_not_writable; #define LOGGING_WRITE_ISSUE_LIMIT 6 typedef struct LogTlsStoreLogThread_ { uint32_t tls_cnt; uint8_t* enc_buf; size_t enc_buf_len; } LogTlsStoreLogThread; static int CreateFileName(const Packet *p, SSLState *state, char *filename) { #define FILELEN 64 //filename len + extention + ending path / + some space int filenamelen = FILELEN + strlen(tls_logfile_base_dir); int file_id = SC_ATOMIC_ADD(cert_id, 1); if (filenamelen + 1 > PATH_MAX) { return 0; } /* Use format : packet time + incremental ID * When running on same pcap it will overwrite * On a live device, we will not be able to overwrite */ snprintf(filename, filenamelen, "%s/%ld.%ld-%d.pem", tls_logfile_base_dir, (long int)p->ts.tv_sec, (long int)p->ts.tv_usec, file_id); return 1; } static void LogTlsLogPem(LogTlsStoreLogThread *aft, const Packet *p, SSLState *state, int ipproto) { #define PEMHEADER "-----BEGIN CERTIFICATE-----\n" #define PEMFOOTER "-----END CERTIFICATE-----\n" //Logging pem certificate char filename[PATH_MAX] = ""; FILE* fp = NULL; FILE* fpmeta = NULL; unsigned long pemlen; unsigned char* pembase64ptr = NULL; int ret; uint8_t *ptmp; SSLCertsChain *cert; if ((state->server_connp.cert_input == NULL) || (state->server_connp.cert_input_len == 0)) SCReturn; CreateFileName(p, state, filename); if (strlen(filename) == 0) { SCLogWarning(SC_ERR_FOPEN, "Can't create PEM filename"); SCReturn; } fp = fopen(filename, "w"); if (fp == NULL) { if (logging_dir_not_writable < LOGGING_WRITE_ISSUE_LIMIT) { SCLogWarning(SC_ERR_FOPEN, "Can't create PEM file '%s' in '%s' directory", filename, tls_logfile_base_dir); logging_dir_not_writable++; } SCReturn; } TAILQ_FOREACH(cert, &state->server_connp.certs, next) { pemlen = (4 * (cert->cert_len + 2) / 3) +1; if (pemlen > aft->enc_buf_len) { ptmp = (uint8_t*) SCRealloc(aft->enc_buf, sizeof(uint8_t) * pemlen); if (ptmp == NULL) { SCFree(aft->enc_buf); aft->enc_buf = NULL; SCLogWarning(SC_ERR_MEM_ALLOC, "Can't allocate data for base64 encoding"); goto end_fp; } aft->enc_buf = ptmp; aft->enc_buf_len = pemlen; } memset(aft->enc_buf, 0, aft->enc_buf_len); ret = Base64Encode((unsigned char*) cert->cert_data, cert->cert_len, aft->enc_buf, &pemlen); if (ret != SC_BASE64_OK) { SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "Invalid return of Base64Encode function"); goto end_fwrite_fp; } if (fprintf(fp, PEMHEADER) < 0) goto end_fwrite_fp; pembase64ptr = aft->enc_buf; while (pemlen > 0) { size_t loffset = pemlen >= 64 ? 64 : pemlen; if (fwrite(pembase64ptr, 1, loffset, fp) != loffset) goto end_fwrite_fp; if (fwrite("\n", 1, 1, fp) != 1) goto end_fwrite_fp; pembase64ptr += 64; if (pemlen < 64) break; pemlen -= 64; } if (fprintf(fp, PEMFOOTER) < 0) goto end_fwrite_fp; } fclose(fp); //Logging certificate informations memcpy(filename + (strlen(filename) - 3), "meta", 4); fpmeta = fopen(filename, "w"); if (fpmeta != NULL) { #define PRINT_BUF_LEN 46 char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN]; char timebuf[64]; Port sp, dp; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); if (!TLSGetIPInformations(p, srcip, PRINT_BUF_LEN, &sp, dstip, PRINT_BUF_LEN, &dp, ipproto)) goto end_fwrite_fpmeta; if (fprintf(fpmeta, "TIME: %s\n", timebuf) < 0) goto end_fwrite_fpmeta; if (p->pcap_cnt > 0) { if (fprintf(fpmeta, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt) < 0) goto end_fwrite_fpmeta; } if (fprintf(fpmeta, "SRC IP: %s\n", srcip) < 0) goto end_fwrite_fpmeta; if (fprintf(fpmeta, "DST IP: %s\n", dstip) < 0) goto end_fwrite_fpmeta; if (fprintf(fpmeta, "PROTO: %" PRIu32 "\n", p->proto) < 0) goto end_fwrite_fpmeta; if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) { if (fprintf(fpmeta, "SRC PORT: %" PRIu16 "\n", sp) < 0) goto end_fwrite_fpmeta; if (fprintf(fpmeta, "DST PORT: %" PRIu16 "\n", dp) < 0) goto end_fwrite_fpmeta; } if (fprintf(fpmeta, "TLS SUBJECT: %s\n" "TLS ISSUERDN: %s\n" "TLS FINGERPRINT: %s\n", state->server_connp.cert0_subject, state->server_connp.cert0_issuerdn, state->server_connp.cert0_fingerprint) < 0) goto end_fwrite_fpmeta; fclose(fpmeta); } else { if (logging_dir_not_writable < LOGGING_WRITE_ISSUE_LIMIT) { SCLogWarning(SC_ERR_FOPEN, "Can't create meta file '%s' in '%s' directory", filename, tls_logfile_base_dir); logging_dir_not_writable++; } SCReturn; } /* Reset the store flag */ state->server_connp.cert_log_flag &= ~SSL_TLS_LOG_PEM; SCReturn; end_fwrite_fp: fclose(fp); if (logging_dir_not_writable < LOGGING_WRITE_ISSUE_LIMIT) { SCLogWarning(SC_ERR_FWRITE, "Unable to write certificate"); logging_dir_not_writable++; } end_fwrite_fpmeta: if (fpmeta) { fclose(fpmeta); if (logging_dir_not_writable < LOGGING_WRITE_ISSUE_LIMIT) { SCLogWarning(SC_ERR_FWRITE, "Unable to write certificate metafile"); logging_dir_not_writable++; } } SCReturn; end_fp: fclose(fp); SCReturn; } /** \internal * \brief Condition function for TLS logger * \retval bool true or false -- log now? */ static int LogTlsStoreCondition(ThreadVars *tv, const Packet *p, void *state, void *tx, uint64_t tx_id) { if (p->flow == NULL) { return FALSE; } if (!(PKT_IS_TCP(p))) { return FALSE; } SSLState *ssl_state = (SSLState *)state; if (ssl_state == NULL) { SCLogDebug("no tls state, so no request logging"); goto dontlog; } if ((ssl_state->server_connp.cert_log_flag & SSL_TLS_LOG_PEM) == 0) goto dontlog; if (ssl_state->server_connp.cert0_issuerdn == NULL || ssl_state->server_connp.cert0_subject == NULL) goto dontlog; return TRUE; dontlog: return FALSE; } static int LogTlsStoreLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { LogTlsStoreLogThread *aft = (LogTlsStoreLogThread *)thread_data; int ipproto = (PKT_IS_IPV4(p)) ? AF_INET : AF_INET6; SSLState *ssl_state = (SSLState *)state; if (unlikely(ssl_state == NULL)) { return 0; } if (ssl_state->server_connp.cert_log_flag & SSL_TLS_LOG_PEM) { LogTlsLogPem(aft, p, ssl_state, ipproto); } return 0; } static TmEcode LogTlsStoreLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogTlsStoreLogThread *aft = SCMalloc(sizeof(LogTlsStoreLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogTlsStoreLogThread)); if (initdata == NULL) { SCLogDebug("Error getting context for LogTLSStore. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } struct stat stat_buf; /* coverity[toctou] */ if (stat(tls_logfile_base_dir, &stat_buf) != 0) { int ret; /* coverity[toctou] */ ret = mkdir(tls_logfile_base_dir, S_IRWXU|S_IXGRP|S_IRGRP); if (ret != 0) { int err = errno; if (err != EEXIST) { SCLogError(SC_ERR_LOGDIR_CONFIG, "Cannot create certs drop directory %s: %s", tls_logfile_base_dir, strerror(err)); exit(EXIT_FAILURE); } } else { SCLogInfo("Created certs drop directory %s", tls_logfile_base_dir); } } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode LogTlsStoreLogThreadDeinit(ThreadVars *t, void *data) { LogTlsStoreLogThread *aft = (LogTlsStoreLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } if (aft->enc_buf != NULL) SCFree(aft->enc_buf); /* clear memory */ memset(aft, 0, sizeof(LogTlsStoreLogThread)); SCFree(aft); return TM_ECODE_OK; } static void LogTlsStoreLogExitPrintStats(ThreadVars *tv, void *data) { LogTlsStoreLogThread *aft = (LogTlsStoreLogThread *)data; if (aft == NULL) { return; } SCLogInfo("(%s) certificates extracted %" PRIu32 "", tv->name, aft->tls_cnt); } /** * \internal * * \brief deinit the log ctx and write out the waldo * * \param output_ctx output context to deinit */ static void LogTlsStoreLogDeInitCtx(OutputCtx *output_ctx) { SCFree(output_ctx); } /** \brief Create a new http log LogFilestoreCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFilestoreCtx* to the file_ctx if succesful * */ static OutputCtx *LogTlsStoreLogInitCtx(ConfNode *conf) { OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) return NULL; output_ctx->data = NULL; output_ctx->DeInit = LogTlsStoreLogDeInitCtx; /* FIXME we need to implement backward compability here */ char *s_default_log_dir = NULL; s_default_log_dir = ConfigGetLogDirectory(); const char *s_base_dir = NULL; s_base_dir = ConfNodeLookupChildValue(conf, "certs-log-dir"); if (s_base_dir == NULL || strlen(s_base_dir) == 0) { strlcpy(tls_logfile_base_dir, s_default_log_dir, sizeof(tls_logfile_base_dir)); } else { if (PathIsAbsolute(s_base_dir)) { strlcpy(tls_logfile_base_dir, s_base_dir, sizeof(tls_logfile_base_dir)); } else { snprintf(tls_logfile_base_dir, sizeof(tls_logfile_base_dir), "%s/%s", s_default_log_dir, s_base_dir); } } SCLogInfo("storing certs in %s", tls_logfile_base_dir); /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); SCReturnPtr(output_ctx, "OutputCtx"); } void LogTlsStoreRegister (void) { OutputRegisterTxModuleWithCondition(LOGGER_TLS_STORE, MODULE_NAME, "tls-store", LogTlsStoreLogInitCtx, ALPROTO_TLS, LogTlsStoreLogger, LogTlsStoreCondition, LogTlsStoreLogThreadInit, LogTlsStoreLogThreadDeinit, LogTlsStoreLogExitPrintStats); SC_ATOMIC_INIT(cert_id); SCLogDebug("registered"); } suricata-3.2.1/src/detect-bytejump.c0000644000000000000000000014534613051004444014267 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Implements byte_jump keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "app-layer.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" #include "detect-content.h" #include "detect-uricontent.h" #include "util-byte.h" #include "util-unittest.h" #include "util-debug.h" #include "detect-pcre.h" /** * \brief Regex for parsing our options */ #define PARSE_REGEX "^\\s*" \ "([^\\s,]+\\s*,\\s*[^\\s,]+)" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "(?:\\s*,\\s*((?:multiplier|post_offset)\\s+[^\\s,]+|[^\\s,]+))?" \ "\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; void DetectBytejumpRegisterTests(void); void DetectBytejumpRegister (void) { sigmatch_table[DETECT_BYTEJUMP].name = "byte_jump"; sigmatch_table[DETECT_BYTEJUMP].Match = DetectBytejumpMatch; sigmatch_table[DETECT_BYTEJUMP].Setup = DetectBytejumpSetup; sigmatch_table[DETECT_BYTEJUMP].Free = DetectBytejumpFree; sigmatch_table[DETECT_BYTEJUMP].RegisterTests = DetectBytejumpRegisterTests; sigmatch_table[DETECT_BYTEJUMP].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** \brief Byte jump match function * \param det_ctx thread detect engine ctx * \param s signature * \param m byte jump sigmatch * \param payload ptr to the payload * \param payload_len length of the payload * \retval 1 match * \retval 0 no match */ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, const SigMatchCtx *ctx, uint8_t *payload, uint32_t payload_len, uint8_t flags, int32_t offset) { SCEnter(); const DetectBytejumpData *data = (const DetectBytejumpData *)ctx; uint8_t *ptr = NULL; uint8_t *jumpptr = NULL; int32_t len = 0; uint64_t val = 0; int extbytes; if (payload_len == 0) { SCReturnInt(0); } /* Calculate the ptr value for the bytejump and length remaining in * the packet from that point. */ if (flags & DETECT_BYTEJUMP_RELATIVE) { ptr = payload + det_ctx->buffer_offset; len = payload_len - det_ctx->buffer_offset; ptr += offset; len -= offset; /* No match if there is no relative base */ if (ptr == NULL || len <= 0) { SCReturnInt(0); } } else { ptr = payload + offset; len = payload_len - offset; } /* Verify the to-be-extracted data is within the packet */ if (ptr < payload || data->nbytes > len) { SCLogDebug("Data not within payload " "pkt=%p, ptr=%p, len=%d, nbytes=%d", payload, ptr, len, data->nbytes); SCReturnInt(0); } /* Extract the byte data */ if (flags & DETECT_BYTEJUMP_STRING) { extbytes = ByteExtractStringUint64(&val, data->base, data->nbytes, (const char *)ptr); if(extbytes <= 0) { SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes " "of string data: %d", data->nbytes, extbytes); SCReturnInt(-1); } } else { int endianness = (flags & DETECT_BYTEJUMP_LITTLE) ? BYTE_LITTLE_ENDIAN : BYTE_BIG_ENDIAN; extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr); if (extbytes != data->nbytes) { SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes " "of numeric data: %d", data->nbytes, extbytes); SCReturnInt(-1); } } //printf("VAL: (%" PRIu64 " x %" PRIu32 ") + %d + %" PRId32 "\n", val, data->multiplier, extbytes, data->post_offset); /* Adjust the jump value based on flags */ val *= data->multiplier; if (flags & DETECT_BYTEJUMP_ALIGN) { if ((val % 4) != 0) { val += 4 - (val % 4); } } val += data->post_offset; /* Calculate the jump location */ if (flags & DETECT_BYTEJUMP_BEGIN) { jumpptr = payload + val; //printf("NEWVAL: payload %p + %ld = %p\n", p->payload, val, jumpptr); } else { val += extbytes; jumpptr = ptr + val; //printf("NEWVAL: ptr %p + %ld = %p\n", ptr, val, jumpptr); } /* Validate that the jump location is still in the packet * \todo Should this validate it is still in the *payload*? */ if ((jumpptr < payload) || (jumpptr >= payload + payload_len)) { SCLogDebug("Jump location (%p) is not within " "payload (%p-%p)", jumpptr, payload, payload + payload_len - 1); SCReturnInt(0); } #ifdef DEBUG if (SCLogDebugEnabled()) { uint8_t *sptr = (flags & DETECT_BYTEJUMP_BEGIN) ? payload : ptr; SCLogDebug("jumping %" PRId64 " bytes from %p (%08x) to %p (%08x)", val, sptr, (int)(sptr - payload), jumpptr, (int)(jumpptr - payload)); } #endif /* DEBUG */ /* Adjust the detection context to the jump location. */ det_ctx->buffer_offset = jumpptr - payload; SCReturnInt(1); } int DetectBytejumpMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectBytejumpData *data = (const DetectBytejumpData *)ctx; uint8_t *ptr = NULL; uint8_t *jumpptr = NULL; uint16_t len = 0; uint64_t val = 0; int extbytes; if (p->payload_len == 0) { return 0; } /* Calculate the ptr value for the bytejump and length remaining in * the packet from that point. */ if (data->flags & DETECT_BYTEJUMP_RELATIVE) { ptr = p->payload + det_ctx->buffer_offset; len = p->payload_len - det_ctx->buffer_offset; /* No match if there is no relative base */ if (ptr == NULL || len == 0) { return 0; } ptr += data->offset; len -= data->offset; } else { ptr = p->payload + data->offset; len = p->payload_len - data->offset; } /* Verify the to-be-extracted data is within the packet */ if (ptr < p->payload || data->nbytes > len) { SCLogDebug("Data not within packet " "payload=%p, ptr=%p, len=%d, nbytes=%d", p->payload, ptr, len, data->nbytes); return 0; } /* Extract the byte data */ if (data->flags & DETECT_BYTEJUMP_STRING) { extbytes = ByteExtractStringUint64(&val, data->base, data->nbytes, (const char *)ptr); if(extbytes <= 0) { SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes " "of string data: %d", data->nbytes, extbytes); return -1; } } else { int endianness = (data->flags & DETECT_BYTEJUMP_LITTLE) ? BYTE_LITTLE_ENDIAN : BYTE_BIG_ENDIAN; extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr); if (extbytes != data->nbytes) { SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes " "of numeric data: %d", data->nbytes, extbytes); return -1; } } //printf("VAL: (%" PRIu64 " x %" PRIu32 ") + %d + %" PRId32 "\n", val, data->multiplier, extbytes, data->post_offset); /* Adjust the jump value based on flags */ val *= data->multiplier; if (data->flags & DETECT_BYTEJUMP_ALIGN) { if ((val % 4) != 0) { val += 4 - (val % 4); } } val += data->post_offset; /* Calculate the jump location */ if (data->flags & DETECT_BYTEJUMP_BEGIN) { jumpptr = p->payload + val; //printf("NEWVAL: payload %p + %ld = %p\n", p->payload, val, jumpptr); } else { val += extbytes; jumpptr = ptr + val; //printf("NEWVAL: ptr %p + %ld = %p\n", ptr, val, jumpptr); } /* Validate that the jump location is still in the packet * \todo Should this validate it is still in the *payload*? */ if ((jumpptr < p->payload) || (jumpptr >= p->payload + p->payload_len)) { SCLogDebug("Jump location (%p) is not within " "packet (%p-%p)", jumpptr, p->payload, p->payload + p->payload_len - 1); return 0; } #ifdef DEBUG if (SCLogDebugEnabled()) { uint8_t *sptr = (data->flags & DETECT_BYTEJUMP_BEGIN) ? p->payload : ptr; SCLogDebug("jumping %" PRId64 " bytes from %p (%08x) to %p (%08x)", val, sptr, (int)(sptr - p->payload), jumpptr, (int)(jumpptr - p->payload)); } #endif /* DEBUG */ /* Adjust the detection context to the jump location. */ det_ctx->buffer_offset = jumpptr - p->payload; return 1; } DetectBytejumpData *DetectBytejumpParse(char *optstr, char **offset) { DetectBytejumpData *data = NULL; char args[10][64]; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int numargs = 0; int i = 0; uint32_t nbytes; char *str_ptr; char *end_ptr; memset(args, 0x00, sizeof(args)); /* Execute the regex and populate args with captures. */ ret = pcre_exec(parse_regex, parse_regex_study, optstr, strlen(optstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2 || ret > 10) { SCLogError(SC_ERR_PCRE_PARSE,"parse error, ret %" PRId32 ", string \"%s\"", ret, optstr); goto error; } /* The first two arguments are stashed in the first PCRE substring. * This is because byte_jump can take 10 arguments, but PCRE only * supports 9 substrings, sigh. */ char str[512] = ""; res = pcre_copy_substring((char *)optstr, ov, MAX_SUBSTRINGS, 1, str, sizeof(str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed " "for arg 1"); goto error; } /* Break up first substring into two parameters * * NOTE: Because of this, we cannot free args[1] as it is part of args[0], * and *yes* this *is* ugly. */ end_ptr = str; while (!(isspace((unsigned char)*end_ptr) || (*end_ptr == ','))) end_ptr++; *(end_ptr++) = '\0'; strlcpy(args[0], str, sizeof(args[0])); numargs++; str_ptr = end_ptr; while (isspace((unsigned char)*str_ptr) || (*str_ptr == ',')) str_ptr++; end_ptr = str_ptr; while (!(isspace((unsigned char)*end_ptr) || (*end_ptr == ',')) && (*end_ptr != '\0')) end_ptr++; *(end_ptr++) = '\0'; strlcpy(args[1], str_ptr, sizeof(args[1])); numargs++; /* The remaining args are directly from PCRE substrings */ for (i = 1; i < (ret - 1); i++) { res = pcre_copy_substring((char *)optstr, ov, MAX_SUBSTRINGS, i + 1, args[i+1], sizeof(args[0])); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_copy_substring failed for arg %d", i + 1); goto error; } numargs++; } /* Initialize the data */ data = SCMalloc(sizeof(DetectBytejumpData)); if (unlikely(data == NULL)) goto error; data->base = DETECT_BYTEJUMP_BASE_UNSET; data->flags = 0; data->multiplier = 1; data->post_offset = 0; /* * The first two options are required and positional. The * remaining arguments are flags and are not positional. */ /* Number of bytes */ if (ByteExtractStringUint32(&nbytes, 10, strlen(args[0]), args[0]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed number of bytes: %s", optstr); goto error; } /* Offset */ if (args[1][0] != '-' && isalpha((unsigned char)args[1][0])) { if (offset == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "byte_jump supplied with " "var name for offset. \"value\" argument supplied to " "this function has to be non-NULL"); goto error; } *offset = SCStrdup(args[1]); if (*offset == NULL) goto error; } else { if (ByteExtractStringInt32(&data->offset, 0, strlen(args[1]), args[1]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed offset: %s", optstr); goto error; } } /* The remaining options are flags. */ /** \todo Error on dups? */ for (i = 2; i < numargs; i++) { if (strcmp("relative", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_RELATIVE; } else if (strcasecmp("string", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_STRING; } else if (strcasecmp("dec", args[i]) == 0) { data->base |= DETECT_BYTEJUMP_BASE_DEC; } else if (strcasecmp("hex", args[i]) == 0) { data->base |= DETECT_BYTEJUMP_BASE_HEX; } else if (strcasecmp("oct", args[i]) == 0) { data->base |= DETECT_BYTEJUMP_BASE_OCT; } else if (strcasecmp("big", args[i]) == 0) { if (data->flags & DETECT_BYTEJUMP_LITTLE) { data->flags ^= DETECT_BYTEJUMP_LITTLE; } data->flags |= DETECT_BYTEJUMP_BIG; } else if (strcasecmp("little", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_LITTLE; } else if (strcasecmp("from_beginning", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_BEGIN; } else if (strcasecmp("align", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_ALIGN; } else if (strncasecmp("multiplier ", args[i], 11) == 0) { if (ByteExtractStringUint32(&data->multiplier, 10, strlen(args[i]) - 11, args[i] + 11) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed multiplier: %s", optstr); goto error; } } else if (strncasecmp("post_offset ", args[i], 12) == 0) { if (ByteExtractStringInt32(&data->post_offset, 10, strlen(args[i]) - 12, args[i] + 12) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed post_offset: %s", optstr); goto error; } } else if (strcasecmp("dce", args[i]) == 0) { data->flags |= DETECT_BYTEJUMP_DCE; } else { SCLogError(SC_ERR_INVALID_VALUE, "Unknown option: \"%s\"", args[i]); goto error; } } if (data->flags & DETECT_BYTEJUMP_STRING) { /* 23 - This is the largest string (octal, with a zero prefix) that * will not overflow uint64_t. The only way this length * could be over 23 and still not overflow is if it were zero * prefixed and we only support 1 byte of zero prefix for octal. * * "01777777777777777777777" = 0xffffffffffffffff */ if (nbytes > 23) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot test more than 23 bytes " "with \"string\": %s", optstr); goto error; } } else { if (nbytes > 8) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot test more than 8 bytes " "without \"string\": %s\n", optstr); goto error; } if (data->base != DETECT_BYTEJUMP_BASE_UNSET) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot use a base " "without \"string\": %s", optstr); goto error; } } /* This is max 23 so it will fit in a byte (see above) */ data->nbytes = (uint8_t)nbytes; return data; error: if (offset != NULL && *offset != NULL) { SCFree(*offset); *offset = NULL; } if (data != NULL) DetectBytejumpFree(data); return NULL; } int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { SigMatch *sm = NULL; SigMatch *prev_pm = NULL; DetectBytejumpData *data = NULL; char *offset = NULL; int ret = -1; data = DetectBytejumpParse(optstr, &offset); if (data == NULL) goto error; int sm_list; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA) { if (data->flags & DETECT_BYTEJUMP_DCE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "dce bytejump specified " "with file_data option set."); goto error; } AppLayerHtpEnableResponseBodyCallback(); } sm_list = s->list; s->flags |= SIG_FLAG_APPLAYER; if (data->flags & DETECT_BYTEJUMP_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); } } else if (data->flags & DETECT_BYTEJUMP_DCE) { if (data->flags & DETECT_BYTEJUMP_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 12, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; } } else { sm_list = DETECT_SM_LIST_PMATCH; } s->alproto = ALPROTO_DCERPC; s->flags |= SIG_FLAG_APPLAYER; } else if (data->flags & DETECT_BYTEJUMP_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 168, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; } } else { sm_list = DETECT_SM_LIST_PMATCH; } if (data->flags & DETECT_BYTEJUMP_DCE) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Non dce alproto sig has " "bytejump with dce enabled"); goto error; } if ((data->flags & DETECT_BYTEJUMP_STRING) || (data->flags & DETECT_BYTEJUMP_LITTLE) || (data->flags & DETECT_BYTEJUMP_BIG) || (data->flags & DETECT_BYTEJUMP_BEGIN) || (data->base == DETECT_BYTEJUMP_BASE_DEC) || (data->base == DETECT_BYTEJUMP_BASE_HEX) || (data->base == DETECT_BYTEJUMP_BASE_OCT) ) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Invalid option. " "A byte_jump keyword with dce holds other invalid modifiers."); goto error; } } if (offset != NULL) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var " "seen in byte_jump - %s\n", offset); goto error; } data->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id; data->flags |= DETECT_BYTEJUMP_OFFSET_BE; SCFree(offset); } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_BYTEJUMP; sm->ctx = (SigMatchCtx *)data; SigMatchAppendSMToList(s, sm, sm_list); if (!(data->flags & DETECT_BYTEJUMP_RELATIVE)) goto okay; if (prev_pm == NULL) goto okay; if (prev_pm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)prev_pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } okay: ret = 0; return ret; error: DetectBytejumpFree(data); return ret; } /** * \brief this function will free memory associated with DetectBytejumpData * * \param data pointer to DetectBytejumpData */ void DetectBytejumpFree(void *ptr) { if (ptr == NULL) return; DetectBytejumpData *data = (DetectBytejumpData *)ptr; SCFree(data); } /* UNITTESTS */ #ifdef UNITTESTS #include "util-unittest-helper.h" /** * \test DetectBytejumpTestParse01 is a test to make sure that we return * "something" when given valid bytejump opt */ int DetectBytejumpTestParse01(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse("4,0", NULL); if (data != NULL) { DetectBytejumpFree(data); result = 1; } return result; } /** * \test DetectBytejumpTestParse02 is a test for setting the required opts */ int DetectBytejumpTestParse02(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse("4, 0", NULL); if (data != NULL) { if ( (data->nbytes == 4) && (data->offset == 0) && (data->multiplier == 1) && (data->post_offset == 0) && (data->flags == 0) && (data->base == DETECT_BYTEJUMP_BASE_UNSET)) { result = 1; } DetectBytejumpFree(data); } return result; } /** * \test DetectBytejumpTestParse03 is a test for setting the optional flags */ int DetectBytejumpTestParse03(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse(" 4,0 , relative , little, string, " "dec, align, from_beginning", NULL); if (data != NULL) { if ( (data->nbytes == 4) && (data->offset == 0) && (data->multiplier == 1) && (data->post_offset == 0) && (data->flags == ( DETECT_BYTEJUMP_RELATIVE |DETECT_BYTEJUMP_LITTLE |DETECT_BYTEJUMP_STRING |DETECT_BYTEJUMP_ALIGN |DETECT_BYTEJUMP_BEGIN)) && (data->base == DETECT_BYTEJUMP_BASE_DEC)) { result = 1; } DetectBytejumpFree(data); } return result; } /** * \test DetectBytejumpTestParse04 is a test for setting the optional flags * with parameters * * \todo This fails becuase we can only have 9 captures and there are 10. */ int DetectBytejumpTestParse04(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse(" 4,0 , relative , little, string, " "dec, align, from_beginning , " "multiplier 2 , post_offset -16 ", NULL); if (data != NULL) { if ( (data->nbytes == 4) && (data->offset == 0) && (data->multiplier == 2) && (data->post_offset == -16) && (data->flags == ( DETECT_BYTEJUMP_RELATIVE |DETECT_BYTEJUMP_LITTLE |DETECT_BYTEJUMP_ALIGN |DETECT_BYTEJUMP_STRING |DETECT_BYTEJUMP_BEGIN)) && (data->base == DETECT_BYTEJUMP_BASE_DEC)) { result = 1; } DetectBytejumpFree(data); } return result; } /** * \test DetectBytejumpTestParse05 is a test for setting base without string */ int DetectBytejumpTestParse05(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse(" 4,0 , relative , little, dec, " "align, from_beginning", NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytejumpTestParse06 is a test for too many bytes to extract */ int DetectBytejumpTestParse06(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse("9, 0", NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytejumpTestParse07 is a test for too many string bytes to extract */ int DetectBytejumpTestParse07(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse("24, 0, string, dec", NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytejumpTestParse08 is a test for offset too big */ int DetectBytejumpTestParse08(void) { int result = 0; DetectBytejumpData *data = NULL; data = DetectBytejumpParse("4, 0xffffffffffffffff", NULL); if (data == NULL) { result = 1; } return result; } /** * \test Test dce option. */ int DetectBytejumpTestParse09(void) { Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 1; s->alproto = ALPROTO_DCERPC; result &= (DetectBytejumpSetup(NULL, s, "4,0, align, multiplier 2, " "post_offset -16,dce") == 0); result &= (DetectBytejumpSetup(NULL, s, "4,0, multiplier 2, " "post_offset -16,dce") == 0); result &= (DetectBytejumpSetup(NULL, s, "4,0,post_offset -16,dce") == 0); result &= (DetectBytejumpSetup(NULL, s, "4,0,dce") == 0); result &= (DetectBytejumpSetup(NULL, s, "4,0,dce") == 0); result &= (DetectBytejumpSetup(NULL, s, "4,0, string, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, big, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, little, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, string, dec, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, string, oct, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, string, hex, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, from_beginning, dce") == -1); result &= (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); return result; } /** * \test Test dce option. */ int DetectBytejumpTestParse10(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_jump:4,0,align,multiplier 2, " "post_offset -16,relative,dce; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTEJUMP); bd = (DetectBytejumpData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (!(bd->flags & DETECT_BYTEJUMP_DCE) && !(bd->flags & DETECT_BYTEJUMP_RELATIVE) && (bd->flags & DETECT_BYTEJUMP_STRING) && (bd->flags & DETECT_BYTEJUMP_BIG) && (bd->flags & DETECT_BYTEJUMP_LITTLE) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_jump:4,0,align,multiplier 2, " "post_offset -16,relative,dce; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTEJUMP); bd = (DetectBytejumpData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (!(bd->flags & DETECT_BYTEJUMP_DCE) && !(bd->flags & DETECT_BYTEJUMP_RELATIVE) && (bd->flags & DETECT_BYTEJUMP_STRING) && (bd->flags & DETECT_BYTEJUMP_BIG) && (bd->flags & DETECT_BYTEJUMP_LITTLE) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_jump:4,0,align,multiplier 2, " "post_offset -16,relative; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTEJUMP); bd = (DetectBytejumpData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if ((bd->flags & DETECT_BYTEJUMP_DCE) && !(bd->flags & DETECT_BYTEJUMP_RELATIVE) && (bd->flags & DETECT_BYTEJUMP_STRING) && (bd->flags & DETECT_BYTEJUMP_BIG) && (bd->flags & DETECT_BYTEJUMP_LITTLE) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test dce option. */ int DetectBytejumpTestParse11(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,string,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_sub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,big,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,little,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,string,hex,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,string,dec,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,string,oct,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytejump_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; byte_jump:4,0,align,multiplier 2, " "post_offset -16,from_beginning,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test file_data */ static int DetectBytejumpTestParse12(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectBytejumpData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; byte_jump:4,0,align,multiplier 2, " "post_offset -16,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL) { goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_BYTEJUMP) { goto end; } bd = (DetectBytejumpData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if ((bd->flags & DETECT_BYTEJUMP_DCE) && (bd->flags & DETECT_BYTEJUMP_RELATIVE) && (bd->flags & DETECT_BYTEJUMP_STRING) && (bd->flags & DETECT_BYTEJUMP_BIG) && (bd->flags & DETECT_BYTEJUMP_LITTLE) ) { result = 0; goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectByteJumpTestPacket01 is a test to check matches of * byte_jump and byte_jump relative works if the previous keyword is pcre * (bug 142) */ int DetectByteJumpTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"pcre + byte_test + " "relative\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\"; byte_jump:1,6," "relative,string,dec; content:\"0\"; sid:134; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** * \test DetectByteJumpTestPacket02 is a test to check matches of * byte_jump and byte_jump relative works if the previous keyword is byte_jump * (bug 165) */ int DetectByteJumpTestPacket02 (void) { int result = 0; uint8_t buf[] = { 0x00, 0x00, 0x00, 0x77, 0xff, 0x53, 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x92, 0xa4, 0x01, 0x08, 0x17, 0x5c, 0x0e, 0xff, 0x00, 0x00, 0x00, 0x01, 0x40, 0x48, 0x00, 0x00, 0x00, 0xff }; uint16_t buflen = sizeof(buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"byte_jump with byte_jump" " + relative\"; byte_jump:1,13; byte_jump:4,0,relative; " "content:\"|48 00 00|\"; within:3; sid:144; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } int DetectByteJumpTestPacket03(void) { int result = 0; uint8_t *buf = NULL; uint16_t buflen = 0; buf = SCMalloc(4); if (unlikely(buf == NULL)) { printf("malloc failed\n"); exit(EXIT_FAILURE); } memcpy(buf, "boom", 4); buflen = 4; Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"byte_jump\"; " "byte_jump:1,214748364; sid:1; rev:1;)"; result = !UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: if (buf != NULL) SCFree(buf); return result; } /** * \test check matches of with from_beginning (bug 626/627) */ int DetectByteJumpTestPacket04 (void) { int result = 0; uint8_t *buf = (uint8_t *)"XYZ04abcdABCD"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (content:\"XYZ\"; byte_jump:2,0,relative,string,dec; content:\"ABCD\"; distance:0; within:4; sid:1; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** * \test check matches of with from_beginning (bug 626/627) */ int DetectByteJumpTestPacket05 (void) { int result = 0; uint8_t *buf = (uint8_t *)"XYZ04abcdABCD"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (content:\"XYZ\"; byte_jump:2,0,relative,string,dec; content:\"cdABCD\"; within:6; sid:1; rev:1;)"; result = UTHPacketMatchSig(p, sig) ? 0 : 1; UTHFreePacket(p); end: return result; } /** * \test check matches of with from_beginning (bug 626/627) */ int DetectByteJumpTestPacket06 (void) { int result = 0; uint8_t *buf = (uint8_t *)"XX04abcdABCD"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (content:\"XX\"; byte_jump:2,0,relative,string,dec,from_beginning; content:\"ABCD\"; distance:4; within:4; sid:1; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** * \test check matches of with from_beginning (bug 626/627) */ int DetectByteJumpTestPacket07 (void) { int result = 0; uint8_t *buf = (uint8_t *)"XX04abcdABCD"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (content:\"XX\"; byte_jump:2,0,relative,string,dec,from_beginning; content:\"abcdABCD\"; distance:0; within:8; sid:1; rev:1;)"; result = UTHPacketMatchSig(p, sig) ? 1 : 0; UTHFreePacket(p); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectBytejump */ void DetectBytejumpRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectBytejumpTestParse01", DetectBytejumpTestParse01); UtRegisterTest("DetectBytejumpTestParse02", DetectBytejumpTestParse02); UtRegisterTest("DetectBytejumpTestParse03", DetectBytejumpTestParse03); UtRegisterTest("DetectBytejumpTestParse04", DetectBytejumpTestParse04); UtRegisterTest("DetectBytejumpTestParse05", DetectBytejumpTestParse05); UtRegisterTest("DetectBytejumpTestParse06", DetectBytejumpTestParse06); UtRegisterTest("DetectBytejumpTestParse07", DetectBytejumpTestParse07); UtRegisterTest("DetectBytejumpTestParse08", DetectBytejumpTestParse08); UtRegisterTest("DetectBytejumpTestParse09", DetectBytejumpTestParse09); UtRegisterTest("DetectBytejumpTestParse10", DetectBytejumpTestParse10); UtRegisterTest("DetectBytejumpTestParse11", DetectBytejumpTestParse11); UtRegisterTest("DetectBytejumpTestParse12", DetectBytejumpTestParse12); UtRegisterTest("DetectByteJumpTestPacket01", DetectByteJumpTestPacket01); UtRegisterTest("DetectByteJumpTestPacket02", DetectByteJumpTestPacket02); UtRegisterTest("DetectByteJumpTestPacket03", DetectByteJumpTestPacket03); UtRegisterTest("DetectByteJumpTestPacket04", DetectByteJumpTestPacket04); UtRegisterTest("DetectByteJumpTestPacket05", DetectByteJumpTestPacket05); UtRegisterTest("DetectByteJumpTestPacket06", DetectByteJumpTestPacket06); UtRegisterTest("DetectByteJumpTestPacket07", DetectByteJumpTestPacket07); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-lua-tls.c0000644000000000000000000002111313051004444013477 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ssl.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" #include "util-lua-common.h" static int GetCertNotBefore(lua_State *luastate, const Flow *f, int direction) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SSLState *ssl_state = (SSLState *)state; SSLStateConnp *connp = NULL; if (direction) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_not_before == 0) return LuaCallbackError(luastate, "error: no certificate NotBefore"); int r = LuaPushInteger(luastate, connp->cert0_not_before); return r; } static int TlsGetCertNotBefore(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_TLS))) return LuaCallbackError(luastate, "error: protocol not tls"); int direction = LuaStateGetDirection(luastate); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetCertNotBefore(luastate, f, direction); return r; } static int GetCertNotAfter(lua_State *luastate, const Flow *f, int direction) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SSLState *ssl_state = (SSLState *)state; SSLStateConnp *connp = NULL; if (direction) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_not_after == 0) return LuaCallbackError(luastate, "error: no certificate NotAfter"); int r = LuaPushInteger(luastate, connp->cert0_not_after); return r; } static int TlsGetCertNotAfter(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_TLS))) return LuaCallbackError(luastate, "error: protocol not tls"); int direction = LuaStateGetDirection(luastate); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetCertNotAfter(luastate, f, direction); return r; } static int GetCertInfo(lua_State *luastate, const Flow *f, int direction) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SSLState *ssl_state = (SSLState *)state; SSLStateConnp *connp = NULL; if (direction) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } if (connp->cert0_subject == NULL) return LuaCallbackError(luastate, "error: no cert"); /* tls.version */ char ssl_version[32] = ""; switch (ssl_state->server_connp.version) { case TLS_VERSION_UNKNOWN: snprintf(ssl_version, sizeof(ssl_version), "UNDETERMINED"); break; case SSL_VERSION_2: snprintf(ssl_version, sizeof(ssl_version), "SSLv2"); break; case SSL_VERSION_3: snprintf(ssl_version, sizeof(ssl_version), "SSLv3"); break; case TLS_VERSION_10: snprintf(ssl_version, sizeof(ssl_version), "TLSv1"); break; case TLS_VERSION_11: snprintf(ssl_version, sizeof(ssl_version), "TLS 1.1"); break; case TLS_VERSION_12: snprintf(ssl_version, sizeof(ssl_version), "TLS 1.2"); break; default: snprintf(ssl_version, sizeof(ssl_version), "0x%04x", ssl_state->server_connp.version); break; } int r = LuaPushStringBuffer(luastate, (uint8_t *)ssl_version, strlen(ssl_version)); r += LuaPushStringBuffer(luastate, (uint8_t *)connp->cert0_subject, strlen(connp->cert0_subject)); r += LuaPushStringBuffer(luastate, (uint8_t *)connp->cert0_issuerdn, strlen(connp->cert0_issuerdn)); r += LuaPushStringBuffer(luastate, (uint8_t *)connp->cert0_fingerprint, strlen(connp->cert0_fingerprint)); return r; } static int TlsGetCertInfo(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_TLS))) return LuaCallbackError(luastate, "error: protocol not tls"); int direction = LuaStateGetDirection(luastate); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetCertInfo(luastate, f, direction); return r; } static int GetSNI(lua_State *luastate, const Flow *f) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SSLState *ssl_state = (SSLState *)state; if (ssl_state->client_connp.sni == NULL) return LuaCallbackError(luastate, "error: no server name indication"); return LuaPushStringBuffer(luastate, (uint8_t *)ssl_state->client_connp.sni, strlen(ssl_state->client_connp.sni)); } static int TlsGetSNI(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_TLS))) return LuaCallbackError(luastate, "error: protocol not tls"); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetSNI(luastate, f); return r; } static int GetCertChain(lua_State *luastate, const Flow *f, int direction) { void *state = FlowGetAppState(f); if (state == NULL) return LuaCallbackError(luastate, "error: no app layer state"); SSLState *ssl_state = (SSLState *)state; SSLStateConnp *connp = NULL; if (direction) { connp = &ssl_state->client_connp; } else { connp = &ssl_state->server_connp; } uint32_t u = 0; lua_newtable(luastate); SSLCertsChain *cert = NULL; TAILQ_FOREACH(cert, &connp->certs, next) { lua_pushinteger(luastate, u++); lua_newtable(luastate); lua_pushstring(luastate, "length"); lua_pushinteger(luastate, cert->cert_len); lua_settable(luastate, -3); lua_pushstring(luastate, "data"); LuaPushStringBuffer(luastate, cert->cert_data, cert->cert_len); lua_settable(luastate, -3); lua_settable(luastate, -3); } return 1; } static int TlsGetCertChain(lua_State *luastate) { int r; if (!(LuaStateNeedProto(luastate, ALPROTO_TLS))) return LuaCallbackError(luastate, "error: protocol not tls"); int direction = LuaStateGetDirection(luastate); Flow *f = LuaStateGetFlow(luastate); if (f == NULL) return LuaCallbackError(luastate, "internal error: no flow"); r = GetCertChain(luastate, f, direction); return r; } /** \brief register tls lua extensions in a luastate */ int LuaRegisterTlsFunctions(lua_State *luastate) { /* registration of the callbacks */ lua_pushcfunction(luastate, TlsGetCertNotBefore); lua_setglobal(luastate, "TlsGetCertNotBefore"); lua_pushcfunction(luastate, TlsGetCertNotAfter); lua_setglobal(luastate, "TlsGetCertNotAfter"); lua_pushcfunction(luastate, TlsGetCertInfo); lua_setglobal(luastate, "TlsGetCertInfo"); lua_pushcfunction(luastate, TlsGetSNI); lua_setglobal(luastate, "TlsGetSNI"); lua_pushcfunction(luastate, TlsGetCertChain); lua_setglobal(luastate, "TlsGetCertChain"); return 0; } #endif /* HAVE_LUA */ suricata-3.2.1/src/detect-engine-prefilter-common.h0000644000000000000000000000572413051004444017155 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __DETECT_ENGINE_PREFILTER_COMMON_H__ #define __DETECT_ENGINE_PREFILTER_COMMON_H__ typedef union { uint8_t u8[8]; uint16_t u16[4]; uint32_t u32[2]; uint64_t u64; } PrefilterPacketHeaderValue; #define PREFILTER_EXTRA_MATCH_UNUSED 0 #define PREFILTER_EXTRA_MATCH_ALPROTO 1 #define PREFILTER_EXTRA_MATCH_SRCPORT 2 #define PREFILTER_EXTRA_MATCH_DSTPORT 3 typedef struct PrefilterPacketHeaderCtx_ { PrefilterPacketHeaderValue v1; uint16_t type; uint16_t value; /** rules to add when the flags are present */ uint32_t sigs_cnt; SigIntId *sigs_array; } PrefilterPacketHeaderCtx; typedef struct SigsArray_ { SigIntId *sigs; uint32_t cnt; uint32_t offset; // used to track assign pos } SigsArray; typedef struct PrefilterPacketU8HashCtx_ { SigsArray *array[256]; } PrefilterPacketU8HashCtx; #define PREFILTER_U8HASH_MODE_EQ 0 #define PREFILTER_U8HASH_MODE_LT 1 #define PREFILTER_U8HASH_MODE_GT 2 #define PREFILTER_U8HASH_MODE_RA 3 int PrefilterSetupPacketHeader(SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)); int PrefilterSetupPacketHeaderU8Hash(SigGroupHead *sgh, int sm_type, void (*Set)(PrefilterPacketHeaderValue *v, void *), _Bool (*Compare)(PrefilterPacketHeaderValue v, void *), void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)); static inline _Bool PrefilterPacketHeaderExtraMatch(const PrefilterPacketHeaderCtx *ctx, const Packet *p) { switch (ctx->type) { case PREFILTER_EXTRA_MATCH_UNUSED: break; case PREFILTER_EXTRA_MATCH_ALPROTO: if (p->flow == NULL || p->flow->alproto != ctx->value) return FALSE; break; case PREFILTER_EXTRA_MATCH_SRCPORT: if (p->sp != ctx->value) return FALSE; break; case PREFILTER_EXTRA_MATCH_DSTPORT: if (p->dp != ctx->value) return FALSE; break; } return TRUE; } #endif /* __DETECT_ENGINE_PREFILTER_COMMON_H__ */ suricata-3.2.1/src/detect-dns-query.c0000644000000000000000000011237413051004444014352 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup dnslayer * * @{ */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-dns-common.h" #include "detect-dns-query.h" #include "detect-engine-dns.h" #include "util-unittest-helper.h" static int DetectDnsQuerySetup (DetectEngineCtx *, Signature *, char *); static void DetectDnsQueryRegisterTests(void); /** * \brief Registration function for keyword: dns_query */ void DetectDnsQueryRegister (void) { sigmatch_table[DETECT_AL_DNS_QUERY].name = "dns_query"; sigmatch_table[DETECT_AL_DNS_QUERY].desc = "content modifier to match specifically and only on the DNS query-buffer"; sigmatch_table[DETECT_AL_DNS_QUERY].Match = NULL; sigmatch_table[DETECT_AL_DNS_QUERY].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_DNS_QUERY].Setup = DetectDnsQuerySetup; sigmatch_table[DETECT_AL_DNS_QUERY].Free = NULL; sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests; sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("dns_query", SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSQUERYNAME_MATCH, 2, PrefilterTxDnsQueryRegister); DetectAppLayerInspectEngineRegister(ALPROTO_DNS, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSQUERYNAME_MATCH, DetectEngineInspectDnsQueryName); /* register these generic engines from here for now */ DetectAppLayerInspectEngineRegister(ALPROTO_DNS, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSREQUEST_MATCH, DetectEngineInspectDnsRequest); DetectAppLayerInspectEngineRegister(ALPROTO_DNS, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_DNSRESPONSE_MATCH, DetectEngineInspectDnsResponse); } /** * \brief this function setups the dns_query modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success * \retval -1 On failure */ static int DetectDnsQuerySetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { s->list = DETECT_SM_LIST_DNSQUERYNAME_MATCH; s->alproto = ALPROTO_DNS; return 0; } #ifdef UNITTESTS /** \test simple google.com query matching */ static int DetectDnsQueryTest01(void) { /* google.com */ uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_UDP; f.protomap = FlowGetProtoMapping(f.proto); p->flow = &f; p->flags |= PKT_HAS_FLOW; p->flowflags |= FLOW_PKT_TOSERVER; f.alproto = ALPROTO_DNS; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google\"; nocase; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test multi tx google.(com|net) query matching */ static int DetectDnsQueryTest02(void) { /* google.com */ uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x01, 0x00, 0x01, }; uint8_t buf2[] = { 0x10, 0x32, /* tx id */ 0x81, 0x80, /* flags: resp, recursion desired, recusion available */ 0x00, 0x01, /* 1 query */ 0x00, 0x01, /* 1 answer */ 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */ /* query record */ 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */ 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ /* answer */ 0xc0, 0x0c, /* ref to name in query above */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ 0x00, 0x01, 0x40, 0xef, /* ttl */ 0x00, 0x04, /* data len */ 0x01, 0x02, 0x03, 0x04 }; /* addr */ /* google.net */ uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); p2 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); p3 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_UDP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_DNS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW; p1->flowflags |= FLOW_PKT_TOSERVER; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW; p3->flowflags |= FLOW_PKT_TOSERVER; p3->pcap_cnt = 3; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.com\"; nocase; sid:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.net\"; nocase; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("(p1) sig 1 didn't alert, but it should have: "); goto end; } if (PacketAlertCheck(p1, 2)) { printf("(p1) sig 2 did alert, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf2, sizeof(buf2)); if (r != 0) { printf("toserver client 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("(p2) sig 1 alerted, but it should not have: "); goto end; } if (PacketAlertCheck(p2, 2)) { printf("(p2) sig 2 alerted, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf3, sizeof(buf3)); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p3); if (PacketAlertCheck(p3, 1)) { printf("(p3) sig 1 alerted, but it should not have: "); goto end; } if (!(PacketAlertCheck(p3, 2))) { printf("(p3) sig 2 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); return result; } /** \test simple google.com query matching (TCP) */ static int DetectDnsQueryTest03(void) { /* google.com */ uint8_t buf[] = { 0x00, 28, 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_DNS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "content:\"google\"; nocase; dns_query; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test simple google.com query matching (TCP splicing) */ static int DetectDnsQueryTest04(void) { /* google.com */ uint8_t buf1[] = { 0x00, 28, 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p1 = NULL, *p2 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_DNS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; p2->flow = &f; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google\"; nocase; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sig 1 alerted, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf2, sizeof(buf2)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); return result; } /** \test simple google.com query matching (TCP splicing) */ static int DetectDnsQueryTest05(void) { /* google.com in 2 chunks (buf1 and buf2) */ uint8_t buf1[] = { 0x00, 28, /* len 28 */ 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint8_t buf2[] = { 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x10, 0x00, 0x01, }; uint8_t buf3[] = { 0x00, 44, /* len 44 */ 0x10, 0x32, /* tx id */ 0x81, 0x80, /* flags: resp, recursion desired, recusion available */ 0x00, 0x01, /* 1 query */ 0x00, 0x01, /* 1 answer */ 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */ /* query record */ 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */ 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ /* answer */ 0xc0, 0x0c, /* ref to name in query above */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ 0x00, 0x01, 0x40, 0xef, /* ttl */ 0x00, 0x04, /* data len */ 0x01, 0x02, 0x03, 0x04 }; /* addr */ /* google.net */ uint8_t buf4[] = { 0x00, 28, /* len 28 */ 0x11, 0x33, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p1 = NULL, *p2 = NULL, *p3 = NULL, *p4 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); p3 = UTHBuildPacketReal(buf3, sizeof(buf3), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); p4 = UTHBuildPacketReal(buf4, sizeof(buf4), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_DNS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; p2->flow = &f; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; p3->flow = &f; p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT|FLOW_PKT_ESTABLISHED; p4->flow = &f; p4->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p4->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.com\"; nocase; sid:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.net\"; nocase; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("(p1) sig 1 alerted, but it should not have: "); goto end; } if (PacketAlertCheck(p1, 2)) { printf("(p1) sig 2 did alert, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf2, sizeof(buf2)); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sig 1 didn't alert, but it should have: "); goto end; } if (PacketAlertCheck(p2, 2)) { printf("(p2) sig 2 did alert, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf3, sizeof(buf3)); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p3); if (PacketAlertCheck(p3, 1)) { printf("sig 1 did alert, but it should not have: "); goto end; } if (PacketAlertCheck(p3, 2)) { printf("(p3) sig 2 did alert, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf4, sizeof(buf4)); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p4); if (PacketAlertCheck(p4, 1)) { printf("(p4) sig 1 did alert, but it should not have: "); goto end; } if (!(PacketAlertCheck(p4, 2))) { printf("sig 1 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); UTHFreePacket(p4); return result; } /** \test simple google.com query matching, pcre */ static int DetectDnsQueryTest06(void) { /* google.com */ uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_UDP; f.protomap = FlowGetProtoMapping(f.proto); p->flow = &f; p->flags |= PKT_HAS_FLOW; p->flowflags |= FLOW_PKT_TOSERVER; f.alproto = ALPROTO_DNS; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google\"; nocase; " "pcre:\"/google\\.com$/i\"; sid:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google\"; nocase; " "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert, but it should have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sig 2 didn't alert, but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } /** \test multi tx google.(com|net) query matching + * app layer event */ static int DetectDnsQueryTest07(void) { /* google.com */ uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, 0x00, 0x01, 0x00, 0x01, }; uint8_t buf2[] = { 0x10, 0x32, /* tx id */ 0x81, 0x80|0x40, /* flags: resp, recursion desired, recusion available */ 0x00, 0x01, /* 1 query */ 0x00, 0x01, /* 1 answer */ 0x00, 0x00, 0x00, 0x00, /* no auth rr, additional rr */ /* query record */ 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, /* name */ 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00, /* name cont */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ /* answer */ 0xc0, 0x0c, /* ref to name in query above */ 0x00, 0x01, 0x00, 0x01, /* type a, class in */ 0x00, 0x01, 0x40, 0xef, /* ttl */ 0x00, 0x04, /* data len */ 0x01, 0x02, 0x03, 0x04 }; /* addr */ /* google.net */ uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00, 0x00, 0x10, 0x00, 0x01, }; int result = 0; Flow f; DNSState *dns_state = NULL; Packet *p1 = NULL, *p2 = NULL, *p3 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); p1 = UTHBuildPacketReal(buf1, sizeof(buf1), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); p2 = UTHBuildPacketReal(buf2, sizeof(buf2), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); p3 = UTHBuildPacketReal(buf3, sizeof(buf3), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53); FLOW_INITIALIZE(&f); f.flags |= FLOW_IPV4; f.proto = IPPROTO_UDP; f.protomap = FlowGetProtoMapping(f.proto); f.alproto = ALPROTO_DNS; p1->flow = &f; p1->flags |= PKT_HAS_FLOW; p1->flowflags |= FLOW_PKT_TOSERVER; p1->pcap_cnt = 1; p2->flow = &f; p2->flags |= PKT_HAS_FLOW; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->pcap_cnt = 2; p3->flow = &f; p3->flags |= PKT_HAS_FLOW; p3->flowflags |= FLOW_PKT_TOSERVER; p3->pcap_cnt = 3; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.com\"; nocase; sid:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test dns_query option\"; " "dns_query; content:\"google.net\"; nocase; sid:2;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert dns any any -> any any " "(msg:\"Test Z flag event\"; " "app-layer-event:dns.z_flag_set; sid:3;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf1, sizeof(buf1)); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dns_state = f.alstate; if (dns_state == NULL) { printf("no dns state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("(p1) sig 1 didn't alert, but it should have: "); goto end; } if (PacketAlertCheck(p1, 2)) { printf("(p1) sig 2 did alert, but it should not have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOCLIENT, buf2, sizeof(buf2)); if (r != -1) { printf("toserver client 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("(p2) sig 1 alerted, but it should not have: "); goto end; } if (PacketAlertCheck(p2, 2)) { printf("(p2) sig 2 alerted, but it should not have: "); goto end; } if (!(PacketAlertCheck(p2, 3))) { printf("(p2) sig 3 didn't alert, but it should have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf3, sizeof(buf3)); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p3); if (PacketAlertCheck(p3, 1)) { printf("(p3) sig 1 alerted, but it should not have: "); goto end; } if (!(PacketAlertCheck(p3, 2))) { printf("(p3) sig 2 didn't alert, but it should have: "); goto end; } /** \todo should not alert, bug #839 if (PacketAlertCheck(p3, 3)) { printf("(p3) sig 3 did alert, but it should not have: "); goto end; } */ result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); FLOW_DESTROY(&f); UTHFreePacket(p1); UTHFreePacket(p2); UTHFreePacket(p3); return result; } #endif static void DetectDnsQueryRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDnsQueryTest01", DetectDnsQueryTest01); UtRegisterTest("DetectDnsQueryTest02", DetectDnsQueryTest02); UtRegisterTest("DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03); UtRegisterTest("DetectDnsQueryTest04 -- tcp splicing", DetectDnsQueryTest04); UtRegisterTest("DetectDnsQueryTest05 -- tcp splicing/multi tx", DetectDnsQueryTest05); UtRegisterTest("DetectDnsQueryTest06 -- pcre", DetectDnsQueryTest06); UtRegisterTest("DetectDnsQueryTest07 -- app layer event", DetectDnsQueryTest07); #endif } suricata-3.2.1/src/stream.h0000644000000000000000000000464413051004444012455 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __STREAM_H__ #define __STREAM_H__ #include "flow.h" #define STREAM_START 0x01 #define STREAM_EOF 0x02 #define STREAM_TOSERVER 0x04 #define STREAM_TOCLIENT 0x08 #define STREAM_GAP 0x10 /**< data gap encountered */ #define STREAM_DEPTH 0x20 /**< depth reached */ typedef struct StreamMsg_ { struct StreamMsg_ *next; struct StreamMsg_ *prev; uint32_t seq; /**< sequence number */ uint32_t data_len; /**< length of the data */ uint32_t data_size; uint8_t *data; /**< reassembled data: ptr to after this * struct */ } StreamMsg; typedef struct StreamMsgQueue_ { StreamMsg *top; StreamMsg *bot; uint16_t len; #ifdef DBG_PERF uint16_t dbg_maxlen; #endif /* DBG_PERF */ } StreamMsgQueue; /* prototypes */ void StreamMsgQueuesInit(uint32_t prealloc); void StreamMsgQueuesDeinit(char); StreamMsg *StreamMsgGetFromPool(void); void StreamMsgReturnToPool(StreamMsg *); StreamMsg *StreamMsgGetFromQueue(StreamMsgQueue *); void StreamMsgPutInQueue(StreamMsgQueue *, StreamMsg *); StreamMsgQueue *StreamMsgQueueGetNew(void); void StreamMsgQueueFree(StreamMsgQueue *); void StreamMsgQueueSetMinChunkLen(uint8_t dir, uint16_t len); uint16_t StreamMsgQueueGetMinChunkLen(uint8_t); void StreamMsgReturnListToPool(void *); typedef int (*StreamSegmentCallback)(const Packet *, void *, uint8_t *, uint32_t); int StreamSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data); #endif /* __STREAM_H__ */ suricata-3.2.1/src/detect-iprep.c0000644000000000000000000006371513051004444013546 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the iprep keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "threads.h" #include "flow.h" #include "flow-bit.h" #include "flow-util.h" #include "detect-iprep.h" #include "util-spm.h" #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-fmemopen.h" #include "reputation.h" #include "host.h" #define PARSE_REGEX "\\s*(any|src|dst|both)\\s*,\\s*([A-Za-z0-9\\-\\_]+)\\s*,\\s*(\\<|\\>|\\=)\\s*,\\s*([0-9]+)\\s*" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectIPRepMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectIPRepSetup (DetectEngineCtx *, Signature *, char *); void DetectIPRepFree (void *); void IPRepRegisterTests(void); void DetectIPRepRegister (void) { sigmatch_table[DETECT_IPREP].name = "iprep"; sigmatch_table[DETECT_IPREP].Match = DetectIPRepMatch; sigmatch_table[DETECT_IPREP].Setup = DetectIPRepSetup; sigmatch_table[DETECT_IPREP].Free = DetectIPRepFree; sigmatch_table[DETECT_IPREP].RegisterTests = IPRepRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_IPREP].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static uint8_t GetHostRepSrc(Packet *p, uint8_t cat, uint32_t version) { uint8_t val = 0; Host *h = NULL; if (p->flags & PKT_HOST_SRC_LOOKED_UP && p->host_src == NULL) { return 0; } else if (p->host_src != NULL) { h = (Host *)p->host_src; HostLock(h); } else { h = HostLookupHostFromHash(&(p->src)); p->flags |= PKT_HOST_SRC_LOOKED_UP; if (h == NULL) return 0; HostReference(&p->host_src, h); } if (h->iprep == NULL) { HostRelease(h); return 0; } SReputation *r = (SReputation *)h->iprep; /* allow higher versions as this happens during * rule reload */ if (r->version >= version) val = r->rep[cat]; else SCLogDebug("version mismatch %u != %u", r->version, version); HostRelease(h); return val; } static uint8_t GetHostRepDst(Packet *p, uint8_t cat, uint32_t version) { uint8_t val = 0; Host *h = NULL; if (p->flags & PKT_HOST_DST_LOOKED_UP && p->host_dst == NULL) { return 0; } else if (p->host_dst != NULL) { h = (Host *)p->host_dst; HostLock(h); } else { h = HostLookupHostFromHash(&(p->dst)); p->flags |= PKT_HOST_DST_LOOKED_UP; if (h == NULL) { return 0; } HostReference(&p->host_dst, h); } if (h->iprep == NULL) { HostRelease(h); return 0; } SReputation *r = (SReputation *)h->iprep; /* allow higher versions as this happens during * rule reload */ if (r->version >= version) val = r->rep[cat]; else SCLogDebug("version mismatch %u != %u", r->version, version); HostRelease(h); return val; } static inline int RepMatch(uint8_t op, uint8_t val1, uint8_t val2) { if (op == DETECT_IPREP_OP_GT && val1 > val2) { return 1; } else if (op == DETECT_IPREP_OP_LT && val1 < val2) { return 1; } else if (op == DETECT_IPREP_OP_EQ && val1 == val2) { return 1; } return 0; } /* * returns 0: no match * 1: match * -1: error */ int DetectIPRepMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectIPRepData *rd = (const DetectIPRepData *)ctx; if (rd == NULL) return 0; uint32_t version = det_ctx->de_ctx->srep_version; uint8_t val = 0; SCLogDebug("rd->cmd %u", rd->cmd); switch(rd->cmd) { case DETECT_IPREP_CMD_ANY: val = GetHostRepSrc(p, rd->cat, version); if (val == 0) val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val > 0) { if (RepMatch(rd->op, val, rd->val) == 1) return 1; } val = GetHostRepDst(p, rd->cat, version); if (val == 0) val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val > 0) { return RepMatch(rd->op, val, rd->val); } break; case DETECT_IPREP_CMD_SRC: val = GetHostRepSrc(p, rd->cat, version); SCLogDebug("checking src -- val %u (looking for cat %u, val %u)", val, rd->cat, rd->val); if (val == 0) val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val > 0) { return RepMatch(rd->op, val, rd->val); } break; case DETECT_IPREP_CMD_DST: SCLogDebug("checking dst"); val = GetHostRepDst(p, rd->cat, version); if (val == 0) val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val > 0) { return RepMatch(rd->op, val, rd->val); } break; case DETECT_IPREP_CMD_BOTH: val = GetHostRepSrc(p, rd->cat, version); if (val == 0) val = SRepCIDRGetIPRepSrc(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val == 0 || RepMatch(rd->op, val, rd->val) == 0) return 0; val = GetHostRepDst(p, rd->cat, version); if (val == 0) val = SRepCIDRGetIPRepDst(det_ctx->de_ctx->srepCIDR_ctx, p, rd->cat, version); if (val > 0) { return RepMatch(rd->op, val, rd->val); } break; } return 0; } int DetectIPRepSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectIPRepData *cd = NULL; SigMatch *sm = NULL; char *cmd_str = NULL, *name = NULL, *op_str = NULL, *value = NULL; uint8_t cmd = 0; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 5) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for iprep", rawstr); return -1; } const char *str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); return -1; } cmd_str = (char *)str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } name = (char *)str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } op_str = (char *)str_ptr; res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } value = (char *)str_ptr; if (strcmp(cmd_str,"any") == 0) { cmd = DETECT_IPREP_CMD_ANY; } else if (strcmp(cmd_str,"both") == 0) { cmd = DETECT_IPREP_CMD_BOTH; } else if (strcmp(cmd_str,"src") == 0) { cmd = DETECT_IPREP_CMD_SRC; } else if (strcmp(cmd_str,"dst") == 0) { cmd = DETECT_IPREP_CMD_DST; } else { SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: iprep \"%s\" is not supported.", cmd_str); goto error; } //SCLogInfo("category %s", name); uint8_t cat = SRepCatGetByShortname(name); if (cat == 0) { SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown iprep category \"%s\"", name); goto error; } uint8_t op = 0; uint8_t val = 0; if (op_str == NULL || strlen(op_str) != 1) { goto error; } switch(op_str[0]) { case '<': op = DETECT_IPREP_OP_LT; break; case '>': op = DETECT_IPREP_OP_GT; break; case '=': op = DETECT_IPREP_OP_EQ; break; default: goto error; break; } if (value != NULL && strlen(value) > 0) { int ival = atoi(value); if (ival < 0 || ival > 127) goto error; val = (uint8_t)ival; } cd = SCMalloc(sizeof(DetectIPRepData)); if (unlikely(cd == NULL)) goto error; cd->cmd = cmd; cd->cat = cat; cd->op = op; cd->val = val; SCLogDebug("cmd %u, cat %u, op %u, val %u", cd->cmd, cd->cat, cd->op, cd->val); pcre_free_substring(name); name = NULL; pcre_free_substring(cmd_str); cmd_str = NULL; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_IPREP; sm->ctx = (SigMatchCtx *)cd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); return 0; error: if (name != NULL) pcre_free_substring(name); if (cmd_str != NULL) pcre_free_substring(cmd_str); if (cd != NULL) SCFree(cd); if (sm != NULL) SCFree(sm); return -1; } void DetectIPRepFree (void *ptr) { DetectIPRepData *fd = (DetectIPRepData *)ptr; if (fd == NULL) return; SCFree(fd); } #ifdef UNITTESTS FILE *DetectIPRepGenerateCategoriesDummy() { FILE *fd = NULL; const char *buffer = "1,BadHosts,Know bad hosts"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen()"); return fd; } FILE *DetectIPRepGenerateCategoriesDummy2() { FILE *fd = NULL; const char *buffer = "1,BadHosts,Know bad hosts\n" "2,GoodHosts,Know good hosts\n"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen()"); return fd; } FILE *DetectIPRepGenerateNetworksDummy() { FILE *fd = NULL; const char *buffer = "10.0.0.0/24,1,20"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen()"); return fd; } FILE *DetectIPRepGenerateNetworksDummy2() { FILE *fd = NULL; const char *buffer = "0.0.0.0/0,1,10\n" "192.168.0.0/16,2,127"; fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen()"); return fd; } static int DetectIPRepTest01(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1;rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } static int DetectIPRepTest02(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:src,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } static int DetectIPRepTest03(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->dst.addr_data32[0] = UTHSetIPv4Address("10.0.0.2"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:dst,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } static int DetectIPRepTest04(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("10.0.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("10.0.0.2"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:both,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } static int DetectIPRepTest05(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result == 0; } static int DetectIPRepTest06(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result == 0; } static int DetectIPRepTest07(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->dst.addr_data32[0] = UTHSetIPv4Address("1.0.0.2"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result == 0; } static int DetectIPRepTest08(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("1.0.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("1.0.0.2"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result == 0; } static int DetectIPRepTest09(void) { ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Signature *sig = NULL; FILE *fd = NULL; int result = 0, r = 0; Packet *p = UTHBuildPacket((uint8_t *)"lalala", 6, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); HostInitConfig(HOST_QUIET); memset(&th_v, 0, sizeof(th_v)); if (de_ctx == NULL || p == NULL) goto end; p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("192.168.0.2"); de_ctx->flags |= DE_QUIET; SRepInit(de_ctx); SRepResetVersion(); fd = DetectIPRepGenerateCategoriesDummy2(); r = SRepLoadCatFileFromFD(fd); if (r < 0) { goto end; } fd = DetectIPRepGenerateNetworksDummy2(); r = SRepLoadFileFromFD(de_ctx->srepCIDR_ctx, fd); if (r < 0) { goto end; } sig = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"test\"; iprep:src,BadHosts,>,9; sid:1; rev:1;)"); if (sig == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); p->alerts.cnt = 0; p->action = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)) { goto end; } result = 1; end: UTHFreePacket(p); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); HostShutdown(); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for IPRep */ void IPRepRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectIPRepTest01", DetectIPRepTest01); UtRegisterTest("DetectIPRepTest02", DetectIPRepTest02); UtRegisterTest("DetectIPRepTest03", DetectIPRepTest03); UtRegisterTest("DetectIPRepTest04", DetectIPRepTest04); UtRegisterTest("DetectIPRepTest05", DetectIPRepTest05); UtRegisterTest("DetectIPRepTest06", DetectIPRepTest06); UtRegisterTest("DetectIPRepTest07", DetectIPRepTest07); UtRegisterTest("DetectIPRepTest08", DetectIPRepTest08); UtRegisterTest("DetectIPRepTest09", DetectIPRepTest09); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-ssl-state.h0000644000000000000000000000262213051004444014341 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef DETECT_SSL_STATE_H #define DETECT_SSL_STATE_H #include "app-layer-ssl.h" /* we pick these flags flags from the parser */ #define DETECT_SSL_STATE_CLIENT_HELLO SSL_AL_FLAG_STATE_CLIENT_HELLO #define DETECT_SSL_STATE_SERVER_HELLO SSL_AL_FLAG_STATE_SERVER_HELLO #define DETECT_SSL_STATE_CLIENT_KEYX SSL_AL_FLAG_STATE_CLIENT_KEYX #define DETECT_SSL_STATE_SERVER_KEYX SSL_AL_FLAG_STATE_SERVER_KEYX #define DETECT_SSL_STATE_UNKNOWN SSL_AL_FLAG_STATE_UNKNOWN typedef struct DetectSslStateData_ { uint32_t flags; uint32_t mask; } DetectSslStateData; void DetectSslStateRegister(void); #endif /* DETECT_SSL_STATE_H */ suricata-3.2.1/src/detect-fragoffset.c0000644000000000000000000003071213051004444014544 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements fragoffset keyword */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "decode-ipv4.h" #include "decode-ipv6.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-fragoffset.h" #include "util-byte.h" #include "util-unittest.h" #include "util-debug.h" #define PARSE_REGEX "^\\s*(?:(<|>))?\\s*([0-9]+)" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectFragOffsetMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFragOffsetSetup(DetectEngineCtx *, Signature *, char *); void DetectFragOffsetRegisterTests(void); void DetectFragOffsetFree(void *); static int PrefilterSetupFragOffset(SigGroupHead *sgh); static _Bool PrefilterFragOffsetIsPrefilterable(const Signature *s); /** * \brief Registration function for fragoffset */ void DetectFragOffsetRegister (void) { sigmatch_table[DETECT_FRAGOFFSET].name = "fragoffset"; sigmatch_table[DETECT_FRAGOFFSET].desc = "match on specific decimal values of the IP fragment offset field"; sigmatch_table[DETECT_FRAGOFFSET].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragoffset"; sigmatch_table[DETECT_FRAGOFFSET].Match = DetectFragOffsetMatch; sigmatch_table[DETECT_FRAGOFFSET].Setup = DetectFragOffsetSetup; sigmatch_table[DETECT_FRAGOFFSET].Free = DetectFragOffsetFree; sigmatch_table[DETECT_FRAGOFFSET].RegisterTests = DetectFragOffsetRegisterTests; sigmatch_table[DETECT_FRAGOFFSET].SupportsPrefilter = PrefilterFragOffsetIsPrefilterable; sigmatch_table[DETECT_FRAGOFFSET].SetupPrefilter = PrefilterSetupFragOffset; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline int FragOffsetMatch(const uint16_t poffset, const uint8_t mode, const uint16_t doffset) { switch (mode) { case FRAG_LESS: if (poffset < doffset) return 1; break; case FRAG_MORE: if (poffset > doffset) return 1; break; default: if (poffset == doffset) return 1; } return 0; } /** * \brief This function is used to match fragoffset rule option set on a packet * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectFragOffsetData * * \retval 0 no match or frag is not set * \retval 1 match * */ int DetectFragOffsetMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { uint16_t frag = 0; const DetectFragOffsetData *fragoff = (const DetectFragOffsetData *)ctx; if (PKT_IS_PSEUDOPKT(p)) return 0; if (PKT_IS_IPV4(p)) { frag = IPV4_GET_IPOFFSET(p); } else if (PKT_IS_IPV6(p)) { if (IPV6_EXTHDR_ISSET_FH(p)) { frag = IPV6_EXTHDR_GET_FH_OFFSET(p); } else { return 0; } } else { SCLogDebug("No IPv4 or IPv6 packet"); return 0; } return FragOffsetMatch(frag, fragoff->mode, fragoff->frag_off);; } /** * \brief This function is used to parse fragoffset option passed via fragoffset: keyword * * \param fragoffsetstr Pointer to the user provided fragoffset options * * \retval fragoff pointer to DetectFragOffsetData on success * \retval NULL on failure */ DetectFragOffsetData *DetectFragOffsetParse (char *fragoffsetstr) { DetectFragOffsetData *fragoff = NULL; char *substr[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i; const char *str_ptr; char *mode = NULL; ret = pcre_exec(parse_regex, parse_regex_study, fragoffsetstr, strlen(fragoffsetstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH,"Parse error %s", fragoffsetstr); goto error; } for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)fragoffsetstr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed"); goto error; } substr[i-1] = (char *)str_ptr; } fragoff = SCMalloc(sizeof(DetectFragOffsetData)); if (unlikely(fragoff == NULL)) goto error; fragoff->frag_off = 0; fragoff->mode = 0; mode = substr[0]; if(mode != NULL) { while(*mode != '\0') { switch(*mode) { case '>': fragoff->mode = FRAG_MORE; break; case '<': fragoff->mode = FRAG_LESS; break; } mode++; } } if (ByteExtractStringUint16(&fragoff->frag_off, 10, 0, substr[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified frag offset %s is not " "valid", substr[1]); goto error; } for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } return fragoff; error: for (i = 0; i < 3; i++) { if (substr[i] != NULL) SCFree(substr[i]); } if (fragoff != NULL) DetectFragOffsetFree(fragoff); return NULL; } /** * \brief this function is used to add the parsed fragoffset data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param fragoffsetstr pointer to the user provided fragoffset option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFragOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *fragoffsetstr) { DetectFragOffsetData *fragoff = NULL; SigMatch *sm = NULL; fragoff = DetectFragOffsetParse(fragoffsetstr); if (fragoff == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FRAGOFFSET; sm->ctx = (SigMatchCtx *)fragoff; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (fragoff != NULL) DetectFragOffsetFree(fragoff); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectFragOffsetData * * \param ptr pointer to DetectFragOffsetData */ void DetectFragOffsetFree (void *ptr) { DetectFragOffsetData *fragoff = (DetectFragOffsetData *)ptr; SCFree(fragoff); } static void PrefilterPacketFragOffsetMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (PKT_IS_PSEUDOPKT(p)) return; uint16_t frag; if (PKT_IS_IPV4(p)) { frag = IPV4_GET_IPOFFSET(p); } else if (PKT_IS_IPV6(p)) { if (IPV6_EXTHDR_ISSET_FH(p)) { frag = IPV6_EXTHDR_GET_FH_OFFSET(p); } else { return; } } else { SCLogDebug("No IPv4 or IPv6 packet"); return; } const PrefilterPacketHeaderCtx *ctx = pectx; if (FragOffsetMatch(frag, ctx->v1.u8[0], ctx->v1.u16[1])) { PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketFragOffsetSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectFragOffsetData *fb = smctx; v->u8[0] = fb->mode; v->u16[1] = fb->frag_off; } static _Bool PrefilterPacketFragOffsetCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectFragOffsetData *fb = smctx; if (v.u8[0] == fb->mode && v.u16[1] == fb->frag_off) { return TRUE; } return FALSE; } static int PrefilterSetupFragOffset(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_FRAGOFFSET, PrefilterPacketFragOffsetSet, PrefilterPacketFragOffsetCompare, PrefilterPacketFragOffsetMatch); } static _Bool PrefilterFragOffsetIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FRAGOFFSET: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \test DetectFragOffsetParseTest01 is a test for setting a valid fragoffset value */ int DetectFragOffsetParseTest01 (void) { DetectFragOffsetData *fragoff = NULL; fragoff = DetectFragOffsetParse("300"); if (fragoff != NULL && fragoff->frag_off == 300) { DetectFragOffsetFree(fragoff); return 1; } return 0; } /** * \test DetectFragOffsetParseTest02 is a test for setting a valid fragoffset value * with spaces all around */ int DetectFragOffsetParseTest02 (void) { DetectFragOffsetData *fragoff = NULL; fragoff = DetectFragOffsetParse(">300"); if (fragoff != NULL && fragoff->frag_off == 300 && fragoff->mode == FRAG_MORE) { DetectFragOffsetFree(fragoff); return 1; } return 0; } /** * \test DetectFragOffsetParseTest03 is a test for setting an invalid fragoffset value */ int DetectFragOffsetParseTest03 (void) { DetectFragOffsetData *fragoff = NULL; fragoff = DetectFragOffsetParse("badc"); if (fragoff != NULL) { DetectFragOffsetFree(fragoff); return 0; } return 1; } /** * \test DetectFragOffsetMatchTest01 is a test for checking the working of * fragoffset keyword by creating 2 rules and matching a crafted packet * against them. Only the first one shall trigger. */ int DetectFragOffsetMatchTest01 (void) { int result = 0; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; Signature *s = NULL; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; IPV4Hdr ip4h; memset(p, 0, SIZE_OF_PACKET); memset(&ip4h, 0, sizeof(IPV4Hdr)); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(ThreadVars)); FlowInitConfig(FLOW_QUIET); p->src.family = AF_INET; p->dst.family = AF_INET; p->src.addr_data32[0] = 0x01020304; p->dst.addr_data32[0] = 0x04030201; ip4h.s_ip_src.s_addr = p->src.addr_data32[0]; ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0]; ip4h.ip_off = 0x2222; p->ip4h = &ip4h; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any (fragoffset:546; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx, "alert ip any any -> any any (fragoffset:5000; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { printf("sid 1 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 2)) { printf("sid 2 alerted, but should not have: "); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); FlowShutdown(); end: SCFree(p); return result; } #endif /* UNITTESTS */ void DetectFragOffsetRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("DetectFragOffsetParseTest01", DetectFragOffsetParseTest01); UtRegisterTest("DetectFragOffsetParseTest02", DetectFragOffsetParseTest02); UtRegisterTest("DetectFragOffsetParseTest03", DetectFragOffsetParseTest03); UtRegisterTest("DetectFragOffsetMatchTest01", DetectFragOffsetMatchTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-mpipe.c0000644000000000000000000011073513051004444013564 00000000000000/* Copyright (C) 2011-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Ken Steele, Tilera Corporation * * Tilera TILE-Gx mpipe ingress packet support. */ #include "suricata-common.h" #include "suricata.h" #include "host.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "tm-threads-common.h" #include "runmode-tile.h" #include "source-mpipe.h" #include "conf.h" #include "util-debug.h" #include "util-error.h" #include "util-privs.h" #include "util-device.h" #include "util-mem.h" #include "util-profiling.h" #include "tmqh-packetpool.h" #include "pkt-var.h" #ifdef HAVE_MPIPE #include #include #include #include #include #include #include #include #include #include #include #include /* Align "p" mod "align", assuming "p" is a "void*". */ #define ALIGN(p, align) do { (p) += -(long)(p) & ((align) - 1); } while(0) #define VERIFY(VAL, WHAT) \ do { \ int __val = (VAL); \ if (__val < 0) { \ SCLogError(SC_ERR_INVALID_ARGUMENT,(WHAT)); \ SCReturnInt(TM_ECODE_FAILED); \ } \ } while (0) #define min(a,b) (((a) < (b)) ? (a) : (b)) /** storage for mpipe device names */ typedef struct MpipeDevice_ { char *dev; /**< the device (e.g. "xgbe1") */ TAILQ_ENTRY(MpipeDevice_) next; } MpipeDevice; /** private device list */ static TAILQ_HEAD(, MpipeDevice_) mpipe_devices = TAILQ_HEAD_INITIALIZER(mpipe_devices); static int first_stack; static uint32_t headroom = 2; /** * \brief Structure to hold thread specific variables. */ typedef struct MpipeThreadVars_ { ChecksumValidationMode checksum_mode; /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; ThreadVars *tv; TmSlot *slot; Packet *in_p; /** stats/counters */ uint16_t max_mpipe_depth; uint16_t mpipe_drop; uint16_t counter_no_buffers_0; uint16_t counter_no_buffers_1; uint16_t counter_no_buffers_2; uint16_t counter_no_buffers_3; uint16_t counter_no_buffers_4; uint16_t counter_no_buffers_5; uint16_t counter_no_buffers_6; uint16_t counter_no_buffers_7; } MpipeThreadVars; TmEcode ReceiveMpipeLoop(ThreadVars *tv, void *data, void *slot); TmEcode ReceiveMpipeThreadInit(ThreadVars *, void *, void **); void ReceiveMpipeThreadExitStats(ThreadVars *, void *); TmEcode DecodeMpipeThreadInit(ThreadVars *, void *, void **); TmEcode DecodeMpipeThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeMpipe(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); static int MpipeReceiveOpenIqueue(int rank); #define MAX_CHANNELS 32 /* can probably find this in the MDE */ /* * mpipe configuration. */ /* The mpipe context (shared by all workers) */ static gxio_mpipe_context_t context_body; static gxio_mpipe_context_t* context = &context_body; /* First allocated Notification ring for iQueues. */ static int first_notif_ring; /* The ingress queue for this worker thread */ static __thread gxio_mpipe_iqueue_t* thread_iqueue; /* The egress queues (one per port) */ static gxio_mpipe_equeue_t equeue[MAX_CHANNELS]; /* the number of entries in an equeue ring */ static const int equeue_entries = 8192; /* Array of mpipe links */ static gxio_mpipe_link_t mpipe_link[MAX_CHANNELS]; /* Per interface configuration data */ static MpipeIfaceConfig *mpipe_conf[MAX_CHANNELS]; /* Per interface TAP/IPS configuration */ /* egress equeue associated with each ingress channel */ static MpipePeerVars channel_to_equeue[MAX_CHANNELS]; /** * \brief Registration Function for ReceiveMpipe. * \todo Unit tests are needed for this module. */ void TmModuleReceiveMpipeRegister (void) { tmm_modules[TMM_RECEIVEMPIPE].name = "ReceiveMpipe"; tmm_modules[TMM_RECEIVEMPIPE].ThreadInit = ReceiveMpipeThreadInit; tmm_modules[TMM_RECEIVEMPIPE].Func = NULL; tmm_modules[TMM_RECEIVEMPIPE].PktAcqLoop = ReceiveMpipeLoop; tmm_modules[TMM_RECEIVEMPIPE].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEMPIPE].ThreadExitPrintStats = ReceiveMpipeThreadExitStats; tmm_modules[TMM_RECEIVEMPIPE].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEMPIPE].RegisterTests = NULL; tmm_modules[TMM_RECEIVEMPIPE].cap_flags = SC_CAP_NET_RAW; tmm_modules[TMM_RECEIVEMPIPE].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Registraction Function for DecodeNetio. * \todo Unit tests are needed for this module. */ void TmModuleDecodeMpipeRegister (void) { tmm_modules[TMM_DECODEMPIPE].name = "DecodeMpipe"; tmm_modules[TMM_DECODEMPIPE].ThreadInit = DecodeMpipeThreadInit; tmm_modules[TMM_DECODEMPIPE].Func = DecodeMpipe; tmm_modules[TMM_DECODEMPIPE].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEMPIPE].ThreadDeinit = DecodeMpipeThreadDeinit; tmm_modules[TMM_DECODEMPIPE].RegisterTests = NULL; tmm_modules[TMM_DECODEMPIPE].cap_flags = 0; tmm_modules[TMM_DECODEMPIPE].flags = TM_FLAG_DECODE_TM; } /* Release Packet without sending. */ void MpipeReleasePacket(Packet *p) { /* Use this thread's context to free the packet. */ // TODO: Check for dual mPipes. gxio_mpipe_iqueue_t* iqueue = thread_iqueue; int bucket = p->mpipe_v.idesc.bucket_id; gxio_mpipe_credit(iqueue->context, iqueue->ring, bucket, 1); gxio_mpipe_push_buffer(iqueue->context, p->mpipe_v.idesc.stack_idx, (void*)(intptr_t)p->mpipe_v.idesc.va); } /* Unconditionally send packet, then release packet buffer. */ void MpipeReleasePacketCopyTap(Packet *p) { gxio_mpipe_iqueue_t* iqueue = thread_iqueue; int bucket = p->mpipe_v.idesc.bucket_id; gxio_mpipe_credit(iqueue->context, iqueue->ring, bucket, 1); gxio_mpipe_edesc_t edesc; edesc.words[0] = 0; edesc.words[1] = 0; edesc.bound = 1; edesc.xfer_size = p->mpipe_v.idesc.l2_size; edesc.va = p->mpipe_v.idesc.va; edesc.stack_idx = p->mpipe_v.idesc.stack_idx; edesc.hwb = 1; /* mPIPE will return packet buffer to proper stack. */ edesc.size = p->mpipe_v.idesc.size; int channel = p->mpipe_v.idesc.channel; /* Tell mPIPE to egress the packet. */ gxio_mpipe_equeue_put(channel_to_equeue[channel].peer_equeue, edesc); } /* Release Packet and send copy if action is not DROP. */ void MpipeReleasePacketCopyIPS(Packet *p) { if (unlikely(PACKET_TEST_ACTION(p, ACTION_DROP))) { /* Return packet buffer without sending the packet. */ MpipeReleasePacket(p); } else { /* Send packet */ MpipeReleasePacketCopyTap(p); } } /** * \brief Mpipe Packet Process function. * * This function fills in our packet structure from mpipe. * From here the packets are picked up by the DecodeMpipe thread. * * \param user pointer to MpipeThreadVars passed from pcap_dispatch * \param h pointer to gxio packet header * \param pkt pointer to current packet */ static inline Packet *MpipeProcessPacket(MpipeThreadVars *ptv, gxio_mpipe_idesc_t *idesc) { int caplen = idesc->l2_size; u_char *pkt = gxio_mpipe_idesc_get_va(idesc); Packet *p = (Packet *)(pkt - sizeof(Packet) - headroom/*2*/); PACKET_RECYCLE(p); PKT_SET_SRC(p, PKT_SRC_WIRE); ptv->bytes += caplen; ptv->pkts++; gettimeofday(&p->ts, NULL); p->datalink = LINKTYPE_ETHERNET; /* No need to check return value, since the only error is pkt == NULL which can't happen here. */ PacketSetData(p, pkt, caplen); /* copy only the fields we use later */ p->mpipe_v.idesc.bucket_id = idesc->bucket_id; p->mpipe_v.idesc.nr = idesc->nr; p->mpipe_v.idesc.cs = idesc->cs; p->mpipe_v.idesc.va = idesc->va; p->mpipe_v.idesc.stack_idx = idesc->stack_idx; MpipePeerVars *equeue_info = &channel_to_equeue[idesc->channel]; if (equeue_info->copy_mode != MPIPE_COPY_MODE_NONE) { p->mpipe_v.idesc.size = idesc->size; p->mpipe_v.idesc.l2_size = idesc->l2_size; p->mpipe_v.idesc.channel = idesc->channel; p->ReleasePacket = equeue_info->ReleasePacket; } else { p->ReleasePacket = MpipeReleasePacket; } if (ptv->checksum_mode == CHECKSUM_VALIDATION_DISABLE) p->flags |= PKT_IGNORE_CHECKSUM; return p; } static uint16_t XlateStack(MpipeThreadVars *ptv, int stack_idx) { switch(stack_idx - first_stack) { case 0: return ptv->counter_no_buffers_0; case 1: return ptv->counter_no_buffers_1; case 2: return ptv->counter_no_buffers_2; case 3: return ptv->counter_no_buffers_3; case 4: return ptv->counter_no_buffers_4; case 5: return ptv->counter_no_buffers_5; case 6: return ptv->counter_no_buffers_6; case 7: return ptv->counter_no_buffers_7; default: return ptv->counter_no_buffers_7; } } static void SendNoOpPacket(ThreadVars *tv, TmSlot *slot) { Packet *p = PacketPoolGetPacket(); if (p == NULL) { return; } p->datalink = DLT_RAW; p->proto = IPPROTO_TCP; /* So that DecodeMpipe ignores is. */ p->flags |= PKT_PSEUDO_STREAM_END; p->flow = NULL; TmThreadsSlotProcessPkt(tv, slot, p); } /** * \brief Receives packets from an interface via gxio mpipe. */ TmEcode ReceiveMpipeLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); MpipeThreadVars *ptv = (MpipeThreadVars *)data; TmSlot *s = (TmSlot *)slot; ptv->slot = s->slot_next; Packet *p = NULL; int rank = tv->rank; int max_queued = 0; char *ctype; ptv->checksum_mode = CHECKSUM_VALIDATION_DISABLE; if (ConfGet("mpipe.checksum-checks", &ctype) == 1) { if (ConfValIsTrue(ctype)) { ptv->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(ctype)) { ptv->checksum_mode = CHECKSUM_VALIDATION_DISABLE; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid value for checksum-check for mpipe"); } } /* Open Ingress Queue for this worker thread. */ MpipeReceiveOpenIqueue(rank); gxio_mpipe_iqueue_t* iqueue = thread_iqueue; int update_counter = 0; uint64_t last_packet_time = get_cycle_count(); for (;;) { /* Check to see how many packets are available to process. */ gxio_mpipe_idesc_t *idesc; int n = gxio_mpipe_iqueue_try_peek(iqueue, &idesc); if (likely(n > 0)) { int i; int m = min(n, 16); /* Prefetch the idescs (64 bytes each). */ for (i = 0; i < m; i++) { __insn_prefetch(&idesc[i]); } if (unlikely(n > max_queued)) { StatsSetUI64(tv, ptv->max_mpipe_depth, (uint64_t)n); max_queued = n; } for (i = 0; i < m; i++, idesc++) { if (likely(!gxio_mpipe_idesc_has_error(idesc))) { p = MpipeProcessPacket(ptv, idesc); p->mpipe_v.rank = rank; if (TmThreadsSlotProcessPkt(ptv->tv, ptv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ptv->tv, p); SCReturnInt(TM_ECODE_FAILED); } } else { if (idesc->be) { /* Buffer Error - No buffer available, so mPipe * dropped the packet. */ StatsIncr(tv, XlateStack(ptv, idesc->stack_idx)); } else { /* Bad packet. CRC error */ StatsIncr(tv, ptv->mpipe_drop); gxio_mpipe_iqueue_drop(iqueue, idesc); } gxio_mpipe_iqueue_release(iqueue, idesc); } } /* Move forward M packets in ingress ring. */ gxio_mpipe_iqueue_advance(iqueue, m); last_packet_time = get_cycle_count(); } if (update_counter-- <= 0) { /* Only periodically update and check for termination. */ StatsSyncCountersIfSignalled(tv); update_counter = 10000; if (suricata_ctl_flags != 0) { break; } // If no packet has been received for some period of time, process a NOP packet // just to make sure that pseudo packets from the Flow manager get processed. uint64_t now = get_cycle_count(); if (now - last_packet_time > 100000000) { SendNoOpPacket(ptv->tv, ptv->slot); last_packet_time = now; } } } SCReturnInt(TM_ECODE_OK); } static void MpipeRegisterPerfCounters(MpipeThreadVars *ptv, ThreadVars *tv) { /* register counters */ ptv->max_mpipe_depth = StatsRegisterCounter("mpipe.max_mpipe_depth", tv); ptv->mpipe_drop = StatsRegisterCounter("mpipe.drop", tv); ptv->counter_no_buffers_0 = StatsRegisterCounter("mpipe.no_buf0", tv); ptv->counter_no_buffers_1 = StatsRegisterCounter("mpipe.no_buf1", tv); ptv->counter_no_buffers_2 = StatsRegisterCounter("mpipe.no_buf2", tv); ptv->counter_no_buffers_3 = StatsRegisterCounter("mpipe.no_buf3", tv); ptv->counter_no_buffers_4 = StatsRegisterCounter("mpipe.no_buf4", tv); ptv->counter_no_buffers_5 = StatsRegisterCounter("mpipe.no_buf5", tv); ptv->counter_no_buffers_6 = StatsRegisterCounter("mpipe.no_buf6", tv); ptv->counter_no_buffers_7 = StatsRegisterCounter("mpipe.no_buf7", tv); } static const gxio_mpipe_buffer_size_enum_t gxio_buffer_sizes[] = { GXIO_MPIPE_BUFFER_SIZE_128, GXIO_MPIPE_BUFFER_SIZE_256, GXIO_MPIPE_BUFFER_SIZE_512, GXIO_MPIPE_BUFFER_SIZE_1024, GXIO_MPIPE_BUFFER_SIZE_1664, GXIO_MPIPE_BUFFER_SIZE_4096, GXIO_MPIPE_BUFFER_SIZE_10368, GXIO_MPIPE_BUFFER_SIZE_16384 }; static const int buffer_sizes[] = { 128, 256, 512, 1024, 1664, 4096, 10368, 16384 }; static int NormalizeBufferWeights(float buffer_weights[], int num_weights) { int stack_count = 0; /* Count required buffer stacks and normalize weights to sum to 1.0. */ float total_weight = 0; for (int i = 0; i < num_weights; i++) { if (buffer_weights[i] != 0) { ++stack_count; total_weight += buffer_weights[i]; } } /* Convert each weight to a value between 0 and 1. inclusive. */ for (int i = 0; i < num_weights; i++) { if (buffer_weights[i] != 0) { buffer_weights[i] /= total_weight; } } SCLogInfo("DEBUG: %u non-zero sized stacks", stack_count); return stack_count; } static TmEcode ReceiveMpipeAllocatePacketBuffers(void) { SCEnter(); int num_buffers; int result; int total_buffers = 0; /* Relative weighting for the number of buffers of each size. */ float buffer_weight[] = { 0 , /* 128 */ 4 , /* 256 */ 0 , /* 512 */ 0 , /* 1024 */ 4 , /* 1664 */ 0 , /* 4096 */ 0 , /* 10386 */ 0 /* 16384 */ }; int num_weights = sizeof(buffer_weight)/sizeof(buffer_weight[0]); if (ConfGetNode("mpipe.stack") != NULL) { float weight; for (int i = 0; i < num_weights; i++) buffer_weight[i] = 0; if (ConfGetFloat("mpipe.stack.size128", &weight)) buffer_weight[0] = weight; if (ConfGetFloat("mpipe.stack.size256", &weight)) buffer_weight[1] = weight; if (ConfGetFloat("mpipe.stack.size512", &weight)) buffer_weight[2] = weight; if (ConfGetFloat("mpipe.stack.size1024", &weight)) buffer_weight[3] = weight; if (ConfGetFloat("mpipe.stack.size1664", &weight)) buffer_weight[4] = weight; if (ConfGetFloat("mpipe.stack.size4096", &weight)) buffer_weight[5] = weight; if (ConfGetFloat("mpipe.stack.size10386", &weight)) buffer_weight[6] = weight; if (ConfGetFloat("mpipe.stack.size16384", &weight)) buffer_weight[7] = weight; } int stack_count = NormalizeBufferWeights(buffer_weight, num_weights); /* Allocate one of the largest pages to hold our buffer stack, * notif ring, and packets. First get a bit map of the * available page sizes. */ unsigned long available_pagesizes = tmc_alloc_get_pagesizes(); void *packet_page = NULL; size_t tile_vhuge_size = 64 * 1024; /* Try the largest available page size first to see if any * pages of that size can be allocated. */ for (int i = sizeof(available_pagesizes) * 8 - 1; i; i--) { unsigned long size = 1UL<= 1) && (value <= 4096)) { /* Must be a power of 2, so round up to next power of 2. */ int ceiling_log2 = 64 - __builtin_clz((int64_t)value - 1); *num_buckets = 1 << (ceiling_log2); } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Illegal mpipe.buckets value (%ld). must be between 1 and 4096.", value); } } if (ConfGetInt("mpipe.min-buckets", &value) == 1) { /* range check */ if ((value >= 1) && (value <= 4096)) { /* Must be a power of 2, so round up to next power of 2. */ int ceiling_log2 = 64 - __builtin_clz((int64_t)value - 1); min_buckets = 1 << (ceiling_log2); } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Illegal min-mpipe.buckets value (%ld). must be between 1 and 4096.", value); } } /* Allocate buckets. Keep trying half the number of requested buckets until min-bucket is reached. */ while (1) { *first_bucket = gxio_mpipe_alloc_buckets(context, *num_buckets, 0, 0); if (*first_bucket != GXIO_MPIPE_ERR_NO_BUCKET) break; /* Failed to allocate the requested number of buckets. Keep * trying less buckets until min-buckets is reached. */ if (*num_buckets <= min_buckets) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Could not allocate (%d) mpipe buckets. " "Try a smaller mpipe.buckets value in suricata.yaml", *num_buckets); SCReturnInt(TM_ECODE_FAILED); } /* Cut the number of requested buckets in half and try again. */ *num_buckets /= 2; } /* Init group and buckets, preserving packet order among flows. */ gxio_mpipe_bucket_mode_t mode = GXIO_MPIPE_BUCKET_STATIC_FLOW_AFFINITY; char *balance; if (ConfGet("mpipe.load-balance", &balance) == 1) { if (balance) { if (strcmp(balance, "static") == 0) { mode = GXIO_MPIPE_BUCKET_STATIC_FLOW_AFFINITY; SCLogInfo("Using \"static\" flow affinity load balancing with %d buckets.", *num_buckets); } else if (strcmp(balance, "dynamic") == 0) { mode = GXIO_MPIPE_BUCKET_DYNAMIC_FLOW_AFFINITY; SCLogInfo("Using \"dynamic\" flow affinity load balancing with %d buckets.", *num_buckets); } else if (strcmp(balance, "sticky") == 0) { mode = GXIO_MPIPE_BUCKET_STICKY_FLOW_LOCALITY; SCLogInfo("Using \"sticky\" load balancing with %d buckets.", *num_buckets); } else if (strcmp(balance, "round-robin") == 0) { mode = GXIO_MPIPE_BUCKET_ROUND_ROBIN; } else { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Illegal load balancing mode \"%s\"", balance); balance = "static"; } } } else { balance = "static"; } SCLogInfo("Using \"%s\" load balancing with %d buckets.", balance, *num_buckets); result = gxio_mpipe_init_notif_group_and_buckets(context, group, ring, num_workers, *first_bucket, *num_buckets, mode); VERIFY(result, "gxio_mpipe_init_notif_group_and_buckets()"); SCReturnInt(TM_ECODE_OK); } /* \brief Register mPIPE classifier rules to start receiving packets. * * \param Index of the first classifier bucket * \param Number of classifier buckets. * * \return result code where <0 is an error. */ static int ReceiveMpipeRegisterRules(int bucket, int num_buckets) { /* Register for packets. */ gxio_mpipe_rules_t rules; gxio_mpipe_rules_init(&rules, context); gxio_mpipe_rules_begin(&rules, bucket, num_buckets, NULL); /* Give Suricata priority over Linux to receive packets. */ gxio_mpipe_rules_set_priority(&rules, -100); return gxio_mpipe_rules_commit(&rules); } /* \brief Initialize mPIPE ingress ring * * \param name of interface to open * \param Array of port configuations * * \return Output port channel number, or -1 on error */ static int MpipeReceiveOpenIqueue(int rank) { /* Initialize the NotifRings. */ size_t notif_ring_entries = 2048; intmax_t value = 0; if (ConfGetInt("mpipe.iqueue-packets", &value) == 1) { /* range check */ if (value == 128 || value == 512 || value == 2048 || value == (64 * 1024)) { notif_ring_entries = value; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Illegal mpipe.iqueue_packets value. must be 128, 512, 2048 or 65536."); } } size_t notif_ring_size = notif_ring_entries * sizeof(gxio_mpipe_idesc_t); tmc_alloc_t alloc = TMC_ALLOC_INIT; /* Allocate the memory locally on this thread's CPU. */ tmc_alloc_set_home(&alloc, TMC_ALLOC_HOME_TASK); /* Allocate all the memory on one page. Which is required for the notif ring, not the iqueue. */ if (notif_ring_size > (size_t)getpagesize()) tmc_alloc_set_huge(&alloc); int needed = notif_ring_size + sizeof(gxio_mpipe_iqueue_t); // TODO - Save the rest of the Huge Page for other allocations. void *iqueue_mem = tmc_alloc_map(&alloc, needed); if (iqueue_mem == NULL) { SCLogError(SC_ERR_FATAL, "Failed to allocate memory for mPIPE iQueue"); return TM_ECODE_FAILED; } thread_iqueue = iqueue_mem + notif_ring_size; int result = gxio_mpipe_iqueue_init(thread_iqueue, context, first_notif_ring + rank, iqueue_mem, notif_ring_size, 0); if (result < 0) { VERIFY(result, "gxio_mpipe_iqueue_init()"); } return TM_ECODE_OK; } /* \brief Initialize on MPIPE egress port * * Initialize one mPIPE egress port for use in IPS mode. * The port must be one of the input ports. * * \param name of interface to open * \param Array of port configuations * * \return Output port channel number, or -1 on error */ static int MpipeReceiveOpenEgress(char *out_iface, int iface_idx, int copy_mode, MpipeIfaceConfig *mpipe_conf[]) { int channel; int nlive = LiveGetDeviceCount(); int result; /* Initialize an equeue */ result = gxio_mpipe_alloc_edma_rings(context, 1, 0, 0); if (result < 0) { SCLogError(SC_ERR_FATAL, "Failed to allocate mPIPE egress ring"); return result; } uint32_t ering = result; size_t edescs_size = equeue_entries * sizeof(gxio_mpipe_edesc_t); tmc_alloc_t edescs_alloc = TMC_ALLOC_INIT; tmc_alloc_set_pagesize(&edescs_alloc, edescs_size); void *edescs = tmc_alloc_map(&edescs_alloc, edescs_size); if (edescs == NULL) { SCLogError(SC_ERR_FATAL, "Failed to allocate egress descriptors"); return -1; } /* retrieve channel of outbound interface */ for (int j = 0; j < nlive; j++) { if (strcmp(out_iface, mpipe_conf[j]->iface) == 0) { channel = gxio_mpipe_link_channel(&mpipe_link[j]); SCLogInfo("egress link: %s is channel: %d", out_iface, channel); result = gxio_mpipe_equeue_init(&equeue[iface_idx], context, ering, channel, edescs, edescs_size, 0); if (result < 0) { SCLogError(SC_ERR_FATAL, "mPIPE Failed to initialize egress queue"); return -1; } /* Record the mapping from ingress port to egress port. * The egress information is stored indexed by ingress channel. */ channel = gxio_mpipe_link_channel(&mpipe_link[iface_idx]); channel_to_equeue[channel].peer_equeue = &equeue[iface_idx]; channel_to_equeue[channel].copy_mode = copy_mode; if (copy_mode == MPIPE_COPY_MODE_IPS) channel_to_equeue[channel].ReleasePacket = MpipeReleasePacketCopyIPS; else channel_to_equeue[channel].ReleasePacket = MpipeReleasePacketCopyTap; SCLogInfo("ingress link: %s is channel: %d copy_mode: %d", out_iface, channel, copy_mode); return channel; } } /* Did not find matching interface name */ SCLogError(SC_ERR_INVALID_ARGUMENT, "Could not find egress interface: %s", out_iface); return -1; } TmEcode ReceiveMpipeThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); int rank = tv->rank; int num_buckets = 4096; int num_workers = tile_num_pipelines; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "initdata == NULL"); SCReturnInt(TM_ECODE_FAILED); } MpipeThreadVars *ptv = SCMalloc(sizeof(MpipeThreadVars)); if (unlikely(ptv == NULL)) SCReturnInt(TM_ECODE_FAILED); memset(ptv, 0, sizeof(MpipeThreadVars)); ptv->tv = tv; int result; const char *link_name = (char *)initdata; MpipeRegisterPerfCounters(ptv, tv); *data = (void *)ptv; /* Only rank 0 does initialization of mpipe */ if (rank != 0) SCReturnInt(TM_ECODE_OK); /* Initialize and configure mPIPE, which is only done by one core. */ if (strcmp(link_name, "multi") == 0) { int nlive = LiveGetDeviceCount(); int instance = gxio_mpipe_link_instance(LiveGetDeviceName(0)); for (int i = 1; i < nlive; i++) { link_name = LiveGetDeviceName(i); if (gxio_mpipe_link_instance(link_name) != instance) { SCLogError(SC_ERR_INVALID_ARGUMENT, "All interfaces not on same mpipe instance"); SCReturnInt(TM_ECODE_FAILED); } } result = gxio_mpipe_init(context, instance); VERIFY(result, "gxio_mpipe_init()"); /* open ingress interfaces */ for (int i = 0; i < nlive; i++) { link_name = LiveGetDeviceName(i); SCLogInfo("opening interface %s", link_name); result = gxio_mpipe_link_open(&mpipe_link[i], context, link_name, 0); VERIFY(result, "gxio_mpipe_link_open()"); mpipe_conf[i] = ParseMpipeConfig(link_name); } /* find and open egress interfaces for IPS modes */ for (int i = 0; i < nlive; i++) { MpipeIfaceConfig *aconf = mpipe_conf[i]; if (aconf != NULL) { if (aconf->copy_mode != MPIPE_COPY_MODE_NONE) { int channel = MpipeReceiveOpenEgress(aconf->out_iface, i, aconf->copy_mode, mpipe_conf); if (channel < 0) { SCReturnInt(TM_ECODE_FAILED); } } } } } else { SCLogInfo("using single interface %s", (char *)initdata); /* Start the driver. */ result = gxio_mpipe_init(context, gxio_mpipe_link_instance(link_name)); VERIFY(result, "gxio_mpipe_init()"); gxio_mpipe_link_t link; result = gxio_mpipe_link_open(&link, context, link_name, 0); VERIFY(result, "gxio_mpipe_link_open()"); } /* Allocate some NotifRings. */ result = gxio_mpipe_alloc_notif_rings(context, num_workers, 0, 0); VERIFY(result, "gxio_mpipe_alloc_notif_rings()"); first_notif_ring = result; int first_bucket = 0; int rc; rc = ReceiveMpipeCreateBuckets(first_notif_ring, num_workers, &first_bucket, &num_buckets); if (rc != TM_ECODE_OK) SCReturnInt(rc); rc = ReceiveMpipeAllocatePacketBuffers(); if (rc != TM_ECODE_OK) SCReturnInt(rc); result = ReceiveMpipeRegisterRules(first_bucket, num_buckets); if (result < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Registering mPIPE classifier rules, %s", gxio_strerror(result)); SCReturnInt(TM_ECODE_FAILED); } SCReturnInt(TM_ECODE_OK); } TmEcode ReceiveMpipeInit(void) { SCEnter(); SCLogInfo("tile_num_pipelines: %d", tile_num_pipelines); SCReturnInt(TM_ECODE_OK); } /** * \brief This function prints stats to the screen at exit. * \param tv pointer to ThreadVars * \param data pointer that gets cast into NetiohreadVars for ptv */ void ReceiveMpipeThreadExitStats(ThreadVars *tv, void *data) { SCEnter(); SCReturn; } TmEcode DecodeMpipeThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodeMpipeThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } TmEcode DecodeMpipe(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* call the decoder */ DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } /** * \brief Add a mpipe device for monitoring * * \param dev string with the device name * * \retval 0 on success. * \retval -1 on failure. */ int MpipeLiveRegisterDevice(char *dev) { MpipeDevice *nd = SCMalloc(sizeof(MpipeDevice)); if (unlikely(nd == NULL)) { return -1; } nd->dev = SCStrdup(dev); if (unlikely(nd->dev == NULL)) { SCFree(nd); return -1; } TAILQ_INSERT_TAIL(&mpipe_devices, nd, next); SCLogDebug("Mpipe device \"%s\" registered.", dev); return 0; } /** * \brief Get the number of registered devices * * \retval cnt the number of registered devices */ int MpipeLiveGetDeviceCount(void) { int i = 0; MpipeDevice *nd; TAILQ_FOREACH(nd, &mpipe_devices, next) { i++; } return i; } #endif // HAVE_MPIPE suricata-3.2.1/src/app-layer-template.h0000644000000000000000000000463513051004444014665 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author FirstName LastName */ #ifndef __APP_LAYER_TEMPLATE_H__ #define __APP_LAYER_TEMPLATE_H__ #include "detect-engine-state.h" #include "queue.h" void RegisterTemplateParsers(void); void TemplateParserRegisterTests(void); typedef struct TemplateTransaction_ { uint64_t tx_id; /*<< Internal transaction ID. */ AppLayerDecoderEvents *decoder_events; /*<< Application layer * events that occurred * while parsing this * transaction. */ uint8_t *request_buffer; uint32_t request_buffer_len; /* flags indicating which loggers that have logged */ uint32_t logged; uint8_t *response_buffer; uint32_t response_buffer_len; uint8_t response_done; /*<< Flag to be set when the response is * seen. */ DetectEngineState *de_state; TAILQ_ENTRY(TemplateTransaction_) next; } TemplateTransaction; typedef struct TemplateState_ { TAILQ_HEAD(, TemplateTransaction_) tx_list; /**< List of Template transactions * associated with this * state. */ uint64_t transaction_max; /**< A count of the number of * transactions created. The * transaction ID for each transaction * is allocted by incrementing this * value. */ uint16_t events; /**< Number of application layer events created * for this state. */ } TemplateState; #endif /* __APP_LAYER_TEMPLATE_H__ */ suricata-3.2.1/src/alert-debuglog.h0000644000000000000000000000162113051004444014047 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __ALERT_DEBUGLOG_H__ #define __ALERT_DEBUGLOG_H__ void AlertDebugLogRegister(void); #endif /* __ALERT_DEBUGLOG_H__ */ suricata-3.2.1/src/tmqh-simple.h0000644000000000000000000000202513051004444013411 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TMQH_SIMPLE_H__ #define __TMQH_SIMPLE_H__ #include "data-queue.h" SCDQGenericQData *TmqhInputSimpleOnQ(SCDQDataQueue *); void TmqhOutputSimpleOnQ(SCDQDataQueue *, SCDQGenericQData *); void TmqhSimpleRegister (void); #endif /* __TMQH_SIMPLE_H__ */ suricata-3.2.1/src/detect-hostbits.h0000644000000000000000000000200213051004444014251 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_HOSTBITS_H__ #define __DETECT_HOSTBITS_H__ #include "detect-xbits.h" int DetectXbitMatchHost(Packet *p, const DetectXbitsData *xd); /* prototypes */ void DetectHostbitsRegister (void); #endif /* __DETECT_HOSTBITS_H__ */ suricata-3.2.1/src/util-rule-vars.h0000644000000000000000000000221713051004444014047 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_RULE_VARS_H__ #define __UTIL_RULE_VARS_H__ /** Enum indicating the various vars type in the yaml conf file */ typedef enum { SC_RULE_VARS_ADDRESS_GROUPS, SC_RULE_VARS_PORT_GROUPS, } SCRuleVarsType; char *SCRuleVarsGetConfVar(const DetectEngineCtx *, const char *, SCRuleVarsType); void SCRuleVarsRegisterTests(void); #endif /* __UTIL_RULE_VARS_H__ */ suricata-3.2.1/src/util-hash-lookup3.h0000644000000000000000000000620313051004444014443 00000000000000/* ------------------------------------------------------------------------------- lookup3.c, by Bob Jenkins, May 2006, Public Domain. These are functions for producing 32-bit hashes for hash table lookup. hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() are externally useful functions. Routines to test the hash are included if SELF_TEST is defined. You can use this free for any purpose. It's in the public domain. It has no warranty. You probably want to use hashlittle(). hashlittle() and hashbig() hash byte arrays. hashlittle() is is faster than hashbig() on little-endian machines. Intel and AMD are little-endian machines. On second thought, you probably want hashlittle2(), which is identical to hashlittle() except it returns two 32-bit hashes for the price of one. You could implement hashbig2() if you wanted but I haven't bothered here. If you want to find a hash of, say, exactly 7 integers, do a = i1; b = i2; c = i3; mix(a,b,c); a += i4; b += i5; c += i6; mix(a,b,c); a += i7; final(a,b,c); then use c as the hash value. If you have a variable length array of 4-byte integers to hash, use hashword(). If you have a byte array (like a character string), use hashlittle(). If you have several byte arrays, or a mix of things, see the comments above hashlittle(). Why is this so big? I read 12 bytes at a time into 3 4-byte integers, then mix those integers. This is fast (you can do a lot more thorough mixing with 12*3 instructions on 3 integers than you can with 3 instructions on 1 byte), but shoehorning those bytes into integers efficiently is messy. ------------------------------------------------------------------------------- */ #ifndef __UTIL_HASH_LOOKUP3_H__ #define __UTIL_HASH_LOOKUP3_H__ #define hashsize(n) ((uint32_t)1<<(n)) #define hashmask(n) (hashsize(n)-1) uint32_t hashword(const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t initval); /* the previous hash, or an arbitrary value */ void hashword2 (const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t *pc, /* IN: seed OUT: primary hash value */ uint32_t *pb); /* IN: more seed OUT: secondary hash value */ uint32_t hashlittle( const void *key, size_t length, uint32_t initval); /* A variant of hashlittle() that ensures avoids accesses beyond the last byte * of the string, which will cause warnings from tools like Valgrind or Address * Sanitizer. */ uint32_t hashlittle_safe(const void *key, size_t length, uint32_t initval); void hashlittle2(const void *key, /* the key to hash */ size_t length, /* length of the key */ uint32_t *pc, /* IN: primary initval, OUT: primary hash */ uint32_t *pb); /* IN: secondary initval, OUT: secondary hash */ uint32_t hashbig( const void *key, size_t length, uint32_t initval); #endif /* __UTIL_HASH_LOOKUP3_H__ */ suricata-3.2.1/src/detect-http-uri.c0000644000000000000000000004077613051004444014205 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Gerardo Iglesias */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-htp.h" #include "detect-http-uri.h" #include "detect-uricontent.h" #include "detect-engine-uri.h" #include "stream-tcp.h" int DetectHttpUriSetup (DetectEngineCtx *, Signature *, char *); void DetectHttpUriRegisterTests(void); /** * \brief Registration function for keyword: http_uri */ void DetectHttpUriRegister (void) { sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri"; sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer"; sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri"; sigmatch_table[DETECT_AL_HTTP_URI].Match = NULL; sigmatch_table[DETECT_AL_HTTP_URI].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup; sigmatch_table[DETECT_AL_HTTP_URI].Free = NULL; sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests; sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_uri", SIG_FLAG_TOSERVER, DETECT_SM_LIST_UMATCH, 2, PrefilterTxUriRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_UMATCH, DetectEngineInspectHttpUri); } /** * \brief this function setups the http_uri modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success * \retval -1 On failure */ int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectEngineContentModifierBufferSetup(de_ctx, s, str, DETECT_AL_HTTP_URI, DETECT_SM_LIST_UMATCH, ALPROTO_HTTP, NULL); } /******************************** UNITESTS **********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Checks if a http_uri is registered in a Signature, if content is not * specified in the signature */ int DetectHttpUriTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_uri\"; http_uri;sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_uri is registered in a Signature, if some parameter * is specified with http_uri in the signature */ int DetectHttpUriTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_uri\"; content:\"one\"; " "http_cookie:wrong; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_uri is registered in a Signature */ int DetectHttpUriTest03(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_uri\"; content:\"one\"; " "http_uri; content:\"two\"; http_uri; " "content:\"three\"; http_uri; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; } while (sm != NULL) { if (sm->type == DETECT_CONTENT) { result = 1; } else { printf("expected DETECT_AL_HTTP_URI, got %d: ", sm->type); goto end; } sm = sm->next; } end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_uri is registered in a Signature, when rawbytes is * also specified in the signature */ int DetectHttpUriTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_uri\"; content:\"one\"; " "rawbytes; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_uri is successfully converted to a uricontent * */ int DetectHttpUriTest05(void) { DetectEngineCtx *de_ctx = NULL; Signature *s = NULL; int result = 0; if ((de_ctx = DetectEngineCtxInit()) == NULL) goto end; s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_uri\"; " "content:\"we are testing http_uri keyword\"; " "http_uri; sid:1;)"); if (s == NULL) { printf("sig failed to parse\n"); goto end; } if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) goto end; if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_CONTENT) { printf("wrong type\n"); goto end; } char *str = "we are testing http_uri keyword"; int uricomp = memcmp((const char *)((DetectContentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1); int urilen = ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len; if (uricomp != 0 || urilen != strlen("we are testing http_uri keyword")) { printf("sig failed to parse, content not setup properly\n"); goto end; } result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); return result; } int DetectHttpUriTest12(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_uri; " "content:\"two\"; distance:0; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_DISTANCE || memcmp(ud2->content, "two", ud1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest13(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_uri; " "content:\"two\"; within:5; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_WITHIN || memcmp(ud2->content, "two", ud1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest14(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest15(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; http_uri; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (memcmp(cd->content, "one", cd->content_len) != 0 || cd->flags != DETECT_CONTENT_WITHIN) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest16(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest17(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; " "content:\"two\"; distance:0; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_DISTANCE || memcmp(ud2->content, "two", ud1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpUriTest18(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(uricontent:\"one\"; " "content:\"two\"; within:5; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *ud1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; DetectContentData *ud2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud1->flags != DETECT_CONTENT_RELATIVE_NEXT || memcmp(ud1->content, "one", ud1->content_len) != 0 || ud2->flags != DETECT_CONTENT_WITHIN || memcmp(ud2->content, "two", ud1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief Register the UNITTESTS for the http_uri keyword */ void DetectHttpUriRegisterTests (void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectHttpUriTest01", DetectHttpUriTest01); UtRegisterTest("DetectHttpUriTest02", DetectHttpUriTest02); UtRegisterTest("DetectHttpUriTest03", DetectHttpUriTest03); UtRegisterTest("DetectHttpUriTest04", DetectHttpUriTest04); UtRegisterTest("DetectHttpUriTest05", DetectHttpUriTest05); UtRegisterTest("DetectHttpUriTest12", DetectHttpUriTest12); UtRegisterTest("DetectHttpUriTest13", DetectHttpUriTest13); UtRegisterTest("DetectHttpUriTest14", DetectHttpUriTest14); UtRegisterTest("DetectHttpUriTest15", DetectHttpUriTest15); UtRegisterTest("DetectHttpUriTest16", DetectHttpUriTest16); UtRegisterTest("DetectHttpUriTest17", DetectHttpUriTest17); UtRegisterTest("DetectHttpUriTest18", DetectHttpUriTest18); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-threshold.h0000644000000000000000000000554613051004444014426 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva */ #ifndef __DETECT_THRESHOLD_H__ #define __DETECT_THRESHOLD_H__ #include "decode-events.h" #include "decode-ipv4.h" #include "decode-tcp.h" #define TYPE_LIMIT 1 #define TYPE_BOTH 2 #define TYPE_THRESHOLD 3 #define TYPE_DETECTION 4 #define TYPE_RATE 5 #define TYPE_SUPPRESS 6 #define TRACK_DST 1 #define TRACK_SRC 2 #define TRACK_RULE 3 #define TRACK_EITHER 4 /**< either src or dst: only used by suppress */ /* Get the new action to take */ #define TH_ACTION_ALERT 0x01 #define TH_ACTION_DROP 0x02 #define TH_ACTION_PASS 0x04 #define TH_ACTION_LOG 0x08 #define TH_ACTION_SDROP 0x10 #define TH_ACTION_REJECT 0x20 /** * \typedef DetectThresholdData * A typedef for DetectThresholdData_ */ typedef struct DetectThresholdData_ { uint32_t count; /**< Event count */ uint32_t seconds; /**< Event seconds */ uint8_t type; /**< Threshold type : limit , threshold, both, detection_filter */ uint8_t track; /**< Track type: by_src, by_dst */ uint8_t new_action; /**< new_action alert|drop|pass|log|sdrop|reject */ uint32_t timeout; /**< timeout */ uint32_t flags; /**< flags used to set option */ DetectAddressHead addrs; } DetectThresholdData; typedef struct DetectThresholdEntry_ { uint32_t sid; /**< Signature id */ uint32_t gid; /**< Signature group id */ uint32_t tv_timeout; /**< Timeout for new_action (for rate_filter) its not "seconds", that define the time interval */ uint32_t seconds; /**< Event seconds */ uint32_t tv_sec1; /**< Var for time control */ uint32_t tv_usec1; /**< Var for time control */ uint32_t current_count; /**< Var for count control */ int track; /**< Track type: by_src, by_src */ struct DetectThresholdEntry_ *next; } DetectThresholdEntry; /** * Registration function for threshold: keyword */ void DetectThresholdRegister(void); /** * This function registers unit tests for Threshold */ void ThresholdRegisterTests(void); #endif /*__DETECT_THRESHOLD_H__ */ suricata-3.2.1/src/app-layer-tls-handshake.c0000644000000000000000000001763513051004444015577 00000000000000/* * Copyright (C) 2011-2012 ANSSI * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * \author Pierre Chifflier * * \brief Decode TLS Handshake messages, as described in RFC2246 * */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "app-layer-parser.h" #include "app-layer-ssl.h" #include "app-layer-tls-handshake.h" #include "decode-events.h" #include "util-decode-der.h" #include "util-decode-der-get.h" #include "util-crypt.h" #define SSLV3_RECORD_LEN 5 static void TLSCertificateErrCodeToWarning(SSLState *ssl_state, uint32_t errcode) { if (errcode == 0) return; switch (errcode) { case ERR_DER_ELEMENT_SIZE_TOO_BIG: case ERR_DER_INVALID_SIZE: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_CERTIFICATE_INVALID_LENGTH); break; case ERR_DER_UNSUPPORTED_STRING: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_CERTIFICATE_INVALID_STRING); break; case ERR_DER_UNKNOWN_ELEMENT: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_CERTIFICATE_UNKNOWN_ELEMENT); break; case ERR_DER_MISSING_ELEMENT: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_CERTIFICATE_MISSING_ELEMENT); break; case ERR_DER_GENERIC: default: SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_CERTIFICATE); break; }; } int DecodeTLSHandshakeServerCertificate(SSLState *ssl_state, uint8_t *input, uint32_t input_len) { uint32_t certificates_length, cur_cert_length; int i; Asn1Generic *cert; char buffer[256]; time_t not_before, not_after; int rc; int parsed; uint8_t *start_data; uint32_t errcode = 0; if (input_len < 3) return 1; certificates_length = input[0]<<16 | input[1]<<8 | input[2]; /* check if the message is complete */ if (input_len < certificates_length + 3) return 0; start_data = input; input += 3; parsed = 3; i = 0; while (certificates_length > 0) { if ((uint32_t)(input + 3 - start_data) > (uint32_t)input_len) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_CERTIFICATE); return -1; } cur_cert_length = input[0]<<16 | input[1]<<8 | input[2]; input += 3; parsed += 3; /* current certificate length should be greater than zero */ if (cur_cert_length == 0) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_CERTIFICATE); return -1; } if (input - start_data + cur_cert_length > input_len) { SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_CERTIFICATE); return -1; } cert = DecodeDer(input, cur_cert_length, &errcode); if (cert == NULL) { TLSCertificateErrCodeToWarning(ssl_state, errcode); } if (cert != NULL) { rc = Asn1DerGetSubjectDN(cert, buffer, sizeof(buffer), &errcode); if (rc != 0) { TLSCertificateErrCodeToWarning(ssl_state, errcode); } else { SSLCertsChain *ncert; //SCLogInfo("TLS Cert %d: %s\n", i, buffer); if (i == 0) { if (ssl_state->server_connp.cert0_subject == NULL) ssl_state->server_connp.cert0_subject = SCStrdup(buffer); if (ssl_state->server_connp.cert0_subject == NULL) { DerFree(cert); return -1; } } ncert = (SSLCertsChain *)SCMalloc(sizeof(SSLCertsChain)); if (ncert == NULL) { DerFree(cert); return -1; } memset(ncert, 0, sizeof(*ncert)); ncert->cert_data = input; ncert->cert_len = cur_cert_length; TAILQ_INSERT_TAIL(&ssl_state->server_connp.certs, ncert, next); } rc = Asn1DerGetIssuerDN(cert, buffer, sizeof(buffer), &errcode); if (rc != 0) { TLSCertificateErrCodeToWarning(ssl_state, errcode); } else { //SCLogInfo("TLS IssuerDN %d: %s\n", i, buffer); if (i == 0) { if (ssl_state->server_connp.cert0_issuerdn == NULL) ssl_state->server_connp.cert0_issuerdn = SCStrdup(buffer); if (ssl_state->server_connp.cert0_issuerdn == NULL) { DerFree(cert); return -1; } } } rc = Asn1DerGetValidity(cert, ¬_before, ¬_after, &errcode); if (rc != 0) { TLSCertificateErrCodeToWarning(ssl_state, errcode); } else { if (i == 0) { ssl_state->server_connp.cert0_not_before = not_before; ssl_state->server_connp.cert0_not_after = not_after; } } DerFree(cert); if (i == 0 && ssl_state->server_connp.cert0_fingerprint == NULL) { int msg_len = cur_cert_length; unsigned char *hash; hash = ComputeSHA1((unsigned char *) input, (int) msg_len); if (hash == NULL) { // TODO maybe an event here? } else { int hash_len = 20; int out_len = hash_len * 3 + 1; char out[out_len]; memset(out, 0x00, out_len); int j = 0; for (j = 0; j < hash_len; j++) { char one[4]; snprintf(one, sizeof(one), j == hash_len - 1 ? "%02x" : "%02x:", hash[j]); strlcat(out, one, out_len); } SCFree(hash); ssl_state->server_connp.cert0_fingerprint = SCStrdup(out); if (ssl_state->server_connp.cert0_fingerprint == NULL) { // TODO do we need an event here? } } ssl_state->server_connp.cert_input = input; ssl_state->server_connp.cert_input_len = cur_cert_length; } } i++; certificates_length -= (cur_cert_length + 3); parsed += cur_cert_length; input += cur_cert_length; } return parsed; } suricata-3.2.1/src/util-profiling-rules.c0000644000000000000000000005100413051004444015241 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Victor Julien * * An API for rule profiling operations. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "conf.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-byte.h" #include "util-profiling.h" #include "util-profiling-locks.h" #ifdef PROFILING /** * Extra data for rule profiling. */ typedef struct SCProfileData_ { uint32_t sid; uint32_t gid; uint32_t rev; uint64_t checks; uint64_t matches; uint64_t max; uint64_t ticks_match; uint64_t ticks_no_match; } SCProfileData; typedef struct SCProfileDetectCtx_ { uint32_t size; uint32_t id; SCProfileData *data; pthread_mutex_t data_m; } SCProfileDetectCtx; /** * Used for generating the summary data to print. */ typedef struct SCProfileSummary_ { uint32_t sid; uint32_t gid; uint32_t rev; uint64_t ticks; double avgticks; double avgticks_match; double avgticks_no_match; uint64_t checks; uint64_t matches; uint64_t max; uint64_t ticks_match; uint64_t ticks_no_match; } SCProfileSummary; extern int profiling_output_to_file; int profiling_rules_enabled = 0; static char profiling_file_name[PATH_MAX] = ""; static const char *profiling_file_mode = "a"; #ifdef HAVE_LIBJANSSON static int profiling_rule_json = 0; #endif /** * Sort orders for dumping profiled rules. */ enum { SC_PROFILING_RULES_SORT_BY_TICKS = 0, SC_PROFILING_RULES_SORT_BY_AVG_TICKS, SC_PROFILING_RULES_SORT_BY_CHECKS, SC_PROFILING_RULES_SORT_BY_MATCHES, SC_PROFILING_RULES_SORT_BY_MAX_TICKS, SC_PROFILING_RULES_SORT_BY_AVG_TICKS_MATCH, SC_PROFILING_RULES_SORT_BY_AVG_TICKS_NO_MATCH, }; static int profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_TICKS; /** * Maximum number of rules to dump. */ static uint32_t profiling_rules_limit = UINT32_MAX; void SCProfilingRulesGlobalInit(void) { ConfNode *conf; const char *val; conf = ConfGetNode("profiling.rules"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { profiling_rules_enabled = 1; val = ConfNodeLookupChildValue(conf, "sort"); if (val != NULL) { if (strcmp(val, "ticks") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_TICKS; } else if (strcmp(val, "avgticks") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_AVG_TICKS; } else if (strcmp(val, "avgticks_match") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_AVG_TICKS_MATCH; } else if (strcmp(val, "avgticks_no_match") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_AVG_TICKS_NO_MATCH; } else if (strcmp(val, "checks") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_CHECKS; } else if (strcmp(val, "matches") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_MATCHES; } else if (strcmp(val, "maxticks") == 0) { profiling_rules_sort_order = SC_PROFILING_RULES_SORT_BY_MAX_TICKS; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid profiling sort order: %s", val); exit(EXIT_FAILURE); } } val = ConfNodeLookupChildValue(conf, "limit"); if (val != NULL) { if (ByteExtractStringUint32(&profiling_rules_limit, 10, (uint16_t)strlen(val), val) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid limit: %s", val); exit(EXIT_FAILURE); } } const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(profiling_file_name, sizeof(profiling_file_name), "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_file_mode = "a"; } else { profiling_file_mode = "w"; } profiling_output_to_file = 1; } if (ConfNodeChildValueIsTrue(conf, "json")) { #ifdef HAVE_LIBJANSSON profiling_rule_json = 1; #else SCLogWarning(SC_ERR_NO_JSON_SUPPORT, "no json support compiled in, using plain output"); #endif } } } } /** * \brief Qsort comparison function to sort by ticks. */ static int SCProfileSummarySortByTicks(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->ticks == s0->ticks) return 0; else return s0->ticks > s1->ticks ? -1 : 1; } /** * \brief Qsort comparison function to sort by average ticks per match. */ static int SCProfileSummarySortByAvgTicksMatch(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->avgticks_match == s0->avgticks_match) return 0; else return s0->avgticks_match > s1->avgticks_match ? -1 : 1; } /** * \brief Qsort comparison function to sort by average ticks per non match. */ static int SCProfileSummarySortByAvgTicksNoMatch(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->avgticks_no_match == s0->avgticks_no_match) return 0; else return s0->avgticks_no_match > s1->avgticks_no_match ? -1 : 1; } /** * \brief Qsort comparison function to sort by average ticks. */ static int SCProfileSummarySortByAvgTicks(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->avgticks == s0->avgticks) return 0; else return s0->avgticks > s1->avgticks ? -1 : 1; } /** * \brief Qsort comparison function to sort by checks. */ static int SCProfileSummarySortByChecks(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->checks == s0->checks) return 0; else return s0->checks > s1->checks ? -1 : 1; } /** * \brief Qsort comparison function to sort by matches. */ static int SCProfileSummarySortByMatches(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->matches == s0->matches) return 0; else return s0->matches > s1->matches ? -1 : 1; } /** * \brief Qsort comparison function to sort by max ticks. */ static int SCProfileSummarySortByMaxTicks(const void *a, const void *b) { const SCProfileSummary *s0 = a; const SCProfileSummary *s1 = b; if (s1->max == s0->max) return 0; else return s0->max > s1->max ? -1 : 1; } #ifdef HAVE_LIBJANSSON static void DumpJson(FILE *fp, SCProfileSummary *summary, uint32_t count, uint64_t total_ticks) { char timebuf[64]; uint32_t i; struct timeval tval; json_t *js = json_object(); if (js == NULL) return; json_t *jsa = json_array(); if (jsa == NULL) { json_decref(js); return; } gettimeofday(&tval, NULL); CreateIsoTimeString(&tval, timebuf, sizeof(timebuf)); json_object_set_new(js, "timestamp", json_string(timebuf)); for (i = 0; i < count; i++) { /* Stop dumping when we hit our first rule with 0 checks. Due * to sorting this will be the beginning of all the rules with * 0 checks. */ if (summary[i].checks == 0) break; json_t *jsm = json_object(); if (jsm) { json_object_set_new(jsm, "signature_id", json_integer(summary[i].sid)); json_object_set_new(jsm, "gid", json_integer(summary[i].gid)); json_object_set_new(jsm, "rev", json_integer(summary[i].rev)); json_object_set_new(jsm, "checks", json_integer(summary[i].checks)); json_object_set_new(jsm, "matches", json_integer(summary[i].matches)); json_object_set_new(jsm, "ticks_total", json_integer(summary[i].ticks)); json_object_set_new(jsm, "ticks_max", json_integer(summary[i].max)); json_object_set_new(jsm, "ticks_avg", json_integer(summary[i].avgticks)); json_object_set_new(jsm, "ticks_avg_match", json_integer(summary[i].avgticks_match)); json_object_set_new(jsm, "ticks_avg_nomatch", json_integer(summary[i].avgticks_no_match)); double percent = (long double)summary[i].ticks / (long double)total_ticks * 100; json_object_set_new(jsm, "percent", json_integer(percent)); json_array_append_new(jsa, jsm); } } json_object_set_new(js, "rules", jsa); char *js_s = json_dumps(js, JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII| JSON_ESCAPE_SLASH); if (unlikely(js_s == NULL)) return; fprintf(fp, "%s", js_s); free(js_s); json_decref(js); } #endif /* HAVE_LIBJANSSON */ static void DumpText(FILE *fp, SCProfileSummary *summary, uint32_t count, uint64_t total_ticks) { uint32_t i; struct timeval tval; struct tm *tms; gettimeofday(&tval, NULL); struct tm local_tm; tms = SCLocalTime(tval.tv_sec, &local_tm); fprintf(fp, " ----------------------------------------------" "----------------------------\n"); fprintf(fp, " Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d\n", tms->tm_mon + 1, tms->tm_mday, tms->tm_year + 1900, tms->tm_hour,tms->tm_min, tms->tm_sec); fprintf(fp, " ----------------------------------------------" "----------------------------\n"); fprintf(fp, " %-8s %-12s %-8s %-8s %-12s %-6s %-8s %-8s %-11s %-11s %-11s %-11s\n", "Num", "Rule", "Gid", "Rev", "Ticks", "%", "Checks", "Matches", "Max Ticks", "Avg Ticks", "Avg Match", "Avg No Match"); fprintf(fp, " -------- " "------------ " "-------- " "-------- " "------------ " "------ " "-------- " "-------- " "----------- " "----------- " "----------- " "-------------- " "\n"); for (i = 0; i < MIN(count, profiling_rules_limit); i++) { /* Stop dumping when we hit our first rule with 0 checks. Due * to sorting this will be the beginning of all the rules with * 0 checks. */ if (summary[i].checks == 0) break; double percent = (long double)summary[i].ticks / (long double)total_ticks * 100; fprintf(fp, " %-8"PRIu32" %-12u %-8"PRIu32" %-8"PRIu32" %-12"PRIu64" %-6.2f %-8"PRIu64" %-8"PRIu64" %-11"PRIu64" %-11.2f %-11.2f %-11.2f\n", i + 1, summary[i].sid, summary[i].gid, summary[i].rev, summary[i].ticks, percent, summary[i].checks, summary[i].matches, summary[i].max, summary[i].avgticks, summary[i].avgticks_match, summary[i].avgticks_no_match); } fprintf(fp,"\n"); } /** * \brief Dump rule profiling information to file * * \param de_ctx The active DetectEngineCtx, used to get at the loaded rules. */ void SCProfilingRuleDump(SCProfileDetectCtx *rules_ctx) { uint32_t i; FILE *fp; if (rules_ctx == NULL) return; if (profiling_output_to_file == 1) { fp = fopen(profiling_file_name, profiling_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_file_name, strerror(errno)); return; } } else { fp = stdout; } int summary_size = sizeof(SCProfileSummary) * rules_ctx->size; SCProfileSummary *summary = SCMalloc(summary_size); if (unlikely(summary == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for profiling summary"); return; } uint32_t count = rules_ctx->size; uint64_t total_ticks = 0; SCLogPerf("Dumping profiling data for %u rules.", count); memset(summary, 0, summary_size); for (i = 0; i < count; i++) { summary[i].sid = rules_ctx->data[i].sid; summary[i].rev = rules_ctx->data[i].rev; summary[i].gid = rules_ctx->data[i].gid; summary[i].ticks = rules_ctx->data[i].ticks_match + rules_ctx->data[i].ticks_no_match; summary[i].checks = rules_ctx->data[i].checks; if (summary[i].ticks > 0) { summary[i].avgticks = (long double)summary[i].ticks / (long double)summary[i].checks; } summary[i].matches = rules_ctx->data[i].matches; summary[i].max = rules_ctx->data[i].max; summary[i].ticks_match = rules_ctx->data[i].ticks_match; summary[i].ticks_no_match = rules_ctx->data[i].ticks_no_match; if (summary[i].ticks_match > 0) { summary[i].avgticks_match = (long double)summary[i].ticks_match / (long double)summary[i].matches; } if (summary[i].ticks_no_match > 0) { summary[i].avgticks_no_match = (long double)summary[i].ticks_no_match / ((long double)summary[i].checks - (long double)summary[i].matches); } total_ticks += summary[i].ticks; } switch (profiling_rules_sort_order) { case SC_PROFILING_RULES_SORT_BY_TICKS: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByTicks); break; case SC_PROFILING_RULES_SORT_BY_AVG_TICKS: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByAvgTicks); break; case SC_PROFILING_RULES_SORT_BY_CHECKS: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByChecks); break; case SC_PROFILING_RULES_SORT_BY_MATCHES: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByMatches); break; case SC_PROFILING_RULES_SORT_BY_MAX_TICKS: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByMaxTicks); break; case SC_PROFILING_RULES_SORT_BY_AVG_TICKS_MATCH: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByAvgTicksMatch); break; case SC_PROFILING_RULES_SORT_BY_AVG_TICKS_NO_MATCH: qsort(summary, count, sizeof(SCProfileSummary), SCProfileSummarySortByAvgTicksNoMatch); break; } #ifdef HAVE_LIBJANSSON if (profiling_rule_json) { DumpJson(fp, summary, count, total_ticks); } else #endif { DumpText(fp, summary, count, total_ticks); } if (fp != stdout) fclose(fp); SCFree(summary); SCLogPerf("Done dumping profiling data."); } /** * \brief Register a rule profiling counter. * * \retval Returns the ID of the counter on success, 0 on failure. */ static uint16_t SCProfilingRegisterRuleCounter(SCProfileDetectCtx *ctx) { ctx->size++; return ctx->id++; } /** * \brief Update a rule counter. * * \param id The ID of this counter. * \param ticks Number of CPU ticks for this rule. * \param match Did the rule match? */ void SCProfilingRuleUpdateCounter(DetectEngineThreadCtx *det_ctx, uint16_t id, uint64_t ticks, int match) { if (det_ctx != NULL && det_ctx->rule_perf_data != NULL && det_ctx->rule_perf_data_size > id) { SCProfileData *p = &det_ctx->rule_perf_data[id]; p->checks++; p->matches += match; if (ticks > p->max) p->max = ticks; if (match == 1) p->ticks_match += ticks; else p->ticks_no_match += ticks; } } SCProfileDetectCtx *SCProfilingRuleInitCtx(void) { SCProfileDetectCtx *ctx = SCMalloc(sizeof(SCProfileDetectCtx)); if (ctx != NULL) { memset(ctx, 0x00, sizeof(SCProfileDetectCtx)); if (pthread_mutex_init(&ctx->data_m, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Failed to initialize hash table mutex."); exit(EXIT_FAILURE); } } return ctx; } void SCProfilingRuleDestroyCtx(SCProfileDetectCtx *ctx) { if (ctx != NULL) { SCProfilingRuleDump(ctx); if (ctx->data != NULL) SCFree(ctx->data); pthread_mutex_destroy(&ctx->data_m); SCFree(ctx); } } void SCProfilingRuleThreadSetup(SCProfileDetectCtx *ctx, DetectEngineThreadCtx *det_ctx) { if (ctx == NULL|| ctx->size == 0) return; SCProfileData *a = SCMalloc(sizeof(SCProfileData) * ctx->size); if (a != NULL) { memset(a, 0x00, sizeof(SCProfileData) * ctx->size); det_ctx->rule_perf_data = a; det_ctx->rule_perf_data_size = ctx->size; } } static void SCProfilingRuleThreadMerge(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { if (de_ctx == NULL || de_ctx->profile_ctx == NULL || de_ctx->profile_ctx->data == NULL || det_ctx == NULL || det_ctx->rule_perf_data == NULL) return; int i; for (i = 0; i < det_ctx->rule_perf_data_size; i++) { de_ctx->profile_ctx->data[i].checks += det_ctx->rule_perf_data[i].checks; de_ctx->profile_ctx->data[i].matches += det_ctx->rule_perf_data[i].matches; de_ctx->profile_ctx->data[i].ticks_match += det_ctx->rule_perf_data[i].ticks_match; de_ctx->profile_ctx->data[i].ticks_no_match += det_ctx->rule_perf_data[i].ticks_no_match; if (det_ctx->rule_perf_data[i].max > de_ctx->profile_ctx->data[i].max) de_ctx->profile_ctx->data[i].max = det_ctx->rule_perf_data[i].max; } } void SCProfilingRuleThreadCleanup(DetectEngineThreadCtx *det_ctx) { if (det_ctx == NULL || det_ctx->de_ctx == NULL || det_ctx->rule_perf_data == NULL) return; pthread_mutex_lock(&det_ctx->de_ctx->profile_ctx->data_m); SCProfilingRuleThreadMerge(det_ctx->de_ctx, det_ctx); pthread_mutex_unlock(&det_ctx->de_ctx->profile_ctx->data_m); SCFree(det_ctx->rule_perf_data); det_ctx->rule_perf_data = NULL; det_ctx->rule_perf_data_size = 0; } /** * \brief Register the rule profiling counters. * * \param de_ctx The active DetectEngineCtx, used to get at the loaded rules. */ void SCProfilingRuleInitCounters(DetectEngineCtx *de_ctx) { if (profiling_rules_enabled == 0) return; de_ctx->profile_ctx = SCProfilingRuleInitCtx(); BUG_ON(de_ctx->profile_ctx == NULL); Signature *sig = de_ctx->sig_list; uint32_t count = 0; while (sig != NULL) { sig->profiling_id = SCProfilingRegisterRuleCounter(de_ctx->profile_ctx); sig = sig->next; count++; } if (count > 0) { de_ctx->profile_ctx->data = SCMalloc(sizeof(SCProfileData) * de_ctx->profile_ctx->size); BUG_ON(de_ctx->profile_ctx->data == NULL); memset(de_ctx->profile_ctx->data, 0x00, sizeof(SCProfileData) * de_ctx->profile_ctx->size); sig = de_ctx->sig_list; while (sig != NULL) { de_ctx->profile_ctx->data[sig->profiling_id].sid = sig->id; de_ctx->profile_ctx->data[sig->profiling_id].gid = sig->gid; de_ctx->profile_ctx->data[sig->profiling_id].rev = sig->rev; sig = sig->next; } } SCLogPerf("Registered %"PRIu32" rule profiling counters.", count); } #endif /* PROFILING */ suricata-3.2.1/src/util-fmemopen.c0000644000000000000000000001147413051004444013735 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * Based on FMem.c of Alexandre Flori (2008/10/17 AF) */ #include "suricata-common.h" #include "util-fmemopen.h" #ifdef OS_DARWIN #define USE_FMEM_WRAPPER 1 #endif #ifdef OS_FREEBSD #define USE_FMEM_WRAPPER 1 #endif #ifdef __OpenBSD__ #define USE_FMEM_WRAPPER 1 #endif #ifdef USE_FMEM_WRAPPER #ifdef OS_WIN32 /** * \brief portable version of SCFmemopen for Windows works on top of real temp files * \param buffer that holds the file content * \param size of the file buffer * \param mode mode of the file to open * \retval pointer to the file; NULL if something is wrong */ FILE *SCFmemopen(void *buf, size_t size, const char *mode) { char temppath[MAX_PATH - 13]; if (0 == GetTempPath(sizeof(temppath), temppath)) return NULL; char filename[MAX_PATH + 1]; if (0 == GetTempFileName(temppath, "SC", 0, filename)) return NULL; FILE *f = fopen(filename, "wb"); if (NULL == f) return NULL; fwrite(buf, size, 1, f); fclose(f); return fopen(filename, mode); } #else typedef struct SCFmem_ { size_t pos; size_t size; char *buffer; } SCFmem; /** * \brief Seek the mem file from offset and whence * \param handler pointer to the memfile * \param osffset number of bytes to move from whence * \param whence SEEK_SET, SEEK_CUR, SEEK_END * \retval pos the position by the last operation, -1 if sizes are out of bounds */ static fpos_t SeekFn(void *handler, fpos_t offset, int whence) { size_t pos = 0; SCFmem *mem = handler; switch (whence) { case SEEK_SET: if (offset >= 0 && (size_t)offset <= mem->size) { return mem->pos = offset; } break; case SEEK_CUR: if (mem->pos + offset <= mem->size) return mem->pos += offset; break; case SEEK_END: /* must be negative */ if (mem->size + offset <= mem->size) return pos = mem->size + offset; break; } return -1; } /** * \brief Read from the buffer looking for the available memory limits * \param handler pointer to the memfile * \param buf buffer to read from the handler * \param number of bytes to read * \retval count , the number of bytes read */ static int ReadFn(void *handler, char *buf, int size) { size_t count = 0; SCFmem *mem = handler; size_t available = mem->size - mem->pos; int is_eof = 0; if (size < 0) return - 1; if ((size_t)size > available) { size = available; } else { is_eof = 1; } while (count < (size_t)size) buf[count++] = mem->buffer[mem->pos++]; if (is_eof == 1) return 0; return count; } /** * \brief Write into the buffer looking for the available memory limits * \param handler pointer to the memfile * \param buf buffer to write in the handler * \param number of bytes to write * \retval count , the number of bytes writen */ static int WriteFn(void *handler, const char *buf, int size) { size_t count = 0; SCFmem *mem = handler; size_t available = mem->size - mem->pos; if (size < 0) return - 1; if ((size_t)size > available) size = available; while (count < (size_t)size) mem->buffer[mem->pos++] = buf[count++]; return count; } /** * \brief close the mem file handler * \param handler pointer to the memfile * \retval 0 on succesful */ static int CloseFn(void *handler) { SCFree(handler); return 0; } /** * \brief portable version of SCFmemopen for OS X / BSD built on top of funopen() * \param buffer that holds the file content * \param size of the file buffer * \param mode mode of the file to open * \retval pointer to the file; NULL if something is wrong */ FILE *SCFmemopen(void *buf, size_t size, const char *mode) { SCFmem *mem = (SCFmem *) SCMalloc(sizeof(SCFmem)); if (mem == NULL) return NULL; memset(mem, 0, sizeof(SCFmem)); mem->size = size, mem->buffer = buf; return funopen(mem, ReadFn, WriteFn, SeekFn, CloseFn); } #endif /* OS_WIN32 */ #endif /* USE_FMEM_WRAPPER */ suricata-3.2.1/src/source-nfq.h0000644000000000000000000000502713051004444013240 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __SOURCE_NFQ_H__ #define __SOURCE_NFQ_H__ #ifdef NFQ #include "threads.h" #ifdef OS_WIN32 #include #else #include /* for NF_ACCEPT */ #endif #include #define NFQ_MAX_QUEUE 16 /* idea: set the recv-thread id in the packet to * select an verdict-queue */ typedef struct NFQPacketVars_ { int id; /* this nfq packets id */ uint16_t nfq_index; /* index in NFQ array */ uint8_t verdicted; uint32_t mark; uint32_t ifi; uint32_t ifo; uint16_t hw_protocol; } NFQPacketVars; typedef struct NFQQueueVars_ { struct nfq_handle *h; #ifndef OS_WIN32 struct nfnl_handle *nh; int fd; #else HANDLE fd; OVERLAPPED ovr; #endif uint8_t use_mutex; /* 2 threads deal with the queue handle, so add a mutex */ struct nfq_q_handle *qh; SCMutex mutex_qh; /* this one should be not changing after init */ uint16_t queue_num; /* position into the NFQ queue var array */ uint16_t nfq_index; #ifdef DBG_PERF int dbg_maxreadsize; #endif /* DBG_PERF */ /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; uint32_t accepted; uint32_t dropped; uint32_t replaced; struct { uint32_t packet_id; /* id of last processed packet */ uint32_t verdict; uint32_t mark; uint8_t mark_valid:1; uint8_t len; uint8_t maxlen; } verdict_cache; } NFQQueueVars; typedef struct NFQGlobalVars_ { char unbind; } NFQGlobalVars; void NFQInitConfig(char quiet); int NFQRegisterQueue(char *queue); int NFQGetQueueCount(void); void *NFQGetQueue(int number); int NFQGetQueueNum(int number); void *NFQGetThread(int number); #endif /* NFQ */ #endif /* __SOURCE_NFQ_H__ */ suricata-3.2.1/src/util-lua-dnp3-objects.h0000644000000000000000000000161613051004444015203 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __UTIL_LUA_DNP3_OBJECTS_H__ #define __UTIL_LUA_DNP3_OBJECTS_H__ void DNP3PushPoint(lua_State *luastate, DNP3Object *object, DNP3Point *item); #endif /* ! __UTIL_LUA_DNP3_OBJECTS_H__ */ suricata-3.2.1/src/util-validate.h0000644000000000000000000000765713051004444013735 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Functions & Macro's for validation of data structures. This is used for * code correctness. * * These will abort() the program if they fail, so they should _only_ be * used for testing. */ #ifndef __UTIL_VALIDATE_H__ #define __UTIL_VALIDATE_H__ #ifdef DEBUG_VALIDATION /** \brief test if a flow is locked. * * If trylock returns 0 it got a lock. Which means * the flow was previously unlocked. */ #define DEBUG_ASSERT_FLOW_LOCKED(f) do { \ if ((f) != NULL) { \ int r = SCMutexTrylock(&(f)->m); \ if (r == 0) { \ BUG_ON(1); \ } \ } \ } while(0) /** \brief validate the integrity of the flow * * BUG_ON's on problems */ #define DEBUG_VALIDATE_FLOW(f) do { \ if ((f) != NULL) { \ BUG_ON((f)->flags & FLOW_IPV4 && \ (f)->flags & FLOW_IPV6); \ if ((f)->proto == IPPROTO_TCP) { \ BUG_ON((f)->alstate != NULL && \ (f)->alparser == NULL); \ } \ } \ } while(0) /** \brief validate the integrity of the packet * * BUG_ON's on problems */ #define DEBUG_VALIDATE_PACKET(p) do { \ if ((p) != NULL) { \ if ((p)->flow != NULL) { \ DEBUG_VALIDATE_FLOW((p)->flow); \ } \ if (!((p)->flags & (PKT_IS_FRAGMENT|PKT_IS_INVALID))) { \ if ((p)->proto == IPPROTO_TCP) { \ BUG_ON((p)->tcph == NULL); \ } else if ((p)->proto == IPPROTO_UDP) { \ BUG_ON((p)->udph == NULL); \ } else if ((p)->proto == IPPROTO_ICMP) { \ BUG_ON((p)->icmpv4h == NULL); \ } else if ((p)->proto == IPPROTO_SCTP) { \ BUG_ON((p)->sctph == NULL); \ } else if ((p)->proto == IPPROTO_ICMPV6) { \ BUG_ON((p)->icmpv6h == NULL); \ } \ } \ if ((p)->payload_len > 0) { \ BUG_ON((p)->payload == NULL); \ } \ BUG_ON((p)->ip4h != NULL && (p)->ip6h != NULL); \ BUG_ON((p)->flowflags != 0 && (p)->flow == NULL); \ BUG_ON((p)->flowflags & FLOW_PKT_TOSERVER &&\ (p)->flowflags & FLOW_PKT_TOCLIENT); \ } \ } while(0) #define DEBUG_VALIDATE_BUG_ON(exp) BUG_ON((exp)) #else /* DEBUG_VALIDATE */ #define DEBUG_ASSERT_FLOW_LOCKED(f) #define DEBUG_VALIDATE_FLOW(f) #define DEBUG_VALIDATE_PACKET(p) #define DEBUG_VALIDATE_BUG_ON(exp) #endif /* DEBUG_VALIDATE */ #endif /* __UTIL_VALIDATE_H__ */ suricata-3.2.1/src/flow-var.h0000644000000000000000000000416113051004444012711 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon */ #ifndef __FLOW_VAR_H__ #define __FLOW_VAR_H__ #include "flow.h" #include "util-var.h" /** Available data types for Flowvars */ #define FLOWVAR_TYPE_STR 1 #define FLOWVAR_TYPE_INT 2 /** Struct used to hold the string data type for flowvars */ typedef struct FlowVarTypeStr { uint8_t *value; uint16_t value_len; } FlowVarTypeStr; /** Struct used to hold the integer data type for flowvars */ typedef struct FlowVarTypeInt_ { uint32_t value; } FlowVarTypeInt; /** Generic Flowvar Structure */ typedef struct FlowVar_ { uint8_t type; /* type, DETECT_FLOWVAR in this case */ uint16_t idx; /* name idx */ GenericVar *next; /* right now just implement this as a list, * in the long run we have think of something * faster. */ uint8_t datatype; union { FlowVarTypeStr fv_str; FlowVarTypeInt fv_int; } data; } FlowVar; /** Flowvar Interface API */ void FlowVarAddStrNoLock(Flow *, uint16_t, uint8_t *, uint16_t); void FlowVarAddStr(Flow *, uint16_t, uint8_t *, uint16_t); void FlowVarAddIntNoLock(Flow *, uint16_t, uint32_t); void FlowVarAddInt(Flow *, uint16_t, uint32_t); FlowVar *FlowVarGet(Flow *, uint16_t); void FlowVarFree(FlowVar *); void FlowVarPrint(GenericVar *); #endif /* __FLOW_VAR_H__ */ suricata-3.2.1/src/log-tcp-data.c0000644000000000000000000002535713051004444013435 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "log-tcp-data.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "tcp-data.log" #define MODULE_NAME "LogTcpDataLog" #define OUTPUT_BUFFER_SIZE 65535 TmEcode LogTcpDataLogThreadInit(ThreadVars *, void *, void **); TmEcode LogTcpDataLogThreadDeinit(ThreadVars *, void *); void LogTcpDataLogExitPrintStats(ThreadVars *, void *); static void LogTcpDataLogDeInitCtx(OutputCtx *); int LogTcpDataLogger(ThreadVars *tv, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags); void LogTcpDataLogRegister (void) { OutputRegisterStreamingModule(LOGGER_TCP_DATA, MODULE_NAME, "tcp-data", LogTcpDataLogInitCtx, LogTcpDataLogger, STREAMING_TCP_DATA, LogTcpDataLogThreadInit, LogTcpDataLogThreadDeinit, LogTcpDataLogExitPrintStats); OutputRegisterStreamingModule(LOGGER_TCP_DATA, MODULE_NAME, "http-body-data", LogTcpDataLogInitCtx, LogTcpDataLogger, STREAMING_HTTP_BODIES, LogTcpDataLogThreadInit, LogTcpDataLogThreadDeinit, LogTcpDataLogExitPrintStats); } typedef struct LogTcpDataFileCtx_ { LogFileCtx *file_ctx; enum OutputStreamingType type; const char *log_dir; int file; int dir; } LogTcpDataFileCtx; typedef struct LogTcpDataLogThread_ { LogTcpDataFileCtx *tcpdatalog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ MemBuffer *buffer; } LogTcpDataLogThread; static int LogTcpDataLoggerDir(ThreadVars *tv, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags) { SCEnter(); LogTcpDataLogThread *aft = thread_data; LogTcpDataFileCtx *td = aft->tcpdatalog_ctx; char *mode = "a"; if (flags & OUTPUT_STREAMING_FLAG_OPEN) mode = "w"; if (data && data_len) { char srcip[46] = "", dstip[46] = ""; if (FLOW_IS_IPV4(f)) { PrintInet(AF_INET, (const void *)&f->src.addr_data32[0], srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&f->dst.addr_data32[0], dstip, sizeof(dstip)); } else if (FLOW_IS_IPV6(f)) { PrintInet(AF_INET6, (const void *)f->src.addr_data32, srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)f->dst.addr_data32, dstip, sizeof(dstip)); } char name[PATH_MAX]; char tx[64] = { 0 }; if (flags & OUTPUT_STREAMING_FLAG_TRANSACTION) { snprintf(tx, sizeof(tx), "%"PRIu64, tx_id); } snprintf(name, sizeof(name), "%s/%s/%s_%u-%s_%u-%s-%s.data", td->log_dir, td->type == STREAMING_HTTP_BODIES ? "http" : "tcp", srcip, f->sp, dstip, f->dp, tx, flags & OUTPUT_STREAMING_FLAG_TOSERVER ? "ts" : "tc"); FILE *fp = fopen(name, mode); BUG_ON(fp == NULL); // PrintRawDataFp(stdout, (uint8_t *)data, data_len); fwrite(data, data_len, 1, fp); fclose(fp); } SCReturnInt(TM_ECODE_OK); } static int LogTcpDataLoggerFile(ThreadVars *tv, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags) { SCEnter(); LogTcpDataLogThread *aft = thread_data; LogTcpDataFileCtx *td = aft->tcpdatalog_ctx; if (data && data_len) { MemBufferReset(aft->buffer); char srcip[46] = "", dstip[46] = ""; if (FLOW_IS_IPV4(f)) { PrintInet(AF_INET, (const void *)&f->src.addr_data32[0], srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)&f->dst.addr_data32[0], dstip, sizeof(dstip)); } else if (FLOW_IS_IPV6(f)) { PrintInet(AF_INET6, (const void *)f->src.addr_data32, srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)f->dst.addr_data32, dstip, sizeof(dstip)); } char name[PATH_MAX]; snprintf(name, sizeof(name), "%s_%u-%s_%u-%s:", srcip, f->sp, dstip, f->dp, flags & OUTPUT_STREAMING_FLAG_TOSERVER ? "ts" : "tc"); PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)name,strlen(name)); MemBufferWriteString(aft->buffer, "\n"); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, (uint8_t *)data,data_len); SCMutexLock(&td->file_ctx->fp_mutex); td->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), td->file_ctx); SCMutexUnlock(&td->file_ctx->fp_mutex); } SCReturnInt(TM_ECODE_OK); } int LogTcpDataLogger(ThreadVars *tv, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags) { SCEnter(); LogTcpDataLogThread *aft = thread_data; LogTcpDataFileCtx *td = aft->tcpdatalog_ctx; if (td->dir == 1) LogTcpDataLoggerDir(tv, thread_data, f, data, data_len, tx_id, flags); if (td->file == 1) LogTcpDataLoggerFile(tv, thread_data, f, data, data_len, tx_id, flags); SCReturnInt(TM_ECODE_OK); } TmEcode LogTcpDataLogThreadInit(ThreadVars *t, void *initdata, void **data) { LogTcpDataLogThread *aft = SCMalloc(sizeof(LogTcpDataLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(LogTcpDataLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->tcpdatalog_ctx= ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } TmEcode LogTcpDataLogThreadDeinit(ThreadVars *t, void *data) { LogTcpDataLogThread *aft = (LogTcpDataLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(LogTcpDataLogThread)); SCFree(aft); return TM_ECODE_OK; } void LogTcpDataLogExitPrintStats(ThreadVars *tv, void *data) { LogTcpDataLogThread *aft = (LogTcpDataLogThread *)data; if (aft == NULL) { return; } } /** \brief Create a new http log LogFileCtx. * \param conf Pointer to ConfNode containing this loggers configuration. * \return NULL if failure, LogFileCtx* to the file_ctx if succesful * */ OutputCtx *LogTcpDataLogInitCtx(ConfNode *conf) { char filename[PATH_MAX] = ""; char dirname[32] = ""; strlcpy(filename, DEFAULT_LOG_FILENAME, sizeof(filename)); LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_TCPDATA_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } LogTcpDataFileCtx *tcpdatalog_ctx = SCMalloc(sizeof(LogTcpDataFileCtx)); if (unlikely(tcpdatalog_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } memset(tcpdatalog_ctx, 0x00, sizeof(LogTcpDataFileCtx)); tcpdatalog_ctx->file_ctx = file_ctx; if (conf) { if (conf->name) { if (strcmp(conf->name, "tcp-data") == 0) { tcpdatalog_ctx->type = STREAMING_TCP_DATA; snprintf(filename, sizeof(filename), "%s.log", conf->name); strlcpy(dirname, "tcp", sizeof(dirname)); } else if (strcmp(conf->name, "http-body-data") == 0) { tcpdatalog_ctx->type = STREAMING_HTTP_BODIES; snprintf(filename, sizeof(filename), "%s.log", conf->name); strlcpy(dirname, "http", sizeof(dirname)); } } const char *logtype = ConfNodeLookupChildValue(conf, "type"); if (logtype == NULL) logtype = "file"; if (strcmp(logtype, "file") == 0) { tcpdatalog_ctx->file = 1; } else if (strcmp(logtype, "dir") == 0) { tcpdatalog_ctx->dir = 1; } else if (strcmp(logtype, "both") == 0) { tcpdatalog_ctx->file = 1; tcpdatalog_ctx->dir = 1; } } else { tcpdatalog_ctx->file = 1; tcpdatalog_ctx->dir = 0; } if (tcpdatalog_ctx->file == 1) { SCLogInfo("opening logfile"); if (SCConfLogOpenGeneric(conf, file_ctx, filename, 1) < 0) { LogFileFreeCtx(file_ctx); SCFree(tcpdatalog_ctx); return NULL; } } if (tcpdatalog_ctx->dir == 1) { tcpdatalog_ctx->log_dir = ConfigGetLogDirectory(); char dirfull[PATH_MAX]; /* create the filename to use */ snprintf(dirfull, PATH_MAX, "%s/%s", tcpdatalog_ctx->log_dir, dirname); SCLogInfo("using directory %s", dirfull); /* if mkdir fails file open will fail, so deal with errors there */ #ifndef OS_WIN32 (void)mkdir(dirfull, 0700); #else (void)mkdir(dirfull); #endif } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { goto parsererror; } output_ctx->data = tcpdatalog_ctx; output_ctx->DeInit = LogTcpDataLogDeInitCtx; SCLogDebug("Streaming log output initialized"); return output_ctx; parsererror: LogFileFreeCtx(file_ctx); SCFree(tcpdatalog_ctx); SCLogError(SC_ERR_INVALID_ARGUMENT,"Syntax error in custom http log format string."); return NULL; } static void LogTcpDataLogDeInitCtx(OutputCtx *output_ctx) { LogTcpDataFileCtx *tcpdatalog_ctx = (LogTcpDataFileCtx *)output_ctx->data; LogFileFreeCtx(tcpdatalog_ctx->file_ctx); SCFree(tcpdatalog_ctx); SCFree(output_ctx); } suricata-3.2.1/src/runmode-nfq.h0000644000000000000000000000176213051004444013413 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_NFQ_H__ #define __RUNMODE_NFQ_H__ int RunModeIpsNFQAutoFp(void); int RunModeIpsNFQWorker(void); void RunModeIpsNFQRegister(void); const char *RunModeIpsNFQGetDefaultMode(void); #endif /* __RUNMODE_NFQ_H__ */ suricata-3.2.1/src/tm-queues.h0000644000000000000000000000226213051004444013101 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TM_QUEUES_H__ #define __TM_QUEUES_H__ typedef struct Tmq_ { char *name; uint16_t id; uint16_t reader_cnt; uint16_t writer_cnt; /* 0 for packet-queue and 1 for data-queue */ uint8_t q_type; } Tmq; Tmq* TmqCreateQueue(char *name); Tmq* TmqGetQueueByName(char *name); void TmqDebugList(void); void TmqResetQueues(void); void TmValidateQueueState(void); #endif /* __TM_QUEUES_H__ */ suricata-3.2.1/src/detect-engine-hsmd.c0000644000000000000000000017024513051004444014622 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-hsmd.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP Status Message Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpStatMsg(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_message == NULL) return; const uint32_t buffer_len = bstr_len(tx->response_message); const uint8_t *buffer = bstr_ptr(tx->response_message); if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpStatMsg, ALPROTO_HTTP, HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */ mpm_ctx, NULL, "http_stat_msg"); } /** * \brief Do the http_stat_msg content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpStatMsg(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_message == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HSMDMATCH], f, (uint8_t *)bstr_ptr(tx->response_message), bstr_len(tx->response_message), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS static int DetectEngineHttpStatMsgTest01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 message\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"message\"; http_stat_msg; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest02(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 xxxxABC\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "xxxxABC"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"ABC\"; http_stat_msg; offset:4; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } static int DetectEngineHttpStatMsgTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; int result = 0; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 1234567"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "8901234ABC\r\n" "Content-Type: text/html\r\n" "Content-Length: 17\r\n" "\r\n" "12345678901234ABC"; uint32_t http_len3 = sizeof(http_buf3) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"ABC\"; http_stat_msg; offset:14; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest04(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:!\"abc\"; http_stat_msg; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest05(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"abc\"; http_stat_msg; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest06(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:!\"def\"; http_stat_msg; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:!\"def\"; http_stat_msg; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:!\"abc\"; http_stat_msg; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"abc\"; http_stat_msg; depth:3; " "content:\"def\"; http_stat_msg; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"abc\"; http_stat_msg; depth:3; " "content:!\"xyz\"; http_stat_msg; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest11(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"abc\"; http_stat_msg; depth:3; " "content:\"xyz\"; http_stat_msg; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 did match but should not have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest12(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"ab\"; http_stat_msg; depth:2; " "content:\"ef\"; http_stat_msg; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest13(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "content:\"ab\"; http_stat_msg; depth:3; " "content:!\"yz\"; http_stat_msg; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest14(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "pcre:/ab/Y; " "content:\"ef\"; http_stat_msg; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatMsgTest15(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat msg test\"; " "pcre:/abc/Y; " "content:!\"xyz\"; http_stat_msg; distance:0; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpStatMsgRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpStatMsgTest01", DetectEngineHttpStatMsgTest01); UtRegisterTest("DetectEngineHttpStatMsgTest02", DetectEngineHttpStatMsgTest02); UtRegisterTest("DetectEngineHttpStatMsgTest03", DetectEngineHttpStatMsgTest03); UtRegisterTest("DetectEngineHttpStatMsgTest04", DetectEngineHttpStatMsgTest04); UtRegisterTest("DetectEngineHttpStatMsgTest05", DetectEngineHttpStatMsgTest05); UtRegisterTest("DetectEngineHttpStatMsgTest06", DetectEngineHttpStatMsgTest06); UtRegisterTest("DetectEngineHttpStatMsgTest07", DetectEngineHttpStatMsgTest07); UtRegisterTest("DetectEngineHttpStatMsgTest08", DetectEngineHttpStatMsgTest08); UtRegisterTest("DetectEngineHttpStatMsgTest09", DetectEngineHttpStatMsgTest09); UtRegisterTest("DetectEngineHttpStatMsgTest10", DetectEngineHttpStatMsgTest10); UtRegisterTest("DetectEngineHttpStatMsgTest11", DetectEngineHttpStatMsgTest11); UtRegisterTest("DetectEngineHttpStatMsgTest12", DetectEngineHttpStatMsgTest12); UtRegisterTest("DetectEngineHttpStatMsgTest13", DetectEngineHttpStatMsgTest13); UtRegisterTest("DetectEngineHttpStatMsgTest14", DetectEngineHttpStatMsgTest14); UtRegisterTest("DetectEngineHttpStatMsgTest15", DetectEngineHttpStatMsgTest15); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-rev.h0000644000000000000000000000162313051004444013216 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_REV_H__ #define __DETECT_REV_H__ /* prototypes */ void DetectRevRegister (void); #endif /* __DETECT_REV_H__ */ suricata-3.2.1/src/detect-nocase.h0000644000000000000000000000163713051004444013677 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_NOCASE_H__ #define __DETECT_NOCASE_H__ /* prototypes */ void DetectNocaseRegister (void); #endif /* __DETECT_NOCASE_H__ */ suricata-3.2.1/src/output-json-http.c0000644000000000000000000004270013051004444014434 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * * Implements HTTP JSON logging portion of the engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "pkt-var.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "util-unittest.h" #include "util-debug.h" #include "output.h" #include "app-layer-htp.h" #include "app-layer.h" #include "app-layer-parser.h" #include "util-privs.h" #include "util-buffer.h" #include "util-proto-name.h" #include "util-logopenfile.h" #include "util-time.h" #include "output-json.h" #ifdef HAVE_LIBJANSSON typedef struct LogHttpFileCtx_ { LogFileCtx *file_ctx; uint32_t flags; /** Store mode */ uint64_t fields;/** Store fields */ } LogHttpFileCtx; typedef struct JsonHttpLogThread_ { LogHttpFileCtx *httplog_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ uint32_t uri_cnt; MemBuffer *buffer; } JsonHttpLogThread; #define LOG_HTTP_DEFAULT 0 #define LOG_HTTP_EXTENDED 1 #define LOG_HTTP_REQUEST 2 /* request field */ #define LOG_HTTP_ARRAY 4 /* require array handling */ typedef enum { HTTP_FIELD_ACCEPT = 0, HTTP_FIELD_ACCEPT_CHARSET, HTTP_FIELD_ACCEPT_ENCODING, HTTP_FIELD_ACCEPT_LANGUAGE, HTTP_FIELD_ACCEPT_DATETIME, HTTP_FIELD_AUTHORIZATION, HTTP_FIELD_CACHE_CONTROL, HTTP_FIELD_CONNECTION, HTTP_FIELD_FROM, HTTP_FIELD_MAX_FORWARDS, HTTP_FIELD_ORIGIN, HTTP_FIELD_PRAGMA, HTTP_FIELD_PROXY_AUTHORIZATION, HTTP_FIELD_RANGE, HTTP_FIELD_TE, HTTP_FIELD_VIA, HTTP_FIELD_X_REQUESTED_WITH, HTTP_FIELD_DNT, HTTP_FIELD_X_FORWARDED_PROTO, HTTP_FIELD_X_AUTHENTICATED_USER, HTTP_FIELD_X_FLASH_VERSION, HTTP_FIELD_ACCEPT_RANGES, HTTP_FIELD_AGE, HTTP_FIELD_ALLOW, HTTP_FIELD_CONTENT_ENCODING, HTTP_FIELD_CONTENT_LANGUAGE, HTTP_FIELD_CONTENT_LENGTH, HTTP_FIELD_CONTENT_LOCATION, HTTP_FIELD_CONTENT_MD5, HTTP_FIELD_CONTENT_RANGE, HTTP_FIELD_CONTENT_TYPE, HTTP_FIELD_DATE, HTTP_FIELD_ETAG, HTTP_FIELD_EXPIRES, HTTP_FIELD_LAST_MODIFIED, HTTP_FIELD_LINK, HTTP_FIELD_LOCATION, HTTP_FIELD_PROXY_AUTHENTICATE, HTTP_FIELD_REFERRER, HTTP_FIELD_REFRESH, HTTP_FIELD_RETRY_AFTER, HTTP_FIELD_SERVER, HTTP_FIELD_SET_COOKIE, HTTP_FIELD_TRAILER, HTTP_FIELD_TRANSFER_ENCODING, HTTP_FIELD_UPGRADE, HTTP_FIELD_VARY, HTTP_FIELD_WARNING, HTTP_FIELD_WWW_AUTHENTICATE, HTTP_FIELD_SIZE } HttpField; struct { char *config_field; char *htp_field; uint32_t flags; } http_fields[] = { { "accept", "accept", LOG_HTTP_REQUEST }, { "accept_charset", "accept-charset", LOG_HTTP_REQUEST }, { "accept_encoding", "accept-encoding", LOG_HTTP_REQUEST }, { "accept_language", "accept-language", LOG_HTTP_REQUEST }, { "accept_datetime", "accept-datetime", LOG_HTTP_REQUEST }, { "authorization", "authorization", LOG_HTTP_REQUEST }, { "cache_control", "cache-control", LOG_HTTP_REQUEST }, { "cookie", "cookie", LOG_HTTP_REQUEST|LOG_HTTP_ARRAY }, { "from", "from", LOG_HTTP_REQUEST }, { "max_forwards", "max-forwards", LOG_HTTP_REQUEST }, { "origin", "origin", LOG_HTTP_REQUEST }, { "pragma", "pragma", LOG_HTTP_REQUEST }, { "proxy_authorization", "proxy-authorization", LOG_HTTP_REQUEST }, { "range", "range", LOG_HTTP_REQUEST }, { "te", "te", LOG_HTTP_REQUEST }, { "via", "via", LOG_HTTP_REQUEST }, { "x_requested_with", "x-requested-with", LOG_HTTP_REQUEST }, { "dnt", "dnt", LOG_HTTP_REQUEST }, { "x_forwarded_proto", "x-forwarded-proto", LOG_HTTP_REQUEST }, { "x_authenticated_user", "x-authenticated-user", LOG_HTTP_REQUEST }, { "x_flash_version", "x-flash-version", LOG_HTTP_REQUEST }, { "accept_range", "accept-range", 0 }, { "age", "age", 0 }, { "allow", "allow", 0 }, { "connection", "connection", 0 }, { "content_encoding", "content-encoding", 0 }, { "content_language", "content-language", 0 }, { "content_length", "content-length", 0 }, { "content_location", "content-location", 0 }, { "content_md5", "content-md5", 0 }, { "content_range", "content-range", 0 }, { "content_type", "content-type", 0 }, { "date", "date", 0 }, { "etag", "etags", 0 }, { "expires", "expires" , 0 }, { "last_modified", "last-modified", 0 }, { "link", "link", 0 }, { "location", "location", 0 }, { "proxy_authenticate", "proxy-authenticate", 0 }, { "referrer", "referrer", LOG_HTTP_EXTENDED }, { "refresh", "refresh", 0 }, { "retry_after", "retry-after", 0 }, { "server", "server", 0 }, { "set_cookie", "set-cookie", 0 }, { "trailer", "trailer", 0 }, { "transfer_encoding", "transfer-encoding", 0 }, { "upgrade", "upgrade", 0 }, { "vary", "vary", 0 }, { "warning", "warning", 0 }, { "www_authenticate", "www-authenticate", 0 }, }; void JsonHttpLogJSONBasic(json_t *js, htp_tx_t *tx) { char *c; /* hostname */ if (tx->request_hostname != NULL) { c = bstr_util_strdup_to_c(tx->request_hostname); if (c != NULL) { json_object_set_new(js, "hostname", json_string(c)); SCFree(c); } } /* uri */ if (tx->request_uri != NULL) { c = bstr_util_strdup_to_c(tx->request_uri); if (c != NULL) { json_object_set_new(js, "url", json_string(c)); SCFree(c); } } /* user agent */ htp_header_t *h_user_agent = NULL; if (tx->request_headers != NULL) { h_user_agent = htp_table_get_c(tx->request_headers, "user-agent"); } if (h_user_agent != NULL) { c = bstr_util_strdup_to_c(h_user_agent->value); if (c != NULL) { json_object_set_new(js, "http_user_agent", json_string(c)); SCFree(c); } } /* x-forwarded-for */ htp_header_t *h_x_forwarded_for = NULL; if (tx->request_headers != NULL) { h_x_forwarded_for = htp_table_get_c(tx->request_headers, "x-forwarded-for"); } if (h_x_forwarded_for != NULL) { c = bstr_util_strdup_to_c(h_x_forwarded_for->value); if (c != NULL) { json_object_set_new(js, "xff", json_string(c)); SCFree(c); } } /* content-type */ htp_header_t *h_content_type = NULL; if (tx->response_headers != NULL) { h_content_type = htp_table_get_c(tx->response_headers, "content-type"); } if (h_content_type != NULL) { char *p; c = bstr_util_strdup_to_c(h_content_type->value); if (c != NULL) { p = strchr(c, ';'); if (p != NULL) *p = '\0'; json_object_set_new(js, "http_content_type", json_string(c)); SCFree(c); } } } static void JsonHttpLogJSONCustom(LogHttpFileCtx *http_ctx, json_t *js, htp_tx_t *tx) { char *c; HttpField f; for (f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) { if ((http_ctx->fields & (1ULL<flags & LOG_HTTP_EXTENDED) == 0) || ((http_ctx->flags & LOG_HTTP_EXTENDED) != (http_fields[f].flags & LOG_HTTP_EXTENDED))) { htp_header_t *h_field = NULL; if ((http_fields[f].flags & LOG_HTTP_REQUEST) != 0) { if (tx->request_headers != NULL) { h_field = htp_table_get_c(tx->request_headers, http_fields[f].htp_field); } } else { if (tx->response_headers != NULL) { h_field = htp_table_get_c(tx->response_headers, http_fields[f].htp_field); } } if (h_field != NULL) { c = bstr_util_strdup_to_c(h_field->value); if (c != NULL) { json_object_set_new(js, http_fields[f].config_field, json_string(c)); SCFree(c); } } } } } } void JsonHttpLogJSONExtended(json_t *js, htp_tx_t *tx) { char *c; /* referer */ htp_header_t *h_referer = NULL; if (tx->request_headers != NULL) { h_referer = htp_table_get_c(tx->request_headers, "referer"); } if (h_referer != NULL) { c = bstr_util_strdup_to_c(h_referer->value); if (c != NULL) { json_object_set_new(js, "http_refer", json_string(c)); SCFree(c); } } /* method */ if (tx->request_method != NULL) { c = bstr_util_strdup_to_c(tx->request_method); if (c != NULL) { json_object_set_new(js, "http_method", json_string(c)); SCFree(c); } } /* protocol */ if (tx->request_protocol != NULL) { c = bstr_util_strdup_to_c(tx->request_protocol); if (c != NULL) { json_object_set_new(js, "protocol", json_string(c)); SCFree(c); } } /* response status */ if (tx->response_status != NULL) { c = bstr_util_strdup_to_c(tx->response_status); if (c != NULL) { unsigned int val = strtoul(c, NULL, 10); json_object_set_new(js, "status", json_integer(val)); SCFree(c); } htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location"); if (h_location != NULL) { c = bstr_util_strdup_to_c(h_location->value); if (c != NULL) { json_object_set_new(js, "redirect", json_string(c)); SCFree(c); } } } /* length */ json_object_set_new(js, "length", json_integer(tx->response_message_len)); } /* JSON format logging */ static void JsonHttpLogJSON(JsonHttpLogThread *aft, json_t *js, htp_tx_t *tx, uint64_t tx_id) { LogHttpFileCtx *http_ctx = aft->httplog_ctx; json_t *hjs = json_object(); if (hjs == NULL) { return; } JsonHttpLogJSONBasic(hjs, tx); /* log custom fields if configured */ if (http_ctx->fields != 0) JsonHttpLogJSONCustom(http_ctx, hjs, tx); if (http_ctx->flags & LOG_HTTP_EXTENDED) JsonHttpLogJSONExtended(hjs, tx); json_object_set_new(js, "http", hjs); } static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *alstate, void *txptr, uint64_t tx_id) { SCEnter(); htp_tx_t *tx = txptr; JsonHttpLogThread *jhl = (JsonHttpLogThread *)thread_data; json_t *js = CreateJSONHeaderWithTxId((Packet *)p, 1, "http", tx_id); //TODO const if (unlikely(js == NULL)) return TM_ECODE_OK; SCLogDebug("got a HTTP request and now logging !!"); /* reset */ MemBufferReset(jhl->buffer); JsonHttpLogJSON(jhl, js, tx, tx_id); OutputJSONBuffer(js, jhl->httplog_ctx->file_ctx, &jhl->buffer); json_object_del(js, "http"); json_object_clear(js); json_decref(js); SCReturnInt(TM_ECODE_OK); } json_t *JsonHttpAddMetadata(const Flow *f, uint64_t tx_id) { HtpState *htp_state = (HtpState *)FlowGetAppState(f); if (htp_state) { htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, tx_id); if (tx) { json_t *hjs = json_object(); if (unlikely(hjs == NULL)) return NULL; JsonHttpLogJSONBasic(hjs, tx); JsonHttpLogJSONExtended(hjs, tx); return hjs; } } return NULL; } static void OutputHttpLogDeinit(OutputCtx *output_ctx) { LogHttpFileCtx *http_ctx = output_ctx->data; LogFileCtx *logfile_ctx = http_ctx->file_ctx; LogFileFreeCtx(logfile_ctx); SCFree(http_ctx); SCFree(output_ctx); } #define DEFAULT_LOG_FILENAME "http.json" OutputCtx *OutputHttpLogInit(ConfNode *conf) { LogFileCtx *file_ctx = LogFileNewCtx(); if(file_ctx == NULL) { SCLogError(SC_ERR_HTTP_LOG_GENERIC, "couldn't create new file_ctx"); return NULL; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(file_ctx); return NULL; } LogHttpFileCtx *http_ctx = SCMalloc(sizeof(LogHttpFileCtx)); if (unlikely(http_ctx == NULL)) { LogFileFreeCtx(file_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { LogFileFreeCtx(file_ctx); SCFree(http_ctx); return NULL; } http_ctx->file_ctx = file_ctx; http_ctx->flags = LOG_HTTP_DEFAULT; if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended != NULL) { if (ConfValIsTrue(extended)) { http_ctx->flags = LOG_HTTP_EXTENDED; } } } output_ctx->data = http_ctx; output_ctx->DeInit = OutputHttpLogDeinit; /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP); return output_ctx; } static void OutputHttpLogDeinitSub(OutputCtx *output_ctx) { LogHttpFileCtx *http_ctx = output_ctx->data; SCFree(http_ctx); SCFree(output_ctx); } OutputCtx *OutputHttpLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputJsonCtx *ojc = parent_ctx->data; LogHttpFileCtx *http_ctx = SCMalloc(sizeof(LogHttpFileCtx)); if (unlikely(http_ctx == NULL)) return NULL; memset(http_ctx, 0x00, sizeof(*http_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCFree(http_ctx); return NULL; } http_ctx->file_ctx = ojc->file_ctx; http_ctx->flags = LOG_HTTP_DEFAULT; if (conf) { const char *extended = ConfNodeLookupChildValue(conf, "extended"); if (extended != NULL) { if (ConfValIsTrue(extended)) { http_ctx->flags = LOG_HTTP_EXTENDED; } } ConfNode *custom; if ((custom = ConfNodeLookupChild(conf, "custom")) != NULL) { ConfNode *field; TAILQ_FOREACH(field, &custom->head, next) { if (field != NULL) { HttpField f; for (f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) { if ((strcmp(http_fields[f].config_field, field->val) == 0) || (strcasecmp(http_fields[f].htp_field, field->val) == 0)) { http_ctx->fields |= (1ULL<data = http_ctx; output_ctx->DeInit = OutputHttpLogDeinitSub; /* enable the logger for the app layer */ AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP); return output_ctx; } #define OUTPUT_BUFFER_SIZE 65535 static TmEcode JsonHttpLogThreadInit(ThreadVars *t, void *initdata, void **data) { JsonHttpLogThread *aft = SCMalloc(sizeof(JsonHttpLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(JsonHttpLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for EveLogHTTP. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /* Use the Ouptut Context (file pointer and mutex) */ aft->httplog_ctx = ((OutputCtx *)initdata)->data; //TODO aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode JsonHttpLogThreadDeinit(ThreadVars *t, void *data) { JsonHttpLogThread *aft = (JsonHttpLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(JsonHttpLogThread)); SCFree(aft); return TM_ECODE_OK; } void JsonHttpLogRegister (void) { /* register as separate module */ OutputRegisterTxModule(LOGGER_JSON_HTTP, "JsonHttpLog", "http-json-log", OutputHttpLogInit, ALPROTO_HTTP, JsonHttpLogger, JsonHttpLogThreadInit, JsonHttpLogThreadDeinit, NULL); /* also register as child of eve-log */ OutputRegisterTxSubModule(LOGGER_JSON_HTTP, "eve-log", "JsonHttpLog", "eve-log.http", OutputHttpLogInitSub, ALPROTO_HTTP, JsonHttpLogger, JsonHttpLogThreadInit, JsonHttpLogThreadDeinit, NULL); } #else void JsonHttpLogRegister (void) { } #endif suricata-3.2.1/src/threads.c0000644000000000000000000001001613051004444012575 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * This file now only contains unit tests see macros in threads.h */ #include "suricata-common.h" #include "util-unittest.h" #include "debug.h" #include "util-debug.h" #include "threads.h" #ifdef UNITTESTS /* UNIT TESTS */ /** * \brief Test Mutex macros */ int ThreadMacrosTest01Mutex(void) { SCMutex mut; int r = 0; r |= SCMutexInit(&mut, NULL); r |= SCMutexLock(&mut); r |= (SCMutexTrylock(&mut) == EBUSY)? 0 : 1; r |= SCMutexUnlock(&mut); r |= SCMutexDestroy(&mut); return (r == 0)? 1 : 0; } /** * \brief Test Spinlock Macros * * Valgrind's DRD tool (valgrind-3.5.0-Debian) reports: * * ==31156== Recursive locking not allowed: mutex 0x7fefff97c, recursion count 1, owner 1. * ==31156== at 0x4C2C77E: pthread_spin_trylock (drd_pthread_intercepts.c:829) * ==31156== by 0x40EB3E: ThreadMacrosTest02Spinlocks (threads.c:40) * ==31156== by 0x532E8A: UtRunTests (util-unittest.c:182) * ==31156== by 0x4065C3: main (suricata.c:789) * * To me this is a false positve, as the whole point of "trylock" is to see * if a spinlock is actually locked. * */ int ThreadMacrosTest02Spinlocks(void) { SCSpinlock mut; int r = 0; r |= SCSpinInit(&mut, 0); r |= SCSpinLock(&mut); #ifndef __OpenBSD__ r |= (SCSpinTrylock(&mut) == EBUSY)? 0 : 1; #else r |= (SCSpinTrylock(&mut) == EDEADLK)? 0 : 1; #endif r |= SCSpinUnlock(&mut); r |= SCSpinDestroy(&mut); return (r == 0)? 1 : 0; } /** * \brief Test RWLock macros */ int ThreadMacrosTest03RWLocks(void) { SCRWLock rwl_write; int r = 0; r |= SCRWLockInit(&rwl_write, NULL); r |= SCRWLockWRLock(&rwl_write); /* OS X/macOS 10.10 (Yosemite) and newer return EDEADLK. Older versions * and other tested OS's return EBUSY. */ #if __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__>=101000 r |= (SCRWLockTryWRLock(&rwl_write) == EDEADLK)? 0 : 1; #else r |= (SCRWLockTryWRLock(&rwl_write) == EBUSY)? 0 : 1; #endif r |= SCRWLockUnlock(&rwl_write); r |= SCRWLockDestroy(&rwl_write); return (r == 0)? 1 : 0; } /** * \brief Test RWLock macros */ int ThreadMacrosTest04RWLocks(void) { SCRWLock rwl_read; int r = 0; r |= SCRWLockInit(&rwl_read, NULL); r |= SCRWLockRDLock(&rwl_read); r |= (SCRWLockTryWRLock(&rwl_read) == EBUSY)? 0 : 1; r |= SCRWLockUnlock(&rwl_read); r |= SCRWLockDestroy(&rwl_read); return (r == 0)? 1 : 0; } /** * \brief Test RWLock macros */ int ThreadMacrosTest05RWLocks(void) { SCRWLock rwl_read; int r = 0; r |= SCRWLockInit(&rwl_read, NULL); r |= SCRWLockWRLock(&rwl_read); r |= (SCRWLockTryRDLock(&rwl_read) == EBUSY)? 0 : 1; r |= SCRWLockUnlock(&rwl_read); r |= SCRWLockDestroy(&rwl_read); return (r == 0)? 1 : 0; } #endif /* UNIT TESTS */ /** * \brief this function registers unit tests for DetectId */ void ThreadMacrosRegisterTests(void) { #ifdef UNITTESTS /* UNIT TESTS */ UtRegisterTest("ThreadMacrosTest01Mutex", ThreadMacrosTest01Mutex); UtRegisterTest("ThreadMacrosTest02Spinlocks", ThreadMacrosTest02Spinlocks); UtRegisterTest("ThreadMacrosTest03RWLocks", ThreadMacrosTest03RWLocks); UtRegisterTest("ThreadMacrosTest04RWLocks", ThreadMacrosTest04RWLocks); #endif /* UNIT TESTS */ } suricata-3.2.1/src/conf-yaml-loader.h0000644000000000000000000000211513051004444014302 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited - Jason Ish */ #ifndef __CONF_YAML_LOADER_H__ #define __CONF_YAML_LOADER_H__ int ConfYamlLoadFile(const char *); int ConfYamlLoadString(const char *, size_t); int ConfYamlLoadFileWithPrefix(const char *filename, const char *prefix); void ConfYamlRegisterTests(void); #endif /* !__CONF_YAML_LOADER_H__ */ suricata-3.2.1/src/app-layer-dns-tcp.h0000644000000000000000000000216113051004444014412 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * \author Victor Julien */ #ifndef __APP_LAYER_DNS_TCP_H__ #define __APP_LAYER_DNS_TCP_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-dns-common.h" #include "flow.h" #include "queue.h" #include "util-byte.h" void RegisterDNSTCPParsers(void); void DNSTCPParserTests(void); void DNSTCPParserRegisterTests(void); #endif /* __APP_LAYER_DNS_TCP_H__ */ suricata-3.2.1/src/app-layer-htp-body.h0000644000000000000000000000237413051004444014576 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Gurvinder Singh * \author Pablo Rincon * * This file provides a HTTP protocol support for the engine using HTP library. */ #ifndef __APP_LAYER_HTP_BODY_H__ #define __APP_LAYER_HTP_BODY_H__ int HtpBodyAppendChunk(const HTPCfgDir *, HtpBody *, const uint8_t *, uint32_t); void HtpBodyPrint(HtpBody *); void HtpBodyFree(HtpBody *); void HtpBodyPrune(HtpState *, HtpBody *, int); #endif /* __APP_LAYER_HTP_BODY_H__ */ suricata-3.2.1/src/util-cuda.h0000644000000000000000000003622213051004444013046 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_CUDA__H__ #define __UTIL_CUDA__H__ #ifdef __SC_CUDA_SUPPORT__ #include #define SC_CUDA_DEFAULT_DEVICE 0 #define SC_CUDA_DEVICE_NAME_MAX_LEN 128 typedef struct SCCudaDevice_ { /* device id */ CUdevice device; /* device name */ char name[SC_CUDA_DEVICE_NAME_MAX_LEN]; /* device compute capability */ int major_rev; int minor_rev; /* device properties */ CUdevprop prop; /* device total memory */ size_t bytes; /* device attributes. We could have used a fixed int array table to hold * the attributes, but it is better we specify it exclusively this way, * since the usage would be less error prone */ int attr_max_threads_per_block; int attr_max_block_dim_x; int attr_max_block_dim_y; int attr_max_block_dim_z; int attr_max_grid_dim_x; int attr_max_grid_dim_y; int attr_max_grid_dim_z; int attr_max_shared_memory_per_block; int attr_total_constant_memory; int attr_warp_size; int attr_max_pitch; int attr_max_registers_per_block; int attr_clock_rate; int attr_texture_alignment; int attr_gpu_overlap; int attr_multiprocessor_count; int attr_kernel_exec_timeout; int attr_integrated; int attr_can_map_host_memory; int attr_compute_mode; } SCCudaDevice; typedef struct SCCudaDevices_ { int count; SCCudaDevice **devices; } SCCudaDevices; /**************************Cuda_Initialization_API**************************/ int SCCudaInit(unsigned int flags); /***************************Version_Management_API***************************/ int SCCudaDriverGetVersion(int *driver_version); /***************************Device_Management_API****************************/ int SCCudaDeviceComputeCapability(int *major, int *minor, CUdevice dev); int SCCudaDeviceGet(CUdevice *device, int ordinal); int SCCudaDeviceGetAttribute(int *pi, CUdevice_attribute attrib, CUdevice dev); int SCCudaDeviceGetCount(int *count); int SCCudaDeviceGetName(char *name, int len, CUdevice dev); int SCCudaDeviceGetProperties(CUdevprop *prop, CUdevice dev); int SCCudaDeviceTotalMem(size_t *bytes, CUdevice dev); void SCCudaPrintDeviceList(SCCudaDevices *); void SCCudaPrintBasicDeviceInfo(SCCudaDevices *); SCCudaDevices *SCCudaGetDeviceList(void); /***************************Context_Management_API***************************/ int SCCudaCtxCreate(CUcontext *pctx, unsigned int flags, CUdevice dev); int SCCudaCtxDestroy(CUcontext ctx); int SCCudaCtxGetApiVersion(CUcontext ctx, unsigned int *version); int SCCudaCtxGetCacheConfig(CUfunc_cache *pconfig); int SCCudaCtxGetCurrent(CUcontext *pctx); int SCCudaCtxGetDevice(CUdevice *device); int SCCudaCtxGetLimit(size_t *pvalue, CUlimit limit); int SCCudaCtxPopCurrent(CUcontext *pctx); int SCCudaCtxPushCurrent(CUcontext ctx); int SCCudaCtxSetCacheConfig(CUfunc_cache config); int SCCudaCtxSetCurrent(CUcontext ctx); int SCCudaCtxSetLimit(CUlimit limit, size_t value); int SCCudaCtxSynchronize(void); int SCCudaCtxAttach(CUcontext *pctx, unsigned int flags); int SCCudaCtxDetach(CUcontext ctx); /***************************Module_Management_API****************************/ int SCCudaModuleGetFunction(CUfunction *hfunc, CUmodule hmod, const char *name); int SCCudaModuleGetGlobal(CUdeviceptr *dptr, size_t *bytes, CUmodule hmod, const char *name); int SCCudaModuleGetSurfRef(CUsurfref *p_surf_ref, CUmodule hmod, const char *name); int SCCudaModuleGetTexRef(CUtexref *p_tex_ref, CUmodule hmod, const char *name); int SCCudaModuleLoad(CUmodule *module, const char *fname); int SCCudaModuleLoadData(CUmodule *module, const void *image); int SCCudaModuleLoadDataEx(CUmodule *module, const void *image, unsigned int num_options, CUjit_option *options, void **option_values); int SCCudaModuleLoadFatBinary(CUmodule *module, const void *fat_cubin); int SCCudaModuleUnload(CUmodule hmod); /**************************Memory_Management_API*****************************/ int SCCudaArray3DCreate(CUarray *p_handle, const CUDA_ARRAY3D_DESCRIPTOR *p_allocate_array); int SCCudaArray3DGetDescriptor(CUDA_ARRAY3D_DESCRIPTOR *p_array_descriptor, CUarray h_array); int SCCudaArrayCreate(CUarray *p_handle, const CUDA_ARRAY_DESCRIPTOR *p_allocate_array); int SCCudaArrayDestroy(CUarray h_array); int SCCudaArrayGetDescriptor(CUDA_ARRAY_DESCRIPTOR *p_array_descriptor, CUarray h_array); int SCCudaDeviceGetByPCIBusId(CUdevice *dev, char *pci_bus_id); int SCCudaDeviceGetPCIBusId(char *pci_bus_id, int len, CUdevice dev); int SCCudaIpcCloseMemHandle(CUdeviceptr dptr); int SCCudaIpcGetEventHandle(CUipcEventHandle *p_handle, CUevent event); int SCCudaIpcGetMemHandle(CUipcMemHandle *p_handle, CUdeviceptr dptr); int SCCudaIpcOpenEventHandle(CUevent *ph_event, CUipcEventHandle handle); int SCCudaIpcOpenMemHandle(CUdeviceptr *pdptr, CUipcMemHandle handle, unsigned int flags); int SCCudaMemAlloc(CUdeviceptr *dptr, size_t byte_size); int SCCudaMemAllocHost(void **pp, size_t byte_size); int SCCudaMemAllocPitch(CUdeviceptr *dptr, size_t *p_pitch, size_t width_in_bytes, size_t height, unsigned int element_size_bytes); int SCCudaMemcpy(CUdeviceptr dst, CUdeviceptr src, size_t byte_count); int SCCudaMemcpy2D(const CUDA_MEMCPY2D *p_copy); int SCCudaMemcpy2DAsync(const CUDA_MEMCPY2D *p_copy, CUstream h_stream); int SCCudaMemcpy2DUnaligned(const CUDA_MEMCPY2D *p_copy); int SCCudaMemcpy3D(const CUDA_MEMCPY3D *p_copy); int SCCudaMemcpy3DAsync(const CUDA_MEMCPY3D *p_copy, CUstream h_stream); int SCCudaMemcpy3DPeer(const CUDA_MEMCPY3D_PEER *p_copy); int SCCudaMemcpy3DPeerAsync(const CUDA_MEMCPY3D_PEER *p_copy, CUstream h_stream); int SCCudaMemcpyAsync(CUdeviceptr dst, CUdeviceptr src, size_t byte_count, CUstream h_stream); int SCCudaMemcpyAtoA(CUarray dst_array, size_t dst_offset, CUarray src_array, size_t src_offset, size_t byte_count); int SCCudaMemcpyAtoD(CUdeviceptr dst_device, CUarray src_array, size_t src_offset, size_t byte_count); int SCCudaMemcpyAtoH(void *dst_host, CUarray src_array, size_t src_offset, size_t byte_count); int SCCudaMemcpyAtoHAsync(void *dst_host, CUarray src_array, size_t src_offset, size_t byte_count, CUstream h_stream); int SCCudaMemcpyDtoA(CUarray dst_array, size_t dst_offset, CUdeviceptr src_device, size_t byte_count); int SCCudaMemcpyDtoD(CUdeviceptr dst_device, CUdeviceptr src_device, size_t byte_count); int SCCudaMemcpyDtoDAsync(CUdeviceptr dst_device, CUdeviceptr src_device, size_t byte_count, CUstream h_stream); int SCCudaMemcpyDtoH(void *dst_host, CUdeviceptr src_device, size_t byte_count); int SCCudaMemcpyDtoHAsync(void *dst_host, CUdeviceptr src_device, size_t byte_count, CUstream h_stream); int SCCudaMemcpyHtoA(CUarray dst_array, size_t dst_offset, const void *src_host, size_t byte_count); int SCCudaMemcpyHtoAAsync(CUarray dst_array, size_t dst_offset, const void *src_host, size_t byte_count, CUstream h_stream); int SCCudaMemcpyHtoD(CUdeviceptr dst_device, const void *src_host, size_t byte_count); int SCCudaMemcpyHtoDAsync(CUdeviceptr dst_device, const void *src_host, size_t byte_count, CUstream h_stream); int SCCudaMemcpyPeer(CUdeviceptr dst_device, CUcontext dst_context, CUdeviceptr src_device, CUcontext src_context, size_t byte_count); int SCCudaMemcpyPeerAsync(CUdeviceptr dst_device, CUcontext dst_context, CUdeviceptr src_device, CUcontext src_context, size_t byte_count, CUstream h_stream); int SCCudaMemFree(CUdeviceptr dptr); int SCCudaMemFreeHost(void *p); int SCCudaMemGetAddressRange(CUdeviceptr *pbase, size_t *psize, CUdeviceptr dptr); int SCCudaMemGetInfo(size_t *free, size_t *total); int SCCudaMemHostAlloc(void **pp, size_t byte_size, unsigned int flags); int SCCudaMemHostGetDevicePointer(CUdeviceptr *pdptr, void *p, unsigned int flags); int SCCudaMemHostGetFlags(unsigned int *p_flags, void *p); int SCCudaMemHostRegister(void *p, size_t byte_size, unsigned int flags); int SCCudaMemHostUnregister(void *p); int SCCudaMemsetD16(CUdeviceptr dst_device, unsigned short us, size_t n); int SCCudaMemsetD16Async(CUdeviceptr dst_device, unsigned short us, size_t n, CUstream h_stream); int SCCudaMemsetD2D16(CUdeviceptr dst_device, size_t dst_pitch, unsigned short us, size_t width, size_t height); int SCCudaMemsetD2D16Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned short us, size_t width, size_t height, CUstream h_stream); int SCCudaMemsetD2D32(CUdeviceptr dst_device, size_t dst_pitch, unsigned int ui, size_t width, size_t height); int SCCudaMemsetD2D32Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned int ui, size_t width, size_t height, CUstream h_stream); int SCCudaMemsetD2D8(CUdeviceptr dst_device, size_t dst_pitch, unsigned char uc, size_t width, size_t height); int SCCudaMemsetD2D8Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned char uc, size_t width, size_t height, CUstream h_stream); int SCCudaMemsetD32(CUdeviceptr dst_device, unsigned int ui, size_t n); int SCCudaMemsetD32Async(CUdeviceptr dst_device, unsigned int ui, size_t n, CUstream h_stream); int SCCudaMemsetD8(CUdeviceptr dst_device, unsigned char uc, size_t n); int SCCudaMemsetD8Async(CUdeviceptr dst_device, unsigned char uc, size_t n, CUstream h_stream); /***************************Unified_Addressing_API****************************/ int SCCudaPointerGetAttribute(void *data, CUpointer_attribute attribute, CUdeviceptr ptr); /***************************Stream_Management_API****************************/ int SCCudaStreamCreate(CUstream *ph_stream, unsigned int flags); int SCCudaStreamDestroy(CUstream h_stream); int SCCudaStreamQuery(CUstream h_stream); int SCCudaStreamSynchronize(CUstream h_stream); int SCCudaStreamWaitEvent(CUstream h_stream, CUevent h_event, unsigned int flags); /***************************Event_Management_API*****************************/ int SCCudaEventCreate(CUevent *ph_event, unsigned int flags); int SCCudaEventDestroy(CUevent h_event); int SCCudaEventElapsedTime(float *p_milli_seconds, CUevent h_start, CUevent h_end); int SCCudaEventQuery(CUevent h_event); int SCCudaEventRecord(CUevent h_event, CUstream h_stream); int SCCudaEventSynchronize(CUevent h_event); /***********************Execution_Control_Management_API***********************/ int SCCudaFuncGetAttribute(int *pi, CUfunction_attribute attrib, CUfunction hfunc); int SCCudaFuncSetCacheConfig(CUfunction hfunc, CUfunc_cache config); int SCCudaLaunchKernel(CUfunction f, unsigned int grid_dim_x, unsigned int grid_dim_y, unsigned int grid_dim_z, unsigned int block_dim_x, unsigned int block_dim_y, unsigned int block_dim_z, unsigned int shared_mem_bytes, CUstream h_stream, void **kernel_params, void **extra); int SCCudaFuncSetBlockShape(CUfunction hfunc, int x, int y, int z); int SCCudaFuncSetSharedSize(CUfunction hfunc, unsigned int bytes); int SCCudaLaunch(CUfunction f); int SCCudaLaunchGrid(CUfunction f, int grid_width, int grid_height); int SCCudaLaunchGridAsync(CUfunction f, int grid_width, int grid_height, CUstream h_stream); int SCCudaParamSetf(CUfunction h_func, int offset, float value); int SCCudaParamSeti(CUfunction h_func, int offset, unsigned int value); int SCCudaParamSetSize(CUfunction h_func, unsigned int num_bytes); int SCCudaParamSetTexRef(CUfunction h_func, int tex_unit, CUtexref h_tex_ref); int SCCudaParamSetv(CUfunction h_func, int offset, void *ptr, unsigned int num_bytes); /*********************Texture_Reference_Management_API***********************/ int SCCudaTexRefCreate(CUtexref *p_tex_ref); int SCCudaTexRefDestroy(CUtexref h_tex_ref); int SCCudaTexRefGetAddress(CUdeviceptr *pdptr, CUtexref h_tex_ref); int SCCudaTexRefGetAddressMode(CUaddress_mode *pam, CUtexref h_tex_ref, int dim); int SCCudaTexRefGetArray(CUarray *ph_array, CUtexref h_tex_ref); int SCCudaTexRefGetFilterMode(CUfilter_mode *pfm, CUtexref h_tex_ref); int SCCudaTexRefGetFlags(unsigned int *p_flags, CUtexref h_tex_ref); int SCCudaTexRefGetFormat(CUarray_format *p_format, int *p_num_channels, CUtexref h_tex_ref); int SCCudaTexRefSetAddress(size_t *byte_offset, CUtexref h_tex_ref, CUdeviceptr dptr, unsigned int bytes); int SCCudaTexRefSetAddress2D(CUtexref h_tex_ref, const CUDA_ARRAY_DESCRIPTOR *desc, CUdeviceptr dptr, unsigned int pitch); int SCCudaTexRefSetAddressMode(CUtexref h_tex_ref, int dim, CUaddress_mode am); int SCCudaTexRefSetArray(CUtexref h_tex_ref, CUarray h_array, unsigned int flags); int SCCudaTexRefSetFilterMode(CUtexref h_tex_ref, CUfilter_mode fm); int SCCudaTexRefSetFlags(CUtexref h_tex_ref, unsigned int flags); int SCCudaTexRefSetFormat(CUtexref h_tex_ref, CUarray_format fmt, int num_packed_components); /************************Cuda_Env_Initialization_API*************************/ int SCCudaInitCudaEnvironment(void); /********************************Cuda_Utility********************************/ void SCCudaListCards(void); int SCCudaIsCudaDeviceIdValid(int cuda_device_id); /********************************Unittests***********************************/ void SCCudaRegisterTests(void); #endif /* __SC_CUDA_SUPPORT__ */ #endif /* __UTIL_CUDA_H__ */ suricata-3.2.1/src/detect-http-response-line.c0000644000000000000000000002473713051004444016170 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Victor Julien * * Implements support for the http_response_line keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-engine-prefilter.h" #include "detect-engine-content-inspection.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "stream-tcp.h" #include "detect-http-response-line.h" int DetectHttpResponseLineSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpResponseLineRegisterTests(void); void DetectHttpResponseLineFree(void *); static int PrefilterTxHttpResponseLineRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); static int DetectEngineInspectHttpResponseLine(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); /** * \brief Registers the keyword handlers for the "http_response_line" keyword. */ void DetectHttpResponseLineRegister(void) { sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].name = "http_response_line"; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].desc = "content modifier to match only on the HTTP response line"; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_response-line"; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].Match = NULL; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].Setup = DetectHttpResponseLineSetup; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].RegisterTests = DetectHttpResponseLineRegisterTests; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_RESPONSE_LINE].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_response_line", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HTTP_RESLINEMATCH, 2, PrefilterTxHttpResponseLineRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HTTP_RESLINEMATCH, DetectEngineInspectHttpResponseLine); return; } /** * \brief The setup function for the http_response_line keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to the signature for the current Signature being * parsed from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpResponseLineSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { s->list = DETECT_SM_LIST_HTTP_RESLINEMATCH; s->alproto = ALPROTO_HTTP; return 0; } /** \brief HTTP response line Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpResponseLine(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_line == NULL) return; const uint32_t buffer_len = bstr_len(tx->response_line); const uint8_t *buffer = bstr_ptr(tx->response_line); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } static int PrefilterTxHttpResponseLineRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseLine, ALPROTO_HTTP, HTP_RESPONSE_LINE, mpm_ctx, NULL, "http_response_line"); } /** * \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags app layer flags * \param state App layer state * * \retval 0 no match. * \retval 1 match. * \retval 2 Sig can't match. */ int DetectEngineInspectHttpResponseLine(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_line == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_RESPONSE_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; #if 0 PrintRawDataFp(stdout, (uint8_t *)bstr_ptr(tx->response_line), bstr_len(tx->response_line)); #endif /* run the inspection against the buffer */ int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HTTP_RESLINEMATCH], f, bstr_ptr(tx->response_line), bstr_len(tx->response_line), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_response_line is correctly parsed * and the keyword is registered. */ static int DetectHttpResponseLineTest01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(http_response_line; content:\"200 OK\"; sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); DetectEngineCtxFree(de_ctx); PASS; } /** *\test Test that the http_response_line content matches against a http request * which holds the content. */ static int DetectHttpResponseLineTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 OK\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); FAIL_IF_NULL(alp_tctx); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FAIL_IF_NULL(p); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= (FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED); p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(http_response_line; content:\"HTTP/1.0 200 OK\"; " "sid:1;)"); FAIL_IF_NULL(de_ctx->sig_list); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(&th_v, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); FAIL_IF(r != 0); http_state = f.alstate; FAIL_IF_NULL(http_state); r = AppLayerParserParse(&th_v, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); FAIL_IF(r != 0); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(PacketAlertCheck(p, 1)); p->flowflags = (FLOW_PKT_TOCLIENT|FLOW_PKT_ESTABLISHED); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } #endif /* UNITTESTS */ void DetectHttpResponseLineRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpResponseLineTest01", DetectHttpResponseLineTest01); UtRegisterTest("DetectHttpResponseLineTest02", DetectHttpResponseLineTest02); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/decode-sll.h0000644000000000000000000000233713051004444013172 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DECODE_SLL_H__ #define __DECODE_SLL_H__ #define SLL_HEADER_LEN 16 typedef struct SllHdr_ { uint16_t sll_pkttype; /* packet type */ uint16_t sll_hatype; /* link-layer address type */ uint16_t sll_halen; /* link-layer address length */ uint8_t sll_addr[8]; /* link-layer address */ uint16_t sll_protocol; /* protocol */ } __attribute__((__packed__)) SllHdr; #endif /* __DECODE_SLL_H__ */ suricata-3.2.1/src/decode-ipv4.h0000644000000000000000000002245213051004444013262 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Brian Rectanus */ #ifndef __DECODE_IPV4_H__ #define __DECODE_IPV4_H__ #define IPV4_HEADER_LEN 20 /**< Header length */ #define IPV4_OPTMAX 40 /**< Max options length */ #define IPV4_MAXPACKET_LEN 65535 /**< Maximum packet size */ /** IP Option Types */ #define IPV4_OPT_EOL 0x00 /**< Option: End of List */ #define IPV4_OPT_NOP 0x01 /**< Option: No op */ #define IPV4_OPT_RR 0x07 /**< Option: Record Route */ #define IPV4_OPT_QS 0x19 /**< Option: Quick Start */ #define IPV4_OPT_TS 0x44 /**< Option: Timestamp */ #define IPV4_OPT_SEC 0x82 /**< Option: Security */ #define IPV4_OPT_LSRR 0x83 /**< Option: Loose Source Route */ #define IPV4_OPT_CIPSO 0x86 /**< Option: Commercial IP Security */ #define IPV4_OPT_SID 0x88 /**< Option: Stream Identifier */ #define IPV4_OPT_SSRR 0x89 /**< Option: Strict Source Route */ #define IPV4_OPT_RTRALT 0x94 /**< Option: Router Alert */ /** IP Option Lengths (fixed) */ #define IPV4_OPT_SEC_LEN 11 /**< SEC Option Fixed Length */ #define IPV4_OPT_SID_LEN 4 /**< SID Option Fixed Length */ #define IPV4_OPT_RTRALT_LEN 4 /**< RTRALT Option Fixed Length */ /** IP Option Lengths (variable) */ #define IPV4_OPT_ROUTE_MIN 3 /**< RR, SRR, LTRR Option Min Length */ #define IPV4_OPT_QS_MIN 8 /**< QS Option Min Length */ #define IPV4_OPT_TS_MIN 5 /**< TS Option Min Length */ #define IPV4_OPT_CIPSO_MIN 10 /**< CIPSO Option Min Length */ /** IP Option fields */ #define IPV4_OPTS ip4vars.ip_opts #define IPV4_OPTS_CNT ip4vars.ip_opt_cnt typedef struct IPV4Opt_ { /** \todo We may want to break type up into its 3 fields * as the reassembler may want to know which options * must be copied to each fragment. */ uint8_t type; /**< option type */ uint8_t len; /**< option length (type+len+data) */ uint8_t *data; /**< option data */ } IPV4Opt; typedef struct IPV4Hdr_ { uint8_t ip_verhl; /**< version & header length */ uint8_t ip_tos; /**< type of service */ uint16_t ip_len; /**< length */ uint16_t ip_id; /**< id */ uint16_t ip_off; /**< frag offset */ uint8_t ip_ttl; /**< time to live */ uint8_t ip_proto; /**< protocol (tcp, udp, etc) */ uint16_t ip_csum; /**< checksum */ union { struct { struct in_addr ip_src;/**< source address */ struct in_addr ip_dst;/**< destination address */ } ip4_un1; uint16_t ip_addrs[4]; } ip4_hdrun1; } __attribute__((__packed__)) IPV4Hdr; #define s_ip_src ip4_hdrun1.ip4_un1.ip_src #define s_ip_dst ip4_hdrun1.ip4_un1.ip_dst #define s_ip_addrs ip4_hdrun1.ip_addrs #define IPV4_GET_RAW_VER(ip4h) (((ip4h)->ip_verhl & 0xf0) >> 4) #define IPV4_GET_RAW_HLEN(ip4h) ((ip4h)->ip_verhl & 0x0f) #define IPV4_GET_RAW_IPTOS(ip4h) ((ip4h)->ip_tos) #define IPV4_GET_RAW_IPLEN(ip4h) ((ip4h)->ip_len) #define IPV4_GET_RAW_IPID(ip4h) ((ip4h)->ip_id) #define IPV4_GET_RAW_IPOFFSET(ip4h) ((ip4h)->ip_off) #define IPV4_GET_RAW_IPTTL(ip4h) ((ip4h)->ip_ttl) #define IPV4_GET_RAW_IPPROTO(ip4h) ((ip4h)->ip_proto) #define IPV4_GET_RAW_IPSRC(ip4h) ((ip4h)->s_ip_src) #define IPV4_GET_RAW_IPDST(ip4h) ((ip4h)->s_ip_dst) /** return the raw (directly from the header) src ip as uint32_t */ #define IPV4_GET_RAW_IPSRC_U32(ip4h) (uint32_t)((ip4h)->s_ip_src.s_addr) /** return the raw (directly from the header) dst ip as uint32_t */ #define IPV4_GET_RAW_IPDST_U32(ip4h) (uint32_t)((ip4h)->s_ip_dst.s_addr) /* we need to change them as well as get them */ #define IPV4_SET_RAW_VER(ip4h, value) ((ip4h)->ip_verhl = (((ip4h)->ip_verhl & 0x0f) | (value << 4))) #define IPV4_SET_RAW_HLEN(ip4h, value) ((ip4h)->ip_verhl = (((ip4h)->ip_verhl & 0xf0) | (value & 0x0f))) #define IPV4_SET_RAW_IPTOS(ip4h, value) ((ip4h)->ip_tos = value) #define IPV4_SET_RAW_IPLEN(ip4h, value) ((ip4h)->ip_len = value) #define IPV4_SET_RAW_IPPROTO(ip4h, value) ((ip4h)->ip_proto = value) /* ONLY call these functions after making sure that: * 1. p->ip4h is set * 2. p->ip4h is valid (len is correct) */ #define IPV4_GET_VER(p) \ IPV4_GET_RAW_VER((p)->ip4h) #define IPV4_GET_HLEN(p) \ (IPV4_GET_RAW_HLEN((p)->ip4h) << 2) #define IPV4_GET_IPTOS(p) \ IPV4_GET_RAW_IPTOS((p)->ip4h) #define IPV4_GET_IPLEN(p) \ (ntohs(IPV4_GET_RAW_IPLEN((p)->ip4h))) #define IPV4_GET_IPID(p) \ (ntohs(IPV4_GET_RAW_IPID((p)->ip4h))) /* _IPV4_GET_IPOFFSET: get the content of the offset header field in host order */ #define _IPV4_GET_IPOFFSET(p) \ (ntohs(IPV4_GET_RAW_IPOFFSET((p)->ip4h))) /* IPV4_GET_IPOFFSET: get the final offset */ #define IPV4_GET_IPOFFSET(p) \ (_IPV4_GET_IPOFFSET(p) & 0x1fff) /* IPV4_GET_RF: get the RF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */ #define IPV4_GET_RF(p) \ (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x8000) >> 15) /* IPV4_GET_DF: get the DF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */ #define IPV4_GET_DF(p) \ (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x4000) >> 14) /* IPV4_GET_MF: get the MF flag. Use _IPV4_GET_IPOFFSET to save a ntohs call. */ #define IPV4_GET_MF(p) \ (uint8_t)((_IPV4_GET_IPOFFSET((p)) & 0x2000) >> 13) #define IPV4_GET_IPTTL(p) \ IPV4_GET_RAW_IPTTL(p->ip4h) #define IPV4_GET_IPPROTO(p) \ IPV4_GET_RAW_IPPROTO((p)->ip4h) #define CLEAR_IPV4_PACKET(p) do { \ (p)->ip4h = NULL; \ (p)->level3_comp_csum = -1; \ memset(&p->ip4vars, 0x00, sizeof(p->ip4vars)); \ } while (0) enum IPV4OptionFlags { IPV4_OPT_FLAG_EOL = 0, IPV4_OPT_FLAG_NOP, IPV4_OPT_FLAG_RR, IPV4_OPT_FLAG_TS, IPV4_OPT_FLAG_QS, IPV4_OPT_FLAG_LSRR, IPV4_OPT_FLAG_SSRR, IPV4_OPT_FLAG_SID, IPV4_OPT_FLAG_SEC, IPV4_OPT_FLAG_CIPSO, IPV4_OPT_FLAG_RTRALT, }; /* helper structure with parsed ipv4 info */ typedef struct IPV4Vars_ { int32_t comp_csum; /* checksum computed over the ipv4 packet */ uint16_t opt_cnt; uint16_t opts_set; } IPV4Vars; void DecodeIPV4RegisterTests(void); /** ----- Inline functions ----- */ static inline uint16_t IPV4CalculateChecksum(uint16_t *, uint16_t); /** * \brief Calculates the checksum for the IP packet * * \param pkt Pointer to the start of the IP packet * \param hlen Length of the IP header * * \retval csum Checksum for the IP packet */ static inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen) { uint32_t csum = pkt[0]; csum += pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[6] + pkt[7] + pkt[8] + pkt[9]; hlen -= 20; pkt += 10; if (hlen == 0) { ; } else if (hlen == 4) { csum += pkt[0] + pkt[1]; } else if (hlen == 8) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3]; } else if (hlen == 12) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5]; } else if (hlen == 16) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7]; } else if (hlen == 20) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9]; } else if (hlen == 24) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11]; } else if (hlen == 28) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13]; } else if (hlen == 32) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15]; } else if (hlen == 36) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15] + pkt[16] + pkt[17]; } else if (hlen == 40) { csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] + pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] + pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19]; } csum = (csum >> 16) + (csum & 0x0000FFFF); csum += (csum >> 16); return (uint16_t) ~csum; } #endif /* __DECODE_IPV4_H__ */ suricata-3.2.1/src/counters.c0000644000000000000000000012442513051004444013017 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Victor Julien * * Engine stats API */ #include "suricata-common.h" #include "suricata.h" #include "counters.h" #include "threadvars.h" #include "tm-threads.h" #include "conf.h" #include "util-time.h" #include "util-unittest.h" #include "util-debug.h" #include "util-privs.h" #include "util-signal.h" #include "unix-manager.h" #include "runmodes.h" #include "output.h" #include "output-stats.h" #include "output-json-stats.h" /* Time interval for syncing the local counters with the global ones */ #define STATS_WUT_TTS 3 /* Time interval at which the mgmt thread o/p the stats */ #define STATS_MGMTT_TTS 8 /** * \brief Different kinds of qualifier that can be used to modify the behaviour * of the counter to be registered */ enum { STATS_TYPE_NORMAL = 1, STATS_TYPE_AVERAGE = 2, STATS_TYPE_MAXIMUM = 3, STATS_TYPE_FUNC = 4, STATS_TYPE_MAX = 5, }; /** * \brief per thread store of counters */ typedef struct StatsThreadStore_ { /** thread name used in output */ const char *name; StatsPublicThreadContext *ctx; StatsPublicThreadContext **head; uint32_t size; struct StatsThreadStore_ *next; } StatsThreadStore; /** * \brief Holds the output interface context for the counter api */ typedef struct StatsGlobalContext_ { /** list of thread stores: one per thread plus one global */ StatsThreadStore *sts; SCMutex sts_lock; int sts_cnt; HashTable *counters_id_hash; StatsPublicThreadContext global_counter_ctx; } StatsGlobalContext; static void *stats_thread_data = NULL; static StatsGlobalContext *stats_ctx = NULL; static time_t stats_start_time; /** refresh interval in seconds */ static uint32_t stats_tts = STATS_MGMTT_TTS; /** is the stats counter enabled? */ static char stats_enabled = TRUE; static int StatsOutput(ThreadVars *tv); static int StatsThreadRegister(const char *thread_name, StatsPublicThreadContext *); void StatsReleaseCounters(StatsCounter *head); /** stats table is filled each interval and passed to the * loggers. Initialized at first use. */ static StatsTable stats_table = { NULL, NULL, 0, 0, 0, {0 , 0}}; static SCMutex stats_table_mutex = SCMUTEX_INITIALIZER; static int stats_loggers_active = 1; static uint16_t counters_global_id = 0; static void StatsPublicThreadContextInit(StatsPublicThreadContext *t) { SCMutexInit(&t->m, NULL); } static void StatsPublicThreadContextCleanup(StatsPublicThreadContext *t) { SCMutexLock(&t->m); StatsReleaseCounters(t->head); t->head = NULL; t->perf_flag = 0; t->curr_id = 0; SCMutexUnlock(&t->m); SCMutexDestroy(&t->m); } /** * \brief Adds a value of type uint64_t to the local counter. * * \param id ID of the counter as set by the API * \param pca Counter array that holds the local counter for this TM * \param x Value to add to this local counter */ void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x) { StatsPrivateThreadContext *pca = &tv->perf_private_ctx; #ifdef UNITTESTS if (pca->initialized == 0) return; #endif #ifdef DEBUG BUG_ON ((id < 1) || (id > pca->size)); #endif pca->head[id].value += x; pca->head[id].updates++; return; } /** * \brief Increments the local counter * * \param id Index of the counter in the counter array * \param pca Counter array that holds the local counters for this TM */ void StatsIncr(ThreadVars *tv, uint16_t id) { StatsPrivateThreadContext *pca = &tv->perf_private_ctx; #ifdef UNITTESTS if (pca->initialized == 0) return; #endif #ifdef DEBUG BUG_ON ((id < 1) || (id > pca->size)); #endif pca->head[id].value++; pca->head[id].updates++; return; } /** * \brief Sets a value of type double to the local counter * * \param id Index of the local counter in the counter array * \param pca Pointer to the StatsPrivateThreadContext * \param x The value to set for the counter */ void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x) { StatsPrivateThreadContext *pca = &tv->perf_private_ctx; #ifdef UNITTESTS if (pca->initialized == 0) return; #endif #ifdef DEBUG BUG_ON ((id < 1) || (id > pca->size)); #endif if ((pca->head[id].pc->type == STATS_TYPE_MAXIMUM) && (x > pca->head[id].value)) { pca->head[id].value = x; } else if (pca->head[id].pc->type == STATS_TYPE_NORMAL) { pca->head[id].value = x; } pca->head[id].updates++; return; } static ConfNode *GetConfig(void) { ConfNode *stats = ConfGetNode("stats"); if (stats != NULL) return stats; ConfNode *root = ConfGetNode("outputs"); ConfNode *node = NULL; if (root != NULL) { TAILQ_FOREACH(node, &root->head, next) { if (strcmp(node->val, "stats") == 0) { return node->head.tqh_first; } } } return NULL; } /** * \brief Initializes stats context */ static void StatsInitCtx(void) { SCEnter(); #ifdef AFLFUZZ_DISABLE_MGTTHREADS stats_enabled = FALSE; SCReturn; #endif ConfNode *stats = GetConfig(); if (stats != NULL) { const char *enabled = ConfNodeLookupChildValue(stats, "enabled"); if (enabled != NULL && ConfValIsFalse(enabled)) { stats_enabled = FALSE; SCLogDebug("Stats module has been disabled"); SCReturn; } const char *interval = ConfNodeLookupChildValue(stats, "interval"); if (interval != NULL) stats_tts = (uint32_t) atoi(interval); } if (!OutputStatsLoggersRegistered()) { stats_loggers_active = 0; /* if the unix command socket is enabled we do the background * stats sync just in case someone runs 'dump-counters' */ if (!ConfUnixSocketIsEnable()) { SCLogWarning(SC_WARN_NO_STATS_LOGGERS, "stats are enabled but no loggers are active"); stats_enabled = FALSE; SCReturn; } } /* Store the engine start time */ time(&stats_start_time); /* init the lock used by StatsThreadStore */ if (SCMutexInit(&stats_ctx->sts_lock, NULL) != 0) { SCLogError(SC_ERR_INITIALIZATION, "error initializing sts mutex"); exit(EXIT_FAILURE); } SCReturn; } /** * \brief Releases the resources alloted to the output context of the * Stats API */ static void StatsReleaseCtx() { if (stats_ctx == NULL) { SCLogDebug("Counter module has been disabled"); return; } StatsThreadStore *sts = NULL; StatsThreadStore *temp = NULL; sts = stats_ctx->sts; while (sts != NULL) { if (sts->head != NULL) SCFree(sts->head); temp = sts->next; SCFree(sts); sts = temp; } if (stats_ctx->counters_id_hash != NULL) { HashTableFree(stats_ctx->counters_id_hash); stats_ctx->counters_id_hash = NULL; counters_global_id = 0; } StatsPublicThreadContextCleanup(&stats_ctx->global_counter_ctx); SCFree(stats_ctx); stats_ctx = NULL; SCMutexLock(&stats_table_mutex); /* free stats table */ if (stats_table.tstats != NULL) { SCFree(stats_table.tstats); stats_table.tstats = NULL; } if (stats_table.stats != NULL) { SCFree(stats_table.stats); stats_table.stats = NULL; } memset(&stats_table, 0, sizeof(stats_table)); SCMutexUnlock(&stats_table_mutex); return; } /** * \brief management thread. This thread is responsible for writing the stats * * \param arg thread var * * \retval NULL This is the value that is always returned */ static void *StatsMgmtThread(void *arg) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); ThreadVars *tv_local = (ThreadVars *)arg; uint8_t run = 1; struct timespec cond_time; /* Set the thread name */ if (SCSetThreadName(tv_local->name) < 0) { SCLogWarning(SC_ERR_THREAD_INIT, "Unable to set thread name"); } if (tv_local->thread_setup_flags != 0) TmThreadSetupOptions(tv_local); /* Set the threads capability */ tv_local->cap_flags = 0; SCDropCaps(tv_local); if (stats_ctx == NULL) { SCLogError(SC_ERR_STATS_NOT_INIT, "Stats API not init" "StatsInitCounterApi() has to be called first"); TmThreadsSetFlag(tv_local, THV_CLOSED | THV_RUNNING_DONE); return NULL; } TmModule *tm = &tmm_modules[TMM_STATSLOGGER]; BUG_ON(tm->ThreadInit == NULL); int r = tm->ThreadInit(tv_local, NULL, &stats_thread_data); if (r != 0 || stats_thread_data == NULL) { SCLogError(SC_ERR_THREAD_INIT, "Stats API " "ThreadInit failed"); TmThreadsSetFlag(tv_local, THV_CLOSED | THV_RUNNING_DONE); return NULL; } SCLogDebug("stats_thread_data %p", &stats_thread_data); TmThreadsSetFlag(tv_local, THV_INIT_DONE); while (run) { if (TmThreadsCheckFlag(tv_local, THV_PAUSE)) { TmThreadsSetFlag(tv_local, THV_PAUSED); TmThreadTestThreadUnPaused(tv_local); TmThreadsUnsetFlag(tv_local, THV_PAUSED); } cond_time.tv_sec = time(NULL) + stats_tts; cond_time.tv_nsec = 0; /* wait for the set time, or until we are woken up by * the shutdown procedure */ SCCtrlMutexLock(tv_local->ctrl_mutex); SCCtrlCondTimedwait(tv_local->ctrl_cond, tv_local->ctrl_mutex, &cond_time); SCCtrlMutexUnlock(tv_local->ctrl_mutex); SCMutexLock(&stats_table_mutex); StatsOutput(tv_local); SCMutexUnlock(&stats_table_mutex); if (TmThreadsCheckFlag(tv_local, THV_KILL)) { run = 0; } } TmThreadsSetFlag(tv_local, THV_RUNNING_DONE); TmThreadWaitForFlag(tv_local, THV_DEINIT); r = tm->ThreadDeinit(tv_local, stats_thread_data); if (r != TM_ECODE_OK) { SCLogError(SC_ERR_THREAD_DEINIT, "Stats Counter API " "ThreadDeinit failed"); } TmThreadsSetFlag(tv_local, THV_CLOSED); return NULL; } /** * \brief Wake up thread. This thread wakes up every TTS(time to sleep) seconds * and sets the flag for every ThreadVars' StatsPublicThreadContext * * \param arg is NULL always * * \retval NULL This is the value that is always returned */ static void *StatsWakeupThread(void *arg) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); ThreadVars *tv_local = (ThreadVars *)arg; uint8_t run = 1; ThreadVars *tv = NULL; PacketQueue *q = NULL; struct timespec cond_time; /* Set the thread name */ if (SCSetThreadName(tv_local->name) < 0) { SCLogWarning(SC_ERR_THREAD_INIT, "Unable to set thread name"); } if (tv_local->thread_setup_flags != 0) TmThreadSetupOptions(tv_local); /* Set the threads capability */ tv_local->cap_flags = 0; SCDropCaps(tv_local); if (stats_ctx == NULL) { SCLogError(SC_ERR_STATS_NOT_INIT, "Stats API not init" "StatsInitCounterApi() has to be called first"); TmThreadsSetFlag(tv_local, THV_CLOSED | THV_RUNNING_DONE); return NULL; } TmThreadsSetFlag(tv_local, THV_INIT_DONE); while (run) { if (TmThreadsCheckFlag(tv_local, THV_PAUSE)) { TmThreadsSetFlag(tv_local, THV_PAUSED); TmThreadTestThreadUnPaused(tv_local); TmThreadsUnsetFlag(tv_local, THV_PAUSED); } cond_time.tv_sec = time(NULL) + STATS_WUT_TTS; cond_time.tv_nsec = 0; /* wait for the set time, or until we are woken up by * the shutdown procedure */ SCCtrlMutexLock(tv_local->ctrl_mutex); SCCtrlCondTimedwait(tv_local->ctrl_cond, tv_local->ctrl_mutex, &cond_time); SCCtrlMutexUnlock(tv_local->ctrl_mutex); tv = tv_root[TVT_PPT]; while (tv != NULL) { if (tv->perf_public_ctx.head == NULL) { tv = tv->next; continue; } /* assuming the assignment of an int to be atomic, and even if it's * not, it should be okay */ tv->perf_public_ctx.perf_flag = 1; if (tv->inq != NULL) { q = &trans_q[tv->inq->id]; SCCondSignal(&q->cond_q); } tv = tv->next; } /* mgt threads for flow manager */ tv = tv_root[TVT_MGMT]; while (tv != NULL) { if (tv->perf_public_ctx.head == NULL) { tv = tv->next; continue; } /* assuming the assignment of an int to be atomic, and even if it's * not, it should be okay */ tv->perf_public_ctx.perf_flag = 1; tv = tv->next; } if (TmThreadsCheckFlag(tv_local, THV_KILL)) { run = 0; } } TmThreadsSetFlag(tv_local, THV_RUNNING_DONE); TmThreadWaitForFlag(tv_local, THV_DEINIT); TmThreadsSetFlag(tv_local, THV_CLOSED); return NULL; } /** * \brief Releases a counter * * \param pc Pointer to the StatsCounter to be freed */ static void StatsReleaseCounter(StatsCounter *pc) { if (pc != NULL) { SCFree(pc); } return; } /** * \brief Registers a counter. * * \param name Name of the counter, to be registered * \param tm_name Thread module to which this counter belongs * \param pctx StatsPublicThreadContext for this tm-tv instance * \param type_q Qualifier describing the type of counter to be registered * * \retval the counter id for the newly registered counter, or the already * present counter on success * \retval 0 on failure */ static uint16_t StatsRegisterQualifiedCounter(char *name, char *tm_name, StatsPublicThreadContext *pctx, int type_q, uint64_t (*Func)(void)) { StatsCounter **head = &pctx->head; StatsCounter *temp = NULL; StatsCounter *prev = NULL; StatsCounter *pc = NULL; if (name == NULL || pctx == NULL) { SCLogDebug("Counter name, StatsPublicThreadContext NULL"); return 0; } temp = prev = *head; while (temp != NULL) { prev = temp; if (strcmp(name, temp->name) == 0) { break; } temp = temp->next; } /* We already have a counter registered by this name */ if (temp != NULL) return(temp->id); /* if we reach this point we don't have a counter registered by this name */ if ( (pc = SCMalloc(sizeof(StatsCounter))) == NULL) return 0; memset(pc, 0, sizeof(StatsCounter)); /* assign a unique id to this StatsCounter. The id is local to this * thread context. Please note that the id start from 1, and not 0 */ pc->id = ++(pctx->curr_id); pc->name = name; pc->type = type_q; pc->Func = Func; /* we now add the counter to the list */ if (prev == NULL) *head = pc; else prev->next = pc; return pc->id; } /** * \brief Copies the StatsCounter value from the local counter present in the * StatsPrivateThreadContext to its corresponding global counterpart. Used * internally by StatsUpdateCounterArray() * * \param pcae Pointer to the StatsPrivateThreadContext which holds the local * versions of the counters */ static void StatsCopyCounterValue(StatsLocalCounter *pcae) { StatsCounter *pc = pcae->pc; pc->value = pcae->value; pc->updates = pcae->updates; return; } /** * \brief The output interface for the Stats API */ static int StatsOutput(ThreadVars *tv) { const StatsThreadStore *sts = NULL; const StatsCounter *pc = NULL; void *td = stats_thread_data; if (counters_global_id == 0) return -1; if (stats_table.nstats == 0) { StatsThreadRegister("Global", &stats_ctx->global_counter_ctx); uint32_t nstats = counters_global_id; stats_table.nstats = nstats; stats_table.stats = SCCalloc(stats_table.nstats, sizeof(StatsRecord)); if (stats_table.stats == NULL) { stats_table.nstats = 0; SCLogError(SC_ERR_MEM_ALLOC, "could not alloc memory for stats"); return -1; } stats_table.ntstats = stats_ctx->sts_cnt; uint32_t array_size = stats_table.nstats * sizeof(StatsRecord); stats_table.tstats = SCCalloc(stats_table.ntstats, array_size); if (stats_table.tstats == NULL) { stats_table.ntstats = 0; SCLogError(SC_ERR_MEM_ALLOC, "could not alloc memory for stats"); return -1; } stats_table.start_time = stats_start_time; } const uint16_t max_id = counters_global_id; if (max_id == 0) return -1; /** temporary local table to merge the per thread counters, * especially needed for the average counters */ struct CountersMergeTable { int type; uint64_t value; uint64_t updates; } merge_table[max_id]; memset(&merge_table, 0x00, max_id * sizeof(struct CountersMergeTable)); int thread = stats_ctx->sts_cnt - 1; StatsRecord *table = stats_table.stats; /* Loop through the thread counter stores. The global counters * are in a separate store inside this list. */ sts = stats_ctx->sts; SCLogDebug("sts %p", sts); while (sts != NULL) { BUG_ON(thread < 0); SCLogDebug("Thread %d %s ctx %p", thread, sts->name, sts->ctx); /* temporay table for quickly storing the counters for this * thread store, so that we can post process them outside * of the thread store lock */ struct CountersMergeTable thread_table[max_id]; memset(&thread_table, 0x00, max_id * sizeof(struct CountersMergeTable)); SCMutexLock(&sts->ctx->m); pc = sts->ctx->head; while (pc != NULL) { SCLogDebug("Counter %s (%u:%u) value %"PRIu64, pc->name, pc->id, pc->gid, pc->value); thread_table[pc->gid].type = pc->type; switch (pc->type) { case STATS_TYPE_FUNC: if (pc->Func != NULL) thread_table[pc->gid].value = pc->Func(); break; case STATS_TYPE_AVERAGE: default: thread_table[pc->gid].value = pc->value; break; } thread_table[pc->gid].updates = pc->updates; table[pc->gid].name = pc->name; pc = pc->next; } SCMutexUnlock(&sts->ctx->m); /* update merge table */ uint16_t c; for (c = 0; c < max_id; c++) { struct CountersMergeTable *e = &thread_table[c]; /* thread only sets type if it has a counter * of this type. */ if (e->type == 0) continue; switch (e->type) { case STATS_TYPE_MAXIMUM: if (e->value > merge_table[c].value) merge_table[c].value = e->value; break; case STATS_TYPE_FUNC: merge_table[c].value = e->value; break; case STATS_TYPE_AVERAGE: default: merge_table[c].value += e->value; break; } merge_table[c].updates += e->updates; merge_table[c].type = e->type; } /* update per thread stats table */ for (c = 0; c < max_id; c++) { struct CountersMergeTable *e = &thread_table[c]; /* thread only sets type if it has a counter * of this type. */ if (e->type == 0) continue; uint32_t offset = (thread * stats_table.nstats) + c; StatsRecord *r = &stats_table.tstats[offset]; /* xfer previous value to pvalue and reset value */ r->pvalue = r->value; r->value = 0; r->name = table[c].name; r->tm_name = sts->name; switch (e->type) { case STATS_TYPE_AVERAGE: if (e->value > 0 && e->updates > 0) { r->value = (uint64_t)(e->value / e->updates); } break; default: r->value = e->value; break; } } sts = sts->next; thread--; } /* transfer 'merge table' to final stats table */ uint16_t x; for (x = 0; x < max_id; x++) { /* xfer previous value to pvalue and reset value */ table[x].pvalue = table[x].value; table[x].value = 0; table[x].tm_name = "Total"; struct CountersMergeTable *m = &merge_table[x]; switch (m->type) { case STATS_TYPE_MAXIMUM: if (m->value > table[x].value) table[x].value = m->value; break; case STATS_TYPE_AVERAGE: if (m->value > 0 && m->updates > 0) { table[x].value = (uint64_t)(m->value / m->updates); } break; default: table[x].value += m->value; break; } } /* invoke logger(s) */ if (stats_loggers_active) { OutputStatsLog(tv, td, &stats_table); } return 1; } #ifdef BUILD_UNIX_SOCKET /** \brief callback for getting stats into unix socket */ TmEcode StatsOutputCounterSocket(json_t *cmd, json_t *answer, void *data) { json_t *message = NULL; TmEcode r = TM_ECODE_OK; SCMutexLock(&stats_table_mutex); if (stats_table.start_time == 0) { r = TM_ECODE_FAILED; message = json_string("stats not yet synchronized"); } else { message = StatsToJSON(&stats_table, JSON_STATS_TOTALS|JSON_STATS_THREADS); } SCMutexUnlock(&stats_table_mutex); json_object_set_new(answer, "message", message); return r; } #endif /* BUILD_UNIX_SOCKET */ /** * \brief Initializes the perf counter api. Things are hard coded currently. * More work to be done when we implement multiple interfaces */ void StatsInit(void) { BUG_ON(stats_ctx != NULL); if ( (stats_ctx = SCMalloc(sizeof(StatsGlobalContext))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in StatsInitCtx. Exiting..."); exit(EXIT_FAILURE); } memset(stats_ctx, 0, sizeof(StatsGlobalContext)); StatsPublicThreadContextInit(&stats_ctx->global_counter_ctx); } void StatsSetupPostConfig(void) { StatsInitCtx(); } /** * \brief Spawns the wakeup, and the management thread used by the stats api * * The threads use the condition variable in the thread vars to control * their wait loops to make sure the main thread can quickly kill them. */ void StatsSpawnThreads(void) { SCEnter(); if (!stats_enabled) { SCReturn; } ThreadVars *tv_wakeup = NULL; ThreadVars *tv_mgmt = NULL; /* spawn the stats wakeup thread */ tv_wakeup = TmThreadCreateMgmtThread(thread_name_counter_wakeup, StatsWakeupThread, 1); if (tv_wakeup == NULL) { SCLogError(SC_ERR_THREAD_CREATE, "TmThreadCreateMgmtThread " "failed"); exit(EXIT_FAILURE); } if (TmThreadSpawn(tv_wakeup) != 0) { SCLogError(SC_ERR_THREAD_SPAWN, "TmThreadSpawn failed for " "StatsWakeupThread"); exit(EXIT_FAILURE); } /* spawn the stats mgmt thread */ tv_mgmt = TmThreadCreateMgmtThread(thread_name_counter_stats, StatsMgmtThread, 1); if (tv_mgmt == NULL) { SCLogError(SC_ERR_THREAD_CREATE, "TmThreadCreateMgmtThread failed"); exit(EXIT_FAILURE); } if (TmThreadSpawn(tv_mgmt) != 0) { SCLogError(SC_ERR_THREAD_SPAWN, "TmThreadSpawn failed for " "StatsWakeupThread"); exit(EXIT_FAILURE); } SCReturn; } /** * \brief Registers a normal, unqualified counter * * \param name Name of the counter, to be registered * \param tv Pointer to the ThreadVars instance for which the counter would * be registered * * \retval id Counter id for the newly registered counter, or the already * present counter */ uint16_t StatsRegisterCounter(char *name, struct ThreadVars_ *tv) { uint16_t id = StatsRegisterQualifiedCounter(name, (tv->thread_group_name != NULL) ? tv->thread_group_name : tv->name, &tv->perf_public_ctx, STATS_TYPE_NORMAL, NULL); return id; } /** * \brief Registers a counter, whose value holds the average of all the values * assigned to it. * * \param name Name of the counter, to be registered * \param tv Pointer to the ThreadVars instance for which the counter would * be registered * * \retval id Counter id for the newly registered counter, or the already * present counter */ uint16_t StatsRegisterAvgCounter(char *name, struct ThreadVars_ *tv) { uint16_t id = StatsRegisterQualifiedCounter(name, (tv->thread_group_name != NULL) ? tv->thread_group_name : tv->name, &tv->perf_public_ctx, STATS_TYPE_AVERAGE, NULL); return id; } /** * \brief Registers a counter, whose value holds the maximum of all the values * assigned to it. * * \param name Name of the counter, to be registered * \param tv Pointer to the ThreadVars instance for which the counter would * be registered * * \retval the counter id for the newly registered counter, or the already * present counter */ uint16_t StatsRegisterMaxCounter(char *name, struct ThreadVars_ *tv) { uint16_t id = StatsRegisterQualifiedCounter(name, (tv->thread_group_name != NULL) ? tv->thread_group_name : tv->name, &tv->perf_public_ctx, STATS_TYPE_MAXIMUM, NULL); return id; } /** * \brief Registers a counter, which represents a global value * * \param name Name of the counter, to be registered * \param Func Function Pointer returning a uint64_t * * \retval id Counter id for the newly registered counter, or the already * present counter */ uint16_t StatsRegisterGlobalCounter(char *name, uint64_t (*Func)(void)) { #ifdef UNITTESTS if (stats_ctx == NULL) return 0; #else BUG_ON(stats_ctx == NULL); #endif uint16_t id = StatsRegisterQualifiedCounter(name, NULL, &(stats_ctx->global_counter_ctx), STATS_TYPE_FUNC, Func); return id; } typedef struct CountersIdType_ { uint16_t id; const char *string; } CountersIdType; uint32_t CountersIdHashFunc(HashTable *ht, void *data, uint16_t datalen) { CountersIdType *t = (CountersIdType *)data; uint32_t hash = 0; int i = 0; int len = strlen(t->string); for (i = 0; i < len; i++) hash += tolower((unsigned char)t->string[i]); hash = hash % ht->array_size; return hash; } char CountersIdHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2) { CountersIdType *t1 = (CountersIdType *)data1; CountersIdType *t2 = (CountersIdType *)data2; int len1 = 0; int len2 = 0; if (t1 == NULL || t2 == NULL) return 0; if (t1->string == NULL || t2->string == NULL) return 0; len1 = strlen(t1->string); len2 = strlen(t2->string); if (len1 == len2 && memcmp(t1->string, t2->string, len1) == 0) { return 1; } return 0; } void CountersIdHashFreeFunc(void *data) { SCFree(data); } /** \internal * \brief Adds a TM to the clubbed TM table. Multiple instances of the same TM * are stacked together in a PCTMI container. * * \param tm_name Name of the tm to be added to the table * \param pctx StatsPublicThreadContext associated with the TM tm_name * * \retval 1 on success, 0 on failure */ static int StatsThreadRegister(const char *thread_name, StatsPublicThreadContext *pctx) { if (stats_ctx == NULL) { SCLogDebug("Counter module has been disabled"); return 0; } StatsThreadStore *temp = NULL; if (thread_name == NULL || pctx == NULL) { SCLogDebug("supplied argument(s) to StatsThreadRegister NULL"); return 0; } SCMutexLock(&stats_ctx->sts_lock); if (stats_ctx->counters_id_hash == NULL) { stats_ctx->counters_id_hash = HashTableInit(256, CountersIdHashFunc, CountersIdHashCompareFunc, CountersIdHashFreeFunc); BUG_ON(stats_ctx->counters_id_hash == NULL); } StatsCounter *pc = pctx->head; while (pc != NULL) { CountersIdType t = { 0, pc->name }, *id = NULL; id = HashTableLookup(stats_ctx->counters_id_hash, &t, sizeof(t)); if (id == NULL) { id = SCCalloc(1, sizeof(*id)); BUG_ON(id == NULL); id->id = counters_global_id++; id->string = pc->name; BUG_ON(HashTableAdd(stats_ctx->counters_id_hash, id, sizeof(*id)) < 0); } pc->gid = id->id; pc = pc->next; } if ( (temp = SCMalloc(sizeof(StatsThreadStore))) == NULL) { SCMutexUnlock(&stats_ctx->sts_lock); return 0; } memset(temp, 0, sizeof(StatsThreadStore)); temp->ctx = pctx; temp->name = thread_name; temp->next = stats_ctx->sts; stats_ctx->sts = temp; stats_ctx->sts_cnt++; SCLogDebug("stats_ctx->sts %p", stats_ctx->sts); SCMutexUnlock(&stats_ctx->sts_lock); return 1; } /** \internal * \brief Returns a counter array for counters in this id range(s_id - e_id) * * \param s_id Counter id of the first counter to be added to the array * \param e_id Counter id of the last counter to be added to the array * \param pctx Pointer to the tv's StatsPublicThreadContext * * \retval a counter-array in this(s_id-e_id) range for this TM instance */ static int StatsGetCounterArrayRange(uint16_t s_id, uint16_t e_id, StatsPublicThreadContext *pctx, StatsPrivateThreadContext *pca) { StatsCounter *pc = NULL; uint32_t i = 0; if (pctx == NULL || pca == NULL) { SCLogDebug("pctx/pca is NULL"); return -1; } if (s_id < 1 || e_id < 1 || s_id > e_id) { SCLogDebug("error with the counter ids"); return -1; } if (e_id > pctx->curr_id) { SCLogDebug("end id is greater than the max id for this tv"); return -1; } if ( (pca->head = SCMalloc(sizeof(StatsLocalCounter) * (e_id - s_id + 2))) == NULL) { return -1; } memset(pca->head, 0, sizeof(StatsLocalCounter) * (e_id - s_id + 2)); pc = pctx->head; while (pc->id != s_id) pc = pc->next; i = 1; while ((pc != NULL) && (pc->id <= e_id)) { pca->head[i].pc = pc; pca->head[i].id = pc->id; pc = pc->next; i++; } pca->size = i - 1; pca->initialized = 1; return 0; } /** \internal * \brief Returns a counter array for all counters registered for this tm * instance * * \param pctx Pointer to the tv's StatsPublicThreadContext * * \retval pca Pointer to a counter-array for all counter of this tm instance * on success; NULL on failure */ static int StatsGetAllCountersArray(StatsPublicThreadContext *pctx, StatsPrivateThreadContext *private) { if (pctx == NULL || private == NULL) return -1; return StatsGetCounterArrayRange(1, pctx->curr_id, pctx, private); } int StatsSetupPrivate(ThreadVars *tv) { StatsGetAllCountersArray(&(tv)->perf_public_ctx, &(tv)->perf_private_ctx); StatsThreadRegister(tv->name, &(tv)->perf_public_ctx); return 0; } /** * \brief Syncs the counter array with the global counter variables * * \param pca Pointer to the StatsPrivateThreadContext * \param pctx Pointer the the tv's StatsPublicThreadContext * * \retval 0 on success * \retval -1 on error */ int StatsUpdateCounterArray(StatsPrivateThreadContext *pca, StatsPublicThreadContext *pctx) { StatsLocalCounter *pcae = NULL; uint32_t i = 0; if (pca == NULL || pctx == NULL) { SCLogDebug("pca or pctx is NULL inside StatsUpdateCounterArray"); return -1; } pcae = pca->head; SCMutexLock(&pctx->m); for (i = 1; i <= pca->size; i++) { StatsCopyCounterValue(&pcae[i]); } SCMutexUnlock(&pctx->m); pctx->perf_flag = 0; return 1; } /** * \brief Get the value of the local copy of the counter that hold this id. * * \param tv threadvars * \param id The counter id. * * \retval 0 on success. * \retval -1 on error. */ uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id) { StatsPrivateThreadContext *pca = &tv->perf_private_ctx; #ifdef DEBUG BUG_ON ((id < 1) || (id > pca->size)); #endif return pca->head[id].value; } /** * \brief Releases the resources alloted by the Stats API */ void StatsReleaseResources() { StatsReleaseCtx(); return; } /** * \brief Releases counters * * \param head Pointer to the head of the list of perf counters that have to * be freed */ void StatsReleaseCounters(StatsCounter *head) { StatsCounter *pc = NULL; while (head != NULL) { pc = head; head = head->next; StatsReleaseCounter(pc); } return; } /** * \brief Releases the StatsPrivateThreadContext allocated by the user, for storing and * updating local counter values * * \param pca Pointer to the StatsPrivateThreadContext */ void StatsReleasePrivateThreadContext(StatsPrivateThreadContext *pca) { if (pca != NULL) { if (pca->head != NULL) { SCFree(pca->head); pca->head = NULL; pca->size = 0; } pca->initialized = 0; } return; } void StatsThreadCleanup(ThreadVars *tv) { StatsPublicThreadContextCleanup(&tv->perf_public_ctx); StatsReleasePrivateThreadContext(&tv->perf_private_ctx); } /*----------------------------------Unit_Tests--------------------------------*/ #ifdef UNITTESTS /** \internal * \brief Registers a normal, unqualified counter * * \param name Name of the counter, to be registered * \param tm_name Name of the engine module under which the counter has to be * registered * \param type Datatype of this counter variable * \param pctx StatsPublicThreadContext corresponding to the tm_name key under which the * key has to be registered * * \retval id Counter id for the newly registered counter, or the already * present counter */ static uint16_t RegisterCounter(char *name, char *tm_name, StatsPublicThreadContext *pctx) { uint16_t id = StatsRegisterQualifiedCounter(name, tm_name, pctx, STATS_TYPE_NORMAL, NULL); return id; } static int StatsTestCounterReg02() { StatsPublicThreadContext pctx; memset(&pctx, 0, sizeof(StatsPublicThreadContext)); return RegisterCounter(NULL, NULL, &pctx) == 0; } static int StatsTestCounterReg03() { StatsPublicThreadContext pctx; int result; memset(&pctx, 0, sizeof(StatsPublicThreadContext)); result = RegisterCounter("t1", "c1", &pctx); StatsReleaseCounters(pctx.head); return result; } static int StatsTestCounterReg04() { StatsPublicThreadContext pctx; int result; memset(&pctx, 0, sizeof(StatsPublicThreadContext)); RegisterCounter("t1", "c1", &pctx); RegisterCounter("t2", "c2", &pctx); RegisterCounter("t3", "c3", &pctx); result = RegisterCounter("t1", "c1", &pctx); StatsReleaseCounters(pctx.head); return result; } static int StatsTestGetCntArray05() { ThreadVars tv; int id; memset(&tv, 0, sizeof(ThreadVars)); id = RegisterCounter("t1", "c1", &tv.perf_public_ctx); if (id != 1) { printf("id %d: ", id); return 0; } int r = StatsGetAllCountersArray(NULL, &tv.perf_private_ctx); return (r == -1) ? 1 : 0; } static int StatsTestGetCntArray06() { ThreadVars tv; int id; int result; memset(&tv, 0, sizeof(ThreadVars)); id = RegisterCounter("t1", "c1", &tv.perf_public_ctx); if (id != 1) return 0; int r = StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); result = (r == 0) ? 1 : 0; StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(&tv.perf_private_ctx); return result; } static int StatsTestCntArraySize07() { ThreadVars tv; StatsPrivateThreadContext *pca = NULL; int result; memset(&tv, 0, sizeof(ThreadVars)); //pca = (StatsPrivateThreadContext *)&tv.perf_private_ctx; RegisterCounter("t1", "c1", &tv.perf_public_ctx); RegisterCounter("t2", "c2", &tv.perf_public_ctx); StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); pca = &tv.perf_private_ctx; StatsIncr(&tv, 1); StatsIncr(&tv, 2); result = pca->size; StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(pca); PASS_IF(result == 2); } static int StatsTestUpdateCounter08() { ThreadVars tv; StatsPrivateThreadContext *pca = NULL; int id; int result; memset(&tv, 0, sizeof(ThreadVars)); id = RegisterCounter("t1", "c1", &tv.perf_public_ctx); StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); pca = &tv.perf_private_ctx; StatsIncr(&tv, id); StatsAddUI64(&tv, id, 100); result = pca->head[id].value; StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(pca); return result == 101; } static int StatsTestUpdateCounter09() { ThreadVars tv; StatsPrivateThreadContext *pca = NULL; uint16_t id1, id2; int result; memset(&tv, 0, sizeof(ThreadVars)); id1 = RegisterCounter("t1", "c1", &tv.perf_public_ctx); RegisterCounter("t2", "c2", &tv.perf_public_ctx); RegisterCounter("t3", "c3", &tv.perf_public_ctx); RegisterCounter("t4", "c4", &tv.perf_public_ctx); id2 = RegisterCounter("t5", "c5", &tv.perf_public_ctx); StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); pca = &tv.perf_private_ctx; StatsIncr(&tv, id2); StatsAddUI64(&tv, id2, 100); result = (pca->head[id1].value == 0) && (pca->head[id2].value == 101); StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(pca); return result; } static int StatsTestUpdateGlobalCounter10() { ThreadVars tv; StatsPrivateThreadContext *pca = NULL; int result = 1; uint16_t id1, id2, id3; memset(&tv, 0, sizeof(ThreadVars)); id1 = RegisterCounter("t1", "c1", &tv.perf_public_ctx); id2 = RegisterCounter("t2", "c2", &tv.perf_public_ctx); id3 = RegisterCounter("t3", "c3", &tv.perf_public_ctx); StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); pca = &tv.perf_private_ctx; StatsIncr(&tv, id1); StatsAddUI64(&tv, id2, 100); StatsIncr(&tv, id3); StatsAddUI64(&tv, id3, 100); StatsUpdateCounterArray(pca, &tv.perf_public_ctx); result = (1 == tv.perf_public_ctx.head->value); result &= (100 == tv.perf_public_ctx.head->next->value); result &= (101 == tv.perf_public_ctx.head->next->next->value); StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(pca); return result; } static int StatsTestCounterValues11() { ThreadVars tv; StatsPrivateThreadContext *pca = NULL; int result = 1; uint16_t id1, id2, id3, id4; memset(&tv, 0, sizeof(ThreadVars)); id1 = RegisterCounter("t1", "c1", &tv.perf_public_ctx); id2 = RegisterCounter("t2", "c2", &tv.perf_public_ctx); id3 = RegisterCounter("t3", "c3", &tv.perf_public_ctx); id4 = RegisterCounter("t4", "c4", &tv.perf_public_ctx); StatsGetAllCountersArray(&tv.perf_public_ctx, &tv.perf_private_ctx); pca = &tv.perf_private_ctx; StatsIncr(&tv, id1); StatsAddUI64(&tv, id2, 256); StatsAddUI64(&tv, id3, 257); StatsAddUI64(&tv, id4, 16843024); StatsUpdateCounterArray(pca, &tv.perf_public_ctx); result &= (1 == tv.perf_public_ctx.head->value); result &= (256 == tv.perf_public_ctx.head->next->value); result &= (257 == tv.perf_public_ctx.head->next->next->value); result &= (16843024 == tv.perf_public_ctx.head->next->next->next->value); StatsReleaseCounters(tv.perf_public_ctx.head); StatsReleasePrivateThreadContext(pca); return result; } #endif void StatsRegisterTests() { #ifdef UNITTESTS UtRegisterTest("StatsTestCounterReg02", StatsTestCounterReg02); UtRegisterTest("StatsTestCounterReg03", StatsTestCounterReg03); UtRegisterTest("StatsTestCounterReg04", StatsTestCounterReg04); UtRegisterTest("StatsTestGetCntArray05", StatsTestGetCntArray05); UtRegisterTest("StatsTestGetCntArray06", StatsTestGetCntArray06); UtRegisterTest("StatsTestCntArraySize07", StatsTestCntArraySize07); UtRegisterTest("StatsTestUpdateCounter08", StatsTestUpdateCounter08); UtRegisterTest("StatsTestUpdateCounter09", StatsTestUpdateCounter09); UtRegisterTest("StatsTestUpdateGlobalCounter10", StatsTestUpdateGlobalCounter10); UtRegisterTest("StatsTestCounterValues11", StatsTestCounterValues11); #endif } suricata-3.2.1/src/detect-engine-dns.h0000644000000000000000000000345013051004444014451 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_DNS_H__ #define __DETECT_ENGINE_DNS_H__ int PrefilterTxDnsQueryRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectDnsQueryName(ThreadVars *, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, void *, uint64_t); int DetectEngineInspectDnsRequest(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); int DetectEngineInspectDnsResponse(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); #endif /* __DETECT_ENGINE_DNS_H__ */ suricata-3.2.1/src/detect-engine-port.h0000644000000000000000000000354513051004444014656 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PORT_H__ #define __DETECT_PORT_H__ /* prototypes */ int DetectPortParse(const DetectEngineCtx *, DetectPort **head, char *str); DetectPort *DetectPortCopy(DetectEngineCtx *, DetectPort *); DetectPort *DetectPortCopySingle(DetectEngineCtx *, DetectPort *); int DetectPortInsertCopy(DetectEngineCtx *,DetectPort **, DetectPort *); int DetectPortInsert(DetectEngineCtx *,DetectPort **, DetectPort *); void DetectPortCleanupList (DetectPort *head); DetectPort *DetectPortLookupGroup(DetectPort *dp, uint16_t port); int DetectPortJoin(DetectEngineCtx *,DetectPort *target, DetectPort *source); void DetectPortPrint(DetectPort *); void DetectPortPrintList(DetectPort *head); int DetectPortCmp(DetectPort *, DetectPort *); void DetectPortFree(DetectPort *); int DetectPortTestConfVars(void); DetectPort *DetectPortHashLookup(DetectEngineCtx *de_ctx, DetectPort *dp); void DetectPortHashFree(DetectEngineCtx *de_ctx); int DetectPortHashAdd(DetectEngineCtx *de_ctx, DetectPort *dp); int DetectPortHashInit(DetectEngineCtx *de_ctx); void DetectPortTests(void); #endif /* __DETECT_PORT_H__ */ suricata-3.2.1/src/runmodes.c0000644000000000000000000006474713051004444013023 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien * * Pre-cooked threading runmodes. */ #include "suricata-common.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "tm-threads.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-byte.h" #include "util-affinity.h" #include "conf.h" #include "queue.h" #include "runmodes.h" #include "util-unittest.h" #include "util-misc.h" #include "alert-fastlog.h" #include "alert-prelude.h" #include "alert-unified2-alert.h" #include "alert-debuglog.h" #include "log-httplog.h" #include "output.h" #include "source-pfring.h" #include "tmqh-flow.h" #include "flow-manager.h" #include "counters.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #endif int debuglog_enabled = 0; /* Runmode Global Thread Names */ const char *thread_name_autofp = "RX"; const char *thread_name_single = "W"; const char *thread_name_workers = "W"; const char *thread_name_verdict = "TX"; const char *thread_name_flow_mgr = "FM"; const char *thread_name_flow_rec = "FR"; const char *thread_name_unix_socket = "US"; const char *thread_name_detect_loader = "DL"; const char *thread_name_counter_stats = "CS"; const char *thread_name_counter_wakeup = "CW"; /** * \brief Holds description for a runmode. */ typedef struct RunMode_ { /* the runmode type */ int runmode; const char *name; const char *description; /* runmode function */ int (*RunModeFunc)(void); } RunMode; typedef struct RunModes_ { int no_of_runmodes; RunMode *runmodes; } RunModes; static RunModes runmodes[RUNMODE_USER_MAX]; static char *active_runmode; /* free list for our outputs */ typedef struct OutputFreeList_ { OutputModule *output_module; OutputCtx *output_ctx; TAILQ_ENTRY(OutputFreeList_) entries; } OutputFreeList; static TAILQ_HEAD(, OutputFreeList_) output_free_list = TAILQ_HEAD_INITIALIZER(output_free_list); /** * \internal * \brief Translate a runmode mode to a printale string. * * \param runmode Runmode to be converted into a printable string. * * \retval string Printable string. */ static const char *RunModeTranslateModeToName(int runmode) { switch (runmode) { case RUNMODE_PCAP_DEV: return "PCAP_DEV"; case RUNMODE_PCAP_FILE: return "PCAP_FILE"; case RUNMODE_PFRING: #ifdef HAVE_PFRING return "PFRING"; #else return "PFRING(DISABLED)"; #endif case RUNMODE_NFQ: return "NFQ"; case RUNMODE_NFLOG: return "NFLOG"; case RUNMODE_IPFW: return "IPFW"; case RUNMODE_ERF_FILE: return "ERF_FILE"; case RUNMODE_DAG: return "ERF_DAG"; case RUNMODE_NAPATECH: return "NAPATECH"; case RUNMODE_UNITTEST: return "UNITTEST"; case RUNMODE_TILERA_MPIPE: return "MPIPE"; case RUNMODE_AFP_DEV: return "AF_PACKET_DEV"; case RUNMODE_NETMAP: #ifdef HAVE_NETMAP return "NETMAP"; #else return "NETMAP(DISABLED)"; #endif case RUNMODE_UNIX_SOCKET: return "UNIX_SOCKET"; default: SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting"); exit(EXIT_FAILURE); } } /** * \internal * \brief Dispatcher function for runmodes. Calls the required runmode function * based on runmode + runmode_custom_id. * * \param runmode The runmode type. * \param runmode_customd_id The runmode custom id. */ static RunMode *RunModeGetCustomMode(int runmode, const char *custom_mode) { int i; for (i = 0; i < runmodes[runmode].no_of_runmodes; i++) { if (strcmp(runmodes[runmode].runmodes[i].name, custom_mode) == 0) return &runmodes[runmode].runmodes[i]; } return NULL; } /** * Return the running mode * * The returned string must not be freed. * * \return a string containing the current running mode */ char *RunmodeGetActive(void) { return active_runmode; } /** * Return the running mode * * The returned string must not be freed. * * \return a string containing the current running mode */ const char *RunModeGetMainMode(void) { int mainmode = RunmodeGetCurrent(); return RunModeTranslateModeToName(mainmode); } /** * \brief Register all runmodes in the engine. */ void RunModeRegisterRunModes(void) { memset(runmodes, 0, sizeof(runmodes)); RunModeIdsPcapRegister(); RunModeFilePcapRegister(); RunModeIdsPfringRegister(); RunModeIpsNFQRegister(); RunModeIpsIPFWRegister(); RunModeErfFileRegister(); RunModeErfDagRegister(); RunModeNapatechRegister(); RunModeIdsAFPRegister(); RunModeIdsNetmapRegister(); RunModeIdsNflogRegister(); RunModeTileMpipeRegister(); RunModeUnixSocketRegister(); #ifdef UNITTESTS UtRunModeRegister(); #endif return; } /** * \brief Lists all registered runmodes. */ void RunModeListRunmodes(void) { printf("------------------------------------- Runmodes -------------------" "-----------------------\n"); printf("| %-17s | %-17s | %-10s \n", "RunMode Type", "Custom Mode ", "Description"); printf("|-----------------------------------------------------------------" "-----------------------\n"); int i = RUNMODE_UNKNOWN + 1; int j = 0; for ( ; i < RUNMODE_USER_MAX; i++) { int mode_displayed = 0; for (j = 0; j < runmodes[i].no_of_runmodes; j++) { if (mode_displayed == 1) { printf("| ----------------------------------------------" "-----------------------\n"); RunMode *runmode = &runmodes[i].runmodes[j]; printf("| %-17s | %-17s | %-27s \n", "", runmode->name, runmode->description); } else { RunMode *runmode = &runmodes[i].runmodes[j]; printf("| %-17s | %-17s | %-27s \n", RunModeTranslateModeToName(runmode->runmode), runmode->name, runmode->description); } if (mode_displayed == 0) mode_displayed = 1; } if (mode_displayed == 1) { printf("|-----------------------------------------------------------------" "-----------------------\n"); } } return; } /** */ void RunModeDispatch(int runmode, const char *custom_mode) { char *local_custom_mode = NULL; if (custom_mode == NULL) { char *val = NULL; if (ConfGet("runmode", &val) != 1) { custom_mode = NULL; } else { custom_mode = val; } } if (custom_mode == NULL || strcmp(custom_mode, "auto") == 0) { switch (runmode) { case RUNMODE_PCAP_DEV: custom_mode = RunModeIdsGetDefaultMode(); break; case RUNMODE_PCAP_FILE: custom_mode = RunModeFilePcapGetDefaultMode(); break; #ifdef HAVE_PFRING case RUNMODE_PFRING: custom_mode = RunModeIdsPfringGetDefaultMode(); break; #endif case RUNMODE_NFQ: custom_mode = RunModeIpsNFQGetDefaultMode(); break; case RUNMODE_IPFW: custom_mode = RunModeIpsIPFWGetDefaultMode(); break; case RUNMODE_ERF_FILE: custom_mode = RunModeErfFileGetDefaultMode(); break; case RUNMODE_DAG: custom_mode = RunModeErfDagGetDefaultMode(); break; case RUNMODE_TILERA_MPIPE: custom_mode = RunModeTileMpipeGetDefaultMode(); break; case RUNMODE_NAPATECH: custom_mode = RunModeNapatechGetDefaultMode(); break; case RUNMODE_AFP_DEV: custom_mode = RunModeAFPGetDefaultMode(); break; case RUNMODE_NETMAP: custom_mode = RunModeNetmapGetDefaultMode(); break; case RUNMODE_UNIX_SOCKET: custom_mode = RunModeUnixSocketGetDefaultMode(); break; case RUNMODE_NFLOG: custom_mode = RunModeIdsNflogGetDefaultMode(); break; default: SCLogError(SC_ERR_UNKNOWN_RUN_MODE, "Unknown runtime mode. Aborting"); exit(EXIT_FAILURE); } } else { /* if (custom_mode == NULL) */ /* Add compability with old 'worker' name */ if (!strcmp("worker", custom_mode)) { SCLogWarning(SC_ERR_RUNMODE, "'worker' mode have been renamed " "to 'workers', please modify your setup."); local_custom_mode = SCStrdup("workers"); if (unlikely(local_custom_mode == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup custom mode"); exit(EXIT_FAILURE); } custom_mode = local_custom_mode; } } #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA && strcasecmp(custom_mode, "autofp") != 0) { SCLogError(SC_ERR_RUNMODE, "When using a cuda mpm, the only runmode we " "support is autofp."); exit(EXIT_FAILURE); } #endif RunMode *mode = RunModeGetCustomMode(runmode, custom_mode); if (mode == NULL) { SCLogError(SC_ERR_RUNMODE, "The custom type \"%s\" doesn't exist " "for this runmode type \"%s\". Please use --list-runmodes to " "see available custom types for this runmode", custom_mode, RunModeTranslateModeToName(runmode)); exit(EXIT_FAILURE); } /* Export the custom mode */ if (active_runmode) { SCFree(active_runmode); } active_runmode = SCStrdup(custom_mode); if (unlikely(active_runmode == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to dup active mode"); exit(EXIT_FAILURE); } if (strcasecmp(active_runmode, "autofp") == 0) { TmqhFlowPrintAutofpHandler(); } mode->RunModeFunc(); if (local_custom_mode != NULL) SCFree(local_custom_mode); #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) SCACCudaStartDispatcher(); #endif /* Check if the alloted queues have at least 1 reader and writer */ TmValidateQueueState(); if (runmode != RUNMODE_UNIX_SOCKET) { /* spawn management threads */ FlowManagerThreadSpawn(); FlowRecyclerThreadSpawn(); StatsSpawnThreads(); } } /** * \brief Registers a new runmode. * * \param runmode Runmode type. * \param name Custom mode for this specific runmode type. Within each * runmode type, each custom name is a primary key. * \param description Description for this runmode. * \param RunModeFunc The function to be run for this runmode. */ void RunModeRegisterNewRunMode(int runmode, const char *name, const char *description, int (*RunModeFunc)(void)) { void *ptmp; if (RunModeGetCustomMode(runmode, name) != NULL) { SCLogError(SC_ERR_RUNMODE, "A runmode by this custom name has already " "been registered. Please use an unique name"); return; } ptmp = SCRealloc(runmodes[runmode].runmodes, (runmodes[runmode].no_of_runmodes + 1) * sizeof(RunMode)); if (ptmp == NULL) { SCFree(runmodes[runmode].runmodes); runmodes[runmode].runmodes = NULL; exit(EXIT_FAILURE); } runmodes[runmode].runmodes = ptmp; RunMode *mode = &runmodes[runmode].runmodes[runmodes[runmode].no_of_runmodes]; runmodes[runmode].no_of_runmodes++; mode->runmode = runmode; mode->name = SCStrdup(name); if (unlikely(mode->name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string"); exit(EXIT_FAILURE); } mode->description = SCStrdup(description); if (unlikely(mode->description == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate string"); exit(EXIT_FAILURE); } mode->RunModeFunc = RunModeFunc; return; } /** * Setup the outputs for this run mode. * * \param tv The ThreadVars for the thread the outputs will be * appended to. */ static void RunOutputFreeList(void) { OutputFreeList *output; while ((output = TAILQ_FIRST(&output_free_list))) { SCLogDebug("output %s %p %p", output->output_module->name, output, output->output_ctx); if (output->output_ctx != NULL && output->output_ctx->DeInit != NULL) output->output_ctx->DeInit(output->output_ctx); TAILQ_REMOVE(&output_free_list, output, entries); SCFree(output); } } static int file_logger_count = 0; static int filedata_logger_count = 0; int RunModeOutputFileEnabled(void) { return file_logger_count > 0; } int RunModeOutputFiledataEnabled(void) { return filedata_logger_count > 0; } /** * Cleanup the run mode. */ void RunModeShutDown(void) { RunOutputFreeList(); OutputPacketShutdown(); OutputTxShutdown(); OutputFileShutdown(); OutputFiledataShutdown(); OutputStreamingShutdown(); OutputStatsShutdown(); OutputFlowShutdown(); /* Reset logger counts. */ file_logger_count = 0; filedata_logger_count = 0; } /** \internal * \brief add Sub RunModeOutput to list for Submodule so we can free * the output ctx at shutdown and unix socket reload */ static void AddOutputToFreeList(OutputModule *module, OutputCtx *output_ctx) { OutputFreeList *fl_output = SCCalloc(1, sizeof(OutputFreeList)); if (unlikely(fl_output == NULL)) return; fl_output->output_module = module; fl_output->output_ctx = output_ctx; TAILQ_INSERT_TAIL(&output_free_list, fl_output, entries); } /** \brief Turn output into thread module */ static void SetupOutput(const char *name, OutputModule *module, OutputCtx *output_ctx) { /* flow logger doesn't run in the packet path */ if (module->FlowLogFunc) { OutputRegisterFlowLogger(module->name, module->FlowLogFunc, output_ctx, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); return; } /* stats logger doesn't run in the packet path */ if (module->StatsLogFunc) { OutputRegisterStatsLogger(module->name, module->StatsLogFunc, output_ctx,module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); return; } if (module->logger_id == LOGGER_ALERT_DEBUG) { debuglog_enabled = 1; } if (module->PacketLogFunc) { SCLogDebug("%s is a packet logger", module->name); OutputRegisterPacketLogger(module->logger_id, module->name, module->PacketLogFunc, module->PacketConditionFunc, output_ctx, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); } else if (module->TxLogFunc) { SCLogDebug("%s is a tx logger", module->name); OutputRegisterTxLogger(module->logger_id, module->name, module->alproto, module->TxLogFunc, output_ctx, module->tc_log_progress, module->ts_log_progress, module->TxLogCondition, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); } else if (module->FiledataLogFunc) { SCLogDebug("%s is a filedata logger", module->name); OutputRegisterFiledataLogger(module->logger_id, module->name, module->FiledataLogFunc, output_ctx, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); filedata_logger_count++; } else if (module->FileLogFunc) { SCLogDebug("%s is a file logger", module->name); OutputRegisterFileLogger(module->logger_id, module->name, module->FileLogFunc, output_ctx, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); file_logger_count++; } else if (module->StreamingLogFunc) { SCLogDebug("%s is a streaming logger", module->name); OutputRegisterStreamingLogger(module->logger_id, module->name, module->StreamingLogFunc, output_ctx, module->stream_type, module->ThreadInit, module->ThreadDeinit, module->ThreadExitPrintStats); } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Unknown logger type: name=%s", module->name); } } static void RunModeInitializeEveOutput(ConfNode *conf, OutputCtx *parent_ctx) { ConfNode *types = ConfNodeLookupChild(conf, "types"); SCLogDebug("types %p", types); if (types == NULL) { return; } ConfNode *type = NULL; TAILQ_FOREACH(type, &types->head, next) { SCLogConfig("enabling 'eve-log' module '%s'", type->val); int sub_count = 0; char subname[256]; snprintf(subname, sizeof(subname), "eve-log.%s", type->val); /* Now setup all registers logger of this name. */ OutputModule *sub_module; TAILQ_FOREACH(sub_module, &output_modules, entries) { if (strcmp(subname, sub_module->conf_name) == 0) { sub_count++; if (sub_module->parent_name == NULL || strcmp(sub_module->parent_name, "eve-log") != 0) { FatalError(SC_ERR_INVALID_ARGUMENT, "bad parent for %s", subname); } if (sub_module->InitSubFunc == NULL) { FatalError(SC_ERR_INVALID_ARGUMENT, "bad sub-module for %s", subname); } ConfNode *sub_output_config = ConfNodeLookupChild(type, type->val); // sub_output_config may be NULL if no config /* pass on parent output_ctx */ OutputCtx *sub_output_ctx = sub_module->InitSubFunc(sub_output_config, parent_ctx); if (sub_output_ctx == NULL) { continue; } AddOutputToFreeList(sub_module, sub_output_ctx); SetupOutput(sub_module->name, sub_module, sub_output_ctx); } } /* Error is no registered loggers with this name * were found .*/ if (!sub_count) { FatalErrorOnInit(SC_ERR_INVALID_ARGUMENT, "No output module named %s", subname); continue; } } } static void RunModeInitializeLuaOutput(ConfNode *conf, OutputCtx *parent_ctx) { OutputModule *lua_module = OutputGetModuleByConfName("lua"); BUG_ON(lua_module == NULL); ConfNode *scripts = ConfNodeLookupChild(conf, "scripts"); BUG_ON(scripts == NULL); //TODO OutputModule *m; TAILQ_FOREACH(m, &parent_ctx->submodules, entries) { SCLogDebug("m %p %s:%s", m, m->name, m->conf_name); ConfNode *script = NULL; TAILQ_FOREACH(script, &scripts->head, next) { SCLogDebug("script %s", script->val); if (strcmp(script->val, m->conf_name) == 0) { break; } } BUG_ON(script == NULL); /* pass on parent output_ctx */ OutputCtx *sub_output_ctx = m->InitSubFunc(script, parent_ctx); if (sub_output_ctx == NULL) { SCLogInfo("sub_output_ctx NULL, skipping"); continue; } AddOutputToFreeList(m, sub_output_ctx); SetupOutput(m->name, m, sub_output_ctx); } } /** * Initialize the output modules. */ void RunModeInitializeOutputs(void) { ConfNode *outputs = ConfGetNode("outputs"); if (outputs == NULL) { /* No "outputs" section in the configuration. */ return; } ConfNode *output, *output_config; const char *enabled; char tls_log_enabled = 0; char tls_store_present = 0; TAILQ_FOREACH(output, &outputs->head, next) { output_config = ConfNodeLookupChild(output, output->val); if (output_config == NULL) { /* Shouldn't happen. */ FatalError(SC_ERR_INVALID_ARGUMENT, "Failed to lookup configuration child node: %s", output->val); } if (strcmp(output->val, "tls-store") == 0) { tls_store_present = 1; } enabled = ConfNodeLookupChildValue(output_config, "enabled"); if (enabled == NULL || !ConfValIsTrue(enabled)) { continue; } if (strncmp(output->val, "unified-", sizeof("unified-") - 1) == 0) { SCLogWarning(SC_ERR_NOT_SUPPORTED, "Unified1 is no longer supported," " use Unified2 instead " "(see https://redmine.openinfosecfoundation.org/issues/353" " for an explanation)"); continue; } else if (strcmp(output->val, "alert-prelude") == 0) { #ifndef PRELUDE SCLogWarning(SC_ERR_NOT_SUPPORTED, "Prelude support not compiled in. Reconfigure/" "recompile with --enable-prelude to add Prelude " "support."); continue; #endif } else if (strcmp(output->val, "eve-log") == 0) { #ifndef HAVE_LIBJANSSON SCLogWarning(SC_ERR_NOT_SUPPORTED, "Eve-log support not compiled in. Reconfigure/" "recompile with libjansson and its development " "files installed to add eve-log support."); continue; #endif } else if (strcmp(output->val, "lua") == 0) { #ifndef HAVE_LUA SCLogWarning(SC_ERR_NOT_SUPPORTED, "lua support not compiled in. Reconfigure/" "recompile with lua(jit) and its development " "files installed to add lua support."); continue; #endif } else if (strcmp(output->val, "tls-log") == 0) { tls_log_enabled = 1; } OutputModule *module; int count = 0; TAILQ_FOREACH(module, &output_modules, entries) { if (strcmp(module->conf_name, output->val) != 0) { continue; } count++; OutputCtx *output_ctx = NULL; if (module->InitFunc != NULL) { output_ctx = module->InitFunc(output_config); if (output_ctx == NULL) { FatalErrorOnInit(SC_ERR_INVALID_ARGUMENT, "output module setup failed"); continue; } } else if (module->InitSubFunc != NULL) { SCLogInfo("skipping submodule"); continue; } // TODO if module == parent, find it's children if (strcmp(output->val, "eve-log") == 0) { RunModeInitializeEveOutput(output_config, output_ctx); /* add 'eve-log' to free list as it's the owner of the * main output ctx from which the sub-modules share the * LogFileCtx */ AddOutputToFreeList(module, output_ctx); } else if (strcmp(output->val, "lua") == 0) { SCLogDebug("handle lua"); if (output_ctx == NULL) continue; RunModeInitializeLuaOutput(output_config, output_ctx); AddOutputToFreeList(module, output_ctx); } else { AddOutputToFreeList(module, output_ctx); SetupOutput(module->name, module, output_ctx); } } if (count == 0) { FatalErrorOnInit(SC_ERR_INVALID_ARGUMENT, "No output module named %s", output->val); continue; } } /* Backward compatibility code */ if (!tls_store_present && tls_log_enabled) { /* old YAML with no "tls-store" in outputs. "tls-log" value needs * to be started using 'tls-log' config as own config */ SCLogWarning(SC_ERR_CONF_YAML_ERROR, "Please use 'tls-store' in YAML to configure TLS storage"); TAILQ_FOREACH(output, &outputs->head, next) { output_config = ConfNodeLookupChild(output, output->val); if (strcmp(output->val, "tls-log") == 0) { OutputModule *module = OutputGetModuleByConfName("tls-store"); if (module == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "No output module named %s, ignoring", "tls-store"); continue; } OutputCtx *output_ctx = NULL; if (module->InitFunc != NULL) { output_ctx = module->InitFunc(output_config); if (output_ctx == NULL) { continue; } } AddOutputToFreeList(module, output_ctx); SetupOutput(module->name, module, output_ctx); } } } } float threading_detect_ratio = 1; /** * Initialize multithreading settings. */ void RunModeInitialize(void) { threading_set_cpu_affinity = FALSE; if ((ConfGetBool("threading.set-cpu-affinity", &threading_set_cpu_affinity)) == 0) { threading_set_cpu_affinity = FALSE; } /* try to get custom cpu mask value if needed */ if (threading_set_cpu_affinity == TRUE) { AffinitySetupLoadFromConfig(); } if ((ConfGetFloat("threading.detect-thread-ratio", &threading_detect_ratio)) != 1) { if (ConfGetNode("threading.detect-thread-ratio") != NULL) WarnInvalidConfEntry("threading.detect-thread-ratio", "%s", "1"); threading_detect_ratio = 1; } SCLogDebug("threading.detect-thread-ratio %f", threading_detect_ratio); } suricata-3.2.1/src/output-packet.c0000644000000000000000000001521713051004444013760 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Packet Logger Output registration functions */ #include "suricata-common.h" #include "tm-modules.h" #include "output.h" #include "output-packet.h" #include "util-profiling.h" typedef struct OutputLoggerThreadStore_ { void *thread_data; struct OutputLoggerThreadStore_ *next; } OutputLoggerThreadStore; /** per thread data for this module, contains a list of per thread * data for the packet loggers. */ typedef struct OutputLoggerThreadData_ { OutputLoggerThreadStore *store; } OutputLoggerThreadData; /* logger instance, a module + a output ctx, * it's perfectly valid that have multiple instances of the same * log module (e.g. fast.log) with different output ctx'. */ typedef struct OutputPacketLogger_ { PacketLogger LogFunc; PacketLogCondition ConditionFunc; OutputCtx *output_ctx; struct OutputPacketLogger_ *next; const char *name; LoggerId logger_id; ThreadInitFunc ThreadInit; ThreadDeinitFunc ThreadDeinit; ThreadExitPrintStatsFunc ThreadExitPrintStats; } OutputPacketLogger; static OutputPacketLogger *list = NULL; int OutputRegisterPacketLogger(LoggerId logger_id, const char *name, PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats) { OutputPacketLogger *op = SCMalloc(sizeof(*op)); if (op == NULL) return -1; memset(op, 0x00, sizeof(*op)); op->LogFunc = LogFunc; op->ConditionFunc = ConditionFunc; op->output_ctx = output_ctx; op->name = name; op->ThreadInit = ThreadInit; op->ThreadDeinit = ThreadDeinit; op->ThreadExitPrintStats = ThreadExitPrintStats; op->logger_id = logger_id; if (list == NULL) list = op; else { OutputPacketLogger *t = list; while (t->next) t = t->next; t->next = op; } SCLogDebug("OutputRegisterPacketLogger happy"); return 0; } static TmEcode OutputPacketLog(ThreadVars *tv, Packet *p, void *thread_data) { BUG_ON(thread_data == NULL); if (list == NULL) { /* No child loggers. */ return TM_ECODE_OK; } OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputPacketLogger *logger = list; OutputLoggerThreadStore *store = op_thread_data->store; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); BUG_ON(logger == NULL && store == NULL); while (logger && store) { BUG_ON(logger->LogFunc == NULL || logger->ConditionFunc == NULL); if ((logger->ConditionFunc(tv, (const Packet *)p)) == TRUE) { PACKET_PROFILING_LOGGER_START(p, logger->logger_id); logger->LogFunc(tv, store->thread_data, (const Packet *)p); PACKET_PROFILING_LOGGER_END(p, logger->logger_id); } logger = logger->next; store = store->next; BUG_ON(logger == NULL && store != NULL); BUG_ON(logger != NULL && store == NULL); } return TM_ECODE_OK; } /** \brief thread init for the packet logger * This will run the thread init functions for the individual registered * loggers */ static TmEcode OutputPacketLogThreadInit(ThreadVars *tv, void *initdata, void **data) { OutputLoggerThreadData *td = SCMalloc(sizeof(*td)); if (td == NULL) return TM_ECODE_FAILED; memset(td, 0x00, sizeof(*td)); *data = (void *)td; SCLogDebug("OutputPacketLogThreadInit happy (*data %p)", *data); OutputPacketLogger *logger = list; while (logger) { if (logger->ThreadInit) { void *retptr = NULL; if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) { OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts)); /* todo */ BUG_ON(ts == NULL); memset(ts, 0x00, sizeof(*ts)); /* store thread handle */ ts->thread_data = retptr; if (td->store == NULL) { td->store = ts; } else { OutputLoggerThreadStore *tmp = td->store; while (tmp->next != NULL) tmp = tmp->next; tmp->next = ts; } SCLogDebug("%s is now set up", logger->name); } } logger = logger->next; } return TM_ECODE_OK; } static TmEcode OutputPacketLogThreadDeinit(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputPacketLogger *logger = list; while (logger && store) { if (logger->ThreadDeinit) { logger->ThreadDeinit(tv, store->thread_data); } OutputLoggerThreadStore *next_store = store->next; SCFree(store); store = next_store; logger = logger->next; } SCFree(op_thread_data); return TM_ECODE_OK; } static void OutputPacketLogExitPrintStats(ThreadVars *tv, void *thread_data) { OutputLoggerThreadData *op_thread_data = (OutputLoggerThreadData *)thread_data; OutputLoggerThreadStore *store = op_thread_data->store; OutputPacketLogger *logger = list; while (logger && store) { if (logger->ThreadExitPrintStats) { logger->ThreadExitPrintStats(tv, store->thread_data); } logger = logger->next; store = store->next; } } void OutputPacketLoggerRegister(void) { OutputRegisterRootLogger(OutputPacketLogThreadInit, OutputPacketLogThreadDeinit, OutputPacketLogExitPrintStats, OutputPacketLog); } void OutputPacketShutdown(void) { OutputPacketLogger *logger = list; while (logger) { OutputPacketLogger *next_logger = logger->next; SCFree(logger); logger = next_logger; } /* reset list pointer */ list = NULL; } suricata-3.2.1/src/runmode-nfq.c0000644000000000000000000000444713051004444013411 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Eric Leblond * * Handling of NFQ runmodes. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-nfq.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-runmodes.h" #include "util-device.h" static const char *default_mode; const char *RunModeIpsNFQGetDefaultMode(void) { return default_mode; } void RunModeIpsNFQRegister(void) { default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_NFQ, "autofp", "Multi threaded NFQ IPS mode with respect to flow", RunModeIpsNFQAutoFp); RunModeRegisterNewRunMode(RUNMODE_NFQ, "workers", "Multi queue NFQ IPS mode with one thread per queue", RunModeIpsNFQWorker); return; } int RunModeIpsNFQAutoFp(void) { SCEnter(); int ret = 0; #ifdef NFQ RunModeInitialize(); TimeModeSetLive(); LiveDeviceHasNoStats(); ret = RunModeSetIPSAutoFp(NFQGetThread, "ReceiveNFQ", "VerdictNFQ", "DecodeNFQ"); #endif /* NFQ */ return ret; } int RunModeIpsNFQWorker(void) { SCEnter(); int ret = 0; #ifdef NFQ RunModeInitialize(); TimeModeSetLive(); LiveDeviceHasNoStats(); ret = RunModeSetIPSWorker(NFQGetThread, "ReceiveNFQ", "VerdictNFQ", "DecodeNFQ"); #endif /* NFQ */ return ret; } suricata-3.2.1/src/defrag-config.c0000644000000000000000000001110213051004444013633 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Giuseppe Longo * */ #include "suricata-common.h" #include "queue.h" #include "suricata.h" #include "conf.h" #include "util-debug.h" #include "util-misc.h" #include "defrag-config.h" static SCRadixTree *defrag_tree = NULL; static int default_timeout = 0; static void DefragPolicyFreeUserData(void *data) { if (data != NULL) SCFree(data); return; } static void DefragPolicyAddHostInfo(char *host_ip_range, uint64_t timeout) { uint64_t *user_data = NULL; if ( (user_data = SCMalloc(sizeof(uint64_t))) == NULL) { SCLogError(SC_ERR_FATAL, "Error allocating memory. Exiting"); exit(EXIT_FAILURE); } *user_data = timeout; if (strchr(host_ip_range, ':') != NULL) { SCLogDebug("adding ipv6 host %s", host_ip_range); if (SCRadixAddKeyIPV6String(host_ip_range, defrag_tree, (void *)user_data) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "failed to add ipv6 host %s", host_ip_range); } } else { SCLogDebug("adding ipv4 host %s", host_ip_range); if (SCRadixAddKeyIPV4String(host_ip_range, defrag_tree, (void *)user_data) == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "failed to add ipv4 host %s", host_ip_range); } } } static int DefragPolicyGetIPv4HostTimeout(uint8_t *ipv4_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, defrag_tree, &user_data); if (user_data == NULL) return -1; return *((int *)user_data); } static int DefragPolicyGetIPv6HostTimeout(uint8_t *ipv6_addr) { void *user_data = NULL; (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, defrag_tree, &user_data); if (user_data == NULL) return -1; return *((int *)user_data); } int DefragPolicyGetHostTimeout(Packet *p) { int timeout = 0; if (PKT_IS_IPV4(p)) timeout = DefragPolicyGetIPv4HostTimeout((uint8_t *)GET_IPV4_DST_ADDR_PTR(p)); else if (PKT_IS_IPV6(p)) timeout = DefragPolicyGetIPv6HostTimeout((uint8_t *)GET_IPV6_DST_ADDR(p)); if (timeout <= 0) timeout = default_timeout; return timeout; } static void DefragParseParameters(ConfNode *n) { ConfNode *si; uint64_t timeout = 0; TAILQ_FOREACH(si, &n->head, next) { if (strcasecmp("timeout", si->name) == 0) { SCLogDebug("timeout value %s", si->val); if (ParseSizeStringU64(si->val, &timeout) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing timeout " "from conf file"); } } if (strcasecmp("address", si->name) == 0) { ConfNode *pval; TAILQ_FOREACH(pval, &si->head, next) { DefragPolicyAddHostInfo(pval->val, timeout); } } } } void DefragSetDefaultTimeout(intmax_t timeout) { default_timeout = timeout; SCLogDebug("default timeout %d", default_timeout); } void DefragPolicyLoadFromConfig(void) { SCEnter(); defrag_tree = SCRadixCreateRadixTree(DefragPolicyFreeUserData, NULL); if (defrag_tree == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Can't alloc memory for the defrag config tree."); exit(EXIT_FAILURE); } ConfNode *server_config = ConfGetNode("defrag.host-config"); if (server_config == NULL) { SCLogDebug("failed to read host config"); SCReturn; } SCLogDebug("configuring host config %p", server_config); ConfNode *sc; TAILQ_FOREACH(sc, &server_config->head, next) { ConfNode *p = NULL; TAILQ_FOREACH(p, &sc->head, next) { SCLogDebug("parsing configuration for %s", p->name); DefragParseParameters(p); } } } void DefragTreeDestroy(void) { if (defrag_tree != NULL) { SCRadixReleaseRadixTree(defrag_tree); } defrag_tree = NULL; } suricata-3.2.1/src/util-decode-mime.h0000644000000000000000000002300413051004444014274 00000000000000/* Copyright (C) 2012 BAE Systems * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author David Abarbanel * */ #ifndef MIME_DECODE_H_ #define MIME_DECODE_H_ #include #include #include #include "suricata.h" #include "util-base64.h" #include "util-debug.h" /* Content Flags */ #define CTNT_IS_MSG 1 #define CTNT_IS_ENV 2 #define CTNT_IS_ENCAP 4 #define CTNT_IS_BODYPART 8 #define CTNT_IS_MULTIPART 16 #define CTNT_IS_ATTACHMENT 32 #define CTNT_IS_BASE64 64 #define CTNT_IS_QP 128 #define CTNT_IS_TEXT 256 #define CTNT_IS_HTML 512 /* URL Flags */ #define URL_IS_IP4 1 #define URL_IS_IP6 2 #define URL_IS_EXE 4 /* Anomaly Flags */ #define ANOM_INVALID_BASE64 1 /* invalid base64 chars */ #define ANOM_INVALID_QP 2 /* invalid qouted-printable chars */ #define ANOM_LONG_HEADER_NAME 4 /* header is abnormally long */ #define ANOM_LONG_HEADER_VALUE 8 /* header value is abnormally long * (includes multi-line) */ #define ANOM_LONG_LINE 16 /* Lines that exceed 998 octets */ #define ANOM_LONG_ENC_LINE 32 /* Lines that exceed 76 octets */ #define ANOM_MALFORMED_MSG 64 /* Misc msg format errors found */ #define ANOM_LONG_BOUNDARY 128 /* Boundary too long */ /* Publicly exposed size constants */ #define DATA_CHUNK_SIZE 3072 /* Should be divisible by 3 */ #define LINEREM_SIZE 256 /* Mime Parser Constants */ #define HEADER_READY 0x01 #define HEADER_STARTED 0x02 #define HEADER_DONE 0x03 #define BODY_STARTED 0x04 #define BODY_DONE 0x05 #define BODY_END_BOUND 0x06 #define PARSE_DONE 0x07 #define PARSE_ERROR 0x08 /** * \brief Mime Decoder Error Codes */ typedef enum MimeDecRetCode { MIME_DEC_OK = 0, MIME_DEC_MORE = 1, MIME_DEC_ERR_DATA = -1, MIME_DEC_ERR_MEM = -2, MIME_DEC_ERR_PARSE = -3 } MimeDecRetCode; /** * \brief Structure for containing configuration options * */ typedef struct MimeDecConfig { int decode_base64; /**< Decode base64 bodies */ int decode_quoted_printable; /**< Decode quoted-printable bodies */ int extract_urls; /**< Extract and store URLs in data structure */ int body_md5; /**< Compute md5 sum of body */ uint32_t header_value_depth; /**< Depth of which to store header values (Default is 2000) */ } MimeDecConfig; /** * \brief This represents a header field name and associated value */ typedef struct MimeDecField { uint8_t *name; /**< Name of the header field */ uint32_t name_len; /**< Length of the name */ uint32_t value_len; /**< Length of the value */ uint8_t *value; /**< Value of the header field */ struct MimeDecField *next; /**< Pointer to next field */ } MimeDecField; /** * \brief This represents a URL value node in a linked list * * Since HTML can sometimes contain a high number of URLs, this * structure only features the URL host name/IP or those that are * pointing to an executable file (see url_flags to determine which). */ typedef struct MimeDecUrl { uint8_t *url; /**< String representation of full or partial URL (lowercase) */ uint32_t url_len; /**< Length of the URL string */ uint32_t url_flags; /**< Flags indicating type of URL */ struct MimeDecUrl *next; /**< Pointer to next URL */ } MimeDecUrl; /** * \brief This represents the MIME Entity (or also top level message) in a * child-sibling tree */ typedef struct MimeDecEntity { MimeDecField *field_list; /**< Pointer to list of header fields */ MimeDecUrl *url_list; /**< Pointer to list of URLs */ uint32_t body_len; /**< Length of body (prior to any decoding) */ uint32_t decoded_body_len; /**< Length of body after decoding */ uint32_t header_flags; /**< Flags indicating header characteristics */ uint32_t ctnt_flags; /**< Flags indicating type of content */ uint32_t anomaly_flags; /**< Flags indicating an anomaly in the message */ uint32_t filename_len; /**< Length of file attachment name */ uint8_t *filename; /**< Name of file attachment */ uint8_t *ctnt_type; /**< Quick access pointer to short-hand content type field */ uint32_t ctnt_type_len; /**< Length of content type field value */ uint32_t msg_id_len; /**< Quick access pointer to message Id */ uint8_t *msg_id; /**< Quick access pointer to message Id */ struct MimeDecEntity *next; /**< Pointer to list of sibling entities */ struct MimeDecEntity *child; /**< Pointer to list of child entities */ } MimeDecEntity; /** * \brief Structure contains boundary and entity for the current node (entity) * in the stack * */ typedef struct MimeDecStackNode { MimeDecEntity *data; /**< Pointer to the entity data structure */ uint8_t *bdef; /**< Copy of boundary definition for child entity */ uint32_t bdef_len; /**< Boundary length for child entity */ int is_encap; /**< Flag indicating entity is encapsulated in message */ struct MimeDecStackNode *next; /**< Pointer to next item on the stack */ } MimeDecStackNode; /** * \brief Structure holds the top of the stack along with some free reusable nodes * */ typedef struct MimeDecStack { MimeDecStackNode *top; /**< Pointer to the top of the stack */ MimeDecStackNode *free_nodes; /**< Pointer to the list of free nodes */ uint32_t free_nodes_cnt; /**< Count of free nodes in the list */ } MimeDecStack; /** * \brief Structure contains a list of value and lengths for robust data processing * */ typedef struct DataValue { uint8_t *value; /**< Copy of data value */ uint32_t value_len; /**< Length of data value */ struct DataValue *next; /**< Pointer to next value in the list */ } DataValue; /** * \brief Structure contains the current state of the MIME parser * */ typedef struct MimeDecParseState { MimeDecEntity *msg; /**< Pointer to the top-level message entity */ MimeDecStack *stack; /**< Pointer to the top of the entity stack */ uint8_t *hname; /**< Copy of the last known header name */ uint32_t hlen; /**< Length of the last known header name */ uint32_t hvlen; /**< Total length of value list */ DataValue *hvalue; /**< Pointer to the incomplete header value list */ uint8_t linerem[LINEREM_SIZE]; /**< Remainder from previous line (for URL extraction) */ uint16_t linerem_len; /**< Length of remainder from previous line */ uint8_t bvremain[B64_BLOCK]; /**< Remainder from base64-decoded line */ uint8_t bvr_len; /**< Length of remainder from base64-decoded line */ uint8_t data_chunk[DATA_CHUNK_SIZE]; /**< Buffer holding data chunk */ #ifdef HAVE_NSS HASHContext *md5_ctx; uint8_t md5[MD5_LENGTH]; #endif uint8_t state_flag; /**< Flag representing current state of parser */ uint32_t data_chunk_len; /**< Length of data chunk */ int found_child; /**< Flag indicating a child entity was found */ int body_begin; /**< Currently at beginning of body */ int body_end; /**< Currently at end of body */ uint8_t current_line_delimiter_len; /**< Length of line delimiter */ void *data; /**< Pointer to data specific to the caller */ int (*DataChunkProcessorFunc) (const uint8_t *chunk, uint32_t len, struct MimeDecParseState *state); /**< Data chunk processing function callback */ } MimeDecParseState; /* Config functions */ void MimeDecSetConfig(MimeDecConfig *config); MimeDecConfig * MimeDecGetConfig(void); /* Memory functions */ void MimeDecFreeEntity(MimeDecEntity *entity); void MimeDecFreeField(MimeDecField *field); void MimeDecFreeUrl(MimeDecUrl *url); /* List functions */ MimeDecField * MimeDecAddField(MimeDecEntity *entity); MimeDecField * MimeDecFindField(const MimeDecEntity *entity, const char *name); int MimeDecFindFieldsForEach(const MimeDecEntity *entity, const char *name, int (*DataCallback)(const uint8_t *val, const size_t, void *data), void *data); MimeDecEntity * MimeDecAddEntity(MimeDecEntity *parent); /* Helper functions */ //MimeDecField * MimeDecFillField(MimeDecEntity *entity, const char *name, // uint32_t nlen, const char *value, uint32_t vlen, int copy_name_value); /* Parser functions */ MimeDecParseState * MimeDecInitParser(void *data, int (*dcpfunc)(const uint8_t *chunk, uint32_t len, MimeDecParseState *state)); void MimeDecDeInitParser(MimeDecParseState *state); int MimeDecParseComplete(MimeDecParseState *state); int MimeDecParseLine(const uint8_t *line, const uint32_t len, const uint8_t delim_len, MimeDecParseState *state); MimeDecEntity * MimeDecParseFullMsg(const uint8_t *buf, uint32_t blen, void *data, int (*DataChunkProcessorFunc)(const uint8_t *chunk, uint32_t len, MimeDecParseState *state)); const char *MimeDecParseStateGetStatus(MimeDecParseState *state); #ifdef AFLFUZZ_MIME int MimeParserDataFromFile(char *filename); #endif /* Test functions */ void MimeDecRegisterTests(void); #endif suricata-3.2.1/src/app-layer-htp-mem.c0000644000000000000000000000672113051004444014412 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Eric Leblond * * This file provides a memory handling for the HTTP protocol support. */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "util-mem.h" #include "util-misc.h" #include "app-layer-htp-mem.h" uint64_t htp_config_memcap = 0; SC_ATOMIC_DECLARE(uint64_t, htp_memuse); SC_ATOMIC_DECLARE(uint64_t, htp_memcap); void HTPParseMemcap() { char *conf_val; /** set config values for memcap, prealloc and hash_size */ if ((ConfGet("app-layer.protocols.http.memcap", &conf_val)) == 1) { if (ParseSizeStringU64(conf_val, &htp_config_memcap) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing http.memcap " "from conf file - %s. Killing engine", conf_val); exit(EXIT_FAILURE); } SCLogInfo("HTTP memcap: %"PRIu64, htp_config_memcap); } else { /* default to unlimited */ htp_config_memcap = 0; } SC_ATOMIC_INIT(htp_memuse); SC_ATOMIC_INIT(htp_memcap); } void HTPIncrMemuse(uint64_t size) { (void) SC_ATOMIC_ADD(htp_memuse, size); return; } void HTPDecrMemuse(uint64_t size) { (void) SC_ATOMIC_SUB(htp_memuse, size); return; } uint64_t HTPMemuseGlobalCounter(void) { uint64_t tmpval = SC_ATOMIC_GET(htp_memuse); return tmpval; } uint64_t HTPMemcapGlobalCounter(void) { uint64_t tmpval = SC_ATOMIC_GET(htp_memcap); return tmpval; } /** * \brief Check if alloc'ing "size" would mean we're over memcap * * \retval 1 if in bounds * \retval 0 if not in bounds */ int HTPCheckMemcap(uint64_t size) { if (htp_config_memcap == 0 || size + SC_ATOMIC_GET(htp_memuse) <= htp_config_memcap) return 1; (void) SC_ATOMIC_ADD(htp_memcap, 1); return 0; } void *HTPMalloc(size_t size) { void *ptr = NULL; if (HTPCheckMemcap((uint32_t)size) == 0) return NULL; ptr = SCMalloc(size); if (unlikely(ptr == NULL)) return NULL; HTPIncrMemuse((uint64_t)size); return ptr; } void *HTPCalloc(size_t n, size_t size) { void *ptr = NULL; if (HTPCheckMemcap((uint32_t)(n * size)) == 0) return NULL; ptr = SCCalloc(n, size); if (unlikely(ptr == NULL)) return NULL; HTPIncrMemuse((uint64_t)(n * size)); return ptr; } void *HTPRealloc(void *ptr, size_t orig_size, size_t size) { void *rptr = NULL; if (HTPCheckMemcap((uint32_t)(size - orig_size)) == 0) return NULL; rptr = SCRealloc(ptr, size); if (rptr == NULL) return NULL; HTPIncrMemuse((uint64_t)(size - orig_size)); return rptr; } void HTPFree(void *ptr, size_t size) { SCFree(ptr); HTPDecrMemuse((uint64_t)size); } /** * @} */ suricata-3.2.1/src/detect-engine-hrhd.c0000644000000000000000000030065113051004444014610 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP raw header match. * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-hrhd.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP Raw Header Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxRequestHeadersRaw(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud == NULL || tx_ud->request_headers_raw == NULL) return; const uint32_t buffer_len = tx_ud->request_headers_raw_len; const uint8_t *buffer = tx_ud->request_headers_raw; if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxRequestHeadersRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); int r = PrefilterAppendTxEngine(sgh, PrefilterTxRequestHeadersRaw, ALPROTO_HTTP, HTP_REQUEST_HEADERS+1, /* inspect when headers complete */ mpm_ctx, NULL, "http_raw_header (request)"); if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxRequestHeadersRaw, ALPROTO_HTTP, HTP_REQUEST_TRAILER+1, /* inspect when trailer complete */ mpm_ctx, NULL, "http_raw_header (request)"); } /** \brief HTTP Raw Header Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxResponseHeadersRaw(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; HtpTxUserData *tx_ud = htp_tx_get_user_data(tx); if (tx_ud == NULL || tx_ud->response_headers_raw == NULL) return; const uint32_t buffer_len = tx_ud->response_headers_raw_len; const uint8_t *buffer = tx_ud->response_headers_raw; if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxResponseHeadersRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); int r = PrefilterAppendTxEngine(sgh, PrefilterTxResponseHeadersRaw, ALPROTO_HTTP, HTP_RESPONSE_HEADERS+1, /* inspect when headers complete */ mpm_ctx, NULL, "http_raw_header (response)"); if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxResponseHeadersRaw, ALPROTO_HTTP, HTP_RESPONSE_TRAILER+1, /* inspect when trailer complete */ mpm_ctx, NULL, "http_raw_header (response)"); } /** * \brief Do the http_raw_header content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpRawHeader(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { HtpTxUserData *tx_ud = NULL; uint8_t *headers_raw = NULL; uint32_t headers_raw_len = 0; if (flags & STREAM_TOSERVER) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) <= HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } else { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) <= HTP_RESPONSE_HEADERS) return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } tx_ud = htp_tx_get_user_data(txv); if (tx_ud == NULL) goto end; if (flags & STREAM_TOSERVER) { headers_raw = tx_ud->request_headers_raw; headers_raw_len = tx_ud->request_headers_raw_len; } else { headers_raw = tx_ud->response_headers_raw; headers_raw_len = tx_ud->response_headers_raw_len; } if (headers_raw == NULL) goto end; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HRHDMATCH], f, headers_raw, headers_raw_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (flags & STREAM_TOSERVER) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_RESPONSE_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; depth:15; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"one\"; depth:5; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; depth:5; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"one\"; depth:15; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; offset:10; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"one\"; offset:15; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; offset:15; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:!\"one\"; offset:10; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:!\"three\"; http_raw_header; within:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:\"three\"; http_raw_header; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:15; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:!\"five\"; http_raw_header; distance:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpRawHeaderTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_server; " "content:\"one\"; http_raw_header; content:\"five\"; http_raw_header; distance:15; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpRawHeaderTest20(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:!\"dummy\"; http_raw_header; within:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest21(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:!\"dummy\"; within:7; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest22(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:!\"dummy\"; distance:3; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest23(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:!\"dummy\"; distance:13; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest24(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:\"dummy\"; within:15; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest25(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:\"dummy\"; within:10; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest26(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:\"dummy\"; distance:8; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest27(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; flow:to_server; " "pcre:/body1/D; " "content:\"dummy\"; distance:14; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest28(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_client; " "content:\"Content-Length: 6\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpRawHeaderTest29(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; flow:to_client; " "content:\"Content-Length: 7\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #if 0 static int DetectEngineHttpRawHeaderTest30(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Content-Length: 6\"; http_raw_header; " "content:\"User-Agent: Mozilla\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list != NULL) { goto end; } result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* #if 0 */ /** * \test Trailing headers. */ static int DetectEngineHttpRawHeaderTest31(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "host: boom\r\n" "Transfer-Encoding: chunked\r\n" "\r\n" "13\r\n" "This is dummy body1\r\n" "0\r\n" "Dummy-Header: kaboom\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(flow:to_server; " "content:\"Dummy\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } /** * \test Trailing headers. */ static int DetectEngineHttpRawHeaderTest32(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "host: boom\r\n" "Transfer-Encoding: chunked\r\n" "\r\n" "13\r\n" "This is dummy body1\r\n" "0\r\n"; uint8_t http2_buf[] = "Dummy-Header: kaboom\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(flow:to_server; " "content:\"Dummy\"; http_raw_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpRawHeaderRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpRawHeaderTest01", DetectEngineHttpRawHeaderTest01); UtRegisterTest("DetectEngineHttpRawHeaderTest02", DetectEngineHttpRawHeaderTest02); UtRegisterTest("DetectEngineHttpRawHeaderTest03", DetectEngineHttpRawHeaderTest03); UtRegisterTest("DetectEngineHttpRawHeaderTest04", DetectEngineHttpRawHeaderTest04); UtRegisterTest("DetectEngineHttpRawHeaderTest05", DetectEngineHttpRawHeaderTest05); UtRegisterTest("DetectEngineHttpRawHeaderTest06", DetectEngineHttpRawHeaderTest06); UtRegisterTest("DetectEngineHttpRawHeaderTest07", DetectEngineHttpRawHeaderTest07); UtRegisterTest("DetectEngineHttpRawHeaderTest08", DetectEngineHttpRawHeaderTest08); UtRegisterTest("DetectEngineHttpRawHeaderTest09", DetectEngineHttpRawHeaderTest09); UtRegisterTest("DetectEngineHttpRawHeaderTest10", DetectEngineHttpRawHeaderTest10); UtRegisterTest("DetectEngineHttpRawHeaderTest11", DetectEngineHttpRawHeaderTest11); UtRegisterTest("DetectEngineHttpRawHeaderTest12", DetectEngineHttpRawHeaderTest12); UtRegisterTest("DetectEngineHttpRawHeaderTest13", DetectEngineHttpRawHeaderTest13); UtRegisterTest("DetectEngineHttpRawHeaderTest14", DetectEngineHttpRawHeaderTest14); UtRegisterTest("DetectEngineHttpRawHeaderTest15", DetectEngineHttpRawHeaderTest15); UtRegisterTest("DetectEngineHttpRawHeaderTest16", DetectEngineHttpRawHeaderTest16); UtRegisterTest("DetectEngineHttpRawHeaderTest17", DetectEngineHttpRawHeaderTest17); UtRegisterTest("DetectEngineHttpRawHeaderTest20", DetectEngineHttpRawHeaderTest20); UtRegisterTest("DetectEngineHttpRawHeaderTest21", DetectEngineHttpRawHeaderTest21); UtRegisterTest("DetectEngineHttpRawHeaderTest22", DetectEngineHttpRawHeaderTest22); UtRegisterTest("DetectEngineHttpRawHeaderTest23", DetectEngineHttpRawHeaderTest23); UtRegisterTest("DetectEngineHttpRawHeaderTest24", DetectEngineHttpRawHeaderTest24); UtRegisterTest("DetectEngineHttpRawHeaderTest25", DetectEngineHttpRawHeaderTest25); UtRegisterTest("DetectEngineHttpRawHeaderTest26", DetectEngineHttpRawHeaderTest26); UtRegisterTest("DetectEngineHttpRawHeaderTest27", DetectEngineHttpRawHeaderTest27); UtRegisterTest("DetectEngineHttpRawHeaderTest28", DetectEngineHttpRawHeaderTest28); UtRegisterTest("DetectEngineHttpRawHeaderTest29", DetectEngineHttpRawHeaderTest29); #if 0 UtRegisterTest("DetectEngineHttpRawHeaderTest30", DetectEngineHttpRawHeaderTest30, 1); #endif UtRegisterTest("DetectEngineHttpRawHeaderTest31", DetectEngineHttpRawHeaderTest31); UtRegisterTest("DetectEngineHttpRawHeaderTest32", DetectEngineHttpRawHeaderTest32); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/util-signal.h0000644000000000000000000000175713051004444013414 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_SIGNAL_H__ #define __UTIL_SIGNAL_H__ int UtilSignalBlock(int); void UtilSignalHandlerSetup(int, void (*handler)());; int UtilSignalIsHandler(int sig, void (*handler)()); #endif /* __UTIL_SIGNAL_H__ */ suricata-3.2.1/src/util-profiling-keywords.c0000644000000000000000000003123013051004444015755 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Victor Julien * * An API for rule profiling operations. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "conf.h" #include "tm-threads.h" #include "util-unittest.h" #include "util-byte.h" #include "util-profiling.h" #include "util-profiling-locks.h" #ifdef PROFILING #ifndef MIN #define MIN(a, b) (((a) < (b)) ? (a) : (b)) #endif /** * Extra data for rule profiling. */ typedef struct SCProfileKeywordData_ { uint64_t checks; uint64_t matches; uint64_t max; uint64_t ticks_match; uint64_t ticks_no_match; } SCProfileKeywordData; typedef struct SCProfileKeywordDetectCtx_ { uint32_t id; SCProfileKeywordData *data; pthread_mutex_t data_m; } SCProfileKeywordDetectCtx; static int profiling_keywords_output_to_file = 0; int profiling_keyword_enabled = 0; __thread int profiling_keyword_entered = 0; static char profiling_file_name[PATH_MAX]; static const char *profiling_file_mode = "a"; void SCProfilingKeywordsGlobalInit(void) { ConfNode *conf; conf = ConfGetNode("profiling.keywords"); if (conf != NULL) { if (ConfNodeChildValueIsTrue(conf, "enabled")) { profiling_keyword_enabled = 1; const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); snprintf(profiling_file_name, sizeof(profiling_file_name), "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_file_mode = "a"; } else { profiling_file_mode = "w"; } profiling_keywords_output_to_file = 1; } } } } static void DoDump(SCProfileKeywordDetectCtx *rules_ctx, FILE *fp, const char *name) { int i; fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " Stats for: %s\n", name); fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " %-16s %-15s %-15s %-15s %-15s %-15s %-15s %-15s\n", "Keyword", "Ticks", "Checks", "Matches", "Max Ticks", "Avg", "Avg Match", "Avg No Match"); fprintf(fp, " ---------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "--------------- " "\n"); for (i = 0; i < DETECT_TBLSIZE; i++) { SCProfileKeywordData *d = &rules_ctx->data[i]; if (d == NULL || d->checks == 0) continue; uint64_t ticks = d->ticks_match + d->ticks_no_match; double avgticks = 0; double avgticks_match = 0; double avgticks_no_match = 0; if (ticks && d->checks) { avgticks = (ticks / d->checks); if (d->ticks_match && d->matches) avgticks_match = (d->ticks_match / d->matches); if (d->ticks_no_match && (d->checks - d->matches) != 0) avgticks_no_match = (d->ticks_no_match / (d->checks - d->matches)); } fprintf(fp, " %-16s %-15"PRIu64" %-15"PRIu64" %-15"PRIu64" %-15"PRIu64" %-15.2f %-15.2f %-15.2f\n", sigmatch_table[i].name, ticks, d->checks, d->matches, d->max, avgticks, avgticks_match, avgticks_no_match); } } void SCProfilingKeywordDump(DetectEngineCtx *de_ctx) { int i; FILE *fp; struct timeval tval; struct tm *tms; struct tm local_tm; if (profiling_keyword_enabled == 0) return; gettimeofday(&tval, NULL); tms = SCLocalTime(tval.tv_sec, &local_tm); if (profiling_keywords_output_to_file == 1) { SCLogDebug("file %s mode %s", profiling_file_name, profiling_file_mode); fp = fopen(profiling_file_name, profiling_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_file_name, strerror(errno)); return; } } else { fp = stdout; } fprintf(fp, " ----------------------------------------------" "------------------------------------------------------" "----------------------------\n"); fprintf(fp, " Date: %" PRId32 "/%" PRId32 "/%04d -- " "%02d:%02d:%02d\n", tms->tm_mon + 1, tms->tm_mday, tms->tm_year + 1900, tms->tm_hour,tms->tm_min, tms->tm_sec); /* global stats first */ DoDump(de_ctx->profile_keyword_ctx, fp, "total"); /* per buffer stats next, but only if there are stats to print */ for (i = 0; i < DETECT_SM_LIST_MAX; i++) { int j; uint64_t checks = 0; for (j = 0; j < DETECT_TBLSIZE; j++) { checks += de_ctx->profile_keyword_ctx_per_list[i]->data[j].checks; } if (checks) DoDump(de_ctx->profile_keyword_ctx_per_list[i], fp, DetectSigmatchListEnumToString(i)); } fprintf(fp,"\n"); if (fp != stdout) fclose(fp); SCLogPerf("Done dumping keyword profiling data."); } /** * \brief Update a rule counter. * * \param id The ID of this counter. * \param ticks Number of CPU ticks for this rule. * \param match Did the rule match? */ void SCProfilingKeywordUpdateCounter(DetectEngineThreadCtx *det_ctx, int id, uint64_t ticks, int match) { if (det_ctx != NULL && det_ctx->keyword_perf_data != NULL && id < DETECT_TBLSIZE) { SCProfileKeywordData *p = &det_ctx->keyword_perf_data[id]; p->checks++; p->matches += match; if (ticks > p->max) p->max = ticks; if (match == 1) p->ticks_match += ticks; else p->ticks_no_match += ticks; /* store per list (buffer type) as well */ if (det_ctx->keyword_perf_list >= 0 && det_ctx->keyword_perf_list < DETECT_SM_LIST_MAX) { p = &det_ctx->keyword_perf_data_per_list[det_ctx->keyword_perf_list][id]; p->checks++; p->matches += match; if (ticks > p->max) p->max = ticks; if (match == 1) p->ticks_match += ticks; else p->ticks_no_match += ticks; } } } SCProfileKeywordDetectCtx *SCProfilingKeywordInitCtx(void) { SCProfileKeywordDetectCtx *ctx = SCMalloc(sizeof(SCProfileKeywordDetectCtx)); if (ctx != NULL) { memset(ctx, 0x00, sizeof(SCProfileKeywordDetectCtx)); if (pthread_mutex_init(&ctx->data_m, NULL) != 0) { SCLogError(SC_ERR_MUTEX, "Failed to initialize hash table mutex."); exit(EXIT_FAILURE); } } return ctx; } static void DetroyCtx(SCProfileKeywordDetectCtx *ctx) { if (ctx) { if (ctx->data != NULL) SCFree(ctx->data); pthread_mutex_destroy(&ctx->data_m); SCFree(ctx); } } void SCProfilingKeywordDestroyCtx(DetectEngineCtx *de_ctx) { if (de_ctx != NULL) { SCProfilingKeywordDump(de_ctx); DetroyCtx(de_ctx->profile_keyword_ctx); int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { DetroyCtx(de_ctx->profile_keyword_ctx_per_list[i]); } } } void SCProfilingKeywordThreadSetup(SCProfileKeywordDetectCtx *ctx, DetectEngineThreadCtx *det_ctx) { if (ctx == NULL) return; SCProfileKeywordData *a = SCMalloc(sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); if (a != NULL) { memset(a, 0x00, sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); det_ctx->keyword_perf_data = a; } int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { SCProfileKeywordData *b = SCMalloc(sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); if (b != NULL) { memset(b, 0x00, sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); det_ctx->keyword_perf_data_per_list[i] = b; } } } static void SCProfilingKeywordThreadMerge(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { if (de_ctx == NULL || de_ctx->profile_keyword_ctx == NULL || de_ctx->profile_keyword_ctx->data == NULL || det_ctx == NULL || det_ctx->keyword_perf_data == NULL) return; int i; for (i = 0; i < DETECT_TBLSIZE; i++) { de_ctx->profile_keyword_ctx->data[i].checks += det_ctx->keyword_perf_data[i].checks; de_ctx->profile_keyword_ctx->data[i].matches += det_ctx->keyword_perf_data[i].matches; de_ctx->profile_keyword_ctx->data[i].ticks_match += det_ctx->keyword_perf_data[i].ticks_match; de_ctx->profile_keyword_ctx->data[i].ticks_no_match += det_ctx->keyword_perf_data[i].ticks_no_match; if (det_ctx->keyword_perf_data[i].max > de_ctx->profile_keyword_ctx->data[i].max) de_ctx->profile_keyword_ctx->data[i].max = det_ctx->keyword_perf_data[i].max; } int j; for (j = 0; j < DETECT_SM_LIST_MAX; j++) { for (i = 0; i < DETECT_TBLSIZE; i++) { de_ctx->profile_keyword_ctx_per_list[j]->data[i].checks += det_ctx->keyword_perf_data_per_list[j][i].checks; de_ctx->profile_keyword_ctx_per_list[j]->data[i].matches += det_ctx->keyword_perf_data_per_list[j][i].matches; de_ctx->profile_keyword_ctx_per_list[j]->data[i].ticks_match += det_ctx->keyword_perf_data_per_list[j][i].ticks_match; de_ctx->profile_keyword_ctx_per_list[j]->data[i].ticks_no_match += det_ctx->keyword_perf_data_per_list[j][i].ticks_no_match; if (det_ctx->keyword_perf_data_per_list[j][i].max > de_ctx->profile_keyword_ctx_per_list[j]->data[i].max) de_ctx->profile_keyword_ctx_per_list[j]->data[i].max = det_ctx->keyword_perf_data_per_list[j][i].max; } } } void SCProfilingKeywordThreadCleanup(DetectEngineThreadCtx *det_ctx) { if (det_ctx == NULL || det_ctx->de_ctx == NULL || det_ctx->keyword_perf_data == NULL) return; pthread_mutex_lock(&det_ctx->de_ctx->profile_keyword_ctx->data_m); SCProfilingKeywordThreadMerge(det_ctx->de_ctx, det_ctx); pthread_mutex_unlock(&det_ctx->de_ctx->profile_keyword_ctx->data_m); SCFree(det_ctx->keyword_perf_data); det_ctx->keyword_perf_data = NULL; int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { SCFree(det_ctx->keyword_perf_data_per_list[i]); det_ctx->keyword_perf_data_per_list[i] = NULL; } } /** * \brief Register the keyword profiling counters. * * \param de_ctx The active DetectEngineCtx, used to get at the loaded rules. */ void SCProfilingKeywordInitCounters(DetectEngineCtx *de_ctx) { if (profiling_keyword_enabled == 0) return; de_ctx->profile_keyword_ctx = SCProfilingKeywordInitCtx(); BUG_ON(de_ctx->profile_keyword_ctx == NULL); de_ctx->profile_keyword_ctx->data = SCMalloc(sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); BUG_ON(de_ctx->profile_keyword_ctx->data == NULL); memset(de_ctx->profile_keyword_ctx->data, 0x00, sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); int i; for (i = 0; i < DETECT_SM_LIST_MAX; i++) { de_ctx->profile_keyword_ctx_per_list[i] = SCProfilingKeywordInitCtx(); BUG_ON(de_ctx->profile_keyword_ctx_per_list[i] == NULL); de_ctx->profile_keyword_ctx_per_list[i]->data = SCMalloc(sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); BUG_ON(de_ctx->profile_keyword_ctx_per_list[i]->data == NULL); memset(de_ctx->profile_keyword_ctx_per_list[i]->data, 0x00, sizeof(SCProfileKeywordData) * DETECT_TBLSIZE); } SCLogPerf("Registered %"PRIu32" keyword profiling counters.", DETECT_TBLSIZE); } #endif /* PROFILING */ suricata-3.2.1/src/app-layer-smb2.c0000644000000000000000000005743613051004444013717 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl * * SMBv2 parser/decoder */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "util-spm.h" #include "util-unittest.h" #include "util-debug.h" #include "util-memcmp.h" #include "app-layer-smb2.h" enum { SMB2_FIELD_NONE = 0, SMB2_PARSE_NBSS_HEADER, SMB2_PARSE_SMB_HEADER, /* must be last */ SMB_FIELD_MAX, }; static uint32_t NBSSParseHeader(void *smb2_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMB2State *sstate = (SMB2State *) smb2_state; uint8_t *p = input; if (input_len && sstate->bytesprocessed < NBSS_HDR_LEN - 1) { switch (sstate->bytesprocessed) { case 0: /* Initialize */ if (input_len >= NBSS_HDR_LEN) { sstate->nbss.type = *p; sstate->nbss.length = (*(p + 1) & 0x01) << 16; sstate->nbss.length |= *(p + 2) << 8; sstate->nbss.length |= *(p + 3); sstate->bytesprocessed += NBSS_HDR_LEN; SCReturnUInt(4U); } else { sstate->nbss.type = *(p++); if (!(--input_len)) break; } /* fall through */ case 1: sstate->nbss.length = (*(p++) & 0x01) << 16; if (!(--input_len)) break; /* fall through */ case 2: sstate->nbss.length |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 3: sstate->nbss.length |= *(p++); --input_len; break; } sstate->bytesprocessed += (p - input); } SCReturnUInt((uint32_t)(p - input)); } static uint32_t SMB2ParseHeader(void *smb2_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMB2State *sstate = (SMB2State *) smb2_state; uint8_t *p = input; if (input_len) { switch (sstate->bytesprocessed) { case 4: // fallthrough /* above statement to prevent coverity FPs from the switch * fall through */ if (input_len >= SMB2_HDR_LEN) { if (SCMemcmp(p, "\xfe\x53\x4d\x42", 4) != 0) { //printf("SMB2 Header did not validate\n"); return 0; } sstate->smb2.StructureSize = *(p + 4); sstate->smb2.StructureSize |= *(p + 5) << 8; sstate->smb2.CreditCharge = *(p + 6); sstate->smb2.CreditCharge |= *(p + 7) << 8; sstate->smb2.Status = *(p + 8); sstate->smb2.Status |= *(p + 9) << 8; sstate->smb2.Status |= *(p + 10) << 16; sstate->smb2.Status |= *(p + 11) << 24; sstate->smb2.Command = *(p + 12); sstate->smb2.Command |= *(p + 13) << 8; sstate->smb2.CreditRequestResponse = *(p + 14); sstate->smb2.CreditRequestResponse |= *(p + 15) << 8; sstate->smb2.Flags = *(p + 16); sstate->smb2.Flags |= *(p + 17) << 8; sstate->smb2.Flags |= *(p + 18) << 16; sstate->smb2.Flags |= *(p + 19) << 24; sstate->smb2.NextCommand = *(p + 20); sstate->smb2.NextCommand |= *(p + 21) << 8; sstate->smb2.NextCommand |= *(p + 22) << 16; sstate->smb2.NextCommand |= *(p + 23) << 24; sstate->smb2.MessageId = *(p + 24); sstate->smb2.MessageId |= *(p + 25) << 8; sstate->smb2.MessageId |= *(p + 26) << 16; sstate->smb2.MessageId |= (uint64_t) *(p + 27) << 24; sstate->smb2.MessageId |= (uint64_t) *(p + 28) << 32; sstate->smb2.MessageId |= (uint64_t) *(p + 29) << 40; sstate->smb2.MessageId |= (uint64_t) *(p + 30) << 48; sstate->smb2.MessageId |= (uint64_t) *(p + 31) << 56; sstate->smb2.ProcessId = *(p + 32); sstate->smb2.ProcessId |= *(p + 33) << 8; sstate->smb2.ProcessId |= *(p + 34) << 16; sstate->smb2.ProcessId |= *(p + 35) << 24; sstate->smb2.TreeId = *(p + 36); sstate->smb2.TreeId |= *(p + 37) << 8; sstate->smb2.TreeId |= *(p + 38) << 16; sstate->smb2.TreeId |= *(p + 39) << 24; sstate->smb2.SessionId = *(p + 40); sstate->smb2.SessionId |= *(p + 41) << 8; sstate->smb2.SessionId |= *(p + 42) << 16; sstate->smb2.SessionId |= (uint64_t) *(p + 43) << 24; sstate->smb2.SessionId |= (uint64_t) *(p + 44) << 32; sstate->smb2.SessionId |= (uint64_t) *(p + 45) << 40; sstate->smb2.SessionId |= (uint64_t) *(p + 46) << 48; sstate->smb2.SessionId |= (uint64_t) *(p + 47) << 56; sstate->smb2.Signature[0] = *(p + 48); sstate->smb2.Signature[1] = *(p + 49); sstate->smb2.Signature[2] = *(p + 50); sstate->smb2.Signature[3] = *(p + 51); sstate->smb2.Signature[4] = *(p + 52); sstate->smb2.Signature[5] = *(p + 53); sstate->smb2.Signature[6] = *(p + 54); sstate->smb2.Signature[7] = *(p + 55); sstate->smb2.Signature[8] = *(p + 56); sstate->smb2.Signature[9] = *(p + 57); sstate->smb2.Signature[10] = *(p + 58); sstate->smb2.Signature[11] = *(p + 59); sstate->smb2.Signature[12] = *(p + 60); sstate->smb2.Signature[13] = *(p + 61); sstate->smb2.Signature[14] = *(p + 62); sstate->smb2.Signature[15] = *(p + 63); sstate->bytesprocessed += SMB2_HDR_LEN; SCReturnUInt(64U); break; } else { //sstate->smb2.protocol[0] = *(p++); if (*(p++) != 0xfe) return 0; if (!(--input_len)) break; /* We fall through to the next case if we still have input. * Same applies for other cases as well */ } /* fall through */ case 5: //sstate->smb2.protocol[1] = *(p++); if (*(p++) != 'S') return 0; if (!(--input_len)) break; /* fall through */ case 6: //sstate->smb2.protocol[2] = *(p++); if (*(p++) != 'M') return 0; if (!(--input_len)) break; /* fall through */ case 7: //sstate->smb2.protocol[3] = *(p++); if (*(p++) != 'B') return 0; if (!(--input_len)) break; /* fall through */ case 8: sstate->smb2.StructureSize = *(p++); if (!(--input_len)) break; /* fall through */ case 9: sstate->smb2.StructureSize |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 10: sstate->smb2.CreditCharge = *(p++); if (!(--input_len)) break; /* fall through */ case 11: sstate->smb2.CreditCharge |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 12: sstate->smb2.Status = *(p++); if (!(--input_len)) break; /* fall through */ case 13: sstate->smb2.Status |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 14: sstate->smb2.Status |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 15: sstate->smb2.Status |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 16: sstate->smb2.Command = *(p++); if (!(--input_len)) break; /* fall through */ case 17: sstate->smb2.Command |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 18: sstate->smb2.CreditRequestResponse = *(p++); if (!(--input_len)) break; /* fall through */ case 19: sstate->smb2.CreditRequestResponse |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 20: sstate->smb2.Flags = *(p++); if (!(--input_len)) break; /* fall through */ case 21: sstate->smb2.Flags |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 22: sstate->smb2.Flags |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 23: sstate->smb2.Flags |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 24: sstate->smb2.NextCommand = *(p++); if (!(--input_len)) break; /* fall through */ case 25: sstate->smb2.NextCommand |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 26: sstate->smb2.NextCommand |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 27: sstate->smb2.NextCommand |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 28: sstate->smb2.MessageId = *(p++); if (!(--input_len)) break; /* fall through */ case 29: sstate->smb2.MessageId = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 30: sstate->smb2.MessageId = *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 31: sstate->smb2.MessageId = (uint64_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 32: sstate->smb2.MessageId = (uint64_t) *(p++) << 32; if (!(--input_len)) break; /* fall through */ case 33: sstate->smb2.MessageId = (uint64_t) *(p++) << 40; if (!(--input_len)) break; /* fall through */ case 34: sstate->smb2.MessageId = (uint64_t) *(p++) << 48; if (!(--input_len)) break; /* fall through */ case 35: sstate->smb2.MessageId = (uint64_t) *(p++) << 56; if (!(--input_len)) break; /* fall through */ case 36: sstate->smb2.ProcessId = *(p++); if (!(--input_len)) break; /* fall through */ case 37: sstate->smb2.ProcessId |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 38: sstate->smb2.ProcessId |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 39: sstate->smb2.ProcessId |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 40: sstate->smb2.TreeId = *(p++); if (!(--input_len)) break; /* fall through */ case 41: sstate->smb2.TreeId |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 42: sstate->smb2.TreeId |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 43: sstate->smb2.TreeId |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 44: sstate->smb2.SessionId = *(p++); if (!(--input_len)) break; /* fall through */ case 45: sstate->smb2.SessionId |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 46: sstate->smb2.SessionId |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 47: sstate->smb2.SessionId |= (uint64_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 48: sstate->smb2.SessionId |= (uint64_t) *(p++) << 32; if (!(--input_len)) break; /* fall through */ case 49: sstate->smb2.SessionId |= (uint64_t) *(p++) << 40; if (!(--input_len)) break; /* fall through */ case 50: sstate->smb2.SessionId |= (uint64_t) *(p++) << 48; if (!(--input_len)) break; /* fall through */ case 51: sstate->smb2.SessionId |= (uint64_t) *(p++) << 56; if (!(--input_len)) break; /* fall through */ case 52: sstate->smb2.Signature[0] = *(p++); if (!(--input_len)) break; /* fall through */ case 53: sstate->smb2.Signature[1] = *(p++); if (!(--input_len)) break; /* fall through */ case 54: sstate->smb2.Signature[2] = *(p++); if (!(--input_len)) break; /* fall through */ case 55: sstate->smb2.Signature[3] = *(p++); if (!(--input_len)) break; /* fall through */ case 56: sstate->smb2.Signature[4] = *(p++); if (!(--input_len)) break; /* fall through */ case 57: sstate->smb2.Signature[5] = *(p++); if (!(--input_len)) break; /* fall through */ case 58: sstate->smb2.Signature[6] = *(p++); if (!(--input_len)) break; /* fall through */ case 59: sstate->smb2.Signature[7] = *(p++); if (!(--input_len)) break; /* fall through */ case 60: sstate->smb2.Signature[8] = *(p++); if (!(--input_len)) break; /* fall through */ case 61: sstate->smb2.Signature[9] = *(p++); if (!(--input_len)) break; /* fall through */ case 62: sstate->smb2.Signature[10] = *(p++); if (!(--input_len)) break; /* fall through */ case 63: sstate->smb2.Signature[11] = *(p++); if (!(--input_len)) break; /* fall through */ case 64: sstate->smb2.Signature[12] = *(p++); if (!(--input_len)) break; /* fall through */ case 65: sstate->smb2.Signature[13] = *(p++); if (!(--input_len)) break; /* fall through */ case 66: sstate->smb2.Signature[14] = *(p++); if (!(--input_len)) break; /* fall through */ case 67: sstate->smb2.Signature[15] = *(p++); --input_len; break; /* fall through */ } } sstate->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static int SMB2Parse(Flow *f, void *smb2_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { SCEnter(); SMB2State *sstate = (SMB2State *) smb2_state; uint32_t retval = 0; uint32_t parsed = 0; if (pstate == NULL) return -1; if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } else if (input == NULL || input_len == 0) { SCReturnInt(-1); } while (sstate->bytesprocessed < NBSS_HDR_LEN && input_len) { retval = NBSSParseHeader(smb2_state, pstate, input, input_len); if (retval <= input_len) { parsed += retval; input_len -= retval; } else { return -1; } SCLogDebug("NBSS Header (%u/%u) Type 0x%02x Length 0x%04x parsed %u input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, sstate->nbss.length, parsed, input_len); } switch(sstate->nbss.type) { case NBSS_SESSION_MESSAGE: while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN && sstate->bytesprocessed < NBSS_HDR_LEN + SMB2_HDR_LEN)) { retval = SMB2ParseHeader(smb2_state, pstate, input + parsed, input_len); if (retval <= input_len) { parsed += retval; input_len -= retval; } else { return -1; } SCLogDebug("SMB2 Header (%u/%u) Command 0x%04x parsed %u input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB2_HDR_LEN, sstate->smb2.Command, parsed, input_len); } break; default: break; } SCReturnInt(1); } static void *SMB2StateAlloc(void) { void *s = SCMalloc(sizeof(SMB2State)); if (unlikely(s == NULL)) return NULL; memset(s, 0, sizeof(SMB2State)); return s; } static void SMB2StateFree(void *s) { if (s) { SCFree(s); s = NULL; } } void RegisterSMB2Parsers(void) { /** SMB2 */ char *proto_name = "smb2"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB2, STREAM_TOSERVER, SMB2Parse); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB2, STREAM_TOCLIENT, SMB2Parse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMB2, SMB2StateAlloc, SMB2StateFree); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB2, SMB2ParserRegisterTests); #endif return; } /* UNITTESTS */ #ifdef UNITTESTS int SMB2ParserTest01(void) { int result = 1; Flow f; uint8_t smb2buf[] = "\x00\x00\x00\x66" // NBSS "\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00" // SMB2 "\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x24\x00\x01\x00x00\x00\x00\x00\x00\x00\x0\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x02"; uint32_t smb2len = sizeof(smb2buf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); f.protoctx = (void *)&ssn; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB2, STREAM_TOSERVER | STREAM_EOF, smb2buf, smb2len); if (r != 0) { printf("smb2 header check returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMB2State *smb2_state = f.alstate; if (smb2_state == NULL) { printf("no smb2 state: "); result = 0; goto end; } if (smb2_state->nbss.type != NBSS_SESSION_MESSAGE) { printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb2_state->nbss.type); result = 0; goto end; } if (smb2_state->nbss.length != 102) { printf("expected nbss length 0x%02x , got 0x%02x : ", 102, smb2_state->nbss.length); result = 0; goto end; } if (smb2_state->smb2.Command != SMB2_NEGOTIATE) { printf("expected SMB2 command 0x%04x , got 0x%04x : ", SMB2_NEGOTIATE, smb2_state->smb2.Command); result = 0; goto end; } end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); return result; } void SMB2ParserRegisterTests(void) { UtRegisterTest("SMB2ParserTest01", SMB2ParserTest01); } #endif suricata-3.2.1/src/detect-dce-opnum.c0000644000000000000000000033454613051004444014321 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Implements dce_opnum keyword */ #include "suricata-common.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "app-layer.h" #include "app-layer-dcerpc.h" #include "queue.h" #include "stream-tcp-reassemble.h" #include "detect-dce-opnum.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "stream-tcp.h" #define PARSE_REGEX "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$" static pcre *parse_regex = NULL; static pcre_extra *parse_regex_study = NULL; int DetectDceOpnumMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectDceOpnumSetup(DetectEngineCtx *, Signature *, char *); void DetectDceOpnumFree(void *); /** * \brief Registers the keyword handlers for the "dce_opnum" keyword. */ void DetectDceOpnumRegister(void) { sigmatch_table[DETECT_DCE_OPNUM].name = "dce_opnum"; sigmatch_table[DETECT_DCE_OPNUM].Match = NULL; sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch; sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup; sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree; sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests; sigmatch_table[DETECT_DCE_OPNUM].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \internal * \brief Creates and returns a new instance of DetectDceOpnumRange. * * \retval dor Pointer to the new instance DetectDceOpnumRange. */ static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void) { DetectDceOpnumRange *dor = NULL; if ( (dor = SCMalloc(sizeof(DetectDceOpnumRange))) == NULL) return NULL; memset(dor, 0, sizeof(DetectDceOpnumRange)); dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED; return dor; } /** * \internal * \brief Parses the argument sent along with the "dce_opnum" keyword. * * \param arg Pointer to the string containing the argument to be parsed. * * \retval did Pointer to a DetectDceIfaceData instance that holds the data * from the parsed arg. */ static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg) { DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; DetectDceOpnumRange *prev_dor = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *pcre_sub_str = NULL; char *dup_str = NULL; char *dup_str_temp = NULL; char *dup_str_head = NULL; char *comma_token = NULL; char *hyphen_token = NULL; if (arg == NULL) { goto error; } ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 2) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg); goto error; } res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 0, &pcre_sub_str); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } if ( (dod = SCMalloc(sizeof(DetectDceOpnumData))) == NULL) goto error; memset(dod, 0, sizeof(DetectDceOpnumData)); if ( (dup_str = SCStrdup(pcre_sub_str)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); goto error; } /* free the substring */ pcre_free_substring(pcre_sub_str); /* keep a copy of the strdup string in dup_str_head so that we can free it * once we are done using it */ dup_str_head = dup_str; dup_str_temp = dup_str; while ( (comma_token = index(dup_str, ',')) != NULL) { comma_token[0] = '\0'; dup_str = comma_token + 1; dor = DetectDceOpnumAllocDetectDceOpnumRange(); if (dor == NULL) goto error; if (prev_dor == NULL) { prev_dor = dor; dod->range = dor; } else { prev_dor->next = dor; prev_dor = dor; } if ((hyphen_token = index(dup_str_temp, '-')) != NULL) { hyphen_token[0] = '\0'; hyphen_token++; dor->range1 = atoi(dup_str_temp); if (dor->range1 > DCE_OPNUM_RANGE_MAX) goto error; dor->range2 = atoi(hyphen_token); if (dor->range2 > DCE_OPNUM_RANGE_MAX) goto error; if (dor->range1 > dor->range2) goto error; } dor->range1 = atoi(dup_str_temp); if (dor->range1 > DCE_OPNUM_RANGE_MAX) goto error; dup_str_temp = dup_str; } dor = DetectDceOpnumAllocDetectDceOpnumRange(); if (dor == NULL) goto error; if (prev_dor == NULL) { dod->range = dor; } else { prev_dor->next = dor; } if ( (hyphen_token = index(dup_str, '-')) != NULL) { hyphen_token[0] = '\0'; hyphen_token++; dor->range1 = atoi(dup_str); if (dor->range1 > DCE_OPNUM_RANGE_MAX) goto error; dor->range2 = atoi(hyphen_token); if (dor->range2 > DCE_OPNUM_RANGE_MAX) goto error; if (dor->range1 > dor->range2) goto error; } dor->range1 = atoi(dup_str); if (dor->range1 > DCE_OPNUM_RANGE_MAX) goto error; if (dup_str_head != NULL) SCFree(dup_str_head); return dod; error: if (dup_str_head != NULL) SCFree(dup_str_head); DetectDceOpnumFree(dod); return NULL; } /** * \brief App layer match function for the "dce_opnum" keyword. * * \param t Pointer to the ThreadVars instance. * \param det_ctx Pointer to the DetectEngineThreadCtx. * \param f Pointer to the flow. * \param flags Pointer to the flags indicating the flow direction. * \param state Pointer to the app layer state data. * \param s Pointer to the Signature instance. * \param m Pointer to the SigMatch. * * \retval 1 On Match. * \retval 0 On no match. */ int DetectDceOpnumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectDceOpnumData *dce_data = (DetectDceOpnumData *)m->ctx; DetectDceOpnumRange *dor = dce_data->range; DCERPCState *dcerpc_state = (DCERPCState *)state; if (dcerpc_state == NULL) { SCLogDebug("No DCERPCState for the flow"); SCReturnInt(0); } for ( ; dor != NULL; dor = dor->next) { if (dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED) { if (dor->range1 == dcerpc_state->dcerpc.dcerpcrequest.opnum) { SCReturnInt(1); } } else { if (dor->range1 <= dcerpc_state->dcerpc.dcerpcrequest.opnum && dor->range2 >= dcerpc_state->dcerpc.dcerpcrequest.opnum) { SCReturnInt(1); } } } SCReturnInt(0); } /** * \brief Creates a SigMatch for the "dce_opnum" keyword being sent as argument, * and appends it to the Signature(s). * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to signature for the current Signature being parsed * from the rules. * \param arg Pointer to the string holding the keyword value. * * \retval 0 on success, -1 on failure */ static int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { DetectDceOpnumData *dod = NULL; SigMatch *sm = NULL; if (arg == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in " "signature, option needs a value"); goto error; } dod = DetectDceOpnumArgParse(arg); if (dod == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in " "signature"); goto error; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_DCE_OPNUM; sm->ctx = (void *)dod; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->alproto = ALPROTO_DCERPC; /* Flagged the signature as to inspect the app layer data */ s->flags |= SIG_FLAG_APPLAYER; return 0; error: DetectDceOpnumFree(dod); if (sm != NULL) SCFree(sm); return -1; } void DetectDceOpnumFree(void *ptr) { DetectDceOpnumData *dod = ptr; DetectDceOpnumRange *dor = NULL; DetectDceOpnumRange *dor_temp = NULL; if (dod != NULL) { dor = dod->range; while (dor != NULL) { dor_temp = dor; dor = dor->next; SCFree(dor_temp); } SCFree(dod); } return; } /************************************Unittests*********************************/ #ifdef UNITTESTS static int DetectDceOpnumTestParse01(void) { Signature *s = SigAlloc(); int result = 0; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "12") == 0); result &= (DetectDceOpnumSetup(NULL, s, "12,24") == 0); result &= (DetectDceOpnumSetup(NULL, s, "12,12-24") == 0); result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-78") == 0); result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513-6666") == 0); result &= (DetectDceOpnumSetup(NULL, s, "12,26,62,61,6513--") == -1); result &= (DetectDceOpnumSetup(NULL, s, "12-14,12,121,62-8") == -1); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { SigFree(s); result &= 1; } return result; } static int DetectDceOpnumTestParse02(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "12") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 12 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next == NULL); } else { result = 0; } end: SigFree(s); return result; } static int DetectDceOpnumTestParse03(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "12-24") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 12 && dor->range2 == 24); result &= (dor->next == NULL); } else { result = 0; } end: SigFree(s); return result; } static int DetectDceOpnumTestParse04(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "12-24,24,62-72,623-635,62,25,213-235") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 12 && dor->range2 == 24); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 24 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 62 && dor->range2 == 72); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 623 && dor->range2 == 635); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 62 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 25 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 213 && dor->range2 == 235); if (result == 0) goto end; } else { result = 0; } end: SigFree(s); return result; } static int DetectDceOpnumTestParse05(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "1,2,3,4,5,6,7") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 1 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 2 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 3 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 4 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 5 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 6 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 7 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); if (result == 0) goto end; } else { result = 0; } end: SigFree(s); return result; } static int DetectDceOpnumTestParse06(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 1 && dor->range2 == 2); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 3 && dor->range2 == 4); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 5 && dor->range2 == 6); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 7 && dor->range2 == 8); if (result == 0) goto end; } else { result = 0; } end: SigFree(s); return result; } static int DetectDceOpnumTestParse07(void) { Signature *s = SigAlloc(); int result = 0; DetectDceOpnumData *dod = NULL; DetectDceOpnumRange *dor = NULL; SigMatch *temp = NULL; memset(s, 0, sizeof(Signature)); result = (DetectDceOpnumSetup(NULL, s, "1-2,3-4,5-6,7-8,9") == 0); if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { temp = s->sm_lists[DETECT_SM_LIST_AMATCH]; dod = (DetectDceOpnumData *)temp->ctx; if (dod == NULL) goto end; dor = dod->range; result &= (dor->range1 == 1 && dor->range2 == 2); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 3 && dor->range2 == 4); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 5 && dor->range2 == 6); result &= (dor->next != NULL); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 7 && dor->range2 == 8); if (result == 0) goto end; dor = dor->next; result &= (dor->range1 == 9 && dor->range2 == DCE_OPNUM_RANGE_UNINITIALIZED); if (result == 0) goto end; } else { result = 0; } end: SigFree(s); return result; } /** * \test Test a valid dce_opnum entry with a bind, bind_ack and a request. */ static int DetectDceOpnumTestParse08(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x6a, 0x28, 0x19, 0x39, 0x0c, 0xb1, 0xd0, 0x11, 0x9b, 0xa8, 0x00, 0xc0, 0x4f, 0xd9, 0x2e, 0xf5, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x26, 0x3d, 0x00, 0x00, 0x0c, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x6c, 0x73, 0x61, 0x73, 0x73, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; /* todo chop the request frag length and change the * length related parameters in the frag */ uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47, 0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b, 0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd, 0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f, 0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5, 0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22, 0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1, 0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50, 0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22, 0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2, 0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56, 0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1, 0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76, 0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89, 0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a, 0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e, 0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e, 0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9, 0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a, 0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41, 0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6, 0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22, 0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43, 0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50, 0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99, 0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22, 0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e, 0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46, 0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76, 0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c, 0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74, 0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1, 0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c, 0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09, 0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15, 0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57, 0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56, 0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56, 0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48, 0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47, 0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56, 0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41, 0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1, 0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73, 0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a, 0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd, 0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21, 0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab, 0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3, 0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23, 0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23, 0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22, 0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76, 0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22, 0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71, 0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71, 0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06, 0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd, 0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78, 0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51, 0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50, 0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72, 0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1, 0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72, 0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72, 0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48, 0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57, 0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56, 0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78, 0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22, 0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06, 0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22, 0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92, 0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1, 0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22, 0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2, 0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70, 0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26, 0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2, 0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3, 0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x01, 0x02, 0x03, 0x04 }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_opnum:9; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_EOF, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_opnum entry with only a request frag. */ static int DetectDceOpnumTestParse09(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; /* todo chop the request frag length and change the * length related parameters in the frag */ uint8_t dcerpc_request[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xec, 0x0c, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd4, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe1, 0x03, 0x00, 0x00, 0x83, 0xc7, 0x0b, 0x47, 0x47, 0x47, 0x47, 0x81, 0x37, 0x22, 0xa5, 0x9b, 0x4a, 0x75, 0xf4, 0xa3, 0x61, 0xd3, 0xbe, 0xdd, 0x5a, 0xfb, 0x20, 0x1e, 0xfc, 0x10, 0x8e, 0x0f, 0xa5, 0x9f, 0x4a, 0x22, 0x20, 0x9b, 0xa8, 0xd5, 0xc4, 0xff, 0xc1, 0x3f, 0xbd, 0x9b, 0x4a, 0x22, 0x2e, 0xc0, 0x7a, 0xa9, 0xfe, 0x97, 0xc9, 0xe1, 0xa9, 0xf3, 0x2f, 0x22, 0xc9, 0x9b, 0x22, 0x50, 0xa5, 0xf5, 0x4a, 0x4a, 0xce, 0x9b, 0x2f, 0x22, 0x2e, 0x6f, 0xc1, 0xe1, 0xf3, 0xa8, 0x83, 0xa2, 0x64, 0x98, 0xc1, 0x62, 0xa1, 0xa0, 0x89, 0x56, 0xa8, 0x1b, 0x8b, 0x2b, 0x2e, 0xe3, 0x7a, 0xd1, 0x03, 0xef, 0x58, 0x7c, 0x4e, 0x7d, 0x14, 0x76, 0xfa, 0xc3, 0x7f, 0x02, 0xa5, 0xbb, 0x4a, 0x89, 0x47, 0x6c, 0x12, 0xc9, 0x70, 0x18, 0x8e, 0x3a, 0x2e, 0xcb, 0x52, 0xa9, 0x67, 0x98, 0x0a, 0x1e, 0x2e, 0xc3, 0x32, 0x21, 0x7f, 0x10, 0x31, 0x3e, 0xa6, 0x61, 0xc1, 0x61, 0x85, 0x98, 0x88, 0xa9, 0xee, 0x83, 0x22, 0x51, 0xd6, 0xda, 0x4a, 0x4a, 0xc1, 0xff, 0x38, 0x47, 0xcd, 0xe9, 0x25, 0x41, 0xe4, 0xf3, 0x0d, 0x47, 0xd1, 0xcb, 0xc1, 0xd6, 0x1e, 0x95, 0x4a, 0x22, 0xa5, 0x73, 0x08, 0x22, 0xa5, 0x9b, 0xc9, 0xe6, 0xb5, 0xcd, 0x22, 0x43, 0xd7, 0xe2, 0x0b, 0x4a, 0xe9, 0xf2, 0x28, 0x50, 0xcd, 0xd7, 0x25, 0x43, 0xc1, 0x10, 0xbe, 0x99, 0xa9, 0x9b, 0x4a, 0x22, 0x4d, 0xb8, 0x4a, 0x22, 0xa5, 0x18, 0x8e, 0x2e, 0xf3, 0xc9, 0x22, 0x4e, 0xc9, 0x9b, 0x4a, 0x4a, 0x96, 0xa9, 0x64, 0x46, 0xcd, 0xec, 0x39, 0x10, 0xfa, 0xcf, 0xb5, 0x76, 0x81, 0x8f, 0xc9, 0xe6, 0xa9, 0x10, 0x82, 0x7c, 0xff, 0xc4, 0xa1, 0x0a, 0xf5, 0xcc, 0x1b, 0x74, 0xf4, 0x10, 0x81, 0xa9, 0x9d, 0x98, 0xb0, 0xa1, 0x65, 0x9f, 0xb9, 0x84, 0xd1, 0x9f, 0x13, 0x7c, 0x47, 0x76, 0x12, 0x7c, 0xfc, 0x10, 0xbb, 0x09, 0x55, 0x5a, 0xac, 0x20, 0xfa, 0x10, 0x7e, 0x15, 0xa6, 0x69, 0x12, 0xe1, 0xf7, 0xca, 0x22, 0x57, 0xd5, 0x9b, 0x4a, 0x4a, 0xd1, 0xfa, 0x38, 0x56, 0xcd, 0xcc, 0x19, 0x63, 0xf6, 0xf3, 0x2f, 0x56, 0xa5, 0x9b, 0x22, 0x51, 0xca, 0xf8, 0x21, 0x48, 0xa5, 0xf3, 0x28, 0x4b, 0xcb, 0xff, 0x22, 0x47, 0xcb, 0x9b, 0x4a, 0x4a, 0xc9, 0xf2, 0x39, 0x56, 0xcd, 0xeb, 0x3e, 0x22, 0xa5, 0xf3, 0x2b, 0x41, 0xc6, 0xfe, 0xc1, 0xfe, 0xf6, 0xca, 0xc9, 0xe1, 0xad, 0xc8, 0x1b, 0xa1, 0x66, 0x93, 0x19, 0x73, 0x26, 0x58, 0x42, 0x71, 0xf4, 0x18, 0x89, 0x2a, 0xf6, 0xca, 0xb5, 0xf5, 0x2c, 0xd8, 0x42, 0xdd, 0x72, 0x12, 0x09, 0x26, 0x5a, 0x4c, 0xc3, 0x21, 0x5a, 0x4c, 0xc3, 0x61, 0x59, 0x64, 0x9d, 0xab, 0xe6, 0x63, 0xc9, 0xc9, 0xad, 0x10, 0xa9, 0xa3, 0x49, 0x0b, 0x4b, 0x22, 0xa5, 0xcf, 0x22, 0x23, 0xa4, 0x9b, 0x4a, 0xdd, 0x31, 0xbf, 0xe2, 0x23, 0xa5, 0x9b, 0xcb, 0xe6, 0x35, 0x9a, 0x4a, 0x22, 0xcf, 0x9d, 0x20, 0x23, 0xcf, 0x99, 0xb5, 0x76, 0x81, 0x83, 0x20, 0x22, 0xcf, 0x9b, 0x20, 0x22, 0xcd, 0x99, 0x4a, 0xe6, 0x96, 0x10, 0x96, 0x71, 0xf6, 0xcb, 0x20, 0x23, 0xf5, 0xf1, 0x5a, 0x71, 0xf5, 0x64, 0x1e, 0x06, 0x9d, 0x64, 0x1e, 0x06, 0x8d, 0x5c, 0x49, 0x32, 0xa5, 0x9b, 0x4a, 0xdd, 0xf1, 0xbf, 0x56, 0xa1, 0x61, 0xbf, 0x13, 0x78, 0xf4, 0xc9, 0x1a, 0x11, 0x77, 0xc9, 0x22, 0x51, 0xc0, 0xf5, 0x2e, 0xa9, 0x61, 0xc9, 0x22, 0x50, 0xc0, 0xf8, 0x3c, 0xa9, 0x71, 0xc9, 0x1b, 0x72, 0xf4, 0x64, 0x9d, 0xb1, 0x5a, 0x4c, 0xdf, 0xa1, 0x61, 0x8b, 0x12, 0x78, 0xfc, 0xc8, 0x1f, 0x72, 0x2e, 0x77, 0x1a, 0x42, 0xcf, 0x9f, 0x10, 0x72, 0x2e, 0x47, 0xa2, 0x63, 0xa5, 0x9b, 0x4a, 0x48, 0xa5, 0xf3, 0x26, 0x4e, 0xca, 0xf8, 0x22, 0x57, 0xc4, 0xf7, 0x0b, 0x4a, 0xf3, 0xf2, 0x38, 0x56, 0xf1, 0xcd, 0xb5, 0xf5, 0x26, 0x5f, 0x5a, 0x78, 0xf7, 0xf1, 0x0a, 0x4a, 0xa5, 0x8b, 0x4a, 0x22, 0xf7, 0xf1, 0x4a, 0xdd, 0x75, 0x12, 0x0e, 0x06, 0x81, 0xc1, 0xd9, 0xca, 0xb5, 0x9b, 0x4a, 0x22, 0xc4, 0xc0, 0xb5, 0xc1, 0xc5, 0xa8, 0x8a, 0x92, 0xa1, 0x73, 0x5c, 0x22, 0xa5, 0x9b, 0x2b, 0xe1, 0xc5, 0xc9, 0x19, 0x11, 0x65, 0x73, 0x40, 0x22, 0xa5, 0x9b, 0x11, 0x78, 0xa6, 0x43, 0x61, 0xf2, 0xd0, 0x74, 0x2b, 0xe1, 0x96, 0x52, 0x1b, 0x70, 0xf6, 0x64, 0x3f, 0x22, 0x5a, 0xcf, 0x4f, 0x26, 0x20, 0x5b, 0x34, 0x23, 0x66, 0x64, 0x1f, 0xd2, 0xa5, 0x9b, 0x4a, 0x22, 0xa5, 0x9b, 0x4a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x54, 0x58, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x41, 0x3f, 0x3f, 0x2d, 0x6f, 0x43, 0x42, 0x42, 0x50, 0x5f, 0x57, 0xc3, 0x33, 0x5f, 0x37, 0x74, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0xeb, 0xd4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x53, 0x69, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x44, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x44, 0x73, 0x4c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x50, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x44, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x72, 0x65, 0x66, 0x31, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x72, 0x65, 0x66, 0x32, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x01, 0x02, 0x03, 0x04 }; uint32_t dcerpc_request_len = sizeof(dcerpc_request); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_opnum:9; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_request, dcerpc_request_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 /** * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack, * and multiple request/responses with a match test after each frag parsing. */ static int DetectDceOpnumTestParse10(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0xd0, 0x8c, 0x33, 0x44, 0x22, 0xf1, 0x31, 0xaa, 0xaa, 0x90, 0x00, 0x38, 0x00, 0x10, 0x03, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x65, 0x8e, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x77, 0x69, 0x6e, 0x72, 0x65, 0x67, 0x00, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); uint32_t dcerpc_request3_len = sizeof(dcerpc_request3); uint32_t dcerpc_response3_len = sizeof(dcerpc_response3); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_opnum:2,15,22; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SCLogDebug("sending bind"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc bind failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SCLogDebug("sending bind_ack"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SCLogDebug("sending request1"); /* request1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't match, but should have: "); goto end; } SCLogDebug("sending response1"); /* response1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 did match, shouldn't have on response1: "); goto end; } /* request2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't match, but should have on request2: "); goto end; } /* response2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response2, dcerpc_response2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 did match, shouldn't have on response2: "); goto end; } /* request3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request3, dcerpc_request3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't match, but should have on request3: "); goto end; } /* response3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response3, dcerpc_response3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 did match, shouldn't have on response2: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerDestroyCtxThread(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_opnum entry(with multiple values) with multiple * request/responses. */ static int DetectDceOpnumTestParse11(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x2c, 0xfd, 0xb5, 0x00, 0x40, 0xaa, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x5c, 0x00, 0x5c, 0x00, 0xa8, 0xb9, 0x14, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0x00, 0x00, 0x00, 0x53, 0x00, 0x4f, 0x00, 0x46, 0x00, 0x54, 0x00, 0x57, 0x00, 0x41, 0x00, 0x52, 0x00, 0x45, 0x00, 0x5c, 0x00, 0x4d, 0x00, 0x69, 0x00, 0x63, 0x00, 0x72, 0x00, 0x6f, 0x00, 0x73, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x74, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x5c, 0x00, 0x43, 0x00, 0x75, 0x00, 0x72, 0x00, 0x72, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x56, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x5c, 0x00, 0x52, 0x00, 0x75, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request3[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf7, 0x72, 0x28, 0x9c, 0xf0, 0x57, 0xd8, 0x11, 0xb0, 0x05, 0x00, 0x0c, 0x29, 0x87, 0xea, 0xe9, 0x0c, 0x00, 0x0c, 0x00, 0x98, 0xda, 0x14, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x73, 0x00, 0x61, 0x00, 0x33, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x4e, 0x00, 0x54, 0x00, 0x4f, 0x00, 0x53, 0x00, 0x41, 0x00, 0x33, 0x00, 0x32, 0x00, 0x2e, 0x00, 0x45, 0x00, 0x58, 0x00, 0x45, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, }; uint8_t dcerpc_response3[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); uint32_t dcerpc_request3_len = sizeof(dcerpc_request3); uint32_t dcerpc_response3_len = sizeof(dcerpc_response3); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_opnum:2-22; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* request1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_request1, dcerpc_request1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpcrequest1 failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { SCLogDebug("no dcerpc state: "); printf("no dcerpc state: "); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; /* response1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpcresponse1 failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; /* request2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpcrequest2 failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; /* response2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response2, dcerpc_response2_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpcresponse2 failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; /* request3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request3, dcerpc_request3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpc request3 failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; /* response3 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response3, dcerpc_response3_len); if (r != 0) { SCLogDebug("AppLayerParse for dcerpc failed. Returned %" PRId32, r); printf("AppLayerParse for dcerpc response3 failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerDestroyCtxThread(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack, * and multiple request/responses with a match test after each frag parsing. */ static int DetectDceOpnumTestParse12(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_bind[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_bindack[] = { 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x7d, 0xd8, 0x00, 0x00, 0x0d, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, 0x6c, 0x6c, 0x73, 0x72, 0x70, 0x63, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, //opnum is 0x28 0x00 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70, 0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00, 0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00, 0x00 }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70, 0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x4e, 0x6f, 0x6e, 0x65 }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_bind_len = sizeof(dcerpc_bind); uint32_t dcerpc_bindack_len = sizeof(dcerpc_bindack); uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; dce_opnum:30, 40; sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER | STREAM_START, dcerpc_bind, dcerpc_bind_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_bindack, dcerpc_bindack_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); /* request1 */ SCLogDebug("Sending request1"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) { printf("dcerpc state holding invalid opnum. Holding %d, while we are " "expecting 40: ", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("signature 1 didn't match, should have: "); goto end; } /* response1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) { printf("dcerpc state holding invalid opnum. Holding %d, while we are " "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched on response 1, but shouldn't: "); goto end; } /* request2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) { printf("dcerpc state holding invalid opnum. Holding %d, while we are " "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't match on request 2: "); goto end; } /* response2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response2, dcerpc_response2_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) { printf("dcerpc state holding invalid opnum. Holding %d, while we are " "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched on response2, but shouldn't: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerDestroyCtxThread(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test a valid dce_opnum(with multiple values) with a bind, bind_ack, * and multiple request/responses with a match test after each frag parsing. */ static int DetectDceOpnumTestParse13(void) { int result = 0; Signature *s = NULL; ThreadVars th_v; Packet *p = NULL; Flow f; TcpSession ssn; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; DCERPCState *dcerpc_state = NULL; int r = 0; uint8_t dcerpc_request1[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x9a, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70, 0xec, 0xaa, 0x9a, 0xd3, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x80, 0x40, 0x00, 0x44, 0x80, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00, 0x00 }; uint8_t dcerpc_response1[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint8_t dcerpc_request2[] = { 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x54, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x9f, 0x13, 0xd9, 0x2d, 0x97, 0xf4, 0x4a, 0xac, 0xc2, 0xbc, 0x70, 0xec, 0xaa, 0x9a, 0xd3, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x4e, 0x6f, 0x6e, 0x65 }; uint8_t dcerpc_response2[] = { 0x05, 0x00, 0x02, 0x03, 0x10, 0x00, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd8, 0x17, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x58, 0x1d, 0x08, 0x00, 0xe8, 0x32, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4d, 0x6f, 0x00, 0x4e, 0x61, 0x6d, 0x65, 0x00, 0x35, 0x39, 0x31, 0x63, 0x64, 0x30, 0x35, 0x38, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0xd0, 0x2e, 0x08, 0x00, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, }; uint32_t dcerpc_request1_len = sizeof(dcerpc_request1); uint32_t dcerpc_response1_len = sizeof(dcerpc_response1); uint32_t dcerpc_request2_len = sizeof(dcerpc_request2); uint32_t dcerpc_response2_len = sizeof(dcerpc_response2); AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_DCERPC; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"DCERPC\"; " "dce_opnum:30, 40; " "sid:1;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* request1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request1, dcerpc_request1_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) { printf("dcerpc state holding invalid opnum after request1. Holding %d, while we are " "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; /* response1 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT, dcerpc_response1, dcerpc_response1_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 40) { printf("dcerpc state holding invalid opnum after response1. Holding %d, while we are " "expecting 40\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; /* request2 */ printf("Sending Request2\n"); r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOSERVER, dcerpc_request2, dcerpc_request2_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) { printf("dcerpc state holding invalid opnum after request2. Holding %d, while we are " "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_TOSERVER; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) goto end; /* response2 */ r = AppLayerParserParse(alp_tctx, &f, ALPROTO_DCERPC, STREAM_TOCLIENT | STREAM_EOF, dcerpc_response2, dcerpc_response2_len); if (r != 0) { printf("AppLayerParse for dcerpc failed. Returned %" PRId32, r); goto end; } dcerpc_state = f.alstate; if (dcerpc_state == NULL) { printf("no dcerpc state: "); goto end; } if (dcerpc_state->dcerpc.dcerpcrequest.opnum != 30) { printf("dcerpc state holding invalid opnum after response2. Holding %d, while we are " "expecting 30\n", dcerpc_state->dcerpc.dcerpcrequest.opnum); goto end; } p->flowflags &=~ FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_TOCLIENT; /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) goto end; result = 1; end: if (alp_tctx != NULL) AppLayerDestroyCtxThread(alp_tctx); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif #endif void DetectDceOpnumRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectDceOpnumTestParse01", DetectDceOpnumTestParse01); UtRegisterTest("DetectDceOpnumTestParse02", DetectDceOpnumTestParse02); UtRegisterTest("DetectDceOpnumTestParse03", DetectDceOpnumTestParse03); UtRegisterTest("DetectDceOpnumTestParse04", DetectDceOpnumTestParse04); UtRegisterTest("DetectDceOpnumTestParse05", DetectDceOpnumTestParse05); UtRegisterTest("DetectDceOpnumTestParse06", DetectDceOpnumTestParse06); UtRegisterTest("DetectDceOpnumTestParse07", DetectDceOpnumTestParse07); UtRegisterTest("DetectDceOpnumTestParse08", DetectDceOpnumTestParse08); UtRegisterTest("DetectDceOpnumTestParse09", DetectDceOpnumTestParse09); /* Disabled because of bug_753. Would be enabled, once we rewrite * dce parser */ #if 0 UtRegisterTest("DetectDceOpnumTestParse10", DetectDceOpnumTestParse10, 1); UtRegisterTest("DetectDceOpnumTestParse11", DetectDceOpnumTestParse11, 1); UtRegisterTest("DetectDceOpnumTestParse12", DetectDceOpnumTestParse12, 1); UtRegisterTest("DetectDceOpnumTestParse13", DetectDceOpnumTestParse13, 1); #endif #endif return; } suricata-3.2.1/src/util-affinity.h0000644000000000000000000000461613051004444013745 00000000000000/* Copyright (C) 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __UTIL_AFFINITY_H__ #define __UTIL_AFFINITY_H__ #include "suricata-common.h" #if defined OS_FREEBSD #include #include #include #include #include #define cpu_set_t cpuset_t #elif defined __OpenBSD__ #include #include #include #elif defined OS_DARWIN #include #include #include #define cpu_set_t thread_affinity_policy_data_t #define CPU_SET(cpu_id, new_mask) (*(new_mask)).affinity_tag = (cpu_id + 1) #define CPU_ISSET(cpu_id, new_mask) ((*(new_mask)).affinity_tag == (cpu_id + 1)) #define CPU_ZERO(new_mask) (*(new_mask)).affinity_tag = THREAD_AFFINITY_TAG_NULL #endif enum { RECEIVE_CPU_SET, WORKER_CPU_SET, VERDICT_CPU_SET, MANAGEMENT_CPU_SET, MAX_CPU_SET }; enum { BALANCED_AFFINITY, EXCLUSIVE_AFFINITY, MAX_AFFINITY }; typedef struct ThreadsAffinityType_ { const char *name; uint8_t mode_flag; int prio; int nb_threads; SCMutex taf_mutex; uint16_t lcpu; /* use by exclusive mode */ #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun cpu_set_t cpu_set; cpu_set_t lowprio_cpu; cpu_set_t medprio_cpu; cpu_set_t hiprio_cpu; #endif } ThreadsAffinityType; /** store thread affinity mode for all type of threads */ #ifndef _THREAD_AFFINITY extern ThreadsAffinityType thread_affinity[MAX_CPU_SET]; #endif void AffinitySetupLoadFromConfig(); ThreadsAffinityType * GetAffinityTypeFromName(const char *name); int AffinityGetNextCPU(ThreadsAffinityType *taf); #endif /* __UTIL_AFFINITY_H__ */ suricata-3.2.1/src/flow-worker.h0000644000000000000000000000230413051004444013427 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __FLOW_WORKER_H__ #define __FLOW_WORKER_H__ enum ProfileFlowWorkerId { PROFILE_FLOWWORKER_FLOW = 0, PROFILE_FLOWWORKER_STREAM, PROFILE_FLOWWORKER_APPLAYERUDP, PROFILE_FLOWWORKER_DETECT, PROFILE_FLOWWORKER_SIZE }; const char *ProfileFlowWorkerIdToString(enum ProfileFlowWorkerId fwi); void FlowWorkerReplaceDetectCtx(void *flow_worker, void *detect_ctx); void *FlowWorkerGetDetectCtxPtr(void *flow_worker); void TmModuleFlowWorkerRegister (void); #endif /* __FLOW_WORKER_H__ */ suricata-3.2.1/src/flow-bit.c0000644000000000000000000001751413051004444012700 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements per flow bits. Actually, not a bit, * but called that way because of Snort's flowbits. * It's a binary storage. * * \todo move away from a linked list implementation * \todo use different datatypes, such as string, int, etc. * \todo have more than one instance of the same var, and be able to match on a * specific one, or one all at a time. So if a certain capture matches * multiple times, we can operate on all of them. */ #include "suricata-common.h" #include "threads.h" #include "flow-bit.h" #include "flow.h" #include "flow-util.h" #include "flow-private.h" #include "detect.h" #include "util-var.h" #include "util-debug.h" #include "util-unittest.h" /* get the flowbit with idx from the flow */ static FlowBit *FlowBitGet(Flow *f, uint16_t idx) { GenericVar *gv = f->flowvar; for ( ; gv != NULL; gv = gv->next) { if (gv->type == DETECT_FLOWBITS && gv->idx == idx) { return (FlowBit *)gv; } } return NULL; } /* add a flowbit to the flow */ static void FlowBitAdd(Flow *f, uint16_t idx) { FlowBit *fb = FlowBitGet(f, idx); if (fb == NULL) { fb = SCMalloc(sizeof(FlowBit)); if (unlikely(fb == NULL)) return; fb->type = DETECT_FLOWBITS; fb->idx = idx; fb->next = NULL; GenericVarAppend(&f->flowvar, (GenericVar *)fb); } } static void FlowBitRemove(Flow *f, uint16_t idx) { FlowBit *fb = FlowBitGet(f, idx); if (fb == NULL) return; GenericVarRemove(&f->flowvar, (GenericVar *)fb); FlowBitFree(fb); } void FlowBitSet(Flow *f, uint16_t idx) { FlowBitAdd(f, idx); } void FlowBitUnset(Flow *f, uint16_t idx) { FlowBitRemove(f, idx); } void FlowBitToggle(Flow *f, uint16_t idx) { FlowBit *fb = FlowBitGet(f, idx); if (fb != NULL) { FlowBitRemove(f, idx); } else { FlowBitAdd(f, idx); } } int FlowBitIsset(Flow *f, uint16_t idx) { int r = 0; FlowBit *fb = FlowBitGet(f, idx); if (fb != NULL) { r = 1; } return r; } int FlowBitIsnotset(Flow *f, uint16_t idx) { int r = 0; FlowBit *fb = FlowBitGet(f, idx); if (fb == NULL) { r = 1; } return r; } void FlowBitFree(FlowBit *fb) { if (fb == NULL) return; SCFree(fb); } /* TESTS */ #ifdef UNITTESTS static int FlowBitTest01 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBit *fb = FlowBitGet(&f,0); if (fb != NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest02 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBit *fb = FlowBitGet(&f,0); if (fb == NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest03 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBit *fb = FlowBitGet(&f,0); if (fb == NULL) { printf("fb == NULL although it was just added: "); goto end; } FlowBitRemove(&f, 0); fb = FlowBitGet(&f,0); if (fb != NULL) { printf("fb != NULL although it was just removed: "); goto end; } else { ret = 1; } end: GenericVarFree(f.flowvar); return ret; } static int FlowBitTest04 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,0); if (fb != NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest05 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,1); if (fb != NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest06 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,2); if (fb != NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest07 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,3); if (fb != NULL) ret = 1; GenericVarFree(f.flowvar); return ret; } static int FlowBitTest08 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,0); if (fb == NULL) goto end; FlowBitRemove(&f,0); fb = FlowBitGet(&f,0); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; end: GenericVarFree(f.flowvar); return ret; } static int FlowBitTest09 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,1); if (fb == NULL) goto end; FlowBitRemove(&f,1); fb = FlowBitGet(&f,1); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; end: GenericVarFree(f.flowvar); return ret; } static int FlowBitTest10 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,2); if (fb == NULL) goto end; FlowBitRemove(&f,2); fb = FlowBitGet(&f,2); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; end: GenericVarFree(f.flowvar); return ret; } static int FlowBitTest11 (void) { int ret = 0; Flow f; memset(&f, 0, sizeof(Flow)); FlowBitAdd(&f, 0); FlowBitAdd(&f, 1); FlowBitAdd(&f, 2); FlowBitAdd(&f, 3); FlowBit *fb = FlowBitGet(&f,3); if (fb == NULL) goto end; FlowBitRemove(&f,3); fb = FlowBitGet(&f,3); if (fb != NULL) { printf("fb != NULL even though it was removed: "); goto end; } ret = 1; end: GenericVarFree(f.flowvar); return ret; } #endif /* UNITTESTS */ void FlowBitRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("FlowBitTest01", FlowBitTest01); UtRegisterTest("FlowBitTest02", FlowBitTest02); UtRegisterTest("FlowBitTest03", FlowBitTest03); UtRegisterTest("FlowBitTest04", FlowBitTest04); UtRegisterTest("FlowBitTest05", FlowBitTest05); UtRegisterTest("FlowBitTest06", FlowBitTest06); UtRegisterTest("FlowBitTest07", FlowBitTest07); UtRegisterTest("FlowBitTest08", FlowBitTest08); UtRegisterTest("FlowBitTest09", FlowBitTest09); UtRegisterTest("FlowBitTest10", FlowBitTest10); UtRegisterTest("FlowBitTest11", FlowBitTest11); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-filesha1.c0000644000000000000000000001225213051004444014111 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Duarte Silva * */ #include "suricata-common.h" #include "util-detect-file-hash.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-filesha1.h" #ifndef HAVE_NSS static int DetectFileSha1SetupNoSupport (DetectEngineCtx *a, Signature *b, char *c) { SCLogError(SC_ERR_NO_SHA1_SUPPORT, "no SHA-1 calculation support built in, needed for filesha1 keyword"); return -1; } /** * \brief Registration function for keyword: filesha1 */ void DetectFileSha1Register(void) { sigmatch_table[DETECT_FILESHA1].name = "filesha1"; sigmatch_table[DETECT_FILESHA1].FileMatch = NULL; sigmatch_table[DETECT_FILESHA1].Setup = DetectFileSha1SetupNoSupport; sigmatch_table[DETECT_FILESHA1].Free = NULL; sigmatch_table[DETECT_FILESHA1].RegisterTests = NULL; sigmatch_table[DETECT_FILESHA1].flags = SIGMATCH_NOT_BUILT; SCLogDebug("registering filesha1 rule option"); return; } #else /* HAVE_NSS */ static int DetectFileSha1Setup (DetectEngineCtx *, Signature *, char *); static void DetectFileSha1RegisterTests(void); /** * \brief Registration function for keyword: filesha1 */ void DetectFileSha1Register(void) { sigmatch_table[DETECT_FILESHA1].name = "filesha1"; sigmatch_table[DETECT_FILESHA1].desc = "match file SHA-1 against list of SHA-1 checksums"; sigmatch_table[DETECT_FILESHA1].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesha1"; sigmatch_table[DETECT_FILESHA1].FileMatch = DetectFileHashMatch; sigmatch_table[DETECT_FILESHA1].Setup = DetectFileSha1Setup; sigmatch_table[DETECT_FILESHA1].Free = DetectFileHashFree; sigmatch_table[DETECT_FILESHA1].RegisterTests = DetectFileSha1RegisterTests; SCLogDebug("registering filesha1 rule option"); return; } /** * \brief this function is used to parse filesha1 options * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided "filesha1" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFileSha1Setup (DetectEngineCtx *de_ctx, Signature *s, char *str) { return DetectFileHashSetup(de_ctx, s, str, DETECT_FILESHA1); } #ifdef UNITTESTS static int SHA1MatchLookupString(ROHashTable *hash, char *string) { uint8_t sha1[20]; if (ReadHashString(sha1, string, "file", 88, 40) == 1) { void *ptr = ROHashLookup(hash, &sha1, (uint16_t)sizeof(sha1)); if (ptr == NULL) return 0; else return 1; } return 0; } static int SHA1MatchTest01(void) { ROHashTable *hash = ROHashInit(4, 20); if (hash == NULL) { return 0; } if (LoadHashTable(hash, "447661c5de965bd4d837b50244467e37bddc184d", "file", 1, DETECT_FILESHA1) != 1) return 0; if (LoadHashTable(hash, "75a9af1e34dc0bb2f7fcde9d56b2503072ac35dd", "file", 2, DETECT_FILESHA1) != 1) return 0; if (LoadHashTable(hash, "53224a297bbb30631670fdcd2d295d87a1d328e9", "file", 3, DETECT_FILESHA1) != 1) return 0; if (LoadHashTable(hash, "3395856ce81f2b7382dee72602f798b642f14140", "file", 4, DETECT_FILESHA1) != 1) return 0; if (LoadHashTable(hash, "65559245709fe98052eb284577f1fd61c01ad20d", "file", 5, DETECT_FILESHA1) != 1) return 0; if (LoadHashTable(hash, "0931fd4e05e6ea81c75f8488ecc1db9e66f22cbb", "file", 6, DETECT_FILESHA1) != 1) return 0; if (ROHashInitFinalize(hash) != 1) { return 0; } if (SHA1MatchLookupString(hash, "447661c5de965bd4d837b50244467e37bddc184d") != 1) return 0; if (SHA1MatchLookupString(hash, "75a9af1e34dc0bb2f7fcde9d56b2503072ac35dd") != 1) return 0; if (SHA1MatchLookupString(hash, "53224a297bbb30631670fdcd2d295d87a1d328e9") != 1) return 0; if (SHA1MatchLookupString(hash, "3395856ce81f2b7382dee72602f798b642f14140") != 1) return 0; if (SHA1MatchLookupString(hash, "65559245709fe98052eb284577f1fd61c01ad20d") != 1) return 0; if (SHA1MatchLookupString(hash, "0931fd4e05e6ea81c75f8488ecc1db9e66f22cbb") != 1) return 0; /* Shouldn't match */ if (SHA1MatchLookupString(hash, "3333333333333333333333333333333333333333") == 1) return 0; ROHashFree(hash); return 1; } #endif void DetectFileSha1RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SHA1MatchTest01", SHA1MatchTest01); #endif } #endif /* HAVE_NSS */ suricata-3.2.1/src/detect-http-hh.c0000644000000000000000000017553613051004444014010 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * * Implements support for the http_host keyword. */ #include "suricata-common.h" #include "threads.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "stream-tcp.h" #include "detect-http-hh.h" #include "detect-engine-hhhd.h" int DetectHttpHHSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpHHRegisterTests(void); void DetectHttpHHFree(void *); /** * \brief Registers the keyword handlers for the "http_host" keyword. */ void DetectHttpHHRegister(void) { sigmatch_table[DETECT_AL_HTTP_HOST].name = "http_host"; sigmatch_table[DETECT_AL_HTTP_HOST].desc = "content modifier to match only on the HTTP hostname"; sigmatch_table[DETECT_AL_HTTP_HOST].Match = NULL; sigmatch_table[DETECT_AL_HTTP_HOST].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_HOST].Setup = DetectHttpHHSetup; sigmatch_table[DETECT_AL_HTTP_HOST].Free = DetectHttpHHFree; sigmatch_table[DETECT_AL_HTTP_HOST].RegisterTests = DetectHttpHHRegisterTests; sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_NOOPT ; sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_host", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH, 2, PrefilterTxHostnameRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH, DetectEngineInspectHttpHH); return; } /** * \brief The setup function for the http_host keyword for a signature. * * \param de_ctx Pointer to the detection engine context. * \param s Pointer to the signature for the current Signature being * parsed from the rules. * \param m Pointer to the head of the SigMatch for the current rule * being parsed. * \param arg Pointer to the string holding the keyword value. * * \retval 0 On success * \retval -1 On failure */ int DetectHttpHHSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_HOST, DETECT_SM_LIST_HHHDMATCH, ALPROTO_HTTP, NULL); } /** * \brief The function to free the http_host data. * * \param ptr Pointer to the http_host. */ void DetectHttpHHFree(void *ptr) { DetectContentData *hhhd = (DetectContentData *)ptr; if (hhhd == NULL) return; if (hhhd->content != NULL) SCFree(hhhd->content); SpmDestroyCtx(hhhd->spm_ctx); SCFree(hhhd); return; } /************************************Unittests*********************************/ #ifdef UNITTESTS #include "stream-tcp-reassemble.h" /** * \test Test that a signature containting a http_host is correctly parsed * and the keyword is registered. */ static int DetectHttpHHTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_host\"; " "content:\"one\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 1; } else { goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a signature containing an valid http_host entry is * parsed. */ static int DetectHttpHHTest02(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_host\"; " "content:\"one\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing no content but a * http_host is invalidated. */ static int DetectHttpHHTest03(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_host\"; " "http_host; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that an invalid signature containing a rawbytes along with a * http_host is invalidated. */ static int DetectHttpHHTest04(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_host\"; " "content:\"one\"; rawbytes; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test that a http_host with nocase is parsed. */ static int DetectHttpHHTest05(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_host\"; " "content:\"one\"; http_host; sid:1;)"); if (de_ctx->sig_list != NULL) result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** *\test Test that the http_host content matches against a http request * which holds the content. */ static int DetectHttpHHTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_host content matches against a http request * which holds the content. */ static int DetectHttpHHTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message"; uint8_t http2_buf[] = "body1\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched on p1 but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match on p2 but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_host content matches against a http request * which holds the content. */ static int DetectHttpHHTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "host: This is dummy mess"; uint8_t http2_buf[] = "age body\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"message\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_host content matches against a http request * which holds the content, against a cross boundary present pattern. */ static int DetectHttpHHTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy body1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy body1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"body1this\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the http_host content matches against a http request * against a case insensitive pattern. */ static int DetectHttpHHTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy bodY1"; uint8_t http2_buf[] = "This is dummy message body2\r\n" "Content-Type: text/html\r\n" "Content-Length: 46\r\n" "\r\n" "This is dummy bodY1"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"body1this\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** *\test Test that the negated http_host content matches against a * http request which doesn't hold the content. */ static int DetectHttpHHTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy message body\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:!\"message\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Negative test that the negated http_host content matches against a * http request which holds hold the content. */ static int DetectHttpHHTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: This is dummy body\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:!\"message\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectHttpHHTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "User-Agent: www.openinfosecfoundation.org\r\n" "Host: longbufferabcdefghijklmnopqrstuvwxyz0123456789bufferend\r\n" "Content-Type: text/html\r\n" "\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host test\"; " "content:\"abcdefghijklmnopqrstuvwxyz0123456789\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test multiple http transactions and body chunks of request handling */ static int DetectHttpHHTest14(void) { int result = 0; Signature *s = NULL; DetectEngineThreadCtx *det_ctx = NULL; ThreadVars th_v; Flow f; TcpSession ssn; Packet *p = NULL; uint8_t httpbuf1[] = "POST / HTTP/1.1\r\n"; uint8_t httpbuf2[] = "Cookie: dummy1\r\n"; uint8_t httpbuf3[] = "Host: Body one!!\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "GET /?var=val HTTP/1.1\r\n"; uint8_t httpbuf5[] = "Cookie: dummy2\r\n"; uint8_t httpbuf6[] = "Host: Body two\r\n\r\n"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"POST\"; http_method; content:\"dummy1\"; http_cookie; content:\"body one\"; http_host; sid:1; rev:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"dummy2\"; http_cookie; content:\"body two\"; http_host; sid:2; rev:1;)"); if (s == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted (2): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sig 1 didn't alert: "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || PacketAlertCheck(p, 2)) { printf("sig 1 alerted (4): "); goto end; } p->alerts.cnt = 0; FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ((PacketAlertCheck(p, 1)) || (PacketAlertCheck(p, 2))) { printf("sig 1 alerted (request 2, chunk 6): "); goto end; } p->alerts.cnt = 0; SCLogDebug("sending data chunk 7"); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 7 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) || !(PacketAlertCheck(p, 2))) { printf("signature 2 didn't match or sig 1 matched, but shouldn't have: "); goto end; } p->alerts.cnt = 0; HtpState *htp_state = f.alstate; if (htp_state == NULL) { printf("no http state: "); result = 0; goto end; } if (AppLayerParserGetTxCnt(IPPROTO_TCP, ALPROTO_HTTP, htp_state) != 2) { printf("The http app layer doesn't have 2 transactions, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); return result; } int DetectHttpHHTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; content:\"two\"; http_host; " "content:\"three\"; distance:10; http_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "two", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd1) || !DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; pcre:/two/; " "content:\"three\"; distance:10; http_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest24(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; pcre:/two/; " "content:\"three\"; distance:10; within:15; http_host; content:\"four\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != 0 || cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { goto end; } if (!DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; pcre:/two/; " "content:\"three\"; distance:10; http_host; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_host; pcre:/two/; " "content:\"three\"; distance:10; http_host; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT | DETECT_CONTENT_OFFSET) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { printf ("failed: http_host incorrect flags"); goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; offset:10; http_host; pcre:/two/; " "content:\"three\"; distance:10; http_host; within:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; pcre:/two/; " "content:\"three\"; http_host; depth:10; " "content:\"four\"; distance:10; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || cd2->flags != DETECT_CONTENT_DISTANCE || memcmp(cd2->content, "four", cd2->content_len) != 0 || hhhd1->flags != (0) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DEPTH) || memcmp(hhhd2->content, "three", hhhd1->content_len) != 0) { goto end; } if (DETECT_CONTENT_IS_SINGLE(cd2) || !DETECT_CONTENT_IS_SINGLE(hhhd1) || DETECT_CONTENT_IS_SINGLE(hhhd2)) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; distance:0; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hhhd2->content, "two", hhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; " "content:\"two\"; within:5; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "one", hhhd1->content_len) != 0 || hhhd2->flags != (DETECT_CONTENT_WITHIN) || memcmp(hhhd2->content, "two", hhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; http_host; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list != NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"one\"; within:5; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/W; " "content:\"two\"; within:5; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhhd2->flags != (DETECT_CONTENT_WITHIN) || memcmp(hhhd2->content, "two", hhhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"two\"; http_host; " "pcre:/one/WR; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->type != DETECT_PCRE || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->type != DETECT_CONTENT) { goto end; } DetectContentData *hhhd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd2->flags != (DETECT_PCRE_RELATIVE) || hhhd1->flags != (DETECT_CONTENT_RELATIVE_NEXT) || memcmp(hhhd1->content, "two", hhhd1->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectHttpHHTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(pcre:/one/W; " "content:\"two\"; distance:5; http_host; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL) { printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HHHDMATCH] == NULL\n"); goto end; } if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH] == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->type != DETECT_CONTENT || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev == NULL || de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->type != DETECT_PCRE) { goto end; } DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->prev->ctx; DetectContentData *hhhd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH]->ctx; if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) || hhhd2->flags != (DETECT_CONTENT_DISTANCE) || memcmp(hhhd2->content, "two", hhhd2->content_len) != 0) { goto end; } result = 1; end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ void DetectHttpHHRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectHttpHHTest01", DetectHttpHHTest01); UtRegisterTest("DetectHttpHHTest02", DetectHttpHHTest02); UtRegisterTest("DetectHttpHHTest03", DetectHttpHHTest03); UtRegisterTest("DetectHttpHHTest04", DetectHttpHHTest04); UtRegisterTest("DetectHttpHHTest05", DetectHttpHHTest05); UtRegisterTest("DetectHttpHHTest06", DetectHttpHHTest06); UtRegisterTest("DetectHttpHHTest07", DetectHttpHHTest07); UtRegisterTest("DetectHttpHHTest08", DetectHttpHHTest08); UtRegisterTest("DetectHttpHHTest09", DetectHttpHHTest09); UtRegisterTest("DetectHttpHHTest10", DetectHttpHHTest10); UtRegisterTest("DetectHttpHHTest11", DetectHttpHHTest11); UtRegisterTest("DetectHttpHHTest12", DetectHttpHHTest12); UtRegisterTest("DetectHttpHHTest13", DetectHttpHHTest13); UtRegisterTest("DetectHttpHHTest14", DetectHttpHHTest14); UtRegisterTest("DetectHttpHHTest22", DetectHttpHHTest22); UtRegisterTest("DetectHttpHHTest23", DetectHttpHHTest23); UtRegisterTest("DetectHttpHHTest24", DetectHttpHHTest24); UtRegisterTest("DetectHttpHHTest25", DetectHttpHHTest25); UtRegisterTest("DetectHttpHHTest26", DetectHttpHHTest26); UtRegisterTest("DetectHttpHHTest27", DetectHttpHHTest27); UtRegisterTest("DetectHttpHHTest28", DetectHttpHHTest28); UtRegisterTest("DetectHttpHHTest29", DetectHttpHHTest29); UtRegisterTest("DetectHttpHHTest30", DetectHttpHHTest30); UtRegisterTest("DetectHttpHHTest31", DetectHttpHHTest31); UtRegisterTest("DetectHttpHHTest32", DetectHttpHHTest32); UtRegisterTest("DetectHttpHHTest33", DetectHttpHHTest33); UtRegisterTest("DetectHttpHHTest34", DetectHttpHHTest34); UtRegisterTest("DetectHttpHHTest35", DetectHttpHHTest35); UtRegisterTest("DetectHttpHHTest36", DetectHttpHHTest36); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/app-layer-detect-proto.c0000644000000000000000000040510013051004444015446 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "detect.h" #include "detect-engine-port.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-content.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "util-print.h" #include "util-pool.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow.h" #include "flow-util.h" #include "flow-private.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-detect-proto.h" #include "conf.h" #include "util-memcmp.h" #include "util-spm.h" #include "util-cuda.h" #include "util-debug.h" #include "runmodes.h" typedef struct AppLayerProtoDetectProbingParserElement_ { AppProto alproto; /* \todo don't really need it. See if you can get rid of it */ uint16_t port; /* \todo calculate at runtime and get rid of this var */ uint32_t alproto_mask; /* \todo check if we can reduce the bottom 2 vars to uint16_t */ /* the min length of data that has to be supplied to invoke the parser */ uint32_t min_depth; /* the max length of data after which this parser won't be invoked */ uint32_t max_depth; /* the to_server probing parser function */ ProbingParserFPtr ProbingParserTs; /* the to_client probing parser function */ ProbingParserFPtr ProbingParserTc; struct AppLayerProtoDetectProbingParserElement_ *next; } AppLayerProtoDetectProbingParserElement; typedef struct AppLayerProtoDetectProbingParserPort_ { /* the port no for which probing parser(s) are invoked */ uint16_t port; uint32_t alproto_mask; /* the max depth for all the probing parsers registered for this port */ uint16_t dp_max_depth; uint16_t sp_max_depth; AppLayerProtoDetectProbingParserElement *dp; AppLayerProtoDetectProbingParserElement *sp; struct AppLayerProtoDetectProbingParserPort_ *next; } AppLayerProtoDetectProbingParserPort; typedef struct AppLayerProtoDetectProbingParser_ { uint8_t ipproto; AppLayerProtoDetectProbingParserPort *port; struct AppLayerProtoDetectProbingParser_ *next; } AppLayerProtoDetectProbingParser; typedef struct AppLayerProtoDetectPMSignature_ { AppProto alproto; SigIntId id; /* \todo Change this into a non-pointer */ DetectContentData *cd; struct AppLayerProtoDetectPMSignature_ *next; } AppLayerProtoDetectPMSignature; typedef struct AppLayerProtoDetectPMCtx_ { uint16_t max_len; uint16_t min_len; MpmCtx mpm_ctx; /** Mapping between pattern id and signature. As each signature has a * unique pattern with a unique id, we can lookup the signature by * the pattern id. */ AppLayerProtoDetectPMSignature **map; AppLayerProtoDetectPMSignature *head; /* \todo we don't need this except at setup time. Get rid of it. */ PatIntId max_pat_id; SigIntId max_sig_id; } AppLayerProtoDetectPMCtx; typedef struct AppLayerProtoDetectCtxIpproto_ { /* 0 - toserver, 1 - toclient */ AppLayerProtoDetectPMCtx ctx_pm[2]; } AppLayerProtoDetectCtxIpproto; /** * \brief The app layer protocol detection context. */ typedef struct AppLayerProtoDetectCtx_ { /* Context per ip_proto. * \todo Modify ctx_ipp to hold for only tcp and udp. The rest can be * implemented if needed. Waste of space otherwise. */ AppLayerProtoDetectCtxIpproto ctx_ipp[FLOW_PROTO_DEFAULT]; /* Global SPM thread context prototype. */ SpmGlobalThreadCtx *spm_global_thread_ctx; AppLayerProtoDetectProbingParser *ctx_pp; /* Indicates the protocols that have registered themselves * for protocol detection. This table is independent of the * ipproto. */ char *alproto_names[ALPROTO_MAX]; } AppLayerProtoDetectCtx; /** * \brief The app layer protocol detection thread context. */ struct AppLayerProtoDetectThreadCtx_ { PrefilterRuleStore pmq; /* The value 2 is for direction(0 - toserver, 1 - toclient). */ MpmThreadCtx mpm_tctx[FLOW_PROTO_DEFAULT][2]; SpmThreadCtx *spm_thread_ctx; }; /* The global app layer proto detection context. */ static AppLayerProtoDetectCtx alpd_ctx; /***** Static Internal Calls: Protocol Retrieval *****/ /** \internal * \brief Handle SPM search for Signature */ static AppProto AppLayerProtoDetectPMMatchSignature(const AppLayerProtoDetectPMSignature *s, AppLayerProtoDetectThreadCtx *tctx, uint8_t *buf, uint16_t buflen, uint8_t ipproto) { SCEnter(); AppProto proto = ALPROTO_UNKNOWN; uint8_t *found = NULL; if (s->cd->offset > buflen) { SCLogDebug("s->co->offset (%"PRIu16") > buflen (%"PRIu16")", s->cd->offset, buflen); goto end; } if (s->cd->depth > buflen) { SCLogDebug("s->co->depth (%"PRIu16") > buflen (%"PRIu16")", s->cd->depth, buflen); goto end; } uint8_t *sbuf = buf + s->cd->offset; uint16_t sbuflen = s->cd->depth - s->cd->offset; SCLogDebug("s->co->offset (%"PRIu16") s->cd->depth (%"PRIu16")", s->cd->offset, s->cd->depth); found = SpmScan(s->cd->spm_ctx, tctx->spm_thread_ctx, sbuf, sbuflen); if (found != NULL) proto = s->alproto; end: SCReturnUInt(proto); } /** \internal * \brief Run Pattern Sigs against buffer * \param pm_results[out] AppProto array of size ALPROTO_MAX */ static AppProto AppLayerProtoDetectPMGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, uint8_t *buf, uint16_t buflen, uint8_t direction, uint8_t ipproto, AppProto *pm_results) { SCEnter(); pm_results[0] = ALPROTO_UNKNOWN; AppLayerProtoDetectPMCtx *pm_ctx; MpmThreadCtx *mpm_tctx; uint16_t pm_matches = 0; uint8_t cnt; uint16_t searchlen; if (f->protomap >= FLOW_PROTO_DEFAULT) return ALPROTO_UNKNOWN; if (direction & STREAM_TOSERVER) { pm_ctx = &alpd_ctx.ctx_ipp[f->protomap].ctx_pm[0]; mpm_tctx = &tctx->mpm_tctx[f->protomap][0]; } else { pm_ctx = &alpd_ctx.ctx_ipp[f->protomap].ctx_pm[1]; mpm_tctx = &tctx->mpm_tctx[f->protomap][1]; } if (pm_ctx->mpm_ctx.pattern_cnt == 0) goto end; searchlen = buflen; if (searchlen > pm_ctx->max_len) searchlen = pm_ctx->max_len; uint32_t search_cnt = 0; /* do the mpm search */ search_cnt = mpm_table[pm_ctx->mpm_ctx.mpm_type].Search(&pm_ctx->mpm_ctx, mpm_tctx, &tctx->pmq, buf, searchlen); if (search_cnt == 0) goto end; /* alproto bit field */ uint8_t pm_results_bf[(ALPROTO_MAX / 8) + 1]; memset(pm_results_bf, 0, sizeof(pm_results_bf)); /* loop through unique pattern id's. Can't use search_cnt here, * as that contains all matches, tctx->pmq.pattern_id_array_cnt * contains only *unique* matches. */ for (cnt = 0; cnt < tctx->pmq.rule_id_array_cnt; cnt++) { const AppLayerProtoDetectPMSignature *s = pm_ctx->map[tctx->pmq.rule_id_array[cnt]]; while (s != NULL) { AppProto proto = AppLayerProtoDetectPMMatchSignature(s, tctx, buf, searchlen, ipproto); /* store each unique proto once */ if (proto != ALPROTO_UNKNOWN && !(pm_results_bf[proto / 8] & (1 << (proto % 8))) ) { pm_results[pm_matches++] = proto; pm_results_bf[proto / 8] |= 1 << (proto % 8); } s = s->next; } } end: PmqReset(&tctx->pmq); if (buflen >= pm_ctx->max_len) FLOW_SET_PM_DONE(f, direction); SCReturnUInt(pm_matches); } static AppLayerProtoDetectProbingParserPort *AppLayerProtoDetectGetProbingParsers(AppLayerProtoDetectProbingParser *pp, uint8_t ipproto, uint16_t port) { AppLayerProtoDetectProbingParserPort *pp_port = NULL; while (pp != NULL) { if (pp->ipproto == ipproto) break; pp = pp->next; } if (pp == NULL) goto end; pp_port = pp->port; while (pp_port != NULL) { if (pp_port->port == port || pp_port->port == 0) { break; } pp_port = pp_port->next; } end: SCReturnPtr(pp_port, "AppLayerProtoDetectProbingParserPort *"); } /** * \brief Call the probing parser if it exists for this flow. * * First we check the flow's dp as it's most likely to match. If that didn't * lead to a PP, we try the sp. * */ static AppProto AppLayerProtoDetectPPGetProto(Flow *f, uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t direction) { const AppLayerProtoDetectProbingParserPort *pp_port_dp = NULL; const AppLayerProtoDetectProbingParserPort *pp_port_sp = NULL; const AppLayerProtoDetectProbingParserElement *pe = NULL; const AppLayerProtoDetectProbingParserElement *pe1 = NULL; const AppLayerProtoDetectProbingParserElement *pe2 = NULL; AppProto alproto = ALPROTO_UNKNOWN; uint32_t *alproto_masks; uint32_t mask = 0; if (direction & STREAM_TOSERVER) { /* first try the destination port */ pp_port_dp = AppLayerProtoDetectGetProbingParsers(alpd_ctx.ctx_pp, ipproto, f->dp); alproto_masks = &f->probing_parser_toserver_alproto_masks; if (pp_port_dp != NULL) { SCLogDebug("toserver - Probing parser found for destination port %"PRIu16, f->dp); /* found based on destination port, so use dp registration */ pe1 = pp_port_dp->dp; } else { SCLogDebug("toserver - No probing parser registered for dest port %"PRIu16, f->dp); } pp_port_sp = AppLayerProtoDetectGetProbingParsers(alpd_ctx.ctx_pp, ipproto, f->sp); if (pp_port_sp != NULL) { SCLogDebug("toserver - Probing parser found for source port %"PRIu16, f->sp); /* found based on source port, so use sp registration */ pe2 = pp_port_sp->sp; } else { SCLogDebug("toserver - No probing parser registered for source port %"PRIu16, f->sp); } } else { /* first try the destination port */ pp_port_dp = AppLayerProtoDetectGetProbingParsers(alpd_ctx.ctx_pp, ipproto, f->dp); alproto_masks = &f->probing_parser_toclient_alproto_masks; if (pp_port_dp != NULL) { SCLogDebug("toclient - Probing parser found for destination port %"PRIu16, f->dp); /* found based on destination port, so use dp registration */ pe1 = pp_port_dp->dp; } else { SCLogDebug("toclient - No probing parser registered for dest port %"PRIu16, f->dp); } pp_port_sp = AppLayerProtoDetectGetProbingParsers(alpd_ctx.ctx_pp, ipproto, f->sp); if (pp_port_sp != NULL) { SCLogDebug("toclient - Probing parser found for source port %"PRIu16, f->sp); pe2 = pp_port_sp->sp; } else { SCLogDebug("toclient - No probing parser registered for source port %"PRIu16, f->sp); } } if (pe1 == NULL && pe2 == NULL) { SCLogDebug("%s - No probing parsers found for either port", (direction & STREAM_TOSERVER) ? "toserver":"toclient"); FLOW_SET_PP_DONE(f, direction); goto end; } /* run the parser(s) */ pe = pe1; while (pe != NULL) { if ((buflen < pe->min_depth) || (alproto_masks[0] & pe->alproto_mask)) { pe = pe->next; continue; } if (direction & STREAM_TOSERVER && pe->ProbingParserTs != NULL) { alproto = pe->ProbingParserTs(buf, buflen, NULL); } else if (pe->ProbingParserTc != NULL) { alproto = pe->ProbingParserTc(buf, buflen, NULL); } if (alproto != ALPROTO_UNKNOWN && alproto != ALPROTO_FAILED) goto end; if (alproto == ALPROTO_FAILED || (pe->max_depth != 0 && buflen > pe->max_depth)) { alproto_masks[0] |= pe->alproto_mask; } pe = pe->next; } pe = pe2; while (pe != NULL) { if ((buflen < pe->min_depth) || (alproto_masks[0] & pe->alproto_mask)) { pe = pe->next; continue; } if (direction & STREAM_TOSERVER && pe->ProbingParserTs != NULL) { alproto = pe->ProbingParserTs(buf, buflen, NULL); } else if (pe->ProbingParserTc != NULL) { alproto = pe->ProbingParserTc(buf, buflen, NULL); } if (alproto != ALPROTO_UNKNOWN && alproto != ALPROTO_FAILED) goto end; if (alproto == ALPROTO_FAILED || (pe->max_depth != 0 && buflen > pe->max_depth)) { alproto_masks[0] |= pe->alproto_mask; } pe = pe->next; } /* get the mask we need for this direction */ if (pp_port_dp && pp_port_sp) mask = pp_port_dp->alproto_mask|pp_port_sp->alproto_mask; else if (pp_port_dp) mask = pp_port_dp->alproto_mask; else if (pp_port_sp) mask = pp_port_sp->alproto_mask; if (alproto_masks[0] == mask) { FLOW_SET_PP_DONE(f, direction); SCLogDebug("%s, mask is now %08x, needed %08x, so done", (direction & STREAM_TOSERVER) ? "toserver":"toclient", alproto_masks[0], mask); } else { SCLogDebug("%s, mask is now %08x, need %08x", (direction & STREAM_TOSERVER) ? "toserver":"toclient", alproto_masks[0], mask); } end: SCLogDebug("%s, mask is now %08x", (direction & STREAM_TOSERVER) ? "toserver":"toclient", alproto_masks[0]); SCReturnUInt(alproto); } /***** Static Internal Calls: PP registration *****/ static void AppLayerProtoDetectPPGetIpprotos(AppProto alproto, uint8_t *ipprotos) { SCEnter(); const AppLayerProtoDetectProbingParser *pp; const AppLayerProtoDetectProbingParserPort *pp_port; const AppLayerProtoDetectProbingParserElement *pp_pe; for (pp = alpd_ctx.ctx_pp; pp != NULL; pp = pp->next) { for (pp_port = pp->port; pp_port != NULL; pp_port = pp_port->next) { for (pp_pe = pp_port->dp; pp_pe != NULL; pp_pe = pp_pe->next) { if (alproto == pp_pe->alproto) ipprotos[pp->ipproto / 8] |= 1 << (pp->ipproto % 8); } for (pp_pe = pp_port->sp; pp_pe != NULL; pp_pe = pp_pe->next) { if (alproto == pp_pe->alproto) ipprotos[pp->ipproto / 8] |= 1 << (pp->ipproto % 8); } } } SCReturn; } static uint32_t AppLayerProtoDetectProbingParserGetMask(AppProto alproto) { SCEnter(); if (!(alproto > ALPROTO_UNKNOWN && alproto < ALPROTO_FAILED)) { SCLogError(SC_ERR_ALPARSER, "Unknown protocol detected - %"PRIu16, alproto); exit(EXIT_FAILURE); } SCReturnUInt(1 << alproto); } static AppLayerProtoDetectProbingParserElement *AppLayerProtoDetectProbingParserElementAlloc(void) { SCEnter(); AppLayerProtoDetectProbingParserElement *p = SCMalloc(sizeof(AppLayerProtoDetectProbingParserElement)); if (unlikely(p == NULL)) { exit(EXIT_FAILURE); } memset(p, 0, sizeof(AppLayerProtoDetectProbingParserElement)); SCReturnPtr(p, "AppLayerProtoDetectProbingParserElement"); } static void AppLayerProtoDetectProbingParserElementFree(AppLayerProtoDetectProbingParserElement *p) { SCEnter(); SCFree(p); SCReturn; } static AppLayerProtoDetectProbingParserPort *AppLayerProtoDetectProbingParserPortAlloc(void) { SCEnter(); AppLayerProtoDetectProbingParserPort *p = SCMalloc(sizeof(AppLayerProtoDetectProbingParserPort)); if (unlikely(p == NULL)) { exit(EXIT_FAILURE); } memset(p, 0, sizeof(AppLayerProtoDetectProbingParserPort)); SCReturnPtr(p, "AppLayerProtoDetectProbingParserPort"); } static void AppLayerProtoDetectProbingParserPortFree(AppLayerProtoDetectProbingParserPort *p) { SCEnter(); AppLayerProtoDetectProbingParserElement *e; e = p->dp; while (e != NULL) { AppLayerProtoDetectProbingParserElement *e_next = e->next; AppLayerProtoDetectProbingParserElementFree(e); e = e_next; } e = p->sp; while (e != NULL) { AppLayerProtoDetectProbingParserElement *e_next = e->next; AppLayerProtoDetectProbingParserElementFree(e); e = e_next; } SCFree(p); SCReturn; } static AppLayerProtoDetectProbingParser *AppLayerProtoDetectProbingParserAlloc(void) { SCEnter(); AppLayerProtoDetectProbingParser *p = SCMalloc(sizeof(AppLayerProtoDetectProbingParser)); if (unlikely(p == NULL)) { exit(EXIT_FAILURE); } memset(p, 0, sizeof(AppLayerProtoDetectProbingParser)); SCReturnPtr(p, "AppLayerProtoDetectProbingParser"); } static void AppLayerProtoDetectProbingParserFree(AppLayerProtoDetectProbingParser *p) { SCEnter(); AppLayerProtoDetectProbingParserPort *pt = p->port; while (pt != NULL) { AppLayerProtoDetectProbingParserPort *pt_next = pt->next; AppLayerProtoDetectProbingParserPortFree(pt); pt = pt_next; } SCFree(p); SCReturn; } static AppLayerProtoDetectProbingParserElement * AppLayerProtoDetectProbingParserElementCreate(AppProto alproto, uint16_t port, uint16_t min_depth, uint16_t max_depth) { AppLayerProtoDetectProbingParserElement *pe = AppLayerProtoDetectProbingParserElementAlloc(); pe->alproto = alproto; pe->port = port; pe->alproto_mask = AppLayerProtoDetectProbingParserGetMask(alproto); pe->min_depth = min_depth; pe->max_depth = max_depth; pe->next = NULL; if (max_depth != 0 && min_depth >= max_depth) { SCLogError(SC_ERR_ALPARSER, "Invalid arguments sent to " "register the probing parser. min_depth >= max_depth"); goto error; } if (alproto <= ALPROTO_UNKNOWN || alproto >= ALPROTO_MAX) { SCLogError(SC_ERR_ALPARSER, "Invalid arguments sent to register " "the probing parser. Invalid alproto - %d", alproto); goto error; } SCReturnPtr(pe, "AppLayerProtoDetectProbingParserElement"); error: AppLayerProtoDetectProbingParserElementFree(pe); SCReturnPtr(NULL, "AppLayerProtoDetectProbingParserElement"); } static AppLayerProtoDetectProbingParserElement * AppLayerProtoDetectProbingParserElementDuplicate(AppLayerProtoDetectProbingParserElement *pe) { SCEnter(); AppLayerProtoDetectProbingParserElement *new_pe = AppLayerProtoDetectProbingParserElementAlloc(); new_pe->alproto = pe->alproto; new_pe->port = pe->port; new_pe->alproto_mask = pe->alproto_mask; new_pe->min_depth = pe->min_depth; new_pe->max_depth = pe->max_depth; new_pe->ProbingParserTs = pe->ProbingParserTs; new_pe->ProbingParserTc = pe->ProbingParserTc; new_pe->next = NULL; SCReturnPtr(new_pe, "AppLayerProtoDetectProbingParserElement"); } void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingParser *pp) { SCEnter(); AppLayerProtoDetectProbingParserPort *pp_port = NULL; AppLayerProtoDetectProbingParserElement *pp_pe = NULL; printf("\nProtocol Detection Configuration\n"); for ( ; pp != NULL; pp = pp->next) { /* print ip protocol */ if (pp->ipproto == IPPROTO_TCP) printf("IPProto: TCP\n"); else if (pp->ipproto == IPPROTO_UDP) printf("IPProto: UDP\n"); else printf("IPProto: %"PRIu8"\n", pp->ipproto); pp_port = pp->port; for ( ; pp_port != NULL; pp_port = pp_port->next) { if (pp_port->dp != NULL) { printf(" Port: %"PRIu16 "\n", pp_port->port); printf(" Destination port: (max-depth: %"PRIu16 ", " "mask - %"PRIu32")\n", pp_port->dp_max_depth, pp_port->alproto_mask); pp_pe = pp_port->dp; for ( ; pp_pe != NULL; pp_pe = pp_pe->next) { if (pp_pe->alproto == ALPROTO_HTTP) printf(" alproto: ALPROTO_HTTP\n"); else if (pp_pe->alproto == ALPROTO_FTP) printf(" alproto: ALPROTO_FTP\n"); else if (pp_pe->alproto == ALPROTO_SMTP) printf(" alproto: ALPROTO_SMTP\n"); else if (pp_pe->alproto == ALPROTO_TLS) printf(" alproto: ALPROTO_TLS\n"); else if (pp_pe->alproto == ALPROTO_SSH) printf(" alproto: ALPROTO_SSH\n"); else if (pp_pe->alproto == ALPROTO_IMAP) printf(" alproto: ALPROTO_IMAP\n"); else if (pp_pe->alproto == ALPROTO_MSN) printf(" alproto: ALPROTO_MSN\n"); else if (pp_pe->alproto == ALPROTO_JABBER) printf(" alproto: ALPROTO_JABBER\n"); else if (pp_pe->alproto == ALPROTO_SMB) printf(" alproto: ALPROTO_SMB\n"); else if (pp_pe->alproto == ALPROTO_SMB2) printf(" alproto: ALPROTO_SMB2\n"); else if (pp_pe->alproto == ALPROTO_DCERPC) printf(" alproto: ALPROTO_DCERPC\n"); else if (pp_pe->alproto == ALPROTO_IRC) printf(" alproto: ALPROTO_IRC\n"); else if (pp_pe->alproto == ALPROTO_DNS) printf(" alproto: ALPROTO_DNS\n"); else if (pp_pe->alproto == ALPROTO_MODBUS) printf(" alproto: ALPROTO_MODBUS\n"); else if (pp_pe->alproto == ALPROTO_ENIP) printf(" alproto: ALPROTO_ENIP\n"); else if (pp_pe->alproto == ALPROTO_TEMPLATE) printf(" alproto: ALPROTO_TEMPLATE\n"); else if (pp_pe->alproto == ALPROTO_DNP3) printf(" alproto: ALPROTO_DNP3\n"); else printf("impossible\n"); printf(" port: %"PRIu16 "\n", pp_pe->port); printf(" mask: %"PRIu32 "\n", pp_pe->alproto_mask); printf(" min_depth: %"PRIu32 "\n", pp_pe->min_depth); printf(" max_depth: %"PRIu32 "\n", pp_pe->max_depth); printf("\n"); } } if (pp_port->sp == NULL) { continue; } printf(" Source port: (max-depth: %"PRIu16 ", " "mask - %"PRIu32")\n", pp_port->sp_max_depth, pp_port->alproto_mask); pp_pe = pp_port->sp; for ( ; pp_pe != NULL; pp_pe = pp_pe->next) { if (pp_pe->alproto == ALPROTO_HTTP) printf(" alproto: ALPROTO_HTTP\n"); else if (pp_pe->alproto == ALPROTO_FTP) printf(" alproto: ALPROTO_FTP\n"); else if (pp_pe->alproto == ALPROTO_SMTP) printf(" alproto: ALPROTO_SMTP\n"); else if (pp_pe->alproto == ALPROTO_TLS) printf(" alproto: ALPROTO_TLS\n"); else if (pp_pe->alproto == ALPROTO_SSH) printf(" alproto: ALPROTO_SSH\n"); else if (pp_pe->alproto == ALPROTO_IMAP) printf(" alproto: ALPROTO_IMAP\n"); else if (pp_pe->alproto == ALPROTO_MSN) printf(" alproto: ALPROTO_MSN\n"); else if (pp_pe->alproto == ALPROTO_JABBER) printf(" alproto: ALPROTO_JABBER\n"); else if (pp_pe->alproto == ALPROTO_SMB) printf(" alproto: ALPROTO_SMB\n"); else if (pp_pe->alproto == ALPROTO_SMB2) printf(" alproto: ALPROTO_SMB2\n"); else if (pp_pe->alproto == ALPROTO_DCERPC) printf(" alproto: ALPROTO_DCERPC\n"); else if (pp_pe->alproto == ALPROTO_IRC) printf(" alproto: ALPROTO_IRC\n"); else if (pp_pe->alproto == ALPROTO_DNS) printf(" alproto: ALPROTO_DNS\n"); else if (pp_pe->alproto == ALPROTO_MODBUS) printf(" alproto: ALPROTO_MODBUS\n"); else if (pp_pe->alproto == ALPROTO_ENIP) printf(" alproto: ALPROTO_ENIP\n"); else if (pp_pe->alproto == ALPROTO_TEMPLATE) printf(" alproto: ALPROTO_TEMPLATE\n"); else if (pp_pe->alproto == ALPROTO_DNP3) printf(" alproto: ALPROTO_DNP3\n"); else printf("impossible\n"); printf(" port: %"PRIu16 "\n", pp_pe->port); printf(" mask: %"PRIu32 "\n", pp_pe->alproto_mask); printf(" min_depth: %"PRIu32 "\n", pp_pe->min_depth); printf(" max_depth: %"PRIu32 "\n", pp_pe->max_depth); printf("\n"); } } } SCReturn; } static void AppLayerProtoDetectProbingParserElementAppend(AppLayerProtoDetectProbingParserElement **head_pe, AppLayerProtoDetectProbingParserElement *new_pe) { SCEnter(); if (*head_pe == NULL) { *head_pe = new_pe; goto end; } if ((*head_pe)->port == 0) { if (new_pe->port != 0) { new_pe->next = *head_pe; *head_pe = new_pe; } else { AppLayerProtoDetectProbingParserElement *temp_pe = *head_pe; while (temp_pe->next != NULL) temp_pe = temp_pe->next; temp_pe->next = new_pe; } } else { AppLayerProtoDetectProbingParserElement *temp_pe = *head_pe; if (new_pe->port == 0) { while (temp_pe->next != NULL) temp_pe = temp_pe->next; temp_pe->next = new_pe; } else { while (temp_pe->next != NULL && temp_pe->next->port != 0) temp_pe = temp_pe->next; new_pe->next = temp_pe->next; temp_pe->next = new_pe; } } end: SCReturn; } static void AppLayerProtoDetectProbingParserAppend(AppLayerProtoDetectProbingParser **head_pp, AppLayerProtoDetectProbingParser *new_pp) { SCEnter(); if (*head_pp == NULL) { *head_pp = new_pp; goto end; } AppLayerProtoDetectProbingParser *temp_pp = *head_pp; while (temp_pp->next != NULL) temp_pp = temp_pp->next; temp_pp->next = new_pp; end: SCReturn; } static void AppLayerProtoDetectProbingParserPortAppend(AppLayerProtoDetectProbingParserPort **head_port, AppLayerProtoDetectProbingParserPort *new_port) { SCEnter(); if (*head_port == NULL) { *head_port = new_port; goto end; } if ((*head_port)->port == 0) { new_port->next = *head_port; *head_port = new_port; } else { AppLayerProtoDetectProbingParserPort *temp_port = *head_port; while (temp_port->next != NULL && temp_port->next->port != 0) { temp_port = temp_port->next; } new_port->next = temp_port->next; temp_port->next = new_port; } end: SCReturn; } static void AppLayerProtoDetectInsertNewProbingParser(AppLayerProtoDetectProbingParser **pp, uint8_t ipproto, uint16_t port, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2) { SCEnter(); /* get the top level ipproto pp */ AppLayerProtoDetectProbingParser *curr_pp = *pp; while (curr_pp != NULL) { if (curr_pp->ipproto == ipproto) break; curr_pp = curr_pp->next; } if (curr_pp == NULL) { AppLayerProtoDetectProbingParser *new_pp = AppLayerProtoDetectProbingParserAlloc(); new_pp->ipproto = ipproto; AppLayerProtoDetectProbingParserAppend(pp, new_pp); curr_pp = new_pp; } /* get the top level port pp */ AppLayerProtoDetectProbingParserPort *curr_port = curr_pp->port; while (curr_port != NULL) { if (curr_port->port == port) break; curr_port = curr_port->next; } if (curr_port == NULL) { AppLayerProtoDetectProbingParserPort *new_port = AppLayerProtoDetectProbingParserPortAlloc(); new_port->port = port; AppLayerProtoDetectProbingParserPortAppend(&curr_pp->port, new_port); curr_port = new_port; if (direction & STREAM_TOSERVER) { curr_port->dp_max_depth = max_depth; } else { curr_port->sp_max_depth = max_depth; } AppLayerProtoDetectProbingParserPort *zero_port; zero_port = curr_pp->port; while (zero_port != NULL && zero_port->port != 0) { zero_port = zero_port->next; } if (zero_port != NULL) { AppLayerProtoDetectProbingParserElement *zero_pe; zero_pe = zero_port->dp; for ( ; zero_pe != NULL; zero_pe = zero_pe->next) { if (curr_port->dp == NULL) curr_port->dp_max_depth = zero_pe->max_depth; if (zero_pe->max_depth == 0) curr_port->dp_max_depth = zero_pe->max_depth; if (curr_port->dp_max_depth != 0 && curr_port->dp_max_depth < zero_pe->max_depth) { curr_port->dp_max_depth = zero_pe->max_depth; } AppLayerProtoDetectProbingParserElement *dup_pe = AppLayerProtoDetectProbingParserElementDuplicate(zero_pe); AppLayerProtoDetectProbingParserElementAppend(&curr_port->dp, dup_pe); curr_port->alproto_mask |= dup_pe->alproto_mask; } zero_pe = zero_port->sp; for ( ; zero_pe != NULL; zero_pe = zero_pe->next) { if (curr_port->sp == NULL) curr_port->sp_max_depth = zero_pe->max_depth; if (zero_pe->max_depth == 0) curr_port->sp_max_depth = zero_pe->max_depth; if (curr_port->sp_max_depth != 0 && curr_port->sp_max_depth < zero_pe->max_depth) { curr_port->sp_max_depth = zero_pe->max_depth; } AppLayerProtoDetectProbingParserElement *dup_pe = AppLayerProtoDetectProbingParserElementDuplicate(zero_pe); AppLayerProtoDetectProbingParserElementAppend(&curr_port->sp, dup_pe); curr_port->alproto_mask |= dup_pe->alproto_mask; } } /* if (zero_port != NULL) */ } /* if (curr_port == NULL) */ /* insert the pe_pp */ AppLayerProtoDetectProbingParserElement *curr_pe; if (direction & STREAM_TOSERVER) curr_pe = curr_port->dp; else curr_pe = curr_port->sp; while (curr_pe != NULL) { if (curr_pe->alproto == alproto) { SCLogError(SC_ERR_ALPARSER, "Duplicate pp registered - " "ipproto - %"PRIu8" Port - %"PRIu16" " "App Protocol - NULL, App Protocol(ID) - " "%"PRIu16" min_depth - %"PRIu16" " "max_dept - %"PRIu16".", ipproto, port, alproto, min_depth, max_depth); goto error; } curr_pe = curr_pe->next; } /* Get a new parser element */ AppLayerProtoDetectProbingParserElement *new_pe = AppLayerProtoDetectProbingParserElementCreate(alproto, curr_port->port, min_depth, max_depth); if (new_pe == NULL) goto error; curr_pe = new_pe; AppLayerProtoDetectProbingParserElement **head_pe; if (direction & STREAM_TOSERVER) { curr_pe->ProbingParserTs = ProbingParser1; curr_pe->ProbingParserTc = ProbingParser2; if (curr_port->dp == NULL) curr_port->dp_max_depth = new_pe->max_depth; if (new_pe->max_depth == 0) curr_port->dp_max_depth = new_pe->max_depth; if (curr_port->dp_max_depth != 0 && curr_port->dp_max_depth < new_pe->max_depth) { curr_port->dp_max_depth = new_pe->max_depth; } curr_port->alproto_mask |= new_pe->alproto_mask; head_pe = &curr_port->dp; } else { curr_pe->ProbingParserTs = ProbingParser2; curr_pe->ProbingParserTc = ProbingParser1; if (curr_port->sp == NULL) curr_port->sp_max_depth = new_pe->max_depth; if (new_pe->max_depth == 0) curr_port->sp_max_depth = new_pe->max_depth; if (curr_port->sp_max_depth != 0 && curr_port->sp_max_depth < new_pe->max_depth) { curr_port->sp_max_depth = new_pe->max_depth; } curr_port->alproto_mask |= new_pe->alproto_mask; head_pe = &curr_port->sp; } AppLayerProtoDetectProbingParserElementAppend(head_pe, new_pe); if (curr_port->port == 0) { AppLayerProtoDetectProbingParserPort *temp_port = curr_pp->port; while (temp_port != NULL && temp_port->port != 0) { if (direction & STREAM_TOSERVER) { if (temp_port->dp == NULL) temp_port->dp_max_depth = curr_pe->max_depth; if (curr_pe->max_depth == 0) temp_port->dp_max_depth = curr_pe->max_depth; if (temp_port->dp_max_depth != 0 && temp_port->dp_max_depth < curr_pe->max_depth) { temp_port->dp_max_depth = curr_pe->max_depth; } AppLayerProtoDetectProbingParserElementAppend(&temp_port->dp, AppLayerProtoDetectProbingParserElementDuplicate(curr_pe)); temp_port->alproto_mask |= curr_pe->alproto_mask; } else { if (temp_port->sp == NULL) temp_port->sp_max_depth = curr_pe->max_depth; if (curr_pe->max_depth == 0) temp_port->sp_max_depth = curr_pe->max_depth; if (temp_port->sp_max_depth != 0 && temp_port->sp_max_depth < curr_pe->max_depth) { temp_port->sp_max_depth = curr_pe->max_depth; } AppLayerProtoDetectProbingParserElementAppend(&temp_port->sp, AppLayerProtoDetectProbingParserElementDuplicate(curr_pe)); temp_port->alproto_mask |= curr_pe->alproto_mask; } temp_port = temp_port->next; } /* while */ } /* if */ error: SCReturn; } /***** Static Internal Calls: PM registration *****/ static void AppLayerProtoDetectPMGetIpprotos(AppProto alproto, uint8_t *ipprotos) { SCEnter(); const AppLayerProtoDetectPMSignature *s = NULL; int i, j; uint8_t ipproto; for (i = 0; i < FLOW_PROTO_DEFAULT; i++) { ipproto = FlowGetReverseProtoMapping(i); for (j = 0; j < 2; j++) { AppLayerProtoDetectPMCtx *pm_ctx = &alpd_ctx.ctx_ipp[i].ctx_pm[j]; SigIntId x; for (x = 0; x < pm_ctx->max_sig_id;x++) { s = pm_ctx->map[x]; if (s->alproto == alproto) ipprotos[ipproto / 8] |= 1 << (ipproto % 8); } } } SCReturn; } static int AppLayerProtoDetectPMSetContentIDs(AppLayerProtoDetectPMCtx *ctx) { SCEnter(); typedef struct TempContainer_ { PatIntId id; uint16_t content_len; uint8_t *content; } TempContainer; AppLayerProtoDetectPMSignature *s = NULL; uint32_t struct_total_size = 0; uint32_t content_total_size = 0; /* array hash buffer */ uint8_t *ahb = NULL; uint8_t *content = NULL; uint8_t content_len = 0; PatIntId max_id = 0; TempContainer *struct_offset = NULL; uint8_t *content_offset = NULL; int ret = 0; if (ctx->head == NULL) goto end; for (s = ctx->head; s != NULL; s = s->next) { struct_total_size += sizeof(TempContainer); content_total_size += s->cd->content_len; ctx->max_sig_id++; } ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size)); if (unlikely(ahb == NULL)) goto error; struct_offset = (TempContainer *)ahb; content_offset = ahb + struct_total_size; for (s = ctx->head; s != NULL; s = s->next) { TempContainer *tcdup = (TempContainer *)ahb; content = s->cd->content; content_len = s->cd->content_len; for (; tcdup != struct_offset; tcdup++) { if (tcdup->content_len != content_len || SCMemcmp(tcdup->content, content, tcdup->content_len) != 0) { continue; } break; } if (tcdup != struct_offset) { s->cd->id = tcdup->id; continue; } struct_offset->content_len = content_len; struct_offset->content = content_offset; content_offset += content_len; memcpy(struct_offset->content, content, content_len); struct_offset->id = max_id++; s->cd->id = struct_offset->id; struct_offset++; } ctx->max_pat_id = max_id; goto end; error: ret = -1; end: if (ahb != NULL) SCFree(ahb); SCReturnInt(ret); } static int AppLayerProtoDetectPMMapSignatures(AppLayerProtoDetectPMCtx *ctx) { SCEnter(); int ret = 0; AppLayerProtoDetectPMSignature *s, *next_s; int mpm_ret; SigIntId id = 0; ctx->map = SCMalloc(ctx->max_sig_id * sizeof(AppLayerProtoDetectPMSignature *)); if (ctx->map == NULL) goto error; memset(ctx->map, 0, ctx->max_sig_id * sizeof(AppLayerProtoDetectPMSignature *)); /* add an array indexed by rule id to look up the sig */ for (s = ctx->head; s != NULL; ) { next_s = s->next; s->id = id++; SCLogDebug("s->id %u", s->id); if (s->cd->flags & DETECT_CONTENT_NOCASE) { mpm_ret = MpmAddPatternCI(&ctx->mpm_ctx, s->cd->content, s->cd->content_len, 0, 0, s->cd->id, s->id, 0); if (mpm_ret < 0) goto error; } else { mpm_ret = MpmAddPatternCS(&ctx->mpm_ctx, s->cd->content, s->cd->content_len, 0, 0, s->cd->id, s->id, 0); if (mpm_ret < 0) goto error; } ctx->map[s->id] = s; s->next = NULL; s = next_s; } ctx->head = NULL; goto end; error: ret = -1; end: SCReturnInt(ret); } static int AppLayerProtoDetectPMPrepareMpm(AppLayerProtoDetectPMCtx *ctx) { SCEnter(); int ret = 0; MpmCtx *mpm_ctx = &ctx->mpm_ctx; if (mpm_table[mpm_ctx->mpm_type].Prepare(mpm_ctx) < 0) goto error; goto end; error: ret = -1; end: SCReturnInt(ret); } static void AppLayerProtoDetectPMFreeSignature(AppLayerProtoDetectPMSignature *sig) { SCEnter(); if (sig == NULL) SCReturn; if (sig->cd) DetectContentFree(sig->cd); SCFree(sig); SCReturn; } static int AppLayerProtoDetectPMAddSignature(AppLayerProtoDetectPMCtx *ctx, DetectContentData *cd, AppProto alproto) { SCEnter(); int ret = 0; AppLayerProtoDetectPMSignature *s = SCMalloc(sizeof(*s)); if (unlikely(s == NULL)) goto error; memset(s, 0, sizeof(*s)); s->alproto = alproto; s->cd = cd; /* prepend to the list */ s->next = ctx->head; ctx->head = s; goto end; error: ret = -1; end: SCReturnInt(ret); } static int AppLayerProtoDetectPMRegisterPattern(uint8_t ipproto, AppProto alproto, char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, uint8_t is_cs) { SCEnter(); AppLayerProtoDetectCtxIpproto *ctx_ipp = &alpd_ctx.ctx_ipp[FlowGetProtoMapping(ipproto)]; AppLayerProtoDetectPMCtx *ctx_pm = NULL; DetectContentData *cd; int ret = 0; cd = DetectContentParseEncloseQuotes(alpd_ctx.spm_global_thread_ctx, pattern); if (cd == NULL) goto error; cd->depth = depth; cd->offset = offset; if (!is_cs) { /* Rebuild as nocase */ SpmDestroyCtx(cd->spm_ctx); cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, alpd_ctx.spm_global_thread_ctx); if (cd->spm_ctx == NULL) { goto error; } cd->flags |= DETECT_CONTENT_NOCASE; } if (depth < cd->content_len) goto error; if (direction & STREAM_TOSERVER) ctx_pm = (AppLayerProtoDetectPMCtx *)&ctx_ipp->ctx_pm[0]; else ctx_pm = (AppLayerProtoDetectPMCtx *)&ctx_ipp->ctx_pm[1]; if (depth > ctx_pm->max_len) ctx_pm->max_len = depth; if (depth < ctx_pm->min_len) ctx_pm->min_len = depth; /* Finally turn it into a signature and add to the ctx. */ AppLayerProtoDetectPMAddSignature(ctx_pm, cd, alproto); goto end; error: ret = -1; end: SCReturnInt(ret); } /***** Protocol Retrieval *****/ AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t direction) { SCEnter(); AppProto alproto = ALPROTO_UNKNOWN; AppProto pm_results[ALPROTO_MAX]; uint16_t pm_matches; if (!FLOW_IS_PM_DONE(f, direction)) { pm_matches = AppLayerProtoDetectPMGetProto(tctx, f, buf, buflen, direction, ipproto, pm_results); if (pm_matches > 0) { alproto = pm_results[0]; goto end; } } if (!FLOW_IS_PP_DONE(f, direction)) alproto = AppLayerProtoDetectPPGetProto(f, buf, buflen, ipproto, direction); end: SCReturnCT(alproto, "AppProto"); } static void AppLayerProtoDetectFreeProbingParsers(AppLayerProtoDetectProbingParser *pp) { SCEnter(); AppLayerProtoDetectProbingParser *tmp_pp = NULL; if (pp == NULL) goto end; while (pp != NULL) { tmp_pp = pp->next; AppLayerProtoDetectProbingParserFree(pp); pp = tmp_pp; } end: SCReturn; } /***** State Preparation *****/ int AppLayerProtoDetectPrepareState(void) { SCEnter(); AppLayerProtoDetectPMCtx *ctx_pm; int i, j; int ret = 0; for (i = 0; i < FLOW_PROTO_DEFAULT; i++) { for (j = 0; j < 2; j++) { ctx_pm = &alpd_ctx.ctx_ipp[i].ctx_pm[j]; if (AppLayerProtoDetectPMSetContentIDs(ctx_pm) < 0) goto error; if (ctx_pm->max_sig_id == 0) continue; if (AppLayerProtoDetectPMMapSignatures(ctx_pm) < 0) goto error; if (AppLayerProtoDetectPMPrepareMpm(ctx_pm) < 0) goto error; } } #ifdef DEBUG if (SCLogDebugEnabled()) { AppLayerProtoDetectPrintProbingParsers(alpd_ctx.ctx_pp); } #endif goto end; error: ret = -1; end: SCReturnInt(ret); } /***** PP registration *****/ /** \brief register parser at a port * * \param direction STREAM_TOSERVER or STREAM_TOCLIENT for dp or sp */ void AppLayerProtoDetectPPRegister(uint8_t ipproto, char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2) { SCEnter(); DetectPort *head = NULL; DetectPortParse(NULL,&head, portstr); DetectPort *temp_dp = head; while (temp_dp != NULL) { uint32_t port = temp_dp->port; if (port == 0 && temp_dp->port2 != 0) port++; for ( ; port <= temp_dp->port2; port++) { AppLayerProtoDetectInsertNewProbingParser(&alpd_ctx.ctx_pp, ipproto, port, alproto, min_depth, max_depth, direction, ProbingParser1, ProbingParser2); } temp_dp = temp_dp->next; } DetectPortCleanupList(head); SCReturn; } int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc) { SCEnter(); char param[100]; int r; ConfNode *node; ConfNode *port_node = NULL; int config = 0; r = snprintf(param, sizeof(param), "%s%s%s", "app-layer.protocols.", alproto_name, ".detection-ports"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) { SCLogDebug("Entry for %s not found.", param); r = snprintf(param, sizeof(param), "%s%s%s%s%s", "app-layer.protocols.", alproto_name, ".", ipproto_name, ".detection-ports"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) goto end; } /* detect by destination port of the flow (e.g. port 53 for DNS) */ port_node = ConfNodeLookupChild(node, "dp"); if (port_node == NULL) port_node = ConfNodeLookupChild(node, "toserver"); if (port_node != NULL && port_node->val != NULL) { AppLayerProtoDetectPPRegister(ipproto, port_node->val, alproto, min_depth, max_depth, STREAM_TOSERVER, /* to indicate dp */ ProbingParserTs, ProbingParserTc); } /* detect by source port of flow */ port_node = ConfNodeLookupChild(node, "sp"); if (port_node == NULL) port_node = ConfNodeLookupChild(node, "toclient"); if (port_node != NULL && port_node->val != NULL) { AppLayerProtoDetectPPRegister(ipproto, port_node->val, alproto, min_depth, max_depth, STREAM_TOCLIENT, /* to indicate sp */ ProbingParserTc, ProbingParserTs); } config = 1; end: SCReturnInt(config); } /***** PM registration *****/ int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, char *pattern, uint16_t depth, uint16_t offset, uint8_t direction) { SCEnter(); int r = 0; r = AppLayerProtoDetectPMRegisterPattern(ipproto, alproto, pattern, depth, offset, direction, 1 /* case-sensitive */); SCReturnInt(r); } int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, char *pattern, uint16_t depth, uint16_t offset, uint8_t direction) { SCEnter(); int r = 0; r = AppLayerProtoDetectPMRegisterPattern(ipproto, alproto, pattern, depth, offset, direction, 0 /* !case-sensitive */); SCReturnInt(r); } /***** Setup/General Registration *****/ int AppLayerProtoDetectSetup(void) { SCEnter(); int i, j; memset(&alpd_ctx, 0, sizeof(alpd_ctx)); uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); uint16_t mpm_matcher = PatternMatchDefaultMatcher(); #ifdef __SC_CUDA_SUPPORT__ /* CUDA won't work here, so fall back to AC */ if (mpm_matcher == MPM_AC_CUDA) mpm_matcher = mpm_default_matcher; #endif alpd_ctx.spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); if (alpd_ctx.spm_global_thread_ctx == NULL) { SCLogError(SC_ERR_FATAL, "Unable to alloc SpmGlobalThreadCtx."); exit(EXIT_FAILURE); } for (i = 0; i < FLOW_PROTO_DEFAULT; i++) { for (j = 0; j < 2; j++) { MpmInitCtx(&alpd_ctx.ctx_ipp[i].ctx_pm[j].mpm_ctx, mpm_matcher); } } SCReturnInt(0); } /** * \todo incomplete. Need more work. */ int AppLayerProtoDetectDeSetup(void) { SCEnter(); int ipproto_map = 0; int dir = 0; PatIntId id = 0; AppLayerProtoDetectPMCtx *pm_ctx = NULL; AppLayerProtoDetectPMSignature *sig = NULL; for (ipproto_map = 0; ipproto_map < FLOW_PROTO_DEFAULT; ipproto_map++) { for (dir = 0; dir < 2; dir++) { pm_ctx = &alpd_ctx.ctx_ipp[ipproto_map].ctx_pm[dir]; mpm_table[pm_ctx->mpm_ctx.mpm_type].DestroyCtx(&pm_ctx->mpm_ctx); for (id = 0; id < pm_ctx->max_sig_id; id++) { sig = pm_ctx->map[id]; AppLayerProtoDetectPMFreeSignature(sig); } } } SpmDestroyGlobalThreadCtx(alpd_ctx.spm_global_thread_ctx); AppLayerProtoDetectFreeProbingParsers(alpd_ctx.ctx_pp); SCReturnInt(0); } void AppLayerProtoDetectRegisterProtocol(AppProto alproto, char *alproto_name) { SCEnter(); if (alpd_ctx.alproto_names[alproto] != NULL) goto end; alpd_ctx.alproto_names[alproto] = alproto_name; goto end; end: SCReturn; } int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto) { SCEnter(); BUG_ON(ipproto == NULL || alproto == NULL); int enabled = 1; char param[100]; ConfNode *node; int r; #ifdef AFLFUZZ_APPLAYER goto enabled; #endif if (RunmodeIsUnittests()) goto enabled; r = snprintf(param, sizeof(param), "%s%s%s", "app-layer.protocols.", alproto, ".enabled"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) { SCLogDebug("Entry for %s not found.", param); r = snprintf(param, sizeof(param), "%s%s%s%s%s", "app-layer.protocols.", alproto, ".", ipproto, ".enabled"); if (r < 0) { SCLogError(SC_ERR_FATAL, "snprintf failure."); exit(EXIT_FAILURE); } else if (r > (int)sizeof(param)) { SCLogError(SC_ERR_FATAL, "buffer not big enough to write param."); exit(EXIT_FAILURE); } node = ConfGetNode(param); if (node == NULL) { SCLogDebug("Entry for %s not found.", param); goto enabled; } } if (node->val) { if (ConfValIsTrue(node->val)) { goto enabled; } else if (ConfValIsFalse(node->val)) { goto disabled; } else if (strcasecmp(node->val, "detection-only") == 0) { goto enabled; } } /* Invalid or null value. */ SCLogError(SC_ERR_FATAL, "Invalid value found for %s.", param); exit(EXIT_FAILURE); disabled: enabled = 0; enabled: SCReturnInt(enabled); } AppLayerProtoDetectThreadCtx *AppLayerProtoDetectGetCtxThread(void) { SCEnter(); AppLayerProtoDetectThreadCtx *alpd_tctx = NULL; MpmCtx *mpm_ctx; MpmThreadCtx *mpm_tctx; int i, j; PatIntId max_pat_id = 0; for (i = 0; i < FLOW_PROTO_DEFAULT; i++) { for (j = 0; j < 2; j++) { if (max_pat_id == 0) { max_pat_id = alpd_ctx.ctx_ipp[i].ctx_pm[j].max_pat_id; } else if (alpd_ctx.ctx_ipp[i].ctx_pm[j].max_pat_id && max_pat_id < alpd_ctx.ctx_ipp[i].ctx_pm[j].max_pat_id) { max_pat_id = alpd_ctx.ctx_ipp[i].ctx_pm[j].max_pat_id; } } } alpd_tctx = SCMalloc(sizeof(*alpd_tctx)); if (alpd_tctx == NULL) goto error; memset(alpd_tctx, 0, sizeof(*alpd_tctx)); /* Get the max pat id for all the mpm ctxs. */ if (PmqSetup(&alpd_tctx->pmq) < 0) goto error; for (i = 0; i < FLOW_PROTO_DEFAULT; i++) { for (j = 0; j < 2; j++) { mpm_ctx = &alpd_ctx.ctx_ipp[i].ctx_pm[j].mpm_ctx; mpm_tctx = &alpd_tctx->mpm_tctx[i][j]; mpm_table[mpm_ctx->mpm_type].InitThreadCtx(mpm_ctx, mpm_tctx); } } alpd_tctx->spm_thread_ctx = SpmMakeThreadCtx(alpd_ctx.spm_global_thread_ctx); if (alpd_tctx->spm_thread_ctx == NULL) { goto error; } goto end; error: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); alpd_tctx = NULL; end: SCReturnPtr(alpd_tctx, "AppLayerProtoDetectThreadCtx"); } void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *alpd_tctx) { SCEnter(); MpmCtx *mpm_ctx; MpmThreadCtx *mpm_tctx; int ipproto_map, dir; for (ipproto_map = 0; ipproto_map < FLOW_PROTO_DEFAULT; ipproto_map++) { for (dir = 0; dir < 2; dir++) { mpm_ctx = &alpd_ctx.ctx_ipp[ipproto_map].ctx_pm[dir].mpm_ctx; mpm_tctx = &alpd_tctx->mpm_tctx[ipproto_map][dir]; mpm_table[mpm_ctx->mpm_type].DestroyThreadCtx(mpm_ctx, mpm_tctx); } } PmqFree(&alpd_tctx->pmq); if (alpd_tctx->spm_thread_ctx != NULL) { SpmDestroyThreadCtx(alpd_tctx->spm_thread_ctx); } SCFree(alpd_tctx); SCReturn; } /***** Utility *****/ void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos) { SCEnter(); AppLayerProtoDetectPMGetIpprotos(alproto, ipprotos); AppLayerProtoDetectPPGetIpprotos(alproto, ipprotos); SCReturn; } AppProto AppLayerProtoDetectGetProtoByName(char *alproto_name) { SCEnter(); AppProto a; for (a = 0; a < ALPROTO_MAX; a++) { if (alpd_ctx.alproto_names[a] != NULL && strlen(alpd_ctx.alproto_names[a]) == strlen(alproto_name) && (SCMemcmp(alpd_ctx.alproto_names[a], alproto_name, strlen(alproto_name)) == 0)) { SCReturnCT(a, "AppProto"); } } SCReturnCT(ALPROTO_UNKNOWN, "AppProto"); } char *AppLayerProtoDetectGetProtoName(AppProto alproto) { return alpd_ctx.alproto_names[alproto]; } void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos) { SCEnter(); memset(alprotos, 0, ALPROTO_MAX * sizeof(AppProto)); int alproto; for (alproto = 0; alproto != ALPROTO_MAX; alproto++) { if (alpd_ctx.alproto_names[alproto] != NULL) alprotos[alproto] = 1; } SCReturn; } /***** Unittests *****/ #ifdef UNITTESTS static AppLayerProtoDetectCtx alpd_ctx_ut; void AppLayerProtoDetectUnittestCtxBackup(void) { SCEnter(); alpd_ctx_ut = alpd_ctx; memset(&alpd_ctx, 0, sizeof(alpd_ctx)); SCReturn; } void AppLayerProtoDetectUnittestCtxRestore(void) { SCEnter(); alpd_ctx = alpd_ctx_ut; memset(&alpd_ctx_ut, 0, sizeof(alpd_ctx_ut)); SCReturn; } int AppLayerProtoDetectTest01(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); char *buf; int r = 0; buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); buf = "GET"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPrepareState(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 1) { printf("Failure - " "alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 1\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("Failure - " "alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1\n"); goto end; } r = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest02(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); char *buf; int r = 0; buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); buf = "ftp"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_FTP, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_FTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_FTP\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1].alproto != ALPROTO_HTTP\n"); goto end; } r = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest03(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\n"; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); buf = "220 "; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_FTP, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_FTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_FTP\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1].alproto != ALPROTO_HTTP\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("cnt != 1 && pm_results[0] != AlPROTO_HTTP\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest04(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\n"; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "200 "; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 13, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_HTTP\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("cnt != 1 && pm_results[0] != AlPROTO_HTTP\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest05(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\nBlahblah"; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); buf = "220 "; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_FTP, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_FTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_FTP\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1].alproto != ALPROTO_HTTP\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("cnt != 1 && pm_results[0] != AlPROTO_HTTP\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest06(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "220 Welcome to the OISF FTP server\r\n"; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); buf = "220 "; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_FTP, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_FTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_FTP\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[1].alproto != ALPROTO_HTTP\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_FTP) { printf("cnt != 1 && pm_results[0] != AlPROTO_FTP\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest07(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "220 Welcome to the OISF HTTP/FTP server\r\n"; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "HTTP"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_HTTP) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_HTTP\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 0) { printf("cnt != 0\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest08(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = { 0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, 0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 }; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "|ff|SMB"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, buf, 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_SMB) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_SMB\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_SMB) { printf("cnt != 1 && pm_results[0] != AlPROTO_SMB\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest09(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = { 0x00, 0x00, 0x00, 0x66, 0xfe, 0x53, 0x4d, 0x42, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x02 }; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "|fe|SMB"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, buf, 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_SMB2) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_SMB2\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_SMB2) { printf("cnt != 1 && pm_results[0] != AlPROTO_SMB2\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } int AppLayerProtoDetectTest10(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = { 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11, 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; char *buf; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); buf = "|05 00|"; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_DCERPC, buf, 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 0\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_DCERPC) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0].alproto != ALPROTO_DCERPC\n"); goto end; } uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_DCERPC) { printf("cnt != 1 && pm_results[0] != AlPROTO_DCERPC\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } /** * \test Why we still get http for connect... obviously because * we also match on the reply, duh */ int AppLayerProtoDetectTest11(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n"; uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n"; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); memset(pm_results, 0, sizeof(pm_results)); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "GET", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "PUT", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "POST", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "TRACE", 5, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "OPTIONS", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "CONNECT", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 7) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 7\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].max_pat_id != 1\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map == NULL) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map != NULL\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[0]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[1]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[2]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[3]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[4]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[5]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[6]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[1].map[0]->alproto != ALPROTO_HTTP) { printf("failure 1\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); uint32_t cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOSERVER, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("l7data - cnt != 1 && pm_results[0] != AlPROTO_HTTP\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data_resp, sizeof(l7data_resp), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("l7data_resp - cnt != 1 && pm_results[0] != AlPROTO_HTTP\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } /** * \test AlpProtoSignature test */ int AppLayerProtoDetectTest12(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); int r = 0; AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOSERVER); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].head == NULL || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map != NULL) { printf("failure 1\n"); goto end; } AppLayerProtoDetectPrepareState(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].max_pat_id != 1) { printf("failure 2\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].head != NULL || alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map == NULL) { printf("failure 3\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[0]->alproto != ALPROTO_HTTP) { printf("failure 4\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[0]->cd->id != 0) { printf("failure 5\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_TCP].ctx_pm[0].map[0]->next != NULL) { printf("failure 6\n"); goto end; } r = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } /** * \test What about if we add some sigs only for udp but call for tcp? * It should not detect any proto */ int AppLayerProtoDetectTest13(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n"; uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n"; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; uint32_t cnt; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_TCP); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "GET", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "PUT", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "POST", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "TRACE", 5, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "OPTIONS", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "CONNECT", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].max_pat_id != 7) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].max_pat_id != 7\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].max_pat_id != 1\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[0]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[1]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[2]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[3]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[4]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[5]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[6]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].map[0]->alproto != ALPROTO_HTTP) { printf("failure 1\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOSERVER, IPPROTO_TCP, pm_results); if (cnt != 0) { printf("l7data - cnt != 0\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data_resp, sizeof(l7data_resp), STREAM_TOCLIENT, IPPROTO_TCP, pm_results); if (cnt != 0) { printf("l7data_resp - cnt != 0\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } /** * \test What about if we add some sigs only for udp calling it for UDP? * It should detect ALPROTO_HTTP (over udp). This is just a check * to ensure that TCP/UDP differences work correctly. */ int AppLayerProtoDetectTest14(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n"; uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n"; int r = 0; Flow f; AppProto pm_results[ALPROTO_MAX]; AppLayerProtoDetectThreadCtx *alpd_tctx; uint32_t cnt; memset(&f, 0x00, sizeof(f)); f.protomap = FlowGetProtoMapping(IPPROTO_UDP); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "GET", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "PUT", 3, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "POST", 4, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "TRACE", 5, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "OPTIONS", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "CONNECT", 7, 0, STREAM_TOSERVER); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_UDP, ALPROTO_HTTP, "HTTP", 4, 0, STREAM_TOCLIENT); AppLayerProtoDetectPrepareState(); /* AppLayerProtoDetectGetCtxThread() should be called post AppLayerProtoDetectPrepareState(), since * it sets internal structures which depends on the above function. */ alpd_tctx = AppLayerProtoDetectGetCtxThread(); if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].max_pat_id != 7) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].max_pat_id != 7\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].max_pat_id != 1) { printf("alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].max_pat_id != 1\n"); goto end; } if (alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[0]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[1]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[2]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[3]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[4]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[5]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[0].map[6]->alproto != ALPROTO_HTTP || alpd_ctx.ctx_ipp[FLOW_PROTO_UDP].ctx_pm[1].map[0]->alproto != ALPROTO_HTTP) { printf("failure 1\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data, sizeof(l7data), STREAM_TOSERVER, IPPROTO_UDP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("l7data - cnt != 0\n"); goto end; } memset(pm_results, 0, sizeof(pm_results)); cnt = AppLayerProtoDetectPMGetProto(alpd_tctx, &f, l7data_resp, sizeof(l7data_resp), STREAM_TOCLIENT, IPPROTO_UDP, pm_results); if (cnt != 1 && pm_results[0] != ALPROTO_HTTP) { printf("l7data_resp - cnt != 0\n"); goto end; } r = 1; end: if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return r; } typedef struct AppLayerProtoDetectPPTestDataElement_ { char *alproto_name; AppProto alproto; uint16_t port; uint32_t alproto_mask; uint32_t min_depth; uint32_t max_depth; } AppLayerProtoDetectPPTestDataElement; typedef struct AppLayerProtoDetectPPTestDataPort_ { uint16_t port; uint32_t alproto_mask; uint16_t dp_max_depth; uint16_t sp_max_depth; AppLayerProtoDetectPPTestDataElement *toserver_element; AppLayerProtoDetectPPTestDataElement *toclient_element; int ts_no_of_element; int tc_no_of_element; } AppLayerProtoDetectPPTestDataPort; typedef struct AppLayerProtoDetectPPTestDataIPProto_ { uint8_t ipproto; AppLayerProtoDetectPPTestDataPort *port; int no_of_port; } AppLayerProtoDetectPPTestDataIPProto; static int AppLayerProtoDetectPPTestData(AppLayerProtoDetectProbingParser *pp, AppLayerProtoDetectPPTestDataIPProto *ip_proto, int no_of_ip_proto) { int result = 0; int i = -1, j = -1 , k = -1; #ifdef DEBUG int dir = 0; #endif for (i = 0; i < no_of_ip_proto; i++, pp = pp->next) { if (pp->ipproto != ip_proto[i].ipproto) goto end; AppLayerProtoDetectProbingParserPort *pp_port = pp->port; for (k = 0; k < ip_proto[i].no_of_port; k++, pp_port = pp_port->next) { if (pp_port->port != ip_proto[i].port[k].port) goto end; if (pp_port->alproto_mask != ip_proto[i].port[k].alproto_mask) goto end; if (pp_port->alproto_mask != ip_proto[i].port[k].alproto_mask) goto end; if (pp_port->dp_max_depth != ip_proto[i].port[k].dp_max_depth) goto end; if (pp_port->sp_max_depth != ip_proto[i].port[k].sp_max_depth) goto end; AppLayerProtoDetectProbingParserElement *pp_element = pp_port->dp; #ifdef DEBUG dir = 0; #endif for (j = 0 ; j < ip_proto[i].port[k].ts_no_of_element; j++, pp_element = pp_element->next) { if (pp_element->alproto != ip_proto[i].port[k].toserver_element[j].alproto) { goto end; } if (pp_element->port != ip_proto[i].port[k].toserver_element[j].port) { goto end; } if (pp_element->alproto_mask != ip_proto[i].port[k].toserver_element[j].alproto_mask) { goto end; } if (pp_element->min_depth != ip_proto[i].port[k].toserver_element[j].min_depth) { goto end; } if (pp_element->max_depth != ip_proto[i].port[k].toserver_element[j].max_depth) { goto end; } } /* for */ if (pp_element != NULL) goto end; pp_element = pp_port->sp; #ifdef DEBUG dir = 1; #endif for (j = 0 ; j < ip_proto[i].port[k].tc_no_of_element; j++, pp_element = pp_element->next) { if (pp_element->alproto != ip_proto[i].port[k].toclient_element[j].alproto) { goto end; } if (pp_element->port != ip_proto[i].port[k].toclient_element[j].port) { goto end; } if (pp_element->alproto_mask != ip_proto[i].port[k].toclient_element[j].alproto_mask) { goto end; } if (pp_element->min_depth != ip_proto[i].port[k].toclient_element[j].min_depth) { goto end; } if (pp_element->max_depth != ip_proto[i].port[k].toclient_element[j].max_depth) { goto end; } } /* for */ if (pp_element != NULL) goto end; } if (pp_port != NULL) goto end; } if (pp != NULL) goto end; result = 1; end: #ifdef DEBUG printf("i = %d, k = %d, j = %d(%s)\n", i, k, j, (dir == 0) ? "ts" : "tc"); #endif return result; } static uint16_t ProbingParserDummyForTesting(uint8_t *input, uint32_t input_len, uint32_t *offset) { return 0; } static int AppLayerProtoDetectTest15(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); int result = 0; AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_HTTP, 5, 8, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_SMB, 5, 6, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_FTP, 7, 10, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "81", ALPROTO_DCERPC, 9, 10, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "81", ALPROTO_FTP, 7, 15, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_SMTP, 12, 0, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_TLS, 12, 18, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "85", ALPROTO_DCERPC, 9, 10, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "85", ALPROTO_FTP, 7, 15, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); result = 1; AppLayerProtoDetectPPRegister(IPPROTO_UDP, "85", ALPROTO_IMAP, 12, 23, STREAM_TOSERVER, ProbingParserDummyForTesting, NULL); /* toclient */ AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_JABBER, 12, 23, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_IRC, 12, 14, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "85", ALPROTO_DCERPC, 9, 10, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "81", ALPROTO_FTP, 7, 15, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_TLS, 12, 18, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_HTTP, 5, 8, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "81", ALPROTO_DCERPC, 9, 10, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "90", ALPROTO_FTP, 7, 15, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_SMB, 5, 6, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_UDP, "85", ALPROTO_IMAP, 12, 23, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "0", ALPROTO_SMTP, 12, 17, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "80", ALPROTO_FTP, 7, 10, STREAM_TOCLIENT, ProbingParserDummyForTesting, NULL); AppLayerProtoDetectPPTestDataElement element_ts_80[] = { { "http", ALPROTO_HTTP, 80, 1 << ALPROTO_HTTP, 5, 8 }, { "smb", ALPROTO_SMB, 80, 1 << ALPROTO_SMB, 5, 6 }, { "ftp", ALPROTO_FTP, 80, 1 << ALPROTO_FTP, 7, 10 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 0 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 25 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_80[] = { { "http", ALPROTO_HTTP, 80, 1 << ALPROTO_HTTP, 5, 8 }, { "smb", ALPROTO_SMB, 80, 1 << ALPROTO_SMB, 5, 6 }, { "ftp", ALPROTO_FTP, 80, 1 << ALPROTO_FTP, 7, 10 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 14 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 17 } }; AppLayerProtoDetectPPTestDataElement element_ts_81[] = { { "dcerpc", ALPROTO_DCERPC, 81, 1 << ALPROTO_DCERPC, 9, 10 }, { "ftp", ALPROTO_FTP, 81, 1 << ALPROTO_FTP, 7, 15 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 0 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 25 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_81[] = { { "ftp", ALPROTO_FTP, 81, 1 << ALPROTO_FTP, 7, 15 }, { "dcerpc", ALPROTO_DCERPC, 81, 1 << ALPROTO_DCERPC, 9, 10 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 14 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 17 } }; AppLayerProtoDetectPPTestDataElement element_ts_85[] = { { "dcerpc", ALPROTO_DCERPC, 85, 1 << ALPROTO_DCERPC, 9, 10 }, { "ftp", ALPROTO_FTP, 85, 1 << ALPROTO_FTP, 7, 15 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 0 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 25 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_85[] = { { "dcerpc", ALPROTO_DCERPC, 85, 1 << ALPROTO_DCERPC, 9, 10 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 14 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 17 } }; AppLayerProtoDetectPPTestDataElement element_ts_90[] = { { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 0 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 25 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_90[] = { { "ftp", ALPROTO_FTP, 90, 1 << ALPROTO_FTP, 7, 15 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 14 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 17 } }; AppLayerProtoDetectPPTestDataElement element_ts_0[] = { { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 0 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 25 }, { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_0[] = { { "jabber", ALPROTO_JABBER, 0, 1 << ALPROTO_JABBER, 12, 23 }, { "irc", ALPROTO_IRC, 0, 1 << ALPROTO_IRC, 12, 14 }, { "tls", ALPROTO_TLS, 0, 1 << ALPROTO_TLS, 12, 18 }, { "smtp", ALPROTO_SMTP, 0, 1 << ALPROTO_SMTP, 12, 17 } }; AppLayerProtoDetectPPTestDataElement element_ts_85_udp[] = { { "imap", ALPROTO_IMAP, 85, 1 << ALPROTO_IMAP, 12, 23 }, }; AppLayerProtoDetectPPTestDataElement element_tc_85_udp[] = { { "imap", ALPROTO_IMAP, 85, 1 << ALPROTO_IMAP, 12, 23 }, }; AppLayerProtoDetectPPTestDataPort ports_tcp[] = { { 80, ((1 << ALPROTO_HTTP) | (1 << ALPROTO_SMB) | (1 << ALPROTO_FTP) | (1 << ALPROTO_SMTP) | (1 << ALPROTO_TLS) | (1 << ALPROTO_IRC) | (1 << ALPROTO_JABBER)), ((1 << ALPROTO_HTTP) | (1 << ALPROTO_SMB) | (1 << ALPROTO_FTP) | (1 << ALPROTO_JABBER) | (1 << ALPROTO_IRC) | (1 << ALPROTO_TLS) | (1 << ALPROTO_SMTP)), 23, element_ts_80, element_tc_80, sizeof(element_ts_80) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_80) / sizeof(AppLayerProtoDetectPPTestDataElement), }, { 81, ((1 << ALPROTO_DCERPC) | (1 << ALPROTO_FTP) | (1 << ALPROTO_SMTP) | (1 << ALPROTO_TLS) | (1 << ALPROTO_IRC) | (1 << ALPROTO_JABBER)), ((1 << ALPROTO_FTP) | (1 << ALPROTO_DCERPC) | (1 << ALPROTO_JABBER) | (1 << ALPROTO_IRC) | (1 << ALPROTO_TLS) | (1 << ALPROTO_SMTP)), 23, element_ts_81, element_tc_81, sizeof(element_ts_81) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_81) / sizeof(AppLayerProtoDetectPPTestDataElement), }, { 85, ((1 << ALPROTO_DCERPC) | (1 << ALPROTO_FTP) | (1 << ALPROTO_SMTP) | (1 << ALPROTO_TLS) | (1 << ALPROTO_IRC) | (1 << ALPROTO_JABBER)), ((1 << ALPROTO_DCERPC) | (1 << ALPROTO_JABBER) | (1 << ALPROTO_IRC) | (1 << ALPROTO_TLS) | (1 << ALPROTO_SMTP)), 23, element_ts_85, element_tc_85, sizeof(element_ts_85) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_85) / sizeof(AppLayerProtoDetectPPTestDataElement) }, { 90, ((1 << ALPROTO_SMTP) | (1 << ALPROTO_TLS) | (1 << ALPROTO_IRC) | (1 << ALPROTO_JABBER)), ((1 << ALPROTO_FTP) | (1 << ALPROTO_JABBER) | (1 << ALPROTO_IRC) | (1 << ALPROTO_TLS) | (1 << ALPROTO_SMTP)), 23, element_ts_90, element_tc_90, sizeof(element_ts_90) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_90) / sizeof(AppLayerProtoDetectPPTestDataElement) }, { 0, ((1 << ALPROTO_SMTP) | (1 << ALPROTO_TLS) | (1 << ALPROTO_IRC) | (1 << ALPROTO_JABBER)), ((1 << ALPROTO_JABBER) | (1 << ALPROTO_IRC) | (1 << ALPROTO_TLS) | (1 << ALPROTO_SMTP)), 23, element_ts_0, element_tc_0, sizeof(element_ts_0) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_0) / sizeof(AppLayerProtoDetectPPTestDataElement) } }; AppLayerProtoDetectPPTestDataPort ports_udp[] = { { 85, (1 << ALPROTO_IMAP), (1 << ALPROTO_IMAP), 23, element_ts_85_udp, element_tc_85_udp, sizeof(element_ts_85_udp) / sizeof(AppLayerProtoDetectPPTestDataElement), sizeof(element_tc_85_udp) / sizeof(AppLayerProtoDetectPPTestDataElement), }, }; AppLayerProtoDetectPPTestDataIPProto ip_proto[] = { { IPPROTO_TCP, ports_tcp, sizeof(ports_tcp) / sizeof(AppLayerProtoDetectPPTestDataPort), }, { IPPROTO_UDP, ports_udp, sizeof(ports_udp) / sizeof(AppLayerProtoDetectPPTestDataPort), }, }; if (AppLayerProtoDetectPPTestData(alpd_ctx.ctx_pp, ip_proto, sizeof(ip_proto) / sizeof(AppLayerProtoDetectPPTestDataIPProto)) == 0) { goto end; } result = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); return result; } /** \test test if the engine detect the proto and match with it */ static int AppLayerProtoDetectTest16(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); if (p == NULL) { printf("packet setup failed: "); goto end; } f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) { printf("flow setup failed: "); goto end; } f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f->alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"Test content option\"; " "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); UTHFreeFlow(f); return result; } /** \test test if the engine detect the proto on a non standar port * and match with it */ static int AppLayerProtoDetectTest17(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacketSrcDstPorts(http_buf1, http_buf1_len, IPPROTO_TCP, 12345, 88); f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f->alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert http any !80 -> any any " "(msg:\"http over non standar port\"; " "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); UTHFreeFlow(f); return result; } /** \test test if the engine detect the proto and doesn't match * because the sig expects another proto (ex ftp)*/ static int AppLayerProtoDetectTest18(void) { int result = 0; Flow *f = NULL; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f->alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ftp any any -> any any " "(msg:\"Test content option\"; " "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not (it's not ftp): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); UTHFreeFlow(f); return result; } /** \test test if the engine detect the proto and doesn't match * because the packet has another proto (ex ftp) */ static int AppLayerProtoDetectTest19(void) { int result = 0; Flow *f = NULL; uint8_t http_buf1[] = "MPUT one\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacketSrcDstPorts(http_buf1, http_buf1_len, IPPROTO_TCP, 12345, 88); f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f->alproto = ALPROTO_FTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert http any !80 -> any any " "(msg:\"http over non standar port\"; " "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_FTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 alerted, but it should not (it's ftp): "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); UTHFreeFlow(f); return result; } /** \test test if the engine detect the proto and match with it * and also against a content option */ static int AppLayerProtoDetectTest20(void) { int result = 0; Flow *f = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(http_buf1, http_buf1_len, IPPROTO_TCP); f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; p->flow = f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f->alproto = ALPROTO_HTTP; f->proto = IPPROTO_TCP; p->flags |= PKT_STREAM_ADD; p->flags |= PKT_STREAM_EOF; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } StreamTcpInitConfig(TRUE); StreamMsg *stream_msg = StreamMsgGetFromPool(); if (stream_msg == NULL) { printf("no stream_msg: "); goto end; } memcpy(stream_msg->data, http_buf1, http_buf1_len); stream_msg->data_len = http_buf1_len; ssn.toserver_smsg_head = stream_msg; ssn.toserver_smsg_tail = stream_msg; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"Test content option\"; " "content:\"one\"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); UTHFreeFlow(f); return result; } void AppLayerProtoDetectUnittestsRegister(void) { SCEnter(); UtRegisterTest("AppLayerProtoDetectTest01", AppLayerProtoDetectTest01); UtRegisterTest("AppLayerProtoDetectTest02", AppLayerProtoDetectTest02); UtRegisterTest("AppLayerProtoDetectTest03", AppLayerProtoDetectTest03); UtRegisterTest("AppLayerProtoDetectTest04", AppLayerProtoDetectTest04); UtRegisterTest("AppLayerProtoDetectTest05", AppLayerProtoDetectTest05); UtRegisterTest("AppLayerProtoDetectTest06", AppLayerProtoDetectTest06); UtRegisterTest("AppLayerProtoDetectTest07", AppLayerProtoDetectTest07); UtRegisterTest("AppLayerProtoDetectTest08", AppLayerProtoDetectTest08); UtRegisterTest("AppLayerProtoDetectTest09", AppLayerProtoDetectTest09); UtRegisterTest("AppLayerProtoDetectTest10", AppLayerProtoDetectTest10); UtRegisterTest("AppLayerProtoDetectTest11", AppLayerProtoDetectTest11); UtRegisterTest("AppLayerProtoDetectTest12", AppLayerProtoDetectTest12); UtRegisterTest("AppLayerProtoDetectTest13", AppLayerProtoDetectTest13); UtRegisterTest("AppLayerProtoDetectTest14", AppLayerProtoDetectTest14); UtRegisterTest("AppLayerProtoDetectTest15", AppLayerProtoDetectTest15); UtRegisterTest("AppLayerProtoDetectTest16", AppLayerProtoDetectTest16); UtRegisterTest("AppLayerProtoDetectTest17", AppLayerProtoDetectTest17); UtRegisterTest("AppLayerProtoDetectTest18", AppLayerProtoDetectTest18); UtRegisterTest("AppLayerProtoDetectTest19", AppLayerProtoDetectTest19); UtRegisterTest("AppLayerProtoDetectTest20", AppLayerProtoDetectTest20); SCReturn; } #endif /* UNITTESTS */ suricata-3.2.1/src/alert-fastlog.h0000644000000000000000000000202313051004444013713 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __ALERT_FASTLOG_H__ #define __ALERT_FASTLOG_H__ void AlertFastLogRegister(void); void TmModuleAlertFastLogIPv4Register(void); void TmModuleAlertFastLogIPv6Register(void); OutputCtx *AlertFastLogInitCtx(ConfNode *); #endif /* __ALERT_FASTLOG_H__ */ suricata-3.2.1/src/detect-depth.c0000644000000000000000000001446513051004444013531 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the depth keyword. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-byte-extract.h" #include "flow-var.h" #include "app-layer.h" #include "util-byte.h" #include "util-debug.h" static int DetectDepthSetup (DetectEngineCtx *, Signature *, char *); void DetectDepthRegister (void) { sigmatch_table[DETECT_DEPTH].name = "depth"; sigmatch_table[DETECT_DEPTH].desc = "designate how many bytes from the beginning of the payload will be checked"; sigmatch_table[DETECT_DEPTH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#depth"; sigmatch_table[DETECT_DEPTH].Match = NULL; sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup; sigmatch_table[DETECT_DEPTH].Free = NULL; sigmatch_table[DETECT_DEPTH].RegisterTests = NULL; sigmatch_table[DETECT_DEPTH].flags |= SIGMATCH_PAYLOAD; } static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depthstr) { char *str = depthstr; char dubbed = 0; SigMatch *pm = NULL; int ret = -1; /* Strip leading and trailing "s. */ if (depthstr[0] == '\"') { str = SCStrdup(depthstr + 1); if (unlikely(str == NULL)) goto end; if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\0'; } dubbed = 1; } /* retrive the sm to apply the depth against */ if (s->list != DETECT_SM_LIST_NOTSET) { pm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[s->list]); } else { pm = SigMatchGetLastSMFromLists(s, 28, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); } if (pm == NULL) { SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs " "preceding content, uricontent option, http_client_body, " "http_server_body, http_header option, http_raw_header option, " "http_method option, http_cookie, http_raw_uri, " "http_stat_msg, http_stat_code, http_user_agent, " "http_host, http_raw_host or " "file_data/dce_stub_data sticky buffer options"); goto end; } /* verify other conditions. */ DetectContentData *cd = (DetectContentData *)pm->ctx; if (cd->flags & DETECT_CONTENT_DEPTH) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple depths for the same content."); goto end; } if ((cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_DISTANCE)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative " "keyword like within/distance with a absolute " "relative keyword like depth/offset for the same " "content." ); goto end; } if (cd->flags & DETECT_CONTENT_NEGATED && cd->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "negated keyword set along with a fast_pattern"); goto end; } if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative " "keyword set along with a fast_pattern:only;"); goto end; } if (str[0] != '-' && isalpha((unsigned char)str[0])) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var " "seen in depth - %s\n", str); goto end; } cd->depth = ((DetectByteExtractData *)bed_sm->ctx)->local_id; cd->flags |= DETECT_CONTENT_DEPTH_BE; } else { if (ByteExtractStringUint16(&cd->depth, 0, 0, str) != (int)strlen(str)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid value for depth: %s", str); goto end; } /* Now update the real limit, as depth is relative to the offset */ cd->depth += cd->offset; } cd->flags |= DETECT_CONTENT_DEPTH; ret = 0; end: if (dubbed) SCFree(str); return ret; } suricata-3.2.1/src/detect-filesize.c0000644000000000000000000003302413051004444014227 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the filesize keyword */ #include "suricata-common.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-filesize.h" #include "util-debug.h" #include "util-byte.h" #include "flow-util.h" #include "stream-tcp.h" /** * \brief Regex for parsing our filesize */ #define PARSE_REGEX "^(?:\\s*)(<|>)?(?:\\s*)([0-9]{1,23})(?:\\s*)(?:(<>)(?:\\s*)([0-9]{1,23}))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; /*prototypes*/ static int DetectFilesizeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m); static int DetectFilesizeSetup (DetectEngineCtx *, Signature *, char *); static void DetectFilesizeFree (void *); static void DetectFilesizeRegisterTests (void); /** * \brief Registration function for filesize: keyword */ void DetectFilesizeRegister(void) { sigmatch_table[DETECT_FILESIZE].name = "filesize"; sigmatch_table[DETECT_FILESIZE].desc = "match on the size of the file as it is being transferred"; sigmatch_table[DETECT_FILESIZE].url = DOC_URL DOC_VERSION "/rules/file-keywords.html#filesize"; sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch; sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup; sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree; sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests; sigmatch_table[DETECT_FILESIZE].flags |= SIGMATCH_PAYLOAD; /** XXX necessary? */ DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief This function is used to match filesize rule option. * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param f *LOCKED* flow * \param flags direction flags * \param file file being inspected * \param s signature being inspected * \param m sigmatch that we will cast into DetectFilesizeData * * \retval 0 no match * \retval 1 match */ static int DetectFilesizeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, File *file, Signature *s, SigMatch *m) { SCEnter(); DetectFilesizeData *fsd = (DetectFilesizeData *)m->ctx; int ret = 0; uint64_t file_size = FileTrackedSize(file); SCLogDebug("file size %"PRIu64", check %"PRIu64, file_size, fsd->size1); if (file->state == FILE_STATE_CLOSED) { switch (fsd->mode) { case DETECT_FILESIZE_EQ: if (file_size == fsd->size1) ret = 1; break; case DETECT_FILESIZE_LT: if (file_size < fsd->size1) ret = 1; break; case DETECT_FILESIZE_GT: if (file_size > fsd->size1) ret = 1; break; case DETECT_FILESIZE_RA: if (file_size > fsd->size1 && file_size < fsd->size2) ret = 1; break; } /* truncated, error: only see if what we have meets the GT condition */ } else if (file->state > FILE_STATE_CLOSED) { if (fsd->mode == DETECT_FILESIZE_GT && file_size > fsd->size1) ret = 1; } SCReturnInt(ret); } /** * \brief parse filesize options * * \param str pointer to the user provided filesize * * \retval fsd pointer to DetectFilesizeData on success * \retval NULL on failure */ static DetectFilesizeData *DetectFilesizeParse (char *str) { DetectFilesizeData *fsd = NULL; char *arg1 = NULL; char *arg2 = NULL; char *arg3 = NULL; char *arg4 = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 3 || ret > 5) { SCLogError(SC_ERR_PCRE_PARSE, "filesize option pcre parse error: \"%s\"", str); goto error; } const char *str_ptr; SCLogDebug("ret %d", ret); res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg1 = (char *) str_ptr; SCLogDebug("Arg1 \"%s\"", arg1); res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 2, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg2 = (char *) str_ptr; SCLogDebug("Arg2 \"%s\"", arg2); if (ret > 3) { res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 3, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg3 = (char *) str_ptr; SCLogDebug("Arg3 \"%s\"", arg3); if (ret > 4) { res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 4, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } arg4 = (char *) str_ptr; SCLogDebug("Arg4 \"%s\"", arg4); } } fsd = SCMalloc(sizeof (DetectFilesizeData)); if (unlikely(fsd == NULL)) goto error; memset(fsd, 0, sizeof(DetectFilesizeData)); if (arg1[0] == '<') fsd->mode = DETECT_FILESIZE_LT; else if (arg1[0] == '>') fsd->mode = DETECT_FILESIZE_GT; else fsd->mode = DETECT_FILESIZE_EQ; if (arg3 != NULL && strcmp("<>", arg3) == 0) { if (strlen(arg1) != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Range specified but mode also set"); goto error; } fsd->mode = DETECT_FILESIZE_RA; } /** set the first value */ if (ByteExtractStringUint64(&fsd->size1,10,strlen(arg2),arg2) <= 0){ SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg2); goto error; } /** set the second value if specified */ if (arg4 != NULL && strlen(arg4) > 0) { if (fsd->mode != DETECT_FILESIZE_RA) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Multiple filesize values specified" " but mode is not range"); goto error; } if(ByteExtractStringUint64(&fsd->size2,10,strlen(arg4),arg4) <= 0) { SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg4); goto error; } if (fsd->size2 <= fsd->size1){ SCLogError(SC_ERR_INVALID_ARGUMENT,"filesize2:%"PRIu64" <= filesize:" "%"PRIu64"",fsd->size2,fsd->size1); goto error; } } pcre_free_substring(arg1); pcre_free_substring(arg2); if (arg3 != NULL) pcre_free_substring(arg3); if (arg4 != NULL) pcre_free_substring(arg4); return fsd; error: if (fsd) SCFree(fsd); if (arg1 != NULL) SCFree(arg1); if (arg2 != NULL) SCFree(arg2); if (arg3 != NULL) SCFree(arg3); if (arg4 != NULL) SCFree(arg4); return NULL; } /** * \brief this function is used to parse filesize data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param str pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFilesizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { SCEnter(); DetectFilesizeData *fsd = NULL; SigMatch *sm = NULL; fsd = DetectFilesizeParse(str); if (fsd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FILESIZE; sm->ctx = (SigMatchCtx *)fsd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH); s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_SIZE); SCReturnInt(0); error: if (fsd != NULL) DetectFilesizeFree(fsd); if (sm != NULL) SCFree(sm); SCReturnInt(-1); } /** * \brief this function will free memory associated with DetectFilesizeData * * \param ptr pointer to DetectFilesizeData */ static void DetectFilesizeFree(void *ptr) { DetectFilesizeData *fsd = (DetectFilesizeData *)ptr; SCFree(fsd); } #ifdef UNITTESTS #include "stream.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "app-layer-parser.h" /** \test Test the Filesize keyword setup */ static int DetectFilesizeParseTest01(void) { int ret = 0; DetectFilesizeData *fsd = NULL; fsd = DetectFilesizeParse("10"); if (fsd != NULL) { if (fsd->size1 == 10 && fsd->mode == DETECT_FILESIZE_EQ) ret = 1; DetectFilesizeFree(fsd); } return ret; } /** \test Test the Filesize keyword setup */ static int DetectFilesizeParseTest02(void) { int ret = 0; DetectFilesizeData *fsd = NULL; fsd = DetectFilesizeParse(" < 10 "); if (fsd != NULL) { if (fsd->size1 == 10 && fsd->mode == DETECT_FILESIZE_LT) ret = 1; DetectFilesizeFree(fsd); } return ret; } /** \test Test the Filesize keyword setup */ static int DetectFilesizeParseTest03(void) { int ret = 0; DetectFilesizeData *fsd = NULL; fsd = DetectFilesizeParse(" > 10 "); if (fsd != NULL) { if (fsd->size1 == 10 && fsd->mode == DETECT_FILESIZE_GT) ret = 1; DetectFilesizeFree(fsd); } return ret; } /** \test Test the Filesize keyword setup */ static int DetectFilesizeParseTest04(void) { int ret = 0; DetectFilesizeData *fsd = NULL; fsd = DetectFilesizeParse(" 5 <> 10 "); if (fsd != NULL) { if (fsd->size1 == 5 && fsd->size2 == 10 && fsd->mode == DETECT_FILESIZE_RA) ret = 1; DetectFilesizeFree(fsd); } return ret; } /** \test Test the Filesize keyword setup */ static int DetectFilesizeParseTest05(void) { int ret = 0; DetectFilesizeData *fsd = NULL; fsd = DetectFilesizeParse("5<>10"); if (fsd != NULL) { if (fsd->size1 == 5 && fsd->size2 == 10 && fsd->mode == DETECT_FILESIZE_RA) ret = 1; DetectFilesizeFree(fsd); } return ret; } /** * \brief this function is used to initialize the detection engine context and * setup the signature with passed values. * */ static int DetectFilesizeInitTest(DetectEngineCtx **de_ctx, Signature **sig, DetectFilesizeData **fsd, char *str) { char fullstr[1024]; int result = 0; *de_ctx = NULL; *sig = NULL; if (snprintf(fullstr, 1024, "alert http any any -> any any (msg:\"Filesize " "test\"; filesize:%s; sid:1;)", str) >= 1024) { goto end; } *de_ctx = DetectEngineCtxInit(); if (*de_ctx == NULL) { goto end; } (*de_ctx)->flags |= DE_QUIET; (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); if ((*de_ctx)->sig_list == NULL) { goto end; } *sig = (*de_ctx)->sig_list; *fsd = DetectFilesizeParse(str); result = 1; end: return result; } /** * \test DetectFilesizeSetpTest01 is a test for setting up an valid filesize values * with valid "<>" operator and include spaces arround the given values. * In the test the values are setup with initializing the detection engine * context and setting up the signature itself. */ static int DetectFilesizeSetpTest01(void) { DetectFilesizeData *fsd = NULL; uint8_t res = 0; Signature *sig = NULL; DetectEngineCtx *de_ctx = NULL; res = DetectFilesizeInitTest(&de_ctx, &sig, &fsd, "1 <> 2 "); if (res == 0) { goto end; } if(fsd == NULL) goto cleanup; if (fsd != NULL) { if (fsd->size1 == 1 && fsd->size2 == 2 && fsd->mode == DETECT_FILESIZE_RA) res = 1; } cleanup: if (fsd) SCFree(fsd); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return res; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectFilesize */ void DetectFilesizeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectFilesizeParseTest01", DetectFilesizeParseTest01); UtRegisterTest("DetectFilesizeParseTest02", DetectFilesizeParseTest02); UtRegisterTest("DetectFilesizeParseTest03", DetectFilesizeParseTest03); UtRegisterTest("DetectFilesizeParseTest04", DetectFilesizeParseTest04); UtRegisterTest("DetectFilesizeParseTest05", DetectFilesizeParseTest05); UtRegisterTest("DetectFilesizeSetpTest01", DetectFilesizeSetpTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-sigorder.h0000644000000000000000000000525413051004444015507 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_SIGORDER_H__ #define __DETECT_ENGINE_SIGORDER_H__ /** * \brief Different kinds of helper data that can be used by the signature * ordering module. Used by the "user" field in SCSigSignatureWrapper */ typedef enum{ SC_RADIX_USER_DATA_FLOWBITS, SC_RADIX_USER_DATA_FLOWVAR, SC_RADIX_USER_DATA_PKTVAR, SC_RADIX_USER_DATA_FLOWINT, SC_RADIX_USER_DATA_HOSTBITS, SC_RADIX_USER_DATA_IPPAIRBITS, SC_RADIX_USER_DATA_MAX } SCRadixUserDataType; /** * \brief Signature wrapper used by signature ordering module while ordering * signatures */ typedef struct SCSigSignatureWrapper_ { /* the wrapped signature */ Signature *sig; /* used as the lower limit SCSigSignatureWrapper that is used by the next * ordering function, which will order the incoming Sigwrapper after this * (min) wrapper */ struct SCSigSignatureWrapper_ *min; /* used as the upper limit SCSigSignatureWrapper that is used by the next * ordering function, which will order the incoming Sigwrapper below this * (max) wrapper */ struct SCSigSignatureWrapper_ *max; /* user data that is to be associated with this sigwrapper */ int user[SC_RADIX_USER_DATA_MAX]; struct SCSigSignatureWrapper_ *next; struct SCSigSignatureWrapper_ *prev; } SCSigSignatureWrapper; /** * \brief Structure holding the signature ordering function used by the * signature ordering module */ typedef struct SCSigOrderFunc_ { /* Pointer to the Signature Ordering function */ int (*SWCompare)(SCSigSignatureWrapper *sw1, SCSigSignatureWrapper *sw2); struct SCSigOrderFunc_ *next; } SCSigOrderFunc; void SCSigOrderSignatures(DetectEngineCtx *); void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *); void SCSigRegisterSignatureOrderingTests(void); void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *); #endif /* __DETECT_ENGINE_SIGORDER_H__ */ suricata-3.2.1/src/runmode-erf-dag.h0000644000000000000000000000204713051004444014131 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien */ #ifndef __RUNMODE_ERF_DAG_H__ #define __RUNMODE_ERF_DAG_H__ int RunModeIdsErfDagAutoFp(void); int RunModeIdsErfDagSingle(void); int RunModeIdsErfDagWorkers(void); void RunModeErfDagRegister(void); const char *RunModeErfDagGetDefaultMode(void); #endif /* __RUNMODE_ERF_DAG_H__ */ suricata-3.2.1/src/stream-tcp-sack.h0000644000000000000000000000332413051004444014152 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __STREAM_TCP_SACK_H__ #define __STREAM_TCP_SACK_H__ #include "suricata-common.h" #include "util-optimize.h" /** * \brief Get the size of the SACKed ranges * * \param stream Stream to get the size for. * * \retval size the size * * Optimized for case where SACK is not in use in the * stream, as it *should* only be used in case of packet * loss. */ static inline uint32_t StreamTcpSackedSize(TcpStream *stream) { if (likely(stream->sack_head == NULL)) { SCReturnUInt(0U); } else { uint32_t size = 0; StreamTcpSackRecord *rec = NULL; for (rec = stream->sack_head; rec != NULL; rec = rec->next) { size += (rec->re - rec->le); } SCReturnUInt(size); } } int StreamTcpSackUpdatePacket(TcpStream *, Packet *); void StreamTcpSackPruneList(TcpStream *); void StreamTcpSackFreeList(TcpStream *); void StreamTcpSackRegisterTests (void); #endif /* __STREAM_TCP_SACK_H__*/ suricata-3.2.1/src/util-path.c0000644000000000000000000000302313051004444013052 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "util-debug.h" /** * \brief Check if a path is absolute * * \param path string with the path * * \retval 1 absolute * \retval 0 not absolute */ int PathIsAbsolute(const char *path) { if (strlen(path) > 1 && path[0] == '/') { return 1; } #if (defined OS_WIN32 || defined __CYGWIN__) if (strlen(path) > 2) { if (isalpha((unsigned char)path[0]) && path[1] == ':') { return 1; } } #endif return 0; } /** * \brief Check if a path is relative * * \param path string with the path * * \retval 1 relative * \retval 0 not relative */ int PathIsRelative(const char *path) { return PathIsAbsolute(path) ? 0 : 1; } suricata-3.2.1/src/util-device.c0000644000000000000000000002341013051004444013357 00000000000000/* Copyright (C) 2011-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "conf.h" #include "util-device.h" #include "util-ioctl.h" #define MAX_DEVNAME 10 /** * \file * * \author Eric Leblond * * \brief Utility functions to handle device list */ /** private device list */ static TAILQ_HEAD(, LiveDevice_) live_devices = TAILQ_HEAD_INITIALIZER(live_devices); /** if set to 0 when we don't have real devices */ static int live_devices_stats = 1; static int LiveSafeDeviceName(const char *devname, char *newdevname, size_t destlen); static int g_live_devices_disable_offloading = 1; void LiveSetOffloadDisable(void) { g_live_devices_disable_offloading = 1; } void LiveSetOffloadWarn(void) { g_live_devices_disable_offloading = 0; } int LiveGetOffload(void) { return g_live_devices_disable_offloading; } /** * \brief Add a pcap device for monitoring * * \param dev string with the device name * * \retval 0 on success. * \retval -1 on failure. */ int LiveRegisterDevice(const char *dev) { LiveDevice *pd = SCCalloc(1, sizeof(LiveDevice)); if (unlikely(pd == NULL)) { return -1; } pd->dev = SCStrdup(dev); if (unlikely(pd->dev == NULL)) { SCFree(pd); return -1; } /* create a short version to be used in thread names */ if (strlen(pd->dev) > MAX_DEVNAME) { LiveSafeDeviceName(pd->dev, pd->dev_short, sizeof(pd->dev_short)); } else { (void)strlcpy(pd->dev_short, pd->dev, sizeof(pd->dev_short)); } SC_ATOMIC_INIT(pd->pkts); SC_ATOMIC_INIT(pd->drop); SC_ATOMIC_INIT(pd->invalid_checksums); pd->ignore_checksum = 0; TAILQ_INSERT_TAIL(&live_devices, pd, next); SCLogDebug("Device \"%s\" registered.", dev); return 0; } /** * \brief Get the number of registered devices * * \retval cnt the number of registered devices */ int LiveGetDeviceCount(void) { int i = 0; LiveDevice *pd; TAILQ_FOREACH(pd, &live_devices, next) { i++; } return i; } /** * \brief Get a pointer to the device name at idx * * \param number idx of the device in our list * * \retval ptr pointer to the string containing the device * \retval NULL on error */ const char *LiveGetDeviceName(int number) { int i = 0; LiveDevice *pd; TAILQ_FOREACH(pd, &live_devices, next) { if (i == number) { return pd->dev; } i++; } return NULL; } /** \internal * \brief Shorten a device name that is to long * * \param device name from config and destination for modified * * \retval None, is added to destination char *newdevname */ static int LiveSafeDeviceName(const char *devname, char *newdevname, size_t destlen) { size_t devnamelen = strlen(devname); /* If we have to shorten the interface name */ if (devnamelen > MAX_DEVNAME) { /* IF the dest length is over 10 chars long it will not do any * good for the shortening. The shortening is done due to the * max length of pthread names (15 chars) and we use 3 chars * for the threadname indicator eg. "W#-" and one-two chars for * the thread number. And if the destination buffer is under * 6 chars there is no point in shortening it since we must at * least enter two periods (.) into the string. */ if ((destlen-1) > 10 || (destlen-1) < 6) { return 1; } size_t length; size_t half; size_t spaces; half = (destlen-1) / 2; /* If the destlen is an even number */ if (half * 2 == (destlen-1)) { half = half - 1; } spaces = (destlen-1) - (half*2); length = half; /* Add the first half to the new dev name */ snprintf(newdevname, half+1, "%s", devname); /* Add the amount of spaces wanted */ for (uint i = half; i < half+spaces; i++) { length = strlcat(newdevname, ".", destlen); } snprintf(newdevname+length, half+1, "%s", devname+(devnamelen-half)); SCLogInfo("Shortening device name to: %s", newdevname); } else { strlcpy(newdevname, devname, destlen); } return 0; } /** * \brief Get a pointer to the device at idx * * \param number idx of the device in our list * * \retval ptr pointer to the string containing the device * \retval NULL on error */ LiveDevice *LiveGetDevice(const char *name) { int i = 0; LiveDevice *pd; if (name == NULL) { SCLogWarning(SC_ERR_INVALID_VALUE, "Name of device should not be null"); return NULL; } TAILQ_FOREACH(pd, &live_devices, next) { if (!strcmp(name, pd->dev)) { return pd; } i++; } return NULL; } const char *LiveGetShortName(const char *dev) { LiveDevice *live_dev = LiveGetDevice(dev); if (live_dev == NULL) return NULL; return live_dev->dev_short; } int LiveBuildDeviceList(const char *runmode) { return LiveBuildDeviceListCustom(runmode, "interface"); } int LiveBuildDeviceListCustom(const char *runmode, const char *itemname) { ConfNode *base = ConfGetNode(runmode); ConfNode *child; int i = 0; if (base == NULL) return 0; TAILQ_FOREACH(child, &base->head, next) { ConfNode *subchild; TAILQ_FOREACH(subchild, &child->head, next) { if ((!strcmp(subchild->name, itemname))) { if (!strcmp(subchild->val, "default")) break; SCLogConfig("Adding %s %s from config file", itemname, subchild->val); LiveRegisterDevice(subchild->val); i++; } } } return i; } /** Call this function to disable stat on live devices * * This can be useful in the case, this is not a real interface. */ void LiveDeviceHasNoStats() { live_devices_stats = 0; } int LiveDeviceListClean() { SCEnter(); LiveDevice *pd, *tpd; TAILQ_FOREACH_SAFE(pd, &live_devices, next, tpd) { if (live_devices_stats) { SCLogNotice("Stats for '%s': pkts: %" PRIu64", drop: %" PRIu64 " (%.2f%%), invalid chksum: %" PRIu64, pd->dev, SC_ATOMIC_GET(pd->pkts), SC_ATOMIC_GET(pd->drop), 100 * (SC_ATOMIC_GET(pd->drop) * 1.0) / SC_ATOMIC_GET(pd->pkts), SC_ATOMIC_GET(pd->invalid_checksums)); } RestoreIfaceOffloading(pd); if (pd->dev) SCFree(pd->dev); SC_ATOMIC_DESTROY(pd->pkts); SC_ATOMIC_DESTROY(pd->drop); SC_ATOMIC_DESTROY(pd->invalid_checksums); SCFree(pd); } SCReturnInt(TM_ECODE_OK); } #ifdef BUILD_UNIX_SOCKET TmEcode LiveDeviceIfaceStat(json_t *cmd, json_t *answer, void *data) { SCEnter(); LiveDevice *pd; const char * name = NULL; json_t *jarg = json_object_get(cmd, "iface"); if(!json_is_string(jarg)) { json_object_set_new(answer, "message", json_string("Iface is not a string")); SCReturnInt(TM_ECODE_FAILED); } name = json_string_value(jarg); if (name == NULL) { json_object_set_new(answer, "message", json_string("Iface name is NULL")); SCReturnInt(TM_ECODE_FAILED); } TAILQ_FOREACH(pd, &live_devices, next) { if (!strcmp(name, pd->dev)) { json_t *jdata = json_object(); if (jdata == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); SCReturnInt(TM_ECODE_FAILED); } json_object_set_new(jdata, "pkts", json_integer(SC_ATOMIC_GET(pd->pkts))); json_object_set_new(jdata, "invalid-checksums", json_integer(SC_ATOMIC_GET(pd->invalid_checksums))); json_object_set_new(jdata, "drop", json_integer(SC_ATOMIC_GET(pd->drop))); json_object_set_new(answer, "message", jdata); SCReturnInt(TM_ECODE_OK); } } json_object_set_new(answer, "message", json_string("Iface does not exist")); SCReturnInt(TM_ECODE_FAILED); } TmEcode LiveDeviceIfaceList(json_t *cmd, json_t *answer, void *data) { SCEnter(); json_t *jdata; json_t *jarray; LiveDevice *pd; int i = 0; jdata = json_object(); if (jdata == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } jarray = json_array(); if (jarray == NULL) { json_object_set_new(answer, "message", json_string("internal error at json object creation")); return TM_ECODE_FAILED; } TAILQ_FOREACH(pd, &live_devices, next) { json_array_append_new(jarray, json_string(pd->dev)); i++; } json_object_set_new(jdata, "count", json_integer(i)); json_object_set_new(jdata, "ifaces", jarray); json_object_set_new(answer, "message", jdata); SCReturnInt(TM_ECODE_OK); } #endif /* BUILD_UNIX_SOCKET */ suricata-3.2.1/src/output-json.h0000644000000000000000000000416113051004444013463 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio */ #ifndef __OUTPUT_JSON_H__ #define __OUTPUT_JSON_H__ #include "suricata-common.h" #include "util-buffer.h" #include "util-logopenfile.h" void OutputJsonRegister(void); #ifdef HAVE_LIBJANSSON /* helper struct for OutputJSONMemBufferCallback */ typedef struct OutputJSONMemBufferWrapper_ { MemBuffer **buffer; /**< buffer to use & expand as needed */ size_t expand_by; /**< expand by this size */ } OutputJSONMemBufferWrapper; int OutputJSONMemBufferCallback(const char *str, size_t size, void *data); void CreateJSONFlowId(json_t *js, const Flow *f); void JsonTcpFlags(uint8_t flags, json_t *js); json_t *CreateJSONHeader(const Packet *p, int direction_sensative, const char *event_type); json_t *CreateJSONHeaderWithTxId(const Packet *p, int direction_sensitive, const char *event_type, uint64_t tx_id); int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer); OutputCtx *OutputJsonInitCtx(ConfNode *); enum JsonFormat { COMPACT, INDENT }; /* * Global configuration context data */ typedef struct OutputJsonCtx_ { LogFileCtx *file_ctx; enum LogFileType json_out; enum JsonFormat format; } OutputJsonCtx; typedef struct AlertJsonThread_ { /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ LogFileCtx *file_ctx; } AlertJsonThread; #endif /* HAVE_LIBJANSSON */ #endif /* __OUTPUT_JSON_H__ */ suricata-3.2.1/src/detect-engine-hscd.c0000644000000000000000000017041713051004444014611 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Anoop Saldanha * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-hscd.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" /** \brief HTTP Status Code Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpStatCode(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_status == NULL) return; const uint32_t buffer_len = bstr_len(tx->response_status); const uint8_t *buffer = bstr_ptr(tx->response_status); if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxHttpStatCodeRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHttpStatCode, ALPROTO_HTTP, HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */ mpm_ctx, NULL, "http_stat_code"); } /** * \brief Do the http_stat_code content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpStatCode(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_status == NULL) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_LINE) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HSCDMATCH], f, (uint8_t *)bstr_ptr(tx->response_status), bstr_len(tx->response_status), 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS static int DetectEngineHttpStatCodeTest01(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 message\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "message"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"200\"; http_stat_code; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if ((PacketAlertCheck(p1, 1))) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest02(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 2000123 xxxxABC\r\n" "Content-Type: text/html\r\n" "Content-Length: 7\r\n" "\r\n" "xxxxABC"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOCLIENT; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"123\"; http_stat_code; offset:4; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } static int DetectEngineHttpStatCodeTest03(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; int result = 0; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 123"; uint32_t http_len2 = sizeof(http_buf2) - 1; uint8_t http_buf3[] = "456789\r\n" "Content-Type: text/html\r\n" "Content-Length: 17\r\n" "\r\n" "12345678901234ABC"; uint32_t http_len3 = sizeof(http_buf3) - 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"789\"; http_stat_code; offset:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf3, http_len3); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 1))) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest04(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:!\"200\"; http_stat_code; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest05(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"200\"; http_stat_code; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest06(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:!\"123\"; http_stat_code; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest07(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:!\"123\"; http_stat_code; offset:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest08(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:!\"200\"; http_stat_code; depth:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest09(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"200\"; http_stat_code; depth:3; " "content:\"123\"; http_stat_code; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest10(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"200\"; http_stat_code; depth:3; " "content:!\"124\"; http_stat_code; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest11(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"200\"; http_stat_code; depth:3; " "content:\"124\"; http_stat_code; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 did match but should not have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest12(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"20\"; http_stat_code; depth:2; " "content:\"23\"; http_stat_code; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest13(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "content:\"20\"; http_stat_code; depth:3; " "content:!\"25\"; http_stat_code; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest14(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "pcre:/20/S; " "content:\"23\"; http_stat_code; distance:2; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpStatCodeTest15(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_len1 = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200123 abcdef\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_len2 = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http stat code test\"; " "pcre:/200/S; " "content:!\"124\"; http_stat_code; distance:0; within:3; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_len1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_len2); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 did not match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpStatCodeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpStatCodeTest01", DetectEngineHttpStatCodeTest01); UtRegisterTest("DetectEngineHttpStatCodeTest02", DetectEngineHttpStatCodeTest02); UtRegisterTest("DetectEngineHttpStatCodeTest03", DetectEngineHttpStatCodeTest03); UtRegisterTest("DetectEngineHttpStatCodeTest04", DetectEngineHttpStatCodeTest04); UtRegisterTest("DetectEngineHttpStatCodeTest05", DetectEngineHttpStatCodeTest05); UtRegisterTest("DetectEngineHttpStatCodeTest06", DetectEngineHttpStatCodeTest06); UtRegisterTest("DetectEngineHttpStatCodeTest07", DetectEngineHttpStatCodeTest07); UtRegisterTest("DetectEngineHttpStatCodeTest08", DetectEngineHttpStatCodeTest08); UtRegisterTest("DetectEngineHttpStatCodeTest09", DetectEngineHttpStatCodeTest09); UtRegisterTest("DetectEngineHttpStatCodeTest10", DetectEngineHttpStatCodeTest10); UtRegisterTest("DetectEngineHttpStatCodeTest11", DetectEngineHttpStatCodeTest11); UtRegisterTest("DetectEngineHttpStatCodeTest12", DetectEngineHttpStatCodeTest12); UtRegisterTest("DetectEngineHttpStatCodeTest13", DetectEngineHttpStatCodeTest13); UtRegisterTest("DetectEngineHttpStatCodeTest14", DetectEngineHttpStatCodeTest14); UtRegisterTest("DetectEngineHttpStatCodeTest15", DetectEngineHttpStatCodeTest15); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/runmode-pcap.c0000644000000000000000000002342713051004444013547 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #include "suricata-common.h" #include "tm-threads.h" #include "conf.h" #include "runmodes.h" #include "runmode-pcap.h" #include "log-httplog.h" #include "output.h" #include "util-debug.h" #include "util-time.h" #include "util-cpu.h" #include "util-affinity.h" #include "util-device.h" #include "util-runmodes.h" #include "util-atomic.h" #include "util-misc.h" static const char *default_mode = NULL; const char *RunModeIdsGetDefaultMode(void) { return default_mode; } int RunModeIdsPcapWorkers(void); void RunModeIdsPcapRegister(void) { RunModeRegisterNewRunMode(RUNMODE_PCAP_DEV, "single", "Single threaded pcap live mode", RunModeIdsPcapSingle); default_mode = "autofp"; RunModeRegisterNewRunMode(RUNMODE_PCAP_DEV, "autofp", "Multi threaded pcap live mode. Packets from " "each flow are assigned to a single detect thread, " "unlike \"pcap_live_auto\" where packets from " "the same flow can be processed by any detect " "thread", RunModeIdsPcapAutoFp); RunModeRegisterNewRunMode(RUNMODE_PCAP_DEV, "workers", "Workers pcap live mode, each thread does all" " tasks from acquisition to logging", RunModeIdsPcapWorkers); return; } void PcapDerefConfig(void *conf) { PcapIfaceConfig *pfp = (PcapIfaceConfig *)conf; /* Pcap config is used only once but cost of this low. */ if (SC_ATOMIC_SUB(pfp->ref, 1) == 0) { SCFree(pfp); } } void *ParsePcapConfig(const char *iface) { char *threadsstr = NULL; ConfNode *if_root; ConfNode *if_default = NULL; ConfNode *pcap_node; PcapIfaceConfig *aconf = SCMalloc(sizeof(*aconf)); char *tmpbpf; char *tmpctype; intmax_t value; int promisc = 0; intmax_t snaplen = 0; if (unlikely(aconf == NULL)) { return NULL; } if (iface == NULL) { SCFree(aconf); return NULL; } memset(aconf, 0x00, sizeof(*aconf)); strlcpy(aconf->iface, iface, sizeof(aconf->iface)); aconf->buffer_size = 0; /* If set command line option has precedence over config */ if ((ConfGetInt("pcap.buffer-size", &value)) == 1) { SCLogInfo("Pcap will use %d buffer size", (int)value); aconf->buffer_size = value; } aconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; aconf->bpf_filter = NULL; if ((ConfGet("bpf-filter", &tmpbpf)) == 1) { aconf->bpf_filter = tmpbpf; } SC_ATOMIC_INIT(aconf->ref); aconf->DerefFunc = PcapDerefConfig; aconf->threads = 1; /* Find initial node */ pcap_node = ConfGetNode("pcap"); if (pcap_node == NULL) { SCLogInfo("Unable to find pcap config using default value"); return aconf; } if_root = ConfFindDeviceConfig(pcap_node, iface); if_default = ConfFindDeviceConfig(pcap_node, "default"); if (if_root == NULL && if_default == NULL) { SCLogInfo("Unable to find pcap config for " "interface %s, using default value", iface); return aconf; } /* If there is no setting for current interface use default one as main iface */ if (if_root == NULL) { if_root = if_default; if_default = NULL; } if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) { aconf->threads = 1; } else { if (threadsstr != NULL) { aconf->threads = (uint8_t)atoi(threadsstr); } } if (aconf->threads == 0) { aconf->threads = 1; } (void) SC_ATOMIC_ADD(aconf->ref, aconf->threads); if (aconf->buffer_size == 0) { char *s_limit = NULL; int ret; ret = ConfGetChildValueWithDefault(if_root, if_default, "buffer-size", &s_limit); if (ret == 1 && s_limit) { uint64_t bsize = 0; if (ParseSizeStringU64(s_limit, &bsize) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to parse pcap buffer size: %s", s_limit); } else { /* the string 2gb returns 2147483648 which is 1 to high * for a int. */ if (bsize == (uint64_t)((uint64_t)INT_MAX + (uint64_t)1)) bsize = (uint64_t)INT_MAX; if (bsize > INT_MAX) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to set pcap buffer size: 2gb max. %"PRIu64" > %d", bsize, INT_MAX); } else { aconf->buffer_size = (int)bsize; } } } } if (aconf->bpf_filter == NULL) { /* set bpf filter if we have one */ if (ConfGetChildValueWithDefault(if_root, if_default, "bpf-filter", &tmpbpf) != 1) { SCLogDebug("could not get bpf or none specified"); } else { aconf->bpf_filter = tmpbpf; } } else { SCLogInfo("BPF filter set from command line or via old 'bpf-filter' option."); } if (ConfGetChildValueWithDefault(if_root, if_default, "checksum-checks", &tmpctype) == 1) { if (strcmp(tmpctype, "auto") == 0) { aconf->checksum_mode = CHECKSUM_VALIDATION_AUTO; } else if (ConfValIsTrue(tmpctype)) { aconf->checksum_mode = CHECKSUM_VALIDATION_ENABLE; } else if (ConfValIsFalse(tmpctype)) { aconf->checksum_mode = CHECKSUM_VALIDATION_DISABLE; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid value for checksum-checks for %s", aconf->iface); } } aconf->promisc = LIBPCAP_PROMISC; if (ConfGetChildValueBoolWithDefault(if_root, if_default, "promisc", &promisc) != 1) { SCLogDebug("could not get promisc or none specified"); } else { aconf->promisc = promisc; } aconf->snaplen = 0; if (ConfGetChildValueIntWithDefault(if_root, if_default, "snaplen", &snaplen) != 1) { SCLogDebug("could not get snaplen or none specified"); } else { aconf->snaplen = snaplen; } return aconf; } int PcapConfigGeThreadsCount(void *conf) { PcapIfaceConfig *pfp = (PcapIfaceConfig *)conf; return pfp->threads; } /** * \brief Single thread version of the Pcap live processing. */ int RunModeIdsPcapSingle(void) { int ret; char *live_dev = NULL; SCEnter(); RunModeInitialize(); TimeModeSetLive(); (void)ConfGet("pcap.single-pcap-dev", &live_dev); ret = RunModeSetLiveCaptureSingle(ParsePcapConfig, PcapConfigGeThreadsCount, "ReceivePcap", "DecodePcap", thread_name_single, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPcapSingle initialised"); SCReturnInt(0); } /** * \brief RunModIdsPcapAutoFp set up the following thread packet handlers: * - Receive thread (from pcap device) * - Decode thread * - Stream thread * - Detect: If we have only 1 cpu, it will setup one Detect thread * If we have more than one, it will setup num_cpus - 1 * starting from the second cpu available. * - Outputs thread * By default the threads will use the first cpu available * except the Detection threads if we have more than one cpu. * * \retval 0 If all goes well. (If any problem is detected the engine will * exit()). */ int RunModeIdsPcapAutoFp(void) { int ret; char *live_dev = NULL; SCEnter(); RunModeInitialize(); TimeModeSetLive(); (void) ConfGet("pcap.single-pcap-dev", &live_dev); ret = RunModeSetLiveCaptureAutoFp(ParsePcapConfig, PcapConfigGeThreadsCount, "ReceivePcap", "DecodePcap", thread_name_autofp, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Runmode start failed"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPcapAutoFp initialised"); SCReturnInt(0); } /** * \brief Workers version of the PCAP LIVE processing. * * Start N threads with each thread doing all the work. * */ int RunModeIdsPcapWorkers(void) { int ret; char *live_dev = NULL; SCEnter(); RunModeInitialize(); TimeModeSetLive(); (void) ConfGet("pcap.single-pcap-dev", &live_dev); ret = RunModeSetLiveCaptureWorkers(ParsePcapConfig, PcapConfigGeThreadsCount, "ReceivePcap", "DecodePcap", thread_name_workers, live_dev); if (ret != 0) { SCLogError(SC_ERR_RUNMODE, "Unable to start runmode"); exit(EXIT_FAILURE); } SCLogInfo("RunModeIdsPcapWorkers initialised"); SCReturnInt(0); } suricata-3.2.1/src/util-lua-http.h0000644000000000000000000000170113051004444013662 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_LUA_HTTP_H__ #define __UTIL_LUA_HTTP_H__ #ifdef HAVE_LUA int LuaRegisterHttpFunctions(lua_State *luastate); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_HTTP_H__ */ suricata-3.2.1/src/app-layer-smb.c0000644000000000000000000027763113051004444013636 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl * * \brief SMBv1 parser/decoder */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-debug.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-detect-proto.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-dcerpc.h" #include "util-spm.h" #include "util-unittest.h" #include "util-memcmp.h" #include "app-layer-smb.h" enum { SMB_FIELD_NONE = 0, SMB_PARSE_NBSS_HEADER, SMB_PARSE_SMB_HEADER, SMB_PARSE_GET_WORDCOUNT, SMB_PARSE_WORDCOUNT, SMB_PARSE_GET_BYTECOUNT, SMB_PARSE_BYTECOUNT, /* must be last */ SMB_FIELD_MAX, }; /** * \brief SMB Write AndX Request Parsing */ /* For WriteAndX we need to get writeandxdataoffset */ static uint32_t SMBParseWriteAndX(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; switch (sstate->andx.andxbytesprocessed) { case 0: sstate->andx.paddingparsed = 0; if (input_len >= 28) { sstate->andx.andxcommand = *p; sstate->andx.andxoffset = *(p + 2); sstate->andx.andxoffset |= *(p + 3) << 8; sstate->andx.datalengthhigh = *(p + 18); sstate->andx.datalengthhigh |= *(p + 19) << 8; sstate->andx.datalength = *(p + 20); sstate->andx.datalength |= *(p + 21) << 8; sstate->andx.dataoffset = *(p + 22); sstate->andx.dataoffset |= *(p + 23) << 8; sstate->andx.dataoffset |= (uint64_t) *(p + 24) << 56; sstate->andx.dataoffset |= (uint64_t) *(p + 25) << 48; sstate->andx.dataoffset |= (uint64_t) *(p + 26) << 40; sstate->andx.dataoffset |= (uint64_t) *(p + 27) << 32; sstate->bytesprocessed += 28; SCReturnUInt(28U); } else { sstate->andx.andxcommand = *(p++); if (!(--input_len)) break; } /* fall through */ case 1: p++; // Reserved if (!(--input_len)) break; /* fall through */ case 2: sstate->andx.andxoffset = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 3: sstate->andx.andxoffset |= *(p++); if (!(--input_len)) break; /* fall through */ case 4: // SMB_COM_WRITE_ANDX Fid 1 p++; if (!(--input_len)) break; /* fall through */ case 5: // SMB_COM_WRITE_ANDX Fid 2 p++; if (!(--input_len)) break; /* fall through */ case 6: // SMB_COM_WRITE_ANDX Offset 1 p++; if (!(--input_len)) break; /* fall through */ case 7: // SMB_COM_WRITE_ANDX Offset 2 p++; if (!(--input_len)) break; /* fall through */ case 8: // SMB_COM_WRITE_ANDX Offset 3 p++; if (!(--input_len)) break; /* fall through */ case 9: // SMB_COM_WRITE_ANDX Offset 4 p++; if (!(--input_len)) break; /* fall through */ case 10: // SMB_COM_WRITE_ANDX Reserved 1 p++; if (!(--input_len)) break; /* fall through */ case 11: // SMB_COM_WRITE_ANDX Reserved 2 p++; if (!(--input_len)) break; /* fall through */ case 12: // SMB_COM_WRITE_ANDX Reserved 3 p++; if (!(--input_len)) break; /* fall through */ case 13: // SMB_COM_WRITE_ANDX Reserved 4 p++; if (!(--input_len)) break; /* fall through */ case 14: // SMB_COM_WRITE_ANDX WriteMode 1 p++; if (!(--input_len)) break; /* fall through */ case 15: // SMB_COM_WRITE_ANDX WriteMode 2 p++; if (!(--input_len)) break; /* fall through */ case 16: // SMB_COM_WRITE_ANDX BytesRemaining 1 p++; if (!(--input_len)) break; /* fall through */ case 17: // SMB_COM_WRITE_ANDX BytesRemaining 2 p++; if (!(--input_len)) break; /* fall through */ case 18: // DataLengthHigh 1 sstate->andx.datalengthhigh = *(p++); if (!(--input_len)) break; /* fall through */ case 19: // DataLengthHigh 2 sstate->andx.datalengthhigh |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 20: // DataLength 1 sstate->andx.datalength = *(p++); if (!(--input_len)) break; /* fall through */ case 21: // DataLength 2 sstate->andx.datalength |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 22: sstate->andx.dataoffset = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 23: sstate->andx.dataoffset |= *(p++); if (!(--input_len)) break; /* fall through */ case 24: sstate->andx.dataoffset |= (uint64_t) *(p++) << 56; if (!(--input_len)) break; /* fall through */ case 25: sstate->andx.dataoffset |= (uint64_t) *(p++) << 48; if (!(--input_len)) break; /* fall through */ case 26: sstate->andx.dataoffset |= (uint64_t) *(p++) << 40; if (!(--input_len)) break; /* fall through */ case 27: sstate->andx.dataoffset |= (uint64_t) *(p++) << 32; --input_len; break; /* fall through */ default: sstate->bytesprocessed++; SCReturnUInt(1); break; } sstate->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** * \brief SMB Read AndX Response Parsing */ static uint32_t SMBParseReadAndX(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; switch (sstate->andx.andxbytesprocessed) { case 0: sstate->andx.paddingparsed = 0; if (input_len >= 24) { sstate->andx.andxcommand = *p; sstate->andx.andxoffset = *(p + 2); sstate->andx.andxoffset |= *(p + 3) << 8; sstate->andx.datalength = *(p + 10); sstate->andx.datalength |= *(p + 11) << 8; sstate->andx.dataoffset = *(p + 12); sstate->andx.dataoffset |= *(p + 13) << 8; sstate->andx.datalength |= (uint64_t) *(p + 14) << 32; sstate->andx.datalength |= (uint64_t) *(p + 15) << 40; sstate->andx.datalength |= (uint64_t) *(p + 16) << 48; sstate->andx.datalength |= (uint64_t) *(p + 17) << 56; sstate->bytesprocessed += 24; SCReturnUInt(24U); } else { sstate->andx.andxcommand = *(p++); if (!(--input_len)) break; } /* fall through */ case 1: p++; // Reserved if (!(--input_len)) break; /* fall through */ case 2: sstate->andx.andxoffset |= *(p++); if (!(--input_len)) break; /* fall through */ case 3: sstate->andx.andxoffset |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 4: // SMB_COM_READ_ANDX Remaining Reserved must be 0xff p++; if (!(--input_len)) break; /* fall through */ case 5: // SMB_COM_READ_ANDX Remaining Reserved must be 0xff p++; if (!(--input_len)) break; /* fall through */ case 6: // SMB_COM_READ_ANDX DataCompactionMode 1 p++; if (!(--input_len)) break; /* fall through */ case 7: // SMB_COM_READ_ANDX DataCompactionMode 1 p++; if (!(--input_len)) break; /* fall through */ case 8: // SMB_COM_READ_ANDX Reserved p++; if (!(--input_len)) break; /* fall through */ case 9: // SMB_COM_READ_ANDX Reserved p++; if (!(--input_len)) break; /* fall through */ case 10: sstate->andx.datalength = *(p++); if (!(--input_len)) break; /* fall through */ case 11: sstate->andx.datalength |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 12: sstate->andx.dataoffset = *(p++); if (!(--input_len)) break; /* fall through */ case 13: sstate->andx.dataoffset |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 14: sstate->andx.datalength |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 15: sstate->andx.datalength |= *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 16: // SMB_COM_READ_ANDX Reserved p++; if (!(--input_len)) break; /* fall through */ case 17: // SMB_COM_READ_ANDX Reserved p++; if (!(--input_len)) break; /* fall through */ case 18: // SMB_COM_READ_ANDX Reserved p++; --input_len; break; default: sstate->bytesprocessed++; SCReturnUInt(1); break; } sstate->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } static uint32_t SMBParseTransact(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; switch (sstate->andx.andxbytesprocessed) { case 0: sstate->andx.paddingparsed = 0; if (input_len >= 26) { sstate->andx.datalength = *(p + 22); sstate->andx.datalength |= *(p + 23) << 8; sstate->andx.dataoffset = *(p + 24); sstate->andx.dataoffset |= *(p + 25) << 8; sstate->andx.datalength |= (uint64_t) *(p + 14) << 56; sstate->andx.datalength |= (uint64_t) *(p + 15) << 48; sstate->andx.datalength |= (uint64_t) *(p + 16) << 40; sstate->andx.datalength |= (uint64_t) *(p + 17) << 32; sstate->bytesprocessed += 26; sstate->andx.andxbytesprocessed += 26; SCReturnUInt(sstate->wordcount.wordcount); } else { /* total parameter count 1 */ p++; if (!(--input_len)) break; } /* fall through */ case 1: /* total parameter count 2 */ p++; if (!(--input_len)) break; /* fall through */ case 2: /* total data count 1 */ p++; if (!(--input_len)) break; /* fall through */ case 3: /* total data count 2 */ p++; if (!(--input_len)) break; /* fall through */ case 4: /* max parameter count 1 */ p++; if (!(--input_len)) break; /* fall through */ case 5: /* max parameter count 2 */ p++; if (!(--input_len)) break; /* fall through */ case 6: /* max data count 1 */ p++; if (!(--input_len)) break; /* fall through */ case 7: /* max data count 2 */ p++; if (!(--input_len)) break; /* fall through */ case 8: /* max setup count */ p++; if (!(--input_len)) break; /* fall through */ case 9: /* Reserved */ p++; if (!(--input_len)) break; /* fall through */ case 10: /* Flags */ p++; if (!(--input_len)) break; /* fall through */ case 11: /* Flags */ p++; if (!(--input_len)) break; /* fall through */ case 12: /* Timeout */ p++; if (!(--input_len)) break; /* fall through */ case 13: /* Timeout */ p++; if (!(--input_len)) break; /* fall through */ case 14: /* Timeout */ p++; if (!(--input_len)) break; /* fall through */ case 15: /* Timeout */ p++; if (!(--input_len)) break; /* fall through */ case 16: /* Reserved */ p++; if (!(--input_len)) break; /* fall through */ case 17: /* Reserved */ p++; if (!(--input_len)) break; /* fall through */ case 18: /* Parameter Count */ p++; if (!(--input_len)) break; /* fall through */ case 19: /* Parameter Count */ p++; if (!(--input_len)) break; /* fall through */ case 20: /* Parameter Offset */ p++; if (!(--input_len)) break; /* fall through */ case 21: /* Parameter Offset */ p++; if (!(--input_len)) break; /* fall through */ case 22: /* Data Count */ sstate->andx.datalength = *(p++); if (!(--input_len)) break; /* fall through */ case 23: /* Data Count */ sstate->andx.datalength |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 24: /* Data Offset */ sstate->andx.dataoffset = *(p++); if (!(--input_len)) break; /* fall through */ case 25: /* Data Offset */ sstate->andx.dataoffset |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 26: /* Setup Count */ p++; if (!(--input_len)) break; /* fall through */ case 27: /* Reserved */ p++; if (!(--input_len)) break; /* fall through */ case 28: p++; if (!(--input_len)) break; /* fall through */ case 29: p++; if (!(--input_len)) break; /* fall through */ case 30: p++; if (!(--input_len)) break; /* fall through */ case 31: p++; --input_len; break; default: SCLogDebug("SMB_COM_TRANSACTION AndX bytes processed is greater than 31 %u", sstate->andx.andxbytesprocessed); sstate->bytesprocessed++; sstate->andx.andxbytesprocessed++; SCReturnUInt(1); break; } sstate->bytesprocessed += (p - input); sstate->andx.andxbytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** * Handle variable length padding for WriteAndX and ReadAndX */ static uint32_t PaddingParser(void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; /* Check for validity of dataoffset */ if ((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) > sstate->andx.dataoffset) { sstate->andx.paddingparsed = 1; SCReturnUInt((uint32_t)(p - input)); } while (((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input)) < sstate->andx.dataoffset && sstate->bytecount.bytecountleft-- && input_len--) { SCLogDebug("0x%02x ", *p); p++; } if (((uint64_t)(sstate->bytesprocessed - NBSS_HDR_LEN) + (p - input)) == sstate->andx.dataoffset) { sstate->andx.paddingparsed = 1; } sstate->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } /** * \brief Parse WriteAndX and ReadAndX Data * \retval -1 f DCERPCParser does not validate * \retval Number of bytes processed */ static int32_t DataParser(void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; int32_t parsed = 0; if (sstate->andx.paddingparsed) { parsed = DCERPCParser(&sstate->dcerpc, input, input_len); if (parsed == -1 || parsed > sstate->bytecount.bytecountleft || parsed > (int32_t)input_len) { SCReturnInt(-1); } else { sstate->dcerpc_present = 1; sstate->bytesprocessed += parsed; sstate->bytecount.bytecountleft -= parsed; input_len -= parsed; (void)input_len; /* for scan-build */ } } SCReturnInt(parsed); } /** * \brief Obtain SMB WordCount which is 2 times the value. * Reset bytecount.bytecountbytes to 0. * Determine if this is an SMB AndX Command */ static uint32_t SMBGetWordCount(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); if (input_len > 0) { SMBState *sstate = (SMBState *) smb_state; sstate->wordcount.wordcount = *(input) * 2; sstate->wordcount.wordcountleft = sstate->wordcount.wordcount; sstate->bytesprocessed++; sstate->bytecount.bytecountbytes = 0; sstate->andx.isandx = isAndX(sstate); SCLogDebug("Wordcount (%u):", sstate->wordcount.wordcount); SCReturnUInt(1U); } SCReturnUInt(0); } /* * Obtain SMB Bytecount. Handle the corner obfuscation case where a packet boundary * is after the first bytecount byte. */ static uint32_t SMBGetByteCount(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount) { sstate->bytecount.bytecount = *(p++); sstate->bytesprocessed++; --input_len; } if (input_len && sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN + 2 + sstate->wordcount.wordcount) { sstate->bytecount.bytecount |= *(p++) << 8; sstate->bytecount.bytecountleft = sstate->bytecount.bytecount; sstate->bytesprocessed++; SCLogDebug("Bytecount %u", sstate->bytecount.bytecount); --input_len; } SCReturnUInt((uint32_t)(p - input)); } /** * \brief SMBParseWordCount parses the SMB Wordcount portion of the SMB Transaction. * until sstate->wordcount.wordcount bytes are parsed. */ static uint32_t SMBParseWordCount(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; uint32_t retval = 0; if ((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command == SMB_COM_READ_ANDX) { retval = SMBParseReadAndX(f, sstate, pstate, input, input_len); if (retval <= sstate->wordcount.wordcountleft) { sstate->wordcount.wordcountleft -= retval; SCLogDebug("SMB_COM_READ_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); SCReturnUInt(retval); } else { SCReturnUInt(0U); } } else if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0) && sstate->smb.command == SMB_COM_WRITE_ANDX) { retval = SMBParseWriteAndX(f, sstate, pstate, input, input_len); if (retval <= sstate->wordcount.wordcountleft) { sstate->wordcount.wordcountleft -= retval; SCLogDebug("SMB_COM_WRITE_ANDX returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); SCReturnUInt(retval); } else { SCReturnUInt(0U); } } else if (sstate->smb.command == SMB_COM_TRANSACTION) { retval = SMBParseTransact(f, sstate, pstate, input, input_len); if (retval <= sstate->wordcount.wordcountleft) { sstate->wordcount.wordcountleft -= retval; SCLogDebug("SMB_COM_TRANSACTION returned %d - %u bytes at offset %"PRIu64"", retval, sstate->andx.datalength, sstate->andx.dataoffset); SCReturnUInt(retval); } else { SCReturnUInt(0U); } } else { /* Generic WordCount Handler */ while (sstate->wordcount.wordcountleft-- && input_len--) { SCLogDebug("0x%02x wordcount %u/%u input_len %u", *p, sstate->wordcount.wordcountleft, sstate->wordcount.wordcount, input_len); p++; } sstate->bytesprocessed += (p - input); SCReturnUInt((uint32_t)(p - input)); } } /** * \brief SMBParseByteCount parses the SMB ByteCount portion of the SMB Transaction. * until sstate->bytecount.bytecount bytes are parsed. */ static uint32_t SMBParseByteCount(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; uint32_t ures = 0; /* unsigned */ int32_t sres = 0; /* signed */ uint32_t parsed = 0; if (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) && sstate->smb.command == SMB_COM_READ_ANDX) || (((sstate->smb.flags & SMB_FLAGS_SERVER_TO_REDIR) == 0) && sstate->smb.command == SMB_COM_WRITE_ANDX) || (sstate->smb.command == SMB_COM_TRANSACTION)) { if (sstate->andx.paddingparsed == 0) { ures = PaddingParser(sstate, pstate, input + parsed, input_len); if (ures <= input_len) { parsed += ures; input_len -= ures; } else { SCReturnUInt(0U); } } if (sstate->andx.datalength && input_len) { /* Uncomment the next line to help debug DCERPC over SMB */ //hexdump(f, input + parsed, input_len); sres = DataParser(sstate, pstate, input + parsed, input_len); if (sres != -1 && sres <= (int32_t)input_len) { parsed += (uint32_t)sres; (void)parsed; /* for scan-build */ input_len -= (uint32_t)sres; (void)input_len; /* for scan-build */ } else { /* Did not Validate as DCERPC over SMB */ while (sstate->bytecount.bytecountleft-- && input_len--) { SCLogDebug("0x%02x bytecount %"PRIu16"/%"PRIu16" input_len %"PRIu32, *p, sstate->bytecount.bytecountleft, sstate->bytecount.bytecount, input_len); p++; } sstate->bytesprocessed += (p - input); SCReturnUInt((p - input)); } } SCReturnUInt(ures); } while (sstate->bytecount.bytecountleft-- && input_len--) { SCLogDebug("0x%02x bytecount %u/%u input_len %u", *p, sstate->bytecount.bytecountleft, sstate->bytecount.bytecount, input_len); p++; } sstate->bytesprocessed += (p - input); SCReturnUInt((p - input)); } /** * \brief Parse a NBSS header. * * \retval 4 parsing of the header is done * \retval 3 parsing partially done * \retval 2 parsing partially done * \retval 1 parsing partially done * \retval 0 no input or already done */ static uint32_t NBSSParseHeader(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; if (input_len > 0 && sstate->bytesprocessed < (NBSS_HDR_LEN - 1)) { switch (sstate->bytesprocessed) { case 0: /* Initialize */ sstate->andx.andxcommand = SMB_NO_SECONDARY_ANDX_COMMAND; sstate->andx.maxchainedandx = 5; /* fast track for having all bytes (common case) */ if (input_len >= NBSS_HDR_LEN) { sstate->nbss.type = *p; sstate->nbss.length = (*(p + 1) & 0x01) << 16; sstate->nbss.length |= *(p + 2) << 8; sstate->nbss.length |= *(p + 3); sstate->bytesprocessed += NBSS_HDR_LEN; SCReturnUInt(4U); } else { sstate->nbss.type = *(p++); if (!(--input_len)) break; } /* fall through */ case 1: sstate->nbss.length = (*(p++) & 0x01) << 16; if (!(--input_len)) break; /* fall through */ case 2: sstate->nbss.length |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 3: sstate->nbss.length |= *(p++); --input_len; break; } sstate->bytesprocessed += (p - input); } SCReturnUInt((uint32_t)(p - input)); } /** * \brief parse and validate the 32 byte SMB Header * * \retval 32 parsing done * \retval >0<32 parsing in progress * \retval 0 no input or already fully parsed * \retval -1 error */ static int SMBParseHeader(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint8_t *p = input; if (input_len > 0) { switch (sstate->bytesprocessed) { case 4: // fallthrough /* above statement to prevent coverity FPs from the switch * fall through */ if (input_len >= SMB_HDR_LEN) { if (SCMemcmp(p, "\xff\x53\x4d\x42", 4) != 0) { SCLogDebug("SMB Header did not validate"); SCReturnInt(-1); } sstate->smb.command = *(p + 4); sstate->smb.status = (uint32_t) *(p + 5) << 24; sstate->smb.status |= (uint32_t) *(p + 6) << 16; sstate->smb.status |= (uint32_t) *(p + 7) << 8; sstate->smb.status |= (uint32_t) *(p + 8); sstate->smb.flags = *(p + 9); sstate->smb.flags2 = *(p + 10) << 8; sstate->smb.flags2 |= *(p + 11); sstate->smb.pidhigh = *(p + 12) << 8; sstate->smb.pidhigh |= *(p + 13); sstate->smb.securitysignature = (uint64_t) *(p + 14) << 56; sstate->smb.securitysignature |= (uint64_t) *(p + 15) << 48; sstate->smb.securitysignature |= (uint64_t) *(p + 16) << 40; sstate->smb.securitysignature |= (uint64_t) *(p + 17) << 32; sstate->smb.securitysignature |= (uint64_t) *(p + 18) << 24; sstate->smb.securitysignature |= (uint64_t) *(p + 19) << 16; sstate->smb.securitysignature |= (uint64_t) *(p + 20) << 8; sstate->smb.securitysignature |= (uint64_t) *(p + 21); sstate->smb.tid = *(p + 24) << 8; sstate->smb.tid |= *(p + 25); sstate->smb.pid = *(p + 26) << 8; sstate->smb.pid |= *(p + 27); sstate->smb.uid = *(p + 28) << 8; sstate->smb.uid |= *(p + 29); sstate->smb.mid = *(p + 30) << 8; sstate->smb.mid |= *(p + 31); sstate->bytesprocessed += SMB_HDR_LEN; SCReturnInt(32); break; } else { if (*(p++) != 0xff) { SCLogDebug("SMB Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* We fall through to the next case if we still have input. * Same applies for other cases as well */ } /* fall through */ case 5: if (*(p++) != 'S') { SCLogDebug("SMB Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* fall through */ case 6: if (*(p++) != 'M') { SCLogDebug("SMB Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* fall through */ case 7: if (*(p++) != 'B') { SCLogDebug("SMB Header did not validate"); SCReturnInt(-1); } if (!(--input_len)) break; /* fall through */ case 8: sstate->smb.command = *(p++); if (!(--input_len)) break; /* fall through */ case 9: sstate->smb.status = *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 10: sstate->smb.status |= *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 11: sstate->smb.status |= *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 12: sstate->smb.status |= *(p++); if (!(--input_len)) break; /* fall through */ case 13: sstate->smb.flags = *(p++); if (!(--input_len)) break; /* fall through */ case 14: sstate->smb.flags2 = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 15: sstate->smb.flags2 |= *(p++); if (!(--input_len)) break; /* fall through */ case 16: sstate->smb.pidhigh = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 17: sstate->smb.pidhigh |= *(p++); if (!(--input_len)) break; /* fall through */ case 18: sstate->smb.securitysignature = (uint64_t) *(p++) << 56; if (!(--input_len)) break; /* fall through */ case 19: sstate->smb.securitysignature |= (uint64_t) *(p++) << 48; if (!(--input_len)) break; /* fall through */ case 20: sstate->smb.securitysignature |= (uint64_t) *(p++) << 40; if (!(--input_len)) break; /* fall through */ case 21: sstate->smb.securitysignature |= (uint64_t) *(p++) << 32; if (!(--input_len)) break; /* fall through */ case 22: sstate->smb.securitysignature |= (uint64_t) *(p++) << 24; if (!(--input_len)) break; /* fall through */ case 23: sstate->smb.securitysignature |= (uint64_t) *(p++) << 16; if (!(--input_len)) break; /* fall through */ case 24: sstate->smb.securitysignature |= (uint64_t) *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 25: sstate->smb.securitysignature |= (uint64_t) *(p++); if (!(--input_len)) break; /* fall through */ case 26: p++; // UNUSED if (!(--input_len)) break; /* fall through */ case 27: p++; // UNUSED if (!(--input_len)) break; /* fall through */ case 28: sstate->smb.tid = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 29: sstate->smb.tid |= *(p++); if (!(--input_len)) break; /* fall through */ case 30: sstate->smb.pid = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 31: sstate->smb.pid |= *(p++); if (!(--input_len)) break; /* fall through */ case 32: sstate->smb.uid = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 33: sstate->smb.uid |= *(p++); if (!(--input_len)) break; /* fall through */ case 34: sstate->smb.mid = *(p++) << 8; if (!(--input_len)) break; /* fall through */ case 35: sstate->smb.mid |= *(p++); --input_len; break; /* fall through */ } } sstate->bytesprocessed += (p - input); SCReturnInt((p - input)); } static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data, uint8_t dir) { SCEnter(); SMBState *sstate = (SMBState *) smb_state; uint64_t retval = 0; uint64_t parsed = 0; int hdrretval = 0; int counter = 0; if (pstate == NULL) { SCLogDebug("pstate == NULL"); SCReturnInt(0); } if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } if (sstate->bytesprocessed != 0 && sstate->data_needed_for_dir != dir) { SCReturnInt(-1); } while (input_len) { /* till we clear corner cases */ if (counter++ == 30) { SCLogDebug("Somehow seem to be stuck inside the smb " "parser for quite sometime. Let's get out of here."); sstate->bytesprocessed = 0; SCReturnInt(0); } while (input_len && sstate->bytesprocessed < NBSS_HDR_LEN) { retval = NBSSParseHeader(f, smb_state, pstate, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; SCLogDebug("[1] NBSS Header (%u/%u) Type 0x%02x Length 0x%04x " "parsed %"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN, sstate->nbss.type, sstate->nbss.length, parsed, input_len); } else if (input_len) { SCLogDebug("Error parsing NBSS Header"); sstate->bytesprocessed = 0; SCReturnInt(0); } } switch (sstate->nbss.type) { case NBSS_SESSION_MESSAGE: while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN && sstate->bytesprocessed < NBSS_HDR_LEN + SMB_HDR_LEN)) { /* inside while */ hdrretval = SMBParseHeader(f, smb_state, pstate, input + parsed, input_len); if (hdrretval == -1 || hdrretval > (int32_t)input_len) { SCLogDebug("Error parsing SMB Header"); sstate->bytesprocessed = 0; SCReturnInt(0); } else { parsed += hdrretval; input_len -= hdrretval; SCLogDebug("[2] SMB Header (%u/%u) Command 0x%02x " "parsed %"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN, sstate->smb.command, parsed, input_len); } } /* while */ do { if (input_len && (sstate->bytesprocessed == NBSS_HDR_LEN + SMB_HDR_LEN)) { /* inside if */ retval = SMBGetWordCount(f, smb_state, pstate, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing SMB Word Count"); sstate->bytesprocessed = 0; SCReturnInt(0); } SCLogDebug("[3] WordCount (%u/%u) WordCount %u parsed " "%"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1, sstate->wordcount.wordcount, parsed, input_len); } /* if (input_len && ..) */ while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN + SMB_HDR_LEN + 1 && sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount))) { /* inside while */ retval = SMBParseWordCount(f, smb_state, pstate, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing SMB Word Count Data retval " "%"PRIu64" input_len %u", retval, input_len); sstate->bytesprocessed = 0; SCReturnInt(0); } SCLogDebug("[4] Parsing WordCount (%u/%u) WordCount %u " "parsed %"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount, sstate->wordcount.wordcount, parsed, input_len); } /* while (input_len && ..) */ while (input_len && (sstate->bytesprocessed >= (NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount) && sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 3 + sstate->wordcount.wordcount))) { /* inside while */ retval = SMBGetByteCount(f, smb_state, pstate, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing SMB Byte Count"); sstate->bytesprocessed = 0; SCReturnInt(0); } SCLogDebug("[5] ByteCount (%u/%u) ByteCount %u parsed " "%"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 3, sstate->bytecount.bytecount, parsed, input_len); if (sstate->bytecount.bytecount == 0) { sstate->bytesprocessed = 0; input_len = 0; } } /* while (input_len && ..) */ while (input_len && (sstate->bytesprocessed >= (NBSS_HDR_LEN + SMB_HDR_LEN + 3 + sstate->wordcount.wordcount)) && (sstate->bytesprocessed < (NBSS_HDR_LEN + SMB_HDR_LEN + 3 + sstate->wordcount.wordcount + sstate->bytecount.bytecount))) { /* inside while */ retval = SMBParseByteCount(f, smb_state, pstate, input + parsed, input_len); if (retval && retval <= input_len) { parsed += retval; input_len -= retval; } else if (input_len) { SCLogDebug("Error parsing SMB Byte Count Data"); sstate->bytesprocessed = 0; SCReturnInt(0); } SCLogDebug("[6] Parsing ByteCount (%u/%u) ByteCount %u " "parsed %"PRIu64" input_len %u", sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount + 2 + sstate->bytecount.bytecount, sstate->bytecount.bytecount, parsed, input_len); } /* while (input_len && ..) */ } while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND && input_len && sstate->andx.maxchainedandx--); if (sstate->bytesprocessed >= sstate->nbss.length + NBSS_HDR_LEN || sstate->andx.maxchainedandx == 0) { /* inside if */ sstate->bytesprocessed = 0; sstate->transaction_id++; input_len = 0; } break; case NBSS_SESSION_REQUEST: case NBSS_POSITIVE_SESSION_RESPONSE: case NBSS_NEGATIVE_SESSION_RESPONSE: case NBSS_RETARGET_SESSION_RESPONSE: case NBSS_SESSION_KEEP_ALIVE: if (sstate->bytesprocessed < (sstate->nbss.length + NBSS_HDR_LEN)) { if (input_len >= (sstate->nbss.length + NBSS_HDR_LEN - sstate->bytesprocessed)) { /* inside if */ input_len -= (sstate->nbss.length + NBSS_HDR_LEN - sstate->bytesprocessed); parsed += (sstate->nbss.length + NBSS_HDR_LEN - sstate->bytesprocessed); sstate->bytesprocessed = 0; } else { sstate->bytesprocessed += input_len; input_len = 0; } } else { sstate->bytesprocessed = 0; } break; default: sstate->bytesprocessed = 0; break; } /* switch */ } /* while (input_len) */ sstate->data_needed_for_dir = dir; SCReturnInt(1); } static int SMBParseRequest(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return SMBParse(f, smb_state, pstate, input, input_len, local_data, 0); } static int SMBParseResponse(Flow *f, void *smb_state, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { return SMBParse(f, smb_state, pstate, input, input_len, local_data, 1); } /** * \brief determines if the SMB command is an ANDX command * \retval 1 if smb command is an AndX command * \retval 0 if smb command is not an AndX command */ int isAndX(SMBState *smb_state) { SCEnter(); switch (smb_state->smb.command) { case SMB_NO_SECONDARY_ANDX_COMMAND: case SMB_COM_LOCKING_ANDX: case SMB_COM_OPEN_ANDX: case SMB_COM_READ_ANDX: case SMB_COM_WRITE_ANDX: case SMB_COM_SESSION_SETUP_ANDX: case SMB_COM_LOGOFF_ANDX: case SMB_COM_TREE_CONNECT_ANDX: case SMB_COM_NT_CREATE_ANDX: smb_state->andx.andxbytesprocessed = 0; SCReturnInt(1); default: SCReturnInt(0); } } /** \internal * \brief Allocate a SMBState * \retval s State, or NULL in case of error */ static void *SMBStateAlloc(void) { SCEnter(); SMBState *s = (SMBState *)SCCalloc(1, sizeof(SMBState)); if (unlikely(s == NULL)) { SCReturnPtr(NULL, "void"); } DCERPCInit(&s->dcerpc); SCReturnPtr(s, "void"); } /** \internal * \brief Free a SMBState */ static void SMBStateFree(void *s) { SCEnter(); SMBState *sstate = (SMBState *) s; DCERPCCleanup(&sstate->dcerpc); SCFree(s); SCReturn; } #define SMB_PROBING_PARSER_MIN_DEPTH 8 static uint16_t SMBProbingParser(uint8_t *input, uint32_t ilen, uint32_t *offset) { int32_t len; int32_t input_len = ilen; while (input_len >= SMB_PROBING_PARSER_MIN_DEPTH) { switch (input[0]) { case NBSS_SESSION_MESSAGE: if (input[4] == 0xFF && input[5] == 'S' && input[6] == 'M' && input[7] == 'B') { return ALPROTO_SMB; } /* fall through */ case NBSS_SESSION_REQUEST: case NBSS_POSITIVE_SESSION_RESPONSE: case NBSS_NEGATIVE_SESSION_RESPONSE: case NBSS_RETARGET_SESSION_RESPONSE: case NBSS_SESSION_KEEP_ALIVE: len = (input[1] & 0x01) << 16; len |= input[2] << 8; len |= input[3]; break; default: /* -1 indicates a stream where the probing parser would be * unable to find nbss, even if it exists. This should * prevent the probing parser from beig invoked henceforth */ return ALPROTO_FAILED; } input_len -= 4; if (len >= input_len) { return ALPROTO_UNKNOWN; } input_len -= len; input += 4 + len; } return ALPROTO_UNKNOWN; } static int SMBRegisterPatternsForProtocolDetection(void) { int r = 0; r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER); r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT); r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER); r |= AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT); return r == 0 ? 0 : -1; } void RegisterSMBParsers(void) { char *proto_name = "smb"; if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_SMB, proto_name); if (SMBRegisterPatternsForProtocolDetection() < 0) return; if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_TCP, "139", ALPROTO_SMB, SMB_PROBING_PARSER_MIN_DEPTH, 0, STREAM_TOSERVER, SMBProbingParser, SMBProbingParser); } else { AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP, proto_name, ALPROTO_SMB, SMB_PROBING_PARSER_MIN_DEPTH, 0, SMBProbingParser, SMBProbingParser); } AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOSERVER); } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("tcp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOSERVER, SMBParseRequest); AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_SMB, STREAM_TOCLIENT, SMBParseResponse); AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_SMB, SMBStateAlloc, SMBStateFree); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection " "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests); #endif return; } /* UNITTESTS */ #ifdef UNITTESTS #include "flow-util.h" /** * \test SMBParserTest01 tests the NBSS and SMB header decoding */ int SMBParserTest01(void) { int result = 0; Flow f; uint8_t smbbuf[] = "\x00\x00\x00\x85" // NBSS "\xff\x53\x4d\x42\x72\x00\x00\x00" // SMB "\x00\x18\x53\xc8\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xff\xfe\x00\x00\x00\x00" "\x00" // WordCount "\x62\x00" // ByteCount "\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20" "\x31\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f\x77\x73" "\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00\x02\x4c" "\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54" "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00"; uint32_t smblen = sizeof(smbbuf) - 1; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_EOF, smbbuf, smblen); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) { printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type); goto end; } if (smb_state->nbss.length != 133) { printf("expected nbss length 0x%02x , got 0x%02x : ", 133, smb_state->nbss.length); goto end; } if (smb_state->smb.command != SMB_COM_NEGOTIATE) { printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_NEGOTIATE, smb_state->smb.command); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test SMBParserTest02 tests the NBSS, SMB, and DCERPC over SMB header decoding */ int SMBParserTest02(void) { int result = 0; Flow f; uint8_t smbbuf[] = { 0x00, 0x00, 0x00, 0x92, 0xff, 0x53, 0x4d, 0x42, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x64, 0x05, 0x00, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x48, 0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4a, 0x00, 0x48, 0x00, 0x4a, 0x00, 0x02, 0x00, 0x26, 0x00, 0x00, 0x40, 0x4f, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x40, 0xfd, 0x2c, 0x34, 0x6c, 0x3c, 0xce, 0x11, 0xa8, 0x93, 0x08, 0x00, 0x2b, 0x2e, 0x9c, 0x6d, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t smblen = sizeof(smbbuf); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_EOF, smbbuf, smblen); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->nbss.type != NBSS_SESSION_MESSAGE) { printf("expected nbss type 0x%02x , got 0x%02x : ", NBSS_SESSION_MESSAGE, smb_state->nbss.type); goto end; } if (smb_state->nbss.length != 146) { printf("expected nbss length 0x%02x , got 0x%02x : ", 146, smb_state->nbss.length); goto end; } if (smb_state->smb.command != SMB_COM_TRANSACTION) { printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_TRANSACTION, smb_state->smb.command); goto end; } printUUID("BIND", smb_state->dcerpc.dcerpcbindbindack.uuid_entry); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int SMBParserTest03(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { 0x00, 0x00, 0x07, 0x57, 0xff, 0x53, 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7f, 0x13, 0x01, 0x08, 0xc9, 0x29, 0x0e, 0xff, 0x00, 0x00, 0x00, 0x00, 0x40, 0x55, 0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x08, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x0e, 0x00, 0x49, 0x07, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xcc, 0x1b, 0x19, 0xb8, 0x75, 0x2c, 0x85, 0x52, 0x39, 0x72, 0xfa, 0x9c, 0x5f, 0x5a, 0xb7, 0x59, 0xa1, 0x83, 0xba, 0x87, 0xd3, 0xc3, 0xbf, 0xf4, 0x5d, 0x08, 0x32, 0x22, 0x33, 0x2e, 0x62, 0x46, 0x4d, 0x03, 0x48, 0x1f, 0xea, 0x7c, 0x65, 0x3e, 0x71, 0xf8, 0xea, 0x20, 0x85, 0x29, 0x6f, 0x3c, 0xf2, 0x19, 0xb5, 0x65, 0xb0, 0xce, 0x06, 0xcc, 0x90, 0x86, 0x20, 0x77, 0xf5, 0xa0, 0xbc, 0x45, 0x9d, 0x4e, 0x92, 0xb4, 0x24, 0xc8, 0x58, 0x4a, 0xc3, 0x4e, 0xb8, 0x95, 0x8d, 0x93, 0x0c, 0xce, 0xe0, 0xf9, 0x7d, 0x7e, 0xd3, 0x46, 0x53, 0x32, 0x95, 0x7d, 0x22, 0x76, 0x0e, 0x95, 0x23, 0x2e, 0xa6, 0x58, 0x1a, 0xb6, 0x74, 0x54, 0x4f, 0x37, 0x5c, 0x60, 0x00, 0xb4, 0x55, 0x5b, 0xda, 0xea, 0x2c, 0xf3, 0x9b, 0x91, 0x6f, 0xa8, 0x20, 0xd3, 0x40, 0x0c, 0x7c, 0xc7, 0x85, 0x8c, 0x44, 0x76, 0xbc, 0x22, 0x9d, 0xfd, 0x8e, 0x21, 0x46, 0x05, 0x41, 0x73, 0x0c, 0x88, 0x62, 0xdc, 0x62, 0xc1, 0xc8, 0x14, 0xbb, 0x96, 0x60, 0x77, 0x6c, 0x5c, 0x31, 0x2a, 0xaa, 0x87, 0x69, 0x99, 0xaa, 0x83, 0x5e, 0x71, 0x11, 0x2a, 0x85, 0xca, 0x5d, 0xe1, 0x67, 0x4f, 0xa2, 0x3e, 0x4e, 0x94, 0xe7, 0xa3, 0xe6, 0xa0, 0xdb, 0xc2, 0x05, 0x01, 0x4f, 0xf5, 0xe9, 0xfc, 0xa2, 0x2a, 0x1c, 0x63, 0x21, 0xd5, 0x27, 0x98, 0x86, 0x9c, 0x66, 0x5e, 0xf1, 0x97, 0xb0, 0x86, 0x58, 0x5b, 0x94, 0x51, 0xfd, 0xb9, 0x83, 0x4c, 0xc4, 0x0f, 0x5f, 0xdd, 0xc8, 0xce, 0x43, 0xed, 0xe8, 0xae, 0xbc, 0x52, 0x73, 0xf6, 0x0f, 0x0d, 0xb4, 0xd6, 0xa7, 0xcf, 0xef, 0x0e, 0x72, 0x34, 0xff, 0x2b, 0x50, 0x71, 0x2a, 0x98, 0xf0, 0x60, 0x58, 0xde, 0x1d, 0x96, 0x50, 0xd8, 0xec, 0xeb, 0x40, 0xcb, 0x4c, 0x3b, 0x2c, 0xee, 0x76, 0xd6, 0x97, 0x1c, 0x69, 0x61, 0x89, 0xc1, 0x9b, 0x03, 0xda, 0x08, 0x0b, 0x15, 0xba, 0xd3, 0x3d, 0x8c, 0xea, 0xf7, 0x17, 0xc3, 0x77, 0xf8, 0x04, 0xca, 0x72, 0xed, 0xfe, 0xd0, 0x02, 0x73, 0x1b, 0x71, 0x72, 0x17, 0x9f, 0x14, 0x96, 0xe2, 0x5f, 0xae, 0x5b, 0x7d, 0x7f, 0xc9, 0x72, 0x9f, 0xd5, 0x32, 0xf4, 0xf3, 0x39, 0x89, 0x36, 0x00, 0x44, 0xa9, 0x18, 0x21, 0x4b, 0x26, 0xf2, 0x5a, 0x2a, 0x80, 0xea, 0x6b, 0x3e, 0x68, 0x27, 0xd0, 0xa0, 0x84, 0x81, 0xb5, 0xa6, 0x3b, 0xd5, 0xdc, 0xdd, 0xd1, 0xd4, 0x5b, 0xad, 0x80, 0x91, 0xf2, 0x30, 0x5e, 0x90, 0x17, 0x35, 0x59, 0xad, 0x34, 0x65, 0x54, 0x04, 0x5a, 0x3c, 0xe4, 0x68, 0xa7, 0x30, 0x06, 0x7a, 0x85, 0xe7, 0xf4, 0x20, 0xe3, 0xd7, 0xa5, 0x8b, 0x60, 0xfe, 0x51, 0xad, 0xda, 0xe2, 0xd1, 0x4f, 0xfb, 0x94, 0xc9, 0xba, 0xa4, 0x09, 0x5c, 0xde, 0x78, 0xdc, 0x78, 0x36, 0x96, 0x8b, 0xd6, 0x72, 0xc4, 0xa7, 0x1c, 0xde, 0x45, 0x85, 0xdf, 0x84, 0xb1, 0x3f, 0x2b, 0x3f, 0xfe, 0x56, 0x80, 0x8d, 0x26, 0x4a, 0x39, 0x22, 0x1f, 0x10, 0x89, 0x2e, 0x4e, 0x87, 0xf5, 0x9c, 0x0e, 0xd9, 0xdd, 0xb2, 0xc9, 0x9c, 0x3f, 0xc5, 0xe3, 0xab, 0xdc, 0x85, 0x1c, 0xf9, 0xda, 0xbb, 0x36, 0x9b, 0xe7, 0x21, 0x58, 0x44, 0xee, 0xb3, 0xe7, 0x37, 0xd3, 0xc3, 0x76, 0x09, 0x79, 0xe2, 0xf4, 0xf1, 0x27, 0x6b, 0x74, 0xc4, 0x5f, 0x06, 0x76, 0x78, 0x56, 0xb9, 0x80, 0x7f, 0x63, 0x53, 0xa2, 0xd1, 0xfc, 0xfb, 0x69, 0x38, 0x0c, 0x13, 0x6e, 0x9e, 0xea, 0x79, 0xc9, 0x6d, 0x45, 0x6b, 0xa3, 0xa8, 0x20, 0x21, 0x24, 0xff, 0x0d, 0x8d, 0xd9, 0x0a, 0x9e, 0xf4, 0x3f, 0xf5, 0x18, 0x39, 0xdd, 0x9f, 0xed, 0xd6, 0x2b, 0xb1, 0x4b, 0x3f, 0x24, 0x7e, 0x11, 0x79, 0x37, 0x01, 0x10, 0xe7, 0x34, 0x1d, 0x36, 0x5f, 0x26, 0x99, 0x5a, 0x4d, 0xe9, 0x1a, 0x89, 0x24, 0xf8, 0xea, 0xca, 0x16, 0x19, 0x6c, 0x3b, 0x8e, 0x44, 0x70, 0x20, 0x5f, 0x46, 0x3c, 0x60, 0xbe, 0x03, 0xfc, 0x99, 0x29, 0xd7, 0x30, 0x5e, 0xbe, 0x5b, 0x17, 0x4f, 0xfe, 0x3f, 0xe0, 0x50, 0xa0, 0x1b, 0x1a, 0x6b, 0x17, 0xf3, 0xf9, 0x01, 0xe8, 0xc6, 0xc8, 0x0f, 0x81, 0xbd, 0x2d, 0xc5, 0x8c, 0xa1, 0xab, 0x9d, 0x13, 0xce, 0x73, 0x14, 0x56, 0x56, 0xb4, 0x68, 0xac, 0x35, 0xf8, 0x6a, 0x55, 0x3e, 0x50, 0x34, 0x5a, 0x66, 0x17, 0x98, 0x4d, 0xd1, 0xa7, 0xdf, 0x57, 0xd6, 0xd4, 0x44, 0x64, 0xa7, 0x74, 0x18, 0x0a, 0x4f, 0xa9, 0xe4, 0xb4, 0x0f, 0x89, 0xa2, 0xc5, 0xb8, 0xa7, 0x20, 0xa2, 0xb1, 0xf8, 0x70, 0xaf, 0xee, 0x6e, 0x62, 0xa5, 0x89, 0x5d, 0xc9, 0x8a, 0xb9, 0x87, 0xac, 0x4d, 0x4d, 0x81, 0x1c, 0x62, 0xd3, 0xbf, 0x83, 0x79, 0x98, 0x81, 0xbd, 0xcc, 0x1f, 0x76, 0xc8, 0x7e, 0x2c, 0xec, 0xdb, 0xa7, 0xa5, 0xea, 0x05, 0x94, 0x3f, 0xef, 0x66, 0x1c, 0x5d, 0xc4, 0xbd, 0x73, 0x53, 0x1f, 0xf3, 0xac, 0x1f, 0xa4, 0xb9, 0x78, 0x1b, 0x93, 0xcb, 0x17, 0xb6, 0xda, 0xbb, 0x45, 0x21, 0xfa, 0x52, 0xc7, 0x71, 0x05, 0xb3, 0xeb, 0x82, 0x09, 0x99, 0x90, 0x5d, 0xa9, 0x76, 0xd1, 0x63, 0x6a, 0x14, 0x99, 0xe9, 0xa5, 0x98, 0x5d, 0xe0, 0xb5, 0x2a, 0xd1, 0xf1, 0x2e, 0xe7, 0x85, 0xdb, 0x42, 0xfc, 0x61, 0x09, 0x14, 0xe5, 0x8e, 0x92, 0x70, 0x91, 0x15, 0x74, 0x2c, 0x16, 0x30, 0xc4, 0xb0, 0xf1, 0x61, 0xd5, 0x55, 0xa8, 0xa3, 0xca, 0x88, 0xe6, 0xb1, 0x58, 0x76, 0xa5, 0x4c, 0x48, 0xe3, 0xdd, 0x7a, 0x5e, 0x0a, 0x86, 0xfd, 0xd6, 0xe8, 0xc0, 0x47, 0x27, 0x1a, 0x58, 0x92, 0xad, 0xa6, 0x51, 0x32, 0x4d, 0x0d, 0x29, 0xd3, 0xcf, 0xf1, 0xcc, 0x29, 0x1a, 0xfe, 0xf6, 0xa0, 0xf3, 0xdd, 0x98, 0x73, 0xcb, 0xbb, 0x8a, 0xe9, 0x55, 0xba, 0x89, 0x2d, 0x31, 0x9b, 0x3d, 0x04, 0x1f, 0xb5, 0x1c, 0x84, 0x63, 0xca, 0xde, 0x75, 0xac, 0x91, 0x78, 0x1f, 0x8b, 0x37, 0x8d, 0x46, 0xaa, 0x79, 0x51, 0xbf, 0x30, 0xfa, 0x3d, 0x9b, 0xd9, 0x20, 0x25, 0x18, 0x46, 0xb6, 0xe7, 0x8e, 0xf7, 0x5e, 0x7d, 0xf8, 0xd3, 0x01, 0x39, 0xe5, 0x9d, 0x46, 0x6b, 0x8c, 0xcf, 0x9d, 0xc6, 0xb9, 0xe8, 0xd8, 0x25, 0x2d, 0x96, 0x07, 0xc7, 0x4e, 0xa3, 0x3a, 0x9a, 0xbc, 0x9d, 0x80, 0xa6, 0x5d, 0xb1, 0xc0, 0x3e, 0x81, 0xe0, 0x52, 0x8f, 0x9a, 0x1a, 0xc2, 0xdb, 0x9f, 0x91, 0x85, 0x56, 0xdb, 0xb8, 0x69, 0x10, 0x35, 0xe4, 0xc4, 0xaf, 0xb6, 0x13, 0xf8, 0x86, 0xe1, 0x2d, 0x3c, 0xf8, 0x94, 0x60, 0xb7, 0xa1, 0xde, 0x25, 0x51, 0x7d, 0xff, 0xff, 0xa6, 0x23, 0x68, 0x28, 0x1f, 0x79, 0x33, 0x60, 0x86, 0xe9, 0x2c, 0x3a, 0xb9, 0x3c, 0x70, 0xb3, 0xe0, 0x4c, 0x8c, 0x7e, 0x06, 0xdf, 0x4d, 0xf6, 0x88, 0xda, 0x9e, 0x4f, 0x5b, 0xd2, 0x2e, 0x28, 0xb8, 0xe0, 0x27, 0x7a, 0x43, 0xfb, 0x23, 0x4b, 0x8a, 0xd9, 0x4f, 0x29, 0x53, 0x5d, 0x75, 0xc6, 0xfc }; uint8_t smbbuf2[] = { 0x0a, 0x30, 0xe0, 0x74, 0x3c, 0x23, 0xc3, 0x11, 0x95, 0x25, 0x04, 0xe4, 0x2d, 0x7b, 0x29, 0xa1, 0x75, 0x69, 0x3f, 0x49, 0x9c, 0xfa, 0x66, 0x78, 0x3c, 0xf1, 0xab, 0xee, 0xab, 0x9a, 0x75, 0x63, 0x54, 0x80, 0x2b, 0x5c, 0x07, 0xf7, 0xec, 0x72, 0xfb, 0xd0, 0x52, 0x5e, 0x7e, 0x99, 0xf5, 0x3b, 0xc4, 0x77, 0x96, 0x12, 0xb8, 0x36, 0xb2, 0xcf, 0xab, 0xf5, 0xd3, 0xf3, 0x19, 0x77, 0xbb, 0x03, 0xdb, 0xf7, 0x4d, 0x81, 0xe3, 0xe8, 0x6c, 0x23, 0x02, 0xe0, 0xcf, 0x24, 0xc1, 0xd5, 0x3d, 0x42, 0xa4, 0xbc, 0x97, 0xf4, 0x83, 0xee, 0xff, 0x85, 0x2c, 0xfd, 0xdd, 0xdc, 0x23, 0x1c, 0x87, 0x0c, 0xe4, 0xd5, 0xfc, 0xc3, 0x8b, 0x10, 0xa5, 0x42, 0x0f, 0x14, 0xd1, 0x89, 0xa6, 0xaf, 0xaa, 0x77, 0xfc, 0x3b, 0xce, 0x6c, 0xbe, 0x62, 0xc9, 0xdd, 0x16, 0xc6, 0x14, 0xc2, 0xa6, 0x13, 0x12, 0xfa, 0x5a, 0x8b, 0x05, 0x88, 0x06, 0xf9, 0xef, 0x9c, 0xce, 0xf7, 0x27, 0x46, 0x1d, 0x50, 0xe2, 0xeb, 0x49, 0xb2, 0xb1, 0x7c, 0x6b, 0xaf, 0xe9, 0xc7, 0xdd, 0x59, 0x8c, 0xda, 0x32, 0x55, 0xb5, 0xfe, 0xdc, 0xe0, 0x47, 0xf4, 0xa0, 0xe7, 0xaa, 0x47, 0x49, 0xdf, 0xcf, 0x9c, 0xd6, 0xfa, 0xd2, 0xca, 0x55, 0xa7, 0x3f, 0x62, 0x14, 0x6c, 0xc8, 0x7f, 0xad, 0x7c, 0xb1, 0x70, 0x88, 0xb3, 0x51, 0x13, 0x2c, 0x3b, 0x78, 0x1d, 0xa2, 0x5e, 0xf7, 0x83, 0x62, 0x6a, 0x51, 0xbd, 0xe9, 0x77, 0x62, 0xc6, 0x06, 0x06, 0x51, 0x9d, 0x03, 0x95, 0x51, 0x7c, 0xd3, 0x73, 0x50, 0x9b, 0x36, 0x5a, 0x28, 0x52, 0xc0, 0x05, 0xee, 0xd5, 0x2d, 0xd5, 0x77, 0x52, 0xab, 0x7c, 0x4a, 0x4c, 0x7e, 0xf6, 0xba, 0x52, 0xc5, 0x4d, 0xb5, 0x74, 0x83, 0x77, 0x5f, 0xaa, 0xba, 0x86, 0x94, 0xd2, 0x19, 0xca, 0xef, 0xc9, 0x6e, 0x5b, 0x50, 0xee, 0x2c, 0xdd, 0x67, 0xc8, 0xfd, 0xc3, 0xa4, 0x80, 0x63, 0x1d, 0xa2, 0x07, 0x1e, 0x1a, 0x9d, 0x70, 0xe4, 0xab, 0x34, 0x7a, 0xfb, 0x08, 0x82, 0x85, 0xec, 0x2d, 0x25, 0x3e, 0x70, 0x22, 0x6e, 0x9d, 0x0f, 0xed, 0x60, 0x8f, 0xc5, 0x06, 0x66, 0x42, 0x95, 0xcc, 0x77, 0xbe, 0x4d, 0x19, 0x7c, 0xd1, 0x31, 0x26, 0xfb, 0x52, 0xad, 0xbd, 0x19, 0x1d, 0x68, 0x56, 0x2c, 0xb9, 0x5b, 0xaa, 0x92, 0x48, 0xcf, 0xdf, 0x65, 0x2d, 0xdb, 0x87, 0x06, 0xbe, 0x51, 0x61, 0x6b, 0xf6, 0x87, 0xdc, 0xbb, 0xa5, 0x48, 0x81, 0xaf, 0xd7, 0xfc, 0x15, 0xf7, 0x41, 0xde, 0xe3, 0xe9, 0xd4, 0xad, 0x5d, 0x64, 0x8f, 0x13, 0x68, 0xe5, 0x2b, 0x4d, 0x87, 0x59, 0x7e, 0xcb, 0x2b, 0xbf, 0xbc, 0xaa, 0xd2, 0xc7, 0x60, 0xef, 0xe1, 0x25, 0xe2, 0x89, 0xb4, 0x78, 0x24, 0x52, 0xb4, 0x54, 0xe3, 0xf0, 0xe5, 0x81, 0xba, 0xe3, 0x00, 0x62, 0x09, 0x8a, 0x19, 0x7b, 0x9b, 0x0f, 0x50, 0x91, 0xa7, 0x80, 0xdb, 0x0e, 0x68, 0xe1, 0x22, 0x54, 0x89, 0x07, 0xc7, 0x39, 0x38, 0xca, 0xae, 0xbf, 0x5b, 0xbb, 0xe4, 0x70, 0x28, 0xc5, 0x18, 0x98, 0xea }; uint8_t smbbuf3[] = { 0x39, 0x99, 0x97, 0x1f, 0xf1, 0x6a, 0x72, 0x0d, 0x35, 0xd5, 0x33, 0x42, 0x5a, 0x9f, 0xea, 0x0f, 0x6f, 0x3b, 0xc7, 0xb9, 0xd3, 0x04, 0xdf, 0x44, 0x45, 0xc7, 0xc6, 0x06, 0x0b, 0x77, 0x8e, 0x8e, 0x9a, 0x3c, 0xa4, 0x15, 0x85, 0x80, 0xce, 0xd0, 0x8c, 0x54, 0x60, 0xf9, 0x1f, 0xb3, 0x3e, 0xed, 0x21, 0x3e, 0xfa, 0x30, 0xf4, 0x50, 0x2b, 0x00, 0x00, 0xea, 0xd1, 0xb3, 0xd2, 0x7e, 0x6c, 0x14, 0xe5, 0xf0, 0xf4, 0x9c, 0xb4, 0x2e, 0x32, 0x41, 0x20, 0x2a, 0x18, 0x78, 0x1a, 0xed, 0x04, 0x94, 0x83, 0xd1, 0x87, 0x39, 0xf6, 0xcb, 0xf4, 0xc1, 0xc7, 0xe0, 0x50, 0x87, 0x65, 0x4f, 0x36, 0x73, 0x70, 0xf5, 0x0a, 0xaa, 0x2b, 0x28, 0xad, 0x05, 0x28, 0x8d, 0x3b, 0x42, 0xfb, 0xe2, 0xd3, 0xb8, 0x82, 0x71, 0x25, 0xcd, 0xa2, 0xf2, 0x4b, 0x62, 0xeb, 0x14, 0x3b, 0x81, 0xaf, 0xd4, 0x68, 0x5a, 0xae, 0x8e, 0x10, 0x9a, 0x17, 0x4c, 0xf1, 0x3d, 0x43, 0xb9, 0xd2, 0xd5, 0x86, 0xee, 0x3a, 0xf3, 0xe5, 0x41, 0xe5, 0x52, 0xda, 0x61, 0xf3, 0x20, 0x30, 0x5b, 0xe5, 0x1f, 0xe2, 0x4e, 0x9d, 0xd6, 0xd6, 0x2e, 0x2a, 0x63, 0xbc, 0xf6, 0xb9, 0xc2, 0xec, 0xd0, 0xe9, 0xfd, 0x07, 0xfb, 0x2d, 0x8e, 0xbc, 0x43, 0xcb, 0x7e, 0x55, 0x63, 0x9f, 0xb6, 0xf8, 0x8b, 0x4c, 0xcd, 0x4b, 0x28, 0x47, 0x56, 0xc9, 0xd2, 0xfe, 0x0e, 0x63, 0x11, 0x09, 0xd9, 0xd9, 0x97, 0x0a, 0x5a, 0x21, 0xad, 0xdb, 0x53, 0x24, 0xee, 0x62, 0x4a, 0xaa, 0x49, 0x14, 0xdf, 0xc0, 0x61, 0x85, 0x11, 0x57, 0x6e, 0x3b, 0x8c, 0x37, 0x24, 0x13, 0xde, 0xc7, 0xf3, 0x44, 0x54, 0x8a, 0x69, 0x78, 0x0c, 0xf3, 0xd1, 0xcd, 0xc5, 0xad, 0x45, 0xc6, 0x06, 0x56, 0x0b, 0x53, 0x40, 0x79, 0x12, 0x90, 0x6b, 0xdf, 0xc5, 0x80, 0xde, 0x9c, 0x8e, 0xe1, 0x73, 0xdc, 0x92, 0xc2, 0xf1, 0xeb, 0xd9, 0x66, 0x0a, 0x12, 0xd2, 0x3f, 0x04, 0x03, 0xaa, 0x6f, 0xd0, 0x90, 0xfa, 0xb0, 0x6b, 0x7d, 0xfc, 0x76, 0xf9, 0xe3, 0xa2, 0x17, 0x28, 0x4e, 0x9d, 0x2d, 0xa6, 0x7e, 0xfa, 0x19, 0x91, 0xeb, 0xe5, 0xe4, 0xca, 0x09, 0x77, 0xfe, 0xc0, 0x1c, 0xaa, 0xc4, 0x7c, 0xc2, 0x6a, 0x0e, 0xf3, 0x4e, 0x79, 0x9b, 0x82, 0x2a, 0x4b, 0xd3, 0x35, 0x1d, 0x92, 0x6c, 0x3f, 0x85, 0x57, 0x5a, 0x16, 0xa1, 0x0d, 0xc7, 0x64, 0xb8, 0x46, 0x73, 0xbf, 0x91, 0x5f, 0x10, 0x2a, 0x2b, 0x51, 0x49, 0xe1, 0xea, 0xda, 0x2f, 0x41, 0x7b, 0x96, 0xa3, 0xd2, 0x7b, 0x72, 0xc0, 0x88, 0x84, 0xcb, 0xe0, 0xb7, 0xae, 0x74, 0xc9, 0x78, 0x82, 0x47, 0xf3, 0x19, 0x21, 0x53, 0xe6, 0xe1, 0x67, 0xbb, 0x39, 0x05, 0x6e, 0x1c, 0x38, 0x33, 0x10, 0x60, 0x24, 0x48, 0xb2, 0x7a, 0xb9, 0x4e, 0x8d, 0x36, 0xcf, 0xce, 0xf6, 0x31, 0x3b, 0xa3, 0x18, 0x78, 0x49, 0x91, 0xef, 0xed, 0x86, 0x2c, 0x98, 0x00, 0x18, 0x49, 0x73, 0xb8, 0xe5, 0x2f, 0xc1, 0x58, 0xe0, 0x47, 0x2b, 0x16, 0x41, 0xc3, 0x41, 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0xb0, 0x02, 0x00, 0x00, 0x00, 0x00 }; uint32_t smblen1 = sizeof(smbbuf1); uint32_t smblen2 = sizeof(smbbuf2); uint32_t smblen3 = sizeof(smbbuf3); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->smb.command != SMB_COM_WRITE_ANDX) { printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_WRITE_ANDX, smb_state->smb.command); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf2, smblen2); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf3, smblen3); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); printUUID("BIND", smb_state->dcerpc.dcerpcbindbindack.uuid_entry); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int SMBParserTest04(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { 0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, 0x00, 0x08, 0x00, 0x00, 0x0e, 0xff, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00, 0x08, 0x00, 0x48, 0x00, 0x00, 0x00, 0x48, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0x00, 0xab, 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x16, 0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x78, 0x56, 0x34, 0x12, 0x34, 0x12, 0xcd, 0xab, 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0x01, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint8_t smbbuf2[] = { 0x00, 0x00, 0x00, 0x2f, 0xff, 0x53, 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x98, 0x07, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, 0x00, 0x08, 0x00, 0x00, 0x06, 0xff, 0x00, 0x2f, 0x00, 0x48, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; uint8_t smbbuf3[] = { 0x00, 0x00, 0x00, 0x3b, 0xff, 0x53, 0x4d, 0x42, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, 0x00, 0x08, 0x00, 0x00, 0x0c, 0xff, 0x00, 0xde, 0xde, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x04, 0xff, 0xff, 0xff, 0xff, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; uint8_t smbbuf4[] = { 0x00, 0x00, 0x00, 0x80, 0xff, 0x53, 0x4d, 0x42, 0x2e, 0x00, 0x00, 0x00, 0x00, 0x98, 0x03, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x7c, 0x05, 0x00, 0x08, 0x00, 0x00, 0x0c, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x45, 0x00, 0x00, 0x05, 0x00, 0x0c, 0x03, 0x10, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10, 0x5d, 0xe0, 0x00, 0x00, 0x0e, 0x00, 0x5c, 0x70, 0x69, 0x70, 0x65, 0x5c, 0x73, 0x70, 0x6f, 0x6f, 0x6c, 0x73, 0x73, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00 }; uint32_t smblen1 = sizeof(smbbuf1); uint32_t smblen2 = sizeof(smbbuf2); uint32_t smblen3 = sizeof(smbbuf3); uint32_t smblen4 = sizeof(smbbuf4); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->smb.command != SMB_COM_WRITE_ANDX) { printf("expected SMB command 0x%02x , got 0x%02x : ", SMB_COM_WRITE_ANDX, smb_state->smb.command); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf2, smblen2); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf3, smblen3); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf4, smblen4); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int SMBParserTest05(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t smbbuf1[] = { /* session request */ 0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, 0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 }; uint32_t smblen1 = sizeof(smbbuf1); uint8_t smbbuf2[] = { /* session request */ 0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, 0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, 0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, 0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00, /* session message */ 0x00, 0x00, 0x00, 0x60, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x2d, 0x00, 0x00, 0xdd, 0xca, 0x00, 0x3d, 0x00, 0x02, 0x4d, 0x45, 0x54, 0x41, 0x53, 0x50, 0x4c, 0x4f, 0x49, 0x54, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 }; uint32_t smblen2 = sizeof(smbbuf2); int result = 0; AppProto alproto; Flow f; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0, sizeof(f)); f.dp = 139; /** SMB */ AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER); /** SMB2 */ AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "139", ALPROTO_SMB, SMB_PROBING_PARSER_MIN_DEPTH, 0, STREAM_TOSERVER, SMBProbingParser, NULL); AppLayerProtoDetectPrepareState(); alpd_tctx = AppLayerProtoDetectGetCtxThread(); alproto = AppLayerProtoDetectGetProto(alpd_tctx, &f, smbbuf1, smblen1, IPPROTO_TCP, STREAM_TOSERVER); if (alproto != ALPROTO_UNKNOWN) { printf("alproto is %"PRIu16 ". Should be ALPROTO_UNKNOWN\n", alproto); goto end; } alproto = AppLayerProtoDetectGetProto(alpd_tctx, &f, smbbuf2, smblen2, IPPROTO_TCP, STREAM_TOSERVER); if (alproto != ALPROTO_SMB) { printf("alproto is %"PRIu16 ". Should be ALPROTO_SMB\n", alproto); goto end; } result = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); FLOW_DESTROY(&f); return result; } int SMBParserTest06(void) { AppLayerProtoDetectUnittestCtxBackup(); AppLayerProtoDetectSetup(); uint8_t smbbuf1[] = { /* session request */ 0x83, 0x00, 0x00, 0x01, 0x82 }; uint32_t smblen1 = sizeof(smbbuf1); uint8_t smbbuf2[] = { /* session request */ 0x83, 0x00, 0x00, 0x01, 0x82, /* session message */ 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfd, 0xe3, 0x00, 0x80, 0xb8, 0xcb, 0x22, 0x5f, 0xfd, 0xeb, 0xc3, 0x01, 0x68, 0x01, 0x00, 0x10, 0x00, 0x50, 0xb5, 0xc3, 0x62, 0x59, 0x02, 0xd1, 0x4d, 0x99, 0x6d, 0x85, 0x7d, 0xfa, 0x93, 0x2d, 0xbb }; uint32_t smblen2 = sizeof(smbbuf2); int result = 0; AppProto alproto; Flow f; AppLayerProtoDetectThreadCtx *alpd_tctx; memset(&f, 0, sizeof(f)); f.dp = 139; /** SMB */ AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER); /** SMB2 */ AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT); AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER); AppLayerProtoDetectPPRegister(IPPROTO_TCP, "139", ALPROTO_SMB, SMB_PROBING_PARSER_MIN_DEPTH, 0, STREAM_TOSERVER, SMBProbingParser, NULL); AppLayerProtoDetectPrepareState(); alpd_tctx = AppLayerProtoDetectGetCtxThread(); alproto = AppLayerProtoDetectGetProto(alpd_tctx, &f, smbbuf1, smblen1, IPPROTO_TCP, STREAM_TOSERVER); if (alproto != ALPROTO_UNKNOWN) { printf("alproto is %"PRIu16 ". Should be ALPROTO_UNKNOWN\n", alproto); goto end; } alproto = AppLayerProtoDetectGetProto(alpd_tctx, &f, smbbuf2, smblen2, IPPROTO_TCP, STREAM_TOSERVER); if (alproto != ALPROTO_SMB) { printf("alproto is %"PRIu16 ". Should be ALPROTO_SMB\n", alproto); goto end; } result = 1; end: AppLayerProtoDetectDeSetup(); AppLayerProtoDetectUnittestCtxRestore(); if (alpd_tctx != NULL) AppLayerProtoDetectDestroyCtxThread(alpd_tctx); FLOW_DESTROY(&f); return result; } int SMBParserTest07(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { /* negative session response */ 0x83, 0x00, 0x00, 0x01, 0x82 }; uint32_t smblen1 = sizeof(smbbuf1); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->smb.command != 0) { printf("we shouldn't have any smb state as yet\n"); goto end; } if (smb_state->nbss.length != 1 || smb_state->nbss.type != NBSS_NEGATIVE_SESSION_RESPONSE) { printf("something wrong with nbss parsing\n"); goto end; } if (smb_state->bytesprocessed != 0) { printf("smb parser bytesprocessed should be 0, but it is not\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int SMBParserTest08(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { /* positive session response */ 0x82, 0x00, 0x00, 0x00 }; uint8_t smbbuf2[] = { /* negotiate protocol */ 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, 0x0a, 0x00, 0x01, 0x00, 0x04, 0x11, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfd, 0xe3, 0x00, 0x80, 0x40, 0x8a, 0x57, 0x5c, 0xfd, 0xeb, 0xc3, 0x01, 0x68, 0x01, 0x00, 0x10, 0x00, 0x50, 0xb5, 0xc3, 0x62, 0x59, 0x02, 0xd1, 0x4d, 0x99, 0x6d, 0x85, 0x7d, 0xfa, 0x93, 0x2d, 0xbb }; uint32_t smblen1 = sizeof(smbbuf1); uint32_t smblen2 = sizeof(smbbuf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->smb.command != 0) { printf("we shouldn't have any smb state as yet\n"); goto end; } if (smb_state->nbss.length != 0 || smb_state->nbss.type != NBSS_POSITIVE_SESSION_RESPONSE) { printf("something wrong with nbss parsing\n"); goto end; } if (smb_state->bytesprocessed != 0) { printf("smb parser bytesprocessed should be 0, but it is not\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT, smbbuf2, smblen2); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smb_state->smb.command != SMB_COM_NEGOTIATE) { printf("we should expect SMB command 0x%02x , got 0x%02x : ", SMB_COM_NEGOTIATE, smb_state->smb.command); goto end; } if (smb_state->nbss.length != 85 || smb_state->nbss.type != NBSS_SESSION_MESSAGE) { printf("something wrong with nbss parsing\n"); goto end; } if (smb_state->bytesprocessed != 0) { printf("smb parser bytesprocessed should be 0, but it is not\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } int SMBParserTest09(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { /* session request */ 0x81, 0x00, 0x00, 0x44, 0x20, 0x45, 0x44, 0x45, 0x4a, 0x46, 0x44, 0x45, 0x44, 0x45, 0x50, 0x43, 0x4e, 0x46, 0x48, 0x44, 0x43, 0x45, 0x4c, 0x43, 0x4e, 0x46, 0x43, 0x46, 0x45, 0x45, 0x4e, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x45, 0x44, 0x45, 0x4a, 0x46, 0x44, 0x45, 0x44, 0x45, 0x50, 0x43, 0x4e, 0x46, 0x49, 0x46, 0x41, 0x43, 0x4e, 0x46, 0x43, 0x46, 0x45, 0x45, 0x4e, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 }; uint8_t smbbuf2[] = { /* session service - negotiate protocol */ 0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, 0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 }; uint32_t smblen1 = sizeof(smbbuf1); uint32_t smblen2 = sizeof(smbbuf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->smb.command != 0) { printf("we shouldn't have any smb state as yet\n"); goto end; } if (smb_state->nbss.length != 68 || smb_state->nbss.type != NBSS_SESSION_REQUEST) { printf("something wrong with nbss parsing\n"); goto end; } if (smb_state->bytesprocessed != 0) { printf("smb parser bytesprocessed should be 0, but it is not\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER, smbbuf2, smblen2); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); if (smb_state->smb.command != SMB_COM_NEGOTIATE) { printf("we should expect SMB command 0x%02x , got 0x%02x : ", SMB_COM_NEGOTIATE, smb_state->smb.command); goto end; } if (smb_state->nbss.length != 133 || smb_state->nbss.type != NBSS_SESSION_MESSAGE) { printf("something wrong with nbss parsing\n"); goto end; } if (smb_state->bytesprocessed != 0) { printf("smb parser bytesprocessed should be 0, but it is not\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } /** * \test Test to temporarily to show the direction demaraction issue in the * smb parser. */ int SMBParserTest10(void) { int result = 0; Flow f; uint8_t smbbuf1[] = { /* partial request */ 0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52, 0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57, 0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41, }; //0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54, //0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, //0x00 uint8_t smbbuf2[] = { /* response */ 0x00, 0x00, 0x00, 0x55, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x98, 0x53, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x11, 0x05, 0x00, 0x03, 0x32, 0x00, 0x01, 0x00, 0x04, 0x41, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfd, 0xf3, 0x00, 0x80, 0x20, 0x03, 0x1a, 0x2d, 0x77, 0x98, 0xc5, 0x01, 0xa4, 0x01, 0x00, 0x10, 0x00, 0xb7, 0xeb, 0x0b, 0x05, 0x21, 0x22, 0x50, 0x42, 0x8c, 0x38, 0x2a, 0x7f, 0xc5, 0x6a, 0x7c, 0x0c }; uint32_t smblen1 = sizeof(smbbuf1); uint32_t smblen2 = sizeof(smbbuf2); TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int r = 0; memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOSERVER | STREAM_START, smbbuf1, smblen1); if (r != 0) { printf("smb header check returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SMBState *smb_state = f.alstate; if (smb_state == NULL) { printf("no smb state: "); goto end; } if (smb_state->bytesprocessed == 0) { printf("request - smb parser bytesprocessed should not be 0.\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMB, STREAM_TOCLIENT, smbbuf2, smblen2); if (r == 0) { printf("smb parser didn't return fail\n"); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } #endif void SMBParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SMBParserTest01", SMBParserTest01); UtRegisterTest("SMBParserTest02", SMBParserTest02); UtRegisterTest("SMBParserTest03", SMBParserTest03); UtRegisterTest("SMBParserTest04", SMBParserTest04); UtRegisterTest("SMBParserTest05", SMBParserTest05); UtRegisterTest("SMBParserTest06", SMBParserTest06); UtRegisterTest("SMBParserTest07", SMBParserTest07); UtRegisterTest("SMBParserTest08", SMBParserTest08); UtRegisterTest("SMBParserTest09", SMBParserTest09); UtRegisterTest("SMBParserTest10", SMBParserTest10); #endif } suricata-3.2.1/src/alert-prelude.h0000644000000000000000000000171713051004444013725 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * * \file * * \author Pierre Chifflier * \author Yoann Vandoorselaere */ #ifndef __ALERT_PRELUDE_H__ #define __ALERT_PRELUDE_H__ void AlertPreludeRegister(void); #endif /* __ALERT_PRELUDE_H__ */ suricata-3.2.1/src/detect-geoip.c0000644000000000000000000004450613051004444013527 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ignacio Sanchez * * Implements the geoip keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-geoip.h" #include "util-unittest.h" #include "util-unittest-helper.h" #ifndef HAVE_GEOIP static int DetectGeoipSetupNoSupport (DetectEngineCtx *a, Signature *b, char *c) { SCLogError(SC_ERR_NO_GEOIP_SUPPORT, "no GeoIP support built in, needed for geoip keyword"); return -1; } /** * \brief Registration function for geoip keyword (no libgeoip support) * \todo add support for src_only and dst_only */ void DetectGeoipRegister(void) { sigmatch_table[DETECT_GEOIP].name = "geoip"; sigmatch_table[DETECT_GEOIP].Setup = DetectGeoipSetupNoSupport; sigmatch_table[DETECT_GEOIP].Free = NULL; sigmatch_table[DETECT_GEOIP].RegisterTests = NULL; } #else /* HAVE_GEOIP */ #include static int DetectGeoipMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectGeoipSetup(DetectEngineCtx *, Signature *, char *); static void DetectGeoipRegisterTests(void); static void DetectGeoipDataFree(void *); /** * \brief Registration function for geoip keyword * \todo add support for src_only and dst_only */ void DetectGeoipRegister(void) { sigmatch_table[DETECT_GEOIP].name = "geoip"; sigmatch_table[DETECT_GEOIP].Match = DetectGeoipMatch; sigmatch_table[DETECT_GEOIP].Setup = DetectGeoipSetup; sigmatch_table[DETECT_GEOIP].Free = DetectGeoipDataFree; sigmatch_table[DETECT_GEOIP].RegisterTests = DetectGeoipRegisterTests; } /** * \internal * \brief This function is used to initialize the geolocation MaxMind engine * * \retval NULL if the engine couldn't be initialized * \retval (GeoIP *) to the geolocation engine */ static GeoIP *InitGeolocationEngine(void) { return GeoIP_new(GEOIP_MEMORY_CACHE); } /** * \internal * \brief This function is used to geolocate the IP using the MaxMind libraries * * \param ip IP to geolocate (uint32_t ip) * * \retval NULL if it couldn't be geolocated * \retval ptr (const char *) to the country code string */ static const char *GeolocateIPv4(GeoIP *geoengine, uint32_t ip) { if (geoengine != NULL) return GeoIP_country_code_by_ipnum(geoengine, ntohl(ip)); return NULL; } /* Match-on conditions supported */ #define GEOIP_MATCH_SRC_STR "src" #define GEOIP_MATCH_DST_STR "dst" #define GEOIP_MATCH_BOTH_STR "both" #define GEOIP_MATCH_ANY_STR "any" #define GEOIP_MATCH_NO_FLAG 0 #define GEOIP_MATCH_SRC_FLAG 1 #define GEOIP_MATCH_DST_FLAG 2 #define GEOIP_MATCH_ANY_FLAG 3 /* default src and dst*/ #define GEOIP_MATCH_BOTH_FLAG 4 #define GEOIP_MATCH_NEGATED 8 /** * \internal * \brief This function is used to geolocate the IP using the MaxMind libraries * * \param ip IP to geolocate (uint32_t ip) * * \retval 0 no match * \retval 1 match */ static int CheckGeoMatchIPv4(const DetectGeoipData *geoipdata, uint32_t ip) { const char *country; int i; country = GeolocateIPv4(geoipdata->geoengine, ip); /* Check if NOT NEGATED match-on condition */ if ((geoipdata->flags & GEOIP_MATCH_NEGATED) == 0) { for (i = 0; i < geoipdata->nlocations; i++) if (country != NULL && strcmp(country, (char *)geoipdata->location[i])==0) return 1; } else { /* Check if NEGATED match-on condition */ for (i = 0; i < geoipdata->nlocations; i++) if (country != NULL && strcmp(country, (char *)geoipdata->location[i])==0) return 0; /* if one matches, rule does NOT match (negated) */ return 1; /* returns 1 if no location matches (negated) */ } return 0; } /** * \internal * \brief This function is used to match packets with a IPs in an specified country * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectGeoipData * * \retval 0 no match * \retval 1 match */ static int DetectGeoipMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectGeoipData *geoipdata = (const DetectGeoipData *)ctx; int matches = 0; if (PKT_IS_PSEUDOPKT(p)) return 0; if (PKT_IS_IPV4(p)) { if (geoipdata->flags & ( GEOIP_MATCH_SRC_FLAG | GEOIP_MATCH_BOTH_FLAG )) { if (CheckGeoMatchIPv4(geoipdata, GET_IPV4_SRC_ADDR_U32(p))) { if (geoipdata->flags & GEOIP_MATCH_BOTH_FLAG) matches++; else return 1; } } if (geoipdata->flags & ( GEOIP_MATCH_DST_FLAG | GEOIP_MATCH_BOTH_FLAG )) { if (CheckGeoMatchIPv4(geoipdata, GET_IPV4_DST_ADDR_U32(p))) { if (geoipdata->flags & GEOIP_MATCH_BOTH_FLAG) matches++; else return 1; } } /* if matches == 2 is because match-on is "both" */ if (matches == 2) return 1; } return 0; } /** * \brief This function is used to parse geoipdata * * \param str Pointer to the geoipdata value string * * \retval pointer to DetectGeoipData on success * \retval NULL on failure */ static DetectGeoipData *DetectGeoipDataParse (char *str) { DetectGeoipData *geoipdata = NULL; uint16_t pos = 0; uint16_t prevpos = 0; uint16_t slen = 0; int skiplocationparsing = 0; slen = strlen(str); if (slen == 0) goto error; /* We have a correct geoip options string */ geoipdata = SCMalloc(sizeof(DetectGeoipData)); if (unlikely(geoipdata == NULL)) goto error; memset(geoipdata, 0x00, sizeof(DetectGeoipData)); /* Parse the geoip option string */ while (pos <= slen) { /* search for ',' or end of string */ if (str[pos] == ',' || pos == slen) { if (geoipdata->flags == GEOIP_MATCH_NO_FLAG) { /* Parse match-on condition */ if (pos == slen) /* if end of option str then there are no match-on cond. */ { /* There was NO match-on condition! we default to ANY*/ skiplocationparsing = 0; geoipdata->flags |= GEOIP_MATCH_ANY_FLAG; } else { skiplocationparsing = 1; if (strncmp(&str[prevpos], GEOIP_MATCH_SRC_STR, pos-prevpos) == 0) geoipdata->flags |= GEOIP_MATCH_SRC_FLAG; else if (strncmp(&str[prevpos], GEOIP_MATCH_DST_STR, pos-prevpos) == 0) geoipdata->flags |= GEOIP_MATCH_DST_FLAG; else if (strncmp(&str[prevpos], GEOIP_MATCH_BOTH_STR, pos-prevpos) == 0) geoipdata->flags |= GEOIP_MATCH_BOTH_FLAG; else if (strncmp(&str[prevpos], GEOIP_MATCH_ANY_STR, pos-prevpos) == 0) geoipdata->flags |= GEOIP_MATCH_ANY_FLAG; else { /* There was NO match-on condition! we default to ANY*/ skiplocationparsing = 0; geoipdata->flags |= GEOIP_MATCH_ANY_FLAG; } } } if (geoipdata->flags != GEOIP_MATCH_NO_FLAG && skiplocationparsing == 0) { /* Parse location string: for now just the country code(s) */ if (str[prevpos] == '!') { geoipdata->flags |= GEOIP_MATCH_NEGATED; prevpos++; /* dot not copy the ! */ } if (geoipdata->nlocations >= GEOOPTION_MAXLOCATIONS) { SCLogError(SC_ERR_INVALID_ARGUMENT, "too many arguements for geoip keyword"); goto error; } if (pos-prevpos > GEOOPTION_MAXSIZE) strlcpy((char *)geoipdata->location[geoipdata->nlocations], &str[prevpos], GEOOPTION_MAXSIZE); else strlcpy((char *)geoipdata->location[geoipdata->nlocations], &str[prevpos], pos-prevpos+1); if (geoipdata->nlocations < GEOOPTION_MAXLOCATIONS) geoipdata->nlocations++; } prevpos = pos+1; skiplocationparsing = 0; /* match-on condition for sure has been parsed already */ } pos++; } SCLogDebug("GeoIP: %"PRIu32" countries loaded", geoipdata->nlocations); for (int i=0; inlocations; i++) SCLogDebug("GeoIP country code: %s", geoipdata->location[i]); SCLogDebug("flags %02X", geoipdata->flags); if (geoipdata->flags & GEOIP_MATCH_NEGATED) { SCLogDebug("negated geoip"); } /* Initialize the geolocation engine */ geoipdata->geoengine = InitGeolocationEngine(); if (geoipdata->geoengine == NULL) goto error; return geoipdata; error: if (geoipdata != NULL) DetectGeoipDataFree(geoipdata); return NULL; } /** * \internal * \brief this function is used to add the geoip option into the signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param optstr pointer to the user provided options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectGeoipSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { DetectGeoipData *geoipdata = NULL; SigMatch *sm = NULL; geoipdata = DetectGeoipDataParse(optstr); if (geoipdata == NULL) goto error; /* Get this into a SigMatch and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_GEOIP; sm->ctx = (SigMatchCtx *)geoipdata; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (geoipdata != NULL) DetectGeoipDataFree(geoipdata); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectGeoipData * * \param geoipdata pointer to DetectGeoipData */ static void DetectGeoipDataFree(void *ptr) { if (ptr != NULL) { DetectGeoipData *geoipdata = (DetectGeoipData *)ptr; SCFree(geoipdata); } } #ifdef UNITTESTS static int GeoipParseTest(char *rule, int ncountries, char **countries, uint32_t flags) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectGeoipData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, rule); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_MATCH] == NULL) { printf("empty server body list: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_MATCH]->type != DETECT_GEOIP) { printf("last sm not geoip: "); goto end; } data = (DetectGeoipData *)s->sm_lists_tail[DETECT_SM_LIST_MATCH]->ctx; if (data->flags != flags) { printf("flags not right: (flags=%d)",data->flags); goto end; } if (data->nlocations!=ncountries) { printf("wrong number of parsed countries: "); goto end; } for (int i=0; ilocation[i],countries[i])!=0) { printf("wrong parsed country code: "); goto end; } } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int GeoipParseTest01(void) { char *ccodes[1] = {"US"}; return GeoipParseTest("alert tcp any any -> any any (geoip:US;sid:1;)", 1, ccodes, GEOIP_MATCH_ANY_FLAG); } static int GeoipParseTest02(void) { char *ccodes[1] = {"US"}; return GeoipParseTest("alert tcp any any -> any any (geoip:!US;sid:1;)", 1, ccodes, GEOIP_MATCH_ANY_FLAG | GEOIP_MATCH_NEGATED); } static int GeoipParseTest03(void) { char *ccodes[1] = {"US"}; return GeoipParseTest("alert tcp any any -> any any (geoip:!US;sid:1;)", 1, ccodes, GEOIP_MATCH_ANY_FLAG | GEOIP_MATCH_NEGATED); } static int GeoipParseTest04(void) { char *ccodes[1] = {"US"}; return GeoipParseTest("alert tcp any any -> any any (geoip:src,US;sid:1;)", 1, ccodes, GEOIP_MATCH_SRC_FLAG); } static int GeoipParseTest05(void) { char *ccodes[1] = {"US"}; return GeoipParseTest("alert tcp any any -> any any (geoip:dst,!US;sid:1;)", 1, ccodes, GEOIP_MATCH_DST_FLAG | GEOIP_MATCH_NEGATED); } static int GeoipParseTest06(void) { char *ccodes[3] = {"US", "ES", "UK"}; return GeoipParseTest("alert tcp any any -> any any (geoip:US,ES,UK;sid:1;)", 3, ccodes, GEOIP_MATCH_ANY_FLAG); } static int GeoipParseTest07(void) { char *ccodes[3] = {"US", "ES", "UK"}; return GeoipParseTest("alert tcp any any -> any any (geoip:both,!US,ES,UK;sid:1;)", 3, ccodes, GEOIP_MATCH_BOTH_FLAG | GEOIP_MATCH_NEGATED); } /** * \internal * \brief This test tests geoip success and failure. */ static int GeoipMatchTest(char *rule, char *srcip, char *dstip) { uint8_t *buf = (uint8_t *) "GET / HTTP/1.0\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p1 = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); p1 = UTHBuildPacketSrcDst(buf, buflen, IPPROTO_TCP, srcip, dstip); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, rule); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); result = 2; SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1) == 0) { goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: return result; } static int GeoipMatchTest01(void) { /* Tests with IP of google DNS as US for both src and dst IPs */ return GeoipMatchTest("alert tcp any any -> any any (geoip:US;sid:1;)", "8.8.8.8", "8.8.8.8"); /* Expected result 1 = match */ } static int GeoipMatchTest02(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:JP;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 1 = match */ } static int GeoipMatchTest03(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:dst,JP;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 1 = match */ } static int GeoipMatchTest04(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:src,JP;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 2 = NO match */ } static int GeoipMatchTest05(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:src,JP,US;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 1 = match */ } static int GeoipMatchTest06(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:src,ES,JP,US,UK,PT;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 1 = match */ } static int GeoipMatchTest07(void) { /* Tests with IP of google DNS as US, and m.root-servers.net as japan */ return GeoipMatchTest("alert tcp any any -> any any (geoip:src,!ES,JP,US,UK,PT;sid:1;)", "8.8.8.8", "202.12.27.33"); /* Expected result 2 = NO match */ } #endif /* UNITTESTS */ /** * \internal * \brief This function registers unit tests for DetectGeoip */ static void DetectGeoipRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("GeoipParseTest01", GeoipParseTest01); UtRegisterTest("GeoipParseTest02", GeoipParseTest02); UtRegisterTest("GeoipParseTest03", GeoipParseTest03); UtRegisterTest("GeoipParseTest04", GeoipParseTest04); UtRegisterTest("GeoipParseTest05", GeoipParseTest05); UtRegisterTest("GeoipParseTest06", GeoipParseTest06); UtRegisterTest("GeoipParseTest07", GeoipParseTest07); UtRegisterTest("GeoipMatchTest01", GeoipMatchTest01); UtRegisterTest("GeoipMatchTest02", GeoipMatchTest02); UtRegisterTest("GeoipMatchTest03", GeoipMatchTest03); UtRegisterTest("GeoipMatchTest04", GeoipMatchTest04); UtRegisterTest("GeoipMatchTest05", GeoipMatchTest05); UtRegisterTest("GeoipMatchTest06", GeoipMatchTest06); UtRegisterTest("GeoipMatchTest07", GeoipMatchTest07); #endif /* UNITTESTS */ } #endif /* HAVE_GEOIP */ suricata-3.2.1/src/respond-reject.c0000644000000000000000000001330413051004444014072 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf * * RespondReject is a threaded wrapper for sending Rejects * * \todo RespondRejectFunc returns 1 on error, 0 on ok... why? For now it should * just return 0 always, error handling is a TODO in the threading model (VJ) */ #include "suricata-common.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "action-globals.h" #include "respond-reject.h" #include "respond-reject-libnet11.h" #include "util-debug.h" #include "util-privs.h" int RejectSendIPv4TCP(ThreadVars *, Packet *, void *); int RejectSendIPv4ICMP(ThreadVars *, Packet *, void *); int RejectSendIPv6TCP(ThreadVars *, Packet *, void *); int RejectSendIPv6ICMP(ThreadVars *, Packet *, void *); void TmModuleRespondRejectRegister (void) { tmm_modules[TMM_RESPONDREJECT].name = "RespondReject"; tmm_modules[TMM_RESPONDREJECT].ThreadInit = NULL; tmm_modules[TMM_RESPONDREJECT].Func = RespondRejectFunc; tmm_modules[TMM_RESPONDREJECT].ThreadDeinit = NULL; tmm_modules[TMM_RESPONDREJECT].RegisterTests = NULL; tmm_modules[TMM_RESPONDREJECT].cap_flags = 0; /* libnet is not compat with caps */ } TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { int ret = 0; /* ACTION_REJECT defaults to rejecting the SRC */ if (!(PACKET_TEST_ACTION(p, ACTION_REJECT)) && !(PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) && !(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH))) { return TM_ECODE_OK; } if (PKT_IS_IPV4(p)) { if (PKT_IS_TCP(p)) { ret = RejectSendIPv4TCP(tv, p, data); } else { ret = RejectSendIPv4ICMP(tv, p, data); } } else if (PKT_IS_IPV6(p)) { if (PKT_IS_TCP(p)) { ret = RejectSendIPv6TCP(tv, p, data); } else { ret = RejectSendIPv6ICMP(tv, p, data); } } else { /* we're only supporting IPv4 and IPv6 */ return TM_ECODE_OK; } if (ret) return TM_ECODE_FAILED; else return TM_ECODE_OK; } int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) { SCEnter(); int r = 0; if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { r = RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC); SCReturnInt(r); } else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { r = RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST); SCReturnInt(r); } else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { int ret; ret = RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC); if (RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST) == 0) { SCReturnInt(0); } else { SCReturnInt(ret); } } SCReturnInt(0); } int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data) { SCEnter(); int r = 0; if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { r = RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC); SCReturnInt(r); } else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { r = RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST); SCReturnInt(r); } else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { int ret; ret = RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC); if (RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST) == 0) { SCReturnInt(0); } else { SCReturnInt(ret); } } SCReturnInt(0); } int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data) { SCEnter(); int r = 0; if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { r = RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_SRC); SCReturnInt(r); } else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { r = RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_DST); SCReturnInt(r); } else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { int ret; ret = RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_SRC); if (RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_DST) == 0) { SCReturnInt(0); } else { SCReturnInt(ret); } } SCReturnInt(0); } int RejectSendIPv6ICMP(ThreadVars *tv, Packet *p, void *data) { SCEnter(); int r = 0; if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { r = RejectSendLibnet11L3IPv6ICMP(tv, p, data, REJECT_DIR_SRC); SCReturnInt(r); } else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { r = RejectSendLibnet11L3IPv6ICMP(tv, p, data, REJECT_DIR_DST); SCReturnInt(r); } else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { int ret; ret = RejectSendLibnet11L3IPv6ICMP(tv, p, data, REJECT_DIR_SRC); if (RejectSendLibnet11L3IPv6ICMP(tv, p, data, REJECT_DIR_DST) == 0) { SCReturnInt(0); } else { SCReturnInt(ret); } } SCReturnInt(0); } suricata-3.2.1/src/decode-ipv6.c0000644000000000000000000011101113051004444013245 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decode IPv6 */ #include "suricata-common.h" #include "packet-queue.h" #include "decode.h" #include "decode-ipv6.h" #include "decode-icmpv6.h" #include "decode-events.h" #include "defrag.h" #include "pkt-var.h" #include "util-debug.h" #include "util-print.h" #include "util-unittest.h" #include "util-profiling.h" #include "host.h" #define IPV6_EXTHDRS ip6eh.ip6_exthdrs #define IPV6_EH_CNT ip6eh.ip6_exthdrs_cnt /** * \brief Function to decode IPv4 in IPv6 packets * */ static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq) { if (unlikely(plen < IPV4_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL); return; } if (IP_GET_RAW_VER(pkt) == 4) { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6); /* add the tp to the packet queue. */ PacketEnqueue(pq,tp); StatsIncr(tv, dtv->counter_ipv4inipv6); return; } } } else { ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER); } return; } /** * \brief Function to decode IPv6 in IPv6 packets * */ static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq) { if (unlikely(plen < IPV6_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL); return TM_ECODE_FAILED; } if (IP_GET_RAW_VER(pkt) == 6) { if (unlikely(pq != NULL)) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6); PacketEnqueue(pq,tp); StatsIncr(tv, dtv->counter_ipv6inipv6); } } } else { ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER); } return TM_ECODE_OK; } #ifndef UNITTESTS // ugly, but we need this in defrag tests static inline #endif void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen) { uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8; int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001; p->ip6eh.fh_offset = frag_offset; p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE; p->ip6eh.fh_nh = *pkt; uint32_t fh_id; memcpy(&fh_id, pkt+4, 4); p->ip6eh.fh_id = ntohl(fh_id); SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->ip6eh.fh_offset, p->ip6eh.fh_more_frags_set ? "true" : "false", p->ip6eh.fh_nh, p->ip6eh.fh_id, p->ip6eh.fh_id); // store header offset, data offset uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p)); uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen); uint16_t data_len = plen - hdrextlen; p->ip6eh.fh_header_offset = frag_hdr_offset; p->ip6eh.fh_data_offset = data_offset; p->ip6eh.fh_data_len = data_len; /* if we have a prev hdr, store the type and offset of it */ if (prev_hdrextlen) { p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen; } SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u", p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset, p->ip6eh.fh_data_len); } static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { SCEnter(); uint8_t *orig_pkt = pkt; uint8_t nh = 0; /* careful, 0 is actually a real type */ uint16_t hdrextlen = 0; uint16_t plen; char dstopts = 0; char exthdr_fh_done = 0; int hh = 0; int rh = 0; int eh = 0; int ah = 0; nh = IPV6_GET_NH(p); plen = len; while(1) { /* No upper layer, but we do have data. Suspicious. */ if (nh == IPPROTO_NONE && plen > 0) { ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER); SCReturn; } if (plen < 2) { /* minimal needed in a hdr */ SCReturn; } switch(nh) { case IPPROTO_TCP: IPV6_SET_L4PROTO(p,nh); DecodeTCP(tv, dtv, p, pkt, plen, pq); SCReturn; case IPPROTO_UDP: IPV6_SET_L4PROTO(p,nh); DecodeUDP(tv, dtv, p, pkt, plen, pq); SCReturn; case IPPROTO_ICMPV6: IPV6_SET_L4PROTO(p,nh); DecodeICMPV6(tv, dtv, p, pkt, plen, pq); SCReturn; case IPPROTO_SCTP: IPV6_SET_L4PROTO(p,nh); DecodeSCTP(tv, dtv, p, pkt, plen, pq); SCReturn; case IPPROTO_ROUTING: IPV6_SET_L4PROTO(p,nh); hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */ SCLogDebug("hdrextlen %"PRIu8, hdrextlen); if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } if (rh) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH); /* skip past this extension so we can continue parsing the rest * of the packet */ nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } rh = 1; IPV6_EXTHDR_SET_RH(p); uint8_t ip6rh_type = *(pkt + 2); if (ip6rh_type == 0) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0); } p->ip6eh.rh_type = ip6rh_type; nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; case IPPROTO_HOPOPTS: case IPPROTO_DSTOPTS: { IPV6OptHAO hao_s, *hao = &hao_s; IPV6OptRA ra_s, *ra = &ra_s; IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s; uint16_t optslen = 0; IPV6_SET_L4PROTO(p,nh); hdrextlen = (*(pkt+1) + 1) << 3; if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */ /* point the pointers to right structures * in Packet. */ if (nh == IPPROTO_HOPOPTS) { if (hh) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH); /* skip past this extension so we can continue parsing the rest * of the packet */ nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } hh = 1; optslen = ((*(pkt + 1) + 1 ) << 3) - 2; } else if (nh == IPPROTO_DSTOPTS) { if (dstopts == 0) { optslen = ((*(pkt + 1) + 1 ) << 3) - 2; dstopts = 1; } else if (dstopts == 1) { optslen = ((*(pkt + 1) + 1 ) << 3) - 2; dstopts = 2; } else { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH); /* skip past this extension so we can continue parsing the rest * of the packet */ nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } } if (optslen > plen) { /* since the packet is long enough (we checked * plen against hdrlen, the optlen must be malformed. */ ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); /* skip past this extension so we can continue parsing the rest * of the packet */ nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } /** \todo move into own function to loaded on demand */ uint16_t padn_cnt = 0; uint16_t other_cnt = 0; uint16_t offset = 0; while(offset < optslen) { if (*ptr == IPV6OPT_PAD1) { padn_cnt++; offset++; ptr++; continue; } if (offset + 1 >= optslen) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); break; } /* length field for each opt */ uint8_t ip6_optlen = *(ptr + 1); /* see if the optlen from the packet fits the total optslen */ if ((offset + 1 + ip6_optlen) > optslen) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); break; } if (*ptr == IPV6OPT_PADN) /* PadN */ { //printf("PadN option\n"); padn_cnt++; /* a zero padN len would be weird */ if (ip6_optlen == 0) ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN); } else if (*ptr == IPV6OPT_RA) /* RA */ { ra->ip6ra_type = *(ptr); ra->ip6ra_len = ip6_optlen; if (ip6_optlen < sizeof(ra->ip6ra_value)) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); break; } memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value)); ra->ip6ra_value = ntohs(ra->ip6ra_value); //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n", // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value); other_cnt++; } else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */ { jumbo->ip6j_type = *(ptr); jumbo->ip6j_len = ip6_optlen; if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); break; } memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len)); jumbo->ip6j_payload_len = ntohl(jumbo->ip6j_payload_len); //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n", // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len); } else if (*ptr == IPV6OPT_HAO) /* HAO */ { hao->ip6hao_type = *(ptr); hao->ip6hao_len = ip6_optlen; if (ip6_optlen < sizeof(hao->ip6hao_hoa)) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN); break; } memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa)); //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ", // hao->ip6hao_type, hao->ip6hao_len); //char addr_buf[46]; //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa), // addr_buf,sizeof(addr_buf)); //printf("home addr %s\n", addr_buf); other_cnt++; } else { if (nh == IPPROTO_HOPOPTS) ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT); else ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT); other_cnt++; } uint16_t optlen = (*(ptr + 1) + 2); ptr += optlen; /* +2 for opt type and opt len fields */ offset += optlen; } /* flag packets that have only padding */ if (padn_cnt > 0 && other_cnt == 0) { if (nh == IPPROTO_HOPOPTS) ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING); else ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING); } nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } case IPPROTO_FRAGMENT: { IPV6_SET_L4PROTO(p,nh); /* store the offset of this extension into the packet * past the ipv6 header. We use it in defrag for creating * a defragmented packet without the frag header */ if (exthdr_fh_done == 0) { p->ip6eh.fh_offset = pkt - orig_pkt; exthdr_fh_done = 1; } uint16_t prev_hdrextlen = hdrextlen; hdrextlen = sizeof(IPV6FragHdr); if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } /* for the frag header, the length field is reserved */ if (*(pkt + 1) != 0) { ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD); /* non fatal, lets try to continue */ } if (IPV6_EXTHDR_ISSET_FH(p)) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH); nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } /* set the header flag first */ IPV6_EXTHDR_SET_FH(p); /* parse the header and setup the vars */ DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen); /* if FH has offset 0 and no more fragments are coming, we * parse this packet further right away, no defrag will be * needed. It is a useless FH then though, so we do set an * decoder event. */ if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH); nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } /* the rest is parsed upon reassembly */ p->flags |= PKT_IS_FRAGMENT; SCReturn; } case IPPROTO_ESP: { IPV6_SET_L4PROTO(p,nh); hdrextlen = sizeof(IPV6EspHdr); if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } if (eh) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_EH); SCReturn; } eh = 1; nh = IPPROTO_NONE; pkt += hdrextlen; plen -= hdrextlen; break; } case IPPROTO_AH: { IPV6_SET_L4PROTO(p,nh); /* we need the header as a minimum */ hdrextlen = sizeof(IPV6AuthHdr); /* the payload len field is the number of extra 4 byte fields, * IPV6AuthHdr already contains the first */ if (*(pkt+1) > 0) hdrextlen += ((*(pkt+1) - 1) * 4); SCLogDebug("hdrextlen %"PRIu8, hdrextlen); if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt; if (ahhdr->ip6ah_reserved != 0x0000) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL); } if (ah) { ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH); nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } ah = 1; nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; } case IPPROTO_IPIP: IPV6_SET_L4PROTO(p,nh); DecodeIPv4inIPv6(tv, dtv, p, pkt, plen, pq); SCReturn; /* none, last header */ case IPPROTO_NONE: IPV6_SET_L4PROTO(p,nh); SCReturn; case IPPROTO_ICMP: ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4); SCReturn; /* no parsing yet, just skip it */ case IPPROTO_MH: case IPPROTO_HIP: case IPPROTO_SHIM6: hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */ if (hdrextlen > plen) { ENGINE_SET_EVENT(p, IPV6_TRUNC_EXTHDR); SCReturn; } nh = *pkt; pkt += hdrextlen; plen -= hdrextlen; break; default: ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER); IPV6_SET_L4PROTO(p,nh); SCReturn; } } SCReturn; } static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < IPV6_HEADER_LEN)) { return -1; } if (unlikely(IP_GET_RAW_VER(pkt) != 6)) { SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt)); ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER); return -1; } p->ip6h = (IPV6Hdr *)pkt; if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p)))) { ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT); return -1; } SET_IPV6_SRC_ADDR(p,&p->src); SET_IPV6_DST_ADDR(p,&p->dst); return 0; } int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { int ret; StatsIncr(tv, dtv->counter_ipv6); /* do the actual decoding */ ret = DecodeIPV6Packet (tv, dtv, p, pkt, len); if (unlikely(ret < 0)) { p->ip6h = NULL; return TM_ECODE_FAILED; } #ifdef DEBUG if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */ /* debug print */ char s[46], d[46]; PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d)); SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d, IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p), IPV6_GET_HLIM(p)); } #endif /* DEBUG */ /* now process the Ext headers and/or the L4 Layer */ switch(IPV6_GET_NH(p)) { case IPPROTO_TCP: IPV6_SET_L4PROTO (p, IPPROTO_TCP); DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_UDP: IPV6_SET_L4PROTO (p, IPPROTO_UDP); DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_ICMPV6: IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6); DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_SCTP: IPV6_SET_L4PROTO (p, IPPROTO_SCTP); DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_IPIP: IPV6_SET_L4PROTO(p, IPPROTO_IPIP); DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_IPV6: DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); return TM_ECODE_OK; case IPPROTO_FRAGMENT: case IPPROTO_HOPOPTS: case IPPROTO_ROUTING: case IPPROTO_NONE: case IPPROTO_DSTOPTS: case IPPROTO_AH: case IPPROTO_ESP: case IPPROTO_MH: case IPPROTO_HIP: case IPPROTO_SHIM6: DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq); break; case IPPROTO_ICMP: ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4); break; default: ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER); IPV6_SET_L4PROTO (p, IPV6_GET_NH(p)); break; } p->proto = IPV6_GET_L4PROTO (p); /* Pass to defragger if a fragment. */ if (IPV6_EXTHDR_ISSET_FH(p)) { Packet *rp = Defrag(tv, dtv, p, pq); if (rp != NULL) { PacketEnqueue(pq,rp); } } return TM_ECODE_OK; } #ifdef UNITTESTS /** * \test fragment decoding */ static int DecodeIPV6FragTest01 (void) { uint8_t raw_frag1[] = { 0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01, 0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7, 0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13, 0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44, 0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50, 0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30, 0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a, 0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39, 0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33, 0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75, 0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, }; uint8_t raw_frag2[] = { 0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01, 0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, }; Packet *pkt; Packet *p1 = PacketGetFromAlloc(); if (unlikely(p1 == NULL)) return 0; Packet *p2 = PacketGetFromAlloc(); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars tv; DecodeThreadVars dtv; int result = 0; PacketQueue pq; FlowInitConfig(FLOW_QUIET); DefragInit(); memset(&pq, 0, sizeof(PacketQueue)); memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); PacketCopyData(p1, raw_frag1, sizeof(raw_frag1)); PacketCopyData(p2, raw_frag2, sizeof(raw_frag2)); DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq); if (!(IPV6_EXTHDR_ISSET_FH(p1))) { printf("ipv6 frag header not detected: "); goto end; } DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2), &pq); if (!(IPV6_EXTHDR_ISSET_FH(p2))) { printf("ipv6 frag header not detected: "); goto end; } if (pq.len != 1) { printf("no reassembled packet: "); goto end; } result = 1; end: PACKET_RECYCLE(p1); PACKET_RECYCLE(p2); SCFree(p1); SCFree(p2); pkt = PacketDequeue(&pq); while (pkt != NULL) { PACKET_RECYCLE(pkt); SCFree(pkt); pkt = PacketDequeue(&pq); } DefragDestroy(); FlowShutdown(); return result; } /** * \test routing header decode */ static int DecodeIPV6RouteTest01 (void) { uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40, 0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf, 0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00, 0xfa, 0x87, 0x00, 0x00, }; Packet *p1 = PacketGetFromAlloc(); FAIL_IF(unlikely(p1 == NULL)); ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; FlowInitConfig(FLOW_QUIET); memset(&pq, 0, sizeof(PacketQueue)); memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1)); DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq); FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1))); FAIL_IF (p1->ip6eh.rh_type != 0); PACKET_RECYCLE(p1); SCFree(p1); FlowShutdown(); PASS; } /** * \test HOP header decode */ static int DecodeIPV6HopTest01 (void) { uint8_t raw_pkt1[] = { 0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00, 0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */ 0x02,0x00,0x00,0x00,0x00, 0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; Packet *p1 = PacketGetFromAlloc(); FAIL_IF(unlikely(p1 == NULL)); ThreadVars tv; DecodeThreadVars dtv; PacketQueue pq; FlowInitConfig(FLOW_QUIET); memset(&pq, 0, sizeof(PacketQueue)); memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1)); DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq); FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT))); PACKET_RECYCLE(p1); SCFree(p1); FlowShutdown(); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for IPV6 decoder */ void DecodeIPV6RegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01); UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01); UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/ippair.h0000644000000000000000000001063613051004444012444 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __IPPAIR_H__ #define __IPPAIR_H__ #include "decode.h" #include "util-storage.h" /** Spinlocks or Mutex for the flow buckets. */ //#define HRLOCK_SPIN #define HRLOCK_MUTEX #ifdef HRLOCK_SPIN #ifdef HRLOCK_MUTEX #error Cannot enable both HRLOCK_SPIN and HRLOCK_MUTEX #endif #endif #ifdef HRLOCK_SPIN #define HRLOCK_TYPE SCSpinlock #define HRLOCK_INIT(fb) SCSpinInit(&(fb)->lock, 0) #define HRLOCK_DESTROY(fb) SCSpinDestroy(&(fb)->lock) #define HRLOCK_LOCK(fb) SCSpinLock(&(fb)->lock) #define HRLOCK_TRYLOCK(fb) SCSpinTrylock(&(fb)->lock) #define HRLOCK_UNLOCK(fb) SCSpinUnlock(&(fb)->lock) #elif defined HRLOCK_MUTEX #define HRLOCK_TYPE SCMutex #define HRLOCK_INIT(fb) SCMutexInit(&(fb)->lock, NULL) #define HRLOCK_DESTROY(fb) SCMutexDestroy(&(fb)->lock) #define HRLOCK_LOCK(fb) SCMutexLock(&(fb)->lock) #define HRLOCK_TRYLOCK(fb) SCMutexTrylock(&(fb)->lock) #define HRLOCK_UNLOCK(fb) SCMutexUnlock(&(fb)->lock) #else #error Enable HRLOCK_SPIN or HRLOCK_MUTEX #endif typedef struct IPPair_ { /** ippair mutex */ SCMutex m; /** ippair addresses -- ipv4 or ipv6 */ Address a[2]; /** use cnt, reference counter */ SC_ATOMIC_DECLARE(unsigned int, use_cnt); /** storage api handle */ Storage *storage; /** hash pointers, protected by hash row mutex/spin */ struct IPPair_ *hnext; struct IPPair_ *hprev; /** list pointers, protected by ippair-queue mutex/spin */ struct IPPair_ *lnext; struct IPPair_ *lprev; } IPPair; typedef struct IPPairHashRow_ { HRLOCK_TYPE lock; IPPair *head; IPPair *tail; } __attribute__((aligned(CLS))) IPPairHashRow; /** ippair hash table */ IPPairHashRow *ippair_hash; #define IPPAIR_VERBOSE 0 #define IPPAIR_QUIET 1 typedef struct IPPairConfig_ { uint64_t memcap; uint32_t hash_rand; uint32_t hash_size; uint32_t prealloc; } IPPairConfig; /** \brief check if a memory alloc would fit in the memcap * * \param size memory allocation size to check * * \retval 1 it fits * \retval 0 no fit */ #define IPPAIR_CHECK_MEMCAP(size) \ ((((uint64_t)SC_ATOMIC_GET(ippair_memuse) + (uint64_t)(size)) <= ippair_config.memcap)) #define IPPairIncrUsecnt(h) \ (void)SC_ATOMIC_ADD((h)->use_cnt, 1) #define IPPairDecrUsecnt(h) \ (void)SC_ATOMIC_SUB((h)->use_cnt, 1) #define IPPairReference(dst_h_ptr, h) do { \ if ((h) != NULL) { \ IPPairIncrUsecnt((h)); \ *(dst_h_ptr) = h; \ } \ } while (0) #define IPPairDeReference(src_h_ptr) do { \ if (*(src_h_ptr) != NULL) { \ IPPairDecrUsecnt(*(src_h_ptr)); \ *(src_h_ptr) = NULL; \ } \ } while (0) IPPairConfig ippair_config; SC_ATOMIC_DECLARE(unsigned long long int,ippair_memuse); SC_ATOMIC_DECLARE(unsigned int,ippair_counter); SC_ATOMIC_DECLARE(unsigned int,ippair_prune_idx); void IPPairInitConfig(char quiet); void IPPairShutdown(void); void IPPairCleanup(void); IPPair *IPPairLookupIPPairFromHash (Address *, Address *); IPPair *IPPairGetIPPairFromHash (Address *, Address *); void IPPairRelease(IPPair *); void IPPairLock(IPPair *); void IPPairClearMemory(IPPair *); void IPPairMoveToSpare(IPPair *); uint32_t IPPairSpareQueueGetSize(void); void IPPairPrintStats (void); void IPPairRegisterUnittests(void); IPPair *IPPairAlloc(void); void IPPairFree(IPPair *); void IPPairLock(IPPair *); void IPPairUnlock(IPPair *); #endif /* __IPPAIR_H__ */ suricata-3.2.1/src/detect-engine-hhd.c0000644000000000000000000033360713051004444014435 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * * \brief Handle HTTP header match * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-hhd.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "util-memcmp.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "util-validate.h" #define BUFFER_STEP 50 static inline int HHDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size) { if (size >= (USHRT_MAX - BUFFER_STEP)) return -1; void *ptmp; if (size > det_ctx->hhd_buffers_size) { ptmp = SCRealloc(det_ctx->hhd_buffers, (det_ctx->hhd_buffers_size + BUFFER_STEP) * sizeof(uint8_t *)); if (ptmp == NULL) { SCFree(det_ctx->hhd_buffers); det_ctx->hhd_buffers = NULL; det_ctx->hhd_buffers_size = 0; det_ctx->hhd_buffers_list_len = 0; return -1; } det_ctx->hhd_buffers = ptmp; memset(det_ctx->hhd_buffers + det_ctx->hhd_buffers_size, 0, BUFFER_STEP * sizeof(uint8_t *)); ptmp = SCRealloc(det_ctx->hhd_buffers_len, (det_ctx->hhd_buffers_size + BUFFER_STEP) * sizeof(uint32_t)); if (ptmp == NULL) { SCFree(det_ctx->hhd_buffers_len); det_ctx->hhd_buffers_len = NULL; det_ctx->hhd_buffers_size = 0; det_ctx->hhd_buffers_list_len = 0; return -1; } det_ctx->hhd_buffers_len = ptmp; memset(det_ctx->hhd_buffers_len + det_ctx->hhd_buffers_size, 0, BUFFER_STEP * sizeof(uint32_t)); det_ctx->hhd_buffers_size += BUFFER_STEP; } memset(det_ctx->hhd_buffers_len + det_ctx->hhd_buffers_list_len, 0, (size - det_ctx->hhd_buffers_list_len) * sizeof(uint32_t)); return 0; } static uint8_t *DetectEngineHHDGetBufferForTX(htp_tx_t *tx, uint64_t tx_id, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Flow *f, HtpState *htp_state, uint8_t flags, uint32_t *buffer_len) { uint8_t *headers_buffer = NULL; int index = 0; *buffer_len = 0; if (det_ctx->hhd_buffers_list_len == 0) { /* get the inspect id to use as a 'base id' */ uint64_t base_inspect_id = AppLayerParserGetTransactionInspectId(f->alparser, flags); BUG_ON(base_inspect_id > tx_id); /* see how many space we need for the current tx_id */ uint64_t txs = (tx_id - base_inspect_id) + 1; if (HHDCreateSpace(det_ctx, txs) < 0) goto end; index = (tx_id - base_inspect_id); det_ctx->hhd_start_tx_id = base_inspect_id; det_ctx->hhd_buffers_list_len = txs; } else { /* tx fits in our current buffers */ if ((tx_id - det_ctx->hhd_start_tx_id) < det_ctx->hhd_buffers_list_len) { /* if we previously reassembled, return that buffer */ if (det_ctx->hhd_buffers_len[(tx_id - det_ctx->hhd_start_tx_id)] != 0) { *buffer_len = det_ctx->hhd_buffers_len[(tx_id - det_ctx->hhd_start_tx_id)]; return det_ctx->hhd_buffers[(tx_id - det_ctx->hhd_start_tx_id)]; } /* otherwise fall through */ } else { /* not enough space, lets expand */ uint64_t txs = (tx_id - det_ctx->hhd_start_tx_id) + 1; if (HHDCreateSpace(det_ctx, txs) < 0) goto end; det_ctx->hhd_buffers_list_len = txs; } index = (tx_id - det_ctx->hhd_start_tx_id); } htp_table_t *headers; if (flags & STREAM_TOSERVER) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) <= HTP_REQUEST_HEADERS) goto end; headers = tx->request_headers; } else { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) <= HTP_RESPONSE_HEADERS) goto end; headers = tx->response_headers; } if (headers == NULL) goto end; htp_header_t *h = NULL; headers_buffer = det_ctx->hhd_buffers[index]; size_t headers_buffer_len = 0; size_t i = 0; size_t no_of_headers = htp_table_size(headers); for (; i < no_of_headers; i++) { h = htp_table_get_index(headers, i, NULL); size_t size1 = bstr_size(h->name); size_t size2 = bstr_size(h->value); if (flags & STREAM_TOSERVER) { if (size1 == 6 && SCMemcmpLowercase("cookie", bstr_ptr(h->name), 6) == 0) { continue; } } else { if (size1 == 10 && SCMemcmpLowercase("set-cookie", bstr_ptr(h->name), 10) == 0) { continue; } } /* the extra 4 bytes if for ": " and "\r\n" */ uint8_t *new_headers_buffer = SCRealloc(headers_buffer, headers_buffer_len + size1 + size2 + 4); if (unlikely(new_headers_buffer == NULL)) { if (headers_buffer != NULL) { SCFree(headers_buffer); headers_buffer = NULL; } det_ctx->hhd_buffers[index] = NULL; det_ctx->hhd_buffers_len[index] = 0; goto end; } headers_buffer = new_headers_buffer; memcpy(headers_buffer + headers_buffer_len, bstr_ptr(h->name), size1); headers_buffer_len += size1; headers_buffer[headers_buffer_len] = ':'; headers_buffer[headers_buffer_len + 1] = ' '; headers_buffer_len += 2; memcpy(headers_buffer + headers_buffer_len, bstr_ptr(h->value), size2); headers_buffer_len += size2 + 2; /* \r */ headers_buffer[headers_buffer_len - 2] = '\r'; /* \n */ headers_buffer[headers_buffer_len - 1] = '\n'; } /* store the buffers. We will need it for further inspection */ det_ctx->hhd_buffers[index] = headers_buffer; det_ctx->hhd_buffers_len[index] = headers_buffer_len; *buffer_len = (uint32_t)headers_buffer_len; end: return headers_buffer; } /** \brief HTTP Headers Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpRequestHeaders(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_headers == NULL) return; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; const uint8_t *buffer = DetectEngineHHDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } #if 0 static void PrefilterTxHttpRequestTrailers(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_headers == NULL) return; const HtpTxUserData *htud = (const HtpTxUserData *)htp_tx_get_user_data(tx); /* if the request wasn't flagged as having a trailer, we skip */ if (htud && !htud->request_has_trailers) return; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; const uint8_t *buffer = DetectEngineHHDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } #endif int PrefilterTxHttpRequestHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); int r = PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestHeaders, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_header (request)"); return r; #if 0 if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestTrailers, ALPROTO_HTTP, HTP_REQUEST_TRAILER, mpm_ctx, NULL, "http_header (request)"); #endif } /** \brief HTTP Headers Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHttpResponseHeaders(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_headers == NULL) return; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; const uint8_t *buffer = DetectEngineHHDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } #if 0 static void PrefilterTxHttpResponseTrailers(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->response_headers == NULL) return; const HtpTxUserData *htud = (const HtpTxUserData *)htp_tx_get_user_data(tx); /* if the request wasn't flagged as having a trailer, we skip */ if (htud && !htud->response_has_trailers) return; HtpState *htp_state = f->alstate; uint32_t buffer_len = 0; const uint8_t *buffer = DetectEngineHHDGetBufferForTX(tx, idx, NULL, det_ctx, f, htp_state, flags, &buffer_len); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } #endif int PrefilterTxHttpResponseHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); int r = PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseHeaders, ALPROTO_HTTP, HTP_RESPONSE_HEADERS, mpm_ctx, NULL, "http_header (response)"); return r; #if 0 if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseTrailers, ALPROTO_HTTP, HTP_RESPONSE_TRAILER, mpm_ctx, NULL, "http_header (response)"); #endif } int DetectEngineInspectHttpHeader(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { HtpState *htp_state = (HtpState *)alstate; uint32_t buffer_len = 0; uint8_t *buffer = DetectEngineHHDGetBufferForTX(tx, tx_id, de_ctx, det_ctx, f, htp_state, flags, &buffer_len); if (buffer_len == 0) goto end; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HHDMATCH], f, buffer, buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (flags & STREAM_TOSERVER) { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } else { if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; } return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } void DetectEngineCleanHHDBuffers(DetectEngineThreadCtx *det_ctx) { if (det_ctx->hhd_buffers_list_len != 0) { int i; for (i = 0; i < det_ctx->hhd_buffers_list_len; i++) { det_ctx->hhd_buffers_len[i] = 0; } det_ctx->hhd_buffers_list_len = 0; } det_ctx->hhd_start_tx_id = 0; return; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; depth:15; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"one\"; depth:5; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; depth:5; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"one\"; depth:15; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; offset:10; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"one\"; offset:15; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; offset:15; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:!\"one\"; offset:10; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:\"three\"; http_header; within:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:!\"three\"; http_header; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:!\"three\"; http_header; within:10; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:\"three\"; http_header; within:5; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:\"five\"; http_header; distance:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:!\"five\"; http_header; distance:15; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:!\"five\"; http_header; distance:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** *\test Test that the http_header content matches against a http request * which holds the content. */ static int DetectEngineHttpHeaderTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"one\"; http_header; content:\"five\"; http_header; distance:15; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHeaderTest20(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:!\"dummy\"; http_header; within:7; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest21(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:!\"dummy\"; within:7; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest22(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:!\"dummy\"; distance:3; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest23(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:!\"dummy\"; distance:13; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest24(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:\"dummy\"; within:15; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest25(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:\"dummy\"; within:10; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest26(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:\"dummy\"; distance:8; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest27(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: This_is_dummy_body1"; uint8_t http2_buf[] = "This_is_dummy_message_body2\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http client body test\"; " "pcre:/body1/H; " "content:\"dummy\"; distance:14; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest28(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Content-Length: 6\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } static int DetectEngineHttpHeaderTest29(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Content-Length: 7\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #if 0 static int DetectEngineHttpHeaderTest30(void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any " "(msg:\"http header test\"; " "content:\"Content-Length: 6\"; http_header; " "content:\"User-Agent: Mozilla\"; http_header; " "sid:1;)"); if (de_ctx->sig_list != NULL) { goto end; } result = 1; end: if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* #if 0 */ static int DetectEngineHttpHeaderTest30(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf1[] = "GET /index.html HTTP/1.0\r\n" "Host: www.openinfosecfoundation.org\r\n" "User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7\r\n" "\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "HTTP/1.0 200 ok\r\n" "Set-Cookie: dummycookieset\r\n" "Content-Type: text/html\r\n" "Content-Length: 6\r\n" "\r\n" "abcdef"; uint32_t http_buf2_len = sizeof(http_buf2) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http header test\"; " "content:\"dummycookieset\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test reassembly bug where headers with names of length 6 were * skipped */ static int DetectEngineHttpHeaderTest31(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "Accept: blah\r\n" "Cookie: blah\r\n" "Crazy6: blah\r\n" "SixZix: blah\r\n\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(content:\"Accept|3a|\"; http_header; " "content:!\"Cookie|3a|\"; http_header; " "content:\"Crazy6|3a|\"; http_header; " "content:\"SixZix|3a|\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } /** * \test Trailing headers. */ static int DetectEngineHttpHeaderTest32(void) { TcpSession ssn; Packet *p1 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "host: boom\r\n" "Transfer-Encoding: chunked\r\n" "\r\n" "13\r\n" "This is dummy body1\r\n" "0\r\n" "Dummy-Header: kaboom\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(content:\"Dummy\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); return result; } /** * \test Trailing headers. */ static int DetectEngineHttpHeaderTest33(void) { TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http1_buf[] = "GET /index.html HTTP/1.0\r\n" "host: boom\r\n" "Transfer-Encoding: chunked\r\n" "\r\n" "13\r\n" "This is dummy body1\r\n" "0\r\n"; uint8_t http2_buf[] = "Dummy-Header: kaboom\r\n" "\r\n"; uint32_t http1_len = sizeof(http1_buf) - 1; uint32_t http2_len = sizeof(http2_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(content:\"Dummy\"; http_header; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http1_buf, http1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: \n"); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http2_buf, http2_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: \n", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!PacketAlertCheck(p2, 1)) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpHeaderRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpHeaderTest01", DetectEngineHttpHeaderTest01); UtRegisterTest("DetectEngineHttpHeaderTest02", DetectEngineHttpHeaderTest02); UtRegisterTest("DetectEngineHttpHeaderTest03", DetectEngineHttpHeaderTest03); UtRegisterTest("DetectEngineHttpHeaderTest04", DetectEngineHttpHeaderTest04); UtRegisterTest("DetectEngineHttpHeaderTest05", DetectEngineHttpHeaderTest05); UtRegisterTest("DetectEngineHttpHeaderTest06", DetectEngineHttpHeaderTest06); UtRegisterTest("DetectEngineHttpHeaderTest07", DetectEngineHttpHeaderTest07); UtRegisterTest("DetectEngineHttpHeaderTest08", DetectEngineHttpHeaderTest08); UtRegisterTest("DetectEngineHttpHeaderTest09", DetectEngineHttpHeaderTest09); UtRegisterTest("DetectEngineHttpHeaderTest10", DetectEngineHttpHeaderTest10); UtRegisterTest("DetectEngineHttpHeaderTest11", DetectEngineHttpHeaderTest11); UtRegisterTest("DetectEngineHttpHeaderTest12", DetectEngineHttpHeaderTest12); UtRegisterTest("DetectEngineHttpHeaderTest13", DetectEngineHttpHeaderTest13); UtRegisterTest("DetectEngineHttpHeaderTest14", DetectEngineHttpHeaderTest14); UtRegisterTest("DetectEngineHttpHeaderTest15", DetectEngineHttpHeaderTest15); UtRegisterTest("DetectEngineHttpHeaderTest16", DetectEngineHttpHeaderTest16); UtRegisterTest("DetectEngineHttpHeaderTest17", DetectEngineHttpHeaderTest17); UtRegisterTest("DetectEngineHttpHeaderTest20", DetectEngineHttpHeaderTest20); UtRegisterTest("DetectEngineHttpHeaderTest21", DetectEngineHttpHeaderTest21); UtRegisterTest("DetectEngineHttpHeaderTest22", DetectEngineHttpHeaderTest22); UtRegisterTest("DetectEngineHttpHeaderTest23", DetectEngineHttpHeaderTest23); UtRegisterTest("DetectEngineHttpHeaderTest24", DetectEngineHttpHeaderTest24); UtRegisterTest("DetectEngineHttpHeaderTest25", DetectEngineHttpHeaderTest25); UtRegisterTest("DetectEngineHttpHeaderTest26", DetectEngineHttpHeaderTest26); UtRegisterTest("DetectEngineHttpHeaderTest27", DetectEngineHttpHeaderTest27); UtRegisterTest("DetectEngineHttpHeaderTest28", DetectEngineHttpHeaderTest28); UtRegisterTest("DetectEngineHttpHeaderTest29", DetectEngineHttpHeaderTest29); UtRegisterTest("DetectEngineHttpHeaderTest30", DetectEngineHttpHeaderTest30); UtRegisterTest("DetectEngineHttpHeaderTest31", DetectEngineHttpHeaderTest31); #if 0 UtRegisterTest("DetectEngineHttpHeaderTest30", DetectEngineHttpHeaderTest30, 1); #endif UtRegisterTest("DetectEngineHttpHeaderTest32", DetectEngineHttpHeaderTest32); UtRegisterTest("DetectEngineHttpHeaderTest33", DetectEngineHttpHeaderTest33); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/detect-filemagic.h0000644000000000000000000000250413051004444014341 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FILEMAGIC_H__ #define __DETECT_FILEMAGIC_H__ #ifdef HAVE_MAGIC #include "util-spm-bm.h" typedef struct DetectFilemagicThreadData { magic_t ctx; } DetectFilemagicThreadData; typedef struct DetectFilemagicData { int thread_ctx_id; uint8_t *name; /** name of the file to match */ BmCtx *bm_ctx; /** BM context */ uint16_t len; /** name length */ uint32_t flags; } DetectFilemagicData; /* prototypes */ int FilemagicGlobalLookup(File *file); #endif void DetectFilemagicRegister (void); #endif /* __DETECT_FILEMAGIC_H__ */ suricata-3.2.1/src/app-layer-dns-udp.c0000644000000000000000000007363213051004444014422 00000000000000/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "conf.h" #include "util-misc.h" #include "debug.h" #include "decode.h" #include "flow-util.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-debug.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "util-spm.h" #include "util-unittest.h" #include "app-layer-dns-udp.h" /** \internal * \brief Parse DNS request packet */ static int DNSUDPRequestParse(Flow *f, void *dstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { DNSState *dns_state = (DNSState *)dstate; SCLogDebug("starting %u", input_len); if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } /** \todo remove this when PP is fixed to enforce ipproto */ if (f != NULL && f->proto != IPPROTO_UDP) SCReturnInt(-1); if (input == NULL || input_len == 0 || input_len < sizeof(DNSHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSHeader)); goto insufficient_data; } DNSHeader *dns_header = (DNSHeader *)input; SCLogDebug("DNS %p", dns_header); if (DNSValidateRequestHeader(dns_state, dns_header) < 0) goto bad_data; if (dns_state != NULL) { if (timercmp(&dns_state->last_req, &dns_state->last_resp, >=)) { if (dns_state->window <= dns_state->unreplied_cnt) { dns_state->window++; } } } uint16_t q; const uint8_t *data = input + sizeof(DNSHeader); for (q = 0; q < ntohs(dns_header->questions); q++) { uint8_t fqdn[DNS_MAX_SIZE]; uint16_t fqdn_offset = 0; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len"); goto insufficient_data; } SCLogDebug("query length %u", *data); while (*data != 0) { if (*data > 63) { /** \todo set event?*/ goto insufficient_data; } uint8_t length = *data; data++; if (length == 0) { break; } if (input + input_len < data + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, data, qry->length); if ((size_t)(fqdn_offset + length + 1) < sizeof(fqdn)) { memcpy(fqdn + fqdn_offset, data, length); fqdn_offset += length; fqdn[fqdn_offset++] = '.'; } else { /** \todo set event? */ goto insufficient_data; } data += length; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len(2)"); goto insufficient_data; } SCLogDebug("qry length %u", *data); } if (fqdn_offset) { fqdn_offset--; } data++; if (input + input_len < data + sizeof(DNSQueryTrailer)) { SCLogDebug("input buffer too small for DNSQueryTrailer"); goto insufficient_data; } DNSQueryTrailer *trailer = (DNSQueryTrailer *)data; SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class)); data += sizeof(DNSQueryTrailer); /* store our data */ if (dns_state != NULL) { DNSStoreQueryInState(dns_state, fqdn, fqdn_offset, ntohs(trailer->type), ntohs(trailer->class), ntohs(dns_header->tx_id)); } } if (dns_state != NULL && f != NULL) { dns_state->last_req = f->lastts; } SCReturnInt(1); bad_data: insufficient_data: SCReturnInt(-1); } /** \internal * \brief DNS UDP record parser, entry function * * Parses a DNS UDP record and fills the DNS state * */ static int DNSUDPResponseParse(Flow *f, void *dstate, AppLayerParserState *pstate, uint8_t *input, uint32_t input_len, void *local_data) { DNSState *dns_state = (DNSState *)dstate; SCLogDebug("starting %u", input_len); if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) { SCReturnInt(1); } /** \todo remove this when PP is fixed to enforce ipproto */ if (f != NULL && f->proto != IPPROTO_UDP) SCReturnInt(-1); if (input == NULL || input_len == 0 || input_len < sizeof(DNSHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSHeader)); goto insufficient_data; } DNSHeader *dns_header = (DNSHeader *)input; SCLogDebug("DNS %p %04x %04x", dns_header, ntohs(dns_header->tx_id), dns_header->flags); DNSTransaction *tx = NULL; int found = 0; if ((tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id))) != NULL) found = 1; if (!found) { SCLogDebug("DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE"); DNSSetEvent(dns_state, DNS_DECODER_EVENT_UNSOLLICITED_RESPONSE); } else if (dns_state->unreplied_cnt > 0) { dns_state->unreplied_cnt--; } if (DNSValidateResponseHeader(dns_state, dns_header) < 0) goto bad_data; SCLogDebug("queries %04x", ntohs(dns_header->questions)); uint16_t q; const uint8_t *data = input + sizeof(DNSHeader); for (q = 0; q < ntohs(dns_header->questions); q++) { uint8_t fqdn[DNS_MAX_SIZE]; uint16_t fqdn_offset = 0; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len"); goto insufficient_data; } SCLogDebug("qry length %u", *data); while (*data != 0) { uint8_t length = *data; data++; if (length == 0) break; if (input + input_len < data + length) { SCLogDebug("input buffer too small for domain of len %u", length); goto insufficient_data; } //PrintRawDataFp(stdout, data, length); if ((size_t)(fqdn_offset + length + 1) < sizeof(fqdn)) { memcpy(fqdn + fqdn_offset, data, length); fqdn_offset += length; fqdn[fqdn_offset++] = '.'; } data += length; if (input + input_len < data + 1) { SCLogDebug("input buffer too small for len"); goto insufficient_data; } SCLogDebug("length %u", *data); } if (fqdn_offset) { fqdn_offset--; } data++; if (input + input_len < data + sizeof(DNSQueryTrailer)) { SCLogDebug("input buffer too small for DNSQueryTrailer"); goto insufficient_data; } #if DEBUG DNSQueryTrailer *trailer = (DNSQueryTrailer *)data; SCLogDebug("trailer type %04x class %04x", ntohs(trailer->type), ntohs(trailer->class)); #endif data += sizeof(DNSQueryTrailer); } SCLogDebug("answer_rr %04x", ntohs(dns_header->answer_rr)); for (q = 0; q < ntohs(dns_header->answer_rr); q++) { data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_ANSWER, input, input_len, data); if (data == NULL) { goto insufficient_data; } } SCLogDebug("authority_rr %04x", ntohs(dns_header->authority_rr)); for (q = 0; q < ntohs(dns_header->authority_rr); q++) { data = DNSReponseParse(dns_state, dns_header, q, DNS_LIST_AUTHORITY, input, input_len, data); if (data == NULL) { goto insufficient_data; } } /* if we previously didn't have a tx, it could have been created by the * above code, so lets check again */ if (tx == NULL) { tx = DNSTransactionFindByTxId(dns_state, ntohs(dns_header->tx_id)); } if (tx != NULL) { /* parse rcode, e.g. "noerror" or "nxdomain" */ uint8_t rcode = ntohs(dns_header->flags) & 0x0F; if (rcode <= DNS_RCODE_NOTZONE) { SCLogDebug("rcode %u", rcode); tx->rcode = rcode; } else { /* this is not invalid, rcodes can be user defined */ SCLogDebug("unexpected DNS rcode %u", rcode); } if (ntohs(dns_header->flags) & 0x0080) { SCLogDebug("recursion desired"); tx->recursion_desired = 1; } tx->replied = 1; } if (f != NULL) { dns_state->last_resp = f->lastts; } SCReturnInt(1); bad_data: insufficient_data: DNSSetEvent(dns_state, DNS_DECODER_EVENT_MALFORMED_DATA); SCReturnInt(-1); } static uint16_t DNSUdpProbingParser(uint8_t *input, uint32_t ilen, uint32_t *offset) { if (ilen == 0 || ilen < sizeof(DNSHeader)) { SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSHeader)); return ALPROTO_UNKNOWN; } if (DNSUDPRequestParse(NULL, NULL, NULL, input, ilen, NULL) == -1) return ALPROTO_FAILED; return ALPROTO_DNS; } static void DNSUDPConfigure(void) { uint32_t request_flood = DNS_CONFIG_DEFAULT_REQUEST_FLOOD; uint32_t state_memcap = DNS_CONFIG_DEFAULT_STATE_MEMCAP; uint64_t global_memcap = DNS_CONFIG_DEFAULT_GLOBAL_MEMCAP; ConfNode *p = ConfGetNode("app-layer.protocols.dns.request-flood"); if (p != NULL) { uint32_t value; if (ParseSizeStringU32(p->val, &value) < 0) { SCLogError(SC_ERR_DNS_CONFIG, "invalid value for request-flood %s", p->val); } else { request_flood = value; } } SCLogConfig("DNS request flood protection level: %u", request_flood); DNSConfigSetRequestFlood(request_flood); p = ConfGetNode("app-layer.protocols.dns.state-memcap"); if (p != NULL) { uint32_t value; if (ParseSizeStringU32(p->val, &value) < 0) { SCLogError(SC_ERR_DNS_CONFIG, "invalid value for state-memcap %s", p->val); } else { state_memcap = value; } } SCLogConfig("DNS per flow memcap (state-memcap): %u", state_memcap); DNSConfigSetStateMemcap(state_memcap); p = ConfGetNode("app-layer.protocols.dns.global-memcap"); if (p != NULL) { uint64_t value; if (ParseSizeStringU64(p->val, &value) < 0) { SCLogError(SC_ERR_DNS_CONFIG, "invalid value for global-memcap %s", p->val); } else { global_memcap = value; } } SCLogConfig("DNS global memcap: %"PRIu64, global_memcap); DNSConfigSetGlobalMemcap(global_memcap); } void RegisterDNSUDPParsers(void) { char *proto_name = "dns"; /** DNS */ if (AppLayerProtoDetectConfProtoDetectionEnabled("udp", proto_name)) { AppLayerProtoDetectRegisterProtocol(ALPROTO_DNS, proto_name); if (RunmodeIsUnittests()) { AppLayerProtoDetectPPRegister(IPPROTO_UDP, "53", ALPROTO_DNS, 0, sizeof(DNSHeader), STREAM_TOSERVER, DNSUdpProbingParser, NULL); } else { int have_cfg = AppLayerProtoDetectPPParseConfPorts("udp", IPPROTO_UDP, proto_name, ALPROTO_DNS, 0, sizeof(DNSHeader), DNSUdpProbingParser, NULL); /* if we have no config, we enable the default port 53 */ if (!have_cfg) { #ifndef AFLFUZZ_APPLAYER SCLogWarning(SC_ERR_DNS_CONFIG, "no DNS UDP config found, " "enabling DNS detection on " "port 53."); #endif AppLayerProtoDetectPPRegister(IPPROTO_UDP, "53", ALPROTO_DNS, 0, sizeof(DNSHeader), STREAM_TOSERVER, DNSUdpProbingParser, NULL); } } } else { SCLogInfo("Protocol detection and parser disabled for %s protocol.", proto_name); return; } if (AppLayerParserConfParserEnabled("udp", proto_name)) { AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DNS, STREAM_TOSERVER, DNSUDPRequestParse); AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_DNS, STREAM_TOCLIENT, DNSUDPResponseParse); AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_DNS, DNSStateAlloc, DNSStateFree); AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_DNS, DNSStateTransactionFree); AppLayerParserRegisterGetEventsFunc(IPPROTO_UDP, ALPROTO_DNS, DNSGetEvents); AppLayerParserRegisterHasEventsFunc(IPPROTO_UDP, ALPROTO_DNS, DNSHasEvents); AppLayerParserRegisterDetectStateFuncs(IPPROTO_UDP, ALPROTO_DNS, DNSStateHasTxDetectState, DNSGetTxDetectState, DNSSetTxDetectState); AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_DNS, DNSGetTx); AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_DNS, DNSGetTxCnt); AppLayerParserRegisterLoggerFuncs(IPPROTO_UDP, ALPROTO_DNS, DNSGetTxLogged, DNSSetTxLogged); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP, ALPROTO_DNS, DNSGetAlstateProgress); AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_DNS, DNSGetAlstateProgressCompletionStatus); DNSAppLayerRegisterGetEventInfo(IPPROTO_UDP, ALPROTO_DNS); DNSUDPConfigure(); } else { SCLogInfo("Parsed disabled for %s protocol. Protocol detection" "still on.", proto_name); } #ifdef UNITTESTS AppLayerParserRegisterProtocolUnittests(IPPROTO_UDP, ALPROTO_DNS, DNSUDPParserRegisterTests); #endif } /* UNITTESTS */ #ifdef UNITTESTS #include "util-unittest-helper.h" static int DNSUDPParserTest01 (void) { /* query: abcdefghijk.com * TTL: 86400 * serial 20130422 refresh 28800 retry 7200 exp 604800 min ttl 86400 * ns, hostmaster */ uint8_t buf[] = { 0x00, 0x3c, 0x85, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x0b, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x0f, 0x00, 0x01, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x01, 0x51, 0x80, 0x00, 0x25, 0x02, 0x6e, 0x73, 0x00, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0xc0, 0x2f, 0x01, 0x33, 0x2a, 0x76, 0x00, 0x00, 0x70, 0x80, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x09, 0x3a, 0x80, 0x00, 0x01, 0x51, 0x80}; size_t buflen = sizeof(buf); Flow *f = NULL; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = DNSStateAlloc(); FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, buf, buflen, NULL)); UTHFreeFlow(f); PASS; } static int DNSUDPParserTest02 (void) { uint8_t buf[] = { 0x6D,0x08,0x84,0x80,0x00,0x01,0x00,0x08,0x00,0x00,0x00,0x01,0x03,0x57,0x57,0x57, 0x04,0x54,0x54,0x54,0x54,0x03,0x56,0x56,0x56,0x03,0x63,0x6F,0x6D,0x02,0x79,0x79, 0x00,0x00,0x01,0x00,0x01,0xC0,0x0C,0x00,0x05,0x00,0x01,0x00,0x00,0x0E,0x10,0x00, 0x02,0xC0,0x0C,0xC0,0x31,0x00,0x05,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x02,0xC0, 0x31,0xC0,0x3F,0x00,0x05,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x02,0xC0,0x3F,0xC0, 0x4D,0x00,0x05,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x02,0xC0,0x4D,0xC0,0x5B,0x00, 0x05,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x02,0xC0,0x5B,0xC0,0x69,0x00,0x05,0x00, 0x01,0x00,0x00,0x0E,0x10,0x00,0x02,0xC0,0x69,0xC0,0x77,0x00,0x05,0x00,0x01,0x00, 0x00,0x0E,0x10,0x00,0x02,0xC0,0x77,0xC0,0x85,0x00,0x05,0x00,0x01,0x00,0x00,0x0E, 0x10,0x00,0x02,0xC0,0x85,0x00,0x00,0x29,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00, }; size_t buflen = sizeof(buf); Flow *f = NULL; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = DNSStateAlloc(); FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, buf, buflen, NULL)); UTHFreeFlow(f); PASS; } static int DNSUDPParserTest03 (void) { uint8_t buf[] = { 0x6F,0xB4,0x84,0x80,0x00,0x01,0x00,0x02,0x00,0x02,0x00,0x03,0x03,0x57,0x57,0x77, 0x0B,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x03,0x55,0x55,0x55, 0x02,0x79,0x79,0x00,0x00,0x01,0x00,0x01,0xC0,0x0C,0x00,0x05,0x00,0x01,0x00,0x00, 0x0E,0x10,0x00,0x02,0xC0,0x10,0xC0,0x34,0x00,0x01,0x00,0x01,0x00,0x00,0x0E,0x10, 0x00,0x04,0xC3,0xEA,0x04,0x19,0xC0,0x34,0x00,0x02,0x00,0x01,0x00,0x00,0x0E,0x10, 0x00,0x0A,0x03,0x6E,0x73,0x31,0x03,0x61,0x67,0x62,0xC0,0x20,0xC0,0x46,0x00,0x02, 0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x06,0x03,0x6E,0x73,0x32,0xC0,0x56,0xC0,0x52, 0x00,0x01,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x04,0xC3,0xEA,0x04,0x0A,0xC0,0x68, 0x00,0x01,0x00,0x01,0x00,0x00,0x0E,0x10,0x00,0x04,0xC3,0xEA,0x05,0x14,0x00,0x00, 0x29,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; size_t buflen = sizeof(buf); Flow *f = NULL; f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = DNSStateAlloc(); FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, buf, buflen, NULL)); UTHFreeFlow(f); PASS; } /** \test TXT records in answer */ static int DNSUDPParserTest04 (void) { uint8_t buf[] = { 0xc2,0x2f,0x81,0x80,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x01,0x0a,0x41,0x41,0x41, 0x41,0x41,0x4f,0x31,0x6b,0x51,0x41,0x05,0x3d,0x61,0x75,0x74,0x68,0x03,0x73,0x72, 0x76,0x06,0x74,0x75,0x6e,0x6e,0x65,0x6c,0x03,0x63,0x6f,0x6d,0x00,0x00,0x10,0x00, 0x01, /* answer record start */ 0xc0,0x0c,0x00,0x10,0x00,0x01,0x00,0x00,0x00,0x03,0x00,0x22, /* txt record starts: */ 0x20, /* proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = DNSStateAlloc(); FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, buf, buflen, NULL)); UTHFreeFlow(f); PASS; } /** \test TXT records in answer, bad txtlen */ static int DNSUDPParserTest05 (void) { uint8_t buf[] = { 0xc2,0x2f,0x81,0x80,0x00,0x01,0x00,0x01,0x00,0x01,0x00,0x01,0x0a,0x41,0x41,0x41, 0x41,0x41,0x4f,0x31,0x6b,0x51,0x41,0x05,0x3d,0x61,0x75,0x74,0x68,0x03,0x73,0x72, 0x76,0x06,0x74,0x75,0x6e,0x6e,0x65,0x6c,0x03,0x63,0x6f,0x6d,0x00,0x00,0x10,0x00, 0x01, /* answer record start */ 0xc0,0x0c,0x00,0x10,0x00,0x01,0x00,0x00,0x00,0x03,0x00,0x22, /* txt record starts: */ 0x40, /* proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = DNSStateAlloc(); FAIL_IF(DNSUDPResponseParse(f, f->alstate, NULL, buf, buflen, NULL) != -1); UTHFreeFlow(f); PASS; } /** * \test Test subsequent requests before response. * * This test sends 2 DNS requests on the same state then sends the response * to the first request checking that it is seen and associated with the * transaction. */ static int DNSUDPParserTestDelayedResponse(void) { /* DNS request: * - Flags: 0x0100 Standard query * - A www.google.com */ uint8_t req[] = { 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, }; size_t reqlen = sizeof(req); /* DNS response: * - Flags: 0x8180 Standard query response, no error * - www.google.com A 24.244.4.56 * - www.google.com A 24.244.4.54 * - www.google.com A 24.244.4.57 * - www.google.com A 24.244.4.55 * - www.google.com A 24.244.4.52 * - www.google.com A 24.244.4.53 * - www.google.com A 24.244.4.58 * - www.google.com A 24.244.4.59 */ uint8_t res[] = { 0x00, 0x01, 0x81, 0x80, 0x00, 0x01, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x38, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x39, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x34, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x35, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x36, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x3b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x37, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x3a }; size_t reslen = sizeof(res); DNSState *state = DNSStateAlloc(); FAIL_IF_NULL(state); Flow *f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = state; /* Send to requests with an incrementing tx id. */ FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); req[1] = 0x02; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); /* Send response to the first request. */ FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, res, reslen, NULL)); DNSTransaction *tx = TAILQ_FIRST(&state->tx_list); FAIL_IF_NULL(tx); FAIL_IF_NOT(tx->replied); /* Also free's state. */ UTHFreeFlow(f); PASS; } /** * \test Test entering the flood/givenup state. */ static int DNSUDPParserTestFlood(void) { /* DNS request: * - Flags: 0x0100 Standard query * - A www.google.com */ uint8_t req[] = { 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, }; size_t reqlen = sizeof(req); DNSState *state = DNSStateAlloc(); FAIL_IF_NULL(state); Flow *f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = state; uint16_t txid; for (txid = 1; txid <= DNS_CONFIG_DEFAULT_REQUEST_FLOOD + 1; txid++) { req[0] = (txid >> 8) & 0xff; req[1] = txid & 0xff; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF(state->givenup); } /* With one more request we should enter a flooded state. */ txid++; req[0] = (txid >> 8) & 0xff; req[1] = txid & 0xff; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF(!state->givenup); /* Also free's state. */ UTHFreeFlow(f); PASS; } static int DNSUDPParserTestLostResponse(void) { /* DNS request: * - Flags: 0x0100 Standard query * - A www.google.com */ uint8_t req[] = { 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, }; size_t reqlen = sizeof(req); uint8_t res[] = { 0x00, 0x01, 0x81, 0x80, 0x00, 0x01, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x38, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x39, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x34, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x35, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x36, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x3b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x37, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x08, 0x00, 0x04, 0x18, 0xf4, 0x04, 0x3a }; size_t reslen = sizeof(res); DNSTransaction *tx; DNSState *state = DNSStateAlloc(); FAIL_IF_NULL(state); Flow *f = UTHBuildFlow(AF_INET, "1.1.1.1", "2.2.2.2", 1024, 53); FAIL_IF_NULL(f); f->proto = IPPROTO_UDP; f->alproto = ALPROTO_DNS; f->alstate = state; /* First request. */ req[1] = 0x01; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF_NOT(state->transaction_max == 1); FAIL_IF_NOT(state->unreplied_cnt == 1); FAIL_IF_NOT(state->window == 1); /* Second request. */ req[1] = 0x02; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF_NOT(state->transaction_max == 2); FAIL_IF_NOT(state->unreplied_cnt == 2); FAIL_IF_NOT(state->window == 2); /* Third request. */ req[1] = 0x03; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF_NOT(state->transaction_max == 3); FAIL_IF_NOT(state->unreplied_cnt == 3); FAIL_IF_NOT(state->window == 3); /* Now respond to the second. */ res[1] = 0x02; FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, res, reslen, NULL)); FAIL_IF_NOT(state->unreplied_cnt == 2); FAIL_IF_NOT(state->window == 3); tx = TAILQ_FIRST(&state->tx_list); FAIL_IF_NULL(tx); FAIL_IF(tx->replied); FAIL_IF(tx->reply_lost); /* Send a 4th request. */ req[1] = 0x04; FAIL_IF_NOT(DNSUDPRequestParse(f, f->alstate, NULL, req, reqlen, NULL)); FAIL_IF_NOT(state->unreplied_cnt == 3); FAIL_IF(state->window != 3); FAIL_IF_NOT(state->transaction_max == 4); /* Response to the third request. */ res[1] = 0x03; FAIL_IF_NOT(DNSUDPResponseParse(f, f->alstate, NULL, res, reslen, NULL)); FAIL_IF_NOT(state->unreplied_cnt == 2); FAIL_IF_NOT(state->window == 3); tx = TAILQ_FIRST(&state->tx_list); FAIL_IF_NULL(tx); FAIL_IF(tx->replied); FAIL_IF(!tx->reply_lost); /* Also free's state. */ UTHFreeFlow(f); PASS; } void DNSUDPParserRegisterTests(void) { UtRegisterTest("DNSUDPParserTest01", DNSUDPParserTest01); UtRegisterTest("DNSUDPParserTest02", DNSUDPParserTest02); UtRegisterTest("DNSUDPParserTest03", DNSUDPParserTest03); UtRegisterTest("DNSUDPParserTest04", DNSUDPParserTest04); UtRegisterTest("DNSUDPParserTest05", DNSUDPParserTest05); UtRegisterTest("DNSUDPParserTestFlood", DNSUDPParserTestFlood); UtRegisterTest("DNSUDPParserTestDelayedResponse", DNSUDPParserTestDelayedResponse); UtRegisterTest("DNSUDPParserTestLostResponse", DNSUDPParserTestLostResponse); } #endif suricata-3.2.1/src/tm-threads.c0000644000000000000000000020364513051004444013227 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * \author Eric Leblond * * Thread management functions. */ #include "suricata-common.h" #include "suricata.h" #include "stream.h" #include "runmodes.h" #include "threadvars.h" #include "tm-queues.h" #include "tm-queuehandlers.h" #include "tm-threads.h" #include "tmqh-packetpool.h" #include "threads.h" #include "util-debug.h" #include "util-privs.h" #include "util-cpu.h" #include "util-optimize.h" #include "util-profiling.h" #include "util-signal.h" #include "queue.h" #ifdef PROFILE_LOCKING __thread uint64_t mutex_lock_contention; __thread uint64_t mutex_lock_wait_ticks; __thread uint64_t mutex_lock_cnt; __thread uint64_t spin_lock_contention; __thread uint64_t spin_lock_wait_ticks; __thread uint64_t spin_lock_cnt; __thread uint64_t rww_lock_contention; __thread uint64_t rww_lock_wait_ticks; __thread uint64_t rww_lock_cnt; __thread uint64_t rwr_lock_contention; __thread uint64_t rwr_lock_wait_ticks; __thread uint64_t rwr_lock_cnt; #endif #ifdef OS_FREEBSD #include #include #include #include #include #define cpu_set_t cpuset_t #endif /* OS_FREEBSD */ /* prototypes */ static int SetCPUAffinity(uint16_t cpu); static void TmThreadDeinitMC(ThreadVars *tv); /* root of the threadvars list */ ThreadVars *tv_root[TVT_MAX] = { NULL }; /* lock to protect tv_root */ SCMutex tv_root_lock = SCMUTEX_INITIALIZER; /** * \brief Check if a thread flag is set. * * \retval 1 flag is set. * \retval 0 flag is not set. */ int TmThreadsCheckFlag(ThreadVars *tv, uint16_t flag) { return (SC_ATOMIC_GET(tv->flags) & flag) ? 1 : 0; } /** * \brief Set a thread flag. */ void TmThreadsSetFlag(ThreadVars *tv, uint16_t flag) { SC_ATOMIC_OR(tv->flags, flag); } /** * \brief Unset a thread flag. */ void TmThreadsUnsetFlag(ThreadVars *tv, uint16_t flag) { SC_ATOMIC_AND(tv->flags, ~flag); } /** * \brief Separate run function so we can call it recursively. * * \todo Deal with post_pq for slots beyond the first. */ TmEcode TmThreadsSlotVarRun(ThreadVars *tv, Packet *p, TmSlot *slot) { TmEcode r; TmSlot *s; Packet *extra_p; for (s = slot; s != NULL; s = s->slot_next) { TmSlotFunc SlotFunc = SC_ATOMIC_GET(s->SlotFunc); PACKET_PROFILING_TMM_START(p, s->tm_id); if (unlikely(s->id == 0)) { r = SlotFunc(tv, p, SC_ATOMIC_GET(s->slot_data), &s->slot_pre_pq, &s->slot_post_pq); } else { r = SlotFunc(tv, p, SC_ATOMIC_GET(s->slot_data), &s->slot_pre_pq, NULL); } PACKET_PROFILING_TMM_END(p, s->tm_id); /* handle error */ if (unlikely(r == TM_ECODE_FAILED)) { /* Encountered error. Return packets to packetpool and return */ TmqhReleasePacketsToPacketPool(&s->slot_pre_pq); SCMutexLock(&s->slot_post_pq.mutex_q); TmqhReleasePacketsToPacketPool(&s->slot_post_pq); SCMutexUnlock(&s->slot_post_pq.mutex_q); TmThreadsSetFlag(tv, THV_FAILED); return TM_ECODE_FAILED; } /* handle new packets */ while (s->slot_pre_pq.top != NULL) { extra_p = PacketDequeue(&s->slot_pre_pq); if (unlikely(extra_p == NULL)) continue; /* see if we need to process the packet */ if (s->slot_next != NULL) { r = TmThreadsSlotVarRun(tv, extra_p, s->slot_next); if (unlikely(r == TM_ECODE_FAILED)) { TmqhReleasePacketsToPacketPool(&s->slot_pre_pq); SCMutexLock(&s->slot_post_pq.mutex_q); TmqhReleasePacketsToPacketPool(&s->slot_post_pq); SCMutexUnlock(&s->slot_post_pq.mutex_q); TmqhOutputPacketpool(tv, extra_p); TmThreadsSetFlag(tv, THV_FAILED); return TM_ECODE_FAILED; } } tv->tmqh_out(tv, extra_p); } } return TM_ECODE_OK; } /** \internal * * \brief Process flow timeout packets * * Process flow timeout pseudo packets. During shutdown this loop * is run until the flow engine kills the thread and the queue is * empty. */ static int TmThreadTimeoutLoop(ThreadVars *tv, TmSlot *s) { TmSlot *stream_slot = NULL, *slot = NULL; int run = 1; int r = TM_ECODE_OK; for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->tm_id == TMM_FLOWWORKER) { stream_slot = slot; break; } } if (tv->stream_pq == NULL || stream_slot == NULL) { SCLogDebug("not running TmThreadTimeoutLoop %p/%p", tv->stream_pq, stream_slot); return r; } SCLogDebug("flow end loop starting"); while(run) { Packet *p; if (tv->stream_pq->len != 0) { SCMutexLock(&tv->stream_pq->mutex_q); p = PacketDequeue(tv->stream_pq); SCMutexUnlock(&tv->stream_pq->mutex_q); BUG_ON(p == NULL); if ((r = TmThreadsSlotProcessPkt(tv, stream_slot, p) != TM_ECODE_OK)) { if (r == TM_ECODE_FAILED) run = 0; } } else { usleep(1); } if (tv->stream_pq->len == 0 && TmThreadsCheckFlag(tv, THV_KILL)) { run = 0; } } SCLogDebug("flow end loop complete"); return r; } /* pcap/nfq pkt read callback process_pkt pfring pkt read process_pkt slot: setup pkt_ack_loop(tv, slot_data) deinit process_pkt: while(s) run s; queue; */ void *TmThreadsSlotPktAcqLoop(void *td) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); ThreadVars *tv = (ThreadVars *)td; TmSlot *s = tv->tm_slots; char run = 1; TmEcode r = TM_ECODE_OK; TmSlot *slot = NULL; /* Set the thread name */ if (SCSetThreadName(tv->name) < 0) { SCLogWarning(SC_ERR_THREAD_INIT, "Unable to set thread name"); } if (tv->thread_setup_flags != 0) TmThreadSetupOptions(tv); /* Drop the capabilities for this thread */ SCDropCaps(tv); PacketPoolInit(); /* check if we are setup properly */ if (s == NULL || s->PktAcqLoop == NULL || tv->tmqh_in == NULL || tv->tmqh_out == NULL) { SCLogError(SC_ERR_FATAL, "TmSlot or ThreadVars badly setup: s=%p," " PktAcqLoop=%p, tmqh_in=%p," " tmqh_out=%p", s, s ? s->PktAcqLoop : NULL, tv->tmqh_in, tv->tmqh_out); TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); pthread_exit((void *) -1); return NULL; } for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->SlotThreadInit != NULL) { void *slot_data = NULL; r = slot->SlotThreadInit(tv, slot->slot_initdata, &slot_data); if (r != TM_ECODE_OK) { if (r == TM_ECODE_DONE) { EngineDone(); TmThreadsSetFlag(tv, THV_CLOSED | THV_INIT_DONE | THV_RUNNING_DONE); goto error; } else { TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); goto error; } } (void)SC_ATOMIC_SET(slot->slot_data, slot_data); } memset(&slot->slot_pre_pq, 0, sizeof(PacketQueue)); SCMutexInit(&slot->slot_pre_pq.mutex_q, NULL); memset(&slot->slot_post_pq, 0, sizeof(PacketQueue)); SCMutexInit(&slot->slot_post_pq.mutex_q, NULL); /* get the 'pre qeueue' from module before the stream module */ if (slot->slot_next != NULL && (slot->slot_next->tm_id == TMM_FLOWWORKER)) { SCLogDebug("pre-stream packetqueue %p (postq)", &s->slot_post_pq); tv->stream_pq = &slot->slot_post_pq; /* if the stream module is the first, get the threads input queue */ } else if (slot == (TmSlot *)tv->tm_slots && (slot->tm_id == TMM_FLOWWORKER)) { tv->stream_pq = &trans_q[tv->inq->id]; SCLogDebug("pre-stream packetqueue %p (inq)", &slot->slot_pre_pq); } } StatsSetupPrivate(tv); TmThreadsSetFlag(tv, THV_INIT_DONE); while(run) { if (TmThreadsCheckFlag(tv, THV_PAUSE)) { TmThreadsSetFlag(tv, THV_PAUSED); TmThreadTestThreadUnPaused(tv); TmThreadsUnsetFlag(tv, THV_PAUSED); } r = s->PktAcqLoop(tv, SC_ATOMIC_GET(s->slot_data), s); if (r == TM_ECODE_FAILED) { TmThreadsSetFlag(tv, THV_FAILED); run = 0; } if (TmThreadsCheckFlag(tv, THV_KILL_PKTACQ) || suricata_ctl_flags) { run = 0; } if (r == TM_ECODE_DONE) { run = 0; } } StatsSyncCounters(tv); TmThreadsSetFlag(tv, THV_FLOW_LOOP); /* process all pseudo packets the flow timeout may throw at us */ TmThreadTimeoutLoop(tv, s); TmThreadsSetFlag(tv, THV_RUNNING_DONE); TmThreadWaitForFlag(tv, THV_DEINIT); PacketPoolDestroy(); for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->SlotThreadExitPrintStats != NULL) { slot->SlotThreadExitPrintStats(tv, SC_ATOMIC_GET(slot->slot_data)); } if (slot->SlotThreadDeinit != NULL) { r = slot->SlotThreadDeinit(tv, SC_ATOMIC_GET(slot->slot_data)); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED); goto error; } } BUG_ON(slot->slot_pre_pq.len); BUG_ON(slot->slot_post_pq.len); } tv->stream_pq = NULL; SCLogDebug("%s ending", tv->name); TmThreadsSetFlag(tv, THV_CLOSED); pthread_exit((void *) 0); return NULL; error: tv->stream_pq = NULL; pthread_exit((void *) -1); return NULL; } #ifdef AFLFUZZ_PCAP_RUNMODE /** \brief simplified loop to speed up AFL * * The loop runs in the caller's thread. No separate thread. */ void *TmThreadsSlotPktAcqLoopAFL(void *td) { SCLogNotice("AFL mode starting"); ThreadVars *tv = (ThreadVars *)td; TmSlot *s = tv->tm_slots; char run = 1; TmEcode r = TM_ECODE_OK; TmSlot *slot = NULL; PacketPoolInit(); /* check if we are setup properly */ if (s == NULL || s->PktAcqLoop == NULL || tv->tmqh_in == NULL || tv->tmqh_out == NULL) { SCLogError(SC_ERR_FATAL, "TmSlot or ThreadVars badly setup: s=%p," " PktAcqLoop=%p, tmqh_in=%p," " tmqh_out=%p", s, s ? s->PktAcqLoop : NULL, tv->tmqh_in, tv->tmqh_out); TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); return NULL; } for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->SlotThreadInit != NULL) { void *slot_data = NULL; r = slot->SlotThreadInit(tv, slot->slot_initdata, &slot_data); if (r != TM_ECODE_OK) { if (r == TM_ECODE_DONE) { EngineDone(); TmThreadsSetFlag(tv, THV_CLOSED | THV_INIT_DONE | THV_RUNNING_DONE); goto error; } else { TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); goto error; } } (void)SC_ATOMIC_SET(slot->slot_data, slot_data); } memset(&slot->slot_pre_pq, 0, sizeof(PacketQueue)); SCMutexInit(&slot->slot_pre_pq.mutex_q, NULL); memset(&slot->slot_post_pq, 0, sizeof(PacketQueue)); SCMutexInit(&slot->slot_post_pq.mutex_q, NULL); /* get the 'pre qeueue' from module before the stream module */ if (slot->slot_next != NULL && (slot->slot_next->tm_id == TMM_FLOWWORKER)) { SCLogDebug("pre-stream packetqueue %p (postq)", &s->slot_post_pq); tv->stream_pq = &slot->slot_post_pq; /* if the stream module is the first, get the threads input queue */ } else if (slot == (TmSlot *)tv->tm_slots && (slot->tm_id == TMM_FLOWWORKER)) { tv->stream_pq = &trans_q[tv->inq->id]; SCLogDebug("pre-stream packetqueue %p (inq)", &slot->slot_pre_pq); } } StatsSetupPrivate(tv); TmThreadsSetFlag(tv, THV_INIT_DONE); while(run) { /* run right away */ r = s->PktAcqLoop(tv, SC_ATOMIC_GET(s->slot_data), s); if (r == TM_ECODE_FAILED) { TmThreadsSetFlag(tv, THV_FAILED); run = 0; } if (TmThreadsCheckFlag(tv, THV_KILL_PKTACQ) || suricata_ctl_flags) { run = 0; } if (r == TM_ECODE_DONE) { run = 0; } } StatsSyncCounters(tv); TmThreadsSetFlag(tv, THV_FLOW_LOOP); TmThreadsSetFlag(tv, THV_RUNNING_DONE); PacketPoolDestroy(); for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->SlotThreadExitPrintStats != NULL) { slot->SlotThreadExitPrintStats(tv, SC_ATOMIC_GET(slot->slot_data)); } if (slot->SlotThreadDeinit != NULL) { r = slot->SlotThreadDeinit(tv, SC_ATOMIC_GET(slot->slot_data)); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED); goto error; } } BUG_ON(slot->slot_pre_pq.len); BUG_ON(slot->slot_post_pq.len); } tv->stream_pq = NULL; SCLogDebug("%s ending", tv->name); TmThreadsSetFlag(tv, THV_CLOSED); return NULL; error: tv->stream_pq = NULL; return NULL; } #endif /** * \todo Only the first "slot" currently makes the "post_pq" available * to the thread module. */ void *TmThreadsSlotVar(void *td) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); ThreadVars *tv = (ThreadVars *)td; TmSlot *s = (TmSlot *)tv->tm_slots; Packet *p = NULL; char run = 1; TmEcode r = TM_ECODE_OK; PacketPoolInitEmpty(); /* Set the thread name */ if (SCSetThreadName(tv->name) < 0) { SCLogWarning(SC_ERR_THREAD_INIT, "Unable to set thread name"); } if (tv->thread_setup_flags != 0) TmThreadSetupOptions(tv); /* Drop the capabilities for this thread */ SCDropCaps(tv); /* check if we are setup properly */ if (s == NULL || tv->tmqh_in == NULL || tv->tmqh_out == NULL) { TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); pthread_exit((void *) -1); return NULL; } for (; s != NULL; s = s->slot_next) { if (s->SlotThreadInit != NULL) { void *slot_data = NULL; r = s->SlotThreadInit(tv, s->slot_initdata, &slot_data); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); goto error; } (void)SC_ATOMIC_SET(s->slot_data, slot_data); } memset(&s->slot_pre_pq, 0, sizeof(PacketQueue)); SCMutexInit(&s->slot_pre_pq.mutex_q, NULL); memset(&s->slot_post_pq, 0, sizeof(PacketQueue)); SCMutexInit(&s->slot_post_pq.mutex_q, NULL); /* special case: we need to access the stream queue * from the flow timeout code */ /* get the 'pre qeueue' from module before the stream module */ if (s->slot_next != NULL && (s->slot_next->tm_id == TMM_FLOWWORKER)) { SCLogDebug("pre-stream packetqueue %p (preq)", &s->slot_pre_pq); tv->stream_pq = &s->slot_pre_pq; /* if the stream module is the first, get the threads input queue */ } else if (s == (TmSlot *)tv->tm_slots && (s->tm_id == TMM_FLOWWORKER)) { tv->stream_pq = &trans_q[tv->inq->id]; SCLogDebug("pre-stream packetqueue %p (inq)", &s->slot_pre_pq); } } StatsSetupPrivate(tv); TmThreadsSetFlag(tv, THV_INIT_DONE); s = (TmSlot *)tv->tm_slots; while (run) { if (TmThreadsCheckFlag(tv, THV_PAUSE)) { TmThreadsSetFlag(tv, THV_PAUSED); TmThreadTestThreadUnPaused(tv); TmThreadsUnsetFlag(tv, THV_PAUSED); } /* input a packet */ p = tv->tmqh_in(tv); if (p != NULL) { /* run the thread module(s) */ r = TmThreadsSlotVarRun(tv, p, s); if (r == TM_ECODE_FAILED) { TmqhOutputPacketpool(tv, p); TmThreadsSetFlag(tv, THV_FAILED); break; } /* output the packet */ tv->tmqh_out(tv, p); } /* if (p != NULL) */ /* now handle the post_pq packets */ TmSlot *slot; for (slot = s; slot != NULL; slot = slot->slot_next) { if (slot->slot_post_pq.top != NULL) { while (1) { SCMutexLock(&slot->slot_post_pq.mutex_q); Packet *extra_p = PacketDequeue(&slot->slot_post_pq); SCMutexUnlock(&slot->slot_post_pq.mutex_q); if (extra_p == NULL) break; if (slot->slot_next != NULL) { r = TmThreadsSlotVarRun(tv, extra_p, slot->slot_next); if (r == TM_ECODE_FAILED) { SCMutexLock(&slot->slot_post_pq.mutex_q); TmqhReleasePacketsToPacketPool(&slot->slot_post_pq); SCMutexUnlock(&slot->slot_post_pq.mutex_q); TmqhOutputPacketpool(tv, extra_p); TmThreadsSetFlag(tv, THV_FAILED); break; } } /* output the packet */ tv->tmqh_out(tv, extra_p); } /* while */ } /* if */ } /* for */ if (TmThreadsCheckFlag(tv, THV_KILL)) { run = 0; } } /* while (run) */ StatsSyncCounters(tv); TmThreadsSetFlag(tv, THV_RUNNING_DONE); TmThreadWaitForFlag(tv, THV_DEINIT); PacketPoolDestroy(); s = (TmSlot *)tv->tm_slots; for ( ; s != NULL; s = s->slot_next) { if (s->SlotThreadExitPrintStats != NULL) { s->SlotThreadExitPrintStats(tv, SC_ATOMIC_GET(s->slot_data)); } if (s->SlotThreadDeinit != NULL) { r = s->SlotThreadDeinit(tv, SC_ATOMIC_GET(s->slot_data)); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED); goto error; } } BUG_ON(s->slot_pre_pq.len); BUG_ON(s->slot_post_pq.len); } SCLogDebug("%s ending", tv->name); tv->stream_pq = NULL; TmThreadsSetFlag(tv, THV_CLOSED); pthread_exit((void *) 0); return NULL; error: tv->stream_pq = NULL; pthread_exit((void *) -1); return NULL; } static void *TmThreadsManagement(void *td) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); ThreadVars *tv = (ThreadVars *)td; TmSlot *s = (TmSlot *)tv->tm_slots; TmEcode r = TM_ECODE_OK; BUG_ON(s == NULL); /* Set the thread name */ if (SCSetThreadName(tv->name) < 0) { SCLogWarning(SC_ERR_THREAD_INIT, "Unable to set thread name"); } if (tv->thread_setup_flags != 0) TmThreadSetupOptions(tv); /* Drop the capabilities for this thread */ SCDropCaps(tv); SCLogDebug("%s starting", tv->name); if (s->SlotThreadInit != NULL) { void *slot_data = NULL; r = s->SlotThreadInit(tv, s->slot_initdata, &slot_data); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED | THV_RUNNING_DONE); pthread_exit((void *) -1); return NULL; } (void)SC_ATOMIC_SET(s->slot_data, slot_data); } memset(&s->slot_pre_pq, 0, sizeof(PacketQueue)); memset(&s->slot_post_pq, 0, sizeof(PacketQueue)); StatsSetupPrivate(tv); TmThreadsSetFlag(tv, THV_INIT_DONE); r = s->Management(tv, SC_ATOMIC_GET(s->slot_data)); /* handle error */ if (r == TM_ECODE_FAILED) { TmThreadsSetFlag(tv, THV_FAILED); } if (TmThreadsCheckFlag(tv, THV_KILL)) { StatsSyncCounters(tv); } TmThreadsSetFlag(tv, THV_RUNNING_DONE); TmThreadWaitForFlag(tv, THV_DEINIT); if (s->SlotThreadExitPrintStats != NULL) { s->SlotThreadExitPrintStats(tv, SC_ATOMIC_GET(s->slot_data)); } if (s->SlotThreadDeinit != NULL) { r = s->SlotThreadDeinit(tv, SC_ATOMIC_GET(s->slot_data)); if (r != TM_ECODE_OK) { TmThreadsSetFlag(tv, THV_CLOSED); pthread_exit((void *) -1); return NULL; } } TmThreadsSetFlag(tv, THV_CLOSED); pthread_exit((void *) 0); return NULL; } /** * \brief We set the slot functions. * * \param tv Pointer to the TV to set the slot function for. * \param name Name of the slot variant. * \param fn_p Pointer to a custom slot function. Used only if slot variant * "name" is "custom". * * \retval TmEcode TM_ECODE_OK on success; TM_ECODE_FAILED on failure. */ TmEcode TmThreadSetSlots(ThreadVars *tv, char *name, void *(*fn_p)(void *)) { if (name == NULL) { if (fn_p == NULL) { printf("Both slot name and function pointer can't be NULL inside " "TmThreadSetSlots\n"); goto error; } else { name = "custom"; } } if (strcmp(name, "varslot") == 0) { tv->tm_func = TmThreadsSlotVar; } else if (strcmp(name, "pktacqloop") == 0) { #ifndef AFLFUZZ_PCAP_RUNMODE tv->tm_func = TmThreadsSlotPktAcqLoop; #else tv->tm_func = TmThreadsSlotPktAcqLoopAFL; #endif } else if (strcmp(name, "management") == 0) { tv->tm_func = TmThreadsManagement; } else if (strcmp(name, "command") == 0) { tv->tm_func = TmThreadsManagement; } else if (strcmp(name, "custom") == 0) { if (fn_p == NULL) goto error; tv->tm_func = fn_p; } else { printf("Error: Slot \"%s\" not supported\n", name); goto error; } return TM_ECODE_OK; error: return TM_ECODE_FAILED; } ThreadVars *TmThreadsGetTVContainingSlot(TmSlot *tm_slot) { ThreadVars *tv; int i; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv) { TmSlot *slots = tv->tm_slots; while (slots != NULL) { if (slots == tm_slot) { SCMutexUnlock(&tv_root_lock); return tv; } slots = slots->slot_next; } tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return NULL; } /** * \brief Appends a new entry to the slots. * * \param tv TV the slot is attached to. * \param tm TM to append. * \param data Data to be passed on to the slot init function. * * \retval The allocated TmSlot or NULL if there is an error */ static inline TmSlot * _TmSlotSetFuncAppend(ThreadVars *tv, TmModule *tm, void *data) { TmSlot *slot = SCMalloc(sizeof(TmSlot)); if (unlikely(slot == NULL)) return NULL; memset(slot, 0, sizeof(TmSlot)); SC_ATOMIC_INIT(slot->slot_data); slot->tv = tv; slot->SlotThreadInit = tm->ThreadInit; slot->slot_initdata = data; SC_ATOMIC_INIT(slot->SlotFunc); (void)SC_ATOMIC_SET(slot->SlotFunc, tm->Func); slot->PktAcqLoop = tm->PktAcqLoop; slot->Management = tm->Management; slot->SlotThreadExitPrintStats = tm->ThreadExitPrintStats; slot->SlotThreadDeinit = tm->ThreadDeinit; /* we don't have to check for the return value "-1". We wouldn't have * received a TM as arg, if it didn't exist */ slot->tm_id = TmModuleGetIDForTM(tm); tv->tmm_flags |= tm->flags; tv->cap_flags |= tm->cap_flags; if (tv->tm_slots == NULL) { tv->tm_slots = slot; slot->id = 0; } else { TmSlot *a = (TmSlot *)tv->tm_slots, *b = NULL; /* get the last slot */ for ( ; a != NULL; a = a->slot_next) { b = a; } /* append the new slot */ if (b != NULL) { b->slot_next = slot; slot->id = b->id + 1; } } return slot; } void TmSlotFree(TmSlot *tms) { SC_ATOMIC_DESTROY(tms->slot_data); SCFree(tms); } /** * \brief Appends a new entry to the slots. * * \param tv TV the slot is attached to. * \param tm TM to append. * \param data Data to be passed on to the slot init function. */ void TmSlotSetFuncAppend(ThreadVars *tv, TmModule *tm, void *data) { _TmSlotSetFuncAppend(tv, tm, data); } /** * \brief Returns the slot holding a TM with the particular tm_id. * * \param tm_id TM id of the TM whose slot has to be returned. * * \retval slots Pointer to the slot. */ TmSlot *TmSlotGetSlotForTM(int tm_id) { ThreadVars *tv = NULL; TmSlot *slots; int i; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv) { slots = tv->tm_slots; while (slots != NULL) { if (slots->tm_id == tm_id) { SCMutexUnlock(&tv_root_lock); return slots; } slots = slots->slot_next; } tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return NULL; } #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun static int SetCPUAffinitySet(cpu_set_t *cs) { #if defined OS_FREEBSD int r = cpuset_setaffinity(CPU_LEVEL_WHICH, CPU_WHICH_TID, SCGetThreadIdLong(), sizeof(cpu_set_t),cs); #elif OS_DARWIN int r = thread_policy_set(mach_thread_self(), THREAD_AFFINITY_POLICY, (void*)cs, THREAD_AFFINITY_POLICY_COUNT); #else pid_t tid = syscall(SYS_gettid); int r = sched_setaffinity(tid, sizeof(cpu_set_t), cs); #endif /* OS_FREEBSD */ if (r != 0) { printf("Warning: sched_setaffinity failed (%" PRId32 "): %s\n", r, strerror(errno)); return -1; } return 0; } #endif /** * \brief Set the thread affinity on the calling thread. * * \param cpuid Id of the core/cpu to setup the affinity. * * \retval 0 If all goes well; -1 if something is wrong. */ static int SetCPUAffinity(uint16_t cpuid) { #if defined __OpenBSD__ || defined sun return 0; #else int cpu = (int)cpuid; #if defined OS_WIN32 || defined __CYGWIN__ DWORD cs = 1 << cpu; int r = (0 == SetThreadAffinityMask(GetCurrentThread(), cs)); if (r != 0) { printf("Warning: sched_setaffinity failed (%" PRId32 "): %s\n", r, strerror(errno)); return -1; } SCLogDebug("CPU Affinity for thread %lu set to CPU %" PRId32, SCGetThreadIdLong(), cpu); return 0; #else cpu_set_t cs; CPU_ZERO(&cs); CPU_SET(cpu, &cs); return SetCPUAffinitySet(&cs); #endif /* windows */ #endif /* not supported */ } /** * \brief Set the thread options (thread priority). * * \param tv Pointer to the ThreadVars to setup the thread priority. * * \retval TM_ECODE_OK. */ TmEcode TmThreadSetThreadPriority(ThreadVars *tv, int prio) { tv->thread_setup_flags |= THREAD_SET_PRIORITY; tv->thread_priority = prio; return TM_ECODE_OK; } /** * \brief Adjusting nice value for threads. */ void TmThreadSetPrio(ThreadVars *tv) { SCEnter(); #ifndef __CYGWIN__ #ifdef OS_WIN32 if (0 == SetThreadPriority(GetCurrentThread(), tv->thread_priority)) { SCLogError(SC_ERR_THREAD_NICE_PRIO, "Error setting priority for " "thread %s: %s", tv->name, strerror(errno)); } else { SCLogDebug("Priority set to %"PRId32" for thread %s", tv->thread_priority, tv->name); } #else int ret = nice(tv->thread_priority); if (ret == -1) { SCLogError(SC_ERR_THREAD_NICE_PRIO, "Error setting nice value %d " "for thread %s: %s", tv->thread_priority, tv->name, strerror(errno)); } else { SCLogDebug("Nice value set to %"PRId32" for thread %s", tv->thread_priority, tv->name); } #endif /* OS_WIN32 */ #endif SCReturn; } /** * \brief Set the thread options (cpu affinity). * * \param tv pointer to the ThreadVars to setup the affinity. * \param cpu cpu on which affinity is set. * * \retval TM_ECODE_OK */ TmEcode TmThreadSetCPUAffinity(ThreadVars *tv, uint16_t cpu) { tv->thread_setup_flags |= THREAD_SET_AFFINITY; tv->cpu_affinity = cpu; return TM_ECODE_OK; } TmEcode TmThreadSetCPU(ThreadVars *tv, uint8_t type) { if (!threading_set_cpu_affinity) return TM_ECODE_OK; if (type > MAX_CPU_SET) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid cpu type family"); return TM_ECODE_FAILED; } tv->thread_setup_flags |= THREAD_SET_AFFTYPE; tv->cpu_affinity = type; return TM_ECODE_OK; } int TmThreadGetNbThreads(uint8_t type) { if (type >= MAX_CPU_SET) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid cpu type family"); return 0; } return thread_affinity[type].nb_threads; } /** * \brief Set the thread options (cpu affinitythread). * Priority should be already set by pthread_create. * * \param tv pointer to the ThreadVars of the calling thread. */ TmEcode TmThreadSetupOptions(ThreadVars *tv) { if (tv->thread_setup_flags & THREAD_SET_AFFINITY) { SCLogPerf("Setting affinity for thread \"%s\"to cpu/core " "%"PRIu16", thread id %lu", tv->name, tv->cpu_affinity, SCGetThreadIdLong()); SetCPUAffinity(tv->cpu_affinity); } #if !defined __CYGWIN__ && !defined OS_WIN32 && !defined __OpenBSD__ && !defined sun if (tv->thread_setup_flags & THREAD_SET_PRIORITY) TmThreadSetPrio(tv); if (tv->thread_setup_flags & THREAD_SET_AFFTYPE) { ThreadsAffinityType *taf = &thread_affinity[tv->cpu_affinity]; if (taf->mode_flag == EXCLUSIVE_AFFINITY) { int cpu = AffinityGetNextCPU(taf); SetCPUAffinity(cpu); /* If CPU is in a set overwrite the default thread prio */ if (CPU_ISSET(cpu, &taf->lowprio_cpu)) { tv->thread_priority = PRIO_LOW; } else if (CPU_ISSET(cpu, &taf->medprio_cpu)) { tv->thread_priority = PRIO_MEDIUM; } else if (CPU_ISSET(cpu, &taf->hiprio_cpu)) { tv->thread_priority = PRIO_HIGH; } else { tv->thread_priority = taf->prio; } SCLogPerf("Setting prio %d for thread \"%s\" to cpu/core " "%d, thread id %lu", tv->thread_priority, tv->name, cpu, SCGetThreadIdLong()); } else { SetCPUAffinitySet(&taf->cpu_set); tv->thread_priority = taf->prio; SCLogPerf("Setting prio %d for thread \"%s\", " "thread id %lu", tv->thread_priority, tv->name, SCGetThreadIdLong()); } TmThreadSetPrio(tv); } #endif return TM_ECODE_OK; } /** * \brief Creates and returns the TV instance for a new thread. * * \param name Name of this TV instance * \param inq_name Incoming queue name * \param inqh_name Incoming queue handler name as set by TmqhSetup() * \param outq_name Outgoing queue name * \param outqh_name Outgoing queue handler as set by TmqhSetup() * \param slots String representation for the slot function to be used * \param fn_p Pointer to function when \"slots\" is of type \"custom\" * \param mucond Flag to indicate whether to initialize the condition * and the mutex variables for this newly created TV. * * \retval the newly created TV instance, or NULL on error */ ThreadVars *TmThreadCreate(const char *name, char *inq_name, char *inqh_name, char *outq_name, char *outqh_name, char *slots, void * (*fn_p)(void *), int mucond) { ThreadVars *tv = NULL; Tmq *tmq = NULL; Tmqh *tmqh = NULL; SCLogDebug("creating thread \"%s\"...", name); /* XXX create separate function for this: allocate a thread container */ tv = SCMalloc(sizeof(ThreadVars)); if (unlikely(tv == NULL)) goto error; memset(tv, 0, sizeof(ThreadVars)); SC_ATOMIC_INIT(tv->flags); SCMutexInit(&tv->perf_public_ctx.m, NULL); strlcpy(tv->name, name, sizeof(tv->name)); /* default state for every newly created thread */ TmThreadsSetFlag(tv, THV_PAUSE); TmThreadsSetFlag(tv, THV_USE); /* set the incoming queue */ if (inq_name != NULL && strcmp(inq_name, "packetpool") != 0) { SCLogDebug("inq_name \"%s\"", inq_name); tmq = TmqGetQueueByName(inq_name); if (tmq == NULL) { tmq = TmqCreateQueue(inq_name); if (tmq == NULL) goto error; } SCLogDebug("tmq %p", tmq); tv->inq = tmq; tv->inq->reader_cnt++; SCLogDebug("tv->inq %p", tv->inq); } if (inqh_name != NULL) { SCLogDebug("inqh_name \"%s\"", inqh_name); tmqh = TmqhGetQueueHandlerByName(inqh_name); if (tmqh == NULL) goto error; tv->tmqh_in = tmqh->InHandler; tv->InShutdownHandler = tmqh->InShutdownHandler; SCLogDebug("tv->tmqh_in %p", tv->tmqh_in); } /* set the outgoing queue */ if (outqh_name != NULL) { SCLogDebug("outqh_name \"%s\"", outqh_name); tmqh = TmqhGetQueueHandlerByName(outqh_name); if (tmqh == NULL) goto error; tv->tmqh_out = tmqh->OutHandler; tv->outqh_name = tmqh->name; if (outq_name != NULL && strcmp(outq_name, "packetpool") != 0) { SCLogDebug("outq_name \"%s\"", outq_name); if (tmqh->OutHandlerCtxSetup != NULL) { tv->outctx = tmqh->OutHandlerCtxSetup(outq_name); if (tv->outctx == NULL) goto error; tv->outq = NULL; } else { tmq = TmqGetQueueByName(outq_name); if (tmq == NULL) { tmq = TmqCreateQueue(outq_name); if (tmq == NULL) goto error; } SCLogDebug("tmq %p", tmq); tv->outq = tmq; tv->outctx = NULL; tv->outq->writer_cnt++; } } } if (TmThreadSetSlots(tv, slots, fn_p) != TM_ECODE_OK) { goto error; } if (mucond != 0) TmThreadInitMC(tv); return tv; error: SCLogError(SC_ERR_THREAD_CREATE, "failed to setup a thread"); if (tv != NULL) SCFree(tv); return NULL; } /** * \brief Creates and returns a TV instance for a Packet Processing Thread. * This function doesn't support custom slots, and hence shouldn't be * supplied \"custom\" as its slot type. All PPT threads are created * with a mucond(see TmThreadCreate declaration) of 0. Hence the tv * conditional variables are not used to kill the thread. * * \param name Name of this TV instance * \param inq_name Incoming queue name * \param inqh_name Incoming queue handler name as set by TmqhSetup() * \param outq_name Outgoing queue name * \param outqh_name Outgoing queue handler as set by TmqhSetup() * \param slots String representation for the slot function to be used * * \retval the newly created TV instance, or NULL on error */ ThreadVars *TmThreadCreatePacketHandler(const char *name, char *inq_name, char *inqh_name, char *outq_name, char *outqh_name, char *slots) { ThreadVars *tv = NULL; tv = TmThreadCreate(name, inq_name, inqh_name, outq_name, outqh_name, slots, NULL, 0); if (tv != NULL) { tv->type = TVT_PPT; tv->id = TmThreadsRegisterThread(tv, tv->type); } return tv; } /** * \brief Creates and returns the TV instance for a Management thread(MGMT). * This function supports only custom slot functions and hence a * function pointer should be sent as an argument. * * \param name Name of this TV instance * \param fn_p Pointer to function when \"slots\" is of type \"custom\" * \param mucond Flag to indicate whether to initialize the condition * and the mutex variables for this newly created TV. * * \retval the newly created TV instance, or NULL on error */ ThreadVars *TmThreadCreateMgmtThread(const char *name, void *(fn_p)(void *), int mucond) { ThreadVars *tv = NULL; tv = TmThreadCreate(name, NULL, NULL, NULL, NULL, "custom", fn_p, mucond); if (tv != NULL) { tv->type = TVT_MGMT; tv->id = TmThreadsRegisterThread(tv, tv->type); TmThreadSetCPU(tv, MANAGEMENT_CPU_SET); } return tv; } /** * \brief Creates and returns the TV instance for a Management thread(MGMT). * This function supports only custom slot functions and hence a * function pointer should be sent as an argument. * * \param name Name of this TV instance * \param module Name of TmModule with MANAGEMENT flag set. * \param mucond Flag to indicate whether to initialize the condition * and the mutex variables for this newly created TV. * * \retval the newly created TV instance, or NULL on error */ ThreadVars *TmThreadCreateMgmtThreadByName(const char *name, char *module, int mucond) { ThreadVars *tv = NULL; tv = TmThreadCreate(name, NULL, NULL, NULL, NULL, "management", NULL, mucond); if (tv != NULL) { tv->type = TVT_MGMT; tv->id = TmThreadsRegisterThread(tv, tv->type); TmThreadSetCPU(tv, MANAGEMENT_CPU_SET); TmModule *m = TmModuleGetByName(module); if (m) { TmSlotSetFuncAppend(tv, m, NULL); } } return tv; } /** * \brief Creates and returns the TV instance for a Command thread (CMD). * This function supports only custom slot functions and hence a * function pointer should be sent as an argument. * * \param name Name of this TV instance * \param module Name of TmModule with COMMAND flag set. * \param mucond Flag to indicate whether to initialize the condition * and the mutex variables for this newly created TV. * * \retval the newly created TV instance, or NULL on error */ ThreadVars *TmThreadCreateCmdThreadByName(const char *name, char *module, int mucond) { ThreadVars *tv = NULL; tv = TmThreadCreate(name, NULL, NULL, NULL, NULL, "command", NULL, mucond); if (tv != NULL) { tv->type = TVT_CMD; tv->id = TmThreadsRegisterThread(tv, tv->type); TmThreadSetCPU(tv, MANAGEMENT_CPU_SET); TmModule *m = TmModuleGetByName(module); if (m) { TmSlotSetFuncAppend(tv, m, NULL); } } return tv; } /** * \brief Appends this TV to tv_root based on its type * * \param type holds the type this TV belongs to. */ void TmThreadAppend(ThreadVars *tv, int type) { SCMutexLock(&tv_root_lock); if (tv_root[type] == NULL) { tv_root[type] = tv; tv->next = NULL; tv->prev = NULL; SCMutexUnlock(&tv_root_lock); return; } ThreadVars *t = tv_root[type]; while (t) { if (t->next == NULL) { t->next = tv; tv->prev = t; tv->next = NULL; break; } t = t->next; } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Removes this TV from tv_root based on its type * * \param tv The tv instance to remove from the global tv list. * \param type Holds the type this TV belongs to. */ void TmThreadRemove(ThreadVars *tv, int type) { SCMutexLock(&tv_root_lock); if (tv_root[type] == NULL) { SCMutexUnlock(&tv_root_lock); return; } ThreadVars *t = tv_root[type]; while (t != tv) { t = t->next; } if (t != NULL) { if (t->prev != NULL) t->prev->next = t->next; if (t->next != NULL) t->next->prev = t->prev; if (t == tv_root[type]) tv_root[type] = t->next;; } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Kill a thread. * * \param tv A ThreadVars instance corresponding to the thread that has to be * killed. */ void TmThreadKillThread(ThreadVars *tv) { int i = 0; if (tv == NULL) return; if (tv->inq != NULL) { /* we wait till we dry out all the inq packets, before we * kill this thread. Do note that you should have disabled * packet acquire by now using TmThreadDisableReceiveThreads()*/ if (!(strlen(tv->inq->name) == strlen("packetpool") && strcasecmp(tv->inq->name, "packetpool") == 0)) { PacketQueue *q = &trans_q[tv->inq->id]; while (q->len != 0) { usleep(1000); } } } /* set the thread flag informing the thread that it needs to be * terminated */ TmThreadsSetFlag(tv, THV_KILL); TmThreadsSetFlag(tv, THV_DEINIT); /* to be sure, signal more */ int cnt = 0; while (1) { if (TmThreadsCheckFlag(tv, THV_CLOSED)) { SCLogDebug("signalled the thread %" PRId32 " times", cnt); break; } cnt++; if (tv->InShutdownHandler != NULL) { tv->InShutdownHandler(tv); } if (tv->inq != NULL) { for (i = 0; i < (tv->inq->reader_cnt + tv->inq->writer_cnt); i++) { if (tv->inq->q_type == 0) SCCondSignal(&trans_q[tv->inq->id].cond_q); else SCCondSignal(&data_queues[tv->inq->id].cond_q); } SCLogDebug("signalled tv->inq->id %" PRIu32 "", tv->inq->id); } if (tv->ctrl_cond != NULL ) { pthread_cond_broadcast(tv->ctrl_cond); } usleep(100); } if (tv->outctx != NULL) { Tmqh *tmqh = TmqhGetQueueHandlerByName(tv->outqh_name); if (tmqh == NULL) BUG_ON(1); if (tmqh->OutHandlerCtxFree != NULL) { tmqh->OutHandlerCtxFree(tv->outctx); } } /* join it */ pthread_join(tv->t, NULL); SCLogDebug("thread %s stopped", tv->name); return; } /** \internal * * \brief make sure that all packet threads are done processing their * in-flight packets */ static void TmThreadDrainPacketThreads(void) { /* value in seconds */ #define THREAD_KILL_MAX_WAIT_TIME 60 /* value in microseconds */ #define WAIT_TIME 1000 uint64_t total_wait_time = 0; ThreadVars *tv = NULL; again: if (total_wait_time > (THREAD_KILL_MAX_WAIT_TIME * 1000000)) { SCLogWarning(SC_ERR_SHUTDOWN, "unable to get all packet threads " "to process their packets in time"); return; } SCMutexLock(&tv_root_lock); /* all receive threads are part of packet processing threads */ tv = tv_root[TVT_PPT]; while (tv) { if (tv->inq != NULL) { /* we wait till we dry out all the inq packets, before we * kill this thread. Do note that you should have disabled * packet acquire by now using TmThreadDisableReceiveThreads()*/ if (!(strlen(tv->inq->name) == strlen("packetpool") && strcasecmp(tv->inq->name, "packetpool") == 0)) { PacketQueue *q = &trans_q[tv->inq->id]; if (q->len != 0) { SCMutexUnlock(&tv_root_lock); total_wait_time += WAIT_TIME; /* don't sleep while holding a lock */ usleep(WAIT_TIME); goto again; } } } tv = tv->next; } SCMutexUnlock(&tv_root_lock); return; #undef THREAD_KILL_MAX_WAIT_TIME #undef WAIT_TIME } /** * \brief Disable all threads having the specified TMs. * * Breaks out of the packet acquisition loop, and bumps * into the 'flow loop', where it will process packets * from the flow engine's shutdown handling. */ void TmThreadDisableReceiveThreads(void) { /* value in seconds */ #define THREAD_KILL_MAX_WAIT_TIME 60 /* value in microseconds */ #define WAIT_TIME 100 double total_wait_time = 0; ThreadVars *tv = NULL; again: SCMutexLock(&tv_root_lock); /* all receive threads are part of packet processing threads */ tv = tv_root[TVT_PPT]; /* we do have to keep in mind that TVs are arranged in the order * right from receive to log. The moment we fail to find a * receive TM amongst the slots in a tv, it indicates we are done * with all receive threads */ while (tv) { int disable = 0; TmModule *tm = NULL; /* obtain the slots for this TV */ TmSlot *slots = tv->tm_slots; while (slots != NULL) { tm = TmModuleGetById(slots->tm_id); if (tm->flags & TM_FLAG_RECEIVE_TM) { disable = 1; break; } slots = slots->slot_next; continue; } if (disable) { if (tv->inq != NULL) { /* we wait till we dry out all the inq packets, before we * kill this thread. Do note that you should have disabled * packet acquire by now using TmThreadDisableReceiveThreads()*/ if (!(strlen(tv->inq->name) == strlen("packetpool") && strcasecmp(tv->inq->name, "packetpool") == 0)) { PacketQueue *q = &trans_q[tv->inq->id]; if (q->len != 0) { SCMutexUnlock(&tv_root_lock); /* don't sleep while holding a lock */ usleep(1000); goto again; } } } /* we found a receive TV. Send it a KILL_PKTACQ signal. */ if (tm && tm->PktAcqBreakLoop != NULL) { tm->PktAcqBreakLoop(tv, SC_ATOMIC_GET(slots->slot_data)); } TmThreadsSetFlag(tv, THV_KILL_PKTACQ); if (tv->inq != NULL) { int i; for (i = 0; i < (tv->inq->reader_cnt + tv->inq->writer_cnt); i++) { if (tv->inq->q_type == 0) SCCondSignal(&trans_q[tv->inq->id].cond_q); else SCCondSignal(&data_queues[tv->inq->id].cond_q); } SCLogDebug("signalled tv->inq->id %" PRIu32 "", tv->inq->id); } /* wait for it to enter the 'flow loop' stage */ while (!TmThreadsCheckFlag(tv, THV_FLOW_LOOP)) { usleep(WAIT_TIME); total_wait_time += WAIT_TIME / 1000000.0; if (total_wait_time > THREAD_KILL_MAX_WAIT_TIME) { SCLogError(SC_ERR_FATAL, "Engine unable to " "disable detect thread - \"%s\". " "Killing engine", tv->name); exit(EXIT_FAILURE); } } } tv = tv->next; } SCMutexUnlock(&tv_root_lock); /* finally wait for all packet threads to have * processed all of their 'live' packets so we * don't process the last live packets together * with FFR packets */ TmThreadDrainPacketThreads(); return; } /** * \brief Disable all threads having the specified TMs. */ void TmThreadDisablePacketThreads(void) { /* value in seconds */ #define THREAD_KILL_MAX_WAIT_TIME 60 /* value in microseconds */ #define WAIT_TIME 100 double total_wait_time = 0; ThreadVars *tv = NULL; /* first drain all packet threads of their packets */ TmThreadDrainPacketThreads(); again: SCMutexLock(&tv_root_lock); /* all receive threads are part of packet processing threads */ tv = tv_root[TVT_PPT]; /* we do have to keep in mind that TVs are arranged in the order * right from receive to log. The moment we fail to find a * receive TM amongst the slots in a tv, it indicates we are done * with all receive threads */ while (tv) { if (tv->inq != NULL) { /* we wait till we dry out all the inq packets, before we * kill this thread. Do note that you should have disabled * packet acquire by now using TmThreadDisableReceiveThreads()*/ if (!(strlen(tv->inq->name) == strlen("packetpool") && strcasecmp(tv->inq->name, "packetpool") == 0)) { PacketQueue *q = &trans_q[tv->inq->id]; if (q->len != 0) { SCMutexUnlock(&tv_root_lock); /* don't sleep while holding a lock */ usleep(1000); goto again; } } } /* we found our receive TV. Send it a KILL signal. This is all * we need to do to kill receive threads */ TmThreadsSetFlag(tv, THV_KILL); if (tv->inq != NULL) { int i; for (i = 0; i < (tv->inq->reader_cnt + tv->inq->writer_cnt); i++) { if (tv->inq->q_type == 0) SCCondSignal(&trans_q[tv->inq->id].cond_q); else SCCondSignal(&data_queues[tv->inq->id].cond_q); } SCLogDebug("signalled tv->inq->id %" PRIu32 "", tv->inq->id); } while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { usleep(WAIT_TIME); total_wait_time += WAIT_TIME / 1000000.0; if (total_wait_time > THREAD_KILL_MAX_WAIT_TIME) { SCLogError(SC_ERR_FATAL, "Engine unable to " "disable detect thread - \"%s\". " "Killing engine", tv->name); exit(EXIT_FAILURE); } } tv = tv->next; } SCMutexUnlock(&tv_root_lock); return; } TmSlot *TmThreadGetFirstTmSlotForPartialPattern(const char *tm_name) { ThreadVars *tv = NULL; TmSlot *slots = NULL; SCMutexLock(&tv_root_lock); /* all receive threads are part of packet processing threads */ tv = tv_root[TVT_PPT]; while (tv) { slots = tv->tm_slots; while (slots != NULL) { TmModule *tm = TmModuleGetById(slots->tm_id); char *found = strstr(tm->name, tm_name); if (found != NULL) goto end; slots = slots->slot_next; } tv = tv->next; } end: SCMutexUnlock(&tv_root_lock); return slots; } void TmThreadKillThreadsFamily(int family) { ThreadVars *tv = NULL; if ((family < 0) || (family >= TVT_MAX)) return; SCMutexLock(&tv_root_lock); tv = tv_root[family]; while (tv) { TmThreadKillThread(tv); tv = tv->next; } SCMutexUnlock(&tv_root_lock); } void TmThreadKillThreads(void) { int i = 0; for (i = 0; i < TVT_MAX; i++) { TmThreadKillThreadsFamily(i); } return; } void TmThreadFree(ThreadVars *tv) { TmSlot *s; TmSlot *ps; if (tv == NULL) return; SCLogDebug("Freeing thread '%s'.", tv->name); StatsThreadCleanup(tv); TmThreadDeinitMC(tv); if (tv->thread_group_name) { SCFree(tv->thread_group_name); } s = (TmSlot *)tv->tm_slots; while (s) { ps = s; s = s->slot_next; SCFree(ps); } TmThreadsUnregisterThread(tv->id); SCFree(tv); } void TmThreadSetGroupName(ThreadVars *tv, const char *name) { char *thread_group_name = NULL; if (name == NULL) return; if (tv == NULL) return; thread_group_name = SCStrdup(name); if (unlikely(thread_group_name == NULL)) { SCLogError(SC_ERR_RUNMODE, "error allocating memory"); return; } tv->thread_group_name = thread_group_name; } void TmThreadClearThreadsFamily(int family) { ThreadVars *tv = NULL; ThreadVars *ptv = NULL; if ((family < 0) || (family >= TVT_MAX)) return; SCMutexLock(&tv_root_lock); tv = tv_root[family]; while (tv) { ptv = tv; tv = tv->next; TmThreadFree(ptv); } tv_root[family] = NULL; SCMutexUnlock(&tv_root_lock); } /** * \brief Spawns a thread associated with the ThreadVars instance tv * * \retval TM_ECODE_OK on success and TM_ECODE_FAILED on failure */ TmEcode TmThreadSpawn(ThreadVars *tv) { pthread_attr_t attr; if (tv->tm_func == NULL) { printf("ERROR: no thread function set\n"); return TM_ECODE_FAILED; } /* Initialize and set thread detached attribute */ pthread_attr_init(&attr); pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_JOINABLE); int rc = pthread_create(&tv->t, &attr, tv->tm_func, (void *)tv); if (rc) { printf("ERROR; return code from pthread_create() is %" PRId32 "\n", rc); return TM_ECODE_FAILED; } TmThreadWaitForFlag(tv, THV_INIT_DONE | THV_RUNNING_DONE); TmThreadAppend(tv, tv->type); return TM_ECODE_OK; } /** * \brief Sets the thread flags for a thread instance(tv) * * \param tv Pointer to the thread instance for which the flag has to be set * \param flags Holds the thread state this thread instance has to be set to */ #if 0 void TmThreadSetFlags(ThreadVars *tv, uint8_t flags) { if (tv != NULL) tv->flags = flags; return; } #endif /** * \brief Initializes the mutex and condition variables for this TV * * It can be used by a thread to control a wait loop that can also be * influenced by other threads. * * \param tv Pointer to a TV instance */ void TmThreadInitMC(ThreadVars *tv) { if ( (tv->ctrl_mutex = SCMalloc(sizeof(*tv->ctrl_mutex))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in TmThreadInitMC. " "Exiting..."); exit(EXIT_FAILURE); } if (SCCtrlMutexInit(tv->ctrl_mutex, NULL) != 0) { printf("Error initializing the tv->m mutex\n"); exit(EXIT_FAILURE); } if ( (tv->ctrl_cond = SCMalloc(sizeof(*tv->ctrl_cond))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in TmThreadInitMC. " "Exiting..."); exit(EXIT_FAILURE); } if (SCCtrlCondInit(tv->ctrl_cond, NULL) != 0) { SCLogError(SC_ERR_FATAL, "Error initializing the tv->cond condition " "variable"); exit(EXIT_FAILURE); } return; } static void TmThreadDeinitMC(ThreadVars *tv) { if (tv->ctrl_mutex) { SCCtrlMutexDestroy(tv->ctrl_mutex); SCFree(tv->ctrl_mutex); } if (tv->ctrl_cond) { SCCtrlCondDestroy(tv->ctrl_cond); SCFree(tv->ctrl_cond); } return; } /** * \brief Tests if the thread represented in the arg has been unpaused or not. * * The function would return if the thread tv has been unpaused or if the * kill flag for the thread has been set. * * \param tv Pointer to the TV instance. */ void TmThreadTestThreadUnPaused(ThreadVars *tv) { while (TmThreadsCheckFlag(tv, THV_PAUSE)) { usleep(100); if (TmThreadsCheckFlag(tv, THV_KILL)) break; } return; } /** * \brief Waits till the specified flag(s) is(are) set. We don't bother if * the kill flag has been set or not on the thread. * * \param tv Pointer to the TV instance. */ void TmThreadWaitForFlag(ThreadVars *tv, uint16_t flags) { while (!TmThreadsCheckFlag(tv, flags)) { usleep(100); } return; } /** * \brief Unpauses a thread * * \param tv Pointer to a TV instance that has to be unpaused */ void TmThreadContinue(ThreadVars *tv) { TmThreadsUnsetFlag(tv, THV_PAUSE); return; } /** * \brief Unpauses all threads present in tv_root */ void TmThreadContinueThreads() { ThreadVars *tv = NULL; int i = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { TmThreadContinue(tv); tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Pauses a thread * * \param tv Pointer to a TV instance that has to be paused */ void TmThreadPause(ThreadVars *tv) { TmThreadsSetFlag(tv, THV_PAUSE); return; } /** * \brief Pauses all threads present in tv_root */ void TmThreadPauseThreads() { ThreadVars *tv = NULL; int i = 0; TmThreadsListThreads(); SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { TmThreadPause(tv); tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Used to check the thread for certain conditions of failure. */ void TmThreadCheckThreadState(void) { ThreadVars *tv = NULL; int i = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv) { if (TmThreadsCheckFlag(tv, THV_FAILED)) { FatalError(SC_ERR_FATAL, "thread %s failed", tv->name); } tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return; } /** * \brief Used to check if all threads have finished their initialization. On * finding an un-initialized thread, it waits till that thread completes * its initialization, before proceeding to the next thread. * * \retval TM_ECODE_OK all initialized properly * \retval TM_ECODE_FAILED failure */ TmEcode TmThreadWaitOnThreadInit(void) { ThreadVars *tv = NULL; int i = 0; uint16_t mgt_num = 0; uint16_t ppt_num = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { char started = FALSE; while (started == FALSE) { if (TmThreadsCheckFlag(tv, THV_INIT_DONE)) { started = TRUE; } else { /* sleep a little to give the thread some * time to finish initialization */ usleep(100); } if (TmThreadsCheckFlag(tv, THV_FAILED)) { SCMutexUnlock(&tv_root_lock); SCLogError(SC_ERR_THREAD_INIT, "thread \"%s\" failed to " "initialize.", tv->name); return TM_ECODE_FAILED; } if (TmThreadsCheckFlag(tv, THV_CLOSED)) { SCMutexUnlock(&tv_root_lock); SCLogError(SC_ERR_THREAD_INIT, "thread \"%s\" closed on " "initialization.", tv->name); return TM_ECODE_FAILED; } } if (i == TVT_MGMT) mgt_num++; else if (i == TVT_PPT) ppt_num++; tv = tv->next; } } SCMutexUnlock(&tv_root_lock); SCLogNotice("all %"PRIu16" packet processing threads, %"PRIu16" management " "threads initialized, engine started.", ppt_num, mgt_num); return TM_ECODE_OK; } /** * \brief Returns the TV for the calling thread. * * \retval tv Pointer to the ThreadVars instance for the calling thread; * NULL on no match */ ThreadVars *TmThreadsGetCallingThread(void) { pthread_t self = pthread_self(); ThreadVars *tv = NULL; int i = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv) { if (pthread_equal(self, tv->t)) { SCMutexUnlock(&tv_root_lock); return tv; } tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return NULL; } /** * \brief returns a count of all the threads that match the flag */ uint32_t TmThreadCountThreadsByTmmFlags(uint8_t flags) { ThreadVars *tv = NULL; int i = 0; uint32_t cnt = 0; SCMutexLock(&tv_root_lock); for (i = 0; i < TVT_MAX; i++) { tv = tv_root[i]; while (tv != NULL) { if ((tv->tmm_flags & flags) == flags) cnt++; tv = tv->next; } } SCMutexUnlock(&tv_root_lock); return cnt; } typedef struct Thread_ { ThreadVars *tv; /**< threadvars structure */ const char *name; int type; int in_use; /**< bool to indicate this is in use */ struct timeval ts; /**< current time of this thread (offline mode) */ } Thread; typedef struct Threads_ { Thread *threads; size_t threads_size; int threads_cnt; } Threads; static Threads thread_store = { NULL, 0, 0 }; static SCMutex thread_store_lock = SCMUTEX_INITIALIZER; void TmThreadsListThreads(void) { Thread *t; size_t s; SCMutexLock(&thread_store_lock); for (s = 0; s < thread_store.threads_size; s++) { t = &thread_store.threads[s]; if (t == NULL || t->in_use == 0) continue; SCLogInfo("Thread %"PRIuMAX", %s type %d, tv %p", (uintmax_t)s+1, t->name, t->type, t->tv); } SCMutexUnlock(&thread_store_lock); } #define STEP 32 /** * \retval id thread id, or 0 if not found */ int TmThreadsRegisterThread(ThreadVars *tv, const int type) { SCMutexLock(&thread_store_lock); if (thread_store.threads == NULL) { thread_store.threads = SCCalloc(STEP, sizeof(Thread)); BUG_ON(thread_store.threads == NULL); thread_store.threads_size = STEP; } size_t s; for (s = 0; s < thread_store.threads_size; s++) { if (thread_store.threads[s].in_use == 0) { Thread *t = &thread_store.threads[s]; t->name = tv->name; t->type = type; t->tv = tv; t->in_use = 1; SCMutexUnlock(&thread_store_lock); return (int)(s+1); } } /* if we get here the array is completely filled */ void *newmem = SCRealloc(thread_store.threads, ((thread_store.threads_size + STEP) * sizeof(Thread))); BUG_ON(newmem == NULL); thread_store.threads = newmem; memset((uint8_t *)thread_store.threads + (thread_store.threads_size * sizeof(Thread)), 0x00, STEP * sizeof(Thread)); Thread *t = &thread_store.threads[thread_store.threads_size]; t->name = tv->name; t->type = type; t->tv = tv; t->in_use = 1; s = thread_store.threads_size; thread_store.threads_size += STEP; SCMutexUnlock(&thread_store_lock); return (int)(s+1); } #undef STEP void TmThreadsUnregisterThread(const int id) { SCMutexLock(&thread_store_lock); if (id <= 0 || id > (int)thread_store.threads_size) { SCMutexUnlock(&thread_store_lock); return; } /* id is one higher than index */ int idx = id - 1; /* reset thread_id, which serves as clearing the record */ thread_store.threads[idx].in_use = 0; /* check if we have at least one registered thread left */ size_t s; for (s = 0; s < thread_store.threads_size; s++) { Thread *t = &thread_store.threads[s]; if (t->in_use == 1) { goto end; } } /* if we get here no threads are registered */ SCFree(thread_store.threads); thread_store.threads = NULL; thread_store.threads_size = 0; thread_store.threads_cnt = 0; end: SCMutexUnlock(&thread_store_lock); } void TmThreadsSetThreadTimestamp(const int id, const struct timeval *ts) { SCMutexLock(&thread_store_lock); if (unlikely(id <= 0 || id > (int)thread_store.threads_size)) { SCMutexUnlock(&thread_store_lock); return; } int idx = id - 1; Thread *t = &thread_store.threads[idx]; t->ts.tv_sec = ts->tv_sec; t->ts.tv_usec = ts->tv_usec; SCMutexUnlock(&thread_store_lock); } #define COPY_TIMESTAMP(src,dst) ((dst)->tv_sec = (src)->tv_sec, (dst)->tv_usec = (src)->tv_usec) // XXX unify with flow-util.h void TmreadsGetMinimalTimestamp(struct timeval *ts) { struct timeval local, nullts; memset(&local, 0, sizeof(local)); memset(&nullts, 0, sizeof(nullts)); int set = 0; size_t s; SCMutexLock(&thread_store_lock); for (s = 0; s < thread_store.threads_size; s++) { Thread *t = &thread_store.threads[s]; if (t == NULL || t->in_use == 0) continue; if (!(timercmp(&t->ts, &nullts, ==))) { if (!set) { local.tv_sec = t->ts.tv_sec; local.tv_usec = t->ts.tv_usec; set = 1; } else { if (timercmp(&t->ts, &local, <)) { COPY_TIMESTAMP(&t->ts, &local); } } } } SCMutexUnlock(&thread_store_lock); COPY_TIMESTAMP(&local, ts); SCLogDebug("ts->tv_sec %u", (uint)ts->tv_sec); } #undef COPY_TIMESTAMP /** * \retval r 1 if packet was accepted, 0 otherwise * \note if packet was not accepted, it's still the responsibility * of the caller. */ int TmThreadsInjectPacketsById(Packet **packets, const int id) { if (id <= 0 || id > (int)thread_store.threads_size) return 0; int idx = id - 1; Thread *t = &thread_store.threads[idx]; ThreadVars *tv = t->tv; if (tv == NULL || tv->stream_pq == NULL) return 0; SCMutexLock(&tv->stream_pq->mutex_q); while (*packets != NULL) { PacketEnqueue(tv->stream_pq, *packets); packets++; } SCMutexUnlock(&tv->stream_pq->mutex_q); /* wake up listening thread(s) if necessary */ if (tv->inq != NULL) { SCCondSignal(&trans_q[tv->inq->id].cond_q); } return 1; } suricata-3.2.1/src/detect-content.c0000644000000000000000000030303213051004444014066 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Simple content match part of the detection engine. */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-engine-mpm.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-parse.h" #include "util-mpm.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "detect-flow.h" #include "app-layer.h" #include "util-unittest.h" #include "util-print.h" #include "util-debug.h" #include "util-spm.h" #include "threads.h" #include "util-unittest-helper.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" int DetectContentMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); int DetectContentSetup(DetectEngineCtx *, Signature *, char *); void DetectContentRegisterTests(void); void DetectContentRegister (void) { sigmatch_table[DETECT_CONTENT].name = "content"; sigmatch_table[DETECT_CONTENT].desc = "match on payload content"; sigmatch_table[DETECT_CONTENT].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#content"; sigmatch_table[DETECT_CONTENT].Match = NULL; sigmatch_table[DETECT_CONTENT].Setup = DetectContentSetup; sigmatch_table[DETECT_CONTENT].Free = DetectContentFree; sigmatch_table[DETECT_CONTENT].RegisterTests = DetectContentRegisterTests; sigmatch_table[DETECT_CONTENT].flags |= SIGMATCH_PAYLOAD; } /** * \brief Parse a content string, ie "abc|DE|fgh" * * \param content_str null terminated string containing the content * \param result result pointer to pass the fully parsed byte array * \param result_len size of the resulted data * \param flags flags to be set by this parsing function * * \retval -1 error * \retval 0 ok */ int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen, uint32_t *flags) { char *str = NULL; uint16_t len; uint16_t pos = 0; uint16_t slen = 0; slen = strlen(contentstr); if (slen == 0) { return -1; } /* skip the first spaces */ while (pos < slen && isspace((unsigned char)contentstr[pos])) pos++; if (contentstr[pos] == '!') { *flags = DETECT_CONTENT_NEGATED; pos++; } else *flags = 0; if (contentstr[pos] == '\"' && ((slen - pos) <= 1)) goto error; if (!(contentstr[pos] == '\"' && contentstr[slen - 1] == '\"')) { SCLogError(SC_ERR_INVALID_SIGNATURE, "%s keyword arguments " "should be always enclosed in double quotes. Invalid " "content keyword passed in this rule - \"%s\"", keyword, contentstr); goto error; } if ((str = SCStrdup(contentstr + pos + 1)) == NULL) goto error; str[strlen(str) - 1] = '\0'; len = strlen(str); if (len == 0) goto error; SCLogDebug("\"%s\", len %" PRIu32 "", str, len); //SCLogDebug("DetectContentParse: \"%s\", len %" PRIu32 "", str, len); char converted = 0; { uint16_t i, x; uint8_t bin = 0; uint8_t escape = 0; uint8_t binstr[3] = ""; uint8_t binpos = 0; uint16_t bin_count = 0; for (i = 0, x = 0; i < len; i++) { // SCLogDebug("str[%02u]: %c", i, str[i]); if (str[i] == '|') { bin_count++; if (bin) { bin = 0; } else { bin = 1; } } else if(!escape && str[i] == '\\') { escape = 1; } else { if (bin) { if (isdigit((unsigned char)str[i]) || str[i] == 'A' || str[i] == 'a' || str[i] == 'B' || str[i] == 'b' || str[i] == 'C' || str[i] == 'c' || str[i] == 'D' || str[i] == 'd' || str[i] == 'E' || str[i] == 'e' || str[i] == 'F' || str[i] == 'f') { // SCLogDebug("part of binary: %c", str[i]); binstr[binpos] = (char)str[i]; binpos++; if (binpos == 2) { uint8_t c = strtol((char *)binstr, (char **) NULL, 16) & 0xFF; binpos = 0; str[x] = c; x++; converted = 1; } } else if (str[i] == ' ') { // SCLogDebug("space as part of binary string"); } else if (str[i] != ',') { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid hex code in " "content - %s, hex %c. Invalidating signature", str, str[i]); goto error; } } else if (escape) { if (str[i] == ':' || str[i] == ';' || str[i] == '\\' || str[i] == '\"') { str[x] = str[i]; x++; } else { //SCLogDebug("Can't escape %c", str[i]); goto error; } escape = 0; converted = 1; } else if (str[i] == '"') { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid unescaped double quote within content section"); goto error; } else { str[x] = str[i]; x++; } } } if (bin_count % 2 != 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid hex code assembly in " "%s - %s. Invalidating signature", keyword, contentstr); goto error; } if (converted) { len = x; } } *plen = len; *pstr = (uint8_t *)str; return 0; error: if (str != NULL) SCFree(str); return -1; } /** * \brief DetectContentParse * \initonly */ DetectContentData *DetectContentParse(SpmGlobalThreadCtx *spm_global_thread_ctx, char *contentstr) { DetectContentData *cd = NULL; uint8_t *content = NULL; uint16_t len = 0; uint32_t flags = 0; int ret; ret = DetectContentDataParse("content", contentstr, &content, &len, &flags); if (ret == -1) { return NULL; } cd = SCMalloc(sizeof(DetectContentData) + len); if (unlikely(cd == NULL)) { SCFree(content); exit(EXIT_FAILURE); } memset(cd, 0, sizeof(DetectContentData) + len); if (flags == DETECT_CONTENT_NEGATED) cd->flags |= DETECT_CONTENT_NEGATED; cd->content = (uint8_t *)cd + sizeof(DetectContentData); memcpy(cd->content, content, len); cd->content_len = len; /* Prepare SPM search context. */ cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 0, spm_global_thread_ctx); if (cd->spm_ctx == NULL) { SCFree(content); SCFree(cd); return NULL; } cd->depth = 0; cd->offset = 0; cd->within = 0; cd->distance = 0; SCFree(content); return cd; } DetectContentData *DetectContentParseEncloseQuotes(SpmGlobalThreadCtx *spm_global_thread_ctx, char *contentstr) { char str[strlen(contentstr) + 3]; // 2 for quotes, 1 for \0 str[0] = '\"'; memcpy(str + 1, contentstr, strlen(contentstr)); str[strlen(contentstr) + 1] = '\"'; str[strlen(contentstr) + 2] = '\0'; return DetectContentParse(spm_global_thread_ctx, str); } /** * \brief Helper function to print a DetectContentData */ void DetectContentPrint(DetectContentData *cd) { int i = 0; if (cd == NULL) { SCLogDebug("DetectContentData \"cd\" is NULL"); return; } char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1); if (tmpstr != NULL) { for (i = 0; i < cd->content_len; i++) { if (isprint(cd->content[i])) tmpstr[i] = cd->content[i]; else tmpstr[i] = '.'; } tmpstr[i] = '\0'; SCLogDebug("Content: \"%s\"", tmpstr); SCFree(tmpstr); } else { SCLogDebug("Content: "); for (i = 0; i < cd->content_len; i++) SCLogDebug("%c", cd->content[i]); } SCLogDebug("Content_id: %"PRIu32, cd->id); SCLogDebug("Content_len: %"PRIu16, cd->content_len); SCLogDebug("Depth: %"PRIu16, cd->depth); SCLogDebug("Offset: %"PRIu16, cd->offset); SCLogDebug("Within: %"PRIi32, cd->within); SCLogDebug("Distance: %"PRIi32, cd->distance); SCLogDebug("flags: %u ", cd->flags); SCLogDebug("negated: %s ", cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); SCLogDebug("relative match next: %s ", cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false"); if (cd->replace && cd->replace_len) { char *tmprstr = SCMalloc(sizeof(char) * cd->replace_len + 1); if (tmprstr != NULL) { for (i = 0; i < cd->replace_len; i++) { if (isprint(cd->replace[i])) tmprstr[i] = cd->replace[i]; else tmprstr[i] = '.'; } tmprstr[i] = '\0'; SCLogDebug("Replace: \"%s\"", tmprstr); SCFree(tmprstr); } else { SCLogDebug("Replace: "); for (i = 0; i < cd->replace_len; i++) SCLogDebug("%c", cd->replace[i]); } } SCLogDebug("-----------"); } /** * \brief Print list of DETECT_CONTENT SigMatch's allocated in a * SigMatch list, from the current sm to the end * \param sm pointer to the current SigMatch to start printing from */ void DetectContentPrintAll(SigMatch *sm) { #ifdef DEBUG if (SCLogDebugEnabled()) { int i = 0; if (sm == NULL) return; SigMatch *first_sm = sm; /* Print all of them */ for (; first_sm != NULL; first_sm = first_sm->next) { if (first_sm->type == DETECT_CONTENT) { SCLogDebug("Printing SigMatch DETECT_CONTENT %d", ++i); DetectContentPrint((DetectContentData*)first_sm->ctx); } } } #endif /* DEBUG */ } /** * \brief Function to setup a content pattern. * * \param de_ctx pointer to the current detection_engine * \param s pointer to the current Signature * \param m pointer to the last parsed SigMatch * \param contentstr pointer to the current keyword content string * \retval -1 if error * \retval 0 if all was ok */ int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, char *contentstr) { DetectContentData *cd = NULL; SigMatch *sm = NULL; cd = DetectContentParse(de_ctx->spm_global_thread_ctx, contentstr); if (cd == NULL) goto error; DetectContentPrint(cd); int sm_list; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA && s->alproto == ALPROTO_HTTP) { AppLayerHtpEnableResponseBodyCallback(); s->alproto = ALPROTO_HTTP; } s->flags |= SIG_FLAG_APPLAYER; sm_list = s->list; } else { sm_list = DETECT_SM_LIST_PMATCH; } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->ctx = (void *)cd; sm->type = DETECT_CONTENT; SigMatchAppendSMToList(s, sm, sm_list); return 0; error: DetectContentFree(cd); return -1; } /** * \brief this function will SCFree memory associated with DetectContentData * * \param cd pointer to DetectCotentData */ void DetectContentFree(void *ptr) { SCEnter(); DetectContentData *cd = (DetectContentData *)ptr; if (cd == NULL) SCReturn; SpmDestroyCtx(cd->spm_ctx); SCFree(cd); SCReturn; } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectCotentParseTest01 this is a test to make sure we can deal with escaped colons */ int DetectContentParseTest01 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"abc\\:def\""; char *teststringparsed = "abc:def"; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (memcmp(cd->content, teststringparsed, strlen(teststringparsed)) != 0) { SCLogDebug("expected %s got ", teststringparsed); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } } else { SCLogDebug("expected %s got NULL: ", teststringparsed); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest02 this is a test to make sure we can deal with escaped semi-colons */ int DetectContentParseTest02 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"abc\\;def\""; char *teststringparsed = "abc;def"; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (memcmp(cd->content, teststringparsed, strlen(teststringparsed)) != 0) { SCLogDebug("expected %s got ", teststringparsed); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } } else { SCLogDebug("expected %s got NULL: ", teststringparsed); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest03 this is a test to make sure we can deal with escaped double-quotes */ int DetectContentParseTest03 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"abc\\\"def\""; char *teststringparsed = "abc\"def"; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (memcmp(cd->content, teststringparsed, strlen(teststringparsed)) != 0) { SCLogDebug("expected %s got ", teststringparsed); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } } else { SCLogDebug("expected %s got NULL: ", teststringparsed); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest04 this is a test to make sure we can deal with escaped backslashes */ int DetectContentParseTest04 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"abc\\\\def\""; char *teststringparsed = "abc\\def"; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { uint16_t len = (cd->content_len > strlen(teststringparsed)); if (memcmp(cd->content, teststringparsed, len) != 0) { SCLogDebug("expected %s got ", teststringparsed); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } } else { SCLogDebug("expected %s got NULL: ", teststringparsed); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest05 test illegal escape */ int DetectContentParseTest05 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"abc\\def\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { SCLogDebug("expected NULL got "); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest06 test a binary content */ int DetectContentParseTest06 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"a|42|c|44|e|46|\""; char *teststringparsed = "abcdef"; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { uint16_t len = (cd->content_len > strlen(teststringparsed)); if (memcmp(cd->content, teststringparsed, len) != 0) { SCLogDebug("expected %s got ", teststringparsed); PrintRawUriFp(stdout,cd->content,cd->content_len); SCLogDebug(": "); result = 0; DetectContentFree(cd); } } else { SCLogDebug("expected %s got NULL: ", teststringparsed); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest07 test an empty content */ int DetectContentParseTest07 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { SCLogDebug("expected NULL got %p: ", cd); result = 0; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test DetectCotentParseTest08 test an empty content */ int DetectContentParseTest08 (void) { int result = 1; DetectContentData *cd = NULL; char *teststring = "\"\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { SCLogDebug("expected NULL got %p: ", cd); result = 0; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test Test packet Matches * \param raw_eth_pkt pointer to the ethernet packet * \param pktsize size of the packet * \param sig pointer to the signature to test * \param sid sid number of the signature * \retval return 1 if match * \retval return 0 if not */ int DetectContentLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize, char *sig, uint32_t sid) { int result = 0; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, raw_eth_pkt, pktsize, NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, sig); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = NULL; if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_CONTENT) { DetectContentData *co = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (co->flags & DETECT_CONTENT_RELATIVE_NEXT) { printf("relative next flag set on final match which is content: "); goto end; } } SCLogDebug("---DetectContentLongPatternMatchTest---"); DetectContentPrintAll(de_ctx->sig_list->sm_lists[DETECT_SM_LIST_MATCH]); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, sid) != 1) { goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \brief Wrapper for DetectContentLongPatternMatchTest */ int DetectContentLongPatternMatchTestWrp(char *sig, uint32_t sid) { /** Real packet with the following tcp data: * "Hi, this is a big test to check content matches of splitted" * "patterns between multiple chunks!" * (without quotes! :) ) */ uint8_t raw_eth_pkt[] = { 0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00, 0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00, 0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06, 0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00, 0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02, 0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66, 0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65, 0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72, 0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65, 0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69, 0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e, 0x6b,0x73,0x21 }; /* end raw_eth_pkt */ return DetectContentLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), sig, sid); } /** * \test Check if we match a normal pattern (not splitted) */ int DetectContentLongPatternMatchTest01() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"Hi, this is a big test\"; sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match a splitted pattern */ int DetectContentLongPatternMatchTest02() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"Hi, this is a big test to check content matches of" " splitted patterns between multiple chunks!\"; sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check that we don't match the signature if one of the splitted * chunks doesn't match the packet */ int DetectContentLongPatternMatchTest03() { /** The last chunk of the content should not match */ char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" " content:\"Hi, this is a big test to check content matches of" " splitted patterns between multiple splitted chunks!\"; sid:1;)"; return (DetectContentLongPatternMatchTestWrp(sig, 1) == 0) ? 1: 0; } /** * \test Check if we match multiple content (not splitted) */ int DetectContentLongPatternMatchTest04() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"Hi, this is\"; depth:15 ;content:\"a big test\"; " " within:15; content:\"to check content matches of\"; " " within:30; content:\"splitted patterns\"; distance:1; " " within:30; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check that we match packets with multiple chunks and not chunks * Here we should specify only contents that fit in 32 bytes * Each of them with their modifier values */ int DetectContentLongPatternMatchTest05() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"Hi, this is a big\"; depth:17; " " isdataat:30, relative; " " content:\"test\"; within: 5; distance:1; " " isdataat:15, relative; " " content:\"of splitted\"; within:37; distance:15; " " isdataat:20,relative; " " content:\"patterns\"; within:9; distance:1; " " isdataat:10, relative; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check that we match packets with multiple chunks and not chunks * Here we should specify contents that fit and contents that must be splitted * Each of them with their modifier values */ int DetectContentLongPatternMatchTest06() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"Hi, this is a big test to check cont\"; depth:36;" " content:\"ent matches\"; within:11; distance:0; " " content:\"of splitted patterns between multiple\"; " " within:38; distance:1; " " content:\"chunks!\"; within: 8; distance:1; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match contents that are in the payload * but not in the same order as specified in the signature */ int DetectContentLongPatternMatchTest07() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"chunks!\"; " " content:\"content matches\"; offset:32; depth:47; " " content:\"of splitted patterns between multiple\"; " " content:\"Hi, this is a big\"; offset:0; depth:17; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match contents that are in the payload * but not in the same order as specified in the signature */ int DetectContentLongPatternMatchTest08() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"ent matches\"; " " content:\"of splitted patterns between multiple\"; " " within:38; distance:1; " " content:\"chunks!\"; within: 8; distance:1; " " content:\"Hi, this is a big test to check cont\"; depth:36;" " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match contents that are in the payload * but not in the same order as specified in the signature */ int DetectContentLongPatternMatchTest09() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"ent matches\"; " " content:\"of splitted patterns between multiple\"; " " offset:47; depth:85; " " content:\"chunks!\"; within: 8; distance:1; " " content:\"Hi, this is a big test to chec\"; depth:36;" " content:\"k cont\"; distance:0; within:6;" " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match two consecutive simple contents */ int DetectContentLongPatternMatchTest10() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"Hi, this is a big test to check \"; " " content:\"con\"; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } /** * \test Check if we match two contents of length 1 */ int DetectContentLongPatternMatchTest11() { char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " " content:\"H\"; " " content:\"i\"; " " sid:1;)"; return DetectContentLongPatternMatchTestWrp(sig, 1); } int DetectContentParseTest09(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = "!\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (cd->flags & DETECT_CONTENT_NEGATED) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseTest10(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = "!\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (cd->flags & DETECT_CONTENT_NEGATED) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest11(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = "\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (!(cd->flags & DETECT_CONTENT_NEGATED)) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest12(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = "\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (!(cd->flags & DETECT_CONTENT_NEGATED)) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest13(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = "!\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (cd->flags & DETECT_CONTENT_NEGATED) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest14(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = " \"!boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (!(cd->flags & DETECT_CONTENT_NEGATED)) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest15(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = " !\"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { if (cd->flags & DETECT_CONTENT_NEGATED) result = 1; DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } int DetectContentParseNegTest16(void) { int result = 0; DetectContentData *cd = NULL; char *teststring = " \"boo\""; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd != NULL) { result = (cd->content_len == 3 && memcmp(cd->content,"boo",3) == 0); DetectContentFree(cd); } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); return result; } /** * \test Test cases where if within specified is < content lenggth we invalidate * the sig. */ int DetectContentParseTest17(void) { int result = 0; char *sigstr = "alert tcp any any -> any any (msg:\"Dummy\"; " "content:\"one\"; content:\"two\"; within:2; sid:1;)"; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->sig_list = SigInit(de_ctx, sigstr); if (de_ctx->sig_list != NULL) goto end; result = 1; end: SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectContentParseTest18(void) { Signature *s = SigAlloc(); int result = 1; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { result = 0; goto end; } s->alproto = ALPROTO_DCERPC; result &= (DetectContentSetup(de_ctx, s, "\"one\"") == 0); result &= (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); if (s == NULL) return 0; result &= (DetectContentSetup(de_ctx, s, "\"one\"") == 0); result &= (s->sm_lists[DETECT_SM_LIST_DMATCH] == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); end: SigFree(s); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectContentParseTest19(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; DetectContentData *data = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with content\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; sid:1;)"); if (de_ctx->sig_list == NULL) { printf ("failed dce iface, stub_data with content "); result = 0; goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with contents & distance, within\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; content:\"two\"; within:10; sid:1;)"); if (s->next == NULL) { printf("failed dce iface, stub_data with content & distance, within"); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->within == 10); /* s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with contents & offset, depth\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; offset:5; depth:9; " "content:\"two\"; within:10; sid:1;)"); if (s->next == NULL) { printf ("failed dce iface, stub_data with contents & offset, depth"); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->offset == 5 && data->depth == 9); data = (DetectContentData *)s->sm_lists[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub with contents, distance\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "content:\"two\"; distance:2; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->distance == 2); */ s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub with contents, distance, within\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "content:\"two\"; within:10; distance:2; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || !(data->flags & DETECT_CONTENT_WITHIN) || !(data->flags & DETECT_CONTENT_DISTANCE) || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->within == 10 && data->distance == 2); /* s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with content, offset\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; offset:10; sid:1;)"); if (s->next == NULL) { printf ("Failed dce iface, stub_data with content, offset "); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->offset == 10); s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with content, depth\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; depth:10; sid:1;)"); if (s->next == NULL) { printf ("failed dce iface, stub_data with content, depth"); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->depth == 10); s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing dce iface, stub_data with content, offset, depth\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; offset:10; depth:3; sid:1;)"); if (s->next == NULL) { printf("failed dce iface, stub_data with content, offset, depth"); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_CONTENT); result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || data->flags & DETECT_CONTENT_WITHIN || data->flags & DETECT_CONTENT_DISTANCE || data->flags & DETECT_CONTENT_FAST_PATTERN || data->flags & DETECT_CONTENT_NEGATED || result == 0) { result = 0; goto end; } result &= (data->offset == 10 && data->depth == 13); */ s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing content\"; " "content:\"one\"; sid:1;)"); if (s->next == NULL) { printf ("failed testing content"); result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] != NULL) { result = 0; goto end; } result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test content for dce sig. */ int DetectContentParseTest20(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest21(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest22(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"boo; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest23(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:boo\"; sid:238012;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest24(void) { DetectEngineCtx *de_ctx = NULL; DetectContentData *cd = 0; Signature *s = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content: !\"boo\"; sid:238012;)"); if (de_ctx->sig_list == NULL) { printf("de_ctx->sig_list == NULL: "); result = 0; goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL || s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx == NULL) { printf("de_ctx->pmatch_tail == NULL || de_ctx->pmatch_tail->ctx == NULL: "); result = 0; goto end; } cd = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; result = (strncmp("boo", (char *)cd->content, cd->content_len) == 0); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest25(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest26(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest27(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"af|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest28(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest29(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"aast|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest30(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"aast|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest31(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"aast|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest32(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af|asdf\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest33(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af|af|\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest34(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af|af|af\"; sid:1;)"); if (de_ctx->sig_list != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test */ int DetectContentParseTest35(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(msg:\"test\"; content:\"|af|af|af|\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: file_data */ static int DetectContentParseTest36(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: file_data */ static int DetectContentParseTest37(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; content:\"def\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: file_data */ static int DetectContentParseTest38(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; content:\"def\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int SigTestPositiveTestContent(char *rule, uint8_t *buf) { uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, rule); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 1) { goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } /** * \test Parsing test: file_data, within relative to file_data */ static int DetectContentParseTest39(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; within:8; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Parsing test: file_data, distance relative to file_data */ static int DetectContentParseTest40(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; file_data; content:\"abc\"; distance:3; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { printf("content still in PMATCH list: "); goto end; } if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_FILEDATA] == NULL) { printf("content not in FILEDATA list: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } int DetectContentParseTest41(void) { int result = 1; DetectContentData *cd = NULL; int patlen = 257; char *teststring = SCMalloc(sizeof(char) * (patlen + 1)); if (unlikely(teststring == NULL)) return 0; int idx = 0; teststring[idx++] = '\"'; for (int i = 0; i < (patlen - 2); idx++, i++) { teststring[idx] = 'a'; } teststring[idx++] = '\"'; teststring[idx++] = '\0'; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd == NULL) { SCLogDebug("expected not NULL"); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); SCFree(teststring); DetectContentFree(cd); return result; } /** * Tests that content lengths > 255 are supported. */ int DetectContentParseTest42(void) { int result = 1; DetectContentData *cd = NULL; int patlen = 258; char *teststring = SCMalloc(sizeof(char) * (patlen + 1)); if (unlikely(teststring == NULL)) return 0; int idx = 0; teststring[idx++] = '\"'; for (int i = 0; i < (patlen - 2); idx++, i++) { teststring[idx] = 'a'; } teststring[idx++] = '\"'; teststring[idx++] = '\0'; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd == NULL) { SCLogDebug("expected not NULL"); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); SCFree(teststring); DetectContentFree(cd); return result; } int DetectContentParseTest43(void) { int result = 1; DetectContentData *cd = NULL; int patlen = 260; char *teststring = SCMalloc(sizeof(char) * (patlen + 1)); if (unlikely(teststring == NULL)) return 0; int idx = 0; teststring[idx++] = '\"'; teststring[idx++] = '|'; teststring[idx++] = '4'; teststring[idx++] = '6'; teststring[idx++] = '|'; for (int i = 0; i < (patlen - 6); idx++, i++) { teststring[idx] = 'a'; } teststring[idx++] = '\"'; teststring[idx++] = '\0'; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd == NULL) { SCLogDebug("expected not NULL"); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); SCFree(teststring); DetectContentFree(cd); return result; } /** * Tests that content lengths > 255 are supported. */ int DetectContentParseTest44(void) { int result = 1; DetectContentData *cd = NULL; int patlen = 261; char *teststring = SCMalloc(sizeof(char) * (patlen + 1)); if (unlikely(teststring == NULL)) return 0; int idx = 0; teststring[idx++] = '\"'; teststring[idx++] = '|'; teststring[idx++] = '4'; teststring[idx++] = '6'; teststring[idx++] = '|'; for (int i = 0; i < (patlen - 6); idx++, i++) { teststring[idx] = 'a'; } teststring[idx++] = '\"'; teststring[idx++] = '\0'; uint16_t spm_matcher = SinglePatternMatchDefaultMatcher(); SpmGlobalThreadCtx *spm_global_thread_ctx = SpmInitGlobalThreadCtx(spm_matcher); FAIL_IF(spm_global_thread_ctx == NULL); cd = DetectContentParse(spm_global_thread_ctx, teststring); if (cd == NULL) { SCLogDebug("expected not NULL"); result = 0; } SpmDestroyGlobalThreadCtx(spm_global_thread_ctx); SCFree(teststring); DetectContentFree(cd); return result; } /** * \test Parsing test to check for unescaped quote within content section */ int DetectContentParseTest45(void) { DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"test\"; content:\"|ff|\" content:\"TEST\"; sid:1;)"); FAIL_IF_NOT_NULL(de_ctx->sig_list); DetectEngineCtxFree(de_ctx); PASS; } static int SigTestNegativeTestContent(char *rule, uint8_t *buf) { uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, rule); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 0) { goto end; } result = 1; end: if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } /** * \test A positive test that checks that the content string doesn't contain * the negated content */ static int SigTest41TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:!\"GES\"; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test crash condition: as packet has no direction, it defaults to toclient * in stream ctx inspection of packet. There a null ptr deref happens * We don't care about the match/nomatch here. */ static int SigTest41aTestNegatedContent(void) { (void)SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; flow:to_server; content:\"GET\"; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); return 1; } /** * \test A positive test that checks that the content string doesn't contain * the negated content within the specified depth */ static int SigTest42TestNegatedContent(void) { // 01 5 10 15 20 24 return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:!\"twentythree\"; depth:22; offset:35; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that checks that the content string doesn't contain * the negated content within the specified depth, and also after the * specified offset. Since the content is there, the match fails. * * Match is at offset:23, depth:34 */ static int SigTest43TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:!\"twentythree\"; depth:34; offset:23; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that checks that the content string doesn't contain * the negated content after the specified offset and within the specified * depth. */ static int SigTest44TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:!\"twentythree\"; offset:40; depth:35; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A positive test that uses a combination of content string with negated * content string */ static int SigTest45TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; depth:5; content:!\"twentythree\"; depth:23; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that uses a combination of content string with negated * content string, with we receiving a failure for 'onee' itself. */ static int SigTest46TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"onee\"; content:!\"twentythree\"; depth:23; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that uses a combination of content string with negated * content string, with we receiving a failure of first content's offset * condition */ static int SigTest47TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; offset:5; content:!\"twentythree\"; depth:23; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A positive test that checks that we don't have a negated content within * the specified length from the previous content match. */ static int SigTest48TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET\"; content:!\"GES\"; within:26; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test A negative test that checks the combined use of content and negated * content with the use of within */ static int SigTest49TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET\"; content:!\"Host\"; within:26; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test A positive test that checks the combined use of content and negated * content with the use of distance */ static int SigTest50TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET\"; content:!\"GES\"; distance:25; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test A negative test that checks the combined use of content and negated * content with the use of distance * * First GET at offset 0 * First Host at offset 21 */ static int SigTest51TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"GET\"; content:!\"Host\"; distance:17; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\nHost: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test A negative test that checks the combined use of content and negated * content, with the content not being present */ static int SigTest52TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GES\"; content:!\"BOO\"; sid:1;)", (uint8_t *)"GET /one/ HTTP/1.1\r\n Host: one.example.org\r\n\r\n\r\nGET /two/ HTTP/1.1\r\nHost: two.example.org\r\n\r\n\r\n"); } /** * \test A negative test that checks the combined use of content and negated * content, in the presence of within */ static int SigTest53TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:!\"fourty\"; within:56; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A positive test that checks the combined use of content and negated * content, in the presence of within */ static int SigTest54TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:!\"fourty\"; within:20; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that checks the use of negated content along with * the presence of depth */ static int SigTest55TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:!\"one\"; depth:5; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A positive test that checks the combined use of 2 contents in the * presence of within */ static int SigTest56TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:\"fourty\"; within:56; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that checks the combined use of content and negated * content, in the presence of within */ static int SigTest57TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:!\"fourty\"; within:56; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A positive test that checks the combined use of content and negated * content, in the presence of distance */ static int SigTest58TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:!\"fourty\"; distance:57; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** * \test A negative test that checks the combined use of content and negated * content, in the presence of distance */ static int SigTest59TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; content:!\"fourty\"; distance:30; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest60TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:!\"one\"; content:\"fourty\"; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest61TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"fourty\"; within:30; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** \test Test negation in combination with within and depth * * Match of "one" at offset:0, depth:3 * Match of "fourty" at offset:46, depth:52 * * This signature should not match for the test to pass. */ static int SigTest62TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"fourty\"; within:49; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest63TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; depth:10; content:!\"fourty\"; within:56; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest64TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"fourty\"; within:30; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** \test Test negation in combination with within and depth * * Match of "one" at offset:0, depth:3 * Match of "fourty" at offset:46, depth:52 * * This signature should not match for the test to pass. */ static int SigTest65TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"fourty\"; distance:0; within:49; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest66TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"fourty\"; within:30; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest67TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:!\"four\"; within:56; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest68TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:\"nine\"; offset:8; content:!\"fourty\"; within:28; content:\"fiftysix\"; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest69TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; depth:10; content:\"nine\"; offset:8; content:!\"fourty\"; within:48; content:\"fiftysix\"; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest70TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; content:!\"fourty\"; within:52; distance:45 sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } /** \test within and distance */ static int SigTest71TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; content:!\"fourty\"; within:40; distance:43; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest72TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (content:\"one\"; content:!\"fourty\"; within:49; distance:43; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest73TestNegatedContent(void) { return SigTestNegativeTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"one\"; depth:5; content:!\"twentythree\"; depth:35; sid:1;)", (uint8_t *)"one four nine fourteen twentythree thirtyfive fourtysix fiftysix"); } static int SigTest74TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:!\"PASS\"; sid:1;)", (uint8_t *)"USER apple"); } static int SigTest75TestNegatedContent(void) { return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)", (uint8_t *)"USER !PASS"); } static int SigTest76TestBug134(void) { uint8_t *buf = (uint8_t *)"test detect ${IFS} in traffic"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; Flow f; memset(&f, 0, sizeof(Flow)); FLOW_INITIALIZE(&f); p->dp = 515; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flowflags |= FLOW_PKT_TOSERVER; p->flow = &f; p->flags |= PKT_HAS_FLOW; char sig[] = "alert tcp any any -> any 515 " "(msg:\"detect IFS\"; flow:to_server,established; content:\"${IFS}\";" " depth:50; offset:0; sid:900091; rev:1;)"; if (UTHPacketMatchSigMpm(p, sig, MPM_AC) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); FLOW_DESTROY(&f); return result; } static int SigTest77TestBug139(void) { uint8_t buf[] = { 0x12, 0x23, 0x34, 0x35, 0x52, 0x52, 0x24, 0x42, 0x22, 0x24, 0x52, 0x24, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x34 }; uint16_t buflen = sizeof(buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_UDP); int result = 0; p->dp = 53; char sig[] = "alert udp any any -> any 53 (msg:\"dns testing\";" " content:\"|00 00|\"; depth:5; offset:13; sid:9436601;" " rev:1;)"; if (UTHPacketMatchSigMpm(p, sig, MPM_AC) == 0) { result = 0; goto end; } result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int DetectLongContentTestCommon(char *sig, uint32_t sid) { /* Packet with 512 A's in it for testing long content. */ static uint8_t pkt[739] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x45, 0x00, 0x02, 0xd5, 0x4a, 0x18, 0x40, 0x00, 0x40, 0x06, 0xd7, 0xd6, 0x0a, 0x10, 0x01, 0x0b, 0x0a, 0x10, 0x01, 0x0a, 0xdb, 0x36, 0x00, 0x50, 0xca, 0xc5, 0xcc, 0xd1, 0x95, 0x77, 0x0f, 0x7d, 0x80, 0x18, 0x00, 0xe5, 0x77, 0x9d, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x1d, 0xe0, 0x86, 0xc6, 0xfc, 0x73, 0x49, 0xf3, 0x50, 0x4f, 0x53, 0x54, 0x20, 0x2f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x63, 0x75, 0x72, 0x6c, 0x2f, 0x37, 0x2e, 0x33, 0x37, 0x2e, 0x30, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x30, 0x2e, 0x31, 0x36, 0x2e, 0x31, 0x2e, 0x31, 0x30, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20, 0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x35, 0x32, 0x38, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x78, 0x2d, 0x77, 0x77, 0x77, 0x2d, 0x66, 0x6f, 0x72, 0x6d, 0x2d, 0x75, 0x72, 0x6c, 0x65, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x64, 0x0d, 0x0a, 0x0d, 0x0a, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58 }; return DetectContentLongPatternMatchTest(pkt, (uint16_t)sizeof(pkt), sig, sid); } static int DetectLongContentTest1(void) { /* Signature with 256 A's. */ char *sig = "alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)"; return DetectLongContentTestCommon(sig, 1); } static int DetectLongContentTest2(void) { /* Signature with 512 A's. */ char *sig = "alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)"; return DetectLongContentTestCommon(sig, 1); } static int DetectLongContentTest3(void) { /* Signature with 513 A's. */ char *sig = "alert tcp any any -> any any (msg:\"Test Rule\"; content:\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"; sid:1;)"; return !DetectLongContentTestCommon(sig, 1); } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectContent */ void DetectContentRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectContentParseTest01", DetectContentParseTest01); UtRegisterTest("DetectContentParseTest02", DetectContentParseTest02); UtRegisterTest("DetectContentParseTest03", DetectContentParseTest03); UtRegisterTest("DetectContentParseTest04", DetectContentParseTest04); UtRegisterTest("DetectContentParseTest05", DetectContentParseTest05); UtRegisterTest("DetectContentParseTest06", DetectContentParseTest06); UtRegisterTest("DetectContentParseTest07", DetectContentParseTest07); UtRegisterTest("DetectContentParseTest08", DetectContentParseTest08); UtRegisterTest("DetectContentParseTest09", DetectContentParseTest09); UtRegisterTest("DetectContentParseTest10", DetectContentParseTest10); UtRegisterTest("DetectContentParseNegTest11", DetectContentParseNegTest11); UtRegisterTest("DetectContentParseNegTest12", DetectContentParseNegTest12); UtRegisterTest("DetectContentParseNegTest13", DetectContentParseNegTest13); UtRegisterTest("DetectContentParseNegTest14", DetectContentParseNegTest14); UtRegisterTest("DetectContentParseNegTest15", DetectContentParseNegTest15); UtRegisterTest("DetectContentParseNegTest16", DetectContentParseNegTest16); UtRegisterTest("DetectContentParseTest17", DetectContentParseTest17); UtRegisterTest("DetectContentParseTest18", DetectContentParseTest18); UtRegisterTest("DetectContentParseTest19", DetectContentParseTest19); UtRegisterTest("DetectContentParseTest20", DetectContentParseTest20); UtRegisterTest("DetectContentParseTest21", DetectContentParseTest21); UtRegisterTest("DetectContentParseTest22", DetectContentParseTest22); UtRegisterTest("DetectContentParseTest23", DetectContentParseTest23); UtRegisterTest("DetectContentParseTest24", DetectContentParseTest24); UtRegisterTest("DetectContentParseTest25", DetectContentParseTest25); UtRegisterTest("DetectContentParseTest26", DetectContentParseTest26); UtRegisterTest("DetectContentParseTest27", DetectContentParseTest27); UtRegisterTest("DetectContentParseTest28", DetectContentParseTest28); UtRegisterTest("DetectContentParseTest29", DetectContentParseTest29); UtRegisterTest("DetectContentParseTest30", DetectContentParseTest30); UtRegisterTest("DetectContentParseTest31", DetectContentParseTest31); UtRegisterTest("DetectContentParseTest32", DetectContentParseTest32); UtRegisterTest("DetectContentParseTest33", DetectContentParseTest33); UtRegisterTest("DetectContentParseTest34", DetectContentParseTest34); UtRegisterTest("DetectContentParseTest35", DetectContentParseTest35); UtRegisterTest("DetectContentParseTest36", DetectContentParseTest36); UtRegisterTest("DetectContentParseTest37", DetectContentParseTest37); UtRegisterTest("DetectContentParseTest38", DetectContentParseTest38); UtRegisterTest("DetectContentParseTest39", DetectContentParseTest39); UtRegisterTest("DetectContentParseTest40", DetectContentParseTest40); UtRegisterTest("DetectContentParseTest41", DetectContentParseTest41); UtRegisterTest("DetectContentParseTest42", DetectContentParseTest42); UtRegisterTest("DetectContentParseTest43", DetectContentParseTest43); UtRegisterTest("DetectContentParseTest44", DetectContentParseTest44); UtRegisterTest("DetectContentParseTest45", DetectContentParseTest45); /* The reals */ UtRegisterTest("DetectContentLongPatternMatchTest01", DetectContentLongPatternMatchTest01); UtRegisterTest("DetectContentLongPatternMatchTest02", DetectContentLongPatternMatchTest02); UtRegisterTest("DetectContentLongPatternMatchTest03", DetectContentLongPatternMatchTest03); UtRegisterTest("DetectContentLongPatternMatchTest04", DetectContentLongPatternMatchTest04); UtRegisterTest("DetectContentLongPatternMatchTest05", DetectContentLongPatternMatchTest05); UtRegisterTest("DetectContentLongPatternMatchTest06", DetectContentLongPatternMatchTest06); UtRegisterTest("DetectContentLongPatternMatchTest07", DetectContentLongPatternMatchTest07); UtRegisterTest("DetectContentLongPatternMatchTest08", DetectContentLongPatternMatchTest08); UtRegisterTest("DetectContentLongPatternMatchTest09", DetectContentLongPatternMatchTest09); UtRegisterTest("DetectContentLongPatternMatchTest10", DetectContentLongPatternMatchTest10); UtRegisterTest("DetectContentLongPatternMatchTest11", DetectContentLongPatternMatchTest11); /* Negated content tests */ UtRegisterTest("SigTest41TestNegatedContent", SigTest41TestNegatedContent); UtRegisterTest("SigTest41aTestNegatedContent", SigTest41aTestNegatedContent); UtRegisterTest("SigTest42TestNegatedContent", SigTest42TestNegatedContent); UtRegisterTest("SigTest43TestNegatedContent", SigTest43TestNegatedContent); UtRegisterTest("SigTest44TestNegatedContent", SigTest44TestNegatedContent); UtRegisterTest("SigTest45TestNegatedContent", SigTest45TestNegatedContent); UtRegisterTest("SigTest46TestNegatedContent", SigTest46TestNegatedContent); UtRegisterTest("SigTest47TestNegatedContent", SigTest47TestNegatedContent); UtRegisterTest("SigTest48TestNegatedContent", SigTest48TestNegatedContent); UtRegisterTest("SigTest49TestNegatedContent", SigTest49TestNegatedContent); UtRegisterTest("SigTest50TestNegatedContent", SigTest50TestNegatedContent); UtRegisterTest("SigTest51TestNegatedContent", SigTest51TestNegatedContent); UtRegisterTest("SigTest52TestNegatedContent", SigTest52TestNegatedContent); UtRegisterTest("SigTest53TestNegatedContent", SigTest53TestNegatedContent); UtRegisterTest("SigTest54TestNegatedContent", SigTest54TestNegatedContent); UtRegisterTest("SigTest55TestNegatedContent", SigTest55TestNegatedContent); UtRegisterTest("SigTest56TestNegatedContent", SigTest56TestNegatedContent); UtRegisterTest("SigTest57TestNegatedContent", SigTest57TestNegatedContent); UtRegisterTest("SigTest58TestNegatedContent", SigTest58TestNegatedContent); UtRegisterTest("SigTest59TestNegatedContent", SigTest59TestNegatedContent); UtRegisterTest("SigTest60TestNegatedContent", SigTest60TestNegatedContent); UtRegisterTest("SigTest61TestNegatedContent", SigTest61TestNegatedContent); UtRegisterTest("SigTest62TestNegatedContent", SigTest62TestNegatedContent); UtRegisterTest("SigTest63TestNegatedContent", SigTest63TestNegatedContent); UtRegisterTest("SigTest64TestNegatedContent", SigTest64TestNegatedContent); UtRegisterTest("SigTest65TestNegatedContent", SigTest65TestNegatedContent); UtRegisterTest("SigTest66TestNegatedContent", SigTest66TestNegatedContent); UtRegisterTest("SigTest67TestNegatedContent", SigTest67TestNegatedContent); UtRegisterTest("SigTest68TestNegatedContent", SigTest68TestNegatedContent); UtRegisterTest("SigTest69TestNegatedContent", SigTest69TestNegatedContent); UtRegisterTest("SigTest70TestNegatedContent", SigTest70TestNegatedContent); UtRegisterTest("SigTest71TestNegatedContent", SigTest71TestNegatedContent); UtRegisterTest("SigTest72TestNegatedContent", SigTest72TestNegatedContent); UtRegisterTest("SigTest73TestNegatedContent", SigTest73TestNegatedContent); UtRegisterTest("SigTest74TestNegatedContent", SigTest74TestNegatedContent); UtRegisterTest("SigTest75TestNegatedContent", SigTest75TestNegatedContent); UtRegisterTest("SigTest76TestBug134", SigTest76TestBug134); UtRegisterTest("SigTest77TestBug139", SigTest77TestBug139); UtRegisterTest("DetectLongContentTest1", DetectLongContentTest1); UtRegisterTest("DetectLongContentTest2", DetectLongContentTest2); UtRegisterTest("DetectLongContentTest3", DetectLongContentTest3); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-time.c0000644000000000000000000003454413051004444013070 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Ken Steele * * Time keeping for offline (non-live) packet handling (pcap files). * And time string generation for alerts. */ /* Real time vs offline time * * When we run on live traffic, time handling is simple. Packets have a * timestamp set by the capture method. Management threads can simply * use 'gettimeofday' to know the current time. There should never be * any serious gap between the two. * * In offline mode, things are dramatically different. Here we try to keep * the time from the pcap, which means that if the packets are in 2011 the * log output should also reflect this. Multiple issues: * 1. merged pcaps might have huge time jumps or time going backward * 2. slowly recorded pcaps may be processed much faster than their 'realtime' * 3. management threads need a concept of what the 'current' time is for * enforcing timeouts * 4. due to (1) individual threads may have very different views on what * the current time is. E.g. T1 processed packet 1 with TS X, while T2 * at the very same time processes packet 2 with TS X+100000s. * * In offline mode we keep the timestamp per thread. If a management thread * needs current time, it will get the minimum of the threads' values. This * is to avoid the problem that T2s time value might already trigger a flow * timeout as the flow lastts + 100000s is almost certainly meaning the flow * would be considered timed out. */ #include "suricata-common.h" #include "detect.h" #include "threads.h" #include "tm-threads.h" #include "util-debug.h" #ifdef UNITTESTS static struct timeval current_time = { 0, 0 }; #endif //static SCMutex current_time_mutex = SCMUTEX_INITIALIZER; static SCSpinlock current_time_spinlock; static char live = TRUE; struct tm *SCLocalTime(time_t timep, struct tm *result); struct tm *SCUtcTime(time_t timep, struct tm *result); void TimeInit(void) { SCSpinInit(¤t_time_spinlock, 0); /* Initialize Time Zone settings. */ tzset(); } void TimeDeinit(void) { SCSpinDestroy(¤t_time_spinlock); } void TimeModeSetLive(void) { live = TRUE; SCLogDebug("live time mode enabled"); } void TimeModeSetOffline (void) { live = FALSE; SCLogDebug("offline time mode enabled"); } int TimeModeIsLive(void) { return live; } void TimeSetByThread(const int thread_id, const struct timeval *tv) { if (live == TRUE) return; TmThreadsSetThreadTimestamp(thread_id, tv); } #ifdef UNITTESTS void TimeSet(struct timeval *tv) { if (live == TRUE) return; if (tv == NULL) return; SCSpinLock(¤t_time_spinlock); current_time.tv_sec = tv->tv_sec; current_time.tv_usec = tv->tv_usec; SCLogDebug("time set to %" PRIuMAX " sec, %" PRIuMAX " usec", (uintmax_t)current_time.tv_sec, (uintmax_t)current_time.tv_usec); SCSpinUnlock(¤t_time_spinlock); } /** \brief set the time to "gettimeofday" meant for testing */ void TimeSetToCurrentTime(void) { struct timeval tv; memset(&tv, 0x00, sizeof(tv)); gettimeofday(&tv, NULL); TimeSet(&tv); } #endif void TimeGet(struct timeval *tv) { if (tv == NULL) return; if (live == TRUE) { gettimeofday(tv, NULL); } else { #ifdef UNITTESTS if (unlikely(RunmodeIsUnittests())) { SCSpinLock(¤t_time_spinlock); tv->tv_sec = current_time.tv_sec; tv->tv_usec = current_time.tv_usec; SCSpinUnlock(¤t_time_spinlock); } else { #endif TmreadsGetMinimalTimestamp(tv); #ifdef UNITTESTS } #endif } SCLogDebug("time we got is %" PRIuMAX " sec, %" PRIuMAX " usec", (uintmax_t)tv->tv_sec, (uintmax_t)tv->tv_usec); } #ifdef UNITTESTS /** \brief increment the time in the engine * \param tv_sec seconds to increment the time with */ void TimeSetIncrementTime(uint32_t tv_sec) { struct timeval tv; memset(&tv, 0x00, sizeof(tv)); TimeGet(&tv); tv.tv_sec += tv_sec; TimeSet(&tv); } #endif void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size) { time_t time = ts->tv_sec; struct tm local_tm; memset(&local_tm, 0, sizeof(local_tm)); struct tm *t = (struct tm*)SCLocalTime(time, &local_tm); char time_fmt[64] = { 0 }; if (likely(t != NULL)) { strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S.%%06u%z", t); snprintf(str, size, time_fmt, ts->tv_usec); } else { snprintf(str, size, "ts-error"); } } void CreateUtcIsoTimeString (const struct timeval *ts, char *str, size_t size) { time_t time = ts->tv_sec; struct tm local_tm; memset(&local_tm, 0, sizeof(local_tm)); struct tm *t = (struct tm*)SCUtcTime(time, &local_tm); char time_fmt[64] = { 0 }; if (likely(t != NULL)) { strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S", t); snprintf(str, size, time_fmt, ts->tv_usec); } else { snprintf(str, size, "ts-error"); } } struct tm *SCUtcTime(time_t timep, struct tm *result) { return gmtime_r(&timep, result); } /* * Time Caching code */ #ifndef TLS /* OpenBSD does not support __thread, so don't use time caching on BSD */ struct tm *SCLocalTime(time_t timep, struct tm *result) { return localtime_r(&timep, result); } void CreateTimeString (const struct timeval *ts, char *str, size_t size) { time_t time = ts->tv_sec; struct tm local_tm; struct tm *t = (struct tm*)SCLocalTime(time, &local_tm); if (likely(t != NULL)) { snprintf(str, size, "%02d/%02d/%02d-%02d:%02d:%02d.%06u", t->tm_mon + 1, t->tm_mday, t->tm_year + 1900, t->tm_hour, t->tm_min, t->tm_sec, (uint32_t) ts->tv_usec); } else { snprintf(str, size, "ts-error"); } } #else /* On systems supporting __thread, use Per-thread values for caching * in CreateTimeString */ /* The maximum possible length of the time string. * "%02d/%02d/%02d-%02d:%02d:%02d.%06u" * Or "01/01/2013-15:42:21.123456", which is 26, so round up to 32. */ #define MAX_LOCAL_TIME_STRING 32 static __thread int mru_time_slot; /* Most recently used cached value */ static __thread time_t last_local_time[2]; static __thread short int cached_local_time_len[2]; static __thread char cached_local_time[2][MAX_LOCAL_TIME_STRING]; /* Per-thread values for caching SCLocalTime() These cached values are * independent from the CreateTimeString cached values. */ static __thread int mru_tm_slot; /* Most recently used local tm */ static __thread time_t cached_minute_start[2]; static __thread struct tm cached_local_tm[2]; /** \brief Convert time_t into Year, month, day, hour and minutes. * \param timep Time in seconds since defined date. * \param result The structure into which the broken down time it put. * * To convert a time in seconds into year, month, day, hours, minutes * and seconds, call localtime_r(), which uses the current time zone * to compute these values. Note, glibc's localtime_r() aquires a lock * each time it is called, which limits parallelism. To call * localtime_r() less often, the values returned are cached for the * current and previous minute and then seconds are adjusted to * compute the returned result. This is valid as long as the * difference between the start of the current minute and the current * time is less than 60 seconds. Once the minute value changes, all * the other values could change. * * Two values are cached to prevent thrashing when changing from one * minute to the next. The two cached minutes are independent and are * not required to be M and M+1. If more than two minutes are * requested, the least-recently-used cached value is updated more * often, the results are still correct, but performance will be closer * to previous performance. */ struct tm *SCLocalTime(time_t timep, struct tm *result) { /* Only get a new local time when the time crosses into a new * minute. */ int mru = mru_tm_slot; int lru = 1 - mru; int mru_seconds = timep - cached_minute_start[mru]; int lru_seconds = timep - cached_minute_start[lru]; int new_seconds; if (mru_seconds >= 0 && mru_seconds <= 59) { /* Use most-recently cached time, adjusting the seconds. */ new_seconds = mru_seconds; } else if (lru_seconds >= 0 && lru_seconds <= 59) { /* Use least-recently cached time, update to most recently used. */ new_seconds = lru_seconds; mru = lru; mru_tm_slot = mru; } else { /* Update least-recent cached time. */ if (localtime_r(&timep, &cached_local_tm[lru]) == NULL) return NULL; /* Subtract seconds to get back to the start of the minute. */ new_seconds = cached_local_tm[lru].tm_sec; cached_minute_start[lru] = timep - new_seconds; mru = lru; mru_tm_slot = mru; } memcpy(result, &cached_local_tm[mru], sizeof(struct tm)); result->tm_sec = new_seconds; return result; } /* Update the cached time string in cache index N, for the current minute. */ static int UpdateCachedTime(int n, time_t time) { struct tm local_tm; struct tm *t = (struct tm *)SCLocalTime(time, &local_tm); int cached_len = snprintf(cached_local_time[n], MAX_LOCAL_TIME_STRING, "%02d/%02d/%02d-%02d:%02d:", t->tm_mon + 1, t->tm_mday, t->tm_year + 1900, t->tm_hour, t->tm_min); cached_local_time_len[n] = cached_len; /* Store the time of the beginning of the minute. */ last_local_time[n] = time - t->tm_sec; mru_time_slot = n; return t->tm_sec; } /** \brief Return a formatted string for the provided time. * * Cache the Month/Day/Year - Hours:Min part of the time string for * the current minute. Copy that result into the the return string and * then only print the seconds for each call. */ void CreateTimeString (const struct timeval *ts, char *str, size_t size) { time_t time = ts->tv_sec; int seconds; /* Only get a new local time when the time crosses into a new * minute */ int mru = mru_time_slot; int lru = 1 - mru; int mru_seconds = time - last_local_time[mru]; int lru_seconds = time - last_local_time[lru]; if (mru_seconds >= 0 && mru_seconds <= 59) { /* Use most-recently cached time. */ seconds = mru_seconds; } else if (lru_seconds >= 0 && lru_seconds <= 59) { /* Use least-recently cached time. Change this slot to Most-recent */ seconds = lru_seconds; mru_time_slot = lru; } else { /* Update least-recent cached time. Lock accessing local time * function because it keeps any internal non-spin lock. */ seconds = UpdateCachedTime(lru, time); } /* Copy the string up to the current minute then print the seconds into the return string buffer. */ char *cached_str = cached_local_time[mru_time_slot]; int cached_len = cached_local_time_len[mru_time_slot]; if (cached_len >= (int)size) cached_len = size; memcpy(str, cached_str, cached_len); snprintf(str + cached_len, size - cached_len, "%02d.%06u", seconds, (uint32_t) ts->tv_usec); } #endif /* defined(__OpenBSD__) */ /** * \brief Convert broken-down time to seconds since Unix epoch. * * This function is based on: http://www.catb.org/esr/time-programming * (released to the public domain). * * \param tp Pointer to broken-down time. * * \retval Seconds since Unix epoch. */ time_t SCMkTimeUtc (struct tm *tp) { time_t result; long year; #define MONTHSPERYEAR 12 static const int mdays[MONTHSPERYEAR] = { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 }; year = 1900 + tp->tm_year + tp->tm_mon / MONTHSPERYEAR; result = (year - 1970) * 365 + mdays[tp->tm_mon % MONTHSPERYEAR]; result += (year - 1968) / 4; result -= (year - 1900) / 100; result += (year - 1600) / 400; if ((year % 4) == 0 && ((year % 100) != 0 || (year % 400) == 0) && (tp->tm_mon % MONTHSPERYEAR) < 2) result--; result += tp->tm_mday - 1; result *= 24; result += tp->tm_hour; result *= 60; result += tp->tm_min; result *= 60; result += tp->tm_sec; if (tp->tm_gmtoff) result -= tp->tm_gmtoff; return result; } /** * \brief Parse a date string based on specified patterns. * * This function is based on GNU C library getdate. * * \param string Date string to parse. * \param patterns String array containing patterns. * \param num_patterns Number of patterns to check. * \param tp Pointer to broken-down time. * * \retval 0 on success. * \retval 1 on failure. */ int SCStringPatternToTime (char *string, char **patterns, int num_patterns, struct tm *tp) { char *result = NULL; int i = 0; /* Do the pattern matching */ for (i = 0; i < num_patterns; i++) { if (patterns[i] == NULL) continue; tp->tm_hour = tp->tm_min = tp->tm_sec = 0; tp->tm_year = tp->tm_mon = tp->tm_mday = tp->tm_wday = INT_MIN; tp->tm_isdst = -1; tp->tm_gmtoff = 0; tp->tm_zone = NULL; result = strptime(string, patterns[i], tp); if (result && *result == '\0') break; } /* Return if no patterns matched */ if (result == NULL || *result != '\0') return 1; /* Return if no date is given */ if (tp->tm_year == INT_MIN && tp->tm_mon == INT_MIN && tp->tm_mday == INT_MIN) return 1; /* The first of the month is assumed, if only year and month is given */ if (tp->tm_year != INT_MIN && tp->tm_mon != INT_MIN && tp->tm_mday <= 0) tp->tm_mday = 1; return 0; } suricata-3.2.1/src/decode-erspan.c0000644000000000000000000000407413051004444013663 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Victor Julien * * Decodes ERSPAN */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "decode-events.h" #include "decode-erspan.h" #include "util-unittest.h" #include "util-debug.h" /** * \brief Function to decode ERSPAN packets */ int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_erspan); if (len < sizeof(ErspanHdr)) { ENGINE_SET_EVENT(p,ERSPAN_HEADER_TOO_SMALL); return TM_ECODE_FAILED; } const ErspanHdr *ehdr = (const ErspanHdr *)pkt; uint16_t version = ntohs(ehdr->ver_vlan) >> 12; uint16_t vlan_id = ntohs(ehdr->ver_vlan) & 0x0fff; SCLogDebug("ERSPAN: version %u vlan %u", version, vlan_id); /* only v1 is tested at this time */ if (version != 1) { ENGINE_SET_EVENT(p,ERSPAN_UNSUPPORTED_VERSION); return TM_ECODE_FAILED; } if (vlan_id > 0 && dtv->vlan_disabled == 0) { if (p->vlan_idx >= 2) { ENGINE_SET_EVENT(p,ERSPAN_TOO_MANY_VLAN_LAYERS); return TM_ECODE_FAILED; } p->vlan_id[p->vlan_idx] = vlan_id; p->vlan_idx++; } return DecodeEthernet(tv, dtv, p, pkt + sizeof(ErspanHdr), len - sizeof(ErspanHdr), pq); } /** * @} */ suricata-3.2.1/src/util-unittest.h0000644000000000000000000000607213051004444014011 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Breno Silva * * Unit test framework */ /** * \addtogroup Testing * * @{ */ #ifndef __UTIL_UNITTEST_H__ #define __UTIL_UNITTEST_H__ #ifdef UNITTESTS typedef struct UtTest_ { char *name; int(*TestFn)(void); struct UtTest_ *next; } UtTest; void UtRegisterTest(char *name, int(*TestFn)(void)); uint32_t UtRunTests(char *regex_arg); void UtInitialize(void); void UtCleanup(void); int UtRunSelftest (char *regex_arg); void UtListTests(char *regex_arg); void UtRunModeRegister(void); extern int unittests_fatal; /** * \breif Fail a test. */ #define FAIL do { \ if (unittests_fatal) { \ BUG_ON(1); \ } else { \ return 0; \ } \ } while (0) /** * \brief Fail a test if expression evaluates to false. */ #define FAIL_IF(expr) do { \ if (unittests_fatal) { \ BUG_ON(expr); \ } else if (expr) { \ return 0; \ } \ } while (0) /** * \brief Fail a test if expression to true. */ #define FAIL_IF_NOT(expr) do { \ FAIL_IF(!(expr)); \ } while (0) /** * \brief Fail a test if expression evaluates to NULL. */ #define FAIL_IF_NULL(expr) do { \ FAIL_IF(NULL == expr); \ } while (0) /** * \brief Fail a test if expression evaluates to non-NULL. */ #define FAIL_IF_NOT_NULL(expr) do { \ FAIL_IF(NULL != expr); \ } while (0) /** * \brief Pass the test. * * Only to be used at the end of a function instead instead of "return 1." */ #define PASS do { \ return 1; \ } while (0) #endif /** * \brief Pass the test if expression evaluates to true. * * Only to be used at the end of a function instead of returning the * result of an expression. */ #define PASS_IF(expr) do { \ FAIL_IF(!(expr)); \ PASS; \ } while (0) #endif /* __UTIL_UNITTEST_H__ */ /** * @} */ suricata-3.2.1/src/detect-engine-filedata-smtp.c0000644000000000000000000004320413051004444016413 00000000000000/* Copyright (C) 2015-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Giuseppe Longo * \author Victor Julien * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-smtp.h" #include "app-layer-protos.h" #include "util-validate.h" #include "conf.h" #include "conf-yaml-loader.h" #define BUFFER_STEP 50 static inline int SMTPCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size) { void *ptmp; if (size > det_ctx->smtp_buffers_size) { ptmp = SCRealloc(det_ctx->smtp, (det_ctx->smtp_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody)); if (ptmp == NULL) { SCFree(det_ctx->smtp); det_ctx->smtp = NULL; det_ctx->smtp_buffers_size = 0; det_ctx->smtp_buffers_list_len = 0; return -1; } det_ctx->smtp = ptmp; memset(det_ctx->smtp + det_ctx->smtp_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody)); det_ctx->smtp_buffers_size += BUFFER_STEP; } for (int i = det_ctx->smtp_buffers_list_len; i < (size); i++) { det_ctx->smtp[i].buffer_len = 0; det_ctx->smtp[i].offset = 0; } return 0; } static const uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Flow *f, File *curr_file, uint8_t flags, uint32_t *buffer_len, uint32_t *stream_start_offset) { SCEnter(); int index = 0; const uint8_t *buffer = NULL; *buffer_len = 0; *stream_start_offset = 0; uint64_t file_size = FileDataSize(curr_file); if (det_ctx->smtp_buffers_list_len == 0) { if (SMTPCreateSpace(det_ctx, 1) < 0) goto end; index = 0; if (det_ctx->smtp_buffers_list_len == 0) { det_ctx->smtp_start_tx_id = tx_id; } det_ctx->smtp_buffers_list_len++; } else { if ((tx_id - det_ctx->smtp_start_tx_id) < det_ctx->smtp_buffers_list_len) { if (det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len != 0) { *buffer_len = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len; *stream_start_offset = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].offset; buffer = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer; SCReturnPtr(buffer, "uint8_t"); } } else { if (SMTPCreateSpace(det_ctx, (tx_id - det_ctx->smtp_start_tx_id) + 1) < 0) goto end; if (det_ctx->smtp_buffers_list_len == 0) { det_ctx->smtp_start_tx_id = tx_id; } det_ctx->smtp_buffers_list_len++; } index = (tx_id - det_ctx->smtp_start_tx_id); } SCLogDebug("smtp_config.content_limit %u, smtp_config.content_inspect_min_size %u", smtp_config.content_limit, smtp_config.content_inspect_min_size); SCLogDebug("file %p size %"PRIu64", state %d", curr_file, file_size, curr_file->state); /* no new data */ if (curr_file->content_inspected == file_size) { SCLogDebug("no new data"); goto end; } if (file_size == 0) { SCLogDebug("no data to inspect for this transaction"); goto end; } if ((smtp_config.content_limit == 0 || file_size < smtp_config.content_limit) && file_size < smtp_config.content_inspect_min_size && !(flags & STREAM_EOF) && !(curr_file->state > FILE_STATE_OPENED)) { SCLogDebug("we still haven't seen the entire content. " "Let's defer content inspection till we see the " "entire content."); goto end; } StreamingBufferGetDataAtOffset(curr_file->sb, &det_ctx->smtp[index].buffer, &det_ctx->smtp[index].buffer_len, curr_file->content_inspected); det_ctx->smtp[index].offset = curr_file->content_inspected; /* updat inspected tracker */ curr_file->content_inspected = FileDataSize(curr_file); SCLogDebug("content_inspected %u, offset %u", (uint)curr_file->content_inspected, (uint)det_ctx->smtp[index].offset); buffer = det_ctx->smtp[index].buffer; *buffer_len = det_ctx->smtp[index].buffer_len; *stream_start_offset = det_ctx->smtp[index].offset; end: SCLogDebug("buffer %p, len %u", buffer, *buffer_len); SCReturnPtr(buffer, "uint8_t"); } int DetectEngineInspectSMTPFiledata(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) { SMTPState *smtp_state = (SMTPState *)alstate; FileContainer *ffc = smtp_state->files_ts; int r = 0; int match = 0; uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = 0; if (ffc != NULL) { File *file = ffc->head; for (; file != NULL; file = file->next) { buffer = DetectEngineSMTPGetBufferForTX(tx_id, de_ctx, det_ctx, f, file, flags, &buffer_len, &stream_start_offset); if (buffer_len == 0) goto end; det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; match = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_FILEDATA], f, (uint8_t *)buffer, buffer_len, stream_start_offset, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (match == 1) r = 1; } } end: if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } void DetectEngineCleanSMTPBuffers(DetectEngineThreadCtx *det_ctx) { if (det_ctx->smtp_buffers_list_len > 0) { for (int i = 0; i < det_ctx->smtp_buffers_list_len; i++) { det_ctx->smtp[i].buffer_len = 0; det_ctx->smtp[i].offset = 0; } } det_ctx->smtp_buffers_list_len = 0; det_ctx->smtp_start_tx_id = 0; return; } /** \brief SMTP Filedata Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context * * \todo check files against actual tx */ static void PrefilterTxSmtpFiledata(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; SMTPState *smtp_state = f->alstate; FileContainer *ffc = smtp_state->files_ts; if (ffc != NULL) { File *file = ffc->head; for (; file != NULL; file = file->next) { uint32_t buffer_len = 0; uint32_t stream_start_offset = 0; const uint8_t *buffer = DetectEngineSMTPGetBufferForTX(idx, NULL, det_ctx, f, file, flags, &buffer_len, &stream_start_offset); if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } } } int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxSmtpFiledata, ALPROTO_SMTP, 0, mpm_ctx, NULL, "file_data (smtp)"); } #ifdef UNITTESTS static int DetectEngineSMTPFiledataTest01(void) { uint8_t mimemsg[] = {0x4D, 0x49, 0x4D, 0x45, 0x2D, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x31, 0x2E, 0x30, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x79, 0x70, 0x65, 0x3A, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2F, 0x70, 0x6C, 0x61, 0x69, 0x6E, 0x3B, 0x20, 0x63, 0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x3D, 0x55, 0x54, 0x46, 0x2D, 0x38, 0x3B, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x54, 0x72, 0x61, 0x6E, 0x73, 0x66, 0x65, 0x72, 0x2D, 0x45, 0x6E, 0x63, 0x6F, 0x64, 0x69, 0x6E, 0x67, 0x3A, 0x20, 0x37, 0x62, 0x69, 0x74, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x2D, 0x44, 0x69, 0x73, 0x70, 0x6F, 0x73, 0x69, 0x74, 0x69, 0x6F, 0x6E, 0x3A, 0x20, 0x61, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6D, 0x65, 0x6E, 0x74, 0x3B, 0x20, 0x66, 0x69, 0x6C, 0x65, 0x6E, 0x61, 0x6D, 0x65, 0x3D, 0x22, 0x74, 0x65, 0x73, 0x74, 0x2E, 0x74, 0x78, 0x74, 0x22, 0x0D, 0x0A, 0x0D, 0x0A, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,}; uint32_t mimemsg_len = sizeof(mimemsg) - 1; TcpSession ssn; Packet *p; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; SMTPState *smtp_state = NULL; Flow f; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alstate = SMTPStateAlloc(); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; state->body_begin = 1; if (SMTPProcessDataChunk((uint8_t *)mimemsg, sizeof(mimemsg), state) != 0) goto end; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST|PKT_STREAM_EOF; f.alproto = ALPROTO_SMTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any " "(msg:\"file_data smtp test\"; " "file_data; content:\"message\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER | STREAM_START | STREAM_EOF, mimemsg, mimemsg_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %d", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have\n"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineSMTPFiledataTest02(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert smtp any any -> any any " "(msg:\"file_data smtp test\"; " "file_data; content:\"message\"; sid:1;)"); if (s == NULL) goto end; if (s->flags & SIG_FLAG_TOSERVER) result = 1; else if (s->flags & SIG_FLAG_TOCLIENT) printf("s->flags & SIG_FLAG_TOCLIENT"); end: SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } static int DetectEngineSMTPFiledataTest03(void) { uint8_t mimemsg1[] = {0x65, 0x76,}; uint8_t mimemsg2[] = {0x69, 0x6C,}; uint32_t mimemsg1_len = sizeof(mimemsg1) - 1; uint32_t mimemsg2_len = sizeof(mimemsg2) - 1; TcpSession ssn; Packet *p; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; SMTPState *smtp_state = NULL; Flow f; int result = 1; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; f.alstate = SMTPStateAlloc(); MimeDecParseState *state = MimeDecInitParser(&f, NULL); ((MimeDecEntity *)state->stack->top->data)->ctnt_flags = CTNT_IS_ATTACHMENT; state->body_begin = 1; if (SMTPProcessDataChunk((uint8_t *)mimemsg1, sizeof(mimemsg1), state) != 0) goto end; if (SMTPProcessDataChunk((uint8_t *)mimemsg2, sizeof(mimemsg2), state) != 0) goto end; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SMTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert smtp any any -> any any " "(msg:\"file_data smtp test\"; " "file_data; content:\"evil\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = 0; r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, mimemsg1, mimemsg1_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %d", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SMTP, STREAM_TOSERVER, mimemsg2, mimemsg2_len); if (r != 0) { printf("AppLayerParse for smtp failed. Returned %d", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); smtp_state = f.alstate; if (smtp_state == NULL) { printf("no smtp state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have\n"); goto end; } result = 0; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result == 0; } #endif /* UNITTESTS */ void DetectEngineSMTPFiledataRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineSMTPFiledataTest01", DetectEngineSMTPFiledataTest01); UtRegisterTest("DetectEngineSMTPFiledataTest02", DetectEngineSMTPFiledataTest02); UtRegisterTest("DetectEngineSMTPFiledataTest03", DetectEngineSMTPFiledataTest03); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-byte.h0000644000000000000000000002142413051004444013073 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus */ #ifndef __UTIL_BYTE_H__ #define __UTIL_BYTE_H__ #include #define BYTE_BIG_ENDIAN 0 #define BYTE_LITTLE_ENDIAN 1 /** Wrappers for OS dependent byte swapping functions */ #ifdef OS_FREEBSD #include #define SCByteSwap16(x) bswap16(x) #define SCByteSwap32(x) bswap32(x) #define SCByteSwap64(x) bswap64(x) #elif defined __OpenBSD__ #include #define SCByteSwap16(x) swap16(x) #define SCByteSwap32(x) swap32(x) #define SCByteSwap64(x) swap64(x) #elif OS_DARWIN #include #define SCByteSwap16(x) OSSwapInt16(x) #define SCByteSwap32(x) OSSwapInt32(x) #define SCByteSwap64(x) OSSwapInt64(x) #elif defined(__WIN32) || defined(_WIN32) || defined(sun) /* Quick & dirty solution, nothing seems to exist for this in Win32 API */ #define SCByteSwap16(x) \ ((((x) & 0xff00) >> 8) \ | (((x) & 0x00ff) << 8)) #define SCByteSwap32(x) \ ((((x) & 0xff000000) >> 24) \ | (((x) & 0x00ff0000) >> 8) \ | (((x) & 0x0000ff00) << 8) \ | (((x) & 0x000000ff) << 24)) #define SCByteSwap64(x) \ ((((x) & 0xff00000000000000ull) >> 56) \ | (((x) & 0x00ff000000000000ull) >> 40) \ | (((x) & 0x0000ff0000000000ull) >> 24) \ | (((x) & 0x000000ff00000000ull) >> 8) \ | (((x) & 0x00000000ff000000ull) << 8) \ | (((x) & 0x0000000000ff0000ull) << 24) \ | (((x) & 0x000000000000ff00ull) << 40) \ | (((x) & 0x00000000000000ffull) << 56)) #else #include #define SCByteSwap16(x) bswap_16(x) #define SCByteSwap32(x) bswap_32(x) #define SCByteSwap64(x) bswap_64(x) #endif /* OS_FREEBSD */ /** \brief Turn byte array into string. * * All non-printables are copied over, except for '\0', which is * turned into literal \0 in the string. * * \param bytes byte array * \param nbytes number of bytes * \return string nul-terminated string or NULL on error */ char *BytesToString(const uint8_t *bytes, size_t nbytes); /** * Extract bytes from a byte string and convert to a unint64_t. * * \param res Stores result * \param e Endianness (BYTE_BIG_ENDIAN or BYTE_LITTLE_ENDIAN) * \param len Number of bytes to extract (8 max) * \param bytes Data to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract bytes from a byte string and convert to a unint32_t. * * \param res Stores result * \param e Endianness (BYTE_BIG_ENDIAN or BYTE_LITTLE_ENDIAN) * \param len Number of bytes to extract (8 max) * \param bytes Data to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract bytes from a byte string and convert to a unint16_t. * * \param res Stores result * \param e Endianness (BYTE_BIG_ENDIAN or BYTE_LITTLE_ENDIAN) * \param len Number of bytes to extract (8 max) * \param bytes Data to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes); /** * Extract unsigned integer value from a string. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint64_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param len Number of bytes to extract (23 max) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint32_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint16_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str); /** * Extract unsigned integer value from a string as uint8_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint64_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint32_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint16_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str); /** * Extract signed integer value from a string as uint8_t. * * \param res Stores result * \param base Base of the number to extract * \param len Number of bytes to extract (23 max or 0 for unbounded) * \param str String to extract from * * \return n Number of bytes extracted on success * \return -1 On error */ int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str); #ifdef UNITTESTS void ByteRegisterTests(void); #endif /* UNITTESTS */ /** ------ Inline functions ----- */ static inline int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t *bytes) { uint64_t b = 0; int i; if ((e != BYTE_BIG_ENDIAN) && (e != BYTE_LITTLE_ENDIAN)) { /** \todo Need standard return values */ return -1; } *res = 0; /* Go through each byte and merge it into the result in the correct order */ /** \todo Probably a more efficient way to do this. */ for (i = 0; i < len; i++) { if (e == BYTE_LITTLE_ENDIAN) { b = bytes[i]; } else { b = bytes[len - i - 1]; } *res |= (b << ((i & 7) << 3)); } return len; } #endif /* __UTIL_BYTE_H__ */ suricata-3.2.1/src/util-pool.h0000644000000000000000000000436313051004444013104 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup utilpool * * @{ */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_POOL_H__ #define __UTIL_POOL_H__ #define POOL_BUCKET_PREALLOCATED (1 << 0) /* pool bucket structure */ typedef struct PoolBucket_ { void *data; uint8_t flags; struct PoolBucket_ *next; } PoolBucket; /* pool structure */ typedef struct Pool_ { uint32_t max_buckets; uint32_t preallocated; uint32_t allocated; /**< counter of data elements, both currently in * the pool and outside of it (outstanding) */ uint32_t alloc_stack_size; PoolBucket *alloc_stack; PoolBucket *empty_stack; uint32_t empty_stack_size; int data_buffer_size; void *data_buffer; PoolBucket *pb_buffer; void *(*Alloc)(); int (*Init)(void *, void *); void *InitData; void (*Cleanup)(void *); void (*Free)(void *); uint32_t elt_size; uint32_t outstanding; /**< counter of data items 'in use'. Pretty much * the diff between PoolGet and PoolReturn */ uint32_t max_outstanding; /**< max value of outstanding we saw */ } Pool; /* prototypes */ Pool* PoolInit(uint32_t, uint32_t, uint32_t, void *(*Alloc)(), int (*Init)(void *, void *), void *, void (*Cleanup)(void *), void (*Free)(void *)); void PoolFree(Pool *); void PoolPrint(Pool *); void PoolPrintSaturation(Pool *p); void *PoolGet(Pool *); void PoolReturn(Pool *, void *); void PoolRegisterTests(void); #endif /* __UTIL_POOL_H__ */ /** * @} */ suricata-3.2.1/src/app-layer-smb2.h0000644000000000000000000000462013051004444013707 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl */ #ifndef __APP_LAYER_SMB2_H__ #define __APP_LAYER_SMB2_H__ #include "suricata-common.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-nbss.h" #include "flow.h" #include "stream.h" typedef struct SMB2Hdr { uint32_t Protocol; /**< Contains 0xFE,'SMB' */ uint16_t StructureSize; uint16_t CreditCharge; uint32_t Status; uint16_t Command; uint16_t CreditRequestResponse; uint32_t Flags; uint32_t NextCommand; uint64_t MessageId; uint32_t ProcessId; uint32_t TreeId; uint64_t SessionId; uint8_t Signature[16]; } SMB2Hdr; #define SMB2_HDR_LEN 64 typedef struct SMB2State_ { NBSSHdr nbss; SMB2Hdr smb2; uint16_t bytesprocessed; } SMB2State; /** from http://msdn.microsoft.com/en-us/library/cc246528(PROT.13).aspx */ #define SMB2_NEGOTIATE 0x0000 #define SMB2_SESSION_SETUP 0x0001 #define SMB2_LOGOFF 0x0002 #define SMB2_TREE_CONNECT 0x0003 #define SMB2_TREE_DISCONNECT 0x0004 #define SMB2_CREATE 0x0005 #define SMB2_CLOSE 0x0006 #define SMB2_FLUSH 0x0007 #define SMB2_READ 0x0008 #define SMB2_WRITE 0x0009 #define SMB2_LOCK 0x000A #define SMB2_IOCTL 0x000B #define SMB2_CANCEL 0x000C #define SMB2_ECHO 0x000D #define SMB2_QUERY_DIRECTORY 0x000E #define SMB2_CHANGE_NOTIFY 0x000F #define SMB2_QUERY_INFO 0x0010 #define SMB2_SET_INFO 0x0011 #define SMB2_OPLOCK_BREAK 0x0012 void RegisterSMB2Parsers(void); void SMB2ParserRegisterTests(void); #endif /* __APP_LAYER_SMB2_H__ */ suricata-3.2.1/src/detect-engine-hrud.h0000644000000000000000000000256413051004444014634 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HRUD_H__ #define __DETECT_ENGINE_HRUD_H__ #include "app-layer-htp.h" int PrefilterTxRawUriRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpRawUri(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpRawUriRegisterTests(void); #endif /* __DETECT_ENGINE_HRUD_H__ */ suricata-3.2.1/src/decode-pppoe.h0000644000000000000000000000523613051004444013524 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author James Riden */ #ifndef __DECODE_PPPOE_H__ #define __DECODE_PPPOE_H__ #include "decode.h" #include "threadvars.h" #define PPPOE_SESSION_HEADER_LEN 8 #define PPPOE_DISCOVERY_HEADER_MIN_LEN 6 #define PPPOE_SESSION_GET_VERSION(hdr) ((hdr)->pppoe_version_type & 0xF0) >> 4 #define PPPOE_SESSION_GET_TYPE(hdr) ((hdr)->pppoe_version_type & 0x0F) #define PPPOE_DISCOVERY_GET_VERSION(hdr) ((hdr)->pppoe_version_type & 0xF0) >> 4 #define PPPOE_DISCOVERY_GET_TYPE(hdr) ((hdr)->pppoe_version_type & 0x0F) typedef struct PPPOESessionHdr_ { uint8_t pppoe_version_type; uint8_t pppoe_code; uint16_t session_id; uint16_t pppoe_length; uint16_t protocol; } PPPOESessionHdr; typedef struct PPPOEDiscoveryTag_ { uint16_t pppoe_tag_type; uint16_t pppoe_tag_length; } __attribute__((__packed__)) PPPOEDiscoveryTag; typedef struct PPPOEDiscoveryHdr_ { uint8_t pppoe_version_type; uint8_t pppoe_code; uint16_t discovery_id; uint16_t pppoe_length; } __attribute__((__packed__)) PPPOEDiscoveryHdr; /* see RFC 2516 - discovery codes */ #define PPPOE_CODE_PADI 0x09 #define PPPOE_CODE_PADO 0x07 #define PPPOE_CODE_PADR 0x19 #define PPPOE_CODE_PADS 0x65 #define PPPOE_CODE_PADT 0xa7 /* see RFC 2516 Appendix A */ #define PPPOE_TAG_END_OF_LIST 0x0000 /* End-Of-List */ #define PPPOE_TAG_SERVICE_NAME 0x0101 /* Service-Name */ #define PPPOE_TAG_AC_NAME 0x0102 /* AC-Name */ #define PPPOE_TAG_HOST_UNIQ 0x0103 /* Host-Uniq */ #define PPPOE_TAG_AC_COOKIE 0x0104 /* AC-Cookie */ #define PPPOE_TAG_VENDOR_SPECIFIC 0x0105 /* Vendor-Specific */ #define PPPOE_TAG_RELAY_SESSION_ID 0x0110 /* Relay-Session-Id */ #define PPPOE_TAG_SERVICE_NAME_ERROR 0x0201 /* Service-Name-Error */ #define PPPOE_TAG_AC_SYS_ERROR 0x0202 /* AC-System Error */ #define PPPOE_TAG_GEN_ERROR 0x0203 /* Generic-Error */ void DecodePPPOERegisterTests(void); #endif /* __DECODE_PPPOE_H__ */ suricata-3.2.1/src/stream-tcp-sack.c0000644000000000000000000006346213051004444014156 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Stream engine TCP SACK handling. */ #include "suricata-common.h" #include "stream-tcp.h" #include "stream-tcp-private.h" #include "stream-tcp-sack.h" #include "util-unittest.h" #ifdef DEBUG void StreamTcpSackPrintList(TcpStream *stream) { StreamTcpSackRecord *rec = stream->sack_head; for (; rec != NULL; rec = rec->next) { SCLogDebug("record %8u - %8u", rec->le, rec->re); } } #endif /* DEBUG */ static StreamTcpSackRecord *StreamTcpSackRecordAlloc(void) { if (StreamTcpCheckMemcap((uint32_t)sizeof(StreamTcpSackRecord)) == 0) return NULL; StreamTcpSackRecord *rec = SCMalloc(sizeof(*rec)); if (unlikely(rec == NULL)) return NULL; StreamTcpIncrMemuse((uint64_t)sizeof(*rec)); return rec; } static void StreamTcpSackRecordFree(StreamTcpSackRecord *rec) { SCFree(rec); StreamTcpDecrMemuse((uint64_t)sizeof(*rec)); } /** * \brief insert a SACK range * * \param le left edge in host order * \param re right edge in host order * * \retval 0 all is good * \retval -1 error */ static int StreamTcpSackInsertRange(TcpStream *stream, uint32_t le, uint32_t re) { SCLogDebug("le %u, re %u", le, re); #ifdef DEBUG StreamTcpSackPrintList(stream); #endif /* if to the left of last_ack then ignore */ if (SEQ_LT(re, stream->last_ack)) { SCLogDebug("too far left. discarding"); goto end; } /* if to the right of the tcp window then ignore */ if (SEQ_GT(le, (stream->last_ack + stream->window))) { SCLogDebug("too far right. discarding"); goto end; } if (stream->sack_head != NULL) { StreamTcpSackRecord *rec; for (rec = stream->sack_head; rec != NULL; rec = rec->next) { SCLogDebug("rec %p, le %u, re %u", rec, rec->le, rec->re); if (SEQ_LT(le, rec->le)) { SCLogDebug("SEQ_LT(le, rec->le)"); if (SEQ_LT(re, rec->le)) { SCLogDebug("SEQ_LT(re, rec->le)"); // entirely before, prepend StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = stream->sack_head; stream->sack_head = stsr; goto end; } else if (SEQ_EQ(re, rec->le)) { SCLogDebug("SEQ_EQ(re, rec->le)"); // starts before, ends on rec->le, expand rec->le = le; } else if (SEQ_GT(re, rec->le)) { SCLogDebug("SEQ_GT(re, rec->le)"); // starts before, ends beyond rec->le if (SEQ_LEQ(re, rec->re)) { SCLogDebug("SEQ_LEQ(re, rec->re)"); // ends before rec->re, expand rec->le = le; } else { // implied if (re > rec->re) SCLogDebug("implied if (re > rec->re), le set to %u", rec->re); le = rec->re; continue; } } } else if (SEQ_EQ(le, rec->le)) { SCLogDebug("SEQ_EQ(le, rec->le)"); if (SEQ_LEQ(re, rec->re)) { SCLogDebug("SEQ_LEQ(re, rec->re)"); // new record fully overlapped SCReturnInt(0); } else { // implied re > rec->re SCLogDebug("implied re > rec->re"); if (rec->next != NULL) { if (SEQ_LEQ(re, rec->next->le)) { rec->re = re; goto end; } else { rec->re = rec->next->le; le = rec->next->le; SCLogDebug("le is now %u", le); continue; } } else { rec->re = re; goto end; } } } else { // implied (le > rec->le) SCLogDebug("implied (le > rec->le)"); if (SEQ_LT(le, rec->re)) { SCLogDebug("SEQ_LT(le, rec->re))"); // new record fully overlapped if (SEQ_GT(re, rec->re)) { SCLogDebug("SEQ_GT(re, rec->re)"); if (rec->next != NULL) { if (SEQ_LEQ(re, rec->next->le)) { rec->re = re; goto end; } else { rec->re = rec->next->le; le = rec->next->le; continue; } } else { rec->re = re; goto end; } } SCLogDebug("new range fully overlapped"); SCReturnInt(0); } else if (SEQ_EQ(le, rec->re)) { SCLogDebug("here"); // new record fully overlapped //int r = StreamTcpSackInsertRange(stream, rec->re+1, re); //SCReturnInt(r); le = rec->re; continue; } else { /* implied le > rec->re */ SCLogDebug("implied le > rec->re"); if (rec->next == NULL) { SCLogDebug("rec->next == NULL"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = NULL; stream->sack_tail->next = stsr; stream->sack_tail = stsr; goto end; } else { SCLogDebug("implied rec->next != NULL"); if (SEQ_LT(le, rec->next->le) && SEQ_LT(re, rec->next->le)) { SCLogDebug("SEQ_LT(le, rec->next->le) && SEQ_LT(re, rec->next->le)"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = rec->next; rec->next = stsr; } else if (SEQ_LT(le, rec->next->le) && SEQ_GEQ(re, rec->next->le)) { SCLogDebug("SEQ_LT(le, rec->next->le) && SEQ_GEQ(re, rec->next->le)"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = rec->next->le; stsr->next = rec->next; rec->next = stsr; le = rec->next->le; } } } } } } else { SCLogDebug("implied empty list"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = NULL; stream->sack_head = stsr; stream->sack_tail = stsr; } StreamTcpSackPruneList(stream); end: SCReturnInt(0); } /** * \brief Update stream with SACK records from a TCP packet. * * \param stream The stream to update. * \param p packet to get the SACK records from * * \retval -1 error * \retval 0 ok */ int StreamTcpSackUpdatePacket(TcpStream *stream, Packet *p) { int records = TCP_GET_SACK_CNT(p); int record = 0; const uint8_t *data = TCP_GET_SACK_PTR(p); if (records == 0 || data == NULL) return 0; TCPOptSackRecord rec[records], *sack_rec = rec; memcpy(&rec, data, sizeof(TCPOptSackRecord) * records); for (record = 0; record < records; record++) { SCLogDebug("%p last_ack %u, left edge %u, right edge %u", sack_rec, stream->last_ack, ntohl(sack_rec->le), ntohl(sack_rec->re)); if (SEQ_LEQ(ntohl(sack_rec->re), stream->last_ack)) { SCLogDebug("record before last_ack"); goto next; } /** \todo need a metric to a check for a right edge limit */ /* if (SEQ_GT(ntohl(sack_rec->re), stream->next_seq)) { SCLogDebug("record beyond next_seq %u", stream->next_seq); goto next; } */ if (SEQ_GEQ(ntohl(sack_rec->le), ntohl(sack_rec->re))) { SCLogDebug("invalid record: le >= re"); goto next; } if (StreamTcpSackInsertRange(stream, ntohl(sack_rec->le), ntohl(sack_rec->re)) == -1) { SCReturnInt(-1); } next: sack_rec++; } #ifdef DEBUG StreamTcpSackPrintList(stream); #endif SCReturnInt(0); } void StreamTcpSackPruneList(TcpStream *stream) { SCEnter(); StreamTcpSackRecord *rec = stream->sack_head; while (rec != NULL) { if (SEQ_LT(rec->re, stream->last_ack)) { SCLogDebug("removing le %u re %u", rec->le, rec->re); if (rec->next != NULL) { stream->sack_head = rec->next; StreamTcpSackRecordFree(rec); rec = stream->sack_head; continue; } else { stream->sack_head = NULL; stream->sack_tail = NULL; StreamTcpSackRecordFree(rec); break; } } else if (SEQ_LT(rec->le, stream->last_ack)) { SCLogDebug("adjusting record to le %u re %u", rec->le, rec->re); /* last ack inside this record, update */ rec->le = stream->last_ack; break; } else { SCLogDebug("record beyond last_ack, nothing to do. Bailing out."); break; } } #ifdef DEBUG StreamTcpSackPrintList(stream); #endif SCReturn; } /** * \brief Free SACK list from a stream * * \param stream Stream to cleanup */ void StreamTcpSackFreeList(TcpStream *stream) { SCEnter(); StreamTcpSackRecord *rec = stream->sack_head; StreamTcpSackRecord *next = NULL; while (rec != NULL) { next = rec->next; StreamTcpSackRecordFree(rec); rec = next; } stream->sack_head = NULL; stream->sack_tail = NULL; SCReturn; } #ifdef UNITTESTS /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest01 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 1, 10); StreamTcpSackInsertRange(&stream, 10, 20); StreamTcpSackInsertRange(&stream, 10, 20); StreamTcpSackInsertRange(&stream, 1, 20); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 1 || stream.sack_head->re != 20) { printf("list in weird state, head le %u, re %u: ", stream.sack_head->le, stream.sack_head->re); goto end; } if (StreamTcpSackedSize(&stream) != 19) { printf("size should be 19, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest02 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 10, 20); StreamTcpSackInsertRange(&stream, 1, 20); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 1 || stream.sack_head->re != 20) { printf("list in weird state, head le %u, re %u: ", stream.sack_head->le, stream.sack_head->re); goto end; } if (StreamTcpSackedSize(&stream) != 19) { printf("size should be 19, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest03 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 10, 20); StreamTcpSackInsertRange(&stream, 5, 15); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ StreamTcpSackInsertRange(&stream, 15, 25); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 5) { goto end; } if (StreamTcpSackedSize(&stream) != 20) { printf("size should be 20, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest04 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 20); StreamTcpSackInsertRange(&stream, 30, 50); StreamTcpSackInsertRange(&stream, 10, 25); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 45) { printf("size should be 45, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest05 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 20); StreamTcpSackInsertRange(&stream, 30, 50); StreamTcpSackInsertRange(&stream, 10, 35); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 50) { printf("size should be 50, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest06 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 9); StreamTcpSackInsertRange(&stream, 11, 19); StreamTcpSackInsertRange(&stream, 21, 29); StreamTcpSackInsertRange(&stream, 31, 39); StreamTcpSackInsertRange(&stream, 0, 40); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest07 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 9); StreamTcpSackInsertRange(&stream, 11, 19); StreamTcpSackInsertRange(&stream, 21, 29); StreamTcpSackInsertRange(&stream, 31, 39); StreamTcpSackInsertRange(&stream, 0, 40); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 10; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 30) { printf("size should be 30, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest08 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 9); StreamTcpSackInsertRange(&stream, 11, 19); StreamTcpSackInsertRange(&stream, 21, 29); StreamTcpSackInsertRange(&stream, 31, 39); StreamTcpSackInsertRange(&stream, 0, 40); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 41; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 0) { printf("size should be 0, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest09 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 100; StreamTcpSackInsertRange(&stream, 0, 9); StreamTcpSackInsertRange(&stream, 11, 19); StreamTcpSackInsertRange(&stream, 21, 29); StreamTcpSackInsertRange(&stream, 31, 39); StreamTcpSackInsertRange(&stream, 0, 40); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 0) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 39; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 1) { printf("size should be 1, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest10 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 1000; StreamTcpSackInsertRange(&stream, 100, 119); StreamTcpSackInsertRange(&stream, 111, 119); StreamTcpSackInsertRange(&stream, 121, 129); StreamTcpSackInsertRange(&stream, 131, 139); StreamTcpSackInsertRange(&stream, 100, 140); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 100) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 99; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest11 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 1000; StreamTcpSackInsertRange(&stream, 100, 119); StreamTcpSackInsertRange(&stream, 111, 119); StreamTcpSackInsertRange(&stream, 121, 129); StreamTcpSackInsertRange(&stream, 131, 139); StreamTcpSackInsertRange(&stream, 101, 140); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 100) { goto end; } if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 99; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 40) { printf("size should be 40, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the pruning of SACK ranges. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest12 (void) { TcpStream stream; int retval = 0; memset(&stream, 0, sizeof(stream)); stream.window = 2000; StreamTcpSackInsertRange(&stream, 800, 1000); StreamTcpSackInsertRange(&stream, 700, 900); StreamTcpSackInsertRange(&stream, 600, 800); StreamTcpSackInsertRange(&stream, 500, 700); StreamTcpSackInsertRange(&stream, 100, 600); #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (stream.sack_head->le != 100) { goto end; } if (StreamTcpSackedSize(&stream) != 900) { printf("size should be 900, is %u: ", StreamTcpSackedSize(&stream)); goto end; } StreamTcpSackInsertRange(&stream, 0, 1000); if (StreamTcpSackedSize(&stream) != 1000) { printf("size should be 1000, is %u: ", StreamTcpSackedSize(&stream)); goto end; } stream.last_ack = 500; StreamTcpSackPruneList(&stream); if (StreamTcpSackedSize(&stream) != 500) { printf("size should be 500, is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion on out of window condition. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest13 (void) { TcpStream stream; int retval = 0; int i; memset(&stream, 0, sizeof(stream)); stream.last_ack = 10000; stream.window = 2000; for (i = 0; i < 10; i++) { StreamTcpSackInsertRange(&stream, 100+(20*i), 110+(20*i)); } #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (StreamTcpSackedSize(&stream) != 0) { printf("Sacked size is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } /** * \test Test the insertion of out of window condition. * * \retval On success it returns 1 and on failure 0. */ static int StreamTcpSackTest14 (void) { TcpStream stream; int retval = 0; int i; memset(&stream, 0, sizeof(stream)); stream.last_ack = 1000; stream.window = 2000; for (i = 0; i < 10; i++) { StreamTcpSackInsertRange(&stream, 4000+(20*i), 4010+(20*i)); } #ifdef DEBUG StreamTcpSackPrintList(&stream); #endif /* DEBUG */ if (StreamTcpSackedSize(&stream) != 0) { printf("Sacked size is %u: ", StreamTcpSackedSize(&stream)); goto end; } retval = 1; end: StreamTcpSackFreeList(&stream); SCReturnInt(retval); } #endif /* UNITTESTS */ void StreamTcpSackRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("StreamTcpSackTest01 -- Insertion", StreamTcpSackTest01); UtRegisterTest("StreamTcpSackTest02 -- Insertion", StreamTcpSackTest02); UtRegisterTest("StreamTcpSackTest03 -- Insertion", StreamTcpSackTest03); UtRegisterTest("StreamTcpSackTest04 -- Insertion", StreamTcpSackTest04); UtRegisterTest("StreamTcpSackTest05 -- Insertion", StreamTcpSackTest05); UtRegisterTest("StreamTcpSackTest06 -- Insertion", StreamTcpSackTest06); UtRegisterTest("StreamTcpSackTest07 -- Pruning", StreamTcpSackTest07); UtRegisterTest("StreamTcpSackTest08 -- Pruning", StreamTcpSackTest08); UtRegisterTest("StreamTcpSackTest09 -- Pruning", StreamTcpSackTest09); UtRegisterTest("StreamTcpSackTest10 -- Pruning", StreamTcpSackTest10); UtRegisterTest("StreamTcpSackTest11 -- Insertion && Pruning", StreamTcpSackTest11); UtRegisterTest("StreamTcpSackTest12 -- Insertion && Pruning", StreamTcpSackTest12); UtRegisterTest("StreamTcpSackTest13 -- Insertion out of window", StreamTcpSackTest13); UtRegisterTest("StreamTcpSackTest14 -- Insertion out of window", StreamTcpSackTest14); #endif } suricata-3.2.1/src/output-tx.h0000644000000000000000000000324213051004444013144 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * AppLayer TX Logger Output registration functions */ #ifndef __OUTPUT_TX_H__ #define __OUTPUT_TX_H__ #include "decode.h" /** packet logger function pointer type */ typedef int (*TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id); /** packet logger condition function pointer type, * must return true for packets that should be logged */ typedef int (*TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id); int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc, ThreadDeinitFunc, void (*ThreadExitPrintStats)(ThreadVars *, void *)); void OutputTxLoggerRegister (void); void OutputTxShutdown(void); #endif /* __OUTPUT_PACKET_H__ */ suricata-3.2.1/src/detect-dce-iface.h0000644000000000000000000000245013051004444014221 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_DCE_IFACE_H__ #define __DETECT_DCE_IFACE_H__ typedef enum DetectDceIfaceOperators_ { DETECT_DCE_IFACE_OP_NONE = 0, DETECT_DCE_IFACE_OP_LT, DETECT_DCE_IFACE_OP_GT, DETECT_DCE_IFACE_OP_EQ, DETECT_DCE_IFACE_OP_NE, } DetectDceIfaceOperators; typedef struct DetectDceIfaceData_ { uint8_t uuid[16]; uint8_t op; uint16_t version; uint8_t any_frag; } DetectDceIfaceData; void DetectDceIfaceRegister(void); void DetectDceIfaceRegisterTests(void); #endif /* __DETECT_DCE_IFACE_H__ */ suricata-3.2.1/src/util-logopenfile.c0000644000000000000000000005063213051004444014431 00000000000000/* vi: set et ts=4: */ /* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mike Pomraning * * File-like output for logging: regular files and sockets. */ #include #include #include #include "suricata-common.h" /* errno.h, string.h, etc. */ #include "tm-modules.h" /* LogFileCtx */ #include "conf.h" /* ConfNode, etc. */ #include "output.h" /* DEFAULT_LOG_* */ #include "util-logopenfile.h" #include "util-logopenfile-tile.h" const char * redis_push_cmd = "LPUSH"; const char * redis_publish_cmd = "PUBLISH"; /** \brief connect to the indicated local stream socket, logging any errors * \param path filesystem path to connect to * \param log_err, non-zero if connect failure should be logged. * \retval FILE* on success (fdopen'd wrapper of underlying socket) * \retval NULL on error */ static FILE * SCLogOpenUnixSocketFp(const char *path, int sock_type, int log_err) { struct sockaddr_un saun; int s = -1; FILE * ret = NULL; memset(&saun, 0x00, sizeof(saun)); s = socket(PF_UNIX, sock_type, 0); if (s < 0) goto err; saun.sun_family = AF_UNIX; strlcpy(saun.sun_path, path, sizeof(saun.sun_path)); if (connect(s, (const struct sockaddr *)&saun, sizeof(saun)) < 0) goto err; ret = fdopen(s, "w"); if (ret == NULL) goto err; return ret; err: if (log_err) SCLogWarning(SC_ERR_SOCKET, "Error connecting to socket \"%s\": %s (will keep trying)", path, strerror(errno)); if (s >= 0) close(s); return NULL; } /** * \brief Attempt to reconnect a disconnected (or never-connected) Unix domain socket. * \retval 1 if it is now connected; otherwise 0 */ static int SCLogUnixSocketReconnect(LogFileCtx *log_ctx) { int disconnected = 0; if (log_ctx->fp) { SCLogWarning(SC_ERR_SOCKET, "Write error on Unix socket \"%s\": %s; reconnecting...", log_ctx->filename, strerror(errno)); fclose(log_ctx->fp); log_ctx->fp = NULL; log_ctx->reconn_timer = 0; disconnected = 1; } struct timeval tv; uint64_t now; gettimeofday(&tv, NULL); now = (uint64_t)tv.tv_sec * 1000; now += tv.tv_usec / 1000; /* msec resolution */ if (log_ctx->reconn_timer != 0 && (now - log_ctx->reconn_timer) < LOGFILE_RECONN_MIN_TIME) { /* Don't bother to try reconnecting too often. */ return 0; } log_ctx->reconn_timer = now; log_ctx->fp = SCLogOpenUnixSocketFp(log_ctx->filename, log_ctx->sock_type, 0); if (log_ctx->fp) { /* Connected at last (or reconnected) */ SCLogNotice("Reconnected socket \"%s\"", log_ctx->filename); } else if (disconnected) { SCLogWarning(SC_ERR_SOCKET, "Reconnect failed: %s (will keep trying)", strerror(errno)); } return log_ctx->fp ? 1 : 0; } /** * \brief Write buffer to log file. * \retval 0 on failure; otherwise, the return value of fwrite (number of * characters successfully written). */ static int SCLogFileWrite(const char *buffer, int buffer_len, LogFileCtx *log_ctx) { /* Check for rotation. */ if (log_ctx->rotation_flag) { log_ctx->rotation_flag = 0; SCConfLogReopen(log_ctx); } int ret = 0; if (log_ctx->fp == NULL && log_ctx->is_sock) SCLogUnixSocketReconnect(log_ctx); if (log_ctx->fp) { clearerr(log_ctx->fp); ret = fwrite(buffer, buffer_len, 1, log_ctx->fp); fflush(log_ctx->fp); if (ferror(log_ctx->fp) && log_ctx->is_sock) { /* Error on Unix socket, maybe needs reconnect */ if (SCLogUnixSocketReconnect(log_ctx)) { ret = fwrite(buffer, buffer_len, 1, log_ctx->fp); fflush(log_ctx->fp); } } } return ret; } static void SCLogFileClose(LogFileCtx *log_ctx) { if (log_ctx->fp) fclose(log_ctx->fp); } /** \brief open the indicated file, logging any errors * \param path filesystem path to open * \param append_setting open file with O_APPEND: "yes" or "no" * \retval FILE* on success * \retval NULL on error */ static FILE * SCLogOpenFileFp(const char *path, const char *append_setting) { FILE *ret = NULL; if (ConfValIsTrue(append_setting)) { ret = fopen(path, "a"); } else { ret = fopen(path, "w"); } if (ret == NULL) SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", path, strerror(errno)); return ret; } /** \brief open the indicated file remotely over PCIe to a host * \param path filesystem path to open * \param append_setting open file with O_APPEND: "yes" or "no" * \retval FILE* on success * \retval NULL on error */ static PcieFile *SCLogOpenPcieFp(LogFileCtx *log_ctx, const char *path, const char *append_setting) { #ifndef __tile__ SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "PCIe logging only supported on Tile-Gx Architecture."); return NULL; #else return TileOpenPcieFp(log_ctx, path, append_setting); #endif } /** \brief open a generic output "log file", which may be a regular file or a socket * \param conf ConfNode structure for the output section in question * \param log_ctx Log file context allocated by caller * \param default_filename Default name of file to open, if not specified in ConfNode * \param rotate Register the file for rotation in HUP. * \retval 0 on success * \retval -1 on error */ int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate) { char log_path[PATH_MAX]; char *log_dir; const char *filename, *filetype; // Arg check if (conf == NULL || log_ctx == NULL || default_filename == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "SCConfLogOpenGeneric(conf %p, ctx %p, default %p) " "missing an argument", conf, log_ctx, default_filename); return -1; } if (log_ctx->fp != NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "SCConfLogOpenGeneric: previously initialized Log CTX " "encountered"); return -1; } // Resolve the given config filename = ConfNodeLookupChildValue(conf, "filename"); if (filename == NULL) filename = default_filename; log_dir = ConfigGetLogDirectory(); if (PathIsAbsolute(filename)) { snprintf(log_path, PATH_MAX, "%s", filename); } else { snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename); } filetype = ConfNodeLookupChildValue(conf, "filetype"); if (filetype == NULL) filetype = DEFAULT_LOG_FILETYPE; const char *append = ConfNodeLookupChildValue(conf, "append"); if (append == NULL) append = DEFAULT_LOG_MODE_APPEND; // Now, what have we been asked to open? if (strcasecmp(filetype, "unix_stream") == 0) { /* Don't bail. May be able to connect later. */ log_ctx->is_sock = 1; log_ctx->sock_type = SOCK_STREAM; log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_STREAM, 1); } else if (strcasecmp(filetype, "unix_dgram") == 0) { /* Don't bail. May be able to connect later. */ log_ctx->is_sock = 1; log_ctx->sock_type = SOCK_DGRAM; log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_DGRAM, 1); } else if (strcasecmp(filetype, DEFAULT_LOG_FILETYPE) == 0 || strcasecmp(filetype, "file") == 0) { log_ctx->fp = SCLogOpenFileFp(log_path, append); if (log_ctx->fp == NULL) return -1; // Error already logged by Open...Fp routine log_ctx->is_regular = 1; if (rotate) { OutputRegisterFileRotationFlag(&log_ctx->rotation_flag); } } else if (strcasecmp(filetype, "pcie") == 0) { log_ctx->pcie_fp = SCLogOpenPcieFp(log_ctx, log_path, append); if (log_ctx->pcie_fp == NULL) return -1; // Error already logged by Open...Fp routine #ifdef HAVE_LIBHIREDIS } else if (strcasecmp(filetype, "redis") == 0) { ConfNode *redis_node = ConfNodeLookupChild(conf, "redis"); if (SCConfLogOpenRedis(redis_node, log_ctx) < 0) { SCLogError(SC_ERR_REDIS, "failed to open redis output"); return -1; } log_ctx->type = LOGFILE_TYPE_REDIS; #endif } else { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for " "%s.filetype. Expected \"regular\" (default), \"unix_stream\", " "\"pcie\" " "or \"unix_dgram\"", conf->name); } log_ctx->filename = SCStrdup(log_path); if (unlikely(log_ctx->filename == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for filename"); return -1; } SCLogInfo("%s output device (%s) initialized: %s", conf->name, filetype, filename); return 0; } /** * \brief Reopen a regular log file with the side-affect of truncating it. * * This is useful to clear the log file and start a new one, or to * re-open the file after its been moved by something external * (eg. logrotate). */ int SCConfLogReopen(LogFileCtx *log_ctx) { if (!log_ctx->is_regular) { /* Not supported and not needed on non-regular files. */ return 0; } if (log_ctx->filename == NULL) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Can't re-open LogFileCtx without a filename."); return -1; } fclose(log_ctx->fp); /* Reopen the file. Append is forced in case the file was not * moved as part of a rotation process. */ SCLogDebug("Reopening log file %s.", log_ctx->filename); log_ctx->fp = SCLogOpenFileFp(log_ctx->filename, "yes"); if (log_ctx->fp == NULL) { return -1; // Already logged by Open..Fp routine. } return 0; } #ifdef HAVE_LIBHIREDIS static void SCLogFileCloseRedis(LogFileCtx *log_ctx) { if (log_ctx->redis) { redisReply *reply; int i; for (i = 0; i < log_ctx->redis_setup.batch_count; i++) { redisGetReply(log_ctx->redis, (void **)&reply); if (reply) freeReplyObject(reply); } redisFree(log_ctx->redis); log_ctx->redis = NULL; } log_ctx->redis_setup.tried = 0; log_ctx->redis_setup.batch_count = 0; } int SCConfLogOpenRedis(ConfNode *redis_node, LogFileCtx *log_ctx) { const char *redis_server = NULL; const char *redis_port = NULL; const char *redis_mode = NULL; const char *redis_key = NULL; if (redis_node) { redis_server = ConfNodeLookupChildValue(redis_node, "server"); redis_port = ConfNodeLookupChildValue(redis_node, "port"); redis_mode = ConfNodeLookupChildValue(redis_node, "mode"); redis_key = ConfNodeLookupChildValue(redis_node, "key"); } if (!redis_server) { redis_server = "127.0.0.1"; SCLogInfo("Using default redis server (127.0.0.1)"); } if (!redis_port) redis_port = "6379"; if (!redis_mode) redis_mode = "list"; if (!redis_key) redis_key = "suricata"; log_ctx->redis_setup.key = SCStrdup(redis_key); if (!log_ctx->redis_setup.key) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate redis key name"); exit(EXIT_FAILURE); } log_ctx->redis_setup.batch_size = 0; ConfNode *pipelining = ConfNodeLookupChild(redis_node, "pipelining"); if (pipelining) { int enabled = 0; int ret; intmax_t val; ret = ConfGetChildValueBool(pipelining, "enabled", &enabled); if (ret && enabled) { ret = ConfGetChildValueInt(pipelining, "batch-size", &val); if (ret) { log_ctx->redis_setup.batch_size = val; } else { log_ctx->redis_setup.batch_size = 10; } } } if (!strcmp(redis_mode, "list")) { log_ctx->redis_setup.command = redis_push_cmd; if (!log_ctx->redis_setup.command) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate redis key command"); exit(EXIT_FAILURE); } } else { log_ctx->redis_setup.command = redis_publish_cmd; if (!log_ctx->redis_setup.command) { SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate redis key command"); exit(EXIT_FAILURE); } } redisContext *c = redisConnect(redis_server, atoi(redis_port)); if (c != NULL && c->err) { SCLogError(SC_ERR_SOCKET, "Error connecting to redis server: %s", c->errstr); exit(EXIT_FAILURE); } /* store server params for reconnection */ log_ctx->redis_setup.server = SCStrdup(redis_server); if (!log_ctx->redis_setup.server) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating redis server string"); exit(EXIT_FAILURE); } log_ctx->redis_setup.port = atoi(redis_port); log_ctx->redis_setup.tried = 0; log_ctx->redis = c; log_ctx->Close = SCLogFileCloseRedis; return 0; } int SCConfLogReopenRedis(LogFileCtx *log_ctx) { if (log_ctx->redis != NULL) { redisFree(log_ctx->redis); log_ctx->redis = NULL; } /* only try to reconnect once per second */ if (log_ctx->redis_setup.tried >= time(NULL)) { return -1; } redisContext *c = redisConnect(log_ctx->redis_setup.server, log_ctx->redis_setup.port); if (c != NULL && c->err) { if (log_ctx->redis_setup.tried == 0) { SCLogError(SC_ERR_SOCKET, "Error connecting to redis server: %s\n", c->errstr); } redisFree(c); log_ctx->redis_setup.tried = time(NULL); return -1; } log_ctx->redis = c; log_ctx->redis_setup.tried = 0; log_ctx->redis_setup.batch_count = 0; return 0; } #endif /** \brief LogFileNewCtx() Get a new LogFileCtx * \retval LogFileCtx * pointer if succesful, NULL if error * */ LogFileCtx *LogFileNewCtx(void) { LogFileCtx* lf_ctx; lf_ctx = (LogFileCtx*)SCMalloc(sizeof(LogFileCtx)); if (lf_ctx == NULL) return NULL; memset(lf_ctx, 0, sizeof(LogFileCtx)); SCMutexInit(&lf_ctx->fp_mutex,NULL); // Default Write and Close functions lf_ctx->Write = SCLogFileWrite; lf_ctx->Close = SCLogFileClose; #ifdef HAVE_LIBHIREDIS lf_ctx->redis_setup.batch_count = 0; #endif return lf_ctx; } /** \brief LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory) * \param motcx pointer to the OutputCtx * \retval int 1 if succesful, 0 if error * */ int LogFileFreeCtx(LogFileCtx *lf_ctx) { if (lf_ctx == NULL) { SCReturnInt(0); } if (lf_ctx->fp != NULL) { SCMutexLock(&lf_ctx->fp_mutex); lf_ctx->Close(lf_ctx); SCMutexUnlock(&lf_ctx->fp_mutex); } #ifdef HAVE_LIBHIREDIS if (lf_ctx->type == LOGFILE_TYPE_REDIS) { if (lf_ctx->redis) redisFree(lf_ctx->redis); if (lf_ctx->redis_setup.server) SCFree(lf_ctx->redis_setup.server); if (lf_ctx->redis_setup.key) SCFree(lf_ctx->redis_setup.key); } #endif SCMutexDestroy(&lf_ctx->fp_mutex); if (lf_ctx->prefix != NULL) { SCFree(lf_ctx->prefix); lf_ctx->prefix_len = 0; } if(lf_ctx->filename != NULL) SCFree(lf_ctx->filename); if (lf_ctx->sensor_name) SCFree(lf_ctx->sensor_name); OutputUnregisterFileRotationFlag(&lf_ctx->rotation_flag); SCFree(lf_ctx); SCReturnInt(1); } #ifdef HAVE_LIBHIREDIS static int LogFileWriteRedis(LogFileCtx *file_ctx, const char *string, size_t string_len) { if (file_ctx->redis == NULL) { SCConfLogReopenRedis(file_ctx); if (file_ctx->redis == NULL) { return -1; } else { SCLogInfo("Reconnected to redis server"); } } /* TODO go async here ? */ if (file_ctx->redis_setup.batch_size) { redisAppendCommand(file_ctx->redis, "%s %s %s", file_ctx->redis_setup.command, file_ctx->redis_setup.key, string); if (file_ctx->redis_setup.batch_count == file_ctx->redis_setup.batch_size) { redisReply *reply; int i; file_ctx->redis_setup.batch_count = 0; for (i = 0; i <= file_ctx->redis_setup.batch_size; i++) { if (redisGetReply(file_ctx->redis, (void **)&reply) == REDIS_OK) { freeReplyObject(reply); } else { if (file_ctx->redis->err) { SCLogInfo("Error when fetching reply: %s (%d)", file_ctx->redis->errstr, file_ctx->redis->err); } switch (file_ctx->redis->err) { case REDIS_ERR_EOF: case REDIS_ERR_IO: SCLogInfo("Reopening connection to redis server"); SCConfLogReopenRedis(file_ctx); if (file_ctx->redis) { SCLogInfo("Reconnected to redis server"); return 0; } else { SCLogInfo("Unable to reconnect to redis server"); return 0; } break; default: SCLogWarning(SC_ERR_INVALID_VALUE, "Unsupported error code %d", file_ctx->redis->err); return 0; } } } } else { file_ctx->redis_setup.batch_count++; } } else { redisReply *reply = redisCommand(file_ctx->redis, "%s %s %b", file_ctx->redis_setup.command, file_ctx->redis_setup.key, string, string_len); /* We may lose the reply if disconnection happens! */ if (reply) { switch (reply->type) { case REDIS_REPLY_ERROR: SCLogWarning(SC_ERR_SOCKET, "Redis error: %s", reply->str); SCConfLogReopenRedis(file_ctx); break; case REDIS_REPLY_INTEGER: SCLogDebug("Redis integer %lld", reply->integer); break; default: SCLogError(SC_ERR_INVALID_VALUE, "Redis default triggered with %d", reply->type); SCConfLogReopenRedis(file_ctx); break; } freeReplyObject(reply); } else { SCConfLogReopenRedis(file_ctx); } } return 0; } #endif int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer) { if (file_ctx->type == LOGFILE_TYPE_SYSLOG) { syslog(file_ctx->syslog_setup.alert_syslog_level, "%s", (const char *)MEMBUFFER_BUFFER(buffer)); } else if (file_ctx->type == LOGFILE_TYPE_FILE || file_ctx->type == LOGFILE_TYPE_UNIX_DGRAM || file_ctx->type == LOGFILE_TYPE_UNIX_STREAM) { /* append \n for files only */ MemBufferWriteString(buffer, "\n"); SCMutexLock(&file_ctx->fp_mutex); file_ctx->Write((const char *)MEMBUFFER_BUFFER(buffer), MEMBUFFER_OFFSET(buffer), file_ctx); SCMutexUnlock(&file_ctx->fp_mutex); } #ifdef HAVE_LIBHIREDIS else if (file_ctx->type == LOGFILE_TYPE_REDIS) { SCMutexLock(&file_ctx->fp_mutex); LogFileWriteRedis(file_ctx, (const char *)MEMBUFFER_BUFFER(buffer), MEMBUFFER_OFFSET(buffer)); SCMutexUnlock(&file_ctx->fp_mutex); } #endif return 0; } suricata-3.2.1/src/threads-debug.h0000644000000000000000000003754613051004444013707 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Pablo Rincon Crespo * * Threading functions defined as macros: debug variants */ #ifndef __THREADS_DEBUG_H__ #define __THREADS_DEBUG_H__ /* mutex */ /** When dbg threads is defined, if a mutex fail to lock, it's * initialized, logged, and does a second try; This is to prevent the system to freeze; * It is for Mac OS X users; * If you see a mutex, spinlock or condiion not initialized, report it please! */ #define SCMutexLock_dbg(mut) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locking mutex %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut); \ int retl = pthread_mutex_lock(mut); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locked mutex %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, retl); \ if (retl != 0) { \ switch (retl) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ retl = pthread_mutex_init(mut, NULL); \ if (retl != 0) \ exit(EXIT_FAILURE); \ retl = pthread_mutex_lock(mut); \ break; \ case EDEADLK: \ printf("A deadlock would occur if the thread blocked waiting for mutex\n"); \ break; \ } \ } \ retl; \ }) #define SCMutexTrylock_dbg(mut) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocking mutex %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut); \ int rett = pthread_mutex_trylock(mut); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocked mutex %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, rett); \ if (rett != 0) { \ switch (rett) { \ case EINVAL: \ printf("%16s(%s:%d): The value specified by attr is invalid\n", __FUNCTION__, __FILE__, __LINE__); \ break; \ case EBUSY: \ printf("Mutex is already locked\n"); \ break; \ } \ } \ rett; \ }) #define SCMutexInit_dbg(mut, mutattr) ({ \ int ret; \ ret = pthread_mutex_init(mut, mutattr); \ if (ret != 0) { \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") mutex %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, ret); \ break; \ case EAGAIN: \ printf("The system temporarily lacks the resources to create another mutex\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") mutex %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, ret); \ break; \ case ENOMEM: \ printf("The process cannot allocate enough memory to create another mutex\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") mutex %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, ret); \ break; \ } \ } \ ret; \ }) #define SCMutexUnlock_dbg(mut) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocking mutex %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut); \ int retu = pthread_mutex_unlock(mut); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocked mutex %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, retu); \ if (retu != 0) { \ switch (retu) { \ case EINVAL: \ printf("%16s(%s:%d): The value specified by attr is invalid\n", __FUNCTION__, __FILE__, __LINE__); \ break; \ case EPERM: \ printf("The current thread does not hold a lock on mutex\n"); \ break; \ } \ } \ retu; \ }) #define SCMutex pthread_mutex_t #define SCMutexAttr pthread_mutexattr_t #define SCMutexInit(mut, mutattrs) SCMutexInit_dbg(mut, mutattrs) #define SCMutexLock(mut) SCMutexLock_dbg(mut) #define SCMutexTrylock(mut) SCMutexTrylock_dbg(mut) #define SCMutexUnlock(mut) SCMutexUnlock_dbg(mut) #define SCMutexDestroy pthread_mutex_destroy #define SCMUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER /* conditions */ #define SCCondWait_dbg(cond, mut) ({ \ int ret = pthread_cond_wait(cond, mut); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid (or a SCCondT not initialized!)\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") failed SCCondWait %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), mut, ret); \ break; \ } \ ret; \ }) /* conditions */ #define SCCondT pthread_cond_t #define SCCondInit pthread_cond_init #define SCCondSignal pthread_cond_signal #define SCCondDestroy pthread_cond_destroy #define SCCondWait SCCondWait_dbg /* spinlocks */ #define SCSpinLock_dbg(spin) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locking spin %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin); \ int ret = pthread_spin_lock(spin); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocked spin %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin, ret); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ break; \ case EDEADLK: \ printf("A deadlock would occur if the thread blocked waiting for spin\n"); \ break; \ } \ ret; \ }) #define SCSpinTrylock_dbg(spin) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocking spin %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin); \ int ret = pthread_spin_trylock(spin); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocked spin %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin, ret); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ break; \ case EDEADLK: \ printf("A deadlock would occur if the thread blocked waiting for spin\n"); \ break; \ case EBUSY: \ printf("A thread currently holds the lock\n"); \ break; \ } \ ret; \ }) #define SCSpinUnlock_dbg(spin) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocking spin %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin); \ int ret = pthread_spin_unlock(spin); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlockedspin %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin, ret); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ break; \ case EPERM: \ printf("The calling thread does not hold the lock\n"); \ break; \ } \ ret; \ }) #define SCSpinInit_dbg(spin, spin_attr) ({ \ int ret = pthread_spin_init(spin, spin_attr); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") spinlock %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin, ret); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ break; \ case EBUSY: \ printf("A thread currently holds the lock\n"); \ break; \ case ENOMEM: \ printf("The process cannot allocate enough memory to create another spin\n"); \ break; \ case EAGAIN: \ printf("The system temporarily lacks the resources to create another spin\n"); \ break; \ } \ ret; \ }) #define SCSpinDestroy_dbg(spin) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") condition %p waiting\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin); \ int ret = pthread_spin_destroy(spin); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") condition %p passed %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), spin, ret); \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ break; \ case EBUSY: \ printf("A thread currently holds the lock\n"); \ break; \ case ENOMEM: \ printf("The process cannot allocate enough memory to create another spin\n"); \ break; \ case EAGAIN: \ printf("The system temporarily lacks the resources to create another spin\n"); \ break; \ } \ ret; \ }) #define SCSpinlock pthread_spinlock_t #define SCSpinLock SCSpinLock_dbg #define SCSpinTrylock SCSpinTrylock_dbg #define SCSpinUnlock SCSpinUnlock_dbg #define SCSpinInit SCSpinInit_dbg #define SCSpinDestroy SCSpinDestroy_dbg /* rwlocks */ /** When dbg threads is defined, if a rwlock fail to lock, it's * initialized, logged, and does a second try; This is to prevent the system to freeze; * If you see a rwlock, spinlock or condiion not initialized, report it please! */ #define SCRWLockRDLock_dbg(rwl) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locking rwlock %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl); \ int retl = pthread_rwlock_rdlock(rwl); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locked rwlock %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, retl); \ if (retl != 0) { \ switch (retl) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ retl = pthread_rwlock_init(rwl, NULL); \ if (retl != 0) \ exit(EXIT_FAILURE); \ retl = pthread_rwlock_rdlock(rwl); \ break; \ case EDEADLK: \ printf("A deadlock would occur if the thread blocked waiting for rwlock\n"); \ break; \ } \ } \ retl; \ }) #define SCRWLockWRLock_dbg(rwl) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locking rwlock %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl); \ int retl = pthread_rwlock_wrlock(rwl); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") locked rwlock %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, retl); \ if (retl != 0) { \ switch (retl) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ retl = pthread_rwlock_init(rwl, NULL); \ if (retl != 0) \ exit(EXIT_FAILURE); \ retl = pthread_rwlock_wrlock(rwl); \ break; \ case EDEADLK: \ printf("A deadlock would occur if the thread blocked waiting for rwlock\n"); \ break; \ } \ } \ retl; \ }) #define SCRWLockTryWRLock_dbg(rwl) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocking rwlock %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl); \ int rett = pthread_rwlock_trywrlock(rwl); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocked rwlock %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, rett); \ if (rett != 0) { \ switch (rett) { \ case EINVAL: \ printf("%16s(%s:%d): The value specified by attr is invalid\n", __FUNCTION__, __FILE__, __LINE__); \ break; \ case EBUSY: \ printf("RWLock is already locked\n"); \ break; \ } \ } \ rett; \ }) #define SCRWLockTryRDLock_dbg(rwl) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocking rwlock %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl); \ int rett = pthread_rwlock_tryrdlock(rwl); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") trylocked rwlock %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, rett); \ if (rett != 0) { \ switch (rett) { \ case EINVAL: \ printf("%16s(%s:%d): The value specified by attr is invalid\n", __FUNCTION__, __FILE__, __LINE__); \ break; \ case EBUSY: \ printf("RWLock is already locked\n"); \ break; \ } \ } \ rett; \ }) #define SCRWLockInit_dbg(rwl, rwlattr) ({ \ int ret; \ ret = pthread_rwlock_init(rwl, rwlattr); \ if (ret != 0) { \ switch (ret) { \ case EINVAL: \ printf("The value specified by attr is invalid\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") rwlock %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, ret); \ break; \ case EAGAIN: \ printf("The system temporarily lacks the resources to create another rwlock\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") rwlock %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, ret); \ break; \ case ENOMEM: \ printf("The process cannot allocate enough memory to create another rwlock\n"); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") rwlock %p initialization returned %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, ret); \ break; \ } \ } \ ret; \ }) #define SCRWLockUnlock_dbg(rwl) ({ \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocking rwlock %p\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl); \ int retu = pthread_rwlock_unlock(rwl); \ printf("%16s(%s:%d): (thread:%"PRIuMAX") unlocked rwlock %p ret %" PRId32 "\n", __FUNCTION__, __FILE__, __LINE__, (uintmax_t)pthread_self(), rwl, retu); \ if (retu != 0) { \ switch (retu) { \ case EINVAL: \ printf("%16s(%s:%d): The value specified by attr is invalid\n", __FUNCTION__, __FILE__, __LINE__); \ break; \ case EPERM: \ printf("The current thread does not hold a lock on rwlock\n"); \ break; \ } \ } \ retu; \ }) #define SCRWLock pthread_rwlock_t #define SCRWLockInit(rwl, rwlattrs) SCRWLockInit_dbg(rwl, rwlattrs) #define SCRWLockRDLock(rwl) SCRWLockRDLock_dbg(rwl) #define SCRWLockWRLock(rwl) SCRWLockWRLock_dbg(rwl) #define SCRWLockTryWRLock(rwl) SCRWLockTryWRLock_dbg(rwl) #define SCRWLockTryRDLock(rwl) SCRWLockTryRDLock_dbg(rwl) #define SCRWLockUnlock(rwl) SCRWLockUnlock_dbg(rwl) #define SCRWLockDestroy pthread_rwlock_destroy /* ctrl mutex */ #define SCCtrlMutex pthread_mutex_t #define SCCtrlMutexAttr pthread_mutexattr_t #define SCCtrlMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCCtrlMutexLock(mut) pthread_mutex_lock(mut) #define SCCtrlMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCCtrlMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCCtrlMutexDestroy pthread_mutex_destroy /* ctrl conditions */ #define SCCtrlCondT pthread_cond_t #define SCCtrlCondInit pthread_cond_init #define SCCtrlCondSignal pthread_cond_signal #define SCCtrlCondTimedwait pthread_cond_timedwait #define SCCtrlCondWait pthread_cond_wait #define SCCtrlCondDestroy pthread_cond_destroy #endif suricata-3.2.1/src/detect-engine-hmd.h0000644000000000000000000000255713051004444014444 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HMD_H__ #define __DETECT_ENGINE_HMD_H__ #include "app-layer-htp.h" int DetectEngineInspectHttpMethod(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); int PrefilterTxMethodRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); void DetectEngineHttpMethodRegisterTests(void); #endif /* __DETECT_ENGINE_HMD_H__ */ suricata-3.2.1/src/app-layer-htp-xff.h0000644000000000000000000000337313051004444014424 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ignacio Sanchez * \author Duarte Silva */ #ifndef __APP_LAYER_HTP_XFF_H__ #define __APP_LAYER_HTP_XFF_H__ /** XFF is disabled */ #define XFF_DISABLED 1 /** XFF extra data mode */ #define XFF_EXTRADATA 2 /** XFF overwrite mode */ #define XFF_OVERWRITE 4 /** XFF is to be used in a reverse proxy deployment */ #define XFF_REVERSE 8 /** XFF is to be used in a forward proxy deployment */ #define XFF_FORWARD 16 /** Single XFF IP maximum length (default value based on IPv6 address length) */ #define XFF_MAXLEN 46 typedef struct HttpXFFCfg_ { uint8_t flags; /**< XFF operation mode and deployment */ char *header; /**< XFF header name */ } HttpXFFCfg; void HttpXFFGetCfg(ConfNode *conf, HttpXFFCfg *result); int HttpXFFGetIPFromTx(const Packet *p, uint64_t tx_id, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen); int HttpXFFGetIP(const Packet *p, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen); void HTPXFFParserRegisterTests(void); #endif /* __APP_LAYER_HTP_XFF_H__ */ suricata-3.2.1/src/decode-teredo.c0000644000000000000000000000723113051004444013653 00000000000000/* Copyright (C) 2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Eric Leblond * * Decode Teredo Tunneling protocol. * * This implementation is based upon RFC 4380: http://www.ietf.org/rfc/rfc4380.txt */ #include "suricata-common.h" #include "decode.h" #include "decode-ipv6.h" #include "util-debug.h" #define TEREDO_ORIG_INDICATION_LENGTH 8 /** * \brief Function to decode Teredo packets * * \retval TM_ECODE_FAILED if packet is not a Teredo packet, TM_ECODE_OK if it is */ int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { uint8_t *start = pkt; /* Is this packet to short to contain an IPv6 packet ? */ if (len < IPV6_HEADER_LEN) return TM_ECODE_FAILED; /* Teredo encapsulate IPv6 in UDP and can add some custom message * part before the IPv6 packet. In our case, we just want to get * over an ORIGIN indication. So we just make one offset if needed. */ if (start[0] == 0x0) { switch (start[1]) { /* origin indication: compatible with tunnel */ case 0x0: /* offset is coherent with len and presence of an IPv6 header */ if (len >= TEREDO_ORIG_INDICATION_LENGTH + IPV6_HEADER_LEN) start += TEREDO_ORIG_INDICATION_LENGTH; else return TM_ECODE_FAILED; break; /* authentication: negotiation not real tunnel */ case 0x1: return TM_ECODE_FAILED; /* this case is not possible in Teredo: not that protocol */ default: return TM_ECODE_FAILED; } } /* There is no specific field that we can check to prove that the packet * is a Teredo packet. We've zapped here all the possible Teredo header * and we should have an IPv6 packet at the start pointer. * We then can only do two checks before sending the encapsulated packets * to decoding: * - The packet has a protocol version which is IPv6. * - The IPv6 length of the packet matches what remains in buffer. */ if (IP_GET_RAW_VER(start) == 6) { IPV6Hdr *thdr = (IPV6Hdr *)start; if (len == IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(thdr) + (start - pkt)) { if (pq != NULL) { int blen = len - (start - pkt); /* spawn off tunnel packet */ Packet *tp = PacketTunnelPktSetup(tv, dtv, p, start, blen, DECODE_TUNNEL_IPV6, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_TEREDO); /* add the tp to the packet queue. */ PacketEnqueue(pq,tp); StatsIncr(tv, dtv->counter_teredo); return TM_ECODE_OK; } } } return TM_ECODE_FAILED; } return TM_ECODE_FAILED; } /** * @} */ suricata-3.2.1/src/decode-raw.h0000644000000000000000000000161413051004444013166 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf */ #ifndef __DECODE_RAW_H__ #define __DECODE_RAW_H__ void DecodeRawRegisterTests(void); #endif /* __DECODE_RAW_H__ */ suricata-3.2.1/src/detect-engine-threshold.c0000644000000000000000000004557513051004444015672 00000000000000/* Copyright (C) 2007-2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \defgroup threshold Thresholding * * This feature is used to reduce the number of logged alerts for noisy rules. * This can be tuned to significantly reduce false alarms, and it can also be * used to write a newer breed of rules. Thresholding commands limit the number * of times a particular event is logged during a specified time interval. * * @{ */ /** * \file * * \author Breno Silva * \author Victor Julien * * Threshold part of the detection engine. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "host.h" #include "host-storage.h" #include "detect-parse.h" #include "detect-engine-sigorder.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-iponly.h" #include "detect-engine.h" #include "detect-engine-threshold.h" #include "detect-content.h" #include "detect-uricontent.h" #include "util-hash.h" #include "util-time.h" #include "util-error.h" #include "util-debug.h" #include "util-var-name.h" #include "tm-threads.h" static int threshold_id = -1; /**< host storage id for thresholds */ int ThresholdHostStorageId(void) { return threshold_id; } void ThresholdInit(void) { threshold_id = HostStorageRegister("threshold", sizeof(void *), NULL, ThresholdListFree); if (threshold_id == -1) { SCLogError(SC_ERR_HOST_INIT, "Can't initiate host storage for thresholding"); exit(EXIT_FAILURE); } } int ThresholdHostHasThreshold(Host *host) { return HostGetStorageById(host, threshold_id) ? 1 : 0; } /** * \brief Return next DetectThresholdData for signature * * \param sig Signature pointer * \param p Packet structure * \param sm Pointer to a Signature Match pointer * * \retval tsh Return the threshold data from signature or NULL if not found * * */ const DetectThresholdData *SigGetThresholdTypeIter(const Signature *sig, Packet *p, const SigMatch **psm, int list) { const SigMatch *sm = NULL; const DetectThresholdData *tsh = NULL; if (sig == NULL) return NULL; if (*psm == NULL) { sm = sig->sm_lists_tail[list]; } else { /* Iteration in progress, using provided value */ sm = *psm; } if (p == NULL) return NULL; while (sm != NULL) { if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) { tsh = (DetectThresholdData *)sm->ctx; *psm = sm->prev; return tsh; } sm = sm->prev; } *psm = NULL; return NULL; } /** * \brief Remove timeout threshold hash elements * * \param de_ctx Dectection Context * */ int ThresholdTimeoutCheck(Host *host, struct timeval *tv) { DetectThresholdEntry *tde = NULL; DetectThresholdEntry *tmp = NULL; DetectThresholdEntry *prev = NULL; int retval = 1; tmp = HostGetStorageById(host, threshold_id); if (tmp == NULL) return 1; prev = NULL; while (tmp != NULL) { if ((tv->tv_sec - tmp->tv_sec1) <= tmp->seconds) { prev = tmp; tmp = tmp->next; retval = 0; continue; } /* timed out */ if (prev != NULL) { prev->next = tmp->next; tde = tmp; tmp = tde->next; SCFree(tde); } else { HostSetStorageById(host, threshold_id, tmp->next); tde = tmp; tmp = tde->next; SCFree(tde); } } return retval; } static inline DetectThresholdEntry * DetectThresholdEntryAlloc(const DetectThresholdData *td, Packet *p, uint32_t sid, uint32_t gid) { SCEnter(); DetectThresholdEntry *ste = SCMalloc(sizeof(DetectThresholdEntry)); if (unlikely(ste == NULL)) { SCReturnPtr(NULL, "DetectThresholdEntry"); } ste->sid = sid; ste->gid = gid; ste->track = td->track; ste->seconds = td->seconds; ste->tv_timeout = 0; SCReturnPtr(ste, "DetectThresholdEntry"); } static DetectThresholdEntry *ThresholdHostLookupEntry(Host *h, uint32_t sid, uint32_t gid) { DetectThresholdEntry *e; for (e = HostGetStorageById(h, threshold_id); e != NULL; e = e->next) { if (e->sid == sid && e->gid == gid) break; } return e; } int ThresholdHandlePacketSuppress(Packet *p, const DetectThresholdData *td, uint32_t sid, uint32_t gid) { int ret = 0; DetectAddress *m = NULL; switch (td->track) { case TRACK_DST: m = DetectAddressLookupInHead(&td->addrs, &p->dst); SCLogDebug("TRACK_DST"); break; case TRACK_SRC: m = DetectAddressLookupInHead(&td->addrs, &p->src); SCLogDebug("TRACK_SRC"); break; /* suppress if either src or dst is a match on the suppress * address list */ case TRACK_EITHER: m = DetectAddressLookupInHead(&td->addrs, &p->src); if (m == NULL) { m = DetectAddressLookupInHead(&td->addrs, &p->dst); } break; case TRACK_RULE: default: SCLogError(SC_ERR_INVALID_VALUE, "track mode %d is not supported", td->track); break; } if (m == NULL) ret = 1; else ret = 2; /* suppressed but still need actions */ return ret; } static inline void RateFilterSetAction(Packet *p, PacketAlert *pa, uint8_t new_action) { switch (new_action) { case TH_ACTION_ALERT: PACKET_ALERT(p); pa->flags |= PACKET_ALERT_RATE_FILTER_MODIFIED; break; case TH_ACTION_DROP: PACKET_DROP(p); pa->flags |= PACKET_ALERT_RATE_FILTER_MODIFIED; break; case TH_ACTION_REJECT: PACKET_REJECT(p); pa->flags |= PACKET_ALERT_RATE_FILTER_MODIFIED; break; case TH_ACTION_PASS: PACKET_PASS(p); pa->flags |= PACKET_ALERT_RATE_FILTER_MODIFIED; break; default: /* Weird, leave the default action */ break; } } /** * \retval 2 silent match (no alert but apply actions) * \retval 1 normal match * \retval 0 no match */ int ThresholdHandlePacketHost(Host *h, Packet *p, const DetectThresholdData *td, uint32_t sid, uint32_t gid, PacketAlert *pa) { int ret = 0; DetectThresholdEntry *lookup_tsh = ThresholdHostLookupEntry(h, sid, gid); SCLogDebug("lookup_tsh %p sid %u gid %u", lookup_tsh, sid, gid); switch(td->type) { case TYPE_LIMIT: { SCLogDebug("limit"); if (lookup_tsh != NULL) { if ((p->ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) { lookup_tsh->current_count++; if (lookup_tsh->current_count <= td->count) { ret = 1; } else { ret = 2; } } else { lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->current_count = 1; ret = 1; } } else { DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid); if (e == NULL) { break; } e->tv_sec1 = p->ts.tv_sec; e->current_count = 1; ret = 1; e->next = HostGetStorageById(h, threshold_id); HostSetStorageById(h, threshold_id, e); } break; } case TYPE_THRESHOLD: { SCLogDebug("threshold"); if (lookup_tsh != NULL) { if ((p->ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) { lookup_tsh->current_count++; if (lookup_tsh->current_count >= td->count) { ret = 1; lookup_tsh->current_count = 0; } } else { lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->current_count = 1; } } else { if (td->count == 1) { ret = 1; } else { DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid); if (e == NULL) { break; } e->current_count = 1; e->tv_sec1 = p->ts.tv_sec; e->next = HostGetStorageById(h, threshold_id); HostSetStorageById(h, threshold_id, e); } } break; } case TYPE_BOTH: { SCLogDebug("both"); if (lookup_tsh != NULL) { if ((p->ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) { /* within time limit */ lookup_tsh->current_count++; if (lookup_tsh->current_count == td->count) { ret = 1; } else if (lookup_tsh->current_count > td->count) { /* silent match */ ret = 2; } } else { /* expired, so reset */ lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->current_count = 1; /* if we have a limit of 1, this is a match */ if (lookup_tsh->current_count == td->count) { ret = 1; } } } else { DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid); if (e == NULL) { break; } e->current_count = 1; e->tv_sec1 = p->ts.tv_sec; e->next = HostGetStorageById(h, threshold_id); HostSetStorageById(h, threshold_id, e); /* for the first match we return 1 to * indicate we should alert */ if (td->count == 1) { ret = 1; } } break; } /* detection_filter */ case TYPE_DETECTION: { SCLogDebug("detection_filter"); if (lookup_tsh != NULL) { long double time_diff = ((p->ts.tv_sec + p->ts.tv_usec/1000000.0) - (lookup_tsh->tv_sec1 + lookup_tsh->tv_usec1/1000000.0)); if (time_diff < td->seconds) { /* within timeout */ lookup_tsh->current_count++; if (lookup_tsh->current_count > td->count) { ret = 1; } } else { /* expired, reset */ lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->tv_usec1 = p->ts.tv_usec; lookup_tsh->current_count = 1; } } else { DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid); if (e == NULL) { break; } e->current_count = 1; e->tv_sec1 = p->ts.tv_sec; e->tv_usec1 = p->ts.tv_usec; e->next = HostGetStorageById(h, threshold_id); HostSetStorageById(h, threshold_id, e); } break; } /* rate_filter */ case TYPE_RATE: { SCLogDebug("rate_filter"); ret = 1; if (lookup_tsh != NULL) { /* Check if we have a timeout enabled, if so, * we still matching (and enabling the new_action) */ if (lookup_tsh->tv_timeout != 0) { if ((p->ts.tv_sec - lookup_tsh->tv_timeout) > td->timeout) { /* Ok, we are done, timeout reached */ lookup_tsh->tv_timeout = 0; } else { /* Already matching */ /* Take the action to perform */ RateFilterSetAction(p, pa, td->new_action); ret = 1; } /* else - if ((p->ts.tv_sec - lookup_tsh->tv_timeout) > td->timeout) */ } else { /* Update the matching state with the timeout interval */ if ( (p->ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) { lookup_tsh->current_count++; if (lookup_tsh->current_count > td->count) { /* Then we must enable the new action by setting a * timeout */ lookup_tsh->tv_timeout = p->ts.tv_sec; /* Take the action to perform */ RateFilterSetAction(p, pa, td->new_action); ret = 1; } } else { lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->current_count = 1; } } /* else - if (lookup_tsh->tv_timeout != 0) */ } else { if (td->count == 1) { ret = 1; } DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid); if (e == NULL) { break; } e->current_count = 1; e->tv_sec1 = p->ts.tv_sec; e->tv_timeout = 0; e->next = HostGetStorageById(h, threshold_id); HostSetStorageById(h, threshold_id, e); } break; } /* case TYPE_SUPPRESS: is not handled here */ default: SCLogError(SC_ERR_INVALID_VALUE, "type %d is not supported", td->type); } return ret; } static int ThresholdHandlePacketRule(DetectEngineCtx *de_ctx, Packet *p, const DetectThresholdData *td, const Signature *s, PacketAlert *pa) { int ret = 0; if (td->type != TYPE_RATE) return 1; DetectThresholdEntry* lookup_tsh = (DetectThresholdEntry *)de_ctx->ths_ctx.th_entry[s->num]; if (lookup_tsh != NULL) { /* Check if we have a timeout enabled, if so, * we still matching (and enabling the new_action) */ if ( (p->ts.tv_sec - lookup_tsh->tv_timeout) > td->timeout) { /* Ok, we are done, timeout reached */ lookup_tsh->tv_timeout = 0; } else { /* Already matching */ /* Take the action to perform */ RateFilterSetAction(p, pa, td->new_action); ret = 1; } /* Update the matching state with the timeout interval */ if ( (p->ts.tv_sec - lookup_tsh->tv_sec1) < td->seconds) { lookup_tsh->current_count++; if (lookup_tsh->current_count >= td->count) { /* Then we must enable the new action by setting a * timeout */ lookup_tsh->tv_timeout = p->ts.tv_sec; /* Take the action to perform */ RateFilterSetAction(p, pa, td->new_action); ret = 1; } } else { lookup_tsh->tv_sec1 = p->ts.tv_sec; lookup_tsh->current_count = 1; } } else { if (td->count == 1) { ret = 1; } DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, s->id, s->gid); if (e != NULL) { e->current_count = 1; e->tv_sec1 = p->ts.tv_sec; e->tv_timeout = 0; de_ctx->ths_ctx.th_entry[s->num] = e; } } return ret; } /** * \brief Make the threshold logic for signatures * * \param de_ctx Dectection Context * \param tsh_ptr Threshold element * \param p Packet structure * \param s Signature structure * * \retval 2 silent match (no alert but apply actions) * \retval 1 alert on this event * \retval 0 do not alert on this event */ int PacketAlertThreshold(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectThresholdData *td, Packet *p, const Signature *s, PacketAlert *pa) { SCEnter(); int ret = 0; if (td == NULL) { SCReturnInt(0); } if (td->type == TYPE_SUPPRESS) { ret = ThresholdHandlePacketSuppress(p,td,s->id,s->gid); } else if (td->track == TRACK_SRC) { Host *src = HostGetHostFromHash(&p->src); if (src) { ret = ThresholdHandlePacketHost(src,p,td,s->id,s->gid,pa); HostRelease(src); } } else if (td->track == TRACK_DST) { Host *dst = HostGetHostFromHash(&p->dst); if (dst) { ret = ThresholdHandlePacketHost(dst,p,td,s->id,s->gid,pa); HostRelease(dst); } } else if (td->track == TRACK_RULE) { SCMutexLock(&de_ctx->ths_ctx.threshold_table_lock); ret = ThresholdHandlePacketRule(de_ctx,p,td,s,pa); SCMutexUnlock(&de_ctx->ths_ctx.threshold_table_lock); } SCReturnInt(ret); } /** * \brief Init threshold context hash tables * * \param de_ctx Dectection Context * */ void ThresholdHashInit(DetectEngineCtx *de_ctx) { if (SCMutexInit(&de_ctx->ths_ctx.threshold_table_lock, NULL) != 0) { SCLogError(SC_ERR_MEM_ALLOC, "Threshold: Failed to initialize hash table mutex."); exit(EXIT_FAILURE); } } /** * \brief Destroy threshold context hash tables * * \param de_ctx Dectection Context * */ void ThresholdContextDestroy(DetectEngineCtx *de_ctx) { if (de_ctx->ths_ctx.th_entry != NULL) SCFree(de_ctx->ths_ctx.th_entry); SCMutexDestroy(&de_ctx->ths_ctx.threshold_table_lock); } /** * \brief this function will free all the entries of a list * DetectTagDataEntry * * \param td pointer to DetectTagDataEntryList */ void ThresholdListFree(void *ptr) { if (ptr != NULL) { DetectThresholdEntry *entry = ptr; while (entry != NULL) { DetectThresholdEntry *next_entry = entry->next; SCFree(entry); entry = next_entry; } } } /** * @} */ suricata-3.2.1/src/detect-engine-hhd.h0000644000000000000000000000301513051004444014425 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HHD_H__ #define __DETECT_ENGINE_HHD_H__ #include "app-layer-htp.h" int PrefilterTxHttpRequestHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxHttpResponseHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpHeader(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineCleanHHDBuffers(DetectEngineThreadCtx *det_ctx); void DetectEngineHttpHeaderRegisterTests(void); #endif /* __DETECT_ENGINE_HHD_H__ */ suricata-3.2.1/src/util-mpm-ac-bs.c0000644000000000000000000023621013051004444013700 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * First iteration of aho-corasick MPM from - * * Efficient String Matching: An Aid to Bibliographic Search * Alfred V. Aho and Margaret J. Corasick * * - Uses the delta table for calculating transitions, instead of having * separate goto and failure transitions. * - If we cross 2 ** 16 states, we use 4 bytes in the transition table * to hold each state, otherwise we use 2 bytes. * - This version of the MPM is heavy on memory, but it performs well. * If you can fit the ruleset with this mpm on your box without hitting * swap, this is the MPM to go for. * * \todo - Do a proper analyis of our existing MPMs and suggest a good one based * on the pattern distribution and the expected traffic(say http). * - Tried out loop unrolling without any perf increase. Need to dig deeper. * - Irrespective of whether we cross 2 ** 16 states or not,shift to using * uint32_t for state type, so that we can integrate it's status as a * final state or not in the topmost byte. We are already doing it if * state_count is > 2 ** 16. * - Test case-senstive patterns if they have any ascii chars. If they * don't treat them as nocase. * - Carry out other optimizations we are working on. hashes, compression. */ #include "suricata-common.h" #include "suricata.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "util-mpm-ac-bs.h" #include "conf.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-memcmp.h" #include "util-memcpy.h" void SCACBSInitCtx(MpmCtx *); void SCACBSInitThreadCtx(MpmCtx *, MpmThreadCtx *); void SCACBSDestroyCtx(MpmCtx *); void SCACBSDestroyThreadCtx(MpmCtx *, MpmThreadCtx *); int SCACBSAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACBSAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t); int SCACBSPreparePatterns(MpmCtx *mpm_ctx); uint32_t SCACBSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen); void SCACBSPrintInfo(MpmCtx *mpm_ctx); void SCACBSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx); void SCACBSRegisterTests(void); /* a placeholder to denote a failure transition in the goto table */ #define SC_AC_BS_FAIL (-1) #define STATE_QUEUE_CONTAINER_SIZE 65536 /** * \brief Helper structure used by AC during state table creation */ typedef struct StateQueue_ { int32_t store[STATE_QUEUE_CONTAINER_SIZE]; int top; int bot; } StateQueue; /** * \brief Register the aho-corasick mpm. */ void MpmACBSRegister(void) { mpm_table[MPM_AC_BS].name = "ac-bs"; mpm_table[MPM_AC_BS].InitCtx = SCACBSInitCtx; mpm_table[MPM_AC_BS].InitThreadCtx = SCACBSInitThreadCtx; mpm_table[MPM_AC_BS].DestroyCtx = SCACBSDestroyCtx; mpm_table[MPM_AC_BS].DestroyThreadCtx = SCACBSDestroyThreadCtx; mpm_table[MPM_AC_BS].AddPattern = SCACBSAddPatternCS; mpm_table[MPM_AC_BS].AddPatternNocase = SCACBSAddPatternCI; mpm_table[MPM_AC_BS].Prepare = SCACBSPreparePatterns; mpm_table[MPM_AC_BS].Search = SCACBSSearch; mpm_table[MPM_AC_BS].PrintCtx = SCACBSPrintInfo; mpm_table[MPM_AC_BS].PrintThreadCtx = SCACBSPrintSearchStats; mpm_table[MPM_AC_BS].RegisterUnittests = SCACBSRegisterTests; return; } /** * \internal * \brief Initialize the AC context with user specified conf parameters. We * aren't retrieving anything for AC conf now, but we will certainly * need it, when we customize AC. */ static void SCACBSGetConfig() { //ConfNode *ac_conf; //const char *hash_val = NULL; //ConfNode *pm = ConfGetNode("pattern-matcher"); return; } /** * \internal * \brief Initialize a new state in the goto and output tables. * * \param mpm_ctx Pointer to the mpm context. * * \retval The state id, of the newly created state. */ static inline int SCACBSInitNewState(MpmCtx *mpm_ctx) { void *ptmp; SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int ascii_code = 0; int size = 0; /* reallocate space in the goto table to include a new state */ size = (ctx->state_count + 1) * ctx->single_state_size; ptmp = SCRealloc(ctx->goto_table, size); if (ptmp == NULL) { SCFree(ctx->goto_table); ctx->goto_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->goto_table = ptmp; /* set all transitions for the newly assigned state as FAIL transitions */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { ctx->goto_table[ctx->state_count][ascii_code] = SC_AC_BS_FAIL; } /* reallocate space in the output table for the new state */ size = (ctx->state_count + 1) * sizeof(SCACBSOutputTable); ptmp = SCRealloc(ctx->output_table, size); if (ptmp == NULL) { SCFree(ctx->output_table); ctx->output_table = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } ctx->output_table = ptmp; memset(ctx->output_table + ctx->state_count, 0, sizeof(SCACBSOutputTable)); /* \todo using it temporarily now during dev, since I have restricted * state var in SCACBSCtx->state_table to uint16_t. */ //if (ctx->state_count > 65536) { // printf("state count exceeded\n"); // exit(EXIT_FAILURE); //} return ctx->state_count++; } /** * \internal * \brief Adds a pid to the output table for a state. * * \param state The state to whose output table we should add the pid. * \param pid The pattern id to add. * \param mpm_ctx Pointer to the mpm context. */ static void SCACBSSetOutputState(int32_t state, uint32_t pid, MpmCtx *mpm_ctx) { void *ptmp; SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; SCACBSOutputTable *output_state = &ctx->output_table[state]; uint32_t i = 0; for (i = 0; i < output_state->no_of_entries; i++) { if (output_state->pids[i] == pid) return; } output_state->no_of_entries++; ptmp = SCRealloc(output_state->pids, output_state->no_of_entries * sizeof(uint32_t)); if (ptmp == NULL) { SCFree(output_state->pids); output_state->pids = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } output_state->pids = ptmp; output_state->pids[output_state->no_of_entries - 1] = pid; return; } /** * \brief Helper function used by SCACBSCreateGotoTable. Adds a pattern to the * goto table. * * \param pattern Pointer to the pattern. * \param pattern_len Pattern length. * \param pid The pattern id, that corresponds to this pattern. We * need it to updated the output table for this pattern. * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSEnter(uint8_t *pattern, uint16_t pattern_len, uint32_t pid, MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int32_t state = 0; int32_t newstate = 0; int i = 0; int p = 0; /* walk down the trie till we have a match for the pattern prefix */ state = 0; for (i = 0; i < pattern_len; i++) { if (ctx->goto_table[state][pattern[i]] != SC_AC_BS_FAIL) { state = ctx->goto_table[state][pattern[i]]; } else { break; } } /* add the non-matching pattern suffix to the trie, from the last state * we left off */ for (p = i; p < pattern_len; p++) { newstate = SCACBSInitNewState(mpm_ctx); ctx->goto_table[state][pattern[p]] = newstate; state = newstate; } /* add this pattern id, to the output table of the last state, where the * pattern ends in the trie */ SCACBSSetOutputState(state, pid, mpm_ctx); return; } /** * \internal * \brief Create the goto table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSCreateGotoTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; uint32_t i = 0; /* add each pattern to create the goto table */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { SCACBSEnter(ctx->parray[i]->ci, ctx->parray[i]->len, ctx->parray[i]->id, mpm_ctx); } int ascii_code = 0; for (ascii_code = 0; ascii_code < 256; ascii_code++) { if (ctx->goto_table[0][ascii_code] == SC_AC_BS_FAIL) { ctx->goto_table[0][ascii_code] = 0; } } return; } static inline int SCACBSStateQueueIsEmpty(StateQueue *q) { if (q->top == q->bot) return 1; else return 0; } static inline void SCACBSEnqueue(StateQueue *q, int32_t state) { int i = 0; /*if we already have this */ for (i = q->bot; i < q->top; i++) { if (q->store[i] == state) return; } q->store[q->top++] = state; if (q->top == STATE_QUEUE_CONTAINER_SIZE) q->top = 0; if (q->top == q->bot) { SCLogCritical(SC_ERR_AHO_CORASICK, "Just ran out of space in the queue. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } return; } static inline int32_t SCACBSDequeue(StateQueue *q) { if (q->bot == STATE_QUEUE_CONTAINER_SIZE) q->bot = 0; if (q->bot == q->top) { SCLogCritical(SC_ERR_AHO_CORASICK, "StateQueue behaving weirdly. " "Fatal Error. Exiting. Please file a bug report on this"); exit(EXIT_FAILURE); } return q->store[q->bot++]; } /* #define SCACBSStateQueueIsEmpty(q) (((q)->top == (q)->bot) ? 1 : 0) #define SCACBSEnqueue(q, state) do { \ int i = 0; \ \ for (i = (q)->bot; i < (q)->top; i++) { \ if ((q)->store[i] == state) \ return; \ } \ \ (q)->store[(q)->top++] = state; \ \ if ((q)->top == STATE_QUEUE_CONTAINER_SIZE) \ (q)->top = 0; \ \ if ((q)->top == (q)->bot) { \ SCLogCritical(SC_ERR_AHO_CORASICK, "Just ran out of space in the queue. " \ "Fatal Error. Exiting. Please file a bug report on this"); \ exit(EXIT_FAILURE); \ } \ } while (0) #define SCACBSDequeue(q) ( (((q)->bot == STATE_QUEUE_CONTAINER_SIZE)? ((q)->bot = 0): 0), \ (((q)->bot == (q)->top) ? \ (printf("StateQueue behaving " \ "weirdly. Fatal Error. Exiting. Please " \ "file a bug report on this"), \ exit(EXIT_FAILURE)) : 0), \ (q)->store[(q)->bot++]) \ */ /** * \internal * \brief Club the output data from 2 states and store it in the 1st state. * dst_state_data = {dst_state_data} UNION {src_state_data} * * \param dst_state First state(also the destination) for the union operation. * \param src_state Second state for the union operation. * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSClubOutputStates(int32_t dst_state, int32_t src_state, MpmCtx *mpm_ctx) { void *ptmp; SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; uint32_t i = 0; uint32_t j = 0; SCACBSOutputTable *output_dst_state = &ctx->output_table[dst_state]; SCACBSOutputTable *output_src_state = &ctx->output_table[src_state]; for (i = 0; i < output_src_state->no_of_entries; i++) { for (j = 0; j < output_dst_state->no_of_entries; j++) { if (output_src_state->pids[i] == output_dst_state->pids[j]) { break; } } if (j == output_dst_state->no_of_entries) { output_dst_state->no_of_entries++; ptmp = SCRealloc(output_dst_state->pids, (output_dst_state->no_of_entries * sizeof(uint32_t))); if (ptmp == NULL) { SCFree(output_dst_state->pids); output_dst_state->pids = NULL; SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } else { output_dst_state->pids = ptmp; } output_dst_state->pids[output_dst_state->no_of_entries - 1] = output_src_state->pids[i]; } } return; } /** * \internal * \brief Create the failure table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSCreateFailureTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int ascii_code = 0; int32_t state = 0; int32_t r_state = 0; StateQueue q; memset(&q, 0, sizeof(StateQueue)); /* allot space for the failure table. A failure entry in the table for * every state(SCACBSCtx->state_count) */ ctx->failure_table = SCMalloc(ctx->state_count * sizeof(int32_t)); if (ctx->failure_table == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->failure_table, 0, ctx->state_count * sizeof(int32_t)); /* add the failure transitions for the 0th state, and add every non-fail * transition from the 0th state to the queue for further processing * of failure states */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[0][ascii_code]; if (temp_state != 0) { SCACBSEnqueue(&q, temp_state); ctx->failure_table[temp_state] = 0; } } while (!SCACBSStateQueueIsEmpty(&q)) { /* pick up every state from the queue and add failure transitions */ r_state = SCACBSDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state == SC_AC_BS_FAIL) continue; SCACBSEnqueue(&q, temp_state); state = ctx->failure_table[r_state]; while(ctx->goto_table[state][ascii_code] == SC_AC_BS_FAIL) state = ctx->failure_table[state]; ctx->failure_table[temp_state] = ctx->goto_table[state][ascii_code]; SCACBSClubOutputStates(temp_state, ctx->failure_table[temp_state], mpm_ctx); } } return; } /** * \internal * \brief Create the delta table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSCreateDeltaTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int ascii_code = 0; int32_t r_state = 0; if (ctx->state_count < 32767) { ctx->state_table_u16 = SCMalloc(ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U16) * 256); if (ctx->state_table_u16 == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_u16, 0, ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U16) * 256); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U16) * 256); StateQueue q; memset(&q, 0, sizeof(StateQueue)); for (ascii_code = 0; ascii_code < 256; ascii_code++) { SC_AC_BS_STATE_TYPE_U16 temp_state = ctx->goto_table[0][ascii_code]; ctx->state_table_u16[0][ascii_code] = temp_state; if (temp_state != 0) SCACBSEnqueue(&q, temp_state); } while (!SCACBSStateQueueIsEmpty(&q)) { r_state = SCACBSDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state != SC_AC_BS_FAIL) { SCACBSEnqueue(&q, temp_state); ctx->state_table_u16[r_state][ascii_code] = temp_state; } else { ctx->state_table_u16[r_state][ascii_code] = ctx->state_table_u16[ctx->failure_table[r_state]][ascii_code]; } } } } else { /* create space for the state table. We could have used the existing goto * table, but since we have it set to hold 32 bit state values, we will create * a new state table here of type SC_AC_BS_STATE_TYPE(current set to uint16_t) */ ctx->state_table_u32 = SCMalloc(ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U32) * 256); if (ctx->state_table_u32 == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_u32, 0, ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U32) * 256); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U32) * 256); StateQueue q; memset(&q, 0, sizeof(StateQueue)); for (ascii_code = 0; ascii_code < 256; ascii_code++) { SC_AC_BS_STATE_TYPE_U32 temp_state = ctx->goto_table[0][ascii_code]; ctx->state_table_u32[0][ascii_code] = temp_state; if (temp_state != 0) SCACBSEnqueue(&q, temp_state); } while (!SCACBSStateQueueIsEmpty(&q)) { r_state = SCACBSDequeue(&q); for (ascii_code = 0; ascii_code < 256; ascii_code++) { int32_t temp_state = ctx->goto_table[r_state][ascii_code]; if (temp_state != SC_AC_BS_FAIL) { SCACBSEnqueue(&q, temp_state); ctx->state_table_u32[r_state][ascii_code] = temp_state; } else { ctx->state_table_u32[r_state][ascii_code] = ctx->state_table_u32[ctx->failure_table[r_state]][ascii_code]; } } } } return; } static inline void SCACBSClubOutputStatePresenceWithDeltaTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int ascii_code = 0; uint32_t state = 0; uint32_t temp_state = 0; if (ctx->state_count < 32767) { for (state = 0; state < ctx->state_count; state++) { for (ascii_code = 0; ascii_code < 256; ascii_code++) { temp_state = ctx->state_table_u16[state & 0x7FFF][ascii_code]; if (ctx->output_table[temp_state & 0x7FFF].no_of_entries != 0) ctx->state_table_u16[state & 0x7FFF][ascii_code] |= (1 << 15); } } } else { for (state = 0; state < ctx->state_count; state++) { for (ascii_code = 0; ascii_code < 256; ascii_code++) { temp_state = ctx->state_table_u32[state & 0x00FFFFFF][ascii_code]; if (ctx->output_table[temp_state & 0x00FFFFFF].no_of_entries != 0) ctx->state_table_u32[state & 0x00FFFFFF][ascii_code] |= (1 << 24); } } } return; } static inline void SCACBSInsertCaseSensitiveEntriesForPatterns(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; uint32_t state = 0; uint32_t k = 0; for (state = 0; state < ctx->state_count; state++) { if (ctx->output_table[state].no_of_entries == 0) continue; for (k = 0; k < ctx->output_table[state].no_of_entries; k++) { if (ctx->pid_pat_list[ctx->output_table[state].pids[k]].cs != NULL) { ctx->output_table[state].pids[k] &= 0x0000FFFF; ctx->output_table[state].pids[k] |= 1 << 16; } } } return; } #if 0 static void SCACBSPrintDeltaTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int i = 0, j = 0; printf("##############Delta Table##############\n"); for (i = 0; i < ctx->state_count; i++) { printf("%d: \n", i); for (j = 0; j < 256; j++) { if (SCACBSGetDelta(i, j, mpm_ctx) != 0) { printf(" %c -> %d\n", j, SCACBSGetDelta(i, j, mpm_ctx)); } } } return; } #endif static inline int SCACBSZeroTransitionPresent(SCACBSCtx *ctx, uint32_t state) { if (state == 0) return 1; if (ctx->state_count < 32767) { int ascii; for (ascii = 0; ascii < 256; ascii++) { if ((ctx->state_table_u16[0][ascii] & 0x7fff) == (state & 0x7fff)) { return 1; } } return 0; } else { int ascii; for (ascii = 0; ascii < 256; ascii++) { if ((ctx->state_table_u32[0][ascii] & 0x00FFFFFF) == (state & 0x00FFFFFF)) { return 1; } } return 0; } } /** * \internal * \brief Creates a new goto table structure(throw out all the failure * transitions), to hold the existing goto table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSCreateModDeltaTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; if (ctx->state_count < 32767) { int size = 0; uint32_t state; for (state = 1; state < ctx->state_count; state++) { int ascii_code; int k = 0; for (ascii_code = 0; ascii_code < 256; ascii_code++) { uint32_t temp_state = ctx->state_table_u16[state][ascii_code]; if (SCACBSZeroTransitionPresent(ctx, temp_state)) continue; k++; } size += sizeof(uint16_t) * k * 2; } /* Let us use uint16_t for all. That way we don//'t have to worry about * alignment. Technically 8 bits is all we need to store ascii codes, * but by avoiding it, we save a lot of time on handling alignment */ size += (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U16) + 256 * sizeof(SC_AC_BS_STATE_TYPE_U16) * 1); ctx->state_table_mod = SCMalloc(size); if (ctx->state_table_mod == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_mod, 0, size); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += size; /* buffer to hold pointers in the buffer, so that a state can use it * directly to access its state data */ ctx->state_table_mod_pointers = SCMalloc(ctx->state_count * sizeof(uint8_t *)); if (ctx->state_table_mod_pointers == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_mod_pointers, 0, ctx->state_count * sizeof(uint8_t *)); SC_AC_BS_STATE_TYPE_U16 temp_states[256]; uint16_t *curr_loc = (uint16_t *)ctx->state_table_mod; uint16_t *no_of_entries = NULL; uint16_t *ascii_codes = NULL; uint16_t ascii_code = 0; uint16_t k = 0; for (state = 0; state < ctx->state_count; state++) { /* store the starting location in the buffer for this state */ ctx->state_table_mod_pointers[state] = (uint8_t *)curr_loc; no_of_entries = curr_loc++; ascii_codes = curr_loc; k = 0; /* store all states that have non 0 transitions in the temp buffer */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { uint32_t temp_state = ctx->state_table_u16[state][ascii_code]; if (state != 0 && SCACBSZeroTransitionPresent(ctx, temp_state)) continue; ascii_codes[k] = ascii_code; temp_states[k] = ctx->state_table_u16[state][ascii_code]; k++; } /* if we have any non 0 transitions from our previous for search, * store the acii codes as well the corresponding states */ if (k > 0) { no_of_entries[0] = k; if (state != 0) curr_loc += k; memcpy(curr_loc, temp_states, k * sizeof(SC_AC_BS_STATE_TYPE_U16)); curr_loc += k; } } /* > 33766 */ } else { int size = 0; uint32_t state; for (state = 1; state < ctx->state_count; state++) { int ascii_code; int k = 0; for (ascii_code = 0; ascii_code < 256; ascii_code++) { uint32_t temp_state = ctx->state_table_u32[state][ascii_code]; if (SCACBSZeroTransitionPresent(ctx, temp_state)) continue; k++; } size += sizeof(uint32_t) * k * 2; } /* Let us use uint32_t for all. That way we don//'t have to worry about * alignment. Technically 8 bits is all we need to store ascii codes, * but by avoiding it, we save a lot of time on handling alignment */ size += (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U32) + 256 * sizeof(SC_AC_BS_STATE_TYPE_U32) * 1); ctx->state_table_mod = SCMalloc(size); if (ctx->state_table_mod == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_mod, 0, size); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += size; /* buffer to hold pointers in the buffer, so that a state can use it * directly to access its state data */ ctx->state_table_mod_pointers = SCMalloc(ctx->state_count * sizeof(uint8_t *)); if (ctx->state_table_mod_pointers == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->state_table_mod_pointers, 0, ctx->state_count * sizeof(uint8_t *)); SC_AC_BS_STATE_TYPE_U32 temp_states[256]; uint32_t *curr_loc = (uint32_t *)ctx->state_table_mod; uint32_t *no_of_entries = NULL; uint32_t *ascii_codes = NULL; uint32_t ascii_code = 0; uint32_t k = 0; for (state = 0; state < ctx->state_count; state++) { /* store the starting location in the buffer for this state */ ctx->state_table_mod_pointers[state] = (uint8_t *)curr_loc; no_of_entries = curr_loc++; ascii_codes = curr_loc; k = 0; /* store all states that have non 0 transitions in the temp buffer */ for (ascii_code = 0; ascii_code < 256; ascii_code++) { uint32_t temp_state = ctx->state_table_u32[state][ascii_code]; if (state != 0 && SCACBSZeroTransitionPresent(ctx, temp_state)) continue; ascii_codes[k] = ascii_code; temp_states[k] = ctx->state_table_u32[state][ascii_code]; k++; } /* if we have any non 0 transitions from our previous for search, * store the acii codes as well the corresponding states */ if (k > 0) { no_of_entries[0] = k; if (state != 0) curr_loc += k; memcpy(curr_loc, temp_states, k * sizeof(SC_AC_BS_STATE_TYPE_U32)); curr_loc += k; } } } return; } /** * \brief Process the patterns and prepare the state table. * * \param mpm_ctx Pointer to the mpm context. */ static inline void SCACBSPrepareStateTable(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; /* create the 0th state in the goto table and output_table */ SCACBSInitNewState(mpm_ctx); /* create the goto table */ SCACBSCreateGotoTable(mpm_ctx); /* create the failure table */ SCACBSCreateFailureTable(mpm_ctx); /* create the final state(delta) table */ SCACBSCreateDeltaTable(mpm_ctx); /* club the output state presence with delta transition entries */ SCACBSClubOutputStatePresenceWithDeltaTable(mpm_ctx); /* create the modified table */ SCACBSCreateModDeltaTable(mpm_ctx); /* club nocase entries */ SCACBSInsertCaseSensitiveEntriesForPatterns(mpm_ctx); // int state = 0; // for (state = 0; state < ctx->state_count; state++) { // int i = 0; // for (i = 0; i < 256; i++) { // if (ctx->state_table_u16[state][i] != 0) { // printf("%d-%d-%d\n", state, i, ctx->state_table_u16[state][i] & 0x7fff) ; // } // } // } #if 0 SCACBSPrintDeltaTable(mpm_ctx); #endif /* we don't need these anymore */ SCFree(ctx->goto_table); ctx->goto_table = NULL; SCFree(ctx->failure_table); ctx->failure_table = NULL; SCFree(ctx->state_table_u16); ctx->state_table_u16 = NULL; SCFree(ctx->state_table_u32); ctx->state_table_u32 = NULL; return; } /** * \brief Process the patterns added to the mpm, and create the internal tables. * * \param mpm_ctx Pointer to the mpm context. */ int SCACBSPreparePatterns(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; if (mpm_ctx->pattern_cnt == 0 || mpm_ctx->init_hash == NULL) { SCLogDebug("no patterns supplied to this mpm_ctx"); return 0; } /* alloc the pattern array */ ctx->parray = (MpmPattern **)SCMalloc(mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); if (ctx->parray == NULL) goto error; memset(ctx->parray, 0, mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); /* populate it with the patterns in the hash */ uint32_t i = 0, p = 0; for (i = 0; i < MPM_INIT_HASH_SIZE; i++) { MpmPattern *node = mpm_ctx->init_hash[i], *nnode = NULL; while(node != NULL) { nnode = node->next; node->next = NULL; ctx->parray[p++] = node; node = nnode; } } /* we no longer need the hash, so free it's memory */ SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; /* the memory consumed by a single state in our goto table */ ctx->single_state_size = sizeof(int32_t) * 256; /* handle no case patterns */ ctx->pid_pat_list = SCMalloc((mpm_ctx->max_pat_id + 1)* sizeof(SCACBSPatternList)); if (ctx->pid_pat_list == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memset(ctx->pid_pat_list, 0, (mpm_ctx->max_pat_id + 1) * sizeof(SCACBSPatternList)); for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (!(ctx->parray[i]->flags & MPM_PATTERN_FLAG_NOCASE)) { ctx->pid_pat_list[ctx->parray[i]->id].cs = SCMalloc(ctx->parray[i]->len); if (ctx->pid_pat_list[ctx->parray[i]->id].cs == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } memcpy(ctx->pid_pat_list[ctx->parray[i]->id].cs, ctx->parray[i]->original_pat, ctx->parray[i]->len); ctx->pid_pat_list[ctx->parray[i]->id].patlen = ctx->parray[i]->len; } /* ACPatternList now owns this memory */ ctx->pid_pat_list[ctx->parray[i]->id].sids_size = ctx->parray[i]->sids_size; ctx->pid_pat_list[ctx->parray[i]->id].sids = ctx->parray[i]->sids; } /* prepare the state table required by AC */ SCACBSPrepareStateTable(mpm_ctx); /* free all the stored patterns. Should save us a good 100-200 mbs */ for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->parray[i] != NULL) { MpmFreePattern(mpm_ctx, ctx->parray[i]); } } SCFree(ctx->parray); ctx->parray = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); ctx->pattern_id_bitarray_size = (mpm_ctx->max_pat_id / 8) + 1; return 0; error: return -1; } /** * \brief Init the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param matchsize We don't need this. */ void SCACBSInitThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { memset(mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); mpm_thread_ctx->ctx = SCMalloc(sizeof(SCACBSThreadCtx)); if (mpm_thread_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_thread_ctx->ctx, 0, sizeof(SCACBSThreadCtx)); mpm_thread_ctx->memory_cnt++; mpm_thread_ctx->memory_size += sizeof(SCACBSThreadCtx); return; } /** * \brief Initialize the AC context. * * \param mpm_ctx Mpm context. * \param module_handle Cuda module handle from the cuda handler API. We don't * have to worry about this here. */ void SCACBSInitCtx(MpmCtx *mpm_ctx) { if (mpm_ctx->ctx != NULL) return; mpm_ctx->ctx = SCMalloc(sizeof(SCACBSCtx)); if (mpm_ctx->ctx == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->ctx, 0, sizeof(SCACBSCtx)); mpm_ctx->memory_cnt++; mpm_ctx->memory_size += sizeof(SCACBSCtx); /* initialize the hash we use to speed up pattern insertions */ mpm_ctx->init_hash = SCMalloc(sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); if (mpm_ctx->init_hash == NULL) { exit(EXIT_FAILURE); } memset(mpm_ctx->init_hash, 0, sizeof(MpmPattern *) * MPM_INIT_HASH_SIZE); /* get conf values for AC from our yaml file. We have no conf values for * now. We will certainly need this, as we develop the algo */ SCACBSGetConfig(); SCReturn; } /** * \brief Destroy the mpm thread context. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. */ void SCACBSDestroyThreadCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) { SCACBSPrintSearchStats(mpm_thread_ctx); if (mpm_thread_ctx->ctx != NULL) { SCFree(mpm_thread_ctx->ctx); mpm_thread_ctx->ctx = NULL; mpm_thread_ctx->memory_cnt--; mpm_thread_ctx->memory_size -= sizeof(SCACBSThreadCtx); } return; } /** * \brief Destroy the mpm context. * * \param mpm_ctx Pointer to the mpm context. */ void SCACBSDestroyCtx(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; if (ctx == NULL) return; if (mpm_ctx->init_hash != NULL) { SCFree(mpm_ctx->init_hash); mpm_ctx->init_hash = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (MPM_INIT_HASH_SIZE * sizeof(MpmPattern *)); } if (ctx->parray != NULL) { uint32_t i; for (i = 0; i < mpm_ctx->pattern_cnt; i++) { if (ctx->parray[i] != NULL) { MpmFreePattern(mpm_ctx, ctx->parray[i]); } } SCFree(ctx->parray); ctx->parray = NULL; mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= (mpm_ctx->pattern_cnt * sizeof(MpmPattern *)); } if (ctx->state_table_u16 != NULL) { SCFree(ctx->state_table_u16); ctx->state_table_u16 = NULL; mpm_ctx->memory_cnt++; mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U16) * 256); } else if (ctx->state_table_u32 != NULL) { SCFree(ctx->state_table_u32); ctx->state_table_u32 = NULL; mpm_ctx->memory_cnt++; mpm_ctx->memory_size -= (ctx->state_count * sizeof(SC_AC_BS_STATE_TYPE_U32) * 256); } if (ctx->output_table != NULL) { uint32_t state_count; for (state_count = 0; state_count < ctx->state_count; state_count++) { if (ctx->output_table[state_count].pids != NULL) { SCFree(ctx->output_table[state_count].pids); } } SCFree(ctx->output_table); } if (ctx->pid_pat_list != NULL) { uint32_t i; for (i = 0; i < (mpm_ctx->max_pat_id + 1); i++) { if (ctx->pid_pat_list[i].cs != NULL) SCFree(ctx->pid_pat_list[i].cs); if (ctx->pid_pat_list[i].sids != NULL) SCFree(ctx->pid_pat_list[i].sids); } SCFree(ctx->pid_pat_list); } if (ctx->state_table_mod != NULL) { SCFree(ctx->state_table_mod); ctx->state_table_mod = NULL; } if (ctx->state_table_mod_pointers != NULL) { SCFree(ctx->state_table_mod_pointers); ctx->state_table_mod_pointers = NULL; } SCFree(mpm_ctx->ctx); mpm_ctx->memory_cnt--; mpm_ctx->memory_size -= sizeof(SCACBSCtx); return; } /** * \brief The aho corasick search function. * * \param mpm_ctx Pointer to the mpm context. * \param mpm_thread_ctx Pointer to the mpm thread context. * \param pmq Pointer to the Pattern Matcher Queue to hold * search matches. * \param buf Buffer to be searched. * \param buflen Buffer length. * * \retval matches Match count. */ uint32_t SCACBSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen) { const SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; int i = 0; int matches = 0; uint8_t buf_local; /* \todo tried loop unrolling with register var, with no perf increase. Need * to dig deeper */ /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */ SCACBSPatternList *pid_pat_list = ctx->pid_pat_list; uint8_t bitarray[ctx->pattern_id_bitarray_size]; memset(bitarray, 0, ctx->pattern_id_bitarray_size); if (ctx->state_count < 32767) { register SC_AC_BS_STATE_TYPE_U16 state = 0; uint16_t no_of_entries; uint16_t *ascii_codes; uint16_t **state_table_mod_pointers = (uint16_t **)ctx->state_table_mod_pointers; uint16_t *zero_state = state_table_mod_pointers[0] + 1; for (i = 0; i < buflen; i++) { if (state == 0) { state = zero_state[u8_tolower(buf[i])]; } else { no_of_entries = *(state_table_mod_pointers[state & 0x7FFF]); if (no_of_entries == 1) { ascii_codes = state_table_mod_pointers[state & 0x7FFF] + 1; buf_local = u8_tolower(buf[i]); if (buf_local == ascii_codes[0]) { state = *(ascii_codes + no_of_entries);; } else { state = zero_state[buf_local]; } } else { if (no_of_entries == 0) { state = zero_state[u8_tolower(buf[i])]; goto match_u16; } buf_local = u8_tolower(buf[i]); ascii_codes = state_table_mod_pointers[state & 0x7FFF] + 1; int low = 0; int high = no_of_entries; int mid; while (low <= high) { mid = (low + high) / 2; if (ascii_codes[mid] == buf_local) { state = ((ascii_codes + no_of_entries))[mid]; goto match_u16; } else if (ascii_codes[mid] < buf_local) { low = mid + 1; } else { high = mid - 1; } } /* while */ state = zero_state[buf_local]; } /* else - if (no_of_entires == 1) */ } match_u16: if (state & 0x8000) { uint32_t nentries = ctx->output_table[state & 0x7FFF].no_of_entries; uint32_t *pids = ctx->output_table[state & 0x7FFF].pids; uint32_t k; for (k = 0; k < nentries; k++) { if (pids[k] & 0xFFFF0000) { uint32_t lower_pid = pids[k] & 0x0000FFFF; if (SCMemcmp(pid_pat_list[lower_pid].cs, buf + i - pid_pat_list[lower_pid].patlen + 1, pid_pat_list[lower_pid].patlen) != 0) { /* inside loop */ continue; } if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) { ; } else { bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8)); PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size); } matches++; } else { if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { ; } else { bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size); } matches++; } //loop1: //; } } } /* for (i = 0; i < buflen; i++) */ } else { register SC_AC_BS_STATE_TYPE_U32 state = 0; uint32_t no_of_entries; uint32_t *ascii_codes; uint32_t **state_table_mod_pointers = (uint32_t **)ctx->state_table_mod_pointers; uint32_t *zero_state = state_table_mod_pointers[0] + 1; for (i = 0; i < buflen; i++) { if (state == 0) { state = zero_state[u8_tolower(buf[i])]; } else { no_of_entries = *(state_table_mod_pointers[state & 0x00FFFFFF]); if (no_of_entries == 1) { ascii_codes = state_table_mod_pointers[state & 0x00FFFFFF] + 1; buf_local = u8_tolower(buf[i]); if (buf_local == ascii_codes[0]) { state = *(ascii_codes + no_of_entries);; } else { state = zero_state[buf_local];; } } else { if (no_of_entries == 0) { state = zero_state[u8_tolower(buf[i])]; goto match_u32; } buf_local = u8_tolower(buf[i]); ascii_codes = state_table_mod_pointers[state & 0x00FFFFFF] + 1; int low = 0; int high = no_of_entries; int mid; while (low <= high) { mid = (low + high) / 2; if (ascii_codes[mid] == buf_local) { state = ((ascii_codes + no_of_entries))[mid]; goto match_u32; } else if (ascii_codes[mid] < buf_local) { low = mid + 1; } else { high = mid - 1; } } /* while */ state = zero_state[buf_local]; } /* else - if (no_of_entires == 1) */ } match_u32: if (state & 0xFF000000) { uint32_t nentries = ctx->output_table[state & 0x00FFFFFF].no_of_entries; uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids; uint32_t k; for (k = 0; k < nentries; k++) { if (pids[k] & 0xFFFF0000) { uint32_t lower_pid = pids[k] & 0x0000FFFF; if (SCMemcmp(pid_pat_list[lower_pid].cs, buf + i - pid_pat_list[lower_pid].patlen + 1, pid_pat_list[lower_pid].patlen) != 0) { /* inside loop */ continue; } if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) { ; } else { bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8)); PrefilterAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size); } matches++; } else { if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) { ; } else { bitarray[pids[k] / 8] |= (1 << (pids[k] % 8)); PrefilterAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size); } matches++; } //loop1: //; } } } /* for (i = 0; i < buflen; i++) */ } return matches; } /** * \brief Add a case insensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patnen The pattern length. * \param offset Ignored. * \param depth Ignored. * \param pid The pattern id. * \param sid Ignored. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCACBSAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { flags |= MPM_PATTERN_FLAG_NOCASE; return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } /** * \brief Add a case sensitive pattern. Although we have different calls for * adding case sensitive and insensitive patterns, we make a single call * for either case. No special treatment for either case. * * \param mpm_ctx Pointer to the mpm context. * \param pat The pattern to add. * \param patnen The pattern length. * \param offset Ignored. * \param depth Ignored. * \param pid The pattern id. * \param sid Ignored. * \param flags Flags associated with this pattern. * * \retval 0 On success. * \retval -1 On failure. */ int SCACBSAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags) { return MpmAddPattern(mpm_ctx, pat, patlen, offset, depth, pid, sid, flags); } void SCACBSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) { #ifdef SC_AC_BS_COUNTERS SCACBSThreadCtx *ctx = (SCACBSThreadCtx *)mpm_thread_ctx->ctx; printf("AC Thread Search stats (ctx %p)\n", ctx); printf("Total calls: %" PRIu32 "\n", ctx->total_calls); printf("Total matches: %" PRIu64 "\n", ctx->total_matches); #endif /* SC_AC_BS_COUNTERS */ return; } void SCACBSPrintInfo(MpmCtx *mpm_ctx) { SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx; printf("MPM AC Information:\n"); printf("Memory allocs: %" PRIu32 "\n", mpm_ctx->memory_cnt); printf("Memory alloced: %" PRIu32 "\n", mpm_ctx->memory_size); printf(" Sizeof:\n"); printf(" MpmCtx %" PRIuMAX "\n", (uintmax_t)sizeof(MpmCtx)); printf(" SCACBSCtx: %" PRIuMAX "\n", (uintmax_t)sizeof(SCACBSCtx)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf(" MpmPattern %" PRIuMAX "\n", (uintmax_t)sizeof(MpmPattern)); printf("Unique Patterns: %" PRIu32 "\n", mpm_ctx->pattern_cnt); printf("Smallest: %" PRIu32 "\n", mpm_ctx->minlen); printf("Largest: %" PRIu32 "\n", mpm_ctx->maxlen); printf("Total states in the state table: %" PRIu32 "\n", ctx->state_count); printf("\n"); return; } /*************************************Unittests********************************/ #ifdef UNITTESTS static int SCACBSTest01(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest02(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abce", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest03(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcde", 4, 0, 0, 1, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghj", 4, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest04(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcdegh", 6, 0, 0, 1, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"fghjxyz", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest05(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghJikl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghjiklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest06(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcd"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest07(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* should match 30 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"A", 1, 0, 0, 0, 0, 0); /* should match 29 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 1, 0, 0); /* should match 28 times */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAA", 3, 0, 0, 2, 0, 0); /* 26 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAA", 5, 0, 0, 3, 0, 0); /* 21 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAA", 10, 0, 0, 4, 0, 0); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 30, 0, 0, 5, 0, 0); PmqSetup(&pmq); /* total matches: 135 */ SCACBSPreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 135) result = 1; else printf("135 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest08(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"a", 1); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest09(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ab", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"ab", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest10(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcdefgh", 8, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789" "abcdefgh" "01234567890123456789012345678901234567890123456789" "01234567890123456789012345678901234567890123456789"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest11(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"he", 2, 0, 0, 1, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"she", 3, 0, 0, 2, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"his", 3, 0, 0, 3, 0, 0) == -1) goto end; if (MpmAddPatternCS(&mpm_ctx, (uint8_t *)"hers", 4, 0, 0, 4, 0, 0) == -1) goto end; PmqSetup(&pmq); if (SCACBSPreparePatterns(&mpm_ctx) == -1) goto end; result = 1; char *buf = "he"; result &= (SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "she"; result &= (SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); buf = "his"; result &= (SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 1); buf = "hers"; result &= (SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)) == 2); end: SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest12(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"wxyz", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"vwxyz", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest13(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCD"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCD"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest14(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDE"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDE"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest15(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABCDEF"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABCDEF"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest16(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzABC"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzABC"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest17(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcdefghijklmnopqrstuvwxyzAB"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyzAB"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest18(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ char *pat = "abcde""fghij""klmno""pqrst""uvwxy""z"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcde""fghij""klmno""pqrst""uvwxy""z"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest19(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); PmqFree(&pmq); return result; } static int SCACBSTest20(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ char *pat = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; MpmAddPatternCS(&mpm_ctx, (uint8_t *)pat, strlen(pat), 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AAAAA""AA"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest21(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"AA", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest22(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcd", 4, 0, 0, 0, 0, 0); /* 1 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefghijklmnopqrstuvwxyz"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 2) result = 1; else printf("2 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest23(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 0) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest24(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 1 */ MpmAddPatternCI(&mpm_ctx, (uint8_t *)"AA", 2, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)"aa", 2); if (cnt == 1) result = 1; else printf("1 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest25(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"ABCD", 4, 0, 0, 0, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"bCdEfG", 6, 0, 0, 1, 0, 0); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"fghiJkl", 7, 0, 0, 2, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 3) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest26(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCI(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"Works", 5, 0, 0, 1, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "works"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 1) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest27(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"ONE", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "tone"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest28(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); /* 0 match */ MpmAddPatternCS(&mpm_ctx, (uint8_t *)"one", 3, 0, 0, 0, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "tONE"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 0) result = 1; else printf("0 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest29(void) { int result = 0; MpmCtx mpm_ctx; MpmThreadCtx mpm_thread_ctx; PrefilterRuleStore pmq; memset(&mpm_ctx, 0x00, sizeof(MpmCtx)); memset(&mpm_thread_ctx, 0, sizeof(MpmThreadCtx)); MpmInitCtx(&mpm_ctx, MPM_AC_BS); SCACBSInitThreadCtx(&mpm_ctx, &mpm_thread_ctx); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"abcde", 5, 0, 0, 0, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"bcdef", 5, 0, 0, 1, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"cdefg", 5, 0, 0, 3, 0, 0); MpmAddPatternCS(&mpm_ctx, (uint8_t *)"defgh", 5, 0, 0, 4, 0, 0); PmqSetup(&pmq); SCACBSPreparePatterns(&mpm_ctx); char *buf = "abcdefgh"; uint32_t cnt = SCACBSSearch(&mpm_ctx, &mpm_thread_ctx, &pmq, (uint8_t *)buf, strlen(buf)); if (cnt == 4) result = 1; else printf("3 != %" PRIu32 " ",cnt); SCACBSDestroyCtx(&mpm_ctx); SCACBSDestroyThreadCtx(&mpm_ctx, &mpm_thread_ctx); PmqFree(&pmq); return result; } static int SCACBSTest30(void) { uint8_t *buf = (uint8_t *)"onetwothreefourfivesixseveneightnine"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->mpm_matcher = MPM_AC_BS; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"onetwothreefourfivesixseveneightnine\"; fast_pattern:3,3; sid:2;)"); if (de_ctx->sig_list->next == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) != 1) { printf("if (PacketAlertCheck(p, 1) != 1) failure\n"); goto end; } if (PacketAlertCheck(p, 2) != 1) { printf("if (PacketAlertCheck(p, 1) != 2) failure\n"); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void SCACBSRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCACBSTest01", SCACBSTest01); UtRegisterTest("SCACBSTest02", SCACBSTest02); UtRegisterTest("SCACBSTest03", SCACBSTest03); UtRegisterTest("SCACBSTest04", SCACBSTest04); UtRegisterTest("SCACBSTest05", SCACBSTest05); UtRegisterTest("SCACBSTest06", SCACBSTest06); UtRegisterTest("SCACBSTest07", SCACBSTest07); UtRegisterTest("SCACBSTest08", SCACBSTest08); UtRegisterTest("SCACBSTest09", SCACBSTest09); UtRegisterTest("SCACBSTest10", SCACBSTest10); UtRegisterTest("SCACBSTest11", SCACBSTest11); UtRegisterTest("SCACBSTest12", SCACBSTest12); UtRegisterTest("SCACBSTest13", SCACBSTest13); UtRegisterTest("SCACBSTest14", SCACBSTest14); UtRegisterTest("SCACBSTest15", SCACBSTest15); UtRegisterTest("SCACBSTest16", SCACBSTest16); UtRegisterTest("SCACBSTest17", SCACBSTest17); UtRegisterTest("SCACBSTest18", SCACBSTest18); UtRegisterTest("SCACBSTest19", SCACBSTest19); UtRegisterTest("SCACBSTest20", SCACBSTest20); UtRegisterTest("SCACBSTest21", SCACBSTest21); UtRegisterTest("SCACBSTest22", SCACBSTest22); UtRegisterTest("SCACBSTest23", SCACBSTest23); UtRegisterTest("SCACBSTest24", SCACBSTest24); UtRegisterTest("SCACBSTest25", SCACBSTest25); UtRegisterTest("SCACBSTest26", SCACBSTest26); UtRegisterTest("SCACBSTest27", SCACBSTest27); UtRegisterTest("SCACBSTest28", SCACBSTest28); UtRegisterTest("SCACBSTest29", SCACBSTest29); UtRegisterTest("SCACBSTest30", SCACBSTest30); #endif return; } suricata-3.2.1/src/pkt-var.c0000644000000000000000000000620713051004444012536 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements per packet vars * * \todo move away from a linked list implementation * \todo use different datatypes, such as string, int, etc. * \todo have more than one instance of the same var, and be able to match on a * specific one, or one all at a time. So if a certain capture matches * multiple times, we can operate on all of them. */ #include "suricata-common.h" #include "decode.h" #include "pkt-var.h" #include "util-debug.h" /* puts a new value into a pktvar */ void PktVarUpdate(PktVar *pv, uint8_t *value, uint16_t size) { if (pv->value) SCFree(pv->value); pv->value = value; pv->value_len = size; } /* get the pktvar with name 'name' from the pkt * * name is a normal string*/ PktVar *PktVarGet(Packet *p, const char *name) { PktVar *pv = p->pktvar; for (;pv != NULL; pv = pv->next) { if (pv->name && strcmp(pv->name, name) == 0) return pv; } return NULL; } /* add a pktvar to the pkt, or update it */ void PktVarAdd(Packet *p, const char *name, uint8_t *value, uint16_t size) { //printf("Adding packet var \"%s\" with value(%" PRId32 ") \"%s\"\n", name, size, value); PktVar *pv = PktVarGet(p, name); if (pv == NULL) { pv = SCMalloc(sizeof(PktVar)); if (unlikely(pv == NULL)) return; pv->name = name; pv->value = value; pv->value_len = size; pv->next = NULL; PktVar *tpv = p->pktvar; if (p->pktvar == NULL) p->pktvar = pv; else { while(tpv) { if (tpv->next == NULL) { tpv->next = pv; return; } tpv = tpv->next; } } } else { PktVarUpdate(pv, value, size); } } void PktVarFree(PktVar *pv) { if (pv == NULL) return; pv->name = NULL; if (pv->value != NULL) SCFree(pv->value); PktVar *pv_next = pv->next; SCFree(pv); if (pv_next != NULL) PktVarFree(pv_next); } void PktVarPrint(PktVar *pv) { uint16_t i; if (pv == NULL) return; printf("Name \"%s\", Value \"", pv->name); for (i = 0; i < pv->value_len; i++) { if (isprint(pv->value[i])) printf("%c", pv->value[i]); else printf("\\%02X", pv->value[i]); } printf("\", Len \"%" PRIu32 "\"\n", pv->value_len); PktVarPrint(pv->next); } suricata-3.2.1/src/detect-http-stat-code.c0000644000000000000000000005032013051004444015253 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** * \file * * \author Gurvinder Singh * \author Anoop Saldanha * * Implements the http_stat_code keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-content.h" #include "detect-pcre.h" #include "detect-engine-mpm.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-error.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-spm.h" #include "util-print.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "detect-http-stat-code.h" #include "detect-engine-hscd.h" #include "stream-tcp-private.h" #include "stream-tcp.h" int DetectHttpStatCodeMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t , void *, Signature *, SigMatch *); static int DetectHttpStatCodeSetup(DetectEngineCtx *, Signature *, char *); void DetectHttpStatCodeRegisterTests(void); void DetectHttpStatCodeFree(void *); /** * \brief Registration function for keyword: http_stat_code */ void DetectHttpStatCodeRegister (void) { sigmatch_table[DETECT_AL_HTTP_STAT_CODE].name = "http_stat_code"; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].desc = "content modifier to match only on HTTP stat-code-buffer"; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_stat-code"; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Match = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Setup = DetectHttpStatCodeSetup; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].Free = NULL; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].RegisterTests = DetectHttpStatCodeRegisterTests; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_stat_code", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSCDMATCH, 4, PrefilterTxHttpStatCodeRegister); DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSCDMATCH, DetectEngineInspectHttpStatCode); } /** * \brief this function setups the http_stat_code modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success * \retval -1 On failure */ static int DetectHttpStatCodeSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) { return DetectEngineContentModifierBufferSetup(de_ctx, s, arg, DETECT_AL_HTTP_STAT_CODE, DETECT_SM_LIST_HSCDMATCH, ALPROTO_HTTP, NULL); } #ifdef UNITTESTS /** * \test Checks if a http_stat_code is registered in a Signature, if content is not * specified in the signature or rawbyes is specified or fast_pattern is * provided in the signature. */ int DetectHttpStatCodeTest01(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; if ((de_ctx = DetectEngineCtxInit()) == NULL) { printf("DetectEngineCtxInit failed: "); goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_code\"; http_stat_code; sid:1;)"); if (de_ctx->sig_list != NULL) { printf("sid 1 parse failed to error out: "); goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_code\"; content:\"|FF F1|\";" " rawbytes; http_stat_code; sid:2;)"); if (de_ctx->sig_list != NULL) { printf("sid 2 parse failed to error out: "); goto end; } de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_code\"; content:\"100\";" "fast_pattern; http_stat_code; sid:3;)"); if (de_ctx->sig_list == NULL) { printf("sid 3 parse failed: "); goto end; } if (!(((DetectContentData *)de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)) { goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Checks if a http_stat_code is registered in a Signature and also checks * the nocase */ int DetectHttpStatCodeTest02(void) { SigMatch *sm = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; if ( (de_ctx = DetectEngineCtxInit()) == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing http_stat_code\"; content:\"one\"; " "http_stat_code; content:\"200\"; http_stat_code; " "content:\"two hundred\"; nocase; http_stat_code; " "sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_HSCDMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; } SigMatch *prev = NULL; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { result = 1; } else { printf("expected DETECT_CONTENT for http_stat_code, got %d: ", sm->type); goto end; } prev = sm; sm = sm->next; } if (! (((DetectContentData *)prev->ctx)->flags & DETECT_CONTENT_NOCASE)) { result = 0; } end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** \test Check the signature working to alert when http_stat_code is matched . */ static int DetectHttpStatCodeSigTest01(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("DetectEngineCtxInit failed: "); goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status code\"; content:\"200\"; http_stat_code; sid:1;)"); if (s == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_stat_code is not matched . */ static int DetectHttpStatCodeSigTest02(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status code\"; content:\"no\"; " "http_stat_code; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "Status code\"; content:\"100\";" "http_stat_code; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't: "); goto end; } if ((PacketAlertCheck(p, 2))) { printf("sid 2 match but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_stat_code is matched for * for nocase or not */ static int DetectHttpStatCodeSigTest03(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 FAIL OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status code\"; content:\"FAIL\"; " "http_stat_code; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "Status code nocase\"; content:\"fail\"; nocase; " "http_stat_code; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } /** \test Check the signature working to alert when http_stat_code is matched for * for negatoin or not */ static int DetectHttpStatCodeSigTest04(void) { int result = 0; Flow f; uint8_t httpbuf1[] = "POST / HTTP/1.0\r\nUser-Agent: Mozilla/1.0\r\n\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "HTTP/1.0 200 OK\r\n\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOCLIENT; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any (msg:" "\"HTTP status code\"; content:\"200\"; " "http_stat_code; sid:1;)"); if (s == NULL) { goto end; } s->next = SigInit(de_ctx,"alert http any any -> any any (msg:\"HTTP " "Status code negation\"; content:!\"100\"; nocase; " "http_stat_code; sid:2;)"); if (s->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2); if (r != 0) { printf("toclient chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } if (!(PacketAlertCheck(p, 2))) { printf("sid 2 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); } StreamTcpFreeConfig(TRUE); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ /** * \brief Register the UNITTESTS for the http_stat_code keyword */ void DetectHttpStatCodeRegisterTests (void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectHttpStatCodeTest01", DetectHttpStatCodeTest01); UtRegisterTest("DetectHttpStatCodeTest02", DetectHttpStatCodeTest02); UtRegisterTest("DetectHttpStatCodeSigTest01", DetectHttpStatCodeSigTest01); UtRegisterTest("DetectHttpStatCodeSigTest02", DetectHttpStatCodeSigTest02); UtRegisterTest("DetectHttpStatCodeSigTest03", DetectHttpStatCodeSigTest03); UtRegisterTest("DetectHttpStatCodeSigTest04", DetectHttpStatCodeSigTest04); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-mark.h0000644000000000000000000000271213051004444013354 00000000000000/* Copyright (C) 2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond * * Based on detect-mark.h by Breno Silva * * Implements the nfq_set_mark keyword */ #ifndef __DETECT_MARK_H__ #define __DETECT_MARK_H__ #include "decode.h" #include "detect.h" /** * \struct DetectMarkData_ * DetectMarkData_ is used to store nfq_set_mark: input value */ /** * \typedef DetectMarkData * A typedef for DetectMarkData_ */ typedef struct DetectMarkData_ { uint32_t mark; /**< Rule mark */ uint32_t mask; /**< Rule mask */ } DetectMarkData; /** * Registration function for nfq_set_mark: keyword */ void DetectMarkRegister (void); /** * This function registers unit tests for Mark */ void MarkRegisterTests(void); #endif /*__DETECT_MARK_H__ */ suricata-3.2.1/src/detect-engine-enip.c0000644000000000000000000002663613051004444014626 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Kevin Wong * * Based on detect-engine-modbus.c */ #include "suricata-common.h" #include "app-layer.h" #include "detect.h" #include "detect-cipservice.h" #include "detect-engine-enip.h" #include "flow.h" #include "util-debug.h" #if 0 /** * \brief Print fields from ENIP Packet * @param enip_data */ void PrintENIPAL(ENIPTransaction *enip_data) { SCLogDebug("============================================"); SCLogDebug("ENCAP HEADER cmd 0x%x, length %d, session 0x%x, status 0x%x", enip_data->header.command, enip_data->header.length, enip_data->header.session, enip_data->header.status); //SCLogDebug("context 0x%x option 0x%x", enip_data->header.context, enip_data->header.option); SCLogDebug("ENCAP DATA HEADER handle 0x%x, timeout %d, count %d", enip_data->encap_data_header.interface_handle, enip_data->encap_data_header.timeout, enip_data->encap_data_header.item_count); SCLogDebug("ENCAP ADDR ITEM type 0x%x, length %d", enip_data->encap_addr_item.type, enip_data->encap_addr_item.length); SCLogDebug("ENCAP DATA ITEM type 0x%x, length %d sequence 0x%x", enip_data->encap_data_item.type, enip_data->encap_data_item.length, enip_data->encap_data_item.sequence_count); CIPServiceEntry *svc = NULL; int count = 0; TAILQ_FOREACH(svc, &enip_data->service_list, next) { //SCLogDebug("CIP Service #%d : 0x%x", count, svc->service); count++; } } #endif /** * \brief Matches the rule to the CIP segment in ENIP Packet * @param svc - the CIP service entry * * @param cipserviced - the CIP service rule */ int CIPPathMatch(CIPServiceEntry *svc, DetectCipServiceData *cipserviced) { uint16_t class = 0; uint16_t attrib = 0; int found_class = 0; SegmentEntry *seg = NULL; TAILQ_FOREACH(seg, &svc->segment_list, next) { switch(seg->segment) { case PATH_CLASS_8BIT: class = seg->value; if (cipserviced->cipclass == class) { if (cipserviced->tokens == 2) {// if rule only has class return 1; } else { found_class = 1; } } break; case PATH_INSTANCE_8BIT: break; case PATH_ATTR_8BIT: //single attribute attrib = seg->value; if ((cipserviced->tokens == 3) && (cipserviced->cipclass == class) && (cipserviced->cipattribute == attrib) && (cipserviced->matchattribute == 1)) { // if rule has class & attribute, matched all here return 1; } if ((cipserviced->tokens == 3) && (cipserviced->cipclass == class) && (cipserviced->matchattribute == 0)) { // for negation rule on attribute return 1; } break; case PATH_CLASS_16BIT: class = seg->value; if (cipserviced->cipclass == class) { if (cipserviced->tokens == 2) {// if rule only has class return 1; } else { found_class = 1; } } break; case PATH_INSTANCE_16BIT: break; default: return 0; } } if (found_class == 0) { // if haven't matched class yet, no need to check attribute return 0; } if ((svc->service == CIP_SET_ATTR_LIST) || (svc->service == CIP_GET_ATTR_LIST)) { AttributeEntry *attr = NULL; TAILQ_FOREACH (attr, &svc->attrib_list, next) { if (cipserviced->cipattribute == attr->attribute) { return 1; } } } return 0; } /** * \brief Matches the rule to the ENIP Transaction * @param enip_data - the ENIP transation * * @param cipserviced - the CIP service rule */ int CIPServiceMatch(ENIPTransaction *enip_data, DetectCipServiceData *cipserviced) { int count = 1; CIPServiceEntry *svc = NULL; //SCLogDebug("CIPServiceMatchAL"); TAILQ_FOREACH(svc, &enip_data->service_list, next) { SCLogDebug("CIPServiceMatchAL service #%d : 0x%x dir %d", count, svc->service, svc->direction); if (cipserviced->cipservice == svc->service) { // compare service //SCLogDebug("Rule Match for cip service %d",cipserviced->cipservice ); if (cipserviced->tokens > 1) { //if rule params have class and attribute if ((svc->service == CIP_SET_ATTR_LIST) || (svc->service == CIP_SET_ATTR_SINGLE) || (svc->service == CIP_GET_ATTR_LIST) || (svc->service == CIP_GET_ATTR_SINGLE)) { //decode path if (CIPPathMatch(svc, cipserviced) == 1) { if (svc->direction == 1) return 0; //don't match responses return 1; } } } else { if (svc->direction == 1) return 0; //don't match responses // SCLogDebug("CIPServiceMatchAL found"); return 1; } } count++; } return 0; } /** \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect ( and sm: SigMatch to inspect) * \param f Flow * \param flags App layer flags * \param alstate App layer state * \param txv Pointer to ENIP Transaction structure * * \retval 0 no match or 1 match */ int DetectEngineInspectCIP(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { SCEnter(); ENIPTransaction *tx = (ENIPTransaction *) txv; SigMatch *sm = s->sm_lists[DETECT_SM_LIST_CIP_MATCH]; DetectCipServiceData *cipserviced = (DetectCipServiceData *) sm->ctx; if (cipserviced == NULL) { SCLogDebug("no cipservice state, no match"); SCReturnInt(0); } //SCLogDebug("DetectEngineInspectCIP %d", cipserviced->cipservice); if (CIPServiceMatch(tx, cipserviced) == 1) { //SCLogDebug("DetectCIPServiceMatchAL found"); SCReturnInt(1); } SCReturnInt(0); } /** \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect ( and sm: SigMatch to inspect) * \param f Flow * \param flags App layer flags * \param alstate App layer state * \param txv Pointer to ENIP Transaction structure * * \retval 0 no match or 1 match */ int DetectEngineInspectENIP(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { SCEnter(); ENIPTransaction *tx = (ENIPTransaction *) txv; SigMatch *sm = s->sm_lists[DETECT_SM_LIST_ENIP_MATCH]; DetectEnipCommandData *enipcmdd = (DetectEnipCommandData *) sm->ctx; if (enipcmdd == NULL) { SCLogDebug("no enipcommand state, no match"); SCReturnInt(0); } //SCLogDebug("DetectEngineInspectENIP %d, %d", enipcmdd->enipcommand, tx->header.command); if (enipcmdd->enipcommand == tx->header.command) { // SCLogDebug("DetectENIPCommandMatchAL found!"); SCReturnInt(1); } SCReturnInt(0); } #ifdef UNITTESTS /* UNITTESTS */ #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "flow-util.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" static uint8_t listIdentity[] = {/* List ID */ 0x00, 0x63, /* Length */ 0x00, 0x00, /* Session */ 0x00, 0x00, 0x00, 0x00, /* Status */ 0x00, 0x00, 0x00, 0x00, /* Delay*/ 0x00, /* Context */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* Quantity of coils */ 0x00, 0x00, 0x00, 0x00,}; /** \test Test code function. */ static int DetectEngineInspectENIPTest01(void) { AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; Flow f; Packet *p = NULL; Signature *s = NULL; TcpSession ssn; ThreadVars tv; memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(listIdentity, sizeof(listIdentity), IPPROTO_TCP); FAIL_IF_NULL(p); FLOW_INITIALIZE(&f); f.alproto = ALPROTO_ENIP; f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert enip any any -> any any " "(msg:\"Testing enip command\"; " "enipcommand:99 ; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_ENIP, STREAM_TOSERVER, listIdentity, sizeof(listIdentity)); FAIL_IF(r != 0); ENIPState *enip_state = f.alstate; FAIL_IF_NULL(enip_state); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF(!(PacketAlertCheck(p, 1))); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } #endif /* UNITTESTS */ void DetectEngineInspectENIPRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineInspectENIPTest01", DetectEngineInspectENIPTest01); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/host-queue.c0000644000000000000000000000555013051004444013251 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Host queue handler functions */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "host-queue.h" #include "util-error.h" #include "util-debug.h" #include "util-print.h" HostQueue *HostQueueInit (HostQueue *q) { if (q != NULL) { memset(q, 0, sizeof(HostQueue)); HQLOCK_INIT(q); } return q; } HostQueue *HostQueueNew() { HostQueue *q = (HostQueue *)SCMalloc(sizeof(HostQueue)); if (q == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in HostQueueNew. Exiting..."); exit(EXIT_SUCCESS); } q = HostQueueInit(q); return q; } /** * \brief Destroy a host queue * * \param q the host queue to destroy */ void HostQueueDestroy (HostQueue *q) { HQLOCK_DESTROY(q); } /** * \brief add a host to a queue * * \param q queue * \param h host */ void HostEnqueue (HostQueue *q, Host *h) { #ifdef DEBUG BUG_ON(q == NULL || h == NULL); #endif HQLOCK_LOCK(q); /* more hosts in queue */ if (q->top != NULL) { h->lnext = q->top; q->top->lprev = h; q->top = h; /* only host */ } else { q->top = h; q->bot = h; } q->len++; #ifdef DBG_PERF if (q->len > q->dbg_maxlen) q->dbg_maxlen = q->len; #endif /* DBG_PERF */ HQLOCK_UNLOCK(q); } /** * \brief remove a host from the queue * * \param q queue * * \retval h host or NULL if empty list. */ Host *HostDequeue (HostQueue *q) { HQLOCK_LOCK(q); Host *h = q->bot; if (h == NULL) { HQLOCK_UNLOCK(q); return NULL; } /* more packets in queue */ if (q->bot->lprev != NULL) { q->bot = q->bot->lprev; q->bot->lnext = NULL; /* just the one we remove, so now empty */ } else { q->top = NULL; q->bot = NULL; } #ifdef DEBUG BUG_ON(q->len == 0); #endif if (q->len > 0) q->len--; h->lnext = NULL; h->lprev = NULL; HQLOCK_UNLOCK(q); return h; } uint32_t HostQueueLen(HostQueue *q) { uint32_t len; HQLOCK_LOCK(q); len = q->len; HQLOCK_UNLOCK(q); return len; } suricata-3.2.1/src/output-flow.h0000644000000000000000000000331013051004444013454 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Flow Logger Output registration functions */ #ifndef __OUTPUT_FLOW_H__ #define __OUTPUT_FLOW_H__ #include "decode.h" /** flow logger function pointer type */ typedef int (*FlowLogger)(ThreadVars *, void *thread_data, Flow *f); /** packet logger condition function pointer type, * must return true for packets that should be logged */ //typedef int (*TxLogCondition)(ThreadVars *, const Packet *); int OutputRegisterFlowLogger(const char *name, FlowLogger LogFunc, OutputCtx *, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats); void OutputFlowShutdown(void); TmEcode OutputFlowLog(ThreadVars *tv, void *thread_data, Flow *f); TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data); TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data); void OutputFlowLogExitPrintStats(ThreadVars *tv, void *thread_data); #endif /* __OUTPUT_FLOW_H__ */ suricata-3.2.1/src/util-reference-config.c0000644000000000000000000005504213051004444015327 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "detect.h" #include "detect-engine.h" #include "util-hash.h" #include "util-reference-config.h" #include "conf.h" #include "util-unittest.h" #include "util-error.h" #include "util-debug.h" #include "util-fmemopen.h" /* Regex to parse each line from reference.config file. The first substring * is for the system name and the second for the url */ /*-----------------------------------------------------------system-------------------url----*/ #define SC_RCONF_REGEX "^\\s*config\\s+reference\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s+(.+)\\s*$" /* Default path for the reference.conf file */ #define SC_RCONF_DEFAULT_FILE_PATH CONFIG_DIR "/reference.config" static pcre *regex = NULL; static pcre_extra *regex_study = NULL; /* the hash functions */ uint32_t SCRConfReferenceHashFunc(HashTable *ht, void *data, uint16_t datalen); char SCRConfReferenceHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2); void SCRConfReferenceHashFree(void *ch); /* used to get the reference.config file path */ static char *SCRConfGetConfFilename(const DetectEngineCtx *de_ctx); void SCReferenceConfInit(void) { const char *eb = NULL; int eo; int opts = 0; regex = pcre_compile(SC_RCONF_REGEX, opts, &eb, &eo, NULL); if (regex == NULL) { SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s", SC_RCONF_REGEX, eo, eb); return; } regex_study = pcre_study(regex, 0, &eb); if (eb != NULL) { pcre_free(regex); regex = NULL; SCLogDebug("pcre study failed: %s", eb); return; } return; } void SCReferenceConfDeinit(void) { if (regex != NULL) { pcre_free(regex); regex = NULL; } if (regex_study != NULL) { pcre_free(regex_study); regex_study = NULL; } } /** * \brief Inits the context to be used by the Reference Config parsing API. * * This function initializes the hash table to be used by the Detection * Engine Context to hold the data from reference.config file, * obtains the file descriptor to parse the reference.config file, and * inits the regex used to parse the lines from reference.config file. * * \param de_ctx Pointer to the Detection Engine Context. * * \retval 0 On success. * \retval -1 On failure. */ static FILE *SCRConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FILE *fd) { char *filename = NULL; /* init the hash table to be used by the reference config references */ de_ctx->reference_conf_ht = HashTableInit(128, SCRConfReferenceHashFunc, SCRConfReferenceHashCompareFunc, SCRConfReferenceHashFree); if (de_ctx->reference_conf_ht == NULL) { SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash " "table"); goto error; } /* if it is not NULL, use the file descriptor. The hack so that we can * avoid using a dummy reference file for testing purposes and * instead use an input stream against a buffer containing the * reference strings */ if (fd == NULL) { filename = SCRConfGetConfFilename(de_ctx); if ((fd = fopen(filename, "r")) == NULL) { #ifdef UNITTESTS if (RunmodeIsUnittests()) goto error; // silently fail #endif SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno)); goto error; } } return fd; error: if (de_ctx->reference_conf_ht != NULL) { HashTableFree(de_ctx->reference_conf_ht); de_ctx->reference_conf_ht = NULL; } if (fd != NULL) { fclose(fd); fd = NULL; } return NULL; } /** * \brief Returns the path for the Reference Config file. We check if we * can retrieve the path from the yaml conf file. If it is not present, * return the default path for the reference.config file which is * "./reference.config". * * \retval log_filename Pointer to a string containing the path for the * reference.config file. */ static char *SCRConfGetConfFilename(const DetectEngineCtx *de_ctx) { char *path = NULL; if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) { char config_value[256]; snprintf(config_value, sizeof(config_value), "%s.reference-config-file", de_ctx->config_prefix); /* try loading prefix setting, fall back to global if that * fails. */ if (ConfGet(config_value, &path) != 1) { if (ConfGet("reference-config-file", &path) != 1) { return (char *)SC_RCONF_DEFAULT_FILE_PATH; } } } else { if (ConfGet("reference-config-file", &path) != 1) { return (char *)SC_RCONF_DEFAULT_FILE_PATH; } } return path; } /** * \brief Releases local resources used by the Reference Config API. */ static void SCRConfDeInitLocalResources(DetectEngineCtx *de_ctx, FILE *fd) { if (fd != NULL) { fclose(fd); fd = NULL; } return; } /** * \brief Releases de_ctx resources related to Reference Config API. */ void SCRConfDeInitContext(DetectEngineCtx *de_ctx) { if (de_ctx->reference_conf_ht != NULL) HashTableFree(de_ctx->reference_conf_ht); de_ctx->reference_conf_ht = NULL; return; } /** * \brief Converts a string to lowercase. * * \param str Pointer to the string to be converted. */ static char *SCRConfStringToLowercase(const char *str) { char *new_str = NULL; char *temp_str = NULL; if ((new_str = SCStrdup(str)) == NULL) { return NULL; } temp_str = new_str; while (*temp_str != '\0') { *temp_str = tolower((unsigned char)*temp_str); temp_str++; } return new_str; } /** * \brief Parses a line from the reference config file and adds it to Reference * Config hash table DetectEngineCtx->reference_conf_ht. * * \param rawstr Pointer to the string to be parsed. * \param de_ctx Pointer to the Detection Engine Context. * * \retval 0 On success. * \retval -1 On failure. */ static int SCRConfAddReference(char *rawstr, DetectEngineCtx *de_ctx) { char system[64]; char url[1024]; SCRConfReference *ref_new = NULL; SCRConfReference *ref_lookup = NULL; #define MAX_SUBSTRINGS 30 int ret = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30); if (ret < 0) { SCLogError(SC_ERR_REFERENCE_CONFIG, "Invalid Reference Config in " "reference.config file"); goto error; } /* retrieve the reference system */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 1, system, sizeof(system)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring() failed"); goto error; } /* retrieve the reference url */ ret = pcre_copy_substring((char *)rawstr, ov, 30, 2, url, sizeof(url)); if (ret < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring() failed"); goto error; } /* Create a new instance of the parsed Reference string */ ref_new = SCRConfAllocSCRConfReference(system, url); if (ref_new == NULL) goto error; /* Check if the Reference is present in the HashTable. In case it's present * ignore it, as it's a duplicate. If not present, add it to the table */ ref_lookup = HashTableLookup(de_ctx->reference_conf_ht, ref_new, 0); if (ref_lookup == NULL) { if (HashTableAdd(de_ctx->reference_conf_ht, ref_new, 0) < 0) { SCLogDebug("HashTable Add failed"); } } else { SCLogDebug("Duplicate reference found inside reference.config"); SCRConfDeAllocSCRConfReference(ref_new); } return 0; error: return -1; } /** * \brief Checks if a string is a comment or a blank line. * * Comments lines are lines of the following format - * "# This is a comment string" or * " # This is a comment string". * * \param line String that has to be checked. * * \retval 1 On the argument string being a comment or blank line. * \retval 0 Otherwise. */ static int SCRConfIsLineBlankOrComment(char *line) { while (*line != '\0') { /* we have a comment */ if (*line == '#') return 1; /* this line is neither a comment line, nor a blank line */ if (!isspace((unsigned char)*line)) return 0; line++; } /* we have a blank line */ return 1; } /** * \brief Parses the Reference Config file and updates the * DetectionEngineCtx->reference_conf_ht with the Reference information. * * \param de_ctx Pointer to the Detection Engine Context. */ static void SCRConfParseFile(DetectEngineCtx *de_ctx, FILE *fd) { char line[1024]; uint8_t i = 1; while (fgets(line, sizeof(line), fd) != NULL) { if (SCRConfIsLineBlankOrComment(line)) continue; SCRConfAddReference(line, de_ctx); i++; } #ifdef UNITTESTS SCLogInfo("Added \"%d\" reference types from the reference.config file", de_ctx->reference_conf_ht->count); #endif /* UNITTESTS */ return; } /** * \brief Returns a new SCRConfReference instance. The reference string * is converted into lowercase, before being assigned to the instance. * * \param system Pointer to the system. * \param url Pointer to the reference url. * * \retval ref Pointer to the new instance of SCRConfReference. */ SCRConfReference *SCRConfAllocSCRConfReference(const char *system, const char *url) { SCRConfReference *ref = NULL; if (system == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid arguments. system NULL"); return NULL; } if ((ref = SCMalloc(sizeof(SCRConfReference))) == NULL) { return NULL; } memset(ref, 0, sizeof(SCRConfReference)); if ((ref->system = SCRConfStringToLowercase(system)) == NULL) { SCFree(ref); return NULL; } if (url != NULL && (ref->url = SCStrdup(url)) == NULL) { SCFree(ref->system); SCFree(ref); return NULL; } return ref; } /** * \brief Frees a SCRConfReference instance. * * \param Pointer to the SCRConfReference instance that has to be freed. */ void SCRConfDeAllocSCRConfReference(SCRConfReference *ref) { if (ref != NULL) { if (ref->system != NULL) SCFree(ref->system); if (ref->url != NULL) SCFree(ref->url); SCFree(ref); } return; } /** * \brief Hashing function to be used to hash the Reference name. Would be * supplied as an argument to the HashTableInit function for * DetectEngineCtx->reference_conf_ht. * * \param ht Pointer to the HashTable. * \param data Pointer to the data to be hashed. In this case, the data * would be a pointer to a SCRConfReference instance. * \param datalen Not used by this function. */ uint32_t SCRConfReferenceHashFunc(HashTable *ht, void *data, uint16_t datalen) { SCRConfReference *ref = (SCRConfReference *)data; uint32_t hash = 0; int i = 0; int len = strlen(ref->system); for (i = 0; i < len; i++) hash += tolower((unsigned char)ref->system[i]); hash = hash % ht->array_size; return hash; } /** * \brief Used to compare two References that have been stored in the HashTable. * This function is supplied as an argument to the HashTableInit function * for DetectionEngineCtx->reference_conf_ct. * * \param data1 Pointer to the first SCRConfReference to be compared. * \param len1 Not used by this function. * \param data2 Pointer to the second SCRConfReference to be compared. * \param len2 Not used by this function. * * \retval 1 On data1 and data2 being equal. * \retval 0 On data1 and data2 not being equal. */ char SCRConfReferenceHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2) { SCRConfReference *ref1 = (SCRConfReference *)data1; SCRConfReference *ref2 = (SCRConfReference *)data2; int len1 = 0; int len2 = 0; if (ref1 == NULL || ref2 == NULL) return 0; if (ref1->system == NULL || ref2->system == NULL) return 0; len1 = strlen(ref1->system); len2 = strlen(ref2->system); if (len1 == len2 && memcmp(ref1->system, ref2->system, len1) == 0) { SCLogDebug("Match found inside Reference-Config hash function"); return 1; } return 0; } /** * \brief Used to free the Reference Config Hash Data that was stored in * DetectEngineCtx->reference_conf_ht Hashtable. * * \param data Pointer to the data that has to be freed. */ void SCRConfReferenceHashFree(void *data) { SCRConfDeAllocSCRConfReference(data); return; } /** * \brief Loads the Reference info from the reference.config file. * * The reference.config file contains references that can be used in * Signatures. Each line of the file should have the following format - * config reference: system_name, reference_url. * * \param de_ctx Pointer to the Detection Engine Context that should be updated * with reference information. * * \retval 0 On success. * \retval -1 On failure. */ int SCRConfLoadReferenceConfigFile(DetectEngineCtx *de_ctx, FILE *fd) { fd = SCRConfInitContextAndLocalResources(de_ctx, fd); if (fd == NULL) { #ifdef UNITTESTS if (RunmodeIsUnittests() && fd == NULL) { return -1; } #endif SCLogError(SC_ERR_OPENING_FILE, "please check the \"reference-config-file\" " "option in your suricata.yaml file"); return -1; } SCRConfParseFile(de_ctx, fd); SCRConfDeInitLocalResources(de_ctx, fd); return 0; } /** * \brief Gets the refernce config from the corresponding hash table stored * in the Detection Engine Context's reference conf ht, given the * reference name. * * \param ct_name Pointer to the reference name that has to be looked up. * \param de_ctx Pointer to the Detection Engine Context. * * \retval lookup_rconf_info Pointer to the SCRConfReference instance from * the hash table on success; NULL on failure. */ SCRConfReference *SCRConfGetReference(const char *rconf_name, DetectEngineCtx *de_ctx) { SCRConfReference *ref_conf = SCRConfAllocSCRConfReference(rconf_name, NULL); if (ref_conf == NULL) return NULL; SCRConfReference *lookup_ref_conf = HashTableLookup(de_ctx->reference_conf_ht, ref_conf, 0); SCRConfDeAllocSCRConfReference(ref_conf); return lookup_ref_conf; } /*----------------------------------Unittests---------------------------------*/ #ifdef UNITTESTS /** * \brief Creates a dummy reference config, with all valid references, for * testing purposes. */ FILE *SCRConfGenerateValidDummyReferenceConfigFD01(void) { const char *buffer = "config reference: one http://www.one.com\n" "config reference: two http://www.two.com\n" "config reference: three http://www.three.com\n" "config reference: one http://www.one.com\n" "config reference: three http://www.three.com\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Reference Config test code"); return fd; } /** * \brief Creates a dummy reference config, with some valid references and a * couple of invalid references, for testing purposes. */ FILE *SCRConfGenerateInValidDummyReferenceConfigFD02(void) { const char *buffer = "config reference: one http://www.one.com\n" "config_ reference: two http://www.two.com\n" "config reference_: three http://www.three.com\n" "config reference: four\n" "config reference five http://www.five.com\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Reference Config test code"); return fd; } /** * \brief Creates a dummy reference config, with all invalid references, for * testing purposes. */ FILE *SCRConfGenerateInValidDummyReferenceConfigFD03(void) { const char *buffer = "config reference one http://www.one.com\n" "config_ reference: two http://www.two.com\n" "config reference_: three http://www.three.com\n" "config reference: four\n"; FILE *fd = SCFmemopen((void *)buffer, strlen(buffer), "r"); if (fd == NULL) SCLogDebug("Error with SCFmemopen() called by Reference Config test code"); return fd; } /** * \test Check that the reference file is loaded and the detection engine * content reference_conf_ht loaded with the reference data. */ int SCRConfTest01(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCRConfGenerateValidDummyReferenceConfigFD01(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 3); if (result == 0) printf("FAILED: de_ctx->reference_conf_ht->count %u: ", de_ctx->reference_conf_ht->count); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check that invalid references present in the reference.config file * aren't loaded. */ int SCRConfTest02(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCRConfGenerateInValidDummyReferenceConfigFD03(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 0); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check that only valid references are loaded into the hash table from * the reference.config file. */ int SCRConfTest03(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 0; if (de_ctx == NULL) return result; FILE *fd = SCRConfGenerateInValidDummyReferenceConfigFD02(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 1); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the reference info from the reference.config file have * been loaded into the hash table. */ int SCRConfTest04(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCRConfGenerateValidDummyReferenceConfigFD01(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 3); result &= (SCRConfGetReference("one", de_ctx) != NULL); result &= (SCRConfGetReference("two", de_ctx) != NULL); result &= (SCRConfGetReference("three", de_ctx) != NULL); result &= (SCRConfGetReference("four", de_ctx) == NULL); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the reference info from the invalid reference.config file * have not been loaded into the hash table, and cross verify to check * that the hash table contains no reference data. */ int SCRConfTest05(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCRConfGenerateInValidDummyReferenceConfigFD03(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 0); result &= (SCRConfGetReference("one", de_ctx) == NULL); result &= (SCRConfGetReference("two", de_ctx) == NULL); result &= (SCRConfGetReference("three", de_ctx) == NULL); result &= (SCRConfGetReference("four", de_ctx) == NULL); result &= (SCRConfGetReference("five", de_ctx) == NULL); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Check if the reference info from the reference.config file have * been loaded into the hash table. */ int SCRConfTest06(void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); int result = 1; if (de_ctx == NULL) return 0; FILE *fd = SCRConfGenerateInValidDummyReferenceConfigFD02(); SCRConfLoadReferenceConfigFile(de_ctx, fd); if (de_ctx->reference_conf_ht == NULL) goto end; result = (de_ctx->reference_conf_ht->count == 1); result &= (SCRConfGetReference("one", de_ctx) != NULL); result &= (SCRConfGetReference("two", de_ctx) == NULL); result &= (SCRConfGetReference("three", de_ctx) == NULL); result &= (SCRConfGetReference("four", de_ctx) == NULL); result &= (SCRConfGetReference("five", de_ctx) == NULL); end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for Reference Config API. */ void SCRConfRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCRConfTest01", SCRConfTest01); UtRegisterTest("SCRConfTest02", SCRConfTest02); UtRegisterTest("SCRConfTest03", SCRConfTest03); UtRegisterTest("SCRConfTest04", SCRConfTest04); UtRegisterTest("SCRConfTest05", SCRConfTest05); UtRegisterTest("SCRConfTest06", SCRConfTest06); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/util-mem.h0000644000000000000000000002344713051004444012715 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Utility Macros for memory management * * \todo Add wrappers for functions that allocate/free memory here. * Currently we have malloc, calloc, realloc, strdup and free, * but there are more. */ #ifndef __UTIL_MEM_H__ #define __UTIL_MEM_H__ #include "util-atomic.h" #if CPPCHECK==1 #define SCMalloc malloc #define SCCalloc calloc #define SCRealloc realloc #define SCFree free #define SCStrdup strdup #define SCMallocAligned _mm_malloc #define SCFreeAligned _mm_free #else /* CPPCHECK */ #if defined(_WIN32) || defined(__WIN32) #include "mm_malloc.h" #endif #if defined(__tile__) /* Need to define __mm_ function alternatives, since these are SSE only. */ #include #define _mm_malloc(a,b) memalign((b),(a)) #define _mm_free(a) free((a)) #endif /* defined(__tile__) */ SC_ATOMIC_EXTERN(unsigned int, engine_stage); /* Use this only if you want to debug memory allocation and free() * It will log a lot of lines more, so think that is a performance killer */ /* Uncomment this if you want to print memory allocations and free's() */ //#define DBG_MEM_ALLOC #ifdef DBG_MEM_ALLOC /* Uncomment this if you want to print mallocs at the startup (recommended) */ #define DBG_MEM_ALLOC_SKIP_STARTUP #define SCMalloc(a) ({ \ void *ptrmem = NULL; \ extern size_t global_mem; \ extern uint8_t print_mem_flag; \ \ ptrmem = malloc((a)); \ if (ptrmem == NULL && (a) > 0) { \ SCLogError(SC_ERR_MEM_ALLOC, "SCMalloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)(a)); \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ \ global_mem += (a); \ if (print_mem_flag == 1) { \ SCLogInfo("SCMalloc return at %p of size %"PRIuMAX, \ ptrmem, (uintmax_t)(a)); \ } \ (void*)ptrmem; \ }) #define SCRealloc(x, a) ({ \ void *ptrmem = NULL; \ extern size_t global_mem; \ extern uint8_t print_mem_flag; \ \ ptrmem = realloc((x), (a)); \ if (ptrmem == NULL && (a) > 0) { \ SCLogError(SC_ERR_MEM_ALLOC, "SCRealloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)(a)); \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ \ global_mem += (a); \ if (print_mem_flag == 1) { \ SCLogInfo("SCRealloc return at %p (old:%p) of size %"PRIuMAX, \ ptrmem, (x), (uintmax_t)(a)); \ } \ (void*)ptrmem; \ }) #define SCCalloc(nm, a) ({ \ void *ptrmem = NULL; \ extern size_t global_mem; \ extern uint8_t print_mem_flag; \ \ ptrmem = calloc((nm), (a)); \ if (ptrmem == NULL && (a) > 0) { \ SCLogError(SC_ERR_MEM_ALLOC, "SCCalloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)a); \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ \ global_mem += (a)*(nm); \ if (print_mem_flag == 1) { \ SCLogInfo("SCCalloc return at %p of size %"PRIuMAX" (nm) %"PRIuMAX, \ ptrmem, (uintmax_t)(a), (uintmax_t)(nm)); \ } \ (void*)ptrmem; \ }) #define SCStrdup(a) ({ \ char *ptrmem = NULL; \ extern size_t global_mem; \ extern uint8_t print_mem_flag; \ size_t len = strlen((a)); \ \ ptrmem = strdup((a)); \ if (ptrmem == NULL) { \ SCLogError(SC_ERR_MEM_ALLOC, "SCStrdup failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)len); \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ \ global_mem += len; \ if (print_mem_flag == 1) { \ SCLogInfo("SCStrdup return at %p of size %"PRIuMAX, \ ptrmem, (uintmax_t)len); \ } \ (void*)ptrmem; \ }) #define SCFree(a) ({ \ extern uint8_t print_mem_flag; \ if (print_mem_flag == 1) { \ SCLogInfo("SCFree at %p", (a)); \ } \ free((a)); \ }) #else /* !DBG_MEM_ALLOC */ #define SCMalloc(a) ({ \ void *ptrmem = NULL; \ \ ptrmem = malloc((a)); \ if (ptrmem == NULL) { \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ uintmax_t scmalloc_size_ = (uintmax_t)(a); \ SCLogError(SC_ERR_MEM_ALLOC, "SCMalloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), scmalloc_size_); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) #define SCRealloc(x, a) ({ \ void *ptrmem = NULL; \ \ ptrmem = realloc((x), (a)); \ if (ptrmem == NULL) { \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_MEM_ALLOC, "SCRealloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)(a)); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) #define SCCalloc(nm, a) ({ \ void *ptrmem = NULL; \ \ ptrmem = calloc((nm), (a)); \ if (ptrmem == NULL) { \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_MEM_ALLOC, "SCCalloc failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)(a)); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) #define SCStrdup(a) ({ \ char *ptrmem = NULL; \ \ ptrmem = strdup((a)); \ if (ptrmem == NULL) { \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ size_t _scstrdup_len = strlen((a)); \ SCLogError(SC_ERR_MEM_ALLOC, "SCStrdup failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes", strerror(errno), (uintmax_t)_scstrdup_len); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) #define SCFree(a) ({ \ free(a); \ }) #if defined(__WIN32) || defined(_WIN32) /** \brief wrapper for allocing aligned mem * \param a size * \param b alignement */ #define SCMallocAligned(a, b) ({ \ void *ptrmem = NULL; \ \ ptrmem = _mm_malloc((a), (b)); \ if (ptrmem == NULL) { \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_MEM_ALLOC, "SCMallocAligned(posix_memalign) failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes, alignment %"PRIuMAX, strerror(errno), (uintmax_t)(a), (uintmax_t)(b)); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) /** \brief Free aligned memory * * Not needed for mem alloc'd by posix_memalign, * but for possible future use of _mm_malloc needing * _mm_free. */ #define SCFreeAligned(a) ({ \ _mm_free(a); \ }) #else /* !win */ /** \brief wrapper for allocing aligned mem * \param a size * \param b alignement */ #define SCMallocAligned(a, b) ({ \ void *ptrmem = NULL; \ \ int r = posix_memalign(&ptrmem, (b), (a)); \ if (r != 0 || ptrmem == NULL) { \ if (ptrmem != NULL) { \ free(ptrmem); \ ptrmem = NULL; \ } \ if (SC_ATOMIC_GET(engine_stage) == SURICATA_INIT) {\ SCLogError(SC_ERR_MEM_ALLOC, "SCMallocAligned(posix_memalign) failed: %s, while trying " \ "to allocate %"PRIuMAX" bytes, alignment %"PRIuMAX, strerror(errno), (uintmax_t)a, (uintmax_t)b); \ SCLogError(SC_ERR_FATAL, "Out of memory. The engine cannot be initialized. Exiting..."); \ exit(EXIT_FAILURE); \ } \ } \ (void*)ptrmem; \ }) /** \brief Free aligned memory * * Not needed for mem alloc'd by posix_memalign, * but for possible future use of _mm_malloc needing * _mm_free. */ #define SCFreeAligned(a) ({ \ free(a); \ }) #endif /* __WIN32 */ #endif /* DBG_MEM_ALLOC */ #endif /* CPPCHECK */ #endif /* __UTIL_MEM_H__ */ suricata-3.2.1/src/detect-http-cookie.h0000644000000000000000000000207213051004444014647 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gurvinder Singh */ #ifndef _DETECT_HTTP_COOKIE_H #define _DETECT_HTTP_COOKIE_H /* prototypes */ void DetectHttpCookieRegister (void); int DetectHttpCookieDoMatch(DetectEngineThreadCtx *, Signature *, SigMatch *, Flow *, uint8_t, void *); #endif /* _DETECT_HTTP_COOKIE_H */ suricata-3.2.1/src/util-ip.h0000644000000000000000000000204513051004444012536 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Duarte Silva */ #ifndef __UTIL_IP_H__ #define __UTIL_IP_H__ struct in_addr *ValidateIPV4Address(const char *); struct in6_addr *ValidateIPV6Address(const char *); void MaskIPNetblock(uint8_t *, int, int); #endif /* __UTIL_IP_H__ */ suricata-3.2.1/src/util-profiling-locks.c0000644000000000000000000001406613051004444015231 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * An API for profiling locks. * */ #include "suricata-common.h" #include "util-profiling-locks.h" #include "util-hashlist.h" #ifdef PROFILING #ifdef PROFILE_LOCKING __thread ProfilingLock locks[PROFILING_MAX_LOCKS]; __thread int locks_idx = 0; __thread int record_locks = 0; int profiling_locks_enabled = 0; int profiling_locks_output_to_file = 0; char *profiling_locks_file_name = NULL; char *profiling_locks_file_mode = "a"; typedef struct LockRecord_ { char *file; // hash char *func; // info int type; // info int line; // hash uint32_t cont; uint32_t ticks_cnt; uint64_t ticks_total; uint64_t ticks_max; } LockRecord; HashListTable *lock_records; pthread_mutex_t lock_records_mutex; static uint32_t LockRecordHash(HashListTable *ht, void *buf, uint16_t buflen) { LockRecord *fn = (LockRecord *)buf; uint32_t hash = strlen(fn->file) + fn->line; uint16_t u; for (u = 0; u < strlen(fn->file); u++) { hash += fn->file[u]; } return hash % ht->array_size; } static char LockRecordCompare(void *buf1, uint16_t len1, void *buf2, uint16_t len2) { LockRecord *fn1 = (LockRecord *)buf1; LockRecord *fn2 = (LockRecord *)buf2; if (fn1->line != fn2->line) return 0; if (fn1->file == fn2->file) return 1; return 0; } static void LockRecordFree(void *data) { LockRecord *fn = (LockRecord *)data; if (fn == NULL) return; SCFree(fn); } int LockRecordInitHash() { pthread_mutex_init(&lock_records_mutex, NULL); pthread_mutex_lock(&lock_records_mutex); lock_records = HashListTableInit(512, LockRecordHash, LockRecordCompare, LockRecordFree); BUG_ON(lock_records == NULL); pthread_mutex_unlock(&lock_records_mutex); return 0; } void LockRecordAdd(ProfilingLock *l) { LockRecord fn = { NULL, NULL, 0,0,0,0,0,0}, *ptr = &fn; fn.file = l->file; fn.line = l->line; LockRecord *lookup_fn = (LockRecord *)HashListTableLookup(lock_records, (void *)ptr, 0); if (lookup_fn == NULL) { LockRecord *new = SCMalloc(sizeof(LockRecord)); BUG_ON(new == NULL); new->file = l->file; new->line = l->line; new->type = l->type; new->cont = l->cont; new->func = l->func; new->ticks_max = l->ticks; new->ticks_total = l->ticks; new->ticks_cnt = 1; HashListTableAdd(lock_records, (void *)new, 0); } else { lookup_fn->ticks_total += l->ticks; if (l->ticks > lookup_fn->ticks_max) lookup_fn->ticks_max = l->ticks; lookup_fn->ticks_cnt++; lookup_fn->cont += l->cont; } return; } /** \param p void ptr to Packet struct */ void SCProfilingAddPacketLocks(void *p) { int i; if (profiling_locks_enabled == 0) return; for (i = 0; i < locks_idx; i++) { pthread_mutex_lock(&lock_records_mutex); LockRecordAdd(&locks[i]); pthread_mutex_unlock(&lock_records_mutex); } } void SCProfilingListLocks(void) { FILE *fp = NULL; if (profiling_locks_output_to_file == 1) { fp = fopen(profiling_locks_file_name, profiling_locks_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_locks_file_name, strerror(errno)); return; } } else { fp = stdout; } fprintf(fp, "\n\nLock Cnt Avg ticks Max ticks Total ticks Cont Func\n"); fprintf(fp, "------------------ ---------- --------- ------------ ------------ ------- ---------\n"); uint64_t total = 0; uint32_t cont = 0; uint64_t cnt = 0; HashListTableBucket *b = HashListTableGetListHead(lock_records); while (b) { LockRecord *r = HashListTableGetListData(b); char *lock; switch (r->type) { case LOCK_MUTEX: lock = "mtx"; break; case LOCK_SPIN: lock = "spn"; break; case LOCK_RWW: lock = "rww"; break; case LOCK_RWR: lock = "rwr"; break; default: lock = "bug"; break; } char str[128] = ""; snprintf(str, sizeof(str), "(%s) %s:%d", lock,r->file, r->line); fprintf(fp, "%-50s %-10u %-9"PRIu64" %-12"PRIu64" %-12"PRIu64" %-7u %-s\n", str, r->ticks_cnt, (uint64_t)((uint64_t)r->ticks_total/(uint64_t)r->ticks_cnt), r->ticks_max, r->ticks_total, r->cont, r->func); total += r->ticks_total; cnt += r->ticks_cnt; cont += r->cont; b = HashListTableGetListNext(b); } fprintf(fp, "\nOverall: locks %"PRIu64", average cost %"PRIu64", contentions %"PRIu32", total ticks %"PRIu64"\n", cnt, (uint64_t)((uint64_t)total/(uint64_t)cnt), cont, total); fclose(fp); } void LockRecordFreeHash() { if (profiling_locks_enabled == 0) return; pthread_mutex_lock(&lock_records_mutex); SCProfilingListLocks(); if (lock_records != NULL) { HashListTableFree(lock_records); lock_records = NULL; } pthread_mutex_unlock(&lock_records_mutex); pthread_mutex_destroy(&lock_records_mutex); } #endif #endif suricata-3.2.1/src/util-cuda.c0000644000000000000000000053215513051004444013047 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * NVIDIA CUDA utility functions - last referenced Cuda Toolkit 4.2 */ /* compile in, only if we have a CUDA enabled device on the machine, with the * toolkit and the driver installed */ #include "suricata-common.h" #ifdef __SC_CUDA_SUPPORT__ #include #include "util-cuda.h" #include "util-error.h" #include "util-debug.h" #include "util-unittest.h" #define CASE_CODE(E) case E: return #E typedef enum SCCudaAPIS_ { /* init api */ SC_CUDA_CU_INIT, /* version management api */ SC_CUDA_CU_DRIVER_GET_VERSION, /* device management api */ SC_CUDA_CU_DEVICE_COMPUTE_CAPABILITY, SC_CUDA_CU_DEVICE_GET, SC_CUDA_CU_DEVICE_GET_ATTRIBUTE, SC_CUDA_CU_DEVICE_GET_COUNT, SC_CUDA_CU_DEVICE_GET_NAME, SC_CUDA_CU_DEVICE_GET_PROPERTIES, SC_CUDA_CU_DEVICE_TOTAL_MEM, /* context management api */ SC_CUDA_CU_CTX_CREATE, SC_CUDA_CU_CTX_DESTROY, SC_CUDA_CU_CTX_GET_API_VERSION, SC_CUDA_CU_CTX_GET_CACHE_CONFIG, SC_CUDA_CU_CTX_GET_CURRENT, SC_CUDA_CU_CTX_GET_DEVICE, SC_CUDA_CU_CTX_GET_LIMIT, SC_CUDA_CU_CTX_POP_CURRENT, SC_CUDA_CU_CTX_PUSH_CURRENT, SC_CUDA_CU_CTX_SET_CACHE_CONFIG, SC_CUDA_CU_CTX_SET_CURRENT, SC_CUDA_CU_CTX_SET_LIMIT, SC_CUDA_CU_CTX_SYNCHRONIZE, SC_CUDA_CU_CTX_ATTACH, SC_CUDA_CU_CTX_DETACH, /* module management api */ SC_CUDA_CU_MODULE_GET_FUNCTION, SC_CUDA_CU_MODULE_GET_GLOBAL, SC_CUDA_CU_MODULE_GET_SURF_REF, SC_CUDA_CU_MODULE_GET_TEX_REF, SC_CUDA_CU_MODULE_LOAD, SC_CUDA_CU_MODULE_LOAD_DATA, SC_CUDA_CU_MODULE_LOAD_DATA_EX, SC_CUDA_CU_MODULE_LOAD_FAT_BINARY, SC_CUDA_CU_MODULE_UNLOAD, /* memory management api */ SC_CUDA_CU_ARRAY_3D_CREATE, SC_CUDA_CU_ARRAY_3D_GET_DESCRIPTOR, SC_CUDA_CU_ARRAY_CREATE, SC_CUDA_CU_ARRAY_DESTROY, SC_CUDA_CU_ARRAY_GET_DESCRIPTOR, SC_CUDA_CU_DEVICE_GET_BY_PCI_BUS_ID, SC_CUDA_CU_DEVICE_GET_PCI_BUS_ID, SC_CUDA_CU_IPC_CLOSE_MEM_HANDLE, SC_CUDA_CU_IPC_GET_EVENT_HANDLE, SC_CUDA_CU_IPC_GET_MEM_HANDLE, SC_CUDA_CU_IPC_OPEN_EVENT_HANDLE, SC_CUDA_CU_IPC_OPEN_MEM_HANDLE, SC_CUDA_CU_MEM_ALLOC, SC_CUDA_CU_MEM_ALLOC_HOST, SC_CUDA_CU_MEM_ALLOC_PITCH, SC_CUDA_CU_MEMCPY, SC_CUDA_CU_MEMCPY_2D, SC_CUDA_CU_MEMCPY_2D_ASYNC, SC_CUDA_CU_MEMCPY_2D_UNALIGNED, SC_CUDA_CU_MEMCPY_3D, SC_CUDA_CU_MEMCPY_3D_ASYNC, SC_CUDA_CU_MEMCPY_3D_PEER, SC_CUDA_CU_MEMCPY_3D_PEER_ASYNC, SC_CUDA_CU_MEMCPY_ASYNC, SC_CUDA_CU_MEMCPY_A_TO_A, SC_CUDA_CU_MEMCPY_A_TO_D, SC_CUDA_CU_MEMCPY_A_TO_H, SC_CUDA_CU_MEMCPY_A_TO_H_ASYNC, SC_CUDA_CU_MEMCPY_D_TO_A, SC_CUDA_CU_MEMCPY_D_TO_D, SC_CUDA_CU_MEMCPY_D_TO_D_ASYNC, SC_CUDA_CU_MEMCPY_D_TO_H, SC_CUDA_CU_MEMCPY_D_TO_H_ASYNC, SC_CUDA_CU_MEMCPY_H_TO_A, SC_CUDA_CU_MEMCPY_H_TO_A_ASYNC, SC_CUDA_CU_MEMCPY_H_TO_D, SC_CUDA_CU_MEMCPY_H_TO_D_ASYNC, SC_CUDA_CU_MEMCPY_PEER, SC_CUDA_CU_MEMCPY_PEER_ASYNC, SC_CUDA_CU_MEM_FREE, SC_CUDA_CU_MEM_FREE_HOST, SC_CUDA_CU_MEM_GET_ADDRESS_RANGE, SC_CUDA_CU_MEM_GET_INFO, SC_CUDA_CU_MEM_HOST_ALLOC, SC_CUDA_CU_MEM_HOST_GET_DEVICE_POINTER, SC_CUDA_CU_MEM_HOST_GET_FLAGS, SC_CUDA_CU_MEM_HOST_REGISTER, SC_CUDA_CU_MEM_HOST_UNREGISTER, SC_CUDA_CU_MEMSET_D16, SC_CUDA_CU_MEMSET_D16_ASYNC, SC_CUDA_CU_MEMSET_D2_D16, SC_CUDA_CU_MEMSET_D2_D16_ASYNC, SC_CUDA_CU_MEMSET_D2_D32, SC_CUDA_CU_MEMSET_D2_D32_ASYNC, SC_CUDA_CU_MEMSET_D2_D8, SC_CUDA_CU_MEMSET_D2_D8_ASYNC, SC_CUDA_CU_MEMSET_D32, SC_CUDA_CU_MEMSET_D32_ASYNC, SC_CUDA_CU_MEMSET_D8, SC_CUDA_CU_MEMSET_D8_ASYNC, /* unified addresssing */ SC_CUDA_CU_POINTER_GET_ATTRIBUTE, /* stream management api */ SC_CUDA_CU_STREAM_CREATE, SC_CUDA_CU_STREAM_DESTROY, SC_CUDA_CU_STREAM_QUERY, SC_CUDA_CU_STREAM_SYNCHRONIZE, SC_CUDA_CU_STREAM_WAIT_EVENT, /* event management api */ SC_CUDA_CU_EVENT_CREATE, SC_CUDA_CU_EVENT_DESTROY, SC_CUDA_CU_EVENT_ELAPSED_TIME, SC_CUDA_CU_EVENT_QUERY, SC_CUDA_CU_EVENT_RECORD, SC_CUDA_CU_EVENT_SYNCHRONIZE, /* execution control api */ SC_CUDA_CU_FUNC_GET_ATTRIBUTE, SC_CUDA_CU_FUNC_SET_CACHE_CONFIG, SC_CUDA_CU_LAUNCH_KERNEL, SC_CUDA_CU_FUNC_SET_BLOCK_SHAPE, SC_CUDA_CU_FUNC_SET_SHARED_SIZE, SC_CUDA_CU_LAUNCH, SC_CUDA_CU_LAUNCH_GRID, SC_CUDA_CU_LAUNCH_GRID_ASYNC, SC_CUDA_CU_PARAM_SETF, SC_CUDA_CU_PARAM_SETI, SC_CUDA_CU_PARAM_SET_SIZE, SC_CUDA_CU_PARAM_SET_TEX_REF, SC_CUDA_CU_PARAM_SETV, /* texture reference api */ SC_CUDA_CU_TEX_REF_CREATE, SC_CUDA_CU_TEX_REF_DESTROY, SC_CUDA_CU_TEX_REF_GET_ADDRESS, SC_CUDA_CU_TEX_REF_GET_ADDRESS_MODE, SC_CUDA_CU_TEX_REF_GET_ARRAY, SC_CUDA_CU_TEX_REF_GET_FILTER_MODE, SC_CUDA_CU_TEX_REF_GET_FLAGS, SC_CUDA_CU_TEX_REF_GET_FORMAT, SC_CUDA_CU_TEX_REF_SET_ADDRESS, SC_CUDA_CU_TEX_REF_SET_ADDRESS_2D, SC_CUDA_CU_TEX_REF_SET_ADDRESS_MODE, SC_CUDA_CU_TEX_REF_SET_ARRAY, SC_CUDA_CU_TEX_REF_SET_FILTER_MODE, SC_CUDA_CU_TEX_REF_SET_FLAGS, SC_CUDA_CU_TEX_REF_SET_FORMAT, } SCCudaAPIS; SCEnumCharMap sc_cuda_api_names_string_map[] = { /* init api */ { "cuInit", SC_CUDA_CU_INIT }, /* version management api */ { "cuDriverGetVersion", SC_CUDA_CU_DRIVER_GET_VERSION }, /* device management api */ { "cuDeviceComputeCapability", SC_CUDA_CU_DEVICE_COMPUTE_CAPABILITY }, { "cuDeviceGet", SC_CUDA_CU_DEVICE_GET }, { "cuDeviceGetAttribute", SC_CUDA_CU_DEVICE_GET_ATTRIBUTE }, { "cuDeviceGetCount", SC_CUDA_CU_DEVICE_GET_COUNT }, { "cuDeviceGetName", SC_CUDA_CU_DEVICE_GET_NAME }, { "cuDeviceGetProperties", SC_CUDA_CU_DEVICE_GET_PROPERTIES }, { "cuDeviceTotalMem", SC_CUDA_CU_DEVICE_TOTAL_MEM }, /* context management api */ { "cuCtxCreate", SC_CUDA_CU_CTX_CREATE }, { "cuCtxDestroy", SC_CUDA_CU_CTX_DESTROY }, { "cuCtxGetApiVersion", SC_CUDA_CU_CTX_GET_API_VERSION }, { "cuCtxGetCacheConfig", SC_CUDA_CU_CTX_GET_CACHE_CONFIG }, { "cuCtxGetCurrent", SC_CUDA_CU_CTX_GET_CURRENT }, { "cuCtxGetDevice", SC_CUDA_CU_CTX_GET_DEVICE }, { "cuCtxGetLimit", SC_CUDA_CU_CTX_GET_LIMIT }, { "cuCtxPopCurrent", SC_CUDA_CU_CTX_POP_CURRENT }, { "cuCtxPushCurrent", SC_CUDA_CU_CTX_PUSH_CURRENT }, { "cuCtxSetCacheConfig", SC_CUDA_CU_CTX_SET_CACHE_CONFIG }, { "cuCtxSetCurrent", SC_CUDA_CU_CTX_SET_CURRENT }, { "cuCtxSetLimit", SC_CUDA_CU_CTX_SET_LIMIT }, { "cuCtxSynchronize", SC_CUDA_CU_CTX_SYNCHRONIZE }, { "cuCtxAttach", SC_CUDA_CU_CTX_ATTACH }, { "cuCtxDetach", SC_CUDA_CU_CTX_DETACH }, /* module management api */ { "cuModuleGetFunction", SC_CUDA_CU_MODULE_GET_FUNCTION }, { "cuModuleGetGlobal", SC_CUDA_CU_MODULE_GET_GLOBAL }, { "cuModuleGetSurfRef", SC_CUDA_CU_MODULE_GET_SURF_REF }, { "cuModuleGetTexRef", SC_CUDA_CU_MODULE_GET_TEX_REF }, { "cuModuleLoad", SC_CUDA_CU_MODULE_LOAD }, { "cuModuleLoadData", SC_CUDA_CU_MODULE_LOAD_DATA }, { "cuModuleLoadDataEx", SC_CUDA_CU_MODULE_LOAD_DATA_EX }, { "cuModuleLoadFatBinary", SC_CUDA_CU_MODULE_LOAD_FAT_BINARY }, { "cuModuleUnload", SC_CUDA_CU_MODULE_UNLOAD }, /* memory management api */ { "cuArray3DCreate", SC_CUDA_CU_ARRAY_3D_CREATE }, { "cuArray3DGetDescriptor", SC_CUDA_CU_ARRAY_3D_GET_DESCRIPTOR }, { "cuArrayCreate", SC_CUDA_CU_ARRAY_CREATE }, { "cuArrayDestroy", SC_CUDA_CU_ARRAY_DESTROY }, { "cuArrayGetDescriptor", SC_CUDA_CU_ARRAY_GET_DESCRIPTOR }, { "cuDeviceGetByPCIBusId", SC_CUDA_CU_DEVICE_GET_BY_PCI_BUS_ID }, { "cuDeviceGetPCIBusId", SC_CUDA_CU_DEVICE_GET_PCI_BUS_ID }, { "cuIpcCloseMemHandle", SC_CUDA_CU_IPC_CLOSE_MEM_HANDLE }, { "cuIpcGetEventHandle", SC_CUDA_CU_IPC_GET_MEM_HANDLE }, { "cuIpcGetMemHandle", SC_CUDA_CU_IPC_GET_MEM_HANDLE }, { "cuIpcOpenEventHandle", SC_CUDA_CU_IPC_OPEN_EVENT_HANDLE }, { "cuIpcOpenMemHandle", SC_CUDA_CU_IPC_OPEN_MEM_HANDLE }, { "cuMemAlloc", SC_CUDA_CU_MEM_ALLOC }, { "cuMemAllocHost", SC_CUDA_CU_MEM_ALLOC_HOST }, { "cuMemAllocPitch", SC_CUDA_CU_MEM_ALLOC_PITCH }, { "cuMemcpy", SC_CUDA_CU_MEMCPY }, { "cuMemcpy2D", SC_CUDA_CU_MEMCPY_2D }, { "cuMemcpy2DAsync", SC_CUDA_CU_MEMCPY_2D_ASYNC }, { "cuMemcpy2DUnaligned", SC_CUDA_CU_MEMCPY_2D_UNALIGNED }, { "cuMemcpy3D", SC_CUDA_CU_MEMCPY_3D }, { "cuMemcpy3DAsync", SC_CUDA_CU_MEMCPY_3D_ASYNC }, { "cuMemcpy3DPeer", SC_CUDA_CU_MEMCPY_3D_PEER }, { "cuMemcpy3DPeerAsync", SC_CUDA_CU_MEMCPY_3D_PEER_ASYNC }, { "cuMemcpyAsync", SC_CUDA_CU_MEMCPY_ASYNC }, { "cuMemcpyAtoA", SC_CUDA_CU_MEMCPY_A_TO_A }, { "cuMemcpyAtoD", SC_CUDA_CU_MEMCPY_A_TO_D }, { "cuMemcpyAtoH", SC_CUDA_CU_MEMCPY_A_TO_H }, { "cuMemcpyAtoHAsync", SC_CUDA_CU_MEMCPY_A_TO_H_ASYNC }, { "cuMemcpyDtoA", SC_CUDA_CU_MEMCPY_D_TO_A }, { "cuMemcpyDtoD", SC_CUDA_CU_MEMCPY_D_TO_D }, { "cuMemcpyDtoDAsync", SC_CUDA_CU_MEMCPY_D_TO_D_ASYNC }, { "cuMemcpyDtoH", SC_CUDA_CU_MEMCPY_D_TO_H }, { "cuMemcpyDtoHAsync", SC_CUDA_CU_MEMCPY_D_TO_H_ASYNC }, { "cuMemcpyHtoA", SC_CUDA_CU_MEMCPY_H_TO_A }, { "cuMemcpyHtoAAsync", SC_CUDA_CU_MEMCPY_H_TO_A_ASYNC }, { "cuMemcpyHtoD", SC_CUDA_CU_MEMCPY_H_TO_D }, { "cuMemcpyHtoDAsync", SC_CUDA_CU_MEMCPY_H_TO_D_ASYNC }, { "cuMemcpyPeer", SC_CUDA_CU_MEMCPY_PEER }, { "cuMemcpyPeerAsync", SC_CUDA_CU_MEMCPY_PEER_ASYNC }, { "cuMemFree", SC_CUDA_CU_MEM_FREE }, { "cuMemFreeHost", SC_CUDA_CU_MEM_FREE_HOST }, { "cuMemGetAddressRange", SC_CUDA_CU_MEM_GET_ADDRESS_RANGE }, { "cuMemGetInfo", SC_CUDA_CU_MEM_GET_INFO }, { "cuMemHostAlloc", SC_CUDA_CU_MEM_HOST_ALLOC }, { "cuMemHostGetDevicePointer", SC_CUDA_CU_MEM_HOST_GET_DEVICE_POINTER }, { "cuMemHostGetFlags", SC_CUDA_CU_MEM_HOST_GET_FLAGS }, { "cuMemHostRegister", SC_CUDA_CU_MEM_HOST_REGISTER }, { "cuMemHostUnregister", SC_CUDA_CU_MEM_HOST_UNREGISTER }, { "cuMemsetD16", SC_CUDA_CU_MEMSET_D16 }, { "cuMemsetD16Async", SC_CUDA_CU_MEMSET_D16_ASYNC }, { "cuMemsetD2D16", SC_CUDA_CU_MEMSET_D2_D16 }, { "cuMemsetD2D16Async", SC_CUDA_CU_MEMSET_D2_D16_ASYNC }, { "cuMemsetD2D32", SC_CUDA_CU_MEMSET_D2_D32 }, { "cuMemsetD2D32Async", SC_CUDA_CU_MEMSET_D2_D32_ASYNC }, { "cuMemsetD2D8", SC_CUDA_CU_MEMSET_D2_D8 }, { "cuMemsetD2D8Async", SC_CUDA_CU_MEMSET_D2_D8_ASYNC }, { "cuMemsetD32", SC_CUDA_CU_MEMSET_D32 }, { "cuMemsetD32Async", SC_CUDA_CU_MEMSET_D32_ASYNC }, { "cuMemsetD8", SC_CUDA_CU_MEMSET_D8 }, { "cuMemsetD8Async", SC_CUDA_CU_MEMSET_D8_ASYNC }, /* unified addressing */ { "cuPointerGetAttribute", SC_CUDA_CU_POINTER_GET_ATTRIBUTE }, /* stream management api */ { "cuStreamCreate", SC_CUDA_CU_STREAM_CREATE }, { "cuStreamDestroy", SC_CUDA_CU_STREAM_DESTROY }, { "cuStreamQuery", SC_CUDA_CU_STREAM_QUERY }, { "cuStreamSynchronize", SC_CUDA_CU_STREAM_SYNCHRONIZE }, { "cuStreamWaitEvent", SC_CUDA_CU_STREAM_WAIT_EVENT }, /* event management api */ { "cuEventCreate", SC_CUDA_CU_EVENT_CREATE }, { "cuEventDestroy", SC_CUDA_CU_EVENT_DESTROY }, { "cuEventElapseTime", SC_CUDA_CU_EVENT_ELAPSED_TIME }, { "cuEventQuery", SC_CUDA_CU_EVENT_QUERY }, { "cuEventRecord", SC_CUDA_CU_EVENT_RECORD }, { "cuEventSynchronize", SC_CUDA_CU_EVENT_SYNCHRONIZE }, /* execution control api */ { "cuFuncGetAttribute", SC_CUDA_CU_FUNC_GET_ATTRIBUTE }, { "cuFuncSetCacheConfig", SC_CUDA_CU_FUNC_SET_CACHE_CONFIG }, { "cuLaunchKernel", SC_CUDA_CU_LAUNCH_KERNEL }, { "cuFuncSetBlockShape", SC_CUDA_CU_FUNC_SET_BLOCK_SHAPE }, { "cuFuncSetSharedSize", SC_CUDA_CU_FUNC_SET_SHARED_SIZE }, { "cuLaunch", SC_CUDA_CU_LAUNCH }, { "cuLaunchGrid", SC_CUDA_CU_LAUNCH_GRID }, { "cuLaunchGridAsync", SC_CUDA_CU_LAUNCH_GRID_ASYNC }, { "cuParamSetf", SC_CUDA_CU_PARAM_SETF }, { "cuParamSeti", SC_CUDA_CU_PARAM_SETI }, { "cuParamSetSize", SC_CUDA_CU_PARAM_SET_SIZE }, { "cuSetTexRef", SC_CUDA_CU_PARAM_SET_TEX_REF }, { "cuSetv", SC_CUDA_CU_PARAM_SETV }, /* texture reference api */ { "cuTexRefCreate", SC_CUDA_CU_TEX_REF_CREATE}, { "cuTexRefDestroy", SC_CUDA_CU_TEX_REF_DESTROY}, { "cuTexRefGetAddress", SC_CUDA_CU_TEX_REF_GET_ADDRESS}, { "cuTexRefGetAddressMode", SC_CUDA_CU_TEX_REF_GET_ADDRESS_MODE}, { "cuTexRefGetArray", SC_CUDA_CU_TEX_REF_GET_ARRAY}, { "cuTexRefGetFilterMode", SC_CUDA_CU_TEX_REF_GET_FILTER_MODE}, { "cuTexRefGetFlags", SC_CUDA_CU_TEX_REF_GET_FLAGS}, { "cuTexRefGetFormat", SC_CUDA_CU_TEX_REF_GET_FORMAT}, { "cuTexRefSetAddress", SC_CUDA_CU_TEX_REF_SET_ADDRESS}, { "cuTexRefSetAddress2D", SC_CUDA_CU_TEX_REF_SET_ADDRESS_2D}, { "cuTexRefSetAddressMode", SC_CUDA_CU_TEX_REF_SET_ADDRESS_MODE}, { "cuTexRefSetArray", SC_CUDA_CU_TEX_REF_SET_ARRAY}, { "cuTexRefSetFilterMode", SC_CUDA_CU_TEX_REF_SET_FILTER_MODE}, { "cuTexRefSetFlags", SC_CUDA_CU_TEX_REF_SET_FLAGS}, { "cuTexRefSetFormat", SC_CUDA_CU_TEX_REF_SET_FORMAT}, { NULL, -1 }, }; static SCCudaDevices *devices = NULL; /*****************************Error_Handling_API*******************************/ /** * \internal * \brief Maps the error enums from SCCudaAPIS to strings using the preprocessor * #ENUM_VALUE. This is mainly needed for logging purposes to log the * error codes. * * \param err The error_code for which the string has to be returned. * * \retval The string equivalent of the error code. */ static const char *SCCudaGetErrorCodeInString(int err) { switch (err) { CASE_CODE(CUDA_SUCCESS); CASE_CODE(CUDA_ERROR_INVALID_VALUE); CASE_CODE(CUDA_ERROR_OUT_OF_MEMORY); CASE_CODE(CUDA_ERROR_NOT_INITIALIZED); CASE_CODE(CUDA_ERROR_DEINITIALIZED); CASE_CODE(CUDA_ERROR_PROFILER_DISABLED); CASE_CODE(CUDA_ERROR_PROFILER_NOT_INITIALIZED); CASE_CODE(CUDA_ERROR_PROFILER_ALREADY_STARTED); CASE_CODE(CUDA_ERROR_PROFILER_ALREADY_STOPPED); CASE_CODE(CUDA_ERROR_NO_DEVICE); CASE_CODE(CUDA_ERROR_INVALID_DEVICE); CASE_CODE(CUDA_ERROR_INVALID_IMAGE); CASE_CODE(CUDA_ERROR_INVALID_CONTEXT); /* deprecated error code as of 3.2 */ CASE_CODE(CUDA_ERROR_CONTEXT_ALREADY_CURRENT); CASE_CODE(CUDA_ERROR_MAP_FAILED); CASE_CODE(CUDA_ERROR_UNMAP_FAILED); CASE_CODE(CUDA_ERROR_ARRAY_IS_MAPPED); CASE_CODE(CUDA_ERROR_ALREADY_MAPPED); CASE_CODE(CUDA_ERROR_NO_BINARY_FOR_GPU); CASE_CODE(CUDA_ERROR_ALREADY_ACQUIRED); CASE_CODE(CUDA_ERROR_NOT_MAPPED); CASE_CODE(CUDA_ERROR_NOT_MAPPED_AS_ARRAY); CASE_CODE(CUDA_ERROR_NOT_MAPPED_AS_POINTER); CASE_CODE(CUDA_ERROR_ECC_UNCORRECTABLE); CASE_CODE(CUDA_ERROR_UNSUPPORTED_LIMIT); CASE_CODE(CUDA_ERROR_CONTEXT_ALREADY_IN_USE); CASE_CODE(CUDA_ERROR_INVALID_SOURCE); CASE_CODE(CUDA_ERROR_FILE_NOT_FOUND); CASE_CODE(CUDA_ERROR_SHARED_OBJECT_SYMBOL_NOT_FOUND); CASE_CODE(CUDA_ERROR_SHARED_OBJECT_INIT_FAILED); CASE_CODE(CUDA_ERROR_OPERATING_SYSTEM); CASE_CODE(CUDA_ERROR_INVALID_HANDLE); CASE_CODE(CUDA_ERROR_NOT_FOUND); CASE_CODE(CUDA_ERROR_NOT_READY); CASE_CODE(CUDA_ERROR_LAUNCH_FAILED); CASE_CODE(CUDA_ERROR_LAUNCH_OUT_OF_RESOURCES); CASE_CODE(CUDA_ERROR_LAUNCH_TIMEOUT); CASE_CODE(CUDA_ERROR_LAUNCH_INCOMPATIBLE_TEXTURING); CASE_CODE(CUDA_ERROR_PEER_ACCESS_ALREADY_ENABLED); CASE_CODE(CUDA_ERROR_PEER_ACCESS_NOT_ENABLED); CASE_CODE(CUDA_ERROR_PRIMARY_CONTEXT_ACTIVE); CASE_CODE(CUDA_ERROR_CONTEXT_IS_DESTROYED); CASE_CODE(CUDA_ERROR_ASSERT); CASE_CODE(CUDA_ERROR_TOO_MANY_PEERS); CASE_CODE(CUDA_ERROR_HOST_MEMORY_ALREADY_REGISTERED); CASE_CODE(CUDA_ERROR_HOST_MEMORY_NOT_REGISTERED); CASE_CODE(CUDA_ERROR_UNKNOWN); default: return "CUDA_UNKNOWN_ERROR_CODE"; } } /** * \internal * \brief A generic function that handles the return values from the CUDA driver * API. * * \param result The result from the CUDA driver API call. * \param api_type An enum value SCCudaAPIS corresponing to the API for which the * result was returned. The enum is needed to map the api type to * a string for logging purposes. * * \retval 0 On success. * \retval -1 On failure. */ static int SCCudaHandleRetValue(CUresult result, SCCudaAPIS api_type) { if (result == CUDA_SUCCESS) { SCLogDebug("%s executed successfully", SCMapEnumValueToName(api_type, sc_cuda_api_names_string_map)); return 0; } else { SCLogError(SC_ERR_CUDA_ERROR, "%s failed. Returned errocode - %s", SCMapEnumValueToName(api_type, sc_cuda_api_names_string_map), SCCudaGetErrorCodeInString(result)); return -1; } } /*****************************Cuda_Initialization_API**************************/ /** * \internal * \brief Inits the cuda driver API. * * \param flags Currently should be 0. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaInit(unsigned int flags) { CUresult result = cuInit(flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_INIT) == -1) goto error; return 0; error: return -1; } /*****************************Version_Management_API***************************/ /** * \brief Returns in *driver_version the version number of the installed CUDA * driver. This function automatically returns CUDA_ERROR_INVALID_VALUE * if the driver_version argument is NULL. * * \param driver_version Returns the CUDA driver version. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDriverGetVersion(int *driver_version) { CUresult result = 0; if (driver_version == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "driver_version NULL"); goto error; } result = cuDriverGetVersion(driver_version); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DRIVER_GET_VERSION) == -1) goto error; return 0; error: return -1; } /*****************************Device_Management_API****************************/ /** * \internal * \brief Returns the major and the minor revision numbers that define the * compute capability for the device that is sent as the argument. * * \param major Pointer to an integer, that will be updated with the major revision. * \param minor Pointer to an integer, that will be updated with the minor revision. * \param dev The device handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceComputeCapability(int *major, int *minor, CUdevice dev) { CUresult result = 0; if (major == NULL || minor == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "major is NULL or minor is NULL"); goto error; } result = cuDeviceComputeCapability(major, minor, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_COMPUTE_CAPABILITY) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Returns a device handle given an ordinal in the range * [0, cuDeviceGetCount() - 1]. * * \param device Pointer to a CUDevice instance that will be updated with the * device handle. * \param ordinal An index in the range [0, cuDeviceGetCount() - 1]. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceGet(CUdevice *device, int ordinal) { CUresult result = 0; if (device == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "device NULL"); goto error; } result = cuDeviceGet(device, ordinal); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Returns the various attributes for the device that is sent as the arg. * * The supported attributes are: * * CU_DEVICE_ATTRIBUTE_MAX_THREADS_PER_BLOCK: Maximum number of threads * per block; * CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_X: Maximum x-dimension of a block; * CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_Y: Maximum y-dimension of a block; * CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_Z: Maximum z-dimension of a block; * CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_X: Maximum x-dimension of a grid; * CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_Y: Maximum y-dimension of a grid; * CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_Z: Maximum z-dimension of a grid; * CU_DEVICE_ATTRIBUTE_MAX_SHARED_MEMORY_PER_BLOCK: Maximum amount of * shared mem-ory available to a thread block in bytes; this amount * is shared by all thread blocks simultaneously resident on a * multiprocessor; * CU_DEVICE_ATTRIBUTE_TOTAL_CONSTANT_MEMORY: Memory available on device * for __constant_-_ variables in a CUDA C kernel in bytes; * CU_DEVICE_ATTRIBUTE_WARP_SIZE: Warp size in threads; * CU_DEVICE_ATTRIBUTE_MAX_PITCH: Maximum pitch in bytes allowed by the * memory copy functions that involve memory regions allocated * through cuMemAllocPitch(); * CU_DEVICE_ATTRIBUTE_MAX_REGISTERS_PER_BLOCK: Maximum number of 32-bit * registers avail-able to a thread block; this number is shared by * all thread blocks simultaneously resident on a multiprocessor; * CU_DEVICE_ATTRIBUTE_CLOCK_RATE: Peak clock frequency in kilohertz; * CU_DEVICE_ATTRIBUTE_TEXTURE_ALIGNMENT: Alignment requirement; texture * base addresses aligned to textureAlign bytes do not need an offset * applied to texture fetches; * CU_DEVICE_ATTRIBUTE_GPU_OVERLAP: 1 if the device can concurrently copy * memory between host and device while executing a kernel, or 0 if not; * CU_DEVICE_ATTRIBUTE_MULTIPROCESSOR_COUNT: Number of multiprocessors on * the device; * CU_DEVICE_ATTRIBUTE_KERNEL_EXEC_TIMEOUT: 1 if there is a run time limit * for kernels executed on the device, or 0 if not; * CU_DEVICE_ATTRIBUTE_INTEGRATED: 1 if the device is integrated with the * memory subsystem, or 0 if not; * CU_DEVICE_ATTRIBUTE_CAN_MAP_HOST_MEMORY: 1 if the device can map host * memory into the CUDA address space, or 0 if not; * CU_DEVICE_ATTRIBUTE_COMPUTE_MODE: Compute mode that device is currently * in. Available modes are as follows: * - CU_COMPUTEMODE_DEFAULT: Default mode - Device is not restricted * and can have multiple CUDA contexts present at a single time. * - CU_COMPUTEMODE_EXCLUSIVE: Compute-exclusive mode - Device can have * only one CUDA con-text present on it at a time. * - CU_COMPUTEMODE_PROHIBITED: Compute-prohibited mode - Device is * prohibited from creating new CUDA contexts. * * \param pi Pointer to an interger instance that will be updated with the * attribute value. * \param attrib Device attribute to query. * \param dev The device handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceGetAttribute(int *pi, CUdevice_attribute attrib, CUdevice dev) { CUresult result = 0; if (pi == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "prop is NULL"); goto error; } result = cuDeviceGetAttribute(pi, attrib, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_ATTRIBUTE) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Gets the total no of devices with compute capability greater than or * equal to 1.0 that are available for execution. * * \param count Pointer to an integer that will be updated with the device count. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceGetCount(int *count) { CUresult result = 0; if (count == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "count NULL"); goto error; } result = cuDeviceGetCount(count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_COUNT) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Returns the device name, given the device handle. * * \param name Pointer to a char buffer which will be updated with the device name. * \param len Length of the above buffer. * \param dev The device handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceGetName(char *name, int len, CUdevice dev) { CUresult result = 0; if (name == NULL || len == 0) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "name is NULL or len is 0"); goto error; } result = cuDeviceGetName(name, len, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_NAME) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Returns the properties of the device. The CUdevprop structure is * defined as * * typedef struct CUdevprop_st { * int maxThreadsPerBlock; * int maxThreadsDim[3]; * int maxGridSize[3]; * int sharedMemPerBlock; * int totalConstantMemory; * int SIMDWidth; * int memPitch; * int regsPerBlock; * int clockRate; * int textureAlign * } CUdevprop; * * \param prop Pointer to a CUdevprop instance that holds the device properties. * \param dev The device handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceGetProperties(CUdevprop *prop, CUdevice dev) { CUresult result = 0; if (prop == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "prop is NULL"); goto error; } result = cuDeviceGetProperties(prop, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_PROPERTIES) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Returns the total amount of memory availabe on the device which * is sent as the argument. * * \param bytes Pointer to an unsigned int instance, that will be updated with * total memory for the device. * \param dev The device handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaDeviceTotalMem(size_t *bytes, CUdevice dev) { CUresult result = 0; if (bytes == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "bytes is NULL"); goto error; } result = cuDeviceTotalMem(bytes, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_TOTAL_MEM) == -1) goto error; return 0; error: return -1; } /** * \internal * \brief Creates and returns a new instance of SCCudaDevice. * * \retval device Pointer to the new instance of SCCudaDevice. */ static SCCudaDevice *SCCudaAllocSCCudaDevice(void) { SCCudaDevice *device = SCMalloc(sizeof(SCCudaDevice)); if (unlikely(device == NULL)) return NULL; memset(device, 0 , sizeof(SCCudaDevice)); return device; } /** * \internal * \brief Frees an instance of SCCudaDevice. * * \param device Pointer to the an instance of SCCudaDevice to be freed. */ static void SCCudaDeAllocSCCudaDevice(SCCudaDevice *device) { SCFree(device); return; } /** * \internal * \brief Creates and returns a new instance of SCCudaDevices. * * \retval devices Pointer to the new instance of SCCudaDevices. */ static SCCudaDevices *SCCudaAllocSCCudaDevices(void) { SCCudaDevices *devices = SCMalloc(sizeof(SCCudaDevices)); if (unlikely(devices == NULL)) return NULL; memset(devices, 0 , sizeof(SCCudaDevices)); return devices; } /** * \internal * \brief Frees an instance of SCCudaDevices. * * \param device Pointer to the an instance of SCCudaDevices to be freed. */ static void SCCudaDeAllocSCCudaDevices(SCCudaDevices *devices) { int i = 0; if (devices == NULL) return; if (devices->devices != NULL) { for (i = 0; i < devices->count; i++) SCCudaDeAllocSCCudaDevice(devices->devices[i]); SCFree(devices->devices); } SCFree(devices); return; } /** * \brief Retrieves all the devices and all the information corresponding to * the devices on the CUDA device available on this system and returns * a SCCudaDevices instances which holds all this information. * * \retval devices Pointer to a SCCudaDevices instance that holds information * for all the CUDA devices on the system. */ static SCCudaDevices *SCCudaGetDevices(void) { SCCudaDevices *devices = SCCudaAllocSCCudaDevices(); int i = 0; if (SCCudaDeviceGetCount(&devices->count) == -1) goto error; devices->devices = SCMalloc(devices->count * sizeof(SCCudaDevice *)); if (devices->devices == NULL) goto error; /* update the device properties */ for (i = 0; i < devices->count; i++) { devices->devices[i] = SCCudaAllocSCCudaDevice(); if (SCCudaDeviceGet(&devices->devices[i]->device, i) == -1) goto error; if (SCCudaDeviceComputeCapability(&devices->devices[i]->major_rev, &devices->devices[i]->minor_rev, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetName(devices->devices[i]->name, SC_CUDA_DEVICE_NAME_MAX_LEN, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceTotalMem(&devices->devices[i]->bytes, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetProperties(&devices->devices[i]->prop, devices->devices[i]->device) == -1) { goto error; } /* retrieve the attributes */ if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_threads_per_block, CU_DEVICE_ATTRIBUTE_MAX_THREADS_PER_BLOCK, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_block_dim_x, CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_X, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_block_dim_y, CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_Y, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_block_dim_z, CU_DEVICE_ATTRIBUTE_MAX_BLOCK_DIM_Z, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_grid_dim_x, CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_X, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_grid_dim_y, CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_Y, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_grid_dim_z, CU_DEVICE_ATTRIBUTE_MAX_GRID_DIM_Z, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_shared_memory_per_block, CU_DEVICE_ATTRIBUTE_MAX_SHARED_MEMORY_PER_BLOCK, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_total_constant_memory, CU_DEVICE_ATTRIBUTE_TOTAL_CONSTANT_MEMORY, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_warp_size, CU_DEVICE_ATTRIBUTE_WARP_SIZE, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_pitch, CU_DEVICE_ATTRIBUTE_MAX_PITCH, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_max_registers_per_block, CU_DEVICE_ATTRIBUTE_MAX_REGISTERS_PER_BLOCK, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_clock_rate, CU_DEVICE_ATTRIBUTE_CLOCK_RATE, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_texture_alignment, CU_DEVICE_ATTRIBUTE_TEXTURE_ALIGNMENT, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_gpu_overlap, CU_DEVICE_ATTRIBUTE_GPU_OVERLAP, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_multiprocessor_count, CU_DEVICE_ATTRIBUTE_MULTIPROCESSOR_COUNT, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_kernel_exec_timeout, CU_DEVICE_ATTRIBUTE_KERNEL_EXEC_TIMEOUT, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_integrated, CU_DEVICE_ATTRIBUTE_INTEGRATED, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_can_map_host_memory, CU_DEVICE_ATTRIBUTE_CAN_MAP_HOST_MEMORY, devices->devices[i]->device) == -1) { goto error; } if (SCCudaDeviceGetAttribute(&devices->devices[i]->attr_compute_mode, CU_DEVICE_ATTRIBUTE_COMPUTE_MODE, devices->devices[i]->device) == -1) { goto error; } } #ifdef DEBUG SCCudaPrintDeviceList(devices); #endif return devices; error: SCCudaDeAllocSCCudaDevices(devices); return NULL; } /** * \brief Prints the information for all the devices for this CUDA platform, * supplied inside the argument. * * \param devices Pointer to a SCCudaDevices instance that holds information on * the devices. */ void SCCudaPrintDeviceList(SCCudaDevices *devices) { int i = 0; if (devices == NULL) { SCLogError(SC_ERR_CUDA_ERROR, "CUDA environment not initialized. " "Please initialized the CUDA environment by calling " "SCCudaInitCudaEnvironment() before making any calls " "to the CUDA API."); return; } SCLogDebug("Printing device info for this CUDA context"); SCLogDebug("No of devices: %d", devices->count); for (i = 0; i < devices->count; i++) { SCLogDebug("Device ID: %d", devices->devices[i]->device); SCLogDebug("Device Name: %s", devices->devices[i]->name); SCLogDebug("Device Major Revision: %d", devices->devices[i]->major_rev); SCLogDebug("Device Minor Revision: %d", devices->devices[i]->minor_rev); /* Cudevprop */ SCLogDebug("Device Max Threads Per Block: %d", devices->devices[i]->prop.maxThreadsPerBlock); SCLogDebug("Device Max Threads Dim: [%d, %d, %d]", devices->devices[i]->prop.maxThreadsDim[0], devices->devices[i]->prop.maxThreadsDim[1], devices->devices[i]->prop.maxThreadsDim[2]); SCLogDebug("Device Max Grid Size: [%d, %d, %d]", devices->devices[i]->prop.maxGridSize[0], devices->devices[i]->prop.maxGridSize[1], devices->devices[i]->prop.maxGridSize[2]); SCLogDebug("Device Shared Memory Per Block: %d", devices->devices[i]->prop.sharedMemPerBlock); SCLogDebug("Device Total Constant Memory: %d", devices->devices[i]->prop.totalConstantMemory); SCLogDebug("Device SIMD Width(Warp Size): %d", devices->devices[i]->prop.SIMDWidth); SCLogDebug("Device Maximum Mem Pitch: %d", devices->devices[i]->prop.memPitch); SCLogDebug("Device Total Registers Available Per Block: %d", devices->devices[i]->prop.regsPerBlock); SCLogDebug("Device Clock Frequency: %d", devices->devices[i]->prop.clockRate); SCLogDebug("Device Texture Alignment Requirement: %d", devices->devices[i]->prop.textureAlign); /* device attributes */ SCLogDebug("Device Max Threads Per Block: %d", devices->devices[i]->attr_max_threads_per_block); SCLogDebug("Device Max Block Dim X: %d", devices->devices[i]->attr_max_block_dim_x); SCLogDebug("Device Max Block Dim Y: %d", devices->devices[i]->attr_max_block_dim_y); SCLogDebug("Device Max Block Dim Z: %d", devices->devices[i]->attr_max_block_dim_z); SCLogDebug("Device Max Grid Dim X: %d", devices->devices[i]->attr_max_grid_dim_x); SCLogDebug("Device Max Grid Dim Y: %d", devices->devices[i]->attr_max_grid_dim_y); SCLogDebug("Device Max Grid Dim Z: %d", devices->devices[i]->attr_max_grid_dim_z); SCLogDebug("Device Max Shared Memory Per Block: %d", devices->devices[i]->attr_max_shared_memory_per_block); SCLogDebug("Device Total Constant Memory: %d", devices->devices[i]->attr_total_constant_memory); SCLogDebug("Device Warp Size: %d", devices->devices[i]->attr_warp_size); SCLogDebug("Device Max Pitch: %d", devices->devices[i]->attr_max_pitch); SCLogDebug("Device Max Registers Per Block: %d", devices->devices[i]->attr_max_registers_per_block); SCLogDebug("Device Clock Rate: %d", devices->devices[i]->attr_clock_rate); SCLogDebug("Device Texture Alignement: %d", devices->devices[i]->attr_texture_alignment); SCLogDebug("Device GPU Overlap: %s", (devices->devices[i]->attr_gpu_overlap == 1) ? "Yes": "No"); SCLogDebug("Device Multiprocessor Count: %d", devices->devices[i]->attr_multiprocessor_count); SCLogDebug("Device Kernel Exec Timeout: %s", (devices->devices[i]->attr_kernel_exec_timeout) ? "Yes": "No"); SCLogDebug("Device Integrated With Memory Subsystem: %s", (devices->devices[i]->attr_integrated) ? "Yes": "No"); SCLogDebug("Device Can Map Host Memory: %s", (devices->devices[i]->attr_can_map_host_memory) ? "Yes": "No"); if (devices->devices[i]->attr_compute_mode == CU_COMPUTEMODE_DEFAULT) SCLogDebug("Device Compute Mode: CU_COMPUTEMODE_DEFAULT"); else if (devices->devices[i]->attr_compute_mode == CU_COMPUTEMODE_EXCLUSIVE) SCLogDebug("Device Compute Mode: CU_COMPUTEMODE_EXCLUSIVE"); else if (devices->devices[i]->attr_compute_mode == CU_COMPUTEMODE_PROHIBITED) SCLogDebug("Device Compute Mode: CU_COMPUTEMODE_PROHIBITED"); } return; } /** * \brief Prints some basic information for the default device(the first devie) * we will be using on this cuda platform for use by our engine. This * function is basically to be used to print some minimal information to * the user at engine startup. * * \param devices Pointer to a SCCudaDevices instance that holds information on * the devices. */ void SCCudaPrintBasicDeviceInfo(SCCudaDevices *devices) { int i = 0; if (devices == NULL) { SCLogError(SC_ERR_CUDA_ERROR, "CUDA environment not initialized. " "Please initialized the CUDA environment by calling " "SCCudaInitCudaEnvironment() before making any calls " "to the CUDA API."); return; } for (i = 0; i < devices->count; i++) { SCLogInfo("GPU Device %d: %s, %d Multiprocessors, %dMHz, CUDA Compute " "Capability %d.%d", i + 1, devices->devices[i]->name, devices->devices[i]->attr_multiprocessor_count, devices->devices[i]->attr_clock_rate/1000, devices->devices[i]->major_rev, devices->devices[i]->minor_rev); } return; } /** * \brief Gets the device list, for the CUDA platform environment initialized by * the engine. * * \retval devices Pointer to the CUDA device list on success; NULL on failure. */ SCCudaDevices *SCCudaGetDeviceList(void) { if (devices == NULL) { SCLogError(SC_ERR_CUDA_ERROR, "CUDA environment not initialized. " "Please initialized the CUDA environment by calling " "SCCudaInitCudaEnvironment() before making any calls " "to the CUDA API."); return NULL; } return devices; } /*****************************Context_Management_API***************************/ /** * \brief Creates a new CUDA context and associates it with the calling thread. * The flags parameter is described below. The context is created with * a usage count of 1 and the caller of cuCtxCreate() must call * cuCtxDestroy() or cuCtxDetach() when done using the context. If a * context is already current to the thread, it is supplanted by the * newly created context and may be restored by a subsequent call to * cuCtxPopCurrent(). The two LSBs of the flags parameter can be used * to control how the OS thread, which owns the CUDA context at the * time of an API call, interacts with the OS scheduler when waiting for * results from the GPU. * * - CU_CTX_SCHED_AUTO: The default value if the flags parameter is zero, * uses a heuristic based on the number of active CUDA contexts in * the process C and the number of logical processors in the system * P. If C > P, then CUDA will yield to other OS threads when * waiting for the GPU, otherwise CUDA will not yield while waiting * for results and actively spin on the processor. * - CU_CTX_SCHED_SPIN: Instruct CUDA to actively spin when waiting for * results from the GPU. This can de-crease latency when waiting for * the GPU, but may lower the performance of CPU threads if they are * performing work in parallel with the CUDA thread. * - CU_CTX_SCHED_YIELD: Instruct CUDA to yield its thread when waiting * for results from the GPU. This can increase latency when waiting * for the GPU, but can increase the performance of CPU threads * performing work in parallel with the GPU. * - CU_CTX_BLOCKING_SYNC: Instruct CUDA to block the CPU thread on a * synchronization primitive when waiting for the GPU to finish work. * - CU_CTX_MAP_HOST: Instruct CUDA to support mapped pinned allocations. * This flag must be set in order to allocate pinned host memory * that is accessible to the GPU. * * Note to Linux users: * Context creation will fail with CUDA_ERROR_UNKNOWN if the compute mode * of the device is CU_COMPUTEMODE_PROHIBITED. Similarly, context creation * will also fail with CUDA_ERROR_UNKNOWN if the compute mode for the * device is set to CU_COMPUTEMODE_EXCLUSIVE and there is already an * active context on the device. The function cuDeviceGetAttribute() can * be used with CU_DEVICE_ATTRIBUTE_COMPUTE_MODE to determine the compute * mode of the device. The nvidia-smi tool can be used to set the compute * mode for devices. Documentation for nvidia-smi can be obtained by * passing a -h option to it. * * \param pctx Returned context handle of the current context. * \param flags Context creation flags. * \param dev Device to create context on. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxCreate(CUcontext *pctx, unsigned int flags, CUdevice dev) { CUresult result = 0; if (pctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pctx NULL"); goto error; } result = cuCtxCreate(pctx, flags, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Destroys the CUDA context specified by ctx. If the context usage count * is not equal to 1, or the context is current to any CPU thread other * than the current one, this function fails. Floating contexts (detached * from a CPU thread via cuCtxPopCurrent()) may be destroyed by this * function. * * \param ctx Context to destroy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxDestroy(CUcontext ctx) { CUresult result = 0; result = cuCtxDestroy(ctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_DESTROY) == -1) goto error; return 0; error: return -1; } int SCCudaCtxGetApiVersion(CUcontext ctx, unsigned int *version) { CUresult result = 0; if (version == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "version NULL"); goto error; } result = cuCtxGetApiVersion(ctx, version); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_GET_API_VERSION) == -1) goto error; return 0; error: return -1; } int SCCudaCtxGetCacheConfig(CUfunc_cache *pconfig) { CUresult result = 0; if (pconfig == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pconfig NULL"); goto error; } result = cuCtxGetCacheConfig(pconfig); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_GET_CACHE_CONFIG) == -1) goto error; return 0; error: return -1; } int SCCudaCtxGetCurrent(CUcontext *pctx) { CUresult result = 0; if (pctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pctx NULL"); goto error; } result = cuCtxGetCurrent(pctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_GET_CURRENT) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *device the ordinal of the current context's device. * * \param device Returned device id for the current context. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxGetDevice(CUdevice *device) { CUresult result = 0; if (device == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "device NULL"); goto error; } result = cuCtxGetDevice(device); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_GET_DEVICE) == -1) goto error; return 0; error: return -1; } int SCCudaCtxGetLimit(size_t *pvalue, CUlimit limit) { CUresult result = 0; result = cuCtxGetLimit(pvalue, limit); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_GET_LIMIT) == -1) goto error; return 0; error: return -1; } /** * \brief Pops the current CUDA context from the CPU thread. The CUDA context * must have a usage count of 1. CUDA contexts have a usage count of 1 * upon creation; the usage count may be incremented with cuCtxAttach() * and decremented with cuCtxDetach(). * * If successful, cuCtxPopCurrent() passes back the new context handle * in *pctx. The old context may then be made current to a different CPU * thread by calling cuCtxPushCurrent(). * * Floating contexts may be destroyed by calling cuCtxDestroy(). * * If a context was current to the CPU thread before cuCtxCreate() or * cuCtxPushCurrent() was called, this function makes that context * current to the CPU thread again. * * \param pctx Returned new context handle. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxPopCurrent(CUcontext *pctx) { CUresult result = 0; result = cuCtxPopCurrent(pctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_POP_CURRENT) == -1) goto error; return 0; error: return -1; } /** * \brief Pushes the given context ctx onto the CPU thread's stack of current * contexts. The speci?ed context becomes the CPU thread's current * context, so all CUDA functions that operate on the current context * are affected. * * The previous current context may be made current again by calling * cuCtxDestroy() or cuCtxPopCurrent(). * * The context must be "floating," i.e. not attached to any thread. * Contexts are made to float by calling cuCtxPopCurrent(). * * \param ctx Floating context to attach. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxPushCurrent(CUcontext ctx) { CUresult result = 0; result = cuCtxPushCurrent(ctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_PUSH_CURRENT) == -1) goto error; return 0; error: return -1; } int SCCudaCtxSetCacheConfig(CUfunc_cache config) { CUresult result = 0; result = cuCtxSetCacheConfig(config); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_SET_CACHE_CONFIG) == -1) goto error; return 0; error: return -1; } int SCCudaCtxSetCurrent(CUcontext ctx) { CUresult result = 0; result = cuCtxSetCurrent(ctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_SET_CURRENT) == -1) goto error; return 0; error: return -1; } int SCCudaCtxSetLimit(CUlimit limit, size_t value) { CUresult result = 0; result = cuCtxSetLimit(value, limit); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_SET_LIMIT) == -1) goto error; return 0; error: return -1; } /** * \brief Blocks until the device has completed all preceding requested tasks. * cuCtxSynchronize() returns an error if one of the preceding tasks failed. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxSynchronize(void) { CUresult result = 0; result = cuCtxSynchronize(); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_SYNCHRONIZE) == -1) goto error; return 0; error: return -1; } /** * \brief Increments the usage count of the context and passes back a context * handle in *pctx that must be passed to cuCtxDetach() when the * application is done with the context. cuCtxAttach() fails if there is * no context current to the thread. Currently, the flags parameter must * be 0. * * \param pctx Returned context handle of the current context. * \param flags Context attach flags (must be 0). * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxAttach(CUcontext *pctx, unsigned int flags) { CUresult result = 0; SCLogInfo("Cuda API - %s deprecated", SCMapEnumValueToName(SC_CUDA_CU_CTX_ATTACH, sc_cuda_api_names_string_map)); if (pctx == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pctx NULL"); goto error; } result = cuCtxAttach(pctx, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_ATTACH) == -1) goto error; return 0; error: return -1; } /** * \brief Decrements the usage count of the context ctx, and destroys the * context if the usage count goes to 0. The context must be a handle * that was passed back by cuCtxCreate() or cuCtxAttach(), and must be * current to the calling thread. * * \param ctx Context to destroy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaCtxDetach(CUcontext ctx) { CUresult result = 0; SCLogInfo("Cuda API - %s deprecated", SCMapEnumValueToName(SC_CUDA_CU_CTX_DETACH, sc_cuda_api_names_string_map)); result = cuCtxDetach(ctx); if (SCCudaHandleRetValue(result, SC_CUDA_CU_CTX_DETACH) == -1) goto error; return 0; error: return -1; } /*****************************Module_Management_API****************************/ /** * \brief Returns in *hfunc the handle of the function of name \"name\" located * in module hmod. If no function of that name exists, * cuModuleGetFunction() returns CUDA_ERROR_NOT_FOUND. * * \param hfunc Returned function handle. * \param hmod Module to return function from. * \param name Name of function to retrieve. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleGetFunction(CUfunction *hfunc, CUmodule hmod, const char *name) { CUresult result = 0; if (hfunc == NULL || name == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "hfunc is NULL or name is NULL"); goto error; } result = cuModuleGetFunction(hfunc, hmod, name); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_GET_FUNCTION) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *dptr and *bytes the base pointer and size of the global * name \"name\" located in module hmod. If no variable of that name * exists, cuModuleGetGlobal() returns CUDA_ERROR_NOT_FOUND. Both * parameters dptr and bytes are optional. If one of them is NULL, * it is ignored. * * \param dptr Returned global device pointer. * \param bytes Returned global size in bytes. * \param hmod Module to return function from. * \param name Name of global to retrieve. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleGetGlobal(CUdeviceptr *dptr, size_t *bytes, CUmodule hmod, const char *name) { CUresult result = 0; if (name == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "name is NULL"); goto error; } result = cuModuleGetGlobal(dptr, bytes, hmod, name); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_GET_GLOBAL) == -1) goto error; return 0; error: return -1; } int SCCudaModuleGetSurfRef(CUsurfref *p_surf_ref, CUmodule hmod, const char *name) { CUresult result = 0; if (p_surf_ref == NULL || name == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_surf_ref is NULL or name is NULL"); goto error; } result = cuModuleGetSurfRef(p_surf_ref, hmod, name); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_GET_SURF_REF) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *p_tex_ref the handle of the texture reference of name * \"name\" in the module hmod. If no texture reference of that name * exists, cuModuleGetTexRef() returns CUDA_ERROR_NOT_FOUND. This texture * reference handle should not be destroyed, since it will be destroyed * when the module is unloaded. * * \param p_tex_ref Returned global device pointer. * \param hmod Module to retrieve texture reference from. * \param name Name of the texture reference to retrieve. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleGetTexRef(CUtexref *p_tex_ref, CUmodule hmod, const char *name) { CUresult result = 0; if (p_tex_ref == NULL || name == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_tex_ref is NULL or name is NULL"); goto error; } result = cuModuleGetTexRef(p_tex_ref, hmod, name); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_GET_TEX_REF) == -1) goto error; return 0; error: return -1; } /** * \brief Takes a filename fname and loads the corresponding module \"module\" * into the current context. The CUDA driver API does not attempt to * lazily allocate the resources needed by a module; if the memory for * functions and data (constant and global) needed by the module cannot * be allocated, cuModuleLoad() fails. The file should be a cubin file * as output by nvcc or a PTX file, either as output by nvcc or handwrtten. * * \param module Returned module. * \param fname Filename of module to load. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleLoad(CUmodule *module, const char *fname) { CUresult result = 0; if (module == NULL || fname == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "module is NULL or fname is NULL"); goto error; } result = cuModuleLoad(module, fname); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_LOAD) == -1) goto error; return 0; error: return -1; } /** * \brief Takes a pointer image and loads the corresponding module \"module\" * into the current context. The pointer may be obtained by mapping a * cubin or PTX file, passing a cubin or PTX ?le as a NULL-terminated * text string, or incorporating a cubin object into the executable * resources and using operating system calls such as Windows * FindResource() to obtain the pointer. * * \param module Returned module. * \param image Module data to load * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleLoadData(CUmodule *module, const void *image) { CUresult result = 0; if (module == NULL || image == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "module is NULL or image is NULL"); goto error; } result = cuModuleLoadData(module, image); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_LOAD_DATA) == -1) goto error; return 0; error: return -1; } /** * \brief Takes a pointer image and loads the corresponding module module into * the current context. The pointer may be obtained by mapping a cubin or * PTX file, passing a cubin or PTX file as a NULL-terminated text * string, or incorporating a cubin object into the executable resources * and using operating system calls such as Windows FindResource() to * obtain the pointer. Options are passed as an array via options and any * corresponding parameters are passed in optionValues. The number of * total options is supplied via numOptions. Any outputs will be returned * via optionValues. Supported options are: * * - CU_JIT_MAX_REGISTERS: input specifies the maximum number of registers * per thread; * - CU_JIT_THREADS_PER_BLOCK: input specifies number of threads per block * to target compilation for; output returns the number of threads * the compiler actually targeted; * - CU_JIT_WALL_TIME: output returns the float value of wall clock time, * in milliseconds, spent compiling the PTX code; * - CU_JIT_INFO_LOG_BUFFER: input is a pointer to a buffer in which to * print any informational log messages from PTX assembly; * - CU_JIT_INFO_LOG_BUFFER_SIZE_BYTES: input is the size in bytes of the * buffer; output is the number of bytes filled with messages; * - CU_JIT_ERROR_LOG_BUFFER: input is a pointer to a buffer in which to * print any error log messages from PTX assembly; * - CU_JIT_ERROR_LOG_BUFFER_SIZE_BYTES: input is the size in bytes of the * buffer; output is the number of bytes filled with messages; * - CU_JIT_OPTIMIZATION_LEVEL: input is the level of optimization to apply * to generated code (0 - 4), with 4 being the default and highest * level; * - CU_JIT_TARGET_FROM_CUCONTEXT: causes compilation target to be * determined based on current attached context (default); * - CU_JIT_TARGET: input is the compilation target based on supplied * CUjit_target_enum; possible values are: * -- CU_TARGET_COMPUTE_10 * -- CU_TARGET_COMPUTE_11 * -- CU_TARGET_COMPUTE_12 * -- CU_TARGET_COMPUTE_13 * * \param module Returned module. * \param image Module data to load. * \param numOptions Number of options. * \param options Options for JIT. * \param optionValues Option values for JIT. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleLoadDataEx(CUmodule *module, const void *image, unsigned int num_options, CUjit_option *options, void **option_values) { CUresult result = 0; if (module == NULL || image == NULL || options == NULL || option_values == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "module is NULL or image is NULL or options is NULL or " "option_values is NULL"); goto error; } result = cuModuleLoadDataEx(module, image, num_options, options, option_values); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_LOAD_DATA_EX) == -1) goto error; return 0; error: return -1; } /** * \brief Takes a pointer fat_cubin and loads the corresponding module \"module\" * into the current context. The pointer represents a fat binary object, * which is a collection of different cubin files, all representing the * same device code, but compiled and optimized for different * architectures. There is currently no documented API for constructing * and using fat binary objects by programmers, and therefore this * function is an internal function in this version of CUDA. More * information can be found in the nvcc document. * * \param module Returned module. * \param fatCubin Fat binary to load. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleLoadFatBinary(CUmodule *module, const void *fat_cubin) { CUresult result = 0; if (module == NULL || fat_cubin == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "module is NULL or fatCubin is NULL"); goto error; } result = cuModuleLoadFatBinary(module, fat_cubin); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_LOAD_FAT_BINARY) == -1) goto error; return 0; error: return -1; } /** * \brief Unloads a module hmod from the current context. * * \param module Module to unload * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaModuleUnload(CUmodule hmod) { CUresult result = 0; result = cuModuleUnload(hmod); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MODULE_UNLOAD) == -1) goto error; return 0; error: return -1; } /****************************Memory_Management_API*****************************/ /** * \brief Creates a CUDA array according to the CUDA_ARRAY3D_DESCRIPTOR * structure pAllocateArray and returns a handle to the new CUDA * array in *p_handle. The CUDA_ARRAY3D_DESCRIPTOR is defined as: * * typedef struct { * unsigned int Width; * unsigned int Height; * unsigned int Depth; * CUarray_format Format; * unsigned int NumChannels; * unsigned int Flags; * } CUDA_ARRAY3D_DESCRIPTOR; * * where: * * - Width, Height, and Depth are the width, height, and depth of the * CUDA array (in elements); the CUDA array is one-dimensional if v * height and depth are 0, two-dimensional if depth is 0, and * three-dimensional otherwise; * - Format speci?es the format of the elements; CUarray_format is * defined as: * * typedef enum CUarray_format_enum { * CU_AD_FORMAT_UNSIGNED_INT8 = 0x01, * CU_AD_FORMAT_UNSIGNED_INT16 = 0x02, * CU_AD_FORMAT_UNSIGNED_INT32 = 0x03, * CU_AD_FORMAT_SIGNED_INT8 = 0x08, * CU_AD_FORMAT_SIGNED_INT16 = 0x09, * CU_AD_FORMAT_SIGNED_INT32 = 0x0a, * CU_AD_FORMAT_HALF = 0x10, * CU_AD_FORMAT_FLOAT = 0x20 * } CUarray_format; * * - NumChannels speci?es the number of packed components per CUDA array * element; it may be 1, 2, or 4; * - Flags provides for future features. For now, it must be set to 0. * * Here are examples of CUDA array descriptions: * * Description for a CUDA array of 2048 floats: * * CUDA_ARRAY3D_DESCRIPTOR desc; * desc.Format = CU_AD_FORMAT_FLOAT; * desc.NumChannels = 1; * desc.Width = 2048; * desc.Height = 0; * desc.Depth = 0; * * Description for a 64 x 64 CUDA array of floats: * * CUDA_ARRAY3D_DESCRIPTOR desc; * desc.Format = CU_AD_FORMAT_FLOAT; * desc.NumChannels = 1; * desc.Width = 64; * desc.Height = 64; * desc.Depth = 0; * * Description for a width x height x depth CUDA array of 64-bit, * 4x16-bit float16's: * * CUDA_ARRAY3D_DESCRIPTOR desc; * desc.FormatFlags = CU_AD_FORMAT_HALF; * desc.NumChannels = 4; * desc.Width = width; * desc.Height = height; * desc.Depth = depth; * * \param p_handle Returned Handle. * \param p_allocate_array 3D array descriptor. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaArray3DCreate(CUarray *p_handle, const CUDA_ARRAY3D_DESCRIPTOR *p_allocate_array) { CUresult result = 0; if (p_handle == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_handle is NULL"); goto error; } result = cuArray3DCreate(p_handle, p_allocate_array); if (SCCudaHandleRetValue(result, SC_CUDA_CU_ARRAY_3D_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *p_rray_descriptor a descriptor containing information on * the format and dimensions of the CUDA array h_array. It is useful for * subroutines that have been passed a CUDA array, but need to know the * CUDA array parameters for validation or other purposes. * * This function may be called on 1D and 2D arrays, in which case the * Height and/or Depth members of the descriptor struct will be set to 0. * * \param p_array_descriptor Returned 3D array descriptor. * \param h_array 3D array to get descriptor of. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaArray3DGetDescriptor(CUDA_ARRAY3D_DESCRIPTOR *p_array_descriptor, CUarray h_array) { CUresult result = 0; if (p_array_descriptor == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_array_descriptor is NULL"); goto error; } result = cuArray3DGetDescriptor(p_array_descriptor, h_array); if (SCCudaHandleRetValue(result, SC_CUDA_CU_ARRAY_3D_GET_DESCRIPTOR) == -1) goto error; return 0; error: return -1; } /** * \brief Creates a CUDA array according to the CUDA_ARRAY_DESCRIPTOR structure * p_allocate_array and returns a handle to the new CUDA array in * p_handle. The CUDA_ARRAY_DESCRIPTOR is defined as: * * typedef struct { * unsigned int Width; * unsigned int Height; * CUarray_format Format; * unsigned int NumChannels; * } CUDA_ARRAY_DESCRIPTOR; * * where: * * - Width, and Height are the width, and height of the CUDA array * (in elements); the CUDA array is one-dimensional if height is 0, * two-dimensional otherwise; * - Format speci?es the format of the elements; CUarray_format is * defined as: * * typedef enum CUarray_format_enum { * CU_AD_FORMAT_UNSIGNED_INT8 = 0x01, * CU_AD_FORMAT_UNSIGNED_INT16 = 0x02, * CU_AD_FORMAT_UNSIGNED_INT32 = 0x03, * CU_AD_FORMAT_SIGNED_INT8 = 0x08, * CU_AD_FORMAT_SIGNED_INT16 = 0x09, * CU_AD_FORMAT_SIGNED_INT32 = 0x0a, * CU_AD_FORMAT_HALF = 0x10, * CU_AD_FORMAT_FLOAT = 0x20 * } CUarray_format; * * - NumChannels specifies the number of packed components per CUDA * array element; it may be 1, 2, or 4; * * Here are examples of CUDA array descriptions: * * Description for a CUDA array of 2048 floats: * * CUDA_ARRAY_DESCRIPTOR desc; * desc.Format = CU_AD_FORMAT_FLOAT; * desc.NumChannels = 1; * desc.Width = 2048; * desc.Height = 1; * * Description for a 64 x 64 CUDA array of floats: * * CUDA_ARRAY_DESCRIPTOR desc; * desc.Format = CU_AD_FORMAT_FLOAT; * desc.NumChannels = 1; * desc.Width = 64; * desc.Height = 64; * * Description for a width x height CUDA array of 64-bit, 4x16-bit * float16's: * * CUDA_ARRAY_DESCRIPTOR desc; * desc.FormatFlags = CU_AD_FORMAT_HALF; * desc.NumChannels = 4; * desc.Width = width; * desc.Height = height; * * Description for a width x height CUDA array of 16-bit elements, each * of which is two 8-bit unsigned chars: * * CUDA_ARRAY_DESCRIPTOR arrayDesc; * desc.FormatFlags = CU_AD_FORMAT_UNSIGNED_INT8; * desc.NumChannels = 2; * desc.Width = width; * desc.Height = height; * * \param p_handle Returned array. * \param p_allocate_array Array descriptor. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaArrayCreate(CUarray *p_handle, const CUDA_ARRAY_DESCRIPTOR *p_allocate_array) { CUresult result = 0; if (p_handle == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_handle is NULL"); goto error; } result = cuArrayCreate(p_handle, p_allocate_array); if (SCCudaHandleRetValue(result, SC_CUDA_CU_ARRAY_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Destroys the CUDA array h_array. * * \param h_array Array to destroy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaArrayDestroy(CUarray h_array) { int result = cuArrayDestroy(h_array); if (SCCudaHandleRetValue(result, SC_CUDA_CU_ARRAY_DESTROY) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *p_array_descriptor a descriptor containing information on * the format and dimensions of the CUDA array h_array. It is useful for * subroutines that have been passed a CUDA array, but need to know the * CUDA array parameters for validation or other purposes. * * \param p_array_descriptor Returned array descriptor. * \param h_array Array to get descriptor of. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaArrayGetDescriptor(CUDA_ARRAY_DESCRIPTOR *p_array_descriptor, CUarray h_array) { CUresult result = 0; if (p_array_descriptor == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_array_descriptor is NULL"); goto error; } result = cuArrayGetDescriptor(p_array_descriptor, h_array); if (SCCudaHandleRetValue(result, SC_CUDA_CU_ARRAY_GET_DESCRIPTOR) == -1) goto error; return 0; error: return -1; } int SCCudaDeviceGetByPCIBusId(CUdevice *dev, char *pci_bus_id) { CUresult result = 0; result = cuDeviceGetByPCIBusId(dev, pci_bus_id); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_BY_PCI_BUS_ID) == -1) goto error; return 0; error: return -1; } int SCCudaDeviceGetPCIBusId(char *pci_bus_id, int len, CUdevice dev) { CUresult result = 0; result = cuDeviceGetPCIBusId(pci_bus_id, len, dev); if (SCCudaHandleRetValue(result, SC_CUDA_CU_DEVICE_GET_PCI_BUS_ID) == -1) goto error; return 0; error: return -1; } int SCCudaIpcCloseMemHandle(CUdeviceptr dptr) { CUresult result = 0; result = cuIpcCloseMemHandle(dptr); if (SCCudaHandleRetValue(result, SC_CUDA_CU_IPC_CLOSE_MEM_HANDLE) == -1) goto error; return 0; error: return -1; } int SCCudaIpcGetEventHandle(CUipcEventHandle *p_handle, CUevent event) { CUresult result = 0; result = cuIpcGetEventHandle(p_handle, event); if (SCCudaHandleRetValue(result, SC_CUDA_CU_IPC_GET_MEM_HANDLE) == -1) goto error; return 0; error: return -1; } int SCCudaIpcGetMemHandle(CUipcMemHandle *p_handle, CUdeviceptr dptr) { CUresult result = 0; result = cuIpcGetMemHandle(p_handle, dptr); if (SCCudaHandleRetValue(result, SC_CUDA_CU_IPC_GET_MEM_HANDLE) == -1) goto error; return 0; error: return -1; } int SCCudaIpcOpenEventHandle(CUevent *ph_event, CUipcEventHandle handle) { CUresult result = 0; result = cuIpcOpenEventHandle(ph_event, handle); if (SCCudaHandleRetValue(result, SC_CUDA_CU_IPC_GET_MEM_HANDLE) == -1) goto error; return 0; error: return -1; } int SCCudaIpcOpenMemHandle(CUdeviceptr *pdptr, CUipcMemHandle handle, unsigned int flags) { CUresult result = 0; result = cuIpcOpenMemHandle(pdptr, handle, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_IPC_OPEN_EVENT_HANDLE) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *p_array_descriptor a descriptor containing information on * the format and dimensions of the CUDA array h_array. It is useful for * subroutines that have been passed a CUDA array, but need to know the * CUDA array parameters for validation or other purposes. * * \param p_array_descriptor Returned array descriptor. * \param h_array Array to get descriptor of. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemAlloc(CUdeviceptr *dptr, size_t byte_size) { CUresult result = 0; if (dptr == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "dptr is NULL"); goto error; } result = cuMemAlloc(dptr, byte_size); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_ALLOC) == -1) goto error; return 0; error: return -1; } /** * \brief Allocates bytesize bytes of host memory that is page-locked and * accessible to the device. The driver tracks the vir-tual memory * ranges allocated with this function and automatically accelerates * calls to functions such as cuMemcpy(). Since the memory can be * accessed directly by the device, it can be read or written with * much higher bandwidth than pageable memory obtained with functions * such as SCMalloc(). Allocating excessive amounts of memory with * cuMemAllocHost() may degrade system performance, since it reduces * the amount of memory available to the system for paging. As a result, * this function is best used sparingly to allocate staging areas for * data exchange between host and device. * * \param pp Returned host pointer to page-locked memory. * \param byte_size Requested allocation size in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemAllocHost(void **pp, size_t byte_size) { CUresult result = 0; if (pp == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pp is NULL"); goto error; } result = cuMemAllocHost(pp, byte_size); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_ALLOC_HOST) == -1) goto error; return 0; error: return -1; } /** * \brief Allocates at least width_in_bytes * height bytes of linear memory on the * device and returns in *dptr a pointer to the allocated memory. The * function may pad the allocation to ensure that corresponding pointers in * any given row will continue to meet the alignment requirements for * coalescing as the address is updated from row to row. ElementSizeBytes * specifies the size of the largest reads and writes that will be * performed on the memory range. * * element_size_bytes may be 4, 8 or 16 (since coalesced memory * transactions are not possible on other data sizes). If element_size_bytes * is smaller than the actual read/write size of a kernel, the kernel will * run correctly, but possibly at reduced speed. The pitch returned in * *p_itch by cuMemAllocPitch() is the width in bytes of the allocation. * The intended usage of pitch is as a separate parameter of the allocation, * used to compute addresses within the 2D array. Given the row and column * of an array element of type T, the address is computed as: * * T * p_element = (T*)((char*)base_address + row * pitch) + column; * * The pitch returned by cuMemAllocPitch() is guaranteed to work with * cuMemcpy2D() under all circumstances. For allocations of 2D arrays, it * is recommended that programmers consider performing pitch allocations * using cuMemAllocPitch(). Due to alignment restrictions in the hardware, * this is especially true if the application will be performing 2D memory * copies between different regions of device memory (whether linear memory * or CUDA arrays). * * \param dptr Returned device pointer. * \param p_pitch Returned pitch of allocation in bytes. * \param width_in_bytes Requested allocation width in bytes. * \param height Requested allocation width in rows. * \param element_size_bytes Size of largest reads/writes for range. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemAllocPitch(CUdeviceptr *dptr, size_t *p_pitch, size_t width_in_bytes, size_t height, unsigned int element_size_bytes) { CUresult result = 0; if (dptr == NULL || p_pitch == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "dptr is NULL or p_pitch is NULL"); goto error; } result = cuMemAllocPitch(dptr, p_pitch, width_in_bytes, height, element_size_bytes); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_ALLOC_PITCH) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpy(CUdeviceptr dst, CUdeviceptr src, size_t byte_count) { CUresult result = 0; result = cuMemcpy(dst, src, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY) == -1) goto error; return 0; error: return -1; } /** * \brief Perform a 2D memory copy according to the parameters specified in * p_copy. The CUDA_MEMCPY2D structure is defined as: * * typedef struct CUDA_MEMCPY2D_st { * unsigned int srcXInBytes, srcY; * CUmemorytype srcMemoryType; * const void *srcHost; * CUdeviceptr srcDevice; * CUarray srcArray; * unsigned int srcPitch; * unsigned int dstXInBytes, dstY; * CUmemorytype dstMemoryType; * void *dstHost; * CUdeviceptr dstDevice; * CUarray dstArray; * unsigned int dstPitch; * unsigned int WidthInBytes; * unsigned int Height; * } CUDA_MEMCPY2D; * * where: * * - srcMemoryType and dstMemoryType specify the type of memory of the * source and destination, respectively; * * CUmemorytype_enum is de?ned as: * * typedef enum CUmemorytype_enum { * CU_MEMORYTYPE_HOST = 0x01, * CU_MEMORYTYPE_DEVICE = 0x02, * CU_MEMORYTYPE_ARRAY = 0x03 * } CUmemorytype; * * If srcMemoryType is CU_MEMORYTYPE_HOST, srcHost and srcPitch specify * the (host) base address of the source data and the bytes per row to * apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_DEVICE, srcDevice and srcPitch * specify the (device) base address of the source data and the bytes per * row to apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_ARRAY, srcArray speci?es the handle * of the source data. srcHost, srcDevice and srcPitch are ignored. * * If dstMemoryType is CU_MEMORYTYPE_HOST, dstHost and dstPitch specify * the (host) base address of the destination data and the bytes per row * to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_DEVICE, dstDevice and dstPitch * specify the (device) base address of the destination data and the * bytes per row to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_ARRAY, dstArray specifies the handle * of the destination data dstHost, dstDevice and dstPitch are ignored. * * - srcXInBytes and srcY specify the base address of the source data for * the copy. * * For host pointers, the starting address is * * void* Start = (void*)((char*)srcHost+srcY*srcPitch + srcXInBytes); * * For device pointers, the starting address is * * CUdeviceptr Start = srcDevice+srcY*srcPitch+srcXInBytes; * * For CUDA arrays, srcXInBytes must be evenly divisible by the array * element size. * * - dstXInBytes and dstY specify the base address of the destination data * for the copy. * * For host pointers, the base address is * * void* dstStart = (void*)((char*)dstHost+dstY*dstPitch + dstXInBytes); * * For device pointers, the starting address is * * CUdeviceptr dstStart = dstDevice+dstY*dstPitch+dstXInBytes; * * For CUDA arrays, dstXInBytes must be evenly divisible by the array * element size. * * - WidthInBytes and Height specify the width (in bytes) and height of * the 2D copy being performed. Any pitches must be greater than or * equal to WidthInBytes. * * cuMemcpy2D() returns an error if any pitch is greater than the * maximum allowed (CU_DEVICE_ATTRIBUTE_MAX_PITCH). cuMemAllocPitch() * passes back pitches that always work with cuMemcpy2D(). On intra-device * memory copies (device ? device, CUDA array ? device, CUDA array ? * CUDA array), cuMemcpy2D() may fail for pitches not computed by * cuMemAllocPitch(). cuMemcpy2DUnaligned() does not have this restriction, * but may run signi?cantly slower in the cases where cuMemcpy2D() would * have returned an error code. * * \param p_copy Parameters for the memory copy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpy2D(const CUDA_MEMCPY2D *p_copy) { CUresult result = 0; if (p_copy == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_copy is NULL"); goto error; } result = cuMemcpy2D(p_copy); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_2D) == -1) goto error; return 0; error: return -1; } /** * \brief Perform a 2D memory copy according to the parameters specified in * p_copy. The CUDA_MEMCPY2D structure is defined as: * * typedef struct CUDA_MEMCPY2D_st { * unsigned int srcXInBytes, srcY; * CUmemorytype srcMemoryType; * const void *srcHost; * CUdeviceptr srcDevice; * CUarray srcArray; * unsigned int srcPitch; * unsigned int dstXInBytes, dstY; * CUmemorytype dstMemoryType; * void *dstHost; * CUdeviceptr dstDevice; * CUarray dstArray; * unsigned int dstPitch; * unsigned int WidthInBytes; * unsigned int Height; * } CUDA_MEMCPY2D; * * where: * * - srcMemoryType and dstMemoryType specify the type of memory of the * source and destination, respectively; * * CUmemorytype_enum is de?ned as: * * typedef enum CUmemorytype_enum { * CU_MEMORYTYPE_HOST = 0x01, * CU_MEMORYTYPE_DEVICE = 0x02, * CU_MEMORYTYPE_ARRAY = 0x03 * } CUmemorytype; * * If srcMemoryType is CU_MEMORYTYPE_HOST, srcHost and srcPitch specify * the (host) base address of the source data and the bytes per row to * apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_DEVICE, srcDevice and srcPitch * specify the (device) base address of the source data and the bytes per * row to apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_ARRAY, srcArray speci?es the handle * of the source data. srcHost, srcDevice and srcPitch are ignored. * * If dstMemoryType is CU_MEMORYTYPE_HOST, dstHost and dstPitch specify * the (host) base address of the destination data and the bytes per row * to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_DEVICE, dstDevice and dstPitch * specify the (device) base address of the destination data and the * bytes per row to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_ARRAY, dstArray specifies the handle * of the destination data dstHost, dstDevice and dstPitch are ignored. * * - srcXInBytes and srcY specify the base address of the source data for * the copy. * * For host pointers, the starting address is * * void* Start = (void*)((char*)srcHost+srcY*srcPitch + srcXInBytes); * * For device pointers, the starting address is * * CUdeviceptr Start = srcDevice+srcY*srcPitch+srcXInBytes; * * For CUDA arrays, srcXInBytes must be evenly divisible by the array * element size. * * - dstXInBytes and dstY specify the base address of the destination data * for the copy. * * For host pointers, the base address is * * void* dstStart = (void*)((char*)dstHost+dstY*dstPitch + dstXInBytes); * * For device pointers, the starting address is * * CUdeviceptr dstStart = dstDevice+dstY*dstPitch+dstXInBytes; * * For CUDA arrays, dstXInBytes must be evenly divisible by the array * element size. * * - WidthInBytes and Height specify the width (in bytes) and height of * the 2D copy being performed. Any pitches must be greater than or * equal to WidthInBytes. * * cuMemcpy2D() returns an error if any pitch is greater than the * maximum allowed (CU_DEVICE_ATTRIBUTE_MAX_PITCH). cuMemAllocPitch() * passes back pitches that always work with cuMemcpy2D(). On intra-device * memory copies (device ? device, CUDA array ? device, CUDA array ? * CUDA array), cuMemcpy2D() may fail for pitches not computed by * cuMemAllocPitch(). cuMemcpy2DUnaligned() does not have this restriction, * but may run signi?cantly slower in the cases where cuMemcpy2D() would * have returned an error code. * * cuMemcpy2DAsync() is asynchronous and can optionally be associated to a * stream by passing a non-zero hStream argument. It only works on * page-locked host memory and returns an error if a pointer to pageable * memory is passed as input. * * \param p_copy Parameters for the memory copy. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpy2DAsync(const CUDA_MEMCPY2D *p_copy, CUstream h_stream) { CUresult result = 0; if (p_copy == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_copy is NULL"); goto error; } result = cuMemcpy2DAsync(p_copy, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_2D_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Perform a 2D memory copy according to the parameters specified in * p_copy. The CUDA_MEMCPY2D structure is defined as: * * typedef struct CUDA_MEMCPY2D_st { * unsigned int srcXInBytes, srcY; * CUmemorytype srcMemoryType; * const void *srcHost; * CUdeviceptr srcDevice; * CUarray srcArray; * unsigned int srcPitch; * unsigned int dstXInBytes, dstY; * CUmemorytype dstMemoryType; * void *dstHost; * CUdeviceptr dstDevice; * CUarray dstArray; * unsigned int dstPitch; * unsigned int WidthInBytes; * unsigned int Height; * } CUDA_MEMCPY2D; * * where: * * - srcMemoryType and dstMemoryType specify the type of memory of the * source and destination, respectively; * * CUmemorytype_enum is de?ned as: * * typedef enum CUmemorytype_enum { * CU_MEMORYTYPE_HOST = 0x01, * CU_MEMORYTYPE_DEVICE = 0x02, * CU_MEMORYTYPE_ARRAY = 0x03 * } CUmemorytype; * * If srcMemoryType is CU_MEMORYTYPE_HOST, srcHost and srcPitch specify * the (host) base address of the source data and the bytes per row to * apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_DEVICE, srcDevice and srcPitch * specify the (device) base address of the source data and the bytes per * row to apply. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_ARRAY, srcArray speci?es the handle * of the source data. srcHost, srcDevice and srcPitch are ignored. * * If dstMemoryType is CU_MEMORYTYPE_HOST, dstHost and dstPitch specify * the (host) base address of the destination data and the bytes per row * to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_DEVICE, dstDevice and dstPitch * specify the (device) base address of the destination data and the * bytes per row to apply. dstArray is ignored. * * If dstMemoryType is CU_MEMORYTYPE_ARRAY, dstArray specifies the handle * of the destination data dstHost, dstDevice and dstPitch are ignored. * * - srcXInBytes and srcY specify the base address of the source data for * the copy. * * For host pointers, the starting address is * * void* Start = (void*)((char*)srcHost+srcY*srcPitch + srcXInBytes); * * For device pointers, the starting address is * * CUdeviceptr Start = srcDevice+srcY*srcPitch+srcXInBytes; * * For CUDA arrays, srcXInBytes must be evenly divisible by the array * element size. * * - dstXInBytes and dstY specify the base address of the destination data * for the copy. * * For host pointers, the base address is * * void* dstStart = (void*)((char*)dstHost+dstY*dstPitch + dstXInBytes); * * For device pointers, the starting address is * * CUdeviceptr dstStart = dstDevice+dstY*dstPitch+dstXInBytes; * * For CUDA arrays, dstXInBytes must be evenly divisible by the array * element size. * * - WidthInBytes and Height specify the width (in bytes) and height of * the 2D copy being performed. Any pitches must be greater than or * equal to WidthInBytes. * * cuMemcpy2D() returns an error if any pitch is greater than the * maximum allowed (CU_DEVICE_ATTRIBUTE_MAX_PITCH). cuMemAllocPitch() * passes back pitches that always work with cuMemcpy2D(). On intra-device * memory copies (device ? device, CUDA array ? device, CUDA array ? * CUDA array), cuMemcpy2D() may fail for pitches not computed by * cuMemAllocPitch(). cuMemcpy2DUnaligned() does not have this restriction, * but may run signi?cantly slower in the cases where cuMemcpy2D() would * have returned an error code. * * cuMemcpy2DAsync() is asynchronous and can optionally be associated to a * stream by passing a non-zero hStream argument. It only works on * page-locked host memory and returns an error if a pointer to pageable * memory is passed as input. * * \param p_copy Parameters for the memory copy. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpy2DUnaligned(const CUDA_MEMCPY2D *p_copy) { CUresult result = 0; if (p_copy == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_copy is NULL"); goto error; } result = cuMemcpy2DUnaligned(p_copy); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_2D_UNALIGNED) == -1) goto error; return 0; error: return -1; } /** * \brief Perform a 3D memory copy according to the parameters specified in * p_copy. The CUDA_MEMCPY3D structure is defined as: * * typedef struct CUDA_MEMCPY3D_st { * unsigned int srcXInBytes, srcY, srcZ; * unsigned int srcLOD; * CUmemorytype srcMemoryType; * const void *srcHost; * CUdeviceptr srcDevice; * CUarray srcArray; * unsigned int srcPitch; // ignored when src is array * unsigned int srcHeight; // ignored when src is array; may be 0 if Depth==1 * unsigned int dstXInBytes, dstY, dstZ; * unsigned int dstLOD; * CUmemorytype dstMemoryType; * void *dstHost; * CUdeviceptr dstDevice; * CUarray dstArray; * unsigned int dstPitch; // ignored when dst is array * unsigned int dstHeight; // ignored when dst is array; may be 0 if Depth==1 * unsigned int WidthInBytes; * unsigned int Height; * unsigned int Depth; * } CUDA_MEMCPY3D; * * where: * * - srcMemoryType and dstMemoryType specify the type of memory of the * source and destination, respectively; * CUmemorytype_enum is defined as: * * typedef enum CUmemorytype_enum { * CU_MEMORYTYPE_HOST = 0x01, * CU_MEMORYTYPE_DEVICE = 0x02, * CU_MEMORYTYPE_ARRAY = 0x03 * } CUmemorytype; * * If srcMemoryType is CU_MEMORYTYPE_HOST, srcHost, srcPitch and srcHeight * specify the (host) base address of the source data, the bytes per row, * and the height of each 2D slice of the 3D array. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_DEVICE, srcDevice, srcPitch and * srcHeight specify the (device) base address of the source data, the * bytes per row, and the height of each 2D slice of the 3D array. * srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_ARRAY, srcArray specifies the handle * of the source data. srcHost, srcDevice, srcPitch and srcHeight are * ignored. If dstMemoryType is CU_MEMORYTYPE_HOST, dstHost and dstPitch * specify the (host) base address of the destination data, the bytes per * row, and the height of each 2D slice of the 3D array. dstArray is * ignored. * * If dstMemoryType is CU_MEMORYTYPE_DEVICE, dstDevice and dstPitch * specify the (device) base address of the destination data, the bytes * per row, and the height of each 2D slice of the 3D array. dstArray is * ignored. * * If dstMemoryType is CU_MEMORYTYPE_ARRAY, dstArray specifies the * handle of the destination data. dstHost, dstDevice, dstPitch and * dstHeight are ignored. * * - srcXInBytes, srcY and srcZ specify the base address of the source * data for the copy. * * For host pointers, the starting address is * * void* Start = (void*)((char*)srcHost+(srcZ*srcHeight+srcY)*srcPitch + srcXInBytes); * * For device pointers, the starting address is * * CUdeviceptr Start = srcDevice+(srcZ*srcHeight+srcY)*srcPitch+srcXInBytes; * * For CUDA arrays, srcXInBytes must be evenly divisible by the array * element size. * * - dstXInBytes, dstY and dstZ specify the base address of the destination * data for the copy. * * For host pointers, the base address is * * void* dstStart = (void*)((char*)dstHost+(dstZ*dstHeight+dstY)*dstPitch + dstXInBytes); * * For device pointers, the starting address is * * CUdeviceptr dstStart = dstDevice+(dstZ*dstHeight+dstY)*dstPitch+dstXInBytes; * * For CUDA arrays, dstXInBytes must be evenly divisible by the array * element size. * * - WidthInBytes, Height and Depth specify the width (in bytes), height * and depth of the 3D copy being performed. Any pitches must be greater * than or equal to WidthInBytes. * * cuMemcpy3D() returns an error if any pitch is greater than the maximum * allowed (CU_DEVICE_ATTRIBUTE_MAX_PITCH). * * The srcLOD and dstLOD members of the CUDA_MEMCPY3D structure must be * set to 0. * * \param p_copy Parameters for the memory copy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpy3D(const CUDA_MEMCPY3D *p_copy) { CUresult result = 0; if (p_copy == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_copy is NULL"); goto error; } result = cuMemcpy3D(p_copy); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_3D) == -1) goto error; return 0; error: return -1; } /** * \brief Perform a 3D memory copy according to the parameters specified in * p_copy. The CUDA_MEMCPY3D structure is defined as: * * typedef struct CUDA_MEMCPY3D_st { * unsigned int srcXInBytes, srcY, srcZ; * unsigned int srcLOD; * CUmemorytype srcMemoryType; * const void *srcHost; * CUdeviceptr srcDevice; * CUarray srcArray; * unsigned int srcPitch; // ignored when src is array * unsigned int srcHeight; // ignored when src is array; may be 0 if Depth==1 * unsigned int dstXInBytes, dstY, dstZ; * unsigned int dstLOD; * CUmemorytype dstMemoryType; * void *dstHost; * CUdeviceptr dstDevice; * CUarray dstArray; * unsigned int dstPitch; // ignored when dst is array * unsigned int dstHeight; // ignored when dst is array; may be 0 if Depth==1 * unsigned int WidthInBytes; * unsigned int Height; * unsigned int Depth; * } CUDA_MEMCPY3D; * * where: * * - srcMemoryType and dstMemoryType specify the type of memory of the * source and destination, respectively; * CUmemorytype_enum is defined as: * * typedef enum CUmemorytype_enum { * CU_MEMORYTYPE_HOST = 0x01, * CU_MEMORYTYPE_DEVICE = 0x02, * CU_MEMORYTYPE_ARRAY = 0x03 * } CUmemorytype; * * If srcMemoryType is CU_MEMORYTYPE_HOST, srcHost, srcPitch and srcHeight * specify the (host) base address of the source data, the bytes per row, * and the height of each 2D slice of the 3D array. srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_DEVICE, srcDevice, srcPitch and * srcHeight specify the (device) base address of the source data, the * bytes per row, and the height of each 2D slice of the 3D array. * srcArray is ignored. * * If srcMemoryType is CU_MEMORYTYPE_ARRAY, srcArray specifies the handle * of the source data. srcHost, srcDevice, srcPitch and srcHeight are * ignored. If dstMemoryType is CU_MEMORYTYPE_HOST, dstHost and dstPitch * specify the (host) base address of the destination data, the bytes per * row, and the height of each 2D slice of the 3D array. dstArray is * ignored. * * If dstMemoryType is CU_MEMORYTYPE_DEVICE, dstDevice and dstPitch * specify the (device) base address of the destination data, the bytes * per row, and the height of each 2D slice of the 3D array. dstArray is * ignored. * * If dstMemoryType is CU_MEMORYTYPE_ARRAY, dstArray specifies the * handle of the destination data. dstHost, dstDevice, dstPitch and * dstHeight are ignored. * * - srcXInBytes, srcY and srcZ specify the base address of the source * data for the copy. * * For host pointers, the starting address is * * void* Start = (void*)((char*)srcHost+(srcZ*srcHeight+srcY)*srcPitch + srcXInBytes); * * For device pointers, the starting address is * * CUdeviceptr Start = srcDevice+(srcZ*srcHeight+srcY)*srcPitch+srcXInBytes; * * For CUDA arrays, srcXInBytes must be evenly divisible by the array * element size. * * - dstXInBytes, dstY and dstZ specify the base address of the destination * data for the copy. * * For host pointers, the base address is * * void* dstStart = (void*)((char*)dstHost+(dstZ*dstHeight+dstY)*dstPitch + dstXInBytes); * * For device pointers, the starting address is * * CUdeviceptr dstStart = dstDevice+(dstZ*dstHeight+dstY)*dstPitch+dstXInBytes; * * For CUDA arrays, dstXInBytes must be evenly divisible by the array * element size. * * - WidthInBytes, Height and Depth specify the width (in bytes), height * and depth of the 3D copy being performed. Any pitches must be greater * than or equal to WidthInBytes. * * cuMemcpy3D() returns an error if any pitch is greater than the maximum * allowed (CU_DEVICE_ATTRIBUTE_MAX_PITCH). * * cuMemcpy3DAsync() is asynchronous and can optionally be associated * to a stream by passing a non-zero hStream argument. It only works on * page-locked host memory and returns an error if a pointer to pageable * memory is passed as input. * * The srcLOD and dstLOD members of the CUDA_MEMCPY3D structure must be * set to 0. * * \param p_copy Parameters for the memory copy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpy3DAsync(const CUDA_MEMCPY3D *p_copy, CUstream h_stream) { CUresult result = 0; if (p_copy == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_copy is NULL"); goto error; } result = cuMemcpy3DAsync(p_copy, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_3D_ASYNC) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpy3DPeer(const CUDA_MEMCPY3D_PEER *p_copy) { CUresult result = 0; result = cuMemcpy3DPeer(p_copy); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_3D_PEER) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpy3DPeerAsync(const CUDA_MEMCPY3D_PEER *p_copy, CUstream h_stream) { CUresult result = 0; result = cuMemcpy3DPeerAsync(p_copy, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_3D_PEER_ASYNC) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpyAsync(CUdeviceptr dst, CUdeviceptr src, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyAsync(dst, src, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from one 1D CUDA array to another. dstArray and srcArray * specify the handles of the destination and source CUDA arrays for the * copy, respectively. dstIndex and srcIndex specify the destination and * source indices into the CUDA array. These values are in the range * [0, Width-1] for the CUDA array; they are not byte offsets. ByteCount * is the number of bytes to be copied. The size of the elements in the * CUDA arrays need not be the same format, but the elements must be the * same size; and count must be evenly divisible by that size. * * \param dst_array Destination array. * \param dst_index Offset of destination array. * \param src_array Source array. * \param src_index Offset of source array. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyAtoA(CUarray dst_array, size_t dst_offset, CUarray src_array, size_t src_offset, size_t byte_count) { CUresult result = 0; result = cuMemcpyAtoA(dst_array, dst_offset, src_array, src_offset, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_A_TO_A) == -1) goto error; return 0; error: return -1; } /** * \param Copies from one 1D CUDA array to device memory. dstDevice specifies the * base pointer of the destination and must be naturally aligned with the * CUDA array elements. hSrc and SrcIndex specify the CUDA array handle and * the index (in array elements) of the array element where the copy is * to begin. ByteCount speci?es the number of bytes to copy and must be * evenly divisible by the array element size. * * \param dst_device Destination device pointer. * \param h_src Source array. * \param src_index Offset of source array. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyAtoD(CUdeviceptr dst_device, CUarray src_array, size_t src_offset, size_t byte_count) { CUresult result = 0; result = cuMemcpyAtoD(dst_device, src_array, src_offset, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_A_TO_D) == -1) goto error; return 0; error: return -1; } /** * \param Copies from one 1D CUDA array to host memory. dstHost specifies the * base pointer of the destination. srcArray and srcIndex specify the * CUDA array handle and starting index of the source data. ByteCount * specifies the number of bytes to copy. * * \param dst_device Destination device pointer. * \param h_src Source array. * \param src_index Offset of source array. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyAtoH(void *dst_host, CUarray src_array, size_t src_offset, size_t byte_count) { CUresult result = 0; result = cuMemcpyAtoH(dst_host, src_array, src_offset, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_A_TO_H) == -1) goto error; return 0; error: return -1; } /** * \param Copies from one 1D CUDA array to host memory. dstHost specifies the * base pointer of the destination. srcArray and srcIndex specify the * CUDA array handle and starting index of the source data. ByteCount * specifies the number of bytes to copy. * * cuMemcpyAtoHAsync() is asynchronous and can optionally be associated * to a stream by passing a non-zero stream argument. It only works on * page-locked host memory and returns an error if a pointer to pageable * memory is passed as input. * * \param dst_device Destination device pointer. * \param src_array Source array. * \param src_index Offset of source array. * \param byte_count Size of memory copy in bytes. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyAtoHAsync(void *dst_host, CUarray src_array, size_t src_offset, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyAtoHAsync(dst_host, src_array, src_offset, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_A_TO_H_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from device memory to a 1D CUDA array. dstArray and dstIndex * specify the CUDA array handle and starting index of the destination * data. srcDevice speci?es the base pointer of the source. ByteCount * specifies the number of bytes to copy. * * \param dst_array Destination array. * \param dst_index Offset of destination array. * \param src_device Source device pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyDtoA(CUarray dst_array, size_t dst_offset, CUdeviceptr src_device, size_t byte_count) { CUresult result = 0; result = cuMemcpyDtoA(dst_array, dst_offset, src_device, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_D_TO_A) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from device memory to device memory. dstDevice and srcDevice are * the base pointers of the destination and source, respectively. * byte_count specifies the number of bytes to copy. Note that this * function is asynchronous. * * \param dst_device Destination device pointer. * \param src_device Source device pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyDtoD(CUdeviceptr dst_device, CUdeviceptr src_device, size_t byte_count) { CUresult result = 0; result = cuMemcpyDtoD(dst_device, src_device, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_D_TO_D) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpyDtoDAsync(CUdeviceptr dst_device, CUdeviceptr src_device, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyDtoDAsync(dst_device, src_device, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_D_TO_D_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from device to host memory. dst_host and src_device specify * the base pointers of the destination and source, respectively. * byte_count specifies the number of bytes to copy. Note that this * function is synchronous. * * \param dst_host Destination device pointer. * \param src_device Source device pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyDtoH(void *dst_host, CUdeviceptr src_device, size_t byte_count) { CUresult result = 0; result = cuMemcpyDtoH(dst_host, src_device, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_D_TO_H) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from device to host memory. dst_host and src_device specify * the base pointers of the destination and source, respectively. * byte_count specifies the number of bytes to copy. * * cuMemcpyDtoHAsync() is asynchronous and can optionally be associated * to a stream by passing a non-zero h_stream argument. It only works * on page-locked memory and returns an error if a pointer to pageable * memory is passed as input. * * \param dst_host Destination device pointer. * \param src_device Source device pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyDtoHAsync(void *dst_host, CUdeviceptr src_device, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyDtoHAsync(dst_host, src_device, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_D_TO_H_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from host memory to a 1D CUDA array. dst_array and dst_index * specify the CUDA array handle and starting index of the destination * data. p_src specifies the base address of the source. byte_count * specifies the number of bytes to copy. * * \param dst_array Destination array. * \param dst_index Offset of destination array. * \param p_src Source host pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyHtoA(CUarray dst_array, size_t dst_offset, const void *src_host, size_t byte_count) { CUresult result = 0; result = cuMemcpyHtoA(dst_array, dst_offset, src_host, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_H_TO_A) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from host memory to a 1D CUDA array. dst_array and dst_index * specify the CUDA array handle and starting index of the destination * data. p_src specifies the base address of the source. byte_count * specfies the number of bytes to copy. * * cuMemcpyHtoAAsync() is asynchronous and can optionally be associated * to a stream by passing a non-zero h_stream argument. It only works on * page-locked memory and returns an error if a pointer to pageable * memory is passed as input. * * \param dst_array Destination array. * \param dst_index Offset of destination array. * \param p_src Source host pointer. * \param byte_count Size of memory copy in bytes. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyHtoAAsync(CUarray dst_array, size_t dst_offset, const void *src_host, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyHtoAAsync(dst_array, dst_offset, src_host, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_H_TO_A_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from host memory to device memory. dst_device and src_host * are the base addresses of the destination and source, respectively. * byte_count specifies the number of bytes to copy. Note that this * function is synchronous. * * \param dst_device Destination device pointer. * \param src_host Source host pointer. * \param byte_count Size of memory copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyHtoD(CUdeviceptr dst_device, const void *src_host, size_t byte_count) { CUresult result = 0; result = cuMemcpyHtoD(dst_device, src_host,byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_H_TO_D) == -1) goto error; return 0; error: return -1; } /** * \brief Copies from host memory to device memory. dst_device and src_host are * the base addresses of the destination and source, respectively. * byte_count specifies the number of bytes to copy. * * cuMemcpyHtoDAsync() is asynchronous and can optionally be associated * to a stream by passing a non-zero h_stream argument. It only works on * page-locked memory and returns an error if a pointer to pageable * memory is passed as input. * * * \param dst_device Destination device pointer. * \param src_host Source host pointer. * \param byte_count Size of memory copy in bytes. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemcpyHtoDAsync(CUdeviceptr dst_device, const void *src_host, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyHtoDAsync(dst_device, src_host, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_H_TO_D_ASYNC) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpyPeer(CUdeviceptr dst_device, CUcontext dst_context, CUdeviceptr src_device, CUcontext src_context, size_t byte_count) { CUresult result = 0; result = cuMemcpyPeer(dst_device, dst_context, src_device, src_context, byte_count); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_PEER) == -1) goto error; return 0; error: return -1; } int SCCudaMemcpyPeerAsync(CUdeviceptr dst_device, CUcontext dst_context, CUdeviceptr src_device, CUcontext src_context, size_t byte_count, CUstream h_stream) { CUresult result = 0; result = cuMemcpyPeerAsync(dst_device, dst_context, src_device, src_context, byte_count, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMCPY_PEER_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Frees the memory space pointed to by dptr, which must have been * returned by a previous call to cuMemAlloc() or cuMemAllocPitch(). * * \param dptr Pointer to the memory to free. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemFree(CUdeviceptr dptr) { CUresult result = 0; result = cuMemFree(dptr); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_FREE) == -1) goto error; return 0; error: return -1; } /** * \brief Frees the memory space pointed to by p, which must have been returned * by a previous call to cuMemAllocHost(). * * \param p Pointer to the memory to free. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemFreeHost(void *p) { CUresult result = 0; if (p == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p is NULL"); goto error; } result = cuMemFreeHost(p); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_FREE_HOST) == -1) goto error; return 0; error: return -1; } /** * \brief Returns the base address in *pbase and size in *psize of the allocation * by cuMemAlloc() or cuMemAllocPitch() that contains the input pointer * dptr. Both parameters pbase and psize are optional. If one of them is * NULL, it is ignored. * * \param pbase Returned base address. * \param psize Returned size of device memory allocation. * \param dptr Device pointer to query * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemGetAddressRange(CUdeviceptr *pbase, size_t *psize, CUdeviceptr dptr) { CUresult result = 0; result = cuMemGetAddressRange(pbase, psize, dptr); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_GET_ADDRESS_RANGE) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *free and *total respectively, the free and total amount * of memory available for allocation by the CUDA context, in bytes. * * \param free Returned free memory in bytes. * \param total Returned total memory in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemGetInfo(size_t *free, size_t *total) { CUresult result = 0; if (free == NULL || total == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "free is NULL || total is NULL"); goto error; } result = cuMemGetInfo(free, total); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_GET_INFO) == -1) goto error; return 0; error: return -1; } /** * \brief Allocates bytesize bytes of host memory that is page-locked and * accessible to the device. The driver tracks the virtual memory ranges * allocated with this function and automatically accelerates calls to * functions such as cuMemcpyHtoD(). Since the memory can be accessed * directly by the device, it can be read or written with much higher * bandwidth than pageable memory obtained with functions such as * SCMalloc(). Allocating excessive amounts of pinned memory may degrade * system performance, since it reduces the amount of memory available * to the system for paging. As a result, this function is best used * sparingly to allocate staging areas for data exchange between host * and device. * * The Flags parameter enables different options to be specified that * affect the allocation, as follows. * * - CU_MEMHOSTALLOC_PORTABLE: The memory returned by this call will be * considered as pinned memory by all CUDA contexts, not just the one * that performed the allocation. * - CU_MEMHOSTALLOC_DEVICEMAP: Maps the allocation into the CUDA * address space. The device pointer to the memory may be obtained by * calling cuMemHostGetDevicePointer(). This feature is available only * on GPUs with compute capability greater than or equal to 1.1. * - CU_MEMHOSTALLOC_WRITECOMBINED: Allocates the memory as write-combined * (WC). WC memory can be transferred across the PCI Express bus more * quickly on some system con?gurations, but cannot be read efficiently * by most CPUs. WC memory is a good option for buffers that will be * written by the CPU and read by the GPU via mapped pinned memory or * host->device transfers. All of these fags are orthogonal to one * another: a developer may allocate memory that is portable, mapped * and/or write-combined with no restrictions. * * The CUDA context must have been created with the CU_CTX_MAP_HOST flag * in order for the CU_MEMHOSTALLOC_MAPPED flag to have any effect. * * The CU_MEMHOSTALLOC_MAPPED flag may be specified on CUDA contexts for * devices that do not support mapped pinned memory. The failure is * deferred to cuMemHostGetDevicePointer() because the memory may be * mapped into other CUDA contexts via the CU_MEMHOSTALLOC_PORTABLE flag. * * The memory allocated by this function must be freed with cuMemFreeHost(). * * \param pp Returned host pointer to page-locked memory. * \param byte_size Requested allocation size in bytes. * \param flags Flags for allocation request. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemHostAlloc(void **pp, size_t byte_size, unsigned int flags) { CUresult result = 0; result = cuMemHostAlloc(pp, byte_size, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_HOST_ALLOC) == -1) goto error; return 0; error: return -1; } /** * \brief Passes back the device pointer pdptr corresponding to the mapped, * pinned host buffer p allocated by cuMemHostAlloc. * * cuMemHostGetDevicePointer() will fail if the CU_MEMALLOCHOST_DEVICEMAP * flag was not speci?ed at the time the memory was allocated, or if the * function is called on a GPU that does not support mapped pinned memory. * * Flags provides for future releases. For now, it must be set to 0. * * \param pdptr Returned device pointer. * \param p Host pointer. * \param flags Options(must be 0). * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemHostGetDevicePointer(CUdeviceptr *pdptr, void *p, unsigned int flags) { CUresult result = 0; result = cuMemHostGetDevicePointer(pdptr, p, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_HOST_GET_DEVICE_POINTER) == -1) goto error; return 0; error: return -1; } /** * \brief Passes back the flags p_flags that were specified when allocating the * pinned host buffer p allocated by cuMemHostAlloc. * * cuMemHostGetFlags() will fail if the pointer does not reside in an * allocation performed by cuMemAllocHost() or cuMemHostAlloc(). * * \param p_flags Returned flags word. * \param p Host pointer. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemHostGetFlags(unsigned int *p_flags, void *p) { CUresult result = 0; result = cuMemHostGetFlags(p_flags, p); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_HOST_GET_FLAGS) == -1) goto error; return 0; error: return -1; } int SCCudaMemHostRegister(void *p, size_t byte_size, unsigned int flags) { CUresult result = 0; result = cuMemHostRegister(p, byte_size, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_HOST_REGISTER) == -1) goto error; return 0; error: return -1; } int SCCudaMemHostUnregister(void *p) { CUresult result = 0; result = cuMemHostUnregister(p); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEM_HOST_UNREGISTER) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the memory range of N 16-bit values to the speci?ed value us. * * \param dst_device Destination device pointer. * \param us Value to set. * \param n Number of elements. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD16(CUdeviceptr dst_device, unsigned short us, size_t n) { CUresult result = 0; result = cuMemsetD16(dst_device, us, n); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D16) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD16Async(CUdeviceptr dst_device, unsigned short us, size_t n, CUstream h_stream) { CUresult result = 0; result = cuMemsetD16Async(dst_device, us, n, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D16_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the 2D memory range of Width 16-bit values to the specified * value us. Height specifies the number of rows to set, and dst_pitch * specifies the number of bytes between each row. This function * performs fastest when the pitch is one that has been passed back * by cuMemAllocPitch(). * * \param dst_device Destination device pointer. * \param dst_pitch Pitch of destination device pointer. * \param us Value to set * \param width Width of row. * \param height Number of rows * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD2D16(CUdeviceptr dst_device, size_t dst_pitch, unsigned short us, size_t width, size_t height) { CUresult result = 0; result = cuMemsetD2D16(dst_device, dst_pitch, us, width, height); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D16) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD2D16Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned short us, size_t width, size_t height, CUstream h_stream) { CUresult result = 0; result = cuMemsetD2D16Async(dst_device, dst_pitch, us, width, height, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D16_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the 2D memory range of Width 32-bit values to the specified value * ui. Height speci?es the number of rows to set, and dstPitch specifies * the number of bytes between each row. This function performs fastest * when the pitch is one that has been passed back by cuMemAllocPitch(). * * \param dst_device Destination device pointer. * \param dst_pitch Pitch of destination device pointer. * \param ui Value to set * \param width Width of row. * \param height Number of rows * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD2D32(CUdeviceptr dst_device, size_t dst_pitch, unsigned int ui, size_t width, size_t height) { CUresult result = 0; result = cuMemsetD2D32(dst_device, dst_pitch, ui, width, height); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D32) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD2D32Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned int ui, size_t width, size_t height, CUstream h_stream) { CUresult result = 0; result = cuMemsetD2D32Async(dst_device, dst_pitch, ui, width, height, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D32_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the 2D memory range of Width 8-bit values to the specified value * uc. Height speci?es the number of rows to set, and dstPitch specifies * the number of bytes between each row. This function performs fastest * when the pitch is one that has been passed back by cuMemAllocPitch(). * * \param dst_device Destination device pointer. * \param dst_pitch Pitch of destination device pointer. * \param uc Value to set * \param width Width of row. * \param height Number of rows * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD2D8(CUdeviceptr dst_device, size_t dst_pitch, unsigned char uc, size_t width, size_t height) { CUresult result = 0; result = cuMemsetD2D8(dst_device, dst_pitch, uc, width, height); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D8) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD2D8Async(CUdeviceptr dst_device, size_t dst_pitch, unsigned char uc, size_t width, size_t height, CUstream h_stream) { CUresult result = 0; result = cuMemsetD2D8Async(dst_device, dst_pitch, uc, width, height, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D2_D8_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the memory range of N 32-bit values to the specified value ui. * * \param dst_device Destination device pointer. * \param ui Value to set. * \param n Number of elements. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD32(CUdeviceptr dst_device, unsigned int ui, size_t n) { CUresult result = 0; result = cuMemsetD32(dst_device, ui, n); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D32) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD32Async(CUdeviceptr dst_device, unsigned int ui, size_t n, CUstream h_stream) { CUresult result = 0; result = cuMemsetD32Async(dst_device, ui, n, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D32_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets the memory range of N 8-bit values to the specified value ui. * * \param dst_device Destination device pointer. * \param uc Value to set. * \param n Number of elements. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaMemsetD8(CUdeviceptr dst_device, unsigned char uc, size_t n) { CUresult result = 0; result = cuMemsetD8(dst_device, uc, n); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D8) == -1) goto error; return 0; error: return -1; } int SCCudaMemsetD8Async(CUdeviceptr dst_device, unsigned char uc, size_t n, CUstream h_stream) { CUresult result = 0; result = cuMemsetD8Async(dst_device, uc, n, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_MEMSET_D8_ASYNC) == -1) goto error; return 0; error: return -1; } /*****************************Unified_Addressing_API****************************/ int SCCudaPointerGetAttribute(void *data, CUpointer_attribute attribute, CUdeviceptr ptr) { CUresult result = 0; result = cuPointerGetAttribute(data, attribute, ptr); if (SCCudaHandleRetValue(result, SC_CUDA_CU_POINTER_GET_ATTRIBUTE) == -1) goto error; return 0; error: return -1; } /*****************************Stream_Management_API****************************/ /** * \brief Creates a stream and returns a handle in ph_stream. Flags is * required to be 0. * * \param ph_stream Returned newly created stream. * \param flags Parameters for stream creation(must be 0). * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaStreamCreate(CUstream *ph_stream, unsigned int flags) { CUresult result = 0; if (ph_stream == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "phStream is NULL"); goto error; } result = cuStreamCreate(ph_stream, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_STREAM_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Destroys the stream specified by h_stream. * * \param h_stream Stream to destroy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaStreamDestroy(CUstream h_stream) { CUresult result = 0; result = cuStreamDestroy(h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_STREAM_DESTROY) == -1) goto error; return 0; error: return -1; } /** * \brief Returns CUDA_SUCCESS if all operations in the stream specifed by * h_stream have completed, or CUDA_ERROR_NOT_READY if not. * * \param h_stream Stream to query status of. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaStreamQuery(CUstream h_stream) { CUresult result = 0; result = cuStreamQuery(h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_STREAM_QUERY) == -1) goto error; return 0; error: return -1; } /** * \brief Waits until the device has completed all operations in the stream * specified by h_stream. * * \param h_stream Stream to wait for. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaStreamSynchronize(CUstream h_stream) { CUresult result = 0; result = cuStreamSynchronize(h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_STREAM_SYNCHRONIZE) == -1) goto error; return 0; error: return -1; } int SCCudaStreamWaitEvent(CUstream h_stream, CUevent h_event, unsigned int flags) { CUresult result = 0; result = cuStreamWaitEvent(h_stream, h_event, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_STREAM_WAIT_EVENT) == -1) goto error; return 0; error: return -1; } /*****************************Event_Management_API*****************************/ /** * \brief Creates an event *ph_event with the flags specified via flags. Valid * flags include: * * CU_EVENT_DEFAULT: Default event creation flag. * CU_EVENT_BLOCKING_SYNC: Specifies that event should use blocking * synchronization. * * \param ph_event Returns newly created event. * \param flags Event creation flags. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventCreate(CUevent *ph_event, unsigned int flags) { CUresult result = 0; if (ph_event == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "ph_event is NULL"); goto error; } result = cuEventCreate(ph_event, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Destroys the event specified by h_event. * * \param h_event Event to destroy. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventDestroy(CUevent h_event) { CUresult result = 0; result = cuEventDestroy(h_event); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_DESTROY) == -1) goto error; return 0; error: return -1; } /** * \brief Computes the elapsed time between two events (in milliseconds with * a resolution of around 0.5 microseconds). If either event has not * been recorded yet, this function returns CUDA_ERROR_NOT_READY. If * either event has been recorded with a non-zero stream, the result * is undefined. * * \param p_milli_seconds Returned elapsed time in milliseconds. * \param h_start Starting event. * \param h_end Ending event. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventElapsedTime(float *p_milli_seconds, CUevent h_start, CUevent h_end) { CUresult result = 0; if (p_milli_seconds == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_milli_seconds is NULL"); goto error; } result = cuEventElapsedTime(p_milli_seconds, h_start, h_end); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_ELAPSED_TIME) == -1) goto error; return 0; error: return -1; } /** * \brief Returns CUDA_SUCCESS if the event has actually been recorded, or * CUDA_ERROR_NOT_READY if not. If cuEventRecord() has not been called * on this event, the function returns CUDA_ERROR_INVALID_VALUE. * * \param h_event Event to query. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventQuery(CUevent h_event) { CUresult result = 0; result = cuEventQuery(h_event); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_QUERY) == -1) goto error; return 0; error: return -1; } /** * \brief Records an event. If stream is non-zero, the event is recorded after * all preceding operations in the stream have been completed; otherwise, * it is recorded after all preceding operations in the CUDA context have * been completed. Since operation is asynchronous, cuEventQuery() and/or * cuEventSynchronize() must be used to determine when the event has * actually been recorded. * * If cuEventRecord() has previously been called and the event has not * been recorded yet, this function returns CUDA_ERROR_INVALID_VALUE. * * \param h_event Event to record. * \param h_stream Stream to record event for. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventRecord(CUevent h_event, CUstream h_stream) { CUresult result = 0; result = cuEventRecord(h_event, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_RECORD) == -1) goto error; return 0; error: return -1; } /** * \brief Waits until the event has actually been recorded. If cuEventRecord() * has been called on this event, the function returns * CUDA_ERROR_INVALID_VALUE. * * If cuEventRecord() has previously been called and the event has not * been recorded yet, this function returns CUDA_ERROR_INVALID_VALUE. * * \param h_event Event to wait for. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaEventSynchronize(CUevent h_event) { CUresult result = 0; result = cuEventSynchronize(h_event); if (SCCudaHandleRetValue(result, SC_CUDA_CU_EVENT_SYNCHRONIZE) == -1) goto error; return 0; error: return -1; } /***********************Execution_Control_Management_API***********************/ /** * \brief Returns in *pi the integer value of the attribute attrib on the * kernel given by hfunc. The supported attributes are: * * - CU_FUNC_ATTRIBUTE_MAX_THREADS_PER_BLOCK: The number of threads * beyond which a launch of the function would fail. This number * depends on both the function and the device on which the * function is currently loaded. * - CU_FUNC_ATTRIBUTE_SHARED_SIZE_BYTES: The size in bytes of * statically-allocated shared memory required by this function. * This does not include dynamically-allocated shared memory * requested by the user at runtime. * - CU_FUNC_ATTRIBUTE_CONST_SIZE_BYTES: The size in bytes of * user-allocated constant memory required by this function. * - CU_FUNC_ATTRIBUTE_LOCAL_SIZE_BYTES: The size in bytes of thread * local memory used by this function. * - CU_FUNC_ATTRIBUTE_NUM_REGS: The number of registers used by each * thread of this function. * * \param pi Pointer to an integer which would be updated with the returned * attribute value. * \param attrib Attribute requested. * \param hfunc Function to query attribute of. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaFuncGetAttribute(int *pi, CUfunction_attribute attrib, CUfunction hfunc) { CUresult result = 0; if (pi == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pi is NULL"); goto error; } result = cuFuncGetAttribute(pi, attrib, hfunc); if (SCCudaHandleRetValue(result, SC_CUDA_CU_FUNC_GET_ATTRIBUTE) == -1) goto error; return 0; error: return -1; } int SCCudaFuncSetCacheConfig(CUfunction hfunc, CUfunc_cache config) { CUresult result = 0; result = cuFuncSetCacheConfig(hfunc, config); if (SCCudaHandleRetValue(result, SC_CUDA_CU_FUNC_SET_CACHE_CONFIG) == -1) goto error; return 0; error: return -1; } int SCCudaLaunchKernel(CUfunction f, unsigned int grid_dim_x, unsigned int grid_dim_y, unsigned int grid_dim_z, unsigned int block_dim_x, unsigned int block_dim_y, unsigned int block_dim_z, unsigned int shared_mem_bytes, CUstream h_stream, void **kernel_params, void **extra) { CUresult result = 0; result = cuLaunchKernel(f, grid_dim_x, grid_dim_y, grid_dim_z, block_dim_x, block_dim_y, block_dim_z, shared_mem_bytes, h_stream, kernel_params, extra); if (SCCudaHandleRetValue(result, SC_CUDA_CU_LAUNCH_KERNEL) == -1) goto error; return 0; error: return -1; } /** * \brief Specifies the x, y, and z dimensions of the thread blocks that are * created when the kernel given by hfunc is launched. * * \param hfunc Kernel to specify dimensions of. * \param x X dimension. * \param y Y dimension. * \param z Z dimension. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaFuncSetBlockShape(CUfunction hfunc, int x, int y, int z) { CUresult result = 0; result = cuFuncSetBlockShape(hfunc, x, y, z); if (SCCudaHandleRetValue(result, SC_CUDA_CU_FUNC_SET_BLOCK_SHAPE) == -1) goto error; return 0; error: return -1; } /** * \brief Sets through bytes the amount of dynamic shared memory that will be * available to each thread block when the kernel given by hfunc is * launched. * * \param hfunc Kernel to specify dynamic shared memory for. * \param bytes Dynamic shared memory size per thread in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaFuncSetSharedSize(CUfunction hfunc, unsigned int bytes) { CUresult result = 0; result = cuFuncSetSharedSize(hfunc, bytes); if (SCCudaHandleRetValue(result, SC_CUDA_CU_FUNC_SET_SHARED_SIZE) == -1) goto error; return 0; error: return -1; } /** * \brief Invokes the kernel f on a 1 x 1 x 1 grid of blocks. The block contains * the number of threads specified by a previous call to * cuFuncSetBlockShape(). * * \param f Kernel to launch. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaLaunch(CUfunction f) { CUresult result = 0; result = cuLaunch(f); if (SCCudaHandleRetValue(result, SC_CUDA_CU_LAUNCH) == -1) goto error; return 0; error: return -1; } /** * \brief Invokes the kernel f on a grid_width x grid_height grid of blocks. * Each block contains the number of threads specified by a previous call * to cuFuncSetBlockShape(). * * \param f Kernel to launch. * \param grid_width Width of grid in blocks. * \param grib_height Height of grid in blocks. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaLaunchGrid(CUfunction f, int grid_width, int grid_height) { CUresult result = 0; result = cuLaunchGrid(f, grid_width, grid_height); if (SCCudaHandleRetValue(result, SC_CUDA_CU_LAUNCH_GRID) == -1) goto error; return 0; error: return -1; } /** * \brief Invokes the kernel f on a grid_width x grid_height grid of blocks. * Each block contains the number of threads specified by a previous call * to cuFuncSetBlockShape(). cuLaunchGridAsync() can optionally be * associated to a stream by passing a non-zero hStream argument. * * \param f Kernel to launch. * \param grid_width Width of grid in blocks. * \param grib_height Height of grid in blocks. * \param h_stream Stream identifier. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaLaunchGridAsync(CUfunction f, int grid_width, int grid_height, CUstream h_stream) { CUresult result = 0; result = cuLaunchGridAsync(f, grid_width, grid_height, h_stream); if (SCCudaHandleRetValue(result, SC_CUDA_CU_LAUNCH_GRID_ASYNC) == -1) goto error; return 0; error: return -1; } /** * \brief Sets a foating-point parameter that will be specified the next time * the kernel corresponding to hfunc will be invoked. offset is a byte * offset. * * \param h_func Kernel to add parameter to. * \param offset Offset to add parameter to argument list. * \param value Value of parameter. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaParamSetf(CUfunction h_func, int offset, float value) { CUresult result = 0; result = cuParamSetf(h_func, offset, value); if (SCCudaHandleRetValue(result, SC_CUDA_CU_PARAM_SETF) == -1) goto error; return 0; error: return -1; } /** * \brief Sets an integer parameter that will be specified the next time * the kernel corresponding to hfunc will be invoked. offset is a byte * offset. * * \param h_func Kernel to add parameter to. * \param offset Offset to add parameter to argument list. * \param value Value of parameter. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaParamSeti(CUfunction h_func, int offset, unsigned int value) { CUresult result = 0; result = cuParamSeti(h_func, offset, value); if (SCCudaHandleRetValue(result, SC_CUDA_CU_PARAM_SETI) == -1) goto error; return 0; error: return -1; } /** * \brief Sets through numbytes the total size in bytes needed by the function * parameters of the kernel corresponding to hfunc. * * \param h_func Kernel to set parameter size for. * \param num_bytes Size of paramter list in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaParamSetSize(CUfunction h_func, unsigned int num_bytes) { CUresult result = 0; result = cuParamSetSize(h_func, num_bytes); if (SCCudaHandleRetValue(result, SC_CUDA_CU_PARAM_SET_SIZE) == -1) goto error; return 0; error: return -1; } /** * \brief Makes the CUDA array or linear memory bound to the texture reference * h_tex_ref available to a device program as a texture. In this version * of CUDA, the texture-reference must be obtained via cuModuleGetTexRef() * and the tex_unit parameter must be set to CU_PARAM_TR_DEFAULT. * * \param h_func Kernel to add texture-reference to. * \param tex_unit Texture unit (must be CU_PARAM_TR_DEFAULT). * \param h_tex_ref Texture-reference to add to argument list. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaParamSetTexRef(CUfunction h_func, int tex_unit, CUtexref h_tex_ref) { CUresult result = 0; result = cuParamSetTexRef(h_func, tex_unit, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_PARAM_SET_TEX_REF) == -1) goto error; return 0; error: return -1; } /** * \brief Copies an arbitrary amount of data (specified in numbytes) from ptr * into the parameter space of the kernel corresponding to hfunc. * offset is a byte offset. * * \param h_func Kernel to add data to. * \param offset Offset to add data to argument list. * \param ptr Pointer to arbitrary data. * \param num_bytes Size of data to copy in bytes. * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaParamSetv(CUfunction h_func, int offset, void *ptr, unsigned int num_bytes) { CUresult result = 0; if (ptr == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "ptr is NULL"); goto error; } result = cuParamSetv(h_func, offset, ptr, num_bytes); if (SCCudaHandleRetValue(result, SC_CUDA_CU_PARAM_SETV) == -1) goto error; return 0; error: return -1; } /***********************Texture_Reference_Management_API***********************/ /** * \brief Creates a texture reference and returns its handle in *pTexRef. Once * created, the application must call cuTexRefSetArray() or cuTexRefSetAddress() * to associate the reference with allocated memory. Other texture reference * functions are used to specify the format and interpretation (addressing, * filtering, etc.) to be used when the memory is read through this texture * reference. To associate the texture reference with a texture ordinal for * a given function, the application should call cuParamSetTexRef(). * * \param p_tex_ref Returned texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefCreate(CUtexref *p_tex_ref) { CUresult result = 0; if (p_tex_ref == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_tex_ref is NULL"); goto error; } result = cuTexRefCreate(p_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_CREATE) == -1) goto error; return 0; error: return -1; } /** * \brief Destroys the texture reference specified by hTexRef. * * \param h_tex_ref Texture reference to destroy * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefDestroy(CUtexref h_tex_ref) { CUresult result = 0; result = cuTexRefDestroy(h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_DESTROY) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *pdptr the base address bound to the texture reference * hTexRef, or returns CUDA_ERROR_INVALID_VALUE if the texture reference * is not bound to any device memory range. * * \param pdptr Returned device address * \param h_tex_ref Texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetAddress(CUdeviceptr *pdptr, CUtexref h_tex_ref) { CUresult result = 0; if (pdptr == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pdptr is NULL"); goto error; } result = cuTexRefGetAddress(pdptr, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_ADDRESS) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *pam the addressing mode corresponding to the dimension * dim of the texture reference hTexRef. Currently, the only valid value * for dim are 0 and 1. * * \param pam Returned addressing mode * \param h_tex_ref Texture reference * \param dim Dimension * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetAddressMode(CUaddress_mode *pam, CUtexref h_tex_ref, int dim) { CUresult result = 0; if (pam == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pam is NULL"); goto error; } result = cuTexRefGetAddressMode(pam, h_tex_ref, dim); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_ADDRESS_MODE) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *phArray the CUDA array bound to the texture reference * hTexRef, or returns CUDA_ERROR_INVALID_VALUE if the texture reference * is not bound to any CUDA array. * * \param ph_array Returned array * \param h_tex_ref Texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetArray(CUarray *ph_array, CUtexref h_tex_ref) { CUresult result = 0; if (ph_array == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "ph_array is NULL"); goto error; } result = cuTexRefGetArray(ph_array, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_ARRAY) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *pfm the filtering mode of the texture reference hTexRef. * * \param pfm Returned filtering mode * \param h_tex_ref Texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetFilterMode(CUfilter_mode *pfm, CUtexref h_tex_ref) { CUresult result = 0; if (pfm == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "pfm is NULL"); goto error; } result = cuTexRefGetFilterMode(pfm, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_FILTER_MODE) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *pFlags the flags of the texture reference hTexRef. * * \param p_flags Returned flags * \param h_tex_ref Texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetFlags(unsigned int *p_flags, CUtexref h_tex_ref) { CUresult result = 0; if (p_flags == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_flags is NULL"); goto error; } result = cuTexRefGetFlags(p_flags, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_FLAGS) == -1) goto error; return 0; error: return -1; } /** * \brief Returns in *pFormat and *pNumChannels the format and number of * components of the CUDA array bound to the texture reference hTexRef. * If pFormat or pNumChannels is NULL, it will be ignored. * * \param p_format Returned format * \param p_num_channels Returned number of components * \param h_tex_ref Texture reference * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefGetFormat(CUarray_format *p_format, int *p_num_channels, CUtexref h_tex_ref) { CUresult result = 0; if (p_format == NULL || p_num_channels == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "p_format == NULL || p_num_channels == NULL"); goto error; } result = cuTexRefGetFormat(p_format, p_num_channels, h_tex_ref); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_GET_FORMAT) == -1) goto error; return 0; error: return -1; } /** * \brief Binds a linear address range to the texture reference hTexRef. Any * previous address or CUDA array state associated with the texture * reference is superseded by this function. Any memory previously * bound to hTexRef is unbound. * * Since the hardware enforces an alignment requirement on texture * base addresses, cuTexRefSetAddress() passes back a byte offset in * *ByteOffset that must be applied to texture fetches in order to read * from the desired memory. This offset must be divided by the texel * size and passed to kernels that read from the texture so they can be * applied to the tex1Dfetch() function. * * If the device memory pointer was returned from cuMemAlloc(), the * offset is guaranteed to be 0 and NULL may be passed as the * ByteOffset parameter. * * \param byte_offset Returned byte offset * \param h_tex_ref Texture reference to bind * \param dptr Device pointer to bind * \param bytes Size of memory to bind in bytes * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetAddress(size_t *byte_offset, CUtexref h_tex_ref, CUdeviceptr dptr, unsigned int bytes) { CUresult result = 0; if (byte_offset == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid argument supplied. " "byte_offset is NULL"); goto error; } result = cuTexRefSetAddress(byte_offset, h_tex_ref, dptr, bytes); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_ADDRESS) == -1) goto error; return 0; error: return -1; } /** * \brief Binds a linear address range to the texture reference hTexRef. Any * previous address or CUDA array state associated with the texture * reference is superseded by this function. Any memory previously bound * to hTexRef is unbound. * * Using a tex2D() function inside a kernel requires a call to either * cuTexRefSetArray() to bind the corresponding texture reference to an * array, or cuTexRefSetAddress2D() to bind the texture reference to * linear memory. * * Function calls to cuTexRefSetFormat() cannot follow calls to * cuTexRefSetAddress2D() for the same texture reference. * * It is required that dptr be aligned to the appropriate hardware- * specific texture alignment. You can query this value using the device * attribute CU_DEVICE_ATTRIBUTE_TEXTURE_ALIGNMENT. If an unaligned dptr * is supplied, CUDA_ERROR_INVALID_VALUE is returned. * * \param h_tex_ref Texture reference to bind * \param desc Descriptor of CUDA array * \param dptr Device pointer to bind * \param pitch Line pitch in bytes * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetAddress2D(CUtexref h_tex_ref, const CUDA_ARRAY_DESCRIPTOR *desc, CUdeviceptr dptr, unsigned int pitch) { CUresult result = 0; result = cuTexRefSetAddress2D(h_tex_ref, desc, dptr, pitch); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_ADDRESS_2D) == -1) goto error; return 0; error: return -1; } /** * \brief Specifies the addressing mode am for the given dimension dim of the * texture reference hTexRef. If dim is zero, the addressing mode is * applied to the first parameter of the functions used to fetch from * the texture; if dim is 1, the second, and so on. CUaddress_mode is * defined as: * * typedef enum CUaddress_mode_enum { * CU_TR_ADDRESS_MODE_WRAP = 0, * CU_TR_ADDRESS_MODE_CLAMP = 1, * CU_TR_ADDRESS_MODE_MIRROR = 2, * } CUaddress_mode; * * \param h_tex_ref Texture reference * \param dim Dimension * \param am Addressing mode to set * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetAddressMode(CUtexref h_tex_ref, int dim, CUaddress_mode am) { CUresult result = 0; result = cuTexRefSetAddressMode(h_tex_ref, dim, am); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_ADDRESS_MODE) == -1) goto error; return 0; error: return -1; } /** * \brief Binds the CUDA array hArray to the texture reference hTexRef. Any * previous address or CUDA array state associated with the texture * reference is superseded by this function. Flags must be set to * CU_TRSA_OVERRIDE_FORMAT. Any CUDA array previously bound to hTexRef * is unbound. * * \param h_tex_ref Texture reference to bind * \param h_array Array to bind * \param flags Options (must be CU_TRSA_OVERRIDE_FORMAT) * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetArray(CUtexref h_tex_ref, CUarray h_array, unsigned int flags) { CUresult result = 0; result = cuTexRefSetArray(h_tex_ref, h_array, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_ARRAY) == -1) goto error; return 0; error: return -1; } /** * \brief Specifies the filtering mode fm to be used when reading memory through * the texture reference hTexRef. CUfilter_mode_enum is defined as: * * typedef enum CUfilter_mode_enum { * CU_TR_FILTER_MODE_POINT = 0, * CU_TR_FILTER_MODE_LINEAR = 1 * } CUfilter_mode; * * \param h_tex_ref Texture reference * \param fm Filtering mode to set * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetFilterMode(CUtexref h_tex_ref, CUfilter_mode fm) { CUresult result = 0; result = cuTexRefSetFilterMode(h_tex_ref, fm); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_FILTER_MODE) == -1) goto error; return 0; error: return -1; } /** * \brief Specifies optional flags via Flags to specify the behavior of data * returned through the texture reference hTexRef. The valid flags are: * * * CU_TRSF_READ_AS_INTEGER, which suppresses the default behavior of * having the texture promote integer data to floating point data in * the range [0, 1]; * * CU_TRSF_NORMALIZED_COORDINATES, which suppresses the default * behavior of having the texture coordinates range from [0, Dim) where * Dim is the width or height of the CUDA array. Instead, the texture * coordinates [0, 1.0) reference the entire breadth of the array * dimension; * * \param h_tex_ref Texture reference * \param flags Optional flags to set * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetFlags(CUtexref h_tex_ref, unsigned int flags) { CUresult result = 0; result = cuTexRefSetFlags(h_tex_ref, flags); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_FLAGS) == -1) goto error; return 0; error: return -1; } /** * \brief Specifies the format of the data to be read by the texture reference * hTexRef. fmt and NumPackedComponents are exactly analogous to the * Format and NumChannels members of the CUDA_ARRAY_DESCRIPTOR structure: * They specify the format of each component and the number of components * per array element. * * \param h_tex_ref Texture reference * \param fmt Format to set * \param num_packed_components Number of components per array element * * \retval 0 On success. * \retval -1 On failure. */ int SCCudaTexRefSetFormat(CUtexref h_tex_ref, CUarray_format fmt, int num_packed_components) { CUresult result = 0; result = cuTexRefSetFormat(h_tex_ref, fmt, num_packed_components); if (SCCudaHandleRetValue(result, SC_CUDA_CU_TEX_REF_SET_FORMAT) == -1) goto error; return 0; error: return -1; } /**************************Cuda_Env_Initialization_API*************************/ /** * \brief Initialize the CUDA Environment for the engine. * * \retval 0 On successfully initializing the CUDA environment for the engine. * \retval -1 On failure. */ int SCCudaInitCudaEnvironment(void) { if (devices != NULL) { SCLogWarning(SC_ERR_CUDA_ERROR, "CUDA engine already initalized!!!!"); return 0; } if (SCCudaInit(0) == -1) { SCLogError(SC_ERR_CUDA_ERROR, "Error initializing CUDA API. SCCudaInit() " "returned -1"); goto error; } if ( (devices = SCCudaGetDevices()) == NULL) { SCLogError(SC_ERR_CUDA_ERROR, "Error getting CUDA device list. " "SCCudaGetDevices() returned NULL"); goto error; } SCCudaPrintBasicDeviceInfo(devices); return 0; error: SCCudaDeAllocSCCudaDevices(devices); return -1; } /**********************************Cuda_Utility********************************/ /** * \brief List the cuda cards on the system. * */ void SCCudaListCards(void) { int i = 0; if (devices == NULL) { SCLogWarning(SC_ERR_CUDA_ERROR, "CUDA engine not initalized! Please " "initialize the cuda environment using " "SCCudaInitCudaEnvironment()."); return; } printf("CUDA Cards recognized by the suricata CUDA module - \n"); printf("|-----------------------------------------------------------------------------|\n"); printf("| %-10s | %-20s | %-10s | %-10s | %-13s |\n", "Device Id", " Device Name", " Multi-", "Clock Rate", "Cuda Compute"); printf("| %-10s | %-20s | %-10s | %-10s | %-13s |\n", "", "", "Processors", " (MHz)", "Capability"); printf("|-----------------------------------------------------------------------------|\n"); for (i = 0; i < devices->count; i++) { printf("| %-10d | %-20s | %-10d | %-10d | %d.%-11d |\n", i, devices->devices[i]->name, devices->devices[i]->attr_multiprocessor_count, devices->devices[i]->attr_clock_rate/1000, devices->devices[i]->major_rev, devices->devices[i]->minor_rev); } printf("|-----------------------------------------------------------------------------|\n"); return; } int SCCudaIsCudaDeviceIdValid(int cuda_device_id) { if (devices == NULL) { SCLogWarning(SC_ERR_CUDA_ERROR, "CUDA engine not initalized! Please " "initialize the cuda environment using " "SCCudaInitCudaEnvironment()."); return 0; } return (cuda_device_id < devices->count); } /**********************************Unittests***********************************/ int SCCudaTest01(void) { SCCudaDevices *devices = SCCudaGetDeviceList(); if (devices == NULL) return 0; return (devices->count != 0); } #if defined(__x86_64__) || defined(__ia64__) /** * extern "C" __global__ void SCCudaSuricataTest(int *input, int *output) * { * output[threadIdx.x] = input[threadIdx.x] * 2; * } */ static const char *sc_cuda_test_kernel_64_bit = " .version 1.4\n" " .target sm_10, map_f64_to_f32\n" " .entry SCCudaSuricataTest (\n" " .param .u64 __cudaparm_SCCudaSuricataTest_input,\n" " .param .u64 __cudaparm_SCCudaSuricataTest_output)\n" "{\n" " .reg .u32 %r<5>;\n" " .reg .u64 %rd<8>;\n" " .loc 15 1 0\n" " $LBB1_SCCudaSuricataTest:\n" " .loc 15 3 0\n" " cvt.u32.u16 %r1, %tid.x;\n" " cvt.u64.u32 %rd1, %r1;\n" " mul.lo.u64 %rd2, %rd1, 4;\n" " ld.param.u64 %rd3, [__cudaparm_SCCudaSuricataTest_input];\n" " add.u64 %rd4, %rd3, %rd2;\n" " ld.global.s32 %r2, [%rd4+0];\n" " mul.lo.s32 %r3, %r2, 2;\n" " ld.param.u64 %rd5, [__cudaparm_SCCudaSuricataTest_output];\n" " add.u64 %rd6, %rd5, %rd2;\n" " st.global.s32 [%rd6+0], %r3;\n" " .loc 15 4 0\n" " exit;\n" " $LDWend_SCCudaSuricataTest:\n" "} // SCCudaSuricataTest\n" "\n"; #else /** * extern "C" __global__ void SCCudaSuricataTest(int *input, int *output) * { * output[threadIdx.x] = input[threadIdx.x] * 2; * } */ static const char *sc_cuda_test_kernel_32_bit = " .version 1.4\n" " .target sm_10, map_f64_to_f32\n" " .entry SCCudaSuricataTest (\n" " .param .u32 __cudaparm_SCCudaSuricataTest_input,\n" " .param .u32 __cudaparm_SCCudaSuricataTest_output)\n" " {\n" " .reg .u16 %rh<3>;\n" " .reg .u32 %r<9>;\n" " .loc 15 2 0\n" "$LBB1_SCCudaSuricataTest:\n" " .loc 15 4 0\n" " mov.u16 %rh1, %tid.x;\n" " mul.wide.u16 %r1, %rh1, 4;\n" " ld.param.u32 %r2, [__cudaparm_SCCudaSuricataTest_input];\n" " add.u32 %r3, %r2, %r1;\n" " ld.global.s32 %r4, [%r3+0];\n" " mul.lo.s32 %r5, %r4, 2;\n" " ld.param.u32 %r6, [__cudaparm_SCCudaSuricataTest_output];\n" " add.u32 %r7, %r6, %r1;\n" " st.global.s32 [%r7+0], %r5;\n" " .loc 15 5 0\n" " exit;\n" "$LDWend_SCCudaSuricataTest:\n" " } // SCCudaSuricataTest\n" ""; #endif int SCCudaTest02(void) { #define ALIGN_UP(offset, alignment) do { \ (offset) = ((offset) + (alignment) - 1) & ~((alignment) - 1); \ } while (0) #define N 256 CUcontext context; CUmodule module; CUfunction kernel; CUdeviceptr d_input, d_output; int h_input[N]; int h_result[N]; SCCudaDevices *devices = SCCudaGetDeviceList(); int result = 0; int offset = 0; int i = 0; if (devices == NULL) goto end; if (devices->count == 0) goto end; if (SCCudaCtxCreate(&context, 0, devices->devices[0]->device) == -1) goto end; #if defined(__x86_64__) || defined(__ia64__) if (SCCudaModuleLoadData(&module, (void *)sc_cuda_test_kernel_64_bit) == -1) goto end; #else if (SCCudaModuleLoadData(&module, (void *)sc_cuda_test_kernel_32_bit) == -1) goto end; #endif if (SCCudaModuleGetFunction(&kernel, module, "SCCudaSuricataTest") == -1) goto end; for (i = 0; i < N; i++) h_input[i] = i * 2; if (SCCudaMemAlloc(&d_input, N * sizeof(int)) == -1) goto end; if (SCCudaMemcpyHtoD(d_input, h_input, N * sizeof(int)) == -1) goto end; if (SCCudaMemAlloc(&d_output, N * sizeof(int)) == -1) goto end; offset = 0; ALIGN_UP(offset, __alignof(void *)); if (SCCudaParamSetv(kernel, offset, (void *)&d_input, sizeof(void *)) == -1) goto end; offset += sizeof(void *); ALIGN_UP(offset, __alignof(void *)); if (SCCudaParamSetv(kernel, offset, (void *)&d_output, sizeof(void *)) == -1) goto end; offset += sizeof(void *); if (SCCudaParamSetSize(kernel, offset) == -1) goto end; if (SCCudaFuncSetBlockShape(kernel, N, 1, 1) == -1) goto end; if (SCCudaLaunchGrid(kernel, 1, 1) == -1) goto end; if (SCCudaMemcpyDtoH(h_result, d_output, N * sizeof(int)) == -1) goto end; for (i = 0; i < N; i++) h_input[i] = i * 4; for (i = 0; i < N; i++) { if (h_result[i] != h_input[i]) goto end; } if (SCCudaMemFree(d_input) == -1) goto end; if (SCCudaMemFree(d_output) == -1) goto end; if (SCCudaModuleUnload(module) == -1) goto end; if (SCCudaCtxDestroy(context) == -1) goto end; result = 1; end: return result; } void SCCudaRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("SCCudaTest01", SCCudaTest01); UtRegisterTest("SCCudaTest02", SCCudaTest02); #endif return; } #endif /* __SC_CUDA_SUPPORT__ */ suricata-3.2.1/src/util-strlcpyu.c0000644000000000000000000000512213051004444014005 00000000000000/* * Copyright (c) 1998 Todd C. Miller * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* $Id: strlcpyu.c,v 1.4 2003/10/20 15:03:27 chrisgreen Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" #endif #ifndef HAVE_STRLCPY #if defined(LIBC_SCCS) && !defined(lint) static char *rcsid = "$OpenBSD: strlcpy.c,v 1.4 1999/05/01 18:56:41 millert Exp $"; #endif /* LIBC_SCCS and not lint */ #include #include /* * Copy src to string dst of size siz. At most siz-1 characters * will be copied. Always NUL terminates (unless siz == 0). * Returns strlen(src); if retval >= siz, truncation occurred. */ size_t strlcpy(dst, src, siz) char *dst; const char *src; size_t siz; { register char *d = dst; register const char *s = src; register size_t n = siz; /* Copy as many bytes as will fit */ if (n != 0 && --n != 0) { do { if ((*d++ = *s++) == 0) break; } while (--n != 0); } /* Not enough room in dst, add NUL and traverse rest of src */ if (n == 0) { if (siz != 0) *d = '\0'; /* NUL-terminate dst */ while (*s++) ; } return(s - src - 1); /* count does not include NUL */ } #endif suricata-3.2.1/src/alert-debuglog.c0000644000000000000000000004324513051004444014052 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "stream.h" #include "app-layer-protos.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-print.h" #include "pkt-var.h" #include "util-unittest.h" #include "util-debug.h" #include "util-buffer.h" #include "output.h" #include "alert-debuglog.h" #include "util-privs.h" #include "flow-var.h" #include "flow-bit.h" #include "util-var-name.h" #include "util-optimize.h" #include "util-logopenfile.h" #include "util-time.h" #include "stream-tcp-reassemble.h" #define DEFAULT_LOG_FILENAME "alert-debug.log" #define MODULE_NAME "AlertDebugLog" typedef struct AlertDebugLogThread_ { LogFileCtx *file_ctx; /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ MemBuffer *buffer; } AlertDebugLogThread; /** * \brief Function to log the FlowVars in to alert-debug.log * * \param aft Pointer to AltertDebugLog Thread * \param p Pointer to the packet * */ static void AlertDebugLogFlowVars(AlertDebugLogThread *aft, const Packet *p) { const GenericVar *gv = p->flow->flowvar; uint16_t i; while (gv != NULL) { if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) { FlowVar *fv = (FlowVar *) gv; if (fv->datatype == FLOWVAR_TYPE_STR) { MemBufferWriteString(aft->buffer, "FLOWVAR idx(%"PRIu32"): ", fv->idx); for (i = 0; i < fv->data.fv_str.value_len; i++) { if (isprint(fv->data.fv_str.value[i])) { MemBufferWriteString(aft->buffer, "%c", fv->data.fv_str.value[i]); } else { MemBufferWriteString(aft->buffer, "\\%02X", fv->data.fv_str.value[i]); } } } else if (fv->datatype == FLOWVAR_TYPE_INT) { MemBufferWriteString(aft->buffer, "FLOWVAR idx(%"PRIu32"): " " %" PRIu32 "\"", fv->idx, fv->data.fv_int.value); } } gv = gv->next; } } /** * \brief Function to log the FlowBits in to alert-debug.log * * \param aft Pointer to AltertDebugLog Thread * \param p Pointer to the packet * * \todo const Packet ptr, requires us to change the * debuglog_flowbits_names logic. */ static void AlertDebugLogFlowBits(AlertDebugLogThread *aft, Packet *p) { int i; for (i = 0; i < p->debuglog_flowbits_names_len; i++) { if (p->debuglog_flowbits_names[i] != NULL) { MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n", p->debuglog_flowbits_names[i]); } } SCFree(p->debuglog_flowbits_names); p->debuglog_flowbits_names = NULL; p->debuglog_flowbits_names_len = 0; return; } /** * \brief Function to log the PktVars in to alert-debug.log * * \param aft Pointer to AltertDebugLog Thread * \param p Pointer to the packet * */ static void AlertDebugLogPktVars(AlertDebugLogThread *aft, const Packet *p) { const PktVar *pv = p->pktvar; while(pv != NULL) { MemBufferWriteString(aft->buffer, "PKTVAR: %s\n", pv->name); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, pv->value, pv->value_len); pv = pv->next; } } /** \todo doc * assume we have aft lock */ static int AlertDebugPrintStreamSegmentCallback(const Packet *p, void *data, uint8_t *buf, uint32_t buflen) { AlertDebugLogThread *aft = (AlertDebugLogThread *)data; MemBufferWriteString(aft->buffer, "STREAM DATA LEN: %"PRIu32"\n", buflen); MemBufferWriteString(aft->buffer, "STREAM DATA:\n"); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, buf, buflen); return 1; } static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_data) { AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data; int i; char timebuf[64]; const char *pkt_src_str = NULL; if (p->alerts.cnt == 0) return TM_ECODE_OK; MemBufferReset(aft->buffer); CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); MemBufferWriteString(aft->buffer, "+================\n" "TIME: %s\n", timebuf); if (p->pcap_cnt > 0) { MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); } pkt_src_str = PktSrcToString(p->pkt_src); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); char srcip[46], dstip[46]; if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); } MemBufferWriteString(aft->buffer, "SRC IP: %s\n" "DST IP: %s\n" "PROTO: %" PRIu32 "\n", srcip, dstip, p->proto); if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) { MemBufferWriteString(aft->buffer, "SRC PORT: %" PRIu32 "\n" "DST PORT: %" PRIu32 "\n", p->sp, p->dp); if (PKT_IS_TCP(p)) { MemBufferWriteString(aft->buffer, "TCP SEQ: %"PRIu32"\n" "TCP ACK: %"PRIu32"\n", TCP_GET_SEQ(p), TCP_GET_ACK(p)); } } /* flow stuff */ MemBufferWriteString(aft->buffer, "FLOW: to_server: %s, " "to_client: %s\n", p->flowflags & FLOW_PKT_TOSERVER ? "TRUE" : "FALSE", p->flowflags & FLOW_PKT_TOCLIENT ? "TRUE" : "FALSE"); if (p->flow != NULL) { int applayer = 0; applayer = StreamTcpAppLayerIsDisabled(p->flow); CreateTimeString(&p->flow->startts, timebuf, sizeof(timebuf)); MemBufferWriteString(aft->buffer, "FLOW Start TS: %s\n", timebuf); MemBufferWriteString(aft->buffer, "FLOW PKTS TODST: %"PRIu32"\n" "FLOW PKTS TOSRC: %"PRIu32"\n" "FLOW Total Bytes: %"PRIu64"\n", p->flow->todstpktcnt, p->flow->tosrcpktcnt, p->flow->todstbytecnt + p->flow->tosrcbytecnt); MemBufferWriteString(aft->buffer, "FLOW IPONLY SET: TOSERVER: %s, TOCLIENT: %s\n" "FLOW ACTION: DROP: %s\n" "FLOW NOINSPECTION: PACKET: %s, PAYLOAD: %s, APP_LAYER: %s\n" "FLOW APP_LAYER: DETECTED: %s, PROTO %"PRIu16"\n", p->flow->flags & FLOW_TOSERVER_IPONLY_SET ? "TRUE" : "FALSE", p->flow->flags & FLOW_TOCLIENT_IPONLY_SET ? "TRUE" : "FALSE", p->flow->flags & FLOW_ACTION_DROP ? "TRUE" : "FALSE", p->flow->flags & FLOW_NOPACKET_INSPECTION ? "TRUE" : "FALSE", p->flow->flags & FLOW_NOPAYLOAD_INSPECTION ? "TRUE" : "FALSE", applayer ? "TRUE" : "FALSE", (p->flow->alproto != ALPROTO_UNKNOWN) ? "TRUE" : "FALSE", p->flow->alproto); AlertDebugLogFlowVars(aft, p); AlertDebugLogFlowBits(aft, (Packet *)p); /* < no const */ } AlertDebugLogPktVars(aft, p); /* any stuff */ /* Sig details? */ MemBufferWriteString(aft->buffer, "PACKET LEN: %" PRIu32 "\n" "PACKET:\n", GET_PKT_LEN(p)); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, GET_PKT_DATA(p), GET_PKT_LEN(p)); MemBufferWriteString(aft->buffer, "ALERT CNT: %" PRIu32 "\n", p->alerts.cnt); for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } MemBufferWriteString(aft->buffer, "ALERT MSG [%02d]: %s\n" "ALERT GID [%02d]: %" PRIu32 "\n" "ALERT SID [%02d]: %" PRIu32 "\n" "ALERT REV [%02d]: %" PRIu32 "\n" "ALERT CLASS [%02d]: %s\n" "ALERT PRIO [%02d]: %" PRIu32 "\n" "ALERT FOUND IN [%02d]: %s\n", i, pa->s->msg, i, pa->s->gid, i, pa->s->id, i, pa->s->rev, i, pa->s->class_msg ? pa->s->class_msg : "", i, pa->s->prio, i, pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH ? "STREAM" : (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH ? "STATE" : "PACKET")); if (pa->flags & PACKET_ALERT_FLAG_TX) { MemBufferWriteString(aft->buffer, "ALERT IN TX [%02d]: %"PRIu64"\n", i, pa->tx_id); } else { MemBufferWriteString(aft->buffer, "ALERT IN TX [%02d]: N/A\n", i); } if (p->payload_len > 0) { MemBufferWriteString(aft->buffer, "PAYLOAD LEN: %" PRIu32 "\n" "PAYLOAD:\n", p->payload_len); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, p->payload, p->payload_len); } if ((pa->flags & PACKET_ALERT_FLAG_STATE_MATCH) || (pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH)) { /* This is an app layer or stream alert */ int ret; uint8_t flag; if (!(PKT_IS_TCP(p)) || p->flow == NULL || p->flow->protoctx == NULL) { return TM_ECODE_OK; } /* IDS mode reverse the data */ /** \todo improve the order selection policy */ if (p->flowflags & FLOW_PKT_TOSERVER) { flag = FLOW_PKT_TOCLIENT; } else { flag = FLOW_PKT_TOSERVER; } ret = StreamSegmentForEach((const Packet *)p, flag, AlertDebugPrintStreamSegmentCallback, (void *)aft); if (ret < 0) { return TM_ECODE_FAILED; } } } SCMutexLock(&aft->file_ctx->fp_mutex); aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx); aft->file_ctx->alerts += p->alerts.cnt; SCMutexUnlock(&aft->file_ctx->fp_mutex); return TM_ECODE_OK; } static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *thread_data) { AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data; int i; char timebuf[64]; const char *pkt_src_str = NULL; if (p->alerts.cnt == 0) return TM_ECODE_OK; MemBufferReset(aft->buffer); CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); MemBufferWriteString(aft->buffer, "+================\n" "TIME: %s\n", timebuf); if (p->pcap_cnt > 0) { MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); } pkt_src_str = PktSrcToString(p->pkt_src); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); MemBufferWriteString(aft->buffer, "ALERT CNT: %" PRIu32 "\n", p->alerts.cnt); for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } MemBufferWriteString(aft->buffer, "ALERT MSG [%02d]: %s\n" "ALERT GID [%02d]: %" PRIu32 "\n" "ALERT SID [%02d]: %" PRIu32 "\n" "ALERT REV [%02d]: %" PRIu32 "\n" "ALERT CLASS [%02d]: %s\n" "ALERT PRIO [%02d]: %" PRIu32 "\n", i, pa->s->msg, i, pa->s->gid, i, pa->s->id, i, pa->s->rev, i, pa->s->class_msg, i, pa->s->prio); } MemBufferWriteString(aft->buffer, "PACKET LEN: %" PRIu32 "\n" "PACKET:\n", GET_PKT_LEN(p)); PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size, GET_PKT_DATA(p), GET_PKT_LEN(p)); SCMutexLock(&aft->file_ctx->fp_mutex); aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer), MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx); aft->file_ctx->alerts += p->alerts.cnt; SCMutexUnlock(&aft->file_ctx->fp_mutex); return TM_ECODE_OK; } static TmEcode AlertDebugLogThreadInit(ThreadVars *t, void *initdata, void **data) { AlertDebugLogThread *aft = SCMalloc(sizeof(AlertDebugLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(AlertDebugLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for AlertDebugLog. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /** Use the Ouptut Context (file pointer and mutex) */ aft->file_ctx = ((OutputCtx *)initdata)->data; /* 1 mb seems sufficient enough */ aft->buffer = MemBufferCreateNew(1 * 1024 * 1024); if (aft->buffer == NULL) { SCFree(aft); return TM_ECODE_FAILED; } *data = (void *)aft; return TM_ECODE_OK; } static TmEcode AlertDebugLogThreadDeinit(ThreadVars *t, void *data) { AlertDebugLogThread *aft = (AlertDebugLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } MemBufferFree(aft->buffer); /* clear memory */ memset(aft, 0, sizeof(AlertDebugLogThread)); SCFree(aft); return TM_ECODE_OK; } static void AlertDebugLogExitPrintStats(ThreadVars *tv, void *data) { AlertDebugLogThread *aft = (AlertDebugLogThread *)data; if (aft == NULL) { return; } SCLogInfo("(%s) Alerts %" PRIu64 "", tv->name, aft->file_ctx->alerts); } static void AlertDebugLogDeInitCtx(OutputCtx *output_ctx) { if (output_ctx != NULL) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; if (logfile_ctx != NULL) { LogFileFreeCtx(logfile_ctx); } SCFree(output_ctx); } } /** * \brief Create a new LogFileCtx for alert debug logging. * * \param ConfNode containing configuration for this logger. * * \return output_ctx if succesful, NULL otherwise */ static OutputCtx *AlertDebugLogInitCtx(ConfNode *conf) { LogFileCtx *file_ctx = NULL; file_ctx = LogFileNewCtx(); if (file_ctx == NULL) { SCLogDebug("couldn't create new file_ctx"); goto error; } if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { goto error; } OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) goto error; memset(output_ctx, 0x00, sizeof(OutputCtx)); output_ctx->data = file_ctx; output_ctx->DeInit = AlertDebugLogDeInitCtx; SCLogDebug("Alert debug log output initialized"); return output_ctx; error: if (file_ctx != NULL) { LogFileFreeCtx(file_ctx); } return NULL; } static int AlertDebugLogCondition(ThreadVars *tv, const Packet *p) { return (p->alerts.cnt ? TRUE : FALSE); } static int AlertDebugLogLogger(ThreadVars *tv, void *thread_data, const Packet *p) { if (PKT_IS_IPV4(p) || PKT_IS_IPV6(p)) { return AlertDebugLogger(tv, p, thread_data); } else if (p->events.cnt > 0) { return AlertDebugLogDecoderEvent(tv, p, thread_data); } return TM_ECODE_OK; } void AlertDebugLogRegister(void) { OutputRegisterPacketModule(LOGGER_ALERT_DEBUG, MODULE_NAME, "alert-debug", AlertDebugLogInitCtx, AlertDebugLogLogger, AlertDebugLogCondition, AlertDebugLogThreadInit, AlertDebugLogThreadDeinit, AlertDebugLogExitPrintStats); } suricata-3.2.1/src/detect-fragbits.c0000644000000000000000000004313013051004444014215 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * \author Victor Julien * * Implements fragbits keyword */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter.h" #include "detect-engine-prefilter-common.h" #include "flow-var.h" #include "decode-events.h" #include "app-layer.h" #include "app-layer-detect-proto.h" #include "detect-fragbits.h" #include "util-unittest.h" #include "util-debug.h" #include "pkt-var.h" #include "host.h" #include "util-profiling.h" /** * Regex * fragbits: [!+*](MDR) */ #define PARSE_REGEX "^\\s*(?:([\\+\\*!]))?\\s*([MDR]+)" /** * FragBits args[0] *(3) +(2) !(1) * */ #define MODIFIER_NOT 1 #define MODIFIER_PLUS 2 #define MODIFIER_ANY 3 #define FRAGBITS_HAVE_MF 0x01 #define FRAGBITS_HAVE_DF 0x02 #define FRAGBITS_HAVE_RF 0x04 static pcre *parse_regex; static pcre_extra *parse_regex_study; static int DetectFragBitsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectFragBitsSetup (DetectEngineCtx *, Signature *, char *); static void DetectFragBitsFree(void *); static int PrefilterSetupFragBits(SigGroupHead *sgh); static _Bool PrefilterFragBitsIsPrefilterable(const Signature *s); /** * \brief Registration function for fragbits: keyword */ void DetectFragBitsRegister (void) { sigmatch_table[DETECT_FRAGBITS].name = "fragbits"; sigmatch_table[DETECT_FRAGBITS].desc = "check if the fragmentation and reserved bits are set in the IP header"; sigmatch_table[DETECT_FRAGBITS].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#fragbits"; sigmatch_table[DETECT_FRAGBITS].Match = DetectFragBitsMatch; sigmatch_table[DETECT_FRAGBITS].Setup = DetectFragBitsSetup; sigmatch_table[DETECT_FRAGBITS].Free = DetectFragBitsFree; sigmatch_table[DETECT_FRAGBITS].RegisterTests = FragBitsRegisterTests; sigmatch_table[DETECT_FRAGBITS].SetupPrefilter = PrefilterSetupFragBits; sigmatch_table[DETECT_FRAGBITS].SupportsPrefilter = PrefilterFragBitsIsPrefilterable; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static inline int FragBitsMatch(const uint8_t pbits, const uint8_t modifier, const uint8_t dbits) { switch (modifier) { case MODIFIER_ANY: if ((pbits & dbits) > 0) return 1; return 0; case MODIFIER_PLUS: if (((pbits & dbits) == dbits) && (((pbits - dbits) > 0))) return 1; return 0; case MODIFIER_NOT: if ((pbits & dbits) != dbits) return 1; return 0; default: if (pbits == dbits) return 1; } return 0; } /** * \internal * \brief This function is used to match fragbits on a packet with those passed via fragbits: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param s pointer to the Signature * \param m pointer to the sigmatch * * \retval 0 no match * \retval 1 match */ static int DetectFragBitsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { if (!ctx || !PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) return 0; uint8_t fragbits = 0; const DetectFragBitsData *de = (const DetectFragBitsData *)ctx; if(IPV4_GET_MF(p)) fragbits |= FRAGBITS_HAVE_MF; if(IPV4_GET_DF(p)) fragbits |= FRAGBITS_HAVE_DF; if(IPV4_GET_RF(p)) fragbits |= FRAGBITS_HAVE_RF; return FragBitsMatch(fragbits, de->modifier, de->fragbits); } /** * \internal * \brief This function is used to parse fragbits options passed via fragbits: keyword * * \param rawstr Pointer to the user provided fragbits options * * \retval de pointer to DetectFragBitsData on success * \retval NULL on failure */ static DetectFragBitsData *DetectFragBitsParse (char *rawstr) { DetectFragBitsData *de = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, found = 0, res = 0; int ov[MAX_SUBSTRINGS]; const char *str_ptr = NULL; char *args[2] = { NULL, NULL}; char *ptr; int i; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); goto error; } for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS,i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i] = (char *)str_ptr; } if(args[1] == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "invalid value"); goto error; } de = SCMalloc(sizeof(DetectFragBitsData)); if (unlikely(de == NULL)) goto error; memset(de,0,sizeof(DetectFragBitsData)); /** First parse args[0] */ if(args[0]) { ptr = args[0]; while (*ptr != '\0') { switch (*ptr) { case '!': de->modifier = MODIFIER_NOT; break; case '+': de->modifier = MODIFIER_PLUS; break; case '*': de->modifier = MODIFIER_ANY; break; } ptr++; } } /** Second parse first set of fragbits */ ptr = args[1]; while (*ptr != '\0') { switch (*ptr) { case 'M': case 'm': de->fragbits |= FRAGBITS_HAVE_MF; found++; break; case 'D': case 'd': de->fragbits |= FRAGBITS_HAVE_DF; found++; break; case 'R': case 'r': de->fragbits |= FRAGBITS_HAVE_RF; found++; break; default: found = 0; break; } ptr++; } if(found == 0) goto error; for (i = 0; i < 2; i++) { if (args[i] != NULL) SCFree(args[i]); } return de; error: for (i = 0; i < 2; i++) { if (args[i] != NULL) SCFree(args[i]); } if (de != NULL) SCFree(de); return NULL; } /** * \internal * \brief this function is used to add the parsed fragbits into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param m pointer to the Current SigMatch * \param rawstr pointer to the user provided fragbits options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectFragBitsSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { DetectFragBitsData *de = NULL; SigMatch *sm = NULL; de = DetectFragBitsParse(rawstr); if (de == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FRAGBITS; sm->ctx = (SigMatchCtx *)de; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (de) SCFree(de); if (sm) SCFree(sm); return -1; } /** * \internal * \brief this function will free memory associated with DetectFragBitsData * * \param de pointer to DetectFragBitsData */ static void DetectFragBitsFree(void *de_ptr) { DetectFragBitsData *de = (DetectFragBitsData *)de_ptr; if(de) SCFree(de); } static void PrefilterPacketFragBitsMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { const PrefilterPacketHeaderCtx *ctx = pectx; if (!PKT_IS_IPV4(p) || PKT_IS_PSEUDOPKT(p)) return; uint8_t fragbits = 0; if (IPV4_GET_MF(p)) fragbits |= FRAGBITS_HAVE_MF; if (IPV4_GET_DF(p)) fragbits |= FRAGBITS_HAVE_DF; if (IPV4_GET_RF(p)) fragbits |= FRAGBITS_HAVE_RF; if (FragBitsMatch(fragbits, ctx->v1.u8[0], ctx->v1.u8[1])) { PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } static void PrefilterPacketFragBitsSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectFragBitsData *fb = smctx; v->u8[0] = fb->modifier; v->u8[1] = fb->fragbits; } static _Bool PrefilterPacketFragBitsCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectFragBitsData *fb = smctx; if (v.u8[0] == fb->modifier && v.u8[1] == fb->fragbits) { return TRUE; } return FALSE; } static int PrefilterSetupFragBits(SigGroupHead *sgh) { return PrefilterSetupPacketHeader(sgh, DETECT_FRAGBITS, PrefilterPacketFragBitsSet, PrefilterPacketFragBitsCompare, PrefilterPacketFragBitsMatch); } static _Bool PrefilterFragBitsIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_FRAGBITS: return TRUE; } } return FALSE; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS /** * \test FragBitsTestParse01 is a test for a valid fragbits value * * \retval 1 on succces * \retval 0 on failure */ static int FragBitsTestParse01 (void) { DetectFragBitsData *de = NULL; de = DetectFragBitsParse("M"); if (de && (de->fragbits == FRAGBITS_HAVE_MF) ) { DetectFragBitsFree(de); return 1; } return 0; } /** * \test FragBitsTestParse02 is a test for an invalid fragbits value * * \retval 1 on succces * \retval 0 on failure */ static int FragBitsTestParse02 (void) { DetectFragBitsData *de = NULL; de = DetectFragBitsParse("G"); if (de) { DetectFragBitsFree(de); return 0; } return 1; } /** * \test FragBitsTestParse03 test if DONT FRAG is set. Must return success * * \retval 1 on success * \retval 0 on failure */ static int FragBitsTestParse03 (void) { uint8_t raw_eth[] = { 0x00 ,0x40 ,0x33 ,0xd9 ,0x7c ,0xfd ,0x00 ,0x00, 0x39 ,0xcf ,0xd9 ,0xcd ,0x08 ,0x00 ,0x45 ,0x00, 0x01 ,0x13 ,0x9c ,0x5d ,0x40 ,0x00 ,0xf6 ,0x11, 0x44 ,0xca ,0x97 ,0xa4 ,0x01 ,0x08 ,0x0a ,0x00, 0x00 ,0x06 ,0x00 ,0x35 ,0x04 ,0x0b ,0x00 ,0xff, 0x3c ,0x87 ,0x7d ,0x9e ,0x85 ,0x80 ,0x00 ,0x01, 0x00 ,0x01 ,0x00 ,0x05 ,0x00 ,0x05 ,0x06 ,0x70, 0x69 ,0x63 ,0x61 ,0x72 ,0x64 ,0x07 ,0x75 ,0x74, 0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65 ,0x64, 0x75 ,0x00 ,0x00 ,0x01 ,0x00 ,0x01 ,0xc0 ,0x0c, 0x00 ,0x01 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10, 0x00 ,0x04 ,0x81 ,0x6f ,0x1e ,0x1b ,0x07 ,0x75, 0x74 ,0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65, 0x64 ,0x75 ,0x00 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x09 ,0x06 ,0x6b ,0x65, 0x6e ,0x6f ,0x62 ,0x69 ,0xc0 ,0x34 ,0xc0 ,0x34, 0x00 ,0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10, 0x00 ,0x07 ,0x04 ,0x6a ,0x69 ,0x6e ,0x6e ,0xc0, 0x34 ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x0c ,0x04 ,0x64 ,0x6e, 0x73 ,0x31 ,0x04 ,0x6e ,0x6a ,0x69 ,0x74 ,0xc0, 0x3c ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x08 ,0x05 ,0x65 ,0x6c, 0x7a ,0x69 ,0x70 ,0xc0 ,0x34 ,0xc0 ,0x34 ,0x00, 0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10 ,0x00, 0x08 ,0x05 ,0x61 ,0x72 ,0x77 ,0x65 ,0x6e ,0xc0, 0x34 ,0xc0 ,0x4b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a, 0x06 ,0xc0 ,0x60 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a, 0x07 ,0xc0 ,0x73 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x01 ,0x03 ,0x82 ,0x00 ,0x04 ,0x80 ,0xeb ,0xfb, 0x0a ,0xc0 ,0x8b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x01, 0x0b ,0xc0 ,0x9f ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x0b, 0x51}; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; IPV4Hdr ipv4h; int ret = 0; DetectFragBitsData *de = NULL; SigMatch *sm = NULL; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ipv4h, 0, sizeof(IPV4Hdr)); dtv.app_tctx = AppLayerGetCtxThread(&tv); p->ip4h = &ipv4h; FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth), NULL); de = DetectFragBitsParse("D"); if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF)) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FRAGBITS; sm->ctx = (SigMatchCtx *)de; ret = DetectFragBitsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 1; } error: FlowShutdown(); if (de) SCFree(de); if (sm) SCFree(sm); SCFree(p); return 0; } /** * \test FragBitsTestParse04 test if DONT FRAG is not set. Must fails. * * \retval 1 on success * \retval 0 on failure */ static int FragBitsTestParse04 (void) { uint8_t raw_eth[] = { 0x00 ,0x40 ,0x33 ,0xd9 ,0x7c ,0xfd ,0x00 ,0x00, 0x39 ,0xcf ,0xd9 ,0xcd ,0x08 ,0x00 ,0x45 ,0x00, 0x01 ,0x13 ,0x9c ,0x5d ,0x40 ,0x00 ,0xf6 ,0x11, 0x44 ,0xca ,0x97 ,0xa4 ,0x01 ,0x08 ,0x0a ,0x00, 0x00 ,0x06 ,0x00 ,0x35 ,0x04 ,0x0b ,0x00 ,0xff, 0x3c ,0x87 ,0x7d ,0x9e ,0x85 ,0x80 ,0x00 ,0x01, 0x00 ,0x01 ,0x00 ,0x05 ,0x00 ,0x05 ,0x06 ,0x70, 0x69 ,0x63 ,0x61 ,0x72 ,0x64 ,0x07 ,0x75 ,0x74, 0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65 ,0x64, 0x75 ,0x00 ,0x00 ,0x01 ,0x00 ,0x01 ,0xc0 ,0x0c, 0x00 ,0x01 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10, 0x00 ,0x04 ,0x81 ,0x6f ,0x1e ,0x1b ,0x07 ,0x75, 0x74 ,0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65, 0x64 ,0x75 ,0x00 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x09 ,0x06 ,0x6b ,0x65, 0x6e ,0x6f ,0x62 ,0x69 ,0xc0 ,0x34 ,0xc0 ,0x34, 0x00 ,0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10, 0x00 ,0x07 ,0x04 ,0x6a ,0x69 ,0x6e ,0x6e ,0xc0, 0x34 ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x0c ,0x04 ,0x64 ,0x6e, 0x73 ,0x31 ,0x04 ,0x6e ,0x6a ,0x69 ,0x74 ,0xc0, 0x3c ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x08 ,0x05 ,0x65 ,0x6c, 0x7a ,0x69 ,0x70 ,0xc0 ,0x34 ,0xc0 ,0x34 ,0x00, 0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10 ,0x00, 0x08 ,0x05 ,0x61 ,0x72 ,0x77 ,0x65 ,0x6e ,0xc0, 0x34 ,0xc0 ,0x4b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a, 0x06 ,0xc0 ,0x60 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a, 0x07 ,0xc0 ,0x73 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x01 ,0x03 ,0x82 ,0x00 ,0x04 ,0x80 ,0xeb ,0xfb, 0x0a ,0xc0 ,0x8b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x01, 0x0b ,0xc0 ,0x9f ,0x00 ,0x01 ,0x00 ,0x01 ,0x00, 0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x0b, 0x51}; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; IPV4Hdr ipv4h; int ret = 0; DetectFragBitsData *de = NULL; SigMatch *sm = NULL; memset(&tv, 0, sizeof(ThreadVars)); memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&ipv4h, 0, sizeof(IPV4Hdr)); dtv.app_tctx = AppLayerGetCtxThread(&tv); p->ip4h = &ipv4h; FlowInitConfig(FLOW_QUIET); DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth), NULL); de = DetectFragBitsParse("!D"); if (de == NULL || (de->fragbits != FRAGBITS_HAVE_DF) || (de->modifier != MODIFIER_NOT)) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_FRAGBITS; sm->ctx = (SigMatchCtx *)de; ret = DetectFragBitsMatch(&tv, NULL, p, NULL, sm->ctx); if(ret) { if (de) SCFree(de); if (sm) SCFree(sm); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 0; } /* Error expected. */ error: if (de) SCFree(de); if (sm) SCFree(sm); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return 1; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for FragBits */ void FragBitsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("FragBitsTestParse01", FragBitsTestParse01); UtRegisterTest("FragBitsTestParse02", FragBitsTestParse02); UtRegisterTest("FragBitsTestParse03", FragBitsTestParse03); UtRegisterTest("FragBitsTestParse04", FragBitsTestParse04); #endif /* UNITTESTS */ } suricata-3.2.1/src/decode-gre.c0000644000000000000000000003010113051004444013136 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Breno Silva * * Decodes GRE */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "decode-events.h" #include "decode-gre.h" #include "util-unittest.h" #include "util-debug.h" /** * \brief Function to decode GRE packets */ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { uint16_t header_len = GRE_HDR_LEN; GRESreHdr *gsre = NULL; StatsIncr(tv, dtv->counter_gre); if(len < GRE_HDR_LEN) { ENGINE_SET_INVALID_EVENT(p, GRE_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->greh = (GREHdr *)pkt; if(p->greh == NULL) return TM_ECODE_FAILED; SCLogDebug("p %p pkt %p GRE protocol %04x Len: %d GRE version %x", p, pkt, GRE_GET_PROTO(p->greh), len,GRE_GET_VERSION(p->greh)); switch (GRE_GET_VERSION(p->greh)) { case GRE_VERSION_0: /* GRE version 0 doenst support the fields below RFC 1701 */ /** * \todo We need to make sure this does not allow bypassing * inspection. A server may just ignore these and * continue processing the packet, but we will not look * further into it. */ if (GRE_FLAG_ISSET_RECUR(p->greh)) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_RECUR); return TM_ECODE_OK; } if (GREV1_FLAG_ISSET_FLAGS(p->greh)) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_FLAGS); return TM_ECODE_OK; } /* Adjust header length based on content */ if (GRE_FLAG_ISSET_KY(p->greh)) header_len += GRE_KEY_LEN; if (GRE_FLAG_ISSET_SQ(p->greh)) header_len += GRE_SEQ_LEN; if (GRE_FLAG_ISSET_CHKSUM(p->greh) || GRE_FLAG_ISSET_ROUTE(p->greh)) header_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN; if (header_len > len) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_HDR_TOO_BIG); return TM_ECODE_OK; } if (GRE_FLAG_ISSET_ROUTE(p->greh)) { while (1) { if ((header_len + GRE_SRE_HDR_LEN) > len) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_MALFORMED_SRE_HDR); return TM_ECODE_OK; } gsre = (GRESreHdr *)(pkt + header_len); header_len += GRE_SRE_HDR_LEN; if ((ntohs(gsre->af) == 0) && (gsre->sre_length == 0)) break; header_len += gsre->sre_length; if (header_len > len) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_MALFORMED_SRE_HDR); return TM_ECODE_OK; } } } break; case GRE_VERSION_1: /* GRE version 1 doenst support the fields below RFC 1701 */ /** * \todo We need to make sure this does not allow bypassing * inspection. A server may just ignore these and * continue processing the packet, but we will not look * further into it. */ if (GRE_FLAG_ISSET_CHKSUM(p->greh)) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_CHKSUM); return TM_ECODE_OK; } if (GRE_FLAG_ISSET_ROUTE(p->greh)) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_ROUTE); return TM_ECODE_OK; } if (GRE_FLAG_ISSET_SSR(p->greh)) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_SSR); return TM_ECODE_OK; } if (GRE_FLAG_ISSET_RECUR(p->greh)) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_RECUR); return TM_ECODE_OK; } if (GREV1_FLAG_ISSET_FLAGS(p->greh)) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_FLAGS); return TM_ECODE_OK; } if (GRE_GET_PROTO(p->greh) != GRE_PROTO_PPP) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_WRONG_PROTOCOL); return TM_ECODE_OK; } if (!(GRE_FLAG_ISSET_KY(p->greh))) { ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_NO_KEY); return TM_ECODE_OK; } header_len += GRE_KEY_LEN; /* Adjust header length based on content */ if (GRE_FLAG_ISSET_SQ(p->greh)) header_len += GRE_SEQ_LEN; if (GREV1_FLAG_ISSET_ACK(p->greh)) header_len += GREV1_ACK_LEN; if (header_len > len) { ENGINE_SET_INVALID_EVENT(p, GRE_VERSION1_HDR_TOO_BIG); return TM_ECODE_OK; } break; default: ENGINE_SET_INVALID_EVENT(p, GRE_WRONG_VERSION); return TM_ECODE_OK; } switch (GRE_GET_PROTO(p->greh)) { case ETHERNET_TYPE_IP: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_IPV4, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } case GRE_PROTO_PPP: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_PPP, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } case ETHERNET_TYPE_IPV6: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_IPV6, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } case ETHERNET_TYPE_VLAN: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_VLAN, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } case ETHERNET_TYPE_ERSPAN: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_ERSPAN, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } case ETHERNET_TYPE_BRIDGE: { if (pq != NULL) { Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, len - header_len, DECODE_TUNNEL_ETHERNET, pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); } } break; } default: return TM_ECODE_OK; } return TM_ECODE_OK; } #ifdef UNITTESTS /** * \test DecodeGRETest01 is a test for small gre packet */ static int DecodeGREtest01 (void) { uint8_t raw_gre[] = { 0x00 ,0x6e ,0x62 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL); if(ENGINE_ISSET_EVENT(p,GRE_PKT_TOO_SMALL)) { SCFree(p); return 1; } SCFree(p); return 0; } /** * \test DecodeGRETest02 is a test for wrong gre version */ static int DecodeGREtest02 (void) { uint8_t raw_gre[] = { 0x00, 0x6e, 0x62, 0xac, 0x40, 0x00, 0x40, 0x2f, 0xc2, 0xc7, 0x0a, 0x00, 0x00, 0x64, 0x0a, 0x00, 0x00, 0x8a, 0x30, 0x01, 0x0b, 0x00, 0x4e, 0x00, 0x00, 0x00, 0x18, 0x4a, 0x50, 0xff, 0x03, 0x00, 0x21, 0x45, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x40, 0x00, 0x40, 0x11, 0x94, 0x22, 0x50, 0x7e, 0x2b, 0x2d, 0xc2, 0x6d, 0x68, 0x68, 0x80, 0x0e, 0x00, 0x35, 0x00, 0x36, 0x9f, 0x18, 0xdb, 0xc4, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x73, 0x31, 0x36, 0x09, 0x73, 0x69, 0x74, 0x65, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL); if(ENGINE_ISSET_EVENT(p,GRE_WRONG_VERSION)) { SCFree(p); return 1; } SCFree(p); return 0; } /** * \test DecodeGRETest03 is a test for valid gre packet */ static int DecodeGREtest03 (void) { uint8_t raw_gre[] = { 0x00, 0x6e, 0x62, 0xac, 0x40, 0x00, 0x40, 0x2f, 0xc2, 0xc7, 0x0a, 0x00, 0x00, 0x64, 0x0a, 0x00, 0x00, 0x8a, 0x30, 0x01, 0x88, 0x0b, 0x00, 0x4e, 0x00, 0x00, 0x00, 0x18, 0x4a, 0x50, 0xff, 0x03, 0x00, 0x21, 0x45, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x40, 0x00, 0x40, 0x11, 0x94, 0x22, 0x50, 0x7e, 0x2b, 0x2d, 0xc2, 0x6d, 0x68, 0x68, 0x80, 0x0e, 0x00, 0x35, 0x00, 0x36, 0x9f, 0x18, 0xdb, 0xc4, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x73, 0x31, 0x36, 0x09, 0x73, 0x69, 0x74, 0x65, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL); if(p->greh == NULL) { SCFree(p); return 0; } SCFree(p); return 1; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for GRE decoder */ void DecodeGRERegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodeGREtest01", DecodeGREtest01); UtRegisterTest("DecodeGREtest02", DecodeGREtest02); UtRegisterTest("DecodeGREtest03", DecodeGREtest03); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/detect-engine-proto.c0000644000000000000000000004042613051004444015027 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Proto part of the detection engine. * * \todo move this out of the detection plugin structure */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "app-layer-parser.h" #include "flow-util.h" #include "flow-var.h" #include "detect-engine-siggroup.h" #include "detect-engine-state.h" #include "util-cidr.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /** * \brief Function to initialize the protocol detection and * allocate memory to the DetectProto structure. * * \retval DetectProto instance pointer if successful otherwise NULL */ DetectProto *DetectProtoInit(void) { DetectProto *dp = SCMalloc(sizeof(DetectProto)); if (unlikely(dp == NULL)) return NULL; memset(dp,0,sizeof(DetectProto)); return dp; } /** * \brief Free a DetectProto object * * \param dp Pointer to the DetectProto instance to be freed */ void DetectProtoFree(DetectProto *dp) { if (dp == NULL) return; SCFree(dp); } /** * \brief Parses a protocol sent as a string. * * \param dp Pointer to the DetectProto instance which will be updated with the * incoming protocol information. * \param str Pointer to the string containing the protocol name. * * \retval >=0 If proto is detected, -1 otherwise. */ int DetectProtoParse(DetectProto *dp, char *str) { if (strcasecmp(str, "tcp") == 0) { dp->proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8); SCLogDebug("TCP protocol detected"); } else if (strcasecmp(str, "tcp-pkt") == 0) { dp->proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8); SCLogDebug("TCP protocol detected, packets only"); dp->flags |= DETECT_PROTO_ONLY_PKT; } else if (strcasecmp(str, "tcp-stream") == 0) { dp->proto[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8); SCLogDebug("TCP protocol detected, stream only"); dp->flags |= DETECT_PROTO_ONLY_STREAM; } else if (strcasecmp(str, "udp") == 0) { dp->proto[IPPROTO_UDP / 8] |= 1 << (IPPROTO_UDP % 8); SCLogDebug("UDP protocol detected"); } else if (strcasecmp(str, "icmpv4") == 0) { dp->proto[IPPROTO_ICMP / 8] |= 1 << (IPPROTO_ICMP % 8); SCLogDebug("ICMPv4 protocol detected"); } else if (strcasecmp(str, "icmpv6") == 0) { dp->proto[IPPROTO_ICMPV6 / 8] |= 1 << (IPPROTO_ICMPV6 % 8); SCLogDebug("ICMPv6 protocol detected"); } else if (strcasecmp(str, "icmp") == 0) { dp->proto[IPPROTO_ICMP / 8] |= 1 << (IPPROTO_ICMP % 8); dp->proto[IPPROTO_ICMPV6 / 8] |= 1 << (IPPROTO_ICMPV6 % 8); SCLogDebug("ICMP protocol detected, sig applies both to ICMPv4 and ICMPv6"); } else if (strcasecmp(str, "sctp") == 0) { dp->proto[IPPROTO_SCTP / 8] |= 1 << (IPPROTO_SCTP % 8); SCLogDebug("SCTP protocol detected"); } else if (strcasecmp(str,"ipv4") == 0 || strcasecmp(str,"ip4") == 0 ) { dp->flags |= (DETECT_PROTO_IPV4 | DETECT_PROTO_ANY); memset(dp->proto, 0xff, sizeof(dp->proto)); SCLogDebug("IPv4 protocol detected"); } else if (strcasecmp(str,"ipv6") == 0 || strcasecmp(str,"ip6") == 0 ) { dp->flags |= (DETECT_PROTO_IPV6 | DETECT_PROTO_ANY); memset(dp->proto, 0xff, sizeof(dp->proto)); SCLogDebug("IPv6 protocol detected"); } else if (strcasecmp(str,"ip") == 0 || strcasecmp(str,"pkthdr") == 0) { /* Proto "ip" is treated as an "any" */ dp->flags |= DETECT_PROTO_ANY; memset(dp->proto, 0xff, sizeof(dp->proto)); SCLogDebug("IP protocol detected"); } else { goto error; /** \todo are numeric protocols even valid? */ #if 0 uint8_t proto_u8; /* Used to avoid sign extension */ /* Extract out a 0-256 value with validation checks */ if (ByteExtractStringUint8(&proto_u8, 10, 0, str) == -1) { // XXX SCLogDebug("DetectProtoParse: Error in extracting byte string"); goto error; } proto = (int)proto_u8; /* Proto 0 is the same as "ip" above */ if (proto == IPPROTO_IP) { dp->flags |= DETECT_PROTO_ANY; } else { dp->proto[proto / 8] |= 1<<(proto % 8); } #endif } return 0; error: return -1; } /** \brief see if a DetectProto contains a certain proto * \param dp detect proto to inspect * \param proto protocol (such as IPPROTO_TCP) to look for * \retval 0 protocol not in the set * \retval 1 protocol is in the set */ int DetectProtoContainsProto(const DetectProto *dp, int proto) { if (dp->flags & DETECT_PROTO_ANY) return 1; if (dp->proto[proto / 8] & (1<<(proto % 8))) return 1; return 0; } /* TESTS */ #ifdef UNITTESTS #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-mpm.h" /** * \brief this function is used to initialize the detection engine context and * setup the signature with passed values. */ static int DetectProtoInitTest(DetectEngineCtx **de_ctx, Signature **sig, DetectProto *dp, char *str) { char fullstr[1024]; int result = 0; *de_ctx = NULL; *sig = NULL; if (snprintf(fullstr, 1024, "alert %s any any -> any any (msg:\"DetectProto" " test\"; sid:1;)", str) >= 1024) { goto end; } *de_ctx = DetectEngineCtxInit(); if (*de_ctx == NULL) { goto end; } (*de_ctx)->flags |= DE_QUIET; (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); if ((*de_ctx)->sig_list == NULL) { goto end; } *sig = (*de_ctx)->sig_list; if (DetectProtoParse(dp, str) < 0) goto end; result = 1; end: return result; } /** * \test ProtoTestParse01 is a test to make sure that we parse the * protocol correctly, when given valid proto option. */ static int ProtoTestParse01 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); int r = DetectProtoParse(&dp, "6"); if (r < 0) { return 1; } SCLogDebug("DetectProtoParse should have rejected the \"6\" string"); return 0; } /** * \test ProtoTestParse02 is a test to make sure that we parse the * protocol correctly, when given "tcp" as proto option. */ static int ProtoTestParse02 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); int r = DetectProtoParse(&dp, "tcp"); if (r >= 0 && dp.proto[(IPPROTO_TCP/8)] & (1<<(IPPROTO_TCP%8))) { return 1; } SCLogDebug("ProtoTestParse02: Error in parsing the \"tcp\" string"); return 0; } /** * \test ProtoTestParse03 is a test to make sure that we parse the * protocol correctly, when given "ip" as proto option. */ static int ProtoTestParse03 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); int r = DetectProtoParse(&dp, "ip"); if (r >= 0 && dp.flags & DETECT_PROTO_ANY) { return 1; } SCLogDebug("ProtoTestParse03: Error in parsing the \"ip\" string"); return 0; } /** * \test ProtoTestParse04 is a test to make sure that we do not parse the * protocol, when given an invalid proto option. */ static int ProtoTestParse04 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); /* Check for a bad number */ int r = DetectProtoParse(&dp, "4242"); if (r < 0) { return 1; } SCLogDebug("ProtoTestParse04: it should not parsing the \"4242\" string"); return 0; } /** * \test ProtoTestParse05 is a test to make sure that we do not parse the * protocol, when given an invalid proto option. */ static int ProtoTestParse05 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); /* Check for a bad string */ int r = DetectProtoParse(&dp, "tcp/udp"); if (r < 0) { return 1; } SCLogDebug("ProtoTestParse05: it should not parsing the \"tcp/udp\" string"); return 0; } /** * \test make sure that we properly parse tcp-pkt */ static int ProtoTestParse06 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); /* Check for a bad string */ int r = DetectProtoParse(&dp, "tcp-pkt"); if (r < 0) { printf("parsing tcp-pkt failed: "); return 0; } if (!(dp.flags & DETECT_PROTO_ONLY_PKT)) { printf("DETECT_PROTO_ONLY_PKT flag not set: "); return 0; } return 1; } /** * \test make sure that we properly parse tcp-stream */ static int ProtoTestParse07 (void) { DetectProto dp; memset(&dp,0,sizeof(DetectProto)); /* Check for a bad string */ int r = DetectProtoParse(&dp, "tcp-stream"); if (r < 0) { printf("parsing tcp-stream failed: "); return 0; } if (!(dp.flags & DETECT_PROTO_ONLY_STREAM)) { printf("DETECT_PROTO_ONLY_STREAM flag not set: "); return 0; } return 1; } /** * \test DetectIPProtoTestSetup01 is a test for a protocol setting up in * signature. */ static int DetectProtoTestSetup01(void) { DetectProto dp; Signature *sig = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; int i; memset(&dp, 0, sizeof(dp)); result = DetectProtoInitTest(&de_ctx, &sig, &dp, "tcp"); if (result == 0) { goto end; } result = 0; /* The signature proto should be TCP */ if (!(sig->proto.proto[(IPPROTO_TCP/8)] & (1<<(IPPROTO_TCP%8)))) { printf("failed in sig matching\n"); goto cleanup; } for (i = 2; i < 256/8; i++) { if (sig->proto.proto[i] != 0) { printf("failed in sig clear\n"); goto cleanup; } } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); end: return result; } /** * \test DetectrotoTestSetup02 is a test for a icmpv4 and icmpv6 * protocol setting up in signature. */ static int DetectProtoTestSetup02(void) { DetectProto dp; Signature *sig_icmpv4 = NULL; Signature *sig_icmpv6 = NULL; Signature *sig_icmp = NULL; DetectEngineCtx *de_ctx = NULL; int result = 0; int i; memset(&dp, 0, sizeof(dp)); if (DetectProtoInitTest(&de_ctx, &sig_icmpv4, &dp, "icmpv4") == 0) { printf("failure - imcpv4.\n"); goto end; } if (DetectProtoInitTest(&de_ctx, &sig_icmpv6, &dp, "icmpv6") == 0) { printf("failure - imcpv6.\n"); goto end; } if (DetectProtoInitTest(&de_ctx, &sig_icmp, &dp, "icmp") == 0) { printf("failure - imcp.\n"); goto end; } for (i = 0; i < 256 / 8; i++) { if (i == IPPROTO_ICMP) { if (!(sig_icmpv4->proto.proto[i / 8] & (1 << (i % 8)))) { printf("failed in sig matching - icmpv4 - icmpv4.\n"); goto end; } continue; } if (sig_icmpv4->proto.proto[i / 8] & (1 << (i % 8))) { printf("failed in sig matching - icmpv4 - others.\n"); goto end; } } for (i = 0; i < 256 / 8; i++) { if (i == IPPROTO_ICMPV6) { if (!(sig_icmpv6->proto.proto[i / 8] & (1 << (i % 8)))) { printf("failed in sig matching - icmpv6 - icmpv6.\n"); goto end; } continue; } if (sig_icmpv6->proto.proto[i / 8] & (1 << (i % 8))) { printf("failed in sig matching - icmpv6 - others.\n"); goto end; } } for (i = 0; i < 256 / 8; i++) { if (i == IPPROTO_ICMP || i == IPPROTO_ICMPV6) { if (!(sig_icmp->proto.proto[i / 8] & (1 << (i % 8)))) { printf("failed in sig matching - icmp - icmp.\n"); goto end; } continue; } if (sig_icmpv6->proto.proto[i / 8] & (1 << (i % 8))) { printf("failed in sig matching - icmp - others.\n"); goto end; } } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectProtoTestSig01 is a test for checking the working of protocol * detection by setting up the signature and later testing its working * by matching the received packet against the sig. */ static int DetectProtoTestSig01(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; Flow f; memset(&f, 0, sizeof(Flow)); memset(&th_v, 0, sizeof(th_v)); FLOW_INITIALIZE(&f); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flags |= PKT_HAS_FLOW; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert udp any any -> any any " "(msg:\"Not tcp\"; flow:to_server; sid:1;)"); if (s == NULL) goto end; s = s->next = SigInit(de_ctx,"alert ip any any -> any any " "(msg:\"IP\"; flow:to_server; sid:2;)"); if (s == NULL) goto end; s = s->next = SigInit(de_ctx,"alert tcp any any -> any any " "(msg:\"TCP\"; flow:to_server; sid:3;)"); if (s == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 alerted, but should not have: "); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { printf("sid 2 did not alert, but should have: "); goto cleanup; } else if (PacketAlertCheck(p, 3) == 0) { printf("sid 3 did not alert, but should have: "); goto cleanup; } result = 1; cleanup: FLOW_DESTROY(&f); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } /** * \test signature parsing with tcp-pkt and tcp-stream */ static int DetectProtoTestSig02(void) { Signature *s = NULL; int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp-pkt any any -> any any " "(msg:\"tcp-pkt\"; content:\"blah\"; sid:1;)"); if (s == NULL) { printf("tcp-pkt sig parsing failed: "); goto end; } s = s->next = SigInit(de_ctx,"alert tcp-stream any any -> any any " "(msg:\"tcp-stream\"; content:\"blah\"; sid:2;)"); if (s == NULL) { printf("tcp-pkt sig parsing failed: "); goto end; } result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectProto */ void DetectProtoTests(void) { #ifdef UNITTESTS UtRegisterTest("ProtoTestParse01", ProtoTestParse01); UtRegisterTest("ProtoTestParse02", ProtoTestParse02); UtRegisterTest("ProtoTestParse03", ProtoTestParse03); UtRegisterTest("ProtoTestParse04", ProtoTestParse04); UtRegisterTest("ProtoTestParse05", ProtoTestParse05); UtRegisterTest("ProtoTestParse06", ProtoTestParse06); UtRegisterTest("ProtoTestParse07", ProtoTestParse07); UtRegisterTest("DetectProtoTestSetup01", DetectProtoTestSetup01); UtRegisterTest("DetectProtoTestSetup02", DetectProtoTestSetup02); UtRegisterTest("DetectProtoTestSig01", DetectProtoTestSig01); UtRegisterTest("DetectProtoTestSig02", DetectProtoTestSig02); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-mpipe.h0000644000000000000000000000452213051004444013565 00000000000000/* Copyright (C) 2011-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Tom DeCanio * \author Ken Steele, Tilera Corporation */ #ifndef __SOURCE_MPIPE_H__ #define __SOURCE_MPIPE_H__ #ifdef HAVE_MPIPE #include #include #define MPIPE_FREE_PACKET(p) MpipeFreePacket((p)) #define MPIPE_COPY_MODE_NONE 0 #define MPIPE_COPY_MODE_TAP 1 #define MPIPE_COPY_MODE_IPS 2 #define MPIPE_IFACE_NAME_LENGTH 8 typedef struct MpipeIfaceConfig_ { char iface[MPIPE_IFACE_NAME_LENGTH]; int copy_mode; char *out_iface; } MpipeIfaceConfig; typedef struct MpipePeer_ { int channel; char iface[MPIPE_IFACE_NAME_LENGTH]; } MpipePeer; /* per interface TAP/IPS configuration */ typedef struct MpipePeerVars_ { gxio_mpipe_equeue_t *peer_equeue; void (*ReleasePacket)(struct Packet_ *); int copy_mode; } MpipePeerVars; /* per packet Mpipe vars */ typedef struct MpipePacketVars_ { /* TileGX mpipe stuff */ struct { uint_reg_t channel : 5; uint_reg_t l2_size : 14; uint_reg_t size : 3; uint_reg_t bucket_id : 13; uint_reg_t nr : 1; uint_reg_t cs : 1; uint_reg_t va : 42; uint_reg_t stack_idx : 5; } idesc; /* packetpool this was allocated from */ uint8_t rank; gxio_mpipe_equeue_t *peer_equeue; } MpipePacketVars; int MpipeLiveRegisterDevice(char *); int MpipeLiveGetDeviceCount(void); char *MpipeLiveGetDevice(int); void MpipeFreePacket(void *arg); void TmModuleReceiveMpipeRegister (void); void TmModuleDecodeMpipeRegister (void); TmEcode ReceiveMpipeInit(void); #endif /* HAVE_MPIPE */ #endif /* __SOURCE_MPIPE_H__ */ suricata-3.2.1/src/util-var-name.h0000644000000000000000000000215013051004444013631 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_VAR_NAME_H__ #define __UTIL_VAR_NAME_H__ int VariableNameInitHash(DetectEngineCtx *); void VariableNameFreeHash(DetectEngineCtx *); uint16_t VariableNameGetIdx(DetectEngineCtx *, const char *name, enum VarTypes type); const char *VariableIdxGetName(DetectEngineCtx *, uint16_t id, enum VarTypes type); #endif suricata-3.2.1/src/tm-queuehandlers.c0000644000000000000000000000311613051004444014431 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Master Queue Handler */ #include "suricata-common.h" #include "packet-queue.h" #include "decode.h" #include "threads.h" #include "threadvars.h" #include "tm-queuehandlers.h" #include "tmqh-simple.h" #include "tmqh-nfq.h" #include "tmqh-packetpool.h" #include "tmqh-flow.h" #include "tmqh-ringbuffer.h" void TmqhSetup (void) { memset(&tmqh_table, 0, sizeof(tmqh_table)); TmqhSimpleRegister(); TmqhNfqRegister(); TmqhPacketpoolRegister(); TmqhFlowRegister(); TmqhRingBufferRegister(); } /** \brief Clean up registration time allocs */ void TmqhCleanup(void) { TmqhRingBufferDestroy(); } Tmqh* TmqhGetQueueHandlerByName(char *name) { int i; for (i = 0; i < TMQH_SIZE; i++) { if (strcmp(name, tmqh_table[i].name) == 0) return &tmqh_table[i]; } return NULL; } suricata-3.2.1/src/util-ringbuffer.c0000644000000000000000000006517013051004444014262 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Ringbuffer implementation that is lockless for the most part IF atomic * operations are available. * * Two sizes are implemented currently: 256 and 65536. Those sizes are chosen * for simplicity when working with the read and write indexes. Both can just * wrap around. * * Implemented are: * Single reader, single writer (lockless) * Single reader, multi writer (partly locked) * Multi reader, single writer (lockless) * Multi reader, multi writer (partly locked) */ #include "suricata-common.h" #include "suricata.h" #include "util-ringbuffer.h" #include "util-atomic.h" #include "util-unittest.h" #define USLEEP_TIME 5 /** \brief wait function for condition where ringbuffer is either * full or empty. * * \param rb ringbuffer * * Based on RINGBUFFER_MUTEX_WAIT define, we either sleep and spin * or use thread condition to wait. */ static inline void RingBuffer8DoWait(RingBuffer8 *rb) { #ifdef RINGBUFFER_MUTEX_WAIT SCMutexLock(&rb->wait_mutex); SCCondWait(&rb->wait_cond, &rb->wait_mutex); SCMutexUnlock(&rb->wait_mutex); #else usleep(USLEEP_TIME); #endif } /** \brief wait function for condition where ringbuffer is either * full or empty. * * \param rb ringbuffer * * Based on RINGBUFFER_MUTEX_WAIT define, we either sleep and spin * or use thread condition to wait. */ static inline void RingBufferDoWait(RingBuffer16 *rb) { #ifdef RINGBUFFER_MUTEX_WAIT SCMutexLock(&rb->wait_mutex); SCCondWait(&rb->wait_cond, &rb->wait_mutex); SCMutexUnlock(&rb->wait_mutex); #else usleep(USLEEP_TIME); #endif } /** \brief wait function for condition where ringbuffer is either * full or empty. * * \param rb ringbuffer * * Based on RINGBUFFER_MUTEX_WAIT define, we either sleep and spin * or use thread condition to wait. */ void RingBufferWait(RingBuffer16 *rb) { RingBufferDoWait(rb); } /** \brief tell the ringbuffer to shut down * * \param rb ringbuffer */ void RingBuffer8Shutdown(RingBuffer8 *rb) { rb->shutdown = 1; #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif } /** \brief check the ringbuffer is empty (no data in it) * * \param rb ringbuffer * * \retval 1 empty * \retval 0 not empty */ int RingBuffer8IsEmpty(RingBuffer8 *rb) { if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { return 1; } return 0; } /** \brief check the ringbuffer is full (no more data will fit) * * \param rb ringbuffer * * \retval 1 empty * \retval 0 not empty */ int RingBuffer8IsFull(RingBuffer8 *rb) { if ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { return 1; } return 0; } /** \brief tell the ringbuffer to shut down * * \param rb ringbuffer */ void RingBufferShutdown(RingBuffer16 *rb) { rb->shutdown = 1; #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif } /** \brief get number of items in the ringbuffer */ uint16_t RingBufferSize(RingBuffer16 *rb) { SCEnter(); uint16_t size = (uint16_t)(SC_ATOMIC_GET(rb->write) - SC_ATOMIC_GET(rb->read)); SCReturnUInt(size); } /** \brief check the ringbuffer is empty (no data in it) * * \param rb ringbuffer * * \retval 1 empty * \retval 0 not empty */ int RingBufferIsEmpty(RingBuffer16 *rb) { if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { return 1; } return 0; } /** \brief check the ringbuffer is full (no more data will fit) * * \param rb ringbuffer * * \retval 1 empty * \retval 0 not empty */ int RingBufferIsFull(RingBuffer16 *rb) { if ((unsigned short)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { return 1; } return 0; } /* Single Reader, Single Writer, 8 bits */ void *RingBufferSrSw8Get(RingBuffer8 *rb) { void *ptr = NULL; /* buffer is empty, wait... */ while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBuffer8DoWait(rb); } ptr = rb->array[SC_ATOMIC_GET(rb->read)]; (void) SC_ATOMIC_ADD(rb->read, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } int RingBufferSrSw8Put(RingBuffer8 *rb, void *ptr) { /* buffer is full, wait... */ while ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBuffer8DoWait(rb); } rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Single Reader, Multi Writer, 8 bites */ void *RingBufferSrMw8Get(RingBuffer8 *rb) { void *ptr = NULL; /* buffer is empty, wait... */ while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBuffer8DoWait(rb); } ptr = rb->array[SC_ATOMIC_GET(rb->read)]; (void) SC_ATOMIC_ADD(rb->read, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief put a ptr in the RingBuffer. * * As we support multiple writers we need to protect 2 things: * 1. writing the ptr to the array * 2. incrementing the rb->write idx * * We can't do both at the same time in one atomic operation, so * we need to (spin) lock it. We do increment rb->write atomically * after that, so that we don't need to use the lock in our *Get * function. * * \param rb the ringbuffer * \param ptr ptr to store * * \retval 0 ok * \retval -1 wait loop interrupted because of engine flags */ int RingBufferSrMw8Put(RingBuffer8 *rb, void *ptr) { SCLogDebug("ptr %p", ptr); /* buffer is full, wait... */ retry: while ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBuffer8DoWait(rb); } /* get our lock */ SCSpinLock(&rb->spin); /* if while we got our lock the buffer changed, we need to retry */ if ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { SCSpinUnlock(&rb->spin); goto retry; } SCLogDebug("rb->write %u, ptr %p", SC_ATOMIC_GET(rb->write), ptr); /* update the ring buffer */ rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); SCSpinUnlock(&rb->spin); SCLogDebug("ptr %p, done", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Multi Reader, Single Writer, 8 bits */ /** * \brief get the next ptr from the ring buffer * * Because we allow for multiple readers we take great care in making sure * that the threads don't interfere with one another. * */ void *RingBufferMrSw8Get(RingBuffer8 *rb) { void *ptr; /** local pointer for data races. If SCAtomicCompareAndSwap (CAS) * fails we increase our local array idx to try the next array member * until we succeed. Or when the buffer is empty again we jump back * to the waiting loop. */ unsigned char readp; /* buffer is empty, wait... */ retry: while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBuffer8DoWait(rb); } /* atomically update rb->read */ readp = SC_ATOMIC_GET(rb->read) - 1; do { /* with multiple readers we can get in the situation that we exitted * from the wait loop but the rb is empty again once we get here. */ if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) goto retry; readp++; ptr = rb->array[readp]; } while (!(SC_ATOMIC_CAS(&rb->read, readp, (readp + 1)))); SCLogDebug("ptr %p", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief put a ptr in the RingBuffer */ int RingBufferMrSw8Put(RingBuffer8 *rb, void *ptr) { SCLogDebug("ptr %p", ptr); /* buffer is full, wait... */ while ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBuffer8DoWait(rb); } rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Multi Reader, Single Writer */ /** * \brief get the next ptr from the ring buffer * * Because we allow for multiple readers we take great care in making sure * that the threads don't interfere with one another. * */ void *RingBufferMrSwGet(RingBuffer16 *rb) { void *ptr; /** local pointer for data races. If SCAtomicCompareAndSwap (CAS) * fails we increase our local array idx to try the next array member * until we succeed. Or when the buffer is empty again we jump back * to the waiting loop. */ unsigned short readp; /* buffer is empty, wait... */ retry: while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBufferDoWait(rb); } /* atomically update rb->read */ readp = SC_ATOMIC_GET(rb->read) - 1; do { /* with multiple readers we can get in the situation that we exitted * from the wait loop but the rb is empty again once we get here. */ if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) goto retry; readp++; ptr = rb->array[readp]; } while (!(SC_ATOMIC_CAS(&rb->read, readp, (readp + 1)))); SCLogDebug("ptr %p", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief put a ptr in the RingBuffer */ int RingBufferMrSwPut(RingBuffer16 *rb, void *ptr) { SCLogDebug("ptr %p", ptr); /* buffer is full, wait... */ while ((unsigned short)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBufferDoWait(rb); } rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Single Reader, Single Writer */ void *RingBufferSrSwGet(RingBuffer16 *rb) { void *ptr = NULL; /* buffer is empty, wait... */ while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBufferDoWait(rb); } ptr = rb->array[SC_ATOMIC_GET(rb->read)]; (void) SC_ATOMIC_ADD(rb->read, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } int RingBufferSrSwPut(RingBuffer16 *rb, void *ptr) { /* buffer is full, wait... */ while ((unsigned short)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBufferDoWait(rb); } rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Multi Reader, Multi Writer, 8 bits */ RingBuffer8 *RingBuffer8Init(void) { RingBuffer8 *rb = SCMalloc(sizeof(RingBuffer8)); if (unlikely(rb == NULL)) { return NULL; } memset(rb, 0x00, sizeof(RingBuffer8)); SC_ATOMIC_INIT(rb->write); SC_ATOMIC_INIT(rb->read); SCSpinInit(&rb->spin, 0); #ifdef RINGBUFFER_MUTEX_WAIT SCMutexInit(&rb->wait_mutex, NULL); SCCondInit(&rb->wait_cond, NULL); #endif return rb; } void RingBuffer8Destroy(RingBuffer8 *rb) { if (rb != NULL) { SC_ATOMIC_DESTROY(rb->write); SC_ATOMIC_DESTROY(rb->read); SCSpinDestroy(&rb->spin); #ifdef RINGBUFFER_MUTEX_WAIT SCMutexDestroy(&rb->wait_mutex); SCCondDestroy(&rb->wait_cond); #endif SCFree(rb); } } /** * \brief get the next ptr from the ring buffer * * Because we allow for multiple readers we take great care in making sure * that the threads don't interfere with one another. * */ void *RingBufferMrMw8Get(RingBuffer8 *rb) { void *ptr; /** local pointer for data races. If SCAtomicCompareAndSwap (CAS) * fails we increase our local array idx to try the next array member * until we succeed. Or when the buffer is empty again we jump back * to the waiting loop. */ unsigned char readp; /* buffer is empty, wait... */ retry: while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBuffer8DoWait(rb); } /* atomically update rb->read */ readp = SC_ATOMIC_GET(rb->read) - 1; do { /* with multiple readers we can get in the situation that we exitted * from the wait loop but the rb is empty again once we get here. */ if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) goto retry; readp++; ptr = rb->array[readp]; } while (!(SC_ATOMIC_CAS(&rb->read, readp, (readp + 1)))); SCLogDebug("ptr %p", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief put a ptr in the RingBuffer. * * As we support multiple writers we need to protect 2 things: * 1. writing the ptr to the array * 2. incrementing the rb->write idx * * We can't do both at the same time in one atomic operation, so * we need to (spin) lock it. We do increment rb->write atomically * after that, so that we don't need to use the lock in our *Get * function. * * \param rb the ringbuffer * \param ptr ptr to store * * \retval 0 ok * \retval -1 wait loop interrupted because of engine flags */ int RingBufferMrMw8Put(RingBuffer8 *rb, void *ptr) { SCLogDebug("ptr %p", ptr); /* buffer is full, wait... */ retry: while ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBuffer8DoWait(rb); } /* get our lock */ SCSpinLock(&rb->spin); /* if while we got our lock the buffer changed, we need to retry */ if ((unsigned char)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { SCSpinUnlock(&rb->spin); goto retry; } SCLogDebug("rb->write %u, ptr %p", SC_ATOMIC_GET(rb->write), ptr); /* update the ring buffer */ rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); SCSpinUnlock(&rb->spin); SCLogDebug("ptr %p, done", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } /* Multi Reader, Multi Writer, 16 bits */ RingBuffer16 *RingBufferInit(void) { RingBuffer16 *rb = SCMalloc(sizeof(RingBuffer16)); if (unlikely(rb == NULL)) { return NULL; } memset(rb, 0x00, sizeof(RingBuffer16)); SC_ATOMIC_INIT(rb->write); SC_ATOMIC_INIT(rb->read); SCSpinInit(&rb->spin, 0); #ifdef RINGBUFFER_MUTEX_WAIT SCMutexInit(&rb->wait_mutex, NULL); SCCondInit(&rb->wait_cond, NULL); #endif return rb; } void RingBufferDestroy(RingBuffer16 *rb) { if (rb != NULL) { SC_ATOMIC_DESTROY(rb->write); SC_ATOMIC_DESTROY(rb->read); SCSpinDestroy(&rb->spin); #ifdef RINGBUFFER_MUTEX_WAIT SCMutexDestroy(&rb->wait_mutex); SCCondDestroy(&rb->wait_cond); #endif SCFree(rb); } } /** * \brief get the next ptr from the ring buffer * * Because we allow for multiple readers we take great care in making sure * that the threads don't interfere with one another. * */ void *RingBufferMrMwGet(RingBuffer16 *rb) { void *ptr; /** local pointer for data races. If SCAtomicCompareAndSwap (CAS) * fails we increase our local array idx to try the next array member * until we succeed. Or when the buffer is empty again we jump back * to the waiting loop. */ unsigned short readp; /* buffer is empty, wait... */ retry: while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return NULL; RingBufferDoWait(rb); } /* atomically update rb->read */ readp = SC_ATOMIC_GET(rb->read) - 1; do { /* with multiple readers we can get in the situation that we exitted * from the wait loop but the rb is empty again once we get here. */ if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) goto retry; readp++; ptr = rb->array[readp]; } while (!(SC_ATOMIC_CAS(&rb->read, readp, (readp + 1)))); SCLogDebug("ptr %p", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief get the next ptr from the ring buffer * * Because we allow for multiple readers we take great care in making sure * that the threads don't interfere with one another. * * This version does NOT enter a wait if the buffer is empty loop. * * \retval ptr pointer to the data, or NULL if buffer is empty */ void *RingBufferMrMwGetNoWait(RingBuffer16 *rb) { void *ptr; /** local pointer for data races. If SCAtomicCompareAndSwap (CAS) * fails we increase our local array idx to try the next array member * until we succeed. Or when the buffer is empty again we jump back * to the waiting loop. */ unsigned short readp; /* buffer is empty, wait... */ retry: while (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) { /* break if buffer is empty */ return NULL; } /* atomically update rb->read */ readp = SC_ATOMIC_GET(rb->read) - 1; do { /* with multiple readers we can get in the situation that we exitted * from the wait loop but the rb is empty again once we get here. */ if (SC_ATOMIC_GET(rb->write) == SC_ATOMIC_GET(rb->read)) goto retry; readp++; ptr = rb->array[readp]; } while (!(SC_ATOMIC_CAS(&rb->read, readp, (readp + 1)))); SCLogDebug("ptr %p", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return ptr; } /** * \brief put a ptr in the RingBuffer. * * As we support multiple writers we need to protect 2 things: * 1. writing the ptr to the array * 2. incrementing the rb->write idx * * We can't do both at the same time in one atomic operation, so * we need to (spin) lock it. We do increment rb->write atomically * after that, so that we don't need to use the lock in our *Get * function. * * \param rb the ringbuffer * \param ptr ptr to store * * \retval 0 ok * \retval -1 wait loop interrupted because of engine flags */ int RingBufferMrMwPut(RingBuffer16 *rb, void *ptr) { SCLogDebug("ptr %p", ptr); /* buffer is full, wait... */ retry: while ((unsigned short)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { /* break out if the engine wants to shutdown */ if (rb->shutdown != 0) return -1; RingBufferDoWait(rb); } /* get our lock */ SCSpinLock(&rb->spin); /* if while we got our lock the buffer changed, we need to retry */ if ((unsigned short)(SC_ATOMIC_GET(rb->write) + 1) == SC_ATOMIC_GET(rb->read)) { SCSpinUnlock(&rb->spin); goto retry; } SCLogDebug("rb->write %u, ptr %p", SC_ATOMIC_GET(rb->write), ptr); /* update the ring buffer */ rb->array[SC_ATOMIC_GET(rb->write)] = ptr; (void) SC_ATOMIC_ADD(rb->write, 1); SCSpinUnlock(&rb->spin); SCLogDebug("ptr %p, done", ptr); #ifdef RINGBUFFER_MUTEX_WAIT SCCondSignal(&rb->wait_cond); #endif return 0; } #ifdef UNITTESTS static int RingBuffer8SrSwInit01 (void) { int result = 0; RingBuffer8 *rb = NULL; rb = RingBuffer8Init(); if (rb == NULL) { printf("rb == NULL: "); goto end; } int r = SCSpinLock(&rb->spin); if (r != 0) { printf("r = %d, expected %d: ", r, 0); goto end; } SCSpinUnlock(&rb->spin); if (SC_ATOMIC_GET(rb->read) != 0) { printf("read %u, expected 0: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != 0) { printf("write %u, expected 0: ", SC_ATOMIC_GET(rb->write)); goto end; } result = 1; end: if (rb != NULL) { RingBuffer8Destroy(rb); } return result; } static int RingBuffer8SrSwPut01 (void) { int result = 0; RingBuffer8 *rb = NULL; rb = RingBuffer8Init(); if (rb == NULL) { printf("rb == NULL: "); goto end; } if (SC_ATOMIC_GET(rb->read) != 0) { printf("read %u, expected 0: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != 0) { printf("write %u, expected 0: ", SC_ATOMIC_GET(rb->write)); goto end; } void *ptr = &result; RingBufferSrSw8Put(rb, ptr); if (SC_ATOMIC_GET(rb->read) != 0) { printf("read %u, expected 0: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != 1) { printf("write %u, expected 1: ", SC_ATOMIC_GET(rb->write)); goto end; } if (rb->array[0] != ptr) { printf("ptr is %p, expected %p: ", rb->array[0], ptr); goto end; } result = 1; end: if (rb != NULL) { RingBuffer8Destroy(rb); } return result; } static int RingBuffer8SrSwPut02 (void) { int result = 0; RingBuffer8 *rb = NULL; int array[255]; int cnt = 0; for (cnt = 0; cnt < 255; cnt++) { array[cnt] = cnt; } rb = RingBuffer8Init(); if (rb == NULL) { printf("rb == NULL: "); goto end; } for (cnt = 0; cnt < 255; cnt++) { RingBufferSrSw8Put(rb, (void *)&array[cnt]); if (SC_ATOMIC_GET(rb->read) != 0) { printf("read %u, expected 0: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != (unsigned char)(cnt+1)) { printf("write %u, expected %u: ", SC_ATOMIC_GET(rb->write), (unsigned char)(cnt+1)); goto end; } if (rb->array[cnt] != (void *)&array[cnt]) { printf("ptr is %p, expected %p: ", rb->array[cnt], (void *)&array[cnt]); goto end; } } if (!(RingBuffer8IsFull(rb))) { printf("ringbuffer should be full, isn't: "); goto end; } result = 1; end: if (rb != NULL) { RingBuffer8Destroy(rb); } return result; } static int RingBuffer8SrSwGet01 (void) { int result = 0; RingBuffer8 *rb = NULL; rb = RingBuffer8Init(); if (rb == NULL) { printf("rb == NULL: "); goto end; } void *ptr = &result; RingBufferSrSw8Put(rb, ptr); void *ptr2 = RingBufferSrSw8Get(rb); if (ptr != ptr2) { printf("ptr %p != ptr2 %p: ", ptr, ptr2); goto end; } if (SC_ATOMIC_GET(rb->read) != 1) { printf("read %u, expected 1: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != 1) { printf("write %u, expected 1: ", SC_ATOMIC_GET(rb->write)); goto end; } result = 1; end: if (rb != NULL) { RingBuffer8Destroy(rb); } return result; } static int RingBuffer8SrSwGet02 (void) { int result = 0; RingBuffer8 *rb = NULL; int array[255]; int cnt = 0; for (cnt = 0; cnt < 255; cnt++) { array[cnt] = cnt; } rb = RingBuffer8Init(); if (rb == NULL) { printf("rb == NULL: "); goto end; } for (cnt = 0; cnt < 255; cnt++) { RingBufferSrSw8Put(rb, (void *)&array[cnt]); if (SC_ATOMIC_GET(rb->read) != 0) { printf("read %u, expected 0: ", SC_ATOMIC_GET(rb->read)); goto end; } if (SC_ATOMIC_GET(rb->write) != (unsigned char)(cnt+1)) { printf("write %u, expected %u: ", SC_ATOMIC_GET(rb->write), (unsigned char)(cnt+1)); goto end; } if (rb->array[cnt] != (void *)&array[cnt]) { printf("ptr is %p, expected %p: ", rb->array[cnt], (void *)&array[cnt]); goto end; } } if (!(RingBuffer8IsFull(rb))) { printf("ringbuffer should be full, isn't: "); goto end; } for (cnt = 0; cnt < 255; cnt++) { void *ptr = RingBufferSrSw8Get(rb); if (SC_ATOMIC_GET(rb->read) != (unsigned char)(cnt+1)) { printf("read %u, expected %u: ", SC_ATOMIC_GET(rb->read), (unsigned char)(cnt+1)); goto end; } if (SC_ATOMIC_GET(rb->write) != 255) { printf("write %u, expected %u: ", SC_ATOMIC_GET(rb->write), 255); goto end; } if (ptr != (void *)&array[cnt]) { printf("ptr is %p, expected %p: ", ptr, (void *)&array[cnt]); goto end; } } if (!(RingBuffer8IsEmpty(rb))) { printf("ringbuffer should be empty, isn't: "); goto end; } result = 1; end: if (rb != NULL) { RingBuffer8Destroy(rb); } return result; } #endif /* UNITTESTS */ void DetectRingBufferRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("RingBuffer8SrSwInit01", RingBuffer8SrSwInit01); UtRegisterTest("RingBuffer8SrSwPut01", RingBuffer8SrSwPut01); UtRegisterTest("RingBuffer8SrSwPut02", RingBuffer8SrSwPut02); UtRegisterTest("RingBuffer8SrSwGet01", RingBuffer8SrSwGet01); UtRegisterTest("RingBuffer8SrSwGet02", RingBuffer8SrSwGet02); #endif /* UNITTESTS */ } suricata-3.2.1/src/source-erf-dag.h0000644000000000000000000000175313051004444013763 00000000000000/* Copyright (C) 2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited * \author Jason MacLulich */ #ifndef __SOURCE_ERF_DAG_H__ #define __SOURCE_ERF_DAG_H__ void TmModuleReceiveErfDagRegister(void); void TmModuleDecodeErfDagRegister(void); #endif /* __SOURCE_ERF_DAG_H__ */ suricata-3.2.1/src/util-lua-dns.h0000644000000000000000000000167013051004444013474 00000000000000/* Copyright (C) 2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Eric Leblond */ #ifndef __UTIL_LUA_DNS_H__ #define __UTIL_LUA_DNS_H__ #ifdef HAVE_LUA int LuaRegisterDnsFunctions(lua_State *luastate); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_HTTP_H__ */ suricata-3.2.1/src/source-erf-dag.c0000644000000000000000000004723413051004444013762 00000000000000/* Copyright (C) 2010-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Endace Technology Limited. * \author Jason MacLulich * * Support for reading ERF records from a DAG card. * * Only ethernet supported at this time. */ #include "suricata-common.h" #include "suricata.h" #include "tm-threads.h" #include "util-privs.h" #include "util-device.h" #include "tmqh-packetpool.h" #ifndef HAVE_DAG TmEcode NoErfDagSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveErfDagRegister(void) { tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag"; tmm_modules[TMM_RECEIVEERFDAG].ThreadInit = NoErfDagSupportExit; tmm_modules[TMM_RECEIVEERFDAG].Func = NULL; tmm_modules[TMM_RECEIVEERFDAG].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVEERFDAG].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEERFDAG].RegisterTests = NULL; tmm_modules[TMM_RECEIVEERFDAG].cap_flags = SC_CAP_NET_ADMIN; tmm_modules[TMM_RECEIVEERFDAG].flags = TM_FLAG_RECEIVE_TM; } void TmModuleDecodeErfDagRegister(void) { tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag"; tmm_modules[TMM_DECODEERFDAG].ThreadInit = NoErfDagSupportExit; tmm_modules[TMM_DECODEERFDAG].Func = NULL; tmm_modules[TMM_DECODEERFDAG].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEERFDAG].ThreadDeinit = NULL; tmm_modules[TMM_DECODEERFDAG].RegisterTests = NULL; tmm_modules[TMM_DECODEERFDAG].cap_flags = 0; tmm_modules[TMM_DECODEERFDAG].flags = TM_FLAG_DECODE_TM; } TmEcode NoErfDagSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_DAG_NOSUPPORT, "Error creating thread %s: you do not have support for DAG cards " "enabled please recompile with --enable-dag", tv->name); exit(EXIT_FAILURE); } #else /* Implied we do have DAG support */ #include "source-erf-dag.h" #include /* Minimum amount of data to read from the DAG at a time. */ #define MINDATA 32768 /* Maximum time (us) to wait for MINDATA to be read. */ #define MAXWAIT 20000 /* Poll interval in microseconds. */ #define POLL_INTERVAL 1000; /* Number of bytes per loop to process before fetching more data. */ #define BYTES_PER_LOOP (4 * 1024 * 1024) /* 4 MB */ extern int max_pending_packets; typedef struct ErfDagThreadVars_ { ThreadVars *tv; TmSlot *slot; int dagfd; int dagstream; char dagname[DAGNAME_BUFSIZE]; struct timeval maxwait, poll; /* Could possibly be made static */ LiveDevice *livedev; uint64_t bytes; uint16_t packets; uint16_t drops; /* Current location in the DAG stream input buffer. */ uint8_t *top; uint8_t *btm; } ErfDagThreadVars; static inline TmEcode ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read); static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec); TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot); TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **); void ReceiveErfDagThreadExitStats(ThreadVars *, void *); TmEcode ReceiveErfDagThreadDeinit(ThreadVars *, void *); TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **); TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data); TmEcode DecodeErfDag(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); void ReceiveErfDagCloseStream(int dagfd, int stream); /** * \brief Register the ERF file receiver (reader) module. */ void TmModuleReceiveErfDagRegister(void) { tmm_modules[TMM_RECEIVEERFDAG].name = "ReceiveErfDag"; tmm_modules[TMM_RECEIVEERFDAG].ThreadInit = ReceiveErfDagThreadInit; tmm_modules[TMM_RECEIVEERFDAG].Func = NULL; tmm_modules[TMM_RECEIVEERFDAG].PktAcqLoop = ReceiveErfDagLoop; tmm_modules[TMM_RECEIVEERFDAG].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVEERFDAG].ThreadExitPrintStats = ReceiveErfDagThreadExitStats; tmm_modules[TMM_RECEIVEERFDAG].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVEERFDAG].RegisterTests = NULL; tmm_modules[TMM_RECEIVEERFDAG].cap_flags = 0; tmm_modules[TMM_RECEIVEERFDAG].flags = TM_FLAG_RECEIVE_TM; } /** * \brief Register the ERF file decoder module. */ void TmModuleDecodeErfDagRegister(void) { tmm_modules[TMM_DECODEERFDAG].name = "DecodeErfDag"; tmm_modules[TMM_DECODEERFDAG].ThreadInit = DecodeErfDagThreadInit; tmm_modules[TMM_DECODEERFDAG].Func = DecodeErfDag; tmm_modules[TMM_DECODEERFDAG].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODEERFDAG].ThreadDeinit = DecodeErfDagThreadDeinit; tmm_modules[TMM_DECODEERFDAG].RegisterTests = NULL; tmm_modules[TMM_DECODEERFDAG].cap_flags = 0; tmm_modules[TMM_DECODEERFDAG].flags = TM_FLAG_DECODE_TM; } /** * \brief Initialize the ERF receiver thread, generate a single * ErfDagThreadVar structure for each thread, this will * contain a DAG file descriptor which is read when the * thread executes. * * \param tv Thread variable to ThreadVars * \param initdata Initial data to the interface passed from the user, * this is processed by the user. * * We assume that we have only a single name for the DAG * interface. * * \param data data pointer gets populated with * */ TmEcode ReceiveErfDagThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); int stream_count = 0; if (initdata == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Error: No DAG interface provided."); SCReturnInt(TM_ECODE_FAILED); } ErfDagThreadVars *ewtn = SCMalloc(sizeof(ErfDagThreadVars)); if (unlikely(ewtn == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for ERF DAG thread vars."); exit(EXIT_FAILURE); } memset(ewtn, 0, sizeof(*ewtn)); /* dag_parse_name will return a DAG device name and stream number * to open for this thread. */ if (dag_parse_name(initdata, ewtn->dagname, DAGNAME_BUFSIZE, &ewtn->dagstream) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to parse DAG interface: %s", (char*)initdata); SCFree(ewtn); exit(EXIT_FAILURE); } ewtn->livedev = LiveGetDevice(initdata); if (ewtn->livedev == NULL) { SCLogError(SC_ERR_INVALID_VALUE, "Unable to get %s live device", (char *)initdata); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("Opening DAG: %s on stream: %d for processing", ewtn->dagname, ewtn->dagstream); if ((ewtn->dagfd = dag_open(ewtn->dagname)) < 0) { SCLogError(SC_ERR_ERF_DAG_OPEN_FAILED, "Failed to open DAG: %s", ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } /* Check to make sure the card has enough available streams to * support reading from the one specified. */ if ((stream_count = dag_rx_get_stream_count(ewtn->dagfd)) < 0) { SCLogError(SC_ERR_ERF_DAG_OPEN_FAILED, "Failed to open stream: %d, DAG: %s, could not query stream count", ewtn->dagstream, ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } /* Check to make sure we have enough rx streams to open the stream * the user is asking for. */ if (ewtn->dagstream > stream_count * 2) { SCLogError(SC_ERR_ERF_DAG_OPEN_FAILED, "Failed to open stream: %d, DAG: %s, insufficient streams: %d", ewtn->dagstream, ewtn->dagname, stream_count); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } /* If we are transmitting into a soft DAG card then set the stream * to act in reverse mode. */ if (0 != (ewtn->dagstream & 0x01)) { /* Setting reverse mode for using with soft dag from daemon side */ if (dag_set_mode(ewtn->dagfd, ewtn->dagstream, DAG_REVERSE_MODE)) { SCLogError(SC_ERR_ERF_DAG_STREAM_OPEN_FAILED, "Failed to set mode to DAG_REVERSE_MODE on stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } } if (dag_attach_stream(ewtn->dagfd, ewtn->dagstream, 0, 0) < 0) { SCLogError(SC_ERR_ERF_DAG_STREAM_OPEN_FAILED, "Failed to open DAG stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } if (dag_start_stream(ewtn->dagfd, ewtn->dagstream) < 0) { SCLogError(SC_ERR_ERF_DAG_STREAM_START_FAILED, "Failed to start DAG stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } SCLogInfo("Attached and started stream: %d on DAG: %s", ewtn->dagstream, ewtn->dagname); /* * Initialise DAG Polling parameters. */ timerclear(&ewtn->maxwait); ewtn->maxwait.tv_usec = MAXWAIT; timerclear(&ewtn->poll); ewtn->poll.tv_usec = POLL_INTERVAL; /* 32kB minimum data to return -- we still restrict the number of * pkts that are processed to a maximum of dag_max_read_packets. */ if (dag_set_stream_poll(ewtn->dagfd, ewtn->dagstream, MINDATA, &(ewtn->maxwait), &(ewtn->poll)) < 0) { SCLogError(SC_ERR_ERF_DAG_STREAM_SET_FAILED, "Failed to set poll parameters for stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname); SCFree(ewtn); SCReturnInt(TM_ECODE_FAILED); } ewtn->packets = StatsRegisterCounter("capture.dag_packets", tv); ewtn->drops = StatsRegisterCounter("capture.dag_drops", tv); ewtn->tv = tv; *data = (void *)ewtn; SCLogInfo("Starting processing packets from stream: %d on DAG: %s", ewtn->dagstream, ewtn->dagname); SCReturnInt(TM_ECODE_OK); } /** * \brief Receives packets from a DAG interface. * * \param tv pointer to ThreadVars * \param data pointer to ErfDagThreadVars * \param slot slot containing task information * * \retval TM_ECODE_OK on success * \retval TM_ECODE_FAILED on failure */ TmEcode ReceiveErfDagLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); ErfDagThreadVars *dtv = (ErfDagThreadVars *)data; uint32_t diff = 0; int err; uint8_t *top = NULL; uint32_t pkts_read = 0; TmSlot *s = (TmSlot *)slot; dtv->slot = s->slot_next; while (1) { if (suricata_ctl_flags & SURICATA_STOP) { SCReturnInt(TM_ECODE_OK); } top = dag_advance_stream(dtv->dagfd, dtv->dagstream, &(dtv->btm)); if (top == NULL) { if (errno == EAGAIN) { if (dtv->dagstream & 0x1) { usleep(10 * 1000); dtv->btm = dtv->top; } continue; } else { SCLogError(SC_ERR_ERF_DAG_STREAM_READ_FAILED, "Failed to read from stream: %d, DAG: %s when " "using dag_advance_stream", dtv->dagstream, dtv->dagname); SCReturnInt(TM_ECODE_FAILED); } } diff = top - dtv->btm; if (diff == 0) { continue; } assert(diff >= dag_record_size); err = ProcessErfDagRecords(dtv, top, &pkts_read); if (err == TM_ECODE_FAILED) { SCLogError(SC_ERR_ERF_DAG_STREAM_READ_FAILED, "Failed to read from stream: %d, DAG: %s", dtv->dagstream, dtv->dagname); ReceiveErfDagCloseStream(dtv->dagfd, dtv->dagstream); SCReturnInt(TM_ECODE_FAILED); } StatsSyncCountersIfSignalled(tv); SCLogDebug("Read %d records from stream: %d, DAG: %s", pkts_read, dtv->dagstream, dtv->dagname); } SCReturnInt(TM_ECODE_OK); } /** * \brief Process a chunk of records read from a DAG interface. * * This function takes a pointer to buffer read from the DAG interface * and processes it individual records. */ static inline TmEcode ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read) { SCEnter(); int err = 0; dag_record_t *dr = NULL; char *prec = NULL; int rlen; char hdr_type = 0; int processed = 0; *pkts_read = 0; while (((top - ewtn->btm) >= dag_record_size) && ((processed + dag_record_size) < BYTES_PER_LOOP)) { /* Make sure we have at least one packet in the packet pool, * to prevent us from alloc'ing packets at line rate. */ PacketPoolWait(); prec = (char *)ewtn->btm; dr = (dag_record_t*)prec; rlen = ntohs(dr->rlen); hdr_type = dr->type; /* If we don't have enough data to finish processing this ERF * record return and maybe next time we will. */ if ((top - ewtn->btm) < rlen) SCReturnInt(TM_ECODE_OK); ewtn->btm += rlen; processed += rlen; /* Only support ethernet at this time. */ switch (hdr_type & 0x7f) { case TYPE_PAD: /* Skip. */ continue; case TYPE_DSM_COLOR_ETH: case TYPE_COLOR_ETH: case TYPE_COLOR_HASH_ETH: /* In these types the color value overwrites the lctr * (drop count). */ break; case TYPE_ETH: if (dr->lctr) { StatsAddUI64(ewtn->tv, ewtn->drops, ntohs(dr->lctr)); } break; default: SCLogError(SC_ERR_UNIMPLEMENTED, "Processing of DAG record type: %d not implemented.", dr->type); SCReturnInt(TM_ECODE_FAILED); } err = ProcessErfDagRecord(ewtn, prec); if (err != TM_ECODE_OK) { SCReturnInt(TM_ECODE_FAILED); } (*pkts_read)++; } SCReturnInt(TM_ECODE_OK); } /** * \brief Process a DAG record into a TM packet buffer. * \param prec pointer to a DAG record. * \param */ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec) { SCEnter(); int wlen = 0; int rlen = 0; int hdr_num = 0; char hdr_type = 0; dag_record_t *dr = (dag_record_t*)prec; erf_payload_t *pload; Packet *p; hdr_type = dr->type; wlen = ntohs(dr->wlen); rlen = ntohs(dr->rlen); /* count extension headers */ while (hdr_type & 0x80) { if (rlen < (dag_record_size + (hdr_num * 8))) { SCLogError(SC_ERR_UNIMPLEMENTED, "Insufficient captured packet length."); SCReturnInt(TM_ECODE_FAILED); } hdr_type = prec[(dag_record_size + (hdr_num * 8))]; hdr_num++; } /* Check that the whole frame was captured */ if (rlen < (dag_record_size + (8 * hdr_num) + 2 + wlen)) { SCLogInfo("Incomplete frame captured."); SCReturnInt(TM_ECODE_OK); } /* skip over extension headers */ pload = (erf_payload_t *)(prec + dag_record_size + (8 * hdr_num)); p = PacketGetFromQueueOrAlloc(); if (p == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate a Packet on stream: %d, DAG: %s", ewtn->dagstream, ewtn->dagname); SCReturnInt(TM_ECODE_FAILED); } PKT_SET_SRC(p, PKT_SRC_WIRE); SET_PKT_LEN(p, wlen); p->datalink = LINKTYPE_ETHERNET; /* Take into account for link type Ethernet ETH frame starts * after ther ERF header + pad. */ if (unlikely(PacketCopyData(p, pload->eth.dst, GET_PKT_LEN(p)))) { TmqhOutputPacketpool(ewtn->tv, p); SCReturnInt(TM_ECODE_FAILED); } /* Convert ERF time to timeval - from libpcap. */ uint64_t ts = dr->ts; p->ts.tv_sec = ts >> 32; ts = (ts & 0xffffffffULL) * 1000000; ts += 0x80000000; /* rounding */ p->ts.tv_usec = ts >> 32; if (p->ts.tv_usec >= 1000000) { p->ts.tv_usec -= 1000000; p->ts.tv_sec++; } StatsIncr(ewtn->tv, ewtn->packets); ewtn->bytes += wlen; if (TmThreadsSlotProcessPkt(ewtn->tv, ewtn->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ewtn->tv, p); SCReturnInt(TM_ECODE_FAILED); } SCReturnInt(TM_ECODE_OK); } /** * \brief Print some stats to the log at program exit. * * \param tv Pointer to ThreadVars. * \param data Pointer to data, ErfFileThreadVars. */ void ReceiveErfDagThreadExitStats(ThreadVars *tv, void *data) { ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data; (void)SC_ATOMIC_SET(ewtn->livedev->pkts, StatsGetLocalCounterValue(tv, ewtn->packets)); (void)SC_ATOMIC_SET(ewtn->livedev->drop, StatsGetLocalCounterValue(tv, ewtn->drops)); SCLogInfo("Stream: %d; Bytes: %"PRIu64"; Packets: %"PRIu64 "; Drops: %"PRIu64, ewtn->dagstream, ewtn->bytes, StatsGetLocalCounterValue(tv, ewtn->packets), StatsGetLocalCounterValue(tv, ewtn->drops)); } /** * \brief Deinitializes the DAG card. * \param tv pointer to ThreadVars * \param data pointer that gets cast into PcapThreadVars for ptv */ TmEcode ReceiveErfDagThreadDeinit(ThreadVars *tv, void *data) { SCEnter(); ErfDagThreadVars *ewtn = (ErfDagThreadVars *)data; ReceiveErfDagCloseStream(ewtn->dagfd, ewtn->dagstream); SCReturnInt(TM_ECODE_OK); } void ReceiveErfDagCloseStream(int dagfd, int stream) { dag_stop_stream(dagfd, stream); dag_detach_stream(dagfd, stream); dag_close(dagfd); } /** Decode ErfDag */ /** * \brief This function passes off to link type decoders. * * DecodeErfDag reads packets from the PacketQueue and passes * them off to the proper link type decoder. * * \param t pointer to ThreadVars * \param p pointer to the current packet * \param data pointer that gets cast into PcapThreadVars for ptv * \param pq pointer to the current PacketQueue */ TmEcode DecodeErfDag(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { SCEnter(); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); /* call the decoder */ switch(p->datalink) { case LINKTYPE_ETHERNET: DecodeEthernet(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); break; default: SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module DecodeErfDag", p->datalink); break; } PacketDecodeFinalize(tv, dtv, p); SCReturnInt(TM_ECODE_OK); } TmEcode DecodeErfDagThreadInit(ThreadVars *tv, void *initdata, void **data) { SCEnter(); DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; SCReturnInt(TM_ECODE_OK); } TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* HAVE_DAG */ suricata-3.2.1/src/tmqh-packetpool.h0000644000000000000000000000504613051004444014267 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __TMQH_PACKETPOOL_H__ #define __TMQH_PACKETPOOL_H__ #include "decode.h" #include "threads.h" #include "util-atomic.h" /* Return stack, onto which other threads free packets. */ typedef struct PktPoolLockedStack_{ /* linked list of free packets. */ SCMutex mutex; SCCondT cond; SC_ATOMIC_DECLARE(int, sync_now); Packet *head; } __attribute__((aligned(CLS))) PktPoolLockedStack; typedef struct PktPool_ { /* link listed of free packets local to this thread. * No mutex is needed. */ Packet *head; /* Packets waiting (pending) to be returned to the given Packet * Pool. Accumulate packets for the same pool until a theshold is * reached, then return them all at once. Keep the head and tail * to fast insertion of the entire list onto a return stack. */ struct PktPool_ *pending_pool; Packet *pending_head; Packet *pending_tail; uint32_t pending_count; #ifdef DEBUG_VALIDATION int initialized; int destroyed; #endif /* DEBUG_VALIDATION */ /* All members above this point are accessed locally by only one thread, so * these should live on their own cache line. */ /* Return stack, where other threads put packets that they free that belong * to this thread. */ PktPoolLockedStack return_stack; } PktPool; Packet *TmqhInputPacketpool(ThreadVars *); void TmqhOutputPacketpool(ThreadVars *, Packet *); void TmqhReleasePacketsToPacketPool(PacketQueue *); void TmqhPacketpoolRegister(void); Packet *PacketPoolGetPacket(void); void PacketPoolWait(void); void PacketPoolWaitForN(int n); void PacketPoolReturnPacket(Packet *p); void PacketPoolInit(void); void PacketPoolInitEmpty(void); void PacketPoolDestroy(void); void PacketPoolPostRunmodes(void); #endif /* __TMQH_PACKETPOOL_H__ */ suricata-3.2.1/src/app-layer-enip.h0000644000000000000000000000203613051004444013776 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong */ #ifndef __APP_LAYER_ENIP_H__ #define __APP_LAYER_ENIP_H__ #include "decode.h" #include "detect-engine-state.h" #include "queue.h" void RegisterENIPUDPParsers(void); void RegisterENIPTCPParsers(void); void ENIPParserRegisterTests(void); #endif /* __APP_LAYER_ENIP_H__ */ suricata-3.2.1/src/flow-manager.c0000644000000000000000000012102213051004444013522 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * \author Victor Julien */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "conf.h" #include "threadvars.h" #include "tm-threads.h" #include "runmodes.h" #include "util-random.h" #include "util-time.h" #include "flow.h" #include "flow-queue.h" #include "flow-hash.h" #include "flow-util.h" #include "flow-var.h" #include "flow-private.h" #include "flow-timeout.h" #include "flow-manager.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-byte.h" #include "util-debug.h" #include "util-privs.h" #include "util-signal.h" #include "threads.h" #include "detect.h" #include "detect-engine-state.h" #include "stream.h" #include "app-layer-parser.h" #include "host-timeout.h" #include "defrag-timeout.h" #include "ippair-timeout.h" #include "output-flow.h" /* Run mode selected at suricata.c */ extern int run_mode; /* multi flow mananger support */ static uint32_t flowmgr_number = 1; /* atomic counter for flow managers, to assign instance id */ SC_ATOMIC_DECLARE(uint32_t, flowmgr_cnt); /* multi flow recycler support */ static uint32_t flowrec_number = 1; /* atomic counter for flow recyclers, to assign instance id */ SC_ATOMIC_DECLARE(uint32_t, flowrec_cnt); SC_ATOMIC_EXTERN(unsigned int, flow_flags); typedef FlowProtoTimeout *FlowProtoTimeoutPtr; SC_ATOMIC_DECLARE(FlowProtoTimeoutPtr, flow_timeouts); void FlowTimeoutsInit(void) { SC_ATOMIC_SET(flow_timeouts, flow_timeouts_normal); } void FlowTimeoutsEmergency(void) { SC_ATOMIC_SET(flow_timeouts, flow_timeouts_emerg); } /* 1 seconds */ #define FLOW_NORMAL_MODE_UPDATE_DELAY_SEC 1 #define FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC 0 /* 0.1 seconds */ #define FLOW_EMERG_MODE_UPDATE_DELAY_SEC 0 #define FLOW_EMERG_MODE_UPDATE_DELAY_NSEC 100000 #define NEW_FLOW_COUNT_COND 10 typedef struct FlowTimeoutCounters_ { uint32_t new; uint32_t est; uint32_t clo; uint32_t byp; uint32_t tcp_reuse; uint32_t flows_checked; uint32_t flows_notimeout; uint32_t flows_timeout; uint32_t flows_timeout_inuse; uint32_t flows_removed; uint32_t rows_checked; uint32_t rows_skipped; uint32_t rows_empty; uint32_t rows_busy; uint32_t rows_maxlen; } FlowTimeoutCounters; /** * \brief Used to disable flow manager thread(s). * * \todo Kinda hackish since it uses the tv name to identify flow manager * thread. We need an all weather identification scheme. */ void FlowDisableFlowManagerThread(void) { #ifdef AFLFUZZ_DISABLE_MGTTHREADS return; #endif ThreadVars *tv = NULL; int cnt = 0; /* wake up threads */ uint32_t u; for (u = 0; u < flowmgr_number; u++) SCCtrlCondSignal(&flow_manager_ctrl_cond); SCMutexLock(&tv_root_lock); /* flow manager thread(s) is/are a part of mgmt threads */ tv = tv_root[TVT_MGMT]; while (tv != NULL) { if (strncasecmp(tv->name, thread_name_flow_mgr, strlen(thread_name_flow_mgr)) == 0) { TmThreadsSetFlag(tv, THV_KILL); cnt++; /* value in seconds */ #define THREAD_KILL_MAX_WAIT_TIME 60 /* value in microseconds */ #define WAIT_TIME 100 double total_wait_time = 0; while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { usleep(WAIT_TIME); total_wait_time += WAIT_TIME / 1000000.0; if (total_wait_time > THREAD_KILL_MAX_WAIT_TIME) { SCLogError(SC_ERR_FATAL, "Engine unable to " "disable detect thread - \"%s\". " "Killing engine", tv->name); exit(EXIT_FAILURE); } } } tv = tv->next; } SCMutexUnlock(&tv_root_lock); /* wake up threads, another try */ for (u = 0; u < flowmgr_number; u++) SCCtrlCondSignal(&flow_manager_ctrl_cond); /* reset count, so we can kill and respawn (unix socket) */ SC_ATOMIC_SET(flowmgr_cnt, 0); return; } /** \internal * \brief get timeout for flow * * \param f flow * \param state flow state * * \retval timeout timeout in seconds */ static inline uint32_t FlowGetFlowTimeout(const Flow *f, enum FlowState state) { uint32_t timeout; FlowProtoTimeoutPtr flow_timeouts = SC_ATOMIC_GET(flow_timeouts); switch(state) { default: case FLOW_STATE_NEW: timeout = flow_timeouts[f->protomap].new_timeout; break; case FLOW_STATE_ESTABLISHED: timeout = flow_timeouts[f->protomap].est_timeout; break; case FLOW_STATE_CLOSED: timeout = flow_timeouts[f->protomap].closed_timeout; break; case FLOW_STATE_CAPTURE_BYPASSED: timeout = FLOW_BYPASSED_TIMEOUT; break; case FLOW_STATE_LOCAL_BYPASSED: timeout = flow_timeouts[f->protomap].bypassed_timeout; break; } return timeout; } /** \internal * \brief check if a flow is timed out * * \param f flow * \param ts timestamp * * \retval 0 not timed out * \retval 1 timed out */ static int FlowManagerFlowTimeout(const Flow *f, enum FlowState state, struct timeval *ts, int32_t *next_ts) { /* set the timeout value according to the flow operating mode, * flow's state and protocol.*/ uint32_t timeout = FlowGetFlowTimeout(f, state); int32_t flow_times_out_at = (int32_t)(f->lastts.tv_sec + timeout); if (*next_ts == 0 || flow_times_out_at < *next_ts) *next_ts = flow_times_out_at; /* do the timeout check */ if (flow_times_out_at >= ts->tv_sec) { return 0; } return 1; } /** \internal * \brief See if we can really discard this flow. Check use_cnt reference * counter and force reassembly if necessary. * * \param f flow * \param ts timestamp * * \retval 0 not timed out just yet * \retval 1 fully timed out, lets kill it */ static int FlowManagerFlowTimedOut(Flow *f, struct timeval *ts) { /* never prune a flow that is used by a packet we * are currently processing in one of the threads */ if (SC_ATOMIC_GET(f->use_cnt) > 0) { return 0; } int server = 0, client = 0; if (!(f->flags & FLOW_TIMEOUT_REASSEMBLY_DONE) && FlowForceReassemblyNeedReassembly(f, &server, &client) == 1) { FlowForceReassemblyForFlow(f, server, client); return 0; } #ifdef DEBUG /* this should not be possible */ BUG_ON(SC_ATOMIC_GET(f->use_cnt) > 0); #endif return 1; } /** * \internal * * \brief check all flows in a hash row for timing out * * \param f last flow in the hash row * \param ts timestamp * \param emergency bool indicating emergency mode * \param counters ptr to FlowTimeoutCounters structure * * \retval cnt timed out flows */ static uint32_t FlowManagerHashRowTimeout(Flow *f, struct timeval *ts, int emergency, FlowTimeoutCounters *counters, int32_t *next_ts) { uint32_t cnt = 0; uint32_t checked = 0; do { checked++; /* check flow timeout based on lastts and state. Both can be * accessed w/o Flow lock as we do have the hash row lock (so flow * can't disappear) and flow_state is atomic. lastts can only * be modified when we have both the flow and hash row lock */ enum FlowState state = SC_ATOMIC_GET(f->flow_state); /* timeout logic goes here */ if (FlowManagerFlowTimeout(f, state, ts, next_ts) == 0) { counters->flows_notimeout++; f = f->hprev; continue; } /* before grabbing the flow lock, make sure we have at least * 3 packets in the pool */ PacketPoolWaitForN(3); FLOWLOCK_WRLOCK(f); Flow *next_flow = f->hprev; counters->flows_timeout++; /* check if the flow is fully timed out and * ready to be discarded. */ if (FlowManagerFlowTimedOut(f, ts) == 1) { /* remove from the hash */ if (f->hprev != NULL) f->hprev->hnext = f->hnext; if (f->hnext != NULL) f->hnext->hprev = f->hprev; if (f->fb->head == f) f->fb->head = f->hnext; if (f->fb->tail == f) f->fb->tail = f->hprev; f->hnext = NULL; f->hprev = NULL; if (f->flags & FLOW_TCP_REUSED) counters->tcp_reuse++; if (state == FLOW_STATE_NEW) f->flow_end_flags |= FLOW_END_FLAG_STATE_NEW; else if (state == FLOW_STATE_ESTABLISHED) f->flow_end_flags |= FLOW_END_FLAG_STATE_ESTABLISHED; else if (state == FLOW_STATE_CLOSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_CLOSED; else if (state == FLOW_STATE_LOCAL_BYPASSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_BYPASSED; else if (state == FLOW_STATE_CAPTURE_BYPASSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_BYPASSED; if (emergency) f->flow_end_flags |= FLOW_END_FLAG_EMERGENCY; f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT; /* no one is referring to this flow, use_cnt 0, removed from hash * so we can unlock it and pass it to the flow recycler */ FLOWLOCK_UNLOCK(f); FlowEnqueue(&flow_recycle_q, f); cnt++; switch (state) { case FLOW_STATE_NEW: default: counters->new++; break; case FLOW_STATE_ESTABLISHED: counters->est++; break; case FLOW_STATE_CLOSED: counters->clo++; break; case FLOW_STATE_LOCAL_BYPASSED: case FLOW_STATE_CAPTURE_BYPASSED: counters->byp++; break; } counters->flows_removed++; } else { counters->flows_timeout_inuse++; FLOWLOCK_UNLOCK(f); } f = next_flow; } while (f != NULL); counters->flows_checked += checked; if (checked > counters->rows_maxlen) counters->rows_maxlen = checked; return cnt; } /** * \brief time out flows from the hash * * \param ts timestamp * \param try_cnt number of flows to time out max (0 is unlimited) * \param hash_min min hash index to consider * \param hash_max max hash index to consider * \param counters ptr to FlowTimeoutCounters structure * * \retval cnt number of timed out flow */ static uint32_t FlowTimeoutHash(struct timeval *ts, uint32_t try_cnt, uint32_t hash_min, uint32_t hash_max, FlowTimeoutCounters *counters) { uint32_t idx = 0; uint32_t cnt = 0; int emergency = 0; if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) emergency = 1; for (idx = hash_min; idx < hash_max; idx++) { FlowBucket *fb = &flow_hash[idx]; counters->rows_checked++; int32_t check_ts = SC_ATOMIC_GET(fb->next_ts); if (check_ts > (int32_t)ts->tv_sec) { counters->rows_skipped++; continue; } /* before grabbing the row lock, make sure we have at least * 9 packets in the pool */ PacketPoolWaitForN(9); if (FBLOCK_TRYLOCK(fb) != 0) { counters->rows_busy++; continue; } /* flow hash bucket is now locked */ if (fb->tail == NULL) { SC_ATOMIC_SET(fb->next_ts, INT_MAX); counters->rows_empty++; goto next; } int32_t next_ts = 0; /* we have a flow, or more than one */ cnt += FlowManagerHashRowTimeout(fb->tail, ts, emergency, counters, &next_ts); SC_ATOMIC_SET(fb->next_ts, next_ts); next: FBLOCK_UNLOCK(fb); if (try_cnt > 0 && cnt >= try_cnt) break; } return cnt; } /** * \internal * * \brief move all flows out of a hash row * * \param f last flow in the hash row * * \retval cnt removed out flows */ static uint32_t FlowManagerHashRowCleanup(Flow *f) { uint32_t cnt = 0; do { FLOWLOCK_WRLOCK(f); Flow *next_flow = f->hprev; int state = SC_ATOMIC_GET(f->flow_state); /* remove from the hash */ if (f->hprev != NULL) f->hprev->hnext = f->hnext; if (f->hnext != NULL) f->hnext->hprev = f->hprev; if (f->fb->head == f) f->fb->head = f->hnext; if (f->fb->tail == f) f->fb->tail = f->hprev; f->hnext = NULL; f->hprev = NULL; if (state == FLOW_STATE_NEW) f->flow_end_flags |= FLOW_END_FLAG_STATE_NEW; else if (state == FLOW_STATE_ESTABLISHED) f->flow_end_flags |= FLOW_END_FLAG_STATE_ESTABLISHED; else if (state == FLOW_STATE_CLOSED) f->flow_end_flags |= FLOW_END_FLAG_STATE_CLOSED; f->flow_end_flags |= FLOW_END_FLAG_SHUTDOWN; /* no one is referring to this flow, use_cnt 0, removed from hash * so we can unlock it and move it to the recycle queue. */ FLOWLOCK_UNLOCK(f); FlowEnqueue(&flow_recycle_q, f); cnt++; f = next_flow; } while (f != NULL); return cnt; } /** * \brief remove all flows from the hash * * \retval cnt number of removes out flows */ static uint32_t FlowCleanupHash(void){ uint32_t idx = 0; uint32_t cnt = 0; for (idx = 0; idx < flow_config.hash_size; idx++) { FlowBucket *fb = &flow_hash[idx]; FBLOCK_LOCK(fb); if (fb->tail != NULL) { /* we have a flow, or more than one */ cnt += FlowManagerHashRowCleanup(fb->tail); } FBLOCK_UNLOCK(fb); } return cnt; } extern int g_detect_disabled; typedef struct FlowManagerThreadData_ { uint32_t instance; uint32_t min; uint32_t max; uint16_t flow_mgr_cnt_clo; uint16_t flow_mgr_cnt_new; uint16_t flow_mgr_cnt_est; uint16_t flow_mgr_cnt_byp; uint16_t flow_mgr_spare; uint16_t flow_emerg_mode_enter; uint16_t flow_emerg_mode_over; uint16_t flow_tcp_reuse; uint16_t flow_mgr_flows_checked; uint16_t flow_mgr_flows_notimeout; uint16_t flow_mgr_flows_timeout; uint16_t flow_mgr_flows_timeout_inuse; uint16_t flow_mgr_flows_removed; uint16_t flow_mgr_rows_checked; uint16_t flow_mgr_rows_skipped; uint16_t flow_mgr_rows_empty; uint16_t flow_mgr_rows_busy; uint16_t flow_mgr_rows_maxlen; } FlowManagerThreadData; static TmEcode FlowManagerThreadInit(ThreadVars *t, void *initdata, void **data) { FlowManagerThreadData *ftd = SCCalloc(1, sizeof(FlowManagerThreadData)); if (ftd == NULL) return TM_ECODE_FAILED; ftd->instance = SC_ATOMIC_ADD(flowmgr_cnt, 1); SCLogDebug("flow manager instance %u", ftd->instance); /* set the min and max value used for hash row walking * each thread has it's own section of the flow hash */ uint32_t range = flow_config.hash_size / flowmgr_number; if (ftd->instance == 1) ftd->max = range; else if (ftd->instance == flowmgr_number) { ftd->min = (range * (ftd->instance - 1)); ftd->max = flow_config.hash_size; } else { ftd->min = (range * (ftd->instance - 1)); ftd->max = (range * ftd->instance); } BUG_ON(ftd->min > flow_config.hash_size || ftd->max > flow_config.hash_size); SCLogDebug("instance %u hash range %u %u", ftd->instance, ftd->min, ftd->max); /* pass thread data back to caller */ *data = ftd; ftd->flow_mgr_cnt_clo = StatsRegisterCounter("flow_mgr.closed_pruned", t); ftd->flow_mgr_cnt_new = StatsRegisterCounter("flow_mgr.new_pruned", t); ftd->flow_mgr_cnt_est = StatsRegisterCounter("flow_mgr.est_pruned", t); ftd->flow_mgr_cnt_byp = StatsRegisterCounter("flow_mgr.bypassed_pruned", t); ftd->flow_mgr_spare = StatsRegisterCounter("flow.spare", t); ftd->flow_emerg_mode_enter = StatsRegisterCounter("flow.emerg_mode_entered", t); ftd->flow_emerg_mode_over = StatsRegisterCounter("flow.emerg_mode_over", t); ftd->flow_tcp_reuse = StatsRegisterCounter("flow.tcp_reuse", t); ftd->flow_mgr_flows_checked = StatsRegisterCounter("flow_mgr.flows_checked", t); ftd->flow_mgr_flows_notimeout = StatsRegisterCounter("flow_mgr.flows_notimeout", t); ftd->flow_mgr_flows_timeout = StatsRegisterCounter("flow_mgr.flows_timeout", t); ftd->flow_mgr_flows_timeout_inuse = StatsRegisterCounter("flow_mgr.flows_timeout_inuse", t); ftd->flow_mgr_flows_removed = StatsRegisterCounter("flow_mgr.flows_removed", t); ftd->flow_mgr_rows_checked = StatsRegisterCounter("flow_mgr.rows_checked", t); ftd->flow_mgr_rows_skipped = StatsRegisterCounter("flow_mgr.rows_skipped", t); ftd->flow_mgr_rows_empty = StatsRegisterCounter("flow_mgr.rows_empty", t); ftd->flow_mgr_rows_busy = StatsRegisterCounter("flow_mgr.rows_busy", t); ftd->flow_mgr_rows_maxlen = StatsRegisterCounter("flow_mgr.rows_maxlen", t); PacketPoolInit(); return TM_ECODE_OK; } static TmEcode FlowManagerThreadDeinit(ThreadVars *t, void *data) { PacketPoolDestroy(); SCFree(data); return TM_ECODE_OK; } /** \brief Thread that manages the flow table and times out flows. * * \param td ThreadVars casted to void ptr * * Keeps an eye on the spare list, alloc flows if needed... */ static TmEcode FlowManager(ThreadVars *th_v, void *thread_data) { /* block usr2. usr1 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); FlowManagerThreadData *ftd = thread_data; struct timeval ts; uint32_t established_cnt = 0, new_cnt = 0, closing_cnt = 0; int emerg = FALSE; int prev_emerg = FALSE; struct timespec cond_time; int flow_update_delay_sec = FLOW_NORMAL_MODE_UPDATE_DELAY_SEC; int flow_update_delay_nsec = FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC; /* VJ leaving disabled for now, as hosts are only used by tags and the numbers * are really low. Might confuse ppl uint16_t flow_mgr_host_prune = StatsRegisterCounter("hosts.pruned", th_v); uint16_t flow_mgr_host_active = StatsRegisterCounter("hosts.active", th_v); uint16_t flow_mgr_host_spare = StatsRegisterCounter("hosts.spare", th_v); */ memset(&ts, 0, sizeof(ts)); while (1) { if (TmThreadsCheckFlag(th_v, THV_PAUSE)) { TmThreadsSetFlag(th_v, THV_PAUSED); TmThreadTestThreadUnPaused(th_v); TmThreadsUnsetFlag(th_v, THV_PAUSED); } if (SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) { emerg = TRUE; if (emerg == TRUE && prev_emerg == FALSE) { prev_emerg = TRUE; SCLogDebug("Flow emergency mode entered..."); StatsIncr(th_v, ftd->flow_emerg_mode_enter); } } /* Get the time */ memset(&ts, 0, sizeof(ts)); TimeGet(&ts); SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec); /* see if we still have enough spare flows */ if (ftd->instance == 1) FlowUpdateSpareFlows(); /* try to time out flows */ FlowTimeoutCounters counters = { 0, 0, 0, 0, 0,0,0,0,0,0,0,0,0,0,0}; FlowTimeoutHash(&ts, 0 /* check all */, ftd->min, ftd->max, &counters); if (ftd->instance == 1) { DefragTimeoutHash(&ts); //uint32_t hosts_pruned = HostTimeoutHash(&ts); IPPairTimeoutHash(&ts); } /* StatsAddUI64(th_v, flow_mgr_host_prune, (uint64_t)hosts_pruned); uint32_t hosts_active = HostGetActiveCount(); StatsSetUI64(th_v, flow_mgr_host_active, (uint64_t)hosts_active); uint32_t hosts_spare = HostGetSpareCount(); StatsSetUI64(th_v, flow_mgr_host_spare, (uint64_t)hosts_spare); */ StatsAddUI64(th_v, ftd->flow_mgr_cnt_clo, (uint64_t)counters.clo); StatsAddUI64(th_v, ftd->flow_mgr_cnt_new, (uint64_t)counters.new); StatsAddUI64(th_v, ftd->flow_mgr_cnt_est, (uint64_t)counters.est); StatsAddUI64(th_v, ftd->flow_mgr_cnt_byp, (uint64_t)counters.byp); StatsAddUI64(th_v, ftd->flow_tcp_reuse, (uint64_t)counters.tcp_reuse); StatsSetUI64(th_v, ftd->flow_mgr_flows_checked, (uint64_t)counters.flows_checked); StatsSetUI64(th_v, ftd->flow_mgr_flows_notimeout, (uint64_t)counters.flows_notimeout); StatsSetUI64(th_v, ftd->flow_mgr_flows_timeout, (uint64_t)counters.flows_timeout); StatsSetUI64(th_v, ftd->flow_mgr_flows_removed, (uint64_t)counters.flows_removed); StatsSetUI64(th_v, ftd->flow_mgr_flows_timeout_inuse, (uint64_t)counters.flows_timeout_inuse); StatsSetUI64(th_v, ftd->flow_mgr_rows_checked, (uint64_t)counters.rows_checked); StatsSetUI64(th_v, ftd->flow_mgr_rows_skipped, (uint64_t)counters.rows_skipped); StatsSetUI64(th_v, ftd->flow_mgr_rows_maxlen, (uint64_t)counters.rows_maxlen); StatsSetUI64(th_v, ftd->flow_mgr_rows_busy, (uint64_t)counters.rows_busy); StatsSetUI64(th_v, ftd->flow_mgr_rows_empty, (uint64_t)counters.rows_empty); uint32_t len = 0; FQLOCK_LOCK(&flow_spare_q); len = flow_spare_q.len; FQLOCK_UNLOCK(&flow_spare_q); StatsSetUI64(th_v, ftd->flow_mgr_spare, (uint64_t)len); /* Don't fear, FlowManagerThread is here... * clear emergency bit if we have at least xx flows pruned. */ if (emerg == TRUE) { SCLogDebug("flow_sparse_q.len = %"PRIu32" prealloc: %"PRIu32 "flow_spare_q status: %"PRIu32"%% flows at the queue", len, flow_config.prealloc, len * 100 / flow_config.prealloc); /* only if we have pruned this "emergency_recovery" percentage * of flows, we will unset the emergency bit */ if (len * 100 / flow_config.prealloc > flow_config.emergency_recovery) { SC_ATOMIC_AND(flow_flags, ~FLOW_EMERGENCY); FlowTimeoutsReset(); emerg = FALSE; prev_emerg = FALSE; flow_update_delay_sec = FLOW_NORMAL_MODE_UPDATE_DELAY_SEC; flow_update_delay_nsec = FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC; SCLogInfo("Flow emergency mode over, back to normal... unsetting" " FLOW_EMERGENCY bit (ts.tv_sec: %"PRIuMAX", " "ts.tv_usec:%"PRIuMAX") flow_spare_q status(): %"PRIu32 "%% flows at the queue", (uintmax_t)ts.tv_sec, (uintmax_t)ts.tv_usec, len * 100 / flow_config.prealloc); StatsIncr(th_v, ftd->flow_emerg_mode_over); } else { flow_update_delay_sec = FLOW_EMERG_MODE_UPDATE_DELAY_SEC; flow_update_delay_nsec = FLOW_EMERG_MODE_UPDATE_DELAY_NSEC; } } if (TmThreadsCheckFlag(th_v, THV_KILL)) { StatsSyncCounters(th_v); break; } cond_time.tv_sec = time(NULL) + flow_update_delay_sec; cond_time.tv_nsec = flow_update_delay_nsec; SCCtrlMutexLock(&flow_manager_ctrl_mutex); SCCtrlCondTimedwait(&flow_manager_ctrl_cond, &flow_manager_ctrl_mutex, &cond_time); SCCtrlMutexUnlock(&flow_manager_ctrl_mutex); SCLogDebug("woke up... %s", SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY ? "emergency":""); StatsSyncCountersIfSignalled(th_v); } SCLogPerf("%" PRIu32 " new flows, %" PRIu32 " established flows were " "timed out, %"PRIu32" flows in closed state", new_cnt, established_cnt, closing_cnt); return TM_ECODE_OK; } static uint64_t FlowGetMemuse(void) { uint64_t flow_memuse = SC_ATOMIC_GET(flow_memuse); return flow_memuse; } /** \brief spawn the flow manager thread */ void FlowManagerThreadSpawn() { #ifdef AFLFUZZ_DISABLE_MGTTHREADS return; #endif intmax_t setting = 1; (void)ConfGetInt("flow.managers", &setting); if (setting < 1 || setting > 1024) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "invalid flow.managers setting %"PRIdMAX, setting); exit(EXIT_FAILURE); } flowmgr_number = (uint32_t)setting; SCLogConfig("using %u flow manager threads", flowmgr_number); SCCtrlCondInit(&flow_manager_ctrl_cond, NULL); SCCtrlMutexInit(&flow_manager_ctrl_mutex, NULL); StatsRegisterGlobalCounter("flow.memuse", FlowGetMemuse); uint32_t u; for (u = 0; u < flowmgr_number; u++) { ThreadVars *tv_flowmgr = NULL; char name[TM_THREAD_NAME_MAX]; snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_mgr, u+1); tv_flowmgr = TmThreadCreateMgmtThreadByName(name, "FlowManager", 0); BUG_ON(tv_flowmgr == NULL); if (tv_flowmgr == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(1); } if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(1); } } return; } typedef struct FlowRecyclerThreadData_ { void *output_thread_data; } FlowRecyclerThreadData; static TmEcode FlowRecyclerThreadInit(ThreadVars *t, void *initdata, void **data) { FlowRecyclerThreadData *ftd = SCCalloc(1, sizeof(FlowRecyclerThreadData)); if (ftd == NULL) return TM_ECODE_FAILED; if (OutputFlowLogThreadInit(t, NULL, &ftd->output_thread_data) != TM_ECODE_OK) { SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed"); SCFree(ftd); return TM_ECODE_FAILED; } SCLogDebug("output_thread_data %p", ftd->output_thread_data); *data = ftd; return TM_ECODE_OK; } static TmEcode FlowRecyclerThreadDeinit(ThreadVars *t, void *data) { FlowRecyclerThreadData *ftd = (FlowRecyclerThreadData *)data; if (ftd->output_thread_data != NULL) OutputFlowLogThreadDeinit(t, ftd->output_thread_data); SCFree(data); return TM_ECODE_OK; } /** \brief Thread that manages timed out flows. * * \param td ThreadVars casted to void ptr */ static TmEcode FlowRecycler(ThreadVars *th_v, void *thread_data) { /* block usr2. usr2 to be handled by the main thread only */ UtilSignalBlock(SIGUSR2); struct timeval ts; struct timespec cond_time; int flow_update_delay_sec = FLOW_NORMAL_MODE_UPDATE_DELAY_SEC; int flow_update_delay_nsec = FLOW_NORMAL_MODE_UPDATE_DELAY_NSEC; uint64_t recycled_cnt = 0; FlowRecyclerThreadData *ftd = (FlowRecyclerThreadData *)thread_data; BUG_ON(ftd == NULL); memset(&ts, 0, sizeof(ts)); while (1) { if (TmThreadsCheckFlag(th_v, THV_PAUSE)) { TmThreadsSetFlag(th_v, THV_PAUSED); TmThreadTestThreadUnPaused(th_v); TmThreadsUnsetFlag(th_v, THV_PAUSED); } /* Get the time */ memset(&ts, 0, sizeof(ts)); TimeGet(&ts); SCLogDebug("ts %" PRIdMAX "", (intmax_t)ts.tv_sec); uint32_t len = 0; FQLOCK_LOCK(&flow_recycle_q); len = flow_recycle_q.len; FQLOCK_UNLOCK(&flow_recycle_q); /* Loop through the queue and clean up all flows in it */ if (len) { Flow *f; while ((f = FlowDequeue(&flow_recycle_q)) != NULL) { FLOWLOCK_WRLOCK(f); (void)OutputFlowLog(th_v, ftd->output_thread_data, f); FlowClearMemory (f, f->protomap); FLOWLOCK_UNLOCK(f); FlowMoveToSpare(f); recycled_cnt++; } } SCLogDebug("%u flows to recycle", len); if (TmThreadsCheckFlag(th_v, THV_KILL)) { StatsSyncCounters(th_v); break; } cond_time.tv_sec = time(NULL) + flow_update_delay_sec; cond_time.tv_nsec = flow_update_delay_nsec; SCCtrlMutexLock(&flow_recycler_ctrl_mutex); SCCtrlCondTimedwait(&flow_recycler_ctrl_cond, &flow_recycler_ctrl_mutex, &cond_time); SCCtrlMutexUnlock(&flow_recycler_ctrl_mutex); SCLogDebug("woke up..."); StatsSyncCountersIfSignalled(th_v); } SCLogPerf("%"PRIu64" flows processed", recycled_cnt); return TM_ECODE_OK; } int FlowRecyclerReadyToShutdown(void) { uint32_t len = 0; FQLOCK_LOCK(&flow_recycle_q); len = flow_recycle_q.len; FQLOCK_UNLOCK(&flow_recycle_q); return ((len == 0)); } /** \brief spawn the flow recycler thread */ void FlowRecyclerThreadSpawn() { #ifdef AFLFUZZ_DISABLE_MGTTHREADS return; #endif intmax_t setting = 1; (void)ConfGetInt("flow.recyclers", &setting); if (setting < 1 || setting > 1024) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "invalid flow.recyclers setting %"PRIdMAX, setting); exit(EXIT_FAILURE); } flowrec_number = (uint32_t)setting; SCLogConfig("using %u flow recycler threads", flowrec_number); SCCtrlCondInit(&flow_recycler_ctrl_cond, NULL); SCCtrlMutexInit(&flow_recycler_ctrl_mutex, NULL); uint32_t u; for (u = 0; u < flowrec_number; u++) { ThreadVars *tv_flowmgr = NULL; char name[TM_THREAD_NAME_MAX]; snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_rec, u+1); tv_flowmgr = TmThreadCreateMgmtThreadByName(name, "FlowRecycler", 0); BUG_ON(tv_flowmgr == NULL); if (tv_flowmgr == NULL) { printf("ERROR: TmThreadsCreate failed\n"); exit(1); } if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) { printf("ERROR: TmThreadSpawn failed\n"); exit(1); } } return; } /** * \brief Used to disable flow recycler thread(s). * * \note this should only be called when the flow manager is already gone * * \todo Kinda hackish since it uses the tv name to identify flow recycler * thread. We need an all weather identification scheme. */ void FlowDisableFlowRecyclerThread(void) { #ifdef AFLFUZZ_DISABLE_MGTTHREADS return; #endif ThreadVars *tv = NULL; int cnt = 0; /* move all flows still in the hash to the recycler queue */ FlowCleanupHash(); /* make sure all flows are processed */ do { SCCtrlCondSignal(&flow_recycler_ctrl_cond); usleep(10); } while (FlowRecyclerReadyToShutdown() == 0); /* wake up threads */ uint32_t u; for (u = 0; u < flowrec_number; u++) SCCtrlCondSignal(&flow_recycler_ctrl_cond); SCMutexLock(&tv_root_lock); /* flow recycler thread(s) is/are a part of mgmt threads */ tv = tv_root[TVT_MGMT]; while (tv != NULL) { if (strncasecmp(tv->name, thread_name_flow_rec, strlen(thread_name_flow_rec)) == 0) { TmThreadsSetFlag(tv, THV_KILL); cnt++; /* value in seconds */ #define THREAD_KILL_MAX_WAIT_TIME 60 /* value in microseconds */ #define WAIT_TIME 100 double total_wait_time = 0; while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { usleep(WAIT_TIME); total_wait_time += WAIT_TIME / 1000000.0; if (total_wait_time > THREAD_KILL_MAX_WAIT_TIME) { SCLogError(SC_ERR_FATAL, "Engine unable to " "disable detect thread - \"%s\". " "Killing engine", tv->name); exit(EXIT_FAILURE); } } } tv = tv->next; } /* wake up threads, another try */ for (u = 0; u < flowrec_number; u++) SCCtrlCondSignal(&flow_recycler_ctrl_cond); SCMutexUnlock(&tv_root_lock); /* reset count, so we can kill and respawn (unix socket) */ SC_ATOMIC_SET(flowrec_cnt, 0); return; } void TmModuleFlowManagerRegister (void) { tmm_modules[TMM_FLOWMANAGER].name = "FlowManager"; tmm_modules[TMM_FLOWMANAGER].ThreadInit = FlowManagerThreadInit; tmm_modules[TMM_FLOWMANAGER].ThreadDeinit = FlowManagerThreadDeinit; // tmm_modules[TMM_FLOWMANAGER].RegisterTests = FlowManagerRegisterTests; tmm_modules[TMM_FLOWMANAGER].Management = FlowManager; tmm_modules[TMM_FLOWMANAGER].cap_flags = 0; tmm_modules[TMM_FLOWMANAGER].flags = TM_FLAG_MANAGEMENT_TM; SCLogDebug("%s registered", tmm_modules[TMM_FLOWMANAGER].name); SC_ATOMIC_INIT(flowmgr_cnt); SC_ATOMIC_INIT(flow_timeouts); } void TmModuleFlowRecyclerRegister (void) { tmm_modules[TMM_FLOWRECYCLER].name = "FlowRecycler"; tmm_modules[TMM_FLOWRECYCLER].ThreadInit = FlowRecyclerThreadInit; tmm_modules[TMM_FLOWRECYCLER].ThreadDeinit = FlowRecyclerThreadDeinit; // tmm_modules[TMM_FLOWRECYCLER].RegisterTests = FlowRecyclerRegisterTests; tmm_modules[TMM_FLOWRECYCLER].Management = FlowRecycler; tmm_modules[TMM_FLOWRECYCLER].cap_flags = 0; tmm_modules[TMM_FLOWRECYCLER].flags = TM_FLAG_MANAGEMENT_TM; SCLogDebug("%s registered", tmm_modules[TMM_FLOWRECYCLER].name); SC_ATOMIC_INIT(flowrec_cnt); } #ifdef UNITTESTS /** * \test Test the timing out of a flow with a fresh TcpSession * (just initialized, no data segments) in normal mode. * * \retval On success it returns 1 and on failure 0. */ static int FlowMgrTest01 (void) { TcpSession ssn; Flow f; FlowBucket fb; struct timeval ts; FlowQueueInit(&flow_spare_q); memset(&ssn, 0, sizeof(TcpSession)); memset(&f, 0, sizeof(Flow)); memset(&ts, 0, sizeof(ts)); memset(&fb, 0, sizeof(FlowBucket)); FBLOCK_INIT(&fb); FLOW_INITIALIZE(&f); f.flags |= FLOW_TIMEOUT_REASSEMBLY_DONE; TimeGet(&ts); f.lastts.tv_sec = ts.tv_sec - 5000; f.protoctx = &ssn; f.fb = &fb; f.proto = IPPROTO_TCP; int32_t next_ts = 0; int state = SC_ATOMIC_GET(f.flow_state); if (FlowManagerFlowTimeout(&f, state, &ts, &next_ts) != 1 && FlowManagerFlowTimedOut(&f, &ts) != 1) { FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 0; } FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 1; } /** * \test Test the timing out of a flow with a TcpSession * (with data segments) in normal mode. * * \retval On success it returns 1 and on failure 0. */ static int FlowMgrTest02 (void) { TcpSession ssn; Flow f; FlowBucket fb; struct timeval ts; TcpSegment seg; TcpStream client; uint8_t payload[3] = {0x41, 0x41, 0x41}; FlowQueueInit(&flow_spare_q); memset(&ssn, 0, sizeof(TcpSession)); memset(&f, 0, sizeof(Flow)); memset(&fb, 0, sizeof(FlowBucket)); memset(&ts, 0, sizeof(ts)); memset(&seg, 0, sizeof(TcpSegment)); memset(&client, 0, sizeof(TcpSegment)); FBLOCK_INIT(&fb); FLOW_INITIALIZE(&f); f.flags |= FLOW_TIMEOUT_REASSEMBLY_DONE; TimeGet(&ts); seg.payload = payload; seg.payload_len = 3; seg.next = NULL; seg.prev = NULL; client.seg_list = &seg; ssn.client = client; ssn.server = client; ssn.state = TCP_ESTABLISHED; f.lastts.tv_sec = ts.tv_sec - 5000; f.protoctx = &ssn; f.fb = &fb; f.proto = IPPROTO_TCP; int32_t next_ts = 0; int state = SC_ATOMIC_GET(f.flow_state); if (FlowManagerFlowTimeout(&f, state, &ts, &next_ts) != 1 && FlowManagerFlowTimedOut(&f, &ts) != 1) { FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 0; } FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 1; } /** * \test Test the timing out of a flow with a fresh TcpSession * (just initialized, no data segments) in emergency mode. * * \retval On success it returns 1 and on failure 0. */ static int FlowMgrTest03 (void) { TcpSession ssn; Flow f; FlowBucket fb; struct timeval ts; FlowQueueInit(&flow_spare_q); memset(&ssn, 0, sizeof(TcpSession)); memset(&f, 0, sizeof(Flow)); memset(&ts, 0, sizeof(ts)); memset(&fb, 0, sizeof(FlowBucket)); FBLOCK_INIT(&fb); FLOW_INITIALIZE(&f); f.flags |= FLOW_TIMEOUT_REASSEMBLY_DONE; TimeGet(&ts); ssn.state = TCP_SYN_SENT; f.lastts.tv_sec = ts.tv_sec - 300; f.protoctx = &ssn; f.fb = &fb; f.proto = IPPROTO_TCP; f.flags |= FLOW_EMERGENCY; int next_ts = 0; int state = SC_ATOMIC_GET(f.flow_state); if (FlowManagerFlowTimeout(&f, state, &ts, &next_ts) != 1 && FlowManagerFlowTimedOut(&f, &ts) != 1) { FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 0; } FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 1; } /** * \test Test the timing out of a flow with a TcpSession * (with data segments) in emergency mode. * * \retval On success it returns 1 and on failure 0. */ static int FlowMgrTest04 (void) { TcpSession ssn; Flow f; FlowBucket fb; struct timeval ts; TcpSegment seg; TcpStream client; uint8_t payload[3] = {0x41, 0x41, 0x41}; FlowQueueInit(&flow_spare_q); memset(&ssn, 0, sizeof(TcpSession)); memset(&f, 0, sizeof(Flow)); memset(&fb, 0, sizeof(FlowBucket)); memset(&ts, 0, sizeof(ts)); memset(&seg, 0, sizeof(TcpSegment)); memset(&client, 0, sizeof(TcpSegment)); FBLOCK_INIT(&fb); FLOW_INITIALIZE(&f); f.flags |= FLOW_TIMEOUT_REASSEMBLY_DONE; TimeGet(&ts); seg.payload = payload; seg.payload_len = 3; seg.next = NULL; seg.prev = NULL; client.seg_list = &seg; ssn.client = client; ssn.server = client; ssn.state = TCP_ESTABLISHED; f.lastts.tv_sec = ts.tv_sec - 5000; f.protoctx = &ssn; f.fb = &fb; f.proto = IPPROTO_TCP; f.flags |= FLOW_EMERGENCY; int next_ts = 0; int state = SC_ATOMIC_GET(f.flow_state); if (FlowManagerFlowTimeout(&f, state, &ts, &next_ts) != 1 && FlowManagerFlowTimedOut(&f, &ts) != 1) { FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 0; } FBLOCK_DESTROY(&fb); FLOW_DESTROY(&f); FlowQueueDestroy(&flow_spare_q); return 1; } /** * \test Test flow allocations when it reach memcap * * * \retval On success it returns 1 and on failure 0. */ static int FlowMgrTest05 (void) { int result = 0; FlowInitConfig(FLOW_QUIET); FlowConfig backup; memcpy(&backup, &flow_config, sizeof(FlowConfig)); uint32_t ini = 0; uint32_t end = flow_spare_q.len; flow_config.memcap = 10000; flow_config.prealloc = 100; /* Let's get the flow_spare_q empty */ UTHBuildPacketOfFlows(ini, end, 0); /* And now let's try to reach the memcap val */ while (FLOW_CHECK_MEMCAP(sizeof(Flow))) { ini = end + 1; end = end + 2; UTHBuildPacketOfFlows(ini, end, 0); } /* should time out normal */ TimeSetIncrementTime(2000); ini = end + 1; end = end + 2;; UTHBuildPacketOfFlows(ini, end, 0); struct timeval ts; TimeGet(&ts); /* try to time out flows */ FlowTimeoutCounters counters = { 0, 0, 0, 0, 0,0,0,0,0,0,0,0,0,0,0}; FlowTimeoutHash(&ts, 0 /* check all */, 0, flow_config.hash_size, &counters); if (flow_recycle_q.len > 0) { result = 1; } memcpy(&flow_config, &backup, sizeof(FlowConfig)); FlowShutdown(); return result; } #endif /* UNITTESTS */ /** * \brief Function to register the Flow Unitests. */ void FlowMgrRegisterTests (void) { #ifdef UNITTESTS UtRegisterTest("FlowMgrTest01 -- Timeout a flow having fresh TcpSession", FlowMgrTest01); UtRegisterTest("FlowMgrTest02 -- Timeout a flow having TcpSession with segments", FlowMgrTest02); UtRegisterTest("FlowMgrTest03 -- Timeout a flow in emergency having fresh TcpSession", FlowMgrTest03); UtRegisterTest("FlowMgrTest04 -- Timeout a flow in emergency having TcpSession with segments", FlowMgrTest04); UtRegisterTest("FlowMgrTest05 -- Test flow Allocations when it reach memcap", FlowMgrTest05); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-xbits.c0000644000000000000000000003773313051004444013561 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Implements the xbits keyword */ #include "suricata-common.h" #include "decode.h" #include "detect.h" #include "threads.h" #include "flow.h" #include "flow-util.h" #include "detect-xbits.h" #include "detect-hostbits.h" #include "util-spm.h" #include "detect-engine-sigorder.h" #include "app-layer-parser.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow-bit.h" #include "host-bit.h" #include "ippair-bit.h" #include "util-var-name.h" #include "util-unittest.h" #include "util-debug.h" /* xbits:set,bitname,track ip_pair,expire 60 */ #define PARSE_REGEX "([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectXbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectXbitSetup (DetectEngineCtx *, Signature *, char *); void DetectXbitFree (void *); void XBitsRegisterTests(void); void DetectXbitsRegister (void) { sigmatch_table[DETECT_XBITS].name = "xbits"; sigmatch_table[DETECT_XBITS].desc = "operate on bits"; sigmatch_table[DETECT_XBITS].url = DOC_URL DOC_VERSION "/rules/xbits.html"; sigmatch_table[DETECT_XBITS].Match = DetectXbitMatch; sigmatch_table[DETECT_XBITS].Setup = DetectXbitSetup; sigmatch_table[DETECT_XBITS].Free = DetectXbitFree; sigmatch_table[DETECT_XBITS].RegisterTests = XBitsRegisterTests; /* this is compatible to ip-only signatures */ sigmatch_table[DETECT_XBITS].flags |= SIGMATCH_IPONLY_COMPAT; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } static int DetectIPPairbitMatchToggle (Packet *p, const DetectXbitsData *fd) { IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); if (pair == NULL) return 0; IPPairBitToggle(pair,fd->idx,p->ts.tv_sec + fd->expire); IPPairRelease(pair); return 1; } /* return true even if bit not found */ static int DetectIPPairbitMatchUnset (Packet *p, const DetectXbitsData *fd) { IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); if (pair == NULL) return 1; IPPairBitUnset(pair,fd->idx); IPPairRelease(pair); return 1; } static int DetectIPPairbitMatchSet (Packet *p, const DetectXbitsData *fd) { IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); if (pair == NULL) return 0; IPPairBitSet(pair, fd->idx, p->ts.tv_sec + fd->expire); IPPairRelease(pair); return 1; } static int DetectIPPairbitMatchIsset (Packet *p, const DetectXbitsData *fd) { int r = 0; IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); if (pair == NULL) return 0; r = IPPairBitIsset(pair,fd->idx,p->ts.tv_sec); IPPairRelease(pair); return r; } static int DetectIPPairbitMatchIsnotset (Packet *p, const DetectXbitsData *fd) { int r = 0; IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); if (pair == NULL) return 1; r = IPPairBitIsnotset(pair,fd->idx,p->ts.tv_sec); IPPairRelease(pair); return r; } static int DetectXbitMatchIPPair(Packet *p, const DetectXbitsData *xd) { switch (xd->cmd) { case DETECT_XBITS_CMD_ISSET: return DetectIPPairbitMatchIsset(p,xd); case DETECT_XBITS_CMD_ISNOTSET: return DetectIPPairbitMatchIsnotset(p,xd); case DETECT_XBITS_CMD_SET: return DetectIPPairbitMatchSet(p,xd); case DETECT_XBITS_CMD_UNSET: return DetectIPPairbitMatchUnset(p,xd); case DETECT_XBITS_CMD_TOGGLE: return DetectIPPairbitMatchToggle(p,xd); default: SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", xd->cmd); return 0; } return 0; } /* * returns 0: no match * 1: match * -1: error */ int DetectXbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { const DetectXbitsData *fd = (const DetectXbitsData *)ctx; if (fd == NULL) return 0; switch (fd->type) { case VAR_TYPE_HOST_BIT: return DetectXbitMatchHost(p, (const DetectXbitsData *)fd); break; case VAR_TYPE_IPPAIR_BIT: return DetectXbitMatchIPPair(p, (const DetectXbitsData *)fd); break; default: break; } return 0; } /** \internal * \brief parse xbits rule options * \retval 0 ok * \retval -1 bad * \param[out] cdout return DetectXbitsData structure or NULL if noalert */ static int DetectXbitParse(DetectEngineCtx *de_ctx, const char *rawstr, DetectXbitsData **cdout) { DetectXbitsData *cd = NULL; uint8_t fb_cmd = 0; uint8_t hb_dir = 0; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; char fb_cmd_str[16] = "", fb_name[256] = ""; char hb_dir_str[16] = ""; enum VarTypes var_type = VAR_TYPE_NOT_SET; int expire = DETECT_XBITS_EXPIRE_DEFAULT; ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret != 2 && ret != 3 && ret != 4 && ret != 5) { SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for xbits.", rawstr); return -1; } SCLogDebug("ret %d, %s", ret, rawstr); res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, fb_cmd_str, sizeof(fb_cmd_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return -1; } if (ret >= 3) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, fb_name, sizeof(fb_name)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return -1; } if (ret >= 4) { res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, hb_dir_str, sizeof(hb_dir_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return -1; } SCLogDebug("hb_dir_str %s", hb_dir_str); if (strlen(hb_dir_str) > 0) { if (strcmp(hb_dir_str, "ip_src") == 0) { hb_dir = DETECT_XBITS_TRACK_IPSRC; var_type = VAR_TYPE_HOST_BIT; } else if (strcmp(hb_dir_str, "ip_dst") == 0) { hb_dir = DETECT_XBITS_TRACK_IPDST; var_type = VAR_TYPE_HOST_BIT; } else if (strcmp(hb_dir_str, "ip_pair") == 0) { hb_dir = DETECT_XBITS_TRACK_IPPAIR; var_type = VAR_TYPE_IPPAIR_BIT; } else { // TODO return -1; } } if (ret >= 5) { char expire_str[16] = ""; res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, expire_str, sizeof(expire_str)); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); return -1; } SCLogDebug("expire_str %s", expire_str); expire = atoi(expire_str); if (expire < 0) { SCLogError(SC_ERR_INVALID_VALUE, "expire must be positive. " "Got %d (\"%s\")", expire, expire_str); return -1; } if (expire == 0) { SCLogError(SC_ERR_INVALID_VALUE, "expire must be bigger than 0"); return -1; } SCLogDebug("expire %d", expire); } } } if (strcmp(fb_cmd_str,"noalert") == 0) { fb_cmd = DETECT_XBITS_CMD_NOALERT; } else if (strcmp(fb_cmd_str,"isset") == 0) { fb_cmd = DETECT_XBITS_CMD_ISSET; } else if (strcmp(fb_cmd_str,"isnotset") == 0) { fb_cmd = DETECT_XBITS_CMD_ISNOTSET; } else if (strcmp(fb_cmd_str,"set") == 0) { fb_cmd = DETECT_XBITS_CMD_SET; } else if (strcmp(fb_cmd_str,"unset") == 0) { fb_cmd = DETECT_XBITS_CMD_UNSET; } else if (strcmp(fb_cmd_str,"toggle") == 0) { fb_cmd = DETECT_XBITS_CMD_TOGGLE; } else { SCLogError(SC_ERR_UNKNOWN_VALUE, "xbits action \"%s\" is not supported.", fb_cmd_str); return -1; } switch (fb_cmd) { case DETECT_XBITS_CMD_NOALERT: { if (strlen(fb_name) != 0) return -1; /* return ok, cd is NULL. Flag sig. */ *cdout = NULL; return 0; } case DETECT_XBITS_CMD_ISNOTSET: case DETECT_XBITS_CMD_ISSET: case DETECT_XBITS_CMD_SET: case DETECT_XBITS_CMD_UNSET: case DETECT_XBITS_CMD_TOGGLE: default: if (strlen(fb_name) == 0) return -1; break; } cd = SCMalloc(sizeof(DetectXbitsData)); if (unlikely(cd == NULL)) return -1; cd->idx = VariableNameGetIdx(de_ctx, fb_name, var_type); cd->cmd = fb_cmd; cd->tracker = hb_dir; cd->type = var_type; cd->expire = expire; SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)"); *cdout = cd; return 0; } int DetectXbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { SigMatch *sm = NULL; DetectXbitsData *cd = NULL; int result = DetectXbitParse(de_ctx, rawstr, &cd); if (result < 0) { return -1; /* noalert doesn't use a cd/sm struct. It flags the sig. We're done. */ } else if (result == 0 && cd == NULL) { s->flags |= SIG_FLAG_NOALERT; return 0; } /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_XBITS; sm->ctx = (void *)cd; switch (cd->cmd) { /* case DETECT_XBITS_CMD_NOALERT can't happen here */ case DETECT_XBITS_CMD_ISNOTSET: case DETECT_XBITS_CMD_ISSET: /* checks, so packet list */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); break; case DETECT_XBITS_CMD_SET: case DETECT_XBITS_CMD_UNSET: case DETECT_XBITS_CMD_TOGGLE: /* modifiers, only run when entire sig has matched */ SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); break; } return 0; error: if (cd != NULL) SCFree(cd); return -1; } void DetectXbitFree (void *ptr) { DetectXbitsData *fd = (DetectXbitsData *)ptr; if (fd == NULL) return; SCFree(fd); } #ifdef UNITTESTS static void XBitsTestSetup(void) { StorageInit(); HostBitInitCtx(); IPPairBitInitCtx(); StorageFinalize(); HostInitConfig(TRUE); IPPairInitConfig(TRUE); } static void XBitsTestShutdown(void) { HostCleanup(); IPPairCleanup(); StorageCleanup(); } static int XBitsTestParse01(void) { DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; DetectXbitsData *cd = NULL; #define BAD_INPUT(str) \ FAIL_IF_NOT(DetectXbitParse(de_ctx, (str), &cd) == -1); BAD_INPUT("alert"); BAD_INPUT("n0alert"); BAD_INPUT("nOalert"); BAD_INPUT("set,abc,track nonsense, expire 3600"); BAD_INPUT("set,abc,track ip_source, expire 3600"); BAD_INPUT("set,abc,track ip_src, expire -1"); BAD_INPUT("set,abc,track ip_src, expire 0"); #undef BAD_INPUT #define GOOD_INPUT(str, command, trk, typ, exp) \ FAIL_IF_NOT(DetectXbitParse(de_ctx, (str), &cd) == 0); \ FAIL_IF_NULL(cd); \ FAIL_IF_NOT(cd->cmd == (command)); \ FAIL_IF_NOT(cd->tracker == (trk)); \ FAIL_IF_NOT(cd->type == (typ)); \ FAIL_IF_NOT(cd->expire == (exp)); \ DetectXbitFree(cd); \ cd = NULL; GOOD_INPUT("set,abc,track ip_pair", DETECT_XBITS_CMD_SET, DETECT_XBITS_TRACK_IPPAIR, VAR_TYPE_IPPAIR_BIT, DETECT_XBITS_EXPIRE_DEFAULT); GOOD_INPUT("set,abc,track ip_pair, expire 3600", DETECT_XBITS_CMD_SET, DETECT_XBITS_TRACK_IPPAIR, VAR_TYPE_IPPAIR_BIT, 3600); GOOD_INPUT("set,abc,track ip_src, expire 1234", DETECT_XBITS_CMD_SET, DETECT_XBITS_TRACK_IPSRC, VAR_TYPE_HOST_BIT, 1234); #undef GOOD_INPUT DetectEngineCtxFree(de_ctx); PASS; } /** * \test */ static int XBitsTestSig01(void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); FAIL_IF_NULL(p); Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; DetectEngineCtx *de_ctx = NULL; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; XBitsTestSetup(); de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); XBitsTestShutdown(); SCFree(p); StatsThreadCleanup(&th_v); StatsReleaseResources(); PASS; } /** * \test various options * * \retval 1 on succces * \retval 0 on failure */ static int XBitsTestSig02(void) { Signature *s = NULL; DetectEngineCtx *de_ctx = NULL; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:isset,abc,track ip_src; content:\"GET \"; sid:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:isnotset,abc,track ip_dst; content:\"GET \"; sid:2;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:3;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:unset,abc,track ip_src; content:\"GET \"; sid:4;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (xbits:toggle,abc,track ip_dst; content:\"GET \"; sid:5;)"); FAIL_IF_NULL(s); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for XBits */ void XBitsRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("XBitsTestParse01", XBitsTestParse01); UtRegisterTest("XBitsTestSig01", XBitsTestSig01); UtRegisterTest("XBitsTestSig02", XBitsTestSig02); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-decode-asn1.h0000644000000000000000000001714013051004444014213 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon Crespo * * Implements ASN1 decoding (needed for the asn1 keyword) */ #ifndef __DECODE_ASN1_H__ #define __DECODE_ASN1_H__ #include #include #include #include #include #include #include #include #define ASN1_MAX_FRAMES 256 /* For future enconding type implementations */ enum { ASN1_BER_ENC, ASN1_ENC_UNKNOWN }; /* Class of tag */ #define ASN1_BER_CLASS_UNIV 0 #define ASN1_BER_CLASS_APP 1 #define ASN1_BER_CLASS_CTX_SPECIFIC 2 #define ASN1_BER_CLASS_PRIV 3 /* For low tag numbers */ #define ASN1_BER_GET_CLASS_TAG(id_octet) \ ((id_octet >> 6) & 0x03) /* (8.1.2.2a) */ #define ASN1_BER_IS_CONSTRUCTED(id_octet) \ ((id_octet >> 5) & 0x01) /* (8.1.2.5) Constructed Tag */ #define ASN1_BER_IS_PRIMITIVE(id_octet) \ (((id_octet >> 5) & 0x01)?0:1) /* (8.1.2.5) Primitive Tag */ #define ASN1_BER_IS_LOW_TAG(id_octet) \ ASN1_BER_IS_PRIMITIVE(id_octet) /* (8.1.2.5) Is Low Tag Number */ #define ASN1_BER_GET_LOW_TAG_NUM(id_octet) \ (id_octet & 0x1F) /* (8.1.2.2c) Get LowTag Number */ /* For high tag numbers */ #define ASN1_BER_IS_HIGH_TAG(id_octet) \ ((ASN1_BER_GET_LOW_TAG_NUM(id_octet) == 0x1F) && \ ASN1_BER_IS_CONSTRUCTED(id_octet)) /* (8.1.2.4) High Tag Number */ #define ASN1_BER_IS_HIGH_TAG_END(id_octet) \ ( !((id_octet >> 7) & 0x01)) /* (8.1.2.4) Is End of Tag Num */ #define ASN1_BER_GET_HIGH_TAG_NUM(id_octet) \ (id_octet & 0x7F) /* (8.1.2.4) Part of High Tag Number */ #define ASN1_BER_IS_SHORT_LEN(id_octet) \ ( !((id_octet >> 7) & 0x01)) /* (8.1.3.3) Is short form */ #define ASN1_BER_GET_SHORT_LEN(id_octet) \ (id_octet & 0x7F) /* (8.1.3.3) length value */ #define ASN1_BER_GET_LONG_LEN_OCTETS(id_octet) \ (id_octet & 0x7F) /* (8.1.3.5) the number of bytes */ #define ASN1_BER_GET_LONG_LEN(id_octet) \ (id_octet) /* (8.1.3.5) the byte itself*/ #define ASN1_BER_LONG_LEN_HAS_NEXT(id_octet) \ ( !((id_octet >> 7) & 0x01)) /* (8.1.3.5) Has next octets lenght */ #define ASN1_BER_IS_INDEFINITE_LEN(id_octet) \ (id_octet == 0x80) /* (8.1.3.6) Need end-of-ccontent */ #define ASN1_BER_IS_EOC(tmp_iter) (*tmp_iter == 0 && *(tmp_iter + 1) == 0) /* Return the current node/frame that we are filling */ #define ASN1CTX_CUR_NODE(ac) (ac->asn1_stack[ac->cur_frame]) #define ASN1CTX_GET_NODE(ac, node) (ac->asn1_stack[node]) /* BER Universal tags */ #define ASN1_UNITAG_EOC 0 /* EOC */ #define ASN1_UNITAG_BOOLEAN 1 #define ASN1_UNITAG_INTEGER 2 #define ASN1_UNITAG_BIT_STRING 3 #define ASN1_UNITAG_OCTET_STRING 4 #define ASN1_UNITAG_NULL 5 #define ASN1_UNITAG_OID 6 #define ASN1_UNITAG_OBJECT_DESCRIPTOR 7 #define ASN1_UNITAG_EXTERNAL 8 #define ASN1_UNITAG_REAL 9 #define ASN1_UNITAG_ENUMERATED 10 #define ASN1_UNITAG_EMBEDDED_PDV 11 #define ASN1_UNITAG_UTF8_STRING 12 #define ASN1_UNITAG_RELATIVE_OID 13 #define ASN1_UNITAG_SEQUENCE 16 #define ASN1_UNITAG_SET 17 #define ASN1_UNITAG_NUMERIC_STRING 18 #define ASN1_UNITAG_PRINTABLE_STRING 19 #define ASN1_UNITAG_TELETEX_STRING 20 #define ASN1_UNITAG_VIDEOTEX_STRING 21 #define ASN1_UNITAG_IA5_STRING 22 #define ASN1_UNITAG_UTCTIME 23 #define ASN1_UNITAG_GENERALIZED_TIME 24 #define ASN1_UNITAG_GRAPHIC_STRING 25 #define ASN1_UNITAG_VISIBLE_STRING 26 #define ASN1_UNITAG_GENERAL_STRING 27 #define ASN1_UNITAG_UNIVERSAL_STRING 28 #define ASN1_UNITAG_CHARACTER_STRING 29 #define ASN1_UNITAG_BMP_STRING 30 /* Length form */ #define ASN1_BER_LEN_SHORT 0 #define ASN1_BER_LEN_LONG 1 #define ASN1_BER_LEN_INDEFINITE 2 /* Error events/flags */ #define ASN1_BER_EVENT_ID_TOO_LONG 0x01 #define ASN1_BER_EVENT_INVALID_ID 0x02 /* (8.1.2.4.2c) First subsequent id val (from bit 7 to 0) Shall not be 0 */ #define ASN1_BER_EVENT_INVALID_LEN 0x04 /* (8.1.3.2a) we expect a simple form, or (8.1.3.5c) we got 0xFF, or not enough data */ #define ASN1_BER_EVENT_LEN_TOO_LONG 0x08 #define ASN1_BER_EVENT_EOC_NOT_FOUND 0x10 /* EOC not found */ /* Helper flags */ #define ASN1_NODE_IS_EOC 1 #define ASN1_TAG_TYPE_PRIMITIVE 0 #define ASN1_TAG_TYPE_CONSTRUCTED 1 typedef struct Asn1Len_ { uint8_t form; uint32_t len; uint8_t *ptr; } Asn1Len; typedef struct Asn1Id_ { uint8_t *ptr; uint8_t class_tag; uint8_t tag_type; uint32_t tag_num; } Asn1Id; typedef struct Asn1Data_ { uint8_t *ptr; uint32_t len; uint8_t type; } Asn1Data; typedef struct Asn1Node_ { uint8_t *raw_str; uint8_t data_len; Asn1Len len; Asn1Id id; Asn1Data data; uint8_t flags; } Asn1Node; typedef struct Asn1Ctx_ { uint8_t *data; uint8_t *end; uint16_t len; uint8_t *iter; uint16_t cur_frame; Asn1Node *asn1_stack2[ASN1_MAX_FRAMES]; Asn1Node **asn1_stack; uint8_t parser_status; uint8_t ctx_flags; } Asn1Ctx; /* Return codes of the decoder */ #define ASN1_PARSER_OK 0x01 /* Everything ok */ #define ASN1_PARSER_ERR 0x02 /* Internal error, fatal error, we can't continue decoding */ /* Status of the parser */ #define ASN1_STATUS_OK 0x00 /* On the road */ #define ASN1_STATUS_INVALID 0x01 /* We found something weird/invalid by the specification, but we can try to continue parsing */ #define ASN1_STATUS_OOB 0x02 /* We don't have enough data or ran out of bounds */ #define ASN1_STATUS_DONE 0x04 /* We have finished cleanly */ void SCPrintByteBin(uint8_t); Asn1Ctx *SCAsn1CtxNew(void); void SCAsn1CtxInit(Asn1Ctx *, uint8_t *, uint16_t); void SCAsn1CtxDestroy(Asn1Ctx *); uint8_t SCAsn1Decode(Asn1Ctx *, uint16_t); uint8_t SCAsn1DecodeIdentifier(Asn1Ctx *); uint8_t SCAsn1DecodeLength(Asn1Ctx *); uint8_t SCAsn1DecodeContent(Asn1Ctx *); uint8_t SCAsn1CheckBounds(Asn1Ctx *); void DecodeAsn1RegisterTests(void); void SCAsn1LoadConfig(); #endif /* __DECODE_ASN1_H__ */ suricata-3.2.1/src/detect-ssl-version.c0000644000000000000000000004724013051004444014706 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file detect-ssl-version.c * * \author Gurvinder Singh * * Implements the ssl_version keyword */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "detect-ssl-version.h" #include "stream-tcp.h" #include "app-layer-ssl.h" /** * \brief Regex for parsing "id" option, matching number or "number" */ #define PARSE_REGEX "^\\s*(!?[A-z0-9.]+)\\s*,?\\s*(!?[A-z0-9.]+)?\\s*\\,?\\s*" \ "(!?[A-z0-9.]+)?\\s*,?\\s*(!?[A-z0-9.]+)?\\s*,?\\s*(!?[A-z0-9.]+)?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectSslVersionMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectSslVersionSetup(DetectEngineCtx *, Signature *, char *); void DetectSslVersionRegisterTests(void); void DetectSslVersionFree(void *); /** * \brief Registration function for keyword: ssl_version */ void DetectSslVersionRegister(void) { sigmatch_table[DETECT_AL_SSL_VERSION].name = "ssl_version"; sigmatch_table[DETECT_AL_SSL_VERSION].Match = NULL; sigmatch_table[DETECT_AL_SSL_VERSION].AppLayerMatch = DetectSslVersionMatch; sigmatch_table[DETECT_AL_SSL_VERSION].Setup = DetectSslVersionSetup; sigmatch_table[DETECT_AL_SSL_VERSION].Free = DetectSslVersionFree; sigmatch_table[DETECT_AL_SSL_VERSION].RegisterTests = DetectSslVersionRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief match the specified version on a ssl session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectSslVersionData * * \retval 0 no match * \retval 1 match */ int DetectSslVersionMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); int ret = 0; uint16_t ver = 0; uint8_t sig_ver = TLS_UNKNOWN; DetectSslVersionData *ssl = (DetectSslVersionData *)m->ctx; SSLState *app_state = (SSLState *)state; if (app_state == NULL) { SCLogDebug("no app state, no match"); SCReturnInt(0); } if (flags & STREAM_TOCLIENT) { SCLogDebug("server (toclient) version is 0x%02X", app_state->server_connp.version); ver = app_state->server_connp.version; } else if (flags & STREAM_TOSERVER) { SCLogDebug("client (toserver) version is 0x%02X", app_state->client_connp.version); ver = app_state->client_connp.version; } switch (ver) { case SSL_VERSION_2: if (ver == ssl->data[SSLv2].ver) ret = 1; sig_ver = SSLv2; break; case SSL_VERSION_3: if (ver == ssl->data[SSLv3].ver) ret = 1; sig_ver = SSLv3; break; case TLS_VERSION_10: if (ver == ssl->data[TLS10].ver) ret = 1; sig_ver = TLS10; break; case TLS_VERSION_11: if (ver == ssl->data[TLS11].ver) ret = 1; sig_ver = TLS11; break; case TLS_VERSION_12: if (ver == ssl->data[TLS12].ver) ret = 1; sig_ver = TLS12; break; } if (sig_ver == TLS_UNKNOWN) SCReturnInt(0); SCReturnInt(ret ^ ((ssl->data[sig_ver].flags & DETECT_SSL_VERSION_NEGATED) ? 1 : 0)); } /** * \brief This function is used to parse ssl_version data passed via * keyword: "ssl_version" * * \param str Pointer to the user provided options * * \retval ssl pointer to DetectSslVersionData on success * \retval NULL on failure */ DetectSslVersionData *DetectSslVersionParse(char *str) { DetectSslVersionData *ssl = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 5) { SCLogError(SC_ERR_PCRE_MATCH, "invalid ssl_version option"); goto error; } if (ret > 1) { const char *str_ptr; char *orig; uint8_t found = 0, neg = 0; char *tmp_str; /* We have a correct ssl_version options */ ssl = SCCalloc(1, sizeof (DetectSslVersionData)); if (unlikely(ssl == NULL)) goto error; int i; for (i = 1; i < ret; i++) { res = pcre_get_substring((char *) str, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); if (found == 0) goto error; break; } orig = SCStrdup((char*) str_ptr); if (unlikely(orig == NULL)) { goto error; } tmp_str = orig; /* Let's see if we need to scape "'s */ if (tmp_str[0] == '"') { tmp_str[strlen(tmp_str) - 1] = '\0'; tmp_str += 1; } if (tmp_str[0] == '!') { neg = 1; tmp_str++; } if (strncasecmp("sslv2", tmp_str, 5) == 0) { ssl->data[SSLv2].ver = SSL_VERSION_2; if (neg == 1) ssl->data[SSLv2].flags |= DETECT_SSL_VERSION_NEGATED; } else if (strncasecmp("sslv3", tmp_str, 5) == 0) { ssl->data[SSLv3].ver = SSL_VERSION_3; if (neg == 1) ssl->data[SSLv3].flags |= DETECT_SSL_VERSION_NEGATED; } else if (strncasecmp("tls1.0", tmp_str, 6) == 0) { ssl->data[TLS10].ver = TLS_VERSION_10; if (neg == 1) ssl->data[TLS10].flags |= DETECT_SSL_VERSION_NEGATED; } else if (strncasecmp("tls1.1", tmp_str, 6) == 0) { ssl->data[TLS11].ver = TLS_VERSION_11; if (neg == 1) ssl->data[TLS11].flags |= DETECT_SSL_VERSION_NEGATED; } else if (strncasecmp("tls1.2", tmp_str, 6) == 0) { ssl->data[TLS12].ver = TLS_VERSION_12; if (neg == 1) ssl->data[TLS12].flags |= DETECT_SSL_VERSION_NEGATED; } else if (strcmp(tmp_str, "") == 0) { SCFree(orig); if (found == 0) goto error; break; } else { SCLogError(SC_ERR_INVALID_VALUE, "Invalid value"); SCFree(orig); goto error; } found = 1; neg = 0; SCFree(orig); pcre_free_substring(str_ptr); } } return ssl; error: if (ssl != NULL) DetectSslVersionFree(ssl); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectSslVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectSslVersionData *ssl = NULL; SigMatch *sm = NULL; ssl = DetectSslVersionParse(str); if (ssl == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_AL_SSL_VERSION; sm->ctx = (void *)ssl; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_TLS) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); s->alproto = ALPROTO_TLS; return 0; error: if (ssl != NULL) DetectSslVersionFree(ssl); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectSslVersionData * * \param id_d pointer to DetectSslVersionData */ void DetectSslVersionFree(void *ptr) { if (ptr != NULL) SCFree(ptr); } /**********************************Unittests***********************************/ #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectSslVersionTestParse01 is a test to make sure that we parse the * "ssl_version" option correctly when given valid ssl_version option */ int DetectSslVersionTestParse01(void) { DetectSslVersionData *ssl = NULL; ssl = DetectSslVersionParse("SSlv3"); FAIL_IF_NULL(ssl); FAIL_IF_NOT(ssl->data[SSLv3].ver == SSL_VERSION_3); DetectSslVersionFree(ssl); PASS; } /** * \test DetectSslVersionTestParse02 is a test to make sure that we parse the * "ssl_version" option correctly when given an invalid ssl_version option * it should return ssl = NULL */ int DetectSslVersionTestParse02(void) { DetectSslVersionData *ssl = NULL; ssl = DetectSslVersionParse("2.5"); FAIL_IF_NOT_NULL(ssl); DetectSslVersionFree(ssl); PASS; } /** * \test DetectSslVersionTestParse03 is a test to make sure that we parse the * "ssl_version" options correctly when given valid ssl_version options */ int DetectSslVersionTestParse03(void) { DetectSslVersionData *ssl = NULL; ssl = DetectSslVersionParse("SSlv3,tls1.0, !tls1.2"); FAIL_IF_NULL(ssl); FAIL_IF_NOT(ssl->data[SSLv3].ver == SSL_VERSION_3); FAIL_IF_NOT(ssl->data[TLS10].ver == TLS_VERSION_10); FAIL_IF_NOT(ssl->data[TLS12].ver == TLS_VERSION_12); FAIL_IF_NOT(ssl->data[TLS12].flags & DETECT_SSL_VERSION_NEGATED); DetectSslVersionFree(ssl); PASS; } #include "stream-tcp-reassemble.h" /** \test Send a get request in three chunks + more data. */ static int DetectSslVersionTestDetect01(void) { Flow f; uint8_t sslbuf1[] = { 0x16 }; uint32_t ssllen1 = sizeof(sslbuf1); uint8_t sslbuf2[] = { 0x03 }; uint32_t ssllen2 = sizeof(sslbuf2); uint8_t sslbuf3[] = { 0x01 }; uint32_t ssllen3 = sizeof(sslbuf3); uint8_t sslbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x01 }; uint32_t ssllen4 = sizeof(sslbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tls any any -> any any (msg:\"TLS\"; ssl_version:tls1.0; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf1, ssllen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf2, ssllen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf3, ssllen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf4, ssllen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->client_connp.content_type != 0x16); FAIL_IF(app_state->client_connp.version != TLS_VERSION_10); SCLogDebug("app_state is at %p, app_state->server_connp.version 0x%02X app_state->client_connp.version 0x%02X", app_state, app_state->server_connp.version, app_state->client_connp.version); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } static int DetectSslVersionTestDetect02(void) { Flow f; uint8_t sslbuf1[] = { 0x16 }; uint32_t ssllen1 = sizeof(sslbuf1); uint8_t sslbuf2[] = { 0x03 }; uint32_t ssllen2 = sizeof(sslbuf2); uint8_t sslbuf3[] = { 0x01 }; uint32_t ssllen3 = sizeof(sslbuf3); uint8_t sslbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x02 }; uint32_t ssllen4 = sizeof(sslbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tls any any -> any any (msg:\"TLS\"; ssl_version:tls1.0; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf1, ssllen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf2, ssllen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf3, ssllen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf4, ssllen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->client_connp.content_type != 0x16); FAIL_IF(app_state->client_connp.version != TLS_VERSION_10); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } static int DetectSslVersionTestDetect03(void) { DetectEngineCtx *de_ctx = NULL; Flow f; uint8_t sslbuf1[] = { 0x16 }; uint32_t ssllen1 = sizeof(sslbuf1); uint8_t sslbuf2[] = { 0x03 }; uint32_t ssllen2 = sizeof(sslbuf2); uint8_t sslbuf3[] = { 0x01 }; uint32_t ssllen3 = sizeof(sslbuf3); uint8_t sslbuf4[] = { 0x01, 0x00, 0x00, 0xad, 0x03, 0x02 }; uint32_t ssllen4 = sizeof(sslbuf4); TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p->tcph->th_seq = htonl(1000); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; f.alproto = ALPROTO_TLS; f.proto = p->proto; StreamTcpInitConfig(TRUE); StreamMsg *stream_msg = StreamMsgGetFromPool(); FAIL_IF_NULL(stream_msg); memcpy(stream_msg->data, sslbuf4, ssllen4); stream_msg->data_len = ssllen4; ssn.toserver_smsg_head = stream_msg; ssn.toserver_smsg_tail = stream_msg; de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"TLS\"; ssl_version:tls1.0; content:\"|01 00 00 AD|\"; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf1, ssllen1); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf2, ssllen2); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf3, ssllen3); FAIL_IF(r != 0); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, sslbuf4, ssllen4); FAIL_IF(r != 0); FLOWLOCK_UNLOCK(&f); SSLState *app_state = f.alstate; FAIL_IF_NULL(app_state); FAIL_IF(app_state->client_connp.content_type != 0x16); FAIL_IF(app_state->client_connp.version != TLS_VERSION_10); /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectSslVersion */ void DetectSslVersionRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectSslVersionTestParse01", DetectSslVersionTestParse01); UtRegisterTest("DetectSslVersionTestParse02", DetectSslVersionTestParse02); UtRegisterTest("DetectSslVersionTestParse03", DetectSslVersionTestParse03); UtRegisterTest("DetectSslVersionTestDetect01", DetectSslVersionTestDetect01); UtRegisterTest("DetectSslVersionTestDetect02", DetectSslVersionTestDetect02); UtRegisterTest("DetectSslVersionTestDetect03", DetectSslVersionTestDetect03); #endif /* UNITTESTS */ return; } suricata-3.2.1/src/source-nfq.c0000644000000000000000000011600213051004444013227 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Eric Leblond * * Netfilter's netfilter_queue support for reading packets from the * kernel and setting verdicts back to it (inline mode). * Supported on Linux and Windows. * * \todo test if Receive and Verdict if both are present */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "tm-queuehandlers.h" #include "tmqh-packetpool.h" #include "conf.h" #include "config.h" #include "conf-yaml-loader.h" #include "source-nfq-prototypes.h" #include "action-globals.h" #include "util-debug.h" #include "util-error.h" #include "util-byte.h" #include "util-privs.h" #include "util-device.h" #include "runmodes.h" #include "source-nfq.h" #ifndef NFQ /** Handle the case where no NFQ support is compiled in. * */ TmEcode NoNFQSupportExit(ThreadVars *, void *, void **); void TmModuleReceiveNFQRegister (void) { tmm_modules[TMM_RECEIVENFQ].name = "ReceiveNFQ"; tmm_modules[TMM_RECEIVENFQ].ThreadInit = NoNFQSupportExit; tmm_modules[TMM_RECEIVENFQ].Func = NULL; tmm_modules[TMM_RECEIVENFQ].ThreadExitPrintStats = NULL; tmm_modules[TMM_RECEIVENFQ].ThreadDeinit = NULL; tmm_modules[TMM_RECEIVENFQ].RegisterTests = NULL; tmm_modules[TMM_RECEIVENFQ].cap_flags = SC_CAP_NET_ADMIN; tmm_modules[TMM_RECEIVENFQ].flags = TM_FLAG_RECEIVE_TM; } void TmModuleVerdictNFQRegister (void) { tmm_modules[TMM_VERDICTNFQ].name = "VerdictNFQ"; tmm_modules[TMM_VERDICTNFQ].ThreadInit = NoNFQSupportExit; tmm_modules[TMM_VERDICTNFQ].Func = NULL; tmm_modules[TMM_VERDICTNFQ].ThreadExitPrintStats = NULL; tmm_modules[TMM_VERDICTNFQ].ThreadDeinit = NULL; tmm_modules[TMM_VERDICTNFQ].RegisterTests = NULL; tmm_modules[TMM_VERDICTNFQ].cap_flags = SC_CAP_NET_ADMIN; } void TmModuleDecodeNFQRegister (void) { tmm_modules[TMM_DECODENFQ].name = "DecodeNFQ"; tmm_modules[TMM_DECODENFQ].ThreadInit = NoNFQSupportExit; tmm_modules[TMM_DECODENFQ].Func = NULL; tmm_modules[TMM_DECODENFQ].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENFQ].ThreadDeinit = NULL; tmm_modules[TMM_DECODENFQ].RegisterTests = NULL; tmm_modules[TMM_DECODENFQ].cap_flags = 0; tmm_modules[TMM_DECODENFQ].flags = TM_FLAG_DECODE_TM; } TmEcode NoNFQSupportExit(ThreadVars *tv, void *initdata, void **data) { SCLogError(SC_ERR_NFQ_NOSUPPORT,"Error creating thread %s: you do not have support for nfqueue " "enabled please recompile with --enable-nfqueue", tv->name); exit(EXIT_FAILURE); } #else /* implied we do have NFQ support */ extern int max_pending_packets; #define MAX_ALREADY_TREATED 5 #define NFQ_VERDICT_RETRY_TIME 3 static int already_seen_warning; static int runmode_workers; #define NFQ_BURST_FACTOR 4 #ifndef SOL_NETLINK #define SOL_NETLINK 270 #endif //#define NFQ_DFT_QUEUE_LEN NFQ_BURST_FACTOR * MAX_PENDING //#define NFQ_NF_BUFSIZE 1500 * NFQ_DFT_QUEUE_LEN typedef struct NFQThreadVars_ { uint16_t nfq_index; ThreadVars *tv; TmSlot *slot; char *data; /** Per function and thread data */ int datalen; /** Length of per function and thread data */ CaptureStats stats; } NFQThreadVars; /* shared vars for all for nfq queues and threads */ static NFQGlobalVars nfq_g; static NFQThreadVars g_nfq_t[NFQ_MAX_QUEUE]; static NFQQueueVars g_nfq_q[NFQ_MAX_QUEUE]; static uint16_t receive_queue_num = 0; static SCMutex nfq_init_lock; TmEcode ReceiveNFQLoop(ThreadVars *tv, void *data, void *slot); TmEcode ReceiveNFQThreadInit(ThreadVars *, void *, void **); TmEcode ReceiveNFQThreadDeinit(ThreadVars *, void *); void ReceiveNFQThreadExitStats(ThreadVars *, void *); TmEcode VerdictNFQ(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode VerdictNFQThreadInit(ThreadVars *, void *, void **); TmEcode VerdictNFQThreadDeinit(ThreadVars *, void *); TmEcode DecodeNFQ(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *); TmEcode DecodeNFQThreadInit(ThreadVars *, void *, void **); TmEcode DecodeNFQThreadDeinit(ThreadVars *tv, void *data); TmEcode NFQSetVerdict(Packet *p); typedef enum NFQMode_ { NFQ_ACCEPT_MODE, NFQ_REPEAT_MODE, NFQ_ROUTE_MODE, } NFQMode; #define NFQ_FLAG_FAIL_OPEN (1 << 0) typedef struct NFQCnf_ { NFQMode mode; uint32_t mark; uint32_t mask; uint32_t bypass_mark; uint32_t bypass_mask; uint32_t next_queue; uint32_t flags; uint8_t batchcount; } NFQCnf; NFQCnf nfq_config; void TmModuleReceiveNFQRegister (void) { /* XXX create a general NFQ setup function */ memset(&nfq_g, 0, sizeof(nfq_g)); SCMutexInit(&nfq_init_lock, NULL); tmm_modules[TMM_RECEIVENFQ].name = "ReceiveNFQ"; tmm_modules[TMM_RECEIVENFQ].ThreadInit = ReceiveNFQThreadInit; tmm_modules[TMM_RECEIVENFQ].Func = NULL; tmm_modules[TMM_RECEIVENFQ].PktAcqLoop = ReceiveNFQLoop; tmm_modules[TMM_RECEIVENFQ].PktAcqBreakLoop = NULL; tmm_modules[TMM_RECEIVENFQ].ThreadExitPrintStats = ReceiveNFQThreadExitStats; tmm_modules[TMM_RECEIVENFQ].ThreadDeinit = ReceiveNFQThreadDeinit; tmm_modules[TMM_RECEIVENFQ].RegisterTests = NULL; tmm_modules[TMM_RECEIVENFQ].flags = TM_FLAG_RECEIVE_TM; } void TmModuleVerdictNFQRegister (void) { tmm_modules[TMM_VERDICTNFQ].name = "VerdictNFQ"; tmm_modules[TMM_VERDICTNFQ].ThreadInit = VerdictNFQThreadInit; tmm_modules[TMM_VERDICTNFQ].Func = VerdictNFQ; tmm_modules[TMM_VERDICTNFQ].ThreadExitPrintStats = NULL; tmm_modules[TMM_VERDICTNFQ].ThreadDeinit = VerdictNFQThreadDeinit; tmm_modules[TMM_VERDICTNFQ].RegisterTests = NULL; } void TmModuleDecodeNFQRegister (void) { tmm_modules[TMM_DECODENFQ].name = "DecodeNFQ"; tmm_modules[TMM_DECODENFQ].ThreadInit = DecodeNFQThreadInit; tmm_modules[TMM_DECODENFQ].Func = DecodeNFQ; tmm_modules[TMM_DECODENFQ].ThreadExitPrintStats = NULL; tmm_modules[TMM_DECODENFQ].ThreadDeinit = DecodeNFQThreadDeinit; tmm_modules[TMM_DECODENFQ].RegisterTests = NULL; tmm_modules[TMM_DECODENFQ].flags = TM_FLAG_DECODE_TM; } /** \brief To initialize the NFQ global configuration data * * \param quiet It tells the mode of operation, if it is TRUE nothing will * be get printed. */ void NFQInitConfig(char quiet) { intmax_t value = 0; char* nfq_mode = NULL; int boolval; SCLogDebug("Initializing NFQ"); memset(&nfq_config, 0, sizeof(nfq_config)); if ((ConfGet("nfq.mode", &nfq_mode)) == 0) { nfq_config.mode = NFQ_ACCEPT_MODE; } else { if (!strcmp("accept", nfq_mode)) { nfq_config.mode = NFQ_ACCEPT_MODE; } else if (!strcmp("repeat", nfq_mode)) { nfq_config.mode = NFQ_REPEAT_MODE; } else if (!strcmp("route", nfq_mode)) { nfq_config.mode = NFQ_ROUTE_MODE; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "Unknown nfq.mode"); exit(EXIT_FAILURE); } } (void)ConfGetBool("nfq.fail-open", (int *)&boolval); if (boolval) { #ifdef HAVE_NFQ_SET_QUEUE_FLAGS SCLogInfo("Enabling fail-open on queue"); nfq_config.flags |= NFQ_FLAG_FAIL_OPEN; #else SCLogError(SC_ERR_NFQ_NOSUPPORT, "nfq.%s set but NFQ library has no support for it.", "fail-open"); #endif } if ((ConfGetInt("nfq.repeat-mark", &value)) == 1) { nfq_config.mark = (uint32_t)value; } if ((ConfGetInt("nfq.repeat-mask", &value)) == 1) { nfq_config.mask = (uint32_t)value; } if ((ConfGetInt("nfq.bypass-mark", &value)) == 1) { nfq_config.bypass_mark = (uint32_t)value; } if ((ConfGetInt("nfq.bypass-mask", &value)) == 1) { nfq_config.bypass_mask = (uint32_t)value; } if ((ConfGetInt("nfq.route-queue", &value)) == 1) { nfq_config.next_queue = ((uint32_t)value) << 16; } if ((ConfGetInt("nfq.batchcount", &value)) == 1) { #ifdef HAVE_NFQ_SET_VERDICT_BATCH if (value > 255) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "nfq.batchcount cannot exceed 255."); value = 255; } if (value > 1) nfq_config.batchcount = (uint8_t) (value - 1); #else SCLogWarning(SC_ERR_NFQ_NOSUPPORT, "nfq.%s set but NFQ library has no support for it.", "batchcount"); #endif } if (!quiet) { switch (nfq_config.mode) { case NFQ_ACCEPT_MODE: SCLogInfo("NFQ running in standard ACCEPT/DROP mode"); break; case NFQ_REPEAT_MODE: SCLogInfo("NFQ running in REPEAT mode with mark %"PRIu32"/%"PRIu32, nfq_config.mark, nfq_config.mask); break; case NFQ_ROUTE_MODE: SCLogInfo("NFQ running in route mode with next queue %"PRIu32, nfq_config.next_queue >> 16); break; } } } static uint8_t NFQVerdictCacheLen(NFQQueueVars *t) { #ifdef HAVE_NFQ_SET_VERDICT_BATCH return t->verdict_cache.len; #else return 0; #endif } static void NFQVerdictCacheFlush(NFQQueueVars *t) { #ifdef HAVE_NFQ_SET_VERDICT_BATCH int ret; int iter = 0; do { if (t->verdict_cache.mark_valid) ret = nfq_set_verdict_batch2(t->qh, t->verdict_cache.packet_id, t->verdict_cache.verdict, t->verdict_cache.mark); else ret = nfq_set_verdict_batch(t->qh, t->verdict_cache.packet_id, t->verdict_cache.verdict); } while ((ret < 0) && (iter++ < NFQ_VERDICT_RETRY_TIME)); if (ret < 0) { SCLogWarning(SC_ERR_NFQ_SET_VERDICT, "nfq_set_verdict_batch failed: %s", strerror(errno)); } else { t->verdict_cache.len = 0; t->verdict_cache.mark_valid = 0; } #endif } static int NFQVerdictCacheAdd(NFQQueueVars *t, Packet *p, uint32_t verdict) { #ifdef HAVE_NFQ_SET_VERDICT_BATCH if (t->verdict_cache.maxlen == 0) return -1; if (p->flags & PKT_STREAM_MODIFIED || verdict == NF_DROP) goto flush; if (p->flags & PKT_MARK_MODIFIED) { if (!t->verdict_cache.mark_valid) { if (t->verdict_cache.len) goto flush; t->verdict_cache.mark_valid = 1; t->verdict_cache.mark = p->nfq_v.mark; } else if (t->verdict_cache.mark != p->nfq_v.mark) { goto flush; } } else if (t->verdict_cache.mark_valid) { goto flush; } if (t->verdict_cache.len == 0) { t->verdict_cache.verdict = verdict; } else if (t->verdict_cache.verdict != verdict) goto flush; /* same verdict, mark not set or identical -> can cache */ t->verdict_cache.packet_id = p->nfq_v.id; if (t->verdict_cache.len >= t->verdict_cache.maxlen) NFQVerdictCacheFlush(t); else t->verdict_cache.len++; return 0; flush: /* can't cache. Flush current cache and signal caller it should send single verdict */ if (NFQVerdictCacheLen(t) > 0) NFQVerdictCacheFlush(t); #endif return -1; } static inline void NFQMutexInit(NFQQueueVars *nq) { char *active_runmode = RunmodeGetActive(); if (active_runmode && !strcmp("workers", active_runmode)) { nq->use_mutex = 0; runmode_workers = 1; SCLogInfo("NFQ running in 'workers' runmode, will not use mutex."); } else { nq->use_mutex = 1; runmode_workers = 0; SCMutexInit(&nq->mutex_qh, NULL); } } #define NFQMutexLock(nq) do { \ if ((nq)->use_mutex) \ SCMutexLock(&(nq)->mutex_qh); \ } while (0) #define NFQMutexUnlock(nq) do { \ if ((nq)->use_mutex) \ SCMutexUnlock(&(nq)->mutex_qh); \ } while (0) /** * \brief Read data from nfq message and setup Packet * * \note * In case of error, this function verdict the packet * to avoid skb to get stuck in kernel. */ int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data) { struct nfq_data *tb = (struct nfq_data *)data; int ret; char *pktdata; struct nfqnl_msg_packet_hdr *ph; ph = nfq_get_msg_packet_hdr(tb); if (ph != NULL) { p->nfq_v.id = ntohl(ph->packet_id); //p->nfq_v.hw_protocol = ntohs(p->nfq_v.ph->hw_protocol); p->nfq_v.hw_protocol = ph->hw_protocol; } /* coverity[missing_lock] */ p->nfq_v.mark = nfq_get_nfmark(tb); if (nfq_config.mode == NFQ_REPEAT_MODE) { if ((nfq_config.mark & nfq_config.mask) == (p->nfq_v.mark & nfq_config.mask)) { int iter = 0; if (already_seen_warning < MAX_ALREADY_TREATED) SCLogInfo("Packet seems already treated by suricata"); already_seen_warning++; do { ret = nfq_set_verdict(qh, p->nfq_v.id, NF_ACCEPT, 0, NULL); } while ((ret < 0) && (iter++ < NFQ_VERDICT_RETRY_TIME)); if (ret < 0) { SCLogWarning(SC_ERR_NFQ_SET_VERDICT, "nfq_set_verdict of %p failed %" PRId32 ": %s", p, ret, strerror(errno)); } return -1 ; } } p->nfq_v.ifi = nfq_get_indev(tb); p->nfq_v.ifo = nfq_get_outdev(tb); p->nfq_v.verdicted = 0; #ifdef NFQ_GET_PAYLOAD_SIGNED ret = nfq_get_payload(tb, &pktdata); #else ret = nfq_get_payload(tb, (unsigned char **) &pktdata); #endif /* NFQ_GET_PAYLOAD_SIGNED */ if (ret > 0) { /* nfq_get_payload returns a pointer to a part of memory * that is not preserved over the lifetime of our packet. * So we need to copy it. */ if (ret > 65536) { /* Will not be able to copy data ! Set length to 0 * to trigger an error in packet decoding. * This is unlikely to happen */ SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "NFQ sent too big packet"); SET_PKT_LEN(p, 0); } else if (runmode_workers) { PacketSetData(p, (uint8_t *)pktdata, ret); } else { PacketCopyData(p, (uint8_t *)pktdata, ret); } } else if (ret == -1) { /* unable to get pointer to data, ensure packet length is zero. * This will trigger an error in packet decoding */ SET_PKT_LEN(p, 0); } ret = nfq_get_timestamp(tb, &p->ts); if (ret != 0 || p->ts.tv_sec == 0) { memset (&p->ts, 0, sizeof(struct timeval)); gettimeofday(&p->ts, NULL); } p->datalink = DLT_RAW; return 0; } static void NFQReleasePacket(Packet *p) { if (unlikely(!p->nfq_v.verdicted)) { PACKET_UPDATE_ACTION(p, ACTION_DROP); NFQSetVerdict(p); } PacketFreeOrRelease(p); } /** * \brief bypass callback function for NFQ * * \param p a Packet to use information from to trigger bypass * \return 1 if bypass is successful, 0 if not */ static int NFQBypassCallback(Packet *p) { if (IS_TUNNEL_PKT(p)) { /* real tunnels may have multiple flows inside them, so bypass can't * work for those. Rebuilt packets from IP fragments are fine. */ if (p->flags & PKT_REBUILT_FRAGMENT) { Packet *tp = p->root ? p->root : p; SCMutexLock(&tp->tunnel_mutex); tp->nfq_v.mark = (nfq_config.bypass_mark & nfq_config.bypass_mask) | (tp->nfq_v.mark & ~nfq_config.bypass_mask); tp->flags |= PKT_MARK_MODIFIED; SCMutexUnlock(&tp->tunnel_mutex); return 1; } return 0; } else { /* coverity[missing_lock] */ p->nfq_v.mark = (nfq_config.bypass_mark & nfq_config.bypass_mask) | (p->nfq_v.mark & ~nfq_config.bypass_mask); p->flags |= PKT_MARK_MODIFIED; } return 1; } static int NFQCallBack(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_data *nfa, void *data) { NFQThreadVars *ntv = (NFQThreadVars *)data; ThreadVars *tv = ntv->tv; int ret; /* grab a packet */ Packet *p = PacketGetFromQueueOrAlloc(); if (p == NULL) { return -1; } PKT_SET_SRC(p, PKT_SRC_WIRE); p->nfq_v.nfq_index = ntv->nfq_index; /* if bypass mask is set then we may want to bypass so set pointer */ if (nfq_config.bypass_mask) { p->BypassPacketsFlow = NFQBypassCallback; } ret = NFQSetupPkt(p, qh, (void *)nfa); if (ret == -1) { #ifdef COUNTERS NFQQueueVars *q = NFQGetQueue(ntv->nfq_index); q->errs++; q->pkts++; q->bytes += GET_PKT_LEN(p); #endif /* COUNTERS */ /* NFQSetupPkt is issuing a verdict so we only recycle Packet and leave */ TmqhOutputPacketpool(tv, p); return 0; } p->ReleasePacket = NFQReleasePacket; #ifdef COUNTERS NFQQueueVars *q = NFQGetQueue(ntv->nfq_index); q->pkts++; q->bytes += GET_PKT_LEN(p); #endif /* COUNTERS */ if (ntv->slot) { if (TmThreadsSlotProcessPkt(tv, ntv->slot, p) != TM_ECODE_OK) { TmqhOutputPacketpool(ntv->tv, p); return -1; } } else { /* pass on... */ tv->tmqh_out(tv, p); } return 0; } TmEcode NFQInitThread(NFQThreadVars *t, uint32_t queue_maxlen) { #ifndef OS_WIN32 struct timeval tv; int opt; #endif NFQQueueVars *q = NFQGetQueue(t->nfq_index); if (q == NULL) { SCLogError(SC_ERR_NFQ_OPEN, "no queue for given index"); return TM_ECODE_FAILED; } SCLogDebug("opening library handle"); q->h = nfq_open(); if (q->h == NULL) { SCLogError(SC_ERR_NFQ_OPEN, "nfq_open() failed"); return TM_ECODE_FAILED; } if (nfq_g.unbind == 0) { /* VJ: on my Ubuntu Hardy system this fails the first time it's * run. Ignoring the error seems to have no bad effects. */ SCLogDebug("unbinding existing nf_queue handler for AF_INET (if any)"); if (nfq_unbind_pf(q->h, AF_INET) < 0) { SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nfq_unbind_pf(q->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } nfq_g.unbind = 1; SCLogDebug("binding nfnetlink_queue as nf_queue handler for AF_INET and AF_INET6"); if (nfq_bind_pf(q->h, AF_INET) < 0) { SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nfq_bind_pf(q->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } } SCLogInfo("binding this thread %d to queue '%" PRIu32 "'", t->nfq_index, q->queue_num); /* pass the thread memory as a void ptr so the * callback function has access to it. */ q->qh = nfq_create_queue(q->h, q->queue_num, &NFQCallBack, (void *)t); if (q->qh == NULL) { SCLogError(SC_ERR_NFQ_CREATE_QUEUE, "nfq_create_queue failed"); return TM_ECODE_FAILED; } SCLogDebug("setting copy_packet mode"); /* 05DC = 1500 */ //if (nfq_set_mode(nfq_t->qh, NFQNL_COPY_PACKET, 0x05DC) < 0) { if (nfq_set_mode(q->qh, NFQNL_COPY_PACKET, 0xFFFF) < 0) { SCLogError(SC_ERR_NFQ_SET_MODE, "can't set packet_copy mode"); return TM_ECODE_FAILED; } #ifdef HAVE_NFQ_MAXLEN if (queue_maxlen > 0) { SCLogInfo("setting queue length to %" PRId32 "", queue_maxlen); /* non-fatal if it fails */ if (nfq_set_queue_maxlen(q->qh, queue_maxlen) < 0) { SCLogWarning(SC_ERR_NFQ_MAXLEN, "can't set queue maxlen: your kernel probably " "doesn't support setting the queue length"); } } #endif /* HAVE_NFQ_MAXLEN */ #ifndef OS_WIN32 /* set netlink buffer size to a decent value */ nfnl_rcvbufsiz(nfq_nfnlh(q->h), queue_maxlen * 1500); SCLogInfo("setting nfnl bufsize to %" PRId32 "", queue_maxlen * 1500); q->nh = nfq_nfnlh(q->h); q->fd = nfnl_fd(q->nh); NFQMutexInit(q); /* Set some netlink specific option on the socket to increase performance */ opt = 1; #ifdef NETLINK_BROADCAST_SEND_ERROR if (setsockopt(q->fd, SOL_NETLINK, NETLINK_BROADCAST_SEND_ERROR, &opt, sizeof(int)) == -1) { SCLogWarning(SC_ERR_NFQ_SETSOCKOPT, "can't set netlink broadcast error: %s", strerror(errno)); } #endif /* Don't send error about no buffer space available but drop the packets instead */ #ifdef NETLINK_NO_ENOBUFS if (setsockopt(q->fd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(int)) == -1) { SCLogWarning(SC_ERR_NFQ_SETSOCKOPT, "can't set netlink enobufs: %s", strerror(errno)); } #endif #ifdef HAVE_NFQ_SET_QUEUE_FLAGS if (nfq_config.flags & NFQ_FLAG_FAIL_OPEN) { uint32_t flags = NFQA_CFG_F_FAIL_OPEN; uint32_t mask = NFQA_CFG_F_FAIL_OPEN; int r = nfq_set_queue_flags(q->qh, mask, flags); if (r == -1) { SCLogWarning(SC_ERR_NFQ_SET_MODE, "can't set fail-open mode: %s", strerror(errno)); } else { SCLogInfo("fail-open mode should be set on queue"); } } #endif #ifdef HAVE_NFQ_SET_VERDICT_BATCH if (runmode_workers) { q->verdict_cache.maxlen = nfq_config.batchcount; } else if (nfq_config.batchcount) { SCLogError(SC_ERR_INVALID_ARGUMENT, "nfq.batchcount is only valid in workers runmode."); } #endif /* set a timeout to the socket so we can check for a signal * in case we don't get packets for a longer period. */ tv.tv_sec = 1; tv.tv_usec = 0; if(setsockopt(q->fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1) { SCLogWarning(SC_ERR_NFQ_SETSOCKOPT, "can't set socket timeout: %s", strerror(errno)); } SCLogDebug("nfq_q->h %p, nfq_q->nh %p, nfq_q->qh %p, nfq_q->fd %" PRId32 "", q->h, q->nh, q->qh, q->fd); #else /* OS_WIN32 */ NFQMutexInit(q); q->ovr.hEvent = CreateEvent(NULL, FALSE, FALSE, NULL); q->fd = nfq_fd(q->h); SCLogDebug("q->h %p, q->qh %p, q->fd %p", q->h, q->qh, q->fd); #endif /* OS_WIN32 */ return TM_ECODE_OK; } TmEcode ReceiveNFQThreadInit(ThreadVars *tv, void *initdata, void **data) { SCMutexLock(&nfq_init_lock); #ifndef OS_WIN32 sigset_t sigs; sigfillset(&sigs); pthread_sigmask(SIG_BLOCK, &sigs, NULL); #endif /* OS_WIN32 */ NFQThreadVars *ntv = (NFQThreadVars *) initdata; /* store the ThreadVars pointer in our NFQ thread context * as we will need it in our callback function */ ntv->tv = tv; int r = NFQInitThread(ntv, (max_pending_packets * NFQ_BURST_FACTOR)); if (r != TM_ECODE_OK) { SCLogError(SC_ERR_NFQ_THREAD_INIT, "nfq thread failed to initialize"); SCMutexUnlock(&nfq_init_lock); exit(EXIT_FAILURE); } #define T_DATA_SIZE 70000 ntv->data = SCMalloc(T_DATA_SIZE); if (ntv->data == NULL) { SCMutexUnlock(&nfq_init_lock); return TM_ECODE_FAILED; } ntv->datalen = T_DATA_SIZE; #undef T_DATA_SIZE *data = (void *)ntv; SCMutexUnlock(&nfq_init_lock); return TM_ECODE_OK; } TmEcode ReceiveNFQThreadDeinit(ThreadVars *t, void *data) { NFQThreadVars *ntv = (NFQThreadVars *)data; NFQQueueVars *nq = NFQGetQueue(ntv->nfq_index); if (ntv->data != NULL) { SCFree(ntv->data); ntv->data = NULL; } ntv->datalen = 0; NFQMutexLock(nq); SCLogDebug("starting... will close queuenum %" PRIu32 "", nq->queue_num); if (nq->qh) { nfq_destroy_queue(nq->qh); nq->qh = NULL; } NFQMutexUnlock(nq); return TM_ECODE_OK; } TmEcode VerdictNFQThreadInit(ThreadVars *tv, void *initdata, void **data) { NFQThreadVars *ntv = (NFQThreadVars *) initdata; CaptureStatsSetup(tv, &ntv->stats); *data = (void *)ntv; return TM_ECODE_OK; } TmEcode VerdictNFQThreadDeinit(ThreadVars *tv, void *data) { NFQThreadVars *ntv = (NFQThreadVars *)data; NFQQueueVars *nq = NFQGetQueue(ntv->nfq_index); SCLogDebug("starting... will close queuenum %" PRIu32 "", nq->queue_num); NFQMutexLock(nq); if (nq->qh) { nfq_destroy_queue(nq->qh); nq->qh = NULL; } NFQMutexUnlock(nq); return TM_ECODE_OK; } /** * \brief Add a Netfilter queue * * \param string with the queue name * * \retval 0 on success. * \retval -1 on failure. */ int NFQRegisterQueue(char *queue) { NFQThreadVars *ntv = NULL; NFQQueueVars *nq = NULL; /* Extract the queue number from the specified command line argument */ uint16_t queue_num = 0; if ((ByteExtractStringUint16(&queue_num, 10, strlen(queue), queue)) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified queue number %s is not " "valid", queue); return -1; } SCMutexLock(&nfq_init_lock); if (receive_queue_num >= NFQ_MAX_QUEUE) { SCLogError(SC_ERR_INVALID_ARGUMENT, "too much Netfilter queue registered (%d)", receive_queue_num); SCMutexUnlock(&nfq_init_lock); return -1; } if (receive_queue_num == 0) { memset(&g_nfq_t, 0, sizeof(g_nfq_t)); memset(&g_nfq_q, 0, sizeof(g_nfq_q)); } ntv = &g_nfq_t[receive_queue_num]; ntv->nfq_index = receive_queue_num; nq = &g_nfq_q[receive_queue_num]; nq->queue_num = queue_num; receive_queue_num++; SCMutexUnlock(&nfq_init_lock); LiveRegisterDevice(queue); SCLogDebug("Queue \"%s\" registered.", queue); return 0; } /** * \brief Get a pointer to the NFQ queue at index * * \param number idx of the queue in our array * * \retval ptr pointer to the NFQThreadVars at index * \retval NULL on error */ void *NFQGetQueue(int number) { if (number >= receive_queue_num) return NULL; return (void *)&g_nfq_q[number]; } /** * \brief Get a pointer to the NFQ thread at index * * This function is temporary used as configuration parser. * * \param number idx of the queue in our array * * \retval ptr pointer to the NFQThreadVars at index * \retval NULL on error */ void *NFQGetThread(int number) { if (number >= receive_queue_num) return NULL; return (void *)&g_nfq_t[number]; } /** * \brief NFQ function to get a packet from the kernel * * \note separate functions for Linux and Win32 for readability. */ #ifndef OS_WIN32 void NFQRecvPkt(NFQQueueVars *t, NFQThreadVars *tv) { int rv, ret; int flag = NFQVerdictCacheLen(t) ? MSG_DONTWAIT : 0; /* XXX what happens on rv == 0? */ rv = recv(t->fd, tv->data, tv->datalen, flag); if (rv < 0) { if (errno == EINTR || errno == EWOULDBLOCK) { /* no error on timeout */ if (flag) NFQVerdictCacheFlush(t); } else { #ifdef COUNTERS NFQMutexLock(t); t->errs++; NFQMutexUnlock(t); #endif /* COUNTERS */ } } else if(rv == 0) { SCLogWarning(SC_ERR_NFQ_RECV, "recv got returncode 0"); } else { #ifdef DBG_PERF if (rv > t->dbg_maxreadsize) t->dbg_maxreadsize = rv; #endif /* DBG_PERF */ //printf("NFQRecvPkt: t %p, rv = %" PRId32 "\n", t, rv); NFQMutexLock(t); if (t->qh != NULL) { ret = nfq_handle_packet(t->h, tv->data, rv); } else { SCLogWarning(SC_ERR_NFQ_HANDLE_PKT, "NFQ handle has been destroyed"); ret = -1; } NFQMutexUnlock(t); if (ret != 0) { SCLogWarning(SC_ERR_NFQ_HANDLE_PKT, "nfq_handle_packet error %" PRId32 "", ret); } } } #else /* WIN32 version of NFQRecvPkt */ void NFQRecvPkt(NFQQueueVars *t, NFQThreadVars *tv) { int rv, ret; static int timeouted = 0; if (timeouted) { if (WaitForSingleObject(t->ovr.hEvent, 1000) == WAIT_TIMEOUT) { rv = -1; errno = EINTR; goto process_rv; } timeouted = 0; } read_packet_again: if (!ReadFile(t->fd, tv->buf, sizeof(tv->buf), (DWORD*)&rv, &t->ovr)) { if (GetLastError() != ERROR_IO_PENDING) { rv = -1; errno = EIO; } else { if (WaitForSingleObject(t->ovr.hEvent, 1000) == WAIT_TIMEOUT) { rv = -1; errno = EINTR; timeouted = 1; } else { /* We needn't to call GetOverlappedResult() because it always * fail with our error code ERROR_MORE_DATA. */ goto read_packet_again; } } } process_rv: if (rv < 0) { if (errno == EINTR) { /* no error on timeout */ } else { #ifdef COUNTERS t->errs++; #endif /* COUNTERS */ } } else if(rv == 0) { SCLogWarning(SC_ERR_NFQ_RECV, "recv got returncode 0"); } else { #ifdef DBG_PERF if (rv > t->dbg_maxreadsize) t->dbg_maxreadsize = rv; #endif /* DBG_PERF */ //printf("NFQRecvPkt: t %p, rv = %" PRId32 "\n", t, rv); NFQMutexLock(t); if (t->qh) { ret = nfq_handle_packet(t->h, buf, rv); } else { SCLogWarning(SC_ERR_NFQ_HANDLE_PKT, "NFQ handle has been destroyed"); ret = -1; } NFQMutexUnlock(t); if (ret != 0) { SCLogWarning(SC_ERR_NFQ_HANDLE_PKT, "nfq_handle_packet error %" PRId32 "", ret); } } } #endif /* OS_WIN32 */ /** * \brief Main NFQ reading Loop function */ TmEcode ReceiveNFQLoop(ThreadVars *tv, void *data, void *slot) { SCEnter(); NFQThreadVars *ntv = (NFQThreadVars *)data; NFQQueueVars *nq = NFQGetQueue(ntv->nfq_index); ntv->slot = ((TmSlot *) slot)->slot_next; while(1) { if (suricata_ctl_flags != 0) { NFQMutexLock(nq); if (nq->qh) { nfq_destroy_queue(nq->qh); nq->qh = NULL; } NFQMutexUnlock(nq); break; } NFQRecvPkt(nq, ntv); StatsSyncCountersIfSignalled(tv); } SCReturnInt(TM_ECODE_OK); } /** * \brief NFQ receive module stats printing function */ void ReceiveNFQThreadExitStats(ThreadVars *tv, void *data) { NFQThreadVars *ntv = (NFQThreadVars *)data; NFQQueueVars *nq = NFQGetQueue(ntv->nfq_index); #ifdef COUNTERS SCLogNotice("(%s) Treated: Pkts %" PRIu32 ", Bytes %" PRIu64 ", Errors %" PRIu32 "", tv->name, nq->pkts, nq->bytes, nq->errs); SCLogNotice("(%s) Verdict: Accepted %"PRIu32", Dropped %"PRIu32", Replaced %"PRIu32, tv->name, nq->accepted, nq->dropped, nq->replaced); #endif } /** * \brief NFQ verdict function */ TmEcode NFQSetVerdict(Packet *p) { int iter = 0; int ret = 0; uint32_t verdict = NF_ACCEPT; /* we could also have a direct pointer but we need to have a ref counf in this case */ NFQQueueVars *t = g_nfq_q + p->nfq_v.nfq_index; /** \todo add a test on validity of the entry NFQQueueVars could have been * wipeout */ p->nfq_v.verdicted = 1; /* can't verdict a "fake" packet */ if (p->flags & PKT_PSEUDO_STREAM_END) { return TM_ECODE_OK; } //printf("%p verdicting on queue %" PRIu32 "\n", t, t->queue_num); NFQMutexLock(t); if (t->qh == NULL) { /* Somebody has started a clean-up, we leave */ NFQMutexUnlock(t); return TM_ECODE_OK; } if (PACKET_TEST_ACTION(p, ACTION_DROP)) { verdict = NF_DROP; #ifdef COUNTERS t->dropped++; #endif /* COUNTERS */ } else { switch (nfq_config.mode) { default: case NFQ_ACCEPT_MODE: verdict = NF_ACCEPT; break; case NFQ_REPEAT_MODE: verdict = NF_REPEAT; break; case NFQ_ROUTE_MODE: verdict = ((uint32_t) NF_QUEUE) | nfq_config.next_queue; break; } if (p->flags & PKT_STREAM_MODIFIED) { #ifdef COUNTERS t->replaced++; #endif /* COUNTERS */ } #ifdef COUNTERS t->accepted++; #endif /* COUNTERS */ } ret = NFQVerdictCacheAdd(t, p, verdict); if (ret == 0) { NFQMutexUnlock(t); return TM_ECODE_OK; } do { switch (nfq_config.mode) { default: case NFQ_ACCEPT_MODE: case NFQ_ROUTE_MODE: if (p->flags & PKT_MARK_MODIFIED) { #ifdef HAVE_NFQ_SET_VERDICT2 if (p->flags & PKT_STREAM_MODIFIED) { ret = nfq_set_verdict2(t->qh, p->nfq_v.id, verdict, p->nfq_v.mark, GET_PKT_LEN(p), GET_PKT_DATA(p)); } else { ret = nfq_set_verdict2(t->qh, p->nfq_v.id, verdict, p->nfq_v.mark, 0, NULL); } #else /* fall back to old function */ if (p->flags & PKT_STREAM_MODIFIED) { ret = nfq_set_verdict_mark(t->qh, p->nfq_v.id, verdict, htonl(p->nfq_v.mark), GET_PKT_LEN(p), GET_PKT_DATA(p)); } else { ret = nfq_set_verdict_mark(t->qh, p->nfq_v.id, verdict, htonl(p->nfq_v.mark), 0, NULL); } #endif /* HAVE_NFQ_SET_VERDICT2 */ } else { if (p->flags & PKT_STREAM_MODIFIED) { ret = nfq_set_verdict(t->qh, p->nfq_v.id, verdict, GET_PKT_LEN(p), GET_PKT_DATA(p)); } else { ret = nfq_set_verdict(t->qh, p->nfq_v.id, verdict, 0, NULL); } } break; case NFQ_REPEAT_MODE: #ifdef HAVE_NFQ_SET_VERDICT2 if (p->flags & PKT_STREAM_MODIFIED) { ret = nfq_set_verdict2(t->qh, p->nfq_v.id, verdict, (nfq_config.mark & nfq_config.mask) | (p->nfq_v.mark & ~nfq_config.mask), GET_PKT_LEN(p), GET_PKT_DATA(p)); } else { ret = nfq_set_verdict2(t->qh, p->nfq_v.id, verdict, (nfq_config.mark & nfq_config.mask) | (p->nfq_v.mark & ~nfq_config.mask), 0, NULL); } #else /* fall back to old function */ if (p->flags & PKT_STREAM_MODIFIED) { ret = nfq_set_verdict_mark(t->qh, p->nfq_v.id, verdict, htonl((nfq_config.mark & nfq_config.mask) | (p->nfq_v.mark & ~nfq_config.mask)), GET_PKT_LEN(p), GET_PKT_DATA(p)); } else { ret = nfq_set_verdict_mark(t->qh, p->nfq_v.id, verdict, htonl((nfq_config.mark & nfq_config.mask) | (p->nfq_v.mark & ~nfq_config.mask)), 0, NULL); } #endif /* HAVE_NFQ_SET_VERDICT2 */ break; } } while ((ret < 0) && (iter++ < NFQ_VERDICT_RETRY_TIME)); NFQMutexUnlock(t); if (ret < 0) { SCLogWarning(SC_ERR_NFQ_SET_VERDICT, "nfq_set_verdict of %p failed %" PRId32 ": %s", p, ret, strerror(errno)); return TM_ECODE_FAILED; } return TM_ECODE_OK; } /** * \brief NFQ verdict module packet entry function */ TmEcode VerdictNFQ(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { NFQThreadVars *ntv = (NFQThreadVars *)data; /* update counters */ CaptureStatsUpdate(tv, &ntv->stats, p); int ret; /* if this is a tunnel packet we check if we are ready to verdict * already. */ if (IS_TUNNEL_PKT(p)) { char verdict = 1; //printf("VerdictNFQ: tunnel pkt: %p %s\n", p, p->root ? "upper layer" : "root"); SCMutex *m = p->root ? &p->root->tunnel_mutex : &p->tunnel_mutex; SCMutexLock(m); /* if there are more tunnel packets than ready to verdict packets, * we won't verdict this one */ if (TUNNEL_PKT_TPR(p) > TUNNEL_PKT_RTV(p)) { SCLogDebug("not ready to verdict yet: TUNNEL_PKT_TPR(p) > " "TUNNEL_PKT_RTV(p) = %" PRId32 " > %" PRId32, TUNNEL_PKT_TPR(p), TUNNEL_PKT_RTV(p)); verdict = 0; } SCMutexUnlock(m); /* don't verdict if we are not ready */ if (verdict == 1) { //printf("VerdictNFQ: setting verdict\n"); ret = NFQSetVerdict(p->root ? p->root : p); if (ret != TM_ECODE_OK) return ret; } else { TUNNEL_INCR_PKT_RTV(p); } } else { /* no tunnel, verdict normally */ ret = NFQSetVerdict(p); if (ret != TM_ECODE_OK) return ret; } return TM_ECODE_OK; } /** * \brief Decode a packet coming from NFQ */ TmEcode DecodeNFQ(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { IPV4Hdr *ip4h = (IPV4Hdr *)GET_PKT_DATA(p); IPV6Hdr *ip6h = (IPV6Hdr *)GET_PKT_DATA(p); DecodeThreadVars *dtv = (DecodeThreadVars *)data; /* XXX HACK: flow timeout can call us for injected pseudo packets * see bug: https://redmine.openinfosecfoundation.org/issues/1107 */ if (p->flags & PKT_PSEUDO_STREAM_END) return TM_ECODE_OK; DecodeUpdatePacketCounters(tv, dtv, p); if (IPV4_GET_RAW_VER(ip4h) == 4) { SCLogDebug("IPv4 packet"); DecodeIPV4(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else if(IPV6_GET_RAW_VER(ip6h) == 6) { SCLogDebug("IPv6 packet"); DecodeIPV6(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p), pq); } else { SCLogDebug("packet unsupported by NFQ, first byte: %02x", *GET_PKT_DATA(p)); } PacketDecodeFinalize(tv, dtv, p); return TM_ECODE_OK; } /** * \brief Initialize the NFQ Decode threadvars */ TmEcode DecodeNFQThreadInit(ThreadVars *tv, void *initdata, void **data) { DecodeThreadVars *dtv = NULL; dtv = DecodeThreadVarsAlloc(tv); if (dtv == NULL) SCReturnInt(TM_ECODE_FAILED); DecodeRegisterPerfCounters(dtv, tv); *data = (void *)dtv; return TM_ECODE_OK; } TmEcode DecodeNFQThreadDeinit(ThreadVars *tv, void *data) { if (data != NULL) DecodeThreadVarsFree(tv, data); SCReturnInt(TM_ECODE_OK); } #endif /* NFQ */ suricata-3.2.1/src/util-debug-filters.c0000644000000000000000000006722513051004444014670 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * * Debug filter utility functions */ #include "suricata-common.h" /* both of these are defined in util-debug.c */ extern int sc_log_module_initialized; extern int sc_log_module_cleaned; /* used to indicate if any FG filters are registered */ int sc_log_fg_filters_present = 0; /* used to indicate if any FD filters are registered */ int sc_log_fd_filters_present = 0; /** * \brief Holds the fine-grained filters */ SCLogFGFilterFile *sc_log_fg_filters[SC_LOG_FILTER_MAX] = { NULL, NULL }; /** * \brief Mutex for accessing the fine-grained fiters sc_log_fg_filters */ static SCMutex sc_log_fg_filters_m[SC_LOG_FILTER_MAX] = { SCMUTEX_INITIALIZER, SCMUTEX_INITIALIZER }; /** * \brief Holds the function-dependent filters */ static SCLogFDFilter *sc_log_fd_filters = NULL; /** * \brief Mutex for accessing the function-dependent filters sc_log_fd_filters */ static SCMutex sc_log_fd_filters_m = SCMUTEX_INITIALIZER; /** * \brief Holds the thread_list required by function-dependent filters */ static SCLogFDFilterThreadList *sc_log_fd_filters_tl = NULL; /** * \brief Mutex for accessing the FD thread_list sc_log_fd_filters_tl */ static SCMutex sc_log_fd_filters_tl_m = SCMUTEX_INITIALIZER; /** * \brief Helper function used internally to add a FG filter * * \param file File_name of the filter * \param function Function_name of the filter * \param line Line number of the filter * \param listtype The filter listtype. Can be either a blacklist or whitelist * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) * * \retval 0 on successfully adding the filter; * \retval -1 on failure */ int SCLogAddFGFilter(const char *file, const char *function, int line, int listtype) { SCLogFGFilterFile *fgf_file = NULL; SCLogFGFilterFile *prev_fgf_file = NULL; SCLogFGFilterFunc *fgf_func = NULL; SCLogFGFilterFunc *prev_fgf_func = NULL; SCLogFGFilterLine *fgf_line = NULL; SCLogFGFilterLine *prev_fgf_line = NULL; int found = 0; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return -1 ; } if (file == NULL && function == NULL && line < 0) { printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n"); return -1; } SCMutex *m = &sc_log_fg_filters_m[listtype]; SCMutexLock(m); fgf_file = sc_log_fg_filters[listtype]; prev_fgf_file = fgf_file; while (fgf_file != NULL) { prev_fgf_file = fgf_file; if (file == NULL && fgf_file->file == NULL) found = 1; else if (file != NULL && fgf_file->file != NULL) found = (strcmp(file, fgf_file->file) == 0); else found = 0; if (found == 1) break; fgf_file = fgf_file->next; } if (found == 0) { SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype); goto done; } found = 0; fgf_func = fgf_file->func; prev_fgf_func = fgf_func; while (fgf_func != NULL) { prev_fgf_func = fgf_func; if (function == NULL && fgf_func->func == NULL) found = 1; else if (function != NULL && fgf_func->func != NULL) found = (strcmp(function, fgf_func->func) == 0); else found = 0; if (found == 1) break; fgf_func = fgf_func->next; } if (found == 0) { SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line); goto done; } found = 0; fgf_line = fgf_func->line; prev_fgf_line = fgf_line; while(fgf_line != NULL) { prev_fgf_line = fgf_line; if (line == fgf_line->line) { found = 1; break; } fgf_line = fgf_line->next; } if (found == 0) { SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line); goto done; } done: SCMutexUnlock(&sc_log_fg_filters_m[listtype]); sc_log_fg_filters_present = 1; return 0; } /** * \brief Internal function used to check for matches against registered FG * filters. Checks if there is a match for the incoming log_message with * any of the FG filters. Based on whether the filter type is whitelist * or blacklist, the function allows the message to be logged or not. * * \param file File_name from where the log_message originated * \param function Function_name from where the log_message originated * \param line Line number from where the log_message originated * \param listtype The filter listtype. Can be either a blacklist or whitelist * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) * * \retval 1 if there is a match * \retval 0 on no match * \retval -1 on failure */ static int SCLogMatchFGFilter(const char *file, const char *function, int line, int listtype) { SCLogFGFilterFile *fgf_file = NULL; SCLogFGFilterFunc *fgf_func = NULL; SCLogFGFilterLine *fgf_line = NULL; int match = 1; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return -1; } SCMutexLock(&sc_log_fg_filters_m[listtype]); fgf_file = sc_log_fg_filters[listtype]; if (fgf_file == NULL) { SCMutexUnlock(&sc_log_fg_filters_m[listtype]); return 1; } while(fgf_file != NULL) { match = 1; match &= (fgf_file->file != NULL)? !strcmp(file, fgf_file->file): 1; if (match == 0) { fgf_file = fgf_file->next; continue; } fgf_func = fgf_file->func; while (fgf_func != NULL) { match = 1; match &= (fgf_func->func != NULL)? !strcmp(function, fgf_func->func): 1; if (match == 0) { fgf_func = fgf_func->next; continue; } fgf_line = fgf_func->line; while (fgf_line != NULL) { match = 1; match &= (fgf_line->line != -1)? (line == fgf_line->line): 1; if (match == 1) break; fgf_line = fgf_line->next; } if (match == 1) break; fgf_func = fgf_func->next; } if (match == 1) { SCMutexUnlock(&sc_log_fg_filters_m[listtype]); if (listtype == SC_LOG_FILTER_WL) return 1; else return 0; } fgf_file = fgf_file->next; } SCMutexUnlock(&sc_log_fg_filters_m[listtype]); if (listtype == SC_LOG_FILTER_WL) return 0; else return 1; } /** * \brief Checks if there is a match for the incoming log_message with any * of the FG filters. If there is a match, it allows the message * to be logged, else it rejects that message. * * \param file File_name from where the log_message originated * \param function Function_name from where the log_message originated * \param line Line number from where the log_message originated * * \retval 1 if there is a match * \retval 0 on no match * \retval -1 on failure */ int SCLogMatchFGFilterWL(const char *file, const char *function, int line) { return SCLogMatchFGFilter(file, function, line, SC_LOG_FILTER_WL); } /** * \brief Checks if there is a match for the incoming log_message with any * of the FG filters. If there is a match it rejects the logging * for that messages, else it allows that message to be logged * * \praram file File_name from where the log_message originated * \param function Function_name from where the log_message originated * \param line Line number from where the log_message originated * * \retval 1 if there is a match * \retval 0 on no match * \retval -1 on failure */ int SCLogMatchFGFilterBL(const char *file, const char *function, int line) { return SCLogMatchFGFilter(file, function, line, SC_LOG_FILTER_BL); } /** * \brief Adds a Whitelist(WL) fine-grained(FG) filter. A FG filter WL filter * allows messages that match this filter, to be logged, while the filter * is defined using a file_name, function_name and line_number. * * If a particular paramter in the fg-filter(file, function and line), * shouldn't be considered while logging the message, one can supply * NULL for the file_name or function_name and a negative line_no. * * \param file File_name of the filter * \param function Function_name of the filter * \param line Line number of the filter * * \retval 0 on successfully adding the filter; * \retval -1 on failure */ int SCLogAddFGFilterWL(const char *file, const char *function, int line) { return SCLogAddFGFilter(file, function, line, SC_LOG_FILTER_WL); } /** * \brief Adds a Blacklist(BL) fine-grained(FG) filter. A FG filter BL filter * allows messages that don't match this filter, to be logged, while the * filter is defined using a file_name, function_name and line_number * * If a particular paramter in the fg-filter(file, function and line), * shouldn't be considered while logging the message, one can supply * NULL for the file_name or function_name and a negative line_no. * * \param file File_name of the filter * \param function Function_name of the filter * \param line Line number of the filter * * \retval 0 on successfully adding the filter * \retval -1 on failure */ int SCLogAddFGFilterBL(const char *file, const char *function, int line) { return SCLogAddFGFilter(file, function, line, SC_LOG_FILTER_BL); } void SCLogReleaseFGFilters(void) { SCLogFGFilterFile *fgf_file = NULL; SCLogFGFilterFunc *fgf_func = NULL; SCLogFGFilterLine *fgf_line = NULL; void *temp = NULL; int i = 0; for (i = 0; i < SC_LOG_FILTER_MAX; i++) { SCMutexLock(&sc_log_fg_filters_m[i]); fgf_file = sc_log_fg_filters[i]; while (fgf_file != NULL) { fgf_func = fgf_file->func; while (fgf_func != NULL) { fgf_line = fgf_func->line; while(fgf_line != NULL) { temp = fgf_line; fgf_line = fgf_line->next; SCFree(temp); } if (fgf_func->func != NULL) SCFree(fgf_func->func); temp = fgf_func; fgf_func = fgf_func->next; SCFree(temp); } if (fgf_file->file != NULL) SCFree(fgf_file->file); temp = fgf_file; fgf_file = fgf_file->next; SCFree(temp); } SCMutexUnlock(&sc_log_fg_filters_m[i]); sc_log_fg_filters[i] = NULL; } return; } /** * \brief Prints the FG filters(both WL and BL). Used for debugging purposes. * * \retval count The no of FG filters */ int SCLogPrintFGFilters() { SCLogFGFilterFile *fgf_file = NULL; SCLogFGFilterFunc *fgf_func = NULL; SCLogFGFilterLine *fgf_line = NULL; int count = 0; int i = 0; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return 0; } #ifdef DEBUG printf("Fine grained filters:\n"); #endif for (i = 0; i < SC_LOG_FILTER_MAX; i++) { SCMutexLock(&sc_log_fg_filters_m[i]); fgf_file = sc_log_fg_filters[i]; while (fgf_file != NULL) { fgf_func = fgf_file->func; while (fgf_func != NULL) { fgf_line = fgf_func->line; while(fgf_line != NULL) { #ifdef DEBUG printf("%s - ", fgf_file->file); printf("%s - ", fgf_func->func); printf("%d\n", fgf_line->line); #endif count++; fgf_line = fgf_line->next; } fgf_func = fgf_func->next; } fgf_file = fgf_file->next; } SCMutexUnlock(&sc_log_fg_filters_m[i]); } return count; } /* --------------------------------------------------|-------------------------- * -------------------------- Code for the FD Filter |-------------------------- * --------------------------------------------------V-------------------------- */ /** * \brief Checks if there is a match for the incoming log_message with any * of the FD filters * * \param function Function_name from where the log_message originated * * \retval 1 if there is a match * \retval 0 on no match; */ int SCLogMatchFDFilter(const char *function) { #ifndef DEBUG return 1; #else SCLogFDFilterThreadList *thread_list = NULL; pthread_t self = pthread_self(); if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return 0; } SCMutexLock(&sc_log_fd_filters_tl_m); if (sc_log_fd_filters_tl == NULL) { SCMutexUnlock(&sc_log_fd_filters_tl_m); if (sc_log_fd_filters != NULL) return 0; return 1; } thread_list = sc_log_fd_filters_tl; while (thread_list != NULL) { if (pthread_equal(self, thread_list->t)) { if (thread_list->entered > 0) { SCMutexUnlock(&sc_log_fd_filters_tl_m); return 1; } SCMutexUnlock(&sc_log_fd_filters_tl_m); return 0; } thread_list = thread_list->next; } SCMutexUnlock(&sc_log_fd_filters_tl_m); return 0; #endif } /** * \brief Updates a FD filter, based on whether the function that calls this * function, is registered as a FD filter or not. This is called by * a function only on its entry * * \param function Function_name from where the log_message originated * * \retval 1 Since it is a hack to get things working inside the macros */ int SCLogCheckFDFilterEntry(const char *function) { SCLogFDFilter *curr = NULL; SCLogFDFilterThreadList *thread_list = NULL; SCLogFDFilterThreadList *thread_list_temp = NULL; //pid_t self = syscall(SYS_gettid); pthread_t self = pthread_self(); if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return 0; } SCMutexLock(&sc_log_fd_filters_m); curr = sc_log_fd_filters; while (curr != NULL) { if (strcmp(function, curr->func) == 0) break; curr = curr->next; } if (curr == NULL) { SCMutexUnlock(&sc_log_fd_filters_m); return 1; } SCMutexUnlock(&sc_log_fd_filters_m); SCMutexLock(&sc_log_fd_filters_tl_m); thread_list = sc_log_fd_filters_tl; while (thread_list != NULL) { if (pthread_equal(self, thread_list->t)) break; thread_list = thread_list->next; } if (thread_list != NULL) { thread_list->entered++; SCMutexUnlock(&sc_log_fd_filters_tl_m); return 1; } if ( (thread_list_temp = SCMalloc(sizeof(SCLogFDFilterThreadList))) == NULL) { SCMutexUnlock(&sc_log_fd_filters_tl_m); return 0; } memset(thread_list_temp, 0, sizeof(SCLogFDFilterThreadList)); thread_list_temp->t = self; thread_list_temp->entered++; sc_log_fd_filters_tl = thread_list_temp; SCMutexUnlock(&sc_log_fd_filters_tl_m); return 1; } /** * \brief Updates a FD filter, based on whether the function that calls this * function, is registered as a FD filter or not. This is called by * a function only before its exit. * * \param function Function_name from where the log_message originated * */ void SCLogCheckFDFilterExit(const char *function) { SCLogFDFilter *curr = NULL; SCLogFDFilterThreadList *thread_list = NULL; //pid_t self = syscall(SYS_gettid); pthread_t self = pthread_self(); if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return; } SCMutexLock(&sc_log_fd_filters_m); curr = sc_log_fd_filters; while (curr != NULL) { if (strcmp(function, curr->func) == 0) break; curr = curr->next; } if (curr == NULL) { SCMutexUnlock(&sc_log_fd_filters_m); return; } SCMutexUnlock(&sc_log_fd_filters_m); SCMutexLock(&sc_log_fd_filters_tl_m); thread_list = sc_log_fd_filters_tl; while (thread_list != NULL) { if (pthread_equal(self, thread_list->t)) break; thread_list = thread_list->next; } SCMutexUnlock(&sc_log_fd_filters_tl_m); if (thread_list != NULL) thread_list->entered--; return; } /** * \brief Adds a Function-Dependent(FD) filter * * \param Name of the function for which a FD filter has to be registered * * \retval 0 on success * \retval -1 on failure */ int SCLogAddFDFilter(const char *function) { SCLogFDFilter *curr = NULL; SCLogFDFilter *prev = NULL; SCLogFDFilter *temp = NULL; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return -1; } if (function == NULL) { printf("Invalid argument supplied to SCLogAddFDFilter\n"); return -1; } SCMutexLock(&sc_log_fd_filters_m); curr = sc_log_fd_filters; while (curr != NULL) { prev = curr; if (strcmp(function, curr->func) == 0) { SCMutexUnlock(&sc_log_fd_filters_m); return 0; } curr = curr->next; } if ( (temp = SCMalloc(sizeof(SCLogFDFilter))) == NULL) { printf("Error Allocating memory (SCMalloc)\n"); exit(EXIT_FAILURE); } memset(temp, 0, sizeof(SCLogFDFilter)); if ( (temp->func = SCStrdup(function)) == NULL) { printf("Error Allocating memory (SCStrdup)\n"); exit(EXIT_FAILURE); } if (sc_log_fd_filters == NULL) sc_log_fd_filters = temp; /* clang thinks prev can be NULL, but it can't be unless * sc_log_fd_filters is also NULL which is handled here. * Doing this "fix" to shut clang up. */ else if (prev != NULL) prev->next = temp; SCMutexUnlock(&sc_log_fd_filters_m); sc_log_fd_filters_present = 1; return 0; } /** * \brief Releases all the FD filters added to the logging module */ void SCLogReleaseFDFilters(void) { SCLogFDFilter *fdf = NULL; SCLogFDFilter *temp = NULL; SCMutexLock(&sc_log_fd_filters_m); fdf = sc_log_fd_filters; while (fdf != NULL) { temp = fdf; fdf = fdf->next; SCLogReleaseFDFilter(temp); } sc_log_fd_filters = NULL; SCMutexUnlock( &sc_log_fd_filters_m ); return; } /** * \brief Removes a Function-Dependent(FD) filter * * \param Name of the function for which a FD filter has to be unregistered * * \retval 0 on success(the filter was removed or the filter was not present) * \retval -1 on failure/error */ int SCLogRemoveFDFilter(const char *function) { SCLogFDFilter *curr = NULL; SCLogFDFilter *prev = NULL; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return -1 ; } if (function == NULL) { printf("Invalid argument(s) supplied to SCLogRemoveFDFilter\n"); return -1; } SCMutexLock(&sc_log_fd_filters_m); if (sc_log_fd_filters == NULL) { SCMutexUnlock(&sc_log_fd_filters_m); return 0; } curr = sc_log_fd_filters; prev = curr; while (curr != NULL) { if (strcmp(function, curr->func) == 0) break; prev = curr; curr = curr->next; } if (curr == NULL) { SCMutexUnlock(&sc_log_fd_filters_m); return 0; } if (sc_log_fd_filters == curr) sc_log_fd_filters = curr->next; else prev->next = curr->next; SCLogReleaseFDFilter(curr); SCMutexUnlock(&sc_log_fd_filters_m); if (sc_log_fd_filters == NULL) sc_log_fd_filters_present = 0; return 0; } /** * \brief Prints the FG filters(both WL and BL). Used for debugging purposes. * * \retval count The no of FG filters */ int SCLogPrintFDFilters(void) { SCLogFDFilter *fdf = NULL; int count = 0; if (sc_log_module_initialized != 1) { printf("Logging module not initialized. Call SCLogInitLogModule() " "first before using the debug API\n"); return 0; } #ifdef DEBUG printf("FD filters:\n"); #endif SCMutexLock(&sc_log_fd_filters_m); fdf = sc_log_fd_filters; while (fdf != NULL) { #ifdef DEBUG printf("%s \n", fdf->func); #endif fdf = fdf->next; count++; } SCMutexUnlock(&sc_log_fd_filters_m); return count; } /** * \brief Helper function used internally to add a FG filter. This function is * called when the file component of the incoming filter has no entry * in the filter list. * * \param fgf_file The file component(basically the position in the list) from * the filter list, after which the new filter has to be added * \param file File_name of the filter * \param function Function_name of the filter * \param line Line number of the filter * \param listtype The filter listtype. Can be either a blacklist or whitelist * filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL) */ void SCLogAddToFGFFileList(SCLogFGFilterFile *fgf_file, const char *file, const char *function, int line, int listtype) { SCLogFGFilterFile *fgf_file_temp = NULL; SCLogFGFilterFunc *fgf_func_temp = NULL; SCLogFGFilterLine *fgf_line_temp = NULL; if ( (fgf_file_temp = SCMalloc(sizeof(SCLogFGFilterFile))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFFileList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_file_temp, 0, sizeof(SCLogFGFilterFile)); if ( file != NULL && (fgf_file_temp->file = SCStrdup(file)) == NULL) { printf("Error Allocating memory\n"); exit(EXIT_FAILURE); } if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFFileList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { printf("Error Allocating memory\n"); exit(EXIT_FAILURE); } if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFFileList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); fgf_line_temp->line = line; /* add to the lists */ fgf_func_temp->line = fgf_line_temp; fgf_file_temp->func = fgf_func_temp; if (fgf_file == NULL) sc_log_fg_filters[listtype] = fgf_file_temp; else fgf_file->next = fgf_file_temp; return; } /** * \brief Helper function used internally to add a FG filter. This function is * called when the file component of the incoming filter has an entry * in the filter list, but the function component doesn't have an entry * for the corresponding file component * * \param fgf_file The file component from the filter list to which the new * filter has to be added * \param fgf_func The function component(basically the position in the list), * from the filter list, after which the new filter has to be * added * \param function Function_name of the filter * \param line Line number of the filter */ void SCLogAddToFGFFuncList(SCLogFGFilterFile *fgf_file, SCLogFGFilterFunc *fgf_func, const char *function, int line) { SCLogFGFilterFunc *fgf_func_temp = NULL; SCLogFGFilterLine *fgf_line_temp = NULL; if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFFuncList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc)); if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) { printf("Error Allocating memory\n"); exit(EXIT_FAILURE); } if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFFuncList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); fgf_line_temp->line = line; /* add to the lists */ fgf_func_temp->line = fgf_line_temp; if (fgf_func == NULL) fgf_file->func = fgf_func_temp; else fgf_func->next = fgf_func_temp; return; } /** * \brief Helper function used internally to add a FG filter. This function is * called when the file and function components of the incoming filter * have an entry in the filter list, but the line component doesn't have * an entry for the corresponding function component * * \param fgf_func The function component from the filter list to which the new * filter has to be added * \param fgf_line The function component(basically the position in the list), * from the filter list, after which the new filter has to be * added * \param line Line number of the filter */ void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func, SCLogFGFilterLine *fgf_line, int line) { SCLogFGFilterLine *fgf_line_temp = NULL; if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) { SCLogError(SC_ERR_FATAL, "Fatal error encountered in SCLogAddToFGFLineList. Exiting..."); exit(EXIT_FAILURE); } memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine)); fgf_line_temp->line = line; /* add to the lists */ if (fgf_line == NULL) fgf_func->line = fgf_line_temp; else fgf_line->next = fgf_line_temp; return; } /** * \brief Releases the memory alloted to a FD filter * * \param Pointer to the FD filter that has to be freed */ void SCLogReleaseFDFilter(SCLogFDFilter *fdf) { if (fdf != NULL) { if (fdf->func != NULL) SCFree(fdf->func); SCFree(fdf); } return; } suricata-3.2.1/src/detect.c0000644000000000000000000116336613051004444012435 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Basic detection engine */ #include "suricata-common.h" #include "suricata.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "flow-private.h" #include "flow-bit.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-profile.h" #include "detect-engine-alert.h" #include "detect-engine-siggroup.h" #include "detect-engine-address.h" #include "detect-engine-proto.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "detect-engine-iponly.h" #include "detect-engine-threshold.h" #include "detect-engine-prefilter.h" #include "detect-engine-payload.h" #include "detect-engine-dcepayload.h" #include "detect-engine-uri.h" #include "detect-dns-query.h" #include "detect-tls-sni.h" #include "detect-tls-cert-issuer.h" #include "detect-tls-cert-subject.h" #include "detect-engine-state.h" #include "detect-engine-analyzer.h" #include "detect-engine-filedata-smtp.h" #include "detect-http-cookie.h" #include "detect-http-method.h" #include "detect-http-ua.h" #include "detect-http-hh.h" #include "detect-http-hrh.h" #include "detect-engine-event.h" #include "decode.h" #include "detect-base64-decode.h" #include "detect-base64-data.h" #include "detect-ipopts.h" #include "detect-flags.h" #include "detect-fragbits.h" #include "detect-fragoffset.h" #include "detect-gid.h" #include "detect-ack.h" #include "detect-seq.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-pcre.h" #include "detect-depth.h" #include "detect-nocase.h" #include "detect-rawbytes.h" #include "detect-bytetest.h" #include "detect-bytejump.h" #include "detect-sameip.h" #include "detect-l3proto.h" #include "detect-ipproto.h" #include "detect-within.h" #include "detect-distance.h" #include "detect-offset.h" #include "detect-sid.h" #include "detect-prefilter.h" #include "detect-priority.h" #include "detect-classtype.h" #include "detect-reference.h" #include "detect-tag.h" #include "detect-threshold.h" #include "detect-metadata.h" #include "detect-msg.h" #include "detect-rev.h" #include "detect-flow.h" #include "detect-window.h" #include "detect-ftpbounce.h" #include "detect-isdataat.h" #include "detect-id.h" #include "detect-rpc.h" #include "detect-asn1.h" #include "detect-filename.h" #include "detect-fileext.h" #include "detect-filestore.h" #include "detect-filemagic.h" #include "detect-filemd5.h" #include "detect-filesha1.h" #include "detect-filesha256.h" #include "detect-filesize.h" #include "detect-dsize.h" #include "detect-flowvar.h" #include "detect-flowint.h" #include "detect-pktvar.h" #include "detect-noalert.h" #include "detect-flowbits.h" #include "detect-hostbits.h" #include "detect-xbits.h" #include "detect-csum.h" #include "detect-stream_size.h" #include "detect-engine-sigorder.h" #include "detect-ttl.h" #include "detect-fast-pattern.h" #include "detect-itype.h" #include "detect-icode.h" #include "detect-icmp-id.h" #include "detect-icmp-seq.h" #include "detect-dce-iface.h" #include "detect-dce-opnum.h" #include "detect-dce-stub-data.h" #include "detect-urilen.h" #include "detect-detection-filter.h" #include "detect-http-client-body.h" #include "detect-http-server-body.h" #include "detect-http-header.h" #include "detect-http-raw-header.h" #include "detect-http-uri.h" #include "detect-http-raw-uri.h" #include "detect-http-stat-msg.h" #include "detect-http-request-line.h" #include "detect-http-response-line.h" #include "detect-engine-hcbd.h" #include "detect-engine-hsbd.h" #include "detect-engine-hhd.h" #include "detect-engine-hrhd.h" #include "detect-engine-hmd.h" #include "detect-engine-hcd.h" #include "detect-engine-hrud.h" #include "detect-engine-hsmd.h" #include "detect-engine-hscd.h" #include "detect-engine-hua.h" #include "detect-engine-hhhd.h" #include "detect-engine-hrhhd.h" #include "detect-byte-extract.h" #include "detect-file-data.h" #include "detect-pkt-data.h" #include "detect-replace.h" #include "detect-tos.h" #include "detect-app-layer-event.h" #include "detect-lua.h" #include "detect-iprep.h" #include "detect-geoip.h" #include "detect-app-layer-protocol.h" #include "detect-template.h" #include "detect-template-buffer.h" #include "detect-bypass.h" #include "util-rule-vars.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-htp.h" #include "app-layer-smtp.h" #include "app-layer-template.h" #include "detect-tls.h" #include "detect-tls-cert-validity.h" #include "detect-tls-version.h" #include "detect-ssh-proto-version.h" #include "detect-ssh-software-version.h" #include "detect-http-stat-code.h" #include "detect-ssl-version.h" #include "detect-ssl-state.h" #include "detect-modbus.h" #include "detect-cipservice.h" #include "detect-dnp3.h" #include "action-globals.h" #include "tm-threads.h" #include "pkt-var.h" #include "conf.h" #include "conf-yaml-loader.h" #include "stream-tcp.h" #include "stream-tcp-inline.h" #include "util-lua.h" #include "util-var-name.h" #include "util-classification-config.h" #include "util-print.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" #include "util-hashlist.h" #include "util-cuda.h" #include "util-privs.h" #include "util-profiling.h" #include "util-validate.h" #include "util-optimize.h" #include "util-path.h" #include "util-mpm-ac.h" #include "runmodes.h" #include extern int rule_reload; extern int engine_analysis; static int fp_engine_analysis_set = 0; static int rule_engine_analysis_set = 0; SigMatch *SigMatchAlloc(void); void DetectExitPrintStats(ThreadVars *tv, void *data); void DbgPrintSigs(DetectEngineCtx *, SigGroupHead *); void DbgPrintSigs2(DetectEngineCtx *, SigGroupHead *); static void PacketCreateMask(Packet *, SignatureMask *, uint16_t, int, StreamMsg *, int); /** * \brief Create the path if default-rule-path was specified * \param sig_file The name of the file * \retval str Pointer to the string path + sig_file */ char *DetectLoadCompleteSigPath(const DetectEngineCtx *de_ctx, char *sig_file) { char *defaultpath = NULL; char *path = NULL; char varname[128]; if (strlen(de_ctx->config_prefix) > 0) { snprintf(varname, sizeof(varname), "%s.default-rule-path", de_ctx->config_prefix); } else { snprintf(varname, sizeof(varname), "default-rule-path"); } /* Path not specified */ if (PathIsRelative(sig_file)) { if (ConfGet(varname, &defaultpath) == 1) { SCLogDebug("Default path: %s", defaultpath); size_t path_len = sizeof(char) * (strlen(defaultpath) + strlen(sig_file) + 2); path = SCMalloc(path_len); if (unlikely(path == NULL)) return NULL; strlcpy(path, defaultpath, path_len); #if defined OS_WIN32 || defined __CYGWIN__ if (path[strlen(path) - 1] != '\\') strlcat(path, "\\\\", path_len); #else if (path[strlen(path) - 1] != '/') strlcat(path, "/", path_len); #endif strlcat(path, sig_file, path_len); } else { path = SCStrdup(sig_file); if (unlikely(path == NULL)) return NULL; } } else { path = SCStrdup(sig_file); if (unlikely(path == NULL)) return NULL; } return path; } /** * \brief Load a file with signatures * \param de_ctx Pointer to the detection engine context * \param sig_file Filename to load signatures from * \param goodsigs_tot Will store number of valid signatures in the file * \param badsigs_tot Will store number of invalid signatures in the file * \retval 0 on success, -1 on error */ static int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file, int *goodsigs, int *badsigs) { Signature *sig = NULL; int good = 0, bad = 0; char line[DETECT_MAX_RULE_SIZE] = ""; size_t offset = 0; int lineno = 0, multiline = 0; (*goodsigs) = 0; (*badsigs) = 0; FILE *fp = fopen(sig_file, "r"); if (fp == NULL) { SCLogError(SC_ERR_OPENING_RULE_FILE, "opening rule file %s:" " %s.", sig_file, strerror(errno)); return -1; } while(fgets(line + offset, (int)sizeof(line) - offset, fp) != NULL) { lineno++; size_t len = strlen(line); /* ignore comments and empty lines */ if (line[0] == '\n' || line [0] == '\r' || line[0] == ' ' || line[0] == '#' || line[0] == '\t') continue; /* Check for multiline rules. */ while (len > 0 && isspace((unsigned char)line[--len])); if (line[len] == '\\') { multiline++; offset = len; if (offset < sizeof(line) - 1) { /* We have room for more. */ continue; } /* No more room in line buffer, continue, rule will fail * to parse. */ } /* Check if we have a trailing newline, and remove it */ len = strlen(line); if (len > 0 && (line[len - 1] == '\n' || line[len - 1] == '\r')) { line[len - 1] = '\0'; } /* Reset offset. */ offset = 0; de_ctx->rule_file = sig_file; de_ctx->rule_line = lineno - multiline; sig = DetectEngineAppendSig(de_ctx, line); if (sig != NULL) { if (rule_engine_analysis_set || fp_engine_analysis_set) { RetrieveFPForSig(sig); if (fp_engine_analysis_set) { EngineAnalysisFP(sig, line); } if (rule_engine_analysis_set) { EngineAnalysisRules(sig, line); } } SCLogDebug("signature %"PRIu32" loaded", sig->id); good++; } else { SCLogError(SC_ERR_INVALID_SIGNATURE, "error parsing signature \"%s\" from " "file %s at line %"PRId32"", line, sig_file, lineno - multiline); if (rule_engine_analysis_set) { EngineAnalysisRulesFailure(line, sig_file, lineno - multiline); } bad++; } multiline = 0; } fclose(fp); *goodsigs = good; *badsigs = bad; return 0; } /** * \brief Expands wildcards and reads signatures from each matching file * \param de_ctx Pointer to the detection engine context * \param sig_file Filename (or pattern) holding signatures * \retval -1 on error */ static int ProcessSigFiles(DetectEngineCtx *de_ctx, char *pattern, SigFileLoaderStat *st, int *good_sigs, int *bad_sigs) { if (pattern == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "opening rule file null"); return -1; } glob_t files; int r = glob(pattern, 0, NULL, &files); if (r == GLOB_NOMATCH) { SCLogWarning(SC_ERR_NO_RULES, "No rule files match the pattern %s", pattern); ++(st->bad_files); ++(st->total_files); return -1; } else if (r != 0) { SCLogError(SC_ERR_OPENING_RULE_FILE, "error expanding template %s: %s", pattern, strerror(errno)); return -1; } for (size_t i = 0; i < (size_t)files.gl_pathc; i++) { char *fname = files.gl_pathv[i]; if (strcmp("/dev/null", fname) == 0) continue; SCLogConfig("Loading rule file: %s", fname); r = DetectLoadSigFile(de_ctx, fname, good_sigs, bad_sigs); if (r < 0) { ++(st->bad_files); } ++(st->total_files); st->good_sigs_total += *good_sigs; st->bad_sigs_total += *bad_sigs; } globfree(&files); return r; } /** * \brief Load signatures * \param de_ctx Pointer to the detection engine context * \param sig_file Filename (or pattern) holding signatures * \param sig_file_exclusive File passed in 'sig_file' should be loaded exclusively. * \retval -1 on error */ int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_exclusive) { SCEnter(); ConfNode *rule_files; ConfNode *file = NULL; SigFileLoaderStat sig_stat; int ret = 0; char *sfile = NULL; char varname[128] = "rule-files"; int good_sigs = 0; int bad_sigs = 0; memset(&sig_stat, 0, sizeof(SigFileLoaderStat)); if (strlen(de_ctx->config_prefix) > 0) { snprintf(varname, sizeof(varname), "%s.rule-files", de_ctx->config_prefix); } if (RunmodeGetCurrent() == RUNMODE_ENGINE_ANALYSIS) { fp_engine_analysis_set = SetupFPAnalyzer(); rule_engine_analysis_set = SetupRuleAnalyzer(); } /* ok, let's load signature files from the general config */ if (!(sig_file != NULL && sig_file_exclusive == TRUE)) { rule_files = ConfGetNode(varname); if (rule_files != NULL) { if (!ConfNodeIsSequence(rule_files)) { SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid rule-files configuration section: " "expected a list of filenames."); } else { TAILQ_FOREACH(file, &rule_files->head, next) { sfile = DetectLoadCompleteSigPath(de_ctx, file->val); good_sigs = bad_sigs = 0; ret = ProcessSigFiles(de_ctx, sfile, &sig_stat, &good_sigs, &bad_sigs); SCFree(sfile); if (ret != 0 || good_sigs == 0) { if (de_ctx->failure_fatal == 1) { exit(EXIT_FAILURE); } } } } } } /* If a Signature file is specified from commandline, parse it too */ if (sig_file != NULL) { ret = ProcessSigFiles(de_ctx, sig_file, &sig_stat, &good_sigs, &bad_sigs); if (ret != 0) { if (de_ctx->failure_fatal == 1) { exit(EXIT_FAILURE); } } if (good_sigs == 0) { SCLogConfig("No rules loaded from %s", sig_file); } } /* now we should have signatures to work with */ if (sig_stat.good_sigs_total <= 0) { if (sig_stat.total_files > 0) { SCLogWarning(SC_ERR_NO_RULES_LOADED, "%d rule files specified, but no rule was loaded at all!", sig_stat.total_files); } else { SCLogInfo("No signatures supplied."); goto end; } } else { /* we report the total of files and rules successfully loaded and failed */ SCLogInfo("%" PRId32 " rule files processed. %" PRId32 " rules successfully loaded, %" PRId32 " rules failed", sig_stat.total_files, sig_stat.good_sigs_total, sig_stat.bad_sigs_total); } if ((sig_stat.bad_sigs_total || sig_stat.bad_files) && de_ctx->failure_fatal) { ret = -1; goto end; } SCSigRegisterSignatureOrderingFuncs(de_ctx); SCSigOrderSignatures(de_ctx); SCSigSignatureOrderingModuleCleanup(de_ctx); /* Setup the signature group lookup structure and pattern matchers */ if (SigGroupBuild(de_ctx) < 0) goto end; ret = 0; end: if (RunmodeGetCurrent() == RUNMODE_ENGINE_ANALYSIS) { if (rule_engine_analysis_set) { CleanupRuleAnalyzer(); } if (fp_engine_analysis_set) { CleanupFPAnalyzer(); } } DetectParseDupSigHashFree(de_ctx); SCReturnInt(ret); } int SigMatchSignaturesRunPostMatch(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s) { /* run the packet match functions */ if (s->sm_arrays[DETECT_SM_LIST_POSTMATCH] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_POSTMATCH); SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_POSTMATCH]; SCLogDebug("running match functions, sm %p", smd); if (smd != NULL) { while (1) { KEYWORD_PROFILING_START; (void)sigmatch_table[smd->type].Match(tv, det_ctx, p, s, smd->ctx); KEYWORD_PROFILING_END(det_ctx, smd->type, 1); if (smd->is_last) break; smd++; } } } DetectReplaceExecute(p, det_ctx); if (s->flags & SIG_FLAG_FILESTORE) DetectFilestorePostMatch(tv, det_ctx, p, s); return 1; } /** * \brief Get the SigGroupHead for a packet. * * \param de_ctx detection engine context * \param det_ctx thread detection engine content * \param p packet * * \retval sgh the SigGroupHead or NULL if non applies to the packet */ SigGroupHead *SigMatchSignaturesGetSgh(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { SCEnter(); int f; SigGroupHead *sgh = NULL; /* if the packet proto is 0 (not set), we're inspecting it against * the decoder events sgh we have. */ if (p->proto == 0 && p->events.cnt > 0) { SCReturnPtr(de_ctx->decoder_event_sgh, "SigGroupHead"); } else if (p->proto == 0) { if (!(PKT_IS_IPV4(p) || PKT_IS_IPV6(p))) { /* not IP, so nothing to do */ SCReturnPtr(NULL, "SigGroupHead"); } } /* select the flow_gh */ if (p->flowflags & FLOW_PKT_TOCLIENT) f = 0; else f = 1; int proto = IP_GET_IPPROTO(p); if (proto == IPPROTO_TCP) { DetectPort *list = de_ctx->flow_gh[f].tcp; SCLogDebug("tcp toserver %p, tcp toclient %p: going to use %p", de_ctx->flow_gh[1].tcp, de_ctx->flow_gh[0].tcp, de_ctx->flow_gh[f].tcp); uint16_t port = f ? p->dp : p->sp; SCLogDebug("tcp port %u -> %u:%u", port, p->sp, p->dp); DetectPort *sghport = DetectPortLookupGroup(list, port); if (sghport != NULL) sgh = sghport->sh; SCLogDebug("TCP list %p, port %u, direction %s, sghport %p, sgh %p", list, port, f ? "toserver" : "toclient", sghport, sgh); } else if (proto == IPPROTO_UDP) { DetectPort *list = de_ctx->flow_gh[f].udp; uint16_t port = f ? p->dp : p->sp; DetectPort *sghport = DetectPortLookupGroup(list, port); if (sghport != NULL) sgh = sghport->sh; SCLogDebug("UDP list %p, port %u, direction %s, sghport %p, sgh %p", list, port, f ? "toserver" : "toclient", sghport, sgh); } else { sgh = de_ctx->flow_gh[f].sgh[proto]; } SCReturnPtr(sgh, "SigGroupHead"); } /** \brief Get the smsgs relevant to this packet * * \param f LOCKED flow * \param p packet * \param flags stream flags */ static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags) { SCEnter(); DEBUG_ASSERT_FLOW_LOCKED(f); StreamMsg *smsg = NULL; if (p->proto == IPPROTO_TCP && f->protoctx != NULL && (p->flags & PKT_STREAM_EST)) { TcpSession *ssn = (TcpSession *)f->protoctx; /* at stream eof, or in inline mode, inspect all smsg's */ if ((flags & STREAM_EOF) || StreamTcpInlineMode()) { if (p->flowflags & FLOW_PKT_TOSERVER) { smsg = ssn->toserver_smsg_head; /* deref from the ssn */ ssn->toserver_smsg_head = NULL; ssn->toserver_smsg_tail = NULL; SCLogDebug("to_server smsg %p at stream eof", smsg); } else { smsg = ssn->toclient_smsg_head; /* deref from the ssn */ ssn->toclient_smsg_head = NULL; ssn->toclient_smsg_tail = NULL; SCLogDebug("to_client smsg %p at stream eof", smsg); } } else { if (p->flowflags & FLOW_PKT_TOSERVER) { StreamMsg *head = ssn->toserver_smsg_head; if (unlikely(head == NULL)) { SCLogDebug("no smsgs in to_server direction"); goto end; } /* if the smsg is bigger than the current packet, we will * process the smsg in a later run */ if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) { SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32, (head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len)); goto end; } smsg = head; /* deref from the ssn */ ssn->toserver_smsg_head = NULL; ssn->toserver_smsg_tail = NULL; SCLogDebug("to_server smsg %p", smsg); } else { StreamMsg *head = ssn->toclient_smsg_head; if (unlikely(head == NULL)) goto end; /* if the smsg is bigger than the current packet, we will * process the smsg in a later run */ if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) { SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32, (head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len)); goto end; } smsg = head; /* deref from the ssn */ ssn->toclient_smsg_head = NULL; ssn->toclient_smsg_tail = NULL; SCLogDebug("to_client smsg %p", smsg); } } } end: SCReturnPtr(smsg, "StreamMsg"); } static inline void DetectPrefilterMergeSort(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx) { SigIntId mpm, nonmpm; det_ctx->match_array_cnt = 0; SigIntId *mpm_ptr = det_ctx->pmq.rule_id_array; SigIntId *nonmpm_ptr = det_ctx->non_pf_id_array; uint32_t m_cnt = det_ctx->pmq.rule_id_array_cnt; uint32_t n_cnt = det_ctx->non_pf_id_cnt; SigIntId *final_ptr; uint32_t final_cnt; SigIntId id; SigIntId previous_id = (SigIntId)-1; Signature **sig_array = de_ctx->sig_array; Signature **match_array = det_ctx->match_array; Signature *s; SCLogDebug("PMQ rule id array count %d", det_ctx->pmq.rule_id_array_cnt); /* Load first values. */ if (likely(m_cnt)) { mpm = *mpm_ptr; } else { /* mpm list is empty */ final_ptr = nonmpm_ptr; final_cnt = n_cnt; goto final; } if (likely(n_cnt)) { nonmpm = *nonmpm_ptr; } else { /* non-mpm list is empty. */ final_ptr = mpm_ptr; final_cnt = m_cnt; goto final; } while (1) { if (mpm < nonmpm) { /* Take from mpm list */ id = mpm; s = sig_array[id]; /* As the mpm list can contain duplicates, check for that here. */ if (likely(id != previous_id)) { *match_array++ = s; previous_id = id; } if (unlikely(--m_cnt == 0)) { /* mpm list is now empty */ final_ptr = nonmpm_ptr; final_cnt = n_cnt; goto final; } mpm_ptr++; mpm = *mpm_ptr; } else if (mpm > nonmpm) { id = nonmpm; s = sig_array[id]; /* As the mpm list can contain duplicates, check for that here. */ if (likely(id != previous_id)) { *match_array++ = s; previous_id = id; } if (unlikely(--n_cnt == 0)) { final_ptr = mpm_ptr; final_cnt = m_cnt; goto final; } nonmpm_ptr++; nonmpm = *nonmpm_ptr; } else { /* implied mpm == nonmpm */ /* special case: if on both lists, it's a negated mpm pattern */ /* mpm list may have dups, so skip past them here */ while (--m_cnt != 0) { mpm_ptr++; mpm = *mpm_ptr; if (mpm != nonmpm) break; } /* if mpm is done, update nonmpm_ptrs and jump to final */ if (unlikely(m_cnt == 0)) { n_cnt--; /* mpm list is now empty */ final_ptr = ++nonmpm_ptr; final_cnt = n_cnt; goto final; } /* otherwise, if nonmpm is done jump to final for mpm * mpm ptrs alrady updated */ if (unlikely(--n_cnt == 0)) { final_ptr = mpm_ptr; final_cnt = m_cnt; goto final; } /* not at end of the lists, update nonmpm. Mpm already * updated in while loop above. */ nonmpm_ptr++; nonmpm = *nonmpm_ptr; } } final: /* Only one list remaining. Just walk that list. */ while (final_cnt-- > 0) { id = *final_ptr++; s = sig_array[id]; /* As the mpm list can contain duplicates, check for that here. */ if (likely(id != previous_id)) { *match_array++ = s; previous_id = id; } } det_ctx->match_array_cnt = match_array - det_ctx->match_array; BUG_ON((det_ctx->pmq.rule_id_array_cnt + det_ctx->non_pf_id_cnt) < det_ctx->match_array_cnt); } #define SMS_USE_FLOW_SGH 0x01 #define SMS_USED_PM 0x02 #ifdef DEBUG static void DebugInspectIds(Packet *p, Flow *f, StreamMsg *smsg) { SCLogDebug("pcap_cnt %02"PRIu64", %s, %12s, smsg %s", p->pcap_cnt, p->flowflags & FLOW_PKT_TOSERVER ? "toserver" : "toclient", p->flags & PKT_STREAM_EST ? "established" : "stateless", smsg ? "yes" : "no"); AppLayerParserStatePrintDetails(f->alparser); } #endif static void AlertDebugLogModeSyncFlowbitsNamesToPacketStruct(Packet *p, DetectEngineCtx *de_ctx) { #define MALLOC_JUMP 5 int i = 0; GenericVar *gv = p->flow->flowvar; while (gv != NULL) { i++; gv = gv->next; } if (i == 0) return; p->debuglog_flowbits_names_len = i; p->debuglog_flowbits_names = SCMalloc(sizeof(char *) * p->debuglog_flowbits_names_len); if (p->debuglog_flowbits_names == NULL) { return; } memset(p->debuglog_flowbits_names, 0, sizeof(char *) * p->debuglog_flowbits_names_len); i = 0; gv = p->flow->flowvar; while (gv != NULL) { if (gv->type != DETECT_FLOWBITS) { gv = gv->next; continue; } FlowBit *fb = (FlowBit *) gv; const char *name = VariableIdxGetName(de_ctx, fb->idx, VAR_TYPE_FLOW_BIT); if (name != NULL) { p->debuglog_flowbits_names[i] = SCStrdup(name); if (p->debuglog_flowbits_names[i] == NULL) { return; } i++; } if (i == p->debuglog_flowbits_names_len) { p->debuglog_flowbits_names_len += MALLOC_JUMP; const char **names = SCRealloc(p->debuglog_flowbits_names, sizeof(char *) * p->debuglog_flowbits_names_len); if (names == NULL) { SCFree(p->debuglog_flowbits_names); p->debuglog_flowbits_names = NULL; p->debuglog_flowbits_names_len = 0; return; } p->debuglog_flowbits_names = names; memset(p->debuglog_flowbits_names + p->debuglog_flowbits_names_len - MALLOC_JUMP, 0, sizeof(char *) * MALLOC_JUMP); } gv = gv->next; } return; } static inline void DetectPrefilterBuildNonPrefilterList(DetectEngineThreadCtx *det_ctx, SignatureMask mask) { uint32_t x = 0; for (x = 0; x < det_ctx->non_pf_store_cnt; x++) { /* only if the mask matches this rule can possibly match, * so build the non_mpm array only for match candidates */ SignatureMask rule_mask = det_ctx->non_pf_store_ptr[x].mask; if ((rule_mask & mask) == rule_mask) { det_ctx->non_pf_id_array[det_ctx->non_pf_id_cnt++] = det_ctx->non_pf_store_ptr[x].id; } } } /** \internal * \brief select non-mpm list * Based on the packet properties, select the non-mpm list to use */ static inline void DetectPrefilterSetNonPrefilterList(const Packet *p, DetectEngineThreadCtx *det_ctx) { if ((p->proto == IPPROTO_TCP) && (p->tcph != NULL) && (p->tcph->th_flags & TH_SYN)) { det_ctx->non_pf_store_ptr = det_ctx->sgh->non_pf_syn_store_array; det_ctx->non_pf_store_cnt = det_ctx->sgh->non_pf_syn_store_cnt; } else { det_ctx->non_pf_store_ptr = det_ctx->sgh->non_pf_other_store_array; det_ctx->non_pf_store_cnt = det_ctx->sgh->non_pf_other_store_cnt; } SCLogDebug("sgh non_pf ptr %p cnt %u (syn %p/%u, other %p/%u)", det_ctx->non_pf_store_ptr, det_ctx->non_pf_store_cnt, det_ctx->sgh->non_pf_syn_store_array, det_ctx->sgh->non_pf_syn_store_cnt, det_ctx->sgh->non_pf_other_store_array, det_ctx->sgh->non_pf_other_store_cnt); } /** \internal * \brief update flow's file tracking flags based on the detection engine */ static inline void DetectPostInspectFileFlagsUpdate(Flow *pflow, const SigGroupHead *sgh, uint8_t direction) { /* see if this sgh requires us to consider file storing */ if (sgh == NULL || sgh->filestore_cnt == 0) { FileDisableStoring(pflow, direction); } #ifdef HAVE_MAGIC /* see if this sgh requires us to consider file magic */ if (!FileForceMagic() && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC))) { SCLogDebug("disabling magic for flow"); FileDisableMagic(pflow, direction); } #endif /* see if this sgh requires us to consider file md5 */ if (!FileForceMd5() && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVEFILEMD5))) { SCLogDebug("disabling md5 for flow"); FileDisableMd5(pflow, direction); } /* see if this sgh requires us to consider file sha1 */ if (!FileForceSha1() && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA1))) { SCLogDebug("disabling sha1 for flow"); FileDisableSha1(pflow, direction); } /* see if this sgh requires us to consider file sha256 */ if (!FileForceSha256() && (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVEFILESHA256))) { SCLogDebug("disabling sha256 for flow"); FileDisableSha256(pflow, direction); } /* see if this sgh requires us to consider filesize */ if (sgh == NULL || !(sgh->flags & SIG_GROUP_HEAD_HAVEFILESIZE)) { SCLogDebug("disabling filesize for flow"); FileDisableFilesize(pflow, direction); } } static inline void DetectPostInspectFirstSGH(const Packet *p, Flow *pflow, const SigGroupHead *sgh) { if ((p->flowflags & FLOW_PKT_TOSERVER) && !(pflow->flags & FLOW_SGH_TOSERVER)) { /* first time we see this toserver sgh, store it */ pflow->sgh_toserver = sgh; pflow->flags |= FLOW_SGH_TOSERVER; DetectPostInspectFileFlagsUpdate(pflow, pflow->sgh_toserver, STREAM_TOSERVER); } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && !(pflow->flags & FLOW_SGH_TOCLIENT)) { pflow->sgh_toclient = sgh; pflow->flags |= FLOW_SGH_TOCLIENT; DetectPostInspectFileFlagsUpdate(pflow, pflow->sgh_toclient, STREAM_TOCLIENT); } } /** * \brief Signature match function * * \retval 1 one or more signatures matched * \retval 0 no matches were found */ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { uint8_t sms_runflags = 0; /* function flags */ uint8_t alert_flags = 0; AppProto alproto = ALPROTO_UNKNOWN; #ifdef PROFILING int smatch = 0; /* signature match: 1, no match: 0 */ #endif uint8_t flow_flags = 0; /* flow/state flags */ Signature *s = NULL; Signature *next_s = NULL; uint8_t alversion = 0; int state_alert = 0; int alerts = 0; int app_decoder_events = 0; int has_state = 0; /* do we have an alstate to work with? */ SCEnter(); SCLogDebug("pcap_cnt %"PRIu64, p->pcap_cnt); p->alerts.cnt = 0; det_ctx->filestore_cnt = 0; det_ctx->smsg = NULL; det_ctx->base64_decoded_len = 0; /* No need to perform any detection on this packet, if the the given flag is set.*/ if (p->flags & PKT_NOPACKET_INSPECTION) { SCReturnInt(0); } /* Load the Packet's flow early, even though it might not be needed. * Mark as a constant pointer, although the flow can change. */ Flow * const pflow = p->flow; /* grab the protocol state we will detect on */ if (p->flags & PKT_HAS_FLOW) { if (p->flowflags & FLOW_PKT_TOSERVER) { flow_flags = STREAM_TOSERVER; SCLogDebug("flag STREAM_TOSERVER set"); } else if (p->flowflags & FLOW_PKT_TOCLIENT) { flow_flags = STREAM_TOCLIENT; SCLogDebug("flag STREAM_TOCLIENT set"); } SCLogDebug("p->flowflags 0x%02x", p->flowflags); if (p->flags & PKT_STREAM_EOF) { flow_flags |= STREAM_EOF; SCLogDebug("STREAM_EOF set"); } { /* store tenant_id in the flow so that we can use it * for creating pseudo packets */ if (p->tenant_id > 0 && pflow->tenant_id == 0) { pflow->tenant_id = p->tenant_id; } /* live ruleswap check for flow updates */ if (pflow->de_ctx_id == 0) { /* first time this flow is inspected, set id */ pflow->de_ctx_id = de_ctx->id; } else if (pflow->de_ctx_id != de_ctx->id) { /* first time we inspect flow with this de_ctx, reset */ pflow->flags &= ~FLOW_SGH_TOSERVER; pflow->flags &= ~FLOW_SGH_TOCLIENT; pflow->sgh_toserver = NULL; pflow->sgh_toclient = NULL; pflow->de_ctx_id = de_ctx->id; GenericVarFree(pflow->flowvar); pflow->flowvar = NULL; DetectEngineStateReset(pflow->de_state, (STREAM_TOSERVER|STREAM_TOCLIENT)); DetectEngineStateResetTxs(pflow); } /* set the iponly stuff */ if (pflow->flags & FLOW_TOCLIENT_IPONLY_SET) p->flowflags |= FLOW_PKT_TOCLIENT_IPONLY_SET; if (pflow->flags & FLOW_TOSERVER_IPONLY_SET) p->flowflags |= FLOW_PKT_TOSERVER_IPONLY_SET; /* Get the stored sgh from the flow (if any). Make sure we're not using * the sgh for icmp error packets part of the same stream. */ if (IP_GET_IPPROTO(p) == pflow->proto) { /* filter out icmp */ PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH); if ((p->flowflags & FLOW_PKT_TOSERVER) && (pflow->flags & FLOW_SGH_TOSERVER)) { det_ctx->sgh = pflow->sgh_toserver; SCLogDebug("det_ctx->sgh = pflow->sgh_toserver; => %p", det_ctx->sgh); sms_runflags |= SMS_USE_FLOW_SGH; } else if ((p->flowflags & FLOW_PKT_TOCLIENT) && (pflow->flags & FLOW_SGH_TOCLIENT)) { det_ctx->sgh = pflow->sgh_toclient; SCLogDebug("det_ctx->sgh = pflow->sgh_toclient; => %p", det_ctx->sgh); sms_runflags |= SMS_USE_FLOW_SGH; } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH); det_ctx->smsg = SigMatchSignaturesGetSmsg(pflow, p, flow_flags); #if 0 StreamMsg *tmpsmsg = smsg; while (tmpsmsg) { printf("detect ---start---:\n"); PrintRawDataFp(stdout,tmpsmsg->data.data,tmpsmsg->data.data_len); printf("detect ---end---:\n"); tmpsmsg = tmpsmsg->next; } #endif } /* Retrieve the app layer state and protocol and the tcp reassembled * stream chunks. */ if ((p->proto == IPPROTO_TCP && (p->flags & PKT_STREAM_EST)) || (p->proto == IPPROTO_UDP) || (p->proto == IPPROTO_SCTP && (p->flowflags & FLOW_PKT_ESTABLISHED))) { /* update flow flags with knowledge on disruptions */ flow_flags = FlowGetDisruptionFlags(pflow, flow_flags); has_state = (FlowGetAppState(pflow) != NULL); alproto = FlowGetAppProtocol(pflow); alversion = AppLayerParserGetStateVersion(pflow->alparser); SCLogDebug("alstate %s, alproto %u", has_state ? "true" : "false", alproto); } else { SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto); } app_decoder_events = AppLayerParserHasDecoderEvents(pflow->proto, pflow->alproto, pflow->alstate, pflow->alparser, flow_flags); } if (((p->flowflags & FLOW_PKT_TOSERVER) && !(p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) || ((p->flowflags & FLOW_PKT_TOCLIENT) && !(p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET))) { SCLogDebug("testing against \"ip-only\" signatures"); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY); IPOnlyMatchPacket(th_v, de_ctx, det_ctx, &de_ctx->io_ctx, &det_ctx->io_ctx, p); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY); /* save in the flow that we scanned this direction... */ FlowSetIPOnlyFlag(pflow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0); } else if (((p->flowflags & FLOW_PKT_TOSERVER) && (pflow->flags & FLOW_TOSERVER_IPONLY_SET)) || ((p->flowflags & FLOW_PKT_TOCLIENT) && (pflow->flags & FLOW_TOCLIENT_IPONLY_SET))) { /* If we have a drop from IP only module, * we will drop the rest of the flow packets * This will apply only to inline/IPS */ if (pflow->flags & FLOW_ACTION_DROP) { alert_flags = PACKET_ALERT_FLAG_DROP_FLOW; PACKET_DROP(p); } } if (!(sms_runflags & SMS_USE_FLOW_SGH)) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH); det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH); } #ifdef DEBUG if (pflow) { DebugInspectIds(p, pflow, det_ctx->smsg); } #endif } else { /* p->flags & PKT_HAS_FLOW */ /* no flow */ /* Even without flow we should match the packet src/dst */ PACKET_PROFILING_DETECT_START(p, PROF_DETECT_IPONLY); IPOnlyMatchPacket(th_v, de_ctx, det_ctx, &de_ctx->io_ctx, &det_ctx->io_ctx, p); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_IPONLY); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_GETSGH); det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH); } /* if we didn't get a sig group head, we * have nothing to do.... */ if (det_ctx->sgh == NULL) { SCLogDebug("no sgh for this packet, nothing to match against"); goto end; } DetectPrefilterSetNonPrefilterList(p, det_ctx); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL); /* stateful app layer detection */ if ((p->flags & PKT_HAS_FLOW) && has_state) { memset(det_ctx->de_state_sig_array, 0x00, det_ctx->de_state_sig_array_len); int has_inspectable_state = DeStateFlowHasInspectableState(pflow, alproto, alversion, flow_flags); if (has_inspectable_state == 1) { /* initialize to 0(DE_STATE_MATCH_HAS_NEW_STATE) */ DeStateDetectContinueDetection(th_v, de_ctx, det_ctx, p, pflow, flow_flags, alproto, alversion); } else if (has_inspectable_state == 2) { /* no inspectable state, so pretend we don't have a state at all */ has_state = 0; } } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL); /* create our prefilter mask */ SignatureMask mask = 0; PacketCreateMask(p, &mask, alproto, has_state, det_ctx->smsg, app_decoder_events); /* build and prefilter non_pf list against the mask of the packet */ PACKET_PROFILING_DETECT_START(p, PROF_DETECT_NONMPMLIST); det_ctx->non_pf_id_cnt = 0; if (likely(det_ctx->non_pf_store_cnt > 0)) { DetectPrefilterBuildNonPrefilterList(det_ctx, mask); } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_NONMPMLIST); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PREFILTER); /* run the prefilter engines */ Prefilter(det_ctx, det_ctx->sgh, p, flow_flags, has_state); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2); DetectPrefilterMergeSort(de_ctx, det_ctx); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PREFILTER); #ifdef PROFILING if (th_v) { StatsAddUI64(th_v, det_ctx->counter_mpm_list, (uint64_t)det_ctx->pmq.rule_id_array_cnt); StatsAddUI64(th_v, det_ctx->counter_nonmpm_list, (uint64_t)det_ctx->non_pf_store_cnt); /* non mpm sigs after mask prefilter */ StatsAddUI64(th_v, det_ctx->counter_fnonmpm_list, (uint64_t)det_ctx->non_pf_id_cnt); } #endif PACKET_PROFILING_DETECT_START(p, PROF_DETECT_RULES); /* inspect the sigs against the packet */ /* Prefetch the next signature. */ SigIntId match_cnt = det_ctx->match_array_cnt; #ifdef PROFILING if (th_v) { StatsAddUI64(th_v, det_ctx->counter_match_list, (uint64_t)match_cnt); } #endif Signature **match_array = det_ctx->match_array; SGH_PROFILING_RECORD(det_ctx, det_ctx->sgh); #ifdef PROFILING #ifdef HAVE_LIBJANSSON if (match_cnt >= de_ctx->profile_match_logging_threshold) RulesDumpMatchArray(det_ctx, p); #endif #endif uint32_t sflags, next_sflags = 0; if (match_cnt) { next_s = *match_array++; next_sflags = next_s->flags; } while (match_cnt--) { RULE_PROFILING_START(p); state_alert = 0; #ifdef PROFILING smatch = 0; #endif s = next_s; sflags = next_sflags; if (match_cnt) { next_s = *match_array++; next_sflags = next_s->flags; } uint8_t s_proto_flags = s->proto.flags; SCLogDebug("inspecting signature id %"PRIu32"", s->id); if ((s->mask & mask) != s->mask) goto next; /* if the sig has alproto and the session as well they should match */ if (likely(sflags & SIG_FLAG_APPLAYER)) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != alproto) { if (s->alproto == ALPROTO_DCERPC) { if (alproto != ALPROTO_SMB && alproto != ALPROTO_SMB2) { SCLogDebug("DCERPC sig, alproto not SMB or SMB2"); goto next; } } else { SCLogDebug("alproto mismatch"); goto next; } } } if (unlikely(sflags & SIG_FLAG_DSIZE)) { if (likely(p->payload_len < s->dsize_low || p->payload_len > s->dsize_high)) { SCLogDebug("kicked out as p->payload_len %u, dsize low %u, hi %u", p->payload_len, s->dsize_low, s->dsize_high); goto next; } } if (sflags & SIG_FLAG_STATE_MATCH) { if (det_ctx->de_state_sig_array[s->num] & DE_STATE_MATCH_NO_NEW_STATE) goto next; } /* check if this signature has a requirement for flowvars of some type * and if so, if we actually have any in the flow. If not, the sig * can't match and we skip it. */ if ((p->flags & PKT_HAS_FLOW) && (sflags & SIG_FLAG_REQUIRE_FLOWVAR)) { int m = pflow->flowvar ? 1 : 0; /* no flowvars? skip this sig */ if (m == 0) { SCLogDebug("skipping sig as the flow has no flowvars and sig " "has SIG_FLAG_REQUIRE_FLOWVAR flag set."); goto next; } } if ((s_proto_flags & DETECT_PROTO_IPV4) && !PKT_IS_IPV4(p)) { SCLogDebug("ip version didn't match"); goto next; } if ((s_proto_flags & DETECT_PROTO_IPV6) && !PKT_IS_IPV6(p)) { SCLogDebug("ip version didn't match"); goto next; } if (DetectProtoContainsProto(&s->proto, IP_GET_IPPROTO(p)) == 0) { SCLogDebug("proto didn't match"); goto next; } /* check the source & dst port in the sig */ if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP || p->proto == IPPROTO_SCTP) { if (!(sflags & SIG_FLAG_DP_ANY)) { if (p->flags & PKT_IS_FRAGMENT) goto next; DetectPort *dport = DetectPortLookupGroup(s->dp,p->dp); if (dport == NULL) { SCLogDebug("dport didn't match."); goto next; } } if (!(sflags & SIG_FLAG_SP_ANY)) { if (p->flags & PKT_IS_FRAGMENT) goto next; DetectPort *sport = DetectPortLookupGroup(s->sp,p->sp); if (sport == NULL) { SCLogDebug("sport didn't match."); goto next; } } } else if ((sflags & (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) != (SIG_FLAG_DP_ANY|SIG_FLAG_SP_ANY)) { SCLogDebug("port-less protocol and sig needs ports"); goto next; } /* check the destination address */ if (!(sflags & SIG_FLAG_DST_ANY)) { if (PKT_IS_IPV4(p)) { if (DetectAddressMatchIPv4(s->addr_dst_match4, s->addr_dst_match4_cnt, &p->dst) == 0) goto next; } else if (PKT_IS_IPV6(p)) { if (DetectAddressMatchIPv6(s->addr_dst_match6, s->addr_dst_match6_cnt, &p->dst) == 0) goto next; } } /* check the source address */ if (!(sflags & SIG_FLAG_SRC_ANY)) { if (PKT_IS_IPV4(p)) { if (DetectAddressMatchIPv4(s->addr_src_match4, s->addr_src_match4_cnt, &p->src) == 0) goto next; } else if (PKT_IS_IPV6(p)) { if (DetectAddressMatchIPv6(s->addr_src_match6, s->addr_src_match6_cnt, &p->src) == 0) goto next; } } /* Check the payload keywords. If we are a MPM sig and we've made * to here, we've had at least one of the patterns match */ if (s->sm_arrays[DETECT_SM_LIST_PMATCH] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_PMATCH); /* if we have stream msgs, inspect against those first, * but not for a "dsize" signature */ if (sflags & SIG_FLAG_REQUIRE_STREAM) { char pmatch = 0; if (det_ctx->smsg != NULL) { uint8_t pmq_idx = 0; StreamMsg *smsg_inspect = det_ctx->smsg; for ( ; smsg_inspect != NULL; smsg_inspect = smsg_inspect->next, pmq_idx++) { if (DetectEngineInspectStreamPayload(de_ctx, det_ctx, s, pflow, smsg_inspect->data, smsg_inspect->data_len) == 1) { SCLogDebug("match in smsg %p", smsg_inspect); pmatch = 1; det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH; /* Tell the engine that this reassembled stream can drop the * rest of the pkts with no further inspection */ if (s->action & ACTION_DROP) alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW; alert_flags |= PACKET_ALERT_FLAG_STREAM_MATCH; break; } } } /* if (smsg != NULL) */ /* no match? then inspect packet payload */ if (pmatch == 0) { SCLogDebug("no match in smsg, fall back to packet payload"); if (!(sflags & SIG_FLAG_REQUIRE_PACKET)) { if (p->flags & PKT_STREAM_ADD) goto next; } if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, pflow, p) != 1) { goto next; } } } else { if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, pflow, p) != 1) { goto next; } } } /* run the packet match functions */ if (s->sm_arrays[DETECT_SM_LIST_MATCH] != NULL) { KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_MATCH); SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_MATCH]; SCLogDebug("running match functions, sm %p", smd); if (smd != NULL) { while (1) { KEYWORD_PROFILING_START; if (sigmatch_table[smd->type].Match(th_v, det_ctx, p, s, smd->ctx) <= 0) { KEYWORD_PROFILING_END(det_ctx, smd->type, 0); SCLogDebug("no match"); goto next; } KEYWORD_PROFILING_END(det_ctx, smd->type, 1); if (smd->is_last) { SCLogDebug("match and is_last"); break; } smd++; } } } SCLogDebug("s->sm_lists[DETECT_SM_LIST_AMATCH] %p, " "s->sm_lists[DETECT_SM_LIST_UMATCH] %p, " "s->sm_lists[DETECT_SM_LIST_DMATCH] %p, " "s->sm_lists[DETECT_SM_LIST_HCDMATCH] %p", s->sm_lists[DETECT_SM_LIST_AMATCH], s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_DMATCH], s->sm_lists[DETECT_SM_LIST_HCDMATCH]); /* consider stateful sig matches */ if (sflags & SIG_FLAG_STATE_MATCH) { if (has_state == 0) { SCLogDebug("state matches but no state, we can't match"); goto next; } SCLogDebug("stateful app layer match inspection starting"); /* if DeStateDetectStartDetection matches, it's a full * signature match. It will then call PacketAlertAppend * itself, so we can skip it below. This is done so it * can store the tx_id with the alert */ PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL); state_alert = DeStateDetectStartDetection(th_v, de_ctx, det_ctx, s, p, pflow, flow_flags, alproto, alversion); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL); if (state_alert == 0) goto next; /* match */ if (s->action & ACTION_DROP) alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW; alert_flags |= PACKET_ALERT_FLAG_STATE_MATCH; } #ifdef PROFILING smatch = 1; #endif SigMatchSignaturesRunPostMatch(th_v, de_ctx, det_ctx, p, s); if (!(sflags & SIG_FLAG_NOALERT)) { /* stateful sigs call PacketAlertAppend from DeStateDetectStartDetection */ if (!state_alert) PacketAlertAppend(det_ctx, s, p, 0, alert_flags); } else { /* apply actions even if not alerting */ DetectSignatureApplyActions(p, s); } alerts++; next: DetectFlowvarProcessList(det_ctx, pflow); DetectReplaceFree(det_ctx); RULE_PROFILING_END(det_ctx, s, smatch, p); det_ctx->flags = 0; continue; } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES); end: #ifdef __SC_CUDA_SUPPORT__ CudaReleasePacket(p); #endif /* see if we need to increment the inspect_id and reset the de_state */ if (has_state && AppLayerParserProtocolSupportsTxs(p->proto, alproto)) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL); DeStateUpdateInspectTransactionId(pflow, flow_flags); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL); } /* so now let's iterate the alerts and remove the ones after a pass rule * matched (if any). This is done inside PacketAlertFinalize() */ /* PR: installed "tag" keywords are handled after the threshold inspection */ PACKET_PROFILING_DETECT_START(p, PROF_DETECT_ALERT); PacketAlertFinalize(de_ctx, det_ctx, p); if (p->alerts.cnt > 0) { StatsAddUI64(th_v, det_ctx->counter_alerts, (uint64_t)p->alerts.cnt); } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_ALERT); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP); /* cleanup pkt specific part of the patternmatcher */ PacketPatternCleanup(th_v, det_ctx); DetectEngineCleanHCBDBuffers(det_ctx); DetectEngineCleanHSBDBuffers(det_ctx); DetectEngineCleanHHDBuffers(det_ctx); DetectEngineCleanSMTPBuffers(det_ctx); /* store the found sgh (or NULL) in the flow to save us from looking it * up again for the next packet. Also return any stream chunk we processed * to the pool. */ if (p->flags & PKT_HAS_FLOW) { if (debuglog_enabled) { if (p->alerts.cnt > 0) { AlertDebugLogModeSyncFlowbitsNamesToPacketStruct(p, de_ctx); } } /* HACK: prevent the wrong sgh (or NULL) from being stored in the * flow's sgh pointers */ if (PKT_IS_ICMPV4(p) && ICMPV4_DEST_UNREACH_IS_VALID(p)) { ; /* no-op */ } else if (!(sms_runflags & SMS_USE_FLOW_SGH)) { DetectPostInspectFirstSGH(p, pflow, det_ctx->sgh); } /* if we had no alerts that involved the smsgs, * we can get rid of them now. */ StreamMsgReturnListToPool(det_ctx->smsg); det_ctx->smsg = NULL; } PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP); SCReturnInt((int)(alerts > 0)); } /** \brief Apply action(s) and Set 'drop' sig info, * if applicable */ void DetectSignatureApplyActions(Packet *p, const Signature *s) { PACKET_UPDATE_ACTION(p, s->action); if (s->action & ACTION_DROP) { if (p->alerts.drop.action == 0) { p->alerts.drop.num = s->num; p->alerts.drop.action = s->action; p->alerts.drop.s = (Signature *)s; } } } /* tm module api functions */ static DetectEngineThreadCtx *GetTenantById(HashTable *h, uint32_t id) { /* technically we need to pass a DetectEngineThreadCtx struct with the * tentant_id member. But as that member is the first in the struct, we * can use the id directly. */ return HashTableLookup(h, &id, 0); } static void DetectFlow(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { /* No need to perform any detection on this packet, if the the given flag is set.*/ if ((p->flags & PKT_NOPACKET_INSPECTION) || (PACKET_TEST_ACTION(p, ACTION_DROP))) { /* hack: if we are in pass the entire flow mode, we need to still * update the inspect_id forward. So test for the condition here, * and call the update code if necessary. */ int pass = ((p->flow->flags & FLOW_NOPACKET_INSPECTION)); uint8_t flags = FlowGetDisruptionFlags(p->flow, 0); AppProto alproto = FlowGetAppProtocol(p->flow); if (pass && AppLayerParserProtocolSupportsTxs(p->proto, alproto)) { if (p->flowflags & FLOW_PKT_TOSERVER) { flags |= STREAM_TOSERVER; } else { flags |= STREAM_TOCLIENT; } DeStateUpdateInspectTransactionId(p->flow, flags); } return; } /* see if the packet matches one or more of the sigs */ (void)SigMatchSignatures(tv,de_ctx,det_ctx,p); } static void DetectNoFlow(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { /* No need to perform any detection on this packet, if the the given flag is set.*/ if ((p->flags & PKT_NOPACKET_INSPECTION) || (PACKET_TEST_ACTION(p, ACTION_DROP))) { return; } /* see if the packet matches one or more of the sigs */ (void)SigMatchSignatures(tv,de_ctx,det_ctx,p); return; } /** \brief Detection engine thread wrapper. * \param tv thread vars * \param p packet to inspect * \param data thread specific data * \param pq packet queue * \retval TM_ECODE_FAILED error * \retval TM_ECODE_OK ok */ TmEcode Detect(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq) { DEBUG_VALIDATE_PACKET(p); DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data; if (det_ctx == NULL) { printf("ERROR: Detect has no thread ctx\n"); goto error; } if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) { (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1); SCLogDebug("Detect Engine using new det_ctx - %p", det_ctx); } /* if in MT mode _and_ we have tenants registered, use * MT logic. */ if (det_ctx->mt_det_ctxs_cnt > 0 && det_ctx->TenantGetId != NULL) { uint32_t tenant_id = p->tenant_id; if (tenant_id == 0) tenant_id = det_ctx->TenantGetId(det_ctx, p); if (tenant_id > 0 && tenant_id < det_ctx->mt_det_ctxs_cnt) { p->tenant_id = tenant_id; det_ctx = GetTenantById(det_ctx->mt_det_ctxs_hash, tenant_id); if (det_ctx == NULL) return TM_ECODE_OK; de_ctx = det_ctx->de_ctx; if (de_ctx == NULL) return TM_ECODE_OK; if (unlikely(SC_ATOMIC_GET(det_ctx->so_far_used_by_detect) == 0)) { (void)SC_ATOMIC_SET(det_ctx->so_far_used_by_detect, 1); SCLogDebug("MT de_ctx %p det_ctx %p (tenant %u)", de_ctx, det_ctx, tenant_id); } } else { /* use default if no tenants are registered for this packet */ de_ctx = det_ctx->de_ctx; } } else { de_ctx = det_ctx->de_ctx; } if (p->flow) { DetectFlow(tv, de_ctx, det_ctx, p); } else { DetectNoFlow(tv, de_ctx, det_ctx, p); } return TM_ECODE_OK; error: return TM_ECODE_FAILED; } void SigCleanSignatures(DetectEngineCtx *de_ctx) { Signature *s = NULL, *ns; if (de_ctx == NULL) return; for (s = de_ctx->sig_list; s != NULL;) { ns = s->next; SigFree(s); s = ns; } de_ctx->sig_list = NULL; DetectEngineResetMaxSigId(de_ctx); de_ctx->sig_list = NULL; } /** \brief Find a specific signature by sid and gid * \param de_ctx detection engine ctx * \param sid the signature id * \param gid the signature group id * * \retval s sig found * \retval NULL sig not found */ Signature *SigFindSignatureBySidGid(DetectEngineCtx *de_ctx, uint32_t sid, uint32_t gid) { Signature *s = NULL; if (de_ctx == NULL) return NULL; for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->id == sid && s->gid == gid) return s; } return NULL; } int SignatureIsAppLayer(DetectEngineCtx *de_ctx, Signature *s) { if (s->alproto != 0) return 1; return 0; } /** * \brief Check if a signature contains the filestore keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFilestoring(Signature *s) { if (s == NULL) return 0; if (s->flags & SIG_FLAG_FILESTORE) return 1; return 0; } /** * \brief Check if a signature contains the filemagic keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFilemagicInspecting(Signature *s) { if (s == NULL) return 0; if (s->file_flags & FILE_SIG_NEED_MAGIC) return 1; return 0; } /** * \brief Check if a signature contains the filemd5 keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFileMd5Inspecting(Signature *s) { if ((s != NULL) && (s->file_flags & FILE_SIG_NEED_MD5)) return 1; return 0; } /** * \brief Check if a signature contains the filesha1 keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFileSha1Inspecting(Signature *s) { if ((s != NULL) && (s->file_flags & FILE_SIG_NEED_SHA1)) return 1; return 0; } /** * \brief Check if a signature contains the filesha256 keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFileSha256Inspecting(Signature *s) { if ((s != NULL) && (s->file_flags & FILE_SIG_NEED_SHA256)) return 1; return 0; } /** * \brief Check if a signature contains the filesize keyword. * * \param s signature * * \retval 0 no * \retval 1 yes */ int SignatureIsFilesizeInspecting(Signature *s) { if (s == NULL) return 0; if (s->file_flags & FILE_SIG_NEED_SIZE) return 1; return 0; } /** \brief Test is a initialized signature is IP only * \param de_ctx detection engine ctx * \param s the signature * \retval 1 sig is ip only * \retval 0 sig is not ip only */ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) { if (s->alproto != ALPROTO_UNKNOWN) return 0; if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRHHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) return 0; /* TMATCH list can be ignored, it contains TAGs and * tags are compatible to IP-only. */ IPOnlyCIDRItem *cidr_item; cidr_item = s->CidrSrc; while (cidr_item != NULL) { if (cidr_item->negated) return 0; cidr_item = cidr_item->next; } cidr_item = s->CidrDst; while (cidr_item != NULL) { if (cidr_item->negated) return 0; cidr_item = cidr_item->next; } SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; if (sm == NULL) goto iponly; for ( ; sm != NULL; sm = sm->next) { if ( !(sigmatch_table[sm->type].flags & SIGMATCH_IPONLY_COMPAT)) return 0; /* we have enabled flowbits to be compatible with ip only sigs, as long * as the sig only has a "set" flowbits */ if (sm->type == DETECT_FLOWBITS && (((DetectFlowbitsData *)sm->ctx)->cmd != DETECT_FLOWBITS_CMD_SET) ) { return 0; } } iponly: if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("IP-ONLY (%" PRIu32 "): source %s, dest %s", s->id, s->flags & SIG_FLAG_SRC_ANY ? "ANY" : "SET", s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET"); } return 1; } /** \internal * \brief Test is a initialized signature is inspecting protocol detection only * \param de_ctx detection engine ctx * \param s the signature * \retval 1 sig is dp only * \retval 0 sig is not dp only */ static int SignatureIsPDOnly(const Signature *s) { if (s->alproto != ALPROTO_UNKNOWN) return 0; if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_HRHHDMATCH] != NULL) return 0; if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) return 0; /* TMATCH list can be ignored, it contains TAGs and * tags are compatible to DP-only. */ /* match list matches may be compatible to DP only. We follow the same * logic as IP-only so we can use that flag */ SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; if (sm == NULL) return 0; int pd = 0; for ( ; sm != NULL; sm = sm->next) { if (sm->type == DETECT_AL_APP_LAYER_PROTOCOL) { pd = 1; } else { /* flowbits are supported for dp only sigs, as long * as the sig only has a "set" flowbits */ if (sm->type == DETECT_FLOWBITS) { if ((((DetectFlowbitsData *)sm->ctx)->cmd != DETECT_FLOWBITS_CMD_SET) ) { SCLogDebug("%u: not PD-only: flowbit settings other than 'set'", s->id); return 0; } } else if (sm->type == DETECT_FLOW) { if (((DetectFlowData *)sm->ctx)->flags & ~(DETECT_FLOW_FLAG_TOSERVER|DETECT_FLOW_FLAG_TOCLIENT)) { SCLogDebug("%u: not PD-only: flow settings other than toserver/toclient", s->id); return 0; } } else if ( !(sigmatch_table[sm->type].flags & SIGMATCH_IPONLY_COMPAT)) { SCLogDebug("%u: not PD-only: %s not PD/IP-only compat", s->id, sigmatch_table[sm->type].name); return 0; } } } if (pd) { SCLogDebug("PD-ONLY (%" PRIu32 ")", s->id); } return pd; } /** * \internal * \brief Check if the initialized signature is inspecting the packet payload * \param de_ctx detection engine ctx * \param s the signature * \retval 1 sig is inspecting the payload * \retval 0 sig is not inspecting the payload */ static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) { if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { return 1; } #if 0 SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) return 0; for (; sm != NULL; sm = sm->next) { if (sigmatch_table[sm->type].flags & SIGMATCH_PAYLOAD) { if (!(de_ctx->flags & DE_QUIET)) SCLogDebug("Signature (%" PRIu32 "): is inspecting payload.", s->id); return 1; } } #endif return 0; } /** * \internal * \brief check if a signature is decoder event matching only * \param de_ctx detection engine * \param s the signature to test * \retval 0 not a DEOnly sig * \retval 1 DEOnly sig */ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) { if (s->alproto != ALPROTO_UNKNOWN) { SCReturnInt(0); } if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL || s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_HRHHDMATCH] != NULL) { SCReturnInt(0); } /* check for conflicting keywords */ SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; for ( ;sm != NULL; sm = sm->next) { if ( !(sigmatch_table[sm->type].flags & SIGMATCH_DEONLY_COMPAT)) SCReturnInt(0); } /* need at least one decode event keyword to be considered decode event. */ sm = s->sm_lists[DETECT_SM_LIST_MATCH]; for ( ;sm != NULL; sm = sm->next) { if (sm->type == DETECT_DECODE_EVENT) goto deonly; if (sm->type == DETECT_ENGINE_EVENT) goto deonly; if (sm->type == DETECT_STREAM_EVENT) goto deonly; } SCReturnInt(0); deonly: if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("DE-ONLY (%" PRIu32 "): source %s, dest %s", s->id, s->flags & SIG_FLAG_SRC_ANY ? "ANY" : "SET", s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET"); } SCReturnInt(1); } #define MASK_TCP_INITDEINIT_FLAGS (TH_SYN|TH_RST|TH_FIN) #define MASK_TCP_UNUSUAL_FLAGS (TH_URG|TH_ECN|TH_CWR) /* Create mask for this packet + it's flow if it has one * * Sets SIG_MASK_REQUIRE_PAYLOAD, SIG_MASK_REQUIRE_FLOW, * SIG_MASK_REQUIRE_HTTP_STATE, SIG_MASK_REQUIRE_DCE_STATE */ static void PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, int has_state, StreamMsg *smsg, int app_decoder_events) { /* no payload inspect flag doesn't apply to smsg */ if (smsg != NULL || (!(p->flags & PKT_NOPAYLOAD_INSPECTION) && p->payload_len > 0)) { SCLogDebug("packet has payload"); (*mask) |= SIG_MASK_REQUIRE_PAYLOAD; } else { SCLogDebug("packet has no payload"); (*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD; } if (p->events.cnt > 0 || app_decoder_events != 0 || p->app_layer_events != NULL) { SCLogDebug("packet/flow has events set"); (*mask) |= SIG_MASK_REQUIRE_ENGINE_EVENT; } if (PKT_IS_TCP(p)) { if ((p->tcph->th_flags & MASK_TCP_INITDEINIT_FLAGS) != 0) { (*mask) |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT; } if ((p->tcph->th_flags & MASK_TCP_UNUSUAL_FLAGS) != 0) { (*mask) |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL; } } if (p->flags & PKT_HAS_FLOW) { SCLogDebug("packet has flow"); (*mask) |= SIG_MASK_REQUIRE_FLOW; if (has_state) { switch(alproto) { case ALPROTO_HTTP: SCLogDebug("packet/flow has http state"); (*mask) |= SIG_MASK_REQUIRE_HTTP_STATE; break; case ALPROTO_SMB: case ALPROTO_SMB2: case ALPROTO_DCERPC: SCLogDebug("packet/flow has dce state"); (*mask) |= SIG_MASK_REQUIRE_DCE_STATE; break; case ALPROTO_SSH: SCLogDebug("packet/flow has ssh state"); (*mask) |= SIG_MASK_REQUIRE_SSH_STATE; break; case ALPROTO_TLS: SCLogDebug("packet/flow has tls state"); (*mask) |= SIG_MASK_REQUIRE_TLS_STATE; break; case ALPROTO_DNS: SCLogDebug("packet/flow has dns state"); (*mask) |= SIG_MASK_REQUIRE_DNS_STATE; break; case ALPROTO_FTP: SCLogDebug("packet/flow has ftp state"); (*mask) |= SIG_MASK_REQUIRE_FTP_STATE; break; case ALPROTO_SMTP: SCLogDebug("packet/flow has smtp state"); (*mask) |= SIG_MASK_REQUIRE_SMTP_STATE; break; case ALPROTO_ENIP: SCLogDebug("packet/flow has enip state"); (*mask) |= SIG_MASK_REQUIRE_ENIP_STATE; break; case ALPROTO_DNP3: SCLogDebug("packet/flow has dnp3 state"); (*mask) |= SIG_MASK_REQUIRE_DNP3_STATE; break; case ALPROTO_TEMPLATE: SCLogDebug("packet/flow has template state"); (*mask) |= SIG_MASK_REQUIRE_TEMPLATE_STATE; break; default: SCLogDebug("packet/flow has other state"); break; } } else { SCLogDebug("no alstate"); } } } static int SignatureCreateMask(Signature *s) { SCEnter(); if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_PAYLOAD; SCLogDebug("sig requires payload"); } if (s->sm_lists[DETECT_SM_LIST_DMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_DCE_STATE; SCLogDebug("sig requires dce state"); } if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http state"); } if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_FILEDATA] != NULL) { /* set the state depending from the protocol */ if (s->alproto == ALPROTO_HTTP) s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; else if (s->alproto == ALPROTO_SMTP) s->mask |= SIG_MASK_REQUIRE_SMTP_STATE; SCLogDebug("sig requires http or smtp app state"); } if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HSMDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HSCDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HUADMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } if (s->sm_lists[DETECT_SM_LIST_HRHHDMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires http app state"); } SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_AMATCH] ; sm != NULL; sm = sm->next) { switch(sm->type) { case DETECT_AL_URILEN: case DETECT_AL_HTTP_URI: s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires dce http state"); break; case DETECT_AL_APP_LAYER_EVENT: s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT; break; } } for (sm = s->sm_lists[DETECT_SM_LIST_APP_EVENT] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_AL_APP_LAYER_EVENT: { DetectAppLayerEventData *aed = (DetectAppLayerEventData *)sm->ctx; switch (aed->alproto) { case ALPROTO_HTTP: s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig %u requires http app state (http event)", s->id); break; case ALPROTO_SMTP: s->mask |= SIG_MASK_REQUIRE_SMTP_STATE; SCLogDebug("sig %u requires smtp app state (smtp event)", s->id); break; case ALPROTO_DNS: s->mask |= SIG_MASK_REQUIRE_DNS_STATE; SCLogDebug("sig %u requires dns app state (dns event)", s->id); break; case ALPROTO_TLS: s->mask |= SIG_MASK_REQUIRE_TLS_STATE; SCLogDebug("sig %u requires tls app state (tls event)", s->id); break; } break; } } } for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch(sm->type) { case DETECT_FLOWBITS: { /* figure out what flowbit action */ DetectFlowbitsData *fb = (DetectFlowbitsData *)sm->ctx; if (fb->cmd == DETECT_FLOWBITS_CMD_ISSET) { /* not a mask flag, but still set it here */ s->flags |= SIG_FLAG_REQUIRE_FLOWVAR; SCLogDebug("SIG_FLAG_REQUIRE_FLOWVAR set as sig has " "flowbit isset option."); } /* flow is required for any flowbit manipulation */ s->mask |= SIG_MASK_REQUIRE_FLOW; SCLogDebug("sig requires flow to be able to manipulate " "flowbit(s)"); break; } case DETECT_FLAGS: { DetectFlagsData *fl = (DetectFlagsData *)sm->ctx; if (fl->flags & TH_SYN) { s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT"); } if (fl->flags & TH_RST) { s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT"); } if (fl->flags & TH_FIN) { s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT"); } if (fl->flags & TH_URG) { s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL"); } if (fl->flags & TH_ECN) { s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL"); } if (fl->flags & TH_CWR) { s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL; SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL"); } break; } case DETECT_DSIZE: { DetectDsizeData *ds = (DetectDsizeData *)sm->ctx; switch (ds->mode) { case DETECTDSIZE_LT: /* LT will include 0, so no payload. * if GT is used in the same rule the * flag will be set anyway. */ break; case DETECTDSIZE_RA: case DETECTDSIZE_GT: s->mask |= SIG_MASK_REQUIRE_PAYLOAD; SCLogDebug("sig requires payload"); break; case DETECTDSIZE_EQ: if (ds->dsize > 0) { s->mask |= SIG_MASK_REQUIRE_PAYLOAD; SCLogDebug("sig requires payload"); } else if (ds->dsize == 0) { s->mask |= SIG_MASK_REQUIRE_NO_PAYLOAD; SCLogDebug("sig requires no payload"); } break; } break; } case DETECT_AL_APP_LAYER_EVENT: s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT; break; case DETECT_ENGINE_EVENT: s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT; break; } } if (s->alproto == ALPROTO_SSH) { s->mask |= SIG_MASK_REQUIRE_SSH_STATE; SCLogDebug("sig requires ssh state"); } if (s->alproto == ALPROTO_TLS) { s->mask |= SIG_MASK_REQUIRE_TLS_STATE; SCLogDebug("sig requires tls state"); } if (s->alproto == ALPROTO_DNS) { s->mask |= SIG_MASK_REQUIRE_DNS_STATE; SCLogDebug("sig requires dns state"); } if (s->alproto == ALPROTO_DNP3) { s->mask |= SIG_MASK_REQUIRE_DNP3_STATE; SCLogDebug("sig requires dnp3 state"); } if (s->alproto == ALPROTO_FTP) { s->mask |= SIG_MASK_REQUIRE_FTP_STATE; SCLogDebug("sig requires ftp state"); } if (s->alproto == ALPROTO_SMTP) { s->mask |= SIG_MASK_REQUIRE_SMTP_STATE; SCLogDebug("sig requires smtp state"); } if (s->alproto == ALPROTO_ENIP) { s->mask |= SIG_MASK_REQUIRE_ENIP_STATE; SCLogDebug("sig requires enip state"); } if (s->alproto == ALPROTO_TEMPLATE) { s->mask |= SIG_MASK_REQUIRE_TEMPLATE_STATE; SCLogDebug("sig requires template state"); } if ((s->mask & SIG_MASK_REQUIRE_DCE_STATE) || (s->mask & SIG_MASK_REQUIRE_HTTP_STATE) || (s->mask & SIG_MASK_REQUIRE_SSH_STATE) || (s->mask & SIG_MASK_REQUIRE_DNS_STATE) || (s->mask & SIG_MASK_REQUIRE_DNP3_STATE) || (s->mask & SIG_MASK_REQUIRE_FTP_STATE) || (s->mask & SIG_MASK_REQUIRE_SMTP_STATE) || (s->mask & SIG_MASK_REQUIRE_ENIP_STATE) || (s->mask & SIG_MASK_REQUIRE_TEMPLATE_STATE) || (s->mask & SIG_MASK_REQUIRE_TLS_STATE)) { s->mask |= SIG_MASK_REQUIRE_FLOW; SCLogDebug("sig requires flow"); } if (s->init_flags & SIG_FLAG_INIT_FLOW) { s->mask |= SIG_MASK_REQUIRE_FLOW; SCLogDebug("sig requires flow"); } if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_FLOW; SCLogDebug("sig requires flow"); } if (s->flags & SIG_FLAG_APPLAYER) { s->mask |= SIG_MASK_REQUIRE_FLOW; SCLogDebug("sig requires flow"); } SCLogDebug("mask %02X", s->mask); SCReturnInt(0); } static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx) { DetectMpmInitializeBuiltinMpms(de_ctx); DetectMpmInitializeAppMpms(de_ctx); return; } /** \brief get max dsize "depth" * \param s signature to get dsize value from * \retval depth or negative value */ static int SigParseGetMaxDsize(Signature *s) { if (s->flags & SIG_FLAG_DSIZE && s->dsize_sm != NULL) { DetectDsizeData *dd = (DetectDsizeData *)s->dsize_sm->ctx; switch (dd->mode) { case DETECTDSIZE_LT: case DETECTDSIZE_EQ: return dd->dsize; case DETECTDSIZE_RA: return dd->dsize2; case DETECTDSIZE_GT: default: SCReturnInt(-2); } } SCReturnInt(-1); } /** \brief set prefilter dsize pair * \param s signature to get dsize value from */ static void SigParseSetDsizePair(Signature *s) { if (s->flags & SIG_FLAG_DSIZE && s->dsize_sm != NULL) { DetectDsizeData *dd = (DetectDsizeData *)s->dsize_sm->ctx; uint16_t low = 0; uint16_t high = 65535; switch (dd->mode) { case DETECTDSIZE_LT: low = 0; high = dd->dsize; break; case DETECTDSIZE_EQ: low = dd->dsize; high = dd->dsize; break; case DETECTDSIZE_RA: low = dd->dsize; high = dd->dsize2; break; case DETECTDSIZE_GT: low = dd->dsize; high = 65535; break; } s->dsize_low = low; s->dsize_high = high; SCLogDebug("low %u, high %u", low, high); } } /** * \brief Apply dsize as depth to content matches in the rule * \param s signature to get dsize value from */ static void SigParseApplyDsizeToContent(Signature *s) { SCEnter(); if (s->flags & SIG_FLAG_DSIZE) { SigParseSetDsizePair(s); int dsize = SigParseGetMaxDsize(s); if (dsize < 0) { /* nothing to do */ return; } SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; for ( ; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) { continue; } DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) { continue; } if (cd->depth == 0 || cd->depth >= dsize) { cd->depth = (uint16_t)dsize; SCLogDebug("updated %u, content %u to have depth %u " "because of dsize.", s->id, cd->id, cd->depth); } } } } /** \brief Pure-PCRE or bytetest rule */ int RuleInspectsPayloadHasNoMpm(const Signature *s) { if (s->mpm_sm == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 1; return 0; } int RuleGetMpmPatternSize(const Signature *s) { if (s->mpm_sm == NULL) return -1; int mpm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (mpm_list < 0) return -1; const DetectContentData *cd = (const DetectContentData *)s->mpm_sm->ctx; if (cd == NULL) return -1; return (int)cd->content_len; } int RuleMpmIsNegated(const Signature *s) { if (s->mpm_sm == NULL) return 0; int mpm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); if (mpm_list < 0) return 0; const DetectContentData *cd = (const DetectContentData *)s->mpm_sm->ctx; if (cd == NULL) return 0; return (cd->flags & DETECT_CONTENT_NEGATED); } #ifdef HAVE_LIBJANSSON json_t *RulesGroupPrintSghStats(const SigGroupHead *sgh, const int add_rules, const int add_mpm_stats) { uint32_t mpm_cnt = 0; uint32_t nonmpm_cnt = 0; uint32_t negmpm_cnt = 0; uint32_t any5_cnt = 0; uint32_t payload_no_mpm_cnt = 0; uint32_t syn_cnt = 0; uint32_t mpms_total = 0; uint32_t mpms_min = 0; uint32_t mpms_max = 0; struct { uint32_t total; uint32_t cnt; uint32_t min; uint32_t max; } mpm_stats[DETECT_SM_LIST_MAX]; memset(mpm_stats, 0x00, sizeof(mpm_stats)); uint32_t alstats[ALPROTO_MAX] = {0}; uint32_t mpm_sizes[DETECT_SM_LIST_MAX][256]; memset(mpm_sizes, 0, sizeof(mpm_sizes)); uint32_t alproto_mpm_bufs[ALPROTO_MAX][DETECT_SM_LIST_MAX]; memset(alproto_mpm_bufs, 0, sizeof(alproto_mpm_bufs)); json_t *js = json_object(); if (unlikely(js == NULL)) return NULL; json_object_set_new(js, "id", json_integer(sgh->id)); json_t *js_array = json_array(); const Signature *s; uint32_t x; for (x = 0; x < sgh->sig_cnt; x++) { s = sgh->match_array[x]; if (s == NULL) continue; int any = 0; if (s->proto.flags & DETECT_PROTO_ANY) { any++; } if (s->flags & SIG_FLAG_DST_ANY) { any++; } if (s->flags & SIG_FLAG_SRC_ANY) { any++; } if (s->flags & SIG_FLAG_DP_ANY) { any++; } if (s->flags & SIG_FLAG_SP_ANY) { any++; } if (any == 5) { any5_cnt++; } if (s->mpm_sm == NULL) { nonmpm_cnt++; if (s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { SCLogDebug("SGH %p Non-MPM inspecting only packets. Rule %u", sgh, s->id); } DetectPort *sp = s->sp; DetectPort *dp = s->dp; if (s->flags & SIG_FLAG_TOSERVER && (dp->port == 0 && dp->port2 == 65535)) { SCLogDebug("SGH %p Non-MPM toserver and to 'any'. Rule %u", sgh, s->id); } if (s->flags & SIG_FLAG_TOCLIENT && (sp->port == 0 && sp->port2 == 65535)) { SCLogDebug("SGH %p Non-MPM toclient and to 'any'. Rule %u", sgh, s->id); } if (DetectFlagsSignatureNeedsSynPackets(s)) { syn_cnt++; } } else { int mpm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); BUG_ON(mpm_list < 0); const DetectContentData *cd = (const DetectContentData *)s->mpm_sm->ctx; uint32_t size = cd->content_len < 256 ? cd->content_len : 255; mpm_sizes[mpm_list][size]++; if (s->alproto != ALPROTO_UNKNOWN) { alproto_mpm_bufs[s->alproto][mpm_list]++; } if (mpm_list == DETECT_SM_LIST_PMATCH) { if (size == 1) { DetectPort *sp = s->sp; DetectPort *dp = s->dp; if (s->flags & SIG_FLAG_TOSERVER) { if (dp->port == 0 && dp->port2 == 65535) { SCLogDebug("SGH %p toserver 1byte fast_pattern to ANY. Rule %u", sgh, s->id); } else { SCLogDebug("SGH %p toserver 1byte fast_pattern to port(s) %u-%u. Rule %u", sgh, dp->port, dp->port2, s->id); } } if (s->flags & SIG_FLAG_TOCLIENT) { if (sp->port == 0 && sp->port2 == 65535) { SCLogDebug("SGH %p toclient 1byte fast_pattern to ANY. Rule %u", sgh, s->id); } else { SCLogDebug("SGH %p toclient 1byte fast_pattern to port(s) %u-%u. Rule %u", sgh, sp->port, sp->port2, s->id); } } } } uint32_t w = PatternStrength(cd->content, cd->content_len); mpms_total += w; if (mpms_min == 0) mpms_min = w; if (w < mpms_min) mpms_min = w; if (w > mpms_max) mpms_max = w; mpm_stats[mpm_list].total += w; mpm_stats[mpm_list].cnt++; if (mpm_stats[mpm_list].min == 0 || w < mpm_stats[mpm_list].min) mpm_stats[mpm_list].min = w; if (w > mpm_stats[mpm_list].max) mpm_stats[mpm_list].max = w; mpm_cnt++; if (w < 10) { SCLogDebug("SGH %p Weak MPM Pattern on %s. Rule %u", sgh, DetectListToString(mpm_list), s->id); } if (w < 10 && any == 5) { SCLogDebug("SGH %p Weak MPM Pattern on %s, rule is 5xAny. Rule %u", sgh, DetectListToString(mpm_list), s->id); } if (cd->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("SGH %p MPM Pattern on %s, is negated. Rule %u", sgh, DetectListToString(mpm_list), s->id); negmpm_cnt++; } } if (RuleInspectsPayloadHasNoMpm(s)) { SCLogDebug("SGH %p No MPM. Payload inspecting. Rule %u", sgh, s->id); payload_no_mpm_cnt++; } if (s->alproto != ALPROTO_UNKNOWN) { alstats[s->alproto]++; } if (add_rules) { json_t *js_sig = json_object(); if (unlikely(js == NULL)) continue; json_object_set_new(js_sig, "sig_id", json_integer(s->id)); json_array_append_new(js_array, js_sig); } } json_object_set_new(js, "rules", js_array); json_t *stats = json_object(); json_object_set_new(stats, "total", json_integer(sgh->sig_cnt)); json_t *types = json_object(); json_object_set_new(types, "mpm", json_integer(mpm_cnt)); json_object_set_new(types, "non_mpm", json_integer(nonmpm_cnt)); json_object_set_new(types, "negated_mpm", json_integer(negmpm_cnt)); json_object_set_new(types, "payload_but_no_mpm", json_integer(payload_no_mpm_cnt)); json_object_set_new(types, "syn", json_integer(syn_cnt)); json_object_set_new(types, "any5", json_integer(any5_cnt)); json_object_set_new(stats, "types", types); int i; for (i = 0; i < ALPROTO_MAX; i++) { if (alstats[i] > 0) { json_t *app = json_object(); json_object_set_new(app, "total", json_integer(alstats[i])); for (x = 0; x < DETECT_SM_LIST_MAX; x++) { if (alproto_mpm_bufs[i][x] == 0) continue; json_object_set_new(app, DetectListToHumanString(x), json_integer(alproto_mpm_bufs[i][x])); } json_object_set_new(stats, AppProtoToString(i), app); } } if (add_mpm_stats) { json_t *mpm_js = json_object(); for (i = 0; i < DETECT_SM_LIST_MAX; i++) { if (mpm_stats[i].cnt > 0) { json_t *mpm_sizes_array = json_array(); for (x = 0; x < 256; x++) { if (mpm_sizes[i][x] == 0) continue; json_t *e = json_object(); json_object_set_new(e, "size", json_integer(x)); json_object_set_new(e, "count", json_integer(mpm_sizes[i][x])); json_array_append_new(mpm_sizes_array, e); } json_t *buf = json_object(); json_object_set_new(buf, "total", json_integer(mpm_stats[i].cnt)); json_object_set_new(buf, "avg_strength", json_integer(mpm_stats[i].total / mpm_stats[i].cnt)); json_object_set_new(buf, "min_strength", json_integer(mpm_stats[i].min)); json_object_set_new(buf, "max_strength", json_integer(mpm_stats[i].max)); json_object_set_new(buf, "sizes", mpm_sizes_array); json_object_set_new(mpm_js, DetectListToHumanString(i), buf); } } json_object_set_new(stats, "mpm", mpm_js); } json_object_set_new(js, "stats", stats); json_object_set_new(js, "whitelist", json_integer(sgh->init->whitelist)); return js; } #endif /* HAVE_LIBJANSSON */ void RulesDumpGrouping(const DetectEngineCtx *de_ctx, const int add_rules, const int add_mpm_stats) { #ifdef HAVE_LIBJANSSON json_t *js = json_object(); if (unlikely(js == NULL)) return; int p; for (p = 0; p < 256; p++) { if (p == IPPROTO_TCP || p == IPPROTO_UDP) { const char *name = (p == IPPROTO_TCP) ? "tcp" : "udp"; json_t *tcp = json_object(); json_t *ts_array = json_array(); DetectPort *list = (p == IPPROTO_TCP) ? de_ctx->flow_gh[1].tcp : de_ctx->flow_gh[1].udp; while (list != NULL) { json_t *port = json_object(); json_object_set_new(port, "port", json_integer(list->port)); json_object_set_new(port, "port2", json_integer(list->port2)); json_t *tcp_ts = RulesGroupPrintSghStats(list->sh, add_rules, add_mpm_stats); json_object_set_new(port, "rulegroup", tcp_ts); json_array_append_new(ts_array, port); list = list->next; } json_object_set_new(tcp, "toserver", ts_array); json_t *tc_array = json_array(); list = (p == IPPROTO_TCP) ? de_ctx->flow_gh[0].tcp : de_ctx->flow_gh[0].udp; while (list != NULL) { json_t *port = json_object(); json_object_set_new(port, "port", json_integer(list->port)); json_object_set_new(port, "port2", json_integer(list->port2)); json_t *tcp_tc = RulesGroupPrintSghStats(list->sh, add_rules, add_mpm_stats); json_object_set_new(port, "rulegroup", tcp_tc); json_array_append_new(tc_array, port); list = list->next; } json_object_set_new(tcp, "toclient", tc_array); json_object_set_new(js, name, tcp); } } const char *filename = "rule_group.json"; const char *log_dir = ConfigGetLogDirectory(); char log_path[PATH_MAX] = ""; snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, filename); FILE *fp = fopen(log_path, "w"); if (fp == NULL) { return; } char *js_s = json_dumps(js, JSON_PRESERVE_ORDER|JSON_ESCAPE_SLASH); if (unlikely(js_s == NULL)) { fclose(fp); return; } json_object_clear(js); json_decref(js); fprintf(fp, "%s\n", js_s); free(js_s); fclose(fp); #endif return; } int RulesGroupByProto(DetectEngineCtx *de_ctx) { Signature *s = de_ctx->sig_list; uint32_t max_idx = 0; SigGroupHead *sgh_ts[256] = {NULL}; SigGroupHead *sgh_tc[256] = {NULL}; for ( ; s != NULL; s = s->next) { if (s->flags & SIG_FLAG_IPONLY) continue; int p; for (p = 0; p < 256; p++) { if (p == IPPROTO_TCP || p == IPPROTO_UDP) { continue; } if (!(s->proto.proto[p / 8] & (1<<(p % 8)) || (s->proto.flags & DETECT_PROTO_ANY))) { continue; } if (s->flags & SIG_FLAG_TOCLIENT) { SigGroupHeadAppendSig(de_ctx, &sgh_tc[p], s); max_idx = s->num; } if (s->flags & SIG_FLAG_TOSERVER) { SigGroupHeadAppendSig(de_ctx, &sgh_ts[p], s); max_idx = s->num; } } } SCLogDebug("max_idx %u", max_idx); /* lets look at deduplicating this list */ SigGroupHeadHashFree(de_ctx); SigGroupHeadHashInit(de_ctx); uint32_t cnt = 0; uint32_t own = 0; uint32_t ref = 0; int p; for (p = 0; p < 256; p++) { if (p == IPPROTO_TCP || p == IPPROTO_UDP) continue; if (sgh_ts[p] == NULL) continue; cnt++; SigGroupHead *lookup_sgh = SigGroupHeadHashLookup(de_ctx, sgh_ts[p]); if (lookup_sgh == NULL) { SCLogDebug("proto group %d sgh %p is the original", p, sgh_ts[p]); SigGroupHeadSetSigCnt(sgh_ts[p], max_idx); SigGroupHeadBuildMatchArray(de_ctx, sgh_ts[p], max_idx); SigGroupHeadHashAdd(de_ctx, sgh_ts[p]); SigGroupHeadStore(de_ctx, sgh_ts[p]); de_ctx->gh_unique++; own++; } else { SCLogDebug("proto group %d sgh %p is a copy", p, sgh_ts[p]); SigGroupHeadFree(sgh_ts[p]); sgh_ts[p] = lookup_sgh; de_ctx->gh_reuse++; ref++; } } SCLogPerf("OTHER %s: %u proto groups, %u unique SGH's, %u copies", "toserver", cnt, own, ref); cnt = 0; own = 0; ref = 0; for (p = 0; p < 256; p++) { if (p == IPPROTO_TCP || p == IPPROTO_UDP) continue; if (sgh_tc[p] == NULL) continue; cnt++; SigGroupHead *lookup_sgh = SigGroupHeadHashLookup(de_ctx, sgh_tc[p]); if (lookup_sgh == NULL) { SCLogDebug("proto group %d sgh %p is the original", p, sgh_tc[p]); SigGroupHeadSetSigCnt(sgh_tc[p], max_idx); SigGroupHeadBuildMatchArray(de_ctx, sgh_tc[p], max_idx); SigGroupHeadHashAdd(de_ctx, sgh_tc[p]); SigGroupHeadStore(de_ctx, sgh_tc[p]); de_ctx->gh_unique++; own++; } else { SCLogDebug("proto group %d sgh %p is a copy", p, sgh_tc[p]); SigGroupHeadFree(sgh_tc[p]); sgh_tc[p] = lookup_sgh; de_ctx->gh_reuse++; ref++; } } SCLogPerf("OTHER %s: %u proto groups, %u unique SGH's, %u copies", "toclient", cnt, own, ref); for (p = 0; p < 256; p++) { if (p == IPPROTO_TCP || p == IPPROTO_UDP) continue; de_ctx->flow_gh[0].sgh[p] = sgh_tc[p]; de_ctx->flow_gh[1].sgh[p] = sgh_ts[p]; } return 0; } static int PortIsWhitelisted(const DetectEngineCtx *de_ctx, const DetectPort *a, int ipproto) { DetectPort *w = de_ctx->tcp_whitelist; if (ipproto == IPPROTO_UDP) w = de_ctx->udp_whitelist; while (w) { if (a->port >= w->port && a->port2 <= w->port) { SCLogDebug("port group %u:%u whitelisted -> %d", a->port, a->port2, w->port); return 1; } w = w->next; } return 0; } static int RuleSetWhitelist(Signature *s) { DetectPort *p = NULL; if (s->flags & SIG_FLAG_TOSERVER) p = s->dp; else if (s->flags & SIG_FLAG_TOCLIENT) p = s->sp; else return 0; /* for sigs that don't use 'any' as port, see if we want to * whitelist poor sigs */ int wl = 0; if (!(p->port == 0 && p->port2 == 65535)) { /* pure pcre, bytetest, etc rules */ if (RuleInspectsPayloadHasNoMpm(s)) { SCLogDebug("Rule %u MPM has 1 byte fast_pattern. Whitelisting SGH's.", s->id); wl = 99; } else if (RuleMpmIsNegated(s)) { SCLogDebug("Rule %u MPM is negated. Whitelisting SGH's.", s->id); wl = 77; /* one byte pattern in packet/stream payloads */ } else if (s->mpm_sm != NULL && SigMatchListSMBelongsTo(s, s->mpm_sm) == DETECT_SM_LIST_PMATCH && RuleGetMpmPatternSize(s) == 1) { SCLogDebug("Rule %u No MPM. Payload inspecting. Whitelisting SGH's.", s->id); wl = 55; } else if (DetectFlagsSignatureNeedsSynPackets(s) && DetectFlagsSignatureNeedsSynOnlyPackets(s)) { SCLogDebug("Rule %u Needs SYN, so inspected often. Whitelisting SGH's.", s->id); wl = 33; } } s->whitelist = wl; return wl; } int CreateGroupedPortList(DetectEngineCtx *de_ctx, DetectPort *port_list, DetectPort **newhead, uint32_t unique_groups, int (*CompareFunc)(DetectPort *, DetectPort *), uint32_t max_idx); int CreateGroupedPortListCmpCnt(DetectPort *a, DetectPort *b); static DetectPort *RulesGroupByPorts(DetectEngineCtx *de_ctx, int ipproto, uint32_t direction) { /* step 1: create a hash of 'DetectPort' objects based on all the * rules. Each object will have a SGH with the sigs added * that belong to the SGH. */ DetectPortHashInit(de_ctx); uint32_t max_idx = 0; const Signature *s = de_ctx->sig_list; DetectPort *list = NULL; while (s) { /* IP Only rules are handled separately */ if (s->flags & SIG_FLAG_IPONLY) goto next; if (!(s->proto.proto[ipproto / 8] & (1<<(ipproto % 8)) || (s->proto.flags & DETECT_PROTO_ANY))) goto next; if (direction == SIG_FLAG_TOSERVER) { if (!(s->flags & SIG_FLAG_TOSERVER)) goto next; } else if (direction == SIG_FLAG_TOCLIENT) { if (!(s->flags & SIG_FLAG_TOCLIENT)) goto next; } DetectPort *p = NULL; if (direction == SIG_FLAG_TOSERVER) p = s->dp; else if (direction == SIG_FLAG_TOCLIENT) p = s->sp; else BUG_ON(1); /* see if we want to exclude directionless sigs that really care only for * to_server syn scans/floods */ if ((direction == SIG_FLAG_TOCLIENT) && DetectFlagsSignatureNeedsSynPackets(s) && DetectFlagsSignatureNeedsSynOnlyPackets(s) && ((s->flags & (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) == (SIG_FLAG_TOSERVER|SIG_FLAG_TOCLIENT)) && (!(s->dp->port == 0 && s->dp->port2 == 65535))) { SCLogWarning(SC_WARN_POOR_RULE, "rule %u: SYN-only to port(s) %u:%u " "w/o direction specified, disabling for toclient direction", s->id, s->dp->port, s->dp->port2); goto next; } int wl = s->whitelist; while (p) { int pwl = PortIsWhitelisted(de_ctx, p, ipproto) ? 111 : 0; pwl = MAX(wl,pwl); DetectPort *lookup = DetectPortHashLookup(de_ctx, p); if (lookup) { SigGroupHeadAppendSig(de_ctx, &lookup->sh, s); lookup->sh->init->whitelist = MAX(lookup->sh->init->whitelist, pwl); } else { DetectPort *tmp2 = DetectPortCopySingle(de_ctx, p); BUG_ON(tmp2 == NULL); SigGroupHeadAppendSig(de_ctx, &tmp2->sh, s); tmp2->sh->init->whitelist = pwl; DetectPortHashAdd(de_ctx, tmp2); } p = p->next; } max_idx = s->num; next: s = s->next; } /* step 2: create a list of DetectPort objects */ HashListTableBucket *htb = NULL; for (htb = HashListTableGetListHead(de_ctx->dport_hash_table); htb != NULL; htb = HashListTableGetListNext(htb)) { DetectPort *p = HashListTableGetListData(htb); DetectPort *tmp = DetectPortCopySingle(de_ctx, p); BUG_ON(tmp == NULL); int r = DetectPortInsert(de_ctx, &list , tmp); BUG_ON(r == -1); } DetectPortHashFree(de_ctx); de_ctx->dport_hash_table = NULL; SCLogDebug("rules analyzed"); /* step 3: group the list and shrink it if necessary */ DetectPort *newlist = NULL; uint16_t groupmax = (direction == SIG_FLAG_TOCLIENT) ? de_ctx->max_uniq_toclient_groups : de_ctx->max_uniq_toserver_groups; CreateGroupedPortList(de_ctx, list, &newlist, groupmax, CreateGroupedPortListCmpCnt, max_idx); list = newlist; /* step 4: deduplicate the SGH's */ SigGroupHeadHashFree(de_ctx); SigGroupHeadHashInit(de_ctx); uint32_t cnt = 0; uint32_t own = 0; uint32_t ref = 0; DetectPort *iter; for (iter = list ; iter != NULL; iter = iter->next) { BUG_ON (iter->sh == NULL); cnt++; SigGroupHead *lookup_sgh = SigGroupHeadHashLookup(de_ctx, iter->sh); if (lookup_sgh == NULL) { SCLogDebug("port group %p sgh %p is the original", iter, iter->sh); SigGroupHeadSetSigCnt(iter->sh, max_idx); SigGroupHeadBuildMatchArray(de_ctx, iter->sh, max_idx); SigGroupHeadSetProtoAndDirection(iter->sh, ipproto, direction); SigGroupHeadHashAdd(de_ctx, iter->sh); SigGroupHeadStore(de_ctx, iter->sh); iter->flags |= PORT_SIGGROUPHEAD_COPY; de_ctx->gh_unique++; own++; } else { SCLogDebug("port group %p sgh %p is a copy", iter, iter->sh); SigGroupHeadFree(iter->sh); iter->sh = lookup_sgh; iter->flags |= PORT_SIGGROUPHEAD_COPY; de_ctx->gh_reuse++; ref++; } } #if 0 for (iter = list ; iter != NULL; iter = iter->next) { SCLogInfo("PORT %u-%u %p (sgh=%s, whitelisted=%s/%d)", iter->port, iter->port2, iter->sh, iter->flags & PORT_SIGGROUPHEAD_COPY ? "ref" : "own", iter->sh->init->whitelist ? "true" : "false", iter->sh->init->whitelist); } #endif SCLogPerf("%s %s: %u port groups, %u unique SGH's, %u copies", ipproto == 6 ? "TCP" : "UDP", direction == SIG_FLAG_TOSERVER ? "toserver" : "toclient", cnt, own, ref); return list; } /** * \brief Preprocess signature, classify ip-only, etc, build sig array * * \param de_ctx Pointer to the Detection Engine Context * * \retval 0 on success * \retval -1 on failure */ int SigAddressPrepareStage1(DetectEngineCtx *de_ctx) { Signature *tmp_s = NULL; uint32_t cnt_iponly = 0; uint32_t cnt_payload = 0; uint32_t cnt_applayer = 0; uint32_t cnt_deonly = 0; if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("building signature grouping structure, stage 1: " "preprocessing rules..."); } de_ctx->sig_array_len = DetectEngineGetMaxSigId(de_ctx); de_ctx->sig_array_size = (de_ctx->sig_array_len * sizeof(Signature *)); de_ctx->sig_array = (Signature **)SCMalloc(de_ctx->sig_array_size); if (de_ctx->sig_array == NULL) goto error; memset(de_ctx->sig_array,0,de_ctx->sig_array_size); SCLogDebug("signature lookup array: %" PRIu32 " sigs, %" PRIu32 " bytes", de_ctx->sig_array_len, de_ctx->sig_array_size); /* now for every rule add the source group */ for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) { de_ctx->sig_array[tmp_s->num] = tmp_s; SCLogDebug("Signature %" PRIu32 ", internal id %" PRIu32 ", ptrs %p %p ", tmp_s->id, tmp_s->num, tmp_s, de_ctx->sig_array[tmp_s->num]); /* see if the sig is dp only */ if (SignatureIsPDOnly(tmp_s) == 1) { tmp_s->flags |= SIG_FLAG_PDONLY; SCLogDebug("Signature %"PRIu32" is considered \"PD only\"", tmp_s->id); /* see if the sig is ip only */ } else if (SignatureIsIPOnly(de_ctx, tmp_s) == 1) { tmp_s->flags |= SIG_FLAG_IPONLY; cnt_iponly++; SCLogDebug("Signature %"PRIu32" is considered \"IP only\"", tmp_s->id); /* see if any sig is inspecting the packet payload */ } else if (SignatureIsInspectingPayload(de_ctx, tmp_s) == 1) { tmp_s->init_flags |= SIG_FLAG_INIT_PAYLOAD; cnt_payload++; SCLogDebug("Signature %"PRIu32" is considered \"Payload inspecting\"", tmp_s->id); } else if (SignatureIsDEOnly(de_ctx, tmp_s) == 1) { tmp_s->init_flags |= SIG_FLAG_INIT_DEONLY; SCLogDebug("Signature %"PRIu32" is considered \"Decoder Event only\"", tmp_s->id); cnt_deonly++; } if (tmp_s->flags & SIG_FLAG_APPLAYER) { SCLogDebug("Signature %"PRIu32" is considered \"Applayer inspecting\"", tmp_s->id); cnt_applayer++; } #ifdef DEBUG if (SCLogDebugEnabled()) { uint16_t colen = 0; char copresent = 0; SigMatch *sm; DetectContentData *co; for (sm = tmp_s->sm_lists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; copresent = 1; co = (DetectContentData *)sm->ctx; if (co->content_len > colen) colen = co->content_len; } if (copresent && colen == 1) { SCLogDebug("signature %8u content maxlen 1", tmp_s->id); int proto; for (proto = 0; proto < 256; proto++) { if (tmp_s->proto.proto[(proto/8)] & (1<<(proto%8))) SCLogDebug("=> proto %" PRId32 "", proto); } } } #endif /* DEBUG */ if (RuleMpmIsNegated(tmp_s)) { tmp_s->flags |= SIG_FLAG_MPM_NEG; } SignatureCreateMask(tmp_s); SigParseApplyDsizeToContent(tmp_s); RuleSetWhitelist(tmp_s); /* if keyword engines are enabled in the config, handle them here */ if (de_ctx->prefilter_setting == DETECT_PREFILTER_AUTO && !(tmp_s->flags & SIG_FLAG_PREFILTER)) { int i; int prefilter_list = DETECT_TBLSIZE; /* get the keyword supporting prefilter with the lowest type */ for (i = 0; i < DETECT_SM_LIST_DETECT_MAX; i++) { SigMatch *sm = tmp_s->sm_lists[i]; while (sm != NULL) { if (sigmatch_table[sm->type].SupportsPrefilter != NULL) { if (sigmatch_table[sm->type].SupportsPrefilter(tmp_s) == TRUE) { prefilter_list = MIN(prefilter_list, sm->type); } } sm = sm->next; } } /* apply that keyword as prefilter */ if (prefilter_list != DETECT_TBLSIZE) { for (i = 0; i < DETECT_SM_LIST_DETECT_MAX; i++) { SigMatch *sm = tmp_s->sm_lists[i]; while (sm != NULL) { if (sm->type == prefilter_list) { tmp_s->prefilter_sm = sm; tmp_s->flags |= SIG_FLAG_PREFILTER; SCLogConfig("sid %u: prefilter is on \"%s\"", tmp_s->id, sigmatch_table[sm->type].name); break; } sm = sm->next; } } } } de_ctx->sig_cnt++; } if (!(de_ctx->flags & DE_QUIET)) { SCLogInfo("%" PRIu32 " signatures processed. %" PRIu32 " are IP-only " "rules, %" PRIu32 " are inspecting packet payload, %"PRIu32 " inspect application layer, %"PRIu32" are decoder event only", de_ctx->sig_cnt, cnt_iponly, cnt_payload, cnt_applayer, cnt_deonly); SCLogConfig("building signature grouping structure, stage 1: " "preprocessing rules... complete"); } return 0; error: return -1; } static int PortGroupWhitelist(const DetectPort *a) { return a->sh->init->whitelist; } int CreateGroupedPortListCmpCnt(DetectPort *a, DetectPort *b) { if (PortGroupWhitelist(a) && !PortGroupWhitelist(b)) { SCLogDebug("%u:%u (cnt %u, wl %d) wins against %u:%u (cnt %u, wl %d)", a->port, a->port2, a->sh->sig_cnt, PortGroupWhitelist(a), b->port, b->port2, b->sh->sig_cnt, PortGroupWhitelist(b)); return 1; } else if (!PortGroupWhitelist(a) && PortGroupWhitelist(b)) { SCLogDebug("%u:%u (cnt %u, wl %d) loses against %u:%u (cnt %u, wl %d)", a->port, a->port2, a->sh->sig_cnt, PortGroupWhitelist(a), b->port, b->port2, b->sh->sig_cnt, PortGroupWhitelist(b)); return 0; } else if (PortGroupWhitelist(a) > PortGroupWhitelist(b)) { SCLogDebug("%u:%u (cnt %u, wl %d) wins against %u:%u (cnt %u, wl %d)", a->port, a->port2, a->sh->sig_cnt, PortGroupWhitelist(a), b->port, b->port2, b->sh->sig_cnt, PortGroupWhitelist(b)); return 1; } else if (PortGroupWhitelist(a) == PortGroupWhitelist(b)) { if (a->sh->sig_cnt > b->sh->sig_cnt) { SCLogDebug("%u:%u (cnt %u, wl %d) wins against %u:%u (cnt %u, wl %d)", a->port, a->port2, a->sh->sig_cnt, PortGroupWhitelist(a), b->port, b->port2, b->sh->sig_cnt, PortGroupWhitelist(b)); return 1; } } SCLogDebug("%u:%u (cnt %u, wl %d) loses against %u:%u (cnt %u, wl %d)", a->port, a->port2, a->sh->sig_cnt, PortGroupWhitelist(a), b->port, b->port2, b->sh->sig_cnt, PortGroupWhitelist(b)); return 0; } /** \internal * \brief Create a list of DetectPort objects sorted based on CompareFunc's * logic. * * List can limit the number of groups. In this case an extra "join" group * is created that contains the sigs belonging to that. It's *appended* to * the list, meaning that if the list is walked linearly it's found last. * The joingr is meant to be a catch all. * */ int CreateGroupedPortList(DetectEngineCtx *de_ctx, DetectPort *port_list, DetectPort **newhead, uint32_t unique_groups, int (*CompareFunc)(DetectPort *, DetectPort *), uint32_t max_idx) { DetectPort *tmplist = NULL, *joingr = NULL; char insert = 0; uint32_t groups = 0; DetectPort *list; /* insert the addresses into the tmplist, where it will * be sorted descending on 'cnt' and on wehther a group * is whitelisted. */ DetectPort *oldhead = port_list; while (oldhead) { /* take the top of the list */ list = oldhead; oldhead = oldhead->next; list->next = NULL; groups++; SigGroupHeadSetSigCnt(list->sh, max_idx); /* insert it */ DetectPort *tmpgr = tmplist, *prevtmpgr = NULL; if (tmplist == NULL) { /* empty list, set head */ tmplist = list; } else { /* look for the place to insert */ for ( ; tmpgr != NULL && !insert; tmpgr = tmpgr->next) { if (CompareFunc(list, tmpgr) == 1) { if (tmpgr == tmplist) { list->next = tmplist; tmplist = list; SCLogDebug("new list top: %u:%u", tmplist->port, tmplist->port2); } else { list->next = prevtmpgr->next; prevtmpgr->next = list; } insert = 1; break; } prevtmpgr = tmpgr; } if (insert == 0) { list->next = NULL; prevtmpgr->next = list; } insert = 0; } } uint32_t left = unique_groups; if (left == 0) left = groups; /* create another list: take the port groups from above * and add them to the 2nd list until we have met our * count. The rest is added to the 'join' group. */ DetectPort *tmplist2 = NULL, *tmplist2_tail = NULL; DetectPort *gr, *next_gr; for (gr = tmplist; gr != NULL; ) { next_gr = gr->next; SCLogDebug("temp list gr %p %u:%u", gr, gr->port, gr->port2); DetectPortPrint(gr); /* if we've set up all the unique groups, add the rest to the * catch-all joingr */ if (left == 0) { if (joingr == NULL) { DetectPortParse(de_ctx, &joingr, "0:65535"); if (joingr == NULL) { goto error; } SCLogDebug("joingr => %u-%u", joingr->port, joingr->port2); joingr->next = NULL; } SigGroupHeadCopySigs(de_ctx,gr->sh,&joingr->sh); /* when a group's sigs are added to the joingr, we can free it */ gr->next = NULL; DetectPortFree(gr); gr = NULL; /* append */ } else { gr->next = NULL; if (tmplist2 == NULL) { tmplist2 = gr; tmplist2_tail = gr; } else { tmplist2_tail->next = gr; tmplist2_tail = gr; } } if (left > 0) left--; gr = next_gr; } /* if present, append the joingr that covers the rest */ if (joingr != NULL) { SCLogDebug("appending joingr %p %u:%u", joingr, joingr->port, joingr->port2); if (tmplist2 == NULL) { tmplist2 = joingr; //tmplist2_tail = joingr; } else { tmplist2_tail->next = joingr; //tmplist2_tail = joingr; } } else { SCLogDebug("no joingr"); } /* pass back our new list to the caller */ *newhead = tmplist2; DetectPortPrintList(*newhead); return 0; error: return -1; } /** * \internal * \brief add a decoder event signature to the detection engine ctx */ static void DetectEngineAddDecoderEventSig(DetectEngineCtx *de_ctx, Signature *s) { SCLogDebug("adding signature %"PRIu32" to the decoder event sgh", s->id); SigGroupHeadAppendSig(de_ctx, &de_ctx->decoder_event_sgh, s); } /** * \brief Fill the global src group head, with the sigs included * * \param de_ctx Pointer to the Detection Engine Context whose Signatures have * to be processed * * \retval 0 On success * \retval -1 On failure */ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) { Signature *tmp_s = NULL; uint32_t sigs = 0; if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("building signature grouping structure, stage 2: " "building source address lists..."); } IPOnlyInit(de_ctx, &de_ctx->io_ctx); de_ctx->flow_gh[1].tcp = RulesGroupByPorts(de_ctx, IPPROTO_TCP, SIG_FLAG_TOSERVER); de_ctx->flow_gh[0].tcp = RulesGroupByPorts(de_ctx, IPPROTO_TCP, SIG_FLAG_TOCLIENT); de_ctx->flow_gh[1].udp = RulesGroupByPorts(de_ctx, IPPROTO_UDP, SIG_FLAG_TOSERVER); de_ctx->flow_gh[0].udp = RulesGroupByPorts(de_ctx, IPPROTO_UDP, SIG_FLAG_TOCLIENT); /* Setup the other IP Protocols (so not TCP/UDP) */ RulesGroupByProto(de_ctx); /* now for every rule add the source group to our temp lists */ for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) { SCLogDebug("tmp_s->id %"PRIu32, tmp_s->id); if (tmp_s->flags & SIG_FLAG_IPONLY) { IPOnlyAddSignature(de_ctx, &de_ctx->io_ctx, tmp_s); } if (tmp_s->init_flags & SIG_FLAG_INIT_DEONLY) { DetectEngineAddDecoderEventSig(de_ctx, tmp_s); } sigs++; } IPOnlyPrepare(de_ctx); IPOnlyPrint(de_ctx, &de_ctx->io_ctx); return 0; } static void DetectEngineBuildDecoderEventSgh(DetectEngineCtx *de_ctx) { if (de_ctx->decoder_event_sgh == NULL) return; uint32_t max_idx = DetectEngineGetMaxSigId(de_ctx); SigGroupHeadSetSigCnt(de_ctx->decoder_event_sgh, max_idx); SigGroupHeadBuildMatchArray(de_ctx, de_ctx->decoder_event_sgh, max_idx); } int SigAddressPrepareStage3(DetectEngineCtx *de_ctx) { /* prepare the decoder event sgh */ DetectEngineBuildDecoderEventSgh(de_ctx); return 0; } int SigAddressCleanupStage1(DetectEngineCtx *de_ctx) { BUG_ON(de_ctx == NULL); if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("cleaning up signature grouping structure..."); } if (de_ctx->decoder_event_sgh) SigGroupHeadFree(de_ctx->decoder_event_sgh); de_ctx->decoder_event_sgh = NULL; int f; for (f = 0; f < FLOW_STATES; f++) { int p; for (p = 0; p < 256; p++) { de_ctx->flow_gh[f].sgh[p] = NULL; } /* free lookup lists */ DetectPortCleanupList(de_ctx->flow_gh[f].tcp); de_ctx->flow_gh[f].tcp = NULL; DetectPortCleanupList(de_ctx->flow_gh[f].udp); de_ctx->flow_gh[f].udp = NULL; } uint32_t idx; for (idx = 0; idx < de_ctx->sgh_array_cnt; idx++) { SigGroupHead *sgh = de_ctx->sgh_array[idx]; if (sgh == NULL) continue; SCLogDebug("sgh %p", sgh); SigGroupHeadFree(sgh); } SCFree(de_ctx->sgh_array); de_ctx->sgh_array = NULL; de_ctx->sgh_array_cnt = 0; de_ctx->sgh_array_size = 0; IPOnlyDeinit(de_ctx, &de_ctx->io_ctx); if (!(de_ctx->flags & DE_QUIET)) { SCLogInfo("cleaning up signature grouping structure... complete"); } return 0; } void DbgPrintSigs(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { if (sgh == NULL) { printf("\n"); return; } uint32_t sig; for (sig = 0; sig < sgh->sig_cnt; sig++) { printf("%" PRIu32 " ", sgh->match_array[sig]->id); } printf("\n"); } void DbgPrintSigs2(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { if (sgh == NULL || sgh->init == NULL) { printf("\n"); return; } uint32_t sig; for (sig = 0; sig < DetectEngineGetMaxSigId(de_ctx); sig++) { if (sgh->init->sig_array[(sig/8)] & (1<<(sig%8))) { printf("%" PRIu32 " ", de_ctx->sig_array[sig]->id); } } printf("\n"); } void DbgSghContainsSig(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid) { if (sgh == NULL || sgh->init == NULL) { printf("\n"); return; } uint32_t sig; for (sig = 0; sig < DetectEngineGetMaxSigId(de_ctx); sig++) { if (!(sgh->init->sig_array[(sig/8)] & (1<<(sig%8)))) continue; Signature *s = de_ctx->sig_array[sig]; if (s == NULL) continue; if (sid == s->id) { printf("%" PRIu32 " ", de_ctx->sig_array[sig]->id); } } printf("\n"); } /** \brief finalize preparing sgh's */ int SigAddressPrepareStage4(DetectEngineCtx *de_ctx) { SCEnter(); //SCLogInfo("sgh's %"PRIu32, de_ctx->sgh_array_cnt); uint32_t cnt = 0; uint32_t idx = 0; for (idx = 0; idx < de_ctx->sgh_array_cnt; idx++) { SigGroupHead *sgh = de_ctx->sgh_array[idx]; if (sgh == NULL) continue; SCLogDebug("sgh %p", sgh); SigGroupHeadSetFilemagicFlag(de_ctx, sgh); SigGroupHeadSetFileHashFlag(de_ctx, sgh); SigGroupHeadSetFilesizeFlag(de_ctx, sgh); SigGroupHeadSetFilestoreCount(de_ctx, sgh); SCLogDebug("filestore count %u", sgh->filestore_cnt); PrefilterSetupRuleGroup(de_ctx, sgh); SigGroupHeadBuildNonPrefilterArray(de_ctx, sgh); sgh->id = idx; cnt++; } SCLogPerf("Unique rule groups: %u", cnt); MpmStoreReportStats(de_ctx); if (de_ctx->decoder_event_sgh != NULL) { /* no need to set filestore count here as that would make a * signature not decode event only. */ } /* cleanup the hashes now since we won't need them * after the initialization phase. */ SigGroupHeadHashFree(de_ctx); int dump_grouping = 0; (void)ConfGetBool("detect.profiling.grouping.dump-to-disk", &dump_grouping); if (dump_grouping) { int add_rules = 0; (void)ConfGetBool("detect.profiling.grouping.include-rules", &add_rules); int add_mpm_stats = 0; (void)ConfGetBool("detect.profiling.grouping.include-mpm-stats", &add_rules); RulesDumpGrouping(de_ctx, add_rules, add_mpm_stats); } #ifdef PROFILING SCProfilingSghInitCounters(de_ctx); #endif SCReturnInt(0); } static int SigMatchListLen(SigMatch *sm) { int len = 0; for (; sm != NULL; sm = sm->next) len++; return len; } static int SigMatchPrepare(DetectEngineCtx *de_ctx) { SCEnter(); Signature *s = de_ctx->sig_list; for (; s != NULL; s = s->next) { int type; for (type = 0; type < DETECT_SM_LIST_MAX; type++) { SigMatch *sm = s->sm_lists[type]; int len = SigMatchListLen(sm); if (len == 0) s->sm_arrays[type] = NULL; else { SigMatchData *smd = (SigMatchData*)SCMalloc(len * sizeof(SigMatchData)); if (smd == NULL) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } /* Copy sm type and Context into array */ s->sm_arrays[type] = smd; for (; sm != NULL; sm = sm->next, smd++) { smd->type = sm->type; smd->ctx = sm->ctx; smd->is_last = (sm->next == NULL); } } } DetectEngineAppInspectionEngine2Signature(s); } SCReturnInt(0); } /** * \brief Convert the signature list into the runtime match structure. * * \param de_ctx Pointer to the Detection Engine Context whose Signatures have * to be processed * * \retval 0 On Success. * \retval -1 On failure. */ int SigGroupBuild(DetectEngineCtx *de_ctx) { Signature *s = de_ctx->sig_list; /* Assign the unique order id of signatures after sorting, * so the IP Only engine process them in order too. Also * reset the old signums and assign new signums. We would * have experienced Sig reordering by now, hence the new * signums. */ de_ctx->signum = 0; while (s != NULL) { s->num = de_ctx->signum++; s = s->next; } if (DetectSetFastPatternAndItsId(de_ctx) < 0) return -1; SigInitStandardMpmFactoryContexts(de_ctx); if (SigAddressPrepareStage1(de_ctx) != 0) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } if (SigAddressPrepareStage2(de_ctx) != 0) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } if (SigAddressPrepareStage3(de_ctx) != 0) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } if (SigAddressPrepareStage4(de_ctx) != 0) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } #ifdef __SC_CUDA_SUPPORT__ if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) { /* setting it to default. You've gotta remove it once you fix the state table thing */ SCACConstructBoth16and32StateTables(); MpmCudaConf *conf = CudaHandlerGetCudaProfile("mpm"); CUcontext cuda_context = CudaHandlerModuleGetContext(MPM_AC_CUDA_MODULE_NAME, conf->device_id); if (cuda_context == 0) { SCLogError(SC_ERR_FATAL, "cuda context is NULL."); exit(EXIT_FAILURE); } int r = SCCudaCtxPushCurrent(cuda_context); if (r < 0) { SCLogError(SC_ERR_FATAL, "context push failed."); exit(EXIT_FAILURE); } } if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) { int r = SCCudaCtxPopCurrent(NULL); if (r < 0) { SCLogError(SC_ERR_FATAL, "cuda context pop failure."); exit(EXIT_FAILURE); } } /* too late to call this either ways. Should be called post ac goto. * \todo Support this. */ DetermineCudaStateTableSize(de_ctx); } #endif DetectMpmPrepareBuiltinMpms(de_ctx); DetectMpmPrepareAppMpms(de_ctx); if (SigMatchPrepare(de_ctx) != 0) { SCLogError(SC_ERR_DETECT_PREPARE, "initializing the detection engine failed"); exit(EXIT_FAILURE); } #ifdef PROFILING SCProfilingRuleInitCounters(de_ctx); #endif SCFree(de_ctx->app_mpms); de_ctx->app_mpms = NULL; return 0; } int SigGroupCleanup (DetectEngineCtx *de_ctx) { SigAddressCleanupStage1(de_ctx); return 0; } static void PrintFeatureList(const SigTableElmt *e, char sep) { const uint8_t flags = e->flags; int prev = 0; if (flags & SIGMATCH_NOOPT) { printf("No option"); prev = 1; } if (flags & SIGMATCH_IPONLY_COMPAT) { if (prev == 1) printf("%c", sep); printf("compatible with IP only rule"); prev = 1; } if (flags & SIGMATCH_DEONLY_COMPAT) { if (prev == 1) printf("%c", sep); printf("compatible with decoder event only rule"); prev = 1; } if (flags & SIGMATCH_PAYLOAD) { if (prev == 1) printf("%c", sep); printf("payload inspecting keyword"); prev = 1; } if (e->SupportsPrefilter) { if (prev == 1) printf("%c", sep); printf("prefilter"); prev = 1; } if (prev == 0) { printf("none"); } } static void SigMultilinePrint(int i, char *prefix) { if (sigmatch_table[i].desc) { printf("%sDescription: %s\n", prefix, sigmatch_table[i].desc); } printf("%sFeatures: ", prefix); PrintFeatureList(&sigmatch_table[i], ','); if (sigmatch_table[i].url) { printf("\n%sDocumentation: %s", prefix, sigmatch_table[i].url); } printf("\n"); } void SigTableList(const char *keyword) { size_t size = sizeof(sigmatch_table) / sizeof(SigTableElmt); size_t i; if (keyword == NULL) { printf("=====Supported keywords=====\n"); for (i = 0; i < size; i++) { if (sigmatch_table[i].name != NULL) { if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) { printf("- %s (not built-in)\n", sigmatch_table[i].name); } else { printf("- %s\n", sigmatch_table[i].name); } } } } else if (strcmp("csv", keyword) == 0) { printf("name;description;app layer;features;documentation\n"); for (i = 0; i < size; i++) { if (sigmatch_table[i].name != NULL) { if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) { continue; } printf("%s;", sigmatch_table[i].name); if (sigmatch_table[i].desc) { printf("%s", sigmatch_table[i].desc); } /* Build feature */ printf(";Unset;"); // this used to be alproto PrintFeatureList(&sigmatch_table[i], ':'); printf(";"); if (sigmatch_table[i].url) { printf("%s", sigmatch_table[i].url); } printf(";"); printf("\n"); } } } else if (strcmp("all", keyword) == 0) { for (i = 0; i < size; i++) { if (sigmatch_table[i].name != NULL) { printf("%s:\n", sigmatch_table[i].name); SigMultilinePrint(i, "\t"); } } } else { for (i = 0; i < size; i++) { if ((sigmatch_table[i].name != NULL) && strcmp(sigmatch_table[i].name, keyword) == 0) { printf("= %s =\n", sigmatch_table[i].name); if (sigmatch_table[i].flags & SIGMATCH_NOT_BUILT) { printf("Not built-in\n"); return; } SigMultilinePrint(i, ""); return; } } } return; } void SigTableSetup(void) { memset(sigmatch_table, 0, sizeof(sigmatch_table)); DetectSidRegister(); DetectPriorityRegister(); DetectPrefilterRegister(); DetectRevRegister(); DetectClasstypeRegister(); DetectReferenceRegister(); DetectTagRegister(); DetectThresholdRegister(); DetectMetadataRegister(); DetectMsgRegister(); DetectAckRegister(); DetectSeqRegister(); DetectContentRegister(); DetectUricontentRegister(); /* NOTE: the order of these currently affects inspect * engine registration order and ultimately the order * of inspect engines in the rule. Which in turn affects * state keeping */ DetectHttpUriRegister(); DetectHttpRequestLineRegister(); DetectHttpClientBodyRegister(); DetectHttpResponseLineRegister(); DetectHttpServerBodyRegister(); DetectHttpHeaderRegister(); DetectHttpRawHeaderRegister(); DetectHttpMethodRegister(); DetectHttpCookieRegister(); DetectHttpRawUriRegister(); DetectFilenameRegister(); DetectFileextRegister(); DetectFilestoreRegister(); DetectFilemagicRegister(); DetectFileMd5Register(); DetectFileSha1Register(); DetectFileSha256Register(); DetectFilesizeRegister(); DetectHttpUARegister(); DetectHttpHHRegister(); DetectHttpHRHRegister(); DetectHttpStatMsgRegister(); DetectHttpStatCodeRegister(); DetectDnsQueryRegister(); DetectModbusRegister(); DetectCipServiceRegister(); DetectEnipCommandRegister(); DetectDNP3Register(); DetectTlsSniRegister(); DetectTlsIssuerRegister(); DetectTlsSubjectRegister(); DetectAppLayerEventRegister(); /* end of order dependent regs */ DetectPcreRegister(); DetectDepthRegister(); DetectNocaseRegister(); DetectRawbytesRegister(); DetectBytetestRegister(); DetectBytejumpRegister(); DetectSameipRegister(); DetectGeoipRegister(); DetectL3ProtoRegister(); DetectIPProtoRegister(); DetectWithinRegister(); DetectDistanceRegister(); DetectOffsetRegister(); DetectReplaceRegister(); DetectFlowRegister(); DetectWindowRegister(); DetectRpcRegister(); DetectFtpbounceRegister(); DetectIsdataatRegister(); DetectIdRegister(); DetectDsizeRegister(); DetectFlowvarRegister(); DetectFlowintRegister(); DetectPktvarRegister(); DetectNoalertRegister(); DetectFlowbitsRegister(); DetectHostbitsRegister(); DetectXbitsRegister(); DetectEngineEventRegister(); DetectIpOptsRegister(); DetectFlagsRegister(); DetectFragBitsRegister(); DetectFragOffsetRegister(); DetectGidRegister(); DetectMarkRegister(); DetectCsumRegister(); DetectStreamSizeRegister(); DetectTtlRegister(); DetectTosRegister(); DetectFastPatternRegister(); DetectITypeRegister(); DetectICodeRegister(); DetectIcmpIdRegister(); DetectIcmpSeqRegister(); DetectDceIfaceRegister(); DetectDceOpnumRegister(); DetectDceStubDataRegister(); DetectTlsRegister(); DetectTlsValidityRegister(); DetectTlsVersionRegister(); DetectUrilenRegister(); DetectDetectionFilterRegister(); DetectAsn1Register(); DetectSshVersionRegister(); DetectSshSoftwareVersionRegister(); DetectSslStateRegister(); DetectSslVersionRegister(); DetectByteExtractRegister(); DetectFiledataRegister(); DetectPktDataRegister(); DetectLuaRegister(); DetectIPRepRegister(); DetectAppLayerProtocolRegister(); DetectBase64DecodeRegister(); DetectBase64DataRegister(); DetectTemplateRegister(); DetectTemplateBufferRegister(); DetectBypassRegister(); DetectHttpRequestLineRegister(); DetectHttpResponseLineRegister(); } void SigTableRegisterTests(void) { /* register the tests */ int i = 0; for (i = 0; i < DETECT_TBLSIZE; i++) { g_ut_modules++; if (sigmatch_table[i].RegisterTests != NULL) { sigmatch_table[i].RegisterTests(); g_ut_covered++; } else { SCLogDebug("detection plugin %s has no unittest " "registration function.", sigmatch_table[i].name); if (coverage_unittests) SCLogWarning(SC_WARN_NO_UNITTESTS, "detection plugin %s has no unittest " "registration function.", sigmatch_table[i].name); } } } /* * TESTS */ #ifdef UNITTESTS #include "flow-util.h" #include "stream-tcp-reassemble.h" static const char *dummy_conf_string = "%YAML 1.1\n" "---\n" "\n" "default-log-dir: /var/log/suricata\n" "\n" "logging:\n" "\n" " default-log-level: debug\n" "\n" " default-format: \"<%t> - <%l>\"\n" "\n" " default-startup-message: Your IDS has started.\n" "\n" " default-output-filter:\n" "\n" " output:\n" "\n" " - interface: console\n" " log-level: info\n" "\n" " - interface: file\n" " filename: /var/log/suricata.log\n" "\n" " - interface: syslog\n" " facility: local5\n" " format: \"%l\"\n" "\n" "pfring:\n" "\n" " interface: eth0\n" "\n" " clusterid: 99\n" "\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:" "13c5:5AFE::/64,2001:888:13c5:CAFE::/64]\"\n" "\n" " EXTERNAL_NET: \"[!192.168.0.0/16,2000::/3]\"\n" "\n" " HTTP_SERVERS: \"!192.168.0.0/16\"\n" "\n" " SMTP_SERVERS: \"!192.168.0.0/16\"\n" "\n" " SQL_SERVERS: \"!192.168.0.0/16\"\n" "\n" " DNS_SERVERS: any\n" "\n" " TELNET_SERVERS: any\n" "\n" " AIM_SERVERS: any\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n" " SHELLCODE_PORTS: 80\n" "\n" " ORACLE_PORTS: 1521\n" "\n" " SSH_PORTS: 22\n" "\n"; static int SigTest01 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); int result = 0; char sig[] = "alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"; if (UTHPacketMatchSigMpm(p, sig, MPM_AC) == 0) { result = 0; goto end; } #if 0 //printf("URI0 \"%s\", len %" PRIu32 "\n", p.http_uri.raw[0], p.http_uri.raw_size[0]); //printf("URI1 \"%s\", len %" PRIu32 "\n", p.http_uri.raw[1], p.http_uri.raw_size[1]); if (p->http_uri.raw_size[0] == 5 && memcmp(p->http_uri.raw[0], "/one/", 5) == 0 && p->http_uri.raw_size[1] == 5 && memcmp(p->http_uri.raw[1], "/two/", 5) == 0) { result = 1; } #endif result = 1; end: if (p != NULL) UTHFreePacket(p); return result; } static int SigTest02 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP); char sig[] = "alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host: one.example.org\"; offset:20; depth:41; sid:1;)"; int ret = UTHPacketMatchSigMpm(p, sig, MPM_AC); UTHFreePacket(p); return ret; } static int SigTest03 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host: one.example.org\"; offset:20; depth:39; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTest04 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" /* 20*/ "Host: one.example.org\r\n" /* 23, post "Host:" 18 */ "\r\n\r\n" /* 4 */ "GET /two/ HTTP/1.1\r\n" /* 20 */ "Host: two.example.org\r\n" /* 23 */ "\r\n\r\n"; /* 4 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host:\"; offset:20; depth:25; content:\"Host:\"; distance:42; within:47; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTest05 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.1\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP TEST\"; content:\"Host:\"; offset:20; depth:25; content:\"Host:\"; distance:48; within:52; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { result = 1; } else { printf("sig matched but shouldn't have: "); } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTest06 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.1\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"two\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 1; else printf("sid:1 %s, sid:2 %s: ", PacketAlertCheck(p, 1) ? "OK" : "FAIL", PacketAlertCheck(p, 2) ? "OK" : "FAIL"); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SigTest07 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.1\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"three\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 0; else result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FlowCleanupAppLayer(&f); FLOW_DESTROY(&f); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); return result; } static int SigTest08 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.0\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.0\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&f, 0, sizeof(Flow)); memset(&th_v, 0, sizeof(th_v)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"one\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 1; else printf("sid:1 %s, sid:2 %s: ", PacketAlertCheck(p, 1) ? "OK" : "FAIL", PacketAlertCheck(p, 2) ? "OK" : "FAIL"); end: FlowCleanupAppLayer(&f); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SigTest09 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.0\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.0\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI test\"; uricontent:\"two\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 1; else result = 0; end: FlowCleanupAppLayer(&f); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SigTest10 (void) { uint8_t *buf = (uint8_t *) "ABC"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Long content test (1)\"; content:\"ABCD\"; depth:4; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Long content test (2)\"; content:\"VWXYZ\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, buf, buflen); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 0; else result = 1; end: FlowCleanupAppLayer(&f); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SigTest11 (void) { uint8_t *buf = (uint8_t *) "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; Flow f; TcpSession ssn; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (content:\"ABCDEFGHIJ\"; content:\"klmnop\"; content:\"1234\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (content:\"VWXYZabcde\"; content:\"5678\"; content:\"89\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) && PacketAlertCheck(p, 2)) result = 1; end: FlowCleanupAppLayer(&f); SigGroupCleanup(de_ctx); if (det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); return result; } static int SigTest12 (void) { uint8_t *buf = (uint8_t *) "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Flow f; memset(&f, 0, sizeof(Flow)); FLOW_INITIALIZE(&f); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"klmnop\"; content:\"1234\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; else result = 0; if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); end: UTHFreePackets(&p, 1); if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); } FLOW_DESTROY(&f); return result; } static int SigTest13 (void) { uint8_t *buf = (uint8_t *) "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Flow f; memset(&f, 0, sizeof(Flow)); FLOW_INITIALIZE(&f); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"1234\"; content:\"klmnop\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; else result = 0; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); FLOW_DESTROY(&f); return result; } static int SigTest14 (void) { uint8_t *buf = (uint8_t *) "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Content order test\"; content:\"ABCDEFGHIJ\"; content:\"1234\"; content:\"klmnop\"; distance:0; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 0; else result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTest15 (void) { uint8_t *buf = (uint8_t *) "CONNECT 213.92.8.7:31204 HTTP/1.1"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->dp = 80; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any !$HTTP_PORTS (msg:\"ET POLICY Inbound HTTP CONNECT Attempt on Off-Port\"; content:\"CONNECT \"; nocase; depth:8; content:\" HTTP/1.\"; nocase; within:1000; sid:2008284; rev:2;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 2008284)) result = 0; else result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return result; } static int SigTest16 (void) { uint8_t *buf = (uint8_t *) "CONNECT 213.92.8.7:31204 HTTP/1.1"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(&p, 0, sizeof(p)); p = UTHBuildPacketSrcDstPorts((uint8_t *)buf, buflen, IPPROTO_TCP, 12345, 1234); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any !$HTTP_PORTS (msg:\"ET POLICY Inbound HTTP CONNECT Attempt on Off-Port\"; content:\"CONNECT \"; nocase; depth:8; content:\" HTTP/1.\"; nocase; within:1000; sid:2008284; rev:2;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 2008284)) result = 1; else printf("sid:2008284 %s: ", PacketAlertCheck(p, 2008284) ? "OK" : "FAIL"); SigGroupCleanup(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); UTHFreePackets(&p, 1); return result; } static int SigTest17 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" /* 20 */ "Host: one.example.org\r\n" /* 23, 43 */ "\r\n\r\n" /* 4, 47 */ "GET /two/ HTTP/1.1\r\n" /* 20, 67 */ "Host: two.example.org\r\n" /* 23, 90 */ "\r\n\r\n"; /* 4, 94 */ uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacketSrcDstPorts((uint8_t *)buf, buflen, IPPROTO_TCP, 12345, 80); ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any $HTTP_PORTS (msg:\"HTTP host cap\"; content:\"Host:\"; pcre:\"/^Host: (?P.*)\\r\\n/m\"; noalert; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); PktVar *pv_hn = PktVarGet(p, "http_host"); if (pv_hn != NULL) { if (memcmp(pv_hn->value, "one.example.org", pv_hn->value_len < 15 ? pv_hn->value_len : 15) == 0) result = 1; else { printf("\""); PrintRawUriFp(stdout, pv_hn->value, pv_hn->value_len); printf("\" != \"one.example.org\": "); } PktVarFree(pv_hn); } else { printf("Pkt var http_host not captured: "); } end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } ConfDeInit(); ConfRestoreContextBackup(); UTHFreePackets(&p, 1); return result; } static int SigTest18 (void) { uint8_t *buf = (uint8_t *) "220 (vsFTPd 2.0.5)\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->dp = 34260; p->sp = 21; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any !21:902 -> any any (msg:\"ET MALWARE Suspicious 220 Banner on Local Port\"; content:\"220\"; offset:0; depth:4; pcre:\"/220[- ]/\"; sid:2003055; rev:4;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 2003055)) result = 1; else printf("signature shouldn't match, but did: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } static int SigTest19 (void) { uint8_t *buf = (uint8_t *) "220 (vsFTPd 2.0.5)\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4"); p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->dp = 34260; p->sp = 21; p->flowflags |= FLOW_PKT_TOSERVER; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert ip $HOME_NET any -> 1.2.3.4 any (msg:\"IP-ONLY test (1)\"; sid:999; rev:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 999)) result = 1; else printf("signature didn't match, but should have: "); SigGroupCleanup(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return result; } static int SigTest20 (void) { uint8_t *buf = (uint8_t *) "220 (vsFTPd 2.0.5)\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4"); p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->dp = 34260; p->sp = 21; p->flowflags |= FLOW_PKT_TOSERVER; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert ip $HOME_NET any -> [99.99.99.99,1.2.3.0/24,1.1.1.1,3.0.0.0/8] any (msg:\"IP-ONLY test (2)\"; sid:999; rev:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 999)) result = 1; else printf("signature didn't match, but should have: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); SCFree(p); return result; } static int SigTest21 (void) { ThreadVars th_v; memset(&th_v, 0, sizeof(th_v)); DetectEngineThreadCtx *det_ctx = NULL; int result = 0; Flow f; memset(&f, 0, sizeof(f)); FLOW_INITIALIZE(&f); /* packet 1 */ uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf1len = strlen((char *)buf1); Packet *p1 = NULL; /* packet 2 */ uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf2len = strlen((char *)buf2); Packet *p2 = NULL; p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP); p1->flow = &f; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP); p2->flow = &f; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:set,TEST.one; flowbits:noalert; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.one; sid:2;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 alerted, but shouldn't: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) { printf("sid 2 didn't alert, but should have: "); goto end; } result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } } DetectEngineCtxFree(de_ctx); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); FLOW_DESTROY(&f); return result; } static int SigTest22 (void) { ThreadVars th_v; memset(&th_v, 0, sizeof(th_v)); DetectEngineThreadCtx *det_ctx = NULL; int result = 0; Flow f; memset(&f, 0, sizeof(f)); FLOW_INITIALIZE(&f); /* packet 1 */ uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf1len = strlen((char *)buf1); Packet *p1 = NULL; p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP); p1->flow = &f; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; /* packet 2 */ uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf2len = strlen((char *)buf2); Packet *p2 = NULL; p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP); p2->flow = &f; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:set,TEST.one; flowbits:noalert; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.abc; sid:2;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 alerted, but shouldn't: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) result = 1; else printf("sid 2 alerted, but shouldn't: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); FLOW_DESTROY(&f); return result; } static int SigTest23 (void) { ThreadVars th_v; memset(&th_v, 0, sizeof(th_v)); DetectEngineThreadCtx *det_ctx = NULL; int result = 0; Flow f; memset(&f, 0, sizeof(f)); FLOW_INITIALIZE(&f); /* packet 1 */ uint8_t *buf1 = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf1len = strlen((char *)buf1); Packet *p1 = NULL; p1 = UTHBuildPacket((uint8_t *)buf1, buf1len, IPPROTO_TCP); p1->flow = &f; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; /* packet 2 */ uint8_t *buf2 = (uint8_t *)"GET /two/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buf2len = strlen((char *)buf2); Packet *p2 = NULL; p2 = UTHBuildPacket((uint8_t *)buf2, buf2len, IPPROTO_TCP); p2->flow = &f; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT SET\"; content:\"/one/\"; flowbits:toggle,TEST.one; flowbits:noalert; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"FLOWBIT TEST\"; content:\"/two/\"; flowbits:isset,TEST.one; sid:2;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sid 1 alerted, but shouldn't: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result = 1; else printf("sid 2 didn't alert, but should have: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); FLOW_DESTROY(&f); return result; } int SigTest24IPV4Keyword(void) { uint8_t valid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x03}; uint8_t invalid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x06}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); PACKET_RESET_CHECKSUMS(p2); p1->ip4h = (IPV4Hdr *)valid_raw_ipv4; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_TCP; p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4; p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"/one/\"; ipv4-csum:valid; " "msg:\"ipv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig 1 parse: "); goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"/one/\"; ipv4-csum:invalid; " "msg:\"ipv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { printf("sig 2 parse: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("signature 1 didn't match, but should have: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!((PacketAlertCheck(p2, 2)))) { printf("signature 2 didn't match, but should have: "); goto end; } result = 1; end: if (det_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); } SCFree(p1); SCFree(p2); return result; } int SigTest25NegativeIPV4Keyword(void) { uint8_t valid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x03}; uint8_t invalid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0xb7, 0x52, 0xc0, 0xa8, 0x01, 0x03, 0xc0, 0xa8, 0x01, 0x06}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); PACKET_RESET_CHECKSUMS(p2); p1->ip4h = (IPV4Hdr *)valid_raw_ipv4; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_TCP; p2->ip4h = (IPV4Hdr *)invalid_raw_ipv4; p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"/one/\"; ipv4-csum:invalid; " "msg:\"ipv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"/one/\"; ipv4-csum:valid; " "msg:\"ipv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 0; else result &= 1; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 0; else result &= 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest26TCPV4Keyword(void) { uint8_t raw_ipv4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x8e, 0x7e, 0xb2, 0xc0, 0xa8, 0x01, 0x03}; uint8_t valid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0x4A, 0x04, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x02}; uint8_t invalid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x03}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp)); PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp)); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1); p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4)); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20; p1->payload_len = 20; p1->proto = IPPROTO_TCP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2); p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4)); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20; p2->payload_len = 20; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:valid; dsize:20; " "msg:\"tcpv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:invalid; " "msg:\"tcpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sig 1 didn't match: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) { printf("sig 2 didn't match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } /* Test SigTest26TCPV4Keyword but also check for invalid IPV4 checksum */ static int SigTest26TCPV4AndNegativeIPV4Keyword(void) { uint8_t raw_ipv4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x8e, 0x7e, 0xb2, 0xc0, 0xa8, 0x01, 0x03}; uint8_t valid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0x4A, 0x04, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x02}; uint8_t invalid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x03}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp)); PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp)); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1); p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4)); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20; p1->payload_len = 20; p1->proto = IPPROTO_TCP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2); p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4)); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20; p2->payload_len = 20; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:valid; dsize:20; " "ipv4-csum:invalid; " "msg:\"tcpv4-csum and ipv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert ip any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:invalid; " "ipv4-csum:invalid; " "msg:\"tcpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sig 1 didn't match: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) { printf("sig 2 didn't match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } /* Similar to SigTest26, but with different packet */ static int SigTest26TCPV4AndIPV4Keyword(void) { /* IPV4: src:192.168.176.67 dst: 192.168.176.116 * TTL: 64 Flags: Don't Fragment */ uint8_t raw_ipv4[] = { 0x45, 0x00, 0x00, 0x40, 0x9b, 0xa4, 0x40, 0x00, 0x40, 0x06, 0xbd, 0x0a, 0xc0, 0xa8, 0xb0, 0x43, 0xc0, 0xa8, 0xb0, 0x74}; /* TCP: sport: 49517 dport: 445 Flags: SYN * Window size: 65535, checksum: 0x2009, * MTU: 1460, Window scale: 4, TSACK permitted, * 24 bytes of options, no payload. */ uint8_t valid_raw_tcp[] = { 0xc1, 0x6d, 0x01, 0xbd, 0x03, 0x10, 0xd3, 0xc9, 0x00, 0x00, 0x00, 0x00, 0xb0, 0x02, 0xff, 0xff, 0x20, 0x09, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x01, 0x03, 0x03, 0x04, 0x01, 0x01, 0x08, 0x0a, 0x19, 0x69, 0x81, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00}; uint8_t invalid_raw_tcp[] = { 0xc1, 0x6d, 0x01, 0xbd, 0x03, 0x10, 0xd3, 0xc9, 0x00, 0x00, 0x00, 0x00, 0xb0, 0x02, 0xff, 0xff, 0x20, 0x09, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x01, 0x03, 0x03, 0x04, 0x01, 0x01, 0x08, 0x0a, 0x19, 0x69, 0x81, 0x7e, 0xFF, 0xAA, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp)); PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp)); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1); p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4)); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20 + 24; p1->payload_len = 0; p1->proto = IPPROTO_TCP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2); p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4)); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20 + 24; p2->payload_len = 0; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any any " "(tcpv4-csum:valid; " "ipv4-csum:valid; " "msg:\"tcpv4-csum and ipv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert ip any any -> any any " "(tcpv4-csum:invalid; " "ipv4-csum:valid; " "msg:\"tcpv4-csum and ipv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sig 1 didn't match: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) { printf("sig 2 didn't match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } static int SigTest27NegativeTCPV4Keyword(void) { uint8_t raw_ipv4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x8e, 0x7e, 0xb2, 0xc0, 0xa8, 0x01, 0x03}; uint8_t valid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x02}; uint8_t invalid_raw_tcp[] = { 0x00, 0x50, 0x8e, 0x16, 0x0d, 0x59, 0xcd, 0x3c, 0xcf, 0x0d, 0x21, 0x80, 0x50, 0x12, 0x16, 0xa0, 0xfa, 0x03, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x6e, 0x18, 0x78, 0x73, 0x01, 0x71, 0x74, 0xde, 0x01, 0x03, 0x03, 0x03}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PacketCopyData(p1, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p1, GET_PKT_LEN(p1), valid_raw_tcp, sizeof(valid_raw_tcp)); PacketCopyData(p2, raw_ipv4, sizeof(raw_ipv4)); PacketCopyDataOffset(p2, GET_PKT_LEN(p2), invalid_raw_tcp, sizeof(invalid_raw_tcp)); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)GET_PKT_DATA(p1); p1->tcph = (TCPHdr *)(GET_PKT_DATA(p1) + sizeof(raw_ipv4)); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = (uint8_t *)GET_PKT_DATA(p1) + sizeof(raw_ipv4) + 20; p1->payload_len = 20; p1->proto = IPPROTO_TCP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)GET_PKT_DATA(p2); p2->tcph = (TCPHdr *)(GET_PKT_DATA(p2) + sizeof(raw_ipv4)); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = (uint8_t *)GET_PKT_DATA(p2) + sizeof(raw_ipv4) + 20; p2->payload_len = 20; p2->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:invalid; dsize:20; " "msg:\"tcpv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|DE 01 03|\"; tcpv4-csum:valid; dsize:20; " "msg:\"tcpv4-csum keyword check(2)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!PacketAlertCheck(p1, 1)) { printf("sig 1 didn't match on p1: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) { printf("sig 2 matched on p2: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } int SigTest28TCPV6Keyword(void) { static uint8_t valid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c, 0xf2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x27}; static uint8_t invalid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c, 0xc2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x28}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = valid_raw_ipv6 + 54 + 20; p1->payload_len = 12; p1->proto = IPPROTO_TCP; if (TCP_GET_HLEN(p1) != 20) { BUG_ON(1); } PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = invalid_raw_ipv6 + 54 + 20;; p2->payload_len = 12; p2->proto = IPPROTO_TCP; if (TCP_GET_HLEN(p2) != 20) { BUG_ON(1); } DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|00 01 69|\"; tcpv6-csum:valid; dsize:12; " "msg:\"tcpv6-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|00 01 69|\"; tcpv6-csum:invalid; dsize:12; " "msg:\"tcpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 1))) { printf("sid 1 didn't match on p1: "); goto end; } SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 2))) { printf("sid 2 didn't match on p2: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } int SigTest29NegativeTCPV6Keyword(void) { static uint8_t valid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c, 0xf2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x27}; static uint8_t invalid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0x03, 0xfe, 0x00, 0x16, 0xd6, 0x76, 0xf5, 0x2d, 0x0c, 0x7a, 0x08, 0x77, 0x50, 0x10, 0x21, 0x5c, 0xc2, 0xf1, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xca, 0x5a, 0x00, 0x01, 0x69, 0x28}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->tcph = (TCPHdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = valid_raw_ipv6 + 54 + 20; p1->payload_len = 12; p1->proto = IPPROTO_TCP; if (TCP_GET_HLEN(p1) != 20) { BUG_ON(1); } PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->tcph = (TCPHdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = invalid_raw_ipv6 + 54 + 20;; p2->payload_len = 12; p2->proto = IPPROTO_TCP; if (TCP_GET_HLEN(p2) != 20) { BUG_ON(1); } DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|00 01 69|\"; tcpv6-csum:invalid; dsize:12; " "msg:\"tcpv6-csum keyword check(1)\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"|00 01 69|\"; tcpv6-csum:valid; dsize:12; " "msg:\"tcpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) goto end; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) goto end; result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); SCFree(p1); SCFree(p2); return result; } int SigTest30UDPV4Keyword(void) { uint8_t raw_ipv4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0xd0, 0x43, 0xdc, 0xdc, 0xc0, 0xa8, 0x01, 0x03}; uint8_t valid_raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x26}; uint8_t invalid_raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x27}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0yyyyyyyyyyyyyyyy\r\n" "\r\n\r\nyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)raw_ipv4; p1->udph = (UDPHdr *)valid_raw_udp; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN; p1->proto = IPPROTO_UDP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)raw_ipv4; p2->udph = (UDPHdr *)invalid_raw_udp; p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN; p2->proto = IPPROTO_UDP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv4-csum:valid; " "msg:\"udpv4-csum keyword check(1)\"; " "sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv4-csum:invalid; " "msg:\"udpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 1; else result &= 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 1; else result &= 0; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest31NegativeUDPV4Keyword(void) { uint8_t raw_ipv4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x43, 0xdc, 0xdc, 0xc0, 0xa8, 0x01, 0x03}; uint8_t valid_raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x26}; uint8_t invalid_raw_udp[] = { 0x00, 0x35, 0xcf, 0x34, 0x00, 0x55, 0x6c, 0xe0, 0x83, 0xfc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x07, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x32, 0x11, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x73, 0x79, 0x6e, 0x64, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x1c, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x4b, 0x50, 0x00, 0x12, 0x06, 0x70, 0x61, 0x67, 0x65, 0x61, 0x64, 0x01, 0x6c, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0xc0, 0x27}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0yyyyyyyyyyyyyyyy\r\n" "\r\n\r\nyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)raw_ipv4; p1->udph = (UDPHdr *)valid_raw_udp; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = sizeof(valid_raw_udp) - UDP_HEADER_LEN; p1->proto = IPPROTO_UDP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)raw_ipv4; p2->udph = (UDPHdr *)invalid_raw_udp; p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = sizeof(invalid_raw_udp) - UDP_HEADER_LEN; p2->proto = IPPROTO_UDP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv4-csum:invalid; " "msg:\"udpv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv4-csum:valid; " "msg:\"udpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 0; else result &= 1; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) { result &= 0; } else result &= 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest32UDPV6Keyword(void) { static uint8_t valid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x00}; static uint8_t invalid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x01}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP\r\n" "\r\n\r\n"; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN; p1->proto = IPPROTO_UDP; PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN; p2->proto = IPPROTO_UDP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv6-csum:valid; " "msg:\"udpv6-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv6-csum:invalid; " "msg:\"udpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 1; else result &= 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 1; else result &= 0; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest33NegativeUDPV6Keyword(void) { static uint8_t valid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x00}; static uint8_t invalid_raw_ipv6[] = { 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x02, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0xa0, 0x00, 0x14, 0x1a, 0xc3, 0x06, 0x02, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0x57, 0xb0, 0x09, 0x01}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP\r\n" "\r\n\r\n"; memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->udph = (UDPHdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = IPV6_GET_PLEN((p1)) - UDP_HEADER_LEN; p1->proto = IPPROTO_UDP; PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->udph = (UDPHdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = IPV6_GET_PLEN((p2)) - UDP_HEADER_LEN; p2->proto = IPPROTO_UDP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv6-csum:invalid; " "msg:\"udpv6-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert udp any any -> any any " "(content:\"/one/\"; udpv6-csum:valid; " "msg:\"udpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 0; else result &= 1; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 0; else result &= 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest34ICMPV4Keyword(void) { uint8_t valid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01, 0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a, 0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37}; uint8_t invalid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01, 0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a, 0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4); p1->ip4h->ip_verhl = 69; p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_ICMP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4); p2->ip4h->ip_verhl = 69; p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_ICMP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; icmpv4-csum:valid; " "msg:\"icmpv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; icmpv4-csum:invalid; " "msg:\"icmpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 1; else result &= 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 1; else result &= 0; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest35NegativeICMPV4Keyword(void) { uint8_t valid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01, 0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a, 0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37}; uint8_t invalid_raw_ipv4[] = { 0x45, 0x00, 0x00, 0x54, 0x00, 0x00, 0x40, 0x00, 0x40, 0x01, 0x3c, 0xa7, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01, 0x08, 0x00, 0xc3, 0x01, 0x2b, 0x36, 0x00, 0x01, 0x3f, 0x16, 0x9a, 0x4a, 0x41, 0x63, 0x04, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip4h = (IPV4Hdr *)(valid_raw_ipv4); p1->ip4h->ip_verhl = 69; p1->icmpv4h = (ICMPV4Hdr *) (valid_raw_ipv4 + IPV4_GET_RAW_HLEN(p1->ip4h) * 4); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_ICMP; PACKET_RESET_CHECKSUMS(p2); p2->ip4h = (IPV4Hdr *)(invalid_raw_ipv4); p2->ip4h->ip_verhl = 69; p2->icmpv4h = (ICMPV4Hdr *) (invalid_raw_ipv4 + IPV4_GET_RAW_HLEN(p2->ip4h) * 4); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_ICMP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; icmpv4-csum:invalid; " "msg:\"icmpv4-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert icmp any any -> any any " "(content:\"/one/\"; icmpv4-csum:valid; " "msg:\"icmpv4-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 0; else result &= 1; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 0; else { result &= 1; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest36ICMPV6Keyword(void) { uint8_t valid_raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x00}; uint8_t invalid_raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x01}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_ICMPV6; PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_ICMPV6; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmpv6 any any -> any any " "(content:\"/one/\"; icmpv6-csum:valid; " "msg:\"icmpv6-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert icmpv6 any any -> any any " "(content:\"/one/\"; icmpv6-csum:invalid; " "msg:\"icmpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 1; else result &= 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 1; else result &= 0; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } int SigTest37NegativeICMPV6Keyword(void) { uint8_t valid_raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x00}; uint8_t invalid_raw_ipv6[] = { 0x00, 0x00, 0x86, 0x05, 0x80, 0xda, 0x00, 0x60, 0x97, 0x07, 0x69, 0xea, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x44, 0x3a, 0x40, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x60, 0x97, 0xff, 0xfe, 0x07, 0x69, 0xea, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x03, 0x00, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x14, 0x11, 0x01, 0x3f, 0xfe, 0x05, 0x07, 0x00, 0x00, 0x00, 0x01, 0x02, 0x00, 0x86, 0xff, 0xfe, 0x05, 0x80, 0xda, 0x3f, 0xfe, 0x05, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02, 0xc0, 0xdf, 0xff, 0xfe, 0x47, 0x03, 0x3e, 0xa0, 0x75, 0x82, 0x9b, 0x00, 0x14, 0x82, 0x8b, 0x01, 0x01, 0x00, 0x00, 0xf9, 0xc8, 0xe7, 0x36, 0xf5, 0xed, 0x08, 0x01}; Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; Packet *p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) { SCFree(p1); return 0; } ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t *buf = (uint8_t *)"GET /one/ HTTP/1.0\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); memset(p2, 0, SIZE_OF_PACKET); PACKET_RESET_CHECKSUMS(p1); p1->ip6h = (IPV6Hdr *)(valid_raw_ipv6 + 14); p1->icmpv6h = (ICMPV6Hdr *) (valid_raw_ipv6 + 54); p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = buf; p1->payload_len = buflen; p1->proto = IPPROTO_ICMPV6; PACKET_RESET_CHECKSUMS(p2); p2->ip6h = (IPV6Hdr *)(invalid_raw_ipv6 + 14); p2->icmpv6h = (ICMPV6Hdr *) (invalid_raw_ipv6 + 54); p2->src.family = AF_INET; p2->dst.family = AF_INET; p2->payload = buf; p2->payload_len = buflen; p2->proto = IPPROTO_ICMPV6; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert icmpv6 any any -> any any " "(content:\"/one/\"; icmpv6-csum:invalid; " "msg:\"icmpv6-csum keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert icmpv6 any any -> any any " "(content:\"/one/\"; icmpv6-csum:valid; " "msg:\"icmpv6-csum keyword check(1)\"; " "sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) result &= 0; else result &= 1; SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 2)) result &= 0; else result &= 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); SCFree(p2); return result; } static int SigTest38(void) { Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t raw_eth[] = { 0x00, 0x00, 0x03, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00 }; uint8_t raw_ipv4[] = { 0x45, 0x00, 0x00, 0x7d, 0xd8, 0xf3, 0x40, 0x00, 0x40, 0x06, 0x63, 0x85, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01 }; uint8_t raw_tcp[] = { 0xad, 0x22, 0x04, 0x00, 0x16, 0x39, 0x72, 0xe2, 0x16, 0x1f, 0x79, 0x84, 0x80, 0x18, 0x01, 0x01, 0xfe, 0x71, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x22, 0xaa, 0x10, 0x00, 0x22, 0xaa, 0x10 }; uint8_t buf[] = { 0x00, 0x00, 0x00, 0x08, 0x62, 0x6f, 0x6f, 0x65, 0x65, 0x6b, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x31, 0x20, 0x38, 0x0d, 0x0a, 0x66, 0x6f, 0x30, 0x30, /* LEN1|20| ends at 17 */ 0x30, 0x38, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x32, /* "0008" at offset 5 */ 0x20, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x0d, 0x0a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x0d, 0x0a, 0x0d, 0x0a, 0x0d, 0x0a }; uint16_t ethlen = sizeof(raw_eth); uint16_t ipv4len = sizeof(raw_ipv4); uint16_t tcplen = sizeof(raw_tcp); uint16_t buflen = sizeof(buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); /* Copy raw data into packet */ if (PacketCopyData(p1, raw_eth, ethlen) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen, raw_ipv4, ipv4len) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen + ipv4len, raw_tcp, tcplen) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen + ipv4len + tcplen, buf, buflen) == -1) { SCFree(p1); return 1; } SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen); PACKET_RESET_CHECKSUMS(p1); p1->ethh = (EthernetHdr *)raw_eth; p1->ip4h = (IPV4Hdr *)raw_ipv4; p1->tcph = (TCPHdr *)raw_tcp; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = GET_PKT_DATA(p1) + ethlen + ipv4len + tcplen; p1->payload_len = buflen; p1->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"LEN1|20|\"; " "byte_test:4,=,8,0; " "msg:\"byte_test keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"LEN1|20|\"; " "byte_test:4,=,8,5,relative,string,dec; " "msg:\"byte_test keyword check(2)\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { result = 1; } else { result = 0; printf("sid 1 didn't alert, but should have: "); goto cleanup; } if (PacketAlertCheck(p1, 2)) { result = 1; } else { result = 0; printf("sid 2 didn't alert, but should have: "); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); return result; } static int SigTest39(void) { Packet *p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; uint8_t raw_eth[] = { 0x00, 0x00, 0x03, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00 }; uint8_t raw_ipv4[] = { 0x45, 0x00, 0x00, 0x7d, 0xd8, 0xf3, 0x40, 0x00, 0x40, 0x06, 0x63, 0x85, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00, 0x01 }; uint8_t raw_tcp[] = { 0xad, 0x22, 0x04, 0x00, 0x16, 0x39, 0x72, 0xe2, 0x16, 0x1f, 0x79, 0x84, 0x80, 0x18, 0x01, 0x01, 0xfe, 0x71, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x22, 0xaa, 0x10, 0x00, 0x22, 0xaa, 0x10 }; uint8_t buf[] = { 0x00, 0x00, 0x00, 0x08, 0x62, 0x6f, 0x6f, 0x65, 0x65, 0x6b, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x31, 0x20, 0x38, 0x0d, 0x0a, 0x66, 0x30, 0x30, 0x30, 0x38, 0x72, 0x0d, 0x0a, 0x4c, 0x45, 0x4e, 0x32, 0x20, 0x39, 0x39, 0x4c, 0x45, 0x4e, 0x32, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x0d, 0x0a, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x0d, 0x0a, 0x0d, 0x0a, 0x0d, 0x0a }; uint16_t ethlen = sizeof(raw_eth); uint16_t ipv4len = sizeof(raw_ipv4); uint16_t tcplen = sizeof(raw_tcp); uint16_t buflen = sizeof(buf); memset(&th_v, 0, sizeof(ThreadVars)); memset(p1, 0, SIZE_OF_PACKET); /* Copy raw data into packet */ if (PacketCopyData(p1, raw_eth, ethlen) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen, raw_ipv4, ipv4len) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen + ipv4len, raw_tcp, tcplen) == -1) { SCFree(p1); return 1; } if (PacketCopyDataOffset(p1, ethlen + ipv4len + tcplen, buf, buflen) == -1) { SCFree(p1); return 1; } SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen); PACKET_RESET_CHECKSUMS(p1); p1->ethh = (EthernetHdr *)raw_eth; p1->ip4h = (IPV4Hdr *)raw_ipv4; p1->tcph = (TCPHdr *)raw_tcp; p1->src.family = AF_INET; p1->dst.family = AF_INET; p1->payload = GET_PKT_DATA(p1) + ethlen + ipv4len + tcplen; p1->payload_len = buflen; p1->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"LEN1|20|\"; " "byte_test:4,=,8,0; " "byte_jump:4,0; " "byte_test:6,=,0x4c454e312038,0,relative; " "msg:\"byte_jump keyword check(1)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result &= 0; goto end; } // XXX TODO de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any any " "(content:\"LEN1|20|\"; " "byte_test:4,=,8,4,relative,string,dec; " "byte_jump:4,4,relative,string,dec,post_offset 2; " "byte_test:4,=,0x4c454e32,0,relative; " "msg:\"byte_jump keyword check(2)\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result &= 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { result = 1; } else { result = 0; printf("sid 1 didn't alert, but should have: "); goto cleanup; } if (PacketAlertCheck(p1, 2)) { result = 1; } else { result = 0; printf("sid 2 didn't alert, but should have: "); goto cleanup; } cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p1); return result; } /** * \test SigTest36ContentAndIsdataatKeywords01 is a test to check window with constructed packets, * \brief expecting to match a size */ static int SigTest36ContentAndIsdataatKeywords01 (void) { int result = 0; // Buid and decode the packet uint8_t raw_eth [] = { 0x00,0x25,0x00,0x9e,0xfa,0xfe,0x00,0x02,0xcf,0x74,0xfe,0xe1,0x08,0x00,0x45,0x00 ,0x01,0xcc,0xcb,0x91,0x00,0x00,0x34,0x06,0xdf,0xa8,0xd1,0x55,0xe3,0x67,0xc0,0xa8 ,0x64,0x8c,0x00,0x50,0xc0,0xb7,0xd1,0x11,0xed,0x63,0x81,0xa9,0x9a,0x05,0x80,0x18 ,0x00,0x75,0x0a,0xdd,0x00,0x00,0x01,0x01,0x08,0x0a,0x09,0x8a,0x06,0xd0,0x12,0x21 ,0x2a,0x3b,0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20,0x33,0x30,0x32,0x20,0x46 ,0x6f,0x75,0x6e,0x64,0x0d,0x0a,0x4c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3a,0x20 ,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c ,0x65,0x2e,0x65,0x73,0x2f,0x0d,0x0a,0x43,0x61,0x63,0x68,0x65,0x2d,0x43,0x6f,0x6e ,0x74,0x72,0x6f,0x6c,0x3a,0x20,0x70,0x72,0x69,0x76,0x61,0x74,0x65,0x0d,0x0a,0x43 ,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,0x78 ,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x20,0x63,0x68,0x61,0x72,0x73,0x65,0x74,0x3d ,0x55,0x54,0x46,0x2d,0x38,0x0d,0x0a,0x44,0x61,0x74,0x65,0x3a,0x20,0x4d,0x6f,0x6e ,0x2c,0x20,0x31,0x34,0x20,0x53,0x65,0x70,0x20,0x32,0x30,0x30,0x39,0x20,0x30,0x38 ,0x3a,0x34,0x38,0x3a,0x33,0x31,0x20,0x47,0x4d,0x54,0x0d,0x0a,0x53,0x65,0x72,0x76 ,0x65,0x72,0x3a,0x20,0x67,0x77,0x73,0x0d,0x0a,0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74 ,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,0x32,0x31,0x38,0x0d,0x0a,0x0d,0x0a ,0x3c,0x48,0x54,0x4d,0x4c,0x3e,0x3c,0x48,0x45,0x41,0x44,0x3e,0x3c,0x6d,0x65,0x74 ,0x61,0x20,0x68,0x74,0x74,0x70,0x2d,0x65,0x71,0x75,0x69,0x76,0x3d,0x22,0x63,0x6f ,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x22,0x20,0x63,0x6f,0x6e,0x74 ,0x65,0x6e,0x74,0x3d,0x22,0x74,0x65,0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x63 ,0x68,0x61,0x72,0x73,0x65,0x74,0x3d,0x75,0x74,0x66,0x2d,0x38,0x22,0x3e,0x0a,0x3c ,0x54,0x49,0x54,0x4c,0x45,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76,0x65,0x64,0x3c ,0x2f,0x54,0x49,0x54,0x4c,0x45,0x3e,0x3c,0x2f,0x48,0x45,0x41,0x44,0x3e,0x3c,0x42 ,0x4f,0x44,0x59,0x3e,0x0a,0x3c,0x48,0x31,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76 ,0x65,0x64,0x3c,0x2f,0x48,0x31,0x3e,0x0a,0x54,0x68,0x65,0x20,0x64,0x6f,0x63,0x75 ,0x6d,0x65,0x6e,0x74,0x20,0x68,0x61,0x73,0x20,0x6d,0x6f,0x76,0x65,0x64,0x0a,0x3c ,0x41,0x20,0x48,0x52,0x45,0x46,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77 ,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c,0x65,0x2e,0x65,0x73,0x2f,0x22,0x3e,0x68 ,0x65,0x72,0x65,0x3c,0x2f,0x41,0x3e,0x2e,0x0d,0x0a,0x3c,0x2f,0x42,0x4f,0x44,0x59 ,0x3e,0x3c,0x2f,0x48,0x54,0x4d,0x4c,0x3e,0x0d,0x0a }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest36ContentAndIsdataatKeywords01 \"; content:\"HTTP\"; isdataat:404, relative; sid:101;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 101) == 0) { result = 0; goto end; } else { result=1; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; end: if(de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if(det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); //PatternMatchDestroy(mpm_ctx); if(de_ctx) DetectEngineCtxFree(de_ctx); if (p != NULL) PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \test SigTest37ContentAndIsdataatKeywords02 is a test to check window with constructed packets, * \brief not expecting to match a size */ static int SigTest37ContentAndIsdataatKeywords02 (void) { int result = 0; // Buid and decode the packet uint8_t raw_eth [] = { 0x00,0x25,0x00,0x9e,0xfa,0xfe,0x00,0x02,0xcf,0x74,0xfe,0xe1,0x08,0x00,0x45,0x00 ,0x01,0xcc,0xcb,0x91,0x00,0x00,0x34,0x06,0xdf,0xa8,0xd1,0x55,0xe3,0x67,0xc0,0xa8 ,0x64,0x8c,0x00,0x50,0xc0,0xb7,0xd1,0x11,0xed,0x63,0x81,0xa9,0x9a,0x05,0x80,0x18 ,0x00,0x75,0x0a,0xdd,0x00,0x00,0x01,0x01,0x08,0x0a,0x09,0x8a,0x06,0xd0,0x12,0x21 ,0x2a,0x3b,0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20,0x33,0x30,0x32,0x20,0x46 ,0x6f,0x75,0x6e,0x64,0x0d,0x0a,0x4c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x3a,0x20 ,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c ,0x65,0x2e,0x65,0x73,0x2f,0x0d,0x0a,0x43,0x61,0x63,0x68,0x65,0x2d,0x43,0x6f,0x6e ,0x74,0x72,0x6f,0x6c,0x3a,0x20,0x70,0x72,0x69,0x76,0x61,0x74,0x65,0x0d,0x0a,0x43 ,0x6f,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x54,0x79,0x70,0x65,0x3a,0x20,0x74,0x65,0x78 ,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x20,0x63,0x68,0x61,0x72,0x73,0x65,0x74,0x3d ,0x55,0x54,0x46,0x2d,0x38,0x0d,0x0a,0x44,0x61,0x74,0x65,0x3a,0x20,0x4d,0x6f,0x6e ,0x2c,0x20,0x31,0x34,0x20,0x53,0x65,0x70,0x20,0x32,0x30,0x30,0x39,0x20,0x30,0x38 ,0x3a,0x34,0x38,0x3a,0x33,0x31,0x20,0x47,0x4d,0x54,0x0d,0x0a,0x53,0x65,0x72,0x76 ,0x65,0x72,0x3a,0x20,0x67,0x77,0x73,0x0d,0x0a,0x43,0x6f,0x6e,0x74,0x65,0x6e,0x74 ,0x2d,0x4c,0x65,0x6e,0x67,0x74,0x68,0x3a,0x20,0x32,0x31,0x38,0x0d,0x0a,0x0d,0x0a ,0x3c,0x48,0x54,0x4d,0x4c,0x3e,0x3c,0x48,0x45,0x41,0x44,0x3e,0x3c,0x6d,0x65,0x74 ,0x61,0x20,0x68,0x74,0x74,0x70,0x2d,0x65,0x71,0x75,0x69,0x76,0x3d,0x22,0x63,0x6f ,0x6e,0x74,0x65,0x6e,0x74,0x2d,0x74,0x79,0x70,0x65,0x22,0x20,0x63,0x6f,0x6e,0x74 ,0x65,0x6e,0x74,0x3d,0x22,0x74,0x65,0x78,0x74,0x2f,0x68,0x74,0x6d,0x6c,0x3b,0x63 ,0x68,0x61,0x72,0x73,0x65,0x74,0x3d,0x75,0x74,0x66,0x2d,0x38,0x22,0x3e,0x0a,0x3c ,0x54,0x49,0x54,0x4c,0x45,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76,0x65,0x64,0x3c ,0x2f,0x54,0x49,0x54,0x4c,0x45,0x3e,0x3c,0x2f,0x48,0x45,0x41,0x44,0x3e,0x3c,0x42 ,0x4f,0x44,0x59,0x3e,0x0a,0x3c,0x48,0x31,0x3e,0x33,0x30,0x32,0x20,0x4d,0x6f,0x76 ,0x65,0x64,0x3c,0x2f,0x48,0x31,0x3e,0x0a,0x54,0x68,0x65,0x20,0x64,0x6f,0x63,0x75 ,0x6d,0x65,0x6e,0x74,0x20,0x68,0x61,0x73,0x20,0x6d,0x6f,0x76,0x65,0x64,0x0a,0x3c ,0x41,0x20,0x48,0x52,0x45,0x46,0x3d,0x22,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x77 ,0x77,0x77,0x2e,0x67,0x6f,0x6f,0x67,0x6c,0x65,0x2e,0x65,0x73,0x2f,0x22,0x3e,0x68 ,0x65,0x72,0x65,0x3c,0x2f,0x41,0x3e,0x2e,0x0d,0x0a,0x3c,0x2f,0x42,0x4f,0x44,0x59 ,0x3e,0x3c,0x2f,0x48,0x54,0x4d,0x4c,0x3e,0x0d,0x0a }; Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; DecodeThreadVars dtv; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; memset(p, 0, SIZE_OF_PACKET); memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); FlowInitConfig(FLOW_QUIET); DecodeEthernet(&th_v, &dtv, p, raw_eth, sizeof(raw_eth), NULL); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; Signature *s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"SigTest37ContentAndIsdataatKeywords01 \"; content:\"HTTP\"; isdataat:500, relative; sid:101;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); result = 0; goto end; } if (s->sm_lists[DETECT_SM_LIST_PMATCH]->type != DETECT_CONTENT) { printf("type not content: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 101) == 0) { result = 1; goto end; } else { printf("sig matched, but should not have: "); result=0; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; end: if(de_ctx) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if(det_ctx) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if(de_ctx) DetectEngineCtxFree(de_ctx); if (p != NULL) PACKET_RECYCLE(p); FlowShutdown(); SCFree(p); return result; } /** * \test SigTest41NoPacketInspection is a test to check that when PKT_NOPACKET_INSPECTION * flag is set, we don't need to inspect the packet protocol header or its contents. */ static int SigTest40NoPacketInspection01(void) { uint8_t *buf = (uint8_t *) "220 (vsFTPd 2.0.5)\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); TCPHdr tcphdr; if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; PacketQueue pq; Flow f; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); memset(&pq, 0, sizeof(pq)); memset(&f, 0, sizeof(f)); memset(&tcphdr, 0, sizeof(tcphdr)); p->src.family = AF_INET; p->src.addr_data32[0] = UTHSetIPv4Address("192.168.0.1"); p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4"); p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->dp = 34260; p->sp = 21; p->flowflags |= FLOW_PKT_TOSERVER; p->flags |= PKT_NOPACKET_INSPECTION; p->tcph = &tcphdr; p->flow = &f; FLOW_INITIALIZE(&f); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> 1.2.3.4 any (msg:\"No Packet Inspection Test\"; flow:to_server; sid:2; rev:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx,(void *)&det_ctx); det_ctx->de_ctx = de_ctx; Detect(&th_v, p, det_ctx, &pq, NULL); if (PacketAlertCheck(p, 2)) result = 0; else result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); //PatternMatchDestroy(mpm_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } /** * \test SigTest42NoPayloadInspection is a test to check that when PKT_NOPAYLOAD_INSPECTION * flasg is set, we don't need to inspect the packet contents. */ int SigTest40NoPayloadInspection02(void) { uint8_t *buf = (uint8_t *) "220 (vsFTPd 2.0.5)\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 1; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; p->flags |= PKT_NOPAYLOAD_INSPECTION; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { result = 0; goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"No Payload TEST\"; content:\"220 (vsFTPd 2.0.5)\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); if (!(de_ctx->sig_list->init_flags & SIG_FLAG_INIT_PAYLOAD)) result = 0; SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result &= 0; else result &= 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: SCFree(p); return result; } static int SigTestMemory01 (void) { uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n" "\r\n\r\n" "GET /two/ HTTP/1.1\r\n" "Host: two.example.org\r\n" "\r\n\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = SCMalloc(SIZE_OF_PACKET); if (unlikely(p == NULL)) return 0; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); memset(p, 0, SIZE_OF_PACKET); p->src.family = AF_INET; p->dst.family = AF_INET; p->payload = buf; p->payload_len = buflen; p->proto = IPPROTO_TCP; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigGroupCleanup(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); result = 1; end: SCFree(p); return result; } static int SigTestMemory02 (void) { ThreadVars th_v; int result = 0; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any 456 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any 1:1000 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); result = 1; end: return result; } static int SigTestMemory03 (void) { ThreadVars th_v; int result = 0; memset(&th_v, 0, sizeof(th_v)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> 1.2.3.4 456 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> 1.2.3.3-1.2.3.6 1:1000 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } de_ctx->sig_list->next->next = SigInit(de_ctx,"alert tcp any any -> !1.2.3.5 1:990 (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; sid:3;)"); if (de_ctx->sig_list->next->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); SigGroupCleanup(de_ctx); DetectEngineCtxFree(de_ctx); result = 1; end: return result; } static int SigTestContent01 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; else printf("sig 1 didn't match: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTestContent02 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 31\"; content:\"0123456789012345678901234567890\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { if (PacketAlertCheck(p, 2)) { result = 1; } else printf("sig 2 didn't match: "); } else printf("sig 1 didn't match: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTestContent03 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; else printf("sig 1 didn't match: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTestContent04 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; else printf("sig 1 didn't match: "); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } /** \test sigs with patterns at the limit of the pm's size limit */ static int SigTestContent05 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901PADabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { printf("de_ctx == NULL: "); goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig1 parse failed: "); goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:32; sid:2;)"); if (de_ctx->sig_list->next == NULL) { printf("sig2 parse failed: "); goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sig 1 matched but shouldn't: "); goto end; } if (PacketAlertCheck(p, 2)) { printf("sig 2 matched but shouldn't: "); goto end; } result = 1; end: UTHFreePackets(&p, 1); SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); if (det_ctx != NULL) { DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); } if (de_ctx != NULL) { DetectEngineCtxFree(de_ctx); } return result; } static int SigTestContent06 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint16_t buflen = strlen((char *)buf); ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); Packet *p = NULL; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Test 32 sig1\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } de_ctx->sig_list->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Test 32 sig2\"; content:\"01234567890123456789012345678901\"; content:\"abcdefg\"; sid:2;)"); if (de_ctx->sig_list->next == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)){ //printf("sig 1 matched :"); }else{ printf("sig 1 didn't match: "); goto end; } if (PacketAlertCheck(p, 2)){ result = 1; }else{ printf("sig 2 didn't match: "); goto end; } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTestWithin01 (void) { DecodeThreadVars dtv; ThreadVars th_v; int result = 0; Packet *p1 = NULL; Packet *p2 = NULL; Packet *p3 = NULL; Packet *p4 = NULL; uint8_t rawpkt1[] = { 0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24, 0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00, 0x00,0x8c,0x95,0x50,0x00,0x00,0x40,0x06, 0x2d,0x45,0xc0,0xa8,0x02,0x03,0xd0,0x45, 0x24,0xe6,0x06,0xcc,0x03,0x09,0x18,0x72, 0xd0,0xe3,0x1a,0xab,0x7c,0x98,0x50,0x00, 0x02,0x00,0x46,0xa0,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00 }; /* end rawpkt1 */ uint8_t rawpkt2[] = { 0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24, 0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00, 0x00,0x8c,0x30,0x87,0x00,0x00,0x40,0x06, 0x92,0x0e,0xc0,0xa8,0x02,0x03,0xd0,0x45, 0x24,0xe6,0x06,0xcd,0x03,0x09,0x73,0xec, 0xd5,0x35,0x14,0x7d,0x7c,0x12,0x50,0x00, 0x02,0x00,0xed,0x86,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00 }; /* end rawpkt2 */ uint8_t rawpkt3[] = { 0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24, 0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00, 0x00,0x8c,0x57,0xd8,0x00,0x00,0x40,0x06, 0x6a,0xbd,0xc0,0xa8,0x02,0x03,0xd0,0x45, 0x24,0xe6,0x06,0xce,0x03,0x09,0x06,0x3d, 0x02,0x22,0x2f,0x9b,0x6f,0x8f,0x50,0x00, 0x02,0x00,0x1f,0xae,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00 }; /* end rawpkt3 */ uint8_t rawpkt4[] = { 0x00,0x04,0x76,0xd3,0xd8,0x6a,0x00,0x24, 0xe8,0x29,0xfa,0x4f,0x08,0x00,0x45,0x00, 0x00,0x8c,0xa7,0x2e,0x00,0x00,0x40,0x06, 0x1b,0x67,0xc0,0xa8,0x02,0x03,0xd0,0x45, 0x24,0xe6,0x06,0xcf,0x03,0x09,0x00,0x0e, 0xdf,0x72,0x3d,0xc2,0x21,0xce,0x50,0x00, 0x02,0x00,0x88,0x25,0x00,0x00,0x48,0x69, 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, 0x74,0x63,0x68,0x65,0x73,0x0a,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00 }; /* end rawpkt4 */ memset(&dtv, 0, sizeof(DecodeThreadVars)); memset(&th_v, 0, sizeof(th_v)); DetectEngineThreadCtx *det_ctx = NULL; FlowInitConfig(FLOW_QUIET); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"within test\"; content:\"Hi, this is a big test to check \"; content:\"content matches\"; distance:0; within:15; sid:556;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); /* packet 1 */ p1 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p1 == NULL)) return 0; memset(p1, 0, SIZE_OF_PACKET); DecodeEthernet(&th_v, &dtv, p1, rawpkt1, sizeof(rawpkt1), NULL); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); if (!(PacketAlertCheck(p1, 556))) { printf("failed to match on packet 1: "); goto end; } /* packet 2 */ p2 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p2 == NULL)) return 0; memset(p2, 0, SIZE_OF_PACKET); DecodeEthernet(&th_v, &dtv, p2, rawpkt2, sizeof(rawpkt2), NULL); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); if (!(PacketAlertCheck(p2, 556))) { printf("failed to match on packet 2: "); goto end; } /* packet 3 */ p3 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p3 == NULL)) return 0; memset(p3, 0, SIZE_OF_PACKET); DecodeEthernet(&th_v, &dtv, p3, rawpkt3, sizeof(rawpkt3), NULL); SigMatchSignatures(&th_v, de_ctx, det_ctx, p3); if (!(PacketAlertCheck(p3, 556))) { printf("failed to match on packet 3: "); goto end; } /* packet 4 */ p4 = SCMalloc(SIZE_OF_PACKET); if (unlikely(p4 == NULL)) return 0; memset(p4, 0, SIZE_OF_PACKET); DecodeEthernet(&th_v, &dtv, p4, rawpkt4, sizeof(rawpkt4), NULL); SigMatchSignatures(&th_v, de_ctx, det_ctx, p4); if (!(PacketAlertCheck(p4, 556))) { printf("failed to match on packet 4: "); goto end; } /* packet 5 */ uint8_t *p5buf = (uint8_t *)"Hi, this is a big test to check content matches"; uint16_t p5buflen = strlen((char *)p5buf); Packet *p5 = UTHBuildPacket(p5buf, p5buflen, IPPROTO_TCP); SigMatchSignatures(&th_v, de_ctx, det_ctx, p5); if (!(PacketAlertCheck(p5, 556))) { printf("failed to match on packet 5: "); goto end; } UTHFreePackets(&p5, 1); result = 1; end: if (de_ctx != NULL) { SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); } if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); if (p1 != NULL) { PACKET_RECYCLE(p1); SCFree(p1); } if (p2 != NULL) { PACKET_RECYCLE(p2); SCFree(p2); } if (p3 != NULL) { PACKET_RECYCLE(p3); SCFree(p3); } if (p4 != NULL) { PACKET_RECYCLE(p4); SCFree(p4); } FlowShutdown(); return result; } static int SigTestDepthOffset01 (void) { uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"depth offset\"; content:\"456\"; offset:4; depth:3; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) result = 1; SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); end: UTHFreePackets(&p, 1); return result; } static int SigTestDetectAlertCounter(void) { Packet *p = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; int result = 0; memset(&tv, 0, sizeof(tv)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (msg:\"Test counter\"; " "content:\"boo\"; sid:1;)"); if (de_ctx->sig_list == NULL) { goto end; } SigGroupBuild(de_ctx); strlcpy(tv.name, "detect_test", sizeof(tv.name)); DetectEngineThreadCtxInit(&tv, de_ctx, (void *)&det_ctx); /* init counters */ StatsSetupPrivate(&tv); p = UTHBuildPacket((uint8_t *)"boo", strlen("boo"), IPPROTO_TCP); Detect(&tv, p, det_ctx, NULL, NULL); result = (StatsGetLocalCounterValue(&tv, det_ctx->counter_alerts) == 1); Detect(&tv, p, det_ctx, NULL, NULL); result &= (StatsGetLocalCounterValue(&tv, det_ctx->counter_alerts) == 2); UTHFreePackets(&p, 1); p = UTHBuildPacket((uint8_t *)"roo", strlen("roo"), IPPROTO_TCP); Detect(&tv, p, det_ctx, NULL, NULL); result &= (StatsGetLocalCounterValue(&tv, det_ctx->counter_alerts) == 2); UTHFreePackets(&p, 1); p = UTHBuildPacket((uint8_t *)"laboosa", strlen("laboosa"), IPPROTO_TCP); Detect(&tv, p, det_ctx, NULL, NULL); result &= (StatsGetLocalCounterValue(&tv, det_ctx->counter_alerts) == 3); UTHFreePackets(&p, 1); end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx); DetectEngineCtxFree(de_ctx); return result; } /** \test test if the engine set flag to drop pkts of a flow that * triggered a drop action on IPS mode */ static int SigTestDropFlow01(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "drop http any any -> any any " "(msg:\"Test proto match\"; " "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should: "); goto end; } if ( !(p->flow->flags & FLOW_ACTION_DROP)) { printf("sig 1 alerted but flow was not flagged correctly: "); goto end; } /* Ok, now we know that the flag is set for proto http */ result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test test if the engine set flag to drop pkts of a flow that * triggered a drop action on IPS mode */ static int SigTestDropFlow02(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 " "(msg:\"Test proto match\"; uricontent:\"one\";" "sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sig 1 didn't alert, but it should: "); goto end; } if ( !(p->flow->flags & FLOW_ACTION_DROP)) { printf("sig 1 alerted but flow was not flagged correctly: "); goto end; } /* Ok, now we know that the flag is set for app layer sigs * (ex: inspecting uricontent) */ result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** \test test if the engine set flag to drop pkts of a flow that * triggered a drop action on IPS mode, and it doesn't inspect * any other packet of the stream */ static int SigTestDropFlow03(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /two HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf1) - 1; /* Set the engine mode to IPS */ EngineModeSetIPS(); TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 " "(msg:\"Test proto match\"; uricontent:\"one\";" "sid:1;)"); if (s == NULL) { goto end; } /* the no inspection flag should be set after the first sig gets triggered, * so the second packet should not match the next sig (because of no inspection) */ s = de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any 80 " "(msg:\"Test proto match\"; uricontent:\"two\";" "sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (!PacketAlertCheck(p1, 1)) { printf("sig 1 didn't alert on p1, but it should: "); goto end; } if ( !(p1->flow->flags & FLOW_ACTION_DROP)) { printf("sig 1 alerted but flow was not flagged correctly: "); goto end; } /* Second part.. Let's feed with another packet */ if (StreamTcpCheckFlowDrops(p2) == 1) { SCLogDebug("This flow/stream triggered a drop rule"); FlowSetNoPacketInspectionFlag(p2->flow); DecodeSetNoPacketInspectionFlag(p2); StreamTcpDisableAppLayer(p2->flow); p2->action |= ACTION_DROP; /* return the segments to the pool */ StreamTcpSessionPktFree(p2); } if ( !(p2->flags & PKT_NOPACKET_INSPECTION)) { printf("The packet was not flagged with no-inspection: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sig 1 alerted, but it should not since the no pkt inspection should be set: "); goto end; } if (PacketAlertCheck(p2, 2)) { printf("sig 2 alerted, but it should not since the no pkt inspection should be set: "); goto end; } if ( !(PACKET_TEST_ACTION(p2, ACTION_DROP))) { printf("A \"drop\" action should be set from the flow to the packet: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); /* Restore mode to IDS */ EngineModeSetIDS(); return result; } /** \test test if the engine set flag to drop pkts of a flow that * triggered a drop action on IDS mode, but continue the inspection * as usual (instead of on IPS mode) */ static int SigTestDropFlow04(void) { int result = 0; Flow f; HtpState *http_state = NULL; uint8_t http_buf1[] = "POST /one HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf1_len = sizeof(http_buf1) - 1; uint8_t http_buf2[] = "POST /two HTTP/1.0\r\n" "User-Agent: Mozilla/1.0\r\n" "Cookie: hellocatch\r\n\r\n"; uint32_t http_buf2_len = sizeof(http_buf1) - 1; TcpSession ssn; Packet *p1 = NULL; Packet *p2 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p1->flow = &f; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "drop tcp any any -> any 80 " "(msg:\"Test proto match\"; uricontent:\"one\";" "sid:1;)"); if (s == NULL) { goto end; } /* the no inspection flag should be set after the first sig gets triggered, * so the second packet should not match the next sig (because of no inspection) */ s = de_ctx->sig_list->next = SigInit(de_ctx, "alert tcp any any -> any 80 " "(msg:\"Test proto match\"; uricontent:\"two\";" "sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf1, http_buf1_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); goto end; } /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (!PacketAlertCheck(p1, 1)) { printf("sig 1 didn't alert on p1, but it should: "); goto end; } if (PacketAlertCheck(p1, 2)) { printf("sig 2 alerted on p1, but it should not: "); goto end; } if ( !(p1->flow->flags & FLOW_ACTION_DROP)) { printf("sig 1 alerted but flow was not flagged correctly: "); goto end; } if (!(PACKET_TEST_ACTION(p1, ACTION_DROP))) { printf("A \"drop\" action was set from the flow to the packet " "which is right, but setting the flag shouldn't disable " "inspection on the packet in IDS mode"); goto end; } /* Second part.. Let's feed with another packet */ if (StreamTcpCheckFlowDrops(p2) == 1) { FlowSetNoPacketInspectionFlag(p2->flow); DecodeSetNoPacketInspectionFlag(p2); StreamTcpDisableAppLayer(p2->flow); p2->action |= ACTION_DROP; /* return the segments to the pool */ StreamTcpSessionPktFree(p2); } if ( (p2->flags & PKT_NOPACKET_INSPECTION)) { printf("The packet was flagged with no-inspection but we are not on IPS mode: "); goto end; } FLOWLOCK_WRLOCK(&f); r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf2, http_buf2_len); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p2); if (PacketAlertCheck(p2, 1)) { printf("sig 1 alerted, but it should not: "); goto end; } if (!PacketAlertCheck(p2, 2)) { printf("sig 2 didn't alert, but it should, since we are not on IPS mode: "); goto end; } if (!(PACKET_TEST_ACTION(p2, ACTION_DROP))) { printf("A \"drop\" action was set from the flow to the packet " "which is right, but setting the flag shouldn't disable " "inspection on the packet in IDS mode"); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p1, 1); UTHFreePackets(&p2, 1); return result; } /** \test ICMP packet shouldn't be matching port based sig * Bug #611 */ static int SigTestPorts01(void) { int result = 0; Packet *p1 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; uint8_t payload[] = "AAAAAAAAAAAAAAAAAA"; memset(&tv, 0, sizeof(ThreadVars)); p1 = UTHBuildPacket(payload, sizeof(payload), IPPROTO_ICMP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx, "alert ip any any -> any 80 " "(content:\"AAA\"; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sig 1 alerted on p1, but it should not: "); goto end; } result = 1; end: if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); UTHFreePackets(&p1, 1); return result; } /** \test almost identical patterns */ static int SigTestBug01(void) { int result = 0; Packet *p1 = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; uint8_t payload[] = "!mymy"; memset(&tv, 0, sizeof(ThreadVars)); p1 = UTHBuildPacket(payload, sizeof(payload), IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(content:\"Omymy\"; nocase; sid:1;)"); if (s == NULL) { goto end; } s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any " "(content:\"!mymy\"; nocase; sid:2;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p1); if (PacketAlertCheck(p1, 1)) { printf("sig 1 alerted on p1, but it should not: "); goto end; } if (!(PacketAlertCheck(p1, 2))) { printf("sig 2 did not p1, but it should have: "); goto end; } result = 1; end: if (det_ctx != NULL) DetectEngineThreadCtxDeinit(&tv, det_ctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); UTHFreePackets(&p1, 1); return result; } static const char *dummy_conf_string2 = "%YAML 1.1\n" "---\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[10.10.10.0/24, !10.10.10.247]\"\n" "\n" " EXTERNAL_NET: \"any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n"; static int DetectAddressYamlParsing01 (void) { int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string2, strlen(dummy_conf_string2)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> any any (sid:1;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp any any -> $HOME_NET any (sid:2;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> $HOME_NET any (sid:3;)")) == NULL) goto end; result = 1; DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); return result; } static const char *dummy_conf_string3 = "%YAML 1.1\n" "---\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[10.10.10.0/24, !10.10.10.247/32]\"\n" "\n" " EXTERNAL_NET: \"any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n"; static int DetectAddressYamlParsing02 (void) { int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string3, strlen(dummy_conf_string3)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> any any (sid:1;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp any any -> $HOME_NET any (sid:2;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> $HOME_NET any (sid:3;)")) == NULL) goto end; result = 1; DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); return result; } static const char *dummy_conf_string4 = "%YAML 1.1\n" "---\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[10.10.10.0/24, !10.10.10.247/32]\"\n" "\n" " EXTERNAL_NET: \"any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n"; static int DetectAddressYamlParsing03 (void) { int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string4, strlen(dummy_conf_string4)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> any any (sid:1;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp any any -> $HOME_NET any (sid:2;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> $HOME_NET any (sid:3;)")) == NULL) goto end; result = 1; DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); return result; } static const char *dummy_conf_string5 = "%YAML 1.1\n" "---\n" "vars:\n" "\n" " address-groups:\n" "\n" " HOME_NET: \"[10.196.0.0/24, !10.196.0.15]\"\n" "\n" " EXTERNAL_NET: \"any\"\n" "\n" " port-groups:\n" "\n" " HTTP_PORTS: \"80:81,88\"\n" "\n"; /** \test bug #815 */ static int DetectAddressYamlParsing04 (void) { int result = 0; ConfCreateContextBackup(); ConfInit(); ConfYamlLoadString(dummy_conf_string5, strlen(dummy_conf_string5)); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> any any (sid:1;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp any any -> $HOME_NET any (sid:2;)")) == NULL) goto end; if ((DetectEngineAppendSig(de_ctx, "alert tcp $HOME_NET any -> $HOME_NET any (sid:3;)")) == NULL) goto end; result = 1; DetectEngineCtxFree(de_ctx); end: ConfDeInit(); ConfRestoreContextBackup(); return result; } #endif /* UNITTESTS */ void SigRegisterTests(void) { #ifdef UNITTESTS SigParseRegisterTests(); IPOnlyRegisterTests(); UtRegisterTest("SigTest01", SigTest01); UtRegisterTest("SigTest02 -- Offset/Depth match", SigTest02); UtRegisterTest("SigTest03 -- offset/depth mismatch", SigTest03); UtRegisterTest("SigTest04 -- distance/within match", SigTest04); UtRegisterTest("SigTest05 -- distance/within mismatch", SigTest05); UtRegisterTest("SigTest06 -- uricontent HTTP/1.1 match test", SigTest06); UtRegisterTest("SigTest07 -- uricontent HTTP/1.1 mismatch test", SigTest07); UtRegisterTest("SigTest08 -- uricontent HTTP/1.0 match test", SigTest08); UtRegisterTest("SigTest09 -- uricontent HTTP/1.0 mismatch test", SigTest09); UtRegisterTest("SigTest10 -- long content match, longer than pkt", SigTest10); UtRegisterTest("SigTest11 -- mpm searching", SigTest11); UtRegisterTest("SigTest12 -- content order matching, normal", SigTest12); UtRegisterTest("SigTest13 -- content order matching, diff order", SigTest13); UtRegisterTest("SigTest14 -- content order matching, distance 0", SigTest14); UtRegisterTest("SigTest15 -- port negation sig (no match)", SigTest15); UtRegisterTest("SigTest16 -- port negation sig (match)", SigTest16); UtRegisterTest("SigTest17 -- HTTP Host Pkt var capture", SigTest17); UtRegisterTest("SigTest18 -- Ftp negation sig test", SigTest18); UtRegisterTest("SigTest19 -- IP-ONLY test (1)", SigTest19); UtRegisterTest("SigTest20 -- IP-ONLY test (2)", SigTest20); UtRegisterTest("SigTest21 -- FLOWBIT test (1)", SigTest21); UtRegisterTest("SigTest22 -- FLOWBIT test (2)", SigTest22); UtRegisterTest("SigTest23 -- FLOWBIT test (3)", SigTest23); UtRegisterTest("SigTest24IPV4Keyword", SigTest24IPV4Keyword); UtRegisterTest("SigTest25NegativeIPV4Keyword", SigTest25NegativeIPV4Keyword); UtRegisterTest("SigTest26TCPV4Keyword", SigTest26TCPV4Keyword); UtRegisterTest("SigTest26TCPV4AndNegativeIPV4Keyword", SigTest26TCPV4AndNegativeIPV4Keyword); UtRegisterTest("SigTest26TCPV4AndIPV4Keyword", SigTest26TCPV4AndIPV4Keyword); UtRegisterTest("SigTest27NegativeTCPV4Keyword", SigTest27NegativeTCPV4Keyword); UtRegisterTest("SigTest28TCPV6Keyword", SigTest28TCPV6Keyword); UtRegisterTest("SigTest29NegativeTCPV6Keyword", SigTest29NegativeTCPV6Keyword); UtRegisterTest("SigTest30UDPV4Keyword", SigTest30UDPV4Keyword); UtRegisterTest("SigTest31NegativeUDPV4Keyword", SigTest31NegativeUDPV4Keyword); UtRegisterTest("SigTest32UDPV6Keyword", SigTest32UDPV6Keyword); UtRegisterTest("SigTest33NegativeUDPV6Keyword", SigTest33NegativeUDPV6Keyword); UtRegisterTest("SigTest34ICMPV4Keyword", SigTest34ICMPV4Keyword); UtRegisterTest("SigTest35NegativeICMPV4Keyword", SigTest35NegativeICMPV4Keyword); UtRegisterTest("SigTest36ContentAndIsdataatKeywords01", SigTest36ContentAndIsdataatKeywords01); UtRegisterTest("SigTest37ContentAndIsdataatKeywords02", SigTest37ContentAndIsdataatKeywords02); /* We need to enable these tests, as soon as we add the ICMPv6 protocol support in our rules engine */ //UtRegisterTest("SigTest36ICMPV6Keyword", SigTest36ICMPV6Keyword, 1); //UtRegisterTest("SigTest37NegativeICMPV6Keyword", // SigTest37NegativeICMPV6Keyword, 1); UtRegisterTest("SigTest38 -- byte_test test (1)", SigTest38); UtRegisterTest("SigTest39 -- byte_jump test (2)", SigTest39); UtRegisterTest("SigTest40NoPacketInspection01", SigTest40NoPacketInspection01); UtRegisterTest("SigTest40NoPayloadInspection02", SigTest40NoPayloadInspection02); UtRegisterTest("SigTestMemory01", SigTestMemory01); UtRegisterTest("SigTestMemory02", SigTestMemory02); UtRegisterTest("SigTestMemory03", SigTestMemory03); UtRegisterTest("SigTestContent01 -- 32 byte pattern", SigTestContent01); UtRegisterTest("SigTestContent02 -- 32+31 byte pattern", SigTestContent02); UtRegisterTest("SigTestContent03 -- 32 byte pattern, x2 + distance", SigTestContent03); UtRegisterTest("SigTestContent04 -- 32 byte pattern, x2 + distance/within", SigTestContent04); UtRegisterTest("SigTestContent05 -- distance/within", SigTestContent05); UtRegisterTest("SigTestContent06 -- distance/within ip only", SigTestContent06); UtRegisterTest("SigTestWithinReal01", SigTestWithin01); UtRegisterTest("SigTestDepthOffset01", SigTestDepthOffset01); UtRegisterTest("SigTestDetectAlertCounter", SigTestDetectAlertCounter); UtRegisterTest("SigTestDropFlow01", SigTestDropFlow01); UtRegisterTest("SigTestDropFlow02", SigTestDropFlow02); UtRegisterTest("SigTestDropFlow03", SigTestDropFlow03); UtRegisterTest("SigTestDropFlow04", SigTestDropFlow04); UtRegisterTest("DetectAddressYamlParsing01", DetectAddressYamlParsing01); UtRegisterTest("DetectAddressYamlParsing02", DetectAddressYamlParsing02); UtRegisterTest("DetectAddressYamlParsing03", DetectAddressYamlParsing03); UtRegisterTest("DetectAddressYamlParsing04", DetectAddressYamlParsing04); UtRegisterTest("SigTestPorts01", SigTestPorts01); UtRegisterTest("SigTestBug01", SigTestBug01); #if 0 DetectSimdRegisterTests(); #endif #endif /* UNITTESTS */ } suricata-3.2.1/src/util-lua-tls.h0000644000000000000000000000167513051004444013517 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_LUA_TLS_H__ #define __UTIL_LUA_TLS_H__ #ifdef HAVE_LUA int LuaRegisterTlsFunctions(lua_State *luastate); #endif /* HAVE_LUA */ #endif /* __UTIL_LUA_TLS_H__ */ suricata-3.2.1/src/source-ipfw.h0000644000000000000000000000334713051004444013424 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Nick Rogness * \author Eric Leblond */ #ifndef __SOURCE_IPFW_H__ #define __SOURCE_IPFW_H__ #define IPFW_MAX_QUEUE 16 /* per packet IPFW vars (Not used) */ typedef struct IPFWPacketVars_ { int ipfw_index; } IPFWPacketVars; typedef struct IPFWQueueVars_ { int fd; SCMutex socket_lock; uint8_t use_mutex; /* this one should be not changing after init */ uint16_t port_num; /* position into the ipfw queue var array */ uint16_t ipfw_index; struct sockaddr_in ipfw_sin; socklen_t ipfw_sinlen; #ifdef DBG_PERF int dbg_maxreadsize; #endif /* DBG_PERF */ /* counters */ uint32_t pkts; uint64_t bytes; uint32_t errs; uint32_t accepted; uint32_t dropped; uint32_t replaced; } IPFWQueueVars; void *IPFWGetThread(int number); int IPFWRegisterQueue(char *queue); void TmModuleReceiveIPFWRegister (void); void TmModuleVerdictIPFWRegister (void); void TmModuleDecodeIPFWRegister (void); #endif /* __SOURCE_IPFW_H__ */ suricata-3.2.1/src/util-signal.c0000644000000000000000000000326113051004444013377 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "suricata.h" #include "util-debug.h" int UtilSignalBlock(int signum) { sigset_t x; if (sigemptyset(&x) < 0) return -1; if (sigaddset(&x, signum) < 0) return -1; if (sigprocmask(SIG_BLOCK, &x, NULL) < 0) return -1; return 0; } void UtilSignalHandlerSetup(int sig, void (*handler)()) { #if defined (OS_WIN32) signal(sig, handler); #else struct sigaction action; memset(&action, 0x00, sizeof(struct sigaction)); action.sa_handler = handler; sigemptyset(&(action.sa_mask)); sigaddset(&(action.sa_mask),sig); action.sa_flags = 0; sigaction(sig, &action, 0); #endif /* OS_WIN32 */ return; } int UtilSignalIsHandler(int sig, void (*handler)()) { struct sigaction action; memset(&action, 0x00, sizeof(struct sigaction)); sigaction(sig, NULL, &action); return (action.sa_handler == handler); } suricata-3.2.1/src/detect-content.h0000644000000000000000000001123413051004444014073 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_CONTENT_H__ #define __DETECT_CONTENT_H__ /* Flags affecting this content */ #define DETECT_CONTENT_NOCASE (1) #define DETECT_CONTENT_DISTANCE (1 << 1) #define DETECT_CONTENT_WITHIN (1 << 2) #define DETECT_CONTENT_OFFSET (1 << 3) #define DETECT_CONTENT_DEPTH (1 << 4) #define DETECT_CONTENT_FAST_PATTERN (1 << 5) #define DETECT_CONTENT_FAST_PATTERN_ONLY (1 << 6) #define DETECT_CONTENT_FAST_PATTERN_CHOP (1 << 7) /** content applies to a "raw"/undecoded field if applicable */ #define DETECT_CONTENT_RAWBYTES (1 << 8) /** content is negated */ #define DETECT_CONTENT_NEGATED (1 << 9) /** a relative match to this content is next, used in matching phase */ #define DETECT_CONTENT_RELATIVE_NEXT (1 << 10) /* BE - byte extract */ #define DETECT_CONTENT_OFFSET_BE (1 << 11) #define DETECT_CONTENT_DEPTH_BE (1 << 12) #define DETECT_CONTENT_DISTANCE_BE (1 << 13) #define DETECT_CONTENT_WITHIN_BE (1 << 14) /* replace data */ #define DETECT_CONTENT_REPLACE (1 << 15) /* this flag is set during the staging phase. It indicates that a content * has been added to the mpm phase and requires no further inspection inside * the inspection phase */ #define DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED (1 << 16) #define DETECT_CONTENT_IS_SINGLE(c) (!( ((c)->flags & DETECT_CONTENT_DISTANCE) || \ ((c)->flags & DETECT_CONTENT_WITHIN) || \ ((c)->flags & DETECT_CONTENT_RELATIVE_NEXT) || \ ((c)->flags & DETECT_CONTENT_DEPTH) || \ ((c)->flags & DETECT_CONTENT_OFFSET) )) /* if a pattern has no depth/offset limits, no relative specifiers and isn't * chopped for the mpm, we can take the mpm and consider this pattern a match * w/o futher inspection. Warning: this may still mean other patterns depend * on this pattern that force match validation anyway. */ #define DETECT_CONTENT_MPM_IS_CONCLUSIVE(c) \ !( ((c)->flags & DETECT_CONTENT_DISTANCE) || \ ((c)->flags & DETECT_CONTENT_WITHIN) || \ ((c)->flags & DETECT_CONTENT_DEPTH) || \ ((c)->flags & DETECT_CONTENT_OFFSET) || \ ((c)->flags & DETECT_CONTENT_FAST_PATTERN_CHOP)) #include "util-spm.h" typedef struct DetectContentData_ { uint8_t *content; uint16_t content_len; uint16_t replace_len; /* for chopped fast pattern, the length */ uint16_t fp_chop_len; /* for chopped fast pattern, the offset */ uint16_t fp_chop_offset; /* would want to move PatIntId here and flags down to remove the padding * gap, but I think the first four members was used as a template for * casting. \todo check this and fix it if posssible */ uint32_t flags; PatIntId id; uint16_t depth; uint16_t offset; int32_t distance; int32_t within; /* SPM search context. */ SpmCtx *spm_ctx; /* pointer to replacement data */ uint8_t *replace; } DetectContentData; /* prototypes */ void DetectContentRegister (void); uint32_t DetectContentMaxId(DetectEngineCtx *); DetectContentData *DetectContentParse(SpmGlobalThreadCtx *spm_global_thread_ctx, char *contentstr); int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen, uint32_t *flags); DetectContentData *DetectContentParseEncloseQuotes(SpmGlobalThreadCtx *spm_global_thread_ctx, char *contentstr); int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, char *contentstr); void DetectContentPrint(DetectContentData *); void DetectContentFree(void *); #endif /* __DETECT_CONTENT_H__ */ suricata-3.2.1/src/detect-engine-dcepayload.h0000644000000000000000000000205613051004444015773 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_ENGINE_DCEPAYLOAD_H__ #define __DETECT_ENGINE_DCEPAYLOAD_H__ int DetectEngineInspectDcePayload(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *); void DcePayloadRegisterTests(void); #endif /* __DETECT_ENGINE_DCEPAYLOAD_H__ */ suricata-3.2.1/src/detect-ssh-software-version.c0000644000000000000000000004712413051004444016533 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Implements the ssh.softwareversion keyword * You can match over the software version string of ssh, and it will * be compared from the beginning of the string so you can say for * example ssh.softwareversion:"PuTTY" and it can match, or you can * also specify the version, something like * ssh.softwareversion:"PuTTY-Release-0.55" * I find this useful to match over a known vulnerable server/client * software version incombination to other checks, so you can know * that the risk is higher */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" #include "flow.h" #include "flow-var.h" #include "flow-util.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-ssh.h" #include "detect-ssh-software-version.h" #include "stream-tcp.h" /** * \brief Regex for parsing the softwareversion string */ #define PARSE_REGEX "^\\s*\"?\\s*?([0-9a-zA-Z\\:\\.\\-\\_\\+\\s+]+)\\s*\"?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectSshSoftwareVersionMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *); static int DetectSshSoftwareVersionSetup (DetectEngineCtx *, Signature *, char *); void DetectSshSoftwareVersionRegisterTests(void); void DetectSshSoftwareVersionFree(void *); void DetectSshSoftwareVersionRegister(void); /** * \brief Registration function for keyword: ssh.softwareversion */ void DetectSshSoftwareVersionRegister(void) { sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].name = "ssh.softwareversion"; sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].Match = NULL; sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].AppLayerMatch = DetectSshSoftwareVersionMatch; sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].Setup = DetectSshSoftwareVersionSetup; sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].Free = DetectSshSoftwareVersionFree; sigmatch_table[DETECT_AL_SSH_SOFTWAREVERSION].RegisterTests = DetectSshSoftwareVersionRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** * \brief match the specified version on a ssh session * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectSshSoftwareVersionData * * \retval 0 no match * \retval 1 match */ int DetectSshSoftwareVersionMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { SCEnter(); DetectSshSoftwareVersionData *ssh = (DetectSshSoftwareVersionData *)m->ctx; SshState *ssh_state = (SshState *)state; if (ssh_state == NULL) { SCLogDebug("no ssh state, no match"); SCReturnInt(0); } int ret = 0; if ((flags & STREAM_TOCLIENT) && (ssh_state->srv_hdr.flags & SSH_FLAG_VERSION_PARSED)) { SCLogDebug("looking for ssh server softwareversion %s length %"PRIu16" on %s", ssh->software_ver, ssh->len, ssh_state->srv_hdr.software_version); ret = (strncmp((char *) ssh_state->srv_hdr.software_version, (char *) ssh->software_ver, ssh->len) == 0)? 1 : 0; } else if ((flags & STREAM_TOSERVER) && (ssh_state->cli_hdr.flags & SSH_FLAG_VERSION_PARSED)) { SCLogDebug("looking for ssh client softwareversion %s length %"PRIu16" on %s", ssh->software_ver, ssh->len, ssh_state->cli_hdr.software_version); ret = (strncmp((char *) ssh_state->cli_hdr.software_version, (char *) ssh->software_ver, ssh->len) == 0)? 1 : 0; } SCReturnInt(ret); } /** * \brief This function is used to parse IPV4 ip_id passed via keyword: "id" * * \param idstr Pointer to the user provided id option * * \retval id_d pointer to DetectSshSoftwareVersionData on success * \retval NULL on failure */ DetectSshSoftwareVersionData *DetectSshSoftwareVersionParse (char *str) { DetectSshSoftwareVersionData *ssh = NULL; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 3) { SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.softwareversion option"); goto error; } if (ret > 1) { const char *str_ptr = NULL; res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } /* We have a correct id option */ ssh = SCMalloc(sizeof(DetectSshSoftwareVersionData)); if (unlikely(ssh == NULL)) goto error; ssh->software_ver = (uint8_t *)SCStrdup((char *)str_ptr); if (ssh->software_ver == NULL) { goto error; } pcre_free_substring(str_ptr); ssh->len = strlen((char *)ssh->software_ver); SCLogDebug("will look for ssh %s", ssh->software_ver); } return ssh; error: if (ssh != NULL) DetectSshSoftwareVersionFree(ssh); return NULL; } /** * \brief this function is used to add the parsed "id" option * \brief into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param idstr pointer to the user provided "id" option * * \retval 0 on Success * \retval -1 on Failure */ static int DetectSshSoftwareVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { DetectSshSoftwareVersionData *ssh = NULL; SigMatch *sm = NULL; ssh = DetectSshSoftwareVersionParse(str); if (ssh == NULL) goto error; /* Okay so far so good, lets get this into a SigMatch * and put it in the Signature. */ sm = SigMatchAlloc(); if (sm == NULL) goto error; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_SSH) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } sm->type = DETECT_AL_SSH_SOFTWAREVERSION; sm->ctx = (void *)ssh; s->flags |= SIG_FLAG_APPLAYER; s->alproto = ALPROTO_SSH; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH); return 0; error: if (ssh != NULL) DetectSshSoftwareVersionFree(ssh); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectSshSoftwareVersionData * * \param id_d pointer to DetectSshSoftwareVersionData */ void DetectSshSoftwareVersionFree(void *ptr) { if (ptr == NULL) return; DetectSshSoftwareVersionData *ssh = (DetectSshSoftwareVersionData *)ptr; if (ssh->software_ver != NULL) SCFree(ssh->software_ver); SCFree(ssh); } #ifdef UNITTESTS /* UNITTESTS */ /** * \test DetectSshSoftwareVersionTestParse01 is a test to make sure that we parse * a software version correctly */ int DetectSshSoftwareVersionTestParse01 (void) { DetectSshSoftwareVersionData *ssh = NULL; ssh = DetectSshSoftwareVersionParse("PuTTY_1.0"); if (ssh != NULL && strncmp((char *) ssh->software_ver, "PuTTY_1.0", 9) == 0) { DetectSshSoftwareVersionFree(ssh); return 1; } return 0; } /** * \test DetectSshSoftwareVersionTestParse02 is a test to make sure that we parse * the software version correctly */ int DetectSshSoftwareVersionTestParse02 (void) { DetectSshSoftwareVersionData *ssh = NULL; ssh = DetectSshSoftwareVersionParse("\"SecureCRT-4.0\""); if (ssh != NULL && strncmp((char *) ssh->software_ver, "SecureCRT-4.0", 13) == 0) { DetectSshSoftwareVersionFree(ssh); return 1; } return 0; } /** * \test DetectSshSoftwareVersionTestParse03 is a test to make sure that we * don't return a ssh_data with an empty value specified */ int DetectSshSoftwareVersionTestParse03 (void) { DetectSshSoftwareVersionData *ssh = NULL; ssh = DetectSshSoftwareVersionParse(""); if (ssh != NULL) { DetectSshSoftwareVersionFree(ssh); return 0; } return 1; } #include "stream-tcp-reassemble.h" /** \test Send a get request in three chunks + more data. */ static int DetectSshSoftwareVersionTestDetect01(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "10-PuTTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.softwareversion:PuTTY_2.123; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ( !(PacketAlertCheck(p, 1))) { printf("Error, the sig should match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } /** \test Send a get request in three chunks + more data. */ static int DetectSshSoftwareVersionTestDetect02(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1.99-Pu"; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "TTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.softwareversion:PuTTY_2.123; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if ( !(PacketAlertCheck(p, 1))) { printf("Error, the sig should match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } /** \test Send a get request in three chunks + more data. */ static int DetectSshSoftwareVersionTestDetect03(void) { int result = 0; Flow f; uint8_t sshbuf1[] = "SSH-1."; uint32_t sshlen1 = sizeof(sshbuf1) - 1; uint8_t sshbuf2[] = "7-PuTTY_2.123" ; uint32_t sshlen2 = sizeof(sshbuf2) - 1; uint8_t sshbuf3[] = "\n"; uint32_t sshlen3 = sizeof(sshbuf3) - 1; uint8_t sshbuf4[] = "whatever..."; uint32_t sshlen4 = sizeof(sshbuf4) - 1; TcpSession ssn; Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_SSH; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert ssh any any -> any any (msg:\"SSH\"; ssh.softwareversion:lalala-3.1.4; sid:1;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf1, sshlen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf2, sshlen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf3, sshlen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_SSH, STREAM_TOSERVER, sshbuf4, sshlen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); SshState *ssh_state = f.alstate; if (ssh_state == NULL) { printf("no ssh state: "); goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("Error, 1.7 version is not 2 compat, so the sig should not match: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectSshSoftwareVersion */ void DetectSshSoftwareVersionRegisterTests(void) { #ifdef UNITTESTS /* UNITTESTS */ UtRegisterTest("DetectSshSoftwareVersionTestParse01", DetectSshSoftwareVersionTestParse01); UtRegisterTest("DetectSshSoftwareVersionTestParse02", DetectSshSoftwareVersionTestParse02); UtRegisterTest("DetectSshSoftwareVersionTestParse03", DetectSshSoftwareVersionTestParse03); UtRegisterTest("DetectSshSoftwareVersionTestDetect01", DetectSshSoftwareVersionTestDetect01); UtRegisterTest("DetectSshSoftwareVersionTestDetect02", DetectSshSoftwareVersionTestDetect02); UtRegisterTest("DetectSshSoftwareVersionTestDetect03", DetectSshSoftwareVersionTestDetect03); #endif /* UNITTESTS */ } suricata-3.2.1/src/log-pcap.c0000644000000000000000000013364313051004444012661 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf * \author Victor Julien * * Pcap packet logging module. */ #include "suricata-common.h" #if defined(HAVE_DIRENT_H) && defined(HAVE_FNMATCH_H) #define INIT_RING_BUFFER #include #include #endif #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "threadvars.h" #include "tm-threads.h" #include "util-unittest.h" #include "log-pcap.h" #include "decode-ipv4.h" #include "util-error.h" #include "util-debug.h" #include "util-time.h" #include "util-byte.h" #include "util-misc.h" #include "util-cpu.h" #include "util-atomic.h" #include "source-pcap.h" #include "output.h" #include "queue.h" #define DEFAULT_LOG_FILENAME "pcaplog" #define MODULE_NAME "PcapLog" #define MIN_LIMIT 1 * 1024 * 1024 #define DEFAULT_LIMIT 100 * 1024 * 1024 #define DEFAULT_FILE_LIMIT 0 #define LOGMODE_NORMAL 0 #define LOGMODE_SGUIL 1 #define LOGMODE_MULTI 2 #define RING_BUFFER_MODE_DISABLED 0 #define RING_BUFFER_MODE_ENABLED 1 #define TS_FORMAT_SEC 0 #define TS_FORMAT_USEC 1 #define USE_STREAM_DEPTH_DISABLED 0 #define USE_STREAM_DEPTH_ENABLED 1 #define HONOR_PASS_RULES_DISABLED 0 #define HONOR_PASS_RULES_ENABLED 1 #define PCAP_SNAPLEN 262144 SC_ATOMIC_DECLARE(uint32_t, thread_cnt); typedef struct PcapFileName_ { char *filename; char *dirname; /* Like a struct timeval, but with fixed size. This is only used when * seeding the ring buffer on start. */ struct { uint64_t secs; uint32_t usecs; }; TAILQ_ENTRY(PcapFileName_) next; /**< Pointer to next Pcap File for tailq. */ } PcapFileName; typedef struct PcapLogProfileData_ { uint64_t total; uint64_t cnt; } PcapLogProfileData; #define MAX_TOKS 9 /** * PcapLog thread vars * * Used for storing file options. */ typedef struct PcapLogData_ { int use_stream_depth; /**< use stream depth i.e. ignore packets that reach limit */ int honor_pass_rules; /**< don't log if pass rules have matched */ int is_private; /**< TRUE if ctx is thread local */ SCMutex plog_lock; uint64_t pkt_cnt; /**< total number of packets */ struct pcap_pkthdr *h; /**< pcap header struct */ char *filename; /**< current filename */ int mode; /**< normal or sguil */ int prev_day; /**< last day, for finding out when */ uint64_t size_current; /**< file current size */ uint64_t size_limit; /**< file size limit */ pcap_t *pcap_dead_handle; /**< pcap_dumper_t needs a handle */ pcap_dumper_t *pcap_dumper; /**< actually writes the packets */ uint64_t profile_data_size; /**< track in bytes how many bytes we wrote */ uint32_t file_cnt; /**< count of pcap files we currently have */ uint32_t max_files; /**< maximum files to use in ring buffer mode */ PcapLogProfileData profile_lock; PcapLogProfileData profile_write; PcapLogProfileData profile_unlock; PcapLogProfileData profile_handles; // open handles PcapLogProfileData profile_close; PcapLogProfileData profile_open; PcapLogProfileData profile_rotate; TAILQ_HEAD(, PcapFileName_) pcap_file_list; uint32_t thread_number; /**< thread number, first thread is 1, second 2, etc */ int use_ringbuffer; /**< ring buffer mode enabled or disabled */ int timestamp_format; /**< timestamp format sec or usec */ char *prefix; /**< filename prefix */ char dir[PATH_MAX]; /**< pcap log directory */ int reported; int threads; /**< number of threads (only set in the global) */ char *filename_parts[MAX_TOKS]; int filename_part_cnt; } PcapLogData; typedef struct PcapLogThreadData_ { PcapLogData *pcap_log; } PcapLogThreadData; /* Pattern for extracting timestamp from pcap log files. */ static const char timestamp_pattern[] = ".*?(\\d+)(\\.(\\d+))?"; static pcre *pcre_timestamp_code = NULL; static pcre_extra *pcre_timestamp_extra = NULL; /* global pcap data for when we're using multi mode. At exit we'll * merge counters into this one and then report counters. */ static PcapLogData *g_pcap_data = NULL; static int PcapLogOpenFileCtx(PcapLogData *); static int PcapLog(ThreadVars *, void *, const Packet *); static TmEcode PcapLogDataInit(ThreadVars *, void *, void **); static TmEcode PcapLogDataDeinit(ThreadVars *, void *); static void PcapLogFileDeInitCtx(OutputCtx *); static OutputCtx *PcapLogInitCtx(ConfNode *); static void PcapLogProfilingDump(PcapLogData *); static int PcapLogCondition(ThreadVars *, const Packet *); void PcapLogRegister(void) { OutputRegisterPacketModule(LOGGER_PCAP, MODULE_NAME, "pcap-log", PcapLogInitCtx, PcapLog, PcapLogCondition, PcapLogDataInit, PcapLogDataDeinit, NULL); PcapLogProfileSetup(); SC_ATOMIC_INIT(thread_cnt); return; } #define PCAPLOG_PROFILE_START \ uint64_t pcaplog_profile_ticks = UtilCpuGetTicks() #define PCAPLOG_PROFILE_END(prof) \ (prof).total += (UtilCpuGetTicks() - pcaplog_profile_ticks); \ (prof).cnt++ static int PcapLogCondition(ThreadVars *tv, const Packet *p) { if (p->flags & PKT_PSEUDO_STREAM_END) { return FALSE; } if (IS_TUNNEL_PKT(p) && !IS_TUNNEL_ROOT_PKT(p)) { return FALSE; } return TRUE; } /** * \brief Function to close pcaplog file * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param pl PcapLog thread variable. */ static int PcapLogCloseFile(ThreadVars *t, PcapLogData *pl) { if (pl != NULL) { PCAPLOG_PROFILE_START; if (pl->pcap_dumper != NULL) pcap_dump_close(pl->pcap_dumper); pl->size_current = 0; pl->pcap_dumper = NULL; if (pl->pcap_dead_handle != NULL) pcap_close(pl->pcap_dead_handle); pl->pcap_dead_handle = NULL; PCAPLOG_PROFILE_END(pl->profile_close); } return 0; } static void PcapFileNameFree(PcapFileName *pf) { if (pf != NULL) { if (pf->filename != NULL) { SCFree(pf->filename); } if (pf->dirname != NULL) { SCFree(pf->dirname); } SCFree(pf); } return; } /** * \brief Function to rotate pcaplog file * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param pl PcapLog thread variable. * * \retval 0 on succces * \retval -1 on failure */ static int PcapLogRotateFile(ThreadVars *t, PcapLogData *pl) { PcapFileName *pf; PcapFileName *pfnext; PCAPLOG_PROFILE_START; if (PcapLogCloseFile(t,pl) < 0) { SCLogDebug("PcapLogCloseFile failed"); return -1; } if (pl->use_ringbuffer == RING_BUFFER_MODE_ENABLED && pl->file_cnt >= pl->max_files) { pf = TAILQ_FIRST(&pl->pcap_file_list); SCLogDebug("Removing pcap file %s", pf->filename); if (remove(pf->filename) != 0) { // VJ remove can fail because file is already gone //LogWarning(SC_ERR_PCAP_FILE_DELETE_FAILED, // "failed to remove log file %s: %s", // pf->filename, strerror( errno )); } /* Remove directory if Sguil mode and no files left in sguil dir */ if (pl->mode == LOGMODE_SGUIL) { pfnext = TAILQ_NEXT(pf,next); if (strcmp(pf->dirname, pfnext->dirname) == 0) { SCLogDebug("Current entry dir %s and next entry %s " "are equal: not removing dir", pf->dirname, pfnext->dirname); } else { SCLogDebug("current entry %s and %s are " "not equal: removing dir", pf->dirname, pfnext->dirname); if (remove(pf->dirname) != 0) { SCLogWarning(SC_ERR_PCAP_FILE_DELETE_FAILED, "failed to remove sguil log %s: %s", pf->dirname, strerror( errno )); } } } TAILQ_REMOVE(&pl->pcap_file_list, pf, next); PcapFileNameFree(pf); pl->file_cnt--; } if (PcapLogOpenFileCtx(pl) < 0) { SCLogError(SC_ERR_FOPEN, "opening new pcap log file failed"); return -1; } pl->file_cnt++; SCLogDebug("file_cnt %u", pl->file_cnt); PCAPLOG_PROFILE_END(pl->profile_rotate); return 0; } static int PcapLogOpenHandles(PcapLogData *pl, const Packet *p) { PCAPLOG_PROFILE_START; SCLogDebug("Setting pcap-log link type to %u", p->datalink); if (pl->pcap_dead_handle == NULL) { if ((pl->pcap_dead_handle = pcap_open_dead(p->datalink, PCAP_SNAPLEN)) == NULL) { SCLogDebug("Error opening dead pcap handle"); return TM_ECODE_FAILED; } } if (pl->pcap_dumper == NULL) { if ((pl->pcap_dumper = pcap_dump_open(pl->pcap_dead_handle, pl->filename)) == NULL) { SCLogInfo("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle)); return TM_ECODE_FAILED; } } PCAPLOG_PROFILE_END(pl->profile_handles); return TM_ECODE_OK; } /** \internal * \brief lock wrapper for main PcapLog() function * NOTE: only meant for use in main PcapLog() function. */ static void PcapLogLock(PcapLogData *pl) { if (!(pl->is_private)) { PCAPLOG_PROFILE_START; SCMutexLock(&pl->plog_lock); PCAPLOG_PROFILE_END(pl->profile_lock); } } /** \internal * \brief unlock wrapper for main PcapLog() function * NOTE: only meant for use in main PcapLog() function. */ static void PcapLogUnlock(PcapLogData *pl) { if (!(pl->is_private)) { PCAPLOG_PROFILE_START; SCMutexUnlock(&pl->plog_lock); PCAPLOG_PROFILE_END(pl->profile_unlock); } } /** * \brief Pcap logging main function * * \param t threadvar * \param p packet * \param data thread module specific data * \param pq pre-packet-queue * \param postpq post-packet-queue * * \retval TM_ECODE_OK on succes * \retval TM_ECODE_FAILED on serious error */ static int PcapLog (ThreadVars *t, void *thread_data, const Packet *p) { size_t len; int rotate = 0; int ret = 0; PcapLogThreadData *td = (PcapLogThreadData *)thread_data; PcapLogData *pl = td->pcap_log; if ((p->flags & PKT_PSEUDO_STREAM_END) || ((p->flags & PKT_STREAM_NOPCAPLOG) && (pl->use_stream_depth == USE_STREAM_DEPTH_ENABLED)) || (IS_TUNNEL_PKT(p) && !IS_TUNNEL_ROOT_PKT(p)) || (pl->honor_pass_rules && (p->flags & PKT_NOPACKET_INSPECTION))) { return TM_ECODE_OK; } PcapLogLock(pl); pl->pkt_cnt++; pl->h->ts.tv_sec = p->ts.tv_sec; pl->h->ts.tv_usec = p->ts.tv_usec; pl->h->caplen = GET_PKT_LEN(p); pl->h->len = GET_PKT_LEN(p); len = sizeof(*pl->h) + GET_PKT_LEN(p); if (pl->filename == NULL) { ret = PcapLogOpenFileCtx(pl); if (ret < 0) { PcapLogUnlock(pl); return TM_ECODE_FAILED; } SCLogDebug("Opening PCAP log file %s", pl->filename); } if (pl->mode == LOGMODE_SGUIL) { struct tm local_tm; struct tm *tms = SCLocalTime(p->ts.tv_sec, &local_tm); if (tms->tm_mday != pl->prev_day) { rotate = 1; pl->prev_day = tms->tm_mday; } } if ((pl->size_current + len) > pl->size_limit || rotate) { if (PcapLogRotateFile(t,pl) < 0) { PcapLogUnlock(pl); SCLogDebug("rotation of pcap failed"); return TM_ECODE_FAILED; } } /* XXX pcap handles, nfq, pfring, can only have one link type ipfw? we do * this here as we don't know the link type until we get our first packet */ if (pl->pcap_dead_handle == NULL || pl->pcap_dumper == NULL) { if (PcapLogOpenHandles(pl, p) != TM_ECODE_OK) { PcapLogUnlock(pl); return TM_ECODE_FAILED; } } PCAPLOG_PROFILE_START; pcap_dump((u_char *)pl->pcap_dumper, pl->h, GET_PKT_DATA(p)); pl->size_current += len; PCAPLOG_PROFILE_END(pl->profile_write); pl->profile_data_size += len; SCLogDebug("pl->size_current %"PRIu64", pl->size_limit %"PRIu64, pl->size_current, pl->size_limit); PcapLogUnlock(pl); return TM_ECODE_OK; } static PcapLogData *PcapLogDataCopy(const PcapLogData *pl) { BUG_ON(pl->mode != LOGMODE_MULTI); PcapLogData *copy = SCCalloc(1, sizeof(*copy)); if (unlikely(copy == NULL)) { return NULL; } copy->h = SCCalloc(1, sizeof(*copy->h)); if (unlikely(copy->h == NULL)) { SCFree(copy); return NULL; } copy->prefix = SCStrdup(pl->prefix); if (unlikely(copy->prefix == NULL)) { SCFree(copy->h); SCFree(copy); return NULL; } /* settings TODO move to global cfg struct */ copy->is_private = TRUE; copy->mode = pl->mode; copy->max_files = pl->max_files; copy->use_ringbuffer = pl->use_ringbuffer; copy->timestamp_format = pl->timestamp_format; copy->use_stream_depth = pl->use_stream_depth; copy->size_limit = pl->size_limit; TAILQ_INIT(©->pcap_file_list); SCMutexInit(©->plog_lock, NULL); strlcpy(copy->dir, pl->dir, sizeof(copy->dir)); int i; for (i = 0; i < pl->filename_part_cnt && i < MAX_TOKS; i++) copy->filename_parts[i] = pl->filename_parts[i]; copy->filename_part_cnt = pl->filename_part_cnt; /* set thread number, first thread is 1 */ copy->thread_number = SC_ATOMIC_ADD(thread_cnt, 1); SCLogDebug("copied, returning %p", copy); return copy; } #ifdef INIT_RING_BUFFER static int PcapLogGetTimeOfFile(const char *filename, uint64_t *secs, uint32_t *usecs) { int pcre_ovecsize = 4 * 3; int pcre_ovec[pcre_ovecsize]; char buf[PATH_MAX]; int n = pcre_exec(pcre_timestamp_code, pcre_timestamp_extra, filename, strlen(filename), 0, 0, pcre_ovec, pcre_ovecsize); if (n != 2 && n != 4) { /* No match. */ return 0; } if (n >= 2) { /* Extract seconds. */ if (pcre_copy_substring(filename, pcre_ovec, pcre_ovecsize, 1, buf, sizeof(buf)) < 0) { return 0; } if (ByteExtractStringUint64(secs, 10, 0, buf) < 0) { return 0; } } if (n == 4) { /* Extract microseconds. */ if (pcre_copy_substring(filename, pcre_ovec, pcre_ovecsize, 3, buf, sizeof(buf)) < 0) { return 0; } if (ByteExtractStringUint32(usecs, 10, 0, buf) < 0) { return 0; } } return 1; } static TmEcode PcapLogInitRingBuffer(PcapLogData *pl) { char pattern[PATH_MAX]; SCLogInfo("Initializing PCAP ring buffer for %s/%s.", pl->dir, pl->prefix); strlcpy(pattern, pl->dir, PATH_MAX); if (pattern[strlen(pattern) - 1] != '/') { strlcat(pattern, "/", PATH_MAX); } if (pl->mode == LOGMODE_MULTI) { for (int i = 0; i < pl->filename_part_cnt; i++) { char *part = pl->filename_parts[i]; if (part == NULL || strlen(part) == 0) { continue; } if (part[0] != '%' || strlen(part) < 2) { strlcat(pattern, part, PATH_MAX); continue; } switch (part[1]) { case 'i': SCLogError(SC_ERR_INVALID_ARGUMENT, "Thread ID not allowed inring buffer mode."); return TM_ECODE_FAILED; case 'n': { char tmp[PATH_MAX]; snprintf(tmp, PATH_MAX, "%"PRIu32, pl->thread_number); strlcat(pattern, tmp, PATH_MAX); break; } case 't': strlcat(pattern, "*", PATH_MAX); break; default: SCLogError(SC_ERR_INVALID_ARGUMENT, "Unsupported format character: %%%s", part); return TM_ECODE_FAILED; } } } else { strlcat(pattern, pl->prefix, PATH_MAX); strlcat(pattern, ".*", PATH_MAX); } char *basename = strrchr(pattern, '/'); *basename++ = '\0'; /* Pattern is now just the directory name. */ DIR *dir = opendir(pattern); if (dir == NULL) { SCLogWarning(SC_ERR_DIR_OPEN, "Failed to open directory %s: %s", pattern, strerror(errno)); return TM_ECODE_FAILED; } for (;;) { struct dirent *entry = readdir(dir); if (entry == NULL) { break; } if (fnmatch(basename, entry->d_name, 0) != 0) { continue; } uint64_t secs = 0; uint32_t usecs = 0; if (!PcapLogGetTimeOfFile(entry->d_name, &secs, &usecs)) { /* Failed to get time stamp out of file name. Not necessarily a * failure as the file might just not be a pcap log file. */ continue; } PcapFileName *pf = SCCalloc(sizeof(*pf), 1); if (unlikely(pf == NULL)) { goto fail; } char path[PATH_MAX]; snprintf(path, PATH_MAX - 1, "%s/%s", pattern, entry->d_name); if ((pf->filename = SCStrdup(path)) == NULL) { goto fail; } if ((pf->dirname = SCStrdup(pattern)) == NULL) { goto fail; } pf->secs = secs; pf->usecs = usecs; if (TAILQ_EMPTY(&pl->pcap_file_list)) { TAILQ_INSERT_TAIL(&pl->pcap_file_list, pf, next); } else { /* Ordered insert. */ PcapFileName *it = NULL; TAILQ_FOREACH(it, &pl->pcap_file_list, next) { if (pf->secs < it->secs) { break; } else if (pf->secs == it->secs && pf->usecs < it->usecs) { break; } } if (it == NULL) { TAILQ_INSERT_TAIL(&pl->pcap_file_list, pf, next); } else { TAILQ_INSERT_BEFORE(it, pf, next); } } pl->file_cnt++; continue; fail: if (pf != NULL) { if (pf->filename != NULL) { SCFree(pf->filename); } if (pf->dirname != NULL) { SCFree(pf->dirname); } SCFree(pf); } break; } if (pl->file_cnt > pl->max_files) { PcapFileName *pf = TAILQ_FIRST(&pl->pcap_file_list); while (pf != NULL && pl->file_cnt > pl->max_files) { SCLogDebug("Removing PCAP file %s", pf->filename); if (remove(pf->filename) != 0) { SCLogWarning(SC_WARN_REMOVE_FILE, "Failed to remove PCAP file %s: %s", pf->filename, strerror(errno)); } TAILQ_REMOVE(&pl->pcap_file_list, pf, next); PcapFileNameFree(pf); pf = TAILQ_FIRST(&pl->pcap_file_list); pl->file_cnt--; } } closedir(dir); /* For some reason file count is initialized at one, instead of 0. */ SCLogNotice("Ring buffer initialized with %d files.", pl->file_cnt - 1); return TM_ECODE_OK; } #endif /* INIT_RING_BUFFER */ static TmEcode PcapLogDataInit(ThreadVars *t, void *initdata, void **data) { if (initdata == NULL) { SCLogDebug("Error getting context for LogPcap. \"initdata\" argument NULL"); return TM_ECODE_FAILED; } PcapLogData *pl = ((OutputCtx *)initdata)->data; PcapLogThreadData *td = SCCalloc(1, sizeof(*td)); if (unlikely(td == NULL)) return TM_ECODE_FAILED; if (pl->mode == LOGMODE_MULTI) td->pcap_log = PcapLogDataCopy(pl); else td->pcap_log = pl; BUG_ON(td->pcap_log == NULL); PcapLogLock(td->pcap_log); /** Use the Ouptut Context (file pointer and mutex) */ td->pcap_log->pkt_cnt = 0; td->pcap_log->pcap_dead_handle = NULL; td->pcap_log->pcap_dumper = NULL; if (td->pcap_log->file_cnt < 1) { td->pcap_log->file_cnt = 1; } struct timeval ts; memset(&ts, 0x00, sizeof(struct timeval)); TimeGet(&ts); struct tm local_tm; struct tm *tms = SCLocalTime(ts.tv_sec, &local_tm); td->pcap_log->prev_day = tms->tm_mday; PcapLogUnlock(td->pcap_log); /* count threads in the global structure */ SCMutexLock(&pl->plog_lock); pl->threads++; SCMutexUnlock(&pl->plog_lock); *data = (void *)td; if (pl->max_files && (pl->mode == LOGMODE_MULTI || pl->threads == 1)) { #ifdef INIT_RING_BUFFER if (PcapLogInitRingBuffer(td->pcap_log) == TM_ECODE_FAILED) { return TM_ECODE_FAILED; } #else SCLogInfo("Unable to initialize ring buffer on this platform."); #endif /* INIT_RING_BUFFER */ } return TM_ECODE_OK; } static void StatsMerge(PcapLogData *dst, PcapLogData *src) { dst->profile_open.total += src->profile_open.total; dst->profile_open.cnt += src->profile_open.cnt; dst->profile_close.total += src->profile_close.total; dst->profile_close.cnt += src->profile_close.cnt; dst->profile_write.total += src->profile_write.total; dst->profile_write.cnt += src->profile_write.cnt; dst->profile_rotate.total += src->profile_rotate.total; dst->profile_rotate.cnt += src->profile_rotate.cnt; dst->profile_handles.total += src->profile_handles.total; dst->profile_handles.cnt += src->profile_handles.cnt; dst->profile_lock.total += src->profile_lock.total; dst->profile_lock.cnt += src->profile_lock.cnt; dst->profile_unlock.total += src->profile_unlock.total; dst->profile_unlock.cnt += src->profile_unlock.cnt; dst->profile_data_size += src->profile_data_size; } static void PcapLogDataFree(PcapLogData *pl) { PcapFileName *pf; while ((pf = TAILQ_FIRST(&pl->pcap_file_list)) != NULL) { TAILQ_REMOVE(&pl->pcap_file_list, pf, next); PcapFileNameFree(pf); } if (pl == g_pcap_data) { for (int i = 0; i < MAX_TOKS; i++) { if (pl->filename_parts[i] != NULL) { SCFree(pl->filename_parts[i]); } } } SCFree(pl->h); SCFree(pl->filename); SCFree(pl->prefix); SCFree(pl); } /** * \brief Thread deinit function. * * \param t Thread Variable containing input/output queue, cpu affinity etc. * \param data PcapLog thread data. * \retval TM_ECODE_OK on succces * \retval TM_ECODE_FAILED on failure */ static TmEcode PcapLogDataDeinit(ThreadVars *t, void *thread_data) { PcapLogThreadData *td = (PcapLogThreadData *)thread_data; PcapLogData *pl = td->pcap_log; if (pl->pcap_dumper != NULL) { if (PcapLogCloseFile(t,pl) < 0) { SCLogDebug("PcapLogCloseFile failed"); } } if (pl->mode == LOGMODE_MULTI) { SCMutexLock(&g_pcap_data->plog_lock); StatsMerge(g_pcap_data, pl); g_pcap_data->reported++; if (g_pcap_data->threads == g_pcap_data->reported) PcapLogProfilingDump(g_pcap_data); SCMutexUnlock(&g_pcap_data->plog_lock); } else { if (pl->reported == 0) { PcapLogProfilingDump(pl); pl->reported = 1; } } if (pl != g_pcap_data) { PcapLogDataFree(pl); } SCFree(td); return TM_ECODE_OK; } static int ParseFilename(PcapLogData *pl, const char *filename) { char *toks[MAX_TOKS] = { NULL }; int tok = 0; char str[512] = ""; int s = 0; int i, x; char *p = NULL; if (filename) { for (i = 0; i < (int)strlen(filename); i++) { if (tok >= MAX_TOKS) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid filename option. Max 2 %%-sign options"); goto error; } str[s++] = filename[i]; if (filename[i] == '%') { str[s-1] = '\0'; SCLogDebug("filename with %%-sign: %s", str); p = SCStrdup(str); if (p == NULL) goto error; toks[tok++] = p; s = 0; if (i+1 < (int)strlen(filename)) { if (tok >= MAX_TOKS) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid filename option. Max 2 %%-sign options"); goto error; } if (filename[i+1] != 'n' && filename[i+1] != 't' && filename[i+1] != 'i') { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid filename option. Valid %%-sign options: %%n, %%i and %%t"); goto error; } str[0] = '%'; str[1] = filename[i+1]; str[2] = '\0'; p = SCStrdup(str); if (p == NULL) goto error; toks[tok++] = p; i++; } } } if (s) { if (tok >= MAX_TOKS) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid filename option. Max 3 %%-sign options"); goto error; } str[s++] = '\0'; p = SCStrdup(str); if (p == NULL) goto error; toks[tok++] = p; } /* finally, store tokens in the pl */ for (i = 0; i < tok; i++) { if (toks[i] == NULL) goto error; SCLogDebug("toks[%d] %s", i, toks[i]); pl->filename_parts[i] = toks[i]; } pl->filename_part_cnt = tok; } return 0; error: for (x = 0; x < MAX_TOKS; x++) { if (toks[x] != NULL) SCFree(toks[x]); } return -1; } /** \brief Fill in pcap logging struct from the provided ConfNode. * \param conf The configuration node for this output. * \retval output_ctx * */ static OutputCtx *PcapLogInitCtx(ConfNode *conf) { const char *pcre_errbuf; int pcre_erroffset; PcapLogData *pl = SCMalloc(sizeof(PcapLogData)); if (unlikely(pl == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate Memory for PcapLogData"); exit(EXIT_FAILURE); } memset(pl, 0, sizeof(PcapLogData)); pl->h = SCMalloc(sizeof(*pl->h)); if (pl->h == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate Memory for pcap header struct"); exit(EXIT_FAILURE); } /* Set the defaults */ pl->mode = LOGMODE_NORMAL; pl->max_files = DEFAULT_FILE_LIMIT; pl->use_ringbuffer = RING_BUFFER_MODE_DISABLED; pl->timestamp_format = TS_FORMAT_SEC; pl->use_stream_depth = USE_STREAM_DEPTH_DISABLED; pl->honor_pass_rules = HONOR_PASS_RULES_DISABLED; TAILQ_INIT(&pl->pcap_file_list); SCMutexInit(&pl->plog_lock, NULL); /* Initialize PCREs. */ pcre_timestamp_code = pcre_compile(timestamp_pattern, 0, &pcre_errbuf, &pcre_erroffset, NULL); if (pcre_timestamp_code == NULL) { FatalError(SC_ERR_PCRE_COMPILE, "Failed to compile \"%s\" at offset %"PRIu32": %s", timestamp_pattern, pcre_erroffset, pcre_errbuf); } pcre_timestamp_extra = pcre_study(pcre_timestamp_code, 0, &pcre_errbuf); if (pcre_errbuf != NULL) { FatalError(SC_ERR_PCRE_STUDY, "Fail to study pcre: %s", pcre_errbuf); } /* conf params */ const char *filename = NULL; if (conf != NULL) { /* To faciliate unit tests. */ filename = ConfNodeLookupChildValue(conf, "filename"); } if (filename == NULL) filename = DEFAULT_LOG_FILENAME; if ((pl->prefix = SCStrdup(filename)) == NULL) { exit(EXIT_FAILURE); } if (filename) { if (ParseFilename(pl, filename) != 0) exit(EXIT_FAILURE); } pl->size_limit = DEFAULT_LIMIT; if (conf != NULL) { const char *s_limit = NULL; s_limit = ConfNodeLookupChildValue(conf, "limit"); if (s_limit != NULL) { if (ParseSizeStringU64(s_limit, &pl->size_limit) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize unified2 output, invalid limit: %s", s_limit); exit(EXIT_FAILURE); } if (pl->size_limit < 4096) { SCLogInfo("pcap-log \"limit\" value of %"PRIu64" assumed to be pre-1.2 " "style: setting limit to %"PRIu64"mb", pl->size_limit, pl->size_limit); uint64_t size = pl->size_limit * 1024 * 1024; pl->size_limit = size; } else if (pl->size_limit < MIN_LIMIT) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Fail to initialize pcap-log output, limit less than " "allowed minimum."); exit(EXIT_FAILURE); } } } if (conf != NULL) { const char *s_mode = NULL; s_mode = ConfNodeLookupChildValue(conf, "mode"); if (s_mode != NULL) { if (strcasecmp(s_mode, "sguil") == 0) { pl->mode = LOGMODE_SGUIL; } else if (strcasecmp(s_mode, "multi") == 0) { pl->mode = LOGMODE_MULTI; } else if (strcasecmp(s_mode, "normal") != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "log-pcap: invalid mode \"%s\". Valid options: \"normal\", " "\"sguil\", or \"multi\" mode ", s_mode); exit(EXIT_FAILURE); } } const char *s_dir = NULL; s_dir = ConfNodeLookupChildValue(conf, "dir"); if (s_dir == NULL) { s_dir = ConfNodeLookupChildValue(conf, "sguil-base-dir"); } if (s_dir == NULL) { if (pl->mode == LOGMODE_SGUIL) { SCLogError(SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING, "log-pcap \"sguil\" mode requires \"sguil-base-dir\" " "option to be set."); exit(EXIT_FAILURE); } else { char *log_dir = NULL; log_dir = ConfigGetLogDirectory(); strlcpy(pl->dir, log_dir, sizeof(pl->dir)); SCLogInfo("Using log dir %s", pl->dir); } } else { if (PathIsAbsolute(s_dir)) { strlcpy(pl->dir, s_dir, sizeof(pl->dir)); } else { char *log_dir = NULL; log_dir = ConfigGetLogDirectory(); snprintf(pl->dir, sizeof(pl->dir), "%s/%s", log_dir, s_dir); } struct stat stat_buf; if (stat(pl->dir, &stat_buf) != 0) { SCLogError(SC_ERR_LOGDIR_CONFIG, "The sguil-base-dir directory \"%s\" " "supplied doesn't exist. Shutting down the engine", pl->dir); exit(EXIT_FAILURE); } SCLogInfo("Using log dir %s", pl->dir); } } SCLogInfo("using %s logging", pl->mode == LOGMODE_SGUIL ? "Sguil compatible" : (pl->mode == LOGMODE_MULTI ? "multi" : "normal")); uint32_t max_file_limit = DEFAULT_FILE_LIMIT; if (conf != NULL) { const char *max_number_of_files_s = NULL; max_number_of_files_s = ConfNodeLookupChildValue(conf, "max-files"); if (max_number_of_files_s != NULL) { if (ByteExtractStringUint32(&max_file_limit, 10, 0, max_number_of_files_s) == -1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize " "pcap-log output, invalid number of files limit: %s", max_number_of_files_s); exit(EXIT_FAILURE); } else if (max_file_limit < 1) { SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to initialize pcap-log output, limit less than " "allowed minimum."); exit(EXIT_FAILURE); } else { pl->max_files = max_file_limit; pl->use_ringbuffer = RING_BUFFER_MODE_ENABLED; } } } const char *ts_format = NULL; if (conf != NULL) { /* To faciliate unit tests. */ ts_format = ConfNodeLookupChildValue(conf, "ts-format"); } if (ts_format != NULL) { if (strcasecmp(ts_format, "usec") == 0) { pl->timestamp_format = TS_FORMAT_USEC; } else if (strcasecmp(ts_format, "sec") != 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "log-pcap ts_format specified %s is invalid must be" " \"sec\" or \"usec\"", ts_format); exit(EXIT_FAILURE); } } const char *use_stream_depth = NULL; if (conf != NULL) { /* To faciliate unit tests. */ use_stream_depth = ConfNodeLookupChildValue(conf, "use-stream-depth"); } if (use_stream_depth != NULL) { if (ConfValIsFalse(use_stream_depth)) { pl->use_stream_depth = USE_STREAM_DEPTH_DISABLED; } else if (ConfValIsTrue(use_stream_depth)) { pl->use_stream_depth = USE_STREAM_DEPTH_ENABLED; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "log-pcap use_stream_depth specified is invalid must be"); exit(EXIT_FAILURE); } } const char *honor_pass_rules = NULL; if (conf != NULL) { /* To faciliate unit tests. */ honor_pass_rules = ConfNodeLookupChildValue(conf, "honor-pass-rules"); } if (honor_pass_rules != NULL) { if (ConfValIsFalse(honor_pass_rules)) { pl->honor_pass_rules = HONOR_PASS_RULES_DISABLED; } else if (ConfValIsTrue(honor_pass_rules)) { pl->honor_pass_rules = HONOR_PASS_RULES_ENABLED; } else { SCLogError(SC_ERR_INVALID_ARGUMENT, "log-pcap honor-pass-rules specified is invalid"); exit(EXIT_FAILURE); } } /* create the output ctx and send it back */ OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for OutputCtx."); exit(EXIT_FAILURE); } output_ctx->data = pl; output_ctx->DeInit = PcapLogFileDeInitCtx; g_pcap_data = pl; return output_ctx; } static void PcapLogFileDeInitCtx(OutputCtx *output_ctx) { if (output_ctx == NULL) return; PcapLogData *pl = output_ctx->data; PcapFileName *pf = NULL; TAILQ_FOREACH(pf, &pl->pcap_file_list, next) { SCLogDebug("PCAP files left at exit: %s\n", pf->filename); } PcapLogDataFree(pl); SCFree(output_ctx); return; } /** * \brief Read the config set the file pointer, open the file * * \param PcapLogData. * * \retval -1 if failure * \retval 0 if succesful */ static int PcapLogOpenFileCtx(PcapLogData *pl) { char *filename = NULL; PCAPLOG_PROFILE_START; if (pl->filename != NULL) filename = pl->filename; else { filename = SCMalloc(PATH_MAX); if (unlikely(filename == NULL)) { return -1; } pl->filename = filename; } /** get the time so we can have a filename with seconds since epoch */ struct timeval ts; memset(&ts, 0x00, sizeof(struct timeval)); TimeGet(&ts); /* Place to store the name of our PCAP file */ PcapFileName *pf = SCMalloc(sizeof(PcapFileName)); if (unlikely(pf == NULL)) { return -1; } memset(pf, 0, sizeof(PcapFileName)); if (pl->mode == LOGMODE_SGUIL) { struct tm local_tm; struct tm *tms = SCLocalTime(ts.tv_sec, &local_tm); char dirname[32], dirfull[PATH_MAX] = ""; snprintf(dirname, sizeof(dirname), "%04d-%02d-%02d", tms->tm_year + 1900, tms->tm_mon + 1, tms->tm_mday); /* create the filename to use */ snprintf(dirfull, PATH_MAX, "%s/%s", pl->dir, dirname); /* if mkdir fails file open will fail, so deal with errors there */ #ifndef OS_WIN32 (void)mkdir(dirfull, 0700); #else (void)mkdir(dirfull); #endif if ((pf->dirname = SCStrdup(dirfull)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for " "directory name"); goto error; } if (pl->timestamp_format == TS_FORMAT_SEC) { snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, dirfull, pl->prefix, (uint32_t)ts.tv_sec); } else { snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32, dirfull, pl->prefix, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec); } } else if (pl->mode == LOGMODE_NORMAL) { /* create the filename to use */ if (pl->timestamp_format == TS_FORMAT_SEC) { snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, pl->dir, pl->prefix, (uint32_t)ts.tv_sec); } else { snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32, pl->dir, pl->prefix, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec); } } else if (pl->mode == LOGMODE_MULTI) { if (pl->filename_part_cnt > 0) { /* assemble filename from stored tokens */ strlcpy(filename, pl->dir, PATH_MAX); strlcat(filename, "/", PATH_MAX); int i; for (i = 0; i < pl->filename_part_cnt; i++) { if (pl->filename_parts[i] == NULL ||strlen(pl->filename_parts[i]) == 0) continue; /* handle variables */ if (pl->filename_parts[i][0] == '%') { char str[64] = ""; if (strlen(pl->filename_parts[i]) < 2) continue; switch(pl->filename_parts[i][1]) { case 'n': snprintf(str, sizeof(str), "%u", pl->thread_number); break; case 'i': { long thread_id = SCGetThreadIdLong(); snprintf(str, sizeof(str), "%"PRIu64, (uint64_t)thread_id); break; } case 't': /* create the filename to use */ if (pl->timestamp_format == TS_FORMAT_SEC) { snprintf(str, sizeof(str), "%"PRIu32, (uint32_t)ts.tv_sec); } else { snprintf(str, sizeof(str), "%"PRIu32".%"PRIu32, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec); } } strlcat(filename, str, PATH_MAX); /* copy the rest over */ } else { strlcat(filename, pl->filename_parts[i], PATH_MAX); } } } else { /* create the filename to use */ if (pl->timestamp_format == TS_FORMAT_SEC) { snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32, pl->dir, pl->prefix, pl->thread_number, (uint32_t)ts.tv_sec); } else { snprintf(filename, PATH_MAX, "%s/%s.%u.%" PRIu32 ".%" PRIu32, pl->dir, pl->prefix, pl->thread_number, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec); } } SCLogDebug("multi-mode: filename %s", filename); } if ((pf->filename = SCStrdup(pl->filename)) == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory. For filename"); goto error; } SCLogDebug("Opening pcap file log %s", pf->filename); TAILQ_INSERT_TAIL(&pl->pcap_file_list, pf, next); PCAPLOG_PROFILE_END(pl->profile_open); return 0; error: PcapFileNameFree(pf); return -1; } static int profiling_pcaplog_enabled = 0; static int profiling_pcaplog_output_to_file = 0; static char *profiling_pcaplog_file_name = NULL; static char *profiling_pcaplog_file_mode = "a"; static void FormatNumber(uint64_t num, char *str, size_t size) { if (num < 1000UL) snprintf(str, size, "%"PRIu64, num); else if (num < 1000000UL) snprintf(str, size, "%3.1fk", (float)num/1000UL); else if (num < 1000000000UL) snprintf(str, size, "%3.1fm", (float)num/1000000UL); else snprintf(str, size, "%3.1fb", (float)num/1000000000UL); } static void ProfileReportPair(FILE *fp, const char *name, PcapLogProfileData *p) { char ticks_str[32] = "n/a"; char cnt_str[32] = "n/a"; char avg_str[32] = "n/a"; FormatNumber((uint64_t)p->cnt, cnt_str, sizeof(cnt_str)); FormatNumber((uint64_t)p->total, ticks_str, sizeof(ticks_str)); if (p->cnt && p->total) FormatNumber((uint64_t)(p->total/p->cnt), avg_str, sizeof(avg_str)); fprintf(fp, "%-28s %-10s %-10s %-10s\n", name, cnt_str, avg_str, ticks_str); } static void ProfileReport(FILE *fp, PcapLogData *pl) { ProfileReportPair(fp, "open", &pl->profile_open); ProfileReportPair(fp, "close", &pl->profile_close); ProfileReportPair(fp, "write", &pl->profile_write); ProfileReportPair(fp, "rotate (incl open/close)", &pl->profile_rotate); ProfileReportPair(fp, "handles", &pl->profile_handles); ProfileReportPair(fp, "lock", &pl->profile_lock); ProfileReportPair(fp, "unlock", &pl->profile_unlock); } static void FormatBytes(uint64_t num, char *str, size_t size) { if (num < 1000UL) snprintf(str, size, "%"PRIu64, num); else if (num < 1048576UL) snprintf(str, size, "%3.1fKiB", (float)num/1000UL); else if (num < 1073741824UL) snprintf(str, size, "%3.1fMiB", (float)num/1000000UL); else snprintf(str, size, "%3.1fGiB", (float)num/1000000000UL); } static void PcapLogProfilingDump(PcapLogData *pl) { FILE *fp = NULL; if (profiling_pcaplog_enabled == 0) return; if (profiling_pcaplog_output_to_file == 1) { fp = fopen(profiling_pcaplog_file_name, profiling_pcaplog_file_mode); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", profiling_pcaplog_file_name, strerror(errno)); return; } } else { fp = stdout; } /* counters */ fprintf(fp, "\n\nOperation Cnt Avg ticks Total ticks\n"); fprintf(fp, "---------------------------- ---------- ---------- -----------\n"); ProfileReport(fp, pl); uint64_t total = pl->profile_write.total + pl->profile_rotate.total + pl->profile_handles.total + pl->profile_open.total + pl->profile_close.total + pl->profile_lock.total + pl->profile_unlock.total; /* overall stats */ fprintf(fp, "\nOverall: %"PRIu64" bytes written, average %d bytes per write.\n", pl->profile_data_size, (int)(pl->profile_data_size / pl->profile_write.cnt)); fprintf(fp, " PCAP data structure overhead: %"PRIuMAX" per write.\n", (uintmax_t)sizeof(struct pcap_pkthdr)); /* print total bytes written */ char bytes_str[32]; FormatBytes(pl->profile_data_size, bytes_str, sizeof(bytes_str)); fprintf(fp, " Size written: %s\n", bytes_str); /* ticks per MiB and GiB */ uint64_t ticks_per_mib = 0, ticks_per_gib = 0; uint64_t mib = pl->profile_data_size/(1024*1024); if (mib) ticks_per_mib = total/mib; char ticks_per_mib_str[32] = "n/a"; if (ticks_per_mib > 0) FormatNumber(ticks_per_mib, ticks_per_mib_str, sizeof(ticks_per_mib_str)); fprintf(fp, " Ticks per MiB: %s\n", ticks_per_mib_str); uint64_t gib = pl->profile_data_size/(1024*1024*1024); if (gib) ticks_per_gib = total/gib; char ticks_per_gib_str[32] = "n/a"; if (ticks_per_gib > 0) FormatNumber(ticks_per_gib, ticks_per_gib_str, sizeof(ticks_per_gib_str)); fprintf(fp, " Ticks per GiB: %s\n", ticks_per_gib_str); if (fp != stdout) fclose(fp); } void PcapLogProfileSetup(void) { ConfNode *conf = ConfGetNode("profiling.pcap-log"); if (conf != NULL && ConfNodeChildValueIsTrue(conf, "enabled")) { profiling_pcaplog_enabled = 1; SCLogInfo("pcap-log profiling enabled"); const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename != NULL) { char *log_dir; log_dir = ConfigGetLogDirectory(); profiling_pcaplog_file_name = SCMalloc(PATH_MAX); if (unlikely(profiling_pcaplog_file_name == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "can't duplicate file name"); exit(EXIT_FAILURE); } snprintf(profiling_pcaplog_file_name, PATH_MAX, "%s/%s", log_dir, filename); const char *v = ConfNodeLookupChildValue(conf, "append"); if (v == NULL || ConfValIsTrue(v)) { profiling_pcaplog_file_mode = "a"; } else { profiling_pcaplog_file_mode = "w"; } profiling_pcaplog_output_to_file = 1; SCLogInfo("pcap-log profiling output goes to %s (mode %s)", profiling_pcaplog_file_name, profiling_pcaplog_file_mode); } } } suricata-3.2.1/src/detect-gid.c0000644000000000000000000001146613051004444013166 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Breno Silva * * Implements the gid keyword */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "flow-var.h" #include "decode-events.h" #include "detect-gid.h" #include "util-unittest.h" #include "util-debug.h" static int DetectGidSetup (DetectEngineCtx *, Signature *, char *); /** * \brief Registration function for gid: keyword */ void DetectGidRegister (void) { sigmatch_table[DETECT_GID].name = "gid"; sigmatch_table[DETECT_GID].desc = "give different groups of signatures another id value"; sigmatch_table[DETECT_GID].url = DOC_URL DOC_VERSION "/rules/meta.html#gid-group-id"; sigmatch_table[DETECT_GID].Match = NULL; sigmatch_table[DETECT_GID].Setup = DetectGidSetup; sigmatch_table[DETECT_GID].Free = NULL; sigmatch_table[DETECT_GID].RegisterTests = GidRegisterTests; } /** * \internal * \brief this function is used to add the parsed gid into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rawstr pointer to the user provided gid options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectGidSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) { char *str = rawstr; char duped = 0; /* Strip leading and trailing "s. */ if (rawstr[0] == '\"') { str = SCStrdup(rawstr + 1); if (unlikely(str == NULL)) { return -1; } if (strlen(str) && str[strlen(str) - 1] == '\"') { str[strlen(str) - 1] = '\"'; } duped = 1; } unsigned long gid = 0; char *endptr = NULL; gid = strtoul(rawstr, &endptr, 10); if (endptr == NULL || *endptr != '\0') { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid character as arg " "to gid keyword"); goto error; } if (gid >= UINT_MAX) { SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "gid value to high, max %u", UINT_MAX); goto error; } s->gid = (uint32_t)gid; if (duped) SCFree(str); return 0; error: if (duped) SCFree(str); return -1; } /* * ONLY TESTS BELOW THIS COMMENT */ #ifdef UNITTESTS /** * \test GidTestParse01 is a test for a valid gid value * * \retval 1 on succces * \retval 0 on failure */ static int GidTestParse01 (void) { int result = 0; Signature *s = NULL; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; s = DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:1;)"); if (s == NULL || s->gid != 1) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test GidTestParse02 is a test for an invalid gid value * * \retval 1 on succces * \retval 0 on failure */ static int GidTestParse02 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:a;)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } /** * \test Test a gid consisting of a single quote. * * \retval 1 on succces * \retval 0 on failure */ static int GidTestParse03 (void) { int result = 0; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; if (DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"ABC\"; gid:\";)") != NULL) goto end; result = 1; end: if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for Gid */ void GidRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("GidTestParse01", GidTestParse01); UtRegisterTest("GidTestParse02", GidTestParse02); UtRegisterTest("GidTestParse03", GidTestParse03); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-spm-hs.c0000644000000000000000000001604313051004444013333 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Justin Viiret * * Single pattern matcher that uses the Hyperscan regex matcher. */ #include "suricata-common.h" #include "suricata.h" #include "util-hyperscan.h" #include "util-spm-hs.h" #ifdef BUILD_HYPERSCAN #include /** * \internal * \brief Hyperscan match callback, called by hs_scan. */ static int MatchEvent(unsigned int id, unsigned long long from, unsigned long long to, unsigned int flags, void *context) { uint64_t *match_offset = context; BUG_ON(*match_offset != UINT64_MAX); *match_offset = to; return 1; /* Terminate matching. */ } typedef struct SpmHsCtx_ { hs_database_t *db; uint16_t needle_len; } SpmHsCtx; static void HSDestroyCtx(SpmCtx *ctx) { if (ctx == NULL) { return; } SpmHsCtx *sctx = ctx->ctx; if (sctx) { hs_free_database(sctx->db); SCFree(sctx); } SCFree(ctx); } static int HSBuildDatabase(const uint8_t *needle, uint16_t needle_len, int nocase, SpmHsCtx *sctx, SpmGlobalThreadCtx *global_thread_ctx) { char *expr = HSRenderPattern(needle, needle_len); if (expr == NULL) { SCLogDebug("HSRenderPattern returned NULL"); return -1; } unsigned flags = nocase ? HS_FLAG_CASELESS : 0; hs_database_t *db = NULL; hs_compile_error_t *compile_err = NULL; hs_error_t err = hs_compile(expr, flags, HS_MODE_BLOCK, NULL, &db, &compile_err); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "Unable to compile '%s' with Hyperscan, " "returned %d.", expr, err); exit(EXIT_FAILURE); } SCFree(expr); /* Update scratch for this database. */ hs_scratch_t *scratch = global_thread_ctx->ctx; err = hs_alloc_scratch(db, &scratch); if (err != HS_SUCCESS) { /* If scratch allocation failed, this is not recoverable: other SPM * contexts may need this scratch space. */ SCLogError(SC_ERR_FATAL, "Unable to alloc scratch for Hyperscan, returned %d.", err); exit(EXIT_FAILURE); } global_thread_ctx->ctx = scratch; sctx->db = db; sctx->needle_len = needle_len; return 0; } static SpmCtx *HSInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx) { SpmCtx *ctx = SCMalloc(sizeof(SpmCtx)); if (ctx == NULL) { SCLogDebug("Unable to alloc SpmCtx."); return NULL; } memset(ctx, 0, sizeof(SpmCtx)); ctx->matcher = SPM_HS; SpmHsCtx *sctx = SCMalloc(sizeof(SpmHsCtx)); if (sctx == NULL) { SCLogDebug("Unable to alloc SpmHsCtx."); SCFree(ctx); return NULL; } ctx->ctx = sctx; memset(sctx, 0, sizeof(SpmHsCtx)); if (HSBuildDatabase(needle, needle_len, nocase, sctx, global_thread_ctx) != 0) { SCLogDebug("HSBuildDatabase failed."); HSDestroyCtx(ctx); return NULL; } return ctx; } static uint8_t *HSScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx, const uint8_t *haystack, uint16_t haystack_len) { const SpmHsCtx *sctx = ctx->ctx; hs_scratch_t *scratch = thread_ctx->ctx; if (unlikely(haystack_len == 0)) { return NULL; } uint64_t match_offset = UINT64_MAX; hs_error_t err = hs_scan(sctx->db, (const char *)haystack, haystack_len, 0, scratch, MatchEvent, &match_offset); if (err != HS_SUCCESS && err != HS_SCAN_TERMINATED) { /* An error value (other than HS_SCAN_TERMINATED) from hs_scan() * indicates that it was passed an invalid database or scratch region, * which is not something we can recover from at scan time. */ SCLogError(SC_ERR_FATAL, "Hyperscan returned fatal error %d.", err); exit(EXIT_FAILURE); } if (match_offset == UINT64_MAX) { return NULL; } BUG_ON(match_offset < sctx->needle_len); BUG_ON(match_offset > UINT16_MAX); /* haystack_len is a uint16_t */ /* Note: existing API returns non-const ptr */ return (uint8_t *)haystack + (match_offset - sctx->needle_len); } static SpmGlobalThreadCtx *HSInitGlobalThreadCtx(void) { SpmGlobalThreadCtx *global_thread_ctx = SCMalloc(sizeof(SpmGlobalThreadCtx)); if (global_thread_ctx == NULL) { SCLogDebug("Unable to alloc SpmGlobalThreadCtx."); return NULL; } memset(global_thread_ctx, 0, sizeof(*global_thread_ctx)); global_thread_ctx->matcher = SPM_HS; /* We store scratch in the HS-specific ctx. This will be initialized as * patterns are compiled by SpmInitCtx. */ global_thread_ctx->ctx = NULL; return global_thread_ctx; } static void HSDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx) { if (global_thread_ctx == NULL) { return; } hs_free_scratch(global_thread_ctx->ctx); SCFree(global_thread_ctx); } static void HSDestroyThreadCtx(SpmThreadCtx *thread_ctx) { if (thread_ctx == NULL) { return; } hs_free_scratch(thread_ctx->ctx); SCFree(thread_ctx); } static SpmThreadCtx *HSMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx) { SpmThreadCtx *thread_ctx = SCMalloc(sizeof(SpmThreadCtx)); if (thread_ctx == NULL) { SCLogDebug("Unable to alloc SpmThreadCtx."); return NULL; } memset(thread_ctx, 0, sizeof(*thread_ctx)); thread_ctx->matcher = SPM_HS; if (global_thread_ctx->ctx != NULL) { hs_scratch_t *scratch = NULL; hs_error_t err = hs_clone_scratch(global_thread_ctx->ctx, &scratch); if (err != HS_SUCCESS) { SCLogError(SC_ERR_FATAL, "Unable to clone scratch (error %d).", err); exit(EXIT_FAILURE); } thread_ctx->ctx = scratch; } return thread_ctx; } void SpmHSRegister(void) { spm_table[SPM_HS].name = "hs"; spm_table[SPM_HS].InitGlobalThreadCtx = HSInitGlobalThreadCtx; spm_table[SPM_HS].DestroyGlobalThreadCtx = HSDestroyGlobalThreadCtx; spm_table[SPM_HS].MakeThreadCtx = HSMakeThreadCtx; spm_table[SPM_HS].DestroyThreadCtx = HSDestroyThreadCtx; spm_table[SPM_HS].InitCtx = HSInitCtx; spm_table[SPM_HS].DestroyCtx = HSDestroyCtx; spm_table[SPM_HS].Scan = HSScan; } #endif /* BUILD_HYPERSCAN */ suricata-3.2.1/src/detect-priority.h0000644000000000000000000000200113051004444014272 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Anoop Saldanha * * Implements the priority keyword */ #ifndef __DETECT_PRIORITY_H__ #define __DETECT_PRIORITY_H__ /* prototypes */ void DetectPriorityRegister (void); #endif /* __DETECT_PRIORITY_H__ */ suricata-3.2.1/src/detect-tls-sni.c0000644000000000000000000002375513051004444014020 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland * * Implements support for tls_sni keyword. */ #include "suricata-common.h" #include "threads.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-content.h" #include "detect-pcre.h" #include "flow.h" #include "flow-util.h" #include "flow-var.h" #include "util-debug.h" #include "util-unittest.h" #include "util-spm.h" #include "util-print.h" #include "stream-tcp.h" #include "app-layer.h" #include "app-layer-ssl.h" #include "detect-engine-tls.h" #include "util-unittest.h" #include "util-unittest-helper.h" static int DetectTlsSniSetup(DetectEngineCtx *, Signature *, char *); static void DetectTlsSniRegisterTests(void); /** * \brief Registration function for keyword: tls_sni */ void DetectTlsSniRegister(void) { sigmatch_table[DETECT_AL_TLS_SNI].name = "tls_sni"; sigmatch_table[DETECT_AL_TLS_SNI].desc = "content modifier to match specifically and only on the TLS SNI buffer"; sigmatch_table[DETECT_AL_TLS_SNI].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tls-sni"; sigmatch_table[DETECT_AL_TLS_SNI].Match = NULL; sigmatch_table[DETECT_AL_TLS_SNI].AppLayerMatch = NULL; sigmatch_table[DETECT_AL_TLS_SNI].Setup = DetectTlsSniSetup; sigmatch_table[DETECT_AL_TLS_SNI].Free = NULL; sigmatch_table[DETECT_AL_TLS_SNI].RegisterTests = DetectTlsSniRegisterTests; sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_sni", SIG_FLAG_TOSERVER, DETECT_SM_LIST_TLSSNI_MATCH, 2, PrefilterTxTlsSniRegister); DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOSERVER, DETECT_SM_LIST_TLSSNI_MATCH, DetectEngineInspectTlsSni); } /** * \brief this function setup the tls_sni modifier keyword used in the rule * * \param de_ctx Pointer to the Detection Engine Context * \param s Pointer to the Signature to which the current keyword belongs * \param str Should hold an empty string always * * \retval 0 On success */ static int DetectTlsSniSetup(DetectEngineCtx *de_ctx, Signature *s, char *str) { s->list = DETECT_SM_LIST_TLSSNI_MATCH; s->alproto = ALPROTO_TLS; return 0; } #ifdef UNITTESTS /** * \test Test matching on a simple google.com SNI */ static int DetectTlsSniTest01(void) { /* client hello */ uint8_t buf[] = { 0x16, 0x03, 0x03, 0x00, 0x82, 0x01, 0x00, 0x00, 0x7E, 0x03, 0x03, 0x57, 0x04, 0x9F, 0x5D, 0xC9, 0x5C, 0x87, 0xAE, 0xF2, 0xA7, 0x4A, 0xFC, 0x59, 0x78, 0x23, 0x31, 0x61, 0x2D, 0x29, 0x92, 0xB6, 0x70, 0xA5, 0xA1, 0xFC, 0x0E, 0x79, 0xFE, 0xC3, 0x97, 0x37, 0xC0, 0x00, 0x00, 0x44, 0x00, 0x04, 0x00, 0x05, 0x00, 0x0A, 0x00, 0x0D, 0x00, 0x10, 0x00, 0x13, 0x00, 0x16, 0x00, 0x2F, 0x00, 0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00, 0x45, 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B, 0x00, 0x84, 0x00, 0x87, 0x00, 0xFF, 0x01, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0D, 0x00, 0x00, 0x0A, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, }; Flow f; SSLState *ssl_state = NULL; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 443); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_sni option\"; " "tls_sni; content:\"google.com\"; sid:1;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf, sizeof(buf)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } /** * \test Test matching on a simple google.com SNI with pcre */ static int DetectTlsSniTest02(void) { /* client hello */ uint8_t buf[] = { 0x16, 0x03, 0x03, 0x00, 0x82, 0x01, 0x00, 0x00, 0x7E, 0x03, 0x03, 0x57, 0x04, 0x9F, 0x5D, 0xC9, 0x5C, 0x87, 0xAE, 0xF2, 0xA7, 0x4A, 0xFC, 0x59, 0x78, 0x23, 0x31, 0x61, 0x2D, 0x29, 0x92, 0xB6, 0x70, 0xA5, 0xA1, 0xFC, 0x0E, 0x79, 0xFE, 0xC3, 0x97, 0x37, 0xC0, 0x00, 0x00, 0x44, 0x00, 0x04, 0x00, 0x05, 0x00, 0x0A, 0x00, 0x0D, 0x00, 0x10, 0x00, 0x13, 0x00, 0x16, 0x00, 0x2F, 0x00, 0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, 0x00, 0x44, 0x00, 0x45, 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B, 0x00, 0x84, 0x00, 0x87, 0x00, 0xFF, 0x01, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0D, 0x00, 0x00, 0x0A, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x2E, 0x63, 0x6F, 0x6D, }; Flow f; SSLState *ssl_state = NULL; Packet *p = NULL; Signature *s = NULL; ThreadVars tv; DetectEngineThreadCtx *det_ctx = NULL; TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&tv, 0, sizeof(ThreadVars)); memset(&f, 0, sizeof(Flow)); memset(&ssn, 0, sizeof(TcpSession)); p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP, "192.168.1.5", "192.168.1.1", 41424, 443); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.flags |= FLOW_IPV4; f.proto = IPPROTO_TCP; f.protomap = FlowGetProtoMapping(f.proto); p->flow = &f; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED; f.alproto = ALPROTO_TLS; StreamTcpInitConfig(TRUE); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); de_ctx->mpm_matcher = mpm_default_matcher; de_ctx->flags |= DE_QUIET; s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_sni option\"; " "tls_sni; content:\"google\"; nocase; " "pcre:\"/google\\.com$/i\"; sid:1;)"); FAIL_IF_NULL(s); s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any " "(msg:\"Test tls_sni option\"; " "tls_sni; content:\"google\"; nocase; " "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)"); FAIL_IF_NULL(s); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS, STREAM_TOSERVER, buf, sizeof(buf)); FLOWLOCK_UNLOCK(&f); FAIL_IF(r != 0); ssl_state = f.alstate; FAIL_IF_NULL(ssl_state); /* do detect */ SigMatchSignatures(&tv, de_ctx, det_ctx, p); FAIL_IF_NOT(PacketAlertCheck(p, 1)); FAIL_IF_NOT(PacketAlertCheck(p, 2)); AppLayerParserThreadCtxFree(alp_tctx); DetectEngineThreadCtxDeinit(&tv, det_ctx); DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePacket(p); PASS; } #endif static void DetectTlsSniRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectTlsSniTest01", DetectTlsSniTest01); UtRegisterTest("DetectTlsSniTest02", DetectTlsSniTest02); #endif } suricata-3.2.1/src/suricata.h0000644000000000000000000001276113051004451012772 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \mainpage Doxygen documentation * * \section intro_sec Introduction * * The Suricata Engine is an Open Source Next Generation Intrusion Detection * and Prevention Engine. This engine is not intended to just replace or * emulate the existing tools in the industry, but will bring new ideas and * technologies to the field. * * \section dev_doc Developer documentation * * You've reach the automically generated documentation of Suricata. This * document contains information about architecture and code structure. It * is attended for developers wanting to understand or contribute to Suricata. * * \subsection modules Modules * * Documentation is generate from comments placed in all parts of the code. * But you will also find some groups describing specific functional parts: * - \ref decode * - \ref httplayer * - \ref sigstate * - \ref threshold * * \section archi Architecture * * \subsection datastruct Data structures * * Regarding matching, there is three main data structures which are: * - ::Packet: Data relative to an individual packet with information about * linked structure such as the ::Flow the ::Packet belongs to. * - ::Flow: Information about a flow for example a TCP session * - ::StreamMsg: structure containing the reassembled data * * \subsection runmode Running mode * * Suricata is multithreaded and running modes define how the different * threads are working together. You can see util-runmodes.c for example * of running mode. */ /** * \file * * \author Victor Julien */ #ifndef __SURICATA_H__ #define __SURICATA_H__ #include "suricata-common.h" #include "packet-queue.h" #include "data-queue.h" /* the name of our binary */ #define PROG_NAME "Suricata" #define PROG_VER "3.2.1" /* workaround SPlint error (don't know __gnuc_va_list) */ #ifdef S_SPLINT_S # include # define CONFIG_DIR "/etc/suricata" #endif #define DEFAULT_CONF_FILE CONFIG_DIR "/suricata.yaml" #define DEFAULT_PID_DIR LOCAL_STATE_DIR "/run/" #define DEFAULT_PID_BASENAME "suricata.pid" #define DEFAULT_PID_FILENAME DEFAULT_PID_DIR DEFAULT_PID_BASENAME #define DOC_URL "http://suricata.readthedocs.io/en/" #if defined RELEASE #define DOC_VERSION PROG_VER #else #define DOC_VERSION "latest" #endif /* runtime engine control flags */ #define SURICATA_STOP (1 << 0) /**< gracefully stop the engine: process all outstanding packets first */ #define SURICATA_DONE (1 << 2) /**< packets capture ended */ /* Engine stage/status*/ enum { SURICATA_INIT = 0, SURICATA_RUNTIME, SURICATA_DEINIT }; /* Engine is acting as */ enum EngineMode { ENGINE_MODE_IDS, ENGINE_MODE_IPS, }; void EngineModeSetIPS(void); void EngineModeSetIDS(void); int EngineModeIsIPS(void); int EngineModeIsIDS(void); /* Box is acting as router */ enum { SURI_HOST_IS_SNIFFER_ONLY, SURI_HOST_IS_ROUTER, }; #define IS_SURI_HOST_MODE_SNIFFER_ONLY(host_mode) ((host_mode) == SURI_HOST_IS_SNIFFER_ONLY) #define IS_SURI_HOST_MODE_ROUTER(host_mode) ((host_mode) == SURI_HOST_IS_ROUTER) #include "runmodes.h" /* queue's between various other threads * XXX move to the TmQueue structure later */ PacketQueue trans_q[256]; SCDQDataQueue data_queues[256]; typedef struct SCInstance_ { enum RunModes run_mode; char pcap_dev[128]; char *sig_file; int sig_file_exclusive; char *pid_filename; char *regex_arg; char *keyword_info; char *runmode_custom_mode; #ifndef OS_WIN32 char *user_name; char *group_name; uint8_t do_setuid; uint8_t do_setgid; uint32_t userid; uint32_t groupid; #endif /* OS_WIN32 */ int delayed_detect; int disabled_detect; int daemon; int offline; int verbose; int checksum_validation; struct timeval start_time; char *log_dir; const char *progname; /**< pointer to argv[0] */ const char *conf_filename; } SCInstance; /* memset to zeros, and mutex init! */ void GlobalsInitPreConfig(); extern volatile uint8_t suricata_ctl_flags; /* uppercase to lowercase conversion lookup table */ uint8_t g_u8_lowercasetable[256]; /* marco to do the actual lookup */ //#define u8_tolower(c) g_u8_lowercasetable[(c)] // these 2 are slower: //#define u8_tolower(c) ((c) >= 'A' && (c) <= 'Z') ? g_u8_lowercasetable[(c)] : (c) //#define u8_tolower(c) (((c) >= 'A' && (c) <= 'Z') ? ((c) + ('a' - 'A')) : (c)) /* this is faster than the table lookup */ #include #define u8_tolower(c) tolower((uint8_t)(c)) void EngineStop(void); void EngineDone(void); int RunmodeIsUnittests(void); int RunmodeGetCurrent(void); int IsRuleReloadSet(int quiet); extern int run_mode; void PreRunInit(const int runmode); void PreRunPostPrivsDropInit(const int runmode); void PostRunDeinit(const int runmode, struct timeval *start_time); #endif /* __SURICATA_H__ */ suricata-3.2.1/src/decode-ppp.c0000644000000000000000000002017313051004444013170 00000000000000/* Copyright (C) 2007-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup decode * * @{ */ /** * \file * * \author Breno Silva Pinto * * Decode PPP */ #include "suricata-common.h" #include "decode.h" #include "decode-ppp.h" #include "decode-events.h" #include "flow.h" #include "util-unittest.h" #include "util-debug.h" int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_ppp); if (unlikely(len < PPP_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, PPP_PKT_TOO_SMALL); return TM_ECODE_FAILED; } p->ppph = (PPPHdr *)pkt; if (unlikely(p->ppph == NULL)) return TM_ECODE_FAILED; SCLogDebug("p %p pkt %p PPP protocol %04x Len: %" PRId32 "", p, pkt, ntohs(p->ppph->protocol), len); switch (ntohs(p->ppph->protocol)) { case PPP_VJ_UCOMP: if (unlikely(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN))) { ENGINE_SET_INVALID_EVENT(p,PPPVJU_PKT_TOO_SMALL); p->ppph = NULL; return TM_ECODE_FAILED; } if (likely(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPP_HEADER_LEN)) == 4)) { return DecodeIPV4(tv, dtv, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq); } else return TM_ECODE_FAILED; break; case PPP_IP: if (unlikely(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN))) { ENGINE_SET_INVALID_EVENT(p,PPPIPV4_PKT_TOO_SMALL); p->ppph = NULL; return TM_ECODE_FAILED; } return DecodeIPV4(tv, dtv, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq); /* PPP IPv6 was not tested */ case PPP_IPV6: if (unlikely(len < (PPP_HEADER_LEN + IPV6_HEADER_LEN))) { ENGINE_SET_INVALID_EVENT(p,PPPIPV6_PKT_TOO_SMALL); p->ppph = NULL; return TM_ECODE_FAILED; } return DecodeIPV6(tv, dtv, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq); case PPP_VJ_COMP: case PPP_IPX: case PPP_OSI: case PPP_NS: case PPP_DECNET: case PPP_APPLE: case PPP_BRPDU: case PPP_STII: case PPP_VINES: case PPP_HELLO: case PPP_LUXCOM: case PPP_SNS: case PPP_MPLS_UCAST: case PPP_MPLS_MCAST: case PPP_IPCP: case PPP_OSICP: case PPP_NSCP: case PPP_DECNETCP: case PPP_APPLECP: case PPP_IPXCP: case PPP_STIICP: case PPP_VINESCP: case PPP_IPV6CP: case PPP_MPLSCP: case PPP_LCP: case PPP_PAP: case PPP_LQM: case PPP_CHAP: ENGINE_SET_EVENT(p,PPP_UNSUP_PROTO); return TM_ECODE_OK; default: SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol)); ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE); return TM_ECODE_OK; } } /* TESTS BELOW */ #ifdef UNITTESTS /* DecodePPPtest01 * Decode malformed ip layer PPP packet * Expected test value: 1 */ static int DecodePPPtest01 (void) { uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL); /* Function my returns here with expected value */ if(ENGINE_ISSET_EVENT(p,PPPIPV4_PKT_TOO_SMALL)) { SCFree(p); return 1; } SCFree(p); return 0; } /* DecodePPPtest02 * Decode malformed ppp layer packet * Expected test value: 1 */ static int DecodePPPtest02 (void) { uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0xff, 0x45, 0xc0, 0x00, 0x2c, 0x4d, 0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01, 0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00, 0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL); /* Function must returns here */ if(ENGINE_ISSET_EVENT(p,PPP_WRONG_TYPE)) { SCFree(p); return 1; } SCFree(p); return 0; } /** DecodePPPtest03 * \brief Decode good PPP packet, additionally the IPv4 packet inside is * 4 bytes short. * \retval 0 Test failed * \retval 1 Test succeeded */ static int DecodePPPtest03 (void) { uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00, 0x2c, 0x4d, 0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01, 0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00, 0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL); FlowShutdown(); if(p->ppph == NULL) { SCFree(p); return 0; } if(ENGINE_ISSET_EVENT(p,PPP_PKT_TOO_SMALL)) { SCFree(p); return 0; } if(ENGINE_ISSET_EVENT(p,PPPIPV4_PKT_TOO_SMALL)) { SCFree(p); return 0; } if(ENGINE_ISSET_EVENT(p,PPP_WRONG_TYPE)) { SCFree(p); return 0; } if (!(ENGINE_ISSET_EVENT(p,IPV4_TRUNC_PKT))) { SCFree(p); return 0; } /* Function must return here */ SCFree(p); return 1; } /* DecodePPPtest04 * Check if ppp header is null * Expected test value: 1 */ static int DecodePPPtest04 (void) { uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00, 0x2c, 0x4d, 0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01, 0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00, 0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 }; Packet *p = PacketGetFromAlloc(); if (unlikely(p == NULL)) return 0; ThreadVars tv; DecodeThreadVars dtv; memset(&tv, 0, sizeof(ThreadVars)); memset(&dtv, 0, sizeof(DecodeThreadVars)); FlowInitConfig(FLOW_QUIET); DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL); FlowShutdown(); if(p->ppph == NULL) { SCFree(p); return 0; } if (!(ENGINE_ISSET_EVENT(p,IPV4_TRUNC_PKT))) { SCFree(p); return 0; } /* Function must returns here */ SCFree(p); return 1; } #endif /* UNITTESTS */ void DecodePPPRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DecodePPPtest01", DecodePPPtest01); UtRegisterTest("DecodePPPtest02", DecodePPPtest02); UtRegisterTest("DecodePPPtest03", DecodePPPtest03); UtRegisterTest("DecodePPPtest04", DecodePPPtest04); #endif /* UNITTESTS */ } /** * @} */ suricata-3.2.1/src/util-bloomfilter-counting.h0000644000000000000000000000324213051004444016270 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __BLOOMFILTERCOUNTING_H__ #define __BLOOMFILTERCOUNTING_H__ /* Bloom filter structure */ typedef struct BloomFilterCounting_ { uint8_t *array; uint32_t array_size; /* size in buckets */ uint8_t type; /* 1, 2 or 4 byte counters */ uint8_t hash_iterations; uint32_t (*Hash)(void *, uint16_t, uint8_t, uint32_t); } BloomFilterCounting; /* prototypes */ BloomFilterCounting *BloomFilterCountingInit(uint32_t, uint8_t, uint8_t, uint32_t (*Hash)(void *, uint16_t, uint8_t, uint32_t)); void BloomFilterCountingFree(BloomFilterCounting *); void BloomFilterCountingPrint(BloomFilterCounting *); int BloomFilterCountingAdd(BloomFilterCounting *, void *, uint16_t); int BloomFilterCountingRemove(BloomFilterCounting *, void *, uint16_t); int BloomFilterCountingTest(BloomFilterCounting *, void *, uint16_t); void BloomFilterCountingRegisterTests(void); #endif /* __BLOOMFILTERCOUNTING_H__ */ suricata-3.2.1/src/detect-tls-cert-issuer.h0000644000000000000000000000167013051004444015471 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Mats Klepsland */ #ifndef __DETECT_TLS_ISSUER_H__ #define __DETECT_TLS_ISSUER_H__ #include "app-layer-ssl.h" void DetectTlsIssuerRegister(void); #endif /* __DETECT_TLS_ISSUER_H__ */ suricata-3.2.1/src/detect-engine-profile.h0000644000000000000000000000170613051004444015327 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef _DETECT_ENGINE_PROFILE_H #define _DETECT_ENGINE_PROFILE_H void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, const Packet *p); #endif /* _DETECT_ENGINE_PROFILE_H */ suricata-3.2.1/src/detect-distance.h0000644000000000000000000000164713051004444014222 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_DISTANCE_H__ #define __DETECT_DISTANCE_H__ /* prototypes */ void DetectDistanceRegister (void); #endif /* __DETECT_DISTANCE_H__ */ suricata-3.2.1/src/detect-offset.h0000644000000000000000000000163713051004444013715 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_OFFSET_H__ #define __DETECT_OFFSET_H__ /* prototypes */ void DetectOffsetRegister (void); #endif /* __DETECT_OFFSET_H__ */ suricata-3.2.1/src/detect-dnp3.h0000644000000000000000000000205713051004444013270 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ #ifndef __DETECT_DNP3_H__ #define __DETECT_DNP3_H__ /** * Struct for mapping symbolic names to values. */ typedef struct DNP3Mapping_ { char *name; uint16_t value; } DNP3Mapping; /* Map of internal indicators to value for external use. */ extern DNP3Mapping DNP3IndicatorsMap[]; void DetectDNP3Register(void); #endif /* __DETECT_DNP3_H__ */ suricata-3.2.1/src/detect-flow.h0000644000000000000000000000300513051004444013365 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_FLOW_H__ #define __DETECT_FLOW_H__ #define DETECT_FLOW_FLAG_TOSERVER BIT_U16(0) #define DETECT_FLOW_FLAG_TOCLIENT BIT_U16(1) #define DETECT_FLOW_FLAG_ESTABLISHED BIT_U16(2) #define DETECT_FLOW_FLAG_NOT_ESTABLISHED BIT_U16(3) #define DETECT_FLOW_FLAG_STATELESS BIT_U16(4) #define DETECT_FLOW_FLAG_ONLYSTREAM BIT_U16(5) #define DETECT_FLOW_FLAG_NOSTREAM BIT_U16(6) #define DETECT_FLOW_FLAG_NO_FRAG BIT_U16(7) #define DETECT_FLOW_FLAG_ONLY_FRAG BIT_U16(8) typedef struct DetectFlowData_ { uint16_t flags; /* flags to match */ uint8_t match_cnt; /* number of matches we need */ } DetectFlowData; /* prototypes */ void DetectFlowRegister (void); #endif /* __DETECT_FLOW_H__ */ suricata-3.2.1/src/suricata.c0000644000000000000000000027361513051004444012776 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #include "suricata-common.h" #include "config.h" #if HAVE_GETOPT_H #include #endif #if HAVE_SIGNAL_H #include #endif #ifdef HAVE_NSS #include #include #endif #include "suricata.h" #include "decode.h" #include "detect.h" #include "packet-queue.h" #include "threads.h" #include "threadvars.h" #include "flow-worker.h" #include "util-atomic.h" #include "util-spm.h" #include "util-cpu.h" #include "util-action.h" #include "util-pidfile.h" #include "util-ioctl.h" #include "util-device.h" #include "util-misc.h" #include "util-running-modes.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-fast-pattern.h" #include "detect-engine-tag.h" #include "detect-engine-threshold.h" #include "detect-engine-address.h" #include "detect-engine-port.h" #include "detect-engine-mpm.h" #include "tm-queuehandlers.h" #include "tm-queues.h" #include "tm-threads.h" #include "tmqh-flow.h" #include "conf.h" #include "conf-yaml-loader.h" #include "stream-tcp.h" #include "source-nfq.h" #include "source-nfq-prototypes.h" #include "source-nflog.h" #include "source-ipfw.h" #include "source-pcap.h" #include "source-pcap-file.h" #include "source-pfring.h" #include "source-erf-file.h" #include "source-erf-dag.h" #include "source-napatech.h" #include "source-af-packet.h" #include "source-netmap.h" #include "source-mpipe.h" #include "respond-reject.h" #include "flow.h" #include "flow-timeout.h" #include "flow-manager.h" #include "flow-var.h" #include "flow-bit.h" #include "pkt-var.h" #include "host-bit.h" #include "ippair.h" #include "ippair-bit.h" #include "host.h" #include "unix-manager.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "app-layer-ssl.h" #include "app-layer-dns-tcp.h" #include "app-layer-dns-udp.h" #include "app-layer-ssh.h" #include "app-layer-ftp.h" #include "app-layer-smtp.h" #include "app-layer-smb.h" #include "app-layer-modbus.h" #include "app-layer-enip.h" #include "app-layer-dnp3.h" #include "util-decode-der.h" #include "util-radix-tree.h" #include "util-host-os-info.h" #include "util-cidr.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-time.h" #include "util-rule-vars.h" #include "util-classification-config.h" #include "util-threshold-config.h" #include "util-reference-config.h" #include "util-profiling.h" #include "util-magic.h" #include "util-signal.h" #include "util-coredump-config.h" #include "util-decode-mime.h" #include "defrag.h" #include "runmodes.h" #include "runmode-unittests.h" #include "util-cuda.h" #include "util-decode-asn1.h" #include "util-debug.h" #include "util-error.h" #include "util-daemon.h" #include "reputation.h" #include "output.h" #include "util-privs.h" #include "tmqh-packetpool.h" #include "util-proto-name.h" #ifdef __SC_CUDA_SUPPORT__ #include "util-cuda-buffer.h" #include "util-mpm-ac.h" #endif #include "util-mpm-hs.h" #include "util-storage.h" #include "host-storage.h" #include "util-lua.h" /* * we put this here, because we only use it here in main. */ volatile sig_atomic_t sigint_count = 0; volatile sig_atomic_t sighup_count = 0; volatile sig_atomic_t sigterm_count = 0; volatile sig_atomic_t sigusr2_count = 0; /* * Flag to indicate if the engine is at the initialization * or already processing packets. 3 stages: SURICATA_INIT, * SURICATA_RUNTIME and SURICATA_FINALIZE */ SC_ATOMIC_DECLARE(unsigned int, engine_stage); /* Max packets processed simultaniously per thread. */ #define DEFAULT_MAX_PENDING_PACKETS 1024 /** suricata engine control flags */ volatile uint8_t suricata_ctl_flags = 0; /** Run mode selected */ int run_mode = RUNMODE_UNKNOWN; /** Engine mode: inline (ENGINE_MODE_IPS) or just * detection mode (ENGINE_MODE_IDS by default) */ static enum EngineMode g_engine_mode = ENGINE_MODE_IDS; /** Host mode: set if box is sniffing only * or is a router */ uint8_t host_mode = SURI_HOST_IS_SNIFFER_ONLY; /** Maximum packets to simultaneously process. */ intmax_t max_pending_packets; /** global indicating if detection is enabled */ int g_detect_disabled = 0; /** set caps or not */ int sc_set_caps = FALSE; /** highest mtu of the interfaces we monitor */ int g_default_mtu = 0; int EngineModeIsIPS(void) { return (g_engine_mode == ENGINE_MODE_IPS); } int EngineModeIsIDS(void) { return (g_engine_mode == ENGINE_MODE_IDS); } void EngineModeSetIPS(void) { g_engine_mode = ENGINE_MODE_IPS; } void EngineModeSetIDS(void) { g_engine_mode = ENGINE_MODE_IDS; } int RunmodeIsUnittests(void) { if (run_mode == RUNMODE_UNITTEST) return 1; return 0; } int RunmodeGetCurrent(void) { return run_mode; } /** signal handlers * * WARNING: don't use the SCLog* API in the handlers. The API is complex * with memory allocation possibly happening, calls to syslog, json message * construction, etc. */ static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; } static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; } /** * SIGUSR2 handler. Just set sigusr2_count. The main loop will act on * it. */ static void SignalHandlerSigusr2(int sig) { if (sigusr2_count < 16) { sigusr2_count++; } else { SCLogWarning(SC_ERR_LIVE_RULE_SWAP, "Too many USR2 signals pending, ignoring new ones!"); } } /** * SIGHUP handler. Just set sighup_count. The main loop will act on * it. */ static void SignalHandlerSigHup(/*@unused@*/ int sig) { sighup_count = 1; } #ifdef DBG_MEM_ALLOC #ifndef _GLOBAL_MEM_ #define _GLOBAL_MEM_ /* This counter doesn't complain realloc's(), it's gives * an aproximation for the startup */ size_t global_mem = 0; #ifdef DBG_MEM_ALLOC_SKIP_STARTUP uint8_t print_mem_flag = 0; #else uint8_t print_mem_flag = 1; #endif #endif #endif void CreateLowercaseTable() { /* create table for O(1) lowercase conversion lookup. It was removed, but * we still need it for cuda. So resintalling it back into the codebase */ int c = 0; memset(g_u8_lowercasetable, 0x00, sizeof(g_u8_lowercasetable)); for ( ; c < 256; c++) { if (c >= 'A' && c <= 'Z') g_u8_lowercasetable[c] = (c + ('a' - 'A')); else g_u8_lowercasetable[c] = c; } } void GlobalsInitPreConfig() { #ifdef __SC_CUDA_SUPPORT__ /* Init the CUDA environment */ SCCudaInitCudaEnvironment(); CudaBufferInit(); #endif memset(trans_q, 0, sizeof(trans_q)); memset(data_queues, 0, sizeof(data_queues)); /* Initialize the trans_q mutex */ int blah; int r = 0; for(blah=0;blah<256;blah++) { r |= SCMutexInit(&trans_q[blah].mutex_q, NULL); r |= SCCondInit(&trans_q[blah].cond_q, NULL); r |= SCMutexInit(&data_queues[blah].mutex_q, NULL); r |= SCCondInit(&data_queues[blah].cond_q, NULL); } if (r != 0) { SCLogInfo("Trans_Q Mutex not initialized correctly"); exit(EXIT_FAILURE); } CreateLowercaseTable(); TimeInit(); SupportFastPatternForSigMatchTypes(); } void GlobalsDestroy(SCInstance *suri) { HostShutdown(); HTPFreeConfig(); HTPAtExitPrintStats(); #ifdef DBG_MEM_ALLOC SCLogInfo("Total memory used (without SCFree()): %"PRIdMAX, (intmax_t)global_mem); #ifdef DBG_MEM_ALLOC_SKIP_STARTUP print_mem_flag = 0; #endif #endif AppLayerHtpPrintStats(); /* TODO this can do into it's own func */ DetectEngineCtx *de_ctx = DetectEngineGetCurrent(); if (de_ctx) { DetectEngineMoveToFreeList(de_ctx); DetectEngineDeReference(&de_ctx); } DetectEnginePruneFreeList(); AppLayerDeSetup(); TagDestroyCtx(); LiveDeviceListClean(); OutputDeregisterAll(); TimeDeinit(); SCProtoNameDeInit(); if (!suri->disabled_detect) { SCReferenceConfDeinit(); SCClassConfDeinit(); } #ifdef HAVE_MAGIC MagicDeinit(); #endif TmqhCleanup(); TmModuleRunDeInit(); ParseSizeDeinit(); #ifdef HAVE_NSS NSS_Shutdown(); PR_Cleanup(); #endif #ifdef HAVE_AF_PACKET AFPPeersListClean(); #endif SC_ATOMIC_DESTROY(engine_stage); #ifdef BUILD_HYPERSCAN MpmHSGlobalCleanup(); #endif #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) MpmCudaBufferDeSetup(); CudaHandlerFreeProfiles(); #endif ConfDeInit(); #ifdef HAVE_LUAJIT LuajitFreeStatesPool(); #endif SCLogDeInitLogModule(); DetectParseFreeRegexes(); SCPidfileRemove(suri->pid_filename); } /** \brief make sure threads can stop the engine by calling this * function. Purpose: pcap file mode needs to be able to tell the * engine the file eof is reached. */ void EngineStop(void) { suricata_ctl_flags |= SURICATA_STOP; } /** * \brief Used to indicate that the current task is done. * * This is mainly used by pcap-file to tell it has finished * to treat a pcap files when running in unix-socket mode. */ void EngineDone(void) { suricata_ctl_flags |= SURICATA_DONE; } static int SetBpfString(int argc, char *argv[]) { char *bpf_filter = NULL; uint32_t bpf_len = 0; int tmpindex = 0; /* attempt to parse remaining args as bpf filter */ tmpindex = argc; while(argv[tmpindex] != NULL) { bpf_len+=strlen(argv[tmpindex]) + 1; tmpindex++; } if (bpf_len == 0) return TM_ECODE_OK; if (EngineModeIsIPS()) { SCLogError(SC_ERR_NOT_SUPPORTED, "BPF filter not available in IPS mode." " Use firewall filtering if possible."); return TM_ECODE_FAILED; } bpf_filter = SCMalloc(bpf_len); if (unlikely(bpf_filter == NULL)) return TM_ECODE_OK; memset(bpf_filter, 0x00, bpf_len); tmpindex = optind; while(argv[tmpindex] != NULL) { strlcat(bpf_filter, argv[tmpindex],bpf_len); if(argv[tmpindex + 1] != NULL) { strlcat(bpf_filter," ", bpf_len); } tmpindex++; } if(strlen(bpf_filter) > 0) { if (ConfSetFinal("bpf-filter", bpf_filter) != 1) { SCLogError(SC_ERR_FATAL, "Failed to set bpf filter."); SCFree(bpf_filter); return TM_ECODE_FAILED; } } SCFree(bpf_filter); return TM_ECODE_OK; } static void SetBpfStringFromFile(char *filename) { char *bpf_filter = NULL; char *bpf_comment_tmp = NULL; char *bpf_comment_start = NULL; uint32_t bpf_len = 0; #ifdef OS_WIN32 struct _stat st; #else struct stat st; #endif /* OS_WIN32 */ FILE *fp = NULL; size_t nm = 0; if (EngineModeIsIPS()) { SCLogError(SC_ERR_NOT_SUPPORTED, "BPF filter not available in IPS mode." " Use firewall filtering if possible."); exit(EXIT_FAILURE); } #ifdef OS_WIN32 if(_stat(filename, &st) != 0) { #else if(stat(filename, &st) != 0) { #endif /* OS_WIN32 */ SCLogError(SC_ERR_FOPEN, "Failed to stat file %s", filename); exit(EXIT_FAILURE); } bpf_len = st.st_size + 1; fp = fopen(filename,"r"); if (fp == NULL) { SCLogError(SC_ERR_FOPEN, "Failed to open file %s", filename); exit(EXIT_FAILURE); } bpf_filter = SCMalloc(bpf_len * sizeof(char)); if (unlikely(bpf_filter == NULL)) { SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate buffer for bpf filter in file %s", filename); exit(EXIT_FAILURE); } memset(bpf_filter, 0x00, bpf_len); nm = fread(bpf_filter, 1, bpf_len - 1, fp); if ((ferror(fp) != 0) || (nm != (bpf_len - 1))) { SCLogError(SC_ERR_BPF, "Failed to read complete BPF file %s", filename); SCFree(bpf_filter); fclose(fp); exit(EXIT_FAILURE); } fclose(fp); bpf_filter[nm] = '\0'; if(strlen(bpf_filter) > 0) { /*replace comments with space*/ bpf_comment_start = bpf_filter; while((bpf_comment_tmp = strchr(bpf_comment_start, '#')) != NULL) { while((*bpf_comment_tmp !='\0') && (*bpf_comment_tmp != '\r') && (*bpf_comment_tmp != '\n')) { *bpf_comment_tmp++ = ' '; } bpf_comment_start = bpf_comment_tmp; } /*remove remaining '\r' and '\n' */ while((bpf_comment_tmp = strchr(bpf_filter, '\r')) != NULL) { *bpf_comment_tmp = ' '; } while((bpf_comment_tmp = strchr(bpf_filter, '\n')) != NULL) { *bpf_comment_tmp = ' '; } /* cut trailing spaces */ while (strlen(bpf_filter) > 0 && bpf_filter[strlen(bpf_filter)-1] == ' ') { bpf_filter[strlen(bpf_filter)-1] = '\0'; } if (strlen(bpf_filter) > 0) { if(ConfSetFinal("bpf-filter", bpf_filter) != 1) { SCLogError(SC_ERR_FOPEN, "ERROR: Failed to set bpf filter!"); SCFree(bpf_filter); exit(EXIT_FAILURE); } } } SCFree(bpf_filter); } void usage(const char *progname) { #ifdef REVISION printf("%s %s (rev %s)\n", PROG_NAME, PROG_VER, xstr(REVISION)); #else printf("%s %s\n", PROG_NAME, PROG_VER); #endif printf("USAGE: %s [OPTIONS] [BPF FILTER]\n\n", progname); printf("\t-c : path to configuration file\n"); printf("\t-T : test configuration file (use with -c)\n"); printf("\t-i : run in pcap live mode\n"); printf("\t-F : bpf filter file\n"); printf("\t-r : run in pcap file/offline mode\n"); #ifdef NFQ printf("\t-q : run in inline nfqueue mode\n"); #endif /* NFQ */ #ifdef IPFW printf("\t-d : run in inline ipfw divert mode\n"); #endif /* IPFW */ printf("\t-s : path to signature file loaded in addition to suricata.yaml settings (optional)\n"); printf("\t-S : path to signature file loaded exclusively (optional)\n"); printf("\t-l : default log directory\n"); #ifndef OS_WIN32 printf("\t-D : run as daemon\n"); #else printf("\t--service-install : install as service\n"); printf("\t--service-remove : remove service\n"); printf("\t--service-change-params : change service startup parameters\n"); #endif /* OS_WIN32 */ printf("\t-k [all|none] : force checksum check (all) or disabled it (none)\n"); printf("\t-V : display Suricata version\n"); printf("\t-v[v] : increase default Suricata verbosity\n"); #ifdef UNITTESTS printf("\t-u : run the unittests and exit\n"); printf("\t-U, --unittest-filter=REGEX : filter unittests with a regex\n"); printf("\t--list-unittests : list unit tests\n"); printf("\t--fatal-unittests : enable fatal failure on unittest error\n"); printf("\t--unittests-coverage : display unittest coverage report\n"); #endif /* UNITTESTS */ printf("\t--list-app-layer-protos : list supported app layer protocols\n"); printf("\t--list-keywords[=all|csv|] : list keywords implemented by the engine\n"); #ifdef __SC_CUDA_SUPPORT__ printf("\t--list-cuda-cards : list cuda supported cards\n"); #endif printf("\t--list-runmodes : list supported runmodes\n"); printf("\t--runmode : specific runmode modification the engine should run. The argument\n" "\t supplied should be the id for the runmode obtained by running\n" "\t --list-runmodes\n"); printf("\t--engine-analysis : print reports on analysis of different sections in the engine and exit.\n" "\t Please have a look at the conf parameter engine-analysis on what reports\n" "\t can be printed\n"); printf("\t--pidfile : write pid to this file\n"); printf("\t--init-errors-fatal : enable fatal failure on signature init error\n"); printf("\t--disable-detection : disable detection engine\n"); printf("\t--dump-config : show the running configuration\n"); printf("\t--build-info : display build information\n"); printf("\t--pcap[=] : run in pcap mode, no value select interfaces from suricata.yaml\n"); #ifdef HAVE_PCAP_SET_BUFF printf("\t--pcap-buffer-size : size of the pcap buffer value from 0 - %i\n",INT_MAX); #endif /* HAVE_SET_PCAP_BUFF */ #ifdef HAVE_AF_PACKET printf("\t--af-packet[=] : run in af-packet mode, no value select interfaces from suricata.yaml\n"); #endif #ifdef HAVE_NETMAP printf("\t--netmap[=] : run in netmap mode, no value select interfaces from suricata.yaml\n"); #endif #ifdef HAVE_PFRING printf("\t--pfring[=] : run in pfring mode, use interfaces from suricata.yaml\n"); printf("\t--pfring-int : run in pfring mode, use interface \n"); printf("\t--pfring-cluster-id : pfring cluster id \n"); printf("\t--pfring-cluster-type : pfring cluster type for PF_RING 4.1.2 and later cluster_round_robin|cluster_flow\n"); #endif /* HAVE_PFRING */ printf("\t--simulate-ips : force engine into IPS mode. Useful for QA\n"); #ifdef HAVE_LIBCAP_NG printf("\t--user : run suricata as this user after init\n"); printf("\t--group : run suricata as this group after init\n"); #endif /* HAVE_LIBCAP_NG */ printf("\t--erf-in : process an ERF file\n"); #ifdef HAVE_DAG printf("\t--dag : process ERF records from DAG interface X, stream Y\n"); #endif #ifdef HAVE_NAPATECH printf("\t--napatech : run Napatech Streams using the API\n"); #endif #ifdef BUILD_UNIX_SOCKET printf("\t--unix-socket[=] : use unix socket to control suricata work\n"); #endif #ifdef HAVE_MPIPE printf("\t--mpipe : run with tilegx mpipe interface(s)\n"); #endif printf("\t--set name=value : set a configuration value\n"); printf("\n"); printf("\nTo run the engine with default configuration on " "interface eth0 with signature file \"signatures.rules\", run the " "command as:\n\n%s -c suricata.yaml -s signatures.rules -i eth0 \n\n", progname); } void SCPrintBuildInfo(void) { char *bits = "-bits"; char *endian = "-endian"; char features[2048] = ""; char *tls = "pthread key"; #ifdef REVISION printf("This is %s version %s (rev %s)\n", PROG_NAME, PROG_VER, xstr(REVISION)); #elif defined RELEASE printf("This is %s version %s RELEASE\n", PROG_NAME, PROG_VER); #else printf("This is %s version %s\n", PROG_NAME, PROG_VER); #endif #ifdef DEBUG strlcat(features, "DEBUG ", sizeof(features)); #endif #ifdef DEBUG_VALIDATION strlcat(features, "DEBUG_VALIDATION ", sizeof(features)); #endif #ifdef UNITTESTS strlcat(features, "UNITTESTS ", sizeof(features)); #endif #ifdef NFQ strlcat(features, "NFQ ", sizeof(features)); #endif #ifdef IPFW strlcat(features, "IPFW ", sizeof(features)); #endif #ifdef HAVE_PCAP_SET_BUFF strlcat(features, "PCAP_SET_BUFF ", sizeof(features)); #endif #if LIBPCAP_VERSION_MAJOR == 1 strlcat(features, "LIBPCAP_VERSION_MAJOR=1 ", sizeof(features)); #elif LIBPCAP_VERSION_MAJOR == 0 strlcat(features, "LIBPCAP_VERSION_MAJOR=0 ", sizeof(features)); #endif #ifdef __SC_CUDA_SUPPORT__ strlcat(features, "CUDA ", sizeof(features)); #endif #ifdef HAVE_PFRING strlcat(features, "PF_RING ", sizeof(features)); #endif #ifdef HAVE_AF_PACKET strlcat(features, "AF_PACKET ", sizeof(features)); #endif #ifdef HAVE_NETMAP strlcat(features, "NETMAP ", sizeof(features)); #endif #ifdef HAVE_PACKET_FANOUT strlcat(features, "HAVE_PACKET_FANOUT ", sizeof(features)); #endif #ifdef HAVE_DAG strlcat(features, "DAG ", sizeof(features)); #endif #ifdef HAVE_LIBCAP_NG strlcat(features, "LIBCAP_NG ", sizeof(features)); #endif #ifdef HAVE_LIBNET11 strlcat(features, "LIBNET1.1 ", sizeof(features)); #endif #ifdef HAVE_HTP_URI_NORMALIZE_HOOK strlcat(features, "HAVE_HTP_URI_NORMALIZE_HOOK ", sizeof(features)); #endif #ifdef PCRE_HAVE_JIT strlcat(features, "PCRE_JIT ", sizeof(features)); #endif #ifdef HAVE_NSS strlcat(features, "HAVE_NSS ", sizeof(features)); #endif #ifdef HAVE_LUA strlcat(features, "HAVE_LUA ", sizeof(features)); #endif #ifdef HAVE_LUAJIT strlcat(features, "HAVE_LUAJIT ", sizeof(features)); #endif #ifdef HAVE_LIBJANSSON strlcat(features, "HAVE_LIBJANSSON ", sizeof(features)); #endif #ifdef PROFILING strlcat(features, "PROFILING ", sizeof(features)); #endif #ifdef PROFILE_LOCKING strlcat(features, "PROFILE_LOCKING ", sizeof(features)); #endif #ifdef TLS strlcat(features, "TLS ", sizeof(features)); #endif #ifdef HAVE_MAGIC strlcat(features, "MAGIC ", sizeof(features)); #endif if (strlen(features) == 0) { strlcat(features, "none", sizeof(features)); } printf("Features: %s\n", features); /* SIMD stuff */ memset(features, 0x00, sizeof(features)); #if defined(__SSE4_2__) strlcat(features, "SSE_4_2 ", sizeof(features)); #endif #if defined(__SSE4_1__) strlcat(features, "SSE_4_1 ", sizeof(features)); #endif #if defined(__SSE3__) strlcat(features, "SSE_3 ", sizeof(features)); #endif #if defined(__tile__) strlcat(features, "Tilera ", sizeof(features)); #endif if (strlen(features) == 0) { strlcat(features, "none", sizeof(features)); } printf("SIMD support: %s\n", features); /* atomics stuff */ memset(features, 0x00, sizeof(features)); #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1) strlcat(features, "1 ", sizeof(features)); #endif #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2) strlcat(features, "2 ", sizeof(features)); #endif #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4) strlcat(features, "4 ", sizeof(features)); #endif #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8) strlcat(features, "8 ", sizeof(features)); #endif #if defined(__GCC_HAVE_SYNC_COMPARE_AND_SWAP_16) strlcat(features, "16 ", sizeof(features)); #endif if (strlen(features) == 0) { strlcat(features, "none", sizeof(features)); } else { strlcat(features, "byte(s)", sizeof(features)); } printf("Atomic intrisics: %s\n", features); #if __WORDSIZE == 64 bits = "64-bits"; #elif __WORDSIZE == 32 bits = "32-bits"; #endif #if __BYTE_ORDER == __BIG_ENDIAN endian = "Big-endian"; #elif __BYTE_ORDER == __LITTLE_ENDIAN endian = "Little-endian"; #endif printf("%s, %s architecture\n", bits, endian); #ifdef __GNUC__ printf("GCC version %s, C version %"PRIiMAX"\n", __VERSION__, (intmax_t)__STDC_VERSION__); #else printf("C version %"PRIiMAX"\n", (intmax_t)__STDC_VERSION__); #endif #if __SSP__ == 1 printf("compiled with -fstack-protector\n"); #endif #if __SSP_ALL__ == 2 printf("compiled with -fstack-protector-all\n"); #endif /* * Workaround for special defines of _FORTIFY_SOURCE like * FORTIFY_SOURCE=((defined __OPTIMIZE && OPTIMIZE > 0) ? 2 : 0) * which is used by Gentoo for example and would result in the error * 'defined' undeclared when _FORTIFY_SOURCE used via %d in printf func * */ #if _FORTIFY_SOURCE == 2 printf("compiled with _FORTIFY_SOURCE=2\n"); #elif _FORTIFY_SOURCE == 1 printf("compiled with _FORTIFY_SOURCE=1\n"); #elif _FORTIFY_SOURCE == 0 printf("compiled with _FORTIFY_SOURCE=0\n"); #endif #ifdef CLS printf("L1 cache line size (CLS)=%d\n", CLS); #endif #ifdef TLS tls = "__thread"; #endif printf("thread local storage method: %s\n", tls); printf("compiled with %s, linked against %s\n", HTP_VERSION_STRING_FULL, htp_get_version()); printf("\n"); #include "build-info.h" } int coverage_unittests; int g_ut_modules; int g_ut_covered; void RegisterAllModules() { /* commanders */ TmModuleUnixManagerRegister(); /* managers */ TmModuleFlowManagerRegister(); TmModuleFlowRecyclerRegister(); /* nfq */ TmModuleReceiveNFQRegister(); TmModuleVerdictNFQRegister(); TmModuleDecodeNFQRegister(); /* ipfw */ TmModuleReceiveIPFWRegister(); TmModuleVerdictIPFWRegister(); TmModuleDecodeIPFWRegister(); /* pcap live */ TmModuleReceivePcapRegister(); TmModuleDecodePcapRegister(); /* pcap file */ TmModuleReceivePcapFileRegister(); TmModuleDecodePcapFileRegister(); #ifdef HAVE_MPIPE /* mpipe */ TmModuleReceiveMpipeRegister(); TmModuleDecodeMpipeRegister(); #endif /* af-packet */ TmModuleReceiveAFPRegister(); TmModuleDecodeAFPRegister(); /* netmap */ TmModuleReceiveNetmapRegister(); TmModuleDecodeNetmapRegister(); /* pfring */ TmModuleReceivePfringRegister(); TmModuleDecodePfringRegister(); /* dag file */ TmModuleReceiveErfFileRegister(); TmModuleDecodeErfFileRegister(); /* dag live */ TmModuleReceiveErfDagRegister(); TmModuleDecodeErfDagRegister(); /* napatech */ TmModuleNapatechStreamRegister(); TmModuleNapatechDecodeRegister(); /* flow worker */ TmModuleFlowWorkerRegister(); /* respond-reject */ TmModuleRespondRejectRegister(); /* log api */ TmModuleLoggerRegister(); TmModuleStatsLoggerRegister(); TmModuleDebugList(); /* nflog */ TmModuleReceiveNFLOGRegister(); TmModuleDecodeNFLOGRegister(); } static TmEcode LoadYamlConfig(SCInstance *suri) { SCEnter(); if (suri->conf_filename == NULL) suri->conf_filename = DEFAULT_CONF_FILE; if (ConfYamlLoadFile(suri->conf_filename) != 0) { /* Error already displayed. */ SCReturnInt(TM_ECODE_FAILED); } SCReturnInt(TM_ECODE_OK); } static TmEcode ParseInterfacesList(int runmode, char *pcap_dev) { SCEnter(); /* run the selected runmode */ if (runmode == RUNMODE_PCAP_DEV) { if (strlen(pcap_dev) == 0) { int ret = LiveBuildDeviceList("pcap"); if (ret == 0) { SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for pcap"); SCReturnInt(TM_ECODE_FAILED); } } #ifdef HAVE_MPIPE } else if (runmode == RUNMODE_TILERA_MPIPE) { if (strlen(pcap_dev)) { if (ConfSetFinal("mpipe.single_mpipe_dev", pcap_dev) != 1) { fprintf(stderr, "ERROR: Failed to set mpipe.single_mpipe_dev\n"); SCReturnInt(TM_ECODE_FAILED); } } else { int ret = LiveBuildDeviceList("mpipe.inputs"); if (ret == 0) { fprintf(stderr, "ERROR: No interface found in config for mpipe\n"); SCReturnInt(TM_ECODE_FAILED); } } #endif } else if (runmode == RUNMODE_PFRING) { /* FIXME add backward compat support */ /* iface has been set on command line */ if (strlen(pcap_dev)) { if (ConfSetFinal("pfring.live-interface", pcap_dev) != 1) { SCLogError(SC_ERR_INITIALIZATION, "Failed to set pfring.live-interface"); SCReturnInt(TM_ECODE_FAILED); } } else { /* not an error condition if we have a 1.0 config */ LiveBuildDeviceList("pfring"); } #ifdef HAVE_AF_PACKET } else if (runmode == RUNMODE_AFP_DEV) { /* iface has been set on command line */ if (strlen(pcap_dev)) { if (ConfSetFinal("af-packet.live-interface", pcap_dev) != 1) { SCLogError(SC_ERR_INITIALIZATION, "Failed to set af-packet.live-interface"); SCReturnInt(TM_ECODE_FAILED); } } else { int ret = LiveBuildDeviceList("af-packet"); if (ret == 0) { SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for af-packet"); SCReturnInt(TM_ECODE_FAILED); } if (AFPRunModeIsIPS()) { SCLogInfo("AF_PACKET: Setting IPS mode"); EngineModeSetIPS(); } } #endif #ifdef HAVE_NETMAP } else if (runmode == RUNMODE_NETMAP) { /* iface has been set on command line */ if (strlen(pcap_dev)) { if (ConfSetFinal("netmap.live-interface", pcap_dev) != 1) { SCLogError(SC_ERR_INITIALIZATION, "Failed to set netmap.live-interface"); SCReturnInt(TM_ECODE_FAILED); } } else { int ret = LiveBuildDeviceList("netmap"); if (ret == 0) { SCLogError(SC_ERR_INITIALIZATION, "No interface found in config for netmap"); SCReturnInt(TM_ECODE_FAILED); } if (NetmapRunModeIsIPS()) { SCLogInfo("Netmap: Setting IPS mode"); EngineModeSetIPS(); } } #endif #ifdef HAVE_NFLOG } else if (runmode == RUNMODE_NFLOG) { int ret = LiveBuildDeviceListCustom("nflog", "group"); if (ret == 0) { SCLogError(SC_ERR_INITIALIZATION, "No group found in config for nflog"); SCReturnInt(TM_ECODE_FAILED); } #endif } SCReturnInt(TM_ECODE_OK); } static void SCInstanceInit(SCInstance *suri, const char *progname) { memset(suri, 0x00, sizeof(*suri)); suri->progname = progname; suri->run_mode = RUNMODE_UNKNOWN; memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); suri->sig_file = NULL; suri->sig_file_exclusive = FALSE; suri->pid_filename = NULL; suri->regex_arg = NULL; suri->keyword_info = NULL; suri->runmode_custom_mode = NULL; #ifndef OS_WIN32 suri->user_name = NULL; suri->group_name = NULL; suri->do_setuid = FALSE; suri->do_setgid = FALSE; suri->userid = 0; suri->groupid = 0; #endif /* OS_WIN32 */ suri->delayed_detect = 0; suri->daemon = 0; suri->offline = 0; suri->verbose = 0; /* use -1 as unknown */ suri->checksum_validation = -1; #if HAVE_DETECT_DISABLED==1 g_detect_disabled = suri->disabled_detect = 1; #else g_detect_disabled = suri->disabled_detect = 0; #endif } static TmEcode PrintVersion() { #ifdef REVISION printf("This is %s version %s (rev %s)\n", PROG_NAME, PROG_VER, xstr(REVISION)); #elif defined RELEASE printf("This is %s version %s RELEASE\n", PROG_NAME, PROG_VER); #else printf("This is %s version %s\n", PROG_NAME, PROG_VER); #endif return TM_ECODE_OK; } static TmEcode SCPrintVersion() { #ifdef REVISION SCLogNotice("This is %s version %s (rev %s)", PROG_NAME, PROG_VER, xstr(REVISION)); #elif defined RELEASE SCLogNotice("This is %s version %s RELEASE", PROG_NAME, PROG_VER); #else SCLogNotice("This is %s version %s", PROG_NAME, PROG_VER); #endif return TM_ECODE_OK; } static void SCSetStartTime(SCInstance *suri) { memset(&suri->start_time, 0, sizeof(suri->start_time)); gettimeofday(&suri->start_time, NULL); } static void SCPrintElapsedTime(struct timeval *start_time) { if (start_time == NULL) return; struct timeval end_time; memset(&end_time, 0, sizeof(end_time)); gettimeofday(&end_time, NULL); uint64_t milliseconds = ((end_time.tv_sec - start_time->tv_sec) * 1000) + (((1000000 + end_time.tv_usec - start_time->tv_usec) / 1000) - 1000); SCLogInfo("time elapsed %.3fs", (float)milliseconds/(float)1000); } static int ParseCommandLineAfpacket(SCInstance *suri, const char *in_arg) { #ifdef HAVE_AF_PACKET if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_AFP_DEV; if (in_arg) { LiveRegisterDevice(in_arg); memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev)); } } else if (suri->run_mode == RUNMODE_AFP_DEV) { SCLogWarning(SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL, "using " "multiple devices to get packets is experimental."); if (in_arg) { LiveRegisterDevice(in_arg); } else { SCLogInfo("Multiple af-packet option without interface on each is useless"); } } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(suri->progname); return TM_ECODE_FAILED; } return TM_ECODE_OK; #else SCLogError(SC_ERR_NO_AF_PACKET,"AF_PACKET not enabled. On Linux " "host, make sure to pass --enable-af-packet to " "configure when building."); return TM_ECODE_FAILED; #endif } static int ParseCommandLinePcapLive(SCInstance *suri, const char *in_arg) { memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); if (in_arg != NULL) { /* some windows shells require escaping of the \ in \Device. Otherwise * the backslashes are stripped. We put them back here. */ if (strlen(in_arg) > 9 && strncmp(in_arg, "DeviceNPF", 9) == 0) { snprintf(suri->pcap_dev, sizeof(suri->pcap_dev), "\\Device\\NPF%s", in_arg+9); } else { strlcpy(suri->pcap_dev, in_arg, sizeof(suri->pcap_dev)); PcapTranslateIPToDevice(suri->pcap_dev, sizeof(suri->pcap_dev)); } if (strcmp(suri->pcap_dev, in_arg) != 0) { SCLogInfo("translated %s to pcap device %s", in_arg, suri->pcap_dev); } else if (strlen(suri->pcap_dev) > 0 && isdigit((unsigned char)suri->pcap_dev[0])) { SCLogError(SC_ERR_PCAP_TRANSLATE, "failed to find a pcap device for IP %s", in_arg); return TM_ECODE_FAILED; } } if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_PCAP_DEV; if (in_arg) { LiveRegisterDevice(suri->pcap_dev); } } else if (suri->run_mode == RUNMODE_PCAP_DEV) { #ifdef OS_WIN32 SCLogError(SC_ERR_PCAP_MULTI_DEV_NO_SUPPORT, "pcap multi dev " "support is not (yet) supported on Windows."); return TM_ECODE_FAILED; #else SCLogWarning(SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL, "using " "multiple pcap devices to get packets is experimental."); LiveRegisterDevice(suri->pcap_dev); #endif } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(suri->progname); return TM_ECODE_FAILED; } return TM_ECODE_OK; } static void ParseCommandLineAFL(const char *opt_name, char *opt_arg) { #ifdef AFLFUZZ_RULES if(strcmp(opt_name, "afl-rules") == 0) { MpmTableSetup(); SpmTableSetup(); exit(RuleParseDataFromFile(opt_arg)); } else #endif #ifdef AFLFUZZ_APPLAYER if(strcmp(opt_name, "afl-http-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterHTPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_HTTP, opt_arg)); } else if(strcmp(opt_name, "afl-http") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterHTPParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_HTTP, opt_arg)); } else if(strcmp(opt_name, "afl-tls-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSSLParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_TLS, opt_arg)); } else if(strcmp(opt_name, "afl-tls") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSSLParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_TLS, opt_arg)); } else if(strcmp(opt_name, "afl-dns-request") == 0) { //printf("arg: //%s\n", opt_arg); RegisterDNSUDPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_UDP, ALPROTO_DNS, opt_arg)); } else if(strcmp(opt_name, "afl-dns") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterDNSUDPParsers(); exit(AppLayerParserFromFile(IPPROTO_UDP, ALPROTO_DNS, opt_arg)); } else if(strcmp(opt_name, "afl-dnstcp-request") == 0) { //printf("arg: //%s\n", opt_arg); RegisterDNSTCPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_DNS, opt_arg)); } else if(strcmp(opt_name, "afl-dnstcp") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterDNSTCPParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_DNS, opt_arg)); } else if(strcmp(opt_name, "afl-ssh-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); RegisterSSHParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_SSH, opt_arg)); } else if(strcmp(opt_name, "afl-ssh") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSSHParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_SSH, opt_arg)); } else if(strcmp(opt_name, "afl-ftp-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterFTPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_FTP, opt_arg)); } else if(strcmp(opt_name, "afl-ftp") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterFTPParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_FTP, opt_arg)); } else if(strcmp(opt_name, "afl-smtp-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSMTPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_SMTP, opt_arg)); } else if(strcmp(opt_name, "afl-smtp") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSMTPParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_SMTP, opt_arg)); } else if(strcmp(opt_name, "afl-smb-request") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); RegisterSMBParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_SMB, opt_arg)); } else if(strcmp(opt_name, "afl-smb") == 0) { //printf("arg: //%s\n", opt_arg); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); AppLayerParserSetup(); RegisterSMBParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_SMB, opt_arg)); } else if(strcmp(opt_name, "afl-modbus-request") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterModbusParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_MODBUS, opt_arg)); } else if(strcmp(opt_name, "afl-modbus") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterModbusParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_MODBUS, opt_arg)); } else if(strcmp(opt_name, "afl-enip-request") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterENIPTCPParsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_ENIP, opt_arg)); } else if(strcmp(opt_name, "afl-enip") == 0) { //printf("arg: //%s\n", opt_arg); AppLayerParserSetup(); RegisterENIPTCPParsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_ENIP, opt_arg)); } else if(strcmp(opt_name, "afl-dnp3-request") == 0) { AppLayerParserSetup(); RegisterDNP3Parsers(); exit(AppLayerParserRequestFromFile(IPPROTO_TCP, ALPROTO_DNP3, opt_arg)); } else if(strcmp(opt_name, "afl-dnp3") == 0) { AppLayerParserSetup(); RegisterDNP3Parsers(); exit(AppLayerParserFromFile(IPPROTO_TCP, ALPROTO_DNP3, opt_arg)); } else #endif #ifdef AFLFUZZ_MIME if(strcmp(opt_name, "afl-mime") == 0) { //printf("arg: //%s\n", opt_arg); exit(MimeParserDataFromFile(opt_arg)); } else #endif #ifdef AFLFUZZ_DECODER if(strstr(opt_name, "afl-decoder-ppp") != NULL) { StatsInit(); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); if (strcmp(opt_name, "afl-decoder-ppp") == 0) exit(DecoderParseDataFromFile(opt_arg, DecodePPP)); else exit(DecoderParseDataFromFileSerie(opt_arg, DecodePPP)); } else if(strstr(opt_name, "afl-decoder-ipv4") != NULL) { StatsInit(); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); if (strcmp(opt_name, "afl-decoder-ipv4") == 0) exit(DecoderParseDataFromFile(opt_arg, DecodeIPV4)); else exit(DecoderParseDataFromFileSerie(opt_arg, DecodeIPV4)); } else if(strstr(opt_name, "afl-decoder-ipv6") != NULL) { StatsInit(); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); if (strcmp(opt_name, "afl-decoder-ipv6") == 0) exit(DecoderParseDataFromFile(opt_arg, DecodeIPV6)); else exit(DecoderParseDataFromFileSerie(opt_arg, DecodeIPV6)); } else if(strstr(opt_name, "afl-decoder-ethernet") != NULL) { StatsInit(); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); if (strcmp(opt_name, "afl-decoder-ethernet") == 0) exit(DecoderParseDataFromFile(opt_arg, DecodeEthernet)); else exit(DecoderParseDataFromFileSerie(opt_arg, DecodeEthernet)); } else if(strstr(opt_name, "afl-decoder-erspan") != NULL) { StatsInit(); MpmTableSetup(); SpmTableSetup(); AppLayerProtoDetectSetup(); if (strcmp(opt_name, "afl-decoder-erspan") == 0) exit(DecoderParseDataFromFile(opt_arg, DecodeERSPAN)); else exit(DecoderParseDataFromFileSerie(opt_arg, DecodeERSPAN)); } else #endif #ifdef AFLFUZZ_DER if(strcmp(opt_name, "afl-der") == 0) { //printf("arg: //%s\n", opt_arg); exit(DerParseDataFromFile(opt_arg)); } else #endif { abort(); } } static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri) { int opt; int dump_config = 0; int list_app_layer_protocols = 0; int list_unittests = 0; int list_cuda_cards = 0; int list_runmodes = 0; int list_keywords = 0; int build_info = 0; int conf_test = 0; #ifdef AFLFUZZ_CONF_TEST int conf_test_force_success = 0; #endif int engine_analysis = 0; int set_log_directory = 0; int ret = TM_ECODE_OK; #ifdef UNITTESTS coverage_unittests = 0; g_ut_modules = 0; g_ut_covered = 0; #endif struct option long_opts[] = { {"dump-config", 0, &dump_config, 1}, {"pfring", optional_argument, 0, 0}, {"pfring-int", required_argument, 0, 0}, {"pfring-cluster-id", required_argument, 0, 0}, {"pfring-cluster-type", required_argument, 0, 0}, {"af-packet", optional_argument, 0, 0}, {"netmap", optional_argument, 0, 0}, {"pcap", optional_argument, 0, 0}, {"simulate-ips", 0, 0 , 0}, /* AFL app-layer options. */ {"afl-http-request", required_argument, 0 , 0}, {"afl-http", required_argument, 0 , 0}, {"afl-tls-request", required_argument, 0 , 0}, {"afl-tls", required_argument, 0 , 0}, {"afl-dns-request", required_argument, 0 , 0}, {"afl-dns", required_argument, 0 , 0}, {"afl-ssh-request", required_argument, 0 , 0}, {"afl-ssh", required_argument, 0 , 0}, {"afl-ftp-request", required_argument, 0 , 0}, {"afl-ftp", required_argument, 0 , 0}, {"afl-smtp-request", required_argument, 0 , 0}, {"afl-smtp", required_argument, 0 , 0}, {"afl-smb-request", required_argument, 0 , 0}, {"afl-smb", required_argument, 0 , 0}, {"afl-modbus-request", required_argument, 0 , 0}, {"afl-modbus", required_argument, 0 , 0}, {"afl-enip-request", required_argument, 0 , 0}, {"afl-enip", required_argument, 0 , 0}, {"afl-mime", required_argument, 0 , 0}, {"afl-dnp3-request", required_argument, 0, 0}, {"afl-dnp3", required_argument, 0, 0}, /* Other AFL options. */ {"afl-rules", required_argument, 0 , 0}, {"afl-mime", required_argument, 0 , 0}, {"afl-decoder-ppp", required_argument, 0 , 0}, {"afl-decoder-ppp-serie", required_argument, 0 , 0}, {"afl-decoder-ethernet", required_argument, 0 , 0}, {"afl-decoder-ethernet-serie", required_argument, 0 , 0}, {"afl-decoder-erspan", required_argument, 0 , 0}, {"afl-decoder-erspan-serie", required_argument, 0 , 0}, {"afl-decoder-ipv4", required_argument, 0 , 0}, {"afl-decoder-ipv4-serie", required_argument, 0 , 0}, {"afl-decoder-ipv6", required_argument, 0 , 0}, {"afl-decoder-ipv6-serie", required_argument, 0 , 0}, {"afl-der", required_argument, 0, 0}, #ifdef BUILD_UNIX_SOCKET {"unix-socket", optional_argument, 0, 0}, #endif {"pcap-buffer-size", required_argument, 0, 0}, {"unittest-filter", required_argument, 0, 'U'}, {"list-app-layer-protos", 0, &list_app_layer_protocols, 1}, {"list-unittests", 0, &list_unittests, 1}, {"list-cuda-cards", 0, &list_cuda_cards, 1}, {"list-runmodes", 0, &list_runmodes, 1}, {"list-keywords", optional_argument, &list_keywords, 1}, {"runmode", required_argument, NULL, 0}, {"engine-analysis", 0, &engine_analysis, 1}, #ifdef OS_WIN32 {"service-install", 0, 0, 0}, {"service-remove", 0, 0, 0}, {"service-change-params", 0, 0, 0}, #endif /* OS_WIN32 */ {"pidfile", required_argument, 0, 0}, {"init-errors-fatal", 0, 0, 0}, {"disable-detection", 0, 0, 0}, {"fatal-unittests", 0, 0, 0}, {"unittests-coverage", 0, &coverage_unittests, 1}, {"user", required_argument, 0, 0}, {"group", required_argument, 0, 0}, {"erf-in", required_argument, 0, 0}, {"dag", required_argument, 0, 0}, {"napatech", 0, 0, 0}, {"build-info", 0, &build_info, 1}, #ifdef HAVE_MPIPE {"mpipe", optional_argument, 0, 0}, #endif {"set", required_argument, 0, 0}, #ifdef HAVE_NFLOG {"nflog", optional_argument, 0, 0}, #endif #ifdef AFLFUZZ_CONF_TEST {"afl-parse-rules", 0, &conf_test_force_success, 1}, #endif {NULL, 0, NULL, 0} }; /* getopt_long stores the option index here. */ int option_index = 0; char short_opts[] = "c:TDhi:l:q:d:r:us:S:U:VF:vk:"; while ((opt = getopt_long(argc, argv, short_opts, long_opts, &option_index)) != -1) { switch (opt) { case 0: if (strcmp((long_opts[option_index]).name , "pfring") == 0 || strcmp((long_opts[option_index]).name , "pfring-int") == 0) { #ifdef HAVE_PFRING suri->run_mode = RUNMODE_PFRING; if (optarg != NULL) { memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); strlcpy(suri->pcap_dev, optarg, ((strlen(optarg) < sizeof(suri->pcap_dev)) ? (strlen(optarg) + 1) : sizeof(suri->pcap_dev))); LiveRegisterDevice(optarg); } #else SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure " "to pass --enable-pfring to configure when building."); return TM_ECODE_FAILED; #endif /* HAVE_PFRING */ } else if(strcmp((long_opts[option_index]).name , "pfring-cluster-id") == 0){ #ifdef HAVE_PFRING if (ConfSetFinal("pfring.cluster-id", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set pfring.cluster-id.\n"); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure " "to pass --enable-pfring to configure when building."); return TM_ECODE_FAILED; #endif /* HAVE_PFRING */ } else if(strcmp((long_opts[option_index]).name , "pfring-cluster-type") == 0){ #ifdef HAVE_PFRING if (ConfSetFinal("pfring.cluster-type", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set pfring.cluster-type.\n"); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_NO_PF_RING,"PF_RING not enabled. Make sure " "to pass --enable-pfring to configure when building."); return TM_ECODE_FAILED; #endif /* HAVE_PFRING */ } else if (strcmp((long_opts[option_index]).name , "af-packet") == 0) { if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) { return TM_ECODE_FAILED; } } else if (strcmp((long_opts[option_index]).name , "netmap") == 0){ #ifdef HAVE_NETMAP if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_NETMAP; if (optarg) { LiveRegisterDevice(optarg); memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); strlcpy(suri->pcap_dev, optarg, ((strlen(optarg) < sizeof(suri->pcap_dev)) ? (strlen(optarg) + 1) : sizeof(suri->pcap_dev))); } } else if (suri->run_mode == RUNMODE_NETMAP) { SCLogWarning(SC_WARN_PCAP_MULTI_DEV_EXPERIMENTAL, "using " "multiple devices to get packets is experimental."); if (optarg) { LiveRegisterDevice(optarg); } else { SCLogInfo("Multiple netmap option without interface on each is useless"); break; } } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_NO_NETMAP, "NETMAP not enabled."); return TM_ECODE_FAILED; #endif } else if (strcmp((long_opts[option_index]).name, "nflog") == 0) { #ifdef HAVE_NFLOG if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_NFLOG; LiveBuildDeviceListCustom("nflog", "group"); } #else SCLogError(SC_ERR_NFLOG_NOSUPPORT, "NFLOG not enabled."); return TM_ECODE_FAILED; #endif /* HAVE_NFLOG */ } else if (strcmp((long_opts[option_index]).name , "pcap") == 0) { if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) { return TM_ECODE_FAILED; } } else if(strncmp((long_opts[option_index]).name, "afl-", 4) == 0) { ParseCommandLineAFL((long_opts[option_index]).name, optarg); } else if(strcmp((long_opts[option_index]).name, "simulate-ips") == 0) { SCLogInfo("Setting IPS mode"); EngineModeSetIPS(); } else if(strcmp((long_opts[option_index]).name, "init-errors-fatal") == 0) { if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) { fprintf(stderr, "ERROR: Failed to set engine init-failure-fatal.\n"); return TM_ECODE_FAILED; } #ifdef BUILD_UNIX_SOCKET } else if (strcmp((long_opts[option_index]).name , "unix-socket") == 0) { if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_UNIX_SOCKET; if (optarg) { if (ConfSetFinal("unix-command.filename", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set unix-command.filename.\n"); return TM_ECODE_FAILED; } } } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } #endif } else if(strcmp((long_opts[option_index]).name, "list-app-layer-protocols") == 0) { /* listing all supported app layer protocols */ } else if(strcmp((long_opts[option_index]).name, "list-unittests") == 0) { #ifdef UNITTESTS suri->run_mode = RUNMODE_LIST_UNITTEST; #else fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n"); return TM_ECODE_FAILED; #endif /* UNITTESTS */ } else if(strcmp((long_opts[option_index]).name, "list-cuda-cards") == 0) { #ifndef __SC_CUDA_SUPPORT__ fprintf(stderr, "ERROR: Cuda not enabled. Make sure to pass " "--enable-cuda to configure when building.\n"); return TM_ECODE_FAILED; #endif /* UNITTESTS */ } else if (strcmp((long_opts[option_index]).name, "list-runmodes") == 0) { suri->run_mode = RUNMODE_LIST_RUNMODES; return TM_ECODE_OK; } else if (strcmp((long_opts[option_index]).name, "list-keywords") == 0) { if (optarg) { if (strcmp("short",optarg)) { suri->keyword_info = optarg; } } } else if (strcmp((long_opts[option_index]).name, "runmode") == 0) { suri->runmode_custom_mode = optarg; } else if(strcmp((long_opts[option_index]).name, "engine-analysis") == 0) { // do nothing for now } #ifdef OS_WIN32 else if(strcmp((long_opts[option_index]).name, "service-install") == 0) { suri->run_mode = RUNMODE_INSTALL_SERVICE; return TM_ECODE_OK; } else if(strcmp((long_opts[option_index]).name, "service-remove") == 0) { suri->run_mode = RUNMODE_REMOVE_SERVICE; return TM_ECODE_OK; } else if(strcmp((long_opts[option_index]).name, "service-change-params") == 0) { suri->run_mode = RUNMODE_CHANGE_SERVICE_PARAMS; return TM_ECODE_OK; } #endif /* OS_WIN32 */ else if(strcmp((long_opts[option_index]).name, "pidfile") == 0) { suri->pid_filename = optarg; } else if(strcmp((long_opts[option_index]).name, "disable-detection") == 0) { g_detect_disabled = suri->disabled_detect = 1; SCLogInfo("detection engine disabled"); } else if(strcmp((long_opts[option_index]).name, "fatal-unittests") == 0) { #ifdef UNITTESTS unittests_fatal = 1; #else fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n"); return TM_ECODE_FAILED; #endif /* UNITTESTS */ } else if(strcmp((long_opts[option_index]).name, "user") == 0) { #ifndef HAVE_LIBCAP_NG SCLogError(SC_ERR_LIBCAP_NG_REQUIRED, "libcap-ng is required to" " drop privileges, but it was not compiled into Suricata."); return TM_ECODE_FAILED; #else suri->user_name = optarg; suri->do_setuid = TRUE; #endif /* HAVE_LIBCAP_NG */ } else if(strcmp((long_opts[option_index]).name, "group") == 0) { #ifndef HAVE_LIBCAP_NG SCLogError(SC_ERR_LIBCAP_NG_REQUIRED, "libcap-ng is required to" " drop privileges, but it was not compiled into Suricata."); return TM_ECODE_FAILED; #else suri->group_name = optarg; suri->do_setgid = TRUE; #endif /* HAVE_LIBCAP_NG */ } else if (strcmp((long_opts[option_index]).name, "erf-in") == 0) { suri->run_mode = RUNMODE_ERF_FILE; if (ConfSetFinal("erf-file.file", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set erf-file.file\n"); return TM_ECODE_FAILED; } } else if (strcmp((long_opts[option_index]).name, "dag") == 0) { #ifdef HAVE_DAG if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_DAG; } else if (suri->run_mode != RUNMODE_DAG) { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } LiveRegisterDevice(optarg); #else SCLogError(SC_ERR_DAG_REQUIRED, "libdag and a DAG card are required" " to receive packets using --dag."); return TM_ECODE_FAILED; #endif /* HAVE_DAG */ } else if (strcmp((long_opts[option_index]).name, "napatech") == 0) { #ifdef HAVE_NAPATECH suri->run_mode = RUNMODE_NAPATECH; #else SCLogError(SC_ERR_NAPATECH_REQUIRED, "libntapi and a Napatech adapter are required" " to capture packets using --napatech."); return TM_ECODE_FAILED; #endif /* HAVE_NAPATECH */ } else if(strcmp((long_opts[option_index]).name, "pcap-buffer-size") == 0) { #ifdef HAVE_PCAP_SET_BUFF if (ConfSetFinal("pcap.buffer-size", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set pcap-buffer-size.\n"); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_NO_PCAP_SET_BUFFER_SIZE, "The version of libpcap you have" " doesn't support setting buffer size."); #endif /* HAVE_PCAP_SET_BUFF */ } else if(strcmp((long_opts[option_index]).name, "build-info") == 0) { suri->run_mode = RUNMODE_PRINT_BUILDINFO; return TM_ECODE_OK; } #ifdef HAVE_MPIPE else if(strcmp((long_opts[option_index]).name , "mpipe") == 0) { if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_TILERA_MPIPE; if (optarg != NULL) { memset(suri->pcap_dev, 0, sizeof(suri->pcap_dev)); strlcpy(suri->pcap_dev, optarg, ((strlen(optarg) < sizeof(suri->pcap_dev)) ? (strlen(optarg) + 1) : sizeof(suri->pcap_dev))); LiveRegisterDevice(optarg); } } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode has been specified"); usage(argv[0]); exit(EXIT_FAILURE); } } #endif else if (strcmp((long_opts[option_index]).name, "set") == 0) { if (optarg != NULL) { /* Quick validation. */ char *val = strchr(optarg, '='); if (val == NULL) { SCLogError(SC_ERR_CMD_LINE, "Invalid argument for --set, must be key=val."); exit(EXIT_FAILURE); } if (!ConfSetFromString(optarg, 1)) { fprintf(stderr, "Failed to set configuration value %s.", optarg); exit(EXIT_FAILURE); } } } break; case 'c': suri->conf_filename = optarg; break; case 'T': SCLogInfo("Running suricata under test mode"); conf_test = 1; if (ConfSetFinal("engine.init-failure-fatal", "1") != 1) { fprintf(stderr, "ERROR: Failed to set engine init-failure-fatal.\n"); return TM_ECODE_FAILED; } break; #ifndef OS_WIN32 case 'D': suri->daemon = 1; break; #endif /* OS_WIN32 */ case 'h': suri->run_mode = RUNMODE_PRINT_USAGE; return TM_ECODE_OK; case 'i': if (optarg == NULL) { SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -i"); return TM_ECODE_FAILED; } #ifdef HAVE_AF_PACKET if (ParseCommandLineAfpacket(suri, optarg) != TM_ECODE_OK) { return TM_ECODE_FAILED; } #else /* not afpacket */ /* warn user if netmap or pf-ring are available */ #if defined HAVE_PFRING || HAVE_NETMAP int i = 0; #ifdef HAVE_PFRING i++; #endif #ifdef HAVE_NETMAP i++; #endif SCLogWarning(SC_WARN_FASTER_CAPTURE_AVAILABLE, "faster capture " "option%s %s available:" #ifdef HAVE_PFRING " PF_RING (--pfring-int=%s)" #endif #ifdef HAVE_NETMAP " NETMAP (--netmap=%s)" #endif ". Use --pcap=%s to suppress this warning", i == 1 ? "" : "s", i == 1 ? "is" : "are" #ifdef HAVE_PFRING , optarg #endif #ifdef HAVE_NETMAP , optarg #endif , optarg ); #endif /* have faster methods */ if (ParseCommandLinePcapLive(suri, optarg) != TM_ECODE_OK) { return TM_ECODE_FAILED; } #endif break; case 'l': if (optarg == NULL) { SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -l"); return TM_ECODE_FAILED; } if (ConfigSetLogDirectory(optarg) != TM_ECODE_OK) { SCLogError(SC_ERR_FATAL, "Failed to set log directory.\n"); return TM_ECODE_FAILED; } if (ConfigCheckLogDirectory(optarg) != TM_ECODE_OK) { SCLogError(SC_ERR_LOGDIR_CMDLINE, "The logging directory \"%s\"" " supplied at the commandline (-l %s) doesn't " "exist. Shutting down the engine.", optarg, optarg); return TM_ECODE_FAILED; } set_log_directory = 1; break; case 'q': #ifdef NFQ if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_NFQ; EngineModeSetIPS(); if (NFQRegisterQueue(optarg) == -1) return TM_ECODE_FAILED; } else if (suri->run_mode == RUNMODE_NFQ) { if (NFQRegisterQueue(optarg) == -1) return TM_ECODE_FAILED; } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_NFQ_NOSUPPORT,"NFQUEUE not enabled. Make sure to pass --enable-nfqueue to configure when building."); return TM_ECODE_FAILED; #endif /* NFQ */ break; case 'd': #ifdef IPFW if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_IPFW; EngineModeSetIPS(); if (IPFWRegisterQueue(optarg) == -1) return TM_ECODE_FAILED; } else if (suri->run_mode == RUNMODE_IPFW) { if (IPFWRegisterQueue(optarg) == -1) return TM_ECODE_FAILED; } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } #else SCLogError(SC_ERR_IPFW_NOSUPPORT,"IPFW not enabled. Make sure to pass --enable-ipfw to configure when building."); return TM_ECODE_FAILED; #endif /* IPFW */ break; case 'r': if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_PCAP_FILE; } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode " "has been specified"); usage(argv[0]); return TM_ECODE_FAILED; } if (ConfSetFinal("pcap-file.file", optarg) != 1) { fprintf(stderr, "ERROR: Failed to set pcap-file.file\n"); return TM_ECODE_FAILED; } break; case 's': if (suri->sig_file != NULL) { SCLogError(SC_ERR_CMD_LINE, "can't have multiple -s options or mix -s and -S."); return TM_ECODE_FAILED; } suri->sig_file = optarg; break; case 'S': if (suri->sig_file != NULL) { SCLogError(SC_ERR_CMD_LINE, "can't have multiple -S options or mix -s and -S."); return TM_ECODE_FAILED; } suri->sig_file = optarg; suri->sig_file_exclusive = TRUE; break; case 'u': #ifdef UNITTESTS if (suri->run_mode == RUNMODE_UNKNOWN) { suri->run_mode = RUNMODE_UNITTEST; } else { SCLogError(SC_ERR_MULTIPLE_RUN_MODE, "more than one run mode has" " been specified"); usage(argv[0]); return TM_ECODE_FAILED; } #else fprintf(stderr, "ERROR: Unit tests not enabled. Make sure to pass --enable-unittests to configure when building.\n"); return TM_ECODE_FAILED; #endif /* UNITTESTS */ break; case 'U': #ifdef UNITTESTS suri->regex_arg = optarg; if(strlen(suri->regex_arg) == 0) suri->regex_arg = NULL; #endif break; case 'V': suri->run_mode = RUNMODE_PRINT_VERSION; return TM_ECODE_OK; case 'F': if (optarg == NULL) { SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -F"); return TM_ECODE_FAILED; } SetBpfStringFromFile(optarg); break; case 'v': suri->verbose++; break; case 'k': if (optarg == NULL) { SCLogError(SC_ERR_INITIALIZATION, "no option argument (optarg) for -k"); return TM_ECODE_FAILED; } if (!strcmp("all", optarg)) suri->checksum_validation = 1; else if (!strcmp("none", optarg)) suri->checksum_validation = 0; else { SCLogError(SC_ERR_INITIALIZATION, "option '%s' invalid for -k", optarg); return TM_ECODE_FAILED; } break; default: usage(argv[0]); return TM_ECODE_FAILED; } } if (suri->disabled_detect && suri->sig_file != NULL) { SCLogError(SC_ERR_INITIALIZATION, "can't use -s/-S when detection is disabled"); return TM_ECODE_FAILED; } #ifdef AFLFUZZ_CONF_TEST if (conf_test && conf_test_force_success) { (void)ConfSetFinal("engine.init-failure-fatal", "0"); } #endif if ((suri->run_mode == RUNMODE_UNIX_SOCKET) && set_log_directory) { SCLogError(SC_ERR_INITIALIZATION, "can't use -l and unix socket runmode at the same time"); return TM_ECODE_FAILED; } if (list_app_layer_protocols) suri->run_mode = RUNMODE_LIST_APP_LAYERS; if (list_cuda_cards) suri->run_mode = RUNMODE_LIST_CUDA_CARDS; if (list_keywords) suri->run_mode = RUNMODE_LIST_KEYWORDS; if (list_unittests) suri->run_mode = RUNMODE_LIST_UNITTEST; if (dump_config) suri->run_mode = RUNMODE_DUMP_CONFIG; if (conf_test) suri->run_mode = RUNMODE_CONF_TEST; if (engine_analysis) suri->run_mode = RUNMODE_ENGINE_ANALYSIS; ret = SetBpfString(optind, argv); if (ret != TM_ECODE_OK) return ret; return TM_ECODE_OK; } #ifdef OS_WIN32 static int WindowsInitService(int argc, char **argv) { if (SCRunningAsService()) { char path[MAX_PATH]; char *p = NULL; strlcpy(path, argv[0], MAX_PATH); if ((p = strrchr(path, '\\'))) { *p = '\0'; } if (!SetCurrentDirectory(path)) { SCLogError(SC_ERR_FATAL, "Can't set current directory to: %s", path); return -1; } SCLogInfo("Current directory is set to: %s", path); daemon = 1; SCServiceInit(argc, argv); } /* Windows socket subsystem initialization */ WSADATA wsaData; if (0 != WSAStartup(MAKEWORD(2, 2), &wsaData)) { SCLogError(SC_ERR_FATAL, "Can't initialize Windows sockets: %d", WSAGetLastError()); return -1; } return 0; } #endif /* OS_WIN32 */ static int MayDaemonize(SCInstance *suri) { if (suri->daemon == 1 && suri->pid_filename == NULL) { if (ConfGet("pid-file", &suri->pid_filename) == 1) { SCLogInfo("Use pid file %s from config file.", suri->pid_filename); } else { suri->pid_filename = DEFAULT_PID_FILENAME; } } if (suri->pid_filename != NULL && SCPidfileTestRunning(suri->pid_filename) != 0) { suri->pid_filename = NULL; return TM_ECODE_FAILED; } if (suri->daemon == 1) { Daemonize(); } if (suri->pid_filename != NULL) { if (SCPidfileCreate(suri->pid_filename) != 0) { suri->pid_filename = NULL; SCLogError(SC_ERR_PIDFILE_DAEMON, "Unable to create PID file, concurrent run of" " Suricata can occur."); SCLogError(SC_ERR_PIDFILE_DAEMON, "PID file creation WILL be mandatory for daemon mode" " in future version"); } } return TM_ECODE_OK; } static int InitSignalHandler(SCInstance *suri) { /* registering signals we use */ UtilSignalHandlerSetup(SIGINT, SignalHandlerSigint); UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2); UtilSignalHandlerSetup(SIGTERM, SignalHandlerSigterm); UtilSignalHandlerSetup(SIGPIPE, SIG_IGN); UtilSignalHandlerSetup(SIGSYS, SIG_IGN); #ifndef OS_WIN32 /* SIGHUP is not implemented on WIN32 */ UtilSignalHandlerSetup(SIGHUP, SignalHandlerSigHup); /* Try to get user/group to run suricata as if command line as not decide of that */ if (suri->do_setuid == FALSE && suri->do_setgid == FALSE) { char *id; if (ConfGet("run-as.user", &id) == 1) { suri->do_setuid = TRUE; suri->user_name = id; } if (ConfGet("run-as.group", &id) == 1) { suri->do_setgid = TRUE; suri->group_name = id; } } /* Get the suricata user ID to given user ID */ if (suri->do_setuid == TRUE) { if (SCGetUserID(suri->user_name, suri->group_name, &suri->userid, &suri->groupid) != 0) { SCLogError(SC_ERR_UID_FAILED, "failed in getting user ID"); return TM_ECODE_FAILED; } sc_set_caps = TRUE; /* Get the suricata group ID to given group ID */ } else if (suri->do_setgid == TRUE) { if (SCGetGroupID(suri->group_name, &suri->groupid) != 0) { SCLogError(SC_ERR_GID_FAILED, "failed in getting group ID"); return TM_ECODE_FAILED; } sc_set_caps = TRUE; } #endif /* OS_WIN32 */ return TM_ECODE_OK; } /* initialization code for both the main modes and for * unix socket mode. * * Will be run once per pcap in unix-socket mode */ void PreRunInit(const int runmode) { if (runmode == RUNMODE_UNIX_SOCKET) return; StatsInit(); #ifdef PROFILING SCProfilingRulesGlobalInit(); SCProfilingKeywordsGlobalInit(); SCProfilingSghsGlobalInit(); SCProfilingInit(); #endif /* PROFILING */ DefragInit(); FlowInitConfig(FLOW_QUIET); IPPairInitConfig(FLOW_QUIET); StreamTcpInitConfig(STREAM_VERBOSE); AppLayerRegisterGlobalCounters(); } /* tasks we need to run before packets start flowing, * but after we dropped privs */ void PreRunPostPrivsDropInit(const int runmode) { if (runmode == RUNMODE_UNIX_SOCKET) return; RunModeInitializeOutputs(); StatsSetupPostConfig(); } /* clean up / shutdown code for both the main modes and for * unix socket mode. * * Will be run once per pcap in unix-socket mode */ void PostRunDeinit(const int runmode, struct timeval *start_time) { if (runmode == RUNMODE_UNIX_SOCKET) return; /* needed by FlowForceReassembly */ PacketPoolInit(); /* handle graceful shutdown of the flow engine, it's helper * threads and the packet threads */ FlowDisableFlowManagerThread(); TmThreadDisableReceiveThreads(); FlowForceReassembly(); TmThreadDisablePacketThreads(); SCPrintElapsedTime(start_time); FlowDisableFlowRecyclerThread(); /* kill the stats threads */ TmThreadKillThreadsFamily(TVT_MGMT); TmThreadClearThreadsFamily(TVT_MGMT); /* kill packet threads -- already in 'disabled' state */ TmThreadKillThreadsFamily(TVT_PPT); TmThreadClearThreadsFamily(TVT_PPT); PacketPoolDestroy(); /* mgt and ppt threads killed, we can run non thread-safe * shutdown functions */ StatsReleaseResources(); RunModeShutDown(); FlowShutdown(); IPPairShutdown(); HostCleanup(); StreamTcpFreeConfig(STREAM_VERBOSE); DefragDestroy(); TmqResetQueues(); #ifdef PROFILING if (profiling_rules_enabled) SCProfilingDump(); SCProfilingDestroy(); #endif } int StartInternalRunMode(SCInstance *suri, int argc, char **argv) { /* Treat internal running mode */ switch(suri->run_mode) { case RUNMODE_LIST_KEYWORDS: ListKeywords(suri->keyword_info); return TM_ECODE_DONE; case RUNMODE_LIST_APP_LAYERS: ListAppLayerProtocols(); return TM_ECODE_DONE; case RUNMODE_PRINT_VERSION: PrintVersion(); return TM_ECODE_DONE; case RUNMODE_PRINT_BUILDINFO: SCPrintBuildInfo(); return TM_ECODE_DONE; case RUNMODE_PRINT_USAGE: usage(argv[0]); return TM_ECODE_DONE; #ifdef __SC_CUDA_SUPPORT__ case RUNMODE_LIST_CUDA_CARDS: return ListCudaCards(); #endif case RUNMODE_LIST_RUNMODES: RunModeListRunmodes(); return TM_ECODE_DONE; case RUNMODE_LIST_UNITTEST: RunUnittests(1, suri->regex_arg); case RUNMODE_UNITTEST: RunUnittests(0, suri->regex_arg); #ifdef OS_WIN32 case RUNMODE_INSTALL_SERVICE: if (SCServiceInstall(argc, argv)) { return TM_ECODE_FAILED; } SCLogInfo("Suricata service has been successfuly installed."); return TM_ECODE_DONE; case RUNMODE_REMOVE_SERVICE: if (SCServiceRemove(argc, argv)) { return TM_ECODE_FAILED; } SCLogInfo("Suricata service has been successfuly removed."); return TM_ECODE_DONE; case RUNMODE_CHANGE_SERVICE_PARAMS: if (SCServiceChangeParams(argc, argv)) { return TM_ECODE_FAILED; } SCLogInfo("Suricata service startup parameters has been successfuly changed."); return TM_ECODE_DONE; #endif /* OS_WIN32 */ default: /* simply continue for other running mode */ break; } return TM_ECODE_OK; } static int FinalizeRunMode(SCInstance *suri, char **argv) { switch (suri->run_mode) { case RUNMODE_PCAP_FILE: case RUNMODE_ERF_FILE: case RUNMODE_ENGINE_ANALYSIS: suri->offline = 1; break; case RUNMODE_UNKNOWN: usage(argv[0]); return TM_ECODE_FAILED; default: break; } /* Set the global run mode */ run_mode = suri->run_mode; if (!CheckValidDaemonModes(suri->daemon, suri->run_mode)) { return TM_ECODE_FAILED; } return TM_ECODE_OK; } static void SetupDelayedDetect(SCInstance *suri) { /* In offline mode delayed init of detect is a bad idea */ if (suri->offline) { suri->delayed_detect = 0; } else { if (ConfGetBool("detect.delayed-detect", &suri->delayed_detect) != 1) { ConfNode *denode = NULL; ConfNode *decnf = ConfGetNode("detect-engine"); if (decnf != NULL) { TAILQ_FOREACH(denode, &decnf->head, next) { if (strcmp(denode->val, "delayed-detect") == 0) { (void)ConfGetChildValueBool(denode, "delayed-detect", &suri->delayed_detect); } } } } } SCLogConfig("Delayed detect %s", suri->delayed_detect ? "enabled" : "disabled"); if (suri->delayed_detect) { SCLogInfo("Packets will start being processed before signatures are active."); } } static int LoadSignatures(DetectEngineCtx *de_ctx, SCInstance *suri) { if (SigLoadSignatures(de_ctx, suri->sig_file, suri->sig_file_exclusive) < 0) { SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed."); if (de_ctx->failure_fatal) return TM_ECODE_FAILED; } SCThresholdConfInitContext(de_ctx, NULL); return TM_ECODE_OK; } static int ConfigGetCaptureValue(SCInstance *suri) { /* Pull the max pending packets from the config, if not found fall * back on a sane default. */ if (ConfGetInt("max-pending-packets", &max_pending_packets) != 1) max_pending_packets = DEFAULT_MAX_PENDING_PACKETS; if (max_pending_packets >= 65535) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Maximum max-pending-packets setting is 65534. " "Please check %s for errors", suri->conf_filename); return TM_ECODE_FAILED; } SCLogDebug("Max pending packets set to %"PRIiMAX, max_pending_packets); /* Pull the default packet size from the config, if not found fall * back on a sane default. */ char *temp_default_packet_size; if ((ConfGet("default-packet-size", &temp_default_packet_size)) != 1) { int lthread; int nlive; int strip_trailing_plus = 0; switch (suri->run_mode) { case RUNMODE_PCAP_DEV: case RUNMODE_AFP_DEV: case RUNMODE_NETMAP: /* in netmap igb0+ has a special meaning, however the * interface really is igb0 */ strip_trailing_plus = 1; /* fall through */ case RUNMODE_PFRING: nlive = LiveGetDeviceCount(); for (lthread = 0; lthread < nlive; lthread++) { const char *live_dev = LiveGetDeviceName(lthread); char dev[32]; (void)strlcpy(dev, live_dev, sizeof(dev)); if (strip_trailing_plus) { size_t len = strlen(dev); if (len && dev[len-1] == '+') { dev[len-1] = '\0'; } } int mtu = GetIfaceMTU(dev); g_default_mtu = MAX(mtu, g_default_mtu); unsigned int iface_max_packet_size = GetIfaceMaxPacketSize(dev); if (iface_max_packet_size > default_packet_size) default_packet_size = iface_max_packet_size; } if (default_packet_size) break; /* fall through */ default: g_default_mtu = DEFAULT_MTU; default_packet_size = DEFAULT_PACKET_SIZE; } } else { if (ParseSizeStringU32(temp_default_packet_size, &default_packet_size) < 0) { SCLogError(SC_ERR_SIZE_PARSE, "Error parsing max-pending-packets " "from conf file - %s. Killing engine", temp_default_packet_size); return TM_ECODE_FAILED; } } SCLogDebug("Default packet size set to %"PRIu32, default_packet_size); return TM_ECODE_OK; } static void PostRunStartedDetectSetup(SCInstance *suri) { /* registering signal handlers we use. We register usr2 here, so that one * can't call it during the first sig load phase or while threads are still * starting up. */ if (DetectEngineEnabled() && suri->sig_file == NULL && suri->delayed_detect == 0) UtilSignalHandlerSetup(SIGUSR2, SignalHandlerSigusr2); if (suri->delayed_detect) { /* force 'reload', this will load the rules and swap engines */ DetectEngineReload(suri); SCLogNotice("Signature(s) loaded, Detect thread(s) activated."); } } static void PostConfLoadedDetectSetup(SCInstance *suri) { DetectEngineCtx *de_ctx = NULL; if (!suri->disabled_detect) { SCClassConfInit(); SCReferenceConfInit(); SetupDelayedDetect(suri); int mt_enabled = 0; (void)ConfGetBool("multi-detect.enabled", &mt_enabled); int default_tenant = 0; if (mt_enabled) (void)ConfGetBool("multi-detect.default", &default_tenant); if (DetectEngineMultiTenantSetup() == -1) { SCLogError(SC_ERR_INITIALIZATION, "initializing multi-detect " "detection engine contexts failed."); exit(EXIT_FAILURE); } if ((suri->delayed_detect || (mt_enabled && !default_tenant)) && (suri->run_mode != RUNMODE_CONF_TEST)) { de_ctx = DetectEngineCtxInitMinimal(); } else { de_ctx = DetectEngineCtxInit(); } if (de_ctx == NULL) { SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine " "context failed."); exit(EXIT_FAILURE); } #ifdef __SC_CUDA_SUPPORT__ if (PatternMatchDefaultMatcher() == MPM_AC_CUDA) CudaVarsSetDeCtx(de_ctx); #endif /* __SC_CUDA_SUPPORT__ */ if (!de_ctx->minimal) { if (LoadSignatures(de_ctx, suri) != TM_ECODE_OK) exit(EXIT_FAILURE); if (suri->run_mode == RUNMODE_ENGINE_ANALYSIS) { exit(EXIT_SUCCESS); } } DetectEngineAddToMaster(de_ctx); } else { /* tell the app layer to consider only the log id */ RegisterAppLayerGetActiveTxIdFunc(AppLayerTransactionGetActiveLogOnly); } } /** * This function is meant to contain code that needs * to be run once the configuration has been loaded. */ static int PostConfLoadedSetup(SCInstance *suri) { char *hostmode = NULL; /* do this as early as possible #1577 #1955 */ #ifdef HAVE_LUAJIT if (LuajitSetupStatesPool() != 0) { SCReturnInt(TM_ECODE_FAILED); } #endif /* load the pattern matchers */ MpmTableSetup(); #ifdef __SC_CUDA_SUPPORT__ MpmCudaEnvironmentSetup(); #endif SpmTableSetup(); int disable_offloading; if (ConfGetBool("capture.disable-offloading", &disable_offloading) == 0) disable_offloading = 1; if (disable_offloading) { LiveSetOffloadDisable(); } else { LiveSetOffloadWarn(); } if (suri->checksum_validation == -1) { char *cv = NULL; if (ConfGet("capture.checksum-validation", &cv) == 1) { if (strcmp(cv, "none") == 0) { suri->checksum_validation = 0; } else if (strcmp(cv, "all") == 0) { suri->checksum_validation = 1; } } } switch (suri->checksum_validation) { case 0: ConfSet("stream.checksum-validation", "0"); break; case 1: ConfSet("stream.checksum-validation", "1"); break; } AppLayerSetup(); /* Check for the existance of the default logging directory which we pick * from suricata.yaml. If not found, shut the engine down */ suri->log_dir = ConfigGetLogDirectory(); if (ConfigCheckLogDirectory(suri->log_dir) != TM_ECODE_OK) { SCLogError(SC_ERR_LOGDIR_CONFIG, "The logging directory \"%s\" " "supplied by %s (default-log-dir) doesn't exist. " "Shutting down the engine", suri->log_dir, suri->conf_filename); SCReturnInt(TM_ECODE_FAILED); } if (ConfigGetCaptureValue(suri) != TM_ECODE_OK) { SCReturnInt(TM_ECODE_FAILED); } if (ConfGet("host-mode", &hostmode) == 1) { if (!strcmp(hostmode, "router")) { host_mode = SURI_HOST_IS_ROUTER; } else if (!strcmp(hostmode, "sniffer-only")) { host_mode = SURI_HOST_IS_SNIFFER_ONLY; } else { if (strcmp(hostmode, "auto") != 0) { WarnInvalidConfEntry("host-mode", "%s", "auto"); } if (EngineModeIsIPS()) { host_mode = SURI_HOST_IS_ROUTER; } else { host_mode = SURI_HOST_IS_SNIFFER_ONLY; } } } else { if (EngineModeIsIPS()) { host_mode = SURI_HOST_IS_ROUTER; SCLogInfo("No 'host-mode': suricata is in IPS mode, using " "default setting 'router'"); } else { host_mode = SURI_HOST_IS_SNIFFER_ONLY; SCLogInfo("No 'host-mode': suricata is in IDS mode, using " "default setting 'sniffer-only'"); } } #ifdef NFQ if (suri->run_mode == RUNMODE_NFQ) NFQInitConfig(FALSE); #endif /* Load the Host-OS lookup. */ SCHInfoLoadFromConfig(); if (suri->run_mode == RUNMODE_ENGINE_ANALYSIS) { SCLogInfo("== Carrying out Engine Analysis =="); char *temp = NULL; if (ConfGet("engine-analysis", &temp) == 0) { SCLogInfo("no engine-analysis parameter(s) defined in conf file. " "Please define/enable them in the conf to use this " "feature."); SCReturnInt(TM_ECODE_FAILED); } } /* hardcoded initialization code */ SigTableSetup(); /* load the rule keywords */ TmqhSetup(); StorageInit(); CIDRInit(); SigParsePrepare(); SCReputationInitCtx(); SCProtoNameInit(); TagInitCtx(); PacketAlertTagInit(); ThresholdInit(); HostBitInitCtx(); IPPairBitInitCtx(); if (DetectAddressTestConfVars() < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "basic address vars test failed. Please check %s for errors", suri->conf_filename); SCReturnInt(TM_ECODE_FAILED); } if (DetectPortTestConfVars() < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "basic port vars test failed. Please check %s for errors", suri->conf_filename); SCReturnInt(TM_ECODE_FAILED); } RegisterAllModules(); AppLayerHtpNeedFileInspection(); StorageFinalize(); TmModuleRunInit(); if (MayDaemonize(suri) != TM_ECODE_OK) SCReturnInt(TM_ECODE_FAILED); if (InitSignalHandler(suri) != TM_ECODE_OK) SCReturnInt(TM_ECODE_FAILED); #ifdef HAVE_NSS if (suri->run_mode != RUNMODE_CONF_TEST) { /* init NSS for hashing */ PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0); NSS_NoDB_Init(NULL); } #endif if (suri->disabled_detect) { /* disable raw reassembly */ (void)ConfSetFinal("stream.reassembly.raw", "false"); } HostInitConfig(HOST_VERBOSE); #ifdef HAVE_MAGIC if (MagicInit() != 0) SCReturnInt(TM_ECODE_FAILED); #endif SCAsn1LoadConfig(); CoredumpLoadConfig(); PreRunInit(suri->run_mode); SCReturnInt(TM_ECODE_OK); } static void SuricataMainLoop(SCInstance *suri) { while(1) { if (sigterm_count || sigint_count) { suricata_ctl_flags |= SURICATA_STOP; } if (suricata_ctl_flags & SURICATA_STOP) { SCLogNotice("Signal Received. Stopping engine."); break; } TmThreadCheckThreadState(); if (sighup_count > 0) { OutputNotifyFileRotation(); sighup_count--; } if (sigusr2_count > 0) { if (suri->sig_file != NULL) { SCLogWarning(SC_ERR_LIVE_RULE_SWAP, "Live rule reload not " "possible if -s or -S option used at runtime."); sigusr2_count--; } else { if (!(DetectEngineReloadIsStart())) { DetectEngineReloadStart(); DetectEngineReload(suri); DetectEngineReloadSetDone(); sigusr2_count--; } } } else if (DetectEngineReloadIsStart()) { if (suri->sig_file != NULL) { SCLogWarning(SC_ERR_LIVE_RULE_SWAP, "Live rule reload not " "possible if -s or -S option used at runtime."); DetectEngineReloadSetDone(); } else { DetectEngineReload(suri); DetectEngineReloadSetDone(); } } usleep(10* 1000); } } int main(int argc, char **argv) { SCInstance suri; SCInstanceInit(&suri, argv[0]); SC_ATOMIC_INIT(engine_stage); /* initialize the logging subsys */ SCLogInitLogModule(NULL); (void)SCSetThreadName("Suricata-Main"); ParseSizeInit(); RunModeRegisterRunModes(); #ifdef OS_WIN32 /* service initialization */ if (WindowsInit(argc, argv) != 0) { exit(EXIT_FAILURE); } #endif /* OS_WIN32 */ /* Initialize the configuration module. */ ConfInit(); if (ParseCommandLine(argc, argv, &suri) != TM_ECODE_OK) { exit(EXIT_FAILURE); } if (FinalizeRunMode(&suri, argv) != TM_ECODE_OK) { exit(EXIT_FAILURE); } switch (StartInternalRunMode(&suri, argc, argv)) { case TM_ECODE_DONE: exit(EXIT_SUCCESS); case TM_ECODE_FAILED: exit(EXIT_FAILURE); } /* Initializations for global vars, queues, etc (memsets, mutex init..) */ GlobalsInitPreConfig(); /* Load yaml configuration file if provided. */ if (LoadYamlConfig(&suri) != TM_ECODE_OK) { exit(EXIT_FAILURE); } if (suri.run_mode == RUNMODE_DUMP_CONFIG) { ConfDump(); exit(EXIT_SUCCESS); } /* Since our config is now loaded we can finish configurating the * logging module. */ SCLogLoadConfig(suri.daemon, suri.verbose); SCPrintVersion(); UtilCpuPrintSummary(); if (ParseInterfacesList(suri.run_mode, suri.pcap_dev) != TM_ECODE_OK) { exit(EXIT_FAILURE); } if (PostConfLoadedSetup(&suri) != TM_ECODE_OK) { exit(EXIT_FAILURE); } PostConfLoadedDetectSetup(&suri); SCDropMainThreadCaps(suri.userid, suri.groupid); PreRunPostPrivsDropInit(suri.run_mode); if (suri.run_mode == RUNMODE_CONF_TEST){ SCLogNotice("Configuration provided was successfully loaded. Exiting."); #ifdef HAVE_MAGIC MagicDeinit(); #endif exit(EXIT_SUCCESS); } SCSetStartTime(&suri); RunModeDispatch(suri.run_mode, suri.runmode_custom_mode); if (suri.run_mode != RUNMODE_UNIX_SOCKET) { UnixManagerThreadSpawnNonRunmode(); } /* Wait till all the threads have been initialized */ if (TmThreadWaitOnThreadInit() == TM_ECODE_FAILED) { SCLogError(SC_ERR_INITIALIZATION, "Engine initialization failed, " "aborting..."); exit(EXIT_FAILURE); } (void) SC_ATOMIC_CAS(&engine_stage, SURICATA_INIT, SURICATA_RUNTIME); PacketPoolPostRunmodes(); /* Un-pause all the paused threads */ TmThreadContinueThreads(); PostRunStartedDetectSetup(&suri); #ifdef DBG_MEM_ALLOC SCLogInfo("Memory used at startup: %"PRIdMAX, (intmax_t)global_mem); #ifdef DBG_MEM_ALLOC_SKIP_STARTUP print_mem_flag = 1; #endif #endif SuricataMainLoop(&suri); /* Update the engine stage/status flag */ (void) SC_ATOMIC_CAS(&engine_stage, SURICATA_RUNTIME, SURICATA_DEINIT); UnixSocketKillSocketThread(); PostRunDeinit(suri.run_mode, &suri.start_time); /* kill remaining threads */ TmThreadKillThreads(); GlobalsDestroy(&suri); exit(EXIT_SUCCESS); } suricata-3.2.1/src/log-tlsstore.h0000644000000000000000000000160313051004444013610 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __LOG_TLSSTORE_H__ #define __LOG_TLSSTORE_H__ void LogTlsStoreRegister(void); #endif /* __LOG_TLSSTORE_H__ */ suricata-3.2.1/src/util-lua-dnp3-objects.c0000644000000000000000000047533213051004444015210 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * DO NOT EDIT. THIS FILE IS AUTO-GENERATED. * * Generated by command: * ./scripts/dnp3-gen/dnp3-gen.py */ #include "suricata-common.h" #include "app-layer-dnp3.h" #include "app-layer-dnp3-objects.h" #ifdef HAVE_LUA #include #include #include #include "util-lua.h" /** * \brief Push an object point item onto the stack. */ void DNP3PushPoint(lua_State *luastate, DNP3Object *object, DNP3Point *point) { switch (DNP3_OBJECT_CODE(object->group, object->variation)) { case DNP3_OBJECT_CODE(1, 1): { DNP3ObjectG1V1 *data = point->data; lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(1, 2): { DNP3ObjectG1V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved"); lua_pushinteger(luastate, data->reserved); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(2, 1): { DNP3ObjectG2V1 *data = point->data; lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(2, 2): { DNP3ObjectG2V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved"); lua_pushinteger(luastate, data->reserved); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(2, 3): { DNP3ObjectG2V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved"); lua_pushinteger(luastate, data->reserved); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(3, 1): { DNP3ObjectG3V1 *data = point->data; lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(3, 2): { DNP3ObjectG3V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(4, 1): { DNP3ObjectG4V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(4, 2): { DNP3ObjectG4V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(4, 3): { DNP3ObjectG4V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "chatter_filter"); lua_pushinteger(luastate, data->chatter_filter); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); lua_pushliteral(luastate, "relative_time_ms"); lua_pushinteger(luastate, data->relative_time_ms); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(10, 1): { DNP3ObjectG10V1 *data = point->data; lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(10, 2): { DNP3ObjectG10V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(11, 1): { DNP3ObjectG11V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(11, 2): { DNP3ObjectG11V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(12, 1): { DNP3ObjectG12V1 *data = point->data; lua_pushliteral(luastate, "op_type"); lua_pushinteger(luastate, data->op_type); lua_settable(luastate, -3); lua_pushliteral(luastate, "qu"); lua_pushinteger(luastate, data->qu); lua_settable(luastate, -3); lua_pushliteral(luastate, "cr"); lua_pushinteger(luastate, data->cr); lua_settable(luastate, -3); lua_pushliteral(luastate, "tcc"); lua_pushinteger(luastate, data->tcc); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "ontime"); lua_pushinteger(luastate, data->ontime); lua_settable(luastate, -3); lua_pushliteral(luastate, "offtime"); lua_pushinteger(luastate, data->offtime); lua_settable(luastate, -3); lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved"); lua_pushinteger(luastate, data->reserved); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(12, 2): { DNP3ObjectG12V2 *data = point->data; lua_pushliteral(luastate, "op_type"); lua_pushinteger(luastate, data->op_type); lua_settable(luastate, -3); lua_pushliteral(luastate, "qu"); lua_pushinteger(luastate, data->qu); lua_settable(luastate, -3); lua_pushliteral(luastate, "cr"); lua_pushinteger(luastate, data->cr); lua_settable(luastate, -3); lua_pushliteral(luastate, "tcc"); lua_pushinteger(luastate, data->tcc); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "ontime"); lua_pushinteger(luastate, data->ontime); lua_settable(luastate, -3); lua_pushliteral(luastate, "offtime"); lua_pushinteger(luastate, data->offtime); lua_settable(luastate, -3); lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved"); lua_pushinteger(luastate, data->reserved); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(12, 3): { DNP3ObjectG12V3 *data = point->data; lua_pushliteral(luastate, "point"); lua_pushinteger(luastate, data->point); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(13, 1): { DNP3ObjectG13V1 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_state"); lua_pushinteger(luastate, data->commanded_state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(13, 2): { DNP3ObjectG13V2 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_state"); lua_pushinteger(luastate, data->commanded_state); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 1): { DNP3ObjectG20V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 2): { DNP3ObjectG20V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 3): { DNP3ObjectG20V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 4): { DNP3ObjectG20V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 5): { DNP3ObjectG20V5 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 6): { DNP3ObjectG20V6 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 7): { DNP3ObjectG20V7 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(20, 8): { DNP3ObjectG20V8 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 1): { DNP3ObjectG21V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 2): { DNP3ObjectG21V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 3): { DNP3ObjectG21V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 4): { DNP3ObjectG21V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 5): { DNP3ObjectG21V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 6): { DNP3ObjectG21V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 7): { DNP3ObjectG21V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 8): { DNP3ObjectG21V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 9): { DNP3ObjectG21V9 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 10): { DNP3ObjectG21V10 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 11): { DNP3ObjectG21V11 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(21, 12): { DNP3ObjectG21V12 *data = point->data; lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 1): { DNP3ObjectG22V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 2): { DNP3ObjectG22V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 3): { DNP3ObjectG22V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 4): { DNP3ObjectG22V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 5): { DNP3ObjectG22V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 6): { DNP3ObjectG22V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 7): { DNP3ObjectG22V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(22, 8): { DNP3ObjectG22V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 1): { DNP3ObjectG23V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 2): { DNP3ObjectG23V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 3): { DNP3ObjectG23V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 4): { DNP3ObjectG23V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 5): { DNP3ObjectG23V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 6): { DNP3ObjectG23V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 7): { DNP3ObjectG23V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(23, 8): { DNP3ObjectG23V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "rollover"); lua_pushinteger(luastate, data->rollover); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "count"); lua_pushinteger(luastate, data->count); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 1): { DNP3ObjectG30V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 2): { DNP3ObjectG30V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 3): { DNP3ObjectG30V3 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 4): { DNP3ObjectG30V4 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 5): { DNP3ObjectG30V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(30, 6): { DNP3ObjectG30V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 1): { DNP3ObjectG31V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 2): { DNP3ObjectG31V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 3): { DNP3ObjectG31V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 4): { DNP3ObjectG31V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 5): { DNP3ObjectG31V5 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 6): { DNP3ObjectG31V6 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 7): { DNP3ObjectG31V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(31, 8): { DNP3ObjectG31V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 1): { DNP3ObjectG32V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 2): { DNP3ObjectG32V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 3): { DNP3ObjectG32V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 4): { DNP3ObjectG32V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 5): { DNP3ObjectG32V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 6): { DNP3ObjectG32V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 7): { DNP3ObjectG32V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(32, 8): { DNP3ObjectG32V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 1): { DNP3ObjectG33V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 2): { DNP3ObjectG33V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 3): { DNP3ObjectG33V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 4): { DNP3ObjectG33V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 5): { DNP3ObjectG33V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 6): { DNP3ObjectG33V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 7): { DNP3ObjectG33V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(33, 8): { DNP3ObjectG33V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(34, 1): { DNP3ObjectG34V1 *data = point->data; lua_pushliteral(luastate, "deadband_value"); lua_pushinteger(luastate, data->deadband_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(34, 2): { DNP3ObjectG34V2 *data = point->data; lua_pushliteral(luastate, "deadband_value"); lua_pushinteger(luastate, data->deadband_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(34, 3): { DNP3ObjectG34V3 *data = point->data; lua_pushliteral(luastate, "deadband_value"); lua_pushnumber(luastate, data->deadband_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(40, 1): { DNP3ObjectG40V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(40, 2): { DNP3ObjectG40V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(40, 3): { DNP3ObjectG40V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(40, 4): { DNP3ObjectG40V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(41, 1): { DNP3ObjectG41V1 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "control_status"); lua_pushinteger(luastate, data->control_status); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(41, 2): { DNP3ObjectG41V2 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "control_status"); lua_pushinteger(luastate, data->control_status); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(41, 3): { DNP3ObjectG41V3 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "control_status"); lua_pushinteger(luastate, data->control_status); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(41, 4): { DNP3ObjectG41V4 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "control_status"); lua_pushinteger(luastate, data->control_status); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 1): { DNP3ObjectG42V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 2): { DNP3ObjectG42V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 3): { DNP3ObjectG42V3 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 4): { DNP3ObjectG42V4 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 5): { DNP3ObjectG42V5 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 6): { DNP3ObjectG42V6 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 7): { DNP3ObjectG42V7 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(42, 8): { DNP3ObjectG42V8 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "over_range"); lua_pushinteger(luastate, data->over_range); lua_settable(luastate, -3); lua_pushliteral(luastate, "reference_err"); lua_pushinteger(luastate, data->reference_err); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "value"); lua_pushnumber(luastate, data->value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 1): { DNP3ObjectG43V1 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushinteger(luastate, data->commanded_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 2): { DNP3ObjectG43V2 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushinteger(luastate, data->commanded_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 3): { DNP3ObjectG43V3 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushinteger(luastate, data->commanded_value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 4): { DNP3ObjectG43V4 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushinteger(luastate, data->commanded_value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 5): { DNP3ObjectG43V5 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushnumber(luastate, data->commanded_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 6): { DNP3ObjectG43V6 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushnumber(luastate, data->commanded_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 7): { DNP3ObjectG43V7 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushnumber(luastate, data->commanded_value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(43, 8): { DNP3ObjectG43V8 *data = point->data; lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "commanded_value"); lua_pushnumber(luastate, data->commanded_value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(50, 1): { DNP3ObjectG50V1 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(50, 2): { DNP3ObjectG50V2 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); lua_pushliteral(luastate, "interval"); lua_pushinteger(luastate, data->interval); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(50, 3): { DNP3ObjectG50V3 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(50, 4): { DNP3ObjectG50V4 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); lua_pushliteral(luastate, "interval_count"); lua_pushinteger(luastate, data->interval_count); lua_settable(luastate, -3); lua_pushliteral(luastate, "interval_units"); lua_pushinteger(luastate, data->interval_units); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(51, 1): { DNP3ObjectG51V1 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(51, 2): { DNP3ObjectG51V2 *data = point->data; lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(52, 1): { DNP3ObjectG52V1 *data = point->data; lua_pushliteral(luastate, "delay_secs"); lua_pushinteger(luastate, data->delay_secs); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(52, 2): { DNP3ObjectG52V2 *data = point->data; lua_pushliteral(luastate, "delay_ms"); lua_pushinteger(luastate, data->delay_ms); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 1): { DNP3ObjectG70V1 *data = point->data; lua_pushliteral(luastate, "filename_size"); lua_pushinteger(luastate, data->filename_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "filetype_code"); lua_pushinteger(luastate, data->filetype_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "attribute_code"); lua_pushinteger(luastate, data->attribute_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "start_record"); lua_pushinteger(luastate, data->start_record); lua_settable(luastate, -3); lua_pushliteral(luastate, "end_record"); lua_pushinteger(luastate, data->end_record); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_size"); lua_pushinteger(luastate, data->file_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "created_timestamp"); lua_pushinteger(luastate, data->created_timestamp); lua_settable(luastate, -3); lua_pushliteral(luastate, "permission"); lua_pushinteger(luastate, data->permission); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_id"); lua_pushinteger(luastate, data->file_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "owner_id"); lua_pushinteger(luastate, data->owner_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "group_id"); lua_pushinteger(luastate, data->group_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_function_code"); lua_pushinteger(luastate, data->file_function_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "filename"); LuaPushStringBuffer(luastate, (uint8_t *)data->filename, strlen(data->filename)); lua_settable(luastate, -3); lua_pushliteral(luastate, "data_size"); lua_pushinteger(luastate, data->data_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "data"); LuaPushStringBuffer(luastate, (uint8_t *)data->data, strlen(data->data)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 2): { DNP3ObjectG70V2 *data = point->data; lua_pushliteral(luastate, "username_offset"); lua_pushinteger(luastate, data->username_offset); lua_settable(luastate, -3); lua_pushliteral(luastate, "username_size"); lua_pushinteger(luastate, data->username_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "password_offset"); lua_pushinteger(luastate, data->password_offset); lua_settable(luastate, -3); lua_pushliteral(luastate, "password_size"); lua_pushinteger(luastate, data->password_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "authentication_key"); lua_pushinteger(luastate, data->authentication_key); lua_settable(luastate, -3); lua_pushliteral(luastate, "username"); LuaPushStringBuffer(luastate, (uint8_t *)data->username, strlen(data->username)); lua_settable(luastate, -3); lua_pushliteral(luastate, "password"); LuaPushStringBuffer(luastate, (uint8_t *)data->password, strlen(data->password)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 3): { DNP3ObjectG70V3 *data = point->data; lua_pushliteral(luastate, "filename_offset"); lua_pushinteger(luastate, data->filename_offset); lua_settable(luastate, -3); lua_pushliteral(luastate, "filename_size"); lua_pushinteger(luastate, data->filename_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "created"); lua_pushinteger(luastate, data->created); lua_settable(luastate, -3); lua_pushliteral(luastate, "permissions"); lua_pushinteger(luastate, data->permissions); lua_settable(luastate, -3); lua_pushliteral(luastate, "authentication_key"); lua_pushinteger(luastate, data->authentication_key); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_size"); lua_pushinteger(luastate, data->file_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "operational_mode"); lua_pushinteger(luastate, data->operational_mode); lua_settable(luastate, -3); lua_pushliteral(luastate, "maximum_block_size"); lua_pushinteger(luastate, data->maximum_block_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "request_id"); lua_pushinteger(luastate, data->request_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "filename"); LuaPushStringBuffer(luastate, (uint8_t *)data->filename, strlen(data->filename)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 4): { DNP3ObjectG70V4 *data = point->data; lua_pushliteral(luastate, "file_handle"); lua_pushinteger(luastate, data->file_handle); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_size"); lua_pushinteger(luastate, data->file_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "maximum_block_size"); lua_pushinteger(luastate, data->maximum_block_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "request_id"); lua_pushinteger(luastate, data->request_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "optional_text"); LuaPushStringBuffer(luastate, (uint8_t *)data->optional_text, strlen(data->optional_text)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 5): { DNP3ObjectG70V5 *data = point->data; lua_pushliteral(luastate, "file_handle"); lua_pushinteger(luastate, data->file_handle); lua_settable(luastate, -3); lua_pushliteral(luastate, "block_number"); lua_pushinteger(luastate, data->block_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_data"); LuaPushStringBuffer(luastate, (uint8_t *)data->file_data, strlen(data->file_data)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 6): { DNP3ObjectG70V6 *data = point->data; lua_pushliteral(luastate, "file_handle"); lua_pushinteger(luastate, data->file_handle); lua_settable(luastate, -3); lua_pushliteral(luastate, "block_number"); lua_pushinteger(luastate, data->block_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "status_code"); lua_pushinteger(luastate, data->status_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "optional_text"); LuaPushStringBuffer(luastate, (uint8_t *)data->optional_text, strlen(data->optional_text)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 7): { DNP3ObjectG70V7 *data = point->data; lua_pushliteral(luastate, "filename_offset"); lua_pushinteger(luastate, data->filename_offset); lua_settable(luastate, -3); lua_pushliteral(luastate, "filename_size"); lua_pushinteger(luastate, data->filename_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_type"); lua_pushinteger(luastate, data->file_type); lua_settable(luastate, -3); lua_pushliteral(luastate, "file_size"); lua_pushinteger(luastate, data->file_size); lua_settable(luastate, -3); lua_pushliteral(luastate, "created_timestamp"); lua_pushinteger(luastate, data->created_timestamp); lua_settable(luastate, -3); lua_pushliteral(luastate, "permissions"); lua_pushinteger(luastate, data->permissions); lua_settable(luastate, -3); lua_pushliteral(luastate, "request_id"); lua_pushinteger(luastate, data->request_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "filename"); LuaPushStringBuffer(luastate, (uint8_t *)data->filename, strlen(data->filename)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(70, 8): { DNP3ObjectG70V8 *data = point->data; lua_pushliteral(luastate, "file_specification"); LuaPushStringBuffer(luastate, (uint8_t *)data->file_specification, strlen(data->file_specification)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(80, 1): { DNP3ObjectG80V1 *data = point->data; lua_pushliteral(luastate, "state"); lua_pushinteger(luastate, data->state); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(81, 1): { DNP3ObjectG81V1 *data = point->data; lua_pushliteral(luastate, "fill_percentage"); lua_pushinteger(luastate, data->fill_percentage); lua_settable(luastate, -3); lua_pushliteral(luastate, "overflow_state"); lua_pushinteger(luastate, data->overflow_state); lua_settable(luastate, -3); lua_pushliteral(luastate, "group"); lua_pushinteger(luastate, data->group); lua_settable(luastate, -3); lua_pushliteral(luastate, "variation"); lua_pushinteger(luastate, data->variation); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(83, 1): { DNP3ObjectG83V1 *data = point->data; lua_pushliteral(luastate, "vendor_code"); LuaPushStringBuffer(luastate, (uint8_t *)data->vendor_code, strlen(data->vendor_code)); lua_settable(luastate, -3); lua_pushliteral(luastate, "object_id"); lua_pushinteger(luastate, data->object_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "length"); lua_pushinteger(luastate, data->length); lua_settable(luastate, -3); lua_pushliteral(luastate, "data_objects"); lua_pushlstring(luastate, (const char *)data->data_objects, data->length); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(86, 2): { DNP3ObjectG86V2 *data = point->data; lua_pushliteral(luastate, "rd"); lua_pushinteger(luastate, data->rd); lua_settable(luastate, -3); lua_pushliteral(luastate, "wr"); lua_pushinteger(luastate, data->wr); lua_settable(luastate, -3); lua_pushliteral(luastate, "st"); lua_pushinteger(luastate, data->st); lua_settable(luastate, -3); lua_pushliteral(luastate, "ev"); lua_pushinteger(luastate, data->ev); lua_settable(luastate, -3); lua_pushliteral(luastate, "df"); lua_pushinteger(luastate, data->df); lua_settable(luastate, -3); lua_pushliteral(luastate, "padding0"); lua_pushinteger(luastate, data->padding0); lua_settable(luastate, -3); lua_pushliteral(luastate, "padding1"); lua_pushinteger(luastate, data->padding1); lua_settable(luastate, -3); lua_pushliteral(luastate, "padding2"); lua_pushinteger(luastate, data->padding2); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(102, 1): { DNP3ObjectG102V1 *data = point->data; lua_pushliteral(luastate, "value"); lua_pushinteger(luastate, data->value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 1): { DNP3ObjectG120V1 *data = point->data; lua_pushliteral(luastate, "csq"); lua_pushinteger(luastate, data->csq); lua_settable(luastate, -3); lua_pushliteral(luastate, "usr"); lua_pushinteger(luastate, data->usr); lua_settable(luastate, -3); lua_pushliteral(luastate, "mal"); lua_pushinteger(luastate, data->mal); lua_settable(luastate, -3); lua_pushliteral(luastate, "reason"); lua_pushinteger(luastate, data->reason); lua_settable(luastate, -3); lua_pushliteral(luastate, "challenge_data"); lua_pushlstring(luastate, (const char *)data->challenge_data, data->challenge_data_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 2): { DNP3ObjectG120V2 *data = point->data; lua_pushliteral(luastate, "csq"); lua_pushinteger(luastate, data->csq); lua_settable(luastate, -3); lua_pushliteral(luastate, "usr"); lua_pushinteger(luastate, data->usr); lua_settable(luastate, -3); lua_pushliteral(luastate, "mac_value"); lua_pushlstring(luastate, (const char *)data->mac_value, data->mac_value_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 3): { DNP3ObjectG120V3 *data = point->data; lua_pushliteral(luastate, "csq"); lua_pushinteger(luastate, data->csq); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_number"); lua_pushinteger(luastate, data->user_number); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 4): { DNP3ObjectG120V4 *data = point->data; lua_pushliteral(luastate, "user_number"); lua_pushinteger(luastate, data->user_number); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 5): { DNP3ObjectG120V5 *data = point->data; lua_pushliteral(luastate, "ksq"); lua_pushinteger(luastate, data->ksq); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_number"); lua_pushinteger(luastate, data->user_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "key_wrap_alg"); lua_pushinteger(luastate, data->key_wrap_alg); lua_settable(luastate, -3); lua_pushliteral(luastate, "key_status"); lua_pushinteger(luastate, data->key_status); lua_settable(luastate, -3); lua_pushliteral(luastate, "mal"); lua_pushinteger(luastate, data->mal); lua_settable(luastate, -3); lua_pushliteral(luastate, "challenge_data_len"); lua_pushinteger(luastate, data->challenge_data_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "challenge_data"); lua_pushlstring(luastate, (const char *)data->challenge_data, data->challenge_data_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "mac_value"); lua_pushlstring(luastate, (const char *)data->mac_value, data->mac_value_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 6): { DNP3ObjectG120V6 *data = point->data; lua_pushliteral(luastate, "ksq"); lua_pushinteger(luastate, data->ksq); lua_settable(luastate, -3); lua_pushliteral(luastate, "usr"); lua_pushinteger(luastate, data->usr); lua_settable(luastate, -3); lua_pushliteral(luastate, "wrapped_key_data"); lua_pushlstring(luastate, (const char *)data->wrapped_key_data, data->wrapped_key_data_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 7): { DNP3ObjectG120V7 *data = point->data; lua_pushliteral(luastate, "sequence_number"); lua_pushinteger(luastate, data->sequence_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "usr"); lua_pushinteger(luastate, data->usr); lua_settable(luastate, -3); lua_pushliteral(luastate, "association_id"); lua_pushinteger(luastate, data->association_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "error_code"); lua_pushinteger(luastate, data->error_code); lua_settable(luastate, -3); lua_pushliteral(luastate, "time_of_error"); lua_pushinteger(luastate, data->time_of_error); lua_settable(luastate, -3); lua_pushliteral(luastate, "error_text"); LuaPushStringBuffer(luastate, (uint8_t *)data->error_text, strlen(data->error_text)); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 8): { DNP3ObjectG120V8 *data = point->data; lua_pushliteral(luastate, "key_change_method"); lua_pushinteger(luastate, data->key_change_method); lua_settable(luastate, -3); lua_pushliteral(luastate, "certificate_type"); lua_pushinteger(luastate, data->certificate_type); lua_settable(luastate, -3); lua_pushliteral(luastate, "certificate"); lua_pushlstring(luastate, (const char *)data->certificate, data->certificate_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 9): { DNP3ObjectG120V9 *data = point->data; lua_pushliteral(luastate, "mac_value"); lua_pushlstring(luastate, (const char *)data->mac_value, data->mac_value_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 10): { DNP3ObjectG120V10 *data = point->data; lua_pushliteral(luastate, "key_change_method"); lua_pushinteger(luastate, data->key_change_method); lua_settable(luastate, -3); lua_pushliteral(luastate, "operation"); lua_pushinteger(luastate, data->operation); lua_settable(luastate, -3); lua_pushliteral(luastate, "scs"); lua_pushinteger(luastate, data->scs); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_role"); lua_pushinteger(luastate, data->user_role); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_role_expiry_interval"); lua_pushinteger(luastate, data->user_role_expiry_interval); lua_settable(luastate, -3); lua_pushliteral(luastate, "username_len"); lua_pushinteger(luastate, data->username_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_public_key_len"); lua_pushinteger(luastate, data->user_public_key_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "certification_data_len"); lua_pushinteger(luastate, data->certification_data_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "username"); LuaPushStringBuffer(luastate, (uint8_t *)data->username, strlen(data->username)); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_public_key"); lua_pushlstring(luastate, (const char *)data->user_public_key, data->user_public_key_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "certification_data"); lua_pushlstring(luastate, (const char *)data->certification_data, data->certification_data_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 11): { DNP3ObjectG120V11 *data = point->data; lua_pushliteral(luastate, "key_change_method"); lua_pushinteger(luastate, data->key_change_method); lua_settable(luastate, -3); lua_pushliteral(luastate, "username_len"); lua_pushinteger(luastate, data->username_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "master_challenge_data_len"); lua_pushinteger(luastate, data->master_challenge_data_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "username"); LuaPushStringBuffer(luastate, (uint8_t *)data->username, strlen(data->username)); lua_settable(luastate, -3); lua_pushliteral(luastate, "master_challenge_data"); lua_pushlstring(luastate, (const char *)data->master_challenge_data, data->master_challenge_data_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 12): { DNP3ObjectG120V12 *data = point->data; lua_pushliteral(luastate, "ksq"); lua_pushinteger(luastate, data->ksq); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_number"); lua_pushinteger(luastate, data->user_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "challenge_data_len"); lua_pushinteger(luastate, data->challenge_data_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "challenge_data"); lua_pushlstring(luastate, (const char *)data->challenge_data, data->challenge_data_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 13): { DNP3ObjectG120V13 *data = point->data; lua_pushliteral(luastate, "ksq"); lua_pushinteger(luastate, data->ksq); lua_settable(luastate, -3); lua_pushliteral(luastate, "user_number"); lua_pushinteger(luastate, data->user_number); lua_settable(luastate, -3); lua_pushliteral(luastate, "encrypted_update_key_len"); lua_pushinteger(luastate, data->encrypted_update_key_len); lua_settable(luastate, -3); lua_pushliteral(luastate, "encrypted_update_key_data"); lua_pushlstring(luastate, (const char *)data->encrypted_update_key_data, data->encrypted_update_key_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 14): { DNP3ObjectG120V14 *data = point->data; lua_pushliteral(luastate, "digital_signature"); lua_pushlstring(luastate, (const char *)data->digital_signature, data->digital_signature_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(120, 15): { DNP3ObjectG120V15 *data = point->data; lua_pushliteral(luastate, "mac"); lua_pushlstring(luastate, (const char *)data->mac, data->mac_len); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(121, 1): { DNP3ObjectG121V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "association_id"); lua_pushinteger(luastate, data->association_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "count_value"); lua_pushinteger(luastate, data->count_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(122, 1): { DNP3ObjectG122V1 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "association_id"); lua_pushinteger(luastate, data->association_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "count_value"); lua_pushinteger(luastate, data->count_value); lua_settable(luastate, -3); break; } case DNP3_OBJECT_CODE(122, 2): { DNP3ObjectG122V2 *data = point->data; lua_pushliteral(luastate, "online"); lua_pushinteger(luastate, data->online); lua_settable(luastate, -3); lua_pushliteral(luastate, "restart"); lua_pushinteger(luastate, data->restart); lua_settable(luastate, -3); lua_pushliteral(luastate, "comm_lost"); lua_pushinteger(luastate, data->comm_lost); lua_settable(luastate, -3); lua_pushliteral(luastate, "remote_forced"); lua_pushinteger(luastate, data->remote_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "local_forced"); lua_pushinteger(luastate, data->local_forced); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved0"); lua_pushinteger(luastate, data->reserved0); lua_settable(luastate, -3); lua_pushliteral(luastate, "discontinuity"); lua_pushinteger(luastate, data->discontinuity); lua_settable(luastate, -3); lua_pushliteral(luastate, "reserved1"); lua_pushinteger(luastate, data->reserved1); lua_settable(luastate, -3); lua_pushliteral(luastate, "association_id"); lua_pushinteger(luastate, data->association_id); lua_settable(luastate, -3); lua_pushliteral(luastate, "count_value"); lua_pushinteger(luastate, data->count_value); lua_settable(luastate, -3); lua_pushliteral(luastate, "timestamp"); lua_pushinteger(luastate, data->timestamp); lua_settable(luastate, -3); break; } default: break; } } #endif /* HAVE_LUA */ suricata-3.2.1/src/util-profiling-locks.h0000644000000000000000000000223213051004444015226 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_PROFILE_LOCKS_H__ #define __UTIL_PROFILE_LOCKS_H__ #ifdef PROFILING #define PROFILING_MAX_LOCKS 64 enum { LOCK_MUTEX, LOCK_SPIN, LOCK_RWW, /**< rwlock, writer */ LOCK_RWR, /**< rwlock, reader */ }; void SCProfilingAddPacketLocks(void *); int LockRecordInitHash(); void LockRecordFreeHash(); #endif /* PROFILING */ #endif /* __UTIL_PROFILE_LOCKS_H__ */ suricata-3.2.1/src/detect-itype.c0000644000000000000000000004126213051004444013552 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Gerardo Iglesias * * Implements itype keyword support */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" #include "detect-itype.h" #include "util-byte.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-debug.h" /** *\brief Regex for parsing our itype options */ #define PARSE_REGEX "^\\s*(<|>)?\\s*([0-9]+)\\s*(?:<>\\s*([0-9]+))?\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; int DetectITypeMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); static int DetectITypeSetup(DetectEngineCtx *, Signature *, char *); void DetectITypeRegisterTests(void); void DetectITypeFree(void *); static int PrefilterSetupIType(SigGroupHead *sgh); static _Bool PrefilterITypeIsPrefilterable(const Signature *s); /** * \brief Registration function for itype: keyword */ void DetectITypeRegister (void) { sigmatch_table[DETECT_ITYPE].name = "itype"; sigmatch_table[DETECT_ITYPE].desc = "matching on a specific ICMP type"; sigmatch_table[DETECT_ITYPE].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#itype"; sigmatch_table[DETECT_ITYPE].Match = DetectITypeMatch; sigmatch_table[DETECT_ITYPE].Setup = DetectITypeSetup; sigmatch_table[DETECT_ITYPE].Free = DetectITypeFree; sigmatch_table[DETECT_ITYPE].RegisterTests = DetectITypeRegisterTests; sigmatch_table[DETECT_ITYPE].SupportsPrefilter = PrefilterITypeIsPrefilterable; sigmatch_table[DETECT_ITYPE].SetupPrefilter = PrefilterSetupIType; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } #define DETECT_ITYPE_EQ PREFILTER_U8HASH_MODE_EQ /**< "equal" operator */ #define DETECT_ITYPE_LT PREFILTER_U8HASH_MODE_LT /**< "less than" operator */ #define DETECT_ITYPE_GT PREFILTER_U8HASH_MODE_GT /**< "greater than" operator */ #define DETECT_ITYPE_RN PREFILTER_U8HASH_MODE_RA /**< "range" operator */ typedef struct DetectITypeData_ { uint8_t type1; uint8_t type2; uint8_t mode; } DetectITypeData; static inline int ITypeMatch(const uint8_t ptype, const uint8_t mode, const uint8_t dtype1, const uint8_t dtype2) { switch (mode) { case DETECT_ITYPE_EQ: return (ptype == dtype1) ? 1 : 0; case DETECT_ITYPE_LT: return (ptype < dtype1) ? 1 : 0; case DETECT_ITYPE_GT: return (ptype > dtype1) ? 1 : 0; case DETECT_ITYPE_RN: return (ptype > dtype1 && ptype < dtype2) ? 1 : 0; } return 0; } /** * \brief This function is used to match itype rule option set on a packet with those passed via itype: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet * \param m pointer to the sigmatch that we will cast into DetectITypeData * * \retval 0 no match * \retval 1 match */ int DetectITypeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { if (PKT_IS_PSEUDOPKT(p)) return 0; uint8_t pitype; if (PKT_IS_ICMPV4(p)) { pitype = ICMPV4_GET_TYPE(p); } else if (PKT_IS_ICMPV6(p)) { pitype = ICMPV6_GET_TYPE(p); } else { /* Packet not ICMPv4 nor ICMPv6 */ return 0; } const DetectITypeData *itd = (const DetectITypeData *)ctx; return ITypeMatch(pitype, itd->mode, itd->type1, itd->type2); } /** * \brief This function is used to parse itype options passed via itype: keyword * * \param itypestr Pointer to the user provided itype options * * \retval itd pointer to DetectITypeData on success * \retval NULL on failure */ DetectITypeData *DetectITypeParse(char *itypestr) { DetectITypeData *itd = NULL; char *args[3] = {NULL, NULL, NULL}; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; ret = pcre_exec(parse_regex, parse_regex_study, itypestr, strlen(itypestr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1 || ret > 4) { SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, itypestr); goto error; } int i; const char *str_ptr; for (i = 1; i < ret; i++) { res = pcre_get_substring((char *)itypestr, ov, MAX_SUBSTRINGS, i, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); goto error; } args[i-1] = (char *)str_ptr; } itd = SCMalloc(sizeof(DetectITypeData)); if (unlikely(itd == NULL)) goto error; itd->type1 = 0; itd->type2 = 0; itd->mode = 0; /* we have either "<" or ">" */ if (args[0] != NULL && strlen(args[0]) != 0) { /* we have a third part ("<> y"), therefore it's invalid */ if (args[2] != NULL) { SCLogError(SC_ERR_INVALID_VALUE, "itype: invalid value"); goto error; } /* we have only a comparison ("<", ">") */ if (ByteExtractStringUint8(&itd->type1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp type %s is not " "valid", args[1]); goto error; } if ((strcmp(args[0], ">")) == 0) itd->mode = DETECT_ITYPE_GT; else itd->mode = DETECT_ITYPE_LT; } else { /* no "<", ">" */ /* we have a range ("<>") */ if (args[2] != NULL) { itd->mode = (uint8_t) DETECT_ITYPE_RN; if (ByteExtractStringUint8(&itd->type1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp type %s is not " "valid", args[1]); goto error; } if (ByteExtractStringUint8(&itd->type2, 10, 0, args[2]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp type %s is not " "valid", args[2]); goto error; } /* we check that the first given value in the range is less than the second, otherwise we swap them */ if (itd->type1 > itd->type2) { uint8_t temp = itd->type1; itd->type1 = itd->type2; itd->type2 = temp; } } else { /* we have an equality */ itd->mode = DETECT_ITYPE_EQ; if (ByteExtractStringUint8(&itd->type1, 10, 0, args[1]) < 0) { SCLogError(SC_ERR_INVALID_ARGUMENT, "specified icmp type %s is not " "valid", args[1]); goto error; } } } for (i = 0; i < (ret-1); i++) { if (args[i] != NULL) SCFree(args[i]); } return itd; error: for (i = 0; i < (ret-1) && i < 3; i++) { if (args[i] != NULL) SCFree(args[i]); } if (itd != NULL) DetectITypeFree(itd); return NULL; } /** * \brief this function is used to add the parsed itype data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param itypestr pointer to the user provided itype options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectITypeSetup(DetectEngineCtx *de_ctx, Signature *s, char *itypestr) { DetectITypeData *itd = NULL; SigMatch *sm = NULL; itd = DetectITypeParse(itypestr); if (itd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ITYPE; sm->ctx = (SigMatchCtx *)itd; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); s->flags |= SIG_FLAG_REQUIRE_PACKET; return 0; error: if (itd != NULL) DetectITypeFree(itd); if (sm != NULL) SCFree(sm); return -1; } /** * \brief this function will free memory associated with DetectITypeData * * \param ptr pointer to DetectITypeData */ void DetectITypeFree(void *ptr) { DetectITypeData *itd = (DetectITypeData *)ptr; SCFree(itd); } /* prefilter code * * Prefilter uses the U8Hash logic, where we setup a 256 entry array * for each ICMP type. Each array element has the list of signatures * that need to be inspected. */ static void PrefilterPacketITypeMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { if (PKT_IS_PSEUDOPKT(p)) { SCReturn; } uint8_t pitype; if (PKT_IS_ICMPV4(p)) { pitype = ICMPV4_GET_TYPE(p); } else if (PKT_IS_ICMPV6(p)) { pitype = ICMPV6_GET_TYPE(p); } else { /* Packet not ICMPv4 nor ICMPv6 */ return; } const PrefilterPacketU8HashCtx *h = pectx; const SigsArray *sa = h->array[pitype]; if (sa) { PrefilterAddSids(&det_ctx->pmq, sa->sigs, sa->cnt); } } static void PrefilterPacketITypeSet(PrefilterPacketHeaderValue *v, void *smctx) { const DetectITypeData *a = smctx; v->u8[0] = a->mode; v->u8[1] = a->type1; v->u8[2] = a->type2; } static _Bool PrefilterPacketITypeCompare(PrefilterPacketHeaderValue v, void *smctx) { const DetectITypeData *a = smctx; if (v.u8[0] == a->mode && v.u8[1] == a->type1 && v.u8[2] == a->type2) return TRUE; return FALSE; } static int PrefilterSetupIType(SigGroupHead *sgh) { return PrefilterSetupPacketHeaderU8Hash(sgh, DETECT_ITYPE, PrefilterPacketITypeSet, PrefilterPacketITypeCompare, PrefilterPacketITypeMatch); } static _Bool PrefilterITypeIsPrefilterable(const Signature *s) { const SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) { switch (sm->type) { case DETECT_ITYPE: return TRUE; } } return FALSE; } #ifdef UNITTESTS #include "detect-engine.h" #include "detect-engine-mpm.h" /** * \test DetectITypeParseTest01 is a test for setting a valid itype value */ int DetectITypeParseTest01(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse("8"); if (itd != NULL) { if (itd->type1 == 8 && itd->mode == DETECT_ITYPE_EQ) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest02 is a test for setting a valid itype value * with ">" operator */ int DetectITypeParseTest02(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse(">8"); if (itd != NULL) { if (itd->type1 == 8 && itd->mode == DETECT_ITYPE_GT) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest03 is a test for setting a valid itype value * with "<" operator */ int DetectITypeParseTest03(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse("<8"); if (itd != NULL) { if (itd->type1 == 8 && itd->mode == DETECT_ITYPE_LT) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest04 is a test for setting a valid itype value * with "<>" operator */ int DetectITypeParseTest04(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse("8<>20"); if (itd != NULL) { if (itd->type1 == 8 && itd->type2 == 20 && itd->mode == DETECT_ITYPE_RN) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest05 is a test for setting a valid itype value * with spaces all around */ int DetectITypeParseTest05(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse(" 8 "); if (itd != NULL) { if (itd->type1 == 8 && itd->mode == DETECT_ITYPE_EQ) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest06 is a test for setting a valid itype value * with ">" operator and spaces all around */ int DetectITypeParseTest06(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse(" > 8 "); if (itd != NULL) { if (itd->type1 == 8 && itd->mode == DETECT_ITYPE_GT) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest07 is a test for setting a valid itype value * with "<>" operator and spaces all around */ int DetectITypeParseTest07(void) { DetectITypeData *itd = NULL; int result = 0; itd = DetectITypeParse(" 8 <> 20 "); if (itd != NULL) { if (itd->type1 == 8 && itd->type2 == 20 && itd->mode == DETECT_ITYPE_RN) result = 1; DetectITypeFree(itd); } return result; } /** * \test DetectITypeParseTest08 is a test for setting an invalid itype value */ int DetectITypeParseTest08(void) { DetectITypeData *itd = NULL; itd = DetectITypeParse("> 8 <> 20"); if (itd == NULL) return 1; DetectITypeFree(itd); return 0; } /** * \test DetectITypeMatchTest01 is a test for checking the working of itype * keyword by creating 5 rules and matching a crafted packet against * them. 4 out of 5 rules shall trigger. */ int DetectITypeMatchTest01(void) { Packet *p = NULL; Signature *s = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; int result = 0; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP); p->icmpv4h->type = 10; DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { goto end; } de_ctx->flags |= DE_QUIET; s = de_ctx->sig_list = SigInit(de_ctx,"alert icmp any any -> any any (itype:10; sid:1;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (itype:<15; sid:2;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (itype:>20; sid:3;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (itype:8<>20; sid:4;)"); if (s == NULL) { goto end; } s = s->next = SigInit(de_ctx,"alert icmp any any -> any any (itype:20<>8; sid:5;)"); if (s == NULL) { goto end; } SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1) == 0) { SCLogDebug("sid 1 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 2) == 0) { SCLogDebug("sid 2 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 3)) { SCLogDebug("sid 3 alerted, but should not have"); goto cleanup; } else if (PacketAlertCheck(p, 4) == 0) { SCLogDebug("sid 4 did not alert, but should have"); goto cleanup; } else if (PacketAlertCheck(p, 5) == 0) { SCLogDebug("sid 5 did not alert, but should have"); goto cleanup; } result = 1; cleanup: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectIType */ void DetectITypeRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectITypeParseTest01", DetectITypeParseTest01); UtRegisterTest("DetectITypeParseTest02", DetectITypeParseTest02); UtRegisterTest("DetectITypeParseTest03", DetectITypeParseTest03); UtRegisterTest("DetectITypeParseTest04", DetectITypeParseTest04); UtRegisterTest("DetectITypeParseTest05", DetectITypeParseTest05); UtRegisterTest("DetectITypeParseTest06", DetectITypeParseTest06); UtRegisterTest("DetectITypeParseTest07", DetectITypeParseTest07); UtRegisterTest("DetectITypeParseTest08", DetectITypeParseTest08); UtRegisterTest("DetectITypeMatchTest01", DetectITypeMatchTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-engine-hscd.h0000644000000000000000000000260513051004444014607 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_HSCD_H__ #define __DETECT_ENGINE_HSCD_H__ #include "app-layer-htp.h" int PrefilterTxHttpStatCodeRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpStatCode(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); void DetectEngineHttpStatCodeRegisterTests(void); #endif /* __DETECT_ENGINE_HSCD_H__ */ suricata-3.2.1/src/app-layer-htp-libhtp.h0000644000000000000000000000425013051004444015116 00000000000000/* * We are using this file to hold APIs copied from libhtp 0.5.x. */ /*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * Anoop Saldanha */ #ifndef __APP_LAYER_HTP_LIBHTP__H__ #define __APP_LAYER_HTP_LIBHTP__H__ #include "suricata.h" #include "suricata-common.h" bstr *SCHTPGenerateNormalizedUri(htp_tx_t *tx, htp_uri_t *uri, int uri_include_all); int64_t SC_htp_parse_content_length(bstr *b); #endif /* __APP_LAYER_HTP_LIBHTP__H__ */ suricata-3.2.1/src/detect-cipservice.c0000644000000000000000000003154313051004444014555 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kevin Wong * * Set up ENIP Commnad and CIP Service rule parsing and entry point for matching */ #include "suricata-common.h" #include "util-unittest.h" #include "detect-parse.h" #include "detect-engine.h" #include "util-byte.h" #include "detect-cipservice.h" #include "detect-engine-enip.h" /* * CIP SERVICE CODE */ /** * \brief CIP Service Detect Prototypes */ static int DetectCipServiceSetup(DetectEngineCtx *, Signature *, char *); static void DetectCipServiceFree(void *); static void DetectCipServiceRegisterTests(void); /** * \brief Registration function for cip_service: keyword */ void DetectCipServiceRegister(void) { SCEnter(); sigmatch_table[DETECT_CIPSERVICE].name = "cip_service"; //rule keyword sigmatch_table[DETECT_CIPSERVICE].desc = "Rules for detecting CIP Service "; sigmatch_table[DETECT_CIPSERVICE].Match = NULL; sigmatch_table[DETECT_CIPSERVICE].AppLayerMatch = NULL; sigmatch_table[DETECT_CIPSERVICE].Setup = DetectCipServiceSetup; sigmatch_table[DETECT_CIPSERVICE].Free = DetectCipServiceFree; sigmatch_table[DETECT_CIPSERVICE].RegisterTests = DetectCipServiceRegisterTests; DetectAppLayerInspectEngineRegister(ALPROTO_ENIP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_CIP_MATCH, DetectEngineInspectCIP); DetectAppLayerInspectEngineRegister(ALPROTO_ENIP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_CIP_MATCH, DetectEngineInspectCIP); SCReturn; } /** * \brief This function is used to parse cip_service options passed via cip_service: keyword * * \param rulestr Pointer to the user provided rulestr options * Takes comma seperated string with numeric tokens. Only first 3 are used * * \retval cipserviced pointer to DetectCipServiceData on success * \retval NULL on failure */ static DetectCipServiceData *DetectCipServiceParse(const char *rulestrc) { const char delims[] = ","; DetectCipServiceData *cipserviced = NULL; //SCLogDebug("DetectCipServiceParse - rule string %s", rulestr); /* strtok_r modifies the string so work with a copy */ char *rulestr = SCStrdup(rulestrc); if (unlikely(rulestr == NULL)) goto error; cipserviced = SCMalloc(sizeof(DetectCipServiceData)); if (unlikely(cipserviced == NULL)) goto error; cipserviced->cipservice = 0; cipserviced->cipclass = 0; cipserviced->matchattribute = 1; cipserviced->cipattribute = 0; char* token; char *save; int var; int input[3] = { 0, 0, 0 }; int i = 0; token = strtok_r(rulestr, delims, &save); while (token != NULL) { if (i > 2) //for now only need 3 parameters { SCLogError(SC_ERR_INVALID_SIGNATURE, "too many parameters"); goto error; } if (i < 2) //if on service or class { if (!isdigit((int) *token)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "parameter error %s", token); goto error; } } else //if on attribute { if (token[0] == '!') { cipserviced->matchattribute = 0; token++; } if (!isdigit((int) *token)) { SCLogError(SC_ERR_INVALID_SIGNATURE, "attribute error %s", token); goto error; } } unsigned long num = atol(token); if ((num > MAX_CIP_SERVICE) && (i == 0))//if service greater than 7 bit { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid CIP service %lu", num); goto error; } else if ((num > MAX_CIP_CLASS) && (i == 1))//if service greater than 16 bit { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid CIP class %lu", num); goto error; } else if ((num > MAX_CIP_ATTRIBUTE) && (i == 2))//if service greater than 16 bit { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid CIP attribute %lu", num); goto error; } sscanf(token, "%d", &var); input[i++] = var; token = strtok_r(NULL, delims, &save); } if (i == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "no tokens found"); goto error; } cipserviced->cipservice = input[0]; cipserviced->cipclass = input[1]; cipserviced->cipattribute = input[2]; cipserviced->tokens = i; SCLogDebug("DetectCipServiceParse - tokens %d", cipserviced->tokens); SCLogDebug("DetectCipServiceParse - service %d", cipserviced->cipservice); SCLogDebug("DetectCipServiceParse - class %d", cipserviced->cipclass); SCLogDebug("DetectCipServiceParse - match attribute %d", cipserviced->matchattribute); SCLogDebug("DetectCipServiceParse - attribute %d", cipserviced->cipattribute); SCFree(rulestr); SCReturnPtr(cipserviced, "DetectENIPFunction"); error: if (cipserviced) SCFree(cipserviced); if (rulestr) SCFree(rulestr); SCReturnPtr(NULL, "DetectENIP"); } /** * \brief this function is used to a cipserviced the parsed cip_service data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rulestr pointer to the user provided cip_service options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectCipServiceSetup(DetectEngineCtx *de_ctx, Signature *s, char *rulestr) { SCEnter(); DetectCipServiceData *cipserviced = NULL; SigMatch *sm = NULL; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_ENIP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } cipserviced = DetectCipServiceParse(rulestr); if (cipserviced == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_CIPSERVICE; sm->ctx = (void *) cipserviced; s->alproto = ALPROTO_ENIP; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_CIP_MATCH); SCReturnInt(0); error: if (cipserviced != NULL) DetectCipServiceFree(cipserviced); if (sm != NULL) SCFree(sm); SCReturnInt(-1); } /** * \brief this function will free memory associated with DetectCipServiceData * * \param ptr pointer to DetectCipServiceData */ void DetectCipServiceFree(void *ptr) { DetectCipServiceData *cipserviced = (DetectCipServiceData *) ptr; SCFree(cipserviced); } #ifdef UNITTESTS /** * \test Test CIP Command parameter parsing */ static int DetectCipServiceParseTest01 (void) { DetectCipServiceData *cipserviced = NULL; cipserviced = DetectCipServiceParse("7"); FAIL_IF_NULL(cipserviced); FAIL_IF(cipserviced->cipservice != 7); DetectCipServiceFree(cipserviced); PASS; } /** * \test Test CIP Service signature */ static int DetectCipServiceSignatureTest01 (void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); Signature *sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (cip_service:1; sid:1; rev:1;)"); FAIL_IF_NULL(sig); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectCipService */ void DetectCipServiceRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectCipServiceParseTest01", DetectCipServiceParseTest01); UtRegisterTest("DetectCipServiceSignatureTest01", DetectCipServiceSignatureTest01); #endif /* UNITTESTS */ } /* * ENIP COMMAND CODE */ /** * \brief ENIP Commond Detect Prototypes */ static int DetectEnipCommandSetup(DetectEngineCtx *, Signature *, char *); static void DetectEnipCommandFree(void *); static void DetectEnipCommandRegisterTests(void); /** * \brief Registration function for enip_command: keyword */ void DetectEnipCommandRegister(void) { sigmatch_table[DETECT_ENIPCOMMAND].name = "enip_command"; //rule keyword sigmatch_table[DETECT_ENIPCOMMAND].desc = "Rules for detecting EtherNet/IP command"; sigmatch_table[DETECT_ENIPCOMMAND].Match = NULL; sigmatch_table[DETECT_ENIPCOMMAND].AppLayerMatch = NULL; sigmatch_table[DETECT_ENIPCOMMAND].Setup = DetectEnipCommandSetup; sigmatch_table[DETECT_ENIPCOMMAND].Free = DetectEnipCommandFree; sigmatch_table[DETECT_ENIPCOMMAND].RegisterTests = DetectEnipCommandRegisterTests; DetectAppLayerInspectEngineRegister(ALPROTO_ENIP, SIG_FLAG_TOSERVER, DETECT_SM_LIST_ENIP_MATCH, DetectEngineInspectENIP); DetectAppLayerInspectEngineRegister(ALPROTO_ENIP, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_ENIP_MATCH, DetectEngineInspectENIP); } /** * \brief This function is used to parse cip_service options passed via enip_command: keyword * * \param rulestr Pointer to the user provided rulestr options * Takes single single numeric value * * \retval enipcmdd pointer to DetectCipServiceData on success * \retval NULL on failure */ static DetectEnipCommandData *DetectEnipCommandParse(const char *rulestr) { DetectEnipCommandData *enipcmdd = NULL; enipcmdd = SCMalloc(sizeof(DetectEnipCommandData)); if (unlikely(enipcmdd == NULL)) goto error; if (!(isdigit((int) *rulestr))) { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid ENIP command %s", rulestr); goto error; } unsigned long cmd = atol(rulestr); if (cmd > MAX_ENIP_CMD) //if command greater than 16 bit { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid ENIP command %lu", cmd); goto error; } enipcmdd->enipcommand = (uint16_t) atoi(rulestr); return enipcmdd; error: if (enipcmdd) SCFree(enipcmdd); return NULL; } /** * \brief this function is used by enipcmdd to parse enip_command data into the current signature * * \param de_ctx pointer to the Detection Engine Context * \param s pointer to the Current Signature * \param rulestr pointer to the user provided enip command options * * \retval 0 on Success * \retval -1 on Failure */ static int DetectEnipCommandSetup(DetectEngineCtx *de_ctx, Signature *s, char *rulestr) { DetectEnipCommandData *enipcmdd = NULL; SigMatch *sm = NULL; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_ENIP) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); goto error; } enipcmdd = DetectEnipCommandParse(rulestr); if (enipcmdd == NULL) goto error; sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_ENIPCOMMAND; sm->ctx = (void *) enipcmdd; s->alproto = ALPROTO_ENIP; SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_ENIP_MATCH); SCReturnInt(0); error: if (enipcmdd != NULL) DetectEnipCommandFree(enipcmdd); if (sm != NULL) SCFree(sm); SCReturnInt(-1); } /** * \brief this function will free memory associated with DetectEnipCommandData * * \param ptr pointer to DetectEnipCommandData */ void DetectEnipCommandFree(void *ptr) { DetectEnipCommandData *enipcmdd = (DetectEnipCommandData *) ptr; SCFree(enipcmdd); } #ifdef UNITTESTS /** * \test ENIP parameter test */ static int DetectEnipCommandParseTest01 (void) { DetectEnipCommandData *enipcmdd = NULL; enipcmdd = DetectEnipCommandParse("1"); FAIL_IF_NULL(enipcmdd); FAIL_IF_NOT(enipcmdd->enipcommand == 1); DetectEnipCommandFree(enipcmdd); PASS; } /** * \test ENIP Command signature test */ static int DetectEnipCommandSignatureTest01 (void) { DetectEngineCtx *de_ctx = DetectEngineCtxInit(); FAIL_IF_NULL(de_ctx); Signature *sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (enip_command:1; sid:1; rev:1;)"); FAIL_IF_NULL(sig); DetectEngineCtxFree(de_ctx); PASS; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectEnipCommand */ void DetectEnipCommandRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEnipCommandParseTest01", DetectEnipCommandParseTest01); UtRegisterTest("DetectEnipCommandSignatureTest01", DetectEnipCommandSignatureTest01); #endif /* UNITTESTS */ } suricata-3.2.1/src/util-random.h0000644000000000000000000000162513051004444013411 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon */ #ifndef __UTIL_RANDOM_H__ #define __UTIL_RANDOM_H__ unsigned int RandomTimePreseed(void); #endif /* __UTIL_RANDOM_H__ */ suricata-3.2.1/src/util-base64.c0000644000000000000000000001077613051004444013217 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author David Abarbanel * */ #include "util-base64.h" /* Constants */ #define BASE64_TABLE_MAX 122 /* Base64 character to index conversion table */ /* Characters are mapped as "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" */ static const int b64table[] = { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51 }; /** * \brief Gets a base64-decoded value from an encoded character * * \param c The encoded character * * \return The decoded value (0 or above), or -1 if the parameter is invalid */ static inline int GetBase64Value(uint8_t c) { int val = -1; /* Pull from conversion table */ if (c <= BASE64_TABLE_MAX) { val = b64table[(int) c]; } return val; } /** * \brief Decodes a 4-byte base64-encoded block into a 3-byte ascii-encoded block * * \param ascii the 3-byte ascii output block * \param b64 the 4-byte base64 input block * * \return none */ static inline void DecodeBase64Block(uint8_t ascii[ASCII_BLOCK], uint8_t b64[B64_BLOCK]) { ascii[0] = (uint8_t) (b64[0] << 2) | (b64[1] >> 4); ascii[1] = (uint8_t) (b64[1] << 4) | (b64[2] >> 2); ascii[2] = (uint8_t) (b64[2] << 6) | (b64[3]); } /** * \brief Decodes a base64-encoded string buffer into an ascii-encoded byte buffer * * \param dest The destination byte buffer * \param src The source string * \param len The length of the source string * \param strict If set file on invalid byte, otherwise return what has been * decoded. * * \return Number of bytes decoded, or 0 if no data is decoded or it fails */ uint32_t DecodeBase64(uint8_t *dest, const uint8_t *src, uint32_t len, int strict) { int val; uint32_t padding = 0, numDecoded = 0, bbidx = 0, valid = 1, i; uint8_t *dptr = dest; uint8_t b64[B64_BLOCK] = { 0,0,0,0 }; /* Traverse through each alpha-numeric letter in the source array */ for(i = 0; i < len && src[i] != 0; i++) { /* Get decimal representation */ val = GetBase64Value(src[i]); if (val < 0) { /* Invalid character found, so decoding fails */ if (src[i] != '=') { valid = 0; if (strict) { numDecoded = 0; } break; } padding++; } /* For each alpha-numeric letter in the source array, find the numeric * value */ b64[bbidx++] = (val > 0 ? val : 0); /* Decode every 4 base64 bytes into 3 ascii bytes */ if (bbidx == B64_BLOCK) { /* For every 4 bytes, add 3 bytes but deduct the '=' padded blocks */ numDecoded += ASCII_BLOCK - (padding < B64_BLOCK ? padding : ASCII_BLOCK); /* Decode base-64 block into ascii block and move pointer */ DecodeBase64Block(dptr, b64); dptr += ASCII_BLOCK; /* Reset base-64 block and index */ bbidx = 0; padding = 0; } } /* Finish remaining b64 bytes by padding */ if (valid && bbidx > 0) { /* Decode remaining */ numDecoded += ASCII_BLOCK - (B64_BLOCK - bbidx); DecodeBase64Block(dptr, b64); } if (numDecoded == 0) { SCLogDebug("base64 decoding failed"); } return numDecoded; } suricata-3.2.1/src/detect-engine-content-inspection.h0000644000000000000000000000305613051004444017512 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_ENGINE_CONTENT_INSPECTION_H__ #define __DETECT_ENGINE_CONTENT_INSPECTION_H__ /** indication to content engine what type of data * we're inspecting */ enum { DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD = 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, }; int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, Flow *f, uint8_t *buffer, uint32_t buffer_len, uint32_t stream_start_offset, uint8_t inspection_mode, void *data); #endif /* __DETECT_ENGINE_CONTENT_INSPECTION_H__ */ suricata-3.2.1/src/threads-arch-tile.h0000644000000000000000000000741513051004444014461 00000000000000/* Copyright (C) 2011-2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele, Tilera Corporation */ #ifndef __THREADS_ARCH_TILE_H__ #define __THREADS_ARCH_TILE_H__ #include #include /* NOTE: On Tilera datapath threads use the TMC (Tilera Multicore * Components) library spin mutexes while the control threads use * pthread mutexes. So the pthread mutex types are split out so that * their use can be differentiated. */ /* ctrl mutex */ #define SCCtrlMutex pthread_mutex_t #define SCCtrlMutexAttr pthread_mutexattr_t #define SCCtrlMutexInit(mut, mutattr ) pthread_mutex_init(mut, mutattr) #define SCCtrlMutexLock(mut) pthread_mutex_lock(mut) #define SCCtrlMutexTrylock(mut) pthread_mutex_trylock(mut) #define SCCtrlMutexUnlock(mut) pthread_mutex_unlock(mut) #define SCCtrlMutexDestroy pthread_mutex_destroy /* ctrl cond */ #define SCCtrlCondT pthread_cond_t #define SCCtrlCondInit pthread_cond_init #define SCCtrlCondSignal pthread_cond_signal #define SCCtrlCondTimedwait pthread_cond_timedwait #define SCCtrlCondWait pthread_cond_wait #define SCCtrlCondDestroy pthread_cond_destroy /* mutex */ #define SCMutex tmc_spin_queued_mutex_t #define SCMutexAttr #define SCMutexDestroy(x) ({ (void)(x); 0; }) #define SCMUTEX_INITIALIZER TMC_SPIN_QUEUED_MUTEX_INIT #define SCMutexInit(mut, mutattr) ({ \ int ret = 0; \ tmc_spin_queued_mutex_init(mut); \ ret; \ }) #define SCMutexLock(mut) ({ \ int ret = 0; \ tmc_spin_queued_mutex_lock(mut); \ ret; \ }) #define SCMutexTrylock(mut) ({ \ int ret = (tmc_spin_queued_mutex_trylock(mut) == 0) ? 0 : EBUSY; \ ret; \ }) #define SCMutexUnlock(mut) ({ \ int ret = 0; \ tmc_spin_queued_mutex_unlock(mut); \ ret; \ }) /* conditions */ /* Ignore signals when using spin locks */ #define SCCondT uint8_t #define SCCondInit(x,y) ({ 0; }) #define SCCondSignal(x) ({ 0; }) #define SCCondDestroy(x) ({ 0; }) static inline void cycle_sleep(int cycles) { uint64_t end = get_cycle_count() + cycles; while (get_cycle_count() < end) ; } #define SCCondWait(x,y) cycle_sleep(300) /* spinlocks */ #define SCSpinlock tmc_spin_queued_mutex_t #define SCSpinLock(spin) ({ tmc_spin_queued_mutex_lock(spin); 0; }) #define SCSpinTrylock(spin) (tmc_spin_queued_mutex_trylock(spin) ? EBUSY : 0) #define SCSpinUnlock(spin) ({ tmc_spin_queued_mutex_unlock(spin); 0; }) #define SCSpinInit(spin, spin_attr) ({ tmc_spin_queued_mutex_init(spin); 0; }) #define SCSpinDestroy(spin) ({ (void)(spin); 0; }) /* rwlocks */ #define SCRWLock tmc_spin_rwlock_t #define SCRWLockDestroy(x) ({ (void)(x); 0; }) #define SCRWLockInit(rwl, rwlattr ) ({ tmc_spin_rwlock_init(rwl); 0; }) #define SCRWLockWRLock(rwl) ({ tmc_spin_rwlock_wrlock(rwl); 0; }) #define SCRWLockRDLock(rwl) ({ tmc_spin_rwlock_rdlock(rwl); 0; }) #define SCRWLockTryWRLock(rwl) (tmc_spin_rwlock_trywrlock(rwl) ? EBUSY : 0) #define SCRWLockTryRDLock(rwl) (tmc_spin_rwlock_tryrdlock(rwl) ? EBUSY : 0) #define SCRWLockUnlock(rwl) ({ tmc_spin_rwlock_unlock(rwl); 0; }) #endif suricata-3.2.1/src/detect-classtype.h0000644000000000000000000000165713051004444014440 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __DETECT_CLASSTYPE_H__ #define __DETECT_CLASSTYPE_H__ /* prototypes */ void DetectClasstypeRegister(void); #endif /* __DETECT_CLASSTYPE_H__ */ suricata-3.2.1/src/util-unittest.c0000644000000000000000000001542513051004444014006 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * \author Breno Silva * * Unit test framework */ /** * \defgroup Testing Testing * * \brief Unit testing support functions. * * @{ */ #include "suricata-common.h" #include "runmodes.h" #include "util-unittest.h" #include "util-debug.h" #include "util-time.h" #include "conf.h" #ifdef UNITTESTS static pcre *parse_regex; static pcre_extra *parse_regex_study; static UtTest *ut_list; int unittests_fatal = 0; /** * \brief Allocate UtTest list member * * \retval ut Pointer to UtTest */ static UtTest *UtAllocTest(void) { UtTest *ut = SCMalloc(sizeof(UtTest)); if (unlikely(ut == NULL)) return NULL; memset(ut, 0, sizeof(UtTest)); return ut; } /** * \brief Append test in UtTest list * * \param list Pointer to the start of the IP packet * \param test Pointer to unit test * * \retval 0 Function always returns zero */ static int UtAppendTest(UtTest **list, UtTest *test) { if (*list == NULL) { *list = test; } else { UtTest *tmp = *list; while (tmp->next != NULL) { tmp = tmp->next; } tmp->next = test; } return 0; } /** * \brief Register unit test * * \param name Unit test name * \param TestFn Unit test function */ void UtRegisterTest(char *name, int(*TestFn)(void)) { UtTest *ut = UtAllocTest(); if (ut == NULL) return; ut->name = name; ut->TestFn = TestFn; ut->next = NULL; /* append */ UtAppendTest(&ut_list, ut); } /** * \brief Compile a regex to run a specific unit test * * \param regex_arg The regular expression * * \retval 1 Regex compiled * \retval -1 Regex error */ int UtRegex (char *regex_arg) { const char *eb; int eo; int opts = PCRE_CASELESS;; if(regex_arg == NULL) return -1; parse_regex = pcre_compile(regex_arg, opts, &eb, &eo, NULL); if(parse_regex == NULL) { printf("pcre compile of \"%s\" failed at offset %" PRId32 ": %s\n", regex_arg, eo, eb); goto error; } parse_regex_study = pcre_study(parse_regex, 0, &eb); if(eb != NULL) { printf("pcre study failed: %s\n", eb); goto error; } return 1; error: return -1; } #define MAX_SUBSTRINGS 30 /** \brief List all registered unit tests. * * \param regex_arg Regular expression to limit listed tests. */ void UtListTests(char *regex_arg) { UtTest *ut; int ret = 0, rcomp = 0; int ov[MAX_SUBSTRINGS]; rcomp = UtRegex(regex_arg); for (ut = ut_list; ut != NULL; ut = ut->next) { if (rcomp == 1) { ret = pcre_exec(parse_regex, parse_regex_study, ut->name, strlen(ut->name), 0, 0, ov, MAX_SUBSTRINGS); if (ret >= 1) { printf("%s\n", ut->name); } } else { printf("%s\n", ut->name); } } } /** \brief Run all registered unittests. * * \param regex_arg The regular expression * * \retval 0 all successful * \retval result number of tests that failed */ uint32_t UtRunTests(char *regex_arg) { UtTest *ut; uint32_t good = 0, bad = 0, matchcnt = 0; int ret = 0, rcomp = 0; int ov[MAX_SUBSTRINGS]; rcomp = UtRegex(regex_arg); if(rcomp == 1){ for (ut = ut_list; ut != NULL; ut = ut->next) { ret = pcre_exec(parse_regex, parse_regex_study, ut->name, strlen(ut->name), 0, 0, ov, MAX_SUBSTRINGS); if( ret >= 1 ) { printf("Test %-60.60s : ", ut->name); matchcnt++; fflush(stdout); /* flush so in case of a segv we see the testname */ /* reset the time */ TimeModeSetOffline(); TimeSetToCurrentTime(); ret = ut->TestFn(); printf("%s\n", ret ? "pass" : "FAILED"); if (!ret) { if (unittests_fatal == 1) { fprintf(stderr, "ERROR: unittest failed.\n"); exit(EXIT_FAILURE); } bad++; } else { good++; } } } if(matchcnt > 0){ printf("==== TEST RESULTS ====\n"); printf("PASSED: %" PRIu32 "\n", good); printf("FAILED: %" PRIu32 "\n", bad); printf("======================\n"); } else { SCLogInfo("UtRunTests: regex provided regex_arg: %s did not match any tests",regex_arg); } } else { SCLogInfo("UtRunTests: pcre compilation failed"); } return bad; } /** * \brief Initialize unit test list */ void UtInitialize(void) { ut_list = NULL; } /** * \brief Cleanup unit test list */ void UtCleanup(void) { UtTest *tmp = ut_list, *otmp; while (tmp != NULL) { otmp = tmp->next; SCFree(tmp); tmp = otmp; } ut_list = NULL; } void UtRunModeRegister(void) { RunModeRegisterNewRunMode(RUNMODE_UNITTEST, "unittest", "Unittest mode", NULL); return; } /* * unittests for the unittests code */ /** \brief True test * * \retval 1 True * \retval 0 False */ int UtSelftestTrue(void) { if (1)return 1; else return 0; } /** \brief False test * * \retval 1 False * \retval 0 True */ int UtSelftestFalse(void) { if (0)return 0; else return 1; } #endif /* UNITTESTS */ /** \brief Run self tests * * \param regex_arg The regular expression * * \retval 0 all successful */ int UtRunSelftest (char *regex_arg) { #ifdef UNITTESTS printf("* Running Unittesting subsystem selftests...\n"); UtInitialize(); UtRegisterTest("true", UtSelftestTrue); UtRegisterTest("false", UtSelftestFalse); int ret = UtRunTests(regex_arg); if (ret == 0) printf("* Done running Unittesting subsystem selftests...\n"); else printf("* ERROR running Unittesting subsystem selftests failed...\n"); UtCleanup(); #endif /* UNITTESTS */ return 0; } /** * @} */ suricata-3.2.1/src/alert-unified2-alert.h0000644000000000000000000000317513051004444015077 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * \author Breno Silva */ #ifndef __ALERT_UNIFIED2_ALERT_H__ #define __ALERT_UNIFIED2_ALERT_H__ /** Unified2 Option packet action */ #define UNIFIED2_PACKET_FLAG 1 #define UNIFIED2_BLOCKED_FLAG 0x20 /** Unified2 Header Types */ #define UNIFIED2_EVENT_TYPE 1 #define UNIFIED2_PACKET_TYPE 2 #define UNIFIED2_IDS_EVENT_TYPE 7 #define UNIFIED2_EVENT_EXTENDED_TYPE 66 #define UNIFIED2_PERFORMANCE_TYPE 67 #define UNIFIED2_PORTSCAN_TYPE 68 #define UNIFIED2_IDS_EVENT_IPV6_TYPE 72 #define UNIFIED2_IDS_EVENT_MPLS_TYPE 99 #define UNIFIED2_IDS_EVENT_IPV6_MPLS_TYPE 100 #define UNIFIED2_IDS_EVENT_EXTRADATA_TYPE 110 #define UNIFIED2_EXTRADATA_CLIENT_IPV4_TYPE 1 #define UNIFIED2_EXTRADATA_CLIENT_IPV6_TYPE 1 #define UNIFIED2_EXTRADATA_TYPE_BLOB 1 #define UNIFIED2_EXTRADATA_TYPE_EXTRA_DATA 4 void Unified2AlertRegister(void); OutputCtx *Unified2AlertInitCtx(ConfNode *); #endif /* __ALERT_UNIFIED2_ALERT_H__ */ suricata-3.2.1/src/util-buffer.c0000644000000000000000000000461413051004444013376 00000000000000/* Copyright (C) 2007-2012 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #include "suricata-common.h" #include "suricata.h" #include "util-debug.h" #include "util-buffer.h" /* 10 mb */ #define MAX_LIMIT 10485760 MemBuffer *MemBufferCreateNew(uint32_t size) { if (size > MAX_LIMIT) { SCLogWarning(SC_ERR_MEM_BUFFER_API, "Mem buffer asked to create " "buffer with size greater than API limit - %d", MAX_LIMIT); return NULL; } uint32_t total_size = size + sizeof(MemBuffer); MemBuffer *buffer = SCMalloc(total_size); if (unlikely(buffer == NULL)) { return NULL; } memset(buffer, 0, total_size); buffer->size = size; buffer->buffer = (uint8_t *)buffer + sizeof(MemBuffer); return buffer; } /** \brief expand membuffer by size of 'expand_by' * * If expansion failed, buffer will still be valid. * * \retval result 0 ok, -1 expansion failed */ int MemBufferExpand(MemBuffer **buffer, uint32_t expand_by) { if (((*buffer)->size + expand_by) > MAX_LIMIT) { SCLogWarning(SC_ERR_MEM_BUFFER_API, "Mem buffer asked to create " "buffer with size greater than API limit - %d", MAX_LIMIT); return -1; } uint32_t total_size = (*buffer)->size + sizeof(MemBuffer) + expand_by; MemBuffer *tbuffer = SCRealloc(*buffer, total_size); if (unlikely(tbuffer == NULL)) { return -1; } *buffer = tbuffer; (*buffer)->size += expand_by; (*buffer)->buffer = (uint8_t *)tbuffer + sizeof(MemBuffer); SCLogDebug("expanded buffer by %u, size is now %u", expand_by, (*buffer)->size); return 0; } void MemBufferFree(MemBuffer *buffer) { SCFree(buffer); return; } suricata-3.2.1/src/util-vector.h0000644000000000000000000000234513051004444013433 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __UTIL_VECTOR_H__ #define __UTIL_VECTOR_H__ #if defined(__SSE3__) #include typedef struct Vector_ { union { __m128i v; /**< vector */ uint8_t c[16]; /**< character */ uint16_t w[8]; /**< word */ uint32_t dw[4]; /**< double word */ uint64_t qw[2]; /**< quad word */ }; } Vector __attribute((aligned(16))); #endif /* defined(__SSE3__) */ #endif /* __UTIL_VECTOR_H__ */ suricata-3.2.1/src/util-host-os-info.h0000644000000000000000000000230413051004444014451 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha */ #ifndef __UTIL_HOST_OS_INFO_H__ #define __UTIL_HOST_OS_INFO_H__ #define SC_HINFO_IS_IPV6 0 #define SC_HINFO_IS_IPV4 1 int SCHInfoAddHostOSInfo(char *, char *, int); int SCHInfoGetHostOSFlavour(char *); int SCHInfoGetIPv4HostOSFlavour(uint8_t *); int SCHInfoGetIPv6HostOSFlavour(uint8_t *); void SCHInfoCleanResources(void); void SCHInfoLoadFromConfig(void); void SCHInfoRegisterTests(void); #endif /* __UTIL_HOST_OS_INFO_H__ */ suricata-3.2.1/src/app-layer-dnp3-objects.h0000644000000000000000000010204213051004444015334 00000000000000/* Copyright (C) 2015 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Jason Ish * * This file contains the types (definitions) of the DNP3 objects. */ #ifndef __APP_LAYER_DNP3_OBJECTS_H__ #define __APP_LAYER_DNP3_OBJECTS_H__ #define DNP3_OBJECT_CODE(group, variation) (group << 8 | variation) /* START GENERATED CODE */ /* Code generated by: * ./scripts/dnp3-gen/dnp3-gen.py */ typedef struct DNP3ObjectG1V1_ { uint8_t state; } DNP3ObjectG1V1; typedef struct DNP3ObjectG1V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t reserved:1; uint8_t state:1; } DNP3ObjectG1V2; typedef struct DNP3ObjectG2V1_ { uint8_t state; } DNP3ObjectG2V1; typedef struct DNP3ObjectG2V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t reserved:1; uint8_t state:1; uint64_t timestamp; } DNP3ObjectG2V2; typedef struct DNP3ObjectG2V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t reserved:1; uint8_t state:1; uint16_t timestamp; } DNP3ObjectG2V3; typedef struct DNP3ObjectG3V1_ { uint8_t state; } DNP3ObjectG3V1; typedef struct DNP3ObjectG3V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t state:2; } DNP3ObjectG3V2; typedef struct DNP3ObjectG4V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t state:2; } DNP3ObjectG4V1; typedef struct DNP3ObjectG4V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t state:2; uint64_t timestamp; } DNP3ObjectG4V2; typedef struct DNP3ObjectG4V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t chatter_filter:1; uint8_t state:2; uint16_t relative_time_ms; } DNP3ObjectG4V3; typedef struct DNP3ObjectG10V1_ { uint8_t state; } DNP3ObjectG10V1; typedef struct DNP3ObjectG10V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t reserved1:1; uint8_t state:1; } DNP3ObjectG10V2; typedef struct DNP3ObjectG11V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t reserved1:1; uint8_t state:1; } DNP3ObjectG11V1; typedef struct DNP3ObjectG11V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t reserved1:1; uint8_t state:1; uint64_t timestamp; } DNP3ObjectG11V2; typedef struct DNP3ObjectG12V1_ { uint8_t op_type:4; uint8_t qu:1; uint8_t cr:1; uint8_t tcc:2; uint8_t count; uint32_t ontime; uint32_t offtime; uint8_t status_code:7; uint8_t reserved:1; } DNP3ObjectG12V1; typedef struct DNP3ObjectG12V2_ { uint8_t op_type:4; uint8_t qu:1; uint8_t cr:1; uint8_t tcc:2; uint8_t count; uint32_t ontime; uint32_t offtime; uint8_t status_code:7; uint8_t reserved:1; } DNP3ObjectG12V2; typedef struct DNP3ObjectG12V3_ { uint8_t point; } DNP3ObjectG12V3; typedef struct DNP3ObjectG13V1_ { uint8_t status_code:7; uint8_t commanded_state:1; } DNP3ObjectG13V1; typedef struct DNP3ObjectG13V2_ { uint8_t status_code:7; uint8_t commanded_state:1; uint64_t timestamp; } DNP3ObjectG13V2; typedef struct DNP3ObjectG20V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint32_t count; } DNP3ObjectG20V1; typedef struct DNP3ObjectG20V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint16_t count; } DNP3ObjectG20V2; typedef struct DNP3ObjectG20V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; } DNP3ObjectG20V3; typedef struct DNP3ObjectG20V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; } DNP3ObjectG20V4; typedef struct DNP3ObjectG20V5_ { uint32_t count; } DNP3ObjectG20V5; typedef struct DNP3ObjectG20V6_ { uint16_t count; } DNP3ObjectG20V6; typedef struct DNP3ObjectG20V7_ { uint32_t count; } DNP3ObjectG20V7; typedef struct DNP3ObjectG20V8_ { uint16_t count; } DNP3ObjectG20V8; typedef struct DNP3ObjectG21V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint32_t count; } DNP3ObjectG21V1; typedef struct DNP3ObjectG21V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint16_t count; } DNP3ObjectG21V2; typedef struct DNP3ObjectG21V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; } DNP3ObjectG21V3; typedef struct DNP3ObjectG21V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; } DNP3ObjectG21V4; typedef struct DNP3ObjectG21V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved1:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG21V5; typedef struct DNP3ObjectG21V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved1:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG21V6; typedef struct DNP3ObjectG21V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG21V7; typedef struct DNP3ObjectG21V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG21V8; typedef struct DNP3ObjectG21V9_ { uint32_t count; } DNP3ObjectG21V9; typedef struct DNP3ObjectG21V10_ { uint16_t count; } DNP3ObjectG21V10; typedef struct DNP3ObjectG21V11_ { uint32_t count; } DNP3ObjectG21V11; typedef struct DNP3ObjectG21V12_ { uint16_t count; } DNP3ObjectG21V12; typedef struct DNP3ObjectG22V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint32_t count; } DNP3ObjectG22V1; typedef struct DNP3ObjectG22V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint16_t count; } DNP3ObjectG22V2; typedef struct DNP3ObjectG22V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; } DNP3ObjectG22V3; typedef struct DNP3ObjectG22V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; } DNP3ObjectG22V4; typedef struct DNP3ObjectG22V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG22V5; typedef struct DNP3ObjectG22V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG22V6; typedef struct DNP3ObjectG22V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG22V7; typedef struct DNP3ObjectG22V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG22V8; typedef struct DNP3ObjectG23V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint32_t count; } DNP3ObjectG23V1; typedef struct DNP3ObjectG23V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; } DNP3ObjectG23V2; typedef struct DNP3ObjectG23V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; } DNP3ObjectG23V3; typedef struct DNP3ObjectG23V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; } DNP3ObjectG23V4; typedef struct DNP3ObjectG23V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG23V5; typedef struct DNP3ObjectG23V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t discontinuity:1; uint8_t reserved0:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG23V6; typedef struct DNP3ObjectG23V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint32_t count; uint64_t timestamp; } DNP3ObjectG23V7; typedef struct DNP3ObjectG23V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t rollover:1; uint8_t reserved0:1; uint8_t reserved1:1; uint16_t count; uint64_t timestamp; } DNP3ObjectG23V8; typedef struct DNP3ObjectG30V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG30V1; typedef struct DNP3ObjectG30V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG30V2; typedef struct DNP3ObjectG30V3_ { int32_t value; } DNP3ObjectG30V3; typedef struct DNP3ObjectG30V4_ { int16_t value; } DNP3ObjectG30V4; typedef struct DNP3ObjectG30V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG30V5; typedef struct DNP3ObjectG30V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG30V6; typedef struct DNP3ObjectG31V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG31V1; typedef struct DNP3ObjectG31V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG31V2; typedef struct DNP3ObjectG31V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; uint64_t timestamp; } DNP3ObjectG31V3; typedef struct DNP3ObjectG31V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; uint64_t timestamp; } DNP3ObjectG31V4; typedef struct DNP3ObjectG31V5_ { int32_t value; } DNP3ObjectG31V5; typedef struct DNP3ObjectG31V6_ { int16_t value; } DNP3ObjectG31V6; typedef struct DNP3ObjectG31V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG31V7; typedef struct DNP3ObjectG31V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG31V8; typedef struct DNP3ObjectG32V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG32V1; typedef struct DNP3ObjectG32V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG32V2; typedef struct DNP3ObjectG32V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; uint64_t timestamp; } DNP3ObjectG32V3; typedef struct DNP3ObjectG32V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; uint64_t timestamp; } DNP3ObjectG32V4; typedef struct DNP3ObjectG32V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG32V5; typedef struct DNP3ObjectG32V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG32V6; typedef struct DNP3ObjectG32V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; uint64_t timestamp; } DNP3ObjectG32V7; typedef struct DNP3ObjectG32V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; uint64_t timestamp; } DNP3ObjectG32V8; typedef struct DNP3ObjectG33V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG33V1; typedef struct DNP3ObjectG33V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG33V2; typedef struct DNP3ObjectG33V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; uint64_t timestamp; } DNP3ObjectG33V3; typedef struct DNP3ObjectG33V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; uint64_t timestamp; } DNP3ObjectG33V4; typedef struct DNP3ObjectG33V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG33V5; typedef struct DNP3ObjectG33V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG33V6; typedef struct DNP3ObjectG33V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; uint64_t timestamp; } DNP3ObjectG33V7; typedef struct DNP3ObjectG33V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; uint64_t timestamp; } DNP3ObjectG33V8; typedef struct DNP3ObjectG34V1_ { uint16_t deadband_value; } DNP3ObjectG34V1; typedef struct DNP3ObjectG34V2_ { uint32_t deadband_value; } DNP3ObjectG34V2; typedef struct DNP3ObjectG34V3_ { float deadband_value; } DNP3ObjectG34V3; typedef struct DNP3ObjectG40V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG40V1; typedef struct DNP3ObjectG40V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG40V2; typedef struct DNP3ObjectG40V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG40V3; typedef struct DNP3ObjectG40V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG40V4; typedef struct DNP3ObjectG41V1_ { int32_t value; uint8_t control_status; } DNP3ObjectG41V1; typedef struct DNP3ObjectG41V2_ { int16_t value; uint8_t control_status; } DNP3ObjectG41V2; typedef struct DNP3ObjectG41V3_ { float value; uint8_t control_status; } DNP3ObjectG41V3; typedef struct DNP3ObjectG41V4_ { double value; uint8_t control_status; } DNP3ObjectG41V4; typedef struct DNP3ObjectG42V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; } DNP3ObjectG42V1; typedef struct DNP3ObjectG42V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; } DNP3ObjectG42V2; typedef struct DNP3ObjectG42V3_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int32_t value; uint64_t timestamp; } DNP3ObjectG42V3; typedef struct DNP3ObjectG42V4_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; int16_t value; uint64_t timestamp; } DNP3ObjectG42V4; typedef struct DNP3ObjectG42V5_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; } DNP3ObjectG42V5; typedef struct DNP3ObjectG42V6_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; } DNP3ObjectG42V6; typedef struct DNP3ObjectG42V7_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; float value; uint64_t timestamp; } DNP3ObjectG42V7; typedef struct DNP3ObjectG42V8_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t over_range:1; uint8_t reference_err:1; uint8_t reserved0:1; double value; uint64_t timestamp; } DNP3ObjectG42V8; typedef struct DNP3ObjectG43V1_ { uint8_t status_code:7; uint8_t reserved0:1; int32_t commanded_value; } DNP3ObjectG43V1; typedef struct DNP3ObjectG43V2_ { uint8_t status_code:7; uint8_t reserved0:1; int16_t commanded_value; } DNP3ObjectG43V2; typedef struct DNP3ObjectG43V3_ { uint8_t status_code:7; uint8_t reserved0:1; int32_t commanded_value; uint64_t timestamp; } DNP3ObjectG43V3; typedef struct DNP3ObjectG43V4_ { uint8_t status_code:7; uint8_t reserved0:1; int16_t commanded_value; uint64_t timestamp; } DNP3ObjectG43V4; typedef struct DNP3ObjectG43V5_ { uint8_t status_code:7; uint8_t reserved0:1; float commanded_value; } DNP3ObjectG43V5; typedef struct DNP3ObjectG43V6_ { uint8_t status_code:7; uint8_t reserved0:1; double commanded_value; } DNP3ObjectG43V6; typedef struct DNP3ObjectG43V7_ { uint8_t status_code:7; uint8_t reserved0:1; float commanded_value; uint64_t timestamp; } DNP3ObjectG43V7; typedef struct DNP3ObjectG43V8_ { uint8_t status_code:7; uint8_t reserved0:1; double commanded_value; uint64_t timestamp; } DNP3ObjectG43V8; typedef struct DNP3ObjectG50V1_ { uint64_t timestamp; } DNP3ObjectG50V1; typedef struct DNP3ObjectG50V2_ { uint64_t timestamp; uint32_t interval; } DNP3ObjectG50V2; typedef struct DNP3ObjectG50V3_ { uint64_t timestamp; } DNP3ObjectG50V3; typedef struct DNP3ObjectG50V4_ { uint64_t timestamp; uint32_t interval_count; uint8_t interval_units; } DNP3ObjectG50V4; typedef struct DNP3ObjectG51V1_ { uint64_t timestamp; } DNP3ObjectG51V1; typedef struct DNP3ObjectG51V2_ { uint64_t timestamp; } DNP3ObjectG51V2; typedef struct DNP3ObjectG52V1_ { uint16_t delay_secs; } DNP3ObjectG52V1; typedef struct DNP3ObjectG52V2_ { uint16_t delay_ms; } DNP3ObjectG52V2; typedef struct DNP3ObjectG70V1_ { uint16_t filename_size; uint8_t filetype_code; uint8_t attribute_code; uint16_t start_record; uint16_t end_record; uint32_t file_size; uint64_t created_timestamp; uint16_t permission; uint32_t file_id; uint32_t owner_id; uint32_t group_id; uint8_t file_function_code; uint8_t status_code; char filename[65535]; uint16_t data_size; char data[65535]; } DNP3ObjectG70V1; typedef struct DNP3ObjectG70V2_ { uint16_t username_offset; uint16_t username_size; uint16_t password_offset; uint16_t password_size; uint32_t authentication_key; char username[65535]; char password[65535]; } DNP3ObjectG70V2; typedef struct DNP3ObjectG70V3_ { uint16_t filename_offset; uint16_t filename_size; uint64_t created; uint16_t permissions; uint32_t authentication_key; uint32_t file_size; uint16_t operational_mode; uint16_t maximum_block_size; uint16_t request_id; char filename[65535]; } DNP3ObjectG70V3; typedef struct DNP3ObjectG70V4_ { uint32_t file_handle; uint32_t file_size; uint16_t maximum_block_size; uint16_t request_id; uint8_t status_code; char optional_text[255]; uint8_t optional_text_len; } DNP3ObjectG70V4; typedef struct DNP3ObjectG70V5_ { uint32_t file_handle; uint32_t block_number; char file_data[255]; uint8_t file_data_len; } DNP3ObjectG70V5; typedef struct DNP3ObjectG70V6_ { uint32_t file_handle; uint32_t block_number; uint8_t status_code; char optional_text[255]; uint8_t optional_text_len; } DNP3ObjectG70V6; typedef struct DNP3ObjectG70V7_ { uint16_t filename_offset; uint16_t filename_size; uint16_t file_type; uint32_t file_size; uint64_t created_timestamp; uint16_t permissions; uint16_t request_id; char filename[65535]; } DNP3ObjectG70V7; typedef struct DNP3ObjectG70V8_ { char file_specification[65535]; uint16_t file_specification_len; } DNP3ObjectG70V8; typedef struct DNP3ObjectG80V1_ { uint8_t state; } DNP3ObjectG80V1; typedef struct DNP3ObjectG81V1_ { uint8_t fill_percentage:7; uint8_t overflow_state:1; uint8_t group; uint8_t variation; } DNP3ObjectG81V1; typedef struct DNP3ObjectG83V1_ { char vendor_code[5]; uint16_t object_id; uint16_t length; uint8_t *data_objects; } DNP3ObjectG83V1; typedef struct DNP3ObjectG86V2_ { uint8_t rd:1; uint8_t wr:1; uint8_t st:1; uint8_t ev:1; uint8_t df:1; uint8_t padding0:1; uint8_t padding1:1; uint8_t padding2:1; } DNP3ObjectG86V2; typedef struct DNP3ObjectG102V1_ { uint8_t value; } DNP3ObjectG102V1; typedef struct DNP3ObjectG120V1_ { uint32_t csq; uint16_t usr; uint8_t mal; uint8_t reason; uint8_t *challenge_data; uint16_t challenge_data_len; } DNP3ObjectG120V1; typedef struct DNP3ObjectG120V2_ { uint32_t csq; uint16_t usr; uint8_t *mac_value; uint16_t mac_value_len; } DNP3ObjectG120V2; typedef struct DNP3ObjectG120V3_ { uint32_t csq; uint16_t user_number; } DNP3ObjectG120V3; typedef struct DNP3ObjectG120V4_ { uint16_t user_number; } DNP3ObjectG120V4; typedef struct DNP3ObjectG120V5_ { uint32_t ksq; uint16_t user_number; uint8_t key_wrap_alg; uint8_t key_status; uint8_t mal; uint16_t challenge_data_len; uint8_t *challenge_data; uint8_t *mac_value; uint16_t mac_value_len; } DNP3ObjectG120V5; typedef struct DNP3ObjectG120V6_ { uint32_t ksq; uint16_t usr; uint8_t *wrapped_key_data; uint16_t wrapped_key_data_len; } DNP3ObjectG120V6; typedef struct DNP3ObjectG120V7_ { uint32_t sequence_number; uint16_t usr; uint16_t association_id; uint8_t error_code; uint64_t time_of_error; char error_text[65535]; uint16_t error_text_len; } DNP3ObjectG120V7; typedef struct DNP3ObjectG120V8_ { uint8_t key_change_method; uint8_t certificate_type; uint8_t *certificate; uint16_t certificate_len; } DNP3ObjectG120V8; typedef struct DNP3ObjectG120V9_ { uint8_t *mac_value; uint16_t mac_value_len; } DNP3ObjectG120V9; typedef struct DNP3ObjectG120V10_ { uint8_t key_change_method; uint8_t operation; uint32_t scs; uint16_t user_role; uint16_t user_role_expiry_interval; uint16_t username_len; uint16_t user_public_key_len; uint16_t certification_data_len; char username[65535]; uint8_t *user_public_key; uint8_t *certification_data; } DNP3ObjectG120V10; typedef struct DNP3ObjectG120V11_ { uint8_t key_change_method; uint16_t username_len; uint16_t master_challenge_data_len; char username[65535]; uint8_t *master_challenge_data; } DNP3ObjectG120V11; typedef struct DNP3ObjectG120V12_ { uint32_t ksq; uint16_t user_number; uint16_t challenge_data_len; uint8_t *challenge_data; } DNP3ObjectG120V12; typedef struct DNP3ObjectG120V13_ { uint32_t ksq; uint16_t user_number; uint16_t encrypted_update_key_len; uint8_t *encrypted_update_key_data; } DNP3ObjectG120V13; typedef struct DNP3ObjectG120V14_ { uint8_t *digital_signature; uint16_t digital_signature_len; } DNP3ObjectG120V14; typedef struct DNP3ObjectG120V15_ { uint8_t *mac; uint32_t mac_len; } DNP3ObjectG120V15; typedef struct DNP3ObjectG121V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t discontinuity:1; uint8_t reserved1:1; uint16_t association_id; uint32_t count_value; } DNP3ObjectG121V1; typedef struct DNP3ObjectG122V1_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t discontinuity:1; uint8_t reserved1:1; uint16_t association_id; uint32_t count_value; } DNP3ObjectG122V1; typedef struct DNP3ObjectG122V2_ { uint8_t online:1; uint8_t restart:1; uint8_t comm_lost:1; uint8_t remote_forced:1; uint8_t local_forced:1; uint8_t reserved0:1; uint8_t discontinuity:1; uint8_t reserved1:1; uint16_t association_id; uint32_t count_value; uint64_t timestamp; } DNP3ObjectG122V2; /* END GENERATED CODE */ int DNP3DecodeObject(int group, int variation, const uint8_t **buf, uint32_t *len, uint8_t prefix_code, uint32_t start, uint32_t count, DNP3PointList *); DNP3PointList *DNP3PointListAlloc(void); void DNP3FreeObjectPointList(int group, int variation, DNP3PointList *); #endif /* __APP_LAYER_DNP3_OBJECTS_H__ */ suricata-3.2.1/src/app-layer-dcerpc.h0000644000000000000000000000243313051004444014304 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Kirby Kuehl */ #ifndef __APP_LAYER_DCERPC_H__ #define __APP_LAYER_DCERPC_H__ #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-dcerpc-common.h" #include "flow.h" #include "queue.h" #include "util-byte.h" typedef struct DCERPCState_ { DCERPC dcerpc; uint8_t data_needed_for_dir; } DCERPCState; void DCERPCInit(DCERPC *dcerpc); void DCERPCCleanup(DCERPC *dcerpc); void RegisterDCERPCParsers(void); void DCERPCParserTests(void); void DCERPCParserRegisterTests(void); #endif /* __APP_LAYER_DCERPC_H__ */ suricata-3.2.1/src/source-pfring.h0000644000000000000000000000333313051004444013737 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author William Metcalf */ #ifndef __SOURCE_PFRING_H__ #define __SOURCE_PFRING_H__ #define PFRING_IFACE_NAME_LENGTH 48 #include #ifdef HAVE_PFRING #include #endif typedef enum { PFRING_CONF_FLAGS_CLUSTER = 0x1 } PfringIfaceConfigFlags; typedef struct PfringIfaceConfig_ { uint32_t flags; /* cluster param */ int cluster_id; #ifdef HAVE_PFRING cluster_type ctype; #endif char iface[PFRING_IFACE_NAME_LENGTH]; /* number of threads */ int threads; char *bpf_filter; ChecksumValidationMode checksum_mode; SC_ATOMIC_DECLARE(unsigned int, ref); void (*DerefFunc)(void *); } PfringIfaceConfig; void TmModuleReceivePfringRegister (void); void TmModuleDecodePfringRegister (void); int PfringConfGetThreads(void); void PfringLoadConfig(void); /* We don't have to use an enum that sucks in our code */ #define CLUSTER_FLOW 0 #define CLUSTER_ROUND_ROBIN 1 #define CLUSTER_FLOW_5_TUPLE 4 #endif /* __SOURCE_PFRING_H__ */ suricata-3.2.1/src/util-random.c0000644000000000000000000000246313051004444013405 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Pablo Rincon * * Utility function for seeding rand */ #include "suricata-common.h" #include "detect.h" #include "threads.h" #include "util-debug.h" /** * \brief create a seed number to pass to rand() , rand_r(), and similars * \retval seed for rand() */ unsigned int RandomTimePreseed(void) { /* preseed rand() */ time_t now = time ( 0 ); unsigned char *p = (unsigned char *)&now; unsigned seed = 0; size_t ind; for ( ind = 0; ind < sizeof now; ind++ ) seed = seed * ( UCHAR_MAX + 2U ) + p[ind]; return seed; } suricata-3.2.1/src/util-pages.h0000644000000000000000000000225013051004444013223 00000000000000/* Copyright (C) 2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * */ #ifndef __UTIL_PAGES_H__ #define __UTIL_PAGES_H__ #include "suricata-common.h" #ifdef __OpenBSD__ /* OpenBSD won't allow for this test: * "suricata(...): mprotect W^X violation" */ #define PageSupportsRWX() 0 #else #ifndef HAVE_SYS_MMAN_H #define PageSupportsRWX() 1 #else int PageSupportsRWX(void); #endif /* HAVE_SYS_MMAN_H */ #endif #endif /* __UTIL_PAGES_H__ */ suricata-3.2.1/src/detect-engine-hhhd.c0000644000000000000000000021662713051004444014607 00000000000000/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \ingroup httplayer * * @{ */ /** \file * * \author Anoop Saldanha * \author Victor Julien * * \brief Handle HTTP host header. * HHHD - Http Host Header Data * */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "stream-tcp.h" #include "app-layer-parser.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "app-layer.h" #include "app-layer-htp.h" #include "app-layer-protos.h" #include "detect-engine-hhhd.h" #include "util-validate.h" /** \brief HTTP Host Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxHostname(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; if (tx->request_hostname == NULL) return; const uint32_t buffer_len = bstr_len(tx->request_hostname); const uint8_t *buffer = bstr_ptr(tx->request_hostname); if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } int PrefilterTxHostnameRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxHostname, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_host"); } /** * \brief Do the http_header content inspection for a signature. * * \param de_ctx Detection engine context. * \param det_ctx Detection engine thread context. * \param s Signature to inspect. * \param f Flow. * \param flags App layer flags. * \param state App layer state. * * \retval 0 No match. * \retval 1 Match. */ int DetectEngineInspectHttpHH(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { htp_tx_t *tx = (htp_tx_t *)txv; if (tx->parsed_uri == NULL || tx->request_hostname == NULL) goto end; uint8_t *hname = (uint8_t *)bstr_ptr(tx->request_hostname); if (hname == NULL) goto end; uint32_t hname_len = bstr_len(tx->request_hostname); det_ctx->buffer_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HHHDMATCH], f, hname, hname_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; end: if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; else return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; } /***********************************Unittests**********************************/ #ifdef UNITTESTS /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest01(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"connect\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest02(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"co\"; depth:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest03(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:!\"ect\"; depth:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest04(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"ect\"; depth:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest05(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"con\"; depth:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest06(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"ect\"; offset:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest07(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"co\"; offset:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!(PacketAlertCheck(p, 1))) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest08(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:!\"ect\"; offset:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest09(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http host header test\"; " "content:\"con\"; offset:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest10(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:\"ec\"; within:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest11(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:!\"ec\"; within:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest12(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:\"ec\"; within:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest13(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:!\"ec\"; within:4; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest14(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:\"ec\"; distance:2; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest15(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:!\"ec\"; distance:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest16(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:\"ec\"; distance:3; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } /** * \test Test that the http_host header content matches against a http request * which holds the content. */ static int DetectEngineHttpHHTest17(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: CONNECT\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"co\"; http_host; " "content:!\"ec\"; distance:2; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest18(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"kaboom\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest19(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com:8080\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"kaboom\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest20(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET /index.html HTTP/1.0\r\n" "Host: www.kaboom.com:8080\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"8080\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest21(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"kaboom\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest22(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"kaboom\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest23(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"8080\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest24(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "Host: www.rabbit.com\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"kaboom\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (!PacketAlertCheck(p, 1)) { printf("sid 1 didn't match but it should have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } static int DetectEngineHttpHHTest25(void) { TcpSession ssn; Packet *p = NULL; ThreadVars th_v; DetectEngineCtx *de_ctx = NULL; DetectEngineThreadCtx *det_ctx = NULL; HtpState *http_state = NULL; Flow f; uint8_t http_buf[] = "GET http://www.kaboom.com:8080/index.html HTTP/1.0\r\n" "Host: www.rabbit.com\r\n" "User-Agent: www.onetwothreefourfivesixseven.org\r\n\r\n"; uint32_t http_len = sizeof(http_buf) - 1; int result = 0; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&th_v, 0, sizeof(th_v)); memset(&f, 0, sizeof(f)); memset(&ssn, 0, sizeof(ssn)); p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); FLOW_INITIALIZE(&f); f.protoctx = (void *)&ssn; f.proto = IPPROTO_TCP; f.flags |= FLOW_IPV4; p->flow = &f; p->flowflags |= FLOW_PKT_TOSERVER; p->flowflags |= FLOW_PKT_ESTABLISHED; p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; f.alproto = ALPROTO_HTTP; StreamTcpInitConfig(TRUE); de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any " "(msg:\"http_host header test\"; " "content:\"rabbit\"; http_host; " "sid:1;)"); if (de_ctx->sig_list == NULL) goto end; SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); FLOWLOCK_WRLOCK(&f); int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, http_buf, http_len); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(&f); goto end; } FLOWLOCK_UNLOCK(&f); http_state = f.alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } /* do detect */ SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (PacketAlertCheck(p, 1)) { printf("sid 1 matched but it shouldn't have: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); if (de_ctx != NULL) SigGroupCleanup(de_ctx); if (de_ctx != NULL) SigCleanSignatures(de_ctx); if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); StreamTcpFreeConfig(TRUE); FLOW_DESTROY(&f); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ void DetectEngineHttpHHRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectEngineHttpHHTest01", DetectEngineHttpHHTest01); UtRegisterTest("DetectEngineHttpHHTest02", DetectEngineHttpHHTest02); UtRegisterTest("DetectEngineHttpHHTest03", DetectEngineHttpHHTest03); UtRegisterTest("DetectEngineHttpHHTest04", DetectEngineHttpHHTest04); UtRegisterTest("DetectEngineHttpHHTest05", DetectEngineHttpHHTest05); UtRegisterTest("DetectEngineHttpHHTest06", DetectEngineHttpHHTest06); UtRegisterTest("DetectEngineHttpHHTest07", DetectEngineHttpHHTest07); UtRegisterTest("DetectEngineHttpHHTest08", DetectEngineHttpHHTest08); UtRegisterTest("DetectEngineHttpHHTest09", DetectEngineHttpHHTest09); UtRegisterTest("DetectEngineHttpHHTest10", DetectEngineHttpHHTest10); UtRegisterTest("DetectEngineHttpHHTest11", DetectEngineHttpHHTest11); UtRegisterTest("DetectEngineHttpHHTest12", DetectEngineHttpHHTest12); UtRegisterTest("DetectEngineHttpHHTest13", DetectEngineHttpHHTest13); UtRegisterTest("DetectEngineHttpHHTest14", DetectEngineHttpHHTest14); UtRegisterTest("DetectEngineHttpHHTest15", DetectEngineHttpHHTest15); UtRegisterTest("DetectEngineHttpHHTest16", DetectEngineHttpHHTest16); UtRegisterTest("DetectEngineHttpHHTest17", DetectEngineHttpHHTest17); UtRegisterTest("DetectEngineHttpHHTest18", DetectEngineHttpHHTest18); UtRegisterTest("DetectEngineHttpHHTest19", DetectEngineHttpHHTest19); UtRegisterTest("DetectEngineHttpHHTest20", DetectEngineHttpHHTest20); UtRegisterTest("DetectEngineHttpHHTest21", DetectEngineHttpHHTest21); UtRegisterTest("DetectEngineHttpHHTest22", DetectEngineHttpHHTest22); UtRegisterTest("DetectEngineHttpHHTest23", DetectEngineHttpHHTest23); UtRegisterTest("DetectEngineHttpHHTest24", DetectEngineHttpHHTest24); UtRegisterTest("DetectEngineHttpHHTest25", DetectEngineHttpHHTest25); #endif /* UNITTESTS */ return; } /** * @} */ suricata-3.2.1/src/util-mpm-ac.h0000644000000000000000000001524513051004444013306 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Anoop Saldanha * */ #ifndef __UTIL_MPM_AC__H__ #define __UTIL_MPM_AC__H__ #define SC_AC_STATE_TYPE_U16 uint16_t #define SC_AC_STATE_TYPE_U32 uint32_t #ifdef __SC_CUDA_SUPPORT__ #include "suricata-common.h" #include "util-cuda.h" #include "util-cuda-vars.h" #include "decode.h" #include "util-cuda-buffer.h" #include "util-mpm.h" #include "flow.h" #endif /* __SC_CUDA_SUPPORT__ */ typedef struct SCACPatternList_ { uint8_t *cs; uint16_t patlen; /* sid(s) for this pattern */ uint32_t sids_size; SigIntId *sids; } SCACPatternList; typedef struct SCACOutputTable_ { /* list of pattern sids */ uint32_t *pids; /* no of entries we have in pids */ uint32_t no_of_entries; } SCACOutputTable; typedef struct SCACCtx_ { /* pattern arrays. We need this only during the goto table creation phase */ MpmPattern **parray; /* no of states used by ac */ uint32_t state_count; uint32_t pattern_id_bitarray_size; /* the all important memory hungry state_table */ SC_AC_STATE_TYPE_U16 (*state_table_u16)[256]; /* the all important memory hungry state_table */ SC_AC_STATE_TYPE_U32 (*state_table_u32)[256]; /* goto_table, failure table and output table. Needed to create state_table. * Will be freed, once we have created the state_table */ int32_t (*goto_table)[256]; int32_t *failure_table; SCACOutputTable *output_table; SCACPatternList *pid_pat_list; /* the size of each state */ uint32_t single_state_size; uint32_t allocated_state_count; #ifdef __SC_CUDA_SUPPORT__ CUdeviceptr state_table_u16_cuda; CUdeviceptr state_table_u32_cuda; #endif /* __SC_CUDA_SUPPORT__ */ } SCACCtx; typedef struct SCACThreadCtx_ { /* the total calls we make to the search function */ uint32_t total_calls; /* the total patterns that we ended up matching against */ uint64_t total_matches; } SCACThreadCtx; void MpmACRegister(void); #ifdef __SC_CUDA_SUPPORT__ #define MPM_AC_CUDA_MODULE_NAME "ac_cuda" #define MPM_AC_CUDA_MODULE_CUDA_BUFFER_NAME "ac_cuda_cb" static inline void CudaBufferPacket(CudaThreadVars *ctv, Packet *p) { if (p->cuda_pkt_vars.cuda_mpm_enabled) { while (!p->cuda_pkt_vars.cuda_done) { SCMutexLock(&p->cuda_pkt_vars.cuda_mutex); if (p->cuda_pkt_vars.cuda_done) { SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); break; } else { SCCondWait(&p->cuda_pkt_vars.cuda_cond, &p->cuda_pkt_vars.cuda_mutex); SCMutexUnlock(&p->cuda_pkt_vars.cuda_mutex); } } } p->cuda_pkt_vars.cuda_done = 0; if (p->payload_len == 0 || (p->flags & (PKT_NOPAYLOAD_INSPECTION & PKT_NOPACKET_INSPECTION)) || (p->flags & PKT_ALLOC) || (ctv->data_buffer_size_min_limit != 0 && p->payload_len < ctv->data_buffer_size_min_limit) || (p->payload_len > ctv->data_buffer_size_max_limit && ctv->data_buffer_size_max_limit != 0) ) { p->cuda_pkt_vars.cuda_mpm_enabled = 0; return; } MpmCtx *mpm_ctx = NULL; if (p->proto == IPPROTO_TCP) { if (p->flowflags & FLOW_PKT_TOSERVER) mpm_ctx = ctv->mpm_proto_tcp_ctx_ts; else mpm_ctx = ctv->mpm_proto_tcp_ctx_tc; } else if (p->proto == IPPROTO_UDP) { if (p->flowflags & FLOW_PKT_TOSERVER) mpm_ctx = ctv->mpm_proto_udp_ctx_ts; else mpm_ctx = ctv->mpm_proto_udp_ctx_tc; } else { mpm_ctx = ctv->mpm_proto_other_ctx; } if (mpm_ctx == NULL || mpm_ctx->pattern_cnt == 0) { p->cuda_pkt_vars.cuda_mpm_enabled = 0; return; } #if __WORDSIZE==64 CudaBufferSlice *slice = CudaBufferGetSlice(ctv->cuda_ac_cb, p->payload_len + sizeof(uint64_t) + sizeof(CUdeviceptr), (void *)p); if (slice == NULL) { SCLogError(SC_ERR_FATAL, "Error retrieving slice. Please report " "this to dev."); p->cuda_pkt_vars.cuda_mpm_enabled = 0; return; } *((uint64_t *)(slice->buffer + slice->start_offset)) = p->payload_len; *((CUdeviceptr *)(slice->buffer + slice->start_offset + sizeof(uint64_t))) = ((SCACCtx *)(mpm_ctx->ctx))->state_table_u32_cuda; memcpy(slice->buffer + slice->start_offset + sizeof(uint64_t) + sizeof(CUdeviceptr), p->payload, p->payload_len); #else CudaBufferSlice *slice = CudaBufferGetSlice(ctv->cuda_ac_cb, p->payload_len + sizeof(uint32_t) + sizeof(CUdeviceptr), (void *)p); if (slice == NULL) { SCLogError(SC_ERR_FATAL, "Error retrieving slice. Please report " "this to dev."); p->cuda_pkt_vars.cuda_mpm_enabled = 0; return; } *((uint32_t *)(slice->buffer + slice->start_offset)) = p->payload_len; *((CUdeviceptr *)(slice->buffer + slice->start_offset + sizeof(uint32_t))) = ((SCACCtx *)(mpm_ctx->ctx))->state_table_u32_cuda; memcpy(slice->buffer + slice->start_offset + sizeof(uint32_t) + sizeof(CUdeviceptr), p->payload, p->payload_len); #endif p->cuda_pkt_vars.cuda_mpm_enabled = 1; SC_ATOMIC_SET(slice->done, 1); SCLogDebug("cuda ac buffering packet %p, payload_len - %"PRIu16" and deviceptr - %"PRIu64"\n", p, p->payload_len, (unsigned long)((SCACCtx *)(mpm_ctx->ctx))->state_table_u32_cuda); return; } void MpmACCudaRegister(void); void SCACConstructBoth16and32StateTables(void); int MpmCudaBufferSetup(void); int MpmCudaBufferDeSetup(void); void SCACCudaStartDispatcher(void); void SCACCudaKillDispatcher(void); uint32_t SCACCudaPacketResultsProcessing(Packet *p, const MpmCtx *mpm_ctx, PrefilterRuleStore *pmq); void DetermineCudaStateTableSize(DetectEngineCtx *de_ctx); void CudaReleasePacket(Packet *p); #endif /* __SC_CUDA_SUPPORT__ */ #endif /* __UTIL_MPM_AC__H__ */ suricata-3.2.1/src/detect-engine-dns.c0000644000000000000000000001220113051004444014436 00000000000000/* Copyright (C) 2013-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Victor Julien * * Based on detect-engine-uri.c */ #include "suricata-common.h" #include "suricata.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" #include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" #include "util-print.h" #include "flow.h" #include "app-layer.h" #include "app-layer-parser.h" #include "app-layer-protos.h" #include "app-layer-dns-common.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "util-validate.h" /** \brief Do the content inspection & validation for a signature * * \param de_ctx Detection engine context * \param det_ctx Detection engine thread context * \param s Signature to inspect * \param sm SigMatch to inspect * \param f Flow * \param flags app layer flags * \param state App layer state * * \retval 0 no match * \retval 1 match */ int DetectEngineInspectDnsQueryName(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { DNSTransaction *tx = (DNSTransaction *)txv; DNSQueryEntry *query = NULL; uint8_t *buffer; uint16_t buffer_len; int r = 0; SCLogDebug("start"); TAILQ_FOREACH(query, &tx->query_list, next) { SCLogDebug("tx %p query %p", tx, query); det_ctx->discontinue_matching = 0; det_ctx->buffer_offset = 0; det_ctx->inspection_recursion_counter = 0; buffer = (uint8_t *)((uint8_t *)query + sizeof(DNSQueryEntry)); buffer_len = query->len; //PrintRawDataFp(stdout, buffer, buffer_len); r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH], f, buffer, buffer_len, 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) break; } return r; } /** \brief DNS Query Mpm prefilter callback * * \param det_ctx detection engine thread ctx * \param p packet to inspect * \param f flow to inspect * \param txv tx to inspect * \param pectx inspection context */ static void PrefilterTxDnsQuery(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, const uint64_t idx, const uint8_t flags) { SCEnter(); const MpmCtx *mpm_ctx = (MpmCtx *)pectx; DNSTransaction *tx = (DNSTransaction *)txv; DNSQueryEntry *query = NULL; TAILQ_FOREACH(query, &tx->query_list, next) { SCLogDebug("tx %p query %p", tx, query); const uint8_t *buffer = (const uint8_t *)((uint8_t *)query + sizeof(DNSQueryEntry)); const uint32_t buffer_len = query->len; if (buffer_len >= mpm_ctx->minlen) { (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } } int PrefilterTxDnsQueryRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); return PrefilterAppendTxEngine(sgh, PrefilterTxDnsQuery, ALPROTO_DNS, 1, mpm_ctx, NULL, "dns_query"); } int DetectEngineInspectDnsRequest(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { return DetectEngineInspectGenericList(tv, de_ctx, det_ctx, s, f, flags, alstate, txv, tx_id, DETECT_SM_LIST_DNSREQUEST_MATCH); } int DetectEngineInspectDnsResponse(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) { return DetectEngineInspectGenericList(tv, de_ctx, det_ctx, s, f, flags, alstate, txv, tx_id, DETECT_SM_LIST_DNSRESPONSE_MATCH); } suricata-3.2.1/src/detect-parse.h0000644000000000000000000000561213051004444013536 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien */ #ifndef __DETECT_PARSE_H__ #define __DETECT_PARSE_H__ /** Flags to indicate if the Signature parsing must be done * switching the source and dest (for ip addresses and ports) * or otherwise as normal */ enum { SIG_DIREC_NORMAL, SIG_DIREC_SWITCHED }; /** Flags to indicate if are referencing the source of the Signature * or the destination (for ip addresses and ports)*/ enum { SIG_DIREC_SRC, SIG_DIREC_DST }; /* prototypes */ int SigParse(DetectEngineCtx *,Signature *, char *, uint8_t); Signature *SigAlloc(void); void SigFree(Signature *s); Signature *SigInit(DetectEngineCtx *,char *sigstr); Signature *SigInitReal(DetectEngineCtx *, char *); SigMatch *SigMatchGetLastSMFromLists(const Signature *, int, ...); SigMatch *SigMatchGetLastSM(const Signature *); void SigMatchTransferSigMatchAcrossLists(SigMatch *sm, SigMatch **, SigMatch **s, SigMatch **, SigMatch **); void SigParsePrepare(void); void SigParseRegisterTests(void); Signature *DetectEngineAppendSig(DetectEngineCtx *, char *); void SigMatchAppendSMToList(Signature *, SigMatch *, int); void SigMatchRemoveSMFromList(Signature *, SigMatch *, int); int SigMatchListSMBelongsTo(const Signature *, const SigMatch *); int DetectParseDupSigHashInit(DetectEngineCtx *); void DetectParseDupSigHashFree(DetectEngineCtx *); int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg, uint8_t sm_type, uint8_t sm_list, AppProto alproto, void (*CustomCallback)(Signature *s)); const char *DetectListToHumanString(int list); const char *DetectListToString(int list); /* parse regex setup and free util funcs */ void DetectSetupParseRegexes(const char *parse_str, pcre **parse_regex, pcre_extra **parse_regex_study); void DetectParseRegexAddToFreeList(pcre *regex, pcre_extra *study); void DetectParseFreeRegexes(void); #ifdef AFLFUZZ_RULES int RuleParseDataFromFile(char *filename); #endif #endif /* __DETECT_PARSE_H__ */ suricata-3.2.1/src/app-layer-htp-file.c0000644000000000000000000015117213051004444014554 00000000000000/* Copyright (C) 2007-2011 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * This file provides HTTP protocol file handling support for the engine * using HTP library. */ #include "suricata.h" #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "threads.h" #include "util-print.h" #include "util-pool.h" #include "util-radix-tree.h" #include "stream-tcp-private.h" #include "stream-tcp-reassemble.h" #include "stream-tcp.h" #include "stream.h" #include "app-layer.h" #include "app-layer-protos.h" #include "app-layer-parser.h" #include "app-layer-htp.h" #include "util-spm.h" #include "util-debug.h" #include "util-time.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "flow-util.h" #include "detect-engine.h" #include "detect-engine-state.h" #include "detect-parse.h" #include "conf.h" #include "util-memcmp.h" /** * \brief Open the file with "filename" and pass the first chunk * of data if any. * * \param s http state * \param filename name of the file * \param filename_len length of the name * \param data data chunk (if any) * \param data_len length of the data portion * \param direction flow direction * * \retval 0 ok * \retval -1 error * \retval -2 not handling files on this flow */ int HTPFileOpen(HtpState *s, const uint8_t *filename, uint16_t filename_len, const uint8_t *data, uint32_t data_len, uint64_t txid, uint8_t direction) { int retval = 0; uint16_t flags = 0; FileContainer *files = NULL; FileContainer *files_opposite = NULL; const StreamingBufferConfig *sbcfg = NULL; SCLogDebug("data %p data_len %"PRIu32, data, data_len); if (s == NULL) { SCReturnInt(-1); } if (direction & STREAM_TOCLIENT) { if (s->files_tc == NULL) { s->files_tc = FileContainerAlloc(); if (s->files_tc == NULL) { retval = -1; goto end; } } files = s->files_tc; files_opposite = s->files_ts; flags = FileFlowToFlags(s->f, STREAM_TOCLIENT); if ((s->flags & HTP_FLAG_STORE_FILES_TS) || ((s->flags & HTP_FLAG_STORE_FILES_TX_TS) && txid == s->store_tx_id)) { flags |= FILE_STORE; flags &= ~FILE_NOSTORE; } else if (!(flags & FILE_STORE) && (s->f->file_flags & FLOWFILE_NO_STORE_TC)) { flags |= FILE_NOSTORE; } sbcfg = &s->cfg->response.sbcfg; } else { if (s->files_ts == NULL) { s->files_ts = FileContainerAlloc(); if (s->files_ts == NULL) { retval = -1; goto end; } } files = s->files_ts; files_opposite = s->files_tc; flags = FileFlowToFlags(s->f, STREAM_TOSERVER); if ((s->flags & HTP_FLAG_STORE_FILES_TC) || ((s->flags & HTP_FLAG_STORE_FILES_TX_TC) && txid == s->store_tx_id)) { flags |= FILE_STORE; flags &= ~FILE_NOSTORE; } else if (!(flags & FILE_STORE) && (s->f->file_flags & FLOWFILE_NO_STORE_TS)) { flags |= FILE_NOSTORE; } sbcfg = &s->cfg->request.sbcfg; } /* if the previous file is in the same txid, we reset the file part of the * stateful detection engine. We cannot do that here directly, because of * locking order. Flow is locked at this point and we can't lock flow * before de_state */ if (files != NULL && files->tail != NULL && files->tail->txid == txid) { SCLogDebug("new file in same tx, flagging http state for de_state reset"); if (direction & STREAM_TOCLIENT) { s->flags |= HTP_FLAG_NEW_FILE_TX_TC; } else { s->flags |= HTP_FLAG_NEW_FILE_TX_TS; } } if (files_opposite != NULL && files_opposite->tail != NULL && files_opposite->tail->txid == txid) { SCLogDebug("new file in same tx, flagging http state for de_state reset"); if (direction & STREAM_TOCLIENT) { SCLogDebug("flagging TC"); s->flags |= HTP_FLAG_NEW_FILE_TX_TC; } else { SCLogDebug("flagging TS"); s->flags |= HTP_FLAG_NEW_FILE_TX_TS; } } if (FileOpenFile(files, sbcfg, filename, filename_len, data, data_len, flags) == NULL) { retval = -1; } FileSetTx(files->tail, txid); FilePrune(files); end: SCReturnInt(retval); } /** * \brief Store a chunk of data in the flow * * \param s http state * \param data data chunk (if any) * \param data_len length of the data portion * \param direction flow direction * * \retval 0 ok * \retval -1 error * \retval -2 file doesn't need storing */ int HTPFileStoreChunk(HtpState *s, const uint8_t *data, uint32_t data_len, uint8_t direction) { SCEnter(); int retval = 0; int result = 0; FileContainer *files = NULL; if (s == NULL) { SCReturnInt(-1); } if (direction & STREAM_TOCLIENT) { files = s->files_tc; } else { files = s->files_ts; } if (files == NULL) { SCLogDebug("no files in state"); retval = -1; goto end; } result = FileAppendData(files, data, data_len); if (result == -1) { SCLogDebug("appending data failed"); retval = -1; } else if (result == -2) { retval = -2; } FilePrune(files); end: SCReturnInt(retval); } /** * \brief Close the file in the flow * * \param s http state * \param data data chunk if any * \param data_len length of the data portion * \param flags flags to indicate events * \param direction flow direction * * Currently on the FLOW_FILE_TRUNCATED flag is implemented, indicating * that the file isn't complete but we're stopping storing it. * * \retval 0 ok * \retval -1 error * \retval -2 not storing files on this flow/tx */ int HTPFileClose(HtpState *s, const uint8_t *data, uint32_t data_len, uint8_t flags, uint8_t direction) { SCEnter(); int retval = 0; int result = 0; FileContainer *files = NULL; if (s == NULL) { SCReturnInt(-1); } if (direction & STREAM_TOCLIENT) { files = s->files_tc; } else { files = s->files_ts; } if (files == NULL) { retval = -1; goto end; } result = FileCloseFile(files, data, data_len, flags); if (result == -1) { retval = -1; } else if (result == -2) { retval = -2; } FilePrune(files); end: SCReturnInt(retval); } #ifdef UNITTESTS static int HTPFileParserTest01(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *http_state = NULL; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } static int HTPFileParserTest02(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 337\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"email\"\r\n" "\r\n" "someaddress@somedomain.lan\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } static int HTPFileParserTest03(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 337\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"email\"\r\n" "\r\n" "someaddress@somedomain.lan\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "file"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "content\r\n"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint8_t httpbuf6[] = "-----------------------------277531038314945--"; uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 5 size %u <<<<\n", httplen5); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 6 size %u <<<<\n", httplen6); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { goto end; } if (http_state->files_ts->head == NULL || FileDataSize(http_state->files_ts->head) != 11) { if (http_state->files_ts->head != NULL) printf("filedata len not 11 but %"PRIu64": ", FileDataSize(http_state->files_ts->head)); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } static int HTPFileParserTest04(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 373\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"email\"\r\n" "\r\n" "someaddress@somedomain.lan\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "file0123456789abcdefghijklmnopqrstuvwxyz"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ uint8_t httpbuf5[] = "content\r\n"; uint32_t httplen5 = sizeof(httpbuf5) - 1; /* minus the \0 */ uint8_t httpbuf6[] = "-----------------------------277531038314945--"; uint32_t httplen6 = sizeof(httpbuf6) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 5 size %u <<<<\n", httplen5); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf5, httplen5); if (r != 0) { printf("toserver chunk 5 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 6 size %u <<<<\n", httplen6); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf6, httplen6); if (r != 0) { printf("toserver chunk 6 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s: ", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } static int HTPFileParserTest05(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 544\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------277531038314945\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "Content-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "FILECONTENT\r\n" "-----------------------------277531038314945--"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 size %u <<<<\n", httplen1); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { goto end; } if (http_state->files_ts->head == http_state->files_ts->tail) goto end; if (http_state->files_ts->head->next != http_state->files_ts->tail) goto end; if (StreamingBufferCompareRawData(http_state->files_ts->head->sb, (uint8_t *)"filecontent", 11) != 1) { goto end; } if (StreamingBufferCompareRawData(http_state->files_ts->tail->sb, (uint8_t *)"FILECONTENT", 11) != 1) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test first multipart part contains file but doesn't end in first chunk */ static int HTPFileParserTest06(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 544\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "filecontent\r\n" "-----------------------------27753103831494"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "5\r\nContent-Disposition: form-data; name=\"uploadfile_1\"; filename=\"somepicture2.jpg\"\r\n" "Content-Type: image/jpeg\r\n" "\r\n" "FILECONTENT\r\n" "-----------------------------277531038314945--"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 size %u <<<<\n", httplen1); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { goto end; } if (http_state->files_ts->head == http_state->files_ts->tail) goto end; if (http_state->files_ts->head->next != http_state->files_ts->tail) goto end; if (StreamingBufferCompareRawData(http_state->files_ts->head->sb, (uint8_t *)"filecontent", 11) != 1) { goto end; } if (StreamingBufferCompareRawData(http_state->files_ts->tail->sb, (uint8_t *)"FILECONTENT", 11) != 1) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test POST, but not multipart */ static int HTPFileParserTest07(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /filename HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Length: 11\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "FILECONTENT"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 size %u <<<<\n", httplen1); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { printf("state != FILE_STATE_CLOSED"); goto end; } if (StreamingBufferCompareRawData(http_state->files_ts->tail->sb, (uint8_t *)"FILECONTENT", 11) != 1) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } static int HTPFileParserTest08(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 215\r\n" "\r\n" "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Content-Type: image/jpeg\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "filecontent\r\n\r\n" "-----------------------------277531038314945--"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ TcpSession ssn; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); HtpState *http_state = NULL; memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events == NULL) { printf("no app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); if (decoder_events->cnt != 2) { printf("expected 2 events: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test invalid header: Somereallylongheaderstr: has no value */ static int HTPFileParserTest09(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 337\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"email\"\r\n" "\r\n" "someaddress@somedomain.lan\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Somereallylongheaderstr:\r\n" "\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events == NULL) { printf("no app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); if (decoder_events->cnt != 1) { printf("expected 1 event: "); goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test empty entries */ static int HTPFileParserTest10(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=---------------------------277531038314945\r\n" "Content-Length: 337\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "-----------------------------277531038314945\r\n" "\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "-----------------------------277531038314945\r\n" "Content-Disposition: form-data; name=\"uploadfile_0\"; filename=\"somepicture1.jpg\"\r\n" "Somereallylongheaderstr: with a good value\r\n" "\r\n"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "filecontent\r\n" "-----------------------------277531038314945--"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); result = 0; FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); result = 0; goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events != NULL) { printf("app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } /** \test filedata cut in two pieces */ static int HTPFileParserTest11(void) { int result = 0; Flow *f = NULL; uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n" "Host: www.server.lan\r\n" "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Length: 1102\r\n" "\r\n"; uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ uint8_t httpbuf2[] = "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"; uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */ uint8_t httpbuf3[] = "Content-Disposition: form-data; name=\"PROGRESS_URL\"\r\n" "\r\n" "http://somserver.com/progress.php?UPLOAD_IDENTIFIER=XXXXXXXXX.XXXXXXXXXX.XXXXXXXX.XX.X\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"DESTINATION_DIR\"\r\n" "\r\n" "10\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"js_enabled\"\r\n" "\r\n" "1" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"signature\"\r\n" "\r\n" "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"upload_files\"\r\n" "\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"terms\"\r\n" "\r\n" "1" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"file[]\"\r\n" "\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"description[]\"\r\n" "\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n" "Content-Disposition: form-data; name=\"upload_file[]\"; filename=\"filename.doc\"\r\n" "Content-Type: application/msword\r\n" "\r\n" "FILE"; uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */ uint8_t httpbuf4[] = "CONTENT\r\n" "------WebKitFormBoundaryBRDbP74mBhBxsIdo--"; uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */ TcpSession ssn; HtpState *http_state = NULL; AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); memset(&ssn, 0, sizeof(ssn)); f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80); if (f == NULL) goto end; f->protoctx = &ssn; f->proto = IPPROTO_TCP; StreamTcpInitConfig(TRUE); SCLogDebug("\n>>>> processing chunk 1 <<<<\n"); FLOWLOCK_WRLOCK(f); int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_START, httpbuf1, httplen1); if (r != 0) { printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2); if (r != 0) { printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3); if (r != 0) { printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4); FLOWLOCK_WRLOCK(f); r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_HTTP, STREAM_TOSERVER | STREAM_EOF, httpbuf4, httplen4); if (r != 0) { printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); http_state = f->alstate; if (http_state == NULL) { printf("no http state: "); goto end; } FLOWLOCK_WRLOCK(f); AppLayerDecoderEvents *decoder_events = AppLayerParserGetEventsByTx(IPPROTO_TCP, ALPROTO_HTTP,f->alstate, 0); if (decoder_events != NULL) { printf("app events: "); FLOWLOCK_UNLOCK(f); goto end; } FLOWLOCK_UNLOCK(f); htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, http_state, 0); if (tx == NULL) { goto end; } if (tx->request_method == NULL || memcmp(bstr_util_strdup_to_c(tx->request_method), "POST", 4) != 0) { printf("expected method POST, got %s \n", bstr_util_strdup_to_c(tx->request_method)); goto end; } if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL || http_state->files_ts->tail->state != FILE_STATE_CLOSED) { printf("state != FILE_STATE_CLOSED: "); goto end; } if (StreamingBufferCompareRawData(http_state->files_ts->head->sb, (uint8_t *)"FILECONTENT", 11) != 1) { goto end; } result = 1; end: if (alp_tctx != NULL) AppLayerParserThreadCtxFree(alp_tctx); StreamTcpFreeConfig(TRUE); if (http_state != NULL) HTPStateFree(http_state); UTHFreeFlow(f); return result; } #endif /* UNITTESTS */ void HTPFileParserRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("HTPFileParserTest01", HTPFileParserTest01); UtRegisterTest("HTPFileParserTest02", HTPFileParserTest02); UtRegisterTest("HTPFileParserTest03", HTPFileParserTest03); UtRegisterTest("HTPFileParserTest04", HTPFileParserTest04); UtRegisterTest("HTPFileParserTest05", HTPFileParserTest05); UtRegisterTest("HTPFileParserTest06", HTPFileParserTest06); UtRegisterTest("HTPFileParserTest07", HTPFileParserTest07); UtRegisterTest("HTPFileParserTest08", HTPFileParserTest08); UtRegisterTest("HTPFileParserTest09", HTPFileParserTest09); UtRegisterTest("HTPFileParserTest10", HTPFileParserTest10); UtRegisterTest("HTPFileParserTest11", HTPFileParserTest11); #endif /* UNITTESTS */ } suricata-3.2.1/src/detect-bytetest.c0000644000000000000000000015305713051004444014271 00000000000000/* Copyright (C) 2007-2010 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Brian Rectanus * * Implements byte_test keyword. */ #include "suricata-common.h" #include "debug.h" #include "decode.h" #include "detect.h" #include "detect-engine.h" #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" #include "detect-bytetest.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" #include "app-layer.h" #include "util-byte.h" #include "util-unittest.h" #include "util-debug.h" #include "detect-pcre.h" /** * \brief Regex for parsing our options */ /** \todo We probably just need a simple tokenizer here */ #define PARSE_REGEX "^\\s*" \ "([^\\s,]+)" \ "\\s*,\\s*(\\!?)\\s*([^\\s,]*)" \ "\\s*,\\s*([^\\s,]+)" \ "\\s*,\\s*([^\\s,]+)" \ "(?:\\s*,\\s*([^\\s,]+))?" \ "(?:\\s*,\\s*([^\\s,]+))?" \ "(?:\\s*,\\s*([^\\s,]+))?" \ "(?:\\s*,\\s*([^\\s,]+))?" \ "(?:\\s*,\\s*([^\\s,]+))?" \ "\\s*$" static pcre *parse_regex; static pcre_extra *parse_regex_study; void DetectBytetestRegisterTests(void); void DetectBytetestRegister (void) { sigmatch_table[DETECT_BYTETEST].name = "byte_test"; sigmatch_table[DETECT_BYTETEST].Match = DetectBytetestMatch; sigmatch_table[DETECT_BYTETEST].Setup = DetectBytetestSetup; sigmatch_table[DETECT_BYTETEST].Free = DetectBytetestFree; sigmatch_table[DETECT_BYTETEST].RegisterTests = DetectBytetestRegisterTests; sigmatch_table[DETECT_BYTETEST].flags |= SIGMATCH_PAYLOAD; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); } /** \brief Bytetest detection code * * Byte test works on the packet payload. * * \param det_ctx thread de ctx * \param s signature * \param m sigmatch for this bytettest * \param payload ptr to the start of the buffer to inspect * \param payload_len length of the payload * \retval 1 match * \retval 0 no match */ int DetectBytetestDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, const SigMatchCtx *ctx, uint8_t *payload, uint32_t payload_len, uint8_t flags, int32_t offset, uint64_t value) { SCEnter(); const DetectBytetestData *data = (const DetectBytetestData *)ctx; uint8_t *ptr = NULL; int32_t len = 0; uint64_t val = 0; int extbytes; int neg; int match; if (payload_len == 0) { SCReturnInt(0); } /* Calculate the ptr value for the bytetest and length remaining in * the packet from that point. */ if (flags & DETECT_BYTETEST_RELATIVE) { SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", " "data->offset %"PRIi32"", det_ctx->buffer_offset, data->offset); ptr = payload + det_ctx->buffer_offset; len = payload_len - det_ctx->buffer_offset; ptr += offset; len -= offset; /* No match if there is no relative base */ if (ptr == NULL || len <= 0) { SCReturnInt(0); } //PrintRawDataFp(stdout,ptr,len); } else { SCLogDebug("absolute, data->offset %"PRIi32"", data->offset); ptr = payload + offset; len = payload_len - offset; } /* Validate that the to-be-extracted is within the packet * \todo Should this validate it is in the *payload*? */ if (ptr < payload || data->nbytes > len) { SCLogDebug("Data not within payload pkt=%p, ptr=%p, len=%"PRIu32", nbytes=%d", payload, ptr, len, data->nbytes); SCReturnInt(0); } neg = flags & DETECT_BYTETEST_NEGOP; /* Extract the byte data */ if (flags & DETECT_BYTETEST_STRING) { extbytes = ByteExtractStringUint64(&val, data->base, data->nbytes, (const char *)ptr); if (extbytes <= 0) { /* strtoull() return 0 if there is no numeric value in data string */ if (val == 0) { SCLogDebug("No Numeric value"); SCReturnInt(0); } else { SCLogError(SC_ERR_INVALID_NUM_BYTES, "Error extracting %d " "bytes of string data: %d", data->nbytes, extbytes); SCReturnInt(-1); } } SCLogDebug("comparing base %d string 0x%" PRIx64 " %s%c 0x%" PRIx64 "", data->base, val, (neg ? "!" : ""), data->op, data->value); } else { int endianness = (flags & DETECT_BYTETEST_LITTLE) ? BYTE_LITTLE_ENDIAN : BYTE_BIG_ENDIAN; extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr); if (extbytes != data->nbytes) { SCLogError(SC_ERR_INVALID_NUM_BYTES, "Error extracting %d bytes " "of numeric data: %d\n", data->nbytes, extbytes); SCReturnInt(-1); } SCLogDebug("comparing numeric 0x%" PRIx64 " %s%c 0x%" PRIx64 "", val, (neg ? "!" : ""), data->op, data->value); } /* Compare using the configured operator */ match = 0; switch (data->op) { case DETECT_BYTETEST_OP_EQ: if (val == value) { match = 1; } break; case DETECT_BYTETEST_OP_LT: if (val < value) { match = 1; } break; case DETECT_BYTETEST_OP_GT: if (val > value) { match = 1; } break; case DETECT_BYTETEST_OP_AND: if (val & value) { match = 1; } break; case DETECT_BYTETEST_OP_OR: if (val ^ value) { match = 1; } break; case DETECT_BYTETEST_OP_GE: if (val >= value) { match = 1; } break; case DETECT_BYTETEST_OP_LE: if (val <= value) { match = 1; } break; default: /* Should never get here as we handle this in parsing. */ SCReturnInt(-1); } /* A successful match depends on negation */ if ((!neg && match) || (neg && !match)) { SCLogDebug("MATCH"); SCReturnInt(1); } SCLogDebug("NO MATCH"); SCReturnInt(0); } int DetectBytetestMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) { return DetectBytetestDoMatch(det_ctx, s, ctx, p->payload, p->payload_len, ((DetectBytetestData *)ctx)->flags, 0, 0); } DetectBytetestData *DetectBytetestParse(char *optstr, char **value, char **offset) { DetectBytetestData *data = NULL; char *args[9] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }; #define MAX_SUBSTRINGS 30 int ret = 0, res = 0; int ov[MAX_SUBSTRINGS]; int i; uint32_t nbytes; const char *str_ptr = NULL; /* Execute the regex and populate args with captures. */ ret = pcre_exec(parse_regex, parse_regex_study, optstr, strlen(optstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 6 || ret > 10) { SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32 ", string %s", ret, optstr); goto error; } for (i = 0; i < (ret - 1); i++) { res = pcre_get_substring((char *)optstr, ov, MAX_SUBSTRINGS, i + 1, &str_ptr); if (res < 0) { SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed " "for arg %d", i + 1); goto error; } args[i] = (char *)str_ptr; } /* Initialize the data */ data = SCMalloc(sizeof(DetectBytetestData)); if (unlikely(data == NULL)) goto error; data->base = DETECT_BYTETEST_BASE_UNSET; data->flags = 0; /* * The first four options are required and positional. The * remaining arguments are flags and are not positional. */ /* Number of bytes */ if (ByteExtractStringUint32(&nbytes, 10, 0, args[0]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed number of bytes: %s", str_ptr); goto error; } /* Operator is next two args: neg + op */ data->op = 0; if (args[1] != NULL && *args[1] == '!') { data->flags |= DETECT_BYTETEST_NEGOP; } if (args[2] != NULL) { if ((strcmp("=", args[2]) == 0) || ((data->flags & DETECT_BYTETEST_NEGOP) && strcmp("", args[2]) == 0)) { data->op |= DETECT_BYTETEST_OP_EQ; } else if (strcmp("<", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_LT; } else if (strcmp(">", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_GT; } else if (strcmp("&", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_AND; } else if (strcmp("^", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_OR; } else if (strcmp(">=", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_GE; } else if (strcmp("<=", args[2]) == 0) { data->op |= DETECT_BYTETEST_OP_LE; } else { SCLogError(SC_ERR_INVALID_OPERATOR, "Invalid operator"); goto error; } } /* Value */ if (args[3][0] != '-' && isalpha((unsigned char)args[3][0])) { if (value == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "byte_test supplied with " "var name for value. \"value\" argument supplied to " "this function has to be non-NULL"); goto error; } *value = SCStrdup(args[3]); if (*value == NULL) goto error; } else { if (ByteExtractStringUint64(&data->value, 0, 0, args[3]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, "Malformed value: %s", str_ptr); goto error; } } /* Offset */ if (args[4][0] != '-' && isalpha((unsigned char)args[4][0])) { if (offset == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "byte_test supplied with " "var name for offset. \"offset\" argument supplied to " "this function has to be non-NULL"); goto error; } *offset = SCStrdup(args[4]); if (*offset == NULL) goto error; } else { if (ByteExtractStringInt32(&data->offset, 0, 0, args[4]) <= 0) { SCLogError(SC_ERR_INVALID_VALUE, " Malformed offset: %s", str_ptr); goto error; } } /* The remaining options are flags. */ /** \todo Error on dups? */ for (i = 5; i < (ret - 1); i++) { if (args[i] != NULL) { if (strcmp("relative", args[i]) == 0) { data->flags |= DETECT_BYTETEST_RELATIVE; } else if (strcasecmp("string", args[i]) == 0) { data->flags |= DETECT_BYTETEST_STRING; } else if (strcasecmp("dec", args[i]) == 0) { data->base |= DETECT_BYTETEST_BASE_DEC; } else if (strcasecmp("hex", args[i]) == 0) { data->base |= DETECT_BYTETEST_BASE_HEX; } else if (strcasecmp("oct", args[i]) == 0) { data->base |= DETECT_BYTETEST_BASE_OCT; } else if (strcasecmp("big", args[i]) == 0) { if (data->flags & DETECT_BYTETEST_LITTLE) { data->flags ^= DETECT_BYTETEST_LITTLE; } data->flags |= DETECT_BYTETEST_BIG; } else if (strcasecmp("little", args[i]) == 0) { data->flags |= DETECT_BYTETEST_LITTLE; } else if (strcasecmp("dce", args[i]) == 0) { data->flags |= DETECT_BYTETEST_DCE; } else { SCLogError(SC_ERR_UNKNOWN_VALUE, "Unknown value: \"%s\"", args[i]); goto error; } } } if (data->flags & DETECT_BYTETEST_STRING) { /* 23 - This is the largest string (octal, with a zero prefix) that * will not overflow uint64_t. The only way this length * could be over 23 and still not overflow is if it were zero * prefixed and we only support 1 byte of zero prefix for octal. * * "01777777777777777777777" = 0xffffffffffffffff */ if (nbytes > 23) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot test more than 23 bytes with \"string\": %s", optstr); goto error; } } else { if (nbytes > 8) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot test more than 8 bytes without \"string\": %s", optstr); goto error; } if (data->base != DETECT_BYTETEST_BASE_UNSET) { SCLogError(SC_ERR_INVALID_VALUE, "Cannot use a base without \"string\": %s", optstr); goto error; } } /* This is max 23 so it will fit in a byte (see above) */ data->nbytes = (uint8_t)nbytes; for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } return data; error: for (i = 0; i < (ret - 1); i++){ if (args[i] != NULL) SCFree(args[i]); } if (data != NULL) DetectBytetestFree(data); return NULL; } int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) { SigMatch *sm = NULL; SigMatch *prev_pm = NULL; DetectBytetestData *data = NULL; char *value = NULL; char *offset = NULL; int ret = -1; data = DetectBytetestParse(optstr, &value, &offset); if (data == NULL) goto error; int sm_list; if (s->list != DETECT_SM_LIST_NOTSET) { if (s->list == DETECT_SM_LIST_FILEDATA) { if (data->flags & DETECT_BYTETEST_DCE) { SCLogError(SC_ERR_INVALID_SIGNATURE, "dce bytetest specified " "with file_data option set."); goto error; } AppLayerHtpEnableResponseBodyCallback(); } sm_list = s->list; s->flags |= SIG_FLAG_APPLAYER; if (data->flags & DETECT_BYTETEST_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[sm_list], DETECT_PCRE, s->sm_lists_tail[sm_list]); } } else if (data->flags & DETECT_BYTETEST_DCE) { if (data->flags & DETECT_BYTETEST_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 12, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; } } else { sm_list = DETECT_SM_LIST_PMATCH; } s->alproto = ALPROTO_DCERPC; s->flags |= SIG_FLAG_APPLAYER; } else if (data->flags & DETECT_BYTETEST_RELATIVE) { prev_pm = SigMatchGetLastSMFromLists(s, 168, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_FILEDATA], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSMDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HSCDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HUADMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HHHDMATCH], DETECT_ISDATAAT, s->sm_lists_tail[DETECT_SM_LIST_HRHHDMATCH]); if (prev_pm == NULL) { sm_list = DETECT_SM_LIST_PMATCH; } else { sm_list = SigMatchListSMBelongsTo(s, prev_pm); if (sm_list < 0) goto error; } } else { sm_list = DETECT_SM_LIST_PMATCH; } if (data->flags & DETECT_BYTETEST_DCE) { if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Non dce alproto sig has " "bytetest with dce enabled"); goto error; } if ((data->flags & DETECT_BYTETEST_STRING) || (data->flags & DETECT_BYTETEST_LITTLE) || (data->flags & DETECT_BYTETEST_BIG) || (data->base == DETECT_BYTETEST_BASE_DEC) || (data->base == DETECT_BYTETEST_BASE_HEX) || (data->base == DETECT_BYTETEST_BASE_OCT) ) { SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Invalid option. " "A byte_test keyword with dce holds other invalid modifiers."); goto error; } } if (value != NULL) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(value, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var " "seen in byte_test - %s\n", value); goto error; } data->value = ((DetectByteExtractData *)bed_sm->ctx)->local_id; data->flags |= DETECT_BYTETEST_VALUE_BE; SCFree(value); } if (offset != NULL) { SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s); if (bed_sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var " "seen in byte_test - %s\n", offset); goto error; } data->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id; data->flags |= DETECT_BYTETEST_OFFSET_BE; SCFree(offset); } sm = SigMatchAlloc(); if (sm == NULL) goto error; sm->type = DETECT_BYTETEST; sm->ctx = (SigMatchCtx *)data; SigMatchAppendSMToList(s, sm, sm_list); if (!(data->flags & DETECT_BYTETEST_RELATIVE)) goto okay; if (prev_pm == NULL) goto okay; if (prev_pm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)prev_pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else if (prev_pm->type == DETECT_PCRE) { DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx; pd->flags |= DETECT_PCRE_RELATIVE_NEXT; } okay: ret = 0; return ret; error: DetectBytetestFree(data); return ret; } /** * \brief this function will free memory associated with DetectBytetestData * * \param data pointer to DetectBytetestData */ void DetectBytetestFree(void *ptr) { if (ptr == NULL) return; DetectBytetestData *data = (DetectBytetestData *)ptr; SCFree(data); } /* UNITTESTS */ #ifdef UNITTESTS #include "util-unittest-helper.h" /** * \test DetectBytetestTestParse01 is a test to make sure that we return "something" * when given valid bytetest opt */ int DetectBytetestTestParse01(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, =, 1 , 0", NULL, NULL); if (data != NULL) { DetectBytetestFree(data); result = 1; } return result; } /** * \test DetectBytetestTestParse02 is a test for setting the required opts */ int DetectBytetestTestParse02(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, !=, 1, 0", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 4) && (data->value == 1) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_NEGOP) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse03 is a test for setting the relative flag */ int DetectBytetestTestParse03(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, !=, 1, 0, relative", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 4) && (data->value == 1) && (data->offset == 0) && (data->flags == ( DETECT_BYTETEST_NEGOP |DETECT_BYTETEST_RELATIVE)) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse04 is a test for setting the string/oct flags */ int DetectBytetestTestParse04(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, !=, 1, 0, string, oct", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 4) && (data->value == 1) && (data->offset == 0) && (data->flags == ( DETECT_BYTETEST_NEGOP |DETECT_BYTETEST_STRING)) && (data->base == DETECT_BYTETEST_BASE_OCT)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse05 is a test for setting the string/dec flags */ int DetectBytetestTestParse05(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, =, 1, 0, string, dec", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 4) && (data->value == 1) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_STRING) && (data->base == DETECT_BYTETEST_BASE_DEC)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse06 is a test for setting the string/hex flags */ int DetectBytetestTestParse06(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, >, 1, 0, string, hex", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_GT) && (data->nbytes == 4) && (data->value == 1) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_STRING) && (data->base == DETECT_BYTETEST_BASE_HEX)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse07 is a test for setting the big flag */ int DetectBytetestTestParse07(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, <, 5, 0, big", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_LT) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags == 4) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse08 is a test for setting the little flag */ int DetectBytetestTestParse08(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, <, 5, 0, little", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_LT) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_LITTLE) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse09 is a test for neg operator only */ int DetectBytetestTestParse09(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, !, 5, 0", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_NEGOP) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse10 is a test for whitespace */ int DetectBytetestTestParse10(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse(" 4 , ! &, 5 , 0 , little ", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_AND) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags == (DETECT_BYTETEST_NEGOP|DETECT_BYTETEST_LITTLE)) && (data->base == DETECT_BYTETEST_BASE_UNSET)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse11 is a test for whitespace */ int DetectBytetestTestParse11(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4,!^,5,0,little,string,relative,hex", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_OR) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags == ( DETECT_BYTETEST_NEGOP |DETECT_BYTETEST_LITTLE |DETECT_BYTETEST_STRING |DETECT_BYTETEST_RELATIVE)) && (data->base == DETECT_BYTETEST_BASE_HEX)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse12 is a test for hex w/o string */ int DetectBytetestTestParse12(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, =, 1, 0, hex", NULL, NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytetestTestParse13 is a test for too many bytes to extract */ int DetectBytetestTestParse13(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("9, =, 1, 0", NULL, NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytetestTestParse14 is a test for large string extraction */ int DetectBytetestTestParse14(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("23,=,0xffffffffffffffffULL,0,string,oct", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_EQ) && (data->nbytes == 23) && (data->value == 0xffffffffffffffffULL) && (data->offset == 0) && (data->flags == DETECT_BYTETEST_STRING) && (data->base == DETECT_BYTETEST_BASE_OCT)) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test DetectBytetestTestParse15 is a test for too many bytes to extract (string) */ int DetectBytetestTestParse15(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("24, =, 0xffffffffffffffffULL, 0, string", NULL, NULL); if (data == NULL) { result = 1; } return result; } /** * \test DetectBytetestTestParse16 is a test for offset too big */ int DetectBytetestTestParse16(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4,=,0,0xffffffffffffffffULL", NULL, NULL); if (data == NULL) { result = 1; } return result; } /** * \test Test dce option. */ int DetectBytetestTestParse17(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, <, 5, 0, dce", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_LT) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && (data->flags & DETECT_BYTETEST_DCE) ) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test Test dce option. */ int DetectBytetestTestParse18(void) { int result = 0; DetectBytetestData *data = NULL; data = DetectBytetestParse("4, <, 5, 0", NULL, NULL); if (data != NULL) { if ( (data->op == DETECT_BYTETEST_OP_LT) && (data->nbytes == 4) && (data->value == 5) && (data->offset == 0) && !(data->flags & DETECT_BYTETEST_DCE) ) { result = 1; } DetectBytetestFree(data); } return result; } /** * \test Test dce option. */ int DetectBytetestTestParse19(void) { Signature *s = SigAlloc(); if (s == NULL) return 0; int result = 1; s->alproto = ALPROTO_DCERPC; result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,dce") == 0); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,string,dce") == -1); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,big,dce") == -1); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,little,dce") == -1); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,hex,dce") == -1); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,oct,dce") == -1); result &= (DetectBytetestSetup(NULL, s, "1,=,1,6,dec,dce") == -1); SigFree(s); return result; } /** * \test Test dce option. */ int DetectBytetestTestParse20(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; DetectBytetestData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_test:1,=,1,6,relative,dce; sid:1;)"); if (de_ctx->sig_list == NULL) { result = 0; goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTETEST); bd = (DetectBytetestData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (!(bd->flags & DETECT_BYTETEST_DCE) && !(bd->flags & DETECT_BYTETEST_RELATIVE) && (bd->flags & DETECT_BYTETEST_STRING) && (bd->flags & DETECT_BYTETEST_BIG) && (bd->flags & DETECT_BYTETEST_LITTLE) && (bd->flags & DETECT_BYTETEST_NEGOP) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_test:1,=,1,6,relative,dce; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTETEST); bd = (DetectBytetestData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if (!(bd->flags & DETECT_BYTETEST_DCE) && !(bd->flags & DETECT_BYTETEST_RELATIVE) && (bd->flags & DETECT_BYTETEST_STRING) && (bd->flags & DETECT_BYTETEST_BIG) && (bd->flags & DETECT_BYTETEST_LITTLE) && (bd->flags & DETECT_BYTETEST_NEGOP) ) { result = 0; goto end; } s->next = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "dce_stub_data; " "content:\"one\"; distance:0; " "byte_test:1,=,1,6,relative; sid:1;)"); if (s->next == NULL) { result = 0; goto end; } s = s->next; if (s->sm_lists_tail[DETECT_SM_LIST_DMATCH] == NULL) { result = 0; goto end; } result &= (s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->type == DETECT_BYTETEST); bd = (DetectBytetestData *)s->sm_lists_tail[DETECT_SM_LIST_DMATCH]->ctx; if ((bd->flags & DETECT_BYTETEST_DCE) && !(bd->flags & DETECT_BYTETEST_RELATIVE) && (bd->flags & DETECT_BYTETEST_STRING) && (bd->flags & DETECT_BYTETEST_BIG) && (bd->flags & DETECT_BYTETEST_LITTLE) && (bd->flags & DETECT_BYTETEST_NEGOP) ) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test dce option. */ int DetectBytetestTestParse21(void) { DetectEngineCtx *de_ctx = NULL; int result = 1; Signature *s = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,string,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,big,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,little,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,hex,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,dec,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,oct,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,string,hex,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,big,string,hex,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,big,string,oct,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,little,string,hex,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } s = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"Testing bytetest_body\"; " "dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; " "content:\"one\"; byte_test:1,=,1,6,big,string,dec,dce; sid:1;)"); if (s != NULL) { result = 0; goto end; } end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test Test file_data */ static int DetectBytetestTestParse22(void) { DetectEngineCtx *de_ctx = NULL; int result = 0; Signature *s = NULL; DetectBytetestData *bd = NULL; de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) goto end; de_ctx->flags |= DE_QUIET; de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(file_data; byte_test:1,=,1,6,relative; sid:1;)"); if (de_ctx->sig_list == NULL) { printf("sig parse failed: "); goto end; } s = de_ctx->sig_list; if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA] == NULL) { printf("empty server body list: "); goto end; } if (s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->type != DETECT_BYTETEST) { printf("bytetest not last sm in server body list: "); goto end; } bd = (DetectBytetestData *)s->sm_lists_tail[DETECT_SM_LIST_FILEDATA]->ctx; if (bd->flags & DETECT_BYTETEST_DCE && bd->flags & DETECT_BYTETEST_RELATIVE && (bd->flags & DETECT_BYTETEST_STRING) && (bd->flags & DETECT_BYTETEST_BIG) && (bd->flags & DETECT_BYTETEST_LITTLE) && (bd->flags & DETECT_BYTETEST_NEGOP) ) { printf("wrong flags: "); goto end; } result = 1; end: SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineCtxFree(de_ctx); return result; } /** * \test DetectByteTestTestPacket01 is a test to check matches of * byte_test and byte_test relative works if the previous keyword is pcre * (bug 142) */ int DetectByteTestTestPacket01 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"pcre + byte_test + " "relative\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\"; byte_test:1,=,1" ",6,relative,string,dec; sid:126; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** * \test DetectByteTestTestPacket02 is a test to check matches of * byte_test and byte_test relative works if the previous keyword is byte_jump * (bug 158) */ int DetectByteTestTestPacket02 (void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"content + byte_test + " "relative\"; byte_jump:1,44,string,dec; byte_test:1,=,0,0,relative,string," "dec; sid:777; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } int DetectByteTestTestPacket03(void) { int result = 0; uint8_t *buf = NULL; uint16_t buflen = 0; buf = SCMalloc(4); if (unlikely(buf == NULL)) { printf("malloc failed\n"); exit(EXIT_FAILURE); } memcpy(buf, "boom", 4); buflen = 4; Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"content + byte_test\"; " "byte_test:1,=,65,214748364; sid:1; rev:1;)"; result = !UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** \test Test the byte_test signature matching with operator <= */ int DetectByteTestTestPacket04(void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"content + byte_test +" "relative\"; content:\"GET \"; depth:4; content:\"HTTP/1.\"; " "byte_test:1,<=,0,0,relative,string,dec; sid:124; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } /** \test Test the byte_test signature matching with operator >= */ int DetectByteTestTestPacket05(void) { int result = 0; uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0" "User-Agent: Wget/1.11.4" "Accept: */*" "Host: www.google.com" "Connection: Keep-Alive" "Date: Mon, 04 Jan 2010 17:29:39 GMT"; uint16_t buflen = strlen((char *)buf); Packet *p; p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); if (p == NULL) goto end; char sig[] = "alert tcp any any -> any any (msg:\"content + byte_test +" "relative\"; content:\"GET \"; depth:4; content:\"HTTP/1.\"; " "byte_test:1,>=,0,0,relative,string,dec; sid:125; rev:1;)"; result = UTHPacketMatchSig(p, sig); UTHFreePacket(p); end: return result; } #endif /* UNITTESTS */ /** * \brief this function registers unit tests for DetectBytetest */ void DetectBytetestRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("DetectBytetestTestParse01", DetectBytetestTestParse01); UtRegisterTest("DetectBytetestTestParse02", DetectBytetestTestParse02); UtRegisterTest("DetectBytetestTestParse03", DetectBytetestTestParse03); UtRegisterTest("DetectBytetestTestParse04", DetectBytetestTestParse04); UtRegisterTest("DetectBytetestTestParse05", DetectBytetestTestParse05); UtRegisterTest("DetectBytetestTestParse06", DetectBytetestTestParse06); UtRegisterTest("DetectBytetestTestParse07", DetectBytetestTestParse07); UtRegisterTest("DetectBytetestTestParse08", DetectBytetestTestParse08); UtRegisterTest("DetectBytetestTestParse09", DetectBytetestTestParse09); UtRegisterTest("DetectBytetestTestParse10", DetectBytetestTestParse10); UtRegisterTest("DetectBytetestTestParse11", DetectBytetestTestParse11); UtRegisterTest("DetectBytetestTestParse12", DetectBytetestTestParse12); UtRegisterTest("DetectBytetestTestParse13", DetectBytetestTestParse13); UtRegisterTest("DetectBytetestTestParse14", DetectBytetestTestParse14); UtRegisterTest("DetectBytetestTestParse15", DetectBytetestTestParse15); UtRegisterTest("DetectBytetestTestParse17", DetectBytetestTestParse17); UtRegisterTest("DetectBytetestTestParse18", DetectBytetestTestParse18); UtRegisterTest("DetectBytetestTestParse19", DetectBytetestTestParse19); UtRegisterTest("DetectBytetestTestParse20", DetectBytetestTestParse20); UtRegisterTest("DetectBytetestTestParse21", DetectBytetestTestParse21); UtRegisterTest("DetectBytetestTestParse22", DetectBytetestTestParse22); UtRegisterTest("DetectByteTestTestPacket01", DetectByteTestTestPacket01); UtRegisterTest("DetectByteTestTestPacket02", DetectByteTestTestPacket02); UtRegisterTest("DetectByteTestTestPacket03", DetectByteTestTestPacket03); UtRegisterTest("DetectByteTestTestPacket04", DetectByteTestTestPacket04); UtRegisterTest("DetectByteTestTestPacket05", DetectByteTestTestPacket05); #endif /* UNITTESTS */ } suricata-3.2.1/src/alert-fastlog.c0000644000000000000000000002732113051004444013716 00000000000000/* Copyright (C) 2007-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Victor Julien * * Logs alerts in a line based text format compatible to Snort's * alert_fast format. * * \todo Support classifications * \todo Support more than just IPv4/IPv6 TCP/UDP. */ #include "suricata-common.h" #include "debug.h" #include "detect.h" #include "flow.h" #include "conf.h" #include "threads.h" #include "tm-threads.h" #include "threadvars.h" #include "util-debug.h" #include "util-unittest.h" #include "util-unittest-helper.h" #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-reference.h" #include "util-classification-config.h" #include "output.h" #include "alert-fastlog.h" #include "util-privs.h" #include "util-print.h" #include "util-proto-name.h" #include "util-optimize.h" #include "util-logopenfile.h" #include "util-time.h" #define DEFAULT_LOG_FILENAME "fast.log" #define MODULE_NAME "AlertFastLog" /* The largest that size allowed for one alert string. */ #define MAX_FASTLOG_ALERT_SIZE 2048 /* The largest alert buffer that will be written at one time, possibly * holding multiple alerts. */ #define MAX_FASTLOG_BUFFER_SIZE (2 * MAX_FASTLOG_ALERT_SIZE) TmEcode AlertFastLogThreadInit(ThreadVars *, void *, void **); TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *); void AlertFastLogExitPrintStats(ThreadVars *, void *); void AlertFastLogRegisterTests(void); static void AlertFastLogDeInitCtx(OutputCtx *); int AlertFastLogCondition(ThreadVars *tv, const Packet *p); int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p); void AlertFastLogRegister(void) { OutputRegisterPacketModule(LOGGER_ALERT_FAST, MODULE_NAME, "fast", AlertFastLogInitCtx, AlertFastLogger, AlertFastLogCondition, AlertFastLogThreadInit, AlertFastLogThreadDeinit, AlertFastLogExitPrintStats); AlertFastLogRegisterTests(); } typedef struct AlertFastLogThread_ { /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */ LogFileCtx* file_ctx; } AlertFastLogThread; int AlertFastLogCondition(ThreadVars *tv, const Packet *p) { return (p->alerts.cnt ? TRUE : FALSE); } static inline void AlertFastLogOutputAlert(AlertFastLogThread *aft, char *buffer, int alert_size) { SCMutex *file_lock = &aft->file_ctx->fp_mutex; /* Output the alert string and count alerts. Only need to lock here. */ SCMutexLock(file_lock); aft->file_ctx->alerts++; aft->file_ctx->Write(buffer, alert_size, aft->file_ctx); SCMutexUnlock(file_lock); } int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p) { AlertFastLogThread *aft = (AlertFastLogThread *)data; int i; char timebuf[64]; int decoder_event = 0; CreateTimeString(&p->ts, timebuf, sizeof(timebuf)); char srcip[46], dstip[46]; if (PKT_IS_IPV4(p)) { PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip)); PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip)); } else if (PKT_IS_IPV6(p)) { PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip)); PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip)); } else { decoder_event = 1; } /* Buffer to store the generated alert strings. The buffer is * filled with alert strings until it doesn't have room to store * another full alert, only then is the buffer written. This is * more efficient for multiple alerts and only slightly slower for * single alerts. */ char alert_buffer[MAX_FASTLOG_BUFFER_SIZE]; for (i = 0; i < p->alerts.cnt; i++) { const PacketAlert *pa = &p->alerts.alerts[i]; if (unlikely(pa->s == NULL)) { continue; } char *action = ""; if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) { action = "[Drop] "; } else if (pa->action & ACTION_DROP) { action = "[wDrop] "; } char proto[16] = ""; if (likely(decoder_event == 0)) { if (SCProtoNameValid(IP_GET_IPPROTO(p)) == TRUE) { strlcpy(proto, known_proto[IP_GET_IPPROTO(p)], sizeof(proto)); } else { snprintf(proto, sizeof(proto), "PROTO:%03" PRIu32, IP_GET_IPPROTO(p)); } } /* Create the alert string without locking. */ int size = 0; if (likely(decoder_event == 0)) { PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "%s %s[**] [%" PRIu32 ":%" PRIu32 ":%" PRIu32 "] %s [**] [Classification: %s] [Priority: %"PRIu32"]" " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "\n", timebuf, action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio, proto, srcip, p->sp, dstip, p->dp); } else { PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "%s %s[**] [%" PRIu32 ":%" PRIu32 ":%" PRIu32 "] %s [**] [Classification: %s] [Priority: " "%" PRIu32 "] [**] [Raw pkt: ", timebuf, action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio); PrintBufferRawLineHex(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); if (p->pcap_cnt != 0) { PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "] [pcap file packet: %"PRIu64"]\n", p->pcap_cnt); } else { PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "]\n"); } } /* Write the alert to output file */ AlertFastLogOutputAlert(aft, alert_buffer, size); } return TM_ECODE_OK; } TmEcode AlertFastLogThreadInit(ThreadVars *t, void *initdata, void **data) { AlertFastLogThread *aft = SCMalloc(sizeof(AlertFastLogThread)); if (unlikely(aft == NULL)) return TM_ECODE_FAILED; memset(aft, 0, sizeof(AlertFastLogThread)); if(initdata == NULL) { SCLogDebug("Error getting context for AlertFastLog. \"initdata\" argument NULL"); SCFree(aft); return TM_ECODE_FAILED; } /** Use the Ouptut Context (file pointer and mutex) */ aft->file_ctx = ((OutputCtx *)initdata)->data; *data = (void *)aft; return TM_ECODE_OK; } TmEcode AlertFastLogThreadDeinit(ThreadVars *t, void *data) { AlertFastLogThread *aft = (AlertFastLogThread *)data; if (aft == NULL) { return TM_ECODE_OK; } /* clear memory */ memset(aft, 0, sizeof(AlertFastLogThread)); SCFree(aft); return TM_ECODE_OK; } void AlertFastLogExitPrintStats(ThreadVars *tv, void *data) { AlertFastLogThread *aft = (AlertFastLogThread *)data; if (aft == NULL) { return; } //SCLogInfo("Fast log output wrote %" PRIu64 " alerts", aft->file_ctx->alerts); } /** * \brief Create a new LogFileCtx for "fast" output style. * \param conf The configuration node for this output. * \return A LogFileCtx pointer on success, NULL on failure. */ OutputCtx *AlertFastLogInitCtx(ConfNode *conf) { LogFileCtx *logfile_ctx = LogFileNewCtx(); if (logfile_ctx == NULL) { SCLogDebug("AlertFastLogInitCtx2: Could not create new LogFileCtx"); return NULL; } if (SCConfLogOpenGeneric(conf, logfile_ctx, DEFAULT_LOG_FILENAME, 1) < 0) { LogFileFreeCtx(logfile_ctx); return NULL; } OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); if (unlikely(output_ctx == NULL)) return NULL; output_ctx->data = logfile_ctx; output_ctx->DeInit = AlertFastLogDeInitCtx; return output_ctx; } static void AlertFastLogDeInitCtx(OutputCtx *output_ctx) { LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data; LogFileFreeCtx(logfile_ctx); SCFree(output_ctx); } /*------------------------------Unittests-------------------------------------*/ #ifdef UNITTESTS static int AlertFastLogTest01() { int result = 0; uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } de_ctx->flags |= DE_QUIET; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"FastLog test\"; content:\"GET\"; " "Classtype:unknown; sid:1;)"); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt == 1) { result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0); } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); return result; } static int AlertFastLogTest02() { int result = 0; uint8_t *buf = (uint8_t *) "GET /one/ HTTP/1.1\r\n" "Host: one.example.org\r\n"; uint16_t buflen = strlen((char *)buf); Packet *p = NULL; ThreadVars th_v; DetectEngineThreadCtx *det_ctx; memset(&th_v, 0, sizeof(th_v)); p = UTHBuildPacket(buf, buflen, IPPROTO_TCP); DetectEngineCtx *de_ctx = DetectEngineCtxInit(); if (de_ctx == NULL) { return result; } de_ctx->flags |= DE_QUIET; FILE *fd = SCClassConfGenerateValidDummyClassConfigFD01(); SCClassConfLoadClassficationConfigFile(de_ctx, fd); de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " "(msg:\"FastLog test\"; content:\"GET\"; " "Classtype:unknown; sid:1;)"); SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); SigMatchSignatures(&th_v, de_ctx, det_ctx, p); if (p->alerts.cnt == 1) { result = (strcmp(p->alerts.alerts[0].s->class_msg, "Unknown are we") == 0); if (result == 0) printf("p->alerts.alerts[0].class_msg %s: ", p->alerts.alerts[0].s->class_msg); } SigGroupCleanup(de_ctx); SigCleanSignatures(de_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineCtxFree(de_ctx); UTHFreePackets(&p, 1); return result; } #endif /* UNITTESTS */ /** * \brief This function registers unit tests for AlertFastLog API. */ void AlertFastLogRegisterTests(void) { #ifdef UNITTESTS UtRegisterTest("AlertFastLogTest01", AlertFastLogTest01); UtRegisterTest("AlertFastLogTest02", AlertFastLogTest02); #endif /* UNITTESTS */ } suricata-3.2.1/Makefile.am0000644000000000000000000000750113051004444012251 00000000000000# not a GNU package. You can remove this line, if # have all needed files, that a GNU package needs AUTOMAKE_OPTIONS = foreign 1.4 ACLOCAL_AMFLAGS = -I m4 EXTRA_DIST = ChangeLog COPYING LICENSE suricata.yaml.in \ classification.config threshold.config \ reference.config SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts CLEANFILES = stamp-h[0-9]* install-data-am: @echo "Run 'make install-conf' if you want to install initial configuration files. Or 'make install-full' to install configuration and rules"; install-full: install install-conf install-rules install-conf: install -d "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/suricata.yaml" || install -m 600 "$(top_srcdir)/suricata.yaml" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/classification.config" || install -m 600 "$(top_srcdir)/classification.config" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/reference.config" || install -m 600 "$(top_srcdir)/reference.config" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/threshold.config" || install -m 600 "$(top_srcdir)/threshold.config" "$(DESTDIR)$(e_sysconfdir)" install -d "$(DESTDIR)$(e_logfilesdir)" install -d "$(DESTDIR)$(e_logcertsdir)" install -d "$(DESTDIR)$(e_rundir)" install -m 770 -d "$(DESTDIR)$(e_localstatedir)" install-rules: install -d "$(DESTDIR)$(e_sysconfrulesdir)" if HAVE_FETCH_COMMAND if HAVE_WGET_COMMAND $(HAVE_WGET) -qO - https://rules.emergingthreats.net/open/suricata-3.0/emerging.rules.tar.gz | tar -x -z -C "$(DESTDIR)$(e_sysconfdir)" -f - else $(HAVE_CURL) -s https://rules.emergingthreats.net/open/suricata-3.0/emerging.rules.tar.gz | tar -x -z -C "$(DESTDIR)$(e_sysconfdir)" -f - endif else @echo "UNABLE to load ruleset wget or curl are not installed on system." endif @test -e "$(DESTDIR)$(e_sysconfrulesdir)decoder-events.rules" || install -m 600 "$(top_srcdir)/rules/decoder-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)stream-events.rules" || install -m 600 "$(top_srcdir)/rules/stream-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)smtp-events.rules" || install -m 600 "$(top_srcdir)/rules/smtp-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)http-events.rules" || install -m 600 "$(top_srcdir)/rules/http-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)dns-events.rules" || install -m 600 "$(top_srcdir)/rules/dns-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)tls-events.rules" || install -m 600 "$(top_srcdir)/rules/tls-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)modbus-events.rules" || install -m 600 "$(top_srcdir)/rules/modbus-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)app-layer-events.rules" || install -m 600 "$(top_srcdir)/rules/app-layer-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)dnp3-events.rules" || install -m 600 "$(top_srcdir)/rules/dnp3-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @echo "" @echo "You can now start suricata by running as root something like '$(DESTDIR)$(bindir)/suricata -c $(DESTDIR)$(e_sysconfdir)/suricata.yaml -i eth0'." @echo "" @echo "If a library like libhtp.so is not found, you can run suricata with:" @echo "'LD_LIBRARY_PATH="$(DESTDIR)$(prefix)/lib" "$(DESTDIR)$(bindir)/suricata" -c "$(DESTDIR)$(e_sysconfdir)/suricata.yaml" -i eth0'." @echo "" @echo "While rules are installed now, it's highly recommended to use a rule manager for maintaining rules." @echo "The two most common are Oinkmaster and Pulledpork. For a guide see:" @echo "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster" suricata-3.2.1/configure.ac0000644000000000000000000024172213051004451012506 00000000000000 AC_INIT(suricata, 3.2.1) m4_ifndef([AM_SILENT_RULES], [m4_define([AM_SILENT_RULES],[])])AM_SILENT_RULES([yes]) m4_ifndef([AS_VERSION_COMPARE], [AC_DEFUN([AS_VERSION_COMPARE],[])]) AC_CONFIG_HEADERS([config.h]) AC_CONFIG_SRCDIR([src/suricata.c]) AC_CONFIG_MACRO_DIR(m4) AM_INIT_AUTOMAKE AC_DEFINE([RELEASE], [1], [Official release]) AC_LANG_C AC_PROG_CC_C99 AC_PROG_LIBTOOL PKG_PROG_PKG_CONFIG(0.21) # 0.21 is the CentOS 5.11 version dnl Taken from https://llvm.org/svn/llvm-project/llvm/trunk/autoconf/configure.ac dnl check if we compile using clang or gcc. On some systems the gcc binary is dnl is actually clang, so do a compile test. AC_MSG_CHECKING([whether GCC or Clang is our compiler]) AC_LANG_PUSH([C]) compiler=unknown AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#if ! __clang__ #error #endif ]])], compiler=clang, [AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#if ! __GNUC__ #error #endif ]])], compiler=gcc, [])]) AC_LANG_POP([C]) AC_MSG_RESULT([${compiler}]) case "$compiler" in clang) CLANG_CFLAGS="-Wextra -Werror-implicit-function-declaration -Wno-error=unused-command-line-argument" AC_MSG_CHECKING([clang __sync_bool_compare_and_swap support]) AC_TRY_COMPILE([#include ], [ unsigned int i = 0; (void)__sync_bool_compare_and_swap(&i, 1, 1);], [ AC_DEFINE([__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1], [1], [Fake GCC atomic support]) AC_DEFINE([__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2], [1], [Fake GCC atomic support]) AC_DEFINE([__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4], [1], [Fake GCC atomic support]) AC_DEFINE([__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8], [1], [Fake GCC atomic support]) AC_MSG_RESULT([yes]) ], [AC_MSG_RESULT([no])]) AC_SUBST(CLANG_CFLAGS) ;; gcc) dnl get gcc version AC_MSG_CHECKING([gcc version]) gccver=$($CC -dumpversion) gccvermajor=$(echo $gccver | cut -d . -f1) gccverminor=$(echo $gccver | cut -d . -f2) gccvernum=$(expr $gccvermajor "*" 100 + $gccverminor) AC_MSG_RESULT($gccver) if test "$gccvernum" -ge "400"; then dnl gcc 4.0 or later GCC_CFLAGS="-Wextra -Werror-implicit-function-declaration" # remove optimization options that break our code # VJ 2010/06/27: no-tree-pre added. It breaks ringbuffers code. GCC_CFLAGS="$GCC_CFLAGS -fno-tree-pre" else GCC_CFLAGS="-W" fi AC_SUBST(GCC_CFLAGS) ;; *) AC_MSG_WARN([unsupported/untested compiler, this may or may not work]) ;; esac # Checks for programs. AC_PROG_AWK AC_PROG_CC AC_PROG_CPP AC_PROG_INSTALL AC_PROG_LN_S AC_PROG_MAKE_SET AC_PATH_PROG(HAVE_PKG_CONFIG, pkg-config, "no") if test "$HAVE_PKG_CONFIG" = "no"; then echo echo " ERROR! pkg-config not found, go get it " echo " http://pkg-config.freedesktop.org/wiki/ " echo " or install from your distribution " echo exit 1 fi AC_ARG_ENABLE(python, AS_HELP_STRING([--enable-python], [Enable python]),,[enable_python=yes]) AC_PATH_PROG(HAVE_PYTHON_CONFIG, python, "no") if test "x$enable_python" = "xno" ; then echo echo " Warning! python disabled, you will not be " echo " able to install suricatasc unix socket client " echo enable_python="no" fi if test "$HAVE_PYTHON_CONFIG" = "no"; then echo echo " Warning! python not found, you will not be " echo " able to install suricatasc unix socket client " echo enable_python="no" fi AM_CONDITIONAL([HAVE_PYTHON], [test "x$enable_python" = "xyes"]) AC_PATH_PROG(HAVE_WGET, wget, "no") if test "$HAVE_WGET" = "no"; then AC_PATH_PROG(HAVE_CURL, curl, "no") if test "$HAVE_CURL" = "no"; then echo echo " Warning curl or wget not found, you won't be able to" echo " download latest ruleset with 'make install-rules'" fi fi AM_CONDITIONAL([HAVE_FETCH_COMMAND], [test "x$HAVE_WGET" != "xno" || test "x$HAVE_CURL" != "xno"]) AM_CONDITIONAL([HAVE_WGET_COMMAND], [test "x$HAVE_WGET" != "xno"]) # Checks for libraries. # Checks for header files. AC_CHECK_HEADERS([stddef.h]) AC_CHECK_HEADERS([arpa/inet.h assert.h ctype.h errno.h fcntl.h inttypes.h]) AC_CHECK_HEADERS([getopt.h]) AC_CHECK_HEADERS([limits.h netdb.h netinet/in.h poll.h sched.h signal.h]) AC_CHECK_HEADERS([stdarg.h stdint.h stdio.h stdlib.h string.h strings.h sys/ioctl.h]) AC_CHECK_HEADERS([syslog.h sys/prctl.h sys/socket.h sys/stat.h sys/syscall.h]) AC_CHECK_HEADERS([sys/time.h time.h unistd.h]) AC_CHECK_HEADERS([sys/ioctl.h linux/if_ether.h linux/if_packet.h linux/filter.h]) AC_CHECK_HEADERS([linux/ethtool.h linux/sockios.h]) AC_CHECK_HEADER(glob.h,,[AC_ERROR(glob.h not found ...)]) AC_CHECK_HEADERS([dirent.h fnmatch.h]) AC_CHECK_HEADERS([sys/socket.h net/if.h sys/mman.h linux/if_arp.h], [], [], [[#ifdef HAVE_SYS_SOCKET_H #include #include #endif ]]) AC_CHECK_HEADERS([windows.h winsock2.h ws2tcpip.h w32api/wtypes.h], [], [], [[ #ifndef _X86_ #define _X86_ #endif ]]) AC_CHECK_HEADERS([w32api/winbase.h], [], [], [[ #ifndef _X86_ #define _X86_ #endif #include ]]) # Checks for typedefs, structures, and compiler characteristics. AC_C_INLINE AC_TYPE_PID_T AC_TYPE_SIZE_T AC_TYPE_INT32_T AC_TYPE_UINT16_T AC_TYPE_UINT32_T AC_TYPE_UINT64_T AC_TYPE_UINT8_T AC_HEADER_STDBOOL # Checks for library functions. AC_FUNC_MALLOC AC_FUNC_REALLOC AC_CHECK_FUNCS([gettimeofday memset strcasecmp strchr strdup strerror strncasecmp strtol strtoul memchr memrchr]) OCFLAGS=$CFLAGS CFLAGS="" AC_CHECK_FUNCS([strlcpy strlcat]) CFLAGS=$OCFLAGS # Add large file support AC_SYS_LARGEFILE #check for os AC_MSG_CHECKING([host os]) # lua pkg-config name differs per OS LUA_PC_NAME="lua5.1" LUA_LIB_NAME="lua5.1" # If no host os was detected, try with uname if test -z "$host" ; then host="`uname`" fi echo -n "installation for $host OS... " e_magic_file="" e_magic_file_comment="#" case "$host" in *-*-*freebsd*) LUA_PC_NAME="lua-5.1" LUA_LIB_NAME="lua-5.1" CFLAGS="${CFLAGS} -DOS_FREEBSD" CPPFLAGS="${CPPFLAGS} -I/usr/local/include -I/usr/local/include/libnet11" LDFLAGS="${LDFLAGS} -L/usr/local/lib -L/usr/local/lib/libnet11" ;; *-*-openbsd*) LUA_PC_NAME="lua51" CFLAGS="${CFLAGS} -D__OpenBSD__" CPPFLAGS="${CPPFLAGS} -I/usr/local/include -I/usr/local/include/libnet-1.1" LDFLAGS="${LDFLAGS} -L/usr/local/lib -I/usr/local/lib/libnet-1.1" ;; *darwin*|*Darwin*) LUA_PC_NAME="lua-5.1" LUA_LIB_NAME="lua-5.1" CFLAGS="${CFLAGS} -DOS_DARWIN" CPPFLAGS="${CPPFLAGS} -I/opt/local/include" LDFLAGS="${LDFLAGS} -L/opt/local/lib" ;; *-*-linux*) #for now do nothing ;; *-*-mingw32*) CFLAGS="${CFLAGS} -DOS_WIN32" LDFLAGS="${LDFLAGS} -lws2_32" WINDOWS_PATH="yes" ;; *-*-cygwin) LUA_PC_NAME="lua" LUA_LIB_NAME="lua" WINDOWS_PATH="yes" ;; *-*-solaris*) AC_MSG_WARN([support for Solaris/Illumos/SunOS is experimental]) LDFLAGS="${LDFLAGS} -lsocket -lnsl" ;; *) AC_MSG_WARN([unsupported OS this may or may not work]) ;; esac AC_MSG_RESULT(ok) # enable modifications for AFL fuzzing AC_ARG_ENABLE(afl, AS_HELP_STRING([--enable-afl], Enable AFL fuzzing logic[])], [enable_afl="$enableval"],[enable_afl=no]) AS_IF([test "x$enable_afl" = "xyes"], [ AC_DEFINE([AFLFUZZ_NO_RANDOM], [1], [Disable all use of random functions]) AC_DEFINE([AFLFUZZ_DISABLE_MGTTHREADS], [1], [Disable all management threads]) AC_DEFINE([AFLFUZZ_PCAP_RUNMODE], [1], [Enable special AFL 'single' runmode]) AC_DEFINE([AFLFUZZ_CONF_TEST], [1], [Enable special --afl-parse-rules commandline option]) AC_DEFINE([AFLFUZZ_APPLAYER], [1], [Enable --afl-$proto-request commandline option]) AC_DEFINE([AFLFUZZ_MIME], [1], [Enable --afl-mime commandline option]) AC_DEFINE([AFLFUZZ_DECODER], [1], [Enable --afl-decoder-$proto commandline option]) AC_DEFINE([AFLFUZZ_DER], [1], [Enable --afl-der commandline option]) AC_DEFINE([AFLFUZZ_RULES], [1], [Enable --afl-rules commandline option]) # test for AFL PERSISTANT_MODE support CFLAGS_ORIG=$CFLAGS CFLAGS="-Werror" AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[while (__AFL_LOOP(1000))]])], [AC_DEFINE([AFLFUZZ_PERSISTANT_MODE], [1], [Enable AFL PERSISTANT_MODE])], []) CFLAGS=$CFLAGS_ORIG ]) # disable TLS on user request AC_ARG_ENABLE(threading-tls, AS_HELP_STRING([--disable-threading-tls], [Disable TLS (thread local storage)]), [enable_tls="$enableval"],[enable_tls=yes]) AS_IF([test "x$enable_tls" = "xyes"], [ # check if our target supports thread local storage AC_MSG_CHECKING(for thread local storage __thread support) AC_TRY_COMPILE([#include ], [ static __thread int i; i = 1; i++; ], [AC_DEFINE([TLS], [1], [Thread local storage]) AC_MSG_RESULT([yes]) ], [AC_MSG_RESULT([no])]) ]) #Enable support for gcc compile time security options. There is no great way to do detection of valid cflags that I have found #AX_CFLAGS_GCC_OPTION don't seem to do a better job than the code below and are a pain because of extra m4 files etc. #These flags seem to be supported on CentOS 5+, Ubuntu 8.04+, and FedoreCore 11+ #Options are taken from https://wiki.ubuntu.com/CompilerFlags AC_ARG_ENABLE(gccprotect, AS_HELP_STRING([--enable-gccprotect], [Detect and use gcc hardening options]),,[enable_gccprotect=no]) AS_IF([test "x$enable_gccprotect" = "xyes"], [ #buffer overflow protection AC_MSG_CHECKING(for -fstack-protector) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fstack-protector" AC_TRY_LINK(,,SECCFLAGS="-fstack-protector" AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) CFLAGS="${TMPCFLAGS}" #compile-time best-practices errors for certain libc functions, provides checks of buffer lengths and memory regions AC_MSG_CHECKING(for -D_FORTIFY_SOURCE=2) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" AC_TRY_COMPILE(,,SECCFLAGS="${SECCFLAGS} -D_FORTIFY_SOURCE=2" AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) CFLAGS="${TMPCFLAGS}" #compile-time warnings about misuse of format strings AC_MSG_CHECKING(for -Wformat -Wformat-security) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wformat -Wformat-security" AC_TRY_COMPILE(,,SECCFLAGS="${SECCFLAGS} -Wformat -Wformat-security" AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) CFLAGS="${TMPCFLAGS}" #provides a read-only relocation table area in the final ELF AC_MSG_CHECKING(for -z relro) TMPLDFLAGS="${LDFLAGS}" LDFLAGS="${LDFLAGS} -z relro" AC_TRY_LINK(,,SECLDFLAGS="${SECLDFLAGS} -z relro" AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) LDFLAGS="${TMPLDFLAGS}" #forces all relocations to be resolved at run-time AC_MSG_CHECKING(for -z now) TMPLDFLAGS="${LDFLAGS}" LDFLAGS="${LDFLAGS} -z now" AC_TRY_LINK(,,SECLDFLAGS="${SECLDFLAGS} -z now" AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) LDFLAGS="${TMPLDFLAGS}" AC_SUBST(SECCFLAGS) AC_SUBST(SECLDFLAGS) ]) #enable profile generation AC_ARG_ENABLE(gccprofile, AS_HELP_STRING([--enable-gccprofile], [Enable gcc profile info i.e -pg flag is set]),,[enable_gccprofile=no]) AS_IF([test "x$enable_gccprofile" = "xyes"], [ CFLAGS="${CFLAGS} -pg" ]) #enable gcc march=native gcc 4.2 or later AC_ARG_ENABLE(gccmarch_native, AS_HELP_STRING([--enable-gccmarch-native], [Enable gcc march=native gcc 4.2 and later only]),,[enable_gccmarch_native=yes]) AS_IF([test "x$enable_gccmarch_native" = "xyes"], [ case "$host" in *powerpc*) ;; *) OFLAGS="$CFLAGS" CFLAGS="$CFLAGS -march=native" AC_MSG_CHECKING([checking if $CC supports -march=native]) AC_COMPILE_IFELSE( [AC_LANG_PROGRAM([[#include ]])], [ AC_MSG_RESULT([yes]) OPTIMIZATION_CFLAGS="-march=native" AC_SUBST(OPTIMIZATION_CFLAGS) ], [ AC_MSG_RESULT([no]) CFLAGS="$OFLAGS" enable_gccmarch_native=no ] ) ;; esac ]) # options # enable the running of unit tests AC_ARG_ENABLE(unittests, AS_HELP_STRING([--enable-unittests], [Enable compilation of the unit tests]),,[enable_unittests=no]) AS_IF([test "x$enable_unittests" = "xyes"], [ AC_DEFINE([UNITTESTS],[1],[Enable built-in unittests]) ]) AM_CONDITIONAL([BUILD_UNITTESTS], [test "x$enable_unittests" = "xyes"]) # enable workaround for old barnyard2 for unified alert output AC_ARG_ENABLE(old-barnyard2, AS_HELP_STRING([--enable-old-barnyard2], [Use workaround for old barnyard2 in unified2 output]),,[enable_old_barnyard2=no]) AS_IF([test "x$enable_old_barnyard2" = "xyes"], [ AC_DEFINE([HAVE_OLD_BARNYARD2],[1],[Use workaround for old barnyard2 in unified2 output]) ]) # enable debug output AC_ARG_ENABLE(debug, AS_HELP_STRING([--enable-debug], [Enable debug output]),,[enable_debug=no]) AS_IF([test "x$enable_debug" = "xyes"], [ AC_DEFINE([DEBUG],[1],[Enable debug output]) ]) AM_CONDITIONAL([DEBUG], [test "x$enable_debug" = "xyes"]) # enable debug validation functions & macro's output AC_ARG_ENABLE(debug-validation, AS_HELP_STRING([--enable-debug-validation], [Enable (debug) validation code output]),,[enable_debug_validation=no]) AS_IF([test "x$enable_debug_validation" = "xyes"], [ if test "$enable_unittests" = "yes"; then AC_MSG_ERROR([debug_validation can't be enabled with enabled unittests!]) else AC_DEFINE([DEBUG_VALIDATION],[1],[Enable (debug) validation code output]) fi ]) # profiling support AC_ARG_ENABLE(profiling, AS_HELP_STRING([--enable-profiling], [Enable performance profiling]),,[enable_profiling=no]) AS_IF([test "x$enable_profiling" = "xyes"], [ case "$host" in *-*-openbsd*) AC_MSG_ERROR([profiling is not supported on OpenBSD]) ;; *) AC_DEFINE([PROFILING],[1],[Enable performance profiling]) ;; esac ]) # profiling support, locking AC_ARG_ENABLE(profiling-locks, AS_HELP_STRING([--enable-profiling-locks], [Enable performance profiling for locks]),,[enable_profiling_locks=no]) AS_IF([test "x$enable_profiling_locks" = "xyes"], [ AC_DEFINE([PROFILING],[1],[Enable performance profiling]) AC_DEFINE([PROFILE_LOCKING],[1],[Enable performance profiling for locks]) ]) # enable support for IPFW AC_ARG_ENABLE(ipfw, AS_HELP_STRING([--enable-ipfw], [Enable FreeBSD IPFW support for inline IDP]),,[enable_ipfw=no]) AS_IF([test "x$enable_ipfw" = "xyes"], [ AC_DEFINE([IPFW],[1],[Enable FreeBSD IPFW support for inline IDP]) ]) AC_ARG_ENABLE(coccinelle, AS_HELP_STRING([--disable-coccinelle], [Disable coccinelle QA steps during make check]),[enable_coccinelle="$enableval"],[enable_coccinelle=yes]) AS_IF([test "x$enable_coccinelle" = "xyes"], [ AC_PATH_PROG(HAVE_COCCINELLE_CONFIG, spatch, "no") if test "$HAVE_COCCINELLE_CONFIG" = "no"; then enable_coccinelle=no fi ]) AM_CONDITIONAL([HAVE_COCCINELLE], [test "x$enable_coccinelle" != "xno"]) # disable detection AC_ARG_ENABLE(detection, AS_HELP_STRING([--disable-detection], [Disable Detection Modules]), [enable_detection="$enableval"],[enable_detection=yes]) AS_IF([test "x$enable_detection" = "xno"], [ AC_DEFINE([HAVE_DETECT_DISABLED], [1], [Detection is disabled]) ]) # Tilera PCIE logging AM_CONDITIONAL([BUILD_PCIE_LOGGING], [test ! -z "$TILERA_ROOT"]) # libraries AC_MSG_CHECKING([for Mpipe]) AC_COMPILE_IFELSE( [AC_LANG_PROGRAM([[#include ]])], [ AC_MSG_RESULT([yes]) AC_DEFINE([HAVE_MPIPE],[1],[mPIPE support is available]) LDFLAGS="$LDFLAGS -lgxpci -lgxio -ltmc" ], [AC_MSG_RESULT([no])]) #libpcre AC_ARG_WITH(libpcre_includes, [ --with-libpcre-includes=DIR libpcre include directory], [with_libpcre_includes="$withval"],[with_libpcre_includes=no]) AC_ARG_WITH(libpcre_libraries, [ --with-libpcre-libraries=DIR libpcre library directory], [with_libpcre_libraries="$withval"],[with_libpcre_libraries="no"]) if test "$with_libpcre_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpcre_includes}" fi AC_CHECK_HEADER(pcre.h,,[AC_ERROR(pcre.h not found ...)]) if test "$with_libpcre_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpcre_libraries}" fi PCRE="" AC_CHECK_LIB(pcre, pcre_get_substring,, PCRE="no") if test "$PCRE" = "no"; then echo echo " ERROR! pcre library not found, go get it" echo " from www.pcre.org." echo exit 1 fi # libpcre 8.35 (especially on debian) has a known issue that results in segfaults # see https://redmine.openinfosecfoundation.org/issues/1693 if test "$with_libpcre_libraries" = "no"; then PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre = 8.35],[libpcre_buggy_found="yes"],[libprce_buggy_found="no"]) if test "$libpcre_buggy_found" = "yes"; then echo echo " Warning! vulnerable libpcre version 8.35 found" echo " This version has a known issue that could result in segfaults" echo " please upgrade to a newer version of pcre which you can get from" echo " www.pcre.org. For more information, see issue #1693" echo echo " Continuing for now with JIT disabled..." echo fi fi # To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work # see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful PCRE="" TMPLIBS="${LIBS}" AC_CHECK_LIB(pcre, pcre_dfa_exec,, PCRE="no") if test "$PCRE" = "no"; then echo echo " ERROR! pcre library was found but version was < 6.0" echo " please upgrade to a newer version of pcre which you can get from" echo " www.pcre.org." echo exit 1 fi LIBS="${TMPLIBS}" AC_TRY_COMPILE([ #include ], [ int eo = 0; eo |= PCRE_EXTRA_MATCH_LIMIT_RECURSION; ], [ pcre_match_limit_recursion_available=yes ], [:] ) if test "$pcre_match_limit_recursion_available" != "yes"; then echo echo " Warning! pcre extra opt PCRE_EXTRA_MATCH_LIMIT_RECURSION not found" echo " This could lead to potential DoS please upgrade to pcre >= 6.5" echo " from www.pcre.org." echo " Continuing for now...." echo AC_DEFINE([NO_PCRE_MATCH_RLIMIT],[1],[Pcre PCRE_EXTRA_MATCH_LIMIT_RECURSION not available]) fi TMPCFLAGS="${CFLAGS}" CFLAGS="-O0 -g -Werror -Wall" AC_TRY_COMPILE([ #include ], [ pcre_extra *extra = NULL; pcre_free_study(extra); ], [ AC_DEFINE([HAVE_PCRE_FREE_STUDY], [1], [Pcre pcre_free_study supported])], [:] ) CFLAGS="${TMPCFLAGS}" #enable support for PCRE-jit available since pcre-8.20 AC_MSG_CHECKING(for PCRE JIT support) AC_TRY_COMPILE([ #include ], [ int jit = 0; pcre_config(PCRE_CONFIG_JIT, &jit); ], [ pcre_jit_available=yes ], [ pcre_jit_available=no ] ) # bug 1693, libpcre 8.35 is broken and debian jessie is still using that if test "$libpcre_buggy_found" = "yes"; then pcre_jit_available="no, libpcre 8.35 blacklisted" fi if test "x$pcre_jit_available" = "xyes"; then AC_MSG_RESULT(yes) AC_DEFINE([PCRE_HAVE_JIT], [1], [Pcre with JIT compiler support enabled]) AC_MSG_CHECKING(for PCRE JIT support usability) AC_TRY_COMPILE([ #include ], [ const char* regexstr = "(a|b|c|d)"; pcre *re; const char *error; pcre_extra *extra; int err_offset; re = pcre_compile(regexstr,0, &error, &err_offset,NULL); extra = pcre_study(re, PCRE_STUDY_JIT_COMPILE, &error); if (extra == NULL) exit(EXIT_FAILURE); int jit = 0; int ret = pcre_fullinfo(re, extra, PCRE_INFO_JIT, &jit); if (ret != 0 || jit != 1) exit(EXIT_FAILURE); exit(EXIT_SUCCESS); ], [ pcre_jit_works=yes ], [:] ) if test "x$pcre_jit_works" != "xyes"; then AC_MSG_RESULT(no) echo echo " PCRE JIT support detection worked but testing it failed" echo " something odd is going on, please file a bug report." echo exit 1 else AC_MSG_RESULT(yes) fi else AC_MSG_RESULT(no) fi # libhs enable_hyperscan="no" # Try pkg-config first: PKG_CHECK_MODULES([libhs], libhs,, [with_pkgconfig_libhs=no]) if test "$with_pkgconfig_libhs" != "no"; then CPPFLAGS="${CPPFLAGS} ${libhs_CFLAGS}" LIBS="${LIBS} ${libhs_LIBS}" fi AC_ARG_WITH(libhs_includes, [ --with-libhs-includes=DIR libhs include directory], [with_libhs_includes="$withval"],[with_libhs_includes=no]) AC_ARG_WITH(libhs_libraries, [ --with-libhs-libraries=DIR libhs library directory], [with_libhs_libraries="$withval"],[with_libhs_libraries="no"]) if test "$with_libhs_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libhs_includes}" fi AC_CHECK_HEADER(hs.h,HYPERSCAN="yes",HYPERSCAN="no") if test "$HYPERSCAN" = "yes"; then if test "$with_libhs_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhs_libraries}" fi AC_CHECK_LIB(hs,hs_compile,,HYPERSCAN="no") AC_CHECK_FUNCS(hs_valid_platform) enable_hyperscan="yes" if test "$HYPERSCAN" = "no"; then echo echo " Hyperscan headers are present, but link test failed." echo " Check that you have a shared library and C++ linkage available." echo enable_hyperscan="no" fi fi AS_IF([test "x$enable_hyperscan" = "xyes"], [AC_DEFINE([BUILD_HYPERSCAN], [1], [Intel Hyperscan support enabled])]) # libyaml AC_ARG_WITH(libyaml_includes, [ --with-libyaml-includes=DIR libyaml include directory], [with_libyaml_includes="$withval"],[with_libyaml_includes=no]) AC_ARG_WITH(libyaml_libraries, [ --with-libyaml-libraries=DIR libyaml library directory], [with_libyaml_libraries="$withval"],[with_libyaml_libraries="no"]) if test "$with_libyaml_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libyaml_includes}" fi AC_CHECK_HEADER(yaml.h,,LIBYAML="no") if test "$with_libyaml_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libyaml_libraries}" fi LIBYAML="" AC_CHECK_LIB(yaml,yaml_parser_initialize,,LIBYAML="no") if test "$LIBYAML" = "no"; then echo echo " ERROR! libyaml library not found, go get it" echo " from http://pyyaml.org/wiki/LibYAML " echo " or your distribution:" echo echo " Ubuntu: apt-get install libyaml-dev" echo " Fedora: yum install libyaml-devel" echo exit 1 fi # libpthread AC_ARG_WITH(libpthread_includes, [ --with-libpthread-includes=DIR libpthread include directory], [with_libpthread_includes="$withval"],[with_libpthread_includes=no]) AC_ARG_WITH(libpthread_libraries, [ --with-libpthread-libraries=DIR libpthread library directory], [with_libpthread_libraries="$withval"],[with_libpthread_libraries="no"]) if test "$with_libpthread_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpthread_includes}" fi dnl AC_CHECK_HEADER(pthread.h,,[AC_ERROR(pthread.h not found ...)]) if test "$with_libpthread_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpthread_libraries}" fi PTHREAD="" AC_CHECK_LIB(pthread, pthread_create,, PTHREAD="no") if test "$PTHREAD" = "no"; then echo echo " ERROR! libpthread library not found, glibc problem?" echo exit 1 fi # libjansson enable_jansson="no" AC_ARG_WITH(libjansson_includes, [ --with-libjansson-includes=DIR libjansson include directory], [with_libjansson_includes="$withval"],[with_libjansson_includes=no]) AC_ARG_WITH(libjansson_libraries, [ --with-libjansson-libraries=DIR libjansson library directory], [with_libjansson_libraries="$withval"],[with_libjansson_libraries="no"]) if test "$with_libjansson_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libjansson_includes}" fi enable_jansson="no" enable_unixsocket="no" AC_ARG_ENABLE(unix-socket, AS_HELP_STRING([--enable-unix-socket], [Enable unix socket [default=test]]),[enable_unixsocket="$enableval"],[enable_unixsocket=test]) AC_CHECK_HEADER(jansson.h,JANSSON="yes",JANSSON="no") if test "$JANSSON" = "yes"; then if test "$with_libjansson_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libjansson_libraries}" fi AC_CHECK_LIB(jansson, json_dump_callback,, JANSSON="no") enable_jansson="yes" if test "$JANSSON" = "no"; then echo echo " Jansson >= 2.2 is required for features like unix socket" echo " Go get it from your distribution or from:" echo " http://www.digip.org/jansson/" echo if test "x$enable_unixsocket" = "xyes"; then exit 1 fi enable_unixsocket="no" enable_jansson="no" else case $host in *-*-mingw32*) ;; *-*-cygwin) ;; *) if test "x$enable_unixsocket" = "xtest"; then enable_unixsocket="yes" fi ;; esac fi else if test "x$enable_unixsocket" = "xyes"; then echo echo " Jansson >= 2.2 is required for features like unix socket" echo " Go get it from your distribution or from:" echo " http://www.digip.org/jansson/" echo exit 1 fi enable_unixsocket="no" fi AS_IF([test "x$enable_unixsocket" = "xyes"], [AC_DEFINE([BUILD_UNIX_SOCKET], [1], [Unix socket support enabled])]) e_enable_evelog=$enable_jansson AC_ARG_ENABLE(nflog, AS_HELP_STRING([--enable-nflog],[Enable libnetfilter_log support]), [ enable_nflog="yes"], [ enable_nflog="no"]) AC_ARG_ENABLE(nfqueue, AS_HELP_STRING([--enable-nfqueue], [Enable NFQUEUE support for inline IDP]),[enable_nfqueue=yes],[enable_nfqueue=no]) if test "$enable_nfqueue" != "no"; then PKG_CHECK_MODULES([libnetfilter_queue], [libnetfilter_queue], [enable_nfqueue=yes], [enable_nfqueue=no]) CPPFLAGS="${CPPFLAGS} ${libnetfilter_queue_CFLAGS}" fi if test "x$enable_nflog" = "xyes" || test "x$enable_nfqueue" = "xyes"; then # libnfnetlink case $host in *-*-mingw32*) ;; *) AC_ARG_WITH(libnfnetlink_includes, [ --with-libnfnetlink-includes=DIR libnfnetlink include directory], [with_libnfnetlink_includes="$withval"],[with_libnfnetlink_includes=no]) AC_ARG_WITH(libnfnetlink_libraries, [ --with-libnfnetlink-libraries=DIR libnfnetlink library directory], [with_libnfnetlink_libraries="$withval"],[with_libnfnetlink_libraries="no"]) if test "$with_libnfnetlink_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnfnetlink_includes}" fi if test "$with_libnfnetlink_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnfnetlink_libraries}" fi NFNL="" AC_CHECK_LIB(nfnetlink, nfnl_fd,, NFNL="no") if test "$NFNL" = "no"; then echo echo " ERROR! nfnetlink library not found, go get it" echo " from www.netfilter.org." echo " we automatically append libnetfilter_queue/ when searching" echo " for headers etc. when the --with-libnfnetlink-includes directive" echo " is used" echo fi ;; esac fi # enable support for NFQUEUE AS_IF([test "x$enable_nfqueue" = "xyes"], [ AC_DEFINE_UNQUOTED([NFQ],[1],[Enable Linux Netfilter NFQUEUE support for inline IDP]) #libnetfilter_queue AC_ARG_WITH(libnetfilter_queue_includes, [ --with-libnetfilter_queue-includes=DIR libnetfilter_queue include directory], [with_libnetfilter_queue_includes="$withval"],[with_libnetfilter_queue_includes=no]) AC_ARG_WITH(libnetfilter_queue_libraries, [ --with-libnetfilter_queue-libraries=DIR libnetfilter_queue library directory], [with_libnetfilter_queue_libraries="$withval"],[with_libnetfilter_queue_libraries="no"]) if test "$with_libnetfilter_queue_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnetfilter_queue_includes}" fi AC_CHECK_HEADER(libnetfilter_queue/libnetfilter_queue.h,,[AC_ERROR(libnetfilter_queue/libnetfilter_queue.h not found ...)]) if test "$with_libnetfilter_queue_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnetfilter_queue_libraries}" fi #LDFLAGS="${LDFLAGS} -lnetfilter_queue" NFQ="" case $host in *-*-mingw32*) AC_CHECK_LIB(netfilter_queue, nfq_open,, NFQ="no",-lws2_32) AC_ARG_WITH(netfilterforwin_includes, [ --with-netfilterforwin-includes=DIR netfilterforwin include directory], [with_netfilterforwin_includes="$withval"],[with_netfilterforwin_includes=no]) if test "$with_netfilterforwin_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_netfilterforwin_includes}" else CPPFLAGS="${CPPFLAGS} -I../../netfilterforwin" fi ;; *) AC_CHECK_LIB(netfilter_queue, nfq_open,, NFQ="no",) AC_CHECK_LIB([netfilter_queue], [nfq_set_queue_maxlen],AC_DEFINE_UNQUOTED([HAVE_NFQ_MAXLEN],[1],[Found queue max length support in netfilter_queue]) ,,[-lnfnetlink]) AC_CHECK_LIB([netfilter_queue], [nfq_set_verdict2],AC_DEFINE_UNQUOTED([HAVE_NFQ_SET_VERDICT2],[1],[Found nfq_set_verdict2 function in netfilter_queue]) ,,[-lnfnetlink]) AC_CHECK_LIB([netfilter_queue], [nfq_set_queue_flags],AC_DEFINE_UNQUOTED([HAVE_NFQ_SET_QUEUE_FLAGS],[1],[Found nfq_set_queue_flags function in netfilter_queue]) ,,[-lnfnetlink]) AC_CHECK_LIB([netfilter_queue], [nfq_set_verdict_batch],AC_DEFINE_UNQUOTED([HAVE_NFQ_SET_VERDICT_BATCH],[1],[Found nfq_set_verdict_batch function in netfilter_queue]) ,,[-lnfnetlink]) # check if the argument to nfq_get_payload is signed or unsigned AC_MSG_CHECKING([for signed nfq_get_payload payload argument]) STORECFLAGS="${CFLAGS}" if test `basename $CC` = "clang"; then CFLAGS="${CFLAGS} -Werror=incompatible-pointer-types" else CFLAGS="${CFLAGS} -Werror" fi AC_COMPILE_IFELSE( [AC_LANG_PROGRAM( [ #include #include ], [ char *pktdata; nfq_get_payload(NULL, &pktdata); ])], [libnetfilter_queue_nfq_get_payload_signed="yes"], [libnetfilter_queue_nfq_get_payload_signed="no"]) AC_MSG_RESULT($libnetfilter_queue_nfq_get_payload_signed) if test "x$libnetfilter_queue_nfq_get_payload_signed" = "xyes"; then AC_DEFINE([NFQ_GET_PAYLOAD_SIGNED], [1], [For signed version of nfq_get_payload]) fi CFLAGS="${STORECFLAGS}" ;; esac if test "$NFQ" = "no"; then echo echo " ERROR! libnetfilter_queue library not found, go get it" echo " from www.netfilter.org." echo " we automatically append libnetfilter_queue/ when searching" echo " for headers etc. when the --with-libnfq-includes directive" echo " is used" echo exit 1 fi ]) # libnetfilter_log AC_ARG_WITH(libnetfilter_log_includes, [ --with-libnetfilter_log-includes=DIR libnetfilter_log include directory], [with_libnetfilter_log_includes="$withval"],[with_libnetfilter_log_includes="no"]) AC_ARG_WITH(libnetfilter_log_libraries, [ --with-libnetfilter_log-libraries=DIR libnetfilter_log library directory], [with_libnetfilter_log_libraries="$withval"],[with_libnetfilter_log_libraries="no"]) if test "$enable_nflog" = "yes"; then if test "$with_libnetfilter_log_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnetfilter_log_includes}" fi AC_CHECK_HEADER(libnetfilter_log/libnetfilter_log.h,,[AC_ERROR(libnetfilter_log.h not found ...)]) if test "$with_libnetfilter_log_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnetfilter_log_libraries}" fi NFLOG="" AC_CHECK_LIB(netfilter_log, nflog_open,, NFLOG="no") if test "$NFLOG" = "no"; then echo echo " ERROR! libnetfilter_log library not found, go get it" echo " from http://www.netfilter.org." echo exit 1 else AC_DEFINE([HAVE_NFLOG],[1],[nflog available]) enable_nflog="yes" fi fi # prelude AC_ARG_ENABLE(prelude, AS_HELP_STRING([--enable-prelude], [Enable Prelude support for alerts]),,[enable_prelude=no]) # Prelude doesn't work with -Werror STORECFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wno-error=unused-result" AS_IF([test "x$enable_prelude" = "xyes"], [ AM_PATH_LIBPRELUDE(0.9.9, , AC_MSG_ERROR(Cannot find libprelude: Is libprelude-config in the path?), no) if test "x${LIBPRELUDE_CFLAGS}" != "x"; then CPPFLAGS="${CPPFLAGS} ${LIBPRELUDE_CFLAGS}" fi if test "x${LIBPRELUDE_LDFLAGS}" != "x"; then LDFLAGS="${LDFLAGS} ${LIBPRELUDE_LDFLAGS}" fi if test "x${LIBPRELUDE_LIBS}" != "x"; then LDFLAGS="${LDFLAGS} ${LIBPRELUDE_LIBS}" fi AC_DEFINE([PRELUDE], [1], [Libprelude support enabled]) ]) CFLAGS="${STORECFLAGS}" # libnet AC_ARG_WITH(libnet_includes, [ --with-libnet-includes=DIR libnet include directory], [with_libnet_includes="$withval"],[with_libnet_includes="no"]) AC_ARG_WITH(libnet_libraries, [ --with-libnet-libraries=DIR libnet library directory], [with_libnet_libraries="$withval"],[with_libnet_libraries="no"]) if test "x$with_libnet_includes" != "xno"; then CPPFLAGS="${CPPFLAGS} -I${with_libnet_includes}" libnet_dir="${with_libnet_includes}" else libnet_dir="/usr/include /usr/local/include /usr/local/include/libnet11 /opt/local/include /usr/local/include/libnet-1.1" fi if test "x$with_libnet_libraries" != "xno"; then LDFLAGS="${LDFLAGS} -L${with_libnet_libraries}" fi LIBNET_DETECT_FAIL="no" LIBNET_INC_DIR="" for i in $libnet_dir; do if test -r "$i/libnet.h"; then LIBNET_INC_DIR="$i" fi done enable_libnet="no" AC_MSG_CHECKING(for libnet.h version 1.1.x) if test "$LIBNET_INC_DIR" != ""; then LIBNET_VER=`grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep '1.[[12]]' | sed 's/[[^"]]*"\([[^"]]*\).*/\1/'` if test -z "$LIBNET_VER" ; then AC_MSG_RESULT(no) else AC_MSG_RESULT(yes) fi #CentOS, Fedora, Ubuntu-LTS, Ubuntu all set defines to the same values. libnet-config seems #to have been depreciated but all distro's seem to include it as part of the package. if test "$LIBNET_DETECT_FAIL" = "no"; then LLIBNET="" AC_CHECK_LIB(net, libnet_write,, LLIBNET="no") if test "$LLIBNET" != "no"; then AC_DEFINE([HAVE_LIBNET11],[1],(libnet 1.1 available)) AC_DEFINE([_DEFAULT_SOURCE],[1],(default source)) AC_DEFINE([_BSD_SOURCE],[1],(bsd source)) AC_DEFINE([__BSD_SOURCE],[1],(bsd source)) AC_DEFINE([__FAVOR_BSD],[1],(favor bsd)) AC_DEFINE([HAVE_NET_ETHERNET_H],[1],(ethernet.h)) enable_libnet="yes" fi # see if we have the patched libnet 1.1 # http://www.inliniac.net/blog/2007/10/16/libnet-11-ipv6-fixes-and-additions.html # # To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work # see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful if test "$enable_libnet" = "yes"; then LLIBNET="" TMPLIBS="${LIBS}" AC_CHECK_LIB(net, libnet_build_icmpv6_unreach,, LLIBNET="no") if test "$LLIBNET" != "no"; then AC_DEFINE([HAVE_LIBNET_ICMPV6_UNREACH],[1],(libnet_build_icmpv6_unreach available)) fi LIBS="${TMPLIBS}" fi # See if we have libnet 1.1.6 or newer - these versions handle capabilities correctly # Some patched 1.1.4 versions are also good, but it's not guaranteed for all distros. # # Details: https://bugzilla.redhat.com/show_bug.cgi?id=589770 AS_VERSION_COMPARE([LIBNET_VER], [1.1.6], [], [AC_DEFINE([HAVE_LIBNET_CAPABILITIES],[1], (libnet_have_capabilities_patch))], [AC_DEFINE([HAVE_LIBNET_CAPABILITIES],[1], (libnet_have_capabilities_patch))]) # check if the argument to libnet_init is char* or const char* AC_MSG_CHECKING([libnet_init dev type]) STORECFLAGS="${CFLAGS}" if test `basename $CC` = "clang"; then CFLAGS="${CFLAGS} -Werror=incompatible-pointer-types" else CFLAGS="${CFLAGS} -Werror" fi AC_COMPILE_IFELSE( [AC_LANG_PROGRAM( [ #include #include ], [[ const char dev[32] = ""; char ebuf[LIBNET_ERRBUF_SIZE]; (void)libnet_init(LIBNET_LINK, dev, ebuf); ]])], [libnet_init_const="yes"], [libnet_init_const="no"]) AC_MSG_RESULT($libnet_init_const) if test "x$libnet_init_const" = "xyes"; then AC_DEFINE([HAVE_LIBNET_INIT_CONST], [1], [libnet_init takes const argument]) fi CFLAGS="${STORECFLAGS}" fi else AC_MSG_RESULT(no) fi # libpcap AC_ARG_WITH(libpcap_includes, [ --with-libpcap-includes=DIR libpcap include directory], [with_libpcap_includes="$withval"],[with_libpcap_includes=no]) AC_ARG_WITH(libpcap_libraries, [ --with-libpcap-libraries=DIR libpcap library directory], [with_libpcap_libraries="$withval"],[with_libpcap_libraries="no"]) if test "$with_libpcap_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpcap_includes}" fi AC_CHECK_HEADER(pcap.h,,[AC_ERROR(pcap.h not found ...)]) if test "$with_libpcap_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpcap_libraries}" fi AC_CHECK_HEADERS([pcap.h pcap/pcap.h pcap/bpf.h]) LIBPCAP="" AC_CHECK_LIB(pcap, pcap_open_live,, LIBPCAP="no") if test "$LIBPCAP" = "no"; then echo echo " ERROR! libpcap library not found, go get it" echo " from http://www.tcpdump.org or your distribution:" echo echo " Ubuntu: apt-get install libpcap-dev" echo " Fedora: yum install libpcap-devel" echo exit 1 fi # pcap_activate and pcap_create only exists in libpcap >= 1.0 LIBPCAPVTEST="" #To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work #see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful TMPLIBS="${LIBS}" AC_CHECK_LIB(pcap, pcap_activate,, LPCAPVTEST="no") if test "$LPCAPVTEST" != "no"; then AC_PATH_PROG(HAVE_PCAP_CONFIG, pcap-config, "no") if test "$HAVE_PCAP_CONFIG" = "no" -o "$cross_compiling" = "yes"; then AC_DEFINE([LIBPCAP_VERSION_MAJOR],[1],(libpcap version 1.0+)) else PCAP_CFLAGS="$(pcap-config --defines) $(pcap-config --cflags)" AC_SUBST(PCAP_CFLAGS) AC_DEFINE([LIBPCAP_VERSION_MAJOR],[1],(libpcap version 1.0+)) fi else AC_DEFINE([LIBPCAP_VERSION_MAJOR],[0],(libpcap version 0.x)) fi LIBS="${TMPLIBS}" #Appears as if pcap_set_buffer_size is linux only? LIBPCAPSBUFF="" #To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work #see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful TMPLIBS="${LIBS}" AC_CHECK_LIB(pcap, pcap_set_buffer_size,, LPCAPSBUFF="no") if test "$LPCAPSBUFF" != "no"; then AC_DEFINE([HAVE_PCAP_SET_BUFF],[1],(libpcap has pcap_set_buffer_size function)) fi LIBS="${TMPLIBS}" # libpfring # libpfring (currently only supported for libpcap enabled pfring) # Error on the side of caution. If libpfring enabled pcap is being used and we don't link against -lpfring compilation will fail. AC_ARG_ENABLE(pfring, AS_HELP_STRING([--enable-pfring], [Enable Native PF_RING support]),,[enable_pfring=no]) AS_IF([test "x$enable_pfring" = "xyes"], [ AC_DEFINE([HAVE_PFRING],[1],(PF_RING support enabled)) #We have to set CFLAGS for AC_TRY_COMPILE as it doesn't pay attention to CPPFLAGS AC_ARG_WITH(libpfring_includes, [ --with-libpfring-includes=DIR libpfring include directory], [with_libpfring_includes="$withval"],[with_libpfring_includes=no]) AC_ARG_WITH(libpfring_libraries, [ --with-libpfring-libraries=DIR libpfring library directory], [with_libpfring_libraries="$withval"],[with_libpfring_libraries="no"]) if test "$with_libpfring_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpfring_includes}" fi if test "$with_libpfring_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpfring_libraries}" fi LIBPFRING="" AC_CHECK_LIB(pfring, pfring_open,, LIBPFRING="no", [-lpcap]) if test "$LIBPFRING" != "no"; then STORECFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Werror" AC_COMPILE_IFELSE( [AC_LANG_PROGRAM( [ #include ], [ pfring_recv_chunk(NULL, NULL, 0, 0); ])], [pfring_recv_chunk="yes"], [pfring_recv_chunk="no"]) CFLAGS="${STORECFLAGS}" if test "x$pfring_recv_chunk" != "xyes"; then if test "x$enable_pfring" = "xyes"; then echo echo " ERROR! --enable-pfring was passed but the library version is < 6, go get it" echo " from http://www.ntop.org/products/pf_ring/" echo exit 1 fi fi else if test "x$enable_pfring" = "xyes"; then echo echo " ERROR! --enable-pfring was passed but the library was not found, go get it" echo " from http://www.ntop.org/products/pf_ring/" echo exit 1 fi fi ]) # AF_PACKET support AC_ARG_ENABLE(af-packet, AS_HELP_STRING([--enable-af-packet], [Enable AF_PACKET support [default=yes]]), ,[enable_af_packet=yes]) AS_IF([test "x$enable_af_packet" = "xyes"], [ AC_CHECK_DECL([TPACKET_V2], AC_DEFINE([HAVE_AF_PACKET],[1],[AF_PACKET support is available]), [enable_af_packet="no"], [[#include #include ]]) AC_CHECK_DECL([PACKET_FANOUT_QM], AC_DEFINE([HAVE_PACKET_FANOUT],[1],[Recent packet fanout support is available]), [], [[#include ]]) AC_CHECK_DECL([TPACKET_V3], AC_DEFINE([HAVE_TPACKET_V3],[1],[AF_PACKET tpcket_v3 support is available]), [], [[#include #include ]]) AC_CHECK_DECL([SOF_TIMESTAMPING_RAW_HARDWARE], AC_DEFINE([HAVE_HW_TIMESTAMPING],[1],[Hardware timestamping support is available]), [], [[#include ]]) ]) # Netmap support AC_ARG_ENABLE(netmap, AS_HELP_STRING([--enable-netmap], [Enable Netmap support]),,[enable_netmap=no]) AC_ARG_WITH(netmap_includes, [ --with-netmap-includes=DIR netmap include directory], [with_netmap_includes="$withval"],[with_netmap_includes=no]) AS_IF([test "x$enable_netmap" = "xyes"], [ AC_DEFINE([HAVE_NETMAP],[1],(NETMAP support enabled)) if test "$with_netmap_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_netmap_includes}" fi AC_CHECK_HEADER(net/netmap_user.h,,[AC_ERROR(net/netmap_user.h not found ...)],) ]) # libhtp AC_ARG_ENABLE(non-bundled-htp, AS_HELP_STRING([--enable-non-bundled-htp], [Enable the use of an already installed version of htp]),,[enable_non_bundled_htp=no]) AS_IF([test "x$enable_non_bundled_htp" = "xyes"], [ PKG_CHECK_MODULES([libhtp], htp,, [with_pkgconfig_htp=no]) if test "$with_pkgconfig_htp" != "no"; then CPPFLAGS="${CPPFLAGS} ${libhtp_CFLAGS}" LIBS="${LIBS} ${libhtp_LIBS}" fi AC_ARG_WITH(libhtp_includes, [ --with-libhtp-includes=DIR libhtp include directory], [with_libhtp_includes="$withval"],[with_libhtp_includes=no]) AC_ARG_WITH(libhtp_libraries, [ --with-libhtp-libraries=DIR libhtp library directory], [with_libhtp_libraries="$withval"],[with_libhtp_libraries="no"]) if test "$with_libhtp_includes" != "no"; then CPPFLAGS="-I${with_libhtp_includes} ${CPPFLAGS}" fi if test "$with_libhtp_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhtp_libraries}" fi AC_CHECK_HEADER(htp/htp.h,,[AC_ERROR(htp/htp.h not found ...)]) LIBHTP="" AC_CHECK_LIB(htp, htp_conn_create,, LIBHTP="no") if test "$LIBHTP" = "no"; then echo echo " ERROR! libhtp library not found" echo exit 1 fi PKG_CHECK_MODULES(LIBHTPMINVERSION, [htp >= 0.5.20],[libhtp_minver_found="yes"],[libhtp_minver_found="no"]) if test "$libhtp_minver_found" = "no"; then PKG_CHECK_MODULES(LIBHTPDEVVERSION, [htp = 0.5.X],[libhtp_devver_found="yes"],[libhtp_devver_found="no"]) if test "$libhtp_devver_found" = "no"; then echo echo " ERROR! libhtp was found but it is neither >= 0.5.20, nor the dev 0.5.X" echo exit 1 fi fi AC_CHECK_LIB([htp], [htp_config_register_request_uri_normalize],AC_DEFINE_UNQUOTED([HAVE_HTP_URI_NORMALIZE_HOOK],[1],[Found htp_config_register_request_uri_normalize function in libhtp]) ,,[-lhtp]) # check for htp_tx_get_response_headers_raw AC_CHECK_LIB([htp], [htp_tx_get_response_headers_raw],AC_DEFINE_UNQUOTED([HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW],[1],[Found htp_tx_get_response_headers_raw in libhtp]) ,,[-lhtp]) AC_CHECK_LIB([htp], [htp_decode_query_inplace],AC_DEFINE_UNQUOTED([HAVE_HTP_DECODE_QUERY_INPLACE],[1],[Found htp_decode_query_inplace function in libhtp]) ,,[-lhtp]) AC_CHECK_LIB([htp], [htp_config_set_response_decompression_layer_limit],AC_DEFINE_UNQUOTED([HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT],[1],[Found htp_config_set_response_decompression_layer_limit function in libhtp]) ,,[-lhtp]) AC_EGREP_HEADER(htp_config_set_path_decode_u_encoding, htp/htp.h, AC_DEFINE_UNQUOTED([HAVE_HTP_SET_PATH_DECODE_U_ENCODING],[1],[Found usable htp_config_set_path_decode_u_encoding function in libhtp]) ) ]) if test "x$enable_non_bundled_htp" = "xno"; then # test if we have a bundled htp if test -d "$srcdir/libhtp"; then AC_CONFIG_SUBDIRS([libhtp]) HTP_DIR="libhtp" AC_SUBST(HTP_DIR) HTP_LDADD="../libhtp/htp/libhtp.la" AC_SUBST(HTP_LDADD) # make sure libhtp is added to the includes CPPFLAGS="-I\${srcdir}/../libhtp/ ${CPPFLAGS}" AC_CHECK_HEADER(iconv.h,,[AC_ERROR(iconv.h not found ...)]) AC_CHECK_LIB(iconv, libiconv_close) AC_DEFINE_UNQUOTED([HAVE_HTP_URI_NORMALIZE_HOOK],[1],[Assuming htp_config_register_request_uri_normalize function in bundled libhtp]) AC_DEFINE_UNQUOTED([HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW],[1],[Assuming htp_tx_get_response_headers_raw function in bundled libhtp]) AC_DEFINE_UNQUOTED([HAVE_HTP_DECODE_QUERY_INPLACE],[1],[Assuming htp_decode_query_inplace function in bundled libhtp]) # enable when libhtp has been updated AC_DEFINE_UNQUOTED([HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT],[1],[Assuming htp_config_set_response_decompression_layer_limit function in bundled libhtp]) else echo echo " ERROR: Libhtp is not bundled. Get libhtp by doing:" echo " git clone https://github.com/OISF/libhtp" echo " Then re-run Suricata's autogen.sh and configure script." echo " Or, if libhtp is installed in a different location," echo " pass --enable-non-bundled-htp to Suricata's configure script." echo " Add --with-libhtp-includes= and --with-libhtp-libraries= if" echo " libhtp is not installed in the include and library paths." echo exit 1 fi fi # enable CUDA output AC_ARG_ENABLE(cuda, AS_HELP_STRING([--enable-cuda], [Enable experimental CUDA pattern matching]),,[enable_cuda=no]) AS_IF([test "x$enable_cuda" = "xyes"], [ AC_ARG_WITH(cuda_includes, [ --with-cuda-includes=DIR cuda include directory], [with_cuda_includes="$withval"],[with_cuda_includes=no]) AC_ARG_WITH(cuda_libraries, [ --with-cuda-libraries=DIR cuda library directory], [with_cuda_libraries="$withval"],[with_cuda_libraries="no"]) AC_ARG_WITH(cuda_nvcc, [ --with-cuda-nvcc=DIR cuda nvcc compiler directory], [with_cuda_nvcc="$withval"],[with_cuda_nvcc=no]) AC_DEFINE([__SC_CUDA_SUPPORT__],[1],(CUDA support enabled)) if test "$with_cuda_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_cuda_includes}" else CPPFLAGS="${CPPFLAGS} -I/usr/local/cuda/include" fi if test "$with_cuda_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_cuda_libraries}" fi if test "$with_cuda_nvcc" != "no"; then NVCC_DIR="${with_cuda_nvcc}" else NVCC_DIR="/usr/local/cuda/bin" fi AC_CHECK_HEADER(cuda.h,,[AC_ERROR(cuda.h not found ...)]) LIBCUDA="" AC_CHECK_LIB(cuda, cuArray3DCreate,, LIBCUDA="no") if test "$LIBCUDA" = "no"; then echo echo " ERROR! libcuda library not found" echo exit 1 fi AC_PATH_PROG([NVCC], [nvcc], no, [$PATH:$NVCC_DIR]) if test "x$NVCC" = "xno"; then echo echo " ERROR! CUDA nvcc compiler not found: use --with-cuda-nvcc=DIR" echo exit 1 fi AC_MSG_CHECKING(for nvcc version) NVCCVER=`$NVCC --version | grep "release" | sed 's/.*release \(@<:@0-9@:>@\)\.\(@<:@0-9@:>@\).*/\1\2/'` AC_MSG_RESULT($NVCCVER) if test "$NVCCVER" -lt 31; then echo echo " Warning! Your CUDA nvcc version might be outdated." echo " If compilation fails try the latest CUDA toolkit from" echo " www.nvidia.com/object/cuda_develop.html" echo fi AM_PATH_PYTHON(,, no) if test "x$PYTHON" = "xno"; then echo echo " ERROR! Compiling CUDA kernels requires python." echo exit 1 fi ]) AM_CONDITIONAL([BUILD_CUDA], [test "x$enable_cuda" = "xyes"]) AM_CONDITIONAL([__SC_CUDA_SUPPORT__], [test "x$enable_cuda" = "xyes"]) # Check for libcap-ng case $host in *-*-linux*) AC_ARG_WITH(libcap_ng_includes, [ --with-libcap_ng-includes=DIR libcap_ng include directory], [with_libcap_ng_includes="$withval"],[with_libcap_ng_includes=no]) AC_ARG_WITH(libcap_ng_libraries, [ --with-libcap_ng-libraries=DIR libcap_ng library directory], [with_libcap_ng_libraries="$withval"],[with_libcap_ng_libraries="no"]) if test "$with_libcap_ng_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libcap_ng_includes}" fi if test "$with_libcap_ng_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libcap_ng_libraries}" fi AC_CHECK_HEADER(cap-ng.h,,LIBCAP_NG="no") if test "$LIBCAP_NG" != "no"; then LIBCAP_NG="" AC_CHECK_LIB(cap-ng,capng_clear,,LIBCAP_NG="no") fi if test "$LIBCAP_NG" != "no"; then AC_DEFINE([HAVE_LIBCAP_NG],[1],[Libpcap-ng support]) fi if test "$LIBCAP_NG" = "no"; then echo echo " WARNING! libcap-ng library not found, go get it" echo " from http://people.redhat.com/sgrubb/libcap-ng/" echo " or your distribution:" echo echo " Ubuntu: apt-get install libcap-ng-dev" echo " Fedora: yum install libcap-ng-devel" echo echo " Suricata will be built without support for dropping privs." echo fi ;; esac # Check for DAG support. AC_ARG_ENABLE(dag, AS_HELP_STRING([--enable-dag],[Enable DAG capture]), [ enable_dag=yes ], [ enable_dag=no]) AC_ARG_WITH(dag_includes, [ --with-dag-includes=DIR dagapi include directory], [with_dag_includes="$withval"],[with_dag_includes="no"]) AC_ARG_WITH(dag_libraries, [ --with-dag-libraries=DIR dagapi library directory], [with_dag_libraries="$withval"],[with_dag_libraries="no"]) if test "$enable_dag" = "yes"; then if test "$with_dag_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_dag_includes}" fi if test "$with_dag_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_dag_libraries}" fi AC_CHECK_HEADER(dagapi.h,DAG="yes",DAG="no") if test "$DAG" != "no"; then DAG="" AC_CHECK_LIB(dag,dag_open,,DAG="no",) fi if test "$DAG" = "no"; then echo echo " ERROR! libdag library not found" echo exit 1 fi AC_DEFINE([HAVE_DAG],[1],(Endace DAG card support enabled)) fi # libnspr enable_nspr="no" # Try pkg-config first: PKG_CHECK_MODULES([libnspr], nspr,, [with_pkgconfig_nspr=no]) if test "$with_pkgconfig_nspr" != "no"; then CPPFLAGS="${CPPFLAGS} ${libnspr_CFLAGS}" LIBS="${LIBS} ${libnspr_LIBS}" fi AC_ARG_WITH(libnspr_includes, [ --with-libnspr-includes=DIR libnspr include directory], [with_libnspr_includes="$withval"],[with_libnspr_includes=no]) AC_ARG_WITH(libnspr_libraries, [ --with-libnspr-libraries=DIR libnspr library directory], [with_libnspr_libraries="$withval"],[with_libnspr_libraries="no"]) if test "$with_libnspr_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnspr_includes}" fi AC_CHECK_HEADER(nspr.h,NSPR="yes",NSPR="no") if test "$NSPR" = "yes"; then if test "$with_libnspr_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnspr_libraries}" fi AC_CHECK_LIB(nspr4, PR_GetCurrentThread,, NSPR="no") if test "$NSPR" = "no"; then echo echo " ERROR! libnspr library not found, go get it" echo " from Mozilla or your distribution:" echo echo " Ubuntu: apt-get install libnspr4-dev" echo " Fedora: yum install nspr-devel" echo exit 1 fi enable_nspr="yes" fi # libnss enable_nss="no" # Try pkg-config first: PKG_CHECK_MODULES([libnss], nss,, [with_pkgconfig_nss=no]) if test "$with_pkgconfig_nss" != "no"; then CPPFLAGS="${CPPFLAGS} ${libnss_CFLAGS}" LIBS="${LIBS} ${libnss_LIBS}" fi AC_ARG_WITH(libnss_includes, [ --with-libnss-includes=DIR libnss include directory], [with_libnss_includes="$withval"],[with_libnss_includes=no]) AC_ARG_WITH(libnss_libraries, [ --with-libnss-libraries=DIR libnss library directory], [with_libnss_libraries="$withval"],[with_libnss_libraries="no"]) if test "$with_libnss_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnss_includes}" fi AC_CHECK_HEADER(sechash.h,NSS="yes",NSS="no") if test "$NSS" = "yes"; then if test "$with_libnss_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnss_libraries}" fi AC_CHECK_LIB(nss3, HASH_Begin,, NSS="no") if test "$NSS" = "no"; then echo echo " ERROR! libnss library not found, go get it" echo " from Mozilla or your distribution:" echo echo " Ubuntu: apt-get install libnss3-dev" echo " Fedora: yum install nss-devel" echo exit 1 fi AC_DEFINE([HAVE_NSS],[1],[libnss available for md5]) enable_nss="yes" fi # libmagic enable_magic="no" AC_ARG_ENABLE(libmagic, AS_HELP_STRING([--enable-libmagic], [Enable libmagic support [default=yes]]), ,[enable_magic=yes]) if test "$enable_magic" = "yes"; then AC_ARG_WITH(libmagic_includes, [ --with-libmagic-includes=DIR libmagic include directory], [with_libmagic_includes="$withval"],[with_libmagic_includes=no]) AC_ARG_WITH(libmagic_libraries, [ --with-libmagic-libraries=DIR libmagic library directory], [with_libmagic_libraries="$withval"],[with_libmagic_libraries="no"]) if test "$with_libmagic_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libmagic_includes}" fi AC_CHECK_HEADER(magic.h,,MAGIC="no") if test "$MAGIC" != "no"; then MAGIC="" AC_CHECK_LIB(magic, magic_open,, MAGIC="no") fi if test "x$MAGIC" != "xno"; then if test "$with_libmagic_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libmagic_libraries}" fi AC_DEFINE([HAVE_MAGIC],[1],(Libmagic for file handling)) else echo echo " WARNING! magic library not found, go get it" echo " from http://www.darwinsys.com/file/ or your distribution:" echo echo " Ubuntu: apt-get install libmagic-dev" echo " Fedora: yum install file-devel" echo enable_magic="no" fi fi # Napatech - Using the 3GD API AC_ARG_ENABLE(napatech, AS_HELP_STRING([--enable-napatech],[Enabled Napatech Devices]), [ enable_napatech=yes ], [ enable_napatech=no]) AC_ARG_WITH(napatech_includes, [ --with-napatech-includes=DIR napatech include directory], [with_napatech_includes="$withval"],[with_napatech_includes="/opt/napatech3/include"]) AC_ARG_WITH(napatech_libraries, [ --with-napatech-libraries=DIR napatech library directory], [with_napatech_libraries="$withval"],[with_napatech_libraries="/opt/napatech3/lib"]) if test "$enable_napatech" = "yes"; then CPPFLAGS="${CPPFLAGS} -I${with_napatech_includes}" LDFLAGS="${LDFLAGS} -L${with_napatech_libraries} -lntapi" AC_CHECK_HEADER(nt.h,NAPATECH="yes",NAPATECH="no") if test "$NAPATECH" != "no"; then NAPATECH="" AC_CHECK_LIB(ntapi, NT_Init,NAPATECH="yes",NAPATECH="no") fi if test "$NAPATECH" = "no"; then echo echo " ERROR! libntapi library not found" echo exit 1 fi AC_DEFINE([HAVE_NAPATECH],[1],(Napatech capture card support)) fi # liblua AC_ARG_ENABLE(lua, AS_HELP_STRING([--enable-lua],[Enable Lua support]), [ enable_lua="yes"], [ enable_lua="no"]) AC_ARG_ENABLE(luajit, AS_HELP_STRING([--enable-luajit],[Enable Luajit support]), [ enable_luajit="yes"], [ enable_luajit="no"]) if test "$enable_lua" = "yes"; then if test "$enable_luajit" = "yes"; then echo "ERROR: can't enable liblua and luajit at the same time." echo "For LuaJIT, just use --enable-luajit. For liblua (no jit)" echo "support, use just --enable-lua." echo "Both options will enable the Lua scripting capabilities" echo "in Suricata". echo exit 1 fi fi AC_ARG_WITH(liblua_includes, [ --with-liblua-includes=DIR liblua include directory], [with_liblua_includes="$withval"],[with_liblua_includes="no"]) AC_ARG_WITH(liblua_libraries, [ --with-liblua-libraries=DIR liblua library directory], [with_liblua_libraries="$withval"],[with_liblua_libraries="no"]) if test "$enable_lua" = "yes"; then if test "$with_liblua_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_liblua_includes}" else # lua lua51 lua5.1 lua-5.1 PKG_CHECK_MODULES([LUA], [lua], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua5.1], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua-5.1], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua51], [LUA="yes"], [ LUA="no" ]) ]) ]) ]) CPPFLAGS="${CPPFLAGS} ${LUA_CFLAGS}" fi AC_CHECK_HEADER(lualib.h,LUA="yes",LUA="no") if test "$LUA" = "yes"; then if test "$with_liblua_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_liblua_libraries}" AC_CHECK_LIB(${LUA_LIB_NAME}, luaL_openlibs,, LUA="no") if test "$LUA" = "no"; then echo echo " ERROR! liblua library not found, go get it" echo " from http://lua.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install liblua5.1-dev" echo " CentOS/Fedora: yum install lua-devel" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-liblua-libraries configure option." echo exit 1 fi else # lua lua51 lua5.1 lua-5.1 PKG_CHECK_MODULES([LUA], [lua], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua5.1], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua-5.1], [LUA="yes"], [ PKG_CHECK_MODULES([LUA], [lua51], [LUA="yes"], [ LUA="no" ]) ]) ]) ]) LDFLAGS="${LDFLAGS} ${LUA_LIBS}" fi if test "$LUA" = "no"; then AC_CHECK_LIB(lua, luaL_openlibs,, LUA="no") fi if test "$LUA" = "yes"; then AC_DEFINE([HAVE_LUA],[1],[liblua available]) enable_lua="yes" fi else echo echo " ERROR! liblua headers not found, go get them" echo " from http://lua.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install liblua5.1-dev" echo " CentOS/Fedora: yum install lua-devel" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-liblua-includes and --with-liblua-libraries" echo " configure option." echo exit 1 fi fi # libluajit AC_ARG_WITH(libluajit_includes, [ --with-libluajit-includes=DIR libluajit include directory], [with_libluajit_includes="$withval"],[with_libluajit_includes="no"]) AC_ARG_WITH(libluajit_libraries, [ --with-libluajit-libraries=DIR libluajit library directory], [with_libluajit_libraries="$withval"],[with_libluajit_libraries="no"]) if test "$enable_luajit" = "yes"; then if test "$with_libluajit_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libluajit_includes}" else PKG_CHECK_MODULES([LUAJIT], [luajit], , LUAJIT="no") CPPFLAGS="${CPPFLAGS} ${LUAJIT_CFLAGS}" fi AC_CHECK_HEADER(lualib.h,LUAJIT="yes",LUAJIT="no") if test "$LUAJIT" = "yes"; then if test "$with_libluajit_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libluajit_libraries}" else PKG_CHECK_MODULES([LUAJIT], [luajit]) LDFLAGS="${LDFLAGS} ${LUAJIT_LIBS}" fi AC_CHECK_LIB(luajit-5.1, luaL_openlibs,, LUAJIT="no") if test "$LUAJIT" = "no"; then echo echo " ERROR! libluajit library not found, go get it" echo " from http://luajit.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install libluajit-5.1-dev" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-libluajit-libraries configure option." echo exit 1 fi AC_DEFINE([HAVE_LUA],[1],[lua support available]) AC_DEFINE([HAVE_LUAJIT],[1],[libluajit available]) enable_lua="yes, through luajit" enable_luajit="yes" else echo echo " ERROR! libluajit headers not found, go get them" echo " from http://luajit.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install libluajit-5.1-dev" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-libluajit-includes and --with-libluajit-libraries" echo " configure option." echo exit 1 fi fi # libgeoip AC_ARG_ENABLE(geoip, AS_HELP_STRING([--enable-geoip],[Enable GeoIP support]), [ enable_geoip="yes"], [ enable_geoip="no"]) AC_ARG_WITH(libgeoip_includes, [ --with-libgeoip-includes=DIR libgeoip include directory], [with_libgeoip_includes="$withval"],[with_libgeoip_includes="no"]) AC_ARG_WITH(libgeoip_libraries, [ --with-libgeoip-libraries=DIR libgeoip library directory], [with_libgeoip_libraries="$withval"],[with_libgeoip_libraries="no"]) if test "$enable_geoip" = "yes"; then if test "$with_libgeoip_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libgeoip_includes}" fi AC_CHECK_HEADER(GeoIP.h,GEOIP="yes",GEOIP="no") if test "$GEOIP" = "yes"; then if test "$with_libgeoip_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libgeoip_libraries}" fi AC_CHECK_LIB(GeoIP, GeoIP_country_code_by_ipnum,, GEOIP="no") fi if test "$GEOIP" = "no"; then echo echo " ERROR! libgeoip library not found, go get it" echo " from http://www.maxmind.com/en/geolite or your distribution:" echo echo " Ubuntu: apt-get install libgeoip-dev" echo " Fedora: yum install GeoIP-devel" echo exit 1 fi AC_DEFINE([HAVE_GEOIP],[1],[libgeoip available]) enable_geoip="yes" fi # Position Independent Executable AC_ARG_ENABLE(pie, AS_HELP_STRING([--enable-pie],[Enable compiling as a position independent executable]), [ enable_pie="yes"], [ enable_pie="no"]) if test "$enable_pie" = "yes"; then CPPFLAGS="${CPPFLAGS} -fPIC" LDFLAGS="${LDFLAGS} -pie" fi # libhiredis AC_ARG_ENABLE(hiredis, AS_HELP_STRING([--enable-hiredis],[Enable Redis support]), [ enable_hiredis="yes"], [ enable_hiredis="no"]) AC_ARG_WITH(libhiredis_includes, [ --with-libhiredis-includes=DIR libhiredis include directory], [with_libhiredis_includes="$withval"],[with_libhiredis_includes="no"]) AC_ARG_WITH(libhiredis_libraries, [ --with-libhiredis-libraries=DIR libhiredis library directory], [with_libhiredis_libraries="$withval"],[with_libhiredis_libraries="no"]) if test "$enable_hiredis" = "yes"; then if test "$with_libhiredis_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libhiredis_includes}" fi AC_CHECK_HEADER("hiredis/hiredis.h",HIREDIS="yes",HIREDIS="no") if test "$HIREDIS" = "yes"; then if test "$with_libhiredis_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhiredis_libraries}" fi AC_CHECK_LIB(hiredis, redisConnect,, HIREDIS="no") fi if test "$HIREDIS" = "no"; then echo echo " ERROR! libhiredis library not found, go get it" echo " from https://github.com/redis/hiredis or your distribution:" echo echo " Ubuntu: apt-get install libhiredis-dev" echo " Fedora: dnf install hiredis-devel" echo " RHEL/CentOS: yum install hiredis-devel" echo exit 1 fi if test "$HIREDIS" = "yes"; then AC_DEFINE([HAVE_LIBHIREDIS],[1],[libhiredis available]) enable_hiredis="yes" fi fi # get cache line size AC_PATH_PROG(HAVE_GETCONF_CMD, getconf, "no") if test "$HAVE_GETCONF_CMD" != "no"; then CLS=$(getconf LEVEL1_DCACHE_LINESIZE) if [test "$CLS" != "" && test "$CLS" != "0"]; then AC_DEFINE_UNQUOTED([CLS],[${CLS}],[L1 cache line size]) else AC_DEFINE([CLS],[64],[L1 cache line size]) fi else AC_DEFINE([CLS],[64],[L1 cache line size]) fi # sphinx for documentation AC_PATH_PROG(HAVE_SPHINXBUILD, sphinx-build, "no") if test "$HAVE_SPHINXBUILD" = "no"; then enable_sphinxbuild=no if test -e "$srcdir/doc/userguide/suricata.1"; then have_suricata_man=yes fi fi AM_CONDITIONAL([HAVE_SPHINXBUILD], [test "x$enable_sphinxbuild" != "xno"]) AM_CONDITIONAL([HAVE_SURICATA_MAN], [test "x$have_suricata_man" = "xyes"]) # pdflatex for the pdf version of the user manual AC_PATH_PROG(HAVE_PDFLATEX, pdflatex, "no") if test "$HAVE_PDFLATEX" = "no"; then enable_pdflatex=no fi AM_CONDITIONAL([HAVE_PDFLATEX], [test "x$enable_pdflatex" != "xno"]) # get revision if test -f ./revision; then REVISION=`cat ./revision` AC_DEFINE_UNQUOTED([REVISION],[${REVISION}],[Git revision]) else AC_PATH_PROG(HAVE_GIT_CMD, git, "no") if test "$HAVE_GIT_CMD" != "no"; then if [ test -d .git ]; then REVISION=`git rev-parse --short HEAD` AC_DEFINE_UNQUOTED([REVISION],[${REVISION}],[Git revision]) fi fi fi AC_SUBST(CFLAGS) AC_SUBST(LDFLAGS) AC_SUBST(CPPFLAGS) define([EXPAND_VARIABLE], [$2=[$]$1 if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "[$]$2" in *\[$]* ) eval "$2=[$]$2" ;; *) break ;; esac done eval "$2=[$]$2$3" ])dnl EXPAND_VARIABLE # suricata log dir if test "$WINDOWS_PATH" = "yes"; then systemtype="`systeminfo | grep \"based PC\"`" case "$systemtype" in *x64*) e_winbase="C:\\\\Program Files (x86)\\\\Suricata" ;; *) e_winbase="C:\\\\Program Files\\\\Suricata" ;; esac e_sysconfdir="$e_winbase\\\\" e_sysconfrulesdir="$e_winbase\\\\rules\\\\" e_magic_file="$e_winbase\\\\magic.mgc" e_logdir="$e_winbase\\\\log" e_logfilesdir="$e_logdir\\\\files" e_logcertsdir="$e_logdir\\\\certs" else EXPAND_VARIABLE(localstatedir, e_logdir, "/log/suricata/") EXPAND_VARIABLE(localstatedir, e_rundir, "/run/") EXPAND_VARIABLE(localstatedir, e_logfilesdir, "/log/suricata/files") EXPAND_VARIABLE(localstatedir, e_logcertsdir, "/log/suricata/certs") EXPAND_VARIABLE(sysconfdir, e_sysconfdir, "/suricata/") EXPAND_VARIABLE(sysconfdir, e_sysconfrulesdir, "/suricata/rules") EXPAND_VARIABLE(localstatedir, e_localstatedir, "/run/suricata") fi AC_SUBST(e_logdir) AC_SUBST(e_rundir) AC_SUBST(e_logfilesdir) AC_SUBST(e_logcertsdir) AC_SUBST(e_sysconfdir) AC_SUBST(e_sysconfrulesdir) AC_SUBST(e_localstatedir) AC_DEFINE_UNQUOTED([CONFIG_DIR],["$e_sysconfdir"],[Our CONFIG_DIR]) AC_SUBST(e_magic_file) AC_SUBST(e_magic_file_comment) AC_SUBST(e_enable_evelog) EXPAND_VARIABLE(prefix, CONFIGURE_PREFIX) EXPAND_VARIABLE(sysconfdir, CONFIGURE_SYSCONDIR) EXPAND_VARIABLE(localstatedir, CONFIGURE_LOCALSTATEDIR) AC_SUBST(CONFIGURE_PREFIX) AC_SUBST(CONFIGURE_SYSCONDIR) AC_SUBST(CONFIGURE_LOCALSTATEDIR) AC_OUTPUT(Makefile src/Makefile qa/Makefile qa/coccinelle/Makefile rules/Makefile doc/Makefile doc/userguide/Makefile contrib/Makefile contrib/file_processor/Makefile contrib/file_processor/Action/Makefile contrib/file_processor/Processor/Makefile contrib/tile_pcie_logd/Makefile suricata.yaml scripts/Makefile scripts/suricatasc/Makefile scripts/suricatasc/suricatasc) SURICATA_BUILD_CONF="Suricata Configuration: AF_PACKET support: ${enable_af_packet} PF_RING support: ${enable_pfring} NFQueue support: ${enable_nfqueue} NFLOG support: ${enable_nflog} IPFW support: ${enable_ipfw} Netmap support: ${enable_netmap} DAG enabled: ${enable_dag} Napatech enabled: ${enable_napatech} Unix socket enabled: ${enable_unixsocket} Detection enabled: ${enable_detection} Libmagic support: ${enable_magic} libnss support: ${enable_nss} libnspr support: ${enable_nspr} libjansson support: ${enable_jansson} hiredis support: ${enable_hiredis} Prelude support: ${enable_prelude} PCRE jit: ${pcre_jit_available} LUA support: ${enable_lua} libluajit: ${enable_luajit} libgeoip: ${enable_geoip} Non-bundled htp: ${enable_non_bundled_htp} Old barnyard2 support: ${enable_old_barnyard2} CUDA enabled: ${enable_cuda} Hyperscan support: ${enable_hyperscan} Libnet support: ${enable_libnet} Suricatasc install: ${enable_python} Profiling enabled: ${enable_profiling} Profiling locks enabled: ${enable_profiling_locks} Development settings: Coccinelle / spatch: ${enable_coccinelle} Unit tests enabled: ${enable_unittests} Debug output enabled: ${enable_debug} Debug validation enabled: ${enable_debug_validation} Generic build parameters: Installation prefix: ${prefix} Configuration directory: ${e_sysconfdir} Log directory: ${e_logdir} --prefix ${CONFIGURE_PREFIX} --sysconfdir ${CONFIGURE_SYSCONDIR} --localstatedir ${CONFIGURE_LOCALSTATEDIR} Host: ${host} Compiler: ${CC} (exec name) / ${compiler} (real) GCC Protect enabled: ${enable_gccprotect} GCC march native enabled: ${enable_gccmarch_native} GCC Profile enabled: ${enable_gccprofile} Position Independent Executable enabled: ${enable_pie} CFLAGS ${CFLAGS} PCAP_CFLAGS ${PCAP_CFLAGS} SECCFLAGS ${SECCFLAGS}" echo echo "$SURICATA_BUILD_CONF" echo "printf(" >src/build-info.h echo "$SURICATA_BUILD_CONF" | sed -e 's/^/"/' | sed -e 's/$/\\n"/' >>src/build-info.h echo ");" >>src/build-info.h echo " To build and install run 'make' and 'make install'. You can run 'make install-conf' if you want to install initial configuration files to ${e_sysconfdir}. Running 'make install-full' will install configuration and rules and provide you a ready-to-run suricata." echo echo "To install Suricata into /usr/bin/suricata, have the config in /etc/suricata and use /var/log/suricata as log dir, use: ./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/" echo suricata-3.2.1/LICENSE0000644000000000000000000004325413051004444011227 00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. suricata-3.2.1/COPYING0000644000000000000000000004325413051004444011255 00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. suricata-3.2.1/compile0000755000000000000000000001624513051004467011605 00000000000000#! /bin/sh # Wrapper for compilers which do not understand '-c -o'. scriptversion=2012-10-14.11; # UTC # Copyright (C) 1999-2014 Free Software Foundation, Inc. # Written by Tom Tromey . # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # This file is maintained in Automake, please report # bugs to or send patches to # . nl=' ' # We need space, tab and new line, in precisely that order. Quoting is # there to prevent tools from complaining about whitespace usage. IFS=" "" $nl" file_conv= # func_file_conv build_file lazy # Convert a $build file to $host form and store it in $file # Currently only supports Windows hosts. If the determined conversion # type is listed in (the comma separated) LAZY, no conversion will # take place. func_file_conv () { file=$1 case $file in / | /[!/]*) # absolute file, and not a UNC file if test -z "$file_conv"; then # lazily determine how to convert abs files case `uname -s` in MINGW*) file_conv=mingw ;; CYGWIN*) file_conv=cygwin ;; *) file_conv=wine ;; esac fi case $file_conv/,$2, in *,$file_conv,*) ;; mingw/*) file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'` ;; cygwin/*) file=`cygpath -m "$file" || echo "$file"` ;; wine/*) file=`winepath -w "$file" || echo "$file"` ;; esac ;; esac } # func_cl_dashL linkdir # Make cl look for libraries in LINKDIR func_cl_dashL () { func_file_conv "$1" if test -z "$lib_path"; then lib_path=$file else lib_path="$lib_path;$file" fi linker_opts="$linker_opts -LIBPATH:$file" } # func_cl_dashl library # Do a library search-path lookup for cl func_cl_dashl () { lib=$1 found=no save_IFS=$IFS IFS=';' for dir in $lib_path $LIB do IFS=$save_IFS if $shared && test -f "$dir/$lib.dll.lib"; then found=yes lib=$dir/$lib.dll.lib break fi if test -f "$dir/$lib.lib"; then found=yes lib=$dir/$lib.lib break fi if test -f "$dir/lib$lib.a"; then found=yes lib=$dir/lib$lib.a break fi done IFS=$save_IFS if test "$found" != yes; then lib=$lib.lib fi } # func_cl_wrapper cl arg... # Adjust compile command to suit cl func_cl_wrapper () { # Assume a capable shell lib_path= shared=: linker_opts= for arg do if test -n "$eat"; then eat= else case $1 in -o) # configure might choose to run compile as 'compile cc -o foo foo.c'. eat=1 case $2 in *.o | *.[oO][bB][jJ]) func_file_conv "$2" set x "$@" -Fo"$file" shift ;; *) func_file_conv "$2" set x "$@" -Fe"$file" shift ;; esac ;; -I) eat=1 func_file_conv "$2" mingw set x "$@" -I"$file" shift ;; -I*) func_file_conv "${1#-I}" mingw set x "$@" -I"$file" shift ;; -l) eat=1 func_cl_dashl "$2" set x "$@" "$lib" shift ;; -l*) func_cl_dashl "${1#-l}" set x "$@" "$lib" shift ;; -L) eat=1 func_cl_dashL "$2" ;; -L*) func_cl_dashL "${1#-L}" ;; -static) shared=false ;; -Wl,*) arg=${1#-Wl,} save_ifs="$IFS"; IFS=',' for flag in $arg; do IFS="$save_ifs" linker_opts="$linker_opts $flag" done IFS="$save_ifs" ;; -Xlinker) eat=1 linker_opts="$linker_opts $2" ;; -*) set x "$@" "$1" shift ;; *.cc | *.CC | *.cxx | *.CXX | *.[cC]++) func_file_conv "$1" set x "$@" -Tp"$file" shift ;; *.c | *.cpp | *.CPP | *.lib | *.LIB | *.Lib | *.OBJ | *.obj | *.[oO]) func_file_conv "$1" mingw set x "$@" "$file" shift ;; *) set x "$@" "$1" shift ;; esac fi shift done if test -n "$linker_opts"; then linker_opts="-link$linker_opts" fi exec "$@" $linker_opts exit 1 } eat= case $1 in '') echo "$0: No command. Try '$0 --help' for more information." 1>&2 exit 1; ;; -h | --h*) cat <<\EOF Usage: compile [--help] [--version] PROGRAM [ARGS] Wrapper for compilers which do not understand '-c -o'. Remove '-o dest.o' from ARGS, run PROGRAM with the remaining arguments, and rename the output as expected. If you are trying to build a whole package this is not the right script to run: please start by reading the file 'INSTALL'. Report bugs to . EOF exit $? ;; -v | --v*) echo "compile $scriptversion" exit $? ;; cl | *[/\\]cl | cl.exe | *[/\\]cl.exe ) func_cl_wrapper "$@" # Doesn't return... ;; esac ofile= cfile= for arg do if test -n "$eat"; then eat= else case $1 in -o) # configure might choose to run compile as 'compile cc -o foo foo.c'. # So we strip '-o arg' only if arg is an object. eat=1 case $2 in *.o | *.obj) ofile=$2 ;; *) set x "$@" -o "$2" shift ;; esac ;; *.c) cfile=$1 set x "$@" "$1" shift ;; *) set x "$@" "$1" shift ;; esac fi shift done if test -z "$ofile" || test -z "$cfile"; then # If no '-o' option was seen then we might have been invoked from a # pattern rule where we don't need one. That is ok -- this is a # normal compilation that the losing compiler can handle. If no # '.c' file was seen then we are probably linking. That is also # ok. exec "$@" fi # Name of file we expect compiler to create. cofile=`echo "$cfile" | sed 's|^.*[\\/]||; s|^[a-zA-Z]:||; s/\.c$/.o/'` # Create the lock directory. # Note: use '[/\\:.-]' here to ensure that we don't use the same name # that we are using for the .o file. Also, base the name on the expected # object file name, since that is what matters with a parallel build. lockdir=`echo "$cofile" | sed -e 's|[/\\:.-]|_|g'`.d while true; do if mkdir "$lockdir" >/dev/null 2>&1; then break fi sleep 1 done # FIXME: race condition here if user kills between mkdir and trap. trap "rmdir '$lockdir'; exit 1" 1 2 15 # Run the compile. "$@" ret=$? if test -f "$cofile"; then test "$cofile" = "$ofile" || mv "$cofile" "$ofile" elif test -f "${cofile}bj"; then test "${cofile}bj" = "$ofile" || mv "${cofile}bj" "$ofile" fi rmdir "$lockdir" exit $ret # Local Variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/Makefile.in0000644000000000000000000007631513051004467012300 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = . ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \ $(am__configure_deps) $(am__DIST_COMMON) am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \ configure.lineno config.status.lineno mkinstalldirs = $(install_sh) -d CONFIG_HEADER = config.h CONFIG_CLEAN_FILES = suricata.yaml CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ cscope distdir dist dist-all distcheck am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \ $(LISP)config.h.in # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags CSCOPE = cscope DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \ $(srcdir)/suricata.yaml.in COPYING ChangeLog compile \ config.guess config.rpath config.sub install-sh ltmain.sh \ missing DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) distdir = $(PACKAGE)-$(VERSION) top_distdir = $(distdir) am__remove_distdir = \ if test -d "$(distdir)"; then \ find "$(distdir)" -type d ! -perm -200 -exec chmod u+w {} ';' \ && rm -rf "$(distdir)" \ || { sleep 5 && rm -rf "$(distdir)"; }; \ else :; fi am__post_remove_distdir = $(am__remove_distdir) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" DIST_ARCHIVES = $(distdir).tar.gz GZIP_ENV = --best DIST_TARGETS = dist-gzip distuninstallcheck_listfiles = find . -type f -print am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \ | sed 's|^\./|$(prefix)/|' | grep -v '$(infodir)/dir$$' distcleancheck_listfiles = find . -type f -print ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ # not a GNU package. You can remove this line, if # have all needed files, that a GNU package needs AUTOMAKE_OPTIONS = foreign 1.4 ACLOCAL_AMFLAGS = -I m4 EXTRA_DIST = ChangeLog COPYING LICENSE suricata.yaml.in \ classification.config threshold.config \ reference.config SUBDIRS = $(HTP_DIR) src qa rules doc contrib scripts CLEANFILES = stamp-h[0-9]* all: config.h $(MAKE) $(AM_MAKEFLAGS) all-recursive .SUFFIXES: am--refresh: Makefile @: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ echo ' cd $(srcdir) && $(AUTOMAKE) --foreign'; \ $(am__cd) $(srcdir) && $(AUTOMAKE) --foreign \ && exit 0; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --foreign Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ echo ' $(SHELL) ./config.status'; \ $(SHELL) ./config.status;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) $(SHELL) ./config.status --recheck $(top_srcdir)/configure: $(am__configure_deps) $(am__cd) $(srcdir) && $(AUTOCONF) $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__cd) $(srcdir) && $(ACLOCAL) $(ACLOCAL_AMFLAGS) $(am__aclocal_m4_deps): config.h: stamp-h1 @test -f $@ || rm -f stamp-h1 @test -f $@ || $(MAKE) $(AM_MAKEFLAGS) stamp-h1 stamp-h1: $(srcdir)/config.h.in $(top_builddir)/config.status @rm -f stamp-h1 cd $(top_builddir) && $(SHELL) ./config.status config.h $(srcdir)/config.h.in: $(am__configure_deps) ($(am__cd) $(top_srcdir) && $(AUTOHEADER)) rm -f stamp-h1 touch $@ distclean-hdr: -rm -f config.h stamp-h1 suricata.yaml: $(top_builddir)/config.status $(srcdir)/suricata.yaml.in cd $(top_builddir) && $(SHELL) ./config.status $@ mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs distclean-libtool: -rm -f libtool config.lt # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscope: cscope.files test ! -s cscope.files \ || $(CSCOPE) -b -q $(AM_CSCOPEFLAGS) $(CSCOPEFLAGS) -i cscope.files $(CSCOPE_ARGS) clean-cscope: -rm -f cscope.files cscope.files: clean-cscope cscopelist cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags -rm -f cscope.out cscope.in.out cscope.po.out cscope.files distdir: $(DISTFILES) $(am__remove_distdir) test -d "$(distdir)" || mkdir "$(distdir)" @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done -test -n "$(am__skip_mode_fix)" \ || find "$(distdir)" -type d ! -perm -755 \ -exec chmod u+rwx,go+rx {} \; -o \ ! -type d ! -perm -444 -links 1 -exec chmod a+r {} \; -o \ ! -type d ! -perm -400 -exec chmod a+r {} \; -o \ ! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \ || chmod -R a+r "$(distdir)" dist-gzip: distdir tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz $(am__post_remove_distdir) dist-bzip2: distdir tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2 $(am__post_remove_distdir) dist-lzip: distdir tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz $(am__post_remove_distdir) dist-xz: distdir tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz $(am__post_remove_distdir) dist-tarZ: distdir @echo WARNING: "Support for distribution archives compressed with" \ "legacy program 'compress' is deprecated." >&2 @echo WARNING: "It will be removed altogether in Automake 2.0" >&2 tardir=$(distdir) && $(am__tar) | compress -c >$(distdir).tar.Z $(am__post_remove_distdir) dist-shar: distdir @echo WARNING: "Support for shar distribution archives is" \ "deprecated." >&2 @echo WARNING: "It will be removed altogether in Automake 2.0" >&2 shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz $(am__post_remove_distdir) dist-zip: distdir -rm -f $(distdir).zip zip -rq $(distdir).zip $(distdir) $(am__post_remove_distdir) dist dist-all: $(MAKE) $(AM_MAKEFLAGS) $(DIST_TARGETS) am__post_remove_distdir='@:' $(am__post_remove_distdir) # This target untars the dist file and tries a VPATH configuration. Then # it guarantees that the distribution is self-contained by making another # tarfile. distcheck: dist case '$(DIST_ARCHIVES)' in \ *.tar.gz*) \ GZIP=$(GZIP_ENV) gzip -dc $(distdir).tar.gz | $(am__untar) ;;\ *.tar.bz2*) \ bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\ *.tar.lz*) \ lzip -dc $(distdir).tar.lz | $(am__untar) ;;\ *.tar.xz*) \ xz -dc $(distdir).tar.xz | $(am__untar) ;;\ *.tar.Z*) \ uncompress -c $(distdir).tar.Z | $(am__untar) ;;\ *.shar.gz*) \ GZIP=$(GZIP_ENV) gzip -dc $(distdir).shar.gz | unshar ;;\ *.zip*) \ unzip $(distdir).zip ;;\ esac chmod -R a-w $(distdir) chmod u+w $(distdir) mkdir $(distdir)/_build $(distdir)/_build/sub $(distdir)/_inst chmod a-w $(distdir) test -d $(distdir)/_build || exit 0; \ dc_install_base=`$(am__cd) $(distdir)/_inst && pwd | sed -e 's,^[^:\\/]:[\\/],/,'` \ && dc_destdir="$${TMPDIR-/tmp}/am-dc-$$$$/" \ && am__cwd=`pwd` \ && $(am__cd) $(distdir)/_build/sub \ && ../../configure \ $(AM_DISTCHECK_CONFIGURE_FLAGS) \ $(DISTCHECK_CONFIGURE_FLAGS) \ --srcdir=../.. --prefix="$$dc_install_base" \ && $(MAKE) $(AM_MAKEFLAGS) \ && $(MAKE) $(AM_MAKEFLAGS) dvi \ && $(MAKE) $(AM_MAKEFLAGS) check \ && $(MAKE) $(AM_MAKEFLAGS) install \ && $(MAKE) $(AM_MAKEFLAGS) installcheck \ && $(MAKE) $(AM_MAKEFLAGS) uninstall \ && $(MAKE) $(AM_MAKEFLAGS) distuninstallcheck_dir="$$dc_install_base" \ distuninstallcheck \ && chmod -R a-w "$$dc_install_base" \ && ({ \ (cd ../.. && umask 077 && mkdir "$$dc_destdir") \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" install \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" uninstall \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" \ distuninstallcheck_dir="$$dc_destdir" distuninstallcheck; \ } || { rm -rf "$$dc_destdir"; exit 1; }) \ && rm -rf "$$dc_destdir" \ && $(MAKE) $(AM_MAKEFLAGS) dist \ && rm -rf $(DIST_ARCHIVES) \ && $(MAKE) $(AM_MAKEFLAGS) distcleancheck \ && cd "$$am__cwd" \ || exit 1 $(am__post_remove_distdir) @(echo "$(distdir) archives ready for distribution: "; \ list='$(DIST_ARCHIVES)'; for i in $$list; do echo $$i; done) | \ sed -e 1h -e 1s/./=/g -e 1p -e 1x -e '$$p' -e '$$x' distuninstallcheck: @test -n '$(distuninstallcheck_dir)' || { \ echo 'ERROR: trying to run $@ with an empty' \ '$$(distuninstallcheck_dir)' >&2; \ exit 1; \ }; \ $(am__cd) '$(distuninstallcheck_dir)' || { \ echo 'ERROR: cannot chdir into $(distuninstallcheck_dir)' >&2; \ exit 1; \ }; \ test `$(am__distuninstallcheck_listfiles) | wc -l` -eq 0 \ || { echo "ERROR: files left after uninstall:" ; \ if test -n "$(DESTDIR)"; then \ echo " (check DESTDIR support)"; \ fi ; \ $(distuninstallcheck_listfiles) ; \ exit 1; } >&2 distcleancheck: distclean @if test '$(srcdir)' = . ; then \ echo "ERROR: distcleancheck can only run from a VPATH build" ; \ exit 1 ; \ fi @test `$(distcleancheck_listfiles) | wc -l` -eq 0 \ || { echo "ERROR: files left in build directory after distclean:" ; \ $(distcleancheck_listfiles) ; \ exit 1; } >&2 check-am: all-am check: check-recursive all-am: Makefile config.h installdirs: installdirs-recursive installdirs-am: install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f $(am__CONFIG_DISTCLEAN_FILES) -rm -f Makefile distclean-am: clean-am distclean-generic distclean-hdr \ distclean-libtool distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f $(am__CONFIG_DISTCLEAN_FILES) -rm -rf $(top_srcdir)/autom4te.cache -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: .MAKE: $(am__recursive_targets) all install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \ am--refresh check check-am clean clean-cscope clean-generic \ clean-libtool cscope cscopelist-am ctags ctags-am dist \ dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \ dist-xz dist-zip distcheck distclean distclean-generic \ distclean-hdr distclean-libtool distclean-tags distcleancheck \ distdir distuninstallcheck dvi dvi-am html html-am info \ info-am install install-am install-data install-data-am \ install-dvi install-dvi-am install-exec install-exec-am \ install-html install-html-am install-info install-info-am \ install-man install-pdf install-pdf-am install-ps \ install-ps-am install-strip installcheck installcheck-am \ installdirs installdirs-am maintainer-clean \ maintainer-clean-generic mostlyclean mostlyclean-generic \ mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \ uninstall-am .PRECIOUS: Makefile install-data-am: @echo "Run 'make install-conf' if you want to install initial configuration files. Or 'make install-full' to install configuration and rules"; install-full: install install-conf install-rules install-conf: install -d "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/suricata.yaml" || install -m 600 "$(top_srcdir)/suricata.yaml" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/classification.config" || install -m 600 "$(top_srcdir)/classification.config" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/reference.config" || install -m 600 "$(top_srcdir)/reference.config" "$(DESTDIR)$(e_sysconfdir)" @test -e "$(DESTDIR)$(e_sysconfdir)/threshold.config" || install -m 600 "$(top_srcdir)/threshold.config" "$(DESTDIR)$(e_sysconfdir)" install -d "$(DESTDIR)$(e_logfilesdir)" install -d "$(DESTDIR)$(e_logcertsdir)" install -d "$(DESTDIR)$(e_rundir)" install -m 770 -d "$(DESTDIR)$(e_localstatedir)" install-rules: install -d "$(DESTDIR)$(e_sysconfrulesdir)" @HAVE_FETCH_COMMAND_TRUE@@HAVE_WGET_COMMAND_TRUE@ $(HAVE_WGET) -qO - https://rules.emergingthreats.net/open/suricata-3.0/emerging.rules.tar.gz | tar -x -z -C "$(DESTDIR)$(e_sysconfdir)" -f - @HAVE_FETCH_COMMAND_TRUE@@HAVE_WGET_COMMAND_FALSE@ $(HAVE_CURL) -s https://rules.emergingthreats.net/open/suricata-3.0/emerging.rules.tar.gz | tar -x -z -C "$(DESTDIR)$(e_sysconfdir)" -f - @HAVE_FETCH_COMMAND_FALSE@ @echo "UNABLE to load ruleset wget or curl are not installed on system." @test -e "$(DESTDIR)$(e_sysconfrulesdir)decoder-events.rules" || install -m 600 "$(top_srcdir)/rules/decoder-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)stream-events.rules" || install -m 600 "$(top_srcdir)/rules/stream-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)smtp-events.rules" || install -m 600 "$(top_srcdir)/rules/smtp-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)http-events.rules" || install -m 600 "$(top_srcdir)/rules/http-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)dns-events.rules" || install -m 600 "$(top_srcdir)/rules/dns-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)tls-events.rules" || install -m 600 "$(top_srcdir)/rules/tls-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)modbus-events.rules" || install -m 600 "$(top_srcdir)/rules/modbus-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)app-layer-events.rules" || install -m 600 "$(top_srcdir)/rules/app-layer-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @test -e "$(DESTDIR)$(e_sysconfrulesdir)dnp3-events.rules" || install -m 600 "$(top_srcdir)/rules/dnp3-events.rules" "$(DESTDIR)$(e_sysconfrulesdir)" @echo "" @echo "You can now start suricata by running as root something like '$(DESTDIR)$(bindir)/suricata -c $(DESTDIR)$(e_sysconfdir)/suricata.yaml -i eth0'." @echo "" @echo "If a library like libhtp.so is not found, you can run suricata with:" @echo "'LD_LIBRARY_PATH="$(DESTDIR)$(prefix)/lib" "$(DESTDIR)$(bindir)/suricata" -c "$(DESTDIR)$(e_sysconfdir)/suricata.yaml" -i eth0'." @echo "" @echo "While rules are installed now, it's highly recommended to use a rule manager for maintaining rules." @echo "The two most common are Oinkmaster and Pulledpork. For a guide see:" @echo "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster" # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/depcomp0000755000000000000000000005601613051004467011604 00000000000000#! /bin/sh # depcomp - compile a program generating dependencies as side-effects scriptversion=2013-05-30.07; # UTC # Copyright (C) 1999-2014 Free Software Foundation, Inc. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Originally written by Alexandre Oliva . case $1 in '') echo "$0: No command. Try '$0 --help' for more information." 1>&2 exit 1; ;; -h | --h*) cat <<\EOF Usage: depcomp [--help] [--version] PROGRAM [ARGS] Run PROGRAMS ARGS to compile a file, generating dependencies as side-effects. Environment variables: depmode Dependency tracking mode. source Source file read by 'PROGRAMS ARGS'. object Object file output by 'PROGRAMS ARGS'. DEPDIR directory where to store dependencies. depfile Dependency file to output. tmpdepfile Temporary file to use when outputting dependencies. libtool Whether libtool is used (yes/no). Report bugs to . EOF exit $? ;; -v | --v*) echo "depcomp $scriptversion" exit $? ;; esac # Get the directory component of the given path, and save it in the # global variables '$dir'. Note that this directory component will # be either empty or ending with a '/' character. This is deliberate. set_dir_from () { case $1 in */*) dir=`echo "$1" | sed -e 's|/[^/]*$|/|'`;; *) dir=;; esac } # Get the suffix-stripped basename of the given path, and save it the # global variable '$base'. set_base_from () { base=`echo "$1" | sed -e 's|^.*/||' -e 's/\.[^.]*$//'` } # If no dependency file was actually created by the compiler invocation, # we still have to create a dummy depfile, to avoid errors with the # Makefile "include basename.Plo" scheme. make_dummy_depfile () { echo "#dummy" > "$depfile" } # Factor out some common post-processing of the generated depfile. # Requires the auxiliary global variable '$tmpdepfile' to be set. aix_post_process_depfile () { # If the compiler actually managed to produce a dependency file, # post-process it. if test -f "$tmpdepfile"; then # Each line is of the form 'foo.o: dependency.h'. # Do two passes, one to just change these to # $object: dependency.h # and one to simply output # dependency.h: # which is needed to avoid the deleted-header problem. { sed -e "s,^.*\.[$lower]*:,$object:," < "$tmpdepfile" sed -e "s,^.*\.[$lower]*:[$tab ]*,," -e 's,$,:,' < "$tmpdepfile" } > "$depfile" rm -f "$tmpdepfile" else make_dummy_depfile fi } # A tabulation character. tab=' ' # A newline character. nl=' ' # Character ranges might be problematic outside the C locale. # These definitions help. upper=ABCDEFGHIJKLMNOPQRSTUVWXYZ lower=abcdefghijklmnopqrstuvwxyz digits=0123456789 alpha=${upper}${lower} if test -z "$depmode" || test -z "$source" || test -z "$object"; then echo "depcomp: Variables source, object and depmode must be set" 1>&2 exit 1 fi # Dependencies for sub/bar.o or sub/bar.obj go into sub/.deps/bar.Po. depfile=${depfile-`echo "$object" | sed 's|[^\\/]*$|'${DEPDIR-.deps}'/&|;s|\.\([^.]*\)$|.P\1|;s|Pobj$|Po|'`} tmpdepfile=${tmpdepfile-`echo "$depfile" | sed 's/\.\([^.]*\)$/.T\1/'`} rm -f "$tmpdepfile" # Avoid interferences from the environment. gccflag= dashmflag= # Some modes work just like other modes, but use different flags. We # parameterize here, but still list the modes in the big case below, # to make depend.m4 easier to write. Note that we *cannot* use a case # here, because this file can only contain one case statement. if test "$depmode" = hp; then # HP compiler uses -M and no extra arg. gccflag=-M depmode=gcc fi if test "$depmode" = dashXmstdout; then # This is just like dashmstdout with a different argument. dashmflag=-xM depmode=dashmstdout fi cygpath_u="cygpath -u -f -" if test "$depmode" = msvcmsys; then # This is just like msvisualcpp but w/o cygpath translation. # Just convert the backslash-escaped backslashes to single forward # slashes to satisfy depend.m4 cygpath_u='sed s,\\\\,/,g' depmode=msvisualcpp fi if test "$depmode" = msvc7msys; then # This is just like msvc7 but w/o cygpath translation. # Just convert the backslash-escaped backslashes to single forward # slashes to satisfy depend.m4 cygpath_u='sed s,\\\\,/,g' depmode=msvc7 fi if test "$depmode" = xlc; then # IBM C/C++ Compilers xlc/xlC can output gcc-like dependency information. gccflag=-qmakedep=gcc,-MF depmode=gcc fi case "$depmode" in gcc3) ## gcc 3 implements dependency tracking that does exactly what ## we want. Yay! Note: for some reason libtool 1.4 doesn't like ## it if -MD -MP comes after the -MF stuff. Hmm. ## Unfortunately, FreeBSD c89 acceptance of flags depends upon ## the command line argument order; so add the flags where they ## appear in depend2.am. Note that the slowdown incurred here ## affects only configure: in makefiles, %FASTDEP% shortcuts this. for arg do case $arg in -c) set fnord "$@" -MT "$object" -MD -MP -MF "$tmpdepfile" "$arg" ;; *) set fnord "$@" "$arg" ;; esac shift # fnord shift # $arg done "$@" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi mv "$tmpdepfile" "$depfile" ;; gcc) ## Note that this doesn't just cater to obsosete pre-3.x GCC compilers. ## but also to in-use compilers like IMB xlc/xlC and the HP C compiler. ## (see the conditional assignment to $gccflag above). ## There are various ways to get dependency output from gcc. Here's ## why we pick this rather obscure method: ## - Don't want to use -MD because we'd like the dependencies to end ## up in a subdir. Having to rename by hand is ugly. ## (We might end up doing this anyway to support other compilers.) ## - The DEPENDENCIES_OUTPUT environment variable makes gcc act like ## -MM, not -M (despite what the docs say). Also, it might not be ## supported by the other compilers which use the 'gcc' depmode. ## - Using -M directly means running the compiler twice (even worse ## than renaming). if test -z "$gccflag"; then gccflag=-MD, fi "$@" -Wp,"$gccflag$tmpdepfile" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" echo "$object : \\" > "$depfile" # The second -e expression handles DOS-style file names with drive # letters. sed -e 's/^[^:]*: / /' \ -e 's/^['$alpha']:\/[^:]*: / /' < "$tmpdepfile" >> "$depfile" ## This next piece of magic avoids the "deleted header file" problem. ## The problem is that when a header file which appears in a .P file ## is deleted, the dependency causes make to die (because there is ## typically no way to rebuild the header). We avoid this by adding ## dummy dependencies for each header file. Too bad gcc doesn't do ## this for us directly. ## Some versions of gcc put a space before the ':'. On the theory ## that the space means something, we add a space to the output as ## well. hp depmode also adds that space, but also prefixes the VPATH ## to the object. Take care to not repeat it in the output. ## Some versions of the HPUX 10.20 sed can't process this invocation ## correctly. Breaking it into two sed invocations is a workaround. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^\\$//' -e '/^$/d' -e "s|.*$object$||" -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; hp) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; sgi) if test "$libtool" = yes; then "$@" "-Wp,-MDupdate,$tmpdepfile" else "$@" -MDupdate "$tmpdepfile" fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" if test -f "$tmpdepfile"; then # yes, the sourcefile depend on other files echo "$object : \\" > "$depfile" # Clip off the initial element (the dependent). Don't try to be # clever and replace this with sed code, as IRIX sed won't handle # lines with more than a fixed number of characters (4096 in # IRIX 6.2 sed, 8192 in IRIX 6.5). We also remove comment lines; # the IRIX cc adds comments like '#:fec' to the end of the # dependency line. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' \ | tr "$nl" ' ' >> "$depfile" echo >> "$depfile" # The second pass generates a dummy entry for each header file. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' -e 's/$/:/' \ >> "$depfile" else make_dummy_depfile fi rm -f "$tmpdepfile" ;; xlc) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; aix) # The C for AIX Compiler uses -M and outputs the dependencies # in a .u file. In older versions, this file always lives in the # current directory. Also, the AIX compiler puts '$object:' at the # start of each line; $object doesn't have directory information. # Version 6 uses the directory in both cases. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then tmpdepfile1=$dir$base.u tmpdepfile2=$base.u tmpdepfile3=$dir.libs/$base.u "$@" -Wc,-M else tmpdepfile1=$dir$base.u tmpdepfile2=$dir$base.u tmpdepfile3=$dir$base.u "$@" -M fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" do test -f "$tmpdepfile" && break done aix_post_process_depfile ;; tcc) # tcc (Tiny C Compiler) understand '-MD -MF file' since version 0.9.26 # FIXME: That version still under development at the moment of writing. # Make that this statement remains true also for stable, released # versions. # It will wrap lines (doesn't matter whether long or short) with a # trailing '\', as in: # # foo.o : \ # foo.c \ # foo.h \ # # It will put a trailing '\' even on the last line, and will use leading # spaces rather than leading tabs (at least since its commit 0394caf7 # "Emit spaces for -MD"). "$@" -MD -MF "$tmpdepfile" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" # Each non-empty line is of the form 'foo.o : \' or ' dep.h \'. # We have to change lines of the first kind to '$object: \'. sed -e "s|.*:|$object :|" < "$tmpdepfile" > "$depfile" # And for each line of the second kind, we have to emit a 'dep.h:' # dummy dependency, to avoid the deleted-header problem. sed -n -e 's|^ *\(.*\) *\\$|\1:|p' < "$tmpdepfile" >> "$depfile" rm -f "$tmpdepfile" ;; ## The order of this option in the case statement is important, since the ## shell code in configure will try each of these formats in the order ## listed in this file. A plain '-MD' option would be understood by many ## compilers, so we must ensure this comes after the gcc and icc options. pgcc) # Portland's C compiler understands '-MD'. # Will always output deps to 'file.d' where file is the root name of the # source file under compilation, even if file resides in a subdirectory. # The object file name does not affect the name of the '.d' file. # pgcc 10.2 will output # foo.o: sub/foo.c sub/foo.h # and will wrap long lines using '\' : # foo.o: sub/foo.c ... \ # sub/foo.h ... \ # ... set_dir_from "$object" # Use the source, not the object, to determine the base name, since # that's sadly what pgcc will do too. set_base_from "$source" tmpdepfile=$base.d # For projects that build the same source file twice into different object # files, the pgcc approach of using the *source* file root name can cause # problems in parallel builds. Use a locking strategy to avoid stomping on # the same $tmpdepfile. lockdir=$base.d-lock trap " echo '$0: caught signal, cleaning up...' >&2 rmdir '$lockdir' exit 1 " 1 2 13 15 numtries=100 i=$numtries while test $i -gt 0; do # mkdir is a portable test-and-set. if mkdir "$lockdir" 2>/dev/null; then # This process acquired the lock. "$@" -MD stat=$? # Release the lock. rmdir "$lockdir" break else # If the lock is being held by a different process, wait # until the winning process is done or we timeout. while test -d "$lockdir" && test $i -gt 0; do sleep 1 i=`expr $i - 1` done fi i=`expr $i - 1` done trap - 1 2 13 15 if test $i -le 0; then echo "$0: failed to acquire lock after $numtries attempts" >&2 echo "$0: check lockdir '$lockdir'" >&2 exit 1 fi if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" # Each line is of the form `foo.o: dependent.h', # or `foo.o: dep1.h dep2.h \', or ` dep3.h dep4.h \'. # Do two passes, one to just change these to # `$object: dependent.h' and one to simply `dependent.h:'. sed "s,^[^:]*:,$object :," < "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process this invocation # correctly. Breaking it into two sed invocations is a workaround. sed 's,^[^:]*: \(.*\)$,\1,;s/^\\$//;/^$/d;/:$/d' < "$tmpdepfile" \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; hp2) # The "hp" stanza above does not work with aCC (C++) and HP's ia64 # compilers, which have integrated preprocessors. The correct option # to use with these is +Maked; it writes dependencies to a file named # 'foo.d', which lands next to the object file, wherever that # happens to be. # Much of this is similar to the tru64 case; see comments there. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then tmpdepfile1=$dir$base.d tmpdepfile2=$dir.libs/$base.d "$@" -Wc,+Maked else tmpdepfile1=$dir$base.d tmpdepfile2=$dir$base.d "$@" +Maked fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" do test -f "$tmpdepfile" && break done if test -f "$tmpdepfile"; then sed -e "s,^.*\.[$lower]*:,$object:," "$tmpdepfile" > "$depfile" # Add 'dependent.h:' lines. sed -ne '2,${ s/^ *// s/ \\*$// s/$/:/ p }' "$tmpdepfile" >> "$depfile" else make_dummy_depfile fi rm -f "$tmpdepfile" "$tmpdepfile2" ;; tru64) # The Tru64 compiler uses -MD to generate dependencies as a side # effect. 'cc -MD -o foo.o ...' puts the dependencies into 'foo.o.d'. # At least on Alpha/Redhat 6.1, Compaq CCC V6.2-504 seems to put # dependencies in 'foo.d' instead, so we check for that too. # Subdirectories are respected. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then # Libtool generates 2 separate objects for the 2 libraries. These # two compilations output dependencies in $dir.libs/$base.o.d and # in $dir$base.o.d. We have to check for both files, because # one of the two compilations can be disabled. We should prefer # $dir$base.o.d over $dir.libs/$base.o.d because the latter is # automatically cleaned when .libs/ is deleted, while ignoring # the former would cause a distcleancheck panic. tmpdepfile1=$dir$base.o.d # libtool 1.5 tmpdepfile2=$dir.libs/$base.o.d # Likewise. tmpdepfile3=$dir.libs/$base.d # Compaq CCC V6.2-504 "$@" -Wc,-MD else tmpdepfile1=$dir$base.d tmpdepfile2=$dir$base.d tmpdepfile3=$dir$base.d "$@" -MD fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" do test -f "$tmpdepfile" && break done # Same post-processing that is required for AIX mode. aix_post_process_depfile ;; msvc7) if test "$libtool" = yes; then showIncludes=-Wc,-showIncludes else showIncludes=-showIncludes fi "$@" $showIncludes > "$tmpdepfile" stat=$? grep -v '^Note: including file: ' "$tmpdepfile" if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" echo "$object : \\" > "$depfile" # The first sed program below extracts the file names and escapes # backslashes for cygpath. The second sed program outputs the file # name when reading, but also accumulates all include files in the # hold buffer in order to output them again at the end. This only # works with sed implementations that can handle large buffers. sed < "$tmpdepfile" -n ' /^Note: including file: *\(.*\)/ { s//\1/ s/\\/\\\\/g p }' | $cygpath_u | sort -u | sed -n ' s/ /\\ /g s/\(.*\)/'"$tab"'\1 \\/p s/.\(.*\) \\/\1:/ H $ { s/.*/'"$tab"'/ G p }' >> "$depfile" echo >> "$depfile" # make sure the fragment doesn't end with a backslash rm -f "$tmpdepfile" ;; msvc7msys) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; #nosideeffect) # This comment above is used by automake to tell side-effect # dependency tracking mechanisms from slower ones. dashmstdout) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout, regardless of -o. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # Remove '-o $object'. IFS=" " for arg do case $arg in -o) shift ;; $object) shift ;; *) set fnord "$@" "$arg" shift # fnord shift # $arg ;; esac done test -z "$dashmflag" && dashmflag=-M # Require at least two characters before searching for ':' # in the target name. This is to cope with DOS-style filenames: # a dependency such as 'c:/foo/bar' could be seen as target 'c' otherwise. "$@" $dashmflag | sed "s|^[$tab ]*[^:$tab ][^:][^:]*:[$tab ]*|$object: |" > "$tmpdepfile" rm -f "$depfile" cat < "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process this sed invocation # correctly. Breaking it into two sed invocations is a workaround. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; dashXmstdout) # This case only exists to satisfy depend.m4. It is never actually # run, as this mode is specially recognized in the preamble. exit 1 ;; makedepend) "$@" || exit $? # Remove any Libtool call if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # X makedepend shift cleared=no eat=no for arg do case $cleared in no) set ""; shift cleared=yes ;; esac if test $eat = yes; then eat=no continue fi case "$arg" in -D*|-I*) set fnord "$@" "$arg"; shift ;; # Strip any option that makedepend may not understand. Remove # the object too, otherwise makedepend will parse it as a source file. -arch) eat=yes ;; -*|$object) ;; *) set fnord "$@" "$arg"; shift ;; esac done obj_suffix=`echo "$object" | sed 's/^.*\././'` touch "$tmpdepfile" ${MAKEDEPEND-makedepend} -o"$obj_suffix" -f"$tmpdepfile" "$@" rm -f "$depfile" # makedepend may prepend the VPATH from the source file name to the object. # No need to regex-escape $object, excess matching of '.' is harmless. sed "s|^.*\($object *:\)|\1|" "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process the last invocation # correctly. Breaking it into two sed invocations is a workaround. sed '1,2d' "$tmpdepfile" \ | tr ' ' "$nl" \ | sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" "$tmpdepfile".bak ;; cpp) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # Remove '-o $object'. IFS=" " for arg do case $arg in -o) shift ;; $object) shift ;; *) set fnord "$@" "$arg" shift # fnord shift # $arg ;; esac done "$@" -E \ | sed -n -e '/^# [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' \ -e '/^#line [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' \ | sed '$ s: \\$::' > "$tmpdepfile" rm -f "$depfile" echo "$object : \\" > "$depfile" cat < "$tmpdepfile" >> "$depfile" sed < "$tmpdepfile" '/^$/d;s/^ //;s/ \\$//;s/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; msvisualcpp) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi IFS=" " for arg do case "$arg" in -o) shift ;; $object) shift ;; "-Gm"|"/Gm"|"-Gi"|"/Gi"|"-ZI"|"/ZI") set fnord "$@" shift shift ;; *) set fnord "$@" "$arg" shift shift ;; esac done "$@" -E 2>/dev/null | sed -n '/^#line [0-9][0-9]* "\([^"]*\)"/ s::\1:p' | $cygpath_u | sort -u > "$tmpdepfile" rm -f "$depfile" echo "$object : \\" > "$depfile" sed < "$tmpdepfile" -n -e 's% %\\ %g' -e '/^\(.*\)$/ s::'"$tab"'\1 \\:p' >> "$depfile" echo "$tab" >> "$depfile" sed < "$tmpdepfile" -n -e 's% %\\ %g' -e '/^\(.*\)$/ s::\1\::p' >> "$depfile" rm -f "$tmpdepfile" ;; msvcmsys) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; none) exec "$@" ;; *) echo "Unknown depmode $depmode" 1>&2 exit 1 ;; esac exit 0 # Local Variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/aclocal.m40000644000000000000000000017004013051004465012057 00000000000000# generated automatically by aclocal 1.15 -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])]) m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.69],, [m4_warning([this file was generated for autoconf 2.69. You have another version of autoconf. It may work, but is not guaranteed to. If you have problems, you may need to regenerate the build system entirely. To do so, use the procedure documented by the package, typically 'autoreconf'.])]) dnl pkg.m4 - Macros to locate and utilise pkg-config. -*- Autoconf -*- dnl serial 11 (pkg-config-0.29.1) dnl dnl Copyright © 2004 Scott James Remnant . dnl Copyright © 2012-2015 Dan Nicholson dnl dnl This program is free software; you can redistribute it and/or modify dnl it under the terms of the GNU General Public License as published by dnl the Free Software Foundation; either version 2 of the License, or dnl (at your option) any later version. dnl dnl This program is distributed in the hope that it will be useful, but dnl WITHOUT ANY WARRANTY; without even the implied warranty of dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU dnl General Public License for more details. dnl dnl You should have received a copy of the GNU General Public License dnl along with this program; if not, write to the Free Software dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA dnl 02111-1307, USA. dnl dnl As a special exception to the GNU General Public License, if you dnl distribute this file as part of a program that contains a dnl configuration script generated by Autoconf, you may include it under dnl the same distribution terms that you use for the rest of that dnl program. dnl PKG_PREREQ(MIN-VERSION) dnl ----------------------- dnl Since: 0.29 dnl dnl Verify that the version of the pkg-config macros are at least dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's dnl installed version of pkg-config, this checks the developer's version dnl of pkg.m4 when generating configure. dnl dnl To ensure that this macro is defined, also add: dnl m4_ifndef([PKG_PREREQ], dnl [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])]) dnl dnl See the "Since" comment for each macro you use to see what version dnl of the macros you require. m4_defun([PKG_PREREQ], [m4_define([PKG_MACROS_VERSION], [0.29.1]) m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1, [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])]) ])dnl PKG_PREREQ dnl PKG_PROG_PKG_CONFIG([MIN-VERSION]) dnl ---------------------------------- dnl Since: 0.16 dnl dnl Search for the pkg-config tool and set the PKG_CONFIG variable to dnl first found in the path. Checks that the version of pkg-config found dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is dnl used since that's the first version where most current features of dnl pkg-config existed. AC_DEFUN([PKG_PROG_PKG_CONFIG], [m4_pattern_forbid([^_?PKG_[A-Z_]+$]) m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$]) m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$]) AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility]) AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path]) AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path]) if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then AC_PATH_TOOL([PKG_CONFIG], [pkg-config]) fi if test -n "$PKG_CONFIG"; then _pkg_min_version=m4_default([$1], [0.9.0]) AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version]) if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) PKG_CONFIG="" fi fi[]dnl ])dnl PKG_PROG_PKG_CONFIG dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) dnl ------------------------------------------------------------------- dnl Since: 0.18 dnl dnl Check to see whether a particular set of modules exists. Similar to dnl PKG_CHECK_MODULES(), but does not set variables or print errors. dnl dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG]) dnl only at the first occurence in configure.ac, so if the first place dnl it's called might be skipped (such as if it is within an "if", you dnl have to call PKG_CHECK_EXISTS manually AC_DEFUN([PKG_CHECK_EXISTS], [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl if test -n "$PKG_CONFIG" && \ AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then m4_default([$2], [:]) m4_ifvaln([$3], [else $3])dnl fi]) dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES]) dnl --------------------------------------------- dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting dnl pkg_failed based on the result. m4_define([_PKG_CONFIG], [if test -n "$$1"; then pkg_cv_[]$1="$$1" elif test -n "$PKG_CONFIG"; then PKG_CHECK_EXISTS([$3], [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes ], [pkg_failed=yes]) else pkg_failed=untried fi[]dnl ])dnl _PKG_CONFIG dnl _PKG_SHORT_ERRORS_SUPPORTED dnl --------------------------- dnl Internal check to see if pkg-config supports short errors. AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED], [AC_REQUIRE([PKG_PROG_PKG_CONFIG]) if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi[]dnl ])dnl _PKG_SHORT_ERRORS_SUPPORTED dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND], dnl [ACTION-IF-NOT-FOUND]) dnl -------------------------------------------------------------- dnl Since: 0.4.0 dnl dnl Note that if there is a possibility the first call to dnl PKG_CHECK_MODULES might not happen, you should be sure to include an dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac AC_DEFUN([PKG_CHECK_MODULES], [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl pkg_failed=no AC_MSG_CHECKING([for $1]) _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2]) _PKG_CONFIG([$1][_LIBS], [libs], [$2]) m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS and $1[]_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details.]) if test $pkg_failed = yes; then AC_MSG_RESULT([no]) _PKG_SHORT_ERRORS_SUPPORTED if test $_pkg_short_errors_supported = yes; then $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1` else $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD m4_default([$4], [AC_MSG_ERROR( [Package requirements ($2) were not met: $$1_PKG_ERRORS Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. _PKG_TEXT])[]dnl ]) elif test $pkg_failed = untried; then AC_MSG_RESULT([no]) m4_default([$4], [AC_MSG_FAILURE( [The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. _PKG_TEXT To get pkg-config, see .])[]dnl ]) else $1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS $1[]_LIBS=$pkg_cv_[]$1[]_LIBS AC_MSG_RESULT([yes]) $3 fi[]dnl ])dnl PKG_CHECK_MODULES dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND], dnl [ACTION-IF-NOT-FOUND]) dnl --------------------------------------------------------------------- dnl Since: 0.29 dnl dnl Checks for existence of MODULES and gathers its build flags with dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags dnl and VARIABLE-PREFIX_LIBS from --libs. dnl dnl Note that if there is a possibility the first call to dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to dnl include an explicit call to PKG_PROG_PKG_CONFIG in your dnl configure.ac. AC_DEFUN([PKG_CHECK_MODULES_STATIC], [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl _save_PKG_CONFIG=$PKG_CONFIG PKG_CONFIG="$PKG_CONFIG --static" PKG_CHECK_MODULES($@) PKG_CONFIG=$_save_PKG_CONFIG[]dnl ])dnl PKG_CHECK_MODULES_STATIC dnl PKG_INSTALLDIR([DIRECTORY]) dnl ------------------------- dnl Since: 0.27 dnl dnl Substitutes the variable pkgconfigdir as the location where a module dnl should install pkg-config .pc files. By default the directory is dnl $libdir/pkgconfig, but the default can be changed by passing dnl DIRECTORY. The user can override through the --with-pkgconfigdir dnl parameter. AC_DEFUN([PKG_INSTALLDIR], [m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])]) m4_pushdef([pkg_description], [pkg-config installation directory @<:@]pkg_default[@:>@]) AC_ARG_WITH([pkgconfigdir], [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],, [with_pkgconfigdir=]pkg_default) AC_SUBST([pkgconfigdir], [$with_pkgconfigdir]) m4_popdef([pkg_default]) m4_popdef([pkg_description]) ])dnl PKG_INSTALLDIR dnl PKG_NOARCH_INSTALLDIR([DIRECTORY]) dnl -------------------------------- dnl Since: 0.27 dnl dnl Substitutes the variable noarch_pkgconfigdir as the location where a dnl module should install arch-independent pkg-config .pc files. By dnl default the directory is $datadir/pkgconfig, but the default can be dnl changed by passing DIRECTORY. The user can override through the dnl --with-noarch-pkgconfigdir parameter. AC_DEFUN([PKG_NOARCH_INSTALLDIR], [m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])]) m4_pushdef([pkg_description], [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@]) AC_ARG_WITH([noarch-pkgconfigdir], [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],, [with_noarch_pkgconfigdir=]pkg_default) AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir]) m4_popdef([pkg_default]) m4_popdef([pkg_description]) ])dnl PKG_NOARCH_INSTALLDIR dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE, dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) dnl ------------------------------------------- dnl Since: 0.28 dnl dnl Retrieves the value of the pkg-config variable for the given module. AC_DEFUN([PKG_CHECK_VAR], [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl _PKG_CONFIG([$1], [variable="][$3]["], [$2]) AS_VAR_COPY([$1], [pkg_cv_][$1]) AS_VAR_IF([$1], [""], [$5], [$4])dnl ])dnl PKG_CHECK_VAR # Copyright (C) 2002-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_AUTOMAKE_VERSION(VERSION) # ---------------------------- # Automake X.Y traces this macro to ensure aclocal.m4 has been # generated from the m4 files accompanying Automake X.Y. # (This private macro should not be called outside this file.) AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version='1.15' dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to dnl require some minimum version. Point them to the right macro. m4_if([$1], [1.15], [], [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl ]) # _AM_AUTOCONF_VERSION(VERSION) # ----------------------------- # aclocal traces this macro to find the Autoconf version. # This is a private macro too. Using m4_define simplifies # the logic in aclocal, which can simply ignore this definition. m4_define([_AM_AUTOCONF_VERSION], []) # AM_SET_CURRENT_AUTOMAKE_VERSION # ------------------------------- # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced. # This function is AC_REQUIREd by AM_INIT_AUTOMAKE. AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION], [AM_AUTOMAKE_VERSION([1.15])dnl m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) # AM_AUX_DIR_EXPAND -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # For projects using AC_CONFIG_AUX_DIR([foo]), Autoconf sets # $ac_aux_dir to '$srcdir/foo'. In other projects, it is set to # '$srcdir', '$srcdir/..', or '$srcdir/../..'. # # Of course, Automake must honor this variable whenever it calls a # tool from the auxiliary directory. The problem is that $srcdir (and # therefore $ac_aux_dir as well) can be either absolute or relative, # depending on how configure is run. This is pretty annoying, since # it makes $ac_aux_dir quite unusable in subdirectories: in the top # source directory, any form will work fine, but in subdirectories a # relative path needs to be adjusted first. # # $ac_aux_dir/missing # fails when called from a subdirectory if $ac_aux_dir is relative # $top_srcdir/$ac_aux_dir/missing # fails if $ac_aux_dir is absolute, # fails when called from a subdirectory in a VPATH build with # a relative $ac_aux_dir # # The reason of the latter failure is that $top_srcdir and $ac_aux_dir # are both prefixed by $srcdir. In an in-source build this is usually # harmless because $srcdir is '.', but things will broke when you # start a VPATH build or use an absolute $srcdir. # # So we could use something similar to $top_srcdir/$ac_aux_dir/missing, # iff we strip the leading $srcdir from $ac_aux_dir. That would be: # am_aux_dir='\$(top_srcdir)/'`expr "$ac_aux_dir" : "$srcdir//*\(.*\)"` # and then we would define $MISSING as # MISSING="\${SHELL} $am_aux_dir/missing" # This will work as long as MISSING is not called from configure, because # unfortunately $(top_srcdir) has no meaning in configure. # However there are other variables, like CC, which are often used in # configure, and could therefore not use this "fixed" $ac_aux_dir. # # Another solution, used here, is to always expand $ac_aux_dir to an # absolute PATH. The drawback is that using absolute paths prevent a # configured tree to be moved without reconfiguration. AC_DEFUN([AM_AUX_DIR_EXPAND], [AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl # Expand $ac_aux_dir to an absolute path. am_aux_dir=`cd "$ac_aux_dir" && pwd` ]) # AM_CONDITIONAL -*- Autoconf -*- # Copyright (C) 1997-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_CONDITIONAL(NAME, SHELL-CONDITION) # ------------------------------------- # Define a conditional. AC_DEFUN([AM_CONDITIONAL], [AC_PREREQ([2.52])dnl m4_if([$1], [TRUE], [AC_FATAL([$0: invalid condition: $1])], [$1], [FALSE], [AC_FATAL([$0: invalid condition: $1])])dnl AC_SUBST([$1_TRUE])dnl AC_SUBST([$1_FALSE])dnl _AM_SUBST_NOTMAKE([$1_TRUE])dnl _AM_SUBST_NOTMAKE([$1_FALSE])dnl m4_define([_AM_COND_VALUE_$1], [$2])dnl if $2; then $1_TRUE= $1_FALSE='#' else $1_TRUE='#' $1_FALSE= fi AC_CONFIG_COMMANDS_PRE( [if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then AC_MSG_ERROR([[conditional "$1" was never defined. Usually this means the macro was only invoked conditionally.]]) fi])]) # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # There are a few dirty hacks below to avoid letting 'AC_PROG_CC' be # written in clear, in which case automake, when reading aclocal.m4, # will think it sees a *use*, and therefore will trigger all it's # C support machinery. Also note that it means that autoscan, seeing # CC etc. in the Makefile, will ask for an AC_PROG_CC use... # _AM_DEPENDENCIES(NAME) # ---------------------- # See how the compiler implements dependency checking. # NAME is "CC", "CXX", "OBJC", "OBJCXX", "UPC", or "GJC". # We try a few techniques and use that to set a single cache variable. # # We don't AC_REQUIRE the corresponding AC_PROG_CC since the latter was # modified to invoke _AM_DEPENDENCIES(CC); we would have a circular # dependency, and given that the user is not expected to run this macro, # just rely on AC_PROG_CC. AC_DEFUN([_AM_DEPENDENCIES], [AC_REQUIRE([AM_SET_DEPDIR])dnl AC_REQUIRE([AM_OUTPUT_DEPENDENCY_COMMANDS])dnl AC_REQUIRE([AM_MAKE_INCLUDE])dnl AC_REQUIRE([AM_DEP_TRACK])dnl m4_if([$1], [CC], [depcc="$CC" am_compiler_list=], [$1], [CXX], [depcc="$CXX" am_compiler_list=], [$1], [OBJC], [depcc="$OBJC" am_compiler_list='gcc3 gcc'], [$1], [OBJCXX], [depcc="$OBJCXX" am_compiler_list='gcc3 gcc'], [$1], [UPC], [depcc="$UPC" am_compiler_list=], [$1], [GCJ], [depcc="$GCJ" am_compiler_list='gcc3 gcc'], [depcc="$$1" am_compiler_list=]) AC_CACHE_CHECK([dependency style of $depcc], [am_cv_$1_dependencies_compiler_type], [if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_$1_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n ['s/^#*\([a-zA-Z0-9]*\))$/\1/p'] < ./depcomp` fi am__universal=false m4_case([$1], [CC], [case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac], [CXX], [case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac]) for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_$1_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_$1_dependencies_compiler_type=none fi ]) AC_SUBST([$1DEPMODE], [depmode=$am_cv_$1_dependencies_compiler_type]) AM_CONDITIONAL([am__fastdep$1], [ test "x$enable_dependency_tracking" != xno \ && test "$am_cv_$1_dependencies_compiler_type" = gcc3]) ]) # AM_SET_DEPDIR # ------------- # Choose a directory name for dependency files. # This macro is AC_REQUIREd in _AM_DEPENDENCIES. AC_DEFUN([AM_SET_DEPDIR], [AC_REQUIRE([AM_SET_LEADING_DOT])dnl AC_SUBST([DEPDIR], ["${am__leading_dot}deps"])dnl ]) # AM_DEP_TRACK # ------------ AC_DEFUN([AM_DEP_TRACK], [AC_ARG_ENABLE([dependency-tracking], [dnl AS_HELP_STRING( [--enable-dependency-tracking], [do not reject slow dependency extractors]) AS_HELP_STRING( [--disable-dependency-tracking], [speeds up one-time build])]) if test "x$enable_dependency_tracking" != xno; then am_depcomp="$ac_aux_dir/depcomp" AMDEPBACKSLASH='\' am__nodep='_no' fi AM_CONDITIONAL([AMDEP], [test "x$enable_dependency_tracking" != xno]) AC_SUBST([AMDEPBACKSLASH])dnl _AM_SUBST_NOTMAKE([AMDEPBACKSLASH])dnl AC_SUBST([am__nodep])dnl _AM_SUBST_NOTMAKE([am__nodep])dnl ]) # Generate code to set up dependency tracking. -*- Autoconf -*- # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_OUTPUT_DEPENDENCY_COMMANDS # ------------------------------ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS], [{ # Older Autoconf quotes --file arguments for eval, but not when files # are listed without --file. Let's play safe and only enable the eval # if we detect the quoting. case $CONFIG_FILES in *\'*) eval set x "$CONFIG_FILES" ;; *) set x $CONFIG_FILES ;; esac shift for mf do # Strip MF so we end up with the name of the file. mf=`echo "$mf" | sed -e 's/:.*$//'` # Check whether this is an Automake generated Makefile or not. # We used to match only the files named 'Makefile.in', but # some people rename them; so instead we look at the file content. # Grep'ing the first line is not enough: some people post-process # each Makefile.in and add a new line on top of each file to say so. # Grep'ing the whole file is not good either: AIX grep has a line # limit of 2048, but all sed's we know have understand at least 4000. if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then dirpart=`AS_DIRNAME("$mf")` else continue fi # Extract the definition of DEPDIR, am__include, and am__quote # from the Makefile without running 'make'. DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"` test -z "$DEPDIR" && continue am__include=`sed -n 's/^am__include = //p' < "$mf"` test -z "$am__include" && continue am__quote=`sed -n 's/^am__quote = //p' < "$mf"` # Find all dependency output files, they are included files with # $(DEPDIR) in their names. We invoke sed twice because it is the # simplest approach to changing $(DEPDIR) to its actual value in the # expansion. for file in `sed -n " s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \ sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do # Make sure the directory exists. test -f "$dirpart/$file" && continue fdir=`AS_DIRNAME(["$file"])` AS_MKDIR_P([$dirpart/$fdir]) # echo "creating $dirpart/$file" echo '# dummy' > "$dirpart/$file" done done } ])# _AM_OUTPUT_DEPENDENCY_COMMANDS # AM_OUTPUT_DEPENDENCY_COMMANDS # ----------------------------- # This macro should only be invoked once -- use via AC_REQUIRE. # # This code is only required when automatic dependency tracking # is enabled. FIXME. This creates each '.P' file that we will # need in order to bootstrap the dependency handling code. AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS], [AC_CONFIG_COMMANDS([depfiles], [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS], [AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"]) ]) # Do all the work for Automake. -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This macro actually does too much. Some checks are only needed if # your package does certain things. But this isn't really a big deal. dnl Redefine AC_PROG_CC to automatically invoke _AM_PROG_CC_C_O. m4_define([AC_PROG_CC], m4_defn([AC_PROG_CC]) [_AM_PROG_CC_C_O ]) # AM_INIT_AUTOMAKE(PACKAGE, VERSION, [NO-DEFINE]) # AM_INIT_AUTOMAKE([OPTIONS]) # ----------------------------------------------- # The call with PACKAGE and VERSION arguments is the old style # call (pre autoconf-2.50), which is being phased out. PACKAGE # and VERSION should now be passed to AC_INIT and removed from # the call to AM_INIT_AUTOMAKE. # We support both call styles for the transition. After # the next Automake release, Autoconf can make the AC_INIT # arguments mandatory, and then we can depend on a new Autoconf # release and drop the old call support. AC_DEFUN([AM_INIT_AUTOMAKE], [AC_PREREQ([2.65])dnl dnl Autoconf wants to disallow AM_ names. We explicitly allow dnl the ones we care about. m4_pattern_allow([^AM_[A-Z]+FLAGS$])dnl AC_REQUIRE([AM_SET_CURRENT_AUTOMAKE_VERSION])dnl AC_REQUIRE([AC_PROG_INSTALL])dnl if test "`cd $srcdir && pwd`" != "`pwd`"; then # Use -I$(srcdir) only when $(srcdir) != ., so that make's output # is not polluted with repeated "-I." AC_SUBST([am__isrc], [' -I$(srcdir)'])_AM_SUBST_NOTMAKE([am__isrc])dnl # test to see if srcdir already configured if test -f $srcdir/config.status; then AC_MSG_ERROR([source directory already configured; run "make distclean" there first]) fi fi # test whether we have cygpath if test -z "$CYGPATH_W"; then if (cygpath --version) >/dev/null 2>/dev/null; then CYGPATH_W='cygpath -w' else CYGPATH_W=echo fi fi AC_SUBST([CYGPATH_W]) # Define the identity of the package. dnl Distinguish between old-style and new-style calls. m4_ifval([$2], [AC_DIAGNOSE([obsolete], [$0: two- and three-arguments forms are deprecated.]) m4_ifval([$3], [_AM_SET_OPTION([no-define])])dnl AC_SUBST([PACKAGE], [$1])dnl AC_SUBST([VERSION], [$2])], [_AM_SET_OPTIONS([$1])dnl dnl Diagnose old-style AC_INIT with new-style AM_AUTOMAKE_INIT. m4_if( m4_ifdef([AC_PACKAGE_NAME], [ok]):m4_ifdef([AC_PACKAGE_VERSION], [ok]), [ok:ok],, [m4_fatal([AC_INIT should be called with package and version arguments])])dnl AC_SUBST([PACKAGE], ['AC_PACKAGE_TARNAME'])dnl AC_SUBST([VERSION], ['AC_PACKAGE_VERSION'])])dnl _AM_IF_OPTION([no-define],, [AC_DEFINE_UNQUOTED([PACKAGE], ["$PACKAGE"], [Name of package]) AC_DEFINE_UNQUOTED([VERSION], ["$VERSION"], [Version number of package])])dnl # Some tools Automake needs. AC_REQUIRE([AM_SANITY_CHECK])dnl AC_REQUIRE([AC_ARG_PROGRAM])dnl AM_MISSING_PROG([ACLOCAL], [aclocal-${am__api_version}]) AM_MISSING_PROG([AUTOCONF], [autoconf]) AM_MISSING_PROG([AUTOMAKE], [automake-${am__api_version}]) AM_MISSING_PROG([AUTOHEADER], [autoheader]) AM_MISSING_PROG([MAKEINFO], [makeinfo]) AC_REQUIRE([AM_PROG_INSTALL_SH])dnl AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl AC_REQUIRE([AC_PROG_MKDIR_P])dnl # For better backward compatibility. To be removed once Automake 1.9.x # dies out for good. For more background, see: # # AC_SUBST([mkdir_p], ['$(MKDIR_P)']) # We need awk for the "check" target (and possibly the TAP driver). The # system "awk" is bad on some platforms. AC_REQUIRE([AC_PROG_AWK])dnl AC_REQUIRE([AC_PROG_MAKE_SET])dnl AC_REQUIRE([AM_SET_LEADING_DOT])dnl _AM_IF_OPTION([tar-ustar], [_AM_PROG_TAR([ustar])], [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])], [_AM_PROG_TAR([v7])])]) _AM_IF_OPTION([no-dependencies],, [AC_PROVIDE_IFELSE([AC_PROG_CC], [_AM_DEPENDENCIES([CC])], [m4_define([AC_PROG_CC], m4_defn([AC_PROG_CC])[_AM_DEPENDENCIES([CC])])])dnl AC_PROVIDE_IFELSE([AC_PROG_CXX], [_AM_DEPENDENCIES([CXX])], [m4_define([AC_PROG_CXX], m4_defn([AC_PROG_CXX])[_AM_DEPENDENCIES([CXX])])])dnl AC_PROVIDE_IFELSE([AC_PROG_OBJC], [_AM_DEPENDENCIES([OBJC])], [m4_define([AC_PROG_OBJC], m4_defn([AC_PROG_OBJC])[_AM_DEPENDENCIES([OBJC])])])dnl AC_PROVIDE_IFELSE([AC_PROG_OBJCXX], [_AM_DEPENDENCIES([OBJCXX])], [m4_define([AC_PROG_OBJCXX], m4_defn([AC_PROG_OBJCXX])[_AM_DEPENDENCIES([OBJCXX])])])dnl ]) AC_REQUIRE([AM_SILENT_RULES])dnl dnl The testsuite driver may need to know about EXEEXT, so add the dnl 'am__EXEEXT' conditional if _AM_COMPILER_EXEEXT was seen. This dnl macro is hooked onto _AC_COMPILER_EXEEXT early, see below. AC_CONFIG_COMMANDS_PRE(dnl [m4_provide_if([_AM_COMPILER_EXEEXT], [AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"])])])dnl # POSIX will say in a future version that running "rm -f" with no argument # is OK; and we want to be able to make that assumption in our Makefile # recipes. So use an aggressive probe to check that the usage we want is # actually supported "in the wild" to an acceptable degree. # See automake bug#10828. # To make any issue more visible, cause the running configure to be aborted # by default if the 'rm' program in use doesn't match our expectations; the # user can still override this though. if rm -f && rm -fr && rm -rf; then : OK; else cat >&2 <<'END' Oops! Your 'rm' program seems unable to run without file operands specified on the command line, even when the '-f' option is present. This is contrary to the behaviour of most rm programs out there, and not conforming with the upcoming POSIX standard: Please tell bug-automake@gnu.org about your system, including the value of your $PATH and any error possibly output before this message. This can help us improve future automake versions. END if test x"$ACCEPT_INFERIOR_RM_PROGRAM" = x"yes"; then echo 'Configuration will proceed anyway, since you have set the' >&2 echo 'ACCEPT_INFERIOR_RM_PROGRAM variable to "yes"' >&2 echo >&2 else cat >&2 <<'END' Aborting the configuration process, to ensure you take notice of the issue. You can download and install GNU coreutils to get an 'rm' implementation that behaves properly: . If you want to complete the configuration process using your problematic 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM to "yes", and re-run configure. END AC_MSG_ERROR([Your 'rm' program is bad, sorry.]) fi fi dnl The trailing newline in this macro's definition is deliberate, for dnl backward compatibility and to allow trailing 'dnl'-style comments dnl after the AM_INIT_AUTOMAKE invocation. See automake bug#16841. ]) dnl Hook into '_AC_COMPILER_EXEEXT' early to learn its expansion. Do not dnl add the conditional right here, as _AC_COMPILER_EXEEXT may be further dnl mangled by Autoconf and run in a shell conditional statement. m4_define([_AC_COMPILER_EXEEXT], m4_defn([_AC_COMPILER_EXEEXT])[m4_provide([_AM_COMPILER_EXEEXT])]) # When config.status generates a header, we must update the stamp-h file. # This file resides in the same directory as the config header # that is generated. The stamp files are numbered to have different names. # Autoconf calls _AC_AM_CONFIG_HEADER_HOOK (when defined) in the # loop where config.status creates the headers, so we can generate # our stamp files there. AC_DEFUN([_AC_AM_CONFIG_HEADER_HOOK], [# Compute $1's index in $config_headers. _am_arg=$1 _am_stamp_count=1 for _am_header in $config_headers :; do case $_am_header in $_am_arg | $_am_arg:* ) break ;; * ) _am_stamp_count=`expr $_am_stamp_count + 1` ;; esac done echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_PROG_INSTALL_SH # ------------------ # Define $install_sh. AC_DEFUN([AM_PROG_INSTALL_SH], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; *) install_sh="\${SHELL} $am_aux_dir/install-sh" esac fi AC_SUBST([install_sh])]) # Copyright (C) 2003-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # Check whether the underlying file-system supports filenames # with a leading dot. For instance MS-DOS doesn't. AC_DEFUN([AM_SET_LEADING_DOT], [rm -rf .tst 2>/dev/null mkdir .tst 2>/dev/null if test -d .tst; then am__leading_dot=. else am__leading_dot=_ fi rmdir .tst 2>/dev/null AC_SUBST([am__leading_dot])]) # Check to see how 'make' treats includes. -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_MAKE_INCLUDE() # ----------------- # Check to see how make treats includes. AC_DEFUN([AM_MAKE_INCLUDE], [am_make=${MAKE-make} cat > confinc << 'END' am__doit: @echo this is the am__doit target .PHONY: am__doit END # If we don't find an include directive, just comment out the code. AC_MSG_CHECKING([for style of include used by $am_make]) am__include="#" am__quote= _am_result=none # First try GNU make style include. echo "include confinc" > confmf # Ignore all kinds of additional output from 'make'. case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=include am__quote= _am_result=GNU ;; esac # Now try BSD make style include. if test "$am__include" = "#"; then echo '.include "confinc"' > confmf case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=.include am__quote="\"" _am_result=BSD ;; esac fi AC_SUBST([am__include]) AC_SUBST([am__quote]) AC_MSG_RESULT([$_am_result]) rm -f confinc confmf ]) # Fake the existence of programs that GNU maintainers use. -*- Autoconf -*- # Copyright (C) 1997-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_MISSING_PROG(NAME, PROGRAM) # ------------------------------ AC_DEFUN([AM_MISSING_PROG], [AC_REQUIRE([AM_MISSING_HAS_RUN]) $1=${$1-"${am_missing_run}$2"} AC_SUBST($1)]) # AM_MISSING_HAS_RUN # ------------------ # Define MISSING if not defined so far and test if it is modern enough. # If it is, set am_missing_run to use it, otherwise, to nothing. AC_DEFUN([AM_MISSING_HAS_RUN], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl AC_REQUIRE_AUX_FILE([missing])dnl if test x"${MISSING+set}" != xset; then case $am_aux_dir in *\ * | *\ *) MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;; *) MISSING="\${SHELL} $am_aux_dir/missing" ;; esac fi # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= AC_MSG_WARN(['missing' script is too old or missing]) fi ]) # Helper functions for option handling. -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_MANGLE_OPTION(NAME) # ----------------------- AC_DEFUN([_AM_MANGLE_OPTION], [[_AM_OPTION_]m4_bpatsubst($1, [[^a-zA-Z0-9_]], [_])]) # _AM_SET_OPTION(NAME) # -------------------- # Set option NAME. Presently that only means defining a flag for this option. AC_DEFUN([_AM_SET_OPTION], [m4_define(_AM_MANGLE_OPTION([$1]), [1])]) # _AM_SET_OPTIONS(OPTIONS) # ------------------------ # OPTIONS is a space-separated list of Automake options. AC_DEFUN([_AM_SET_OPTIONS], [m4_foreach_w([_AM_Option], [$1], [_AM_SET_OPTION(_AM_Option)])]) # _AM_IF_OPTION(OPTION, IF-SET, [IF-NOT-SET]) # ------------------------------------------- # Execute IF-SET if OPTION is set, IF-NOT-SET otherwise. AC_DEFUN([_AM_IF_OPTION], [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])]) # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_PROG_CC_C_O # --------------- # Like AC_PROG_CC_C_O, but changed for automake. We rewrite AC_PROG_CC # to automatically call this. AC_DEFUN([_AM_PROG_CC_C_O], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl AC_REQUIRE_AUX_FILE([compile])dnl AC_LANG_PUSH([C])dnl AC_CACHE_CHECK( [whether $CC understands -c and -o together], [am_cv_prog_cc_c_o], [AC_LANG_CONFTEST([AC_LANG_PROGRAM([])]) # Make sure it works both with $CC and with simple cc. # Following AC_PROG_CC_C_O, we do the test twice because some # compilers refuse to overwrite an existing .o file with -o, # though they will create one. am_cv_prog_cc_c_o=yes for am_i in 1 2; do if AM_RUN_LOG([$CC -c conftest.$ac_ext -o conftest2.$ac_objext]) \ && test -f conftest2.$ac_objext; then : OK else am_cv_prog_cc_c_o=no break fi done rm -f core conftest* unset am_i]) if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. # FIXME: It is wrong to rewrite CC. # But if we don't then we get into trouble of one sort or another. # A longer-term fix would be to have automake use am__CC in this case, # and then we could set am__CC="\$(top_srcdir)/compile \$(CC)" CC="$am_aux_dir/compile $CC" fi AC_LANG_POP([C])]) # For backward compatibility. AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])]) # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_PATH_PYTHON([MINIMUM-VERSION], [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) # --------------------------------------------------------------------------- # Adds support for distributing Python modules and packages. To # install modules, copy them to $(pythondir), using the python_PYTHON # automake variable. To install a package with the same name as the # automake package, install to $(pkgpythondir), or use the # pkgpython_PYTHON automake variable. # # The variables $(pyexecdir) and $(pkgpyexecdir) are provided as # locations to install python extension modules (shared libraries). # Another macro is required to find the appropriate flags to compile # extension modules. # # If your package is configured with a different prefix to python, # users will have to add the install directory to the PYTHONPATH # environment variable, or create a .pth file (see the python # documentation for details). # # If the MINIMUM-VERSION argument is passed, AM_PATH_PYTHON will # cause an error if the version of python installed on the system # doesn't meet the requirement. MINIMUM-VERSION should consist of # numbers and dots only. AC_DEFUN([AM_PATH_PYTHON], [ dnl Find a Python interpreter. Python versions prior to 2.0 are not dnl supported. (2.0 was released on October 16, 2000). m4_define_default([_AM_PYTHON_INTERPRETER_LIST], [python python2 python3 python3.3 python3.2 python3.1 python3.0 python2.7 dnl python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 python2.0]) AC_ARG_VAR([PYTHON], [the Python interpreter]) m4_if([$1],[],[ dnl No version check is needed. # Find any Python interpreter. if test -z "$PYTHON"; then AC_PATH_PROGS([PYTHON], _AM_PYTHON_INTERPRETER_LIST, :) fi am_display_PYTHON=python ], [ dnl A version check is needed. if test -n "$PYTHON"; then # If the user set $PYTHON, use it and don't search something else. AC_MSG_CHECKING([whether $PYTHON version is >= $1]) AM_PYTHON_CHECK_VERSION([$PYTHON], [$1], [AC_MSG_RESULT([yes])], [AC_MSG_RESULT([no]) AC_MSG_ERROR([Python interpreter is too old])]) am_display_PYTHON=$PYTHON else # Otherwise, try each interpreter until we find one that satisfies # VERSION. AC_CACHE_CHECK([for a Python interpreter with version >= $1], [am_cv_pathless_PYTHON],[ for am_cv_pathless_PYTHON in _AM_PYTHON_INTERPRETER_LIST none; do test "$am_cv_pathless_PYTHON" = none && break AM_PYTHON_CHECK_VERSION([$am_cv_pathless_PYTHON], [$1], [break]) done]) # Set $PYTHON to the absolute path of $am_cv_pathless_PYTHON. if test "$am_cv_pathless_PYTHON" = none; then PYTHON=: else AC_PATH_PROG([PYTHON], [$am_cv_pathless_PYTHON]) fi am_display_PYTHON=$am_cv_pathless_PYTHON fi ]) if test "$PYTHON" = :; then dnl Run any user-specified action, or abort. m4_default([$3], [AC_MSG_ERROR([no suitable Python interpreter found])]) else dnl Query Python for its version number. Getting [:3] seems to be dnl the best way to do this; it's what "site.py" does in the standard dnl library. AC_CACHE_CHECK([for $am_display_PYTHON version], [am_cv_python_version], [am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version[[:3]])"`]) AC_SUBST([PYTHON_VERSION], [$am_cv_python_version]) dnl Use the values of $prefix and $exec_prefix for the corresponding dnl values of PYTHON_PREFIX and PYTHON_EXEC_PREFIX. These are made dnl distinct variables so they can be overridden if need be. However, dnl general consensus is that you shouldn't need this ability. AC_SUBST([PYTHON_PREFIX], ['${prefix}']) AC_SUBST([PYTHON_EXEC_PREFIX], ['${exec_prefix}']) dnl At times (like when building shared libraries) you may want dnl to know which OS platform Python thinks this is. AC_CACHE_CHECK([for $am_display_PYTHON platform], [am_cv_python_platform], [am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"`]) AC_SUBST([PYTHON_PLATFORM], [$am_cv_python_platform]) # Just factor out some code duplication. am_python_setup_sysconfig="\ import sys # Prefer sysconfig over distutils.sysconfig, for better compatibility # with python 3.x. See automake bug#10227. try: import sysconfig except ImportError: can_use_sysconfig = 0 else: can_use_sysconfig = 1 # Can't use sysconfig in CPython 2.7, since it's broken in virtualenvs: # try: from platform import python_implementation if python_implementation() == 'CPython' and sys.version[[:3]] == '2.7': can_use_sysconfig = 0 except ImportError: pass" dnl Set up 4 directories: dnl pythondir -- where to install python scripts. This is the dnl site-packages directory, not the python standard library dnl directory like in previous automake betas. This behavior dnl is more consistent with lispdir.m4 for example. dnl Query distutils for this directory. AC_CACHE_CHECK([for $am_display_PYTHON script directory], [am_cv_python_pythondir], [if test "x$prefix" = xNONE then am_py_prefix=$ac_default_prefix else am_py_prefix=$prefix fi am_cv_python_pythondir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix') sys.stdout.write(sitedir)"` case $am_cv_python_pythondir in $am_py_prefix*) am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'` am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"` ;; *) case $am_py_prefix in /usr|/System*) ;; *) am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages ;; esac ;; esac ]) AC_SUBST([pythondir], [$am_cv_python_pythondir]) dnl pkgpythondir -- $PACKAGE directory under pythondir. Was dnl PYTHON_SITE_PACKAGE in previous betas, but this naming is dnl more consistent with the rest of automake. AC_SUBST([pkgpythondir], [\${pythondir}/$PACKAGE]) dnl pyexecdir -- directory for installing python extension modules dnl (shared libraries) dnl Query distutils for this directory. AC_CACHE_CHECK([for $am_display_PYTHON extension module directory], [am_cv_python_pyexecdir], [if test "x$exec_prefix" = xNONE then am_py_exec_prefix=$am_py_prefix else am_py_exec_prefix=$exec_prefix fi am_cv_python_pyexecdir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix') sys.stdout.write(sitedir)"` case $am_cv_python_pyexecdir in $am_py_exec_prefix*) am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'` am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"` ;; *) case $am_py_exec_prefix in /usr|/System*) ;; *) am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages ;; esac ;; esac ]) AC_SUBST([pyexecdir], [$am_cv_python_pyexecdir]) dnl pkgpyexecdir -- $(pyexecdir)/$(PACKAGE) AC_SUBST([pkgpyexecdir], [\${pyexecdir}/$PACKAGE]) dnl Run any user-specified action. $2 fi ]) # AM_PYTHON_CHECK_VERSION(PROG, VERSION, [ACTION-IF-TRUE], [ACTION-IF-FALSE]) # --------------------------------------------------------------------------- # Run ACTION-IF-TRUE if the Python interpreter PROG has version >= VERSION. # Run ACTION-IF-FALSE otherwise. # This test uses sys.hexversion instead of the string equivalent (first # word of sys.version), in order to cope with versions such as 2.2c1. # This supports Python 2.0 or higher. (2.0 was released on October 16, 2000). AC_DEFUN([AM_PYTHON_CHECK_VERSION], [prog="import sys # split strings by '.' and convert to numeric. Append some zeros # because we need at least 4 digits for the hex conversion. # map returns an iterator in Python 3.0 and a list in 2.x minver = list(map(int, '$2'.split('.'))) + [[0, 0, 0]] minverhex = 0 # xrange is not present in Python 3.0 and range returns an iterator for i in list(range(0, 4)): minverhex = (minverhex << 8) + minver[[i]] sys.exit(sys.hexversion < minverhex)" AS_IF([AM_RUN_LOG([$1 -c "$prog"])], [$3], [$4])]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_RUN_LOG(COMMAND) # ------------------- # Run COMMAND, save the exit status in ac_status, and log it. # (This has been adapted from Autoconf's _AC_RUN_LOG macro.) AC_DEFUN([AM_RUN_LOG], [{ echo "$as_me:$LINENO: $1" >&AS_MESSAGE_LOG_FD ($1) >&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD (exit $ac_status); }]) # Check to make sure that the build environment is sane. -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_SANITY_CHECK # --------------- AC_DEFUN([AM_SANITY_CHECK], [AC_MSG_CHECKING([whether build environment is sane]) # Reject unsafe characters in $srcdir or the absolute working directory # name. Accept space and tab only in the latter. am_lf=' ' case `pwd` in *[[\\\"\#\$\&\'\`$am_lf]]*) AC_MSG_ERROR([unsafe absolute working directory name]);; esac case $srcdir in *[[\\\"\#\$\&\'\`$am_lf\ \ ]]*) AC_MSG_ERROR([unsafe srcdir value: '$srcdir']);; esac # Do 'set' in a subshell so we don't clobber the current shell's # arguments. Must try -L first in case configure is actually a # symlink; some systems play weird games with the mod time of symlinks # (eg FreeBSD returns the mod time of the symlink's containing # directory). if ( am_has_slept=no for am_try in 1 2; do echo "timestamp, slept: $am_has_slept" > conftest.file set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null` if test "$[*]" = "X"; then # -L didn't work. set X `ls -t "$srcdir/configure" conftest.file` fi if test "$[*]" != "X $srcdir/configure conftest.file" \ && test "$[*]" != "X conftest.file $srcdir/configure"; then # If neither matched, then we have a broken ls. This can happen # if, for instance, CONFIG_SHELL is bash and it inherits a # broken ls alias from the environment. This has actually # happened. Such a system could not be considered "sane". AC_MSG_ERROR([ls -t appears to fail. Make sure there is not a broken alias in your environment]) fi if test "$[2]" = conftest.file || test $am_try -eq 2; then break fi # Just in case. sleep 1 am_has_slept=yes done test "$[2]" = conftest.file ) then # Ok. : else AC_MSG_ERROR([newly created file is older than distributed files! Check your system clock]) fi AC_MSG_RESULT([yes]) # If we didn't sleep, we still need to ensure time stamps of config.status and # generated files are strictly newer. am_sleep_pid= if grep 'slept: no' conftest.file >/dev/null 2>&1; then ( sleep 1 ) & am_sleep_pid=$! fi AC_CONFIG_COMMANDS_PRE( [AC_MSG_CHECKING([that generated files are newer than configure]) if test -n "$am_sleep_pid"; then # Hide warnings about reused PIDs. wait $am_sleep_pid 2>/dev/null fi AC_MSG_RESULT([done])]) rm -f conftest.file ]) # Copyright (C) 2009-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_SILENT_RULES([DEFAULT]) # -------------------------- # Enable less verbose build rules; with the default set to DEFAULT # ("yes" being less verbose, "no" or empty being verbose). AC_DEFUN([AM_SILENT_RULES], [AC_ARG_ENABLE([silent-rules], [dnl AS_HELP_STRING( [--enable-silent-rules], [less verbose build output (undo: "make V=1")]) AS_HELP_STRING( [--disable-silent-rules], [verbose build output (undo: "make V=0")])dnl ]) case $enable_silent_rules in @%:@ ((( yes) AM_DEFAULT_VERBOSITY=0;; no) AM_DEFAULT_VERBOSITY=1;; *) AM_DEFAULT_VERBOSITY=m4_if([$1], [yes], [0], [1]);; esac dnl dnl A few 'make' implementations (e.g., NonStop OS and NextStep) dnl do not support nested variable expansions. dnl See automake bug#9928 and bug#10237. am_make=${MAKE-make} AC_CACHE_CHECK([whether $am_make supports nested variables], [am_cv_make_support_nested_variables], [if AS_ECHO([['TRUE=$(BAR$(V)) BAR0=false BAR1=true V=1 am__doit: @$(TRUE) .PHONY: am__doit']]) | $am_make -f - >/dev/null 2>&1; then am_cv_make_support_nested_variables=yes else am_cv_make_support_nested_variables=no fi]) if test $am_cv_make_support_nested_variables = yes; then dnl Using '$V' instead of '$(V)' breaks IRIX make. AM_V='$(V)' AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)' else AM_V=$AM_DEFAULT_VERBOSITY AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY fi AC_SUBST([AM_V])dnl AM_SUBST_NOTMAKE([AM_V])dnl AC_SUBST([AM_DEFAULT_V])dnl AM_SUBST_NOTMAKE([AM_DEFAULT_V])dnl AC_SUBST([AM_DEFAULT_VERBOSITY])dnl AM_BACKSLASH='\' AC_SUBST([AM_BACKSLASH])dnl _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl ]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_PROG_INSTALL_STRIP # --------------------- # One issue with vendor 'install' (even GNU) is that you can't # specify the program used to strip binaries. This is especially # annoying in cross-compiling environments, where the build's strip # is unlikely to handle the host's binaries. # Fortunately install-sh will honor a STRIPPROG variable, so we # always use install-sh in "make install-strip", and initialize # STRIPPROG with the value of the STRIP variable (set by the user). AC_DEFUN([AM_PROG_INSTALL_STRIP], [AC_REQUIRE([AM_PROG_INSTALL_SH])dnl # Installed binaries are usually stripped using 'strip' when the user # run "make install-strip". However 'strip' might not be the right # tool to use in cross-compilation environments, therefore Automake # will honor the 'STRIP' environment variable to overrule this program. dnl Don't test for $cross_compiling = yes, because it might be 'maybe'. if test "$cross_compiling" != no; then AC_CHECK_TOOL([STRIP], [strip], :) fi INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" AC_SUBST([INSTALL_STRIP_PROGRAM])]) # Copyright (C) 2006-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_SUBST_NOTMAKE(VARIABLE) # --------------------------- # Prevent Automake from outputting VARIABLE = @VARIABLE@ in Makefile.in. # This macro is traced by Automake. AC_DEFUN([_AM_SUBST_NOTMAKE]) # AM_SUBST_NOTMAKE(VARIABLE) # -------------------------- # Public sister of _AM_SUBST_NOTMAKE. AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)]) # Check how to create a tarball. -*- Autoconf -*- # Copyright (C) 2004-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_PROG_TAR(FORMAT) # -------------------- # Check how to create a tarball in format FORMAT. # FORMAT should be one of 'v7', 'ustar', or 'pax'. # # Substitute a variable $(am__tar) that is a command # writing to stdout a FORMAT-tarball containing the directory # $tardir. # tardir=directory && $(am__tar) > result.tar # # Substitute a variable $(am__untar) that extract such # a tarball read from stdin. # $(am__untar) < result.tar # AC_DEFUN([_AM_PROG_TAR], [# Always define AMTAR for backward compatibility. Yes, it's still used # in the wild :-( We should find a proper way to deprecate it ... AC_SUBST([AMTAR], ['$${TAR-tar}']) # We'll loop over all known methods to create a tar archive until one works. _am_tools='gnutar m4_if([$1], [ustar], [plaintar]) pax cpio none' m4_if([$1], [v7], [am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -'], [m4_case([$1], [ustar], [# The POSIX 1988 'ustar' format is defined with fixed-size fields. # There is notably a 21 bits limit for the UID and the GID. In fact, # the 'pax' utility can hang on bigger UID/GID (see automake bug#8343 # and bug#13588). am_max_uid=2097151 # 2^21 - 1 am_max_gid=$am_max_uid # The $UID and $GID variables are not portable, so we need to resort # to the POSIX-mandated id(1) utility. Errors in the 'id' calls # below are definitely unexpected, so allow the users to see them # (that is, avoid stderr redirection). am_uid=`id -u || echo unknown` am_gid=`id -g || echo unknown` AC_MSG_CHECKING([whether UID '$am_uid' is supported by ustar format]) if test $am_uid -le $am_max_uid; then AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) _am_tools=none fi AC_MSG_CHECKING([whether GID '$am_gid' is supported by ustar format]) if test $am_gid -le $am_max_gid; then AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) _am_tools=none fi], [pax], [], [m4_fatal([Unknown tar format])]) AC_MSG_CHECKING([how to create a $1 tar archive]) # Go ahead even if we have the value already cached. We do so because we # need to set the values for the 'am__tar' and 'am__untar' variables. _am_tools=${am_cv_prog_tar_$1-$_am_tools} for _am_tool in $_am_tools; do case $_am_tool in gnutar) for _am_tar in tar gnutar gtar; do AM_RUN_LOG([$_am_tar --version]) && break done am__tar="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$$tardir"' am__tar_="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$tardir"' am__untar="$_am_tar -xf -" ;; plaintar) # Must skip GNU tar: if it does not support --format= it doesn't create # ustar tarball either. (tar --version) >/dev/null 2>&1 && continue am__tar='tar chf - "$$tardir"' am__tar_='tar chf - "$tardir"' am__untar='tar xf -' ;; pax) am__tar='pax -L -x $1 -w "$$tardir"' am__tar_='pax -L -x $1 -w "$tardir"' am__untar='pax -r' ;; cpio) am__tar='find "$$tardir" -print | cpio -o -H $1 -L' am__tar_='find "$tardir" -print | cpio -o -H $1 -L' am__untar='cpio -i -H $1 -d' ;; none) am__tar=false am__tar_=false am__untar=false ;; esac # If the value was cached, stop now. We just wanted to have am__tar # and am__untar set. test -n "${am_cv_prog_tar_$1}" && break # tar/untar a dummy directory, and stop if the command works. rm -rf conftest.dir mkdir conftest.dir echo GrepMe > conftest.dir/file AM_RUN_LOG([tardir=conftest.dir && eval $am__tar_ >conftest.tar]) rm -rf conftest.dir if test -s conftest.tar; then AM_RUN_LOG([$am__untar /dev/null 2>&1 && break fi done rm -rf conftest.dir AC_CACHE_VAL([am_cv_prog_tar_$1], [am_cv_prog_tar_$1=$_am_tool]) AC_MSG_RESULT([$am_cv_prog_tar_$1])]) AC_SUBST([am__tar]) AC_SUBST([am__untar]) ]) # _AM_PROG_TAR m4_include([m4/libprelude.m4]) m4_include([m4/libtool.m4]) m4_include([m4/ltoptions.m4]) m4_include([m4/ltsugar.m4]) m4_include([m4/ltversion.m4]) m4_include([m4/lt~obsolete.m4]) suricata-3.2.1/contrib/0000755000000000000000000000000013051004531011727 500000000000000suricata-3.2.1/contrib/tile_pcie_logd/0000755000000000000000000000000013051004531014671 500000000000000suricata-3.2.1/contrib/tile_pcie_logd/Makefile.am0000644000000000000000000000041013051004444016643 00000000000000 EXTRA_DIST = LICENSE README if BUILD_PCIE_LOGGING bin_PROGRAMS = tile_pcie_logd tile_pcie_logd_SOURCE = tile_pcie_logd.c AM_CFLAGS = -std=gnu99 -Wall -Werror -g -O2 -I$(TILERA_ROOT)/include \ -DTILEPCI_HOST tile_pcie_logd_LDDADD = -pthread endif suricata-3.2.1/contrib/tile_pcie_logd/LICENSE0000644000000000000000000004310313051004444015622 00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. suricata-3.2.1/contrib/tile_pcie_logd/Makefile.in0000644000000000000000000005321313051004467016672 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ @BUILD_PCIE_LOGGING_TRUE@bin_PROGRAMS = tile_pcie_logd$(EXEEXT) subdir = contrib/tile_pcie_logd ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__installdirs = "$(DESTDIR)$(bindir)" PROGRAMS = $(bin_PROGRAMS) tile_pcie_logd_SOURCES = tile_pcie_logd.c tile_pcie_logd_OBJECTS = tile_pcie_logd.$(OBJEXT) tile_pcie_logd_LDADD = $(LDADD) AM_V_lt = $(am__v_lt_@AM_V@) am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) am__v_lt_0 = --silent am__v_lt_1 = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CFLAGS) $(CFLAGS) AM_V_CC = $(am__v_CC_@AM_V@) am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) am__v_CC_0 = @echo " CC " $@; am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; am__v_CCLD_1 = SOURCES = tile_pcie_logd.c DIST_SOURCES = tile_pcie_logd.c am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp README DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = LICENSE README @BUILD_PCIE_LOGGING_TRUE@tile_pcie_logd_SOURCE = tile_pcie_logd.c @BUILD_PCIE_LOGGING_TRUE@AM_CFLAGS = -std=gnu99 -Wall -Werror -g -O2 -I$(TILERA_ROOT)/include \ @BUILD_PCIE_LOGGING_TRUE@ -DTILEPCI_HOST @BUILD_PCIE_LOGGING_TRUE@tile_pcie_logd_LDDADD = -pthread all: all-am .SUFFIXES: .SUFFIXES: .c .lo .o .obj $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu contrib/tile_pcie_logd/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu contrib/tile_pcie_logd/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): install-binPROGRAMS: $(bin_PROGRAMS) @$(NORMAL_INSTALL) @list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(bindir)'"; \ $(MKDIR_P) "$(DESTDIR)$(bindir)" || exit 1; \ fi; \ for p in $$list; do echo "$$p $$p"; done | \ sed 's/$(EXEEXT)$$//' | \ while read p p1; do if test -f $$p \ || test -f $$p1 \ ; then echo "$$p"; echo "$$p"; else :; fi; \ done | \ sed -e 'p;s,.*/,,;n;h' \ -e 's|.*|.|' \ -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \ sed 'N;N;N;s,\n, ,g' | \ $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \ { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ if ($$2 == $$4) files[d] = files[d] " " $$1; \ else { print "f", $$3 "/" $$4, $$1; } } \ END { for (d in files) print "f", d, files[d] }' | \ while read type dir files; do \ if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \ test -z "$$files" || { \ echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(bindir)$$dir'"; \ $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(bindir)$$dir" || exit $$?; \ } \ ; done uninstall-binPROGRAMS: @$(NORMAL_UNINSTALL) @list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \ files=`for p in $$list; do echo "$$p"; done | \ sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \ -e 's/$$/$(EXEEXT)/' \ `; \ test -n "$$list" || exit 0; \ echo " ( cd '$(DESTDIR)$(bindir)' && rm -f" $$files ")"; \ cd "$(DESTDIR)$(bindir)" && rm -f $$files clean-binPROGRAMS: @list='$(bin_PROGRAMS)'; test -n "$$list" || exit 0; \ echo " rm -f" $$list; \ rm -f $$list || exit $$?; \ test -n "$(EXEEXT)" || exit 0; \ list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ echo " rm -f" $$list; \ rm -f $$list tile_pcie_logd$(EXEEXT): $(tile_pcie_logd_OBJECTS) $(tile_pcie_logd_DEPENDENCIES) $(EXTRA_tile_pcie_logd_DEPENDENCIES) @rm -f tile_pcie_logd$(EXEEXT) $(AM_V_CCLD)$(LINK) $(tile_pcie_logd_OBJECTS) $(tile_pcie_logd_LDADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tile_pcie_logd.Po@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $< .c.obj: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .c.lo: @am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-am TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-am CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-am cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile $(PROGRAMS) installdirs: for dir in "$(DESTDIR)$(bindir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-binPROGRAMS clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -rf ./$(DEPDIR) -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-binPROGRAMS install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-binPROGRAMS .MAKE: install-am install-strip .PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \ clean-binPROGRAMS clean-generic clean-libtool cscopelist-am \ ctags ctags-am distclean distclean-compile distclean-generic \ distclean-libtool distclean-tags distdir dvi dvi-am html \ html-am info info-am install install-am install-binPROGRAMS \ install-data install-data-am install-dvi install-dvi-am \ install-exec install-exec-am install-html install-html-am \ install-info install-info-am install-man install-pdf \ install-pdf-am install-ps install-ps-am install-strip \ installcheck installcheck-am installdirs maintainer-clean \ maintainer-clean-generic mostlyclean mostlyclean-compile \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags tags-am uninstall uninstall-am uninstall-binPROGRAMS .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/contrib/tile_pcie_logd/tile_pcie_logd.c0000644000000000000000000002753413051004444017735 00000000000000/* Copyright (C) 2013-2014 Tilera Corporation. * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * * \author Ken Steele, Tilera Corporation * \author Tom DeCanio * * Host side of PCIe alert logging from Suricata running on a * TILEncore-Gx card. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define CHECK_SEQ_NUM 1 /* The "/dev/tilegxpci%d" device to be used. */ unsigned int card_index = 0; unsigned int debug = 0; /* * When set, drop all alerts rather than write to file. This is for * testing performance on a file system that can't write files fast * enough. */ unsigned int drop_alerts = 0; /* Packet queue index. */ unsigned int queue_index; /* Prefix added to all file paths sent from PCIe card. */ char * path_prefix = NULL; /* By default, the host ring buffer is 4MB in size and it consists of * 1024 entries of 4KB buffers. Modify GXPCI_HOST_PQ_RING_ENTRIES in * to change the size of each buffer. To increase * the total ring buffer size, re-configure the host kernel using * CONFIG_FORCE_MAX_ZONEORDER. */ #ifdef GXPCI_HOST_PQ_SEGMENT_ENTRIES /* New definitions for MDE 4.1.5 */ #define RING_BUF_ELEMS GXPCI_HOST_PQ_SEGMENT_ENTRIES #define RING_BUF_ELEM_SIZE (HOST_PQ_SEGMENT_MAX_SIZE / GXPCI_HOST_PQ_SEGMENT_ENTRIES) #else /* Definitions prior to MDE 4.1.5 */ #define RING_BUF_ELEMS GXPCI_HOST_PQ_RING_ENTRIES #define RING_BUF_ELEM_SIZE (HOST_PQ_RING_BUF_MAX_SIZE / GXPCI_HOST_PQ_RING_ENTRIES) #endif /*********************************************************************/ /* Host-Side Packet Consumer */ /*********************************************************************/ #define TAIL_UPDATE_LIMIT_ENABLE #define OP_OPEN 1 #define OP_WRITE 2 #define OP_CLOSE 3 typedef struct { uint32_t magic; uint32_t fileno; uint32_t op; uint32_t seq; volatile uint32_t len; uint32_t next_offset; char buf[]; } TrioMsg; typedef struct { FILE *fd; } FDesc; #define MAX_FDESC 1024 static FDesc *fdesc[MAX_FDESC]; void run_pcie_logging(void) { char dev_name[40]; int pq_fd; unsigned int host_ring_buffer_size = RING_BUF_ELEMS * RING_BUF_ELEM_SIZE; volatile TrioMsg *p; printf("Waiting for PCIe logging data from card %d on queue %d...\n", card_index, queue_index); if (path_prefix) { printf("PCIe logging into directory: '%s'\n", path_prefix); fflush(stdout); } /* Open the packet queue file. */ snprintf(dev_name, sizeof(dev_name), "/dev/tilegxpci%d/packet_queue/t2h/%d", card_index, queue_index); do { pq_fd = open(dev_name, O_RDWR); if (pq_fd < 0) { sleep(1); } } while (pq_fd < 0); /* mmap the register space. */ struct gxpci_host_pq_regs_app* pq_regs = (struct gxpci_host_pq_regs_app*) mmap(0, sizeof(struct gxpci_host_pq_regs_app), PROT_READ | PROT_WRITE, MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_INDICES_MMAP_OFFSET); if (pq_regs == MAP_FAILED) { fprintf(stderr, "Failed to mmap PCIe control registers.\n"); exit(EXIT_FAILURE); } /* Configure and allocate the ring buffer for the receive queue. */ tilepci_packet_queue_info_t buf_info; buf_info.buf_size = RING_BUF_ELEM_SIZE; int err = ioctl(pq_fd, TILEPCI_IOC_SET_PACKET_QUEUE_BUF, &buf_info); if (err < 0) { fprintf(stderr, "Failed TILEPCI_IOC_SET_PACKET_QUEUE_BUF: %s\n", strerror(errno)); abort(); } /* On the host side, mmap the receive queue region. */ void* buffer = mmap(0, host_ring_buffer_size, PROT_READ | PROT_WRITE, MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_BUF_MMAP_OFFSET); assert(buffer != MAP_FAILED); /* On the host side, mmap the queue status. */ struct tlr_pq_status *pq_status = mmap(0, sizeof(struct tlr_pq_status), PROT_READ | PROT_WRITE, MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_STS_MMAP_OFFSET); assert(pq_status != MAP_FAILED); pq_regs->consumer_index = 0; uint64_t packet_count = 0; volatile uint32_t write; uint32_t read = 0; #ifdef CHECK_SEQ_NUM uint32_t expect_seq = 1; #endif #ifdef HOST_INTERRUPT_MODE volatile uint32_t* producer_index = &(pq_status->drv_consumer_index); #else volatile uint32_t* producer_index = &(pq_regs->producer_index); #endif volatile uint32_t* consumer_index = &(pq_regs->consumer_index); volatile enum gxpci_chan_status_t* status = &(pq_status->status); while (1) { if (*status == GXPCI_CHAN_RESET) { printf("Tile to Host PCIe logging channel was reset.\n"); fflush(stdout); return; } // Get packets off the ring buffer by accessing the receive queue at // the new write index. write = *producer_index; while (write != read) { if (*status == GXPCI_CHAN_RESET) { printf("Tile to Host PCIe logging channel was reset.\n"); fflush(stdout); return; } packet_count++; p = (TrioMsg *)(buffer + ((read&(RING_BUF_ELEMS-1))*RING_BUF_ELEM_SIZE)); if (debug) { fprintf(stdout, "got a message\n"); fprintf(stdout, "p->magic: %d\n", p->magic); fprintf(stdout, "p->fileno: %d\n", p->fileno); #ifdef CHECK_SEQ_NUM fprintf(stdout, "p->seq: %d\n", p->seq); #endif fprintf(stdout, "p->len: %d\n", p->len); fprintf(stdout, "p->next_offset: %d\n", p->next_offset); fprintf(stdout, "p->buf: "); fwrite(&p->buf, sizeof(char), p->len - offsetof(TrioMsg, buf), stdout); fprintf(stdout, "\n"); fflush(stdout); } #ifdef CHECK_SEQ_NUM if (p->seq != expect_seq) { /* Check for a reset before reporting a bad sequence * number to prevent confusing users. */ if (*status == GXPCI_CHAN_RESET) { printf("Tile to Host PCIe logging channel was reset.\n"); fflush(stdout); return; } fprintf(stderr, "BAD sequence expected %d got %d\n", expect_seq, p->seq); return; } expect_seq = p->seq + 1; #endif switch (p->op) { case OP_OPEN: if (p->fileno < MAX_FDESC) { fdesc[p->fileno] = malloc(sizeof(FDesc)); if (fdesc[p->fileno]) { char mode[2]; mode[0] = p->buf[0]; mode[1] = '\0'; char *file_name = (char *)&p->buf[1]; if (path_prefix) { /* Added path_prefix to the start of the * file name. Added space for '\0' and '\'. * By default, no prefix is added. */ int new_size = strlen(path_prefix) + strlen(file_name) + 1 + 1; char *new_name = malloc(new_size); if (!new_name) { fprintf(stderr, "Failed to allocate memory for %s/%s\n", path_prefix, file_name); return; } snprintf(new_name, new_size, "%s/%s", path_prefix, file_name); file_name = new_name; } if ((fdesc[p->fileno]->fd = fopen(file_name, mode)) == NULL) { fprintf(stderr, "Could not open %s: %s\n", file_name, strerror(errno)); } else { printf("Opened '%s' for logging.\n", file_name); fflush(stdout); } } } else { fprintf(stderr, "File number %d exceeds Max of %d\n", p->fileno, MAX_FDESC); } break; case OP_WRITE: if (drop_alerts) { /* TODO: Report alert count periodically. */ } else { if (fdesc[p->fileno] && fdesc[p->fileno]->fd) { fwrite(&p->buf, sizeof(char), p->len - offsetof(TrioMsg, buf), fdesc[p->fileno]->fd); fflush(fdesc[p->fileno]->fd); } } break; case OP_CLOSE: if (fdesc[p->fileno] && fdesc[p->fileno]->fd) { fclose( fdesc[p->fileno]->fd); free(fdesc[p->fileno]); fdesc[p->fileno] = NULL; } break; } read++; /* Update the read index register to inform the tile side * that the packet has been read. */ #ifdef TAIL_UPDATE_LIMIT_ENABLE if ((packet_count & 0x3f) == 0) *consumer_index = read; #else *consumer_index = read; #endif } } return; } /* * Match argument list option. * Options ending in '=' take an additional value, which may be * attached in the same argument or detached in the following * argument. * @param arglist Points to remaining argv, updated on match. * @param option The option to match, ending in '=' if it takes a value. * @return Value if option matches, NULL otherwise. */ char *shift_option(char ***arglist, const char* option) { char** args = *arglist; char* arg = args[0], **rest = &args[1]; int optlen = strlen(option); char* val = arg+optlen; if (option[optlen - 1] != '=') { if (strcmp(arg, option)) return NULL; } else { if (strncmp(arg, option, optlen-1)) return NULL; if (arg[optlen- 1 ] == '\0') val = *rest++; else if (arg[optlen - 1] != '=') return NULL; } *arglist = rest; return val; } int main(int argc, char** argv) { char **args = &argv[1]; /* * Scan command line options. */ while (*args) { char* opt = NULL; if ((opt = shift_option(&args, "--queue_index="))) queue_index = strtoul(opt, NULL, 0); else if ((opt = shift_option(&args, "--card="))) card_index = strtoul(opt, NULL, 0); else if ((opt = shift_option(&args, "--debug"))) debug = 1; else if ((opt = shift_option(&args, "--drop"))) drop_alerts = 1; else if ((opt = shift_option(&args, "--prefix="))) path_prefix = opt; else { fprintf(stderr, "Unknown option '%s'.\n", args[0]); exit(EXIT_FAILURE); } } run_pcie_logging(); return 0; } suricata-3.2.1/contrib/tile_pcie_logd/README0000644000000000000000000000237013051004444015476 00000000000000Introduction ------------ This application allows writing files to an x86 host from a TILEncore-Gx PCIe card. The file name and data are sent over PCIe using the Tilera Packet Queue API from an aplication running on the Tilera processor. The original purpose is to write log files from Suricata (Intrusion Dectection System) on the x86 host's file system. Running The Logger ------------------ To run the application, set the TILERA_ROOT environment variable to point to a valide Tilera MDE, then do: make run The application should be started before the application on the Tile side that will be generating the log data. By default, queue number 0 is used. The --queue_index=N command line argument can be used to change the queue number. If more than one TILEncore-Gx PCIe card is installed, the --card=M argument changes to listening to card M. Caveats ------- Due to the fact that the host driver allocates 4MB physically contiguous memory for the packet queue ring buffer, it is possible that this allocation could fail on a host whose memory has been considerably fragmented. If the host program exits with the following error, reboot the host and run the test again. Host: Failed to open '/dev/tilegxpci%d/packet_queue/t2h/0': Cannot allocate memory suricata-3.2.1/contrib/Makefile.am0000644000000000000000000000010413051004444013701 00000000000000SUBDIRS = file_processor tile_pcie_logd EXTRA_DIST = suri-graphite suricata-3.2.1/contrib/Makefile.in0000644000000000000000000005063113051004467013731 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = contrib ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ distdir am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = file_processor tile_pcie_logd EXTRA_DIST = suri-graphite all: all-recursive .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu contrib/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu contrib/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done check-am: all-am check: check-recursive all-am: Makefile installdirs: installdirs-recursive installdirs-am: install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f Makefile distclean-am: clean-am distclean-generic distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: .MAKE: $(am__recursive_targets) install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \ check-am clean clean-generic clean-libtool cscopelist-am ctags \ ctags-am distclean distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/contrib/file_processor/0000755000000000000000000000000013051004531014745 500000000000000suricata-3.2.1/contrib/file_processor/Makefile.am0000644000000000000000000000013613051004444016724 00000000000000SUBDIRS = Action Processor EXTRA_DIST = file_processor.conf file_processor.pl LICENSE README suricata-3.2.1/contrib/file_processor/Processor/0000755000000000000000000000000013051004531016724 500000000000000suricata-3.2.1/contrib/file_processor/Processor/Malwr.pm0000644000000000000000000000200613051004444020265 00000000000000package Processor::Malwr; use Moose; extends 'Processor'; use Data::Dumper; use LWP::UserAgent; has 'md5' => (is => 'ro', isa => 'Str', required => 1); has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://malwr.com/analysis/%s/'); sub name { 'Malwr' } sub description { 'Processor for Malwr.com' } sub process { my $self = shift; my $url = sprintf($self->url_template, $self->md5); $self->log->debug('Getting url ' . $url); my $response = $self->ua->get($url); if ($response->code eq 200){ if ($response->decoded_content =~ /Cannot find analysis with specified ID or MD5/){ $self->log->debug('No result'); return 0; } $self->log->info('Got malwr.com result'); return $url; } else { $self->log->debug('Communications failure: ' . Dumper($response)); return 0; } } 1suricata-3.2.1/contrib/file_processor/Processor/Makefile.am0000644000000000000000000000012113051004444020675 00000000000000EXTRA_DIST=Anubis.pm Malwr.pm ShadowServer.pm ThreatExpert.pm VirusTotal.pm suricata-3.2.1/contrib/file_processor/Processor/ThreatExpert.pm0000644000000000000000000000205713051004444021630 00000000000000package Processor::ThreatExpert; use Moose; extends 'Processor'; use Data::Dumper; use LWP::UserAgent; has 'md5' => (is => 'ro', isa => 'Str', required => 1); has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://www.threatexpert.com/report.aspx?md5=%s'); sub name { 'ThreatExpert' } sub description { 'Processor for threatexpert.com' } sub process { my $self = shift; my $url = sprintf($self->url_template, $self->md5); $self->log->debug('Getting url ' . $url); my $response = $self->ua->get($url); #$self->log->debug(Dumper($response)); if ($response->code eq 200){ if ($response->decoded_content =~ /Search All Reports/){ $self->log->debug('No result'); return 0; } $self->log->info('Got result'); return $url; } else { $self->log->debug('Communications failure: ' . Dumper($response)); return 0; } } 1suricata-3.2.1/contrib/file_processor/Processor/Makefile.in0000644000000000000000000003440613051004467020730 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = contrib/file_processor/Processor ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = Anubis.pm Malwr.pm ShadowServer.pm ThreatExpert.pm VirusTotal.pm all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu contrib/file_processor/Processor/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu contrib/file_processor/Processor/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/contrib/file_processor/Processor/ShadowServer.pm0000644000000000000000000000271613051004444021627 00000000000000package Processor::ShadowServer; use Moose; extends 'Processor'; use Data::Dumper; use LWP::UserAgent; use JSON; has 'md5' => (is => 'ro', isa => 'Str', required => 1); has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://innocuous.shadowserver.org/api/?query=%s'); sub name { 'ShadowServer' } sub description { 'Processor for shadowserver.com' } sub process { my $self = shift; my $url = sprintf($self->url_template, $self->md5); $self->log->debug('Getting url ' . $url); my $response = $self->ua->get($url); if ($response->code eq 200){ if ($response->decoded_content =~ /No match/){ $self->log->debug('No result'); return 0; } elsif ($response->decoded_content =~ /Whitelisted/){ $self->log->info('Whitelisted'); return 0; } $self->log->info('Got shadowserver.com result'); my $ret; eval { my ($meta,$json) = split(/\n/, $response->decoded_content); my @meta_cols = qw(md5 sha1 first_date last_date type ssdeep); my %metas; @metas{@meta_cols} = split(/\,/, $meta); $ret = { meta => \%metas, results => decode_json($json) }; }; if ($@){ $self->log->error($@); return 0; } return $ret; } else { $self->log->debug('Communications failure: ' . Dumper($response)); return 0; } } 1 suricata-3.2.1/contrib/file_processor/Processor/VirusTotal.pm0000644000000000000000000000245213051004444021324 00000000000000package Processor::VirusTotal; use Moose; extends 'Processor'; use Data::Dumper; use LWP::UserAgent; has 'md5' => (is => 'ro', isa => 'Str', required => 1); has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); has 'url' => (is => 'ro', isa => 'Str', required => 1, default => 'https://www.virustotal.com/vtapi/v2/file/report'); sub name { 'VirusTotal' } sub description { 'Processor for virustotal.com' } sub process { my $self = shift; unless ($self->conf->{virustotal_apikey}){ warn('No VirusTotal apikey configured in config file'); return 0; } $self->log->debug('Getting url ' . $self->url); #$self->log->debug('md5: ' . $self->md5 . ', apikey: ' . $self->conf->{virustotal_apikey}); my $response = $self->ua->post($self->url, { resource => $self->md5, apikey => $self->conf->{virustotal_apikey} }); #$self->log->debug(Dumper($response)); if ($response->code eq 200){ my $data = $self->json->decode($response->decoded_content); $self->log->debug('data: ' . Dumper($data)); if ($data->{positives}){ return $data; } else { return 0; } } else { $self->log->debug('Communications failure: ' . Dumper($response)); return 0; } } 1suricata-3.2.1/contrib/file_processor/Processor/Anubis.pm0000644000000000000000000000204713051004444020431 00000000000000package Processor::Anubis; use Moose; extends 'Processor'; use Data::Dumper; use LWP::UserAgent; has 'md5' => (is => 'ro', isa => 'Str', required => 1); has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://anubis.iseclab.org/?action=result&task_id=%s'); sub name { 'Anubis' } sub description { 'Processor for anubis.iseclab.org' } sub process { my $self = shift; my $url = sprintf($self->url_template, $self->md5); $self->log->debug('Getting url ' . $url); my $response = $self->ua->get($url); #$self->log->debug(Dumper($response)); if ($response->code eq 200){ if ($response->decoded_content =~ /Invalid Task ID/){ $self->log->debug('No result'); return 0; } $self->log->info('Got result'); return $url; } else { $self->log->debug('Communications failure: ' . Dumper($response)); return 0; } } 1suricata-3.2.1/contrib/file_processor/LICENSE0000644000000000000000000004310313051004444015676 00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. suricata-3.2.1/contrib/file_processor/Action/0000755000000000000000000000000013051004531016162 500000000000000suricata-3.2.1/contrib/file_processor/Action/Log.pm0000644000000000000000000000040413051004444017162 00000000000000package Action::Log; use Moose; extends 'Processor'; has 'data' => (is => 'rw', isa => 'HashRef', required => 1); sub name { 'log' } sub description { 'Log to file' } sub perform { my $self = shift; $self->log->info($self->json->encode($self->data)); } 1suricata-3.2.1/contrib/file_processor/Action/Syslog.pm0000644000000000000000000000064713051004444017732 00000000000000package Action::Syslog; use Moose; extends 'Processor'; use Sys::Syslog qw(:standard :macros); our $Program = 'suricata_file'; our $Facility = LOG_LOCAL0; has 'data' => (is => 'rw', isa => 'HashRef', required => 1); sub name { 'syslog' } sub description { 'Log to local syslog' } sub perform { my $self = shift; openlog($Program, undef, $Facility); syslog(LOG_INFO, $self->json->encode($self->data)); closelog; } 1 suricata-3.2.1/contrib/file_processor/Action/Makefile.am0000644000000000000000000000003413051004444020136 00000000000000EXTRA_DIST=Log.pm Syslog.pm suricata-3.2.1/contrib/file_processor/Action/Makefile.in0000644000000000000000000003431113051004467020161 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = contrib/file_processor/Action ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = Log.pm Syslog.pm all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu contrib/file_processor/Action/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu contrib/file_processor/Action/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/contrib/file_processor/Makefile.in0000644000000000000000000005075013051004467016751 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = contrib/file_processor ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ distdir am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in README DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = Action Processor EXTRA_DIST = file_processor.conf file_processor.pl LICENSE README all: all-recursive .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu contrib/file_processor/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu contrib/file_processor/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done check-am: all-am check: check-recursive all-am: Makefile installdirs: installdirs-recursive installdirs-am: install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f Makefile distclean-am: clean-am distclean-generic distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: .MAKE: $(am__recursive_targets) install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \ check-am clean clean-generic clean-libtool cscopelist-am ctags \ ctags-am distclean distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/contrib/file_processor/file_processor.conf0000644000000000000000000000047113051004444020557 00000000000000{ "logdir": "/var/log/suricata", "debug_level": "INFO", #"virustotal_apikey": "xxx" "actions": { "Action::Log": 1, "Action::Syslog": 1 }, "processors": { "Processor::Anubis": 1, "Processor::Malwr": 1, "Processor::ThreatExpert": 1, "Processor::ShadowServer": 1 #"Processor::VirusTotal": 1 } } suricata-3.2.1/contrib/file_processor/README0000644000000000000000000000304713051004444015554 00000000000000This directory contains what's needed for reading the JSON file /var/log/suricata/files-json.log and processing those entries against plugins. Included are plugins for checking the MD5 of the observed file on the network against already created reports on anubis.iseclab.org, malwr.com, and threatexpert.com. If you have a virustotal.com API key (free, though see the terms of use on virustotal.com/documentation/public-api/), you can enable the virustotal.com plugin and configure your API key so you can check the MD5 against over forty AV vendors' results. To create new plugins, use the existing modules as a guide. Drop a new file with the .pm extension in either the Processor or Action directory, depending on what kind of plugin it is. Processor plugins add information to the data. Action plugins do something with the data once all of the information is available. A simple logging demo has been included, but many different kinds of action plugins could be written to do things like submit full files to a sandbox, send an email, log to a database, send an SNMP trap, etc. INSTALLATION You will need a few Perl modules to get going. I recommend using the excellent cpanm utility which can be installed by typing "cpan App::cpanminus." After cpanm is installed, you can install everything in one command like this: cpanm Moose Module::Pluggable Log::Log4perl Config::JSON File::Tail LWP::UserAgent Sys::Syslog Alternatively, you may wish to install using your operating system's package manager, though that may not use the latest code for these modules. suricata-3.2.1/contrib/file_processor/file_processor.pl0000644000000000000000000001204513051004444020245 00000000000000# Copyright (C) 2012 Martin Holste # # You can copy, redistribute or modify this Program under the terms of # the GNU General Public License version 2 as published by the Free # Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # version 2 along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA # 02110-1301, USA. # package Processor; use Moose; use Data::Dumper; use Module::Pluggable search_path => qw(Processor), sub_name => 'processors'; use Module::Pluggable search_path => qw(Action), sub_name => 'actions'; use Log::Log4perl; use JSON; has 'conf' => (is => 'rw', isa => 'HashRef', required => 1); has 'log' => (is => 'rw', isa => 'Object', required => 1); has 'json' => (is => 'ro', isa => 'JSON', required => 1, default => sub { return JSON->new->pretty->allow_blessed }); sub BUILD { my $self = shift; foreach my $processor_plugin ($self->processors){ next unless exists $self->conf->{processors}->{$processor_plugin}; eval qq{require $processor_plugin}; $self->log->info('Using processor plugin ' . $processor_plugin->description); } foreach my $action_plugin ($self->actions){ next unless exists $self->conf->{actions}->{$action_plugin}; eval qq{require $action_plugin}; $self->log->info('Using action plugin ' . $action_plugin->description); } } sub process { my $self = shift; my $line = shift; #$self->log->debug('got line ' . $line); eval { my $data = $self->json->decode($line); $data->{processors} = {}; if($data->{md5}){ foreach my $processor_plugin ($self->processors){ next unless exists $self->conf->{processors}->{$processor_plugin}; my $processor = $processor_plugin->new(conf => $self->conf, log => $self->log, md5 => $data->{md5}); $self->log->debug('processing with plugin ' . $processor->description); $data->{processors}->{ $processor->name } = $processor->process(); } } #$self->log->debug('data: ' . Dumper($data)); foreach my $action_plugin ($self->actions){ next unless exists $self->conf->{actions}->{$action_plugin}; my $action = $action_plugin->new(conf => $self->conf, log => $self->log, data => $data); $self->log->debug('performing action with plugin ' . $action->description); $action->perform(); } }; if ($@){ $self->log->error('Error: ' . $@ . ', processing line: ' . $line); } } package main; use strict; use Getopt::Std; use FindBin; use Config::JSON; use File::Tail; # Include the directory this script is in use lib $FindBin::Bin; my %Opts; getopts('c:', \%Opts); my $conf_file = $Opts{c} ? $Opts{c} : '/etc/suricata/file_processor.conf'; my $Conf = { logdir => '/tmp', debug_level => 'TRACE', actions => { 'Action::Log' => 1, 'Action::Syslog' => 1, }, processors => { 'Processor::Anubis' => 1, 'Processor::Malwr' => 1, 'Processor::ThreatExpert' => 1, } }; if (-f $conf_file){ $Conf = Config::JSON->new( $conf_file ); $Conf = $Conf->{config}; # native hash is 10x faster than using Config::JSON->get() } # Setup logger my $logdir = $Conf->{logdir} ? $Conf->{logdir} : '/var/log/suricata'; my $debug_level = $Conf->{debug_level} ? $Conf->{debug_level} : 'TRACE'; my $l4pconf = qq( log4perl.category.App = $debug_level, File, Screen log4perl.appender.File = Log::Log4perl::Appender::File log4perl.appender.File.filename = $logdir/file_processor.log log4perl.appender.File.syswrite = 1 log4perl.appender.File.recreate = 1 log4perl.appender.File.layout = Log::Log4perl::Layout::PatternLayout log4perl.appender.File.layout.ConversionPattern = * %p [%d] %F (%L) %M %P %m%n log4perl.filter.ScreenLevel = Log::Log4perl::Filter::LevelRange log4perl.filter.ScreenLevel.LevelMin = $debug_level log4perl.filter.ScreenLevel.LevelMax = ERROR log4perl.filter.ScreenLevel.AcceptOnMatch = true log4perl.appender.Screen = Log::Log4perl::Appender::Screen log4perl.appender.Screen.Filter = ScreenLevel log4perl.appender.Screen.stderr = 1 log4perl.appender.Screen.layout = Log::Log4perl::Layout::PatternLayout log4perl.appender.Screen.layout.ConversionPattern = * %p [%d] %F (%L) %M %P %m%n ); Log::Log4perl::init( \$l4pconf ) or die("Unable to init logger\n"); my $Log = Log::Log4perl::get_logger('App') or die("Unable to init logger\n"); my $processor = new Processor(conf => $Conf, log => $Log); my $file = $Conf->{file} ? $Conf->{file} : '/var/log/suricata/files-json.log'; my $tail = new File::Tail(name => $file, maxinterval => 1); while (my $line = $tail->read){ $processor->process($line); } __END__ Example config file /etc/suricata/file_processor.conf { "logdir": "/var/log/suricata", "debug_level": "INFO", "virustotal_apikey": "xxx" "actions": { "Action::Log": 1 }, "processors": { "Processor::Anubis": 1, "Processor::Malwr": 1, "Processor::ThreatExpert": 1, "Processor::VirusTotal": 1 } } suricata-3.2.1/contrib/suri-graphite0000755000000000000000000000622313051004444014366 00000000000000#!/usr/bin/env python # Copyright (C) 2013, 2015 Eric Leblond # # You can copy, redistribute or modify this Program under the terms of # the GNU General Public License version 3 as published by the Free # Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # version 3 along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA # 02110-1301, USA. import suricatasc import socket import time import argparse have_daemon = True try: import daemon except: logging.warning("No daemon support available, install python-daemon if feature is needed") have_daemon = False parser = argparse.ArgumentParser(prog='suri-graphite', description='Export suricata stats to Graphite') parser.add_argument('-H', '--host', default='localhost', help='Host running Graphite') parser.add_argument('-P', '--port', default=2003, help='Port of Graphite data socket') parser.add_argument('-O', '--oneshot', action='store_const', const=True, help='Send one update and exit', default=False) parser.add_argument('-D', '--delay', default=10, help='Delay between data dump') parser.add_argument('-r', '--root', default='suricata.perf', help='Prefix of data name in Graphite') parser.add_argument('-o', '--output', default=None, help='Output stats to a file instead of using Graphite') parser.add_argument('socket', help='suricata socket file to connect to', default="/usr/local/var/run/suricata/suricata-command.socket", nargs='?') parser.add_argument('-v', '--verbose', action='store_const', const=True, help='verbose output', default=False) if have_daemon: parser.add_argument('-d', '--daemon', default=False, action="store_true", help="Run as unix daemon") args = parser.parse_args() if args.output: import json def main_task(args): sc = suricatasc.SuricataSC(args.socket) sc.connect() if args.output: logfile = open(args.output, 'a') else: sck = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sck.connect((args.host, int(args.port))) while 1: res = sc.send_command("dump-counters") res = res['message'] tnow = int(time.time()) for thread in res: for counter in res[thread]: if args.output: data = {"key": "%s.%s" % (thread , counter), "value": res[thread][counter], "time": tnow} logfile.write(json.dumps(data) + '\n') else: sck.send("%s.%s.%s %s %d\n" % (args.root, thread , counter, res[thread][counter], tnow)) if args.verbose: print "%s.%s.%s %s %d\n" % (args.root, thread , counter, res[thread][counter], tnow) if args.oneshot: break time.sleep(float(args.delay)) if have_daemon and args.daemon: with daemon.DaemonContext(): main_task(args) else: main_task(args) suricata-3.2.1/classification.config0000644000000000000000000000671513051004444014405 00000000000000# $Id$ # classification.config taken from Snort 2.8.5.3. Snort is governed by the GPLv2 # # The following includes information for prioritizing rules # # Each classification includes a shortname, a description, and a default # priority for that classification. # # This allows alerts to be classified and prioritized. You can specify # what priority each classification has. Any rule can override the default # priority for that rule. # # Here are a few example rules: # # alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow"; # dsize: > 128; classtype:attempted-admin; priority:10; # # alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \ # content:"expn root"; nocase; classtype:attempted-recon;) # # The first rule will set its type to "attempted-admin" and override # the default priority for that type to 10. # # The second rule set its type to "attempted-recon" and set its # priority to the default for that type. # # # config classification:shortname,short description,priority # config classification: not-suspicious,Not Suspicious Traffic,3 config classification: unknown,Unknown Traffic,3 config classification: bad-unknown,Potentially Bad Traffic, 2 config classification: attempted-recon,Attempted Information Leak,2 config classification: successful-recon-limited,Information Leak,2 config classification: successful-recon-largescale,Large Scale Information Leak,2 config classification: attempted-dos,Attempted Denial of Service,2 config classification: successful-dos,Denial of Service,2 config classification: attempted-user,Attempted User Privilege Gain,1 config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1 config classification: successful-user,Successful User Privilege Gain,1 config classification: attempted-admin,Attempted Administrator Privilege Gain,1 config classification: successful-admin,Successful Administrator Privilege Gain,1 # NEW CLASSIFICATIONS config classification: rpc-portmap-decode,Decode of an RPC Query,2 config classification: shellcode-detect,Executable code was detected,1 config classification: string-detect,A suspicious string was detected,3 config classification: suspicious-filename-detect,A suspicious filename was detected,2 config classification: suspicious-login,An attempted login using a suspicious username was detected,2 config classification: system-call-detect,A system call was detected,2 config classification: tcp-connection,A TCP connection was detected,4 config classification: trojan-activity,A Network Trojan was detected, 1 config classification: unusual-client-port-connection,A client was using an unusual port,2 config classification: network-scan,Detection of a Network Scan,3 config classification: denial-of-service,Detection of a Denial of Service Attack,2 config classification: non-standard-protocol,Detection of a non-standard protocol or event,2 config classification: protocol-command-decode,Generic Protocol Command Decode,3 config classification: web-application-activity,access to a potentially vulnerable web application,2 config classification: web-application-attack,Web Application Attack,1 config classification: misc-activity,Misc activity,3 config classification: misc-attack,Misc Attack,2 config classification: icmp-event,Generic ICMP event,3 config classification: kickass-porn,SCORE! Get the lotion!,1 config classification: policy-violation,Potential Corporate Privacy Violation,1 config classification: default-login-attempt,Attempt to login by a default username and password,2 suricata-3.2.1/scripts/0000755000000000000000000000000013051004531011756 500000000000000suricata-3.2.1/scripts/suricatasc/0000755000000000000000000000000013051004531014117 500000000000000suricata-3.2.1/scripts/suricatasc/src/0000755000000000000000000000000013051004531014706 500000000000000suricata-3.2.1/scripts/suricatasc/src/__init__.py0000644000000000000000000000003213051004444016735 00000000000000 from suricatasc import * suricata-3.2.1/scripts/suricatasc/src/suricatasc.py0000644000000000000000000002642513051004444017355 00000000000000#!/usr/bin/python # Copyright(C) 2012 Open Information Security Foundation # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, version 2 of the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. try: import simplejson as json except: import json import re import readline from socket import socket, AF_UNIX, error from time import sleep import select import sys SURICATASC_VERSION = "0.9" VERSION = "0.1" SIZE = 4096 class SuricataException(Exception): """ Generic class for suricatasc exception """ def __init__(self, value): self.value = value def __str__(self): return str(self.value) class SuricataNetException(SuricataException): """ Exception raised when network error occur. """ pass class SuricataCommandException(SuricataException): """ Exception raised when command is not correct. """ pass class SuricataReturnException(SuricataException): """ Exception raised when return message is not correct. """ pass class SuricataCompleter: def __init__(self, words): self.words = words self.generator = None def complete(self, text): for word in self.words: if word.startswith(text): yield word def __call__(self, text, state): if state == 0: self.generator = self.complete(text) try: return next(self.generator) except StopIteration: return None return None class SuricataSC: def __init__(self, sck_path, verbose=False): self.cmd_list=['shutdown','quit','pcap-file','pcap-file-number','pcap-file-list','iface-list','iface-stat','register-tenant','unregister-tenant','register-tenant-handler','unregister-tenant-handler'] self.sck_path = sck_path self.verbose = verbose def json_recv(self): cmdret = None i = 0 data = "" while i < 5: i += 1 if sys.version < '3': data += self.socket.recv(SIZE) else: data += self.socket.recv(SIZE).decode('iso-8859-1') try: cmdret = json.loads(data) break except: sleep(0.3) return cmdret def send_command(self, command, arguments = None): if command not in self.cmd_list and command != 'command-list': raise SuricataCommandException("No such command: %s", command) cmdmsg = {} cmdmsg['command'] = command if (arguments != None): cmdmsg['arguments'] = arguments if self.verbose: print("SND: " + json.dumps(cmdmsg)) if sys.version < '3': self.socket.send(json.dumps(cmdmsg)) else: self.socket.send(bytes(json.dumps(cmdmsg), 'iso-8859-1')) ready = select.select([self.socket], [], [], 600) if ready[0]: cmdret = self.json_recv() else: cmdret = None if cmdret == None: raise SuricataReturnException("Unable to get message from server") if self.verbose: print("RCV: "+ json.dumps(cmdret)) return cmdret def connect(self): try: self.socket = socket(AF_UNIX) self.socket.connect(self.sck_path) except error as err: raise SuricataNetException(err) self.socket.settimeout(10) #send version if self.verbose: print("SND: " + json.dumps({"version": VERSION})) if sys.version < '3': self.socket.send(json.dumps({"version": VERSION})) else: self.socket.send(bytes(json.dumps({"version": VERSION}), 'iso-8859-1')) ready = select.select([self.socket], [], [], 600) if ready[0]: cmdret = self.json_recv() else: cmdret = None if cmdret == None: raise SuricataReturnException("Unable to get message from server") if self.verbose: print("RCV: "+ json.dumps(cmdret)) if cmdret["return"] == "NOK": raise SuricataReturnException("Error: %s" % (cmdret["message"])) cmdret = self.send_command("command-list") # we silently ignore NOK as this means server is old if cmdret["return"] == "OK": self.cmd_list = cmdret["message"]["commands"] self.cmd_list.append("quit") def close(self): self.socket.close() def parse_command(self, command): arguments = None if command.split(' ', 2)[0] in self.cmd_list: if "pcap-file " in command: try: parts = command.split(' '); except: raise SuricataCommandException("Arguments to command '%s' is missing" % (command)) cmd, filename, output = parts[0], parts[1], parts[2] tenant = None if len(parts) > 3: tenant = parts[3] if cmd != "pcap-file": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["filename"] = filename arguments["output-dir"] = output if tenant != None: arguments["tenant"] = int(tenant) elif "iface-stat" in command: try: [cmd, iface] = command.split(' ', 1) except: raise SuricataCommandException("Unable to split command '%s'" % (command)) if cmd != "iface-stat": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["iface"] = iface elif "conf-get" in command: try: [cmd, variable] = command.split(' ', 1) except: raise SuricataCommandException("Unable to split command '%s'" % (command)) if cmd != "conf-get": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["variable"] = variable elif "unregister-tenant-handler" in command: try: parts = command.split(' ') except: raise SuricataCommandException("Arguments to command '%s' is missing" % (command)) cmd, tenantid, htype = parts[0], parts[1], parts[2] hargs = None if len(parts) > 3: hargs = parts[3] if cmd != "unregister-tenant-handler": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["id"] = int(tenantid) arguments["htype"] = htype if hargs != None: arguments["hargs"] = int(hargs) elif "register-tenant-handler" in command: try: parts = command.split(' ') except: raise SuricataCommandException("Arguments to command '%s' is missing" % (command)) cmd, tenantid, htype = parts[0], parts[1], parts[2] hargs = None if len(parts) > 3: hargs = parts[3] if cmd != "register-tenant-handler": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["id"] = int(tenantid) arguments["htype"] = htype if hargs != None: arguments["hargs"] = int(hargs) elif "unregister-tenant" in command: try: [cmd, tenantid] = command.split(' ', 1) except: raise SuricataCommandException("Unable to split command '%s'" % (command)) if cmd != "unregister-tenant": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["id"] = int(tenantid) elif "register-tenant" in command: try: [cmd, tenantid, filename] = command.split(' ', 2) except: raise SuricataCommandException("Arguments to command '%s' is missing" % (command)) if cmd != "register-tenant": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["id"] = int(tenantid) arguments["filename"] = filename elif "reload-tenant" in command: try: [cmd, tenantid, filename] = command.split(' ', 2) except: raise SuricataCommandException("Arguments to command '%s' is missing" % (command)) if cmd != "reload-tenant": raise SuricataCommandException("Invalid command '%s'" % (command)) else: arguments = {} arguments["id"] = int(tenantid) arguments["filename"] = filename else: cmd = command else: raise SuricataCommandException("Unknown command '%s'" % (command)) return (cmd, arguments) def interactive(self): print("Command list: " + ", ".join(self.cmd_list)) try: readline.set_completer(SuricataCompleter(self.cmd_list)) readline.set_completer_delims(";") readline.parse_and_bind('tab: complete') while True: if sys.version < '3': command = raw_input(">>> ").strip() else: command = input(">>> ").strip() if command == "quit": break; try: (cmd, arguments) = self.parse_command(command) except SuricataCommandException as err: print(err) continue cmdret = self.send_command(cmd, arguments) #decode json message if cmdret["return"] == "NOK": print("Error:") print(json.dumps(cmdret["message"], sort_keys=True, indent=4, separators=(',', ': '))) else: print("Success:") print(json.dumps(cmdret["message"], sort_keys=True, indent=4, separators=(',', ': '))) except KeyboardInterrupt: print("[!] Interrupted") suricata-3.2.1/scripts/suricatasc/Makefile.am0000644000000000000000000000106613051004444016101 00000000000000EXTRA_DIST = setup.py suricatasc.in src/__init__.py src/suricatasc.py if HAVE_PYTHON all-local: mkdir -p $(top_builddir)/scripts/suricatasc/src $(PYTHON) $(srcdir)/setup.py build; install-exec-local: $(PYTHON) $(srcdir)/setup.py install --prefix $(DESTDIR)$(prefix) clean-local: $(PYTHON) $(srcdir)/setup.py clean; rm -rf $(top_builddir)/scripts/suricatasc/build uninstall-local: [ ! -f "$(DESTDIR)$(prefix)/bin/suricatasc" ] || rm -f "$(DESTDIR)$(prefix)/bin/suricatasc" find "$(DESTDIR)$(prefix)/lib" -name "suricatasc-*.egg-info" -delete ||true endif suricata-3.2.1/scripts/suricatasc/Makefile.in0000644000000000000000000003642013051004467016121 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = scripts/suricatasc ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = suricatasc CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/suricatasc.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = setup.py suricatasc.in src/__init__.py src/suricatasc.py all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu scripts/suricatasc/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu scripts/suricatasc/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): suricatasc: $(top_builddir)/config.status $(srcdir)/suricatasc.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am @HAVE_PYTHON_FALSE@all-local: all-am: Makefile all-local installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." @HAVE_PYTHON_FALSE@clean-local: @HAVE_PYTHON_FALSE@uninstall-local: @HAVE_PYTHON_FALSE@install-exec-local: clean: clean-am clean-am: clean-generic clean-libtool clean-local mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-exec-local install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-local .MAKE: install-am install-strip .PHONY: all all-am all-local check check-am clean clean-generic \ clean-libtool clean-local cscopelist-am ctags-am distclean \ distclean-generic distclean-libtool distdir dvi dvi-am html \ html-am info info-am install install-am install-data \ install-data-am install-dvi install-dvi-am install-exec \ install-exec-am install-exec-local install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags-am uninstall uninstall-am uninstall-local .PRECIOUS: Makefile @HAVE_PYTHON_TRUE@all-local: @HAVE_PYTHON_TRUE@ mkdir -p $(top_builddir)/scripts/suricatasc/src @HAVE_PYTHON_TRUE@ $(PYTHON) $(srcdir)/setup.py build; @HAVE_PYTHON_TRUE@install-exec-local: @HAVE_PYTHON_TRUE@ $(PYTHON) $(srcdir)/setup.py install --prefix $(DESTDIR)$(prefix) @HAVE_PYTHON_TRUE@clean-local: @HAVE_PYTHON_TRUE@ $(PYTHON) $(srcdir)/setup.py clean; @HAVE_PYTHON_TRUE@ rm -rf $(top_builddir)/scripts/suricatasc/build @HAVE_PYTHON_TRUE@uninstall-local: @HAVE_PYTHON_TRUE@ [ ! -f "$(DESTDIR)$(prefix)/bin/suricatasc" ] || rm -f "$(DESTDIR)$(prefix)/bin/suricatasc" @HAVE_PYTHON_TRUE@ find "$(DESTDIR)$(prefix)/lib" -name "suricatasc-*.egg-info" -delete ||true # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/scripts/suricatasc/setup.py0000755000000000000000000000155413051004444015564 00000000000000#!/usr/bin/env python from distutils.core import setup SURICATASC_VERSION = "0.9" setup(name='suricatasc', version=SURICATASC_VERSION, description='Suricata unix socket client', author='Eric Leblond', author_email='eric@regit.org', url='https://www.suricata-ids.org/', scripts=['suricatasc'], packages=['suricatasc'], package_dir={'suricatasc':'src'}, provides=['suricatasc'], requires=['argparse','simplejson'], classifiers=[ 'Development Status :: 5 - Production/Stable', 'Environment :: Console', 'Intended Audience :: System Administrators', 'License :: OSI Approved :: GNU General Public License (GPL)', 'Operating System :: POSIX', 'Programming Language :: Python', 'Topic :: System :: Systems Administration', ], ) suricata-3.2.1/scripts/suricatasc/suricatasc.in0000755000000000000000000000433613051004444016544 00000000000000#!/usr/bin/python # Copyright(C) 2013 Open Information Security Foundation # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, version 2 of the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. from __future__ import print_function import sys import argparse from suricatasc import * parser = argparse.ArgumentParser(prog='suricatasc', description='Client for Suricata unix socket') parser.add_argument('-v', '--verbose', action='store_const', const=True, help='verbose output (including JSON dump)') parser.add_argument('-c', '--command', default=None, help='execute on single command and return JSON') parser.add_argument('socket', metavar='socket', nargs='?', help='socket file to connnect to', default=None) args = parser.parse_args() if args.socket != None: SOCKET_PATH = args.socket else: SOCKET_PATH = "@e_localstatedir@/suricata-command.socket" sc = SuricataSC(SOCKET_PATH, verbose=args.verbose) try: sc.connect() except SuricataNetException as err: print("Unable to connect to socket %s: %s" % (SOCKET_PATH, err), file=sys.stderr) sys.exit(1) except SuricataReturnException as err: print("Unable to negotiate version with server: %s" % (err), file=sys.stderr) sys.exit(1) if args.command: (command, arguments) = sc.parse_command(args.command) res = sc.send_command(command, arguments) print(json.dumps(res)) sc.close() if res['return'] == 'OK': sys.exit(0) else: sys.exit(1) try: sc.interactive() except SuricataNetException as err: print("Communication error: %s" % (err)) sys.exit(1) except SuricataReturnException as err: print("Invalid return from server: %s" % (err)) sys.exit(1) print("[+] Quit command client") sc.close() suricata-3.2.1/scripts/Makefile.am0000644000000000000000000000002313051004444013730 00000000000000SUBDIRS=suricatasc suricata-3.2.1/scripts/Makefile.in0000644000000000000000000005055313051004467013763 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = scripts ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ distdir am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = suricatasc all: all-recursive .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu scripts/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu scripts/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done check-am: all-am check: check-recursive all-am: Makefile installdirs: installdirs-recursive installdirs-am: install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f Makefile distclean-am: clean-am distclean-generic distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: .MAKE: $(am__recursive_targets) install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \ check-am clean clean-generic clean-libtool cscopelist-am ctags \ ctags-am distclean distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/ltmain.sh0000644000000000000000000117146413051004463012051 00000000000000#! /bin/sh ## DO NOT EDIT - This file generated from ./build-aux/ltmain.in ## by inline-source v2014-01-03.01 # libtool (GNU libtool) 2.4.6 # Provide generalized library-building support services. # Written by Gordon Matzigkeit , 1996 # Copyright (C) 1996-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, # if you distribute this file as part of a program or library that # is built using GNU Libtool, you may include this file under the # same distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . PROGRAM=libtool PACKAGE=libtool VERSION="2.4.6 Debian-2.4.6-0.1" package_revision=2.4.6 ## ------ ## ## Usage. ## ## ------ ## # Run './libtool --help' for help with using this script from the # command line. ## ------------------------------- ## ## User overridable command paths. ## ## ------------------------------- ## # After configure completes, it has a better idea of some of the # shell tools we need than the defaults used by the functions shared # with bootstrap, so set those here where they can still be over- # ridden by the user, but otherwise take precedence. : ${AUTOCONF="autoconf"} : ${AUTOMAKE="automake"} ## -------------------------- ## ## Source external libraries. ## ## -------------------------- ## # Much of our low-level functionality needs to be sourced from external # libraries, which are installed to $pkgauxdir. # Set a version string for this script. scriptversion=2015-01-20.17; # UTC # General shell script boiler plate, and helper functions. # Written by Gary V. Vaughan, 2004 # Copyright (C) 2004-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # As a special exception to the GNU General Public License, if you distribute # this file as part of a program or library that is built using GNU Libtool, # you may include this file under the same distribution terms that you use # for the rest of that program. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNES FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # Please report bugs or propose patches to gary@gnu.org. ## ------ ## ## Usage. ## ## ------ ## # Evaluate this file near the top of your script to gain access to # the functions and variables defined here: # # . `echo "$0" | ${SED-sed} 's|[^/]*$||'`/build-aux/funclib.sh # # If you need to override any of the default environment variable # settings, do that before evaluating this file. ## -------------------- ## ## Shell normalisation. ## ## -------------------- ## # Some shells need a little help to be as Bourne compatible as possible. # Before doing anything else, make sure all that help has been provided! DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi # NLS nuisances: We save the old values in case they are required later. _G_user_locale= _G_safe_locale= for _G_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES do eval "if test set = \"\${$_G_var+set}\"; then save_$_G_var=\$$_G_var $_G_var=C export $_G_var _G_user_locale=\"$_G_var=\\\$save_\$_G_var; \$_G_user_locale\" _G_safe_locale=\"$_G_var=C; \$_G_safe_locale\" fi" done # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # Make sure IFS has a sensible default sp=' ' nl=' ' IFS="$sp $nl" # There are apparently some retarded systems that use ';' as a PATH separator! if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi ## ------------------------- ## ## Locate command utilities. ## ## ------------------------- ## # func_executable_p FILE # ---------------------- # Check that FILE is an executable regular file. func_executable_p () { test -f "$1" && test -x "$1" } # func_path_progs PROGS_LIST CHECK_FUNC [PATH] # -------------------------------------------- # Search for either a program that responds to --version with output # containing "GNU", or else returned by CHECK_FUNC otherwise, by # trying all the directories in PATH with each of the elements of # PROGS_LIST. # # CHECK_FUNC should accept the path to a candidate program, and # set $func_check_prog_result if it truncates its output less than # $_G_path_prog_max characters. func_path_progs () { _G_progs_list=$1 _G_check_func=$2 _G_PATH=${3-"$PATH"} _G_path_prog_max=0 _G_path_prog_found=false _G_save_IFS=$IFS; IFS=${PATH_SEPARATOR-:} for _G_dir in $_G_PATH; do IFS=$_G_save_IFS test -z "$_G_dir" && _G_dir=. for _G_prog_name in $_G_progs_list; do for _exeext in '' .EXE; do _G_path_prog=$_G_dir/$_G_prog_name$_exeext func_executable_p "$_G_path_prog" || continue case `"$_G_path_prog" --version 2>&1` in *GNU*) func_path_progs_result=$_G_path_prog _G_path_prog_found=: ;; *) $_G_check_func $_G_path_prog func_path_progs_result=$func_check_prog_result ;; esac $_G_path_prog_found && break 3 done done done IFS=$_G_save_IFS test -z "$func_path_progs_result" && { echo "no acceptable sed could be found in \$PATH" >&2 exit 1 } } # We want to be able to use the functions in this file before configure # has figured out where the best binaries are kept, which means we have # to search for them ourselves - except when the results are already set # where we skip the searches. # Unless the user overrides by setting SED, search the path for either GNU # sed, or the sed that truncates its output the least. test -z "$SED" && { _G_sed_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/ for _G_i in 1 2 3 4 5 6 7; do _G_sed_script=$_G_sed_script$nl$_G_sed_script done echo "$_G_sed_script" 2>/dev/null | sed 99q >conftest.sed _G_sed_script= func_check_prog_sed () { _G_path_prog=$1 _G_count=0 printf 0123456789 >conftest.in while : do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo '' >> conftest.nl "$_G_path_prog" -f conftest.sed conftest.out 2>/dev/null || break diff conftest.out conftest.nl >/dev/null 2>&1 || break _G_count=`expr $_G_count + 1` if test "$_G_count" -gt "$_G_path_prog_max"; then # Best one so far, save it but keep looking for a better one func_check_prog_result=$_G_path_prog _G_path_prog_max=$_G_count fi # 10*(2^10) chars as input seems more than enough test 10 -lt "$_G_count" && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out } func_path_progs "sed gsed" func_check_prog_sed $PATH:/usr/xpg4/bin rm -f conftest.sed SED=$func_path_progs_result } # Unless the user overrides by setting GREP, search the path for either GNU # grep, or the grep that truncates its output the least. test -z "$GREP" && { func_check_prog_grep () { _G_path_prog=$1 _G_count=0 _G_path_prog_max=0 printf 0123456789 >conftest.in while : do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo 'GREP' >> conftest.nl "$_G_path_prog" -e 'GREP$' -e '-(cannot match)-' conftest.out 2>/dev/null || break diff conftest.out conftest.nl >/dev/null 2>&1 || break _G_count=`expr $_G_count + 1` if test "$_G_count" -gt "$_G_path_prog_max"; then # Best one so far, save it but keep looking for a better one func_check_prog_result=$_G_path_prog _G_path_prog_max=$_G_count fi # 10*(2^10) chars as input seems more than enough test 10 -lt "$_G_count" && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out } func_path_progs "grep ggrep" func_check_prog_grep $PATH:/usr/xpg4/bin GREP=$func_path_progs_result } ## ------------------------------- ## ## User overridable command paths. ## ## ------------------------------- ## # All uppercase variable names are used for environment variables. These # variables can be overridden by the user before calling a script that # uses them if a suitable command of that name is not already available # in the command search PATH. : ${CP="cp -f"} : ${ECHO="printf %s\n"} : ${EGREP="$GREP -E"} : ${FGREP="$GREP -F"} : ${LN_S="ln -s"} : ${MAKE="make"} : ${MKDIR="mkdir"} : ${MV="mv -f"} : ${RM="rm -f"} : ${SHELL="${CONFIG_SHELL-/bin/sh}"} ## -------------------- ## ## Useful sed snippets. ## ## -------------------- ## sed_dirname='s|/[^/]*$||' sed_basename='s|^.*/||' # Sed substitution that helps us do robust quoting. It backslashifies # metacharacters that are still active within double-quoted strings. sed_quote_subst='s|\([`"$\\]\)|\\\1|g' # Same as above, but do not quote variable references. sed_double_quote_subst='s/\(["`\\]\)/\\\1/g' # Sed substitution that turns a string into a regex matching for the # string literally. sed_make_literal_regex='s|[].[^$\\*\/]|\\&|g' # Sed substitution that converts a w32 file name or path # that contains forward slashes, into one that contains # (escaped) backslashes. A very naive implementation. sed_naive_backslashify='s|\\\\*|\\|g;s|/|\\|g;s|\\|\\\\|g' # Re-'\' parameter expansions in output of sed_double_quote_subst that # were '\'-ed in input to the same. If an odd number of '\' preceded a # '$' in input to sed_double_quote_subst, that '$' was protected from # expansion. Since each input '\' is now two '\'s, look for any number # of runs of four '\'s followed by two '\'s and then a '$'. '\' that '$'. _G_bs='\\' _G_bs2='\\\\' _G_bs4='\\\\\\\\' _G_dollar='\$' sed_double_backslash="\ s/$_G_bs4/&\\ /g s/^$_G_bs2$_G_dollar/$_G_bs&/ s/\\([^$_G_bs]\\)$_G_bs2$_G_dollar/\\1$_G_bs2$_G_bs$_G_dollar/g s/\n//g" ## ----------------- ## ## Global variables. ## ## ----------------- ## # Except for the global variables explicitly listed below, the following # functions in the '^func_' namespace, and the '^require_' namespace # variables initialised in the 'Resource management' section, sourcing # this file will not pollute your global namespace with anything # else. There's no portable way to scope variables in Bourne shell # though, so actually running these functions will sometimes place # results into a variable named after the function, and often use # temporary variables in the '^_G_' namespace. If you are careful to # avoid using those namespaces casually in your sourcing script, things # should continue to work as you expect. And, of course, you can freely # overwrite any of the functions or variables defined here before # calling anything to customize them. EXIT_SUCCESS=0 EXIT_FAILURE=1 EXIT_MISMATCH=63 # $? = 63 is used to indicate version mismatch to missing. EXIT_SKIP=77 # $? = 77 is used to indicate a skipped test to automake. # Allow overriding, eg assuming that you follow the convention of # putting '$debug_cmd' at the start of all your functions, you can get # bash to show function call trace with: # # debug_cmd='eval echo "${FUNCNAME[0]} $*" >&2' bash your-script-name debug_cmd=${debug_cmd-":"} exit_cmd=: # By convention, finish your script with: # # exit $exit_status # # so that you can set exit_status to non-zero if you want to indicate # something went wrong during execution without actually bailing out at # the point of failure. exit_status=$EXIT_SUCCESS # Work around backward compatibility issue on IRIX 6.5. On IRIX 6.4+, sh # is ksh but when the shell is invoked as "sh" and the current value of # the _XPG environment variable is not equal to 1 (one), the special # positional parameter $0, within a function call, is the name of the # function. progpath=$0 # The name of this program. progname=`$ECHO "$progpath" |$SED "$sed_basename"` # Make sure we have an absolute progpath for reexecution: case $progpath in [\\/]*|[A-Za-z]:\\*) ;; *[\\/]*) progdir=`$ECHO "$progpath" |$SED "$sed_dirname"` progdir=`cd "$progdir" && pwd` progpath=$progdir/$progname ;; *) _G_IFS=$IFS IFS=${PATH_SEPARATOR-:} for progdir in $PATH; do IFS=$_G_IFS test -x "$progdir/$progname" && break done IFS=$_G_IFS test -n "$progdir" || progdir=`pwd` progpath=$progdir/$progname ;; esac ## ----------------- ## ## Standard options. ## ## ----------------- ## # The following options affect the operation of the functions defined # below, and should be set appropriately depending on run-time para- # meters passed on the command line. opt_dry_run=false opt_quiet=false opt_verbose=false # Categories 'all' and 'none' are always available. Append any others # you will pass as the first argument to func_warning from your own # code. warning_categories= # By default, display warnings according to 'opt_warning_types'. Set # 'warning_func' to ':' to elide all warnings, or func_fatal_error to # treat the next displayed warning as a fatal error. warning_func=func_warn_and_continue # Set to 'all' to display all warnings, 'none' to suppress all # warnings, or a space delimited list of some subset of # 'warning_categories' to display only the listed warnings. opt_warning_types=all ## -------------------- ## ## Resource management. ## ## -------------------- ## # This section contains definitions for functions that each ensure a # particular resource (a file, or a non-empty configuration variable for # example) is available, and if appropriate to extract default values # from pertinent package files. Call them using their associated # 'require_*' variable to ensure that they are executed, at most, once. # # It's entirely deliberate that calling these functions can set # variables that don't obey the namespace limitations obeyed by the rest # of this file, in order that that they be as useful as possible to # callers. # require_term_colors # ------------------- # Allow display of bold text on terminals that support it. require_term_colors=func_require_term_colors func_require_term_colors () { $debug_cmd test -t 1 && { # COLORTERM and USE_ANSI_COLORS environment variables take # precedence, because most terminfo databases neglect to describe # whether color sequences are supported. test -n "${COLORTERM+set}" && : ${USE_ANSI_COLORS="1"} if test 1 = "$USE_ANSI_COLORS"; then # Standard ANSI escape sequences tc_reset='' tc_bold=''; tc_standout='' tc_red=''; tc_green='' tc_blue=''; tc_cyan='' else # Otherwise trust the terminfo database after all. test -n "`tput sgr0 2>/dev/null`" && { tc_reset=`tput sgr0` test -n "`tput bold 2>/dev/null`" && tc_bold=`tput bold` tc_standout=$tc_bold test -n "`tput smso 2>/dev/null`" && tc_standout=`tput smso` test -n "`tput setaf 1 2>/dev/null`" && tc_red=`tput setaf 1` test -n "`tput setaf 2 2>/dev/null`" && tc_green=`tput setaf 2` test -n "`tput setaf 4 2>/dev/null`" && tc_blue=`tput setaf 4` test -n "`tput setaf 5 2>/dev/null`" && tc_cyan=`tput setaf 5` } fi } require_term_colors=: } ## ----------------- ## ## Function library. ## ## ----------------- ## # This section contains a variety of useful functions to call in your # scripts. Take note of the portable wrappers for features provided by # some modern shells, which will fall back to slower equivalents on # less featureful shells. # func_append VAR VALUE # --------------------- # Append VALUE onto the existing contents of VAR. # We should try to minimise forks, especially on Windows where they are # unreasonably slow, so skip the feature probes when bash or zsh are # being used: if test set = "${BASH_VERSION+set}${ZSH_VERSION+set}"; then : ${_G_HAVE_ARITH_OP="yes"} : ${_G_HAVE_XSI_OPS="yes"} # The += operator was introduced in bash 3.1 case $BASH_VERSION in [12].* | 3.0 | 3.0*) ;; *) : ${_G_HAVE_PLUSEQ_OP="yes"} ;; esac fi # _G_HAVE_PLUSEQ_OP # Can be empty, in which case the shell is probed, "yes" if += is # useable or anything else if it does not work. test -z "$_G_HAVE_PLUSEQ_OP" \ && (eval 'x=a; x+=" b"; test "a b" = "$x"') 2>/dev/null \ && _G_HAVE_PLUSEQ_OP=yes if test yes = "$_G_HAVE_PLUSEQ_OP" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_append () { $debug_cmd eval "$1+=\$2" }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_append () { $debug_cmd eval "$1=\$$1\$2" } fi # func_append_quoted VAR VALUE # ---------------------------- # Quote VALUE and append to the end of shell variable VAR, separated # by a space. if test yes = "$_G_HAVE_PLUSEQ_OP"; then eval 'func_append_quoted () { $debug_cmd func_quote_for_eval "$2" eval "$1+=\\ \$func_quote_for_eval_result" }' else func_append_quoted () { $debug_cmd func_quote_for_eval "$2" eval "$1=\$$1\\ \$func_quote_for_eval_result" } fi # func_append_uniq VAR VALUE # -------------------------- # Append unique VALUE onto the existing contents of VAR, assuming # entries are delimited by the first character of VALUE. For example: # # func_append_uniq options " --another-option option-argument" # # will only append to $options if " --another-option option-argument " # is not already present somewhere in $options already (note spaces at # each end implied by leading space in second argument). func_append_uniq () { $debug_cmd eval _G_current_value='`$ECHO $'$1'`' _G_delim=`expr "$2" : '\(.\)'` case $_G_delim$_G_current_value$_G_delim in *"$2$_G_delim"*) ;; *) func_append "$@" ;; esac } # func_arith TERM... # ------------------ # Set func_arith_result to the result of evaluating TERMs. test -z "$_G_HAVE_ARITH_OP" \ && (eval 'test 2 = $(( 1 + 1 ))') 2>/dev/null \ && _G_HAVE_ARITH_OP=yes if test yes = "$_G_HAVE_ARITH_OP"; then eval 'func_arith () { $debug_cmd func_arith_result=$(( $* )) }' else func_arith () { $debug_cmd func_arith_result=`expr "$@"` } fi # func_basename FILE # ------------------ # Set func_basename_result to FILE with everything up to and including # the last / stripped. if test yes = "$_G_HAVE_XSI_OPS"; then # If this shell supports suffix pattern removal, then use it to avoid # forking. Hide the definitions single quotes in case the shell chokes # on unsupported syntax... _b='func_basename_result=${1##*/}' _d='case $1 in */*) func_dirname_result=${1%/*}$2 ;; * ) func_dirname_result=$3 ;; esac' else # ...otherwise fall back to using sed. _b='func_basename_result=`$ECHO "$1" |$SED "$sed_basename"`' _d='func_dirname_result=`$ECHO "$1" |$SED "$sed_dirname"` if test "X$func_dirname_result" = "X$1"; then func_dirname_result=$3 else func_append func_dirname_result "$2" fi' fi eval 'func_basename () { $debug_cmd '"$_b"' }' # func_dirname FILE APPEND NONDIR_REPLACEMENT # ------------------------------------------- # Compute the dirname of FILE. If nonempty, add APPEND to the result, # otherwise set result to NONDIR_REPLACEMENT. eval 'func_dirname () { $debug_cmd '"$_d"' }' # func_dirname_and_basename FILE APPEND NONDIR_REPLACEMENT # -------------------------------------------------------- # Perform func_basename and func_dirname in a single function # call: # dirname: Compute the dirname of FILE. If nonempty, # add APPEND to the result, otherwise set result # to NONDIR_REPLACEMENT. # value returned in "$func_dirname_result" # basename: Compute filename of FILE. # value retuned in "$func_basename_result" # For efficiency, we do not delegate to the functions above but instead # duplicate the functionality here. eval 'func_dirname_and_basename () { $debug_cmd '"$_b"' '"$_d"' }' # func_echo ARG... # ---------------- # Echo program name prefixed message. func_echo () { $debug_cmd _G_message=$* func_echo_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_IFS $ECHO "$progname: $_G_line" done IFS=$func_echo_IFS } # func_echo_all ARG... # -------------------- # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "$*" } # func_echo_infix_1 INFIX ARG... # ------------------------------ # Echo program name, followed by INFIX on the first line, with any # additional lines not showing INFIX. func_echo_infix_1 () { $debug_cmd $require_term_colors _G_infix=$1; shift _G_indent=$_G_infix _G_prefix="$progname: $_G_infix: " _G_message=$* # Strip color escape sequences before counting printable length for _G_tc in "$tc_reset" "$tc_bold" "$tc_standout" "$tc_red" "$tc_green" "$tc_blue" "$tc_cyan" do test -n "$_G_tc" && { _G_esc_tc=`$ECHO "$_G_tc" | $SED "$sed_make_literal_regex"` _G_indent=`$ECHO "$_G_indent" | $SED "s|$_G_esc_tc||g"` } done _G_indent="$progname: "`echo "$_G_indent" | $SED 's|.| |g'`" " ## exclude from sc_prohibit_nested_quotes func_echo_infix_1_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_infix_1_IFS $ECHO "$_G_prefix$tc_bold$_G_line$tc_reset" >&2 _G_prefix=$_G_indent done IFS=$func_echo_infix_1_IFS } # func_error ARG... # ----------------- # Echo program name prefixed message to standard error. func_error () { $debug_cmd $require_term_colors func_echo_infix_1 " $tc_standout${tc_red}error$tc_reset" "$*" >&2 } # func_fatal_error ARG... # ----------------------- # Echo program name prefixed message to standard error, and exit. func_fatal_error () { $debug_cmd func_error "$*" exit $EXIT_FAILURE } # func_grep EXPRESSION FILENAME # ----------------------------- # Check whether EXPRESSION matches any line of FILENAME, without output. func_grep () { $debug_cmd $GREP "$1" "$2" >/dev/null 2>&1 } # func_len STRING # --------------- # Set func_len_result to the length of STRING. STRING may not # start with a hyphen. test -z "$_G_HAVE_XSI_OPS" \ && (eval 'x=a/b/c; test 5aa/bb/cc = "${#x}${x%%/*}${x%/*}${x#*/}${x##*/}"') 2>/dev/null \ && _G_HAVE_XSI_OPS=yes if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_len () { $debug_cmd func_len_result=${#1} }' else func_len () { $debug_cmd func_len_result=`expr "$1" : ".*" 2>/dev/null || echo $max_cmd_len` } fi # func_mkdir_p DIRECTORY-PATH # --------------------------- # Make sure the entire path to DIRECTORY-PATH is available. func_mkdir_p () { $debug_cmd _G_directory_path=$1 _G_dir_list= if test -n "$_G_directory_path" && test : != "$opt_dry_run"; then # Protect directory names starting with '-' case $_G_directory_path in -*) _G_directory_path=./$_G_directory_path ;; esac # While some portion of DIR does not yet exist... while test ! -d "$_G_directory_path"; do # ...make a list in topmost first order. Use a colon delimited # list incase some portion of path contains whitespace. _G_dir_list=$_G_directory_path:$_G_dir_list # If the last portion added has no slash in it, the list is done case $_G_directory_path in */*) ;; *) break ;; esac # ...otherwise throw away the child directory and loop _G_directory_path=`$ECHO "$_G_directory_path" | $SED -e "$sed_dirname"` done _G_dir_list=`$ECHO "$_G_dir_list" | $SED 's|:*$||'` func_mkdir_p_IFS=$IFS; IFS=: for _G_dir in $_G_dir_list; do IFS=$func_mkdir_p_IFS # mkdir can fail with a 'File exist' error if two processes # try to create one of the directories concurrently. Don't # stop in that case! $MKDIR "$_G_dir" 2>/dev/null || : done IFS=$func_mkdir_p_IFS # Bail out if we (or some other process) failed to create a directory. test -d "$_G_directory_path" || \ func_fatal_error "Failed to create '$1'" fi } # func_mktempdir [BASENAME] # ------------------------- # Make a temporary directory that won't clash with other running # libtool processes, and avoids race conditions if possible. If # given, BASENAME is the basename for that directory. func_mktempdir () { $debug_cmd _G_template=${TMPDIR-/tmp}/${1-$progname} if test : = "$opt_dry_run"; then # Return a directory name, but don't create it in dry-run mode _G_tmpdir=$_G_template-$$ else # If mktemp works, use that first and foremost _G_tmpdir=`mktemp -d "$_G_template-XXXXXXXX" 2>/dev/null` if test ! -d "$_G_tmpdir"; then # Failing that, at least try and use $RANDOM to avoid a race _G_tmpdir=$_G_template-${RANDOM-0}$$ func_mktempdir_umask=`umask` umask 0077 $MKDIR "$_G_tmpdir" umask $func_mktempdir_umask fi # If we're not in dry-run mode, bomb out on failure test -d "$_G_tmpdir" || \ func_fatal_error "cannot create temporary directory '$_G_tmpdir'" fi $ECHO "$_G_tmpdir" } # func_normal_abspath PATH # ------------------------ # Remove doubled-up and trailing slashes, "." path components, # and cancel out any ".." path components in PATH after making # it an absolute path. func_normal_abspath () { $debug_cmd # These SED scripts presuppose an absolute path with a trailing slash. _G_pathcar='s|^/\([^/]*\).*$|\1|' _G_pathcdr='s|^/[^/]*||' _G_removedotparts=':dotsl s|/\./|/|g t dotsl s|/\.$|/|' _G_collapseslashes='s|/\{1,\}|/|g' _G_finalslash='s|/*$|/|' # Start from root dir and reassemble the path. func_normal_abspath_result= func_normal_abspath_tpath=$1 func_normal_abspath_altnamespace= case $func_normal_abspath_tpath in "") # Empty path, that just means $cwd. func_stripname '' '/' "`pwd`" func_normal_abspath_result=$func_stripname_result return ;; # The next three entries are used to spot a run of precisely # two leading slashes without using negated character classes; # we take advantage of case's first-match behaviour. ///*) # Unusual form of absolute path, do nothing. ;; //*) # Not necessarily an ordinary path; POSIX reserves leading '//' # and for example Cygwin uses it to access remote file shares # over CIFS/SMB, so we conserve a leading double slash if found. func_normal_abspath_altnamespace=/ ;; /*) # Absolute path, do nothing. ;; *) # Relative path, prepend $cwd. func_normal_abspath_tpath=`pwd`/$func_normal_abspath_tpath ;; esac # Cancel out all the simple stuff to save iterations. We also want # the path to end with a slash for ease of parsing, so make sure # there is one (and only one) here. func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_removedotparts" -e "$_G_collapseslashes" -e "$_G_finalslash"` while :; do # Processed it all yet? if test / = "$func_normal_abspath_tpath"; then # If we ascended to the root using ".." the result may be empty now. if test -z "$func_normal_abspath_result"; then func_normal_abspath_result=/ fi break fi func_normal_abspath_tcomponent=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_pathcar"` func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_pathcdr"` # Figure out what to do with it case $func_normal_abspath_tcomponent in "") # Trailing empty path component, ignore it. ;; ..) # Parent dir; strip last assembled component from result. func_dirname "$func_normal_abspath_result" func_normal_abspath_result=$func_dirname_result ;; *) # Actual path component, append it. func_append func_normal_abspath_result "/$func_normal_abspath_tcomponent" ;; esac done # Restore leading double-slash if one was found on entry. func_normal_abspath_result=$func_normal_abspath_altnamespace$func_normal_abspath_result } # func_notquiet ARG... # -------------------- # Echo program name prefixed message only when not in quiet mode. func_notquiet () { $debug_cmd $opt_quiet || func_echo ${1+"$@"} # A bug in bash halts the script if the last line of a function # fails when set -e is in force, so we need another command to # work around that: : } # func_relative_path SRCDIR DSTDIR # -------------------------------- # Set func_relative_path_result to the relative path from SRCDIR to DSTDIR. func_relative_path () { $debug_cmd func_relative_path_result= func_normal_abspath "$1" func_relative_path_tlibdir=$func_normal_abspath_result func_normal_abspath "$2" func_relative_path_tbindir=$func_normal_abspath_result # Ascend the tree starting from libdir while :; do # check if we have found a prefix of bindir case $func_relative_path_tbindir in $func_relative_path_tlibdir) # found an exact match func_relative_path_tcancelled= break ;; $func_relative_path_tlibdir*) # found a matching prefix func_stripname "$func_relative_path_tlibdir" '' "$func_relative_path_tbindir" func_relative_path_tcancelled=$func_stripname_result if test -z "$func_relative_path_result"; then func_relative_path_result=. fi break ;; *) func_dirname $func_relative_path_tlibdir func_relative_path_tlibdir=$func_dirname_result if test -z "$func_relative_path_tlibdir"; then # Have to descend all the way to the root! func_relative_path_result=../$func_relative_path_result func_relative_path_tcancelled=$func_relative_path_tbindir break fi func_relative_path_result=../$func_relative_path_result ;; esac done # Now calculate path; take care to avoid doubling-up slashes. func_stripname '' '/' "$func_relative_path_result" func_relative_path_result=$func_stripname_result func_stripname '/' '/' "$func_relative_path_tcancelled" if test -n "$func_stripname_result"; then func_append func_relative_path_result "/$func_stripname_result" fi # Normalisation. If bindir is libdir, return '.' else relative path. if test -n "$func_relative_path_result"; then func_stripname './' '' "$func_relative_path_result" func_relative_path_result=$func_stripname_result fi test -n "$func_relative_path_result" || func_relative_path_result=. : } # func_quote_for_eval ARG... # -------------------------- # Aesthetically quote ARGs to be evaled later. # This function returns two values: # i) func_quote_for_eval_result # double-quoted, suitable for a subsequent eval # ii) func_quote_for_eval_unquoted_result # has all characters that are still active within double # quotes backslashified. func_quote_for_eval () { $debug_cmd func_quote_for_eval_unquoted_result= func_quote_for_eval_result= while test 0 -lt $#; do case $1 in *[\\\`\"\$]*) _G_unquoted_arg=`printf '%s\n' "$1" |$SED "$sed_quote_subst"` ;; *) _G_unquoted_arg=$1 ;; esac if test -n "$func_quote_for_eval_unquoted_result"; then func_append func_quote_for_eval_unquoted_result " $_G_unquoted_arg" else func_append func_quote_for_eval_unquoted_result "$_G_unquoted_arg" fi case $_G_unquoted_arg in # Double-quote args containing shell metacharacters to delay # word splitting, command substitution and variable expansion # for a subsequent eval. # Many Bourne shells cannot handle close brackets correctly # in scan sets, so we specify it separately. *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \ ]*|*]*|"") _G_quoted_arg=\"$_G_unquoted_arg\" ;; *) _G_quoted_arg=$_G_unquoted_arg ;; esac if test -n "$func_quote_for_eval_result"; then func_append func_quote_for_eval_result " $_G_quoted_arg" else func_append func_quote_for_eval_result "$_G_quoted_arg" fi shift done } # func_quote_for_expand ARG # ------------------------- # Aesthetically quote ARG to be evaled later; same as above, # but do not quote variable references. func_quote_for_expand () { $debug_cmd case $1 in *[\\\`\"]*) _G_arg=`$ECHO "$1" | $SED \ -e "$sed_double_quote_subst" -e "$sed_double_backslash"` ;; *) _G_arg=$1 ;; esac case $_G_arg in # Double-quote args containing shell metacharacters to delay # word splitting and command substitution for a subsequent eval. # Many Bourne shells cannot handle close brackets correctly # in scan sets, so we specify it separately. *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \ ]*|*]*|"") _G_arg=\"$_G_arg\" ;; esac func_quote_for_expand_result=$_G_arg } # func_stripname PREFIX SUFFIX NAME # --------------------------------- # strip PREFIX and SUFFIX from NAME, and store in func_stripname_result. # PREFIX and SUFFIX must not contain globbing or regex special # characters, hashes, percent signs, but SUFFIX may contain a leading # dot (in which case that matches only a dot). if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_stripname () { $debug_cmd # pdksh 5.2.14 does not do ${X%$Y} correctly if both X and Y are # positional parameters, so assign one to ordinary variable first. func_stripname_result=$3 func_stripname_result=${func_stripname_result#"$1"} func_stripname_result=${func_stripname_result%"$2"} }' else func_stripname () { $debug_cmd case $2 in .*) func_stripname_result=`$ECHO "$3" | $SED -e "s%^$1%%" -e "s%\\\\$2\$%%"`;; *) func_stripname_result=`$ECHO "$3" | $SED -e "s%^$1%%" -e "s%$2\$%%"`;; esac } fi # func_show_eval CMD [FAIL_EXP] # ----------------------------- # Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is # not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP # is given, then evaluate it. func_show_eval () { $debug_cmd _G_cmd=$1 _G_fail_exp=${2-':'} func_quote_for_expand "$_G_cmd" eval "func_notquiet $func_quote_for_expand_result" $opt_dry_run || { eval "$_G_cmd" _G_status=$? if test 0 -ne "$_G_status"; then eval "(exit $_G_status); $_G_fail_exp" fi } } # func_show_eval_locale CMD [FAIL_EXP] # ------------------------------------ # Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is # not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP # is given, then evaluate it. Use the saved locale for evaluation. func_show_eval_locale () { $debug_cmd _G_cmd=$1 _G_fail_exp=${2-':'} $opt_quiet || { func_quote_for_expand "$_G_cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || { eval "$_G_user_locale $_G_cmd" _G_status=$? eval "$_G_safe_locale" if test 0 -ne "$_G_status"; then eval "(exit $_G_status); $_G_fail_exp" fi } } # func_tr_sh # ---------- # Turn $1 into a string suitable for a shell variable name. # Result is stored in $func_tr_sh_result. All characters # not in the set a-zA-Z0-9_ are replaced with '_'. Further, # if $1 begins with a digit, a '_' is prepended as well. func_tr_sh () { $debug_cmd case $1 in [0-9]* | *[!a-zA-Z0-9_]*) func_tr_sh_result=`$ECHO "$1" | $SED -e 's/^\([0-9]\)/_\1/' -e 's/[^a-zA-Z0-9_]/_/g'` ;; * ) func_tr_sh_result=$1 ;; esac } # func_verbose ARG... # ------------------- # Echo program name prefixed message in verbose mode only. func_verbose () { $debug_cmd $opt_verbose && func_echo "$*" : } # func_warn_and_continue ARG... # ----------------------------- # Echo program name prefixed warning message to standard error. func_warn_and_continue () { $debug_cmd $require_term_colors func_echo_infix_1 "${tc_red}warning$tc_reset" "$*" >&2 } # func_warning CATEGORY ARG... # ---------------------------- # Echo program name prefixed warning message to standard error. Warning # messages can be filtered according to CATEGORY, where this function # elides messages where CATEGORY is not listed in the global variable # 'opt_warning_types'. func_warning () { $debug_cmd # CATEGORY must be in the warning_categories list! case " $warning_categories " in *" $1 "*) ;; *) func_internal_error "invalid warning category '$1'" ;; esac _G_category=$1 shift case " $opt_warning_types " in *" $_G_category "*) $warning_func ${1+"$@"} ;; esac } # func_sort_ver VER1 VER2 # ----------------------- # 'sort -V' is not generally available. # Note this deviates from the version comparison in automake # in that it treats 1.5 < 1.5.0, and treats 1.4.4a < 1.4-p3a # but this should suffice as we won't be specifying old # version formats or redundant trailing .0 in bootstrap.conf. # If we did want full compatibility then we should probably # use m4_version_compare from autoconf. func_sort_ver () { $debug_cmd printf '%s\n%s\n' "$1" "$2" \ | sort -t. -k 1,1n -k 2,2n -k 3,3n -k 4,4n -k 5,5n -k 6,6n -k 7,7n -k 8,8n -k 9,9n } # func_lt_ver PREV CURR # --------------------- # Return true if PREV and CURR are in the correct order according to # func_sort_ver, otherwise false. Use it like this: # # func_lt_ver "$prev_ver" "$proposed_ver" || func_fatal_error "..." func_lt_ver () { $debug_cmd test "x$1" = x`func_sort_ver "$1" "$2" | $SED 1q` } # Local variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC" # time-stamp-time-zone: "UTC" # End: #! /bin/sh # Set a version string for this script. scriptversion=2014-01-07.03; # UTC # A portable, pluggable option parser for Bourne shell. # Written by Gary V. Vaughan, 2010 # Copyright (C) 2010-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # Please report bugs or propose patches to gary@gnu.org. ## ------ ## ## Usage. ## ## ------ ## # This file is a library for parsing options in your shell scripts along # with assorted other useful supporting features that you can make use # of too. # # For the simplest scripts you might need only: # # #!/bin/sh # . relative/path/to/funclib.sh # . relative/path/to/options-parser # scriptversion=1.0 # func_options ${1+"$@"} # eval set dummy "$func_options_result"; shift # ...rest of your script... # # In order for the '--version' option to work, you will need to have a # suitably formatted comment like the one at the top of this file # starting with '# Written by ' and ending with '# warranty; '. # # For '-h' and '--help' to work, you will also need a one line # description of your script's purpose in a comment directly above the # '# Written by ' line, like the one at the top of this file. # # The default options also support '--debug', which will turn on shell # execution tracing (see the comment above debug_cmd below for another # use), and '--verbose' and the func_verbose function to allow your script # to display verbose messages only when your user has specified # '--verbose'. # # After sourcing this file, you can plug processing for additional # options by amending the variables from the 'Configuration' section # below, and following the instructions in the 'Option parsing' # section further down. ## -------------- ## ## Configuration. ## ## -------------- ## # You should override these variables in your script after sourcing this # file so that they reflect the customisations you have added to the # option parser. # The usage line for option parsing errors and the start of '-h' and # '--help' output messages. You can embed shell variables for delayed # expansion at the time the message is displayed, but you will need to # quote other shell meta-characters carefully to prevent them being # expanded when the contents are evaled. usage='$progpath [OPTION]...' # Short help message in response to '-h' and '--help'. Add to this or # override it after sourcing this library to reflect the full set of # options your script accepts. usage_message="\ --debug enable verbose shell tracing -W, --warnings=CATEGORY report the warnings falling in CATEGORY [all] -v, --verbose verbosely report processing --version print version information and exit -h, --help print short or long help message and exit " # Additional text appended to 'usage_message' in response to '--help'. long_help_message=" Warning categories include: 'all' show all warnings 'none' turn off all the warnings 'error' warnings are treated as fatal errors" # Help message printed before fatal option parsing errors. fatal_help="Try '\$progname --help' for more information." ## ------------------------- ## ## Hook function management. ## ## ------------------------- ## # This section contains functions for adding, removing, and running hooks # to the main code. A hook is just a named list of of function, that can # be run in order later on. # func_hookable FUNC_NAME # ----------------------- # Declare that FUNC_NAME will run hooks added with # 'func_add_hook FUNC_NAME ...'. func_hookable () { $debug_cmd func_append hookable_fns " $1" } # func_add_hook FUNC_NAME HOOK_FUNC # --------------------------------- # Request that FUNC_NAME call HOOK_FUNC before it returns. FUNC_NAME must # first have been declared "hookable" by a call to 'func_hookable'. func_add_hook () { $debug_cmd case " $hookable_fns " in *" $1 "*) ;; *) func_fatal_error "'$1' does not accept hook functions." ;; esac eval func_append ${1}_hooks '" $2"' } # func_remove_hook FUNC_NAME HOOK_FUNC # ------------------------------------ # Remove HOOK_FUNC from the list of functions called by FUNC_NAME. func_remove_hook () { $debug_cmd eval ${1}_hooks='`$ECHO "\$'$1'_hooks" |$SED "s| '$2'||"`' } # func_run_hooks FUNC_NAME [ARG]... # --------------------------------- # Run all hook functions registered to FUNC_NAME. # It is assumed that the list of hook functions contains nothing more # than a whitespace-delimited list of legal shell function names, and # no effort is wasted trying to catch shell meta-characters or preserve # whitespace. func_run_hooks () { $debug_cmd case " $hookable_fns " in *" $1 "*) ;; *) func_fatal_error "'$1' does not support hook funcions.n" ;; esac eval _G_hook_fns=\$$1_hooks; shift for _G_hook in $_G_hook_fns; do eval $_G_hook '"$@"' # store returned options list back into positional # parameters for next 'cmd' execution. eval _G_hook_result=\$${_G_hook}_result eval set dummy "$_G_hook_result"; shift done func_quote_for_eval ${1+"$@"} func_run_hooks_result=$func_quote_for_eval_result } ## --------------- ## ## Option parsing. ## ## --------------- ## # In order to add your own option parsing hooks, you must accept the # full positional parameter list in your hook function, remove any # options that you action, and then pass back the remaining unprocessed # options in '_result', escaped suitably for # 'eval'. Like this: # # my_options_prep () # { # $debug_cmd # # # Extend the existing usage message. # usage_message=$usage_message' # -s, --silent don'\''t print informational messages # ' # # func_quote_for_eval ${1+"$@"} # my_options_prep_result=$func_quote_for_eval_result # } # func_add_hook func_options_prep my_options_prep # # # my_silent_option () # { # $debug_cmd # # # Note that for efficiency, we parse as many options as we can # # recognise in a loop before passing the remainder back to the # # caller on the first unrecognised argument we encounter. # while test $# -gt 0; do # opt=$1; shift # case $opt in # --silent|-s) opt_silent=: ;; # # Separate non-argument short options: # -s*) func_split_short_opt "$_G_opt" # set dummy "$func_split_short_opt_name" \ # "-$func_split_short_opt_arg" ${1+"$@"} # shift # ;; # *) set dummy "$_G_opt" "$*"; shift; break ;; # esac # done # # func_quote_for_eval ${1+"$@"} # my_silent_option_result=$func_quote_for_eval_result # } # func_add_hook func_parse_options my_silent_option # # # my_option_validation () # { # $debug_cmd # # $opt_silent && $opt_verbose && func_fatal_help "\ # '--silent' and '--verbose' options are mutually exclusive." # # func_quote_for_eval ${1+"$@"} # my_option_validation_result=$func_quote_for_eval_result # } # func_add_hook func_validate_options my_option_validation # # You'll alse need to manually amend $usage_message to reflect the extra # options you parse. It's preferable to append if you can, so that # multiple option parsing hooks can be added safely. # func_options [ARG]... # --------------------- # All the functions called inside func_options are hookable. See the # individual implementations for details. func_hookable func_options func_options () { $debug_cmd func_options_prep ${1+"$@"} eval func_parse_options \ ${func_options_prep_result+"$func_options_prep_result"} eval func_validate_options \ ${func_parse_options_result+"$func_parse_options_result"} eval func_run_hooks func_options \ ${func_validate_options_result+"$func_validate_options_result"} # save modified positional parameters for caller func_options_result=$func_run_hooks_result } # func_options_prep [ARG]... # -------------------------- # All initialisations required before starting the option parse loop. # Note that when calling hook functions, we pass through the list of # positional parameters. If a hook function modifies that list, and # needs to propogate that back to rest of this script, then the complete # modified list must be put in 'func_run_hooks_result' before # returning. func_hookable func_options_prep func_options_prep () { $debug_cmd # Option defaults: opt_verbose=false opt_warning_types= func_run_hooks func_options_prep ${1+"$@"} # save modified positional parameters for caller func_options_prep_result=$func_run_hooks_result } # func_parse_options [ARG]... # --------------------------- # The main option parsing loop. func_hookable func_parse_options func_parse_options () { $debug_cmd func_parse_options_result= # this just eases exit handling while test $# -gt 0; do # Defer to hook functions for initial option parsing, so they # get priority in the event of reusing an option name. func_run_hooks func_parse_options ${1+"$@"} # Adjust func_parse_options positional parameters to match eval set dummy "$func_run_hooks_result"; shift # Break out of the loop if we already parsed every option. test $# -gt 0 || break _G_opt=$1 shift case $_G_opt in --debug|-x) debug_cmd='set -x' func_echo "enabling shell trace mode" $debug_cmd ;; --no-warnings|--no-warning|--no-warn) set dummy --warnings none ${1+"$@"} shift ;; --warnings|--warning|-W) test $# = 0 && func_missing_arg $_G_opt && break case " $warning_categories $1" in *" $1 "*) # trailing space prevents matching last $1 above func_append_uniq opt_warning_types " $1" ;; *all) opt_warning_types=$warning_categories ;; *none) opt_warning_types=none warning_func=: ;; *error) opt_warning_types=$warning_categories warning_func=func_fatal_error ;; *) func_fatal_error \ "unsupported warning category: '$1'" ;; esac shift ;; --verbose|-v) opt_verbose=: ;; --version) func_version ;; -\?|-h) func_usage ;; --help) func_help ;; # Separate optargs to long options (plugins may need this): --*=*) func_split_equals "$_G_opt" set dummy "$func_split_equals_lhs" \ "$func_split_equals_rhs" ${1+"$@"} shift ;; # Separate optargs to short options: -W*) func_split_short_opt "$_G_opt" set dummy "$func_split_short_opt_name" \ "$func_split_short_opt_arg" ${1+"$@"} shift ;; # Separate non-argument short options: -\?*|-h*|-v*|-x*) func_split_short_opt "$_G_opt" set dummy "$func_split_short_opt_name" \ "-$func_split_short_opt_arg" ${1+"$@"} shift ;; --) break ;; -*) func_fatal_help "unrecognised option: '$_G_opt'" ;; *) set dummy "$_G_opt" ${1+"$@"}; shift; break ;; esac done # save modified positional parameters for caller func_quote_for_eval ${1+"$@"} func_parse_options_result=$func_quote_for_eval_result } # func_validate_options [ARG]... # ------------------------------ # Perform any sanity checks on option settings and/or unconsumed # arguments. func_hookable func_validate_options func_validate_options () { $debug_cmd # Display all warnings if -W was not given. test -n "$opt_warning_types" || opt_warning_types=" $warning_categories" func_run_hooks func_validate_options ${1+"$@"} # Bail if the options were screwed! $exit_cmd $EXIT_FAILURE # save modified positional parameters for caller func_validate_options_result=$func_run_hooks_result } ## ----------------- ## ## Helper functions. ## ## ----------------- ## # This section contains the helper functions used by the rest of the # hookable option parser framework in ascii-betical order. # func_fatal_help ARG... # ---------------------- # Echo program name prefixed message to standard error, followed by # a help hint, and exit. func_fatal_help () { $debug_cmd eval \$ECHO \""Usage: $usage"\" eval \$ECHO \""$fatal_help"\" func_error ${1+"$@"} exit $EXIT_FAILURE } # func_help # --------- # Echo long help message to standard output and exit. func_help () { $debug_cmd func_usage_message $ECHO "$long_help_message" exit 0 } # func_missing_arg ARGNAME # ------------------------ # Echo program name prefixed message to standard error and set global # exit_cmd. func_missing_arg () { $debug_cmd func_error "Missing argument for '$1'." exit_cmd=exit } # func_split_equals STRING # ------------------------ # Set func_split_equals_lhs and func_split_equals_rhs shell variables after # splitting STRING at the '=' sign. test -z "$_G_HAVE_XSI_OPS" \ && (eval 'x=a/b/c; test 5aa/bb/cc = "${#x}${x%%/*}${x%/*}${x#*/}${x##*/}"') 2>/dev/null \ && _G_HAVE_XSI_OPS=yes if test yes = "$_G_HAVE_XSI_OPS" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_split_equals () { $debug_cmd func_split_equals_lhs=${1%%=*} func_split_equals_rhs=${1#*=} test "x$func_split_equals_lhs" = "x$1" \ && func_split_equals_rhs= }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_split_equals () { $debug_cmd func_split_equals_lhs=`expr "x$1" : 'x\([^=]*\)'` func_split_equals_rhs= test "x$func_split_equals_lhs" = "x$1" \ || func_split_equals_rhs=`expr "x$1" : 'x[^=]*=\(.*\)$'` } fi #func_split_equals # func_split_short_opt SHORTOPT # ----------------------------- # Set func_split_short_opt_name and func_split_short_opt_arg shell # variables after splitting SHORTOPT after the 2nd character. if test yes = "$_G_HAVE_XSI_OPS" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_split_short_opt () { $debug_cmd func_split_short_opt_arg=${1#??} func_split_short_opt_name=${1%"$func_split_short_opt_arg"} }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_split_short_opt () { $debug_cmd func_split_short_opt_name=`expr "x$1" : 'x-\(.\)'` func_split_short_opt_arg=`expr "x$1" : 'x-.\(.*\)$'` } fi #func_split_short_opt # func_usage # ---------- # Echo short help message to standard output and exit. func_usage () { $debug_cmd func_usage_message $ECHO "Run '$progname --help |${PAGER-more}' for full usage" exit 0 } # func_usage_message # ------------------ # Echo short help message to standard output. func_usage_message () { $debug_cmd eval \$ECHO \""Usage: $usage"\" echo $SED -n 's|^# || /^Written by/{ x;p;x } h /^Written by/q' < "$progpath" echo eval \$ECHO \""$usage_message"\" } # func_version # ------------ # Echo version message to standard output and exit. func_version () { $debug_cmd printf '%s\n' "$progname $scriptversion" $SED -n ' /(C)/!b go :more /\./!{ N s|\n# | | b more } :go /^# Written by /,/# warranty; / { s|^# || s|^# *$|| s|\((C)\)[ 0-9,-]*[ ,-]\([1-9][0-9]* \)|\1 \2| p } /^# Written by / { s|^# || p } /^warranty; /q' < "$progpath" exit $? } # Local variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC" # time-stamp-time-zone: "UTC" # End: # Set a version string. scriptversion='(GNU libtool) 2.4.6' # func_echo ARG... # ---------------- # Libtool also displays the current mode in messages, so override # funclib.sh func_echo with this custom definition. func_echo () { $debug_cmd _G_message=$* func_echo_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_IFS $ECHO "$progname${opt_mode+: $opt_mode}: $_G_line" done IFS=$func_echo_IFS } # func_warning ARG... # ------------------- # Libtool warnings are not categorized, so override funclib.sh # func_warning with this simpler definition. func_warning () { $debug_cmd $warning_func ${1+"$@"} } ## ---------------- ## ## Options parsing. ## ## ---------------- ## # Hook in the functions to make sure our own options are parsed during # the option parsing loop. usage='$progpath [OPTION]... [MODE-ARG]...' # Short help message in response to '-h'. usage_message="Options: --config show all configuration variables --debug enable verbose shell tracing -n, --dry-run display commands without modifying any files --features display basic configuration information and exit --mode=MODE use operation mode MODE --no-warnings equivalent to '-Wnone' --preserve-dup-deps don't remove duplicate dependency libraries --quiet, --silent don't print informational messages --tag=TAG use configuration variables from tag TAG -v, --verbose print more informational messages than default --version print version information -W, --warnings=CATEGORY report the warnings falling in CATEGORY [all] -h, --help, --help-all print short, long, or detailed help message " # Additional text appended to 'usage_message' in response to '--help'. func_help () { $debug_cmd func_usage_message $ECHO "$long_help_message MODE must be one of the following: clean remove files from the build directory compile compile a source file into a libtool object execute automatically set library path, then run a program finish complete the installation of libtool libraries install install libraries or executables link create a library or an executable uninstall remove libraries from an installed directory MODE-ARGS vary depending on the MODE. When passed as first option, '--mode=MODE' may be abbreviated as 'MODE' or a unique abbreviation of that. Try '$progname --help --mode=MODE' for a more detailed description of MODE. When reporting a bug, please describe a test case to reproduce it and include the following information: host-triplet: $host shell: $SHELL compiler: $LTCC compiler flags: $LTCFLAGS linker: $LD (gnu? $with_gnu_ld) version: $progname (GNU libtool) 2.4.6 automake: `($AUTOMAKE --version) 2>/dev/null |$SED 1q` autoconf: `($AUTOCONF --version) 2>/dev/null |$SED 1q` Report bugs to . GNU libtool home page: . General help using GNU software: ." exit 0 } # func_lo2o OBJECT-NAME # --------------------- # Transform OBJECT-NAME from a '.lo' suffix to the platform specific # object suffix. lo2o=s/\\.lo\$/.$objext/ o2lo=s/\\.$objext\$/.lo/ if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_lo2o () { case $1 in *.lo) func_lo2o_result=${1%.lo}.$objext ;; * ) func_lo2o_result=$1 ;; esac }' # func_xform LIBOBJ-OR-SOURCE # --------------------------- # Transform LIBOBJ-OR-SOURCE from a '.o' or '.c' (or otherwise) # suffix to a '.lo' libtool-object suffix. eval 'func_xform () { func_xform_result=${1%.*}.lo }' else # ...otherwise fall back to using sed. func_lo2o () { func_lo2o_result=`$ECHO "$1" | $SED "$lo2o"` } func_xform () { func_xform_result=`$ECHO "$1" | $SED 's|\.[^.]*$|.lo|'` } fi # func_fatal_configuration ARG... # ------------------------------- # Echo program name prefixed message to standard error, followed by # a configuration failure hint, and exit. func_fatal_configuration () { func__fatal_error ${1+"$@"} \ "See the $PACKAGE documentation for more information." \ "Fatal configuration error." } # func_config # ----------- # Display the configuration for all the tags in this script. func_config () { re_begincf='^# ### BEGIN LIBTOOL' re_endcf='^# ### END LIBTOOL' # Default configuration. $SED "1,/$re_begincf CONFIG/d;/$re_endcf CONFIG/,\$d" < "$progpath" # Now print the configurations for the tags. for tagname in $taglist; do $SED -n "/$re_begincf TAG CONFIG: $tagname\$/,/$re_endcf TAG CONFIG: $tagname\$/p" < "$progpath" done exit $? } # func_features # ------------- # Display the features supported by this script. func_features () { echo "host: $host" if test yes = "$build_libtool_libs"; then echo "enable shared libraries" else echo "disable shared libraries" fi if test yes = "$build_old_libs"; then echo "enable static libraries" else echo "disable static libraries" fi exit $? } # func_enable_tag TAGNAME # ----------------------- # Verify that TAGNAME is valid, and either flag an error and exit, or # enable the TAGNAME tag. We also add TAGNAME to the global $taglist # variable here. func_enable_tag () { # Global variable: tagname=$1 re_begincf="^# ### BEGIN LIBTOOL TAG CONFIG: $tagname\$" re_endcf="^# ### END LIBTOOL TAG CONFIG: $tagname\$" sed_extractcf=/$re_begincf/,/$re_endcf/p # Validate tagname. case $tagname in *[!-_A-Za-z0-9,/]*) func_fatal_error "invalid tag name: $tagname" ;; esac # Don't test for the "default" C tag, as we know it's # there but not specially marked. case $tagname in CC) ;; *) if $GREP "$re_begincf" "$progpath" >/dev/null 2>&1; then taglist="$taglist $tagname" # Evaluate the configuration. Be careful to quote the path # and the sed script, to avoid splitting on whitespace, but # also don't use non-portable quotes within backquotes within # quotes we have to do it in 2 steps: extractedcf=`$SED -n -e "$sed_extractcf" < "$progpath"` eval "$extractedcf" else func_error "ignoring unknown tag $tagname" fi ;; esac } # func_check_version_match # ------------------------ # Ensure that we are using m4 macros, and libtool script from the same # release of libtool. func_check_version_match () { if test "$package_revision" != "$macro_revision"; then if test "$VERSION" != "$macro_version"; then if test -z "$macro_version"; then cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, but the $progname: definition of this LT_INIT comes from an older release. $progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION $progname: and run autoconf again. _LT_EOF else cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, but the $progname: definition of this LT_INIT comes from $PACKAGE $macro_version. $progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION $progname: and run autoconf again. _LT_EOF fi else cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, revision $package_revision, $progname: but the definition of this LT_INIT comes from revision $macro_revision. $progname: You should recreate aclocal.m4 with macros from revision $package_revision $progname: of $PACKAGE $VERSION and run autoconf again. _LT_EOF fi exit $EXIT_MISMATCH fi } # libtool_options_prep [ARG]... # ----------------------------- # Preparation for options parsed by libtool. libtool_options_prep () { $debug_mode # Option defaults: opt_config=false opt_dlopen= opt_dry_run=false opt_help=false opt_mode= opt_preserve_dup_deps=false opt_quiet=false nonopt= preserve_args= # Shorthand for --mode=foo, only valid as the first argument case $1 in clean|clea|cle|cl) shift; set dummy --mode clean ${1+"$@"}; shift ;; compile|compil|compi|comp|com|co|c) shift; set dummy --mode compile ${1+"$@"}; shift ;; execute|execut|execu|exec|exe|ex|e) shift; set dummy --mode execute ${1+"$@"}; shift ;; finish|finis|fini|fin|fi|f) shift; set dummy --mode finish ${1+"$@"}; shift ;; install|instal|insta|inst|ins|in|i) shift; set dummy --mode install ${1+"$@"}; shift ;; link|lin|li|l) shift; set dummy --mode link ${1+"$@"}; shift ;; uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u) shift; set dummy --mode uninstall ${1+"$@"}; shift ;; esac # Pass back the list of options. func_quote_for_eval ${1+"$@"} libtool_options_prep_result=$func_quote_for_eval_result } func_add_hook func_options_prep libtool_options_prep # libtool_parse_options [ARG]... # --------------------------------- # Provide handling for libtool specific options. libtool_parse_options () { $debug_cmd # Perform our own loop to consume as many options as possible in # each iteration. while test $# -gt 0; do _G_opt=$1 shift case $_G_opt in --dry-run|--dryrun|-n) opt_dry_run=: ;; --config) func_config ;; --dlopen|-dlopen) opt_dlopen="${opt_dlopen+$opt_dlopen }$1" shift ;; --preserve-dup-deps) opt_preserve_dup_deps=: ;; --features) func_features ;; --finish) set dummy --mode finish ${1+"$@"}; shift ;; --help) opt_help=: ;; --help-all) opt_help=': help-all' ;; --mode) test $# = 0 && func_missing_arg $_G_opt && break opt_mode=$1 case $1 in # Valid mode arguments: clean|compile|execute|finish|install|link|relink|uninstall) ;; # Catch anything else as an error *) func_error "invalid argument for $_G_opt" exit_cmd=exit break ;; esac shift ;; --no-silent|--no-quiet) opt_quiet=false func_append preserve_args " $_G_opt" ;; --no-warnings|--no-warning|--no-warn) opt_warning=false func_append preserve_args " $_G_opt" ;; --no-verbose) opt_verbose=false func_append preserve_args " $_G_opt" ;; --silent|--quiet) opt_quiet=: opt_verbose=false func_append preserve_args " $_G_opt" ;; --tag) test $# = 0 && func_missing_arg $_G_opt && break opt_tag=$1 func_append preserve_args " $_G_opt $1" func_enable_tag "$1" shift ;; --verbose|-v) opt_quiet=false opt_verbose=: func_append preserve_args " $_G_opt" ;; # An option not handled by this hook function: *) set dummy "$_G_opt" ${1+"$@"}; shift; break ;; esac done # save modified positional parameters for caller func_quote_for_eval ${1+"$@"} libtool_parse_options_result=$func_quote_for_eval_result } func_add_hook func_parse_options libtool_parse_options # libtool_validate_options [ARG]... # --------------------------------- # Perform any sanity checks on option settings and/or unconsumed # arguments. libtool_validate_options () { # save first non-option argument if test 0 -lt $#; then nonopt=$1 shift fi # preserve --debug test : = "$debug_cmd" || func_append preserve_args " --debug" case $host in # Solaris2 added to fix http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452 # see also: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788 *cygwin* | *mingw* | *pw32* | *cegcc* | *solaris2* | *os2*) # don't eliminate duplications in $postdeps and $predeps opt_duplicate_compiler_generated_deps=: ;; *) opt_duplicate_compiler_generated_deps=$opt_preserve_dup_deps ;; esac $opt_help || { # Sanity checks first: func_check_version_match test yes != "$build_libtool_libs" \ && test yes != "$build_old_libs" \ && func_fatal_configuration "not configured to build any kind of library" # Darwin sucks eval std_shrext=\"$shrext_cmds\" # Only execute mode is allowed to have -dlopen flags. if test -n "$opt_dlopen" && test execute != "$opt_mode"; then func_error "unrecognized option '-dlopen'" $ECHO "$help" 1>&2 exit $EXIT_FAILURE fi # Change the help message to a mode-specific one. generic_help=$help help="Try '$progname --help --mode=$opt_mode' for more information." } # Pass back the unparsed argument list func_quote_for_eval ${1+"$@"} libtool_validate_options_result=$func_quote_for_eval_result } func_add_hook func_validate_options libtool_validate_options # Process options as early as possible so that --help and --version # can return quickly. func_options ${1+"$@"} eval set dummy "$func_options_result"; shift ## ----------- ## ## Main. ## ## ----------- ## magic='%%%MAGIC variable%%%' magic_exe='%%%MAGIC EXE variable%%%' # Global variables. extracted_archives= extracted_serial=0 # If this variable is set in any of the actions, the command in it # will be execed at the end. This prevents here-documents from being # left over by shells. exec_cmd= # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $1 _LTECHO_EOF' } # func_generated_by_libtool # True iff stdin has been generated by Libtool. This function is only # a basic sanity check; it will hardly flush out determined imposters. func_generated_by_libtool_p () { $GREP "^# Generated by .*$PACKAGE" > /dev/null 2>&1 } # func_lalib_p file # True iff FILE is a libtool '.la' library or '.lo' object file. # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_lalib_p () { test -f "$1" && $SED -e 4q "$1" 2>/dev/null | func_generated_by_libtool_p } # func_lalib_unsafe_p file # True iff FILE is a libtool '.la' library or '.lo' object file. # This function implements the same check as func_lalib_p without # resorting to external programs. To this end, it redirects stdin and # closes it afterwards, without saving the original file descriptor. # As a safety measure, use it only where a negative result would be # fatal anyway. Works if 'file' does not exist. func_lalib_unsafe_p () { lalib_p=no if test -f "$1" && test -r "$1" && exec 5<&0 <"$1"; then for lalib_p_l in 1 2 3 4 do read lalib_p_line case $lalib_p_line in \#\ Generated\ by\ *$PACKAGE* ) lalib_p=yes; break;; esac done exec 0<&5 5<&- fi test yes = "$lalib_p" } # func_ltwrapper_script_p file # True iff FILE is a libtool wrapper script # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_script_p () { test -f "$1" && $lt_truncate_bin < "$1" 2>/dev/null | func_generated_by_libtool_p } # func_ltwrapper_executable_p file # True iff FILE is a libtool wrapper executable # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_executable_p () { func_ltwrapper_exec_suffix= case $1 in *.exe) ;; *) func_ltwrapper_exec_suffix=.exe ;; esac $GREP "$magic_exe" "$1$func_ltwrapper_exec_suffix" >/dev/null 2>&1 } # func_ltwrapper_scriptname file # Assumes file is an ltwrapper_executable # uses $file to determine the appropriate filename for a # temporary ltwrapper_script. func_ltwrapper_scriptname () { func_dirname_and_basename "$1" "" "." func_stripname '' '.exe' "$func_basename_result" func_ltwrapper_scriptname_result=$func_dirname_result/$objdir/${func_stripname_result}_ltshwrapper } # func_ltwrapper_p file # True iff FILE is a libtool wrapper script or wrapper executable # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_p () { func_ltwrapper_script_p "$1" || func_ltwrapper_executable_p "$1" } # func_execute_cmds commands fail_cmd # Execute tilde-delimited COMMANDS. # If FAIL_CMD is given, eval that upon failure. # FAIL_CMD may read-access the current command in variable CMD! func_execute_cmds () { $debug_cmd save_ifs=$IFS; IFS='~' for cmd in $1; do IFS=$sp$nl eval cmd=\"$cmd\" IFS=$save_ifs func_show_eval "$cmd" "${2-:}" done IFS=$save_ifs } # func_source file # Source FILE, adding directory component if necessary. # Note that it is not necessary on cygwin/mingw to append a dot to # FILE even if both FILE and FILE.exe exist: automatic-append-.exe # behavior happens only for exec(3), not for open(2)! Also, sourcing # 'FILE.' does not work on cygwin managed mounts. func_source () { $debug_cmd case $1 in */* | *\\*) . "$1" ;; *) . "./$1" ;; esac } # func_resolve_sysroot PATH # Replace a leading = in PATH with a sysroot. Store the result into # func_resolve_sysroot_result func_resolve_sysroot () { func_resolve_sysroot_result=$1 case $func_resolve_sysroot_result in =*) func_stripname '=' '' "$func_resolve_sysroot_result" func_resolve_sysroot_result=$lt_sysroot$func_stripname_result ;; esac } # func_replace_sysroot PATH # If PATH begins with the sysroot, replace it with = and # store the result into func_replace_sysroot_result. func_replace_sysroot () { case $lt_sysroot:$1 in ?*:"$lt_sysroot"*) func_stripname "$lt_sysroot" '' "$1" func_replace_sysroot_result='='$func_stripname_result ;; *) # Including no sysroot. func_replace_sysroot_result=$1 ;; esac } # func_infer_tag arg # Infer tagged configuration to use if any are available and # if one wasn't chosen via the "--tag" command line option. # Only attempt this if the compiler in the base compile # command doesn't match the default compiler. # arg is usually of the form 'gcc ...' func_infer_tag () { $debug_cmd if test -n "$available_tags" && test -z "$tagname"; then CC_quoted= for arg in $CC; do func_append_quoted CC_quoted "$arg" done CC_expanded=`func_echo_all $CC` CC_quoted_expanded=`func_echo_all $CC_quoted` case $@ in # Blanks in the command may have been stripped by the calling shell, # but not from the CC environment variable when configure was run. " $CC "* | "$CC "* | " $CC_expanded "* | "$CC_expanded "* | \ " $CC_quoted"* | "$CC_quoted "* | " $CC_quoted_expanded "* | "$CC_quoted_expanded "*) ;; # Blanks at the start of $base_compile will cause this to fail # if we don't check for them as well. *) for z in $available_tags; do if $GREP "^# ### BEGIN LIBTOOL TAG CONFIG: $z$" < "$progpath" > /dev/null; then # Evaluate the configuration. eval "`$SED -n -e '/^# ### BEGIN LIBTOOL TAG CONFIG: '$z'$/,/^# ### END LIBTOOL TAG CONFIG: '$z'$/p' < $progpath`" CC_quoted= for arg in $CC; do # Double-quote args containing other shell metacharacters. func_append_quoted CC_quoted "$arg" done CC_expanded=`func_echo_all $CC` CC_quoted_expanded=`func_echo_all $CC_quoted` case "$@ " in " $CC "* | "$CC "* | " $CC_expanded "* | "$CC_expanded "* | \ " $CC_quoted"* | "$CC_quoted "* | " $CC_quoted_expanded "* | "$CC_quoted_expanded "*) # The compiler in the base compile command matches # the one in the tagged configuration. # Assume this is the tagged configuration we want. tagname=$z break ;; esac fi done # If $tagname still isn't set, then no tagged configuration # was found and let the user know that the "--tag" command # line option must be used. if test -z "$tagname"; then func_echo "unable to infer tagged configuration" func_fatal_error "specify a tag with '--tag'" # else # func_verbose "using $tagname tagged configuration" fi ;; esac fi } # func_write_libtool_object output_name pic_name nonpic_name # Create a libtool object file (analogous to a ".la" file), # but don't create it if we're doing a dry run. func_write_libtool_object () { write_libobj=$1 if test yes = "$build_libtool_libs"; then write_lobj=\'$2\' else write_lobj=none fi if test yes = "$build_old_libs"; then write_oldobj=\'$3\' else write_oldobj=none fi $opt_dry_run || { cat >${write_libobj}T </dev/null` if test "$?" -eq 0 && test -n "$func_convert_core_file_wine_to_w32_tmp"; then func_convert_core_file_wine_to_w32_result=`$ECHO "$func_convert_core_file_wine_to_w32_tmp" | $SED -e "$sed_naive_backslashify"` else func_convert_core_file_wine_to_w32_result= fi fi } # end: func_convert_core_file_wine_to_w32 # func_convert_core_path_wine_to_w32 ARG # Helper function used by path conversion functions when $build is *nix, and # $host is mingw, cygwin, or some other w32 environment. Relies on a correctly # configured wine environment available, with the winepath program in $build's # $PATH. Assumes ARG has no leading or trailing path separator characters. # # ARG is path to be converted from $build format to win32. # Result is available in $func_convert_core_path_wine_to_w32_result. # Unconvertible file (directory) names in ARG are skipped; if no directory names # are convertible, then the result may be empty. func_convert_core_path_wine_to_w32 () { $debug_cmd # unfortunately, winepath doesn't convert paths, only file names func_convert_core_path_wine_to_w32_result= if test -n "$1"; then oldIFS=$IFS IFS=: for func_convert_core_path_wine_to_w32_f in $1; do IFS=$oldIFS func_convert_core_file_wine_to_w32 "$func_convert_core_path_wine_to_w32_f" if test -n "$func_convert_core_file_wine_to_w32_result"; then if test -z "$func_convert_core_path_wine_to_w32_result"; then func_convert_core_path_wine_to_w32_result=$func_convert_core_file_wine_to_w32_result else func_append func_convert_core_path_wine_to_w32_result ";$func_convert_core_file_wine_to_w32_result" fi fi done IFS=$oldIFS fi } # end: func_convert_core_path_wine_to_w32 # func_cygpath ARGS... # Wrapper around calling the cygpath program via LT_CYGPATH. This is used when # when (1) $build is *nix and Cygwin is hosted via a wine environment; or (2) # $build is MSYS and $host is Cygwin, or (3) $build is Cygwin. In case (1) or # (2), returns the Cygwin file name or path in func_cygpath_result (input # file name or path is assumed to be in w32 format, as previously converted # from $build's *nix or MSYS format). In case (3), returns the w32 file name # or path in func_cygpath_result (input file name or path is assumed to be in # Cygwin format). Returns an empty string on error. # # ARGS are passed to cygpath, with the last one being the file name or path to # be converted. # # Specify the absolute *nix (or w32) name to cygpath in the LT_CYGPATH # environment variable; do not put it in $PATH. func_cygpath () { $debug_cmd if test -n "$LT_CYGPATH" && test -f "$LT_CYGPATH"; then func_cygpath_result=`$LT_CYGPATH "$@" 2>/dev/null` if test "$?" -ne 0; then # on failure, ensure result is empty func_cygpath_result= fi else func_cygpath_result= func_error "LT_CYGPATH is empty or specifies non-existent file: '$LT_CYGPATH'" fi } #end: func_cygpath # func_convert_core_msys_to_w32 ARG # Convert file name or path ARG from MSYS format to w32 format. Return # result in func_convert_core_msys_to_w32_result. func_convert_core_msys_to_w32 () { $debug_cmd # awkward: cmd appends spaces to result func_convert_core_msys_to_w32_result=`( cmd //c echo "$1" ) 2>/dev/null | $SED -e 's/[ ]*$//' -e "$sed_naive_backslashify"` } #end: func_convert_core_msys_to_w32 # func_convert_file_check ARG1 ARG2 # Verify that ARG1 (a file name in $build format) was converted to $host # format in ARG2. Otherwise, emit an error message, but continue (resetting # func_to_host_file_result to ARG1). func_convert_file_check () { $debug_cmd if test -z "$2" && test -n "$1"; then func_error "Could not determine host file name corresponding to" func_error " '$1'" func_error "Continuing, but uninstalled executables may not work." # Fallback: func_to_host_file_result=$1 fi } # end func_convert_file_check # func_convert_path_check FROM_PATHSEP TO_PATHSEP FROM_PATH TO_PATH # Verify that FROM_PATH (a path in $build format) was converted to $host # format in TO_PATH. Otherwise, emit an error message, but continue, resetting # func_to_host_file_result to a simplistic fallback value (see below). func_convert_path_check () { $debug_cmd if test -z "$4" && test -n "$3"; then func_error "Could not determine the host path corresponding to" func_error " '$3'" func_error "Continuing, but uninstalled executables may not work." # Fallback. This is a deliberately simplistic "conversion" and # should not be "improved". See libtool.info. if test "x$1" != "x$2"; then lt_replace_pathsep_chars="s|$1|$2|g" func_to_host_path_result=`echo "$3" | $SED -e "$lt_replace_pathsep_chars"` else func_to_host_path_result=$3 fi fi } # end func_convert_path_check # func_convert_path_front_back_pathsep FRONTPAT BACKPAT REPL ORIG # Modifies func_to_host_path_result by prepending REPL if ORIG matches FRONTPAT # and appending REPL if ORIG matches BACKPAT. func_convert_path_front_back_pathsep () { $debug_cmd case $4 in $1 ) func_to_host_path_result=$3$func_to_host_path_result ;; esac case $4 in $2 ) func_append func_to_host_path_result "$3" ;; esac } # end func_convert_path_front_back_pathsep ################################################## # $build to $host FILE NAME CONVERSION FUNCTIONS # ################################################## # invoked via '$to_host_file_cmd ARG' # # In each case, ARG is the path to be converted from $build to $host format. # Result will be available in $func_to_host_file_result. # func_to_host_file ARG # Converts the file name ARG from $build format to $host format. Return result # in func_to_host_file_result. func_to_host_file () { $debug_cmd $to_host_file_cmd "$1" } # end func_to_host_file # func_to_tool_file ARG LAZY # converts the file name ARG from $build format to toolchain format. Return # result in func_to_tool_file_result. If the conversion in use is listed # in (the comma separated) LAZY, no conversion takes place. func_to_tool_file () { $debug_cmd case ,$2, in *,"$to_tool_file_cmd",*) func_to_tool_file_result=$1 ;; *) $to_tool_file_cmd "$1" func_to_tool_file_result=$func_to_host_file_result ;; esac } # end func_to_tool_file # func_convert_file_noop ARG # Copy ARG to func_to_host_file_result. func_convert_file_noop () { func_to_host_file_result=$1 } # end func_convert_file_noop # func_convert_file_msys_to_w32 ARG # Convert file name ARG from (mingw) MSYS to (mingw) w32 format; automatic # conversion to w32 is not available inside the cwrapper. Returns result in # func_to_host_file_result. func_convert_file_msys_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_msys_to_w32 "$1" func_to_host_file_result=$func_convert_core_msys_to_w32_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_msys_to_w32 # func_convert_file_cygwin_to_w32 ARG # Convert file name ARG from Cygwin to w32 format. Returns result in # func_to_host_file_result. func_convert_file_cygwin_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then # because $build is cygwin, we call "the" cygpath in $PATH; no need to use # LT_CYGPATH in this case. func_to_host_file_result=`cygpath -m "$1"` fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_cygwin_to_w32 # func_convert_file_nix_to_w32 ARG # Convert file name ARG from *nix to w32 format. Requires a wine environment # and a working winepath. Returns result in func_to_host_file_result. func_convert_file_nix_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_file_wine_to_w32 "$1" func_to_host_file_result=$func_convert_core_file_wine_to_w32_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_nix_to_w32 # func_convert_file_msys_to_cygwin ARG # Convert file name ARG from MSYS to Cygwin format. Requires LT_CYGPATH set. # Returns result in func_to_host_file_result. func_convert_file_msys_to_cygwin () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_msys_to_w32 "$1" func_cygpath -u "$func_convert_core_msys_to_w32_result" func_to_host_file_result=$func_cygpath_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_msys_to_cygwin # func_convert_file_nix_to_cygwin ARG # Convert file name ARG from *nix to Cygwin format. Requires Cygwin installed # in a wine environment, working winepath, and LT_CYGPATH set. Returns result # in func_to_host_file_result. func_convert_file_nix_to_cygwin () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then # convert from *nix to w32, then use cygpath to convert from w32 to cygwin. func_convert_core_file_wine_to_w32 "$1" func_cygpath -u "$func_convert_core_file_wine_to_w32_result" func_to_host_file_result=$func_cygpath_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_nix_to_cygwin ############################################# # $build to $host PATH CONVERSION FUNCTIONS # ############################################# # invoked via '$to_host_path_cmd ARG' # # In each case, ARG is the path to be converted from $build to $host format. # The result will be available in $func_to_host_path_result. # # Path separators are also converted from $build format to $host format. If # ARG begins or ends with a path separator character, it is preserved (but # converted to $host format) on output. # # All path conversion functions are named using the following convention: # file name conversion function : func_convert_file_X_to_Y () # path conversion function : func_convert_path_X_to_Y () # where, for any given $build/$host combination the 'X_to_Y' value is the # same. If conversion functions are added for new $build/$host combinations, # the two new functions must follow this pattern, or func_init_to_host_path_cmd # will break. # func_init_to_host_path_cmd # Ensures that function "pointer" variable $to_host_path_cmd is set to the # appropriate value, based on the value of $to_host_file_cmd. to_host_path_cmd= func_init_to_host_path_cmd () { $debug_cmd if test -z "$to_host_path_cmd"; then func_stripname 'func_convert_file_' '' "$to_host_file_cmd" to_host_path_cmd=func_convert_path_$func_stripname_result fi } # func_to_host_path ARG # Converts the path ARG from $build format to $host format. Return result # in func_to_host_path_result. func_to_host_path () { $debug_cmd func_init_to_host_path_cmd $to_host_path_cmd "$1" } # end func_to_host_path # func_convert_path_noop ARG # Copy ARG to func_to_host_path_result. func_convert_path_noop () { func_to_host_path_result=$1 } # end func_convert_path_noop # func_convert_path_msys_to_w32 ARG # Convert path ARG from (mingw) MSYS to (mingw) w32 format; automatic # conversion to w32 is not available inside the cwrapper. Returns result in # func_to_host_path_result. func_convert_path_msys_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # Remove leading and trailing path separator characters from ARG. MSYS # behavior is inconsistent here; cygpath turns them into '.;' and ';.'; # and winepath ignores them completely. func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_msys_to_w32 "$func_to_host_path_tmp1" func_to_host_path_result=$func_convert_core_msys_to_w32_result func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_msys_to_w32 # func_convert_path_cygwin_to_w32 ARG # Convert path ARG from Cygwin to w32 format. Returns result in # func_to_host_file_result. func_convert_path_cygwin_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_to_host_path_result=`cygpath -m -p "$func_to_host_path_tmp1"` func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_cygwin_to_w32 # func_convert_path_nix_to_w32 ARG # Convert path ARG from *nix to w32 format. Requires a wine environment and # a working winepath. Returns result in func_to_host_file_result. func_convert_path_nix_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1" func_to_host_path_result=$func_convert_core_path_wine_to_w32_result func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_nix_to_w32 # func_convert_path_msys_to_cygwin ARG # Convert path ARG from MSYS to Cygwin format. Requires LT_CYGPATH set. # Returns result in func_to_host_file_result. func_convert_path_msys_to_cygwin () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_msys_to_w32 "$func_to_host_path_tmp1" func_cygpath -u -p "$func_convert_core_msys_to_w32_result" func_to_host_path_result=$func_cygpath_result func_convert_path_check : : \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" : "$1" fi } # end func_convert_path_msys_to_cygwin # func_convert_path_nix_to_cygwin ARG # Convert path ARG from *nix to Cygwin format. Requires Cygwin installed in a # a wine environment, working winepath, and LT_CYGPATH set. Returns result in # func_to_host_file_result. func_convert_path_nix_to_cygwin () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # Remove leading and trailing path separator characters from # ARG. msys behavior is inconsistent here, cygpath turns them # into '.;' and ';.', and winepath ignores them completely. func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1" func_cygpath -u -p "$func_convert_core_path_wine_to_w32_result" func_to_host_path_result=$func_cygpath_result func_convert_path_check : : \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" : "$1" fi } # end func_convert_path_nix_to_cygwin # func_dll_def_p FILE # True iff FILE is a Windows DLL '.def' file. # Keep in sync with _LT_DLL_DEF_P in libtool.m4 func_dll_def_p () { $debug_cmd func_dll_def_p_tmp=`$SED -n \ -e 's/^[ ]*//' \ -e '/^\(;.*\)*$/d' \ -e 's/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p' \ -e q \ "$1"` test DEF = "$func_dll_def_p_tmp" } # func_mode_compile arg... func_mode_compile () { $debug_cmd # Get the compilation command and the source file. base_compile= srcfile=$nonopt # always keep a non-empty value in "srcfile" suppress_opt=yes suppress_output= arg_mode=normal libobj= later= pie_flag= for arg do case $arg_mode in arg ) # do not "continue". Instead, add this to base_compile lastarg=$arg arg_mode=normal ;; target ) libobj=$arg arg_mode=normal continue ;; normal ) # Accept any command-line options. case $arg in -o) test -n "$libobj" && \ func_fatal_error "you cannot specify '-o' more than once" arg_mode=target continue ;; -pie | -fpie | -fPIE) func_append pie_flag " $arg" continue ;; -shared | -static | -prefer-pic | -prefer-non-pic) func_append later " $arg" continue ;; -no-suppress) suppress_opt=no continue ;; -Xcompiler) arg_mode=arg # the next one goes into the "base_compile" arg list continue # The current "srcfile" will either be retained or ;; # replaced later. I would guess that would be a bug. -Wc,*) func_stripname '-Wc,' '' "$arg" args=$func_stripname_result lastarg= save_ifs=$IFS; IFS=, for arg in $args; do IFS=$save_ifs func_append_quoted lastarg "$arg" done IFS=$save_ifs func_stripname ' ' '' "$lastarg" lastarg=$func_stripname_result # Add the arguments to base_compile. func_append base_compile " $lastarg" continue ;; *) # Accept the current argument as the source file. # The previous "srcfile" becomes the current argument. # lastarg=$srcfile srcfile=$arg ;; esac # case $arg ;; esac # case $arg_mode # Aesthetically quote the previous argument. func_append_quoted base_compile "$lastarg" done # for arg case $arg_mode in arg) func_fatal_error "you must specify an argument for -Xcompile" ;; target) func_fatal_error "you must specify a target with '-o'" ;; *) # Get the name of the library object. test -z "$libobj" && { func_basename "$srcfile" libobj=$func_basename_result } ;; esac # Recognize several different file suffixes. # If the user specifies -o file.o, it is replaced with file.lo case $libobj in *.[cCFSifmso] | \ *.ada | *.adb | *.ads | *.asm | \ *.c++ | *.cc | *.ii | *.class | *.cpp | *.cxx | \ *.[fF][09]? | *.for | *.java | *.go | *.obj | *.sx | *.cu | *.cup) func_xform "$libobj" libobj=$func_xform_result ;; esac case $libobj in *.lo) func_lo2o "$libobj"; obj=$func_lo2o_result ;; *) func_fatal_error "cannot determine name of library object from '$libobj'" ;; esac func_infer_tag $base_compile for arg in $later; do case $arg in -shared) test yes = "$build_libtool_libs" \ || func_fatal_configuration "cannot build a shared library" build_old_libs=no continue ;; -static) build_libtool_libs=no build_old_libs=yes continue ;; -prefer-pic) pic_mode=yes continue ;; -prefer-non-pic) pic_mode=no continue ;; esac done func_quote_for_eval "$libobj" test "X$libobj" != "X$func_quote_for_eval_result" \ && $ECHO "X$libobj" | $GREP '[]~#^*{};<>?"'"'"' &()|`$[]' \ && func_warning "libobj name '$libobj' may not contain shell special characters." func_dirname_and_basename "$obj" "/" "" objname=$func_basename_result xdir=$func_dirname_result lobj=$xdir$objdir/$objname test -z "$base_compile" && \ func_fatal_help "you must specify a compilation command" # Delete any leftover library objects. if test yes = "$build_old_libs"; then removelist="$obj $lobj $libobj ${libobj}T" else removelist="$lobj $libobj ${libobj}T" fi # On Cygwin there's no "real" PIC flag so we must build both object types case $host_os in cygwin* | mingw* | pw32* | os2* | cegcc*) pic_mode=default ;; esac if test no = "$pic_mode" && test pass_all != "$deplibs_check_method"; then # non-PIC code in shared libraries is not supported pic_mode=default fi # Calculate the filename of the output object if compiler does # not support -o with -c if test no = "$compiler_c_o"; then output_obj=`$ECHO "$srcfile" | $SED 's%^.*/%%; s%\.[^.]*$%%'`.$objext lockfile=$output_obj.lock else output_obj= need_locks=no lockfile= fi # Lock this critical section if it is needed # We use this script file to make the link, it avoids creating a new file if test yes = "$need_locks"; then until $opt_dry_run || ln "$progpath" "$lockfile" 2>/dev/null; do func_echo "Waiting for $lockfile to be removed" sleep 2 done elif test warn = "$need_locks"; then if test -f "$lockfile"; then $ECHO "\ *** ERROR, $lockfile exists and contains: `cat $lockfile 2>/dev/null` This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi func_append removelist " $output_obj" $ECHO "$srcfile" > "$lockfile" fi $opt_dry_run || $RM $removelist func_append removelist " $lockfile" trap '$opt_dry_run || $RM $removelist; exit $EXIT_FAILURE' 1 2 15 func_to_tool_file "$srcfile" func_convert_file_msys_to_w32 srcfile=$func_to_tool_file_result func_quote_for_eval "$srcfile" qsrcfile=$func_quote_for_eval_result # Only build a PIC object if we are building libtool libraries. if test yes = "$build_libtool_libs"; then # Without this assignment, base_compile gets emptied. fbsd_hideous_sh_bug=$base_compile if test no != "$pic_mode"; then command="$base_compile $qsrcfile $pic_flag" else # Don't build PIC code command="$base_compile $qsrcfile" fi func_mkdir_p "$xdir$objdir" if test -z "$output_obj"; then # Place PIC objects in $objdir func_append command " -o $lobj" fi func_show_eval_locale "$command" \ 'test -n "$output_obj" && $RM $removelist; exit $EXIT_FAILURE' if test warn = "$need_locks" && test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then $ECHO "\ *** ERROR, $lockfile contains: `cat $lockfile 2>/dev/null` but it should contain: $srcfile This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi # Just move the object if needed, then go on to compile the next one if test -n "$output_obj" && test "X$output_obj" != "X$lobj"; then func_show_eval '$MV "$output_obj" "$lobj"' \ 'error=$?; $opt_dry_run || $RM $removelist; exit $error' fi # Allow error messages only from the first compilation. if test yes = "$suppress_opt"; then suppress_output=' >/dev/null 2>&1' fi fi # Only build a position-dependent object if we build old libraries. if test yes = "$build_old_libs"; then if test yes != "$pic_mode"; then # Don't build PIC code command="$base_compile $qsrcfile$pie_flag" else command="$base_compile $qsrcfile $pic_flag" fi if test yes = "$compiler_c_o"; then func_append command " -o $obj" fi # Suppress compiler output if we already did a PIC compilation. func_append command "$suppress_output" func_show_eval_locale "$command" \ '$opt_dry_run || $RM $removelist; exit $EXIT_FAILURE' if test warn = "$need_locks" && test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then $ECHO "\ *** ERROR, $lockfile contains: `cat $lockfile 2>/dev/null` but it should contain: $srcfile This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi # Just move the object if needed if test -n "$output_obj" && test "X$output_obj" != "X$obj"; then func_show_eval '$MV "$output_obj" "$obj"' \ 'error=$?; $opt_dry_run || $RM $removelist; exit $error' fi fi $opt_dry_run || { func_write_libtool_object "$libobj" "$objdir/$objname" "$objname" # Unlock the critical section if it was locked if test no != "$need_locks"; then removelist=$lockfile $RM "$lockfile" fi } exit $EXIT_SUCCESS } $opt_help || { test compile = "$opt_mode" && func_mode_compile ${1+"$@"} } func_mode_help () { # We need to display help for each of the modes. case $opt_mode in "") # Generic help is extracted from the usage comments # at the start of this file. func_help ;; clean) $ECHO \ "Usage: $progname [OPTION]... --mode=clean RM [RM-OPTION]... FILE... Remove files from the build directory. RM is the name of the program to use to delete files associated with each FILE (typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed to RM. If FILE is a libtool library, object or program, all the files associated with it are deleted. Otherwise, only FILE itself is deleted using RM." ;; compile) $ECHO \ "Usage: $progname [OPTION]... --mode=compile COMPILE-COMMAND... SOURCEFILE Compile a source file into a libtool library object. This mode accepts the following additional options: -o OUTPUT-FILE set the output file name to OUTPUT-FILE -no-suppress do not suppress compiler output for multiple passes -prefer-pic try to build PIC objects only -prefer-non-pic try to build non-PIC objects only -shared do not build a '.o' file suitable for static linking -static only build a '.o' file suitable for static linking -Wc,FLAG pass FLAG directly to the compiler COMPILE-COMMAND is a command to be used in creating a 'standard' object file from the given SOURCEFILE. The output file name is determined by removing the directory component from SOURCEFILE, then substituting the C source code suffix '.c' with the library object suffix, '.lo'." ;; execute) $ECHO \ "Usage: $progname [OPTION]... --mode=execute COMMAND [ARGS]... Automatically set library path, then run a program. This mode accepts the following additional options: -dlopen FILE add the directory containing FILE to the library path This mode sets the library path environment variable according to '-dlopen' flags. If any of the ARGS are libtool executable wrappers, then they are translated into their corresponding uninstalled binary, and any of their required library directories are added to the library path. Then, COMMAND is executed, with ARGS as arguments." ;; finish) $ECHO \ "Usage: $progname [OPTION]... --mode=finish [LIBDIR]... Complete the installation of libtool libraries. Each LIBDIR is a directory that contains libtool libraries. The commands that this mode executes may require superuser privileges. Use the '--dry-run' option if you just want to see what would be executed." ;; install) $ECHO \ "Usage: $progname [OPTION]... --mode=install INSTALL-COMMAND... Install executables or libraries. INSTALL-COMMAND is the installation command. The first component should be either the 'install' or 'cp' program. The following components of INSTALL-COMMAND are treated specially: -inst-prefix-dir PREFIX-DIR Use PREFIX-DIR as a staging area for installation The rest of the components are interpreted as arguments to that command (only BSD-compatible install options are recognized)." ;; link) $ECHO \ "Usage: $progname [OPTION]... --mode=link LINK-COMMAND... Link object files or libraries together to form another library, or to create an executable program. LINK-COMMAND is a command using the C compiler that you would use to create a program from several object files. The following components of LINK-COMMAND are treated specially: -all-static do not do any dynamic linking at all -avoid-version do not add a version suffix if possible -bindir BINDIR specify path to binaries directory (for systems where libraries must be found in the PATH setting at runtime) -dlopen FILE '-dlpreopen' FILE if it cannot be dlopened at runtime -dlpreopen FILE link in FILE and add its symbols to lt_preloaded_symbols -export-dynamic allow symbols from OUTPUT-FILE to be resolved with dlsym(3) -export-symbols SYMFILE try to export only the symbols listed in SYMFILE -export-symbols-regex REGEX try to export only the symbols matching REGEX -LLIBDIR search LIBDIR for required installed libraries -lNAME OUTPUT-FILE requires the installed library libNAME -module build a library that can dlopened -no-fast-install disable the fast-install mode -no-install link a not-installable executable -no-undefined declare that a library does not refer to external symbols -o OUTPUT-FILE create OUTPUT-FILE from the specified objects -objectlist FILE use a list of object files found in FILE to specify objects -os2dllname NAME force a short DLL name on OS/2 (no effect on other OSes) -precious-files-regex REGEX don't remove output files matching REGEX -release RELEASE specify package release information -rpath LIBDIR the created library will eventually be installed in LIBDIR -R[ ]LIBDIR add LIBDIR to the runtime path of programs and libraries -shared only do dynamic linking of libtool libraries -shrext SUFFIX override the standard shared library file extension -static do not do any dynamic linking of uninstalled libtool libraries -static-libtool-libs do not do any dynamic linking of libtool libraries -version-info CURRENT[:REVISION[:AGE]] specify library version info [each variable defaults to 0] -weak LIBNAME declare that the target provides the LIBNAME interface -Wc,FLAG -Xcompiler FLAG pass linker-specific FLAG directly to the compiler -Wl,FLAG -Xlinker FLAG pass linker-specific FLAG directly to the linker -XCClinker FLAG pass link-specific FLAG to the compiler driver (CC) All other options (arguments beginning with '-') are ignored. Every other argument is treated as a filename. Files ending in '.la' are treated as uninstalled libtool libraries, other files are standard or library object files. If the OUTPUT-FILE ends in '.la', then a libtool library is created, only library objects ('.lo' files) may be specified, and '-rpath' is required, except when creating a convenience library. If OUTPUT-FILE ends in '.a' or '.lib', then a standard library is created using 'ar' and 'ranlib', or on Windows using 'lib'. If OUTPUT-FILE ends in '.lo' or '.$objext', then a reloadable object file is created, otherwise an executable program is created." ;; uninstall) $ECHO \ "Usage: $progname [OPTION]... --mode=uninstall RM [RM-OPTION]... FILE... Remove libraries from an installation directory. RM is the name of the program to use to delete files associated with each FILE (typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed to RM. If FILE is a libtool library, all the files associated with it are deleted. Otherwise, only FILE itself is deleted using RM." ;; *) func_fatal_help "invalid operation mode '$opt_mode'" ;; esac echo $ECHO "Try '$progname --help' for more information about other modes." } # Now that we've collected a possible --mode arg, show help if necessary if $opt_help; then if test : = "$opt_help"; then func_mode_help else { func_help noexit for opt_mode in compile link execute install finish uninstall clean; do func_mode_help done } | $SED -n '1p; 2,$s/^Usage:/ or: /p' { func_help noexit for opt_mode in compile link execute install finish uninstall clean; do echo func_mode_help done } | $SED '1d /^When reporting/,/^Report/{ H d } $x /information about other modes/d /more detailed .*MODE/d s/^Usage:.*--mode=\([^ ]*\) .*/Description of \1 mode:/' fi exit $? fi # func_mode_execute arg... func_mode_execute () { $debug_cmd # The first argument is the command name. cmd=$nonopt test -z "$cmd" && \ func_fatal_help "you must specify a COMMAND" # Handle -dlopen flags immediately. for file in $opt_dlopen; do test -f "$file" \ || func_fatal_help "'$file' is not a file" dir= case $file in *.la) func_resolve_sysroot "$file" file=$func_resolve_sysroot_result # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$file" \ || func_fatal_help "'$lib' is not a valid libtool archive" # Read the libtool library. dlname= library_names= func_source "$file" # Skip this library if it cannot be dlopened. if test -z "$dlname"; then # Warn if it was a shared library. test -n "$library_names" && \ func_warning "'$file' was not linked with '-export-dynamic'" continue fi func_dirname "$file" "" "." dir=$func_dirname_result if test -f "$dir/$objdir/$dlname"; then func_append dir "/$objdir" else if test ! -f "$dir/$dlname"; then func_fatal_error "cannot find '$dlname' in '$dir' or '$dir/$objdir'" fi fi ;; *.lo) # Just add the directory containing the .lo file. func_dirname "$file" "" "." dir=$func_dirname_result ;; *) func_warning "'-dlopen' is ignored for non-libtool libraries and objects" continue ;; esac # Get the absolute pathname. absdir=`cd "$dir" && pwd` test -n "$absdir" && dir=$absdir # Now add the directory to shlibpath_var. if eval "test -z \"\$$shlibpath_var\""; then eval "$shlibpath_var=\"\$dir\"" else eval "$shlibpath_var=\"\$dir:\$$shlibpath_var\"" fi done # This variable tells wrapper scripts just to set shlibpath_var # rather than running their programs. libtool_execute_magic=$magic # Check if any of the arguments is a wrapper script. args= for file do case $file in -* | *.la | *.lo ) ;; *) # Do a test to see if this is really a libtool program. if func_ltwrapper_script_p "$file"; then func_source "$file" # Transform arg to wrapped name. file=$progdir/$program elif func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" func_source "$func_ltwrapper_scriptname_result" # Transform arg to wrapped name. file=$progdir/$program fi ;; esac # Quote arguments (to preserve shell metacharacters). func_append_quoted args "$file" done if $opt_dry_run; then # Display what would be done. if test -n "$shlibpath_var"; then eval "\$ECHO \"\$shlibpath_var=\$$shlibpath_var\"" echo "export $shlibpath_var" fi $ECHO "$cmd$args" exit $EXIT_SUCCESS else if test -n "$shlibpath_var"; then # Export the shlibpath_var. eval "export $shlibpath_var" fi # Restore saved environment variables for lt_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES do eval "if test \"\${save_$lt_var+set}\" = set; then $lt_var=\$save_$lt_var; export $lt_var else $lt_unset $lt_var fi" done # Now prepare to actually exec the command. exec_cmd=\$cmd$args fi } test execute = "$opt_mode" && func_mode_execute ${1+"$@"} # func_mode_finish arg... func_mode_finish () { $debug_cmd libs= libdirs= admincmds= for opt in "$nonopt" ${1+"$@"} do if test -d "$opt"; then func_append libdirs " $opt" elif test -f "$opt"; then if func_lalib_unsafe_p "$opt"; then func_append libs " $opt" else func_warning "'$opt' is not a valid libtool archive" fi else func_fatal_error "invalid argument '$opt'" fi done if test -n "$libs"; then if test -n "$lt_sysroot"; then sysroot_regex=`$ECHO "$lt_sysroot" | $SED "$sed_make_literal_regex"` sysroot_cmd="s/\([ ']\)$sysroot_regex/\1/g;" else sysroot_cmd= fi # Remove sysroot references if $opt_dry_run; then for lib in $libs; do echo "removing references to $lt_sysroot and '=' prefixes from $lib" done else tmpdir=`func_mktempdir` for lib in $libs; do $SED -e "$sysroot_cmd s/\([ ']-[LR]\)=/\1/g; s/\([ ']\)=/\1/g" $lib \ > $tmpdir/tmp-la mv -f $tmpdir/tmp-la $lib done ${RM}r "$tmpdir" fi fi if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then for libdir in $libdirs; do if test -n "$finish_cmds"; then # Do each command in the finish commands. func_execute_cmds "$finish_cmds" 'admincmds="$admincmds '"$cmd"'"' fi if test -n "$finish_eval"; then # Do the single finish_eval. eval cmds=\"$finish_eval\" $opt_dry_run || eval "$cmds" || func_append admincmds " $cmds" fi done fi # Exit here if they wanted silent mode. $opt_quiet && exit $EXIT_SUCCESS if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then echo "----------------------------------------------------------------------" echo "Libraries have been installed in:" for libdir in $libdirs; do $ECHO " $libdir" done echo echo "If you ever happen to want to link against installed libraries" echo "in a given directory, LIBDIR, you must either use libtool, and" echo "specify the full pathname of the library, or use the '-LLIBDIR'" echo "flag during linking and do at least one of the following:" if test -n "$shlibpath_var"; then echo " - add LIBDIR to the '$shlibpath_var' environment variable" echo " during execution" fi if test -n "$runpath_var"; then echo " - add LIBDIR to the '$runpath_var' environment variable" echo " during linking" fi if test -n "$hardcode_libdir_flag_spec"; then libdir=LIBDIR eval flag=\"$hardcode_libdir_flag_spec\" $ECHO " - use the '$flag' linker flag" fi if test -n "$admincmds"; then $ECHO " - have your system administrator run these commands:$admincmds" fi if test -f /etc/ld.so.conf; then echo " - have your system administrator add LIBDIR to '/etc/ld.so.conf'" fi echo echo "See any operating system documentation about shared libraries for" case $host in solaris2.[6789]|solaris2.1[0-9]) echo "more information, such as the ld(1), crle(1) and ld.so(8) manual" echo "pages." ;; *) echo "more information, such as the ld(1) and ld.so(8) manual pages." ;; esac echo "----------------------------------------------------------------------" fi exit $EXIT_SUCCESS } test finish = "$opt_mode" && func_mode_finish ${1+"$@"} # func_mode_install arg... func_mode_install () { $debug_cmd # There may be an optional sh(1) argument at the beginning of # install_prog (especially on Windows NT). if test "$SHELL" = "$nonopt" || test /bin/sh = "$nonopt" || # Allow the use of GNU shtool's install command. case $nonopt in *shtool*) :;; *) false;; esac then # Aesthetically quote it. func_quote_for_eval "$nonopt" install_prog="$func_quote_for_eval_result " arg=$1 shift else install_prog= arg=$nonopt fi # The real first argument should be the name of the installation program. # Aesthetically quote it. func_quote_for_eval "$arg" func_append install_prog "$func_quote_for_eval_result" install_shared_prog=$install_prog case " $install_prog " in *[\\\ /]cp\ *) install_cp=: ;; *) install_cp=false ;; esac # We need to accept at least all the BSD install flags. dest= files= opts= prev= install_type= isdir=false stripme= no_mode=: for arg do arg2= if test -n "$dest"; then func_append files " $dest" dest=$arg continue fi case $arg in -d) isdir=: ;; -f) if $install_cp; then :; else prev=$arg fi ;; -g | -m | -o) prev=$arg ;; -s) stripme=" -s" continue ;; -*) ;; *) # If the previous option needed an argument, then skip it. if test -n "$prev"; then if test X-m = "X$prev" && test -n "$install_override_mode"; then arg2=$install_override_mode no_mode=false fi prev= else dest=$arg continue fi ;; esac # Aesthetically quote the argument. func_quote_for_eval "$arg" func_append install_prog " $func_quote_for_eval_result" if test -n "$arg2"; then func_quote_for_eval "$arg2" fi func_append install_shared_prog " $func_quote_for_eval_result" done test -z "$install_prog" && \ func_fatal_help "you must specify an install program" test -n "$prev" && \ func_fatal_help "the '$prev' option requires an argument" if test -n "$install_override_mode" && $no_mode; then if $install_cp; then :; else func_quote_for_eval "$install_override_mode" func_append install_shared_prog " -m $func_quote_for_eval_result" fi fi if test -z "$files"; then if test -z "$dest"; then func_fatal_help "no file or destination specified" else func_fatal_help "you must specify a destination" fi fi # Strip any trailing slash from the destination. func_stripname '' '/' "$dest" dest=$func_stripname_result # Check to see that the destination is a directory. test -d "$dest" && isdir=: if $isdir; then destdir=$dest destname= else func_dirname_and_basename "$dest" "" "." destdir=$func_dirname_result destname=$func_basename_result # Not a directory, so check to see that there is only one file specified. set dummy $files; shift test "$#" -gt 1 && \ func_fatal_help "'$dest' is not a directory" fi case $destdir in [\\/]* | [A-Za-z]:[\\/]*) ;; *) for file in $files; do case $file in *.lo) ;; *) func_fatal_help "'$destdir' must be an absolute directory name" ;; esac done ;; esac # This variable tells wrapper scripts just to set variables rather # than running their programs. libtool_install_magic=$magic staticlibs= future_libdirs= current_libdirs= for file in $files; do # Do each installation. case $file in *.$libext) # Do the static libraries later. func_append staticlibs " $file" ;; *.la) func_resolve_sysroot "$file" file=$func_resolve_sysroot_result # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$file" \ || func_fatal_help "'$file' is not a valid libtool archive" library_names= old_library= relink_command= func_source "$file" # Add the libdir to current_libdirs if it is the destination. if test "X$destdir" = "X$libdir"; then case "$current_libdirs " in *" $libdir "*) ;; *) func_append current_libdirs " $libdir" ;; esac else # Note the libdir as a future libdir. case "$future_libdirs " in *" $libdir "*) ;; *) func_append future_libdirs " $libdir" ;; esac fi func_dirname "$file" "/" "" dir=$func_dirname_result func_append dir "$objdir" if test -n "$relink_command"; then # Determine the prefix the user has applied to our future dir. inst_prefix_dir=`$ECHO "$destdir" | $SED -e "s%$libdir\$%%"` # Don't allow the user to place us outside of our expected # location b/c this prevents finding dependent libraries that # are installed to the same prefix. # At present, this check doesn't affect windows .dll's that # are installed into $libdir/../bin (currently, that works fine) # but it's something to keep an eye on. test "$inst_prefix_dir" = "$destdir" && \ func_fatal_error "error: cannot install '$file' to a directory not ending in $libdir" if test -n "$inst_prefix_dir"; then # Stick the inst_prefix_dir data into the link command. relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%-inst-prefix-dir $inst_prefix_dir%"` else relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%%"` fi func_warning "relinking '$file'" func_show_eval "$relink_command" \ 'func_fatal_error "error: relink '\''$file'\'' with the above command before installing it"' fi # See the names of the shared library. set dummy $library_names; shift if test -n "$1"; then realname=$1 shift srcname=$realname test -n "$relink_command" && srcname=${realname}T # Install the shared library and build the symlinks. func_show_eval "$install_shared_prog $dir/$srcname $destdir/$realname" \ 'exit $?' tstripme=$stripme case $host_os in cygwin* | mingw* | pw32* | cegcc*) case $realname in *.dll.a) tstripme= ;; esac ;; os2*) case $realname in *_dll.a) tstripme= ;; esac ;; esac if test -n "$tstripme" && test -n "$striplib"; then func_show_eval "$striplib $destdir/$realname" 'exit $?' fi if test "$#" -gt 0; then # Delete the old symlinks, and create new ones. # Try 'ln -sf' first, because the 'ln' binary might depend on # the symlink we replace! Solaris /bin/ln does not understand -f, # so we also need to try rm && ln -s. for linkname do test "$linkname" != "$realname" \ && func_show_eval "(cd $destdir && { $LN_S -f $realname $linkname || { $RM $linkname && $LN_S $realname $linkname; }; })" done fi # Do each command in the postinstall commands. lib=$destdir/$realname func_execute_cmds "$postinstall_cmds" 'exit $?' fi # Install the pseudo-library for information purposes. func_basename "$file" name=$func_basename_result instname=$dir/${name}i func_show_eval "$install_prog $instname $destdir/$name" 'exit $?' # Maybe install the static library, too. test -n "$old_library" && func_append staticlibs " $dir/$old_library" ;; *.lo) # Install (i.e. copy) a libtool object. # Figure out destination file name, if it wasn't already specified. if test -n "$destname"; then destfile=$destdir/$destname else func_basename "$file" destfile=$func_basename_result destfile=$destdir/$destfile fi # Deduce the name of the destination old-style object file. case $destfile in *.lo) func_lo2o "$destfile" staticdest=$func_lo2o_result ;; *.$objext) staticdest=$destfile destfile= ;; *) func_fatal_help "cannot copy a libtool object to '$destfile'" ;; esac # Install the libtool object if requested. test -n "$destfile" && \ func_show_eval "$install_prog $file $destfile" 'exit $?' # Install the old object if enabled. if test yes = "$build_old_libs"; then # Deduce the name of the old-style object file. func_lo2o "$file" staticobj=$func_lo2o_result func_show_eval "$install_prog \$staticobj \$staticdest" 'exit $?' fi exit $EXIT_SUCCESS ;; *) # Figure out destination file name, if it wasn't already specified. if test -n "$destname"; then destfile=$destdir/$destname else func_basename "$file" destfile=$func_basename_result destfile=$destdir/$destfile fi # If the file is missing, and there is a .exe on the end, strip it # because it is most likely a libtool script we actually want to # install stripped_ext= case $file in *.exe) if test ! -f "$file"; then func_stripname '' '.exe' "$file" file=$func_stripname_result stripped_ext=.exe fi ;; esac # Do a test to see if this is really a libtool program. case $host in *cygwin* | *mingw*) if func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" wrapper=$func_ltwrapper_scriptname_result else func_stripname '' '.exe' "$file" wrapper=$func_stripname_result fi ;; *) wrapper=$file ;; esac if func_ltwrapper_script_p "$wrapper"; then notinst_deplibs= relink_command= func_source "$wrapper" # Check the variables that should have been set. test -z "$generated_by_libtool_version" && \ func_fatal_error "invalid libtool wrapper script '$wrapper'" finalize=: for lib in $notinst_deplibs; do # Check to see that each library is installed. libdir= if test -f "$lib"; then func_source "$lib" fi libfile=$libdir/`$ECHO "$lib" | $SED 's%^.*/%%g'` if test -n "$libdir" && test ! -f "$libfile"; then func_warning "'$lib' has not been installed in '$libdir'" finalize=false fi done relink_command= func_source "$wrapper" outputname= if test no = "$fast_install" && test -n "$relink_command"; then $opt_dry_run || { if $finalize; then tmpdir=`func_mktempdir` func_basename "$file$stripped_ext" file=$func_basename_result outputname=$tmpdir/$file # Replace the output file specification. relink_command=`$ECHO "$relink_command" | $SED 's%@OUTPUT@%'"$outputname"'%g'` $opt_quiet || { func_quote_for_expand "$relink_command" eval "func_echo $func_quote_for_expand_result" } if eval "$relink_command"; then : else func_error "error: relink '$file' with the above command before installing it" $opt_dry_run || ${RM}r "$tmpdir" continue fi file=$outputname else func_warning "cannot relink '$file'" fi } else # Install the binary that we compiled earlier. file=`$ECHO "$file$stripped_ext" | $SED "s%\([^/]*\)$%$objdir/\1%"` fi fi # remove .exe since cygwin /usr/bin/install will append another # one anyway case $install_prog,$host in */usr/bin/install*,*cygwin*) case $file:$destfile in *.exe:*.exe) # this is ok ;; *.exe:*) destfile=$destfile.exe ;; *:*.exe) func_stripname '' '.exe' "$destfile" destfile=$func_stripname_result ;; esac ;; esac func_show_eval "$install_prog\$stripme \$file \$destfile" 'exit $?' $opt_dry_run || if test -n "$outputname"; then ${RM}r "$tmpdir" fi ;; esac done for file in $staticlibs; do func_basename "$file" name=$func_basename_result # Set up the ranlib parameters. oldlib=$destdir/$name func_to_tool_file "$oldlib" func_convert_file_msys_to_w32 tool_oldlib=$func_to_tool_file_result func_show_eval "$install_prog \$file \$oldlib" 'exit $?' if test -n "$stripme" && test -n "$old_striplib"; then func_show_eval "$old_striplib $tool_oldlib" 'exit $?' fi # Do each command in the postinstall commands. func_execute_cmds "$old_postinstall_cmds" 'exit $?' done test -n "$future_libdirs" && \ func_warning "remember to run '$progname --finish$future_libdirs'" if test -n "$current_libdirs"; then # Maybe just do a dry run. $opt_dry_run && current_libdirs=" -n$current_libdirs" exec_cmd='$SHELL "$progpath" $preserve_args --finish$current_libdirs' else exit $EXIT_SUCCESS fi } test install = "$opt_mode" && func_mode_install ${1+"$@"} # func_generate_dlsyms outputname originator pic_p # Extract symbols from dlprefiles and create ${outputname}S.o with # a dlpreopen symbol table. func_generate_dlsyms () { $debug_cmd my_outputname=$1 my_originator=$2 my_pic_p=${3-false} my_prefix=`$ECHO "$my_originator" | $SED 's%[^a-zA-Z0-9]%_%g'` my_dlsyms= if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then if test -n "$NM" && test -n "$global_symbol_pipe"; then my_dlsyms=${my_outputname}S.c else func_error "not configured to extract global symbols from dlpreopened files" fi fi if test -n "$my_dlsyms"; then case $my_dlsyms in "") ;; *.c) # Discover the nlist of each of the dlfiles. nlist=$output_objdir/$my_outputname.nm func_show_eval "$RM $nlist ${nlist}S ${nlist}T" # Parse the name list into a source file. func_verbose "creating $output_objdir/$my_dlsyms" $opt_dry_run || $ECHO > "$output_objdir/$my_dlsyms" "\ /* $my_dlsyms - symbol resolution table for '$my_outputname' dlsym emulation. */ /* Generated by $PROGRAM (GNU $PACKAGE) $VERSION */ #ifdef __cplusplus extern \"C\" { #endif #if defined __GNUC__ && (((__GNUC__ == 4) && (__GNUC_MINOR__ >= 4)) || (__GNUC__ > 4)) #pragma GCC diagnostic ignored \"-Wstrict-prototypes\" #endif /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT_DLSYM_CONST #else # define LT_DLSYM_CONST const #endif #define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0) /* External symbol declarations for the compiler. */\ " if test yes = "$dlself"; then func_verbose "generating symbol list for '$output'" $opt_dry_run || echo ': @PROGRAM@ ' > "$nlist" # Add our own program objects to the symbol list. progfiles=`$ECHO "$objs$old_deplibs" | $SP2NL | $SED "$lo2o" | $NL2SP` for progfile in $progfiles; do func_to_tool_file "$progfile" func_convert_file_msys_to_w32 func_verbose "extracting global C symbols from '$func_to_tool_file_result'" $opt_dry_run || eval "$NM $func_to_tool_file_result | $global_symbol_pipe >> '$nlist'" done if test -n "$exclude_expsyms"; then $opt_dry_run || { eval '$EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' } fi if test -n "$export_symbols_regex"; then $opt_dry_run || { eval '$EGREP -e "$export_symbols_regex" "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' } fi # Prepare the list of exported symbols if test -z "$export_symbols"; then export_symbols=$output_objdir/$outputname.exp $opt_dry_run || { $RM $export_symbols eval "$SED -n -e '/^: @PROGRAM@ $/d' -e 's/^.* \(.*\)$/\1/p' "'< "$nlist" > "$export_symbols"' case $host in *cygwin* | *mingw* | *cegcc* ) eval "echo EXPORTS "'> "$output_objdir/$outputname.def"' eval 'cat "$export_symbols" >> "$output_objdir/$outputname.def"' ;; esac } else $opt_dry_run || { eval "$SED -e 's/\([].[*^$]\)/\\\\\1/g' -e 's/^/ /' -e 's/$/$/'"' < "$export_symbols" > "$output_objdir/$outputname.exp"' eval '$GREP -f "$output_objdir/$outputname.exp" < "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' case $host in *cygwin* | *mingw* | *cegcc* ) eval "echo EXPORTS "'> "$output_objdir/$outputname.def"' eval 'cat "$nlist" >> "$output_objdir/$outputname.def"' ;; esac } fi fi for dlprefile in $dlprefiles; do func_verbose "extracting global C symbols from '$dlprefile'" func_basename "$dlprefile" name=$func_basename_result case $host in *cygwin* | *mingw* | *cegcc* ) # if an import library, we need to obtain dlname if func_win32_import_lib_p "$dlprefile"; then func_tr_sh "$dlprefile" eval "curr_lafile=\$libfile_$func_tr_sh_result" dlprefile_dlbasename= if test -n "$curr_lafile" && func_lalib_p "$curr_lafile"; then # Use subshell, to avoid clobbering current variable values dlprefile_dlname=`source "$curr_lafile" && echo "$dlname"` if test -n "$dlprefile_dlname"; then func_basename "$dlprefile_dlname" dlprefile_dlbasename=$func_basename_result else # no lafile. user explicitly requested -dlpreopen . $sharedlib_from_linklib_cmd "$dlprefile" dlprefile_dlbasename=$sharedlib_from_linklib_result fi fi $opt_dry_run || { if test -n "$dlprefile_dlbasename"; then eval '$ECHO ": $dlprefile_dlbasename" >> "$nlist"' else func_warning "Could not compute DLL name from $name" eval '$ECHO ": $name " >> "$nlist"' fi func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe | $SED -e '/I __imp/d' -e 's/I __nm_/D /;s/_nm__//' >> '$nlist'" } else # not an import lib $opt_dry_run || { eval '$ECHO ": $name " >> "$nlist"' func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe >> '$nlist'" } fi ;; *) $opt_dry_run || { eval '$ECHO ": $name " >> "$nlist"' func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe >> '$nlist'" } ;; esac done $opt_dry_run || { # Make sure we have at least an empty file. test -f "$nlist" || : > "$nlist" if test -n "$exclude_expsyms"; then $EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T $MV "$nlist"T "$nlist" fi # Try sorting and uniquifying the output. if $GREP -v "^: " < "$nlist" | if sort -k 3 /dev/null 2>&1; then sort -k 3 else sort +2 fi | uniq > "$nlist"S; then : else $GREP -v "^: " < "$nlist" > "$nlist"S fi if test -f "$nlist"S; then eval "$global_symbol_to_cdecl"' < "$nlist"S >> "$output_objdir/$my_dlsyms"' else echo '/* NONE */' >> "$output_objdir/$my_dlsyms" fi func_show_eval '$RM "${nlist}I"' if test -n "$global_symbol_to_import"; then eval "$global_symbol_to_import"' < "$nlist"S > "$nlist"I' fi echo >> "$output_objdir/$my_dlsyms" "\ /* The mapping between symbol names and symbols. */ typedef struct { const char *name; void *address; } lt_dlsymlist; extern LT_DLSYM_CONST lt_dlsymlist lt_${my_prefix}_LTX_preloaded_symbols[];\ " if test -s "$nlist"I; then echo >> "$output_objdir/$my_dlsyms" "\ static void lt_syminit(void) { LT_DLSYM_CONST lt_dlsymlist *symbol = lt_${my_prefix}_LTX_preloaded_symbols; for (; symbol->name; ++symbol) {" $SED 's/.*/ if (STREQ (symbol->name, \"&\")) symbol->address = (void *) \&&;/' < "$nlist"I >> "$output_objdir/$my_dlsyms" echo >> "$output_objdir/$my_dlsyms" "\ } }" fi echo >> "$output_objdir/$my_dlsyms" "\ LT_DLSYM_CONST lt_dlsymlist lt_${my_prefix}_LTX_preloaded_symbols[] = { {\"$my_originator\", (void *) 0}," if test -s "$nlist"I; then echo >> "$output_objdir/$my_dlsyms" "\ {\"@INIT@\", (void *) <_syminit}," fi case $need_lib_prefix in no) eval "$global_symbol_to_c_name_address" < "$nlist" >> "$output_objdir/$my_dlsyms" ;; *) eval "$global_symbol_to_c_name_address_lib_prefix" < "$nlist" >> "$output_objdir/$my_dlsyms" ;; esac echo >> "$output_objdir/$my_dlsyms" "\ {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt_${my_prefix}_LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif\ " } # !$opt_dry_run pic_flag_for_symtable= case "$compile_command " in *" -static "*) ;; *) case $host in # compiling the symbol table file with pic_flag works around # a FreeBSD bug that causes programs to crash when -lm is # linked before any other PIC object. But we must not use # pic_flag when linking with -static. The problem exists in # FreeBSD 2.2.6 and is fixed in FreeBSD 3.1. *-*-freebsd2.*|*-*-freebsd3.0*|*-*-freebsdelf3.0*) pic_flag_for_symtable=" $pic_flag -DFREEBSD_WORKAROUND" ;; *-*-hpux*) pic_flag_for_symtable=" $pic_flag" ;; *) $my_pic_p && pic_flag_for_symtable=" $pic_flag" ;; esac ;; esac symtab_cflags= for arg in $LTCFLAGS; do case $arg in -pie | -fpie | -fPIE) ;; *) func_append symtab_cflags " $arg" ;; esac done # Now compile the dynamic symbol file. func_show_eval '(cd $output_objdir && $LTCC$symtab_cflags -c$no_builtin_flag$pic_flag_for_symtable "$my_dlsyms")' 'exit $?' # Clean up the generated files. func_show_eval '$RM "$output_objdir/$my_dlsyms" "$nlist" "${nlist}S" "${nlist}T" "${nlist}I"' # Transform the symbol file into the correct name. symfileobj=$output_objdir/${my_outputname}S.$objext case $host in *cygwin* | *mingw* | *cegcc* ) if test -f "$output_objdir/$my_outputname.def"; then compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"` else compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$symfileobj%"` fi ;; *) compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$symfileobj%"` ;; esac ;; *) func_fatal_error "unknown suffix for '$my_dlsyms'" ;; esac else # We keep going just in case the user didn't refer to # lt_preloaded_symbols. The linker will fail if global_symbol_pipe # really was required. # Nullify the symbol file. compile_command=`$ECHO "$compile_command" | $SED "s% @SYMFILE@%%"` finalize_command=`$ECHO "$finalize_command" | $SED "s% @SYMFILE@%%"` fi } # func_cygming_gnu_implib_p ARG # This predicate returns with zero status (TRUE) if # ARG is a GNU/binutils-style import library. Returns # with nonzero status (FALSE) otherwise. func_cygming_gnu_implib_p () { $debug_cmd func_to_tool_file "$1" func_convert_file_msys_to_w32 func_cygming_gnu_implib_tmp=`$NM "$func_to_tool_file_result" | eval "$global_symbol_pipe" | $EGREP ' (_head_[A-Za-z0-9_]+_[ad]l*|[A-Za-z0-9_]+_[ad]l*_iname)$'` test -n "$func_cygming_gnu_implib_tmp" } # func_cygming_ms_implib_p ARG # This predicate returns with zero status (TRUE) if # ARG is an MS-style import library. Returns # with nonzero status (FALSE) otherwise. func_cygming_ms_implib_p () { $debug_cmd func_to_tool_file "$1" func_convert_file_msys_to_w32 func_cygming_ms_implib_tmp=`$NM "$func_to_tool_file_result" | eval "$global_symbol_pipe" | $GREP '_NULL_IMPORT_DESCRIPTOR'` test -n "$func_cygming_ms_implib_tmp" } # func_win32_libid arg # return the library type of file 'arg' # # Need a lot of goo to handle *both* DLLs and import libs # Has to be a shell function in order to 'eat' the argument # that is supplied when $file_magic_command is called. # Despite the name, also deal with 64 bit binaries. func_win32_libid () { $debug_cmd win32_libid_type=unknown win32_fileres=`file -L $1 2>/dev/null` case $win32_fileres in *ar\ archive\ import\ library*) # definitely import win32_libid_type="x86 archive import" ;; *ar\ archive*) # could be an import, or static # Keep the egrep pattern in sync with the one in _LT_CHECK_MAGIC_METHOD. if eval $OBJDUMP -f $1 | $SED -e '10q' 2>/dev/null | $EGREP 'file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' >/dev/null; then case $nm_interface in "MS dumpbin") if func_cygming_ms_implib_p "$1" || func_cygming_gnu_implib_p "$1" then win32_nmres=import else win32_nmres= fi ;; *) func_to_tool_file "$1" func_convert_file_msys_to_w32 win32_nmres=`eval $NM -f posix -A \"$func_to_tool_file_result\" | $SED -n -e ' 1,100{ / I /{ s|.*|import| p q } }'` ;; esac case $win32_nmres in import*) win32_libid_type="x86 archive import";; *) win32_libid_type="x86 archive static";; esac fi ;; *DLL*) win32_libid_type="x86 DLL" ;; *executable*) # but shell scripts are "executable" too... case $win32_fileres in *MS\ Windows\ PE\ Intel*) win32_libid_type="x86 DLL" ;; esac ;; esac $ECHO "$win32_libid_type" } # func_cygming_dll_for_implib ARG # # Platform-specific function to extract the # name of the DLL associated with the specified # import library ARG. # Invoked by eval'ing the libtool variable # $sharedlib_from_linklib_cmd # Result is available in the variable # $sharedlib_from_linklib_result func_cygming_dll_for_implib () { $debug_cmd sharedlib_from_linklib_result=`$DLLTOOL --identify-strict --identify "$1"` } # func_cygming_dll_for_implib_fallback_core SECTION_NAME LIBNAMEs # # The is the core of a fallback implementation of a # platform-specific function to extract the name of the # DLL associated with the specified import library LIBNAME. # # SECTION_NAME is either .idata$6 or .idata$7, depending # on the platform and compiler that created the implib. # # Echos the name of the DLL associated with the # specified import library. func_cygming_dll_for_implib_fallback_core () { $debug_cmd match_literal=`$ECHO "$1" | $SED "$sed_make_literal_regex"` $OBJDUMP -s --section "$1" "$2" 2>/dev/null | $SED '/^Contents of section '"$match_literal"':/{ # Place marker at beginning of archive member dllname section s/.*/====MARK====/ p d } # These lines can sometimes be longer than 43 characters, but # are always uninteresting /:[ ]*file format pe[i]\{,1\}-/d /^In archive [^:]*:/d # Ensure marker is printed /^====MARK====/p # Remove all lines with less than 43 characters /^.\{43\}/!d # From remaining lines, remove first 43 characters s/^.\{43\}//' | $SED -n ' # Join marker and all lines until next marker into a single line /^====MARK====/ b para H $ b para b :para x s/\n//g # Remove the marker s/^====MARK====// # Remove trailing dots and whitespace s/[\. \t]*$// # Print /./p' | # we now have a list, one entry per line, of the stringified # contents of the appropriate section of all members of the # archive that possess that section. Heuristic: eliminate # all those that have a first or second character that is # a '.' (that is, objdump's representation of an unprintable # character.) This should work for all archives with less than # 0x302f exports -- but will fail for DLLs whose name actually # begins with a literal '.' or a single character followed by # a '.'. # # Of those that remain, print the first one. $SED -e '/^\./d;/^.\./d;q' } # func_cygming_dll_for_implib_fallback ARG # Platform-specific function to extract the # name of the DLL associated with the specified # import library ARG. # # This fallback implementation is for use when $DLLTOOL # does not support the --identify-strict option. # Invoked by eval'ing the libtool variable # $sharedlib_from_linklib_cmd # Result is available in the variable # $sharedlib_from_linklib_result func_cygming_dll_for_implib_fallback () { $debug_cmd if func_cygming_gnu_implib_p "$1"; then # binutils import library sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$7' "$1"` elif func_cygming_ms_implib_p "$1"; then # ms-generated import library sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$6' "$1"` else # unknown sharedlib_from_linklib_result= fi } # func_extract_an_archive dir oldlib func_extract_an_archive () { $debug_cmd f_ex_an_ar_dir=$1; shift f_ex_an_ar_oldlib=$1 if test yes = "$lock_old_archive_extraction"; then lockfile=$f_ex_an_ar_oldlib.lock until $opt_dry_run || ln "$progpath" "$lockfile" 2>/dev/null; do func_echo "Waiting for $lockfile to be removed" sleep 2 done fi func_show_eval "(cd \$f_ex_an_ar_dir && $AR x \"\$f_ex_an_ar_oldlib\")" \ 'stat=$?; rm -f "$lockfile"; exit $stat' if test yes = "$lock_old_archive_extraction"; then $opt_dry_run || rm -f "$lockfile" fi if ($AR t "$f_ex_an_ar_oldlib" | sort | sort -uc >/dev/null 2>&1); then : else func_fatal_error "object name conflicts in archive: $f_ex_an_ar_dir/$f_ex_an_ar_oldlib" fi } # func_extract_archives gentop oldlib ... func_extract_archives () { $debug_cmd my_gentop=$1; shift my_oldlibs=${1+"$@"} my_oldobjs= my_xlib= my_xabs= my_xdir= for my_xlib in $my_oldlibs; do # Extract the objects. case $my_xlib in [\\/]* | [A-Za-z]:[\\/]*) my_xabs=$my_xlib ;; *) my_xabs=`pwd`"/$my_xlib" ;; esac func_basename "$my_xlib" my_xlib=$func_basename_result my_xlib_u=$my_xlib while :; do case " $extracted_archives " in *" $my_xlib_u "*) func_arith $extracted_serial + 1 extracted_serial=$func_arith_result my_xlib_u=lt$extracted_serial-$my_xlib ;; *) break ;; esac done extracted_archives="$extracted_archives $my_xlib_u" my_xdir=$my_gentop/$my_xlib_u func_mkdir_p "$my_xdir" case $host in *-darwin*) func_verbose "Extracting $my_xabs" # Do not bother doing anything if just a dry run $opt_dry_run || { darwin_orig_dir=`pwd` cd $my_xdir || exit $? darwin_archive=$my_xabs darwin_curdir=`pwd` func_basename "$darwin_archive" darwin_base_archive=$func_basename_result darwin_arches=`$LIPO -info "$darwin_archive" 2>/dev/null | $GREP Architectures 2>/dev/null || true` if test -n "$darwin_arches"; then darwin_arches=`$ECHO "$darwin_arches" | $SED -e 's/.*are://'` darwin_arch= func_verbose "$darwin_base_archive has multiple architectures $darwin_arches" for darwin_arch in $darwin_arches; do func_mkdir_p "unfat-$$/$darwin_base_archive-$darwin_arch" $LIPO -thin $darwin_arch -output "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive" "$darwin_archive" cd "unfat-$$/$darwin_base_archive-$darwin_arch" func_extract_an_archive "`pwd`" "$darwin_base_archive" cd "$darwin_curdir" $RM "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive" done # $darwin_arches ## Okay now we've a bunch of thin objects, gotta fatten them up :) darwin_filelist=`find unfat-$$ -type f -name \*.o -print -o -name \*.lo -print | $SED -e "$sed_basename" | sort -u` darwin_file= darwin_files= for darwin_file in $darwin_filelist; do darwin_files=`find unfat-$$ -name $darwin_file -print | sort | $NL2SP` $LIPO -create -output "$darwin_file" $darwin_files done # $darwin_filelist $RM -rf unfat-$$ cd "$darwin_orig_dir" else cd $darwin_orig_dir func_extract_an_archive "$my_xdir" "$my_xabs" fi # $darwin_arches } # !$opt_dry_run ;; *) func_extract_an_archive "$my_xdir" "$my_xabs" ;; esac my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | sort | $NL2SP` done func_extract_archives_result=$my_oldobjs } # func_emit_wrapper [arg=no] # # Emit a libtool wrapper script on stdout. # Don't directly open a file because we may want to # incorporate the script contents within a cygwin/mingw # wrapper executable. Must ONLY be called from within # func_mode_link because it depends on a number of variables # set therein. # # ARG is the value that the WRAPPER_SCRIPT_BELONGS_IN_OBJDIR # variable will take. If 'yes', then the emitted script # will assume that the directory where it is stored is # the $objdir directory. This is a cygwin/mingw-specific # behavior. func_emit_wrapper () { func_emit_wrapper_arg1=${1-no} $ECHO "\ #! $SHELL # $output - temporary wrapper script for $objdir/$outputname # Generated by $PROGRAM (GNU $PACKAGE) $VERSION # # The $output program cannot be directly executed until all the libtool # libraries that it depends on are installed. # # This wrapper script should never be moved out of the build directory. # If it is, it will not operate correctly. # Sed substitution that helps us do robust quoting. It backslashifies # metacharacters that are still active within double-quoted strings. sed_quote_subst='$sed_quote_subst' # Be Bourne compatible if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Zsh 3.x and 4.x performs word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in *posix*) set -o posix;; esac fi BIN_SH=xpg4; export BIN_SH # for Tru64 DUALCASE=1; export DUALCASE # for MKS sh # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH relink_command=\"$relink_command\" # This environment variable determines our operation mode. if test \"\$libtool_install_magic\" = \"$magic\"; then # install mode needs the following variables: generated_by_libtool_version='$macro_version' notinst_deplibs='$notinst_deplibs' else # When we are sourced in execute mode, \$file and \$ECHO are already set. if test \"\$libtool_execute_magic\" != \"$magic\"; then file=\"\$0\"" qECHO=`$ECHO "$ECHO" | $SED "$sed_quote_subst"` $ECHO "\ # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$1 _LTECHO_EOF' } ECHO=\"$qECHO\" fi # Very basic option parsing. These options are (a) specific to # the libtool wrapper, (b) are identical between the wrapper # /script/ and the wrapper /executable/ that is used only on # windows platforms, and (c) all begin with the string "--lt-" # (application programs are unlikely to have options that match # this pattern). # # There are only two supported options: --lt-debug and # --lt-dump-script. There is, deliberately, no --lt-help. # # The first argument to this parsing function should be the # script's $0 value, followed by "$@". lt_option_debug= func_parse_lt_options () { lt_script_arg0=\$0 shift for lt_opt do case \"\$lt_opt\" in --lt-debug) lt_option_debug=1 ;; --lt-dump-script) lt_dump_D=\`\$ECHO \"X\$lt_script_arg0\" | $SED -e 's/^X//' -e 's%/[^/]*$%%'\` test \"X\$lt_dump_D\" = \"X\$lt_script_arg0\" && lt_dump_D=. lt_dump_F=\`\$ECHO \"X\$lt_script_arg0\" | $SED -e 's/^X//' -e 's%^.*/%%'\` cat \"\$lt_dump_D/\$lt_dump_F\" exit 0 ;; --lt-*) \$ECHO \"Unrecognized --lt- option: '\$lt_opt'\" 1>&2 exit 1 ;; esac done # Print the debug banner immediately: if test -n \"\$lt_option_debug\"; then echo \"$outputname:$output:\$LINENO: libtool wrapper (GNU $PACKAGE) $VERSION\" 1>&2 fi } # Used when --lt-debug. Prints its arguments to stdout # (redirection is the responsibility of the caller) func_lt_dump_args () { lt_dump_args_N=1; for lt_arg do \$ECHO \"$outputname:$output:\$LINENO: newargv[\$lt_dump_args_N]: \$lt_arg\" lt_dump_args_N=\`expr \$lt_dump_args_N + 1\` done } # Core function for launching the target application func_exec_program_core () { " case $host in # Backslashes separate directories on plain windows *-*-mingw | *-*-os2* | *-cegcc*) $ECHO "\ if test -n \"\$lt_option_debug\"; then \$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir\\\\\$program\" 1>&2 func_lt_dump_args \${1+\"\$@\"} 1>&2 fi exec \"\$progdir\\\\\$program\" \${1+\"\$@\"} " ;; *) $ECHO "\ if test -n \"\$lt_option_debug\"; then \$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir/\$program\" 1>&2 func_lt_dump_args \${1+\"\$@\"} 1>&2 fi exec \"\$progdir/\$program\" \${1+\"\$@\"} " ;; esac $ECHO "\ \$ECHO \"\$0: cannot exec \$program \$*\" 1>&2 exit 1 } # A function to encapsulate launching the target application # Strips options in the --lt-* namespace from \$@ and # launches target application with the remaining arguments. func_exec_program () { case \" \$* \" in *\\ --lt-*) for lt_wr_arg do case \$lt_wr_arg in --lt-*) ;; *) set x \"\$@\" \"\$lt_wr_arg\"; shift;; esac shift done ;; esac func_exec_program_core \${1+\"\$@\"} } # Parse options func_parse_lt_options \"\$0\" \${1+\"\$@\"} # Find the directory that this script lives in. thisdir=\`\$ECHO \"\$file\" | $SED 's%/[^/]*$%%'\` test \"x\$thisdir\" = \"x\$file\" && thisdir=. # Follow symbolic links until we get to the real thisdir. file=\`ls -ld \"\$file\" | $SED -n 's/.*-> //p'\` while test -n \"\$file\"; do destdir=\`\$ECHO \"\$file\" | $SED 's%/[^/]*\$%%'\` # If there was a directory component, then change thisdir. if test \"x\$destdir\" != \"x\$file\"; then case \"\$destdir\" in [\\\\/]* | [A-Za-z]:[\\\\/]*) thisdir=\"\$destdir\" ;; *) thisdir=\"\$thisdir/\$destdir\" ;; esac fi file=\`\$ECHO \"\$file\" | $SED 's%^.*/%%'\` file=\`ls -ld \"\$thisdir/\$file\" | $SED -n 's/.*-> //p'\` done # Usually 'no', except on cygwin/mingw when embedded into # the cwrapper. WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=$func_emit_wrapper_arg1 if test \"\$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR\" = \"yes\"; then # special case for '.' if test \"\$thisdir\" = \".\"; then thisdir=\`pwd\` fi # remove .libs from thisdir case \"\$thisdir\" in *[\\\\/]$objdir ) thisdir=\`\$ECHO \"\$thisdir\" | $SED 's%[\\\\/][^\\\\/]*$%%'\` ;; $objdir ) thisdir=. ;; esac fi # Try to get the absolute directory name. absdir=\`cd \"\$thisdir\" && pwd\` test -n \"\$absdir\" && thisdir=\"\$absdir\" " if test yes = "$fast_install"; then $ECHO "\ program=lt-'$outputname'$exeext progdir=\"\$thisdir/$objdir\" if test ! -f \"\$progdir/\$program\" || { file=\`ls -1dt \"\$progdir/\$program\" \"\$progdir/../\$program\" 2>/dev/null | $SED 1q\`; \\ test \"X\$file\" != \"X\$progdir/\$program\"; }; then file=\"\$\$-\$program\" if test ! -d \"\$progdir\"; then $MKDIR \"\$progdir\" else $RM \"\$progdir/\$file\" fi" $ECHO "\ # relink executable if necessary if test -n \"\$relink_command\"; then if relink_command_output=\`eval \$relink_command 2>&1\`; then : else \$ECHO \"\$relink_command_output\" >&2 $RM \"\$progdir/\$file\" exit 1 fi fi $MV \"\$progdir/\$file\" \"\$progdir/\$program\" 2>/dev/null || { $RM \"\$progdir/\$program\"; $MV \"\$progdir/\$file\" \"\$progdir/\$program\"; } $RM \"\$progdir/\$file\" fi" else $ECHO "\ program='$outputname' progdir=\"\$thisdir/$objdir\" " fi $ECHO "\ if test -f \"\$progdir/\$program\"; then" # fixup the dll searchpath if we need to. # # Fix the DLL searchpath if we need to. Do this before prepending # to shlibpath, because on Windows, both are PATH and uninstalled # libraries must come first. if test -n "$dllsearchpath"; then $ECHO "\ # Add the dll search path components to the executable PATH PATH=$dllsearchpath:\$PATH " fi # Export our shlibpath_var if we have one. if test yes = "$shlibpath_overrides_runpath" && test -n "$shlibpath_var" && test -n "$temp_rpath"; then $ECHO "\ # Add our own library path to $shlibpath_var $shlibpath_var=\"$temp_rpath\$$shlibpath_var\" # Some systems cannot cope with colon-terminated $shlibpath_var # The second colon is a workaround for a bug in BeOS R4 sed $shlibpath_var=\`\$ECHO \"\$$shlibpath_var\" | $SED 's/::*\$//'\` export $shlibpath_var " fi $ECHO "\ if test \"\$libtool_execute_magic\" != \"$magic\"; then # Run the actual program with our arguments. func_exec_program \${1+\"\$@\"} fi else # The program doesn't exist. \$ECHO \"\$0: error: '\$progdir/\$program' does not exist\" 1>&2 \$ECHO \"This script is just a wrapper for \$program.\" 1>&2 \$ECHO \"See the $PACKAGE documentation for more information.\" 1>&2 exit 1 fi fi\ " } # func_emit_cwrapperexe_src # emit the source code for a wrapper executable on stdout # Must ONLY be called from within func_mode_link because # it depends on a number of variable set therein. func_emit_cwrapperexe_src () { cat < #include #ifdef _MSC_VER # include # include # include #else # include # include # ifdef __CYGWIN__ # include # endif #endif #include #include #include #include #include #include #include #include #define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0) /* declarations of non-ANSI functions */ #if defined __MINGW32__ # ifdef __STRICT_ANSI__ int _putenv (const char *); # endif #elif defined __CYGWIN__ # ifdef __STRICT_ANSI__ char *realpath (const char *, char *); int putenv (char *); int setenv (const char *, const char *, int); # endif /* #elif defined other_platform || defined ... */ #endif /* portability defines, excluding path handling macros */ #if defined _MSC_VER # define setmode _setmode # define stat _stat # define chmod _chmod # define getcwd _getcwd # define putenv _putenv # define S_IXUSR _S_IEXEC #elif defined __MINGW32__ # define setmode _setmode # define stat _stat # define chmod _chmod # define getcwd _getcwd # define putenv _putenv #elif defined __CYGWIN__ # define HAVE_SETENV # define FOPEN_WB "wb" /* #elif defined other platforms ... */ #endif #if defined PATH_MAX # define LT_PATHMAX PATH_MAX #elif defined MAXPATHLEN # define LT_PATHMAX MAXPATHLEN #else # define LT_PATHMAX 1024 #endif #ifndef S_IXOTH # define S_IXOTH 0 #endif #ifndef S_IXGRP # define S_IXGRP 0 #endif /* path handling portability macros */ #ifndef DIR_SEPARATOR # define DIR_SEPARATOR '/' # define PATH_SEPARATOR ':' #endif #if defined _WIN32 || defined __MSDOS__ || defined __DJGPP__ || \ defined __OS2__ # define HAVE_DOS_BASED_FILE_SYSTEM # define FOPEN_WB "wb" # ifndef DIR_SEPARATOR_2 # define DIR_SEPARATOR_2 '\\' # endif # ifndef PATH_SEPARATOR_2 # define PATH_SEPARATOR_2 ';' # endif #endif #ifndef DIR_SEPARATOR_2 # define IS_DIR_SEPARATOR(ch) ((ch) == DIR_SEPARATOR) #else /* DIR_SEPARATOR_2 */ # define IS_DIR_SEPARATOR(ch) \ (((ch) == DIR_SEPARATOR) || ((ch) == DIR_SEPARATOR_2)) #endif /* DIR_SEPARATOR_2 */ #ifndef PATH_SEPARATOR_2 # define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR) #else /* PATH_SEPARATOR_2 */ # define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR_2) #endif /* PATH_SEPARATOR_2 */ #ifndef FOPEN_WB # define FOPEN_WB "w" #endif #ifndef _O_BINARY # define _O_BINARY 0 #endif #define XMALLOC(type, num) ((type *) xmalloc ((num) * sizeof(type))) #define XFREE(stale) do { \ if (stale) { free (stale); stale = 0; } \ } while (0) #if defined LT_DEBUGWRAPPER static int lt_debug = 1; #else static int lt_debug = 0; #endif const char *program_name = "libtool-wrapper"; /* in case xstrdup fails */ void *xmalloc (size_t num); char *xstrdup (const char *string); const char *base_name (const char *name); char *find_executable (const char *wrapper); char *chase_symlinks (const char *pathspec); int make_executable (const char *path); int check_executable (const char *path); char *strendzap (char *str, const char *pat); void lt_debugprintf (const char *file, int line, const char *fmt, ...); void lt_fatal (const char *file, int line, const char *message, ...); static const char *nonnull (const char *s); static const char *nonempty (const char *s); void lt_setenv (const char *name, const char *value); char *lt_extend_str (const char *orig_value, const char *add, int to_end); void lt_update_exe_path (const char *name, const char *value); void lt_update_lib_path (const char *name, const char *value); char **prepare_spawn (char **argv); void lt_dump_script (FILE *f); EOF cat <= 0) && (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))) return 1; else return 0; } int make_executable (const char *path) { int rval = 0; struct stat st; lt_debugprintf (__FILE__, __LINE__, "(make_executable): %s\n", nonempty (path)); if ((!path) || (!*path)) return 0; if (stat (path, &st) >= 0) { rval = chmod (path, st.st_mode | S_IXOTH | S_IXGRP | S_IXUSR); } return rval; } /* Searches for the full path of the wrapper. Returns newly allocated full path name if found, NULL otherwise Does not chase symlinks, even on platforms that support them. */ char * find_executable (const char *wrapper) { int has_slash = 0; const char *p; const char *p_next; /* static buffer for getcwd */ char tmp[LT_PATHMAX + 1]; size_t tmp_len; char *concat_name; lt_debugprintf (__FILE__, __LINE__, "(find_executable): %s\n", nonempty (wrapper)); if ((wrapper == NULL) || (*wrapper == '\0')) return NULL; /* Absolute path? */ #if defined HAVE_DOS_BASED_FILE_SYSTEM if (isalpha ((unsigned char) wrapper[0]) && wrapper[1] == ':') { concat_name = xstrdup (wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } else { #endif if (IS_DIR_SEPARATOR (wrapper[0])) { concat_name = xstrdup (wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } #if defined HAVE_DOS_BASED_FILE_SYSTEM } #endif for (p = wrapper; *p; p++) if (*p == '/') { has_slash = 1; break; } if (!has_slash) { /* no slashes; search PATH */ const char *path = getenv ("PATH"); if (path != NULL) { for (p = path; *p; p = p_next) { const char *q; size_t p_len; for (q = p; *q; q++) if (IS_PATH_SEPARATOR (*q)) break; p_len = (size_t) (q - p); p_next = (*q == '\0' ? q : q + 1); if (p_len == 0) { /* empty path: current directory */ if (getcwd (tmp, LT_PATHMAX) == NULL) lt_fatal (__FILE__, __LINE__, "getcwd failed: %s", nonnull (strerror (errno))); tmp_len = strlen (tmp); concat_name = XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, tmp, tmp_len); concat_name[tmp_len] = '/'; strcpy (concat_name + tmp_len + 1, wrapper); } else { concat_name = XMALLOC (char, p_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, p, p_len); concat_name[p_len] = '/'; strcpy (concat_name + p_len + 1, wrapper); } if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } } /* not found in PATH; assume curdir */ } /* Relative path | not found in path: prepend cwd */ if (getcwd (tmp, LT_PATHMAX) == NULL) lt_fatal (__FILE__, __LINE__, "getcwd failed: %s", nonnull (strerror (errno))); tmp_len = strlen (tmp); concat_name = XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, tmp, tmp_len); concat_name[tmp_len] = '/'; strcpy (concat_name + tmp_len + 1, wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); return NULL; } char * chase_symlinks (const char *pathspec) { #ifndef S_ISLNK return xstrdup (pathspec); #else char buf[LT_PATHMAX]; struct stat s; char *tmp_pathspec = xstrdup (pathspec); char *p; int has_symlinks = 0; while (strlen (tmp_pathspec) && !has_symlinks) { lt_debugprintf (__FILE__, __LINE__, "checking path component for symlinks: %s\n", tmp_pathspec); if (lstat (tmp_pathspec, &s) == 0) { if (S_ISLNK (s.st_mode) != 0) { has_symlinks = 1; break; } /* search backwards for last DIR_SEPARATOR */ p = tmp_pathspec + strlen (tmp_pathspec) - 1; while ((p > tmp_pathspec) && (!IS_DIR_SEPARATOR (*p))) p--; if ((p == tmp_pathspec) && (!IS_DIR_SEPARATOR (*p))) { /* no more DIR_SEPARATORS left */ break; } *p = '\0'; } else { lt_fatal (__FILE__, __LINE__, "error accessing file \"%s\": %s", tmp_pathspec, nonnull (strerror (errno))); } } XFREE (tmp_pathspec); if (!has_symlinks) { return xstrdup (pathspec); } tmp_pathspec = realpath (pathspec, buf); if (tmp_pathspec == 0) { lt_fatal (__FILE__, __LINE__, "could not follow symlinks for %s", pathspec); } return xstrdup (tmp_pathspec); #endif } char * strendzap (char *str, const char *pat) { size_t len, patlen; assert (str != NULL); assert (pat != NULL); len = strlen (str); patlen = strlen (pat); if (patlen <= len) { str += len - patlen; if (STREQ (str, pat)) *str = '\0'; } return str; } void lt_debugprintf (const char *file, int line, const char *fmt, ...) { va_list args; if (lt_debug) { (void) fprintf (stderr, "%s:%s:%d: ", program_name, file, line); va_start (args, fmt); (void) vfprintf (stderr, fmt, args); va_end (args); } } static void lt_error_core (int exit_status, const char *file, int line, const char *mode, const char *message, va_list ap) { fprintf (stderr, "%s:%s:%d: %s: ", program_name, file, line, mode); vfprintf (stderr, message, ap); fprintf (stderr, ".\n"); if (exit_status >= 0) exit (exit_status); } void lt_fatal (const char *file, int line, const char *message, ...) { va_list ap; va_start (ap, message); lt_error_core (EXIT_FAILURE, file, line, "FATAL", message, ap); va_end (ap); } static const char * nonnull (const char *s) { return s ? s : "(null)"; } static const char * nonempty (const char *s) { return (s && !*s) ? "(empty)" : nonnull (s); } void lt_setenv (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_setenv) setting '%s' to '%s'\n", nonnull (name), nonnull (value)); { #ifdef HAVE_SETENV /* always make a copy, for consistency with !HAVE_SETENV */ char *str = xstrdup (value); setenv (name, str, 1); #else size_t len = strlen (name) + 1 + strlen (value) + 1; char *str = XMALLOC (char, len); sprintf (str, "%s=%s", name, value); if (putenv (str) != EXIT_SUCCESS) { XFREE (str); } #endif } } char * lt_extend_str (const char *orig_value, const char *add, int to_end) { char *new_value; if (orig_value && *orig_value) { size_t orig_value_len = strlen (orig_value); size_t add_len = strlen (add); new_value = XMALLOC (char, add_len + orig_value_len + 1); if (to_end) { strcpy (new_value, orig_value); strcpy (new_value + orig_value_len, add); } else { strcpy (new_value, add); strcpy (new_value + add_len, orig_value); } } else { new_value = xstrdup (add); } return new_value; } void lt_update_exe_path (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_update_exe_path) modifying '%s' by prepending '%s'\n", nonnull (name), nonnull (value)); if (name && *name && value && *value) { char *new_value = lt_extend_str (getenv (name), value, 0); /* some systems can't cope with a ':'-terminated path #' */ size_t len = strlen (new_value); while ((len > 0) && IS_PATH_SEPARATOR (new_value[len-1])) { new_value[--len] = '\0'; } lt_setenv (name, new_value); XFREE (new_value); } } void lt_update_lib_path (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_update_lib_path) modifying '%s' by prepending '%s'\n", nonnull (name), nonnull (value)); if (name && *name && value && *value) { char *new_value = lt_extend_str (getenv (name), value, 0); lt_setenv (name, new_value); XFREE (new_value); } } EOF case $host_os in mingw*) cat <<"EOF" /* Prepares an argument vector before calling spawn(). Note that spawn() does not by itself call the command interpreter (getenv ("COMSPEC") != NULL ? getenv ("COMSPEC") : ({ OSVERSIONINFO v; v.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&v); v.dwPlatformId == VER_PLATFORM_WIN32_NT; }) ? "cmd.exe" : "command.com"). Instead it simply concatenates the arguments, separated by ' ', and calls CreateProcess(). We must quote the arguments since Win32 CreateProcess() interprets characters like ' ', '\t', '\\', '"' (but not '<' and '>') in a special way: - Space and tab are interpreted as delimiters. They are not treated as delimiters if they are surrounded by double quotes: "...". - Unescaped double quotes are removed from the input. Their only effect is that within double quotes, space and tab are treated like normal characters. - Backslashes not followed by double quotes are not special. - But 2*n+1 backslashes followed by a double quote become n backslashes followed by a double quote (n >= 0): \" -> " \\\" -> \" \\\\\" -> \\" */ #define SHELL_SPECIAL_CHARS "\"\\ \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037" #define SHELL_SPACE_CHARS " \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037" char ** prepare_spawn (char **argv) { size_t argc; char **new_argv; size_t i; /* Count number of arguments. */ for (argc = 0; argv[argc] != NULL; argc++) ; /* Allocate new argument vector. */ new_argv = XMALLOC (char *, argc + 1); /* Put quoted arguments into the new argument vector. */ for (i = 0; i < argc; i++) { const char *string = argv[i]; if (string[0] == '\0') new_argv[i] = xstrdup ("\"\""); else if (strpbrk (string, SHELL_SPECIAL_CHARS) != NULL) { int quote_around = (strpbrk (string, SHELL_SPACE_CHARS) != NULL); size_t length; unsigned int backslashes; const char *s; char *quoted_string; char *p; length = 0; backslashes = 0; if (quote_around) length++; for (s = string; *s != '\0'; s++) { char c = *s; if (c == '"') length += backslashes + 1; length++; if (c == '\\') backslashes++; else backslashes = 0; } if (quote_around) length += backslashes + 1; quoted_string = XMALLOC (char, length + 1); p = quoted_string; backslashes = 0; if (quote_around) *p++ = '"'; for (s = string; *s != '\0'; s++) { char c = *s; if (c == '"') { unsigned int j; for (j = backslashes + 1; j > 0; j--) *p++ = '\\'; } *p++ = c; if (c == '\\') backslashes++; else backslashes = 0; } if (quote_around) { unsigned int j; for (j = backslashes; j > 0; j--) *p++ = '\\'; *p++ = '"'; } *p = '\0'; new_argv[i] = quoted_string; } else new_argv[i] = (char *) string; } new_argv[argc] = NULL; return new_argv; } EOF ;; esac cat <<"EOF" void lt_dump_script (FILE* f) { EOF func_emit_wrapper yes | $SED -n -e ' s/^\(.\{79\}\)\(..*\)/\1\ \2/ h s/\([\\"]\)/\\\1/g s/$/\\n/ s/\([^\n]*\).*/ fputs ("\1", f);/p g D' cat <<"EOF" } EOF } # end: func_emit_cwrapperexe_src # func_win32_import_lib_p ARG # True if ARG is an import lib, as indicated by $file_magic_cmd func_win32_import_lib_p () { $debug_cmd case `eval $file_magic_cmd \"\$1\" 2>/dev/null | $SED -e 10q` in *import*) : ;; *) false ;; esac } # func_suncc_cstd_abi # !!ONLY CALL THIS FOR SUN CC AFTER $compile_command IS FULLY EXPANDED!! # Several compiler flags select an ABI that is incompatible with the # Cstd library. Avoid specifying it if any are in CXXFLAGS. func_suncc_cstd_abi () { $debug_cmd case " $compile_command " in *" -compat=g "*|*\ -std=c++[0-9][0-9]\ *|*" -library=stdcxx4 "*|*" -library=stlport4 "*) suncc_use_cstd_abi=no ;; *) suncc_use_cstd_abi=yes ;; esac } # func_mode_link arg... func_mode_link () { $debug_cmd case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) # It is impossible to link a dll without this setting, and # we shouldn't force the makefile maintainer to figure out # what system we are compiling for in order to pass an extra # flag for every libtool invocation. # allow_undefined=no # FIXME: Unfortunately, there are problems with the above when trying # to make a dll that has undefined symbols, in which case not # even a static library is built. For now, we need to specify # -no-undefined on the libtool link line when we can be certain # that all symbols are satisfied, otherwise we get a static library. allow_undefined=yes ;; *) allow_undefined=yes ;; esac libtool_args=$nonopt base_compile="$nonopt $@" compile_command=$nonopt finalize_command=$nonopt compile_rpath= finalize_rpath= compile_shlibpath= finalize_shlibpath= convenience= old_convenience= deplibs= old_deplibs= compiler_flags= linker_flags= dllsearchpath= lib_search_path=`pwd` inst_prefix_dir= new_inherited_linker_flags= avoid_version=no bindir= dlfiles= dlprefiles= dlself=no export_dynamic=no export_symbols= export_symbols_regex= generated= libobjs= ltlibs= module=no no_install=no objs= os2dllname= non_pic_objects= precious_files_regex= prefer_static_libs=no preload=false prev= prevarg= release= rpath= xrpath= perm_rpath= temp_rpath= thread_safe=no vinfo= vinfo_number=no weak_libs= single_module=$wl-single_module func_infer_tag $base_compile # We need to know -static, to get the right output filenames. for arg do case $arg in -shared) test yes != "$build_libtool_libs" \ && func_fatal_configuration "cannot build a shared library" build_old_libs=no break ;; -all-static | -static | -static-libtool-libs) case $arg in -all-static) if test yes = "$build_libtool_libs" && test -z "$link_static_flag"; then func_warning "complete static linking is impossible in this configuration" fi if test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=yes ;; -static) if test -z "$pic_flag" && test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=built ;; -static-libtool-libs) if test -z "$pic_flag" && test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=yes ;; esac build_libtool_libs=no build_old_libs=yes break ;; esac done # See if our shared archives depend on static archives. test -n "$old_archive_from_new_cmds" && build_old_libs=yes # Go through the arguments, transforming them on the way. while test "$#" -gt 0; do arg=$1 shift func_quote_for_eval "$arg" qarg=$func_quote_for_eval_unquoted_result func_append libtool_args " $func_quote_for_eval_result" # If the previous option needs an argument, assign it. if test -n "$prev"; then case $prev in output) func_append compile_command " @OUTPUT@" func_append finalize_command " @OUTPUT@" ;; esac case $prev in bindir) bindir=$arg prev= continue ;; dlfiles|dlprefiles) $preload || { # Add the symbol object into the linking commands. func_append compile_command " @SYMFILE@" func_append finalize_command " @SYMFILE@" preload=: } case $arg in *.la | *.lo) ;; # We handle these cases below. force) if test no = "$dlself"; then dlself=needless export_dynamic=yes fi prev= continue ;; self) if test dlprefiles = "$prev"; then dlself=yes elif test dlfiles = "$prev" && test yes != "$dlopen_self"; then dlself=yes else dlself=needless export_dynamic=yes fi prev= continue ;; *) if test dlfiles = "$prev"; then func_append dlfiles " $arg" else func_append dlprefiles " $arg" fi prev= continue ;; esac ;; expsyms) export_symbols=$arg test -f "$arg" \ || func_fatal_error "symbol file '$arg' does not exist" prev= continue ;; expsyms_regex) export_symbols_regex=$arg prev= continue ;; framework) case $host in *-*-darwin*) case "$deplibs " in *" $qarg.ltframework "*) ;; *) func_append deplibs " $qarg.ltframework" # this is fixed later ;; esac ;; esac prev= continue ;; inst_prefix) inst_prefix_dir=$arg prev= continue ;; mllvm) # Clang does not use LLVM to link, so we can simply discard any # '-mllvm $arg' options when doing the link step. prev= continue ;; objectlist) if test -f "$arg"; then save_arg=$arg moreargs= for fil in `cat "$save_arg"` do # func_append moreargs " $fil" arg=$fil # A libtool-controlled object. # Check to see that this really is a libtool object. if func_lalib_unsafe_p "$arg"; then pic_object= non_pic_object= # Read the .lo file func_source "$arg" if test -z "$pic_object" || test -z "$non_pic_object" || test none = "$pic_object" && test none = "$non_pic_object"; then func_fatal_error "cannot find name of object for '$arg'" fi # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result if test none != "$pic_object"; then # Prepend the subdirectory the object is found in. pic_object=$xdir$pic_object if test dlfiles = "$prev"; then if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then func_append dlfiles " $pic_object" prev= continue else # If libtool objects are unsupported, then we need to preload. prev=dlprefiles fi fi # CHECK ME: I think I busted this. -Ossama if test dlprefiles = "$prev"; then # Preload the old-style object. func_append dlprefiles " $pic_object" prev= fi # A PIC object. func_append libobjs " $pic_object" arg=$pic_object fi # Non-PIC object. if test none != "$non_pic_object"; then # Prepend the subdirectory the object is found in. non_pic_object=$xdir$non_pic_object # A standard non-PIC object func_append non_pic_objects " $non_pic_object" if test -z "$pic_object" || test none = "$pic_object"; then arg=$non_pic_object fi else # If the PIC object exists, use it instead. # $xdir was prepended to $pic_object above. non_pic_object=$pic_object func_append non_pic_objects " $non_pic_object" fi else # Only an error if not doing a dry-run. if $opt_dry_run; then # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result func_lo2o "$arg" pic_object=$xdir$objdir/$func_lo2o_result non_pic_object=$xdir$func_lo2o_result func_append libobjs " $pic_object" func_append non_pic_objects " $non_pic_object" else func_fatal_error "'$arg' is not a valid libtool object" fi fi done else func_fatal_error "link input file '$arg' does not exist" fi arg=$save_arg prev= continue ;; os2dllname) os2dllname=$arg prev= continue ;; precious_regex) precious_files_regex=$arg prev= continue ;; release) release=-$arg prev= continue ;; rpath | xrpath) # We need an absolute path. case $arg in [\\/]* | [A-Za-z]:[\\/]*) ;; *) func_fatal_error "only absolute run-paths are allowed" ;; esac if test rpath = "$prev"; then case "$rpath " in *" $arg "*) ;; *) func_append rpath " $arg" ;; esac else case "$xrpath " in *" $arg "*) ;; *) func_append xrpath " $arg" ;; esac fi prev= continue ;; shrext) shrext_cmds=$arg prev= continue ;; weak) func_append weak_libs " $arg" prev= continue ;; xcclinker) func_append linker_flags " $qarg" func_append compiler_flags " $qarg" prev= func_append compile_command " $qarg" func_append finalize_command " $qarg" continue ;; xcompiler) func_append compiler_flags " $qarg" prev= func_append compile_command " $qarg" func_append finalize_command " $qarg" continue ;; xlinker) func_append linker_flags " $qarg" func_append compiler_flags " $wl$qarg" prev= func_append compile_command " $wl$qarg" func_append finalize_command " $wl$qarg" continue ;; *) eval "$prev=\"\$arg\"" prev= continue ;; esac fi # test -n "$prev" prevarg=$arg case $arg in -all-static) if test -n "$link_static_flag"; then # See comment for -static flag below, for more details. func_append compile_command " $link_static_flag" func_append finalize_command " $link_static_flag" fi continue ;; -allow-undefined) # FIXME: remove this flag sometime in the future. func_fatal_error "'-allow-undefined' must not be used because it is the default" ;; -avoid-version) avoid_version=yes continue ;; -bindir) prev=bindir continue ;; -dlopen) prev=dlfiles continue ;; -dlpreopen) prev=dlprefiles continue ;; -export-dynamic) export_dynamic=yes continue ;; -export-symbols | -export-symbols-regex) if test -n "$export_symbols" || test -n "$export_symbols_regex"; then func_fatal_error "more than one -exported-symbols argument is not allowed" fi if test X-export-symbols = "X$arg"; then prev=expsyms else prev=expsyms_regex fi continue ;; -framework) prev=framework continue ;; -inst-prefix-dir) prev=inst_prefix continue ;; # The native IRIX linker understands -LANG:*, -LIST:* and -LNO:* # so, if we see these flags be careful not to treat them like -L -L[A-Z][A-Z]*:*) case $with_gcc/$host in no/*-*-irix* | /*-*-irix*) func_append compile_command " $arg" func_append finalize_command " $arg" ;; esac continue ;; -L*) func_stripname "-L" '' "$arg" if test -z "$func_stripname_result"; then if test "$#" -gt 0; then func_fatal_error "require no space between '-L' and '$1'" else func_fatal_error "need path for '-L' option" fi fi func_resolve_sysroot "$func_stripname_result" dir=$func_resolve_sysroot_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) ;; *) absdir=`cd "$dir" && pwd` test -z "$absdir" && \ func_fatal_error "cannot determine absolute directory name of '$dir'" dir=$absdir ;; esac case "$deplibs " in *" -L$dir "* | *" $arg "*) # Will only happen for absolute or sysroot arguments ;; *) # Preserve sysroot, but never include relative directories case $dir in [\\/]* | [A-Za-z]:[\\/]* | =*) func_append deplibs " $arg" ;; *) func_append deplibs " -L$dir" ;; esac func_append lib_search_path " $dir" ;; esac case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) testbindir=`$ECHO "$dir" | $SED 's*/lib$*/bin*'` case :$dllsearchpath: in *":$dir:"*) ;; ::) dllsearchpath=$dir;; *) func_append dllsearchpath ":$dir";; esac case :$dllsearchpath: in *":$testbindir:"*) ;; ::) dllsearchpath=$testbindir;; *) func_append dllsearchpath ":$testbindir";; esac ;; esac continue ;; -l*) if test X-lc = "X$arg" || test X-lm = "X$arg"; then case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-beos* | *-cegcc* | *-*-haiku*) # These systems don't actually have a C or math library (as such) continue ;; *-*-os2*) # These systems don't actually have a C library (as such) test X-lc = "X$arg" && continue ;; *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*) # Do not include libc due to us having libc/libc_r. test X-lc = "X$arg" && continue ;; *-*-rhapsody* | *-*-darwin1.[012]) # Rhapsody C and math libraries are in the System framework func_append deplibs " System.ltframework" continue ;; *-*-sco3.2v5* | *-*-sco5v6*) # Causes problems with __ctype test X-lc = "X$arg" && continue ;; *-*-sysv4.2uw2* | *-*-sysv5* | *-*-unixware* | *-*-OpenUNIX*) # Compiler inserts libc in the correct place for threads to work test X-lc = "X$arg" && continue ;; esac elif test X-lc_r = "X$arg"; then case $host in *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*) # Do not include libc_r directly, use -pthread flag. continue ;; esac fi func_append deplibs " $arg" continue ;; -mllvm) prev=mllvm continue ;; -module) module=yes continue ;; # Tru64 UNIX uses -model [arg] to determine the layout of C++ # classes, name mangling, and exception handling. # Darwin uses the -arch flag to determine output architecture. -model|-arch|-isysroot|--sysroot) func_append compiler_flags " $arg" func_append compile_command " $arg" func_append finalize_command " $arg" prev=xcompiler continue ;; -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe \ |-threads|-fopenmp|-openmp|-mp|-xopenmp|-omp|-qsmp=*) func_append compiler_flags " $arg" func_append compile_command " $arg" func_append finalize_command " $arg" case "$new_inherited_linker_flags " in *" $arg "*) ;; * ) func_append new_inherited_linker_flags " $arg" ;; esac continue ;; -multi_module) single_module=$wl-multi_module continue ;; -no-fast-install) fast_install=no continue ;; -no-install) case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-*-darwin* | *-cegcc*) # The PATH hackery in wrapper scripts is required on Windows # and Darwin in order for the loader to find any dlls it needs. func_warning "'-no-install' is ignored for $host" func_warning "assuming '-no-fast-install' instead" fast_install=no ;; *) no_install=yes ;; esac continue ;; -no-undefined) allow_undefined=no continue ;; -objectlist) prev=objectlist continue ;; -os2dllname) prev=os2dllname continue ;; -o) prev=output ;; -precious-files-regex) prev=precious_regex continue ;; -release) prev=release continue ;; -rpath) prev=rpath continue ;; -R) prev=xrpath continue ;; -R*) func_stripname '-R' '' "$arg" dir=$func_stripname_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) ;; =*) func_stripname '=' '' "$dir" dir=$lt_sysroot$func_stripname_result ;; *) func_fatal_error "only absolute run-paths are allowed" ;; esac case "$xrpath " in *" $dir "*) ;; *) func_append xrpath " $dir" ;; esac continue ;; -shared) # The effects of -shared are defined in a previous loop. continue ;; -shrext) prev=shrext continue ;; -static | -static-libtool-libs) # The effects of -static are defined in a previous loop. # We used to do the same as -all-static on platforms that # didn't have a PIC flag, but the assumption that the effects # would be equivalent was wrong. It would break on at least # Digital Unix and AIX. continue ;; -thread-safe) thread_safe=yes continue ;; -version-info) prev=vinfo continue ;; -version-number) prev=vinfo vinfo_number=yes continue ;; -weak) prev=weak continue ;; -Wc,*) func_stripname '-Wc,' '' "$arg" args=$func_stripname_result arg= save_ifs=$IFS; IFS=, for flag in $args; do IFS=$save_ifs func_quote_for_eval "$flag" func_append arg " $func_quote_for_eval_result" func_append compiler_flags " $func_quote_for_eval_result" done IFS=$save_ifs func_stripname ' ' '' "$arg" arg=$func_stripname_result ;; -Wl,*) func_stripname '-Wl,' '' "$arg" args=$func_stripname_result arg= save_ifs=$IFS; IFS=, for flag in $args; do IFS=$save_ifs func_quote_for_eval "$flag" func_append arg " $wl$func_quote_for_eval_result" func_append compiler_flags " $wl$func_quote_for_eval_result" func_append linker_flags " $func_quote_for_eval_result" done IFS=$save_ifs func_stripname ' ' '' "$arg" arg=$func_stripname_result ;; -Xcompiler) prev=xcompiler continue ;; -Xlinker) prev=xlinker continue ;; -XCClinker) prev=xcclinker continue ;; # -msg_* for osf cc -msg_*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; # Flags to be passed through unchanged, with rationale: # -64, -mips[0-9] enable 64-bit mode for the SGI compiler # -r[0-9][0-9]* specify processor for the SGI compiler # -xarch=*, -xtarget=* enable 64-bit mode for the Sun compiler # +DA*, +DD* enable 64-bit mode for the HP compiler # -q* compiler args for the IBM compiler # -m*, -t[45]*, -txscale* architecture-specific flags for GCC # -F/path path to uninstalled frameworks, gcc on darwin # -p, -pg, --coverage, -fprofile-* profiling flags for GCC # -fstack-protector* stack protector flags for GCC # @file GCC response files # -tp=* Portland pgcc target processor selection # --sysroot=* for sysroot support # -O*, -g*, -flto*, -fwhopr*, -fuse-linker-plugin GCC link-time optimization # -specs=* GCC specs files # -stdlib=* select c++ std lib with clang # -fsanitize=* Clang/GCC memory and address sanitizer -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \ -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \ -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \ -specs=*|-fsanitize=*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result func_append compile_command " $arg" func_append finalize_command " $arg" func_append compiler_flags " $arg" continue ;; -Z*) if test os2 = "`expr $host : '.*\(os2\)'`"; then # OS/2 uses -Zxxx to specify OS/2-specific options compiler_flags="$compiler_flags $arg" func_append compile_command " $arg" func_append finalize_command " $arg" case $arg in -Zlinker | -Zstack) prev=xcompiler ;; esac continue else # Otherwise treat like 'Some other compiler flag' below func_quote_for_eval "$arg" arg=$func_quote_for_eval_result fi ;; # Some other compiler flag. -* | +*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; *.$objext) # A standard object. func_append objs " $arg" ;; *.lo) # A libtool-controlled object. # Check to see that this really is a libtool object. if func_lalib_unsafe_p "$arg"; then pic_object= non_pic_object= # Read the .lo file func_source "$arg" if test -z "$pic_object" || test -z "$non_pic_object" || test none = "$pic_object" && test none = "$non_pic_object"; then func_fatal_error "cannot find name of object for '$arg'" fi # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result test none = "$pic_object" || { # Prepend the subdirectory the object is found in. pic_object=$xdir$pic_object if test dlfiles = "$prev"; then if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then func_append dlfiles " $pic_object" prev= continue else # If libtool objects are unsupported, then we need to preload. prev=dlprefiles fi fi # CHECK ME: I think I busted this. -Ossama if test dlprefiles = "$prev"; then # Preload the old-style object. func_append dlprefiles " $pic_object" prev= fi # A PIC object. func_append libobjs " $pic_object" arg=$pic_object } # Non-PIC object. if test none != "$non_pic_object"; then # Prepend the subdirectory the object is found in. non_pic_object=$xdir$non_pic_object # A standard non-PIC object func_append non_pic_objects " $non_pic_object" if test -z "$pic_object" || test none = "$pic_object"; then arg=$non_pic_object fi else # If the PIC object exists, use it instead. # $xdir was prepended to $pic_object above. non_pic_object=$pic_object func_append non_pic_objects " $non_pic_object" fi else # Only an error if not doing a dry-run. if $opt_dry_run; then # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result func_lo2o "$arg" pic_object=$xdir$objdir/$func_lo2o_result non_pic_object=$xdir$func_lo2o_result func_append libobjs " $pic_object" func_append non_pic_objects " $non_pic_object" else func_fatal_error "'$arg' is not a valid libtool object" fi fi ;; *.$libext) # An archive. func_append deplibs " $arg" func_append old_deplibs " $arg" continue ;; *.la) # A libtool-controlled library. func_resolve_sysroot "$arg" if test dlfiles = "$prev"; then # This library was specified with -dlopen. func_append dlfiles " $func_resolve_sysroot_result" prev= elif test dlprefiles = "$prev"; then # The library was specified with -dlpreopen. func_append dlprefiles " $func_resolve_sysroot_result" prev= else func_append deplibs " $func_resolve_sysroot_result" fi continue ;; # Some other compiler argument. *) # Unknown arguments in both finalize_command and compile_command need # to be aesthetically quoted because they are evaled later. func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; esac # arg # Now actually substitute the argument into the commands. if test -n "$arg"; then func_append compile_command " $arg" func_append finalize_command " $arg" fi done # argument parsing loop test -n "$prev" && \ func_fatal_help "the '$prevarg' option requires an argument" if test yes = "$export_dynamic" && test -n "$export_dynamic_flag_spec"; then eval arg=\"$export_dynamic_flag_spec\" func_append compile_command " $arg" func_append finalize_command " $arg" fi oldlibs= # calculate the name of the file, without its directory func_basename "$output" outputname=$func_basename_result libobjs_save=$libobjs if test -n "$shlibpath_var"; then # get the directories listed in $shlibpath_var eval shlib_search_path=\`\$ECHO \"\$$shlibpath_var\" \| \$SED \'s/:/ /g\'\` else shlib_search_path= fi eval sys_lib_search_path=\"$sys_lib_search_path_spec\" eval sys_lib_dlsearch_path=\"$sys_lib_dlsearch_path_spec\" # Definition is injected by LT_CONFIG during libtool generation. func_munge_path_list sys_lib_dlsearch_path "$LT_SYS_LIBRARY_PATH" func_dirname "$output" "/" "" output_objdir=$func_dirname_result$objdir func_to_tool_file "$output_objdir/" tool_output_objdir=$func_to_tool_file_result # Create the object directory. func_mkdir_p "$output_objdir" # Determine the type of output case $output in "") func_fatal_help "you must specify an output file" ;; *.$libext) linkmode=oldlib ;; *.lo | *.$objext) linkmode=obj ;; *.la) linkmode=lib ;; *) linkmode=prog ;; # Anything else should be a program. esac specialdeplibs= libs= # Find all interdependent deplibs by searching for libraries # that are linked more than once (e.g. -la -lb -la) for deplib in $deplibs; do if $opt_preserve_dup_deps; then case "$libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append libs " $deplib" done if test lib = "$linkmode"; then libs="$predeps $libs $compiler_lib_search_path $postdeps" # Compute libraries that are listed more than once in $predeps # $postdeps and mark them as special (i.e., whose duplicates are # not to be eliminated). pre_post_deps= if $opt_duplicate_compiler_generated_deps; then for pre_post_dep in $predeps $postdeps; do case "$pre_post_deps " in *" $pre_post_dep "*) func_append specialdeplibs " $pre_post_deps" ;; esac func_append pre_post_deps " $pre_post_dep" done fi pre_post_deps= fi deplibs= newdependency_libs= newlib_search_path= need_relink=no # whether we're linking any uninstalled libtool libraries notinst_deplibs= # not-installed libtool libraries notinst_path= # paths that contain not-installed libtool libraries case $linkmode in lib) passes="conv dlpreopen link" for file in $dlfiles $dlprefiles; do case $file in *.la) ;; *) func_fatal_help "libraries can '-dlopen' only libtool libraries: $file" ;; esac done ;; prog) compile_deplibs= finalize_deplibs= alldeplibs=false newdlfiles= newdlprefiles= passes="conv scan dlopen dlpreopen link" ;; *) passes="conv" ;; esac for pass in $passes; do # The preopen pass in lib mode reverses $deplibs; put it back here # so that -L comes before libs that need it for instance... if test lib,link = "$linkmode,$pass"; then ## FIXME: Find the place where the list is rebuilt in the wrong ## order, and fix it there properly tmp_deplibs= for deplib in $deplibs; do tmp_deplibs="$deplib $tmp_deplibs" done deplibs=$tmp_deplibs fi if test lib,link = "$linkmode,$pass" || test prog,scan = "$linkmode,$pass"; then libs=$deplibs deplibs= fi if test prog = "$linkmode"; then case $pass in dlopen) libs=$dlfiles ;; dlpreopen) libs=$dlprefiles ;; link) libs="$deplibs %DEPLIBS%" test "X$link_all_deplibs" != Xno && libs="$libs $dependency_libs" ;; esac fi if test lib,dlpreopen = "$linkmode,$pass"; then # Collect and forward deplibs of preopened libtool libs for lib in $dlprefiles; do # Ignore non-libtool-libs dependency_libs= func_resolve_sysroot "$lib" case $lib in *.la) func_source "$func_resolve_sysroot_result" ;; esac # Collect preopened libtool deplibs, except any this library # has declared as weak libs for deplib in $dependency_libs; do func_basename "$deplib" deplib_base=$func_basename_result case " $weak_libs " in *" $deplib_base "*) ;; *) func_append deplibs " $deplib" ;; esac done done libs=$dlprefiles fi if test dlopen = "$pass"; then # Collect dlpreopened libraries save_deplibs=$deplibs deplibs= fi for deplib in $libs; do lib= found=false case $deplib in -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe \ |-threads|-fopenmp|-openmp|-mp|-xopenmp|-omp|-qsmp=*) if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else func_append compiler_flags " $deplib" if test lib = "$linkmode"; then case "$new_inherited_linker_flags " in *" $deplib "*) ;; * ) func_append new_inherited_linker_flags " $deplib" ;; esac fi fi continue ;; -l*) if test lib != "$linkmode" && test prog != "$linkmode"; then func_warning "'-l' is ignored for archives/objects" continue fi func_stripname '-l' '' "$deplib" name=$func_stripname_result if test lib = "$linkmode"; then searchdirs="$newlib_search_path $lib_search_path $compiler_lib_search_dirs $sys_lib_search_path $shlib_search_path" else searchdirs="$newlib_search_path $lib_search_path $sys_lib_search_path $shlib_search_path" fi for searchdir in $searchdirs; do for search_ext in .la $std_shrext .so .a; do # Search the libtool library lib=$searchdir/lib$name$search_ext if test -f "$lib"; then if test .la = "$search_ext"; then found=: else found=false fi break 2 fi done done if $found; then # deplib is a libtool library # If $allow_libtool_libs_with_static_runtimes && $deplib is a stdlib, # We need to do some special things here, and not later. if test yes = "$allow_libtool_libs_with_static_runtimes"; then case " $predeps $postdeps " in *" $deplib "*) if func_lalib_p "$lib"; then library_names= old_library= func_source "$lib" for l in $old_library $library_names; do ll=$l done if test "X$ll" = "X$old_library"; then # only static version available found=false func_dirname "$lib" "" "." ladir=$func_dirname_result lib=$ladir/$old_library if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs" fi continue fi fi ;; *) ;; esac fi else # deplib doesn't seem to be a libtool library if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs" fi continue fi ;; # -l *.ltframework) if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" if test lib = "$linkmode"; then case "$new_inherited_linker_flags " in *" $deplib "*) ;; * ) func_append new_inherited_linker_flags " $deplib" ;; esac fi fi continue ;; -L*) case $linkmode in lib) deplibs="$deplib $deplibs" test conv = "$pass" && continue newdependency_libs="$deplib $newdependency_libs" func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; prog) if test conv = "$pass"; then deplibs="$deplib $deplibs" continue fi if test scan = "$pass"; then deplibs="$deplib $deplibs" else compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" fi func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; *) func_warning "'-L' is ignored for archives/objects" ;; esac # linkmode continue ;; # -L -R*) if test link = "$pass"; then func_stripname '-R' '' "$deplib" func_resolve_sysroot "$func_stripname_result" dir=$func_resolve_sysroot_result # Make sure the xrpath contains only unique directories. case "$xrpath " in *" $dir "*) ;; *) func_append xrpath " $dir" ;; esac fi deplibs="$deplib $deplibs" continue ;; *.la) func_resolve_sysroot "$deplib" lib=$func_resolve_sysroot_result ;; *.$libext) if test conv = "$pass"; then deplibs="$deplib $deplibs" continue fi case $linkmode in lib) # Linking convenience modules into shared libraries is allowed, # but linking other static libraries is non-portable. case " $dlpreconveniencelibs " in *" $deplib "*) ;; *) valid_a_lib=false case $deplibs_check_method in match_pattern*) set dummy $deplibs_check_method; shift match_pattern_regex=`expr "$deplibs_check_method" : "$1 \(.*\)"` if eval "\$ECHO \"$deplib\"" 2>/dev/null | $SED 10q \ | $EGREP "$match_pattern_regex" > /dev/null; then valid_a_lib=: fi ;; pass_all) valid_a_lib=: ;; esac if $valid_a_lib; then echo $ECHO "*** Warning: Linking the shared library $output against the" $ECHO "*** static library $deplib is not portable!" deplibs="$deplib $deplibs" else echo $ECHO "*** Warning: Trying to link with static lib archive $deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because the file extensions .$libext of this argument makes me believe" echo "*** that it is just a static archive that I should not use here." fi ;; esac continue ;; prog) if test link != "$pass"; then deplibs="$deplib $deplibs" else compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" fi continue ;; esac # linkmode ;; # *.$libext *.lo | *.$objext) if test conv = "$pass"; then deplibs="$deplib $deplibs" elif test prog = "$linkmode"; then if test dlpreopen = "$pass" || test yes != "$dlopen_support" || test no = "$build_libtool_libs"; then # If there is no dlopen support or we're linking statically, # we need to preload. func_append newdlprefiles " $deplib" compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else func_append newdlfiles " $deplib" fi fi continue ;; %DEPLIBS%) alldeplibs=: continue ;; esac # case $deplib $found || test -f "$lib" \ || func_fatal_error "cannot find the library '$lib' or unhandled argument '$deplib'" # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$lib" \ || func_fatal_error "'$lib' is not a valid libtool archive" func_dirname "$lib" "" "." ladir=$func_dirname_result dlname= dlopen= dlpreopen= libdir= library_names= old_library= inherited_linker_flags= # If the library was installed with an old release of libtool, # it will not redefine variables installed, or shouldnotlink installed=yes shouldnotlink=no avoidtemprpath= # Read the .la file func_source "$lib" # Convert "-framework foo" to "foo.ltframework" if test -n "$inherited_linker_flags"; then tmp_inherited_linker_flags=`$ECHO "$inherited_linker_flags" | $SED 's/-framework \([^ $]*\)/\1.ltframework/g'` for tmp_inherited_linker_flag in $tmp_inherited_linker_flags; do case " $new_inherited_linker_flags " in *" $tmp_inherited_linker_flag "*) ;; *) func_append new_inherited_linker_flags " $tmp_inherited_linker_flag";; esac done fi dependency_libs=`$ECHO " $dependency_libs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` if test lib,link = "$linkmode,$pass" || test prog,scan = "$linkmode,$pass" || { test prog != "$linkmode" && test lib != "$linkmode"; }; then test -n "$dlopen" && func_append dlfiles " $dlopen" test -n "$dlpreopen" && func_append dlprefiles " $dlpreopen" fi if test conv = "$pass"; then # Only check for convenience libraries deplibs="$lib $deplibs" if test -z "$libdir"; then if test -z "$old_library"; then func_fatal_error "cannot find name of link library for '$lib'" fi # It is a libtool convenience library, so add in its objects. func_append convenience " $ladir/$objdir/$old_library" func_append old_convenience " $ladir/$objdir/$old_library" tmp_libs= for deplib in $dependency_libs; do deplibs="$deplib $deplibs" if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append tmp_libs " $deplib" done elif test prog != "$linkmode" && test lib != "$linkmode"; then func_fatal_error "'$lib' is not a convenience library" fi continue fi # $pass = conv # Get the name of the library we link against. linklib= if test -n "$old_library" && { test yes = "$prefer_static_libs" || test built,no = "$prefer_static_libs,$installed"; }; then linklib=$old_library else for l in $old_library $library_names; do linklib=$l done fi if test -z "$linklib"; then func_fatal_error "cannot find name of link library for '$lib'" fi # This library was specified with -dlopen. if test dlopen = "$pass"; then test -z "$libdir" \ && func_fatal_error "cannot -dlopen a convenience library: '$lib'" if test -z "$dlname" || test yes != "$dlopen_support" || test no = "$build_libtool_libs" then # If there is no dlname, no dlopen support or we're linking # statically, we need to preload. We also need to preload any # dependent libraries so libltdl's deplib preloader doesn't # bomb out in the load deplibs phase. func_append dlprefiles " $lib $dependency_libs" else func_append newdlfiles " $lib" fi continue fi # $pass = dlopen # We need an absolute path. case $ladir in [\\/]* | [A-Za-z]:[\\/]*) abs_ladir=$ladir ;; *) abs_ladir=`cd "$ladir" && pwd` if test -z "$abs_ladir"; then func_warning "cannot determine absolute directory name of '$ladir'" func_warning "passing it literally to the linker, although it might fail" abs_ladir=$ladir fi ;; esac func_basename "$lib" laname=$func_basename_result # Find the relevant object directory and library name. if test yes = "$installed"; then if test ! -f "$lt_sysroot$libdir/$linklib" && test -f "$abs_ladir/$linklib"; then func_warning "library '$lib' was moved." dir=$ladir absdir=$abs_ladir libdir=$abs_ladir else dir=$lt_sysroot$libdir absdir=$lt_sysroot$libdir fi test yes = "$hardcode_automatic" && avoidtemprpath=yes else if test ! -f "$ladir/$objdir/$linklib" && test -f "$abs_ladir/$linklib"; then dir=$ladir absdir=$abs_ladir # Remove this search path later func_append notinst_path " $abs_ladir" else dir=$ladir/$objdir absdir=$abs_ladir/$objdir # Remove this search path later func_append notinst_path " $abs_ladir" fi fi # $installed = yes func_stripname 'lib' '.la' "$laname" name=$func_stripname_result # This library was specified with -dlpreopen. if test dlpreopen = "$pass"; then if test -z "$libdir" && test prog = "$linkmode"; then func_fatal_error "only libraries may -dlpreopen a convenience library: '$lib'" fi case $host in # special handling for platforms with PE-DLLs. *cygwin* | *mingw* | *cegcc* ) # Linker will automatically link against shared library if both # static and shared are present. Therefore, ensure we extract # symbols from the import library if a shared library is present # (otherwise, the dlopen module name will be incorrect). We do # this by putting the import library name into $newdlprefiles. # We recover the dlopen module name by 'saving' the la file # name in a special purpose variable, and (later) extracting the # dlname from the la file. if test -n "$dlname"; then func_tr_sh "$dir/$linklib" eval "libfile_$func_tr_sh_result=\$abs_ladir/\$laname" func_append newdlprefiles " $dir/$linklib" else func_append newdlprefiles " $dir/$old_library" # Keep a list of preopened convenience libraries to check # that they are being used correctly in the link pass. test -z "$libdir" && \ func_append dlpreconveniencelibs " $dir/$old_library" fi ;; * ) # Prefer using a static library (so that no silly _DYNAMIC symbols # are required to link). if test -n "$old_library"; then func_append newdlprefiles " $dir/$old_library" # Keep a list of preopened convenience libraries to check # that they are being used correctly in the link pass. test -z "$libdir" && \ func_append dlpreconveniencelibs " $dir/$old_library" # Otherwise, use the dlname, so that lt_dlopen finds it. elif test -n "$dlname"; then func_append newdlprefiles " $dir/$dlname" else func_append newdlprefiles " $dir/$linklib" fi ;; esac fi # $pass = dlpreopen if test -z "$libdir"; then # Link the convenience library if test lib = "$linkmode"; then deplibs="$dir/$old_library $deplibs" elif test prog,link = "$linkmode,$pass"; then compile_deplibs="$dir/$old_library $compile_deplibs" finalize_deplibs="$dir/$old_library $finalize_deplibs" else deplibs="$lib $deplibs" # used for prog,scan pass fi continue fi if test prog = "$linkmode" && test link != "$pass"; then func_append newlib_search_path " $ladir" deplibs="$lib $deplibs" linkalldeplibs=false if test no != "$link_all_deplibs" || test -z "$library_names" || test no = "$build_libtool_libs"; then linkalldeplibs=: fi tmp_libs= for deplib in $dependency_libs; do case $deplib in -L*) func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; esac # Need to link against all dependency_libs? if $linkalldeplibs; then deplibs="$deplib $deplibs" else # Need to hardcode shared library paths # or/and link against static libraries newdependency_libs="$deplib $newdependency_libs" fi if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append tmp_libs " $deplib" done # for deplib continue fi # $linkmode = prog... if test prog,link = "$linkmode,$pass"; then if test -n "$library_names" && { { test no = "$prefer_static_libs" || test built,yes = "$prefer_static_libs,$installed"; } || test -z "$old_library"; }; then # We need to hardcode the library path if test -n "$shlibpath_var" && test -z "$avoidtemprpath"; then # Make sure the rpath contains only unique directories. case $temp_rpath: in *"$absdir:"*) ;; *) func_append temp_rpath "$absdir:" ;; esac fi # Hardcode the library path. # Skip directories that are in the system default run-time # search path. case " $sys_lib_dlsearch_path " in *" $absdir "*) ;; *) case "$compile_rpath " in *" $absdir "*) ;; *) func_append compile_rpath " $absdir" ;; esac ;; esac case " $sys_lib_dlsearch_path " in *" $libdir "*) ;; *) case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac ;; esac fi # $linkmode,$pass = prog,link... if $alldeplibs && { test pass_all = "$deplibs_check_method" || { test yes = "$build_libtool_libs" && test -n "$library_names"; }; }; then # We only need to search for static libraries continue fi fi link_static=no # Whether the deplib will be linked statically use_static_libs=$prefer_static_libs if test built = "$use_static_libs" && test yes = "$installed"; then use_static_libs=no fi if test -n "$library_names" && { test no = "$use_static_libs" || test -z "$old_library"; }; then case $host in *cygwin* | *mingw* | *cegcc* | *os2*) # No point in relinking DLLs because paths are not encoded func_append notinst_deplibs " $lib" need_relink=no ;; *) if test no = "$installed"; then func_append notinst_deplibs " $lib" need_relink=yes fi ;; esac # This is a shared library # Warn about portability, can't link against -module's on some # systems (darwin). Don't bleat about dlopened modules though! dlopenmodule= for dlpremoduletest in $dlprefiles; do if test "X$dlpremoduletest" = "X$lib"; then dlopenmodule=$dlpremoduletest break fi done if test -z "$dlopenmodule" && test yes = "$shouldnotlink" && test link = "$pass"; then echo if test prog = "$linkmode"; then $ECHO "*** Warning: Linking the executable $output against the loadable module" else $ECHO "*** Warning: Linking the shared library $output against the loadable module" fi $ECHO "*** $linklib is not portable!" fi if test lib = "$linkmode" && test yes = "$hardcode_into_libs"; then # Hardcode the library path. # Skip directories that are in the system default run-time # search path. case " $sys_lib_dlsearch_path " in *" $absdir "*) ;; *) case "$compile_rpath " in *" $absdir "*) ;; *) func_append compile_rpath " $absdir" ;; esac ;; esac case " $sys_lib_dlsearch_path " in *" $libdir "*) ;; *) case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac ;; esac fi if test -n "$old_archive_from_expsyms_cmds"; then # figure out the soname set dummy $library_names shift realname=$1 shift libname=`eval "\\$ECHO \"$libname_spec\""` # use dlname if we got it. it's perfectly good, no? if test -n "$dlname"; then soname=$dlname elif test -n "$soname_spec"; then # bleh windows case $host in *cygwin* | mingw* | *cegcc* | *os2*) func_arith $current - $age major=$func_arith_result versuffix=-$major ;; esac eval soname=\"$soname_spec\" else soname=$realname fi # Make a new name for the extract_expsyms_cmds to use soroot=$soname func_basename "$soroot" soname=$func_basename_result func_stripname 'lib' '.dll' "$soname" newlib=libimp-$func_stripname_result.a # If the library has no export list, then create one now if test -f "$output_objdir/$soname-def"; then : else func_verbose "extracting exported symbol list from '$soname'" func_execute_cmds "$extract_expsyms_cmds" 'exit $?' fi # Create $newlib if test -f "$output_objdir/$newlib"; then :; else func_verbose "generating import library for '$soname'" func_execute_cmds "$old_archive_from_expsyms_cmds" 'exit $?' fi # make sure the library variables are pointing to the new library dir=$output_objdir linklib=$newlib fi # test -n "$old_archive_from_expsyms_cmds" if test prog = "$linkmode" || test relink != "$opt_mode"; then add_shlibpath= add_dir= add= lib_linked=yes case $hardcode_action in immediate | unsupported) if test no = "$hardcode_direct"; then add=$dir/$linklib case $host in *-*-sco3.2v5.0.[024]*) add_dir=-L$dir ;; *-*-sysv4*uw2*) add_dir=-L$dir ;; *-*-sysv5OpenUNIX* | *-*-sysv5UnixWare7.[01].[10]* | \ *-*-unixware7*) add_dir=-L$dir ;; *-*-darwin* ) # if the lib is a (non-dlopened) module then we cannot # link against it, someone is ignoring the earlier warnings if /usr/bin/file -L $add 2> /dev/null | $GREP ": [^:]* bundle" >/dev/null; then if test "X$dlopenmodule" != "X$lib"; then $ECHO "*** Warning: lib $linklib is a module, not a shared library" if test -z "$old_library"; then echo echo "*** And there doesn't seem to be a static archive available" echo "*** The link will probably fail, sorry" else add=$dir/$old_library fi elif test -n "$old_library"; then add=$dir/$old_library fi fi esac elif test no = "$hardcode_minus_L"; then case $host in *-*-sunos*) add_shlibpath=$dir ;; esac add_dir=-L$dir add=-l$name elif test no = "$hardcode_shlibpath_var"; then add_shlibpath=$dir add=-l$name else lib_linked=no fi ;; relink) if test yes = "$hardcode_direct" && test no = "$hardcode_direct_absolute"; then add=$dir/$linklib elif test yes = "$hardcode_minus_L"; then add_dir=-L$absdir # Try looking first in the location we're being installed to. if test -n "$inst_prefix_dir"; then case $libdir in [\\/]*) func_append add_dir " -L$inst_prefix_dir$libdir" ;; esac fi add=-l$name elif test yes = "$hardcode_shlibpath_var"; then add_shlibpath=$dir add=-l$name else lib_linked=no fi ;; *) lib_linked=no ;; esac if test yes != "$lib_linked"; then func_fatal_configuration "unsupported hardcode properties" fi if test -n "$add_shlibpath"; then case :$compile_shlibpath: in *":$add_shlibpath:"*) ;; *) func_append compile_shlibpath "$add_shlibpath:" ;; esac fi if test prog = "$linkmode"; then test -n "$add_dir" && compile_deplibs="$add_dir $compile_deplibs" test -n "$add" && compile_deplibs="$add $compile_deplibs" else test -n "$add_dir" && deplibs="$add_dir $deplibs" test -n "$add" && deplibs="$add $deplibs" if test yes != "$hardcode_direct" && test yes != "$hardcode_minus_L" && test yes = "$hardcode_shlibpath_var"; then case :$finalize_shlibpath: in *":$libdir:"*) ;; *) func_append finalize_shlibpath "$libdir:" ;; esac fi fi fi if test prog = "$linkmode" || test relink = "$opt_mode"; then add_shlibpath= add_dir= add= # Finalize command for both is simple: just hardcode it. if test yes = "$hardcode_direct" && test no = "$hardcode_direct_absolute"; then add=$libdir/$linklib elif test yes = "$hardcode_minus_L"; then add_dir=-L$libdir add=-l$name elif test yes = "$hardcode_shlibpath_var"; then case :$finalize_shlibpath: in *":$libdir:"*) ;; *) func_append finalize_shlibpath "$libdir:" ;; esac add=-l$name elif test yes = "$hardcode_automatic"; then if test -n "$inst_prefix_dir" && test -f "$inst_prefix_dir$libdir/$linklib"; then add=$inst_prefix_dir$libdir/$linklib else add=$libdir/$linklib fi else # We cannot seem to hardcode it, guess we'll fake it. add_dir=-L$libdir # Try looking first in the location we're being installed to. if test -n "$inst_prefix_dir"; then case $libdir in [\\/]*) func_append add_dir " -L$inst_prefix_dir$libdir" ;; esac fi add=-l$name fi if test prog = "$linkmode"; then test -n "$add_dir" && finalize_deplibs="$add_dir $finalize_deplibs" test -n "$add" && finalize_deplibs="$add $finalize_deplibs" else test -n "$add_dir" && deplibs="$add_dir $deplibs" test -n "$add" && deplibs="$add $deplibs" fi fi elif test prog = "$linkmode"; then # Here we assume that one of hardcode_direct or hardcode_minus_L # is not unsupported. This is valid on all known static and # shared platforms. if test unsupported != "$hardcode_direct"; then test -n "$old_library" && linklib=$old_library compile_deplibs="$dir/$linklib $compile_deplibs" finalize_deplibs="$dir/$linklib $finalize_deplibs" else compile_deplibs="-l$name -L$dir $compile_deplibs" finalize_deplibs="-l$name -L$dir $finalize_deplibs" fi elif test yes = "$build_libtool_libs"; then # Not a shared library if test pass_all != "$deplibs_check_method"; then # We're trying link a shared library against a static one # but the system doesn't support it. # Just print a warning and add the library to dependency_libs so # that the program can be linked against the static library. echo $ECHO "*** Warning: This system cannot link to static lib archive $lib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have." if test yes = "$module"; then echo "*** But as you try to build a module library, libtool will still create " echo "*** a static module, that should work as long as the dlopening application" echo "*** is linked with the -dlopen flag to resolve symbols at runtime." if test -z "$global_symbol_pipe"; then echo echo "*** However, this would only work if libtool was able to extract symbol" echo "*** lists from a program, using 'nm' or equivalent, but libtool could" echo "*** not find such a program. So, this module is probably useless." echo "*** 'nm' from GNU binutils and a full rebuild may help." fi if test no = "$build_old_libs"; then build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi fi else deplibs="$dir/$old_library $deplibs" link_static=yes fi fi # link shared/static library? if test lib = "$linkmode"; then if test -n "$dependency_libs" && { test yes != "$hardcode_into_libs" || test yes = "$build_old_libs" || test yes = "$link_static"; }; then # Extract -R from dependency_libs temp_deplibs= for libdir in $dependency_libs; do case $libdir in -R*) func_stripname '-R' '' "$libdir" temp_xrpath=$func_stripname_result case " $xrpath " in *" $temp_xrpath "*) ;; *) func_append xrpath " $temp_xrpath";; esac;; *) func_append temp_deplibs " $libdir";; esac done dependency_libs=$temp_deplibs fi func_append newlib_search_path " $absdir" # Link against this library test no = "$link_static" && newdependency_libs="$abs_ladir/$laname $newdependency_libs" # ... and its dependency_libs tmp_libs= for deplib in $dependency_libs; do newdependency_libs="$deplib $newdependency_libs" case $deplib in -L*) func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result";; *) func_resolve_sysroot "$deplib" ;; esac if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $func_resolve_sysroot_result "*) func_append specialdeplibs " $func_resolve_sysroot_result" ;; esac fi func_append tmp_libs " $func_resolve_sysroot_result" done if test no != "$link_all_deplibs"; then # Add the search paths of all dependency libraries for deplib in $dependency_libs; do path= case $deplib in -L*) path=$deplib ;; *.la) func_resolve_sysroot "$deplib" deplib=$func_resolve_sysroot_result func_dirname "$deplib" "" "." dir=$func_dirname_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) absdir=$dir ;; *) absdir=`cd "$dir" && pwd` if test -z "$absdir"; then func_warning "cannot determine absolute directory name of '$dir'" absdir=$dir fi ;; esac if $GREP "^installed=no" $deplib > /dev/null; then case $host in *-*-darwin*) depdepl= eval deplibrary_names=`$SED -n -e 's/^library_names=\(.*\)$/\1/p' $deplib` if test -n "$deplibrary_names"; then for tmp in $deplibrary_names; do depdepl=$tmp done if test -f "$absdir/$objdir/$depdepl"; then depdepl=$absdir/$objdir/$depdepl darwin_install_name=`$OTOOL -L $depdepl | awk '{if (NR == 2) {print $1;exit}}'` if test -z "$darwin_install_name"; then darwin_install_name=`$OTOOL64 -L $depdepl | awk '{if (NR == 2) {print $1;exit}}'` fi func_append compiler_flags " $wl-dylib_file $wl$darwin_install_name:$depdepl" func_append linker_flags " -dylib_file $darwin_install_name:$depdepl" path= fi fi ;; *) path=-L$absdir/$objdir ;; esac else eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $deplib` test -z "$libdir" && \ func_fatal_error "'$deplib' is not a valid libtool archive" test "$absdir" != "$libdir" && \ func_warning "'$deplib' seems to be moved" path=-L$absdir fi ;; esac case " $deplibs " in *" $path "*) ;; *) deplibs="$path $deplibs" ;; esac done fi # link_all_deplibs != no fi # linkmode = lib done # for deplib in $libs if test link = "$pass"; then if test prog = "$linkmode"; then compile_deplibs="$new_inherited_linker_flags $compile_deplibs" finalize_deplibs="$new_inherited_linker_flags $finalize_deplibs" else compiler_flags="$compiler_flags "`$ECHO " $new_inherited_linker_flags" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` fi fi dependency_libs=$newdependency_libs if test dlpreopen = "$pass"; then # Link the dlpreopened libraries before other libraries for deplib in $save_deplibs; do deplibs="$deplib $deplibs" done fi if test dlopen != "$pass"; then test conv = "$pass" || { # Make sure lib_search_path contains only unique directories. lib_search_path= for dir in $newlib_search_path; do case "$lib_search_path " in *" $dir "*) ;; *) func_append lib_search_path " $dir" ;; esac done newlib_search_path= } if test prog,link = "$linkmode,$pass"; then vars="compile_deplibs finalize_deplibs" else vars=deplibs fi for var in $vars dependency_libs; do # Add libraries to $var in reverse order eval tmp_libs=\"\$$var\" new_libs= for deplib in $tmp_libs; do # FIXME: Pedantically, this is the right thing to do, so # that some nasty dependency loop isn't accidentally # broken: #new_libs="$deplib $new_libs" # Pragmatically, this seems to cause very few problems in # practice: case $deplib in -L*) new_libs="$deplib $new_libs" ;; -R*) ;; *) # And here is the reason: when a library appears more # than once as an explicit dependence of a library, or # is implicitly linked in more than once by the # compiler, it is considered special, and multiple # occurrences thereof are not removed. Compare this # with having the same library being listed as a # dependency of multiple other libraries: in this case, # we know (pedantically, we assume) the library does not # need to be listed more than once, so we keep only the # last copy. This is not always right, but it is rare # enough that we require users that really mean to play # such unportable linking tricks to link the library # using -Wl,-lname, so that libtool does not consider it # for duplicate removal. case " $specialdeplibs " in *" $deplib "*) new_libs="$deplib $new_libs" ;; *) case " $new_libs " in *" $deplib "*) ;; *) new_libs="$deplib $new_libs" ;; esac ;; esac ;; esac done tmp_libs= for deplib in $new_libs; do case $deplib in -L*) case " $tmp_libs " in *" $deplib "*) ;; *) func_append tmp_libs " $deplib" ;; esac ;; *) func_append tmp_libs " $deplib" ;; esac done eval $var=\"$tmp_libs\" done # for var fi # Add Sun CC postdeps if required: test CXX = "$tagname" && { case $host_os in linux*) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 func_suncc_cstd_abi if test no != "$suncc_use_cstd_abi"; then func_append postdeps ' -library=Cstd -library=Crun' fi ;; esac ;; solaris*) func_cc_basename "$CC" case $func_cc_basename_result in CC* | sunCC*) func_suncc_cstd_abi if test no != "$suncc_use_cstd_abi"; then func_append postdeps ' -library=Cstd -library=Crun' fi ;; esac ;; esac } # Last step: remove runtime libs from dependency_libs # (they stay in deplibs) tmp_libs= for i in $dependency_libs; do case " $predeps $postdeps $compiler_lib_search_path " in *" $i "*) i= ;; esac if test -n "$i"; then func_append tmp_libs " $i" fi done dependency_libs=$tmp_libs done # for pass if test prog = "$linkmode"; then dlfiles=$newdlfiles fi if test prog = "$linkmode" || test lib = "$linkmode"; then dlprefiles=$newdlprefiles fi case $linkmode in oldlib) if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then func_warning "'-dlopen' is ignored for archives" fi case " $deplibs" in *\ -l* | *\ -L*) func_warning "'-l' and '-L' are ignored for archives" ;; esac test -n "$rpath" && \ func_warning "'-rpath' is ignored for archives" test -n "$xrpath" && \ func_warning "'-R' is ignored for archives" test -n "$vinfo" && \ func_warning "'-version-info/-version-number' is ignored for archives" test -n "$release" && \ func_warning "'-release' is ignored for archives" test -n "$export_symbols$export_symbols_regex" && \ func_warning "'-export-symbols' is ignored for archives" # Now set the variables for building old libraries. build_libtool_libs=no oldlibs=$output func_append objs "$old_deplibs" ;; lib) # Make sure we only generate libraries of the form 'libNAME.la'. case $outputname in lib*) func_stripname 'lib' '.la' "$outputname" name=$func_stripname_result eval shared_ext=\"$shrext_cmds\" eval libname=\"$libname_spec\" ;; *) test no = "$module" \ && func_fatal_help "libtool library '$output' must begin with 'lib'" if test no != "$need_lib_prefix"; then # Add the "lib" prefix for modules if required func_stripname '' '.la' "$outputname" name=$func_stripname_result eval shared_ext=\"$shrext_cmds\" eval libname=\"$libname_spec\" else func_stripname '' '.la' "$outputname" libname=$func_stripname_result fi ;; esac if test -n "$objs"; then if test pass_all != "$deplibs_check_method"; then func_fatal_error "cannot build libtool library '$output' from non-libtool objects on this host:$objs" else echo $ECHO "*** Warning: Linking the shared library $output against the non-libtool" $ECHO "*** objects $objs is not portable!" func_append libobjs " $objs" fi fi test no = "$dlself" \ || func_warning "'-dlopen self' is ignored for libtool libraries" set dummy $rpath shift test 1 -lt "$#" \ && func_warning "ignoring multiple '-rpath's for a libtool library" install_libdir=$1 oldlibs= if test -z "$rpath"; then if test yes = "$build_libtool_libs"; then # Building a libtool convenience library. # Some compilers have problems with a '.al' extension so # convenience libraries should have the same extension an # archive normally would. oldlibs="$output_objdir/$libname.$libext $oldlibs" build_libtool_libs=convenience build_old_libs=yes fi test -n "$vinfo" && \ func_warning "'-version-info/-version-number' is ignored for convenience libraries" test -n "$release" && \ func_warning "'-release' is ignored for convenience libraries" else # Parse the version information argument. save_ifs=$IFS; IFS=: set dummy $vinfo 0 0 0 shift IFS=$save_ifs test -n "$7" && \ func_fatal_help "too many parameters to '-version-info'" # convert absolute version numbers to libtool ages # this retains compatibility with .la files and attempts # to make the code below a bit more comprehensible case $vinfo_number in yes) number_major=$1 number_minor=$2 number_revision=$3 # # There are really only two kinds -- those that # use the current revision as the major version # and those that subtract age and use age as # a minor version. But, then there is irix # that has an extra 1 added just for fun # case $version_type in # correct linux to gnu/linux during the next big refactor darwin|freebsd-elf|linux|osf|windows|none) func_arith $number_major + $number_minor current=$func_arith_result age=$number_minor revision=$number_revision ;; freebsd-aout|qnx|sunos) current=$number_major revision=$number_minor age=0 ;; irix|nonstopux) func_arith $number_major + $number_minor current=$func_arith_result age=$number_minor revision=$number_minor lt_irix_increment=no ;; *) func_fatal_configuration "$modename: unknown library version type '$version_type'" ;; esac ;; no) current=$1 revision=$2 age=$3 ;; esac # Check that each of the things are valid numbers. case $current in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "CURRENT '$current' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac case $revision in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "REVISION '$revision' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac case $age in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "AGE '$age' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac if test "$age" -gt "$current"; then func_error "AGE '$age' is greater than the current interface number '$current'" func_fatal_error "'$vinfo' is not valid version information" fi # Calculate the version variables. major= versuffix= verstring= case $version_type in none) ;; darwin) # Like Linux, but with the current version available in # verstring for coding it into the library header func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision # Darwin ld doesn't like 0 for these options... func_arith $current + 1 minor_current=$func_arith_result xlcverstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision" verstring="-compatibility_version $minor_current -current_version $minor_current.$revision" # On Darwin other compilers case $CC in nagfor*) verstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision" ;; *) verstring="-compatibility_version $minor_current -current_version $minor_current.$revision" ;; esac ;; freebsd-aout) major=.$current versuffix=.$current.$revision ;; freebsd-elf) func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision ;; irix | nonstopux) if test no = "$lt_irix_increment"; then func_arith $current - $age else func_arith $current - $age + 1 fi major=$func_arith_result case $version_type in nonstopux) verstring_prefix=nonstopux ;; *) verstring_prefix=sgi ;; esac verstring=$verstring_prefix$major.$revision # Add in all the interfaces that we are compatible with. loop=$revision while test 0 -ne "$loop"; do func_arith $revision - $loop iface=$func_arith_result func_arith $loop - 1 loop=$func_arith_result verstring=$verstring_prefix$major.$iface:$verstring done # Before this point, $major must not contain '.'. major=.$major versuffix=$major.$revision ;; linux) # correct to gnu/linux during the next big refactor func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision ;; osf) func_arith $current - $age major=.$func_arith_result versuffix=.$current.$age.$revision verstring=$current.$age.$revision # Add in all the interfaces that we are compatible with. loop=$age while test 0 -ne "$loop"; do func_arith $current - $loop iface=$func_arith_result func_arith $loop - 1 loop=$func_arith_result verstring=$verstring:$iface.0 done # Make executables depend on our current version. func_append verstring ":$current.0" ;; qnx) major=.$current versuffix=.$current ;; sco) major=.$current versuffix=.$current ;; sunos) major=.$current versuffix=.$current.$revision ;; windows) # Use '-' rather than '.', since we only want one # extension on DOS 8.3 file systems. func_arith $current - $age major=$func_arith_result versuffix=-$major ;; *) func_fatal_configuration "unknown library version type '$version_type'" ;; esac # Clear the version info if we defaulted, and they specified a release. if test -z "$vinfo" && test -n "$release"; then major= case $version_type in darwin) # we can't check for "0.0" in archive_cmds due to quoting # problems, so we reset it completely verstring= ;; *) verstring=0.0 ;; esac if test no = "$need_version"; then versuffix= else versuffix=.0.0 fi fi # Remove version info from name if versioning should be avoided if test yes,no = "$avoid_version,$need_version"; then major= versuffix= verstring= fi # Check to see if the archive will have undefined symbols. if test yes = "$allow_undefined"; then if test unsupported = "$allow_undefined_flag"; then if test yes = "$build_old_libs"; then func_warning "undefined symbols not allowed in $host shared libraries; building static only" build_libtool_libs=no else func_fatal_error "can't build $host shared library unless -no-undefined is specified" fi fi else # Don't allow undefined symbols. allow_undefined_flag=$no_undefined_flag fi fi func_generate_dlsyms "$libname" "$libname" : func_append libobjs " $symfileobj" test " " = "$libobjs" && libobjs= if test relink != "$opt_mode"; then # Remove our outputs, but don't remove object files since they # may have been created when compiling PIC objects. removelist= tempremovelist=`$ECHO "$output_objdir/*"` for p in $tempremovelist; do case $p in *.$objext | *.gcno) ;; $output_objdir/$outputname | $output_objdir/$libname.* | $output_objdir/$libname$release.*) if test -n "$precious_files_regex"; then if $ECHO "$p" | $EGREP -e "$precious_files_regex" >/dev/null 2>&1 then continue fi fi func_append removelist " $p" ;; *) ;; esac done test -n "$removelist" && \ func_show_eval "${RM}r \$removelist" fi # Now set the variables for building old libraries. if test yes = "$build_old_libs" && test convenience != "$build_libtool_libs"; then func_append oldlibs " $output_objdir/$libname.$libext" # Transform .lo files to .o files. oldobjs="$objs "`$ECHO "$libobjs" | $SP2NL | $SED "/\.$libext$/d; $lo2o" | $NL2SP` fi # Eliminate all temporary directories. #for path in $notinst_path; do # lib_search_path=`$ECHO "$lib_search_path " | $SED "s% $path % %g"` # deplibs=`$ECHO "$deplibs " | $SED "s% -L$path % %g"` # dependency_libs=`$ECHO "$dependency_libs " | $SED "s% -L$path % %g"` #done if test -n "$xrpath"; then # If the user specified any rpath flags, then add them. temp_xrpath= for libdir in $xrpath; do func_replace_sysroot "$libdir" func_append temp_xrpath " -R$func_replace_sysroot_result" case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac done if test yes != "$hardcode_into_libs" || test yes = "$build_old_libs"; then dependency_libs="$temp_xrpath $dependency_libs" fi fi # Make sure dlfiles contains only unique files that won't be dlpreopened old_dlfiles=$dlfiles dlfiles= for lib in $old_dlfiles; do case " $dlprefiles $dlfiles " in *" $lib "*) ;; *) func_append dlfiles " $lib" ;; esac done # Make sure dlprefiles contains only unique files old_dlprefiles=$dlprefiles dlprefiles= for lib in $old_dlprefiles; do case "$dlprefiles " in *" $lib "*) ;; *) func_append dlprefiles " $lib" ;; esac done if test yes = "$build_libtool_libs"; then if test -n "$rpath"; then case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-*-beos* | *-cegcc* | *-*-haiku*) # these systems don't actually have a c library (as such)! ;; *-*-rhapsody* | *-*-darwin1.[012]) # Rhapsody C library is in the System framework func_append deplibs " System.ltframework" ;; *-*-netbsd*) # Don't link with libc until the a.out ld.so is fixed. ;; *-*-openbsd* | *-*-freebsd* | *-*-dragonfly*) # Do not include libc due to us having libc/libc_r. ;; *-*-sco3.2v5* | *-*-sco5v6*) # Causes problems with __ctype ;; *-*-sysv4.2uw2* | *-*-sysv5* | *-*-unixware* | *-*-OpenUNIX*) # Compiler inserts libc in the correct place for threads to work ;; *) # Add libc to deplibs on all other systems if necessary. if test yes = "$build_libtool_need_lc"; then func_append deplibs " -lc" fi ;; esac fi # Transform deplibs into only deplibs that can be linked in shared. name_save=$name libname_save=$libname release_save=$release versuffix_save=$versuffix major_save=$major # I'm not sure if I'm treating the release correctly. I think # release should show up in the -l (ie -lgmp5) so we don't want to # add it in twice. Is that correct? release= versuffix= major= newdeplibs= droppeddeps=no case $deplibs_check_method in pass_all) # Don't check for shared/static. Everything works. # This might be a little naive. We might want to check # whether the library exists or not. But this is on # osf3 & osf4 and I'm not really sure... Just # implementing what was already the behavior. newdeplibs=$deplibs ;; test_compile) # This code stresses the "libraries are programs" paradigm to its # limits. Maybe even breaks it. We compile a program, linking it # against the deplibs as a proxy for the library. Then we can check # whether they linked in statically or dynamically with ldd. $opt_dry_run || $RM conftest.c cat > conftest.c </dev/null` $nocaseglob else potential_libs=`ls $i/$libnameglob[.-]* 2>/dev/null` fi for potent_lib in $potential_libs; do # Follow soft links. if ls -lLd "$potent_lib" 2>/dev/null | $GREP " -> " >/dev/null; then continue fi # The statement above tries to avoid entering an # endless loop below, in case of cyclic links. # We might still enter an endless loop, since a link # loop can be closed while we follow links, # but so what? potlib=$potent_lib while test -h "$potlib" 2>/dev/null; do potliblink=`ls -ld $potlib | $SED 's/.* -> //'` case $potliblink in [\\/]* | [A-Za-z]:[\\/]*) potlib=$potliblink;; *) potlib=`$ECHO "$potlib" | $SED 's|[^/]*$||'`"$potliblink";; esac done if eval $file_magic_cmd \"\$potlib\" 2>/dev/null | $SED -e 10q | $EGREP "$file_magic_regex" > /dev/null; then func_append newdeplibs " $a_deplib" a_deplib= break 2 fi done done fi if test -n "$a_deplib"; then droppeddeps=yes echo $ECHO "*** Warning: linker path does not have real file for library $a_deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because I did check the linker path looking for a file starting" if test -z "$potlib"; then $ECHO "*** with $libname but no candidates were found. (...for file magic test)" else $ECHO "*** with $libname and none of the candidates passed a file format test" $ECHO "*** using a file magic. Last file checked: $potlib" fi fi ;; *) # Add a -L argument. func_append newdeplibs " $a_deplib" ;; esac done # Gone through all deplibs. ;; match_pattern*) set dummy $deplibs_check_method; shift match_pattern_regex=`expr "$deplibs_check_method" : "$1 \(.*\)"` for a_deplib in $deplibs; do case $a_deplib in -l*) func_stripname -l '' "$a_deplib" name=$func_stripname_result if test yes = "$allow_libtool_libs_with_static_runtimes"; then case " $predeps $postdeps " in *" $a_deplib "*) func_append newdeplibs " $a_deplib" a_deplib= ;; esac fi if test -n "$a_deplib"; then libname=`eval "\\$ECHO \"$libname_spec\""` for i in $lib_search_path $sys_lib_search_path $shlib_search_path; do potential_libs=`ls $i/$libname[.-]* 2>/dev/null` for potent_lib in $potential_libs; do potlib=$potent_lib # see symlink-check above in file_magic test if eval "\$ECHO \"$potent_lib\"" 2>/dev/null | $SED 10q | \ $EGREP "$match_pattern_regex" > /dev/null; then func_append newdeplibs " $a_deplib" a_deplib= break 2 fi done done fi if test -n "$a_deplib"; then droppeddeps=yes echo $ECHO "*** Warning: linker path does not have real file for library $a_deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because I did check the linker path looking for a file starting" if test -z "$potlib"; then $ECHO "*** with $libname but no candidates were found. (...for regex pattern test)" else $ECHO "*** with $libname and none of the candidates passed a file format test" $ECHO "*** using a regex pattern. Last file checked: $potlib" fi fi ;; *) # Add a -L argument. func_append newdeplibs " $a_deplib" ;; esac done # Gone through all deplibs. ;; none | unknown | *) newdeplibs= tmp_deplibs=`$ECHO " $deplibs" | $SED 's/ -lc$//; s/ -[LR][^ ]*//g'` if test yes = "$allow_libtool_libs_with_static_runtimes"; then for i in $predeps $postdeps; do # can't use Xsed below, because $i might contain '/' tmp_deplibs=`$ECHO " $tmp_deplibs" | $SED "s|$i||"` done fi case $tmp_deplibs in *[!\ \ ]*) echo if test none = "$deplibs_check_method"; then echo "*** Warning: inter-library dependencies are not supported in this platform." else echo "*** Warning: inter-library dependencies are not known to be supported." fi echo "*** All declared inter-library dependencies are being dropped." droppeddeps=yes ;; esac ;; esac versuffix=$versuffix_save major=$major_save release=$release_save libname=$libname_save name=$name_save case $host in *-*-rhapsody* | *-*-darwin1.[012]) # On Rhapsody replace the C library with the System framework newdeplibs=`$ECHO " $newdeplibs" | $SED 's/ -lc / System.ltframework /'` ;; esac if test yes = "$droppeddeps"; then if test yes = "$module"; then echo echo "*** Warning: libtool could not satisfy all declared inter-library" $ECHO "*** dependencies of module $libname. Therefore, libtool will create" echo "*** a static module, that should work as long as the dlopening" echo "*** application is linked with the -dlopen flag." if test -z "$global_symbol_pipe"; then echo echo "*** However, this would only work if libtool was able to extract symbol" echo "*** lists from a program, using 'nm' or equivalent, but libtool could" echo "*** not find such a program. So, this module is probably useless." echo "*** 'nm' from GNU binutils and a full rebuild may help." fi if test no = "$build_old_libs"; then oldlibs=$output_objdir/$libname.$libext build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi else echo "*** The inter-library dependencies that have been dropped here will be" echo "*** automatically added whenever a program is linked with this library" echo "*** or is declared to -dlopen it." if test no = "$allow_undefined"; then echo echo "*** Since this library must not contain undefined symbols," echo "*** because either the platform does not support them or" echo "*** it was explicitly requested with -no-undefined," echo "*** libtool will only create a static version of it." if test no = "$build_old_libs"; then oldlibs=$output_objdir/$libname.$libext build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi fi fi fi # Done checking deplibs! deplibs=$newdeplibs fi # Time to change all our "foo.ltframework" stuff back to "-framework foo" case $host in *-*-darwin*) newdeplibs=`$ECHO " $newdeplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` new_inherited_linker_flags=`$ECHO " $new_inherited_linker_flags" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` deplibs=`$ECHO " $deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` ;; esac # move library search paths that coincide with paths to not yet # installed libraries to the beginning of the library search list new_libs= for path in $notinst_path; do case " $new_libs " in *" -L$path/$objdir "*) ;; *) case " $deplibs " in *" -L$path/$objdir "*) func_append new_libs " -L$path/$objdir" ;; esac ;; esac done for deplib in $deplibs; do case $deplib in -L*) case " $new_libs " in *" $deplib "*) ;; *) func_append new_libs " $deplib" ;; esac ;; *) func_append new_libs " $deplib" ;; esac done deplibs=$new_libs # All the library-specific variables (install_libdir is set above). library_names= old_library= dlname= # Test again, we may have decided not to build it any more if test yes = "$build_libtool_libs"; then # Remove $wl instances when linking with ld. # FIXME: should test the right _cmds variable. case $archive_cmds in *\$LD\ *) wl= ;; esac if test yes = "$hardcode_into_libs"; then # Hardcode the library paths hardcode_libdirs= dep_rpath= rpath=$finalize_rpath test relink = "$opt_mode" || rpath=$compile_rpath$rpath for libdir in $rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then func_replace_sysroot "$libdir" libdir=$func_replace_sysroot_result if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append dep_rpath " $flag" fi elif test -n "$runpath_var"; then case "$perm_rpath " in *" $libdir "*) ;; *) func_append perm_rpath " $libdir" ;; esac fi done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval "dep_rpath=\"$hardcode_libdir_flag_spec\"" fi if test -n "$runpath_var" && test -n "$perm_rpath"; then # We should set the runpath_var. rpath= for dir in $perm_rpath; do func_append rpath "$dir:" done eval "$runpath_var='$rpath\$$runpath_var'; export $runpath_var" fi test -n "$dep_rpath" && deplibs="$dep_rpath $deplibs" fi shlibpath=$finalize_shlibpath test relink = "$opt_mode" || shlibpath=$compile_shlibpath$shlibpath if test -n "$shlibpath"; then eval "$shlibpath_var='$shlibpath\$$shlibpath_var'; export $shlibpath_var" fi # Get the real and link names of the library. eval shared_ext=\"$shrext_cmds\" eval library_names=\"$library_names_spec\" set dummy $library_names shift realname=$1 shift if test -n "$soname_spec"; then eval soname=\"$soname_spec\" else soname=$realname fi if test -z "$dlname"; then dlname=$soname fi lib=$output_objdir/$realname linknames= for link do func_append linknames " $link" done # Use standard objects if they are pic test -z "$pic_flag" && libobjs=`$ECHO "$libobjs" | $SP2NL | $SED "$lo2o" | $NL2SP` test "X$libobjs" = "X " && libobjs= delfiles= if test -n "$export_symbols" && test -n "$include_expsyms"; then $opt_dry_run || cp "$export_symbols" "$output_objdir/$libname.uexp" export_symbols=$output_objdir/$libname.uexp func_append delfiles " $export_symbols" fi orig_export_symbols= case $host_os in cygwin* | mingw* | cegcc*) if test -n "$export_symbols" && test -z "$export_symbols_regex"; then # exporting using user supplied symfile func_dll_def_p "$export_symbols" || { # and it's NOT already a .def file. Must figure out # which of the given symbols are data symbols and tag # them as such. So, trigger use of export_symbols_cmds. # export_symbols gets reassigned inside the "prepare # the list of exported symbols" if statement, so the # include_expsyms logic still works. orig_export_symbols=$export_symbols export_symbols= always_export_symbols=yes } fi ;; esac # Prepare the list of exported symbols if test -z "$export_symbols"; then if test yes = "$always_export_symbols" || test -n "$export_symbols_regex"; then func_verbose "generating symbol list for '$libname.la'" export_symbols=$output_objdir/$libname.exp $opt_dry_run || $RM $export_symbols cmds=$export_symbols_cmds save_ifs=$IFS; IFS='~' for cmd1 in $cmds; do IFS=$save_ifs # Take the normal branch if the nm_file_list_spec branch # doesn't work or if tool conversion is not needed. case $nm_file_list_spec~$to_tool_file_cmd in *~func_convert_file_noop | *~func_convert_file_msys_to_w32 | ~*) try_normal_branch=yes eval cmd=\"$cmd1\" func_len " $cmd" len=$func_len_result ;; *) try_normal_branch=no ;; esac if test yes = "$try_normal_branch" \ && { test "$len" -lt "$max_cmd_len" \ || test "$max_cmd_len" -le -1; } then func_show_eval "$cmd" 'exit $?' skipped_export=false elif test -n "$nm_file_list_spec"; then func_basename "$output" output_la=$func_basename_result save_libobjs=$libobjs save_output=$output output=$output_objdir/$output_la.nm func_to_tool_file "$output" libobjs=$nm_file_list_spec$func_to_tool_file_result func_append delfiles " $output" func_verbose "creating $NM input file list: $output" for obj in $save_libobjs; do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" done > "$output" eval cmd=\"$cmd1\" func_show_eval "$cmd" 'exit $?' output=$save_output libobjs=$save_libobjs skipped_export=false else # The command line is too long to execute in one step. func_verbose "using reloadable object file for export list..." skipped_export=: # Break out early, otherwise skipped_export may be # set to false by a later but shorter cmd. break fi done IFS=$save_ifs if test -n "$export_symbols_regex" && test : != "$skipped_export"; then func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"' func_show_eval '$MV "${export_symbols}T" "$export_symbols"' fi fi fi if test -n "$export_symbols" && test -n "$include_expsyms"; then tmp_export_symbols=$export_symbols test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols $opt_dry_run || eval '$ECHO "$include_expsyms" | $SP2NL >> "$tmp_export_symbols"' fi if test : != "$skipped_export" && test -n "$orig_export_symbols"; then # The given exports_symbols file has to be filtered, so filter it. func_verbose "filter symbol list for '$libname.la' to tag DATA exports" # FIXME: $output_objdir/$libname.filter potentially contains lots of # 's' commands, which not all seds can handle. GNU sed should be fine # though. Also, the filter scales superlinearly with the number of # global variables. join(1) would be nice here, but unfortunately # isn't a blessed tool. $opt_dry_run || $SED -e '/[ ,]DATA/!d;s,\(.*\)\([ \,].*\),s|^\1$|\1\2|,' < $export_symbols > $output_objdir/$libname.filter func_append delfiles " $export_symbols $output_objdir/$libname.filter" export_symbols=$output_objdir/$libname.def $opt_dry_run || $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols fi tmp_deplibs= for test_deplib in $deplibs; do case " $convenience " in *" $test_deplib "*) ;; *) func_append tmp_deplibs " $test_deplib" ;; esac done deplibs=$tmp_deplibs if test -n "$convenience"; then if test -n "$whole_archive_flag_spec" && test yes = "$compiler_needs_object" && test -z "$libobjs"; then # extract the archives, so we have objects to list. # TODO: could optimize this to just extract one archive. whole_archive_flag_spec= fi if test -n "$whole_archive_flag_spec"; then save_libobjs=$libobjs eval libobjs=\"\$libobjs $whole_archive_flag_spec\" test "X$libobjs" = "X " && libobjs= else gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $convenience func_append libobjs " $func_extract_archives_result" test "X$libobjs" = "X " && libobjs= fi fi if test yes = "$thread_safe" && test -n "$thread_safe_flag_spec"; then eval flag=\"$thread_safe_flag_spec\" func_append linker_flags " $flag" fi # Make a backup of the uninstalled library when relinking if test relink = "$opt_mode"; then $opt_dry_run || eval '(cd $output_objdir && $RM ${realname}U && $MV $realname ${realname}U)' || exit $? fi # Do each of the archive commands. if test yes = "$module" && test -n "$module_cmds"; then if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then eval test_cmds=\"$module_expsym_cmds\" cmds=$module_expsym_cmds else eval test_cmds=\"$module_cmds\" cmds=$module_cmds fi else if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then eval test_cmds=\"$archive_expsym_cmds\" cmds=$archive_expsym_cmds else eval test_cmds=\"$archive_cmds\" cmds=$archive_cmds fi fi if test : != "$skipped_export" && func_len " $test_cmds" && len=$func_len_result && test "$len" -lt "$max_cmd_len" || test "$max_cmd_len" -le -1; then : else # The command line is too long to link in one step, link piecewise # or, if using GNU ld and skipped_export is not :, use a linker # script. # Save the value of $output and $libobjs because we want to # use them later. If we have whole_archive_flag_spec, we # want to use save_libobjs as it was before # whole_archive_flag_spec was expanded, because we can't # assume the linker understands whole_archive_flag_spec. # This may have to be revisited, in case too many # convenience libraries get linked in and end up exceeding # the spec. if test -z "$convenience" || test -z "$whole_archive_flag_spec"; then save_libobjs=$libobjs fi save_output=$output func_basename "$output" output_la=$func_basename_result # Clear the reloadable object creation command queue and # initialize k to one. test_cmds= concat_cmds= objlist= last_robj= k=1 if test -n "$save_libobjs" && test : != "$skipped_export" && test yes = "$with_gnu_ld"; then output=$output_objdir/$output_la.lnkscript func_verbose "creating GNU ld script: $output" echo 'INPUT (' > $output for obj in $save_libobjs do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" >> $output done echo ')' >> $output func_append delfiles " $output" func_to_tool_file "$output" output=$func_to_tool_file_result elif test -n "$save_libobjs" && test : != "$skipped_export" && test -n "$file_list_spec"; then output=$output_objdir/$output_la.lnk func_verbose "creating linker input file list: $output" : > $output set x $save_libobjs shift firstobj= if test yes = "$compiler_needs_object"; then firstobj="$1 " shift fi for obj do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" >> $output done func_append delfiles " $output" func_to_tool_file "$output" output=$firstobj\"$file_list_spec$func_to_tool_file_result\" else if test -n "$save_libobjs"; then func_verbose "creating reloadable object files..." output=$output_objdir/$output_la-$k.$objext eval test_cmds=\"$reload_cmds\" func_len " $test_cmds" len0=$func_len_result len=$len0 # Loop over the list of objects to be linked. for obj in $save_libobjs do func_len " $obj" func_arith $len + $func_len_result len=$func_arith_result if test -z "$objlist" || test "$len" -lt "$max_cmd_len"; then func_append objlist " $obj" else # The command $test_cmds is almost too long, add a # command to the queue. if test 1 -eq "$k"; then # The first file doesn't have a previous command to add. reload_objs=$objlist eval concat_cmds=\"$reload_cmds\" else # All subsequent reloadable object files will link in # the last one created. reload_objs="$objlist $last_robj" eval concat_cmds=\"\$concat_cmds~$reload_cmds~\$RM $last_robj\" fi last_robj=$output_objdir/$output_la-$k.$objext func_arith $k + 1 k=$func_arith_result output=$output_objdir/$output_la-$k.$objext objlist=" $obj" func_len " $last_robj" func_arith $len0 + $func_len_result len=$func_arith_result fi done # Handle the remaining objects by creating one last # reloadable object file. All subsequent reloadable object # files will link in the last one created. test -z "$concat_cmds" || concat_cmds=$concat_cmds~ reload_objs="$objlist $last_robj" eval concat_cmds=\"\$concat_cmds$reload_cmds\" if test -n "$last_robj"; then eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\" fi func_append delfiles " $output" else output= fi ${skipped_export-false} && { func_verbose "generating symbol list for '$libname.la'" export_symbols=$output_objdir/$libname.exp $opt_dry_run || $RM $export_symbols libobjs=$output # Append the command to create the export file. test -z "$concat_cmds" || concat_cmds=$concat_cmds~ eval concat_cmds=\"\$concat_cmds$export_symbols_cmds\" if test -n "$last_robj"; then eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\" fi } test -n "$save_libobjs" && func_verbose "creating a temporary reloadable object file: $output" # Loop through the commands generated above and execute them. save_ifs=$IFS; IFS='~' for cmd in $concat_cmds; do IFS=$save_ifs $opt_quiet || { func_quote_for_expand "$cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || eval "$cmd" || { lt_exit=$? # Restore the uninstalled library and exit if test relink = "$opt_mode"; then ( cd "$output_objdir" && \ $RM "${realname}T" && \ $MV "${realname}U" "$realname" ) fi exit $lt_exit } done IFS=$save_ifs if test -n "$export_symbols_regex" && ${skipped_export-false}; then func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"' func_show_eval '$MV "${export_symbols}T" "$export_symbols"' fi fi ${skipped_export-false} && { if test -n "$export_symbols" && test -n "$include_expsyms"; then tmp_export_symbols=$export_symbols test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols $opt_dry_run || eval '$ECHO "$include_expsyms" | $SP2NL >> "$tmp_export_symbols"' fi if test -n "$orig_export_symbols"; then # The given exports_symbols file has to be filtered, so filter it. func_verbose "filter symbol list for '$libname.la' to tag DATA exports" # FIXME: $output_objdir/$libname.filter potentially contains lots of # 's' commands, which not all seds can handle. GNU sed should be fine # though. Also, the filter scales superlinearly with the number of # global variables. join(1) would be nice here, but unfortunately # isn't a blessed tool. $opt_dry_run || $SED -e '/[ ,]DATA/!d;s,\(.*\)\([ \,].*\),s|^\1$|\1\2|,' < $export_symbols > $output_objdir/$libname.filter func_append delfiles " $export_symbols $output_objdir/$libname.filter" export_symbols=$output_objdir/$libname.def $opt_dry_run || $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols fi } libobjs=$output # Restore the value of output. output=$save_output if test -n "$convenience" && test -n "$whole_archive_flag_spec"; then eval libobjs=\"\$libobjs $whole_archive_flag_spec\" test "X$libobjs" = "X " && libobjs= fi # Expand the library linking commands again to reset the # value of $libobjs for piecewise linking. # Do each of the archive commands. if test yes = "$module" && test -n "$module_cmds"; then if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then cmds=$module_expsym_cmds else cmds=$module_cmds fi else if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then cmds=$archive_expsym_cmds else cmds=$archive_cmds fi fi fi if test -n "$delfiles"; then # Append the command to remove temporary files to $cmds. eval cmds=\"\$cmds~\$RM $delfiles\" fi # Add any objects from preloaded convenience libraries if test -n "$dlprefiles"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $dlprefiles func_append libobjs " $func_extract_archives_result" test "X$libobjs" = "X " && libobjs= fi save_ifs=$IFS; IFS='~' for cmd in $cmds; do IFS=$sp$nl eval cmd=\"$cmd\" IFS=$save_ifs $opt_quiet || { func_quote_for_expand "$cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || eval "$cmd" || { lt_exit=$? # Restore the uninstalled library and exit if test relink = "$opt_mode"; then ( cd "$output_objdir" && \ $RM "${realname}T" && \ $MV "${realname}U" "$realname" ) fi exit $lt_exit } done IFS=$save_ifs # Restore the uninstalled library and exit if test relink = "$opt_mode"; then $opt_dry_run || eval '(cd $output_objdir && $RM ${realname}T && $MV $realname ${realname}T && $MV ${realname}U $realname)' || exit $? if test -n "$convenience"; then if test -z "$whole_archive_flag_spec"; then func_show_eval '${RM}r "$gentop"' fi fi exit $EXIT_SUCCESS fi # Create links to the real library. for linkname in $linknames; do if test "$realname" != "$linkname"; then func_show_eval '(cd "$output_objdir" && $RM "$linkname" && $LN_S "$realname" "$linkname")' 'exit $?' fi done # If -module or -export-dynamic was specified, set the dlname. if test yes = "$module" || test yes = "$export_dynamic"; then # On all known operating systems, these are identical. dlname=$soname fi fi ;; obj) if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then func_warning "'-dlopen' is ignored for objects" fi case " $deplibs" in *\ -l* | *\ -L*) func_warning "'-l' and '-L' are ignored for objects" ;; esac test -n "$rpath" && \ func_warning "'-rpath' is ignored for objects" test -n "$xrpath" && \ func_warning "'-R' is ignored for objects" test -n "$vinfo" && \ func_warning "'-version-info' is ignored for objects" test -n "$release" && \ func_warning "'-release' is ignored for objects" case $output in *.lo) test -n "$objs$old_deplibs" && \ func_fatal_error "cannot build library object '$output' from non-libtool objects" libobj=$output func_lo2o "$libobj" obj=$func_lo2o_result ;; *) libobj= obj=$output ;; esac # Delete the old objects. $opt_dry_run || $RM $obj $libobj # Objects from convenience libraries. This assumes # single-version convenience libraries. Whenever we create # different ones for PIC/non-PIC, this we'll have to duplicate # the extraction. reload_conv_objs= gentop= # if reload_cmds runs $LD directly, get rid of -Wl from # whole_archive_flag_spec and hope we can get by with turning comma # into space. case $reload_cmds in *\$LD[\ \$]*) wl= ;; esac if test -n "$convenience"; then if test -n "$whole_archive_flag_spec"; then eval tmp_whole_archive_flags=\"$whole_archive_flag_spec\" test -n "$wl" || tmp_whole_archive_flags=`$ECHO "$tmp_whole_archive_flags" | $SED 's|,| |g'` reload_conv_objs=$reload_objs\ $tmp_whole_archive_flags else gentop=$output_objdir/${obj}x func_append generated " $gentop" func_extract_archives $gentop $convenience reload_conv_objs="$reload_objs $func_extract_archives_result" fi fi # If we're not building shared, we need to use non_pic_objs test yes = "$build_libtool_libs" || libobjs=$non_pic_objects # Create the old-style object. reload_objs=$objs$old_deplibs' '`$ECHO "$libobjs" | $SP2NL | $SED "/\.$libext$/d; /\.lib$/d; $lo2o" | $NL2SP`' '$reload_conv_objs output=$obj func_execute_cmds "$reload_cmds" 'exit $?' # Exit if we aren't doing a library object file. if test -z "$libobj"; then if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi exit $EXIT_SUCCESS fi test yes = "$build_libtool_libs" || { if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi # Create an invalid libtool object if no PIC, so that we don't # accidentally link it into a program. # $show "echo timestamp > $libobj" # $opt_dry_run || eval "echo timestamp > $libobj" || exit $? exit $EXIT_SUCCESS } if test -n "$pic_flag" || test default != "$pic_mode"; then # Only do commands if we really have different PIC objects. reload_objs="$libobjs $reload_conv_objs" output=$libobj func_execute_cmds "$reload_cmds" 'exit $?' fi if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi exit $EXIT_SUCCESS ;; prog) case $host in *cygwin*) func_stripname '' '.exe' "$output" output=$func_stripname_result.exe;; esac test -n "$vinfo" && \ func_warning "'-version-info' is ignored for programs" test -n "$release" && \ func_warning "'-release' is ignored for programs" $preload \ && test unknown,unknown,unknown = "$dlopen_support,$dlopen_self,$dlopen_self_static" \ && func_warning "'LT_INIT([dlopen])' not used. Assuming no dlopen support." case $host in *-*-rhapsody* | *-*-darwin1.[012]) # On Rhapsody replace the C library is the System framework compile_deplibs=`$ECHO " $compile_deplibs" | $SED 's/ -lc / System.ltframework /'` finalize_deplibs=`$ECHO " $finalize_deplibs" | $SED 's/ -lc / System.ltframework /'` ;; esac case $host in *-*-darwin*) # Don't allow lazy linking, it breaks C++ global constructors # But is supposedly fixed on 10.4 or later (yay!). if test CXX = "$tagname"; then case ${MACOSX_DEPLOYMENT_TARGET-10.0} in 10.[0123]) func_append compile_command " $wl-bind_at_load" func_append finalize_command " $wl-bind_at_load" ;; esac fi # Time to change all our "foo.ltframework" stuff back to "-framework foo" compile_deplibs=`$ECHO " $compile_deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` finalize_deplibs=`$ECHO " $finalize_deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` ;; esac # move library search paths that coincide with paths to not yet # installed libraries to the beginning of the library search list new_libs= for path in $notinst_path; do case " $new_libs " in *" -L$path/$objdir "*) ;; *) case " $compile_deplibs " in *" -L$path/$objdir "*) func_append new_libs " -L$path/$objdir" ;; esac ;; esac done for deplib in $compile_deplibs; do case $deplib in -L*) case " $new_libs " in *" $deplib "*) ;; *) func_append new_libs " $deplib" ;; esac ;; *) func_append new_libs " $deplib" ;; esac done compile_deplibs=$new_libs func_append compile_command " $compile_deplibs" func_append finalize_command " $finalize_deplibs" if test -n "$rpath$xrpath"; then # If the user specified any rpath flags, then add them. for libdir in $rpath $xrpath; do # This is the magic to use -rpath. case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac done fi # Now hardcode the library paths rpath= hardcode_libdirs= for libdir in $compile_rpath $finalize_rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append rpath " $flag" fi elif test -n "$runpath_var"; then case "$perm_rpath " in *" $libdir "*) ;; *) func_append perm_rpath " $libdir" ;; esac fi case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) testbindir=`$ECHO "$libdir" | $SED -e 's*/lib$*/bin*'` case :$dllsearchpath: in *":$libdir:"*) ;; ::) dllsearchpath=$libdir;; *) func_append dllsearchpath ":$libdir";; esac case :$dllsearchpath: in *":$testbindir:"*) ;; ::) dllsearchpath=$testbindir;; *) func_append dllsearchpath ":$testbindir";; esac ;; esac done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval rpath=\" $hardcode_libdir_flag_spec\" fi compile_rpath=$rpath rpath= hardcode_libdirs= for libdir in $finalize_rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append rpath " $flag" fi elif test -n "$runpath_var"; then case "$finalize_perm_rpath " in *" $libdir "*) ;; *) func_append finalize_perm_rpath " $libdir" ;; esac fi done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval rpath=\" $hardcode_libdir_flag_spec\" fi finalize_rpath=$rpath if test -n "$libobjs" && test yes = "$build_old_libs"; then # Transform all the library objects into standard objects. compile_command=`$ECHO "$compile_command" | $SP2NL | $SED "$lo2o" | $NL2SP` finalize_command=`$ECHO "$finalize_command" | $SP2NL | $SED "$lo2o" | $NL2SP` fi func_generate_dlsyms "$outputname" "@PROGRAM@" false # template prelinking step if test -n "$prelink_cmds"; then func_execute_cmds "$prelink_cmds" 'exit $?' fi wrappers_required=: case $host in *cegcc* | *mingw32ce*) # Disable wrappers for cegcc and mingw32ce hosts, we are cross compiling anyway. wrappers_required=false ;; *cygwin* | *mingw* ) test yes = "$build_libtool_libs" || wrappers_required=false ;; *) if test no = "$need_relink" || test yes != "$build_libtool_libs"; then wrappers_required=false fi ;; esac $wrappers_required || { # Replace the output file specification. compile_command=`$ECHO "$compile_command" | $SED 's%@OUTPUT@%'"$output"'%g'` link_command=$compile_command$compile_rpath # We have no uninstalled library dependencies, so finalize right now. exit_status=0 func_show_eval "$link_command" 'exit_status=$?' if test -n "$postlink_cmds"; then func_to_tool_file "$output" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi # Delete the generated files. if test -f "$output_objdir/${outputname}S.$objext"; then func_show_eval '$RM "$output_objdir/${outputname}S.$objext"' fi exit $exit_status } if test -n "$compile_shlibpath$finalize_shlibpath"; then compile_command="$shlibpath_var=\"$compile_shlibpath$finalize_shlibpath\$$shlibpath_var\" $compile_command" fi if test -n "$finalize_shlibpath"; then finalize_command="$shlibpath_var=\"$finalize_shlibpath\$$shlibpath_var\" $finalize_command" fi compile_var= finalize_var= if test -n "$runpath_var"; then if test -n "$perm_rpath"; then # We should set the runpath_var. rpath= for dir in $perm_rpath; do func_append rpath "$dir:" done compile_var="$runpath_var=\"$rpath\$$runpath_var\" " fi if test -n "$finalize_perm_rpath"; then # We should set the runpath_var. rpath= for dir in $finalize_perm_rpath; do func_append rpath "$dir:" done finalize_var="$runpath_var=\"$rpath\$$runpath_var\" " fi fi if test yes = "$no_install"; then # We don't need to create a wrapper script. link_command=$compile_var$compile_command$compile_rpath # Replace the output file specification. link_command=`$ECHO "$link_command" | $SED 's%@OUTPUT@%'"$output"'%g'` # Delete the old output file. $opt_dry_run || $RM $output # Link the executable and exit func_show_eval "$link_command" 'exit $?' if test -n "$postlink_cmds"; then func_to_tool_file "$output" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi exit $EXIT_SUCCESS fi case $hardcode_action,$fast_install in relink,*) # Fast installation is not supported link_command=$compile_var$compile_command$compile_rpath relink_command=$finalize_var$finalize_command$finalize_rpath func_warning "this platform does not like uninstalled shared libraries" func_warning "'$output' will be relinked during installation" ;; *,yes) link_command=$finalize_var$compile_command$finalize_rpath relink_command=`$ECHO "$compile_var$compile_command$compile_rpath" | $SED 's%@OUTPUT@%\$progdir/\$file%g'` ;; *,no) link_command=$compile_var$compile_command$compile_rpath relink_command=$finalize_var$finalize_command$finalize_rpath ;; *,needless) link_command=$finalize_var$compile_command$finalize_rpath relink_command= ;; esac # Replace the output file specification. link_command=`$ECHO "$link_command" | $SED 's%@OUTPUT@%'"$output_objdir/$outputname"'%g'` # Delete the old output files. $opt_dry_run || $RM $output $output_objdir/$outputname $output_objdir/lt-$outputname func_show_eval "$link_command" 'exit $?' if test -n "$postlink_cmds"; then func_to_tool_file "$output_objdir/$outputname" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output_objdir/$outputname"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi # Now create the wrapper script. func_verbose "creating $output" # Quote the relink command for shipping. if test -n "$relink_command"; then # Preserve any variables that may affect compiler behavior for var in $variables_saved_for_relink; do if eval test -z \"\${$var+set}\"; then relink_command="{ test -z \"\${$var+set}\" || $lt_unset $var || { $var=; export $var; }; }; $relink_command" elif eval var_value=\$$var; test -z "$var_value"; then relink_command="$var=; export $var; $relink_command" else func_quote_for_eval "$var_value" relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command" fi done relink_command="(cd `pwd`; $relink_command)" relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"` fi # Only actually do things if not in dry run mode. $opt_dry_run || { # win32 will think the script is a binary if it has # a .exe suffix, so we strip it off here. case $output in *.exe) func_stripname '' '.exe' "$output" output=$func_stripname_result ;; esac # test for cygwin because mv fails w/o .exe extensions case $host in *cygwin*) exeext=.exe func_stripname '' '.exe' "$outputname" outputname=$func_stripname_result ;; *) exeext= ;; esac case $host in *cygwin* | *mingw* ) func_dirname_and_basename "$output" "" "." output_name=$func_basename_result output_path=$func_dirname_result cwrappersource=$output_path/$objdir/lt-$output_name.c cwrapper=$output_path/$output_name.exe $RM $cwrappersource $cwrapper trap "$RM $cwrappersource $cwrapper; exit $EXIT_FAILURE" 1 2 15 func_emit_cwrapperexe_src > $cwrappersource # The wrapper executable is built using the $host compiler, # because it contains $host paths and files. If cross- # compiling, it, like the target executable, must be # executed on the $host or under an emulation environment. $opt_dry_run || { $LTCC $LTCFLAGS -o $cwrapper $cwrappersource $STRIP $cwrapper } # Now, create the wrapper script for func_source use: func_ltwrapper_scriptname $cwrapper $RM $func_ltwrapper_scriptname_result trap "$RM $func_ltwrapper_scriptname_result; exit $EXIT_FAILURE" 1 2 15 $opt_dry_run || { # note: this script will not be executed, so do not chmod. if test "x$build" = "x$host"; then $cwrapper --lt-dump-script > $func_ltwrapper_scriptname_result else func_emit_wrapper no > $func_ltwrapper_scriptname_result fi } ;; * ) $RM $output trap "$RM $output; exit $EXIT_FAILURE" 1 2 15 func_emit_wrapper no > $output chmod +x $output ;; esac } exit $EXIT_SUCCESS ;; esac # See if we need to build an old-fashioned archive. for oldlib in $oldlibs; do case $build_libtool_libs in convenience) oldobjs="$libobjs_save $symfileobj" addlibs=$convenience build_libtool_libs=no ;; module) oldobjs=$libobjs_save addlibs=$old_convenience build_libtool_libs=no ;; *) oldobjs="$old_deplibs $non_pic_objects" $preload && test -f "$symfileobj" \ && func_append oldobjs " $symfileobj" addlibs=$old_convenience ;; esac if test -n "$addlibs"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $addlibs func_append oldobjs " $func_extract_archives_result" fi # Do each command in the archive commands. if test -n "$old_archive_from_new_cmds" && test yes = "$build_libtool_libs"; then cmds=$old_archive_from_new_cmds else # Add any objects from preloaded convenience libraries if test -n "$dlprefiles"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $dlprefiles func_append oldobjs " $func_extract_archives_result" fi # POSIX demands no paths to be encoded in archives. We have # to avoid creating archives with duplicate basenames if we # might have to extract them afterwards, e.g., when creating a # static archive out of a convenience library, or when linking # the entirety of a libtool archive into another (currently # not supported by libtool). if (for obj in $oldobjs do func_basename "$obj" $ECHO "$func_basename_result" done | sort | sort -uc >/dev/null 2>&1); then : else echo "copying selected object files to avoid basename conflicts..." gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_mkdir_p "$gentop" save_oldobjs=$oldobjs oldobjs= counter=1 for obj in $save_oldobjs do func_basename "$obj" objbase=$func_basename_result case " $oldobjs " in " ") oldobjs=$obj ;; *[\ /]"$objbase "*) while :; do # Make sure we don't pick an alternate name that also # overlaps. newobj=lt$counter-$objbase func_arith $counter + 1 counter=$func_arith_result case " $oldobjs " in *[\ /]"$newobj "*) ;; *) if test ! -f "$gentop/$newobj"; then break; fi ;; esac done func_show_eval "ln $obj $gentop/$newobj || cp $obj $gentop/$newobj" func_append oldobjs " $gentop/$newobj" ;; *) func_append oldobjs " $obj" ;; esac done fi func_to_tool_file "$oldlib" func_convert_file_msys_to_w32 tool_oldlib=$func_to_tool_file_result eval cmds=\"$old_archive_cmds\" func_len " $cmds" len=$func_len_result if test "$len" -lt "$max_cmd_len" || test "$max_cmd_len" -le -1; then cmds=$old_archive_cmds elif test -n "$archiver_list_spec"; then func_verbose "using command file archive linking..." for obj in $oldobjs do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" done > $output_objdir/$libname.libcmd func_to_tool_file "$output_objdir/$libname.libcmd" oldobjs=" $archiver_list_spec$func_to_tool_file_result" cmds=$old_archive_cmds else # the command line is too long to link in one step, link in parts func_verbose "using piecewise archive linking..." save_RANLIB=$RANLIB RANLIB=: objlist= concat_cmds= save_oldobjs=$oldobjs oldobjs= # Is there a better way of finding the last object in the list? for obj in $save_oldobjs do last_oldobj=$obj done eval test_cmds=\"$old_archive_cmds\" func_len " $test_cmds" len0=$func_len_result len=$len0 for obj in $save_oldobjs do func_len " $obj" func_arith $len + $func_len_result len=$func_arith_result func_append objlist " $obj" if test "$len" -lt "$max_cmd_len"; then : else # the above command should be used before it gets too long oldobjs=$objlist if test "$obj" = "$last_oldobj"; then RANLIB=$save_RANLIB fi test -z "$concat_cmds" || concat_cmds=$concat_cmds~ eval concat_cmds=\"\$concat_cmds$old_archive_cmds\" objlist= len=$len0 fi done RANLIB=$save_RANLIB oldobjs=$objlist if test -z "$oldobjs"; then eval cmds=\"\$concat_cmds\" else eval cmds=\"\$concat_cmds~\$old_archive_cmds\" fi fi fi func_execute_cmds "$cmds" 'exit $?' done test -n "$generated" && \ func_show_eval "${RM}r$generated" # Now create the libtool archive. case $output in *.la) old_library= test yes = "$build_old_libs" && old_library=$libname.$libext func_verbose "creating $output" # Preserve any variables that may affect compiler behavior for var in $variables_saved_for_relink; do if eval test -z \"\${$var+set}\"; then relink_command="{ test -z \"\${$var+set}\" || $lt_unset $var || { $var=; export $var; }; }; $relink_command" elif eval var_value=\$$var; test -z "$var_value"; then relink_command="$var=; export $var; $relink_command" else func_quote_for_eval "$var_value" relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command" fi done # Quote the link command for shipping. relink_command="(cd `pwd`; $SHELL \"$progpath\" $preserve_args --mode=relink $libtool_args @inst_prefix_dir@)" relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"` if test yes = "$hardcode_automatic"; then relink_command= fi # Only create the output if not a dry run. $opt_dry_run || { for installed in no yes; do if test yes = "$installed"; then if test -z "$install_libdir"; then break fi output=$output_objdir/${outputname}i # Replace all uninstalled libtool libraries with the installed ones newdependency_libs= for deplib in $dependency_libs; do case $deplib in *.la) func_basename "$deplib" name=$func_basename_result func_resolve_sysroot "$deplib" eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $func_resolve_sysroot_result` test -z "$libdir" && \ func_fatal_error "'$deplib' is not a valid libtool archive" func_append newdependency_libs " ${lt_sysroot:+=}$libdir/$name" ;; -L*) func_stripname -L '' "$deplib" func_replace_sysroot "$func_stripname_result" func_append newdependency_libs " -L$func_replace_sysroot_result" ;; -R*) func_stripname -R '' "$deplib" func_replace_sysroot "$func_stripname_result" func_append newdependency_libs " -R$func_replace_sysroot_result" ;; *) func_append newdependency_libs " $deplib" ;; esac done dependency_libs=$newdependency_libs newdlfiles= for lib in $dlfiles; do case $lib in *.la) func_basename "$lib" name=$func_basename_result eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $lib` test -z "$libdir" && \ func_fatal_error "'$lib' is not a valid libtool archive" func_append newdlfiles " ${lt_sysroot:+=}$libdir/$name" ;; *) func_append newdlfiles " $lib" ;; esac done dlfiles=$newdlfiles newdlprefiles= for lib in $dlprefiles; do case $lib in *.la) # Only pass preopened files to the pseudo-archive (for # eventual linking with the app. that links it) if we # didn't already link the preopened objects directly into # the library: func_basename "$lib" name=$func_basename_result eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $lib` test -z "$libdir" && \ func_fatal_error "'$lib' is not a valid libtool archive" func_append newdlprefiles " ${lt_sysroot:+=}$libdir/$name" ;; esac done dlprefiles=$newdlprefiles else newdlfiles= for lib in $dlfiles; do case $lib in [\\/]* | [A-Za-z]:[\\/]*) abs=$lib ;; *) abs=`pwd`"/$lib" ;; esac func_append newdlfiles " $abs" done dlfiles=$newdlfiles newdlprefiles= for lib in $dlprefiles; do case $lib in [\\/]* | [A-Za-z]:[\\/]*) abs=$lib ;; *) abs=`pwd`"/$lib" ;; esac func_append newdlprefiles " $abs" done dlprefiles=$newdlprefiles fi $RM $output # place dlname in correct position for cygwin # In fact, it would be nice if we could use this code for all target # systems that can't hard-code library paths into their executables # and that have no shared library path variable independent of PATH, # but it turns out we can't easily determine that from inspecting # libtool variables, so we have to hard-code the OSs to which it # applies here; at the moment, that means platforms that use the PE # object format with DLL files. See the long comment at the top of # tests/bindir.at for full details. tdlname=$dlname case $host,$output,$installed,$module,$dlname in *cygwin*,*lai,yes,no,*.dll | *mingw*,*lai,yes,no,*.dll | *cegcc*,*lai,yes,no,*.dll) # If a -bindir argument was supplied, place the dll there. if test -n "$bindir"; then func_relative_path "$install_libdir" "$bindir" tdlname=$func_relative_path_result/$dlname else # Otherwise fall back on heuristic. tdlname=../bin/$dlname fi ;; esac $ECHO > $output "\ # $outputname - a libtool library file # Generated by $PROGRAM (GNU $PACKAGE) $VERSION # # Please DO NOT delete this file! # It is necessary for linking the library. # The name that we can dlopen(3). dlname='$tdlname' # Names of this library. library_names='$library_names' # The name of the static archive. old_library='$old_library' # Linker flags that cannot go in dependency_libs. inherited_linker_flags='$new_inherited_linker_flags' # Libraries that this one depends upon. dependency_libs='$dependency_libs' # Names of additional weak libraries provided by this library weak_library_names='$weak_libs' # Version information for $libname. current=$current age=$age revision=$revision # Is this an already installed library? installed=$installed # Should we warn about portability when linking against -modules? shouldnotlink=$module # Files to dlopen/dlpreopen dlopen='$dlfiles' dlpreopen='$dlprefiles' # Directory that this library needs to be installed in: libdir='$install_libdir'" if test no,yes = "$installed,$need_relink"; then $ECHO >> $output "\ relink_command=\"$relink_command\"" fi done } # Do a symbolic link so that the libtool archive can be found in # LD_LIBRARY_PATH before the program is installed. func_show_eval '( cd "$output_objdir" && $RM "$outputname" && $LN_S "../$outputname" "$outputname" )' 'exit $?' ;; esac exit $EXIT_SUCCESS } if test link = "$opt_mode" || test relink = "$opt_mode"; then func_mode_link ${1+"$@"} fi # func_mode_uninstall arg... func_mode_uninstall () { $debug_cmd RM=$nonopt files= rmforce=false exit_status=0 # This variable tells wrapper scripts just to set variables rather # than running their programs. libtool_install_magic=$magic for arg do case $arg in -f) func_append RM " $arg"; rmforce=: ;; -*) func_append RM " $arg" ;; *) func_append files " $arg" ;; esac done test -z "$RM" && \ func_fatal_help "you must specify an RM program" rmdirs= for file in $files; do func_dirname "$file" "" "." dir=$func_dirname_result if test . = "$dir"; then odir=$objdir else odir=$dir/$objdir fi func_basename "$file" name=$func_basename_result test uninstall = "$opt_mode" && odir=$dir # Remember odir for removal later, being careful to avoid duplicates if test clean = "$opt_mode"; then case " $rmdirs " in *" $odir "*) ;; *) func_append rmdirs " $odir" ;; esac fi # Don't error if the file doesn't exist and rm -f was used. if { test -L "$file"; } >/dev/null 2>&1 || { test -h "$file"; } >/dev/null 2>&1 || test -f "$file"; then : elif test -d "$file"; then exit_status=1 continue elif $rmforce; then continue fi rmfiles=$file case $name in *.la) # Possibly a libtool archive, so verify it. if func_lalib_p "$file"; then func_source $dir/$name # Delete the libtool libraries and symlinks. for n in $library_names; do func_append rmfiles " $odir/$n" done test -n "$old_library" && func_append rmfiles " $odir/$old_library" case $opt_mode in clean) case " $library_names " in *" $dlname "*) ;; *) test -n "$dlname" && func_append rmfiles " $odir/$dlname" ;; esac test -n "$libdir" && func_append rmfiles " $odir/$name $odir/${name}i" ;; uninstall) if test -n "$library_names"; then # Do each command in the postuninstall commands. func_execute_cmds "$postuninstall_cmds" '$rmforce || exit_status=1' fi if test -n "$old_library"; then # Do each command in the old_postuninstall commands. func_execute_cmds "$old_postuninstall_cmds" '$rmforce || exit_status=1' fi # FIXME: should reinstall the best remaining shared library. ;; esac fi ;; *.lo) # Possibly a libtool object, so verify it. if func_lalib_p "$file"; then # Read the .lo file func_source $dir/$name # Add PIC object to the list of files to remove. if test -n "$pic_object" && test none != "$pic_object"; then func_append rmfiles " $dir/$pic_object" fi # Add non-PIC object to the list of files to remove. if test -n "$non_pic_object" && test none != "$non_pic_object"; then func_append rmfiles " $dir/$non_pic_object" fi fi ;; *) if test clean = "$opt_mode"; then noexename=$name case $file in *.exe) func_stripname '' '.exe' "$file" file=$func_stripname_result func_stripname '' '.exe' "$name" noexename=$func_stripname_result # $file with .exe has already been added to rmfiles, # add $file without .exe func_append rmfiles " $file" ;; esac # Do a test to see if this is a libtool program. if func_ltwrapper_p "$file"; then if func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" relink_command= func_source $func_ltwrapper_scriptname_result func_append rmfiles " $func_ltwrapper_scriptname_result" else relink_command= func_source $dir/$noexename fi # note $name still contains .exe if it was in $file originally # as does the version of $file that was added into $rmfiles func_append rmfiles " $odir/$name $odir/${name}S.$objext" if test yes = "$fast_install" && test -n "$relink_command"; then func_append rmfiles " $odir/lt-$name" fi if test "X$noexename" != "X$name"; then func_append rmfiles " $odir/lt-$noexename.c" fi fi fi ;; esac func_show_eval "$RM $rmfiles" 'exit_status=1' done # Try to remove the $objdir's in the directories where we deleted files for dir in $rmdirs; do if test -d "$dir"; then func_show_eval "rmdir $dir >/dev/null 2>&1" fi done exit $exit_status } if test uninstall = "$opt_mode" || test clean = "$opt_mode"; then func_mode_uninstall ${1+"$@"} fi test -z "$opt_mode" && { help=$generic_help func_fatal_help "you must specify a MODE" } test -z "$exec_cmd" && \ func_fatal_help "invalid operation mode '$opt_mode'" if test -n "$exec_cmd"; then eval exec "$exec_cmd" exit $EXIT_FAILURE fi exit $exit_status # The TAGs below are defined such that we never get into a situation # where we disable both kinds of libraries. Given conflicting # choices, we go for a static library, that is the most portable, # since we can't tell whether shared libraries were disabled because # the user asked for that or because the platform doesn't support # them. This is particularly important on AIX, because we don't # support having both static and shared libraries enabled at the same # time on that platform, so we default to a shared-only configuration. # If a disable-shared tag is given, we'll fallback to a static-only # configuration. But we'll never go from static-only to shared-only. # ### BEGIN LIBTOOL TAG CONFIG: disable-shared build_libtool_libs=no build_old_libs=yes # ### END LIBTOOL TAG CONFIG: disable-shared # ### BEGIN LIBTOOL TAG CONFIG: disable-static build_old_libs=`case $build_libtool_libs in yes) echo no;; *) echo yes;; esac` # ### END LIBTOOL TAG CONFIG: disable-static # Local Variables: # mode:shell-script # sh-indentation:2 # End: suricata-3.2.1/libhtp/0000755000000000000000000000000013051004503011550 500000000000000suricata-3.2.1/libhtp/ChangeLog0000644000000000000000000001630513051004451013251 000000000000000.5.23 (01 November 2016) -------------------------- - enable -fPIC by default if supported and enable stack protection options on *BSD [#145] 0.5.22 (06 September 2016) -------------------------- - on "101 Switching Protocols", treat connection as a tunnel [#141] - Fix warning on OS X. [#142] 0.5.21 (13 July 2016) --------------------- - compression: fixed 'response_decompression_enabled' being ignored in case of multiple encodings [#140] 0.5.20 (7 June 2016) -------------------- - compression: support multiple layers of compressed content [#133] - compression: opportunistic decompression [#137] - compression: implement rfc1950 deflate [#136] - chunked: handle mismatch between header and body [#135] - chunked: handle malformed chunked lengths [#134] 0.5.19 (22 March 2016) ---------------------- - configure: improve strlcpy/strlcat checks [Victor Julien] - Fix uninitialized htp_tx_t::is_last value in htp_decompressors.c [Fedor Sakharov] - headers: fix memory leak on malformed headers [Victor Julien] - connect: handle response headers with 200 response [Victor Julien] 0.5.18 (25 September 2015) -------------------------- - Fixed [#120] Trigger request line parsing on incomplete request [Victor Julien] - Fixed [#119] Fix uninitialized htp_tx_t::is_last value in in htp_tx_res_process_body_data_ex() [Fedor Sakharov] - Fixed [#118] Coverity-identified missing break in switch [Sam Baskinger] - Fixed [#117] Coverity-identified issue of not checking malloc() return value [Sam Baskinger] - Fixed [#116] Fix coverity-identified leaked file descriptors in unit test [Sam Baskinger] - Fixed [#113] fix pkgconfig include dir [Eric Leblond] - Fixed [#111] Connect plain http [Victor Julien] - Fixed [#105] Do not invoke callbacks in htp_req_run_hook_body_data() when there is no tx running. [Sam Baskinger] - Fixed [#104] Modifiying HTTP methods to be rfc3253 compliant [Andreas Moe] - Fixed [#103] Fixes [Victor Julien] - Fixed [#101] Make including the autoconf config header safer [Brian Rectanus] 0.5.17 (25 February 2015) ------------------------- - Fix URI parsing for non-std 'space' chars [Fixed by Victor Julien / Reported by Darien Huss from Emerging Threats] - Fixing buffer overrun that was failing clang -fsanitize=address checks [Sam Baskinger] - Replace strcat/sprintf by strlcat/snprintf [Giuseppe Longo] - Fix autogen on CentOS 5.11 [Victor Julien] - Fix dereferencing type-punned pointer on CentOS 5.11 [Giuseppe Longo] - Fix warning on OpenBSD [Giuseppe Longo] 0.5.16 (11 December 2014) ------------------------- - Per personality requestline leading whitespace handling [Victor Julien] - Improve request line parsing with leading spaces [Victor Julien] - Harden decompress code against memory stress [Victor Julien] 0.5.15 (1 August 2014) ---------------------- - Fixed [#78] Make a case-insensitive comparision for the pattern "chunked" for "Transfer-Encoding" [Anoop Saldanha] 0.5.14 (22 July 2014) --------------------- - Fixed the tests sometimes not returning the correct status code. Increased the the compiler warnings for the tests. - Fixed [#77] Fix compiler warnings in the tests 0.5.13 (16 July 2014) --------------------- - Fixed [#56] Investigate clean-up performance with a large number of transactions on a single connection 0.5.12 (25 June 2014) --------------------- - Fixed [#73] Fix double Content-Length issue [Wesley Shields] 0.5.11 (5 April 2014) --------------------- - Fixed [#72] On CONNECT requests inbound tx progress prematurely set to complete - Fixed [#71] Fix missing files in distribution target [Pierre Chifflier] 0.5.10 (3 March 2014) -------------------- - Fixed [#63] Final response body data callback missing on compressed responses. - Do not consume the byte that comes after an invalid UTF-8 character. - Use case insensitive comparison for content-coding values. Warn if unknown response content encoding is encountered. - Small fixes. [#66, #69] [Victor Julien] 0.5.9 (19 November 2013) ------------------------ - Fixed an HTP_HOST_AMBIGUOUS false positive. - Fixed the tests not compiling on OS X 10.9. 0.5.8 (21 October 2013) ----------------------- - Fixed [#54] Compression and base64 tests failing on some architectures. - Fixed [#55] Incorrect ambiguous host warning on some CONNECT requests. 0.5.7 (18 September 2013) ------------------------- - Use umask() with mkstemp() to ensure that temporary files are created with correct permissions. This addresses the potential security problem, but creates another, because umask() is not thread safe. For this and other reasons (see #52), file extraction will be removed in a future release. - Fix copying hook_response_complete instead of hook_transaction_complete. - Fix several small memory leaks that occur when memory allocation fails. 0.5.6 (22 July 2013) ------------------- - Fix memory leaks in htp_tx_t::request_auth_username and htp_tx_t::request_auth_password. - [#43] When processing the response line, treat stream closure as the end of line. - Fix normalization when the URL begins with "./". - Do not fail a stream with an incorrectly formed digest username. - Do not stop processing request headers on PUT requests. 0.5.5 (18 July 2013) -------------------- - Tagging for a Suricata beta release. - [#46] Fix the segfault that occurs under certain conditions when an invalid hostname is supplied. - [#44] Fix libiconv detection on OpenBSD. [Victor Julien] 0.5.4 (17 July 2013) -------------------- - Tagging for a Suricata beta release. - Added htp_get_version(), which returns the complete library name (e.g., "LibHTP v0.5.4"). - Hard field limit is now treated as specifying the maximum amount of memory LibHTP will use for buffering per stream. Fields (e.g., headers) longer than this limit will be accepted if they are contained within a single buffer submitted to LibHTP (i.e., if LibHTP does not have to do any buffering in order to process them). Soft limits are currently not creating any warnings. This area will be improved in a future release. - Invalid headers no longer fail the entire stream. They are now treated as headers without a name. - htp_conn_remove_tx() now returns HTP_DECLINED (was HTTP_ERROR) if the specified transaction cannot be found. - htp_list_array_replace() now returns HTP_DECLINED (was HTP_ERROR) if the element at the specified position does not exist. - New public functions: htp_status_t htp_urldecode_inplace(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags); htp_status_t htp_urldecode_inplace_ex(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags, int *expected_status_code); - Improved test coverage (84.1% lines, 91.3% functions). 0.5.3 (14 June 2013) -------------------- - Fix stream error when valid Basic Authentication information is provided. - Do not fail the entire stream if the Authorization header is invalid. Raise HTP_AUTH_INVALID instead. - When a request does not contain the request URI, leave htp_tx_t::request_uri NULL. suricata-3.2.1/libhtp/htp/0000755000000000000000000000000013051004503012343 500000000000000suricata-3.2.1/libhtp/htp/htp_transaction.h0000644000000000000000000005177413051004451015654 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /* * @file * @author Ivan Ristic */ #ifndef HTP_TRANSACTION_H #define HTP_TRANSACTION_H #ifdef __cplusplus extern "C" { #endif #include "htp.h" /** * Enumerate possible data handling strategies in hybrid parsing * mode. The two possibilities are to make copies of all data and * use bstr instances to wrap already available data. */ enum htp_alloc_strategy_t { /** * Make copies of all data. This strategy should be used when * the supplied buffers are transient and will go away after * the invoked function returns. */ HTP_ALLOC_COPY = 1, /** * Reuse buffers, without a change of ownership. We assume the * buffers will continue to be available until the transaction * is deleted by the container. */ HTP_ALLOC_REUSE = 2 }; /** * Possible states of a progressing transaction. Internally, progress will change * to the next state when the processing activities associated with that state * begin. For example, when we start to process request line bytes, the request * state will change from HTP_REQUEST_NOT_STARTED to HTP_REQUEST_LINE.* */ enum htp_tx_req_progress_t { HTP_REQUEST_NOT_STARTED = 0, HTP_REQUEST_LINE = 1, HTP_REQUEST_HEADERS = 2, HTP_REQUEST_BODY = 3, HTP_REQUEST_TRAILER = 4, HTP_REQUEST_COMPLETE = 5 }; enum htp_tx_res_progress_t { HTP_RESPONSE_NOT_STARTED = 0, HTP_RESPONSE_LINE = 1, HTP_RESPONSE_HEADERS = 2, HTP_RESPONSE_BODY = 3, HTP_RESPONSE_TRAILER = 4, HTP_RESPONSE_COMPLETE = 5 }; #define HTP_CONFIG_PRIVATE 0 #define HTP_CONFIG_SHARED 1 /** * Creates a new transaction structure. * * @param[in] connp Connection parser pointer. Must not be NULL. * @return The newly created transaction, or NULL on memory allocation failure. */ htp_tx_t *htp_tx_create(htp_connp_t *connp); /** * Destroys the supplied transaction. * * @param[in] tx Transaction pointer. Must not be NULL. */ htp_status_t htp_tx_destroy(htp_tx_t *tx); /** * Determines if the transaction used a shared configuration structure. See the * documentation for htp_tx_set_config() for more information why you might want * to know that. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_CFG_SHARED or HTP_CFG_PRIVATE. */ int htp_tx_get_is_config_shared(const htp_tx_t *tx); /** * Returns the user data associated with this transaction. * * @param[in] tx Transaction pointer. Must not be NULL. * @return A pointer to user data or NULL. */ void *htp_tx_get_user_data(const htp_tx_t *tx); /** * Registers a callback that will be invoked to process the transaction's request body data. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] callback_fn Callback function pointer. Must not be NULL. */ void htp_tx_register_request_body_data(htp_tx_t *tx, int (*callback_fn)(htp_tx_data_t *)); /** * Registers a callback that will be invoked to process the transaction's response body data. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] callback_fn Callback function pointer. Must not be NULL. */ void htp_tx_register_response_body_data(htp_tx_t *tx, int (*callback_fn)(htp_tx_data_t *)); /** * Adds one parameter to the request. THis function will take over the * responsibility for the provided htp_param_t structure. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] param Parameter pointer. Must not be NULL. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_add_param(htp_tx_t *tx, htp_param_t *param); /** * Returns the first request parameter that matches the given name, using case-insensitive matching. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] name Name data pointer. Must not be NULL. * @param[in] name_len Name data length. * @return htp_param_t instance, or NULL if parameter not found. */ htp_param_t *htp_tx_req_get_param(htp_tx_t *tx, const char *name, size_t name_len); /** * Returns the first request parameter from the given source that matches the given name, * using case-insensitive matching. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] source Parameter source (where in request the parameter was located). * @param[in] name Name data pointer. Must not be NULL. * @param[in] name_len Name data length. * @return htp_param_t instance, or NULL if parameter not found. */ htp_param_t *htp_tx_req_get_param_ex(htp_tx_t *tx, enum htp_data_source_t source, const char *name, size_t name_len); /** * Determine if the request has a body. * * @param[in] tx Transaction pointer. Must not be NULL. * @return 1 if there is a body, 0 otherwise. */ int htp_tx_req_has_body(const htp_tx_t *tx); /** * Process a chunk of request body data. This function assumes that * handling of chunked encoding is implemented by the container. When * you're done submitting body data, invoke a state change (to REQUEST) * to finalize any processing that might be pending. The supplied data is * fully consumed and there is no expectation that it will be available * afterwards. The protocol parsing code makes no copies of the data, * but some parsers might. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] data Data pointer. Must not be NULL. * @param[in] len Data length. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_process_body_data(htp_tx_t *tx, const void *data, size_t len); /** * Set one request header. This function should be invoked once for * each available header, and in the order in which headers were * seen in the request. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] name Name data pointer. Must not be NULL. * @param[in] name_len Name data length. * @param[in] value Value data pointer. Must not be NULL. * @param[in] value_len Value data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_header(htp_tx_t *tx, const char *name, size_t name_len, const char *value, size_t value_len, enum htp_alloc_strategy_t alloc); /** * Removes all request headers associated with this transaction. This * function is needed because in some cases the container does not * differentiate between standard and trailing headers. In that case, * you set request headers once at the beginning of the transaction, * read the body (at this point the request headers should contain the * mix of regular and trailing headers), clear all headers, and then set * them all again. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_headers_clear(htp_tx_t *tx); /** * Set request line. When used, this function should always be called first, * with more specific functions following. Must not contain line terminators. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] line Line data pointer. Must not be NULL. * @param[in] line_len Line data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_line(htp_tx_t *tx, const char *line, size_t line_len, enum htp_alloc_strategy_t alloc); /** * Set transaction request method. This function will enable you to keep * track of the text representation of the method. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] method Method data pointer. Must not be NULL. * @param[in] method_len Method data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_method(htp_tx_t *tx, const char *method, size_t method_len, enum htp_alloc_strategy_t alloc); /** * Set transaction request method number. This function enables you to * keep track how a particular method string is interpreted. This function * is useful with web servers that ignore invalid methods; for example, some * web servers will treat them as a GET. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] method_number Method number. */ void htp_tx_req_set_method_number(htp_tx_t *tx, enum htp_method_t method_number); /** * Set parsed request URI. You don't need to use this function if you are already providing * the request line or request URI. But if your container already has this data available, * feeding it to LibHTP will minimize any potential data differences. This function assumes * management of the data provided in parsed_uri. This function will not change htp_tx_t::parsed_uri_raw * (which may have data in it from the parsing of the request URI). * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] parsed_uri URI pointer. Must not be NULL. */ void htp_tx_req_set_parsed_uri(htp_tx_t *tx, htp_uri_t *parsed_uri); /** * Forces HTTP/0.9 as the transaction protocol. This method exists to ensure * that both LibHTP and the container treat the transaction as HTTP/0.9, despite * potential differences in how the protocol version is determined. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] is_protocol_0_9 Zero if protocol is not HTTP/0.9, or 1 if it is. */ void htp_tx_req_set_protocol_0_9(htp_tx_t *tx, int is_protocol_0_9); /** * Sets the request protocol string (e.g., "HTTP/1.0"). The information provided * is only stored, not parsed. Use htp_tx_req_set_protocol_number() to set the * actual protocol number, as interpreted by the container. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] protocol Protocol data pointer. Must not be NULL. * @param[in] protocol_len Protocol data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_protocol(htp_tx_t *tx, const char *protocol, size_t protocol_len, enum htp_alloc_strategy_t alloc); /** * Set request protocol version number. Must be invoked after * htp_txh_set_req_protocol(), because it will overwrite the previously * extracted version number. Convert the protocol version number to an integer * by multiplying it with 100. For example, 1.1 becomes 110. Alternatively, * use the HTP_PROTOCOL_0_9, HTP_PROTOCOL_1_0, and HTP_PROTOCOL_1_1 constants. * Note: setting protocol to HTP_PROTOCOL_0_9 alone will _not_ get the library to * treat the transaction as HTTP/0.9. You need to also invoke htp_tx_req_set_protocol_0_9(). * This is because HTTP 0.9 is used only when protocol information is absent from the * request line, and not when it is explicitly stated (as "HTTP/0.9"). This behavior is * consistent with that of Apache httpd. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] protocol_number Protocol number. */ void htp_tx_req_set_protocol_number(htp_tx_t *tx, int protocol_number); /** * Set transaction request URI. The value provided here will be stored in htp_tx_t::request_uri * and subsequently parsed. If htp_tx_req_set_line() was previously used, the uri provided * when calling this function will overwrite any previously parsed value. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] uri URI data pointer. Must not be NULL. * @param[in] uri_len URI data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_req_set_uri(htp_tx_t *tx, const char *uri, size_t uri_len, enum htp_alloc_strategy_t alloc); /** * Process a chunk of response body data. This function assumes that * handling of chunked encoding is implemented by the container. When * you're done submitting body data, invoking a state change (to RESPONSE) * will finalize any processing that might be pending. * * The response body data will be decompressed if two conditions are met: one, * decompression is enabled in configuration and two, if the response headers * indicate compression. Alternatively, you can control decompression from * a RESPONSE_HEADERS callback, by setting tx->response_content_encoding either * to COMPRESSION_NONE (to disable compression), or to one of the supported * decompression algorithms. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] data Data pointer. Must not be NULL. * @param[in] len Data length. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_res_process_body_data(htp_tx_t *tx, const void *data, size_t len); /** * Set one response header. This function should be invoked once for * each available header, and in the order in which headers were * seen in the response. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] name Name data pointer. Must not be NULL. * @param[in] name_len Name data length. * @param[in] value Value data pointer. Must not be NULL. * @param[in] value_len Value length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_res_set_header(htp_tx_t *tx, const char *name, size_t name_len, const char *value, size_t value_len, enum htp_alloc_strategy_t alloc); /** * Removes all response headers associated with this transaction. This * function is needed because in some cases the container does not * differentiate between standard and trailing headers. In that case, * you set response headers once at the beginning of the transaction, * read the body, clear all headers, and then set them all again. After * the headers are set for the second time, they will potentially contain * a mixture of standard and trailing headers. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_res_set_headers_clear(htp_tx_t *tx); /** * Set response protocol number. See htp_tx_res_set_protocol_number() for more information * about the correct format of the protocol_parameter parameter. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] protocol_number Protocol number. * @return HTP_OK on success, HTP_ERROR on failure. */ void htp_tx_res_set_protocol_number(htp_tx_t *tx, int protocol_number); /** * Set response line. Use this function is you have a single buffer containing * the entire line. If you have individual request line pieces, use the other * available functions. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] line Line data pointer. Must not be NULL. * @param[in] line_len Line data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_res_set_status_line(htp_tx_t *tx, const char *line, size_t line_len, enum htp_alloc_strategy_t alloc); /** * Set response status code. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] status_code Response status code. * @return HTP_OK on success, HTP_ERROR on failure. */ void htp_tx_res_set_status_code(htp_tx_t *tx, int status_code); /** * Set response status message, which is the part of the response * line that comes after the status code. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] msg Message data pointer. Must not be NULL. * @param[in] msg_len Message data length. * @param[in] alloc Desired allocation strategy. * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_tx_res_set_status_message(htp_tx_t *tx, const char *msg, size_t msg_len, enum htp_alloc_strategy_t alloc); /** * Sets the configuration that is to be used for this transaction. If the * second parameter is set to HTP_CFG_PRIVATE, the transaction will adopt * the configuration structure and destroy it when appropriate. This function is * useful if you need to make changes to configuration on per-transaction basis. * Initially, all transactions will share the configuration with that of the * connection; if you were to make changes on it, they would affect all * current and future connections. To work around that, you make a copy of the * configuration object, call this function with the second parameter set to * HTP_CFG_PRIVATE, and modify configuration at will. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] cfg Configuration pointer. Must not be NULL. * @param[in] is_cfg_shared HTP_CFG_SHARED or HTP_CFG_PRIVATE */ void htp_tx_set_config(htp_tx_t *tx, htp_cfg_t *cfg, int is_cfg_shared); /** * Associates user data with this transaction. * * @param[in] tx Transaction pointer. Must not be NULL. * @param[in] user_data Opaque user data pointer. */ void htp_tx_set_user_data(htp_tx_t *tx, void *user_data); /** * Change transaction state to REQUEST and invoke registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_request_complete(htp_tx_t *tx); /** * Change transaction state to REQUEST_HEADERS and invoke all * registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_request_headers(htp_tx_t *tx); /** * Change transaction state to REQUEST_LINE and invoke all * registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_request_line(htp_tx_t *tx); /** * Initialize hybrid parsing mode, change state to TRANSACTION_START, * and invoke all registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_request_start(htp_tx_t *tx); /** * Change transaction state to RESPONSE and invoke registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_response_complete(htp_tx_t *tx); /** * Change transaction state to RESPONSE_HEADERS and invoke registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_response_headers(htp_tx_t *tx); /** * Change transaction state to HTP_RESPONSE_LINE and invoke registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_response_line(htp_tx_t *tx); /** * Change transaction state to RESPONSE_START and invoke registered callbacks. * * @param[in] tx Transaction pointer. Must not be NULL. * @return HTP_OK on success; HTP_ERROR on error, HTP_STOP if one of the * callbacks does not want to follow the transaction any more. */ htp_status_t htp_tx_state_response_start(htp_tx_t *tx); #ifdef __cplusplus } #endif #endif /* HTP_HYBRID_H */ suricata-3.2.1/libhtp/htp/htp_decompressors.h0000644000000000000000000000572113051004451016206 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_DECOMPRESSORS_H #define _HTP_DECOMPRESSORS_H #ifdef __cplusplus extern "C" { #endif #include typedef struct htp_decompressor_gzip_t htp_decompressor_gzip_t; typedef struct htp_decompressor_t htp_decompressor_t; #define GZIP_BUF_SIZE 8192 #define DEFLATE_MAGIC_1 0x1f #define DEFLATE_MAGIC_2 0x8b struct htp_decompressor_t { htp_status_t (*decompress)(htp_decompressor_t *, htp_tx_data_t *); htp_status_t (*callback)(htp_tx_data_t *); void (*destroy)(htp_decompressor_t *); struct htp_decompressor_t *next; }; struct htp_decompressor_gzip_t { htp_decompressor_t super; #if 0 int initialized; #endif int zlib_initialized; uint8_t header[10]; uint8_t header_len; uint8_t restart; /**< deflate restarted to try rfc1950 instead of 1951 */ uint8_t passthrough; /**< decompression failed, pass through raw data */ z_stream stream; unsigned char *buffer; unsigned long crc; }; htp_decompressor_t *htp_gzip_decompressor_create(htp_connp_t *connp, enum htp_content_encoding_t format); #ifdef __cplusplus } #endif #endif /* _HTP_DECOMPRESSORS_H */ suricata-3.2.1/libhtp/htp/htp_config_private.h0000644000000000000000000002711013051004451016311 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CONFIG_PRIVATE_H #define HTP_CONFIG_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #define HTP_DECODER_CONTEXTS_MAX 3 typedef struct htp_decoder_cfg_t { // Path-specific decoding options. /** Convert backslash characters to slashes. */ int backslash_convert_slashes; /** Convert to lowercase. */ int convert_lowercase; /** Compress slash characters. */ int path_separators_compress; /** Should we URL-decode encoded path segment separators? */ int path_separators_decode; /** Should we decode '+' characters to spaces? */ int plusspace_decode; /** Reaction to encoded path separators. */ enum htp_unwanted_t path_separators_encoded_unwanted; // Special characters options. /** Controls how raw NUL bytes are handled. */ int nul_raw_terminates; /** Determines server response to a raw NUL byte in the path. */ enum htp_unwanted_t nul_raw_unwanted; /** Reaction to control characters. */ enum htp_unwanted_t control_chars_unwanted; // URL encoding options. /** Should we decode %u-encoded characters? */ int u_encoding_decode; /** Reaction to %u encoding. */ enum htp_unwanted_t u_encoding_unwanted; /** Handling of invalid URL encodings. */ enum htp_url_encoding_handling_t url_encoding_invalid_handling; /** Reaction to invalid URL encoding. */ enum htp_unwanted_t url_encoding_invalid_unwanted; /** Controls how encoded NUL bytes are handled. */ int nul_encoded_terminates; /** How are we expected to react to an encoded NUL byte? */ enum htp_unwanted_t nul_encoded_unwanted; // UTF-8 options. /** Controls how invalid UTF-8 characters are handled. */ enum htp_unwanted_t utf8_invalid_unwanted; /** Convert UTF-8 characters into bytes using best-fit mapping. */ int utf8_convert_bestfit; // Best-fit mapping options. /** The best-fit map to use to decode %u-encoded characters. */ unsigned char *bestfit_map; /** The replacement byte used when there is no best-fit mapping. */ unsigned char bestfit_replacement_byte; } htp_decoder_cfg_t; struct htp_cfg_t { /** * The maximum size of the buffer that is used when the current * input chunk does not contain all the necessary data (e.g., a very header * line that spans several packets). */ size_t field_limit_hard; /** * Soft field limit length. If this limit is reached the parser will issue * a warning but continue to run. NOT IMPLEMENTED. */ size_t field_limit_soft; /** * Log level, which will be used when deciding whether to store or * ignore the messages issued by the parser. */ enum htp_log_level_t log_level; /** * Whether to delete each transaction after the last hook is invoked. This * feature should be used when parsing traffic streams in real time. */ int tx_auto_destroy; /** * Server personality identifier. */ enum htp_server_personality_t server_personality; /** The function used for request line parsing. Depends on the personality. */ int (*parse_request_line)(htp_connp_t *connp); /** The function used for response line parsing. Depends on the personality. */ int (*parse_response_line)(htp_connp_t *connp); /** The function used for request header parsing. Depends on the personality. */ int (*process_request_header)(htp_connp_t *connp, unsigned char *data, size_t len); /** The function used for response header parsing. Depends on the personality. */ int (*process_response_header)(htp_connp_t *connp, unsigned char *data, size_t len); /** The function to use to transform parameters after parsing. */ int (*parameter_processor)(htp_param_t *param); /** Decoder configuration array, one per context. */ htp_decoder_cfg_t decoder_cfgs[HTP_DECODER_CONTEXTS_MAX]; /** Whether to generate the request_uri_normalized field. */ int generate_request_uri_normalized; /** Whether to decompress compressed response bodies. */ int response_decompression_enabled; /** Not fully implemented at the moment. */ char *request_encoding; /** Not fully implemented at the moment. */ char *internal_encoding; /** Whether to parse request cookies. */ int parse_request_cookies; /** Whether to parse HTTP Authentication headers. */ int parse_request_auth; /** Whether to extract files from requests using Multipart encoding. */ int extract_request_files; /** How many extracted files are allowed in a single Multipart request? */ int extract_request_files_limit; /** The location on disk where temporary files will be created. */ char *tmpdir; // Hooks /** * Request start hook, invoked when the parser receives the first byte of a new * request. Because in HTTP a transaction always starts with a request, this hook * doubles as a transaction start hook. */ htp_hook_t *hook_request_start; /** * Request line hook, invoked after a request line has been parsed. */ htp_hook_t *hook_request_line; /** * Request URI normalization hook, for overriding default normalization of URI. */ htp_hook_t *hook_request_uri_normalize; /** * Receives raw request header data, starting immediately after the request line, * including all headers as they are seen on the TCP connection, and including the * terminating empty line. Not available on genuine HTTP/0.9 requests (because * they don't use headers). */ htp_hook_t *hook_request_header_data; /** * Request headers hook, invoked after all request headers are seen. */ htp_hook_t *hook_request_headers; /** * Request body data hook, invoked every time body data is available. Each * invocation will provide a htp_tx_data_t instance. Chunked data * will be dechunked before the data is passed to this hook. Decompression * is not currently implemented. At the end of the request body * there will be a call with the data pointer set to NULL. */ htp_hook_t *hook_request_body_data; /** * Request file data hook, which is invoked whenever request file data is * available. Currently used only by the Multipart parser. */ htp_hook_t *hook_request_file_data; /** * Receives raw request trailer data, which can be available on requests that have * chunked bodies. The data starts immediately after the zero-length chunk * and includes the terminating empty line. */ htp_hook_t *hook_request_trailer_data; /** * Request trailer hook, invoked after all trailer headers are seen, * and if they are seen (not invoked otherwise). */ htp_hook_t *hook_request_trailer; /** * Request hook, invoked after a complete request is seen. */ htp_hook_t *hook_request_complete; /** * Response startup hook, invoked when a response transaction is found and * processing started. */ htp_hook_t *hook_response_start; /** * Response line hook, invoked after a response line has been parsed. */ htp_hook_t *hook_response_line; /** * Receives raw response header data, starting immediately after the status line * and including all headers as they are seen on the TCP connection, and including the * terminating empty line. Not available on genuine HTTP/0.9 responses (because * they don't have response headers). */ htp_hook_t *hook_response_header_data; /** * Response headers book, invoked after all response headers have been seen. */ htp_hook_t *hook_response_headers; /** * Response body data hook, invoked every time body data is available. Each * invocation will provide a htp_tx_data_t instance. Chunked data * will be dechunked before the data is passed to this hook. By default, * compressed data will be decompressed, but decompression can be disabled * in configuration. At the end of the response body there will be a call * with the data pointer set to NULL. */ htp_hook_t *hook_response_body_data; /** * Receives raw response trailer data, which can be available on responses that have * chunked bodies. The data starts immediately after the zero-length chunk * and includes the terminating empty line. */ htp_hook_t *hook_response_trailer_data; /** * Response trailer hook, invoked after all trailer headers have been processed, * and only if the trailer exists. */ htp_hook_t *hook_response_trailer; /** * Response hook, invoked after a response has been seen. Because sometimes servers * respond before receiving complete requests, a response_complete callback may be * invoked prior to a request_complete callback. */ htp_hook_t *hook_response_complete; /** * Transaction complete hook, which is invoked once the entire transaction is * considered complete (request and response are both complete). This is always * the last hook to be invoked. */ htp_hook_t *hook_transaction_complete; /** * Log hook, invoked every time the library wants to log. */ htp_hook_t *hook_log; /** * Opaque user data associated with this configuration structure. */ void *user_data; // Request Line parsing options. // TODO this was added here to maintain a stable ABI, once we can break that // we may want to move this into htp_decoder_cfg_t (VJ) /** Reaction to leading whitespace on the request line */ enum htp_unwanted_t requestline_leading_whitespace_unwanted; /** How many layers of compression we will decompress (0 => no limit). */ int response_decompression_layer_limit; }; #ifdef __cplusplus } #endif #endif /* HTP_CONFIG_PRIVATE H */ suricata-3.2.1/libhtp/htp/htp_utf8_decoder.c0000644000000000000000000001502113051004451015656 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ /* Copyright (c) 2008-2009 Bjoern Hoehrmann Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ // Copyright (c) 2008-2009 Bjoern Hoehrmann // See http://bjoern.hoehrmann.de/utf-8/decoder/dfa/ for details. #include "htp_config_auto.h" #include "htp_private.h" static const uint8_t utf8d[] = { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 00..1f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 20..3f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 40..5f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 60..7f 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9, // 80..9f 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7, // a0..bf 8,8,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2, // c0..df 0xa,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x4,0x3,0x3, // e0..ef 0xb,0x6,0x6,0x6,0x5,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8, // f0..ff 0x0,0x1,0x2,0x3,0x5,0x8,0x7,0x1,0x1,0x1,0x4,0x6,0x1,0x1,0x1,0x1, // s0..s0 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1, // s1..s2 1,2,1,1,1,1,1,2,1,2,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1, // s3..s4 1,2,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1,1,1,1,1,1,3,1,3,1,1,1,1,1,1, // s5..s6 1,3,1,1,1,1,1,3,1,3,1,1,1,1,1,1,1,3,1,1,1,1,1,1,1,1,1,1,1,1,1,1, // s7..s8 }; static const uint8_t utf8d_allow_overlong[] = { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 00..1f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 20..3f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 40..5f 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, // 60..7f 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9,9, // 80..9f 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7, // a0..bf 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2, // c0..df; changed c0 and c1 0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x4,0x3,0x3, // e0..ef; changed e0 0x6,0x6,0x6,0x6,0x5,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8,0x8, // f0..ff; changed f0 0x0,0x1,0x2,0x3,0x5,0x8,0x7,0x1,0x1,0x1,0x4,0x6,0x1,0x1,0x1,0x1, // s0..s0 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1,1,0,1,0,1,1,1,1,1,1, // s1..s2 1,2,1,1,1,1,1,2,1,2,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1, // s3..s4 1,2,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1,1,1,1,1,1,3,1,3,1,1,1,1,1,1, // s5..s6 1,3,1,1,1,1,1,3,1,3,1,1,1,1,1,1,1,3,1,1,1,1,1,1,1,1,1,1,1,1,1,1, // s7..s8 }; /** * Process one byte of UTF-8 data and return a code point if one is available. * * @param[in] state * @param[in] codep * @param[in] byte * @return HTP_UTF8_ACCEPT for a valid character, HTP_UTF8_REJECT for an invalid character, * or something else if the character has not yet been formed */ uint32_t htp_utf8_decode(uint32_t* state, uint32_t* codep, uint32_t byte) { uint32_t type = utf8d[byte]; *codep = (*state != HTP_UTF8_ACCEPT) ? (byte & 0x3fu) | (*codep << 6) : (0xff >> type) & (byte); *state = utf8d[256 + *state*16 + type]; return *state; } /** * Process one byte of UTF-8 data and return a code point if one is available. Allows * overlong characters in input. * * @param[in] state * @param[in] codep * @param[in] byte * @return HTP_UTF8_ACCEPT for a valid character, HTP_UTF8_REJECT for an invalid character, * or something else if the character has not yet been formed */ uint32_t htp_utf8_decode_allow_overlong(uint32_t* state, uint32_t* codep, uint32_t byte) { uint32_t type = utf8d_allow_overlong[byte]; *codep = (*state != HTP_UTF8_ACCEPT) ? (byte & 0x3fu) | (*codep << 6) : (0xff >> type) & (byte); *state = utf8d[256 + *state*16 + type]; return *state; } suricata-3.2.1/libhtp/htp/bstr_builder.c0000644000000000000000000000762313051004451015121 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "bstr.h" #include "htp_list.h" htp_status_t bstr_builder_appendn(bstr_builder_t *bb, bstr *b) { return htp_list_push(bb->pieces, b); } htp_status_t bstr_builder_append_c(bstr_builder_t *bb, const char *cstr) { bstr *b = bstr_dup_c(cstr); if (b == NULL) return HTP_ERROR; return htp_list_push(bb->pieces, b); } htp_status_t bstr_builder_append_mem(bstr_builder_t *bb, const void *data, size_t len) { bstr *b = bstr_dup_mem(data, len); if (b == NULL) return HTP_ERROR; return htp_list_push(bb->pieces, b); } void bstr_builder_clear(bstr_builder_t *bb) { // Do nothing if the list is empty if (htp_list_size(bb->pieces) == 0) return; for (size_t i = 0, n = htp_list_size(bb->pieces); i < n; i++) { bstr *b = htp_list_get(bb->pieces, i); bstr_free(b); } htp_list_clear(bb->pieces); } bstr_builder_t *bstr_builder_create() { bstr_builder_t *bb = calloc(1, sizeof (bstr_builder_t)); if (bb == NULL) return NULL; bb->pieces = htp_list_create(BSTR_BUILDER_DEFAULT_SIZE); if (bb->pieces == NULL) { free(bb); return NULL; } return bb; } void bstr_builder_destroy(bstr_builder_t *bb) { if (bb == NULL) return; // Destroy any pieces we might have for (size_t i = 0, n = htp_list_size(bb->pieces); i < n; i++) { bstr *b = htp_list_get(bb->pieces, i); bstr_free(b); } htp_list_destroy(bb->pieces); free(bb); } size_t bstr_builder_size(const bstr_builder_t *bb) { return htp_list_size(bb->pieces); } bstr *bstr_builder_to_str(const bstr_builder_t *bb) { size_t len = 0; // Determine the size of the string for (size_t i = 0, n = htp_list_size(bb->pieces); i < n; i++) { bstr *b = htp_list_get(bb->pieces, i); len += bstr_len(b); } // Allocate string bstr *bnew = bstr_alloc(len); if (bnew == NULL) return NULL; // Determine the size of the string for (size_t i = 0, n = htp_list_size(bb->pieces); i < n; i++) { bstr *b = htp_list_get(bb->pieces, i); bstr_add_noex(bnew, b); } return bnew; } suricata-3.2.1/libhtp/htp/htp_list.c0000644000000000000000000002122013051004451014254 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" // Array-backed list htp_list_t *htp_list_array_create(size_t size) { // It makes no sense to create a zero-size list. if (size == 0) return NULL; // Allocate the list structure. htp_list_array_t *l = calloc(1, sizeof (htp_list_array_t)); if (l == NULL) return NULL; // Allocate the initial batch of elements. l->elements = malloc(size * sizeof (void *)); if (l->elements == NULL) { free(l); return NULL; } // Initialize the structure. l->first = 0; l->last = 0; l->current_size = 0; l->max_size = size; return (htp_list_t *) l; } void htp_list_array_clear(htp_list_array_t *l) { if (l == NULL) return; // Continue using already allocated memory; just reset the fields. l->first = 0; l->last = 0; l->current_size = 0; } void htp_list_array_destroy(htp_list_array_t *l) { if (l == NULL) return; free(l->elements); free(l); } void *htp_list_array_get(const htp_list_array_t *l, size_t idx) { if (l == NULL) return NULL; if (idx + 1 > l->current_size) return NULL; if (l->first + idx < l->max_size) { return (void *) l->elements[l->first + idx]; } else { return (void *) l->elements[idx - (l->max_size - l->first)]; } } void *htp_list_array_pop(htp_list_array_t *l) { if (l == NULL) return NULL; const void *r = NULL; if (l->current_size == 0) { return NULL; } size_t pos = l->first + l->current_size - 1; if (pos > l->max_size - 1) pos -= l->max_size; r = l->elements[pos]; l->last = pos; l->current_size--; return (void *) r; } htp_status_t htp_list_array_push(htp_list_array_t *l, void *e) { if (l == NULL) return HTP_ERROR; // Check whether we're full if (l->current_size >= l->max_size) { size_t new_size = l->max_size * 2; void *newblock = NULL; if (l->first == 0) { // The simple case of expansion is when the first // element in the list resides in the first slot. In // that case we just add some new space to the end, // adjust the max_size and that's that. newblock = realloc(l->elements, new_size * sizeof (void *)); if (newblock == NULL) return HTP_ERROR; } else { // When the first element is not in the first // memory slot, we need to rearrange the order // of the elements in order to expand the storage area. /* coverity[suspicious_sizeof] */ newblock = malloc((size_t) (new_size * sizeof (void *))); if (newblock == NULL) return HTP_ERROR; // Copy the beginning of the list to the beginning of the new memory block /* coverity[suspicious_sizeof] */ memcpy(newblock, (void *) ((char *) l->elements + l->first * sizeof (void *)), (size_t) ((l->max_size - l->first) * sizeof (void *))); // Append the second part of the list to the end memcpy((void *) ((char *) newblock + (l->max_size - l->first) * sizeof (void *)), (void *) l->elements, (size_t) (l->first * sizeof (void *))); free(l->elements); } l->first = 0; l->last = l->current_size; l->max_size = new_size; l->elements = newblock; } l->elements[l->last] = e; l->current_size++; l->last++; if (l->last == l->max_size) { l->last = 0; } return HTP_OK; } htp_status_t htp_list_array_replace(htp_list_array_t *l, size_t idx, void *e) { if (l == NULL) return HTP_ERROR; if (idx + 1 > l->current_size) return HTP_DECLINED; size_t i = l->first; while (idx--) { if (++i == l->max_size) { i = 0; } } l->elements[i] = e; return HTP_OK; } size_t htp_list_array_size(const htp_list_array_t *l) { if (l == NULL) return HTP_ERROR; return l->current_size; } void *htp_list_array_shift(htp_list_array_t *l) { if (l == NULL) return NULL; void *r = NULL; if (l->current_size == 0) { return NULL; } r = l->elements[l->first]; l->first++; if (l->first == l->max_size) { l->first = 0; } l->current_size--; return r; } #if 0 // Linked list htp_list_linked_t *htp_list_linked_create(void) { htp_list_linked_t *l = calloc(1, sizeof (htp_list_linked_t)); if (l == NULL) return NULL; return l; } void htp_list_linked_destroy(htp_list_linked_t *l) { if (l == NULL) return; // Free the list structures htp_list_linked_element_t *temp = l->first; htp_list_linked_element_t *prev = NULL; while (temp != NULL) { free(temp->data); prev = temp; temp = temp->next; free(prev); } // Free the list itself free(l); } int htp_list_linked_empty(const htp_list_linked_t *l) { if (!l->first) { return 1; } else { return 0; } } void *htp_list_linked_pop(htp_list_linked_t *l) { void *r = NULL; if (!l->first) { return NULL; } // Find the last element htp_list_linked_element_t *qprev = NULL; htp_list_linked_element_t *qe = l->first; while (qe->next != NULL) { qprev = qe; qe = qe->next; } r = qe->data; free(qe); if (qprev != NULL) { qprev->next = NULL; l->last = qprev; } else { l->first = NULL; l->last = NULL; } return r; } int htp_list_linked_push(htp_list_linked_t *l, void *e) { htp_list_linked_element_t *le = calloc(1, sizeof (htp_list_linked_element_t)); if (le == NULL) return -1; // Remember the element le->data = e; // If the queue is empty, make this element first if (!l->first) { l->first = le; } if (l->last) { l->last->next = le; } l->last = le; return 1; } void *htp_list_linked_shift(htp_list_linked_t *l) { void *r = NULL; if (!l->first) { return NULL; } htp_list_linked_element_t *le = l->first; l->first = le->next; r = le->data; if (!l->first) { l->last = NULL; } free(le); return r; } #endif #if 0 int main(int argc, char **argv) { htp_list_t *q = htp_list_array_create(4); htp_list_push(q, "1"); htp_list_push(q, "2"); htp_list_push(q, "3"); htp_list_push(q, "4"); htp_list_shift(q); htp_list_push(q, "5"); htp_list_push(q, "6"); char *s = NULL; while ((s = (char *) htp_list_pop(q)) != NULL) { printf("Got: %s\n", s); } printf("---\n"); htp_list_push(q, "1"); htp_list_push(q, "2"); htp_list_push(q, "3"); htp_list_push(q, "4"); while ((s = (char *) htp_list_shift(q)) != NULL) { printf("Got: %s\n", s); } free(q); return 0; } #endif suricata-3.2.1/libhtp/htp/htp_base64.h0000644000000000000000000000511413051004451014376 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ /* Adapted from the libb64 project (http://sourceforge.net/projects/libb64), which is in public domain. */ #ifndef _HTP_BASE64_H #define _HTP_BASE64_H #ifdef __cplusplus extern "C" { #endif #include "bstr.h" typedef enum { step_a, step_b, step_c, step_d } htp_base64_decodestep; typedef struct { htp_base64_decodestep step; char plainchar; } htp_base64_decoder; void htp_base64_decoder_init(htp_base64_decoder *state_in); int htp_base64_decode_single(signed char value_in); int htp_base64_decode(htp_base64_decoder *decoder, const void *code_in, int length_in, void *plaintext_out, int length_out); bstr *htp_base64_decode_bstr(bstr *input); bstr *htp_base64_decode_mem(const void *data, size_t len); #ifdef __cplusplus } #endif #endif /* _HTP_BASE64_H */ suricata-3.2.1/libhtp/htp/htp_transaction.c0000644000000000000000000013332413051004451015637 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" static bstr *copy_or_wrap_mem(const void *data, size_t len, enum htp_alloc_strategy_t alloc) { if (data == NULL) return NULL; if (alloc == HTP_ALLOC_REUSE) { return bstr_wrap_mem(data, len); } else { return bstr_dup_mem(data, len); } } htp_tx_t *htp_tx_create(htp_connp_t *connp) { if (connp == NULL) return NULL; htp_tx_t *tx = calloc(1, sizeof (htp_tx_t)); if (tx == NULL) return NULL; tx->connp = connp; tx->conn = connp->conn; tx->index = htp_list_size(tx->conn->transactions); tx->cfg = connp->cfg; tx->is_config_shared = HTP_CONFIG_SHARED; // Request fields. tx->request_progress = HTP_REQUEST_NOT_STARTED; tx->request_protocol_number = HTP_PROTOCOL_UNKNOWN; tx->request_content_length = -1; tx->parsed_uri_raw = htp_uri_alloc(); if (tx->parsed_uri_raw == NULL) { htp_tx_destroy_incomplete(tx); return NULL; } tx->request_headers = htp_table_create(32); if (tx->request_headers == NULL) { htp_tx_destroy_incomplete(tx); return NULL; } tx->request_params = htp_table_create(32); if (tx->request_params == NULL) { htp_tx_destroy_incomplete(tx); return NULL; } // Response fields. tx->response_progress = HTP_RESPONSE_NOT_STARTED; tx->response_status = NULL; tx->response_status_number = HTP_STATUS_UNKNOWN; tx->response_protocol_number = HTP_PROTOCOL_UNKNOWN; tx->response_content_length = -1; tx->response_headers = htp_table_create(32); if (tx->response_headers == NULL) { htp_tx_destroy_incomplete(tx); return NULL; } htp_list_add(tx->conn->transactions, tx); return tx; } htp_status_t htp_tx_destroy(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; if (!htp_tx_is_complete(tx)) return HTP_ERROR; htp_tx_destroy_incomplete(tx); return HTP_OK; } void htp_tx_destroy_incomplete(htp_tx_t *tx) { if (tx == NULL) return; // Disconnect transaction from other structures. htp_conn_remove_tx(tx->conn, tx); htp_connp_tx_remove(tx->connp, tx); // Request fields. bstr_free(tx->request_line); bstr_free(tx->request_method); bstr_free(tx->request_uri); bstr_free(tx->request_protocol); bstr_free(tx->request_content_type); bstr_free(tx->request_hostname); htp_uri_free(tx->parsed_uri_raw); htp_uri_free(tx->parsed_uri); bstr_free(tx->request_auth_username); bstr_free(tx->request_auth_password); // Request_headers. if (tx->request_headers != NULL) { htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(tx->request_headers); i < n; i++) { h = htp_table_get_index(tx->request_headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_destroy(tx->request_headers); } // Request parsers. htp_urlenp_destroy(tx->request_urlenp_query); htp_urlenp_destroy(tx->request_urlenp_body); htp_mpartp_destroy(tx->request_mpartp); // Request parameters. htp_param_t *param = NULL; for (size_t i = 0, n = htp_table_size(tx->request_params); i < n; i++) { param = htp_table_get_index(tx->request_params, i, NULL); bstr_free(param->name); bstr_free(param->value); free(param); } htp_table_destroy(tx->request_params); // Request cookies. if (tx->request_cookies != NULL) { bstr *b = NULL; for (size_t i = 0, n = htp_table_size(tx->request_cookies); i < n; i++) { b = htp_table_get_index(tx->request_cookies, i, NULL); bstr_free(b); } htp_table_destroy(tx->request_cookies); } htp_hook_destroy(tx->hook_request_body_data); // Response fields. bstr_free(tx->response_line); bstr_free(tx->response_protocol); bstr_free(tx->response_status); bstr_free(tx->response_message); bstr_free(tx->response_content_type); // Destroy response headers. if (tx->response_headers != NULL) { htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(tx->response_headers); i < n; i++) { h = htp_table_get_index(tx->response_headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_destroy(tx->response_headers); } // If we're using a private configuration structure, destroy it. if (tx->is_config_shared == HTP_CONFIG_PRIVATE) { htp_config_destroy(tx->cfg); } free(tx); } int htp_tx_get_is_config_shared(const htp_tx_t *tx) { if (tx == NULL) return -1; return tx->is_config_shared; } void *htp_tx_get_user_data(const htp_tx_t *tx) { if (tx == NULL) return NULL; return tx->user_data; } void htp_tx_set_config(htp_tx_t *tx, htp_cfg_t *cfg, int is_cfg_shared) { if ((tx == NULL) || (cfg == NULL)) return; if ((is_cfg_shared != HTP_CONFIG_PRIVATE) && (is_cfg_shared != HTP_CONFIG_SHARED)) return; // If we're using a private configuration, destroy it. if (tx->is_config_shared == HTP_CONFIG_PRIVATE) { htp_config_destroy(tx->cfg); } tx->cfg = cfg; tx->is_config_shared = is_cfg_shared; } void htp_tx_set_user_data(htp_tx_t *tx, void *user_data) { if (tx == NULL) return; tx->user_data = user_data; } htp_status_t htp_tx_req_add_param(htp_tx_t *tx, htp_param_t *param) { if ((tx == NULL) || (param == NULL)) return HTP_ERROR; if (tx->cfg->parameter_processor != NULL) { if (tx->cfg->parameter_processor(param) != HTP_OK) return HTP_ERROR; } return htp_table_addk(tx->request_params, param->name, param); } htp_param_t *htp_tx_req_get_param(htp_tx_t *tx, const char *name, size_t name_len) { if ((tx == NULL) || (name == NULL)) return NULL; return htp_table_get_mem(tx->request_params, name, name_len); } htp_param_t *htp_tx_req_get_param_ex(htp_tx_t *tx, enum htp_data_source_t source, const char *name, size_t name_len) { if ((tx == NULL) || (name == NULL)) return NULL; htp_param_t *p = NULL; for (size_t i = 0, n = htp_table_size(tx->request_params); i < n; i++) { p = htp_table_get_index(tx->request_params, i, NULL); if (p->source != source) continue; if (bstr_cmp_mem_nocase(p->name, name, name_len) == 0) return p; } return NULL; } int htp_tx_req_has_body(const htp_tx_t *tx) { if (tx == NULL) return -1; if ((tx->request_transfer_coding == HTP_CODING_IDENTITY) || (tx->request_transfer_coding == HTP_CODING_CHUNKED)) { return 1; } return 0; } htp_status_t htp_tx_req_set_header(htp_tx_t *tx, const char *name, size_t name_len, const char *value, size_t value_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (name == NULL) || (value == NULL)) return HTP_ERROR; htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return HTP_ERROR; h->name = copy_or_wrap_mem(name, name_len, alloc); if (h->name == NULL) { free(h); return HTP_ERROR; } h->value = copy_or_wrap_mem(value, value_len, alloc); if (h->value == NULL) { bstr_free(h->name); free(h); return HTP_ERROR; } if (htp_table_add(tx->request_headers, h->name, h) != HTP_OK) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_req_set_method(htp_tx_t *tx, const char *method, size_t method_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (method == NULL)) return HTP_ERROR; tx->request_method = copy_or_wrap_mem(method, method_len, alloc); if (tx->request_method == NULL) return HTP_ERROR; return HTP_OK; } void htp_tx_req_set_method_number(htp_tx_t *tx, enum htp_method_t method_number) { if (tx == NULL) return; tx->request_method_number = method_number; } htp_status_t htp_tx_req_set_uri(htp_tx_t *tx, const char *uri, size_t uri_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (uri == NULL)) return HTP_ERROR; tx->request_uri = copy_or_wrap_mem(uri, uri_len, alloc); if (tx->request_uri == NULL) return HTP_ERROR; return HTP_OK; } htp_status_t htp_tx_req_set_protocol(htp_tx_t *tx, const char *protocol, size_t protocol_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (protocol == NULL)) return HTP_ERROR; tx->request_protocol = copy_or_wrap_mem(protocol, protocol_len, alloc); if (tx->request_protocol == NULL) return HTP_ERROR; return HTP_OK; } void htp_tx_req_set_protocol_number(htp_tx_t *tx, int protocol_number) { if (tx == NULL) return; tx->request_protocol_number = protocol_number; } void htp_tx_req_set_protocol_0_9(htp_tx_t *tx, int is_protocol_0_9) { if (tx == NULL) return; if (is_protocol_0_9) { tx->is_protocol_0_9 = 1; } else { tx->is_protocol_0_9 = 0; } } static htp_status_t htp_tx_process_request_headers(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // Determine if we have a request body, and how it is packaged. htp_status_t rc = HTP_OK; htp_header_t *cl = htp_table_get_c(tx->request_headers, "content-length"); htp_header_t *te = htp_table_get_c(tx->request_headers, "transfer-encoding"); // Check for the Transfer-Encoding header, which would indicate a chunked request body. if (te != NULL) { // Make sure it contains "chunked" only. // TODO The HTTP/1.1 RFC also allows the T-E header to contain "identity", which // presumably should have the same effect as T-E header absence. However, Apache // (2.2.22 on Ubuntu 12.04 LTS) instead errors out with "Unknown Transfer-Encoding: identity". // And it behaves strangely, too, sending a 501 and proceeding to process the request // (e.g., PHP is run), but without the body. It then closes the connection. if (bstr_cmp_c_nocase(te->value, "chunked") != 0) { // Invalid T-E header value. tx->request_transfer_coding = HTP_CODING_INVALID; tx->flags |= HTP_REQUEST_INVALID_T_E; tx->flags |= HTP_REQUEST_INVALID; } else { // Chunked encoding is a HTTP/1.1 feature, so check that an earlier protocol // version is not used. The flag will also be set if the protocol could not be parsed. // // TODO IIS 7.0, for example, would ignore the T-E header when it // it is used with a protocol below HTTP 1.1. This should be a // personality trait. if (tx->request_protocol_number < HTP_PROTOCOL_1_1) { tx->flags |= HTP_REQUEST_INVALID_T_E; tx->flags |= HTP_REQUEST_SMUGGLING; } // If the T-E header is present we are going to use it. tx->request_transfer_coding = HTP_CODING_CHUNKED; // We are still going to check for the presence of C-L. if (cl != NULL) { // According to the HTTP/1.1 RFC (section 4.4): // // "The Content-Length header field MUST NOT be sent // if these two lengths are different (i.e., if a Transfer-Encoding // header field is present). If a message is received with both a // Transfer-Encoding header field and a Content-Length header field, // the latter MUST be ignored." // tx->flags |= HTP_REQUEST_SMUGGLING; } } } else if (cl != NULL) { // Check for a folded C-L header. if (cl->flags & HTP_FIELD_FOLDED) { tx->flags |= HTP_REQUEST_SMUGGLING; } // Check for multiple C-L headers. if (cl->flags & HTP_FIELD_REPEATED) { tx->flags |= HTP_REQUEST_SMUGGLING; // TODO Personality trait to determine which C-L header to parse. // At the moment we're parsing the combination of all instances, // which is bound to fail (because it will contain commas). } // Get the body length. tx->request_content_length = htp_parse_content_length(cl->value); if (tx->request_content_length < 0) { tx->request_transfer_coding = HTP_CODING_INVALID; tx->flags |= HTP_REQUEST_INVALID_C_L; tx->flags |= HTP_REQUEST_INVALID; } else { // We have a request body of known length. tx->request_transfer_coding = HTP_CODING_IDENTITY; } } else { // No body. tx->request_transfer_coding = HTP_CODING_NO_BODY; } // If we could not determine the correct body handling, // consider the request invalid. if (tx->request_transfer_coding == HTP_CODING_UNKNOWN) { tx->request_transfer_coding = HTP_CODING_INVALID; tx->flags |= HTP_REQUEST_INVALID; } // Check for PUT requests, which we need to treat as file uploads. if (tx->request_method_number == HTP_M_PUT) { if (htp_tx_req_has_body(tx)) { // Prepare to treat PUT request body as a file. tx->connp->put_file = calloc(1, sizeof (htp_file_t)); if (tx->connp->put_file == NULL) return HTP_ERROR; tx->connp->put_file->fd = -1; tx->connp->put_file->source = HTP_FILE_PUT; } else { // TODO Warn about PUT request without a body. } } // Determine hostname. // Use the hostname from the URI, when available. if (tx->parsed_uri->hostname != NULL) { tx->request_hostname = bstr_dup(tx->parsed_uri->hostname); if (tx->request_hostname == NULL) return HTP_ERROR; } tx->request_port_number = tx->parsed_uri->port_number; // Examine the Host header. htp_header_t *h = htp_table_get_c(tx->request_headers, "host"); if (h == NULL) { // No host information in the headers. // HTTP/1.1 requires host information in the headers. if (tx->request_protocol_number >= HTP_PROTOCOL_1_1) { tx->flags |= HTP_HOST_MISSING; } } else { // Host information available in the headers. bstr *hostname; int port; rc = htp_parse_header_hostport(h->value, &hostname, NULL, &port, &(tx->flags)); if (rc != HTP_OK) return rc; if (hostname != NULL) { // The host information in the headers is valid. // Is there host information in the URI? if (tx->request_hostname == NULL) { // There is no host information in the URI. Place the // hostname from the headers into the parsed_uri structure. tx->request_hostname = hostname; tx->request_port_number = port; } else { // The host information appears in the URI and in the headers. The // HTTP RFC states that we should ignore the header copy. // Check for different hostnames. if (bstr_cmp_nocase(hostname, tx->request_hostname) != 0) { tx->flags |= HTP_HOST_AMBIGUOUS; } // Check for different ports. if (((tx->request_port_number != -1)&&(port != -1))&&(tx->request_port_number != port)) { tx->flags |= HTP_HOST_AMBIGUOUS; } bstr_free(hostname); } } else { // Invalid host information in the headers. if (tx->request_hostname != NULL) { // Raise the flag, even though the host information in the headers is invalid. tx->flags |= HTP_HOST_AMBIGUOUS; } } } // Determine Content-Type. htp_header_t *ct = htp_table_get_c(tx->request_headers, "content-type"); if (ct != NULL) { rc = htp_parse_ct_header(ct->value, &tx->request_content_type); if (rc != HTP_OK) return rc; } // Parse cookies. if (tx->connp->cfg->parse_request_cookies) { rc = htp_parse_cookies_v0(tx->connp); if (rc != HTP_OK) return rc; } // Parse authentication information. if (tx->connp->cfg->parse_request_auth) { rc = htp_parse_authorization(tx->connp); if (rc == HTP_DECLINED) { // Don't fail the stream if an authorization header is invalid, just set a flag. tx->flags |= HTP_AUTH_INVALID; } else { if (rc != HTP_OK) return rc; } } // Finalize sending raw header data. rc = htp_connp_req_receiver_finalize_clear(tx->connp); if (rc != HTP_OK) return rc; // Run hook REQUEST_HEADERS. rc = htp_hook_run_all(tx->connp->cfg->hook_request_headers, tx); if (rc != HTP_OK) return rc; // We cannot proceed if the request is invalid. if (tx->flags & HTP_REQUEST_INVALID) { return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_req_process_body_data(htp_tx_t *tx, const void *data, size_t len) { if ((tx == NULL) || (data == NULL)) return HTP_ERROR; if (len == 0) return HTP_OK; return htp_tx_req_process_body_data_ex(tx, data, len); } htp_status_t htp_tx_req_process_body_data_ex(htp_tx_t *tx, const void *data, size_t len) { if (tx == NULL) return HTP_ERROR; // NULL data is allowed in this private function; it's // used to indicate the end of request body. // Keep track of the body length. tx->request_entity_len += len; // Send data to the callbacks. htp_tx_data_t d; d.tx = tx; d.data = (unsigned char *) data; d.len = len; htp_status_t rc = htp_req_run_hook_body_data(tx->connp, &d); if (rc != HTP_OK) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Request body data callback returned error (%d)", rc); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_req_set_headers_clear(htp_tx_t *tx) { if ((tx == NULL) || (tx->request_headers == NULL)) return HTP_ERROR; htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(tx->request_headers); i < n; i++) { h = htp_table_get_index(tx->request_headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_destroy(tx->request_headers); tx->request_headers = htp_table_create(32); if (tx->request_headers == NULL) return HTP_ERROR; return HTP_OK; } htp_status_t htp_tx_req_set_line(htp_tx_t *tx, const char *line, size_t line_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (line == NULL) || (line_len == 0)) return HTP_ERROR; tx->request_line = copy_or_wrap_mem(line, line_len, alloc); if (tx->request_line == NULL) return HTP_ERROR; if (tx->connp->cfg->parse_request_line(tx->connp) != HTP_OK) return HTP_ERROR; return HTP_OK; } void htp_tx_req_set_parsed_uri(htp_tx_t *tx, htp_uri_t *parsed_uri) { if ((tx == NULL) || (parsed_uri == NULL)) return; if (tx->parsed_uri != NULL) { htp_uri_free(tx->parsed_uri); } tx->parsed_uri = parsed_uri; } htp_status_t htp_tx_res_set_status_line(htp_tx_t *tx, const char *line, size_t line_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (line == NULL) || (line_len == 0)) return HTP_ERROR; tx->response_line = copy_or_wrap_mem(line, line_len, alloc); if (tx->response_line == NULL) return HTP_ERROR; if (tx->connp->cfg->parse_response_line(tx->connp) != HTP_OK) return HTP_ERROR; return HTP_OK; } void htp_tx_res_set_protocol_number(htp_tx_t *tx, int protocol_number) { if (tx == NULL) return; tx->response_protocol_number = protocol_number; } void htp_tx_res_set_status_code(htp_tx_t *tx, int status_code) { if (tx == NULL) return; tx->response_status_number = status_code; } htp_status_t htp_tx_res_set_status_message(htp_tx_t *tx, const char *msg, size_t msg_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (msg == NULL)) return HTP_ERROR; if (tx->response_message != NULL) { bstr_free(tx->response_message); } tx->response_message = copy_or_wrap_mem(msg, msg_len, alloc); if (tx->response_message == NULL) return HTP_ERROR; return HTP_OK; } htp_status_t htp_tx_state_response_line(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; #if 0 // Commented-out until we determine which fields can be // unavailable in real-life. // Unless we're dealing with HTTP/0.9, check that // the minimum amount of data has been provided. if (tx->is_protocol_0_9 != 0) { if ((tx->response_protocol == NULL) || (tx->response_status_number == -1) || (tx->response_message == NULL)) { return HTP_ERROR; } } #endif // Is the response line valid? if ((tx->response_protocol_number == HTP_PROTOCOL_INVALID) || (tx->response_status_number == HTP_STATUS_INVALID) || (tx->response_status_number < HTP_VALID_STATUS_MIN) || (tx->response_status_number > HTP_VALID_STATUS_MAX)) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Invalid response line."); tx->flags |= HTP_STATUS_LINE_INVALID; } // Run hook HTP_RESPONSE_LINE htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_response_line, tx); if (rc != HTP_OK) return rc; return HTP_OK; } htp_status_t htp_tx_res_set_header(htp_tx_t *tx, const char *name, size_t name_len, const char *value, size_t value_len, enum htp_alloc_strategy_t alloc) { if ((tx == NULL) || (name == NULL) || (value == NULL)) return HTP_ERROR; htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return HTP_ERROR; h->name = copy_or_wrap_mem(name, name_len, alloc); if (h->name == NULL) { free(h); return HTP_ERROR; } h->value = copy_or_wrap_mem(value, value_len, alloc); if (h->value == NULL) { bstr_free(h->name); free(h); return HTP_ERROR; } if (htp_table_add(tx->response_headers, h->name, h) != HTP_OK) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_res_set_headers_clear(htp_tx_t *tx) { if ((tx == NULL) || (tx->response_headers == NULL)) return HTP_ERROR; htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(tx->response_headers); i < n; i++) { h = htp_table_get_index(tx->response_headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_destroy(tx->response_headers); tx->response_headers = htp_table_create(32); if (tx->response_headers == NULL) return HTP_ERROR; return HTP_OK; } void htp_connp_destroy_decompressors(htp_connp_t *connp) { htp_decompressor_t *comp = connp->out_decompressor; while (comp) { htp_decompressor_t *next = comp->next; comp->destroy(comp); comp = next; } connp->out_decompressor = NULL; } /** \internal * * Clean up decompressor(s). * * @param[in] tx */ static void htp_tx_res_destroy_decompressors(htp_tx_t *tx) { htp_connp_destroy_decompressors(tx->connp); } static htp_status_t htp_tx_res_process_body_data_decompressor_callback(htp_tx_data_t *d) { if (d == NULL) return HTP_ERROR; #if HTP_DEBUG fprint_raw_data(stderr, __func__, d->data, d->len); #endif // Keep track of actual response body length. d->tx->response_entity_len += d->len; // Invoke all callbacks. htp_status_t rc = htp_res_run_hook_body_data(d->tx->connp, d); if (rc != HTP_OK) return HTP_ERROR; return HTP_OK; } htp_status_t htp_tx_res_process_body_data(htp_tx_t *tx, const void *data, size_t len) { if ((tx == NULL) || (data == NULL)) return HTP_ERROR; if (len == 0) return HTP_OK; return htp_tx_res_process_body_data_ex(tx, data, len); } htp_status_t htp_tx_res_process_body_data_ex(htp_tx_t *tx, const void *data, size_t len) { if (tx == NULL) return HTP_ERROR; // NULL data is allowed in this private function; it's // used to indicate the end of response body. #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, data, len); #endif htp_tx_data_t d; d.tx = tx; d.data = (unsigned char *) data; d.len = len; d.is_last = 0; // Keep track of body size before decompression. tx->response_message_len += d.len; switch (tx->response_content_encoding_processing) { case HTP_COMPRESSION_GZIP: case HTP_COMPRESSION_DEFLATE: // In severe memory stress these could be NULL if (tx->connp->out_decompressor == NULL || tx->connp->out_decompressor->decompress == NULL) return HTP_ERROR; // Send data buffer to the decompressor. tx->connp->out_decompressor->decompress(tx->connp->out_decompressor, &d); if (data == NULL) { // Shut down the decompressor, if we used one. htp_tx_res_destroy_decompressors(tx); } break; case HTP_COMPRESSION_NONE: // When there's no decompression, response_entity_len. // is identical to response_message_len. tx->response_entity_len += d.len; htp_status_t rc = htp_res_run_hook_body_data(tx->connp, &d); if (rc != HTP_OK) return HTP_ERROR; break; default: // Internal error. htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "[Internal Error] Invalid tx->response_content_encoding_processing value: %d", tx->response_content_encoding_processing); return HTP_ERROR; break; } return HTP_OK; } htp_status_t htp_tx_state_request_complete_partial(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // Finalize request body. if (htp_tx_req_has_body(tx)) { htp_status_t rc = htp_tx_req_process_body_data_ex(tx, NULL, 0); if (rc != HTP_OK) return rc; } tx->request_progress = HTP_REQUEST_COMPLETE; // Run hook REQUEST_COMPLETE. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_request_complete, tx); if (rc != HTP_OK) return rc; // Clean-up. if (tx->connp->put_file != NULL) { bstr_free(tx->connp->put_file->filename); free(tx->connp->put_file); tx->connp->put_file = NULL; } return HTP_OK; } htp_status_t htp_tx_state_request_complete(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; if (tx->request_progress != HTP_REQUEST_COMPLETE) { htp_status_t rc = htp_tx_state_request_complete_partial(tx); if (rc != HTP_OK) return rc; } // Make a copy of the connection parser pointer, so that // we don't have to reference it via tx, which may be // destroyed later. htp_connp_t *connp = tx->connp; // Determine what happens next, and remove this transaction from the parser. if (tx->is_protocol_0_9) { connp->in_state = htp_connp_REQ_IGNORE_DATA_AFTER_HTTP_0_9; } else { connp->in_state = htp_connp_REQ_IDLE; } // Check if the entire transaction is complete. This call may // destroy the transaction, if auto-destroy is enabled. htp_tx_finalize(tx); // At this point, tx may no longer be valid. connp->in_tx = NULL; return HTP_OK; } htp_status_t htp_tx_state_request_start(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // Run hook REQUEST_START. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_request_start, tx); if (rc != HTP_OK) return rc; // Change state into request line parsing. tx->connp->in_state = htp_connp_REQ_LINE; tx->connp->in_tx->request_progress = HTP_REQUEST_LINE; return HTP_OK; } htp_status_t htp_tx_state_request_headers(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // If we're in HTP_REQ_HEADERS that means that this is the // first time we're processing headers in a request. Otherwise, // we're dealing with trailing headers. if (tx->request_progress > HTP_REQUEST_HEADERS) { // Request trailers. // Run hook HTP_REQUEST_TRAILER. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_request_trailer, tx); if (rc != HTP_OK) return rc; // Finalize sending raw header data. rc = htp_connp_req_receiver_finalize_clear(tx->connp); if (rc != HTP_OK) return rc; // Completed parsing this request; finalize it now. tx->connp->in_state = htp_connp_REQ_FINALIZE; } else if (tx->request_progress >= HTP_REQUEST_LINE) { // Request headers. // Did this request arrive in multiple data chunks? if (tx->connp->in_chunk_count != tx->connp->in_chunk_request_index) { tx->flags |= HTP_MULTI_PACKET_HEAD; } htp_status_t rc = htp_tx_process_request_headers(tx); if (rc != HTP_OK) return rc; tx->connp->in_state = htp_connp_REQ_CONNECT_CHECK; } else { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "[Internal Error] Invalid tx progress: %d", tx->request_progress); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_state_request_line(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // Determine how to process the request URI. if (tx->request_method_number == HTP_M_CONNECT) { // When CONNECT is used, the request URI contains an authority string. if (htp_parse_uri_hostport(tx->connp, tx->request_uri, tx->parsed_uri_raw) != HTP_OK) { return HTP_ERROR; } } else { // Parse the request URI into htp_tx_t::parsed_uri_raw. if (htp_parse_uri(tx->request_uri, &(tx->parsed_uri_raw)) != HTP_OK) { return HTP_ERROR; } } // Build htp_tx_t::parsed_uri, but only if it was not explicitly set already. if (tx->parsed_uri == NULL) { tx->parsed_uri = htp_uri_alloc(); if (tx->parsed_uri == NULL) return HTP_ERROR; // Keep the original URI components, but create a copy which we can normalize and use internally. if (htp_normalize_parsed_uri(tx, tx->parsed_uri_raw, tx->parsed_uri) != HTP_OK) { return HTP_ERROR; } } // Check parsed_uri hostname. if (tx->parsed_uri->hostname != NULL) { if (htp_validate_hostname(tx->parsed_uri->hostname) == 0) { tx->flags |= HTP_HOSTU_INVALID; } } // Run hook REQUEST_URI_NORMALIZE. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_request_uri_normalize, tx); if (rc != HTP_OK) return rc; // Run hook REQUEST_LINE. rc = htp_hook_run_all(tx->connp->cfg->hook_request_line, tx); if (rc != HTP_OK) return rc; // Move on to the next phase. tx->connp->in_state = htp_connp_REQ_PROTOCOL; return HTP_OK; } htp_status_t htp_tx_state_response_complete(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; return htp_tx_state_response_complete_ex(tx, 1 /* hybrid mode */); } htp_status_t htp_tx_finalize(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; if (!htp_tx_is_complete(tx)) return HTP_OK; // Run hook TRANSACTION_COMPLETE. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_transaction_complete, tx); if (rc != HTP_OK) return rc; // In streaming processing, we destroy the transaction because it will not be needed any more. if (tx->connp->cfg->tx_auto_destroy) { htp_tx_destroy(tx); } return HTP_OK; } htp_status_t htp_tx_state_response_complete_ex(htp_tx_t *tx, int hybrid_mode) { if (tx == NULL) return HTP_ERROR; if (tx->response_progress != HTP_RESPONSE_COMPLETE) { tx->response_progress = HTP_RESPONSE_COMPLETE; // Run the last RESPONSE_BODY_DATA HOOK, but only if there was a response body present. if (tx->response_transfer_coding != HTP_CODING_NO_BODY) { htp_tx_res_process_body_data_ex(tx, NULL, 0); } // Run hook RESPONSE_COMPLETE. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_response_complete, tx); if (rc != HTP_OK) return rc; } if (!hybrid_mode) { // Check if the inbound parser is waiting on us. If it is, that means that // there might be request data that the inbound parser hasn't consumed yet. // If we don't stop parsing we might encounter a response without a request, // which is why we want to return straight away before processing any data. // // This situation will occur any time the parser needs to see the server // respond to a particular situation before it can decide how to proceed. For // example, when a CONNECT is sent, different paths are used when it is accepted // and when it is not accepted. // // It is not enough to check only in_status here. Because of pipelining, it's possible // that many inbound transactions have been processed, and that the parser is // waiting on a response that we have not seen yet. if ((tx->connp->in_status == HTP_STREAM_DATA_OTHER) && (tx->connp->in_tx == tx->connp->out_tx)) { return HTP_DATA_OTHER; } // Do we have a signal to yield to inbound processing at // the end of the next transaction? if (tx->connp->out_data_other_at_tx_end) { // We do. Let's yield then. tx->connp->out_data_other_at_tx_end = 0; return HTP_DATA_OTHER; } } // Make a copy of the connection parser pointer, so that // we don't have to reference it via tx, which may be destroyed later. htp_connp_t *connp = tx->connp; // Finalize the transaction. This may call may destroy the transaction, if auto-destroy is enabled. htp_status_t rc = htp_tx_finalize(tx); if (rc != HTP_OK) return rc; // Disconnect transaction from the parser. connp->out_tx = NULL; connp->out_state = htp_connp_RES_IDLE; return HTP_OK; } /** * @internal * @brief split input into tokens separated by "seps" * @param seps nul-terminated string: each character is a separator */ static int get_token(const unsigned char *in, size_t in_len, const char *seps, unsigned char **ret_tok_ptr, size_t *ret_tok_len) { #if HTP_DEBUG fprintf(stderr, "INPUT %u", (uint)in_len); fprint_raw_data(stderr, __func__, in, in_len); #endif size_t i = 0; /* skip leading 'separators' */ while (i < in_len) { int match = 0; for (const char *s = seps; *s != '\0'; s++) { if (in[i] == *s) { match++; break; } } if (!match) break; i++; } if (i >= in_len) return 0; in += i; in_len -= i; #if HTP_DEBUG fprintf(stderr, "INPUT (POST SEP STRIP) %u", (uint)in_len); fprint_raw_data(stderr, __func__, in, in_len); #endif for (i = 0; i < in_len; i++) { for (const char *s = seps; *s != '\0'; s++) { if (in[i] == *s) { *ret_tok_ptr = (unsigned char *)in; *ret_tok_len = i; return 1; } } } *ret_tok_ptr = (unsigned char *)in; *ret_tok_len = in_len; return 1; } htp_status_t htp_tx_state_response_headers(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; // Check for compression. // Determine content encoding. int ce_multi_comp = 0; tx->response_content_encoding = HTP_COMPRESSION_NONE; htp_header_t *ce = htp_table_get_c(tx->response_headers, "content-encoding"); if (ce != NULL) { /* fast paths: regular gzip and friends */ if ((bstr_cmp_c_nocase(ce->value, "gzip") == 0) || (bstr_cmp_c_nocase(ce->value, "x-gzip") == 0)) { tx->response_content_encoding = HTP_COMPRESSION_GZIP; } else if ((bstr_cmp_c_nocase(ce->value, "deflate") == 0) || (bstr_cmp_c_nocase(ce->value, "x-deflate") == 0)) { tx->response_content_encoding = HTP_COMPRESSION_DEFLATE; } else if (bstr_cmp_c_nocase(ce->value, "inflate") == 0) { // ignore } else { /* exceptional cases: enter slow path */ ce_multi_comp = 1; } } // Configure decompression, if enabled in the configuration. if (tx->connp->cfg->response_decompression_enabled) { tx->response_content_encoding_processing = tx->response_content_encoding; } else { tx->response_content_encoding_processing = HTP_COMPRESSION_NONE; ce_multi_comp = 0; } // Finalize sending raw header data. htp_status_t rc = htp_connp_res_receiver_finalize_clear(tx->connp); if (rc != HTP_OK) return rc; // Run hook RESPONSE_HEADERS. rc = htp_hook_run_all(tx->connp->cfg->hook_response_headers, tx); if (rc != HTP_OK) return rc; // Initialize the decompression engine as necessary. We can deal with three // scenarios: // // 1. Decompression is enabled, compression indicated in headers, and we decompress. // // 2. As above, but the user disables decompression by setting response_content_encoding // to COMPRESSION_NONE. // // 3. Decompression is disabled and we do not attempt to enable it, but the user // forces decompression by setting response_content_encoding to one of the // supported algorithms. if ((tx->response_content_encoding_processing == HTP_COMPRESSION_GZIP) || (tx->response_content_encoding_processing == HTP_COMPRESSION_DEFLATE) || ce_multi_comp) { if (tx->connp->out_decompressor != NULL) { htp_tx_res_destroy_decompressors(tx); } /* normal case */ if (!ce_multi_comp) { tx->connp->out_decompressor = htp_gzip_decompressor_create(tx->connp, tx->response_content_encoding_processing); if (tx->connp->out_decompressor == NULL) return HTP_ERROR; tx->connp->out_decompressor->callback = htp_tx_res_process_body_data_decompressor_callback; /* multiple ce value case */ } else { int layers = 0; htp_decompressor_t *comp = NULL; uint8_t *tok = NULL; size_t tok_len = 0; uint8_t *input = bstr_ptr(ce->value); size_t input_len = bstr_len(ce->value); #if HTP_DEBUG fprintf(stderr, "INPUT %u", (uint)input_len); fprint_raw_data(stderr, __func__, input, input_len); #endif while (input_len > 0 && get_token(input, input_len, ", ", &tok, &tok_len)) { #if HTP_DEBUG fprintf(stderr, "TOKEN %u", (uint)tok_len); fprint_raw_data(stderr, __func__, tok, tok_len); #endif enum htp_content_encoding_t cetype = HTP_COMPRESSION_NONE; /* check depth limit (0 means no limit) */ if ((tx->connp->cfg->response_decompression_layer_limit != 0) && ((++layers) > tx->connp->cfg->response_decompression_layer_limit)) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Too many response content encoding layers"); break; } if (bstr_util_mem_index_of_c_nocase(tok, tok_len, "gzip") != -1) { if (!(bstr_util_cmp_mem(tok, tok_len, "gzip", 4) == 0 || bstr_util_cmp_mem(tok, tok_len, "x-gzip", 6) == 0)) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "C-E gzip has abnormal value"); } cetype = HTP_COMPRESSION_GZIP; } else if (bstr_util_mem_index_of_c_nocase(tok, tok_len, "deflate") != -1) { if (!(bstr_util_cmp_mem(tok, tok_len, "deflate", 7) == 0 || bstr_util_cmp_mem(tok, tok_len, "x-deflate", 9) == 0)) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "C-E deflate has abnormal value"); } cetype = HTP_COMPRESSION_DEFLATE; } else if (bstr_util_cmp_mem(tok, tok_len, "inflate", 7) == 0) { cetype = HTP_COMPRESSION_NONE; } else { // continue htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "C-E unknown setting"); } if (cetype != HTP_COMPRESSION_NONE) { if (comp == NULL) { tx->response_content_encoding_processing = cetype; tx->connp->out_decompressor = htp_gzip_decompressor_create(tx->connp, tx->response_content_encoding_processing); if (tx->connp->out_decompressor == NULL) { free(input); return HTP_ERROR; } tx->connp->out_decompressor->callback = htp_tx_res_process_body_data_decompressor_callback; comp = tx->connp->out_decompressor; } else { comp->next = htp_gzip_decompressor_create(tx->connp, cetype); if (comp->next == NULL) { free(input); return HTP_ERROR; } comp->next->callback = htp_tx_res_process_body_data_decompressor_callback; comp = comp->next; } } if ((tok_len + 1) >= input_len) break; input += (tok_len + 1); input_len -= (tok_len + 1); } } } else if (tx->response_content_encoding_processing != HTP_COMPRESSION_NONE) { return HTP_ERROR; } return HTP_OK; } htp_status_t htp_tx_state_response_start(htp_tx_t *tx) { if (tx == NULL) return HTP_ERROR; tx->connp->out_tx = tx; // Run hook RESPONSE_START. htp_status_t rc = htp_hook_run_all(tx->connp->cfg->hook_response_start, tx); if (rc != HTP_OK) return rc; // Change state into response line parsing, except if we're following // a HTTP/0.9 request (no status line or response headers). if (tx->is_protocol_0_9) { tx->response_transfer_coding = HTP_CODING_IDENTITY; tx->response_content_encoding_processing = HTP_COMPRESSION_NONE; tx->response_progress = HTP_RESPONSE_BODY; tx->connp->out_state = htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE; tx->connp->out_body_data_left = -1; } else { tx->connp->out_state = htp_connp_RES_LINE; tx->response_progress = HTP_RESPONSE_LINE; } /* If at this point we have no method and no uri and our status * is still htp_connp_REQ_LINE, we likely have timed out request * or a overly long request */ if (tx->request_method == HTP_M_UNKNOWN && tx->request_uri == NULL && tx->connp->in_state == htp_connp_REQ_LINE) { htp_log(tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request line incomplete"); if (htp_connp_REQ_LINE_complete(tx->connp) != HTP_OK) { return HTP_ERROR; } } return HTP_OK; } /** * Register callback for the transaction-specific REQUEST_BODY_DATA hook. * * @param[in] tx * @param[in] callback_fn */ void htp_tx_register_request_body_data(htp_tx_t *tx, int (*callback_fn)(htp_tx_data_t *)) { if ((tx == NULL) || (callback_fn == NULL)) return; htp_hook_register(&tx->hook_request_body_data, (htp_callback_fn_t) callback_fn); } /** * Register callback for the transaction-specific RESPONSE_BODY_DATA hook. * * @param[in] tx * @param[in] callback_fn */ void htp_tx_register_response_body_data(htp_tx_t *tx, int (*callback_fn)(htp_tx_data_t *)) { if ((tx == NULL) || (callback_fn == NULL)) return; htp_hook_register(&tx->hook_response_body_data, (htp_callback_fn_t) callback_fn); } int htp_tx_is_complete(htp_tx_t *tx) { if (tx == NULL) return -1; // A transaction is considered complete only when both the request and // response are complete. (Sometimes a complete response can be seen // even while the request is ongoing.) if ((tx->request_progress != HTP_REQUEST_COMPLETE) || (tx->response_progress != HTP_RESPONSE_COMPLETE)) { return 0; } else { return 1; } } suricata-3.2.1/libhtp/htp/strlcpy.c0000644000000000000000000000507613051004451014141 00000000000000/* * Copyright (c) 1998 Todd C. Miller * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* $Id: strlcpyu.c,v 1.4 2003/10/20 15:03:27 chrisgreen Exp $ */ #include "htp_config_auto.h" #include "htp_private.h" #ifndef HAVE_STRLCPY #if defined(LIBC_SCCS) && !defined(lint) static char *rcsid = "$OpenBSD: strlcpy.c,v 1.4 1999/05/01 18:56:41 millert Exp $"; #endif /* LIBC_SCCS and not lint */ #include #include /* * Copy src to string dst of size siz. At most siz-1 characters * will be copied. Always NUL terminates (unless siz == 0). * Returns strlen(src); if retval >= siz, truncation occurred. */ size_t strlcpy(char *dst, const char *src, size_t siz) { register char *d = dst; register const char *s = src; register size_t n = siz; /* Copy as many bytes as will fit */ if (n != 0 && --n != 0) { do { if ((*d++ = *s++) == 0) break; } while (--n != 0); } /* Not enough room in dst, add NUL and traverse rest of src */ if (n == 0) { if (siz != 0) *d = '\0'; /* NUL-terminate dst */ while (*s++) ; } return(s - src - 1); /* count does not include NUL */ } #endif suricata-3.2.1/libhtp/htp/htp_php.c0000644000000000000000000001021513051004451014072 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * This is a proof-of-concept processor that processes parameter names in * a way _similar_ to PHP. Whitespace at the beginning is removed, and the * remaining whitespace characters are converted to underscores. Proper * research of PHP's behavior is needed before we can claim to be emulating it. * * @param[in,out] p * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_php_parameter_processor(htp_param_t *p) { if (p == NULL) return HTP_ERROR; // Name transformation bstr *new_name = NULL; // Ignore whitespace characters at the beginning of parameter name. unsigned char *data = bstr_ptr(p->name); size_t len = bstr_len(p->name); size_t pos = 0; // Advance over any whitespace characters at the beginning of the name. while ((pos < len) && (isspace(data[pos]))) pos++; // Have we seen any whitespace? if (pos > 0) { // Make a copy of the name, starting with // the first non-whitespace character. new_name = bstr_dup_mem(data + pos, len - pos); if (new_name == NULL) return HTP_ERROR; } // Replace remaining whitespace characters with underscores. size_t offset = pos; pos = 0; // Advance to the end of name or to the first whitespace character. while ((offset + pos < len)&&(!isspace(data[pos]))) pos++; // Are we at the end of the name? if (offset + pos < len) { // Seen whitespace within the string. // Make a copy of the name if needed (which would be the case // with a parameter that does not have any whitespace in front). if (new_name == NULL) { new_name = bstr_dup(p->name); if (new_name == NULL) return HTP_ERROR; } // Change the pointers to the new name and ditch the offset. data = bstr_ptr(new_name); len = bstr_len(new_name); // Replace any whitespace characters in the copy with underscores. while (pos < len) { if (isspace(data[pos])) { data[pos] = '_'; } pos++; } } // If we made any changes, free the old parameter name and put the new one in. if (new_name != NULL) { bstr_free(p->name); p->name = new_name; } return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_version.h0000644000000000000000000000415613051004502015001 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_VERSION_H #define HTP_VERSION_H #ifdef __cplusplus extern "C" { #endif #define HTP_VERSION_STRING "0.5.23" #define HTP_VERSION_STRING_FULL "LibHTP v" HTP_VERSION_STRING #ifdef __cplusplus } #endif #endif /* HTP_VERSION_H */ suricata-3.2.1/libhtp/htp/htp_connection_parser_private.h0000644000000000000000000002174113051004451020563 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CONNECTION_PARSER_PRIVATE_H #define HTP_CONNECTION_PARSER_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #include "htp_core.h" /** * Connection parser structure. */ struct htp_connp_t { // General fields /** Current parser configuration structure. */ htp_cfg_t *cfg; /** The connection structure associated with this parser. */ htp_conn_t *conn; /** Opaque user data associated with this parser. */ const void *user_data; /** * On parser failure, this field will contain the error information. Do note, however, * that the value in this field will only be valid immediately after an error condition, * but it is not guaranteed to remain valid if the parser is invoked again. */ htp_log_t *last_error; // Request parser fields /** Parser inbound status. Starts as HTP_OK, but may turn into HTP_ERROR. */ enum htp_stream_state_t in_status; /** Parser output status. Starts as HTP_OK, but may turn into HTP_ERROR. */ enum htp_stream_state_t out_status; /** * When true, this field indicates that there is unprocessed inbound data, and * that the response parsing code should stop at the end of the current request * in order to allow more requests to be produced. */ unsigned int out_data_other_at_tx_end; /** * The time when the last request data chunk was received. Can be NULL if * the upstream code is not providing the timestamps when calling us. */ htp_time_t in_timestamp; /** Pointer to the current request data chunk. */ unsigned char *in_current_data; /** The length of the current request data chunk. */ int64_t in_current_len; /** The offset of the next byte in the request data chunk to read. */ int64_t in_current_read_offset; /** * The starting point of the data waiting to be consumed. This field is used * in the states where reading data is not the same as consumption. */ int64_t in_current_consume_offset; /** * Marks the starting point of raw data within the inbound data chunk. Raw * data (e.g., complete headers) is sent to appropriate callbacks (e.g., * REQUEST_HEADER_DATA). */ int64_t in_current_receiver_offset; /** How many data chunks does the inbound connection stream consist of? */ size_t in_chunk_count; /** The index of the first chunk used in the current request. */ size_t in_chunk_request_index; /** The offset, in the entire connection stream, of the next request byte. */ int64_t in_stream_offset; /** * The value of the request byte currently being processed. This field is * populated when the IN_NEXT_* or IN_PEEK_* macros are invoked. */ int in_next_byte; /** Used to buffer a line of inbound data when buffering cannot be avoided. */ unsigned char *in_buf; /** Stores the size of the buffer. Valid only when htp_tx_t::in_buf is not NULL. */ size_t in_buf_size; /** * Stores the current value of a folded request header. Such headers span * multiple lines, and are processed only when all data is available. */ bstr *in_header; /** Ongoing inbound transaction. */ htp_tx_t *in_tx; /** * The request body length declared in a valid request header. The key here * is "valid". This field will not be populated if the request contains both * a Transfer-Encoding header and a Content-Length header. */ int64_t in_content_length; /** * Holds the remaining request body length that we expect to read. This * field will be available only when the length of a request body is known * in advance, i.e. when request headers contain a Content-Length header. */ int64_t in_body_data_left; /** * Holds the amount of data that needs to be read from the * current data chunk. Only used with chunked request bodies. */ int64_t in_chunked_length; /** Current request parser state. */ int (*in_state)(htp_connp_t *); /** Previous request parser state. Used to detect state changes. */ int (*in_state_previous)(htp_connp_t *); /** The hook that should be receiving raw connection data. */ htp_hook_t *in_data_receiver_hook; // Response parser fields /** * Response counter, incremented with every new response. This field is * used to match responses to requests. The expectation is that for every * response there will already be a transaction (request) waiting. */ size_t out_next_tx_index; /** The time when the last response data chunk was received. Can be NULL. */ htp_time_t out_timestamp; /** Pointer to the current response data chunk. */ unsigned char *out_current_data; /** The length of the current response data chunk. */ int64_t out_current_len; /** The offset of the next byte in the response data chunk to consume. */ int64_t out_current_read_offset; /** * The starting point of the data waiting to be consumed. This field is used * in the states where reading data is not the same as consumption. */ int64_t out_current_consume_offset; /** * Marks the starting point of raw data within the outbound data chunk. Raw * data (e.g., complete headers) is sent to appropriate callbacks (e.g., * RESPONSE_HEADER_DATA). */ int64_t out_current_receiver_offset; /** The offset, in the entire connection stream, of the next response byte. */ int64_t out_stream_offset; /** The value of the response byte currently being processed. */ int out_next_byte; /** Used to buffer a line of outbound data when buffering cannot be avoided. */ unsigned char *out_buf; /** Stores the size of the buffer. Valid only when htp_tx_t::out_buf is not NULL. */ size_t out_buf_size; /** * Stores the current value of a folded response header. Such headers span * multiple lines, and are processed only when all data is available. */ bstr *out_header; /** Ongoing outbound transaction */ htp_tx_t *out_tx; /** * The length of the current response body as presented in the * Content-Length response header. */ int64_t out_content_length; /** The remaining length of the current response body, if known. Set to -1 otherwise. */ int64_t out_body_data_left; /** * Holds the amount of data that needs to be read from the * current response data chunk. Only used with chunked response bodies. */ int64_t out_chunked_length; /** Current response parser state. */ int (*out_state)(htp_connp_t *); /** Previous response parser state. */ int (*out_state_previous)(htp_connp_t *); /** The hook that should be receiving raw connection data. */ htp_hook_t *out_data_receiver_hook; /** Response decompressor used to decompress response body data. */ htp_decompressor_t *out_decompressor; /** On a PUT request, this field contains additional file data. */ htp_file_t *put_file; }; /** * This function is most likely not used and/or not needed. * * @param[in] connp */ void htp_connp_in_reset(htp_connp_t *connp); #ifdef __cplusplus } #endif #endif /* HTP_CONNECTION_PARSER_PRIVATE_H */ suricata-3.2.1/libhtp/htp/htp_util.c0000644000000000000000000024720513051004451014273 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Is character a linear white space character? * * @param[in] c * @return 0 or 1 */ int htp_is_lws(int c) { if ((c == ' ') || (c == '\t')) return 1; else return 0; } /** * Is character a separator character? * * @param[in] c * @return 0 or 1 */ int htp_is_separator(int c) { /* separators = "(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\" | <"> | "/" | "[" | "]" | "?" | "=" | "{" | "}" | SP | HT */ switch (c) { case '(': case ')': case '<': case '>': case '@': case ',': case ';': case ':': case '\\': case '"': case '/': case '[': case ']': case '?': case '=': case '{': case '}': case ' ': case '\t': return 1; break; default: return 0; } } /** * Is character a text character? * * @param[in] c * @return 0 or 1 */ int htp_is_text(int c) { if (c == '\t') return 1; if (c < 32) return 0; return 1; } /** * Is character a token character? * * @param[in] c * @return 0 or 1 */ int htp_is_token(int c) { /* token = 1* */ /* CHAR = */ if ((c < 32) || (c > 126)) return 0; if (htp_is_separator(c)) return 0; return 1; } /** * Remove all line terminators (LF or CRLF) from * the end of the line provided as input. * * @return 0 if nothing was removed, 1 if one or more LF characters were removed, or * 2 if one or more CR and/or LF characters were removed. */ int htp_chomp(unsigned char *data, size_t *len) { int r = 0; // Loop until there's no more stuff in the buffer while (*len > 0) { // Try one LF first if (data[*len - 1] == LF) { (*len)--; r = 1; if (*len == 0) return r; // A CR is allowed before LF if (data[*len - 1] == CR) { (*len)--; r = 2; } } else return r; } return r; } /** * Is character a white space character? * * @param[in] c * @return 0 or 1 */ int htp_is_space(int c) { switch (c) { case ' ': case '\f': case '\v': case '\t': case '\r': case '\n': return 1; default: return 0; } } /** * Converts request method, given as a string, into a number. * * @param[in] method * @return Method number of M_UNKNOWN */ int htp_convert_method_to_number(bstr *method) { if (method == NULL) return HTP_M_UNKNOWN; // TODO Optimize using parallel matching, or something similar. if (bstr_cmp_c(method, "GET") == 0) return HTP_M_GET; if (bstr_cmp_c(method, "PUT") == 0) return HTP_M_PUT; if (bstr_cmp_c(method, "POST") == 0) return HTP_M_POST; if (bstr_cmp_c(method, "DELETE") == 0) return HTP_M_DELETE; if (bstr_cmp_c(method, "CONNECT") == 0) return HTP_M_CONNECT; if (bstr_cmp_c(method, "OPTIONS") == 0) return HTP_M_OPTIONS; if (bstr_cmp_c(method, "TRACE") == 0) return HTP_M_TRACE; if (bstr_cmp_c(method, "PATCH") == 0) return HTP_M_PATCH; if (bstr_cmp_c(method, "PROPFIND") == 0) return HTP_M_PROPFIND; if (bstr_cmp_c(method, "PROPPATCH") == 0) return HTP_M_PROPPATCH; if (bstr_cmp_c(method, "MKCOL") == 0) return HTP_M_MKCOL; if (bstr_cmp_c(method, "COPY") == 0) return HTP_M_COPY; if (bstr_cmp_c(method, "MOVE") == 0) return HTP_M_MOVE; if (bstr_cmp_c(method, "LOCK") == 0) return HTP_M_LOCK; if (bstr_cmp_c(method, "UNLOCK") == 0) return HTP_M_UNLOCK; if (bstr_cmp_c(method, "VERSION-CONTROL") == 0) return HTP_M_VERSION_CONTROL; if (bstr_cmp_c(method, "CHECKOUT") == 0) return HTP_M_CHECKOUT; if (bstr_cmp_c(method, "UNCHECKOUT") == 0) return HTP_M_UNCHECKOUT; if (bstr_cmp_c(method, "CHECKIN") == 0) return HTP_M_CHECKIN; if (bstr_cmp_c(method, "UPDATE") == 0) return HTP_M_UPDATE; if (bstr_cmp_c(method, "LABEL") == 0) return HTP_M_LABEL; if (bstr_cmp_c(method, "REPORT") == 0) return HTP_M_REPORT; if (bstr_cmp_c(method, "MKWORKSPACE") == 0) return HTP_M_MKWORKSPACE; if (bstr_cmp_c(method, "MKACTIVITY") == 0) return HTP_M_MKACTIVITY; if (bstr_cmp_c(method, "BASELINE-CONTROL") == 0) return HTP_M_BASELINE_CONTROL; if (bstr_cmp_c(method, "MERGE") == 0) return HTP_M_MERGE; if (bstr_cmp_c(method, "INVALID") == 0) return HTP_M_INVALID; if (bstr_cmp_c(method, "HEAD") == 0) return HTP_M_HEAD; return HTP_M_UNKNOWN; } /** * Is the given line empty? This function expects the line to have * a terminating LF. * * @param[in] data * @param[in] len * @return 0 or 1 */ int htp_is_line_empty(unsigned char *data, size_t len) { if ((len == 1) || ((len == 2) && (data[0] == CR))) { return 1; } return 0; } /** * Does line consist entirely of whitespace characters? * * @param[in] data * @param[in] len * @return 0 or 1 */ int htp_is_line_whitespace(unsigned char *data, size_t len) { size_t i; for (i = 0; i < len; i++) { if (!isspace(data[i])) { return 0; } } return 1; } /** * Parses Content-Length string (positive decimal number). * White space is allowed before and after the number. * * @param[in] b * @return Content-Length as a number, or -1 on error. */ int64_t htp_parse_content_length(bstr *b) { return htp_parse_positive_integer_whitespace((unsigned char *) bstr_ptr(b), bstr_len(b), 10); } /** * Parses chunk length (positive hexadecimal number). White space is allowed before * and after the number. An error will be returned if the chunk length is greater than * INT32_MAX. * * @param[in] data * @param[in] len * @return Chunk length, or a negative number on error. */ int64_t htp_parse_chunked_length(unsigned char *data, size_t len) { // skip leading line feeds and other control chars while (len) { unsigned char c = *data; if (!(c == 0x0d || c == 0x0a || c == 0x20 || c == 0x09 || c == 0x0b || c == 0x0c)) break; data++; len--; } if (len == 0) return -1004; // find how much of the data is correctly formatted size_t i = 0; while (i < len) { unsigned char c = data[i]; if (!(isdigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F'))) break; i++; } // cut off trailing junk if (i != len) { len = i; } int64_t chunk_len = htp_parse_positive_integer_whitespace(data, len, 16); if (chunk_len < 0) return chunk_len; if (chunk_len > INT32_MAX) return -1; return chunk_len; } /** * A somewhat forgiving parser for a positive integer in a given base. * Only LWS is allowed before and after the number. * * @param[in] data * @param[in] len * @param[in] base * @return The parsed number on success; a negative number on error. */ int64_t htp_parse_positive_integer_whitespace(unsigned char *data, size_t len, int base) { if (len == 0) return -1003; size_t last_pos; size_t pos = 0; // Ignore LWS before while ((pos < len) && (htp_is_lws(data[pos]))) pos++; if (pos == len) return -1001; int64_t r = bstr_util_mem_to_pint(data + pos, len - pos, base, &last_pos); if (r < 0) return r; // Move after the last digit pos += last_pos; // Ignore LWS after while (pos < len) { if (!htp_is_lws(data[pos])) { return -1002; } pos++; } return r; } #ifdef HTP_DEBUG /** * Prints one log message to stderr. * * @param[in] stream * @param[in] log */ void htp_print_log(FILE *stream, htp_log_t *log) { if (log->code != 0) { fprintf(stream, "[%d][code %d][file %s][line %d] %s\n", log->level, log->code, log->file, log->line, log->msg); } else { fprintf(stream, "[%d][file %s][line %d] %s\n", log->level, log->file, log->line, log->msg); } } #endif /** * Records one log message. * * @param[in] connp * @param[in] file * @param[in] line * @param[in] level * @param[in] code * @param[in] fmt */ void htp_log(htp_connp_t *connp, const char *file, int line, enum htp_log_level_t level, int code, const char *fmt, ...) { if (connp == NULL) return; char buf[1024]; va_list args; // Ignore messages below our log level. if (connp->cfg->log_level < level) { return; } va_start(args, fmt); int r = vsnprintf(buf, 1024, fmt, args); va_end(args); if (r < 0) { snprintf(buf, 1024, "[vnsprintf returned error %d]", r); } else if (r >= 1024) { // Indicate overflow with a '+' at the end. buf[1022] = '+'; buf[1023] = '\0'; } // Create a new log entry. htp_log_t *log = calloc(1, sizeof (htp_log_t)); if (log == NULL) return; log->connp = connp; log->file = file; log->line = line; log->level = level; log->code = code; log->msg = strdup(buf); htp_list_add(connp->conn->messages, log); if (level == HTP_LOG_ERROR) { connp->last_error = log; } #ifdef HTP_DEBUG fprintf(stderr, "[LOG] %s\n", log->msg); #endif /* coverity[check_return] */ htp_hook_run_all(connp->cfg->hook_log, log); } /** * Determines if the given line is a continuation (of some previous line). * * @param[in] data * @param[in] len * @return 0 or 1 for false and true, respectively. Returns -1 on error (NULL pointer or length zero). */ int htp_connp_is_line_folded(unsigned char *data, size_t len) { if ((data == NULL) || (len == 0)) return -1; return htp_is_folding_char(data[0]); } int htp_is_folding_char(int c) { if (htp_is_lws(c)) return 1; else return 0; } /** * Determines if the given line is a request terminator. * * @param[in] connp * @param[in] data * @param[in] len * @return 0 or 1 */ int htp_connp_is_line_terminator(htp_connp_t *connp, unsigned char *data, size_t len) { // Is this the end of request headers? switch (connp->cfg->server_personality) { case HTP_SERVER_IIS_5_1: // IIS 5 will accept a whitespace line as a terminator if (htp_is_line_whitespace(data, len)) { return 1; } // Fall through default: // Treat an empty line as terminator if (htp_is_line_empty(data, len)) { return 1; } break; } return 0; } /** * Determines if the given line can be ignored when it appears before a request. * * @param[in] connp * @param[in] data * @param[in] len * @return 0 or 1 */ int htp_connp_is_line_ignorable(htp_connp_t *connp, unsigned char *data, size_t len) { return htp_connp_is_line_terminator(connp, data, len); } static htp_status_t htp_parse_port(unsigned char *data, size_t len, int *port, int *invalid) { if (len == 0) { *port = -1; *invalid = 1; return HTP_OK; } int64_t port_parsed = htp_parse_positive_integer_whitespace(data, len, 10); if (port_parsed < 0) { // Failed to parse the port number. *port = -1; *invalid = 1; } else if ((port_parsed > 0) && (port_parsed < 65536)) { // Valid port number. *port = port_parsed; } else { // Port number out of range. *port = -1; *invalid = 1; } return HTP_OK; } /** * Parses an authority string, which consists of a hostname with an optional port number; username * and password are not allowed and will not be handled. * * @param[in] hostport * @param[out] hostname A bstring containing the hostname, or NULL if the hostname is invalid. If this value * is not NULL, the caller assumes responsibility for memory management. * @param[out] port Port as text, or NULL if not provided. * @param[out] port_number Port number, or -1 if the port is not present or invalid. * @param[out] invalid Set to 1 if any part of the authority is invalid. * @return HTP_OK on success, HTP_ERROR on memory allocation failure. */ htp_status_t htp_parse_hostport(bstr *hostport, bstr **hostname, bstr **port, int *port_number, int *invalid) { if ((hostport == NULL) || (hostname == NULL) || (port_number == NULL) || (invalid == NULL)) return HTP_ERROR; *hostname = NULL; if (port != NULL) { *port = NULL; } *port_number = -1; *invalid = 0; unsigned char *data = bstr_ptr(hostport); size_t len = bstr_len(hostport); bstr_util_mem_trim(&data, &len); if (len == 0) { *invalid = 1; return HTP_OK; } // Check for an IPv6 address. if (data[0] == '[') { // IPv6 host. // Find the end of the IPv6 address. size_t pos = 0; while ((pos < len) && (data[pos] != ']')) pos++; if (pos == len) { *invalid = 1; return HTP_OK; } *hostname = bstr_dup_mem(data, pos + 1); if (*hostname == NULL) return HTP_ERROR; // Over the ']'. pos++; if (pos == len) return HTP_OK; // Handle port. if (data[pos] == ':') { if (port != NULL) { *port = bstr_dup_mem(data + pos + 1, len - pos - 1); if (*port == NULL) { bstr_free(*hostname); return HTP_ERROR; } } return htp_parse_port(data + pos + 1, len - pos - 1, port_number, invalid); } else { *invalid = 1; return HTP_OK; } } else { // Not IPv6 host. // Is there a colon? unsigned char *colon = memchr(data, ':', len); if (colon == NULL) { // Hostname alone, no port. *hostname = bstr_dup_mem(data, len); if (*hostname == NULL) return HTP_ERROR; bstr_to_lowercase(*hostname); } else { // Hostname and port. // Ignore whitespace at the end of hostname. unsigned char *hostend = colon; while ((hostend > data) && (isspace(*(hostend - 1)))) hostend--; *hostname = bstr_dup_mem(data, hostend - data); if (*hostname == NULL) return HTP_ERROR; if (port != NULL) { *port = bstr_dup_mem(colon + 1, len - (colon + 1 - data)); if (*port == NULL) { bstr_free(*hostname); return HTP_ERROR; } } return htp_parse_port(colon + 1, len - (colon + 1 - data), port_number, invalid); } } return HTP_OK; } /** * Parses hostport provided in the URI. * * @param[in] connp * @param[in] hostport * @param[in] uri * @return HTP_OK on success or HTP_ERROR error. */ int htp_parse_uri_hostport(htp_connp_t *connp, bstr *hostport, htp_uri_t *uri) { int invalid; htp_status_t rc = htp_parse_hostport(hostport, &(uri->hostname), &(uri->port), &(uri->port_number), &invalid); if (rc != HTP_OK) return rc; if (invalid) { connp->in_tx->flags |= HTP_HOSTU_INVALID; } if (uri->hostname != NULL) { if (htp_validate_hostname(uri->hostname) == 0) { connp->in_tx->flags |= HTP_HOSTU_INVALID; } } return HTP_OK; } /** * Parses hostport provided in the Host header. * * @param[in] hostport * @param[out] hostname * @param[out] port * @param[out] port_number * @param[out] flags * @return HTP_OK on success or HTP_ERROR error. */ htp_status_t htp_parse_header_hostport(bstr *hostport, bstr **hostname, bstr **port, int *port_number, uint64_t *flags) { int invalid; htp_status_t rc = htp_parse_hostport(hostport, hostname, port, port_number, &invalid); if (rc != HTP_OK) return rc; if (invalid) { *flags |= HTP_HOSTH_INVALID; } if (*hostname != NULL) { if (htp_validate_hostname(*hostname) == 0) { *flags |= HTP_HOSTH_INVALID; } } return HTP_OK; } /** * Parses request URI, making no attempt to validate the contents. * * @param[in] input * @param[in] uri * @return HTP_ERROR on memory allocation failure, HTP_OK otherwise */ int htp_parse_uri(bstr *input, htp_uri_t **uri) { // Allow a htp_uri_t structure to be provided on input, // but allocate a new one if the structure is NULL. if (*uri == NULL) { *uri = calloc(1, sizeof (htp_uri_t)); if (*uri == NULL) return HTP_ERROR; } if (input == NULL) { // The input might be NULL on requests that don't actually // contain the URI. We allow that. return HTP_OK; } unsigned char *data = bstr_ptr(input); size_t len = bstr_len(input); size_t start, pos; if (len == 0) { // Empty string. return HTP_OK; } pos = 0; // Scheme test: if it doesn't start with a forward slash character (which it must // for the contents to be a path or an authority, then it must be the scheme part if (data[0] != '/') { // Parse scheme // Find the colon, which marks the end of the scheme part start = pos; while ((pos < len) && (data[pos] != ':')) pos++; if (pos >= len) { // We haven't found a colon, which means that the URI // is invalid. Apache will ignore this problem and assume // the URI contains an invalid path so, for the time being, // we are going to do the same. pos = 0; } else { // Make a copy of the scheme (*uri)->scheme = bstr_dup_mem(data + start, pos - start); if ((*uri)->scheme == NULL) return HTP_ERROR; // Go over the colon pos++; } } // Authority test: two forward slash characters and it's an authority. // One, three or more slash characters, and it's a path. We, however, // only attempt to parse authority if we've seen a scheme. if ((*uri)->scheme != NULL) if ((pos + 2 < len) && (data[pos] == '/') && (data[pos + 1] == '/') && (data[pos + 2] != '/')) { // Parse authority // Go over the two slash characters start = pos = pos + 2; // Authority ends with a question mark, forward slash or hash while ((pos < len) && (data[pos] != '?') && (data[pos] != '/') && (data[pos] != '#')) pos++; unsigned char *hostname_start; size_t hostname_len; // Are the credentials included in the authority? unsigned char *m = memchr(data + start, '@', pos - start); if (m != NULL) { // Credentials present unsigned char *credentials_start = data + start; size_t credentials_len = m - data - start; // Figure out just the hostname part hostname_start = data + start + credentials_len + 1; hostname_len = pos - start - credentials_len - 1; // Extract the username and the password m = memchr(credentials_start, ':', credentials_len); if (m != NULL) { // Username and password (*uri)->username = bstr_dup_mem(credentials_start, m - credentials_start); if ((*uri)->username == NULL) return HTP_ERROR; (*uri)->password = bstr_dup_mem(m + 1, credentials_len - (m - credentials_start) - 1); if ((*uri)->password == NULL) return HTP_ERROR; } else { // Username alone (*uri)->username = bstr_dup_mem(credentials_start, credentials_len); if ((*uri)->username == NULL) return HTP_ERROR; } } else { // No credentials hostname_start = data + start; hostname_len = pos - start; } // Parsing authority without credentials. if ((hostname_len > 0) && (hostname_start[0] == '[')) { // IPv6 address. m = memchr(hostname_start, ']', hostname_len); if (m == NULL) { // Invalid IPv6 address; use the entire string as hostname. (*uri)->hostname = bstr_dup_mem(hostname_start, hostname_len); if ((*uri)->hostname == NULL) return HTP_ERROR; } else { (*uri)->hostname = bstr_dup_mem(hostname_start, m - hostname_start + 1); if ((*uri)->hostname == NULL) return HTP_ERROR; // Is there a port? hostname_len = hostname_len - (m - hostname_start + 1); hostname_start = m + 1; // Port string m = memchr(hostname_start, ':', hostname_len); if (m != NULL) { size_t port_len = hostname_len - (m - hostname_start) - 1; (*uri)->port = bstr_dup_mem(m + 1, port_len); if ((*uri)->port == NULL) return HTP_ERROR; } } } else { // Not IPv6 address. m = memchr(hostname_start, ':', hostname_len); if (m != NULL) { size_t port_len = hostname_len - (m - hostname_start) - 1; hostname_len = hostname_len - port_len - 1; // Port string (*uri)->port = bstr_dup_mem(m + 1, port_len); if ((*uri)->port == NULL) return HTP_ERROR; } // Hostname (*uri)->hostname = bstr_dup_mem(hostname_start, hostname_len); if ((*uri)->hostname == NULL) return HTP_ERROR; } } // Path start = pos; // The path part will end with a question mark or a hash character, which // mark the beginning of the query part or the fragment part, respectively. while ((pos < len) && (data[pos] != '?') && (data[pos] != '#')) pos++; // Path (*uri)->path = bstr_dup_mem(data + start, pos - start); if ((*uri)->path == NULL) return HTP_ERROR; if (pos == len) return HTP_OK; // Query if (data[pos] == '?') { // Step over the question mark start = pos + 1; // The query part will end with the end of the input // or the beginning of the fragment part while ((pos < len) && (data[pos] != '#')) pos++; // Query string (*uri)->query = bstr_dup_mem(data + start, pos - start); if ((*uri)->query == NULL) return HTP_ERROR; if (pos == len) return HTP_OK; } // Fragment if (data[pos] == '#') { // Step over the hash character start = pos + 1; // Fragment; ends with the end of the input (*uri)->fragment = bstr_dup_mem(data + start, len - start); if ((*uri)->fragment == NULL) return HTP_ERROR; } return HTP_OK; } /** * Convert two input bytes, pointed to by the pointer parameter, * into a single byte by assuming the input consists of hexadecimal * characters. This function will happily convert invalid input. * * @param[in] what * @return hex-decoded byte */ static unsigned char x2c(unsigned char *what) { register unsigned char digit; digit = (what[0] >= 'A' ? ((what[0] & 0xdf) - 'A') + 10 : (what[0] - '0')); digit *= 16; digit += (what[1] >= 'A' ? ((what[1] & 0xdf) - 'A') + 10 : (what[1] - '0')); return digit; } /** * Convert a Unicode codepoint into a single-byte, using best-fit * mapping (as specified in the provided configuration structure). * * @param[in] cfg * @param[in] codepoint * @return converted single byte */ static uint8_t bestfit_codepoint(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, uint32_t codepoint) { // Is it a single-byte codepoint? if (codepoint < 0x100) { return (uint8_t) codepoint; } // Our current implementation converts only the 2-byte codepoints. if (codepoint > 0xffff) { return cfg->decoder_cfgs[ctx].bestfit_replacement_byte; } uint8_t *p = cfg->decoder_cfgs[ctx].bestfit_map; // TODO Optimize lookup. for (;;) { uint32_t x = (p[0] << 8) + p[1]; if (x == 0) { return cfg->decoder_cfgs[ctx].bestfit_replacement_byte; } if (x == codepoint) { return p[2]; } // Move to the next triplet p += 3; } } /** * Decode a UTF-8 encoded path. Overlong characters will be decoded, invalid * characters will be left as-is. Best-fit mapping will be used to convert * UTF-8 into a single-byte stream. * * @param[in] cfg * @param[in] tx * @param[in] path */ void htp_utf8_decode_path_inplace(htp_cfg_t *cfg, htp_tx_t *tx, bstr *path) { if (path == NULL) return; uint8_t *data = bstr_ptr(path); if (data == NULL) return; size_t len = bstr_len(path); size_t rpos = 0; size_t wpos = 0; uint32_t codepoint = 0; uint32_t state = HTP_UTF8_ACCEPT; uint32_t counter = 0; uint8_t seen_valid = 0; while ((rpos < len)&&(wpos < len)) { counter++; switch (htp_utf8_decode_allow_overlong(&state, &codepoint, data[rpos])) { case HTP_UTF8_ACCEPT: if (counter == 1) { // ASCII character, which we just copy. data[wpos++] = (uint8_t) codepoint; } else { // A valid UTF-8 character, which we need to convert. seen_valid = 1; // Check for overlong characters and set the flag accordingly. switch (counter) { case 2: if (codepoint < 0x80) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; case 3: if (codepoint < 0x800) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; case 4: if (codepoint < 0x10000) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; } // Special flag for half-width/full-width evasion. if ((codepoint >= 0xff00) && (codepoint <= 0xffef)) { tx->flags |= HTP_PATH_HALF_FULL_RANGE; } // Use best-fit mapping to convert to a single byte. data[wpos++] = bestfit_codepoint(cfg, HTP_DECODER_URL_PATH, codepoint); } // Advance over the consumed byte and reset the byte counter. rpos++; counter = 0; break; case HTP_UTF8_REJECT: // Invalid UTF-8 character. tx->flags |= HTP_PATH_UTF8_INVALID; // Is the server expected to respond with 400? if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].utf8_invalid_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].utf8_invalid_unwanted; } // Output the replacement byte, replacing one or more invalid bytes. data[wpos++] = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].bestfit_replacement_byte; // If the invalid byte was first in a sequence, consume it. Otherwise, // assume it's the starting byte of the next character. if (counter == 1) { rpos++; } // Reset the decoder state and continue decoding. state = HTP_UTF8_ACCEPT; codepoint = 0; counter = 0; break; default: // Keep going; the character is not yet formed. rpos++; break; } } // Did the input stream seem like a valid UTF-8 string? if ((seen_valid) && (!(tx->flags & HTP_PATH_UTF8_INVALID))) { tx->flags |= HTP_PATH_UTF8_VALID; } // Adjust the length of the string, because // we're doing in-place decoding. bstr_adjust_len(path, wpos); } /** * Validate a path that is quite possibly UTF-8 encoded. * * @param[in] tx * @param[in] path */ void htp_utf8_validate_path(htp_tx_t *tx, bstr *path) { unsigned char *data = bstr_ptr(path); size_t len = bstr_len(path); size_t rpos = 0; uint32_t codepoint = 0; uint32_t state = HTP_UTF8_ACCEPT; uint32_t counter = 0; // How many bytes used by a UTF-8 character. uint8_t seen_valid = 0; while (rpos < len) { counter++; switch (htp_utf8_decode_allow_overlong(&state, &codepoint, data[rpos])) { case HTP_UTF8_ACCEPT: // We have a valid character. if (counter > 1) { // A valid UTF-8 character, consisting of 2 or more bytes. seen_valid = 1; // Check for overlong characters and set the flag accordingly. switch (counter) { case 2: if (codepoint < 0x80) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; case 3: if (codepoint < 0x800) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; case 4: if (codepoint < 0x10000) { tx->flags |= HTP_PATH_UTF8_OVERLONG; } break; } } // Special flag for half-width/full-width evasion. if ((codepoint > 0xfeff) && (codepoint < 0x010000)) { tx->flags |= HTP_PATH_HALF_FULL_RANGE; } // Advance over the consumed byte and reset the byte counter. rpos++; counter = 0; break; case HTP_UTF8_REJECT: // Invalid UTF-8 character. tx->flags |= HTP_PATH_UTF8_INVALID; // Override the decoder state because we want to continue decoding. state = HTP_UTF8_ACCEPT; // Advance over the consumed byte and reset the byte counter. rpos++; counter = 0; break; default: // Keep going; the character is not yet formed. rpos++; break; } } // Did the input stream seem like a valid UTF-8 string? if ((seen_valid) && (!(tx->flags & HTP_PATH_UTF8_INVALID))) { tx->flags |= HTP_PATH_UTF8_VALID; } } /** * Decode a %u-encoded character, using best-fit mapping as necessary. Path version. * * @param[in] cfg * @param[in] tx * @param[in] data * @return decoded byte */ static int decode_u_encoding_path(htp_cfg_t *cfg, htp_tx_t *tx, unsigned char *data) { unsigned int c1 = x2c(data); unsigned int c2 = x2c(data + 2); int r = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].bestfit_replacement_byte; if (c1 == 0x00) { r = c2; tx->flags |= HTP_PATH_OVERLONG_U; } else { // Check for fullwidth form evasion if (c1 == 0xff) { tx->flags |= HTP_PATH_HALF_FULL_RANGE; } if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].u_encoding_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].u_encoding_unwanted; } // Use best-fit mapping unsigned char *p = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].bestfit_map; // TODO Optimize lookup. for (;;) { // Have we reached the end of the map? if ((p[0] == 0) && (p[1] == 0)) { break; } // Have we found the mapping we're looking for? if ((p[0] == c1) && (p[1] == c2)) { r = p[2]; break; } // Move to the next triplet p += 3; } } // Check for encoded path separators if ((r == '/') || ((cfg->decoder_cfgs[HTP_DECODER_URL_PATH].backslash_convert_slashes) && (r == '\\'))) { tx->flags |= HTP_PATH_ENCODED_SEPARATOR; } return r; } /** * Decode a %u-encoded character, using best-fit mapping as necessary. Params version. * * @param[in] cfg * @param[in] tx * @param[in] data * @return decoded byte */ static int decode_u_encoding_params(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, unsigned char *data, uint64_t *flags) { unsigned int c1 = x2c(data); unsigned int c2 = x2c(data + 2); // Check for overlong usage first. if (c1 == 0) { (*flags) |= HTP_URLEN_OVERLONG_U; return c2; } // Both bytes were used. // Detect half-width and full-width range. if ((c1 == 0xff) && (c2 <= 0xef)) { (*flags) |= HTP_URLEN_HALF_FULL_RANGE; } // Use best-fit mapping. unsigned char *p = cfg->decoder_cfgs[ctx].bestfit_map; int r = cfg->decoder_cfgs[ctx].bestfit_replacement_byte; // TODO Optimize lookup. for (;;) { // Have we reached the end of the map? if ((p[0] == 0) && (p[1] == 0)) { break; } // Have we found the mapping we're looking for? if ((p[0] == c1) && (p[1] == c2)) { r = p[2]; break; } // Move to the next triplet p += 3; } return r; } /** * Decode a request path according to the settings in the * provided configuration structure. * * @param[in] cfg * @param[in] tx * @param[in] path */ htp_status_t htp_decode_path_inplace(htp_tx_t *tx, bstr *path) { if (path == NULL) return HTP_ERROR; unsigned char *data = bstr_ptr(path); if (data == NULL) return HTP_ERROR; size_t len = bstr_len(path); htp_cfg_t *cfg = tx->cfg; size_t rpos = 0; size_t wpos = 0; int previous_was_separator = 0; while ((rpos < len) && (wpos < len)) { int c = data[rpos]; // Decode encoded characters if (c == '%') { if (rpos + 2 < len) { int handled = 0; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].u_encoding_decode) { // Check for the %u encoding if ((data[rpos + 1] == 'u') || (data[rpos + 1] == 'U')) { handled = 1; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].u_encoding_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].u_encoding_unwanted; } if (rpos + 5 < len) { if (isxdigit(data[rpos + 2]) && (isxdigit(data[rpos + 3])) && isxdigit(data[rpos + 4]) && (isxdigit(data[rpos + 5]))) { // Decode a valid %u encoding c = decode_u_encoding_path(cfg, tx, &data[rpos + 2]); rpos += 6; if (c == 0) { tx->flags |= HTP_PATH_ENCODED_NUL; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_encoded_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_encoded_unwanted; } } } else { // Invalid %u encoding tx->flags |= HTP_PATH_INVALID_ENCODING; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; eat // the percent character rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the percent character in output rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Decode invalid %u encoding c = decode_u_encoding_path(cfg, tx, &data[rpos + 2]); rpos += 6; break; } } } else { // Invalid %u encoding (not enough data) tx->flags |= HTP_PATH_INVALID_ENCODING; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; eat // the percent character rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the percent character in output rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Cannot decode, because there's not enough data. // Leave the percent character in output rpos++; // TODO Configurable handling. break; } } } } // Handle standard URL encoding if (!handled) { if ((isxdigit(data[rpos + 1])) && (isxdigit(data[rpos + 2]))) { c = x2c(&data[rpos + 1]); if (c == 0) { tx->flags |= HTP_PATH_ENCODED_NUL; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_encoded_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_encoded_unwanted; } if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_encoded_terminates) { bstr_adjust_len(path, wpos); return HTP_OK; } } if ((c == '/') || ((cfg->decoder_cfgs[HTP_DECODER_URL_PATH].backslash_convert_slashes) && (c == '\\'))) { tx->flags |= HTP_PATH_ENCODED_SEPARATOR; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].path_separators_encoded_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].path_separators_encoded_unwanted; } if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].path_separators_decode) { // Decode rpos += 3; } else { // Leave encoded c = '%'; rpos++; } } else { // Decode rpos += 3; } } else { // Invalid encoding tx->flags |= HTP_PATH_INVALID_ENCODING; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; eat // the percent character rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the percent character in output rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Decode c = x2c(&data[rpos + 1]); rpos += 3; // Note: What if an invalid encoding decodes into a path // separator? This is theoretical at the moment, because // the only platform we know doesn't convert separators is // Apache, who will also respond with 400 if invalid encoding // is encountered. Thus no check for a separator here. break; default: // Unknown setting return HTP_ERROR; break; } } } } else { // Invalid URL encoding (not enough data) tx->flags |= HTP_PATH_INVALID_ENCODING; if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; eat // the percent character rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the percent character in output rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Cannot decode, because there's not enough data. // Leave the percent character in output. // TODO Configurable handling. rpos++; break; } } } else { // One non-encoded character // Is it a NUL byte? if (c == 0) { if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_raw_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_raw_unwanted; } if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].nul_raw_terminates) { // Terminate path with a raw NUL byte bstr_adjust_len(path, wpos); return HTP_OK; break; } } rpos++; } // Place the character into output // Check for control characters if (c < 0x20) { if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].control_chars_unwanted != HTP_UNWANTED_IGNORE) { tx->response_status_expected_number = cfg->decoder_cfgs[HTP_DECODER_URL_PATH].control_chars_unwanted; } } // Convert backslashes to forward slashes, if necessary if ((c == '\\') && (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].backslash_convert_slashes)) { c = '/'; } // Lowercase characters, if necessary if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].convert_lowercase) { c = tolower(c); } // If we're compressing separators then we need // to track if the previous character was a separator if (cfg->decoder_cfgs[HTP_DECODER_URL_PATH].path_separators_compress) { if (c == '/') { if (!previous_was_separator) { data[wpos++] = c; previous_was_separator = 1; } else { // Do nothing; we don't want // another separator in output } } else { data[wpos++] = c; previous_was_separator = 0; } } else { data[wpos++] = c; } } bstr_adjust_len(path, wpos); return HTP_OK; } htp_status_t htp_tx_urldecode_uri_inplace(htp_tx_t *tx, bstr *input) { uint64_t flags = 0; htp_status_t rc = htp_urldecode_inplace_ex(tx->cfg, HTP_DECODER_URL_PATH, input, &flags, &(tx->response_status_expected_number)); if (flags & HTP_URLEN_INVALID_ENCODING) { tx->flags |= HTP_PATH_INVALID_ENCODING; } if (flags & HTP_URLEN_ENCODED_NUL) { tx->flags |= HTP_PATH_ENCODED_NUL; } if (flags & HTP_URLEN_RAW_NUL) { tx->flags |= HTP_PATH_RAW_NUL; } return rc; } htp_status_t htp_tx_urldecode_params_inplace(htp_tx_t *tx, bstr *input) { return htp_urldecode_inplace_ex(tx->cfg, HTP_DECODER_URLENCODED, input, &(tx->flags), &(tx->response_status_expected_number)); } htp_status_t htp_urldecode_inplace(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags) { int expected_status_code = 0; return htp_urldecode_inplace_ex(cfg, ctx, input, flags, &expected_status_code); } htp_status_t htp_urldecode_inplace_ex(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags, int *expected_status_code) { if (input == NULL) return HTP_ERROR; unsigned char *data = bstr_ptr(input); if (data == NULL) return HTP_ERROR; size_t len = bstr_len(input); size_t rpos = 0; size_t wpos = 0; while ((rpos < len) && (wpos < len)) { int c = data[rpos]; // Decode encoded characters. if (c == '%') { // Need at least 2 additional bytes for %HH. if (rpos + 2 < len) { int handled = 0; // Decode %uHHHH encoding, but only if allowed in configuration. if (cfg->decoder_cfgs[ctx].u_encoding_decode) { // The next character must be a case-insensitive u. if ((data[rpos + 1] == 'u') || (data[rpos + 1] == 'U')) { handled = 1; if (cfg->decoder_cfgs[ctx].u_encoding_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].u_encoding_unwanted; } // Need at least 5 additional bytes for %uHHHH. if (rpos + 5 < len) { if (isxdigit(data[rpos + 2]) && (isxdigit(data[rpos + 3])) && isxdigit(data[rpos + 4]) && (isxdigit(data[rpos + 5]))) { // Decode a valid %u encoding. c = decode_u_encoding_params(cfg, ctx, &(data[rpos + 2]), flags); rpos += 6; } else { // Invalid %u encoding (could not find 4 xdigits). (*flags) |= HTP_URLEN_INVALID_ENCODING; if (cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[ctx].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; consume the %. rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the % in output. rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Decode invalid %u encoding. c = decode_u_encoding_params(cfg, ctx, &(data[rpos + 2]), flags); rpos += 6; break; } } } else { // Invalid %u encoding; not enough data. (*flags) |= HTP_URLEN_INVALID_ENCODING; if (cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[ctx].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; consume the %. rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the % in output. rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Cannot decode because there's not enough data. // Leave the % in output. // TODO Configurable handling of %, u, etc. rpos++; break; } } } } // Handle standard URL encoding. if (!handled) { // Need 2 hexadecimal digits. if ((isxdigit(data[rpos + 1])) && (isxdigit(data[rpos + 2]))) { // Decode %HH encoding. c = x2c(&(data[rpos + 1])); rpos += 3; } else { // Invalid encoding (enough bytes, but not hexadecimal digits). (*flags) |= HTP_URLEN_INVALID_ENCODING; if (cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[ctx].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; consume the %. rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the % in output. rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Decode. c = x2c(&(data[rpos + 1])); rpos += 3; break; } } } } else { // Invalid encoding; not enough data (at least 2 bytes required). (*flags) |= HTP_URLEN_INVALID_ENCODING; if (cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted; } switch (cfg->decoder_cfgs[ctx].url_encoding_invalid_handling) { case HTP_URL_DECODE_REMOVE_PERCENT: // Do not place anything in output; consume the %. rpos++; continue; break; case HTP_URL_DECODE_PRESERVE_PERCENT: // Leave the % in output. rpos++; break; case HTP_URL_DECODE_PROCESS_INVALID: // Cannot decode because there's not enough data. // Leave the % in output. // TODO Configurable handling of %, etc. rpos++; break; } } // Did we get an encoded NUL byte? if (c == 0) { if (cfg->decoder_cfgs[ctx].nul_encoded_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].nul_encoded_unwanted; } (*flags) |= HTP_URLEN_ENCODED_NUL; if (cfg->decoder_cfgs[ctx].nul_encoded_terminates) { // Terminate the path at the raw NUL byte. bstr_adjust_len(input, wpos); return 1; } } data[wpos++] = c; } else if (c == '+') { // Decoding of the plus character is conditional on the configuration. if (cfg->decoder_cfgs[ctx].plusspace_decode) { c = 0x20; } rpos++; data[wpos++] = c; } else { // One non-encoded byte. // Did we get a raw NUL byte? if (c == 0) { if (cfg->decoder_cfgs[ctx].nul_raw_unwanted != HTP_UNWANTED_IGNORE) { (*expected_status_code) = cfg->decoder_cfgs[ctx].nul_raw_unwanted; } (*flags) |= HTP_URLEN_RAW_NUL; if (cfg->decoder_cfgs[ctx].nul_raw_terminates) { // Terminate the path at the encoded NUL byte. bstr_adjust_len(input, wpos); return HTP_OK; } } rpos++; data[wpos++] = c; } } bstr_adjust_len(input, wpos); return HTP_OK; } /** * Normalize a previously-parsed request URI. * * @param[in] connp * @param[in] incomplete * @param[in] normalized * @return HTP_OK or HTP_ERROR */ int htp_normalize_parsed_uri(htp_tx_t *tx, htp_uri_t *incomplete, htp_uri_t *normalized) { // Scheme. if (incomplete->scheme != NULL) { // Duplicate and convert to lowercase. normalized->scheme = bstr_dup_lower(incomplete->scheme); if (normalized->scheme == NULL) return HTP_ERROR; } // Username. if (incomplete->username != NULL) { normalized->username = bstr_dup(incomplete->username); if (normalized->username == NULL) return HTP_ERROR; htp_tx_urldecode_uri_inplace(tx, normalized->username); } // Password. if (incomplete->password != NULL) { normalized->password = bstr_dup(incomplete->password); if (normalized->password == NULL) return HTP_ERROR; htp_tx_urldecode_uri_inplace(tx, normalized->password); } // Hostname. if (incomplete->hostname != NULL) { // We know that incomplete->hostname does not contain // port information, so no need to check for it here. normalized->hostname = bstr_dup(incomplete->hostname); if (normalized->hostname == NULL) return HTP_ERROR; htp_tx_urldecode_uri_inplace(tx, normalized->hostname); htp_normalize_hostname_inplace(normalized->hostname); } // Port. if (incomplete->port != NULL) { int64_t port_parsed = htp_parse_positive_integer_whitespace( bstr_ptr(incomplete->port), bstr_len(incomplete->port), 10); if (port_parsed < 0) { // Failed to parse the port number. normalized->port_number = -1; tx->flags |= HTP_HOSTU_INVALID; } else if ((port_parsed > 0) && (port_parsed < 65536)) { // Valid port number. normalized->port_number = (int) port_parsed; } else { // Port number out of range. normalized->port_number = -1; tx->flags |= HTP_HOSTU_INVALID; } } else { normalized->port_number = -1; } // Path. if (incomplete->path != NULL) { // Make a copy of the path, so that we can work on it. normalized->path = bstr_dup(incomplete->path); if (normalized->path == NULL) return HTP_ERROR; // Decode URL-encoded (and %u-encoded) characters, as well as lowercase, // compress separators and convert backslashes. htp_decode_path_inplace(tx, normalized->path); // Handle UTF-8 in the path. if (tx->cfg->decoder_cfgs[HTP_DECODER_URL_PATH].utf8_convert_bestfit) { // Decode Unicode characters into a single-byte stream, using best-fit mapping. htp_utf8_decode_path_inplace(tx->cfg, tx, normalized->path); } else { // No decoding, but try to validate the path as a UTF-8 stream. htp_utf8_validate_path(tx, normalized->path); } // RFC normalization. htp_normalize_uri_path_inplace(normalized->path); } // Query string. if (incomplete->query != NULL) { normalized->query = bstr_dup(incomplete->query); if (normalized->query == NULL) return HTP_ERROR; } // Fragment. if (incomplete->fragment != NULL) { normalized->fragment = bstr_dup(incomplete->fragment); if (normalized->fragment == NULL) return HTP_ERROR; htp_tx_urldecode_uri_inplace(tx, normalized->fragment); } return HTP_OK; } /** * Normalize request hostname. Convert all characters to lowercase and * remove trailing dots from the end, if present. * * @param[in] hostname * @return Normalized hostname. */ bstr *htp_normalize_hostname_inplace(bstr *hostname) { if (hostname == NULL) return NULL; bstr_to_lowercase(hostname); // Remove dots from the end of the string. while (bstr_char_at_end(hostname, 0) == '.') bstr_chop(hostname); return hostname; } #if 0 /** * Replace the URI in the structure with the one provided as the parameter * to this function (which will typically be supplied in a Host header). * * @param[in] connp * @param[in] parsed_uri * @param[in] hostname */ void htp_replace_hostname(htp_connp_t *connp, htp_uri_t *parsed_uri, bstr *hostname) { if (hostname == NULL) return; bstr *new_hostname = NULL; int colon = bstr_chr(hostname, ':'); if (colon == -1) { // Hostname alone (no port information) new_hostname = bstr_dup(hostname); if (new_hostname == NULL) return; htp_normalize_hostname_inplace(new_hostname); if (parsed_uri->hostname != NULL) bstr_free(parsed_uri->hostname); parsed_uri->hostname = new_hostname; } else { // Hostname and port new_hostname = bstr_dup_ex(hostname, 0, colon); if (new_hostname == NULL) return; // TODO Handle whitespace around hostname htp_normalize_hostname_inplace(new_hostname); if (parsed_uri->hostname != NULL) bstr_free(parsed_uri->hostname); parsed_uri->hostname = new_hostname; parsed_uri->port_number = 0; // Port int port = htp_parse_positive_integer_whitespace((unsigned char *) bstr_ptr(hostname) + colon + 1, bstr_len(hostname) - colon - 1, 10); if (port < 0) { // Failed to parse port htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Invalid server port information in request"); } else if ((port > 0) && (port < 65536)) { // Valid port if ((connp->conn->server_port != 0) && (port != connp->conn->server_port)) { // Port was specified in connection and is different from the TCP port htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Request server port=%d number differs from the actual TCP port=%d", port, connp->conn->server_port); } else { parsed_uri->port_number = port; } } } } /** * Is URI character reserved? * * @param[in] c * @return 1 if it is, 0 if it isn't */ int htp_is_uri_unreserved(unsigned char c) { if (((c >= 0x41) && (c <= 0x5a)) || ((c >= 0x61) && (c <= 0x7a)) || ((c >= 0x30) && (c <= 0x39)) || (c == 0x2d) || (c == 0x2e) || (c == 0x5f) || (c == 0x7e)) { return 1; } else { return 0; } } /** * Decode a URL-encoded string, leaving the reserved * characters and invalid encodings alone. * * @param[in] s */ void htp_uriencoding_normalize_inplace(bstr *s) { if (s == NULL) return; unsigned char *data = bstr_ptr(s); if (data == NULL) return; size_t len = bstr_len(s); size_t rpos = 0; size_t wpos = 0; while (rpos < len) { if (data[rpos] == '%') { if (rpos + 2 < len) { if (isxdigit(data[rpos + 1]) && (isxdigit(data[rpos + 2]))) { unsigned char c = x2c(&data[rpos + 1]); if (htp_is_uri_unreserved(c)) { // Leave reserved characters encoded, but convert // the hexadecimal digits to uppercase data[wpos++] = data[rpos++]; data[wpos++] = toupper(data[rpos++]); data[wpos++] = toupper(data[rpos++]); } else { // Decode unreserved character data[wpos++] = c; rpos += 3; } } else { // Invalid URL encoding: invalid hex digits // Copy over what's there data[wpos++] = data[rpos++]; data[wpos++] = toupper(data[rpos++]); data[wpos++] = toupper(data[rpos++]); } } else { // Invalid URL encoding: string too short // Copy over what's there data[wpos++] = data[rpos++]; while (rpos < len) { data[wpos++] = toupper(data[rpos++]); } } } else { data[wpos++] = data[rpos++]; } } bstr_adjust_len(s, wpos); } #endif /** * Normalize URL path. This function implements the remove dot segments algorithm * specified in RFC 3986, section 5.2.4. * * @param[in] s */ void htp_normalize_uri_path_inplace(bstr *s) { if (s == NULL) return; unsigned char *data = bstr_ptr(s); if (data == NULL) return; size_t len = bstr_len(s); size_t rpos = 0; size_t wpos = 0; int c = -1; while ((rpos < len)&&(wpos < len)) { if (c == -1) { c = data[rpos++]; } // A. If the input buffer begins with a prefix of "../" or "./", // then remove that prefix from the input buffer; otherwise, if (c == '.') { if ((rpos + 1 < len) && (data[rpos] == '.') && (data[rpos + 1] == '/')) { c = -1; rpos += 2; continue; } else if ((rpos < len) && (data[rpos] == '/')) { c = -1; rpos += 1; continue; } } if (c == '/') { // B. if the input buffer begins with a prefix of "/./" or "/.", // where "." is a complete path segment, then replace that // prefix with "/" in the input buffer; otherwise, if ((rpos + 1 < len) && (data[rpos] == '.') && (data[rpos + 1] == '/')) { c = '/'; rpos += 2; continue; } else if ((rpos + 1 == len) && (data[rpos] == '.')) { c = '/'; rpos += 1; continue; } // C. if the input buffer begins with a prefix of "/../" or "/..", // where ".." is a complete path segment, then replace that // prefix with "/" in the input buffer and remove the last // segment and its preceding "/" (if any) from the output // buffer; otherwise, if ((rpos + 2 < len) && (data[rpos] == '.') && (data[rpos + 1] == '.') && (data[rpos + 2] == '/')) { c = '/'; rpos += 3; // Remove the last segment while ((wpos > 0) && (data[wpos - 1] != '/')) wpos--; if (wpos > 0) wpos--; continue; } else if ((rpos + 2 == len) && (data[rpos] == '.') && (data[rpos + 1] == '.')) { c = '/'; rpos += 2; // Remove the last segment while ((wpos > 0) && (data[wpos - 1] != '/')) wpos--; if (wpos > 0) wpos--; continue; } } // D. if the input buffer consists only of "." or "..", then remove // that from the input buffer; otherwise, if ((c == '.') && (rpos == len)) { rpos++; continue; } if ((c == '.') && (rpos + 1 == len) && (data[rpos] == '.')) { rpos += 2; continue; } // E. move the first path segment in the input buffer to the end of // the output buffer, including the initial "/" character (if // any) and any subsequent characters up to, but not including, // the next "/" character or the end of the input buffer. data[wpos++] = c; while ((rpos < len) && (data[rpos] != '/') && (wpos < len)) { data[wpos++] = data[rpos++]; } c = -1; } bstr_adjust_len(s, wpos); } /** * */ void fprint_bstr(FILE *stream, const char *name, bstr *b) { if (b == NULL) { fprint_raw_data_ex(stream, name, "(null)", 0, 6); return; } fprint_raw_data_ex(stream, name, bstr_ptr(b), 0, bstr_len(b)); } /** * */ void fprint_raw_data(FILE *stream, const char *name, const void *data, size_t len) { fprint_raw_data_ex(stream, name, data, 0, len); } /** * */ void fprint_raw_data_ex(FILE *stream, const char *name, const void *_data, size_t offset, size_t printlen) { const unsigned char *data = (const unsigned char *) _data; char buf[160]; size_t len = offset + printlen; fprintf(stream, "\n%s: ptr %p offset %" PRIu64 " len %" PRIu64"\n", name, (void*) data, (uint64_t) offset, (uint64_t) len); while (offset < len) { size_t i; snprintf(buf, sizeof(buf), "%08" PRIx64, (uint64_t) offset); strlcat(buf, " ", sizeof(buf)); i = 0; while (i < 8) { if (offset + i < len) { snprintf(buf + strlen(buf), sizeof(buf), "%02x ", data[offset + i]); } else { strlcat(buf, " ", sizeof(buf)); } i++; } strlcat(buf, " ", sizeof(buf)); i = 8; while (i < 16) { if (offset + i < len) { snprintf(buf + strlen(buf), sizeof(buf), "%02x ", data[offset + i]); } else { strlcat(buf, " ", sizeof(buf)); } i++; } strlcat(buf, " |", sizeof(buf)); i = 0; char *p = buf + strlen(buf); while ((offset + i < len) && (i < 16)) { int c = data[offset + i]; if (isprint(c)) { *p++ = c; } else { *p++ = '.'; } i++; } *p++ = '|'; *p++ = '\n'; *p = '\0'; fprintf(stream, "%s", buf); offset += 16; } fprintf(stream, "\n"); } /** * */ char *htp_connp_in_state_as_string(htp_connp_t *connp) { if (connp == NULL) return "NULL"; if (connp->in_state == htp_connp_REQ_IDLE) return "REQ_IDLE"; if (connp->in_state == htp_connp_REQ_LINE) return "REQ_LINE"; if (connp->in_state == htp_connp_REQ_PROTOCOL) return "REQ_PROTOCOL"; if (connp->in_state == htp_connp_REQ_HEADERS) return "REQ_HEADERS"; if (connp->in_state == htp_connp_REQ_CONNECT_CHECK) return "REQ_CONNECT_CHECK"; if (connp->in_state == htp_connp_REQ_CONNECT_WAIT_RESPONSE) return "REQ_CONNECT_WAIT_RESPONSE"; if (connp->in_state == htp_connp_REQ_BODY_DETERMINE) return "REQ_BODY_DETERMINE"; if (connp->in_state == htp_connp_REQ_BODY_IDENTITY) return "REQ_BODY_IDENTITY"; if (connp->in_state == htp_connp_REQ_BODY_CHUNKED_LENGTH) return "REQ_BODY_CHUNKED_LENGTH"; if (connp->in_state == htp_connp_REQ_BODY_CHUNKED_DATA) return "REQ_BODY_CHUNKED_DATA"; if (connp->in_state == htp_connp_REQ_BODY_CHUNKED_DATA_END) return "REQ_BODY_CHUNKED_DATA_END"; if (connp->in_state == htp_connp_REQ_FINALIZE) return "REQ_FINALIZE"; if (connp->in_state == htp_connp_REQ_IGNORE_DATA_AFTER_HTTP_0_9) return "REQ_IGNORE_DATA_AFTER_HTTP_0_9"; return "UNKNOWN"; } /** * */ char *htp_connp_out_state_as_string(htp_connp_t *connp) { if (connp == NULL) return "NULL"; if (connp->out_state == htp_connp_RES_IDLE) return "RES_IDLE"; if (connp->out_state == htp_connp_RES_LINE) return "RES_LINE"; if (connp->out_state == htp_connp_RES_HEADERS) return "RES_HEADERS"; if (connp->out_state == htp_connp_RES_BODY_DETERMINE) return "RES_BODY_DETERMINE"; if (connp->out_state == htp_connp_RES_BODY_IDENTITY_CL_KNOWN) return "RES_BODY_IDENTITY_CL_KNOWN"; if (connp->out_state == htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE) return "RES_BODY_IDENTITY_STREAM_CLOSE"; if (connp->out_state == htp_connp_RES_BODY_CHUNKED_LENGTH) return "RES_BODY_CHUNKED_LENGTH"; if (connp->out_state == htp_connp_RES_BODY_CHUNKED_DATA) return "RES_BODY_CHUNKED_DATA"; if (connp->out_state == htp_connp_RES_BODY_CHUNKED_DATA_END) return "RES_BODY_CHUNKED_DATA_END"; if (connp->out_state == htp_connp_RES_FINALIZE) return "RES_BODY_FINALIZE"; return "UNKNOWN"; } /** * */ char *htp_tx_request_progress_as_string(htp_tx_t *tx) { if (tx == NULL) return "NULL"; switch (tx->request_progress) { case HTP_REQUEST_NOT_STARTED: return "NOT_STARTED"; case HTP_REQUEST_LINE: return "REQ_LINE"; case HTP_REQUEST_HEADERS: return "REQ_HEADERS"; case HTP_REQUEST_BODY: return "REQ_BODY"; case HTP_REQUEST_TRAILER: return "REQ_TRAILER"; case HTP_REQUEST_COMPLETE: return "COMPLETE"; } return "INVALID"; } /** * */ char *htp_tx_response_progress_as_string(htp_tx_t *tx) { if (tx == NULL) return "NULL"; switch (tx->response_progress) { case HTP_RESPONSE_NOT_STARTED: return "NOT_STARTED"; case HTP_RESPONSE_LINE: return "RES_LINE"; case HTP_RESPONSE_HEADERS: return "RES_HEADERS"; case HTP_RESPONSE_BODY: return "RES_BODY"; case HTP_RESPONSE_TRAILER: return "RES_TRAILER"; case HTP_RESPONSE_COMPLETE: return "COMPLETE"; } return "INVALID"; } bstr *htp_unparse_uri_noencode(htp_uri_t *uri) { if (uri == NULL) return NULL; // On the first pass determine the length of the final string size_t len = 0; if (uri->scheme != NULL) { len += bstr_len(uri->scheme); len += 3; // "://" } if ((uri->username != NULL) || (uri->password != NULL)) { if (uri->username != NULL) { len += bstr_len(uri->username); } len += 1; // ":" if (uri->password != NULL) { len += bstr_len(uri->password); } len += 1; // "@" } if (uri->hostname != NULL) { len += bstr_len(uri->hostname); } if (uri->port != NULL) { len += 1; // ":" len += bstr_len(uri->port); } if (uri->path != NULL) { len += bstr_len(uri->path); } if (uri->query != NULL) { len += 1; // "?" len += bstr_len(uri->query); } if (uri->fragment != NULL) { len += 1; // "#" len += bstr_len(uri->fragment); } // On the second pass construct the string bstr *r = bstr_alloc(len); if (r == NULL) return NULL; if (uri->scheme != NULL) { bstr_add_noex(r, uri->scheme); bstr_add_c_noex(r, "://"); } if ((uri->username != NULL) || (uri->password != NULL)) { if (uri->username != NULL) { bstr_add_noex(r, uri->username); } bstr_add_c_noex(r, ":"); if (uri->password != NULL) { bstr_add_noex(r, uri->password); } bstr_add_c_noex(r, "@"); } if (uri->hostname != NULL) { bstr_add_noex(r, uri->hostname); } if (uri->port != NULL) { bstr_add_c_noex(r, ":"); bstr_add_noex(r, uri->port); } if (uri->path != NULL) { bstr_add_noex(r, uri->path); } if (uri->query != NULL) { bstr_add_c_noex(r, "?"); bstr_add_noex(r, uri->query); /* bstr *query = bstr_dup(uri->query); if (query == NULL) { bstr_free(r); return NULL; } htp_uriencoding_normalize_inplace(query); bstr_add_c_noex(r, "?"); bstr_add_noex(r, query); bstr_free(query); */ } if (uri->fragment != NULL) { bstr_add_c_noex(r, "#"); bstr_add_noex(r, uri->fragment); } return r; } /** * Determine if the information provided on the response line * is good enough. Browsers are lax when it comes to response * line parsing. In most cases they will only look for the * words "http" at the beginning. * * @param[in] tx * @return 1 for good enough or 0 for not good enough */ int htp_treat_response_line_as_body(htp_tx_t *tx) { // Browser behavior: // Firefox 3.5.x: (?i)^\s*http // IE: (?i)^\s*http\s*/ // Safari: ^HTTP/\d+\.\d+\s+\d{3} if (tx->response_protocol == NULL) return 1; if (bstr_len(tx->response_protocol) < 4) return 1; unsigned char *data = bstr_ptr(tx->response_protocol); if ((data[0] != 'H') && (data[0] != 'h')) return 1; if ((data[1] != 'T') && (data[1] != 't')) return 1; if ((data[2] != 'T') && (data[2] != 't')) return 1; if ((data[3] != 'P') && (data[3] != 'p')) return 1; return 0; } /** * Run the REQUEST_BODY_DATA hook. * * @param[in] connp * @param[in] d */ htp_status_t htp_req_run_hook_body_data(htp_connp_t *connp, htp_tx_data_t *d) { // Do not invoke callbacks with an empty data chunk if ((d->data != NULL) && (d->len == 0)) return HTP_OK; // Do not invoke callbacks without a transaction. if (connp->in_tx == NULL) return HTP_OK; // Run transaction hooks first htp_status_t rc = htp_hook_run_all(connp->in_tx->hook_request_body_data, d); if (rc != HTP_OK) return rc; // Run configuration hooks second rc = htp_hook_run_all(connp->cfg->hook_request_body_data, d); if (rc != HTP_OK) return rc; // On PUT requests, treat request body as file if (connp->put_file != NULL) { htp_file_data_t file_data; file_data.data = d->data; file_data.len = d->len; file_data.file = connp->put_file; file_data.file->len += d->len; rc = htp_hook_run_all(connp->cfg->hook_request_file_data, &file_data); if (rc != HTP_OK) return rc; } return HTP_OK; } /** * Run the RESPONSE_BODY_DATA hook. * * @param[in] connp * @param[in] d */ htp_status_t htp_res_run_hook_body_data(htp_connp_t *connp, htp_tx_data_t *d) { // Do not invoke callbacks with an empty data chunk. if ((d->data != NULL) && (d->len == 0)) return HTP_OK; // Run transaction hooks first htp_status_t rc = htp_hook_run_all(connp->out_tx->hook_response_body_data, d); if (rc != HTP_OK) return rc; // Run configuration hooks second rc = htp_hook_run_all(connp->cfg->hook_response_body_data, d); if (rc != HTP_OK) return rc; return HTP_OK; } /** * Parses the provided memory region, extracting the double-quoted string. * * @param[in] data * @param[in] len * @param[out] out * @param[out] endoffset * @return HTP_OK on success, HTP_DECLINED if the input is not well formed, and HTP_ERROR on fatal errors. */ htp_status_t htp_extract_quoted_string_as_bstr(unsigned char *data, size_t len, bstr **out, size_t *endoffset) { if ((data == NULL) || (out == NULL)) return HTP_ERROR; if (len == 0) return HTP_DECLINED; size_t pos = 0; // Check that the first character is a double quote. if (data[pos] != '"') return HTP_DECLINED; // Step over the double quote. pos++; if (pos == len) return HTP_DECLINED; // Calculate the length of the resulting string. size_t escaped_chars = 0; while (pos < len) { if (data[pos] == '\\') { if (pos + 1 < len) { escaped_chars++; pos += 2; continue; } } else if (data[pos] == '"') { break; } pos++; } // Have we reached the end of input without seeing the terminating double quote? if (pos == len) return HTP_DECLINED; // Copy the data and unescape it as necessary. size_t outlen = pos - 1 - escaped_chars; *out = bstr_alloc(outlen); if (*out == NULL) return HTP_ERROR; unsigned char *outptr = bstr_ptr(*out); size_t outpos = 0; pos = 1; while ((pos < len) && (outpos < outlen)) { // TODO We are not properly unescaping test here, we're only // handling escaped double quotes. if (data[pos] == '\\') { if (pos + 1 < len) { outptr[outpos++] = data[pos + 1]; pos += 2; continue; } } else if (data[pos] == '"') { break; } outptr[outpos++] = data[pos++]; } bstr_adjust_len(*out, outlen); if (endoffset != NULL) { *endoffset = pos; } return HTP_OK; } htp_status_t htp_parse_ct_header(bstr *header, bstr **ct) { if ((header == NULL) || (ct == NULL)) return HTP_ERROR; unsigned char *data = bstr_ptr(header); size_t len = bstr_len(header); // The assumption here is that the header value we receive // here has been left-trimmed, which means the starting position // is on the media type. On some platforms that may not be the // case, and we may need to do the left-trim ourselves. // Find the end of the MIME type, using the same approach PHP 5.4.3 uses. size_t pos = 0; while ((pos < len) && (data[pos] != ';') && (data[pos] != ',') && (data[pos] != ' ')) pos++; *ct = bstr_dup_ex(header, 0, pos); if (*ct == NULL) return HTP_ERROR; bstr_to_lowercase(*ct); return HTP_OK; } /** * Implements relaxed (not strictly RFC) hostname validation. * * @param[in] hostname * @return 1 if the supplied hostname is valid; 0 if it is not. */ int htp_validate_hostname(bstr *hostname) { unsigned char *data = bstr_ptr(hostname); size_t len = bstr_len(hostname); size_t startpos = 0; size_t pos = 0; if ((len == 0) || (len > 255)) return 0; while (pos < len) { // Validate label characters. startpos = pos; while ((pos < len) && (data[pos] != '.')) { unsigned char c = data[pos]; // According to the RFC, the underscore is not allowed in a label, but // we allow it here because we think it's often seen in practice. if (!(((c >= 'a') && (c <= 'z')) || ((c >= 'A') && (c <= 'Z')) || ((c >= '0') && (c <= '9')) || (c == '-'))) { return 0; } pos++; } // Validate label length. if ((pos - startpos == 0) || (pos - startpos > 63)) return 0; if (pos >= len) return 1; // No more data after label. // How many dots are there? startpos = pos; while ((pos < len) && (data[pos] == '.')) pos++; if (pos - startpos != 1) return 0; // Exactly one dot expected. } return 1; } void htp_uri_free(htp_uri_t *uri) { if (uri == NULL) return; bstr_free(uri->scheme); bstr_free(uri->username); bstr_free(uri->password); bstr_free(uri->hostname); bstr_free(uri->port); bstr_free(uri->path); bstr_free(uri->query); bstr_free(uri->fragment); free(uri); } htp_uri_t *htp_uri_alloc() { htp_uri_t *u = calloc(1, sizeof (htp_uri_t)); if (u == NULL) return NULL; u->port_number = -1; return u; } char *htp_get_version(void) { return HTP_VERSION_STRING_FULL; } suricata-3.2.1/libhtp/htp/bstr.c0000644000000000000000000003652513051004451013416 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include #include "bstr.h" bstr *bstr_alloc(size_t len) { bstr *b = malloc(sizeof (bstr) + len); if (b == NULL) return NULL; b->len = 0; b->size = len; b->realptr = NULL; return b; } bstr *bstr_add(bstr *destination, const bstr *source) { return bstr_add_mem(destination, bstr_ptr(source), bstr_len(source)); } bstr *bstr_add_c(bstr *bdestination, const char *csource) { return bstr_add_mem(bdestination, csource, strlen(csource)); } bstr *bstr_add_c_noex(bstr *destination, const char *source) { return bstr_add_mem_noex(destination, source, strlen(source)); } bstr *bstr_add_mem(bstr *destination, const void *data, size_t len) { // Expand the destination if necessary if (bstr_size(destination) < bstr_len(destination) + len) { destination = bstr_expand(destination, bstr_len(destination) + len); if (destination == NULL) return NULL; } // Add source to destination bstr *b = (bstr *) destination; memcpy(bstr_ptr(destination) + bstr_len(b), data, len); bstr_adjust_len(b, bstr_len(b) + len); return destination; } bstr *bstr_add_mem_noex(bstr *destination, const void *data, size_t len) { size_t copylen = len; // Is there enough room in the destination? if (bstr_size(destination) < bstr_len(destination) + copylen) { copylen = bstr_size(destination) - bstr_len(destination); if (copylen <= 0) return destination; } // Copy over the bytes bstr *b = (bstr *) destination; memcpy(bstr_ptr(destination) + bstr_len(b), data, copylen); bstr_adjust_len(b, bstr_len(b) + copylen); return destination; } bstr *bstr_add_noex(bstr *destination, const bstr *source) { return bstr_add_mem_noex(destination, bstr_ptr(source), bstr_len(source)); } void bstr_adjust_len(bstr *b, size_t newlen) { b->len = newlen; } void bstr_adjust_realptr(bstr *b, void *newrealptr) { b->realptr = newrealptr; } void bstr_adjust_size(bstr *b, size_t newsize) { b->size = newsize; } int bstr_begins_with(const bstr *haystack, const bstr *needle) { return bstr_begins_with_mem(haystack, bstr_ptr(needle), bstr_len(needle)); } int bstr_begins_with_c(const bstr *haystack, const char *needle) { return bstr_begins_with_mem(haystack, needle, strlen(needle)); } int bstr_begins_with_c_nocase(const bstr *haystack, const char *needle) { return bstr_begins_with_mem_nocase(haystack, needle, strlen(needle)); } int bstr_begins_with_nocase(const bstr *haystack, const bstr *needle) { return bstr_begins_with_mem_nocase(haystack, bstr_ptr(needle), bstr_len(needle)); } int bstr_begins_with_mem(const bstr *haystack, const void *_data, size_t len) { const unsigned char *data = (unsigned char *) _data; const unsigned char *hdata = bstr_ptr(haystack); size_t hlen = bstr_len(haystack); size_t pos = 0; while ((pos < len) && (pos < hlen)) { if (hdata[pos] != data[pos]) { return 0; } pos++; } if (pos == len) { return 1; } else { return 0; } } int bstr_begins_with_mem_nocase(const bstr *haystack, const void *_data, size_t len) { const unsigned char *data = (const unsigned char *) _data; const unsigned char *hdata = bstr_ptr(haystack); size_t hlen = bstr_len(haystack); size_t pos = 0; while ((pos < len) && (pos < hlen)) { if (tolower((int) hdata[pos]) != tolower((int) data[pos])) { return 0; } pos++; } if (pos == len) { return 1; } else { return 0; } } int bstr_char_at(const bstr *b, size_t pos) { unsigned char *data = bstr_ptr(b); size_t len = bstr_len(b); if (pos >= len) return -1; return data[pos]; } int bstr_char_at_end(const bstr *b, size_t pos) { unsigned char *data = bstr_ptr(b); size_t len = bstr_len(b); if (pos >= len) return -1; return data[len - 1 - pos]; } void bstr_chop(bstr *b) { if (bstr_len(b) > 0) { bstr_adjust_len(b, bstr_len(b) - 1); } } int bstr_chr(const bstr *b, int c) { unsigned char *data = bstr_ptr(b); size_t len = bstr_len(b); size_t i = 0; while (i < len) { if (data[i] == c) { return i; } i++; } return -1; } int bstr_cmp(const bstr *b1, const bstr *b2) { return bstr_util_cmp_mem(bstr_ptr(b1), bstr_len(b1), bstr_ptr(b2), bstr_len(b2)); } int bstr_cmp_c(const bstr *b, const char *c) { return bstr_util_cmp_mem(bstr_ptr(b), bstr_len(b), c, strlen(c)); } int bstr_cmp_c_nocase(const bstr *b, const char *c) { return bstr_util_cmp_mem_nocase(bstr_ptr(b), bstr_len(b), c, strlen(c)); } int bstr_cmp_mem(const bstr *b, const void *data, size_t len) { return bstr_util_cmp_mem(bstr_ptr(b), bstr_len(b), data, len); } int bstr_cmp_mem_nocase(const bstr *b, const void *data, size_t len) { return bstr_util_cmp_mem_nocase(bstr_ptr(b), bstr_len(b), data, len); } int bstr_cmp_nocase(const bstr *b1, const bstr *b2) { return bstr_util_cmp_mem_nocase(bstr_ptr(b1), bstr_len(b1), bstr_ptr(b2), bstr_len(b2)); } bstr *bstr_dup(const bstr *b) { return bstr_dup_ex(b, 0, bstr_len(b)); } bstr *bstr_dup_c(const char *cstr) { return bstr_dup_mem(cstr, strlen(cstr)); } bstr *bstr_dup_ex(const bstr *b, size_t offset, size_t len) { bstr *bnew = bstr_alloc(len); if (bnew == NULL) return NULL; memcpy(bstr_ptr(bnew), bstr_ptr(b) + offset, len); bstr_adjust_len(bnew, len); return bnew; } bstr *bstr_dup_lower(const bstr *b) { return bstr_to_lowercase(bstr_dup(b)); } bstr *bstr_dup_mem(const void *data, size_t len) { bstr *bnew = bstr_alloc(len); if (bnew == NULL) return NULL; memcpy(bstr_ptr(bnew), data, len); bstr_adjust_len(bnew, len); return bnew; } bstr *bstr_expand(bstr *b, size_t newsize) { if (bstr_realptr(b) != NULL) { // Refuse to expand a wrapped bstring. In the future, // we can change this to make a copy of the data, thus // leaving the original memory area intact. return NULL; } // Catch attempts to "expand" to a smaller size if (bstr_size(b) > newsize) return NULL; bstr *bnew = realloc(b, sizeof (bstr) + newsize); if (bnew == NULL) return NULL; bstr_adjust_size(bnew, newsize); return bnew; } void bstr_free(bstr *b) { if (b == NULL) return; free(b); } int bstr_index_of(const bstr *haystack, const bstr *needle) { return bstr_index_of_mem(haystack, bstr_ptr(needle), bstr_len(needle)); } int bstr_index_of_c(const bstr *haystack, const char *needle) { return bstr_index_of_mem(haystack, needle, strlen(needle)); } int bstr_index_of_c_nocase(const bstr *haystack, const char *needle) { return bstr_index_of_mem_nocase(haystack, needle, strlen(needle)); } int bstr_index_of_mem(const bstr *haystack, const void *_data2, size_t len2) { return bstr_util_mem_index_of_mem(bstr_ptr(haystack), bstr_len(haystack), _data2, len2); } int bstr_index_of_mem_nocase(const bstr *haystack, const void *_data2, size_t len2) { return bstr_util_mem_index_of_mem_nocase(bstr_ptr(haystack), bstr_len(haystack), _data2, len2); } int bstr_index_of_nocase(const bstr *haystack, const bstr *needle) { return bstr_index_of_mem_nocase(haystack, bstr_ptr(needle), bstr_len(needle)); } int bstr_rchr(const bstr *b, int c) { const unsigned char *data = bstr_ptr(b); size_t len = bstr_len(b); size_t i = len; while (i > 0) { if (data[i - 1] == c) { return i - 1; } i--; } return -1; } bstr *bstr_to_lowercase(bstr *b) { if (b == NULL) return NULL; unsigned char *data = bstr_ptr(b); size_t len = bstr_len(b); size_t i = 0; while (i < len) { data[i] = tolower(data[i]); i++; } return b; } int bstr_util_cmp_mem(const void *_data1, size_t len1, const void *_data2, size_t len2) { const unsigned char *data1 = (const unsigned char *) _data1; const unsigned char *data2 = (const unsigned char *) _data2; size_t p1 = 0, p2 = 0; while ((p1 < len1) && (p2 < len2)) { if (data1[p1] != data2[p2]) { // Difference. return (data1[p1] < data2[p2]) ? -1 : 1; } p1++; p2++; } if ((p1 == len2) && (p2 == len1)) { // They're identical. return 0; } else { // One string is shorter. if (p1 == len1) return -1; else return 1; } } int bstr_util_cmp_mem_nocase(const void *_data1, size_t len1, const void *_data2, size_t len2) { const unsigned char *data1 = (const unsigned char *) _data1; const unsigned char *data2 = (const unsigned char *) _data2; size_t p1 = 0, p2 = 0; while ((p1 < len1) && (p2 < len2)) { if (tolower(data1[p1]) != tolower(data2[p2])) { // Difference. return (tolower(data1[p1]) < tolower(data2[p2])) ? -1 : 1; } p1++; p2++; } if ((p1 == len2) && (p2 == len1)) { // They're identical. return 0; } else { // One string is shorter. if (p1 == len1) return -1; else return 1; } } int64_t bstr_util_mem_to_pint(const void *_data, size_t len, int base, size_t *lastlen) { const unsigned char *data = (unsigned char *) _data; int64_t rval = 0, tval = 0, tflag = 0; size_t i = 0; *lastlen = i; for (i = 0; i < len; i++) { int d = data[i]; *lastlen = i; // Convert character to digit. if ((d >= '0') && (d <= '9')) { d -= '0'; } else if ((d >= 'a') && (d <= 'z')) { d -= 'a' - 10; } else if ((d >= 'A') && (d <= 'Z')) { d -= 'A' - 10; } else { d = -1; } // Check that the digit makes sense with the base we are using. if ((d == -1) || (d >= base)) { if (tflag) { // Return what we have so far; lastlen points // to the first non-digit position. return rval; } else { // We didn't see a single digit. return -1; } } if (tflag) { rval *= base; if (tval > rval) { // Overflow return -2; } rval += d; if (tval > rval) { // Overflow return -2; } tval = rval; } else { tval = rval = d; tflag = 1; } } *lastlen = i + 1; return rval; } int bstr_util_mem_index_of_c(const void *_data1, size_t len1, const char *cstr) { return bstr_util_mem_index_of_mem(_data1, len1, cstr, strlen(cstr)); } int bstr_util_mem_index_of_c_nocase(const void *_data1, size_t len1, const char *cstr) { return bstr_util_mem_index_of_mem_nocase(_data1, len1, cstr, strlen(cstr)); } int bstr_util_mem_index_of_mem(const void *_data1, size_t len1, const void *_data2, size_t len2) { const unsigned char *data1 = (unsigned char *) _data1; const unsigned char *data2 = (unsigned char *) _data2; size_t i, j; // If we ever want to optimize this function, the following link // might be useful: http://en.wikipedia.org/wiki/Knuth-Morris-Pratt_algorithm for (i = 0; i < len1; i++) { size_t k = i; for (j = 0; ((j < len2) && (k < len1)); j++, k++) { if (data1[k] != data2[j]) break; } if (j == len2) { return i; } } return -1; } int bstr_util_mem_index_of_mem_nocase(const void *_data1, size_t len1, const void *_data2, size_t len2) { const unsigned char *data1 = (unsigned char *) _data1; const unsigned char *data2 = (unsigned char *) _data2; size_t i, j; // If we ever want to optimize this function, the following link // might be useful: http://en.wikipedia.org/wiki/Knuth-Morris-Pratt_algorithm for (i = 0; i < len1; i++) { size_t k = i; for (j = 0; ((j < len2) && (k < len1)); j++, k++) { if (toupper(data1[k]) != toupper(data2[j])) break; } if (j == len2) { return i; } } return -1; } void bstr_util_mem_trim(unsigned char **data, size_t *len) { if ((data == NULL)||(len == NULL)) return; unsigned char *d = *data; size_t l = *len; // Ignore whitespace at the beginning. size_t pos = 0; while ((pos < l) && isspace(d[pos])) pos++; d += pos; l -= pos; // Ignore whitespace at the end. while ((l > 0)&&(isspace(d[l - 1]))) l--; *data = d; *len = l; } char *bstr_util_memdup_to_c(const void *_data, size_t len) { const unsigned char *data = (unsigned char *) _data; // Count how many NUL bytes we have in the string. size_t i, nulls = 0; for (i = 0; i < len; i++) { if (data[i] == '\0') { nulls++; } } // Now copy the string into a NUL-terminated buffer. char *r, *d; r = d = malloc(len + nulls + 1); if (d == NULL) return NULL; while (len--) { if (*data == '\0') { data++; *d++ = '\\'; *d++ = '0'; } else { *d++ = *data++; } } *d = '\0'; return r; } char *bstr_util_strdup_to_c(const bstr *b) { if (b == NULL) return NULL; return bstr_util_memdup_to_c(bstr_ptr(b), bstr_len(b)); } bstr *bstr_wrap_c(const char *cstr) { return bstr_wrap_mem((unsigned char *) cstr, strlen(cstr)); } bstr *bstr_wrap_mem(const void *data, size_t len) { bstr *b = (bstr *) malloc(sizeof (bstr)); if (b == NULL) return NULL; b->size = b->len = len; b->realptr = (unsigned char *) data; return b; } suricata-3.2.1/libhtp/htp/htp_multipart_private.h0000644000000000000000000001574113051004451017074 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_MULTIPART_PRIVATE_H #define _HTP_MULTIPART_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #include "htp_multipart.h" #define CD_PARAM_OTHER 0 #define CD_PARAM_NAME 1 #define CD_PARAM_FILENAME 2 #define DEFAULT_FILE_EXTRACT_LIMIT 16 enum htp_part_mode_t { /** When in line mode, the parser is handling part headers. */ MODE_LINE = 0, /** When in data mode, the parser is consuming part data. */ MODE_DATA = 1 }; enum htp_multipart_state_t { /** Initial state, after the parser has been created but before the boundary initialized. */ STATE_INIT = 0, /** Processing data, waiting for a new line (which might indicate a new boundary). */ STATE_DATA = 1, /** Testing a potential boundary. */ STATE_BOUNDARY = 2, /** Checking the first byte after a boundary. */ STATE_BOUNDARY_IS_LAST1 = 3, /** Checking the second byte after a boundary. */ STATE_BOUNDARY_IS_LAST2 = 4, /** Consuming linear whitespace after a boundary. */ STATE_BOUNDARY_EAT_LWS = 5, /** Used after a CR byte is detected in STATE_BOUNDARY_EAT_LWS. */ STATE_BOUNDARY_EAT_LWS_CR = 6 }; struct htp_mpartp_t { htp_multipart_t multipart; htp_cfg_t *cfg; int extract_files; int extract_limit; char *extract_dir; int file_count; // Parsing callbacks int (*handle_data)(htp_mpartp_t *mpartp, const unsigned char *data, size_t len, int line_end); int (*handle_boundary)(htp_mpartp_t *mpartp); // Internal parsing fields; move into a private structure /** * Parser state; one of MULTIPART_STATE_* constants. */ enum htp_multipart_state_t parser_state; /** * Keeps track of the current position in the boundary matching progress. * When this field reaches boundary_len, we have a boundary match. */ size_t boundary_match_pos; /** * Pointer to the part that is currently being processed. */ htp_multipart_part_t *current_part; /** * This parser consists of two layers: the outer layer is charged with * finding parts, and the internal layer handles part data. There is an * interesting interaction between the two parsers. Because the * outer layer is seeing every line (it has to, in order to test for * boundaries), it also effectively also splits input into lines. The * inner parser deals with two areas: first is the headers, which are * line based, followed by binary data. When parsing headers, the inner * parser can reuse the lines identified by the outer parser. In this * variable we keep the current parsing mode of the part, which helps * us process input data more efficiently. The possible values are * MULTIPART_MODE_LINE and MULTIPART_MODE_DATA. */ enum htp_part_mode_t current_part_mode; /** * Used for buffering when a potential boundary is fragmented * across many input data buffers. On a match, the data stored here is * discarded. When there is no match, the buffer is processed as data * (belonging to the currently active part). */ bstr_builder_t *boundary_pieces; bstr_builder_t *part_header_pieces; bstr *pending_header_line; /** * Stores text part pieces until the entire part is seen, at which * point the pieces are assembled into a single buffer, and the * builder cleared. */ bstr_builder_t *part_data_pieces; /** * The offset of the current boundary candidate, relative to the most * recent data chunk (first unprocessed chunk of data). */ size_t boundary_candidate_pos; /** * When we encounter a CR as the last byte in a buffer, we don't know * if the byte is part of a CRLF combination. If it is, then the CR * might be a part of a boundary. But if it is not, it's current * part's data. Because we know how to handle everything before the * CR, we do, and we use this flag to indicate that a CR byte is * effectively being buffered. This is probably a case of premature * optimization, but I am going to leave it in for now. */ int cr_aside; /** * When set, indicates that this parser no longer owns names and * values of MULTIPART_PART_TEXT parts. It is used to avoid data * duplication when the parser is used by LibHTP internally. */ int gave_up_data; }; htp_status_t htp_mpartp_run_request_file_data_hook(htp_multipart_part_t *part, const unsigned char *data, size_t len); htp_status_t htp_mpart_part_process_headers(htp_multipart_part_t *part); htp_status_t htp_mpartp_parse_header(htp_multipart_part_t *part, const unsigned char *data, size_t len); htp_status_t htp_mpart_part_handle_data(htp_multipart_part_t *part, const unsigned char *data, size_t len, int is_line); int htp_mpartp_is_boundary_character(int c); htp_multipart_part_t *htp_mpart_part_create(htp_mpartp_t *parser); htp_status_t htp_mpart_part_finalize_data(htp_multipart_part_t *part); void htp_mpart_part_destroy(htp_multipart_part_t *part, int gave_up_data); htp_status_t htp_mpart_part_parse_c_d(htp_multipart_part_t *part); #ifdef __cplusplus } #endif #endif /* _HTP_MULTIPART_PRIVATE_H */ suricata-3.2.1/libhtp/htp/htp_config_auto.h0000644000000000000000000000414313051004451015610 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * * This file wraps the generated autoconf header to provide define * blocks to prevent issue when included more than once. * * @warning Only include this in source files. * * @author Brian Rectanus */ #ifndef _HTP_CONFIG_AUTO_H #define _HTP_CONFIG_AUTO_H #ifdef HAVE_CONFIG_H #include "htp_config_auto_gen.h" #endif #endif /* _HTP_CONFIG_AUTO_H */ suricata-3.2.1/libhtp/htp/htp_content_handlers.c0000644000000000000000000002470613051004451016647 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * This callback function feeds request body data to a Urlencoded parser * and, later, feeds the parsed parameters to the correct structures. * * @param[in] d * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_ch_urlencoded_callback_request_body_data(htp_tx_data_t *d) { htp_tx_t *tx = d->tx; // Check that we were not invoked again after the finalization. if (tx->request_urlenp_body->params == NULL) return HTP_ERROR; if (d->data != NULL) { // Process one chunk of data. htp_urlenp_parse_partial(tx->request_urlenp_body, d->data, d->len); } else { // Finalize parsing. htp_urlenp_finalize(tx->request_urlenp_body); // Add all parameters to the transaction. bstr *name = NULL; bstr *value = NULL; for (size_t i = 0, n = htp_table_size(tx->request_urlenp_body->params); i < n; i++) { value = htp_table_get_index(tx->request_urlenp_body->params, i, &name); htp_param_t *param = calloc(1, sizeof (htp_param_t)); if (param == NULL) return HTP_ERROR; param->name = name; param->value = value; param->source = HTP_SOURCE_BODY; param->parser_id = HTP_PARSER_URLENCODED; param->parser_data = NULL; if (htp_tx_req_add_param(tx, param) != HTP_OK) { free(param); return HTP_ERROR; } } // All the parameter data is now owned by the transaction, and // the parser table used to store it is no longer needed. The // line below will destroy just the table, leaving keys intact. htp_table_destroy_ex(tx->request_urlenp_body->params); tx->request_urlenp_body->params = NULL; } return HTP_OK; } /** * Determine if the request has a Urlencoded body, and, if it does, create and * attach an instance of the Urlencoded parser to the transaction. * * @param[in] connp * @return HTP_OK if a new parser has been setup, HTP_DECLINED if the MIME type * is not appropriate for this parser, and HTP_ERROR on failure. */ htp_status_t htp_ch_urlencoded_callback_request_headers(htp_tx_t *tx) { // Check the request content type to see if it matches our MIME type. if ((tx->request_content_type == NULL) || (!bstr_begins_with_c(tx->request_content_type, HTP_URLENCODED_MIME_TYPE))) { #ifdef HTP_DEBUG fprintf(stderr, "htp_ch_urlencoded_callback_request_headers: Body not URLENCODED\n"); #endif return HTP_DECLINED; } #ifdef HTP_DEBUG fprintf(stderr, "htp_ch_urlencoded_callback_request_headers: Parsing URLENCODED body\n"); #endif // Create parser instance. tx->request_urlenp_body = htp_urlenp_create(tx); if (tx->request_urlenp_body == NULL) return HTP_ERROR; // Register a request body data callback. htp_tx_register_request_body_data(tx, htp_ch_urlencoded_callback_request_body_data); return HTP_OK; } /** * Parses request query string, if present. * * @param[in] connp * @param[in] raw_data * @param[in] raw_len * @return HTP_OK if query string was parsed, HTP_DECLINED if there was no query * string, and HTP_ERROR on failure. */ htp_status_t htp_ch_urlencoded_callback_request_line(htp_tx_t *tx) { // Proceed only if there's something for us to parse. if ((tx->parsed_uri->query == NULL) || (bstr_len(tx->parsed_uri->query) == 0)) { return HTP_DECLINED; } // We have a non-zero length query string. tx->request_urlenp_query = htp_urlenp_create(tx); if (tx->request_urlenp_query == NULL) return HTP_ERROR; if (htp_urlenp_parse_complete(tx->request_urlenp_query, bstr_ptr(tx->parsed_uri->query), bstr_len(tx->parsed_uri->query)) != HTP_OK) { htp_urlenp_destroy(tx->request_urlenp_query); return HTP_ERROR; } // Add all parameters to the transaction. bstr *name = NULL; bstr *value = NULL; for (size_t i = 0, n = htp_table_size(tx->request_urlenp_query->params); i < n; i++) { value = htp_table_get_index(tx->request_urlenp_query->params, i, &name); htp_param_t *param = calloc(1, sizeof (htp_param_t)); if (param == NULL) return HTP_ERROR; param->name = name; param->value = value; param->source = HTP_SOURCE_QUERY_STRING; param->parser_id = HTP_PARSER_URLENCODED; param->parser_data = NULL; if (htp_tx_req_add_param(tx, param) != HTP_OK) { free(param); return HTP_ERROR; } } // All the parameter data is now owned by the transaction, and // the parser table used to store it is no longer needed. The // line below will destroy just the table, leaving keys intact. htp_table_destroy_ex(tx->request_urlenp_query->params); tx->request_urlenp_query->params = NULL; htp_urlenp_destroy(tx->request_urlenp_query); tx->request_urlenp_query = NULL; return HTP_OK; } /** * Finalize Multipart processing. * * @param[in] d * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_ch_multipart_callback_request_body_data(htp_tx_data_t *d) { htp_tx_t *tx = d->tx; // Check that we were not invoked again after the finalization. if (tx->request_mpartp->gave_up_data == 1) return HTP_ERROR; if (d->data != NULL) { // Process one chunk of data. htp_mpartp_parse(tx->request_mpartp, d->data, d->len); } else { // Finalize parsing. htp_mpartp_finalize(tx->request_mpartp); htp_multipart_t *body = htp_mpartp_get_multipart(tx->request_mpartp); for (size_t i = 0, n = htp_list_size(body->parts); i < n; i++) { htp_multipart_part_t *part = htp_list_get(body->parts, i); // Use text parameters. if (part->type == MULTIPART_PART_TEXT) { htp_param_t *param = calloc(1, sizeof (htp_param_t)); if (param == NULL) return HTP_ERROR; param->name = part->name; param->value = part->value; param->source = HTP_SOURCE_BODY; param->parser_id = HTP_PARSER_MULTIPART; param->parser_data = part; if (htp_tx_req_add_param(tx, param) != HTP_OK) { free(param); return HTP_ERROR; } } } // Tell the parser that it no longer owns names // and values of MULTIPART_PART_TEXT parts. tx->request_mpartp->gave_up_data = 1; } return HTP_OK; } /** * Inspect request headers and register the Multipart request data hook * if it contains a multipart/form-data body. * * @param[in] connp * @return HTP_OK if a new parser has been setup, HTP_DECLINED if the MIME type * is not appropriate for this parser, and HTP_ERROR on failure. */ htp_status_t htp_ch_multipart_callback_request_headers(htp_tx_t *tx) { #ifdef HTP_DEBUG fprintf(stderr, "htp_ch_multipart_callback_request_headers: Need to determine if multipart body is present\n"); #endif // The field tx->request_content_type does not contain the entire C-T // value and so we cannot use it to look for a boundary, but we can // use it for a quick check to determine if the C-T header exists. if (tx->request_content_type == NULL) { #ifdef HTP_DEBUG fprintf(stderr, "htp_ch_multipart_callback_request_headers: Not multipart body (no C-T header)\n"); #endif return HTP_DECLINED; } // Look for a boundary. htp_header_t *ct = htp_table_get_c(tx->request_headers, "content-type"); if (ct == NULL) return HTP_ERROR; bstr *boundary = NULL; uint64_t flags = 0; htp_status_t rc = htp_mpartp_find_boundary(ct->value, &boundary, &flags); if (rc != HTP_OK) { #ifdef HTP_DEBUG if (rc == HTP_DECLINED) { fprintf(stderr, "htp_ch_multipart_callback_request_headers: Not multipart body\n"); } #endif // No boundary (HTP_DECLINED) or error (HTP_ERROR). return rc; } if (boundary == NULL) return HTP_ERROR; // Create a Multipart parser instance. tx->request_mpartp = htp_mpartp_create(tx->connp->cfg, boundary, flags); if (tx->request_mpartp == NULL) { bstr_free(boundary); return HTP_ERROR; } // Configure file extraction. if (tx->cfg->extract_request_files) { tx->request_mpartp->extract_files = 1; tx->request_mpartp->extract_dir = tx->connp->cfg->tmpdir; } // Register a request body data callback. htp_tx_register_request_body_data(tx, htp_ch_multipart_callback_request_body_data); return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_cookies.c0000644000000000000000000000766513051004451014756 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Parses a single v0 request cookie and places the results into tx->request_cookies. * * @param[in] connp * @param[in] data * @param[in] len * @return HTP_OK on success, HTP_ERROR on error. */ int htp_parse_single_cookie_v0(htp_connp_t *connp, unsigned char *data, size_t len) { if (len == 0) return HTP_OK; size_t pos = 0; // Look for '='. while ((pos < len) && (data[pos] != '=')) pos++; if (pos == 0) return HTP_OK; // Ignore a nameless cookie. bstr *name = bstr_dup_mem(data, pos); if (name == NULL) return HTP_ERROR; bstr *value = NULL; if (pos == len) { // The cookie is empty. value = bstr_dup_c(""); } else { // The cookie is not empty. value = bstr_dup_mem(data + pos + 1, len - pos - 1); } if (value == NULL) { bstr_free(name); return HTP_ERROR; } htp_table_addn(connp->in_tx->request_cookies, name, value); return HTP_OK; } /** * Parses the Cookie request header in v0 format. * * @param[in] connp * @return HTP_OK on success, HTP_ERROR on error */ htp_status_t htp_parse_cookies_v0(htp_connp_t *connp) { htp_header_t *cookie_header = htp_table_get_c(connp->in_tx->request_headers, "cookie"); if (cookie_header == NULL) return HTP_OK; // Create a new table to store cookies. connp->in_tx->request_cookies = htp_table_create(4); if (connp->in_tx->request_cookies == NULL) return HTP_ERROR; unsigned char *data = bstr_ptr(cookie_header->value); size_t len = bstr_len(cookie_header->value); size_t pos = 0; while (pos < len) { // Ignore whitespace at the beginning. while ((pos < len) && (isspace((int)data[pos]))) pos++; if (pos == len) return HTP_OK; size_t start = pos; // Find the end of the cookie. while ((pos < len) && (data[pos] != ';')) pos++; if (htp_parse_single_cookie_v0(connp, data + start, pos - start) != HTP_OK) { return HTP_ERROR; } // Go over the semicolon. if (pos < len) pos++; } return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_request_generic.c0000644000000000000000000003005213051004451016470 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Extract one request header. A header can span multiple lines, in * which case they will be folded into one before parsing is attempted. * * @param[in] connp * @param[in] data * @param[in] len * @return HTP_OK or HTP_ERROR */ htp_status_t htp_process_request_header_generic(htp_connp_t *connp, unsigned char *data, size_t len) { // Create a new header structure. htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return HTP_ERROR; // Now try to parse the header. if (htp_parse_request_header_generic(connp, h, data, len) != HTP_OK) { free(h); return HTP_ERROR; } #ifdef HTP_DEBUG fprint_bstr(stderr, "Header name", h->name); fprint_bstr(stderr, "Header value", h->value); #endif // Do we already have a header with the same name? htp_header_t *h_existing = htp_table_get(connp->in_tx->request_headers, h->name); if (h_existing != NULL) { // TODO Do we want to have a list of the headers that are // allowed to be combined in this way? // Add to the existing header. bstr *new_value = bstr_expand(h_existing->value, bstr_len(h_existing->value) + 2 + bstr_len(h->value)); if (new_value == NULL) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } h_existing->value = new_value; bstr_add_mem_noex(h_existing->value, ", ", 2); bstr_add_noex(h_existing->value, h->value); // The new header structure is no longer needed. bstr_free(h->name); bstr_free(h->value); free(h); // Keep track of repeated same-name headers. h_existing->flags |= HTP_FIELD_REPEATED; } else { // Add as a new header. htp_table_add(connp->in_tx->request_headers, h->name, h); } return HTP_OK; } /** * Generic request header parser. * * @param[in] connp * @param[in] h * @param[in] data * @param[in] len * @return HTP_OK or HTP_ERROR */ htp_status_t htp_parse_request_header_generic(htp_connp_t *connp, htp_header_t *h, unsigned char *data, size_t len) { size_t name_start, name_end; size_t value_start, value_end; htp_chomp(data, &len); name_start = 0; // Look for the colon. size_t colon_pos = 0; while ((colon_pos < len) && (data[colon_pos] != '\0') && (data[colon_pos] != ':')) colon_pos++; if ((colon_pos == len) || (data[colon_pos] == '\0')) { // Missing colon. h->flags |= HTP_FIELD_UNPARSEABLE; // Log only once per transaction. if (!(connp->in_tx->flags & HTP_FIELD_UNPARSEABLE)) { connp->in_tx->flags |= HTP_FIELD_UNPARSEABLE; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request field invalid: colon missing"); } // We handle this case as a header with an empty name, with the value equal // to the entire input string. // TODO Apache will respond to this problem with a 400. // Now extract the name and the value h->name = bstr_dup_c(""); if (h->name == NULL) return HTP_ERROR; h->value = bstr_dup_mem(data, len); if (h->value == NULL) { bstr_free(h->name); return HTP_ERROR; } return HTP_OK; } if (colon_pos == 0) { // Empty header name. h->flags |= HTP_FIELD_INVALID; // Log only once per transaction. if (!(connp->in_tx->flags & HTP_FIELD_INVALID)) { connp->in_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request field invalid: empty name"); } } name_end = colon_pos; // Ignore LWS after field-name. size_t prev = name_end; while ((prev > name_start) && (htp_is_lws(data[prev - 1]))) { // LWS after header name. prev--; name_end--; h->flags |= HTP_FIELD_INVALID; // Log only once per transaction. if (!(connp->in_tx->flags & HTP_FIELD_INVALID)) { connp->in_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request field invalid: LWS after name"); } } // Header value. value_start = colon_pos; // Go over the colon. if (value_start < len) { value_start++; } // Ignore LWS before field-content. while ((value_start < len) && (htp_is_lws(data[value_start]))) { value_start++; } // Look for the end of field-content. value_end = value_start; while ((value_end < len) && (data[value_end] != '\0')) value_end++; // Ignore LWS after field-content. prev = value_end - 1; while ((prev > value_start) && (htp_is_lws(data[prev]))) { prev--; value_end--; } // Check that the header name is a token. size_t i = name_start; while (i < name_end) { if (!htp_is_token(data[i])) { // Incorrectly formed header name. h->flags |= HTP_FIELD_INVALID; // Log only once per transaction. if (!(connp->in_tx->flags & HTP_FIELD_INVALID)) { connp->in_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request header name is not a token"); } break; } i++; } // Now extract the name and the value h->name = bstr_dup_mem(data + name_start, name_end - name_start); if (h->name == NULL) return HTP_ERROR; h->value = bstr_dup_mem(data + value_start, value_end - value_start); if (h->value == NULL) { bstr_free(h->name); return HTP_ERROR; } return HTP_OK; } /** * Generic request line parser. * * @param[in] connp * @return HTP_OK or HTP_ERROR */ htp_status_t htp_parse_request_line_generic(htp_connp_t *connp) { return htp_parse_request_line_generic_ex(connp, 0 /* NUL does not terminates line */); } htp_status_t htp_parse_request_line_generic_ex(htp_connp_t *connp, int nul_terminates) { htp_tx_t *tx = connp->in_tx; unsigned char *data = bstr_ptr(tx->request_line); size_t len = bstr_len(tx->request_line); size_t pos = 0; size_t mstart = 0; size_t start; size_t bad_delim; if (nul_terminates) { // The line ends with the first NUL byte. size_t newlen = 0; while ((pos < len) && (data[pos] != '\0')) { pos++; newlen++; } // Start again, with the new length. len = newlen; pos = 0; } // skip past leading whitespace. IIS allows this while ((pos < len) && htp_is_space(data[pos])) pos++; if (pos) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request line: leading whitespace"); mstart = pos; if (connp->cfg->requestline_leading_whitespace_unwanted != HTP_UNWANTED_IGNORE) { // reset mstart so that we copy the whitespace into the method mstart = 0; // set expected response code to this anomaly tx->response_status_expected_number = connp->cfg->requestline_leading_whitespace_unwanted; } } // The request method starts at the beginning of the // line and ends with the first whitespace character. while ((pos < len) && (!htp_is_space(data[pos]))) pos++; // No, we don't care if the method is empty. tx->request_method = bstr_dup_mem(data + mstart, pos - mstart); if (tx->request_method == NULL) return HTP_ERROR; #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, bstr_ptr(tx->request_method), bstr_len(tx->request_method)); #endif tx->request_method_number = htp_convert_method_to_number(tx->request_method); bad_delim = 0; // Ignore whitespace after request method. The RFC allows // for only one SP, but then suggests any number of SP and HT // should be permitted. Apache uses isspace(), which is even // more permitting, so that's what we use here. while ((pos < len) && (isspace(data[pos]))) { if (!bad_delim && data[pos] != 0x20) { bad_delim++; } pos++; } if (bad_delim) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request line: non-compliant delimiter between Method and URI"); } // Is there anything after the request method? if (pos == len) { // No, this looks like a HTTP/0.9 request. tx->is_protocol_0_9 = 1; tx->request_protocol_number = HTP_PROTOCOL_0_9; return HTP_OK; } start = pos; bad_delim = 0; // The URI ends with the first whitespace. while ((pos < len) && (data[pos] != 0x20)) { if (!bad_delim && htp_is_space(data[pos])) { bad_delim++; } pos++; } /* if we've seen some 'bad' delimiters, we retry with those */ if (bad_delim && pos == len) { // special case: even though RFC's allow only SP (0x20), many // implementations allow other delimiters, like tab or other // characters that isspace() accepts. pos = start; while ((pos < len) && (!htp_is_space(data[pos]))) pos++; } if (bad_delim) { // warn regardless if we've seen non-compliant chars htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Request line: URI contains non-compliant delimiter"); } tx->request_uri = bstr_dup_mem(data + start, pos - start); if (tx->request_uri == NULL) return HTP_ERROR; #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, bstr_ptr(tx->request_uri), bstr_len(tx->request_uri)); #endif // Ignore whitespace after URI. while ((pos < len) && (htp_is_space(data[pos]))) pos++; // Is there protocol information available? if (pos == len) { // No, this looks like a HTTP/0.9 request. tx->is_protocol_0_9 = 1; tx->request_protocol_number = HTP_PROTOCOL_0_9; return HTP_OK; } // The protocol information continues until the end of the line. tx->request_protocol = bstr_dup_mem(data + pos, len - pos); if (tx->request_protocol == NULL) return HTP_ERROR; tx->request_protocol_number = htp_parse_protocol(tx->request_protocol); #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, bstr_ptr(tx->request_protocol), bstr_len(tx->request_protocol)); #endif return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_transcoder.c0000644000000000000000000001511513051004451015453 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Transcode all parameters supplied in the table. * * @param[in] connp * @param[in] params * @param[in] destroy_old */ int htp_transcode_params(htp_connp_t *connp, htp_table_t **params, int destroy_old) { htp_table_t *input_params = *params; // No transcoding unless necessary if ((connp->cfg->internal_encoding == NULL)||(connp->cfg->request_encoding == NULL)) return HTP_OK; // Create a new table that will hold transcoded parameters htp_table_t *output_params = htp_table_create(htp_table_size(input_params)); if (output_params == NULL) return HTP_ERROR; // Initialize iconv iconv_t cd = iconv_open(connp->cfg->internal_encoding, connp->cfg->request_encoding); if (cd == (iconv_t) -1) { htp_table_destroy(output_params); return HTP_ERROR; } #if (_LIBICONV_VERSION >= 0x0108) int iconv_param = 0; iconvctl(cd, ICONV_SET_TRANSLITERATE, &iconv_param); iconv_param = 1; iconvctl(cd, ICONV_SET_DISCARD_ILSEQ, &iconv_param); #endif // Convert the parameters, one by one bstr *name = NULL; bstr *value = NULL; for (int i = 0, n = htp_table_size(input_params); i < n; i++) { value = htp_table_get_index(input_params, i, &name); bstr *new_name = NULL, *new_value = NULL; // Convert name htp_transcode_bstr(cd, name, &new_name); if (new_name == NULL) { iconv_close(cd); bstr *b = NULL; for (int j = 0, k = htp_table_size(output_params); j < k; j++) { b = htp_table_get_index(output_params, j, NULL); bstr_free(b); } htp_table_destroy(output_params); return HTP_ERROR; } // Convert value htp_transcode_bstr(cd, value, &new_value); if (new_value == NULL) { bstr_free(new_name); iconv_close(cd); bstr *b = NULL; for (int j = 0, k = htp_table_size(output_params); j < k; j++) { b = htp_table_get_index(output_params, j, NULL); bstr_free(b); } htp_table_destroy(output_params); return HTP_ERROR; } // Add to new table htp_table_addn(output_params, new_name, new_value); } // Replace the old parameter table *params = output_params; // Destroy the old parameter table if necessary if (destroy_old) { bstr *b = NULL; for (int i = 0, n = htp_table_size(input_params); i < n; i++) { b = htp_table_get_index(input_params, i, NULL); bstr_free(b); } htp_table_destroy(input_params); } iconv_close(cd); return HTP_OK; } /** * Transcode one bstr. * * @param[in] cd * @param[in] input * @param[in] output */ int htp_transcode_bstr(iconv_t cd, bstr *input, bstr **output) { // Reset conversion state for every new string iconv(cd, NULL, 0, NULL, 0); bstr_builder_t *bb = NULL; const size_t buflen = 10; unsigned char *buf = malloc(buflen); if (buf == NULL) { return HTP_ERROR; } const char *inbuf = (const char *)bstr_ptr(input); size_t inleft = bstr_len(input); char *outbuf = (char *)buf; size_t outleft = buflen; int loop = 1; while (loop) { loop = 0; if (iconv(cd, (ICONV_CONST char **)&inbuf, &inleft, (char **)&outbuf, &outleft) == (size_t) - 1) { if (errno == E2BIG) { // Create bstr builder on-demand if (bb == NULL) { bb = bstr_builder_create(); if (bb == NULL) { free(buf); return HTP_ERROR; } } // The output buffer is full bstr_builder_append_mem(bb, buf, buflen - outleft); outbuf = (char *)buf; outleft = buflen; // Continue in the loop, as there's more work to do loop = 1; } else { // Error if (bb != NULL) bstr_builder_destroy(bb); free(buf); return HTP_ERROR; } } } if (bb != NULL) { bstr_builder_append_mem(bb, buf, buflen - outleft); *output = bstr_builder_to_str(bb); bstr_builder_destroy(bb); if (*output == NULL) { free(buf); return HTP_ERROR; } } else { *output = bstr_dup_mem(buf, buflen - outleft); if (*output == NULL) { free(buf); return HTP_ERROR; } } free(buf); return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_multipart.h0000644000000000000000000002653313051004451015343 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_MULTIPART_H #define _HTP_MULTIPART_H #ifdef __cplusplus extern "C" { #endif #include "bstr.h" #include "htp.h" #include "htp_table.h" // Constants and enums. /** * Seen a LF line in the payload. LF lines are not allowed, but * some clients do use them and some backends do accept them. Mixing * LF and CRLF lines within some payload might be unusual. */ #define HTP_MULTIPART_LF_LINE 0x0001 /** Seen a CRLF line in the payload. This is normal and expected. */ #define HTP_MULTIPART_CRLF_LINE 0x0002 /** Seen LWS after a boundary instance in the body. Unusual. */ #define HTP_MULTIPART_BBOUNDARY_LWS_AFTER 0x0004 /** Seen non-LWS content after a boundary instance in the body. Highly unusual. */ #define HTP_MULTIPART_BBOUNDARY_NLWS_AFTER 0x0008 /** * Payload has a preamble part. Might not be that unusual. */ #define HTP_MULTIPART_HAS_PREAMBLE 0x0010 /** * Payload has an epilogue part. Unusual. */ #define HTP_MULTIPART_HAS_EPILOGUE 0x0020 /** * The last boundary was seen in the payload. Absence of the last boundary * may not break parsing with some (most?) backends, but it means that the payload * is not well formed. Can occur if the client gives up, or if the connection is * interrupted. Incomplete payloads should be blocked whenever possible. */ #define HTP_MULTIPART_SEEN_LAST_BOUNDARY 0x0040 /** * There was a part after the last boundary. This is highly irregular * and indicative of evasion. */ #define HTP_MULTIPART_PART_AFTER_LAST_BOUNDARY 0x0080 /** * The payloads ends abruptly, without proper termination. Can occur if the client gives up, * or if the connection is interrupted. When this flag is raised, HTP_MULTIPART_PART_INCOMPLETE * will also be raised for the part that was only partially processed. (But the opposite may not * always be the case -- there are other ways in which a part can be left incomplete.) */ #define HTP_MULTIPART_INCOMPLETE 0x0100 /** The boundary in the Content-Type header is invalid. */ #define HTP_MULTIPART_HBOUNDARY_INVALID 0x0200 /** * The boundary in the Content-Type header is unusual. This may mean that evasion * is attempted, but it could also mean that we have encountered a client that does * not do things in the way it should. */ #define HTP_MULTIPART_HBOUNDARY_UNUSUAL 0x0400 /** * The boundary in the Content-Type header is quoted. This is very unusual, * and may be indicative of an evasion attempt. */ #define HTP_MULTIPART_HBOUNDARY_QUOTED 0x0800 /** Header folding was used in part headers. Very unusual. */ #define HTP_MULTIPART_PART_HEADER_FOLDING 0x1000 /** * A part of unknown type was encountered, which probably means that the part is lacking * a Content-Disposition header, or that the header is invalid. Highly unusual. */ #define HTP_MULTIPART_PART_UNKNOWN 0x2000 /** There was a repeated part header, possibly in an attempt to confuse the parser. Very unusual. */ #define HTP_MULTIPART_PART_HEADER_REPEATED 0x4000 /** Unknown part header encountered. */ #define HTP_MULTIPART_PART_HEADER_UNKNOWN 0x8000 /** Invalid part header encountered. */ #define HTP_MULTIPART_PART_HEADER_INVALID 0x10000 /** Part type specified in the C-D header is neither MULTIPART_PART_TEXT nor MULTIPART_PART_FILE. */ #define HTP_MULTIPART_CD_TYPE_INVALID 0x20000 /** Content-Disposition part header with multiple parameters with the same name. */ #define HTP_MULTIPART_CD_PARAM_REPEATED 0x40000 /** Unknown Content-Disposition parameter. */ #define HTP_MULTIPART_CD_PARAM_UNKNOWN 0x80000 /** Invalid Content-Disposition syntax. */ #define HTP_MULTIPART_CD_SYNTAX_INVALID 0x100000 /** * There is an abruptly terminated part. This can happen when the payload itself is abruptly * terminated (in which case HTP_MULTIPART_INCOMPLETE) will be raised. However, it can also * happen when a boundary is seen before any part data. */ #define HTP_MULTIPART_PART_INCOMPLETE 0x200000 /** A NUL byte was seen in a part header area. */ #define HTP_MULTIPART_NUL_BYTE 0x400000 /** A collection of flags that all indicate an invalid C-D header. */ #define HTP_MULTIPART_CD_INVALID ( \ HTP_MULTIPART_CD_TYPE_INVALID | \ HTP_MULTIPART_CD_PARAM_REPEATED | \ HTP_MULTIPART_CD_PARAM_UNKNOWN | \ HTP_MULTIPART_CD_SYNTAX_INVALID ) /** A collection of flags that all indicate an invalid part. */ #define HTP_MULTIPART_PART_INVALID ( \ HTP_MULTIPART_CD_INVALID | \ HTP_MULTIPART_NUL_BYTE | \ HTP_MULTIPART_PART_UNKNOWN | \ HTP_MULTIPART_PART_HEADER_REPEATED | \ HTP_MULTIPART_PART_INCOMPLETE | \ HTP_MULTIPART_PART_HEADER_UNKNOWN | \ HTP_MULTIPART_PART_HEADER_INVALID ) /** A collection of flags that all indicate an invalid Multipart payload. */ #define HTP_MULTIPART_INVALID ( \ HTP_MULTIPART_PART_INVALID | \ HTP_MULTIPART_PART_AFTER_LAST_BOUNDARY | \ HTP_MULTIPART_INCOMPLETE | \ HTP_MULTIPART_HBOUNDARY_INVALID ) /** A collection of flags that all indicate an unusual Multipart payload. */ #define HTP_MULTIPART_UNUSUAL ( \ HTP_MULTIPART_INVALID | \ HTP_MULTIPART_PART_HEADER_FOLDING | \ HTP_MULTIPART_BBOUNDARY_NLWS_AFTER | \ HTP_MULTIPART_HAS_EPILOGUE | \ HTP_MULTIPART_HBOUNDARY_UNUSUAL \ HTP_MULTIPART_HBOUNDARY_QUOTED ) /** A collection of flags that all indicate an unusual Multipart payload, with a low sensitivity to irregularities. */ #define HTP_MULTIPART_UNUSUAL_PARANOID ( \ HTP_MULTIPART_UNUSUAL | \ HTP_MULTIPART_LF_LINE | \ HTP_MULTIPART_BBOUNDARY_LWS_AFTER | \ HTP_MULTIPART_HAS_PREAMBLE ) #define HTP_MULTIPART_MIME_TYPE "multipart/form-data" enum htp_multipart_type_t { /** Unknown part. */ MULTIPART_PART_UNKNOWN = 0, /** Text (parameter) part. */ MULTIPART_PART_TEXT = 1, /** File part. */ MULTIPART_PART_FILE = 2, /** Free-text part before the first boundary. */ MULTIPART_PART_PREAMBLE = 3, /** Free-text part after the last boundary. */ MULTIPART_PART_EPILOGUE = 4 }; // Structures /** * Holds multipart parser configuration and state. Private. */ typedef struct htp_mpartp_t htp_mpartp_t; /** * Holds information related to a multipart body. */ typedef struct htp_multipart_t { /** Multipart boundary. */ char *boundary; /** Boundary length. */ size_t boundary_len; /** How many boundaries were there? */ int boundary_count; /** List of parts, in the order in which they appeared in the body. */ htp_list_t *parts; /** Parsing flags. */ uint64_t flags; } htp_multipart_t; /** * Holds information related to a part. */ typedef struct htp_multipart_part_t { /** Pointer to the parser. */ htp_mpartp_t *parser; /** Part type; see the MULTIPART_PART_* constants. */ enum htp_multipart_type_t type; /** Raw part length (i.e., headers and data). */ size_t len; /** Part name, from the Content-Disposition header. Can be NULL. */ bstr *name; /** * Part value; the contents depends on the type of the part: * 1) NULL for files; 2) contains complete part contents for * preamble and epilogue parts (they have no headers), and * 3) data only (headers excluded) for text and unknown parts. */ bstr *value; /** Part content type, from the Content-Type header. Can be NULL. */ bstr *content_type; /** Part headers (htp_header_t instances), using header name as the key. */ htp_table_t *headers; /** File data, available only for MULTIPART_PART_FILE parts. */ htp_file_t *file; } htp_multipart_part_t; // Functions /** * Creates a new multipart/form-data parser. On a successful invocation, * the ownership of the boundary parameter is transferred to the parser. * * @param[in] cfg * @param[in] boundary * @param[in] flags * @return New parser instance, or NULL on memory allocation failure. */ htp_mpartp_t *htp_mpartp_create(htp_cfg_t *cfg, bstr *boundary, uint64_t flags); /** * Looks for boundary in the supplied Content-Type request header. The extracted * boundary will be allocated on the heap. * * @param[in] content_type * @param[out] boundary * @param[out] multipart_flags Multipart flags, which are not compatible from general LibHTP flags. * @return HTP_OK on success (boundary found), HTP_DECLINED if boundary was not found, * and HTP_ERROR on failure. Flags may be set on HTP_OK and HTP_DECLINED. For * example, if a boundary could not be extracted but there is indication that * one is present, HTP_MULTIPART_HBOUNDARY_INVALID will be set. */ htp_status_t htp_mpartp_find_boundary(bstr *content_type, bstr **boundary, uint64_t *multipart_flags); /** * Returns the multipart structure created by the parser. * * @param[in] parser * @return The main multipart structure. */ htp_multipart_t *htp_mpartp_get_multipart(htp_mpartp_t *parser); /** * Destroys the provided parser. * * @param[in] parser */ void htp_mpartp_destroy(htp_mpartp_t *parser); /** * Finalize parsing. * * @param[in] parser * @returns HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_mpartp_finalize(htp_mpartp_t *parser); /** * Parses a chunk of multipart/form-data data. This function should be called * as many times as necessary until all data has been consumed. * * @param[in] parser * @param[in] data * @param[in] len * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_mpartp_parse(htp_mpartp_t *parser, const void *data, size_t len); #ifdef __cplusplus } #endif #endif /* _HTP_MULTIPART_H */ suricata-3.2.1/libhtp/htp/htp_connection_parser.c0000644000000000000000000001447213051004451017027 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" void htp_connp_clear_error(htp_connp_t *connp) { connp->last_error = NULL; } void htp_connp_close(htp_connp_t *connp, const htp_time_t *timestamp) { if (connp == NULL) return; // Close the underlying connection. htp_conn_close(connp->conn, timestamp); // Update internal flags if (connp->in_status != HTP_STREAM_ERROR) connp->in_status = HTP_STREAM_CLOSED; if (connp->out_status != HTP_STREAM_ERROR) connp->out_status = HTP_STREAM_CLOSED; // Call the parsers one last time, which will allow them // to process the events that depend on stream closure htp_connp_req_data(connp, timestamp, NULL, 0); htp_connp_res_data(connp, timestamp, NULL, 0); } htp_connp_t *htp_connp_create(htp_cfg_t *cfg) { htp_connp_t *connp = calloc(1, sizeof (htp_connp_t)); if (connp == NULL) return NULL; // Use the supplied configuration structure connp->cfg = cfg; // Create a new connection. connp->conn = htp_conn_create(); if (connp->conn == NULL) { free(connp); return NULL; } // Request parsing connp->in_state = htp_connp_REQ_IDLE; connp->in_status = HTP_STREAM_NEW; // Response parsing connp->out_state = htp_connp_RES_IDLE; connp->out_status = HTP_STREAM_NEW; return connp; } void htp_connp_destroy(htp_connp_t *connp) { if (connp == NULL) return; if (connp->in_buf != NULL) { free(connp->in_buf); } if (connp->out_buf != NULL) { free(connp->out_buf); } htp_connp_destroy_decompressors(connp); if (connp->put_file != NULL) { bstr_free(connp->put_file->filename); free(connp->put_file); } if (connp->in_header) { bstr_free(connp->in_header); connp->in_header = NULL; } if (connp->out_header) { bstr_free(connp->out_header); connp->out_header = NULL; } free(connp); } void htp_connp_destroy_all(htp_connp_t *connp) { if (connp == NULL) return; // Destroy connection htp_conn_destroy(connp->conn); connp->conn = NULL; // Destroy everything else htp_connp_destroy(connp); } htp_conn_t *htp_connp_get_connection(const htp_connp_t *connp) { if (connp == NULL) return NULL; return connp->conn; } htp_tx_t *htp_connp_get_in_tx(const htp_connp_t *connp) { if (connp == NULL) return NULL; return connp->in_tx; } htp_log_t *htp_connp_get_last_error(const htp_connp_t *connp) { if (connp == NULL) return NULL; return connp->last_error; } htp_tx_t *htp_connp_get_out_tx(const htp_connp_t *connp) { if (connp == NULL) return NULL; return connp->out_tx; } void *htp_connp_get_user_data(const htp_connp_t *connp) { if (connp == NULL) return NULL; return (void *)connp->user_data; } void htp_connp_in_reset(htp_connp_t *connp) { if (connp == NULL) return; connp->in_content_length = -1; connp->in_body_data_left = -1; connp->in_chunk_request_index = connp->in_chunk_count; } void htp_connp_open(htp_connp_t *connp, const char *client_addr, int client_port, const char *server_addr, int server_port, htp_time_t *timestamp) { if (connp == NULL) return; // Check connection parser state first. if ((connp->in_status != HTP_STREAM_NEW) || (connp->out_status != HTP_STREAM_NEW)) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Connection is already open"); return; } if (htp_conn_open(connp->conn, client_addr, client_port, server_addr, server_port, timestamp) != HTP_OK) { return; } connp->in_status = HTP_STREAM_OPEN; connp->out_status = HTP_STREAM_OPEN; } void htp_connp_set_user_data(htp_connp_t *connp, const void *user_data) { if (connp == NULL) return; connp->user_data = user_data; } htp_tx_t *htp_connp_tx_create(htp_connp_t *connp) { if (connp == NULL) return NULL; // Detect pipelining. if (htp_list_size(connp->conn->transactions) > connp->out_next_tx_index) { connp->conn->flags |= HTP_CONN_PIPELINED; } htp_tx_t *tx = htp_tx_create(connp); if (tx == NULL) return NULL; connp->in_tx = tx; htp_connp_in_reset(connp); return tx; } /** * Removes references to the supplied transaction. * * @param[in] connp * @param[in] tx */ void htp_connp_tx_remove(htp_connp_t *connp, htp_tx_t *tx) { if (connp == NULL) return; if (connp->in_tx == tx) { connp->in_tx = NULL; } if (connp->out_tx == tx) { connp->out_tx = NULL; } } suricata-3.2.1/libhtp/htp/Makefile.am0000644000000000000000000000302313051004451014317 00000000000000 h_sources = bstr.h bstr_builder.h htp.h htp_base64.h htp_config.h htp_connection_parser.h \ htp_core.h htp_decompressors.h htp_hooks.h htp_list.h \ htp_multipart.h htp_table.h htp_transaction.h \ htp_urlencoded.h htp_utf8_decoder.h htp_version.h h_sources_private = htp_config_private.h htp_connection_private.h htp_connection_parser_private.h htp_list_private.h \ htp_multipart_private.h htp_private.h htp_table_private.h htp_config_auto.h c_sources = bstr.c bstr_builder.c htp_base64.c htp_config.c htp_connection.c htp_connection_parser.c \ htp_content_handlers.c htp_cookies.c htp_decompressors.c htp_hooks.c htp_list.c htp_multipart.c htp_parsers.c \ htp_php.c htp_request.c htp_request_apache_2_2.c htp_request_generic.c htp_request_parsers.c htp_response.c \ htp_response_generic.c htp_table.c htp_transaction.c htp_transcoder.c htp_urlencoded.c htp_util.c htp_utf8_decoder.c \ strlcpy.c strlcat.c library_includedir = $(includedir)/$(GENERIC_LIBRARY_NAME) library_include_HEADERS = $(h_sources) AM_CFLAGS = -I$(top_srcdir) -I$(top_builddir)/htp -D_GNU_SOURCE -g -Wall -Wextra -std=gnu99 -pedantic \ -Wextra -Wno-missing-field-initializers -Wshadow -Wpointer-arith \ -Wstrict-prototypes -Wmissing-prototypes -Wno-unused-parameter noinst_LTLIBRARIES = libhtp-c.la libhtp_c_la_SOURCES = $(h_sources) $(h_sources_private) $(c_sources) lib_LTLIBRARIES = libhtp.la libhtp_la_SOURCES = libhtp_la_LIBADD = libhtp-c.la libhtp_la_LDFLAGS = -version-info $(GENERIC_LIBRARY_VERSION) -release $(GENERIC_RELEASE) suricata-3.2.1/libhtp/htp/htp_request_parsers.c0000644000000000000000000001011313051004451016527 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" #if 0 /** * */ int htp_header_parse_internal_strict(unsigned char *data, size_t len, htp_header_t *h) { size_t name_start, name_end; size_t value_start, value_end; // Deal with the name first name_start = name_end = 0; // Find where the header name ends while (name_end < len) { if (htp_is_lws(data[name_end]) || data[name_end] == ':') break; name_end++; } if (name_end == 0) { // Empty header name return -1; } if (name_end == len) { // TODO return -1; } // Is there any LWS before colon? size_t pos = name_end; while (pos < len) { if (!htp_is_lws(data[pos])) break; pos++; // TODO // return -1; } if (pos == len) { // TODO return -1; } // The next character must be a colon if (data[pos] != ':') { // TODO return -1; } // Move over the colon pos++; // Again, ignore any LWS while (pos < len) { if (!htp_is_lws(data[pos])) break; pos++; } if (pos == len) { // TODO return -1; } value_start = value_end = pos; while (value_end < len) { if (htp_is_lws(data[value_end])) break; value_end++; } h->name_offset = name_start; h->name_len = name_end - name_start; h->value_offset = value_start; h->value_len = value_end - value_start; return 1; } */ /** * */ htp_header_t *htp_connp_header_parse(htp_connp_t *reqp, unsigned char *data, size_t len) { htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return NULL; // Parse the header line if (reqp->impl_header_parse(data, len, h) < 0) { // Invalid header line h->is_parsed = 0; h->name = bstr_dup_mem(data, len); return h; } // Now extract the name and the value h->name = bstr_dup_mem(data + h->name_offset, h->name_len); h->value = bstr_dup_mem(data + h->value_offset, h->value_len); h->is_parsed = 1; // Because header names are case-insensitive, we will convert // the name to lowercase to use it as a lookup key. h->name_lowercase = bstr_to_lowercase(h->name); return h; } #endif suricata-3.2.1/libhtp/htp/htp_table_private.h0000644000000000000000000000544013051004451016135 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_TABLE_PRIVATE_H #define HTP_TABLE_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #include "htp_list.h" #include "htp_table.h" enum htp_table_alloc_t { /** This is the default value, used only until the first element is added. */ HTP_TABLE_KEYS_ALLOC_UKNOWN = 0, /** Keys are copied.*/ HTP_TABLE_KEYS_COPIED = 1, /** Keys are adopted and freed when the table is destroyed. */ HTP_TABLE_KEYS_ADOPTED = 2, /** Keys are only referenced; the caller is still responsible for freeing them after the table is destroyed. */ HTP_TABLE_KEYS_REFERENCED = 3 }; struct htp_table_t { /** Table key and value pairs are stored in this list; name first, then value. */ htp_list_t *list; /** * Key management strategy. Initially set to HTP_TABLE_KEYS_ALLOC_UKNOWN. The * actual strategy is determined by the first allocation. */ enum htp_table_alloc_t alloc_type; }; #ifdef __cplusplus } #endif #endif /* HTP_TABLE_PRIVATE_H */ suricata-3.2.1/libhtp/htp/htp_urlencoded.c0000644000000000000000000002666213051004451015444 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * This method is invoked whenever a piece of data, belonging to a single field (name or value) * becomes available. It will either create a new parameter or store the transient information * until a parameter can be created. * * @param[in] urlenp * @param[in] data * @param[in] startpos * @param[in] endpos * @param[in] c Should contain -1 if the reason this function is called is because the end of * the current data chunk is reached. */ static void htp_urlenp_add_field_piece(htp_urlenp_t *urlenp, const unsigned char *data, size_t startpos, size_t endpos, int last_char) { // Add field if we know it ended (last_char is something other than -1) // or if we know that there won't be any more input data (urlenp->_complete is true). if ((last_char != -1) || (urlenp->_complete)) { // Prepare the field value, assembling from multiple pieces as necessary. bstr *field = NULL; // Did we use the string builder for this field? if (bstr_builder_size(urlenp->_bb) > 0) { // The current field consists of more than once piece, we have to use the string builder. // Add current piece to string builder. if ((data != NULL) && (endpos - startpos > 0)) { bstr_builder_append_mem(urlenp->_bb, data + startpos, endpos - startpos); } // Generate the field and clear the string builder. field = bstr_builder_to_str(urlenp->_bb); if (field == NULL) return; bstr_builder_clear(urlenp->_bb); } else { // We only have the current piece to work with, so no need to involve the string builder. if ((data != NULL) && (endpos - startpos > 0)) { field = bstr_dup_mem(data + startpos, endpos - startpos); if (field == NULL) return; } } // Process field as key or value, as appropriate. if (urlenp->_state == HTP_URLENP_STATE_KEY) { // Key. // If there is no more work left to do, then we have a single key. Add it. if ((urlenp->_complete)||(last_char == urlenp->argument_separator)) { // Handling empty pairs is tricky. We don't want to create a pair for // an entirely empty input, but in some cases it may be appropriate // (e.g., /index.php?&q=2). if ((field != NULL)||(last_char == urlenp->argument_separator)) { // Add one pair, with an empty value and possibly empty key too. bstr *name = field; if (name == NULL) { name = bstr_dup_c(""); if (name == NULL) return; } bstr *value = bstr_dup_c(""); if (value == NULL) { bstr_free(name); return; } if (urlenp->decode_url_encoding) { htp_tx_urldecode_params_inplace(urlenp->tx, name); } htp_table_addn(urlenp->params, name, value); urlenp->_name = NULL; #ifdef HTP_DEBUG fprint_raw_data(stderr, "NAME", bstr_ptr(name), bstr_len(name)); fprint_raw_data(stderr, "VALUE", bstr_ptr(value), bstr_len(value)); #endif } } else { // This key will possibly be followed by a value, so keep it for later. urlenp->_name = field; } } else { // Value (with a key remembered from before). bstr *name = urlenp->_name; urlenp->_name = NULL; if (name == NULL) { name = bstr_dup_c(""); if (name == NULL) { bstr_free(field); return; } } bstr *value = field; if (value == NULL) { value = bstr_dup_c(""); if (value == NULL) { bstr_free(name); return; } } if (urlenp->decode_url_encoding) { htp_tx_urldecode_params_inplace(urlenp->tx, name); htp_tx_urldecode_params_inplace(urlenp->tx, value); } htp_table_addn(urlenp->params, name, value); #ifdef HTP_DEBUG fprint_raw_data(stderr, "NAME", bstr_ptr(name), bstr_len(name)); fprint_raw_data(stderr, "VALUE", bstr_ptr(value), bstr_len(value)); #endif } } else { // The field has not ended. We'll make a copy of of the available data for later. if ((data != NULL) && (endpos - startpos > 0)) { bstr_builder_append_mem(urlenp->_bb, data + startpos, endpos - startpos); } } } /** * Creates a new URLENCODED parser. * * @return New parser, or NULL on memory allocation failure. */ htp_urlenp_t *htp_urlenp_create(htp_tx_t *tx) { htp_urlenp_t *urlenp = calloc(1, sizeof (htp_urlenp_t)); if (urlenp == NULL) return NULL; urlenp->tx = tx; urlenp->params = htp_table_create(HTP_URLENP_DEFAULT_PARAMS_SIZE); if (urlenp->params == NULL) { free(urlenp); return NULL; } urlenp->_bb = bstr_builder_create(); if (urlenp->_bb == NULL) { htp_table_destroy(urlenp->params); free(urlenp); return NULL; } urlenp->argument_separator = '&'; urlenp->decode_url_encoding = 1; urlenp->_state = HTP_URLENP_STATE_KEY; return urlenp; } /** * Destroys an existing URLENCODED parser. * * @param[in] urlenp */ void htp_urlenp_destroy(htp_urlenp_t *urlenp) { if (urlenp == NULL) return; if (urlenp->_name != NULL) { bstr_free(urlenp->_name); } bstr_builder_destroy(urlenp->_bb); if (urlenp->params != NULL) { // Destroy parameters. for (size_t i = 0, n = htp_table_size(urlenp->params); i < n; i++) { bstr *b = htp_table_get_index(urlenp->params, i, NULL); // Parameter name will be freed by the table code. bstr_free(b); } htp_table_destroy(urlenp->params); } free(urlenp); } /** * Finalizes parsing, forcing the parser to convert any outstanding * data into parameters. This method should be invoked at the end * of a parsing operation that used htp_urlenp_parse_partial(). * * @param[in] urlenp * @return Success indication */ htp_status_t htp_urlenp_finalize(htp_urlenp_t *urlenp) { urlenp->_complete = 1; return htp_urlenp_parse_partial(urlenp, NULL, 0); } /** * Parses the provided data chunk under the assumption * that it contains all the data that will be parsed. When this * method is used for parsing the finalization method should not * be invoked. * * @param[in] urlenp * @param[in] data * @param[in] len * @return */ htp_status_t htp_urlenp_parse_complete(htp_urlenp_t *urlenp, const void *data, size_t len) { htp_urlenp_parse_partial(urlenp, data, len); return htp_urlenp_finalize(urlenp); } /** * Parses the provided data chunk, keeping state to allow streaming parsing, i.e., the * parsing where only partial information is available at any one time. The method * htp_urlenp_finalize() must be invoked at the end to finalize parsing. * * @param[in] urlenp * @param[in] _data * @param[in] len * @return */ htp_status_t htp_urlenp_parse_partial(htp_urlenp_t *urlenp, const void *_data, size_t len) { unsigned char *data = (unsigned char *) _data; size_t startpos = 0; size_t pos = 0; int c; if (data == NULL) len = 0; do { // Get the next character, or use -1 to indicate end of input. if (pos < len) c = data[pos]; else c = -1; switch (urlenp->_state) { case HTP_URLENP_STATE_KEY: // Look for =, argument separator, or end of input. if ((c == '=') || (c == urlenp->argument_separator) || (c == -1)) { // Data from startpos to pos. htp_urlenp_add_field_piece(urlenp, data, startpos, pos, c); // If it's not the end of input, then it must be the end of this field. if (c != -1) { // Next state. startpos = pos + 1; if (c == urlenp->argument_separator) { urlenp->_state = HTP_URLENP_STATE_KEY; } else { urlenp->_state = HTP_URLENP_STATE_VALUE; } } } pos++; break; case HTP_URLENP_STATE_VALUE: // Look for argument separator or end of input. if ((c == urlenp->argument_separator) || (c == -1)) { // Data from startpos to pos. htp_urlenp_add_field_piece(urlenp, data, startpos, pos, c); // If it's not the end of input, then it must be the end of this field. if (c != -1) { // Next state. startpos = pos + 1; urlenp->_state = HTP_URLENP_STATE_KEY; } } pos++; break; default: // Invalid state. return HTP_ERROR; } } while (c != -1); return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_connection_private.h0000644000000000000000000001000713051004451017200 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CONNECTION_H #define HTP_CONNECTION_H #ifdef __cplusplus extern "C" { #endif /** * Creates a new connection structure. * * @return A new connection structure on success, NULL on memory allocation failure. */ htp_conn_t *htp_conn_create(void); /** * Closes the connection. * * @param[in] conn * @param[in] timestamp */ void htp_conn_close(htp_conn_t *conn, const htp_time_t *timestamp); /** * Destroys a connection, as well as all the transactions it contains. It is * not possible to destroy a connection structure yet leave any of its * transactions intact. This is because transactions need its connection and * connection structures hold little data anyway. The opposite is true, though * it is possible to delete a transaction but leave its connection alive. * * @param[in] conn */ void htp_conn_destroy(htp_conn_t *conn); /** * Opens a connection. This function will essentially only store the provided data * for future reference. The timestamp parameter is optional. * * @param[in] conn * @param[in] remote_addr * @param[in] remote_port * @param[in] local_addr * @param[in] local_port * @param[in] timestamp * @return */ htp_status_t htp_conn_open(htp_conn_t *conn, const char *remote_addr, int remote_port, const char *local_addr, int local_port, const htp_time_t *timestamp); /** * Removes the given transaction structure, which makes it possible to * safely destroy it. It is safe to destroy transactions in this way * because the index of the transactions (in a connection) is preserved. * * @param[in] conn * @param[in] tx * @return HTP_OK if transaction was removed (replaced with NULL) or HTP_ERROR if it wasn't found. */ htp_status_t htp_conn_remove_tx(htp_conn_t *conn, const htp_tx_t *tx); /** * Keeps track of inbound packets and data. * * @param[in] conn * @param[in] len * @param[in] timestamp */ void htp_conn_track_inbound_data(htp_conn_t *conn, size_t len, const htp_time_t *timestamp); /** * Keeps track of outbound packets and data. * * @param[in] conn * @param[in] len * @param[in] timestamp */ void htp_conn_track_outbound_data(htp_conn_t *conn, size_t len, const htp_time_t *timestamp); #ifdef __cplusplus } #endif #endif /* HTP_CONNECTION_H */ suricata-3.2.1/libhtp/htp/htp_request.c0000644000000000000000000010340513051004451014777 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" #define IN_TEST_NEXT_BYTE_OR_RETURN(X) \ if ((X)->in_current_read_offset >= (X)->in_current_len) { \ return HTP_DATA; \ } #define IN_PEEK_NEXT(X) \ if ((X)->in_current_read_offset >= (X)->in_current_len) { \ (X)->in_next_byte = -1; \ } else { \ (X)->in_next_byte = (X)->in_current_data[(X)->in_current_read_offset]; \ } #define IN_NEXT_BYTE(X) \ if ((X)->in_current_read_offset < (X)->in_current_len) { \ (X)->in_next_byte = (X)->in_current_data[(X)->in_current_read_offset]; \ (X)->in_current_read_offset++; \ (X)->in_current_consume_offset++; \ (X)->in_stream_offset++; \ } else { \ (X)->in_next_byte = -1; \ } #define IN_NEXT_BYTE_OR_RETURN(X) \ if ((X)->in_current_read_offset < (X)->in_current_len) { \ (X)->in_next_byte = (X)->in_current_data[(X)->in_current_read_offset]; \ (X)->in_current_read_offset++; \ (X)->in_current_consume_offset++; \ (X)->in_stream_offset++; \ } else { \ return HTP_DATA; \ } #define IN_COPY_BYTE_OR_RETURN(X) \ if ((X)->in_current_read_offset < (X)->in_current_len) { \ (X)->in_next_byte = (X)->in_current_data[(X)->in_current_read_offset]; \ (X)->in_current_read_offset++; \ (X)->in_stream_offset++; \ } else { \ return HTP_DATA_BUFFER; \ } /** * Sends outstanding connection data to the currently active data receiver hook. * * @param[in] connp * @param[in] is_last * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_connp_req_receiver_send_data(htp_connp_t *connp, int is_last) { if (connp->in_data_receiver_hook == NULL) return HTP_OK; htp_tx_data_t d; d.tx = connp->in_tx; d.data = connp->in_current_data + connp->in_current_receiver_offset; d.len = connp->in_current_read_offset - connp->in_current_receiver_offset; d.is_last = is_last; htp_status_t rc = htp_hook_run_all(connp->in_data_receiver_hook, &d); if (rc != HTP_OK) return rc; connp->in_current_receiver_offset = connp->in_current_read_offset; return HTP_OK; } /** * Configures the data receiver hook. If there is a previous hook, it will be finalized and cleared. * * @param[in] connp * @param[in] data_receiver_hook * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_connp_req_receiver_set(htp_connp_t *connp, htp_hook_t *data_receiver_hook) { htp_connp_req_receiver_finalize_clear(connp); connp->in_data_receiver_hook = data_receiver_hook; connp->in_current_receiver_offset = connp->in_current_read_offset; return HTP_OK; } /** * Finalizes an existing data receiver hook by sending any outstanding data to it. The * hook is then removed so that it receives no more data. * * @param[in] connp * @return HTP_OK, or a value returned from a callback. */ htp_status_t htp_connp_req_receiver_finalize_clear(htp_connp_t *connp) { if (connp->in_data_receiver_hook == NULL) return HTP_OK; htp_status_t rc = htp_connp_req_receiver_send_data(connp, 1 /* last */); connp->in_data_receiver_hook = NULL; return rc; } /** * Handles request parser state changes. At the moment, this function is used only * to configure data receivers, which are sent raw connection data. * * @param[in] connp * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_req_handle_state_change(htp_connp_t *connp) { if (connp->in_state_previous == connp->in_state) return HTP_OK; if (connp->in_state == htp_connp_REQ_HEADERS) { htp_status_t rc = HTP_OK; switch (connp->in_tx->request_progress) { case HTP_REQUEST_HEADERS: rc = htp_connp_req_receiver_set(connp, connp->in_tx->cfg->hook_request_header_data); break; case HTP_REQUEST_TRAILER: rc = htp_connp_req_receiver_set(connp, connp->in_tx->cfg->hook_request_trailer_data); break; default: // Do nothing; receivers are currently used only for header blocks. break; } if (rc != HTP_OK) return rc; } // Initially, I had the finalization of raw data sending here, but that // caused the last REQUEST_HEADER_DATA hook to be invoked after the // REQUEST_HEADERS hook -- which I thought made no sense. For that reason, // the finalization is now initiated from the request header processing code, // which is less elegant but provides a better user experience. Having some // (or all) hooks to be invoked on state change might work better. connp->in_state_previous = connp->in_state; return HTP_OK; } /** * If there is any data left in the inbound data chunk, this function will preserve * it for later consumption. The maximum amount accepted for buffering is controlled * by htp_config_t::field_limit_hard. * * @param[in] connp * @return HTP_OK, or HTP_ERROR on fatal failure. */ static htp_status_t htp_connp_req_buffer(htp_connp_t *connp) { if (connp->in_current_data == NULL) return HTP_OK; unsigned char *data = connp->in_current_data + connp->in_current_consume_offset; size_t len = connp->in_current_read_offset - connp->in_current_consume_offset; if (len == 0) return HTP_OK; // Check the hard (buffering) limit. size_t newlen = connp->in_buf_size + len; // When calculating the size of the buffer, take into account the // space we're using for the request header buffer. if (connp->in_header != NULL) { newlen += bstr_len(connp->in_header); } if (newlen > connp->in_tx->cfg->field_limit_hard) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Request buffer over the limit: size %zd limit %zd.", newlen, connp->in_tx->cfg->field_limit_hard); return HTP_ERROR; } // Copy the data remaining in the buffer. if (connp->in_buf == NULL) { connp->in_buf = malloc(len); if (connp->in_buf == NULL) return HTP_ERROR; memcpy(connp->in_buf, data, len); connp->in_buf_size = len; } else { size_t newsize = connp->in_buf_size + len; unsigned char *newbuf = realloc(connp->in_buf, newsize); if (newbuf == NULL) return HTP_ERROR; connp->in_buf = newbuf; memcpy(connp->in_buf + connp->in_buf_size, data, len); connp->in_buf_size = newsize; } // Reset the consumer position. connp->in_current_consume_offset = connp->in_current_read_offset; return HTP_OK; } /** * Returns to the caller the memory region that should be processed next. This function * hides away the buffering process from the rest of the code, allowing it to work with * non-buffered data that's in the inbound chunk, or buffered data that's in our structures. * * @param[in] connp * @param[out] data * @param[out] len * @return HTP_OK */ static htp_status_t htp_connp_req_consolidate_data(htp_connp_t *connp, unsigned char **data, size_t *len) { if (connp->in_buf == NULL) { // We do not have any data buffered; point to the current data chunk. *data = connp->in_current_data + connp->in_current_consume_offset; *len = connp->in_current_read_offset - connp->in_current_consume_offset; } else { // We already have some data in the buffer. Add the data from the current // chunk to it, and point to the consolidated buffer. if (htp_connp_req_buffer(connp) != HTP_OK) { return HTP_ERROR; } *data = connp->in_buf; *len = connp->in_buf_size; } return HTP_OK; } /** * Clears buffered inbound data and resets the consumer position to the reader position. * * @param[in] connp */ static void htp_connp_req_clear_buffer(htp_connp_t *connp) { connp->in_current_consume_offset = connp->in_current_read_offset; if (connp->in_buf != NULL) { free(connp->in_buf); connp->in_buf = NULL; connp->in_buf_size = 0; } } /** * Performs a check for a CONNECT transaction to decide whether inbound * parsing needs to be suspended. * * @param[in] connp * @return HTP_OK if the request does not use CONNECT, HTP_DATA_OTHER if * inbound parsing needs to be suspended until we hear from the * other side */ htp_status_t htp_connp_REQ_CONNECT_CHECK(htp_connp_t *connp) { // If the request uses the CONNECT method, then there will // not be a request body, but first we need to wait to see the // response in order to determine if the tunneling request // was a success. if (connp->in_tx->request_method_number == HTP_M_CONNECT) { connp->in_state = htp_connp_REQ_CONNECT_WAIT_RESPONSE; connp->in_status = HTP_STREAM_DATA_OTHER; return HTP_DATA_OTHER; } // Continue to the next step to determine // the presence of request body connp->in_state = htp_connp_REQ_BODY_DETERMINE; return HTP_OK; } /** * Determines whether inbound parsing needs to continue or stop. In * case the data appears to be plain text HTTP, we try to continue. * * @param[in] connp * @return HTP_OK if the parser can resume parsing, HTP_DATA_BUFFER if * we need more data. */ htp_status_t htp_connp_REQ_CONNECT_PROBE_DATA(htp_connp_t *connp) { for (;;) {//;i < max_read; i++) { IN_PEEK_NEXT(connp); // Have we reached the end of the line? For some reason // we can't test after IN_COPY_BYTE_OR_RETURN */ if (connp->in_next_byte == LF || connp->in_next_byte == 0x00) break; IN_COPY_BYTE_OR_RETURN(connp); } unsigned char *data; size_t len; if (htp_connp_req_consolidate_data(connp, &data, &len) != HTP_OK) { fprintf(stderr, "htp_connp_req_consolidate_data fail"); return HTP_ERROR; } #ifdef HTP_DEBUG fprint_raw_data(stderr, "PROBING", data, len); #endif size_t pos = 0; size_t mstart = 0; // skip past leading whitespace. IIS allows this while ((pos < len) && htp_is_space(data[pos])) pos++; if (pos) mstart = pos; // The request method starts at the beginning of the // line and ends with the first whitespace character. while ((pos < len) && (!htp_is_space(data[pos]))) pos++; int methodi = HTP_M_UNKNOWN; bstr *method = bstr_dup_mem(data + mstart, pos - mstart); if (method) { methodi = htp_convert_method_to_number(method); bstr_free(method); } if (methodi != HTP_M_UNKNOWN) { #ifdef HTP_DEBUG fprint_raw_data(stderr, "htp_connp_REQ_CONNECT_PROBE_DATA: tunnel contains plain text HTTP", data, len); #endif connp->in_state = htp_connp_REQ_IDLE; } else { #ifdef HTP_DEBUG fprint_raw_data(stderr, "htp_connp_REQ_CONNECT_PROBE_DATA: tunnel is not HTTP", data, len); #endif connp->in_status = HTP_STREAM_TUNNEL; connp->out_status = HTP_STREAM_TUNNEL; } // not calling htp_connp_req_clear_buffer, we're not consuming the data return HTP_OK; } /** * Determines whether inbound parsing, which was suspended after * encountering a CONNECT transaction, can proceed (after receiving * the response). * * @param[in] connp * @return HTP_OK if the parser can resume parsing, HTP_DATA_OTHER if * it needs to continue waiting. */ htp_status_t htp_connp_REQ_CONNECT_WAIT_RESPONSE(htp_connp_t *connp) { // Check that we saw the response line of the current inbound transaction. if (connp->in_tx->response_progress <= HTP_RESPONSE_LINE) { return HTP_DATA_OTHER; } // A 2xx response means a tunnel was established. Anything // else means we continue to follow the HTTP stream. if ((connp->in_tx->response_status_number >= 200) && (connp->in_tx->response_status_number <= 299)) { // TODO Check that the server did not accept a connection to itself. // The requested tunnel was established: we are going // to probe the remaining data on this stream to see // if we need to ignore it or parse it connp->in_state = htp_connp_REQ_CONNECT_PROBE_DATA; } else { // No tunnel; continue to the next transaction connp->in_state = htp_connp_REQ_FINALIZE; } return HTP_OK; } /** * Consumes bytes until the end of the current line. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_BODY_CHUNKED_DATA_END(htp_connp_t *connp) { // TODO We shouldn't really see anything apart from CR and LF, // so we should warn about anything else. for (;;) { IN_NEXT_BYTE_OR_RETURN(connp); connp->in_tx->request_message_len++; if (connp->in_next_byte == LF) { connp->in_state = htp_connp_REQ_BODY_CHUNKED_LENGTH; return HTP_OK; } } return HTP_ERROR; } /** * Processes a chunk of data. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_BODY_CHUNKED_DATA(htp_connp_t *connp) { // Determine how many bytes we can consume. size_t bytes_to_consume; if (connp->in_current_len - connp->in_current_read_offset >= connp->in_chunked_length) { // Entire chunk available in the buffer; read all of it. bytes_to_consume = connp->in_chunked_length; } else { // Partial chunk available in the buffer; read as much as we can. bytes_to_consume = connp->in_current_len - connp->in_current_read_offset; } #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_REQ_BODY_CHUNKED_DATA Consuming %zd bytes\n", bytes_to_consume); #endif // If the input buffer is empty, ask for more data. if (bytes_to_consume == 0) return HTP_DATA; // Consume the data. htp_status_t rc = htp_tx_req_process_body_data_ex(connp->in_tx, connp->in_current_data + connp->in_current_read_offset, bytes_to_consume); if (rc != HTP_OK) return rc; // Adjust counters. connp->in_current_read_offset += bytes_to_consume; connp->in_current_consume_offset += bytes_to_consume; connp->in_stream_offset += bytes_to_consume; connp->in_tx->request_message_len += bytes_to_consume; connp->in_chunked_length -= bytes_to_consume; if (connp->in_chunked_length == 0) { // End of the chunk. connp->in_state = htp_connp_REQ_BODY_CHUNKED_DATA_END; return HTP_OK; } // Ask for more data. return HTP_DATA; } /** * Extracts chunk length. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_BODY_CHUNKED_LENGTH(htp_connp_t *connp) { for (;;) { IN_COPY_BYTE_OR_RETURN(connp); // Have we reached the end of the line? if (connp->in_next_byte == LF) { unsigned char *data; size_t len; if (htp_connp_req_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } connp->in_tx->request_message_len += len; #ifdef HTP_DEBUG fprint_raw_data(stderr, "Chunk length line", data, len); #endif htp_chomp(data, &len); connp->in_chunked_length = htp_parse_chunked_length(data, len); htp_connp_req_clear_buffer(connp); // Handle chunk length. if (connp->in_chunked_length > 0) { // More data available. connp->in_state = htp_connp_REQ_BODY_CHUNKED_DATA; } else if (connp->in_chunked_length == 0) { // End of data. connp->in_state = htp_connp_REQ_HEADERS; connp->in_tx->request_progress = HTP_REQUEST_TRAILER; } else { // Invalid chunk length. htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Request chunk encoding: Invalid chunk length"); return HTP_ERROR; } return HTP_OK; } } return HTP_ERROR; } /** * Processes identity request body. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_BODY_IDENTITY(htp_connp_t *connp) { // Determine how many bytes we can consume. size_t bytes_to_consume; if (connp->in_current_len - connp->in_current_read_offset >= connp->in_body_data_left) { bytes_to_consume = connp->in_body_data_left; } else { bytes_to_consume = connp->in_current_len - connp->in_current_read_offset; } // If the input buffer is empty, ask for more data. if (bytes_to_consume == 0) return HTP_DATA; // Consume data. int rc = htp_tx_req_process_body_data_ex(connp->in_tx, connp->in_current_data + connp->in_current_read_offset, bytes_to_consume); if (rc != HTP_OK) return rc; // Adjust counters. connp->in_current_read_offset += bytes_to_consume; connp->in_current_consume_offset += bytes_to_consume; connp->in_stream_offset += bytes_to_consume; connp->in_tx->request_message_len += bytes_to_consume; connp->in_body_data_left -= bytes_to_consume; if (connp->in_body_data_left == 0) { // End of request body. connp->in_state = htp_connp_REQ_FINALIZE; return HTP_OK; } // Ask for more data. return HTP_DATA; } /** * Determines presence (and encoding) of a request body. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_BODY_DETERMINE(htp_connp_t *connp) { // Determine the next state based on the presence of the request // body, and the coding used. switch (connp->in_tx->request_transfer_coding) { case HTP_CODING_CHUNKED: connp->in_state = htp_connp_REQ_BODY_CHUNKED_LENGTH; connp->in_tx->request_progress = HTP_REQUEST_BODY; break; case HTP_CODING_IDENTITY: connp->in_content_length = connp->in_tx->request_content_length; connp->in_body_data_left = connp->in_content_length; if (connp->in_content_length != 0) { connp->in_state = htp_connp_REQ_BODY_IDENTITY; connp->in_tx->request_progress = HTP_REQUEST_BODY; } else { connp->in_tx->connp->in_state = htp_connp_REQ_FINALIZE; } break; case HTP_CODING_NO_BODY: // This request does not have a body, which // means that we're done with it connp->in_state = htp_connp_REQ_FINALIZE; break; default: // Should not be here return HTP_ERROR; break; } return HTP_OK; } /** * Parses request headers. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_HEADERS(htp_connp_t *connp) { for (;;) { IN_COPY_BYTE_OR_RETURN(connp); // Have we reached the end of the line? if (connp->in_next_byte == LF) { unsigned char *data; size_t len; if (htp_connp_req_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, data, len); #endif // Should we terminate headers? if (htp_connp_is_line_terminator(connp, data, len)) { // Parse previous header, if any. if (connp->in_header != NULL) { if (connp->cfg->process_request_header(connp, bstr_ptr(connp->in_header), bstr_len(connp->in_header)) != HTP_OK) return HTP_ERROR; bstr_free(connp->in_header); connp->in_header = NULL; } htp_connp_req_clear_buffer(connp); // We've seen all the request headers. return htp_tx_state_request_headers(connp->in_tx); } htp_chomp(data, &len); // Check for header folding. if (htp_connp_is_line_folded(data, len) == 0) { // New header line. // Parse previous header, if any. if (connp->in_header != NULL) { if (connp->cfg->process_request_header(connp, bstr_ptr(connp->in_header), bstr_len(connp->in_header)) != HTP_OK) return HTP_ERROR; bstr_free(connp->in_header); connp->in_header = NULL; } IN_PEEK_NEXT(connp); if (htp_is_folding_char(connp->in_next_byte) == 0) { // Because we know this header is not folded, we can process the buffer straight away. if (connp->cfg->process_request_header(connp, data, len) != HTP_OK) return HTP_ERROR; } else { // Keep the partial header data for parsing later. connp->in_header = bstr_dup_mem(data, len); if (connp->in_header == NULL) return HTP_ERROR; } } else { // Folding; check that there's a previous header line to add to. if (connp->in_header == NULL) { // Invalid folding. // Warn only once per transaction. if (!(connp->in_tx->flags & HTP_INVALID_FOLDING)) { connp->in_tx->flags |= HTP_INVALID_FOLDING; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Invalid request field folding"); } // Keep the header data for parsing later. connp->in_header = bstr_dup_mem(data, len); if (connp->in_header == NULL) return HTP_ERROR; } else { // Add to the existing header. bstr *new_in_header = bstr_add_mem(connp->in_header, data, len); if (new_in_header == NULL) return HTP_ERROR; connp->in_header = new_in_header; } } htp_connp_req_clear_buffer(connp); } } return HTP_ERROR; } /** * Determines request protocol. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_PROTOCOL(htp_connp_t *connp) { // Is this a short-style HTTP/0.9 request? If it is, // we will not want to parse request headers. if (connp->in_tx->is_protocol_0_9 == 0) { // Switch to request header parsing. connp->in_state = htp_connp_REQ_HEADERS; connp->in_tx->request_progress = HTP_REQUEST_HEADERS; } else { // We're done with this request. connp->in_state = htp_connp_REQ_FINALIZE; } return HTP_OK; } /** * Parse the request line. * * @param[in] connp * @returns HTP_OK on succesful parse, HTP_ERROR on error. */ htp_status_t htp_connp_REQ_LINE_complete(htp_connp_t *connp) { unsigned char *data; size_t len; if (htp_connp_req_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, data, len); #endif // Is this a line that should be ignored? if (htp_connp_is_line_ignorable(connp, data, len)) { // We have an empty/whitespace line, which we'll note, ignore and move on. connp->in_tx->request_ignored_lines++; htp_connp_req_clear_buffer(connp); return HTP_OK; } // Process request line. htp_chomp(data, &len); connp->in_tx->request_line = bstr_dup_mem(data, len); if (connp->in_tx->request_line == NULL) return HTP_ERROR; if (connp->cfg->parse_request_line(connp) != HTP_OK) return HTP_ERROR; // Finalize request line parsing. if (htp_tx_state_request_line(connp->in_tx) != HTP_OK) return HTP_ERROR; htp_connp_req_clear_buffer(connp); return HTP_OK; } /** * Parses request line. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_LINE(htp_connp_t *connp) { for (;;) { // Get one byte IN_COPY_BYTE_OR_RETURN(connp); // Have we reached the end of the line? if (connp->in_next_byte == LF) { return htp_connp_REQ_LINE_complete(connp); } } return HTP_ERROR; } htp_status_t htp_connp_REQ_FINALIZE(htp_connp_t *connp) { return htp_tx_state_request_complete(connp->in_tx); } htp_status_t htp_connp_REQ_IGNORE_DATA_AFTER_HTTP_0_9(htp_connp_t *connp) { // Consume whatever is left in the buffer. size_t bytes_left = connp->in_current_len - connp->in_current_read_offset; if (bytes_left > 0) { connp->conn->flags |= HTP_CONN_HTTP_0_9_EXTRA; } connp->in_current_read_offset += bytes_left; connp->in_current_consume_offset += bytes_left; connp->in_stream_offset += bytes_left; return HTP_DATA; } /** * The idle state is where the parser will end up after a transaction is processed. * If there is more data available, a new request will be started. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_REQ_IDLE(htp_connp_t * connp) { // We want to start parsing the next request (and change // the state from IDLE) only if there's at least one // byte of data available. Otherwise we could be creating // new structures even if there's no more data on the // connection. IN_TEST_NEXT_BYTE_OR_RETURN(connp); connp->in_tx = htp_connp_tx_create(connp); if (connp->in_tx == NULL) return HTP_ERROR; // Change state to TRANSACTION_START htp_tx_state_request_start(connp->in_tx); return HTP_OK; } /** * Returns how many bytes from the current data chunks were consumed so far. * * @param[in] connp * @return The number of bytes consumed. */ size_t htp_connp_req_data_consumed(htp_connp_t *connp) { return connp->in_current_read_offset; } int htp_connp_req_data(htp_connp_t *connp, const htp_time_t *timestamp, const void *data, size_t len) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data(connp->in_status %x)\n", connp->in_status); fprint_raw_data(stderr, __func__, data, len); #endif // Return if the connection is in stop state. if (connp->in_status == HTP_STREAM_STOP) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_INFO, 0, "Inbound parser is in HTP_STREAM_STOP"); return HTP_STREAM_STOP; } // Return if the connection had a fatal error earlier if (connp->in_status == HTP_STREAM_ERROR) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Inbound parser is in HTP_STREAM_ERROR"); #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_DATA (previous error)\n"); #endif return HTP_STREAM_ERROR; } // Sanity check: we must have a transaction pointer if the state is not IDLE (no inbound transaction) if ((connp->in_tx == NULL)&&(connp->in_state != htp_connp_REQ_IDLE)) { connp->in_status = HTP_STREAM_ERROR; htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Missing inbound transaction data"); return HTP_STREAM_ERROR; } // If the length of the supplied data chunk is zero, proceed // only if the stream has been closed. We do not allow zero-sized // chunks in the API, but we use them internally to force the parsers // to finalize parsing. if (((data == NULL) || (len == 0)) && (connp->in_status != HTP_STREAM_CLOSED)) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Zero-length data chunks are not allowed"); #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_DATA (zero-length chunk)\n"); #endif return HTP_STREAM_CLOSED; } // Remember the timestamp of the current request data chunk if (timestamp != NULL) { memcpy(&connp->in_timestamp, timestamp, sizeof (*timestamp)); } // Store the current chunk information connp->in_current_data = (unsigned char *) data; connp->in_current_len = len; connp->in_current_read_offset = 0; connp->in_current_consume_offset = 0; connp->in_current_receiver_offset = 0; connp->in_chunk_count++; htp_conn_track_inbound_data(connp->conn, len, timestamp); // Return without processing any data if the stream is in tunneling // mode (which it would be after an initial CONNECT transaction). if (connp->in_status == HTP_STREAM_TUNNEL) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_TUNNEL\n"); #endif return HTP_STREAM_TUNNEL; } if (connp->out_status == HTP_STREAM_DATA_OTHER) { connp->out_status = HTP_STREAM_DATA; } // Invoke a processor, in a loop, until an error // occurs or until we run out of data. Many processors // will process a request, each pointing to the next // processor that needs to run. for (;;) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: in state=%s, progress=%s\n", htp_connp_in_state_as_string(connp), htp_tx_request_progress_as_string(connp->in_tx)); #endif // Return if there's been an error or if we've run out of data. We are relying // on processors to supply error messages, so we'll keep quiet here. htp_status_t rc = connp->in_state(connp); if (rc == HTP_OK) { if (connp->in_status == HTP_STREAM_TUNNEL) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_TUNNEL\n"); #endif return HTP_STREAM_TUNNEL; } rc = htp_req_handle_state_change(connp); } if (rc != HTP_OK) { // Do we need more data? if ((rc == HTP_DATA) || (rc == HTP_DATA_BUFFER)) { htp_connp_req_receiver_send_data(connp, 0 /* not last */); if (rc == HTP_DATA_BUFFER) { if (htp_connp_req_buffer(connp) != HTP_OK) { connp->in_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } } #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_DATA\n"); #endif connp->in_status = HTP_STREAM_DATA; return HTP_STREAM_DATA; } // Check for suspended parsing. if (rc == HTP_DATA_OTHER) { // We might have actually consumed the entire data chunk? if (connp->in_current_read_offset >= connp->in_current_len) { // Do not send STREAM_DATE_DATA_OTHER if we've consumed the entire chunk. #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_DATA (suspended parsing)\n"); #endif connp->in_status = HTP_STREAM_DATA; return HTP_STREAM_DATA; } else { // Partial chunk consumption. #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_DATA_OTHER\n"); #endif connp->in_status = HTP_STREAM_DATA_OTHER; return HTP_STREAM_DATA_OTHER; } } // Check for the stop signal. if (rc == HTP_STOP) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_STOP\n"); #endif connp->in_status = HTP_STREAM_STOP; return HTP_STREAM_STOP; } #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_req_data: returning HTP_STREAM_ERROR\n"); #endif // Permanent stream error. connp->in_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } } // Permanent stream error. connp->in_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } suricata-3.2.1/libhtp/htp/htp_utf8_decoder.h0000644000000000000000000000711713051004451015672 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ /* LibHTP changes: * * - Changed the name of the function from "decode" to "utf8_decode" * - Created a separate header file * - Copied the license from the web page * - Created a copy of the data and function "utf8_decode_allow_overlong", which * does not treat overlong characters as invalid. */ /* Copyright (c) 2008-2009 Bjoern Hoehrmann Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #ifndef _UTF8_DECODER_H #define _UTF8_DECODER_H #ifdef __cplusplus extern "C" { #endif #include #define HTP_UTF8_ACCEPT 0 #define HTP_UTF8_REJECT 1 uint32_t htp_utf8_decode(uint32_t* state, uint32_t* codep, uint32_t byte); uint32_t htp_utf8_decode_allow_overlong(uint32_t* state, uint32_t* codep, uint32_t byte); #ifdef __cplusplus } #endif #endif /* _UTF8_DECODER_H */ suricata-3.2.1/libhtp/htp/htp_hooks.h0000644000000000000000000001001013051004451014424 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HOOKS_H #define _HOOKS_H #ifdef __cplusplus extern "C" { #endif typedef struct htp_hook_t htp_hook_t; typedef struct htp_callback_t htp_callback_t; typedef int (*htp_callback_fn_t) (void *); #include "htp.h" struct htp_hook_t { htp_list_array_t *callbacks; }; struct htp_callback_t { htp_callback_fn_t fn; }; /** * Creates a copy of the provided hook. The hook is allowed to be NULL, * in which case this function simply returns a NULL. * * @param[in] hook * @return A copy of the hook, or NULL (if the provided hook was NULL * or, if it wasn't, if there was a memory allocation problem while * constructing a copy). */ htp_hook_t *htp_hook_copy(const htp_hook_t *hook); /** * Creates a new hook. * * @return New htp_hook_t structure on success, NULL on failure. */ htp_hook_t *htp_hook_create(void); /** * Destroys an existing hook. It is all right to send a NULL * to this method because it will simply return straight away. * * @param[in] hook */ void htp_hook_destroy(htp_hook_t *hook); /** * Registers a new callback with the hook. * * @param[in] hook * @param[in] callback_fn * @return HTP_OK on success, HTP_ERROR on memory allocation error. */ htp_status_t htp_hook_register(htp_hook_t **hook, const htp_callback_fn_t callback_fn); /** * Runs all the callbacks associated with a given hook. Only stops if * one of the callbacks returns an error (HTP_ERROR) or stop (HTP_STOP). * * @param[in] hook * @param[in] user_data * @return HTP_OK if at least one hook ran successfully, HTP_STOP if there was * no error but processing should stop, and HTP_ERROR or any other value * less than zero on error. */ htp_status_t htp_hook_run_all(htp_hook_t *hook, void *user_data); /** * Run callbacks one by one until one of them accepts to service the hook. * * @param[in] hook * @param[in] user_data * @return HTP_OK if a hook was found to process the callback, HTP_DECLINED if * no hook could be found, HTP_STOP if a hook signalled the processing * to stop, and HTP_ERROR or any other value less than zero on error. */ htp_status_t htp_hook_run_one(htp_hook_t *hook, void *user_data); #ifdef __cplusplus } #endif #endif /* _HOOKS_H */ suricata-3.2.1/libhtp/htp/htp_list.h0000644000000000000000000001332613051004451014271 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_LIST_H #define HTP_LIST_H #ifdef __cplusplus extern "C" { #endif // The default list implementation is array-based. The // linked list version is not fully implemented yet. #define htp_list_t htp_list_array_t #define htp_list_add htp_list_array_push #define htp_list_create htp_list_array_create #define htp_list_clear htp_list_array_clear #define htp_list_destroy htp_list_array_destroy #define htp_list_get htp_list_array_get #define htp_list_pop htp_list_array_pop #define htp_list_push htp_list_array_push #define htp_list_replace htp_list_array_replace #define htp_list_size htp_list_array_size #define htp_list_shift htp_list_array_shift // Data structures typedef struct htp_list_array_t htp_list_array_t; typedef struct htp_list_linked_t htp_list_linked_t; #include "htp_core.h" #include "bstr.h" // Functions /** * Create new array-backed list. * * @param[in] size * @return Newly created list. */ htp_list_array_t *htp_list_array_create(size_t size); /** * Remove all elements from the list. It is the responsibility of the caller * to iterate over list elements and deallocate them if necessary, prior to * invoking this function. * * @param[in] l */ void htp_list_array_clear(htp_list_array_t *l); /** * Free the memory occupied by this list. This function assumes * the elements held by the list were freed beforehand. * * @param[in] l */ void htp_list_array_destroy(htp_list_array_t *l); /** * Find the element at the given index. * * @param[in] l * @param[in] idx * @return the desired element, or NULL if the list is too small, or * if the element at that position carries a NULL */ void *htp_list_array_get(const htp_list_array_t *l, size_t idx); /** * Remove one element from the end of the list. * * @param[in] l * @return The removed element, or NULL if the list is empty. */ void *htp_list_array_pop(htp_list_array_t *l); /** * Add new element to the end of the list, expanding the list as necessary. * * @param[in] l * @param[in] e * @return HTP_OK on success or HTP_ERROR on failure. * */ htp_status_t htp_list_array_push(htp_list_array_t *l, void *e); /** * Replace the element at the given index with the provided element. * * @param[in] l * @param[in] idx * @param[in] e * * @return HTP_OK if an element with the given index was replaced; HTP_ERROR * if the desired index does not exist. */ htp_status_t htp_list_array_replace(htp_list_array_t *l, size_t idx, void *e); /** * Returns the size of the list. * * @param[in] l * @return List size. */ size_t htp_list_array_size(const htp_list_array_t *l); /** * Remove one element from the beginning of the list. * * @param[in] l * @return The removed element, or NULL if the list is empty. */ void *htp_list_array_shift(htp_list_array_t *l); // Linked list /** * Create a new linked list. * * @return The newly created list, or NULL on memory allocation failure */ htp_list_linked_t *htp_list_linked_create(void); /** * Destroy list. This function will not destroy any of the * data stored in it. You'll have to do that manually beforehand. * * @param[in] l */ void htp_list_linked_destroy(htp_list_linked_t *l); /** * Is the list empty? * * @param[in] l * @return 1 if the list is empty, 0 if it is not */ int htp_list_linked_empty(const htp_list_linked_t *l); /** * Remove one element from the end of the list. * * @param[in] l * @return Pointer to the removed element, or NULL if the list is empty. */ void *htp_list_linked_pop(htp_list_linked_t *l); /** * Add element to list. * * @param[in] l * @param[in] e * @return HTP_OK on success, HTP_ERROR on error. */ htp_status_t htp_list_linked_push(htp_list_linked_t *l, void *e); /** * Remove one element from the beginning of the list. * * @param[in] l * @return Pointer to the removed element, or NULL if the list is empty. */ void *htp_list_linked_shift(htp_list_linked_t *l); #ifdef __cplusplus } #endif #endif /* HTP_LIST_H */ suricata-3.2.1/libhtp/htp/htp_config.c0000644000000000000000000011375113051004451014561 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * This map is used by default for best-fit mapping from the Unicode * values U+0100-FFFF. */ static unsigned char bestfit_1252[] = { 0x01, 0x00, 0x41, 0x01, 0x01, 0x61, 0x01, 0x02, 0x41, 0x01, 0x03, 0x61, 0x01, 0x04, 0x41, 0x01, 0x05, 0x61, 0x01, 0x06, 0x43, 0x01, 0x07, 0x63, 0x01, 0x08, 0x43, 0x01, 0x09, 0x63, 0x01, 0x0a, 0x43, 0x01, 0x0b, 0x63, 0x01, 0x0c, 0x43, 0x01, 0x0d, 0x63, 0x01, 0x0e, 0x44, 0x01, 0x0f, 0x64, 0x01, 0x11, 0x64, 0x01, 0x12, 0x45, 0x01, 0x13, 0x65, 0x01, 0x14, 0x45, 0x01, 0x15, 0x65, 0x01, 0x16, 0x45, 0x01, 0x17, 0x65, 0x01, 0x18, 0x45, 0x01, 0x19, 0x65, 0x01, 0x1a, 0x45, 0x01, 0x1b, 0x65, 0x01, 0x1c, 0x47, 0x01, 0x1d, 0x67, 0x01, 0x1e, 0x47, 0x01, 0x1f, 0x67, 0x01, 0x20, 0x47, 0x01, 0x21, 0x67, 0x01, 0x22, 0x47, 0x01, 0x23, 0x67, 0x01, 0x24, 0x48, 0x01, 0x25, 0x68, 0x01, 0x26, 0x48, 0x01, 0x27, 0x68, 0x01, 0x28, 0x49, 0x01, 0x29, 0x69, 0x01, 0x2a, 0x49, 0x01, 0x2b, 0x69, 0x01, 0x2c, 0x49, 0x01, 0x2d, 0x69, 0x01, 0x2e, 0x49, 0x01, 0x2f, 0x69, 0x01, 0x30, 0x49, 0x01, 0x31, 0x69, 0x01, 0x34, 0x4a, 0x01, 0x35, 0x6a, 0x01, 0x36, 0x4b, 0x01, 0x37, 0x6b, 0x01, 0x39, 0x4c, 0x01, 0x3a, 0x6c, 0x01, 0x3b, 0x4c, 0x01, 0x3c, 0x6c, 0x01, 0x3d, 0x4c, 0x01, 0x3e, 0x6c, 0x01, 0x41, 0x4c, 0x01, 0x42, 0x6c, 0x01, 0x43, 0x4e, 0x01, 0x44, 0x6e, 0x01, 0x45, 0x4e, 0x01, 0x46, 0x6e, 0x01, 0x47, 0x4e, 0x01, 0x48, 0x6e, 0x01, 0x4c, 0x4f, 0x01, 0x4d, 0x6f, 0x01, 0x4e, 0x4f, 0x01, 0x4f, 0x6f, 0x01, 0x50, 0x4f, 0x01, 0x51, 0x6f, 0x01, 0x54, 0x52, 0x01, 0x55, 0x72, 0x01, 0x56, 0x52, 0x01, 0x57, 0x72, 0x01, 0x58, 0x52, 0x01, 0x59, 0x72, 0x01, 0x5a, 0x53, 0x01, 0x5b, 0x73, 0x01, 0x5c, 0x53, 0x01, 0x5d, 0x73, 0x01, 0x5e, 0x53, 0x01, 0x5f, 0x73, 0x01, 0x62, 0x54, 0x01, 0x63, 0x74, 0x01, 0x64, 0x54, 0x01, 0x65, 0x74, 0x01, 0x66, 0x54, 0x01, 0x67, 0x74, 0x01, 0x68, 0x55, 0x01, 0x69, 0x75, 0x01, 0x6a, 0x55, 0x01, 0x6b, 0x75, 0x01, 0x6c, 0x55, 0x01, 0x6d, 0x75, 0x01, 0x6e, 0x55, 0x01, 0x6f, 0x75, 0x01, 0x70, 0x55, 0x01, 0x71, 0x75, 0x01, 0x72, 0x55, 0x01, 0x73, 0x75, 0x01, 0x74, 0x57, 0x01, 0x75, 0x77, 0x01, 0x76, 0x59, 0x01, 0x77, 0x79, 0x01, 0x79, 0x5a, 0x01, 0x7b, 0x5a, 0x01, 0x7c, 0x7a, 0x01, 0x80, 0x62, 0x01, 0x97, 0x49, 0x01, 0x9a, 0x6c, 0x01, 0x9f, 0x4f, 0x01, 0xa0, 0x4f, 0x01, 0xa1, 0x6f, 0x01, 0xab, 0x74, 0x01, 0xae, 0x54, 0x01, 0xaf, 0x55, 0x01, 0xb0, 0x75, 0x01, 0xb6, 0x7a, 0x01, 0xc0, 0x7c, 0x01, 0xc3, 0x21, 0x01, 0xcd, 0x41, 0x01, 0xce, 0x61, 0x01, 0xcf, 0x49, 0x01, 0xd0, 0x69, 0x01, 0xd1, 0x4f, 0x01, 0xd2, 0x6f, 0x01, 0xd3, 0x55, 0x01, 0xd4, 0x75, 0x01, 0xd5, 0x55, 0x01, 0xd6, 0x75, 0x01, 0xd7, 0x55, 0x01, 0xd8, 0x75, 0x01, 0xd9, 0x55, 0x01, 0xda, 0x75, 0x01, 0xdb, 0x55, 0x01, 0xdc, 0x75, 0x01, 0xde, 0x41, 0x01, 0xdf, 0x61, 0x01, 0xe4, 0x47, 0x01, 0xe5, 0x67, 0x01, 0xe6, 0x47, 0x01, 0xe7, 0x67, 0x01, 0xe8, 0x4b, 0x01, 0xe9, 0x6b, 0x01, 0xea, 0x4f, 0x01, 0xeb, 0x6f, 0x01, 0xec, 0x4f, 0x01, 0xed, 0x6f, 0x01, 0xf0, 0x6a, 0x02, 0x61, 0x67, 0x02, 0xb9, 0x27, 0x02, 0xba, 0x22, 0x02, 0xbc, 0x27, 0x02, 0xc4, 0x5e, 0x02, 0xc8, 0x27, 0x02, 0xcb, 0x60, 0x02, 0xcd, 0x5f, 0x03, 0x00, 0x60, 0x03, 0x02, 0x5e, 0x03, 0x03, 0x7e, 0x03, 0x0e, 0x22, 0x03, 0x31, 0x5f, 0x03, 0x32, 0x5f, 0x03, 0x7e, 0x3b, 0x03, 0x93, 0x47, 0x03, 0x98, 0x54, 0x03, 0xa3, 0x53, 0x03, 0xa6, 0x46, 0x03, 0xa9, 0x4f, 0x03, 0xb1, 0x61, 0x03, 0xb4, 0x64, 0x03, 0xb5, 0x65, 0x03, 0xc0, 0x70, 0x03, 0xc3, 0x73, 0x03, 0xc4, 0x74, 0x03, 0xc6, 0x66, 0x04, 0xbb, 0x68, 0x05, 0x89, 0x3a, 0x06, 0x6a, 0x25, 0x20, 0x00, 0x20, 0x20, 0x01, 0x20, 0x20, 0x02, 0x20, 0x20, 0x03, 0x20, 0x20, 0x04, 0x20, 0x20, 0x05, 0x20, 0x20, 0x06, 0x20, 0x20, 0x10, 0x2d, 0x20, 0x11, 0x2d, 0x20, 0x17, 0x3d, 0x20, 0x32, 0x27, 0x20, 0x35, 0x60, 0x20, 0x44, 0x2f, 0x20, 0x74, 0x34, 0x20, 0x75, 0x35, 0x20, 0x76, 0x36, 0x20, 0x77, 0x37, 0x20, 0x78, 0x38, 0x20, 0x7f, 0x6e, 0x20, 0x80, 0x30, 0x20, 0x81, 0x31, 0x20, 0x82, 0x32, 0x20, 0x83, 0x33, 0x20, 0x84, 0x34, 0x20, 0x85, 0x35, 0x20, 0x86, 0x36, 0x20, 0x87, 0x37, 0x20, 0x88, 0x38, 0x20, 0x89, 0x39, 0x20, 0xa7, 0x50, 0x21, 0x02, 0x43, 0x21, 0x07, 0x45, 0x21, 0x0a, 0x67, 0x21, 0x0b, 0x48, 0x21, 0x0c, 0x48, 0x21, 0x0d, 0x48, 0x21, 0x0e, 0x68, 0x21, 0x10, 0x49, 0x21, 0x11, 0x49, 0x21, 0x12, 0x4c, 0x21, 0x13, 0x6c, 0x21, 0x15, 0x4e, 0x21, 0x18, 0x50, 0x21, 0x19, 0x50, 0x21, 0x1a, 0x51, 0x21, 0x1b, 0x52, 0x21, 0x1c, 0x52, 0x21, 0x1d, 0x52, 0x21, 0x24, 0x5a, 0x21, 0x28, 0x5a, 0x21, 0x2a, 0x4b, 0x21, 0x2c, 0x42, 0x21, 0x2d, 0x43, 0x21, 0x2e, 0x65, 0x21, 0x2f, 0x65, 0x21, 0x30, 0x45, 0x21, 0x31, 0x46, 0x21, 0x33, 0x4d, 0x21, 0x34, 0x6f, 0x22, 0x12, 0x2d, 0x22, 0x15, 0x2f, 0x22, 0x16, 0x5c, 0x22, 0x17, 0x2a, 0x22, 0x1a, 0x76, 0x22, 0x1e, 0x38, 0x22, 0x23, 0x7c, 0x22, 0x29, 0x6e, 0x22, 0x36, 0x3a, 0x22, 0x3c, 0x7e, 0x22, 0x61, 0x3d, 0x22, 0x64, 0x3d, 0x22, 0x65, 0x3d, 0x23, 0x03, 0x5e, 0x23, 0x20, 0x28, 0x23, 0x21, 0x29, 0x23, 0x29, 0x3c, 0x23, 0x2a, 0x3e, 0x25, 0x00, 0x2d, 0x25, 0x0c, 0x2b, 0x25, 0x10, 0x2b, 0x25, 0x14, 0x2b, 0x25, 0x18, 0x2b, 0x25, 0x1c, 0x2b, 0x25, 0x2c, 0x2d, 0x25, 0x34, 0x2d, 0x25, 0x3c, 0x2b, 0x25, 0x50, 0x2d, 0x25, 0x52, 0x2b, 0x25, 0x53, 0x2b, 0x25, 0x54, 0x2b, 0x25, 0x55, 0x2b, 0x25, 0x56, 0x2b, 0x25, 0x57, 0x2b, 0x25, 0x58, 0x2b, 0x25, 0x59, 0x2b, 0x25, 0x5a, 0x2b, 0x25, 0x5b, 0x2b, 0x25, 0x5c, 0x2b, 0x25, 0x5d, 0x2b, 0x25, 0x64, 0x2d, 0x25, 0x65, 0x2d, 0x25, 0x66, 0x2d, 0x25, 0x67, 0x2d, 0x25, 0x68, 0x2d, 0x25, 0x69, 0x2d, 0x25, 0x6a, 0x2b, 0x25, 0x6b, 0x2b, 0x25, 0x6c, 0x2b, 0x25, 0x84, 0x5f, 0x27, 0x58, 0x7c, 0x30, 0x00, 0x20, 0x30, 0x08, 0x3c, 0x30, 0x09, 0x3e, 0x30, 0x1a, 0x5b, 0x30, 0x1b, 0x5d, 0xff, 0x01, 0x21, 0xff, 0x02, 0x22, 0xff, 0x03, 0x23, 0xff, 0x04, 0x24, 0xff, 0x05, 0x25, 0xff, 0x06, 0x26, 0xff, 0x07, 0x27, 0xff, 0x08, 0x28, 0xff, 0x09, 0x29, 0xff, 0x0a, 0x2a, 0xff, 0x0b, 0x2b, 0xff, 0x0c, 0x2c, 0xff, 0x0d, 0x2d, 0xff, 0x0e, 0x2e, 0xff, 0x0f, 0x2f, 0xff, 0x10, 0x30, 0xff, 0x11, 0x31, 0xff, 0x12, 0x32, 0xff, 0x13, 0x33, 0xff, 0x14, 0x34, 0xff, 0x15, 0x35, 0xff, 0x16, 0x36, 0xff, 0x17, 0x37, 0xff, 0x18, 0x38, 0xff, 0x19, 0x39, 0xff, 0x1a, 0x3a, 0xff, 0x1b, 0x3b, 0xff, 0x1c, 0x3c, 0xff, 0x1d, 0x3d, 0xff, 0x1e, 0x3e, 0xff, 0x20, 0x40, 0xff, 0x21, 0x41, 0xff, 0x22, 0x42, 0xff, 0x23, 0x43, 0xff, 0x24, 0x44, 0xff, 0x25, 0x45, 0xff, 0x26, 0x46, 0xff, 0x27, 0x47, 0xff, 0x28, 0x48, 0xff, 0x29, 0x49, 0xff, 0x2a, 0x4a, 0xff, 0x2b, 0x4b, 0xff, 0x2c, 0x4c, 0xff, 0x2d, 0x4d, 0xff, 0x2e, 0x4e, 0xff, 0x2f, 0x4f, 0xff, 0x30, 0x50, 0xff, 0x31, 0x51, 0xff, 0x32, 0x52, 0xff, 0x33, 0x53, 0xff, 0x34, 0x54, 0xff, 0x35, 0x55, 0xff, 0x36, 0x56, 0xff, 0x37, 0x57, 0xff, 0x38, 0x58, 0xff, 0x39, 0x59, 0xff, 0x3a, 0x5a, 0xff, 0x3b, 0x5b, 0xff, 0x3c, 0x5c, 0xff, 0x3d, 0x5d, 0xff, 0x3e, 0x5e, 0xff, 0x3f, 0x5f, 0xff, 0x40, 0x60, 0xff, 0x41, 0x61, 0xff, 0x42, 0x62, 0xff, 0x43, 0x63, 0xff, 0x44, 0x64, 0xff, 0x45, 0x65, 0xff, 0x46, 0x66, 0xff, 0x47, 0x67, 0xff, 0x48, 0x68, 0xff, 0x49, 0x69, 0xff, 0x4a, 0x6a, 0xff, 0x4b, 0x6b, 0xff, 0x4c, 0x6c, 0xff, 0x4d, 0x6d, 0xff, 0x4e, 0x6e, 0xff, 0x4f, 0x6f, 0xff, 0x50, 0x70, 0xff, 0x51, 0x71, 0xff, 0x52, 0x72, 0xff, 0x53, 0x73, 0xff, 0x54, 0x74, 0xff, 0x55, 0x75, 0xff, 0x56, 0x76, 0xff, 0x57, 0x77, 0xff, 0x58, 0x78, 0xff, 0x59, 0x79, 0xff, 0x5a, 0x7a, 0xff, 0x5b, 0x7b, 0xff, 0x5c, 0x7c, 0xff, 0x5d, 0x7d, 0xff, 0x5e, 0x7e, 0x00, 0x00, 0x00 }; htp_cfg_t *htp_config_create(void) { htp_cfg_t *cfg = calloc(1, sizeof (htp_cfg_t)); if (cfg == NULL) return NULL; cfg->field_limit_hard = HTP_FIELD_LIMIT_HARD; cfg->field_limit_soft = HTP_FIELD_LIMIT_SOFT; cfg->log_level = HTP_LOG_NOTICE; cfg->response_decompression_enabled = 1; cfg->parse_request_cookies = 1; cfg->parse_request_auth = 1; cfg->extract_request_files = 0; cfg->extract_request_files_limit = -1; // Use the parser default. cfg->response_decompression_layer_limit = 2; // 2 layers seem fairly common // Default settings for URL-encoded data. htp_config_set_bestfit_map(cfg, HTP_DECODER_DEFAULTS, bestfit_1252); htp_config_set_bestfit_replacement_byte(cfg, HTP_DECODER_DEFAULTS, '?'); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_config_set_nul_raw_terminates(cfg, HTP_DECODER_DEFAULTS, 0); htp_config_set_nul_encoded_terminates(cfg, HTP_DECODER_DEFAULTS, 0); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 0); htp_config_set_plusspace_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_server_personality(cfg, HTP_SERVER_MINIMAL); return cfg; } htp_cfg_t *htp_config_copy(htp_cfg_t *cfg) { if (cfg == NULL) return NULL; // Start by making a copy of the entire structure, // which is essentially a shallow copy. htp_cfg_t *copy = malloc(sizeof (htp_cfg_t)); if (copy == NULL) return NULL; memcpy(copy, cfg, sizeof (htp_cfg_t)); // Now create copies of the hooks' structures. if (cfg->hook_request_start != NULL) { copy->hook_request_start = htp_hook_copy(cfg->hook_request_start); if (copy->hook_request_start == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_line != NULL) { copy->hook_request_line = htp_hook_copy(cfg->hook_request_line); if (copy->hook_request_line == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_uri_normalize != NULL) { copy->hook_request_uri_normalize = htp_hook_copy(cfg->hook_request_uri_normalize); if (copy->hook_request_uri_normalize == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_header_data != NULL) { copy->hook_request_header_data = htp_hook_copy(cfg->hook_request_header_data); if (copy->hook_request_header_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_headers != NULL) { copy->hook_request_headers = htp_hook_copy(cfg->hook_request_headers); if (copy->hook_request_headers == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_body_data != NULL) { copy->hook_request_body_data = htp_hook_copy(cfg->hook_request_body_data); if (copy->hook_request_body_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_file_data != NULL) { copy->hook_request_file_data = htp_hook_copy(cfg->hook_request_file_data); if (copy->hook_request_file_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_trailer != NULL) { copy->hook_request_trailer = htp_hook_copy(cfg->hook_request_trailer); if (copy->hook_request_trailer == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_trailer_data != NULL) { copy->hook_request_trailer_data = htp_hook_copy(cfg->hook_request_trailer_data); if (copy->hook_request_trailer_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_request_complete != NULL) { copy->hook_request_complete = htp_hook_copy(cfg->hook_request_complete); if (copy->hook_request_complete == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_start != NULL) { copy->hook_response_start = htp_hook_copy(cfg->hook_response_start); if (copy->hook_response_start == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_line != NULL) { copy->hook_response_line = htp_hook_copy(cfg->hook_response_line); if (copy->hook_response_line == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_header_data != NULL) { copy->hook_response_header_data = htp_hook_copy(cfg->hook_response_header_data); if (copy->hook_response_header_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_headers != NULL) { copy->hook_response_headers = htp_hook_copy(cfg->hook_response_headers); if (copy->hook_response_headers == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_body_data != NULL) { copy->hook_response_body_data = htp_hook_copy(cfg->hook_response_body_data); if (copy->hook_response_body_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_trailer != NULL) { copy->hook_response_trailer = htp_hook_copy(cfg->hook_response_trailer); if (copy->hook_response_trailer == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_trailer_data != NULL) { copy->hook_response_trailer_data = htp_hook_copy(cfg->hook_response_trailer_data); if (copy->hook_response_trailer_data == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_response_complete != NULL) { copy->hook_response_complete = htp_hook_copy(cfg->hook_response_complete); if (copy->hook_response_complete == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_transaction_complete != NULL) { copy->hook_transaction_complete = htp_hook_copy(cfg->hook_transaction_complete); if (copy->hook_transaction_complete == NULL) { htp_config_destroy(copy); return NULL; } } if (cfg->hook_log != NULL) { copy->hook_log = htp_hook_copy(cfg->hook_log); if (copy->hook_log == NULL) { htp_config_destroy(copy); return NULL; } } return copy; } void htp_config_destroy(htp_cfg_t *cfg) { if (cfg == NULL) return; htp_hook_destroy(cfg->hook_request_start); htp_hook_destroy(cfg->hook_request_line); htp_hook_destroy(cfg->hook_request_uri_normalize); htp_hook_destroy(cfg->hook_request_header_data); htp_hook_destroy(cfg->hook_request_headers); htp_hook_destroy(cfg->hook_request_body_data); htp_hook_destroy(cfg->hook_request_file_data); htp_hook_destroy(cfg->hook_request_trailer); htp_hook_destroy(cfg->hook_request_trailer_data); htp_hook_destroy(cfg->hook_request_complete); htp_hook_destroy(cfg->hook_response_start); htp_hook_destroy(cfg->hook_response_line); htp_hook_destroy(cfg->hook_response_header_data); htp_hook_destroy(cfg->hook_response_headers); htp_hook_destroy(cfg->hook_response_body_data); htp_hook_destroy(cfg->hook_response_trailer); htp_hook_destroy(cfg->hook_response_trailer_data); htp_hook_destroy(cfg->hook_response_complete); htp_hook_destroy(cfg->hook_transaction_complete); htp_hook_destroy(cfg->hook_log); free(cfg); } void *htp_config_get_user_data(htp_cfg_t *cfg) { if (cfg == NULL) return NULL; return cfg->user_data; } void htp_config_register_log(htp_cfg_t *cfg, int (*callback_fn)(htp_log_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_log, (htp_callback_fn_t) callback_fn); } void htp_config_register_multipart_parser(htp_cfg_t *cfg) { if (cfg == NULL) return; htp_config_register_request_headers(cfg, htp_ch_multipart_callback_request_headers); } void htp_config_register_request_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_complete, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_body_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_body_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_file_data(htp_cfg_t *cfg, int (*callback_fn)(htp_file_data_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_file_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_uri_normalize(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_uri_normalize, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_header_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_header_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_headers(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_headers, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_line(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_line, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_start(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_start, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_trailer(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_trailer, (htp_callback_fn_t) callback_fn); } void htp_config_register_request_trailer_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *d)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_request_trailer_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_body_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_body_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_complete, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_header_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_header_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_headers(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_headers, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_line(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_line, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_start(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_start, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_trailer(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_trailer, (htp_callback_fn_t) callback_fn); } void htp_config_register_response_trailer_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *d)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_response_trailer_data, (htp_callback_fn_t) callback_fn); } void htp_config_register_transaction_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)) { if (cfg == NULL) return; htp_hook_register(&cfg->hook_transaction_complete, (htp_callback_fn_t) callback_fn); } void htp_config_register_urlencoded_parser(htp_cfg_t *cfg) { if (cfg == NULL) return; htp_config_register_request_line(cfg, htp_ch_urlencoded_callback_request_line); htp_config_register_request_headers(cfg, htp_ch_urlencoded_callback_request_headers); } htp_status_t htp_config_set_extract_request_files(htp_cfg_t *cfg, int extract_request_files, int limit) { if (cfg == NULL) return HTP_ERROR; if (cfg->tmpdir == NULL) return HTP_ERROR; cfg->extract_request_files = extract_request_files; cfg->extract_request_files_limit = limit; return HTP_OK; } void htp_config_set_field_limits(htp_cfg_t *cfg, size_t soft_limit, size_t hard_limit) { if (cfg == NULL) return; cfg->field_limit_soft = soft_limit; cfg->field_limit_hard = hard_limit; } void htp_config_set_log_level(htp_cfg_t *cfg, enum htp_log_level_t log_level) { if (cfg == NULL) return; cfg->log_level = log_level; } void htp_config_set_parse_request_auth(htp_cfg_t *cfg, int parse_request_auth) { if (cfg == NULL) return; cfg->parse_request_auth = parse_request_auth; } void htp_config_set_parse_request_cookies(htp_cfg_t *cfg, int parse_request_cookies) { if (cfg == NULL) return; cfg->parse_request_cookies = parse_request_cookies; } void htp_config_set_response_decompression(htp_cfg_t *cfg, int enabled) { if (cfg == NULL) return; cfg->response_decompression_enabled = enabled; } int htp_config_set_server_personality(htp_cfg_t *cfg, enum htp_server_personality_t personality) { if (cfg == NULL) return HTP_ERROR; switch (personality) { case HTP_SERVER_MINIMAL: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; break; case HTP_SERVER_GENERIC: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); break; case HTP_SERVER_IDS: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_convert_lowercase(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_requestline_leading_whitespace_unwanted(cfg, HTP_DECODER_DEFAULTS, HTP_UNWANTED_IGNORE); break; case HTP_SERVER_APACHE_2: cfg->parse_request_line = htp_parse_request_line_apache_2_2; cfg->process_request_header = htp_process_request_header_apache_2_2; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 0); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 0); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URL_PATH, 0); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URL_PATH, HTP_URL_DECODE_PRESERVE_PERCENT); htp_config_set_url_encoding_invalid_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_400); htp_config_set_control_chars_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_IGNORE); htp_config_set_requestline_leading_whitespace_unwanted(cfg, HTP_DECODER_DEFAULTS, HTP_UNWANTED_400); break; case HTP_SERVER_IIS_5_1: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URL_PATH, 0); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URL_PATH, HTP_URL_DECODE_PRESERVE_PERCENT); htp_config_set_control_chars_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_IGNORE); htp_config_set_requestline_leading_whitespace_unwanted(cfg, HTP_DECODER_DEFAULTS, HTP_UNWANTED_IGNORE); break; case HTP_SERVER_IIS_6_0: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URL_PATH, HTP_URL_DECODE_PRESERVE_PERCENT); htp_config_set_u_encoding_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_400); htp_config_set_control_chars_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_400); htp_config_set_requestline_leading_whitespace_unwanted(cfg, HTP_DECODER_DEFAULTS, HTP_UNWANTED_IGNORE); break; case HTP_SERVER_IIS_7_0: case HTP_SERVER_IIS_7_5: cfg->parse_request_line = htp_parse_request_line_generic; cfg->process_request_header = htp_process_request_header_generic; cfg->parse_response_line = htp_parse_response_line_generic; cfg->process_response_header = htp_process_response_header_generic; htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_path_separators_compress(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URL_PATH, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URL_PATH, HTP_URL_DECODE_PRESERVE_PERCENT); htp_config_set_url_encoding_invalid_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_400); htp_config_set_control_chars_unwanted(cfg, HTP_DECODER_URL_PATH, HTP_UNWANTED_400); htp_config_set_requestline_leading_whitespace_unwanted(cfg, HTP_DECODER_DEFAULTS, HTP_UNWANTED_IGNORE); break; default: return HTP_ERROR; } // Remember the personality cfg->server_personality = personality; return HTP_OK; } void htp_config_set_tmpdir(htp_cfg_t *cfg, char *tmpdir) { if (cfg == NULL) return; cfg->tmpdir = tmpdir; } void htp_config_set_tx_auto_destroy(htp_cfg_t *cfg, int tx_auto_destroy) { if (cfg == NULL) return; cfg->tx_auto_destroy = tx_auto_destroy; } void htp_config_set_user_data(htp_cfg_t *cfg, void *user_data) { if (cfg == NULL) return; cfg->user_data = user_data; } static int convert_to_0_or_1(int b) { if (b) return 1; return 0; } void htp_config_set_bestfit_map(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, void *map) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].bestfit_map = map; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].bestfit_map = map; } } } void htp_config_set_bestfit_replacement_byte(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int b) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].bestfit_replacement_byte = b; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].bestfit_replacement_byte = b; } } } void htp_config_set_url_encoding_invalid_handling(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_url_encoding_handling_t handling) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].url_encoding_invalid_handling = handling; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].url_encoding_invalid_handling = handling; } } } void htp_config_set_nul_raw_terminates(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].nul_raw_terminates = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].nul_raw_terminates = convert_to_0_or_1(enabled); } } } void htp_config_set_nul_encoded_terminates(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].nul_encoded_terminates = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].nul_encoded_terminates = convert_to_0_or_1(enabled); } } } void htp_config_set_u_encoding_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].u_encoding_decode = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].u_encoding_decode = convert_to_0_or_1(enabled); } } } void htp_config_set_backslash_convert_slashes(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].backslash_convert_slashes = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].backslash_convert_slashes = convert_to_0_or_1(enabled); } } } void htp_config_set_path_separators_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].path_separators_decode = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].path_separators_decode = convert_to_0_or_1(enabled); } } } void htp_config_set_path_separators_compress(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].path_separators_compress = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].path_separators_compress = convert_to_0_or_1(enabled); } } } void htp_config_set_plusspace_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].plusspace_decode = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].plusspace_decode = convert_to_0_or_1(enabled); } } } void htp_config_set_convert_lowercase(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].convert_lowercase = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].convert_lowercase = convert_to_0_or_1(enabled); } } } void htp_config_set_utf8_convert_bestfit(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].utf8_convert_bestfit = convert_to_0_or_1(enabled); if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].utf8_convert_bestfit = convert_to_0_or_1(enabled); } } } void htp_config_set_u_encoding_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].u_encoding_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].u_encoding_unwanted = unwanted; } } } void htp_config_set_control_chars_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].u_encoding_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].u_encoding_unwanted = unwanted; } } } void htp_config_set_url_encoding_invalid_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].url_encoding_invalid_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].url_encoding_invalid_unwanted = unwanted; } } } void htp_config_set_nul_encoded_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].nul_encoded_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].nul_encoded_unwanted = unwanted; } } } void htp_config_set_nul_raw_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].nul_raw_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].nul_raw_unwanted = unwanted; } } } void htp_config_set_path_separators_encoded_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].path_separators_encoded_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].path_separators_encoded_unwanted = unwanted; } } } void htp_config_set_utf8_invalid_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->decoder_cfgs[ctx].utf8_invalid_unwanted = unwanted; if (ctx == HTP_DECODER_DEFAULTS) { for (size_t i = 0; i < HTP_DECODER_CONTEXTS_MAX; i++) { cfg->decoder_cfgs[i].utf8_invalid_unwanted = unwanted; } } } void htp_config_set_requestline_leading_whitespace_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted) { if (ctx >= HTP_DECODER_CONTEXTS_MAX) return; cfg->requestline_leading_whitespace_unwanted = unwanted; } void htp_config_set_response_decompression_layer_limit(htp_cfg_t *cfg, int limit) { if (cfg == NULL) return; cfg->response_decompression_layer_limit = limit; } suricata-3.2.1/libhtp/htp/htp_connection.c0000644000000000000000000001236113051004451015446 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" htp_conn_t *htp_conn_create(void) { htp_conn_t *conn = calloc(1, sizeof (htp_conn_t)); if (conn == NULL) return NULL; conn->transactions = htp_list_create(16); if (conn->transactions == NULL) { free(conn); return NULL; } conn->messages = htp_list_create(8); if (conn->messages == NULL) { htp_list_destroy(conn->transactions); conn->transactions = NULL; free(conn); return NULL; } return conn; } void htp_conn_close(htp_conn_t *conn, const htp_time_t *timestamp) { if (conn == NULL) return; // Update timestamp. if (timestamp != NULL) { memcpy(&(conn->close_timestamp), timestamp, sizeof(htp_time_t)); } } void htp_conn_destroy(htp_conn_t *conn) { if (conn == NULL) return; if (conn->transactions != NULL) { // Destroy individual transactions. Do note that iterating // using the iterator does not work here because some of the // list element may be NULL (and with the iterator it is impossible // to distinguish a NULL element from the end of the list). for (size_t i = 0, n = htp_list_size(conn->transactions); i < n; i++) { htp_tx_t *tx = htp_list_get(conn->transactions, i); if (tx != NULL) { htp_tx_destroy_incomplete(tx); } } htp_list_destroy(conn->transactions); conn->transactions = NULL; } if (conn->messages != NULL) { // Destroy individual messages. for (size_t i = 0, n = htp_list_size(conn->messages); i < n; i++) { htp_log_t *l = htp_list_get(conn->messages, i); free((void *) l->msg); free(l); } htp_list_destroy(conn->messages); conn->messages = NULL; } if (conn->server_addr != NULL) { free(conn->server_addr); } if (conn->client_addr != NULL) { free(conn->client_addr); } free(conn); } htp_status_t htp_conn_open(htp_conn_t *conn, const char *client_addr, int client_port, const char *server_addr, int server_port, const htp_time_t *timestamp) { if (conn == NULL) return HTP_ERROR; if (client_addr != NULL) { conn->client_addr = strdup(client_addr); if (conn->client_addr == NULL) return HTP_ERROR; } conn->client_port = client_port; if (server_addr != NULL) { conn->server_addr = strdup(server_addr); if (conn->server_addr == NULL) { if (conn->client_addr != NULL) { free(conn->client_addr); } return HTP_ERROR; } } conn->server_port = server_port; // Remember when the connection was opened. if (timestamp != NULL) { memcpy(&(conn->open_timestamp), timestamp, sizeof(*timestamp)); } return HTP_OK; } htp_status_t htp_conn_remove_tx(htp_conn_t *conn, const htp_tx_t *tx) { if ((tx == NULL) || (conn == NULL)) return HTP_ERROR; if (conn->transactions == NULL) return HTP_ERROR; return htp_list_replace(conn->transactions, tx->index, NULL); } void htp_conn_track_inbound_data(htp_conn_t *conn, size_t len, const htp_time_t *timestamp) { if (conn == NULL) return; conn->in_data_counter += len; } void htp_conn_track_outbound_data(htp_conn_t *conn, size_t len, const htp_time_t *timestamp) { if (conn == NULL) return; conn->out_data_counter += len; } suricata-3.2.1/libhtp/htp/htp_table.c0000644000000000000000000002005013051004451014370 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" static htp_status_t _htp_table_add(htp_table_t *table, const bstr *key, const void *element) { // Add key. if (htp_list_add(table->list, (void *)key) != HTP_OK) return HTP_ERROR; // Add element. if (htp_list_add(table->list, (void *)element) != HTP_OK) { htp_list_pop(table->list); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_table_add(htp_table_t *table, const bstr *key, const void *element) { if ((table == NULL)||(key == NULL)) return HTP_ERROR; // Keep track of how keys are allocated, and // ensure that all invocations are consistent. if (table->alloc_type == HTP_TABLE_KEYS_ALLOC_UKNOWN) { table->alloc_type = HTP_TABLE_KEYS_COPIED; } else { if (table->alloc_type != HTP_TABLE_KEYS_COPIED) { #ifdef HTP_DEBUG fprintf(stderr, "# Inconsistent key management strategy. Actual %d. Attempted %d.\n", table->alloc_type, HTP_TABLE_KEYS_COPIED); #endif return HTP_ERROR; } } bstr *dupkey = bstr_dup(key); if (dupkey == NULL) return HTP_ERROR; if (_htp_table_add(table, dupkey, element) != HTP_OK) { bstr_free(dupkey); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_table_addn(htp_table_t *table, const bstr *key, const void *element) { if ((table == NULL)||(key == NULL)) return HTP_ERROR; // Keep track of how keys are allocated, and // ensure that all invocations are consistent. if (table->alloc_type == HTP_TABLE_KEYS_ALLOC_UKNOWN) { table->alloc_type = HTP_TABLE_KEYS_ADOPTED; } else { if (table->alloc_type != HTP_TABLE_KEYS_ADOPTED) { #ifdef HTP_DEBUG fprintf(stderr, "# Inconsistent key management strategy. Actual %d. Attempted %d.\n", table->alloc_type, HTP_TABLE_KEYS_ADOPTED); #endif return HTP_ERROR; } } return _htp_table_add(table, key, element); } htp_status_t htp_table_addk(htp_table_t *table, const bstr *key, const void *element) { if ((table == NULL)||(key == NULL)) return HTP_ERROR; // Keep track of how keys are allocated, and // ensure that all invocations are consistent. if (table->alloc_type == HTP_TABLE_KEYS_ALLOC_UKNOWN) { table->alloc_type = HTP_TABLE_KEYS_REFERENCED; } else { if (table->alloc_type != HTP_TABLE_KEYS_REFERENCED) { #ifdef HTP_DEBUG fprintf(stderr, "# Inconsistent key management strategy. Actual %d. Attempted %d.\n", table->alloc_type, HTP_TABLE_KEYS_REFERENCED); #endif return HTP_ERROR; } } return _htp_table_add(table, key, element); } void htp_table_clear(htp_table_t *table) { if (table == NULL) return; // Free the table keys, but only if we're managing them. if ((table->alloc_type == HTP_TABLE_KEYS_COPIED)||(table->alloc_type == HTP_TABLE_KEYS_ADOPTED)) { bstr *key = NULL; for (size_t i = 0, n = htp_list_size(table->list); i < n; i += 2) { key = htp_list_get(table->list, i); bstr_free(key); } } htp_list_clear(table->list); } void htp_table_clear_ex(htp_table_t *table) { if (table == NULL) return; // This function does not free table keys. htp_list_clear(table->list); } htp_table_t *htp_table_create(size_t size) { if (size == 0) return NULL; htp_table_t *table = calloc(1, sizeof (htp_table_t)); if (table == NULL) return NULL; table->alloc_type = HTP_TABLE_KEYS_ALLOC_UKNOWN; // Use a list behind the scenes. table->list = htp_list_array_create(size * 2); if (table->list == NULL) { free(table); return NULL; } return table; } void htp_table_destroy(htp_table_t *table) { if (table == NULL) return; htp_table_clear(table); htp_list_destroy(table->list); table->list = NULL; free(table); } void htp_table_destroy_ex(htp_table_t *table) { if (table == NULL) return; // Change allocation strategy in order to // prevent the keys from being freed. table->alloc_type = HTP_TABLE_KEYS_REFERENCED; htp_table_destroy(table); } void *htp_table_get(const htp_table_t *table, const bstr *key) { if ((table == NULL)||(key == NULL)) return NULL; // Iterate through the list, comparing // keys with the parameter, return data if found. for (size_t i = 0, n = htp_list_size(table->list); i < n; i += 2) { bstr *key_candidate = htp_list_get(table->list, i); void *element = htp_list_get(table->list, i + 1); if (bstr_cmp_nocase(key_candidate, key) == 0) { return element; } } return NULL; } void *htp_table_get_c(const htp_table_t *table, const char *ckey) { if ((table == NULL)||(ckey == NULL)) return NULL; // Iterate through the list, comparing // keys with the parameter, return data if found. for (size_t i = 0, n = htp_list_size(table->list); i < n; i += 2) { bstr *key_candidate = htp_list_get(table->list, i); void *element = htp_list_get(table->list, i + 1); if (bstr_cmp_c_nocase(key_candidate, ckey) == 0) { return element; } } return NULL; } void *htp_table_get_index(const htp_table_t *table, size_t idx, bstr **key) { if (table == NULL) return NULL; if (idx >= htp_list_size(table->list)) return NULL; if (key != NULL) { *key = htp_list_get(table->list, idx * 2); } return htp_list_get(table->list, (idx * 2) + 1); } void *htp_table_get_mem(const htp_table_t *table, const void *key, size_t key_len) { if ((table == NULL)||(key == NULL)) return NULL; // Iterate through the list, comparing // keys with the parameter, return data if found. for (size_t i = 0, n = htp_list_size(table->list); i < n; i += 2) { bstr *key_candidate = htp_list_get(table->list, i); void *element = htp_list_get(table->list, i + 1); if (bstr_cmp_mem_nocase(key_candidate, key, key_len) == 0) { return element; } } return NULL; } size_t htp_table_size(const htp_table_t *table) { if (table == NULL) return 0; return htp_list_size(table->list) / 2; } suricata-3.2.1/libhtp/htp/Makefile.in0000644000000000000000000006423213051004463014344 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = htp ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ $(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/lib-ld.m4 \ $(top_srcdir)/m4/lib-link.m4 $(top_srcdir)/m4/lib-prefix.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(library_include_HEADERS) \ $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/htp_config_auto_gen.h CONFIG_CLEAN_FILES = htp_version.h CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } am__installdirs = "$(DESTDIR)$(libdir)" \ "$(DESTDIR)$(library_includedir)" LTLIBRARIES = $(lib_LTLIBRARIES) $(noinst_LTLIBRARIES) libhtp_c_la_LIBADD = am__objects_1 = am__objects_2 = bstr.lo bstr_builder.lo htp_base64.lo htp_config.lo \ htp_connection.lo htp_connection_parser.lo \ htp_content_handlers.lo htp_cookies.lo htp_decompressors.lo \ htp_hooks.lo htp_list.lo htp_multipart.lo htp_parsers.lo \ htp_php.lo htp_request.lo htp_request_apache_2_2.lo \ htp_request_generic.lo htp_request_parsers.lo htp_response.lo \ htp_response_generic.lo htp_table.lo htp_transaction.lo \ htp_transcoder.lo htp_urlencoded.lo htp_util.lo \ htp_utf8_decoder.lo strlcpy.lo strlcat.lo am_libhtp_c_la_OBJECTS = $(am__objects_1) $(am__objects_1) \ $(am__objects_2) libhtp_c_la_OBJECTS = $(am_libhtp_c_la_OBJECTS) AM_V_lt = $(am__v_lt_@AM_V@) am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) am__v_lt_0 = --silent am__v_lt_1 = libhtp_la_DEPENDENCIES = libhtp-c.la am_libhtp_la_OBJECTS = libhtp_la_OBJECTS = $(am_libhtp_la_OBJECTS) libhtp_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(libhtp_la_LDFLAGS) $(LDFLAGS) -o $@ AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CFLAGS) $(CFLAGS) AM_V_CC = $(am__v_CC_@AM_V@) am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) am__v_CC_0 = @echo " CC " $@; am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; am__v_CCLD_1 = SOURCES = $(libhtp_c_la_SOURCES) $(libhtp_la_SOURCES) DIST_SOURCES = $(libhtp_c_la_SOURCES) $(libhtp_la_SOURCES) am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac HEADERS = $(library_include_HEADERS) am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/htp_version.h.in \ $(top_srcdir)/depcomp DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CXX = @CXX@ CXXCPP = @CXXCPP@ CXXDEPMODE = @CXXDEPMODE@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DOXYGEN = @DOXYGEN@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GENERIC_API_VERSION = @GENERIC_API_VERSION@ GENERIC_LIBRARY_NAME = @GENERIC_LIBRARY_NAME@ GENERIC_LIBRARY_VERSION = @GENERIC_LIBRARY_VERSION@ GENERIC_RELEASE = @GENERIC_RELEASE@ GENERIC_VERSION = @GENERIC_VERSION@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBICONV = @LIBICONV@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBICONV = @LTLIBICONV@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ RANLIB = @RANLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ doxygen = @doxygen@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ h_sources = bstr.h bstr_builder.h htp.h htp_base64.h htp_config.h htp_connection_parser.h \ htp_core.h htp_decompressors.h htp_hooks.h htp_list.h \ htp_multipart.h htp_table.h htp_transaction.h \ htp_urlencoded.h htp_utf8_decoder.h htp_version.h h_sources_private = htp_config_private.h htp_connection_private.h htp_connection_parser_private.h htp_list_private.h \ htp_multipart_private.h htp_private.h htp_table_private.h htp_config_auto.h c_sources = bstr.c bstr_builder.c htp_base64.c htp_config.c htp_connection.c htp_connection_parser.c \ htp_content_handlers.c htp_cookies.c htp_decompressors.c htp_hooks.c htp_list.c htp_multipart.c htp_parsers.c \ htp_php.c htp_request.c htp_request_apache_2_2.c htp_request_generic.c htp_request_parsers.c htp_response.c \ htp_response_generic.c htp_table.c htp_transaction.c htp_transcoder.c htp_urlencoded.c htp_util.c htp_utf8_decoder.c \ strlcpy.c strlcat.c library_includedir = $(includedir)/$(GENERIC_LIBRARY_NAME) library_include_HEADERS = $(h_sources) AM_CFLAGS = -I$(top_srcdir) -I$(top_builddir)/htp -D_GNU_SOURCE -g -Wall -Wextra -std=gnu99 -pedantic \ -Wextra -Wno-missing-field-initializers -Wshadow -Wpointer-arith \ -Wstrict-prototypes -Wmissing-prototypes -Wno-unused-parameter noinst_LTLIBRARIES = libhtp-c.la libhtp_c_la_SOURCES = $(h_sources) $(h_sources_private) $(c_sources) lib_LTLIBRARIES = libhtp.la libhtp_la_SOURCES = libhtp_la_LIBADD = libhtp-c.la libhtp_la_LDFLAGS = -version-info $(GENERIC_LIBRARY_VERSION) -release $(GENERIC_RELEASE) all: all-am .SUFFIXES: .SUFFIXES: .c .lo .o .obj $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu htp/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu htp/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): htp_version.h: $(top_builddir)/config.status $(srcdir)/htp_version.h.in cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ install-libLTLIBRARIES: $(lib_LTLIBRARIES) @$(NORMAL_INSTALL) @list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ list2="$$list2 $$p"; \ else :; fi; \ done; \ test -z "$$list2" || { \ echo " $(MKDIR_P) '$(DESTDIR)$(libdir)'"; \ $(MKDIR_P) "$(DESTDIR)$(libdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \ } uninstall-libLTLIBRARIES: @$(NORMAL_UNINSTALL) @list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \ for p in $$list; do \ $(am__strip_dir) \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \ done clean-libLTLIBRARIES: -test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES) @list='$(lib_LTLIBRARIES)'; \ locs=`for p in $$list; do echo $$p; done | \ sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \ sort -u`; \ test -z "$$locs" || { \ echo rm -f $${locs}; \ rm -f $${locs}; \ } clean-noinstLTLIBRARIES: -test -z "$(noinst_LTLIBRARIES)" || rm -f $(noinst_LTLIBRARIES) @list='$(noinst_LTLIBRARIES)'; \ locs=`for p in $$list; do echo $$p; done | \ sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \ sort -u`; \ test -z "$$locs" || { \ echo rm -f $${locs}; \ rm -f $${locs}; \ } libhtp-c.la: $(libhtp_c_la_OBJECTS) $(libhtp_c_la_DEPENDENCIES) $(EXTRA_libhtp_c_la_DEPENDENCIES) $(AM_V_CCLD)$(LINK) $(libhtp_c_la_OBJECTS) $(libhtp_c_la_LIBADD) $(LIBS) libhtp.la: $(libhtp_la_OBJECTS) $(libhtp_la_DEPENDENCIES) $(EXTRA_libhtp_la_DEPENDENCIES) $(AM_V_CCLD)$(libhtp_la_LINK) -rpath $(libdir) $(libhtp_la_OBJECTS) $(libhtp_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/bstr.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/bstr_builder.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_base64.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_config.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_connection.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_connection_parser.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_content_handlers.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_cookies.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_decompressors.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_hooks.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_list.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_multipart.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_parsers.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_php.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_request.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_request_apache_2_2.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_request_generic.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_request_parsers.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_response.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_response_generic.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_table.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_transaction.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_transcoder.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_urlencoded.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_utf8_decoder.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/htp_util.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/strlcat.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/strlcpy.Plo@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $< .c.obj: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .c.lo: @am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs install-library_includeHEADERS: $(library_include_HEADERS) @$(NORMAL_INSTALL) @list='$(library_include_HEADERS)'; test -n "$(library_includedir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(library_includedir)'"; \ $(MKDIR_P) "$(DESTDIR)$(library_includedir)" || exit 1; \ fi; \ for p in $$list; do \ if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ echo "$$d$$p"; \ done | $(am__base_list) | \ while read files; do \ echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(library_includedir)'"; \ $(INSTALL_HEADER) $$files "$(DESTDIR)$(library_includedir)" || exit $$?; \ done uninstall-library_includeHEADERS: @$(NORMAL_UNINSTALL) @list='$(library_include_HEADERS)'; test -n "$(library_includedir)" || list=; \ files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \ dir='$(DESTDIR)$(library_includedir)'; $(am__uninstall_files_from_dir) ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-am TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-am CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-am cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile $(LTLIBRARIES) $(HEADERS) installdirs: for dir in "$(DESTDIR)$(libdir)" "$(DESTDIR)$(library_includedir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-generic clean-libLTLIBRARIES clean-libtool \ clean-noinstLTLIBRARIES mostlyclean-am distclean: distclean-am -rm -rf ./$(DEPDIR) -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-library_includeHEADERS install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-libLTLIBRARIES install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-libLTLIBRARIES \ uninstall-library_includeHEADERS .MAKE: install-am install-strip .PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \ clean-libLTLIBRARIES clean-libtool clean-noinstLTLIBRARIES \ cscopelist-am ctags ctags-am distclean distclean-compile \ distclean-generic distclean-libtool distclean-tags distdir dvi \ dvi-am html html-am info info-am install install-am \ install-data install-data-am install-dvi install-dvi-am \ install-exec install-exec-am install-html install-html-am \ install-info install-info-am install-libLTLIBRARIES \ install-library_includeHEADERS install-man install-pdf \ install-pdf-am install-ps install-ps-am install-strip \ installcheck installcheck-am installdirs maintainer-clean \ maintainer-clean-generic mostlyclean mostlyclean-compile \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags tags-am uninstall uninstall-am uninstall-libLTLIBRARIES \ uninstall-library_includeHEADERS .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/libhtp/htp/htp_parsers.c0000644000000000000000000001476313051004451014776 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Determines protocol number from a textual representation (i.e., "HTTP/1.1"). This * function will only understand a properly formatted protocol information. It does * not try to be flexible. * * @param[in] protocol * @return Protocol version or PROTOCOL_UNKNOWN. */ int htp_parse_protocol(bstr *protocol) { if (protocol == NULL) return HTP_PROTOCOL_INVALID; // TODO This function uses a very strict approach to parsing, whereas // browsers will typically be more flexible, allowing whitespace // before and after the forward slash, as well as allowing leading // zeroes in the numbers. We should be able to parse such malformed // content correctly (but emit a warning). if (bstr_len(protocol) == 8) { unsigned char *ptr = bstr_ptr(protocol); if ((ptr[0] == 'H') && (ptr[1] == 'T') && (ptr[2] == 'T') && (ptr[3] == 'P') && (ptr[4] == '/') && (ptr[6] == '.')) { // Check the version numbers if (ptr[5] == '0') { if (ptr[7] == '9') { return HTP_PROTOCOL_0_9; } } else if (ptr[5] == '1') { if (ptr[7] == '0') { return HTP_PROTOCOL_1_0; } else if (ptr[7] == '1') { return HTP_PROTOCOL_1_1; } } } } return HTP_PROTOCOL_INVALID; } /** * Determines the numerical value of a response status given as a string. * * @param[in] status * @return Status code on success, or -1 on error. */ int htp_parse_status(bstr *status) { return htp_parse_positive_integer_whitespace((unsigned char *) bstr_ptr(status), bstr_len(status), 10); } /** * Parses Digest Authorization request header. * * @param[in] connp * @param[in] auth_header */ int htp_parse_authorization_digest(htp_connp_t *connp, htp_header_t *auth_header) { // Extract the username int i = bstr_index_of_c(auth_header->value, "username="); if (i == -1) return HTP_DECLINED; unsigned char *data = bstr_ptr(auth_header->value); size_t len = bstr_len(auth_header->value); size_t pos = i + 9; // Ignore whitespace while ((pos < len) && (isspace((int) data[pos]))) pos++; if (data[pos] != '"') return HTP_DECLINED; return htp_extract_quoted_string_as_bstr(data + pos, len - pos, &(connp->in_tx->request_auth_username), NULL); } /** * Parses Basic Authorization request header. * * @param[in] connp * @param[in] auth_header */ int htp_parse_authorization_basic(htp_connp_t *connp, htp_header_t *auth_header) { unsigned char *data = bstr_ptr(auth_header->value); size_t len = bstr_len(auth_header->value); size_t pos = 5; // Ignore whitespace while ((pos < len) && (isspace((int) data[pos]))) pos++; if (pos == len) return HTP_DECLINED; // Decode base64-encoded data bstr *decoded = htp_base64_decode_mem(data + pos, len - pos); if (decoded == NULL) return HTP_ERROR; // Now extract the username and password int i = bstr_index_of_c(decoded, ":"); if (i == -1) { bstr_free(decoded); return HTP_DECLINED; } connp->in_tx->request_auth_username = bstr_dup_ex(decoded, 0, i); if (connp->in_tx->request_auth_username == NULL) { bstr_free(decoded); return HTP_ERROR; } connp->in_tx->request_auth_password = bstr_dup_ex(decoded, i + 1, bstr_len(decoded) - i - 1); if (connp->in_tx->request_auth_password == NULL) { bstr_free(decoded); bstr_free(connp->in_tx->request_auth_username); return HTP_ERROR; } bstr_free(decoded); return HTP_OK; } /** * Parses Authorization request header. * * @param[in] connp */ int htp_parse_authorization(htp_connp_t *connp) { htp_header_t *auth_header = htp_table_get_c(connp->in_tx->request_headers, "authorization"); if (auth_header == NULL) { connp->in_tx->request_auth_type = HTP_AUTH_NONE; return HTP_OK; } // TODO Need a flag to raise when failing to parse authentication headers. if (bstr_begins_with_c_nocase(auth_header->value, "basic")) { // Basic authentication connp->in_tx->request_auth_type = HTP_AUTH_BASIC; return htp_parse_authorization_basic(connp, auth_header); } else if (bstr_begins_with_c_nocase(auth_header->value, "digest")) { // Digest authentication connp->in_tx->request_auth_type = HTP_AUTH_DIGEST; return htp_parse_authorization_digest(connp, auth_header); } else { // Unrecognized authentication method connp->in_tx->request_auth_type = HTP_AUTH_UNRECOGNIZED; } return HTP_OK; } suricata-3.2.1/libhtp/htp/bstr_builder.h0000644000000000000000000001010113051004451015107 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _BSTR_BUILDER_H #define _BSTR_BUILDER_H #ifdef __cplusplus extern "C" { #endif typedef struct bstr_builder_t bstr_builder_t; #include "htp_list.h" struct bstr_builder_t { htp_list_t *pieces; }; #define BSTR_BUILDER_DEFAULT_SIZE 16 /** * Adds one new string to the builder. This function will adopt the * string and destroy it when the builder itself is destroyed. * * @param[in] bb * @param[in] b * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t bstr_builder_appendn(bstr_builder_t *bb, bstr *b); /** * Adds one new piece, in the form of a NUL-terminated string, to * the builder. This function will make a copy of the provided string. * * @param[in] bb * @param[in] cstr * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t bstr_builder_append_c(bstr_builder_t *bb, const char *cstr); /** * Adds one new piece, defined with the supplied pointer and * length, to the builder. This function will make a copy of the * provided data region. * * @param[in] bb * @param[in] data * @param[in] len * @return @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t bstr_builder_append_mem(bstr_builder_t *bb, const void *data, size_t len); /** * Clears this string builder, destroying all existing pieces. You may * want to clear a builder once you've either read all the pieces and * done something with them, or after you've converted the builder into * a single string. * * @param[in] bb */ void bstr_builder_clear(bstr_builder_t *bb); /** * Creates a new string builder. * * @return New string builder, or NULL on error. */ bstr_builder_t *bstr_builder_create(void); /** * Destroys an existing string builder, also destroying all * the pieces stored within. * * @param[in] bb */ void bstr_builder_destroy(bstr_builder_t *bb); /** * Returns the size (the number of pieces) currently in a string builder. * * @param[in] bb * @return size */ size_t bstr_builder_size(const bstr_builder_t *bb); /** * Creates a single string out of all the pieces held in a * string builder. This method will not destroy any of the pieces. * * @param[in] bb * @return New string, or NULL on error. */ bstr *bstr_builder_to_str(const bstr_builder_t *bb); #ifdef __cplusplus } #endif #endif /* _BSTR_BUILDER_H */ suricata-3.2.1/libhtp/htp/htp_table.h0000644000000000000000000001415613051004451014407 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_TABLE_H #define HTP_TABLE_H #ifdef __cplusplus extern "C" { #endif typedef struct htp_table_t htp_table_t; /** * Add a new element to the table. The key will be copied, and the copy * managed by the table. The table keeps a pointer to the element. It is the * callers responsibility to ensure the pointer remains valid. * * @param[in] table * @param[in] key * @param[in] element * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_table_add(htp_table_t *table, const bstr *key, const void *element); /** * Add a new element to the table. The key provided will be adopted and managed * by the table. You should not keep a copy of the pointer to the key unless you're * certain that the table will live longer that the copy. The table keeps a pointer * to the element. It is the callers responsibility to ensure the pointer remains * valid. * * @param[in] table * @param[in] key * @param[in] element * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_table_addn(htp_table_t *table, const bstr *key, const void *element); /** * Add a new element to the table. The key provided will be only referenced and the * caller remains responsible to keep it alive until after the table is destroyed. The * table keeps a pointer to the element. It is the callers responsibility to ensure * the pointer remains valid. * * @param[in] table * @param[in] key * @param[in] element * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_table_addk(htp_table_t *table, const bstr *key, const void *element); /** * Remove all elements from the table. This function handles keys * according to the active allocation strategy. If the elements need freeing, * you need to free them before invoking this function. * * @param[in] table */ void htp_table_clear(htp_table_t *table); /** * Remove all elements from the table without freeing any of the keys, even * if the table is using an allocation strategy where keys belong to it. This * function is useful if all the keys have been adopted by some other structure. * * @param[in] table */ void htp_table_clear_ex(htp_table_t *table); /** * Create a new table structure. The table will grow automatically as needed, * but you are required to provide a starting size. * * @param[in] size The starting size. * @return Newly created table instance, or NULL on failure. */ htp_table_t *htp_table_create(size_t size); /** * Destroy a table. This function handles the keys according to the active * allocation strategy. If the elements need freeing, you need to free them * before invoking this function. After the table has been destroyed, * the pointer is set to NULL. * * @param[in] table */ void htp_table_destroy(htp_table_t *table); /** * Destroy the given table, but don't free the keys. even if they are managed by * the table. Use this method when the responsibility for the keys has been transferred * elsewhere. After the table has been destroyed, the pointer is set to NULL. * * @param[in] table */ void htp_table_destroy_ex(htp_table_t *table); /** * Retrieve the first element that matches the given bstr key. * * @param[in] table * @param[in] key * @return Matched element, or NULL if no elements match the key. */ void *htp_table_get(const htp_table_t *table, const bstr *key); /** * Retrieve the first element that matches the given NUL-terminated key. * * @param[in] table * @param[in] ckey * @return Matched element, or NULL if no elements match the key. */ void *htp_table_get_c(const htp_table_t *table, const char *ckey); /** * Retrieve key and element at the given index. * * @param[in] table * @param[in] idx * @param[in,out] key Pointer in which the key will be returned. Can be NULL. * @return HTP_OK on success, HTP_ERROR on failure. */ void *htp_table_get_index(const htp_table_t *table, size_t idx, bstr **key); /** * Retrieve table key defined by the provided pointer and length. * * @param[in] table * @param[in] key * @param[in] key_len * @return Matched element, or NULL if no elements match the key. */ void *htp_table_get_mem(const htp_table_t *table, const void *key, size_t key_len); /** * Return the size of the table. * * @param[in] table * @return table size */ size_t htp_table_size(const htp_table_t *table); #ifdef __cplusplus } #endif #endif /* HTP_TABLE_H */ suricata-3.2.1/libhtp/htp/htp_request_apache_2_2.c0000644000000000000000000000502213051004451016736 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Extract one request header. A header can span multiple lines, in * which case they will be folded into one before parsing is attempted. * * @param[in] connp * @param[in] data * @param[in] len * @return HTP_OK or HTP_ERROR */ htp_status_t htp_process_request_header_apache_2_2(htp_connp_t *connp, unsigned char *data, size_t len) { return htp_process_request_header_generic(connp, data, len); } /** * Parse request line as Apache 2.2 does. * * @param[in] connp * @return HTP_OK or HTP_ERROR */ htp_status_t htp_parse_request_line_apache_2_2(htp_connp_t *connp) { return htp_parse_request_line_generic_ex(connp, 1 /* NUL terminates line */); } suricata-3.2.1/libhtp/htp/htp_decompressors.c0000644000000000000000000003106713051004451016203 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * @brief See if the header has extensions * @return number of bytes to skip */ static size_t htp_gzip_decompressor_probe(const unsigned char *data, size_t data_len) { if (data_len < 4) return 0; size_t consumed = 0; if (data[0] == 0x1f && data[1] == 0x8b && data[3] != 0) { if (data[3] & (1 << 3) || data[3] & (1 << 4)) { /* skip past * - FNAME extension, which is a name ended in a NUL terminator * or * - FCOMMENT extension, which is a commend ended in a NULL terminator */ size_t len; for (len = 10; len < data_len && data[len] != '\0'; len++); consumed = len + 1; //printf("skipped %u bytes for FNAME/FCOMMENT header (GZIP)\n", (uint)consumed); } else if (data[3] & (1 << 1)) { consumed = 12; //printf("skipped %u bytes for FHCRC header (GZIP)\n", 12); } else { //printf("GZIP unknown/unsupported flags %02X\n", data[3]); consumed = 10; } } if (consumed > data_len) return 0; return consumed; } /** * @brief restart the decompressor * @return 1 if it restarted, 0 otherwise */ static int htp_gzip_decompressor_restart(htp_decompressor_gzip_t *drec, const unsigned char *data, size_t data_len, size_t *consumed_back) { size_t consumed = 0; int rc = 0; if (drec->restart < 3) { // first retry with the existing type, but now consider the // extensions if (drec->restart == 0) { consumed = htp_gzip_decompressor_probe(data, data_len); if (drec->zlib_initialized == HTP_COMPRESSION_GZIP) { //printf("GZIP restart, consumed %u\n", (uint)consumed); rc = inflateInit2(&drec->stream, 15 + 32); } else { //printf("DEFLATE restart, consumed %u\n", (uint)consumed); rc = inflateInit2(&drec->stream, -15); } if (rc != Z_OK) return 0; goto restart; // if that still fails, try the other method we support } else if (drec->zlib_initialized == HTP_COMPRESSION_DEFLATE) { rc = inflateInit2(&drec->stream, 15 + 32); if (rc != Z_OK) return 0; drec->zlib_initialized = HTP_COMPRESSION_GZIP; consumed = htp_gzip_decompressor_probe(data, data_len); #if 0 printf("DEFLATE -> GZIP consumed %u\n", (uint)consumed); #endif goto restart; } else if (drec->zlib_initialized == HTP_COMPRESSION_GZIP) { rc = inflateInit2(&drec->stream, -15); if (rc != Z_OK) return 0; drec->zlib_initialized = HTP_COMPRESSION_DEFLATE; consumed = htp_gzip_decompressor_probe(data, data_len); #if 0 printf("GZIP -> DEFLATE consumed %u\n", (uint)consumed); #endif goto restart; } } return 0; restart: #if 0 gz_header y; gz_headerp x = &y; int res = inflateGetHeader(&drec->stream, x); printf("HEADER res %d x.os %d x.done %d\n", res, x->os, x->done); #endif *consumed_back = consumed; drec->restart++; return 1; } /** * Decompress a chunk of gzip-compressed data. * If we have more than one decompressor, call this function recursively. * * @param[in] drec * @param[in] d * @return HTP_OK on success, HTP_ERROR or some other negative integer on failure. */ static htp_status_t htp_gzip_decompressor_decompress(htp_decompressor_gzip_t *drec, htp_tx_data_t *d) { size_t consumed = 0; int rc = 0; // Pass-through the NULL chunk, which indicates the end of the stream. if (drec->passthrough) { htp_tx_data_t d2; d2.tx = d->tx; d2.data = d->data; d2.len = d->len; d2.is_last = d->is_last; htp_status_t callback_rc = drec->super.callback(&d2); if (callback_rc != HTP_OK) { return HTP_ERROR; } return HTP_OK; } if (d->data == NULL) { // Prepare data for callback. htp_tx_data_t dout; dout.tx = d->tx; dout.data = NULL; dout.len = 0; dout.is_last = d->is_last; if (drec->super.next != NULL && drec->zlib_initialized) { return htp_gzip_decompressor_decompress((htp_decompressor_gzip_t *)drec->super.next, &dout); } else { // Send decompressed data to the callback. htp_status_t callback_rc = drec->super.callback(&dout); if (callback_rc != HTP_OK) { inflateEnd(&drec->stream); drec->zlib_initialized = 0; return callback_rc; } } return HTP_OK; } restart: if (consumed > d->len) { htp_log(d->tx->connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "GZip decompressor: consumed > d->len"); return HTP_ERROR; } drec->stream.next_in = (unsigned char *) (d->data + consumed); drec->stream.avail_in = d->len - consumed; while (drec->stream.avail_in != 0) { // If there's no more data left in the // buffer, send that information out. if (drec->stream.avail_out == 0) { drec->crc = crc32(drec->crc, drec->buffer, GZIP_BUF_SIZE); // Prepare data for callback. htp_tx_data_t d2; d2.tx = d->tx; d2.data = drec->buffer; d2.len = GZIP_BUF_SIZE; d2.is_last = d->is_last; //if (drec->super.next != NULL) { if (drec->super.next != NULL && drec->zlib_initialized) { htp_tx_data_t d3; d3.tx = d->tx; d3.data = drec->buffer; d3.len = GZIP_BUF_SIZE; d3.is_last = d->is_last; return htp_gzip_decompressor_decompress((htp_decompressor_gzip_t *)drec->super.next, &d3); } else { // Send decompressed data to callback. htp_status_t callback_rc = drec->super.callback(&d2); if (callback_rc != HTP_OK) { inflateEnd(&drec->stream); drec->zlib_initialized = 0; return callback_rc; } } drec->stream.next_out = drec->buffer; drec->stream.avail_out = GZIP_BUF_SIZE; } if (drec->zlib_initialized) { rc = inflate(&drec->stream, Z_NO_FLUSH); } if (rc == Z_STREAM_END) { // How many bytes do we have? size_t len = GZIP_BUF_SIZE - drec->stream.avail_out; // Update CRC // Prepare data for the callback. htp_tx_data_t d2; d2.tx = d->tx; d2.data = drec->buffer; d2.len = len; d2.is_last = d->is_last; if (drec->super.next != NULL && drec->zlib_initialized) { htp_tx_data_t d3; d3.tx = d->tx; d3.data = drec->buffer; d3.len = len; d3.is_last = d->is_last; return htp_gzip_decompressor_decompress((htp_decompressor_gzip_t *)drec->super.next, &d3); } else { // Send decompressed data to the callback. htp_status_t callback_rc = drec->super.callback(&d2); if (callback_rc != HTP_OK) { inflateEnd(&drec->stream); drec->zlib_initialized = 0; return callback_rc; } } // TODO Handle trailer. return HTP_OK; } else if (rc != Z_OK) { htp_log(d->tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "GZip decompressor: inflate failed with %d", rc); inflateEnd(&drec->stream); // see if we want to restart the decompressor if (htp_gzip_decompressor_restart(drec, d->data, d->len, &consumed) == 1) { // we'll be restarting the compressor goto restart; } drec->zlib_initialized = 0; // all our inflate attempts have failed, simply // pass the raw data on to the callback in case // it's not compressed at all htp_tx_data_t d2; d2.tx = d->tx; d2.data = d->data; d2.len = d->len; d2.is_last = d->is_last; htp_status_t callback_rc = drec->super.callback(&d2); if (callback_rc != HTP_OK) { return HTP_ERROR; } /* successfully passed through, lets continue doing that */ drec->passthrough = 1; return HTP_OK; } } return HTP_OK; } /** * Shut down gzip decompressor. * * @param[in] drec */ static void htp_gzip_decompressor_destroy(htp_decompressor_gzip_t *drec) { if (drec == NULL) return; if (drec->zlib_initialized) { inflateEnd(&drec->stream); drec->zlib_initialized = 0; } free(drec->buffer); free(drec); } /** * Create a new decompressor instance. * * @param[in] connp * @param[in] format * @return New htp_decompressor_t instance on success, or NULL on failure. */ htp_decompressor_t *htp_gzip_decompressor_create(htp_connp_t *connp, enum htp_content_encoding_t format) { htp_decompressor_gzip_t *drec = calloc(1, sizeof (htp_decompressor_gzip_t)); if (drec == NULL) return NULL; drec->super.decompress = (int (*)(htp_decompressor_t *, htp_tx_data_t *))htp_gzip_decompressor_decompress; drec->super.destroy = (void (*)(htp_decompressor_t *))htp_gzip_decompressor_destroy; drec->super.next = NULL; drec->buffer = malloc(GZIP_BUF_SIZE); if (drec->buffer == NULL) { free(drec); return NULL; } // Initialize zlib. int rc; if (format == HTP_COMPRESSION_DEFLATE) { // Negative values activate raw processing, // which is what we need for deflate. rc = inflateInit2(&drec->stream, -15); } else { // Increased windows size activates gzip header processing. rc = inflateInit2(&drec->stream, 15 + 32); } if (rc != Z_OK) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "GZip decompressor: inflateInit2 failed with code %d", rc); inflateEnd(&drec->stream); free(drec->buffer); free(drec); return NULL; } drec->zlib_initialized = format; drec->stream.avail_out = GZIP_BUF_SIZE; drec->stream.next_out = drec->buffer; #if 0 if (format == COMPRESSION_DEFLATE) { drec->initialized = 1; } #endif return (htp_decompressor_t *) drec; } suricata-3.2.1/libhtp/htp/htp_version.h.in0000644000000000000000000000417113051004451015406 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_VERSION_H #define HTP_VERSION_H #ifdef __cplusplus extern "C" { #endif #define HTP_VERSION_STRING "@PACKAGE_VERSION@" #define HTP_VERSION_STRING_FULL "LibHTP v" HTP_VERSION_STRING #ifdef __cplusplus } #endif #endif /* HTP_VERSION_H */ suricata-3.2.1/libhtp/htp/htp_base64.c0000644000000000000000000001535613051004451014402 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ /* Adapted from the libb64 project (http://sourceforge.net/projects/libb64), which is in public domain. */ #include "bstr.h" #include "htp_base64.h" /** * Decode single base64-encoded character. * * @param[in] value_in * @return decoded character */ int htp_base64_decode_single(signed char value_in) { static const signed char decoding[] = {62, -1, -1, -1, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51}; static const signed char decoding_size = sizeof (decoding); value_in -= 43; if ((value_in < 0) || (value_in > decoding_size - 1)) return -1; return decoding[(int) value_in]; } /** * Initialize base64 decoder. * * @param[in] decoder */ void htp_base64_decoder_init(htp_base64_decoder *decoder) { decoder->step = step_a; decoder->plainchar = 0; } /** * Feed the supplied memory range to the decoder. * * @param[in] decoder * @param[in] _code_in * @param[in] length_in * @param[in] _plaintext_out * @param[in] length_out * @return how many bytes were placed into plaintext output */ int htp_base64_decode(htp_base64_decoder *decoder, const void *_code_in, int length_in, void *_plaintext_out, int length_out) { const unsigned char *code_in = (const unsigned char *)_code_in; unsigned char *plaintext_out = (unsigned char *)_plaintext_out; const unsigned char *codechar = code_in; unsigned char *plainchar = plaintext_out; signed char fragment; if (length_out <= 0) return 0; *plainchar = decoder->plainchar; switch (decoder->step) { while (1) { case step_a: do { if (codechar == code_in + length_in) { decoder->step = step_a; decoder->plainchar = *plainchar; return plainchar - plaintext_out; } fragment = (char) htp_base64_decode_single(*codechar++); } while (fragment < 0); *plainchar = (fragment & 0x03f) << 2; case step_b: do { if (codechar == code_in + length_in) { decoder->step = step_b; decoder->plainchar = *plainchar; return plainchar - plaintext_out; } fragment = (char) htp_base64_decode_single(*codechar++); } while (fragment < 0); *plainchar++ |= (fragment & 0x030) >> 4; *plainchar = (fragment & 0x00f) << 4; if (--length_out == 0) { return plainchar - plaintext_out; } case step_c: do { if (codechar == code_in + length_in) { decoder->step = step_c; decoder->plainchar = *plainchar; return plainchar - plaintext_out; } fragment = (char) htp_base64_decode_single(*codechar++); } while (fragment < 0); *plainchar++ |= (fragment & 0x03c) >> 2; *plainchar = (fragment & 0x003) << 6; if (--length_out == 0) { return plainchar - plaintext_out; } case step_d: do { if (codechar == code_in + length_in) { decoder->step = step_d; decoder->plainchar = *plainchar; return plainchar - plaintext_out; } fragment = (char) htp_base64_decode_single(*codechar++); } while (fragment < 0); *plainchar++ |= (fragment & 0x03f); if (--length_out == 0) { return plainchar - plaintext_out; } } } /* control should not reach here */ return plainchar - plaintext_out; } /** * Base64-decode input, given as bstring. * * @param[in] input * @return new base64-decoded bstring */ bstr *htp_base64_decode_bstr(bstr *input) { return htp_base64_decode_mem(bstr_ptr(input), bstr_len(input)); } /** * Base64-decode input, given as memory range. * * @param[in] data * @param[in] len * @return new base64-decoded bstring */ bstr *htp_base64_decode_mem(const void *data, size_t len) { htp_base64_decoder decoder; bstr *r = NULL; htp_base64_decoder_init(&decoder); unsigned char *tmpstr = malloc(len); if (tmpstr == NULL) return NULL; int resulting_len = htp_base64_decode(&decoder, data, len, tmpstr, len); if (resulting_len > 0) { r = bstr_dup_mem(tmpstr, resulting_len); } free(tmpstr); return r; } suricata-3.2.1/libhtp/htp/htp_urlencoded.h0000644000000000000000000000744713051004451015451 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_URLENCODED_H #define _HTP_URLENCODED_H #ifdef __cplusplus extern "C" { #endif typedef struct htp_urlenp_t htp_urlenp_t; typedef struct htp_urlen_param_t htp_urlen_param_t; #define HTP_URLENP_DEFAULT_PARAMS_SIZE 32 #define HTP_URLENP_STATE_KEY 1 #define HTP_URLENP_STATE_VALUE 2 // The MIME type that triggers the parser. Must be lowercase. #define HTP_URLENCODED_MIME_TYPE "application/x-www-form-urlencoded" #include "htp.h" /** * This is the main URLENCODED parser structure. It is used to store * parser configuration, temporary parsing data, as well as the parameters. */ struct htp_urlenp_t { /** The transaction this parser belongs to. */ htp_tx_t *tx; /** The character used to separate parameters. Defaults to & and should * not be changed without good reason. */ unsigned char argument_separator; /** Whether to perform URL-decoding on parameters. */ int decode_url_encoding; /** This table contains the list of parameters, indexed by name. */ htp_table_t *params; // Private fields; these are used during the parsing process only int _state; int _complete; bstr *_name; bstr_builder_t *_bb; }; /** * Holds one application/x-www-form-urlencoded parameter. */ struct htp_urlen_param_t { /** Parameter name. */ bstr *name; /** Parameter value. */ bstr *value; }; htp_urlenp_t *htp_urlenp_create(htp_tx_t *tx); void htp_urlenp_destroy(htp_urlenp_t *urlenp); void htp_urlenp_set_argument_separator(htp_urlenp_t *urlenp, unsigned char argument_separator); void htp_urlenp_set_decode_url_encoding(htp_urlenp_t *urlenp, int decode_url_encoding); htp_status_t htp_urlenp_parse_partial(htp_urlenp_t *urlenp, const void *data, size_t len); htp_status_t htp_urlenp_parse_complete(htp_urlenp_t *urlenp, const void *data, size_t len); htp_status_t htp_urlenp_finalize(htp_urlenp_t *urlenp); #ifdef __cplusplus } #endif #endif /* _HTP_URLENCODED_H */ suricata-3.2.1/libhtp/htp/htp_private.h0000644000000000000000000002426313051004451014772 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_PRIVATE_H #define _HTP_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #if defined(__cplusplus) && !defined(__STDC_FORMAT_MACROS) /* C99 requires that inttypes.h only exposes PRI* macros * for C++ implementations if this is defined: */ #define __STDC_FORMAT_MACROS #endif #include #include #include #include #include #include #include #include #include #include #include "htp.h" #include "htp_config_private.h" #include "htp_connection_parser_private.h" #include "htp_connection_private.h" #include "htp_list_private.h" #include "htp_multipart_private.h" #include "htp_table_private.h" #ifndef CR #define CR '\r' #endif #ifndef LF #define LF '\n' #endif #define HTP_FIELD_LIMIT_HARD 18000 #define HTP_FIELD_LIMIT_SOFT 9000 #define HTP_VALID_STATUS_MIN 100 #define HTP_VALID_STATUS_MAX 999 // Parser states, in the order in which they are // used as a single transaction is processed. htp_status_t htp_connp_REQ_IDLE(htp_connp_t *connp); htp_status_t htp_connp_REQ_LINE(htp_connp_t *connp); htp_status_t htp_connp_REQ_LINE_complete(htp_connp_t *connp); htp_status_t htp_connp_REQ_PROTOCOL(htp_connp_t *connp); htp_status_t htp_connp_REQ_HEADERS(htp_connp_t *connp); htp_status_t htp_connp_REQ_CONNECT_CHECK(htp_connp_t *connp); htp_status_t htp_connp_REQ_CONNECT_WAIT_RESPONSE(htp_connp_t *connp); htp_status_t htp_connp_REQ_CONNECT_PROBE_DATA(htp_connp_t *connp); htp_status_t htp_connp_REQ_BODY_DETERMINE(htp_connp_t *connp); htp_status_t htp_connp_REQ_BODY_IDENTITY(htp_connp_t *connp); htp_status_t htp_connp_REQ_BODY_CHUNKED_LENGTH(htp_connp_t *connp); htp_status_t htp_connp_REQ_BODY_CHUNKED_DATA(htp_connp_t *connp); htp_status_t htp_connp_REQ_BODY_CHUNKED_DATA_END(htp_connp_t *connp); htp_status_t htp_connp_REQ_FINALIZE(htp_connp_t *connp); htp_status_t htp_connp_REQ_IGNORE_DATA_AFTER_HTTP_0_9(htp_connp_t *connp); htp_status_t htp_connp_RES_IDLE(htp_connp_t *connp); htp_status_t htp_connp_RES_LINE(htp_connp_t *connp); htp_status_t htp_connp_RES_HEADERS(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_DETERMINE(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_IDENTITY_CL_KNOWN(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_CHUNKED_LENGTH(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_CHUNKED_DATA(htp_connp_t *connp); htp_status_t htp_connp_RES_BODY_CHUNKED_DATA_END(htp_connp_t *connp); htp_status_t htp_connp_RES_FINALIZE(htp_connp_t *connp); // Parsing functions htp_status_t htp_parse_request_line_generic(htp_connp_t *connp); htp_status_t htp_parse_request_line_generic_ex(htp_connp_t *connp, int nul_terminates); htp_status_t htp_parse_request_header_generic(htp_connp_t *connp, htp_header_t *h, unsigned char *data, size_t len); htp_status_t htp_process_request_header_generic(htp_connp_t *, unsigned char *data, size_t len); htp_status_t htp_parse_request_line_apache_2_2(htp_connp_t *connp); htp_status_t htp_process_request_header_apache_2_2(htp_connp_t *, unsigned char *data, size_t len); htp_status_t htp_parse_response_line_generic(htp_connp_t *connp); htp_status_t htp_parse_response_header_generic(htp_connp_t *connp, htp_header_t *h, unsigned char *data, size_t len); htp_status_t htp_process_response_header_generic(htp_connp_t *connp, unsigned char *data, size_t len); // Private transaction functions htp_status_t htp_tx_state_response_complete_ex(htp_tx_t *tx, int hybrid_mode); // Utility functions int htp_convert_method_to_number(bstr *); int htp_is_lws(int c); int htp_is_separator(int c); int htp_is_text(int c); int htp_is_token(int c); int htp_chomp(unsigned char *data, size_t *len); int htp_is_space(int c); int htp_parse_protocol(bstr *protocol); int htp_is_line_empty(unsigned char *data, size_t len); int htp_is_line_whitespace(unsigned char *data, size_t len); int htp_connp_is_line_folded(unsigned char *data, size_t len); int htp_is_folding_char(int c); int htp_connp_is_line_terminator(htp_connp_t *connp, unsigned char *data, size_t len); int htp_connp_is_line_ignorable(htp_connp_t *connp, unsigned char *data, size_t len); int htp_parse_uri(bstr *input, htp_uri_t **uri); htp_status_t htp_parse_hostport(bstr *authority, bstr **hostname, bstr **port, int *port_number, int *invalid); htp_status_t htp_parse_header_hostport(bstr *authority, bstr **hostname, bstr **port, int *port_number, uint64_t *flags); int htp_validate_hostname(bstr *hostname); int htp_parse_uri_hostport(htp_connp_t *connp, bstr *input, htp_uri_t *uri); int htp_normalize_parsed_uri(htp_tx_t *tx, htp_uri_t *parsed_uri_incomplete, htp_uri_t *parsed_uri); bstr *htp_normalize_hostname_inplace(bstr *input); void htp_replace_hostname(htp_connp_t *connp, htp_uri_t *parsed_uri, bstr *hostname); int htp_is_uri_unreserved(unsigned char c); int htp_decode_path_inplace(htp_tx_t *tx, bstr *path); int htp_prenormalize_uri_path_inplace(bstr *s, int *flags, int case_insensitive, int backslash, int decode_separators, int remove_consecutive); void htp_normalize_uri_path_inplace(bstr *s); void htp_utf8_decode_path_inplace(htp_cfg_t *cfg, htp_tx_t *tx, bstr *path); void htp_utf8_validate_path(htp_tx_t *tx, bstr *path); int64_t htp_parse_content_length(bstr *b); int64_t htp_parse_chunked_length(unsigned char *data, size_t len); int64_t htp_parse_positive_integer_whitespace(unsigned char *data, size_t len, int base); int htp_parse_status(bstr *status); int htp_parse_authorization_digest(htp_connp_t *connp, htp_header_t *auth_header); int htp_parse_authorization_basic(htp_connp_t *connp, htp_header_t *auth_header); void htp_print_log(FILE *stream, htp_log_t *log); void fprint_bstr(FILE *stream, const char *name, bstr *b); void fprint_raw_data(FILE *stream, const char *name, const void *data, size_t len); void fprint_raw_data_ex(FILE *stream, const char *name, const void *data, size_t offset, size_t len); char *htp_connp_in_state_as_string(htp_connp_t *connp); char *htp_connp_out_state_as_string(htp_connp_t *connp); char *htp_tx_request_progress_as_string(htp_tx_t *tx); char *htp_tx_response_progress_as_string(htp_tx_t *tx); bstr *htp_unparse_uri_noencode(htp_uri_t *uri); int htp_treat_response_line_as_body(htp_tx_t *tx); htp_status_t htp_req_run_hook_body_data(htp_connp_t *connp, htp_tx_data_t *d); htp_status_t htp_res_run_hook_body_data(htp_connp_t *connp, htp_tx_data_t *d); htp_status_t htp_ch_urlencoded_callback_request_body_data(htp_tx_data_t *d); htp_status_t htp_ch_urlencoded_callback_request_headers(htp_tx_t *tx); htp_status_t htp_ch_urlencoded_callback_request_line(htp_tx_t *tx); htp_status_t htp_ch_multipart_callback_request_body_data(htp_tx_data_t *d); htp_status_t htp_ch_multipart_callback_request_headers(htp_tx_t *tx); htp_status_t htp_php_parameter_processor(htp_param_t *p); int htp_transcode_params(htp_connp_t *connp, htp_table_t **params, int destroy_old); int htp_transcode_bstr(iconv_t cd, bstr *input, bstr **output); int htp_parse_single_cookie_v0(htp_connp_t *connp, unsigned char *data, size_t len); int htp_parse_cookies_v0(htp_connp_t *connp); int htp_parse_authorization(htp_connp_t *connp); htp_status_t htp_extract_quoted_string_as_bstr(unsigned char *data, size_t len, bstr **out, size_t *endoffset); htp_header_t *htp_connp_header_parse(htp_connp_t *, unsigned char *, size_t); htp_status_t htp_parse_ct_header(bstr *header, bstr **ct); htp_status_t htp_connp_req_receiver_finalize_clear(htp_connp_t *connp); htp_status_t htp_connp_res_receiver_finalize_clear(htp_connp_t *connp); htp_status_t htp_tx_finalize(htp_tx_t *tx); int htp_tx_is_complete(htp_tx_t *tx); htp_status_t htp_tx_state_request_complete_partial(htp_tx_t *tx); void htp_connp_tx_remove(htp_connp_t *connp, htp_tx_t *tx); void htp_tx_destroy_incomplete(htp_tx_t *tx); htp_status_t htp_tx_req_process_body_data_ex(htp_tx_t *tx, const void *data, size_t len); htp_status_t htp_tx_res_process_body_data_ex(htp_tx_t *tx, const void *data, size_t len); htp_status_t htp_tx_urldecode_uri_inplace(htp_tx_t *tx, bstr *input); htp_status_t htp_tx_urldecode_params_inplace(htp_tx_t *tx, bstr *input); void htp_connp_destroy_decompressors(htp_connp_t *connp); #ifndef HAVE_STRLCAT size_t strlcat(char *dst, const char *src, size_t size); #endif #ifndef HAVE_STRLCPY size_t strlcpy(char *dst, const char *src, size_t size); #endif #ifdef __cplusplus } #endif #endif /* _HTP_PRIVATE_H */ suricata-3.2.1/libhtp/htp/htp_response_generic.c0000644000000000000000000002512613051004451016644 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Generic response line parser. * * @param[in] connp * @return HTP status */ htp_status_t htp_parse_response_line_generic(htp_connp_t *connp) { htp_tx_t *tx = connp->out_tx; unsigned char *data = bstr_ptr(tx->response_line); size_t len = bstr_len(tx->response_line); size_t pos = 0; tx->response_protocol = NULL; tx->response_protocol_number = HTP_PROTOCOL_INVALID; tx->response_status = NULL; tx->response_status_number = HTP_STATUS_INVALID; tx->response_message = NULL; // Ignore whitespace at the beginning of the line. while ((pos < len) && (htp_is_space(data[pos]))) pos++; size_t start = pos; // Find the end of the protocol string. while ((pos < len) && (!htp_is_space(data[pos]))) pos++; if (pos - start == 0) return HTP_OK; tx->response_protocol = bstr_dup_mem(data + start, pos - start); if (tx->response_protocol == NULL) return HTP_ERROR; tx->response_protocol_number = htp_parse_protocol(tx->response_protocol); #ifdef HTP_DEBUG fprint_raw_data(stderr, "Response protocol", bstr_ptr(tx->response_protocol), bstr_len(tx->response_protocol)); fprintf(stderr, "Response protocol number: %d\n", tx->response_protocol_number); #endif // Ignore whitespace after the response protocol. while ((pos < len) && (htp_is_space(data[pos]))) pos++; if (pos == len) return HTP_OK; start = pos; // Find the next whitespace character. while ((pos < len) && (!htp_is_space(data[pos]))) pos++; if (pos - start == 0) return HTP_OK; tx->response_status = bstr_dup_mem(data + start, pos - start); if (tx->response_status == NULL) return HTP_ERROR; tx->response_status_number = htp_parse_status(tx->response_status); #ifdef HTP_DEBUG fprint_raw_data(stderr, "Response status (as text)", bstr_ptr(tx->response_status), bstr_len(tx->response_status)); fprintf(stderr, "Response status number: %d\n", tx->response_status_number); #endif // Ignore whitespace that follows the status code. while ((pos < len) && (isspace(data[pos]))) pos++; if (pos == len) return HTP_OK; // Assume the message stretches until the end of the line. tx->response_message = bstr_dup_mem(data + pos, len - pos); if (tx->response_message == NULL) return HTP_ERROR; #ifdef HTP_DEBUG fprint_raw_data(stderr, "Response status message", bstr_ptr(tx->response_message), bstr_len(tx->response_message)); #endif return HTP_OK; } /** * Generic response header parser. * * @param[in] connp * @param[in] h * @param[in] data * @param[in] len * @return HTP status */ htp_status_t htp_parse_response_header_generic(htp_connp_t *connp, htp_header_t *h, unsigned char *data, size_t len) { size_t name_start, name_end; size_t value_start, value_end; size_t prev; htp_chomp(data, &len); name_start = 0; // Look for the first colon. size_t colon_pos = 0; while ((colon_pos < len) && (data[colon_pos] != ':')) colon_pos++; if (colon_pos == len) { // Header line with a missing colon. h->flags |= HTP_FIELD_UNPARSEABLE; h->flags |= HTP_FIELD_INVALID; if (!(connp->out_tx->flags & HTP_FIELD_UNPARSEABLE)) { // Only once per transaction. connp->out_tx->flags |= HTP_FIELD_UNPARSEABLE; connp->out_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Response field invalid: missing colon."); } // Reset the position. We're going to treat this invalid header // as a header with an empty name. That will increase the probability // that the content will be inspected. colon_pos = 0; name_end = 0; value_start = 0; } else { // Header line with a colon. if (colon_pos == 0) { // Empty header name. h->flags |= HTP_FIELD_INVALID; if (!(connp->out_tx->flags & HTP_FIELD_INVALID)) { // Only once per transaction. connp->out_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Response field invalid: empty name."); } } name_end = colon_pos; // Ignore LWS after field-name. prev = name_end; while ((prev > name_start) && (htp_is_lws(data[prev - 1]))) { prev--; name_end--; h->flags |= HTP_FIELD_INVALID; if (!(connp->out_tx->flags & HTP_FIELD_INVALID)) { // Only once per transaction. connp->out_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Response field invalid: LWS after name."); } } value_start = colon_pos + 1; } // Header value. // Ignore LWS before field-content. while ((value_start < len) && (htp_is_lws(data[value_start]))) { value_start++; } // Look for the end of field-content. value_end = len; // Check that the header name is a token. size_t i = name_start; while (i < name_end) { if (!htp_is_token(data[i])) { h->flags |= HTP_FIELD_INVALID; if (!(connp->out_tx->flags & HTP_FIELD_INVALID)) { connp->out_tx->flags |= HTP_FIELD_INVALID; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Response header name is not a token."); } break; } i++; } // Now extract the name and the value. h->name = bstr_dup_mem(data + name_start, name_end - name_start); h->value = bstr_dup_mem(data + value_start, value_end - value_start); if ((h->name == NULL) || (h->value == NULL)) { bstr_free(h->name); bstr_free(h->value); return HTP_ERROR; } return HTP_OK; } /** * Generic response header line(s) processor, which assembles folded lines * into a single buffer before invoking the parsing function. * * @param[in] connp * @param[in] data * @param[in] len * @return HTP status */ htp_status_t htp_process_response_header_generic(htp_connp_t *connp, unsigned char *data, size_t len) { // Create a new header structure. htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return HTP_ERROR; if (htp_parse_response_header_generic(connp, h, data, len) != HTP_OK) { free(h); return HTP_ERROR; } #ifdef HTP_DEBUG fprint_bstr(stderr, "Header name", h->name); fprint_bstr(stderr, "Header value", h->value); #endif // Do we already have a header with the same name? htp_header_t *h_existing = htp_table_get(connp->out_tx->response_headers, h->name); if (h_existing != NULL) { // Keep track of repeated same-name headers. h_existing->flags |= HTP_FIELD_REPEATED; // Having multiple C-L headers is against the RFC but many // browsers ignore the subsequent headers if the values are the same. if (bstr_cmp_c_nocase(h->name, "Content-Length") == 0) { // Don't use string comparison here because we want to // ignore small formatting differences. int64_t existing_cl, new_cl; existing_cl = htp_parse_content_length(h_existing->value); new_cl = htp_parse_content_length(h->value); if ((existing_cl == -1) || (new_cl == -1) || (existing_cl != new_cl)) { // Ambiguous response C-L value. htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Ambiguous response C-L value"); bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } // Ignoring the new C-L header that has the same value as the previous ones. } else { // Add to the existing header. bstr *new_value = bstr_expand(h_existing->value, bstr_len(h_existing->value) + 2 + bstr_len(h->value)); if (new_value == NULL) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } h_existing->value = new_value; bstr_add_mem_noex(h_existing->value, (unsigned char *) ", ", 2); bstr_add_noex(h_existing->value, h->value); } // The new header structure is no longer needed. bstr_free(h->name); bstr_free(h->value); free(h); } else { // Add as a new header. if (htp_table_add(connp->out_tx->response_headers, h->name, h) != HTP_OK) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } } return HTP_OK; } suricata-3.2.1/libhtp/htp/htp.h0000644000000000000000000005212513051004451013236 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _HTP_H #define _HTP_H #ifdef __cplusplus extern "C" { #endif #include #include "htp_version.h" #include "htp_core.h" #include "bstr.h" #include "htp_base64.h" #include "htp_config.h" #include "htp_connection_parser.h" #include "htp_decompressors.h" #include "htp_hooks.h" #include "htp_list.h" #include "htp_multipart.h" #include "htp_table.h" #include "htp_transaction.h" #include "htp_urlencoded.h" #include "htp_utf8_decoder.h" /** * Represents a single TCP connection. */ struct htp_conn_t { /** Client IP address. */ char *client_addr; /** Client port. */ int client_port; /** Server IP address. */ char *server_addr; /** Server port. */ int server_port; /** * Transactions carried out on this connection. The list may contain * NULL elements when some of the transactions are deleted (and then * removed from a connection by calling htp_conn_remove_tx(). */ htp_list_t *transactions; /** Log messages associated with this connection. */ htp_list_t *messages; /** Parsing flags: HTP_CONN_PIPELINED. */ uint8_t flags; /** When was this connection opened? Can be NULL. */ htp_time_t open_timestamp; /** When was this connection closed? Can be NULL. */ htp_time_t close_timestamp; /** Inbound data counter. */ int64_t in_data_counter; /** Outbound data counter. */ int64_t out_data_counter; }; /** * Used to represent files that are seen during the processing of HTTP traffic. Most * commonly this refers to files seen in multipart/form-data payloads. In addition, PUT * request bodies can be treated as files. */ struct htp_file_t { /** Where did this file come from? Possible values: HTP_FILE_MULTIPART and HTP_FILE_PUT. */ enum htp_file_source_t source; /** File name, as provided (e.g., in the Content-Disposition multipart part header. */ bstr *filename; /** File length. */ int64_t len; /** The unique filename in which this file is stored on the filesystem, when applicable.*/ char *tmpname; /** The file descriptor used for external storage, or -1 if unused. */ int fd; }; /** * Represents a chunk of file data. */ struct htp_file_data_t { /** File information. */ htp_file_t *file; /** Pointer to the data buffer. */ const unsigned char *data; /** Buffer length. */ size_t len; }; /** * Represents a single log entry. */ struct htp_log_t { /** The connection parser associated with this log message. */ htp_connp_t *connp; /** The transaction associated with this log message, if any. */ htp_tx_t *tx; /** Log message. */ const char *msg; /** Message level. */ enum htp_log_level_t level; /** Message code. */ int code; /** File in which the code that emitted the message resides. */ const char *file; /** Line number on which the code that emitted the message resides. */ unsigned int line; }; /** * Represents a single request or response header. */ struct htp_header_t { /** Header name. */ bstr *name; /** Header value. */ bstr *value; /** Parsing flags; a combination of: HTP_FIELD_INVALID, HTP_FIELD_FOLDED, HTP_FIELD_REPEATED. */ uint64_t flags; }; /** * Represents a single request parameter. */ struct htp_param_t { /** Parameter name. */ bstr *name; /** Parameter value. */ bstr *value; /** Source of the parameter, for example HTP_SOURCE_QUERY_STRING. */ enum htp_data_source_t source; /** Type of the data structure referenced below. */ enum htp_parser_id_t parser_id; /** * Pointer to the parser data structure that contains * complete information about the parameter. Can be NULL. */ void *parser_data; }; /** * Represents a single HTTP transaction, which is a combination of a request and a response. */ struct htp_tx_t { /** The connection parser associated with this transaction. */ htp_connp_t *connp; /** The connection to which this transaction belongs. */ htp_conn_t *conn; /** The configuration structure associated with this transaction. */ htp_cfg_t *cfg; /** * Is the configuration structure shared with other transactions or connections? If * this field is set to HTP_CONFIG_PRIVATE, the transaction owns the configuration. */ int is_config_shared; /** The user data associated with this transaction. */ void *user_data; // Request fields /** Contains a count of how many empty lines were skipped before the request line. */ unsigned int request_ignored_lines; /** The first line of this request. */ bstr *request_line; /** Request method. */ bstr *request_method; /** Request method, as number. Available only if we were able to recognize the request method. */ enum htp_method_t request_method_number; /** * Request URI, raw, as given to us on the request line. This field can take different forms, * for example authority for CONNECT methods, absolute URIs for proxy requests, and the query * string when one is provided. Use htp_tx_t::parsed_uri if you need to access to specific * URI elements. Can be NULL if the request line contains only a request method (which is * an extreme case of HTTP/0.9, but passes in practice. */ bstr *request_uri; /** Request protocol, as text. Can be NULL if no protocol was specified. */ bstr *request_protocol; /** * Protocol version as a number. Multiply the high version number by 100, then add the low * version number. You should prefer to work the pre-defined HTP_PROTOCOL_* constants. */ int request_protocol_number; /** * Is this request using HTTP/0.9? We need a separate field for this purpose because * the protocol version alone is not sufficient to determine if HTTP/0.9 is used. For * example, if you submit "GET / HTTP/0.9" to Apache, it will not treat the request * as HTTP/0.9. */ int is_protocol_0_9; /** * This structure holds the individual components parsed out of the request URI, with * appropriate normalization and transformation applied, per configuration. No information * is added. In extreme cases when no URI is provided on the request line, all fields * will be NULL. (Well, except for port_number, which will be -1.) To inspect raw data, use * htp_tx_t::request_uri or htp_tx_t::parsed_uri_raw. */ htp_uri_t *parsed_uri; /** * This structure holds the individual components parsed out of the request URI, but * without any modification. The purpose of this field is to allow you to look at the data as it * was supplied on the request line. Fields can be NULL, depending on what data was supplied. * The port_number field is always -1. */ htp_uri_t *parsed_uri_raw; /* HTTP 1.1 RFC * * 4.3 Message Body * * The message-body (if any) of an HTTP message is used to carry the * entity-body associated with the request or response. The message-body * differs from the entity-body only when a transfer-coding has been * applied, as indicated by the Transfer-Encoding header field (section * 14.41). * * message-body = entity-body * | */ /** * The length of the request message-body. In most cases, this value * will be the same as request_entity_len. The values will be different * if request compression or chunking were applied. In that case, * request_message_len contains the length of the request body as it * has been seen over TCP; request_entity_len contains length after * de-chunking and decompression. */ int64_t request_message_len; /** * The length of the request entity-body. In most cases, this value * will be the same as request_message_len. The values will be different * if request compression or chunking were applied. In that case, * request_message_len contains the length of the request body as it * has been seen over TCP; request_entity_len contains length after * de-chunking and decompression. */ int64_t request_entity_len; /** Parsed request headers. */ htp_table_t *request_headers; /** * Request transfer coding. Can be one of HTP_CODING_UNKNOWN (body presence not * determined yet), HTP_CODING_IDENTITY, HTP_CODING_CHUNKED, HTP_CODING_NO_BODY, * and HTP_CODING_UNRECOGNIZED. */ enum htp_transfer_coding_t request_transfer_coding; /** Request body compression. */ enum htp_content_encoding_t request_content_encoding; /** * This field contain the request content type when that information is * available in request headers. The contents of the field will be converted * to lowercase and any parameters (e.g., character set information) removed. */ bstr *request_content_type; /** * Contains the value specified in the Content-Length header. The value of this * field will be -1 from the beginning of the transaction and until request * headers are processed. It will stay -1 if the C-L header was not provided, * or if the value in it cannot be parsed. */ int64_t request_content_length; /** * Transaction-specific REQUEST_BODY_DATA hook. Behaves as * the configuration hook with the same name. */ htp_hook_t *hook_request_body_data; /** * Transaction-specific RESPONSE_BODY_DATA hook. Behaves as * the configuration hook with the same name. */ htp_hook_t *hook_response_body_data; /** * Query string URLENCODED parser. Available only * when the query string is not NULL and not empty. */ htp_urlenp_t *request_urlenp_query; /** * Request body URLENCODED parser. Available only when the request body is in the * application/x-www-form-urlencoded format and the parser was configured to run. */ htp_urlenp_t *request_urlenp_body; /** * Request body MULTIPART parser. Available only when the body is in the * multipart/form-data format and the parser was configured to run. */ htp_mpartp_t *request_mpartp; /** Request parameters. */ htp_table_t *request_params; /** Request cookies */ htp_table_t *request_cookies; /** Authentication type used in the request. */ enum htp_auth_type_t request_auth_type; /** Authentication username. */ bstr *request_auth_username; /** Authentication password. Available only when htp_tx_t::request_auth_type is HTP_AUTH_BASIC. */ bstr *request_auth_password; /** * Request hostname. Per the RFC, the hostname will be taken from the Host header * when available. If the host information is also available in the URI, it is used * instead of whatever might be in the Host header. Can be NULL. This field does * not contain port information. */ bstr *request_hostname; /** * Request port number, if presented. The rules for htp_tx_t::request_host apply. Set to * -1 by default. */ int request_port_number; // Response fields /** How many empty lines did we ignore before reaching the status line? */ unsigned int response_ignored_lines; /** Response line. */ bstr *response_line; /** Response protocol, as text. Can be NULL. */ bstr *response_protocol; /** * Response protocol as number. Available only if we were able to parse the protocol version, * HTP_PROTOCOL_INVALID otherwise. HTP_PROTOCOL_UNKNOWN until parsing is attempted. */ int response_protocol_number; /** * Response status code, as text. Starts as NULL and can remain NULL on * an invalid response that does not specify status code. */ bstr *response_status; /** * Response status code, available only if we were able to parse it, HTP_STATUS_INVALID * otherwise. HTP_STATUS_UNKNOWN until parsing is attempted. */ int response_status_number; /** * This field is set by the protocol decoder with it thinks that the * backend server will reject a request with a particular status code. */ int response_status_expected_number; /** The message associated with the response status code. Can be NULL. */ bstr *response_message; /** Have we seen the server respond with a 100 response? */ int seen_100continue; /** Parsed response headers. Contains instances of htp_header_t. */ htp_table_t *response_headers; /* HTTP 1.1 RFC * * 4.3 Message Body * * The message-body (if any) of an HTTP message is used to carry the * entity-body associated with the request or response. The message-body * differs from the entity-body only when a transfer-coding has been * applied, as indicated by the Transfer-Encoding header field (section * 14.41). * * message-body = entity-body * | */ /** * The length of the response message-body. In most cases, this value * will be the same as response_entity_len. The values will be different * if response compression or chunking were applied. In that case, * response_message_len contains the length of the response body as it * has been seen over TCP; response_entity_len contains the length after * de-chunking and decompression. */ int64_t response_message_len; /** * The length of the response entity-body. In most cases, this value * will be the same as response_message_len. The values will be different * if request compression or chunking were applied. In that case, * response_message_len contains the length of the response body as it * has been seen over TCP; response_entity_len contains length after * de-chunking and decompression. */ int64_t response_entity_len; /** * Contains the value specified in the Content-Length header. The value of this * field will be -1 from the beginning of the transaction and until response * headers are processed. It will stay -1 if the C-L header was not provided, * or if the value in it cannot be parsed. */ int64_t response_content_length; /** * Response transfer coding, which indicates if there is a response body, * and how it is transported (e.g., as-is, or chunked). */ enum htp_transfer_coding_t response_transfer_coding; /** * Response body compression, which indicates if compression is used * for the response body. This field is an interpretation of the information * available in response headers. */ enum htp_content_encoding_t response_content_encoding; /** * Response body compression processing information, which is related to how * the library is going to process (or has processed) a response body. Changing * this field mid-processing can influence library actions. For example, setting * this field to HTP_COMPRESSION_NONE in a RESPONSE_HEADERS callback will prevent * decompression. */ enum htp_content_encoding_t response_content_encoding_processing; /** * This field will contain the response content type when that information * is available in response headers. The contents of the field will be converted * to lowercase and any parameters (e.g., character set information) removed. */ bstr *response_content_type; // Common fields /** * Parsing flags; a combination of: HTP_REQUEST_INVALID_T_E, HTP_INVALID_FOLDING, * HTP_REQUEST_SMUGGLING, HTP_MULTI_PACKET_HEAD, and HTP_FIELD_UNPARSEABLE. */ uint64_t flags; /** Request progress. */ enum htp_tx_req_progress_t request_progress; /** Response progress. */ enum htp_tx_res_progress_t response_progress; /** Transaction index on the connection. */ size_t index; }; /** * This structure is used to pass transaction data (for example * request and response body buffers) to callbacks. */ struct htp_tx_data_t { /** Transaction pointer. */ htp_tx_t *tx; /** Pointer to the data buffer. */ const unsigned char *data; /** Buffer length. */ size_t len; /** * Indicator if this chunk of data is the last in the series. Currently * used only by REQUEST_HEADER_DATA, REQUEST_TRAILER_DATA, RESPONSE_HEADER_DATA, * and RESPONSE_TRAILER_DATA callbacks. */ int is_last; }; /** * URI structure. Each of the fields provides access to a single * URI element. Where an element is not present in a URI, the * corresponding field will be set to NULL or -1, depending on the * field type. */ struct htp_uri_t { /** Scheme, e.g., "http". */ bstr *scheme; /** Username. */ bstr *username; /** Password. */ bstr *password; /** Hostname. */ bstr *hostname; /** Port, as string. */ bstr *port; /** * Port, as number. This field will contain HTP_PORT_NONE if there was * no port information in the URI and HTP_PORT_INVALID if the port information * was invalid (e.g., it's not a number or it falls out of range. */ int port_number; /** The path part of this URI. */ bstr *path; /** Query string. */ bstr *query; /** * Fragment identifier. This field will rarely be available in a server-side * setting, but it's not impossible to see it. */ bstr *fragment; }; /** * Frees all data contained in the uri, and then the uri itself. * * @param[in] uri */ void htp_uri_free(htp_uri_t *uri); /** * Allocates and initializes a new htp_uri_t structure. * * @return New structure, or NULL on memory allocation failure. */ htp_uri_t *htp_uri_alloc(void); /** * Creates a new log entry and stores it with the connection. The file and line * parameters are typically auto-generated using the HTP_LOG_MARK macro. * * @param[in] connp * @param[in] file * @param[in] line * @param[in] level * @param[in] code * @param[in] fmt * @param[in] ... */ void htp_log(htp_connp_t *connp, const char *file, int line, enum htp_log_level_t level, int code, const char *fmt, ...); /** * Performs in-place decoding of the input string, according to the configuration specified * by cfg and ctx. On output, various flags (HTP_URLEN_*) might be set. * * @param[in] cfg * @param[in] ctx * @param[in] input * @param[out] flags * * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_urldecode_inplace(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags); /** * Performs in-place decoding of the input string, according to the configuration specified * by cfg and ctx. On output, various flags (HTP_URLEN_*) might be set. If something in the * input would cause a particular server to respond with an error, the appropriate status * code will be set. * * @param[in] cfg * @param[in] ctx * @param[in] input * @param[out] flags * @param[out] expected_status_code 0 by default, or status code as necessary * * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_urldecode_inplace_ex(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags, int *expected_status_code); /** * Returns the LibHTP version string. * * @return LibHTP version, for example "LibHTP v0.5.x". */ char *htp_get_version(void); #ifdef __cplusplus } #endif #endif /* _HTP_H */ suricata-3.2.1/libhtp/htp/htp_hooks.c0000644000000000000000000001202113051004451014423 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" htp_hook_t *htp_hook_copy(const htp_hook_t *hook) { if (hook == NULL) return NULL; htp_hook_t *copy = htp_hook_create(); if (copy == NULL) return NULL; for (size_t i = 0, n = htp_list_size(hook->callbacks); i < n; i++) { htp_callback_t *callback = htp_list_get(hook->callbacks, i); if (htp_hook_register(©, callback->fn) != HTP_OK) { htp_hook_destroy(copy); return NULL; } } return copy; } htp_hook_t *htp_hook_create(void) { htp_hook_t *hook = calloc(1, sizeof (htp_hook_t)); if (hook == NULL) return NULL; hook->callbacks = (htp_list_array_t *) htp_list_array_create(4); if (hook->callbacks == NULL) { free(hook); return NULL; } return hook; } void htp_hook_destroy(htp_hook_t *hook) { if (hook == NULL) return; for (size_t i = 0, n = htp_list_size(hook->callbacks); i < n; i++) { free((htp_callback_t *) htp_list_get(hook->callbacks, i)); } htp_list_array_destroy(hook->callbacks); free(hook); } htp_status_t htp_hook_register(htp_hook_t **hook, const htp_callback_fn_t callback_fn) { if (hook == NULL) return HTP_ERROR; htp_callback_t *callback = calloc(1, sizeof (htp_callback_t)); if (callback == NULL) return HTP_ERROR; callback->fn = callback_fn; // Create a new hook if one does not exist int hook_created = 0; if (*hook == NULL) { hook_created = 1; *hook = htp_hook_create(); if (*hook == NULL) { free(callback); return HTP_ERROR; } } // Add callback if (htp_list_array_push((*hook)->callbacks, callback) != HTP_OK) { if (hook_created) { free(*hook); } free(callback); return HTP_ERROR; } return HTP_OK; } htp_status_t htp_hook_run_all(htp_hook_t *hook, void *user_data) { if (hook == NULL) return HTP_OK; // Loop through the registered callbacks, giving each a chance to run. for (size_t i = 0, n = htp_list_size(hook->callbacks); i < n; i++) { htp_callback_t *callback = htp_list_get(hook->callbacks, i); htp_status_t rc = callback->fn(user_data); // A hook can return HTP_OK to say that it did some work, // or HTP_DECLINED to say that it did no work. Anything else // is treated as an error. if ((rc != HTP_OK) && (rc != HTP_DECLINED)) { return rc; } } return HTP_OK; } htp_status_t htp_hook_run_one(htp_hook_t *hook, void *user_data) { if (hook == NULL) return HTP_DECLINED; for (size_t i = 0, n = htp_list_size(hook->callbacks); i < n; i++) { htp_callback_t *callback = htp_list_get(hook->callbacks, i); htp_status_t rc = callback->fn(user_data); // A hook can return HTP_DECLINED to say that it did no work, // and we'll ignore that. If we see HTP_OK or anything else, // we stop processing (because it was either a successful // handling or an error). if (rc != HTP_DECLINED) { // Return HTP_OK or an error. return rc; } } // No hook wanted to process the callback. return HTP_DECLINED; } suricata-3.2.1/libhtp/htp/bstr.h0000644000000000000000000004506113051004451013416 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _BSTR_H #define _BSTR_H #ifdef __cplusplus extern "C" { #endif typedef struct bstr_t bstr; #include #include #include #include #include "bstr_builder.h" // Data structures struct bstr_t { /** The length of the string stored in the buffer. */ size_t len; /** The current size of the buffer. If there is extra room in the * buffer the string will be able to expand without reallocation. */ size_t size; /** Optional buffer pointer. If this pointer is NULL the string buffer * will immediately follow this structure. If the pointer is not NUL, * it points to the actual buffer used, and there's no data following * this structure. */ unsigned char *realptr; }; // Defines #define bstr_len(X) ((*(X)).len) #define bstr_size(X) ((*(X)).size) #define bstr_ptr(X) ( ((*(X)).realptr == NULL) ? ((unsigned char *)(X) + sizeof(bstr)) : (unsigned char *)(*(X)).realptr ) #define bstr_realptr(X) ((*(X)).realptr) // Functions /** * Append source bstring to destination bstring, growing destination if * necessary. If the destination bstring is expanded, the pointer will change. * You must replace the original destination pointer with the returned one. * Destination is not changed on memory allocation failure. * * @param[in] bdestination * @param[in] bsource * @return Updated bstring, or NULL on memory allocation failure. */ bstr *bstr_add(bstr *bdestination, const bstr *bsource); /** * Append a NUL-terminated source to destination, growing destination if * necessary. If the string is expanded, the pointer will change. You must * replace the original destination pointer with the returned one. Destination * is not changed on memory allocation failure. * * @param[in] b * @param[in] cstr * @return Updated bstring, or NULL on memory allocation failure. */ bstr *bstr_add_c(bstr *b, const char *cstr); /** * Append as many bytes from the source to destination bstring. The * destination storage will not be expanded if there is not enough space in it * already to accommodate all of the data. * * @param[in] b * @param[in] cstr * @return The destination bstring. */ bstr *bstr_add_c_noex(bstr *b, const char *cstr); /** * Append a memory region to destination, growing destination if necessary. If * the string is expanded, the pointer will change. You must replace the * original destination pointer with the returned one. Destination is not * changed on memory allocation failure. * * @param[in] b * @param[in] data * @param[in] len * @return Updated bstring, or NULL on memory allocation failure. */ bstr *bstr_add_mem(bstr *b, const void *data, size_t len); /** * Append as many bytes from the source to destination bstring. The * destination storage will not be expanded if there is not enough space in it * already to accommodate all of the data. * * @param[in] b * @param[in] data * @param[in] len * @return The destination bstring. */ bstr *bstr_add_mem_noex(bstr *b, const void *data, size_t len); /** * Append as many bytes from the source bstring to destination bstring. The * destination storage will not be expanded if there is not enough space in it * already to accommodate all of the data. * * @param[in] bdestination * @param[in] bsource * @return The destination bstring. */ bstr *bstr_add_noex(bstr *bdestination, const bstr *bsource); /** * Adjust bstring length. You will need to use this method whenever * you work directly with the string contents, and end up changing * its length by direct structure manipulation. * * @param[in] b * @param[in] newlen */ void bstr_adjust_len(bstr *b, size_t newlen); /** * Change the external pointer used by bstring. You will need to use this * function only if you're messing with bstr internals. Use with caution. * * @param[in] b * @param[in] newrealptr */ void bstr_adjust_realptr(bstr *b, void *newrealptr); /** * Adjust bstring size. This does not change the size of the storage behind * the bstring, just changes the field that keeps track of how many bytes * there are in the storage. You will need to use this function only if * you're messing with bstr internals. Use with caution. * * @param[in] b * @param[in] newsize */ void bstr_adjust_size(bstr *b, size_t newsize); /** * Allocate a zero-length bstring, reserving space for at least size bytes. * * @param[in] size * @return New string instance */ bstr *bstr_alloc(size_t size); /** * Checks whether bstring begins with another bstring. Case sensitive. * * @param[in] bhaystack * @param[in] bneedle * @return 1 if true, otherwise 0. */ int bstr_begins_with(const bstr *bhaystack, const bstr *bneedle); /** * Checks whether bstring begins with NUL-terminated string. Case sensitive. * * @param[in] bhaystack * @param[in] cneedle * @return 1 if true, otherwise 0. */ int bstr_begins_with_c(const bstr *bhaystack, const char *cneedle); /** * Checks whether bstring begins with NUL-terminated string. Case insensitive. * * @param[in] bhaystack * @param[in] cneedle * @return 1 if true, otherwise 0. */ int bstr_begins_with_c_nocase(const bstr *bhaystack, const char *cneedle); /** * Checks whether the bstring begins with the given memory block. Case sensitive. * * @param[in] bhaystack * @param[in] data * @param[in] len * @return 1 if true, otherwise 0. */ int bstr_begins_with_mem(const bstr *bhaystack, const void *data, size_t len); /** * Checks whether bstring begins with memory block. Case insensitive. * * @param[in] bhaystack * @param[in] data * @param[in] len * @return 1 if true, otherwise 0. */ int bstr_begins_with_mem_nocase(const bstr *bhaystack, const void *data, size_t len); /** * Checks whether bstring begins with another bstring. Case insensitive. * * @param[in] bhaystack * @param[in] cneedle * @return 1 if true, otherwise 0. */ int bstr_begins_with_nocase(const bstr *bhaystack, const bstr *cneedle); /** * Return the byte at the given position. * * @param[in] b * @param[in] pos * @return The byte at the given location, or -1 if the position is out of range. */ int bstr_char_at(const bstr *b, size_t pos); /** * Return the byte at the given position, counting from the end of the string (e.g., * byte at position 0 is the last byte in the string.) * * @param[in] b * @param[in] pos * @return The byte at the given location, or -1 if the position is out of range. */ int bstr_char_at_end(const bstr *b, size_t pos); /** * Remove the last byte from bstring, assuming it contains at least one byte. This * function will not reduce the storage that backs the string, only the amount * of data used. * * @param[in] b */ void bstr_chop(bstr *b); /** * Return the first position of the provided byte. * * @param[in] b * @param[in] c * @return The first position of the byte, or -1 if it could not be found */ int bstr_chr(const bstr *b, int c); /** * Case-sensitive comparison of two bstrings. * * @param[in] b1 * @param[in] b2 * @return Zero on string match, 1 if b1 is greater than b2, and -1 if b2 is * greater than b1. */ int bstr_cmp(const bstr *b1, const bstr *b2); /** * Case-sensitive comparison of a bstring and a NUL-terminated string. * * @param[in] b * @param[in] cstr * @return Zero on string match, 1 if b is greater than cstr, and -1 if cstr is * greater than b. */ int bstr_cmp_c(const bstr *b, const char *cstr); /** * Case-insensitive comparison of a bstring with a NUL-terminated string. * * @param[in] b * @param[in] cstr * @return Zero on string match, 1 if b is greater than cstr, and -1 if cstr is greater than b. */ int bstr_cmp_c_nocase(const bstr *b, const char *cstr); /** * Performs a case-sensitive comparison of a bstring with a memory region. * * @param[in] b * @param[in] data * @param[in] len * @return Zero ona match, 1 if b is greater than data, and -1 if data is greater than b. */ int bstr_cmp_mem(const bstr *b, const void *data, size_t len); /** * Performs a case-insensitive comparison of a bstring with a memory region. * * @param[in] b * @param[in] data * @param[in] len * @return Zero ona match, 1 if b is greater than data, and -1 if data is greater than b. */ int bstr_cmp_mem_nocase(const bstr *b, const void *data, size_t len); /** * Case-insensitive comparison two bstrings. * * @param[in] b1 * @param[in] b2 * @return Zero on string match, 1 if b1 is greater than b2, and -1 if b2 is * greater than b1. */ int bstr_cmp_nocase(const bstr *b1, const bstr *b2); /** * Create a new bstring by copying the provided bstring. * * @param[in] b * @return New bstring, or NULL if memory allocation failed. */ bstr *bstr_dup(const bstr *b); /** * Create a new bstring by copying the provided NUL-terminated string. * * @param[in] cstr * @return New bstring, or NULL if memory allocation failed. */ bstr *bstr_dup_c(const char *cstr); /** * Create a new bstring by copying a part of the provided bstring. * * @param[in] b * @param[in] offset * @param[in] len * @return New bstring, or NULL if memory allocation failed. */ bstr *bstr_dup_ex(const bstr *b, size_t offset, size_t len); /** * Create a copy of the provided bstring, then convert it to lowercase. * * @param[in] b * @return New bstring, or NULL if memory allocation failed */ bstr *bstr_dup_lower(const bstr *b); /** * Create a new bstring by copying the provided memory region. * * @param[in] data * @param[in] len * @return New bstring, or NULL if memory allocation failed */ bstr *bstr_dup_mem(const void *data, size_t len); /** * Expand internal bstring storage to support at least newsize bytes. The storage * is not expanded if the current size is equal or greater to newsize. Because * realloc is used underneath, the old pointer to bstring may no longer be valid * after this function completes successfully. * * @param[in] b * @param[in] newsize * @return Updated string instance, or NULL if memory allocation failed or if * attempt was made to "expand" the bstring to a smaller size. */ bstr *bstr_expand(bstr *b, size_t newsize); /** * Deallocate the supplied bstring instance and set it to NULL. Allows NULL on * input. * * @param[in] b */ void bstr_free(bstr *b); /** * Find the needle in the haystack. * * @param[in] bhaystack * @param[in] bneedle * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of(const bstr *bhaystack, const bstr *bneedle); /** * Find the needle in the haystack, ignoring case differences. * * @param[in] bhaystack * @param[in] bneedle * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of_nocase(const bstr *bhaystack, const bstr *bneedle); /** * Find the needle in the haystack, with the needle being a NUL-terminated * string. * * @param[in] bhaystack * @param[in] cneedle * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of_c(const bstr *bhaystack, const char *cneedle); /** * Find the needle in the haystack, with the needle being a NUL-terminated * string. Ignore case differences. * * @param[in] bhaystack * @param[in] cneedle * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of_c_nocase(const bstr *bhaystack, const char *cneedle); /** * Find the needle in the haystack, with the needle being a memory region. * * @param[in] bhaystack * @param[in] data * @param[in] len * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of_mem(const bstr *bhaystack, const void *data, size_t len); /** * Find the needle in the haystack, with the needle being a memory region. * Ignore case differences. * * @param[in] bhaystack * @param[in] data * @param[in] len * @return Position of the match, or -1 if the needle could not be found. */ int bstr_index_of_mem_nocase(const bstr *bhaystack, const void *data, size_t len); /** * Return the last position of a character (byte). * * @param[in] b * @param[in] c * @return The last position of the character, or -1 if it could not be found. */ int bstr_rchr(const bstr *b, int c); /** * Convert bstring to lowercase. This function converts the supplied string, * it does not create a new string. * * @param[in] b * @return The same bstring received on input */ bstr *bstr_to_lowercase(bstr *b); /** * Case-sensitive comparison of two memory regions. * * @param[in] data1 * @param[in] len1 * @param[in] data2 * @param[in] len2 * @return Zero if the memory regions are identical, 1 if data1 is greater than * data2, and -1 if data2 is greater than data1. */ int bstr_util_cmp_mem(const void *data1, size_t len1, const void *data2, size_t len2); /** * Case-insensitive comparison of two memory regions. * * @param[in] data1 * @param[in] len1 * @param[in] data2 * @param[in] len2 * @return Zero if the memory regions are identical, 1 if data1 is greater than * data2, and -1 if data2 is greater than data1. */ int bstr_util_cmp_mem_nocase(const void *data1, size_t len1, const void *data2, size_t len2); /** * Convert contents of a memory region to a positive integer. * * @param[in] data * @param[in] len * @param[in] base The desired number base. * @param[in] lastlen Points to the first unused byte in the region * @return If the conversion was successful, this function returns the * number. When the conversion fails, -1 will be returned when not * one valid digit was found, and -2 will be returned if an overflow * occurred. */ int64_t bstr_util_mem_to_pint(const void *data, size_t len, int base, size_t *lastlen); /** * Searches a memory block for the given NUL-terminated string. Case sensitive. * * @param[in] data * @param[in] len * @param[in] cstr * @return Index of the first location of the needle on success, or -1 if the needle was not found. */ int bstr_util_mem_index_of_c(const void *data, size_t len, const char *cstr); /** * Searches a memory block for the given NUL-terminated string. Case insensitive. * * @param[in] data * @param[in] len * @param[in] cstr * @return Index of the first location of the needle on success, or -1 if the needle was not found. */ int bstr_util_mem_index_of_c_nocase(const void *data, size_t len, const char *cstr); /** * Searches the haystack memory block for the needle memory block. Case sensitive. * * @param data1 * @param len1 * @param data2 * @param len2 * @return Index of the first location of the needle on success, or -1 if the needle was not found. */ int bstr_util_mem_index_of_mem(const void *data1, size_t len1, const void *data2, size_t len2); /** * Searches the haystack memory block for the needle memory block. Case sensitive. * * @param data1 * @param len1 * @param data2 * @param len2 * @return Index of the first location of the needle on success, or -1 if the needle was not found. */ int bstr_util_mem_index_of_mem_nocase(const void *data1, size_t len1, const void *data2, size_t len2); /** * Removes whitespace from the beginning and the end of a memory region. The data * itself is not modified; this function only adjusts the provided pointers. * * @param[in,out] data * @param[in,out] len */ void bstr_util_mem_trim(unsigned char **data, size_t *len); /** * Take the provided memory region, allocate a new memory buffer, and construct * a NUL-terminated string, replacing each NUL byte with "\0" (two bytes). The * caller is responsible to keep track of the allocated memory area and free * it once it is no longer needed. * * @param[in] data * @param[in] len * @return The newly created NUL-terminated string, or NULL in case of memory * allocation failure. */ char *bstr_util_memdup_to_c(const void *data, size_t len); /** * Create a new NUL-terminated string out of the provided bstring. If NUL bytes * are contained in the bstring, each will be replaced with "\0" (two characters). * The caller is responsible to keep track of the allocated memory area and free * it once it is no longer needed. * * @param[in] b * @return The newly created NUL-terminated string, or NULL in case of memory * allocation failure. */ char *bstr_util_strdup_to_c(const bstr *b); /** * Create a new bstring from the provided NUL-terminated string and without * copying the data. The caller must ensure that the input string continues * to point to a valid memory location for as long as the bstring is used. * * @param[in] cstr * @return New bstring, or NULL on memory allocation failure. */ bstr *bstr_wrap_c(const char *cstr); /** * Create a new bstring from the provided memory buffer without * copying the data. The caller must ensure that the buffer remains * valid for as long as the bstring is used. * * @param[in] data * @param[in] len * @return New bstring, or NULL on memory allocation failure. */ bstr *bstr_wrap_mem(const void *data, size_t len); #ifdef __cplusplus } #endif #endif /* _BSTR_H */ suricata-3.2.1/libhtp/htp/htp_connection_parser.h0000644000000000000000000001664613051004451017041 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CONNECTION_PARSER_H #define HTP_CONNECTION_PARSER_H #ifdef __cplusplus extern "C" { #endif /** * Clears the most recent error, if any. * * @param[in] connp */ void htp_connp_clear_error(htp_connp_t *connp); /** * Closes the connection associated with the supplied parser. * * @param[in] connp * @param[in] timestamp Optional. */ void htp_connp_close(htp_connp_t *connp, const htp_time_t *timestamp); /** * Creates a new connection parser using the provided configuration. Because * the configuration structure is used directly, in a multithreaded environment * you are not allowed to change the structure, ever. If you have a need to * change configuration on per-connection basis, make a copy of the configuration * structure to go along with every connection parser. * * @param[in] cfg * @return New connection parser instance, or NULL on error. */ htp_connp_t *htp_connp_create(htp_cfg_t *cfg); /** * Destroys the connection parser and its data structures, leaving * all the data (connection, transactions, etc) intact. * * @param[in] connp */ void htp_connp_destroy(htp_connp_t *connp); /** * Destroys the connection parser, its data structures, as well * as the connection and its transactions. * * @param[in] connp */ void htp_connp_destroy_all(htp_connp_t *connp); /** * Returns the connection associated with the connection parser. * * @param[in] connp * @return htp_conn_t instance, or NULL if one is not available. */ htp_conn_t *htp_connp_get_connection(const htp_connp_t *connp); /** * Retrieves the pointer to the active inbound transaction. In connection * parsing mode there can be many open transactions, and up to 2 active * transactions at any one time. This is due to HTTP pipelining. Can be NULL. * * @param[in] connp * @return Active inbound transaction, or NULL if there isn't one. */ htp_tx_t *htp_connp_get_in_tx(const htp_connp_t *connp); /** * Returns the last error that occurred with this connection parser. Do note, however, * that the value in this field will only be valid immediately after an error condition, * but it is not guaranteed to remain valid if the parser is invoked again. * * @param[in] connp * @return A pointer to an htp_log_t instance if there is an error, or NULL * if there isn't. */ htp_log_t *htp_connp_get_last_error(const htp_connp_t *connp); /** * Retrieves the pointer to the active outbound transaction. In connection * parsing mode there can be many open transactions, and up to 2 active * transactions at any one time. This is due to HTTP pipelining. Can be NULL. * * @param[in] connp * @return Active outbound transaction, or NULL if there isn't one. */ htp_tx_t *htp_connp_get_out_tx(const htp_connp_t *connp); /** * Retrieve the user data associated with this connection parser. * * @param[in] connp * @return User data, or NULL if there isn't any. */ void *htp_connp_get_user_data(const htp_connp_t *connp); /** * Opens connection. * * @param[in] connp * @param[in] client_addr Client address * @param[in] client_port Client port * @param[in] server_addr Server address * @param[in] server_port Server port * @param[in] timestamp Optional. */ void htp_connp_open(htp_connp_t *connp, const char *client_addr, int client_port, const char *server_addr, int server_port, htp_time_t *timestamp); /** * Associate user data with the supplied parser. * * @param[in] connp * @param[in] user_data */ void htp_connp_set_user_data(htp_connp_t *connp, const void *user_data); /** * * @param[in] connp * @param[in] timestamp * @param[in] data * @param[in] len * @return HTP_STREAM_DATA, HTP_STREAM_ERROR or STEAM_STATE_DATA_OTHER (see QUICK_START). * HTP_STREAM_CLOSED and HTP_STREAM_TUNNEL are also possible. */ int htp_connp_req_data(htp_connp_t *connp, const htp_time_t *timestamp, const void *data, size_t len); /** * Returns the number of bytes consumed from the most recent inbound data chunk. Normally, an invocation * of htp_connp_req_data() will consume all data from the supplied buffer, but there are circumstances * where only partial consumption is possible. In such cases HTP_STREAM_DATA_OTHER will be returned. * Consumed bytes are no longer necessary, but the remainder of the buffer will be need to be saved * for later. * * @param[in] connp * @return The number of bytes consumed from the last data chunk sent for inbound processing. */ size_t htp_connp_req_data_consumed(htp_connp_t *connp); /** * Process a chunk of outbound (server or response) data. * * @param[in] connp * @param[in] timestamp Optional. * @param[in] data * @param[in] len * @return HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed */ int htp_connp_res_data(htp_connp_t *connp, const htp_time_t *timestamp, const void *data, size_t len); /** * Returns the number of bytes consumed from the most recent outbound data chunk. Normally, an invocation * of htp_connp_res_data() will consume all data from the supplied buffer, but there are circumstances * where only partial consumption is possible. In such cases HTP_STREAM_DATA_OTHER will be returned. * Consumed bytes are no longer necessary, but the remainder of the buffer will be need to be saved * for later. * * @param[in] connp * @return The number of bytes consumed from the last data chunk sent for outbound processing. */ size_t htp_connp_res_data_consumed(htp_connp_t *connp); /** * Create a new transaction using the connection parser provided. * * @param[in] connp * @return Transaction instance on success, NULL on failure. */ htp_tx_t *htp_connp_tx_create(htp_connp_t *connp); #ifdef __cplusplus } #endif #endif /* HTP_CONNECTION_PARSER_H */ suricata-3.2.1/libhtp/htp/htp_config.h0000644000000000000000000005117413051004451014566 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CONFIG_H #define HTP_CONFIG_H #ifdef __cplusplus extern "C" { #endif #include "htp.h" /** * Decoder contexts. */ enum htp_decoder_ctx_t { /** Default settings. Settings applied to this context are propagated to all other contexts. */ HTP_DECODER_DEFAULTS = 0, /** Urlencoded decoder settings. */ HTP_DECODER_URLENCODED = 1, /** URL path decoder settings. */ HTP_DECODER_URL_PATH = 2 }; /** * Enumerates the possible server personalities. */ enum htp_server_personality_t { /** * Minimal personality that performs at little work as possible. All optional * features are disabled. This personality is a good starting point for customization. */ HTP_SERVER_MINIMAL = 0, /** A generic personality that aims to work reasonably well for all server types. */ HTP_SERVER_GENERIC = 1, /** The IDS personality tries to perform as much decoding as possible. */ HTP_SERVER_IDS = 2, /** Mimics the behavior of IIS 4.0, as shipped with Windows NT 4.0. */ HTP_SERVER_IIS_4_0 = 3, /** Mimics the behavior of IIS 5.0, as shipped with Windows 2000. */ HTP_SERVER_IIS_5_0 = 4, /** Mimics the behavior of IIS 5.1, as shipped with Windows XP Professional. */ HTP_SERVER_IIS_5_1 = 5, /** Mimics the behavior of IIS 6.0, as shipped with Windows 2003. */ HTP_SERVER_IIS_6_0 = 6, /** Mimics the behavior of IIS 7.0, as shipped with Windows 2008. */ HTP_SERVER_IIS_7_0 = 7, /* Mimics the behavior of IIS 7.5, as shipped with Windows 7. */ HTP_SERVER_IIS_7_5 = 8, /* Mimics the behavior of Apache 2.x. */ HTP_SERVER_APACHE_2 = 9 }; /** * Enumerates the ways in which servers respond to malformed data. */ enum htp_unwanted_t { /** Ignores problem. */ HTP_UNWANTED_IGNORE = 0, /** Responds with HTTP 400 status code. */ HTP_UNWANTED_400 = 400, /** Responds with HTTP 404 status code. */ HTP_UNWANTED_404 = 404 }; /** * Enumerates the possible approaches to handling invalid URL-encodings. */ enum htp_url_encoding_handling_t { /** Ignore invalid URL encodings and leave the % in the data. */ HTP_URL_DECODE_PRESERVE_PERCENT = 0, /** Ignore invalid URL encodings, but remove the % from the data. */ HTP_URL_DECODE_REMOVE_PERCENT = 1, /** Decode invalid URL encodings. */ HTP_URL_DECODE_PROCESS_INVALID = 2 }; /** * Creates a new configuration structure. Configuration structures created at * configuration time must not be changed afterwards in order to support lock-less * copying. * * @return New configuration structure. */ htp_cfg_t *htp_config_create(void); /** * Creates a copy of the supplied configuration structure. The idea is to create * one or more configuration objects at configuration-time, but to use this * function to create per-connection copies. That way it will be possible to * adjust per-connection configuration as necessary, without affecting the * global configuration. Make sure no other thread changes the configuration * object while this function is operating. * * @param[in] cfg * @return A copy of the configuration structure. */ htp_cfg_t *htp_config_copy(htp_cfg_t *cfg); /** * Destroy a configuration structure. * * @param[in] cfg */ void htp_config_destroy(htp_cfg_t *cfg); /** * Retrieves user data associated with this configuration. * * @param[in] cfg * @return User data pointer, or NULL if not set. */ void *htp_config_get_user_data(htp_cfg_t *cfg); /** * Registers a callback that is invoked every time there is a log message with * severity equal and higher than the configured log level. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_log(htp_cfg_t *cfg, int (*callback_fn)(htp_log_t *)); /** * Adds the built-in Multipart parser to the configuration. This parser will extract information * stored in request bodies, when they are in multipart/form-data format. * * @param[in] cfg */ void htp_config_register_multipart_parser(htp_cfg_t *cfg); /** * Registers a REQUEST_START callback, which is invoked every time a new * request begins and before any parsing is done. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_start(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a REQUEST_BODY_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_body_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)); /** * Registers a REQUEST_COMPLETE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a REQUEST_FILE_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_file_data(htp_cfg_t *cfg, int (*callback_fn)(htp_file_data_t *)); /** * Registers a REQUEST_HEADER_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_header_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)); /** * Registers a REQUEST_HEADERS callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_headers(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a REQUEST_LINE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_line(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a REQUEST_URI_NORMALIZE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_uri_normalize(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a HTP_REQUEST_TRAILER callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_trailer(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a REQUEST_TRAILER_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_request_trailer_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *d)); /** * Registers a RESPONSE_BODY_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_body_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)); /** * Registers a RESPONSE_COMPLETE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a RESPONSE_HEADER_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_header_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *)); /** * Registers a RESPONSE_HEADERS callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_headers(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a RESPONSE_LINE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_line(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a RESPONSE_START callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_start(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a RESPONSE_TRAILER callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_trailer(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Registers a RESPONSE_TRAILER_DATA callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_response_trailer_data(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_data_t *d)); /** * Registers a TRANSACTION_COMPLETE callback. * * @param[in] cfg * @param[in] callback_fn */ void htp_config_register_transaction_complete(htp_cfg_t *cfg, int (*callback_fn)(htp_tx_t *)); /** * Adds the built-in Urlencoded parser to the configuration. The parser will * parse query strings and request bodies with the appropriate MIME type. * * @param[in] cfg */ void htp_config_register_urlencoded_parser(htp_cfg_t *cfg); /** * Configures whether backslash characters are treated as path segment separators. They * are not on Unix systems, but are on Windows systems. If this setting is enabled, a path * such as "/one\two/three" will be converted to "/one/two/three". Implemented only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_backslash_convert_slashes(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures a best-fit map, which is used whenever characters longer than one byte * need to be converted to a single-byte. By default a Windows 1252 best-fit map is used. * The map is an list of triplets, the first 2 bytes being an UCS-2 character to map from, * and the third byte being the single byte to map to. Make sure that your map contains * the mappings to cover the full-width and half-width form characters (U+FF00-FFEF). The * last triplet in the map must be all zeros (3 NUL bytes). * * @param[in] cfg * @param[in] ctx * @param[in] map */ void htp_config_set_bestfit_map(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, void *map); /** * Sets the replacement character that will be used to in the lossy best-fit * mapping from multi-byte to single-byte streams. The question mark character * is used as the default replacement byte. * * @param[in] cfg * @param[in] ctx * @param[in] replacement_byte */ void htp_config_set_bestfit_replacement_byte(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int replacement_byte); /** * Controls reaction to raw control characters in the data. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_control_chars_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures whether input data will be converted to lowercase. Useful when set on the * HTP_DECODER_URL_PATH context, in order to handle servers with case-insensitive filesystems. * Implemented only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_convert_lowercase(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Enables or disables Multipart file extraction. This function can be invoked only * after a previous htp_config_set_tmpdir() invocation. Otherwise, the configuration * change will fail, and extraction will not be enabled. Disabled by default. Please * note that the built-in file extraction implementation uses synchronous I/O, which * means that it is not suitable for use in an event-driven container. There's an * upper limit to how many files can be created on the filesystem during a single * request. The limit exists in order to mitigate against a DoS attack with a * Multipart payload that contains hundreds and thousands of files (it's cheap for the * attacker to do this, but costly for the server to support it). The default limit * may be pretty conservative. * * @param[in] cfg * @param[in] extract_files 1 if you wish extraction to be enabled, 0 otherwise * @param[in] limit the maximum number of files allowed; use -1 to use the parser default. */ htp_status_t htp_config_set_extract_request_files(htp_cfg_t *cfg, int extract_files, int limit); /** * Configures the maximum size of the buffer LibHTP will use when all data is not available * in the current buffer (e.g., a very long header line that might span several packets). This * limit is controlled by the hard_limit parameter. The soft_limit parameter is not implemented. * * @param[in] cfg * @param[in] soft_limit NOT IMPLEMENTED. * @param[in] hard_limit */ void htp_config_set_field_limits(htp_cfg_t *cfg, size_t soft_limit, size_t hard_limit); /** * Configures the desired log level. * * @param[in] cfg * @param[in] log_level */ void htp_config_set_log_level(htp_cfg_t *cfg, enum htp_log_level_t log_level); /** * Configures how the server reacts to encoded NUL bytes. Some servers will stop at * at NUL, while some will respond with 400 or 404. When the termination option is not * used, the NUL byte will remain in the path. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_nul_encoded_terminates(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures reaction to encoded NUL bytes in input data. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_nul_encoded_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures the handling of raw NUL bytes. If enabled, raw NUL terminates strings. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_nul_raw_terminates(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures how the server reacts to raw NUL bytes. Some servers will terminate * path at NUL, while some will respond with 400 or 404. When the termination option * is not used, the NUL byte will remain in the data. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_nul_raw_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Enable or disable request HTTP Authentication parsing. Enabled by default. * * @param[in] cfg * @param[in] parse_request_auth */ void htp_config_set_parse_request_auth(htp_cfg_t *cfg, int parse_request_auth); /** * Enable or disable request cookie parsing. Enabled by default. * * @param[in] cfg * @param[in] parse_request_cookies */ void htp_config_set_parse_request_cookies(htp_cfg_t *cfg, int parse_request_cookies); /** * Configures whether consecutive path segment separators will be compressed. When enabled, a path * such as "/one//two" will be normalized to "/one/two". Backslash conversion and path segment separator * decoding are carried out before compression. For example, the path "/one\\/two\/%5cthree/%2f//four" * will be converted to "/one/two/three/four" (assuming all 3 options are enabled). Implemented only for * HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_path_separators_compress(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures whether encoded path segment separators will be decoded. Apache does not do * this by default, but IIS does. If enabled, a path such as "/one%2ftwo" will be normalized * to "/one/two". If the backslash_separators option is also enabled, encoded backslash * characters will be converted too (and subsequently normalized to forward slashes). Implemented * only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_path_separators_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures reaction to encoded path separator characters (e.g., %2f). Implemented only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_path_separators_encoded_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures whether plus characters are converted to spaces when decoding URL-encoded strings. This * is appropriate to do for parameters, but not for URLs. Only applies to contexts where decoding * is taking place. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_plusspace_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Controls whether compressed response bodies will be automatically decompressed. * * @param[in] cfg * @param[in] enabled set to 1 to enable decompression, 0 otherwise */ void htp_config_set_response_decompression(htp_cfg_t *cfg, int enabled); /** * Configure desired server personality. * * @param[in] cfg * @param[in] personality * @return HTP_OK if the personality is supported, HTP_ERROR if it isn't. */ htp_status_t htp_config_set_server_personality(htp_cfg_t *cfg, enum htp_server_personality_t personality); /** * Configures the path where temporary files should be stored. Must be set * in order to use the Multipart file extraction functionality. * * @param[in] cfg * @param[in] tmpdir */ void htp_config_set_tmpdir(htp_cfg_t *cfg, char *tmpdir); /** * Configures whether transactions will be automatically destroyed once they * are processed and all callbacks invoked. This option is appropriate for * programs that process transactions as they are processed. * * @param[in] cfg * @param[in] tx_auto_destroy */ void htp_config_set_tx_auto_destroy(htp_cfg_t *cfg, int tx_auto_destroy); /** * Associates provided opaque user data with the configuration. * * @param[in] cfg * @param[in] user_data */ void htp_config_set_user_data(htp_cfg_t *cfg, void *user_data); /** * Configures whether %u-encoded sequences are decoded. Such sequences * will be treated as invalid URL encoding if decoding is not desirable. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_u_encoding_decode(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures reaction to %u-encoded sequences in input data. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_u_encoding_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures how the server handles to invalid URL encoding. * * @param[in] cfg * @param[in] ctx * @param[in] handling */ void htp_config_set_url_encoding_invalid_handling(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_url_encoding_handling_t handling); /** * Configures how the server reacts to invalid URL encoding. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_url_encoding_invalid_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Controls whether the data should be treated as UTF-8 and converted to a single-byte * stream using best-fit mapping. Implemented only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] enabled */ void htp_config_set_utf8_convert_bestfit(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, int enabled); /** * Configures how the server reacts to invalid UTF-8 characters. This setting does * not affect path normalization; it only controls what response status will be expect for * a request that contains invalid UTF-8 characters. Implemented only for HTP_DECODER_URL_PATH. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_utf8_invalid_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures how the server reacts to leading whitespace on the request line. * * @param[in] cfg * @param[in] ctx * @param[in] unwanted */ void htp_config_set_requestline_leading_whitespace_unwanted(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, enum htp_unwanted_t unwanted); /** * Configures many layers of compression we try to decompress. * * @param[in] cfg * @param[in] limit 0 disables limit */ void htp_config_set_response_decompression_layer_limit(htp_cfg_t *cfg, int limit); #ifdef __cplusplus } #endif #endif /* HTP_CONFIG_H */ suricata-3.2.1/libhtp/htp/htp_core.h0000644000000000000000000002575313051004451014255 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_CORE_H #define HTP_CORE_H #ifdef __cplusplus extern "C" { #endif typedef int htp_status_t; typedef struct htp_cfg_t htp_cfg_t; typedef struct htp_conn_t htp_conn_t; typedef struct htp_connp_t htp_connp_t; typedef struct htp_file_t htp_file_t; typedef struct htp_file_data_t htp_file_data_t; typedef struct htp_header_t htp_header_t; typedef struct htp_header_line_t htp_header_line_t; typedef struct htp_log_t htp_log_t; typedef struct htp_param_t htp_param_t; typedef struct htp_tx_data_t htp_tx_data_t; typedef struct htp_tx_t htp_tx_t; typedef struct htp_uri_t htp_uri_t; typedef struct timeval htp_time_t; // Below are all htp_status_t return codes used by LibHTP. Enum is not // used here to allow applications to define their own codes. /** * The lowest htp_status_t value LibHTP will use internally. */ #define HTP_ERROR_RESERVED -1000 /** General-purpose error code. */ #define HTP_ERROR -1 /** * No processing or work was done. This is typically used by callbacks * to indicate that they were not interested in doing any work in the * given context. */ #define HTP_DECLINED 0 /** Returned by a function when its work was successfully completed. */ #define HTP_OK 1 /** * Returned when processing a connection stream, after consuming all * provided data. The caller should call again with more data. */ #define HTP_DATA 2 /** * Returned when processing a connection stream, after encountering * a situation where processing needs to continue on the alternate * stream (e.g., the inbound parser needs to observe some outbound * data). The data provided was not completely consumed. On the next * invocation the caller should supply only the data that has not * been processed already. Use htp_connp_req_data_consumed() and * htp_connp_res_data_consumed() to determine how much of the most * recent data chunk was consumed. */ #define HTP_DATA_OTHER 3 /** * Used by callbacks to indicate that the processing should stop. For example, * returning HTP_STOP from a connection callback indicates that LibHTP should * stop following that particular connection. */ #define HTP_STOP 4 /** * Same as HTP_DATA, but indicates that any non-consumed part of the * data chunk should be preserved (buffered) for later. */ #define HTP_DATA_BUFFER 5 /** * The highest htp_status_t value LibHTP will use internally. */ #define HTP_STATUS_RESERVED 1000 /** * Enumerates the possible values for authentication type. */ enum htp_auth_type_t { /** * This is the default value that is used before * the presence of authentication is determined (e.g., * before request headers are seen). */ HTP_AUTH_UNKNOWN = 0, /** No authentication. */ HTP_AUTH_NONE = 1, /** HTTP Basic authentication used. */ HTP_AUTH_BASIC = 2, /** HTTP Digest authentication used. */ HTP_AUTH_DIGEST = 3, /** Unrecognized authentication method. */ HTP_AUTH_UNRECOGNIZED = 9 }; enum htp_content_encoding_t { /** * This is the default value, which is used until the presence * of content encoding is determined (e.g., before request headers * are seen. */ HTP_COMPRESSION_UNKNOWN = 0, /** No compression. */ HTP_COMPRESSION_NONE = 1, /** Gzip compression. */ HTP_COMPRESSION_GZIP = 2, /** Deflate compression. */ HTP_COMPRESSION_DEFLATE = 3 }; /** * Enumerates the possible request and response body codings. */ enum htp_transfer_coding_t { /** Body coding not determined yet. */ HTP_CODING_UNKNOWN = 0, /** No body. */ HTP_CODING_NO_BODY = 1, /** Identity coding is used, which means that the body was sent as is. */ HTP_CODING_IDENTITY = 2, /** Chunked encoding. */ HTP_CODING_CHUNKED = 3, /** We could not recognize the encoding. */ HTP_CODING_INVALID = 4 }; enum htp_file_source_t { HTP_FILE_MULTIPART = 1, HTP_FILE_PUT = 2 }; // Various flag bits. Even though we have a flag field in several places // (header, transaction, connection), these fields are all in the same namespace // because we may want to set the same flag in several locations. For example, we // may set HTP_FIELD_FOLDED on the actual folded header, but also on the transaction // that contains the header. Both uses are useful. // Connection flags are 8 bits wide. #define HTP_CONN_PIPELINED 0x000000001ULL #define HTP_CONN_HTTP_0_9_EXTRA 0x000000002ULL // All other flags are 64 bits wide. #define HTP_FIELD_UNPARSEABLE 0x000000004ULL #define HTP_FIELD_INVALID 0x000000008ULL #define HTP_FIELD_FOLDED 0x000000010ULL #define HTP_FIELD_REPEATED 0x000000020ULL #define HTP_FIELD_LONG 0x000000040ULL #define HTP_FIELD_RAW_NUL 0x000000080ULL #define HTP_REQUEST_SMUGGLING 0x000000100ULL #define HTP_INVALID_FOLDING 0x000000200ULL #define HTP_REQUEST_INVALID_T_E 0x000000400ULL #define HTP_MULTI_PACKET_HEAD 0x000000800ULL #define HTP_HOST_MISSING 0x000001000ULL #define HTP_HOST_AMBIGUOUS 0x000002000ULL #define HTP_PATH_ENCODED_NUL 0x000004000ULL #define HTP_PATH_RAW_NUL 0x000008000ULL #define HTP_PATH_INVALID_ENCODING 0x000010000ULL #define HTP_PATH_INVALID 0x000020000ULL #define HTP_PATH_OVERLONG_U 0x000040000ULL #define HTP_PATH_ENCODED_SEPARATOR 0x000080000ULL #define HTP_PATH_UTF8_VALID 0x000100000ULL /* At least one valid UTF-8 character and no invalid ones. */ #define HTP_PATH_UTF8_INVALID 0x000200000ULL #define HTP_PATH_UTF8_OVERLONG 0x000400000ULL #define HTP_PATH_HALF_FULL_RANGE 0x000800000ULL /* Range U+FF00 - U+FFEF detected. */ #define HTP_STATUS_LINE_INVALID 0x001000000ULL #define HTP_HOSTU_INVALID 0x002000000ULL /* Host in the URI. */ #define HTP_HOSTH_INVALID 0x004000000ULL /* Host in the Host header. */ #define HTP_URLEN_ENCODED_NUL 0x008000000ULL #define HTP_URLEN_INVALID_ENCODING 0x010000000ULL #define HTP_URLEN_OVERLONG_U 0x020000000ULL #define HTP_URLEN_HALF_FULL_RANGE 0x040000000ULL /* Range U+FF00 - U+FFEF detected. */ #define HTP_URLEN_RAW_NUL 0x080000000ULL #define HTP_REQUEST_INVALID 0x100000000ULL #define HTP_REQUEST_INVALID_C_L 0x200000000ULL #define HTP_AUTH_INVALID 0x400000000ULL #define HTP_HOST_INVALID ( HTP_HOSTU_INVALID | HTP_HOSTH_INVALID ) // Logging-related constants. #define HTP_LOG_MARK __FILE__,__LINE__ /** * Enumerates all log levels. */ enum htp_log_level_t { HTP_LOG_NONE = 0, HTP_LOG_ERROR = 1, HTP_LOG_WARNING = 2, HTP_LOG_NOTICE = 3, HTP_LOG_INFO = 4, HTP_LOG_DEBUG = 5, HTP_LOG_DEBUG2 = 6 }; /** * HTTP methods. */ enum htp_method_t { /** * Used by default, until the method is determined (e.g., before * the request line is processed. */ HTP_M_UNKNOWN = 0, HTP_M_HEAD = 1, HTP_M_GET = 2, HTP_M_PUT = 3, HTP_M_POST = 4, HTP_M_DELETE = 5, HTP_M_CONNECT = 6, HTP_M_OPTIONS = 7, HTP_M_TRACE = 8, HTP_M_PATCH = 9, HTP_M_PROPFIND = 10, HTP_M_PROPPATCH = 11, HTP_M_MKCOL = 12, HTP_M_COPY = 13, HTP_M_MOVE = 14, HTP_M_LOCK = 15, HTP_M_UNLOCK = 16, HTP_M_VERSION_CONTROL = 17, HTP_M_CHECKOUT = 18, HTP_M_UNCHECKOUT = 19, HTP_M_CHECKIN = 20, HTP_M_UPDATE = 21, HTP_M_LABEL = 22, HTP_M_REPORT = 23, HTP_M_MKWORKSPACE = 24, HTP_M_MKACTIVITY = 25, HTP_M_BASELINE_CONTROL = 26, HTP_M_MERGE = 27, HTP_M_INVALID = 28 }; // A collection of unique parser IDs. enum htp_parser_id_t { /** application/x-www-form-urlencoded parser. */ HTP_PARSER_URLENCODED = 0, /** multipart/form-data parser. */ HTP_PARSER_MULTIPART = 1 }; // Protocol version constants; an enum cannot be // used here because we allow any properly-formatted protocol // version (e.g., 1.3), even those that do not actually exist. #define HTP_PROTOCOL_INVALID -2 #define HTP_PROTOCOL_UNKNOWN -1 #define HTP_PROTOCOL_0_9 9 #define HTP_PROTOCOL_1_0 100 #define HTP_PROTOCOL_1_1 101 // A collection of possible data sources. enum htp_data_source_t { /** Embedded in the URL. */ HTP_SOURCE_URL = 0, /** Transported in the query string. */ HTP_SOURCE_QUERY_STRING = 1, /** Cookies. */ HTP_SOURCE_COOKIE = 2, /** Transported in the request body. */ HTP_SOURCE_BODY = 3 }; #define HTP_STATUS_INVALID -1 #define HTP_STATUS_UNKNOWN 0 /** * Enumerates all stream states. Each connection has two streams, one * inbound and one outbound. Their states are tracked separately. */ enum htp_stream_state_t { HTP_STREAM_NEW = 0, HTP_STREAM_OPEN = 1, HTP_STREAM_CLOSED = 2, HTP_STREAM_ERROR = 3, HTP_STREAM_TUNNEL = 4, HTP_STREAM_DATA_OTHER = 5, HTP_STREAM_STOP = 6, HTP_STREAM_DATA = 9 }; #ifdef __cplusplus } #endif #endif /* HTP_CORE_H */ suricata-3.2.1/libhtp/htp/strlcat.c0000644000000000000000000000523613051004451014113 00000000000000/* * Copyright (c) 1998 Todd C. Miller * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* $Id: strlcatu.c,v 1.4 2003/10/20 15:03:27 chrisgreen Exp $ */ #include "htp_config_auto.h" #include "htp_private.h" #ifndef HAVE_STRLCAT #if defined(LIBC_SCCS) && !defined(lint) static char *rcsid = "$OpenBSD: strlcat.c,v 1.5 2001/01/13 16:17:24 millert Exp $"; #endif /* LIBC_SCCS and not lint */ #include #include /* * Appends src to string dst of size siz (unlike strncat, siz is the * full size of dst, not space left). At most siz-1 characters * will be copied. Always NUL terminates (unless siz <= strlen(dst)). * Returns strlen(initial dst) + strlen(src); if retval >= siz, * truncation occurred. */ size_t strlcat(char *dst, const char *src, size_t siz) { register char *d = dst; register const char *s = src; register size_t n = siz; size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; if (n == 0) return(dlen + strlen(s)); while (*s != '\0') { if (n != 1) { *d++ = *s; n--; } s++; } *d = '\0'; return(dlen + (s - src)); /* count does not include NUL */ } #endif suricata-3.2.1/libhtp/htp/htp_list_private.h0000644000000000000000000000460313051004451016021 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef HTP_LIST_PRIVATE_H #define HTP_LIST_PRIVATE_H #ifdef __cplusplus extern "C" { #endif #include "htp_list.h" typedef struct htp_list_linked_element_t htp_list_linked_element_t; struct htp_list_array_t { size_t first; size_t last; size_t max_size; size_t current_size; void **elements; }; struct htp_list_linked_element_t { void *data; htp_list_linked_element_t *next; }; struct htp_list_linked_t { htp_list_linked_element_t *first; htp_list_linked_element_t *last; }; #ifdef __cplusplus } #endif #endif /* HTP_LIST_PRIVATE_H */ suricata-3.2.1/libhtp/htp/htp_multipart.c0000644000000000000000000016330513051004451015335 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" /** * Determines the type of a Content-Disposition parameter. * * @param[in] data * @param[in] startpos * @param[in] pos * @return CD_PARAM_OTHER, CD_PARAM_NAME or CD_PARAM_FILENAME. */ static int htp_mpartp_cd_param_type(unsigned char *data, size_t startpos, size_t endpos) { if ((endpos - startpos) == 4) { if (memcmp(data + startpos, "name", 4) == 0) return CD_PARAM_NAME; } else if ((endpos - startpos) == 8) { if (memcmp(data + startpos, "filename", 8) == 0) return CD_PARAM_FILENAME; } return CD_PARAM_OTHER; } htp_multipart_t *htp_mpartp_get_multipart(htp_mpartp_t *parser) { return &(parser->multipart); } /** * Decodes a C-D header value. This is impossible to do correctly without a * parsing personality because most browsers are broken: * - Firefox encodes " as \", and \ is not encoded. * - Chrome encodes " as %22. * - IE encodes " as \", and \ is not encoded. * - Opera encodes " as \" and \ as \\. * @param[in] b */ static void htp_mpart_decode_quoted_cd_value_inplace(bstr *b) { unsigned char *s = bstr_ptr(b); unsigned char *d = bstr_ptr(b); size_t len = bstr_len(b); size_t pos = 0; while (pos < len) { // Ignore \ when before \ or ". if ((*s == '\\')&&(pos + 1 < len)&&((*(s + 1) == '"')||(*(s + 1) == '\\'))) { s++; pos++; } *d++ = *s++; pos++; } bstr_adjust_len(b, len - (s - d)); } /** * Parses the Content-Disposition part header. * * @param[in] part * @return HTP_OK on success (header found and parsed), HTP_DECLINED if there is no C-D header or if * it could not be processed, and HTP_ERROR on fatal error. */ htp_status_t htp_mpart_part_parse_c_d(htp_multipart_part_t *part) { // Find the C-D header. htp_header_t *h = htp_table_get_c(part->headers, "content-disposition"); if (h == NULL) { part->parser->multipart.flags |= HTP_MULTIPART_PART_UNKNOWN; return HTP_DECLINED; } // Require "form-data" at the beginning of the header. if (bstr_index_of_c(h->value, "form-data") != 0) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // The parsing starts here. unsigned char *data = bstr_ptr(h->value); size_t len = bstr_len(h->value); size_t pos = 9; // Start after "form-data" // Main parameter parsing loop (once per parameter). while (pos < len) { // Ignore whitespace. while ((pos < len) && isspace(data[pos])) pos++; if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Expecting a semicolon. if (data[pos] != ';') { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } pos++; // Go over the whitespace before parameter name. while ((pos < len) && isspace(data[pos])) pos++; if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Found the starting position of the parameter name. size_t start = pos; // Look for the ending position. while ((pos < len) && (!isspace(data[pos]) && (data[pos] != '='))) pos++; if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Ending position is in "pos" now. // Determine parameter type ("name", "filename", or other). int param_type = htp_mpartp_cd_param_type(data, start, pos); // Ignore whitespace after parameter name, if any. while ((pos < len) && isspace(data[pos])) pos++; if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Equals. if (data[pos] != '=') { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } pos++; // Go over the whitespace before the parameter value. while ((pos < len) && isspace(data[pos])) pos++; if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Expecting a double quote. if (data[pos] != '"') { // Bare string or non-standard quoting, which we don't like. part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } pos++; // Over the double quote. // We have the starting position of the value. start = pos; // Find the end of the value. while ((pos < len) && (data[pos] != '"')) { // Check for escaping. if (data[pos] == '\\') { if (pos + 1 >= len) { // A backslash as the last character in the C-D header. part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Allow " and \ to be escaped. if ((data[pos + 1] == '"')||(data[pos + 1] == '\\')) { // Go over the quoted character. pos++; } } pos++; } // If we've reached the end of the string that means the // value was not terminated properly (the second double quote is missing). if (pos == len) { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } // Expecting the terminating double quote. if (data[pos] != '"') { part->parser->multipart.flags |= HTP_MULTIPART_CD_SYNTAX_INVALID; return HTP_DECLINED; } pos++; // Over the terminating double quote. // Finally, process the parameter value. switch (param_type) { case CD_PARAM_NAME: // Check that we have not seen the name parameter already. if (part->name != NULL) { part->parser->multipart.flags |= HTP_MULTIPART_CD_PARAM_REPEATED; return HTP_DECLINED; } part->name = bstr_dup_mem(data + start, pos - start - 1); if (part->name == NULL) return HTP_ERROR; htp_mpart_decode_quoted_cd_value_inplace(part->name); break; case CD_PARAM_FILENAME: // Check that we have not seen the filename parameter already. if (part->file != NULL) { part->parser->multipart.flags |= HTP_MULTIPART_CD_PARAM_REPEATED; return HTP_DECLINED; } part->file = calloc(1, sizeof (htp_file_t)); if (part->file == NULL) return HTP_ERROR; part->file->fd = -1; part->file->source = HTP_FILE_MULTIPART; part->file->filename = bstr_dup_mem(data + start, pos - start - 1); if (part->file->filename == NULL) { free(part->file); return HTP_ERROR; } htp_mpart_decode_quoted_cd_value_inplace(part->file->filename); break; default: // Unknown parameter. part->parser->multipart.flags |= HTP_MULTIPART_CD_PARAM_UNKNOWN; return HTP_DECLINED; break; } // Continue to parse the next parameter, if any. } return HTP_OK; } /** * Parses the Content-Type part header, if present. * * @param[in] part * @return HTP_OK on success, HTP_DECLINED if the C-T header is not present, and HTP_ERROR on failure. */ static htp_status_t htp_mpart_part_parse_c_t(htp_multipart_part_t *part) { htp_header_t *h = (htp_header_t *) htp_table_get_c(part->headers, "content-type"); if (h == NULL) return HTP_DECLINED; return htp_parse_ct_header(h->value, &part->content_type); } /** * Processes part headers. * * @param[in] part * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_mpart_part_process_headers(htp_multipart_part_t *part) { if (htp_mpart_part_parse_c_d(part) == HTP_ERROR) return HTP_ERROR; if (htp_mpart_part_parse_c_t(part) == HTP_ERROR) return HTP_ERROR; return HTP_OK; } /** * Parses one part header. * * @param[in] part * @param[in] data * @param[in] len * @return HTP_OK on success, HTP_DECLINED on parsing error, HTP_ERROR on fatal error. */ htp_status_t htp_mpartp_parse_header(htp_multipart_part_t *part, const unsigned char *data, size_t len) { size_t name_start, name_end; size_t value_start, value_end; // We do not allow NUL bytes here. if (memchr(data, '\0', len) != NULL) { part->parser->multipart.flags |= HTP_MULTIPART_NUL_BYTE; return HTP_DECLINED; } name_start = 0; // Look for the starting position of the name first. size_t colon_pos = 0; while ((colon_pos < len)&&(htp_is_space(data[colon_pos]))) colon_pos++; if (colon_pos != 0) { // Whitespace before header name. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } // Now look for the colon. while ((colon_pos < len) && (data[colon_pos] != ':')) colon_pos++; if (colon_pos == len) { // Missing colon. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } if (colon_pos == 0) { // Empty header name. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } name_end = colon_pos; // Ignore LWS after header name. size_t prev = name_end; while ((prev > name_start) && (htp_is_lws(data[prev - 1]))) { prev--; name_end--; // LWS after field name. Not allowing for now. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } // Header value. value_start = colon_pos + 1; // Ignore LWS before value. while ((value_start < len) && (htp_is_lws(data[value_start]))) value_start++; if (value_start == len) { // No header value. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } // Assume the value is at the end. value_end = len; // Check that the header name is a token. size_t i = name_start; while (i < name_end) { if (!htp_is_token(data[i])) { part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_INVALID; return HTP_DECLINED; } i++; } // Now extract the name and the value. htp_header_t *h = calloc(1, sizeof (htp_header_t)); if (h == NULL) return HTP_ERROR; h->name = bstr_dup_mem(data + name_start, name_end - name_start); if (h->name == NULL) { free(h); return HTP_ERROR; } h->value = bstr_dup_mem(data + value_start, value_end - value_start); if (h->value == NULL) { bstr_free(h->name); free(h); return HTP_ERROR; } if ((bstr_cmp_c_nocase(h->name, "content-disposition") != 0) && (bstr_cmp_c_nocase(h->name, "content-type") != 0)) { part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_UNKNOWN; } // Check if the header already exists. htp_header_t * h_existing = htp_table_get(part->headers, h->name); if (h_existing != NULL) { // Add to the existing header. bstr *new_value = bstr_expand(h_existing->value, bstr_len(h_existing->value) + 2 + bstr_len(h->value)); if (new_value == NULL) { bstr_free(h->name); bstr_free(h->value); free(h); return HTP_ERROR; } h_existing->value = new_value; bstr_add_mem_noex(h_existing->value, ", ", 2); bstr_add_noex(h_existing->value, h->value); // The header is no longer needed. bstr_free(h->name); bstr_free(h->value); free(h); // Keep track of same-name headers. h_existing->flags |= HTP_MULTIPART_PART_HEADER_REPEATED; part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_REPEATED; } else { // Add as a new header. if (htp_table_add(part->headers, h->name, h) != HTP_OK) { bstr_free(h->value); bstr_free(h->name); free(h); return HTP_ERROR; } } return HTP_OK; } /** * Creates a new Multipart part. * * @param[in] parser * @return New part instance, or NULL on memory allocation failure. */ htp_multipart_part_t *htp_mpart_part_create(htp_mpartp_t *parser) { htp_multipart_part_t * part = calloc(1, sizeof (htp_multipart_part_t)); if (part == NULL) return NULL; part->headers = htp_table_create(4); if (part->headers == NULL) { free(part); return NULL; } part->parser = parser; bstr_builder_clear(parser->part_data_pieces); bstr_builder_clear(parser->part_header_pieces); return part; } /** * Destroys a part. * * @param[in] part * @param[in] gave_up_data */ void htp_mpart_part_destroy(htp_multipart_part_t *part, int gave_up_data) { if (part == NULL) return; if (part->file != NULL) { bstr_free(part->file->filename); if (part->file->tmpname != NULL) { unlink(part->file->tmpname); free(part->file->tmpname); } free(part->file); part->file = NULL; } if ((!gave_up_data) || (part->type != MULTIPART_PART_TEXT)) { bstr_free(part->name); bstr_free(part->value); } bstr_free(part->content_type); if (part->headers != NULL) { htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(part->headers); i < n; i++) { h = htp_table_get_index(part->headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_destroy(part->headers); } free(part); } /** * Finalizes part processing. * * @param[in] part * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_mpart_part_finalize_data(htp_multipart_part_t *part) { // Determine if this part is the epilogue. if (part->parser->multipart.flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY) { if (part->type == MULTIPART_PART_UNKNOWN) { // Assume that the unknown part after the last boundary is the epilogue. part->parser->current_part->type = MULTIPART_PART_EPILOGUE; // But if we've already seen a part we thought was the epilogue, // raise HTP_MULTIPART_PART_UNKNOWN. Multiple epilogues are not allowed. if (part->parser->multipart.flags & HTP_MULTIPART_HAS_EPILOGUE) { part->parser->multipart.flags |= HTP_MULTIPART_PART_UNKNOWN; } part->parser->multipart.flags |= HTP_MULTIPART_HAS_EPILOGUE; } else { part->parser->multipart.flags |= HTP_MULTIPART_PART_AFTER_LAST_BOUNDARY; } } // Sanity checks. // Have we seen complete part headers? If we have not, that means that the part ended prematurely. if ((part->parser->current_part->type != MULTIPART_PART_EPILOGUE) && (part->parser->current_part_mode != MODE_DATA)) { part->parser->multipart.flags |= HTP_MULTIPART_PART_INCOMPLETE; } // Have we been able to determine the part type? If not, this means // that the part did not contain the C-D header. if (part->type == MULTIPART_PART_UNKNOWN) { part->parser->multipart.flags |= HTP_MULTIPART_PART_UNKNOWN; } // Finalize part value. if (part->type == MULTIPART_PART_FILE) { // Notify callbacks about the end of the file. htp_mpartp_run_request_file_data_hook(part, NULL, 0); // If we are storing the file to disk, close the file descriptor. if (part->file->fd != -1) { close(part->file->fd); } } else { // Combine value pieces into a single buffer. if (bstr_builder_size(part->parser->part_data_pieces) > 0) { part->value = bstr_builder_to_str(part->parser->part_data_pieces); bstr_builder_clear(part->parser->part_data_pieces); } } return HTP_OK; } htp_status_t htp_mpartp_run_request_file_data_hook(htp_multipart_part_t *part, const unsigned char *data, size_t len) { if (part->parser->cfg == NULL) return HTP_OK; // Keep track of the file length. part->file->len += len; // Package data for the callbacks. htp_file_data_t file_data; file_data.file = part->file; file_data.data = data; file_data.len = (const size_t) len; // Send data to callbacks htp_status_t rc = htp_hook_run_all(part->parser->cfg->hook_request_file_data, &file_data); if (rc != HTP_OK) return rc; return HTP_OK; } /** * Handles part data. * * @param[in] part * @param[in] data * @param[in] len * @param[in] is_line * @return HTP_OK on success, HTP_ERROR on failure. */ htp_status_t htp_mpart_part_handle_data(htp_multipart_part_t *part, const unsigned char *data, size_t len, int is_line) { #if HTP_DEBUG fprintf(stderr, "Part type %d mode %d is_line %d\n", part->type, part->parser->current_part_mode, is_line); fprint_raw_data(stderr, "htp_mpart_part_handle_data: data chunk", data, len); #endif // Keep track of raw part length. part->len += len; // If we're processing a part that came after the last boundary, then we're not sure if it // is the epilogue part or some other part (in case of evasion attempt). For that reason we // will keep all its data in the part_data_pieces structure. If it ends up not being the // epilogue, this structure will be cleared. if ((part->parser->multipart.flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY) && (part->type == MULTIPART_PART_UNKNOWN)) { bstr_builder_append_mem(part->parser->part_data_pieces, data, len); } if (part->parser->current_part_mode == MODE_LINE) { // Line mode. if (is_line) { // End of the line. bstr *line = NULL; // If this line came to us in pieces, combine them now into a single buffer. if (bstr_builder_size(part->parser->part_header_pieces) > 0) { bstr_builder_append_mem(part->parser->part_header_pieces, data, len); line = bstr_builder_to_str(part->parser->part_header_pieces); if (line == NULL) return HTP_ERROR; bstr_builder_clear(part->parser->part_header_pieces); data = bstr_ptr(line); len = bstr_len(line); } // Ignore the line endings. if (len > 1) { if (data[len - 1] == LF) len--; if (data[len - 1] == CR) len--; } else if (len > 0) { if (data[len - 1] == LF) len--; } // Is it an empty line? if (len == 0) { // Empty line; process headers and switch to data mode. // Process the pending header, if any. if (part->parser->pending_header_line != NULL) { if (htp_mpartp_parse_header(part, bstr_ptr(part->parser->pending_header_line), bstr_len(part->parser->pending_header_line)) == HTP_ERROR) { bstr_free(line); return HTP_ERROR; } bstr_free(part->parser->pending_header_line); part->parser->pending_header_line = NULL; } if (htp_mpart_part_process_headers(part) == HTP_ERROR) { bstr_free(line); return HTP_ERROR; } part->parser->current_part_mode = MODE_DATA; bstr_builder_clear(part->parser->part_header_pieces); if (part->file != NULL) { // Changing part type because we have a filename. part->type = MULTIPART_PART_FILE; if ((part->parser->extract_files) && (part->parser->file_count < part->parser->extract_limit)) { char buf[255]; strncpy(buf, part->parser->extract_dir, 254); strncat(buf, "/libhtp-multipart-file-XXXXXX", 254 - strlen(buf)); part->file->tmpname = strdup(buf); if (part->file->tmpname == NULL) { bstr_free(line); return HTP_ERROR; } mode_t previous_mask = umask(S_IXUSR | S_IRWXG | S_IRWXO); part->file->fd = mkstemp(part->file->tmpname); umask(previous_mask); if (part->file->fd < 0) { bstr_free(line); return HTP_ERROR; } part->parser->file_count++; } } else if (part->name != NULL) { // Changing part type because we have a name. part->type = MULTIPART_PART_TEXT; bstr_builder_clear(part->parser->part_data_pieces); } else { // Do nothing; the type stays MULTIPART_PART_UNKNOWN. } } else { // Not an empty line. // Is there a pending header? if (part->parser->pending_header_line == NULL) { if (line != NULL) { part->parser->pending_header_line = line; line = NULL; } else { part->parser->pending_header_line = bstr_dup_mem(data, len); if (part->parser->pending_header_line == NULL) return HTP_ERROR; } } else { // Is this a folded line? if (isspace(data[0])) { // Folding; add to the existing line. part->parser->multipart.flags |= HTP_MULTIPART_PART_HEADER_FOLDING; part->parser->pending_header_line = bstr_add_mem(part->parser->pending_header_line, data, len); if (part->parser->pending_header_line == NULL) { bstr_free(line); return HTP_ERROR; } } else { // Process the pending header line. if (htp_mpartp_parse_header(part, bstr_ptr(part->parser->pending_header_line), bstr_len(part->parser->pending_header_line)) == HTP_ERROR) { bstr_free(line); return HTP_ERROR; } bstr_free(part->parser->pending_header_line); if (line != NULL) { part->parser->pending_header_line = line; line = NULL; } else { part->parser->pending_header_line = bstr_dup_mem(data, len); if (part->parser->pending_header_line == NULL) return HTP_ERROR; } } } } bstr_free(line); line = NULL; } else { // Not end of line; keep the data chunk for later. bstr_builder_append_mem(part->parser->part_header_pieces, data, len); } } else { // Data mode; keep the data chunk for later (but not if it is a file). switch (part->type) { case MULTIPART_PART_EPILOGUE: case MULTIPART_PART_PREAMBLE: case MULTIPART_PART_TEXT: case MULTIPART_PART_UNKNOWN: // Make a copy of the data in RAM. bstr_builder_append_mem(part->parser->part_data_pieces, data, len); break; case MULTIPART_PART_FILE: // Invoke file data callbacks. htp_mpartp_run_request_file_data_hook(part, data, len); // Optionally, store the data in a file. if (part->file->fd != -1) { if (write(part->file->fd, data, len) < 0) { return HTP_ERROR; } } break; default: // Internal error. return HTP_ERROR; break; } } return HTP_OK; } /** * Handles data, creating new parts as necessary. * * @param[in] mpartp * @param[in] data * @param[in] len * @param[in] is_line * @return HTP_OK on success, HTP_ERROR on failure. */ static htp_status_t htp_mpartp_handle_data(htp_mpartp_t *parser, const unsigned char *data, size_t len, int is_line) { if (len == 0) return HTP_OK; // Do we have a part already? if (parser->current_part == NULL) { // Create a new part. parser->current_part = htp_mpart_part_create(parser); if (parser->current_part == NULL) return HTP_ERROR; if (parser->multipart.boundary_count == 0) { // We haven't seen a boundary yet, so this must be the preamble part. parser->current_part->type = MULTIPART_PART_PREAMBLE; parser->multipart.flags |= HTP_MULTIPART_HAS_PREAMBLE; parser->current_part_mode = MODE_DATA; } else { // Part after preamble. parser->current_part_mode = MODE_LINE; } // Add part to the list. htp_list_push(parser->multipart.parts, parser->current_part); #ifdef HTP_DEBUG fprintf(stderr, "Created new part type %d\n", parser->current_part->type); #endif } // Send data to the part. return htp_mpart_part_handle_data(parser->current_part, data, len, is_line); } /** * Handles a boundary event, which means that it will finalize a part if one exists. * * @param[in] mpartp * @return HTP_OK on success, HTP_ERROR on failure. */ static htp_status_t htp_mpartp_handle_boundary(htp_mpartp_t *parser) { #if HTP_DEBUG fprintf(stderr, "htp_mpartp_handle_boundary\n"); #endif if (parser->current_part != NULL) { if (htp_mpart_part_finalize_data(parser->current_part) != HTP_OK) { return HTP_ERROR; } // We're done with this part parser->current_part = NULL; // Revert to line mode parser->current_part_mode = MODE_LINE; } return HTP_OK; } static htp_status_t htp_mpartp_init_boundary(htp_mpartp_t *parser, unsigned char *data, size_t len) { if ((parser == NULL) || (data == NULL)) return HTP_ERROR; // Copy the boundary and convert it to lowercase. parser->multipart.boundary_len = len + 4; parser->multipart.boundary = malloc(parser->multipart.boundary_len + 1); if (parser->multipart.boundary == NULL) return HTP_ERROR; parser->multipart.boundary[0] = CR; parser->multipart.boundary[1] = LF; parser->multipart.boundary[2] = '-'; parser->multipart.boundary[3] = '-'; for (size_t i = 0; i < len; i++) { parser->multipart.boundary[i + 4] = data[i]; } parser->multipart.boundary[parser->multipart.boundary_len] = '\0'; // We're starting in boundary-matching mode. The first boundary can appear without the // CRLF, and our starting state expects that. If we encounter non-boundary data, the // state will switch to data mode. Then, if the data is CRLF or LF, we will go back // to boundary matching. Thus, we handle all the possibilities. parser->parser_state = STATE_BOUNDARY; parser->boundary_match_pos = 2; return HTP_OK; } htp_mpartp_t *htp_mpartp_create(htp_cfg_t *cfg, bstr *boundary, uint64_t flags) { if ((cfg == NULL) || (boundary == NULL)) return NULL; htp_mpartp_t *parser = calloc(1, sizeof (htp_mpartp_t)); if (parser == NULL) return NULL; parser->cfg = cfg; parser->boundary_pieces = bstr_builder_create(); if (parser->boundary_pieces == NULL) { htp_mpartp_destroy(parser); return NULL; } parser->part_data_pieces = bstr_builder_create(); if (parser->part_data_pieces == NULL) { htp_mpartp_destroy(parser); return NULL; } parser->part_header_pieces = bstr_builder_create(); if (parser->part_header_pieces == NULL) { htp_mpartp_destroy(parser); return NULL; } parser->multipart.parts = htp_list_create(64); if (parser->multipart.parts == NULL) { htp_mpartp_destroy(parser); return NULL; } parser->multipart.flags = flags; parser->parser_state = STATE_INIT; parser->extract_files = cfg->extract_request_files; parser->extract_dir = cfg->tmpdir; if (cfg->extract_request_files_limit >= 0) { parser->extract_limit = cfg->extract_request_files_limit; } else { parser->extract_limit = DEFAULT_FILE_EXTRACT_LIMIT; } parser->handle_data = htp_mpartp_handle_data; parser->handle_boundary = htp_mpartp_handle_boundary; // Initialize the boundary. htp_status_t rc = htp_mpartp_init_boundary(parser, bstr_ptr(boundary), bstr_len(boundary)); if (rc != HTP_OK) { htp_mpartp_destroy(parser); return NULL; } // On success, the ownership of the boundary parameter // is transferred to us. We made a copy, and so we // don't need it any more. bstr_free(boundary); return parser; } void htp_mpartp_destroy(htp_mpartp_t *parser) { if (parser == NULL) return; if (parser->multipart.boundary != NULL) { free(parser->multipart.boundary); } bstr_builder_destroy(parser->boundary_pieces); bstr_builder_destroy(parser->part_header_pieces); bstr_free(parser->pending_header_line); bstr_builder_destroy(parser->part_data_pieces); // Free the parts. if (parser->multipart.parts != NULL) { for (size_t i = 0, n = htp_list_size(parser->multipart.parts); i < n; i++) { htp_multipart_part_t * part = htp_list_get(parser->multipart.parts, i); htp_mpart_part_destroy(part, parser->gave_up_data); } htp_list_destroy(parser->multipart.parts); } free(parser); } /** * Processes set-aside data. * * @param[in] mpartp * @param[in] data * @param[in] pos * @param[in] startpos * @param[in] return_pos * @param[in] matched * @return HTP_OK on success, HTP_ERROR on failure. */ static htp_status_t htp_martp_process_aside(htp_mpartp_t *parser, int matched) { // The stored data pieces can contain up to one line. If we're in data mode and there // was no boundary match, things are straightforward -- we process everything as data. // If there was a match, we need to take care to not send the line ending as data, nor // anything that follows (because it's going to be a part of the boundary). Similarly, // when we are in line mode, we need to split the first data chunk, processing the first // part as line and the second part as data. #ifdef HTP_DEBUG fprintf(stderr, "mpartp_process_aside matched %d current_part_mode %d\n", matched, parser->current_part_mode); #endif // Do we need to do any chunk splitting? if (matched || (parser->current_part_mode == MODE_LINE)) { // Line mode or boundary match // Process the CR byte, if set aside. if ((!matched) && (parser->cr_aside)) { // Treat as part data, when there is not a match. parser->handle_data(parser, (unsigned char *) &"\r", 1, /* not a line */ 0); parser->cr_aside = 0; } else { // Treat as boundary, when there is a match. parser->cr_aside = 0; } // We know that we went to match a boundary because // we saw a new line. Now we have to find that line and // process it. It's either going to be in the current chunk, // or in the first stored chunk. if (bstr_builder_size(parser->boundary_pieces) > 0) { int first = 1; for (size_t i = 0, n = htp_list_size(parser->boundary_pieces->pieces); i < n; i++) { bstr *b = htp_list_get(parser->boundary_pieces->pieces, i); if (first) { first = 0; // Split the first chunk. if (!matched) { // In line mode, we are OK with line endings. parser->handle_data(parser, bstr_ptr(b), parser->boundary_candidate_pos, /* line */ 1); } else { // But if there was a match, the line ending belongs to the boundary. unsigned char *dx = bstr_ptr(b); size_t lx = parser->boundary_candidate_pos; // Remove LF or CRLF. if ((lx > 0) && (dx[lx - 1] == LF)) { lx--; // Remove CR. if ((lx > 0) && (dx[lx - 1] == CR)) { lx--; } } parser->handle_data(parser, dx, lx, /* not a line */ 0); } // The second part of the split chunks belongs to the boundary // when matched, data otherwise. if (!matched) { parser->handle_data(parser, bstr_ptr(b) + parser->boundary_candidate_pos, bstr_len(b) - parser->boundary_candidate_pos, /* not a line */ 0); } } else { // Do not send data if there was a boundary match. The stored // data belongs to the boundary. if (!matched) { parser->handle_data(parser, bstr_ptr(b), bstr_len(b), /* not a line */ 0); } } } bstr_builder_clear(parser->boundary_pieces); } } else { // Data mode and no match. // In data mode, we process the lone CR byte as data. if (parser->cr_aside) { parser->handle_data(parser, (const unsigned char *)&"\r", 1, /* not a line */ 0); parser->cr_aside = 0; } // We then process any pieces that we might have stored, also as data. if (bstr_builder_size(parser->boundary_pieces) > 0) { for (size_t i = 0, n = htp_list_size(parser->boundary_pieces->pieces); i < n; i++) { bstr *b = htp_list_get(parser->boundary_pieces->pieces, i); parser->handle_data(parser, bstr_ptr(b), bstr_len(b), /* not a line */ 0); } bstr_builder_clear(parser->boundary_pieces); } } return HTP_OK; } htp_status_t htp_mpartp_finalize(htp_mpartp_t *parser) { if (parser->current_part != NULL) { // Process buffered data, if any. htp_martp_process_aside(parser, 0); // Finalize the last part. if (htp_mpart_part_finalize_data(parser->current_part) != HTP_OK) return HTP_ERROR; // It is OK to end abruptly in the epilogue part, but not in any other. if (parser->current_part->type != MULTIPART_PART_EPILOGUE) { parser->multipart.flags |= HTP_MULTIPART_INCOMPLETE; } } bstr_builder_clear(parser->boundary_pieces); return HTP_OK; } htp_status_t htp_mpartp_parse(htp_mpartp_t *parser, const void *_data, size_t len) { unsigned char *data = (unsigned char *) _data; // The current position in the entire input buffer. size_t pos = 0; // The position of the first unprocessed byte of data. We split the // input buffer into smaller chunks, according to their purpose. Once // an entire such smaller chunk is processed, we move to the next // and update startpos. size_t startpos = 0; // The position of the (possible) boundary. We investigate for possible // boundaries whenever we encounter CRLF or just LF. If we don't find a // boundary we need to go back, and this is what data_return_pos helps with. size_t data_return_pos = 0; #if HTP_DEBUG fprint_raw_data(stderr, "htp_mpartp_parse: data chunk", data, len); #endif // While there's data in the input buffer. while (pos < len) { STATE_SWITCH: #if HTP_DEBUG fprintf(stderr, "htp_mpartp_parse: state %d pos %zd startpos %zd\n", parser->parser_state, pos, startpos); #endif switch (parser->parser_state) { case STATE_INIT: // Incomplete initialization. return HTP_ERROR; break; case STATE_DATA: // Handle part data. // While there's data in the input buffer. while (pos < len) { // Check for a CRLF-terminated line. if (data[pos] == CR) { // We have a CR byte. // Is this CR the last byte in the input buffer? if (pos + 1 == len) { // We have CR as the last byte in input. We are going to process // what we have in the buffer as data, except for the CR byte, // which we're going to leave for later. If it happens that a // CR is followed by a LF and then a boundary, the CR is going // to be discarded. pos++; // Advance over CR. parser->cr_aside = 1; } else { // We have CR and at least one more byte in the buffer, so we // are able to test for the LF byte too. if (data[pos + 1] == LF) { pos += 2; // Advance over CR and LF. parser->multipart.flags |= HTP_MULTIPART_CRLF_LINE; // Prepare to switch to boundary testing. data_return_pos = pos; parser->boundary_candidate_pos = pos - startpos; parser->boundary_match_pos = 2; // After LF; position of the first dash. parser->parser_state = STATE_BOUNDARY; goto STATE_SWITCH; } else { // This is not a new line; advance over the // byte and clear the CR set-aside flag. pos++; parser->cr_aside = 0; } } } else if (data[pos] == LF) { // Check for a LF-terminated line. pos++; // Advance over LF. // Did we have a CR in the previous input chunk? if (parser->cr_aside == 0) { parser->multipart.flags |= HTP_MULTIPART_LF_LINE; } else { parser->multipart.flags |= HTP_MULTIPART_CRLF_LINE; } // Prepare to switch to boundary testing. data_return_pos = pos; parser->boundary_candidate_pos = pos - startpos; parser->boundary_match_pos = 2; // After LF; position of the first dash. parser->parser_state = STATE_BOUNDARY; goto STATE_SWITCH; } else { // Take one byte from input pos++; // Earlier we might have set aside a CR byte not knowing if the next // byte is a LF. Now we know that it is not, and so we can release the CR. if (parser->cr_aside) { parser->handle_data(parser, (unsigned char *) &"\r", 1, /* not a line */ 0); parser->cr_aside = 0; } } } // while // No more data in the input buffer; process the data chunk. parser->handle_data(parser, data + startpos, pos - startpos - parser->cr_aside, /* not a line */ 0); break; case STATE_BOUNDARY: // Handle a possible boundary. while (pos < len) { #ifdef HTP_DEBUG fprintf(stderr, "boundary (len %zd pos %zd char %d) data char %d\n", parser->multipart.boundary_len, parser->boundary_match_pos, parser->multipart.boundary[parser->boundary_match_pos], tolower(data[pos])); #endif // Check if the bytes match. if (!(data[pos] == parser->multipart.boundary[parser->boundary_match_pos])) { // Boundary mismatch. // Process stored (buffered) data. htp_martp_process_aside(parser, /* no match */ 0); // Return back where data parsing left off. if (parser->current_part_mode == MODE_LINE) { // In line mode, we process the line. parser->handle_data(parser, data + startpos, data_return_pos - startpos, /* line */ 1); startpos = data_return_pos; } else { // In data mode, we go back where we left off. pos = data_return_pos; } parser->parser_state = STATE_DATA; goto STATE_SWITCH; } // Consume one matched boundary byte pos++; parser->boundary_match_pos++; // Have we seen all boundary bytes? if (parser->boundary_match_pos == parser->multipart.boundary_len) { // Boundary match! // Process stored (buffered) data. htp_martp_process_aside(parser, /* boundary match */ 1); // Process data prior to the boundary in the current input buffer. // Because we know this is the last chunk before boundary, we can // remove the line endings. size_t dlen = data_return_pos - startpos; if ((dlen > 0) && (data[startpos + dlen - 1] == LF)) dlen--; if ((dlen > 0) && (data[startpos + dlen - 1] == CR)) dlen--; parser->handle_data(parser, data + startpos, dlen, /* line */ 1); // Keep track of how many boundaries we've seen. parser->multipart.boundary_count++; if (parser->multipart.flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY) { parser->multipart.flags |= HTP_MULTIPART_PART_AFTER_LAST_BOUNDARY; } // Run boundary match. parser->handle_boundary(parser); // We now need to check if this is the last boundary in the payload parser->parser_state = STATE_BOUNDARY_IS_LAST2; goto STATE_SWITCH; } } // while // No more data in the input buffer; store (buffer) the unprocessed // part for later, for after we find out if this is a boundary. bstr_builder_append_mem(parser->boundary_pieces, data + startpos, len - startpos); break; case STATE_BOUNDARY_IS_LAST2: // Examine the first byte after the last boundary character. If it is // a dash, then we maybe processing the last boundary in the payload. If // it is not, move to eat all bytes until the end of the line. if (data[pos] == '-') { // Found one dash, now go to check the next position. pos++; parser->parser_state = STATE_BOUNDARY_IS_LAST1; } else { // This is not the last boundary. Change state but // do not advance the position, allowing the next // state to process the byte. parser->parser_state = STATE_BOUNDARY_EAT_LWS; } break; case STATE_BOUNDARY_IS_LAST1: // Examine the byte after the first dash; expected to be another dash. // If not, eat all bytes until the end of the line. if (data[pos] == '-') { // This is indeed the last boundary in the payload. pos++; parser->multipart.flags |= HTP_MULTIPART_SEEN_LAST_BOUNDARY; parser->parser_state = STATE_BOUNDARY_EAT_LWS; } else { // The second character is not a dash, and so this is not // the final boundary. Raise the flag for the first dash, // and change state to consume the rest of the boundary line. parser->multipart.flags |= HTP_MULTIPART_BBOUNDARY_NLWS_AFTER; parser->parser_state = STATE_BOUNDARY_EAT_LWS; } break; case STATE_BOUNDARY_EAT_LWS: if (data[pos] == CR) { // CR byte, which could indicate a CRLF line ending. pos++; parser->parser_state = STATE_BOUNDARY_EAT_LWS_CR; } else if (data[pos] == LF) { // LF line ending; we're done with boundary processing; data bytes follow. pos++; startpos = pos; parser->multipart.flags |= HTP_MULTIPART_LF_LINE; parser->parser_state = STATE_DATA; } else { if (htp_is_lws(data[pos])) { // Linear white space is allowed here. parser->multipart.flags |= HTP_MULTIPART_BBOUNDARY_LWS_AFTER; pos++; } else { // Unexpected byte; consume, but remain in the same state. parser->multipart.flags |= HTP_MULTIPART_BBOUNDARY_NLWS_AFTER; pos++; } } break; case STATE_BOUNDARY_EAT_LWS_CR: if (data[pos] == LF) { // CRLF line ending; we're done with boundary processing; data bytes follow. pos++; startpos = pos; parser->multipart.flags |= HTP_MULTIPART_CRLF_LINE; parser->parser_state = STATE_DATA; } else { // Not a line ending; start again, but do not process this byte. parser->multipart.flags |= HTP_MULTIPART_BBOUNDARY_NLWS_AFTER; parser->parser_state = STATE_BOUNDARY_EAT_LWS; } break; } // switch } return HTP_OK; } static void htp_mpartp_validate_boundary(bstr *boundary, uint64_t *flags) { /* RFC 1341: The only mandatory parameter for the multipart Content-Type is the boundary parameter, which consists of 1 to 70 characters from a set of characters known to be very robust through email gateways, and NOT ending with white space. (If a boundary appears to end with white space, the white space must be presumed to have been added by a gateway, and should be deleted.) It is formally specified by the following BNF: boundary := 0*69 bcharsnospace bchars := bcharsnospace / " " bcharsnospace := DIGIT / ALPHA / "'" / "(" / ")" / "+" / "_" / "," / "-" / "." / "/" / ":" / "=" / "?" */ /* Chrome: Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT4AfwQCOgIxNVwlD Firefox: Content-Type: multipart/form-data; boundary=---------------------------21071316483088 MSIE: Content-Type: multipart/form-data; boundary=---------------------------7dd13e11c0452 Opera: Content-Type: multipart/form-data; boundary=----------2JL5oh7QWEDwyBllIRc7fh Safari: Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryre6zL3b0BelnTY5S */ unsigned char *data = bstr_ptr(boundary); size_t len = bstr_len(boundary); // The RFC allows up to 70 characters. In real life, // boundaries tend to be shorter. if ((len == 0) || (len > 70)) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } // Check boundary characters. This check is stricter than the // RFC, which seems to allow many separator characters. size_t pos = 0; while (pos < len) { if (!(((data[pos] >= '0') && (data[pos] <= '9')) || ((data[pos] >= 'a') && (data[pos] <= 'z')) || ((data[pos] >= 'A') && (data[pos] <= 'Z')) || (data[pos] == '-'))) { switch (data[pos]) { case '\'': case '(': case ')': case '+': case '_': case ',': case '.': case '/': case ':': case '=': case '?': // These characters are allowed by the RFC, but not common. *flags |= HTP_MULTIPART_HBOUNDARY_UNUSUAL; break; default: // Invalid character. *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; break; } } pos++; } } static void htp_mpartp_validate_content_type(bstr *content_type, uint64_t *flags) { unsigned char *data = bstr_ptr(content_type); size_t len = bstr_len(content_type); size_t counter = 0; while (len > 0) { int i = bstr_util_mem_index_of_c_nocase(data, len, "boundary"); if (i == -1) break; data = data + i; len = len - i; // In order to work around the fact that WebKit actually uses // the word "boundary" in their boundary, we also require one // equals character the follow the words. // "multipart/form-data; boundary=----WebKitFormBoundaryT4AfwQCOgIxNVwlD" if (memchr(data, '=', len) == NULL) break; counter++; // Check for case variations. for (size_t j = 0; j < 8; j++) { if (!((*data >= 'a') && (*data <= 'z'))) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } data++; len--; } } // How many boundaries have we seen? if (counter > 1) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } } htp_status_t htp_mpartp_find_boundary(bstr *content_type, bstr **boundary, uint64_t *flags) { if ((content_type == NULL) || (boundary == NULL) || (flags == NULL)) return HTP_ERROR; // Our approach is to ignore the MIME type and instead just look for // the boundary. This approach is more reliable in the face of various // evasion techniques that focus on submitting invalid MIME types. // Reset flags. *flags = 0; // Look for the boundary, case insensitive. int i = bstr_index_of_c_nocase(content_type, "boundary"); if (i == -1) return HTP_DECLINED; unsigned char *data = bstr_ptr(content_type) + i + 8; size_t len = bstr_len(content_type) - i - 8; // Look for the boundary value. size_t pos = 0; while ((pos < len) && (data[pos] != '=')) { if (htp_is_space(data[pos])) { // It is unusual to see whitespace before the equals sign. *flags |= HTP_MULTIPART_HBOUNDARY_UNUSUAL; } else { // But seeing a non-whitespace character may indicate evasion. *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } pos++; } if (pos >= len) { // No equals sign in the header. *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; return HTP_DECLINED; } // Go over the '=' character. pos++; // Ignore any whitespace after the equals sign. while ((pos < len) && (htp_is_space(data[pos]))) { if (htp_is_space(data[pos])) { // It is unusual to see whitespace after // the equals sign. *flags |= HTP_MULTIPART_HBOUNDARY_UNUSUAL; } pos++; } if (pos >= len) { // No value after the equals sign. *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; return HTP_DECLINED; } if (data[pos] == '"') { // Quoted boundary. // Possibly not very unusual, but let's see. *flags |= HTP_MULTIPART_HBOUNDARY_UNUSUAL; pos++; // Over the double quote. size_t startpos = pos; // Starting position of the boundary. // Look for the terminating double quote. while ((pos < len) && (data[pos] != '"')) pos++; if (pos >= len) { // Ran out of space without seeing // the terminating double quote. *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; // Include the starting double quote in the boundary. startpos--; } *boundary = bstr_dup_mem(data + startpos, pos - startpos); if (*boundary == NULL) return HTP_ERROR; pos++; // Over the double quote. } else { // Boundary not quoted. size_t startpos = pos; // Find the end of the boundary. For the time being, we replicate // the behavior of PHP 5.4.x. This may result with a boundary that's // closer to what would be accepted in real life. Our subsequent // checks of boundary characters will catch irregularities. while ((pos < len) && (data[pos] != ',') && (data[pos] != ';') && (!htp_is_space(data[pos]))) pos++; *boundary = bstr_dup_mem(data + startpos, pos - startpos); if (*boundary == NULL) return HTP_ERROR; } // Check for a zero-length boundary. if (bstr_len(*boundary) == 0) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; return HTP_DECLINED; } // Allow only whitespace characters after the boundary. int seen_space = 0, seen_non_space = 0; while (pos < len) { if (!htp_is_space(data[pos])) { seen_non_space = 1; } else { seen_space = 1; } pos++; } // Raise INVALID if we see any non-space characters, // but raise UNUSUAL if we see _only_ space characters. if (seen_non_space) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } else if (seen_space) { *flags |= HTP_MULTIPART_HBOUNDARY_UNUSUAL; } #ifdef HTP_DEBUG fprint_bstr(stderr, "Multipart boundary", *boundary); #endif // Validate boundary characters. htp_mpartp_validate_boundary(*boundary, flags); // Correlate with the MIME type. This might be a tad too // sensitive because it may catch non-browser access with sloppy // implementations, but let's go with it for now. if (bstr_begins_with_c(content_type, "multipart/form-data;") == 0) { *flags |= HTP_MULTIPART_HBOUNDARY_INVALID; } htp_mpartp_validate_content_type(content_type, flags); return HTP_OK; } suricata-3.2.1/libhtp/htp/htp_response.c0000644000000000000000000012573113051004451015153 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include "htp_config_auto.h" #include "htp_private.h" #define OUT_TEST_NEXT_BYTE_OR_RETURN(X) \ if ((X)->out_current_read_offset >= (X)->out_current_len) { \ return HTP_DATA; \ } #define OUT_PEEK_NEXT(X) \ if ((X)->out_current_read_offset >= (X)->out_current_len) { \ (X)->out_next_byte = -1; \ } else { \ (X)->out_next_byte = (X)->out_current_data[(X)->out_current_read_offset]; \ } #define OUT_NEXT_BYTE(X) \ if ((X)->out_current_read_offset < (X)->out_current_len) { \ (X)->out_next_byte = (X)->out_current_data[(X)->out_current_read_offset]; \ (X)->out_current_read_offset++; \ (X)->out_current_consume_offset++; \ (X)->out_stream_offset++; \ } else { \ (X)->out_next_byte = -1; \ } #define OUT_NEXT_BYTE_OR_RETURN(X) \ if ((X)->out_current_read_offset < (X)->out_current_len) { \ (X)->out_next_byte = (X)->out_current_data[(X)->out_current_read_offset]; \ (X)->out_current_read_offset++; \ (X)->out_current_consume_offset++; \ (X)->out_stream_offset++; \ } else { \ return HTP_DATA; \ } #define OUT_COPY_BYTE_OR_RETURN(X) \ if ((X)->out_current_read_offset < (X)->out_current_len) { \ (X)->out_next_byte = (X)->out_current_data[(X)->out_current_read_offset]; \ (X)->out_current_read_offset++; \ (X)->out_stream_offset++; \ } else { \ return HTP_DATA_BUFFER; \ } /** * Sends outstanding connection data to the currently active data receiver hook. * * @param[in] connp * @param[in] is_last * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_connp_res_receiver_send_data(htp_connp_t *connp, int is_last) { if (connp->out_data_receiver_hook == NULL) return HTP_OK; htp_tx_data_t d; d.tx = connp->out_tx; d.data = connp->out_current_data + connp->out_current_receiver_offset; d.len = connp->out_current_read_offset - connp->out_current_receiver_offset; d.is_last = is_last; htp_status_t rc = htp_hook_run_all(connp->out_data_receiver_hook, &d); if (rc != HTP_OK) return rc; connp->out_current_receiver_offset = connp->out_current_read_offset; return HTP_OK; } /** * Finalizes an existing data receiver hook by sending any outstanding data to it. The * hook is then removed so that it receives no more data. * * @param[in] connp * @return HTP_OK, or a value returned from a callback. */ htp_status_t htp_connp_res_receiver_finalize_clear(htp_connp_t *connp) { if (connp->out_data_receiver_hook == NULL) return HTP_OK; htp_status_t rc = htp_connp_res_receiver_send_data(connp, 1 /* last */); connp->out_data_receiver_hook = NULL; return rc; } /** * Configures the data receiver hook. If there is a previous hook, it will be finalized and cleared. * * @param[in] connp * @param[in] data_receiver_hook * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_connp_res_receiver_set(htp_connp_t *connp, htp_hook_t *data_receiver_hook) { htp_connp_res_receiver_finalize_clear(connp); connp->out_data_receiver_hook = data_receiver_hook; connp->out_current_receiver_offset = connp->out_current_read_offset; return HTP_OK; } /** * Handles request parser state changes. At the moment, this function is used only * to configure data receivers, which are sent raw connection data. * * @param[in] connp * @return HTP_OK, or a value returned from a callback. */ static htp_status_t htp_res_handle_state_change(htp_connp_t *connp) { if (connp->out_state_previous == connp->out_state) return HTP_OK; if (connp->out_state == htp_connp_RES_HEADERS) { htp_status_t rc = HTP_OK; switch (connp->out_tx->response_progress) { case HTP_RESPONSE_HEADERS: rc = htp_connp_res_receiver_set(connp, connp->out_tx->cfg->hook_response_header_data); break; case HTP_RESPONSE_TRAILER: rc = htp_connp_res_receiver_set(connp, connp->out_tx->cfg->hook_response_trailer_data); break; default: // Do nothing; receivers are currently used only for header blocks. break; } if (rc != HTP_OK) return rc; } // Same comment as in htp_req_handle_state_change(). Below is a copy. // Initially, I had the finalization of raw data sending here, but that // caused the last REQUEST_HEADER_DATA hook to be invoked after the // REQUEST_HEADERS hook -- which I thought made no sense. For that reason, // the finalization is now initiated from the request header processing code, // which is less elegant but provides a better user experience. Having some // (or all) hooks to be invoked on state change might work better. connp->out_state_previous = connp->out_state; return HTP_OK; } /** * If there is any data left in the outbound data chunk, this function will preserve * it for later consumption. The maximum amount accepted for buffering is controlled * by htp_config_t::field_limit_hard. * * @param[in] connp * @return HTP_OK, or HTP_ERROR on fatal failure. */ static htp_status_t htp_connp_res_buffer(htp_connp_t *connp) { if (connp->out_current_data == NULL) return HTP_OK; unsigned char *data = connp->out_current_data + connp->out_current_consume_offset; size_t len = connp->out_current_read_offset - connp->out_current_consume_offset; // Check the hard (buffering) limit. size_t newlen = connp->out_buf_size + len; // When calculating the size of the buffer, take into account the // space we're using for the response header buffer. if (connp->out_header != NULL) { newlen += bstr_len(connp->out_header); } if (newlen > connp->out_tx->cfg->field_limit_hard) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Response the buffer limit: size %zd limit %zd.", newlen, connp->out_tx->cfg->field_limit_hard); return HTP_ERROR; } // Copy the data remaining in the buffer. if (connp->out_buf == NULL) { connp->out_buf = malloc(len); if (connp->out_buf == NULL) return HTP_ERROR; memcpy(connp->out_buf, data, len); connp->out_buf_size = len; } else { size_t newsize = connp->out_buf_size + len; unsigned char *newbuf = realloc(connp->out_buf, newsize); if (newbuf == NULL) return HTP_ERROR; connp->out_buf = newbuf; memcpy(connp->out_buf + connp->out_buf_size, data, len); connp->out_buf_size = newsize; } // Reset the consumer position. connp->out_current_consume_offset = connp->out_current_read_offset; return HTP_OK; } /** * Returns to the caller the memory region that should be processed next. This function * hides away the buffering process from the rest of the code, allowing it to work with * non-buffered data that's in the outbound chunk, or buffered data that's in our structures. * * @param[in] connp * @param[out] data * @param[out] len * @return HTP_OK */ static htp_status_t htp_connp_res_consolidate_data(htp_connp_t *connp, unsigned char **data, size_t *len) { if (connp->out_buf == NULL) { // We do not have any data buffered; point to the current data chunk. *data = connp->out_current_data + connp->out_current_consume_offset; *len = connp->out_current_read_offset - connp->out_current_consume_offset; } else { // We do have data in the buffer. Add data from the current // chunk, and point to the consolidated buffer. if (htp_connp_res_buffer(connp) != HTP_OK) { return HTP_ERROR; } *data = connp->out_buf; *len = connp->out_buf_size; } return HTP_OK; } /** * Clears buffered outbound data and resets the consumer position to the reader position. * * @param[in] connp */ static void htp_connp_res_clear_buffer(htp_connp_t *connp) { connp->out_current_consume_offset = connp->out_current_read_offset; if (connp->out_buf != NULL) { free(connp->out_buf); connp->out_buf = NULL; connp->out_buf_size = 0; } } /** * Consumes bytes until the end of the current line. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_CHUNKED_DATA_END(htp_connp_t *connp) { // TODO We shouldn't really see anything apart from CR and LF, // so we should warn about anything else. for (;;) { OUT_NEXT_BYTE_OR_RETURN(connp); connp->out_tx->response_message_len++; if (connp->out_next_byte == LF) { connp->out_state = htp_connp_RES_BODY_CHUNKED_LENGTH; return HTP_OK; } } return HTP_ERROR; } /** * Processes a chunk of data. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_CHUNKED_DATA(htp_connp_t *connp) { size_t bytes_to_consume; // Determine how many bytes we can consume. if (connp->out_current_len - connp->out_current_read_offset >= connp->out_chunked_length) { bytes_to_consume = connp->out_chunked_length; } else { bytes_to_consume = connp->out_current_len - connp->out_current_read_offset; } if (bytes_to_consume == 0) return HTP_DATA; // Consume the data. htp_status_t rc = htp_tx_res_process_body_data_ex(connp->out_tx, connp->out_current_data + connp->out_current_read_offset, bytes_to_consume); if (rc != HTP_OK) return rc; // Adjust the counters. connp->out_current_read_offset += bytes_to_consume; connp->out_current_consume_offset += bytes_to_consume; connp->out_stream_offset += bytes_to_consume; connp->out_chunked_length -= bytes_to_consume; // Have we seen the entire chunk? if (connp->out_chunked_length == 0) { connp->out_state = htp_connp_RES_BODY_CHUNKED_DATA_END; return HTP_OK; } return HTP_DATA; } /** * Peeks ahead into the data to try to see if it starts with a valid Chunked * length field. * * @returns 1 if it looks valid, 0 if it looks invalid */ static inline int data_probe_chunk_length(htp_connp_t *connp) { if (connp->out_current_read_offset - connp->out_current_consume_offset < 8) { // not enough data so far, consider valid still return 1; } unsigned char *data = connp->out_current_data + connp->out_current_consume_offset; size_t len = connp->out_current_read_offset - connp->out_current_consume_offset; size_t i = 0; while (i < len) { unsigned char c = data[i]; if (c == 0x0d || c == 0x0a || c == 0x20 || c == 0x09 || c == 0x0b || c == 0x0c) { // ctl char, still good. } else if (isdigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) { // real chunklen char return 1; } else { // leading junk, bad return 0; } i++; } return 1; } /** * Extracts chunk length. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_CHUNKED_LENGTH(htp_connp_t *connp) { for (;;) { OUT_COPY_BYTE_OR_RETURN(connp); // Have we reached the end of the line? Or is this not chunked after all? if (connp->out_next_byte == LF || !data_probe_chunk_length(connp)) { unsigned char *data; size_t len; if (htp_connp_res_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } connp->out_tx->response_message_len += len; #ifdef HTP_DEBUG fprint_raw_data(stderr, "Chunk length line", data, len); #endif connp->out_chunked_length = htp_parse_chunked_length(data, len); // empty chunk length line, lets try to continue if (connp->out_chunked_length == -1004) continue; if (connp->out_chunked_length < 0) { // reset out_current_read_offset so htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE // doesn't miss the first bytes if (len > (size_t)connp->out_current_read_offset) { connp->out_current_read_offset = 0; } else { connp->out_current_read_offset -= len; } connp->out_state = htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE; connp->out_tx->response_transfer_coding = HTP_CODING_IDENTITY; htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Response chunk encoding: Invalid chunk length: %d", connp->out_chunked_length); return HTP_OK; } htp_connp_res_clear_buffer(connp); // Handle chunk length if (connp->out_chunked_length > 0) { // More data available connp->out_state = htp_connp_RES_BODY_CHUNKED_DATA; } else if (connp->out_chunked_length == 0) { // End of data connp->out_state = htp_connp_RES_HEADERS; connp->out_tx->response_progress = HTP_RESPONSE_TRAILER; } return HTP_OK; } } return HTP_ERROR; } /** * Processes an identity response body of known length. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_IDENTITY_CL_KNOWN(htp_connp_t *connp) { size_t bytes_to_consume; // Determine how many bytes we can consume. if (connp->out_current_len - connp->out_current_read_offset >= connp->out_body_data_left) { bytes_to_consume = connp->out_body_data_left; } else { bytes_to_consume = connp->out_current_len - connp->out_current_read_offset; } if (bytes_to_consume == 0) return HTP_DATA; // Consume the data. htp_status_t rc = htp_tx_res_process_body_data_ex(connp->out_tx, connp->out_current_data + connp->out_current_read_offset, bytes_to_consume); if (rc != HTP_OK) return rc; // Adjust the counters. connp->out_current_read_offset += bytes_to_consume; connp->out_current_consume_offset += bytes_to_consume; connp->out_stream_offset += bytes_to_consume; connp->out_body_data_left -= bytes_to_consume; // Have we seen the entire response body? if (connp->out_body_data_left == 0) { connp->out_state = htp_connp_RES_FINALIZE; return HTP_OK; } return HTP_DATA; } /** * Processes identity response body of unknown length. In this case, we assume the * response body consumes all data until the end of the stream. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE(htp_connp_t *connp) { // Consume all data from the input buffer. size_t bytes_to_consume = connp->out_current_len - connp->out_current_read_offset; #ifdef HTP_DEBUG fprintf(stderr, "bytes_to_consume %u", (uint)bytes_to_consume); #endif if (bytes_to_consume != 0) { htp_status_t rc = htp_tx_res_process_body_data_ex(connp->out_tx, connp->out_current_data + connp->out_current_read_offset, bytes_to_consume); if (rc != HTP_OK) return rc; // Adjust the counters. connp->out_current_read_offset += bytes_to_consume; connp->out_current_consume_offset += bytes_to_consume; connp->out_stream_offset += bytes_to_consume; } // Have we seen the entire response body? if (connp->out_status == HTP_STREAM_CLOSED) { connp->out_state = htp_connp_RES_FINALIZE; return HTP_OK; } return HTP_DATA; } /** * Determines presence (and encoding) of a response body. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_BODY_DETERMINE(htp_connp_t *connp) { // If the request uses the CONNECT method, then not only are we // to assume there's no body, but we need to ignore all // subsequent data in the stream. if (connp->out_tx->request_method_number == HTP_M_CONNECT) { if ((connp->out_tx->response_status_number >= 200) && (connp->out_tx->response_status_number <= 299)) { // This is a successful CONNECT stream, which means // we need to switch into tunneling mode: on the // request side we'll now probe the tunnel data to see // if we need to parse or ignore it. So on the response // side we wrap up the tx and wait. connp->out_state = htp_connp_RES_FINALIZE; // we may have response headers htp_status_t rc = htp_tx_state_response_headers(connp->out_tx); return rc; } else { // This is a failed CONNECT stream, which means that // we can unblock request parsing connp->in_status = HTP_STREAM_DATA; // We are going to continue processing this transaction, // adding a note for ourselves to stop at the end (because // we don't want to see the beginning of a new transaction). connp->out_data_other_at_tx_end = 1; } } // Check for "101 Switching Protocol" response. // If it's seen, it means that traffic after empty line following headers // is no longer HTTP. We can treat it similarly to CONNECT. // Unlike CONNECT, however, upgrades from HTTP to HTTP seem // rather unlikely, so don't try to probe tunnel for nested HTTP, // and switch to tunnel mode right away. if (connp->out_tx->response_status_number == 101) { connp->out_state = htp_connp_RES_FINALIZE; connp->in_status = HTP_STREAM_TUNNEL; connp->out_status = HTP_STREAM_TUNNEL; // we may have response headers htp_status_t rc = htp_tx_state_response_headers(connp->out_tx); return rc; } // Check for an interim "100 Continue" response. Ignore it if found, and revert back to RES_LINE. if (connp->out_tx->response_status_number == 100) { if (connp->out_tx->seen_100continue != 0) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Already seen 100-Continue."); return HTP_ERROR; } // Ignore any response headers seen so far. htp_header_t *h = NULL; for (size_t i = 0, n = htp_table_size(connp->out_tx->response_headers); i < n; i++) { h = htp_table_get_index(connp->out_tx->response_headers, i, NULL); bstr_free(h->name); bstr_free(h->value); free(h); } htp_table_clear(connp->out_tx->response_headers); // Expecting to see another response line next. connp->out_state = htp_connp_RES_LINE; connp->out_tx->response_progress = HTP_RESPONSE_LINE; connp->out_tx->seen_100continue++; return HTP_OK; } // 1. Any response message which MUST NOT include a message-body // (such as the 1xx, 204, and 304 responses and any response to a HEAD // request) is always terminated by the first empty line after the // header fields, regardless of the entity-header fields present in the // message. if (((connp->out_tx->response_status_number >= 100) && (connp->out_tx->response_status_number <= 199)) || (connp->out_tx->response_status_number == 204) || (connp->out_tx->response_status_number == 304) || (connp->out_tx->request_method_number == HTP_M_HEAD)) { // There's no response body connp->out_tx->response_transfer_coding = HTP_CODING_NO_BODY; connp->out_state = htp_connp_RES_FINALIZE; } else { // We have a response body htp_header_t *ct = htp_table_get_c(connp->out_tx->response_headers, "content-type"); htp_header_t *cl = htp_table_get_c(connp->out_tx->response_headers, "content-length"); htp_header_t *te = htp_table_get_c(connp->out_tx->response_headers, "transfer-encoding"); if (ct != NULL) { connp->out_tx->response_content_type = bstr_dup_lower(ct->value); if (connp->out_tx->response_content_type == NULL) return HTP_ERROR; // Ignore parameters unsigned char *data = bstr_ptr(connp->out_tx->response_content_type); size_t len = bstr_len(ct->value); size_t newlen = 0; while (newlen < len) { // TODO Some platforms may do things differently here. if (htp_is_space(data[newlen]) || (data[newlen] == ';')) { bstr_adjust_len(connp->out_tx->response_content_type, newlen); break; } newlen++; } } // 2. If a Transfer-Encoding header field (section 14.40) is present and // indicates that the "chunked" transfer coding has been applied, then // the length is defined by the chunked encoding (section 3.6). if ((te != NULL) && (bstr_index_of_c_nocase(te->value, "chunked") != -1)) { if (bstr_cmp_c_nocase(te->value, "chunked") != 0) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Transfer-encoding has abnormal chunked value"); } // spec says chunked is HTTP/1.1 only, but some browsers accept it // with 1.0 as well if (connp->out_tx->response_protocol_number < HTP_PROTOCOL_1_1) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Chunked transfer-encoding on HTTP/0.9 or HTTP/1.0"); } // If the T-E header is present we are going to use it. connp->out_tx->response_transfer_coding = HTP_CODING_CHUNKED; // We are still going to check for the presence of C-L if (cl != NULL) { // This is a violation of the RFC connp->out_tx->flags |= HTP_REQUEST_SMUGGLING; } connp->out_state = htp_connp_RES_BODY_CHUNKED_LENGTH; connp->out_tx->response_progress = HTP_RESPONSE_BODY; }// 3. If a Content-Length header field (section 14.14) is present, its // value in bytes represents the length of the message-body. else if (cl != NULL) { // We know the exact length connp->out_tx->response_transfer_coding = HTP_CODING_IDENTITY; // Check for multiple C-L headers if (cl->flags & HTP_FIELD_REPEATED) { connp->out_tx->flags |= HTP_REQUEST_SMUGGLING; } // Get body length connp->out_tx->response_content_length = htp_parse_content_length(cl->value); if (connp->out_tx->response_content_length < 0) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Invalid C-L field in response: %d", connp->out_tx->response_content_length); return HTP_ERROR; } else { connp->out_content_length = connp->out_tx->response_content_length; connp->out_body_data_left = connp->out_content_length; if (connp->out_content_length != 0) { connp->out_state = htp_connp_RES_BODY_IDENTITY_CL_KNOWN; connp->out_tx->response_progress = HTP_RESPONSE_BODY; } else { connp->out_state = htp_connp_RES_FINALIZE; } } } else { // 4. If the message uses the media type "multipart/byteranges", which is // self-delimiting, then that defines the length. This media type MUST // NOT be used unless the sender knows that the recipient can parse it; // the presence in a request of a Range header with multiple byte-range // specifiers implies that the client can parse multipart/byteranges // responses. if (ct != NULL) { // TODO Handle multipart/byteranges if (bstr_index_of_c_nocase(ct->value, "multipart/byteranges") != -1) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "C-T multipart/byteranges in responses not supported"); return HTP_ERROR; } } // 5. By the server closing the connection. (Closing the connection // cannot be used to indicate the end of a request body, since that // would leave no possibility for the server to send back a response.) connp->out_state = htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE; connp->out_tx->response_transfer_coding = HTP_CODING_IDENTITY; connp->out_tx->response_progress = HTP_RESPONSE_BODY; connp->out_body_data_left = -1; } } // NOTE We do not need to check for short-style HTTP/0.9 requests here because // that is done earlier, before response line parsing begins htp_status_t rc = htp_tx_state_response_headers(connp->out_tx); if (rc != HTP_OK) return rc; return HTP_OK; } /** * Parses response headers. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_HEADERS(htp_connp_t *connp) { for (;;) { OUT_COPY_BYTE_OR_RETURN(connp); // Have we reached the end of the line? if (connp->out_next_byte == LF || connp->out_next_byte == CR) { if (connp->out_next_byte == CR) { OUT_PEEK_NEXT(connp); if (connp->out_next_byte == -1) { return HTP_DATA_BUFFER; } else if (connp->out_next_byte == LF) { OUT_COPY_BYTE_OR_RETURN(connp); } } unsigned char *data; size_t len; if (htp_connp_res_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, data, len); #endif // Should we terminate headers? if (htp_connp_is_line_terminator(connp, data, len)) { // Parse previous header, if any. if (connp->out_header != NULL) { if (connp->cfg->process_response_header(connp, bstr_ptr(connp->out_header), bstr_len(connp->out_header)) != HTP_OK) return HTP_ERROR; bstr_free(connp->out_header); connp->out_header = NULL; } htp_connp_res_clear_buffer(connp); // We've seen all response headers. if (connp->out_tx->response_progress == HTP_RESPONSE_HEADERS) { // Response headers. // The next step is to determine if this response has a body. connp->out_state = htp_connp_RES_BODY_DETERMINE; } else { // Response trailer. // Finalize sending raw trailer data. htp_status_t rc = htp_connp_res_receiver_finalize_clear(connp); if (rc != HTP_OK) return rc; // Run hook response_TRAILER. rc = htp_hook_run_all(connp->cfg->hook_response_trailer, connp->out_tx); if (rc != HTP_OK) return rc; // The next step is to finalize this response. connp->out_state = htp_connp_RES_FINALIZE; } return HTP_OK; } htp_chomp(data, &len); // Check for header folding. if (htp_connp_is_line_folded(data, len) == 0) { // New header line. // Parse previous header, if any. if (connp->out_header != NULL) { if (connp->cfg->process_response_header(connp, bstr_ptr(connp->out_header), bstr_len(connp->out_header)) != HTP_OK) return HTP_ERROR; bstr_free(connp->out_header); connp->out_header = NULL; } OUT_PEEK_NEXT(connp); if (htp_is_folding_char(connp->out_next_byte) == 0) { // Because we know this header is not folded, we can process the buffer straight away. if (connp->cfg->process_response_header(connp, data, len) != HTP_OK) return HTP_ERROR; } else { // Keep the partial header data for parsing later. connp->out_header = bstr_dup_mem(data, len); if (connp->out_header == NULL) return HTP_ERROR; } } else { // Folding; check that there's a previous header line to add to. if (connp->out_header == NULL) { // Invalid folding. // Warn only once per transaction. if (!(connp->out_tx->flags & HTP_INVALID_FOLDING)) { connp->out_tx->flags |= HTP_INVALID_FOLDING; htp_log(connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "Invalid response field folding"); } // Keep the header data for parsing later. connp->out_header = bstr_dup_mem(data, len); if (connp->out_header == NULL) return HTP_ERROR; } else { // Add to the existing header. bstr *new_out_header = bstr_add_mem(connp->out_header, data, len); if (new_out_header == NULL) return HTP_ERROR; connp->out_header = new_out_header; } } htp_connp_res_clear_buffer(connp); } } return HTP_ERROR; } /** * Parses response line. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_LINE(htp_connp_t *connp) { for (;;) { // Don't try to get more data if the stream is closed. If we do, we'll return, asking for more data. if (connp->out_status != HTP_STREAM_CLOSED) { // Get one byte OUT_COPY_BYTE_OR_RETURN(connp); } // Have we reached the end of the line? We treat stream closure as end of line in // order to handle the case when the first line of the response is actually response body // (and we wish it processed as such). if ((connp->out_next_byte == LF)||(connp->out_status == HTP_STREAM_CLOSED)) { unsigned char *data; size_t len; if (htp_connp_res_consolidate_data(connp, &data, &len) != HTP_OK) { return HTP_ERROR; } #ifdef HTP_DEBUG fprint_raw_data(stderr, __func__, data, len); #endif // Is this a line that should be ignored? if (htp_connp_is_line_ignorable(connp, data, len)) { // We have an empty/whitespace line, which we'll note, ignore and move on connp->out_tx->response_ignored_lines++; // TODO How many lines are we willing to accept? // Start again htp_connp_res_clear_buffer(connp); return HTP_OK; } // Deallocate previous response line allocations, which we would have on a 100 response. if (connp->out_tx->response_line != NULL) { bstr_free(connp->out_tx->response_line); connp->out_tx->response_line = NULL; } if (connp->out_tx->response_protocol != NULL) { bstr_free(connp->out_tx->response_protocol); connp->out_tx->response_protocol = NULL; } if (connp->out_tx->response_status != NULL) { bstr_free(connp->out_tx->response_status); connp->out_tx->response_status = NULL; } if (connp->out_tx->response_message != NULL) { bstr_free(connp->out_tx->response_message); connp->out_tx->response_message = NULL; } // Process response line. int chomp_result = htp_chomp(data, &len); connp->out_tx->response_line = bstr_dup_mem(data, len); if (connp->out_tx->response_line == NULL) return HTP_ERROR; if (connp->cfg->parse_response_line(connp) != HTP_OK) return HTP_ERROR; // If the response line is invalid, determine if it _looks_ like // a response line. If it does not look like a line, process the // data as a response body because that is what browsers do. if (htp_treat_response_line_as_body(connp->out_tx)) { connp->out_tx->response_content_encoding_processing = HTP_COMPRESSION_NONE; htp_status_t rc = htp_tx_res_process_body_data_ex(connp->out_tx, data, len + chomp_result); if (rc != HTP_OK) return rc; // Continue to process response body. Because we don't have // any headers to parse, we assume the body continues until // the end of the stream. connp->out_tx->response_transfer_coding = HTP_CODING_IDENTITY; connp->out_tx->response_progress = HTP_RESPONSE_BODY; connp->out_state = htp_connp_RES_BODY_IDENTITY_STREAM_CLOSE; connp->out_body_data_left = -1; return HTP_OK; } htp_status_t rc = htp_tx_state_response_line(connp->out_tx); if (rc != HTP_OK) return rc; htp_connp_res_clear_buffer(connp); // Move on to the next phase. connp->out_state = htp_connp_RES_HEADERS; connp->out_tx->response_progress = HTP_RESPONSE_HEADERS; return HTP_OK; } } return HTP_ERROR; } size_t htp_connp_res_data_consumed(htp_connp_t *connp) { return connp->out_current_read_offset; } htp_status_t htp_connp_RES_FINALIZE(htp_connp_t *connp) { return htp_tx_state_response_complete_ex(connp->out_tx, 0 /* not hybrid mode */); } /** * The response idle state will initialize response processing, as well as * finalize each transactions after we are done with it. * * @param[in] connp * @returns HTP_OK on state change, HTP_ERROR on error, or HTP_DATA when more data is needed. */ htp_status_t htp_connp_RES_IDLE(htp_connp_t *connp) { // We want to start parsing the next response (and change // the state from IDLE) only if there's at least one // byte of data available. Otherwise we could be creating // new structures even if there's no more data on the // connection. OUT_TEST_NEXT_BYTE_OR_RETURN(connp); // Parsing a new response // Find the next outgoing transaction connp->out_tx = htp_list_get(connp->conn->transactions, connp->out_next_tx_index); if (connp->out_tx == NULL) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Unable to match response to request"); return HTP_ERROR; } // We've used one transaction connp->out_next_tx_index++; // TODO Detect state mismatch connp->out_content_length = -1; connp->out_body_data_left = -1; htp_status_t rc = htp_tx_state_response_start(connp->out_tx); if (rc != HTP_OK) return rc; return HTP_OK; } int htp_connp_res_data(htp_connp_t *connp, const htp_time_t *timestamp, const void *data, size_t len) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data(connp->out_status %x)\n", connp->out_status); fprint_raw_data(stderr, __func__, data, len); #endif // Return if the connection is in stop state if (connp->out_status == HTP_STREAM_STOP) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_INFO, 0, "Outbound parser is in HTP_STREAM_STOP"); return HTP_STREAM_STOP; } // Return if the connection has had a fatal error if (connp->out_status == HTP_STREAM_ERROR) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Outbound parser is in HTP_STREAM_ERROR"); #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_DATA (previous error)\n"); #endif return HTP_STREAM_ERROR; } // Sanity check: we must have a transaction pointer if the state is not IDLE (no outbound transaction) if ((connp->out_tx == NULL)&&(connp->out_state != htp_connp_RES_IDLE)) { connp->out_status = HTP_STREAM_ERROR; htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Missing outbound transaction data"); return HTP_STREAM_ERROR; } // If the length of the supplied data chunk is zero, proceed // only if the stream has been closed. We do not allow zero-sized // chunks in the API, but we use it internally to force the parsers // to finalize parsing. if (((data == NULL) || (len == 0)) && (connp->out_status != HTP_STREAM_CLOSED)) { htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Zero-length data chunks are not allowed"); #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_DATA (zero-length chunk)\n"); #endif return HTP_STREAM_CLOSED; } // Remember the timestamp of the current response data chunk if (timestamp != NULL) { memcpy(&connp->out_timestamp, timestamp, sizeof (*timestamp)); } // Store the current chunk information connp->out_current_data = (unsigned char *) data; connp->out_current_len = len; connp->out_current_read_offset = 0; connp->out_current_consume_offset = 0; connp->out_current_receiver_offset = 0; htp_conn_track_outbound_data(connp->conn, len, timestamp); // Return without processing any data if the stream is in tunneling // mode (which it would be after an initial CONNECT transaction. if (connp->out_status == HTP_STREAM_TUNNEL) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_TUNNEL\n"); #endif return HTP_STREAM_TUNNEL; } // Invoke a processor, in a loop, until an error // occurs or until we run out of data. Many processors // will process a request, each pointing to the next // processor that needs to run. for (;;) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: out state=%s, progress=%s\n", htp_connp_out_state_as_string(connp), htp_tx_response_progress_as_string(connp->out_tx)); #endif // Return if there's been an error // or if we've run out of data. We are relying // on processors to add error messages, so we'll // keep quiet here. htp_status_t rc = connp->out_state(connp); if (rc == HTP_OK) { if (connp->out_status == HTP_STREAM_TUNNEL) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_TUNNEL\n"); #endif return HTP_STREAM_TUNNEL; } rc = htp_res_handle_state_change(connp); } if (rc != HTP_OK) { // Do we need more data? if ((rc == HTP_DATA) || (rc == HTP_DATA_BUFFER)) { htp_connp_res_receiver_send_data(connp, 0 /* not last */); if (rc == HTP_DATA_BUFFER) { if (htp_connp_res_buffer(connp) != HTP_OK) { connp->out_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } } #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_DATA\n"); #endif connp->out_status = HTP_STREAM_DATA; return HTP_STREAM_DATA; } // Check for stop if (rc == HTP_STOP) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_STOP\n"); #endif connp->out_status = HTP_STREAM_STOP; return HTP_STREAM_STOP; } // Check for suspended parsing if (rc == HTP_DATA_OTHER) { // We might have actually consumed the entire data chunk? if (connp->out_current_read_offset >= connp->out_current_len) { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_DATA (suspended parsing)\n"); #endif connp->out_status = HTP_STREAM_DATA; // Do not send STREAM_DATE_DATA_OTHER if we've // consumed the entire chunk return HTP_STREAM_DATA; } else { #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_DATA_OTHER\n"); #endif connp->out_status = HTP_STREAM_DATA_OTHER; // Partial chunk consumption return HTP_STREAM_DATA_OTHER; } } #ifdef HTP_DEBUG fprintf(stderr, "htp_connp_res_data: returning HTP_STREAM_ERROR\n"); #endif // Permanent stream error. connp->out_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } } // Permanent stream error. connp->out_status = HTP_STREAM_ERROR; return HTP_STREAM_ERROR; } suricata-3.2.1/libhtp/missing0000755000000000000000000001533013051004463013076 00000000000000#! /bin/sh # Common wrapper for a few potentially missing GNU programs. scriptversion=2013-10-28.13; # UTC # Copyright (C) 1996-2014 Free Software Foundation, Inc. # Originally written by Fran,cois Pinard , 1996. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. if test $# -eq 0; then echo 1>&2 "Try '$0 --help' for more information" exit 1 fi case $1 in --is-lightweight) # Used by our autoconf macros to check whether the available missing # script is modern enough. exit 0 ;; --run) # Back-compat with the calling convention used by older automake. shift ;; -h|--h|--he|--hel|--help) echo "\ $0 [OPTION]... PROGRAM [ARGUMENT]... Run 'PROGRAM [ARGUMENT]...', returning a proper advice when this fails due to PROGRAM being missing or too old. Options: -h, --help display this help and exit -v, --version output version information and exit Supported PROGRAM values: aclocal autoconf autoheader autom4te automake makeinfo bison yacc flex lex help2man Version suffixes to PROGRAM as well as the prefixes 'gnu-', 'gnu', and 'g' are ignored when checking the name. Send bug reports to ." exit $? ;; -v|--v|--ve|--ver|--vers|--versi|--versio|--version) echo "missing $scriptversion (GNU Automake)" exit $? ;; -*) echo 1>&2 "$0: unknown '$1' option" echo 1>&2 "Try '$0 --help' for more information" exit 1 ;; esac # Run the given program, remember its exit status. "$@"; st=$? # If it succeeded, we are done. test $st -eq 0 && exit 0 # Also exit now if we it failed (or wasn't found), and '--version' was # passed; such an option is passed most likely to detect whether the # program is present and works. case $2 in --version|--help) exit $st;; esac # Exit code 63 means version mismatch. This often happens when the user # tries to use an ancient version of a tool on a file that requires a # minimum version. if test $st -eq 63; then msg="probably too old" elif test $st -eq 127; then # Program was missing. msg="missing on your system" else # Program was found and executed, but failed. Give up. exit $st fi perl_URL=http://www.perl.org/ flex_URL=http://flex.sourceforge.net/ gnu_software_URL=http://www.gnu.org/software program_details () { case $1 in aclocal|automake) echo "The '$1' program is part of the GNU Automake package:" echo "<$gnu_software_URL/automake>" echo "It also requires GNU Autoconf, GNU m4 and Perl in order to run:" echo "<$gnu_software_URL/autoconf>" echo "<$gnu_software_URL/m4/>" echo "<$perl_URL>" ;; autoconf|autom4te|autoheader) echo "The '$1' program is part of the GNU Autoconf package:" echo "<$gnu_software_URL/autoconf/>" echo "It also requires GNU m4 and Perl in order to run:" echo "<$gnu_software_URL/m4/>" echo "<$perl_URL>" ;; esac } give_advice () { # Normalize program name to check for. normalized_program=`echo "$1" | sed ' s/^gnu-//; t s/^gnu//; t s/^g//; t'` printf '%s\n' "'$1' is $msg." configure_deps="'configure.ac' or m4 files included by 'configure.ac'" case $normalized_program in autoconf*) echo "You should only need it if you modified 'configure.ac'," echo "or m4 files included by it." program_details 'autoconf' ;; autoheader*) echo "You should only need it if you modified 'acconfig.h' or" echo "$configure_deps." program_details 'autoheader' ;; automake*) echo "You should only need it if you modified 'Makefile.am' or" echo "$configure_deps." program_details 'automake' ;; aclocal*) echo "You should only need it if you modified 'acinclude.m4' or" echo "$configure_deps." program_details 'aclocal' ;; autom4te*) echo "You might have modified some maintainer files that require" echo "the 'autom4te' program to be rebuilt." program_details 'autom4te' ;; bison*|yacc*) echo "You should only need it if you modified a '.y' file." echo "You may want to install the GNU Bison package:" echo "<$gnu_software_URL/bison/>" ;; lex*|flex*) echo "You should only need it if you modified a '.l' file." echo "You may want to install the Fast Lexical Analyzer package:" echo "<$flex_URL>" ;; help2man*) echo "You should only need it if you modified a dependency" \ "of a man page." echo "You may want to install the GNU Help2man package:" echo "<$gnu_software_URL/help2man/>" ;; makeinfo*) echo "You should only need it if you modified a '.texi' file, or" echo "any other file indirectly affecting the aspect of the manual." echo "You might want to install the Texinfo package:" echo "<$gnu_software_URL/texinfo/>" echo "The spurious makeinfo call might also be the consequence of" echo "using a buggy 'make' (AIX, DU, IRIX), in which case you might" echo "want to install GNU make:" echo "<$gnu_software_URL/make/>" ;; *) echo "You might have modified some files without having the proper" echo "tools for further handling them. Check the 'README' file, it" echo "often tells you about the needed prerequisites for installing" echo "this package. You may also peek at any GNU archive site, in" echo "case some other package contains this missing '$1' program." ;; esac } give_advice "$1" | sed -e '1s/^/WARNING: /' \ -e '2,$s/^/ /' >&2 # Propagate the correct exit status (expected to be 127 for a program # not found, 63 for a program that failed due to version mismatch). exit $st # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/libhtp/INSTALL0000644000000000000000000003661013051004463012534 00000000000000Installation Instructions ************************* Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation, Inc. Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without warranty of any kind. Basic Installation ================== Briefly, the shell command `./configure && make && make install' should configure, build, and install this package. The following more-detailed instructions are generic; see the `README' file for instructions specific to this package. Some packages provide this `INSTALL' file but do not implement all of the features documented below. The lack of an optional feature in a given package is not necessarily a bug. More recommendations for GNU packages can be found in *note Makefile Conventions: (standards)Makefile Conventions. The `configure' shell script attempts to guess correct values for various system-dependent variables used during compilation. It uses those values to create a `Makefile' in each directory of the package. It may also create one or more `.h' files containing system-dependent definitions. Finally, it creates a shell script `config.status' that you can run in the future to recreate the current configuration, and a file `config.log' containing compiler output (useful mainly for debugging `configure'). It can also use an optional file (typically called `config.cache' and enabled with `--cache-file=config.cache' or simply `-C') that saves the results of its tests to speed up reconfiguring. Caching is disabled by default to prevent problems with accidental use of stale cache files. If you need to do unusual things to compile the package, please try to figure out how `configure' could check whether to do them, and mail diffs or instructions to the address given in the `README' so they can be considered for the next release. If you are using the cache, and at some point `config.cache' contains results you don't want to keep, you may remove or edit it. The file `configure.ac' (or `configure.in') is used to create `configure' by a program called `autoconf'. You need `configure.ac' if you want to change it or regenerate `configure' using a newer version of `autoconf'. The simplest way to compile this package is: 1. `cd' to the directory containing the package's source code and type `./configure' to configure the package for your system. Running `configure' might take a while. While running, it prints some messages telling which features it is checking for. 2. Type `make' to compile the package. 3. Optionally, type `make check' to run any self-tests that come with the package, generally using the just-built uninstalled binaries. 4. Type `make install' to install the programs and any data files and documentation. When installing into a prefix owned by root, it is recommended that the package be configured and built as a regular user, and only the `make install' phase executed with root privileges. 5. Optionally, type `make installcheck' to repeat any self-tests, but this time using the binaries in their final installed location. This target does not install anything. Running this target as a regular user, particularly if the prior `make install' required root privileges, verifies that the installation completed correctly. 6. You can remove the program binaries and object files from the source code directory by typing `make clean'. To also remove the files that `configure' created (so you can compile the package for a different kind of computer), type `make distclean'. There is also a `make maintainer-clean' target, but that is intended mainly for the package's developers. If you use it, you may have to get all sorts of other programs in order to regenerate files that came with the distribution. 7. Often, you can also type `make uninstall' to remove the installed files again. In practice, not all packages have tested that uninstallation works correctly, even though it is required by the GNU Coding Standards. 8. Some packages, particularly those that use Automake, provide `make distcheck', which can by used by developers to test that all other targets like `make install' and `make uninstall' work correctly. This target is generally not run by end users. Compilers and Options ===================== Some systems require unusual options for compilation or linking that the `configure' script does not know about. Run `./configure --help' for details on some of the pertinent environment variables. You can give `configure' initial values for configuration parameters by setting variables in the command line or in the environment. Here is an example: ./configure CC=c99 CFLAGS=-g LIBS=-lposix *Note Defining Variables::, for more details. Compiling For Multiple Architectures ==================================== You can compile the package for more than one kind of computer at the same time, by placing the object files for each architecture in their own directory. To do this, you can use GNU `make'. `cd' to the directory where you want the object files and executables to go and run the `configure' script. `configure' automatically checks for the source code in the directory that `configure' is in and in `..'. This is known as a "VPATH" build. With a non-GNU `make', it is safer to compile the package for one architecture at a time in the source code directory. After you have installed the package for one architecture, use `make distclean' before reconfiguring for another architecture. On MacOS X 10.5 and later systems, you can create libraries and executables that work on multiple system types--known as "fat" or "universal" binaries--by specifying multiple `-arch' options to the compiler but only a single `-arch' option to the preprocessor. Like this: ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \ CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \ CPP="gcc -E" CXXCPP="g++ -E" This is not guaranteed to produce working output in all cases, you may have to build one architecture at a time and combine the results using the `lipo' tool if you have problems. Installation Names ================== By default, `make install' installs the package's commands under `/usr/local/bin', include files under `/usr/local/include', etc. You can specify an installation prefix other than `/usr/local' by giving `configure' the option `--prefix=PREFIX', where PREFIX must be an absolute file name. You can specify separate installation prefixes for architecture-specific files and architecture-independent files. If you pass the option `--exec-prefix=PREFIX' to `configure', the package uses PREFIX as the prefix for installing programs and libraries. Documentation and other data files still use the regular prefix. In addition, if you use an unusual directory layout you can give options like `--bindir=DIR' to specify different values for particular kinds of files. Run `configure --help' for a list of the directories you can set and what kinds of files go in them. In general, the default for these options is expressed in terms of `${prefix}', so that specifying just `--prefix' will affect all of the other directory specifications that were not explicitly provided. The most portable way to affect installation locations is to pass the correct locations to `configure'; however, many packages provide one or both of the following shortcuts of passing variable assignments to the `make install' command line to change installation locations without having to reconfigure or recompile. The first method involves providing an override variable for each affected directory. For example, `make install prefix=/alternate/directory' will choose an alternate location for all directory configuration variables that were expressed in terms of `${prefix}'. Any directories that were specified during `configure', but not in terms of `${prefix}', must each be overridden at install time for the entire installation to be relocated. The approach of makefile variable overrides for each directory variable is required by the GNU Coding Standards, and ideally causes no recompilation. However, some platforms have known limitations with the semantics of shared libraries that end up requiring recompilation when using this method, particularly noticeable in packages that use GNU Libtool. The second method involves providing the `DESTDIR' variable. For example, `make install DESTDIR=/alternate/directory' will prepend `/alternate/directory' before all installation names. The approach of `DESTDIR' overrides is not required by the GNU Coding Standards, and does not work on platforms that have drive letters. On the other hand, it does better at avoiding recompilation issues, and works well even when some directory options were not specified in terms of `${prefix}' at `configure' time. Optional Features ================= If the package supports it, you can cause programs to be installed with an extra prefix or suffix on their names by giving `configure' the option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. Some packages pay attention to `--enable-FEATURE' options to `configure', where FEATURE indicates an optional part of the package. They may also pay attention to `--with-PACKAGE' options, where PACKAGE is something like `gnu-as' or `x' (for the X Window System). The `README' should mention any `--enable-' and `--with-' options that the package recognizes. For packages that use the X Window System, `configure' can usually find the X include and library files automatically, but if it doesn't, you can use the `configure' options `--x-includes=DIR' and `--x-libraries=DIR' to specify their locations. Some packages offer the ability to configure how verbose the execution of `make' will be. For these packages, running `./configure --enable-silent-rules' sets the default to minimal output, which can be overridden with `make V=1'; while running `./configure --disable-silent-rules' sets the default to verbose, which can be overridden with `make V=0'. Particular systems ================== On HP-UX, the default C compiler is not ANSI C compatible. If GNU CC is not installed, it is recommended to use the following options in order to use an ANSI C compiler: ./configure CC="cc -Ae -D_XOPEN_SOURCE=500" and if that doesn't work, install pre-built binaries of GCC for HP-UX. HP-UX `make' updates targets which have the same time stamps as their prerequisites, which makes it generally unusable when shipped generated files such as `configure' are involved. Use GNU `make' instead. On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot parse its `' header file. The option `-nodtk' can be used as a workaround. If GNU CC is not installed, it is therefore recommended to try ./configure CC="cc" and if that doesn't work, try ./configure CC="cc -nodtk" On Solaris, don't put `/usr/ucb' early in your `PATH'. This directory contains several dysfunctional programs; working variants of these programs are available in `/usr/bin'. So, if you need `/usr/ucb' in your `PATH', put it _after_ `/usr/bin'. On Haiku, software installed for all users goes in `/boot/common', not `/usr/local'. It is recommended to use the following options: ./configure --prefix=/boot/common Specifying the System Type ========================== There may be some features `configure' cannot figure out automatically, but needs to determine by the type of machine the package will run on. Usually, assuming the package is built to be run on the _same_ architectures, `configure' can figure that out, but if it prints a message saying it cannot guess the machine type, give it the `--build=TYPE' option. TYPE can either be a short name for the system type, such as `sun4', or a canonical name which has the form: CPU-COMPANY-SYSTEM where SYSTEM can have one of these forms: OS KERNEL-OS See the file `config.sub' for the possible values of each field. If `config.sub' isn't included in this package, then this package doesn't need to know the machine type. If you are _building_ compiler tools for cross-compiling, you should use the option `--target=TYPE' to select the type of system they will produce code for. If you want to _use_ a cross compiler, that generates code for a platform different from the build platform, you should specify the "host" platform (i.e., that on which the generated programs will eventually be run) with `--host=TYPE'. Sharing Defaults ================ If you want to set default values for `configure' scripts to share, you can create a site shell script called `config.site' that gives default values for variables like `CC', `cache_file', and `prefix'. `configure' looks for `PREFIX/share/config.site' if it exists, then `PREFIX/etc/config.site' if it exists. Or, you can set the `CONFIG_SITE' environment variable to the location of the site script. A warning: not all `configure' scripts look for a site script. Defining Variables ================== Variables not defined in a site shell script can be set in the environment passed to `configure'. However, some packages may run configure again during the build, and the customized values of these variables may be lost. In order to avoid this problem, you should set them in the `configure' command line, using `VAR=value'. For example: ./configure CC=/usr/local2/bin/gcc causes the specified `gcc' to be used as the C compiler (unless it is overridden in the site shell script). Unfortunately, this technique does not work for `CONFIG_SHELL' due to an Autoconf limitation. Until the limitation is lifted, you can use this workaround: CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash `configure' Invocation ====================== `configure' recognizes the following options to control how it operates. `--help' `-h' Print a summary of all of the options to `configure', and exit. `--help=short' `--help=recursive' Print a summary of the options unique to this package's `configure', and exit. The `short' variant lists options used only in the top level, while the `recursive' variant lists options also present in any nested packages. `--version' `-V' Print the version of Autoconf used to generate the `configure' script, and exit. `--cache-file=FILE' Enable the cache: use and save the results of the tests in FILE, traditionally `config.cache'. FILE defaults to `/dev/null' to disable caching. `--config-cache' `-C' Alias for `--cache-file=config.cache'. `--quiet' `--silent' `-q' Do not print messages saying which checks are being made. To suppress all normal output, redirect it to `/dev/null' (any error messages will still be shown). `--srcdir=DIR' Look for the package's source code in directory DIR. Usually `configure' can determine that directory automatically. `--prefix=DIR' Use DIR as the installation prefix. *note Installation Names:: for more details, including other options available for fine-tuning the installation locations. `--no-create' `-n' Run the configure checks, but stop before creating any output files. `configure' also accepts some other, not widely useful, options. Run `configure --help' for more details. suricata-3.2.1/libhtp/AUTHORS0000644000000000000000000000042413051004451012542 00000000000000ivanr = Ivan Ristic b1v1r = Brian Rectanus wmetcalf = Will Metcalf calfeld = Christopher Alfeld glongo = Giuseppe Longo ironbee = The Iron Bee suricata-3.2.1/libhtp/config.guess0000755000000000000000000012475313051004463014031 00000000000000#! /bin/sh # Attempt to guess a canonical system name. # Copyright 1992-2015 Free Software Foundation, Inc. timestamp='2015-08-20' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # # Originally written by Per Bothner; maintained since 2000 by Ben Elliston. # # You can get the latest version of this script from: # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD # # Please send patches to . me=`echo "$0" | sed -e 's,.*/,,'` usage="\ Usage: $0 [OPTION] Output the configuration name of the system \`$me' is run on. Operation modes: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. Copyright 1992-2015 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" >&2 exit 1 ;; * ) break ;; esac done if test $# != 0; then echo "$me: too many arguments$help" >&2 exit 1 fi trap 'exit 1' 1 2 15 # CC_FOR_BUILD -- compiler used by this script. Note that the use of a # compiler to aid in system detection is discouraged as it requires # temporary files to be created and, as you can see below, it is a # headache to deal with in a portable fashion. # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still # use `HOST_CC' if defined, but it is deprecated. # Portable tmp directory creation inspired by the Autoconf team. set_cc_for_build=' trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ; trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ; : ${TMPDIR=/tmp} ; { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } || { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } || { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } || { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ; dummy=$tmp/dummy ; tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ; case $CC_FOR_BUILD,$HOST_CC,$CC in ,,) echo "int x;" > $dummy.c ; for c in cc gcc c89 c99 ; do if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then CC_FOR_BUILD="$c"; break ; fi ; done ; if test x"$CC_FOR_BUILD" = x ; then CC_FOR_BUILD=no_compiler_found ; fi ;; ,,*) CC_FOR_BUILD=$CC ;; ,*,*) CC_FOR_BUILD=$HOST_CC ;; esac ; set_cc_for_build= ;' # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 1994-08-24) if (test -f /.attbin/uname) >/dev/null 2>&1 ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown case "${UNAME_SYSTEM}" in Linux|GNU|GNU/*) # If the system lacks a compiler, then just pick glibc. # We could probably try harder. LIBC=gnu eval $set_cc_for_build cat <<-EOF > $dummy.c #include #if defined(__UCLIBC__) LIBC=uclibc #elif defined(__dietlibc__) LIBC=dietlibc #else LIBC=gnu #endif EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` ;; esac # Note: order is significant - the case branches are not exclusive. case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, # *-*-netbsdecoff* and *-*-netbsd*. For targets that recently # switched to ELF, *-*-netbsd* would select the old # object file format. This provides both forward # compatibility and a consistent mechanism for selecting the # object file format. # # Note: NetBSD doesn't particularly care about the vendor # portion of the name. We always set it to "unknown". sysctl="sysctl -n hw.machine_arch" UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \ /sbin/$sysctl 2>/dev/null || \ /usr/sbin/$sysctl 2>/dev/null || \ echo unknown)` case "${UNAME_MACHINE_ARCH}" in armeb) machine=armeb-unknown ;; arm*) machine=arm-unknown ;; sh3el) machine=shl-unknown ;; sh3eb) machine=sh-unknown ;; sh5el) machine=sh5le-unknown ;; earmv*) arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'` endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'` machine=${arch}${endian}-unknown ;; *) machine=${UNAME_MACHINE_ARCH}-unknown ;; esac # The Operating System including object format, if it has switched # to ELF recently, or will in the future. case "${UNAME_MACHINE_ARCH}" in arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax) eval $set_cc_for_build if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ELF__ then # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout). # Return netbsd for either. FIX? os=netbsd else os=netbsdelf fi ;; *) os=netbsd ;; esac # Determine ABI tags. case "${UNAME_MACHINE_ARCH}" in earm*) expr='s/^earmv[0-9]/-eabi/;s/eb$//' abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"` ;; esac # The OS release # Debian GNU/NetBSD machines have a different userland, and # thus, need a distinct triplet. However, they do not need # kernel version information, so it can be replaced with a # suitable tag, in the style of linux-gnu. case "${UNAME_VERSION}" in Debian*) release='-gnu' ;; *) release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2` ;; esac # Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM: # contains redundant information, the shorter form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used. echo "${machine}-${os}${release}${abi}" exit ;; *:Bitrig:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'` echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE} exit ;; *:OpenBSD:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'` echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE} exit ;; *:ekkoBSD:*:*) echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE} exit ;; *:SolidBSD:*:*) echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE} exit ;; macppc:MirBSD:*:*) echo powerpc-unknown-mirbsd${UNAME_RELEASE} exit ;; *:MirBSD:*:*) echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE} exit ;; *:Sortix:*:*) echo ${UNAME_MACHINE}-unknown-sortix exit ;; alpha:OSF1:*:*) case $UNAME_RELEASE in *4.0) UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'` ;; *5.*) UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'` ;; esac # According to Compaq, /usr/sbin/psrinfo has been available on # OSF/1 and Tru64 systems produced since 1995. I hope that # covers most systems running today. This code pipes the CPU # types through head -n 1, so we only detect the type of CPU 0. ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1` case "$ALPHA_CPU_TYPE" in "EV4 (21064)") UNAME_MACHINE="alpha" ;; "EV4.5 (21064)") UNAME_MACHINE="alpha" ;; "LCA4 (21066/21068)") UNAME_MACHINE="alpha" ;; "EV5 (21164)") UNAME_MACHINE="alphaev5" ;; "EV5.6 (21164A)") UNAME_MACHINE="alphaev56" ;; "EV5.6 (21164PC)") UNAME_MACHINE="alphapca56" ;; "EV5.7 (21164PC)") UNAME_MACHINE="alphapca57" ;; "EV6 (21264)") UNAME_MACHINE="alphaev6" ;; "EV6.7 (21264A)") UNAME_MACHINE="alphaev67" ;; "EV6.8CB (21264C)") UNAME_MACHINE="alphaev68" ;; "EV6.8AL (21264B)") UNAME_MACHINE="alphaev68" ;; "EV6.8CX (21264D)") UNAME_MACHINE="alphaev68" ;; "EV6.9A (21264/EV69A)") UNAME_MACHINE="alphaev69" ;; "EV7 (21364)") UNAME_MACHINE="alphaev7" ;; "EV7.9 (21364A)") UNAME_MACHINE="alphaev79" ;; esac # A Pn.n version is a patched version. # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` # Reset EXIT trap before exiting to avoid spurious non-zero exit code. exitcode=$? trap '' 0 exit $exitcode ;; Alpha\ *:Windows_NT*:*) # How do we know it's Interix rather than the generic POSIX subsystem? # Should we change UNAME_MACHINE based on the output of uname instead # of the specific Alpha model? echo alpha-pc-interix exit ;; 21064:Windows_NT:50:3) echo alpha-dec-winnt3.5 exit ;; Amiga*:UNIX_System_V:4.0:*) echo m68k-unknown-sysv4 exit ;; *:[Aa]miga[Oo][Ss]:*:*) echo ${UNAME_MACHINE}-unknown-amigaos exit ;; *:[Mm]orph[Oo][Ss]:*:*) echo ${UNAME_MACHINE}-unknown-morphos exit ;; *:OS/390:*:*) echo i370-ibm-openedition exit ;; *:z/VM:*:*) echo s390-ibm-zvmoe exit ;; *:OS400:*:*) echo powerpc-ibm-os400 exit ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) echo arm-acorn-riscix${UNAME_RELEASE} exit ;; arm*:riscos:*:*|arm*:RISCOS:*:*) echo arm-unknown-riscos exit ;; SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*) echo hppa1.1-hitachi-hiuxmpp exit ;; Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. if test "`(/bin/universe) 2>/dev/null`" = att ; then echo pyramid-pyramid-sysv3 else echo pyramid-pyramid-bsd fi exit ;; NILE*:*:*:dcosx) echo pyramid-pyramid-svr4 exit ;; DRS?6000:unix:4.0:6*) echo sparc-icl-nx6 exit ;; DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*) case `/usr/bin/uname -p` in sparc) echo sparc-icl-nx7; exit ;; esac ;; s390x:SunOS:*:*) echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4H:SunOS:5.*:*) echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*) echo i386-pc-auroraux${UNAME_RELEASE} exit ;; i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*) eval $set_cc_for_build SUN_ARCH="i386" # If there is a compiler, see if it is configured for 64-bit objects. # Note that the Sun cc does not turn __LP64__ into 1 like gcc does. # This test works for both compilers. if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then SUN_ARCH="x86_64" fi fi echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; sun4*:SunOS:*:*) case "`/usr/bin/arch -k`" in Series*|S4*) UNAME_RELEASE=`uname -v` ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'` exit ;; sun3*:SunOS:*:*) echo m68k-sun-sunos${UNAME_RELEASE} exit ;; sun*:*:4.2BSD:*) UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null` test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3 case "`/bin/arch`" in sun3) echo m68k-sun-sunos${UNAME_RELEASE} ;; sun4) echo sparc-sun-sunos${UNAME_RELEASE} ;; esac exit ;; aushp:SunOS:*:*) echo sparc-auspex-sunos${UNAME_RELEASE} exit ;; # The situation for MiNT is a little confusing. The machine name # can be virtually everything (everything which is not # "atarist" or "atariste" at least should have a processor # > m68000). The system name ranges from "MiNT" over "FreeMiNT" # to the lowercase version "mint" (or "freemint"). Finally # the system name "TOS" denotes a system which is actually not # MiNT. But MiNT is downward compatible to TOS, so this should # be no problem. atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*) echo m68k-atari-mint${UNAME_RELEASE} exit ;; milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*) echo m68k-milan-mint${UNAME_RELEASE} exit ;; hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*) echo m68k-hades-mint${UNAME_RELEASE} exit ;; *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*) echo m68k-unknown-mint${UNAME_RELEASE} exit ;; m68k:machten:*:*) echo m68k-apple-machten${UNAME_RELEASE} exit ;; powerpc:machten:*:*) echo powerpc-apple-machten${UNAME_RELEASE} exit ;; RISC*:Mach:*:*) echo mips-dec-mach_bsd4.3 exit ;; RISC*:ULTRIX:*:*) echo mips-dec-ultrix${UNAME_RELEASE} exit ;; VAX*:ULTRIX*:*:*) echo vax-dec-ultrix${UNAME_RELEASE} exit ;; 2020:CLIX:*:* | 2430:CLIX:*:*) echo clipper-intergraph-clix${UNAME_RELEASE} exit ;; mips:*:*:UMIPS | mips:*:*:RISCos) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #ifdef __cplusplus #include /* for printf() prototype */ int main (int argc, char *argv[]) { #else int main (argc, argv) int argc; char *argv[]; { #endif #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF $CC_FOR_BUILD -o $dummy $dummy.c && dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` && SYSTEM_NAME=`$dummy $dummyarg` && { echo "$SYSTEM_NAME"; exit; } echo mips-mips-riscos${UNAME_RELEASE} exit ;; Motorola:PowerMAX_OS:*:*) echo powerpc-motorola-powermax exit ;; Motorola:*:4.3:PL8-*) echo powerpc-harris-powermax exit ;; Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*) echo powerpc-harris-powermax exit ;; Night_Hawk:Power_UNIX:*:*) echo powerpc-harris-powerunix exit ;; m88k:CX/UX:7*:*) echo m88k-harris-cxux7 exit ;; m88k:*:4*:R4*) echo m88k-motorola-sysv4 exit ;; m88k:*:3*:R3*) echo m88k-motorola-sysv3 exit ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=`/usr/bin/uname -p` if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ] then if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \ [ ${TARGET_BINARY_INTERFACE}x = x ] then echo m88k-dg-dgux${UNAME_RELEASE} else echo m88k-dg-dguxbcs${UNAME_RELEASE} fi else echo i586-dg-dgux${UNAME_RELEASE} fi exit ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) echo m88k-dolphin-sysv3 exit ;; M88*:*:R3*:*) # Delta 88k system running SVR3 echo m88k-motorola-sysv3 exit ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) echo m88k-tektronix-sysv3 exit ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) echo m68k-tektronix-bsd exit ;; *:IRIX*:*:*) echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'` exit ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id exit ;; # Note that: echo "'`uname -s`'" gives 'AIX ' i*86:AIX:*:*) echo i386-ibm-aix exit ;; ia64:AIX:*:*) if [ -x /usr/bin/oslevel ] ; then IBM_REV=`/usr/bin/oslevel` else IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} fi echo ${UNAME_MACHINE}-ibm-aix${IBM_REV} exit ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #include main() { if (!__power_pc()) exit(1); puts("powerpc-ibm-aix3.2.5"); exit(0); } EOF if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` then echo "$SYSTEM_NAME" else echo rs6000-ibm-aix3.2.5 fi elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then echo rs6000-ibm-aix3.2.4 else echo rs6000-ibm-aix3.2 fi exit ;; *:AIX:*:[4567]) IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'` if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi if [ -x /usr/bin/lslpp ] ; then IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | awk -F: '{ print $3 }' | sed s/[0-9]*$/0/` else IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} fi echo ${IBM_ARCH}-ibm-aix${IBM_REV} exit ;; *:AIX:*:*) echo rs6000-ibm-aix exit ;; ibmrt:4.4BSD:*|romp-ibm:BSD:*) echo romp-ibm-bsd4.4 exit ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to exit ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) echo rs6000-bull-bosx exit ;; DPX/2?00:B.O.S.:*:*) echo m68k-bull-sysv3 exit ;; 9000/[34]??:4.3bsd:1.*:*) echo m68k-hp-bsd exit ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) echo m68k-hp-bsd4.4 exit ;; 9000/[34678]??:HP-UX:*:*) HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` case "${UNAME_MACHINE}" in 9000/31? ) HP_ARCH=m68000 ;; 9000/[34]?? ) HP_ARCH=m68k ;; 9000/[678][0-9][0-9]) if [ -x /usr/bin/getconf ]; then sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null` sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null` case "${sc_cpu_version}" in 523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0 528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1 532) # CPU_PA_RISC2_0 case "${sc_kernel_bits}" in 32) HP_ARCH="hppa2.0n" ;; 64) HP_ARCH="hppa2.0w" ;; '') HP_ARCH="hppa2.0" ;; # HP-UX 10.20 esac ;; esac fi if [ "${HP_ARCH}" = "" ]; then eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #define _HPUX_SOURCE #include #include int main () { #if defined(_SC_KERNEL_BITS) long bits = sysconf(_SC_KERNEL_BITS); #endif long cpu = sysconf (_SC_CPU_VERSION); switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0"); break; case CPU_PA_RISC1_1: puts ("hppa1.1"); break; case CPU_PA_RISC2_0: #if defined(_SC_KERNEL_BITS) switch (bits) { case 64: puts ("hppa2.0w"); break; case 32: puts ("hppa2.0n"); break; default: puts ("hppa2.0"); break; } break; #else /* !defined(_SC_KERNEL_BITS) */ puts ("hppa2.0"); break; #endif default: puts ("hppa1.0"); break; } exit (0); } EOF (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy` test -z "$HP_ARCH" && HP_ARCH=hppa fi ;; esac if [ ${HP_ARCH} = "hppa2.0w" ] then eval $set_cc_for_build # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating # 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler # generating 64-bit code. GNU and HP use different nomenclature: # # $ CC_FOR_BUILD=cc ./config.guess # => hppa2.0w-hp-hpux11.23 # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess # => hppa64-hp-hpux11.23 if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | grep -q __LP64__ then HP_ARCH="hppa2.0w" else HP_ARCH="hppa64" fi fi echo ${HP_ARCH}-hp-hpux${HPUX_REV} exit ;; ia64:HP-UX:*:*) HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` echo ia64-hp-hpux${HPUX_REV} exit ;; 3050*:HI-UX:*:*) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #include int main () { long cpu = sysconf (_SC_CPU_VERSION); /* The order matters, because CPU_IS_HP_MC68K erroneously returns true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct results, however. */ if (CPU_IS_PA_RISC (cpu)) { switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break; case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break; case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break; default: puts ("hppa-hitachi-hiuxwe2"); break; } } else if (CPU_IS_HP_MC68K (cpu)) puts ("m68k-hitachi-hiuxwe2"); else puts ("unknown-hitachi-hiuxwe2"); exit (0); } EOF $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` && { echo "$SYSTEM_NAME"; exit; } echo unknown-hitachi-hiuxwe2 exit ;; 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* ) echo hppa1.1-hp-bsd exit ;; 9000/8??:4.3bsd:*:*) echo hppa1.0-hp-bsd exit ;; *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*) echo hppa1.0-hp-mpeix exit ;; hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* ) echo hppa1.1-hp-osf exit ;; hp8??:OSF1:*:*) echo hppa1.0-hp-osf exit ;; i*86:OSF1:*:*) if [ -x /usr/sbin/sysversion ] ; then echo ${UNAME_MACHINE}-unknown-osf1mk else echo ${UNAME_MACHINE}-unknown-osf1 fi exit ;; parisc*:Lites*:*:*) echo hppa1.1-hp-lites exit ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) echo c1-convex-bsd exit ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) echo c34-convex-bsd exit ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) echo c38-convex-bsd exit ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) echo c4-convex-bsd exit ;; CRAY*Y-MP:*:*:*) echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*[A-Z]90:*:*:*) echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \ -e 's/\.[^.]*$/.X/' exit ;; CRAY*TS:*:*:*) echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*T3E:*:*:*) echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; CRAY*SV1:*:*:*) echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; *:UNICOS/mp:*:*) echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*) FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; 5000:UNIX_System_V:4.*:*) FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'` echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*) echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE} exit ;; sparc*:BSD/OS:*:*) echo sparc-unknown-bsdi${UNAME_RELEASE} exit ;; *:BSD/OS:*:*) echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE} exit ;; *:FreeBSD:*:*) UNAME_PROCESSOR=`/usr/bin/uname -p` case ${UNAME_PROCESSOR} in amd64) echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; *) echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; esac exit ;; i*:CYGWIN*:*) echo ${UNAME_MACHINE}-pc-cygwin exit ;; *:MINGW64*:*) echo ${UNAME_MACHINE}-pc-mingw64 exit ;; *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; *:MSYS*:*) echo ${UNAME_MACHINE}-pc-msys exit ;; i*:windows32*:*) # uname -m includes "-pc" on this system. echo ${UNAME_MACHINE}-mingw32 exit ;; i*:PW*:*) echo ${UNAME_MACHINE}-pc-pw32 exit ;; *:Interix*:*) case ${UNAME_MACHINE} in x86) echo i586-pc-interix${UNAME_RELEASE} exit ;; authenticamd | genuineintel | EM64T) echo x86_64-unknown-interix${UNAME_RELEASE} exit ;; IA64) echo ia64-unknown-interix${UNAME_RELEASE} exit ;; esac ;; [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*) echo i${UNAME_MACHINE}-pc-mks exit ;; 8664:Windows_NT:*) echo x86_64-pc-mks exit ;; i*:Windows_NT*:* | Pentium*:Windows_NT*:*) # How do we know it's Interix rather than the generic POSIX subsystem? # It also conflicts with pre-2.0 versions of AT&T UWIN. Should we # UNAME_MACHINE based on the output of uname instead of i386? echo i586-pc-interix exit ;; i*:UWIN*:*) echo ${UNAME_MACHINE}-pc-uwin exit ;; amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*) echo x86_64-unknown-cygwin exit ;; p*:CYGWIN*:*) echo powerpcle-unknown-cygwin exit ;; prep*:SunOS:5.*:*) echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit ;; *:GNU:*:*) # the GNU system echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'` exit ;; *:GNU/*:*:*) # other systems with GNU libc and userland echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC} exit ;; i*86:Minix:*:*) echo ${UNAME_MACHINE}-pc-minix exit ;; aarch64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; aarch64_be:Linux:*:*) UNAME_MACHINE=aarch64_be echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; alpha:Linux:*:*) case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in EV5) UNAME_MACHINE=alphaev5 ;; EV56) UNAME_MACHINE=alphaev56 ;; PCA56) UNAME_MACHINE=alphapca56 ;; PCA57) UNAME_MACHINE=alphapca56 ;; EV6) UNAME_MACHINE=alphaev6 ;; EV67) UNAME_MACHINE=alphaev67 ;; EV68*) UNAME_MACHINE=alphaev68 ;; esac objdump --private-headers /bin/sh | grep -q ld.so.1 if test "$?" = 0 ; then LIBC="gnulibc1" ; fi echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; arc:Linux:*:* | arceb:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; arm*:Linux:*:*) eval $set_cc_for_build if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_EABI__ then echo ${UNAME_MACHINE}-unknown-linux-${LIBC} else if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_PCS_VFP then echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi else echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf fi fi exit ;; avr32*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; cris:Linux:*:*) echo ${UNAME_MACHINE}-axis-linux-${LIBC} exit ;; crisv32:Linux:*:*) echo ${UNAME_MACHINE}-axis-linux-${LIBC} exit ;; e2k:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; frv:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; hexagon:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; i*86:Linux:*:*) echo ${UNAME_MACHINE}-pc-linux-${LIBC} exit ;; ia64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; m32r*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; m68*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; mips:Linux:*:* | mips64:Linux:*:*) eval $set_cc_for_build sed 's/^ //' << EOF >$dummy.c #undef CPU #undef ${UNAME_MACHINE} #undef ${UNAME_MACHINE}el #if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) CPU=${UNAME_MACHINE}el #else #if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) CPU=${UNAME_MACHINE} #else CPU= #endif #endif EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } ;; openrisc*:Linux:*:*) echo or1k-unknown-linux-${LIBC} exit ;; or32:Linux:*:* | or1k*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; padre:Linux:*:*) echo sparc-unknown-linux-${LIBC} exit ;; parisc64:Linux:*:* | hppa64:Linux:*:*) echo hppa64-unknown-linux-${LIBC} exit ;; parisc:Linux:*:* | hppa:Linux:*:*) # Look for CPU level case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in PA7*) echo hppa1.1-unknown-linux-${LIBC} ;; PA8*) echo hppa2.0-unknown-linux-${LIBC} ;; *) echo hppa-unknown-linux-${LIBC} ;; esac exit ;; ppc64:Linux:*:*) echo powerpc64-unknown-linux-${LIBC} exit ;; ppc:Linux:*:*) echo powerpc-unknown-linux-${LIBC} exit ;; ppc64le:Linux:*:*) echo powerpc64le-unknown-linux-${LIBC} exit ;; ppcle:Linux:*:*) echo powerpcle-unknown-linux-${LIBC} exit ;; s390:Linux:*:* | s390x:Linux:*:*) echo ${UNAME_MACHINE}-ibm-linux-${LIBC} exit ;; sh64*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; sh*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; sparc:Linux:*:* | sparc64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; tile*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; vax:Linux:*:*) echo ${UNAME_MACHINE}-dec-linux-${LIBC} exit ;; x86_64:Linux:*:*) echo ${UNAME_MACHINE}-pc-linux-${LIBC} exit ;; xtensa*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; i*86:DYNIX/ptx:4*:*) # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. # earlier versions are messed up and put the nodename in both # sysname and nodename. echo i386-sequent-sysv4 exit ;; i*86:UNIX_SV:4.2MP:2.*) # Unixware is an offshoot of SVR4, but it has its own version # number series starting with 2... # I am not positive that other SVR4 systems won't match this, # I just have to hope. -- rms. # Use sysv4.2uw... so that sysv4* matches it. echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION} exit ;; i*86:OS/2:*:*) # If we were able to find `uname', then EMX Unix compatibility # is probably installed. echo ${UNAME_MACHINE}-pc-os2-emx exit ;; i*86:XTS-300:*:STOP) echo ${UNAME_MACHINE}-unknown-stop exit ;; i*86:atheos:*:*) echo ${UNAME_MACHINE}-unknown-atheos exit ;; i*86:syllable:*:*) echo ${UNAME_MACHINE}-pc-syllable exit ;; i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*) echo i386-unknown-lynxos${UNAME_RELEASE} exit ;; i*86:*DOS:*:*) echo ${UNAME_MACHINE}-pc-msdosdjgpp exit ;; i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*) UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'` if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL} else echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL} fi exit ;; i*86:*:5:[678]*) # UnixWare 7.x, OpenUNIX and OpenServer 6. case `/bin/uname -X | grep "^Machine"` in *486*) UNAME_MACHINE=i486 ;; *Pentium) UNAME_MACHINE=i586 ;; *Pent*|*Celeron) UNAME_MACHINE=i686 ;; esac echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION} exit ;; i*86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')` (/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486 (/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \ && UNAME_MACHINE=i586 (/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \ && UNAME_MACHINE=i686 (/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \ && UNAME_MACHINE=i686 echo ${UNAME_MACHINE}-pc-sco$UNAME_REL else echo ${UNAME_MACHINE}-pc-sysv32 fi exit ;; pc:*:*:*) # Left here for compatibility: # uname -m prints for DJGPP always 'pc', but it prints nothing about # the processor, so we play safe by assuming i586. # Note: whatever this is, it MUST be the same as what config.sub # prints for the "djgpp" host, or else GDB configury will decide that # this is a cross-build. echo i586-pc-msdosdjgpp exit ;; Intel:Mach:3*:*) echo i386-pc-mach3 exit ;; paragon:*:*:*) echo i860-intel-osf1 exit ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4 fi exit ;; mini*:CTIX:SYS*5:*) # "miniframe" echo m68010-convergent-sysv exit ;; mc68k:UNIX:SYSTEM5:3.51m) echo m68k-convergent-sysv exit ;; M680?0:D-NIX:5.3:*) echo m68k-diab-dnix exit ;; M68*:*:R3V[5678]*:*) test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;; 3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0) OS_REL='' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4; exit; } ;; NCR*:*:4.2:* | MPRAS*:*:4.2:*) OS_REL='.3' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } /bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \ && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*) echo m68k-unknown-lynxos${UNAME_RELEASE} exit ;; mc68030:UNIX_System_V:4.*:*) echo m68k-atari-sysv4 exit ;; TSUNAMI:LynxOS:2.*:*) echo sparc-unknown-lynxos${UNAME_RELEASE} exit ;; rs6000:LynxOS:2.*:*) echo rs6000-unknown-lynxos${UNAME_RELEASE} exit ;; PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*) echo powerpc-unknown-lynxos${UNAME_RELEASE} exit ;; SM[BE]S:UNIX_SV:*:*) echo mips-dde-sysv${UNAME_RELEASE} exit ;; RM*:ReliantUNIX-*:*:*) echo mips-sni-sysv4 exit ;; RM*:SINIX-*:*:*) echo mips-sni-sysv4 exit ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=`(uname -p) 2>/dev/null` echo ${UNAME_MACHINE}-sni-sysv4 else echo ns32k-sni-sysv fi exit ;; PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says echo i586-unisys-sysv4 exit ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm echo hppa1.1-stratus-sysv4 exit ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. echo i860-stratus-sysv4 exit ;; i*86:VOS:*:*) # From Paul.Green@stratus.com. echo ${UNAME_MACHINE}-stratus-vos exit ;; *:VOS:*:*) # From Paul.Green@stratus.com. echo hppa1.1-stratus-vos exit ;; mc68*:A/UX:*:*) echo m68k-apple-aux${UNAME_RELEASE} exit ;; news*:NEWS-OS:6*:*) echo mips-sony-newsos6 exit ;; R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*) if [ -d /usr/nec ]; then echo mips-nec-sysv${UNAME_RELEASE} else echo mips-unknown-sysv${UNAME_RELEASE} fi exit ;; BeBox:BeOS:*:*) # BeOS running on hardware made by Be, PPC only. echo powerpc-be-beos exit ;; BeMac:BeOS:*:*) # BeOS running on Mac or Mac clone, PPC only. echo powerpc-apple-beos exit ;; BePC:BeOS:*:*) # BeOS running on Intel PC compatible. echo i586-pc-beos exit ;; BePC:Haiku:*:*) # Haiku running on Intel PC compatible. echo i586-pc-haiku exit ;; x86_64:Haiku:*:*) echo x86_64-unknown-haiku exit ;; SX-4:SUPER-UX:*:*) echo sx4-nec-superux${UNAME_RELEASE} exit ;; SX-5:SUPER-UX:*:*) echo sx5-nec-superux${UNAME_RELEASE} exit ;; SX-6:SUPER-UX:*:*) echo sx6-nec-superux${UNAME_RELEASE} exit ;; SX-7:SUPER-UX:*:*) echo sx7-nec-superux${UNAME_RELEASE} exit ;; SX-8:SUPER-UX:*:*) echo sx8-nec-superux${UNAME_RELEASE} exit ;; SX-8R:SUPER-UX:*:*) echo sx8r-nec-superux${UNAME_RELEASE} exit ;; Power*:Rhapsody:*:*) echo powerpc-apple-rhapsody${UNAME_RELEASE} exit ;; *:Rhapsody:*:*) echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE} exit ;; *:Darwin:*:*) UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown eval $set_cc_for_build if test "$UNAME_PROCESSOR" = unknown ; then UNAME_PROCESSOR=powerpc fi if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then case $UNAME_PROCESSOR in i386) UNAME_PROCESSOR=x86_64 ;; powerpc) UNAME_PROCESSOR=powerpc64 ;; esac fi fi elif test "$UNAME_PROCESSOR" = i386 ; then # Avoid executing cc on OS X 10.9, as it ships with a stub # that puts up a graphical alert prompting to install # developer tools. Any system running Mac OS X 10.7 or # later (Darwin 11 and later) is required to have a 64-bit # processor. This is not true of the ARM version of Darwin # that Apple uses in portable devices. UNAME_PROCESSOR=x86_64 fi echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE} exit ;; *:procnto*:*:* | *:QNX:[0123456789]*:*) UNAME_PROCESSOR=`uname -p` if test "$UNAME_PROCESSOR" = "x86"; then UNAME_PROCESSOR=i386 UNAME_MACHINE=pc fi echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE} exit ;; *:QNX:*:4*) echo i386-pc-qnx exit ;; NEO-?:NONSTOP_KERNEL:*:*) echo neo-tandem-nsk${UNAME_RELEASE} exit ;; NSE-*:NONSTOP_KERNEL:*:*) echo nse-tandem-nsk${UNAME_RELEASE} exit ;; NSR-?:NONSTOP_KERNEL:*:*) echo nsr-tandem-nsk${UNAME_RELEASE} exit ;; *:NonStop-UX:*:*) echo mips-compaq-nonstopux exit ;; BS2000:POSIX*:*:*) echo bs2000-siemens-sysv exit ;; DS/*:UNIX_System_V:*:*) echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE} exit ;; *:Plan9:*:*) # "uname -m" is not consistent, so use $cputype instead. 386 # is converted to i386 for consistency with other x86 # operating systems. if test "$cputype" = "386"; then UNAME_MACHINE=i386 else UNAME_MACHINE="$cputype" fi echo ${UNAME_MACHINE}-unknown-plan9 exit ;; *:TOPS-10:*:*) echo pdp10-unknown-tops10 exit ;; *:TENEX:*:*) echo pdp10-unknown-tenex exit ;; KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*) echo pdp10-dec-tops20 exit ;; XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*) echo pdp10-xkl-tops20 exit ;; *:TOPS-20:*:*) echo pdp10-unknown-tops20 exit ;; *:ITS:*:*) echo pdp10-unknown-its exit ;; SEI:*:*:SEIUX) echo mips-sei-seiux${UNAME_RELEASE} exit ;; *:DragonFly:*:*) echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` exit ;; *:*VMS:*:*) UNAME_MACHINE=`(uname -p) 2>/dev/null` case "${UNAME_MACHINE}" in A*) echo alpha-dec-vms ; exit ;; I*) echo ia64-dec-vms ; exit ;; V*) echo vax-dec-vms ; exit ;; esac ;; *:XENIX:*:SysV) echo i386-pc-xenix exit ;; i*86:skyos:*:*) echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//' exit ;; i*86:rdos:*:*) echo ${UNAME_MACHINE}-pc-rdos exit ;; i*86:AROS:*:*) echo ${UNAME_MACHINE}-pc-aros exit ;; x86_64:VMkernel:*:*) echo ${UNAME_MACHINE}-unknown-esx exit ;; esac cat >&2 < in order to provide the needed information to handle your system. config.guess timestamp = $timestamp uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null` /bin/uname -X = `(/bin/uname -X) 2>/dev/null` hostinfo = `(hostinfo) 2>/dev/null` /bin/universe = `(/bin/universe) 2>/dev/null` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null` /bin/arch = `(/bin/arch) 2>/dev/null` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null` UNAME_MACHINE = ${UNAME_MACHINE} UNAME_RELEASE = ${UNAME_RELEASE} UNAME_SYSTEM = ${UNAME_SYSTEM} UNAME_VERSION = ${UNAME_VERSION} EOF exit 1 # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: suricata-3.2.1/libhtp/test-driver0000755000000000000000000001104013051004463013667 00000000000000#! /bin/sh # test-driver - basic testsuite driver script. scriptversion=2013-07-13.22; # UTC # Copyright (C) 2011-2014 Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # This file is maintained in Automake, please report # bugs to or send patches to # . # Make unconditional expansion of undefined variables an error. This # helps a lot in preventing typo-related bugs. set -u usage_error () { echo "$0: $*" >&2 print_usage >&2 exit 2 } print_usage () { cat <$log_file 2>&1 estatus=$? if test $enable_hard_errors = no && test $estatus -eq 99; then tweaked_estatus=1 else tweaked_estatus=$estatus fi case $tweaked_estatus:$expect_failure in 0:yes) col=$red res=XPASS recheck=yes gcopy=yes;; 0:*) col=$grn res=PASS recheck=no gcopy=no;; 77:*) col=$blu res=SKIP recheck=no gcopy=yes;; 99:*) col=$mgn res=ERROR recheck=yes gcopy=yes;; *:yes) col=$lgn res=XFAIL recheck=no gcopy=yes;; *:*) col=$red res=FAIL recheck=yes gcopy=yes;; esac # Report the test outcome and exit status in the logs, so that one can # know whether the test passed or failed simply by looking at the '.log' # file, without the need of also peaking into the corresponding '.trs' # file (automake bug#11814). echo "$res $test_name (exit status: $estatus)" >>$log_file # Report outcome to console. echo "${col}${res}${std}: $test_name" # Register the test result, and other relevant metadata. echo ":test-result: $res" > $trs_file echo ":global-test-result: $res" >> $trs_file echo ":recheck: $recheck" >> $trs_file echo ":copy-in-global-log: $gcopy" >> $trs_file # Local Variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/libhtp/htp.pc.in0000644000000000000000000000044513051004451013221 00000000000000prefix=@prefix@ exec_prefix=@exec_prefix@ libdir=@libdir@ includedir=@includedir@ Name: @PACKAGE_NAME@ Description: A security-aware HTTP parser, designed for use in IDS/IPS and WAF products. Version: @PACKAGE_VERSION@ Libs: -L${libdir} -lhtp Cflags: -I${includedir} -I${libdir}/htp/include suricata-3.2.1/libhtp/NEWS0000644000000000000000000000000013051004451012157 00000000000000suricata-3.2.1/libhtp/install-sh0000755000000000000000000003546313051004463013514 00000000000000#!/bin/sh # install - install a program, script, or datafile scriptversion=2014-09-12.12; # UTC # This originates from X11R5 (mit/util/scripts/install.sh), which was # later released in X11R6 (xc/config/util/install.sh) with the # following copyright and license. # # Copyright (C) 1994 X Consortium # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to # deal in the Software without restriction, including without limitation the # rights to use, copy, modify, merge, publish, distribute, sublicense, and/or # sell copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN # AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC- # TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # # Except as contained in this notice, the name of the X Consortium shall not # be used in advertising or otherwise to promote the sale, use or other deal- # ings in this Software without prior written authorization from the X Consor- # tium. # # # FSF changes to this file are in the public domain. # # Calling this script install-sh is preferred over install.sh, to prevent # 'make' implicit rules from creating a file called install from it # when there is no Makefile. # # This script is compatible with the BSD install script, but was written # from scratch. tab=' ' nl=' ' IFS=" $tab$nl" # Set DOITPROG to "echo" to test this script. doit=${DOITPROG-} doit_exec=${doit:-exec} # Put in absolute file names if you don't have them in your path; # or use environment vars. chgrpprog=${CHGRPPROG-chgrp} chmodprog=${CHMODPROG-chmod} chownprog=${CHOWNPROG-chown} cmpprog=${CMPPROG-cmp} cpprog=${CPPROG-cp} mkdirprog=${MKDIRPROG-mkdir} mvprog=${MVPROG-mv} rmprog=${RMPROG-rm} stripprog=${STRIPPROG-strip} posix_mkdir= # Desired mode of installed file. mode=0755 chgrpcmd= chmodcmd=$chmodprog chowncmd= mvcmd=$mvprog rmcmd="$rmprog -f" stripcmd= src= dst= dir_arg= dst_arg= copy_on_change=false is_target_a_directory=possibly usage="\ Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE or: $0 [OPTION]... SRCFILES... DIRECTORY or: $0 [OPTION]... -t DIRECTORY SRCFILES... or: $0 [OPTION]... -d DIRECTORIES... In the 1st form, copy SRCFILE to DSTFILE. In the 2nd and 3rd, copy all SRCFILES to DIRECTORY. In the 4th, create DIRECTORIES. Options: --help display this help and exit. --version display version info and exit. -c (ignored) -C install only if different (preserve the last data modification time) -d create directories instead of installing files. -g GROUP $chgrpprog installed files to GROUP. -m MODE $chmodprog installed files to MODE. -o USER $chownprog installed files to USER. -s $stripprog installed files. -t DIRECTORY install into DIRECTORY. -T report an error if DSTFILE is a directory. Environment variables override the default commands: CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG RMPROG STRIPPROG " while test $# -ne 0; do case $1 in -c) ;; -C) copy_on_change=true;; -d) dir_arg=true;; -g) chgrpcmd="$chgrpprog $2" shift;; --help) echo "$usage"; exit $?;; -m) mode=$2 case $mode in *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*) echo "$0: invalid mode: $mode" >&2 exit 1;; esac shift;; -o) chowncmd="$chownprog $2" shift;; -s) stripcmd=$stripprog;; -t) is_target_a_directory=always dst_arg=$2 # Protect names problematic for 'test' and other utilities. case $dst_arg in -* | [=\(\)!]) dst_arg=./$dst_arg;; esac shift;; -T) is_target_a_directory=never;; --version) echo "$0 $scriptversion"; exit $?;; --) shift break;; -*) echo "$0: invalid option: $1" >&2 exit 1;; *) break;; esac shift done # We allow the use of options -d and -T together, by making -d # take the precedence; this is for compatibility with GNU install. if test -n "$dir_arg"; then if test -n "$dst_arg"; then echo "$0: target directory not allowed when installing a directory." >&2 exit 1 fi fi if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then # When -d is used, all remaining arguments are directories to create. # When -t is used, the destination is already specified. # Otherwise, the last argument is the destination. Remove it from $@. for arg do if test -n "$dst_arg"; then # $@ is not empty: it contains at least $arg. set fnord "$@" "$dst_arg" shift # fnord fi shift # arg dst_arg=$arg # Protect names problematic for 'test' and other utilities. case $dst_arg in -* | [=\(\)!]) dst_arg=./$dst_arg;; esac done fi if test $# -eq 0; then if test -z "$dir_arg"; then echo "$0: no input file specified." >&2 exit 1 fi # It's OK to call 'install-sh -d' without argument. # This can happen when creating conditional directories. exit 0 fi if test -z "$dir_arg"; then if test $# -gt 1 || test "$is_target_a_directory" = always; then if test ! -d "$dst_arg"; then echo "$0: $dst_arg: Is not a directory." >&2 exit 1 fi fi fi if test -z "$dir_arg"; then do_exit='(exit $ret); exit $ret' trap "ret=129; $do_exit" 1 trap "ret=130; $do_exit" 2 trap "ret=141; $do_exit" 13 trap "ret=143; $do_exit" 15 # Set umask so as not to create temps with too-generous modes. # However, 'strip' requires both read and write access to temps. case $mode in # Optimize common cases. *644) cp_umask=133;; *755) cp_umask=22;; *[0-7]) if test -z "$stripcmd"; then u_plus_rw= else u_plus_rw='% 200' fi cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;; *) if test -z "$stripcmd"; then u_plus_rw= else u_plus_rw=,u+rw fi cp_umask=$mode$u_plus_rw;; esac fi for src do # Protect names problematic for 'test' and other utilities. case $src in -* | [=\(\)!]) src=./$src;; esac if test -n "$dir_arg"; then dst=$src dstdir=$dst test -d "$dstdir" dstdir_status=$? else # Waiting for this to be detected by the "$cpprog $src $dsttmp" command # might cause directories to be created, which would be especially bad # if $src (and thus $dsttmp) contains '*'. if test ! -f "$src" && test ! -d "$src"; then echo "$0: $src does not exist." >&2 exit 1 fi if test -z "$dst_arg"; then echo "$0: no destination specified." >&2 exit 1 fi dst=$dst_arg # If destination is a directory, append the input filename; won't work # if double slashes aren't ignored. if test -d "$dst"; then if test "$is_target_a_directory" = never; then echo "$0: $dst_arg: Is a directory" >&2 exit 1 fi dstdir=$dst dst=$dstdir/`basename "$src"` dstdir_status=0 else dstdir=`dirname "$dst"` test -d "$dstdir" dstdir_status=$? fi fi obsolete_mkdir_used=false if test $dstdir_status != 0; then case $posix_mkdir in '') # Create intermediate dirs using mode 755 as modified by the umask. # This is like FreeBSD 'install' as of 1997-10-28. umask=`umask` case $stripcmd.$umask in # Optimize common cases. *[2367][2367]) mkdir_umask=$umask;; .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;; *[0-7]) mkdir_umask=`expr $umask + 22 \ - $umask % 100 % 40 + $umask % 20 \ - $umask % 10 % 4 + $umask % 2 `;; *) mkdir_umask=$umask,go-w;; esac # With -d, create the new directory with the user-specified mode. # Otherwise, rely on $mkdir_umask. if test -n "$dir_arg"; then mkdir_mode=-m$mode else mkdir_mode= fi posix_mkdir=false case $umask in *[123567][0-7][0-7]) # POSIX mkdir -p sets u+wx bits regardless of umask, which # is incompatible with FreeBSD 'install' when (umask & 300) != 0. ;; *) # $RANDOM is not portable (e.g. dash); use it when possible to # lower collision chance tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$ trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0 # As "mkdir -p" follows symlinks and we work in /tmp possibly; so # create the $tmpdir first (and fail if unsuccessful) to make sure # that nobody tries to guess the $tmpdir name. if (umask $mkdir_umask && $mkdirprog $mkdir_mode "$tmpdir" && exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1 then if test -z "$dir_arg" || { # Check for POSIX incompatibilities with -m. # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or # other-writable bit of parent directory when it shouldn't. # FreeBSD 6.1 mkdir -m -p sets mode of existing directory. test_tmpdir="$tmpdir/a" ls_ld_tmpdir=`ls -ld "$test_tmpdir"` case $ls_ld_tmpdir in d????-?r-*) different_mode=700;; d????-?--*) different_mode=755;; *) false;; esac && $mkdirprog -m$different_mode -p -- "$test_tmpdir" && { ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"` test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1" } } then posix_mkdir=: fi rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" else # Remove any dirs left behind by ancient mkdir implementations. rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null fi trap '' 0;; esac;; esac if $posix_mkdir && ( umask $mkdir_umask && $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir" ) then : else # The umask is ridiculous, or mkdir does not conform to POSIX, # or it failed possibly due to a race condition. Create the # directory the slow way, step by step, checking for races as we go. case $dstdir in /*) prefix='/';; [-=\(\)!]*) prefix='./';; *) prefix='';; esac oIFS=$IFS IFS=/ set -f set fnord $dstdir shift set +f IFS=$oIFS prefixes= for d do test X"$d" = X && continue prefix=$prefix$d if test -d "$prefix"; then prefixes= else if $posix_mkdir; then (umask=$mkdir_umask && $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break # Don't fail if two instances are running concurrently. test -d "$prefix" || exit 1 else case $prefix in *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;; *) qprefix=$prefix;; esac prefixes="$prefixes '$qprefix'" fi fi prefix=$prefix/ done if test -n "$prefixes"; then # Don't fail if two instances are running concurrently. (umask $mkdir_umask && eval "\$doit_exec \$mkdirprog $prefixes") || test -d "$dstdir" || exit 1 obsolete_mkdir_used=true fi fi fi if test -n "$dir_arg"; then { test -z "$chowncmd" || $doit $chowncmd "$dst"; } && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } && { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false || test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1 else # Make a couple of temp file names in the proper directory. dsttmp=$dstdir/_inst.$$_ rmtmp=$dstdir/_rm.$$_ # Trap to clean up those temp files at exit. trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0 # Copy the file name to the temp name. (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") && # and set any options; do chmod last to preserve setuid bits. # # If any of these fail, we abort the whole thing. If we want to # ignore errors from any of these, just make sure not to ignore # errors from the above "$doit $cpprog $src $dsttmp" command. # { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } && { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } && { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } && # If -C, don't bother to copy if it wouldn't change the file. if $copy_on_change && old=`LC_ALL=C ls -dlL "$dst" 2>/dev/null` && new=`LC_ALL=C ls -dlL "$dsttmp" 2>/dev/null` && set -f && set X $old && old=:$2:$4:$5:$6 && set X $new && new=:$2:$4:$5:$6 && set +f && test "$old" = "$new" && $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1 then rm -f "$dsttmp" else # Rename the file to the real destination. $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null || # The rename failed, perhaps because mv can't rename something else # to itself, or perhaps because mv is so ancient that it does not # support -f. { # Now remove or move aside any old file at destination location. # We try this two ways since rm can't unlink itself on some # systems and the destination file might be busy for other # reasons. In this case, the final cleanup might fail but the new # file should still install successfully. { test ! -f "$dst" || $doit $rmcmd -f "$dst" 2>/dev/null || { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null && { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; } } || { echo "$0: cannot unlink or rename $dst" >&2 (exit 1); exit 1 } } && # Now rename the file to the real destination. $doit $mvcmd "$dsttmp" "$dst" } fi || exit 1 trap '' 0 fi done # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/libhtp/config.sub0000755000000000000000000010646013051004463013467 00000000000000#! /bin/sh # Configuration validation subroutine script. # Copyright 1992-2015 Free Software Foundation, Inc. timestamp='2015-08-20' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # Please send patches to . # # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. # If it is invalid, we print an error message on stderr and exit with code 1. # Otherwise, we print the canonical config type on stdout and succeed. # You can get the latest version of this script from: # http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases # that are meaningful with *any* GNU software. # Each package is responsible for reporting which valid configurations # it does not support. The user should be able to distinguish # a failure to support a valid configuration from a meaningless # configuration. # The goal of this file is to map all the various variations of a given # machine specification into a single specification in the form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM # or in some cases, the newer four-part form: # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. me=`echo "$0" | sed -e 's,.*/,,'` usage="\ Usage: $0 [OPTION] CPU-MFR-OPSYS $0 [OPTION] ALIAS Canonicalize a configuration name. Operation modes: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit Report bugs and patches to ." version="\ GNU config.sub ($timestamp) Copyright 1992-2015 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" Try \`$me --help' for more information." # Parse command line while test $# -gt 0 ; do case $1 in --time-stamp | --time* | -t ) echo "$timestamp" ; exit ;; --version | -v ) echo "$version" ; exit ;; --help | --h* | -h ) echo "$usage"; exit ;; -- ) # Stop option processing shift; break ;; - ) # Use stdin as input. break ;; -* ) echo "$me: invalid option $1$help" exit 1 ;; *local*) # First pass through any local machine types. echo $1 exit ;; * ) break ;; esac done case $# in 0) echo "$me: missing argument$help" >&2 exit 1;; 1) ;; *) echo "$me: too many arguments$help" >&2 exit 1;; esac # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any). # Here we must recognize all the valid KERNEL-OS combinations. maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` case $maybe_os in nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \ linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \ knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \ kopensolaris*-gnu* | \ storm-chaos* | os2-emx* | rtmk-nova*) os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; android-linux) os=-linux-android basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] then os=`echo $1 | sed 's/.*-/-/'` else os=; fi ;; esac ### Let's recognize common machines as not being operating systems so ### that things like config.sub decstation-3100 work. We also ### recognize some manufacturers as not being operating systems, so we ### can provide default operating systems below. case $os in -sun*os*) # Prevent following clause from handling this invalid input. ;; -dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \ -att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \ -unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \ -convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\ -c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \ -harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \ -apple | -axis | -knuth | -cray | -microblaze*) os= basic_machine=$1 ;; -bluegene*) os=-cnk ;; -sim | -cisco | -oki | -wec | -winbond) os= basic_machine=$1 ;; -scout) ;; -wrs) os=-vxworks basic_machine=$1 ;; -chorusos*) os=-chorusos basic_machine=$1 ;; -chorusrdb) os=-chorusrdb basic_machine=$1 ;; -hiux*) os=-hiuxwe2 ;; -sco6) os=-sco5v6 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco5) os=-sco3.2v5 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco4) os=-sco3.2v4 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2.[4-9]*) os=`echo $os | sed -e 's/sco3.2./sco3.2v/'` basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2v[4-9]*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco5v6*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco*) os=-sco3.2v2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -udk*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -isc) os=-isc2.2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -clix*) basic_machine=clipper-intergraph ;; -isc*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -lynx*178) os=-lynxos178 ;; -lynx*5) os=-lynxos5 ;; -lynx*) os=-lynxos ;; -ptx*) basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'` ;; -windowsnt*) os=`echo $os | sed -e 's/windowsnt/winnt/'` ;; -psos*) os=-psos ;; -mint | -mint[0-9]*) basic_machine=m68k-atari os=-mint ;; esac # Decode aliases for certain CPU-COMPANY combinations. case $basic_machine in # Recognize the basic CPU types without company name. # Some are omitted here because they have special meanings below. 1750a | 580 \ | a29k \ | aarch64 | aarch64_be \ | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ | am33_2.0 \ | arc | arceb \ | arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \ | avr | avr32 \ | ba \ | be32 | be64 \ | bfin \ | c4x | c8051 | clipper \ | d10v | d30v | dlx | dsp16xx \ | e2k | epiphany \ | fido | fr30 | frv | ft32 \ | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ | k1om \ | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ | mips | mipsbe | mipseb | mipsel | mipsle \ | mips16 \ | mips64 | mips64el \ | mips64octeon | mips64octeonel \ | mips64orion | mips64orionel \ | mips64r5900 | mips64r5900el \ | mips64vr | mips64vrel \ | mips64vr4100 | mips64vr4100el \ | mips64vr4300 | mips64vr4300el \ | mips64vr5000 | mips64vr5000el \ | mips64vr5900 | mips64vr5900el \ | mipsisa32 | mipsisa32el \ | mipsisa32r2 | mipsisa32r2el \ | mipsisa32r6 | mipsisa32r6el \ | mipsisa64 | mipsisa64el \ | mipsisa64r2 | mipsisa64r2el \ | mipsisa64r6 | mipsisa64r6el \ | mipsisa64sb1 | mipsisa64sb1el \ | mipsisa64sr71k | mipsisa64sr71kel \ | mipsr5900 | mipsr5900el \ | mipstx39 | mipstx39el \ | mn10200 | mn10300 \ | moxie \ | mt \ | msp430 \ | nds32 | nds32le | nds32be \ | nios | nios2 | nios2eb | nios2el \ | ns16k | ns32k \ | open8 | or1k | or1knd | or32 \ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ | riscv32 | riscv64 \ | rl78 | rx \ | score \ | sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \ | sh64 | sh64le \ | sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \ | sparcv8 | sparcv9 | sparcv9b | sparcv9v \ | spu \ | tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \ | ubicom32 \ | v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \ | visium \ | we32k \ | x86 | xc16x | xstormy16 | xtensa \ | z8k | z80) basic_machine=$basic_machine-unknown ;; c54x) basic_machine=tic54x-unknown ;; c55x) basic_machine=tic55x-unknown ;; c6x) basic_machine=tic6x-unknown ;; leon|leon[3-9]) basic_machine=sparc-$basic_machine ;; m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip) basic_machine=$basic_machine-unknown os=-none ;; m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k) ;; ms1) basic_machine=mt-unknown ;; strongarm | thumb | xscale) basic_machine=arm-unknown ;; xgate) basic_machine=$basic_machine-unknown os=-none ;; xscaleeb) basic_machine=armeb-unknown ;; xscaleel) basic_machine=armel-unknown ;; # We use `pc' rather than `unknown' # because (1) that's what they normally are, and # (2) the word "unknown" tends to confuse beginning users. i*86 | x86_64) basic_machine=$basic_machine-pc ;; # Object if more than one company name word. *-*-*) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; # Recognize the basic CPU types with company name. 580-* \ | a29k-* \ | aarch64-* | aarch64_be-* \ | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ | avr-* | avr32-* \ | ba-* \ | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ | c8051-* | clipper-* | craynv-* | cydra-* \ | d10v-* | d30v-* | dlx-* \ | e2k-* | elxsi-* \ | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ | h8300-* | h8500-* \ | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ | k1om-* \ | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ | microblaze-* | microblazeel-* \ | mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \ | mips16-* \ | mips64-* | mips64el-* \ | mips64octeon-* | mips64octeonel-* \ | mips64orion-* | mips64orionel-* \ | mips64r5900-* | mips64r5900el-* \ | mips64vr-* | mips64vrel-* \ | mips64vr4100-* | mips64vr4100el-* \ | mips64vr4300-* | mips64vr4300el-* \ | mips64vr5000-* | mips64vr5000el-* \ | mips64vr5900-* | mips64vr5900el-* \ | mipsisa32-* | mipsisa32el-* \ | mipsisa32r2-* | mipsisa32r2el-* \ | mipsisa32r6-* | mipsisa32r6el-* \ | mipsisa64-* | mipsisa64el-* \ | mipsisa64r2-* | mipsisa64r2el-* \ | mipsisa64r6-* | mipsisa64r6el-* \ | mipsisa64sb1-* | mipsisa64sb1el-* \ | mipsisa64sr71k-* | mipsisa64sr71kel-* \ | mipsr5900-* | mipsr5900el-* \ | mipstx39-* | mipstx39el-* \ | mmix-* \ | mt-* \ | msp430-* \ | nds32-* | nds32le-* | nds32be-* \ | nios-* | nios2-* | nios2eb-* | nios2el-* \ | none-* | np1-* | ns16k-* | ns32k-* \ | open8-* \ | or1k*-* \ | orion-* \ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ | pyramid-* \ | riscv32-* | riscv64-* \ | rl78-* | romp-* | rs6000-* | rx-* \ | sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \ | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ | sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \ | sparclite-* \ | sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \ | tahoe-* \ | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \ | tile*-* \ | tron-* \ | ubicom32-* \ | v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \ | vax-* \ | visium-* \ | we32k-* \ | x86-* | x86_64-* | xc16x-* | xps100-* \ | xstormy16-* | xtensa*-* \ | ymp-* \ | z8k-* | z80-*) ;; # Recognize the basic CPU types without company name, with glob match. xtensa*) basic_machine=$basic_machine-unknown ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. 386bsd) basic_machine=i386-unknown os=-bsd ;; 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) basic_machine=m68000-att ;; 3b*) basic_machine=we32k-att ;; a29khif) basic_machine=a29k-amd os=-udi ;; abacus) basic_machine=abacus-unknown ;; adobe68k) basic_machine=m68010-adobe os=-scout ;; alliant | fx80) basic_machine=fx80-alliant ;; altos | altos3068) basic_machine=m68k-altos ;; am29k) basic_machine=a29k-none os=-bsd ;; amd64) basic_machine=x86_64-pc ;; amd64-*) basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'` ;; amdahl) basic_machine=580-amdahl os=-sysv ;; amiga | amiga-*) basic_machine=m68k-unknown ;; amigaos | amigados) basic_machine=m68k-unknown os=-amigaos ;; amigaunix | amix) basic_machine=m68k-unknown os=-sysv4 ;; apollo68) basic_machine=m68k-apollo os=-sysv ;; apollo68bsd) basic_machine=m68k-apollo os=-bsd ;; aros) basic_machine=i386-pc os=-aros ;; asmjs) basic_machine=asmjs-unknown ;; aux) basic_machine=m68k-apple os=-aux ;; balance) basic_machine=ns32k-sequent os=-dynix ;; blackfin) basic_machine=bfin-unknown os=-linux ;; blackfin-*) basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; bluegene*) basic_machine=powerpc-ibm os=-cnk ;; c54x-*) basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c55x-*) basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c6x-*) basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'` ;; c90) basic_machine=c90-cray os=-unicos ;; cegcc) basic_machine=arm-unknown os=-cegcc ;; convex-c1) basic_machine=c1-convex os=-bsd ;; convex-c2) basic_machine=c2-convex os=-bsd ;; convex-c32) basic_machine=c32-convex os=-bsd ;; convex-c34) basic_machine=c34-convex os=-bsd ;; convex-c38) basic_machine=c38-convex os=-bsd ;; cray | j90) basic_machine=j90-cray os=-unicos ;; craynv) basic_machine=craynv-cray os=-unicosmp ;; cr16 | cr16-*) basic_machine=cr16-unknown os=-elf ;; crds | unos) basic_machine=m68k-crds ;; crisv32 | crisv32-* | etraxfs*) basic_machine=crisv32-axis ;; cris | cris-* | etrax*) basic_machine=cris-axis ;; crx) basic_machine=crx-unknown os=-elf ;; da30 | da30-*) basic_machine=m68k-da30 ;; decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) basic_machine=mips-dec ;; decsystem10* | dec10*) basic_machine=pdp10-dec os=-tops10 ;; decsystem20* | dec20*) basic_machine=pdp10-dec os=-tops20 ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) basic_machine=m68k-motorola ;; delta88) basic_machine=m88k-motorola os=-sysv3 ;; dicos) basic_machine=i686-pc os=-dicos ;; djgpp) basic_machine=i586-pc os=-msdosdjgpp ;; dpx20 | dpx20-*) basic_machine=rs6000-bull os=-bosx ;; dpx2* | dpx2*-bull) basic_machine=m68k-bull os=-sysv3 ;; ebmon29k) basic_machine=a29k-amd os=-ebmon ;; elxsi) basic_machine=elxsi-elxsi os=-bsd ;; encore | umax | mmax) basic_machine=ns32k-encore ;; es1800 | OSE68k | ose68k | ose | OSE) basic_machine=m68k-ericsson os=-ose ;; fx2800) basic_machine=i860-alliant ;; genix) basic_machine=ns32k-ns ;; gmicro) basic_machine=tron-gmicro os=-sysv ;; go32) basic_machine=i386-pc os=-go32 ;; h3050r* | hiux*) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; h8300hms) basic_machine=h8300-hitachi os=-hms ;; h8300xray) basic_machine=h8300-hitachi os=-xray ;; h8500hms) basic_machine=h8500-hitachi os=-hms ;; harris) basic_machine=m88k-harris os=-sysv3 ;; hp300-*) basic_machine=m68k-hp ;; hp300bsd) basic_machine=m68k-hp os=-bsd ;; hp300hpux) basic_machine=m68k-hp os=-hpux ;; hp3k9[0-9][0-9] | hp9[0-9][0-9]) basic_machine=hppa1.0-hp ;; hp9k2[0-9][0-9] | hp9k31[0-9]) basic_machine=m68000-hp ;; hp9k3[2-9][0-9]) basic_machine=m68k-hp ;; hp9k6[0-9][0-9] | hp6[0-9][0-9]) basic_machine=hppa1.0-hp ;; hp9k7[0-79][0-9] | hp7[0-79][0-9]) basic_machine=hppa1.1-hp ;; hp9k78[0-9] | hp78[0-9]) # FIXME: really hppa2.0-hp basic_machine=hppa1.1-hp ;; hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893) # FIXME: really hppa2.0-hp basic_machine=hppa1.1-hp ;; hp9k8[0-9][13679] | hp8[0-9][13679]) basic_machine=hppa1.1-hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) basic_machine=hppa1.0-hp ;; hppa-next) os=-nextstep3 ;; hppaosf) basic_machine=hppa1.1-hp os=-osf ;; hppro) basic_machine=hppa1.1-hp os=-proelf ;; i370-ibm* | ibm*) basic_machine=i370-ibm ;; i*86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 ;; i*86v4*) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv4 ;; i*86v) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv ;; i*86sol2) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-solaris2 ;; i386mach) basic_machine=i386-mach os=-mach ;; i386-vsta | vsta) basic_machine=i386-unknown os=-vsta ;; iris | iris4d) basic_machine=mips-sgi case $os in -irix*) ;; *) os=-irix4 ;; esac ;; isi68 | isi) basic_machine=m68k-isi os=-sysv ;; leon-*|leon[3-9]-*) basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'` ;; m68knommu) basic_machine=m68k-unknown os=-linux ;; m68knommu-*) basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; m88k-omron*) basic_machine=m88k-omron ;; magnum | m3230) basic_machine=mips-mips os=-sysv ;; merlin) basic_machine=ns32k-utek os=-sysv ;; microblaze*) basic_machine=microblaze-xilinx ;; mingw64) basic_machine=x86_64-pc os=-mingw64 ;; mingw32) basic_machine=i686-pc os=-mingw32 ;; mingw32ce) basic_machine=arm-unknown os=-mingw32ce ;; miniframe) basic_machine=m68000-convergent ;; *mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*) basic_machine=m68k-atari os=-mint ;; mips3*-*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` ;; mips3*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown ;; monitor) basic_machine=m68k-rom68k os=-coff ;; morphos) basic_machine=powerpc-unknown os=-morphos ;; moxiebox) basic_machine=moxie-unknown os=-moxiebox ;; msdos) basic_machine=i386-pc os=-msdos ;; ms1-*) basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; msys) basic_machine=i686-pc os=-msys ;; mvs) basic_machine=i370-ibm os=-mvs ;; nacl) basic_machine=le32-unknown os=-nacl ;; ncr3000) basic_machine=i486-ncr os=-sysv4 ;; netbsd386) basic_machine=i386-unknown os=-netbsd ;; netwinder) basic_machine=armv4l-rebel os=-linux ;; news | news700 | news800 | news900) basic_machine=m68k-sony os=-newsos ;; news1000) basic_machine=m68030-sony os=-newsos ;; news-3600 | risc-news) basic_machine=mips-sony os=-newsos ;; necv70) basic_machine=v70-nec os=-sysv ;; next | m*-next ) basic_machine=m68k-next case $os in -nextstep* ) ;; -ns2*) os=-nextstep2 ;; *) os=-nextstep3 ;; esac ;; nh3000) basic_machine=m68k-harris os=-cxux ;; nh[45]000) basic_machine=m88k-harris os=-cxux ;; nindy960) basic_machine=i960-intel os=-nindy ;; mon960) basic_machine=i960-intel os=-mon960 ;; nonstopux) basic_machine=mips-compaq os=-nonstopux ;; np1) basic_machine=np1-gould ;; neo-tandem) basic_machine=neo-tandem ;; nse-tandem) basic_machine=nse-tandem ;; nsr-tandem) basic_machine=nsr-tandem ;; op50n-* | op60c-*) basic_machine=hppa1.1-oki os=-proelf ;; openrisc | openrisc-*) basic_machine=or32-unknown ;; os400) basic_machine=powerpc-ibm os=-os400 ;; OSE68000 | ose68000) basic_machine=m68000-ericsson os=-ose ;; os68k) basic_machine=m68k-none os=-os68k ;; pa-hitachi) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; paragon) basic_machine=i860-intel os=-osf ;; parisc) basic_machine=hppa-unknown os=-linux ;; parisc-*) basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'` os=-linux ;; pbd) basic_machine=sparc-tti ;; pbb) basic_machine=m68k-tti ;; pc532 | pc532-*) basic_machine=ns32k-pc532 ;; pc98) basic_machine=i386-pc ;; pc98-*) basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentium | p5 | k5 | k6 | nexgen | viac3) basic_machine=i586-pc ;; pentiumpro | p6 | 6x86 | athlon | athlon_*) basic_machine=i686-pc ;; pentiumii | pentium2 | pentiumiii | pentium3) basic_machine=i686-pc ;; pentium4) basic_machine=i786-pc ;; pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*) basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumpro-* | p6-* | 6x86-* | athlon-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentium4-*) basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pn) basic_machine=pn-gould ;; power) basic_machine=power-ibm ;; ppc | ppcbe) basic_machine=powerpc-unknown ;; ppc-* | ppcbe-*) basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppcle | powerpclittle | ppc-le | powerpc-little) basic_machine=powerpcle-unknown ;; ppcle-* | powerpclittle-*) basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64) basic_machine=powerpc64-unknown ;; ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64le | powerpc64little | ppc64-le | powerpc64-little) basic_machine=powerpc64le-unknown ;; ppc64le-* | powerpc64little-*) basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ps2) basic_machine=i386-ibm ;; pw32) basic_machine=i586-unknown os=-pw32 ;; rdos | rdos64) basic_machine=x86_64-pc os=-rdos ;; rdos32) basic_machine=i386-pc os=-rdos ;; rom68k) basic_machine=m68k-rom68k os=-coff ;; rm[46]00) basic_machine=mips-siemens ;; rtpc | rtpc-*) basic_machine=romp-ibm ;; s390 | s390-*) basic_machine=s390-ibm ;; s390x | s390x-*) basic_machine=s390x-ibm ;; sa29200) basic_machine=a29k-amd os=-udi ;; sb1) basic_machine=mipsisa64sb1-unknown ;; sb1el) basic_machine=mipsisa64sb1el-unknown ;; sde) basic_machine=mipsisa32-sde os=-elf ;; sei) basic_machine=mips-sei os=-seiux ;; sequent) basic_machine=i386-sequent ;; sh) basic_machine=sh-hitachi os=-hms ;; sh5el) basic_machine=sh5le-unknown ;; sh64) basic_machine=sh64-unknown ;; sparclite-wrs | simso-wrs) basic_machine=sparclite-wrs os=-vxworks ;; sps7) basic_machine=m68k-bull os=-sysv2 ;; spur) basic_machine=spur-unknown ;; st2000) basic_machine=m68k-tandem ;; stratus) basic_machine=i860-stratus os=-sysv4 ;; strongarm-* | thumb-*) basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'` ;; sun2) basic_machine=m68000-sun ;; sun2os3) basic_machine=m68000-sun os=-sunos3 ;; sun2os4) basic_machine=m68000-sun os=-sunos4 ;; sun3os3) basic_machine=m68k-sun os=-sunos3 ;; sun3os4) basic_machine=m68k-sun os=-sunos4 ;; sun4os3) basic_machine=sparc-sun os=-sunos3 ;; sun4os4) basic_machine=sparc-sun os=-sunos4 ;; sun4sol2) basic_machine=sparc-sun os=-solaris2 ;; sun3 | sun3-*) basic_machine=m68k-sun ;; sun4) basic_machine=sparc-sun ;; sun386 | sun386i | roadrunner) basic_machine=i386-sun ;; sv1) basic_machine=sv1-cray os=-unicos ;; symmetry) basic_machine=i386-sequent os=-dynix ;; t3e) basic_machine=alphaev5-cray os=-unicos ;; t90) basic_machine=t90-cray os=-unicos ;; tile*) basic_machine=$basic_machine-unknown os=-linux-gnu ;; tx39) basic_machine=mipstx39-unknown ;; tx39el) basic_machine=mipstx39el-unknown ;; toad1) basic_machine=pdp10-xkl os=-tops20 ;; tower | tower-32) basic_machine=m68k-ncr ;; tpf) basic_machine=s390x-ibm os=-tpf ;; udi29k) basic_machine=a29k-amd os=-udi ;; ultra3) basic_machine=a29k-nyu os=-sym1 ;; v810 | necv810) basic_machine=v810-nec os=-none ;; vaxv) basic_machine=vax-dec os=-sysv ;; vms) basic_machine=vax-dec os=-vms ;; vpp*|vx|vx-*) basic_machine=f301-fujitsu ;; vxworks960) basic_machine=i960-wrs os=-vxworks ;; vxworks68) basic_machine=m68k-wrs os=-vxworks ;; vxworks29k) basic_machine=a29k-wrs os=-vxworks ;; w65*) basic_machine=w65-wdc os=-none ;; w89k-*) basic_machine=hppa1.1-winbond os=-proelf ;; xbox) basic_machine=i686-pc os=-mingw32 ;; xps | xps100) basic_machine=xps100-honeywell ;; xscale-* | xscalee[bl]-*) basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'` ;; ymp) basic_machine=ymp-cray os=-unicos ;; z8k-*-coff) basic_machine=z8k-unknown os=-sim ;; z80-*-coff) basic_machine=z80-unknown os=-sim ;; none) basic_machine=none-none os=-none ;; # Here we handle the default manufacturer of certain CPU types. It is in # some cases the only manufacturer, in others, it is the most popular. w89k) basic_machine=hppa1.1-winbond ;; op50n) basic_machine=hppa1.1-oki ;; op60c) basic_machine=hppa1.1-oki ;; romp) basic_machine=romp-ibm ;; mmix) basic_machine=mmix-knuth ;; rs6000) basic_machine=rs6000-ibm ;; vax) basic_machine=vax-dec ;; pdp10) # there are many clones, so DEC is not a safe bet basic_machine=pdp10-unknown ;; pdp11) basic_machine=pdp11-dec ;; we32k) basic_machine=we32k-att ;; sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele) basic_machine=sh-unknown ;; sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v) basic_machine=sparc-sun ;; cydra) basic_machine=cydra-cydrome ;; orion) basic_machine=orion-highlevel ;; orion105) basic_machine=clipper-highlevel ;; mac | mpw | mac-mpw) basic_machine=m68k-apple ;; pmac | pmac-mpw) basic_machine=powerpc-apple ;; *-unknown) # Make sure to match an already-canonicalized machine name. ;; *) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; esac # Here we canonicalize certain aliases for manufacturers. case $basic_machine in *-digital*) basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'` ;; *-commodore*) basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'` ;; *) ;; esac # Decode manufacturer-specific aliases for certain operating systems. if [ x"$os" != x"" ] then case $os in # First match some system type aliases # that might get confused with valid system types. # -solaris* is a basic system type, with this one exception. -auroraux) os=-auroraux ;; -solaris1 | -solaris1.*) os=`echo $os | sed -e 's|solaris1|sunos4|'` ;; -solaris) os=-solaris2 ;; -svr4*) os=-sysv4 ;; -unixware*) os=-sysv4.2uw ;; -gnu/linux*) os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'` ;; # First accept the basic system types. # The portable systems comes first. # Each alternative MUST END IN A *, to match a version number. # -sysv* is not here because it comes later, after sysvr4. -gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \ | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\ | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \ | -sym* | -kopensolaris* | -plan9* \ | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \ | -aos* | -aros* | -cloudabi* | -sortix* \ | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \ | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \ | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \ | -bitrig* | -openbsd* | -solidbsd* \ | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \ | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \ | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -chorusos* | -chorusrdb* | -cegcc* \ | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-musl* | -linux-uclibc* \ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \ | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \ | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \ | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \ | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \ | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \ | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*) # Remember, each alternative MUST END IN *, to match a version number. ;; -qnx*) case $basic_machine in x86-* | i*86-*) ;; *) os=-nto$os ;; esac ;; -nto-qnx*) ;; -nto*) os=`echo $os | sed -e 's|nto|nto-qnx|'` ;; -sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \ | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \ | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*) ;; -mac*) os=`echo $os | sed -e 's|mac|macos|'` ;; -linux-dietlibc) os=-linux-dietlibc ;; -linux*) os=`echo $os | sed -e 's|linux|linux-gnu|'` ;; -sunos5*) os=`echo $os | sed -e 's|sunos5|solaris2|'` ;; -sunos6*) os=`echo $os | sed -e 's|sunos6|solaris3|'` ;; -opened*) os=-openedition ;; -os400*) os=-os400 ;; -wince*) os=-wince ;; -osfrose*) os=-osfrose ;; -osf*) os=-osf ;; -utek*) os=-bsd ;; -dynix*) os=-bsd ;; -acis*) os=-aos ;; -atheos*) os=-atheos ;; -syllable*) os=-syllable ;; -386bsd) os=-bsd ;; -ctix* | -uts*) os=-sysv ;; -nova*) os=-rtmk-nova ;; -ns2 ) os=-nextstep2 ;; -nsk*) os=-nsk ;; # Preserve the version number of sinix5. -sinix5.*) os=`echo $os | sed -e 's|sinix|sysv|'` ;; -sinix*) os=-sysv4 ;; -tpf*) os=-tpf ;; -triton*) os=-sysv3 ;; -oss*) os=-sysv3 ;; -svr4) os=-sysv4 ;; -svr3) os=-sysv3 ;; -sysvr4) os=-sysv4 ;; # This must come after -sysvr4. -sysv*) ;; -ose*) os=-ose ;; -es1800*) os=-ose ;; -xenix) os=-xenix ;; -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) os=-mint ;; -aros*) os=-aros ;; -zvmoe) os=-zvmoe ;; -dicos*) os=-dicos ;; -nacl*) ;; -none) ;; *) # Get rid of the `-' at the beginning of $os. os=`echo $os | sed 's/[^-]*-//'` echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2 exit 1 ;; esac else # Here we handle the default operating systems that come with various machines. # The value should be what the vendor currently ships out the door with their # machine or put another way, the most popular os provided with the machine. # Note that if you're going to try to match "-MANUFACTURER" here (say, # "-sun"), then you have to tell the case statement up towards the top # that MANUFACTURER isn't an operating system. Otherwise, code above # will signal an error saying that MANUFACTURER isn't an operating # system, and we'll never get to this point. case $basic_machine in score-*) os=-elf ;; spu-*) os=-elf ;; *-acorn) os=-riscix1.2 ;; arm*-rebel) os=-linux ;; arm*-semi) os=-aout ;; c4x-* | tic4x-*) os=-coff ;; c8051-*) os=-elf ;; hexagon-*) os=-elf ;; tic54x-*) os=-coff ;; tic55x-*) os=-coff ;; tic6x-*) os=-coff ;; # This must come before the *-dec entry. pdp10-*) os=-tops20 ;; pdp11-*) os=-none ;; *-dec | vax-*) os=-ultrix4.2 ;; m68*-apollo) os=-domain ;; i386-sun) os=-sunos4.0.2 ;; m68000-sun) os=-sunos3 ;; m68*-cisco) os=-aout ;; mep-*) os=-elf ;; mips*-cisco) os=-elf ;; mips*-*) os=-elf ;; or32-*) os=-coff ;; *-tti) # must be before sparc entry or we get the wrong os. os=-sysv3 ;; sparc-* | *-sun) os=-sunos4.1.1 ;; *-be) os=-beos ;; *-haiku) os=-haiku ;; *-ibm) os=-aix ;; *-knuth) os=-mmixware ;; *-wec) os=-proelf ;; *-winbond) os=-proelf ;; *-oki) os=-proelf ;; *-hp) os=-hpux ;; *-hitachi) os=-hiux ;; i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent) os=-sysv ;; *-cbm) os=-amigaos ;; *-dg) os=-dgux ;; *-dolphin) os=-sysv3 ;; m68k-ccur) os=-rtu ;; m88k-omron*) os=-luna ;; *-next ) os=-nextstep ;; *-sequent) os=-ptx ;; *-crds) os=-unos ;; *-ns) os=-genix ;; i370-*) os=-mvs ;; *-next) os=-nextstep3 ;; *-gould) os=-sysv ;; *-highlevel) os=-bsd ;; *-encore) os=-bsd ;; *-sgi) os=-irix ;; *-siemens) os=-sysv4 ;; *-masscomp) os=-rtu ;; f30[01]-fujitsu | f700-fujitsu) os=-uxpv ;; *-rom68k) os=-coff ;; *-*bug) os=-coff ;; *-apple) os=-macos ;; *-atari*) os=-mint ;; *) os=-none ;; esac fi # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. vendor=unknown case $basic_machine in *-unknown) case $os in -riscix*) vendor=acorn ;; -sunos*) vendor=sun ;; -cnk*|-aix*) vendor=ibm ;; -beos*) vendor=be ;; -hpux*) vendor=hp ;; -mpeix*) vendor=hp ;; -hiux*) vendor=hitachi ;; -unos*) vendor=crds ;; -dgux*) vendor=dg ;; -luna*) vendor=omron ;; -genix*) vendor=ns ;; -mvs* | -opened*) vendor=ibm ;; -os400*) vendor=ibm ;; -ptx*) vendor=sequent ;; -tpf*) vendor=ibm ;; -vxsim* | -vxworks* | -windiss*) vendor=wrs ;; -aux*) vendor=apple ;; -hms*) vendor=hitachi ;; -mpw* | -macos*) vendor=apple ;; -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) vendor=atari ;; -vos*) vendor=stratus ;; esac basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"` ;; esac echo $basic_machine$os exit # Local variables: # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" # End: suricata-3.2.1/libhtp/Makefile.am0000644000000000000000000000165513051004451013535 00000000000000 ACLOCAL_AMFLAGS = -I m4 SUBDIRS = htp test docs DIST_SUBDIRS = htp test docs EXTRA_DIST = LICENSE NOTICE docs/doxygen.conf docs/QUICK_START VERSION get-version.sh pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = htp.pc test: all @(cd test && $(MAKE) $@) test-compile-only: all @(cd test && $(MAKE) $@) check-compile-only: all @(cd test && $(MAKE) $@) doxygen doxygen-pdf: @(cd docs && $(MAKE) $@) gcov: test @ if [[ -x $(LCOV) ]]; then \ lcov --capture --directory $(top_builddir)/htp/ --output-file $(top_builddir)/test/coverage.info --no-external ; \ genhtml $(top_builddir)/test/coverage.info --output-directory $(top_builddir)/docs/lcov ; \ echo "" ; \ echo "Open docs/lcov/index.html to review lcov output" ; \ fi clean-local: rm -rf $(top_builddir)/docs/doxygen rm -rf $(top_builddir)/docs/lcov find $(top_builddir) -type f \( -name '*.gcda' -o -name '*.gcno' -o -name '*.gcov' \) -exec rm '{}' ';' suricata-3.2.1/libhtp/configure.ac0000644000000000000000000001533413051004451013766 00000000000000 dnl ---------------------- dnl Initialization macros dnl ---------------------- AC_INIT([LibHTP], m4_esyscmd([./get-version.sh VERSION])) AM_INIT_AUTOMAKE() AC_CONFIG_HEADERS([htp_config_auto_gen.h]) AC_CONFIG_FILES([htp/htp_version.h]) dnl ----------------------------------------------- dnl Package name and version number (user defined) dnl ----------------------------------------------- GENERIC_LIBRARY_NAME=htp # API version GENERIC_API_VERSION=1.0 AC_SUBST(GENERIC_API_VERSION) # Shared library versioning GENERIC_LIBRARY_VERSION=1:0:0 AC_SUBST(GENERIC_LIBRARY_VERSION) dnl -------------------------------- dnl Package name and version number dnl -------------------------------- PACKAGE=$GENERIC_LIBRARY_NAME AC_SUBST(GENERIC_LIBRARY_NAME) GENERIC_VERSION=$PACKAGE_VERSION GENERIC_RELEASE=$PACKAGE_VERSION AC_SUBST(GENERIC_RELEASE) AC_SUBST(GENERIC_VERSION) VERSION=$GENERIC_VERSION AC_CONFIG_MACRO_DIR([m4]) dnl -------------------------------- dnl Options dnl -------------------------------- AC_ARG_ENABLE(debug, [ --enable-debug Enable debug mode], [ enable_debug=yes ]) if test "$enable_debug" = "yes"; then CFLAGS="${CFLAGS} -DHTP_DEBUG" echo "Debug mode enabled" fi OLEVEL=2 AC_ARG_ENABLE(devmode, [ --enable-devmode Enable development mode], [ enable_devmode=yes ]) if test "$enable_devmode" = "yes"; then OLEVEL=0 CFLAGS="${CFLAGS} -Werror -Wfatal-errors" CPPFLAGS="${CPPFLAGS} -Werror -Wfatal-errors" echo "Development mode enabled" fi AC_ARG_ENABLE(gcov, [ --enable-gcov Enable gcov support], [ enable_gcov=yes ]) if test "$enable_gcov" = "yes"; then OLEVEL=0 CFLAGS="${CFLAGS} --coverage -fprofile-arcs -ftest-coverage" CPPFLAGS="${CPPFLAGS} --coverage -fprofile-arcs -ftest-coverage" LDFLAGS="${LDFLAGS} -lgcov --coverage -fprofile-arcs" echo "gcov support enabled" fi CFLAGS="${CFLAGS} -O${OLEVEL}" CPPFLAGS="${CPPFLAGS} -O${OLEVEL}" dnl ----------------------------------------------- dnl Checks for programs. dnl ----------------------------------------------- AC_PROG_CC AM_PROG_CC_C_O AC_PROG_CXX AM_PROG_LIBTOOL AM_SANITY_CHECK # Checks for library functions #AC_CHECK_FUNCS([strlcpy strlcat]) OCFLAGS=$CFLAGS CFLAGS="" AC_CHECK_FUNCS([strlcpy strlcat]) CFLAGS=$OCFLAGS dnl ----------------------------------------------- dnl Checks for libs. dnl ----------------------------------------------- AC_CHECK_HEADER(zlib.h,,[AC_ERROR(zlib.h not found ...)]) ZLIB="" AC_CHECK_LIB(z, inflate,, ZLIB="no") if test "$ZLIB" = "no"; then echo echo " ERROR! zlib library not found" echo exit 1 fi # Determine the OS AC_MSG_CHECKING([OS]) OS=`uname -s` case "$OS" in CYGWIN*) AC_MSG_RESULT(Cygwin) OS_CYGWIN="true" NO_STACK_PROTECTOR="true" ;; FreeBSD*) AC_MSG_RESULT(FreeBSD) OS_FREEBSD="true" CPPFLAGS="${CPPFLAGS} -I/usr/local/include" LDFLAGS="${LDFLAGS} -L/usr/local/lib" ;; OpenBSD*) AC_MSG_RESULT(OpenBSD) OS_OPENBSD="true" CPPFLAGS="${CPPFLAGS} -I/usr/local/include" LDFLAGS="${LDFLAGS} -L/usr/local/lib" ;; Linux*) AC_MSG_RESULT(Linux) OS_LINUX="true" ;; *) AC_MSG_RESULT(no) ;; esac #We need to call the iconv macro after OS detection for FreeBSD to work properly sinclude(m4/iconv.m4) sinclude(m4/lib-ld.m4) sinclude(m4/lib-link.m4) sinclude(m4/lib-prefix.m4) AM_ICONV dnl ----------------------------------------------- dnl Check and enable the GCC opts we want to use. dnl We may need to add more checks dnl ----------------------------------------------- dnl ----------------------------------------------- dnl Check for GCC signed overflow warning support dnl ----------------------------------------------- AC_MSG_CHECKING(for gcc support of -Wstrict-overflow=1) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wstrict-overflow=1" AC_TRY_COMPILE(,,[gcc_have_strict_overflow=yes],[gcc_have_strict_overflow=no]) AC_MSG_RESULT($gcc_have_strict_overflow) if test "$gcc_have_strict_overflow" != "yes"; then CFLAGS="${TMPCFLAGS}" fi if test "$NO_STACK_PROTECTOR" != "true"; then dnl ----------------------------------------------- dnl Check for GCC stack smashing protection dnl ----------------------------------------------- AC_MSG_CHECKING(for gcc support of stack smashing protection) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fstack-protector" AC_TRY_COMPILE(,,[gcc_have_fstack_protector=yes],[gcc_have_fstack_protector=no]) AC_MSG_RESULT($gcc_have_fstack_protector) if test "$gcc_have_fstack_protector" != "yes"; then CFLAGS="${TMPCFLAGS}" fi fi dnl ----------------------------------------------- dnl Check for GCC -D_FORTIFY_SOURCE support dnl ----------------------------------------------- AC_MSG_CHECKING(for gcc support of FORTIFY_SOURCE) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" AC_TRY_COMPILE(,,[gcc_have_fortify_source=yes],[gcc_have_fortify_source=no]) AC_MSG_RESULT($gcc_have_fortify_source) if test "$gcc_have_fortify_source" != "yes"; then CFLAGS="${TMPCFLAGS}" fi dnl ----------------------------------------------- dnl Check for GCC -Wformat-security support dnl ----------------------------------------------- AC_MSG_CHECKING(for gcc support of -Wformat -Wformat-security) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wformat -Wformat-security" AC_TRY_COMPILE(,,[gcc_have_format_security=yes],[gcc_have_format_security=no]) AC_MSG_RESULT($gcc_have_format_security) if test "$gcc_have_format_security" != "yes"; then CFLAGS="${TMPCFLAGS}" fi AC_MSG_CHECKING(for gcc support of -fPIC) TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fPIC" AC_TRY_COMPILE(,,[gcc_have_fpic=yes],[gcc_have_fpic=no]) AC_MSG_RESULT($gcc_have_fpic) if test "$gcc_have_fpic" != "yes"; then CFLAGS="${TMPCFLAGS}" fi dnl ----------------------------------------------- dnl Check for doxygen dnl ----------------------------------------------- AC_ARG_WITH([doxygen], [ --with-doxygen=PROG doxygen executable], [doxygen="$withval"],[doxygen=no]) if test "$doxygen" != "no"; then AC_MSG_NOTICE([Using doxygen: $doxygen]) else AC_PATH_PROGS([doxygen],[doxygen],[]) fi DOXYGEN=$doxygen AC_SUBST(DOXYGEN) dnl ----------------------------------------------- dnl Check for lcov dnl ----------------------------------------------- AC_PATH_PROG(LCOV, lcov, [no]) AC_SUBST(LCOV) dnl ----------------------------------------------- dnl Generates Makefiles, configuration files and scripts dnl ----------------------------------------------- AC_PREFIX_DEFAULT(/usr/local) AC_OUTPUT(Makefile \ htp.pc \ htp/Makefile \ test/Makefile \ docs/Makefile ) suricata-3.2.1/libhtp/LICENSE0000644000000000000000000000301713051004451012500 00000000000000Copyright (c) 2009-2010 Open Information Security Foundation Copyright (c) 2010-2013 Qualys, Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - Neither the name of the Qualys, Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. suricata-3.2.1/libhtp/COPYING0000644000000000000000000000001413051004451012520 00000000000000See LICENSE.suricata-3.2.1/libhtp/htp_config_auto_gen.h.in0000644000000000000000000000373113051004462016257 00000000000000/* htp_config_auto_gen.h.in. Generated from configure.ac by autoheader. */ /* Define to 1 if you have the header file. */ #undef HAVE_DLFCN_H /* Define if you have the iconv() function and it works. */ #undef HAVE_ICONV /* Define to 1 if you have the header file. */ #undef HAVE_INTTYPES_H /* Define to 1 if you have the `z' library (-lz). */ #undef HAVE_LIBZ /* Define to 1 if you have the header file. */ #undef HAVE_MEMORY_H /* Define to 1 if you have the header file. */ #undef HAVE_STDINT_H /* Define to 1 if you have the header file. */ #undef HAVE_STDLIB_H /* Define to 1 if you have the header file. */ #undef HAVE_STRINGS_H /* Define to 1 if you have the header file. */ #undef HAVE_STRING_H /* Define to 1 if you have the `strlcat' function. */ #undef HAVE_STRLCAT /* Define to 1 if you have the `strlcpy' function. */ #undef HAVE_STRLCPY /* Define to 1 if you have the header file. */ #undef HAVE_SYS_STAT_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_TYPES_H /* Define to 1 if you have the header file. */ #undef HAVE_UNISTD_H /* Define as const if the declaration of iconv() needs const. */ #undef ICONV_CONST /* Define to the sub-directory where libtool stores uninstalled libraries. */ #undef LT_OBJDIR /* Name of package */ #undef PACKAGE /* Define to the address where bug reports for this package should be sent. */ #undef PACKAGE_BUGREPORT /* Define to the full name of this package. */ #undef PACKAGE_NAME /* Define to the full name and version of this package. */ #undef PACKAGE_STRING /* Define to the one symbol short name of this package. */ #undef PACKAGE_TARNAME /* Define to the home page for this package. */ #undef PACKAGE_URL /* Define to the version of this package. */ #undef PACKAGE_VERSION /* Define to 1 if you have the ANSI C header files. */ #undef STDC_HEADERS /* Version number of package */ #undef VERSION suricata-3.2.1/libhtp/VERSION0000644000000000000000000000007713051004451012546 00000000000000# This file is intended to be sourced by sh PKG_VERSION=0.5.23 suricata-3.2.1/libhtp/compile0000755000000000000000000001624513051004463013063 00000000000000#! /bin/sh # Wrapper for compilers which do not understand '-c -o'. scriptversion=2012-10-14.11; # UTC # Copyright (C) 1999-2014 Free Software Foundation, Inc. # Written by Tom Tromey . # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # This file is maintained in Automake, please report # bugs to or send patches to # . nl=' ' # We need space, tab and new line, in precisely that order. Quoting is # there to prevent tools from complaining about whitespace usage. IFS=" "" $nl" file_conv= # func_file_conv build_file lazy # Convert a $build file to $host form and store it in $file # Currently only supports Windows hosts. If the determined conversion # type is listed in (the comma separated) LAZY, no conversion will # take place. func_file_conv () { file=$1 case $file in / | /[!/]*) # absolute file, and not a UNC file if test -z "$file_conv"; then # lazily determine how to convert abs files case `uname -s` in MINGW*) file_conv=mingw ;; CYGWIN*) file_conv=cygwin ;; *) file_conv=wine ;; esac fi case $file_conv/,$2, in *,$file_conv,*) ;; mingw/*) file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'` ;; cygwin/*) file=`cygpath -m "$file" || echo "$file"` ;; wine/*) file=`winepath -w "$file" || echo "$file"` ;; esac ;; esac } # func_cl_dashL linkdir # Make cl look for libraries in LINKDIR func_cl_dashL () { func_file_conv "$1" if test -z "$lib_path"; then lib_path=$file else lib_path="$lib_path;$file" fi linker_opts="$linker_opts -LIBPATH:$file" } # func_cl_dashl library # Do a library search-path lookup for cl func_cl_dashl () { lib=$1 found=no save_IFS=$IFS IFS=';' for dir in $lib_path $LIB do IFS=$save_IFS if $shared && test -f "$dir/$lib.dll.lib"; then found=yes lib=$dir/$lib.dll.lib break fi if test -f "$dir/$lib.lib"; then found=yes lib=$dir/$lib.lib break fi if test -f "$dir/lib$lib.a"; then found=yes lib=$dir/lib$lib.a break fi done IFS=$save_IFS if test "$found" != yes; then lib=$lib.lib fi } # func_cl_wrapper cl arg... # Adjust compile command to suit cl func_cl_wrapper () { # Assume a capable shell lib_path= shared=: linker_opts= for arg do if test -n "$eat"; then eat= else case $1 in -o) # configure might choose to run compile as 'compile cc -o foo foo.c'. eat=1 case $2 in *.o | *.[oO][bB][jJ]) func_file_conv "$2" set x "$@" -Fo"$file" shift ;; *) func_file_conv "$2" set x "$@" -Fe"$file" shift ;; esac ;; -I) eat=1 func_file_conv "$2" mingw set x "$@" -I"$file" shift ;; -I*) func_file_conv "${1#-I}" mingw set x "$@" -I"$file" shift ;; -l) eat=1 func_cl_dashl "$2" set x "$@" "$lib" shift ;; -l*) func_cl_dashl "${1#-l}" set x "$@" "$lib" shift ;; -L) eat=1 func_cl_dashL "$2" ;; -L*) func_cl_dashL "${1#-L}" ;; -static) shared=false ;; -Wl,*) arg=${1#-Wl,} save_ifs="$IFS"; IFS=',' for flag in $arg; do IFS="$save_ifs" linker_opts="$linker_opts $flag" done IFS="$save_ifs" ;; -Xlinker) eat=1 linker_opts="$linker_opts $2" ;; -*) set x "$@" "$1" shift ;; *.cc | *.CC | *.cxx | *.CXX | *.[cC]++) func_file_conv "$1" set x "$@" -Tp"$file" shift ;; *.c | *.cpp | *.CPP | *.lib | *.LIB | *.Lib | *.OBJ | *.obj | *.[oO]) func_file_conv "$1" mingw set x "$@" "$file" shift ;; *) set x "$@" "$1" shift ;; esac fi shift done if test -n "$linker_opts"; then linker_opts="-link$linker_opts" fi exec "$@" $linker_opts exit 1 } eat= case $1 in '') echo "$0: No command. Try '$0 --help' for more information." 1>&2 exit 1; ;; -h | --h*) cat <<\EOF Usage: compile [--help] [--version] PROGRAM [ARGS] Wrapper for compilers which do not understand '-c -o'. Remove '-o dest.o' from ARGS, run PROGRAM with the remaining arguments, and rename the output as expected. If you are trying to build a whole package this is not the right script to run: please start by reading the file 'INSTALL'. Report bugs to . EOF exit $? ;; -v | --v*) echo "compile $scriptversion" exit $? ;; cl | *[/\\]cl | cl.exe | *[/\\]cl.exe ) func_cl_wrapper "$@" # Doesn't return... ;; esac ofile= cfile= for arg do if test -n "$eat"; then eat= else case $1 in -o) # configure might choose to run compile as 'compile cc -o foo foo.c'. # So we strip '-o arg' only if arg is an object. eat=1 case $2 in *.o | *.obj) ofile=$2 ;; *) set x "$@" -o "$2" shift ;; esac ;; *.c) cfile=$1 set x "$@" "$1" shift ;; *) set x "$@" "$1" shift ;; esac fi shift done if test -z "$ofile" || test -z "$cfile"; then # If no '-o' option was seen then we might have been invoked from a # pattern rule where we don't need one. That is ok -- this is a # normal compilation that the losing compiler can handle. If no # '.c' file was seen then we are probably linking. That is also # ok. exec "$@" fi # Name of file we expect compiler to create. cofile=`echo "$cfile" | sed 's|^.*[\\/]||; s|^[a-zA-Z]:||; s/\.c$/.o/'` # Create the lock directory. # Note: use '[/\\:.-]' here to ensure that we don't use the same name # that we are using for the .o file. Also, base the name on the expected # object file name, since that is what matters with a parallel build. lockdir=`echo "$cofile" | sed -e 's|[/\\:.-]|_|g'`.d while true; do if mkdir "$lockdir" >/dev/null 2>&1; then break fi sleep 1 done # FIXME: race condition here if user kills between mkdir and trap. trap "rmdir '$lockdir'; exit 1" 1 2 15 # Run the compile. "$@" ret=$? if test -f "$cofile"; then test "$cofile" = "$ofile" || mv "$cofile" "$ofile" elif test -f "${cofile}bj"; then test "${cofile}bj" = "$ofile" || mv "${cofile}bj" "$ofile" fi rmdir "$lockdir" exit $ret # Local Variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/libhtp/Makefile.in0000644000000000000000000007114713051004463013554 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = . ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ $(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/lib-ld.m4 \ $(top_srcdir)/m4/lib-link.m4 $(top_srcdir)/m4/lib-prefix.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \ $(am__configure_deps) $(am__DIST_COMMON) am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \ configure.lineno config.status.lineno mkinstalldirs = $(install_sh) -d CONFIG_HEADER = htp_config_auto_gen.h CONFIG_CLEAN_FILES = htp.pc CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } am__installdirs = "$(DESTDIR)$(pkgconfigdir)" DATA = $(pkgconfig_DATA) RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ cscope distdir dist dist-all distcheck am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \ $(LISP)htp_config_auto_gen.h.in # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags CSCOPE = cscope am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/htp.pc.in \ $(srcdir)/htp_config_auto_gen.h.in AUTHORS COPYING ChangeLog \ INSTALL NEWS README compile config.guess config.rpath \ config.sub install-sh ltmain.sh missing DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) distdir = $(PACKAGE)-$(VERSION) top_distdir = $(distdir) am__remove_distdir = \ if test -d "$(distdir)"; then \ find "$(distdir)" -type d ! -perm -200 -exec chmod u+w {} ';' \ && rm -rf "$(distdir)" \ || { sleep 5 && rm -rf "$(distdir)"; }; \ else :; fi am__post_remove_distdir = $(am__remove_distdir) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" DIST_ARCHIVES = $(distdir).tar.gz GZIP_ENV = --best DIST_TARGETS = dist-gzip distuninstallcheck_listfiles = find . -type f -print am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \ | sed 's|^\./|$(prefix)/|' | grep -v '$(infodir)/dir$$' distcleancheck_listfiles = find . -type f -print ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CXX = @CXX@ CXXCPP = @CXXCPP@ CXXDEPMODE = @CXXDEPMODE@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DOXYGEN = @DOXYGEN@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GENERIC_API_VERSION = @GENERIC_API_VERSION@ GENERIC_LIBRARY_NAME = @GENERIC_LIBRARY_NAME@ GENERIC_LIBRARY_VERSION = @GENERIC_LIBRARY_VERSION@ GENERIC_RELEASE = @GENERIC_RELEASE@ GENERIC_VERSION = @GENERIC_VERSION@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBICONV = @LIBICONV@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBICONV = @LTLIBICONV@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ RANLIB = @RANLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ doxygen = @doxygen@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ ACLOCAL_AMFLAGS = -I m4 SUBDIRS = htp test docs DIST_SUBDIRS = htp test docs EXTRA_DIST = LICENSE NOTICE docs/doxygen.conf docs/QUICK_START VERSION get-version.sh pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = htp.pc all: htp_config_auto_gen.h $(MAKE) $(AM_MAKEFLAGS) all-recursive .SUFFIXES: am--refresh: Makefile @: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ echo ' cd $(srcdir) && $(AUTOMAKE) --gnu'; \ $(am__cd) $(srcdir) && $(AUTOMAKE) --gnu \ && exit 0; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ echo ' $(SHELL) ./config.status'; \ $(SHELL) ./config.status;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) $(SHELL) ./config.status --recheck $(top_srcdir)/configure: $(am__configure_deps) $(am__cd) $(srcdir) && $(AUTOCONF) $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__cd) $(srcdir) && $(ACLOCAL) $(ACLOCAL_AMFLAGS) $(am__aclocal_m4_deps): htp_config_auto_gen.h: stamp-h1 @test -f $@ || rm -f stamp-h1 @test -f $@ || $(MAKE) $(AM_MAKEFLAGS) stamp-h1 stamp-h1: $(srcdir)/htp_config_auto_gen.h.in $(top_builddir)/config.status @rm -f stamp-h1 cd $(top_builddir) && $(SHELL) ./config.status htp_config_auto_gen.h $(srcdir)/htp_config_auto_gen.h.in: $(am__configure_deps) ($(am__cd) $(top_srcdir) && $(AUTOHEADER)) rm -f stamp-h1 touch $@ distclean-hdr: -rm -f htp_config_auto_gen.h stamp-h1 htp.pc: $(top_builddir)/config.status $(srcdir)/htp.pc.in cd $(top_builddir) && $(SHELL) ./config.status $@ mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs distclean-libtool: -rm -f libtool config.lt install-pkgconfigDATA: $(pkgconfig_DATA) @$(NORMAL_INSTALL) @list='$(pkgconfig_DATA)'; test -n "$(pkgconfigdir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(pkgconfigdir)'"; \ $(MKDIR_P) "$(DESTDIR)$(pkgconfigdir)" || exit 1; \ fi; \ for p in $$list; do \ if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ echo "$$d$$p"; \ done | $(am__base_list) | \ while read files; do \ echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(pkgconfigdir)'"; \ $(INSTALL_DATA) $$files "$(DESTDIR)$(pkgconfigdir)" || exit $$?; \ done uninstall-pkgconfigDATA: @$(NORMAL_UNINSTALL) @list='$(pkgconfig_DATA)'; test -n "$(pkgconfigdir)" || list=; \ files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \ dir='$(DESTDIR)$(pkgconfigdir)'; $(am__uninstall_files_from_dir) # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscope: cscope.files test ! -s cscope.files \ || $(CSCOPE) -b -q $(AM_CSCOPEFLAGS) $(CSCOPEFLAGS) -i cscope.files $(CSCOPE_ARGS) clean-cscope: -rm -f cscope.files cscope.files: clean-cscope cscopelist cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags -rm -f cscope.out cscope.in.out cscope.po.out cscope.files distdir: $(DISTFILES) $(am__remove_distdir) test -d "$(distdir)" || mkdir "$(distdir)" @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done -test -n "$(am__skip_mode_fix)" \ || find "$(distdir)" -type d ! -perm -755 \ -exec chmod u+rwx,go+rx {} \; -o \ ! -type d ! -perm -444 -links 1 -exec chmod a+r {} \; -o \ ! -type d ! -perm -400 -exec chmod a+r {} \; -o \ ! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \ || chmod -R a+r "$(distdir)" dist-gzip: distdir tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz $(am__post_remove_distdir) dist-bzip2: distdir tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2 $(am__post_remove_distdir) dist-lzip: distdir tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz $(am__post_remove_distdir) dist-xz: distdir tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz $(am__post_remove_distdir) dist-tarZ: distdir @echo WARNING: "Support for distribution archives compressed with" \ "legacy program 'compress' is deprecated." >&2 @echo WARNING: "It will be removed altogether in Automake 2.0" >&2 tardir=$(distdir) && $(am__tar) | compress -c >$(distdir).tar.Z $(am__post_remove_distdir) dist-shar: distdir @echo WARNING: "Support for shar distribution archives is" \ "deprecated." >&2 @echo WARNING: "It will be removed altogether in Automake 2.0" >&2 shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz $(am__post_remove_distdir) dist-zip: distdir -rm -f $(distdir).zip zip -rq $(distdir).zip $(distdir) $(am__post_remove_distdir) dist dist-all: $(MAKE) $(AM_MAKEFLAGS) $(DIST_TARGETS) am__post_remove_distdir='@:' $(am__post_remove_distdir) # This target untars the dist file and tries a VPATH configuration. Then # it guarantees that the distribution is self-contained by making another # tarfile. distcheck: dist case '$(DIST_ARCHIVES)' in \ *.tar.gz*) \ GZIP=$(GZIP_ENV) gzip -dc $(distdir).tar.gz | $(am__untar) ;;\ *.tar.bz2*) \ bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\ *.tar.lz*) \ lzip -dc $(distdir).tar.lz | $(am__untar) ;;\ *.tar.xz*) \ xz -dc $(distdir).tar.xz | $(am__untar) ;;\ *.tar.Z*) \ uncompress -c $(distdir).tar.Z | $(am__untar) ;;\ *.shar.gz*) \ GZIP=$(GZIP_ENV) gzip -dc $(distdir).shar.gz | unshar ;;\ *.zip*) \ unzip $(distdir).zip ;;\ esac chmod -R a-w $(distdir) chmod u+w $(distdir) mkdir $(distdir)/_build $(distdir)/_build/sub $(distdir)/_inst chmod a-w $(distdir) test -d $(distdir)/_build || exit 0; \ dc_install_base=`$(am__cd) $(distdir)/_inst && pwd | sed -e 's,^[^:\\/]:[\\/],/,'` \ && dc_destdir="$${TMPDIR-/tmp}/am-dc-$$$$/" \ && am__cwd=`pwd` \ && $(am__cd) $(distdir)/_build/sub \ && ../../configure \ $(AM_DISTCHECK_CONFIGURE_FLAGS) \ $(DISTCHECK_CONFIGURE_FLAGS) \ --srcdir=../.. --prefix="$$dc_install_base" \ && $(MAKE) $(AM_MAKEFLAGS) \ && $(MAKE) $(AM_MAKEFLAGS) dvi \ && $(MAKE) $(AM_MAKEFLAGS) check \ && $(MAKE) $(AM_MAKEFLAGS) install \ && $(MAKE) $(AM_MAKEFLAGS) installcheck \ && $(MAKE) $(AM_MAKEFLAGS) uninstall \ && $(MAKE) $(AM_MAKEFLAGS) distuninstallcheck_dir="$$dc_install_base" \ distuninstallcheck \ && chmod -R a-w "$$dc_install_base" \ && ({ \ (cd ../.. && umask 077 && mkdir "$$dc_destdir") \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" install \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" uninstall \ && $(MAKE) $(AM_MAKEFLAGS) DESTDIR="$$dc_destdir" \ distuninstallcheck_dir="$$dc_destdir" distuninstallcheck; \ } || { rm -rf "$$dc_destdir"; exit 1; }) \ && rm -rf "$$dc_destdir" \ && $(MAKE) $(AM_MAKEFLAGS) dist \ && rm -rf $(DIST_ARCHIVES) \ && $(MAKE) $(AM_MAKEFLAGS) distcleancheck \ && cd "$$am__cwd" \ || exit 1 $(am__post_remove_distdir) @(echo "$(distdir) archives ready for distribution: "; \ list='$(DIST_ARCHIVES)'; for i in $$list; do echo $$i; done) | \ sed -e 1h -e 1s/./=/g -e 1p -e 1x -e '$$p' -e '$$x' distuninstallcheck: @test -n '$(distuninstallcheck_dir)' || { \ echo 'ERROR: trying to run $@ with an empty' \ '$$(distuninstallcheck_dir)' >&2; \ exit 1; \ }; \ $(am__cd) '$(distuninstallcheck_dir)' || { \ echo 'ERROR: cannot chdir into $(distuninstallcheck_dir)' >&2; \ exit 1; \ }; \ test `$(am__distuninstallcheck_listfiles) | wc -l` -eq 0 \ || { echo "ERROR: files left after uninstall:" ; \ if test -n "$(DESTDIR)"; then \ echo " (check DESTDIR support)"; \ fi ; \ $(distuninstallcheck_listfiles) ; \ exit 1; } >&2 distcleancheck: distclean @if test '$(srcdir)' = . ; then \ echo "ERROR: distcleancheck can only run from a VPATH build" ; \ exit 1 ; \ fi @test `$(distcleancheck_listfiles) | wc -l` -eq 0 \ || { echo "ERROR: files left in build directory after distclean:" ; \ $(distcleancheck_listfiles) ; \ exit 1; } >&2 check-am: all-am check: check-recursive all-am: Makefile $(DATA) htp_config_auto_gen.h installdirs: installdirs-recursive installdirs-am: for dir in "$(DESTDIR)$(pkgconfigdir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool clean-local mostlyclean-am distclean: distclean-recursive -rm -f $(am__CONFIG_DISTCLEAN_FILES) -rm -f Makefile distclean-am: clean-am distclean-generic distclean-hdr \ distclean-libtool distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-pkgconfigDATA install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f $(am__CONFIG_DISTCLEAN_FILES) -rm -rf $(top_srcdir)/autom4te.cache -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: uninstall-pkgconfigDATA .MAKE: $(am__recursive_targets) all install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \ am--refresh check check-am clean clean-cscope clean-generic \ clean-libtool clean-local cscope cscopelist-am ctags ctags-am \ dist dist-all dist-bzip2 dist-gzip dist-lzip dist-shar \ dist-tarZ dist-xz dist-zip distcheck distclean \ distclean-generic distclean-hdr distclean-libtool \ distclean-tags distcleancheck distdir distuninstallcheck dvi \ dvi-am html html-am info info-am install install-am \ install-data install-data-am install-dvi install-dvi-am \ install-exec install-exec-am install-html install-html-am \ install-info install-info-am install-man install-pdf \ install-pdf-am install-pkgconfigDATA install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags tags-am uninstall uninstall-am \ uninstall-pkgconfigDATA .PRECIOUS: Makefile test: all @(cd test && $(MAKE) $@) test-compile-only: all @(cd test && $(MAKE) $@) check-compile-only: all @(cd test && $(MAKE) $@) doxygen doxygen-pdf: @(cd docs && $(MAKE) $@) gcov: test @ if [[ -x $(LCOV) ]]; then \ lcov --capture --directory $(top_builddir)/htp/ --output-file $(top_builddir)/test/coverage.info --no-external ; \ genhtml $(top_builddir)/test/coverage.info --output-directory $(top_builddir)/docs/lcov ; \ echo "" ; \ echo "Open docs/lcov/index.html to review lcov output" ; \ fi clean-local: rm -rf $(top_builddir)/docs/doxygen rm -rf $(top_builddir)/docs/lcov find $(top_builddir) -type f \( -name '*.gcda' -o -name '*.gcno' -o -name '*.gcov' \) -exec rm '{}' ';' # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/libhtp/depcomp0000755000000000000000000005601613051004463013062 00000000000000#! /bin/sh # depcomp - compile a program generating dependencies as side-effects scriptversion=2013-05-30.07; # UTC # Copyright (C) 1999-2014 Free Software Foundation, Inc. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Originally written by Alexandre Oliva . case $1 in '') echo "$0: No command. Try '$0 --help' for more information." 1>&2 exit 1; ;; -h | --h*) cat <<\EOF Usage: depcomp [--help] [--version] PROGRAM [ARGS] Run PROGRAMS ARGS to compile a file, generating dependencies as side-effects. Environment variables: depmode Dependency tracking mode. source Source file read by 'PROGRAMS ARGS'. object Object file output by 'PROGRAMS ARGS'. DEPDIR directory where to store dependencies. depfile Dependency file to output. tmpdepfile Temporary file to use when outputting dependencies. libtool Whether libtool is used (yes/no). Report bugs to . EOF exit $? ;; -v | --v*) echo "depcomp $scriptversion" exit $? ;; esac # Get the directory component of the given path, and save it in the # global variables '$dir'. Note that this directory component will # be either empty or ending with a '/' character. This is deliberate. set_dir_from () { case $1 in */*) dir=`echo "$1" | sed -e 's|/[^/]*$|/|'`;; *) dir=;; esac } # Get the suffix-stripped basename of the given path, and save it the # global variable '$base'. set_base_from () { base=`echo "$1" | sed -e 's|^.*/||' -e 's/\.[^.]*$//'` } # If no dependency file was actually created by the compiler invocation, # we still have to create a dummy depfile, to avoid errors with the # Makefile "include basename.Plo" scheme. make_dummy_depfile () { echo "#dummy" > "$depfile" } # Factor out some common post-processing of the generated depfile. # Requires the auxiliary global variable '$tmpdepfile' to be set. aix_post_process_depfile () { # If the compiler actually managed to produce a dependency file, # post-process it. if test -f "$tmpdepfile"; then # Each line is of the form 'foo.o: dependency.h'. # Do two passes, one to just change these to # $object: dependency.h # and one to simply output # dependency.h: # which is needed to avoid the deleted-header problem. { sed -e "s,^.*\.[$lower]*:,$object:," < "$tmpdepfile" sed -e "s,^.*\.[$lower]*:[$tab ]*,," -e 's,$,:,' < "$tmpdepfile" } > "$depfile" rm -f "$tmpdepfile" else make_dummy_depfile fi } # A tabulation character. tab=' ' # A newline character. nl=' ' # Character ranges might be problematic outside the C locale. # These definitions help. upper=ABCDEFGHIJKLMNOPQRSTUVWXYZ lower=abcdefghijklmnopqrstuvwxyz digits=0123456789 alpha=${upper}${lower} if test -z "$depmode" || test -z "$source" || test -z "$object"; then echo "depcomp: Variables source, object and depmode must be set" 1>&2 exit 1 fi # Dependencies for sub/bar.o or sub/bar.obj go into sub/.deps/bar.Po. depfile=${depfile-`echo "$object" | sed 's|[^\\/]*$|'${DEPDIR-.deps}'/&|;s|\.\([^.]*\)$|.P\1|;s|Pobj$|Po|'`} tmpdepfile=${tmpdepfile-`echo "$depfile" | sed 's/\.\([^.]*\)$/.T\1/'`} rm -f "$tmpdepfile" # Avoid interferences from the environment. gccflag= dashmflag= # Some modes work just like other modes, but use different flags. We # parameterize here, but still list the modes in the big case below, # to make depend.m4 easier to write. Note that we *cannot* use a case # here, because this file can only contain one case statement. if test "$depmode" = hp; then # HP compiler uses -M and no extra arg. gccflag=-M depmode=gcc fi if test "$depmode" = dashXmstdout; then # This is just like dashmstdout with a different argument. dashmflag=-xM depmode=dashmstdout fi cygpath_u="cygpath -u -f -" if test "$depmode" = msvcmsys; then # This is just like msvisualcpp but w/o cygpath translation. # Just convert the backslash-escaped backslashes to single forward # slashes to satisfy depend.m4 cygpath_u='sed s,\\\\,/,g' depmode=msvisualcpp fi if test "$depmode" = msvc7msys; then # This is just like msvc7 but w/o cygpath translation. # Just convert the backslash-escaped backslashes to single forward # slashes to satisfy depend.m4 cygpath_u='sed s,\\\\,/,g' depmode=msvc7 fi if test "$depmode" = xlc; then # IBM C/C++ Compilers xlc/xlC can output gcc-like dependency information. gccflag=-qmakedep=gcc,-MF depmode=gcc fi case "$depmode" in gcc3) ## gcc 3 implements dependency tracking that does exactly what ## we want. Yay! Note: for some reason libtool 1.4 doesn't like ## it if -MD -MP comes after the -MF stuff. Hmm. ## Unfortunately, FreeBSD c89 acceptance of flags depends upon ## the command line argument order; so add the flags where they ## appear in depend2.am. Note that the slowdown incurred here ## affects only configure: in makefiles, %FASTDEP% shortcuts this. for arg do case $arg in -c) set fnord "$@" -MT "$object" -MD -MP -MF "$tmpdepfile" "$arg" ;; *) set fnord "$@" "$arg" ;; esac shift # fnord shift # $arg done "$@" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi mv "$tmpdepfile" "$depfile" ;; gcc) ## Note that this doesn't just cater to obsosete pre-3.x GCC compilers. ## but also to in-use compilers like IMB xlc/xlC and the HP C compiler. ## (see the conditional assignment to $gccflag above). ## There are various ways to get dependency output from gcc. Here's ## why we pick this rather obscure method: ## - Don't want to use -MD because we'd like the dependencies to end ## up in a subdir. Having to rename by hand is ugly. ## (We might end up doing this anyway to support other compilers.) ## - The DEPENDENCIES_OUTPUT environment variable makes gcc act like ## -MM, not -M (despite what the docs say). Also, it might not be ## supported by the other compilers which use the 'gcc' depmode. ## - Using -M directly means running the compiler twice (even worse ## than renaming). if test -z "$gccflag"; then gccflag=-MD, fi "$@" -Wp,"$gccflag$tmpdepfile" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" echo "$object : \\" > "$depfile" # The second -e expression handles DOS-style file names with drive # letters. sed -e 's/^[^:]*: / /' \ -e 's/^['$alpha']:\/[^:]*: / /' < "$tmpdepfile" >> "$depfile" ## This next piece of magic avoids the "deleted header file" problem. ## The problem is that when a header file which appears in a .P file ## is deleted, the dependency causes make to die (because there is ## typically no way to rebuild the header). We avoid this by adding ## dummy dependencies for each header file. Too bad gcc doesn't do ## this for us directly. ## Some versions of gcc put a space before the ':'. On the theory ## that the space means something, we add a space to the output as ## well. hp depmode also adds that space, but also prefixes the VPATH ## to the object. Take care to not repeat it in the output. ## Some versions of the HPUX 10.20 sed can't process this invocation ## correctly. Breaking it into two sed invocations is a workaround. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^\\$//' -e '/^$/d' -e "s|.*$object$||" -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; hp) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; sgi) if test "$libtool" = yes; then "$@" "-Wp,-MDupdate,$tmpdepfile" else "$@" -MDupdate "$tmpdepfile" fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" if test -f "$tmpdepfile"; then # yes, the sourcefile depend on other files echo "$object : \\" > "$depfile" # Clip off the initial element (the dependent). Don't try to be # clever and replace this with sed code, as IRIX sed won't handle # lines with more than a fixed number of characters (4096 in # IRIX 6.2 sed, 8192 in IRIX 6.5). We also remove comment lines; # the IRIX cc adds comments like '#:fec' to the end of the # dependency line. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' \ | tr "$nl" ' ' >> "$depfile" echo >> "$depfile" # The second pass generates a dummy entry for each header file. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' -e 's/$/:/' \ >> "$depfile" else make_dummy_depfile fi rm -f "$tmpdepfile" ;; xlc) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; aix) # The C for AIX Compiler uses -M and outputs the dependencies # in a .u file. In older versions, this file always lives in the # current directory. Also, the AIX compiler puts '$object:' at the # start of each line; $object doesn't have directory information. # Version 6 uses the directory in both cases. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then tmpdepfile1=$dir$base.u tmpdepfile2=$base.u tmpdepfile3=$dir.libs/$base.u "$@" -Wc,-M else tmpdepfile1=$dir$base.u tmpdepfile2=$dir$base.u tmpdepfile3=$dir$base.u "$@" -M fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" do test -f "$tmpdepfile" && break done aix_post_process_depfile ;; tcc) # tcc (Tiny C Compiler) understand '-MD -MF file' since version 0.9.26 # FIXME: That version still under development at the moment of writing. # Make that this statement remains true also for stable, released # versions. # It will wrap lines (doesn't matter whether long or short) with a # trailing '\', as in: # # foo.o : \ # foo.c \ # foo.h \ # # It will put a trailing '\' even on the last line, and will use leading # spaces rather than leading tabs (at least since its commit 0394caf7 # "Emit spaces for -MD"). "$@" -MD -MF "$tmpdepfile" stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" # Each non-empty line is of the form 'foo.o : \' or ' dep.h \'. # We have to change lines of the first kind to '$object: \'. sed -e "s|.*:|$object :|" < "$tmpdepfile" > "$depfile" # And for each line of the second kind, we have to emit a 'dep.h:' # dummy dependency, to avoid the deleted-header problem. sed -n -e 's|^ *\(.*\) *\\$|\1:|p' < "$tmpdepfile" >> "$depfile" rm -f "$tmpdepfile" ;; ## The order of this option in the case statement is important, since the ## shell code in configure will try each of these formats in the order ## listed in this file. A plain '-MD' option would be understood by many ## compilers, so we must ensure this comes after the gcc and icc options. pgcc) # Portland's C compiler understands '-MD'. # Will always output deps to 'file.d' where file is the root name of the # source file under compilation, even if file resides in a subdirectory. # The object file name does not affect the name of the '.d' file. # pgcc 10.2 will output # foo.o: sub/foo.c sub/foo.h # and will wrap long lines using '\' : # foo.o: sub/foo.c ... \ # sub/foo.h ... \ # ... set_dir_from "$object" # Use the source, not the object, to determine the base name, since # that's sadly what pgcc will do too. set_base_from "$source" tmpdepfile=$base.d # For projects that build the same source file twice into different object # files, the pgcc approach of using the *source* file root name can cause # problems in parallel builds. Use a locking strategy to avoid stomping on # the same $tmpdepfile. lockdir=$base.d-lock trap " echo '$0: caught signal, cleaning up...' >&2 rmdir '$lockdir' exit 1 " 1 2 13 15 numtries=100 i=$numtries while test $i -gt 0; do # mkdir is a portable test-and-set. if mkdir "$lockdir" 2>/dev/null; then # This process acquired the lock. "$@" -MD stat=$? # Release the lock. rmdir "$lockdir" break else # If the lock is being held by a different process, wait # until the winning process is done or we timeout. while test -d "$lockdir" && test $i -gt 0; do sleep 1 i=`expr $i - 1` done fi i=`expr $i - 1` done trap - 1 2 13 15 if test $i -le 0; then echo "$0: failed to acquire lock after $numtries attempts" >&2 echo "$0: check lockdir '$lockdir'" >&2 exit 1 fi if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" # Each line is of the form `foo.o: dependent.h', # or `foo.o: dep1.h dep2.h \', or ` dep3.h dep4.h \'. # Do two passes, one to just change these to # `$object: dependent.h' and one to simply `dependent.h:'. sed "s,^[^:]*:,$object :," < "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process this invocation # correctly. Breaking it into two sed invocations is a workaround. sed 's,^[^:]*: \(.*\)$,\1,;s/^\\$//;/^$/d;/:$/d' < "$tmpdepfile" \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; hp2) # The "hp" stanza above does not work with aCC (C++) and HP's ia64 # compilers, which have integrated preprocessors. The correct option # to use with these is +Maked; it writes dependencies to a file named # 'foo.d', which lands next to the object file, wherever that # happens to be. # Much of this is similar to the tru64 case; see comments there. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then tmpdepfile1=$dir$base.d tmpdepfile2=$dir.libs/$base.d "$@" -Wc,+Maked else tmpdepfile1=$dir$base.d tmpdepfile2=$dir$base.d "$@" +Maked fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" do test -f "$tmpdepfile" && break done if test -f "$tmpdepfile"; then sed -e "s,^.*\.[$lower]*:,$object:," "$tmpdepfile" > "$depfile" # Add 'dependent.h:' lines. sed -ne '2,${ s/^ *// s/ \\*$// s/$/:/ p }' "$tmpdepfile" >> "$depfile" else make_dummy_depfile fi rm -f "$tmpdepfile" "$tmpdepfile2" ;; tru64) # The Tru64 compiler uses -MD to generate dependencies as a side # effect. 'cc -MD -o foo.o ...' puts the dependencies into 'foo.o.d'. # At least on Alpha/Redhat 6.1, Compaq CCC V6.2-504 seems to put # dependencies in 'foo.d' instead, so we check for that too. # Subdirectories are respected. set_dir_from "$object" set_base_from "$object" if test "$libtool" = yes; then # Libtool generates 2 separate objects for the 2 libraries. These # two compilations output dependencies in $dir.libs/$base.o.d and # in $dir$base.o.d. We have to check for both files, because # one of the two compilations can be disabled. We should prefer # $dir$base.o.d over $dir.libs/$base.o.d because the latter is # automatically cleaned when .libs/ is deleted, while ignoring # the former would cause a distcleancheck panic. tmpdepfile1=$dir$base.o.d # libtool 1.5 tmpdepfile2=$dir.libs/$base.o.d # Likewise. tmpdepfile3=$dir.libs/$base.d # Compaq CCC V6.2-504 "$@" -Wc,-MD else tmpdepfile1=$dir$base.d tmpdepfile2=$dir$base.d tmpdepfile3=$dir$base.d "$@" -MD fi stat=$? if test $stat -ne 0; then rm -f "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" exit $stat fi for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" do test -f "$tmpdepfile" && break done # Same post-processing that is required for AIX mode. aix_post_process_depfile ;; msvc7) if test "$libtool" = yes; then showIncludes=-Wc,-showIncludes else showIncludes=-showIncludes fi "$@" $showIncludes > "$tmpdepfile" stat=$? grep -v '^Note: including file: ' "$tmpdepfile" if test $stat -ne 0; then rm -f "$tmpdepfile" exit $stat fi rm -f "$depfile" echo "$object : \\" > "$depfile" # The first sed program below extracts the file names and escapes # backslashes for cygpath. The second sed program outputs the file # name when reading, but also accumulates all include files in the # hold buffer in order to output them again at the end. This only # works with sed implementations that can handle large buffers. sed < "$tmpdepfile" -n ' /^Note: including file: *\(.*\)/ { s//\1/ s/\\/\\\\/g p }' | $cygpath_u | sort -u | sed -n ' s/ /\\ /g s/\(.*\)/'"$tab"'\1 \\/p s/.\(.*\) \\/\1:/ H $ { s/.*/'"$tab"'/ G p }' >> "$depfile" echo >> "$depfile" # make sure the fragment doesn't end with a backslash rm -f "$tmpdepfile" ;; msvc7msys) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; #nosideeffect) # This comment above is used by automake to tell side-effect # dependency tracking mechanisms from slower ones. dashmstdout) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout, regardless of -o. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # Remove '-o $object'. IFS=" " for arg do case $arg in -o) shift ;; $object) shift ;; *) set fnord "$@" "$arg" shift # fnord shift # $arg ;; esac done test -z "$dashmflag" && dashmflag=-M # Require at least two characters before searching for ':' # in the target name. This is to cope with DOS-style filenames: # a dependency such as 'c:/foo/bar' could be seen as target 'c' otherwise. "$@" $dashmflag | sed "s|^[$tab ]*[^:$tab ][^:][^:]*:[$tab ]*|$object: |" > "$tmpdepfile" rm -f "$depfile" cat < "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process this sed invocation # correctly. Breaking it into two sed invocations is a workaround. tr ' ' "$nl" < "$tmpdepfile" \ | sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; dashXmstdout) # This case only exists to satisfy depend.m4. It is never actually # run, as this mode is specially recognized in the preamble. exit 1 ;; makedepend) "$@" || exit $? # Remove any Libtool call if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # X makedepend shift cleared=no eat=no for arg do case $cleared in no) set ""; shift cleared=yes ;; esac if test $eat = yes; then eat=no continue fi case "$arg" in -D*|-I*) set fnord "$@" "$arg"; shift ;; # Strip any option that makedepend may not understand. Remove # the object too, otherwise makedepend will parse it as a source file. -arch) eat=yes ;; -*|$object) ;; *) set fnord "$@" "$arg"; shift ;; esac done obj_suffix=`echo "$object" | sed 's/^.*\././'` touch "$tmpdepfile" ${MAKEDEPEND-makedepend} -o"$obj_suffix" -f"$tmpdepfile" "$@" rm -f "$depfile" # makedepend may prepend the VPATH from the source file name to the object. # No need to regex-escape $object, excess matching of '.' is harmless. sed "s|^.*\($object *:\)|\1|" "$tmpdepfile" > "$depfile" # Some versions of the HPUX 10.20 sed can't process the last invocation # correctly. Breaking it into two sed invocations is a workaround. sed '1,2d' "$tmpdepfile" \ | tr ' ' "$nl" \ | sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' \ | sed -e 's/$/ :/' >> "$depfile" rm -f "$tmpdepfile" "$tmpdepfile".bak ;; cpp) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi # Remove '-o $object'. IFS=" " for arg do case $arg in -o) shift ;; $object) shift ;; *) set fnord "$@" "$arg" shift # fnord shift # $arg ;; esac done "$@" -E \ | sed -n -e '/^# [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' \ -e '/^#line [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' \ | sed '$ s: \\$::' > "$tmpdepfile" rm -f "$depfile" echo "$object : \\" > "$depfile" cat < "$tmpdepfile" >> "$depfile" sed < "$tmpdepfile" '/^$/d;s/^ //;s/ \\$//;s/$/ :/' >> "$depfile" rm -f "$tmpdepfile" ;; msvisualcpp) # Important note: in order to support this mode, a compiler *must* # always write the preprocessed file to stdout. "$@" || exit $? # Remove the call to Libtool. if test "$libtool" = yes; then while test "X$1" != 'X--mode=compile'; do shift done shift fi IFS=" " for arg do case "$arg" in -o) shift ;; $object) shift ;; "-Gm"|"/Gm"|"-Gi"|"/Gi"|"-ZI"|"/ZI") set fnord "$@" shift shift ;; *) set fnord "$@" "$arg" shift shift ;; esac done "$@" -E 2>/dev/null | sed -n '/^#line [0-9][0-9]* "\([^"]*\)"/ s::\1:p' | $cygpath_u | sort -u > "$tmpdepfile" rm -f "$depfile" echo "$object : \\" > "$depfile" sed < "$tmpdepfile" -n -e 's% %\\ %g' -e '/^\(.*\)$/ s::'"$tab"'\1 \\:p' >> "$depfile" echo "$tab" >> "$depfile" sed < "$tmpdepfile" -n -e 's% %\\ %g' -e '/^\(.*\)$/ s::\1\::p' >> "$depfile" rm -f "$tmpdepfile" ;; msvcmsys) # This case exists only to let depend.m4 do its work. It works by # looking at the text of this script. This case will never be run, # since it is checked for above. exit 1 ;; none) exec "$@" ;; *) echo "Unknown depmode $depmode" 1>&2 exit 1 ;; esac exit 0 # Local Variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC" # time-stamp-end: "; # UTC" # End: suricata-3.2.1/libhtp/aclocal.m40000644000000000000000000012246113051004461013341 00000000000000# generated automatically by aclocal 1.15 -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])]) m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.69],, [m4_warning([this file was generated for autoconf 2.69. You have another version of autoconf. It may work, but is not guaranteed to. If you have problems, you may need to regenerate the build system entirely. To do so, use the procedure documented by the package, typically 'autoreconf'.])]) # Copyright (C) 2002-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_AUTOMAKE_VERSION(VERSION) # ---------------------------- # Automake X.Y traces this macro to ensure aclocal.m4 has been # generated from the m4 files accompanying Automake X.Y. # (This private macro should not be called outside this file.) AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version='1.15' dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to dnl require some minimum version. Point them to the right macro. m4_if([$1], [1.15], [], [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl ]) # _AM_AUTOCONF_VERSION(VERSION) # ----------------------------- # aclocal traces this macro to find the Autoconf version. # This is a private macro too. Using m4_define simplifies # the logic in aclocal, which can simply ignore this definition. m4_define([_AM_AUTOCONF_VERSION], []) # AM_SET_CURRENT_AUTOMAKE_VERSION # ------------------------------- # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced. # This function is AC_REQUIREd by AM_INIT_AUTOMAKE. AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION], [AM_AUTOMAKE_VERSION([1.15])dnl m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) # AM_AUX_DIR_EXPAND -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # For projects using AC_CONFIG_AUX_DIR([foo]), Autoconf sets # $ac_aux_dir to '$srcdir/foo'. In other projects, it is set to # '$srcdir', '$srcdir/..', or '$srcdir/../..'. # # Of course, Automake must honor this variable whenever it calls a # tool from the auxiliary directory. The problem is that $srcdir (and # therefore $ac_aux_dir as well) can be either absolute or relative, # depending on how configure is run. This is pretty annoying, since # it makes $ac_aux_dir quite unusable in subdirectories: in the top # source directory, any form will work fine, but in subdirectories a # relative path needs to be adjusted first. # # $ac_aux_dir/missing # fails when called from a subdirectory if $ac_aux_dir is relative # $top_srcdir/$ac_aux_dir/missing # fails if $ac_aux_dir is absolute, # fails when called from a subdirectory in a VPATH build with # a relative $ac_aux_dir # # The reason of the latter failure is that $top_srcdir and $ac_aux_dir # are both prefixed by $srcdir. In an in-source build this is usually # harmless because $srcdir is '.', but things will broke when you # start a VPATH build or use an absolute $srcdir. # # So we could use something similar to $top_srcdir/$ac_aux_dir/missing, # iff we strip the leading $srcdir from $ac_aux_dir. That would be: # am_aux_dir='\$(top_srcdir)/'`expr "$ac_aux_dir" : "$srcdir//*\(.*\)"` # and then we would define $MISSING as # MISSING="\${SHELL} $am_aux_dir/missing" # This will work as long as MISSING is not called from configure, because # unfortunately $(top_srcdir) has no meaning in configure. # However there are other variables, like CC, which are often used in # configure, and could therefore not use this "fixed" $ac_aux_dir. # # Another solution, used here, is to always expand $ac_aux_dir to an # absolute PATH. The drawback is that using absolute paths prevent a # configured tree to be moved without reconfiguration. AC_DEFUN([AM_AUX_DIR_EXPAND], [AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl # Expand $ac_aux_dir to an absolute path. am_aux_dir=`cd "$ac_aux_dir" && pwd` ]) # AM_CONDITIONAL -*- Autoconf -*- # Copyright (C) 1997-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_CONDITIONAL(NAME, SHELL-CONDITION) # ------------------------------------- # Define a conditional. AC_DEFUN([AM_CONDITIONAL], [AC_PREREQ([2.52])dnl m4_if([$1], [TRUE], [AC_FATAL([$0: invalid condition: $1])], [$1], [FALSE], [AC_FATAL([$0: invalid condition: $1])])dnl AC_SUBST([$1_TRUE])dnl AC_SUBST([$1_FALSE])dnl _AM_SUBST_NOTMAKE([$1_TRUE])dnl _AM_SUBST_NOTMAKE([$1_FALSE])dnl m4_define([_AM_COND_VALUE_$1], [$2])dnl if $2; then $1_TRUE= $1_FALSE='#' else $1_TRUE='#' $1_FALSE= fi AC_CONFIG_COMMANDS_PRE( [if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then AC_MSG_ERROR([[conditional "$1" was never defined. Usually this means the macro was only invoked conditionally.]]) fi])]) # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # There are a few dirty hacks below to avoid letting 'AC_PROG_CC' be # written in clear, in which case automake, when reading aclocal.m4, # will think it sees a *use*, and therefore will trigger all it's # C support machinery. Also note that it means that autoscan, seeing # CC etc. in the Makefile, will ask for an AC_PROG_CC use... # _AM_DEPENDENCIES(NAME) # ---------------------- # See how the compiler implements dependency checking. # NAME is "CC", "CXX", "OBJC", "OBJCXX", "UPC", or "GJC". # We try a few techniques and use that to set a single cache variable. # # We don't AC_REQUIRE the corresponding AC_PROG_CC since the latter was # modified to invoke _AM_DEPENDENCIES(CC); we would have a circular # dependency, and given that the user is not expected to run this macro, # just rely on AC_PROG_CC. AC_DEFUN([_AM_DEPENDENCIES], [AC_REQUIRE([AM_SET_DEPDIR])dnl AC_REQUIRE([AM_OUTPUT_DEPENDENCY_COMMANDS])dnl AC_REQUIRE([AM_MAKE_INCLUDE])dnl AC_REQUIRE([AM_DEP_TRACK])dnl m4_if([$1], [CC], [depcc="$CC" am_compiler_list=], [$1], [CXX], [depcc="$CXX" am_compiler_list=], [$1], [OBJC], [depcc="$OBJC" am_compiler_list='gcc3 gcc'], [$1], [OBJCXX], [depcc="$OBJCXX" am_compiler_list='gcc3 gcc'], [$1], [UPC], [depcc="$UPC" am_compiler_list=], [$1], [GCJ], [depcc="$GCJ" am_compiler_list='gcc3 gcc'], [depcc="$$1" am_compiler_list=]) AC_CACHE_CHECK([dependency style of $depcc], [am_cv_$1_dependencies_compiler_type], [if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_$1_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n ['s/^#*\([a-zA-Z0-9]*\))$/\1/p'] < ./depcomp` fi am__universal=false m4_case([$1], [CC], [case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac], [CXX], [case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac]) for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_$1_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_$1_dependencies_compiler_type=none fi ]) AC_SUBST([$1DEPMODE], [depmode=$am_cv_$1_dependencies_compiler_type]) AM_CONDITIONAL([am__fastdep$1], [ test "x$enable_dependency_tracking" != xno \ && test "$am_cv_$1_dependencies_compiler_type" = gcc3]) ]) # AM_SET_DEPDIR # ------------- # Choose a directory name for dependency files. # This macro is AC_REQUIREd in _AM_DEPENDENCIES. AC_DEFUN([AM_SET_DEPDIR], [AC_REQUIRE([AM_SET_LEADING_DOT])dnl AC_SUBST([DEPDIR], ["${am__leading_dot}deps"])dnl ]) # AM_DEP_TRACK # ------------ AC_DEFUN([AM_DEP_TRACK], [AC_ARG_ENABLE([dependency-tracking], [dnl AS_HELP_STRING( [--enable-dependency-tracking], [do not reject slow dependency extractors]) AS_HELP_STRING( [--disable-dependency-tracking], [speeds up one-time build])]) if test "x$enable_dependency_tracking" != xno; then am_depcomp="$ac_aux_dir/depcomp" AMDEPBACKSLASH='\' am__nodep='_no' fi AM_CONDITIONAL([AMDEP], [test "x$enable_dependency_tracking" != xno]) AC_SUBST([AMDEPBACKSLASH])dnl _AM_SUBST_NOTMAKE([AMDEPBACKSLASH])dnl AC_SUBST([am__nodep])dnl _AM_SUBST_NOTMAKE([am__nodep])dnl ]) # Generate code to set up dependency tracking. -*- Autoconf -*- # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_OUTPUT_DEPENDENCY_COMMANDS # ------------------------------ AC_DEFUN([_AM_OUTPUT_DEPENDENCY_COMMANDS], [{ # Older Autoconf quotes --file arguments for eval, but not when files # are listed without --file. Let's play safe and only enable the eval # if we detect the quoting. case $CONFIG_FILES in *\'*) eval set x "$CONFIG_FILES" ;; *) set x $CONFIG_FILES ;; esac shift for mf do # Strip MF so we end up with the name of the file. mf=`echo "$mf" | sed -e 's/:.*$//'` # Check whether this is an Automake generated Makefile or not. # We used to match only the files named 'Makefile.in', but # some people rename them; so instead we look at the file content. # Grep'ing the first line is not enough: some people post-process # each Makefile.in and add a new line on top of each file to say so. # Grep'ing the whole file is not good either: AIX grep has a line # limit of 2048, but all sed's we know have understand at least 4000. if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then dirpart=`AS_DIRNAME("$mf")` else continue fi # Extract the definition of DEPDIR, am__include, and am__quote # from the Makefile without running 'make'. DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"` test -z "$DEPDIR" && continue am__include=`sed -n 's/^am__include = //p' < "$mf"` test -z "$am__include" && continue am__quote=`sed -n 's/^am__quote = //p' < "$mf"` # Find all dependency output files, they are included files with # $(DEPDIR) in their names. We invoke sed twice because it is the # simplest approach to changing $(DEPDIR) to its actual value in the # expansion. for file in `sed -n " s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \ sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do # Make sure the directory exists. test -f "$dirpart/$file" && continue fdir=`AS_DIRNAME(["$file"])` AS_MKDIR_P([$dirpart/$fdir]) # echo "creating $dirpart/$file" echo '# dummy' > "$dirpart/$file" done done } ])# _AM_OUTPUT_DEPENDENCY_COMMANDS # AM_OUTPUT_DEPENDENCY_COMMANDS # ----------------------------- # This macro should only be invoked once -- use via AC_REQUIRE. # # This code is only required when automatic dependency tracking # is enabled. FIXME. This creates each '.P' file that we will # need in order to bootstrap the dependency handling code. AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS], [AC_CONFIG_COMMANDS([depfiles], [test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS], [AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"]) ]) # Do all the work for Automake. -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This macro actually does too much. Some checks are only needed if # your package does certain things. But this isn't really a big deal. dnl Redefine AC_PROG_CC to automatically invoke _AM_PROG_CC_C_O. m4_define([AC_PROG_CC], m4_defn([AC_PROG_CC]) [_AM_PROG_CC_C_O ]) # AM_INIT_AUTOMAKE(PACKAGE, VERSION, [NO-DEFINE]) # AM_INIT_AUTOMAKE([OPTIONS]) # ----------------------------------------------- # The call with PACKAGE and VERSION arguments is the old style # call (pre autoconf-2.50), which is being phased out. PACKAGE # and VERSION should now be passed to AC_INIT and removed from # the call to AM_INIT_AUTOMAKE. # We support both call styles for the transition. After # the next Automake release, Autoconf can make the AC_INIT # arguments mandatory, and then we can depend on a new Autoconf # release and drop the old call support. AC_DEFUN([AM_INIT_AUTOMAKE], [AC_PREREQ([2.65])dnl dnl Autoconf wants to disallow AM_ names. We explicitly allow dnl the ones we care about. m4_pattern_allow([^AM_[A-Z]+FLAGS$])dnl AC_REQUIRE([AM_SET_CURRENT_AUTOMAKE_VERSION])dnl AC_REQUIRE([AC_PROG_INSTALL])dnl if test "`cd $srcdir && pwd`" != "`pwd`"; then # Use -I$(srcdir) only when $(srcdir) != ., so that make's output # is not polluted with repeated "-I." AC_SUBST([am__isrc], [' -I$(srcdir)'])_AM_SUBST_NOTMAKE([am__isrc])dnl # test to see if srcdir already configured if test -f $srcdir/config.status; then AC_MSG_ERROR([source directory already configured; run "make distclean" there first]) fi fi # test whether we have cygpath if test -z "$CYGPATH_W"; then if (cygpath --version) >/dev/null 2>/dev/null; then CYGPATH_W='cygpath -w' else CYGPATH_W=echo fi fi AC_SUBST([CYGPATH_W]) # Define the identity of the package. dnl Distinguish between old-style and new-style calls. m4_ifval([$2], [AC_DIAGNOSE([obsolete], [$0: two- and three-arguments forms are deprecated.]) m4_ifval([$3], [_AM_SET_OPTION([no-define])])dnl AC_SUBST([PACKAGE], [$1])dnl AC_SUBST([VERSION], [$2])], [_AM_SET_OPTIONS([$1])dnl dnl Diagnose old-style AC_INIT with new-style AM_AUTOMAKE_INIT. m4_if( m4_ifdef([AC_PACKAGE_NAME], [ok]):m4_ifdef([AC_PACKAGE_VERSION], [ok]), [ok:ok],, [m4_fatal([AC_INIT should be called with package and version arguments])])dnl AC_SUBST([PACKAGE], ['AC_PACKAGE_TARNAME'])dnl AC_SUBST([VERSION], ['AC_PACKAGE_VERSION'])])dnl _AM_IF_OPTION([no-define],, [AC_DEFINE_UNQUOTED([PACKAGE], ["$PACKAGE"], [Name of package]) AC_DEFINE_UNQUOTED([VERSION], ["$VERSION"], [Version number of package])])dnl # Some tools Automake needs. AC_REQUIRE([AM_SANITY_CHECK])dnl AC_REQUIRE([AC_ARG_PROGRAM])dnl AM_MISSING_PROG([ACLOCAL], [aclocal-${am__api_version}]) AM_MISSING_PROG([AUTOCONF], [autoconf]) AM_MISSING_PROG([AUTOMAKE], [automake-${am__api_version}]) AM_MISSING_PROG([AUTOHEADER], [autoheader]) AM_MISSING_PROG([MAKEINFO], [makeinfo]) AC_REQUIRE([AM_PROG_INSTALL_SH])dnl AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl AC_REQUIRE([AC_PROG_MKDIR_P])dnl # For better backward compatibility. To be removed once Automake 1.9.x # dies out for good. For more background, see: # # AC_SUBST([mkdir_p], ['$(MKDIR_P)']) # We need awk for the "check" target (and possibly the TAP driver). The # system "awk" is bad on some platforms. AC_REQUIRE([AC_PROG_AWK])dnl AC_REQUIRE([AC_PROG_MAKE_SET])dnl AC_REQUIRE([AM_SET_LEADING_DOT])dnl _AM_IF_OPTION([tar-ustar], [_AM_PROG_TAR([ustar])], [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])], [_AM_PROG_TAR([v7])])]) _AM_IF_OPTION([no-dependencies],, [AC_PROVIDE_IFELSE([AC_PROG_CC], [_AM_DEPENDENCIES([CC])], [m4_define([AC_PROG_CC], m4_defn([AC_PROG_CC])[_AM_DEPENDENCIES([CC])])])dnl AC_PROVIDE_IFELSE([AC_PROG_CXX], [_AM_DEPENDENCIES([CXX])], [m4_define([AC_PROG_CXX], m4_defn([AC_PROG_CXX])[_AM_DEPENDENCIES([CXX])])])dnl AC_PROVIDE_IFELSE([AC_PROG_OBJC], [_AM_DEPENDENCIES([OBJC])], [m4_define([AC_PROG_OBJC], m4_defn([AC_PROG_OBJC])[_AM_DEPENDENCIES([OBJC])])])dnl AC_PROVIDE_IFELSE([AC_PROG_OBJCXX], [_AM_DEPENDENCIES([OBJCXX])], [m4_define([AC_PROG_OBJCXX], m4_defn([AC_PROG_OBJCXX])[_AM_DEPENDENCIES([OBJCXX])])])dnl ]) AC_REQUIRE([AM_SILENT_RULES])dnl dnl The testsuite driver may need to know about EXEEXT, so add the dnl 'am__EXEEXT' conditional if _AM_COMPILER_EXEEXT was seen. This dnl macro is hooked onto _AC_COMPILER_EXEEXT early, see below. AC_CONFIG_COMMANDS_PRE(dnl [m4_provide_if([_AM_COMPILER_EXEEXT], [AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"])])])dnl # POSIX will say in a future version that running "rm -f" with no argument # is OK; and we want to be able to make that assumption in our Makefile # recipes. So use an aggressive probe to check that the usage we want is # actually supported "in the wild" to an acceptable degree. # See automake bug#10828. # To make any issue more visible, cause the running configure to be aborted # by default if the 'rm' program in use doesn't match our expectations; the # user can still override this though. if rm -f && rm -fr && rm -rf; then : OK; else cat >&2 <<'END' Oops! Your 'rm' program seems unable to run without file operands specified on the command line, even when the '-f' option is present. This is contrary to the behaviour of most rm programs out there, and not conforming with the upcoming POSIX standard: Please tell bug-automake@gnu.org about your system, including the value of your $PATH and any error possibly output before this message. This can help us improve future automake versions. END if test x"$ACCEPT_INFERIOR_RM_PROGRAM" = x"yes"; then echo 'Configuration will proceed anyway, since you have set the' >&2 echo 'ACCEPT_INFERIOR_RM_PROGRAM variable to "yes"' >&2 echo >&2 else cat >&2 <<'END' Aborting the configuration process, to ensure you take notice of the issue. You can download and install GNU coreutils to get an 'rm' implementation that behaves properly: . If you want to complete the configuration process using your problematic 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM to "yes", and re-run configure. END AC_MSG_ERROR([Your 'rm' program is bad, sorry.]) fi fi dnl The trailing newline in this macro's definition is deliberate, for dnl backward compatibility and to allow trailing 'dnl'-style comments dnl after the AM_INIT_AUTOMAKE invocation. See automake bug#16841. ]) dnl Hook into '_AC_COMPILER_EXEEXT' early to learn its expansion. Do not dnl add the conditional right here, as _AC_COMPILER_EXEEXT may be further dnl mangled by Autoconf and run in a shell conditional statement. m4_define([_AC_COMPILER_EXEEXT], m4_defn([_AC_COMPILER_EXEEXT])[m4_provide([_AM_COMPILER_EXEEXT])]) # When config.status generates a header, we must update the stamp-h file. # This file resides in the same directory as the config header # that is generated. The stamp files are numbered to have different names. # Autoconf calls _AC_AM_CONFIG_HEADER_HOOK (when defined) in the # loop where config.status creates the headers, so we can generate # our stamp files there. AC_DEFUN([_AC_AM_CONFIG_HEADER_HOOK], [# Compute $1's index in $config_headers. _am_arg=$1 _am_stamp_count=1 for _am_header in $config_headers :; do case $_am_header in $_am_arg | $_am_arg:* ) break ;; * ) _am_stamp_count=`expr $_am_stamp_count + 1` ;; esac done echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_PROG_INSTALL_SH # ------------------ # Define $install_sh. AC_DEFUN([AM_PROG_INSTALL_SH], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; *) install_sh="\${SHELL} $am_aux_dir/install-sh" esac fi AC_SUBST([install_sh])]) # Copyright (C) 2003-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # Check whether the underlying file-system supports filenames # with a leading dot. For instance MS-DOS doesn't. AC_DEFUN([AM_SET_LEADING_DOT], [rm -rf .tst 2>/dev/null mkdir .tst 2>/dev/null if test -d .tst; then am__leading_dot=. else am__leading_dot=_ fi rmdir .tst 2>/dev/null AC_SUBST([am__leading_dot])]) # Check to see how 'make' treats includes. -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_MAKE_INCLUDE() # ----------------- # Check to see how make treats includes. AC_DEFUN([AM_MAKE_INCLUDE], [am_make=${MAKE-make} cat > confinc << 'END' am__doit: @echo this is the am__doit target .PHONY: am__doit END # If we don't find an include directive, just comment out the code. AC_MSG_CHECKING([for style of include used by $am_make]) am__include="#" am__quote= _am_result=none # First try GNU make style include. echo "include confinc" > confmf # Ignore all kinds of additional output from 'make'. case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=include am__quote= _am_result=GNU ;; esac # Now try BSD make style include. if test "$am__include" = "#"; then echo '.include "confinc"' > confmf case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=.include am__quote="\"" _am_result=BSD ;; esac fi AC_SUBST([am__include]) AC_SUBST([am__quote]) AC_MSG_RESULT([$_am_result]) rm -f confinc confmf ]) # Fake the existence of programs that GNU maintainers use. -*- Autoconf -*- # Copyright (C) 1997-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_MISSING_PROG(NAME, PROGRAM) # ------------------------------ AC_DEFUN([AM_MISSING_PROG], [AC_REQUIRE([AM_MISSING_HAS_RUN]) $1=${$1-"${am_missing_run}$2"} AC_SUBST($1)]) # AM_MISSING_HAS_RUN # ------------------ # Define MISSING if not defined so far and test if it is modern enough. # If it is, set am_missing_run to use it, otherwise, to nothing. AC_DEFUN([AM_MISSING_HAS_RUN], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl AC_REQUIRE_AUX_FILE([missing])dnl if test x"${MISSING+set}" != xset; then case $am_aux_dir in *\ * | *\ *) MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;; *) MISSING="\${SHELL} $am_aux_dir/missing" ;; esac fi # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= AC_MSG_WARN(['missing' script is too old or missing]) fi ]) # Helper functions for option handling. -*- Autoconf -*- # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_MANGLE_OPTION(NAME) # ----------------------- AC_DEFUN([_AM_MANGLE_OPTION], [[_AM_OPTION_]m4_bpatsubst($1, [[^a-zA-Z0-9_]], [_])]) # _AM_SET_OPTION(NAME) # -------------------- # Set option NAME. Presently that only means defining a flag for this option. AC_DEFUN([_AM_SET_OPTION], [m4_define(_AM_MANGLE_OPTION([$1]), [1])]) # _AM_SET_OPTIONS(OPTIONS) # ------------------------ # OPTIONS is a space-separated list of Automake options. AC_DEFUN([_AM_SET_OPTIONS], [m4_foreach_w([_AM_Option], [$1], [_AM_SET_OPTION(_AM_Option)])]) # _AM_IF_OPTION(OPTION, IF-SET, [IF-NOT-SET]) # ------------------------------------------- # Execute IF-SET if OPTION is set, IF-NOT-SET otherwise. AC_DEFUN([_AM_IF_OPTION], [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])]) # Copyright (C) 1999-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_PROG_CC_C_O # --------------- # Like AC_PROG_CC_C_O, but changed for automake. We rewrite AC_PROG_CC # to automatically call this. AC_DEFUN([_AM_PROG_CC_C_O], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl AC_REQUIRE_AUX_FILE([compile])dnl AC_LANG_PUSH([C])dnl AC_CACHE_CHECK( [whether $CC understands -c and -o together], [am_cv_prog_cc_c_o], [AC_LANG_CONFTEST([AC_LANG_PROGRAM([])]) # Make sure it works both with $CC and with simple cc. # Following AC_PROG_CC_C_O, we do the test twice because some # compilers refuse to overwrite an existing .o file with -o, # though they will create one. am_cv_prog_cc_c_o=yes for am_i in 1 2; do if AM_RUN_LOG([$CC -c conftest.$ac_ext -o conftest2.$ac_objext]) \ && test -f conftest2.$ac_objext; then : OK else am_cv_prog_cc_c_o=no break fi done rm -f core conftest* unset am_i]) if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. # FIXME: It is wrong to rewrite CC. # But if we don't then we get into trouble of one sort or another. # A longer-term fix would be to have automake use am__CC in this case, # and then we could set am__CC="\$(top_srcdir)/compile \$(CC)" CC="$am_aux_dir/compile $CC" fi AC_LANG_POP([C])]) # For backward compatibility. AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_RUN_LOG(COMMAND) # ------------------- # Run COMMAND, save the exit status in ac_status, and log it. # (This has been adapted from Autoconf's _AC_RUN_LOG macro.) AC_DEFUN([AM_RUN_LOG], [{ echo "$as_me:$LINENO: $1" >&AS_MESSAGE_LOG_FD ($1) >&AS_MESSAGE_LOG_FD 2>&AS_MESSAGE_LOG_FD ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD (exit $ac_status); }]) # Check to make sure that the build environment is sane. -*- Autoconf -*- # Copyright (C) 1996-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_SANITY_CHECK # --------------- AC_DEFUN([AM_SANITY_CHECK], [AC_MSG_CHECKING([whether build environment is sane]) # Reject unsafe characters in $srcdir or the absolute working directory # name. Accept space and tab only in the latter. am_lf=' ' case `pwd` in *[[\\\"\#\$\&\'\`$am_lf]]*) AC_MSG_ERROR([unsafe absolute working directory name]);; esac case $srcdir in *[[\\\"\#\$\&\'\`$am_lf\ \ ]]*) AC_MSG_ERROR([unsafe srcdir value: '$srcdir']);; esac # Do 'set' in a subshell so we don't clobber the current shell's # arguments. Must try -L first in case configure is actually a # symlink; some systems play weird games with the mod time of symlinks # (eg FreeBSD returns the mod time of the symlink's containing # directory). if ( am_has_slept=no for am_try in 1 2; do echo "timestamp, slept: $am_has_slept" > conftest.file set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null` if test "$[*]" = "X"; then # -L didn't work. set X `ls -t "$srcdir/configure" conftest.file` fi if test "$[*]" != "X $srcdir/configure conftest.file" \ && test "$[*]" != "X conftest.file $srcdir/configure"; then # If neither matched, then we have a broken ls. This can happen # if, for instance, CONFIG_SHELL is bash and it inherits a # broken ls alias from the environment. This has actually # happened. Such a system could not be considered "sane". AC_MSG_ERROR([ls -t appears to fail. Make sure there is not a broken alias in your environment]) fi if test "$[2]" = conftest.file || test $am_try -eq 2; then break fi # Just in case. sleep 1 am_has_slept=yes done test "$[2]" = conftest.file ) then # Ok. : else AC_MSG_ERROR([newly created file is older than distributed files! Check your system clock]) fi AC_MSG_RESULT([yes]) # If we didn't sleep, we still need to ensure time stamps of config.status and # generated files are strictly newer. am_sleep_pid= if grep 'slept: no' conftest.file >/dev/null 2>&1; then ( sleep 1 ) & am_sleep_pid=$! fi AC_CONFIG_COMMANDS_PRE( [AC_MSG_CHECKING([that generated files are newer than configure]) if test -n "$am_sleep_pid"; then # Hide warnings about reused PIDs. wait $am_sleep_pid 2>/dev/null fi AC_MSG_RESULT([done])]) rm -f conftest.file ]) # Copyright (C) 2009-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_SILENT_RULES([DEFAULT]) # -------------------------- # Enable less verbose build rules; with the default set to DEFAULT # ("yes" being less verbose, "no" or empty being verbose). AC_DEFUN([AM_SILENT_RULES], [AC_ARG_ENABLE([silent-rules], [dnl AS_HELP_STRING( [--enable-silent-rules], [less verbose build output (undo: "make V=1")]) AS_HELP_STRING( [--disable-silent-rules], [verbose build output (undo: "make V=0")])dnl ]) case $enable_silent_rules in @%:@ ((( yes) AM_DEFAULT_VERBOSITY=0;; no) AM_DEFAULT_VERBOSITY=1;; *) AM_DEFAULT_VERBOSITY=m4_if([$1], [yes], [0], [1]);; esac dnl dnl A few 'make' implementations (e.g., NonStop OS and NextStep) dnl do not support nested variable expansions. dnl See automake bug#9928 and bug#10237. am_make=${MAKE-make} AC_CACHE_CHECK([whether $am_make supports nested variables], [am_cv_make_support_nested_variables], [if AS_ECHO([['TRUE=$(BAR$(V)) BAR0=false BAR1=true V=1 am__doit: @$(TRUE) .PHONY: am__doit']]) | $am_make -f - >/dev/null 2>&1; then am_cv_make_support_nested_variables=yes else am_cv_make_support_nested_variables=no fi]) if test $am_cv_make_support_nested_variables = yes; then dnl Using '$V' instead of '$(V)' breaks IRIX make. AM_V='$(V)' AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)' else AM_V=$AM_DEFAULT_VERBOSITY AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY fi AC_SUBST([AM_V])dnl AM_SUBST_NOTMAKE([AM_V])dnl AC_SUBST([AM_DEFAULT_V])dnl AM_SUBST_NOTMAKE([AM_DEFAULT_V])dnl AC_SUBST([AM_DEFAULT_VERBOSITY])dnl AM_BACKSLASH='\' AC_SUBST([AM_BACKSLASH])dnl _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl ]) # Copyright (C) 2001-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # AM_PROG_INSTALL_STRIP # --------------------- # One issue with vendor 'install' (even GNU) is that you can't # specify the program used to strip binaries. This is especially # annoying in cross-compiling environments, where the build's strip # is unlikely to handle the host's binaries. # Fortunately install-sh will honor a STRIPPROG variable, so we # always use install-sh in "make install-strip", and initialize # STRIPPROG with the value of the STRIP variable (set by the user). AC_DEFUN([AM_PROG_INSTALL_STRIP], [AC_REQUIRE([AM_PROG_INSTALL_SH])dnl # Installed binaries are usually stripped using 'strip' when the user # run "make install-strip". However 'strip' might not be the right # tool to use in cross-compilation environments, therefore Automake # will honor the 'STRIP' environment variable to overrule this program. dnl Don't test for $cross_compiling = yes, because it might be 'maybe'. if test "$cross_compiling" != no; then AC_CHECK_TOOL([STRIP], [strip], :) fi INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" AC_SUBST([INSTALL_STRIP_PROGRAM])]) # Copyright (C) 2006-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_SUBST_NOTMAKE(VARIABLE) # --------------------------- # Prevent Automake from outputting VARIABLE = @VARIABLE@ in Makefile.in. # This macro is traced by Automake. AC_DEFUN([_AM_SUBST_NOTMAKE]) # AM_SUBST_NOTMAKE(VARIABLE) # -------------------------- # Public sister of _AM_SUBST_NOTMAKE. AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)]) # Check how to create a tarball. -*- Autoconf -*- # Copyright (C) 2004-2014 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # _AM_PROG_TAR(FORMAT) # -------------------- # Check how to create a tarball in format FORMAT. # FORMAT should be one of 'v7', 'ustar', or 'pax'. # # Substitute a variable $(am__tar) that is a command # writing to stdout a FORMAT-tarball containing the directory # $tardir. # tardir=directory && $(am__tar) > result.tar # # Substitute a variable $(am__untar) that extract such # a tarball read from stdin. # $(am__untar) < result.tar # AC_DEFUN([_AM_PROG_TAR], [# Always define AMTAR for backward compatibility. Yes, it's still used # in the wild :-( We should find a proper way to deprecate it ... AC_SUBST([AMTAR], ['$${TAR-tar}']) # We'll loop over all known methods to create a tar archive until one works. _am_tools='gnutar m4_if([$1], [ustar], [plaintar]) pax cpio none' m4_if([$1], [v7], [am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -'], [m4_case([$1], [ustar], [# The POSIX 1988 'ustar' format is defined with fixed-size fields. # There is notably a 21 bits limit for the UID and the GID. In fact, # the 'pax' utility can hang on bigger UID/GID (see automake bug#8343 # and bug#13588). am_max_uid=2097151 # 2^21 - 1 am_max_gid=$am_max_uid # The $UID and $GID variables are not portable, so we need to resort # to the POSIX-mandated id(1) utility. Errors in the 'id' calls # below are definitely unexpected, so allow the users to see them # (that is, avoid stderr redirection). am_uid=`id -u || echo unknown` am_gid=`id -g || echo unknown` AC_MSG_CHECKING([whether UID '$am_uid' is supported by ustar format]) if test $am_uid -le $am_max_uid; then AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) _am_tools=none fi AC_MSG_CHECKING([whether GID '$am_gid' is supported by ustar format]) if test $am_gid -le $am_max_gid; then AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) _am_tools=none fi], [pax], [], [m4_fatal([Unknown tar format])]) AC_MSG_CHECKING([how to create a $1 tar archive]) # Go ahead even if we have the value already cached. We do so because we # need to set the values for the 'am__tar' and 'am__untar' variables. _am_tools=${am_cv_prog_tar_$1-$_am_tools} for _am_tool in $_am_tools; do case $_am_tool in gnutar) for _am_tar in tar gnutar gtar; do AM_RUN_LOG([$_am_tar --version]) && break done am__tar="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$$tardir"' am__tar_="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$tardir"' am__untar="$_am_tar -xf -" ;; plaintar) # Must skip GNU tar: if it does not support --format= it doesn't create # ustar tarball either. (tar --version) >/dev/null 2>&1 && continue am__tar='tar chf - "$$tardir"' am__tar_='tar chf - "$tardir"' am__untar='tar xf -' ;; pax) am__tar='pax -L -x $1 -w "$$tardir"' am__tar_='pax -L -x $1 -w "$tardir"' am__untar='pax -r' ;; cpio) am__tar='find "$$tardir" -print | cpio -o -H $1 -L' am__tar_='find "$tardir" -print | cpio -o -H $1 -L' am__untar='cpio -i -H $1 -d' ;; none) am__tar=false am__tar_=false am__untar=false ;; esac # If the value was cached, stop now. We just wanted to have am__tar # and am__untar set. test -n "${am_cv_prog_tar_$1}" && break # tar/untar a dummy directory, and stop if the command works. rm -rf conftest.dir mkdir conftest.dir echo GrepMe > conftest.dir/file AM_RUN_LOG([tardir=conftest.dir && eval $am__tar_ >conftest.tar]) rm -rf conftest.dir if test -s conftest.tar; then AM_RUN_LOG([$am__untar /dev/null 2>&1 && break fi done rm -rf conftest.dir AC_CACHE_VAL([am_cv_prog_tar_$1], [am_cv_prog_tar_$1=$_am_tool]) AC_MSG_RESULT([$am_cv_prog_tar_$1])]) AC_SUBST([am__tar]) AC_SUBST([am__untar]) ]) # _AM_PROG_TAR m4_include([m4/libtool.m4]) m4_include([m4/ltoptions.m4]) m4_include([m4/ltsugar.m4]) m4_include([m4/ltversion.m4]) m4_include([m4/lt~obsolete.m4]) suricata-3.2.1/libhtp/docs/0000755000000000000000000000000013051004503012500 500000000000000suricata-3.2.1/libhtp/docs/QUICK_START0000644000000000000000000001155313051004451014203 00000000000000 QUICK START ----------- LibHTP is envisioned to be many things, but the only scenario in which it has been tested so far is that when you need to parse a duplex HTTP stream which you have obtained by passively intercepting a communication channel. The assumption is that you have raw TCP data (after SSL, if SSL is used). Every parsing operation needs to follow these steps: 1. Configure-time: 1.1. Create one or more parser configuration structures. 1.2. Tweak the configuration of each parser to match the behaviour of the server you're intercepting the communication of (htp_config_set_* functions). 1.3. Register the parser callbacks you'll need. You will need to use parser callbacks if you want to monitor parsing events as they occur, and gain access to partial transaction information. If you are processing data in batch (off-line) you may simply parse entire streams at a time and only analyze complete transaction data after the fact. If you need to gain access to request and response bodies, your only option at this time is to use the callbacks, because the parser will not preserve that information. For callback registration, look up the htp_config_register_* functions. If your program operates in real-time then it may be desirable to dispose of the used resources after each transaction is parsed. To do that, use the htp_config_set_tx_auto_destroy() function to tell LibHTP to delete transactions after they are no longer needed. 2. Run-time: 2.1. Create a parser instance for every TCP stream you want to process. 2.2. Feed the parser inbound and outbound data. The parser will typically always consume complete data chunks and return STREAM_STATE_DATA, which means that you can continue to feed it more data when you have it. If you have a queue of data chunks, always first send the parser all the _request_ chunks you have. That will ensure that the parser never encounters a response for which it had not seen a request (which would result with a fatal error). If you get STREAM_STATE_ERROR, the parser has encountered a fatal error and is unable to continue to parse the stream. An error should never happen for a valid HTTP stream. If you encounter such an error and you believe the HTTP stream is valid, please send us the PCAP file we can use to diagnose the problem. There is one situation when the parser will not be able to consume a complete request data chunk, in which case it will return STREAM_STATE_DATA_OTHER. This means that the parser needs to see some response data. You will then need to do the following: 2.2.1. Remember how many bytes of the request chunk data were consumed (using htp_connp_req_data_consumed()). 2.2.2. Suspend request parsing until you get some response data. 2.2.3. Feed some response data (when you have it) to the parser. Note that it is also possible to receive STREAM_STATE_DATA_OTHER from the response parser. If that happens, you will need to remember how many bytes were consumed using htp_connp_res_data_consumed(). 2.2.4. After each chunk of response data fed to the parser, attempt to resume request stream parsing. 2.2.5. If you again receive STREAM_STATE_DATA_OTHER go back to 2.2.3. 2.2.6. Otherwise, feed to the parser all the request data you have. This is necessary to prevent the case of the parser seeing more responses than requests (which would inevitably result with an error). 2.2.7. Send unprocessed response data from 2.2.3 (if any). 2.2.8. Continue sending request/response data as normal. The above situation should occur very rarely. 2.3. Analyze transaction data in callbacks (if you want to have access to the data as it is being produced). 2.4. Analyze transaction data after an entire TCP stream has been processed. 2.4. Destroy parser instance to free up the allocated resources. USER DATA --------- If you're using the callbacks and you need to keep state between invocations, you have two options: 1. Associate one opaque structure with a parser instance, using htp_connp_set_user_data(). 2. Associate one opaque structure with a transaction instance, using htp_tx_set_user_data(). The best place to do this is in a TRANSACTION_START callback. Don't forget to free up any resources you allocate on per-transaction basis, before you delete each transaction. suricata-3.2.1/libhtp/docs/Makefile.am0000644000000000000000000000056313051004451014462 00000000000000CLEANFILES = *.pdf clean-local: rm -rf doxygen doxygen: doxygen.conf $(DOXYGEN_DEPS) @if test -n "$(DOXYGEN)"; then \ $(DOXYGEN) $<; \ else \ echo "You need doxygen installed to build the docs."; \ fi; doxygen-pdf: doxygen doxygen.pdf doxygen.pdf: doxygen (cd doxygen/latex && make refman.pdf) && cp doxygen/latex/refman.pdf doxygen.pdf .PHONY: doxygen-pdf suricata-3.2.1/libhtp/docs/doxygen.conf0000644000000000000000000015624313051004451014761 00000000000000# Doxyfile 1.5.5 # This file describes the settings to be used by the documentation system # doxygen (www.doxygen.org) for a project # # All text after a hash (#) is considered a comment and will be ignored # The format is: # TAG = value [value, ...] # For lists items can also be appended using: # TAG += value [value, ...] # Values that contain spaces should be placed between quotes (" ") #--------------------------------------------------------------------------- # Project related configuration options #--------------------------------------------------------------------------- # This tag specifies the encoding used for all characters in the config file # that follow. The default is UTF-8 which is also the encoding used for all # text before the first occurrence of this tag. Doxygen uses libiconv (or the # iconv built into libc) for the transcoding. See # http://www.gnu.org/software/libiconv for the list of possible encodings. DOXYFILE_ENCODING = UTF-8 # The PROJECT_NAME tag is a single word (or a sequence of words surrounded # by quotes) that should identify the project. PROJECT_NAME = HTP # The PROJECT_NUMBER tag can be used to enter a project or revision number. # This could be handy for archiving the generated documentation or # if some version control system is used. PROJECT_NUMBER = 0.5 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. # If a relative path is entered, it will be relative to the location # where doxygen was started. If left blank the current directory will be used. OUTPUT_DIRECTORY = doxygen/ # If the CREATE_SUBDIRS tag is set to YES, then doxygen will create # 4096 sub-directories (in 2 levels) under the output directory of each output # format and will distribute the generated files over these directories. # Enabling this option can be useful when feeding doxygen a huge amount of # source files, where putting all generated files in the same directory would # otherwise cause performance problems for the file system. CREATE_SUBDIRS = NO # The OUTPUT_LANGUAGE tag is used to specify the language in which all # documentation generated by doxygen is written. Doxygen will use this # information to generate all constant output in the proper language. # The default language is English, other supported languages are: # Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional, # Croatian, Czech, Danish, Dutch, Farsi, Finnish, French, German, Greek, # Hungarian, Italian, Japanese, Japanese-en (Japanese with English messages), # Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian, Polish, # Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, Swedish, # and Ukrainian. OUTPUT_LANGUAGE = English # If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will # include brief member descriptions after the members that are listed in # the file and class documentation (similar to JavaDoc). # Set to NO to disable this. BRIEF_MEMBER_DESC = YES # If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend # the brief description of a member or function before the detailed description. # Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the # brief descriptions will be completely suppressed. REPEAT_BRIEF = YES # This tag implements a quasi-intelligent brief description abbreviator # that is used to form the text in various listings. Each string # in this list, if found as the leading text of the brief description, will be # stripped from the text and the result after processing the whole list, is # used as the annotated text. Otherwise, the brief description is used as-is. # If left blank, the following values are used ("$name" is automatically # replaced with the name of the entity): "The $name class" "The $name widget" # "The $name file" "is" "provides" "specifies" "contains" # "represents" "a" "an" "the" ABBREVIATE_BRIEF = # If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then # Doxygen will generate a detailed section even if there is only a brief # description. ALWAYS_DETAILED_SEC = NO # If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all # inherited members of a class in the documentation of that class as if those # members were ordinary class members. Constructors, destructors and assignment # operators of the base classes will not be shown. INLINE_INHERITED_MEMB = NO # If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full # path before files name in the file list and in the header files. If set # to NO the shortest path that makes the file name unique will be used. FULL_PATH_NAMES = NO # If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag # can be used to strip a user-defined part of the path. Stripping is # only done if one of the specified strings matches the left-hand part of # the path. The tag can be used to show relative paths in the file list. # If left blank the directory from which doxygen is run is used as the # path to strip. STRIP_FROM_PATH = # The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of # the path mentioned in the documentation of a class, which tells # the reader which header file to include in order to use a class. # If left blank only the name of the header file containing the class # definition is used. Otherwise one should specify the include paths that # are normally passed to the compiler using the -I flag. STRIP_FROM_INC_PATH = # If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter # (but less readable) file names. This can be useful is your file systems # doesn't support long names like on DOS, Mac, or CD-ROM. SHORT_NAMES = NO # If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen # will interpret the first line (until the first dot) of a JavaDoc-style # comment as the brief description. If set to NO, the JavaDoc # comments will behave just like regular Qt-style comments # (thus requiring an explicit @brief command for a brief description.) JAVADOC_AUTOBRIEF = NO # If the QT_AUTOBRIEF tag is set to YES then Doxygen will # interpret the first line (until the first dot) of a Qt-style # comment as the brief description. If set to NO, the comments # will behave just like regular Qt-style comments (thus requiring # an explicit \brief command for a brief description.) QT_AUTOBRIEF = NO # The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen # treat a multi-line C++ special comment block (i.e. a block of //! or /// # comments) as a brief description. This used to be the default behaviour. # The new default is to treat a multi-line C++ comment block as a detailed # description. Set this tag to YES if you prefer the old behaviour instead. MULTILINE_CPP_IS_BRIEF = NO # If the DETAILS_AT_TOP tag is set to YES then Doxygen # will output the detailed description near the top, like JavaDoc. # If set to NO, the detailed description appears after the member # documentation. DETAILS_AT_TOP = NO # If the INHERIT_DOCS tag is set to YES (the default) then an undocumented # member inherits the documentation from any documented member that it # re-implements. INHERIT_DOCS = YES # If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce # a new page for each member. If set to NO, the documentation of a member will # be part of the file/class/namespace that contains it. SEPARATE_MEMBER_PAGES = NO # The TAB_SIZE tag can be used to set the number of spaces in a tab. # Doxygen uses this value to replace tabs by spaces in code fragments. TAB_SIZE = 4 # This tag can be used to specify a number of aliases that acts # as commands in the documentation. An alias has the form "name=value". # For example adding "sideeffect=\par Side Effects:\n" will allow you to # put the command \sideeffect (or @sideeffect) in the documentation, which # will result in a user-defined paragraph with heading "Side Effects:". # You can put \n's in the value part of an alias to insert newlines. ALIASES = # Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C # sources only. Doxygen will then generate output that is more tailored for C. # For instance, some of the names that are used will be different. The list # of all members will be omitted, etc. OPTIMIZE_OUTPUT_FOR_C = YES # Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java # sources only. Doxygen will then generate output that is more tailored for # Java. For instance, namespaces will be presented as packages, qualified # scopes will look different, etc. OPTIMIZE_OUTPUT_JAVA = NO # Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran # sources only. Doxygen will then generate output that is more tailored for # Fortran. OPTIMIZE_FOR_FORTRAN = NO # Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL # sources. Doxygen will then generate output that is tailored for # VHDL. OPTIMIZE_OUTPUT_VHDL = NO # If you use STL classes (i.e. std::string, std::vector, etc.) but do not want # to include (a tag file for) the STL sources as input, then you should # set this tag to YES in order to let doxygen match functions declarations and # definitions whose arguments contain STL classes (e.g. func(std::string); v.s. # func(std::string) {}). This also make the inheritance and collaboration # diagrams that involve STL classes more complete and accurate. BUILTIN_STL_SUPPORT = NO # If you use Microsoft's C++/CLI language, you should set this option to YES to # enable parsing support. CPP_CLI_SUPPORT = NO # Set the SIP_SUPPORT tag to YES if your project consists of sip sources only. # Doxygen will parse them like normal C++ but will assume all classes use public # instead of private inheritance when no explicit protection keyword is present. SIP_SUPPORT = NO # If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC # tag is set to YES, then doxygen will reuse the documentation of the first # member in the group (if any) for the other members of the group. By default # all members of a group must be documented explicitly. DISTRIBUTE_GROUP_DOC = NO # Set the SUBGROUPING tag to YES (the default) to allow class member groups of # the same type (for instance a group of public functions) to be put as a # subgroup of that type (e.g. under the Public Functions section). Set it to # NO to prevent subgrouping. Alternatively, this can be done per class using # the \nosubgrouping command. SUBGROUPING = YES # When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum # is documented as struct, union, or enum with the name of the typedef. So # typedef struct TypeS {} TypeT, will appear in the documentation as a struct # with name TypeT. When disabled the typedef will appear as a member of a file, # namespace, or class. And the struct will be named TypeS. This can typically # be useful for C code in case the coding convention dictates that all compound # types are typedef'ed and only the typedef is referenced, never the tag name. TYPEDEF_HIDES_STRUCT = NO #--------------------------------------------------------------------------- # Build related configuration options #--------------------------------------------------------------------------- # If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in # documentation are documented, even if no documentation was available. # Private class members and static file members will be hidden unless # the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES EXTRACT_ALL = YES # If the EXTRACT_PRIVATE tag is set to YES all private members of a class # will be included in the documentation. EXTRACT_PRIVATE = NO # If the EXTRACT_STATIC tag is set to YES all static members of a file # will be included in the documentation. EXTRACT_STATIC = NO # If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) # defined locally in source files will be included in the documentation. # If set to NO only classes defined in header files are included. EXTRACT_LOCAL_CLASSES = YES # This flag is only useful for Objective-C code. When set to YES local # methods, which are defined in the implementation section but not in # the interface are included in the documentation. # If set to NO (the default) only methods in the interface are included. EXTRACT_LOCAL_METHODS = NO # If this flag is set to YES, the members of anonymous namespaces will be # extracted and appear in the documentation as a namespace called # 'anonymous_namespace{file}', where file will be replaced with the base # name of the file that contains the anonymous namespace. By default # anonymous namespace are hidden. EXTRACT_ANON_NSPACES = NO # If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all # undocumented members of documented classes, files or namespaces. # If set to NO (the default) these members will be included in the # various overviews, but no documentation section is generated. # This option has no effect if EXTRACT_ALL is enabled. HIDE_UNDOC_MEMBERS = NO # If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all # undocumented classes that are normally visible in the class hierarchy. # If set to NO (the default) these classes will be included in the various # overviews. This option has no effect if EXTRACT_ALL is enabled. HIDE_UNDOC_CLASSES = NO # If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all # friend (class|struct|union) declarations. # If set to NO (the default) these declarations will be included in the # documentation. HIDE_FRIEND_COMPOUNDS = NO # If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any # documentation blocks found inside the body of a function. # If set to NO (the default) these blocks will be appended to the # function's detailed documentation block. HIDE_IN_BODY_DOCS = NO # The INTERNAL_DOCS tag determines if documentation # that is typed after a \internal command is included. If the tag is set # to NO (the default) then the documentation will be excluded. # Set it to YES to include the internal documentation. INTERNAL_DOCS = NO # If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate # file names in lower-case letters. If set to YES upper-case letters are also # allowed. This is useful if you have classes or files whose names only differ # in case and if your file system supports case sensitive file names. Windows # and Mac users are advised to set this option to NO. CASE_SENSE_NAMES = YES # If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen # will show members with their full class and namespace scopes in the # documentation. If set to YES the scope will be hidden. HIDE_SCOPE_NAMES = NO # If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen # will put a list of the files that are included by a file in the documentation # of that file. SHOW_INCLUDE_FILES = YES # If the INLINE_INFO tag is set to YES (the default) then a tag [inline] # is inserted in the documentation for inline members. INLINE_INFO = YES # If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen # will sort the (detailed) documentation of file and class members # alphabetically by member name. If set to NO the members will appear in # declaration order. SORT_MEMBER_DOCS = YES # If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the # brief documentation of file, namespace and class members alphabetically # by member name. If set to NO (the default) the members will appear in # declaration order. SORT_BRIEF_DOCS = NO # If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the # hierarchy of group names into alphabetical order. If set to NO (the default) # the group names will appear in their defined order. SORT_GROUP_NAMES = NO # If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be # sorted by fully-qualified names, including namespaces. If set to # NO (the default), the class list will be sorted only by class name, # not including the namespace part. # Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. # Note: This option applies only to the class list, not to the # alphabetical list. SORT_BY_SCOPE_NAME = NO # The GENERATE_TODOLIST tag can be used to enable (YES) or # disable (NO) the todo list. This list is created by putting \todo # commands in the documentation. GENERATE_TODOLIST = YES # The GENERATE_TESTLIST tag can be used to enable (YES) or # disable (NO) the test list. This list is created by putting \test # commands in the documentation. GENERATE_TESTLIST = YES # The GENERATE_BUGLIST tag can be used to enable (YES) or # disable (NO) the bug list. This list is created by putting \bug # commands in the documentation. GENERATE_BUGLIST = YES # The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or # disable (NO) the deprecated list. This list is created by putting # \deprecated commands in the documentation. GENERATE_DEPRECATEDLIST= YES # The ENABLED_SECTIONS tag can be used to enable conditional # documentation sections, marked by \if sectionname ... \endif. ENABLED_SECTIONS = # The MAX_INITIALIZER_LINES tag determines the maximum number of lines # the initial value of a variable or define consists of for it to appear in # the documentation. If the initializer consists of more lines than specified # here it will be hidden. Use a value of 0 to hide initializers completely. # The appearance of the initializer of individual variables and defines in the # documentation can be controlled using \showinitializer or \hideinitializer # command in the documentation regardless of this setting. MAX_INITIALIZER_LINES = 30 # Set the SHOW_USED_FILES tag to NO to disable the list of files generated # at the bottom of the documentation of classes and structs. If set to YES the # list will mention the files that were used to generate the documentation. SHOW_USED_FILES = YES # If the sources in your project are distributed over multiple directories # then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy # in the documentation. The default is NO. SHOW_DIRECTORIES = NO # The FILE_VERSION_FILTER tag can be used to specify a program or script that # doxygen should invoke to get the current version for each file (typically from # the version control system). Doxygen will invoke the program by executing (via # popen()) the command , where is the value of # the FILE_VERSION_FILTER tag, and is the name of an input file # provided by doxygen. Whatever the program writes to standard output # is used as the file version. See the manual for examples. FILE_VERSION_FILTER = #--------------------------------------------------------------------------- # configuration options related to warning and progress messages #--------------------------------------------------------------------------- # The QUIET tag can be used to turn on/off the messages that are generated # by doxygen. Possible values are YES and NO. If left blank NO is used. QUIET = NO # The WARNINGS tag can be used to turn on/off the warning messages that are # generated by doxygen. Possible values are YES and NO. If left blank # NO is used. WARNINGS = YES # If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings # for undocumented members. If EXTRACT_ALL is set to YES then this flag will # automatically be disabled. WARN_IF_UNDOCUMENTED = YES # If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for # potential errors in the documentation, such as not documenting some # parameters in a documented function, or documenting parameters that # don't exist or using markup commands wrongly. WARN_IF_DOC_ERROR = YES # This WARN_NO_PARAMDOC option can be abled to get warnings for # functions that are documented, but have no documentation for their parameters # or return value. If set to NO (the default) doxygen will only warn about # wrong or incomplete parameter documentation, but not about the absence of # documentation. WARN_NO_PARAMDOC = NO # The WARN_FORMAT tag determines the format of the warning messages that # doxygen can produce. The string should contain the $file, $line, and $text # tags, which will be replaced by the file and line number from which the # warning originated and the warning text. Optionally the format may contain # $version, which will be replaced by the version of the file (if it could # be obtained via FILE_VERSION_FILTER) WARN_FORMAT = "$file:$line: $text" # The WARN_LOGFILE tag can be used to specify a file to which warning # and error messages should be written. If left blank the output is written # to stderr. WARN_LOGFILE = #--------------------------------------------------------------------------- # configuration options related to the input files #--------------------------------------------------------------------------- # The INPUT tag can be used to specify the files and/or directories that contain # documented source files. You may enter file names like "myfile.cpp" or # directories like "/usr/src/myproject". Separate the files or directories # with spaces. INPUT = ../htp # This tag can be used to specify the character encoding of the source files # that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is # also the default input encoding. Doxygen uses libiconv (or the iconv built # into libc) for the transcoding. See http://www.gnu.org/software/libiconv for # the list of possible encodings. INPUT_ENCODING = UTF-8 # If the value of the INPUT tag contains directories, you can use the # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp # and *.h) to filter out the source-files in the directories. If left # blank the following patterns are tested: # *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx # *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py *.f90 FILE_PATTERNS = *.c *.h # The RECURSIVE tag can be used to turn specify whether or not subdirectories # should be searched for input files as well. Possible values are YES and NO. # If left blank NO is used. RECURSIVE = NO # The EXCLUDE tag can be used to specify files and/or directories that should # excluded from the INPUT source files. This way you can easily exclude a # subdirectory from a directory tree whose root is specified with the INPUT tag. EXCLUDE = # The EXCLUDE_SYMLINKS tag can be used select whether or not files or # directories that are symbolic links (a Unix filesystem feature) are excluded # from the input. EXCLUDE_SYMLINKS = NO # If the value of the INPUT tag contains directories, you can use the # EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude # certain files from those directories. Note that the wildcards are matched # against the file with absolute path, so to exclude all test directories # for example use the pattern */test/* EXCLUDE_PATTERNS = # The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names # (namespaces, classes, functions, etc.) that should be excluded from the # output. The symbol name can be a fully qualified name, a word, or if the # wildcard * is used, a substring. Examples: ANamespace, AClass, # AClass::ANamespace, ANamespace::*Test EXCLUDE_SYMBOLS = # The EXAMPLE_PATH tag can be used to specify one or more files or # directories that contain example code fragments that are included (see # the \include command). EXAMPLE_PATH = # If the value of the EXAMPLE_PATH tag contains directories, you can use the # EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp # and *.h) to filter out the source-files in the directories. If left # blank all files are included. EXAMPLE_PATTERNS = # If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be # searched for input files to be used with the \include or \dontinclude # commands irrespective of the value of the RECURSIVE tag. # Possible values are YES and NO. If left blank NO is used. EXAMPLE_RECURSIVE = NO # The IMAGE_PATH tag can be used to specify one or more files or # directories that contain image that are included in the documentation (see # the \image command). IMAGE_PATH = # The INPUT_FILTER tag can be used to specify a program that doxygen should # invoke to filter for each input file. Doxygen will invoke the filter program # by executing (via popen()) the command , where # is the value of the INPUT_FILTER tag, and is the name of an # input file. Doxygen will then use the output that the filter program writes # to standard output. If FILTER_PATTERNS is specified, this tag will be # ignored. INPUT_FILTER = # The FILTER_PATTERNS tag can be used to specify filters on a per file pattern # basis. Doxygen will compare the file name with each pattern and apply the # filter if there is a match. The filters are a list of the form: # pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further # info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER # is applied to all files. FILTER_PATTERNS = # If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using # INPUT_FILTER) will be used to filter the input files when producing source # files to browse (i.e. when SOURCE_BROWSER is set to YES). FILTER_SOURCE_FILES = NO #--------------------------------------------------------------------------- # configuration options related to source browsing #--------------------------------------------------------------------------- # If the SOURCE_BROWSER tag is set to YES then a list of source files will # be generated. Documented entities will be cross-referenced with these sources. # Note: To get rid of all source code in the generated output, make sure also # VERBATIM_HEADERS is set to NO. SOURCE_BROWSER = NO # Setting the INLINE_SOURCES tag to YES will include the body # of functions and classes directly in the documentation. INLINE_SOURCES = NO # Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct # doxygen to hide any special comment blocks from generated source code # fragments. Normal C and C++ comments will always remain visible. STRIP_CODE_COMMENTS = YES # If the REFERENCED_BY_RELATION tag is set to YES (the default) # then for each documented function all documented # functions referencing it will be listed. REFERENCED_BY_RELATION = NO # If the REFERENCES_RELATION tag is set to YES (the default) # then for each documented function all documented entities # called/used by that function will be listed. REFERENCES_RELATION = NO # If the REFERENCES_LINK_SOURCE tag is set to YES (the default) # and SOURCE_BROWSER tag is set to YES, then the hyperlinks from # functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will # link to the source code. Otherwise they will link to the documentstion. REFERENCES_LINK_SOURCE = YES # If the USE_HTAGS tag is set to YES then the references to source code # will point to the HTML generated by the htags(1) tool instead of doxygen # built-in source browser. The htags tool is part of GNU's global source # tagging system (see http://www.gnu.org/software/global/global.html). You # will need version 4.8.6 or higher. USE_HTAGS = NO # If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen # will generate a verbatim copy of the header file for each class for # which an include is specified. Set to NO to disable this. VERBATIM_HEADERS = YES #--------------------------------------------------------------------------- # configuration options related to the alphabetical class index #--------------------------------------------------------------------------- # If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index # of all compounds will be generated. Enable this if the project # contains a lot of classes, structs, unions or interfaces. ALPHABETICAL_INDEX = NO # If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then # the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns # in which this list will be split (can be a number in the range [1..20]) COLS_IN_ALPHA_INDEX = 5 # In case all classes in a project start with a common prefix, all # classes will be put under the same header in the alphabetical index. # The IGNORE_PREFIX tag can be used to specify one or more prefixes that # should be ignored while generating the index headers. IGNORE_PREFIX = #--------------------------------------------------------------------------- # configuration options related to the HTML output #--------------------------------------------------------------------------- # If the GENERATE_HTML tag is set to YES (the default) Doxygen will # generate HTML output. GENERATE_HTML = YES # The HTML_OUTPUT tag is used to specify where the HTML docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `html' will be used as the default path. HTML_OUTPUT = ./ # The HTML_FILE_EXTENSION tag can be used to specify the file extension for # each generated HTML page (for example: .htm,.php,.asp). If it is left blank # doxygen will generate files with .html extension. HTML_FILE_EXTENSION = .html # The HTML_HEADER tag can be used to specify a personal HTML header for # each generated HTML page. If it is left blank doxygen will generate a # standard header. HTML_HEADER = # The HTML_FOOTER tag can be used to specify a personal HTML footer for # each generated HTML page. If it is left blank doxygen will generate a # standard footer. HTML_FOOTER = # The HTML_STYLESHEET tag can be used to specify a user-defined cascading # style sheet that is used by each HTML page. It can be used to # fine-tune the look of the HTML output. If the tag is left blank doxygen # will generate a default style sheet. Note that doxygen will try to copy # the style sheet file to the HTML output directory, so don't put your own # stylesheet in the HTML output directory as well, or it will be erased! HTML_STYLESHEET = # If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, # files or namespaces will be aligned in HTML using tables. If set to # NO a bullet list will be used. HTML_ALIGN_MEMBERS = YES # If the GENERATE_HTMLHELP tag is set to YES, additional index files # will be generated that can be used as input for tools like the # Microsoft HTML help workshop to generate a compiled HTML help file (.chm) # of the generated HTML documentation. GENERATE_HTMLHELP = NO # If the GENERATE_DOCSET tag is set to YES, additional index files # will be generated that can be used as input for Apple's Xcode 3 # integrated development environment, introduced with OSX 10.5 (Leopard). # To create a documentation set, doxygen will generate a Makefile in the # HTML output directory. Running make will produce the docset in that # directory and running "make install" will install the docset in # ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find # it at startup. GENERATE_DOCSET = NO # When GENERATE_DOCSET tag is set to YES, this tag determines the name of the # feed. A documentation feed provides an umbrella under which multiple # documentation sets from a single provider (such as a company or product suite) # can be grouped. DOCSET_FEEDNAME = "Doxygen generated docs" # When GENERATE_DOCSET tag is set to YES, this tag specifies a string that # should uniquely identify the documentation set bundle. This should be a # reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen # will append .docset to the name. DOCSET_BUNDLE_ID = org.doxygen.Project # If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML # documentation will contain sections that can be hidden and shown after the # page has loaded. For this to work a browser that supports # JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox # Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari). HTML_DYNAMIC_SECTIONS = NO # If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can # be used to specify the file name of the resulting .chm file. You # can add a path in front of the file if the result should not be # written to the html output directory. CHM_FILE = # If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can # be used to specify the location (absolute path including file name) of # the HTML help compiler (hhc.exe). If non-empty doxygen will try to run # the HTML help compiler on the generated index.hhp. HHC_LOCATION = # If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag # controls if a separate .chi index file is generated (YES) or that # it should be included in the master .chm file (NO). GENERATE_CHI = NO # If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag # controls whether a binary table of contents is generated (YES) or a # normal table of contents (NO) in the .chm file. BINARY_TOC = NO # The TOC_EXPAND flag can be set to YES to add extra items for group members # to the contents of the HTML help documentation and to the tree view. TOC_EXPAND = NO # The DISABLE_INDEX tag can be used to turn on/off the condensed index at # top of each HTML page. The value NO (the default) enables the index and # the value YES disables it. DISABLE_INDEX = NO # This tag can be used to set the number of enum values (range [1..20]) # that doxygen will group on one line in the generated HTML documentation. ENUM_VALUES_PER_LINE = 4 # If the GENERATE_TREEVIEW tag is set to YES, a side panel will be # generated containing a tree-like index structure (just like the one that # is generated for HTML Help). For this to work a browser that supports # JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, # Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are # probably better off using the HTML help feature. GENERATE_TREEVIEW = NO # If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be # used to set the initial width (in pixels) of the frame in which the tree # is shown. TREEVIEW_WIDTH = 250 #--------------------------------------------------------------------------- # configuration options related to the LaTeX output #--------------------------------------------------------------------------- # If the GENERATE_LATEX tag is set to YES (the default) Doxygen will # generate Latex output. GENERATE_LATEX = YES # The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `latex' will be used as the default path. LATEX_OUTPUT = latex # The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be # invoked. If left blank `latex' will be used as the default command name. LATEX_CMD_NAME = latex # The MAKEINDEX_CMD_NAME tag can be used to specify the command name to # generate index for LaTeX. If left blank `makeindex' will be used as the # default command name. MAKEINDEX_CMD_NAME = makeindex # If the COMPACT_LATEX tag is set to YES Doxygen generates more compact # LaTeX documents. This may be useful for small projects and may help to # save some trees in general. COMPACT_LATEX = NO # The PAPER_TYPE tag can be used to set the paper type that is used # by the printer. Possible values are: a4, a4wide, letter, legal and # executive. If left blank a4wide will be used. PAPER_TYPE = letter # The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX # packages that should be included in the LaTeX output. EXTRA_PACKAGES = # The LATEX_HEADER tag can be used to specify a personal LaTeX header for # the generated latex document. The header should contain everything until # the first chapter. If it is left blank doxygen will generate a # standard header. Notice: only use this tag if you know what you are doing! LATEX_HEADER = # If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated # is prepared for conversion to pdf (using ps2pdf). The pdf file will # contain links (just like the HTML output) instead of page references # This makes the output suitable for online browsing using a pdf viewer. PDF_HYPERLINKS = YES # If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of # plain latex in the generated Makefile. Set this option to YES to get a # higher quality PDF documentation. USE_PDFLATEX = YES # If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. # command to the generated LaTeX files. This will instruct LaTeX to keep # running if errors occur, instead of asking the user for help. # This option is also used when generating formulas in HTML. LATEX_BATCHMODE = NO # If LATEX_HIDE_INDICES is set to YES then doxygen will not # include the index chapters (such as File Index, Compound Index, etc.) # in the output. LATEX_HIDE_INDICES = NO #--------------------------------------------------------------------------- # configuration options related to the RTF output #--------------------------------------------------------------------------- # If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output # The RTF output is optimized for Word 97 and may not look very pretty with # other RTF readers or editors. GENERATE_RTF = NO # The RTF_OUTPUT tag is used to specify where the RTF docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `rtf' will be used as the default path. RTF_OUTPUT = rtf # If the COMPACT_RTF tag is set to YES Doxygen generates more compact # RTF documents. This may be useful for small projects and may help to # save some trees in general. COMPACT_RTF = NO # If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated # will contain hyperlink fields. The RTF file will # contain links (just like the HTML output) instead of page references. # This makes the output suitable for online browsing using WORD or other # programs which support those fields. # Note: wordpad (write) and others do not support links. RTF_HYPERLINKS = NO # Load stylesheet definitions from file. Syntax is similar to doxygen's # config file, i.e. a series of assignments. You only have to provide # replacements, missing definitions are set to their default value. RTF_STYLESHEET_FILE = # Set optional variables used in the generation of an rtf document. # Syntax is similar to doxygen's config file. RTF_EXTENSIONS_FILE = #--------------------------------------------------------------------------- # configuration options related to the man page output #--------------------------------------------------------------------------- # If the GENERATE_MAN tag is set to YES (the default) Doxygen will # generate man pages GENERATE_MAN = NO # The MAN_OUTPUT tag is used to specify where the man pages will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `man' will be used as the default path. MAN_OUTPUT = man # The MAN_EXTENSION tag determines the extension that is added to # the generated man pages (default is the subroutine's section .3) MAN_EXTENSION = .3 # If the MAN_LINKS tag is set to YES and Doxygen generates man output, # then it will generate one additional man file for each entity # documented in the real man page(s). These additional files # only source the real man page, but without them the man command # would be unable to find the correct page. The default is NO. MAN_LINKS = NO #--------------------------------------------------------------------------- # configuration options related to the XML output #--------------------------------------------------------------------------- # If the GENERATE_XML tag is set to YES Doxygen will # generate an XML file that captures the structure of # the code including all documentation. GENERATE_XML = NO # The XML_OUTPUT tag is used to specify where the XML pages will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `xml' will be used as the default path. XML_OUTPUT = xml # The XML_SCHEMA tag can be used to specify an XML schema, # which can be used by a validating XML parser to check the # syntax of the XML files. XML_SCHEMA = # The XML_DTD tag can be used to specify an XML DTD, # which can be used by a validating XML parser to check the # syntax of the XML files. XML_DTD = # If the XML_PROGRAMLISTING tag is set to YES Doxygen will # dump the program listings (including syntax highlighting # and cross-referencing information) to the XML output. Note that # enabling this will significantly increase the size of the XML output. XML_PROGRAMLISTING = YES #--------------------------------------------------------------------------- # configuration options for the AutoGen Definitions output #--------------------------------------------------------------------------- # If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will # generate an AutoGen Definitions (see autogen.sf.net) file # that captures the structure of the code including all # documentation. Note that this feature is still experimental # and incomplete at the moment. GENERATE_AUTOGEN_DEF = NO #--------------------------------------------------------------------------- # configuration options related to the Perl module output #--------------------------------------------------------------------------- # If the GENERATE_PERLMOD tag is set to YES Doxygen will # generate a Perl module file that captures the structure of # the code including all documentation. Note that this # feature is still experimental and incomplete at the # moment. GENERATE_PERLMOD = NO # If the PERLMOD_LATEX tag is set to YES Doxygen will generate # the necessary Makefile rules, Perl scripts and LaTeX code to be able # to generate PDF and DVI output from the Perl module output. PERLMOD_LATEX = NO # If the PERLMOD_PRETTY tag is set to YES the Perl module output will be # nicely formatted so it can be parsed by a human reader. This is useful # if you want to understand what is going on. On the other hand, if this # tag is set to NO the size of the Perl module output will be much smaller # and Perl will parse it just the same. PERLMOD_PRETTY = YES # The names of the make variables in the generated doxyrules.make file # are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. # This is useful so different doxyrules.make files included by the same # Makefile don't overwrite each other's variables. PERLMOD_MAKEVAR_PREFIX = #--------------------------------------------------------------------------- # Configuration options related to the preprocessor #--------------------------------------------------------------------------- # If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will # evaluate all C-preprocessor directives found in the sources and include # files. ENABLE_PREPROCESSING = YES # If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro # names in the source code. If set to NO (the default) only conditional # compilation will be performed. Macro expansion can be done in a controlled # way by setting EXPAND_ONLY_PREDEF to YES. MACRO_EXPANSION = NO # If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES # then the macro expansion is limited to the macros specified with the # PREDEFINED and EXPAND_AS_DEFINED tags. EXPAND_ONLY_PREDEF = NO # If the SEARCH_INCLUDES tag is set to YES (the default) the includes files # in the INCLUDE_PATH (see below) will be search if a #include is found. SEARCH_INCLUDES = YES # The INCLUDE_PATH tag can be used to specify one or more directories that # contain include files that are not input files but should be processed by # the preprocessor. INCLUDE_PATH = # You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard # patterns (like *.h and *.hpp) to filter out the header-files in the # directories. If left blank, the patterns specified with FILE_PATTERNS will # be used. INCLUDE_FILE_PATTERNS = # The PREDEFINED tag can be used to specify one or more macro names that # are defined before the preprocessor is started (similar to the -D option of # gcc). The argument of the tag is a list of macros of the form: name # or name=definition (no spaces). If the definition and the = are # omitted =1 is assumed. To prevent a macro definition from being # undefined via #undef or recursively expanded use the := operator # instead of the = operator. PREDEFINED = # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then # this tag can be used to specify a list of macro names that should be expanded. # The macro definition that is found in the sources will be used. # Use the PREDEFINED tag if you want to use a different macro definition. EXPAND_AS_DEFINED = # If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then # doxygen's preprocessor will remove all function-like macros that are alone # on a line, have an all uppercase name, and do not end with a semicolon. Such # function macros are typically used for boiler-plate code, and will confuse # the parser if not removed. SKIP_FUNCTION_MACROS = YES #--------------------------------------------------------------------------- # Configuration::additions related to external references #--------------------------------------------------------------------------- # The TAGFILES option can be used to specify one or more tagfiles. # Optionally an initial location of the external documentation # can be added for each tagfile. The format of a tag file without # this location is as follows: # TAGFILES = file1 file2 ... # Adding location for the tag files is done as follows: # TAGFILES = file1=loc1 "file2 = loc2" ... # where "loc1" and "loc2" can be relative or absolute paths or # URLs. If a location is present for each tag, the installdox tool # does not have to be run to correct the links. # Note that each tag file must have a unique name # (where the name does NOT include the path) # If a tag file is not located in the directory in which doxygen # is run, you must also specify the path to the tagfile here. TAGFILES = # When a file name is specified after GENERATE_TAGFILE, doxygen will create # a tag file that is based on the input files it reads. GENERATE_TAGFILE = # If the ALLEXTERNALS tag is set to YES all external classes will be listed # in the class index. If set to NO only the inherited external classes # will be listed. ALLEXTERNALS = NO # If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed # in the modules index. If set to NO, only the current project's groups will # be listed. EXTERNAL_GROUPS = YES # The PERL_PATH should be the absolute path and name of the perl script # interpreter (i.e. the result of `which perl'). PERL_PATH = /usr/bin/perl #--------------------------------------------------------------------------- # Configuration options related to the dot tool #--------------------------------------------------------------------------- # If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will # generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base # or super classes. Setting the tag to NO turns the diagrams off. Note that # this option is superseded by the HAVE_DOT option below. This is only a # fallback. It is recommended to install and use dot, since it yields more # powerful graphs. CLASS_DIAGRAMS = NO # You can define message sequence charts within doxygen comments using the \msc # command. Doxygen will then run the mscgen tool (see # http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the # documentation. The MSCGEN_PATH tag allows you to specify the directory where # the mscgen tool resides. If left empty the tool is assumed to be found in the # default search path. MSCGEN_PATH = # If set to YES, the inheritance and collaboration graphs will hide # inheritance and usage relations if the target is undocumented # or is not a class. HIDE_UNDOC_RELATIONS = YES # If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is # available from the path. This tool is part of Graphviz, a graph visualization # toolkit from AT&T and Lucent Bell Labs. The other options in this section # have no effect if this option is set to NO (the default) HAVE_DOT = NO # If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen # will generate a graph for each documented class showing the direct and # indirect inheritance relations. Setting this tag to YES will force the # the CLASS_DIAGRAMS tag to NO. CLASS_GRAPH = NO # If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen # will generate a graph for each documented class showing the direct and # indirect implementation dependencies (inheritance, containment, and # class references variables) of the class with other documented classes. COLLABORATION_GRAPH = NO # If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen # will generate a graph for groups, showing the direct groups dependencies GROUP_GRAPHS = NO # If the UML_LOOK tag is set to YES doxygen will generate inheritance and # collaboration diagrams in a style similar to the OMG's Unified Modeling # Language. UML_LOOK = NO # If set to YES, the inheritance and collaboration graphs will show the # relations between templates and their instances. TEMPLATE_RELATIONS = NO # If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT # tags are set to YES then doxygen will generate a graph for each documented # file showing the direct and indirect include dependencies of the file with # other documented files. INCLUDE_GRAPH = NO # If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and # HAVE_DOT tags are set to YES then doxygen will generate a graph for each # documented header file showing the documented files that directly or # indirectly include this file. INCLUDED_BY_GRAPH = NO # If the CALL_GRAPH and HAVE_DOT options are set to YES then # doxygen will generate a call dependency graph for every global function # or class method. Note that enabling this option will significantly increase # the time of a run. So in most cases it will be better to enable call graphs # for selected functions only using the \callgraph command. CALL_GRAPH = NO # If the CALLER_GRAPH and HAVE_DOT tags are set to YES then # doxygen will generate a caller dependency graph for every global function # or class method. Note that enabling this option will significantly increase # the time of a run. So in most cases it will be better to enable caller # graphs for selected functions only using the \callergraph command. CALLER_GRAPH = NO # If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen # will graphical hierarchy of all classes instead of a textual one. GRAPHICAL_HIERARCHY = NO # If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES # then doxygen will show the dependencies a directory has on other directories # in a graphical way. The dependency relations are determined by the #include # relations between the files in the directories. DIRECTORY_GRAPH = NO # The DOT_IMAGE_FORMAT tag can be used to set the image format of the images # generated by dot. Possible values are png, jpg, or gif # If left blank png will be used. DOT_IMAGE_FORMAT = png # The tag DOT_PATH can be used to specify the path where the dot tool can be # found. If left blank, it is assumed the dot tool can be found in the path. DOT_PATH = # The DOTFILE_DIRS tag can be used to specify one or more directories that # contain dot files that are included in the documentation (see the # \dotfile command). DOTFILE_DIRS = # The MAX_DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of # nodes that will be shown in the graph. If the number of nodes in a graph # becomes larger than this value, doxygen will truncate the graph, which is # visualized by representing a node as a red box. Note that doxygen if the # number of direct children of the root node in a graph is already larger than # DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note # that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH. DOT_GRAPH_MAX_NODES = 50 # The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the # graphs generated by dot. A depth value of 3 means that only nodes reachable # from the root by following a path via at most 3 edges will be shown. Nodes # that lay further from the root node will be omitted. Note that setting this # option to 1 or 2 may greatly reduce the computation time needed for large # code bases. Also note that the size of a graph can be further restricted by # DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction. MAX_DOT_GRAPH_DEPTH = 0 # Set the DOT_TRANSPARENT tag to YES to generate images with a transparent # background. This is enabled by default, which results in a transparent # background. Warning: Depending on the platform used, enabling this option # may lead to badly anti-aliased labels on the edges of a graph (i.e. they # become hard to read). DOT_TRANSPARENT = YES # Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output # files in one run (i.e. multiple -o and -T options on the command line). This # makes dot run faster, but since only newer versions of dot (>1.8.10) # support this, this feature is disabled by default. DOT_MULTI_TARGETS = NO # If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will # generate a legend page explaining the meaning of the various boxes and # arrows in the dot generated graphs. GENERATE_LEGEND = YES # If the DOT_CLEANUP tag is set to YES (the default) Doxygen will # remove the intermediate dot files that are used to generate # the various graphs. DOT_CLEANUP = YES #--------------------------------------------------------------------------- # Configuration::additions related to the search engine #--------------------------------------------------------------------------- # The SEARCHENGINE tag specifies whether or not a search engine should be # used. If set to NO the values of all tags below this one will be ignored. SEARCHENGINE = NO suricata-3.2.1/libhtp/docs/Makefile.in0000644000000000000000000003114313051004463014474 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = docs ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ $(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/lib-ld.m4 \ $(top_srcdir)/m4/lib-link.m4 $(top_srcdir)/m4/lib-prefix.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/htp_config_auto_gen.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CXX = @CXX@ CXXCPP = @CXXCPP@ CXXDEPMODE = @CXXDEPMODE@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DOXYGEN = @DOXYGEN@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GENERIC_API_VERSION = @GENERIC_API_VERSION@ GENERIC_LIBRARY_NAME = @GENERIC_LIBRARY_NAME@ GENERIC_LIBRARY_VERSION = @GENERIC_LIBRARY_VERSION@ GENERIC_RELEASE = @GENERIC_RELEASE@ GENERIC_VERSION = @GENERIC_VERSION@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBICONV = @LIBICONV@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBICONV = @LTLIBICONV@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ RANLIB = @RANLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ doxygen = @doxygen@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ CLEANFILES = *.pdf all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu docs/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu docs/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES) distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-generic clean-libtool clean-local mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ clean-local cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ tags-am uninstall uninstall-am .PRECIOUS: Makefile clean-local: rm -rf doxygen doxygen: doxygen.conf $(DOXYGEN_DEPS) @if test -n "$(DOXYGEN)"; then \ $(DOXYGEN) $<; \ else \ echo "You need doxygen installed to build the docs."; \ fi; doxygen-pdf: doxygen doxygen.pdf doxygen.pdf: doxygen (cd doxygen/latex && make refman.pdf) && cp doxygen/latex/refman.pdf doxygen.pdf .PHONY: doxygen-pdf # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/libhtp/ltmain.sh0000644000000000000000000117146413051004460013330 00000000000000#! /bin/sh ## DO NOT EDIT - This file generated from ./build-aux/ltmain.in ## by inline-source v2014-01-03.01 # libtool (GNU libtool) 2.4.6 # Provide generalized library-building support services. # Written by Gordon Matzigkeit , 1996 # Copyright (C) 1996-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, # if you distribute this file as part of a program or library that # is built using GNU Libtool, you may include this file under the # same distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . PROGRAM=libtool PACKAGE=libtool VERSION="2.4.6 Debian-2.4.6-0.1" package_revision=2.4.6 ## ------ ## ## Usage. ## ## ------ ## # Run './libtool --help' for help with using this script from the # command line. ## ------------------------------- ## ## User overridable command paths. ## ## ------------------------------- ## # After configure completes, it has a better idea of some of the # shell tools we need than the defaults used by the functions shared # with bootstrap, so set those here where they can still be over- # ridden by the user, but otherwise take precedence. : ${AUTOCONF="autoconf"} : ${AUTOMAKE="automake"} ## -------------------------- ## ## Source external libraries. ## ## -------------------------- ## # Much of our low-level functionality needs to be sourced from external # libraries, which are installed to $pkgauxdir. # Set a version string for this script. scriptversion=2015-01-20.17; # UTC # General shell script boiler plate, and helper functions. # Written by Gary V. Vaughan, 2004 # Copyright (C) 2004-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # As a special exception to the GNU General Public License, if you distribute # this file as part of a program or library that is built using GNU Libtool, # you may include this file under the same distribution terms that you use # for the rest of that program. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNES FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # Please report bugs or propose patches to gary@gnu.org. ## ------ ## ## Usage. ## ## ------ ## # Evaluate this file near the top of your script to gain access to # the functions and variables defined here: # # . `echo "$0" | ${SED-sed} 's|[^/]*$||'`/build-aux/funclib.sh # # If you need to override any of the default environment variable # settings, do that before evaluating this file. ## -------------------- ## ## Shell normalisation. ## ## -------------------- ## # Some shells need a little help to be as Bourne compatible as possible. # Before doing anything else, make sure all that help has been provided! DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi # NLS nuisances: We save the old values in case they are required later. _G_user_locale= _G_safe_locale= for _G_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES do eval "if test set = \"\${$_G_var+set}\"; then save_$_G_var=\$$_G_var $_G_var=C export $_G_var _G_user_locale=\"$_G_var=\\\$save_\$_G_var; \$_G_user_locale\" _G_safe_locale=\"$_G_var=C; \$_G_safe_locale\" fi" done # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # Make sure IFS has a sensible default sp=' ' nl=' ' IFS="$sp $nl" # There are apparently some retarded systems that use ';' as a PATH separator! if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi ## ------------------------- ## ## Locate command utilities. ## ## ------------------------- ## # func_executable_p FILE # ---------------------- # Check that FILE is an executable regular file. func_executable_p () { test -f "$1" && test -x "$1" } # func_path_progs PROGS_LIST CHECK_FUNC [PATH] # -------------------------------------------- # Search for either a program that responds to --version with output # containing "GNU", or else returned by CHECK_FUNC otherwise, by # trying all the directories in PATH with each of the elements of # PROGS_LIST. # # CHECK_FUNC should accept the path to a candidate program, and # set $func_check_prog_result if it truncates its output less than # $_G_path_prog_max characters. func_path_progs () { _G_progs_list=$1 _G_check_func=$2 _G_PATH=${3-"$PATH"} _G_path_prog_max=0 _G_path_prog_found=false _G_save_IFS=$IFS; IFS=${PATH_SEPARATOR-:} for _G_dir in $_G_PATH; do IFS=$_G_save_IFS test -z "$_G_dir" && _G_dir=. for _G_prog_name in $_G_progs_list; do for _exeext in '' .EXE; do _G_path_prog=$_G_dir/$_G_prog_name$_exeext func_executable_p "$_G_path_prog" || continue case `"$_G_path_prog" --version 2>&1` in *GNU*) func_path_progs_result=$_G_path_prog _G_path_prog_found=: ;; *) $_G_check_func $_G_path_prog func_path_progs_result=$func_check_prog_result ;; esac $_G_path_prog_found && break 3 done done done IFS=$_G_save_IFS test -z "$func_path_progs_result" && { echo "no acceptable sed could be found in \$PATH" >&2 exit 1 } } # We want to be able to use the functions in this file before configure # has figured out where the best binaries are kept, which means we have # to search for them ourselves - except when the results are already set # where we skip the searches. # Unless the user overrides by setting SED, search the path for either GNU # sed, or the sed that truncates its output the least. test -z "$SED" && { _G_sed_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/ for _G_i in 1 2 3 4 5 6 7; do _G_sed_script=$_G_sed_script$nl$_G_sed_script done echo "$_G_sed_script" 2>/dev/null | sed 99q >conftest.sed _G_sed_script= func_check_prog_sed () { _G_path_prog=$1 _G_count=0 printf 0123456789 >conftest.in while : do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo '' >> conftest.nl "$_G_path_prog" -f conftest.sed conftest.out 2>/dev/null || break diff conftest.out conftest.nl >/dev/null 2>&1 || break _G_count=`expr $_G_count + 1` if test "$_G_count" -gt "$_G_path_prog_max"; then # Best one so far, save it but keep looking for a better one func_check_prog_result=$_G_path_prog _G_path_prog_max=$_G_count fi # 10*(2^10) chars as input seems more than enough test 10 -lt "$_G_count" && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out } func_path_progs "sed gsed" func_check_prog_sed $PATH:/usr/xpg4/bin rm -f conftest.sed SED=$func_path_progs_result } # Unless the user overrides by setting GREP, search the path for either GNU # grep, or the grep that truncates its output the least. test -z "$GREP" && { func_check_prog_grep () { _G_path_prog=$1 _G_count=0 _G_path_prog_max=0 printf 0123456789 >conftest.in while : do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo 'GREP' >> conftest.nl "$_G_path_prog" -e 'GREP$' -e '-(cannot match)-' conftest.out 2>/dev/null || break diff conftest.out conftest.nl >/dev/null 2>&1 || break _G_count=`expr $_G_count + 1` if test "$_G_count" -gt "$_G_path_prog_max"; then # Best one so far, save it but keep looking for a better one func_check_prog_result=$_G_path_prog _G_path_prog_max=$_G_count fi # 10*(2^10) chars as input seems more than enough test 10 -lt "$_G_count" && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out } func_path_progs "grep ggrep" func_check_prog_grep $PATH:/usr/xpg4/bin GREP=$func_path_progs_result } ## ------------------------------- ## ## User overridable command paths. ## ## ------------------------------- ## # All uppercase variable names are used for environment variables. These # variables can be overridden by the user before calling a script that # uses them if a suitable command of that name is not already available # in the command search PATH. : ${CP="cp -f"} : ${ECHO="printf %s\n"} : ${EGREP="$GREP -E"} : ${FGREP="$GREP -F"} : ${LN_S="ln -s"} : ${MAKE="make"} : ${MKDIR="mkdir"} : ${MV="mv -f"} : ${RM="rm -f"} : ${SHELL="${CONFIG_SHELL-/bin/sh}"} ## -------------------- ## ## Useful sed snippets. ## ## -------------------- ## sed_dirname='s|/[^/]*$||' sed_basename='s|^.*/||' # Sed substitution that helps us do robust quoting. It backslashifies # metacharacters that are still active within double-quoted strings. sed_quote_subst='s|\([`"$\\]\)|\\\1|g' # Same as above, but do not quote variable references. sed_double_quote_subst='s/\(["`\\]\)/\\\1/g' # Sed substitution that turns a string into a regex matching for the # string literally. sed_make_literal_regex='s|[].[^$\\*\/]|\\&|g' # Sed substitution that converts a w32 file name or path # that contains forward slashes, into one that contains # (escaped) backslashes. A very naive implementation. sed_naive_backslashify='s|\\\\*|\\|g;s|/|\\|g;s|\\|\\\\|g' # Re-'\' parameter expansions in output of sed_double_quote_subst that # were '\'-ed in input to the same. If an odd number of '\' preceded a # '$' in input to sed_double_quote_subst, that '$' was protected from # expansion. Since each input '\' is now two '\'s, look for any number # of runs of four '\'s followed by two '\'s and then a '$'. '\' that '$'. _G_bs='\\' _G_bs2='\\\\' _G_bs4='\\\\\\\\' _G_dollar='\$' sed_double_backslash="\ s/$_G_bs4/&\\ /g s/^$_G_bs2$_G_dollar/$_G_bs&/ s/\\([^$_G_bs]\\)$_G_bs2$_G_dollar/\\1$_G_bs2$_G_bs$_G_dollar/g s/\n//g" ## ----------------- ## ## Global variables. ## ## ----------------- ## # Except for the global variables explicitly listed below, the following # functions in the '^func_' namespace, and the '^require_' namespace # variables initialised in the 'Resource management' section, sourcing # this file will not pollute your global namespace with anything # else. There's no portable way to scope variables in Bourne shell # though, so actually running these functions will sometimes place # results into a variable named after the function, and often use # temporary variables in the '^_G_' namespace. If you are careful to # avoid using those namespaces casually in your sourcing script, things # should continue to work as you expect. And, of course, you can freely # overwrite any of the functions or variables defined here before # calling anything to customize them. EXIT_SUCCESS=0 EXIT_FAILURE=1 EXIT_MISMATCH=63 # $? = 63 is used to indicate version mismatch to missing. EXIT_SKIP=77 # $? = 77 is used to indicate a skipped test to automake. # Allow overriding, eg assuming that you follow the convention of # putting '$debug_cmd' at the start of all your functions, you can get # bash to show function call trace with: # # debug_cmd='eval echo "${FUNCNAME[0]} $*" >&2' bash your-script-name debug_cmd=${debug_cmd-":"} exit_cmd=: # By convention, finish your script with: # # exit $exit_status # # so that you can set exit_status to non-zero if you want to indicate # something went wrong during execution without actually bailing out at # the point of failure. exit_status=$EXIT_SUCCESS # Work around backward compatibility issue on IRIX 6.5. On IRIX 6.4+, sh # is ksh but when the shell is invoked as "sh" and the current value of # the _XPG environment variable is not equal to 1 (one), the special # positional parameter $0, within a function call, is the name of the # function. progpath=$0 # The name of this program. progname=`$ECHO "$progpath" |$SED "$sed_basename"` # Make sure we have an absolute progpath for reexecution: case $progpath in [\\/]*|[A-Za-z]:\\*) ;; *[\\/]*) progdir=`$ECHO "$progpath" |$SED "$sed_dirname"` progdir=`cd "$progdir" && pwd` progpath=$progdir/$progname ;; *) _G_IFS=$IFS IFS=${PATH_SEPARATOR-:} for progdir in $PATH; do IFS=$_G_IFS test -x "$progdir/$progname" && break done IFS=$_G_IFS test -n "$progdir" || progdir=`pwd` progpath=$progdir/$progname ;; esac ## ----------------- ## ## Standard options. ## ## ----------------- ## # The following options affect the operation of the functions defined # below, and should be set appropriately depending on run-time para- # meters passed on the command line. opt_dry_run=false opt_quiet=false opt_verbose=false # Categories 'all' and 'none' are always available. Append any others # you will pass as the first argument to func_warning from your own # code. warning_categories= # By default, display warnings according to 'opt_warning_types'. Set # 'warning_func' to ':' to elide all warnings, or func_fatal_error to # treat the next displayed warning as a fatal error. warning_func=func_warn_and_continue # Set to 'all' to display all warnings, 'none' to suppress all # warnings, or a space delimited list of some subset of # 'warning_categories' to display only the listed warnings. opt_warning_types=all ## -------------------- ## ## Resource management. ## ## -------------------- ## # This section contains definitions for functions that each ensure a # particular resource (a file, or a non-empty configuration variable for # example) is available, and if appropriate to extract default values # from pertinent package files. Call them using their associated # 'require_*' variable to ensure that they are executed, at most, once. # # It's entirely deliberate that calling these functions can set # variables that don't obey the namespace limitations obeyed by the rest # of this file, in order that that they be as useful as possible to # callers. # require_term_colors # ------------------- # Allow display of bold text on terminals that support it. require_term_colors=func_require_term_colors func_require_term_colors () { $debug_cmd test -t 1 && { # COLORTERM and USE_ANSI_COLORS environment variables take # precedence, because most terminfo databases neglect to describe # whether color sequences are supported. test -n "${COLORTERM+set}" && : ${USE_ANSI_COLORS="1"} if test 1 = "$USE_ANSI_COLORS"; then # Standard ANSI escape sequences tc_reset='' tc_bold=''; tc_standout='' tc_red=''; tc_green='' tc_blue=''; tc_cyan='' else # Otherwise trust the terminfo database after all. test -n "`tput sgr0 2>/dev/null`" && { tc_reset=`tput sgr0` test -n "`tput bold 2>/dev/null`" && tc_bold=`tput bold` tc_standout=$tc_bold test -n "`tput smso 2>/dev/null`" && tc_standout=`tput smso` test -n "`tput setaf 1 2>/dev/null`" && tc_red=`tput setaf 1` test -n "`tput setaf 2 2>/dev/null`" && tc_green=`tput setaf 2` test -n "`tput setaf 4 2>/dev/null`" && tc_blue=`tput setaf 4` test -n "`tput setaf 5 2>/dev/null`" && tc_cyan=`tput setaf 5` } fi } require_term_colors=: } ## ----------------- ## ## Function library. ## ## ----------------- ## # This section contains a variety of useful functions to call in your # scripts. Take note of the portable wrappers for features provided by # some modern shells, which will fall back to slower equivalents on # less featureful shells. # func_append VAR VALUE # --------------------- # Append VALUE onto the existing contents of VAR. # We should try to minimise forks, especially on Windows where they are # unreasonably slow, so skip the feature probes when bash or zsh are # being used: if test set = "${BASH_VERSION+set}${ZSH_VERSION+set}"; then : ${_G_HAVE_ARITH_OP="yes"} : ${_G_HAVE_XSI_OPS="yes"} # The += operator was introduced in bash 3.1 case $BASH_VERSION in [12].* | 3.0 | 3.0*) ;; *) : ${_G_HAVE_PLUSEQ_OP="yes"} ;; esac fi # _G_HAVE_PLUSEQ_OP # Can be empty, in which case the shell is probed, "yes" if += is # useable or anything else if it does not work. test -z "$_G_HAVE_PLUSEQ_OP" \ && (eval 'x=a; x+=" b"; test "a b" = "$x"') 2>/dev/null \ && _G_HAVE_PLUSEQ_OP=yes if test yes = "$_G_HAVE_PLUSEQ_OP" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_append () { $debug_cmd eval "$1+=\$2" }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_append () { $debug_cmd eval "$1=\$$1\$2" } fi # func_append_quoted VAR VALUE # ---------------------------- # Quote VALUE and append to the end of shell variable VAR, separated # by a space. if test yes = "$_G_HAVE_PLUSEQ_OP"; then eval 'func_append_quoted () { $debug_cmd func_quote_for_eval "$2" eval "$1+=\\ \$func_quote_for_eval_result" }' else func_append_quoted () { $debug_cmd func_quote_for_eval "$2" eval "$1=\$$1\\ \$func_quote_for_eval_result" } fi # func_append_uniq VAR VALUE # -------------------------- # Append unique VALUE onto the existing contents of VAR, assuming # entries are delimited by the first character of VALUE. For example: # # func_append_uniq options " --another-option option-argument" # # will only append to $options if " --another-option option-argument " # is not already present somewhere in $options already (note spaces at # each end implied by leading space in second argument). func_append_uniq () { $debug_cmd eval _G_current_value='`$ECHO $'$1'`' _G_delim=`expr "$2" : '\(.\)'` case $_G_delim$_G_current_value$_G_delim in *"$2$_G_delim"*) ;; *) func_append "$@" ;; esac } # func_arith TERM... # ------------------ # Set func_arith_result to the result of evaluating TERMs. test -z "$_G_HAVE_ARITH_OP" \ && (eval 'test 2 = $(( 1 + 1 ))') 2>/dev/null \ && _G_HAVE_ARITH_OP=yes if test yes = "$_G_HAVE_ARITH_OP"; then eval 'func_arith () { $debug_cmd func_arith_result=$(( $* )) }' else func_arith () { $debug_cmd func_arith_result=`expr "$@"` } fi # func_basename FILE # ------------------ # Set func_basename_result to FILE with everything up to and including # the last / stripped. if test yes = "$_G_HAVE_XSI_OPS"; then # If this shell supports suffix pattern removal, then use it to avoid # forking. Hide the definitions single quotes in case the shell chokes # on unsupported syntax... _b='func_basename_result=${1##*/}' _d='case $1 in */*) func_dirname_result=${1%/*}$2 ;; * ) func_dirname_result=$3 ;; esac' else # ...otherwise fall back to using sed. _b='func_basename_result=`$ECHO "$1" |$SED "$sed_basename"`' _d='func_dirname_result=`$ECHO "$1" |$SED "$sed_dirname"` if test "X$func_dirname_result" = "X$1"; then func_dirname_result=$3 else func_append func_dirname_result "$2" fi' fi eval 'func_basename () { $debug_cmd '"$_b"' }' # func_dirname FILE APPEND NONDIR_REPLACEMENT # ------------------------------------------- # Compute the dirname of FILE. If nonempty, add APPEND to the result, # otherwise set result to NONDIR_REPLACEMENT. eval 'func_dirname () { $debug_cmd '"$_d"' }' # func_dirname_and_basename FILE APPEND NONDIR_REPLACEMENT # -------------------------------------------------------- # Perform func_basename and func_dirname in a single function # call: # dirname: Compute the dirname of FILE. If nonempty, # add APPEND to the result, otherwise set result # to NONDIR_REPLACEMENT. # value returned in "$func_dirname_result" # basename: Compute filename of FILE. # value retuned in "$func_basename_result" # For efficiency, we do not delegate to the functions above but instead # duplicate the functionality here. eval 'func_dirname_and_basename () { $debug_cmd '"$_b"' '"$_d"' }' # func_echo ARG... # ---------------- # Echo program name prefixed message. func_echo () { $debug_cmd _G_message=$* func_echo_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_IFS $ECHO "$progname: $_G_line" done IFS=$func_echo_IFS } # func_echo_all ARG... # -------------------- # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "$*" } # func_echo_infix_1 INFIX ARG... # ------------------------------ # Echo program name, followed by INFIX on the first line, with any # additional lines not showing INFIX. func_echo_infix_1 () { $debug_cmd $require_term_colors _G_infix=$1; shift _G_indent=$_G_infix _G_prefix="$progname: $_G_infix: " _G_message=$* # Strip color escape sequences before counting printable length for _G_tc in "$tc_reset" "$tc_bold" "$tc_standout" "$tc_red" "$tc_green" "$tc_blue" "$tc_cyan" do test -n "$_G_tc" && { _G_esc_tc=`$ECHO "$_G_tc" | $SED "$sed_make_literal_regex"` _G_indent=`$ECHO "$_G_indent" | $SED "s|$_G_esc_tc||g"` } done _G_indent="$progname: "`echo "$_G_indent" | $SED 's|.| |g'`" " ## exclude from sc_prohibit_nested_quotes func_echo_infix_1_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_infix_1_IFS $ECHO "$_G_prefix$tc_bold$_G_line$tc_reset" >&2 _G_prefix=$_G_indent done IFS=$func_echo_infix_1_IFS } # func_error ARG... # ----------------- # Echo program name prefixed message to standard error. func_error () { $debug_cmd $require_term_colors func_echo_infix_1 " $tc_standout${tc_red}error$tc_reset" "$*" >&2 } # func_fatal_error ARG... # ----------------------- # Echo program name prefixed message to standard error, and exit. func_fatal_error () { $debug_cmd func_error "$*" exit $EXIT_FAILURE } # func_grep EXPRESSION FILENAME # ----------------------------- # Check whether EXPRESSION matches any line of FILENAME, without output. func_grep () { $debug_cmd $GREP "$1" "$2" >/dev/null 2>&1 } # func_len STRING # --------------- # Set func_len_result to the length of STRING. STRING may not # start with a hyphen. test -z "$_G_HAVE_XSI_OPS" \ && (eval 'x=a/b/c; test 5aa/bb/cc = "${#x}${x%%/*}${x%/*}${x#*/}${x##*/}"') 2>/dev/null \ && _G_HAVE_XSI_OPS=yes if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_len () { $debug_cmd func_len_result=${#1} }' else func_len () { $debug_cmd func_len_result=`expr "$1" : ".*" 2>/dev/null || echo $max_cmd_len` } fi # func_mkdir_p DIRECTORY-PATH # --------------------------- # Make sure the entire path to DIRECTORY-PATH is available. func_mkdir_p () { $debug_cmd _G_directory_path=$1 _G_dir_list= if test -n "$_G_directory_path" && test : != "$opt_dry_run"; then # Protect directory names starting with '-' case $_G_directory_path in -*) _G_directory_path=./$_G_directory_path ;; esac # While some portion of DIR does not yet exist... while test ! -d "$_G_directory_path"; do # ...make a list in topmost first order. Use a colon delimited # list incase some portion of path contains whitespace. _G_dir_list=$_G_directory_path:$_G_dir_list # If the last portion added has no slash in it, the list is done case $_G_directory_path in */*) ;; *) break ;; esac # ...otherwise throw away the child directory and loop _G_directory_path=`$ECHO "$_G_directory_path" | $SED -e "$sed_dirname"` done _G_dir_list=`$ECHO "$_G_dir_list" | $SED 's|:*$||'` func_mkdir_p_IFS=$IFS; IFS=: for _G_dir in $_G_dir_list; do IFS=$func_mkdir_p_IFS # mkdir can fail with a 'File exist' error if two processes # try to create one of the directories concurrently. Don't # stop in that case! $MKDIR "$_G_dir" 2>/dev/null || : done IFS=$func_mkdir_p_IFS # Bail out if we (or some other process) failed to create a directory. test -d "$_G_directory_path" || \ func_fatal_error "Failed to create '$1'" fi } # func_mktempdir [BASENAME] # ------------------------- # Make a temporary directory that won't clash with other running # libtool processes, and avoids race conditions if possible. If # given, BASENAME is the basename for that directory. func_mktempdir () { $debug_cmd _G_template=${TMPDIR-/tmp}/${1-$progname} if test : = "$opt_dry_run"; then # Return a directory name, but don't create it in dry-run mode _G_tmpdir=$_G_template-$$ else # If mktemp works, use that first and foremost _G_tmpdir=`mktemp -d "$_G_template-XXXXXXXX" 2>/dev/null` if test ! -d "$_G_tmpdir"; then # Failing that, at least try and use $RANDOM to avoid a race _G_tmpdir=$_G_template-${RANDOM-0}$$ func_mktempdir_umask=`umask` umask 0077 $MKDIR "$_G_tmpdir" umask $func_mktempdir_umask fi # If we're not in dry-run mode, bomb out on failure test -d "$_G_tmpdir" || \ func_fatal_error "cannot create temporary directory '$_G_tmpdir'" fi $ECHO "$_G_tmpdir" } # func_normal_abspath PATH # ------------------------ # Remove doubled-up and trailing slashes, "." path components, # and cancel out any ".." path components in PATH after making # it an absolute path. func_normal_abspath () { $debug_cmd # These SED scripts presuppose an absolute path with a trailing slash. _G_pathcar='s|^/\([^/]*\).*$|\1|' _G_pathcdr='s|^/[^/]*||' _G_removedotparts=':dotsl s|/\./|/|g t dotsl s|/\.$|/|' _G_collapseslashes='s|/\{1,\}|/|g' _G_finalslash='s|/*$|/|' # Start from root dir and reassemble the path. func_normal_abspath_result= func_normal_abspath_tpath=$1 func_normal_abspath_altnamespace= case $func_normal_abspath_tpath in "") # Empty path, that just means $cwd. func_stripname '' '/' "`pwd`" func_normal_abspath_result=$func_stripname_result return ;; # The next three entries are used to spot a run of precisely # two leading slashes without using negated character classes; # we take advantage of case's first-match behaviour. ///*) # Unusual form of absolute path, do nothing. ;; //*) # Not necessarily an ordinary path; POSIX reserves leading '//' # and for example Cygwin uses it to access remote file shares # over CIFS/SMB, so we conserve a leading double slash if found. func_normal_abspath_altnamespace=/ ;; /*) # Absolute path, do nothing. ;; *) # Relative path, prepend $cwd. func_normal_abspath_tpath=`pwd`/$func_normal_abspath_tpath ;; esac # Cancel out all the simple stuff to save iterations. We also want # the path to end with a slash for ease of parsing, so make sure # there is one (and only one) here. func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_removedotparts" -e "$_G_collapseslashes" -e "$_G_finalslash"` while :; do # Processed it all yet? if test / = "$func_normal_abspath_tpath"; then # If we ascended to the root using ".." the result may be empty now. if test -z "$func_normal_abspath_result"; then func_normal_abspath_result=/ fi break fi func_normal_abspath_tcomponent=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_pathcar"` func_normal_abspath_tpath=`$ECHO "$func_normal_abspath_tpath" | $SED \ -e "$_G_pathcdr"` # Figure out what to do with it case $func_normal_abspath_tcomponent in "") # Trailing empty path component, ignore it. ;; ..) # Parent dir; strip last assembled component from result. func_dirname "$func_normal_abspath_result" func_normal_abspath_result=$func_dirname_result ;; *) # Actual path component, append it. func_append func_normal_abspath_result "/$func_normal_abspath_tcomponent" ;; esac done # Restore leading double-slash if one was found on entry. func_normal_abspath_result=$func_normal_abspath_altnamespace$func_normal_abspath_result } # func_notquiet ARG... # -------------------- # Echo program name prefixed message only when not in quiet mode. func_notquiet () { $debug_cmd $opt_quiet || func_echo ${1+"$@"} # A bug in bash halts the script if the last line of a function # fails when set -e is in force, so we need another command to # work around that: : } # func_relative_path SRCDIR DSTDIR # -------------------------------- # Set func_relative_path_result to the relative path from SRCDIR to DSTDIR. func_relative_path () { $debug_cmd func_relative_path_result= func_normal_abspath "$1" func_relative_path_tlibdir=$func_normal_abspath_result func_normal_abspath "$2" func_relative_path_tbindir=$func_normal_abspath_result # Ascend the tree starting from libdir while :; do # check if we have found a prefix of bindir case $func_relative_path_tbindir in $func_relative_path_tlibdir) # found an exact match func_relative_path_tcancelled= break ;; $func_relative_path_tlibdir*) # found a matching prefix func_stripname "$func_relative_path_tlibdir" '' "$func_relative_path_tbindir" func_relative_path_tcancelled=$func_stripname_result if test -z "$func_relative_path_result"; then func_relative_path_result=. fi break ;; *) func_dirname $func_relative_path_tlibdir func_relative_path_tlibdir=$func_dirname_result if test -z "$func_relative_path_tlibdir"; then # Have to descend all the way to the root! func_relative_path_result=../$func_relative_path_result func_relative_path_tcancelled=$func_relative_path_tbindir break fi func_relative_path_result=../$func_relative_path_result ;; esac done # Now calculate path; take care to avoid doubling-up slashes. func_stripname '' '/' "$func_relative_path_result" func_relative_path_result=$func_stripname_result func_stripname '/' '/' "$func_relative_path_tcancelled" if test -n "$func_stripname_result"; then func_append func_relative_path_result "/$func_stripname_result" fi # Normalisation. If bindir is libdir, return '.' else relative path. if test -n "$func_relative_path_result"; then func_stripname './' '' "$func_relative_path_result" func_relative_path_result=$func_stripname_result fi test -n "$func_relative_path_result" || func_relative_path_result=. : } # func_quote_for_eval ARG... # -------------------------- # Aesthetically quote ARGs to be evaled later. # This function returns two values: # i) func_quote_for_eval_result # double-quoted, suitable for a subsequent eval # ii) func_quote_for_eval_unquoted_result # has all characters that are still active within double # quotes backslashified. func_quote_for_eval () { $debug_cmd func_quote_for_eval_unquoted_result= func_quote_for_eval_result= while test 0 -lt $#; do case $1 in *[\\\`\"\$]*) _G_unquoted_arg=`printf '%s\n' "$1" |$SED "$sed_quote_subst"` ;; *) _G_unquoted_arg=$1 ;; esac if test -n "$func_quote_for_eval_unquoted_result"; then func_append func_quote_for_eval_unquoted_result " $_G_unquoted_arg" else func_append func_quote_for_eval_unquoted_result "$_G_unquoted_arg" fi case $_G_unquoted_arg in # Double-quote args containing shell metacharacters to delay # word splitting, command substitution and variable expansion # for a subsequent eval. # Many Bourne shells cannot handle close brackets correctly # in scan sets, so we specify it separately. *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \ ]*|*]*|"") _G_quoted_arg=\"$_G_unquoted_arg\" ;; *) _G_quoted_arg=$_G_unquoted_arg ;; esac if test -n "$func_quote_for_eval_result"; then func_append func_quote_for_eval_result " $_G_quoted_arg" else func_append func_quote_for_eval_result "$_G_quoted_arg" fi shift done } # func_quote_for_expand ARG # ------------------------- # Aesthetically quote ARG to be evaled later; same as above, # but do not quote variable references. func_quote_for_expand () { $debug_cmd case $1 in *[\\\`\"]*) _G_arg=`$ECHO "$1" | $SED \ -e "$sed_double_quote_subst" -e "$sed_double_backslash"` ;; *) _G_arg=$1 ;; esac case $_G_arg in # Double-quote args containing shell metacharacters to delay # word splitting and command substitution for a subsequent eval. # Many Bourne shells cannot handle close brackets correctly # in scan sets, so we specify it separately. *[\[\~\#\^\&\*\(\)\{\}\|\;\<\>\?\'\ \ ]*|*]*|"") _G_arg=\"$_G_arg\" ;; esac func_quote_for_expand_result=$_G_arg } # func_stripname PREFIX SUFFIX NAME # --------------------------------- # strip PREFIX and SUFFIX from NAME, and store in func_stripname_result. # PREFIX and SUFFIX must not contain globbing or regex special # characters, hashes, percent signs, but SUFFIX may contain a leading # dot (in which case that matches only a dot). if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_stripname () { $debug_cmd # pdksh 5.2.14 does not do ${X%$Y} correctly if both X and Y are # positional parameters, so assign one to ordinary variable first. func_stripname_result=$3 func_stripname_result=${func_stripname_result#"$1"} func_stripname_result=${func_stripname_result%"$2"} }' else func_stripname () { $debug_cmd case $2 in .*) func_stripname_result=`$ECHO "$3" | $SED -e "s%^$1%%" -e "s%\\\\$2\$%%"`;; *) func_stripname_result=`$ECHO "$3" | $SED -e "s%^$1%%" -e "s%$2\$%%"`;; esac } fi # func_show_eval CMD [FAIL_EXP] # ----------------------------- # Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is # not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP # is given, then evaluate it. func_show_eval () { $debug_cmd _G_cmd=$1 _G_fail_exp=${2-':'} func_quote_for_expand "$_G_cmd" eval "func_notquiet $func_quote_for_expand_result" $opt_dry_run || { eval "$_G_cmd" _G_status=$? if test 0 -ne "$_G_status"; then eval "(exit $_G_status); $_G_fail_exp" fi } } # func_show_eval_locale CMD [FAIL_EXP] # ------------------------------------ # Unless opt_quiet is true, then output CMD. Then, if opt_dryrun is # not true, evaluate CMD. If the evaluation of CMD fails, and FAIL_EXP # is given, then evaluate it. Use the saved locale for evaluation. func_show_eval_locale () { $debug_cmd _G_cmd=$1 _G_fail_exp=${2-':'} $opt_quiet || { func_quote_for_expand "$_G_cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || { eval "$_G_user_locale $_G_cmd" _G_status=$? eval "$_G_safe_locale" if test 0 -ne "$_G_status"; then eval "(exit $_G_status); $_G_fail_exp" fi } } # func_tr_sh # ---------- # Turn $1 into a string suitable for a shell variable name. # Result is stored in $func_tr_sh_result. All characters # not in the set a-zA-Z0-9_ are replaced with '_'. Further, # if $1 begins with a digit, a '_' is prepended as well. func_tr_sh () { $debug_cmd case $1 in [0-9]* | *[!a-zA-Z0-9_]*) func_tr_sh_result=`$ECHO "$1" | $SED -e 's/^\([0-9]\)/_\1/' -e 's/[^a-zA-Z0-9_]/_/g'` ;; * ) func_tr_sh_result=$1 ;; esac } # func_verbose ARG... # ------------------- # Echo program name prefixed message in verbose mode only. func_verbose () { $debug_cmd $opt_verbose && func_echo "$*" : } # func_warn_and_continue ARG... # ----------------------------- # Echo program name prefixed warning message to standard error. func_warn_and_continue () { $debug_cmd $require_term_colors func_echo_infix_1 "${tc_red}warning$tc_reset" "$*" >&2 } # func_warning CATEGORY ARG... # ---------------------------- # Echo program name prefixed warning message to standard error. Warning # messages can be filtered according to CATEGORY, where this function # elides messages where CATEGORY is not listed in the global variable # 'opt_warning_types'. func_warning () { $debug_cmd # CATEGORY must be in the warning_categories list! case " $warning_categories " in *" $1 "*) ;; *) func_internal_error "invalid warning category '$1'" ;; esac _G_category=$1 shift case " $opt_warning_types " in *" $_G_category "*) $warning_func ${1+"$@"} ;; esac } # func_sort_ver VER1 VER2 # ----------------------- # 'sort -V' is not generally available. # Note this deviates from the version comparison in automake # in that it treats 1.5 < 1.5.0, and treats 1.4.4a < 1.4-p3a # but this should suffice as we won't be specifying old # version formats or redundant trailing .0 in bootstrap.conf. # If we did want full compatibility then we should probably # use m4_version_compare from autoconf. func_sort_ver () { $debug_cmd printf '%s\n%s\n' "$1" "$2" \ | sort -t. -k 1,1n -k 2,2n -k 3,3n -k 4,4n -k 5,5n -k 6,6n -k 7,7n -k 8,8n -k 9,9n } # func_lt_ver PREV CURR # --------------------- # Return true if PREV and CURR are in the correct order according to # func_sort_ver, otherwise false. Use it like this: # # func_lt_ver "$prev_ver" "$proposed_ver" || func_fatal_error "..." func_lt_ver () { $debug_cmd test "x$1" = x`func_sort_ver "$1" "$2" | $SED 1q` } # Local variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC" # time-stamp-time-zone: "UTC" # End: #! /bin/sh # Set a version string for this script. scriptversion=2014-01-07.03; # UTC # A portable, pluggable option parser for Bourne shell. # Written by Gary V. Vaughan, 2010 # Copyright (C) 2010-2015 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . # Please report bugs or propose patches to gary@gnu.org. ## ------ ## ## Usage. ## ## ------ ## # This file is a library for parsing options in your shell scripts along # with assorted other useful supporting features that you can make use # of too. # # For the simplest scripts you might need only: # # #!/bin/sh # . relative/path/to/funclib.sh # . relative/path/to/options-parser # scriptversion=1.0 # func_options ${1+"$@"} # eval set dummy "$func_options_result"; shift # ...rest of your script... # # In order for the '--version' option to work, you will need to have a # suitably formatted comment like the one at the top of this file # starting with '# Written by ' and ending with '# warranty; '. # # For '-h' and '--help' to work, you will also need a one line # description of your script's purpose in a comment directly above the # '# Written by ' line, like the one at the top of this file. # # The default options also support '--debug', which will turn on shell # execution tracing (see the comment above debug_cmd below for another # use), and '--verbose' and the func_verbose function to allow your script # to display verbose messages only when your user has specified # '--verbose'. # # After sourcing this file, you can plug processing for additional # options by amending the variables from the 'Configuration' section # below, and following the instructions in the 'Option parsing' # section further down. ## -------------- ## ## Configuration. ## ## -------------- ## # You should override these variables in your script after sourcing this # file so that they reflect the customisations you have added to the # option parser. # The usage line for option parsing errors and the start of '-h' and # '--help' output messages. You can embed shell variables for delayed # expansion at the time the message is displayed, but you will need to # quote other shell meta-characters carefully to prevent them being # expanded when the contents are evaled. usage='$progpath [OPTION]...' # Short help message in response to '-h' and '--help'. Add to this or # override it after sourcing this library to reflect the full set of # options your script accepts. usage_message="\ --debug enable verbose shell tracing -W, --warnings=CATEGORY report the warnings falling in CATEGORY [all] -v, --verbose verbosely report processing --version print version information and exit -h, --help print short or long help message and exit " # Additional text appended to 'usage_message' in response to '--help'. long_help_message=" Warning categories include: 'all' show all warnings 'none' turn off all the warnings 'error' warnings are treated as fatal errors" # Help message printed before fatal option parsing errors. fatal_help="Try '\$progname --help' for more information." ## ------------------------- ## ## Hook function management. ## ## ------------------------- ## # This section contains functions for adding, removing, and running hooks # to the main code. A hook is just a named list of of function, that can # be run in order later on. # func_hookable FUNC_NAME # ----------------------- # Declare that FUNC_NAME will run hooks added with # 'func_add_hook FUNC_NAME ...'. func_hookable () { $debug_cmd func_append hookable_fns " $1" } # func_add_hook FUNC_NAME HOOK_FUNC # --------------------------------- # Request that FUNC_NAME call HOOK_FUNC before it returns. FUNC_NAME must # first have been declared "hookable" by a call to 'func_hookable'. func_add_hook () { $debug_cmd case " $hookable_fns " in *" $1 "*) ;; *) func_fatal_error "'$1' does not accept hook functions." ;; esac eval func_append ${1}_hooks '" $2"' } # func_remove_hook FUNC_NAME HOOK_FUNC # ------------------------------------ # Remove HOOK_FUNC from the list of functions called by FUNC_NAME. func_remove_hook () { $debug_cmd eval ${1}_hooks='`$ECHO "\$'$1'_hooks" |$SED "s| '$2'||"`' } # func_run_hooks FUNC_NAME [ARG]... # --------------------------------- # Run all hook functions registered to FUNC_NAME. # It is assumed that the list of hook functions contains nothing more # than a whitespace-delimited list of legal shell function names, and # no effort is wasted trying to catch shell meta-characters or preserve # whitespace. func_run_hooks () { $debug_cmd case " $hookable_fns " in *" $1 "*) ;; *) func_fatal_error "'$1' does not support hook funcions.n" ;; esac eval _G_hook_fns=\$$1_hooks; shift for _G_hook in $_G_hook_fns; do eval $_G_hook '"$@"' # store returned options list back into positional # parameters for next 'cmd' execution. eval _G_hook_result=\$${_G_hook}_result eval set dummy "$_G_hook_result"; shift done func_quote_for_eval ${1+"$@"} func_run_hooks_result=$func_quote_for_eval_result } ## --------------- ## ## Option parsing. ## ## --------------- ## # In order to add your own option parsing hooks, you must accept the # full positional parameter list in your hook function, remove any # options that you action, and then pass back the remaining unprocessed # options in '_result', escaped suitably for # 'eval'. Like this: # # my_options_prep () # { # $debug_cmd # # # Extend the existing usage message. # usage_message=$usage_message' # -s, --silent don'\''t print informational messages # ' # # func_quote_for_eval ${1+"$@"} # my_options_prep_result=$func_quote_for_eval_result # } # func_add_hook func_options_prep my_options_prep # # # my_silent_option () # { # $debug_cmd # # # Note that for efficiency, we parse as many options as we can # # recognise in a loop before passing the remainder back to the # # caller on the first unrecognised argument we encounter. # while test $# -gt 0; do # opt=$1; shift # case $opt in # --silent|-s) opt_silent=: ;; # # Separate non-argument short options: # -s*) func_split_short_opt "$_G_opt" # set dummy "$func_split_short_opt_name" \ # "-$func_split_short_opt_arg" ${1+"$@"} # shift # ;; # *) set dummy "$_G_opt" "$*"; shift; break ;; # esac # done # # func_quote_for_eval ${1+"$@"} # my_silent_option_result=$func_quote_for_eval_result # } # func_add_hook func_parse_options my_silent_option # # # my_option_validation () # { # $debug_cmd # # $opt_silent && $opt_verbose && func_fatal_help "\ # '--silent' and '--verbose' options are mutually exclusive." # # func_quote_for_eval ${1+"$@"} # my_option_validation_result=$func_quote_for_eval_result # } # func_add_hook func_validate_options my_option_validation # # You'll alse need to manually amend $usage_message to reflect the extra # options you parse. It's preferable to append if you can, so that # multiple option parsing hooks can be added safely. # func_options [ARG]... # --------------------- # All the functions called inside func_options are hookable. See the # individual implementations for details. func_hookable func_options func_options () { $debug_cmd func_options_prep ${1+"$@"} eval func_parse_options \ ${func_options_prep_result+"$func_options_prep_result"} eval func_validate_options \ ${func_parse_options_result+"$func_parse_options_result"} eval func_run_hooks func_options \ ${func_validate_options_result+"$func_validate_options_result"} # save modified positional parameters for caller func_options_result=$func_run_hooks_result } # func_options_prep [ARG]... # -------------------------- # All initialisations required before starting the option parse loop. # Note that when calling hook functions, we pass through the list of # positional parameters. If a hook function modifies that list, and # needs to propogate that back to rest of this script, then the complete # modified list must be put in 'func_run_hooks_result' before # returning. func_hookable func_options_prep func_options_prep () { $debug_cmd # Option defaults: opt_verbose=false opt_warning_types= func_run_hooks func_options_prep ${1+"$@"} # save modified positional parameters for caller func_options_prep_result=$func_run_hooks_result } # func_parse_options [ARG]... # --------------------------- # The main option parsing loop. func_hookable func_parse_options func_parse_options () { $debug_cmd func_parse_options_result= # this just eases exit handling while test $# -gt 0; do # Defer to hook functions for initial option parsing, so they # get priority in the event of reusing an option name. func_run_hooks func_parse_options ${1+"$@"} # Adjust func_parse_options positional parameters to match eval set dummy "$func_run_hooks_result"; shift # Break out of the loop if we already parsed every option. test $# -gt 0 || break _G_opt=$1 shift case $_G_opt in --debug|-x) debug_cmd='set -x' func_echo "enabling shell trace mode" $debug_cmd ;; --no-warnings|--no-warning|--no-warn) set dummy --warnings none ${1+"$@"} shift ;; --warnings|--warning|-W) test $# = 0 && func_missing_arg $_G_opt && break case " $warning_categories $1" in *" $1 "*) # trailing space prevents matching last $1 above func_append_uniq opt_warning_types " $1" ;; *all) opt_warning_types=$warning_categories ;; *none) opt_warning_types=none warning_func=: ;; *error) opt_warning_types=$warning_categories warning_func=func_fatal_error ;; *) func_fatal_error \ "unsupported warning category: '$1'" ;; esac shift ;; --verbose|-v) opt_verbose=: ;; --version) func_version ;; -\?|-h) func_usage ;; --help) func_help ;; # Separate optargs to long options (plugins may need this): --*=*) func_split_equals "$_G_opt" set dummy "$func_split_equals_lhs" \ "$func_split_equals_rhs" ${1+"$@"} shift ;; # Separate optargs to short options: -W*) func_split_short_opt "$_G_opt" set dummy "$func_split_short_opt_name" \ "$func_split_short_opt_arg" ${1+"$@"} shift ;; # Separate non-argument short options: -\?*|-h*|-v*|-x*) func_split_short_opt "$_G_opt" set dummy "$func_split_short_opt_name" \ "-$func_split_short_opt_arg" ${1+"$@"} shift ;; --) break ;; -*) func_fatal_help "unrecognised option: '$_G_opt'" ;; *) set dummy "$_G_opt" ${1+"$@"}; shift; break ;; esac done # save modified positional parameters for caller func_quote_for_eval ${1+"$@"} func_parse_options_result=$func_quote_for_eval_result } # func_validate_options [ARG]... # ------------------------------ # Perform any sanity checks on option settings and/or unconsumed # arguments. func_hookable func_validate_options func_validate_options () { $debug_cmd # Display all warnings if -W was not given. test -n "$opt_warning_types" || opt_warning_types=" $warning_categories" func_run_hooks func_validate_options ${1+"$@"} # Bail if the options were screwed! $exit_cmd $EXIT_FAILURE # save modified positional parameters for caller func_validate_options_result=$func_run_hooks_result } ## ----------------- ## ## Helper functions. ## ## ----------------- ## # This section contains the helper functions used by the rest of the # hookable option parser framework in ascii-betical order. # func_fatal_help ARG... # ---------------------- # Echo program name prefixed message to standard error, followed by # a help hint, and exit. func_fatal_help () { $debug_cmd eval \$ECHO \""Usage: $usage"\" eval \$ECHO \""$fatal_help"\" func_error ${1+"$@"} exit $EXIT_FAILURE } # func_help # --------- # Echo long help message to standard output and exit. func_help () { $debug_cmd func_usage_message $ECHO "$long_help_message" exit 0 } # func_missing_arg ARGNAME # ------------------------ # Echo program name prefixed message to standard error and set global # exit_cmd. func_missing_arg () { $debug_cmd func_error "Missing argument for '$1'." exit_cmd=exit } # func_split_equals STRING # ------------------------ # Set func_split_equals_lhs and func_split_equals_rhs shell variables after # splitting STRING at the '=' sign. test -z "$_G_HAVE_XSI_OPS" \ && (eval 'x=a/b/c; test 5aa/bb/cc = "${#x}${x%%/*}${x%/*}${x#*/}${x##*/}"') 2>/dev/null \ && _G_HAVE_XSI_OPS=yes if test yes = "$_G_HAVE_XSI_OPS" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_split_equals () { $debug_cmd func_split_equals_lhs=${1%%=*} func_split_equals_rhs=${1#*=} test "x$func_split_equals_lhs" = "x$1" \ && func_split_equals_rhs= }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_split_equals () { $debug_cmd func_split_equals_lhs=`expr "x$1" : 'x\([^=]*\)'` func_split_equals_rhs= test "x$func_split_equals_lhs" = "x$1" \ || func_split_equals_rhs=`expr "x$1" : 'x[^=]*=\(.*\)$'` } fi #func_split_equals # func_split_short_opt SHORTOPT # ----------------------------- # Set func_split_short_opt_name and func_split_short_opt_arg shell # variables after splitting SHORTOPT after the 2nd character. if test yes = "$_G_HAVE_XSI_OPS" then # This is an XSI compatible shell, allowing a faster implementation... eval 'func_split_short_opt () { $debug_cmd func_split_short_opt_arg=${1#??} func_split_short_opt_name=${1%"$func_split_short_opt_arg"} }' else # ...otherwise fall back to using expr, which is often a shell builtin. func_split_short_opt () { $debug_cmd func_split_short_opt_name=`expr "x$1" : 'x-\(.\)'` func_split_short_opt_arg=`expr "x$1" : 'x-.\(.*\)$'` } fi #func_split_short_opt # func_usage # ---------- # Echo short help message to standard output and exit. func_usage () { $debug_cmd func_usage_message $ECHO "Run '$progname --help |${PAGER-more}' for full usage" exit 0 } # func_usage_message # ------------------ # Echo short help message to standard output. func_usage_message () { $debug_cmd eval \$ECHO \""Usage: $usage"\" echo $SED -n 's|^# || /^Written by/{ x;p;x } h /^Written by/q' < "$progpath" echo eval \$ECHO \""$usage_message"\" } # func_version # ------------ # Echo version message to standard output and exit. func_version () { $debug_cmd printf '%s\n' "$progname $scriptversion" $SED -n ' /(C)/!b go :more /\./!{ N s|\n# | | b more } :go /^# Written by /,/# warranty; / { s|^# || s|^# *$|| s|\((C)\)[ 0-9,-]*[ ,-]\([1-9][0-9]* \)|\1 \2| p } /^# Written by / { s|^# || p } /^warranty; /q' < "$progpath" exit $? } # Local variables: # mode: shell-script # sh-indentation: 2 # eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-pattern: "10/scriptversion=%:y-%02m-%02d.%02H; # UTC" # time-stamp-time-zone: "UTC" # End: # Set a version string. scriptversion='(GNU libtool) 2.4.6' # func_echo ARG... # ---------------- # Libtool also displays the current mode in messages, so override # funclib.sh func_echo with this custom definition. func_echo () { $debug_cmd _G_message=$* func_echo_IFS=$IFS IFS=$nl for _G_line in $_G_message; do IFS=$func_echo_IFS $ECHO "$progname${opt_mode+: $opt_mode}: $_G_line" done IFS=$func_echo_IFS } # func_warning ARG... # ------------------- # Libtool warnings are not categorized, so override funclib.sh # func_warning with this simpler definition. func_warning () { $debug_cmd $warning_func ${1+"$@"} } ## ---------------- ## ## Options parsing. ## ## ---------------- ## # Hook in the functions to make sure our own options are parsed during # the option parsing loop. usage='$progpath [OPTION]... [MODE-ARG]...' # Short help message in response to '-h'. usage_message="Options: --config show all configuration variables --debug enable verbose shell tracing -n, --dry-run display commands without modifying any files --features display basic configuration information and exit --mode=MODE use operation mode MODE --no-warnings equivalent to '-Wnone' --preserve-dup-deps don't remove duplicate dependency libraries --quiet, --silent don't print informational messages --tag=TAG use configuration variables from tag TAG -v, --verbose print more informational messages than default --version print version information -W, --warnings=CATEGORY report the warnings falling in CATEGORY [all] -h, --help, --help-all print short, long, or detailed help message " # Additional text appended to 'usage_message' in response to '--help'. func_help () { $debug_cmd func_usage_message $ECHO "$long_help_message MODE must be one of the following: clean remove files from the build directory compile compile a source file into a libtool object execute automatically set library path, then run a program finish complete the installation of libtool libraries install install libraries or executables link create a library or an executable uninstall remove libraries from an installed directory MODE-ARGS vary depending on the MODE. When passed as first option, '--mode=MODE' may be abbreviated as 'MODE' or a unique abbreviation of that. Try '$progname --help --mode=MODE' for a more detailed description of MODE. When reporting a bug, please describe a test case to reproduce it and include the following information: host-triplet: $host shell: $SHELL compiler: $LTCC compiler flags: $LTCFLAGS linker: $LD (gnu? $with_gnu_ld) version: $progname (GNU libtool) 2.4.6 automake: `($AUTOMAKE --version) 2>/dev/null |$SED 1q` autoconf: `($AUTOCONF --version) 2>/dev/null |$SED 1q` Report bugs to . GNU libtool home page: . General help using GNU software: ." exit 0 } # func_lo2o OBJECT-NAME # --------------------- # Transform OBJECT-NAME from a '.lo' suffix to the platform specific # object suffix. lo2o=s/\\.lo\$/.$objext/ o2lo=s/\\.$objext\$/.lo/ if test yes = "$_G_HAVE_XSI_OPS"; then eval 'func_lo2o () { case $1 in *.lo) func_lo2o_result=${1%.lo}.$objext ;; * ) func_lo2o_result=$1 ;; esac }' # func_xform LIBOBJ-OR-SOURCE # --------------------------- # Transform LIBOBJ-OR-SOURCE from a '.o' or '.c' (or otherwise) # suffix to a '.lo' libtool-object suffix. eval 'func_xform () { func_xform_result=${1%.*}.lo }' else # ...otherwise fall back to using sed. func_lo2o () { func_lo2o_result=`$ECHO "$1" | $SED "$lo2o"` } func_xform () { func_xform_result=`$ECHO "$1" | $SED 's|\.[^.]*$|.lo|'` } fi # func_fatal_configuration ARG... # ------------------------------- # Echo program name prefixed message to standard error, followed by # a configuration failure hint, and exit. func_fatal_configuration () { func__fatal_error ${1+"$@"} \ "See the $PACKAGE documentation for more information." \ "Fatal configuration error." } # func_config # ----------- # Display the configuration for all the tags in this script. func_config () { re_begincf='^# ### BEGIN LIBTOOL' re_endcf='^# ### END LIBTOOL' # Default configuration. $SED "1,/$re_begincf CONFIG/d;/$re_endcf CONFIG/,\$d" < "$progpath" # Now print the configurations for the tags. for tagname in $taglist; do $SED -n "/$re_begincf TAG CONFIG: $tagname\$/,/$re_endcf TAG CONFIG: $tagname\$/p" < "$progpath" done exit $? } # func_features # ------------- # Display the features supported by this script. func_features () { echo "host: $host" if test yes = "$build_libtool_libs"; then echo "enable shared libraries" else echo "disable shared libraries" fi if test yes = "$build_old_libs"; then echo "enable static libraries" else echo "disable static libraries" fi exit $? } # func_enable_tag TAGNAME # ----------------------- # Verify that TAGNAME is valid, and either flag an error and exit, or # enable the TAGNAME tag. We also add TAGNAME to the global $taglist # variable here. func_enable_tag () { # Global variable: tagname=$1 re_begincf="^# ### BEGIN LIBTOOL TAG CONFIG: $tagname\$" re_endcf="^# ### END LIBTOOL TAG CONFIG: $tagname\$" sed_extractcf=/$re_begincf/,/$re_endcf/p # Validate tagname. case $tagname in *[!-_A-Za-z0-9,/]*) func_fatal_error "invalid tag name: $tagname" ;; esac # Don't test for the "default" C tag, as we know it's # there but not specially marked. case $tagname in CC) ;; *) if $GREP "$re_begincf" "$progpath" >/dev/null 2>&1; then taglist="$taglist $tagname" # Evaluate the configuration. Be careful to quote the path # and the sed script, to avoid splitting on whitespace, but # also don't use non-portable quotes within backquotes within # quotes we have to do it in 2 steps: extractedcf=`$SED -n -e "$sed_extractcf" < "$progpath"` eval "$extractedcf" else func_error "ignoring unknown tag $tagname" fi ;; esac } # func_check_version_match # ------------------------ # Ensure that we are using m4 macros, and libtool script from the same # release of libtool. func_check_version_match () { if test "$package_revision" != "$macro_revision"; then if test "$VERSION" != "$macro_version"; then if test -z "$macro_version"; then cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, but the $progname: definition of this LT_INIT comes from an older release. $progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION $progname: and run autoconf again. _LT_EOF else cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, but the $progname: definition of this LT_INIT comes from $PACKAGE $macro_version. $progname: You should recreate aclocal.m4 with macros from $PACKAGE $VERSION $progname: and run autoconf again. _LT_EOF fi else cat >&2 <<_LT_EOF $progname: Version mismatch error. This is $PACKAGE $VERSION, revision $package_revision, $progname: but the definition of this LT_INIT comes from revision $macro_revision. $progname: You should recreate aclocal.m4 with macros from revision $package_revision $progname: of $PACKAGE $VERSION and run autoconf again. _LT_EOF fi exit $EXIT_MISMATCH fi } # libtool_options_prep [ARG]... # ----------------------------- # Preparation for options parsed by libtool. libtool_options_prep () { $debug_mode # Option defaults: opt_config=false opt_dlopen= opt_dry_run=false opt_help=false opt_mode= opt_preserve_dup_deps=false opt_quiet=false nonopt= preserve_args= # Shorthand for --mode=foo, only valid as the first argument case $1 in clean|clea|cle|cl) shift; set dummy --mode clean ${1+"$@"}; shift ;; compile|compil|compi|comp|com|co|c) shift; set dummy --mode compile ${1+"$@"}; shift ;; execute|execut|execu|exec|exe|ex|e) shift; set dummy --mode execute ${1+"$@"}; shift ;; finish|finis|fini|fin|fi|f) shift; set dummy --mode finish ${1+"$@"}; shift ;; install|instal|insta|inst|ins|in|i) shift; set dummy --mode install ${1+"$@"}; shift ;; link|lin|li|l) shift; set dummy --mode link ${1+"$@"}; shift ;; uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u) shift; set dummy --mode uninstall ${1+"$@"}; shift ;; esac # Pass back the list of options. func_quote_for_eval ${1+"$@"} libtool_options_prep_result=$func_quote_for_eval_result } func_add_hook func_options_prep libtool_options_prep # libtool_parse_options [ARG]... # --------------------------------- # Provide handling for libtool specific options. libtool_parse_options () { $debug_cmd # Perform our own loop to consume as many options as possible in # each iteration. while test $# -gt 0; do _G_opt=$1 shift case $_G_opt in --dry-run|--dryrun|-n) opt_dry_run=: ;; --config) func_config ;; --dlopen|-dlopen) opt_dlopen="${opt_dlopen+$opt_dlopen }$1" shift ;; --preserve-dup-deps) opt_preserve_dup_deps=: ;; --features) func_features ;; --finish) set dummy --mode finish ${1+"$@"}; shift ;; --help) opt_help=: ;; --help-all) opt_help=': help-all' ;; --mode) test $# = 0 && func_missing_arg $_G_opt && break opt_mode=$1 case $1 in # Valid mode arguments: clean|compile|execute|finish|install|link|relink|uninstall) ;; # Catch anything else as an error *) func_error "invalid argument for $_G_opt" exit_cmd=exit break ;; esac shift ;; --no-silent|--no-quiet) opt_quiet=false func_append preserve_args " $_G_opt" ;; --no-warnings|--no-warning|--no-warn) opt_warning=false func_append preserve_args " $_G_opt" ;; --no-verbose) opt_verbose=false func_append preserve_args " $_G_opt" ;; --silent|--quiet) opt_quiet=: opt_verbose=false func_append preserve_args " $_G_opt" ;; --tag) test $# = 0 && func_missing_arg $_G_opt && break opt_tag=$1 func_append preserve_args " $_G_opt $1" func_enable_tag "$1" shift ;; --verbose|-v) opt_quiet=false opt_verbose=: func_append preserve_args " $_G_opt" ;; # An option not handled by this hook function: *) set dummy "$_G_opt" ${1+"$@"}; shift; break ;; esac done # save modified positional parameters for caller func_quote_for_eval ${1+"$@"} libtool_parse_options_result=$func_quote_for_eval_result } func_add_hook func_parse_options libtool_parse_options # libtool_validate_options [ARG]... # --------------------------------- # Perform any sanity checks on option settings and/or unconsumed # arguments. libtool_validate_options () { # save first non-option argument if test 0 -lt $#; then nonopt=$1 shift fi # preserve --debug test : = "$debug_cmd" || func_append preserve_args " --debug" case $host in # Solaris2 added to fix http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452 # see also: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788 *cygwin* | *mingw* | *pw32* | *cegcc* | *solaris2* | *os2*) # don't eliminate duplications in $postdeps and $predeps opt_duplicate_compiler_generated_deps=: ;; *) opt_duplicate_compiler_generated_deps=$opt_preserve_dup_deps ;; esac $opt_help || { # Sanity checks first: func_check_version_match test yes != "$build_libtool_libs" \ && test yes != "$build_old_libs" \ && func_fatal_configuration "not configured to build any kind of library" # Darwin sucks eval std_shrext=\"$shrext_cmds\" # Only execute mode is allowed to have -dlopen flags. if test -n "$opt_dlopen" && test execute != "$opt_mode"; then func_error "unrecognized option '-dlopen'" $ECHO "$help" 1>&2 exit $EXIT_FAILURE fi # Change the help message to a mode-specific one. generic_help=$help help="Try '$progname --help --mode=$opt_mode' for more information." } # Pass back the unparsed argument list func_quote_for_eval ${1+"$@"} libtool_validate_options_result=$func_quote_for_eval_result } func_add_hook func_validate_options libtool_validate_options # Process options as early as possible so that --help and --version # can return quickly. func_options ${1+"$@"} eval set dummy "$func_options_result"; shift ## ----------- ## ## Main. ## ## ----------- ## magic='%%%MAGIC variable%%%' magic_exe='%%%MAGIC EXE variable%%%' # Global variables. extracted_archives= extracted_serial=0 # If this variable is set in any of the actions, the command in it # will be execed at the end. This prevents here-documents from being # left over by shells. exec_cmd= # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $1 _LTECHO_EOF' } # func_generated_by_libtool # True iff stdin has been generated by Libtool. This function is only # a basic sanity check; it will hardly flush out determined imposters. func_generated_by_libtool_p () { $GREP "^# Generated by .*$PACKAGE" > /dev/null 2>&1 } # func_lalib_p file # True iff FILE is a libtool '.la' library or '.lo' object file. # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_lalib_p () { test -f "$1" && $SED -e 4q "$1" 2>/dev/null | func_generated_by_libtool_p } # func_lalib_unsafe_p file # True iff FILE is a libtool '.la' library or '.lo' object file. # This function implements the same check as func_lalib_p without # resorting to external programs. To this end, it redirects stdin and # closes it afterwards, without saving the original file descriptor. # As a safety measure, use it only where a negative result would be # fatal anyway. Works if 'file' does not exist. func_lalib_unsafe_p () { lalib_p=no if test -f "$1" && test -r "$1" && exec 5<&0 <"$1"; then for lalib_p_l in 1 2 3 4 do read lalib_p_line case $lalib_p_line in \#\ Generated\ by\ *$PACKAGE* ) lalib_p=yes; break;; esac done exec 0<&5 5<&- fi test yes = "$lalib_p" } # func_ltwrapper_script_p file # True iff FILE is a libtool wrapper script # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_script_p () { test -f "$1" && $lt_truncate_bin < "$1" 2>/dev/null | func_generated_by_libtool_p } # func_ltwrapper_executable_p file # True iff FILE is a libtool wrapper executable # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_executable_p () { func_ltwrapper_exec_suffix= case $1 in *.exe) ;; *) func_ltwrapper_exec_suffix=.exe ;; esac $GREP "$magic_exe" "$1$func_ltwrapper_exec_suffix" >/dev/null 2>&1 } # func_ltwrapper_scriptname file # Assumes file is an ltwrapper_executable # uses $file to determine the appropriate filename for a # temporary ltwrapper_script. func_ltwrapper_scriptname () { func_dirname_and_basename "$1" "" "." func_stripname '' '.exe' "$func_basename_result" func_ltwrapper_scriptname_result=$func_dirname_result/$objdir/${func_stripname_result}_ltshwrapper } # func_ltwrapper_p file # True iff FILE is a libtool wrapper script or wrapper executable # This function is only a basic sanity check; it will hardly flush out # determined imposters. func_ltwrapper_p () { func_ltwrapper_script_p "$1" || func_ltwrapper_executable_p "$1" } # func_execute_cmds commands fail_cmd # Execute tilde-delimited COMMANDS. # If FAIL_CMD is given, eval that upon failure. # FAIL_CMD may read-access the current command in variable CMD! func_execute_cmds () { $debug_cmd save_ifs=$IFS; IFS='~' for cmd in $1; do IFS=$sp$nl eval cmd=\"$cmd\" IFS=$save_ifs func_show_eval "$cmd" "${2-:}" done IFS=$save_ifs } # func_source file # Source FILE, adding directory component if necessary. # Note that it is not necessary on cygwin/mingw to append a dot to # FILE even if both FILE and FILE.exe exist: automatic-append-.exe # behavior happens only for exec(3), not for open(2)! Also, sourcing # 'FILE.' does not work on cygwin managed mounts. func_source () { $debug_cmd case $1 in */* | *\\*) . "$1" ;; *) . "./$1" ;; esac } # func_resolve_sysroot PATH # Replace a leading = in PATH with a sysroot. Store the result into # func_resolve_sysroot_result func_resolve_sysroot () { func_resolve_sysroot_result=$1 case $func_resolve_sysroot_result in =*) func_stripname '=' '' "$func_resolve_sysroot_result" func_resolve_sysroot_result=$lt_sysroot$func_stripname_result ;; esac } # func_replace_sysroot PATH # If PATH begins with the sysroot, replace it with = and # store the result into func_replace_sysroot_result. func_replace_sysroot () { case $lt_sysroot:$1 in ?*:"$lt_sysroot"*) func_stripname "$lt_sysroot" '' "$1" func_replace_sysroot_result='='$func_stripname_result ;; *) # Including no sysroot. func_replace_sysroot_result=$1 ;; esac } # func_infer_tag arg # Infer tagged configuration to use if any are available and # if one wasn't chosen via the "--tag" command line option. # Only attempt this if the compiler in the base compile # command doesn't match the default compiler. # arg is usually of the form 'gcc ...' func_infer_tag () { $debug_cmd if test -n "$available_tags" && test -z "$tagname"; then CC_quoted= for arg in $CC; do func_append_quoted CC_quoted "$arg" done CC_expanded=`func_echo_all $CC` CC_quoted_expanded=`func_echo_all $CC_quoted` case $@ in # Blanks in the command may have been stripped by the calling shell, # but not from the CC environment variable when configure was run. " $CC "* | "$CC "* | " $CC_expanded "* | "$CC_expanded "* | \ " $CC_quoted"* | "$CC_quoted "* | " $CC_quoted_expanded "* | "$CC_quoted_expanded "*) ;; # Blanks at the start of $base_compile will cause this to fail # if we don't check for them as well. *) for z in $available_tags; do if $GREP "^# ### BEGIN LIBTOOL TAG CONFIG: $z$" < "$progpath" > /dev/null; then # Evaluate the configuration. eval "`$SED -n -e '/^# ### BEGIN LIBTOOL TAG CONFIG: '$z'$/,/^# ### END LIBTOOL TAG CONFIG: '$z'$/p' < $progpath`" CC_quoted= for arg in $CC; do # Double-quote args containing other shell metacharacters. func_append_quoted CC_quoted "$arg" done CC_expanded=`func_echo_all $CC` CC_quoted_expanded=`func_echo_all $CC_quoted` case "$@ " in " $CC "* | "$CC "* | " $CC_expanded "* | "$CC_expanded "* | \ " $CC_quoted"* | "$CC_quoted "* | " $CC_quoted_expanded "* | "$CC_quoted_expanded "*) # The compiler in the base compile command matches # the one in the tagged configuration. # Assume this is the tagged configuration we want. tagname=$z break ;; esac fi done # If $tagname still isn't set, then no tagged configuration # was found and let the user know that the "--tag" command # line option must be used. if test -z "$tagname"; then func_echo "unable to infer tagged configuration" func_fatal_error "specify a tag with '--tag'" # else # func_verbose "using $tagname tagged configuration" fi ;; esac fi } # func_write_libtool_object output_name pic_name nonpic_name # Create a libtool object file (analogous to a ".la" file), # but don't create it if we're doing a dry run. func_write_libtool_object () { write_libobj=$1 if test yes = "$build_libtool_libs"; then write_lobj=\'$2\' else write_lobj=none fi if test yes = "$build_old_libs"; then write_oldobj=\'$3\' else write_oldobj=none fi $opt_dry_run || { cat >${write_libobj}T </dev/null` if test "$?" -eq 0 && test -n "$func_convert_core_file_wine_to_w32_tmp"; then func_convert_core_file_wine_to_w32_result=`$ECHO "$func_convert_core_file_wine_to_w32_tmp" | $SED -e "$sed_naive_backslashify"` else func_convert_core_file_wine_to_w32_result= fi fi } # end: func_convert_core_file_wine_to_w32 # func_convert_core_path_wine_to_w32 ARG # Helper function used by path conversion functions when $build is *nix, and # $host is mingw, cygwin, or some other w32 environment. Relies on a correctly # configured wine environment available, with the winepath program in $build's # $PATH. Assumes ARG has no leading or trailing path separator characters. # # ARG is path to be converted from $build format to win32. # Result is available in $func_convert_core_path_wine_to_w32_result. # Unconvertible file (directory) names in ARG are skipped; if no directory names # are convertible, then the result may be empty. func_convert_core_path_wine_to_w32 () { $debug_cmd # unfortunately, winepath doesn't convert paths, only file names func_convert_core_path_wine_to_w32_result= if test -n "$1"; then oldIFS=$IFS IFS=: for func_convert_core_path_wine_to_w32_f in $1; do IFS=$oldIFS func_convert_core_file_wine_to_w32 "$func_convert_core_path_wine_to_w32_f" if test -n "$func_convert_core_file_wine_to_w32_result"; then if test -z "$func_convert_core_path_wine_to_w32_result"; then func_convert_core_path_wine_to_w32_result=$func_convert_core_file_wine_to_w32_result else func_append func_convert_core_path_wine_to_w32_result ";$func_convert_core_file_wine_to_w32_result" fi fi done IFS=$oldIFS fi } # end: func_convert_core_path_wine_to_w32 # func_cygpath ARGS... # Wrapper around calling the cygpath program via LT_CYGPATH. This is used when # when (1) $build is *nix and Cygwin is hosted via a wine environment; or (2) # $build is MSYS and $host is Cygwin, or (3) $build is Cygwin. In case (1) or # (2), returns the Cygwin file name or path in func_cygpath_result (input # file name or path is assumed to be in w32 format, as previously converted # from $build's *nix or MSYS format). In case (3), returns the w32 file name # or path in func_cygpath_result (input file name or path is assumed to be in # Cygwin format). Returns an empty string on error. # # ARGS are passed to cygpath, with the last one being the file name or path to # be converted. # # Specify the absolute *nix (or w32) name to cygpath in the LT_CYGPATH # environment variable; do not put it in $PATH. func_cygpath () { $debug_cmd if test -n "$LT_CYGPATH" && test -f "$LT_CYGPATH"; then func_cygpath_result=`$LT_CYGPATH "$@" 2>/dev/null` if test "$?" -ne 0; then # on failure, ensure result is empty func_cygpath_result= fi else func_cygpath_result= func_error "LT_CYGPATH is empty or specifies non-existent file: '$LT_CYGPATH'" fi } #end: func_cygpath # func_convert_core_msys_to_w32 ARG # Convert file name or path ARG from MSYS format to w32 format. Return # result in func_convert_core_msys_to_w32_result. func_convert_core_msys_to_w32 () { $debug_cmd # awkward: cmd appends spaces to result func_convert_core_msys_to_w32_result=`( cmd //c echo "$1" ) 2>/dev/null | $SED -e 's/[ ]*$//' -e "$sed_naive_backslashify"` } #end: func_convert_core_msys_to_w32 # func_convert_file_check ARG1 ARG2 # Verify that ARG1 (a file name in $build format) was converted to $host # format in ARG2. Otherwise, emit an error message, but continue (resetting # func_to_host_file_result to ARG1). func_convert_file_check () { $debug_cmd if test -z "$2" && test -n "$1"; then func_error "Could not determine host file name corresponding to" func_error " '$1'" func_error "Continuing, but uninstalled executables may not work." # Fallback: func_to_host_file_result=$1 fi } # end func_convert_file_check # func_convert_path_check FROM_PATHSEP TO_PATHSEP FROM_PATH TO_PATH # Verify that FROM_PATH (a path in $build format) was converted to $host # format in TO_PATH. Otherwise, emit an error message, but continue, resetting # func_to_host_file_result to a simplistic fallback value (see below). func_convert_path_check () { $debug_cmd if test -z "$4" && test -n "$3"; then func_error "Could not determine the host path corresponding to" func_error " '$3'" func_error "Continuing, but uninstalled executables may not work." # Fallback. This is a deliberately simplistic "conversion" and # should not be "improved". See libtool.info. if test "x$1" != "x$2"; then lt_replace_pathsep_chars="s|$1|$2|g" func_to_host_path_result=`echo "$3" | $SED -e "$lt_replace_pathsep_chars"` else func_to_host_path_result=$3 fi fi } # end func_convert_path_check # func_convert_path_front_back_pathsep FRONTPAT BACKPAT REPL ORIG # Modifies func_to_host_path_result by prepending REPL if ORIG matches FRONTPAT # and appending REPL if ORIG matches BACKPAT. func_convert_path_front_back_pathsep () { $debug_cmd case $4 in $1 ) func_to_host_path_result=$3$func_to_host_path_result ;; esac case $4 in $2 ) func_append func_to_host_path_result "$3" ;; esac } # end func_convert_path_front_back_pathsep ################################################## # $build to $host FILE NAME CONVERSION FUNCTIONS # ################################################## # invoked via '$to_host_file_cmd ARG' # # In each case, ARG is the path to be converted from $build to $host format. # Result will be available in $func_to_host_file_result. # func_to_host_file ARG # Converts the file name ARG from $build format to $host format. Return result # in func_to_host_file_result. func_to_host_file () { $debug_cmd $to_host_file_cmd "$1" } # end func_to_host_file # func_to_tool_file ARG LAZY # converts the file name ARG from $build format to toolchain format. Return # result in func_to_tool_file_result. If the conversion in use is listed # in (the comma separated) LAZY, no conversion takes place. func_to_tool_file () { $debug_cmd case ,$2, in *,"$to_tool_file_cmd",*) func_to_tool_file_result=$1 ;; *) $to_tool_file_cmd "$1" func_to_tool_file_result=$func_to_host_file_result ;; esac } # end func_to_tool_file # func_convert_file_noop ARG # Copy ARG to func_to_host_file_result. func_convert_file_noop () { func_to_host_file_result=$1 } # end func_convert_file_noop # func_convert_file_msys_to_w32 ARG # Convert file name ARG from (mingw) MSYS to (mingw) w32 format; automatic # conversion to w32 is not available inside the cwrapper. Returns result in # func_to_host_file_result. func_convert_file_msys_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_msys_to_w32 "$1" func_to_host_file_result=$func_convert_core_msys_to_w32_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_msys_to_w32 # func_convert_file_cygwin_to_w32 ARG # Convert file name ARG from Cygwin to w32 format. Returns result in # func_to_host_file_result. func_convert_file_cygwin_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then # because $build is cygwin, we call "the" cygpath in $PATH; no need to use # LT_CYGPATH in this case. func_to_host_file_result=`cygpath -m "$1"` fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_cygwin_to_w32 # func_convert_file_nix_to_w32 ARG # Convert file name ARG from *nix to w32 format. Requires a wine environment # and a working winepath. Returns result in func_to_host_file_result. func_convert_file_nix_to_w32 () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_file_wine_to_w32 "$1" func_to_host_file_result=$func_convert_core_file_wine_to_w32_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_nix_to_w32 # func_convert_file_msys_to_cygwin ARG # Convert file name ARG from MSYS to Cygwin format. Requires LT_CYGPATH set. # Returns result in func_to_host_file_result. func_convert_file_msys_to_cygwin () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then func_convert_core_msys_to_w32 "$1" func_cygpath -u "$func_convert_core_msys_to_w32_result" func_to_host_file_result=$func_cygpath_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_msys_to_cygwin # func_convert_file_nix_to_cygwin ARG # Convert file name ARG from *nix to Cygwin format. Requires Cygwin installed # in a wine environment, working winepath, and LT_CYGPATH set. Returns result # in func_to_host_file_result. func_convert_file_nix_to_cygwin () { $debug_cmd func_to_host_file_result=$1 if test -n "$1"; then # convert from *nix to w32, then use cygpath to convert from w32 to cygwin. func_convert_core_file_wine_to_w32 "$1" func_cygpath -u "$func_convert_core_file_wine_to_w32_result" func_to_host_file_result=$func_cygpath_result fi func_convert_file_check "$1" "$func_to_host_file_result" } # end func_convert_file_nix_to_cygwin ############################################# # $build to $host PATH CONVERSION FUNCTIONS # ############################################# # invoked via '$to_host_path_cmd ARG' # # In each case, ARG is the path to be converted from $build to $host format. # The result will be available in $func_to_host_path_result. # # Path separators are also converted from $build format to $host format. If # ARG begins or ends with a path separator character, it is preserved (but # converted to $host format) on output. # # All path conversion functions are named using the following convention: # file name conversion function : func_convert_file_X_to_Y () # path conversion function : func_convert_path_X_to_Y () # where, for any given $build/$host combination the 'X_to_Y' value is the # same. If conversion functions are added for new $build/$host combinations, # the two new functions must follow this pattern, or func_init_to_host_path_cmd # will break. # func_init_to_host_path_cmd # Ensures that function "pointer" variable $to_host_path_cmd is set to the # appropriate value, based on the value of $to_host_file_cmd. to_host_path_cmd= func_init_to_host_path_cmd () { $debug_cmd if test -z "$to_host_path_cmd"; then func_stripname 'func_convert_file_' '' "$to_host_file_cmd" to_host_path_cmd=func_convert_path_$func_stripname_result fi } # func_to_host_path ARG # Converts the path ARG from $build format to $host format. Return result # in func_to_host_path_result. func_to_host_path () { $debug_cmd func_init_to_host_path_cmd $to_host_path_cmd "$1" } # end func_to_host_path # func_convert_path_noop ARG # Copy ARG to func_to_host_path_result. func_convert_path_noop () { func_to_host_path_result=$1 } # end func_convert_path_noop # func_convert_path_msys_to_w32 ARG # Convert path ARG from (mingw) MSYS to (mingw) w32 format; automatic # conversion to w32 is not available inside the cwrapper. Returns result in # func_to_host_path_result. func_convert_path_msys_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # Remove leading and trailing path separator characters from ARG. MSYS # behavior is inconsistent here; cygpath turns them into '.;' and ';.'; # and winepath ignores them completely. func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_msys_to_w32 "$func_to_host_path_tmp1" func_to_host_path_result=$func_convert_core_msys_to_w32_result func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_msys_to_w32 # func_convert_path_cygwin_to_w32 ARG # Convert path ARG from Cygwin to w32 format. Returns result in # func_to_host_file_result. func_convert_path_cygwin_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_to_host_path_result=`cygpath -m -p "$func_to_host_path_tmp1"` func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_cygwin_to_w32 # func_convert_path_nix_to_w32 ARG # Convert path ARG from *nix to w32 format. Requires a wine environment and # a working winepath. Returns result in func_to_host_file_result. func_convert_path_nix_to_w32 () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1" func_to_host_path_result=$func_convert_core_path_wine_to_w32_result func_convert_path_check : ";" \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" ";" "$1" fi } # end func_convert_path_nix_to_w32 # func_convert_path_msys_to_cygwin ARG # Convert path ARG from MSYS to Cygwin format. Requires LT_CYGPATH set. # Returns result in func_to_host_file_result. func_convert_path_msys_to_cygwin () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # See func_convert_path_msys_to_w32: func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_msys_to_w32 "$func_to_host_path_tmp1" func_cygpath -u -p "$func_convert_core_msys_to_w32_result" func_to_host_path_result=$func_cygpath_result func_convert_path_check : : \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" : "$1" fi } # end func_convert_path_msys_to_cygwin # func_convert_path_nix_to_cygwin ARG # Convert path ARG from *nix to Cygwin format. Requires Cygwin installed in a # a wine environment, working winepath, and LT_CYGPATH set. Returns result in # func_to_host_file_result. func_convert_path_nix_to_cygwin () { $debug_cmd func_to_host_path_result=$1 if test -n "$1"; then # Remove leading and trailing path separator characters from # ARG. msys behavior is inconsistent here, cygpath turns them # into '.;' and ';.', and winepath ignores them completely. func_stripname : : "$1" func_to_host_path_tmp1=$func_stripname_result func_convert_core_path_wine_to_w32 "$func_to_host_path_tmp1" func_cygpath -u -p "$func_convert_core_path_wine_to_w32_result" func_to_host_path_result=$func_cygpath_result func_convert_path_check : : \ "$func_to_host_path_tmp1" "$func_to_host_path_result" func_convert_path_front_back_pathsep ":*" "*:" : "$1" fi } # end func_convert_path_nix_to_cygwin # func_dll_def_p FILE # True iff FILE is a Windows DLL '.def' file. # Keep in sync with _LT_DLL_DEF_P in libtool.m4 func_dll_def_p () { $debug_cmd func_dll_def_p_tmp=`$SED -n \ -e 's/^[ ]*//' \ -e '/^\(;.*\)*$/d' \ -e 's/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p' \ -e q \ "$1"` test DEF = "$func_dll_def_p_tmp" } # func_mode_compile arg... func_mode_compile () { $debug_cmd # Get the compilation command and the source file. base_compile= srcfile=$nonopt # always keep a non-empty value in "srcfile" suppress_opt=yes suppress_output= arg_mode=normal libobj= later= pie_flag= for arg do case $arg_mode in arg ) # do not "continue". Instead, add this to base_compile lastarg=$arg arg_mode=normal ;; target ) libobj=$arg arg_mode=normal continue ;; normal ) # Accept any command-line options. case $arg in -o) test -n "$libobj" && \ func_fatal_error "you cannot specify '-o' more than once" arg_mode=target continue ;; -pie | -fpie | -fPIE) func_append pie_flag " $arg" continue ;; -shared | -static | -prefer-pic | -prefer-non-pic) func_append later " $arg" continue ;; -no-suppress) suppress_opt=no continue ;; -Xcompiler) arg_mode=arg # the next one goes into the "base_compile" arg list continue # The current "srcfile" will either be retained or ;; # replaced later. I would guess that would be a bug. -Wc,*) func_stripname '-Wc,' '' "$arg" args=$func_stripname_result lastarg= save_ifs=$IFS; IFS=, for arg in $args; do IFS=$save_ifs func_append_quoted lastarg "$arg" done IFS=$save_ifs func_stripname ' ' '' "$lastarg" lastarg=$func_stripname_result # Add the arguments to base_compile. func_append base_compile " $lastarg" continue ;; *) # Accept the current argument as the source file. # The previous "srcfile" becomes the current argument. # lastarg=$srcfile srcfile=$arg ;; esac # case $arg ;; esac # case $arg_mode # Aesthetically quote the previous argument. func_append_quoted base_compile "$lastarg" done # for arg case $arg_mode in arg) func_fatal_error "you must specify an argument for -Xcompile" ;; target) func_fatal_error "you must specify a target with '-o'" ;; *) # Get the name of the library object. test -z "$libobj" && { func_basename "$srcfile" libobj=$func_basename_result } ;; esac # Recognize several different file suffixes. # If the user specifies -o file.o, it is replaced with file.lo case $libobj in *.[cCFSifmso] | \ *.ada | *.adb | *.ads | *.asm | \ *.c++ | *.cc | *.ii | *.class | *.cpp | *.cxx | \ *.[fF][09]? | *.for | *.java | *.go | *.obj | *.sx | *.cu | *.cup) func_xform "$libobj" libobj=$func_xform_result ;; esac case $libobj in *.lo) func_lo2o "$libobj"; obj=$func_lo2o_result ;; *) func_fatal_error "cannot determine name of library object from '$libobj'" ;; esac func_infer_tag $base_compile for arg in $later; do case $arg in -shared) test yes = "$build_libtool_libs" \ || func_fatal_configuration "cannot build a shared library" build_old_libs=no continue ;; -static) build_libtool_libs=no build_old_libs=yes continue ;; -prefer-pic) pic_mode=yes continue ;; -prefer-non-pic) pic_mode=no continue ;; esac done func_quote_for_eval "$libobj" test "X$libobj" != "X$func_quote_for_eval_result" \ && $ECHO "X$libobj" | $GREP '[]~#^*{};<>?"'"'"' &()|`$[]' \ && func_warning "libobj name '$libobj' may not contain shell special characters." func_dirname_and_basename "$obj" "/" "" objname=$func_basename_result xdir=$func_dirname_result lobj=$xdir$objdir/$objname test -z "$base_compile" && \ func_fatal_help "you must specify a compilation command" # Delete any leftover library objects. if test yes = "$build_old_libs"; then removelist="$obj $lobj $libobj ${libobj}T" else removelist="$lobj $libobj ${libobj}T" fi # On Cygwin there's no "real" PIC flag so we must build both object types case $host_os in cygwin* | mingw* | pw32* | os2* | cegcc*) pic_mode=default ;; esac if test no = "$pic_mode" && test pass_all != "$deplibs_check_method"; then # non-PIC code in shared libraries is not supported pic_mode=default fi # Calculate the filename of the output object if compiler does # not support -o with -c if test no = "$compiler_c_o"; then output_obj=`$ECHO "$srcfile" | $SED 's%^.*/%%; s%\.[^.]*$%%'`.$objext lockfile=$output_obj.lock else output_obj= need_locks=no lockfile= fi # Lock this critical section if it is needed # We use this script file to make the link, it avoids creating a new file if test yes = "$need_locks"; then until $opt_dry_run || ln "$progpath" "$lockfile" 2>/dev/null; do func_echo "Waiting for $lockfile to be removed" sleep 2 done elif test warn = "$need_locks"; then if test -f "$lockfile"; then $ECHO "\ *** ERROR, $lockfile exists and contains: `cat $lockfile 2>/dev/null` This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi func_append removelist " $output_obj" $ECHO "$srcfile" > "$lockfile" fi $opt_dry_run || $RM $removelist func_append removelist " $lockfile" trap '$opt_dry_run || $RM $removelist; exit $EXIT_FAILURE' 1 2 15 func_to_tool_file "$srcfile" func_convert_file_msys_to_w32 srcfile=$func_to_tool_file_result func_quote_for_eval "$srcfile" qsrcfile=$func_quote_for_eval_result # Only build a PIC object if we are building libtool libraries. if test yes = "$build_libtool_libs"; then # Without this assignment, base_compile gets emptied. fbsd_hideous_sh_bug=$base_compile if test no != "$pic_mode"; then command="$base_compile $qsrcfile $pic_flag" else # Don't build PIC code command="$base_compile $qsrcfile" fi func_mkdir_p "$xdir$objdir" if test -z "$output_obj"; then # Place PIC objects in $objdir func_append command " -o $lobj" fi func_show_eval_locale "$command" \ 'test -n "$output_obj" && $RM $removelist; exit $EXIT_FAILURE' if test warn = "$need_locks" && test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then $ECHO "\ *** ERROR, $lockfile contains: `cat $lockfile 2>/dev/null` but it should contain: $srcfile This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi # Just move the object if needed, then go on to compile the next one if test -n "$output_obj" && test "X$output_obj" != "X$lobj"; then func_show_eval '$MV "$output_obj" "$lobj"' \ 'error=$?; $opt_dry_run || $RM $removelist; exit $error' fi # Allow error messages only from the first compilation. if test yes = "$suppress_opt"; then suppress_output=' >/dev/null 2>&1' fi fi # Only build a position-dependent object if we build old libraries. if test yes = "$build_old_libs"; then if test yes != "$pic_mode"; then # Don't build PIC code command="$base_compile $qsrcfile$pie_flag" else command="$base_compile $qsrcfile $pic_flag" fi if test yes = "$compiler_c_o"; then func_append command " -o $obj" fi # Suppress compiler output if we already did a PIC compilation. func_append command "$suppress_output" func_show_eval_locale "$command" \ '$opt_dry_run || $RM $removelist; exit $EXIT_FAILURE' if test warn = "$need_locks" && test "X`cat $lockfile 2>/dev/null`" != "X$srcfile"; then $ECHO "\ *** ERROR, $lockfile contains: `cat $lockfile 2>/dev/null` but it should contain: $srcfile This indicates that another process is trying to use the same temporary object file, and libtool could not work around it because your compiler does not support '-c' and '-o' together. If you repeat this compilation, it may succeed, by chance, but you had better avoid parallel builds (make -j) in this platform, or get a better compiler." $opt_dry_run || $RM $removelist exit $EXIT_FAILURE fi # Just move the object if needed if test -n "$output_obj" && test "X$output_obj" != "X$obj"; then func_show_eval '$MV "$output_obj" "$obj"' \ 'error=$?; $opt_dry_run || $RM $removelist; exit $error' fi fi $opt_dry_run || { func_write_libtool_object "$libobj" "$objdir/$objname" "$objname" # Unlock the critical section if it was locked if test no != "$need_locks"; then removelist=$lockfile $RM "$lockfile" fi } exit $EXIT_SUCCESS } $opt_help || { test compile = "$opt_mode" && func_mode_compile ${1+"$@"} } func_mode_help () { # We need to display help for each of the modes. case $opt_mode in "") # Generic help is extracted from the usage comments # at the start of this file. func_help ;; clean) $ECHO \ "Usage: $progname [OPTION]... --mode=clean RM [RM-OPTION]... FILE... Remove files from the build directory. RM is the name of the program to use to delete files associated with each FILE (typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed to RM. If FILE is a libtool library, object or program, all the files associated with it are deleted. Otherwise, only FILE itself is deleted using RM." ;; compile) $ECHO \ "Usage: $progname [OPTION]... --mode=compile COMPILE-COMMAND... SOURCEFILE Compile a source file into a libtool library object. This mode accepts the following additional options: -o OUTPUT-FILE set the output file name to OUTPUT-FILE -no-suppress do not suppress compiler output for multiple passes -prefer-pic try to build PIC objects only -prefer-non-pic try to build non-PIC objects only -shared do not build a '.o' file suitable for static linking -static only build a '.o' file suitable for static linking -Wc,FLAG pass FLAG directly to the compiler COMPILE-COMMAND is a command to be used in creating a 'standard' object file from the given SOURCEFILE. The output file name is determined by removing the directory component from SOURCEFILE, then substituting the C source code suffix '.c' with the library object suffix, '.lo'." ;; execute) $ECHO \ "Usage: $progname [OPTION]... --mode=execute COMMAND [ARGS]... Automatically set library path, then run a program. This mode accepts the following additional options: -dlopen FILE add the directory containing FILE to the library path This mode sets the library path environment variable according to '-dlopen' flags. If any of the ARGS are libtool executable wrappers, then they are translated into their corresponding uninstalled binary, and any of their required library directories are added to the library path. Then, COMMAND is executed, with ARGS as arguments." ;; finish) $ECHO \ "Usage: $progname [OPTION]... --mode=finish [LIBDIR]... Complete the installation of libtool libraries. Each LIBDIR is a directory that contains libtool libraries. The commands that this mode executes may require superuser privileges. Use the '--dry-run' option if you just want to see what would be executed." ;; install) $ECHO \ "Usage: $progname [OPTION]... --mode=install INSTALL-COMMAND... Install executables or libraries. INSTALL-COMMAND is the installation command. The first component should be either the 'install' or 'cp' program. The following components of INSTALL-COMMAND are treated specially: -inst-prefix-dir PREFIX-DIR Use PREFIX-DIR as a staging area for installation The rest of the components are interpreted as arguments to that command (only BSD-compatible install options are recognized)." ;; link) $ECHO \ "Usage: $progname [OPTION]... --mode=link LINK-COMMAND... Link object files or libraries together to form another library, or to create an executable program. LINK-COMMAND is a command using the C compiler that you would use to create a program from several object files. The following components of LINK-COMMAND are treated specially: -all-static do not do any dynamic linking at all -avoid-version do not add a version suffix if possible -bindir BINDIR specify path to binaries directory (for systems where libraries must be found in the PATH setting at runtime) -dlopen FILE '-dlpreopen' FILE if it cannot be dlopened at runtime -dlpreopen FILE link in FILE and add its symbols to lt_preloaded_symbols -export-dynamic allow symbols from OUTPUT-FILE to be resolved with dlsym(3) -export-symbols SYMFILE try to export only the symbols listed in SYMFILE -export-symbols-regex REGEX try to export only the symbols matching REGEX -LLIBDIR search LIBDIR for required installed libraries -lNAME OUTPUT-FILE requires the installed library libNAME -module build a library that can dlopened -no-fast-install disable the fast-install mode -no-install link a not-installable executable -no-undefined declare that a library does not refer to external symbols -o OUTPUT-FILE create OUTPUT-FILE from the specified objects -objectlist FILE use a list of object files found in FILE to specify objects -os2dllname NAME force a short DLL name on OS/2 (no effect on other OSes) -precious-files-regex REGEX don't remove output files matching REGEX -release RELEASE specify package release information -rpath LIBDIR the created library will eventually be installed in LIBDIR -R[ ]LIBDIR add LIBDIR to the runtime path of programs and libraries -shared only do dynamic linking of libtool libraries -shrext SUFFIX override the standard shared library file extension -static do not do any dynamic linking of uninstalled libtool libraries -static-libtool-libs do not do any dynamic linking of libtool libraries -version-info CURRENT[:REVISION[:AGE]] specify library version info [each variable defaults to 0] -weak LIBNAME declare that the target provides the LIBNAME interface -Wc,FLAG -Xcompiler FLAG pass linker-specific FLAG directly to the compiler -Wl,FLAG -Xlinker FLAG pass linker-specific FLAG directly to the linker -XCClinker FLAG pass link-specific FLAG to the compiler driver (CC) All other options (arguments beginning with '-') are ignored. Every other argument is treated as a filename. Files ending in '.la' are treated as uninstalled libtool libraries, other files are standard or library object files. If the OUTPUT-FILE ends in '.la', then a libtool library is created, only library objects ('.lo' files) may be specified, and '-rpath' is required, except when creating a convenience library. If OUTPUT-FILE ends in '.a' or '.lib', then a standard library is created using 'ar' and 'ranlib', or on Windows using 'lib'. If OUTPUT-FILE ends in '.lo' or '.$objext', then a reloadable object file is created, otherwise an executable program is created." ;; uninstall) $ECHO \ "Usage: $progname [OPTION]... --mode=uninstall RM [RM-OPTION]... FILE... Remove libraries from an installation directory. RM is the name of the program to use to delete files associated with each FILE (typically '/bin/rm'). RM-OPTIONS are options (such as '-f') to be passed to RM. If FILE is a libtool library, all the files associated with it are deleted. Otherwise, only FILE itself is deleted using RM." ;; *) func_fatal_help "invalid operation mode '$opt_mode'" ;; esac echo $ECHO "Try '$progname --help' for more information about other modes." } # Now that we've collected a possible --mode arg, show help if necessary if $opt_help; then if test : = "$opt_help"; then func_mode_help else { func_help noexit for opt_mode in compile link execute install finish uninstall clean; do func_mode_help done } | $SED -n '1p; 2,$s/^Usage:/ or: /p' { func_help noexit for opt_mode in compile link execute install finish uninstall clean; do echo func_mode_help done } | $SED '1d /^When reporting/,/^Report/{ H d } $x /information about other modes/d /more detailed .*MODE/d s/^Usage:.*--mode=\([^ ]*\) .*/Description of \1 mode:/' fi exit $? fi # func_mode_execute arg... func_mode_execute () { $debug_cmd # The first argument is the command name. cmd=$nonopt test -z "$cmd" && \ func_fatal_help "you must specify a COMMAND" # Handle -dlopen flags immediately. for file in $opt_dlopen; do test -f "$file" \ || func_fatal_help "'$file' is not a file" dir= case $file in *.la) func_resolve_sysroot "$file" file=$func_resolve_sysroot_result # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$file" \ || func_fatal_help "'$lib' is not a valid libtool archive" # Read the libtool library. dlname= library_names= func_source "$file" # Skip this library if it cannot be dlopened. if test -z "$dlname"; then # Warn if it was a shared library. test -n "$library_names" && \ func_warning "'$file' was not linked with '-export-dynamic'" continue fi func_dirname "$file" "" "." dir=$func_dirname_result if test -f "$dir/$objdir/$dlname"; then func_append dir "/$objdir" else if test ! -f "$dir/$dlname"; then func_fatal_error "cannot find '$dlname' in '$dir' or '$dir/$objdir'" fi fi ;; *.lo) # Just add the directory containing the .lo file. func_dirname "$file" "" "." dir=$func_dirname_result ;; *) func_warning "'-dlopen' is ignored for non-libtool libraries and objects" continue ;; esac # Get the absolute pathname. absdir=`cd "$dir" && pwd` test -n "$absdir" && dir=$absdir # Now add the directory to shlibpath_var. if eval "test -z \"\$$shlibpath_var\""; then eval "$shlibpath_var=\"\$dir\"" else eval "$shlibpath_var=\"\$dir:\$$shlibpath_var\"" fi done # This variable tells wrapper scripts just to set shlibpath_var # rather than running their programs. libtool_execute_magic=$magic # Check if any of the arguments is a wrapper script. args= for file do case $file in -* | *.la | *.lo ) ;; *) # Do a test to see if this is really a libtool program. if func_ltwrapper_script_p "$file"; then func_source "$file" # Transform arg to wrapped name. file=$progdir/$program elif func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" func_source "$func_ltwrapper_scriptname_result" # Transform arg to wrapped name. file=$progdir/$program fi ;; esac # Quote arguments (to preserve shell metacharacters). func_append_quoted args "$file" done if $opt_dry_run; then # Display what would be done. if test -n "$shlibpath_var"; then eval "\$ECHO \"\$shlibpath_var=\$$shlibpath_var\"" echo "export $shlibpath_var" fi $ECHO "$cmd$args" exit $EXIT_SUCCESS else if test -n "$shlibpath_var"; then # Export the shlibpath_var. eval "export $shlibpath_var" fi # Restore saved environment variables for lt_var in LANG LANGUAGE LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES do eval "if test \"\${save_$lt_var+set}\" = set; then $lt_var=\$save_$lt_var; export $lt_var else $lt_unset $lt_var fi" done # Now prepare to actually exec the command. exec_cmd=\$cmd$args fi } test execute = "$opt_mode" && func_mode_execute ${1+"$@"} # func_mode_finish arg... func_mode_finish () { $debug_cmd libs= libdirs= admincmds= for opt in "$nonopt" ${1+"$@"} do if test -d "$opt"; then func_append libdirs " $opt" elif test -f "$opt"; then if func_lalib_unsafe_p "$opt"; then func_append libs " $opt" else func_warning "'$opt' is not a valid libtool archive" fi else func_fatal_error "invalid argument '$opt'" fi done if test -n "$libs"; then if test -n "$lt_sysroot"; then sysroot_regex=`$ECHO "$lt_sysroot" | $SED "$sed_make_literal_regex"` sysroot_cmd="s/\([ ']\)$sysroot_regex/\1/g;" else sysroot_cmd= fi # Remove sysroot references if $opt_dry_run; then for lib in $libs; do echo "removing references to $lt_sysroot and '=' prefixes from $lib" done else tmpdir=`func_mktempdir` for lib in $libs; do $SED -e "$sysroot_cmd s/\([ ']-[LR]\)=/\1/g; s/\([ ']\)=/\1/g" $lib \ > $tmpdir/tmp-la mv -f $tmpdir/tmp-la $lib done ${RM}r "$tmpdir" fi fi if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then for libdir in $libdirs; do if test -n "$finish_cmds"; then # Do each command in the finish commands. func_execute_cmds "$finish_cmds" 'admincmds="$admincmds '"$cmd"'"' fi if test -n "$finish_eval"; then # Do the single finish_eval. eval cmds=\"$finish_eval\" $opt_dry_run || eval "$cmds" || func_append admincmds " $cmds" fi done fi # Exit here if they wanted silent mode. $opt_quiet && exit $EXIT_SUCCESS if test -n "$finish_cmds$finish_eval" && test -n "$libdirs"; then echo "----------------------------------------------------------------------" echo "Libraries have been installed in:" for libdir in $libdirs; do $ECHO " $libdir" done echo echo "If you ever happen to want to link against installed libraries" echo "in a given directory, LIBDIR, you must either use libtool, and" echo "specify the full pathname of the library, or use the '-LLIBDIR'" echo "flag during linking and do at least one of the following:" if test -n "$shlibpath_var"; then echo " - add LIBDIR to the '$shlibpath_var' environment variable" echo " during execution" fi if test -n "$runpath_var"; then echo " - add LIBDIR to the '$runpath_var' environment variable" echo " during linking" fi if test -n "$hardcode_libdir_flag_spec"; then libdir=LIBDIR eval flag=\"$hardcode_libdir_flag_spec\" $ECHO " - use the '$flag' linker flag" fi if test -n "$admincmds"; then $ECHO " - have your system administrator run these commands:$admincmds" fi if test -f /etc/ld.so.conf; then echo " - have your system administrator add LIBDIR to '/etc/ld.so.conf'" fi echo echo "See any operating system documentation about shared libraries for" case $host in solaris2.[6789]|solaris2.1[0-9]) echo "more information, such as the ld(1), crle(1) and ld.so(8) manual" echo "pages." ;; *) echo "more information, such as the ld(1) and ld.so(8) manual pages." ;; esac echo "----------------------------------------------------------------------" fi exit $EXIT_SUCCESS } test finish = "$opt_mode" && func_mode_finish ${1+"$@"} # func_mode_install arg... func_mode_install () { $debug_cmd # There may be an optional sh(1) argument at the beginning of # install_prog (especially on Windows NT). if test "$SHELL" = "$nonopt" || test /bin/sh = "$nonopt" || # Allow the use of GNU shtool's install command. case $nonopt in *shtool*) :;; *) false;; esac then # Aesthetically quote it. func_quote_for_eval "$nonopt" install_prog="$func_quote_for_eval_result " arg=$1 shift else install_prog= arg=$nonopt fi # The real first argument should be the name of the installation program. # Aesthetically quote it. func_quote_for_eval "$arg" func_append install_prog "$func_quote_for_eval_result" install_shared_prog=$install_prog case " $install_prog " in *[\\\ /]cp\ *) install_cp=: ;; *) install_cp=false ;; esac # We need to accept at least all the BSD install flags. dest= files= opts= prev= install_type= isdir=false stripme= no_mode=: for arg do arg2= if test -n "$dest"; then func_append files " $dest" dest=$arg continue fi case $arg in -d) isdir=: ;; -f) if $install_cp; then :; else prev=$arg fi ;; -g | -m | -o) prev=$arg ;; -s) stripme=" -s" continue ;; -*) ;; *) # If the previous option needed an argument, then skip it. if test -n "$prev"; then if test X-m = "X$prev" && test -n "$install_override_mode"; then arg2=$install_override_mode no_mode=false fi prev= else dest=$arg continue fi ;; esac # Aesthetically quote the argument. func_quote_for_eval "$arg" func_append install_prog " $func_quote_for_eval_result" if test -n "$arg2"; then func_quote_for_eval "$arg2" fi func_append install_shared_prog " $func_quote_for_eval_result" done test -z "$install_prog" && \ func_fatal_help "you must specify an install program" test -n "$prev" && \ func_fatal_help "the '$prev' option requires an argument" if test -n "$install_override_mode" && $no_mode; then if $install_cp; then :; else func_quote_for_eval "$install_override_mode" func_append install_shared_prog " -m $func_quote_for_eval_result" fi fi if test -z "$files"; then if test -z "$dest"; then func_fatal_help "no file or destination specified" else func_fatal_help "you must specify a destination" fi fi # Strip any trailing slash from the destination. func_stripname '' '/' "$dest" dest=$func_stripname_result # Check to see that the destination is a directory. test -d "$dest" && isdir=: if $isdir; then destdir=$dest destname= else func_dirname_and_basename "$dest" "" "." destdir=$func_dirname_result destname=$func_basename_result # Not a directory, so check to see that there is only one file specified. set dummy $files; shift test "$#" -gt 1 && \ func_fatal_help "'$dest' is not a directory" fi case $destdir in [\\/]* | [A-Za-z]:[\\/]*) ;; *) for file in $files; do case $file in *.lo) ;; *) func_fatal_help "'$destdir' must be an absolute directory name" ;; esac done ;; esac # This variable tells wrapper scripts just to set variables rather # than running their programs. libtool_install_magic=$magic staticlibs= future_libdirs= current_libdirs= for file in $files; do # Do each installation. case $file in *.$libext) # Do the static libraries later. func_append staticlibs " $file" ;; *.la) func_resolve_sysroot "$file" file=$func_resolve_sysroot_result # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$file" \ || func_fatal_help "'$file' is not a valid libtool archive" library_names= old_library= relink_command= func_source "$file" # Add the libdir to current_libdirs if it is the destination. if test "X$destdir" = "X$libdir"; then case "$current_libdirs " in *" $libdir "*) ;; *) func_append current_libdirs " $libdir" ;; esac else # Note the libdir as a future libdir. case "$future_libdirs " in *" $libdir "*) ;; *) func_append future_libdirs " $libdir" ;; esac fi func_dirname "$file" "/" "" dir=$func_dirname_result func_append dir "$objdir" if test -n "$relink_command"; then # Determine the prefix the user has applied to our future dir. inst_prefix_dir=`$ECHO "$destdir" | $SED -e "s%$libdir\$%%"` # Don't allow the user to place us outside of our expected # location b/c this prevents finding dependent libraries that # are installed to the same prefix. # At present, this check doesn't affect windows .dll's that # are installed into $libdir/../bin (currently, that works fine) # but it's something to keep an eye on. test "$inst_prefix_dir" = "$destdir" && \ func_fatal_error "error: cannot install '$file' to a directory not ending in $libdir" if test -n "$inst_prefix_dir"; then # Stick the inst_prefix_dir data into the link command. relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%-inst-prefix-dir $inst_prefix_dir%"` else relink_command=`$ECHO "$relink_command" | $SED "s%@inst_prefix_dir@%%"` fi func_warning "relinking '$file'" func_show_eval "$relink_command" \ 'func_fatal_error "error: relink '\''$file'\'' with the above command before installing it"' fi # See the names of the shared library. set dummy $library_names; shift if test -n "$1"; then realname=$1 shift srcname=$realname test -n "$relink_command" && srcname=${realname}T # Install the shared library and build the symlinks. func_show_eval "$install_shared_prog $dir/$srcname $destdir/$realname" \ 'exit $?' tstripme=$stripme case $host_os in cygwin* | mingw* | pw32* | cegcc*) case $realname in *.dll.a) tstripme= ;; esac ;; os2*) case $realname in *_dll.a) tstripme= ;; esac ;; esac if test -n "$tstripme" && test -n "$striplib"; then func_show_eval "$striplib $destdir/$realname" 'exit $?' fi if test "$#" -gt 0; then # Delete the old symlinks, and create new ones. # Try 'ln -sf' first, because the 'ln' binary might depend on # the symlink we replace! Solaris /bin/ln does not understand -f, # so we also need to try rm && ln -s. for linkname do test "$linkname" != "$realname" \ && func_show_eval "(cd $destdir && { $LN_S -f $realname $linkname || { $RM $linkname && $LN_S $realname $linkname; }; })" done fi # Do each command in the postinstall commands. lib=$destdir/$realname func_execute_cmds "$postinstall_cmds" 'exit $?' fi # Install the pseudo-library for information purposes. func_basename "$file" name=$func_basename_result instname=$dir/${name}i func_show_eval "$install_prog $instname $destdir/$name" 'exit $?' # Maybe install the static library, too. test -n "$old_library" && func_append staticlibs " $dir/$old_library" ;; *.lo) # Install (i.e. copy) a libtool object. # Figure out destination file name, if it wasn't already specified. if test -n "$destname"; then destfile=$destdir/$destname else func_basename "$file" destfile=$func_basename_result destfile=$destdir/$destfile fi # Deduce the name of the destination old-style object file. case $destfile in *.lo) func_lo2o "$destfile" staticdest=$func_lo2o_result ;; *.$objext) staticdest=$destfile destfile= ;; *) func_fatal_help "cannot copy a libtool object to '$destfile'" ;; esac # Install the libtool object if requested. test -n "$destfile" && \ func_show_eval "$install_prog $file $destfile" 'exit $?' # Install the old object if enabled. if test yes = "$build_old_libs"; then # Deduce the name of the old-style object file. func_lo2o "$file" staticobj=$func_lo2o_result func_show_eval "$install_prog \$staticobj \$staticdest" 'exit $?' fi exit $EXIT_SUCCESS ;; *) # Figure out destination file name, if it wasn't already specified. if test -n "$destname"; then destfile=$destdir/$destname else func_basename "$file" destfile=$func_basename_result destfile=$destdir/$destfile fi # If the file is missing, and there is a .exe on the end, strip it # because it is most likely a libtool script we actually want to # install stripped_ext= case $file in *.exe) if test ! -f "$file"; then func_stripname '' '.exe' "$file" file=$func_stripname_result stripped_ext=.exe fi ;; esac # Do a test to see if this is really a libtool program. case $host in *cygwin* | *mingw*) if func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" wrapper=$func_ltwrapper_scriptname_result else func_stripname '' '.exe' "$file" wrapper=$func_stripname_result fi ;; *) wrapper=$file ;; esac if func_ltwrapper_script_p "$wrapper"; then notinst_deplibs= relink_command= func_source "$wrapper" # Check the variables that should have been set. test -z "$generated_by_libtool_version" && \ func_fatal_error "invalid libtool wrapper script '$wrapper'" finalize=: for lib in $notinst_deplibs; do # Check to see that each library is installed. libdir= if test -f "$lib"; then func_source "$lib" fi libfile=$libdir/`$ECHO "$lib" | $SED 's%^.*/%%g'` if test -n "$libdir" && test ! -f "$libfile"; then func_warning "'$lib' has not been installed in '$libdir'" finalize=false fi done relink_command= func_source "$wrapper" outputname= if test no = "$fast_install" && test -n "$relink_command"; then $opt_dry_run || { if $finalize; then tmpdir=`func_mktempdir` func_basename "$file$stripped_ext" file=$func_basename_result outputname=$tmpdir/$file # Replace the output file specification. relink_command=`$ECHO "$relink_command" | $SED 's%@OUTPUT@%'"$outputname"'%g'` $opt_quiet || { func_quote_for_expand "$relink_command" eval "func_echo $func_quote_for_expand_result" } if eval "$relink_command"; then : else func_error "error: relink '$file' with the above command before installing it" $opt_dry_run || ${RM}r "$tmpdir" continue fi file=$outputname else func_warning "cannot relink '$file'" fi } else # Install the binary that we compiled earlier. file=`$ECHO "$file$stripped_ext" | $SED "s%\([^/]*\)$%$objdir/\1%"` fi fi # remove .exe since cygwin /usr/bin/install will append another # one anyway case $install_prog,$host in */usr/bin/install*,*cygwin*) case $file:$destfile in *.exe:*.exe) # this is ok ;; *.exe:*) destfile=$destfile.exe ;; *:*.exe) func_stripname '' '.exe' "$destfile" destfile=$func_stripname_result ;; esac ;; esac func_show_eval "$install_prog\$stripme \$file \$destfile" 'exit $?' $opt_dry_run || if test -n "$outputname"; then ${RM}r "$tmpdir" fi ;; esac done for file in $staticlibs; do func_basename "$file" name=$func_basename_result # Set up the ranlib parameters. oldlib=$destdir/$name func_to_tool_file "$oldlib" func_convert_file_msys_to_w32 tool_oldlib=$func_to_tool_file_result func_show_eval "$install_prog \$file \$oldlib" 'exit $?' if test -n "$stripme" && test -n "$old_striplib"; then func_show_eval "$old_striplib $tool_oldlib" 'exit $?' fi # Do each command in the postinstall commands. func_execute_cmds "$old_postinstall_cmds" 'exit $?' done test -n "$future_libdirs" && \ func_warning "remember to run '$progname --finish$future_libdirs'" if test -n "$current_libdirs"; then # Maybe just do a dry run. $opt_dry_run && current_libdirs=" -n$current_libdirs" exec_cmd='$SHELL "$progpath" $preserve_args --finish$current_libdirs' else exit $EXIT_SUCCESS fi } test install = "$opt_mode" && func_mode_install ${1+"$@"} # func_generate_dlsyms outputname originator pic_p # Extract symbols from dlprefiles and create ${outputname}S.o with # a dlpreopen symbol table. func_generate_dlsyms () { $debug_cmd my_outputname=$1 my_originator=$2 my_pic_p=${3-false} my_prefix=`$ECHO "$my_originator" | $SED 's%[^a-zA-Z0-9]%_%g'` my_dlsyms= if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then if test -n "$NM" && test -n "$global_symbol_pipe"; then my_dlsyms=${my_outputname}S.c else func_error "not configured to extract global symbols from dlpreopened files" fi fi if test -n "$my_dlsyms"; then case $my_dlsyms in "") ;; *.c) # Discover the nlist of each of the dlfiles. nlist=$output_objdir/$my_outputname.nm func_show_eval "$RM $nlist ${nlist}S ${nlist}T" # Parse the name list into a source file. func_verbose "creating $output_objdir/$my_dlsyms" $opt_dry_run || $ECHO > "$output_objdir/$my_dlsyms" "\ /* $my_dlsyms - symbol resolution table for '$my_outputname' dlsym emulation. */ /* Generated by $PROGRAM (GNU $PACKAGE) $VERSION */ #ifdef __cplusplus extern \"C\" { #endif #if defined __GNUC__ && (((__GNUC__ == 4) && (__GNUC_MINOR__ >= 4)) || (__GNUC__ > 4)) #pragma GCC diagnostic ignored \"-Wstrict-prototypes\" #endif /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT_DLSYM_CONST #else # define LT_DLSYM_CONST const #endif #define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0) /* External symbol declarations for the compiler. */\ " if test yes = "$dlself"; then func_verbose "generating symbol list for '$output'" $opt_dry_run || echo ': @PROGRAM@ ' > "$nlist" # Add our own program objects to the symbol list. progfiles=`$ECHO "$objs$old_deplibs" | $SP2NL | $SED "$lo2o" | $NL2SP` for progfile in $progfiles; do func_to_tool_file "$progfile" func_convert_file_msys_to_w32 func_verbose "extracting global C symbols from '$func_to_tool_file_result'" $opt_dry_run || eval "$NM $func_to_tool_file_result | $global_symbol_pipe >> '$nlist'" done if test -n "$exclude_expsyms"; then $opt_dry_run || { eval '$EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' } fi if test -n "$export_symbols_regex"; then $opt_dry_run || { eval '$EGREP -e "$export_symbols_regex" "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' } fi # Prepare the list of exported symbols if test -z "$export_symbols"; then export_symbols=$output_objdir/$outputname.exp $opt_dry_run || { $RM $export_symbols eval "$SED -n -e '/^: @PROGRAM@ $/d' -e 's/^.* \(.*\)$/\1/p' "'< "$nlist" > "$export_symbols"' case $host in *cygwin* | *mingw* | *cegcc* ) eval "echo EXPORTS "'> "$output_objdir/$outputname.def"' eval 'cat "$export_symbols" >> "$output_objdir/$outputname.def"' ;; esac } else $opt_dry_run || { eval "$SED -e 's/\([].[*^$]\)/\\\\\1/g' -e 's/^/ /' -e 's/$/$/'"' < "$export_symbols" > "$output_objdir/$outputname.exp"' eval '$GREP -f "$output_objdir/$outputname.exp" < "$nlist" > "$nlist"T' eval '$MV "$nlist"T "$nlist"' case $host in *cygwin* | *mingw* | *cegcc* ) eval "echo EXPORTS "'> "$output_objdir/$outputname.def"' eval 'cat "$nlist" >> "$output_objdir/$outputname.def"' ;; esac } fi fi for dlprefile in $dlprefiles; do func_verbose "extracting global C symbols from '$dlprefile'" func_basename "$dlprefile" name=$func_basename_result case $host in *cygwin* | *mingw* | *cegcc* ) # if an import library, we need to obtain dlname if func_win32_import_lib_p "$dlprefile"; then func_tr_sh "$dlprefile" eval "curr_lafile=\$libfile_$func_tr_sh_result" dlprefile_dlbasename= if test -n "$curr_lafile" && func_lalib_p "$curr_lafile"; then # Use subshell, to avoid clobbering current variable values dlprefile_dlname=`source "$curr_lafile" && echo "$dlname"` if test -n "$dlprefile_dlname"; then func_basename "$dlprefile_dlname" dlprefile_dlbasename=$func_basename_result else # no lafile. user explicitly requested -dlpreopen . $sharedlib_from_linklib_cmd "$dlprefile" dlprefile_dlbasename=$sharedlib_from_linklib_result fi fi $opt_dry_run || { if test -n "$dlprefile_dlbasename"; then eval '$ECHO ": $dlprefile_dlbasename" >> "$nlist"' else func_warning "Could not compute DLL name from $name" eval '$ECHO ": $name " >> "$nlist"' fi func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe | $SED -e '/I __imp/d' -e 's/I __nm_/D /;s/_nm__//' >> '$nlist'" } else # not an import lib $opt_dry_run || { eval '$ECHO ": $name " >> "$nlist"' func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe >> '$nlist'" } fi ;; *) $opt_dry_run || { eval '$ECHO ": $name " >> "$nlist"' func_to_tool_file "$dlprefile" func_convert_file_msys_to_w32 eval "$NM \"$func_to_tool_file_result\" 2>/dev/null | $global_symbol_pipe >> '$nlist'" } ;; esac done $opt_dry_run || { # Make sure we have at least an empty file. test -f "$nlist" || : > "$nlist" if test -n "$exclude_expsyms"; then $EGREP -v " ($exclude_expsyms)$" "$nlist" > "$nlist"T $MV "$nlist"T "$nlist" fi # Try sorting and uniquifying the output. if $GREP -v "^: " < "$nlist" | if sort -k 3 /dev/null 2>&1; then sort -k 3 else sort +2 fi | uniq > "$nlist"S; then : else $GREP -v "^: " < "$nlist" > "$nlist"S fi if test -f "$nlist"S; then eval "$global_symbol_to_cdecl"' < "$nlist"S >> "$output_objdir/$my_dlsyms"' else echo '/* NONE */' >> "$output_objdir/$my_dlsyms" fi func_show_eval '$RM "${nlist}I"' if test -n "$global_symbol_to_import"; then eval "$global_symbol_to_import"' < "$nlist"S > "$nlist"I' fi echo >> "$output_objdir/$my_dlsyms" "\ /* The mapping between symbol names and symbols. */ typedef struct { const char *name; void *address; } lt_dlsymlist; extern LT_DLSYM_CONST lt_dlsymlist lt_${my_prefix}_LTX_preloaded_symbols[];\ " if test -s "$nlist"I; then echo >> "$output_objdir/$my_dlsyms" "\ static void lt_syminit(void) { LT_DLSYM_CONST lt_dlsymlist *symbol = lt_${my_prefix}_LTX_preloaded_symbols; for (; symbol->name; ++symbol) {" $SED 's/.*/ if (STREQ (symbol->name, \"&\")) symbol->address = (void *) \&&;/' < "$nlist"I >> "$output_objdir/$my_dlsyms" echo >> "$output_objdir/$my_dlsyms" "\ } }" fi echo >> "$output_objdir/$my_dlsyms" "\ LT_DLSYM_CONST lt_dlsymlist lt_${my_prefix}_LTX_preloaded_symbols[] = { {\"$my_originator\", (void *) 0}," if test -s "$nlist"I; then echo >> "$output_objdir/$my_dlsyms" "\ {\"@INIT@\", (void *) <_syminit}," fi case $need_lib_prefix in no) eval "$global_symbol_to_c_name_address" < "$nlist" >> "$output_objdir/$my_dlsyms" ;; *) eval "$global_symbol_to_c_name_address_lib_prefix" < "$nlist" >> "$output_objdir/$my_dlsyms" ;; esac echo >> "$output_objdir/$my_dlsyms" "\ {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt_${my_prefix}_LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif\ " } # !$opt_dry_run pic_flag_for_symtable= case "$compile_command " in *" -static "*) ;; *) case $host in # compiling the symbol table file with pic_flag works around # a FreeBSD bug that causes programs to crash when -lm is # linked before any other PIC object. But we must not use # pic_flag when linking with -static. The problem exists in # FreeBSD 2.2.6 and is fixed in FreeBSD 3.1. *-*-freebsd2.*|*-*-freebsd3.0*|*-*-freebsdelf3.0*) pic_flag_for_symtable=" $pic_flag -DFREEBSD_WORKAROUND" ;; *-*-hpux*) pic_flag_for_symtable=" $pic_flag" ;; *) $my_pic_p && pic_flag_for_symtable=" $pic_flag" ;; esac ;; esac symtab_cflags= for arg in $LTCFLAGS; do case $arg in -pie | -fpie | -fPIE) ;; *) func_append symtab_cflags " $arg" ;; esac done # Now compile the dynamic symbol file. func_show_eval '(cd $output_objdir && $LTCC$symtab_cflags -c$no_builtin_flag$pic_flag_for_symtable "$my_dlsyms")' 'exit $?' # Clean up the generated files. func_show_eval '$RM "$output_objdir/$my_dlsyms" "$nlist" "${nlist}S" "${nlist}T" "${nlist}I"' # Transform the symbol file into the correct name. symfileobj=$output_objdir/${my_outputname}S.$objext case $host in *cygwin* | *mingw* | *cegcc* ) if test -f "$output_objdir/$my_outputname.def"; then compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$output_objdir/$my_outputname.def $symfileobj%"` else compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$symfileobj%"` fi ;; *) compile_command=`$ECHO "$compile_command" | $SED "s%@SYMFILE@%$symfileobj%"` finalize_command=`$ECHO "$finalize_command" | $SED "s%@SYMFILE@%$symfileobj%"` ;; esac ;; *) func_fatal_error "unknown suffix for '$my_dlsyms'" ;; esac else # We keep going just in case the user didn't refer to # lt_preloaded_symbols. The linker will fail if global_symbol_pipe # really was required. # Nullify the symbol file. compile_command=`$ECHO "$compile_command" | $SED "s% @SYMFILE@%%"` finalize_command=`$ECHO "$finalize_command" | $SED "s% @SYMFILE@%%"` fi } # func_cygming_gnu_implib_p ARG # This predicate returns with zero status (TRUE) if # ARG is a GNU/binutils-style import library. Returns # with nonzero status (FALSE) otherwise. func_cygming_gnu_implib_p () { $debug_cmd func_to_tool_file "$1" func_convert_file_msys_to_w32 func_cygming_gnu_implib_tmp=`$NM "$func_to_tool_file_result" | eval "$global_symbol_pipe" | $EGREP ' (_head_[A-Za-z0-9_]+_[ad]l*|[A-Za-z0-9_]+_[ad]l*_iname)$'` test -n "$func_cygming_gnu_implib_tmp" } # func_cygming_ms_implib_p ARG # This predicate returns with zero status (TRUE) if # ARG is an MS-style import library. Returns # with nonzero status (FALSE) otherwise. func_cygming_ms_implib_p () { $debug_cmd func_to_tool_file "$1" func_convert_file_msys_to_w32 func_cygming_ms_implib_tmp=`$NM "$func_to_tool_file_result" | eval "$global_symbol_pipe" | $GREP '_NULL_IMPORT_DESCRIPTOR'` test -n "$func_cygming_ms_implib_tmp" } # func_win32_libid arg # return the library type of file 'arg' # # Need a lot of goo to handle *both* DLLs and import libs # Has to be a shell function in order to 'eat' the argument # that is supplied when $file_magic_command is called. # Despite the name, also deal with 64 bit binaries. func_win32_libid () { $debug_cmd win32_libid_type=unknown win32_fileres=`file -L $1 2>/dev/null` case $win32_fileres in *ar\ archive\ import\ library*) # definitely import win32_libid_type="x86 archive import" ;; *ar\ archive*) # could be an import, or static # Keep the egrep pattern in sync with the one in _LT_CHECK_MAGIC_METHOD. if eval $OBJDUMP -f $1 | $SED -e '10q' 2>/dev/null | $EGREP 'file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' >/dev/null; then case $nm_interface in "MS dumpbin") if func_cygming_ms_implib_p "$1" || func_cygming_gnu_implib_p "$1" then win32_nmres=import else win32_nmres= fi ;; *) func_to_tool_file "$1" func_convert_file_msys_to_w32 win32_nmres=`eval $NM -f posix -A \"$func_to_tool_file_result\" | $SED -n -e ' 1,100{ / I /{ s|.*|import| p q } }'` ;; esac case $win32_nmres in import*) win32_libid_type="x86 archive import";; *) win32_libid_type="x86 archive static";; esac fi ;; *DLL*) win32_libid_type="x86 DLL" ;; *executable*) # but shell scripts are "executable" too... case $win32_fileres in *MS\ Windows\ PE\ Intel*) win32_libid_type="x86 DLL" ;; esac ;; esac $ECHO "$win32_libid_type" } # func_cygming_dll_for_implib ARG # # Platform-specific function to extract the # name of the DLL associated with the specified # import library ARG. # Invoked by eval'ing the libtool variable # $sharedlib_from_linklib_cmd # Result is available in the variable # $sharedlib_from_linklib_result func_cygming_dll_for_implib () { $debug_cmd sharedlib_from_linklib_result=`$DLLTOOL --identify-strict --identify "$1"` } # func_cygming_dll_for_implib_fallback_core SECTION_NAME LIBNAMEs # # The is the core of a fallback implementation of a # platform-specific function to extract the name of the # DLL associated with the specified import library LIBNAME. # # SECTION_NAME is either .idata$6 or .idata$7, depending # on the platform and compiler that created the implib. # # Echos the name of the DLL associated with the # specified import library. func_cygming_dll_for_implib_fallback_core () { $debug_cmd match_literal=`$ECHO "$1" | $SED "$sed_make_literal_regex"` $OBJDUMP -s --section "$1" "$2" 2>/dev/null | $SED '/^Contents of section '"$match_literal"':/{ # Place marker at beginning of archive member dllname section s/.*/====MARK====/ p d } # These lines can sometimes be longer than 43 characters, but # are always uninteresting /:[ ]*file format pe[i]\{,1\}-/d /^In archive [^:]*:/d # Ensure marker is printed /^====MARK====/p # Remove all lines with less than 43 characters /^.\{43\}/!d # From remaining lines, remove first 43 characters s/^.\{43\}//' | $SED -n ' # Join marker and all lines until next marker into a single line /^====MARK====/ b para H $ b para b :para x s/\n//g # Remove the marker s/^====MARK====// # Remove trailing dots and whitespace s/[\. \t]*$// # Print /./p' | # we now have a list, one entry per line, of the stringified # contents of the appropriate section of all members of the # archive that possess that section. Heuristic: eliminate # all those that have a first or second character that is # a '.' (that is, objdump's representation of an unprintable # character.) This should work for all archives with less than # 0x302f exports -- but will fail for DLLs whose name actually # begins with a literal '.' or a single character followed by # a '.'. # # Of those that remain, print the first one. $SED -e '/^\./d;/^.\./d;q' } # func_cygming_dll_for_implib_fallback ARG # Platform-specific function to extract the # name of the DLL associated with the specified # import library ARG. # # This fallback implementation is for use when $DLLTOOL # does not support the --identify-strict option. # Invoked by eval'ing the libtool variable # $sharedlib_from_linklib_cmd # Result is available in the variable # $sharedlib_from_linklib_result func_cygming_dll_for_implib_fallback () { $debug_cmd if func_cygming_gnu_implib_p "$1"; then # binutils import library sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$7' "$1"` elif func_cygming_ms_implib_p "$1"; then # ms-generated import library sharedlib_from_linklib_result=`func_cygming_dll_for_implib_fallback_core '.idata$6' "$1"` else # unknown sharedlib_from_linklib_result= fi } # func_extract_an_archive dir oldlib func_extract_an_archive () { $debug_cmd f_ex_an_ar_dir=$1; shift f_ex_an_ar_oldlib=$1 if test yes = "$lock_old_archive_extraction"; then lockfile=$f_ex_an_ar_oldlib.lock until $opt_dry_run || ln "$progpath" "$lockfile" 2>/dev/null; do func_echo "Waiting for $lockfile to be removed" sleep 2 done fi func_show_eval "(cd \$f_ex_an_ar_dir && $AR x \"\$f_ex_an_ar_oldlib\")" \ 'stat=$?; rm -f "$lockfile"; exit $stat' if test yes = "$lock_old_archive_extraction"; then $opt_dry_run || rm -f "$lockfile" fi if ($AR t "$f_ex_an_ar_oldlib" | sort | sort -uc >/dev/null 2>&1); then : else func_fatal_error "object name conflicts in archive: $f_ex_an_ar_dir/$f_ex_an_ar_oldlib" fi } # func_extract_archives gentop oldlib ... func_extract_archives () { $debug_cmd my_gentop=$1; shift my_oldlibs=${1+"$@"} my_oldobjs= my_xlib= my_xabs= my_xdir= for my_xlib in $my_oldlibs; do # Extract the objects. case $my_xlib in [\\/]* | [A-Za-z]:[\\/]*) my_xabs=$my_xlib ;; *) my_xabs=`pwd`"/$my_xlib" ;; esac func_basename "$my_xlib" my_xlib=$func_basename_result my_xlib_u=$my_xlib while :; do case " $extracted_archives " in *" $my_xlib_u "*) func_arith $extracted_serial + 1 extracted_serial=$func_arith_result my_xlib_u=lt$extracted_serial-$my_xlib ;; *) break ;; esac done extracted_archives="$extracted_archives $my_xlib_u" my_xdir=$my_gentop/$my_xlib_u func_mkdir_p "$my_xdir" case $host in *-darwin*) func_verbose "Extracting $my_xabs" # Do not bother doing anything if just a dry run $opt_dry_run || { darwin_orig_dir=`pwd` cd $my_xdir || exit $? darwin_archive=$my_xabs darwin_curdir=`pwd` func_basename "$darwin_archive" darwin_base_archive=$func_basename_result darwin_arches=`$LIPO -info "$darwin_archive" 2>/dev/null | $GREP Architectures 2>/dev/null || true` if test -n "$darwin_arches"; then darwin_arches=`$ECHO "$darwin_arches" | $SED -e 's/.*are://'` darwin_arch= func_verbose "$darwin_base_archive has multiple architectures $darwin_arches" for darwin_arch in $darwin_arches; do func_mkdir_p "unfat-$$/$darwin_base_archive-$darwin_arch" $LIPO -thin $darwin_arch -output "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive" "$darwin_archive" cd "unfat-$$/$darwin_base_archive-$darwin_arch" func_extract_an_archive "`pwd`" "$darwin_base_archive" cd "$darwin_curdir" $RM "unfat-$$/$darwin_base_archive-$darwin_arch/$darwin_base_archive" done # $darwin_arches ## Okay now we've a bunch of thin objects, gotta fatten them up :) darwin_filelist=`find unfat-$$ -type f -name \*.o -print -o -name \*.lo -print | $SED -e "$sed_basename" | sort -u` darwin_file= darwin_files= for darwin_file in $darwin_filelist; do darwin_files=`find unfat-$$ -name $darwin_file -print | sort | $NL2SP` $LIPO -create -output "$darwin_file" $darwin_files done # $darwin_filelist $RM -rf unfat-$$ cd "$darwin_orig_dir" else cd $darwin_orig_dir func_extract_an_archive "$my_xdir" "$my_xabs" fi # $darwin_arches } # !$opt_dry_run ;; *) func_extract_an_archive "$my_xdir" "$my_xabs" ;; esac my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | sort | $NL2SP` done func_extract_archives_result=$my_oldobjs } # func_emit_wrapper [arg=no] # # Emit a libtool wrapper script on stdout. # Don't directly open a file because we may want to # incorporate the script contents within a cygwin/mingw # wrapper executable. Must ONLY be called from within # func_mode_link because it depends on a number of variables # set therein. # # ARG is the value that the WRAPPER_SCRIPT_BELONGS_IN_OBJDIR # variable will take. If 'yes', then the emitted script # will assume that the directory where it is stored is # the $objdir directory. This is a cygwin/mingw-specific # behavior. func_emit_wrapper () { func_emit_wrapper_arg1=${1-no} $ECHO "\ #! $SHELL # $output - temporary wrapper script for $objdir/$outputname # Generated by $PROGRAM (GNU $PACKAGE) $VERSION # # The $output program cannot be directly executed until all the libtool # libraries that it depends on are installed. # # This wrapper script should never be moved out of the build directory. # If it is, it will not operate correctly. # Sed substitution that helps us do robust quoting. It backslashifies # metacharacters that are still active within double-quoted strings. sed_quote_subst='$sed_quote_subst' # Be Bourne compatible if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Zsh 3.x and 4.x performs word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in *posix*) set -o posix;; esac fi BIN_SH=xpg4; export BIN_SH # for Tru64 DUALCASE=1; export DUALCASE # for MKS sh # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH relink_command=\"$relink_command\" # This environment variable determines our operation mode. if test \"\$libtool_install_magic\" = \"$magic\"; then # install mode needs the following variables: generated_by_libtool_version='$macro_version' notinst_deplibs='$notinst_deplibs' else # When we are sourced in execute mode, \$file and \$ECHO are already set. if test \"\$libtool_execute_magic\" != \"$magic\"; then file=\"\$0\"" qECHO=`$ECHO "$ECHO" | $SED "$sed_quote_subst"` $ECHO "\ # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$1 _LTECHO_EOF' } ECHO=\"$qECHO\" fi # Very basic option parsing. These options are (a) specific to # the libtool wrapper, (b) are identical between the wrapper # /script/ and the wrapper /executable/ that is used only on # windows platforms, and (c) all begin with the string "--lt-" # (application programs are unlikely to have options that match # this pattern). # # There are only two supported options: --lt-debug and # --lt-dump-script. There is, deliberately, no --lt-help. # # The first argument to this parsing function should be the # script's $0 value, followed by "$@". lt_option_debug= func_parse_lt_options () { lt_script_arg0=\$0 shift for lt_opt do case \"\$lt_opt\" in --lt-debug) lt_option_debug=1 ;; --lt-dump-script) lt_dump_D=\`\$ECHO \"X\$lt_script_arg0\" | $SED -e 's/^X//' -e 's%/[^/]*$%%'\` test \"X\$lt_dump_D\" = \"X\$lt_script_arg0\" && lt_dump_D=. lt_dump_F=\`\$ECHO \"X\$lt_script_arg0\" | $SED -e 's/^X//' -e 's%^.*/%%'\` cat \"\$lt_dump_D/\$lt_dump_F\" exit 0 ;; --lt-*) \$ECHO \"Unrecognized --lt- option: '\$lt_opt'\" 1>&2 exit 1 ;; esac done # Print the debug banner immediately: if test -n \"\$lt_option_debug\"; then echo \"$outputname:$output:\$LINENO: libtool wrapper (GNU $PACKAGE) $VERSION\" 1>&2 fi } # Used when --lt-debug. Prints its arguments to stdout # (redirection is the responsibility of the caller) func_lt_dump_args () { lt_dump_args_N=1; for lt_arg do \$ECHO \"$outputname:$output:\$LINENO: newargv[\$lt_dump_args_N]: \$lt_arg\" lt_dump_args_N=\`expr \$lt_dump_args_N + 1\` done } # Core function for launching the target application func_exec_program_core () { " case $host in # Backslashes separate directories on plain windows *-*-mingw | *-*-os2* | *-cegcc*) $ECHO "\ if test -n \"\$lt_option_debug\"; then \$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir\\\\\$program\" 1>&2 func_lt_dump_args \${1+\"\$@\"} 1>&2 fi exec \"\$progdir\\\\\$program\" \${1+\"\$@\"} " ;; *) $ECHO "\ if test -n \"\$lt_option_debug\"; then \$ECHO \"$outputname:$output:\$LINENO: newargv[0]: \$progdir/\$program\" 1>&2 func_lt_dump_args \${1+\"\$@\"} 1>&2 fi exec \"\$progdir/\$program\" \${1+\"\$@\"} " ;; esac $ECHO "\ \$ECHO \"\$0: cannot exec \$program \$*\" 1>&2 exit 1 } # A function to encapsulate launching the target application # Strips options in the --lt-* namespace from \$@ and # launches target application with the remaining arguments. func_exec_program () { case \" \$* \" in *\\ --lt-*) for lt_wr_arg do case \$lt_wr_arg in --lt-*) ;; *) set x \"\$@\" \"\$lt_wr_arg\"; shift;; esac shift done ;; esac func_exec_program_core \${1+\"\$@\"} } # Parse options func_parse_lt_options \"\$0\" \${1+\"\$@\"} # Find the directory that this script lives in. thisdir=\`\$ECHO \"\$file\" | $SED 's%/[^/]*$%%'\` test \"x\$thisdir\" = \"x\$file\" && thisdir=. # Follow symbolic links until we get to the real thisdir. file=\`ls -ld \"\$file\" | $SED -n 's/.*-> //p'\` while test -n \"\$file\"; do destdir=\`\$ECHO \"\$file\" | $SED 's%/[^/]*\$%%'\` # If there was a directory component, then change thisdir. if test \"x\$destdir\" != \"x\$file\"; then case \"\$destdir\" in [\\\\/]* | [A-Za-z]:[\\\\/]*) thisdir=\"\$destdir\" ;; *) thisdir=\"\$thisdir/\$destdir\" ;; esac fi file=\`\$ECHO \"\$file\" | $SED 's%^.*/%%'\` file=\`ls -ld \"\$thisdir/\$file\" | $SED -n 's/.*-> //p'\` done # Usually 'no', except on cygwin/mingw when embedded into # the cwrapper. WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=$func_emit_wrapper_arg1 if test \"\$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR\" = \"yes\"; then # special case for '.' if test \"\$thisdir\" = \".\"; then thisdir=\`pwd\` fi # remove .libs from thisdir case \"\$thisdir\" in *[\\\\/]$objdir ) thisdir=\`\$ECHO \"\$thisdir\" | $SED 's%[\\\\/][^\\\\/]*$%%'\` ;; $objdir ) thisdir=. ;; esac fi # Try to get the absolute directory name. absdir=\`cd \"\$thisdir\" && pwd\` test -n \"\$absdir\" && thisdir=\"\$absdir\" " if test yes = "$fast_install"; then $ECHO "\ program=lt-'$outputname'$exeext progdir=\"\$thisdir/$objdir\" if test ! -f \"\$progdir/\$program\" || { file=\`ls -1dt \"\$progdir/\$program\" \"\$progdir/../\$program\" 2>/dev/null | $SED 1q\`; \\ test \"X\$file\" != \"X\$progdir/\$program\"; }; then file=\"\$\$-\$program\" if test ! -d \"\$progdir\"; then $MKDIR \"\$progdir\" else $RM \"\$progdir/\$file\" fi" $ECHO "\ # relink executable if necessary if test -n \"\$relink_command\"; then if relink_command_output=\`eval \$relink_command 2>&1\`; then : else \$ECHO \"\$relink_command_output\" >&2 $RM \"\$progdir/\$file\" exit 1 fi fi $MV \"\$progdir/\$file\" \"\$progdir/\$program\" 2>/dev/null || { $RM \"\$progdir/\$program\"; $MV \"\$progdir/\$file\" \"\$progdir/\$program\"; } $RM \"\$progdir/\$file\" fi" else $ECHO "\ program='$outputname' progdir=\"\$thisdir/$objdir\" " fi $ECHO "\ if test -f \"\$progdir/\$program\"; then" # fixup the dll searchpath if we need to. # # Fix the DLL searchpath if we need to. Do this before prepending # to shlibpath, because on Windows, both are PATH and uninstalled # libraries must come first. if test -n "$dllsearchpath"; then $ECHO "\ # Add the dll search path components to the executable PATH PATH=$dllsearchpath:\$PATH " fi # Export our shlibpath_var if we have one. if test yes = "$shlibpath_overrides_runpath" && test -n "$shlibpath_var" && test -n "$temp_rpath"; then $ECHO "\ # Add our own library path to $shlibpath_var $shlibpath_var=\"$temp_rpath\$$shlibpath_var\" # Some systems cannot cope with colon-terminated $shlibpath_var # The second colon is a workaround for a bug in BeOS R4 sed $shlibpath_var=\`\$ECHO \"\$$shlibpath_var\" | $SED 's/::*\$//'\` export $shlibpath_var " fi $ECHO "\ if test \"\$libtool_execute_magic\" != \"$magic\"; then # Run the actual program with our arguments. func_exec_program \${1+\"\$@\"} fi else # The program doesn't exist. \$ECHO \"\$0: error: '\$progdir/\$program' does not exist\" 1>&2 \$ECHO \"This script is just a wrapper for \$program.\" 1>&2 \$ECHO \"See the $PACKAGE documentation for more information.\" 1>&2 exit 1 fi fi\ " } # func_emit_cwrapperexe_src # emit the source code for a wrapper executable on stdout # Must ONLY be called from within func_mode_link because # it depends on a number of variable set therein. func_emit_cwrapperexe_src () { cat < #include #ifdef _MSC_VER # include # include # include #else # include # include # ifdef __CYGWIN__ # include # endif #endif #include #include #include #include #include #include #include #include #define STREQ(s1, s2) (strcmp ((s1), (s2)) == 0) /* declarations of non-ANSI functions */ #if defined __MINGW32__ # ifdef __STRICT_ANSI__ int _putenv (const char *); # endif #elif defined __CYGWIN__ # ifdef __STRICT_ANSI__ char *realpath (const char *, char *); int putenv (char *); int setenv (const char *, const char *, int); # endif /* #elif defined other_platform || defined ... */ #endif /* portability defines, excluding path handling macros */ #if defined _MSC_VER # define setmode _setmode # define stat _stat # define chmod _chmod # define getcwd _getcwd # define putenv _putenv # define S_IXUSR _S_IEXEC #elif defined __MINGW32__ # define setmode _setmode # define stat _stat # define chmod _chmod # define getcwd _getcwd # define putenv _putenv #elif defined __CYGWIN__ # define HAVE_SETENV # define FOPEN_WB "wb" /* #elif defined other platforms ... */ #endif #if defined PATH_MAX # define LT_PATHMAX PATH_MAX #elif defined MAXPATHLEN # define LT_PATHMAX MAXPATHLEN #else # define LT_PATHMAX 1024 #endif #ifndef S_IXOTH # define S_IXOTH 0 #endif #ifndef S_IXGRP # define S_IXGRP 0 #endif /* path handling portability macros */ #ifndef DIR_SEPARATOR # define DIR_SEPARATOR '/' # define PATH_SEPARATOR ':' #endif #if defined _WIN32 || defined __MSDOS__ || defined __DJGPP__ || \ defined __OS2__ # define HAVE_DOS_BASED_FILE_SYSTEM # define FOPEN_WB "wb" # ifndef DIR_SEPARATOR_2 # define DIR_SEPARATOR_2 '\\' # endif # ifndef PATH_SEPARATOR_2 # define PATH_SEPARATOR_2 ';' # endif #endif #ifndef DIR_SEPARATOR_2 # define IS_DIR_SEPARATOR(ch) ((ch) == DIR_SEPARATOR) #else /* DIR_SEPARATOR_2 */ # define IS_DIR_SEPARATOR(ch) \ (((ch) == DIR_SEPARATOR) || ((ch) == DIR_SEPARATOR_2)) #endif /* DIR_SEPARATOR_2 */ #ifndef PATH_SEPARATOR_2 # define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR) #else /* PATH_SEPARATOR_2 */ # define IS_PATH_SEPARATOR(ch) ((ch) == PATH_SEPARATOR_2) #endif /* PATH_SEPARATOR_2 */ #ifndef FOPEN_WB # define FOPEN_WB "w" #endif #ifndef _O_BINARY # define _O_BINARY 0 #endif #define XMALLOC(type, num) ((type *) xmalloc ((num) * sizeof(type))) #define XFREE(stale) do { \ if (stale) { free (stale); stale = 0; } \ } while (0) #if defined LT_DEBUGWRAPPER static int lt_debug = 1; #else static int lt_debug = 0; #endif const char *program_name = "libtool-wrapper"; /* in case xstrdup fails */ void *xmalloc (size_t num); char *xstrdup (const char *string); const char *base_name (const char *name); char *find_executable (const char *wrapper); char *chase_symlinks (const char *pathspec); int make_executable (const char *path); int check_executable (const char *path); char *strendzap (char *str, const char *pat); void lt_debugprintf (const char *file, int line, const char *fmt, ...); void lt_fatal (const char *file, int line, const char *message, ...); static const char *nonnull (const char *s); static const char *nonempty (const char *s); void lt_setenv (const char *name, const char *value); char *lt_extend_str (const char *orig_value, const char *add, int to_end); void lt_update_exe_path (const char *name, const char *value); void lt_update_lib_path (const char *name, const char *value); char **prepare_spawn (char **argv); void lt_dump_script (FILE *f); EOF cat <= 0) && (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))) return 1; else return 0; } int make_executable (const char *path) { int rval = 0; struct stat st; lt_debugprintf (__FILE__, __LINE__, "(make_executable): %s\n", nonempty (path)); if ((!path) || (!*path)) return 0; if (stat (path, &st) >= 0) { rval = chmod (path, st.st_mode | S_IXOTH | S_IXGRP | S_IXUSR); } return rval; } /* Searches for the full path of the wrapper. Returns newly allocated full path name if found, NULL otherwise Does not chase symlinks, even on platforms that support them. */ char * find_executable (const char *wrapper) { int has_slash = 0; const char *p; const char *p_next; /* static buffer for getcwd */ char tmp[LT_PATHMAX + 1]; size_t tmp_len; char *concat_name; lt_debugprintf (__FILE__, __LINE__, "(find_executable): %s\n", nonempty (wrapper)); if ((wrapper == NULL) || (*wrapper == '\0')) return NULL; /* Absolute path? */ #if defined HAVE_DOS_BASED_FILE_SYSTEM if (isalpha ((unsigned char) wrapper[0]) && wrapper[1] == ':') { concat_name = xstrdup (wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } else { #endif if (IS_DIR_SEPARATOR (wrapper[0])) { concat_name = xstrdup (wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } #if defined HAVE_DOS_BASED_FILE_SYSTEM } #endif for (p = wrapper; *p; p++) if (*p == '/') { has_slash = 1; break; } if (!has_slash) { /* no slashes; search PATH */ const char *path = getenv ("PATH"); if (path != NULL) { for (p = path; *p; p = p_next) { const char *q; size_t p_len; for (q = p; *q; q++) if (IS_PATH_SEPARATOR (*q)) break; p_len = (size_t) (q - p); p_next = (*q == '\0' ? q : q + 1); if (p_len == 0) { /* empty path: current directory */ if (getcwd (tmp, LT_PATHMAX) == NULL) lt_fatal (__FILE__, __LINE__, "getcwd failed: %s", nonnull (strerror (errno))); tmp_len = strlen (tmp); concat_name = XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, tmp, tmp_len); concat_name[tmp_len] = '/'; strcpy (concat_name + tmp_len + 1, wrapper); } else { concat_name = XMALLOC (char, p_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, p, p_len); concat_name[p_len] = '/'; strcpy (concat_name + p_len + 1, wrapper); } if (check_executable (concat_name)) return concat_name; XFREE (concat_name); } } /* not found in PATH; assume curdir */ } /* Relative path | not found in path: prepend cwd */ if (getcwd (tmp, LT_PATHMAX) == NULL) lt_fatal (__FILE__, __LINE__, "getcwd failed: %s", nonnull (strerror (errno))); tmp_len = strlen (tmp); concat_name = XMALLOC (char, tmp_len + 1 + strlen (wrapper) + 1); memcpy (concat_name, tmp, tmp_len); concat_name[tmp_len] = '/'; strcpy (concat_name + tmp_len + 1, wrapper); if (check_executable (concat_name)) return concat_name; XFREE (concat_name); return NULL; } char * chase_symlinks (const char *pathspec) { #ifndef S_ISLNK return xstrdup (pathspec); #else char buf[LT_PATHMAX]; struct stat s; char *tmp_pathspec = xstrdup (pathspec); char *p; int has_symlinks = 0; while (strlen (tmp_pathspec) && !has_symlinks) { lt_debugprintf (__FILE__, __LINE__, "checking path component for symlinks: %s\n", tmp_pathspec); if (lstat (tmp_pathspec, &s) == 0) { if (S_ISLNK (s.st_mode) != 0) { has_symlinks = 1; break; } /* search backwards for last DIR_SEPARATOR */ p = tmp_pathspec + strlen (tmp_pathspec) - 1; while ((p > tmp_pathspec) && (!IS_DIR_SEPARATOR (*p))) p--; if ((p == tmp_pathspec) && (!IS_DIR_SEPARATOR (*p))) { /* no more DIR_SEPARATORS left */ break; } *p = '\0'; } else { lt_fatal (__FILE__, __LINE__, "error accessing file \"%s\": %s", tmp_pathspec, nonnull (strerror (errno))); } } XFREE (tmp_pathspec); if (!has_symlinks) { return xstrdup (pathspec); } tmp_pathspec = realpath (pathspec, buf); if (tmp_pathspec == 0) { lt_fatal (__FILE__, __LINE__, "could not follow symlinks for %s", pathspec); } return xstrdup (tmp_pathspec); #endif } char * strendzap (char *str, const char *pat) { size_t len, patlen; assert (str != NULL); assert (pat != NULL); len = strlen (str); patlen = strlen (pat); if (patlen <= len) { str += len - patlen; if (STREQ (str, pat)) *str = '\0'; } return str; } void lt_debugprintf (const char *file, int line, const char *fmt, ...) { va_list args; if (lt_debug) { (void) fprintf (stderr, "%s:%s:%d: ", program_name, file, line); va_start (args, fmt); (void) vfprintf (stderr, fmt, args); va_end (args); } } static void lt_error_core (int exit_status, const char *file, int line, const char *mode, const char *message, va_list ap) { fprintf (stderr, "%s:%s:%d: %s: ", program_name, file, line, mode); vfprintf (stderr, message, ap); fprintf (stderr, ".\n"); if (exit_status >= 0) exit (exit_status); } void lt_fatal (const char *file, int line, const char *message, ...) { va_list ap; va_start (ap, message); lt_error_core (EXIT_FAILURE, file, line, "FATAL", message, ap); va_end (ap); } static const char * nonnull (const char *s) { return s ? s : "(null)"; } static const char * nonempty (const char *s) { return (s && !*s) ? "(empty)" : nonnull (s); } void lt_setenv (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_setenv) setting '%s' to '%s'\n", nonnull (name), nonnull (value)); { #ifdef HAVE_SETENV /* always make a copy, for consistency with !HAVE_SETENV */ char *str = xstrdup (value); setenv (name, str, 1); #else size_t len = strlen (name) + 1 + strlen (value) + 1; char *str = XMALLOC (char, len); sprintf (str, "%s=%s", name, value); if (putenv (str) != EXIT_SUCCESS) { XFREE (str); } #endif } } char * lt_extend_str (const char *orig_value, const char *add, int to_end) { char *new_value; if (orig_value && *orig_value) { size_t orig_value_len = strlen (orig_value); size_t add_len = strlen (add); new_value = XMALLOC (char, add_len + orig_value_len + 1); if (to_end) { strcpy (new_value, orig_value); strcpy (new_value + orig_value_len, add); } else { strcpy (new_value, add); strcpy (new_value + add_len, orig_value); } } else { new_value = xstrdup (add); } return new_value; } void lt_update_exe_path (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_update_exe_path) modifying '%s' by prepending '%s'\n", nonnull (name), nonnull (value)); if (name && *name && value && *value) { char *new_value = lt_extend_str (getenv (name), value, 0); /* some systems can't cope with a ':'-terminated path #' */ size_t len = strlen (new_value); while ((len > 0) && IS_PATH_SEPARATOR (new_value[len-1])) { new_value[--len] = '\0'; } lt_setenv (name, new_value); XFREE (new_value); } } void lt_update_lib_path (const char *name, const char *value) { lt_debugprintf (__FILE__, __LINE__, "(lt_update_lib_path) modifying '%s' by prepending '%s'\n", nonnull (name), nonnull (value)); if (name && *name && value && *value) { char *new_value = lt_extend_str (getenv (name), value, 0); lt_setenv (name, new_value); XFREE (new_value); } } EOF case $host_os in mingw*) cat <<"EOF" /* Prepares an argument vector before calling spawn(). Note that spawn() does not by itself call the command interpreter (getenv ("COMSPEC") != NULL ? getenv ("COMSPEC") : ({ OSVERSIONINFO v; v.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&v); v.dwPlatformId == VER_PLATFORM_WIN32_NT; }) ? "cmd.exe" : "command.com"). Instead it simply concatenates the arguments, separated by ' ', and calls CreateProcess(). We must quote the arguments since Win32 CreateProcess() interprets characters like ' ', '\t', '\\', '"' (but not '<' and '>') in a special way: - Space and tab are interpreted as delimiters. They are not treated as delimiters if they are surrounded by double quotes: "...". - Unescaped double quotes are removed from the input. Their only effect is that within double quotes, space and tab are treated like normal characters. - Backslashes not followed by double quotes are not special. - But 2*n+1 backslashes followed by a double quote become n backslashes followed by a double quote (n >= 0): \" -> " \\\" -> \" \\\\\" -> \\" */ #define SHELL_SPECIAL_CHARS "\"\\ \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037" #define SHELL_SPACE_CHARS " \001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037" char ** prepare_spawn (char **argv) { size_t argc; char **new_argv; size_t i; /* Count number of arguments. */ for (argc = 0; argv[argc] != NULL; argc++) ; /* Allocate new argument vector. */ new_argv = XMALLOC (char *, argc + 1); /* Put quoted arguments into the new argument vector. */ for (i = 0; i < argc; i++) { const char *string = argv[i]; if (string[0] == '\0') new_argv[i] = xstrdup ("\"\""); else if (strpbrk (string, SHELL_SPECIAL_CHARS) != NULL) { int quote_around = (strpbrk (string, SHELL_SPACE_CHARS) != NULL); size_t length; unsigned int backslashes; const char *s; char *quoted_string; char *p; length = 0; backslashes = 0; if (quote_around) length++; for (s = string; *s != '\0'; s++) { char c = *s; if (c == '"') length += backslashes + 1; length++; if (c == '\\') backslashes++; else backslashes = 0; } if (quote_around) length += backslashes + 1; quoted_string = XMALLOC (char, length + 1); p = quoted_string; backslashes = 0; if (quote_around) *p++ = '"'; for (s = string; *s != '\0'; s++) { char c = *s; if (c == '"') { unsigned int j; for (j = backslashes + 1; j > 0; j--) *p++ = '\\'; } *p++ = c; if (c == '\\') backslashes++; else backslashes = 0; } if (quote_around) { unsigned int j; for (j = backslashes; j > 0; j--) *p++ = '\\'; *p++ = '"'; } *p = '\0'; new_argv[i] = quoted_string; } else new_argv[i] = (char *) string; } new_argv[argc] = NULL; return new_argv; } EOF ;; esac cat <<"EOF" void lt_dump_script (FILE* f) { EOF func_emit_wrapper yes | $SED -n -e ' s/^\(.\{79\}\)\(..*\)/\1\ \2/ h s/\([\\"]\)/\\\1/g s/$/\\n/ s/\([^\n]*\).*/ fputs ("\1", f);/p g D' cat <<"EOF" } EOF } # end: func_emit_cwrapperexe_src # func_win32_import_lib_p ARG # True if ARG is an import lib, as indicated by $file_magic_cmd func_win32_import_lib_p () { $debug_cmd case `eval $file_magic_cmd \"\$1\" 2>/dev/null | $SED -e 10q` in *import*) : ;; *) false ;; esac } # func_suncc_cstd_abi # !!ONLY CALL THIS FOR SUN CC AFTER $compile_command IS FULLY EXPANDED!! # Several compiler flags select an ABI that is incompatible with the # Cstd library. Avoid specifying it if any are in CXXFLAGS. func_suncc_cstd_abi () { $debug_cmd case " $compile_command " in *" -compat=g "*|*\ -std=c++[0-9][0-9]\ *|*" -library=stdcxx4 "*|*" -library=stlport4 "*) suncc_use_cstd_abi=no ;; *) suncc_use_cstd_abi=yes ;; esac } # func_mode_link arg... func_mode_link () { $debug_cmd case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) # It is impossible to link a dll without this setting, and # we shouldn't force the makefile maintainer to figure out # what system we are compiling for in order to pass an extra # flag for every libtool invocation. # allow_undefined=no # FIXME: Unfortunately, there are problems with the above when trying # to make a dll that has undefined symbols, in which case not # even a static library is built. For now, we need to specify # -no-undefined on the libtool link line when we can be certain # that all symbols are satisfied, otherwise we get a static library. allow_undefined=yes ;; *) allow_undefined=yes ;; esac libtool_args=$nonopt base_compile="$nonopt $@" compile_command=$nonopt finalize_command=$nonopt compile_rpath= finalize_rpath= compile_shlibpath= finalize_shlibpath= convenience= old_convenience= deplibs= old_deplibs= compiler_flags= linker_flags= dllsearchpath= lib_search_path=`pwd` inst_prefix_dir= new_inherited_linker_flags= avoid_version=no bindir= dlfiles= dlprefiles= dlself=no export_dynamic=no export_symbols= export_symbols_regex= generated= libobjs= ltlibs= module=no no_install=no objs= os2dllname= non_pic_objects= precious_files_regex= prefer_static_libs=no preload=false prev= prevarg= release= rpath= xrpath= perm_rpath= temp_rpath= thread_safe=no vinfo= vinfo_number=no weak_libs= single_module=$wl-single_module func_infer_tag $base_compile # We need to know -static, to get the right output filenames. for arg do case $arg in -shared) test yes != "$build_libtool_libs" \ && func_fatal_configuration "cannot build a shared library" build_old_libs=no break ;; -all-static | -static | -static-libtool-libs) case $arg in -all-static) if test yes = "$build_libtool_libs" && test -z "$link_static_flag"; then func_warning "complete static linking is impossible in this configuration" fi if test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=yes ;; -static) if test -z "$pic_flag" && test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=built ;; -static-libtool-libs) if test -z "$pic_flag" && test -n "$link_static_flag"; then dlopen_self=$dlopen_self_static fi prefer_static_libs=yes ;; esac build_libtool_libs=no build_old_libs=yes break ;; esac done # See if our shared archives depend on static archives. test -n "$old_archive_from_new_cmds" && build_old_libs=yes # Go through the arguments, transforming them on the way. while test "$#" -gt 0; do arg=$1 shift func_quote_for_eval "$arg" qarg=$func_quote_for_eval_unquoted_result func_append libtool_args " $func_quote_for_eval_result" # If the previous option needs an argument, assign it. if test -n "$prev"; then case $prev in output) func_append compile_command " @OUTPUT@" func_append finalize_command " @OUTPUT@" ;; esac case $prev in bindir) bindir=$arg prev= continue ;; dlfiles|dlprefiles) $preload || { # Add the symbol object into the linking commands. func_append compile_command " @SYMFILE@" func_append finalize_command " @SYMFILE@" preload=: } case $arg in *.la | *.lo) ;; # We handle these cases below. force) if test no = "$dlself"; then dlself=needless export_dynamic=yes fi prev= continue ;; self) if test dlprefiles = "$prev"; then dlself=yes elif test dlfiles = "$prev" && test yes != "$dlopen_self"; then dlself=yes else dlself=needless export_dynamic=yes fi prev= continue ;; *) if test dlfiles = "$prev"; then func_append dlfiles " $arg" else func_append dlprefiles " $arg" fi prev= continue ;; esac ;; expsyms) export_symbols=$arg test -f "$arg" \ || func_fatal_error "symbol file '$arg' does not exist" prev= continue ;; expsyms_regex) export_symbols_regex=$arg prev= continue ;; framework) case $host in *-*-darwin*) case "$deplibs " in *" $qarg.ltframework "*) ;; *) func_append deplibs " $qarg.ltframework" # this is fixed later ;; esac ;; esac prev= continue ;; inst_prefix) inst_prefix_dir=$arg prev= continue ;; mllvm) # Clang does not use LLVM to link, so we can simply discard any # '-mllvm $arg' options when doing the link step. prev= continue ;; objectlist) if test -f "$arg"; then save_arg=$arg moreargs= for fil in `cat "$save_arg"` do # func_append moreargs " $fil" arg=$fil # A libtool-controlled object. # Check to see that this really is a libtool object. if func_lalib_unsafe_p "$arg"; then pic_object= non_pic_object= # Read the .lo file func_source "$arg" if test -z "$pic_object" || test -z "$non_pic_object" || test none = "$pic_object" && test none = "$non_pic_object"; then func_fatal_error "cannot find name of object for '$arg'" fi # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result if test none != "$pic_object"; then # Prepend the subdirectory the object is found in. pic_object=$xdir$pic_object if test dlfiles = "$prev"; then if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then func_append dlfiles " $pic_object" prev= continue else # If libtool objects are unsupported, then we need to preload. prev=dlprefiles fi fi # CHECK ME: I think I busted this. -Ossama if test dlprefiles = "$prev"; then # Preload the old-style object. func_append dlprefiles " $pic_object" prev= fi # A PIC object. func_append libobjs " $pic_object" arg=$pic_object fi # Non-PIC object. if test none != "$non_pic_object"; then # Prepend the subdirectory the object is found in. non_pic_object=$xdir$non_pic_object # A standard non-PIC object func_append non_pic_objects " $non_pic_object" if test -z "$pic_object" || test none = "$pic_object"; then arg=$non_pic_object fi else # If the PIC object exists, use it instead. # $xdir was prepended to $pic_object above. non_pic_object=$pic_object func_append non_pic_objects " $non_pic_object" fi else # Only an error if not doing a dry-run. if $opt_dry_run; then # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result func_lo2o "$arg" pic_object=$xdir$objdir/$func_lo2o_result non_pic_object=$xdir$func_lo2o_result func_append libobjs " $pic_object" func_append non_pic_objects " $non_pic_object" else func_fatal_error "'$arg' is not a valid libtool object" fi fi done else func_fatal_error "link input file '$arg' does not exist" fi arg=$save_arg prev= continue ;; os2dllname) os2dllname=$arg prev= continue ;; precious_regex) precious_files_regex=$arg prev= continue ;; release) release=-$arg prev= continue ;; rpath | xrpath) # We need an absolute path. case $arg in [\\/]* | [A-Za-z]:[\\/]*) ;; *) func_fatal_error "only absolute run-paths are allowed" ;; esac if test rpath = "$prev"; then case "$rpath " in *" $arg "*) ;; *) func_append rpath " $arg" ;; esac else case "$xrpath " in *" $arg "*) ;; *) func_append xrpath " $arg" ;; esac fi prev= continue ;; shrext) shrext_cmds=$arg prev= continue ;; weak) func_append weak_libs " $arg" prev= continue ;; xcclinker) func_append linker_flags " $qarg" func_append compiler_flags " $qarg" prev= func_append compile_command " $qarg" func_append finalize_command " $qarg" continue ;; xcompiler) func_append compiler_flags " $qarg" prev= func_append compile_command " $qarg" func_append finalize_command " $qarg" continue ;; xlinker) func_append linker_flags " $qarg" func_append compiler_flags " $wl$qarg" prev= func_append compile_command " $wl$qarg" func_append finalize_command " $wl$qarg" continue ;; *) eval "$prev=\"\$arg\"" prev= continue ;; esac fi # test -n "$prev" prevarg=$arg case $arg in -all-static) if test -n "$link_static_flag"; then # See comment for -static flag below, for more details. func_append compile_command " $link_static_flag" func_append finalize_command " $link_static_flag" fi continue ;; -allow-undefined) # FIXME: remove this flag sometime in the future. func_fatal_error "'-allow-undefined' must not be used because it is the default" ;; -avoid-version) avoid_version=yes continue ;; -bindir) prev=bindir continue ;; -dlopen) prev=dlfiles continue ;; -dlpreopen) prev=dlprefiles continue ;; -export-dynamic) export_dynamic=yes continue ;; -export-symbols | -export-symbols-regex) if test -n "$export_symbols" || test -n "$export_symbols_regex"; then func_fatal_error "more than one -exported-symbols argument is not allowed" fi if test X-export-symbols = "X$arg"; then prev=expsyms else prev=expsyms_regex fi continue ;; -framework) prev=framework continue ;; -inst-prefix-dir) prev=inst_prefix continue ;; # The native IRIX linker understands -LANG:*, -LIST:* and -LNO:* # so, if we see these flags be careful not to treat them like -L -L[A-Z][A-Z]*:*) case $with_gcc/$host in no/*-*-irix* | /*-*-irix*) func_append compile_command " $arg" func_append finalize_command " $arg" ;; esac continue ;; -L*) func_stripname "-L" '' "$arg" if test -z "$func_stripname_result"; then if test "$#" -gt 0; then func_fatal_error "require no space between '-L' and '$1'" else func_fatal_error "need path for '-L' option" fi fi func_resolve_sysroot "$func_stripname_result" dir=$func_resolve_sysroot_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) ;; *) absdir=`cd "$dir" && pwd` test -z "$absdir" && \ func_fatal_error "cannot determine absolute directory name of '$dir'" dir=$absdir ;; esac case "$deplibs " in *" -L$dir "* | *" $arg "*) # Will only happen for absolute or sysroot arguments ;; *) # Preserve sysroot, but never include relative directories case $dir in [\\/]* | [A-Za-z]:[\\/]* | =*) func_append deplibs " $arg" ;; *) func_append deplibs " -L$dir" ;; esac func_append lib_search_path " $dir" ;; esac case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) testbindir=`$ECHO "$dir" | $SED 's*/lib$*/bin*'` case :$dllsearchpath: in *":$dir:"*) ;; ::) dllsearchpath=$dir;; *) func_append dllsearchpath ":$dir";; esac case :$dllsearchpath: in *":$testbindir:"*) ;; ::) dllsearchpath=$testbindir;; *) func_append dllsearchpath ":$testbindir";; esac ;; esac continue ;; -l*) if test X-lc = "X$arg" || test X-lm = "X$arg"; then case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-beos* | *-cegcc* | *-*-haiku*) # These systems don't actually have a C or math library (as such) continue ;; *-*-os2*) # These systems don't actually have a C library (as such) test X-lc = "X$arg" && continue ;; *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*) # Do not include libc due to us having libc/libc_r. test X-lc = "X$arg" && continue ;; *-*-rhapsody* | *-*-darwin1.[012]) # Rhapsody C and math libraries are in the System framework func_append deplibs " System.ltframework" continue ;; *-*-sco3.2v5* | *-*-sco5v6*) # Causes problems with __ctype test X-lc = "X$arg" && continue ;; *-*-sysv4.2uw2* | *-*-sysv5* | *-*-unixware* | *-*-OpenUNIX*) # Compiler inserts libc in the correct place for threads to work test X-lc = "X$arg" && continue ;; esac elif test X-lc_r = "X$arg"; then case $host in *-*-openbsd* | *-*-freebsd* | *-*-dragonfly* | *-*-bitrig*) # Do not include libc_r directly, use -pthread flag. continue ;; esac fi func_append deplibs " $arg" continue ;; -mllvm) prev=mllvm continue ;; -module) module=yes continue ;; # Tru64 UNIX uses -model [arg] to determine the layout of C++ # classes, name mangling, and exception handling. # Darwin uses the -arch flag to determine output architecture. -model|-arch|-isysroot|--sysroot) func_append compiler_flags " $arg" func_append compile_command " $arg" func_append finalize_command " $arg" prev=xcompiler continue ;; -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe \ |-threads|-fopenmp|-openmp|-mp|-xopenmp|-omp|-qsmp=*) func_append compiler_flags " $arg" func_append compile_command " $arg" func_append finalize_command " $arg" case "$new_inherited_linker_flags " in *" $arg "*) ;; * ) func_append new_inherited_linker_flags " $arg" ;; esac continue ;; -multi_module) single_module=$wl-multi_module continue ;; -no-fast-install) fast_install=no continue ;; -no-install) case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-*-darwin* | *-cegcc*) # The PATH hackery in wrapper scripts is required on Windows # and Darwin in order for the loader to find any dlls it needs. func_warning "'-no-install' is ignored for $host" func_warning "assuming '-no-fast-install' instead" fast_install=no ;; *) no_install=yes ;; esac continue ;; -no-undefined) allow_undefined=no continue ;; -objectlist) prev=objectlist continue ;; -os2dllname) prev=os2dllname continue ;; -o) prev=output ;; -precious-files-regex) prev=precious_regex continue ;; -release) prev=release continue ;; -rpath) prev=rpath continue ;; -R) prev=xrpath continue ;; -R*) func_stripname '-R' '' "$arg" dir=$func_stripname_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) ;; =*) func_stripname '=' '' "$dir" dir=$lt_sysroot$func_stripname_result ;; *) func_fatal_error "only absolute run-paths are allowed" ;; esac case "$xrpath " in *" $dir "*) ;; *) func_append xrpath " $dir" ;; esac continue ;; -shared) # The effects of -shared are defined in a previous loop. continue ;; -shrext) prev=shrext continue ;; -static | -static-libtool-libs) # The effects of -static are defined in a previous loop. # We used to do the same as -all-static on platforms that # didn't have a PIC flag, but the assumption that the effects # would be equivalent was wrong. It would break on at least # Digital Unix and AIX. continue ;; -thread-safe) thread_safe=yes continue ;; -version-info) prev=vinfo continue ;; -version-number) prev=vinfo vinfo_number=yes continue ;; -weak) prev=weak continue ;; -Wc,*) func_stripname '-Wc,' '' "$arg" args=$func_stripname_result arg= save_ifs=$IFS; IFS=, for flag in $args; do IFS=$save_ifs func_quote_for_eval "$flag" func_append arg " $func_quote_for_eval_result" func_append compiler_flags " $func_quote_for_eval_result" done IFS=$save_ifs func_stripname ' ' '' "$arg" arg=$func_stripname_result ;; -Wl,*) func_stripname '-Wl,' '' "$arg" args=$func_stripname_result arg= save_ifs=$IFS; IFS=, for flag in $args; do IFS=$save_ifs func_quote_for_eval "$flag" func_append arg " $wl$func_quote_for_eval_result" func_append compiler_flags " $wl$func_quote_for_eval_result" func_append linker_flags " $func_quote_for_eval_result" done IFS=$save_ifs func_stripname ' ' '' "$arg" arg=$func_stripname_result ;; -Xcompiler) prev=xcompiler continue ;; -Xlinker) prev=xlinker continue ;; -XCClinker) prev=xcclinker continue ;; # -msg_* for osf cc -msg_*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; # Flags to be passed through unchanged, with rationale: # -64, -mips[0-9] enable 64-bit mode for the SGI compiler # -r[0-9][0-9]* specify processor for the SGI compiler # -xarch=*, -xtarget=* enable 64-bit mode for the Sun compiler # +DA*, +DD* enable 64-bit mode for the HP compiler # -q* compiler args for the IBM compiler # -m*, -t[45]*, -txscale* architecture-specific flags for GCC # -F/path path to uninstalled frameworks, gcc on darwin # -p, -pg, --coverage, -fprofile-* profiling flags for GCC # -fstack-protector* stack protector flags for GCC # @file GCC response files # -tp=* Portland pgcc target processor selection # --sysroot=* for sysroot support # -O*, -g*, -flto*, -fwhopr*, -fuse-linker-plugin GCC link-time optimization # -specs=* GCC specs files # -stdlib=* select c++ std lib with clang # -fsanitize=* Clang/GCC memory and address sanitizer -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \ -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \ -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \ -specs=*|-fsanitize=*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result func_append compile_command " $arg" func_append finalize_command " $arg" func_append compiler_flags " $arg" continue ;; -Z*) if test os2 = "`expr $host : '.*\(os2\)'`"; then # OS/2 uses -Zxxx to specify OS/2-specific options compiler_flags="$compiler_flags $arg" func_append compile_command " $arg" func_append finalize_command " $arg" case $arg in -Zlinker | -Zstack) prev=xcompiler ;; esac continue else # Otherwise treat like 'Some other compiler flag' below func_quote_for_eval "$arg" arg=$func_quote_for_eval_result fi ;; # Some other compiler flag. -* | +*) func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; *.$objext) # A standard object. func_append objs " $arg" ;; *.lo) # A libtool-controlled object. # Check to see that this really is a libtool object. if func_lalib_unsafe_p "$arg"; then pic_object= non_pic_object= # Read the .lo file func_source "$arg" if test -z "$pic_object" || test -z "$non_pic_object" || test none = "$pic_object" && test none = "$non_pic_object"; then func_fatal_error "cannot find name of object for '$arg'" fi # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result test none = "$pic_object" || { # Prepend the subdirectory the object is found in. pic_object=$xdir$pic_object if test dlfiles = "$prev"; then if test yes = "$build_libtool_libs" && test yes = "$dlopen_support"; then func_append dlfiles " $pic_object" prev= continue else # If libtool objects are unsupported, then we need to preload. prev=dlprefiles fi fi # CHECK ME: I think I busted this. -Ossama if test dlprefiles = "$prev"; then # Preload the old-style object. func_append dlprefiles " $pic_object" prev= fi # A PIC object. func_append libobjs " $pic_object" arg=$pic_object } # Non-PIC object. if test none != "$non_pic_object"; then # Prepend the subdirectory the object is found in. non_pic_object=$xdir$non_pic_object # A standard non-PIC object func_append non_pic_objects " $non_pic_object" if test -z "$pic_object" || test none = "$pic_object"; then arg=$non_pic_object fi else # If the PIC object exists, use it instead. # $xdir was prepended to $pic_object above. non_pic_object=$pic_object func_append non_pic_objects " $non_pic_object" fi else # Only an error if not doing a dry-run. if $opt_dry_run; then # Extract subdirectory from the argument. func_dirname "$arg" "/" "" xdir=$func_dirname_result func_lo2o "$arg" pic_object=$xdir$objdir/$func_lo2o_result non_pic_object=$xdir$func_lo2o_result func_append libobjs " $pic_object" func_append non_pic_objects " $non_pic_object" else func_fatal_error "'$arg' is not a valid libtool object" fi fi ;; *.$libext) # An archive. func_append deplibs " $arg" func_append old_deplibs " $arg" continue ;; *.la) # A libtool-controlled library. func_resolve_sysroot "$arg" if test dlfiles = "$prev"; then # This library was specified with -dlopen. func_append dlfiles " $func_resolve_sysroot_result" prev= elif test dlprefiles = "$prev"; then # The library was specified with -dlpreopen. func_append dlprefiles " $func_resolve_sysroot_result" prev= else func_append deplibs " $func_resolve_sysroot_result" fi continue ;; # Some other compiler argument. *) # Unknown arguments in both finalize_command and compile_command need # to be aesthetically quoted because they are evaled later. func_quote_for_eval "$arg" arg=$func_quote_for_eval_result ;; esac # arg # Now actually substitute the argument into the commands. if test -n "$arg"; then func_append compile_command " $arg" func_append finalize_command " $arg" fi done # argument parsing loop test -n "$prev" && \ func_fatal_help "the '$prevarg' option requires an argument" if test yes = "$export_dynamic" && test -n "$export_dynamic_flag_spec"; then eval arg=\"$export_dynamic_flag_spec\" func_append compile_command " $arg" func_append finalize_command " $arg" fi oldlibs= # calculate the name of the file, without its directory func_basename "$output" outputname=$func_basename_result libobjs_save=$libobjs if test -n "$shlibpath_var"; then # get the directories listed in $shlibpath_var eval shlib_search_path=\`\$ECHO \"\$$shlibpath_var\" \| \$SED \'s/:/ /g\'\` else shlib_search_path= fi eval sys_lib_search_path=\"$sys_lib_search_path_spec\" eval sys_lib_dlsearch_path=\"$sys_lib_dlsearch_path_spec\" # Definition is injected by LT_CONFIG during libtool generation. func_munge_path_list sys_lib_dlsearch_path "$LT_SYS_LIBRARY_PATH" func_dirname "$output" "/" "" output_objdir=$func_dirname_result$objdir func_to_tool_file "$output_objdir/" tool_output_objdir=$func_to_tool_file_result # Create the object directory. func_mkdir_p "$output_objdir" # Determine the type of output case $output in "") func_fatal_help "you must specify an output file" ;; *.$libext) linkmode=oldlib ;; *.lo | *.$objext) linkmode=obj ;; *.la) linkmode=lib ;; *) linkmode=prog ;; # Anything else should be a program. esac specialdeplibs= libs= # Find all interdependent deplibs by searching for libraries # that are linked more than once (e.g. -la -lb -la) for deplib in $deplibs; do if $opt_preserve_dup_deps; then case "$libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append libs " $deplib" done if test lib = "$linkmode"; then libs="$predeps $libs $compiler_lib_search_path $postdeps" # Compute libraries that are listed more than once in $predeps # $postdeps and mark them as special (i.e., whose duplicates are # not to be eliminated). pre_post_deps= if $opt_duplicate_compiler_generated_deps; then for pre_post_dep in $predeps $postdeps; do case "$pre_post_deps " in *" $pre_post_dep "*) func_append specialdeplibs " $pre_post_deps" ;; esac func_append pre_post_deps " $pre_post_dep" done fi pre_post_deps= fi deplibs= newdependency_libs= newlib_search_path= need_relink=no # whether we're linking any uninstalled libtool libraries notinst_deplibs= # not-installed libtool libraries notinst_path= # paths that contain not-installed libtool libraries case $linkmode in lib) passes="conv dlpreopen link" for file in $dlfiles $dlprefiles; do case $file in *.la) ;; *) func_fatal_help "libraries can '-dlopen' only libtool libraries: $file" ;; esac done ;; prog) compile_deplibs= finalize_deplibs= alldeplibs=false newdlfiles= newdlprefiles= passes="conv scan dlopen dlpreopen link" ;; *) passes="conv" ;; esac for pass in $passes; do # The preopen pass in lib mode reverses $deplibs; put it back here # so that -L comes before libs that need it for instance... if test lib,link = "$linkmode,$pass"; then ## FIXME: Find the place where the list is rebuilt in the wrong ## order, and fix it there properly tmp_deplibs= for deplib in $deplibs; do tmp_deplibs="$deplib $tmp_deplibs" done deplibs=$tmp_deplibs fi if test lib,link = "$linkmode,$pass" || test prog,scan = "$linkmode,$pass"; then libs=$deplibs deplibs= fi if test prog = "$linkmode"; then case $pass in dlopen) libs=$dlfiles ;; dlpreopen) libs=$dlprefiles ;; link) libs="$deplibs %DEPLIBS%" test "X$link_all_deplibs" != Xno && libs="$libs $dependency_libs" ;; esac fi if test lib,dlpreopen = "$linkmode,$pass"; then # Collect and forward deplibs of preopened libtool libs for lib in $dlprefiles; do # Ignore non-libtool-libs dependency_libs= func_resolve_sysroot "$lib" case $lib in *.la) func_source "$func_resolve_sysroot_result" ;; esac # Collect preopened libtool deplibs, except any this library # has declared as weak libs for deplib in $dependency_libs; do func_basename "$deplib" deplib_base=$func_basename_result case " $weak_libs " in *" $deplib_base "*) ;; *) func_append deplibs " $deplib" ;; esac done done libs=$dlprefiles fi if test dlopen = "$pass"; then # Collect dlpreopened libraries save_deplibs=$deplibs deplibs= fi for deplib in $libs; do lib= found=false case $deplib in -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe \ |-threads|-fopenmp|-openmp|-mp|-xopenmp|-omp|-qsmp=*) if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else func_append compiler_flags " $deplib" if test lib = "$linkmode"; then case "$new_inherited_linker_flags " in *" $deplib "*) ;; * ) func_append new_inherited_linker_flags " $deplib" ;; esac fi fi continue ;; -l*) if test lib != "$linkmode" && test prog != "$linkmode"; then func_warning "'-l' is ignored for archives/objects" continue fi func_stripname '-l' '' "$deplib" name=$func_stripname_result if test lib = "$linkmode"; then searchdirs="$newlib_search_path $lib_search_path $compiler_lib_search_dirs $sys_lib_search_path $shlib_search_path" else searchdirs="$newlib_search_path $lib_search_path $sys_lib_search_path $shlib_search_path" fi for searchdir in $searchdirs; do for search_ext in .la $std_shrext .so .a; do # Search the libtool library lib=$searchdir/lib$name$search_ext if test -f "$lib"; then if test .la = "$search_ext"; then found=: else found=false fi break 2 fi done done if $found; then # deplib is a libtool library # If $allow_libtool_libs_with_static_runtimes && $deplib is a stdlib, # We need to do some special things here, and not later. if test yes = "$allow_libtool_libs_with_static_runtimes"; then case " $predeps $postdeps " in *" $deplib "*) if func_lalib_p "$lib"; then library_names= old_library= func_source "$lib" for l in $old_library $library_names; do ll=$l done if test "X$ll" = "X$old_library"; then # only static version available found=false func_dirname "$lib" "" "." ladir=$func_dirname_result lib=$ladir/$old_library if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs" fi continue fi fi ;; *) ;; esac fi else # deplib doesn't seem to be a libtool library if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" test lib = "$linkmode" && newdependency_libs="$deplib $newdependency_libs" fi continue fi ;; # -l *.ltframework) if test prog,link = "$linkmode,$pass"; then compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else deplibs="$deplib $deplibs" if test lib = "$linkmode"; then case "$new_inherited_linker_flags " in *" $deplib "*) ;; * ) func_append new_inherited_linker_flags " $deplib" ;; esac fi fi continue ;; -L*) case $linkmode in lib) deplibs="$deplib $deplibs" test conv = "$pass" && continue newdependency_libs="$deplib $newdependency_libs" func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; prog) if test conv = "$pass"; then deplibs="$deplib $deplibs" continue fi if test scan = "$pass"; then deplibs="$deplib $deplibs" else compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" fi func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; *) func_warning "'-L' is ignored for archives/objects" ;; esac # linkmode continue ;; # -L -R*) if test link = "$pass"; then func_stripname '-R' '' "$deplib" func_resolve_sysroot "$func_stripname_result" dir=$func_resolve_sysroot_result # Make sure the xrpath contains only unique directories. case "$xrpath " in *" $dir "*) ;; *) func_append xrpath " $dir" ;; esac fi deplibs="$deplib $deplibs" continue ;; *.la) func_resolve_sysroot "$deplib" lib=$func_resolve_sysroot_result ;; *.$libext) if test conv = "$pass"; then deplibs="$deplib $deplibs" continue fi case $linkmode in lib) # Linking convenience modules into shared libraries is allowed, # but linking other static libraries is non-portable. case " $dlpreconveniencelibs " in *" $deplib "*) ;; *) valid_a_lib=false case $deplibs_check_method in match_pattern*) set dummy $deplibs_check_method; shift match_pattern_regex=`expr "$deplibs_check_method" : "$1 \(.*\)"` if eval "\$ECHO \"$deplib\"" 2>/dev/null | $SED 10q \ | $EGREP "$match_pattern_regex" > /dev/null; then valid_a_lib=: fi ;; pass_all) valid_a_lib=: ;; esac if $valid_a_lib; then echo $ECHO "*** Warning: Linking the shared library $output against the" $ECHO "*** static library $deplib is not portable!" deplibs="$deplib $deplibs" else echo $ECHO "*** Warning: Trying to link with static lib archive $deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because the file extensions .$libext of this argument makes me believe" echo "*** that it is just a static archive that I should not use here." fi ;; esac continue ;; prog) if test link != "$pass"; then deplibs="$deplib $deplibs" else compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" fi continue ;; esac # linkmode ;; # *.$libext *.lo | *.$objext) if test conv = "$pass"; then deplibs="$deplib $deplibs" elif test prog = "$linkmode"; then if test dlpreopen = "$pass" || test yes != "$dlopen_support" || test no = "$build_libtool_libs"; then # If there is no dlopen support or we're linking statically, # we need to preload. func_append newdlprefiles " $deplib" compile_deplibs="$deplib $compile_deplibs" finalize_deplibs="$deplib $finalize_deplibs" else func_append newdlfiles " $deplib" fi fi continue ;; %DEPLIBS%) alldeplibs=: continue ;; esac # case $deplib $found || test -f "$lib" \ || func_fatal_error "cannot find the library '$lib' or unhandled argument '$deplib'" # Check to see that this really is a libtool archive. func_lalib_unsafe_p "$lib" \ || func_fatal_error "'$lib' is not a valid libtool archive" func_dirname "$lib" "" "." ladir=$func_dirname_result dlname= dlopen= dlpreopen= libdir= library_names= old_library= inherited_linker_flags= # If the library was installed with an old release of libtool, # it will not redefine variables installed, or shouldnotlink installed=yes shouldnotlink=no avoidtemprpath= # Read the .la file func_source "$lib" # Convert "-framework foo" to "foo.ltframework" if test -n "$inherited_linker_flags"; then tmp_inherited_linker_flags=`$ECHO "$inherited_linker_flags" | $SED 's/-framework \([^ $]*\)/\1.ltframework/g'` for tmp_inherited_linker_flag in $tmp_inherited_linker_flags; do case " $new_inherited_linker_flags " in *" $tmp_inherited_linker_flag "*) ;; *) func_append new_inherited_linker_flags " $tmp_inherited_linker_flag";; esac done fi dependency_libs=`$ECHO " $dependency_libs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` if test lib,link = "$linkmode,$pass" || test prog,scan = "$linkmode,$pass" || { test prog != "$linkmode" && test lib != "$linkmode"; }; then test -n "$dlopen" && func_append dlfiles " $dlopen" test -n "$dlpreopen" && func_append dlprefiles " $dlpreopen" fi if test conv = "$pass"; then # Only check for convenience libraries deplibs="$lib $deplibs" if test -z "$libdir"; then if test -z "$old_library"; then func_fatal_error "cannot find name of link library for '$lib'" fi # It is a libtool convenience library, so add in its objects. func_append convenience " $ladir/$objdir/$old_library" func_append old_convenience " $ladir/$objdir/$old_library" tmp_libs= for deplib in $dependency_libs; do deplibs="$deplib $deplibs" if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append tmp_libs " $deplib" done elif test prog != "$linkmode" && test lib != "$linkmode"; then func_fatal_error "'$lib' is not a convenience library" fi continue fi # $pass = conv # Get the name of the library we link against. linklib= if test -n "$old_library" && { test yes = "$prefer_static_libs" || test built,no = "$prefer_static_libs,$installed"; }; then linklib=$old_library else for l in $old_library $library_names; do linklib=$l done fi if test -z "$linklib"; then func_fatal_error "cannot find name of link library for '$lib'" fi # This library was specified with -dlopen. if test dlopen = "$pass"; then test -z "$libdir" \ && func_fatal_error "cannot -dlopen a convenience library: '$lib'" if test -z "$dlname" || test yes != "$dlopen_support" || test no = "$build_libtool_libs" then # If there is no dlname, no dlopen support or we're linking # statically, we need to preload. We also need to preload any # dependent libraries so libltdl's deplib preloader doesn't # bomb out in the load deplibs phase. func_append dlprefiles " $lib $dependency_libs" else func_append newdlfiles " $lib" fi continue fi # $pass = dlopen # We need an absolute path. case $ladir in [\\/]* | [A-Za-z]:[\\/]*) abs_ladir=$ladir ;; *) abs_ladir=`cd "$ladir" && pwd` if test -z "$abs_ladir"; then func_warning "cannot determine absolute directory name of '$ladir'" func_warning "passing it literally to the linker, although it might fail" abs_ladir=$ladir fi ;; esac func_basename "$lib" laname=$func_basename_result # Find the relevant object directory and library name. if test yes = "$installed"; then if test ! -f "$lt_sysroot$libdir/$linklib" && test -f "$abs_ladir/$linklib"; then func_warning "library '$lib' was moved." dir=$ladir absdir=$abs_ladir libdir=$abs_ladir else dir=$lt_sysroot$libdir absdir=$lt_sysroot$libdir fi test yes = "$hardcode_automatic" && avoidtemprpath=yes else if test ! -f "$ladir/$objdir/$linklib" && test -f "$abs_ladir/$linklib"; then dir=$ladir absdir=$abs_ladir # Remove this search path later func_append notinst_path " $abs_ladir" else dir=$ladir/$objdir absdir=$abs_ladir/$objdir # Remove this search path later func_append notinst_path " $abs_ladir" fi fi # $installed = yes func_stripname 'lib' '.la' "$laname" name=$func_stripname_result # This library was specified with -dlpreopen. if test dlpreopen = "$pass"; then if test -z "$libdir" && test prog = "$linkmode"; then func_fatal_error "only libraries may -dlpreopen a convenience library: '$lib'" fi case $host in # special handling for platforms with PE-DLLs. *cygwin* | *mingw* | *cegcc* ) # Linker will automatically link against shared library if both # static and shared are present. Therefore, ensure we extract # symbols from the import library if a shared library is present # (otherwise, the dlopen module name will be incorrect). We do # this by putting the import library name into $newdlprefiles. # We recover the dlopen module name by 'saving' the la file # name in a special purpose variable, and (later) extracting the # dlname from the la file. if test -n "$dlname"; then func_tr_sh "$dir/$linklib" eval "libfile_$func_tr_sh_result=\$abs_ladir/\$laname" func_append newdlprefiles " $dir/$linklib" else func_append newdlprefiles " $dir/$old_library" # Keep a list of preopened convenience libraries to check # that they are being used correctly in the link pass. test -z "$libdir" && \ func_append dlpreconveniencelibs " $dir/$old_library" fi ;; * ) # Prefer using a static library (so that no silly _DYNAMIC symbols # are required to link). if test -n "$old_library"; then func_append newdlprefiles " $dir/$old_library" # Keep a list of preopened convenience libraries to check # that they are being used correctly in the link pass. test -z "$libdir" && \ func_append dlpreconveniencelibs " $dir/$old_library" # Otherwise, use the dlname, so that lt_dlopen finds it. elif test -n "$dlname"; then func_append newdlprefiles " $dir/$dlname" else func_append newdlprefiles " $dir/$linklib" fi ;; esac fi # $pass = dlpreopen if test -z "$libdir"; then # Link the convenience library if test lib = "$linkmode"; then deplibs="$dir/$old_library $deplibs" elif test prog,link = "$linkmode,$pass"; then compile_deplibs="$dir/$old_library $compile_deplibs" finalize_deplibs="$dir/$old_library $finalize_deplibs" else deplibs="$lib $deplibs" # used for prog,scan pass fi continue fi if test prog = "$linkmode" && test link != "$pass"; then func_append newlib_search_path " $ladir" deplibs="$lib $deplibs" linkalldeplibs=false if test no != "$link_all_deplibs" || test -z "$library_names" || test no = "$build_libtool_libs"; then linkalldeplibs=: fi tmp_libs= for deplib in $dependency_libs; do case $deplib in -L*) func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result" func_append newlib_search_path " $func_resolve_sysroot_result" ;; esac # Need to link against all dependency_libs? if $linkalldeplibs; then deplibs="$deplib $deplibs" else # Need to hardcode shared library paths # or/and link against static libraries newdependency_libs="$deplib $newdependency_libs" fi if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $deplib "*) func_append specialdeplibs " $deplib" ;; esac fi func_append tmp_libs " $deplib" done # for deplib continue fi # $linkmode = prog... if test prog,link = "$linkmode,$pass"; then if test -n "$library_names" && { { test no = "$prefer_static_libs" || test built,yes = "$prefer_static_libs,$installed"; } || test -z "$old_library"; }; then # We need to hardcode the library path if test -n "$shlibpath_var" && test -z "$avoidtemprpath"; then # Make sure the rpath contains only unique directories. case $temp_rpath: in *"$absdir:"*) ;; *) func_append temp_rpath "$absdir:" ;; esac fi # Hardcode the library path. # Skip directories that are in the system default run-time # search path. case " $sys_lib_dlsearch_path " in *" $absdir "*) ;; *) case "$compile_rpath " in *" $absdir "*) ;; *) func_append compile_rpath " $absdir" ;; esac ;; esac case " $sys_lib_dlsearch_path " in *" $libdir "*) ;; *) case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac ;; esac fi # $linkmode,$pass = prog,link... if $alldeplibs && { test pass_all = "$deplibs_check_method" || { test yes = "$build_libtool_libs" && test -n "$library_names"; }; }; then # We only need to search for static libraries continue fi fi link_static=no # Whether the deplib will be linked statically use_static_libs=$prefer_static_libs if test built = "$use_static_libs" && test yes = "$installed"; then use_static_libs=no fi if test -n "$library_names" && { test no = "$use_static_libs" || test -z "$old_library"; }; then case $host in *cygwin* | *mingw* | *cegcc* | *os2*) # No point in relinking DLLs because paths are not encoded func_append notinst_deplibs " $lib" need_relink=no ;; *) if test no = "$installed"; then func_append notinst_deplibs " $lib" need_relink=yes fi ;; esac # This is a shared library # Warn about portability, can't link against -module's on some # systems (darwin). Don't bleat about dlopened modules though! dlopenmodule= for dlpremoduletest in $dlprefiles; do if test "X$dlpremoduletest" = "X$lib"; then dlopenmodule=$dlpremoduletest break fi done if test -z "$dlopenmodule" && test yes = "$shouldnotlink" && test link = "$pass"; then echo if test prog = "$linkmode"; then $ECHO "*** Warning: Linking the executable $output against the loadable module" else $ECHO "*** Warning: Linking the shared library $output against the loadable module" fi $ECHO "*** $linklib is not portable!" fi if test lib = "$linkmode" && test yes = "$hardcode_into_libs"; then # Hardcode the library path. # Skip directories that are in the system default run-time # search path. case " $sys_lib_dlsearch_path " in *" $absdir "*) ;; *) case "$compile_rpath " in *" $absdir "*) ;; *) func_append compile_rpath " $absdir" ;; esac ;; esac case " $sys_lib_dlsearch_path " in *" $libdir "*) ;; *) case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac ;; esac fi if test -n "$old_archive_from_expsyms_cmds"; then # figure out the soname set dummy $library_names shift realname=$1 shift libname=`eval "\\$ECHO \"$libname_spec\""` # use dlname if we got it. it's perfectly good, no? if test -n "$dlname"; then soname=$dlname elif test -n "$soname_spec"; then # bleh windows case $host in *cygwin* | mingw* | *cegcc* | *os2*) func_arith $current - $age major=$func_arith_result versuffix=-$major ;; esac eval soname=\"$soname_spec\" else soname=$realname fi # Make a new name for the extract_expsyms_cmds to use soroot=$soname func_basename "$soroot" soname=$func_basename_result func_stripname 'lib' '.dll' "$soname" newlib=libimp-$func_stripname_result.a # If the library has no export list, then create one now if test -f "$output_objdir/$soname-def"; then : else func_verbose "extracting exported symbol list from '$soname'" func_execute_cmds "$extract_expsyms_cmds" 'exit $?' fi # Create $newlib if test -f "$output_objdir/$newlib"; then :; else func_verbose "generating import library for '$soname'" func_execute_cmds "$old_archive_from_expsyms_cmds" 'exit $?' fi # make sure the library variables are pointing to the new library dir=$output_objdir linklib=$newlib fi # test -n "$old_archive_from_expsyms_cmds" if test prog = "$linkmode" || test relink != "$opt_mode"; then add_shlibpath= add_dir= add= lib_linked=yes case $hardcode_action in immediate | unsupported) if test no = "$hardcode_direct"; then add=$dir/$linklib case $host in *-*-sco3.2v5.0.[024]*) add_dir=-L$dir ;; *-*-sysv4*uw2*) add_dir=-L$dir ;; *-*-sysv5OpenUNIX* | *-*-sysv5UnixWare7.[01].[10]* | \ *-*-unixware7*) add_dir=-L$dir ;; *-*-darwin* ) # if the lib is a (non-dlopened) module then we cannot # link against it, someone is ignoring the earlier warnings if /usr/bin/file -L $add 2> /dev/null | $GREP ": [^:]* bundle" >/dev/null; then if test "X$dlopenmodule" != "X$lib"; then $ECHO "*** Warning: lib $linklib is a module, not a shared library" if test -z "$old_library"; then echo echo "*** And there doesn't seem to be a static archive available" echo "*** The link will probably fail, sorry" else add=$dir/$old_library fi elif test -n "$old_library"; then add=$dir/$old_library fi fi esac elif test no = "$hardcode_minus_L"; then case $host in *-*-sunos*) add_shlibpath=$dir ;; esac add_dir=-L$dir add=-l$name elif test no = "$hardcode_shlibpath_var"; then add_shlibpath=$dir add=-l$name else lib_linked=no fi ;; relink) if test yes = "$hardcode_direct" && test no = "$hardcode_direct_absolute"; then add=$dir/$linklib elif test yes = "$hardcode_minus_L"; then add_dir=-L$absdir # Try looking first in the location we're being installed to. if test -n "$inst_prefix_dir"; then case $libdir in [\\/]*) func_append add_dir " -L$inst_prefix_dir$libdir" ;; esac fi add=-l$name elif test yes = "$hardcode_shlibpath_var"; then add_shlibpath=$dir add=-l$name else lib_linked=no fi ;; *) lib_linked=no ;; esac if test yes != "$lib_linked"; then func_fatal_configuration "unsupported hardcode properties" fi if test -n "$add_shlibpath"; then case :$compile_shlibpath: in *":$add_shlibpath:"*) ;; *) func_append compile_shlibpath "$add_shlibpath:" ;; esac fi if test prog = "$linkmode"; then test -n "$add_dir" && compile_deplibs="$add_dir $compile_deplibs" test -n "$add" && compile_deplibs="$add $compile_deplibs" else test -n "$add_dir" && deplibs="$add_dir $deplibs" test -n "$add" && deplibs="$add $deplibs" if test yes != "$hardcode_direct" && test yes != "$hardcode_minus_L" && test yes = "$hardcode_shlibpath_var"; then case :$finalize_shlibpath: in *":$libdir:"*) ;; *) func_append finalize_shlibpath "$libdir:" ;; esac fi fi fi if test prog = "$linkmode" || test relink = "$opt_mode"; then add_shlibpath= add_dir= add= # Finalize command for both is simple: just hardcode it. if test yes = "$hardcode_direct" && test no = "$hardcode_direct_absolute"; then add=$libdir/$linklib elif test yes = "$hardcode_minus_L"; then add_dir=-L$libdir add=-l$name elif test yes = "$hardcode_shlibpath_var"; then case :$finalize_shlibpath: in *":$libdir:"*) ;; *) func_append finalize_shlibpath "$libdir:" ;; esac add=-l$name elif test yes = "$hardcode_automatic"; then if test -n "$inst_prefix_dir" && test -f "$inst_prefix_dir$libdir/$linklib"; then add=$inst_prefix_dir$libdir/$linklib else add=$libdir/$linklib fi else # We cannot seem to hardcode it, guess we'll fake it. add_dir=-L$libdir # Try looking first in the location we're being installed to. if test -n "$inst_prefix_dir"; then case $libdir in [\\/]*) func_append add_dir " -L$inst_prefix_dir$libdir" ;; esac fi add=-l$name fi if test prog = "$linkmode"; then test -n "$add_dir" && finalize_deplibs="$add_dir $finalize_deplibs" test -n "$add" && finalize_deplibs="$add $finalize_deplibs" else test -n "$add_dir" && deplibs="$add_dir $deplibs" test -n "$add" && deplibs="$add $deplibs" fi fi elif test prog = "$linkmode"; then # Here we assume that one of hardcode_direct or hardcode_minus_L # is not unsupported. This is valid on all known static and # shared platforms. if test unsupported != "$hardcode_direct"; then test -n "$old_library" && linklib=$old_library compile_deplibs="$dir/$linklib $compile_deplibs" finalize_deplibs="$dir/$linklib $finalize_deplibs" else compile_deplibs="-l$name -L$dir $compile_deplibs" finalize_deplibs="-l$name -L$dir $finalize_deplibs" fi elif test yes = "$build_libtool_libs"; then # Not a shared library if test pass_all != "$deplibs_check_method"; then # We're trying link a shared library against a static one # but the system doesn't support it. # Just print a warning and add the library to dependency_libs so # that the program can be linked against the static library. echo $ECHO "*** Warning: This system cannot link to static lib archive $lib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have." if test yes = "$module"; then echo "*** But as you try to build a module library, libtool will still create " echo "*** a static module, that should work as long as the dlopening application" echo "*** is linked with the -dlopen flag to resolve symbols at runtime." if test -z "$global_symbol_pipe"; then echo echo "*** However, this would only work if libtool was able to extract symbol" echo "*** lists from a program, using 'nm' or equivalent, but libtool could" echo "*** not find such a program. So, this module is probably useless." echo "*** 'nm' from GNU binutils and a full rebuild may help." fi if test no = "$build_old_libs"; then build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi fi else deplibs="$dir/$old_library $deplibs" link_static=yes fi fi # link shared/static library? if test lib = "$linkmode"; then if test -n "$dependency_libs" && { test yes != "$hardcode_into_libs" || test yes = "$build_old_libs" || test yes = "$link_static"; }; then # Extract -R from dependency_libs temp_deplibs= for libdir in $dependency_libs; do case $libdir in -R*) func_stripname '-R' '' "$libdir" temp_xrpath=$func_stripname_result case " $xrpath " in *" $temp_xrpath "*) ;; *) func_append xrpath " $temp_xrpath";; esac;; *) func_append temp_deplibs " $libdir";; esac done dependency_libs=$temp_deplibs fi func_append newlib_search_path " $absdir" # Link against this library test no = "$link_static" && newdependency_libs="$abs_ladir/$laname $newdependency_libs" # ... and its dependency_libs tmp_libs= for deplib in $dependency_libs; do newdependency_libs="$deplib $newdependency_libs" case $deplib in -L*) func_stripname '-L' '' "$deplib" func_resolve_sysroot "$func_stripname_result";; *) func_resolve_sysroot "$deplib" ;; esac if $opt_preserve_dup_deps; then case "$tmp_libs " in *" $func_resolve_sysroot_result "*) func_append specialdeplibs " $func_resolve_sysroot_result" ;; esac fi func_append tmp_libs " $func_resolve_sysroot_result" done if test no != "$link_all_deplibs"; then # Add the search paths of all dependency libraries for deplib in $dependency_libs; do path= case $deplib in -L*) path=$deplib ;; *.la) func_resolve_sysroot "$deplib" deplib=$func_resolve_sysroot_result func_dirname "$deplib" "" "." dir=$func_dirname_result # We need an absolute path. case $dir in [\\/]* | [A-Za-z]:[\\/]*) absdir=$dir ;; *) absdir=`cd "$dir" && pwd` if test -z "$absdir"; then func_warning "cannot determine absolute directory name of '$dir'" absdir=$dir fi ;; esac if $GREP "^installed=no" $deplib > /dev/null; then case $host in *-*-darwin*) depdepl= eval deplibrary_names=`$SED -n -e 's/^library_names=\(.*\)$/\1/p' $deplib` if test -n "$deplibrary_names"; then for tmp in $deplibrary_names; do depdepl=$tmp done if test -f "$absdir/$objdir/$depdepl"; then depdepl=$absdir/$objdir/$depdepl darwin_install_name=`$OTOOL -L $depdepl | awk '{if (NR == 2) {print $1;exit}}'` if test -z "$darwin_install_name"; then darwin_install_name=`$OTOOL64 -L $depdepl | awk '{if (NR == 2) {print $1;exit}}'` fi func_append compiler_flags " $wl-dylib_file $wl$darwin_install_name:$depdepl" func_append linker_flags " -dylib_file $darwin_install_name:$depdepl" path= fi fi ;; *) path=-L$absdir/$objdir ;; esac else eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $deplib` test -z "$libdir" && \ func_fatal_error "'$deplib' is not a valid libtool archive" test "$absdir" != "$libdir" && \ func_warning "'$deplib' seems to be moved" path=-L$absdir fi ;; esac case " $deplibs " in *" $path "*) ;; *) deplibs="$path $deplibs" ;; esac done fi # link_all_deplibs != no fi # linkmode = lib done # for deplib in $libs if test link = "$pass"; then if test prog = "$linkmode"; then compile_deplibs="$new_inherited_linker_flags $compile_deplibs" finalize_deplibs="$new_inherited_linker_flags $finalize_deplibs" else compiler_flags="$compiler_flags "`$ECHO " $new_inherited_linker_flags" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` fi fi dependency_libs=$newdependency_libs if test dlpreopen = "$pass"; then # Link the dlpreopened libraries before other libraries for deplib in $save_deplibs; do deplibs="$deplib $deplibs" done fi if test dlopen != "$pass"; then test conv = "$pass" || { # Make sure lib_search_path contains only unique directories. lib_search_path= for dir in $newlib_search_path; do case "$lib_search_path " in *" $dir "*) ;; *) func_append lib_search_path " $dir" ;; esac done newlib_search_path= } if test prog,link = "$linkmode,$pass"; then vars="compile_deplibs finalize_deplibs" else vars=deplibs fi for var in $vars dependency_libs; do # Add libraries to $var in reverse order eval tmp_libs=\"\$$var\" new_libs= for deplib in $tmp_libs; do # FIXME: Pedantically, this is the right thing to do, so # that some nasty dependency loop isn't accidentally # broken: #new_libs="$deplib $new_libs" # Pragmatically, this seems to cause very few problems in # practice: case $deplib in -L*) new_libs="$deplib $new_libs" ;; -R*) ;; *) # And here is the reason: when a library appears more # than once as an explicit dependence of a library, or # is implicitly linked in more than once by the # compiler, it is considered special, and multiple # occurrences thereof are not removed. Compare this # with having the same library being listed as a # dependency of multiple other libraries: in this case, # we know (pedantically, we assume) the library does not # need to be listed more than once, so we keep only the # last copy. This is not always right, but it is rare # enough that we require users that really mean to play # such unportable linking tricks to link the library # using -Wl,-lname, so that libtool does not consider it # for duplicate removal. case " $specialdeplibs " in *" $deplib "*) new_libs="$deplib $new_libs" ;; *) case " $new_libs " in *" $deplib "*) ;; *) new_libs="$deplib $new_libs" ;; esac ;; esac ;; esac done tmp_libs= for deplib in $new_libs; do case $deplib in -L*) case " $tmp_libs " in *" $deplib "*) ;; *) func_append tmp_libs " $deplib" ;; esac ;; *) func_append tmp_libs " $deplib" ;; esac done eval $var=\"$tmp_libs\" done # for var fi # Add Sun CC postdeps if required: test CXX = "$tagname" && { case $host_os in linux*) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 func_suncc_cstd_abi if test no != "$suncc_use_cstd_abi"; then func_append postdeps ' -library=Cstd -library=Crun' fi ;; esac ;; solaris*) func_cc_basename "$CC" case $func_cc_basename_result in CC* | sunCC*) func_suncc_cstd_abi if test no != "$suncc_use_cstd_abi"; then func_append postdeps ' -library=Cstd -library=Crun' fi ;; esac ;; esac } # Last step: remove runtime libs from dependency_libs # (they stay in deplibs) tmp_libs= for i in $dependency_libs; do case " $predeps $postdeps $compiler_lib_search_path " in *" $i "*) i= ;; esac if test -n "$i"; then func_append tmp_libs " $i" fi done dependency_libs=$tmp_libs done # for pass if test prog = "$linkmode"; then dlfiles=$newdlfiles fi if test prog = "$linkmode" || test lib = "$linkmode"; then dlprefiles=$newdlprefiles fi case $linkmode in oldlib) if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then func_warning "'-dlopen' is ignored for archives" fi case " $deplibs" in *\ -l* | *\ -L*) func_warning "'-l' and '-L' are ignored for archives" ;; esac test -n "$rpath" && \ func_warning "'-rpath' is ignored for archives" test -n "$xrpath" && \ func_warning "'-R' is ignored for archives" test -n "$vinfo" && \ func_warning "'-version-info/-version-number' is ignored for archives" test -n "$release" && \ func_warning "'-release' is ignored for archives" test -n "$export_symbols$export_symbols_regex" && \ func_warning "'-export-symbols' is ignored for archives" # Now set the variables for building old libraries. build_libtool_libs=no oldlibs=$output func_append objs "$old_deplibs" ;; lib) # Make sure we only generate libraries of the form 'libNAME.la'. case $outputname in lib*) func_stripname 'lib' '.la' "$outputname" name=$func_stripname_result eval shared_ext=\"$shrext_cmds\" eval libname=\"$libname_spec\" ;; *) test no = "$module" \ && func_fatal_help "libtool library '$output' must begin with 'lib'" if test no != "$need_lib_prefix"; then # Add the "lib" prefix for modules if required func_stripname '' '.la' "$outputname" name=$func_stripname_result eval shared_ext=\"$shrext_cmds\" eval libname=\"$libname_spec\" else func_stripname '' '.la' "$outputname" libname=$func_stripname_result fi ;; esac if test -n "$objs"; then if test pass_all != "$deplibs_check_method"; then func_fatal_error "cannot build libtool library '$output' from non-libtool objects on this host:$objs" else echo $ECHO "*** Warning: Linking the shared library $output against the non-libtool" $ECHO "*** objects $objs is not portable!" func_append libobjs " $objs" fi fi test no = "$dlself" \ || func_warning "'-dlopen self' is ignored for libtool libraries" set dummy $rpath shift test 1 -lt "$#" \ && func_warning "ignoring multiple '-rpath's for a libtool library" install_libdir=$1 oldlibs= if test -z "$rpath"; then if test yes = "$build_libtool_libs"; then # Building a libtool convenience library. # Some compilers have problems with a '.al' extension so # convenience libraries should have the same extension an # archive normally would. oldlibs="$output_objdir/$libname.$libext $oldlibs" build_libtool_libs=convenience build_old_libs=yes fi test -n "$vinfo" && \ func_warning "'-version-info/-version-number' is ignored for convenience libraries" test -n "$release" && \ func_warning "'-release' is ignored for convenience libraries" else # Parse the version information argument. save_ifs=$IFS; IFS=: set dummy $vinfo 0 0 0 shift IFS=$save_ifs test -n "$7" && \ func_fatal_help "too many parameters to '-version-info'" # convert absolute version numbers to libtool ages # this retains compatibility with .la files and attempts # to make the code below a bit more comprehensible case $vinfo_number in yes) number_major=$1 number_minor=$2 number_revision=$3 # # There are really only two kinds -- those that # use the current revision as the major version # and those that subtract age and use age as # a minor version. But, then there is irix # that has an extra 1 added just for fun # case $version_type in # correct linux to gnu/linux during the next big refactor darwin|freebsd-elf|linux|osf|windows|none) func_arith $number_major + $number_minor current=$func_arith_result age=$number_minor revision=$number_revision ;; freebsd-aout|qnx|sunos) current=$number_major revision=$number_minor age=0 ;; irix|nonstopux) func_arith $number_major + $number_minor current=$func_arith_result age=$number_minor revision=$number_minor lt_irix_increment=no ;; *) func_fatal_configuration "$modename: unknown library version type '$version_type'" ;; esac ;; no) current=$1 revision=$2 age=$3 ;; esac # Check that each of the things are valid numbers. case $current in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "CURRENT '$current' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac case $revision in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "REVISION '$revision' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac case $age in 0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]|[1-9][0-9][0-9][0-9]|[1-9][0-9][0-9][0-9][0-9]) ;; *) func_error "AGE '$age' must be a nonnegative integer" func_fatal_error "'$vinfo' is not valid version information" ;; esac if test "$age" -gt "$current"; then func_error "AGE '$age' is greater than the current interface number '$current'" func_fatal_error "'$vinfo' is not valid version information" fi # Calculate the version variables. major= versuffix= verstring= case $version_type in none) ;; darwin) # Like Linux, but with the current version available in # verstring for coding it into the library header func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision # Darwin ld doesn't like 0 for these options... func_arith $current + 1 minor_current=$func_arith_result xlcverstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision" verstring="-compatibility_version $minor_current -current_version $minor_current.$revision" # On Darwin other compilers case $CC in nagfor*) verstring="$wl-compatibility_version $wl$minor_current $wl-current_version $wl$minor_current.$revision" ;; *) verstring="-compatibility_version $minor_current -current_version $minor_current.$revision" ;; esac ;; freebsd-aout) major=.$current versuffix=.$current.$revision ;; freebsd-elf) func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision ;; irix | nonstopux) if test no = "$lt_irix_increment"; then func_arith $current - $age else func_arith $current - $age + 1 fi major=$func_arith_result case $version_type in nonstopux) verstring_prefix=nonstopux ;; *) verstring_prefix=sgi ;; esac verstring=$verstring_prefix$major.$revision # Add in all the interfaces that we are compatible with. loop=$revision while test 0 -ne "$loop"; do func_arith $revision - $loop iface=$func_arith_result func_arith $loop - 1 loop=$func_arith_result verstring=$verstring_prefix$major.$iface:$verstring done # Before this point, $major must not contain '.'. major=.$major versuffix=$major.$revision ;; linux) # correct to gnu/linux during the next big refactor func_arith $current - $age major=.$func_arith_result versuffix=$major.$age.$revision ;; osf) func_arith $current - $age major=.$func_arith_result versuffix=.$current.$age.$revision verstring=$current.$age.$revision # Add in all the interfaces that we are compatible with. loop=$age while test 0 -ne "$loop"; do func_arith $current - $loop iface=$func_arith_result func_arith $loop - 1 loop=$func_arith_result verstring=$verstring:$iface.0 done # Make executables depend on our current version. func_append verstring ":$current.0" ;; qnx) major=.$current versuffix=.$current ;; sco) major=.$current versuffix=.$current ;; sunos) major=.$current versuffix=.$current.$revision ;; windows) # Use '-' rather than '.', since we only want one # extension on DOS 8.3 file systems. func_arith $current - $age major=$func_arith_result versuffix=-$major ;; *) func_fatal_configuration "unknown library version type '$version_type'" ;; esac # Clear the version info if we defaulted, and they specified a release. if test -z "$vinfo" && test -n "$release"; then major= case $version_type in darwin) # we can't check for "0.0" in archive_cmds due to quoting # problems, so we reset it completely verstring= ;; *) verstring=0.0 ;; esac if test no = "$need_version"; then versuffix= else versuffix=.0.0 fi fi # Remove version info from name if versioning should be avoided if test yes,no = "$avoid_version,$need_version"; then major= versuffix= verstring= fi # Check to see if the archive will have undefined symbols. if test yes = "$allow_undefined"; then if test unsupported = "$allow_undefined_flag"; then if test yes = "$build_old_libs"; then func_warning "undefined symbols not allowed in $host shared libraries; building static only" build_libtool_libs=no else func_fatal_error "can't build $host shared library unless -no-undefined is specified" fi fi else # Don't allow undefined symbols. allow_undefined_flag=$no_undefined_flag fi fi func_generate_dlsyms "$libname" "$libname" : func_append libobjs " $symfileobj" test " " = "$libobjs" && libobjs= if test relink != "$opt_mode"; then # Remove our outputs, but don't remove object files since they # may have been created when compiling PIC objects. removelist= tempremovelist=`$ECHO "$output_objdir/*"` for p in $tempremovelist; do case $p in *.$objext | *.gcno) ;; $output_objdir/$outputname | $output_objdir/$libname.* | $output_objdir/$libname$release.*) if test -n "$precious_files_regex"; then if $ECHO "$p" | $EGREP -e "$precious_files_regex" >/dev/null 2>&1 then continue fi fi func_append removelist " $p" ;; *) ;; esac done test -n "$removelist" && \ func_show_eval "${RM}r \$removelist" fi # Now set the variables for building old libraries. if test yes = "$build_old_libs" && test convenience != "$build_libtool_libs"; then func_append oldlibs " $output_objdir/$libname.$libext" # Transform .lo files to .o files. oldobjs="$objs "`$ECHO "$libobjs" | $SP2NL | $SED "/\.$libext$/d; $lo2o" | $NL2SP` fi # Eliminate all temporary directories. #for path in $notinst_path; do # lib_search_path=`$ECHO "$lib_search_path " | $SED "s% $path % %g"` # deplibs=`$ECHO "$deplibs " | $SED "s% -L$path % %g"` # dependency_libs=`$ECHO "$dependency_libs " | $SED "s% -L$path % %g"` #done if test -n "$xrpath"; then # If the user specified any rpath flags, then add them. temp_xrpath= for libdir in $xrpath; do func_replace_sysroot "$libdir" func_append temp_xrpath " -R$func_replace_sysroot_result" case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac done if test yes != "$hardcode_into_libs" || test yes = "$build_old_libs"; then dependency_libs="$temp_xrpath $dependency_libs" fi fi # Make sure dlfiles contains only unique files that won't be dlpreopened old_dlfiles=$dlfiles dlfiles= for lib in $old_dlfiles; do case " $dlprefiles $dlfiles " in *" $lib "*) ;; *) func_append dlfiles " $lib" ;; esac done # Make sure dlprefiles contains only unique files old_dlprefiles=$dlprefiles dlprefiles= for lib in $old_dlprefiles; do case "$dlprefiles " in *" $lib "*) ;; *) func_append dlprefiles " $lib" ;; esac done if test yes = "$build_libtool_libs"; then if test -n "$rpath"; then case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-*-beos* | *-cegcc* | *-*-haiku*) # these systems don't actually have a c library (as such)! ;; *-*-rhapsody* | *-*-darwin1.[012]) # Rhapsody C library is in the System framework func_append deplibs " System.ltframework" ;; *-*-netbsd*) # Don't link with libc until the a.out ld.so is fixed. ;; *-*-openbsd* | *-*-freebsd* | *-*-dragonfly*) # Do not include libc due to us having libc/libc_r. ;; *-*-sco3.2v5* | *-*-sco5v6*) # Causes problems with __ctype ;; *-*-sysv4.2uw2* | *-*-sysv5* | *-*-unixware* | *-*-OpenUNIX*) # Compiler inserts libc in the correct place for threads to work ;; *) # Add libc to deplibs on all other systems if necessary. if test yes = "$build_libtool_need_lc"; then func_append deplibs " -lc" fi ;; esac fi # Transform deplibs into only deplibs that can be linked in shared. name_save=$name libname_save=$libname release_save=$release versuffix_save=$versuffix major_save=$major # I'm not sure if I'm treating the release correctly. I think # release should show up in the -l (ie -lgmp5) so we don't want to # add it in twice. Is that correct? release= versuffix= major= newdeplibs= droppeddeps=no case $deplibs_check_method in pass_all) # Don't check for shared/static. Everything works. # This might be a little naive. We might want to check # whether the library exists or not. But this is on # osf3 & osf4 and I'm not really sure... Just # implementing what was already the behavior. newdeplibs=$deplibs ;; test_compile) # This code stresses the "libraries are programs" paradigm to its # limits. Maybe even breaks it. We compile a program, linking it # against the deplibs as a proxy for the library. Then we can check # whether they linked in statically or dynamically with ldd. $opt_dry_run || $RM conftest.c cat > conftest.c </dev/null` $nocaseglob else potential_libs=`ls $i/$libnameglob[.-]* 2>/dev/null` fi for potent_lib in $potential_libs; do # Follow soft links. if ls -lLd "$potent_lib" 2>/dev/null | $GREP " -> " >/dev/null; then continue fi # The statement above tries to avoid entering an # endless loop below, in case of cyclic links. # We might still enter an endless loop, since a link # loop can be closed while we follow links, # but so what? potlib=$potent_lib while test -h "$potlib" 2>/dev/null; do potliblink=`ls -ld $potlib | $SED 's/.* -> //'` case $potliblink in [\\/]* | [A-Za-z]:[\\/]*) potlib=$potliblink;; *) potlib=`$ECHO "$potlib" | $SED 's|[^/]*$||'`"$potliblink";; esac done if eval $file_magic_cmd \"\$potlib\" 2>/dev/null | $SED -e 10q | $EGREP "$file_magic_regex" > /dev/null; then func_append newdeplibs " $a_deplib" a_deplib= break 2 fi done done fi if test -n "$a_deplib"; then droppeddeps=yes echo $ECHO "*** Warning: linker path does not have real file for library $a_deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because I did check the linker path looking for a file starting" if test -z "$potlib"; then $ECHO "*** with $libname but no candidates were found. (...for file magic test)" else $ECHO "*** with $libname and none of the candidates passed a file format test" $ECHO "*** using a file magic. Last file checked: $potlib" fi fi ;; *) # Add a -L argument. func_append newdeplibs " $a_deplib" ;; esac done # Gone through all deplibs. ;; match_pattern*) set dummy $deplibs_check_method; shift match_pattern_regex=`expr "$deplibs_check_method" : "$1 \(.*\)"` for a_deplib in $deplibs; do case $a_deplib in -l*) func_stripname -l '' "$a_deplib" name=$func_stripname_result if test yes = "$allow_libtool_libs_with_static_runtimes"; then case " $predeps $postdeps " in *" $a_deplib "*) func_append newdeplibs " $a_deplib" a_deplib= ;; esac fi if test -n "$a_deplib"; then libname=`eval "\\$ECHO \"$libname_spec\""` for i in $lib_search_path $sys_lib_search_path $shlib_search_path; do potential_libs=`ls $i/$libname[.-]* 2>/dev/null` for potent_lib in $potential_libs; do potlib=$potent_lib # see symlink-check above in file_magic test if eval "\$ECHO \"$potent_lib\"" 2>/dev/null | $SED 10q | \ $EGREP "$match_pattern_regex" > /dev/null; then func_append newdeplibs " $a_deplib" a_deplib= break 2 fi done done fi if test -n "$a_deplib"; then droppeddeps=yes echo $ECHO "*** Warning: linker path does not have real file for library $a_deplib." echo "*** I have the capability to make that library automatically link in when" echo "*** you link to this library. But I can only do this if you have a" echo "*** shared version of the library, which you do not appear to have" echo "*** because I did check the linker path looking for a file starting" if test -z "$potlib"; then $ECHO "*** with $libname but no candidates were found. (...for regex pattern test)" else $ECHO "*** with $libname and none of the candidates passed a file format test" $ECHO "*** using a regex pattern. Last file checked: $potlib" fi fi ;; *) # Add a -L argument. func_append newdeplibs " $a_deplib" ;; esac done # Gone through all deplibs. ;; none | unknown | *) newdeplibs= tmp_deplibs=`$ECHO " $deplibs" | $SED 's/ -lc$//; s/ -[LR][^ ]*//g'` if test yes = "$allow_libtool_libs_with_static_runtimes"; then for i in $predeps $postdeps; do # can't use Xsed below, because $i might contain '/' tmp_deplibs=`$ECHO " $tmp_deplibs" | $SED "s|$i||"` done fi case $tmp_deplibs in *[!\ \ ]*) echo if test none = "$deplibs_check_method"; then echo "*** Warning: inter-library dependencies are not supported in this platform." else echo "*** Warning: inter-library dependencies are not known to be supported." fi echo "*** All declared inter-library dependencies are being dropped." droppeddeps=yes ;; esac ;; esac versuffix=$versuffix_save major=$major_save release=$release_save libname=$libname_save name=$name_save case $host in *-*-rhapsody* | *-*-darwin1.[012]) # On Rhapsody replace the C library with the System framework newdeplibs=`$ECHO " $newdeplibs" | $SED 's/ -lc / System.ltframework /'` ;; esac if test yes = "$droppeddeps"; then if test yes = "$module"; then echo echo "*** Warning: libtool could not satisfy all declared inter-library" $ECHO "*** dependencies of module $libname. Therefore, libtool will create" echo "*** a static module, that should work as long as the dlopening" echo "*** application is linked with the -dlopen flag." if test -z "$global_symbol_pipe"; then echo echo "*** However, this would only work if libtool was able to extract symbol" echo "*** lists from a program, using 'nm' or equivalent, but libtool could" echo "*** not find such a program. So, this module is probably useless." echo "*** 'nm' from GNU binutils and a full rebuild may help." fi if test no = "$build_old_libs"; then oldlibs=$output_objdir/$libname.$libext build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi else echo "*** The inter-library dependencies that have been dropped here will be" echo "*** automatically added whenever a program is linked with this library" echo "*** or is declared to -dlopen it." if test no = "$allow_undefined"; then echo echo "*** Since this library must not contain undefined symbols," echo "*** because either the platform does not support them or" echo "*** it was explicitly requested with -no-undefined," echo "*** libtool will only create a static version of it." if test no = "$build_old_libs"; then oldlibs=$output_objdir/$libname.$libext build_libtool_libs=module build_old_libs=yes else build_libtool_libs=no fi fi fi fi # Done checking deplibs! deplibs=$newdeplibs fi # Time to change all our "foo.ltframework" stuff back to "-framework foo" case $host in *-*-darwin*) newdeplibs=`$ECHO " $newdeplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` new_inherited_linker_flags=`$ECHO " $new_inherited_linker_flags" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` deplibs=`$ECHO " $deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` ;; esac # move library search paths that coincide with paths to not yet # installed libraries to the beginning of the library search list new_libs= for path in $notinst_path; do case " $new_libs " in *" -L$path/$objdir "*) ;; *) case " $deplibs " in *" -L$path/$objdir "*) func_append new_libs " -L$path/$objdir" ;; esac ;; esac done for deplib in $deplibs; do case $deplib in -L*) case " $new_libs " in *" $deplib "*) ;; *) func_append new_libs " $deplib" ;; esac ;; *) func_append new_libs " $deplib" ;; esac done deplibs=$new_libs # All the library-specific variables (install_libdir is set above). library_names= old_library= dlname= # Test again, we may have decided not to build it any more if test yes = "$build_libtool_libs"; then # Remove $wl instances when linking with ld. # FIXME: should test the right _cmds variable. case $archive_cmds in *\$LD\ *) wl= ;; esac if test yes = "$hardcode_into_libs"; then # Hardcode the library paths hardcode_libdirs= dep_rpath= rpath=$finalize_rpath test relink = "$opt_mode" || rpath=$compile_rpath$rpath for libdir in $rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then func_replace_sysroot "$libdir" libdir=$func_replace_sysroot_result if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append dep_rpath " $flag" fi elif test -n "$runpath_var"; then case "$perm_rpath " in *" $libdir "*) ;; *) func_append perm_rpath " $libdir" ;; esac fi done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval "dep_rpath=\"$hardcode_libdir_flag_spec\"" fi if test -n "$runpath_var" && test -n "$perm_rpath"; then # We should set the runpath_var. rpath= for dir in $perm_rpath; do func_append rpath "$dir:" done eval "$runpath_var='$rpath\$$runpath_var'; export $runpath_var" fi test -n "$dep_rpath" && deplibs="$dep_rpath $deplibs" fi shlibpath=$finalize_shlibpath test relink = "$opt_mode" || shlibpath=$compile_shlibpath$shlibpath if test -n "$shlibpath"; then eval "$shlibpath_var='$shlibpath\$$shlibpath_var'; export $shlibpath_var" fi # Get the real and link names of the library. eval shared_ext=\"$shrext_cmds\" eval library_names=\"$library_names_spec\" set dummy $library_names shift realname=$1 shift if test -n "$soname_spec"; then eval soname=\"$soname_spec\" else soname=$realname fi if test -z "$dlname"; then dlname=$soname fi lib=$output_objdir/$realname linknames= for link do func_append linknames " $link" done # Use standard objects if they are pic test -z "$pic_flag" && libobjs=`$ECHO "$libobjs" | $SP2NL | $SED "$lo2o" | $NL2SP` test "X$libobjs" = "X " && libobjs= delfiles= if test -n "$export_symbols" && test -n "$include_expsyms"; then $opt_dry_run || cp "$export_symbols" "$output_objdir/$libname.uexp" export_symbols=$output_objdir/$libname.uexp func_append delfiles " $export_symbols" fi orig_export_symbols= case $host_os in cygwin* | mingw* | cegcc*) if test -n "$export_symbols" && test -z "$export_symbols_regex"; then # exporting using user supplied symfile func_dll_def_p "$export_symbols" || { # and it's NOT already a .def file. Must figure out # which of the given symbols are data symbols and tag # them as such. So, trigger use of export_symbols_cmds. # export_symbols gets reassigned inside the "prepare # the list of exported symbols" if statement, so the # include_expsyms logic still works. orig_export_symbols=$export_symbols export_symbols= always_export_symbols=yes } fi ;; esac # Prepare the list of exported symbols if test -z "$export_symbols"; then if test yes = "$always_export_symbols" || test -n "$export_symbols_regex"; then func_verbose "generating symbol list for '$libname.la'" export_symbols=$output_objdir/$libname.exp $opt_dry_run || $RM $export_symbols cmds=$export_symbols_cmds save_ifs=$IFS; IFS='~' for cmd1 in $cmds; do IFS=$save_ifs # Take the normal branch if the nm_file_list_spec branch # doesn't work or if tool conversion is not needed. case $nm_file_list_spec~$to_tool_file_cmd in *~func_convert_file_noop | *~func_convert_file_msys_to_w32 | ~*) try_normal_branch=yes eval cmd=\"$cmd1\" func_len " $cmd" len=$func_len_result ;; *) try_normal_branch=no ;; esac if test yes = "$try_normal_branch" \ && { test "$len" -lt "$max_cmd_len" \ || test "$max_cmd_len" -le -1; } then func_show_eval "$cmd" 'exit $?' skipped_export=false elif test -n "$nm_file_list_spec"; then func_basename "$output" output_la=$func_basename_result save_libobjs=$libobjs save_output=$output output=$output_objdir/$output_la.nm func_to_tool_file "$output" libobjs=$nm_file_list_spec$func_to_tool_file_result func_append delfiles " $output" func_verbose "creating $NM input file list: $output" for obj in $save_libobjs; do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" done > "$output" eval cmd=\"$cmd1\" func_show_eval "$cmd" 'exit $?' output=$save_output libobjs=$save_libobjs skipped_export=false else # The command line is too long to execute in one step. func_verbose "using reloadable object file for export list..." skipped_export=: # Break out early, otherwise skipped_export may be # set to false by a later but shorter cmd. break fi done IFS=$save_ifs if test -n "$export_symbols_regex" && test : != "$skipped_export"; then func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"' func_show_eval '$MV "${export_symbols}T" "$export_symbols"' fi fi fi if test -n "$export_symbols" && test -n "$include_expsyms"; then tmp_export_symbols=$export_symbols test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols $opt_dry_run || eval '$ECHO "$include_expsyms" | $SP2NL >> "$tmp_export_symbols"' fi if test : != "$skipped_export" && test -n "$orig_export_symbols"; then # The given exports_symbols file has to be filtered, so filter it. func_verbose "filter symbol list for '$libname.la' to tag DATA exports" # FIXME: $output_objdir/$libname.filter potentially contains lots of # 's' commands, which not all seds can handle. GNU sed should be fine # though. Also, the filter scales superlinearly with the number of # global variables. join(1) would be nice here, but unfortunately # isn't a blessed tool. $opt_dry_run || $SED -e '/[ ,]DATA/!d;s,\(.*\)\([ \,].*\),s|^\1$|\1\2|,' < $export_symbols > $output_objdir/$libname.filter func_append delfiles " $export_symbols $output_objdir/$libname.filter" export_symbols=$output_objdir/$libname.def $opt_dry_run || $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols fi tmp_deplibs= for test_deplib in $deplibs; do case " $convenience " in *" $test_deplib "*) ;; *) func_append tmp_deplibs " $test_deplib" ;; esac done deplibs=$tmp_deplibs if test -n "$convenience"; then if test -n "$whole_archive_flag_spec" && test yes = "$compiler_needs_object" && test -z "$libobjs"; then # extract the archives, so we have objects to list. # TODO: could optimize this to just extract one archive. whole_archive_flag_spec= fi if test -n "$whole_archive_flag_spec"; then save_libobjs=$libobjs eval libobjs=\"\$libobjs $whole_archive_flag_spec\" test "X$libobjs" = "X " && libobjs= else gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $convenience func_append libobjs " $func_extract_archives_result" test "X$libobjs" = "X " && libobjs= fi fi if test yes = "$thread_safe" && test -n "$thread_safe_flag_spec"; then eval flag=\"$thread_safe_flag_spec\" func_append linker_flags " $flag" fi # Make a backup of the uninstalled library when relinking if test relink = "$opt_mode"; then $opt_dry_run || eval '(cd $output_objdir && $RM ${realname}U && $MV $realname ${realname}U)' || exit $? fi # Do each of the archive commands. if test yes = "$module" && test -n "$module_cmds"; then if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then eval test_cmds=\"$module_expsym_cmds\" cmds=$module_expsym_cmds else eval test_cmds=\"$module_cmds\" cmds=$module_cmds fi else if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then eval test_cmds=\"$archive_expsym_cmds\" cmds=$archive_expsym_cmds else eval test_cmds=\"$archive_cmds\" cmds=$archive_cmds fi fi if test : != "$skipped_export" && func_len " $test_cmds" && len=$func_len_result && test "$len" -lt "$max_cmd_len" || test "$max_cmd_len" -le -1; then : else # The command line is too long to link in one step, link piecewise # or, if using GNU ld and skipped_export is not :, use a linker # script. # Save the value of $output and $libobjs because we want to # use them later. If we have whole_archive_flag_spec, we # want to use save_libobjs as it was before # whole_archive_flag_spec was expanded, because we can't # assume the linker understands whole_archive_flag_spec. # This may have to be revisited, in case too many # convenience libraries get linked in and end up exceeding # the spec. if test -z "$convenience" || test -z "$whole_archive_flag_spec"; then save_libobjs=$libobjs fi save_output=$output func_basename "$output" output_la=$func_basename_result # Clear the reloadable object creation command queue and # initialize k to one. test_cmds= concat_cmds= objlist= last_robj= k=1 if test -n "$save_libobjs" && test : != "$skipped_export" && test yes = "$with_gnu_ld"; then output=$output_objdir/$output_la.lnkscript func_verbose "creating GNU ld script: $output" echo 'INPUT (' > $output for obj in $save_libobjs do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" >> $output done echo ')' >> $output func_append delfiles " $output" func_to_tool_file "$output" output=$func_to_tool_file_result elif test -n "$save_libobjs" && test : != "$skipped_export" && test -n "$file_list_spec"; then output=$output_objdir/$output_la.lnk func_verbose "creating linker input file list: $output" : > $output set x $save_libobjs shift firstobj= if test yes = "$compiler_needs_object"; then firstobj="$1 " shift fi for obj do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" >> $output done func_append delfiles " $output" func_to_tool_file "$output" output=$firstobj\"$file_list_spec$func_to_tool_file_result\" else if test -n "$save_libobjs"; then func_verbose "creating reloadable object files..." output=$output_objdir/$output_la-$k.$objext eval test_cmds=\"$reload_cmds\" func_len " $test_cmds" len0=$func_len_result len=$len0 # Loop over the list of objects to be linked. for obj in $save_libobjs do func_len " $obj" func_arith $len + $func_len_result len=$func_arith_result if test -z "$objlist" || test "$len" -lt "$max_cmd_len"; then func_append objlist " $obj" else # The command $test_cmds is almost too long, add a # command to the queue. if test 1 -eq "$k"; then # The first file doesn't have a previous command to add. reload_objs=$objlist eval concat_cmds=\"$reload_cmds\" else # All subsequent reloadable object files will link in # the last one created. reload_objs="$objlist $last_robj" eval concat_cmds=\"\$concat_cmds~$reload_cmds~\$RM $last_robj\" fi last_robj=$output_objdir/$output_la-$k.$objext func_arith $k + 1 k=$func_arith_result output=$output_objdir/$output_la-$k.$objext objlist=" $obj" func_len " $last_robj" func_arith $len0 + $func_len_result len=$func_arith_result fi done # Handle the remaining objects by creating one last # reloadable object file. All subsequent reloadable object # files will link in the last one created. test -z "$concat_cmds" || concat_cmds=$concat_cmds~ reload_objs="$objlist $last_robj" eval concat_cmds=\"\$concat_cmds$reload_cmds\" if test -n "$last_robj"; then eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\" fi func_append delfiles " $output" else output= fi ${skipped_export-false} && { func_verbose "generating symbol list for '$libname.la'" export_symbols=$output_objdir/$libname.exp $opt_dry_run || $RM $export_symbols libobjs=$output # Append the command to create the export file. test -z "$concat_cmds" || concat_cmds=$concat_cmds~ eval concat_cmds=\"\$concat_cmds$export_symbols_cmds\" if test -n "$last_robj"; then eval concat_cmds=\"\$concat_cmds~\$RM $last_robj\" fi } test -n "$save_libobjs" && func_verbose "creating a temporary reloadable object file: $output" # Loop through the commands generated above and execute them. save_ifs=$IFS; IFS='~' for cmd in $concat_cmds; do IFS=$save_ifs $opt_quiet || { func_quote_for_expand "$cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || eval "$cmd" || { lt_exit=$? # Restore the uninstalled library and exit if test relink = "$opt_mode"; then ( cd "$output_objdir" && \ $RM "${realname}T" && \ $MV "${realname}U" "$realname" ) fi exit $lt_exit } done IFS=$save_ifs if test -n "$export_symbols_regex" && ${skipped_export-false}; then func_show_eval '$EGREP -e "$export_symbols_regex" "$export_symbols" > "${export_symbols}T"' func_show_eval '$MV "${export_symbols}T" "$export_symbols"' fi fi ${skipped_export-false} && { if test -n "$export_symbols" && test -n "$include_expsyms"; then tmp_export_symbols=$export_symbols test -n "$orig_export_symbols" && tmp_export_symbols=$orig_export_symbols $opt_dry_run || eval '$ECHO "$include_expsyms" | $SP2NL >> "$tmp_export_symbols"' fi if test -n "$orig_export_symbols"; then # The given exports_symbols file has to be filtered, so filter it. func_verbose "filter symbol list for '$libname.la' to tag DATA exports" # FIXME: $output_objdir/$libname.filter potentially contains lots of # 's' commands, which not all seds can handle. GNU sed should be fine # though. Also, the filter scales superlinearly with the number of # global variables. join(1) would be nice here, but unfortunately # isn't a blessed tool. $opt_dry_run || $SED -e '/[ ,]DATA/!d;s,\(.*\)\([ \,].*\),s|^\1$|\1\2|,' < $export_symbols > $output_objdir/$libname.filter func_append delfiles " $export_symbols $output_objdir/$libname.filter" export_symbols=$output_objdir/$libname.def $opt_dry_run || $SED -f $output_objdir/$libname.filter < $orig_export_symbols > $export_symbols fi } libobjs=$output # Restore the value of output. output=$save_output if test -n "$convenience" && test -n "$whole_archive_flag_spec"; then eval libobjs=\"\$libobjs $whole_archive_flag_spec\" test "X$libobjs" = "X " && libobjs= fi # Expand the library linking commands again to reset the # value of $libobjs for piecewise linking. # Do each of the archive commands. if test yes = "$module" && test -n "$module_cmds"; then if test -n "$export_symbols" && test -n "$module_expsym_cmds"; then cmds=$module_expsym_cmds else cmds=$module_cmds fi else if test -n "$export_symbols" && test -n "$archive_expsym_cmds"; then cmds=$archive_expsym_cmds else cmds=$archive_cmds fi fi fi if test -n "$delfiles"; then # Append the command to remove temporary files to $cmds. eval cmds=\"\$cmds~\$RM $delfiles\" fi # Add any objects from preloaded convenience libraries if test -n "$dlprefiles"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $dlprefiles func_append libobjs " $func_extract_archives_result" test "X$libobjs" = "X " && libobjs= fi save_ifs=$IFS; IFS='~' for cmd in $cmds; do IFS=$sp$nl eval cmd=\"$cmd\" IFS=$save_ifs $opt_quiet || { func_quote_for_expand "$cmd" eval "func_echo $func_quote_for_expand_result" } $opt_dry_run || eval "$cmd" || { lt_exit=$? # Restore the uninstalled library and exit if test relink = "$opt_mode"; then ( cd "$output_objdir" && \ $RM "${realname}T" && \ $MV "${realname}U" "$realname" ) fi exit $lt_exit } done IFS=$save_ifs # Restore the uninstalled library and exit if test relink = "$opt_mode"; then $opt_dry_run || eval '(cd $output_objdir && $RM ${realname}T && $MV $realname ${realname}T && $MV ${realname}U $realname)' || exit $? if test -n "$convenience"; then if test -z "$whole_archive_flag_spec"; then func_show_eval '${RM}r "$gentop"' fi fi exit $EXIT_SUCCESS fi # Create links to the real library. for linkname in $linknames; do if test "$realname" != "$linkname"; then func_show_eval '(cd "$output_objdir" && $RM "$linkname" && $LN_S "$realname" "$linkname")' 'exit $?' fi done # If -module or -export-dynamic was specified, set the dlname. if test yes = "$module" || test yes = "$export_dynamic"; then # On all known operating systems, these are identical. dlname=$soname fi fi ;; obj) if test -n "$dlfiles$dlprefiles" || test no != "$dlself"; then func_warning "'-dlopen' is ignored for objects" fi case " $deplibs" in *\ -l* | *\ -L*) func_warning "'-l' and '-L' are ignored for objects" ;; esac test -n "$rpath" && \ func_warning "'-rpath' is ignored for objects" test -n "$xrpath" && \ func_warning "'-R' is ignored for objects" test -n "$vinfo" && \ func_warning "'-version-info' is ignored for objects" test -n "$release" && \ func_warning "'-release' is ignored for objects" case $output in *.lo) test -n "$objs$old_deplibs" && \ func_fatal_error "cannot build library object '$output' from non-libtool objects" libobj=$output func_lo2o "$libobj" obj=$func_lo2o_result ;; *) libobj= obj=$output ;; esac # Delete the old objects. $opt_dry_run || $RM $obj $libobj # Objects from convenience libraries. This assumes # single-version convenience libraries. Whenever we create # different ones for PIC/non-PIC, this we'll have to duplicate # the extraction. reload_conv_objs= gentop= # if reload_cmds runs $LD directly, get rid of -Wl from # whole_archive_flag_spec and hope we can get by with turning comma # into space. case $reload_cmds in *\$LD[\ \$]*) wl= ;; esac if test -n "$convenience"; then if test -n "$whole_archive_flag_spec"; then eval tmp_whole_archive_flags=\"$whole_archive_flag_spec\" test -n "$wl" || tmp_whole_archive_flags=`$ECHO "$tmp_whole_archive_flags" | $SED 's|,| |g'` reload_conv_objs=$reload_objs\ $tmp_whole_archive_flags else gentop=$output_objdir/${obj}x func_append generated " $gentop" func_extract_archives $gentop $convenience reload_conv_objs="$reload_objs $func_extract_archives_result" fi fi # If we're not building shared, we need to use non_pic_objs test yes = "$build_libtool_libs" || libobjs=$non_pic_objects # Create the old-style object. reload_objs=$objs$old_deplibs' '`$ECHO "$libobjs" | $SP2NL | $SED "/\.$libext$/d; /\.lib$/d; $lo2o" | $NL2SP`' '$reload_conv_objs output=$obj func_execute_cmds "$reload_cmds" 'exit $?' # Exit if we aren't doing a library object file. if test -z "$libobj"; then if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi exit $EXIT_SUCCESS fi test yes = "$build_libtool_libs" || { if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi # Create an invalid libtool object if no PIC, so that we don't # accidentally link it into a program. # $show "echo timestamp > $libobj" # $opt_dry_run || eval "echo timestamp > $libobj" || exit $? exit $EXIT_SUCCESS } if test -n "$pic_flag" || test default != "$pic_mode"; then # Only do commands if we really have different PIC objects. reload_objs="$libobjs $reload_conv_objs" output=$libobj func_execute_cmds "$reload_cmds" 'exit $?' fi if test -n "$gentop"; then func_show_eval '${RM}r "$gentop"' fi exit $EXIT_SUCCESS ;; prog) case $host in *cygwin*) func_stripname '' '.exe' "$output" output=$func_stripname_result.exe;; esac test -n "$vinfo" && \ func_warning "'-version-info' is ignored for programs" test -n "$release" && \ func_warning "'-release' is ignored for programs" $preload \ && test unknown,unknown,unknown = "$dlopen_support,$dlopen_self,$dlopen_self_static" \ && func_warning "'LT_INIT([dlopen])' not used. Assuming no dlopen support." case $host in *-*-rhapsody* | *-*-darwin1.[012]) # On Rhapsody replace the C library is the System framework compile_deplibs=`$ECHO " $compile_deplibs" | $SED 's/ -lc / System.ltframework /'` finalize_deplibs=`$ECHO " $finalize_deplibs" | $SED 's/ -lc / System.ltframework /'` ;; esac case $host in *-*-darwin*) # Don't allow lazy linking, it breaks C++ global constructors # But is supposedly fixed on 10.4 or later (yay!). if test CXX = "$tagname"; then case ${MACOSX_DEPLOYMENT_TARGET-10.0} in 10.[0123]) func_append compile_command " $wl-bind_at_load" func_append finalize_command " $wl-bind_at_load" ;; esac fi # Time to change all our "foo.ltframework" stuff back to "-framework foo" compile_deplibs=`$ECHO " $compile_deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` finalize_deplibs=`$ECHO " $finalize_deplibs" | $SED 's% \([^ $]*\).ltframework% -framework \1%g'` ;; esac # move library search paths that coincide with paths to not yet # installed libraries to the beginning of the library search list new_libs= for path in $notinst_path; do case " $new_libs " in *" -L$path/$objdir "*) ;; *) case " $compile_deplibs " in *" -L$path/$objdir "*) func_append new_libs " -L$path/$objdir" ;; esac ;; esac done for deplib in $compile_deplibs; do case $deplib in -L*) case " $new_libs " in *" $deplib "*) ;; *) func_append new_libs " $deplib" ;; esac ;; *) func_append new_libs " $deplib" ;; esac done compile_deplibs=$new_libs func_append compile_command " $compile_deplibs" func_append finalize_command " $finalize_deplibs" if test -n "$rpath$xrpath"; then # If the user specified any rpath flags, then add them. for libdir in $rpath $xrpath; do # This is the magic to use -rpath. case "$finalize_rpath " in *" $libdir "*) ;; *) func_append finalize_rpath " $libdir" ;; esac done fi # Now hardcode the library paths rpath= hardcode_libdirs= for libdir in $compile_rpath $finalize_rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append rpath " $flag" fi elif test -n "$runpath_var"; then case "$perm_rpath " in *" $libdir "*) ;; *) func_append perm_rpath " $libdir" ;; esac fi case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-cegcc*) testbindir=`$ECHO "$libdir" | $SED -e 's*/lib$*/bin*'` case :$dllsearchpath: in *":$libdir:"*) ;; ::) dllsearchpath=$libdir;; *) func_append dllsearchpath ":$libdir";; esac case :$dllsearchpath: in *":$testbindir:"*) ;; ::) dllsearchpath=$testbindir;; *) func_append dllsearchpath ":$testbindir";; esac ;; esac done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval rpath=\" $hardcode_libdir_flag_spec\" fi compile_rpath=$rpath rpath= hardcode_libdirs= for libdir in $finalize_rpath; do if test -n "$hardcode_libdir_flag_spec"; then if test -n "$hardcode_libdir_separator"; then if test -z "$hardcode_libdirs"; then hardcode_libdirs=$libdir else # Just accumulate the unique libdirs. case $hardcode_libdir_separator$hardcode_libdirs$hardcode_libdir_separator in *"$hardcode_libdir_separator$libdir$hardcode_libdir_separator"*) ;; *) func_append hardcode_libdirs "$hardcode_libdir_separator$libdir" ;; esac fi else eval flag=\"$hardcode_libdir_flag_spec\" func_append rpath " $flag" fi elif test -n "$runpath_var"; then case "$finalize_perm_rpath " in *" $libdir "*) ;; *) func_append finalize_perm_rpath " $libdir" ;; esac fi done # Substitute the hardcoded libdirs into the rpath. if test -n "$hardcode_libdir_separator" && test -n "$hardcode_libdirs"; then libdir=$hardcode_libdirs eval rpath=\" $hardcode_libdir_flag_spec\" fi finalize_rpath=$rpath if test -n "$libobjs" && test yes = "$build_old_libs"; then # Transform all the library objects into standard objects. compile_command=`$ECHO "$compile_command" | $SP2NL | $SED "$lo2o" | $NL2SP` finalize_command=`$ECHO "$finalize_command" | $SP2NL | $SED "$lo2o" | $NL2SP` fi func_generate_dlsyms "$outputname" "@PROGRAM@" false # template prelinking step if test -n "$prelink_cmds"; then func_execute_cmds "$prelink_cmds" 'exit $?' fi wrappers_required=: case $host in *cegcc* | *mingw32ce*) # Disable wrappers for cegcc and mingw32ce hosts, we are cross compiling anyway. wrappers_required=false ;; *cygwin* | *mingw* ) test yes = "$build_libtool_libs" || wrappers_required=false ;; *) if test no = "$need_relink" || test yes != "$build_libtool_libs"; then wrappers_required=false fi ;; esac $wrappers_required || { # Replace the output file specification. compile_command=`$ECHO "$compile_command" | $SED 's%@OUTPUT@%'"$output"'%g'` link_command=$compile_command$compile_rpath # We have no uninstalled library dependencies, so finalize right now. exit_status=0 func_show_eval "$link_command" 'exit_status=$?' if test -n "$postlink_cmds"; then func_to_tool_file "$output" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi # Delete the generated files. if test -f "$output_objdir/${outputname}S.$objext"; then func_show_eval '$RM "$output_objdir/${outputname}S.$objext"' fi exit $exit_status } if test -n "$compile_shlibpath$finalize_shlibpath"; then compile_command="$shlibpath_var=\"$compile_shlibpath$finalize_shlibpath\$$shlibpath_var\" $compile_command" fi if test -n "$finalize_shlibpath"; then finalize_command="$shlibpath_var=\"$finalize_shlibpath\$$shlibpath_var\" $finalize_command" fi compile_var= finalize_var= if test -n "$runpath_var"; then if test -n "$perm_rpath"; then # We should set the runpath_var. rpath= for dir in $perm_rpath; do func_append rpath "$dir:" done compile_var="$runpath_var=\"$rpath\$$runpath_var\" " fi if test -n "$finalize_perm_rpath"; then # We should set the runpath_var. rpath= for dir in $finalize_perm_rpath; do func_append rpath "$dir:" done finalize_var="$runpath_var=\"$rpath\$$runpath_var\" " fi fi if test yes = "$no_install"; then # We don't need to create a wrapper script. link_command=$compile_var$compile_command$compile_rpath # Replace the output file specification. link_command=`$ECHO "$link_command" | $SED 's%@OUTPUT@%'"$output"'%g'` # Delete the old output file. $opt_dry_run || $RM $output # Link the executable and exit func_show_eval "$link_command" 'exit $?' if test -n "$postlink_cmds"; then func_to_tool_file "$output" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi exit $EXIT_SUCCESS fi case $hardcode_action,$fast_install in relink,*) # Fast installation is not supported link_command=$compile_var$compile_command$compile_rpath relink_command=$finalize_var$finalize_command$finalize_rpath func_warning "this platform does not like uninstalled shared libraries" func_warning "'$output' will be relinked during installation" ;; *,yes) link_command=$finalize_var$compile_command$finalize_rpath relink_command=`$ECHO "$compile_var$compile_command$compile_rpath" | $SED 's%@OUTPUT@%\$progdir/\$file%g'` ;; *,no) link_command=$compile_var$compile_command$compile_rpath relink_command=$finalize_var$finalize_command$finalize_rpath ;; *,needless) link_command=$finalize_var$compile_command$finalize_rpath relink_command= ;; esac # Replace the output file specification. link_command=`$ECHO "$link_command" | $SED 's%@OUTPUT@%'"$output_objdir/$outputname"'%g'` # Delete the old output files. $opt_dry_run || $RM $output $output_objdir/$outputname $output_objdir/lt-$outputname func_show_eval "$link_command" 'exit $?' if test -n "$postlink_cmds"; then func_to_tool_file "$output_objdir/$outputname" postlink_cmds=`func_echo_all "$postlink_cmds" | $SED -e 's%@OUTPUT@%'"$output_objdir/$outputname"'%g' -e 's%@TOOL_OUTPUT@%'"$func_to_tool_file_result"'%g'` func_execute_cmds "$postlink_cmds" 'exit $?' fi # Now create the wrapper script. func_verbose "creating $output" # Quote the relink command for shipping. if test -n "$relink_command"; then # Preserve any variables that may affect compiler behavior for var in $variables_saved_for_relink; do if eval test -z \"\${$var+set}\"; then relink_command="{ test -z \"\${$var+set}\" || $lt_unset $var || { $var=; export $var; }; }; $relink_command" elif eval var_value=\$$var; test -z "$var_value"; then relink_command="$var=; export $var; $relink_command" else func_quote_for_eval "$var_value" relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command" fi done relink_command="(cd `pwd`; $relink_command)" relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"` fi # Only actually do things if not in dry run mode. $opt_dry_run || { # win32 will think the script is a binary if it has # a .exe suffix, so we strip it off here. case $output in *.exe) func_stripname '' '.exe' "$output" output=$func_stripname_result ;; esac # test for cygwin because mv fails w/o .exe extensions case $host in *cygwin*) exeext=.exe func_stripname '' '.exe' "$outputname" outputname=$func_stripname_result ;; *) exeext= ;; esac case $host in *cygwin* | *mingw* ) func_dirname_and_basename "$output" "" "." output_name=$func_basename_result output_path=$func_dirname_result cwrappersource=$output_path/$objdir/lt-$output_name.c cwrapper=$output_path/$output_name.exe $RM $cwrappersource $cwrapper trap "$RM $cwrappersource $cwrapper; exit $EXIT_FAILURE" 1 2 15 func_emit_cwrapperexe_src > $cwrappersource # The wrapper executable is built using the $host compiler, # because it contains $host paths and files. If cross- # compiling, it, like the target executable, must be # executed on the $host or under an emulation environment. $opt_dry_run || { $LTCC $LTCFLAGS -o $cwrapper $cwrappersource $STRIP $cwrapper } # Now, create the wrapper script for func_source use: func_ltwrapper_scriptname $cwrapper $RM $func_ltwrapper_scriptname_result trap "$RM $func_ltwrapper_scriptname_result; exit $EXIT_FAILURE" 1 2 15 $opt_dry_run || { # note: this script will not be executed, so do not chmod. if test "x$build" = "x$host"; then $cwrapper --lt-dump-script > $func_ltwrapper_scriptname_result else func_emit_wrapper no > $func_ltwrapper_scriptname_result fi } ;; * ) $RM $output trap "$RM $output; exit $EXIT_FAILURE" 1 2 15 func_emit_wrapper no > $output chmod +x $output ;; esac } exit $EXIT_SUCCESS ;; esac # See if we need to build an old-fashioned archive. for oldlib in $oldlibs; do case $build_libtool_libs in convenience) oldobjs="$libobjs_save $symfileobj" addlibs=$convenience build_libtool_libs=no ;; module) oldobjs=$libobjs_save addlibs=$old_convenience build_libtool_libs=no ;; *) oldobjs="$old_deplibs $non_pic_objects" $preload && test -f "$symfileobj" \ && func_append oldobjs " $symfileobj" addlibs=$old_convenience ;; esac if test -n "$addlibs"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $addlibs func_append oldobjs " $func_extract_archives_result" fi # Do each command in the archive commands. if test -n "$old_archive_from_new_cmds" && test yes = "$build_libtool_libs"; then cmds=$old_archive_from_new_cmds else # Add any objects from preloaded convenience libraries if test -n "$dlprefiles"; then gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_extract_archives $gentop $dlprefiles func_append oldobjs " $func_extract_archives_result" fi # POSIX demands no paths to be encoded in archives. We have # to avoid creating archives with duplicate basenames if we # might have to extract them afterwards, e.g., when creating a # static archive out of a convenience library, or when linking # the entirety of a libtool archive into another (currently # not supported by libtool). if (for obj in $oldobjs do func_basename "$obj" $ECHO "$func_basename_result" done | sort | sort -uc >/dev/null 2>&1); then : else echo "copying selected object files to avoid basename conflicts..." gentop=$output_objdir/${outputname}x func_append generated " $gentop" func_mkdir_p "$gentop" save_oldobjs=$oldobjs oldobjs= counter=1 for obj in $save_oldobjs do func_basename "$obj" objbase=$func_basename_result case " $oldobjs " in " ") oldobjs=$obj ;; *[\ /]"$objbase "*) while :; do # Make sure we don't pick an alternate name that also # overlaps. newobj=lt$counter-$objbase func_arith $counter + 1 counter=$func_arith_result case " $oldobjs " in *[\ /]"$newobj "*) ;; *) if test ! -f "$gentop/$newobj"; then break; fi ;; esac done func_show_eval "ln $obj $gentop/$newobj || cp $obj $gentop/$newobj" func_append oldobjs " $gentop/$newobj" ;; *) func_append oldobjs " $obj" ;; esac done fi func_to_tool_file "$oldlib" func_convert_file_msys_to_w32 tool_oldlib=$func_to_tool_file_result eval cmds=\"$old_archive_cmds\" func_len " $cmds" len=$func_len_result if test "$len" -lt "$max_cmd_len" || test "$max_cmd_len" -le -1; then cmds=$old_archive_cmds elif test -n "$archiver_list_spec"; then func_verbose "using command file archive linking..." for obj in $oldobjs do func_to_tool_file "$obj" $ECHO "$func_to_tool_file_result" done > $output_objdir/$libname.libcmd func_to_tool_file "$output_objdir/$libname.libcmd" oldobjs=" $archiver_list_spec$func_to_tool_file_result" cmds=$old_archive_cmds else # the command line is too long to link in one step, link in parts func_verbose "using piecewise archive linking..." save_RANLIB=$RANLIB RANLIB=: objlist= concat_cmds= save_oldobjs=$oldobjs oldobjs= # Is there a better way of finding the last object in the list? for obj in $save_oldobjs do last_oldobj=$obj done eval test_cmds=\"$old_archive_cmds\" func_len " $test_cmds" len0=$func_len_result len=$len0 for obj in $save_oldobjs do func_len " $obj" func_arith $len + $func_len_result len=$func_arith_result func_append objlist " $obj" if test "$len" -lt "$max_cmd_len"; then : else # the above command should be used before it gets too long oldobjs=$objlist if test "$obj" = "$last_oldobj"; then RANLIB=$save_RANLIB fi test -z "$concat_cmds" || concat_cmds=$concat_cmds~ eval concat_cmds=\"\$concat_cmds$old_archive_cmds\" objlist= len=$len0 fi done RANLIB=$save_RANLIB oldobjs=$objlist if test -z "$oldobjs"; then eval cmds=\"\$concat_cmds\" else eval cmds=\"\$concat_cmds~\$old_archive_cmds\" fi fi fi func_execute_cmds "$cmds" 'exit $?' done test -n "$generated" && \ func_show_eval "${RM}r$generated" # Now create the libtool archive. case $output in *.la) old_library= test yes = "$build_old_libs" && old_library=$libname.$libext func_verbose "creating $output" # Preserve any variables that may affect compiler behavior for var in $variables_saved_for_relink; do if eval test -z \"\${$var+set}\"; then relink_command="{ test -z \"\${$var+set}\" || $lt_unset $var || { $var=; export $var; }; }; $relink_command" elif eval var_value=\$$var; test -z "$var_value"; then relink_command="$var=; export $var; $relink_command" else func_quote_for_eval "$var_value" relink_command="$var=$func_quote_for_eval_result; export $var; $relink_command" fi done # Quote the link command for shipping. relink_command="(cd `pwd`; $SHELL \"$progpath\" $preserve_args --mode=relink $libtool_args @inst_prefix_dir@)" relink_command=`$ECHO "$relink_command" | $SED "$sed_quote_subst"` if test yes = "$hardcode_automatic"; then relink_command= fi # Only create the output if not a dry run. $opt_dry_run || { for installed in no yes; do if test yes = "$installed"; then if test -z "$install_libdir"; then break fi output=$output_objdir/${outputname}i # Replace all uninstalled libtool libraries with the installed ones newdependency_libs= for deplib in $dependency_libs; do case $deplib in *.la) func_basename "$deplib" name=$func_basename_result func_resolve_sysroot "$deplib" eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $func_resolve_sysroot_result` test -z "$libdir" && \ func_fatal_error "'$deplib' is not a valid libtool archive" func_append newdependency_libs " ${lt_sysroot:+=}$libdir/$name" ;; -L*) func_stripname -L '' "$deplib" func_replace_sysroot "$func_stripname_result" func_append newdependency_libs " -L$func_replace_sysroot_result" ;; -R*) func_stripname -R '' "$deplib" func_replace_sysroot "$func_stripname_result" func_append newdependency_libs " -R$func_replace_sysroot_result" ;; *) func_append newdependency_libs " $deplib" ;; esac done dependency_libs=$newdependency_libs newdlfiles= for lib in $dlfiles; do case $lib in *.la) func_basename "$lib" name=$func_basename_result eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $lib` test -z "$libdir" && \ func_fatal_error "'$lib' is not a valid libtool archive" func_append newdlfiles " ${lt_sysroot:+=}$libdir/$name" ;; *) func_append newdlfiles " $lib" ;; esac done dlfiles=$newdlfiles newdlprefiles= for lib in $dlprefiles; do case $lib in *.la) # Only pass preopened files to the pseudo-archive (for # eventual linking with the app. that links it) if we # didn't already link the preopened objects directly into # the library: func_basename "$lib" name=$func_basename_result eval libdir=`$SED -n -e 's/^libdir=\(.*\)$/\1/p' $lib` test -z "$libdir" && \ func_fatal_error "'$lib' is not a valid libtool archive" func_append newdlprefiles " ${lt_sysroot:+=}$libdir/$name" ;; esac done dlprefiles=$newdlprefiles else newdlfiles= for lib in $dlfiles; do case $lib in [\\/]* | [A-Za-z]:[\\/]*) abs=$lib ;; *) abs=`pwd`"/$lib" ;; esac func_append newdlfiles " $abs" done dlfiles=$newdlfiles newdlprefiles= for lib in $dlprefiles; do case $lib in [\\/]* | [A-Za-z]:[\\/]*) abs=$lib ;; *) abs=`pwd`"/$lib" ;; esac func_append newdlprefiles " $abs" done dlprefiles=$newdlprefiles fi $RM $output # place dlname in correct position for cygwin # In fact, it would be nice if we could use this code for all target # systems that can't hard-code library paths into their executables # and that have no shared library path variable independent of PATH, # but it turns out we can't easily determine that from inspecting # libtool variables, so we have to hard-code the OSs to which it # applies here; at the moment, that means platforms that use the PE # object format with DLL files. See the long comment at the top of # tests/bindir.at for full details. tdlname=$dlname case $host,$output,$installed,$module,$dlname in *cygwin*,*lai,yes,no,*.dll | *mingw*,*lai,yes,no,*.dll | *cegcc*,*lai,yes,no,*.dll) # If a -bindir argument was supplied, place the dll there. if test -n "$bindir"; then func_relative_path "$install_libdir" "$bindir" tdlname=$func_relative_path_result/$dlname else # Otherwise fall back on heuristic. tdlname=../bin/$dlname fi ;; esac $ECHO > $output "\ # $outputname - a libtool library file # Generated by $PROGRAM (GNU $PACKAGE) $VERSION # # Please DO NOT delete this file! # It is necessary for linking the library. # The name that we can dlopen(3). dlname='$tdlname' # Names of this library. library_names='$library_names' # The name of the static archive. old_library='$old_library' # Linker flags that cannot go in dependency_libs. inherited_linker_flags='$new_inherited_linker_flags' # Libraries that this one depends upon. dependency_libs='$dependency_libs' # Names of additional weak libraries provided by this library weak_library_names='$weak_libs' # Version information for $libname. current=$current age=$age revision=$revision # Is this an already installed library? installed=$installed # Should we warn about portability when linking against -modules? shouldnotlink=$module # Files to dlopen/dlpreopen dlopen='$dlfiles' dlpreopen='$dlprefiles' # Directory that this library needs to be installed in: libdir='$install_libdir'" if test no,yes = "$installed,$need_relink"; then $ECHO >> $output "\ relink_command=\"$relink_command\"" fi done } # Do a symbolic link so that the libtool archive can be found in # LD_LIBRARY_PATH before the program is installed. func_show_eval '( cd "$output_objdir" && $RM "$outputname" && $LN_S "../$outputname" "$outputname" )' 'exit $?' ;; esac exit $EXIT_SUCCESS } if test link = "$opt_mode" || test relink = "$opt_mode"; then func_mode_link ${1+"$@"} fi # func_mode_uninstall arg... func_mode_uninstall () { $debug_cmd RM=$nonopt files= rmforce=false exit_status=0 # This variable tells wrapper scripts just to set variables rather # than running their programs. libtool_install_magic=$magic for arg do case $arg in -f) func_append RM " $arg"; rmforce=: ;; -*) func_append RM " $arg" ;; *) func_append files " $arg" ;; esac done test -z "$RM" && \ func_fatal_help "you must specify an RM program" rmdirs= for file in $files; do func_dirname "$file" "" "." dir=$func_dirname_result if test . = "$dir"; then odir=$objdir else odir=$dir/$objdir fi func_basename "$file" name=$func_basename_result test uninstall = "$opt_mode" && odir=$dir # Remember odir for removal later, being careful to avoid duplicates if test clean = "$opt_mode"; then case " $rmdirs " in *" $odir "*) ;; *) func_append rmdirs " $odir" ;; esac fi # Don't error if the file doesn't exist and rm -f was used. if { test -L "$file"; } >/dev/null 2>&1 || { test -h "$file"; } >/dev/null 2>&1 || test -f "$file"; then : elif test -d "$file"; then exit_status=1 continue elif $rmforce; then continue fi rmfiles=$file case $name in *.la) # Possibly a libtool archive, so verify it. if func_lalib_p "$file"; then func_source $dir/$name # Delete the libtool libraries and symlinks. for n in $library_names; do func_append rmfiles " $odir/$n" done test -n "$old_library" && func_append rmfiles " $odir/$old_library" case $opt_mode in clean) case " $library_names " in *" $dlname "*) ;; *) test -n "$dlname" && func_append rmfiles " $odir/$dlname" ;; esac test -n "$libdir" && func_append rmfiles " $odir/$name $odir/${name}i" ;; uninstall) if test -n "$library_names"; then # Do each command in the postuninstall commands. func_execute_cmds "$postuninstall_cmds" '$rmforce || exit_status=1' fi if test -n "$old_library"; then # Do each command in the old_postuninstall commands. func_execute_cmds "$old_postuninstall_cmds" '$rmforce || exit_status=1' fi # FIXME: should reinstall the best remaining shared library. ;; esac fi ;; *.lo) # Possibly a libtool object, so verify it. if func_lalib_p "$file"; then # Read the .lo file func_source $dir/$name # Add PIC object to the list of files to remove. if test -n "$pic_object" && test none != "$pic_object"; then func_append rmfiles " $dir/$pic_object" fi # Add non-PIC object to the list of files to remove. if test -n "$non_pic_object" && test none != "$non_pic_object"; then func_append rmfiles " $dir/$non_pic_object" fi fi ;; *) if test clean = "$opt_mode"; then noexename=$name case $file in *.exe) func_stripname '' '.exe' "$file" file=$func_stripname_result func_stripname '' '.exe' "$name" noexename=$func_stripname_result # $file with .exe has already been added to rmfiles, # add $file without .exe func_append rmfiles " $file" ;; esac # Do a test to see if this is a libtool program. if func_ltwrapper_p "$file"; then if func_ltwrapper_executable_p "$file"; then func_ltwrapper_scriptname "$file" relink_command= func_source $func_ltwrapper_scriptname_result func_append rmfiles " $func_ltwrapper_scriptname_result" else relink_command= func_source $dir/$noexename fi # note $name still contains .exe if it was in $file originally # as does the version of $file that was added into $rmfiles func_append rmfiles " $odir/$name $odir/${name}S.$objext" if test yes = "$fast_install" && test -n "$relink_command"; then func_append rmfiles " $odir/lt-$name" fi if test "X$noexename" != "X$name"; then func_append rmfiles " $odir/lt-$noexename.c" fi fi fi ;; esac func_show_eval "$RM $rmfiles" 'exit_status=1' done # Try to remove the $objdir's in the directories where we deleted files for dir in $rmdirs; do if test -d "$dir"; then func_show_eval "rmdir $dir >/dev/null 2>&1" fi done exit $exit_status } if test uninstall = "$opt_mode" || test clean = "$opt_mode"; then func_mode_uninstall ${1+"$@"} fi test -z "$opt_mode" && { help=$generic_help func_fatal_help "you must specify a MODE" } test -z "$exec_cmd" && \ func_fatal_help "invalid operation mode '$opt_mode'" if test -n "$exec_cmd"; then eval exec "$exec_cmd" exit $EXIT_FAILURE fi exit $exit_status # The TAGs below are defined such that we never get into a situation # where we disable both kinds of libraries. Given conflicting # choices, we go for a static library, that is the most portable, # since we can't tell whether shared libraries were disabled because # the user asked for that or because the platform doesn't support # them. This is particularly important on AIX, because we don't # support having both static and shared libraries enabled at the same # time on that platform, so we default to a shared-only configuration. # If a disable-shared tag is given, we'll fallback to a static-only # configuration. But we'll never go from static-only to shared-only. # ### BEGIN LIBTOOL TAG CONFIG: disable-shared build_libtool_libs=no build_old_libs=yes # ### END LIBTOOL TAG CONFIG: disable-shared # ### BEGIN LIBTOOL TAG CONFIG: disable-static build_old_libs=`case $build_libtool_libs in yes) echo no;; *) echo yes;; esac` # ### END LIBTOOL TAG CONFIG: disable-static # Local Variables: # mode:shell-script # sh-indentation:2 # End: suricata-3.2.1/libhtp/m4/0000755000000000000000000000000013051004502012067 500000000000000suricata-3.2.1/libhtp/m4/libtool.m40000644000000000000000000112631113051004460013725 00000000000000# libtool.m4 - Configure libtool for the host system. -*-Autoconf-*- # # Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc. # Written by Gordon Matzigkeit, 1996 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. m4_define([_LT_COPYING], [dnl # Copyright (C) 2014 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program or library that is built # using GNU Libtool, you may include this file under the same # distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . ]) # serial 58 LT_INIT # LT_PREREQ(VERSION) # ------------------ # Complain and exit if this libtool version is less that VERSION. m4_defun([LT_PREREQ], [m4_if(m4_version_compare(m4_defn([LT_PACKAGE_VERSION]), [$1]), -1, [m4_default([$3], [m4_fatal([Libtool version $1 or higher is required], 63)])], [$2])]) # _LT_CHECK_BUILDDIR # ------------------ # Complain if the absolute build directory name contains unusual characters m4_defun([_LT_CHECK_BUILDDIR], [case `pwd` in *\ * | *\ *) AC_MSG_WARN([Libtool does not cope well with whitespace in `pwd`]) ;; esac ]) # LT_INIT([OPTIONS]) # ------------------ AC_DEFUN([LT_INIT], [AC_PREREQ([2.62])dnl We use AC_PATH_PROGS_FEATURE_CHECK AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl AC_BEFORE([$0], [LT_LANG])dnl AC_BEFORE([$0], [LT_OUTPUT])dnl AC_BEFORE([$0], [LTDL_INIT])dnl m4_require([_LT_CHECK_BUILDDIR])dnl dnl Autoconf doesn't catch unexpanded LT_ macros by default: m4_pattern_forbid([^_?LT_[A-Z_]+$])dnl m4_pattern_allow([^(_LT_EOF|LT_DLGLOBAL|LT_DLLAZY_OR_NOW|LT_MULTI_MODULE)$])dnl dnl aclocal doesn't pull ltoptions.m4, ltsugar.m4, or ltversion.m4 dnl unless we require an AC_DEFUNed macro: AC_REQUIRE([LTOPTIONS_VERSION])dnl AC_REQUIRE([LTSUGAR_VERSION])dnl AC_REQUIRE([LTVERSION_VERSION])dnl AC_REQUIRE([LTOBSOLETE_VERSION])dnl m4_require([_LT_PROG_LTMAIN])dnl _LT_SHELL_INIT([SHELL=${CONFIG_SHELL-/bin/sh}]) dnl Parse OPTIONS _LT_SET_OPTIONS([$0], [$1]) # This can be used to rebuild libtool when needed LIBTOOL_DEPS=$ltmain # Always use our own libtool. LIBTOOL='$(SHELL) $(top_builddir)/libtool' AC_SUBST(LIBTOOL)dnl _LT_SETUP # Only expand once: m4_define([LT_INIT]) ])# LT_INIT # Old names: AU_ALIAS([AC_PROG_LIBTOOL], [LT_INIT]) AU_ALIAS([AM_PROG_LIBTOOL], [LT_INIT]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_PROG_LIBTOOL], []) dnl AC_DEFUN([AM_PROG_LIBTOOL], []) # _LT_PREPARE_CC_BASENAME # ----------------------- m4_defun([_LT_PREPARE_CC_BASENAME], [ # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in @S|@*""; do case $cc_temp in compile | *[[\\/]]compile | ccache | *[[\\/]]ccache ) ;; distcc | *[[\\/]]distcc | purify | *[[\\/]]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } ])# _LT_PREPARE_CC_BASENAME # _LT_CC_BASENAME(CC) # ------------------- # It would be clearer to call AC_REQUIREs from _LT_PREPARE_CC_BASENAME, # but that macro is also expanded into generated libtool script, which # arranges for $SED and $ECHO to be set by different means. m4_defun([_LT_CC_BASENAME], [m4_require([_LT_PREPARE_CC_BASENAME])dnl AC_REQUIRE([_LT_DECL_SED])dnl AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl func_cc_basename $1 cc_basename=$func_cc_basename_result ]) # _LT_FILEUTILS_DEFAULTS # ---------------------- # It is okay to use these file commands and assume they have been set # sensibly after 'm4_require([_LT_FILEUTILS_DEFAULTS])'. m4_defun([_LT_FILEUTILS_DEFAULTS], [: ${CP="cp -f"} : ${MV="mv -f"} : ${RM="rm -f"} ])# _LT_FILEUTILS_DEFAULTS # _LT_SETUP # --------- m4_defun([_LT_SETUP], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl AC_REQUIRE([_LT_PREPARE_SED_QUOTE_VARS])dnl AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl _LT_DECL([], [PATH_SEPARATOR], [1], [The PATH separator for the build system])dnl dnl _LT_DECL([], [host_alias], [0], [The host system])dnl _LT_DECL([], [host], [0])dnl _LT_DECL([], [host_os], [0])dnl dnl _LT_DECL([], [build_alias], [0], [The build system])dnl _LT_DECL([], [build], [0])dnl _LT_DECL([], [build_os], [0])dnl dnl AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([LT_PATH_LD])dnl AC_REQUIRE([LT_PATH_NM])dnl dnl AC_REQUIRE([AC_PROG_LN_S])dnl test -z "$LN_S" && LN_S="ln -s" _LT_DECL([], [LN_S], [1], [Whether we need soft or hard links])dnl dnl AC_REQUIRE([LT_CMD_MAX_LEN])dnl _LT_DECL([objext], [ac_objext], [0], [Object file suffix (normally "o")])dnl _LT_DECL([], [exeext], [0], [Executable file suffix (normally "")])dnl dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_CHECK_SHELL_FEATURES])dnl m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl m4_require([_LT_CMD_RELOAD])dnl m4_require([_LT_CHECK_MAGIC_METHOD])dnl m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl m4_require([_LT_CMD_OLD_ARCHIVE])dnl m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl m4_require([_LT_WITH_SYSROOT])dnl m4_require([_LT_CMD_TRUNCATE])dnl _LT_CONFIG_LIBTOOL_INIT([ # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes INIT. if test -n "\${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi ]) if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi _LT_CHECK_OBJDIR m4_require([_LT_TAG_COMPILER])dnl case $host_os in aix3*) # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi ;; esac # Global variables: ofile=libtool can_build_shared=yes # All known linkers require a '.a' archive for static linking (except MSVC, # which needs '.lib'). libext=a with_gnu_ld=$lt_cv_prog_gnu_ld old_CC=$CC old_CFLAGS=$CFLAGS # Set sane defaults for various variables test -z "$CC" && CC=cc test -z "$LTCC" && LTCC=$CC test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS test -z "$LD" && LD=ld test -z "$ac_objext" && ac_objext=o _LT_CC_BASENAME([$compiler]) # Only perform the check for file, if the check method requires it test -z "$MAGIC_CMD" && MAGIC_CMD=file case $deplibs_check_method in file_magic*) if test "$file_magic_cmd" = '$MAGIC_CMD'; then _LT_PATH_MAGIC fi ;; esac # Use C for the default configuration in the libtool script LT_SUPPORTED_TAG([CC]) _LT_LANG_C_CONFIG _LT_LANG_DEFAULT_CONFIG _LT_CONFIG_COMMANDS ])# _LT_SETUP # _LT_PREPARE_SED_QUOTE_VARS # -------------------------- # Define a few sed substitution that help us do robust quoting. m4_defun([_LT_PREPARE_SED_QUOTE_VARS], [# Backslashify metacharacters that are still active within # double-quoted strings. sed_quote_subst='s/\([["`$\\]]\)/\\\1/g' # Same as above, but do not quote variable references. double_quote_subst='s/\([["`\\]]\)/\\\1/g' # Sed substitution to delay expansion of an escaped shell variable in a # double_quote_subst'ed string. delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g' # Sed substitution to delay expansion of an escaped single quote. delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g' # Sed substitution to avoid accidental globbing in evaled expressions no_glob_subst='s/\*/\\\*/g' ]) # _LT_PROG_LTMAIN # --------------- # Note that this code is called both from 'configure', and 'config.status' # now that we use AC_CONFIG_COMMANDS to generate libtool. Notably, # 'config.status' has no value for ac_aux_dir unless we are using Automake, # so we pass a copy along to make sure it has a sensible value anyway. m4_defun([_LT_PROG_LTMAIN], [m4_ifdef([AC_REQUIRE_AUX_FILE], [AC_REQUIRE_AUX_FILE([ltmain.sh])])dnl _LT_CONFIG_LIBTOOL_INIT([ac_aux_dir='$ac_aux_dir']) ltmain=$ac_aux_dir/ltmain.sh ])# _LT_PROG_LTMAIN ## ------------------------------------- ## ## Accumulate code for creating libtool. ## ## ------------------------------------- ## # So that we can recreate a full libtool script including additional # tags, we accumulate the chunks of code to send to AC_CONFIG_COMMANDS # in macros and then make a single call at the end using the 'libtool' # label. # _LT_CONFIG_LIBTOOL_INIT([INIT-COMMANDS]) # ---------------------------------------- # Register INIT-COMMANDS to be passed to AC_CONFIG_COMMANDS later. m4_define([_LT_CONFIG_LIBTOOL_INIT], [m4_ifval([$1], [m4_append([_LT_OUTPUT_LIBTOOL_INIT], [$1 ])])]) # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_INIT]) # _LT_CONFIG_LIBTOOL([COMMANDS]) # ------------------------------ # Register COMMANDS to be passed to AC_CONFIG_COMMANDS later. m4_define([_LT_CONFIG_LIBTOOL], [m4_ifval([$1], [m4_append([_LT_OUTPUT_LIBTOOL_COMMANDS], [$1 ])])]) # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS]) # _LT_CONFIG_SAVE_COMMANDS([COMMANDS], [INIT_COMMANDS]) # ----------------------------------------------------- m4_defun([_LT_CONFIG_SAVE_COMMANDS], [_LT_CONFIG_LIBTOOL([$1]) _LT_CONFIG_LIBTOOL_INIT([$2]) ]) # _LT_FORMAT_COMMENT([COMMENT]) # ----------------------------- # Add leading comment marks to the start of each line, and a trailing # full-stop to the whole comment if one is not present already. m4_define([_LT_FORMAT_COMMENT], [m4_ifval([$1], [ m4_bpatsubst([m4_bpatsubst([$1], [^ *], [# ])], [['`$\]], [\\\&])]m4_bmatch([$1], [[!?.]$], [], [.]) )]) ## ------------------------ ## ## FIXME: Eliminate VARNAME ## ## ------------------------ ## # _LT_DECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION], [IS-TAGGED?]) # ------------------------------------------------------------------- # CONFIGNAME is the name given to the value in the libtool script. # VARNAME is the (base) name used in the configure script. # VALUE may be 0, 1 or 2 for a computed quote escaped value based on # VARNAME. Any other value will be used directly. m4_define([_LT_DECL], [lt_if_append_uniq([lt_decl_varnames], [$2], [, ], [lt_dict_add_subkey([lt_decl_dict], [$2], [libtool_name], [m4_ifval([$1], [$1], [$2])]) lt_dict_add_subkey([lt_decl_dict], [$2], [value], [$3]) m4_ifval([$4], [lt_dict_add_subkey([lt_decl_dict], [$2], [description], [$4])]) lt_dict_add_subkey([lt_decl_dict], [$2], [tagged?], [m4_ifval([$5], [yes], [no])])]) ]) # _LT_TAGDECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION]) # -------------------------------------------------------- m4_define([_LT_TAGDECL], [_LT_DECL([$1], [$2], [$3], [$4], [yes])]) # lt_decl_tag_varnames([SEPARATOR], [VARNAME1...]) # ------------------------------------------------ m4_define([lt_decl_tag_varnames], [_lt_decl_filter([tagged?], [yes], $@)]) # _lt_decl_filter(SUBKEY, VALUE, [SEPARATOR], [VARNAME1..]) # --------------------------------------------------------- m4_define([_lt_decl_filter], [m4_case([$#], [0], [m4_fatal([$0: too few arguments: $#])], [1], [m4_fatal([$0: too few arguments: $#: $1])], [2], [lt_dict_filter([lt_decl_dict], [$1], [$2], [], lt_decl_varnames)], [3], [lt_dict_filter([lt_decl_dict], [$1], [$2], [$3], lt_decl_varnames)], [lt_dict_filter([lt_decl_dict], $@)])[]dnl ]) # lt_decl_quote_varnames([SEPARATOR], [VARNAME1...]) # -------------------------------------------------- m4_define([lt_decl_quote_varnames], [_lt_decl_filter([value], [1], $@)]) # lt_decl_dquote_varnames([SEPARATOR], [VARNAME1...]) # --------------------------------------------------- m4_define([lt_decl_dquote_varnames], [_lt_decl_filter([value], [2], $@)]) # lt_decl_varnames_tagged([SEPARATOR], [VARNAME1...]) # --------------------------------------------------- m4_define([lt_decl_varnames_tagged], [m4_assert([$# <= 2])dnl _$0(m4_quote(m4_default([$1], [[, ]])), m4_ifval([$2], [[$2]], [m4_dquote(lt_decl_tag_varnames)]), m4_split(m4_normalize(m4_quote(_LT_TAGS)), [ ]))]) m4_define([_lt_decl_varnames_tagged], [m4_ifval([$3], [lt_combine([$1], [$2], [_], $3)])]) # lt_decl_all_varnames([SEPARATOR], [VARNAME1...]) # ------------------------------------------------ m4_define([lt_decl_all_varnames], [_$0(m4_quote(m4_default([$1], [[, ]])), m4_if([$2], [], m4_quote(lt_decl_varnames), m4_quote(m4_shift($@))))[]dnl ]) m4_define([_lt_decl_all_varnames], [lt_join($@, lt_decl_varnames_tagged([$1], lt_decl_tag_varnames([[, ]], m4_shift($@))))dnl ]) # _LT_CONFIG_STATUS_DECLARE([VARNAME]) # ------------------------------------ # Quote a variable value, and forward it to 'config.status' so that its # declaration there will have the same value as in 'configure'. VARNAME # must have a single quote delimited value for this to work. m4_define([_LT_CONFIG_STATUS_DECLARE], [$1='`$ECHO "$][$1" | $SED "$delay_single_quote_subst"`']) # _LT_CONFIG_STATUS_DECLARATIONS # ------------------------------ # We delimit libtool config variables with single quotes, so when # we write them to config.status, we have to be sure to quote all # embedded single quotes properly. In configure, this macro expands # each variable declared with _LT_DECL (and _LT_TAGDECL) into: # # ='`$ECHO "$" | $SED "$delay_single_quote_subst"`' m4_defun([_LT_CONFIG_STATUS_DECLARATIONS], [m4_foreach([_lt_var], m4_quote(lt_decl_all_varnames), [m4_n([_LT_CONFIG_STATUS_DECLARE(_lt_var)])])]) # _LT_LIBTOOL_TAGS # ---------------- # Output comment and list of tags supported by the script m4_defun([_LT_LIBTOOL_TAGS], [_LT_FORMAT_COMMENT([The names of the tagged configurations supported by this script])dnl available_tags='_LT_TAGS'dnl ]) # _LT_LIBTOOL_DECLARE(VARNAME, [TAG]) # ----------------------------------- # Extract the dictionary values for VARNAME (optionally with TAG) and # expand to a commented shell variable setting: # # # Some comment about what VAR is for. # visible_name=$lt_internal_name m4_define([_LT_LIBTOOL_DECLARE], [_LT_FORMAT_COMMENT(m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [description])))[]dnl m4_pushdef([_libtool_name], m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [libtool_name])))[]dnl m4_case(m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [value])), [0], [_libtool_name=[$]$1], [1], [_libtool_name=$lt_[]$1], [2], [_libtool_name=$lt_[]$1], [_libtool_name=lt_dict_fetch([lt_decl_dict], [$1], [value])])[]dnl m4_ifval([$2], [_$2])[]m4_popdef([_libtool_name])[]dnl ]) # _LT_LIBTOOL_CONFIG_VARS # ----------------------- # Produce commented declarations of non-tagged libtool config variables # suitable for insertion in the LIBTOOL CONFIG section of the 'libtool' # script. Tagged libtool config variables (even for the LIBTOOL CONFIG # section) are produced by _LT_LIBTOOL_TAG_VARS. m4_defun([_LT_LIBTOOL_CONFIG_VARS], [m4_foreach([_lt_var], m4_quote(_lt_decl_filter([tagged?], [no], [], lt_decl_varnames)), [m4_n([_LT_LIBTOOL_DECLARE(_lt_var)])])]) # _LT_LIBTOOL_TAG_VARS(TAG) # ------------------------- m4_define([_LT_LIBTOOL_TAG_VARS], [m4_foreach([_lt_var], m4_quote(lt_decl_tag_varnames), [m4_n([_LT_LIBTOOL_DECLARE(_lt_var, [$1])])])]) # _LT_TAGVAR(VARNAME, [TAGNAME]) # ------------------------------ m4_define([_LT_TAGVAR], [m4_ifval([$2], [$1_$2], [$1])]) # _LT_CONFIG_COMMANDS # ------------------- # Send accumulated output to $CONFIG_STATUS. Thanks to the lists of # variables for single and double quote escaping we saved from calls # to _LT_DECL, we can put quote escaped variables declarations # into 'config.status', and then the shell code to quote escape them in # for loops in 'config.status'. Finally, any additional code accumulated # from calls to _LT_CONFIG_LIBTOOL_INIT is expanded. m4_defun([_LT_CONFIG_COMMANDS], [AC_PROVIDE_IFELSE([LT_OUTPUT], dnl If the libtool generation code has been placed in $CONFIG_LT, dnl instead of duplicating it all over again into config.status, dnl then we will have config.status run $CONFIG_LT later, so it dnl needs to know what name is stored there: [AC_CONFIG_COMMANDS([libtool], [$SHELL $CONFIG_LT || AS_EXIT(1)], [CONFIG_LT='$CONFIG_LT'])], dnl If the libtool generation code is destined for config.status, dnl expand the accumulated commands and init code now: [AC_CONFIG_COMMANDS([libtool], [_LT_OUTPUT_LIBTOOL_COMMANDS], [_LT_OUTPUT_LIBTOOL_COMMANDS_INIT])]) ])#_LT_CONFIG_COMMANDS # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS_INIT], [ # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH sed_quote_subst='$sed_quote_subst' double_quote_subst='$double_quote_subst' delay_variable_subst='$delay_variable_subst' _LT_CONFIG_STATUS_DECLARATIONS LTCC='$LTCC' LTCFLAGS='$LTCFLAGS' compiler='$compiler_DEFAULT' # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$[]1 _LTECHO_EOF' } # Quote evaled strings. for var in lt_decl_all_varnames([[ \ ]], lt_decl_quote_varnames); do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[[\\\\\\\`\\"\\\$]]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done # Double-quote double-evaled strings. for var in lt_decl_all_varnames([[ \ ]], lt_decl_dquote_varnames); do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[[\\\\\\\`\\"\\\$]]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done _LT_OUTPUT_LIBTOOL_INIT ]) # _LT_GENERATED_FILE_INIT(FILE, [COMMENT]) # ------------------------------------ # Generate a child script FILE with all initialization necessary to # reuse the environment learned by the parent script, and make the # file executable. If COMMENT is supplied, it is inserted after the # '#!' sequence but before initialization text begins. After this # macro, additional text can be appended to FILE to form the body of # the child script. The macro ends with non-zero status if the # file could not be fully written (such as if the disk is full). m4_ifdef([AS_INIT_GENERATED], [m4_defun([_LT_GENERATED_FILE_INIT],[AS_INIT_GENERATED($@)])], [m4_defun([_LT_GENERATED_FILE_INIT], [m4_require([AS_PREPARE])]dnl [m4_pushdef([AS_MESSAGE_LOG_FD])]dnl [lt_write_fail=0 cat >$1 <<_ASEOF || lt_write_fail=1 #! $SHELL # Generated by $as_me. $2 SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$1 <<\_ASEOF || lt_write_fail=1 AS_SHELL_SANITIZE _AS_PREPARE exec AS_MESSAGE_FD>&1 _ASEOF test 0 = "$lt_write_fail" && chmod +x $1[]dnl m4_popdef([AS_MESSAGE_LOG_FD])])])# _LT_GENERATED_FILE_INIT # LT_OUTPUT # --------- # This macro allows early generation of the libtool script (before # AC_OUTPUT is called), incase it is used in configure for compilation # tests. AC_DEFUN([LT_OUTPUT], [: ${CONFIG_LT=./config.lt} AC_MSG_NOTICE([creating $CONFIG_LT]) _LT_GENERATED_FILE_INIT(["$CONFIG_LT"], [# Run this file to recreate a libtool stub with the current configuration.]) cat >>"$CONFIG_LT" <<\_LTEOF lt_cl_silent=false exec AS_MESSAGE_LOG_FD>>config.log { echo AS_BOX([Running $as_me.]) } >&AS_MESSAGE_LOG_FD lt_cl_help="\ '$as_me' creates a local libtool stub from the current configuration, for use in further configure time tests before the real libtool is generated. Usage: $[0] [[OPTIONS]] -h, --help print this help, then exit -V, --version print version number, then exit -q, --quiet do not print progress messages -d, --debug don't remove temporary files Report bugs to ." lt_cl_version="\ m4_ifset([AC_PACKAGE_NAME], [AC_PACKAGE_NAME ])config.lt[]dnl m4_ifset([AC_PACKAGE_VERSION], [ AC_PACKAGE_VERSION]) configured by $[0], generated by m4_PACKAGE_STRING. Copyright (C) 2011 Free Software Foundation, Inc. This config.lt script is free software; the Free Software Foundation gives unlimited permision to copy, distribute and modify it." while test 0 != $[#] do case $[1] in --version | --v* | -V ) echo "$lt_cl_version"; exit 0 ;; --help | --h* | -h ) echo "$lt_cl_help"; exit 0 ;; --debug | --d* | -d ) debug=: ;; --quiet | --q* | --silent | --s* | -q ) lt_cl_silent=: ;; -*) AC_MSG_ERROR([unrecognized option: $[1] Try '$[0] --help' for more information.]) ;; *) AC_MSG_ERROR([unrecognized argument: $[1] Try '$[0] --help' for more information.]) ;; esac shift done if $lt_cl_silent; then exec AS_MESSAGE_FD>/dev/null fi _LTEOF cat >>"$CONFIG_LT" <<_LTEOF _LT_OUTPUT_LIBTOOL_COMMANDS_INIT _LTEOF cat >>"$CONFIG_LT" <<\_LTEOF AC_MSG_NOTICE([creating $ofile]) _LT_OUTPUT_LIBTOOL_COMMANDS AS_EXIT(0) _LTEOF chmod +x "$CONFIG_LT" # configure is writing to config.log, but config.lt does its own redirection, # appending to config.log, which fails on DOS, as config.log is still kept # open by configure. Here we exec the FD to /dev/null, effectively closing # config.log, so it can be properly (re)opened and appended to by config.lt. lt_cl_success=: test yes = "$silent" && lt_config_lt_args="$lt_config_lt_args --quiet" exec AS_MESSAGE_LOG_FD>/dev/null $SHELL "$CONFIG_LT" $lt_config_lt_args || lt_cl_success=false exec AS_MESSAGE_LOG_FD>>config.log $lt_cl_success || AS_EXIT(1) ])# LT_OUTPUT # _LT_CONFIG(TAG) # --------------- # If TAG is the built-in tag, create an initial libtool script with a # default configuration from the untagged config vars. Otherwise add code # to config.status for appending the configuration named by TAG from the # matching tagged config vars. m4_defun([_LT_CONFIG], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl _LT_CONFIG_SAVE_COMMANDS([ m4_define([_LT_TAG], m4_if([$1], [], [C], [$1]))dnl m4_if(_LT_TAG, [C], [ # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes. if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi cfgfile=${ofile}T trap "$RM \"$cfgfile\"; exit 1" 1 2 15 $RM "$cfgfile" cat <<_LT_EOF >> "$cfgfile" #! $SHELL # Generated automatically by $as_me ($PACKAGE) $VERSION # Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`: # NOTE: Changes made to this file will be lost: look at ltmain.sh. # Provide generalized library-building support services. # Written by Gordon Matzigkeit, 1996 _LT_COPYING _LT_LIBTOOL_TAGS # Configured defaults for sys_lib_dlsearch_path munging. : \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"} # ### BEGIN LIBTOOL CONFIG _LT_LIBTOOL_CONFIG_VARS _LT_LIBTOOL_TAG_VARS # ### END LIBTOOL CONFIG _LT_EOF cat <<'_LT_EOF' >> "$cfgfile" # ### BEGIN FUNCTIONS SHARED WITH CONFIGURE _LT_PREPARE_MUNGE_PATH_LIST _LT_PREPARE_CC_BASENAME # ### END FUNCTIONS SHARED WITH CONFIGURE _LT_EOF case $host_os in aix3*) cat <<\_LT_EOF >> "$cfgfile" # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi _LT_EOF ;; esac _LT_PROG_LTMAIN # We use sed instead of cat because bash on DJGPP gets confused if # if finds mixed CR/LF and LF-only lines. Since sed operates in # text mode, it properly converts lines to CR/LF. This bash problem # is reportedly fixed, but why not run on old versions too? sed '$q' "$ltmain" >> "$cfgfile" \ || (rm -f "$cfgfile"; exit 1) mv -f "$cfgfile" "$ofile" || (rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile") chmod +x "$ofile" ], [cat <<_LT_EOF >> "$ofile" dnl Unfortunately we have to use $1 here, since _LT_TAG is not expanded dnl in a comment (ie after a #). # ### BEGIN LIBTOOL TAG CONFIG: $1 _LT_LIBTOOL_TAG_VARS(_LT_TAG) # ### END LIBTOOL TAG CONFIG: $1 _LT_EOF ])dnl /m4_if ], [m4_if([$1], [], [ PACKAGE='$PACKAGE' VERSION='$VERSION' RM='$RM' ofile='$ofile'], []) ])dnl /_LT_CONFIG_SAVE_COMMANDS ])# _LT_CONFIG # LT_SUPPORTED_TAG(TAG) # --------------------- # Trace this macro to discover what tags are supported by the libtool # --tag option, using: # autoconf --trace 'LT_SUPPORTED_TAG:$1' AC_DEFUN([LT_SUPPORTED_TAG], []) # C support is built-in for now m4_define([_LT_LANG_C_enabled], []) m4_define([_LT_TAGS], []) # LT_LANG(LANG) # ------------- # Enable libtool support for the given language if not already enabled. AC_DEFUN([LT_LANG], [AC_BEFORE([$0], [LT_OUTPUT])dnl m4_case([$1], [C], [_LT_LANG(C)], [C++], [_LT_LANG(CXX)], [Go], [_LT_LANG(GO)], [Java], [_LT_LANG(GCJ)], [Fortran 77], [_LT_LANG(F77)], [Fortran], [_LT_LANG(FC)], [Windows Resource], [_LT_LANG(RC)], [m4_ifdef([_LT_LANG_]$1[_CONFIG], [_LT_LANG($1)], [m4_fatal([$0: unsupported language: "$1"])])])dnl ])# LT_LANG # _LT_LANG(LANGNAME) # ------------------ m4_defun([_LT_LANG], [m4_ifdef([_LT_LANG_]$1[_enabled], [], [LT_SUPPORTED_TAG([$1])dnl m4_append([_LT_TAGS], [$1 ])dnl m4_define([_LT_LANG_]$1[_enabled], [])dnl _LT_LANG_$1_CONFIG($1)])dnl ])# _LT_LANG m4_ifndef([AC_PROG_GO], [ ############################################################ # NOTE: This macro has been submitted for inclusion into # # GNU Autoconf as AC_PROG_GO. When it is available in # # a released version of Autoconf we should remove this # # macro and use it instead. # ############################################################ m4_defun([AC_PROG_GO], [AC_LANG_PUSH(Go)dnl AC_ARG_VAR([GOC], [Go compiler command])dnl AC_ARG_VAR([GOFLAGS], [Go compiler flags])dnl _AC_ARG_VAR_LDFLAGS()dnl AC_CHECK_TOOL(GOC, gccgo) if test -z "$GOC"; then if test -n "$ac_tool_prefix"; then AC_CHECK_PROG(GOC, [${ac_tool_prefix}gccgo], [${ac_tool_prefix}gccgo]) fi fi if test -z "$GOC"; then AC_CHECK_PROG(GOC, gccgo, gccgo, false) fi ])#m4_defun ])#m4_ifndef # _LT_LANG_DEFAULT_CONFIG # ----------------------- m4_defun([_LT_LANG_DEFAULT_CONFIG], [AC_PROVIDE_IFELSE([AC_PROG_CXX], [LT_LANG(CXX)], [m4_define([AC_PROG_CXX], defn([AC_PROG_CXX])[LT_LANG(CXX)])]) AC_PROVIDE_IFELSE([AC_PROG_F77], [LT_LANG(F77)], [m4_define([AC_PROG_F77], defn([AC_PROG_F77])[LT_LANG(F77)])]) AC_PROVIDE_IFELSE([AC_PROG_FC], [LT_LANG(FC)], [m4_define([AC_PROG_FC], defn([AC_PROG_FC])[LT_LANG(FC)])]) dnl The call to [A][M_PROG_GCJ] is quoted like that to stop aclocal dnl pulling things in needlessly. AC_PROVIDE_IFELSE([AC_PROG_GCJ], [LT_LANG(GCJ)], [AC_PROVIDE_IFELSE([A][M_PROG_GCJ], [LT_LANG(GCJ)], [AC_PROVIDE_IFELSE([LT_PROG_GCJ], [LT_LANG(GCJ)], [m4_ifdef([AC_PROG_GCJ], [m4_define([AC_PROG_GCJ], defn([AC_PROG_GCJ])[LT_LANG(GCJ)])]) m4_ifdef([A][M_PROG_GCJ], [m4_define([A][M_PROG_GCJ], defn([A][M_PROG_GCJ])[LT_LANG(GCJ)])]) m4_ifdef([LT_PROG_GCJ], [m4_define([LT_PROG_GCJ], defn([LT_PROG_GCJ])[LT_LANG(GCJ)])])])])]) AC_PROVIDE_IFELSE([AC_PROG_GO], [LT_LANG(GO)], [m4_define([AC_PROG_GO], defn([AC_PROG_GO])[LT_LANG(GO)])]) AC_PROVIDE_IFELSE([LT_PROG_RC], [LT_LANG(RC)], [m4_define([LT_PROG_RC], defn([LT_PROG_RC])[LT_LANG(RC)])]) ])# _LT_LANG_DEFAULT_CONFIG # Obsolete macros: AU_DEFUN([AC_LIBTOOL_CXX], [LT_LANG(C++)]) AU_DEFUN([AC_LIBTOOL_F77], [LT_LANG(Fortran 77)]) AU_DEFUN([AC_LIBTOOL_FC], [LT_LANG(Fortran)]) AU_DEFUN([AC_LIBTOOL_GCJ], [LT_LANG(Java)]) AU_DEFUN([AC_LIBTOOL_RC], [LT_LANG(Windows Resource)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_CXX], []) dnl AC_DEFUN([AC_LIBTOOL_F77], []) dnl AC_DEFUN([AC_LIBTOOL_FC], []) dnl AC_DEFUN([AC_LIBTOOL_GCJ], []) dnl AC_DEFUN([AC_LIBTOOL_RC], []) # _LT_TAG_COMPILER # ---------------- m4_defun([_LT_TAG_COMPILER], [AC_REQUIRE([AC_PROG_CC])dnl _LT_DECL([LTCC], [CC], [1], [A C compiler])dnl _LT_DECL([LTCFLAGS], [CFLAGS], [1], [LTCC compiler flags])dnl _LT_TAGDECL([CC], [compiler], [1], [A language specific compiler])dnl _LT_TAGDECL([with_gcc], [GCC], [0], [Is the compiler the GNU compiler?])dnl # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC ])# _LT_TAG_COMPILER # _LT_COMPILER_BOILERPLATE # ------------------------ # Check for compiler boilerplate output or warnings with # the simple compiler test code. m4_defun([_LT_COMPILER_BOILERPLATE], [m4_require([_LT_DECL_SED])dnl ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" >conftest.$ac_ext eval "$ac_compile" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_compiler_boilerplate=`cat conftest.err` $RM conftest* ])# _LT_COMPILER_BOILERPLATE # _LT_LINKER_BOILERPLATE # ---------------------- # Check for linker boilerplate output or warnings with # the simple link test code. m4_defun([_LT_LINKER_BOILERPLATE], [m4_require([_LT_DECL_SED])dnl ac_outfile=conftest.$ac_objext echo "$lt_simple_link_test_code" >conftest.$ac_ext eval "$ac_link" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_linker_boilerplate=`cat conftest.err` $RM -r conftest* ])# _LT_LINKER_BOILERPLATE # _LT_REQUIRED_DARWIN_CHECKS # ------------------------- m4_defun_once([_LT_REQUIRED_DARWIN_CHECKS],[ case $host_os in rhapsody* | darwin*) AC_CHECK_TOOL([DSYMUTIL], [dsymutil], [:]) AC_CHECK_TOOL([NMEDIT], [nmedit], [:]) AC_CHECK_TOOL([LIPO], [lipo], [:]) AC_CHECK_TOOL([OTOOL], [otool], [:]) AC_CHECK_TOOL([OTOOL64], [otool64], [:]) _LT_DECL([], [DSYMUTIL], [1], [Tool to manipulate archived DWARF debug symbol files on Mac OS X]) _LT_DECL([], [NMEDIT], [1], [Tool to change global to local symbols on Mac OS X]) _LT_DECL([], [LIPO], [1], [Tool to manipulate fat objects and archives on Mac OS X]) _LT_DECL([], [OTOOL], [1], [ldd/readelf like tool for Mach-O binaries on Mac OS X]) _LT_DECL([], [OTOOL64], [1], [ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4]) AC_CACHE_CHECK([for -single_module linker flag],[lt_cv_apple_cc_single_mod], [lt_cv_apple_cc_single_mod=no if test -z "$LT_MULTI_MODULE"; then # By default we will add the -single_module flag. You can override # by either setting the environment variable LT_MULTI_MODULE # non-empty at configure time, or by adding -multi_module to the # link flags. rm -rf libconftest.dylib* echo "int foo(void){return 1;}" > conftest.c echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c 2>conftest.err _lt_result=$? # If there is a non-empty error log, and "single_module" # appears in it, assume the flag caused a linker warning if test -s conftest.err && $GREP single_module conftest.err; then cat conftest.err >&AS_MESSAGE_LOG_FD # Otherwise, if the output was created with a 0 exit code from # the compiler, it worked. elif test -f libconftest.dylib && test 0 = "$_lt_result"; then lt_cv_apple_cc_single_mod=yes else cat conftest.err >&AS_MESSAGE_LOG_FD fi rm -rf libconftest.dylib* rm -f conftest.* fi]) AC_CACHE_CHECK([for -exported_symbols_list linker flag], [lt_cv_ld_exported_symbols_list], [lt_cv_ld_exported_symbols_list=no save_LDFLAGS=$LDFLAGS echo "_main" > conftest.sym LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym" AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])], [lt_cv_ld_exported_symbols_list=yes], [lt_cv_ld_exported_symbols_list=no]) LDFLAGS=$save_LDFLAGS ]) AC_CACHE_CHECK([for -force_load linker flag],[lt_cv_ld_force_load], [lt_cv_ld_force_load=no cat > conftest.c << _LT_EOF int forced_loaded() { return 2;} _LT_EOF echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD cat > conftest.c << _LT_EOF int main() { return 0;} _LT_EOF echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err _lt_result=$? if test -s conftest.err && $GREP force_load conftest.err; then cat conftest.err >&AS_MESSAGE_LOG_FD elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then lt_cv_ld_force_load=yes else cat conftest.err >&AS_MESSAGE_LOG_FD fi rm -f conftest.err libconftest.a conftest conftest.c rm -rf conftest.dSYM ]) case $host_os in rhapsody* | darwin1.[[012]]) _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;; darwin1.*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; darwin*) # darwin 5.x on # if running on 10.5 or later, the deployment target defaults # to the OS version, if on x86, and 10.4, the deployment # target defaults to 10.4. Don't you love it? case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in 10.0,*86*-darwin8*|10.0,*-darwin[[91]]*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; 10.[[012]][[,.]]*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; 10.*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; esac ;; esac if test yes = "$lt_cv_apple_cc_single_mod"; then _lt_dar_single_mod='$single_module' fi if test yes = "$lt_cv_ld_exported_symbols_list"; then _lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym' else _lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib' fi if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then _lt_dsymutil='~$DSYMUTIL $lib || :' else _lt_dsymutil= fi ;; esac ]) # _LT_DARWIN_LINKER_FEATURES([TAG]) # --------------------------------- # Checks for linker and compiler features on darwin m4_defun([_LT_DARWIN_LINKER_FEATURES], [ m4_require([_LT_REQUIRED_DARWIN_CHECKS]) _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported if test yes = "$lt_cv_ld_force_load"; then _LT_TAGVAR(whole_archive_flag_spec, $1)='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`' m4_case([$1], [F77], [_LT_TAGVAR(compiler_needs_object, $1)=yes], [FC], [_LT_TAGVAR(compiler_needs_object, $1)=yes]) else _LT_TAGVAR(whole_archive_flag_spec, $1)='' fi _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=$_lt_dar_allow_undefined case $cc_basename in ifort*|nagfor*) _lt_dar_can_shared=yes ;; *) _lt_dar_can_shared=$GCC ;; esac if test yes = "$_lt_dar_can_shared"; then output_verbose_link_cmd=func_echo_all _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil" _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil" _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil" _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil" m4_if([$1], [CXX], [ if test yes != "$lt_cv_apple_cc_single_mod"; then _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil" _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil" fi ],[]) else _LT_TAGVAR(ld_shlibs, $1)=no fi ]) # _LT_SYS_MODULE_PATH_AIX([TAGNAME]) # ---------------------------------- # Links a minimal program and checks the executable # for the system default hardcoded library path. In most cases, # this is /usr/lib:/lib, but when the MPI compilers are used # the location of the communication and MPI libs are included too. # If we don't find anything, use the default library path according # to the aix ld manual. # Store the results from the different compilers for each TAGNAME. # Allow to override them for all tags through lt_cv_aix_libpath. m4_defun([_LT_SYS_MODULE_PATH_AIX], [m4_require([_LT_DECL_SED])dnl if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else AC_CACHE_VAL([_LT_TAGVAR([lt_cv_aix_libpath_], [$1])], [AC_LINK_IFELSE([AC_LANG_PROGRAM],[ lt_aix_libpath_sed='[ /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }]' _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi],[]) if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=/usr/lib:/lib fi ]) aix_libpath=$_LT_TAGVAR([lt_cv_aix_libpath_], [$1]) fi ])# _LT_SYS_MODULE_PATH_AIX # _LT_SHELL_INIT(ARG) # ------------------- m4_define([_LT_SHELL_INIT], [m4_divert_text([M4SH-INIT], [$1 ])])# _LT_SHELL_INIT # _LT_PROG_ECHO_BACKSLASH # ----------------------- # Find how we can fake an echo command that does not interpret backslash. # In particular, with Autoconf 2.60 or later we add some code to the start # of the generated configure script that will find a shell with a builtin # printf (that we can use as an echo command). m4_defun([_LT_PROG_ECHO_BACKSLASH], [ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO AC_MSG_CHECKING([how to print strings]) # Test print first, because it will be a builtin if present. if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \ test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='print -r --' elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='printf %s\n' else # Use this function as a fallback that always works. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $[]1 _LTECHO_EOF' } ECHO='func_fallback_echo' fi # func_echo_all arg... # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "$*" } case $ECHO in printf*) AC_MSG_RESULT([printf]) ;; print*) AC_MSG_RESULT([print -r]) ;; *) AC_MSG_RESULT([cat]) ;; esac m4_ifdef([_AS_DETECT_SUGGESTED], [_AS_DETECT_SUGGESTED([ test -n "${ZSH_VERSION+set}${BASH_VERSION+set}" || ( ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO PATH=/empty FPATH=/empty; export PATH FPATH test "X`printf %s $ECHO`" = "X$ECHO" \ || test "X`print -r -- $ECHO`" = "X$ECHO" )])]) _LT_DECL([], [SHELL], [1], [Shell to use when invoking shell scripts]) _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes]) ])# _LT_PROG_ECHO_BACKSLASH # _LT_WITH_SYSROOT # ---------------- AC_DEFUN([_LT_WITH_SYSROOT], [AC_MSG_CHECKING([for sysroot]) AC_ARG_WITH([sysroot], [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@], [Search for dependent libraries within DIR (or the compiler's sysroot if not specified).])], [], [with_sysroot=no]) dnl lt_sysroot will always be passed unquoted. We quote it here dnl in case the user passed a directory name. lt_sysroot= case $with_sysroot in #( yes) if test yes = "$GCC"; then lt_sysroot=`$CC --print-sysroot 2>/dev/null` fi ;; #( /*) lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"` ;; #( no|'') ;; #( *) AC_MSG_RESULT([$with_sysroot]) AC_MSG_ERROR([The sysroot must be an absolute path.]) ;; esac AC_MSG_RESULT([${lt_sysroot:-no}]) _LT_DECL([], [lt_sysroot], [0], [The root where to search for ]dnl [dependent libraries, and where our libraries should be installed.])]) # _LT_ENABLE_LOCK # --------------- m4_defun([_LT_ENABLE_LOCK], [AC_ARG_ENABLE([libtool-lock], [AS_HELP_STRING([--disable-libtool-lock], [avoid locking (might break parallel builds)])]) test no = "$enable_libtool_lock" || enable_libtool_lock=yes # Some flags need to be propagated to the compiler or linker for good # libtool support. case $host in ia64-*-hpux*) # Find out what ABI is being produced by ac_compile, and set mode # options accordingly. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.$ac_objext` in *ELF-32*) HPUX_IA64_MODE=32 ;; *ELF-64*) HPUX_IA64_MODE=64 ;; esac fi rm -rf conftest* ;; *-*-irix6*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then if test yes = "$lt_cv_prog_gnu_ld"; then case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -melf32bsmip" ;; *N32*) LD="${LD-ld} -melf32bmipn32" ;; *64-bit*) LD="${LD-ld} -melf64bmip" ;; esac else case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -32" ;; *N32*) LD="${LD-ld} -n32" ;; *64-bit*) LD="${LD-ld} -64" ;; esac fi fi rm -rf conftest* ;; mips64*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then emul=elf case `/usr/bin/file conftest.$ac_objext` in *32-bit*) emul="${emul}32" ;; *64-bit*) emul="${emul}64" ;; esac case `/usr/bin/file conftest.$ac_objext` in *MSB*) emul="${emul}btsmip" ;; *LSB*) emul="${emul}ltsmip" ;; esac case `/usr/bin/file conftest.$ac_objext` in *N32*) emul="${emul}n32" ;; esac LD="${LD-ld} -m $emul" fi rm -rf conftest* ;; x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \ s390*-*linux*|s390*-*tpf*|sparc*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. Note that the listed cases only cover the # situations where additional linker options are needed (such as when # doing 32-bit compilation for a host where ld defaults to 64-bit, or # vice versa); the common cases where no linker options are needed do # not appear in the list. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.o` in *32-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_i386_fbsd" ;; x86_64-*linux*) case `/usr/bin/file conftest.o` in *x86-64*) LD="${LD-ld} -m elf32_x86_64" ;; *) LD="${LD-ld} -m elf_i386" ;; esac ;; powerpc64le-*linux*) LD="${LD-ld} -m elf32lppclinux" ;; powerpc64-*linux*) LD="${LD-ld} -m elf32ppclinux" ;; s390x-*linux*) LD="${LD-ld} -m elf_s390" ;; sparc64-*linux*) LD="${LD-ld} -m elf32_sparc" ;; esac ;; *64-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_x86_64_fbsd" ;; x86_64-*linux*) LD="${LD-ld} -m elf_x86_64" ;; powerpcle-*linux*) LD="${LD-ld} -m elf64lppc" ;; powerpc-*linux*) LD="${LD-ld} -m elf64ppc" ;; s390*-*linux*|s390*-*tpf*) LD="${LD-ld} -m elf64_s390" ;; sparc*-*linux*) LD="${LD-ld} -m elf64_sparc" ;; esac ;; esac fi rm -rf conftest* ;; *-*-sco3.2v5*) # On SCO OpenServer 5, we need -belf to get full-featured binaries. SAVE_CFLAGS=$CFLAGS CFLAGS="$CFLAGS -belf" AC_CACHE_CHECK([whether the C compiler needs -belf], lt_cv_cc_needs_belf, [AC_LANG_PUSH(C) AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],[[]])],[lt_cv_cc_needs_belf=yes],[lt_cv_cc_needs_belf=no]) AC_LANG_POP]) if test yes != "$lt_cv_cc_needs_belf"; then # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf CFLAGS=$SAVE_CFLAGS fi ;; *-*solaris*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.o` in *64-bit*) case $lt_cv_prog_gnu_ld in yes*) case $host in i?86-*-solaris*|x86_64-*-solaris*) LD="${LD-ld} -m elf_x86_64" ;; sparc*-*-solaris*) LD="${LD-ld} -m elf64_sparc" ;; esac # GNU ld 2.21 introduced _sol2 emulations. Use them if available. if ${LD-ld} -V | grep _sol2 >/dev/null 2>&1; then LD=${LD-ld}_sol2 fi ;; *) if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then LD="${LD-ld} -64" fi ;; esac ;; esac fi rm -rf conftest* ;; esac need_locks=$enable_libtool_lock ])# _LT_ENABLE_LOCK # _LT_PROG_AR # ----------- m4_defun([_LT_PROG_AR], [AC_CHECK_TOOLS(AR, [ar], false) : ${AR=ar} : ${AR_FLAGS=cru} _LT_DECL([], [AR], [1], [The archiver]) _LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive]) AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file], [lt_cv_ar_at_file=no AC_COMPILE_IFELSE([AC_LANG_PROGRAM], [echo conftest.$ac_objext > conftest.lst lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&AS_MESSAGE_LOG_FD' AC_TRY_EVAL([lt_ar_try]) if test 0 -eq "$ac_status"; then # Ensure the archiver fails upon bogus file names. rm -f conftest.$ac_objext libconftest.a AC_TRY_EVAL([lt_ar_try]) if test 0 -ne "$ac_status"; then lt_cv_ar_at_file=@ fi fi rm -f conftest.* libconftest.a ]) ]) if test no = "$lt_cv_ar_at_file"; then archiver_list_spec= else archiver_list_spec=$lt_cv_ar_at_file fi _LT_DECL([], [archiver_list_spec], [1], [How to feed a file listing to the archiver]) ])# _LT_PROG_AR # _LT_CMD_OLD_ARCHIVE # ------------------- m4_defun([_LT_CMD_OLD_ARCHIVE], [_LT_PROG_AR AC_CHECK_TOOL(STRIP, strip, :) test -z "$STRIP" && STRIP=: _LT_DECL([], [STRIP], [1], [A symbol stripping program]) AC_CHECK_TOOL(RANLIB, ranlib, :) test -z "$RANLIB" && RANLIB=: _LT_DECL([], [RANLIB], [1], [Commands used to install an old-style archive]) # Determine commands to create old-style static archives. old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs' old_postinstall_cmds='chmod 644 $oldlib' old_postuninstall_cmds= if test -n "$RANLIB"; then case $host_os in bitrig* | openbsd*) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib" ;; *) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib" ;; esac old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib" fi case $host_os in darwin*) lock_old_archive_extraction=yes ;; *) lock_old_archive_extraction=no ;; esac _LT_DECL([], [old_postinstall_cmds], [2]) _LT_DECL([], [old_postuninstall_cmds], [2]) _LT_TAGDECL([], [old_archive_cmds], [2], [Commands used to build an old-style archive]) _LT_DECL([], [lock_old_archive_extraction], [0], [Whether to use a lock for old archive extraction]) ])# _LT_CMD_OLD_ARCHIVE # _LT_COMPILER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS, # [OUTPUT-FILE], [ACTION-SUCCESS], [ACTION-FAILURE]) # ---------------------------------------------------------------- # Check whether the given compiler option works AC_DEFUN([_LT_COMPILER_OPTION], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_SED])dnl AC_CACHE_CHECK([$1], [$2], [$2=no m4_if([$4], , [ac_outfile=conftest.$ac_objext], [ac_outfile=$4]) echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="$3" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&AS_MESSAGE_LOG_FD echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then $2=yes fi fi $RM conftest* ]) if test yes = "[$]$2"; then m4_if([$5], , :, [$5]) else m4_if([$6], , :, [$6]) fi ])# _LT_COMPILER_OPTION # Old name: AU_ALIAS([AC_LIBTOOL_COMPILER_OPTION], [_LT_COMPILER_OPTION]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_COMPILER_OPTION], []) # _LT_LINKER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS, # [ACTION-SUCCESS], [ACTION-FAILURE]) # ---------------------------------------------------- # Check whether the given linker option works AC_DEFUN([_LT_LINKER_OPTION], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_SED])dnl AC_CACHE_CHECK([$1], [$2], [$2=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS $3" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&AS_MESSAGE_LOG_FD $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then $2=yes fi else $2=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS ]) if test yes = "[$]$2"; then m4_if([$4], , :, [$4]) else m4_if([$5], , :, [$5]) fi ])# _LT_LINKER_OPTION # Old name: AU_ALIAS([AC_LIBTOOL_LINKER_OPTION], [_LT_LINKER_OPTION]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_LINKER_OPTION], []) # LT_CMD_MAX_LEN #--------------- AC_DEFUN([LT_CMD_MAX_LEN], [AC_REQUIRE([AC_CANONICAL_HOST])dnl # find the maximum length of command line arguments AC_MSG_CHECKING([the maximum length of command line arguments]) AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl i=0 teststring=ABCD case $build_os in msdosdjgpp*) # On DJGPP, this test can blow up pretty badly due to problems in libc # (any single argument exceeding 2000 bytes causes a buffer overrun # during glob expansion). Even if it were fixed, the result of this # check would be larger than it should be. lt_cv_sys_max_cmd_len=12288; # 12K is about right ;; gnu*) # Under GNU Hurd, this test is not required because there is # no limit to the length of command line arguments. # Libtool will interpret -1 as no limit whatsoever lt_cv_sys_max_cmd_len=-1; ;; cygwin* | mingw* | cegcc*) # On Win9x/ME, this test blows up -- it succeeds, but takes # about 5 minutes as the teststring grows exponentially. # Worse, since 9x/ME are not pre-emptively multitasking, # you end up with a "frozen" computer, even though with patience # the test eventually succeeds (with a max line length of 256k). # Instead, let's just punt: use the minimum linelength reported by # all of the supported platforms: 8192 (on NT/2K/XP). lt_cv_sys_max_cmd_len=8192; ;; mint*) # On MiNT this can take a long time and run out of memory. lt_cv_sys_max_cmd_len=8192; ;; amigaos*) # On AmigaOS with pdksh, this test takes hours, literally. # So we just punt and use a minimum line length of 8192. lt_cv_sys_max_cmd_len=8192; ;; bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*) # This has been around since 386BSD, at least. Likely further. if test -x /sbin/sysctl; then lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax` elif test -x /usr/sbin/sysctl; then lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax` else lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs fi # And add a safety zone lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` ;; interix*) # We know the value 262144 and hardcode it with a safety zone (like BSD) lt_cv_sys_max_cmd_len=196608 ;; os2*) # The test takes a long time on OS/2. lt_cv_sys_max_cmd_len=8192 ;; osf*) # Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure # due to this test when exec_disable_arg_limit is 1 on Tru64. It is not # nice to cause kernel panics so lets avoid the loop below. # First set a reasonable default. lt_cv_sys_max_cmd_len=16384 # if test -x /sbin/sysconfig; then case `/sbin/sysconfig -q proc exec_disable_arg_limit` in *1*) lt_cv_sys_max_cmd_len=-1 ;; esac fi ;; sco3.2v5*) lt_cv_sys_max_cmd_len=102400 ;; sysv5* | sco5v6* | sysv4.2uw2*) kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null` if test -n "$kargmax"; then lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[ ]]//'` else lt_cv_sys_max_cmd_len=32768 fi ;; *) lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null` if test -n "$lt_cv_sys_max_cmd_len" && \ test undefined != "$lt_cv_sys_max_cmd_len"; then lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` else # Make teststring a little bigger before we do anything with it. # a 1K string should be a reasonable start. for i in 1 2 3 4 5 6 7 8; do teststring=$teststring$teststring done SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}} # If test is not a shell built-in, we'll probably end up computing a # maximum length that is only half of the actual maximum length, but # we can't tell. while { test X`env echo "$teststring$teststring" 2>/dev/null` \ = "X$teststring$teststring"; } >/dev/null 2>&1 && test 17 != "$i" # 1/2 MB should be enough do i=`expr $i + 1` teststring=$teststring$teststring done # Only check the string length outside the loop. lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1` teststring= # Add a significant safety factor because C++ compilers can tack on # massive amounts of additional arguments before passing them to the # linker. It appears as though 1/2 is a usable value. lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2` fi ;; esac ]) if test -n "$lt_cv_sys_max_cmd_len"; then AC_MSG_RESULT($lt_cv_sys_max_cmd_len) else AC_MSG_RESULT(none) fi max_cmd_len=$lt_cv_sys_max_cmd_len _LT_DECL([], [max_cmd_len], [0], [What is the maximum length of a command?]) ])# LT_CMD_MAX_LEN # Old name: AU_ALIAS([AC_LIBTOOL_SYS_MAX_CMD_LEN], [LT_CMD_MAX_LEN]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_SYS_MAX_CMD_LEN], []) # _LT_HEADER_DLFCN # ---------------- m4_defun([_LT_HEADER_DLFCN], [AC_CHECK_HEADERS([dlfcn.h], [], [], [AC_INCLUDES_DEFAULT])dnl ])# _LT_HEADER_DLFCN # _LT_TRY_DLOPEN_SELF (ACTION-IF-TRUE, ACTION-IF-TRUE-W-USCORE, # ACTION-IF-FALSE, ACTION-IF-CROSS-COMPILING) # ---------------------------------------------------------------- m4_defun([_LT_TRY_DLOPEN_SELF], [m4_require([_LT_HEADER_DLFCN])dnl if test yes = "$cross_compiling"; then : [$4] else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF [#line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; }] _LT_EOF if AC_TRY_EVAL(ac_link) && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&AS_MESSAGE_LOG_FD 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) $1 ;; x$lt_dlneed_uscore) $2 ;; x$lt_dlunknown|x*) $3 ;; esac else : # compilation failed $3 fi fi rm -fr conftest* ])# _LT_TRY_DLOPEN_SELF # LT_SYS_DLOPEN_SELF # ------------------ AC_DEFUN([LT_SYS_DLOPEN_SELF], [m4_require([_LT_HEADER_DLFCN])dnl if test yes != "$enable_dlopen"; then enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown else lt_cv_dlopen=no lt_cv_dlopen_libs= case $host_os in beos*) lt_cv_dlopen=load_add_on lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ;; mingw* | pw32* | cegcc*) lt_cv_dlopen=LoadLibrary lt_cv_dlopen_libs= ;; cygwin*) lt_cv_dlopen=dlopen lt_cv_dlopen_libs= ;; darwin*) # if libdl is installed we need to link against it AC_CHECK_LIB([dl], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl],[ lt_cv_dlopen=dyld lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ]) ;; tpf*) # Don't try to run any link tests for TPF. We know it's impossible # because TPF is a cross-compiler, and we know how we open DSOs. lt_cv_dlopen=dlopen lt_cv_dlopen_libs= lt_cv_dlopen_self=no ;; *) AC_CHECK_FUNC([shl_load], [lt_cv_dlopen=shl_load], [AC_CHECK_LIB([dld], [shl_load], [lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld], [AC_CHECK_FUNC([dlopen], [lt_cv_dlopen=dlopen], [AC_CHECK_LIB([dl], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl], [AC_CHECK_LIB([svld], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld], [AC_CHECK_LIB([dld], [dld_link], [lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld]) ]) ]) ]) ]) ]) ;; esac if test no = "$lt_cv_dlopen"; then enable_dlopen=no else enable_dlopen=yes fi case $lt_cv_dlopen in dlopen) save_CPPFLAGS=$CPPFLAGS test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H" save_LDFLAGS=$LDFLAGS wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\" save_LIBS=$LIBS LIBS="$lt_cv_dlopen_libs $LIBS" AC_CACHE_CHECK([whether a program can dlopen itself], lt_cv_dlopen_self, [dnl _LT_TRY_DLOPEN_SELF( lt_cv_dlopen_self=yes, lt_cv_dlopen_self=yes, lt_cv_dlopen_self=no, lt_cv_dlopen_self=cross) ]) if test yes = "$lt_cv_dlopen_self"; then wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\" AC_CACHE_CHECK([whether a statically linked program can dlopen itself], lt_cv_dlopen_self_static, [dnl _LT_TRY_DLOPEN_SELF( lt_cv_dlopen_self_static=yes, lt_cv_dlopen_self_static=yes, lt_cv_dlopen_self_static=no, lt_cv_dlopen_self_static=cross) ]) fi CPPFLAGS=$save_CPPFLAGS LDFLAGS=$save_LDFLAGS LIBS=$save_LIBS ;; esac case $lt_cv_dlopen_self in yes|no) enable_dlopen_self=$lt_cv_dlopen_self ;; *) enable_dlopen_self=unknown ;; esac case $lt_cv_dlopen_self_static in yes|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;; *) enable_dlopen_self_static=unknown ;; esac fi _LT_DECL([dlopen_support], [enable_dlopen], [0], [Whether dlopen is supported]) _LT_DECL([dlopen_self], [enable_dlopen_self], [0], [Whether dlopen of programs is supported]) _LT_DECL([dlopen_self_static], [enable_dlopen_self_static], [0], [Whether dlopen of statically linked programs is supported]) ])# LT_SYS_DLOPEN_SELF # Old name: AU_ALIAS([AC_LIBTOOL_DLOPEN_SELF], [LT_SYS_DLOPEN_SELF]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_DLOPEN_SELF], []) # _LT_COMPILER_C_O([TAGNAME]) # --------------------------- # Check to see if options -c and -o are simultaneously supported by compiler. # This macro does not hard code the compiler like AC_PROG_CC_C_O. m4_defun([_LT_COMPILER_C_O], [m4_require([_LT_DECL_SED])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_TAG_COMPILER])dnl AC_CACHE_CHECK([if $compiler supports -c -o file.$ac_objext], [_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)], [_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&AS_MESSAGE_LOG_FD echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then _LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes fi fi chmod u+w . 2>&AS_MESSAGE_LOG_FD $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* ]) _LT_TAGDECL([compiler_c_o], [lt_cv_prog_compiler_c_o], [1], [Does compiler simultaneously support -c and -o options?]) ])# _LT_COMPILER_C_O # _LT_COMPILER_FILE_LOCKS([TAGNAME]) # ---------------------------------- # Check to see if we can do hard links to lock some files if needed m4_defun([_LT_COMPILER_FILE_LOCKS], [m4_require([_LT_ENABLE_LOCK])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl _LT_COMPILER_C_O([$1]) hard_links=nottested if test no = "$_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)" && test no != "$need_locks"; then # do not overwrite the value of need_locks provided by the user AC_MSG_CHECKING([if we can lock with hard links]) hard_links=yes $RM conftest* ln conftest.a conftest.b 2>/dev/null && hard_links=no touch conftest.a ln conftest.a conftest.b 2>&5 || hard_links=no ln conftest.a conftest.b 2>/dev/null && hard_links=no AC_MSG_RESULT([$hard_links]) if test no = "$hard_links"; then AC_MSG_WARN(['$CC' does not support '-c -o', so 'make -j' may be unsafe]) need_locks=warn fi else need_locks=no fi _LT_DECL([], [need_locks], [1], [Must we lock files when doing compilation?]) ])# _LT_COMPILER_FILE_LOCKS # _LT_CHECK_OBJDIR # ---------------- m4_defun([_LT_CHECK_OBJDIR], [AC_CACHE_CHECK([for objdir], [lt_cv_objdir], [rm -f .libs 2>/dev/null mkdir .libs 2>/dev/null if test -d .libs; then lt_cv_objdir=.libs else # MS-DOS does not allow filenames that begin with a dot. lt_cv_objdir=_libs fi rmdir .libs 2>/dev/null]) objdir=$lt_cv_objdir _LT_DECL([], [objdir], [0], [The name of the directory that contains temporary libtool files])dnl m4_pattern_allow([LT_OBJDIR])dnl AC_DEFINE_UNQUOTED([LT_OBJDIR], "$lt_cv_objdir/", [Define to the sub-directory where libtool stores uninstalled libraries.]) ])# _LT_CHECK_OBJDIR # _LT_LINKER_HARDCODE_LIBPATH([TAGNAME]) # -------------------------------------- # Check hardcoding attributes. m4_defun([_LT_LINKER_HARDCODE_LIBPATH], [AC_MSG_CHECKING([how to hardcode library paths into programs]) _LT_TAGVAR(hardcode_action, $1)= if test -n "$_LT_TAGVAR(hardcode_libdir_flag_spec, $1)" || test -n "$_LT_TAGVAR(runpath_var, $1)" || test yes = "$_LT_TAGVAR(hardcode_automatic, $1)"; then # We can hardcode non-existent directories. if test no != "$_LT_TAGVAR(hardcode_direct, $1)" && # If the only mechanism to avoid hardcoding is shlibpath_var, we # have to relink, otherwise we might link with an installed library # when we should be linking with a yet-to-be-installed one ## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, $1)" && test no != "$_LT_TAGVAR(hardcode_minus_L, $1)"; then # Linking always hardcodes the temporary library directory. _LT_TAGVAR(hardcode_action, $1)=relink else # We can link without hardcoding, and we can hardcode nonexisting dirs. _LT_TAGVAR(hardcode_action, $1)=immediate fi else # We cannot hardcode anything, or else we can only hardcode existing # directories. _LT_TAGVAR(hardcode_action, $1)=unsupported fi AC_MSG_RESULT([$_LT_TAGVAR(hardcode_action, $1)]) if test relink = "$_LT_TAGVAR(hardcode_action, $1)" || test yes = "$_LT_TAGVAR(inherit_rpath, $1)"; then # Fast installation is not supported enable_fast_install=no elif test yes = "$shlibpath_overrides_runpath" || test no = "$enable_shared"; then # Fast installation is not necessary enable_fast_install=needless fi _LT_TAGDECL([], [hardcode_action], [0], [How to hardcode a shared library path into an executable]) ])# _LT_LINKER_HARDCODE_LIBPATH # _LT_CMD_STRIPLIB # ---------------- m4_defun([_LT_CMD_STRIPLIB], [m4_require([_LT_DECL_EGREP]) striplib= old_striplib= AC_MSG_CHECKING([whether stripping libraries is possible]) if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then test -z "$old_striplib" && old_striplib="$STRIP --strip-debug" test -z "$striplib" && striplib="$STRIP --strip-unneeded" AC_MSG_RESULT([yes]) else # FIXME - insert some real tests, host_os isn't really good enough case $host_os in darwin*) if test -n "$STRIP"; then striplib="$STRIP -x" old_striplib="$STRIP -S" AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) fi ;; *) AC_MSG_RESULT([no]) ;; esac fi _LT_DECL([], [old_striplib], [1], [Commands to strip libraries]) _LT_DECL([], [striplib], [1]) ])# _LT_CMD_STRIPLIB # _LT_PREPARE_MUNGE_PATH_LIST # --------------------------- # Make sure func_munge_path_list() is defined correctly. m4_defun([_LT_PREPARE_MUNGE_PATH_LIST], [[# func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x@S|@2 in x) ;; *:) eval @S|@1=\"`$ECHO @S|@2 | $SED 's/:/ /g'` \@S|@@S|@1\" ;; x:*) eval @S|@1=\"\@S|@@S|@1 `$ECHO @S|@2 | $SED 's/:/ /g'`\" ;; *::*) eval @S|@1=\"\@S|@@S|@1\ `$ECHO @S|@2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval @S|@1=\"`$ECHO @S|@2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \@S|@@S|@1\" ;; *) eval @S|@1=\"`$ECHO @S|@2 | $SED 's/:/ /g'`\" ;; esac } ]])# _LT_PREPARE_PATH_LIST # _LT_SYS_DYNAMIC_LINKER([TAG]) # ----------------------------- # PORTME Fill in your ld.so characteristics m4_defun([_LT_SYS_DYNAMIC_LINKER], [AC_REQUIRE([AC_CANONICAL_HOST])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_OBJDUMP])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_CHECK_SHELL_FEATURES])dnl m4_require([_LT_PREPARE_MUNGE_PATH_LIST])dnl AC_MSG_CHECKING([dynamic linker characteristics]) m4_if([$1], [], [ if test yes = "$GCC"; then case $host_os in darwin*) lt_awk_arg='/^libraries:/,/LR/' ;; *) lt_awk_arg='/^libraries:/' ;; esac case $host_os in mingw* | cegcc*) lt_sed_strip_eq='s|=\([[A-Za-z]]:\)|\1|g' ;; *) lt_sed_strip_eq='s|=/|/|g' ;; esac lt_search_path_spec=`$CC -print-search-dirs | awk $lt_awk_arg | $SED -e "s/^libraries://" -e $lt_sed_strip_eq` case $lt_search_path_spec in *\;*) # if the path contains ";" then we assume it to be the separator # otherwise default to the standard path separator (i.e. ":") - it is # assumed that no part of a normal pathname contains ";" but that should # okay in the real world where ";" in dirpaths is itself problematic. lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED 's/;/ /g'` ;; *) lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED "s/$PATH_SEPARATOR/ /g"` ;; esac # Ok, now we have the path, separated by spaces, we can step through it # and add multilib dir if necessary... lt_tmp_lt_search_path_spec= lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null` # ...but if some path component already ends with the multilib dir we assume # that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer). case "$lt_multi_os_dir; $lt_search_path_spec " in "/; "* | "/.; "* | "/./; "* | *"$lt_multi_os_dir "* | *"$lt_multi_os_dir/ "*) lt_multi_os_dir= ;; esac for lt_sys_path in $lt_search_path_spec; do if test -d "$lt_sys_path$lt_multi_os_dir"; then lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir" elif test -n "$lt_multi_os_dir"; then test -d "$lt_sys_path" && \ lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path" fi done lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" | awk ' BEGIN {RS = " "; FS = "/|\n";} { lt_foo = ""; lt_count = 0; for (lt_i = NF; lt_i > 0; lt_i--) { if ($lt_i != "" && $lt_i != ".") { if ($lt_i == "..") { lt_count++; } else { if (lt_count == 0) { lt_foo = "/" $lt_i lt_foo; } else { lt_count--; } } } } if (lt_foo != "") { lt_freq[[lt_foo]]++; } if (lt_freq[[lt_foo]] == 1) { print lt_foo; } }'` # AWK program above erroneously prepends '/' to C:/dos/paths # for these hosts. case $host_os in mingw* | cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" |\ $SED 's|/\([[A-Za-z]]:\)|\1|g'` ;; esac sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" | $lt_NL2SP` else sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" fi]) library_names_spec= libname_spec='lib$name' soname_spec= shrext_cmds=.so postinstall_cmds= postuninstall_cmds= finish_cmds= finish_eval= shlibpath_var= shlibpath_overrides_runpath=unknown version_type=none dynamic_linker="$host_os ld.so" sys_lib_dlsearch_path_spec="/lib /usr/lib" need_lib_prefix=unknown hardcode_into_libs=no # when you set need_version to no, make sure it does not cause -set_version # flags to be left without arguments need_version=unknown AC_ARG_VAR([LT_SYS_LIBRARY_PATH], [User-defined run-time library search path.]) case $host_os in aix3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname.a' shlibpath_var=LIBPATH # AIX 3 has no versioning support, so we append a major version to the name. soname_spec='$libname$release$shared_ext$major' ;; aix[[4-9]]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no hardcode_into_libs=yes if test ia64 = "$host_cpu"; then # AIX 5 supports IA64 library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH else # With GCC up to 2.95.x, collect2 would create an import file # for dependence libraries. The import file would start with # the line '#! .'. This would cause the generated library to # depend on '.', always an invalid library. This was fixed in # development snapshots of GCC prior to 3.0. case $host_os in aix4 | aix4.[[01]] | aix4.[[01]].*) if { echo '#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)' echo ' yes ' echo '#endif'; } | $CC -E - | $GREP yes > /dev/null; then : else can_build_shared=no fi ;; esac # Using Import Files as archive members, it is possible to support # filename-based versioning of shared library archives on AIX. While # this would work for both with and without runtime linking, it will # prevent static linking of such archives. So we do filename-based # shared library versioning with .so extension only, which is used # when both runtime linking and shared linking is enabled. # Unfortunately, runtime linking may impact performance, so we do # not want this to be the default eventually. Also, we use the # versioned .so libs for executables only if there is the -brtl # linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only. # To allow for filename-based versioning support, we need to create # libNAME.so.V as an archive file, containing: # *) an Import File, referring to the versioned filename of the # archive as well as the shared archive member, telling the # bitwidth (32 or 64) of that shared object, and providing the # list of exported symbols of that shared object, eventually # decorated with the 'weak' keyword # *) the shared object with the F_LOADONLY flag set, to really avoid # it being seen by the linker. # At run time we better use the real file rather than another symlink, # but for link time we create the symlink libNAME.so -> libNAME.so.V case $with_aix_soname,$aix_use_runtimelinking in # AIX (on Power*) has no versioning support, so currently we cannot hardcode correct # soname into executable. Probably we can add versioning support to # collect2, so additional links can be useful in future. aix,yes) # traditional libtool dynamic_linker='AIX unversionable lib.so' # If using run time linking (on AIX 4.2 or later) use lib.so # instead of lib.a to let people know that these are not # typical AIX shared libraries. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; aix,no) # traditional AIX only dynamic_linker='AIX lib.a[(]lib.so.V[)]' # We preserve .a as extension for shared libraries through AIX4.2 # and later when we are not doing run time linking. library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' ;; svr4,*) # full svr4 only dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)]" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,yes) # both, prefer svr4 dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)], lib.a[(]lib.so.V[)]" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # unpreferred sharedlib libNAME.a needs extra handling postinstall_cmds='test -n "$linkname" || linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" || test -z "$striplib" || $striplib "$destdir/$func_stripname_result.$libext"' postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" || func_append rmfiles " $odir/$func_stripname_result.$libext"' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,no) # both, prefer aix dynamic_linker="AIX lib.a[(]lib.so.V[)], lib.so.V[(]$shared_archive_member_spec.o[)]" library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' # unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling postinstall_cmds='test -z "$dlname" || $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" || test -z "$striplib" || $striplib $destdir/$dlname~test -n "$linkname" || linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)' postuninstall_cmds='test -z "$dlname" || func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"' ;; esac shlibpath_var=LIBPATH fi ;; amigaos*) case $host_cpu in powerpc) # Since July 2007 AmigaOS4 officially supports .so libraries. # When compiling the executable, add -use-dynld -Lsobjs: to the compileline. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; m68k) library_names_spec='$libname.ixlibrary $libname.a' # Create ${libname}_ixlibrary.a entries in /sys/libs. finish_eval='for lib in `ls $libdir/*.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" | $SED '\''s%^.*/\([[^/]]*\)\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a || exit 1; done' ;; esac ;; beos*) library_names_spec='$libname$shared_ext' dynamic_linker="$host_os ld.so" shlibpath_var=LIBRARY_PATH ;; bsdi[[45]]*) version_type=linux # correct to gnu/linux during the next big refactor need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib" sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib" # the default ld.so.conf also contains /usr/contrib/lib and # /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow # libtool to hard-code these into programs ;; cygwin* | mingw* | pw32* | cegcc*) version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no case $GCC,$cc_basename in yes,*) # gcc library_names_spec='$libname.dll.a' # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes case $host_os in cygwin*) # Cygwin DLLs use 'cyg' prefix rather than 'lib' soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' m4_if([$1], [],[ sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"]) ;; mingw* | cegcc*) # MinGW DLLs use traditional 'lib' prefix soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' ;; pw32*) # pw32 DLLs use 'pw' prefix rather than 'lib' library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' ;; esac dynamic_linker='Win32 ld.exe' ;; *,cl*) # Native MSVC libname_spec='$name' soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' library_names_spec='$libname.dll.lib' case $build_os in mingw*) sys_lib_search_path_spec= lt_save_ifs=$IFS IFS=';' for lt_path in $LIB do IFS=$lt_save_ifs # Let DOS variable expansion print the short 8.3 style file name. lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"` sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path" done IFS=$lt_save_ifs # Convert to MSYS style. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'` ;; cygwin*) # Convert to unix form, then to dos form, then back to unix form # but this time dos style (no spaces!) so that the unix form looks # like /cygdrive/c/PROGRA~1:/cygdr... sys_lib_search_path_spec=`cygpath --path --unix "$LIB"` sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null` sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` ;; *) sys_lib_search_path_spec=$LIB if $ECHO "$sys_lib_search_path_spec" | [$GREP ';[c-zC-Z]:/' >/dev/null]; then # It is most probably a Windows format PATH. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's/;/ /g'` else sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` fi # FIXME: find the short name or the path components, as spaces are # common. (e.g. "Program Files" -> "PROGRA~1") ;; esac # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes dynamic_linker='Win32 link.exe' ;; *) # Assume MSVC wrapper library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib' dynamic_linker='Win32 ld.exe' ;; esac # FIXME: first we should search . and the directory the executable is in shlibpath_var=PATH ;; darwin* | rhapsody*) dynamic_linker="$host_os dyld" version_type=darwin need_lib_prefix=no need_version=no library_names_spec='$libname$release$major$shared_ext $libname$shared_ext' soname_spec='$libname$release$major$shared_ext' shlibpath_overrides_runpath=yes shlibpath_var=DYLD_LIBRARY_PATH shrext_cmds='`test .$module = .yes && echo .so || echo .dylib`' m4_if([$1], [],[ sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib"]) sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib' ;; dgux*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; freebsd* | dragonfly*) # DragonFly does not have aout. When/if they implement a new # versioning mechanism, adjust this. if test -x /usr/bin/objformat; then objformat=`/usr/bin/objformat` else case $host_os in freebsd[[23]].*) objformat=aout ;; *) objformat=elf ;; esac fi version_type=freebsd-$objformat case $version_type in freebsd-elf*) library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' need_version=no need_lib_prefix=no ;; freebsd-*) library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' need_version=yes ;; esac shlibpath_var=LD_LIBRARY_PATH case $host_os in freebsd2.*) shlibpath_overrides_runpath=yes ;; freebsd3.[[01]]* | freebsdelf3.[[01]]*) shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; freebsd3.[[2-9]]* | freebsdelf3.[[2-9]]* | \ freebsd4.[[0-5]] | freebsdelf4.[[0-5]] | freebsd4.1.1 | freebsdelf4.1.1) shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; *) # from 4.6 on, and DragonFly shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; esac ;; haiku*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no dynamic_linker="$host_os runtime_loader" library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LIBRARY_PATH shlibpath_overrides_runpath=no sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib' hardcode_into_libs=yes ;; hpux9* | hpux10* | hpux11*) # Give a soname corresponding to the major version so that dld.sl refuses to # link against other versions. version_type=sunos need_lib_prefix=no need_version=no case $host_cpu in ia64*) shrext_cmds='.so' hardcode_into_libs=yes dynamic_linker="$host_os dld.so" shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' if test 32 = "$HPUX_IA64_MODE"; then sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib" sys_lib_dlsearch_path_spec=/usr/lib/hpux32 else sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64" sys_lib_dlsearch_path_spec=/usr/lib/hpux64 fi ;; hppa*64*) shrext_cmds='.sl' hardcode_into_libs=yes dynamic_linker="$host_os dld.sl" shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; *) shrext_cmds='.sl' dynamic_linker="$host_os dld.sl" shlibpath_var=SHLIB_PATH shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' ;; esac # HP-UX runs *really* slowly unless shared libraries are mode 555, ... postinstall_cmds='chmod 555 $lib' # or fails outright, so override atomically: install_override_mode=555 ;; interix[[3-9]]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; irix5* | irix6* | nonstopux*) case $host_os in nonstopux*) version_type=nonstopux ;; *) if test yes = "$lt_cv_prog_gnu_ld"; then version_type=linux # correct to gnu/linux during the next big refactor else version_type=irix fi ;; esac need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext' case $host_os in irix5* | nonstopux*) libsuff= shlibsuff= ;; *) case $LD in # libtool.m4 will add one of these switches to LD *-32|*"-32 "|*-melf32bsmip|*"-melf32bsmip ") libsuff= shlibsuff= libmagic=32-bit;; *-n32|*"-n32 "|*-melf32bmipn32|*"-melf32bmipn32 ") libsuff=32 shlibsuff=N32 libmagic=N32;; *-64|*"-64 "|*-melf64bmip|*"-melf64bmip ") libsuff=64 shlibsuff=64 libmagic=64-bit;; *) libsuff= shlibsuff= libmagic=never-match;; esac ;; esac shlibpath_var=LD_LIBRARY${shlibsuff}_PATH shlibpath_overrides_runpath=no sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff" sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff" hardcode_into_libs=yes ;; # No shared lib support for Linux oldld, aout, or coff. linux*oldld* | linux*aout* | linux*coff*) dynamic_linker=no ;; linux*android*) version_type=none # Android doesn't support versioned libraries. need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext' soname_spec='$libname$release$shared_ext' finish_cmds= shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes dynamic_linker='Android linker' # Don't embed -rpath directories since the linker doesn't support them. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no # Some binutils ld are patched to set DT_RUNPATH AC_CACHE_VAL([lt_cv_shlibpath_overrides_runpath], [lt_cv_shlibpath_overrides_runpath=no save_LDFLAGS=$LDFLAGS save_libdir=$libdir eval "libdir=/foo; wl=\"$_LT_TAGVAR(lt_prog_compiler_wl, $1)\"; \ LDFLAGS=\"\$LDFLAGS $_LT_TAGVAR(hardcode_libdir_flag_spec, $1)\"" AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])], [AS_IF([ ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null], [lt_cv_shlibpath_overrides_runpath=yes])]) LDFLAGS=$save_LDFLAGS libdir=$save_libdir ]) shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes # Ideally, we could use ldconfig to report *all* directores which are # searched for libraries, however this is still not possible. Aside from not # being certain /sbin/ldconfig is available, command # 'ldconfig -N -X -v | grep ^/' on 64bit Fedora does not report /usr/lib64, # even though it is searched at run-time. Try to do the best guess by # appending ld.so.conf contents (and includes) to the search path. if test -f /etc/ld.so.conf; then lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" fi # We used to test for /lib/ld.so.1 and disable shared libraries on # powerpc, because MkLinux only supported shared libraries with the # GNU dynamic linker. Since this was broken with cross compilers, # most powerpc-linux boxes support dynamic linking these days and # people can always --disable-shared, the test was removed, and we # assume the GNU/Linux dynamic linker is in use. dynamic_linker='GNU/Linux ld.so' ;; netbsdelf*-gnu) version_type=linux need_lib_prefix=no need_version=no library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}' soname_spec='${libname}${release}${shared_ext}$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='NetBSD ld.elf_so' ;; netbsd*) version_type=sunos need_lib_prefix=no need_version=no if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' dynamic_linker='NetBSD (a.out) ld.so' else library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='NetBSD ld.elf_so' fi shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; newsos6) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; *nto* | *qnx*) version_type=qnx need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='ldqnx.so' ;; openbsd* | bitrig*) version_type=sunos sys_lib_dlsearch_path_spec=/usr/lib need_lib_prefix=no if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then need_version=no else need_version=yes fi library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; os2*) libname_spec='$name' version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no # OS/2 can only load a DLL with a base name of 8 characters or less. soname_spec='`test -n "$os2dllname" && libname="$os2dllname"; v=$($ECHO $release$versuffix | tr -d .-); n=$($ECHO $libname | cut -b -$((8 - ${#v})) | tr . _); $ECHO $n$v`$shared_ext' library_names_spec='${libname}_dll.$libext' dynamic_linker='OS/2 ld.exe' shlibpath_var=BEGINLIBPATH sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' ;; osf3* | osf4* | osf5*) version_type=osf need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; rdos*) dynamic_linker=no ;; solaris*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes # ldd complains unless libraries are executable postinstall_cmds='chmod +x $lib' ;; sunos4*) version_type=sunos library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes if test yes = "$with_gnu_ld"; then need_lib_prefix=no fi need_version=yes ;; sysv4 | sysv4.3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH case $host_vendor in sni) shlibpath_overrides_runpath=no need_lib_prefix=no runpath_var=LD_RUN_PATH ;; siemens) need_lib_prefix=no ;; motorola) need_lib_prefix=no need_version=no shlibpath_overrides_runpath=no sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib' ;; esac ;; sysv4*MP*) if test -d /usr/nec; then version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext' soname_spec='$libname$shared_ext.$major' shlibpath_var=LD_LIBRARY_PATH fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) version_type=sco need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes if test yes = "$with_gnu_ld"; then sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib' else sys_lib_search_path_spec='/usr/ccs/lib /usr/lib' case $host_os in sco3.2v5*) sys_lib_search_path_spec="$sys_lib_search_path_spec /lib" ;; esac fi sys_lib_dlsearch_path_spec='/usr/lib' ;; tpf*) # TPF is a cross-target only. Preferred cross-host = GNU/Linux. version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; uts4*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; *) dynamic_linker=no ;; esac AC_MSG_RESULT([$dynamic_linker]) test no = "$dynamic_linker" && can_build_shared=no variables_saved_for_relink="PATH $shlibpath_var $runpath_var" if test yes = "$GCC"; then variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH" fi if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec fi if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec fi # remember unaugmented sys_lib_dlsearch_path content for libtool script decls... configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec # ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH" # to be used as default LT_SYS_LIBRARY_PATH value in generated libtool configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH _LT_DECL([], [variables_saved_for_relink], [1], [Variables whose values should be saved in libtool wrapper scripts and restored at link time]) _LT_DECL([], [need_lib_prefix], [0], [Do we need the "lib" prefix for modules?]) _LT_DECL([], [need_version], [0], [Do we need a version for libraries?]) _LT_DECL([], [version_type], [0], [Library versioning type]) _LT_DECL([], [runpath_var], [0], [Shared library runtime path variable]) _LT_DECL([], [shlibpath_var], [0],[Shared library path variable]) _LT_DECL([], [shlibpath_overrides_runpath], [0], [Is shlibpath searched before the hard-coded library search path?]) _LT_DECL([], [libname_spec], [1], [Format of library name prefix]) _LT_DECL([], [library_names_spec], [1], [[List of archive names. First name is the real one, the rest are links. The last name is the one that the linker finds with -lNAME]]) _LT_DECL([], [soname_spec], [1], [[The coded name of the library, if different from the real name]]) _LT_DECL([], [install_override_mode], [1], [Permission mode override for installation of shared libraries]) _LT_DECL([], [postinstall_cmds], [2], [Command to use after installation of a shared archive]) _LT_DECL([], [postuninstall_cmds], [2], [Command to use after uninstallation of a shared archive]) _LT_DECL([], [finish_cmds], [2], [Commands used to finish a libtool library installation in a directory]) _LT_DECL([], [finish_eval], [1], [[As "finish_cmds", except a single script fragment to be evaled but not shown]]) _LT_DECL([], [hardcode_into_libs], [0], [Whether we should hardcode library paths into libraries]) _LT_DECL([], [sys_lib_search_path_spec], [2], [Compile-time system search path for libraries]) _LT_DECL([sys_lib_dlsearch_path_spec], [configure_time_dlsearch_path], [2], [Detected run-time system search path for libraries]) _LT_DECL([], [configure_time_lt_sys_library_path], [2], [Explicit LT_SYS_LIBRARY_PATH set during ./configure time]) ])# _LT_SYS_DYNAMIC_LINKER # _LT_PATH_TOOL_PREFIX(TOOL) # -------------------------- # find a file program that can recognize shared library AC_DEFUN([_LT_PATH_TOOL_PREFIX], [m4_require([_LT_DECL_EGREP])dnl AC_MSG_CHECKING([for $1]) AC_CACHE_VAL(lt_cv_path_MAGIC_CMD, [case $MAGIC_CMD in [[\\/*] | ?:[\\/]*]) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR dnl $ac_dummy forces splitting on constant user-supplied paths. dnl POSIX.2 word splitting is done only on the output of word expansions, dnl not every word. This closes a longstanding sh security hole. ac_dummy="m4_if([$2], , $PATH, [$2])" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$1"; then lt_cv_path_MAGIC_CMD=$ac_dir/"$1" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac]) MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then AC_MSG_RESULT($MAGIC_CMD) else AC_MSG_RESULT(no) fi _LT_DECL([], [MAGIC_CMD], [0], [Used to examine libraries when file_magic_cmd begins with "file"])dnl ])# _LT_PATH_TOOL_PREFIX # Old name: AU_ALIAS([AC_PATH_TOOL_PREFIX], [_LT_PATH_TOOL_PREFIX]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_PATH_TOOL_PREFIX], []) # _LT_PATH_MAGIC # -------------- # find a file program that can recognize a shared library m4_defun([_LT_PATH_MAGIC], [_LT_PATH_TOOL_PREFIX(${ac_tool_prefix}file, /usr/bin$PATH_SEPARATOR$PATH) if test -z "$lt_cv_path_MAGIC_CMD"; then if test -n "$ac_tool_prefix"; then _LT_PATH_TOOL_PREFIX(file, /usr/bin$PATH_SEPARATOR$PATH) else MAGIC_CMD=: fi fi ])# _LT_PATH_MAGIC # LT_PATH_LD # ---------- # find the pathname to the GNU or non-GNU linker AC_DEFUN([LT_PATH_LD], [AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_PROG_ECHO_BACKSLASH])dnl AC_ARG_WITH([gnu-ld], [AS_HELP_STRING([--with-gnu-ld], [assume the C compiler uses GNU ld @<:@default=no@:>@])], [test no = "$withval" || with_gnu_ld=yes], [with_gnu_ld=no])dnl ac_prog=ld if test yes = "$GCC"; then # Check if gcc -print-prog-name=ld gives a path. AC_MSG_CHECKING([for ld used by $CC]) case $host in *-*-mingw*) # gcc leaves a trailing carriage return, which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [[\\/]]* | ?:[[\\/]]*) re_direlt='/[[^/]][[^/]]*/\.\./' # Canonicalize the pathname of ld ac_prog=`$ECHO "$ac_prog"| $SED 's%\\\\%/%g'` while $ECHO "$ac_prog" | $GREP "$re_direlt" > /dev/null 2>&1; do ac_prog=`$ECHO $ac_prog| $SED "s%$re_direlt%/%"` done test -z "$LD" && LD=$ac_prog ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test yes = "$with_gnu_ld"; then AC_MSG_CHECKING([for GNU ld]) else AC_MSG_CHECKING([for non-GNU ld]) fi AC_CACHE_VAL(lt_cv_path_LD, [if test -z "$LD"; then lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then lt_cv_path_LD=$ac_dir/$ac_prog # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some variants of GNU ld only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$lt_cv_path_LD" -v 2>&1 &1 conftest.i cat conftest.i conftest.i >conftest2.i : ${lt_DD:=$DD} AC_PATH_PROGS_FEATURE_CHECK([lt_DD], [dd], [if "$ac_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=: fi]) rm -f conftest.i conftest2.i conftest.out]) ])# _LT_PATH_DD # _LT_CMD_TRUNCATE # ---------------- # find command to truncate a binary pipe m4_defun([_LT_CMD_TRUNCATE], [m4_require([_LT_PATH_DD]) AC_CACHE_CHECK([how to truncate binary pipes], [lt_cv_truncate_bin], [printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i lt_cv_truncate_bin= if "$ac_cv_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1" fi rm -f conftest.i conftest2.i conftest.out test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"]) _LT_DECL([lt_truncate_bin], [lt_cv_truncate_bin], [1], [Command to truncate a binary pipe]) ])# _LT_CMD_TRUNCATE # _LT_CHECK_MAGIC_METHOD # ---------------------- # how to check for library dependencies # -- PORTME fill in with the dynamic library characteristics m4_defun([_LT_CHECK_MAGIC_METHOD], [m4_require([_LT_DECL_EGREP]) m4_require([_LT_DECL_OBJDUMP]) AC_CACHE_CHECK([how to recognize dependent libraries], lt_cv_deplibs_check_method, [lt_cv_file_magic_cmd='$MAGIC_CMD' lt_cv_file_magic_test_file= lt_cv_deplibs_check_method='unknown' # Need to set the preceding variable on all platforms that support # interlibrary dependencies. # 'none' -- dependencies not supported. # 'unknown' -- same as none, but documents that we really don't know. # 'pass_all' -- all dependencies passed with no checks. # 'test_compile' -- check by making test program. # 'file_magic [[regex]]' -- check by looking for files in library path # that responds to the $file_magic_cmd with a given extended regex. # If you have 'file' or equivalent on your system and you're not sure # whether 'pass_all' will *always* work, you probably want this one. case $host_os in aix[[4-9]]*) lt_cv_deplibs_check_method=pass_all ;; beos*) lt_cv_deplibs_check_method=pass_all ;; bsdi[[45]]*) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)' lt_cv_file_magic_cmd='/usr/bin/file -L' lt_cv_file_magic_test_file=/shlib/libc.so ;; cygwin*) # func_win32_libid is a shell function defined in ltmain.sh lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' ;; mingw* | pw32*) # Base MSYS/MinGW do not provide the 'file' command needed by # func_win32_libid shell function, so use a weaker test based on 'objdump', # unless we find 'file', for example because we are cross-compiling. if ( file / ) >/dev/null 2>&1; then lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' else # Keep this pattern in sync with the one in func_win32_libid. lt_cv_deplibs_check_method='file_magic file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' lt_cv_file_magic_cmd='$OBJDUMP -f' fi ;; cegcc*) # use the weaker test based on 'objdump'. See mingw*. lt_cv_deplibs_check_method='file_magic file format pe-arm-.*little(.*architecture: arm)?' lt_cv_file_magic_cmd='$OBJDUMP -f' ;; darwin* | rhapsody*) lt_cv_deplibs_check_method=pass_all ;; freebsd* | dragonfly*) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then case $host_cpu in i*86 ) # Not sure whether the presence of OpenBSD here was a mistake. # Let's accept both of them until this is cleared up. lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*` ;; esac else lt_cv_deplibs_check_method=pass_all fi ;; haiku*) lt_cv_deplibs_check_method=pass_all ;; hpux10.20* | hpux11*) lt_cv_file_magic_cmd=/usr/bin/file case $host_cpu in ia64*) lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64' lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so ;; hppa*64*) [lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]'] lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl ;; *) lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|PA-RISC[[0-9]]\.[[0-9]]) shared library' lt_cv_file_magic_test_file=/usr/lib/libc.sl ;; esac ;; interix[[3-9]]*) # PIC code is broken on Interix 3.x, that's why |\.a not |_pic\.a here lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so|\.a)$' ;; irix5* | irix6* | nonstopux*) case $LD in *-32|*"-32 ") libmagic=32-bit;; *-n32|*"-n32 ") libmagic=N32;; *-64|*"-64 ") libmagic=64-bit;; *) libmagic=never-match;; esac lt_cv_deplibs_check_method=pass_all ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) lt_cv_deplibs_check_method=pass_all ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so|_pic\.a)$' fi ;; newos6*) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=/usr/lib/libnls.so ;; *nto* | *qnx*) lt_cv_deplibs_check_method=pass_all ;; openbsd* | bitrig*) if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|\.so|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$' fi ;; osf3* | osf4* | osf5*) lt_cv_deplibs_check_method=pass_all ;; rdos*) lt_cv_deplibs_check_method=pass_all ;; solaris*) lt_cv_deplibs_check_method=pass_all ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) lt_cv_deplibs_check_method=pass_all ;; sysv4 | sysv4.3*) case $host_vendor in motorola) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib) M[[0-9]][[0-9]]* Version [[0-9]]' lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*` ;; ncr) lt_cv_deplibs_check_method=pass_all ;; sequent) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB (shared object|dynamic lib )' ;; sni) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method="file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB dynamic lib" lt_cv_file_magic_test_file=/lib/libc.so ;; siemens) lt_cv_deplibs_check_method=pass_all ;; pc) lt_cv_deplibs_check_method=pass_all ;; esac ;; tpf*) lt_cv_deplibs_check_method=pass_all ;; os2*) lt_cv_deplibs_check_method=pass_all ;; esac ]) file_magic_glob= want_nocaseglob=no if test "$build" = "$host"; then case $host_os in mingw* | pw32*) if ( shopt | grep nocaseglob ) >/dev/null 2>&1; then want_nocaseglob=yes else file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ | $SED -e "s/\(..\)/s\/[[\1]]\/[[\1]]\/g;/g"` fi ;; esac fi file_magic_cmd=$lt_cv_file_magic_cmd deplibs_check_method=$lt_cv_deplibs_check_method test -z "$deplibs_check_method" && deplibs_check_method=unknown _LT_DECL([], [deplibs_check_method], [1], [Method to check whether dependent libraries are shared objects]) _LT_DECL([], [file_magic_cmd], [1], [Command to use when deplibs_check_method = "file_magic"]) _LT_DECL([], [file_magic_glob], [1], [How to find potential files when deplibs_check_method = "file_magic"]) _LT_DECL([], [want_nocaseglob], [1], [Find potential files using nocaseglob when deplibs_check_method = "file_magic"]) ])# _LT_CHECK_MAGIC_METHOD # LT_PATH_NM # ---------- # find the pathname to a BSD- or MS-compatible name lister AC_DEFUN([LT_PATH_NM], [AC_REQUIRE([AC_PROG_CC])dnl AC_CACHE_CHECK([for BSD- or MS-compatible name lister (nm)], lt_cv_path_NM, [if test -n "$NM"; then # Let the user override the test. lt_cv_path_NM=$NM else lt_nm_to_check=${ac_tool_prefix}nm if test -n "$ac_tool_prefix" && test "$build" = "$host"; then lt_nm_to_check="$lt_nm_to_check nm" fi for lt_tmp_nm in $lt_nm_to_check; do lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. tmp_nm=$ac_dir/$lt_tmp_nm if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext"; then # Check to see if the nm accepts a BSD-compat flag. # Adding the 'sed 1q' prevents false positives on HP-UX, which says: # nm: unknown option "B" ignored # Tru64's nm complains that /dev/null is an invalid object file # MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty case $build_os in mingw*) lt_bad_file=conftest.nm/nofile ;; *) lt_bad_file=/dev/null ;; esac case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in *$lt_bad_file* | *'Invalid file or object type'*) lt_cv_path_NM="$tmp_nm -B" break 2 ;; *) case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in */dev/null*) lt_cv_path_NM="$tmp_nm -p" break 2 ;; *) lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but continue # so that we can try to find one that supports BSD flags ;; esac ;; esac fi done IFS=$lt_save_ifs done : ${lt_cv_path_NM=no} fi]) if test no != "$lt_cv_path_NM"; then NM=$lt_cv_path_NM else # Didn't find any BSD compatible name lister, look for dumpbin. if test -n "$DUMPBIN"; then : # Let the user override the test. else AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :) case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in *COFF*) DUMPBIN="$DUMPBIN -symbols -headers" ;; *) DUMPBIN=: ;; esac fi AC_SUBST([DUMPBIN]) if test : != "$DUMPBIN"; then NM=$DUMPBIN fi fi test -z "$NM" && NM=nm AC_SUBST([NM]) _LT_DECL([], [NM], [1], [A BSD- or MS-compatible name lister])dnl AC_CACHE_CHECK([the name lister ($NM) interface], [lt_cv_nm_interface], [lt_cv_nm_interface="BSD nm" echo "int some_variable = 0;" > conftest.$ac_ext (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&AS_MESSAGE_LOG_FD (eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&AS_MESSAGE_LOG_FD) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&AS_MESSAGE_LOG_FD (eval echo "\"\$as_me:$LINENO: output\"" >&AS_MESSAGE_LOG_FD) cat conftest.out >&AS_MESSAGE_LOG_FD if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" fi rm -f conftest*]) ])# LT_PATH_NM # Old names: AU_ALIAS([AM_PROG_NM], [LT_PATH_NM]) AU_ALIAS([AC_PROG_NM], [LT_PATH_NM]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_PROG_NM], []) dnl AC_DEFUN([AC_PROG_NM], []) # _LT_CHECK_SHAREDLIB_FROM_LINKLIB # -------------------------------- # how to determine the name of the shared library # associated with a specific link library. # -- PORTME fill in with the dynamic library characteristics m4_defun([_LT_CHECK_SHAREDLIB_FROM_LINKLIB], [m4_require([_LT_DECL_EGREP]) m4_require([_LT_DECL_OBJDUMP]) m4_require([_LT_DECL_DLLTOOL]) AC_CACHE_CHECK([how to associate runtime and link libraries], lt_cv_sharedlib_from_linklib_cmd, [lt_cv_sharedlib_from_linklib_cmd='unknown' case $host_os in cygwin* | mingw* | pw32* | cegcc*) # two different shell functions defined in ltmain.sh; # decide which one to use based on capabilities of $DLLTOOL case `$DLLTOOL --help 2>&1` in *--identify-strict*) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib ;; *) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback ;; esac ;; *) # fallback: assume linklib IS sharedlib lt_cv_sharedlib_from_linklib_cmd=$ECHO ;; esac ]) sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO _LT_DECL([], [sharedlib_from_linklib_cmd], [1], [Command to associate shared and link libraries]) ])# _LT_CHECK_SHAREDLIB_FROM_LINKLIB # _LT_PATH_MANIFEST_TOOL # ---------------------- # locate the manifest tool m4_defun([_LT_PATH_MANIFEST_TOOL], [AC_CHECK_TOOL(MANIFEST_TOOL, mt, :) test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt AC_CACHE_CHECK([if $MANIFEST_TOOL is a manifest tool], [lt_cv_path_mainfest_tool], [lt_cv_path_mainfest_tool=no echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&AS_MESSAGE_LOG_FD $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out cat conftest.err >&AS_MESSAGE_LOG_FD if $GREP 'Manifest Tool' conftest.out > /dev/null; then lt_cv_path_mainfest_tool=yes fi rm -f conftest*]) if test yes != "$lt_cv_path_mainfest_tool"; then MANIFEST_TOOL=: fi _LT_DECL([], [MANIFEST_TOOL], [1], [Manifest tool])dnl ])# _LT_PATH_MANIFEST_TOOL # _LT_DLL_DEF_P([FILE]) # --------------------- # True iff FILE is a Windows DLL '.def' file. # Keep in sync with func_dll_def_p in the libtool script AC_DEFUN([_LT_DLL_DEF_P], [dnl test DEF = "`$SED -n dnl -e '\''s/^[[ ]]*//'\'' dnl Strip leading whitespace -e '\''/^\(;.*\)*$/d'\'' dnl Delete empty lines and comments -e '\''s/^\(EXPORTS\|LIBRARY\)\([[ ]].*\)*$/DEF/p'\'' dnl -e q dnl Only consider the first "real" line $1`" dnl ])# _LT_DLL_DEF_P # LT_LIB_M # -------- # check for math library AC_DEFUN([LT_LIB_M], [AC_REQUIRE([AC_CANONICAL_HOST])dnl LIBM= case $host in *-*-beos* | *-*-cegcc* | *-*-cygwin* | *-*-haiku* | *-*-pw32* | *-*-darwin*) # These system don't have libm, or don't need it ;; *-ncr-sysv4.3*) AC_CHECK_LIB(mw, _mwvalidcheckl, LIBM=-lmw) AC_CHECK_LIB(m, cos, LIBM="$LIBM -lm") ;; *) AC_CHECK_LIB(m, cos, LIBM=-lm) ;; esac AC_SUBST([LIBM]) ])# LT_LIB_M # Old name: AU_ALIAS([AC_CHECK_LIBM], [LT_LIB_M]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_CHECK_LIBM], []) # _LT_COMPILER_NO_RTTI([TAGNAME]) # ------------------------------- m4_defun([_LT_COMPILER_NO_RTTI], [m4_require([_LT_TAG_COMPILER])dnl _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)= if test yes = "$GCC"; then case $cc_basename in nvcc*) _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -Xcompiler -fno-builtin' ;; *) _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin' ;; esac _LT_COMPILER_OPTION([if $compiler supports -fno-rtti -fno-exceptions], lt_cv_prog_compiler_rtti_exceptions, [-fno-rtti -fno-exceptions], [], [_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)="$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1) -fno-rtti -fno-exceptions"]) fi _LT_TAGDECL([no_builtin_flag], [lt_prog_compiler_no_builtin_flag], [1], [Compiler flag to turn off builtin functions]) ])# _LT_COMPILER_NO_RTTI # _LT_CMD_GLOBAL_SYMBOLS # ---------------------- m4_defun([_LT_CMD_GLOBAL_SYMBOLS], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([AC_PROG_AWK])dnl AC_REQUIRE([LT_PATH_NM])dnl AC_REQUIRE([LT_PATH_LD])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_TAG_COMPILER])dnl # Check for command to grab the raw symbol name followed by C symbol from nm. AC_MSG_CHECKING([command to parse $NM output from $compiler object]) AC_CACHE_VAL([lt_cv_sys_global_symbol_pipe], [ # These are sane defaults that work on at least a few old systems. # [They come from Ultrix. What could be older than Ultrix?!! ;)] # Character class describing NM global symbol codes. symcode='[[BCDEGRST]]' # Regexp to match symbols that can be accessed directly from C. sympat='\([[_A-Za-z]][[_A-Za-z0-9]]*\)' # Define system-specific variables. case $host_os in aix*) symcode='[[BCDT]]' ;; cygwin* | mingw* | pw32* | cegcc*) symcode='[[ABCDGISTW]]' ;; hpux*) if test ia64 = "$host_cpu"; then symcode='[[ABCDEGRST]]' fi ;; irix* | nonstopux*) symcode='[[BCDEGRST]]' ;; osf*) symcode='[[BCDEGQRST]]' ;; solaris*) symcode='[[BDRT]]' ;; sco3.2v5*) symcode='[[DT]]' ;; sysv4.2uw2*) symcode='[[DT]]' ;; sysv5* | sco5v6* | unixware* | OpenUNIX*) symcode='[[ABDT]]' ;; sysv4) symcode='[[DFNSTU]]' ;; esac # If we're using GNU nm, then use its standard symbol codes. case `$NM -V 2>&1` in *GNU* | *'with BFD'*) symcode='[[ABCDGIRSTW]]' ;; esac if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Gets list of data symbols to import. lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'" # Adjust the below global symbol transforms to fixup imported variables. lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'" lt_c_name_hook=" -e 's/^I .* \(.*\)$/ {\"\1\", (void *) 0},/p'" lt_c_name_lib_hook="\ -e 's/^I .* \(lib.*\)$/ {\"\1\", (void *) 0},/p'\ -e 's/^I .* \(.*\)$/ {\"lib\1\", (void *) 0},/p'" else # Disable hooks by default. lt_cv_sys_global_symbol_to_import= lt_cdecl_hook= lt_c_name_hook= lt_c_name_lib_hook= fi # Transform an extracted symbol line into a proper C declaration. # Some systems (esp. on ia64) link data and code symbols differently, # so use this general approach. lt_cv_sys_global_symbol_to_cdecl="sed -n"\ $lt_cdecl_hook\ " -e 's/^T .* \(.*\)$/extern int \1();/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'" # Transform an extracted symbol line into symbol name and symbol address lt_cv_sys_global_symbol_to_c_name_address="sed -n"\ $lt_c_name_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/p'" # Transform an extracted symbol line into symbol name with lib prefix and # symbol address. lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\ $lt_c_name_lib_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(lib.*\)$/ {\"\1\", (void *) \&\1},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"lib\1\", (void *) \&\1},/p'" # Handle CRLF in mingw tool chain opt_cr= case $build_os in mingw*) opt_cr=`$ECHO 'x\{0,1\}' | tr x '\015'` # option cr in regexp ;; esac # Try without a prefix underscore, then with it. for ac_symprfx in "" "_"; do # Transform symcode, sympat, and symprfx into a raw symbol and a C symbol. symxfrm="\\1 $ac_symprfx\\2 \\2" # Write the raw and C identifiers. if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Fake it for dumpbin and say T for any non-static function, # D for any global variable and I for any imported variable. # Also find C++ and __fastcall symbols from MSVC++, # which start with @ or ?. lt_cv_sys_global_symbol_pipe="$AWK ['"\ " {last_section=section; section=\$ 3};"\ " /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\ " /Section length .*#relocs.*(pick any)/{hide[last_section]=1};"\ " /^ *Symbol name *: /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\ " /^ *Type *: code/{print \"T\",si,substr(si,length(prfx))};"\ " /^ *Type *: data/{print \"I\",si,substr(si,length(prfx))};"\ " \$ 0!~/External *\|/{next};"\ " / 0+ UNDEF /{next}; / UNDEF \([^|]\)*()/{next};"\ " {if(hide[section]) next};"\ " {f=\"D\"}; \$ 0~/\(\).*\|/{f=\"T\"};"\ " {split(\$ 0,a,/\||\r/); split(a[2],s)};"\ " s[1]~/^[@?]/{print f,s[1],s[1]; next};"\ " s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\ " ' prfx=^$ac_symprfx]" else lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[ ]]\($symcode$symcode*\)[[ ]][[ ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'" fi lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'" # Check to see that the pipe works correctly. pipe_works=no rm -f conftest* cat > conftest.$ac_ext <<_LT_EOF #ifdef __cplusplus extern "C" { #endif char nm_test_var; void nm_test_func(void); void nm_test_func(void){} #ifdef __cplusplus } #endif int main(){nm_test_var='a';nm_test_func();return(0);} _LT_EOF if AC_TRY_EVAL(ac_compile); then # Now try to grab the symbols. nlist=conftest.nm if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then # Try sorting and uniquifying the output. if sort "$nlist" | uniq > "$nlist"T; then mv -f "$nlist"T "$nlist" else rm -f "$nlist"T fi # Make sure that we snagged all the symbols we need. if $GREP ' nm_test_var$' "$nlist" >/dev/null; then if $GREP ' nm_test_func$' "$nlist" >/dev/null; then cat <<_LT_EOF > conftest.$ac_ext /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT@&t@_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT@&t@_DLSYM_CONST #else # define LT@&t@_DLSYM_CONST const #endif #ifdef __cplusplus extern "C" { #endif _LT_EOF # Now generate the symbol file. eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" | $GREP -v main >> conftest.$ac_ext' cat <<_LT_EOF >> conftest.$ac_ext /* The mapping between symbol names and symbols. */ LT@&t@_DLSYM_CONST struct { const char *name; void *address; } lt__PROGRAM__LTX_preloaded_symbols[[]] = { { "@PROGRAM@", (void *) 0 }, _LT_EOF $SED "s/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/" < "$nlist" | $GREP -v main >> conftest.$ac_ext cat <<\_LT_EOF >> conftest.$ac_ext {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt__PROGRAM__LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif _LT_EOF # Now try linking the two files. mv conftest.$ac_objext conftstm.$ac_objext lt_globsym_save_LIBS=$LIBS lt_globsym_save_CFLAGS=$CFLAGS LIBS=conftstm.$ac_objext CFLAGS="$CFLAGS$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)" if AC_TRY_EVAL(ac_link) && test -s conftest$ac_exeext; then pipe_works=yes fi LIBS=$lt_globsym_save_LIBS CFLAGS=$lt_globsym_save_CFLAGS else echo "cannot find nm_test_func in $nlist" >&AS_MESSAGE_LOG_FD fi else echo "cannot find nm_test_var in $nlist" >&AS_MESSAGE_LOG_FD fi else echo "cannot run $lt_cv_sys_global_symbol_pipe" >&AS_MESSAGE_LOG_FD fi else echo "$progname: failed program was:" >&AS_MESSAGE_LOG_FD cat conftest.$ac_ext >&5 fi rm -rf conftest* conftst* # Do not use the global_symbol_pipe unless it works. if test yes = "$pipe_works"; then break else lt_cv_sys_global_symbol_pipe= fi done ]) if test -z "$lt_cv_sys_global_symbol_pipe"; then lt_cv_sys_global_symbol_to_cdecl= fi if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then AC_MSG_RESULT(failed) else AC_MSG_RESULT(ok) fi # Response file support. if test "$lt_cv_nm_interface" = "MS dumpbin"; then nm_file_list_spec='@' elif $NM --help 2>/dev/null | grep '[[@]]FILE' >/dev/null; then nm_file_list_spec='@' fi _LT_DECL([global_symbol_pipe], [lt_cv_sys_global_symbol_pipe], [1], [Take the output of nm and produce a listing of raw symbols and C names]) _LT_DECL([global_symbol_to_cdecl], [lt_cv_sys_global_symbol_to_cdecl], [1], [Transform the output of nm in a proper C declaration]) _LT_DECL([global_symbol_to_import], [lt_cv_sys_global_symbol_to_import], [1], [Transform the output of nm into a list of symbols to manually relocate]) _LT_DECL([global_symbol_to_c_name_address], [lt_cv_sys_global_symbol_to_c_name_address], [1], [Transform the output of nm in a C name address pair]) _LT_DECL([global_symbol_to_c_name_address_lib_prefix], [lt_cv_sys_global_symbol_to_c_name_address_lib_prefix], [1], [Transform the output of nm in a C name address pair when lib prefix is needed]) _LT_DECL([nm_interface], [lt_cv_nm_interface], [1], [The name lister interface]) _LT_DECL([], [nm_file_list_spec], [1], [Specify filename containing input files for $NM]) ]) # _LT_CMD_GLOBAL_SYMBOLS # _LT_COMPILER_PIC([TAGNAME]) # --------------------------- m4_defun([_LT_COMPILER_PIC], [m4_require([_LT_TAG_COMPILER])dnl _LT_TAGVAR(lt_prog_compiler_wl, $1)= _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)= m4_if([$1], [CXX], [ # C++ specific cases for pic, static, wl, etc. if test yes = "$GXX"; then _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' ;; *djgpp*) # DJGPP does not support shared libraries at all _LT_TAGVAR(lt_prog_compiler_pic, $1)= ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. _LT_TAGVAR(lt_prog_compiler_static, $1)= ;; interix[[3-9]]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic fi ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac else case $host_os in aix[[4-9]]*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' else _LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp' fi ;; chorus*) case $cc_basename in cxch68*) # Green Hills C++ Compiler # _LT_TAGVAR(lt_prog_compiler_static, $1)="--no_auto_instantiation -u __main -u __premain -u _abort -r $COOL_DIR/lib/libOrb.a $MVME_DIR/lib/CC/libC.a $MVME_DIR/lib/classix/libcx.s.a" ;; esac ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) ;; dgux*) case $cc_basename in ec++*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' ;; ghcx*) # Green Hills C++ Compiler _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; *) ;; esac ;; freebsd* | dragonfly*) # FreeBSD uses GNU C++ ;; hpux9* | hpux10* | hpux11*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' if test ia64 != "$host_cpu"; then _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' fi ;; aCC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' ;; esac ;; *) ;; esac ;; interix*) # This is c89, which is MS Visual C++ (no shared libs) # Anyone wants to do a port? ;; irix5* | irix6* | nonstopux*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' # CC pic flag -KPIC is the default. ;; *) ;; esac ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # KAI C++ Compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; ecpc* ) # old Intel C++ for x86_64, which still supported -KPIC. _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; icpc* ) # Intel C++, used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; pgCC* | pgcpp*) # Portland Group C++ compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; cxx*) # Compaq C++ # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; xlc* | xlC* | bgxl[[cC]]* | mpixl[[cC]]*) # IBM XL 8.0, 9.0 on PPC and BlueGene _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; esac ;; esac ;; lynxos*) ;; m88k*) ;; mvs*) case $cc_basename in cxx*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-W c,exportall' ;; *) ;; esac ;; netbsd* | netbsdelf*-gnu) ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,' ;; RCC*) # Rational C++ 2.4.1 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; cxx*) # Digital/Compaq C++ _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; *) ;; esac ;; psos*) ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; gcx*) # Green Hills C++ Compiler _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' ;; *) ;; esac ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; lcc*) # Lucid _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; *) ;; esac ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' ;; *) ;; esac ;; vxworks*) ;; *) _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; esac fi ], [ if test yes = "$GCC"; then _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. _LT_TAGVAR(lt_prog_compiler_static, $1)= ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac ;; interix[[3-9]]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; msdosdjgpp*) # Just because we use GCC doesn't mean we suddenly get shared libraries # on systems that don't support them. _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no enable_shared=no ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic fi ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac case $cc_basename in nvcc*) # Cuda Compiler Driver 2.2 _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Xlinker ' if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then _LT_TAGVAR(lt_prog_compiler_pic, $1)="-Xcompiler $_LT_TAGVAR(lt_prog_compiler_pic, $1)" fi ;; esac else # PORTME Check for flag to pass linker flags through the system compiler. case $host_os in aix*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' else _LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp' fi ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' case $cc_basename in nagfor*) # NAG Fortran compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; hpux9* | hpux10* | hpux11*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # PIC is the default for IA64 HP-UX and 64-bit HP-UX, but # not for PA HP-UX. case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' ;; esac # Is there a better lt_prog_compiler_static that works with the bundled CC? _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' ;; irix5* | irix6* | nonstopux*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # PIC (with -KPIC) is the default. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in # old Intel for x86_64, which still supported -KPIC. ecc*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; # icc used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. icc* | ifort*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; # Lahey Fortran 8.1. lf95*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='--shared' _LT_TAGVAR(lt_prog_compiler_static, $1)='--static' ;; nagfor*) # NAG Fortran compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; tcc*) # Fabrice Bellard et al's Tiny C Compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; pgcc* | pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group compilers (*not* the Pentium gcc compiler, # which looks to be a dead project) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; ccc*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # All Alpha code is PIC. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; xl* | bgxl* | bgf* | mpixl*) # IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*) # Sun Fortran 8.3 passes all unrecognized flags to the linker _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='' ;; *Sun\ F* | *Sun*Fortran*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; *Sun\ C*) # Sun C 5.9 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' ;; *Intel*\ [[CF]]*Compiler*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; *Portland\ Group*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; esac ;; newsos6) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; osf3* | osf4* | osf5*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # All OSF/1 code is PIC. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; rdos*) _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; solaris*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' case $cc_basename in f77* | f90* | f95* | sunf77* | sunf90* | sunf95*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ';; *) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,';; esac ;; sunos4*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; sysv4 | sysv4.2uw2* | sysv4.3*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)='-Kconform_pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; unicos*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; uts4*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; *) _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; esac fi ]) case $host_os in # For platforms that do not support PIC, -DPIC is meaningless: *djgpp*) _LT_TAGVAR(lt_prog_compiler_pic, $1)= ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)="$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])" ;; esac AC_CACHE_CHECK([for $compiler option to produce PIC], [_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)], [_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_prog_compiler_pic, $1)]) _LT_TAGVAR(lt_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_cv_prog_compiler_pic, $1) # # Check to make sure the PIC flag actually works. # if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then _LT_COMPILER_OPTION([if $compiler PIC flag $_LT_TAGVAR(lt_prog_compiler_pic, $1) works], [_LT_TAGVAR(lt_cv_prog_compiler_pic_works, $1)], [$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])], [], [case $_LT_TAGVAR(lt_prog_compiler_pic, $1) in "" | " "*) ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)=" $_LT_TAGVAR(lt_prog_compiler_pic, $1)" ;; esac], [_LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no]) fi _LT_TAGDECL([pic_flag], [lt_prog_compiler_pic], [1], [Additional compiler flags for building library objects]) _LT_TAGDECL([wl], [lt_prog_compiler_wl], [1], [How to pass a linker flag through the compiler]) # # Check to make sure the static flag actually works. # wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1) eval lt_tmp_static_flag=\"$_LT_TAGVAR(lt_prog_compiler_static, $1)\" _LT_LINKER_OPTION([if $compiler static flag $lt_tmp_static_flag works], _LT_TAGVAR(lt_cv_prog_compiler_static_works, $1), $lt_tmp_static_flag, [], [_LT_TAGVAR(lt_prog_compiler_static, $1)=]) _LT_TAGDECL([link_static_flag], [lt_prog_compiler_static], [1], [Compiler flag to prevent dynamic linking]) ])# _LT_COMPILER_PIC # _LT_LINKER_SHLIBS([TAGNAME]) # ---------------------------- # See if the linker supports building shared libraries. m4_defun([_LT_LINKER_SHLIBS], [AC_REQUIRE([LT_PATH_LD])dnl AC_REQUIRE([LT_PATH_NM])dnl m4_require([_LT_PATH_MANIFEST_TOOL])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl m4_require([_LT_TAG_COMPILER])dnl AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries]) m4_if([$1], [CXX], [ _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*'] case $host_os in aix[[4-9]]*) # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi ;; pw32*) _LT_TAGVAR(export_symbols_cmds, $1)=$ltdll_cmds ;; cygwin* | mingw* | cegcc*) case $cc_basename in cl*) _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' ;; *) _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1 DATA/;s/^.*[[ ]]__nm__\([[^ ]]*\)[[ ]][[^ ]]*/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname'] ;; esac ;; linux* | k*bsd*-gnu | gnu*) _LT_TAGVAR(link_all_deplibs, $1)=no ;; *) _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' ;; esac ], [ runpath_var= _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_cmds, $1)= _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(compiler_needs_object, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(old_archive_from_new_cmds, $1)= _LT_TAGVAR(old_archive_from_expsyms_cmds, $1)= _LT_TAGVAR(thread_safe_flag_spec, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= # include_expsyms should be a list of space-separated symbols to be *always* # included in the symbol list _LT_TAGVAR(include_expsyms, $1)= # exclude_expsyms can be an extended regexp of symbols to exclude # it will be wrapped by ' (' and ')$', so one must not match beginning or # end of line. Example: 'a|bc|.*d.*' will exclude the symbols 'a' and 'bc', # as well as any symbol that contains 'd'. _LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*'] # Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out # platforms (ab)use it in PIC code, but their linkers get confused if # the symbol is explicitly referenced. Since portable code cannot # rely on this symbol name, it's probably fine to never include it in # preloaded symbol tables. # Exclude shared library initialization/finalization symbols. dnl Note also adjust exclude_expsyms for C++ above. extract_expsyms_cmds= case $host_os in cygwin* | mingw* | pw32* | cegcc*) # FIXME: the MSVC++ port hasn't been tested in a loooong time # When not using gcc, we currently assume that we are using # Microsoft Visual C++. if test yes != "$GCC"; then with_gnu_ld=no fi ;; interix*) # we just hope/assume this is gcc and not c89 (= MSVC++) with_gnu_ld=yes ;; openbsd* | bitrig*) with_gnu_ld=no ;; linux* | k*bsd*-gnu | gnu*) _LT_TAGVAR(link_all_deplibs, $1)=no ;; esac _LT_TAGVAR(ld_shlibs, $1)=yes # On some targets, GNU ld is compatible enough with the native linker # that we're better off using the native interface for both. lt_use_gnu_ld_interface=no if test yes = "$with_gnu_ld"; then case $host_os in aix*) # The AIX port of GNU ld has always aspired to compatibility # with the native linker. However, as the warning in the GNU ld # block says, versions before 2.19.5* couldn't really create working # shared libraries, regardless of the interface used. case `$LD -v 2>&1` in *\ \(GNU\ Binutils\)\ 2.19.5*) ;; *\ \(GNU\ Binutils\)\ 2.[[2-9]]*) ;; *\ \(GNU\ Binutils\)\ [[3-9]]*) ;; *) lt_use_gnu_ld_interface=yes ;; esac ;; *) lt_use_gnu_ld_interface=yes ;; esac fi if test yes = "$lt_use_gnu_ld_interface"; then # If archive_cmds runs LD, not CC, wlarc should be empty wlarc='$wl' # Set some defaults for GNU ld with shared library support. These # are reset later if shared libraries are not supported. Putting them # here allows them to be overridden if necessary. runpath_var=LD_RUN_PATH _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # ancient GNU ld didn't support --whole-archive et. al. if $LD --help 2>&1 | $GREP 'no-whole-archive' > /dev/null; then _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else _LT_TAGVAR(whole_archive_flag_spec, $1)= fi supports_anon_versioning=no case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in *GNU\ gold*) supports_anon_versioning=yes ;; *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11 *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ... *\ 2.11.92.0.12\ *) supports_anon_versioning=yes ;; # Mandrake 8.2 ... *\ 2.11.*) ;; # other 2.11 versions *) supports_anon_versioning=yes ;; esac # See if GNU ld supports shared libraries. case $host_os in aix[[3-9]]*) # On AIX/PPC, the GNU linker is very broken if test ia64 != "$host_cpu"; then _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: the GNU linker, at least up to release 2.19, is reported *** to be unable to reliably create shared libraries on AIX. *** Therefore, libtool is disabling shared libraries support. If you *** really care for shared libraries, you may want to install binutils *** 2.20 or above, or modify your PATH so that a non-GNU linker is found. *** You will then need to restart the configuration process. _LT_EOF fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='' ;; m68k) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME _LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; cygwin* | mingw* | pw32* | cegcc*) # _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless, # as there is no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1 DATA/;s/^.*[[ ]]__nm__\([[^ ]]*\)[[ ]][[^ ]]*/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname'] if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; haiku*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(link_all_deplibs, $1)=yes ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; interix[[3-9]]*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu) tmp_diet=no if test linux-dietlibc = "$host_os"; then case $cc_basename in diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn) esac fi if $LD --help 2>&1 | $EGREP ': supported targets:.* elf' > /dev/null \ && test no = "$tmp_diet" then tmp_addflag=' $pic_flag' tmp_sharedflag='-shared' case $cc_basename,$host_cpu in pgcc*) # Portland Group C compiler _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag' ;; pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group f77 and f90 compilers _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag -Mnomain' ;; ecc*,ia64* | icc*,ia64*) # Intel C compiler on ia64 tmp_addflag=' -i_dynamic' ;; efc*,ia64* | ifort*,ia64*) # Intel Fortran compiler on ia64 tmp_addflag=' -i_dynamic -nofor_main' ;; ifc* | ifort*) # Intel Fortran compiler tmp_addflag=' -nofor_main' ;; lf95*) # Lahey Fortran 8.1 _LT_TAGVAR(whole_archive_flag_spec, $1)= tmp_sharedflag='--shared' ;; nagfor*) # NAGFOR 5.3 tmp_sharedflag='-Wl,-shared' ;; xl[[cC]]* | bgxl[[cC]]* | mpixl[[cC]]*) # IBM XL C 8.0 on PPC (deal with xlf below) tmp_sharedflag='-qmkshrobj' tmp_addflag= ;; nvcc*) # Cuda Compiler Driver 2.2 _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes ;; esac case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C 5.9 _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes tmp_sharedflag='-G' ;; *Sun\ F*) # Sun Fortran 8.3 tmp_sharedflag='-G' ;; esac _LT_TAGVAR(archive_cmds, $1)='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi case $cc_basename in tcc*) _LT_TAGVAR(export_dynamic_flag_spec, $1)='-rdynamic' ;; xlf* | bgf* | bgxlf* | mpixlf*) # IBM XL Fortran 10.1 on PPC cannot create shared libs itself _LT_TAGVAR(whole_archive_flag_spec, $1)='--whole-archive$convenience --no-whole-archive' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib' fi ;; esac else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib' wlarc= else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' fi ;; solaris*) if $LD -v 2>&1 | $GREP 'BFD 2\.8' > /dev/null; then _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: The releases 2.8.* of the GNU linker cannot reliably *** create shared libraries on Solaris systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.9.1 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF elif $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX*) case `$LD -v 2>&1` in *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.1[[0-5]].*) _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot *** reliably create shared libraries on SCO systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.16.91.0.3 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF ;; *) # For security reasons, it is highly recommended that you always # use absolute paths for naming shared libraries, and exclude the # DT_RUNPATH tag from executables and libraries. But doing so # requires that you compile everything twice, which is a pain. if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; sunos4*) _LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags' wlarc= _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac if test no = "$_LT_TAGVAR(ld_shlibs, $1)"; then runpath_var= _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= fi else # PORTME fill in a description of your system's linker (not GNU ld) case $host_os in aix3*) _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname' # Note: this linker hardcodes the directories in LIBPATH if there # are no directories specified by -L. _LT_TAGVAR(hardcode_minus_L, $1)=yes if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then # Neither direct hardcoding nor static linking is supported with a # broken collect2. _LT_TAGVAR(hardcode_direct, $1)=unsupported fi ;; aix[[4-9]]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[[23]]|aix4.[[23]].*|aix[[5-9]]*) for ld_flag in $LDFLAGS; do if (test x-brtl = "x$ld_flag" || test x-Wl,-brtl = "x$ld_flag"); then aix_use_runtimelinking=yes break fi done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. _LT_TAGVAR(archive_cmds, $1)='' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(file_list_spec, $1)='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # traditional, no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no ;; esac if test yes = "$GCC"; then case $host_os in aix4.[[012]]|aix4.[[012]].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 _LT_TAGVAR(hardcode_direct, $1)=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)= fi ;; esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag="$shared_flag "'$wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to export. _LT_TAGVAR(always_export_symbols, $1)=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. _LT_TAGVAR(allow_undefined_flag, $1)='-berok' # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib' _LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs" _LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. _LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok' _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives _LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience' fi _LT_TAGVAR(archive_cmds_need_lc, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([[, ]]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared libraries. _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d' fi fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='' ;; m68k) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac ;; bsdi[[45]]*) _LT_TAGVAR(export_dynamic_flag_spec, $1)=-rdynamic ;; cygwin* | mingw* | pw32* | cegcc*) # When not using gcc, we currently assume that we are using # Microsoft Visual C++. # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. case $cc_basename in cl*) # Native MSVC _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(file_list_spec, $1)='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1,DATA/'\'' | $SED -e '\''/^[[AITW]][[ ]]/s/.*[[ ]]//'\'' | sort | uniq > $export_symbols' # Don't use ranlib _LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib' _LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # Assume MSVC wrapper _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" | $SED '\''s/ -lc$//'\''` -link -dll~linknames=' # The linker will automatically build a .lib file if we build a DLL. _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' # FIXME: Should let the user specify the lib program. _LT_TAGVAR(old_archive_cmds, $1)='lib -OUT:$oldlib$oldobjs$old_deplibs' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; esac ;; darwin* | rhapsody*) _LT_DARWIN_LINKER_FEATURES($1) ;; dgux*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor # support. Future versions do this automatically, but an explicit c++rt0.o # does not break anything, and helps significantly (at the cost of a little # extra space). freebsd2.2*) _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # Unfortunately, older versions of FreeBSD 2 do not have this feature. freebsd2.*) _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # FreeBSD 3 and greater uses gcc -shared to do shared libraries. freebsd* | dragonfly*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; hpux9*) if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_direct, $1)=yes # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' ;; hpux10*) if test yes,no = "$GCC,$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes fi ;; hpux11*) if test yes,no = "$GCC,$with_gnu_ld"; then case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' ;; esac else case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) m4_if($1, [], [ # Older versions of the 11.00 compiler do not understand -b yet # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does) _LT_LINKER_OPTION([if $CC understands -b], _LT_TAGVAR(lt_cv_prog_compiler__b, $1), [-b], [_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'], [_LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'])], [_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags']) ;; esac fi if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: case $host_cpu in hppa*64*|ia64*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac fi ;; irix5* | irix6* | nonstopux*) if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' # Try to use the -exported_symbol ld option, if it does not # work, assume that -exports_file does not work either and # implicitly export all symbols. # This should be the same for all languages, so no per-tag cache variable. AC_CACHE_CHECK([whether the $host_os linker accepts -exported_symbol], [lt_cv_irix_exported_symbol], [save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null" AC_LINK_IFELSE( [AC_LANG_SOURCE( [AC_LANG_CASE([C], [[int foo (void) { return 0; }]], [C++], [[int foo (void) { return 0; }]], [Fortran 77], [[ subroutine foo end]], [Fortran], [[ subroutine foo end]])])], [lt_cv_irix_exported_symbol=yes], [lt_cv_irix_exported_symbol=no]) LDFLAGS=$save_LDFLAGS]) if test yes = "$lt_cv_irix_exported_symbol"; then _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib' fi _LT_TAGVAR(link_all_deplibs, $1)=no else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(inherit_rpath, $1)=yes _LT_TAGVAR(link_all_deplibs, $1)=yes ;; linux*) case $cc_basename in tcc*) # Fabrice Bellard et al's Tiny C Compiler _LT_TAGVAR(ld_shlibs, $1)=yes _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out else _LT_TAGVAR(archive_cmds, $1)='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; newsos6) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *nto* | *qnx*) ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=yes if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' fi else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; osf3*) if test yes = "$GCC"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: ;; osf4* | osf5*) # as osf3* with the addition of -msym flag if test yes = "$GCC"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' else _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp' # Both c and cxx compiler support -rpath directly _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_separator, $1)=: ;; solaris*) _LT_TAGVAR(no_undefined_flag, $1)=' -z defs' if test yes = "$GCC"; then wlarc='$wl' _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' else case `$CC -V 2>&1` in *"Compilers 5.0"*) wlarc='' _LT_TAGVAR(archive_cmds, $1)='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp' ;; *) wlarc='$wl' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' ;; esac fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. GCC discards it without '$wl', # but is careful enough not to reorder. # Supported since Solaris 2.6 (maybe 2.5.1?) if test yes = "$GCC"; then _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' else _LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract' fi ;; esac _LT_TAGVAR(link_all_deplibs, $1)=yes ;; sunos4*) if test sequent = "$host_vendor"; then # Use $CC to link under sequent, because it throws in some extra .o # files that make .init and .fini sections work. _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; sysv4) case $host_vendor in sni) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes # is this really true??? ;; siemens) ## LD is ld it makes a PLAMLIB ## CC just makes a GrossModule. _LT_TAGVAR(archive_cmds, $1)='$LD -G -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(reload_cmds, $1)='$CC -r -o $output$reload_objs' _LT_TAGVAR(hardcode_direct, $1)=no ;; motorola) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=no #Motorola manual says yes, but my tests say they lie ;; esac runpath_var='LD_RUN_PATH' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; sysv4.3*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)='-Bexport' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var=LD_RUN_PATH hardcode_runpath_var=yes _LT_TAGVAR(ld_shlibs, $1)=yes fi ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[[01]].[[10]]* | unixware7* | sco3.2v5.0.[[024]]*) _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport' runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; uts4*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(ld_shlibs, $1)=no ;; esac if test sni = "$host_vendor"; then case $host in sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*) _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Blargedynsym' ;; esac fi fi ]) AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)]) test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no _LT_TAGVAR(with_gnu_ld, $1)=$with_gnu_ld _LT_DECL([], [libext], [0], [Old archive suffix (normally "a")])dnl _LT_DECL([], [shrext_cmds], [1], [Shared library suffix (normally ".so")])dnl _LT_DECL([], [extract_expsyms_cmds], [2], [The commands to extract the exported symbol list from a shared archive]) # # Do we need to explicitly link libc? # case "x$_LT_TAGVAR(archive_cmds_need_lc, $1)" in x|xyes) # Assume -lc should be added _LT_TAGVAR(archive_cmds_need_lc, $1)=yes if test yes,yes = "$GCC,$enable_shared"; then case $_LT_TAGVAR(archive_cmds, $1) in *'~'*) # FIXME: we may have to deal with multi-command sequences. ;; '$CC '*) # Test whether the compiler implicitly links with -lc since on some # systems, -lgcc has to come before -lc. If gcc already passes -lc # to ld, don't add -lc before -lgcc. AC_CACHE_CHECK([whether -lc should be explicitly linked in], [lt_cv_]_LT_TAGVAR(archive_cmds_need_lc, $1), [$RM conftest* echo "$lt_simple_compile_test_code" > conftest.$ac_ext if AC_TRY_EVAL(ac_compile) 2>conftest.err; then soname=conftest lib=conftest libobjs=conftest.$ac_objext deplibs= wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1) pic_flag=$_LT_TAGVAR(lt_prog_compiler_pic, $1) compiler_flags=-v linker_flags=-v verstring= output_objdir=. libname=conftest lt_save_allow_undefined_flag=$_LT_TAGVAR(allow_undefined_flag, $1) _LT_TAGVAR(allow_undefined_flag, $1)= if AC_TRY_EVAL(_LT_TAGVAR(archive_cmds, $1) 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) then lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=no else lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=yes fi _LT_TAGVAR(allow_undefined_flag, $1)=$lt_save_allow_undefined_flag else cat conftest.err 1>&5 fi $RM conftest* ]) _LT_TAGVAR(archive_cmds_need_lc, $1)=$lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1) ;; esac fi ;; esac _LT_TAGDECL([build_libtool_need_lc], [archive_cmds_need_lc], [0], [Whether or not to add -lc for building shared libraries]) _LT_TAGDECL([allow_libtool_libs_with_static_runtimes], [enable_shared_with_static_runtimes], [0], [Whether or not to disallow shared libs when runtime libs are static]) _LT_TAGDECL([], [export_dynamic_flag_spec], [1], [Compiler flag to allow reflexive dlopens]) _LT_TAGDECL([], [whole_archive_flag_spec], [1], [Compiler flag to generate shared objects directly from archives]) _LT_TAGDECL([], [compiler_needs_object], [1], [Whether the compiler copes with passing no objects directly]) _LT_TAGDECL([], [old_archive_from_new_cmds], [2], [Create an old-style archive from a shared archive]) _LT_TAGDECL([], [old_archive_from_expsyms_cmds], [2], [Create a temporary old-style archive to link instead of a shared archive]) _LT_TAGDECL([], [archive_cmds], [2], [Commands used to build a shared archive]) _LT_TAGDECL([], [archive_expsym_cmds], [2]) _LT_TAGDECL([], [module_cmds], [2], [Commands used to build a loadable module if different from building a shared archive.]) _LT_TAGDECL([], [module_expsym_cmds], [2]) _LT_TAGDECL([], [with_gnu_ld], [1], [Whether we are building with GNU ld or not]) _LT_TAGDECL([], [allow_undefined_flag], [1], [Flag that allows shared libraries with undefined symbols to be built]) _LT_TAGDECL([], [no_undefined_flag], [1], [Flag that enforces no undefined symbols]) _LT_TAGDECL([], [hardcode_libdir_flag_spec], [1], [Flag to hardcode $libdir into a binary during linking. This must work even if $libdir does not exist]) _LT_TAGDECL([], [hardcode_libdir_separator], [1], [Whether we need a single "-rpath" flag with a separated argument]) _LT_TAGDECL([], [hardcode_direct], [0], [Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_direct_absolute], [0], [Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes DIR into the resulting binary and the resulting library dependency is "absolute", i.e impossible to change by setting $shlibpath_var if the library is relocated]) _LT_TAGDECL([], [hardcode_minus_L], [0], [Set to "yes" if using the -LDIR flag during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_shlibpath_var], [0], [Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_automatic], [0], [Set to "yes" if building a shared library automatically hardcodes DIR into the library and all subsequent libraries and executables linked against it]) _LT_TAGDECL([], [inherit_rpath], [0], [Set to yes if linker adds runtime paths of dependent libraries to runtime path list]) _LT_TAGDECL([], [link_all_deplibs], [0], [Whether libtool must link a program against all its dependency libraries]) _LT_TAGDECL([], [always_export_symbols], [0], [Set to "yes" if exported symbols are required]) _LT_TAGDECL([], [export_symbols_cmds], [2], [The commands to list exported symbols]) _LT_TAGDECL([], [exclude_expsyms], [1], [Symbols that should not be listed in the preloaded symbols]) _LT_TAGDECL([], [include_expsyms], [1], [Symbols that must always be exported]) _LT_TAGDECL([], [prelink_cmds], [2], [Commands necessary for linking programs (against libraries) with templates]) _LT_TAGDECL([], [postlink_cmds], [2], [Commands necessary for finishing linking programs]) _LT_TAGDECL([], [file_list_spec], [1], [Specify filename containing input files]) dnl FIXME: Not yet implemented dnl _LT_TAGDECL([], [thread_safe_flag_spec], [1], dnl [Compiler flag to generate thread safe objects]) ])# _LT_LINKER_SHLIBS # _LT_LANG_C_CONFIG([TAG]) # ------------------------ # Ensure that the configuration variables for a C compiler are suitably # defined. These variables are subsequently used by _LT_CONFIG to write # the compiler configuration to 'libtool'. m4_defun([_LT_LANG_C_CONFIG], [m4_require([_LT_DECL_EGREP])dnl lt_save_CC=$CC AC_LANG_PUSH(C) # Source file extension for C test sources. ac_ext=c # Object file extension for compiled C test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(){return(0);}' _LT_TAG_COMPILER # Save the default compiler, since it gets overwritten when the other # tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP. compiler_DEFAULT=$CC # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) LT_SYS_DLOPEN_SELF _LT_CMD_STRIPLIB # Report what library types will actually be built AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_CONFIG($1) fi AC_LANG_POP CC=$lt_save_CC ])# _LT_LANG_C_CONFIG # _LT_LANG_CXX_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for a C++ compiler are suitably # defined. These variables are subsequently used by _LT_CONFIG to write # the compiler configuration to 'libtool'. m4_defun([_LT_LANG_CXX_CONFIG], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_PATH_MANIFEST_TOOL])dnl if test -n "$CXX" && ( test no != "$CXX" && ( (test g++ = "$CXX" && `g++ -v >/dev/null 2>&1` ) || (test g++ != "$CXX"))); then AC_PROG_CXXCPP else _lt_caught_CXX_error=yes fi AC_LANG_PUSH(C++) _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(compiler_needs_object, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for C++ test sources. ac_ext=cpp # Object file extension for compiled C++ test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the CXX compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_caught_CXX_error"; then # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(int, char *[[]]) { return(0); }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_LD=$LD lt_save_GCC=$GCC GCC=$GXX lt_save_with_gnu_ld=$with_gnu_ld lt_save_path_LD=$lt_cv_path_LD if test -n "${lt_cv_prog_gnu_ldcxx+set}"; then lt_cv_prog_gnu_ld=$lt_cv_prog_gnu_ldcxx else $as_unset lt_cv_prog_gnu_ld fi if test -n "${lt_cv_path_LDCXX+set}"; then lt_cv_path_LD=$lt_cv_path_LDCXX else $as_unset lt_cv_path_LD fi test -z "${LDCXX+set}" || LD=$LDCXX CC=${CXX-"c++"} CFLAGS=$CXXFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) if test -n "$compiler"; then # We don't want -fno-exception when compiling C++ code, so set the # no_builtin_flag separately if test yes = "$GXX"; then _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin' else _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)= fi if test yes = "$GXX"; then # Set up default GNU C++ configuration LT_PATH_LD # Check if GNU C++ uses GNU ld as the underlying linker, since the # archiving commands below assume that GNU ld is being used. if test yes = "$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # If archive_cmds runs LD, not CC, wlarc should be empty # XXX I think wlarc can be eliminated in ltcf-cxx, but I need to # investigate it a little bit more. (MM) wlarc='$wl' # ancient GNU ld didn't support --whole-archive et. al. if eval "`$CC -print-prog-name=ld` --help 2>&1" | $GREP 'no-whole-archive' > /dev/null; then _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else _LT_TAGVAR(whole_archive_flag_spec, $1)= fi else with_gnu_ld=no wlarc= # A generic and very simple default shared library creation # command for GNU C++ for the case where it uses the native # linker, instead of GNU ld. If possible, this setting should # overridden to take advantage of the native linker features on # the platform it is being used on. _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' fi # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else GXX=no with_gnu_ld=no wlarc= fi # PORTME: fill in a description of your system's C++ link characteristics AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries]) _LT_TAGVAR(ld_shlibs, $1)=yes case $host_os in aix3*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aix[[4-9]]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[[23]]|aix4.[[23]].*|aix[[5-9]]*) for ld_flag in $LDFLAGS; do case $ld_flag in *-brtl*) aix_use_runtimelinking=yes break ;; esac done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. _LT_TAGVAR(archive_cmds, $1)='' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(file_list_spec, $1)='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no ;; esac if test yes = "$GXX"; then case $host_os in aix4.[[012]]|aix4.[[012]].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 _LT_TAGVAR(hardcode_direct, $1)=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)= fi esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag=$shared_flag' $wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to # export. _LT_TAGVAR(always_export_symbols, $1)=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. # The "-G" linker flag allows undefined symbols. _LT_TAGVAR(no_undefined_flag, $1)='-bernotok' # Determine the default libpath from the value encoded in an empty # executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib' _LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs" _LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. _LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok' _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives _LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience' fi _LT_TAGVAR(archive_cmds_need_lc, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([[, ]]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared # libraries. Need -bnortl late, we may have -brtl in LDFLAGS. _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d' fi fi ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME _LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; chorus*) case $cc_basename in *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; cygwin* | mingw* | pw32* | cegcc*) case $GXX,$cc_basename in ,cl* | no,cl*) # Native MSVC # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(file_list_spec, $1)='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes # Don't use ranlib _LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib' _LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ func_to_tool_file "$lt_outputfile"~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # g++ # _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless, # as there is no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared -nostdlib $output_objdir/$soname.def $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; darwin* | rhapsody*) _LT_DARWIN_LINKER_FEATURES($1) ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; dgux*) case $cc_basename in ec++*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; ghcx*) # Green Hills C++ Compiler # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; freebsd2.*) # C++ shared libraries reported to be fairly broken before # switch to ELF _LT_TAGVAR(ld_shlibs, $1)=no ;; freebsd-elf*) _LT_TAGVAR(archive_cmds_need_lc, $1)=no ;; freebsd* | dragonfly*) # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF # conventions _LT_TAGVAR(ld_shlibs, $1)=yes ;; haiku*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(link_all_deplibs, $1)=yes ;; hpux9*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH, # but as the default # location of the library. case $cc_basename in CC*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aCC*) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -b $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared -nostdlib $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; hpux10*|hpux11*) if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: case $host_cpu in hppa*64*|ia64*) ;; *) _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' ;; esac fi case $host_cpu in hppa*64*|ia64*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH, # but as the default # location of the library. ;; esac case $cc_basename in CC*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aCC*) case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac fi else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; interix[[3-9]]*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; irix5* | irix6*) case $cc_basename in CC*) # SGI C++ _LT_TAGVAR(archive_cmds, $1)='$CC -shared -all -multigot $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' # Archives containing C++ object files must be created using # "CC -ar", where "CC" is the IRIX C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -ar -WR,-u -o $oldlib $oldobjs' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` -o $lib' fi fi _LT_TAGVAR(link_all_deplibs, $1)=yes ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(inherit_rpath, $1)=yes ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. _LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib $wl-retain-symbols-file,$export_symbols; mv \$templib $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 | $GREP "ld"`; rm -f libconftest$shared_ext; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # Archives containing C++ object files must be created using # "CC -Bstatic", where "CC" is the KAI C++ compiler. _LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs' ;; icpc* | ecpc* ) # Intel C++ with_gnu_ld=yes # version 8.0 and above of icpc choke on multiply defined symbols # if we add $predep_objects and $postdep_objects, however 7.1 and # earlier do not add the objects themselves. case `$CC -V 2>&1` in *"Version 7."*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 8.0 or newer tmp_idyn= case $host_cpu in ia64*) tmp_idyn=' -i_dynamic';; esac _LT_TAGVAR(archive_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' ;; pgCC* | pgcpp*) # Portland Group C++ compiler case `$CC -V` in *pgCC\ [[1-5]].* | *pgcpp\ [[1-5]].*) _LT_TAGVAR(prelink_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~ compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"' _LT_TAGVAR(old_archive_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~ $AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~ $RANLIB $oldlib' _LT_TAGVAR(archive_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 6 and above use weak symbols _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl--rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' ;; cxx*) # Compaq C++ _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib $wl-retain-symbols-file $wl$export_symbols' runpath_var=LD_RUN_PATH _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld .*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "X$list" | $Xsed' ;; xl* | mpixl* | bgxl*) # IBM XL 8.0 on PPC, with GNU ld _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file $wl$export_symbols' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes # Not sure whether something based on # $CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 # would be better. output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs' ;; esac ;; esac ;; lynxos*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; m88k*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; mvs*) case $cc_basename in cxx*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; netbsd*) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $predep_objects $libobjs $deplibs $postdep_objects $linker_flags' wlarc= _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no fi # Workaround some broken pre-1.5 toolchains output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP conftest.$objext | $SED -e "s:-lgcc -lc -lgcc::"' ;; *nto* | *qnx*) _LT_TAGVAR(ld_shlibs, $1)=yes ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' if test -z "`echo __ELF__ | $CC -E - | grep __ELF__`"; then _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file,$export_symbols -o $lib' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' fi output_verbose_link_cmd=func_echo_all else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. _LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo "$lib" | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Archives containing C++ object files must be created using # the KAI C++ compiler. case $host in osf3*) _LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs' ;; *) _LT_TAGVAR(old_archive_cmds, $1)='$CC -o $oldlib $oldobjs' ;; esac ;; RCC*) # Rational C++ 2.4.1 # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; cxx*) case $host in osf3*) _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $soname `test -n "$verstring" && func_echo_all "$wl-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' ;; *) _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done~ echo "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname $wl-input $wl$lib.exp `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~ $RM $lib.exp' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' ;; esac _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld" | $GREP -v "ld:"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld.*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes,no = "$GXX,$with_gnu_ld"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' case $host in osf3*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; psos*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; lcc*) # Lucid # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ _LT_TAGVAR(archive_cmds_need_lc,$1)=yes _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag $wl-M $wl$lib.exp -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. # Supported since Solaris 2.6 (maybe 2.5.1?) _LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract' ;; esac _LT_TAGVAR(link_all_deplibs, $1)=yes output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs' ;; gcx*) # Green Hills C++ Compiler _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' # The C++ compiler must be used to create the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC $LDFLAGS -archive -o $oldlib $oldobjs' ;; *) # GNU C++ compiler with Solaris linker if test yes,no = "$GXX,$with_gnu_ld"; then _LT_TAGVAR(no_undefined_flag, $1)=' $wl-z ${wl}defs' if $CC --version | $GREP -v '^2\.7' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # g++ 2.7 appears to require '-G' NOT '-shared' on this # platform. _LT_TAGVAR(archive_cmds, $1)='$CC -G -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir' case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' ;; esac fi ;; esac ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[[01]].[[10]]* | unixware7* | sco3.2v5.0.[[024]]*) _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var='LD_RUN_PATH' case $cc_basename in CC*) _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport' runpath_var='LD_RUN_PATH' case $cc_basename in CC*) _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(old_archive_cmds, $1)='$CC -Tprelink_objects $oldobjs~ '"$_LT_TAGVAR(old_archive_cmds, $1)" _LT_TAGVAR(reload_cmds, $1)='$CC -Tprelink_objects $reload_objs~ '"$_LT_TAGVAR(reload_cmds, $1)" ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; vxworks*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)]) test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no _LT_TAGVAR(GCC, $1)=$GXX _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_SYS_HIDDEN_LIBDEPS($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS LDCXX=$LD LD=$lt_save_LD GCC=$lt_save_GCC with_gnu_ld=$lt_save_with_gnu_ld lt_cv_path_LDCXX=$lt_cv_path_LD lt_cv_path_LD=$lt_save_path_LD lt_cv_prog_gnu_ldcxx=$lt_cv_prog_gnu_ld lt_cv_prog_gnu_ld=$lt_save_with_gnu_ld fi # test yes != "$_lt_caught_CXX_error" AC_LANG_POP ])# _LT_LANG_CXX_CONFIG # _LT_FUNC_STRIPNAME_CNF # ---------------------- # func_stripname_cnf prefix suffix name # strip PREFIX and SUFFIX off of NAME. # PREFIX and SUFFIX must not contain globbing or regex special # characters, hashes, percent signs, but SUFFIX may contain a leading # dot (in which case that matches only a dot). # # This function is identical to the (non-XSI) version of func_stripname, # except this one can be used by m4 code that may be executed by configure, # rather than the libtool script. m4_defun([_LT_FUNC_STRIPNAME_CNF],[dnl AC_REQUIRE([_LT_DECL_SED]) AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH]) func_stripname_cnf () { case @S|@2 in .*) func_stripname_result=`$ECHO "@S|@3" | $SED "s%^@S|@1%%; s%\\\\@S|@2\$%%"`;; *) func_stripname_result=`$ECHO "@S|@3" | $SED "s%^@S|@1%%; s%@S|@2\$%%"`;; esac } # func_stripname_cnf ])# _LT_FUNC_STRIPNAME_CNF # _LT_SYS_HIDDEN_LIBDEPS([TAGNAME]) # --------------------------------- # Figure out "hidden" library dependencies from verbose # compiler output when linking a shared library. # Parse the compiler output and extract the necessary # objects, libraries and library flags. m4_defun([_LT_SYS_HIDDEN_LIBDEPS], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl AC_REQUIRE([_LT_FUNC_STRIPNAME_CNF])dnl # Dependencies to place before and after the object being linked: _LT_TAGVAR(predep_objects, $1)= _LT_TAGVAR(postdep_objects, $1)= _LT_TAGVAR(predeps, $1)= _LT_TAGVAR(postdeps, $1)= _LT_TAGVAR(compiler_lib_search_path, $1)= dnl we can't use the lt_simple_compile_test_code here, dnl because it contains code intended for an executable, dnl not a library. It's possible we should let each dnl tag define a new lt_????_link_test_code variable, dnl but it's only used here... m4_if([$1], [], [cat > conftest.$ac_ext <<_LT_EOF int a; void foo (void) { a = 0; } _LT_EOF ], [$1], [CXX], [cat > conftest.$ac_ext <<_LT_EOF class Foo { public: Foo (void) { a = 0; } private: int a; }; _LT_EOF ], [$1], [F77], [cat > conftest.$ac_ext <<_LT_EOF subroutine foo implicit none integer*4 a a=0 return end _LT_EOF ], [$1], [FC], [cat > conftest.$ac_ext <<_LT_EOF subroutine foo implicit none integer a a=0 return end _LT_EOF ], [$1], [GCJ], [cat > conftest.$ac_ext <<_LT_EOF public class foo { private int a; public void bar (void) { a = 0; } }; _LT_EOF ], [$1], [GO], [cat > conftest.$ac_ext <<_LT_EOF package foo func foo() { } _LT_EOF ]) _lt_libdeps_save_CFLAGS=$CFLAGS case "$CC $CFLAGS " in #( *\ -flto*\ *) CFLAGS="$CFLAGS -fno-lto" ;; *\ -fwhopr*\ *) CFLAGS="$CFLAGS -fno-whopr" ;; *\ -fuse-linker-plugin*\ *) CFLAGS="$CFLAGS -fno-use-linker-plugin" ;; esac dnl Parse the compiler output and extract the necessary dnl objects, libraries and library flags. if AC_TRY_EVAL(ac_compile); then # Parse the compiler output and extract the necessary # objects, libraries and library flags. # Sentinel used to keep track of whether or not we are before # the conftest object file. pre_test_object_deps_done=no for p in `eval "$output_verbose_link_cmd"`; do case $prev$p in -L* | -R* | -l*) # Some compilers place space between "-{L,R}" and the path. # Remove the space. if test x-L = "$p" || test x-R = "$p"; then prev=$p continue fi # Expand the sysroot to ease extracting the directories later. if test -z "$prev"; then case $p in -L*) func_stripname_cnf '-L' '' "$p"; prev=-L; p=$func_stripname_result ;; -R*) func_stripname_cnf '-R' '' "$p"; prev=-R; p=$func_stripname_result ;; -l*) func_stripname_cnf '-l' '' "$p"; prev=-l; p=$func_stripname_result ;; esac fi case $p in =*) func_stripname_cnf '=' '' "$p"; p=$lt_sysroot$func_stripname_result ;; esac if test no = "$pre_test_object_deps_done"; then case $prev in -L | -R) # Internal compiler library paths should come after those # provided the user. The postdeps already come after the # user supplied libs so there is no need to process them. if test -z "$_LT_TAGVAR(compiler_lib_search_path, $1)"; then _LT_TAGVAR(compiler_lib_search_path, $1)=$prev$p else _LT_TAGVAR(compiler_lib_search_path, $1)="${_LT_TAGVAR(compiler_lib_search_path, $1)} $prev$p" fi ;; # The "-l" case would never come before the object being # linked, so don't bother handling this case. esac else if test -z "$_LT_TAGVAR(postdeps, $1)"; then _LT_TAGVAR(postdeps, $1)=$prev$p else _LT_TAGVAR(postdeps, $1)="${_LT_TAGVAR(postdeps, $1)} $prev$p" fi fi prev= ;; *.lto.$objext) ;; # Ignore GCC LTO objects *.$objext) # This assumes that the test object file only shows up # once in the compiler output. if test "$p" = "conftest.$objext"; then pre_test_object_deps_done=yes continue fi if test no = "$pre_test_object_deps_done"; then if test -z "$_LT_TAGVAR(predep_objects, $1)"; then _LT_TAGVAR(predep_objects, $1)=$p else _LT_TAGVAR(predep_objects, $1)="$_LT_TAGVAR(predep_objects, $1) $p" fi else if test -z "$_LT_TAGVAR(postdep_objects, $1)"; then _LT_TAGVAR(postdep_objects, $1)=$p else _LT_TAGVAR(postdep_objects, $1)="$_LT_TAGVAR(postdep_objects, $1) $p" fi fi ;; *) ;; # Ignore the rest. esac done # Clean up. rm -f a.out a.exe else echo "libtool.m4: error: problem compiling $1 test program" fi $RM -f confest.$objext CFLAGS=$_lt_libdeps_save_CFLAGS # PORTME: override above test on systems where it is broken m4_if([$1], [CXX], [case $host_os in interix[[3-9]]*) # Interix 3.5 installs completely hosed .la files for C++, so rather than # hack all around it, let's just trust "g++" to DTRT. _LT_TAGVAR(predep_objects,$1)= _LT_TAGVAR(postdep_objects,$1)= _LT_TAGVAR(postdeps,$1)= ;; esac ]) case " $_LT_TAGVAR(postdeps, $1) " in *" -lc "*) _LT_TAGVAR(archive_cmds_need_lc, $1)=no ;; esac _LT_TAGVAR(compiler_lib_search_dirs, $1)= if test -n "${_LT_TAGVAR(compiler_lib_search_path, $1)}"; then _LT_TAGVAR(compiler_lib_search_dirs, $1)=`echo " ${_LT_TAGVAR(compiler_lib_search_path, $1)}" | $SED -e 's! -L! !g' -e 's!^ !!'` fi _LT_TAGDECL([], [compiler_lib_search_dirs], [1], [The directories searched by this compiler when creating a shared library]) _LT_TAGDECL([], [predep_objects], [1], [Dependencies to place before and after the objects being linked to create a shared library]) _LT_TAGDECL([], [postdep_objects], [1]) _LT_TAGDECL([], [predeps], [1]) _LT_TAGDECL([], [postdeps], [1]) _LT_TAGDECL([], [compiler_lib_search_path], [1], [The library search path used internally by the compiler when linking a shared library]) ])# _LT_SYS_HIDDEN_LIBDEPS # _LT_LANG_F77_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for a Fortran 77 compiler are # suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_F77_CONFIG], [AC_LANG_PUSH(Fortran 77) if test -z "$F77" || test no = "$F77"; then _lt_disable_F77=yes fi _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for f77 test sources. ac_ext=f # Object file extension for compiled f77 test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the F77 compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_disable_F77"; then # Code to be used in simple compile tests lt_simple_compile_test_code="\ subroutine t return end " # Code to be used in simple link tests lt_simple_link_test_code="\ program t end " # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_GCC=$GCC lt_save_CFLAGS=$CFLAGS CC=${F77-"f77"} CFLAGS=$FFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) GCC=$G77 if test -n "$compiler"; then AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_TAGVAR(GCC, $1)=$G77 _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS fi # test yes != "$_lt_disable_F77" AC_LANG_POP ])# _LT_LANG_F77_CONFIG # _LT_LANG_FC_CONFIG([TAG]) # ------------------------- # Ensure that the configuration variables for a Fortran compiler are # suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_FC_CONFIG], [AC_LANG_PUSH(Fortran) if test -z "$FC" || test no = "$FC"; then _lt_disable_FC=yes fi _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for fc test sources. ac_ext=${ac_fc_srcext-f} # Object file extension for compiled fc test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the FC compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_disable_FC"; then # Code to be used in simple compile tests lt_simple_compile_test_code="\ subroutine t return end " # Code to be used in simple link tests lt_simple_link_test_code="\ program t end " # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_GCC=$GCC lt_save_CFLAGS=$CFLAGS CC=${FC-"f95"} CFLAGS=$FCFLAGS compiler=$CC GCC=$ac_cv_fc_compiler_gnu _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) if test -n "$compiler"; then AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_TAGVAR(GCC, $1)=$ac_cv_fc_compiler_gnu _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_SYS_HIDDEN_LIBDEPS($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS fi # test yes != "$_lt_disable_FC" AC_LANG_POP ])# _LT_LANG_FC_CONFIG # _LT_LANG_GCJ_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for the GNU Java Compiler compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_GCJ_CONFIG], [AC_REQUIRE([LT_PROG_GCJ])dnl AC_LANG_SAVE # Source file extension for Java test sources. ac_ext=java # Object file extension for compiled Java test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="class foo {}" # Code to be used in simple link tests lt_simple_link_test_code='public class conftest { public static void main(String[[]] argv) {}; }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC=yes CC=${GCJ-"gcj"} CFLAGS=$GCJFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_TAGVAR(LD, $1)=$LD _LT_CC_BASENAME([$compiler]) # GCJ did not exist at the time GCC didn't implicitly link libc in. _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi AC_LANG_RESTORE GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_GCJ_CONFIG # _LT_LANG_GO_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for the GNU Go compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_GO_CONFIG], [AC_REQUIRE([LT_PROG_GO])dnl AC_LANG_SAVE # Source file extension for Go test sources. ac_ext=go # Object file extension for compiled Go test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="package main; func main() { }" # Code to be used in simple link tests lt_simple_link_test_code='package main; func main() { }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC=yes CC=${GOC-"gccgo"} CFLAGS=$GOFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_TAGVAR(LD, $1)=$LD _LT_CC_BASENAME([$compiler]) # Go did not exist at the time GCC didn't implicitly link libc in. _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi AC_LANG_RESTORE GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_GO_CONFIG # _LT_LANG_RC_CONFIG([TAG]) # ------------------------- # Ensure that the configuration variables for the Windows resource compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_RC_CONFIG], [AC_REQUIRE([LT_PROG_RC])dnl AC_LANG_SAVE # Source file extension for RC test sources. ac_ext=rc # Object file extension for compiled RC test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code='sample MENU { MENUITEM "&Soup", 100, CHECKED }' # Code to be used in simple link tests lt_simple_link_test_code=$lt_simple_compile_test_code # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC= CC=${RC-"windres"} CFLAGS= compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) _LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes if test -n "$compiler"; then : _LT_CONFIG($1) fi GCC=$lt_save_GCC AC_LANG_RESTORE CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_RC_CONFIG # LT_PROG_GCJ # ----------- AC_DEFUN([LT_PROG_GCJ], [m4_ifdef([AC_PROG_GCJ], [AC_PROG_GCJ], [m4_ifdef([A][M_PROG_GCJ], [A][M_PROG_GCJ], [AC_CHECK_TOOL(GCJ, gcj,) test set = "${GCJFLAGS+set}" || GCJFLAGS="-g -O2" AC_SUBST(GCJFLAGS)])])[]dnl ]) # Old name: AU_ALIAS([LT_AC_PROG_GCJ], [LT_PROG_GCJ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_GCJ], []) # LT_PROG_GO # ---------- AC_DEFUN([LT_PROG_GO], [AC_CHECK_TOOL(GOC, gccgo,) ]) # LT_PROG_RC # ---------- AC_DEFUN([LT_PROG_RC], [AC_CHECK_TOOL(RC, windres,) ]) # Old name: AU_ALIAS([LT_AC_PROG_RC], [LT_PROG_RC]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_RC], []) # _LT_DECL_EGREP # -------------- # If we don't have a new enough Autoconf to choose the best grep # available, choose the one first in the user's PATH. m4_defun([_LT_DECL_EGREP], [AC_REQUIRE([AC_PROG_EGREP])dnl AC_REQUIRE([AC_PROG_FGREP])dnl test -z "$GREP" && GREP=grep _LT_DECL([], [GREP], [1], [A grep program that handles long lines]) _LT_DECL([], [EGREP], [1], [An ERE matcher]) _LT_DECL([], [FGREP], [1], [A literal string matcher]) dnl Non-bleeding-edge autoconf doesn't subst GREP, so do it here too AC_SUBST([GREP]) ]) # _LT_DECL_OBJDUMP # -------------- # If we don't have a new enough Autoconf to choose the best objdump # available, choose the one first in the user's PATH. m4_defun([_LT_DECL_OBJDUMP], [AC_CHECK_TOOL(OBJDUMP, objdump, false) test -z "$OBJDUMP" && OBJDUMP=objdump _LT_DECL([], [OBJDUMP], [1], [An object symbol dumper]) AC_SUBST([OBJDUMP]) ]) # _LT_DECL_DLLTOOL # ---------------- # Ensure DLLTOOL variable is set. m4_defun([_LT_DECL_DLLTOOL], [AC_CHECK_TOOL(DLLTOOL, dlltool, false) test -z "$DLLTOOL" && DLLTOOL=dlltool _LT_DECL([], [DLLTOOL], [1], [DLL creation program]) AC_SUBST([DLLTOOL]) ]) # _LT_DECL_SED # ------------ # Check for a fully-functional sed program, that truncates # as few characters as possible. Prefer GNU sed if found. m4_defun([_LT_DECL_SED], [AC_PROG_SED test -z "$SED" && SED=sed Xsed="$SED -e 1s/^X//" _LT_DECL([], [SED], [1], [A sed program that does not truncate output]) _LT_DECL([], [Xsed], ["\$SED -e 1s/^X//"], [Sed that helps us avoid accidentally triggering echo(1) options like -n]) ])# _LT_DECL_SED m4_ifndef([AC_PROG_SED], [ ############################################################ # NOTE: This macro has been submitted for inclusion into # # GNU Autoconf as AC_PROG_SED. When it is available in # # a released version of Autoconf we should remove this # # macro and use it instead. # ############################################################ m4_defun([AC_PROG_SED], [AC_MSG_CHECKING([for a sed that does not truncate output]) AC_CACHE_VAL(lt_cv_path_SED, [# Loop through the user's path and test for sed and gsed. # Then use that list of sed's as ones to test for truncation. as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for lt_ac_prog in sed gsed; do for ac_exec_ext in '' $ac_executable_extensions; do if $as_executable_p "$as_dir/$lt_ac_prog$ac_exec_ext"; then lt_ac_sed_list="$lt_ac_sed_list $as_dir/$lt_ac_prog$ac_exec_ext" fi done done done IFS=$as_save_IFS lt_ac_max=0 lt_ac_count=0 # Add /usr/xpg4/bin/sed as it is typically found on Solaris # along with /bin/sed that truncates output. for lt_ac_sed in $lt_ac_sed_list /usr/xpg4/bin/sed; do test ! -f "$lt_ac_sed" && continue cat /dev/null > conftest.in lt_ac_count=0 echo $ECHO_N "0123456789$ECHO_C" >conftest.in # Check for GNU sed and select it if it is found. if "$lt_ac_sed" --version 2>&1 < /dev/null | grep 'GNU' > /dev/null; then lt_cv_path_SED=$lt_ac_sed break fi while true; do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo >>conftest.nl $lt_ac_sed -e 's/a$//' < conftest.nl >conftest.out || break cmp -s conftest.out conftest.nl || break # 10000 chars as input seems more than enough test 10 -lt "$lt_ac_count" && break lt_ac_count=`expr $lt_ac_count + 1` if test "$lt_ac_count" -gt "$lt_ac_max"; then lt_ac_max=$lt_ac_count lt_cv_path_SED=$lt_ac_sed fi done done ]) SED=$lt_cv_path_SED AC_SUBST([SED]) AC_MSG_RESULT([$SED]) ])#AC_PROG_SED ])#m4_ifndef # Old name: AU_ALIAS([LT_AC_PROG_SED], [AC_PROG_SED]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_SED], []) # _LT_CHECK_SHELL_FEATURES # ------------------------ # Find out whether the shell is Bourne or XSI compatible, # or has some other useful features. m4_defun([_LT_CHECK_SHELL_FEATURES], [if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then lt_unset=unset else lt_unset=false fi _LT_DECL([], [lt_unset], [0], [whether the shell understands "unset"])dnl # test EBCDIC or ASCII case `echo X|tr X '\101'` in A) # ASCII based system # \n is not interpreted correctly by Solaris 8 /usr/ucb/tr lt_SP2NL='tr \040 \012' lt_NL2SP='tr \015\012 \040\040' ;; *) # EBCDIC based system lt_SP2NL='tr \100 \n' lt_NL2SP='tr \r\n \100\100' ;; esac _LT_DECL([SP2NL], [lt_SP2NL], [1], [turn spaces into newlines])dnl _LT_DECL([NL2SP], [lt_NL2SP], [1], [turn newlines into spaces])dnl ])# _LT_CHECK_SHELL_FEATURES # _LT_PATH_CONVERSION_FUNCTIONS # ----------------------------- # Determine what file name conversion functions should be used by # func_to_host_file (and, implicitly, by func_to_host_path). These are needed # for certain cross-compile configurations and native mingw. m4_defun([_LT_PATH_CONVERSION_FUNCTIONS], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl AC_MSG_CHECKING([how to convert $build file names to $host format]) AC_CACHE_VAL(lt_cv_to_host_file_cmd, [case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32 ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32 ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32 ;; esac ;; *-*-cygwin* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_noop ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin ;; esac ;; * ) # unhandled hosts (and "normal" native builds) lt_cv_to_host_file_cmd=func_convert_file_noop ;; esac ]) to_host_file_cmd=$lt_cv_to_host_file_cmd AC_MSG_RESULT([$lt_cv_to_host_file_cmd]) _LT_DECL([to_host_file_cmd], [lt_cv_to_host_file_cmd], [0], [convert $build file names to $host format])dnl AC_MSG_CHECKING([how to convert $build file names to toolchain format]) AC_CACHE_VAL(lt_cv_to_tool_file_cmd, [#assume ordinary cross tools, or native build. lt_cv_to_tool_file_cmd=func_convert_file_noop case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32 ;; esac ;; esac ]) to_tool_file_cmd=$lt_cv_to_tool_file_cmd AC_MSG_RESULT([$lt_cv_to_tool_file_cmd]) _LT_DECL([to_tool_file_cmd], [lt_cv_to_tool_file_cmd], [0], [convert $build files to toolchain format])dnl ])# _LT_PATH_CONVERSION_FUNCTIONS suricata-3.2.1/libhtp/m4/ltversion.m40000644000000000000000000000127313051004460014304 00000000000000# ltversion.m4 -- version numbers -*- Autoconf -*- # # Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc. # Written by Scott James Remnant, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # @configure_input@ # serial 4179 ltversion.m4 # This file is part of GNU Libtool m4_define([LT_PACKAGE_VERSION], [2.4.6]) m4_define([LT_PACKAGE_REVISION], [2.4.6]) AC_DEFUN([LTVERSION_VERSION], [macro_version='2.4.6' macro_revision='2.4.6' _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?]) _LT_DECL(, macro_revision, 0) ]) suricata-3.2.1/libhtp/m4/lib-prefix.m40000644000000000000000000002042213051004451014315 00000000000000# lib-prefix.m4 serial 7 (gettext-0.18) dnl Copyright (C) 2001-2005, 2008-2010 Free Software Foundation, Inc. dnl This file is free software; the Free Software Foundation dnl gives unlimited permission to copy and/or distribute it, dnl with or without modifications, as long as this notice is preserved. dnl From Bruno Haible. dnl AC_LIB_ARG_WITH is synonymous to AC_ARG_WITH in autoconf-2.13, and dnl similar to AC_ARG_WITH in autoconf 2.52...2.57 except that is doesn't dnl require excessive bracketing. ifdef([AC_HELP_STRING], [AC_DEFUN([AC_LIB_ARG_WITH], [AC_ARG_WITH([$1],[[$2]],[$3],[$4])])], [AC_DEFUN([AC_][LIB_ARG_WITH], [AC_ARG_WITH([$1],[$2],[$3],[$4])])]) dnl AC_LIB_PREFIX adds to the CPPFLAGS and LDFLAGS the flags that are needed dnl to access previously installed libraries. The basic assumption is that dnl a user will want packages to use other packages he previously installed dnl with the same --prefix option. dnl This macro is not needed if only AC_LIB_LINKFLAGS is used to locate dnl libraries, but is otherwise very convenient. AC_DEFUN([AC_LIB_PREFIX], [ AC_BEFORE([$0], [AC_LIB_LINKFLAGS]) AC_REQUIRE([AC_PROG_CC]) AC_REQUIRE([AC_CANONICAL_HOST]) AC_REQUIRE([AC_LIB_PREPARE_MULTILIB]) AC_REQUIRE([AC_LIB_PREPARE_PREFIX]) dnl By default, look in $includedir and $libdir. use_additional=yes AC_LIB_WITH_FINAL_PREFIX([ eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" ]) AC_LIB_ARG_WITH([lib-prefix], [ --with-lib-prefix[=DIR] search for libraries in DIR/include and DIR/lib --without-lib-prefix don't search for libraries in includedir and libdir], [ if test "X$withval" = "Xno"; then use_additional=no else if test "X$withval" = "X"; then AC_LIB_WITH_FINAL_PREFIX([ eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" ]) else additional_includedir="$withval/include" additional_libdir="$withval/$acl_libdirstem" fi fi ]) if test $use_additional = yes; then dnl Potentially add $additional_includedir to $CPPFLAGS. dnl But don't add it dnl 1. if it's the standard /usr/include, dnl 2. if it's already present in $CPPFLAGS, dnl 3. if it's /usr/local/include and we are using GCC on Linux, dnl 4. if it doesn't exist as a directory. if test "X$additional_includedir" != "X/usr/include"; then haveit= for x in $CPPFLAGS; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-I$additional_includedir"; then haveit=yes break fi done if test -z "$haveit"; then if test "X$additional_includedir" = "X/usr/local/include"; then if test -n "$GCC"; then case $host_os in linux* | gnu* | k*bsd*-gnu) haveit=yes;; esac fi fi if test -z "$haveit"; then if test -d "$additional_includedir"; then dnl Really add $additional_includedir to $CPPFLAGS. CPPFLAGS="${CPPFLAGS}${CPPFLAGS:+ }-I$additional_includedir" fi fi fi fi dnl Potentially add $additional_libdir to $LDFLAGS. dnl But don't add it dnl 1. if it's the standard /usr/lib, dnl 2. if it's already present in $LDFLAGS, dnl 3. if it's /usr/local/lib and we are using GCC on Linux, dnl 4. if it doesn't exist as a directory. if test "X$additional_libdir" != "X/usr/$acl_libdirstem"; then haveit= for x in $LDFLAGS; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-L$additional_libdir"; then haveit=yes break fi done if test -z "$haveit"; then if test "X$additional_libdir" = "X/usr/local/$acl_libdirstem"; then if test -n "$GCC"; then case $host_os in linux*) haveit=yes;; esac fi fi if test -z "$haveit"; then if test -d "$additional_libdir"; then dnl Really add $additional_libdir to $LDFLAGS. LDFLAGS="${LDFLAGS}${LDFLAGS:+ }-L$additional_libdir" fi fi fi fi fi ]) dnl AC_LIB_PREPARE_PREFIX creates variables acl_final_prefix, dnl acl_final_exec_prefix, containing the values to which $prefix and dnl $exec_prefix will expand at the end of the configure script. AC_DEFUN([AC_LIB_PREPARE_PREFIX], [ dnl Unfortunately, prefix and exec_prefix get only finally determined dnl at the end of configure. if test "X$prefix" = "XNONE"; then acl_final_prefix="$ac_default_prefix" else acl_final_prefix="$prefix" fi if test "X$exec_prefix" = "XNONE"; then acl_final_exec_prefix='${prefix}' else acl_final_exec_prefix="$exec_prefix" fi acl_save_prefix="$prefix" prefix="$acl_final_prefix" eval acl_final_exec_prefix=\"$acl_final_exec_prefix\" prefix="$acl_save_prefix" ]) dnl AC_LIB_WITH_FINAL_PREFIX([statement]) evaluates statement, with the dnl variables prefix and exec_prefix bound to the values they will have dnl at the end of the configure script. AC_DEFUN([AC_LIB_WITH_FINAL_PREFIX], [ acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" $1 exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" ]) dnl AC_LIB_PREPARE_MULTILIB creates dnl - a variable acl_libdirstem, containing the basename of the libdir, either dnl "lib" or "lib64" or "lib/64", dnl - a variable acl_libdirstem2, as a secondary possible value for dnl acl_libdirstem, either the same as acl_libdirstem or "lib/sparcv9" or dnl "lib/amd64". AC_DEFUN([AC_LIB_PREPARE_MULTILIB], [ dnl There is no formal standard regarding lib and lib64. dnl On glibc systems, the current practice is that on a system supporting dnl 32-bit and 64-bit instruction sets or ABIs, 64-bit libraries go under dnl $prefix/lib64 and 32-bit libraries go under $prefix/lib. We determine dnl the compiler's default mode by looking at the compiler's library search dnl path. If at least one of its elements ends in /lib64 or points to a dnl directory whose absolute pathname ends in /lib64, we assume a 64-bit ABI. dnl Otherwise we use the default, namely "lib". dnl On Solaris systems, the current practice is that on a system supporting dnl 32-bit and 64-bit instruction sets or ABIs, 64-bit libraries go under dnl $prefix/lib/64 (which is a symlink to either $prefix/lib/sparcv9 or dnl $prefix/lib/amd64) and 32-bit libraries go under $prefix/lib. AC_REQUIRE([AC_CANONICAL_HOST]) acl_libdirstem=lib acl_libdirstem2= case "$host_os" in solaris*) dnl See Solaris 10 Software Developer Collection > Solaris 64-bit Developer's Guide > The Development Environment dnl . dnl "Portable Makefiles should refer to any library directories using the 64 symbolic link." dnl But we want to recognize the sparcv9 or amd64 subdirectory also if the dnl symlink is missing, so we set acl_libdirstem2 too. AC_CACHE_CHECK([for 64-bit host], [gl_cv_solaris_64bit], [AC_EGREP_CPP([sixtyfour bits], [ #ifdef _LP64 sixtyfour bits #endif ], [gl_cv_solaris_64bit=yes], [gl_cv_solaris_64bit=no]) ]) if test $gl_cv_solaris_64bit = yes; then acl_libdirstem=lib/64 case "$host_cpu" in sparc*) acl_libdirstem2=lib/sparcv9 ;; i*86 | x86_64) acl_libdirstem2=lib/amd64 ;; esac fi ;; *) searchpath=`(LC_ALL=C $CC -print-search-dirs) 2>/dev/null | sed -n -e 's,^libraries: ,,p' | sed -e 's,^=,,'` if test -n "$searchpath"; then acl_save_IFS="${IFS= }"; IFS=":" for searchdir in $searchpath; do if test -d "$searchdir"; then case "$searchdir" in */lib64/ | */lib64 ) acl_libdirstem=lib64 ;; */../ | */.. ) # Better ignore directories of this form. They are misleading. ;; *) searchdir=`cd "$searchdir" && pwd` case "$searchdir" in */lib64 ) acl_libdirstem=lib64 ;; esac ;; esac fi done IFS="$acl_save_IFS" fi ;; esac test -n "$acl_libdirstem2" || acl_libdirstem2="$acl_libdirstem" ]) suricata-3.2.1/libhtp/m4/iconv.m40000644000000000000000000001653713051004451013406 00000000000000# iconv.m4 serial 11 (gettext-0.18.1) dnl Copyright (C) 2000-2002, 2007-2010 Free Software Foundation, Inc. dnl This file is free software; the Free Software Foundation dnl gives unlimited permission to copy and/or distribute it, dnl with or without modifications, as long as this notice is preserved. dnl From Bruno Haible. AC_DEFUN([AM_ICONV_LINKFLAGS_BODY], [ dnl Prerequisites of AC_LIB_LINKFLAGS_BODY. AC_REQUIRE([AC_LIB_PREPARE_PREFIX]) AC_REQUIRE([AC_LIB_RPATH]) dnl Search for libiconv and define LIBICONV, LTLIBICONV and INCICONV dnl accordingly. AC_LIB_LINKFLAGS_BODY([iconv]) ]) AC_DEFUN([AM_ICONV_LINK], [ dnl Some systems have iconv in libc, some have it in libiconv (OSF/1 and dnl those with the standalone portable GNU libiconv installed). AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles dnl Search for libiconv and define LIBICONV, LTLIBICONV and INCICONV dnl accordingly. AC_REQUIRE([AM_ICONV_LINKFLAGS_BODY]) dnl Add $INCICONV to CPPFLAGS before performing the following checks, dnl because if the user has installed libiconv and not disabled its use dnl via --without-libiconv-prefix, he wants to use it. The first dnl AC_TRY_LINK will then fail, the second AC_TRY_LINK will succeed. am_save_CPPFLAGS="$CPPFLAGS" AC_LIB_APPENDTOVAR([CPPFLAGS], [$INCICONV]) AC_CACHE_CHECK([for iconv], [am_cv_func_iconv], [ am_cv_func_iconv="no, consider installing GNU libiconv" am_cv_lib_iconv=no AC_TRY_LINK([#include #include ], [iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd);], [am_cv_func_iconv=yes]) if test "$am_cv_func_iconv" != yes; then am_save_LIBS="$LIBS" LIBS="$LIBS $LIBICONV" AC_TRY_LINK([#include #include ], [iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd);], [am_cv_lib_iconv=yes] [am_cv_func_iconv=yes]) LIBS="$am_save_LIBS" fi ]) if test "$am_cv_func_iconv" = yes; then AC_CACHE_CHECK([for working iconv], [am_cv_func_iconv_works], [ dnl This tests against bugs in AIX 5.1, HP-UX 11.11, Solaris 10. am_save_LIBS="$LIBS" if test $am_cv_lib_iconv = yes; then LIBS="$LIBS $LIBICONV" fi AC_TRY_RUN([ #include #include int main () { /* Test against AIX 5.1 bug: Failures are not distinguishable from successful returns. */ { iconv_t cd_utf8_to_88591 = iconv_open ("ISO8859-1", "UTF-8"); if (cd_utf8_to_88591 != (iconv_t)(-1)) { static const char input[] = "\342\202\254"; /* EURO SIGN */ char buf[10]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_utf8_to_88591, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if (res == 0) return 1; } } /* Test against Solaris 10 bug: Failures are not distinguishable from successful returns. */ { iconv_t cd_ascii_to_88591 = iconv_open ("ISO8859-1", "646"); if (cd_ascii_to_88591 != (iconv_t)(-1)) { static const char input[] = "\263"; char buf[10]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_ascii_to_88591, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if (res == 0) return 1; } } #if 0 /* This bug could be worked around by the caller. */ /* Test against HP-UX 11.11 bug: Positive return value instead of 0. */ { iconv_t cd_88591_to_utf8 = iconv_open ("utf8", "iso88591"); if (cd_88591_to_utf8 != (iconv_t)(-1)) { static const char input[] = "\304rger mit b\366sen B\374bchen ohne Augenma\337"; char buf[50]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_88591_to_utf8, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if ((int)res > 0) return 1; } } #endif /* Test against HP-UX 11.11 bug: No converter from EUC-JP to UTF-8 is provided. */ if (/* Try standardized names. */ iconv_open ("UTF-8", "EUC-JP") == (iconv_t)(-1) /* Try IRIX, OSF/1 names. */ && iconv_open ("UTF-8", "eucJP") == (iconv_t)(-1) /* Try AIX names. */ && iconv_open ("UTF-8", "IBM-eucJP") == (iconv_t)(-1) /* Try HP-UX names. */ && iconv_open ("utf8", "eucJP") == (iconv_t)(-1)) return 1; return 0; }], [am_cv_func_iconv_works=yes], [am_cv_func_iconv_works=no], [case "$host_os" in aix* | hpux*) am_cv_func_iconv_works="guessing no" ;; *) am_cv_func_iconv_works="guessing yes" ;; esac]) LIBS="$am_save_LIBS" ]) case "$am_cv_func_iconv_works" in *no) am_func_iconv=no am_cv_lib_iconv=no ;; *) am_func_iconv=yes ;; esac else am_func_iconv=no am_cv_lib_iconv=no fi if test "$am_func_iconv" = yes; then AC_DEFINE([HAVE_ICONV], [1], [Define if you have the iconv() function and it works.]) fi if test "$am_cv_lib_iconv" = yes; then AC_MSG_CHECKING([how to link with libiconv]) AC_MSG_RESULT([$LIBICONV]) else dnl If $LIBICONV didn't lead to a usable library, we don't need $INCICONV dnl either. CPPFLAGS="$am_save_CPPFLAGS" LIBICONV= LTLIBICONV= fi AC_SUBST([LIBICONV]) AC_SUBST([LTLIBICONV]) ]) dnl Define AM_ICONV using AC_DEFUN_ONCE for Autoconf >= 2.64, in order to dnl avoid warnings like dnl "warning: AC_REQUIRE: `AM_ICONV' was expanded before it was required". dnl This is tricky because of the way 'aclocal' is implemented: dnl - It requires defining an auxiliary macro whose name ends in AC_DEFUN. dnl Otherwise aclocal's initial scan pass would miss the macro definition. dnl - It requires a line break inside the AC_DEFUN_ONCE and AC_DEFUN expansions. dnl Otherwise aclocal would emit many "Use of uninitialized value $1" dnl warnings. m4_define([gl_iconv_AC_DEFUN], m4_version_prereq([2.64], [[AC_DEFUN_ONCE( [$1], [$2])]], [[AC_DEFUN( [$1], [$2])]])) gl_iconv_AC_DEFUN([AM_ICONV], [ AM_ICONV_LINK if test "$am_cv_func_iconv" = yes; then AC_MSG_CHECKING([for iconv declaration]) AC_CACHE_VAL([am_cv_proto_iconv], [ AC_TRY_COMPILE([ #include #include extern #ifdef __cplusplus "C" #endif #if defined(__STDC__) || defined(__cplusplus) size_t iconv (iconv_t cd, char * *inbuf, size_t *inbytesleft, char * *outbuf, size_t *outbytesleft); #else size_t iconv(); #endif ], [], [am_cv_proto_iconv_arg1=""], [am_cv_proto_iconv_arg1="const"]) am_cv_proto_iconv="extern size_t iconv (iconv_t cd, $am_cv_proto_iconv_arg1 char * *inbuf, size_t *inbytesleft, char * *outbuf, size_t *outbytesleft);"]) am_cv_proto_iconv=`echo "[$]am_cv_proto_iconv" | tr -s ' ' | sed -e 's/( /(/'` AC_MSG_RESULT([ $am_cv_proto_iconv]) AC_DEFINE_UNQUOTED([ICONV_CONST], [$am_cv_proto_iconv_arg1], [Define as const if the declaration of iconv() needs const.]) fi ]) suricata-3.2.1/libhtp/m4/ltoptions.m40000644000000000000000000003426213051004460014316 00000000000000# Helper functions for option handling. -*- Autoconf -*- # # Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software # Foundation, Inc. # Written by Gary V. Vaughan, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 8 ltoptions.m4 # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTOPTIONS_VERSION], [m4_if([1])]) # _LT_MANGLE_OPTION(MACRO-NAME, OPTION-NAME) # ------------------------------------------ m4_define([_LT_MANGLE_OPTION], [[_LT_OPTION_]m4_bpatsubst($1__$2, [[^a-zA-Z0-9_]], [_])]) # _LT_SET_OPTION(MACRO-NAME, OPTION-NAME) # --------------------------------------- # Set option OPTION-NAME for macro MACRO-NAME, and if there is a # matching handler defined, dispatch to it. Other OPTION-NAMEs are # saved as a flag. m4_define([_LT_SET_OPTION], [m4_define(_LT_MANGLE_OPTION([$1], [$2]))dnl m4_ifdef(_LT_MANGLE_DEFUN([$1], [$2]), _LT_MANGLE_DEFUN([$1], [$2]), [m4_warning([Unknown $1 option '$2'])])[]dnl ]) # _LT_IF_OPTION(MACRO-NAME, OPTION-NAME, IF-SET, [IF-NOT-SET]) # ------------------------------------------------------------ # Execute IF-SET if OPTION is set, IF-NOT-SET otherwise. m4_define([_LT_IF_OPTION], [m4_ifdef(_LT_MANGLE_OPTION([$1], [$2]), [$3], [$4])]) # _LT_UNLESS_OPTIONS(MACRO-NAME, OPTION-LIST, IF-NOT-SET) # ------------------------------------------------------- # Execute IF-NOT-SET unless all options in OPTION-LIST for MACRO-NAME # are set. m4_define([_LT_UNLESS_OPTIONS], [m4_foreach([_LT_Option], m4_split(m4_normalize([$2])), [m4_ifdef(_LT_MANGLE_OPTION([$1], _LT_Option), [m4_define([$0_found])])])[]dnl m4_ifdef([$0_found], [m4_undefine([$0_found])], [$3 ])[]dnl ]) # _LT_SET_OPTIONS(MACRO-NAME, OPTION-LIST) # ---------------------------------------- # OPTION-LIST is a space-separated list of Libtool options associated # with MACRO-NAME. If any OPTION has a matching handler declared with # LT_OPTION_DEFINE, dispatch to that macro; otherwise complain about # the unknown option and exit. m4_defun([_LT_SET_OPTIONS], [# Set options m4_foreach([_LT_Option], m4_split(m4_normalize([$2])), [_LT_SET_OPTION([$1], _LT_Option)]) m4_if([$1],[LT_INIT],[ dnl dnl Simply set some default values (i.e off) if boolean options were not dnl specified: _LT_UNLESS_OPTIONS([LT_INIT], [dlopen], [enable_dlopen=no ]) _LT_UNLESS_OPTIONS([LT_INIT], [win32-dll], [enable_win32_dll=no ]) dnl dnl If no reference was made to various pairs of opposing options, then dnl we run the default mode handler for the pair. For example, if neither dnl 'shared' nor 'disable-shared' was passed, we enable building of shared dnl archives by default: _LT_UNLESS_OPTIONS([LT_INIT], [shared disable-shared], [_LT_ENABLE_SHARED]) _LT_UNLESS_OPTIONS([LT_INIT], [static disable-static], [_LT_ENABLE_STATIC]) _LT_UNLESS_OPTIONS([LT_INIT], [pic-only no-pic], [_LT_WITH_PIC]) _LT_UNLESS_OPTIONS([LT_INIT], [fast-install disable-fast-install], [_LT_ENABLE_FAST_INSTALL]) _LT_UNLESS_OPTIONS([LT_INIT], [aix-soname=aix aix-soname=both aix-soname=svr4], [_LT_WITH_AIX_SONAME([aix])]) ]) ])# _LT_SET_OPTIONS ## --------------------------------- ## ## Macros to handle LT_INIT options. ## ## --------------------------------- ## # _LT_MANGLE_DEFUN(MACRO-NAME, OPTION-NAME) # ----------------------------------------- m4_define([_LT_MANGLE_DEFUN], [[_LT_OPTION_DEFUN_]m4_bpatsubst(m4_toupper([$1__$2]), [[^A-Z0-9_]], [_])]) # LT_OPTION_DEFINE(MACRO-NAME, OPTION-NAME, CODE) # ----------------------------------------------- m4_define([LT_OPTION_DEFINE], [m4_define(_LT_MANGLE_DEFUN([$1], [$2]), [$3])[]dnl ])# LT_OPTION_DEFINE # dlopen # ------ LT_OPTION_DEFINE([LT_INIT], [dlopen], [enable_dlopen=yes ]) AU_DEFUN([AC_LIBTOOL_DLOPEN], [_LT_SET_OPTION([LT_INIT], [dlopen]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'dlopen' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_DLOPEN], []) # win32-dll # --------- # Declare package support for building win32 dll's. LT_OPTION_DEFINE([LT_INIT], [win32-dll], [enable_win32_dll=yes case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-cegcc*) AC_CHECK_TOOL(AS, as, false) AC_CHECK_TOOL(DLLTOOL, dlltool, false) AC_CHECK_TOOL(OBJDUMP, objdump, false) ;; esac test -z "$AS" && AS=as _LT_DECL([], [AS], [1], [Assembler program])dnl test -z "$DLLTOOL" && DLLTOOL=dlltool _LT_DECL([], [DLLTOOL], [1], [DLL creation program])dnl test -z "$OBJDUMP" && OBJDUMP=objdump _LT_DECL([], [OBJDUMP], [1], [Object dumper program])dnl ])# win32-dll AU_DEFUN([AC_LIBTOOL_WIN32_DLL], [AC_REQUIRE([AC_CANONICAL_HOST])dnl _LT_SET_OPTION([LT_INIT], [win32-dll]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'win32-dll' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_WIN32_DLL], []) # _LT_ENABLE_SHARED([DEFAULT]) # ---------------------------- # implement the --enable-shared flag, and supports the 'shared' and # 'disable-shared' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_SHARED], [m4_define([_LT_ENABLE_SHARED_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([shared], [AS_HELP_STRING([--enable-shared@<:@=PKGS@:>@], [build shared libraries @<:@default=]_LT_ENABLE_SHARED_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_shared=yes ;; no) enable_shared=no ;; *) enable_shared=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_shared=yes fi done IFS=$lt_save_ifs ;; esac], [enable_shared=]_LT_ENABLE_SHARED_DEFAULT) _LT_DECL([build_libtool_libs], [enable_shared], [0], [Whether or not to build shared libraries]) ])# _LT_ENABLE_SHARED LT_OPTION_DEFINE([LT_INIT], [shared], [_LT_ENABLE_SHARED([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-shared], [_LT_ENABLE_SHARED([no])]) # Old names: AC_DEFUN([AC_ENABLE_SHARED], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[shared]) ]) AC_DEFUN([AC_DISABLE_SHARED], [_LT_SET_OPTION([LT_INIT], [disable-shared]) ]) AU_DEFUN([AM_ENABLE_SHARED], [AC_ENABLE_SHARED($@)]) AU_DEFUN([AM_DISABLE_SHARED], [AC_DISABLE_SHARED($@)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_ENABLE_SHARED], []) dnl AC_DEFUN([AM_DISABLE_SHARED], []) # _LT_ENABLE_STATIC([DEFAULT]) # ---------------------------- # implement the --enable-static flag, and support the 'static' and # 'disable-static' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_STATIC], [m4_define([_LT_ENABLE_STATIC_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([static], [AS_HELP_STRING([--enable-static@<:@=PKGS@:>@], [build static libraries @<:@default=]_LT_ENABLE_STATIC_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_static=yes ;; no) enable_static=no ;; *) enable_static=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_static=yes fi done IFS=$lt_save_ifs ;; esac], [enable_static=]_LT_ENABLE_STATIC_DEFAULT) _LT_DECL([build_old_libs], [enable_static], [0], [Whether or not to build static libraries]) ])# _LT_ENABLE_STATIC LT_OPTION_DEFINE([LT_INIT], [static], [_LT_ENABLE_STATIC([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-static], [_LT_ENABLE_STATIC([no])]) # Old names: AC_DEFUN([AC_ENABLE_STATIC], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[static]) ]) AC_DEFUN([AC_DISABLE_STATIC], [_LT_SET_OPTION([LT_INIT], [disable-static]) ]) AU_DEFUN([AM_ENABLE_STATIC], [AC_ENABLE_STATIC($@)]) AU_DEFUN([AM_DISABLE_STATIC], [AC_DISABLE_STATIC($@)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_ENABLE_STATIC], []) dnl AC_DEFUN([AM_DISABLE_STATIC], []) # _LT_ENABLE_FAST_INSTALL([DEFAULT]) # ---------------------------------- # implement the --enable-fast-install flag, and support the 'fast-install' # and 'disable-fast-install' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_FAST_INSTALL], [m4_define([_LT_ENABLE_FAST_INSTALL_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([fast-install], [AS_HELP_STRING([--enable-fast-install@<:@=PKGS@:>@], [optimize for fast installation @<:@default=]_LT_ENABLE_FAST_INSTALL_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_fast_install=yes ;; no) enable_fast_install=no ;; *) enable_fast_install=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_fast_install=yes fi done IFS=$lt_save_ifs ;; esac], [enable_fast_install=]_LT_ENABLE_FAST_INSTALL_DEFAULT) _LT_DECL([fast_install], [enable_fast_install], [0], [Whether or not to optimize for fast installation])dnl ])# _LT_ENABLE_FAST_INSTALL LT_OPTION_DEFINE([LT_INIT], [fast-install], [_LT_ENABLE_FAST_INSTALL([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-fast-install], [_LT_ENABLE_FAST_INSTALL([no])]) # Old names: AU_DEFUN([AC_ENABLE_FAST_INSTALL], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[fast-install]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'fast-install' option into LT_INIT's first parameter.]) ]) AU_DEFUN([AC_DISABLE_FAST_INSTALL], [_LT_SET_OPTION([LT_INIT], [disable-fast-install]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'disable-fast-install' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_ENABLE_FAST_INSTALL], []) dnl AC_DEFUN([AM_DISABLE_FAST_INSTALL], []) # _LT_WITH_AIX_SONAME([DEFAULT]) # ---------------------------------- # implement the --with-aix-soname flag, and support the `aix-soname=aix' # and `aix-soname=both' and `aix-soname=svr4' LT_INIT options. DEFAULT # is either `aix', `both' or `svr4'. If omitted, it defaults to `aix'. m4_define([_LT_WITH_AIX_SONAME], [m4_define([_LT_WITH_AIX_SONAME_DEFAULT], [m4_if($1, svr4, svr4, m4_if($1, both, both, aix))])dnl shared_archive_member_spec= case $host,$enable_shared in power*-*-aix[[5-9]]*,yes) AC_MSG_CHECKING([which variant of shared library versioning to provide]) AC_ARG_WITH([aix-soname], [AS_HELP_STRING([--with-aix-soname=aix|svr4|both], [shared library versioning (aka "SONAME") variant to provide on AIX, @<:@default=]_LT_WITH_AIX_SONAME_DEFAULT[@:>@.])], [case $withval in aix|svr4|both) ;; *) AC_MSG_ERROR([Unknown argument to --with-aix-soname]) ;; esac lt_cv_with_aix_soname=$with_aix_soname], [AC_CACHE_VAL([lt_cv_with_aix_soname], [lt_cv_with_aix_soname=]_LT_WITH_AIX_SONAME_DEFAULT) with_aix_soname=$lt_cv_with_aix_soname]) AC_MSG_RESULT([$with_aix_soname]) if test aix != "$with_aix_soname"; then # For the AIX way of multilib, we name the shared archive member # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o', # and 'shr.imp' or 'shr_64.imp', respectively, for the Import File. # Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag, # the AIX toolchain works better with OBJECT_MODE set (default 32). if test 64 = "${OBJECT_MODE-32}"; then shared_archive_member_spec=shr_64 else shared_archive_member_spec=shr fi fi ;; *) with_aix_soname=aix ;; esac _LT_DECL([], [shared_archive_member_spec], [0], [Shared archive member basename, for filename based shared library versioning on AIX])dnl ])# _LT_WITH_AIX_SONAME LT_OPTION_DEFINE([LT_INIT], [aix-soname=aix], [_LT_WITH_AIX_SONAME([aix])]) LT_OPTION_DEFINE([LT_INIT], [aix-soname=both], [_LT_WITH_AIX_SONAME([both])]) LT_OPTION_DEFINE([LT_INIT], [aix-soname=svr4], [_LT_WITH_AIX_SONAME([svr4])]) # _LT_WITH_PIC([MODE]) # -------------------- # implement the --with-pic flag, and support the 'pic-only' and 'no-pic' # LT_INIT options. # MODE is either 'yes' or 'no'. If omitted, it defaults to 'both'. m4_define([_LT_WITH_PIC], [AC_ARG_WITH([pic], [AS_HELP_STRING([--with-pic@<:@=PKGS@:>@], [try to use only PIC/non-PIC objects @<:@default=use both@:>@])], [lt_p=${PACKAGE-default} case $withval in yes|no) pic_mode=$withval ;; *) pic_mode=default # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for lt_pkg in $withval; do IFS=$lt_save_ifs if test "X$lt_pkg" = "X$lt_p"; then pic_mode=yes fi done IFS=$lt_save_ifs ;; esac], [pic_mode=m4_default([$1], [default])]) _LT_DECL([], [pic_mode], [0], [What type of objects to build])dnl ])# _LT_WITH_PIC LT_OPTION_DEFINE([LT_INIT], [pic-only], [_LT_WITH_PIC([yes])]) LT_OPTION_DEFINE([LT_INIT], [no-pic], [_LT_WITH_PIC([no])]) # Old name: AU_DEFUN([AC_LIBTOOL_PICMODE], [_LT_SET_OPTION([LT_INIT], [pic-only]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'pic-only' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_PICMODE], []) ## ----------------- ## ## LTDL_INIT Options ## ## ----------------- ## m4_define([_LTDL_MODE], []) LT_OPTION_DEFINE([LTDL_INIT], [nonrecursive], [m4_define([_LTDL_MODE], [nonrecursive])]) LT_OPTION_DEFINE([LTDL_INIT], [recursive], [m4_define([_LTDL_MODE], [recursive])]) LT_OPTION_DEFINE([LTDL_INIT], [subproject], [m4_define([_LTDL_MODE], [subproject])]) m4_define([_LTDL_TYPE], []) LT_OPTION_DEFINE([LTDL_INIT], [installable], [m4_define([_LTDL_TYPE], [installable])]) LT_OPTION_DEFINE([LTDL_INIT], [convenience], [m4_define([_LTDL_TYPE], [convenience])]) suricata-3.2.1/libhtp/m4/lib-ld.m40000644000000000000000000000660313051004451013424 00000000000000# lib-ld.m4 serial 4 (gettext-0.18) dnl Copyright (C) 1996-2003, 2009-2010 Free Software Foundation, Inc. dnl This file is free software; the Free Software Foundation dnl gives unlimited permission to copy and/or distribute it, dnl with or without modifications, as long as this notice is preserved. dnl Subroutines of libtool.m4, dnl with replacements s/AC_/AC_LIB/ and s/lt_cv/acl_cv/ to avoid collision dnl with libtool.m4. dnl From libtool-1.4. Sets the variable with_gnu_ld to yes or no. AC_DEFUN([AC_LIB_PROG_LD_GNU], [AC_CACHE_CHECK([if the linker ($LD) is GNU ld], [acl_cv_prog_gnu_ld], [# I'd rather use --version here, but apparently some GNU ld's only accept -v. case `$LD -v 2>&1 conf$$.sh echo "exit 0" >>conf$$.sh chmod +x conf$$.sh if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then PATH_SEPARATOR=';' else PATH_SEPARATOR=: fi rm -f conf$$.sh fi ac_prog=ld if test "$GCC" = yes; then # Check if gcc -print-prog-name=ld gives a path. AC_MSG_CHECKING([for ld used by GCC]) case $host in *-*-mingw*) # gcc leaves a trailing carriage return which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [[\\/]* | [A-Za-z]:[\\/]*)] [re_direlt='/[^/][^/]*/\.\./'] # Canonicalize the path of ld ac_prog=`echo $ac_prog| sed 's%\\\\%/%g'` while echo $ac_prog | grep "$re_direlt" > /dev/null 2>&1; do ac_prog=`echo $ac_prog| sed "s%$re_direlt%/%"` done test -z "$LD" && LD="$ac_prog" ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test "$with_gnu_ld" = yes; then AC_MSG_CHECKING([for GNU ld]) else AC_MSG_CHECKING([for non-GNU ld]) fi AC_CACHE_VAL([acl_cv_path_LD], [if test -z "$LD"; then IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}${PATH_SEPARATOR-:}" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then acl_cv_path_LD="$ac_dir/$ac_prog" # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some GNU ld's only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$acl_cv_path_LD" -v 2>&1 < /dev/null` in *GNU* | *'with BFD'*) test "$with_gnu_ld" != no && break ;; *) test "$with_gnu_ld" != yes && break ;; esac fi done IFS="$ac_save_ifs" else acl_cv_path_LD="$LD" # Let the user override the test with a path. fi]) LD="$acl_cv_path_LD" if test -n "$LD"; then AC_MSG_RESULT([$LD]) else AC_MSG_RESULT([no]) fi test -z "$LD" && AC_MSG_ERROR([no acceptable ld found in \$PATH]) AC_LIB_PROG_LD_GNU ]) suricata-3.2.1/libhtp/m4/lib-link.m40000644000000000000000000010020213051004451013750 00000000000000# lib-link.m4 serial 21 (gettext-0.18) dnl Copyright (C) 2001-2010 Free Software Foundation, Inc. dnl This file is free software; the Free Software Foundation dnl gives unlimited permission to copy and/or distribute it, dnl with or without modifications, as long as this notice is preserved. dnl From Bruno Haible. AC_PREREQ([2.54]) dnl AC_LIB_LINKFLAGS(name [, dependencies]) searches for libname and dnl the libraries corresponding to explicit and implicit dependencies. dnl Sets and AC_SUBSTs the LIB${NAME} and LTLIB${NAME} variables and dnl augments the CPPFLAGS variable. dnl Sets and AC_SUBSTs the LIB${NAME}_PREFIX variable to nonempty if libname dnl was found in ${LIB${NAME}_PREFIX}/$acl_libdirstem. AC_DEFUN([AC_LIB_LINKFLAGS], [ AC_REQUIRE([AC_LIB_PREPARE_PREFIX]) AC_REQUIRE([AC_LIB_RPATH]) pushdef([Name],[translit([$1],[./-], [___])]) pushdef([NAME],[translit([$1],[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) AC_CACHE_CHECK([how to link with lib[]$1], [ac_cv_lib[]Name[]_libs], [ AC_LIB_LINKFLAGS_BODY([$1], [$2]) ac_cv_lib[]Name[]_libs="$LIB[]NAME" ac_cv_lib[]Name[]_ltlibs="$LTLIB[]NAME" ac_cv_lib[]Name[]_cppflags="$INC[]NAME" ac_cv_lib[]Name[]_prefix="$LIB[]NAME[]_PREFIX" ]) LIB[]NAME="$ac_cv_lib[]Name[]_libs" LTLIB[]NAME="$ac_cv_lib[]Name[]_ltlibs" INC[]NAME="$ac_cv_lib[]Name[]_cppflags" LIB[]NAME[]_PREFIX="$ac_cv_lib[]Name[]_prefix" AC_LIB_APPENDTOVAR([CPPFLAGS], [$INC]NAME) AC_SUBST([LIB]NAME) AC_SUBST([LTLIB]NAME) AC_SUBST([LIB]NAME[_PREFIX]) dnl Also set HAVE_LIB[]NAME so that AC_LIB_HAVE_LINKFLAGS can reuse the dnl results of this search when this library appears as a dependency. HAVE_LIB[]NAME=yes popdef([NAME]) popdef([Name]) ]) dnl AC_LIB_HAVE_LINKFLAGS(name, dependencies, includes, testcode, [missing-message]) dnl searches for libname and the libraries corresponding to explicit and dnl implicit dependencies, together with the specified include files and dnl the ability to compile and link the specified testcode. The missing-message dnl defaults to 'no' and may contain additional hints for the user. dnl If found, it sets and AC_SUBSTs HAVE_LIB${NAME}=yes and the LIB${NAME} dnl and LTLIB${NAME} variables and augments the CPPFLAGS variable, and dnl #defines HAVE_LIB${NAME} to 1. Otherwise, it sets and AC_SUBSTs dnl HAVE_LIB${NAME}=no and LIB${NAME} and LTLIB${NAME} to empty. dnl Sets and AC_SUBSTs the LIB${NAME}_PREFIX variable to nonempty if libname dnl was found in ${LIB${NAME}_PREFIX}/$acl_libdirstem. AC_DEFUN([AC_LIB_HAVE_LINKFLAGS], [ AC_REQUIRE([AC_LIB_PREPARE_PREFIX]) AC_REQUIRE([AC_LIB_RPATH]) pushdef([Name],[translit([$1],[./-], [___])]) pushdef([NAME],[translit([$1],[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) dnl Search for lib[]Name and define LIB[]NAME, LTLIB[]NAME and INC[]NAME dnl accordingly. AC_LIB_LINKFLAGS_BODY([$1], [$2]) dnl Add $INC[]NAME to CPPFLAGS before performing the following checks, dnl because if the user has installed lib[]Name and not disabled its use dnl via --without-lib[]Name-prefix, he wants to use it. ac_save_CPPFLAGS="$CPPFLAGS" AC_LIB_APPENDTOVAR([CPPFLAGS], [$INC]NAME) AC_CACHE_CHECK([for lib[]$1], [ac_cv_lib[]Name], [ ac_save_LIBS="$LIBS" dnl If $LIB[]NAME contains some -l options, add it to the end of LIBS, dnl because these -l options might require -L options that are present in dnl LIBS. -l options benefit only from the -L options listed before it. dnl Otherwise, add it to the front of LIBS, because it may be a static dnl library that depends on another static library that is present in LIBS. dnl Static libraries benefit only from the static libraries listed after dnl it. case " $LIB[]NAME" in *" -l"*) LIBS="$LIBS $LIB[]NAME" ;; *) LIBS="$LIB[]NAME $LIBS" ;; esac AC_TRY_LINK([$3], [$4], [ac_cv_lib[]Name=yes], [ac_cv_lib[]Name='m4_if([$5], [], [no], [[$5]])']) LIBS="$ac_save_LIBS" ]) if test "$ac_cv_lib[]Name" = yes; then HAVE_LIB[]NAME=yes AC_DEFINE([HAVE_LIB]NAME, 1, [Define if you have the lib][$1 library.]) AC_MSG_CHECKING([how to link with lib[]$1]) AC_MSG_RESULT([$LIB[]NAME]) else HAVE_LIB[]NAME=no dnl If $LIB[]NAME didn't lead to a usable library, we don't need dnl $INC[]NAME either. CPPFLAGS="$ac_save_CPPFLAGS" LIB[]NAME= LTLIB[]NAME= LIB[]NAME[]_PREFIX= fi AC_SUBST([HAVE_LIB]NAME) AC_SUBST([LIB]NAME) AC_SUBST([LTLIB]NAME) AC_SUBST([LIB]NAME[_PREFIX]) popdef([NAME]) popdef([Name]) ]) dnl Determine the platform dependent parameters needed to use rpath: dnl acl_libext, dnl acl_shlibext, dnl acl_hardcode_libdir_flag_spec, dnl acl_hardcode_libdir_separator, dnl acl_hardcode_direct, dnl acl_hardcode_minus_L. AC_DEFUN([AC_LIB_RPATH], [ dnl Tell automake >= 1.10 to complain if config.rpath is missing. m4_ifdef([AC_REQUIRE_AUX_FILE], [AC_REQUIRE_AUX_FILE([config.rpath])]) AC_REQUIRE([AC_PROG_CC]) dnl we use $CC, $GCC, $LDFLAGS AC_REQUIRE([AC_LIB_PROG_LD]) dnl we use $LD, $with_gnu_ld AC_REQUIRE([AC_CANONICAL_HOST]) dnl we use $host AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT]) dnl we use $ac_aux_dir AC_CACHE_CHECK([for shared library run path origin], [acl_cv_rpath], [ CC="$CC" GCC="$GCC" LDFLAGS="$LDFLAGS" LD="$LD" with_gnu_ld="$with_gnu_ld" \ ${CONFIG_SHELL-/bin/sh} "$ac_aux_dir/config.rpath" "$host" > conftest.sh . ./conftest.sh rm -f ./conftest.sh acl_cv_rpath=done ]) wl="$acl_cv_wl" acl_libext="$acl_cv_libext" acl_shlibext="$acl_cv_shlibext" acl_libname_spec="$acl_cv_libname_spec" acl_library_names_spec="$acl_cv_library_names_spec" acl_hardcode_libdir_flag_spec="$acl_cv_hardcode_libdir_flag_spec" acl_hardcode_libdir_separator="$acl_cv_hardcode_libdir_separator" acl_hardcode_direct="$acl_cv_hardcode_direct" acl_hardcode_minus_L="$acl_cv_hardcode_minus_L" dnl Determine whether the user wants rpath handling at all. AC_ARG_ENABLE([rpath], [ --disable-rpath do not hardcode runtime library paths], :, enable_rpath=yes) ]) dnl AC_LIB_FROMPACKAGE(name, package) dnl declares that libname comes from the given package. The configure file dnl will then not have a --with-libname-prefix option but a dnl --with-package-prefix option. Several libraries can come from the same dnl package. This declaration must occur before an AC_LIB_LINKFLAGS or similar dnl macro call that searches for libname. AC_DEFUN([AC_LIB_FROMPACKAGE], [ pushdef([NAME],[translit([$1],[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) define([acl_frompackage_]NAME, [$2]) popdef([NAME]) pushdef([PACK],[$2]) pushdef([PACKUP],[translit(PACK,[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) define([acl_libsinpackage_]PACKUP, m4_ifdef([acl_libsinpackage_]PACKUP, [acl_libsinpackage_]PACKUP[[, ]],)[lib$1]) popdef([PACKUP]) popdef([PACK]) ]) dnl AC_LIB_LINKFLAGS_BODY(name [, dependencies]) searches for libname and dnl the libraries corresponding to explicit and implicit dependencies. dnl Sets the LIB${NAME}, LTLIB${NAME} and INC${NAME} variables. dnl Also, sets the LIB${NAME}_PREFIX variable to nonempty if libname was found dnl in ${LIB${NAME}_PREFIX}/$acl_libdirstem. AC_DEFUN([AC_LIB_LINKFLAGS_BODY], [ AC_REQUIRE([AC_LIB_PREPARE_MULTILIB]) pushdef([NAME],[translit([$1],[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) pushdef([PACK],[m4_ifdef([acl_frompackage_]NAME, [acl_frompackage_]NAME, lib[$1])]) pushdef([PACKUP],[translit(PACK,[abcdefghijklmnopqrstuvwxyz./-], [ABCDEFGHIJKLMNOPQRSTUVWXYZ___])]) pushdef([PACKLIBS],[m4_ifdef([acl_frompackage_]NAME, [acl_libsinpackage_]PACKUP, lib[$1])]) dnl Autoconf >= 2.61 supports dots in --with options. pushdef([P_A_C_K],[m4_if(m4_version_compare(m4_defn([m4_PACKAGE_VERSION]),[2.61]),[-1],[translit(PACK,[.],[_])],PACK)]) dnl By default, look in $includedir and $libdir. use_additional=yes AC_LIB_WITH_FINAL_PREFIX([ eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" ]) AC_ARG_WITH(P_A_C_K[-prefix], [[ --with-]]P_A_C_K[[-prefix[=DIR] search for ]PACKLIBS[ in DIR/include and DIR/lib --without-]]P_A_C_K[[-prefix don't search for ]PACKLIBS[ in includedir and libdir]], [ if test "X$withval" = "Xno"; then use_additional=no else if test "X$withval" = "X"; then AC_LIB_WITH_FINAL_PREFIX([ eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" ]) else additional_includedir="$withval/include" additional_libdir="$withval/$acl_libdirstem" if test "$acl_libdirstem2" != "$acl_libdirstem" \ && ! test -d "$withval/$acl_libdirstem"; then additional_libdir="$withval/$acl_libdirstem2" fi fi fi ]) dnl Search the library and its dependencies in $additional_libdir and dnl $LDFLAGS. Using breadth-first-seach. LIB[]NAME= LTLIB[]NAME= INC[]NAME= LIB[]NAME[]_PREFIX= dnl HAVE_LIB${NAME} is an indicator that LIB${NAME}, LTLIB${NAME} have been dnl computed. So it has to be reset here. HAVE_LIB[]NAME= rpathdirs= ltrpathdirs= names_already_handled= names_next_round='$1 $2' while test -n "$names_next_round"; do names_this_round="$names_next_round" names_next_round= for name in $names_this_round; do already_handled= for n in $names_already_handled; do if test "$n" = "$name"; then already_handled=yes break fi done if test -z "$already_handled"; then names_already_handled="$names_already_handled $name" dnl See if it was already located by an earlier AC_LIB_LINKFLAGS dnl or AC_LIB_HAVE_LINKFLAGS call. uppername=`echo "$name" | sed -e 'y|abcdefghijklmnopqrstuvwxyz./-|ABCDEFGHIJKLMNOPQRSTUVWXYZ___|'` eval value=\"\$HAVE_LIB$uppername\" if test -n "$value"; then if test "$value" = yes; then eval value=\"\$LIB$uppername\" test -z "$value" || LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$value" eval value=\"\$LTLIB$uppername\" test -z "$value" || LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }$value" else dnl An earlier call to AC_LIB_HAVE_LINKFLAGS has determined dnl that this library doesn't exist. So just drop it. : fi else dnl Search the library lib$name in $additional_libdir and $LDFLAGS dnl and the already constructed $LIBNAME/$LTLIBNAME. found_dir= found_la= found_so= found_a= eval libname=\"$acl_libname_spec\" # typically: libname=lib$name if test -n "$acl_shlibext"; then shrext=".$acl_shlibext" # typically: shrext=.so else shrext= fi if test $use_additional = yes; then dir="$additional_libdir" dnl The same code as in the loop below: dnl First look for a shared library. if test -n "$acl_shlibext"; then if test -f "$dir/$libname$shrext"; then found_dir="$dir" found_so="$dir/$libname$shrext" else if test "$acl_library_names_spec" = '$libname$shrext$versuffix'; then ver=`(cd "$dir" && \ for f in "$libname$shrext".*; do echo "$f"; done \ | sed -e "s,^$libname$shrext\\\\.,," \ | sort -t '.' -n -r -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 \ | sed 1q ) 2>/dev/null` if test -n "$ver" && test -f "$dir/$libname$shrext.$ver"; then found_dir="$dir" found_so="$dir/$libname$shrext.$ver" fi else eval library_names=\"$acl_library_names_spec\" for f in $library_names; do if test -f "$dir/$f"; then found_dir="$dir" found_so="$dir/$f" break fi done fi fi fi dnl Then look for a static library. if test "X$found_dir" = "X"; then if test -f "$dir/$libname.$acl_libext"; then found_dir="$dir" found_a="$dir/$libname.$acl_libext" fi fi if test "X$found_dir" != "X"; then if test -f "$dir/$libname.la"; then found_la="$dir/$libname.la" fi fi fi if test "X$found_dir" = "X"; then for x in $LDFLAGS $LTLIB[]NAME; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) case "$x" in -L*) dir=`echo "X$x" | sed -e 's/^X-L//'` dnl First look for a shared library. if test -n "$acl_shlibext"; then if test -f "$dir/$libname$shrext"; then found_dir="$dir" found_so="$dir/$libname$shrext" else if test "$acl_library_names_spec" = '$libname$shrext$versuffix'; then ver=`(cd "$dir" && \ for f in "$libname$shrext".*; do echo "$f"; done \ | sed -e "s,^$libname$shrext\\\\.,," \ | sort -t '.' -n -r -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 \ | sed 1q ) 2>/dev/null` if test -n "$ver" && test -f "$dir/$libname$shrext.$ver"; then found_dir="$dir" found_so="$dir/$libname$shrext.$ver" fi else eval library_names=\"$acl_library_names_spec\" for f in $library_names; do if test -f "$dir/$f"; then found_dir="$dir" found_so="$dir/$f" break fi done fi fi fi dnl Then look for a static library. if test "X$found_dir" = "X"; then if test -f "$dir/$libname.$acl_libext"; then found_dir="$dir" found_a="$dir/$libname.$acl_libext" fi fi if test "X$found_dir" != "X"; then if test -f "$dir/$libname.la"; then found_la="$dir/$libname.la" fi fi ;; esac if test "X$found_dir" != "X"; then break fi done fi if test "X$found_dir" != "X"; then dnl Found the library. LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }-L$found_dir -l$name" if test "X$found_so" != "X"; then dnl Linking with a shared library. We attempt to hardcode its dnl directory into the executable's runpath, unless it's the dnl standard /usr/lib. if test "$enable_rpath" = no \ || test "X$found_dir" = "X/usr/$acl_libdirstem" \ || test "X$found_dir" = "X/usr/$acl_libdirstem2"; then dnl No hardcoding is needed. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$found_so" else dnl Use an explicit option to hardcode DIR into the resulting dnl binary. dnl Potentially add DIR to ltrpathdirs. dnl The ltrpathdirs will be appended to $LTLIBNAME at the end. haveit= for x in $ltrpathdirs; do if test "X$x" = "X$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then ltrpathdirs="$ltrpathdirs $found_dir" fi dnl The hardcoding into $LIBNAME is system dependent. if test "$acl_hardcode_direct" = yes; then dnl Using DIR/libNAME.so during linking hardcodes DIR into the dnl resulting binary. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$found_so" else if test -n "$acl_hardcode_libdir_flag_spec" && test "$acl_hardcode_minus_L" = no; then dnl Use an explicit option to hardcode DIR into the resulting dnl binary. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$found_so" dnl Potentially add DIR to rpathdirs. dnl The rpathdirs will be appended to $LIBNAME at the end. haveit= for x in $rpathdirs; do if test "X$x" = "X$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then rpathdirs="$rpathdirs $found_dir" fi else dnl Rely on "-L$found_dir". dnl But don't add it if it's already contained in the LDFLAGS dnl or the already constructed $LIBNAME haveit= for x in $LDFLAGS $LIB[]NAME; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-L$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }-L$found_dir" fi if test "$acl_hardcode_minus_L" != no; then dnl FIXME: Not sure whether we should use dnl "-L$found_dir -l$name" or "-L$found_dir $found_so" dnl here. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$found_so" else dnl We cannot use $acl_hardcode_runpath_var and LD_RUN_PATH dnl here, because this doesn't fit in flags passed to the dnl compiler. So give up. No hardcoding. This affects only dnl very old systems. dnl FIXME: Not sure whether we should use dnl "-L$found_dir -l$name" or "-L$found_dir $found_so" dnl here. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }-l$name" fi fi fi fi else if test "X$found_a" != "X"; then dnl Linking with a static library. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$found_a" else dnl We shouldn't come here, but anyway it's good to have a dnl fallback. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }-L$found_dir -l$name" fi fi dnl Assume the include files are nearby. additional_includedir= case "$found_dir" in */$acl_libdirstem | */$acl_libdirstem/) basedir=`echo "X$found_dir" | sed -e 's,^X,,' -e "s,/$acl_libdirstem/"'*$,,'` if test "$name" = '$1'; then LIB[]NAME[]_PREFIX="$basedir" fi additional_includedir="$basedir/include" ;; */$acl_libdirstem2 | */$acl_libdirstem2/) basedir=`echo "X$found_dir" | sed -e 's,^X,,' -e "s,/$acl_libdirstem2/"'*$,,'` if test "$name" = '$1'; then LIB[]NAME[]_PREFIX="$basedir" fi additional_includedir="$basedir/include" ;; esac if test "X$additional_includedir" != "X"; then dnl Potentially add $additional_includedir to $INCNAME. dnl But don't add it dnl 1. if it's the standard /usr/include, dnl 2. if it's /usr/local/include and we are using GCC on Linux, dnl 3. if it's already present in $CPPFLAGS or the already dnl constructed $INCNAME, dnl 4. if it doesn't exist as a directory. if test "X$additional_includedir" != "X/usr/include"; then haveit= if test "X$additional_includedir" = "X/usr/local/include"; then if test -n "$GCC"; then case $host_os in linux* | gnu* | k*bsd*-gnu) haveit=yes;; esac fi fi if test -z "$haveit"; then for x in $CPPFLAGS $INC[]NAME; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-I$additional_includedir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_includedir"; then dnl Really add $additional_includedir to $INCNAME. INC[]NAME="${INC[]NAME}${INC[]NAME:+ }-I$additional_includedir" fi fi fi fi fi dnl Look for dependencies. if test -n "$found_la"; then dnl Read the .la file. It defines the variables dnl dlname, library_names, old_library, dependency_libs, current, dnl age, revision, installed, dlopen, dlpreopen, libdir. save_libdir="$libdir" case "$found_la" in */* | *\\*) . "$found_la" ;; *) . "./$found_la" ;; esac libdir="$save_libdir" dnl We use only dependency_libs. for dep in $dependency_libs; do case "$dep" in -L*) additional_libdir=`echo "X$dep" | sed -e 's/^X-L//'` dnl Potentially add $additional_libdir to $LIBNAME and $LTLIBNAME. dnl But don't add it dnl 1. if it's the standard /usr/lib, dnl 2. if it's /usr/local/lib and we are using GCC on Linux, dnl 3. if it's already present in $LDFLAGS or the already dnl constructed $LIBNAME, dnl 4. if it doesn't exist as a directory. if test "X$additional_libdir" != "X/usr/$acl_libdirstem" \ && test "X$additional_libdir" != "X/usr/$acl_libdirstem2"; then haveit= if test "X$additional_libdir" = "X/usr/local/$acl_libdirstem" \ || test "X$additional_libdir" = "X/usr/local/$acl_libdirstem2"; then if test -n "$GCC"; then case $host_os in linux* | gnu* | k*bsd*-gnu) haveit=yes;; esac fi fi if test -z "$haveit"; then haveit= for x in $LDFLAGS $LIB[]NAME; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-L$additional_libdir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_libdir"; then dnl Really add $additional_libdir to $LIBNAME. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }-L$additional_libdir" fi fi haveit= for x in $LDFLAGS $LTLIB[]NAME; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X-L$additional_libdir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_libdir"; then dnl Really add $additional_libdir to $LTLIBNAME. LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }-L$additional_libdir" fi fi fi fi ;; -R*) dir=`echo "X$dep" | sed -e 's/^X-R//'` if test "$enable_rpath" != no; then dnl Potentially add DIR to rpathdirs. dnl The rpathdirs will be appended to $LIBNAME at the end. haveit= for x in $rpathdirs; do if test "X$x" = "X$dir"; then haveit=yes break fi done if test -z "$haveit"; then rpathdirs="$rpathdirs $dir" fi dnl Potentially add DIR to ltrpathdirs. dnl The ltrpathdirs will be appended to $LTLIBNAME at the end. haveit= for x in $ltrpathdirs; do if test "X$x" = "X$dir"; then haveit=yes break fi done if test -z "$haveit"; then ltrpathdirs="$ltrpathdirs $dir" fi fi ;; -l*) dnl Handle this in the next round. names_next_round="$names_next_round "`echo "X$dep" | sed -e 's/^X-l//'` ;; *.la) dnl Handle this in the next round. Throw away the .la's dnl directory; it is already contained in a preceding -L dnl option. names_next_round="$names_next_round "`echo "X$dep" | sed -e 's,^X.*/,,' -e 's,^lib,,' -e 's,\.la$,,'` ;; *) dnl Most likely an immediate library name. LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$dep" LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }$dep" ;; esac done fi else dnl Didn't find the library; assume it is in the system directories dnl known to the linker and runtime loader. (All the system dnl directories known to the linker should also be known to the dnl runtime loader, otherwise the system is severely misconfigured.) LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }-l$name" LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }-l$name" fi fi fi done done if test "X$rpathdirs" != "X"; then if test -n "$acl_hardcode_libdir_separator"; then dnl Weird platform: only the last -rpath option counts, the user must dnl pass all path elements in one option. We can arrange that for a dnl single library, but not when more than one $LIBNAMEs are used. alldirs= for found_dir in $rpathdirs; do alldirs="${alldirs}${alldirs:+$acl_hardcode_libdir_separator}$found_dir" done dnl Note: acl_hardcode_libdir_flag_spec uses $libdir and $wl. acl_save_libdir="$libdir" libdir="$alldirs" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$flag" else dnl The -rpath options are cumulative. for found_dir in $rpathdirs; do acl_save_libdir="$libdir" libdir="$found_dir" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" LIB[]NAME="${LIB[]NAME}${LIB[]NAME:+ }$flag" done fi fi if test "X$ltrpathdirs" != "X"; then dnl When using libtool, the option that works for both libraries and dnl executables is -R. The -R options are cumulative. for found_dir in $ltrpathdirs; do LTLIB[]NAME="${LTLIB[]NAME}${LTLIB[]NAME:+ }-R$found_dir" done fi popdef([P_A_C_K]) popdef([PACKLIBS]) popdef([PACKUP]) popdef([PACK]) popdef([NAME]) ]) dnl AC_LIB_APPENDTOVAR(VAR, CONTENTS) appends the elements of CONTENTS to VAR, dnl unless already present in VAR. dnl Works only for CPPFLAGS, not for LIB* variables because that sometimes dnl contains two or three consecutive elements that belong together. AC_DEFUN([AC_LIB_APPENDTOVAR], [ for element in [$2]; do haveit= for x in $[$1]; do AC_LIB_WITH_FINAL_PREFIX([eval x=\"$x\"]) if test "X$x" = "X$element"; then haveit=yes break fi done if test -z "$haveit"; then [$1]="${[$1]}${[$1]:+ }$element" fi done ]) dnl For those cases where a variable contains several -L and -l options dnl referring to unknown libraries and directories, this macro determines the dnl necessary additional linker options for the runtime path. dnl AC_LIB_LINKFLAGS_FROM_LIBS([LDADDVAR], [LIBSVALUE], [USE-LIBTOOL]) dnl sets LDADDVAR to linker options needed together with LIBSVALUE. dnl If USE-LIBTOOL evaluates to non-empty, linking with libtool is assumed, dnl otherwise linking without libtool is assumed. AC_DEFUN([AC_LIB_LINKFLAGS_FROM_LIBS], [ AC_REQUIRE([AC_LIB_RPATH]) AC_REQUIRE([AC_LIB_PREPARE_MULTILIB]) $1= if test "$enable_rpath" != no; then if test -n "$acl_hardcode_libdir_flag_spec" && test "$acl_hardcode_minus_L" = no; then dnl Use an explicit option to hardcode directories into the resulting dnl binary. rpathdirs= next= for opt in $2; do if test -n "$next"; then dir="$next" dnl No need to hardcode the standard /usr/lib. if test "X$dir" != "X/usr/$acl_libdirstem" \ && test "X$dir" != "X/usr/$acl_libdirstem2"; then rpathdirs="$rpathdirs $dir" fi next= else case $opt in -L) next=yes ;; -L*) dir=`echo "X$opt" | sed -e 's,^X-L,,'` dnl No need to hardcode the standard /usr/lib. if test "X$dir" != "X/usr/$acl_libdirstem" \ && test "X$dir" != "X/usr/$acl_libdirstem2"; then rpathdirs="$rpathdirs $dir" fi next= ;; *) next= ;; esac fi done if test "X$rpathdirs" != "X"; then if test -n ""$3""; then dnl libtool is used for linking. Use -R options. for dir in $rpathdirs; do $1="${$1}${$1:+ }-R$dir" done else dnl The linker is used for linking directly. if test -n "$acl_hardcode_libdir_separator"; then dnl Weird platform: only the last -rpath option counts, the user dnl must pass all path elements in one option. alldirs= for dir in $rpathdirs; do alldirs="${alldirs}${alldirs:+$acl_hardcode_libdir_separator}$dir" done acl_save_libdir="$libdir" libdir="$alldirs" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" $1="$flag" else dnl The -rpath options are cumulative. for dir in $rpathdirs; do acl_save_libdir="$libdir" libdir="$dir" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" $1="${$1}${$1:+ }$flag" done fi fi fi fi fi AC_SUBST([$1]) ]) suricata-3.2.1/libhtp/m4/lt~obsolete.m40000644000000000000000000001377413051004460014642 00000000000000# lt~obsolete.m4 -- aclocal satisfying obsolete definitions. -*-Autoconf-*- # # Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software # Foundation, Inc. # Written by Scott James Remnant, 2004. # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 5 lt~obsolete.m4 # These exist entirely to fool aclocal when bootstrapping libtool. # # In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN), # which have later been changed to m4_define as they aren't part of the # exported API, or moved to Autoconf or Automake where they belong. # # The trouble is, aclocal is a bit thick. It'll see the old AC_DEFUN # in /usr/share/aclocal/libtool.m4 and remember it, then when it sees us # using a macro with the same name in our local m4/libtool.m4 it'll # pull the old libtool.m4 in (it doesn't see our shiny new m4_define # and doesn't know about Autoconf macros at all.) # # So we provide this file, which has a silly filename so it's always # included after everything else. This provides aclocal with the # AC_DEFUNs it wants, but when m4 processes it, it doesn't do anything # because those macros already exist, or will be overwritten later. # We use AC_DEFUN over AU_DEFUN for compatibility with aclocal-1.6. # # Anytime we withdraw an AC_DEFUN or AU_DEFUN, remember to add it here. # Yes, that means every name once taken will need to remain here until # we give up compatibility with versions before 1.7, at which point # we need to keep only those names which we still refer to. # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTOBSOLETE_VERSION], [m4_if([1])]) m4_ifndef([AC_LIBTOOL_LINKER_OPTION], [AC_DEFUN([AC_LIBTOOL_LINKER_OPTION])]) m4_ifndef([AC_PROG_EGREP], [AC_DEFUN([AC_PROG_EGREP])]) m4_ifndef([_LT_AC_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_AC_PROG_ECHO_BACKSLASH])]) m4_ifndef([_LT_AC_SHELL_INIT], [AC_DEFUN([_LT_AC_SHELL_INIT])]) m4_ifndef([_LT_AC_SYS_LIBPATH_AIX], [AC_DEFUN([_LT_AC_SYS_LIBPATH_AIX])]) m4_ifndef([_LT_PROG_LTMAIN], [AC_DEFUN([_LT_PROG_LTMAIN])]) m4_ifndef([_LT_AC_TAGVAR], [AC_DEFUN([_LT_AC_TAGVAR])]) m4_ifndef([AC_LTDL_ENABLE_INSTALL], [AC_DEFUN([AC_LTDL_ENABLE_INSTALL])]) m4_ifndef([AC_LTDL_PREOPEN], [AC_DEFUN([AC_LTDL_PREOPEN])]) m4_ifndef([_LT_AC_SYS_COMPILER], [AC_DEFUN([_LT_AC_SYS_COMPILER])]) m4_ifndef([_LT_AC_LOCK], [AC_DEFUN([_LT_AC_LOCK])]) m4_ifndef([AC_LIBTOOL_SYS_OLD_ARCHIVE], [AC_DEFUN([AC_LIBTOOL_SYS_OLD_ARCHIVE])]) m4_ifndef([_LT_AC_TRY_DLOPEN_SELF], [AC_DEFUN([_LT_AC_TRY_DLOPEN_SELF])]) m4_ifndef([AC_LIBTOOL_PROG_CC_C_O], [AC_DEFUN([AC_LIBTOOL_PROG_CC_C_O])]) m4_ifndef([AC_LIBTOOL_SYS_HARD_LINK_LOCKS], [AC_DEFUN([AC_LIBTOOL_SYS_HARD_LINK_LOCKS])]) m4_ifndef([AC_LIBTOOL_OBJDIR], [AC_DEFUN([AC_LIBTOOL_OBJDIR])]) m4_ifndef([AC_LTDL_OBJDIR], [AC_DEFUN([AC_LTDL_OBJDIR])]) m4_ifndef([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH], [AC_DEFUN([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH])]) m4_ifndef([AC_LIBTOOL_SYS_LIB_STRIP], [AC_DEFUN([AC_LIBTOOL_SYS_LIB_STRIP])]) m4_ifndef([AC_PATH_MAGIC], [AC_DEFUN([AC_PATH_MAGIC])]) m4_ifndef([AC_PROG_LD_GNU], [AC_DEFUN([AC_PROG_LD_GNU])]) m4_ifndef([AC_PROG_LD_RELOAD_FLAG], [AC_DEFUN([AC_PROG_LD_RELOAD_FLAG])]) m4_ifndef([AC_DEPLIBS_CHECK_METHOD], [AC_DEFUN([AC_DEPLIBS_CHECK_METHOD])]) m4_ifndef([AC_LIBTOOL_PROG_COMPILER_NO_RTTI], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_NO_RTTI])]) m4_ifndef([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE], [AC_DEFUN([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE])]) m4_ifndef([AC_LIBTOOL_PROG_COMPILER_PIC], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_PIC])]) m4_ifndef([AC_LIBTOOL_PROG_LD_SHLIBS], [AC_DEFUN([AC_LIBTOOL_PROG_LD_SHLIBS])]) m4_ifndef([AC_LIBTOOL_POSTDEP_PREDEP], [AC_DEFUN([AC_LIBTOOL_POSTDEP_PREDEP])]) m4_ifndef([LT_AC_PROG_EGREP], [AC_DEFUN([LT_AC_PROG_EGREP])]) m4_ifndef([LT_AC_PROG_SED], [AC_DEFUN([LT_AC_PROG_SED])]) m4_ifndef([_LT_CC_BASENAME], [AC_DEFUN([_LT_CC_BASENAME])]) m4_ifndef([_LT_COMPILER_BOILERPLATE], [AC_DEFUN([_LT_COMPILER_BOILERPLATE])]) m4_ifndef([_LT_LINKER_BOILERPLATE], [AC_DEFUN([_LT_LINKER_BOILERPLATE])]) m4_ifndef([_AC_PROG_LIBTOOL], [AC_DEFUN([_AC_PROG_LIBTOOL])]) m4_ifndef([AC_LIBTOOL_SETUP], [AC_DEFUN([AC_LIBTOOL_SETUP])]) m4_ifndef([_LT_AC_CHECK_DLFCN], [AC_DEFUN([_LT_AC_CHECK_DLFCN])]) m4_ifndef([AC_LIBTOOL_SYS_DYNAMIC_LINKER], [AC_DEFUN([AC_LIBTOOL_SYS_DYNAMIC_LINKER])]) m4_ifndef([_LT_AC_TAGCONFIG], [AC_DEFUN([_LT_AC_TAGCONFIG])]) m4_ifndef([AC_DISABLE_FAST_INSTALL], [AC_DEFUN([AC_DISABLE_FAST_INSTALL])]) m4_ifndef([_LT_AC_LANG_CXX], [AC_DEFUN([_LT_AC_LANG_CXX])]) m4_ifndef([_LT_AC_LANG_F77], [AC_DEFUN([_LT_AC_LANG_F77])]) m4_ifndef([_LT_AC_LANG_GCJ], [AC_DEFUN([_LT_AC_LANG_GCJ])]) m4_ifndef([AC_LIBTOOL_LANG_C_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_C_CONFIG])]) m4_ifndef([_LT_AC_LANG_C_CONFIG], [AC_DEFUN([_LT_AC_LANG_C_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_CXX_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_CXX_CONFIG])]) m4_ifndef([_LT_AC_LANG_CXX_CONFIG], [AC_DEFUN([_LT_AC_LANG_CXX_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_F77_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_F77_CONFIG])]) m4_ifndef([_LT_AC_LANG_F77_CONFIG], [AC_DEFUN([_LT_AC_LANG_F77_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_GCJ_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_GCJ_CONFIG])]) m4_ifndef([_LT_AC_LANG_GCJ_CONFIG], [AC_DEFUN([_LT_AC_LANG_GCJ_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_RC_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_RC_CONFIG])]) m4_ifndef([_LT_AC_LANG_RC_CONFIG], [AC_DEFUN([_LT_AC_LANG_RC_CONFIG])]) m4_ifndef([AC_LIBTOOL_CONFIG], [AC_DEFUN([AC_LIBTOOL_CONFIG])]) m4_ifndef([_LT_AC_FILE_LTDLL_C], [AC_DEFUN([_LT_AC_FILE_LTDLL_C])]) m4_ifndef([_LT_REQUIRED_DARWIN_CHECKS], [AC_DEFUN([_LT_REQUIRED_DARWIN_CHECKS])]) m4_ifndef([_LT_AC_PROG_CXXCPP], [AC_DEFUN([_LT_AC_PROG_CXXCPP])]) m4_ifndef([_LT_PREPARE_SED_QUOTE_VARS], [AC_DEFUN([_LT_PREPARE_SED_QUOTE_VARS])]) m4_ifndef([_LT_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_PROG_ECHO_BACKSLASH])]) m4_ifndef([_LT_PROG_F77], [AC_DEFUN([_LT_PROG_F77])]) m4_ifndef([_LT_PROG_FC], [AC_DEFUN([_LT_PROG_FC])]) m4_ifndef([_LT_PROG_CXX], [AC_DEFUN([_LT_PROG_CXX])]) suricata-3.2.1/libhtp/m4/ltsugar.m40000644000000000000000000001044013051004460013734 00000000000000# ltsugar.m4 -- libtool m4 base layer. -*-Autoconf-*- # # Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software # Foundation, Inc. # Written by Gary V. Vaughan, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 6 ltsugar.m4 # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTSUGAR_VERSION], [m4_if([0.1])]) # lt_join(SEP, ARG1, [ARG2...]) # ----------------------------- # Produce ARG1SEPARG2...SEPARGn, omitting [] arguments and their # associated separator. # Needed until we can rely on m4_join from Autoconf 2.62, since all earlier # versions in m4sugar had bugs. m4_define([lt_join], [m4_if([$#], [1], [], [$#], [2], [[$2]], [m4_if([$2], [], [], [[$2]_])$0([$1], m4_shift(m4_shift($@)))])]) m4_define([_lt_join], [m4_if([$#$2], [2], [], [m4_if([$2], [], [], [[$1$2]])$0([$1], m4_shift(m4_shift($@)))])]) # lt_car(LIST) # lt_cdr(LIST) # ------------ # Manipulate m4 lists. # These macros are necessary as long as will still need to support # Autoconf-2.59, which quotes differently. m4_define([lt_car], [[$1]]) m4_define([lt_cdr], [m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])], [$#], 1, [], [m4_dquote(m4_shift($@))])]) m4_define([lt_unquote], $1) # lt_append(MACRO-NAME, STRING, [SEPARATOR]) # ------------------------------------------ # Redefine MACRO-NAME to hold its former content plus 'SEPARATOR''STRING'. # Note that neither SEPARATOR nor STRING are expanded; they are appended # to MACRO-NAME as is (leaving the expansion for when MACRO-NAME is invoked). # No SEPARATOR is output if MACRO-NAME was previously undefined (different # than defined and empty). # # This macro is needed until we can rely on Autoconf 2.62, since earlier # versions of m4sugar mistakenly expanded SEPARATOR but not STRING. m4_define([lt_append], [m4_define([$1], m4_ifdef([$1], [m4_defn([$1])[$3]])[$2])]) # lt_combine(SEP, PREFIX-LIST, INFIX, SUFFIX1, [SUFFIX2...]) # ---------------------------------------------------------- # Produce a SEP delimited list of all paired combinations of elements of # PREFIX-LIST with SUFFIX1 through SUFFIXn. Each element of the list # has the form PREFIXmINFIXSUFFIXn. # Needed until we can rely on m4_combine added in Autoconf 2.62. m4_define([lt_combine], [m4_if(m4_eval([$# > 3]), [1], [m4_pushdef([_Lt_sep], [m4_define([_Lt_sep], m4_defn([lt_car]))])]]dnl [[m4_foreach([_Lt_prefix], [$2], [m4_foreach([_Lt_suffix], ]m4_dquote(m4_dquote(m4_shift(m4_shift(m4_shift($@)))))[, [_Lt_sep([$1])[]m4_defn([_Lt_prefix])[$3]m4_defn([_Lt_suffix])])])])]) # lt_if_append_uniq(MACRO-NAME, VARNAME, [SEPARATOR], [UNIQ], [NOT-UNIQ]) # ----------------------------------------------------------------------- # Iff MACRO-NAME does not yet contain VARNAME, then append it (delimited # by SEPARATOR if supplied) and expand UNIQ, else NOT-UNIQ. m4_define([lt_if_append_uniq], [m4_ifdef([$1], [m4_if(m4_index([$3]m4_defn([$1])[$3], [$3$2$3]), [-1], [lt_append([$1], [$2], [$3])$4], [$5])], [lt_append([$1], [$2], [$3])$4])]) # lt_dict_add(DICT, KEY, VALUE) # ----------------------------- m4_define([lt_dict_add], [m4_define([$1($2)], [$3])]) # lt_dict_add_subkey(DICT, KEY, SUBKEY, VALUE) # -------------------------------------------- m4_define([lt_dict_add_subkey], [m4_define([$1($2:$3)], [$4])]) # lt_dict_fetch(DICT, KEY, [SUBKEY]) # ---------------------------------- m4_define([lt_dict_fetch], [m4_ifval([$3], m4_ifdef([$1($2:$3)], [m4_defn([$1($2:$3)])]), m4_ifdef([$1($2)], [m4_defn([$1($2)])]))]) # lt_if_dict_fetch(DICT, KEY, [SUBKEY], VALUE, IF-TRUE, [IF-FALSE]) # ----------------------------------------------------------------- m4_define([lt_if_dict_fetch], [m4_if(lt_dict_fetch([$1], [$2], [$3]), [$4], [$5], [$6])]) # lt_dict_filter(DICT, [SUBKEY], VALUE, [SEPARATOR], KEY, [...]) # -------------------------------------------------------------- m4_define([lt_dict_filter], [m4_if([$5], [], [], [lt_join(m4_quote(m4_default([$4], [[, ]])), lt_unquote(m4_split(m4_normalize(m4_foreach(_Lt_key, lt_car([m4_shiftn(4, $@)]), [lt_if_dict_fetch([$1], _Lt_key, [$2], [$3], [_Lt_key ])])))))])[]dnl ]) suricata-3.2.1/libhtp/get-version.sh0000755000000000000000000000074713051004451014303 00000000000000#!/bin/sh # Needed to remove the new line when echoing the version nl=' ' VERSION= usage="\ Usage: $0 version_file Print a version string. " version_file="$1" if test -z "$version_file"; then echo "$usage" exit 1 fi if test -f $version_file; then . ./$version_file else echo "Version file $version_file not found" exit 1 fi if test -z $PKG_VERSION; then echo "No version found in $version_file" exit 1 fi # Omit the trailing newline echo "$PKG_VERSION" | tr -d "$nl" suricata-3.2.1/libhtp/config.rpath0000644000000000000000000000000013051004451013765 00000000000000suricata-3.2.1/libhtp/configure0000755000000000000000000230056513051004462013416 00000000000000#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.69 for LibHTP 0.5.23. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. # # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # Use a proper internal environment variable to ensure we don't fall # into an infinite loop, continuously re-executing ourselves. if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then _as_can_reexec=no; export _as_can_reexec; # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 as_fn_exit 255 fi # We don't want this to propagate to other subprocesses. { _as_can_reexec=; unset _as_can_reexec;} if test "x$CONFIG_SHELL" = x; then as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi " as_required="as_fn_return () { (exit \$1); } as_fn_success () { as_fn_return 0; } as_fn_failure () { as_fn_return 1; } as_fn_ret_success () { return 0; } as_fn_ret_failure () { return 1; } exitcode=0 as_fn_success || { exitcode=1; echo as_fn_success failed.; } as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : else exitcode=1; echo positional parameters were not saved. fi test x\$exitcode = x0 || exit 1 test -x / || exit 1" as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 test -n \"\${ZSH_VERSION+set}\${BASH_VERSION+set}\" || ( ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO PATH=/empty FPATH=/empty; export PATH FPATH test \"X\`printf %s \$ECHO\`\" = \"X\$ECHO\" \\ || test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) || exit 1 test \$(( 1 + 1 )) = 2 || exit 1" if (eval "$as_required") 2>/dev/null; then : as_have_required=yes else as_have_required=no fi if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. as_found=: case $as_dir in #( /*) for as_base in sh bash ksh sh5; do # Try only shells that exist, to save several forks. as_shell=$as_dir/$as_base if { test -f "$as_shell" || test -f "$as_shell.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : CONFIG_SHELL=$as_shell as_have_required=yes if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : break 2 fi fi done;; esac as_found=false done $as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : CONFIG_SHELL=$SHELL as_have_required=yes fi; } IFS=$as_save_IFS if test "x$CONFIG_SHELL" != x; then : export CONFIG_SHELL # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 exit 255 fi if test x$as_have_required = xno; then : $as_echo "$0: This script requires a shell more modern than all" $as_echo "$0: the shells that I found on your system." if test x${ZSH_VERSION+set} = xset ; then $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" $as_echo "$0: be upgraded to zsh 4.3.4 or later." else $as_echo "$0: Please tell bug-autoconf@gnu.org about your system, $0: including any error possibly output before this $0: message. Then install a modern shell, or manually run $0: the script under such a shell if you do have one." fi exit 1 fi fi fi SHELL=${CONFIG_SHELL-/bin/sh} export SHELL # Unset more variables known to interfere with behavior of common tools. CLICOLOR_FORCE= GREP_OPTIONS= unset CLICOLOR_FORCE GREP_OPTIONS ## --------------------- ## ## M4sh Shell Functions. ## ## --------------------- ## # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_lineno_1=$LINENO as_lineno_1a=$LINENO as_lineno_2=$LINENO as_lineno_2a=$LINENO eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } # If we had to re-execute with $CONFIG_SHELL, we're ensured to have # already done that, so ensure we don't try to do so again and fall # in an infinite loop. This has already happened in practice. _as_can_reexec=no; export _as_can_reexec # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" SHELL=${CONFIG_SHELL-/bin/sh} test -n "$DJDIR" || exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= # Identity of this package. PACKAGE_NAME='LibHTP' PACKAGE_TARNAME='libhtp' PACKAGE_VERSION='0.5.23' PACKAGE_STRING='LibHTP 0.5.23' PACKAGE_BUGREPORT='' PACKAGE_URL='' # Factoring default headers for most tests. ac_includes_default="\ #include #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_STAT_H # include #endif #ifdef STDC_HEADERS # include # include #else # ifdef HAVE_STDLIB_H # include # endif #endif #ifdef HAVE_STRING_H # if !defined STDC_HEADERS && defined HAVE_MEMORY_H # include # endif # include #endif #ifdef HAVE_STRINGS_H # include #endif #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif #ifdef HAVE_UNISTD_H # include #endif" ac_default_prefix=/usr/local ac_subst_vars='am__EXEEXT_FALSE am__EXEEXT_TRUE LTLIBOBJS LIBOBJS LCOV DOXYGEN doxygen LTLIBICONV LIBICONV CXXCPP CPP LT_SYS_LIBRARY_PATH OTOOL64 OTOOL LIPO NMEDIT DSYMUTIL MANIFEST_TOOL RANLIB ac_ct_AR AR DLLTOOL OBJDUMP LN_S NM ac_ct_DUMPBIN DUMPBIN LD FGREP EGREP GREP SED host_os host_vendor host_cpu host build_os build_vendor build_cpu build LIBTOOL am__fastdepCXX_FALSE am__fastdepCXX_TRUE CXXDEPMODE ac_ct_CXX CXXFLAGS CXX am__fastdepCC_FALSE am__fastdepCC_TRUE CCDEPMODE am__nodep AMDEPBACKSLASH AMDEP_FALSE AMDEP_TRUE am__quote am__include DEPDIR OBJEXT EXEEXT ac_ct_CC CPPFLAGS LDFLAGS CFLAGS CC GENERIC_VERSION GENERIC_RELEASE GENERIC_LIBRARY_NAME GENERIC_LIBRARY_VERSION GENERIC_API_VERSION AM_BACKSLASH AM_DEFAULT_VERBOSITY AM_DEFAULT_V AM_V am__untar am__tar AMTAR am__leading_dot SET_MAKE AWK mkdir_p MKDIR_P INSTALL_STRIP_PROGRAM STRIP install_sh MAKEINFO AUTOHEADER AUTOMAKE AUTOCONF ACLOCAL VERSION PACKAGE CYGPATH_W am__isrc INSTALL_DATA INSTALL_SCRIPT INSTALL_PROGRAM target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir runstatedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_URL PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking enable_silent_rules enable_debug enable_devmode enable_gcov enable_dependency_tracking enable_shared enable_static with_pic enable_fast_install with_aix_soname with_gnu_ld with_sysroot enable_libtool_lock enable_rpath with_libiconv_prefix with_doxygen ' ac_precious_vars='build_alias host_alias target_alias CC CFLAGS LDFLAGS LIBS CPPFLAGS CXX CXXFLAGS CCC LT_SYS_LIBRARY_PATH CPP CXXCPP' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *=) ac_optarg= ;; *) ac_optarg=yes ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -runstatedir | --runstatedir | --runstatedi | --runstated \ | --runstate | --runstat | --runsta | --runst | --runs \ | --run | --ru | --r) ac_prev=runstatedir ;; -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ | --run=* | --ru=* | --r=*) runstatedir=$ac_optarg ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) as_fn_error $? "unrecognized option: \`$ac_option' Try \`$0 --help' for more information" ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. case $ac_envvar in #( '' | [0-9]* | *[!_$as_cr_alnum]* ) as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; esac eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}" ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` as_fn_error $? "missing argument to $ac_option" fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir runstatedir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || as_fn_error $? "working directory cannot be determined" test "X$ac_ls_di" = "X$ac_pwd_ls_di" || as_fn_error $? "pwd does not report name of working directory" # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures LibHTP 0.5.23 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/libhtp] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF Program names: --program-prefix=PREFIX prepend PREFIX to installed program names --program-suffix=SUFFIX append SUFFIX to installed program names --program-transform-name=PROGRAM run sed PROGRAM on installed program names System types: --build=BUILD configure for building on BUILD [guessed] --host=HOST cross-compile to build programs to run on HOST [BUILD] _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of LibHTP 0.5.23:";; esac cat <<\_ACEOF Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --enable-silent-rules less verbose build output (undo: "make V=1") --disable-silent-rules verbose build output (undo: "make V=0") --enable-debug Enable debug mode --enable-devmode Enable development mode --enable-gcov Enable gcov support --enable-dependency-tracking do not reject slow dependency extractors --disable-dependency-tracking speeds up one-time build --enable-shared[=PKGS] build shared libraries [default=yes] --enable-static[=PKGS] build static libraries [default=yes] --enable-fast-install[=PKGS] optimize for fast installation [default=yes] --disable-libtool-lock avoid locking (might break parallel builds) --disable-rpath do not hardcode runtime library paths Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-pic[=PKGS] try to use only PIC/non-PIC objects [default=use both] --with-aix-soname=aix|svr4|both shared library versioning (aka "SONAME") variant to provide on AIX, [default=aix]. --with-gnu-ld assume the C compiler uses GNU ld [default=no] --with-sysroot[=DIR] Search for dependent libraries within DIR (or the compiler's sysroot if not specified). --with-gnu-ld assume the C compiler uses GNU ld default=no --with-libiconv-prefix[=DIR] search for libiconv in DIR/include and DIR/lib --without-libiconv-prefix don't search for libiconv in includedir and libdir --with-doxygen=PROG doxygen executable Some influential environment variables: CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L if you have libraries in a nonstandard directory LIBS libraries to pass to the linker, e.g. -l CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I if you have headers in a nonstandard directory CXX C++ compiler command CXXFLAGS C++ compiler flags LT_SYS_LIBRARY_PATH User-defined run-time library search path. CPP C preprocessor CXXCPP C++ preprocessor Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to the package provider. _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for guested configure. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF LibHTP configure 0.5.23 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi ## ------------------------ ## ## Autoconf initialization. ## ## ------------------------ ## # ac_fn_c_try_compile LINENO # -------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_compile # ac_fn_cxx_try_compile LINENO # ---------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_cxx_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_cxx_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_cxx_try_compile # ac_fn_c_try_link LINENO # ----------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_link () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest$ac_exeext if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || test -x conftest$ac_exeext }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would # interfere with the next link command; also delete a directory that is # left behind by Apple's compiler. We do this before executing the actions. rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_link # ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists and can be compiled using the include files in # INCLUDES, setting the cache variable VAR accordingly. ac_fn_c_check_header_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_compile # ac_fn_c_try_cpp LINENO # ---------------------- # Try to preprocess conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_cpp () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_cpp conftest.$ac_ext" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } > conftest.i && { test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || test ! -s conftest.err }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_cpp # ac_fn_c_try_run LINENO # ---------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. Assumes # that executables *can* be run. ac_fn_c_try_run () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then : ac_retval=0 else $as_echo "$as_me: program exited with status $ac_status" >&5 $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=$ac_status fi rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_run # ac_fn_c_check_func LINENO FUNC VAR # ---------------------------------- # Tests whether FUNC exists, setting the cache variable VAR accordingly ac_fn_c_check_func () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Define $2 to an innocuous variant, in case declares $2. For example, HP-UX 11i declares gettimeofday. */ #define $2 innocuous_$2 /* System header to define __stub macros and hopefully few prototypes, which can conflict with char $2 (); below. Prefer to if __STDC__ is defined, since exists even on freestanding compilers. */ #ifdef __STDC__ # include #else # include #endif #undef $2 /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char $2 (); /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined __stub_$2 || defined __stub___$2 choke me #endif int main () { return $2 (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_func # ac_fn_cxx_try_cpp LINENO # ------------------------ # Try to preprocess conftest.$ac_ext, and return whether this succeeded. ac_fn_cxx_try_cpp () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_cpp conftest.$ac_ext" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } > conftest.i && { test -z "$ac_cxx_preproc_warn_flag$ac_cxx_werror_flag" || test ! -s conftest.err }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_cxx_try_cpp # ac_fn_cxx_try_link LINENO # ------------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. ac_fn_cxx_try_link () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest$ac_exeext if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_cxx_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || test -x conftest$ac_exeext }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would # interfere with the next link command; also delete a directory that is # left behind by Apple's compiler. We do this before executing the actions. rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_cxx_try_link # ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists, giving a warning if it cannot be compiled using # the include files in INCLUDES and setting the cache variable VAR # accordingly. ac_fn_c_check_header_mongrel () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if eval \${$3+:} false; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } else # Is the header compilable? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5 $as_echo_n "checking $2 usability... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_header_compiler=yes else ac_header_compiler=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5 $as_echo "$ac_header_compiler" >&6; } # Is the header present? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5 $as_echo_n "checking $2 presence... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include <$2> _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : ac_header_preproc=yes else ac_header_preproc=no fi rm -f conftest.err conftest.i conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5 $as_echo "$ac_header_preproc" >&6; } # So? What about this header? case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #(( yes:no: ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5 $as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ;; no:yes:* ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5 $as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5 $as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5 $as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5 $as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else eval "$3=\$ac_header_compiler" fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_mongrel cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by LibHTP $as_me 0.5.23, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. $as_echo "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; 2) as_fn_append ac_configure_args1 " '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi as_fn_append ac_configure_args " '$ac_arg'" ;; esac done done { ac_configure_args0=; unset ac_configure_args0;} { ac_configure_args1=; unset ac_configure_args1;} # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo $as_echo "## ---------------- ## ## Cache variables. ## ## ---------------- ##" echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo $as_echo "## ----------------- ## ## Output variables. ## ## ----------------- ##" echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then $as_echo "## ------------------- ## ## File substitutions. ## ## ------------------- ##" echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then $as_echo "## ----------- ## ## confdefs.h. ## ## ----------- ##" echo cat confdefs.h echo fi test "$ac_signal" != 0 && $as_echo "$as_me: caught signal $ac_signal" $as_echo "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h $as_echo "/* confdefs.h */" > confdefs.h # Predefined preprocessor variables. cat >>confdefs.h <<_ACEOF #define PACKAGE_NAME "$PACKAGE_NAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_TARNAME "$PACKAGE_TARNAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_VERSION "$PACKAGE_VERSION" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_STRING "$PACKAGE_STRING" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_URL "$PACKAGE_URL" _ACEOF # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. ac_site_file1=NONE ac_site_file2=NONE if test -n "$CONFIG_SITE"; then # We do not want a PATH search for config.site. case $CONFIG_SITE in #(( -*) ac_site_file1=./$CONFIG_SITE;; */*) ac_site_file1=$CONFIG_SITE;; *) ac_site_file1=./$CONFIG_SITE;; esac elif test "x$prefix" != xNONE; then ac_site_file1=$prefix/share/config.site ac_site_file2=$prefix/etc/config.site else ac_site_file1=$ac_default_prefix/share/config.site ac_site_file2=$ac_default_prefix/etc/config.site fi for ac_site_file in "$ac_site_file1" "$ac_site_file2" do test "x$ac_site_file" = xNONE && continue if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 $as_echo "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" \ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed to load site script $ac_site_file See \`config.log' for more details" "$LINENO" 5; } fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special files # actually), so we avoid doing that. DJGPP emulates it as a regular file. if test /dev/null != "$cache_file" && test -f "$cache_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 $as_echo "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 $as_echo "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 $as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 $as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 $as_echo "$as_me: former value: \`$ac_old_val'" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 $as_echo "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) as_fn_append ac_configure_args " '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 $as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 fi ## -------------------- ## ## Main body of script. ## ## -------------------- ## ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu am__api_version='1.15' ac_aux_dir= for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do if test -f "$ac_dir/install-sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break elif test -f "$ac_dir/install.sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install.sh -c" break elif test -f "$ac_dir/shtool"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/shtool install -c" break fi done if test -z "$ac_aux_dir"; then as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5 fi # These three variables are undocumented and unsupported, # and are intended to be withdrawn in a future Autoconf release. # They can cause serious problems if a builder's source tree is in a directory # whose full name contains unusual characters. ac_config_guess="$SHELL $ac_aux_dir/config.guess" # Please don't use this var. ac_config_sub="$SHELL $ac_aux_dir/config.sub" # Please don't use this var. ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var. # Find a good install program. We prefer a C program (faster), # so one script is as good as another. But avoid the broken or # incompatible versions: # SysV /etc/install, /usr/sbin/install # SunOS /usr/etc/install # IRIX /sbin/install # AIX /bin/install # AmigaOS /C/install, which installs bootblocks on floppy discs # AIX 4 /usr/bin/installbsd, which doesn't work without a -g flag # AFS /usr/afsws/bin/install, which mishandles nonexistent args # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff" # OS/2's system install, which has a completely different semantic # ./install, which can be erroneously created by make from ./install.sh. # Reject install programs that cannot install multiple files. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5 $as_echo_n "checking for a BSD-compatible install... " >&6; } if test -z "$INSTALL"; then if ${ac_cv_path_install+:} false; then : $as_echo_n "(cached) " >&6 else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. # Account for people who put trailing slashes in PATH elements. case $as_dir/ in #(( ./ | .// | /[cC]/* | \ /etc/* | /usr/sbin/* | /usr/etc/* | /sbin/* | /usr/afsws/bin/* | \ ?:[\\/]os2[\\/]install[\\/]* | ?:[\\/]OS2[\\/]INSTALL[\\/]* | \ /usr/ucb/* ) ;; *) # OSF1 and SCO ODT 3.0 have their own names for install. # Don't use installbsd from OSF since it installs stuff as root # by default. for ac_prog in ginstall scoinst install; do for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext"; then if test $ac_prog = install && grep dspmsg "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # AIX install. It has an incompatible calling convention. : elif test $ac_prog = install && grep pwplus "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # program-specific install script used by HP pwplus--don't use. : else rm -rf conftest.one conftest.two conftest.dir echo one > conftest.one echo two > conftest.two mkdir conftest.dir if "$as_dir/$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir" && test -s conftest.one && test -s conftest.two && test -s conftest.dir/conftest.one && test -s conftest.dir/conftest.two then ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c" break 3 fi fi fi done done ;; esac done IFS=$as_save_IFS rm -rf conftest.one conftest.two conftest.dir fi if test "${ac_cv_path_install+set}" = set; then INSTALL=$ac_cv_path_install else # As a last resort, use the slow shell script. Don't cache a # value for INSTALL within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the value is a relative name. INSTALL=$ac_install_sh fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5 $as_echo "$INSTALL" >&6; } # Use test -z because SunOS4 sh mishandles braces in ${var-val}. # It thinks the first close brace ends the variable substitution. test -z "$INSTALL_PROGRAM" && INSTALL_PROGRAM='${INSTALL}' test -z "$INSTALL_SCRIPT" && INSTALL_SCRIPT='${INSTALL}' test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644' { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether build environment is sane" >&5 $as_echo_n "checking whether build environment is sane... " >&6; } # Reject unsafe characters in $srcdir or the absolute working directory # name. Accept space and tab only in the latter. am_lf=' ' case `pwd` in *[\\\"\#\$\&\'\`$am_lf]*) as_fn_error $? "unsafe absolute working directory name" "$LINENO" 5;; esac case $srcdir in *[\\\"\#\$\&\'\`$am_lf\ \ ]*) as_fn_error $? "unsafe srcdir value: '$srcdir'" "$LINENO" 5;; esac # Do 'set' in a subshell so we don't clobber the current shell's # arguments. Must try -L first in case configure is actually a # symlink; some systems play weird games with the mod time of symlinks # (eg FreeBSD returns the mod time of the symlink's containing # directory). if ( am_has_slept=no for am_try in 1 2; do echo "timestamp, slept: $am_has_slept" > conftest.file set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null` if test "$*" = "X"; then # -L didn't work. set X `ls -t "$srcdir/configure" conftest.file` fi if test "$*" != "X $srcdir/configure conftest.file" \ && test "$*" != "X conftest.file $srcdir/configure"; then # If neither matched, then we have a broken ls. This can happen # if, for instance, CONFIG_SHELL is bash and it inherits a # broken ls alias from the environment. This has actually # happened. Such a system could not be considered "sane". as_fn_error $? "ls -t appears to fail. Make sure there is not a broken alias in your environment" "$LINENO" 5 fi if test "$2" = conftest.file || test $am_try -eq 2; then break fi # Just in case. sleep 1 am_has_slept=yes done test "$2" = conftest.file ) then # Ok. : else as_fn_error $? "newly created file is older than distributed files! Check your system clock" "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } # If we didn't sleep, we still need to ensure time stamps of config.status and # generated files are strictly newer. am_sleep_pid= if grep 'slept: no' conftest.file >/dev/null 2>&1; then ( sleep 1 ) & am_sleep_pid=$! fi rm -f conftest.file test "$program_prefix" != NONE && program_transform_name="s&^&$program_prefix&;$program_transform_name" # Use a double $ so make ignores it. test "$program_suffix" != NONE && program_transform_name="s&\$&$program_suffix&;$program_transform_name" # Double any \ or $. # By default was `s,x,x', remove it if useless. ac_script='s/[\\$]/&&/g;s/;s,x,x,$//' program_transform_name=`$as_echo "$program_transform_name" | sed "$ac_script"` # Expand $ac_aux_dir to an absolute path. am_aux_dir=`cd "$ac_aux_dir" && pwd` if test x"${MISSING+set}" != xset; then case $am_aux_dir in *\ * | *\ *) MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;; *) MISSING="\${SHELL} $am_aux_dir/missing" ;; esac fi # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: 'missing' script is too old or missing" >&5 $as_echo "$as_me: WARNING: 'missing' script is too old or missing" >&2;} fi if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; *) install_sh="\${SHELL} $am_aux_dir/install-sh" esac fi # Installed binaries are usually stripped using 'strip' when the user # run "make install-strip". However 'strip' might not be the right # tool to use in cross-compilation environments, therefore Automake # will honor the 'STRIP' environment variable to overrule this program. if test "$cross_compiling" != no; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args. set dummy ${ac_tool_prefix}strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$STRIP"; then ac_cv_prog_STRIP="$STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_STRIP="${ac_tool_prefix}strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi STRIP=$ac_cv_prog_STRIP if test -n "$STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5 $as_echo "$STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_STRIP"; then ac_ct_STRIP=$STRIP # Extract the first word of "strip", so it can be a program name with args. set dummy strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_STRIP"; then ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_STRIP="strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP if test -n "$ac_ct_STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5 $as_echo "$ac_ct_STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_STRIP" = x; then STRIP=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac STRIP=$ac_ct_STRIP fi else STRIP="$ac_cv_prog_STRIP" fi fi INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a thread-safe mkdir -p" >&5 $as_echo_n "checking for a thread-safe mkdir -p... " >&6; } if test -z "$MKDIR_P"; then if ${ac_cv_path_mkdir+:} false; then : $as_echo_n "(cached) " >&6 else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/opt/sfw/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in mkdir gmkdir; do for ac_exec_ext in '' $ac_executable_extensions; do as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext" || continue case `"$as_dir/$ac_prog$ac_exec_ext" --version 2>&1` in #( 'mkdir (GNU coreutils) '* | \ 'mkdir (coreutils) '* | \ 'mkdir (fileutils) '4.1*) ac_cv_path_mkdir=$as_dir/$ac_prog$ac_exec_ext break 3;; esac done done done IFS=$as_save_IFS fi test -d ./--version && rmdir ./--version if test "${ac_cv_path_mkdir+set}" = set; then MKDIR_P="$ac_cv_path_mkdir -p" else # As a last resort, use the slow shell script. Don't cache a # value for MKDIR_P within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the value is a relative name. MKDIR_P="$ac_install_sh -d" fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MKDIR_P" >&5 $as_echo "$MKDIR_P" >&6; } for ac_prog in gawk mawk nawk awk do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AWK+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AWK"; then ac_cv_prog_AWK="$AWK" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_AWK="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AWK=$ac_cv_prog_AWK if test -n "$AWK"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5 $as_echo "$AWK" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AWK" && break done { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5 $as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; } set x ${MAKE-make} ac_make=`$as_echo "$2" | sed 's/+/p/g; s/[^a-zA-Z0-9_]/_/g'` if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then : $as_echo_n "(cached) " >&6 else cat >conftest.make <<\_ACEOF SHELL = /bin/sh all: @echo '@@@%%%=$(MAKE)=@@@%%%' _ACEOF # GNU make sometimes prints "make[1]: Entering ...", which would confuse us. case `${MAKE-make} -f conftest.make 2>/dev/null` in *@@@%%%=?*=@@@%%%*) eval ac_cv_prog_make_${ac_make}_set=yes;; *) eval ac_cv_prog_make_${ac_make}_set=no;; esac rm -f conftest.make fi if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } SET_MAKE= else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } SET_MAKE="MAKE=${MAKE-make}" fi rm -rf .tst 2>/dev/null mkdir .tst 2>/dev/null if test -d .tst; then am__leading_dot=. else am__leading_dot=_ fi rmdir .tst 2>/dev/null # Check whether --enable-silent-rules was given. if test "${enable_silent_rules+set}" = set; then : enableval=$enable_silent_rules; fi case $enable_silent_rules in # ((( yes) AM_DEFAULT_VERBOSITY=0;; no) AM_DEFAULT_VERBOSITY=1;; *) AM_DEFAULT_VERBOSITY=1;; esac am_make=${MAKE-make} { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5 $as_echo_n "checking whether $am_make supports nested variables... " >&6; } if ${am_cv_make_support_nested_variables+:} false; then : $as_echo_n "(cached) " >&6 else if $as_echo 'TRUE=$(BAR$(V)) BAR0=false BAR1=true V=1 am__doit: @$(TRUE) .PHONY: am__doit' | $am_make -f - >/dev/null 2>&1; then am_cv_make_support_nested_variables=yes else am_cv_make_support_nested_variables=no fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5 $as_echo "$am_cv_make_support_nested_variables" >&6; } if test $am_cv_make_support_nested_variables = yes; then AM_V='$(V)' AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)' else AM_V=$AM_DEFAULT_VERBOSITY AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY fi AM_BACKSLASH='\' if test "`cd $srcdir && pwd`" != "`pwd`"; then # Use -I$(srcdir) only when $(srcdir) != ., so that make's output # is not polluted with repeated "-I." am__isrc=' -I$(srcdir)' # test to see if srcdir already configured if test -f $srcdir/config.status; then as_fn_error $? "source directory already configured; run \"make distclean\" there first" "$LINENO" 5 fi fi # test whether we have cygpath if test -z "$CYGPATH_W"; then if (cygpath --version) >/dev/null 2>/dev/null; then CYGPATH_W='cygpath -w' else CYGPATH_W=echo fi fi # Define the identity of the package. PACKAGE='libhtp' VERSION='0.5.23' cat >>confdefs.h <<_ACEOF #define PACKAGE "$PACKAGE" _ACEOF cat >>confdefs.h <<_ACEOF #define VERSION "$VERSION" _ACEOF # Some tools Automake needs. ACLOCAL=${ACLOCAL-"${am_missing_run}aclocal-${am__api_version}"} AUTOCONF=${AUTOCONF-"${am_missing_run}autoconf"} AUTOMAKE=${AUTOMAKE-"${am_missing_run}automake-${am__api_version}"} AUTOHEADER=${AUTOHEADER-"${am_missing_run}autoheader"} MAKEINFO=${MAKEINFO-"${am_missing_run}makeinfo"} # For better backward compatibility. To be removed once Automake 1.9.x # dies out for good. For more background, see: # # mkdir_p='$(MKDIR_P)' # We need awk for the "check" target (and possibly the TAP driver). The # system "awk" is bad on some platforms. # Always define AMTAR for backward compatibility. Yes, it's still used # in the wild :-( We should find a proper way to deprecate it ... AMTAR='$${TAR-tar}' # We'll loop over all known methods to create a tar archive until one works. _am_tools='gnutar pax cpio none' am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -' # POSIX will say in a future version that running "rm -f" with no argument # is OK; and we want to be able to make that assumption in our Makefile # recipes. So use an aggressive probe to check that the usage we want is # actually supported "in the wild" to an acceptable degree. # See automake bug#10828. # To make any issue more visible, cause the running configure to be aborted # by default if the 'rm' program in use doesn't match our expectations; the # user can still override this though. if rm -f && rm -fr && rm -rf; then : OK; else cat >&2 <<'END' Oops! Your 'rm' program seems unable to run without file operands specified on the command line, even when the '-f' option is present. This is contrary to the behaviour of most rm programs out there, and not conforming with the upcoming POSIX standard: Please tell bug-automake@gnu.org about your system, including the value of your $PATH and any error possibly output before this message. This can help us improve future automake versions. END if test x"$ACCEPT_INFERIOR_RM_PROGRAM" = x"yes"; then echo 'Configuration will proceed anyway, since you have set the' >&2 echo 'ACCEPT_INFERIOR_RM_PROGRAM variable to "yes"' >&2 echo >&2 else cat >&2 <<'END' Aborting the configuration process, to ensure you take notice of the issue. You can download and install GNU coreutils to get an 'rm' implementation that behaves properly: . If you want to complete the configuration process using your problematic 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM to "yes", and re-run configure. END as_fn_error $? "Your 'rm' program is bad, sorry." "$LINENO" 5 fi fi ac_config_headers="$ac_config_headers htp_config_auto_gen.h" ac_config_files="$ac_config_files htp/htp_version.h" GENERIC_LIBRARY_NAME=htp # API version GENERIC_API_VERSION=1.0 # Shared library versioning GENERIC_LIBRARY_VERSION=1:0:0 PACKAGE=$GENERIC_LIBRARY_NAME GENERIC_VERSION=$PACKAGE_VERSION GENERIC_RELEASE=$PACKAGE_VERSION VERSION=$GENERIC_VERSION # Check whether --enable-debug was given. if test "${enable_debug+set}" = set; then : enableval=$enable_debug; enable_debug=yes fi if test "$enable_debug" = "yes"; then CFLAGS="${CFLAGS} -DHTP_DEBUG" echo "Debug mode enabled" fi OLEVEL=2 # Check whether --enable-devmode was given. if test "${enable_devmode+set}" = set; then : enableval=$enable_devmode; enable_devmode=yes fi if test "$enable_devmode" = "yes"; then OLEVEL=0 CFLAGS="${CFLAGS} -Werror -Wfatal-errors" CPPFLAGS="${CPPFLAGS} -Werror -Wfatal-errors" echo "Development mode enabled" fi # Check whether --enable-gcov was given. if test "${enable_gcov+set}" = set; then : enableval=$enable_gcov; enable_gcov=yes fi if test "$enable_gcov" = "yes"; then OLEVEL=0 CFLAGS="${CFLAGS} --coverage -fprofile-arcs -ftest-coverage" CPPFLAGS="${CPPFLAGS} --coverage -fprofile-arcs -ftest-coverage" LDFLAGS="${LDFLAGS} -lgcov --coverage -fprofile-arcs" echo "gcov support enabled" fi CFLAGS="${CFLAGS} -O${OLEVEL}" CPPFLAGS="${CPPFLAGS} -O${OLEVEL}" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 $as_echo_n "checking whether the C compiler works... " >&6; } ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` # The possible output files: ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ac_rmfiles= for ac_file in $ac_files do case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; * ) ac_rmfiles="$ac_rmfiles $ac_file";; esac done rm -f $ac_rmfiles if { { ac_try="$ac_link_default" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link_default") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' # in a Makefile. We should not override ac_cv_exeext if it was cached, # so that the user can short-circuit this test for compilers unknown to # Autoconf. for ac_file in $ac_files '' do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; [ab].out ) # We found the default executable, but exeext='' is most # certainly right. break;; *.* ) if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; then :; else ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` fi # We set ac_cv_exeext here because the later test for it is not # safe: cross compilers may not add the suffix if given an `-o' # argument, so we may need to know it at that point already. # Even if this section looks crufty: it has the advantage of # actually working. break;; * ) break;; esac done test "$ac_cv_exeext" = no && ac_cv_exeext= else ac_file='' fi if test -z "$ac_file"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error 77 "C compiler cannot create executables See \`config.log' for more details" "$LINENO" 5; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 $as_echo_n "checking for C compiler default output file name... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 $as_echo "$ac_file" >&6; } ac_exeext=$ac_cv_exeext rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 $as_echo_n "checking for suffix of executables... " >&6; } if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # If both `conftest.exe' and `conftest' are `present' (well, observable) # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. for ac_file in conftest.exe conftest conftest.*; do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` break;; * ) break;; esac done else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of executables: cannot compile and link See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest conftest$ac_cv_exeext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 $as_echo "$ac_cv_exeext" >&6; } rm -f conftest.$ac_ext EXEEXT=$ac_cv_exeext ac_exeext=$EXEEXT cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { FILE *f = fopen ("conftest.out", "w"); return ferror (f) || fclose (f) != 0; ; return 0; } _ACEOF ac_clean_files="$ac_clean_files conftest.out" # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 $as_echo_n "checking whether we are cross compiling... " >&6; } if test "$cross_compiling" != yes; then { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if { ac_try='./conftest$ac_cv_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then cross_compiling=no else if test "$cross_compiling" = maybe; then cross_compiling=yes else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details" "$LINENO" 5; } fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 $as_echo "$cross_compiling" >&6; } rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 $as_echo_n "checking for suffix of object files... " >&6; } if ${ac_cv_objext+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.o conftest.obj if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : for ac_file in conftest.o conftest.obj conftest.*; do test -f "$ac_file" || continue; case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of object files: cannot compile See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest.$ac_cv_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 $as_echo "$ac_cv_objext" >&6; } OBJEXT=$ac_cv_objext ac_objext=$OBJEXT { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if ${ac_cv_c_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if ${ac_cv_prog_cc_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes else CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if ${ac_cv_prog_cc_c89+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include struct stat; /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac if test "x$ac_cv_prog_cc_c89" != xno; then : fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC understands -c and -o together" >&5 $as_echo_n "checking whether $CC understands -c and -o together... " >&6; } if ${am_cv_prog_cc_c_o+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF # Make sure it works both with $CC and with simple cc. # Following AC_PROG_CC_C_O, we do the test twice because some # compilers refuse to overwrite an existing .o file with -o, # though they will create one. am_cv_prog_cc_c_o=yes for am_i in 1 2; do if { echo "$as_me:$LINENO: $CC -c conftest.$ac_ext -o conftest2.$ac_objext" >&5 ($CC -c conftest.$ac_ext -o conftest2.$ac_objext) >&5 2>&5 ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } \ && test -f conftest2.$ac_objext; then : OK else am_cv_prog_cc_c_o=no break fi done rm -f core conftest* unset am_i fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_cc_c_o" >&5 $as_echo "$am_cv_prog_cc_c_o" >&6; } if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. # FIXME: It is wrong to rewrite CC. # But if we don't then we get into trouble of one sort or another. # A longer-term fix would be to have automake use am__CC in this case, # and then we could set am__CC="\$(top_srcdir)/compile \$(CC)" CC="$am_aux_dir/compile $CC" fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu DEPDIR="${am__leading_dot}deps" ac_config_commands="$ac_config_commands depfiles" am_make=${MAKE-make} cat > confinc << 'END' am__doit: @echo this is the am__doit target .PHONY: am__doit END # If we don't find an include directive, just comment out the code. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for style of include used by $am_make" >&5 $as_echo_n "checking for style of include used by $am_make... " >&6; } am__include="#" am__quote= _am_result=none # First try GNU make style include. echo "include confinc" > confmf # Ignore all kinds of additional output from 'make'. case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=include am__quote= _am_result=GNU ;; esac # Now try BSD make style include. if test "$am__include" = "#"; then echo '.include "confinc"' > confmf case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=.include am__quote="\"" _am_result=BSD ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $_am_result" >&5 $as_echo "$_am_result" >&6; } rm -f confinc confmf # Check whether --enable-dependency-tracking was given. if test "${enable_dependency_tracking+set}" = set; then : enableval=$enable_dependency_tracking; fi if test "x$enable_dependency_tracking" != xno; then am_depcomp="$ac_aux_dir/depcomp" AMDEPBACKSLASH='\' am__nodep='_no' fi if test "x$enable_dependency_tracking" != xno; then AMDEP_TRUE= AMDEP_FALSE='#' else AMDEP_TRUE='#' AMDEP_FALSE= fi depcc="$CC" am_compiler_list= { $as_echo "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5 $as_echo_n "checking dependency style of $depcc... " >&6; } if ${am_cv_CC_dependencies_compiler_type+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_CC_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n 's/^#*\([a-zA-Z0-9]*\))$/\1/p' < ./depcomp` fi am__universal=false case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_CC_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_CC_dependencies_compiler_type=none fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_CC_dependencies_compiler_type" >&5 $as_echo "$am_cv_CC_dependencies_compiler_type" >&6; } CCDEPMODE=depmode=$am_cv_CC_dependencies_compiler_type if test "x$enable_dependency_tracking" != xno \ && test "$am_cv_CC_dependencies_compiler_type" = gcc3; then am__fastdepCC_TRUE= am__fastdepCC_FALSE='#' else am__fastdepCC_TRUE='#' am__fastdepCC_FALSE= fi ac_ext=cpp ac_cpp='$CXXCPP $CPPFLAGS' ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_cxx_compiler_gnu if test -z "$CXX"; then if test -n "$CCC"; then CXX=$CCC else if test -n "$ac_tool_prefix"; then for ac_prog in g++ c++ gpp aCC CC cxx cc++ cl.exe FCC KCC RCC xlC_r xlC do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CXX+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CXX"; then ac_cv_prog_CXX="$CXX" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CXX="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CXX=$ac_cv_prog_CXX if test -n "$CXX"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CXX" >&5 $as_echo "$CXX" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CXX" && break done fi if test -z "$CXX"; then ac_ct_CXX=$CXX for ac_prog in g++ c++ gpp aCC CC cxx cc++ cl.exe FCC KCC RCC xlC_r xlC do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CXX+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CXX"; then ac_cv_prog_ac_ct_CXX="$ac_ct_CXX" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CXX="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CXX=$ac_cv_prog_ac_ct_CXX if test -n "$ac_ct_CXX"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CXX" >&5 $as_echo "$ac_ct_CXX" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CXX" && break done if test "x$ac_ct_CXX" = x; then CXX="g++" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CXX=$ac_ct_CXX fi fi fi fi # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C++ compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C++ compiler" >&5 $as_echo_n "checking whether we are using the GNU C++ compiler... " >&6; } if ${ac_cv_cxx_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_cxx_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_cxx_compiler_gnu" >&5 $as_echo "$ac_cv_cxx_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GXX=yes else GXX= fi ac_test_CXXFLAGS=${CXXFLAGS+set} ac_save_CXXFLAGS=$CXXFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CXX accepts -g" >&5 $as_echo_n "checking whether $CXX accepts -g... " >&6; } if ${ac_cv_prog_cxx_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_cxx_werror_flag=$ac_cxx_werror_flag ac_cxx_werror_flag=yes ac_cv_prog_cxx_g=no CXXFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO"; then : ac_cv_prog_cxx_g=yes else CXXFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO"; then : else ac_cxx_werror_flag=$ac_save_cxx_werror_flag CXXFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_compile "$LINENO"; then : ac_cv_prog_cxx_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cxx_werror_flag=$ac_save_cxx_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cxx_g" >&5 $as_echo "$ac_cv_prog_cxx_g" >&6; } if test "$ac_test_CXXFLAGS" = set; then CXXFLAGS=$ac_save_CXXFLAGS elif test $ac_cv_prog_cxx_g = yes; then if test "$GXX" = yes; then CXXFLAGS="-g -O2" else CXXFLAGS="-g" fi else if test "$GXX" = yes; then CXXFLAGS="-O2" else CXXFLAGS= fi fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu depcc="$CXX" am_compiler_list= { $as_echo "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5 $as_echo_n "checking dependency style of $depcc... " >&6; } if ${am_cv_CXX_dependencies_compiler_type+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_CXX_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n 's/^#*\([a-zA-Z0-9]*\))$/\1/p' < ./depcomp` fi am__universal=false case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_CXX_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_CXX_dependencies_compiler_type=none fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_CXX_dependencies_compiler_type" >&5 $as_echo "$am_cv_CXX_dependencies_compiler_type" >&6; } CXXDEPMODE=depmode=$am_cv_CXX_dependencies_compiler_type if test "x$enable_dependency_tracking" != xno \ && test "$am_cv_CXX_dependencies_compiler_type" = gcc3; then am__fastdepCXX_TRUE= am__fastdepCXX_FALSE='#' else am__fastdepCXX_TRUE='#' am__fastdepCXX_FALSE= fi case `pwd` in *\ * | *\ *) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5 $as_echo "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;; esac macro_version='2.4.6' macro_revision='2.4.6' ltmain=$ac_aux_dir/ltmain.sh # Make sure we can run config.sub. $SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 || as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5 $as_echo_n "checking build system type... " >&6; } if ${ac_cv_build+:} false; then : $as_echo_n "(cached) " >&6 else ac_build_alias=$build_alias test "x$ac_build_alias" = x && ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"` test "x$ac_build_alias" = x && as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5 ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` || as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5 $as_echo "$ac_cv_build" >&6; } case $ac_cv_build in *-*-*) ;; *) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;; esac build=$ac_cv_build ac_save_IFS=$IFS; IFS='-' set x $ac_cv_build shift build_cpu=$1 build_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: build_os=$* IFS=$ac_save_IFS case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5 $as_echo_n "checking host system type... " >&6; } if ${ac_cv_host+:} false; then : $as_echo_n "(cached) " >&6 else if test "x$host_alias" = x; then ac_cv_host=$ac_cv_build else ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` || as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5 fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5 $as_echo "$ac_cv_host" >&6; } case $ac_cv_host in *-*-*) ;; *) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;; esac host=$ac_cv_host ac_save_IFS=$IFS; IFS='-' set x $ac_cv_host shift host_cpu=$1 host_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: host_os=$* IFS=$ac_save_IFS case $host_os in *\ *) host_os=`echo "$host_os" | sed 's/ /-/g'`;; esac # Backslashify metacharacters that are still active within # double-quoted strings. sed_quote_subst='s/\(["`$\\]\)/\\\1/g' # Same as above, but do not quote variable references. double_quote_subst='s/\(["`\\]\)/\\\1/g' # Sed substitution to delay expansion of an escaped shell variable in a # double_quote_subst'ed string. delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g' # Sed substitution to delay expansion of an escaped single quote. delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g' # Sed substitution to avoid accidental globbing in evaled expressions no_glob_subst='s/\*/\\\*/g' ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5 $as_echo_n "checking how to print strings... " >&6; } # Test print first, because it will be a builtin if present. if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \ test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='print -r --' elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='printf %s\n' else # Use this function as a fallback that always works. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $1 _LTECHO_EOF' } ECHO='func_fallback_echo' fi # func_echo_all arg... # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "" } case $ECHO in printf*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: printf" >&5 $as_echo "printf" >&6; } ;; print*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: print -r" >&5 $as_echo "print -r" >&6; } ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: cat" >&5 $as_echo "cat" >&6; } ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5 $as_echo_n "checking for a sed that does not truncate output... " >&6; } if ${ac_cv_path_SED+:} false; then : $as_echo_n "(cached) " >&6 else ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/ for ac_i in 1 2 3 4 5 6 7; do ac_script="$ac_script$as_nl$ac_script" done echo "$ac_script" 2>/dev/null | sed 99q >conftest.sed { ac_script=; unset ac_script;} if test -z "$SED"; then ac_path_SED_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in sed gsed; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_SED="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_SED" || continue # Check for GNU ac_path_SED and select it if it is found. # Check for GNU $ac_path_SED case `"$ac_path_SED" --version 2>&1` in *GNU*) ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo '' >> "conftest.nl" "$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_SED_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_SED="$ac_path_SED" ac_path_SED_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_SED_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_SED"; then as_fn_error $? "no acceptable sed could be found in \$PATH" "$LINENO" 5 fi else ac_cv_path_SED=$SED fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5 $as_echo "$ac_cv_path_SED" >&6; } SED="$ac_cv_path_SED" rm -f conftest.sed test -z "$SED" && SED=sed Xsed="$SED -e 1s/^X//" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 $as_echo_n "checking for grep that handles long lines and -e... " >&6; } if ${ac_cv_path_GREP+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$GREP"; then ac_path_GREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in grep ggrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_GREP" || continue # Check for GNU ac_path_GREP and select it if it is found. # Check for GNU $ac_path_GREP case `"$ac_path_GREP" --version 2>&1` in *GNU*) ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'GREP' >> "conftest.nl" "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_GREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_GREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_GREP"; then as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_GREP=$GREP fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 $as_echo "$ac_cv_path_GREP" >&6; } GREP="$ac_cv_path_GREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 $as_echo_n "checking for egrep... " >&6; } if ${ac_cv_path_EGREP+:} false; then : $as_echo_n "(cached) " >&6 else if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 then ac_cv_path_EGREP="$GREP -E" else if test -z "$EGREP"; then ac_path_EGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in egrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_EGREP" || continue # Check for GNU ac_path_EGREP and select it if it is found. # Check for GNU $ac_path_EGREP case `"$ac_path_EGREP" --version 2>&1` in *GNU*) ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'EGREP' >> "conftest.nl" "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_EGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_EGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_EGREP"; then as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_EGREP=$EGREP fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 $as_echo "$ac_cv_path_EGREP" >&6; } EGREP="$ac_cv_path_EGREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5 $as_echo_n "checking for fgrep... " >&6; } if ${ac_cv_path_FGREP+:} false; then : $as_echo_n "(cached) " >&6 else if echo 'ab*c' | $GREP -F 'ab*c' >/dev/null 2>&1 then ac_cv_path_FGREP="$GREP -F" else if test -z "$FGREP"; then ac_path_FGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in fgrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_FGREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_FGREP" || continue # Check for GNU ac_path_FGREP and select it if it is found. # Check for GNU $ac_path_FGREP case `"$ac_path_FGREP" --version 2>&1` in *GNU*) ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'FGREP' >> "conftest.nl" "$ac_path_FGREP" FGREP < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_FGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_FGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_FGREP"; then as_fn_error $? "no acceptable fgrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_FGREP=$FGREP fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5 $as_echo "$ac_cv_path_FGREP" >&6; } FGREP="$ac_cv_path_FGREP" test -z "$GREP" && GREP=grep # Check whether --with-gnu-ld was given. if test "${with_gnu_ld+set}" = set; then : withval=$with_gnu_ld; test no = "$withval" || with_gnu_ld=yes else with_gnu_ld=no fi ac_prog=ld if test yes = "$GCC"; then # Check if gcc -print-prog-name=ld gives a path. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5 $as_echo_n "checking for ld used by $CC... " >&6; } case $host in *-*-mingw*) # gcc leaves a trailing carriage return, which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [\\/]* | ?:[\\/]*) re_direlt='/[^/][^/]*/\.\./' # Canonicalize the pathname of ld ac_prog=`$ECHO "$ac_prog"| $SED 's%\\\\%/%g'` while $ECHO "$ac_prog" | $GREP "$re_direlt" > /dev/null 2>&1; do ac_prog=`$ECHO $ac_prog| $SED "s%$re_direlt%/%"` done test -z "$LD" && LD=$ac_prog ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test yes = "$with_gnu_ld"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5 $as_echo_n "checking for GNU ld... " >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5 $as_echo_n "checking for non-GNU ld... " >&6; } fi if ${lt_cv_path_LD+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$LD"; then lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then lt_cv_path_LD=$ac_dir/$ac_prog # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some variants of GNU ld only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$lt_cv_path_LD" -v 2>&1 &5 $as_echo "$LD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5 $as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; } if ${lt_cv_prog_gnu_ld+:} false; then : $as_echo_n "(cached) " >&6 else # I'd rather use --version here, but apparently some GNU lds only accept -v. case `$LD -v 2>&1 &5 $as_echo "$lt_cv_prog_gnu_ld" >&6; } with_gnu_ld=$lt_cv_prog_gnu_ld { $as_echo "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5 $as_echo_n "checking for BSD- or MS-compatible name lister (nm)... " >&6; } if ${lt_cv_path_NM+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$NM"; then # Let the user override the test. lt_cv_path_NM=$NM else lt_nm_to_check=${ac_tool_prefix}nm if test -n "$ac_tool_prefix" && test "$build" = "$host"; then lt_nm_to_check="$lt_nm_to_check nm" fi for lt_tmp_nm in $lt_nm_to_check; do lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. tmp_nm=$ac_dir/$lt_tmp_nm if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext"; then # Check to see if the nm accepts a BSD-compat flag. # Adding the 'sed 1q' prevents false positives on HP-UX, which says: # nm: unknown option "B" ignored # Tru64's nm complains that /dev/null is an invalid object file # MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty case $build_os in mingw*) lt_bad_file=conftest.nm/nofile ;; *) lt_bad_file=/dev/null ;; esac case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in *$lt_bad_file* | *'Invalid file or object type'*) lt_cv_path_NM="$tmp_nm -B" break 2 ;; *) case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in */dev/null*) lt_cv_path_NM="$tmp_nm -p" break 2 ;; *) lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but continue # so that we can try to find one that supports BSD flags ;; esac ;; esac fi done IFS=$lt_save_ifs done : ${lt_cv_path_NM=no} fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5 $as_echo "$lt_cv_path_NM" >&6; } if test no != "$lt_cv_path_NM"; then NM=$lt_cv_path_NM else # Didn't find any BSD compatible name lister, look for dumpbin. if test -n "$DUMPBIN"; then : # Let the user override the test. else if test -n "$ac_tool_prefix"; then for ac_prog in dumpbin "link -dump" do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DUMPBIN+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DUMPBIN"; then ac_cv_prog_DUMPBIN="$DUMPBIN" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DUMPBIN="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DUMPBIN=$ac_cv_prog_DUMPBIN if test -n "$DUMPBIN"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5 $as_echo "$DUMPBIN" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$DUMPBIN" && break done fi if test -z "$DUMPBIN"; then ac_ct_DUMPBIN=$DUMPBIN for ac_prog in dumpbin "link -dump" do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DUMPBIN+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DUMPBIN"; then ac_cv_prog_ac_ct_DUMPBIN="$ac_ct_DUMPBIN" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DUMPBIN="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DUMPBIN=$ac_cv_prog_ac_ct_DUMPBIN if test -n "$ac_ct_DUMPBIN"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5 $as_echo "$ac_ct_DUMPBIN" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_DUMPBIN" && break done if test "x$ac_ct_DUMPBIN" = x; then DUMPBIN=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DUMPBIN=$ac_ct_DUMPBIN fi fi case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in *COFF*) DUMPBIN="$DUMPBIN -symbols -headers" ;; *) DUMPBIN=: ;; esac fi if test : != "$DUMPBIN"; then NM=$DUMPBIN fi fi test -z "$NM" && NM=nm { $as_echo "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5 $as_echo_n "checking the name lister ($NM) interface... " >&6; } if ${lt_cv_nm_interface+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_nm_interface="BSD nm" echo "int some_variable = 0;" > conftest.$ac_ext (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&5) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&5 (eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&5) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&5 (eval echo "\"\$as_me:$LINENO: output\"" >&5) cat conftest.out >&5 if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5 $as_echo "$lt_cv_nm_interface" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5 $as_echo_n "checking whether ln -s works... " >&6; } LN_S=$as_ln_s if test "$LN_S" = "ln -s"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5 $as_echo "no, using $LN_S" >&6; } fi # find the maximum length of command line arguments { $as_echo "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5 $as_echo_n "checking the maximum length of command line arguments... " >&6; } if ${lt_cv_sys_max_cmd_len+:} false; then : $as_echo_n "(cached) " >&6 else i=0 teststring=ABCD case $build_os in msdosdjgpp*) # On DJGPP, this test can blow up pretty badly due to problems in libc # (any single argument exceeding 2000 bytes causes a buffer overrun # during glob expansion). Even if it were fixed, the result of this # check would be larger than it should be. lt_cv_sys_max_cmd_len=12288; # 12K is about right ;; gnu*) # Under GNU Hurd, this test is not required because there is # no limit to the length of command line arguments. # Libtool will interpret -1 as no limit whatsoever lt_cv_sys_max_cmd_len=-1; ;; cygwin* | mingw* | cegcc*) # On Win9x/ME, this test blows up -- it succeeds, but takes # about 5 minutes as the teststring grows exponentially. # Worse, since 9x/ME are not pre-emptively multitasking, # you end up with a "frozen" computer, even though with patience # the test eventually succeeds (with a max line length of 256k). # Instead, let's just punt: use the minimum linelength reported by # all of the supported platforms: 8192 (on NT/2K/XP). lt_cv_sys_max_cmd_len=8192; ;; mint*) # On MiNT this can take a long time and run out of memory. lt_cv_sys_max_cmd_len=8192; ;; amigaos*) # On AmigaOS with pdksh, this test takes hours, literally. # So we just punt and use a minimum line length of 8192. lt_cv_sys_max_cmd_len=8192; ;; bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*) # This has been around since 386BSD, at least. Likely further. if test -x /sbin/sysctl; then lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax` elif test -x /usr/sbin/sysctl; then lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax` else lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs fi # And add a safety zone lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` ;; interix*) # We know the value 262144 and hardcode it with a safety zone (like BSD) lt_cv_sys_max_cmd_len=196608 ;; os2*) # The test takes a long time on OS/2. lt_cv_sys_max_cmd_len=8192 ;; osf*) # Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure # due to this test when exec_disable_arg_limit is 1 on Tru64. It is not # nice to cause kernel panics so lets avoid the loop below. # First set a reasonable default. lt_cv_sys_max_cmd_len=16384 # if test -x /sbin/sysconfig; then case `/sbin/sysconfig -q proc exec_disable_arg_limit` in *1*) lt_cv_sys_max_cmd_len=-1 ;; esac fi ;; sco3.2v5*) lt_cv_sys_max_cmd_len=102400 ;; sysv5* | sco5v6* | sysv4.2uw2*) kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null` if test -n "$kargmax"; then lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[ ]//'` else lt_cv_sys_max_cmd_len=32768 fi ;; *) lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null` if test -n "$lt_cv_sys_max_cmd_len" && \ test undefined != "$lt_cv_sys_max_cmd_len"; then lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` else # Make teststring a little bigger before we do anything with it. # a 1K string should be a reasonable start. for i in 1 2 3 4 5 6 7 8; do teststring=$teststring$teststring done SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}} # If test is not a shell built-in, we'll probably end up computing a # maximum length that is only half of the actual maximum length, but # we can't tell. while { test X`env echo "$teststring$teststring" 2>/dev/null` \ = "X$teststring$teststring"; } >/dev/null 2>&1 && test 17 != "$i" # 1/2 MB should be enough do i=`expr $i + 1` teststring=$teststring$teststring done # Only check the string length outside the loop. lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1` teststring= # Add a significant safety factor because C++ compilers can tack on # massive amounts of additional arguments before passing them to the # linker. It appears as though 1/2 is a usable value. lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2` fi ;; esac fi if test -n "$lt_cv_sys_max_cmd_len"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5 $as_echo "$lt_cv_sys_max_cmd_len" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5 $as_echo "none" >&6; } fi max_cmd_len=$lt_cv_sys_max_cmd_len : ${CP="cp -f"} : ${MV="mv -f"} : ${RM="rm -f"} if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then lt_unset=unset else lt_unset=false fi # test EBCDIC or ASCII case `echo X|tr X '\101'` in A) # ASCII based system # \n is not interpreted correctly by Solaris 8 /usr/ucb/tr lt_SP2NL='tr \040 \012' lt_NL2SP='tr \015\012 \040\040' ;; *) # EBCDIC based system lt_SP2NL='tr \100 \n' lt_NL2SP='tr \r\n \100\100' ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5 $as_echo_n "checking how to convert $build file names to $host format... " >&6; } if ${lt_cv_to_host_file_cmd+:} false; then : $as_echo_n "(cached) " >&6 else case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32 ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32 ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32 ;; esac ;; *-*-cygwin* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_noop ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin ;; esac ;; * ) # unhandled hosts (and "normal" native builds) lt_cv_to_host_file_cmd=func_convert_file_noop ;; esac fi to_host_file_cmd=$lt_cv_to_host_file_cmd { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5 $as_echo "$lt_cv_to_host_file_cmd" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5 $as_echo_n "checking how to convert $build file names to toolchain format... " >&6; } if ${lt_cv_to_tool_file_cmd+:} false; then : $as_echo_n "(cached) " >&6 else #assume ordinary cross tools, or native build. lt_cv_to_tool_file_cmd=func_convert_file_noop case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32 ;; esac ;; esac fi to_tool_file_cmd=$lt_cv_to_tool_file_cmd { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5 $as_echo "$lt_cv_to_tool_file_cmd" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5 $as_echo_n "checking for $LD option to reload object files... " >&6; } if ${lt_cv_ld_reload_flag+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_reload_flag='-r' fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5 $as_echo "$lt_cv_ld_reload_flag" >&6; } reload_flag=$lt_cv_ld_reload_flag case $reload_flag in "" | " "*) ;; *) reload_flag=" $reload_flag" ;; esac reload_cmds='$LD$reload_flag -o $output$reload_objs' case $host_os in cygwin* | mingw* | pw32* | cegcc*) if test yes != "$GCC"; then reload_cmds=false fi ;; darwin*) if test yes = "$GCC"; then reload_cmds='$LTCC $LTCFLAGS -nostdlib $wl-r -o $output$reload_objs' else reload_cmds='$LD$reload_flag -o $output$reload_objs' fi ;; esac if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args. set dummy ${ac_tool_prefix}objdump; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OBJDUMP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OBJDUMP"; then ac_cv_prog_OBJDUMP="$OBJDUMP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OBJDUMP="${ac_tool_prefix}objdump" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OBJDUMP=$ac_cv_prog_OBJDUMP if test -n "$OBJDUMP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5 $as_echo "$OBJDUMP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OBJDUMP"; then ac_ct_OBJDUMP=$OBJDUMP # Extract the first word of "objdump", so it can be a program name with args. set dummy objdump; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OBJDUMP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OBJDUMP"; then ac_cv_prog_ac_ct_OBJDUMP="$ac_ct_OBJDUMP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OBJDUMP="objdump" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OBJDUMP=$ac_cv_prog_ac_ct_OBJDUMP if test -n "$ac_ct_OBJDUMP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5 $as_echo "$ac_ct_OBJDUMP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OBJDUMP" = x; then OBJDUMP="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OBJDUMP=$ac_ct_OBJDUMP fi else OBJDUMP="$ac_cv_prog_OBJDUMP" fi test -z "$OBJDUMP" && OBJDUMP=objdump { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5 $as_echo_n "checking how to recognize dependent libraries... " >&6; } if ${lt_cv_deplibs_check_method+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_file_magic_cmd='$MAGIC_CMD' lt_cv_file_magic_test_file= lt_cv_deplibs_check_method='unknown' # Need to set the preceding variable on all platforms that support # interlibrary dependencies. # 'none' -- dependencies not supported. # 'unknown' -- same as none, but documents that we really don't know. # 'pass_all' -- all dependencies passed with no checks. # 'test_compile' -- check by making test program. # 'file_magic [[regex]]' -- check by looking for files in library path # that responds to the $file_magic_cmd with a given extended regex. # If you have 'file' or equivalent on your system and you're not sure # whether 'pass_all' will *always* work, you probably want this one. case $host_os in aix[4-9]*) lt_cv_deplibs_check_method=pass_all ;; beos*) lt_cv_deplibs_check_method=pass_all ;; bsdi[45]*) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object|dynamic lib)' lt_cv_file_magic_cmd='/usr/bin/file -L' lt_cv_file_magic_test_file=/shlib/libc.so ;; cygwin*) # func_win32_libid is a shell function defined in ltmain.sh lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' ;; mingw* | pw32*) # Base MSYS/MinGW do not provide the 'file' command needed by # func_win32_libid shell function, so use a weaker test based on 'objdump', # unless we find 'file', for example because we are cross-compiling. if ( file / ) >/dev/null 2>&1; then lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' else # Keep this pattern in sync with the one in func_win32_libid. lt_cv_deplibs_check_method='file_magic file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' lt_cv_file_magic_cmd='$OBJDUMP -f' fi ;; cegcc*) # use the weaker test based on 'objdump'. See mingw*. lt_cv_deplibs_check_method='file_magic file format pe-arm-.*little(.*architecture: arm)?' lt_cv_file_magic_cmd='$OBJDUMP -f' ;; darwin* | rhapsody*) lt_cv_deplibs_check_method=pass_all ;; freebsd* | dragonfly*) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then case $host_cpu in i*86 ) # Not sure whether the presence of OpenBSD here was a mistake. # Let's accept both of them until this is cleared up. lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[3-9]86 (compact )?demand paged shared library' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*` ;; esac else lt_cv_deplibs_check_method=pass_all fi ;; haiku*) lt_cv_deplibs_check_method=pass_all ;; hpux10.20* | hpux11*) lt_cv_file_magic_cmd=/usr/bin/file case $host_cpu in ia64*) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF-[0-9][0-9]) shared object file - IA64' lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so ;; hppa*64*) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]' lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl ;; *) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|PA-RISC[0-9]\.[0-9]) shared library' lt_cv_file_magic_test_file=/usr/lib/libc.sl ;; esac ;; interix[3-9]*) # PIC code is broken on Interix 3.x, that's why |\.a not |_pic\.a here lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so|\.a)$' ;; irix5* | irix6* | nonstopux*) case $LD in *-32|*"-32 ") libmagic=32-bit;; *-n32|*"-n32 ") libmagic=N32;; *-64|*"-64 ") libmagic=64-bit;; *) libmagic=never-match;; esac lt_cv_deplibs_check_method=pass_all ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) lt_cv_deplibs_check_method=pass_all ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so|_pic\.a)$' fi ;; newos6*) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (executable|dynamic lib)' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=/usr/lib/libnls.so ;; *nto* | *qnx*) lt_cv_deplibs_check_method=pass_all ;; openbsd* | bitrig*) if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|\.so|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$' fi ;; osf3* | osf4* | osf5*) lt_cv_deplibs_check_method=pass_all ;; rdos*) lt_cv_deplibs_check_method=pass_all ;; solaris*) lt_cv_deplibs_check_method=pass_all ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) lt_cv_deplibs_check_method=pass_all ;; sysv4 | sysv4.3*) case $host_vendor in motorola) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object|dynamic lib) M[0-9][0-9]* Version [0-9]' lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*` ;; ncr) lt_cv_deplibs_check_method=pass_all ;; sequent) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [LM]SB (shared object|dynamic lib )' ;; sni) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method="file_magic ELF [0-9][0-9]*-bit [LM]SB dynamic lib" lt_cv_file_magic_test_file=/lib/libc.so ;; siemens) lt_cv_deplibs_check_method=pass_all ;; pc) lt_cv_deplibs_check_method=pass_all ;; esac ;; tpf*) lt_cv_deplibs_check_method=pass_all ;; os2*) lt_cv_deplibs_check_method=pass_all ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5 $as_echo "$lt_cv_deplibs_check_method" >&6; } file_magic_glob= want_nocaseglob=no if test "$build" = "$host"; then case $host_os in mingw* | pw32*) if ( shopt | grep nocaseglob ) >/dev/null 2>&1; then want_nocaseglob=yes else file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ | $SED -e "s/\(..\)/s\/[\1]\/[\1]\/g;/g"` fi ;; esac fi file_magic_cmd=$lt_cv_file_magic_cmd deplibs_check_method=$lt_cv_deplibs_check_method test -z "$deplibs_check_method" && deplibs_check_method=unknown if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}dlltool", so it can be a program name with args. set dummy ${ac_tool_prefix}dlltool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DLLTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DLLTOOL"; then ac_cv_prog_DLLTOOL="$DLLTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DLLTOOL="${ac_tool_prefix}dlltool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DLLTOOL=$ac_cv_prog_DLLTOOL if test -n "$DLLTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5 $as_echo "$DLLTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_DLLTOOL"; then ac_ct_DLLTOOL=$DLLTOOL # Extract the first word of "dlltool", so it can be a program name with args. set dummy dlltool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DLLTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DLLTOOL"; then ac_cv_prog_ac_ct_DLLTOOL="$ac_ct_DLLTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DLLTOOL="dlltool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DLLTOOL=$ac_cv_prog_ac_ct_DLLTOOL if test -n "$ac_ct_DLLTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5 $as_echo "$ac_ct_DLLTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_DLLTOOL" = x; then DLLTOOL="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DLLTOOL=$ac_ct_DLLTOOL fi else DLLTOOL="$ac_cv_prog_DLLTOOL" fi test -z "$DLLTOOL" && DLLTOOL=dlltool { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5 $as_echo_n "checking how to associate runtime and link libraries... " >&6; } if ${lt_cv_sharedlib_from_linklib_cmd+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_sharedlib_from_linklib_cmd='unknown' case $host_os in cygwin* | mingw* | pw32* | cegcc*) # two different shell functions defined in ltmain.sh; # decide which one to use based on capabilities of $DLLTOOL case `$DLLTOOL --help 2>&1` in *--identify-strict*) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib ;; *) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback ;; esac ;; *) # fallback: assume linklib IS sharedlib lt_cv_sharedlib_from_linklib_cmd=$ECHO ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5 $as_echo "$lt_cv_sharedlib_from_linklib_cmd" >&6; } sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO if test -n "$ac_tool_prefix"; then for ac_prog in ar do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AR+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AR"; then ac_cv_prog_AR="$AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_AR="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AR=$ac_cv_prog_AR if test -n "$AR"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5 $as_echo "$AR" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AR" && break done fi if test -z "$AR"; then ac_ct_AR=$AR for ac_prog in ar do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_AR+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_AR"; then ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_AR="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_AR=$ac_cv_prog_ac_ct_AR if test -n "$ac_ct_AR"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5 $as_echo "$ac_ct_AR" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_AR" && break done if test "x$ac_ct_AR" = x; then AR="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac AR=$ac_ct_AR fi fi : ${AR=ar} : ${AR_FLAGS=cru} { $as_echo "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5 $as_echo_n "checking for archiver @FILE support... " >&6; } if ${lt_cv_ar_at_file+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ar_at_file=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : echo conftest.$ac_objext > conftest.lst lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&5' { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5 (eval $lt_ar_try) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if test 0 -eq "$ac_status"; then # Ensure the archiver fails upon bogus file names. rm -f conftest.$ac_objext libconftest.a { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5 (eval $lt_ar_try) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if test 0 -ne "$ac_status"; then lt_cv_ar_at_file=@ fi fi rm -f conftest.* libconftest.a fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5 $as_echo "$lt_cv_ar_at_file" >&6; } if test no = "$lt_cv_ar_at_file"; then archiver_list_spec= else archiver_list_spec=$lt_cv_ar_at_file fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args. set dummy ${ac_tool_prefix}strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$STRIP"; then ac_cv_prog_STRIP="$STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_STRIP="${ac_tool_prefix}strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi STRIP=$ac_cv_prog_STRIP if test -n "$STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5 $as_echo "$STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_STRIP"; then ac_ct_STRIP=$STRIP # Extract the first word of "strip", so it can be a program name with args. set dummy strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_STRIP"; then ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_STRIP="strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP if test -n "$ac_ct_STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5 $as_echo "$ac_ct_STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_STRIP" = x; then STRIP=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac STRIP=$ac_ct_STRIP fi else STRIP="$ac_cv_prog_STRIP" fi test -z "$STRIP" && STRIP=: if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args. set dummy ${ac_tool_prefix}ranlib; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_RANLIB+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$RANLIB"; then ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi RANLIB=$ac_cv_prog_RANLIB if test -n "$RANLIB"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5 $as_echo "$RANLIB" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_RANLIB"; then ac_ct_RANLIB=$RANLIB # Extract the first word of "ranlib", so it can be a program name with args. set dummy ranlib; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_RANLIB+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_RANLIB"; then ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_RANLIB="ranlib" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB if test -n "$ac_ct_RANLIB"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5 $as_echo "$ac_ct_RANLIB" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_RANLIB" = x; then RANLIB=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac RANLIB=$ac_ct_RANLIB fi else RANLIB="$ac_cv_prog_RANLIB" fi test -z "$RANLIB" && RANLIB=: # Determine commands to create old-style static archives. old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs' old_postinstall_cmds='chmod 644 $oldlib' old_postuninstall_cmds= if test -n "$RANLIB"; then case $host_os in bitrig* | openbsd*) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib" ;; *) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib" ;; esac old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib" fi case $host_os in darwin*) lock_old_archive_extraction=yes ;; *) lock_old_archive_extraction=no ;; esac # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC # Check for command to grab the raw symbol name followed by C symbol from nm. { $as_echo "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5 $as_echo_n "checking command to parse $NM output from $compiler object... " >&6; } if ${lt_cv_sys_global_symbol_pipe+:} false; then : $as_echo_n "(cached) " >&6 else # These are sane defaults that work on at least a few old systems. # [They come from Ultrix. What could be older than Ultrix?!! ;)] # Character class describing NM global symbol codes. symcode='[BCDEGRST]' # Regexp to match symbols that can be accessed directly from C. sympat='\([_A-Za-z][_A-Za-z0-9]*\)' # Define system-specific variables. case $host_os in aix*) symcode='[BCDT]' ;; cygwin* | mingw* | pw32* | cegcc*) symcode='[ABCDGISTW]' ;; hpux*) if test ia64 = "$host_cpu"; then symcode='[ABCDEGRST]' fi ;; irix* | nonstopux*) symcode='[BCDEGRST]' ;; osf*) symcode='[BCDEGQRST]' ;; solaris*) symcode='[BDRT]' ;; sco3.2v5*) symcode='[DT]' ;; sysv4.2uw2*) symcode='[DT]' ;; sysv5* | sco5v6* | unixware* | OpenUNIX*) symcode='[ABDT]' ;; sysv4) symcode='[DFNSTU]' ;; esac # If we're using GNU nm, then use its standard symbol codes. case `$NM -V 2>&1` in *GNU* | *'with BFD'*) symcode='[ABCDGIRSTW]' ;; esac if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Gets list of data symbols to import. lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'" # Adjust the below global symbol transforms to fixup imported variables. lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'" lt_c_name_hook=" -e 's/^I .* \(.*\)$/ {\"\1\", (void *) 0},/p'" lt_c_name_lib_hook="\ -e 's/^I .* \(lib.*\)$/ {\"\1\", (void *) 0},/p'\ -e 's/^I .* \(.*\)$/ {\"lib\1\", (void *) 0},/p'" else # Disable hooks by default. lt_cv_sys_global_symbol_to_import= lt_cdecl_hook= lt_c_name_hook= lt_c_name_lib_hook= fi # Transform an extracted symbol line into a proper C declaration. # Some systems (esp. on ia64) link data and code symbols differently, # so use this general approach. lt_cv_sys_global_symbol_to_cdecl="sed -n"\ $lt_cdecl_hook\ " -e 's/^T .* \(.*\)$/extern int \1();/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'" # Transform an extracted symbol line into symbol name and symbol address lt_cv_sys_global_symbol_to_c_name_address="sed -n"\ $lt_c_name_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/p'" # Transform an extracted symbol line into symbol name with lib prefix and # symbol address. lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\ $lt_c_name_lib_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(lib.*\)$/ {\"\1\", (void *) \&\1},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"lib\1\", (void *) \&\1},/p'" # Handle CRLF in mingw tool chain opt_cr= case $build_os in mingw*) opt_cr=`$ECHO 'x\{0,1\}' | tr x '\015'` # option cr in regexp ;; esac # Try without a prefix underscore, then with it. for ac_symprfx in "" "_"; do # Transform symcode, sympat, and symprfx into a raw symbol and a C symbol. symxfrm="\\1 $ac_symprfx\\2 \\2" # Write the raw and C identifiers. if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Fake it for dumpbin and say T for any non-static function, # D for any global variable and I for any imported variable. # Also find C++ and __fastcall symbols from MSVC++, # which start with @ or ?. lt_cv_sys_global_symbol_pipe="$AWK '"\ " {last_section=section; section=\$ 3};"\ " /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\ " /Section length .*#relocs.*(pick any)/{hide[last_section]=1};"\ " /^ *Symbol name *: /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\ " /^ *Type *: code/{print \"T\",si,substr(si,length(prfx))};"\ " /^ *Type *: data/{print \"I\",si,substr(si,length(prfx))};"\ " \$ 0!~/External *\|/{next};"\ " / 0+ UNDEF /{next}; / UNDEF \([^|]\)*()/{next};"\ " {if(hide[section]) next};"\ " {f=\"D\"}; \$ 0~/\(\).*\|/{f=\"T\"};"\ " {split(\$ 0,a,/\||\r/); split(a[2],s)};"\ " s[1]~/^[@?]/{print f,s[1],s[1]; next};"\ " s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\ " ' prfx=^$ac_symprfx" else lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[ ]\($symcode$symcode*\)[ ][ ]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'" fi lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'" # Check to see that the pipe works correctly. pipe_works=no rm -f conftest* cat > conftest.$ac_ext <<_LT_EOF #ifdef __cplusplus extern "C" { #endif char nm_test_var; void nm_test_func(void); void nm_test_func(void){} #ifdef __cplusplus } #endif int main(){nm_test_var='a';nm_test_func();return(0);} _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then # Now try to grab the symbols. nlist=conftest.nm if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5 (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "$nlist"; then # Try sorting and uniquifying the output. if sort "$nlist" | uniq > "$nlist"T; then mv -f "$nlist"T "$nlist" else rm -f "$nlist"T fi # Make sure that we snagged all the symbols we need. if $GREP ' nm_test_var$' "$nlist" >/dev/null; then if $GREP ' nm_test_func$' "$nlist" >/dev/null; then cat <<_LT_EOF > conftest.$ac_ext /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT_DLSYM_CONST #else # define LT_DLSYM_CONST const #endif #ifdef __cplusplus extern "C" { #endif _LT_EOF # Now generate the symbol file. eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" | $GREP -v main >> conftest.$ac_ext' cat <<_LT_EOF >> conftest.$ac_ext /* The mapping between symbol names and symbols. */ LT_DLSYM_CONST struct { const char *name; void *address; } lt__PROGRAM__LTX_preloaded_symbols[] = { { "@PROGRAM@", (void *) 0 }, _LT_EOF $SED "s/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/" < "$nlist" | $GREP -v main >> conftest.$ac_ext cat <<\_LT_EOF >> conftest.$ac_ext {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt__PROGRAM__LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif _LT_EOF # Now try linking the two files. mv conftest.$ac_objext conftstm.$ac_objext lt_globsym_save_LIBS=$LIBS lt_globsym_save_CFLAGS=$CFLAGS LIBS=conftstm.$ac_objext CFLAGS="$CFLAGS$lt_prog_compiler_no_builtin_flag" if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s conftest$ac_exeext; then pipe_works=yes fi LIBS=$lt_globsym_save_LIBS CFLAGS=$lt_globsym_save_CFLAGS else echo "cannot find nm_test_func in $nlist" >&5 fi else echo "cannot find nm_test_var in $nlist" >&5 fi else echo "cannot run $lt_cv_sys_global_symbol_pipe" >&5 fi else echo "$progname: failed program was:" >&5 cat conftest.$ac_ext >&5 fi rm -rf conftest* conftst* # Do not use the global_symbol_pipe unless it works. if test yes = "$pipe_works"; then break else lt_cv_sys_global_symbol_pipe= fi done fi if test -z "$lt_cv_sys_global_symbol_pipe"; then lt_cv_sys_global_symbol_to_cdecl= fi if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5 $as_echo "failed" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5 $as_echo "ok" >&6; } fi # Response file support. if test "$lt_cv_nm_interface" = "MS dumpbin"; then nm_file_list_spec='@' elif $NM --help 2>/dev/null | grep '[@]FILE' >/dev/null; then nm_file_list_spec='@' fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5 $as_echo_n "checking for sysroot... " >&6; } # Check whether --with-sysroot was given. if test "${with_sysroot+set}" = set; then : withval=$with_sysroot; else with_sysroot=no fi lt_sysroot= case $with_sysroot in #( yes) if test yes = "$GCC"; then lt_sysroot=`$CC --print-sysroot 2>/dev/null` fi ;; #( /*) lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"` ;; #( no|'') ;; #( *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5 $as_echo "$with_sysroot" >&6; } as_fn_error $? "The sysroot must be an absolute path." "$LINENO" 5 ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5 $as_echo "${lt_sysroot:-no}" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5 $as_echo_n "checking for a working dd... " >&6; } if ${ac_cv_path_lt_DD+:} false; then : $as_echo_n "(cached) " >&6 else printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i : ${lt_DD:=$DD} if test -z "$lt_DD"; then ac_path_lt_DD_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in dd; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_lt_DD="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_lt_DD" || continue if "$ac_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=: fi $ac_path_lt_DD_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_lt_DD"; then : fi else ac_cv_path_lt_DD=$lt_DD fi rm -f conftest.i conftest2.i conftest.out fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5 $as_echo "$ac_cv_path_lt_DD" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5 $as_echo_n "checking how to truncate binary pipes... " >&6; } if ${lt_cv_truncate_bin+:} false; then : $as_echo_n "(cached) " >&6 else printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i lt_cv_truncate_bin= if "$ac_cv_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1" fi rm -f conftest.i conftest2.i conftest.out test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q" fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5 $as_echo "$lt_cv_truncate_bin" >&6; } # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in $*""; do case $cc_temp in compile | *[\\/]compile | ccache | *[\\/]ccache ) ;; distcc | *[\\/]distcc | purify | *[\\/]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } # Check whether --enable-libtool-lock was given. if test "${enable_libtool_lock+set}" = set; then : enableval=$enable_libtool_lock; fi test no = "$enable_libtool_lock" || enable_libtool_lock=yes # Some flags need to be propagated to the compiler or linker for good # libtool support. case $host in ia64-*-hpux*) # Find out what ABI is being produced by ac_compile, and set mode # options accordingly. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.$ac_objext` in *ELF-32*) HPUX_IA64_MODE=32 ;; *ELF-64*) HPUX_IA64_MODE=64 ;; esac fi rm -rf conftest* ;; *-*-irix6*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '#line '$LINENO' "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then if test yes = "$lt_cv_prog_gnu_ld"; then case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -melf32bsmip" ;; *N32*) LD="${LD-ld} -melf32bmipn32" ;; *64-bit*) LD="${LD-ld} -melf64bmip" ;; esac else case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -32" ;; *N32*) LD="${LD-ld} -n32" ;; *64-bit*) LD="${LD-ld} -64" ;; esac fi fi rm -rf conftest* ;; mips64*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '#line '$LINENO' "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then emul=elf case `/usr/bin/file conftest.$ac_objext` in *32-bit*) emul="${emul}32" ;; *64-bit*) emul="${emul}64" ;; esac case `/usr/bin/file conftest.$ac_objext` in *MSB*) emul="${emul}btsmip" ;; *LSB*) emul="${emul}ltsmip" ;; esac case `/usr/bin/file conftest.$ac_objext` in *N32*) emul="${emul}n32" ;; esac LD="${LD-ld} -m $emul" fi rm -rf conftest* ;; x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \ s390*-*linux*|s390*-*tpf*|sparc*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. Note that the listed cases only cover the # situations where additional linker options are needed (such as when # doing 32-bit compilation for a host where ld defaults to 64-bit, or # vice versa); the common cases where no linker options are needed do # not appear in the list. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.o` in *32-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_i386_fbsd" ;; x86_64-*linux*) case `/usr/bin/file conftest.o` in *x86-64*) LD="${LD-ld} -m elf32_x86_64" ;; *) LD="${LD-ld} -m elf_i386" ;; esac ;; powerpc64le-*linux*) LD="${LD-ld} -m elf32lppclinux" ;; powerpc64-*linux*) LD="${LD-ld} -m elf32ppclinux" ;; s390x-*linux*) LD="${LD-ld} -m elf_s390" ;; sparc64-*linux*) LD="${LD-ld} -m elf32_sparc" ;; esac ;; *64-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_x86_64_fbsd" ;; x86_64-*linux*) LD="${LD-ld} -m elf_x86_64" ;; powerpcle-*linux*) LD="${LD-ld} -m elf64lppc" ;; powerpc-*linux*) LD="${LD-ld} -m elf64ppc" ;; s390*-*linux*|s390*-*tpf*) LD="${LD-ld} -m elf64_s390" ;; sparc*-*linux*) LD="${LD-ld} -m elf64_sparc" ;; esac ;; esac fi rm -rf conftest* ;; *-*-sco3.2v5*) # On SCO OpenServer 5, we need -belf to get full-featured binaries. SAVE_CFLAGS=$CFLAGS CFLAGS="$CFLAGS -belf" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5 $as_echo_n "checking whether the C compiler needs -belf... " >&6; } if ${lt_cv_cc_needs_belf+:} false; then : $as_echo_n "(cached) " >&6 else ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_cc_needs_belf=yes else lt_cv_cc_needs_belf=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5 $as_echo "$lt_cv_cc_needs_belf" >&6; } if test yes != "$lt_cv_cc_needs_belf"; then # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf CFLAGS=$SAVE_CFLAGS fi ;; *-*solaris*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.o` in *64-bit*) case $lt_cv_prog_gnu_ld in yes*) case $host in i?86-*-solaris*|x86_64-*-solaris*) LD="${LD-ld} -m elf_x86_64" ;; sparc*-*-solaris*) LD="${LD-ld} -m elf64_sparc" ;; esac # GNU ld 2.21 introduced _sol2 emulations. Use them if available. if ${LD-ld} -V | grep _sol2 >/dev/null 2>&1; then LD=${LD-ld}_sol2 fi ;; *) if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then LD="${LD-ld} -64" fi ;; esac ;; esac fi rm -rf conftest* ;; esac need_locks=$enable_libtool_lock if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}mt", so it can be a program name with args. set dummy ${ac_tool_prefix}mt; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_MANIFEST_TOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$MANIFEST_TOOL"; then ac_cv_prog_MANIFEST_TOOL="$MANIFEST_TOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_MANIFEST_TOOL="${ac_tool_prefix}mt" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi MANIFEST_TOOL=$ac_cv_prog_MANIFEST_TOOL if test -n "$MANIFEST_TOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5 $as_echo "$MANIFEST_TOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_MANIFEST_TOOL"; then ac_ct_MANIFEST_TOOL=$MANIFEST_TOOL # Extract the first word of "mt", so it can be a program name with args. set dummy mt; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_MANIFEST_TOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_MANIFEST_TOOL"; then ac_cv_prog_ac_ct_MANIFEST_TOOL="$ac_ct_MANIFEST_TOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_MANIFEST_TOOL="mt" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_MANIFEST_TOOL=$ac_cv_prog_ac_ct_MANIFEST_TOOL if test -n "$ac_ct_MANIFEST_TOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5 $as_echo "$ac_ct_MANIFEST_TOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_MANIFEST_TOOL" = x; then MANIFEST_TOOL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac MANIFEST_TOOL=$ac_ct_MANIFEST_TOOL fi else MANIFEST_TOOL="$ac_cv_prog_MANIFEST_TOOL" fi test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5 $as_echo_n "checking if $MANIFEST_TOOL is a manifest tool... " >&6; } if ${lt_cv_path_mainfest_tool+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_path_mainfest_tool=no echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&5 $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out cat conftest.err >&5 if $GREP 'Manifest Tool' conftest.out > /dev/null; then lt_cv_path_mainfest_tool=yes fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5 $as_echo "$lt_cv_path_mainfest_tool" >&6; } if test yes != "$lt_cv_path_mainfest_tool"; then MANIFEST_TOOL=: fi case $host_os in rhapsody* | darwin*) if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}dsymutil", so it can be a program name with args. set dummy ${ac_tool_prefix}dsymutil; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DSYMUTIL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DSYMUTIL"; then ac_cv_prog_DSYMUTIL="$DSYMUTIL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DSYMUTIL="${ac_tool_prefix}dsymutil" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DSYMUTIL=$ac_cv_prog_DSYMUTIL if test -n "$DSYMUTIL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5 $as_echo "$DSYMUTIL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_DSYMUTIL"; then ac_ct_DSYMUTIL=$DSYMUTIL # Extract the first word of "dsymutil", so it can be a program name with args. set dummy dsymutil; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DSYMUTIL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DSYMUTIL"; then ac_cv_prog_ac_ct_DSYMUTIL="$ac_ct_DSYMUTIL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DSYMUTIL="dsymutil" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DSYMUTIL=$ac_cv_prog_ac_ct_DSYMUTIL if test -n "$ac_ct_DSYMUTIL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5 $as_echo "$ac_ct_DSYMUTIL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_DSYMUTIL" = x; then DSYMUTIL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DSYMUTIL=$ac_ct_DSYMUTIL fi else DSYMUTIL="$ac_cv_prog_DSYMUTIL" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}nmedit", so it can be a program name with args. set dummy ${ac_tool_prefix}nmedit; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_NMEDIT+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$NMEDIT"; then ac_cv_prog_NMEDIT="$NMEDIT" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_NMEDIT="${ac_tool_prefix}nmedit" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi NMEDIT=$ac_cv_prog_NMEDIT if test -n "$NMEDIT"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5 $as_echo "$NMEDIT" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_NMEDIT"; then ac_ct_NMEDIT=$NMEDIT # Extract the first word of "nmedit", so it can be a program name with args. set dummy nmedit; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_NMEDIT+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_NMEDIT"; then ac_cv_prog_ac_ct_NMEDIT="$ac_ct_NMEDIT" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_NMEDIT="nmedit" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_NMEDIT=$ac_cv_prog_ac_ct_NMEDIT if test -n "$ac_ct_NMEDIT"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5 $as_echo "$ac_ct_NMEDIT" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_NMEDIT" = x; then NMEDIT=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac NMEDIT=$ac_ct_NMEDIT fi else NMEDIT="$ac_cv_prog_NMEDIT" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}lipo", so it can be a program name with args. set dummy ${ac_tool_prefix}lipo; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_LIPO+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$LIPO"; then ac_cv_prog_LIPO="$LIPO" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_LIPO="${ac_tool_prefix}lipo" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi LIPO=$ac_cv_prog_LIPO if test -n "$LIPO"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5 $as_echo "$LIPO" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_LIPO"; then ac_ct_LIPO=$LIPO # Extract the first word of "lipo", so it can be a program name with args. set dummy lipo; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_LIPO+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_LIPO"; then ac_cv_prog_ac_ct_LIPO="$ac_ct_LIPO" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_LIPO="lipo" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_LIPO=$ac_cv_prog_ac_ct_LIPO if test -n "$ac_ct_LIPO"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5 $as_echo "$ac_ct_LIPO" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_LIPO" = x; then LIPO=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac LIPO=$ac_ct_LIPO fi else LIPO="$ac_cv_prog_LIPO" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}otool", so it can be a program name with args. set dummy ${ac_tool_prefix}otool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OTOOL"; then ac_cv_prog_OTOOL="$OTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OTOOL="${ac_tool_prefix}otool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OTOOL=$ac_cv_prog_OTOOL if test -n "$OTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5 $as_echo "$OTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OTOOL"; then ac_ct_OTOOL=$OTOOL # Extract the first word of "otool", so it can be a program name with args. set dummy otool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OTOOL"; then ac_cv_prog_ac_ct_OTOOL="$ac_ct_OTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OTOOL="otool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OTOOL=$ac_cv_prog_ac_ct_OTOOL if test -n "$ac_ct_OTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5 $as_echo "$ac_ct_OTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OTOOL" = x; then OTOOL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OTOOL=$ac_ct_OTOOL fi else OTOOL="$ac_cv_prog_OTOOL" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}otool64", so it can be a program name with args. set dummy ${ac_tool_prefix}otool64; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OTOOL64+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OTOOL64"; then ac_cv_prog_OTOOL64="$OTOOL64" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OTOOL64="${ac_tool_prefix}otool64" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OTOOL64=$ac_cv_prog_OTOOL64 if test -n "$OTOOL64"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5 $as_echo "$OTOOL64" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OTOOL64"; then ac_ct_OTOOL64=$OTOOL64 # Extract the first word of "otool64", so it can be a program name with args. set dummy otool64; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OTOOL64+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OTOOL64"; then ac_cv_prog_ac_ct_OTOOL64="$ac_ct_OTOOL64" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OTOOL64="otool64" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OTOOL64=$ac_cv_prog_ac_ct_OTOOL64 if test -n "$ac_ct_OTOOL64"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5 $as_echo "$ac_ct_OTOOL64" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OTOOL64" = x; then OTOOL64=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OTOOL64=$ac_ct_OTOOL64 fi else OTOOL64="$ac_cv_prog_OTOOL64" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5 $as_echo_n "checking for -single_module linker flag... " >&6; } if ${lt_cv_apple_cc_single_mod+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_apple_cc_single_mod=no if test -z "$LT_MULTI_MODULE"; then # By default we will add the -single_module flag. You can override # by either setting the environment variable LT_MULTI_MODULE # non-empty at configure time, or by adding -multi_module to the # link flags. rm -rf libconftest.dylib* echo "int foo(void){return 1;}" > conftest.c echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c" >&5 $LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c 2>conftest.err _lt_result=$? # If there is a non-empty error log, and "single_module" # appears in it, assume the flag caused a linker warning if test -s conftest.err && $GREP single_module conftest.err; then cat conftest.err >&5 # Otherwise, if the output was created with a 0 exit code from # the compiler, it worked. elif test -f libconftest.dylib && test 0 = "$_lt_result"; then lt_cv_apple_cc_single_mod=yes else cat conftest.err >&5 fi rm -rf libconftest.dylib* rm -f conftest.* fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5 $as_echo "$lt_cv_apple_cc_single_mod" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5 $as_echo_n "checking for -exported_symbols_list linker flag... " >&6; } if ${lt_cv_ld_exported_symbols_list+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_exported_symbols_list=no save_LDFLAGS=$LDFLAGS echo "_main" > conftest.sym LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_ld_exported_symbols_list=yes else lt_cv_ld_exported_symbols_list=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5 $as_echo "$lt_cv_ld_exported_symbols_list" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5 $as_echo_n "checking for -force_load linker flag... " >&6; } if ${lt_cv_ld_force_load+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_force_load=no cat > conftest.c << _LT_EOF int forced_loaded() { return 2;} _LT_EOF echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5 $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5 echo "$AR cru libconftest.a conftest.o" >&5 $AR cru libconftest.a conftest.o 2>&5 echo "$RANLIB libconftest.a" >&5 $RANLIB libconftest.a 2>&5 cat > conftest.c << _LT_EOF int main() { return 0;} _LT_EOF echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&5 $LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err _lt_result=$? if test -s conftest.err && $GREP force_load conftest.err; then cat conftest.err >&5 elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then lt_cv_ld_force_load=yes else cat conftest.err >&5 fi rm -f conftest.err libconftest.a conftest conftest.c rm -rf conftest.dSYM fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5 $as_echo "$lt_cv_ld_force_load" >&6; } case $host_os in rhapsody* | darwin1.[012]) _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;; darwin1.*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; darwin*) # darwin 5.x on # if running on 10.5 or later, the deployment target defaults # to the OS version, if on x86, and 10.4, the deployment # target defaults to 10.4. Don't you love it? case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in 10.0,*86*-darwin8*|10.0,*-darwin[91]*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; 10.[012][,.]*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; 10.*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; esac ;; esac if test yes = "$lt_cv_apple_cc_single_mod"; then _lt_dar_single_mod='$single_module' fi if test yes = "$lt_cv_ld_exported_symbols_list"; then _lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym' else _lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib' fi if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then _lt_dsymutil='~$DSYMUTIL $lib || :' else _lt_dsymutil= fi ;; esac # func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x$2 in x) ;; *:) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'` \$$1\" ;; x:*) eval $1=\"\$$1 `$ECHO $2 | $SED 's/:/ /g'`\" ;; *::*) eval $1=\"\$$1\ `$ECHO $2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval $1=\"`$ECHO $2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\" ;; *) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'`\" ;; esac } ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 $as_echo_n "checking how to run the C preprocessor... " >&6; } # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if ${ac_cv_prog_CPP+:} false; then : $as_echo_n "(cached) " >&6 else # Double quotes because CPP needs to be expanded for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" do ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : break fi done ac_cv_prog_CPP=$CPP fi CPP=$ac_cv_prog_CPP else ac_cv_prog_CPP=$CPP fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 $as_echo "$CPP" >&6; } ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C preprocessor \"$CPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 $as_echo_n "checking for ANSI C header files... " >&6; } if ${ac_cv_header_stdc+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_stdc=yes else ac_cv_header_stdc=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test $ac_cv_header_stdc = yes; then # SunOS 4.x string.h does not declare mem*, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "memchr" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "free" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. if test "$cross_compiling" = yes; then : : else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #if ((' ' & 0x0FF) == 0x020) # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) #else # define ISLOWER(c) \ (('a' <= (c) && (c) <= 'i') \ || ('j' <= (c) && (c) <= 'r') \ || ('s' <= (c) && (c) <= 'z')) # define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) #endif #define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) int main () { int i; for (i = 0; i < 256; i++) if (XOR (islower (i), ISLOWER (i)) || toupper (i) != TOUPPER (i)) return 2; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : else ac_cv_header_stdc=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 $as_echo "$ac_cv_header_stdc" >&6; } if test $ac_cv_header_stdc = yes; then $as_echo "#define STDC_HEADERS 1" >>confdefs.h fi # On IRIX 5.3, sys/types and inttypes.h are conflicting. for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \ inttypes.h stdint.h unistd.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default " if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in dlfcn.h do : ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default " if test "x$ac_cv_header_dlfcn_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_DLFCN_H 1 _ACEOF fi done func_stripname_cnf () { case $2 in .*) func_stripname_result=`$ECHO "$3" | $SED "s%^$1%%; s%\\\\$2\$%%"`;; *) func_stripname_result=`$ECHO "$3" | $SED "s%^$1%%; s%$2\$%%"`;; esac } # func_stripname_cnf # Set options enable_dlopen=no enable_win32_dll=no # Check whether --enable-shared was given. if test "${enable_shared+set}" = set; then : enableval=$enable_shared; p=${PACKAGE-default} case $enableval in yes) enable_shared=yes ;; no) enable_shared=no ;; *) enable_shared=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_shared=yes fi done IFS=$lt_save_ifs ;; esac else enable_shared=yes fi # Check whether --enable-static was given. if test "${enable_static+set}" = set; then : enableval=$enable_static; p=${PACKAGE-default} case $enableval in yes) enable_static=yes ;; no) enable_static=no ;; *) enable_static=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_static=yes fi done IFS=$lt_save_ifs ;; esac else enable_static=yes fi # Check whether --with-pic was given. if test "${with_pic+set}" = set; then : withval=$with_pic; lt_p=${PACKAGE-default} case $withval in yes|no) pic_mode=$withval ;; *) pic_mode=default # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for lt_pkg in $withval; do IFS=$lt_save_ifs if test "X$lt_pkg" = "X$lt_p"; then pic_mode=yes fi done IFS=$lt_save_ifs ;; esac else pic_mode=default fi # Check whether --enable-fast-install was given. if test "${enable_fast_install+set}" = set; then : enableval=$enable_fast_install; p=${PACKAGE-default} case $enableval in yes) enable_fast_install=yes ;; no) enable_fast_install=no ;; *) enable_fast_install=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_fast_install=yes fi done IFS=$lt_save_ifs ;; esac else enable_fast_install=yes fi shared_archive_member_spec= case $host,$enable_shared in power*-*-aix[5-9]*,yes) { $as_echo "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5 $as_echo_n "checking which variant of shared library versioning to provide... " >&6; } # Check whether --with-aix-soname was given. if test "${with_aix_soname+set}" = set; then : withval=$with_aix_soname; case $withval in aix|svr4|both) ;; *) as_fn_error $? "Unknown argument to --with-aix-soname" "$LINENO" 5 ;; esac lt_cv_with_aix_soname=$with_aix_soname else if ${lt_cv_with_aix_soname+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_with_aix_soname=aix fi with_aix_soname=$lt_cv_with_aix_soname fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5 $as_echo "$with_aix_soname" >&6; } if test aix != "$with_aix_soname"; then # For the AIX way of multilib, we name the shared archive member # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o', # and 'shr.imp' or 'shr_64.imp', respectively, for the Import File. # Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag, # the AIX toolchain works better with OBJECT_MODE set (default 32). if test 64 = "${OBJECT_MODE-32}"; then shared_archive_member_spec=shr_64 else shared_archive_member_spec=shr fi fi ;; *) with_aix_soname=aix ;; esac # This can be used to rebuild libtool when needed LIBTOOL_DEPS=$ltmain # Always use our own libtool. LIBTOOL='$(SHELL) $(top_builddir)/libtool' test -z "$LN_S" && LN_S="ln -s" if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5 $as_echo_n "checking for objdir... " >&6; } if ${lt_cv_objdir+:} false; then : $as_echo_n "(cached) " >&6 else rm -f .libs 2>/dev/null mkdir .libs 2>/dev/null if test -d .libs; then lt_cv_objdir=.libs else # MS-DOS does not allow filenames that begin with a dot. lt_cv_objdir=_libs fi rmdir .libs 2>/dev/null fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5 $as_echo "$lt_cv_objdir" >&6; } objdir=$lt_cv_objdir cat >>confdefs.h <<_ACEOF #define LT_OBJDIR "$lt_cv_objdir/" _ACEOF case $host_os in aix3*) # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi ;; esac # Global variables: ofile=libtool can_build_shared=yes # All known linkers require a '.a' archive for static linking (except MSVC, # which needs '.lib'). libext=a with_gnu_ld=$lt_cv_prog_gnu_ld old_CC=$CC old_CFLAGS=$CFLAGS # Set sane defaults for various variables test -z "$CC" && CC=cc test -z "$LTCC" && LTCC=$CC test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS test -z "$LD" && LD=ld test -z "$ac_objext" && ac_objext=o func_cc_basename $compiler cc_basename=$func_cc_basename_result # Only perform the check for file, if the check method requires it test -z "$MAGIC_CMD" && MAGIC_CMD=file case $deplibs_check_method in file_magic*) if test "$file_magic_cmd" = '$MAGIC_CMD'; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5 $as_echo_n "checking for ${ac_tool_prefix}file... " >&6; } if ${lt_cv_path_MAGIC_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $MAGIC_CMD in [\\/*] | ?:[\\/]*) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR ac_dummy="/usr/bin$PATH_SEPARATOR$PATH" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/${ac_tool_prefix}file"; then lt_cv_path_MAGIC_CMD=$ac_dir/"${ac_tool_prefix}file" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac fi MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5 $as_echo "$MAGIC_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test -z "$lt_cv_path_MAGIC_CMD"; then if test -n "$ac_tool_prefix"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for file" >&5 $as_echo_n "checking for file... " >&6; } if ${lt_cv_path_MAGIC_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $MAGIC_CMD in [\\/*] | ?:[\\/]*) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR ac_dummy="/usr/bin$PATH_SEPARATOR$PATH" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/file"; then lt_cv_path_MAGIC_CMD=$ac_dir/"file" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac fi MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5 $as_echo "$MAGIC_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi else MAGIC_CMD=: fi fi fi ;; esac # Use C for the default configuration in the libtool script lt_save_CC=$CC ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu # Source file extension for C test sources. ac_ext=c # Object file extension for compiled C test sources. objext=o objext=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(){return(0);}' # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC # Save the default compiler, since it gets overwritten when the other # tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP. compiler_DEFAULT=$CC # save warnings/boilerplate of simple test code ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" >conftest.$ac_ext eval "$ac_compile" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_compiler_boilerplate=`cat conftest.err` $RM conftest* ac_outfile=conftest.$ac_objext echo "$lt_simple_link_test_code" >conftest.$ac_ext eval "$ac_link" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_linker_boilerplate=`cat conftest.err` $RM -r conftest* ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then lt_prog_compiler_no_builtin_flag= if test yes = "$GCC"; then case $cc_basename in nvcc*) lt_prog_compiler_no_builtin_flag=' -Xcompiler -fno-builtin' ;; *) lt_prog_compiler_no_builtin_flag=' -fno-builtin' ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5 $as_echo_n "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; } if ${lt_cv_prog_compiler_rtti_exceptions+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_rtti_exceptions=no ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-fno-rtti -fno-exceptions" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_rtti_exceptions=yes fi fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5 $as_echo "$lt_cv_prog_compiler_rtti_exceptions" >&6; } if test yes = "$lt_cv_prog_compiler_rtti_exceptions"; then lt_prog_compiler_no_builtin_flag="$lt_prog_compiler_no_builtin_flag -fno-rtti -fno-exceptions" else : fi fi lt_prog_compiler_wl= lt_prog_compiler_pic= lt_prog_compiler_static= if test yes = "$GCC"; then lt_prog_compiler_wl='-Wl,' lt_prog_compiler_static='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static='-Bstatic' fi lt_prog_compiler_pic='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support lt_prog_compiler_pic='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. lt_prog_compiler_pic='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries lt_prog_compiler_pic='-DDLL_EXPORT' case $host_os in os2*) lt_prog_compiler_static='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files lt_prog_compiler_pic='-fno-common' ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. lt_prog_compiler_static= ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) # +Z the default ;; *) lt_prog_compiler_pic='-fPIC' ;; esac ;; interix[3-9]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; msdosdjgpp*) # Just because we use GCC doesn't mean we suddenly get shared libraries # on systems that don't support them. lt_prog_compiler_can_build_shared=no enable_shared=no ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic='-fPIC -shared' ;; sysv4*MP*) if test -d /usr/nec; then lt_prog_compiler_pic=-Kconform_pic fi ;; *) lt_prog_compiler_pic='-fPIC' ;; esac case $cc_basename in nvcc*) # Cuda Compiler Driver 2.2 lt_prog_compiler_wl='-Xlinker ' if test -n "$lt_prog_compiler_pic"; then lt_prog_compiler_pic="-Xcompiler $lt_prog_compiler_pic" fi ;; esac else # PORTME Check for flag to pass linker flags through the system compiler. case $host_os in aix*) lt_prog_compiler_wl='-Wl,' if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static='-Bstatic' else lt_prog_compiler_static='-bnso -bI:/lib/syscalls.exp' fi ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files lt_prog_compiler_pic='-fno-common' case $cc_basename in nagfor*) # NAG Fortran compiler lt_prog_compiler_wl='-Wl,-Wl,,' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; esac ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). lt_prog_compiler_pic='-DDLL_EXPORT' case $host_os in os2*) lt_prog_compiler_static='$wl-static' ;; esac ;; hpux9* | hpux10* | hpux11*) lt_prog_compiler_wl='-Wl,' # PIC is the default for IA64 HP-UX and 64-bit HP-UX, but # not for PA HP-UX. case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) lt_prog_compiler_pic='+Z' ;; esac # Is there a better lt_prog_compiler_static that works with the bundled CC? lt_prog_compiler_static='$wl-a ${wl}archive' ;; irix5* | irix6* | nonstopux*) lt_prog_compiler_wl='-Wl,' # PIC (with -KPIC) is the default. lt_prog_compiler_static='-non_shared' ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in # old Intel for x86_64, which still supported -KPIC. ecc*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-static' ;; # icc used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. icc* | ifort*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; # Lahey Fortran 8.1. lf95*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='--shared' lt_prog_compiler_static='--static' ;; nagfor*) # NAG Fortran compiler lt_prog_compiler_wl='-Wl,-Wl,,' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; tcc*) # Fabrice Bellard et al's Tiny C Compiler lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; pgcc* | pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group compilers (*not* the Pentium gcc compiler, # which looks to be a dead project) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fpic' lt_prog_compiler_static='-Bstatic' ;; ccc*) lt_prog_compiler_wl='-Wl,' # All Alpha code is PIC. lt_prog_compiler_static='-non_shared' ;; xl* | bgxl* | bgf* | mpixl*) # IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-qpic' lt_prog_compiler_static='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [1-7].* | *Sun*Fortran*\ 8.[0-3]*) # Sun Fortran 8.3 passes all unrecognized flags to the linker lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='' ;; *Sun\ F* | *Sun*Fortran*) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='-Qoption ld ' ;; *Sun\ C*) # Sun C 5.9 lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='-Wl,' ;; *Intel*\ [CF]*Compiler*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; *Portland\ Group*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fpic' lt_prog_compiler_static='-Bstatic' ;; esac ;; esac ;; newsos6) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic='-fPIC -shared' ;; osf3* | osf4* | osf5*) lt_prog_compiler_wl='-Wl,' # All OSF/1 code is PIC. lt_prog_compiler_static='-non_shared' ;; rdos*) lt_prog_compiler_static='-non_shared' ;; solaris*) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' case $cc_basename in f77* | f90* | f95* | sunf77* | sunf90* | sunf95*) lt_prog_compiler_wl='-Qoption ld ';; *) lt_prog_compiler_wl='-Wl,';; esac ;; sunos4*) lt_prog_compiler_wl='-Qoption ld ' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; sysv4 | sysv4.2uw2* | sysv4.3*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; sysv4*MP*) if test -d /usr/nec; then lt_prog_compiler_pic='-Kconform_pic' lt_prog_compiler_static='-Bstatic' fi ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; unicos*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_can_build_shared=no ;; uts4*) lt_prog_compiler_pic='-pic' lt_prog_compiler_static='-Bstatic' ;; *) lt_prog_compiler_can_build_shared=no ;; esac fi case $host_os in # For platforms that do not support PIC, -DPIC is meaningless: *djgpp*) lt_prog_compiler_pic= ;; *) lt_prog_compiler_pic="$lt_prog_compiler_pic -DPIC" ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5 $as_echo_n "checking for $compiler option to produce PIC... " >&6; } if ${lt_cv_prog_compiler_pic+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic=$lt_prog_compiler_pic fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5 $as_echo "$lt_cv_prog_compiler_pic" >&6; } lt_prog_compiler_pic=$lt_cv_prog_compiler_pic # # Check to make sure the PIC flag actually works. # if test -n "$lt_prog_compiler_pic"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5 $as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; } if ${lt_cv_prog_compiler_pic_works+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic_works=no ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="$lt_prog_compiler_pic -DPIC" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_pic_works=yes fi fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5 $as_echo "$lt_cv_prog_compiler_pic_works" >&6; } if test yes = "$lt_cv_prog_compiler_pic_works"; then case $lt_prog_compiler_pic in "" | " "*) ;; *) lt_prog_compiler_pic=" $lt_prog_compiler_pic" ;; esac else lt_prog_compiler_pic= lt_prog_compiler_can_build_shared=no fi fi # # Check to make sure the static flag actually works. # wl=$lt_prog_compiler_wl eval lt_tmp_static_flag=\"$lt_prog_compiler_static\" { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5 $as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; } if ${lt_cv_prog_compiler_static_works+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_static_works=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS $lt_tmp_static_flag" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&5 $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_static_works=yes fi else lt_cv_prog_compiler_static_works=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5 $as_echo "$lt_cv_prog_compiler_static_works" >&6; } if test yes = "$lt_cv_prog_compiler_static_works"; then : else lt_prog_compiler_static= fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5 $as_echo "$lt_cv_prog_compiler_c_o" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5 $as_echo "$lt_cv_prog_compiler_c_o" >&6; } hard_links=nottested if test no = "$lt_cv_prog_compiler_c_o" && test no != "$need_locks"; then # do not overwrite the value of need_locks provided by the user { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5 $as_echo_n "checking if we can lock with hard links... " >&6; } hard_links=yes $RM conftest* ln conftest.a conftest.b 2>/dev/null && hard_links=no touch conftest.a ln conftest.a conftest.b 2>&5 || hard_links=no ln conftest.a conftest.b 2>/dev/null && hard_links=no { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5 $as_echo "$hard_links" >&6; } if test no = "$hard_links"; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5 $as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;} need_locks=warn fi else need_locks=no fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5 $as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; } runpath_var= allow_undefined_flag= always_export_symbols=no archive_cmds= archive_expsym_cmds= compiler_needs_object=no enable_shared_with_static_runtimes=no export_dynamic_flag_spec= export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' hardcode_automatic=no hardcode_direct=no hardcode_direct_absolute=no hardcode_libdir_flag_spec= hardcode_libdir_separator= hardcode_minus_L=no hardcode_shlibpath_var=unsupported inherit_rpath=no link_all_deplibs=unknown module_cmds= module_expsym_cmds= old_archive_from_new_cmds= old_archive_from_expsyms_cmds= thread_safe_flag_spec= whole_archive_flag_spec= # include_expsyms should be a list of space-separated symbols to be *always* # included in the symbol list include_expsyms= # exclude_expsyms can be an extended regexp of symbols to exclude # it will be wrapped by ' (' and ')$', so one must not match beginning or # end of line. Example: 'a|bc|.*d.*' will exclude the symbols 'a' and 'bc', # as well as any symbol that contains 'd'. exclude_expsyms='_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*' # Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out # platforms (ab)use it in PIC code, but their linkers get confused if # the symbol is explicitly referenced. Since portable code cannot # rely on this symbol name, it's probably fine to never include it in # preloaded symbol tables. # Exclude shared library initialization/finalization symbols. extract_expsyms_cmds= case $host_os in cygwin* | mingw* | pw32* | cegcc*) # FIXME: the MSVC++ port hasn't been tested in a loooong time # When not using gcc, we currently assume that we are using # Microsoft Visual C++. if test yes != "$GCC"; then with_gnu_ld=no fi ;; interix*) # we just hope/assume this is gcc and not c89 (= MSVC++) with_gnu_ld=yes ;; openbsd* | bitrig*) with_gnu_ld=no ;; linux* | k*bsd*-gnu | gnu*) link_all_deplibs=no ;; esac ld_shlibs=yes # On some targets, GNU ld is compatible enough with the native linker # that we're better off using the native interface for both. lt_use_gnu_ld_interface=no if test yes = "$with_gnu_ld"; then case $host_os in aix*) # The AIX port of GNU ld has always aspired to compatibility # with the native linker. However, as the warning in the GNU ld # block says, versions before 2.19.5* couldn't really create working # shared libraries, regardless of the interface used. case `$LD -v 2>&1` in *\ \(GNU\ Binutils\)\ 2.19.5*) ;; *\ \(GNU\ Binutils\)\ 2.[2-9]*) ;; *\ \(GNU\ Binutils\)\ [3-9]*) ;; *) lt_use_gnu_ld_interface=yes ;; esac ;; *) lt_use_gnu_ld_interface=yes ;; esac fi if test yes = "$lt_use_gnu_ld_interface"; then # If archive_cmds runs LD, not CC, wlarc should be empty wlarc='$wl' # Set some defaults for GNU ld with shared library support. These # are reset later if shared libraries are not supported. Putting them # here allows them to be overridden if necessary. runpath_var=LD_RUN_PATH hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' export_dynamic_flag_spec='$wl--export-dynamic' # ancient GNU ld didn't support --whole-archive et. al. if $LD --help 2>&1 | $GREP 'no-whole-archive' > /dev/null; then whole_archive_flag_spec=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else whole_archive_flag_spec= fi supports_anon_versioning=no case `$LD -v | $SED -e 's/(^)\+)\s\+//' 2>&1` in *GNU\ gold*) supports_anon_versioning=yes ;; *\ [01].* | *\ 2.[0-9].* | *\ 2.10.*) ;; # catch versions < 2.11 *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ... *\ 2.11.92.0.12\ *) supports_anon_versioning=yes ;; # Mandrake 8.2 ... *\ 2.11.*) ;; # other 2.11 versions *) supports_anon_versioning=yes ;; esac # See if GNU ld supports shared libraries. case $host_os in aix[3-9]*) # On AIX/PPC, the GNU linker is very broken if test ia64 != "$host_cpu"; then ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: the GNU linker, at least up to release 2.19, is reported *** to be unable to reliably create shared libraries on AIX. *** Therefore, libtool is disabling shared libraries support. If you *** really care for shared libraries, you may want to install binutils *** 2.20 or above, or modify your PATH so that a non-GNU linker is found. *** You will then need to restart the configuration process. _LT_EOF fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='' ;; m68k) archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes ;; esac ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then allow_undefined_flag=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME archive_cmds='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else ld_shlibs=no fi ;; cygwin* | mingw* | pw32* | cegcc*) # _LT_TAGVAR(hardcode_libdir_flag_spec, ) is actually meaningless, # as there is no search path for DLLs. hardcode_libdir_flag_spec='-L$libdir' export_dynamic_flag_spec='$wl--export-all-symbols' allow_undefined_flag=unsupported always_export_symbols=no enable_shared_with_static_runtimes=yes export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[BCDGRS][ ]/s/.*[ ]\([^ ]*\)/\1 DATA/;s/^.*[ ]__nm__\([^ ]*\)[ ][^ ]*/\1 DATA/;/^I[ ]/d;/^[AITW][ ]/s/.* //'\'' | sort | uniq > $export_symbols' exclude_expsyms='[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname' if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else ld_shlibs=no fi ;; haiku*) archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' link_all_deplibs=yes ;; os2*) hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes allow_undefined_flag=unsupported shrext_cmds=.dll archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' enable_shared_with_static_runtimes=yes ;; interix[3-9]*) hardcode_direct=no hardcode_shlibpath_var=no hardcode_libdir_flag_spec='$wl-rpath,$libdir' export_dynamic_flag_spec='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' archive_expsym_cmds='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu) tmp_diet=no if test linux-dietlibc = "$host_os"; then case $cc_basename in diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn) esac fi if $LD --help 2>&1 | $EGREP ': supported targets:.* elf' > /dev/null \ && test no = "$tmp_diet" then tmp_addflag=' $pic_flag' tmp_sharedflag='-shared' case $cc_basename,$host_cpu in pgcc*) # Portland Group C compiler whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag' ;; pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group f77 and f90 compilers whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag -Mnomain' ;; ecc*,ia64* | icc*,ia64*) # Intel C compiler on ia64 tmp_addflag=' -i_dynamic' ;; efc*,ia64* | ifort*,ia64*) # Intel Fortran compiler on ia64 tmp_addflag=' -i_dynamic -nofor_main' ;; ifc* | ifort*) # Intel Fortran compiler tmp_addflag=' -nofor_main' ;; lf95*) # Lahey Fortran 8.1 whole_archive_flag_spec= tmp_sharedflag='--shared' ;; nagfor*) # NAGFOR 5.3 tmp_sharedflag='-Wl,-shared' ;; xl[cC]* | bgxl[cC]* | mpixl[cC]*) # IBM XL C 8.0 on PPC (deal with xlf below) tmp_sharedflag='-qmkshrobj' tmp_addflag= ;; nvcc*) # Cuda Compiler Driver 2.2 whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' compiler_needs_object=yes ;; esac case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C 5.9 whole_archive_flag_spec='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' compiler_needs_object=yes tmp_sharedflag='-G' ;; *Sun\ F*) # Sun Fortran 8.3 tmp_sharedflag='-G' ;; esac archive_cmds='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi case $cc_basename in tcc*) export_dynamic_flag_spec='-rdynamic' ;; xlf* | bgf* | bgxlf* | mpixlf*) # IBM XL Fortran 10.1 on PPC cannot create shared libs itself whole_archive_flag_spec='--whole-archive$convenience --no-whole-archive' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib' if test yes = "$supports_anon_versioning"; then archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib' fi ;; esac else ld_shlibs=no fi ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib' wlarc= else archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' fi ;; solaris*) if $LD -v 2>&1 | $GREP 'BFD 2\.8' > /dev/null; then ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: The releases 2.8.* of the GNU linker cannot reliably *** create shared libraries on Solaris systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.9.1 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF elif $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX*) case `$LD -v 2>&1` in *\ [01].* | *\ 2.[0-9].* | *\ 2.1[0-5].*) ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot *** reliably create shared libraries on SCO systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.16.91.0.3 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF ;; *) # For security reasons, it is highly recommended that you always # use absolute paths for naming shared libraries, and exclude the # DT_RUNPATH tag from executables and libraries. But doing so # requires that you compile everything twice, which is a pain. if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; esac ;; sunos4*) archive_cmds='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags' wlarc= hardcode_direct=yes hardcode_shlibpath_var=no ;; *) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; esac if test no = "$ld_shlibs"; then runpath_var= hardcode_libdir_flag_spec= export_dynamic_flag_spec= whole_archive_flag_spec= fi else # PORTME fill in a description of your system's linker (not GNU ld) case $host_os in aix3*) allow_undefined_flag=unsupported always_export_symbols=yes archive_expsym_cmds='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname' # Note: this linker hardcodes the directories in LIBPATH if there # are no directories specified by -L. hardcode_minus_L=yes if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then # Neither direct hardcoding nor static linking is supported with a # broken collect2. hardcode_direct=unsupported fi ;; aix[4-9]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then export_symbols_cmds='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else export_symbols_cmds='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[23]|aix4.[23].*|aix[5-9]*) for ld_flag in $LDFLAGS; do if (test x-brtl = "x$ld_flag" || test x-Wl,-brtl = "x$ld_flag"); then aix_use_runtimelinking=yes break fi done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. archive_cmds='' hardcode_direct=yes hardcode_direct_absolute=yes hardcode_libdir_separator=':' link_all_deplibs=yes file_list_spec='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # traditional, no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. hardcode_direct=no hardcode_direct_absolute=no ;; esac if test yes = "$GCC"; then case $host_os in aix4.[012]|aix4.[012].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 hardcode_direct=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking hardcode_minus_L=yes hardcode_libdir_flag_spec='-L$libdir' hardcode_libdir_separator= fi ;; esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag="$shared_flag "'$wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi export_dynamic_flag_spec='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to export. always_export_symbols=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. allow_undefined_flag='-berok' # Determine the default libpath from the value encoded in an # empty executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath_+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath_ fi hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath" archive_expsym_cmds='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then hardcode_libdir_flag_spec='$wl-R $libdir:/usr/lib:/lib' allow_undefined_flag="-z nodefs" archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath_+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath_ fi hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. no_undefined_flag=' $wl-bernotok' allow_undefined_flag=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. whole_archive_flag_spec='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives whole_archive_flag_spec='$convenience' fi archive_cmds_need_lc=yes archive_expsym_cmds='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([, ]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared libraries. archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols archive_expsym_cmds="$archive_expsym_cmds"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi archive_expsym_cmds="$archive_expsym_cmds"'~$RM -r $output_objdir/$realname.d' fi fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='' ;; m68k) archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes ;; esac ;; bsdi[45]*) export_dynamic_flag_spec=-rdynamic ;; cygwin* | mingw* | pw32* | cegcc*) # When not using gcc, we currently assume that we are using # Microsoft Visual C++. # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. case $cc_basename in cl*) # Native MSVC hardcode_libdir_flag_spec=' ' allow_undefined_flag=unsupported always_export_symbols=yes file_list_spec='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. archive_cmds='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, )='true' enable_shared_with_static_runtimes=yes exclude_expsyms='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[BCDGRS][ ]/s/.*[ ]\([^ ]*\)/\1,DATA/'\'' | $SED -e '\''/^[AITW][ ]/s/.*[ ]//'\'' | sort | uniq > $export_symbols' # Don't use ranlib old_postinstall_cmds='chmod 644 $oldlib' postlink_cmds='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # Assume MSVC wrapper hardcode_libdir_flag_spec=' ' allow_undefined_flag=unsupported # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. archive_cmds='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" | $SED '\''s/ -lc$//'\''` -link -dll~linknames=' # The linker will automatically build a .lib file if we build a DLL. old_archive_from_new_cmds='true' # FIXME: Should let the user specify the lib program. old_archive_cmds='lib -OUT:$oldlib$oldobjs$old_deplibs' enable_shared_with_static_runtimes=yes ;; esac ;; darwin* | rhapsody*) archive_cmds_need_lc=no hardcode_direct=no hardcode_automatic=yes hardcode_shlibpath_var=unsupported if test yes = "$lt_cv_ld_force_load"; then whole_archive_flag_spec='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`' else whole_archive_flag_spec='' fi link_all_deplibs=yes allow_undefined_flag=$_lt_dar_allow_undefined case $cc_basename in ifort*|nagfor*) _lt_dar_can_shared=yes ;; *) _lt_dar_can_shared=$GCC ;; esac if test yes = "$_lt_dar_can_shared"; then output_verbose_link_cmd=func_echo_all archive_cmds="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil" module_cmds="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil" archive_expsym_cmds="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil" module_expsym_cmds="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil" else ld_shlibs=no fi ;; dgux*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_libdir_flag_spec='-L$libdir' hardcode_shlibpath_var=no ;; # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor # support. Future versions do this automatically, but an explicit c++rt0.o # does not break anything, and helps significantly (at the cost of a little # extra space). freebsd2.2*) archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o' hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; # Unfortunately, older versions of FreeBSD 2 do not have this feature. freebsd2.*) archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes hardcode_minus_L=yes hardcode_shlibpath_var=no ;; # FreeBSD 3 and greater uses gcc -shared to do shared libraries. freebsd* | dragonfly*) archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; hpux9*) if test yes = "$GCC"; then archive_cmds='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else archive_cmds='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' fi hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: hardcode_direct=yes # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes export_dynamic_flag_spec='$wl-E' ;; hpux10*) if test yes,no = "$GCC,$with_gnu_ld"; then archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi if test no = "$with_gnu_ld"; then hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: hardcode_direct=yes hardcode_direct_absolute=yes export_dynamic_flag_spec='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes fi ;; hpux11*) if test yes,no = "$GCC,$with_gnu_ld"; then case $host_cpu in hppa*64*) archive_cmds='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' ;; esac else case $host_cpu in hppa*64*) archive_cmds='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) archive_cmds='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) # Older versions of the 11.00 compiler do not understand -b yet # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does) { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5 $as_echo_n "checking if $CC understands -b... " >&6; } if ${lt_cv_prog_compiler__b+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler__b=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -b" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&5 $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler__b=yes fi else lt_cv_prog_compiler__b=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5 $as_echo "$lt_cv_prog_compiler__b" >&6; } if test yes = "$lt_cv_prog_compiler__b"; then archive_cmds='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi ;; esac fi if test no = "$with_gnu_ld"; then hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: case $host_cpu in hppa*64*|ia64*) hardcode_direct=no hardcode_shlibpath_var=no ;; *) hardcode_direct=yes hardcode_direct_absolute=yes export_dynamic_flag_spec='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes ;; esac fi ;; irix5* | irix6* | nonstopux*) if test yes = "$GCC"; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' # Try to use the -exported_symbol ld option, if it does not # work, assume that -exports_file does not work either and # implicitly export all symbols. # This should be the same for all languages, so no per-tag cache variable. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5 $as_echo_n "checking whether the $host_os linker accepts -exported_symbol... " >&6; } if ${lt_cv_irix_exported_symbol+:} false; then : $as_echo_n "(cached) " >&6 else save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int foo (void) { return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_irix_exported_symbol=yes else lt_cv_irix_exported_symbol=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5 $as_echo "$lt_cv_irix_exported_symbol" >&6; } if test yes = "$lt_cv_irix_exported_symbol"; then archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib' fi link_all_deplibs=no else archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib' fi archive_cmds_need_lc='no' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: inherit_rpath=yes link_all_deplibs=yes ;; linux*) case $cc_basename in tcc*) # Fabrice Bellard et al's Tiny C Compiler ld_shlibs=yes archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out else archive_cmds='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF fi hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; newsos6) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: hardcode_shlibpath_var=no ;; *nto* | *qnx*) ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then hardcode_direct=yes hardcode_shlibpath_var=no hardcode_direct_absolute=yes if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols' hardcode_libdir_flag_spec='$wl-rpath,$libdir' export_dynamic_flag_spec='$wl-E' else archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' hardcode_libdir_flag_spec='$wl-rpath,$libdir' fi else ld_shlibs=no fi ;; os2*) hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes allow_undefined_flag=unsupported shrext_cmds=.dll archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' enable_shared_with_static_runtimes=yes ;; osf3*) if test yes = "$GCC"; then allow_undefined_flag=' $wl-expect_unresolved $wl\*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else allow_undefined_flag=' -expect_unresolved \*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' fi archive_cmds_need_lc='no' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: ;; osf4* | osf5*) # as osf3* with the addition of -msym flag if test yes = "$GCC"; then allow_undefined_flag=' $wl-expect_unresolved $wl\*' archive_cmds='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' else allow_undefined_flag=' -expect_unresolved \*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' archive_expsym_cmds='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp' # Both c and cxx compiler support -rpath directly hardcode_libdir_flag_spec='-rpath $libdir' fi archive_cmds_need_lc='no' hardcode_libdir_separator=: ;; solaris*) no_undefined_flag=' -z defs' if test yes = "$GCC"; then wlarc='$wl' archive_cmds='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' else case `$CC -V 2>&1` in *"Compilers 5.0"*) wlarc='' archive_cmds='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp' ;; *) wlarc='$wl' archive_cmds='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' ;; esac fi hardcode_libdir_flag_spec='-R$libdir' hardcode_shlibpath_var=no case $host_os in solaris2.[0-5] | solaris2.[0-5].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. GCC discards it without '$wl', # but is careful enough not to reorder. # Supported since Solaris 2.6 (maybe 2.5.1?) if test yes = "$GCC"; then whole_archive_flag_spec='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' else whole_archive_flag_spec='-z allextract$convenience -z defaultextract' fi ;; esac link_all_deplibs=yes ;; sunos4*) if test sequent = "$host_vendor"; then # Use $CC to link under sequent, because it throws in some extra .o # files that make .init and .fini sections work. archive_cmds='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags' fi hardcode_libdir_flag_spec='-L$libdir' hardcode_direct=yes hardcode_minus_L=yes hardcode_shlibpath_var=no ;; sysv4) case $host_vendor in sni) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes # is this really true??? ;; siemens) ## LD is ld it makes a PLAMLIB ## CC just makes a GrossModule. archive_cmds='$LD -G -o $lib $libobjs $deplibs $linker_flags' reload_cmds='$CC -r -o $output$reload_objs' hardcode_direct=no ;; motorola) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=no #Motorola manual says yes, but my tests say they lie ;; esac runpath_var='LD_RUN_PATH' hardcode_shlibpath_var=no ;; sysv4.3*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_shlibpath_var=no export_dynamic_flag_spec='-Bexport' ;; sysv4*MP*) if test -d /usr/nec; then archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_shlibpath_var=no runpath_var=LD_RUN_PATH hardcode_runpath_var=yes ld_shlibs=yes fi ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[01].[10]* | unixware7* | sco3.2v5.0.[024]*) no_undefined_flag='$wl-z,text' archive_cmds_need_lc=no hardcode_shlibpath_var=no runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. no_undefined_flag='$wl-z,text' allow_undefined_flag='$wl-z,nodefs' archive_cmds_need_lc=no hardcode_shlibpath_var=no hardcode_libdir_flag_spec='$wl-R,$libdir' hardcode_libdir_separator=':' link_all_deplibs=yes export_dynamic_flag_spec='$wl-Bexport' runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; uts4*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_libdir_flag_spec='-L$libdir' hardcode_shlibpath_var=no ;; *) ld_shlibs=no ;; esac if test sni = "$host_vendor"; then case $host in sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*) export_dynamic_flag_spec='$wl-Blargedynsym' ;; esac fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5 $as_echo "$ld_shlibs" >&6; } test no = "$ld_shlibs" && can_build_shared=no with_gnu_ld=$with_gnu_ld # # Do we need to explicitly link libc? # case "x$archive_cmds_need_lc" in x|xyes) # Assume -lc should be added archive_cmds_need_lc=yes if test yes,yes = "$GCC,$enable_shared"; then case $archive_cmds in *'~'*) # FIXME: we may have to deal with multi-command sequences. ;; '$CC '*) # Test whether the compiler implicitly links with -lc since on some # systems, -lgcc has to come before -lc. If gcc already passes -lc # to ld, don't add -lc before -lgcc. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5 $as_echo_n "checking whether -lc should be explicitly linked in... " >&6; } if ${lt_cv_archive_cmds_need_lc+:} false; then : $as_echo_n "(cached) " >&6 else $RM conftest* echo "$lt_simple_compile_test_code" > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } 2>conftest.err; then soname=conftest lib=conftest libobjs=conftest.$ac_objext deplibs= wl=$lt_prog_compiler_wl pic_flag=$lt_prog_compiler_pic compiler_flags=-v linker_flags=-v verstring= output_objdir=. libname=conftest lt_save_allow_undefined_flag=$allow_undefined_flag allow_undefined_flag= if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5 (eval $archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then lt_cv_archive_cmds_need_lc=no else lt_cv_archive_cmds_need_lc=yes fi allow_undefined_flag=$lt_save_allow_undefined_flag else cat conftest.err 1>&5 fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5 $as_echo "$lt_cv_archive_cmds_need_lc" >&6; } archive_cmds_need_lc=$lt_cv_archive_cmds_need_lc ;; esac fi ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5 $as_echo_n "checking dynamic linker characteristics... " >&6; } if test yes = "$GCC"; then case $host_os in darwin*) lt_awk_arg='/^libraries:/,/LR/' ;; *) lt_awk_arg='/^libraries:/' ;; esac case $host_os in mingw* | cegcc*) lt_sed_strip_eq='s|=\([A-Za-z]:\)|\1|g' ;; *) lt_sed_strip_eq='s|=/|/|g' ;; esac lt_search_path_spec=`$CC -print-search-dirs | awk $lt_awk_arg | $SED -e "s/^libraries://" -e $lt_sed_strip_eq` case $lt_search_path_spec in *\;*) # if the path contains ";" then we assume it to be the separator # otherwise default to the standard path separator (i.e. ":") - it is # assumed that no part of a normal pathname contains ";" but that should # okay in the real world where ";" in dirpaths is itself problematic. lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED 's/;/ /g'` ;; *) lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED "s/$PATH_SEPARATOR/ /g"` ;; esac # Ok, now we have the path, separated by spaces, we can step through it # and add multilib dir if necessary... lt_tmp_lt_search_path_spec= lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null` # ...but if some path component already ends with the multilib dir we assume # that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer). case "$lt_multi_os_dir; $lt_search_path_spec " in "/; "* | "/.; "* | "/./; "* | *"$lt_multi_os_dir "* | *"$lt_multi_os_dir/ "*) lt_multi_os_dir= ;; esac for lt_sys_path in $lt_search_path_spec; do if test -d "$lt_sys_path$lt_multi_os_dir"; then lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir" elif test -n "$lt_multi_os_dir"; then test -d "$lt_sys_path" && \ lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path" fi done lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" | awk ' BEGIN {RS = " "; FS = "/|\n";} { lt_foo = ""; lt_count = 0; for (lt_i = NF; lt_i > 0; lt_i--) { if ($lt_i != "" && $lt_i != ".") { if ($lt_i == "..") { lt_count++; } else { if (lt_count == 0) { lt_foo = "/" $lt_i lt_foo; } else { lt_count--; } } } } if (lt_foo != "") { lt_freq[lt_foo]++; } if (lt_freq[lt_foo] == 1) { print lt_foo; } }'` # AWK program above erroneously prepends '/' to C:/dos/paths # for these hosts. case $host_os in mingw* | cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" |\ $SED 's|/\([A-Za-z]:\)|\1|g'` ;; esac sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" | $lt_NL2SP` else sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" fi library_names_spec= libname_spec='lib$name' soname_spec= shrext_cmds=.so postinstall_cmds= postuninstall_cmds= finish_cmds= finish_eval= shlibpath_var= shlibpath_overrides_runpath=unknown version_type=none dynamic_linker="$host_os ld.so" sys_lib_dlsearch_path_spec="/lib /usr/lib" need_lib_prefix=unknown hardcode_into_libs=no # when you set need_version to no, make sure it does not cause -set_version # flags to be left without arguments need_version=unknown case $host_os in aix3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname.a' shlibpath_var=LIBPATH # AIX 3 has no versioning support, so we append a major version to the name. soname_spec='$libname$release$shared_ext$major' ;; aix[4-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no hardcode_into_libs=yes if test ia64 = "$host_cpu"; then # AIX 5 supports IA64 library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH else # With GCC up to 2.95.x, collect2 would create an import file # for dependence libraries. The import file would start with # the line '#! .'. This would cause the generated library to # depend on '.', always an invalid library. This was fixed in # development snapshots of GCC prior to 3.0. case $host_os in aix4 | aix4.[01] | aix4.[01].*) if { echo '#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)' echo ' yes ' echo '#endif'; } | $CC -E - | $GREP yes > /dev/null; then : else can_build_shared=no fi ;; esac # Using Import Files as archive members, it is possible to support # filename-based versioning of shared library archives on AIX. While # this would work for both with and without runtime linking, it will # prevent static linking of such archives. So we do filename-based # shared library versioning with .so extension only, which is used # when both runtime linking and shared linking is enabled. # Unfortunately, runtime linking may impact performance, so we do # not want this to be the default eventually. Also, we use the # versioned .so libs for executables only if there is the -brtl # linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only. # To allow for filename-based versioning support, we need to create # libNAME.so.V as an archive file, containing: # *) an Import File, referring to the versioned filename of the # archive as well as the shared archive member, telling the # bitwidth (32 or 64) of that shared object, and providing the # list of exported symbols of that shared object, eventually # decorated with the 'weak' keyword # *) the shared object with the F_LOADONLY flag set, to really avoid # it being seen by the linker. # At run time we better use the real file rather than another symlink, # but for link time we create the symlink libNAME.so -> libNAME.so.V case $with_aix_soname,$aix_use_runtimelinking in # AIX (on Power*) has no versioning support, so currently we cannot hardcode correct # soname into executable. Probably we can add versioning support to # collect2, so additional links can be useful in future. aix,yes) # traditional libtool dynamic_linker='AIX unversionable lib.so' # If using run time linking (on AIX 4.2 or later) use lib.so # instead of lib.a to let people know that these are not # typical AIX shared libraries. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; aix,no) # traditional AIX only dynamic_linker='AIX lib.a(lib.so.V)' # We preserve .a as extension for shared libraries through AIX4.2 # and later when we are not doing run time linking. library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' ;; svr4,*) # full svr4 only dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,yes) # both, prefer svr4 dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o), lib.a(lib.so.V)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # unpreferred sharedlib libNAME.a needs extra handling postinstall_cmds='test -n "$linkname" || linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" || test -z "$striplib" || $striplib "$destdir/$func_stripname_result.$libext"' postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" || func_append rmfiles " $odir/$func_stripname_result.$libext"' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,no) # both, prefer aix dynamic_linker="AIX lib.a(lib.so.V), lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' # unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling postinstall_cmds='test -z "$dlname" || $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" || test -z "$striplib" || $striplib $destdir/$dlname~test -n "$linkname" || linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)' postuninstall_cmds='test -z "$dlname" || func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"' ;; esac shlibpath_var=LIBPATH fi ;; amigaos*) case $host_cpu in powerpc) # Since July 2007 AmigaOS4 officially supports .so libraries. # When compiling the executable, add -use-dynld -Lsobjs: to the compileline. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; m68k) library_names_spec='$libname.ixlibrary $libname.a' # Create ${libname}_ixlibrary.a entries in /sys/libs. finish_eval='for lib in `ls $libdir/*.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" | $SED '\''s%^.*/\([^/]*\)\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a || exit 1; done' ;; esac ;; beos*) library_names_spec='$libname$shared_ext' dynamic_linker="$host_os ld.so" shlibpath_var=LIBRARY_PATH ;; bsdi[45]*) version_type=linux # correct to gnu/linux during the next big refactor need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib" sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib" # the default ld.so.conf also contains /usr/contrib/lib and # /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow # libtool to hard-code these into programs ;; cygwin* | mingw* | pw32* | cegcc*) version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no case $GCC,$cc_basename in yes,*) # gcc library_names_spec='$libname.dll.a' # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes case $host_os in cygwin*) # Cygwin DLLs use 'cyg' prefix rather than 'lib' soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api" ;; mingw* | cegcc*) # MinGW DLLs use traditional 'lib' prefix soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; pw32*) # pw32 DLLs use 'pw' prefix rather than 'lib' library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; esac dynamic_linker='Win32 ld.exe' ;; *,cl*) # Native MSVC libname_spec='$name' soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' library_names_spec='$libname.dll.lib' case $build_os in mingw*) sys_lib_search_path_spec= lt_save_ifs=$IFS IFS=';' for lt_path in $LIB do IFS=$lt_save_ifs # Let DOS variable expansion print the short 8.3 style file name. lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"` sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path" done IFS=$lt_save_ifs # Convert to MSYS style. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'` ;; cygwin*) # Convert to unix form, then to dos form, then back to unix form # but this time dos style (no spaces!) so that the unix form looks # like /cygdrive/c/PROGRA~1:/cygdr... sys_lib_search_path_spec=`cygpath --path --unix "$LIB"` sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null` sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` ;; *) sys_lib_search_path_spec=$LIB if $ECHO "$sys_lib_search_path_spec" | $GREP ';[c-zC-Z]:/' >/dev/null; then # It is most probably a Windows format PATH. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's/;/ /g'` else sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` fi # FIXME: find the short name or the path components, as spaces are # common. (e.g. "Program Files" -> "PROGRA~1") ;; esac # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes dynamic_linker='Win32 link.exe' ;; *) # Assume MSVC wrapper library_names_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib' dynamic_linker='Win32 ld.exe' ;; esac # FIXME: first we should search . and the directory the executable is in shlibpath_var=PATH ;; darwin* | rhapsody*) dynamic_linker="$host_os dyld" version_type=darwin need_lib_prefix=no need_version=no library_names_spec='$libname$release$major$shared_ext $libname$shared_ext' soname_spec='$libname$release$major$shared_ext' shlibpath_overrides_runpath=yes shlibpath_var=DYLD_LIBRARY_PATH shrext_cmds='`test .$module = .yes && echo .so || echo .dylib`' sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib" sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib' ;; dgux*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; freebsd* | dragonfly*) # DragonFly does not have aout. When/if they implement a new # versioning mechanism, adjust this. if test -x /usr/bin/objformat; then objformat=`/usr/bin/objformat` else case $host_os in freebsd[23].*) objformat=aout ;; *) objformat=elf ;; esac fi version_type=freebsd-$objformat case $version_type in freebsd-elf*) library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' need_version=no need_lib_prefix=no ;; freebsd-*) library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' need_version=yes ;; esac shlibpath_var=LD_LIBRARY_PATH case $host_os in freebsd2.*) shlibpath_overrides_runpath=yes ;; freebsd3.[01]* | freebsdelf3.[01]*) shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; freebsd3.[2-9]* | freebsdelf3.[2-9]* | \ freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1) shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; *) # from 4.6 on, and DragonFly shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; esac ;; haiku*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no dynamic_linker="$host_os runtime_loader" library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LIBRARY_PATH shlibpath_overrides_runpath=no sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib' hardcode_into_libs=yes ;; hpux9* | hpux10* | hpux11*) # Give a soname corresponding to the major version so that dld.sl refuses to # link against other versions. version_type=sunos need_lib_prefix=no need_version=no case $host_cpu in ia64*) shrext_cmds='.so' hardcode_into_libs=yes dynamic_linker="$host_os dld.so" shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' if test 32 = "$HPUX_IA64_MODE"; then sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib" sys_lib_dlsearch_path_spec=/usr/lib/hpux32 else sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64" sys_lib_dlsearch_path_spec=/usr/lib/hpux64 fi ;; hppa*64*) shrext_cmds='.sl' hardcode_into_libs=yes dynamic_linker="$host_os dld.sl" shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; *) shrext_cmds='.sl' dynamic_linker="$host_os dld.sl" shlibpath_var=SHLIB_PATH shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' ;; esac # HP-UX runs *really* slowly unless shared libraries are mode 555, ... postinstall_cmds='chmod 555 $lib' # or fails outright, so override atomically: install_override_mode=555 ;; interix[3-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; irix5* | irix6* | nonstopux*) case $host_os in nonstopux*) version_type=nonstopux ;; *) if test yes = "$lt_cv_prog_gnu_ld"; then version_type=linux # correct to gnu/linux during the next big refactor else version_type=irix fi ;; esac need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext' case $host_os in irix5* | nonstopux*) libsuff= shlibsuff= ;; *) case $LD in # libtool.m4 will add one of these switches to LD *-32|*"-32 "|*-melf32bsmip|*"-melf32bsmip ") libsuff= shlibsuff= libmagic=32-bit;; *-n32|*"-n32 "|*-melf32bmipn32|*"-melf32bmipn32 ") libsuff=32 shlibsuff=N32 libmagic=N32;; *-64|*"-64 "|*-melf64bmip|*"-melf64bmip ") libsuff=64 shlibsuff=64 libmagic=64-bit;; *) libsuff= shlibsuff= libmagic=never-match;; esac ;; esac shlibpath_var=LD_LIBRARY${shlibsuff}_PATH shlibpath_overrides_runpath=no sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff" sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff" hardcode_into_libs=yes ;; # No shared lib support for Linux oldld, aout, or coff. linux*oldld* | linux*aout* | linux*coff*) dynamic_linker=no ;; linux*android*) version_type=none # Android doesn't support versioned libraries. need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext' soname_spec='$libname$release$shared_ext' finish_cmds= shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes dynamic_linker='Android linker' # Don't embed -rpath directories since the linker doesn't support them. hardcode_libdir_flag_spec='-L$libdir' ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no # Some binutils ld are patched to set DT_RUNPATH if ${lt_cv_shlibpath_overrides_runpath+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_shlibpath_overrides_runpath=no save_LDFLAGS=$LDFLAGS save_libdir=$libdir eval "libdir=/foo; wl=\"$lt_prog_compiler_wl\"; \ LDFLAGS=\"\$LDFLAGS $hardcode_libdir_flag_spec\"" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null; then : lt_cv_shlibpath_overrides_runpath=yes fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS libdir=$save_libdir fi shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes # Ideally, we could use ldconfig to report *all* directores which are # searched for libraries, however this is still not possible. Aside from not # being certain /sbin/ldconfig is available, command # 'ldconfig -N -X -v | grep ^/' on 64bit Fedora does not report /usr/lib64, # even though it is searched at run-time. Try to do the best guess by # appending ld.so.conf contents (and includes) to the search path. if test -f /etc/ld.so.conf; then lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" fi # We used to test for /lib/ld.so.1 and disable shared libraries on # powerpc, because MkLinux only supported shared libraries with the # GNU dynamic linker. Since this was broken with cross compilers, # most powerpc-linux boxes support dynamic linking these days and # people can always --disable-shared, the test was removed, and we # assume the GNU/Linux dynamic linker is in use. dynamic_linker='GNU/Linux ld.so' ;; netbsdelf*-gnu) version_type=linux need_lib_prefix=no need_version=no library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}' soname_spec='${libname}${release}${shared_ext}$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='NetBSD ld.elf_so' ;; netbsd*) version_type=sunos need_lib_prefix=no need_version=no if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' dynamic_linker='NetBSD (a.out) ld.so' else library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='NetBSD ld.elf_so' fi shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; newsos6) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; *nto* | *qnx*) version_type=qnx need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='ldqnx.so' ;; openbsd* | bitrig*) version_type=sunos sys_lib_dlsearch_path_spec=/usr/lib need_lib_prefix=no if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then need_version=no else need_version=yes fi library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; os2*) libname_spec='$name' version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no # OS/2 can only load a DLL with a base name of 8 characters or less. soname_spec='`test -n "$os2dllname" && libname="$os2dllname"; v=$($ECHO $release$versuffix | tr -d .-); n=$($ECHO $libname | cut -b -$((8 - ${#v})) | tr . _); $ECHO $n$v`$shared_ext' library_names_spec='${libname}_dll.$libext' dynamic_linker='OS/2 ld.exe' shlibpath_var=BEGINLIBPATH sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' ;; osf3* | osf4* | osf5*) version_type=osf need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; rdos*) dynamic_linker=no ;; solaris*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes # ldd complains unless libraries are executable postinstall_cmds='chmod +x $lib' ;; sunos4*) version_type=sunos library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes if test yes = "$with_gnu_ld"; then need_lib_prefix=no fi need_version=yes ;; sysv4 | sysv4.3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH case $host_vendor in sni) shlibpath_overrides_runpath=no need_lib_prefix=no runpath_var=LD_RUN_PATH ;; siemens) need_lib_prefix=no ;; motorola) need_lib_prefix=no need_version=no shlibpath_overrides_runpath=no sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib' ;; esac ;; sysv4*MP*) if test -d /usr/nec; then version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext' soname_spec='$libname$shared_ext.$major' shlibpath_var=LD_LIBRARY_PATH fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) version_type=sco need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes if test yes = "$with_gnu_ld"; then sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib' else sys_lib_search_path_spec='/usr/ccs/lib /usr/lib' case $host_os in sco3.2v5*) sys_lib_search_path_spec="$sys_lib_search_path_spec /lib" ;; esac fi sys_lib_dlsearch_path_spec='/usr/lib' ;; tpf*) # TPF is a cross-target only. Preferred cross-host = GNU/Linux. version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; uts4*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; *) dynamic_linker=no ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5 $as_echo "$dynamic_linker" >&6; } test no = "$dynamic_linker" && can_build_shared=no variables_saved_for_relink="PATH $shlibpath_var $runpath_var" if test yes = "$GCC"; then variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH" fi if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec fi if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec fi # remember unaugmented sys_lib_dlsearch_path content for libtool script decls... configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec # ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH" # to be used as default LT_SYS_LIBRARY_PATH value in generated libtool configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5 $as_echo_n "checking how to hardcode library paths into programs... " >&6; } hardcode_action= if test -n "$hardcode_libdir_flag_spec" || test -n "$runpath_var" || test yes = "$hardcode_automatic"; then # We can hardcode non-existent directories. if test no != "$hardcode_direct" && # If the only mechanism to avoid hardcoding is shlibpath_var, we # have to relink, otherwise we might link with an installed library # when we should be linking with a yet-to-be-installed one ## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, )" && test no != "$hardcode_minus_L"; then # Linking always hardcodes the temporary library directory. hardcode_action=relink else # We can link without hardcoding, and we can hardcode nonexisting dirs. hardcode_action=immediate fi else # We cannot hardcode anything, or else we can only hardcode existing # directories. hardcode_action=unsupported fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5 $as_echo "$hardcode_action" >&6; } if test relink = "$hardcode_action" || test yes = "$inherit_rpath"; then # Fast installation is not supported enable_fast_install=no elif test yes = "$shlibpath_overrides_runpath" || test no = "$enable_shared"; then # Fast installation is not necessary enable_fast_install=needless fi if test yes != "$enable_dlopen"; then enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown else lt_cv_dlopen=no lt_cv_dlopen_libs= case $host_os in beos*) lt_cv_dlopen=load_add_on lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ;; mingw* | pw32* | cegcc*) lt_cv_dlopen=LoadLibrary lt_cv_dlopen_libs= ;; cygwin*) lt_cv_dlopen=dlopen lt_cv_dlopen_libs= ;; darwin*) # if libdl is installed we need to link against it { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5 $as_echo_n "checking for dlopen in -ldl... " >&6; } if ${ac_cv_lib_dl_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dl_dlopen=yes else ac_cv_lib_dl_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5 $as_echo "$ac_cv_lib_dl_dlopen" >&6; } if test "x$ac_cv_lib_dl_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl else lt_cv_dlopen=dyld lt_cv_dlopen_libs= lt_cv_dlopen_self=yes fi ;; tpf*) # Don't try to run any link tests for TPF. We know it's impossible # because TPF is a cross-compiler, and we know how we open DSOs. lt_cv_dlopen=dlopen lt_cv_dlopen_libs= lt_cv_dlopen_self=no ;; *) ac_fn_c_check_func "$LINENO" "shl_load" "ac_cv_func_shl_load" if test "x$ac_cv_func_shl_load" = xyes; then : lt_cv_dlopen=shl_load else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5 $as_echo_n "checking for shl_load in -ldld... " >&6; } if ${ac_cv_lib_dld_shl_load+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char shl_load (); int main () { return shl_load (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dld_shl_load=yes else ac_cv_lib_dld_shl_load=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5 $as_echo "$ac_cv_lib_dld_shl_load" >&6; } if test "x$ac_cv_lib_dld_shl_load" = xyes; then : lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld else ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen" if test "x$ac_cv_func_dlopen" = xyes; then : lt_cv_dlopen=dlopen else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5 $as_echo_n "checking for dlopen in -ldl... " >&6; } if ${ac_cv_lib_dl_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dl_dlopen=yes else ac_cv_lib_dl_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5 $as_echo "$ac_cv_lib_dl_dlopen" >&6; } if test "x$ac_cv_lib_dl_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5 $as_echo_n "checking for dlopen in -lsvld... " >&6; } if ${ac_cv_lib_svld_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lsvld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_svld_dlopen=yes else ac_cv_lib_svld_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5 $as_echo "$ac_cv_lib_svld_dlopen" >&6; } if test "x$ac_cv_lib_svld_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5 $as_echo_n "checking for dld_link in -ldld... " >&6; } if ${ac_cv_lib_dld_dld_link+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dld_link (); int main () { return dld_link (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dld_dld_link=yes else ac_cv_lib_dld_dld_link=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5 $as_echo "$ac_cv_lib_dld_dld_link" >&6; } if test "x$ac_cv_lib_dld_dld_link" = xyes; then : lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld fi fi fi fi fi fi ;; esac if test no = "$lt_cv_dlopen"; then enable_dlopen=no else enable_dlopen=yes fi case $lt_cv_dlopen in dlopen) save_CPPFLAGS=$CPPFLAGS test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H" save_LDFLAGS=$LDFLAGS wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\" save_LIBS=$LIBS LIBS="$lt_cv_dlopen_libs $LIBS" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5 $as_echo_n "checking whether a program can dlopen itself... " >&6; } if ${lt_cv_dlopen_self+:} false; then : $as_echo_n "(cached) " >&6 else if test yes = "$cross_compiling"; then : lt_cv_dlopen_self=cross else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF #line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; } _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&5 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) lt_cv_dlopen_self=yes ;; x$lt_dlneed_uscore) lt_cv_dlopen_self=yes ;; x$lt_dlunknown|x*) lt_cv_dlopen_self=no ;; esac else : # compilation failed lt_cv_dlopen_self=no fi fi rm -fr conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5 $as_echo "$lt_cv_dlopen_self" >&6; } if test yes = "$lt_cv_dlopen_self"; then wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5 $as_echo_n "checking whether a statically linked program can dlopen itself... " >&6; } if ${lt_cv_dlopen_self_static+:} false; then : $as_echo_n "(cached) " >&6 else if test yes = "$cross_compiling"; then : lt_cv_dlopen_self_static=cross else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF #line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; } _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&5 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) lt_cv_dlopen_self_static=yes ;; x$lt_dlneed_uscore) lt_cv_dlopen_self_static=yes ;; x$lt_dlunknown|x*) lt_cv_dlopen_self_static=no ;; esac else : # compilation failed lt_cv_dlopen_self_static=no fi fi rm -fr conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5 $as_echo "$lt_cv_dlopen_self_static" >&6; } fi CPPFLAGS=$save_CPPFLAGS LDFLAGS=$save_LDFLAGS LIBS=$save_LIBS ;; esac case $lt_cv_dlopen_self in yes|no) enable_dlopen_self=$lt_cv_dlopen_self ;; *) enable_dlopen_self=unknown ;; esac case $lt_cv_dlopen_self_static in yes|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;; *) enable_dlopen_self_static=unknown ;; esac fi striplib= old_striplib= { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5 $as_echo_n "checking whether stripping libraries is possible... " >&6; } if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then test -z "$old_striplib" && old_striplib="$STRIP --strip-debug" test -z "$striplib" && striplib="$STRIP --strip-unneeded" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else # FIXME - insert some real tests, host_os isn't really good enough case $host_os in darwin*) if test -n "$STRIP"; then striplib="$STRIP -x" old_striplib="$STRIP -S" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } ;; esac fi # Report what library types will actually be built { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5 $as_echo_n "checking if libtool supports shared libraries... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5 $as_echo "$can_build_shared" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5 $as_echo_n "checking whether to build shared libraries... " >&6; } test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[4-9]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5 $as_echo "$enable_shared" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5 $as_echo_n "checking whether to build static libraries... " >&6; } # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5 $as_echo "$enable_static" >&6; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CC=$lt_save_CC if test -n "$CXX" && ( test no != "$CXX" && ( (test g++ = "$CXX" && `g++ -v >/dev/null 2>&1` ) || (test g++ != "$CXX"))); then ac_ext=cpp ac_cpp='$CXXCPP $CPPFLAGS' ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_cxx_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C++ preprocessor" >&5 $as_echo_n "checking how to run the C++ preprocessor... " >&6; } if test -z "$CXXCPP"; then if ${ac_cv_prog_CXXCPP+:} false; then : $as_echo_n "(cached) " >&6 else # Double quotes because CXXCPP needs to be expanded for CXXCPP in "$CXX -E" "/lib/cpp" do ac_preproc_ok=false for ac_cxx_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_cxx_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_cxx_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : break fi done ac_cv_prog_CXXCPP=$CXXCPP fi CXXCPP=$ac_cv_prog_CXXCPP else ac_cv_prog_CXXCPP=$CXXCPP fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CXXCPP" >&5 $as_echo "$CXXCPP" >&6; } ac_preproc_ok=false for ac_cxx_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_cxx_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_cxx_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C++ preprocessor \"$CXXCPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu else _lt_caught_CXX_error=yes fi ac_ext=cpp ac_cpp='$CXXCPP $CPPFLAGS' ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_cxx_compiler_gnu archive_cmds_need_lc_CXX=no allow_undefined_flag_CXX= always_export_symbols_CXX=no archive_expsym_cmds_CXX= compiler_needs_object_CXX=no export_dynamic_flag_spec_CXX= hardcode_direct_CXX=no hardcode_direct_absolute_CXX=no hardcode_libdir_flag_spec_CXX= hardcode_libdir_separator_CXX= hardcode_minus_L_CXX=no hardcode_shlibpath_var_CXX=unsupported hardcode_automatic_CXX=no inherit_rpath_CXX=no module_cmds_CXX= module_expsym_cmds_CXX= link_all_deplibs_CXX=unknown old_archive_cmds_CXX=$old_archive_cmds reload_flag_CXX=$reload_flag reload_cmds_CXX=$reload_cmds no_undefined_flag_CXX= whole_archive_flag_spec_CXX= enable_shared_with_static_runtimes_CXX=no # Source file extension for C++ test sources. ac_ext=cpp # Object file extension for compiled C++ test sources. objext=o objext_CXX=$objext # No sense in running all these tests if we already determined that # the CXX compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_caught_CXX_error"; then # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(int, char *[]) { return(0); }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC # save warnings/boilerplate of simple test code ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" >conftest.$ac_ext eval "$ac_compile" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_compiler_boilerplate=`cat conftest.err` $RM conftest* ac_outfile=conftest.$ac_objext echo "$lt_simple_link_test_code" >conftest.$ac_ext eval "$ac_link" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_linker_boilerplate=`cat conftest.err` $RM -r conftest* # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_LD=$LD lt_save_GCC=$GCC GCC=$GXX lt_save_with_gnu_ld=$with_gnu_ld lt_save_path_LD=$lt_cv_path_LD if test -n "${lt_cv_prog_gnu_ldcxx+set}"; then lt_cv_prog_gnu_ld=$lt_cv_prog_gnu_ldcxx else $as_unset lt_cv_prog_gnu_ld fi if test -n "${lt_cv_path_LDCXX+set}"; then lt_cv_path_LD=$lt_cv_path_LDCXX else $as_unset lt_cv_path_LD fi test -z "${LDCXX+set}" || LD=$LDCXX CC=${CXX-"c++"} CFLAGS=$CXXFLAGS compiler=$CC compiler_CXX=$CC func_cc_basename $compiler cc_basename=$func_cc_basename_result if test -n "$compiler"; then # We don't want -fno-exception when compiling C++ code, so set the # no_builtin_flag separately if test yes = "$GXX"; then lt_prog_compiler_no_builtin_flag_CXX=' -fno-builtin' else lt_prog_compiler_no_builtin_flag_CXX= fi if test yes = "$GXX"; then # Set up default GNU C++ configuration # Check whether --with-gnu-ld was given. if test "${with_gnu_ld+set}" = set; then : withval=$with_gnu_ld; test no = "$withval" || with_gnu_ld=yes else with_gnu_ld=no fi ac_prog=ld if test yes = "$GCC"; then # Check if gcc -print-prog-name=ld gives a path. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5 $as_echo_n "checking for ld used by $CC... " >&6; } case $host in *-*-mingw*) # gcc leaves a trailing carriage return, which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [\\/]* | ?:[\\/]*) re_direlt='/[^/][^/]*/\.\./' # Canonicalize the pathname of ld ac_prog=`$ECHO "$ac_prog"| $SED 's%\\\\%/%g'` while $ECHO "$ac_prog" | $GREP "$re_direlt" > /dev/null 2>&1; do ac_prog=`$ECHO $ac_prog| $SED "s%$re_direlt%/%"` done test -z "$LD" && LD=$ac_prog ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test yes = "$with_gnu_ld"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5 $as_echo_n "checking for GNU ld... " >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5 $as_echo_n "checking for non-GNU ld... " >&6; } fi if ${lt_cv_path_LD+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$LD"; then lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then lt_cv_path_LD=$ac_dir/$ac_prog # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some variants of GNU ld only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$lt_cv_path_LD" -v 2>&1 &5 $as_echo "$LD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5 $as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; } if ${lt_cv_prog_gnu_ld+:} false; then : $as_echo_n "(cached) " >&6 else # I'd rather use --version here, but apparently some GNU lds only accept -v. case `$LD -v 2>&1 &5 $as_echo "$lt_cv_prog_gnu_ld" >&6; } with_gnu_ld=$lt_cv_prog_gnu_ld # Check if GNU C++ uses GNU ld as the underlying linker, since the # archiving commands below assume that GNU ld is being used. if test yes = "$with_gnu_ld"; then archive_cmds_CXX='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' hardcode_libdir_flag_spec_CXX='$wl-rpath $wl$libdir' export_dynamic_flag_spec_CXX='$wl--export-dynamic' # If archive_cmds runs LD, not CC, wlarc should be empty # XXX I think wlarc can be eliminated in ltcf-cxx, but I need to # investigate it a little bit more. (MM) wlarc='$wl' # ancient GNU ld didn't support --whole-archive et. al. if eval "`$CC -print-prog-name=ld` --help 2>&1" | $GREP 'no-whole-archive' > /dev/null; then whole_archive_flag_spec_CXX=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else whole_archive_flag_spec_CXX= fi else with_gnu_ld=no wlarc= # A generic and very simple default shared library creation # command for GNU C++ for the case where it uses the native # linker, instead of GNU ld. If possible, this setting should # overridden to take advantage of the native linker features on # the platform it is being used on. archive_cmds_CXX='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' fi # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else GXX=no with_gnu_ld=no wlarc= fi # PORTME: fill in a description of your system's C++ link characteristics { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5 $as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; } ld_shlibs_CXX=yes case $host_os in aix3*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; aix[4-9]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[23]|aix4.[23].*|aix[5-9]*) for ld_flag in $LDFLAGS; do case $ld_flag in *-brtl*) aix_use_runtimelinking=yes break ;; esac done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. archive_cmds_CXX='' hardcode_direct_CXX=yes hardcode_direct_absolute_CXX=yes hardcode_libdir_separator_CXX=':' link_all_deplibs_CXX=yes file_list_spec_CXX='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. hardcode_direct_CXX=no hardcode_direct_absolute_CXX=no ;; esac if test yes = "$GXX"; then case $host_os in aix4.[012]|aix4.[012].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 hardcode_direct_CXX=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking hardcode_minus_L_CXX=yes hardcode_libdir_flag_spec_CXX='-L$libdir' hardcode_libdir_separator_CXX= fi esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag=$shared_flag' $wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi export_dynamic_flag_spec_CXX='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to # export. always_export_symbols_CXX=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. # The "-G" linker flag allows undefined symbols. no_undefined_flag_CXX='-bernotok' # Determine the default libpath from the value encoded in an empty # executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath__CXX+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath__CXX=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath__CXX"; then lt_cv_aix_libpath__CXX=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath__CXX"; then lt_cv_aix_libpath__CXX=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath__CXX fi hardcode_libdir_flag_spec_CXX='$wl-blibpath:$libdir:'"$aix_libpath" archive_expsym_cmds_CXX='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then hardcode_libdir_flag_spec_CXX='$wl-R $libdir:/usr/lib:/lib' allow_undefined_flag_CXX="-z nodefs" archive_expsym_cmds_CXX="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath__CXX+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath__CXX=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath__CXX"; then lt_cv_aix_libpath__CXX=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath__CXX"; then lt_cv_aix_libpath__CXX=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath__CXX fi hardcode_libdir_flag_spec_CXX='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. no_undefined_flag_CXX=' $wl-bernotok' allow_undefined_flag_CXX=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. whole_archive_flag_spec_CXX='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives whole_archive_flag_spec_CXX='$convenience' fi archive_cmds_need_lc_CXX=yes archive_expsym_cmds_CXX='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([, ]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared # libraries. Need -bnortl late, we may have -brtl in LDFLAGS. archive_expsym_cmds_CXX="$archive_expsym_cmds_CXX"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then archive_expsym_cmds_CXX="$archive_expsym_cmds_CXX"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols archive_expsym_cmds_CXX="$archive_expsym_cmds_CXX"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi archive_expsym_cmds_CXX="$archive_expsym_cmds_CXX"'~$RM -r $output_objdir/$realname.d' fi fi ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then allow_undefined_flag_CXX=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME archive_cmds_CXX='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else ld_shlibs_CXX=no fi ;; chorus*) case $cc_basename in *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac ;; cygwin* | mingw* | pw32* | cegcc*) case $GXX,$cc_basename in ,cl* | no,cl*) # Native MSVC # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. hardcode_libdir_flag_spec_CXX=' ' allow_undefined_flag_CXX=unsupported always_export_symbols_CXX=yes file_list_spec_CXX='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. archive_cmds_CXX='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' archive_expsym_cmds_CXX='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, CXX)='true' enable_shared_with_static_runtimes_CXX=yes # Don't use ranlib old_postinstall_cmds_CXX='chmod 644 $oldlib' postlink_cmds_CXX='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ func_to_tool_file "$lt_outputfile"~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # g++ # _LT_TAGVAR(hardcode_libdir_flag_spec, CXX) is actually meaningless, # as there is no search path for DLLs. hardcode_libdir_flag_spec_CXX='-L$libdir' export_dynamic_flag_spec_CXX='$wl--export-all-symbols' allow_undefined_flag_CXX=unsupported always_export_symbols_CXX=no enable_shared_with_static_runtimes_CXX=yes if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then archive_cmds_CXX='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... archive_expsym_cmds_CXX='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared -nostdlib $output_objdir/$soname.def $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else ld_shlibs_CXX=no fi ;; esac ;; darwin* | rhapsody*) archive_cmds_need_lc_CXX=no hardcode_direct_CXX=no hardcode_automatic_CXX=yes hardcode_shlibpath_var_CXX=unsupported if test yes = "$lt_cv_ld_force_load"; then whole_archive_flag_spec_CXX='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`' else whole_archive_flag_spec_CXX='' fi link_all_deplibs_CXX=yes allow_undefined_flag_CXX=$_lt_dar_allow_undefined case $cc_basename in ifort*|nagfor*) _lt_dar_can_shared=yes ;; *) _lt_dar_can_shared=$GCC ;; esac if test yes = "$_lt_dar_can_shared"; then output_verbose_link_cmd=func_echo_all archive_cmds_CXX="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil" module_cmds_CXX="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil" archive_expsym_cmds_CXX="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil" module_expsym_cmds_CXX="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil" if test yes != "$lt_cv_apple_cc_single_mod"; then archive_cmds_CXX="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil" archive_expsym_cmds_CXX="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil" fi else ld_shlibs_CXX=no fi ;; os2*) hardcode_libdir_flag_spec_CXX='-L$libdir' hardcode_minus_L_CXX=yes allow_undefined_flag_CXX=unsupported shrext_cmds=.dll archive_cmds_CXX='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' archive_expsym_cmds_CXX='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' old_archive_From_new_cmds_CXX='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' enable_shared_with_static_runtimes_CXX=yes ;; dgux*) case $cc_basename in ec++*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; ghcx*) # Green Hills C++ Compiler # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac ;; freebsd2.*) # C++ shared libraries reported to be fairly broken before # switch to ELF ld_shlibs_CXX=no ;; freebsd-elf*) archive_cmds_need_lc_CXX=no ;; freebsd* | dragonfly*) # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF # conventions ld_shlibs_CXX=yes ;; haiku*) archive_cmds_CXX='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' link_all_deplibs_CXX=yes ;; hpux9*) hardcode_libdir_flag_spec_CXX='$wl+b $wl$libdir' hardcode_libdir_separator_CXX=: export_dynamic_flag_spec_CXX='$wl-E' hardcode_direct_CXX=yes hardcode_minus_L_CXX=yes # Not in the search PATH, # but as the default # location of the library. case $cc_basename in CC*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; aCC*) archive_cmds_CXX='$RM $output_objdir/$soname~$CC -b $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then archive_cmds_CXX='$RM $output_objdir/$soname~$CC -shared -nostdlib $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else # FIXME: insert proper C++ library support ld_shlibs_CXX=no fi ;; esac ;; hpux10*|hpux11*) if test no = "$with_gnu_ld"; then hardcode_libdir_flag_spec_CXX='$wl+b $wl$libdir' hardcode_libdir_separator_CXX=: case $host_cpu in hppa*64*|ia64*) ;; *) export_dynamic_flag_spec_CXX='$wl-E' ;; esac fi case $host_cpu in hppa*64*|ia64*) hardcode_direct_CXX=no hardcode_shlibpath_var_CXX=no ;; *) hardcode_direct_CXX=yes hardcode_direct_absolute_CXX=yes hardcode_minus_L_CXX=yes # Not in the search PATH, # but as the default # location of the library. ;; esac case $cc_basename in CC*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; aCC*) case $host_cpu in hppa*64*) archive_cmds_CXX='$CC -b $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) archive_cmds_CXX='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) archive_cmds_CXX='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then case $host_cpu in hppa*64*) archive_cmds_CXX='$CC -shared -nostdlib -fPIC $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) archive_cmds_CXX='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) archive_cmds_CXX='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac fi else # FIXME: insert proper C++ library support ld_shlibs_CXX=no fi ;; esac ;; interix[3-9]*) hardcode_direct_CXX=no hardcode_shlibpath_var_CXX=no hardcode_libdir_flag_spec_CXX='$wl-rpath,$libdir' export_dynamic_flag_spec_CXX='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. archive_cmds_CXX='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' archive_expsym_cmds_CXX='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; irix5* | irix6*) case $cc_basename in CC*) # SGI C++ archive_cmds_CXX='$CC -shared -all -multigot $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' # Archives containing C++ object files must be created using # "CC -ar", where "CC" is the IRIX C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. old_archive_cmds_CXX='$CC -ar -WR,-u -o $oldlib $oldobjs' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then archive_cmds_CXX='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else archive_cmds_CXX='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` -o $lib' fi fi link_all_deplibs_CXX=yes ;; esac hardcode_libdir_flag_spec_CXX='$wl-rpath $wl$libdir' hardcode_libdir_separator_CXX=: inherit_rpath_CXX=yes ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. archive_cmds_CXX='tempext=`echo $shared_ext | $SED -e '\''s/\([^()0-9A-Za-z{}]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' archive_expsym_cmds_CXX='tempext=`echo $shared_ext | $SED -e '\''s/\([^()0-9A-Za-z{}]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib $wl-retain-symbols-file,$export_symbols; mv \$templib $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 | $GREP "ld"`; rm -f libconftest$shared_ext; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' hardcode_libdir_flag_spec_CXX='$wl-rpath,$libdir' export_dynamic_flag_spec_CXX='$wl--export-dynamic' # Archives containing C++ object files must be created using # "CC -Bstatic", where "CC" is the KAI C++ compiler. old_archive_cmds_CXX='$CC -Bstatic -o $oldlib $oldobjs' ;; icpc* | ecpc* ) # Intel C++ with_gnu_ld=yes # version 8.0 and above of icpc choke on multiply defined symbols # if we add $predep_objects and $postdep_objects, however 7.1 and # earlier do not add the objects themselves. case `$CC -V 2>&1` in *"Version 7."*) archive_cmds_CXX='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 8.0 or newer tmp_idyn= case $host_cpu in ia64*) tmp_idyn=' -i_dynamic';; esac archive_cmds_CXX='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac archive_cmds_need_lc_CXX=no hardcode_libdir_flag_spec_CXX='$wl-rpath,$libdir' export_dynamic_flag_spec_CXX='$wl--export-dynamic' whole_archive_flag_spec_CXX='$wl--whole-archive$convenience $wl--no-whole-archive' ;; pgCC* | pgcpp*) # Portland Group C++ compiler case `$CC -V` in *pgCC\ [1-5].* | *pgcpp\ [1-5].*) prelink_cmds_CXX='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~ compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"' old_archive_cmds_CXX='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~ $AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~ $RANLIB $oldlib' archive_cmds_CXX='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 6 and above use weak symbols archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac hardcode_libdir_flag_spec_CXX='$wl--rpath $wl$libdir' export_dynamic_flag_spec_CXX='$wl--export-dynamic' whole_archive_flag_spec_CXX='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' ;; cxx*) # Compaq C++ archive_cmds_CXX='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds_CXX='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib $wl-retain-symbols-file $wl$export_symbols' runpath_var=LD_RUN_PATH hardcode_libdir_flag_spec_CXX='-rpath $libdir' hardcode_libdir_separator_CXX=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld .*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "X$list" | $Xsed' ;; xl* | mpixl* | bgxl*) # IBM XL 8.0 on PPC, with GNU ld hardcode_libdir_flag_spec_CXX='$wl-rpath $wl$libdir' export_dynamic_flag_spec_CXX='$wl--export-dynamic' archive_cmds_CXX='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then archive_expsym_cmds_CXX='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 no_undefined_flag_CXX=' -zdefs' archive_cmds_CXX='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' archive_expsym_cmds_CXX='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file $wl$export_symbols' hardcode_libdir_flag_spec_CXX='-R$libdir' whole_archive_flag_spec_CXX='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' compiler_needs_object_CXX=yes # Not sure whether something based on # $CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 # would be better. output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. old_archive_cmds_CXX='$CC -xar -o $oldlib $oldobjs' ;; esac ;; esac ;; lynxos*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; m88k*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; mvs*) case $cc_basename in cxx*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac ;; netbsd*) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then archive_cmds_CXX='$LD -Bshareable -o $lib $predep_objects $libobjs $deplibs $postdep_objects $linker_flags' wlarc= hardcode_libdir_flag_spec_CXX='-R$libdir' hardcode_direct_CXX=yes hardcode_shlibpath_var_CXX=no fi # Workaround some broken pre-1.5 toolchains output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP conftest.$objext | $SED -e "s:-lgcc -lc -lgcc::"' ;; *nto* | *qnx*) ld_shlibs_CXX=yes ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then hardcode_direct_CXX=yes hardcode_shlibpath_var_CXX=no hardcode_direct_absolute_CXX=yes archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' hardcode_libdir_flag_spec_CXX='$wl-rpath,$libdir' if test -z "`echo __ELF__ | $CC -E - | grep __ELF__`"; then archive_expsym_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file,$export_symbols -o $lib' export_dynamic_flag_spec_CXX='$wl-E' whole_archive_flag_spec_CXX=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' fi output_verbose_link_cmd=func_echo_all else ld_shlibs_CXX=no fi ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. archive_cmds_CXX='tempext=`echo $shared_ext | $SED -e '\''s/\([^()0-9A-Za-z{}]\)/\\\\\1/g'\''`; templib=`echo "$lib" | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' hardcode_libdir_flag_spec_CXX='$wl-rpath,$libdir' hardcode_libdir_separator_CXX=: # Archives containing C++ object files must be created using # the KAI C++ compiler. case $host in osf3*) old_archive_cmds_CXX='$CC -Bstatic -o $oldlib $oldobjs' ;; *) old_archive_cmds_CXX='$CC -o $oldlib $oldobjs' ;; esac ;; RCC*) # Rational C++ 2.4.1 # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; cxx*) case $host in osf3*) allow_undefined_flag_CXX=' $wl-expect_unresolved $wl\*' archive_cmds_CXX='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $soname `test -n "$verstring" && func_echo_all "$wl-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' hardcode_libdir_flag_spec_CXX='$wl-rpath $wl$libdir' ;; *) allow_undefined_flag_CXX=' -expect_unresolved \*' archive_cmds_CXX='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' archive_expsym_cmds_CXX='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done~ echo "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname $wl-input $wl$lib.exp `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~ $RM $lib.exp' hardcode_libdir_flag_spec_CXX='-rpath $libdir' ;; esac hardcode_libdir_separator_CXX=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld" | $GREP -v "ld:"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld.*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes,no = "$GXX,$with_gnu_ld"; then allow_undefined_flag_CXX=' $wl-expect_unresolved $wl\*' case $host in osf3*) archive_cmds_CXX='$CC -shared -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; *) archive_cmds_CXX='$CC -shared $pic_flag -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; esac hardcode_libdir_flag_spec_CXX='$wl-rpath $wl$libdir' hardcode_libdir_separator_CXX=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # FIXME: insert proper C++ library support ld_shlibs_CXX=no fi ;; esac ;; psos*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; lcc*) # Lucid # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ archive_cmds_need_lc_CXX=yes no_undefined_flag_CXX=' -zdefs' archive_cmds_CXX='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' archive_expsym_cmds_CXX='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag $wl-M $wl$lib.exp -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' hardcode_libdir_flag_spec_CXX='-R$libdir' hardcode_shlibpath_var_CXX=no case $host_os in solaris2.[0-5] | solaris2.[0-5].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. # Supported since Solaris 2.6 (maybe 2.5.1?) whole_archive_flag_spec_CXX='-z allextract$convenience -z defaultextract' ;; esac link_all_deplibs_CXX=yes output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. old_archive_cmds_CXX='$CC -xar -o $oldlib $oldobjs' ;; gcx*) # Green Hills C++ Compiler archive_cmds_CXX='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' # The C++ compiler must be used to create the archive. old_archive_cmds_CXX='$CC $LDFLAGS -archive -o $oldlib $oldobjs' ;; *) # GNU C++ compiler with Solaris linker if test yes,no = "$GXX,$with_gnu_ld"; then no_undefined_flag_CXX=' $wl-z ${wl}defs' if $CC --version | $GREP -v '^2\.7' > /dev/null; then archive_cmds_CXX='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' archive_expsym_cmds_CXX='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # g++ 2.7 appears to require '-G' NOT '-shared' on this # platform. archive_cmds_CXX='$CC -G -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' archive_expsym_cmds_CXX='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' fi hardcode_libdir_flag_spec_CXX='$wl-R $wl$libdir' case $host_os in solaris2.[0-5] | solaris2.[0-5].*) ;; *) whole_archive_flag_spec_CXX='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' ;; esac fi ;; esac ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[01].[10]* | unixware7* | sco3.2v5.0.[024]*) no_undefined_flag_CXX='$wl-z,text' archive_cmds_need_lc_CXX=no hardcode_shlibpath_var_CXX=no runpath_var='LD_RUN_PATH' case $cc_basename in CC*) archive_cmds_CXX='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds_CXX='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; *) archive_cmds_CXX='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds_CXX='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. no_undefined_flag_CXX='$wl-z,text' allow_undefined_flag_CXX='$wl-z,nodefs' archive_cmds_need_lc_CXX=no hardcode_shlibpath_var_CXX=no hardcode_libdir_flag_spec_CXX='$wl-R,$libdir' hardcode_libdir_separator_CXX=':' link_all_deplibs_CXX=yes export_dynamic_flag_spec_CXX='$wl-Bexport' runpath_var='LD_RUN_PATH' case $cc_basename in CC*) archive_cmds_CXX='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds_CXX='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' old_archive_cmds_CXX='$CC -Tprelink_objects $oldobjs~ '"$old_archive_cmds_CXX" reload_cmds_CXX='$CC -Tprelink_objects $reload_objs~ '"$reload_cmds_CXX" ;; *) archive_cmds_CXX='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds_CXX='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac ;; vxworks*) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; *) # FIXME: insert proper C++ library support ld_shlibs_CXX=no ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs_CXX" >&5 $as_echo "$ld_shlibs_CXX" >&6; } test no = "$ld_shlibs_CXX" && can_build_shared=no GCC_CXX=$GXX LD_CXX=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... # Dependencies to place before and after the object being linked: predep_objects_CXX= postdep_objects_CXX= predeps_CXX= postdeps_CXX= compiler_lib_search_path_CXX= cat > conftest.$ac_ext <<_LT_EOF class Foo { public: Foo (void) { a = 0; } private: int a; }; _LT_EOF _lt_libdeps_save_CFLAGS=$CFLAGS case "$CC $CFLAGS " in #( *\ -flto*\ *) CFLAGS="$CFLAGS -fno-lto" ;; *\ -fwhopr*\ *) CFLAGS="$CFLAGS -fno-whopr" ;; *\ -fuse-linker-plugin*\ *) CFLAGS="$CFLAGS -fno-use-linker-plugin" ;; esac if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then # Parse the compiler output and extract the necessary # objects, libraries and library flags. # Sentinel used to keep track of whether or not we are before # the conftest object file. pre_test_object_deps_done=no for p in `eval "$output_verbose_link_cmd"`; do case $prev$p in -L* | -R* | -l*) # Some compilers place space between "-{L,R}" and the path. # Remove the space. if test x-L = "$p" || test x-R = "$p"; then prev=$p continue fi # Expand the sysroot to ease extracting the directories later. if test -z "$prev"; then case $p in -L*) func_stripname_cnf '-L' '' "$p"; prev=-L; p=$func_stripname_result ;; -R*) func_stripname_cnf '-R' '' "$p"; prev=-R; p=$func_stripname_result ;; -l*) func_stripname_cnf '-l' '' "$p"; prev=-l; p=$func_stripname_result ;; esac fi case $p in =*) func_stripname_cnf '=' '' "$p"; p=$lt_sysroot$func_stripname_result ;; esac if test no = "$pre_test_object_deps_done"; then case $prev in -L | -R) # Internal compiler library paths should come after those # provided the user. The postdeps already come after the # user supplied libs so there is no need to process them. if test -z "$compiler_lib_search_path_CXX"; then compiler_lib_search_path_CXX=$prev$p else compiler_lib_search_path_CXX="${compiler_lib_search_path_CXX} $prev$p" fi ;; # The "-l" case would never come before the object being # linked, so don't bother handling this case. esac else if test -z "$postdeps_CXX"; then postdeps_CXX=$prev$p else postdeps_CXX="${postdeps_CXX} $prev$p" fi fi prev= ;; *.lto.$objext) ;; # Ignore GCC LTO objects *.$objext) # This assumes that the test object file only shows up # once in the compiler output. if test "$p" = "conftest.$objext"; then pre_test_object_deps_done=yes continue fi if test no = "$pre_test_object_deps_done"; then if test -z "$predep_objects_CXX"; then predep_objects_CXX=$p else predep_objects_CXX="$predep_objects_CXX $p" fi else if test -z "$postdep_objects_CXX"; then postdep_objects_CXX=$p else postdep_objects_CXX="$postdep_objects_CXX $p" fi fi ;; *) ;; # Ignore the rest. esac done # Clean up. rm -f a.out a.exe else echo "libtool.m4: error: problem compiling CXX test program" fi $RM -f confest.$objext CFLAGS=$_lt_libdeps_save_CFLAGS # PORTME: override above test on systems where it is broken case $host_os in interix[3-9]*) # Interix 3.5 installs completely hosed .la files for C++, so rather than # hack all around it, let's just trust "g++" to DTRT. predep_objects_CXX= postdep_objects_CXX= postdeps_CXX= ;; esac case " $postdeps_CXX " in *" -lc "*) archive_cmds_need_lc_CXX=no ;; esac compiler_lib_search_dirs_CXX= if test -n "${compiler_lib_search_path_CXX}"; then compiler_lib_search_dirs_CXX=`echo " ${compiler_lib_search_path_CXX}" | $SED -e 's! -L! !g' -e 's!^ !!'` fi lt_prog_compiler_wl_CXX= lt_prog_compiler_pic_CXX= lt_prog_compiler_static_CXX= # C++ specific cases for pic, static, wl, etc. if test yes = "$GXX"; then lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_static_CXX='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static_CXX='-Bstatic' fi lt_prog_compiler_pic_CXX='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support lt_prog_compiler_pic_CXX='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. lt_prog_compiler_pic_CXX='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries lt_prog_compiler_pic_CXX='-DDLL_EXPORT' case $host_os in os2*) lt_prog_compiler_static_CXX='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files lt_prog_compiler_pic_CXX='-fno-common' ;; *djgpp*) # DJGPP does not support shared libraries at all lt_prog_compiler_pic_CXX= ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. lt_prog_compiler_static_CXX= ;; interix[3-9]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; sysv4*MP*) if test -d /usr/nec; then lt_prog_compiler_pic_CXX=-Kconform_pic fi ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) ;; *) lt_prog_compiler_pic_CXX='-fPIC' ;; esac ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic_CXX='-fPIC -shared' ;; *) lt_prog_compiler_pic_CXX='-fPIC' ;; esac else case $host_os in aix[4-9]*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static_CXX='-Bstatic' else lt_prog_compiler_static_CXX='-bnso -bI:/lib/syscalls.exp' fi ;; chorus*) case $cc_basename in cxch68*) # Green Hills C++ Compiler # _LT_TAGVAR(lt_prog_compiler_static, CXX)="--no_auto_instantiation -u __main -u __premain -u _abort -r $COOL_DIR/lib/libOrb.a $MVME_DIR/lib/CC/libC.a $MVME_DIR/lib/classix/libcx.s.a" ;; esac ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). lt_prog_compiler_pic_CXX='-DDLL_EXPORT' ;; dgux*) case $cc_basename in ec++*) lt_prog_compiler_pic_CXX='-KPIC' ;; ghcx*) # Green Hills C++ Compiler lt_prog_compiler_pic_CXX='-pic' ;; *) ;; esac ;; freebsd* | dragonfly*) # FreeBSD uses GNU C++ ;; hpux9* | hpux10* | hpux11*) case $cc_basename in CC*) lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_static_CXX='$wl-a ${wl}archive' if test ia64 != "$host_cpu"; then lt_prog_compiler_pic_CXX='+Z' fi ;; aCC*) lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_static_CXX='$wl-a ${wl}archive' case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) lt_prog_compiler_pic_CXX='+Z' ;; esac ;; *) ;; esac ;; interix*) # This is c89, which is MS Visual C++ (no shared libs) # Anyone wants to do a port? ;; irix5* | irix6* | nonstopux*) case $cc_basename in CC*) lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_static_CXX='-non_shared' # CC pic flag -KPIC is the default. ;; *) ;; esac ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # KAI C++ Compiler lt_prog_compiler_wl_CXX='--backend -Wl,' lt_prog_compiler_pic_CXX='-fPIC' ;; ecpc* ) # old Intel C++ for x86_64, which still supported -KPIC. lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_pic_CXX='-KPIC' lt_prog_compiler_static_CXX='-static' ;; icpc* ) # Intel C++, used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_pic_CXX='-fPIC' lt_prog_compiler_static_CXX='-static' ;; pgCC* | pgcpp*) # Portland Group C++ compiler lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_pic_CXX='-fpic' lt_prog_compiler_static_CXX='-Bstatic' ;; cxx*) # Compaq C++ # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. lt_prog_compiler_pic_CXX= lt_prog_compiler_static_CXX='-non_shared' ;; xlc* | xlC* | bgxl[cC]* | mpixl[cC]*) # IBM XL 8.0, 9.0 on PPC and BlueGene lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_pic_CXX='-qpic' lt_prog_compiler_static_CXX='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 lt_prog_compiler_pic_CXX='-KPIC' lt_prog_compiler_static_CXX='-Bstatic' lt_prog_compiler_wl_CXX='-Qoption ld ' ;; esac ;; esac ;; lynxos*) ;; m88k*) ;; mvs*) case $cc_basename in cxx*) lt_prog_compiler_pic_CXX='-W c,exportall' ;; *) ;; esac ;; netbsd* | netbsdelf*-gnu) ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic_CXX='-fPIC -shared' ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) lt_prog_compiler_wl_CXX='--backend -Wl,' ;; RCC*) # Rational C++ 2.4.1 lt_prog_compiler_pic_CXX='-pic' ;; cxx*) # Digital/Compaq C++ lt_prog_compiler_wl_CXX='-Wl,' # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. lt_prog_compiler_pic_CXX= lt_prog_compiler_static_CXX='-non_shared' ;; *) ;; esac ;; psos*) ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ lt_prog_compiler_pic_CXX='-KPIC' lt_prog_compiler_static_CXX='-Bstatic' lt_prog_compiler_wl_CXX='-Qoption ld ' ;; gcx*) # Green Hills C++ Compiler lt_prog_compiler_pic_CXX='-PIC' ;; *) ;; esac ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x lt_prog_compiler_pic_CXX='-pic' lt_prog_compiler_static_CXX='-Bstatic' ;; lcc*) # Lucid lt_prog_compiler_pic_CXX='-pic' ;; *) ;; esac ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) case $cc_basename in CC*) lt_prog_compiler_wl_CXX='-Wl,' lt_prog_compiler_pic_CXX='-KPIC' lt_prog_compiler_static_CXX='-Bstatic' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 lt_prog_compiler_pic_CXX='-KPIC' ;; *) ;; esac ;; vxworks*) ;; *) lt_prog_compiler_can_build_shared_CXX=no ;; esac fi case $host_os in # For platforms that do not support PIC, -DPIC is meaningless: *djgpp*) lt_prog_compiler_pic_CXX= ;; *) lt_prog_compiler_pic_CXX="$lt_prog_compiler_pic_CXX -DPIC" ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5 $as_echo_n "checking for $compiler option to produce PIC... " >&6; } if ${lt_cv_prog_compiler_pic_CXX+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic_CXX=$lt_prog_compiler_pic_CXX fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_CXX" >&5 $as_echo "$lt_cv_prog_compiler_pic_CXX" >&6; } lt_prog_compiler_pic_CXX=$lt_cv_prog_compiler_pic_CXX # # Check to make sure the PIC flag actually works. # if test -n "$lt_prog_compiler_pic_CXX"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic_CXX works" >&5 $as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic_CXX works... " >&6; } if ${lt_cv_prog_compiler_pic_works_CXX+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic_works_CXX=no ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="$lt_prog_compiler_pic_CXX -DPIC" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_pic_works_CXX=yes fi fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works_CXX" >&5 $as_echo "$lt_cv_prog_compiler_pic_works_CXX" >&6; } if test yes = "$lt_cv_prog_compiler_pic_works_CXX"; then case $lt_prog_compiler_pic_CXX in "" | " "*) ;; *) lt_prog_compiler_pic_CXX=" $lt_prog_compiler_pic_CXX" ;; esac else lt_prog_compiler_pic_CXX= lt_prog_compiler_can_build_shared_CXX=no fi fi # # Check to make sure the static flag actually works. # wl=$lt_prog_compiler_wl_CXX eval lt_tmp_static_flag=\"$lt_prog_compiler_static_CXX\" { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5 $as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; } if ${lt_cv_prog_compiler_static_works_CXX+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_static_works_CXX=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS $lt_tmp_static_flag" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&5 $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_static_works_CXX=yes fi else lt_cv_prog_compiler_static_works_CXX=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works_CXX" >&5 $as_echo "$lt_cv_prog_compiler_static_works_CXX" >&6; } if test yes = "$lt_cv_prog_compiler_static_works_CXX"; then : else lt_prog_compiler_static_CXX= fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o_CXX+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o_CXX=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o_CXX=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o_CXX" >&5 $as_echo "$lt_cv_prog_compiler_c_o_CXX" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o_CXX+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o_CXX=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o_CXX=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o_CXX" >&5 $as_echo "$lt_cv_prog_compiler_c_o_CXX" >&6; } hard_links=nottested if test no = "$lt_cv_prog_compiler_c_o_CXX" && test no != "$need_locks"; then # do not overwrite the value of need_locks provided by the user { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5 $as_echo_n "checking if we can lock with hard links... " >&6; } hard_links=yes $RM conftest* ln conftest.a conftest.b 2>/dev/null && hard_links=no touch conftest.a ln conftest.a conftest.b 2>&5 || hard_links=no ln conftest.a conftest.b 2>/dev/null && hard_links=no { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5 $as_echo "$hard_links" >&6; } if test no = "$hard_links"; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5 $as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;} need_locks=warn fi else need_locks=no fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5 $as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; } export_symbols_cmds_CXX='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' exclude_expsyms_CXX='_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*' case $host_os in aix[4-9]*) # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then export_symbols_cmds_CXX='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else export_symbols_cmds_CXX='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi ;; pw32*) export_symbols_cmds_CXX=$ltdll_cmds ;; cygwin* | mingw* | cegcc*) case $cc_basename in cl*) exclude_expsyms_CXX='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' ;; *) export_symbols_cmds_CXX='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[BCDGRS][ ]/s/.*[ ]\([^ ]*\)/\1 DATA/;s/^.*[ ]__nm__\([^ ]*\)[ ][^ ]*/\1 DATA/;/^I[ ]/d;/^[AITW][ ]/s/.* //'\'' | sort | uniq > $export_symbols' exclude_expsyms_CXX='[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname' ;; esac ;; linux* | k*bsd*-gnu | gnu*) link_all_deplibs_CXX=no ;; *) export_symbols_cmds_CXX='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs_CXX" >&5 $as_echo "$ld_shlibs_CXX" >&6; } test no = "$ld_shlibs_CXX" && can_build_shared=no with_gnu_ld_CXX=$with_gnu_ld # # Do we need to explicitly link libc? # case "x$archive_cmds_need_lc_CXX" in x|xyes) # Assume -lc should be added archive_cmds_need_lc_CXX=yes if test yes,yes = "$GCC,$enable_shared"; then case $archive_cmds_CXX in *'~'*) # FIXME: we may have to deal with multi-command sequences. ;; '$CC '*) # Test whether the compiler implicitly links with -lc since on some # systems, -lgcc has to come before -lc. If gcc already passes -lc # to ld, don't add -lc before -lgcc. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5 $as_echo_n "checking whether -lc should be explicitly linked in... " >&6; } if ${lt_cv_archive_cmds_need_lc_CXX+:} false; then : $as_echo_n "(cached) " >&6 else $RM conftest* echo "$lt_simple_compile_test_code" > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } 2>conftest.err; then soname=conftest lib=conftest libobjs=conftest.$ac_objext deplibs= wl=$lt_prog_compiler_wl_CXX pic_flag=$lt_prog_compiler_pic_CXX compiler_flags=-v linker_flags=-v verstring= output_objdir=. libname=conftest lt_save_allow_undefined_flag=$allow_undefined_flag_CXX allow_undefined_flag_CXX= if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds_CXX 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5 (eval $archive_cmds_CXX 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then lt_cv_archive_cmds_need_lc_CXX=no else lt_cv_archive_cmds_need_lc_CXX=yes fi allow_undefined_flag_CXX=$lt_save_allow_undefined_flag else cat conftest.err 1>&5 fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc_CXX" >&5 $as_echo "$lt_cv_archive_cmds_need_lc_CXX" >&6; } archive_cmds_need_lc_CXX=$lt_cv_archive_cmds_need_lc_CXX ;; esac fi ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5 $as_echo_n "checking dynamic linker characteristics... " >&6; } library_names_spec= libname_spec='lib$name' soname_spec= shrext_cmds=.so postinstall_cmds= postuninstall_cmds= finish_cmds= finish_eval= shlibpath_var= shlibpath_overrides_runpath=unknown version_type=none dynamic_linker="$host_os ld.so" sys_lib_dlsearch_path_spec="/lib /usr/lib" need_lib_prefix=unknown hardcode_into_libs=no # when you set need_version to no, make sure it does not cause -set_version # flags to be left without arguments need_version=unknown case $host_os in aix3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname.a' shlibpath_var=LIBPATH # AIX 3 has no versioning support, so we append a major version to the name. soname_spec='$libname$release$shared_ext$major' ;; aix[4-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no hardcode_into_libs=yes if test ia64 = "$host_cpu"; then # AIX 5 supports IA64 library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH else # With GCC up to 2.95.x, collect2 would create an import file # for dependence libraries. The import file would start with # the line '#! .'. This would cause the generated library to # depend on '.', always an invalid library. This was fixed in # development snapshots of GCC prior to 3.0. case $host_os in aix4 | aix4.[01] | aix4.[01].*) if { echo '#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)' echo ' yes ' echo '#endif'; } | $CC -E - | $GREP yes > /dev/null; then : else can_build_shared=no fi ;; esac # Using Import Files as archive members, it is possible to support # filename-based versioning of shared library archives on AIX. While # this would work for both with and without runtime linking, it will # prevent static linking of such archives. So we do filename-based # shared library versioning with .so extension only, which is used # when both runtime linking and shared linking is enabled. # Unfortunately, runtime linking may impact performance, so we do # not want this to be the default eventually. Also, we use the # versioned .so libs for executables only if there is the -brtl # linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only. # To allow for filename-based versioning support, we need to create # libNAME.so.V as an archive file, containing: # *) an Import File, referring to the versioned filename of the # archive as well as the shared archive member, telling the # bitwidth (32 or 64) of that shared object, and providing the # list of exported symbols of that shared object, eventually # decorated with the 'weak' keyword # *) the shared object with the F_LOADONLY flag set, to really avoid # it being seen by the linker. # At run time we better use the real file rather than another symlink, # but for link time we create the symlink libNAME.so -> libNAME.so.V case $with_aix_soname,$aix_use_runtimelinking in # AIX (on Power*) has no versioning support, so currently we cannot hardcode correct # soname into executable. Probably we can add versioning support to # collect2, so additional links can be useful in future. aix,yes) # traditional libtool dynamic_linker='AIX unversionable lib.so' # If using run time linking (on AIX 4.2 or later) use lib.so # instead of lib.a to let people know that these are not # typical AIX shared libraries. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; aix,no) # traditional AIX only dynamic_linker='AIX lib.a(lib.so.V)' # We preserve .a as extension for shared libraries through AIX4.2 # and later when we are not doing run time linking. library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' ;; svr4,*) # full svr4 only dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,yes) # both, prefer svr4 dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o), lib.a(lib.so.V)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # unpreferred sharedlib libNAME.a needs extra handling postinstall_cmds='test -n "$linkname" || linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" || test -z "$striplib" || $striplib "$destdir/$func_stripname_result.$libext"' postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" || func_append rmfiles " $odir/$func_stripname_result.$libext"' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,no) # both, prefer aix dynamic_linker="AIX lib.a(lib.so.V), lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' # unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling postinstall_cmds='test -z "$dlname" || $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" || test -z "$striplib" || $striplib $destdir/$dlname~test -n "$linkname" || linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)' postuninstall_cmds='test -z "$dlname" || func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"' ;; esac shlibpath_var=LIBPATH fi ;; amigaos*) case $host_cpu in powerpc) # Since July 2007 AmigaOS4 officially supports .so libraries. # When compiling the executable, add -use-dynld -Lsobjs: to the compileline. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; m68k) library_names_spec='$libname.ixlibrary $libname.a' # Create ${libname}_ixlibrary.a entries in /sys/libs. finish_eval='for lib in `ls $libdir/*.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" | $SED '\''s%^.*/\([^/]*\)\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a || exit 1; done' ;; esac ;; beos*) library_names_spec='$libname$shared_ext' dynamic_linker="$host_os ld.so" shlibpath_var=LIBRARY_PATH ;; bsdi[45]*) version_type=linux # correct to gnu/linux during the next big refactor need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib" sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib" # the default ld.so.conf also contains /usr/contrib/lib and # /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow # libtool to hard-code these into programs ;; cygwin* | mingw* | pw32* | cegcc*) version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no case $GCC,$cc_basename in yes,*) # gcc library_names_spec='$libname.dll.a' # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes case $host_os in cygwin*) # Cygwin DLLs use 'cyg' prefix rather than 'lib' soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; mingw* | cegcc*) # MinGW DLLs use traditional 'lib' prefix soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; pw32*) # pw32 DLLs use 'pw' prefix rather than 'lib' library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; esac dynamic_linker='Win32 ld.exe' ;; *,cl*) # Native MSVC libname_spec='$name' soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' library_names_spec='$libname.dll.lib' case $build_os in mingw*) sys_lib_search_path_spec= lt_save_ifs=$IFS IFS=';' for lt_path in $LIB do IFS=$lt_save_ifs # Let DOS variable expansion print the short 8.3 style file name. lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"` sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path" done IFS=$lt_save_ifs # Convert to MSYS style. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'` ;; cygwin*) # Convert to unix form, then to dos form, then back to unix form # but this time dos style (no spaces!) so that the unix form looks # like /cygdrive/c/PROGRA~1:/cygdr... sys_lib_search_path_spec=`cygpath --path --unix "$LIB"` sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null` sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` ;; *) sys_lib_search_path_spec=$LIB if $ECHO "$sys_lib_search_path_spec" | $GREP ';[c-zC-Z]:/' >/dev/null; then # It is most probably a Windows format PATH. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's/;/ /g'` else sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` fi # FIXME: find the short name or the path components, as spaces are # common. (e.g. "Program Files" -> "PROGRA~1") ;; esac # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes dynamic_linker='Win32 link.exe' ;; *) # Assume MSVC wrapper library_names_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib' dynamic_linker='Win32 ld.exe' ;; esac # FIXME: first we should search . and the directory the executable is in shlibpath_var=PATH ;; darwin* | rhapsody*) dynamic_linker="$host_os dyld" version_type=darwin need_lib_prefix=no need_version=no library_names_spec='$libname$release$major$shared_ext $libname$shared_ext' soname_spec='$libname$release$major$shared_ext' shlibpath_overrides_runpath=yes shlibpath_var=DYLD_LIBRARY_PATH shrext_cmds='`test .$module = .yes && echo .so || echo .dylib`' sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib' ;; dgux*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; freebsd* | dragonfly*) # DragonFly does not have aout. When/if they implement a new # versioning mechanism, adjust this. if test -x /usr/bin/objformat; then objformat=`/usr/bin/objformat` else case $host_os in freebsd[23].*) objformat=aout ;; *) objformat=elf ;; esac fi version_type=freebsd-$objformat case $version_type in freebsd-elf*) library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' need_version=no need_lib_prefix=no ;; freebsd-*) library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' need_version=yes ;; esac shlibpath_var=LD_LIBRARY_PATH case $host_os in freebsd2.*) shlibpath_overrides_runpath=yes ;; freebsd3.[01]* | freebsdelf3.[01]*) shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; freebsd3.[2-9]* | freebsdelf3.[2-9]* | \ freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1) shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; *) # from 4.6 on, and DragonFly shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; esac ;; haiku*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no dynamic_linker="$host_os runtime_loader" library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LIBRARY_PATH shlibpath_overrides_runpath=no sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib' hardcode_into_libs=yes ;; hpux9* | hpux10* | hpux11*) # Give a soname corresponding to the major version so that dld.sl refuses to # link against other versions. version_type=sunos need_lib_prefix=no need_version=no case $host_cpu in ia64*) shrext_cmds='.so' hardcode_into_libs=yes dynamic_linker="$host_os dld.so" shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' if test 32 = "$HPUX_IA64_MODE"; then sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib" sys_lib_dlsearch_path_spec=/usr/lib/hpux32 else sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64" sys_lib_dlsearch_path_spec=/usr/lib/hpux64 fi ;; hppa*64*) shrext_cmds='.sl' hardcode_into_libs=yes dynamic_linker="$host_os dld.sl" shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; *) shrext_cmds='.sl' dynamic_linker="$host_os dld.sl" shlibpath_var=SHLIB_PATH shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' ;; esac # HP-UX runs *really* slowly unless shared libraries are mode 555, ... postinstall_cmds='chmod 555 $lib' # or fails outright, so override atomically: install_override_mode=555 ;; interix[3-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; irix5* | irix6* | nonstopux*) case $host_os in nonstopux*) version_type=nonstopux ;; *) if test yes = "$lt_cv_prog_gnu_ld"; then version_type=linux # correct to gnu/linux during the next big refactor else version_type=irix fi ;; esac need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext' case $host_os in irix5* | nonstopux*) libsuff= shlibsuff= ;; *) case $LD in # libtool.m4 will add one of these switches to LD *-32|*"-32 "|*-melf32bsmip|*"-melf32bsmip ") libsuff= shlibsuff= libmagic=32-bit;; *-n32|*"-n32 "|*-melf32bmipn32|*"-melf32bmipn32 ") libsuff=32 shlibsuff=N32 libmagic=N32;; *-64|*"-64 "|*-melf64bmip|*"-melf64bmip ") libsuff=64 shlibsuff=64 libmagic=64-bit;; *) libsuff= shlibsuff= libmagic=never-match;; esac ;; esac shlibpath_var=LD_LIBRARY${shlibsuff}_PATH shlibpath_overrides_runpath=no sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff" sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff" hardcode_into_libs=yes ;; # No shared lib support for Linux oldld, aout, or coff. linux*oldld* | linux*aout* | linux*coff*) dynamic_linker=no ;; linux*android*) version_type=none # Android doesn't support versioned libraries. need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext' soname_spec='$libname$release$shared_ext' finish_cmds= shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes dynamic_linker='Android linker' # Don't embed -rpath directories since the linker doesn't support them. hardcode_libdir_flag_spec_CXX='-L$libdir' ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no # Some binutils ld are patched to set DT_RUNPATH if ${lt_cv_shlibpath_overrides_runpath+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_shlibpath_overrides_runpath=no save_LDFLAGS=$LDFLAGS save_libdir=$libdir eval "libdir=/foo; wl=\"$lt_prog_compiler_wl_CXX\"; \ LDFLAGS=\"\$LDFLAGS $hardcode_libdir_flag_spec_CXX\"" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_cxx_try_link "$LINENO"; then : if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null; then : lt_cv_shlibpath_overrides_runpath=yes fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS libdir=$save_libdir fi shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes # Ideally, we could use ldconfig to report *all* directores which are # searched for libraries, however this is still not possible. Aside from not # being certain /sbin/ldconfig is available, command # 'ldconfig -N -X -v | grep ^/' on 64bit Fedora does not report /usr/lib64, # even though it is searched at run-time. Try to do the best guess by # appending ld.so.conf contents (and includes) to the search path. if test -f /etc/ld.so.conf; then lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" fi # We used to test for /lib/ld.so.1 and disable shared libraries on # powerpc, because MkLinux only supported shared libraries with the # GNU dynamic linker. Since this was broken with cross compilers, # most powerpc-linux boxes support dynamic linking these days and # people can always --disable-shared, the test was removed, and we # assume the GNU/Linux dynamic linker is in use. dynamic_linker='GNU/Linux ld.so' ;; netbsdelf*-gnu) version_type=linux need_lib_prefix=no need_version=no library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}' soname_spec='${libname}${release}${shared_ext}$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='NetBSD ld.elf_so' ;; netbsd*) version_type=sunos need_lib_prefix=no need_version=no if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' dynamic_linker='NetBSD (a.out) ld.so' else library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='NetBSD ld.elf_so' fi shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; newsos6) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; *nto* | *qnx*) version_type=qnx need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='ldqnx.so' ;; openbsd* | bitrig*) version_type=sunos sys_lib_dlsearch_path_spec=/usr/lib need_lib_prefix=no if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then need_version=no else need_version=yes fi library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; os2*) libname_spec='$name' version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no # OS/2 can only load a DLL with a base name of 8 characters or less. soname_spec='`test -n "$os2dllname" && libname="$os2dllname"; v=$($ECHO $release$versuffix | tr -d .-); n=$($ECHO $libname | cut -b -$((8 - ${#v})) | tr . _); $ECHO $n$v`$shared_ext' library_names_spec='${libname}_dll.$libext' dynamic_linker='OS/2 ld.exe' shlibpath_var=BEGINLIBPATH sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' ;; osf3* | osf4* | osf5*) version_type=osf need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; rdos*) dynamic_linker=no ;; solaris*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes # ldd complains unless libraries are executable postinstall_cmds='chmod +x $lib' ;; sunos4*) version_type=sunos library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes if test yes = "$with_gnu_ld"; then need_lib_prefix=no fi need_version=yes ;; sysv4 | sysv4.3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH case $host_vendor in sni) shlibpath_overrides_runpath=no need_lib_prefix=no runpath_var=LD_RUN_PATH ;; siemens) need_lib_prefix=no ;; motorola) need_lib_prefix=no need_version=no shlibpath_overrides_runpath=no sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib' ;; esac ;; sysv4*MP*) if test -d /usr/nec; then version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext' soname_spec='$libname$shared_ext.$major' shlibpath_var=LD_LIBRARY_PATH fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) version_type=sco need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes if test yes = "$with_gnu_ld"; then sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib' else sys_lib_search_path_spec='/usr/ccs/lib /usr/lib' case $host_os in sco3.2v5*) sys_lib_search_path_spec="$sys_lib_search_path_spec /lib" ;; esac fi sys_lib_dlsearch_path_spec='/usr/lib' ;; tpf*) # TPF is a cross-target only. Preferred cross-host = GNU/Linux. version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; uts4*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; *) dynamic_linker=no ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5 $as_echo "$dynamic_linker" >&6; } test no = "$dynamic_linker" && can_build_shared=no variables_saved_for_relink="PATH $shlibpath_var $runpath_var" if test yes = "$GCC"; then variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH" fi if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec fi if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec fi # remember unaugmented sys_lib_dlsearch_path content for libtool script decls... configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec # ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH" # to be used as default LT_SYS_LIBRARY_PATH value in generated libtool configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5 $as_echo_n "checking how to hardcode library paths into programs... " >&6; } hardcode_action_CXX= if test -n "$hardcode_libdir_flag_spec_CXX" || test -n "$runpath_var_CXX" || test yes = "$hardcode_automatic_CXX"; then # We can hardcode non-existent directories. if test no != "$hardcode_direct_CXX" && # If the only mechanism to avoid hardcoding is shlibpath_var, we # have to relink, otherwise we might link with an installed library # when we should be linking with a yet-to-be-installed one ## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, CXX)" && test no != "$hardcode_minus_L_CXX"; then # Linking always hardcodes the temporary library directory. hardcode_action_CXX=relink else # We can link without hardcoding, and we can hardcode nonexisting dirs. hardcode_action_CXX=immediate fi else # We cannot hardcode anything, or else we can only hardcode existing # directories. hardcode_action_CXX=unsupported fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action_CXX" >&5 $as_echo "$hardcode_action_CXX" >&6; } if test relink = "$hardcode_action_CXX" || test yes = "$inherit_rpath_CXX"; then # Fast installation is not supported enable_fast_install=no elif test yes = "$shlibpath_overrides_runpath" || test no = "$enable_shared"; then # Fast installation is not necessary enable_fast_install=needless fi fi # test -n "$compiler" CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS LDCXX=$LD LD=$lt_save_LD GCC=$lt_save_GCC with_gnu_ld=$lt_save_with_gnu_ld lt_cv_path_LDCXX=$lt_cv_path_LD lt_cv_path_LD=$lt_save_path_LD lt_cv_prog_gnu_ldcxx=$lt_cv_prog_gnu_ld lt_cv_prog_gnu_ld=$lt_save_with_gnu_ld fi # test yes != "$_lt_caught_CXX_error" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_config_commands="$ac_config_commands libtool" # Only expand once: { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether build environment is sane" >&5 $as_echo_n "checking whether build environment is sane... " >&6; } # Reject unsafe characters in $srcdir or the absolute working directory # name. Accept space and tab only in the latter. am_lf=' ' case `pwd` in *[\\\"\#\$\&\'\`$am_lf]*) as_fn_error $? "unsafe absolute working directory name" "$LINENO" 5;; esac case $srcdir in *[\\\"\#\$\&\'\`$am_lf\ \ ]*) as_fn_error $? "unsafe srcdir value: '$srcdir'" "$LINENO" 5;; esac # Do 'set' in a subshell so we don't clobber the current shell's # arguments. Must try -L first in case configure is actually a # symlink; some systems play weird games with the mod time of symlinks # (eg FreeBSD returns the mod time of the symlink's containing # directory). if ( am_has_slept=no for am_try in 1 2; do echo "timestamp, slept: $am_has_slept" > conftest.file set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null` if test "$*" = "X"; then # -L didn't work. set X `ls -t "$srcdir/configure" conftest.file` fi if test "$*" != "X $srcdir/configure conftest.file" \ && test "$*" != "X conftest.file $srcdir/configure"; then # If neither matched, then we have a broken ls. This can happen # if, for instance, CONFIG_SHELL is bash and it inherits a # broken ls alias from the environment. This has actually # happened. Such a system could not be considered "sane". as_fn_error $? "ls -t appears to fail. Make sure there is not a broken alias in your environment" "$LINENO" 5 fi if test "$2" = conftest.file || test $am_try -eq 2; then break fi # Just in case. sleep 1 am_has_slept=yes done test "$2" = conftest.file ) then # Ok. : else as_fn_error $? "newly created file is older than distributed files! Check your system clock" "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } # If we didn't sleep, we still need to ensure time stamps of config.status and # generated files are strictly newer. am_sleep_pid= if grep 'slept: no' conftest.file >/dev/null 2>&1; then ( sleep 1 ) & am_sleep_pid=$! fi rm -f conftest.file # Checks for library functions #AC_CHECK_FUNCS([strlcpy strlcat]) OCFLAGS=$CFLAGS CFLAGS="" for ac_func in strlcpy strlcat do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done CFLAGS=$OCFLAGS ac_fn_c_check_header_mongrel "$LINENO" "zlib.h" "ac_cv_header_zlib_h" "$ac_includes_default" if test "x$ac_cv_header_zlib_h" = xyes; then : else as_fn_error $? "zlib.h not found ..." "$LINENO" 5 fi ZLIB="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for inflate in -lz" >&5 $as_echo_n "checking for inflate in -lz... " >&6; } if ${ac_cv_lib_z_inflate+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lz $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char inflate (); int main () { return inflate (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_z_inflate=yes else ac_cv_lib_z_inflate=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_z_inflate" >&5 $as_echo "$ac_cv_lib_z_inflate" >&6; } if test "x$ac_cv_lib_z_inflate" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBZ 1 _ACEOF LIBS="-lz $LIBS" else ZLIB="no" fi if test "$ZLIB" = "no"; then echo echo " ERROR! zlib library not found" echo exit 1 fi # Determine the OS { $as_echo "$as_me:${as_lineno-$LINENO}: checking OS" >&5 $as_echo_n "checking OS... " >&6; } OS=`uname -s` case "$OS" in CYGWIN*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: Cygwin" >&5 $as_echo "Cygwin" >&6; } OS_CYGWIN="true" NO_STACK_PROTECTOR="true" ;; FreeBSD*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: FreeBSD" >&5 $as_echo "FreeBSD" >&6; } OS_FREEBSD="true" CPPFLAGS="${CPPFLAGS} -I/usr/local/include" LDFLAGS="${LDFLAGS} -L/usr/local/lib" ;; OpenBSD*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: OpenBSD" >&5 $as_echo "OpenBSD" >&6; } OS_OPENBSD="true" CPPFLAGS="${CPPFLAGS} -I/usr/local/include" LDFLAGS="${LDFLAGS} -L/usr/local/lib" ;; Linux*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: Linux" >&5 $as_echo "Linux" >&6; } OS_LINUX="true" ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } ;; esac #We need to call the iconv macro after OS detection for FreeBSD to work properly # iconv.m4 serial 11 (gettext-0.18.1) # lib-ld.m4 serial 4 (gettext-0.18) # lib-link.m4 serial 21 (gettext-0.18) # lib-prefix.m4 serial 7 (gettext-0.18) if test "X$prefix" = "XNONE"; then acl_final_prefix="$ac_default_prefix" else acl_final_prefix="$prefix" fi if test "X$exec_prefix" = "XNONE"; then acl_final_exec_prefix='${prefix}' else acl_final_exec_prefix="$exec_prefix" fi acl_save_prefix="$prefix" prefix="$acl_final_prefix" eval acl_final_exec_prefix=\"$acl_final_exec_prefix\" prefix="$acl_save_prefix" # Check whether --with-gnu-ld was given. if test "${with_gnu_ld+set}" = set; then : withval=$with_gnu_ld; test "$withval" = no || with_gnu_ld=yes else with_gnu_ld=no fi # Prepare PATH_SEPARATOR. # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then echo "#! /bin/sh" >conf$$.sh echo "exit 0" >>conf$$.sh chmod +x conf$$.sh if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then PATH_SEPARATOR=';' else PATH_SEPARATOR=: fi rm -f conf$$.sh fi ac_prog=ld if test "$GCC" = yes; then # Check if gcc -print-prog-name=ld gives a path. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by GCC" >&5 $as_echo_n "checking for ld used by GCC... " >&6; } case $host in *-*-mingw*) # gcc leaves a trailing carriage return which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [\\/]* | [A-Za-z]:[\\/]*) re_direlt='/[^/][^/]*/\.\./' # Canonicalize the path of ld ac_prog=`echo $ac_prog| sed 's%\\\\%/%g'` while echo $ac_prog | grep "$re_direlt" > /dev/null 2>&1; do ac_prog=`echo $ac_prog| sed "s%$re_direlt%/%"` done test -z "$LD" && LD="$ac_prog" ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test "$with_gnu_ld" = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5 $as_echo_n "checking for GNU ld... " >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5 $as_echo_n "checking for non-GNU ld... " >&6; } fi if ${acl_cv_path_LD+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$LD"; then IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}${PATH_SEPARATOR-:}" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then acl_cv_path_LD="$ac_dir/$ac_prog" # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some GNU ld's only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$acl_cv_path_LD" -v 2>&1 < /dev/null` in *GNU* | *'with BFD'*) test "$with_gnu_ld" != no && break ;; *) test "$with_gnu_ld" != yes && break ;; esac fi done IFS="$ac_save_ifs" else acl_cv_path_LD="$LD" # Let the user override the test with a path. fi fi LD="$acl_cv_path_LD" if test -n "$LD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LD" >&5 $as_echo "$LD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5 $as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; } if ${acl_cv_prog_gnu_ld+:} false; then : $as_echo_n "(cached) " >&6 else # I'd rather use --version here, but apparently some GNU ld's only accept -v. case `$LD -v 2>&1 &5 $as_echo "$acl_cv_prog_gnu_ld" >&6; } with_gnu_ld=$acl_cv_prog_gnu_ld { $as_echo "$as_me:${as_lineno-$LINENO}: checking for shared library run path origin" >&5 $as_echo_n "checking for shared library run path origin... " >&6; } if ${acl_cv_rpath+:} false; then : $as_echo_n "(cached) " >&6 else CC="$CC" GCC="$GCC" LDFLAGS="$LDFLAGS" LD="$LD" with_gnu_ld="$with_gnu_ld" \ ${CONFIG_SHELL-/bin/sh} "$ac_aux_dir/config.rpath" "$host" > conftest.sh . ./conftest.sh rm -f ./conftest.sh acl_cv_rpath=done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $acl_cv_rpath" >&5 $as_echo "$acl_cv_rpath" >&6; } wl="$acl_cv_wl" acl_libext="$acl_cv_libext" acl_shlibext="$acl_cv_shlibext" acl_libname_spec="$acl_cv_libname_spec" acl_library_names_spec="$acl_cv_library_names_spec" acl_hardcode_libdir_flag_spec="$acl_cv_hardcode_libdir_flag_spec" acl_hardcode_libdir_separator="$acl_cv_hardcode_libdir_separator" acl_hardcode_direct="$acl_cv_hardcode_direct" acl_hardcode_minus_L="$acl_cv_hardcode_minus_L" # Check whether --enable-rpath was given. if test "${enable_rpath+set}" = set; then : enableval=$enable_rpath; : else enable_rpath=yes fi acl_libdirstem=lib acl_libdirstem2= case "$host_os" in solaris*) { $as_echo "$as_me:${as_lineno-$LINENO}: checking for 64-bit host" >&5 $as_echo_n "checking for 64-bit host... " >&6; } if ${gl_cv_solaris_64bit+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef _LP64 sixtyfour bits #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "sixtyfour bits" >/dev/null 2>&1; then : gl_cv_solaris_64bit=yes else gl_cv_solaris_64bit=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gl_cv_solaris_64bit" >&5 $as_echo "$gl_cv_solaris_64bit" >&6; } if test $gl_cv_solaris_64bit = yes; then acl_libdirstem=lib/64 case "$host_cpu" in sparc*) acl_libdirstem2=lib/sparcv9 ;; i*86 | x86_64) acl_libdirstem2=lib/amd64 ;; esac fi ;; *) searchpath=`(LC_ALL=C $CC -print-search-dirs) 2>/dev/null | sed -n -e 's,^libraries: ,,p' | sed -e 's,^=,,'` if test -n "$searchpath"; then acl_save_IFS="${IFS= }"; IFS=":" for searchdir in $searchpath; do if test -d "$searchdir"; then case "$searchdir" in */lib64/ | */lib64 ) acl_libdirstem=lib64 ;; */../ | */.. ) # Better ignore directories of this form. They are misleading. ;; *) searchdir=`cd "$searchdir" && pwd` case "$searchdir" in */lib64 ) acl_libdirstem=lib64 ;; esac ;; esac fi done IFS="$acl_save_IFS" fi ;; esac test -n "$acl_libdirstem2" || acl_libdirstem2="$acl_libdirstem" use_additional=yes acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" # Check whether --with-libiconv-prefix was given. if test "${with_libiconv_prefix+set}" = set; then : withval=$with_libiconv_prefix; if test "X$withval" = "Xno"; then use_additional=no else if test "X$withval" = "X"; then acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval additional_includedir=\"$includedir\" eval additional_libdir=\"$libdir\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" else additional_includedir="$withval/include" additional_libdir="$withval/$acl_libdirstem" if test "$acl_libdirstem2" != "$acl_libdirstem" \ && ! test -d "$withval/$acl_libdirstem"; then additional_libdir="$withval/$acl_libdirstem2" fi fi fi fi LIBICONV= LTLIBICONV= INCICONV= LIBICONV_PREFIX= HAVE_LIBICONV= rpathdirs= ltrpathdirs= names_already_handled= names_next_round='iconv ' while test -n "$names_next_round"; do names_this_round="$names_next_round" names_next_round= for name in $names_this_round; do already_handled= for n in $names_already_handled; do if test "$n" = "$name"; then already_handled=yes break fi done if test -z "$already_handled"; then names_already_handled="$names_already_handled $name" uppername=`echo "$name" | sed -e 'y|abcdefghijklmnopqrstuvwxyz./-|ABCDEFGHIJKLMNOPQRSTUVWXYZ___|'` eval value=\"\$HAVE_LIB$uppername\" if test -n "$value"; then if test "$value" = yes; then eval value=\"\$LIB$uppername\" test -z "$value" || LIBICONV="${LIBICONV}${LIBICONV:+ }$value" eval value=\"\$LTLIB$uppername\" test -z "$value" || LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }$value" else : fi else found_dir= found_la= found_so= found_a= eval libname=\"$acl_libname_spec\" # typically: libname=lib$name if test -n "$acl_shlibext"; then shrext=".$acl_shlibext" # typically: shrext=.so else shrext= fi if test $use_additional = yes; then dir="$additional_libdir" if test -n "$acl_shlibext"; then if test -f "$dir/$libname$shrext"; then found_dir="$dir" found_so="$dir/$libname$shrext" else if test "$acl_library_names_spec" = '$libname$shrext$versuffix'; then ver=`(cd "$dir" && \ for f in "$libname$shrext".*; do echo "$f"; done \ | sed -e "s,^$libname$shrext\\\\.,," \ | sort -t '.' -n -r -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 \ | sed 1q ) 2>/dev/null` if test -n "$ver" && test -f "$dir/$libname$shrext.$ver"; then found_dir="$dir" found_so="$dir/$libname$shrext.$ver" fi else eval library_names=\"$acl_library_names_spec\" for f in $library_names; do if test -f "$dir/$f"; then found_dir="$dir" found_so="$dir/$f" break fi done fi fi fi if test "X$found_dir" = "X"; then if test -f "$dir/$libname.$acl_libext"; then found_dir="$dir" found_a="$dir/$libname.$acl_libext" fi fi if test "X$found_dir" != "X"; then if test -f "$dir/$libname.la"; then found_la="$dir/$libname.la" fi fi fi if test "X$found_dir" = "X"; then for x in $LDFLAGS $LTLIBICONV; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" case "$x" in -L*) dir=`echo "X$x" | sed -e 's/^X-L//'` if test -n "$acl_shlibext"; then if test -f "$dir/$libname$shrext"; then found_dir="$dir" found_so="$dir/$libname$shrext" else if test "$acl_library_names_spec" = '$libname$shrext$versuffix'; then ver=`(cd "$dir" && \ for f in "$libname$shrext".*; do echo "$f"; done \ | sed -e "s,^$libname$shrext\\\\.,," \ | sort -t '.' -n -r -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 \ | sed 1q ) 2>/dev/null` if test -n "$ver" && test -f "$dir/$libname$shrext.$ver"; then found_dir="$dir" found_so="$dir/$libname$shrext.$ver" fi else eval library_names=\"$acl_library_names_spec\" for f in $library_names; do if test -f "$dir/$f"; then found_dir="$dir" found_so="$dir/$f" break fi done fi fi fi if test "X$found_dir" = "X"; then if test -f "$dir/$libname.$acl_libext"; then found_dir="$dir" found_a="$dir/$libname.$acl_libext" fi fi if test "X$found_dir" != "X"; then if test -f "$dir/$libname.la"; then found_la="$dir/$libname.la" fi fi ;; esac if test "X$found_dir" != "X"; then break fi done fi if test "X$found_dir" != "X"; then LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }-L$found_dir -l$name" if test "X$found_so" != "X"; then if test "$enable_rpath" = no \ || test "X$found_dir" = "X/usr/$acl_libdirstem" \ || test "X$found_dir" = "X/usr/$acl_libdirstem2"; then LIBICONV="${LIBICONV}${LIBICONV:+ }$found_so" else haveit= for x in $ltrpathdirs; do if test "X$x" = "X$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then ltrpathdirs="$ltrpathdirs $found_dir" fi if test "$acl_hardcode_direct" = yes; then LIBICONV="${LIBICONV}${LIBICONV:+ }$found_so" else if test -n "$acl_hardcode_libdir_flag_spec" && test "$acl_hardcode_minus_L" = no; then LIBICONV="${LIBICONV}${LIBICONV:+ }$found_so" haveit= for x in $rpathdirs; do if test "X$x" = "X$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then rpathdirs="$rpathdirs $found_dir" fi else haveit= for x in $LDFLAGS $LIBICONV; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" if test "X$x" = "X-L$found_dir"; then haveit=yes break fi done if test -z "$haveit"; then LIBICONV="${LIBICONV}${LIBICONV:+ }-L$found_dir" fi if test "$acl_hardcode_minus_L" != no; then LIBICONV="${LIBICONV}${LIBICONV:+ }$found_so" else LIBICONV="${LIBICONV}${LIBICONV:+ }-l$name" fi fi fi fi else if test "X$found_a" != "X"; then LIBICONV="${LIBICONV}${LIBICONV:+ }$found_a" else LIBICONV="${LIBICONV}${LIBICONV:+ }-L$found_dir -l$name" fi fi additional_includedir= case "$found_dir" in */$acl_libdirstem | */$acl_libdirstem/) basedir=`echo "X$found_dir" | sed -e 's,^X,,' -e "s,/$acl_libdirstem/"'*$,,'` if test "$name" = 'iconv'; then LIBICONV_PREFIX="$basedir" fi additional_includedir="$basedir/include" ;; */$acl_libdirstem2 | */$acl_libdirstem2/) basedir=`echo "X$found_dir" | sed -e 's,^X,,' -e "s,/$acl_libdirstem2/"'*$,,'` if test "$name" = 'iconv'; then LIBICONV_PREFIX="$basedir" fi additional_includedir="$basedir/include" ;; esac if test "X$additional_includedir" != "X"; then if test "X$additional_includedir" != "X/usr/include"; then haveit= if test "X$additional_includedir" = "X/usr/local/include"; then if test -n "$GCC"; then case $host_os in linux* | gnu* | k*bsd*-gnu) haveit=yes;; esac fi fi if test -z "$haveit"; then for x in $CPPFLAGS $INCICONV; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" if test "X$x" = "X-I$additional_includedir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_includedir"; then INCICONV="${INCICONV}${INCICONV:+ }-I$additional_includedir" fi fi fi fi fi if test -n "$found_la"; then save_libdir="$libdir" case "$found_la" in */* | *\\*) . "$found_la" ;; *) . "./$found_la" ;; esac libdir="$save_libdir" for dep in $dependency_libs; do case "$dep" in -L*) additional_libdir=`echo "X$dep" | sed -e 's/^X-L//'` if test "X$additional_libdir" != "X/usr/$acl_libdirstem" \ && test "X$additional_libdir" != "X/usr/$acl_libdirstem2"; then haveit= if test "X$additional_libdir" = "X/usr/local/$acl_libdirstem" \ || test "X$additional_libdir" = "X/usr/local/$acl_libdirstem2"; then if test -n "$GCC"; then case $host_os in linux* | gnu* | k*bsd*-gnu) haveit=yes;; esac fi fi if test -z "$haveit"; then haveit= for x in $LDFLAGS $LIBICONV; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" if test "X$x" = "X-L$additional_libdir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_libdir"; then LIBICONV="${LIBICONV}${LIBICONV:+ }-L$additional_libdir" fi fi haveit= for x in $LDFLAGS $LTLIBICONV; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" if test "X$x" = "X-L$additional_libdir"; then haveit=yes break fi done if test -z "$haveit"; then if test -d "$additional_libdir"; then LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }-L$additional_libdir" fi fi fi fi ;; -R*) dir=`echo "X$dep" | sed -e 's/^X-R//'` if test "$enable_rpath" != no; then haveit= for x in $rpathdirs; do if test "X$x" = "X$dir"; then haveit=yes break fi done if test -z "$haveit"; then rpathdirs="$rpathdirs $dir" fi haveit= for x in $ltrpathdirs; do if test "X$x" = "X$dir"; then haveit=yes break fi done if test -z "$haveit"; then ltrpathdirs="$ltrpathdirs $dir" fi fi ;; -l*) names_next_round="$names_next_round "`echo "X$dep" | sed -e 's/^X-l//'` ;; *.la) names_next_round="$names_next_round "`echo "X$dep" | sed -e 's,^X.*/,,' -e 's,^lib,,' -e 's,\.la$,,'` ;; *) LIBICONV="${LIBICONV}${LIBICONV:+ }$dep" LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }$dep" ;; esac done fi else LIBICONV="${LIBICONV}${LIBICONV:+ }-l$name" LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }-l$name" fi fi fi done done if test "X$rpathdirs" != "X"; then if test -n "$acl_hardcode_libdir_separator"; then alldirs= for found_dir in $rpathdirs; do alldirs="${alldirs}${alldirs:+$acl_hardcode_libdir_separator}$found_dir" done acl_save_libdir="$libdir" libdir="$alldirs" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" LIBICONV="${LIBICONV}${LIBICONV:+ }$flag" else for found_dir in $rpathdirs; do acl_save_libdir="$libdir" libdir="$found_dir" eval flag=\"$acl_hardcode_libdir_flag_spec\" libdir="$acl_save_libdir" LIBICONV="${LIBICONV}${LIBICONV:+ }$flag" done fi fi if test "X$ltrpathdirs" != "X"; then for found_dir in $ltrpathdirs; do LTLIBICONV="${LTLIBICONV}${LTLIBICONV:+ }-R$found_dir" done fi am_save_CPPFLAGS="$CPPFLAGS" for element in $INCICONV; do haveit= for x in $CPPFLAGS; do acl_save_prefix="$prefix" prefix="$acl_final_prefix" acl_save_exec_prefix="$exec_prefix" exec_prefix="$acl_final_exec_prefix" eval x=\"$x\" exec_prefix="$acl_save_exec_prefix" prefix="$acl_save_prefix" if test "X$x" = "X$element"; then haveit=yes break fi done if test -z "$haveit"; then CPPFLAGS="${CPPFLAGS}${CPPFLAGS:+ }$element" fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for iconv" >&5 $as_echo_n "checking for iconv... " >&6; } if ${am_cv_func_iconv+:} false; then : $as_echo_n "(cached) " >&6 else am_cv_func_iconv="no, consider installing GNU libiconv" am_cv_lib_iconv=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : am_cv_func_iconv=yes fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test "$am_cv_func_iconv" != yes; then am_save_LIBS="$LIBS" LIBS="$LIBS $LIBICONV" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : am_cv_lib_iconv=yes am_cv_func_iconv=yes fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS="$am_save_LIBS" fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_func_iconv" >&5 $as_echo "$am_cv_func_iconv" >&6; } if test "$am_cv_func_iconv" = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working iconv" >&5 $as_echo_n "checking for working iconv... " >&6; } if ${am_cv_func_iconv_works+:} false; then : $as_echo_n "(cached) " >&6 else am_save_LIBS="$LIBS" if test $am_cv_lib_iconv = yes; then LIBS="$LIBS $LIBICONV" fi if test "$cross_compiling" = yes; then : case "$host_os" in aix* | hpux*) am_cv_func_iconv_works="guessing no" ;; *) am_cv_func_iconv_works="guessing yes" ;; esac else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { /* Test against AIX 5.1 bug: Failures are not distinguishable from successful returns. */ { iconv_t cd_utf8_to_88591 = iconv_open ("ISO8859-1", "UTF-8"); if (cd_utf8_to_88591 != (iconv_t)(-1)) { static const char input[] = "\342\202\254"; /* EURO SIGN */ char buf[10]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_utf8_to_88591, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if (res == 0) return 1; } } /* Test against Solaris 10 bug: Failures are not distinguishable from successful returns. */ { iconv_t cd_ascii_to_88591 = iconv_open ("ISO8859-1", "646"); if (cd_ascii_to_88591 != (iconv_t)(-1)) { static const char input[] = "\263"; char buf[10]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_ascii_to_88591, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if (res == 0) return 1; } } #if 0 /* This bug could be worked around by the caller. */ /* Test against HP-UX 11.11 bug: Positive return value instead of 0. */ { iconv_t cd_88591_to_utf8 = iconv_open ("utf8", "iso88591"); if (cd_88591_to_utf8 != (iconv_t)(-1)) { static const char input[] = "\304rger mit b\366sen B\374bchen ohne Augenma\337"; char buf[50]; const char *inptr = input; size_t inbytesleft = strlen (input); char *outptr = buf; size_t outbytesleft = sizeof (buf); size_t res = iconv (cd_88591_to_utf8, (char **) &inptr, &inbytesleft, &outptr, &outbytesleft); if ((int)res > 0) return 1; } } #endif /* Test against HP-UX 11.11 bug: No converter from EUC-JP to UTF-8 is provided. */ if (/* Try standardized names. */ iconv_open ("UTF-8", "EUC-JP") == (iconv_t)(-1) /* Try IRIX, OSF/1 names. */ && iconv_open ("UTF-8", "eucJP") == (iconv_t)(-1) /* Try AIX names. */ && iconv_open ("UTF-8", "IBM-eucJP") == (iconv_t)(-1) /* Try HP-UX names. */ && iconv_open ("utf8", "eucJP") == (iconv_t)(-1)) return 1; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : am_cv_func_iconv_works=yes else am_cv_func_iconv_works=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi LIBS="$am_save_LIBS" fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_func_iconv_works" >&5 $as_echo "$am_cv_func_iconv_works" >&6; } case "$am_cv_func_iconv_works" in *no) am_func_iconv=no am_cv_lib_iconv=no ;; *) am_func_iconv=yes ;; esac else am_func_iconv=no am_cv_lib_iconv=no fi if test "$am_func_iconv" = yes; then $as_echo "#define HAVE_ICONV 1" >>confdefs.h fi if test "$am_cv_lib_iconv" = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to link with libiconv" >&5 $as_echo_n "checking how to link with libiconv... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIBICONV" >&5 $as_echo "$LIBICONV" >&6; } else CPPFLAGS="$am_save_CPPFLAGS" LIBICONV= LTLIBICONV= fi if test "$am_cv_func_iconv" = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for iconv declaration" >&5 $as_echo_n "checking for iconv declaration... " >&6; } if ${am_cv_proto_iconv+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include extern #ifdef __cplusplus "C" #endif #if defined(__STDC__) || defined(__cplusplus) size_t iconv (iconv_t cd, char * *inbuf, size_t *inbytesleft, char * *outbuf, size_t *outbytesleft); #else size_t iconv(); #endif int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : am_cv_proto_iconv_arg1="" else am_cv_proto_iconv_arg1="const" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext am_cv_proto_iconv="extern size_t iconv (iconv_t cd, $am_cv_proto_iconv_arg1 char * *inbuf, size_t *inbytesleft, char * *outbuf, size_t *outbytesleft);" fi am_cv_proto_iconv=`echo "$am_cv_proto_iconv" | tr -s ' ' | sed -e 's/( /(/'` { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_proto_iconv" >&5 $as_echo " $am_cv_proto_iconv" >&6; } cat >>confdefs.h <<_ACEOF #define ICONV_CONST $am_cv_proto_iconv_arg1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc support of -Wstrict-overflow=1" >&5 $as_echo_n "checking for gcc support of -Wstrict-overflow=1... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wstrict-overflow=1" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : gcc_have_strict_overflow=yes else gcc_have_strict_overflow=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gcc_have_strict_overflow" >&5 $as_echo "$gcc_have_strict_overflow" >&6; } if test "$gcc_have_strict_overflow" != "yes"; then CFLAGS="${TMPCFLAGS}" fi if test "$NO_STACK_PROTECTOR" != "true"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc support of stack smashing protection" >&5 $as_echo_n "checking for gcc support of stack smashing protection... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fstack-protector" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : gcc_have_fstack_protector=yes else gcc_have_fstack_protector=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gcc_have_fstack_protector" >&5 $as_echo "$gcc_have_fstack_protector" >&6; } if test "$gcc_have_fstack_protector" != "yes"; then CFLAGS="${TMPCFLAGS}" fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc support of FORTIFY_SOURCE" >&5 $as_echo_n "checking for gcc support of FORTIFY_SOURCE... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : gcc_have_fortify_source=yes else gcc_have_fortify_source=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gcc_have_fortify_source" >&5 $as_echo "$gcc_have_fortify_source" >&6; } if test "$gcc_have_fortify_source" != "yes"; then CFLAGS="${TMPCFLAGS}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc support of -Wformat -Wformat-security" >&5 $as_echo_n "checking for gcc support of -Wformat -Wformat-security... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wformat -Wformat-security" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : gcc_have_format_security=yes else gcc_have_format_security=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gcc_have_format_security" >&5 $as_echo "$gcc_have_format_security" >&6; } if test "$gcc_have_format_security" != "yes"; then CFLAGS="${TMPCFLAGS}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gcc support of -fPIC" >&5 $as_echo_n "checking for gcc support of -fPIC... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fPIC" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : gcc_have_fpic=yes else gcc_have_fpic=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gcc_have_fpic" >&5 $as_echo "$gcc_have_fpic" >&6; } if test "$gcc_have_fpic" != "yes"; then CFLAGS="${TMPCFLAGS}" fi # Check whether --with-doxygen was given. if test "${with_doxygen+set}" = set; then : withval=$with_doxygen; doxygen="$withval" else doxygen=no fi if test "$doxygen" != "no"; then { $as_echo "$as_me:${as_lineno-$LINENO}: Using doxygen: $doxygen" >&5 $as_echo "$as_me: Using doxygen: $doxygen" >&6;} else for ac_prog in doxygen do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_doxygen+:} false; then : $as_echo_n "(cached) " >&6 else case $doxygen in [\\/]* | ?:[\\/]*) ac_cv_path_doxygen="$doxygen" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_doxygen="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi doxygen=$ac_cv_path_doxygen if test -n "$doxygen"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $doxygen" >&5 $as_echo "$doxygen" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$doxygen" && break done fi DOXYGEN=$doxygen # Extract the first word of "lcov", so it can be a program name with args. set dummy lcov; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_LCOV+:} false; then : $as_echo_n "(cached) " >&6 else case $LCOV in [\\/]* | ?:[\\/]*) ac_cv_path_LCOV="$LCOV" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_LCOV="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_LCOV" && ac_cv_path_LCOV="no" ;; esac fi LCOV=$ac_cv_path_LCOV if test -n "$LCOV"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LCOV" >&5 $as_echo "$LCOV" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi ac_config_files="$ac_config_files Makefile htp.pc htp/Makefile test/Makefile docs/Makefile" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes: double-quote # substitution turns \\\\ into \\, and sed turns \\ into \. sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then if test "x$cache_file" != "x/dev/null"; then { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 $as_echo "$as_me: updating cache $cache_file" >&6;} if test ! -f "$cache_file" || test -h "$cache_file"; then cat confcache >"$cache_file" else case $cache_file in #( */* | ?:*) mv -f confcache "$cache_file"$$ && mv -f "$cache_file"$$ "$cache_file" ;; #( *) mv -f confcache "$cache_file" ;; esac fi fi else { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 $as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' DEFS=-DHAVE_CONFIG_H ac_libobjs= ac_ltlibobjs= U= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`$as_echo "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs { $as_echo "$as_me:${as_lineno-$LINENO}: checking that generated files are newer than configure" >&5 $as_echo_n "checking that generated files are newer than configure... " >&6; } if test -n "$am_sleep_pid"; then # Hide warnings about reused PIDs. wait $am_sleep_pid 2>/dev/null fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: done" >&5 $as_echo "done" >&6; } if test -n "$EXEEXT"; then am__EXEEXT_TRUE= am__EXEEXT_FALSE='#' else am__EXEEXT_TRUE='#' am__EXEEXT_FALSE= fi if test -z "${AMDEP_TRUE}" && test -z "${AMDEP_FALSE}"; then as_fn_error $? "conditional \"AMDEP\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${am__fastdepCC_TRUE}" && test -z "${am__fastdepCC_FALSE}"; then as_fn_error $? "conditional \"am__fastdepCC\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${am__fastdepCXX_TRUE}" && test -z "${am__fastdepCXX_FALSE}"; then as_fn_error $? "conditional \"am__fastdepCXX\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking that generated files are newer than configure" >&5 $as_echo_n "checking that generated files are newer than configure... " >&6; } if test -n "$am_sleep_pid"; then # Hide warnings about reused PIDs. wait $am_sleep_pid 2>/dev/null fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: done" >&5 $as_echo "done" >&6; } : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 $as_echo "$as_me: creating $CONFIG_STATUS" >&6;} as_write_fail=0 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 ## ----------------------------------- ## ## Main body of $CONFIG_STATUS script. ## ## ----------------------------------- ## _ASEOF test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Save the log message, to keep $0 and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by LibHTP $as_me 0.5.23, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac case $ac_config_headers in *" "*) set x $ac_config_headers; shift; ac_config_headers=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" config_headers="$ac_config_headers" config_commands="$ac_config_commands" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files and other configuration actions from templates according to the current configuration. Unless the files and actions are specified as TAGs, all are instantiated by default. Usage: $0 [OPTION]... [TAG]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit --config print configuration, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE --header=FILE[:TEMPLATE] instantiate the configuration header FILE Configuration files: $config_files Configuration headers: $config_headers Configuration commands: $config_commands Report bugs to the package provider." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ LibHTP config.status 0.5.23 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" Copyright (C) 2012 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' INSTALL='$INSTALL' MKDIR_P='$MKDIR_P' AWK='$AWK' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=?*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; --*=) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg= ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) $as_echo "$ac_cs_version"; exit ;; --config | --confi | --conf | --con | --co | --c ) $as_echo "$ac_cs_config"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; '') as_fn_error $? "missing file argument" ;; esac as_fn_append CONFIG_FILES " '$ac_optarg'" ac_need_defaults=false;; --header | --heade | --head | --hea ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append CONFIG_HEADERS " '$ac_optarg'" ac_need_defaults=false;; --he | --h) # Conflict between --help and --header as_fn_error $? "ambiguous option: \`$1' Try \`$0 --help' for more information.";; --help | --hel | -h ) $as_echo "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) as_fn_error $? "unrecognized option: \`$1' Try \`$0 --help' for more information." ;; *) as_fn_append ac_config_targets " $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX $as_echo "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # # INIT-COMMANDS # AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir" # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH sed_quote_subst='$sed_quote_subst' double_quote_subst='$double_quote_subst' delay_variable_subst='$delay_variable_subst' macro_version='`$ECHO "$macro_version" | $SED "$delay_single_quote_subst"`' macro_revision='`$ECHO "$macro_revision" | $SED "$delay_single_quote_subst"`' enable_shared='`$ECHO "$enable_shared" | $SED "$delay_single_quote_subst"`' enable_static='`$ECHO "$enable_static" | $SED "$delay_single_quote_subst"`' pic_mode='`$ECHO "$pic_mode" | $SED "$delay_single_quote_subst"`' enable_fast_install='`$ECHO "$enable_fast_install" | $SED "$delay_single_quote_subst"`' shared_archive_member_spec='`$ECHO "$shared_archive_member_spec" | $SED "$delay_single_quote_subst"`' SHELL='`$ECHO "$SHELL" | $SED "$delay_single_quote_subst"`' ECHO='`$ECHO "$ECHO" | $SED "$delay_single_quote_subst"`' PATH_SEPARATOR='`$ECHO "$PATH_SEPARATOR" | $SED "$delay_single_quote_subst"`' host_alias='`$ECHO "$host_alias" | $SED "$delay_single_quote_subst"`' host='`$ECHO "$host" | $SED "$delay_single_quote_subst"`' host_os='`$ECHO "$host_os" | $SED "$delay_single_quote_subst"`' build_alias='`$ECHO "$build_alias" | $SED "$delay_single_quote_subst"`' build='`$ECHO "$build" | $SED "$delay_single_quote_subst"`' build_os='`$ECHO "$build_os" | $SED "$delay_single_quote_subst"`' SED='`$ECHO "$SED" | $SED "$delay_single_quote_subst"`' Xsed='`$ECHO "$Xsed" | $SED "$delay_single_quote_subst"`' GREP='`$ECHO "$GREP" | $SED "$delay_single_quote_subst"`' EGREP='`$ECHO "$EGREP" | $SED "$delay_single_quote_subst"`' FGREP='`$ECHO "$FGREP" | $SED "$delay_single_quote_subst"`' LD='`$ECHO "$LD" | $SED "$delay_single_quote_subst"`' NM='`$ECHO "$NM" | $SED "$delay_single_quote_subst"`' LN_S='`$ECHO "$LN_S" | $SED "$delay_single_quote_subst"`' max_cmd_len='`$ECHO "$max_cmd_len" | $SED "$delay_single_quote_subst"`' ac_objext='`$ECHO "$ac_objext" | $SED "$delay_single_quote_subst"`' exeext='`$ECHO "$exeext" | $SED "$delay_single_quote_subst"`' lt_unset='`$ECHO "$lt_unset" | $SED "$delay_single_quote_subst"`' lt_SP2NL='`$ECHO "$lt_SP2NL" | $SED "$delay_single_quote_subst"`' lt_NL2SP='`$ECHO "$lt_NL2SP" | $SED "$delay_single_quote_subst"`' lt_cv_to_host_file_cmd='`$ECHO "$lt_cv_to_host_file_cmd" | $SED "$delay_single_quote_subst"`' lt_cv_to_tool_file_cmd='`$ECHO "$lt_cv_to_tool_file_cmd" | $SED "$delay_single_quote_subst"`' reload_flag='`$ECHO "$reload_flag" | $SED "$delay_single_quote_subst"`' reload_cmds='`$ECHO "$reload_cmds" | $SED "$delay_single_quote_subst"`' OBJDUMP='`$ECHO "$OBJDUMP" | $SED "$delay_single_quote_subst"`' deplibs_check_method='`$ECHO "$deplibs_check_method" | $SED "$delay_single_quote_subst"`' file_magic_cmd='`$ECHO "$file_magic_cmd" | $SED "$delay_single_quote_subst"`' file_magic_glob='`$ECHO "$file_magic_glob" | $SED "$delay_single_quote_subst"`' want_nocaseglob='`$ECHO "$want_nocaseglob" | $SED "$delay_single_quote_subst"`' DLLTOOL='`$ECHO "$DLLTOOL" | $SED "$delay_single_quote_subst"`' sharedlib_from_linklib_cmd='`$ECHO "$sharedlib_from_linklib_cmd" | $SED "$delay_single_quote_subst"`' AR='`$ECHO "$AR" | $SED "$delay_single_quote_subst"`' AR_FLAGS='`$ECHO "$AR_FLAGS" | $SED "$delay_single_quote_subst"`' archiver_list_spec='`$ECHO "$archiver_list_spec" | $SED "$delay_single_quote_subst"`' STRIP='`$ECHO "$STRIP" | $SED "$delay_single_quote_subst"`' RANLIB='`$ECHO "$RANLIB" | $SED "$delay_single_quote_subst"`' old_postinstall_cmds='`$ECHO "$old_postinstall_cmds" | $SED "$delay_single_quote_subst"`' old_postuninstall_cmds='`$ECHO "$old_postuninstall_cmds" | $SED "$delay_single_quote_subst"`' old_archive_cmds='`$ECHO "$old_archive_cmds" | $SED "$delay_single_quote_subst"`' lock_old_archive_extraction='`$ECHO "$lock_old_archive_extraction" | $SED "$delay_single_quote_subst"`' CC='`$ECHO "$CC" | $SED "$delay_single_quote_subst"`' CFLAGS='`$ECHO "$CFLAGS" | $SED "$delay_single_quote_subst"`' compiler='`$ECHO "$compiler" | $SED "$delay_single_quote_subst"`' GCC='`$ECHO "$GCC" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_pipe='`$ECHO "$lt_cv_sys_global_symbol_pipe" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_cdecl='`$ECHO "$lt_cv_sys_global_symbol_to_cdecl" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_import='`$ECHO "$lt_cv_sys_global_symbol_to_import" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_c_name_address='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_c_name_address_lib_prefix='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address_lib_prefix" | $SED "$delay_single_quote_subst"`' lt_cv_nm_interface='`$ECHO "$lt_cv_nm_interface" | $SED "$delay_single_quote_subst"`' nm_file_list_spec='`$ECHO "$nm_file_list_spec" | $SED "$delay_single_quote_subst"`' lt_sysroot='`$ECHO "$lt_sysroot" | $SED "$delay_single_quote_subst"`' lt_cv_truncate_bin='`$ECHO "$lt_cv_truncate_bin" | $SED "$delay_single_quote_subst"`' objdir='`$ECHO "$objdir" | $SED "$delay_single_quote_subst"`' MAGIC_CMD='`$ECHO "$MAGIC_CMD" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_no_builtin_flag='`$ECHO "$lt_prog_compiler_no_builtin_flag" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_pic='`$ECHO "$lt_prog_compiler_pic" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_wl='`$ECHO "$lt_prog_compiler_wl" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_static='`$ECHO "$lt_prog_compiler_static" | $SED "$delay_single_quote_subst"`' lt_cv_prog_compiler_c_o='`$ECHO "$lt_cv_prog_compiler_c_o" | $SED "$delay_single_quote_subst"`' need_locks='`$ECHO "$need_locks" | $SED "$delay_single_quote_subst"`' MANIFEST_TOOL='`$ECHO "$MANIFEST_TOOL" | $SED "$delay_single_quote_subst"`' DSYMUTIL='`$ECHO "$DSYMUTIL" | $SED "$delay_single_quote_subst"`' NMEDIT='`$ECHO "$NMEDIT" | $SED "$delay_single_quote_subst"`' LIPO='`$ECHO "$LIPO" | $SED "$delay_single_quote_subst"`' OTOOL='`$ECHO "$OTOOL" | $SED "$delay_single_quote_subst"`' OTOOL64='`$ECHO "$OTOOL64" | $SED "$delay_single_quote_subst"`' libext='`$ECHO "$libext" | $SED "$delay_single_quote_subst"`' shrext_cmds='`$ECHO "$shrext_cmds" | $SED "$delay_single_quote_subst"`' extract_expsyms_cmds='`$ECHO "$extract_expsyms_cmds" | $SED "$delay_single_quote_subst"`' archive_cmds_need_lc='`$ECHO "$archive_cmds_need_lc" | $SED "$delay_single_quote_subst"`' enable_shared_with_static_runtimes='`$ECHO "$enable_shared_with_static_runtimes" | $SED "$delay_single_quote_subst"`' export_dynamic_flag_spec='`$ECHO "$export_dynamic_flag_spec" | $SED "$delay_single_quote_subst"`' whole_archive_flag_spec='`$ECHO "$whole_archive_flag_spec" | $SED "$delay_single_quote_subst"`' compiler_needs_object='`$ECHO "$compiler_needs_object" | $SED "$delay_single_quote_subst"`' old_archive_from_new_cmds='`$ECHO "$old_archive_from_new_cmds" | $SED "$delay_single_quote_subst"`' old_archive_from_expsyms_cmds='`$ECHO "$old_archive_from_expsyms_cmds" | $SED "$delay_single_quote_subst"`' archive_cmds='`$ECHO "$archive_cmds" | $SED "$delay_single_quote_subst"`' archive_expsym_cmds='`$ECHO "$archive_expsym_cmds" | $SED "$delay_single_quote_subst"`' module_cmds='`$ECHO "$module_cmds" | $SED "$delay_single_quote_subst"`' module_expsym_cmds='`$ECHO "$module_expsym_cmds" | $SED "$delay_single_quote_subst"`' with_gnu_ld='`$ECHO "$with_gnu_ld" | $SED "$delay_single_quote_subst"`' allow_undefined_flag='`$ECHO "$allow_undefined_flag" | $SED "$delay_single_quote_subst"`' no_undefined_flag='`$ECHO "$no_undefined_flag" | $SED "$delay_single_quote_subst"`' hardcode_libdir_flag_spec='`$ECHO "$hardcode_libdir_flag_spec" | $SED "$delay_single_quote_subst"`' hardcode_libdir_separator='`$ECHO "$hardcode_libdir_separator" | $SED "$delay_single_quote_subst"`' hardcode_direct='`$ECHO "$hardcode_direct" | $SED "$delay_single_quote_subst"`' hardcode_direct_absolute='`$ECHO "$hardcode_direct_absolute" | $SED "$delay_single_quote_subst"`' hardcode_minus_L='`$ECHO "$hardcode_minus_L" | $SED "$delay_single_quote_subst"`' hardcode_shlibpath_var='`$ECHO "$hardcode_shlibpath_var" | $SED "$delay_single_quote_subst"`' hardcode_automatic='`$ECHO "$hardcode_automatic" | $SED "$delay_single_quote_subst"`' inherit_rpath='`$ECHO "$inherit_rpath" | $SED "$delay_single_quote_subst"`' link_all_deplibs='`$ECHO "$link_all_deplibs" | $SED "$delay_single_quote_subst"`' always_export_symbols='`$ECHO "$always_export_symbols" | $SED "$delay_single_quote_subst"`' export_symbols_cmds='`$ECHO "$export_symbols_cmds" | $SED "$delay_single_quote_subst"`' exclude_expsyms='`$ECHO "$exclude_expsyms" | $SED "$delay_single_quote_subst"`' include_expsyms='`$ECHO "$include_expsyms" | $SED "$delay_single_quote_subst"`' prelink_cmds='`$ECHO "$prelink_cmds" | $SED "$delay_single_quote_subst"`' postlink_cmds='`$ECHO "$postlink_cmds" | $SED "$delay_single_quote_subst"`' file_list_spec='`$ECHO "$file_list_spec" | $SED "$delay_single_quote_subst"`' variables_saved_for_relink='`$ECHO "$variables_saved_for_relink" | $SED "$delay_single_quote_subst"`' need_lib_prefix='`$ECHO "$need_lib_prefix" | $SED "$delay_single_quote_subst"`' need_version='`$ECHO "$need_version" | $SED "$delay_single_quote_subst"`' version_type='`$ECHO "$version_type" | $SED "$delay_single_quote_subst"`' runpath_var='`$ECHO "$runpath_var" | $SED "$delay_single_quote_subst"`' shlibpath_var='`$ECHO "$shlibpath_var" | $SED "$delay_single_quote_subst"`' shlibpath_overrides_runpath='`$ECHO "$shlibpath_overrides_runpath" | $SED "$delay_single_quote_subst"`' libname_spec='`$ECHO "$libname_spec" | $SED "$delay_single_quote_subst"`' library_names_spec='`$ECHO "$library_names_spec" | $SED "$delay_single_quote_subst"`' soname_spec='`$ECHO "$soname_spec" | $SED "$delay_single_quote_subst"`' install_override_mode='`$ECHO "$install_override_mode" | $SED "$delay_single_quote_subst"`' postinstall_cmds='`$ECHO "$postinstall_cmds" | $SED "$delay_single_quote_subst"`' postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`' finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`' finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`' hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`' sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`' configure_time_dlsearch_path='`$ECHO "$configure_time_dlsearch_path" | $SED "$delay_single_quote_subst"`' configure_time_lt_sys_library_path='`$ECHO "$configure_time_lt_sys_library_path" | $SED "$delay_single_quote_subst"`' hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`' enable_dlopen='`$ECHO "$enable_dlopen" | $SED "$delay_single_quote_subst"`' enable_dlopen_self='`$ECHO "$enable_dlopen_self" | $SED "$delay_single_quote_subst"`' enable_dlopen_self_static='`$ECHO "$enable_dlopen_self_static" | $SED "$delay_single_quote_subst"`' old_striplib='`$ECHO "$old_striplib" | $SED "$delay_single_quote_subst"`' striplib='`$ECHO "$striplib" | $SED "$delay_single_quote_subst"`' compiler_lib_search_dirs='`$ECHO "$compiler_lib_search_dirs" | $SED "$delay_single_quote_subst"`' predep_objects='`$ECHO "$predep_objects" | $SED "$delay_single_quote_subst"`' postdep_objects='`$ECHO "$postdep_objects" | $SED "$delay_single_quote_subst"`' predeps='`$ECHO "$predeps" | $SED "$delay_single_quote_subst"`' postdeps='`$ECHO "$postdeps" | $SED "$delay_single_quote_subst"`' compiler_lib_search_path='`$ECHO "$compiler_lib_search_path" | $SED "$delay_single_quote_subst"`' LD_CXX='`$ECHO "$LD_CXX" | $SED "$delay_single_quote_subst"`' reload_flag_CXX='`$ECHO "$reload_flag_CXX" | $SED "$delay_single_quote_subst"`' reload_cmds_CXX='`$ECHO "$reload_cmds_CXX" | $SED "$delay_single_quote_subst"`' old_archive_cmds_CXX='`$ECHO "$old_archive_cmds_CXX" | $SED "$delay_single_quote_subst"`' compiler_CXX='`$ECHO "$compiler_CXX" | $SED "$delay_single_quote_subst"`' GCC_CXX='`$ECHO "$GCC_CXX" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_no_builtin_flag_CXX='`$ECHO "$lt_prog_compiler_no_builtin_flag_CXX" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_pic_CXX='`$ECHO "$lt_prog_compiler_pic_CXX" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_wl_CXX='`$ECHO "$lt_prog_compiler_wl_CXX" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_static_CXX='`$ECHO "$lt_prog_compiler_static_CXX" | $SED "$delay_single_quote_subst"`' lt_cv_prog_compiler_c_o_CXX='`$ECHO "$lt_cv_prog_compiler_c_o_CXX" | $SED "$delay_single_quote_subst"`' archive_cmds_need_lc_CXX='`$ECHO "$archive_cmds_need_lc_CXX" | $SED "$delay_single_quote_subst"`' enable_shared_with_static_runtimes_CXX='`$ECHO "$enable_shared_with_static_runtimes_CXX" | $SED "$delay_single_quote_subst"`' export_dynamic_flag_spec_CXX='`$ECHO "$export_dynamic_flag_spec_CXX" | $SED "$delay_single_quote_subst"`' whole_archive_flag_spec_CXX='`$ECHO "$whole_archive_flag_spec_CXX" | $SED "$delay_single_quote_subst"`' compiler_needs_object_CXX='`$ECHO "$compiler_needs_object_CXX" | $SED "$delay_single_quote_subst"`' old_archive_from_new_cmds_CXX='`$ECHO "$old_archive_from_new_cmds_CXX" | $SED "$delay_single_quote_subst"`' old_archive_from_expsyms_cmds_CXX='`$ECHO "$old_archive_from_expsyms_cmds_CXX" | $SED "$delay_single_quote_subst"`' archive_cmds_CXX='`$ECHO "$archive_cmds_CXX" | $SED "$delay_single_quote_subst"`' archive_expsym_cmds_CXX='`$ECHO "$archive_expsym_cmds_CXX" | $SED "$delay_single_quote_subst"`' module_cmds_CXX='`$ECHO "$module_cmds_CXX" | $SED "$delay_single_quote_subst"`' module_expsym_cmds_CXX='`$ECHO "$module_expsym_cmds_CXX" | $SED "$delay_single_quote_subst"`' with_gnu_ld_CXX='`$ECHO "$with_gnu_ld_CXX" | $SED "$delay_single_quote_subst"`' allow_undefined_flag_CXX='`$ECHO "$allow_undefined_flag_CXX" | $SED "$delay_single_quote_subst"`' no_undefined_flag_CXX='`$ECHO "$no_undefined_flag_CXX" | $SED "$delay_single_quote_subst"`' hardcode_libdir_flag_spec_CXX='`$ECHO "$hardcode_libdir_flag_spec_CXX" | $SED "$delay_single_quote_subst"`' hardcode_libdir_separator_CXX='`$ECHO "$hardcode_libdir_separator_CXX" | $SED "$delay_single_quote_subst"`' hardcode_direct_CXX='`$ECHO "$hardcode_direct_CXX" | $SED "$delay_single_quote_subst"`' hardcode_direct_absolute_CXX='`$ECHO "$hardcode_direct_absolute_CXX" | $SED "$delay_single_quote_subst"`' hardcode_minus_L_CXX='`$ECHO "$hardcode_minus_L_CXX" | $SED "$delay_single_quote_subst"`' hardcode_shlibpath_var_CXX='`$ECHO "$hardcode_shlibpath_var_CXX" | $SED "$delay_single_quote_subst"`' hardcode_automatic_CXX='`$ECHO "$hardcode_automatic_CXX" | $SED "$delay_single_quote_subst"`' inherit_rpath_CXX='`$ECHO "$inherit_rpath_CXX" | $SED "$delay_single_quote_subst"`' link_all_deplibs_CXX='`$ECHO "$link_all_deplibs_CXX" | $SED "$delay_single_quote_subst"`' always_export_symbols_CXX='`$ECHO "$always_export_symbols_CXX" | $SED "$delay_single_quote_subst"`' export_symbols_cmds_CXX='`$ECHO "$export_symbols_cmds_CXX" | $SED "$delay_single_quote_subst"`' exclude_expsyms_CXX='`$ECHO "$exclude_expsyms_CXX" | $SED "$delay_single_quote_subst"`' include_expsyms_CXX='`$ECHO "$include_expsyms_CXX" | $SED "$delay_single_quote_subst"`' prelink_cmds_CXX='`$ECHO "$prelink_cmds_CXX" | $SED "$delay_single_quote_subst"`' postlink_cmds_CXX='`$ECHO "$postlink_cmds_CXX" | $SED "$delay_single_quote_subst"`' file_list_spec_CXX='`$ECHO "$file_list_spec_CXX" | $SED "$delay_single_quote_subst"`' hardcode_action_CXX='`$ECHO "$hardcode_action_CXX" | $SED "$delay_single_quote_subst"`' compiler_lib_search_dirs_CXX='`$ECHO "$compiler_lib_search_dirs_CXX" | $SED "$delay_single_quote_subst"`' predep_objects_CXX='`$ECHO "$predep_objects_CXX" | $SED "$delay_single_quote_subst"`' postdep_objects_CXX='`$ECHO "$postdep_objects_CXX" | $SED "$delay_single_quote_subst"`' predeps_CXX='`$ECHO "$predeps_CXX" | $SED "$delay_single_quote_subst"`' postdeps_CXX='`$ECHO "$postdeps_CXX" | $SED "$delay_single_quote_subst"`' compiler_lib_search_path_CXX='`$ECHO "$compiler_lib_search_path_CXX" | $SED "$delay_single_quote_subst"`' LTCC='$LTCC' LTCFLAGS='$LTCFLAGS' compiler='$compiler_DEFAULT' # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$1 _LTECHO_EOF' } # Quote evaled strings. for var in SHELL \ ECHO \ PATH_SEPARATOR \ SED \ GREP \ EGREP \ FGREP \ LD \ NM \ LN_S \ lt_SP2NL \ lt_NL2SP \ reload_flag \ OBJDUMP \ deplibs_check_method \ file_magic_cmd \ file_magic_glob \ want_nocaseglob \ DLLTOOL \ sharedlib_from_linklib_cmd \ AR \ AR_FLAGS \ archiver_list_spec \ STRIP \ RANLIB \ CC \ CFLAGS \ compiler \ lt_cv_sys_global_symbol_pipe \ lt_cv_sys_global_symbol_to_cdecl \ lt_cv_sys_global_symbol_to_import \ lt_cv_sys_global_symbol_to_c_name_address \ lt_cv_sys_global_symbol_to_c_name_address_lib_prefix \ lt_cv_nm_interface \ nm_file_list_spec \ lt_cv_truncate_bin \ lt_prog_compiler_no_builtin_flag \ lt_prog_compiler_pic \ lt_prog_compiler_wl \ lt_prog_compiler_static \ lt_cv_prog_compiler_c_o \ need_locks \ MANIFEST_TOOL \ DSYMUTIL \ NMEDIT \ LIPO \ OTOOL \ OTOOL64 \ shrext_cmds \ export_dynamic_flag_spec \ whole_archive_flag_spec \ compiler_needs_object \ with_gnu_ld \ allow_undefined_flag \ no_undefined_flag \ hardcode_libdir_flag_spec \ hardcode_libdir_separator \ exclude_expsyms \ include_expsyms \ file_list_spec \ variables_saved_for_relink \ libname_spec \ library_names_spec \ soname_spec \ install_override_mode \ finish_eval \ old_striplib \ striplib \ compiler_lib_search_dirs \ predep_objects \ postdep_objects \ predeps \ postdeps \ compiler_lib_search_path \ LD_CXX \ reload_flag_CXX \ compiler_CXX \ lt_prog_compiler_no_builtin_flag_CXX \ lt_prog_compiler_pic_CXX \ lt_prog_compiler_wl_CXX \ lt_prog_compiler_static_CXX \ lt_cv_prog_compiler_c_o_CXX \ export_dynamic_flag_spec_CXX \ whole_archive_flag_spec_CXX \ compiler_needs_object_CXX \ with_gnu_ld_CXX \ allow_undefined_flag_CXX \ no_undefined_flag_CXX \ hardcode_libdir_flag_spec_CXX \ hardcode_libdir_separator_CXX \ exclude_expsyms_CXX \ include_expsyms_CXX \ file_list_spec_CXX \ compiler_lib_search_dirs_CXX \ predep_objects_CXX \ postdep_objects_CXX \ predeps_CXX \ postdeps_CXX \ compiler_lib_search_path_CXX; do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[\\\\\\\`\\"\\\$]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done # Double-quote double-evaled strings. for var in reload_cmds \ old_postinstall_cmds \ old_postuninstall_cmds \ old_archive_cmds \ extract_expsyms_cmds \ old_archive_from_new_cmds \ old_archive_from_expsyms_cmds \ archive_cmds \ archive_expsym_cmds \ module_cmds \ module_expsym_cmds \ export_symbols_cmds \ prelink_cmds \ postlink_cmds \ postinstall_cmds \ postuninstall_cmds \ finish_cmds \ sys_lib_search_path_spec \ configure_time_dlsearch_path \ configure_time_lt_sys_library_path \ reload_cmds_CXX \ old_archive_cmds_CXX \ old_archive_from_new_cmds_CXX \ old_archive_from_expsyms_cmds_CXX \ archive_cmds_CXX \ archive_expsym_cmds_CXX \ module_cmds_CXX \ module_expsym_cmds_CXX \ export_symbols_cmds_CXX \ prelink_cmds_CXX \ postlink_cmds_CXX; do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[\\\\\\\`\\"\\\$]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done ac_aux_dir='$ac_aux_dir' # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes INIT. if test -n "\${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi PACKAGE='$PACKAGE' VERSION='$VERSION' RM='$RM' ofile='$ofile' _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in "htp_config_auto_gen.h") CONFIG_HEADERS="$CONFIG_HEADERS htp_config_auto_gen.h" ;; "htp/htp_version.h") CONFIG_FILES="$CONFIG_FILES htp/htp_version.h" ;; "depfiles") CONFIG_COMMANDS="$CONFIG_COMMANDS depfiles" ;; "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;; "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; "htp.pc") CONFIG_FILES="$CONFIG_FILES htp.pc" ;; "htp/Makefile") CONFIG_FILES="$CONFIG_FILES htp/Makefile" ;; "test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;; "docs/Makefile") CONFIG_FILES="$CONFIG_FILES docs/Makefile" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers test "${CONFIG_COMMANDS+set}" = set || CONFIG_COMMANDS=$config_commands fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= ac_tmp= trap 'exit_status=$? : "${ac_tmp:=$tmp}" { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status ' 0 trap 'as_fn_exit 1' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 ac_tmp=$tmp # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=`echo X | tr X '\015'` # On cygwin, bash can eat \r inside `` if the user requested igncr. # But we know of no other shell where ac_cr would be empty at this # point, so we can use a bashism as a fallback. if test "x$ac_cr" = x; then eval ac_cr=\$\'\\r\' fi ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$ac_tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\)..*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\)..*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$ac_tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 _ACEOF # VPATH may cause trouble with some makes, so we remove sole $(srcdir), # ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ h s/// s/^/:/ s/[ ]*$/:/ s/:\$(srcdir):/:/g s/:\${srcdir}:/:/g s/:@srcdir@:/:/g s/^:*// s/:*$// x s/\(=[ ]*\).*/\1/ G s/\n// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" # Set up the scripts for CONFIG_HEADERS section. # No need to generate them if there are no CONFIG_HEADERS. # This happens for instance with `./config.status Makefile'. if test -n "$CONFIG_HEADERS"; then cat >"$ac_tmp/defines.awk" <<\_ACAWK || BEGIN { _ACEOF # Transform confdefs.h into an awk script `defines.awk', embedded as # here-document in config.status, that substitutes the proper values into # config.h.in to produce config.h. # Create a delimiter string that does not exist in confdefs.h, to ease # handling of long lines. ac_delim='%!_!# ' for ac_last_try in false false :; do ac_tt=`sed -n "/$ac_delim/p" confdefs.h` if test -z "$ac_tt"; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done # For the awk script, D is an array of macro values keyed by name, # likewise P contains macro parameters if any. Preserve backslash # newline sequences. ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]* sed -n ' s/.\{148\}/&'"$ac_delim"'/g t rset :rset s/^[ ]*#[ ]*define[ ][ ]*/ / t def d :def s/\\$// t bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3"/p s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2"/p d :bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3\\\\\\n"\\/p t cont s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2\\\\\\n"\\/p t cont d :cont n s/.\{148\}/&'"$ac_delim"'/g t clear :clear s/\\$// t bsnlc s/["\\]/\\&/g; s/^/"/; s/$/"/p d :bsnlc s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p b cont ' >$CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 for (key in D) D_is_set[key] = 1 FS = "" } /^[\t ]*#[\t ]*(define|undef)[\t ]+$ac_word_re([\t (]|\$)/ { line = \$ 0 split(line, arg, " ") if (arg[1] == "#") { defundef = arg[2] mac1 = arg[3] } else { defundef = substr(arg[1], 2) mac1 = arg[2] } split(mac1, mac2, "(") #) macro = mac2[1] prefix = substr(line, 1, index(line, defundef) - 1) if (D_is_set[macro]) { # Preserve the white space surrounding the "#". print prefix "define", macro P[macro] D[macro] next } else { # Replace #undef with comments. This is necessary, for example, # in the case of _POSIX_SOURCE, which is predefined and required # on some systems where configure will not decide to define it. if (defundef == "undef") { print "/*", prefix defundef, macro, "*/" next } } } { print } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 as_fn_error $? "could not setup config headers machinery" "$LINENO" 5 fi # test -n "$CONFIG_HEADERS" eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS :C $CONFIG_COMMANDS" shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$ac_tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;; esac case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac as_fn_append ac_file_inputs " '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 $as_echo "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`$as_echo "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$ac_tmp/stdin" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # case $INSTALL in [\\/$]* | ?:[\\/]* ) ac_INSTALL=$INSTALL ;; *) ac_INSTALL=$ac_top_build_prefix$INSTALL ;; esac ac_MKDIR_P=$MKDIR_P case $MKDIR_P in [\\/$]* | ?:[\\/]* ) ;; */*) ac_MKDIR_P=$ac_top_build_prefix$MKDIR_P ;; esac _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 $as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t s&@INSTALL@&$ac_INSTALL&;t t s&@MKDIR_P@&$ac_MKDIR_P&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \ >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5 test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \ "$ac_tmp/out"`; test -z "$ac_out"; } && { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&5 $as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&2;} rm -f "$ac_tmp/stdin" case $ac_file in -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";; *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";; esac \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; :H) # # CONFIG_HEADER # if test x"$ac_file" != x-; then { $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" } >"$ac_tmp/config.h" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5 $as_echo "$as_me: $ac_file is unchanged" >&6;} else rm -f "$ac_file" mv "$ac_tmp/config.h" "$ac_file" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 fi else $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \ || as_fn_error $? "could not create -" "$LINENO" 5 fi # Compute "$ac_file"'s index in $config_headers. _am_arg="$ac_file" _am_stamp_count=1 for _am_header in $config_headers :; do case $_am_header in $_am_arg | $_am_arg:* ) break ;; * ) _am_stamp_count=`expr $_am_stamp_count + 1` ;; esac done echo "timestamp for $_am_arg" >`$as_dirname -- "$_am_arg" || $as_expr X"$_am_arg" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$_am_arg" : 'X\(//\)[^/]' \| \ X"$_am_arg" : 'X\(//\)$' \| \ X"$_am_arg" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$_am_arg" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'`/stamp-h$_am_stamp_count ;; :C) { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5 $as_echo "$as_me: executing $ac_file commands" >&6;} ;; esac case $ac_file$ac_mode in "depfiles":C) test x"$AMDEP_TRUE" != x"" || { # Older Autoconf quotes --file arguments for eval, but not when files # are listed without --file. Let's play safe and only enable the eval # if we detect the quoting. case $CONFIG_FILES in *\'*) eval set x "$CONFIG_FILES" ;; *) set x $CONFIG_FILES ;; esac shift for mf do # Strip MF so we end up with the name of the file. mf=`echo "$mf" | sed -e 's/:.*$//'` # Check whether this is an Automake generated Makefile or not. # We used to match only the files named 'Makefile.in', but # some people rename them; so instead we look at the file content. # Grep'ing the first line is not enough: some people post-process # each Makefile.in and add a new line on top of each file to say so. # Grep'ing the whole file is not good either: AIX grep has a line # limit of 2048, but all sed's we know have understand at least 4000. if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then dirpart=`$as_dirname -- "$mf" || $as_expr X"$mf" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$mf" : 'X\(//\)[^/]' \| \ X"$mf" : 'X\(//\)$' \| \ X"$mf" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$mf" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` else continue fi # Extract the definition of DEPDIR, am__include, and am__quote # from the Makefile without running 'make'. DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"` test -z "$DEPDIR" && continue am__include=`sed -n 's/^am__include = //p' < "$mf"` test -z "$am__include" && continue am__quote=`sed -n 's/^am__quote = //p' < "$mf"` # Find all dependency output files, they are included files with # $(DEPDIR) in their names. We invoke sed twice because it is the # simplest approach to changing $(DEPDIR) to its actual value in the # expansion. for file in `sed -n " s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \ sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do # Make sure the directory exists. test -f "$dirpart/$file" && continue fdir=`$as_dirname -- "$file" || $as_expr X"$file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$file" : 'X\(//\)[^/]' \| \ X"$file" : 'X\(//\)$' \| \ X"$file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir=$dirpart/$fdir; as_fn_mkdir_p # echo "creating $dirpart/$file" echo '# dummy' > "$dirpart/$file" done done } ;; "libtool":C) # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes. if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi cfgfile=${ofile}T trap "$RM \"$cfgfile\"; exit 1" 1 2 15 $RM "$cfgfile" cat <<_LT_EOF >> "$cfgfile" #! $SHELL # Generated automatically by $as_me ($PACKAGE) $VERSION # Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`: # NOTE: Changes made to this file will be lost: look at ltmain.sh. # Provide generalized library-building support services. # Written by Gordon Matzigkeit, 1996 # Copyright (C) 2014 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program or library that is built # using GNU Libtool, you may include this file under the same # distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # The names of the tagged configurations supported by this script. available_tags='CXX ' # Configured defaults for sys_lib_dlsearch_path munging. : \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"} # ### BEGIN LIBTOOL CONFIG # Which release of libtool.m4 was used? macro_version=$macro_version macro_revision=$macro_revision # Whether or not to build shared libraries. build_libtool_libs=$enable_shared # Whether or not to build static libraries. build_old_libs=$enable_static # What type of objects to build. pic_mode=$pic_mode # Whether or not to optimize for fast installation. fast_install=$enable_fast_install # Shared archive member basename,for filename based shared library versioning on AIX. shared_archive_member_spec=$shared_archive_member_spec # Shell to use when invoking shell scripts. SHELL=$lt_SHELL # An echo program that protects backslashes. ECHO=$lt_ECHO # The PATH separator for the build system. PATH_SEPARATOR=$lt_PATH_SEPARATOR # The host system. host_alias=$host_alias host=$host host_os=$host_os # The build system. build_alias=$build_alias build=$build build_os=$build_os # A sed program that does not truncate output. SED=$lt_SED # Sed that helps us avoid accidentally triggering echo(1) options like -n. Xsed="\$SED -e 1s/^X//" # A grep program that handles long lines. GREP=$lt_GREP # An ERE matcher. EGREP=$lt_EGREP # A literal string matcher. FGREP=$lt_FGREP # A BSD- or MS-compatible name lister. NM=$lt_NM # Whether we need soft or hard links. LN_S=$lt_LN_S # What is the maximum length of a command? max_cmd_len=$max_cmd_len # Object file suffix (normally "o"). objext=$ac_objext # Executable file suffix (normally ""). exeext=$exeext # whether the shell understands "unset". lt_unset=$lt_unset # turn spaces into newlines. SP2NL=$lt_lt_SP2NL # turn newlines into spaces. NL2SP=$lt_lt_NL2SP # convert \$build file names to \$host format. to_host_file_cmd=$lt_cv_to_host_file_cmd # convert \$build files to toolchain format. to_tool_file_cmd=$lt_cv_to_tool_file_cmd # An object symbol dumper. OBJDUMP=$lt_OBJDUMP # Method to check whether dependent libraries are shared objects. deplibs_check_method=$lt_deplibs_check_method # Command to use when deplibs_check_method = "file_magic". file_magic_cmd=$lt_file_magic_cmd # How to find potential files when deplibs_check_method = "file_magic". file_magic_glob=$lt_file_magic_glob # Find potential files using nocaseglob when deplibs_check_method = "file_magic". want_nocaseglob=$lt_want_nocaseglob # DLL creation program. DLLTOOL=$lt_DLLTOOL # Command to associate shared and link libraries. sharedlib_from_linklib_cmd=$lt_sharedlib_from_linklib_cmd # The archiver. AR=$lt_AR # Flags to create an archive. AR_FLAGS=$lt_AR_FLAGS # How to feed a file listing to the archiver. archiver_list_spec=$lt_archiver_list_spec # A symbol stripping program. STRIP=$lt_STRIP # Commands used to install an old-style archive. RANLIB=$lt_RANLIB old_postinstall_cmds=$lt_old_postinstall_cmds old_postuninstall_cmds=$lt_old_postuninstall_cmds # Whether to use a lock for old archive extraction. lock_old_archive_extraction=$lock_old_archive_extraction # A C compiler. LTCC=$lt_CC # LTCC compiler flags. LTCFLAGS=$lt_CFLAGS # Take the output of nm and produce a listing of raw symbols and C names. global_symbol_pipe=$lt_lt_cv_sys_global_symbol_pipe # Transform the output of nm in a proper C declaration. global_symbol_to_cdecl=$lt_lt_cv_sys_global_symbol_to_cdecl # Transform the output of nm into a list of symbols to manually relocate. global_symbol_to_import=$lt_lt_cv_sys_global_symbol_to_import # Transform the output of nm in a C name address pair. global_symbol_to_c_name_address=$lt_lt_cv_sys_global_symbol_to_c_name_address # Transform the output of nm in a C name address pair when lib prefix is needed. global_symbol_to_c_name_address_lib_prefix=$lt_lt_cv_sys_global_symbol_to_c_name_address_lib_prefix # The name lister interface. nm_interface=$lt_lt_cv_nm_interface # Specify filename containing input files for \$NM. nm_file_list_spec=$lt_nm_file_list_spec # The root where to search for dependent libraries,and where our libraries should be installed. lt_sysroot=$lt_sysroot # Command to truncate a binary pipe. lt_truncate_bin=$lt_lt_cv_truncate_bin # The name of the directory that contains temporary libtool files. objdir=$objdir # Used to examine libraries when file_magic_cmd begins with "file". MAGIC_CMD=$MAGIC_CMD # Must we lock files when doing compilation? need_locks=$lt_need_locks # Manifest tool. MANIFEST_TOOL=$lt_MANIFEST_TOOL # Tool to manipulate archived DWARF debug symbol files on Mac OS X. DSYMUTIL=$lt_DSYMUTIL # Tool to change global to local symbols on Mac OS X. NMEDIT=$lt_NMEDIT # Tool to manipulate fat objects and archives on Mac OS X. LIPO=$lt_LIPO # ldd/readelf like tool for Mach-O binaries on Mac OS X. OTOOL=$lt_OTOOL # ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4. OTOOL64=$lt_OTOOL64 # Old archive suffix (normally "a"). libext=$libext # Shared library suffix (normally ".so"). shrext_cmds=$lt_shrext_cmds # The commands to extract the exported symbol list from a shared archive. extract_expsyms_cmds=$lt_extract_expsyms_cmds # Variables whose values should be saved in libtool wrapper scripts and # restored at link time. variables_saved_for_relink=$lt_variables_saved_for_relink # Do we need the "lib" prefix for modules? need_lib_prefix=$need_lib_prefix # Do we need a version for libraries? need_version=$need_version # Library versioning type. version_type=$version_type # Shared library runtime path variable. runpath_var=$runpath_var # Shared library path variable. shlibpath_var=$shlibpath_var # Is shlibpath searched before the hard-coded library search path? shlibpath_overrides_runpath=$shlibpath_overrides_runpath # Format of library name prefix. libname_spec=$lt_libname_spec # List of archive names. First name is the real one, the rest are links. # The last name is the one that the linker finds with -lNAME library_names_spec=$lt_library_names_spec # The coded name of the library, if different from the real name. soname_spec=$lt_soname_spec # Permission mode override for installation of shared libraries. install_override_mode=$lt_install_override_mode # Command to use after installation of a shared archive. postinstall_cmds=$lt_postinstall_cmds # Command to use after uninstallation of a shared archive. postuninstall_cmds=$lt_postuninstall_cmds # Commands used to finish a libtool library installation in a directory. finish_cmds=$lt_finish_cmds # As "finish_cmds", except a single script fragment to be evaled but # not shown. finish_eval=$lt_finish_eval # Whether we should hardcode library paths into libraries. hardcode_into_libs=$hardcode_into_libs # Compile-time system search path for libraries. sys_lib_search_path_spec=$lt_sys_lib_search_path_spec # Detected run-time system search path for libraries. sys_lib_dlsearch_path_spec=$lt_configure_time_dlsearch_path # Explicit LT_SYS_LIBRARY_PATH set during ./configure time. configure_time_lt_sys_library_path=$lt_configure_time_lt_sys_library_path # Whether dlopen is supported. dlopen_support=$enable_dlopen # Whether dlopen of programs is supported. dlopen_self=$enable_dlopen_self # Whether dlopen of statically linked programs is supported. dlopen_self_static=$enable_dlopen_self_static # Commands to strip libraries. old_striplib=$lt_old_striplib striplib=$lt_striplib # The linker used to build libraries. LD=$lt_LD # How to create reloadable object files. reload_flag=$lt_reload_flag reload_cmds=$lt_reload_cmds # Commands used to build an old-style archive. old_archive_cmds=$lt_old_archive_cmds # A language specific compiler. CC=$lt_compiler # Is the compiler the GNU compiler? with_gcc=$GCC # Compiler flag to turn off builtin functions. no_builtin_flag=$lt_lt_prog_compiler_no_builtin_flag # Additional compiler flags for building library objects. pic_flag=$lt_lt_prog_compiler_pic # How to pass a linker flag through the compiler. wl=$lt_lt_prog_compiler_wl # Compiler flag to prevent dynamic linking. link_static_flag=$lt_lt_prog_compiler_static # Does compiler simultaneously support -c and -o options? compiler_c_o=$lt_lt_cv_prog_compiler_c_o # Whether or not to add -lc for building shared libraries. build_libtool_need_lc=$archive_cmds_need_lc # Whether or not to disallow shared libs when runtime libs are static. allow_libtool_libs_with_static_runtimes=$enable_shared_with_static_runtimes # Compiler flag to allow reflexive dlopens. export_dynamic_flag_spec=$lt_export_dynamic_flag_spec # Compiler flag to generate shared objects directly from archives. whole_archive_flag_spec=$lt_whole_archive_flag_spec # Whether the compiler copes with passing no objects directly. compiler_needs_object=$lt_compiler_needs_object # Create an old-style archive from a shared archive. old_archive_from_new_cmds=$lt_old_archive_from_new_cmds # Create a temporary old-style archive to link instead of a shared archive. old_archive_from_expsyms_cmds=$lt_old_archive_from_expsyms_cmds # Commands used to build a shared archive. archive_cmds=$lt_archive_cmds archive_expsym_cmds=$lt_archive_expsym_cmds # Commands used to build a loadable module if different from building # a shared archive. module_cmds=$lt_module_cmds module_expsym_cmds=$lt_module_expsym_cmds # Whether we are building with GNU ld or not. with_gnu_ld=$lt_with_gnu_ld # Flag that allows shared libraries with undefined symbols to be built. allow_undefined_flag=$lt_allow_undefined_flag # Flag that enforces no undefined symbols. no_undefined_flag=$lt_no_undefined_flag # Flag to hardcode \$libdir into a binary during linking. # This must work even if \$libdir does not exist hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec # Whether we need a single "-rpath" flag with a separated argument. hardcode_libdir_separator=$lt_hardcode_libdir_separator # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary. hardcode_direct=$hardcode_direct # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary and the resulting library dependency is # "absolute",i.e impossible to change by setting \$shlibpath_var if the # library is relocated. hardcode_direct_absolute=$hardcode_direct_absolute # Set to "yes" if using the -LDIR flag during linking hardcodes DIR # into the resulting binary. hardcode_minus_L=$hardcode_minus_L # Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR # into the resulting binary. hardcode_shlibpath_var=$hardcode_shlibpath_var # Set to "yes" if building a shared library automatically hardcodes DIR # into the library and all subsequent libraries and executables linked # against it. hardcode_automatic=$hardcode_automatic # Set to yes if linker adds runtime paths of dependent libraries # to runtime path list. inherit_rpath=$inherit_rpath # Whether libtool must link a program against all its dependency libraries. link_all_deplibs=$link_all_deplibs # Set to "yes" if exported symbols are required. always_export_symbols=$always_export_symbols # The commands to list exported symbols. export_symbols_cmds=$lt_export_symbols_cmds # Symbols that should not be listed in the preloaded symbols. exclude_expsyms=$lt_exclude_expsyms # Symbols that must always be exported. include_expsyms=$lt_include_expsyms # Commands necessary for linking programs (against libraries) with templates. prelink_cmds=$lt_prelink_cmds # Commands necessary for finishing linking programs. postlink_cmds=$lt_postlink_cmds # Specify filename containing input files. file_list_spec=$lt_file_list_spec # How to hardcode a shared library path into an executable. hardcode_action=$hardcode_action # The directories searched by this compiler when creating a shared library. compiler_lib_search_dirs=$lt_compiler_lib_search_dirs # Dependencies to place before and after the objects being linked to # create a shared library. predep_objects=$lt_predep_objects postdep_objects=$lt_postdep_objects predeps=$lt_predeps postdeps=$lt_postdeps # The library search path used internally by the compiler when linking # a shared library. compiler_lib_search_path=$lt_compiler_lib_search_path # ### END LIBTOOL CONFIG _LT_EOF cat <<'_LT_EOF' >> "$cfgfile" # ### BEGIN FUNCTIONS SHARED WITH CONFIGURE # func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x$2 in x) ;; *:) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'` \$$1\" ;; x:*) eval $1=\"\$$1 `$ECHO $2 | $SED 's/:/ /g'`\" ;; *::*) eval $1=\"\$$1\ `$ECHO $2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval $1=\"`$ECHO $2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\" ;; *) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'`\" ;; esac } # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in $*""; do case $cc_temp in compile | *[\\/]compile | ccache | *[\\/]ccache ) ;; distcc | *[\\/]distcc | purify | *[\\/]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } # ### END FUNCTIONS SHARED WITH CONFIGURE _LT_EOF case $host_os in aix3*) cat <<\_LT_EOF >> "$cfgfile" # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi _LT_EOF ;; esac ltmain=$ac_aux_dir/ltmain.sh # We use sed instead of cat because bash on DJGPP gets confused if # if finds mixed CR/LF and LF-only lines. Since sed operates in # text mode, it properly converts lines to CR/LF. This bash problem # is reportedly fixed, but why not run on old versions too? sed '$q' "$ltmain" >> "$cfgfile" \ || (rm -f "$cfgfile"; exit 1) mv -f "$cfgfile" "$ofile" || (rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile") chmod +x "$ofile" cat <<_LT_EOF >> "$ofile" # ### BEGIN LIBTOOL TAG CONFIG: CXX # The linker used to build libraries. LD=$lt_LD_CXX # How to create reloadable object files. reload_flag=$lt_reload_flag_CXX reload_cmds=$lt_reload_cmds_CXX # Commands used to build an old-style archive. old_archive_cmds=$lt_old_archive_cmds_CXX # A language specific compiler. CC=$lt_compiler_CXX # Is the compiler the GNU compiler? with_gcc=$GCC_CXX # Compiler flag to turn off builtin functions. no_builtin_flag=$lt_lt_prog_compiler_no_builtin_flag_CXX # Additional compiler flags for building library objects. pic_flag=$lt_lt_prog_compiler_pic_CXX # How to pass a linker flag through the compiler. wl=$lt_lt_prog_compiler_wl_CXX # Compiler flag to prevent dynamic linking. link_static_flag=$lt_lt_prog_compiler_static_CXX # Does compiler simultaneously support -c and -o options? compiler_c_o=$lt_lt_cv_prog_compiler_c_o_CXX # Whether or not to add -lc for building shared libraries. build_libtool_need_lc=$archive_cmds_need_lc_CXX # Whether or not to disallow shared libs when runtime libs are static. allow_libtool_libs_with_static_runtimes=$enable_shared_with_static_runtimes_CXX # Compiler flag to allow reflexive dlopens. export_dynamic_flag_spec=$lt_export_dynamic_flag_spec_CXX # Compiler flag to generate shared objects directly from archives. whole_archive_flag_spec=$lt_whole_archive_flag_spec_CXX # Whether the compiler copes with passing no objects directly. compiler_needs_object=$lt_compiler_needs_object_CXX # Create an old-style archive from a shared archive. old_archive_from_new_cmds=$lt_old_archive_from_new_cmds_CXX # Create a temporary old-style archive to link instead of a shared archive. old_archive_from_expsyms_cmds=$lt_old_archive_from_expsyms_cmds_CXX # Commands used to build a shared archive. archive_cmds=$lt_archive_cmds_CXX archive_expsym_cmds=$lt_archive_expsym_cmds_CXX # Commands used to build a loadable module if different from building # a shared archive. module_cmds=$lt_module_cmds_CXX module_expsym_cmds=$lt_module_expsym_cmds_CXX # Whether we are building with GNU ld or not. with_gnu_ld=$lt_with_gnu_ld_CXX # Flag that allows shared libraries with undefined symbols to be built. allow_undefined_flag=$lt_allow_undefined_flag_CXX # Flag that enforces no undefined symbols. no_undefined_flag=$lt_no_undefined_flag_CXX # Flag to hardcode \$libdir into a binary during linking. # This must work even if \$libdir does not exist hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec_CXX # Whether we need a single "-rpath" flag with a separated argument. hardcode_libdir_separator=$lt_hardcode_libdir_separator_CXX # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary. hardcode_direct=$hardcode_direct_CXX # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary and the resulting library dependency is # "absolute",i.e impossible to change by setting \$shlibpath_var if the # library is relocated. hardcode_direct_absolute=$hardcode_direct_absolute_CXX # Set to "yes" if using the -LDIR flag during linking hardcodes DIR # into the resulting binary. hardcode_minus_L=$hardcode_minus_L_CXX # Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR # into the resulting binary. hardcode_shlibpath_var=$hardcode_shlibpath_var_CXX # Set to "yes" if building a shared library automatically hardcodes DIR # into the library and all subsequent libraries and executables linked # against it. hardcode_automatic=$hardcode_automatic_CXX # Set to yes if linker adds runtime paths of dependent libraries # to runtime path list. inherit_rpath=$inherit_rpath_CXX # Whether libtool must link a program against all its dependency libraries. link_all_deplibs=$link_all_deplibs_CXX # Set to "yes" if exported symbols are required. always_export_symbols=$always_export_symbols_CXX # The commands to list exported symbols. export_symbols_cmds=$lt_export_symbols_cmds_CXX # Symbols that should not be listed in the preloaded symbols. exclude_expsyms=$lt_exclude_expsyms_CXX # Symbols that must always be exported. include_expsyms=$lt_include_expsyms_CXX # Commands necessary for linking programs (against libraries) with templates. prelink_cmds=$lt_prelink_cmds_CXX # Commands necessary for finishing linking programs. postlink_cmds=$lt_postlink_cmds_CXX # Specify filename containing input files. file_list_spec=$lt_file_list_spec_CXX # How to hardcode a shared library path into an executable. hardcode_action=$hardcode_action_CXX # The directories searched by this compiler when creating a shared library. compiler_lib_search_dirs=$lt_compiler_lib_search_dirs_CXX # Dependencies to place before and after the objects being linked to # create a shared library. predep_objects=$lt_predep_objects_CXX postdep_objects=$lt_postdep_objects_CXX predeps=$lt_predeps_CXX postdeps=$lt_postdeps_CXX # The library search path used internally by the compiler when linking # a shared library. compiler_lib_search_path=$lt_compiler_lib_search_path_CXX # ### END LIBTOOL TAG CONFIG: CXX _LT_EOF ;; esac done # for ac_tag as_fn_exit 0 _ACEOF ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || as_fn_exit 1 fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi suricata-3.2.1/libhtp/NOTICE0000644000000000000000000000000013051004451012364 00000000000000suricata-3.2.1/libhtp/test/0000755000000000000000000000000013051004503012527 500000000000000suricata-3.2.1/libhtp/test/test_gunzip.cpp0000644000000000000000000001746413051004451015544 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * * @author Ivan Ristic */ #include #include #include #include #include #include #include #include #ifndef O_BINARY #define O_BINARY 0 #endif static htp_status_t GUnzip_decompressor_callback(htp_tx_data_t *d) { bstr **output = (bstr **) htp_tx_get_user_data(d->tx); *output = bstr_dup_mem(d->data, d->len); return HTP_OK; } class GUnzip : public testing::Test { protected: virtual htp_status_t decompressFile(const char *f) { // Construct complete file name char filename[1025]; strncpy(filename, home, 1024); strncat(filename, "/", 1024 - strlen(filename)); strncat(filename, f, 1024 - strlen(filename)); // Load test data int fd = open(filename, O_RDONLY | O_BINARY); if (fd < 0) { //FAIL() << "Unable to open test file"; return HTP_ERROR; } struct stat statbuf; if (fstat(fd, &statbuf) < 0) { //FAIL() << "Unable to stat test file"; return HTP_ERROR; } htp_tx_data_t d; d.tx = tx; d.len = statbuf.st_size; d.data = (const unsigned char *) malloc(d.len); if (d.data == NULL) { //FAIL() << "Memory allocation failed"; return HTP_ERROR; } ssize_t bytes_read = read(fd, (void *) d.data, d.len); if ((bytes_read < 0)||((size_t)bytes_read != d.len)) { //FAIL() << "Reading from test file failed"; close(fd); return HTP_ERROR; } close(fd); // Decompress htp_status_t rc = decompressor->decompress(decompressor, &d); free((void *)d.data); return rc; } virtual void SetUp() { home = getenv("srcdir"); if (home == NULL) { fprintf(stderr, "This program needs environment variable 'srcdir' set."); exit(EXIT_FAILURE); } cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_APACHE_2); connp = htp_connp_create(cfg); tx = htp_connp_tx_create(connp); htp_tx_set_user_data(tx, &output); decompressor = htp_gzip_decompressor_create(connp, HTP_COMPRESSION_GZIP); decompressor->callback = GUnzip_decompressor_callback; o_boxing_wizards = bstr_dup_c("The five boxing wizards jump quickly."); output = NULL; } virtual void TearDown() { bstr_free(output); bstr_free(o_boxing_wizards); decompressor->destroy(decompressor); htp_connp_destroy_all(connp); htp_config_destroy(cfg); } bstr *output; bstr *o_boxing_wizards; htp_connp_t *connp; htp_tx_t *tx; htp_cfg_t *cfg; char *home; htp_decompressor_t *decompressor; }; TEST_F(GUnzip, Minimal) { htp_status_t rc = decompressFile("gztest-01-minimal.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, FNAME) { htp_status_t rc = decompressFile("gztest-02-fname.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #if 0 TEST_F(GUnzip, FCOMMENT) { htp_status_t rc = decompressFile("gztest-03-fcomment.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, FHCRC) { htp_status_t rc = decompressFile("gztest-04-fhcrc.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #endif TEST_F(GUnzip, FEXTRA) { htp_status_t rc = decompressFile("gztest-05-fextra.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, FTEXT) { htp_status_t rc = decompressFile("gztest-06-ftext.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #if 0 TEST_F(GUnzip, FRESERVED1) { htp_status_t rc = decompressFile("gztest-07-freserved1.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, FRESERVED2) { htp_status_t rc = decompressFile("gztest-08-freserved2.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, FRESERVED3) { htp_status_t rc = decompressFile("gztest-09-freserved3.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #endif TEST_F(GUnzip, Multipart) { htp_status_t rc = decompressFile("gztest-10-multipart.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #if 0 TEST_F(GUnzip, InvalidMethod) { htp_status_t rc = decompressFile("gztest-11-invalid-method.gz.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, InvalidCrc) { htp_status_t rc = decompressFile("gztest-12-invalid-crc32.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, InvalidInputSize) { htp_status_t rc = decompressFile("gztest-13-invalid-isize.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } #endif TEST_F(GUnzip, InvalidExtraFlags) { htp_status_t rc = decompressFile("gztest-14-invalid-xfl.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } TEST_F(GUnzip, InvalidHeaderCrc) { htp_status_t rc = decompressFile("gztest-15-invalid-fhcrc.gz"); ASSERT_EQ(rc, HTP_OK); ASSERT_TRUE(output != NULL); ASSERT_TRUE(bstr_cmp(o_boxing_wizards, output) == 0); } suricata-3.2.1/libhtp/test/test_bench.cpp0000644000000000000000000000550513051004451015300 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * * @author Ivan Ristic */ #include #include #include #include "test.h" class Benchmark : public testing::Test { protected: virtual void SetUp() { home = getenv("srcdir"); if (home == NULL) { fprintf(stderr, "This program needs environment variable 'srcdir' set."); exit(EXIT_FAILURE); } cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_APACHE_2); htp_config_register_urlencoded_parser(cfg); htp_config_register_multipart_parser(cfg); } virtual void TearDown() { htp_connp_destroy_all(connp); htp_config_destroy(cfg); } htp_connp_t *connp; htp_cfg_t *cfg; char *home; }; TEST_F(Benchmark, ConnectionWithManyTransactions) { int rc = test_run_ex(home, "01-get.t", cfg, &connp, 2000); ASSERT_GE(rc, 0); ASSERT_EQ(2000, htp_list_size(connp->conn->transactions)); }suricata-3.2.1/libhtp/test/test_hybrid.cpp0000644000000000000000000007505113051004451015505 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include #include #include #include "test.h" class HybridParsing_Get_User_Data { public: // Request callback indicators. int callback_REQUEST_START_invoked; int callback_REQUEST_LINE_invoked; int callback_REQUEST_HEADERS_invoked; int callback_REQUEST_COMPLETE_invoked; // Response callback indicators. int callback_RESPONSE_START_invoked; int callback_RESPONSE_LINE_invoked; int callback_RESPONSE_HEADERS_invoked; int callback_RESPONSE_COMPLETE_invoked; // Transaction callback indicators. int callback_TRANSACTION_COMPLETE_invoked; // Response body handling fields. int response_body_chunks_seen; int response_body_correctly_received; HybridParsing_Get_User_Data() { Reset(); } void Reset() { this->callback_REQUEST_START_invoked = 0; this->callback_REQUEST_LINE_invoked = 0; this->callback_REQUEST_HEADERS_invoked = 0; this->callback_REQUEST_COMPLETE_invoked = 0; this->callback_RESPONSE_START_invoked = 0; this->callback_RESPONSE_LINE_invoked = 0; this->callback_RESPONSE_HEADERS_invoked = 0; this->callback_RESPONSE_COMPLETE_invoked = 0; this->callback_TRANSACTION_COMPLETE_invoked = 0; this->response_body_chunks_seen = 0; this->response_body_correctly_received = 0; } }; static int HybridParsing_Get_Callback_REQUEST_START(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_REQUEST_START_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_REQUEST_LINE(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_REQUEST_LINE_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_REQUEST_HEADERS(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_REQUEST_HEADERS_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_REQUEST_COMPLETE(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_REQUEST_COMPLETE_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_RESPONSE_START(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_RESPONSE_START_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_RESPONSE_LINE(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_RESPONSE_LINE_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_RESPONSE_HEADERS(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_RESPONSE_HEADERS_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_RESPONSE_BODY_DATA(htp_tx_data_t *d) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(d->tx); // Don't do anything if in errored state. if (user_data->response_body_correctly_received == -1) return HTP_ERROR; switch (user_data->response_body_chunks_seen) { case 0: if ((d->len == 9) && (memcmp(d->data, "

Hello", 9) == 0)) { user_data->response_body_chunks_seen++; } else { SCOPED_TRACE("Mismatch in 1st chunk"); user_data->response_body_correctly_received = -1; } break; case 1: if ((d->len == 1) && (memcmp(d->data, " ", 1) == 0)) { user_data->response_body_chunks_seen++; } else { SCOPED_TRACE("Mismatch in 2nd chunk"); user_data->response_body_correctly_received = -1; } break; case 2: if ((d->len == 11) && (memcmp(d->data, "World!

", 11) == 0)) { user_data->response_body_chunks_seen++; user_data->response_body_correctly_received = 1; } else { SCOPED_TRACE("Mismatch in 3rd chunk"); user_data->response_body_correctly_received = -1; } break; default: SCOPED_TRACE("Seen more than 3 chunks"); user_data->response_body_correctly_received = -1; break; } return HTP_OK; } static int HybridParsing_Get_Callback_RESPONSE_COMPLETE(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_RESPONSE_COMPLETE_invoked; return HTP_OK; } static int HybridParsing_Get_Callback_TRANSACTION_COMPLETE(htp_tx_t *tx) { struct HybridParsing_Get_User_Data *user_data = (struct HybridParsing_Get_User_Data *) htp_tx_get_user_data(tx); ++user_data->callback_TRANSACTION_COMPLETE_invoked; return HTP_OK; } class HybridParsing : public testing::Test { protected: virtual void SetUp() { testing::Test::SetUp(); cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_APACHE_2); htp_config_register_urlencoded_parser(cfg); htp_config_register_multipart_parser(cfg); connp = htp_connp_create(cfg); htp_connp_open(connp, "127.0.0.1", 32768, "127.0.0.1", 80, NULL); connp_open = true; user_data.Reset(); } virtual void TearDown() { CloseConnParser( ); htp_connp_destroy_all(connp); htp_config_destroy(cfg); testing::Test::TearDown(); } void CloseConnParser() { if (connp_open) { htp_connp_close(connp, NULL); connp_open = false; } } void RegisterUserCallbacks() { // Request callbacks htp_config_register_request_start(cfg, HybridParsing_Get_Callback_REQUEST_START); htp_config_register_request_line(cfg, HybridParsing_Get_Callback_REQUEST_LINE); htp_config_register_request_headers(cfg, HybridParsing_Get_Callback_REQUEST_HEADERS); htp_config_register_request_complete(cfg, HybridParsing_Get_Callback_REQUEST_COMPLETE); // Response callbacks htp_config_register_response_start(cfg, HybridParsing_Get_Callback_RESPONSE_START); htp_config_register_response_line(cfg, HybridParsing_Get_Callback_RESPONSE_LINE); htp_config_register_response_headers(cfg, HybridParsing_Get_Callback_RESPONSE_HEADERS); htp_config_register_response_body_data(cfg, HybridParsing_Get_Callback_RESPONSE_BODY_DATA); htp_config_register_response_complete(cfg, HybridParsing_Get_Callback_RESPONSE_COMPLETE); // Transaction calllbacks htp_config_register_transaction_complete(cfg, HybridParsing_Get_Callback_TRANSACTION_COMPLETE); } htp_connp_t *connp; htp_cfg_t *cfg; bool connp_open; // This must not be in a test stack frame as it will persist to TearDown // as htp user data. HybridParsing_Get_User_Data user_data; }; /** * Test hybrid mode with one complete GET transaction; request then response * with a body. Most features are tested, including query string parameters and callbacks. */ TEST_F(HybridParsing, GetTest) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Configure user data and callbacks htp_tx_set_user_data(tx, &user_data); // Register callbacks RegisterUserCallbacks(); // Request begins htp_tx_state_request_start(tx); ASSERT_EQ(1, user_data.callback_REQUEST_START_invoked); // Request line data htp_tx_req_set_method(tx, "GET", 3, HTP_ALLOC_COPY); htp_tx_req_set_method_number(tx, HTP_M_GET); htp_tx_req_set_uri(tx, "/?p=1&q=2", 9, HTP_ALLOC_COPY); htp_tx_req_set_protocol(tx, "HTTP/1.1", 8, HTP_ALLOC_COPY); htp_tx_req_set_protocol_number(tx, HTP_PROTOCOL_1_1); htp_tx_req_set_protocol_0_9(tx, 0); // Request line complete htp_tx_state_request_line(tx); ASSERT_EQ(1, user_data.callback_REQUEST_LINE_invoked); // Check request line data ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=1&q=2")); ASSERT_TRUE(tx->request_protocol != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_protocol, "HTTP/1.1")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/")); ASSERT_TRUE(tx->parsed_uri->query != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->query, "p=1&q=2")); // Check parameters htp_param_t *param_p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); htp_param_t *param_q = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); // Request headers htp_tx_req_set_header(tx, "Host", 4, "www.example.com", 15, HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "Connection", 10, "keep-alive", 10, HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "User-Agent", 10, "Mozilla/5.0", 11, HTP_ALLOC_COPY); // Request headers complete htp_tx_state_request_headers(tx); // Check headers ASSERT_EQ(1, user_data.callback_REQUEST_HEADERS_invoked); htp_header_t *h_host = (htp_header_t *) htp_table_get_c(tx->request_headers, "host"); ASSERT_TRUE(h_host != NULL); ASSERT_EQ(0, bstr_cmp_c(h_host->value, "www.example.com")); htp_header_t *h_connection = (htp_header_t *) htp_table_get_c(tx->request_headers, "connection"); ASSERT_TRUE(h_connection != NULL); ASSERT_EQ(0, bstr_cmp_c(h_connection->value, "keep-alive")); htp_header_t *h_ua = (htp_header_t *) htp_table_get_c(tx->request_headers, "user-agent"); ASSERT_TRUE(h_ua != NULL); ASSERT_EQ(0, bstr_cmp_c(h_ua->value, "Mozilla/5.0")); // Request complete htp_tx_state_request_complete(tx); ASSERT_EQ(1, user_data.callback_REQUEST_COMPLETE_invoked); // Response begins htp_tx_state_response_start(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_START_invoked); // Response line data htp_tx_res_set_status_line(tx, "HTTP/1.1 200 OK", 15, HTP_ALLOC_COPY); ASSERT_EQ(0, bstr_cmp_c(tx->response_protocol, "HTTP/1.1")); ASSERT_EQ(HTP_PROTOCOL_1_1, tx->response_protocol_number); ASSERT_EQ(200, tx->response_status_number); ASSERT_EQ(0, bstr_cmp_c(tx->response_message, "OK")); htp_tx_res_set_protocol_number(tx, HTP_PROTOCOL_1_0); ASSERT_EQ(HTP_PROTOCOL_1_0, tx->response_protocol_number); htp_tx_res_set_status_code(tx, 500); ASSERT_EQ(500, tx->response_status_number); htp_tx_res_set_status_message(tx, "Internal Server Error", 21, HTP_ALLOC_COPY); ASSERT_EQ(0, bstr_cmp_c(tx->response_message, "Internal Server Error")); // Response line complete htp_tx_state_response_line(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_LINE_invoked); // Response header data htp_tx_res_set_header(tx, "Content-Type", 12, "text/html", 9, HTP_ALLOC_COPY); htp_tx_res_set_header(tx, "Server", 6, "Apache", 6, HTP_ALLOC_COPY); // Response headers complete htp_tx_state_response_headers(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_HEADERS_invoked); // Check response headers htp_header_t *h_content_type = (htp_header_t *) htp_table_get_c(tx->response_headers, "content-type"); ASSERT_TRUE(h_content_type != NULL); ASSERT_EQ(0, bstr_cmp_c(h_content_type->value, "text/html")); htp_header_t *h_server = (htp_header_t *) htp_table_get_c(tx->response_headers, "server"); ASSERT_TRUE(h_server != NULL); ASSERT_EQ(0, bstr_cmp_c(h_server->value, "Apache")); // Response body data htp_tx_res_process_body_data(tx, "

Hello", 9); htp_tx_res_process_body_data(tx, " ", 1); htp_tx_res_process_body_data(tx, "World!

", 11); ASSERT_EQ(1, user_data.response_body_correctly_received); // Check that the API is rejecting NULL data. ASSERT_EQ(HTP_ERROR, htp_tx_res_process_body_data(tx, NULL, 1)); // Trailing response headers htp_tx_res_set_headers_clear(tx); ASSERT_EQ(0, htp_table_size(tx->response_headers)); htp_tx_res_set_header(tx, "Content-Type", 12, "text/html", 9, HTP_ALLOC_COPY); htp_tx_res_set_header(tx, "Server", 6, "Apache", 6, HTP_ALLOC_COPY); // Check trailing response headers h_content_type = (htp_header_t *) htp_table_get_c(tx->response_headers, "content-type"); ASSERT_TRUE(h_content_type != NULL); ASSERT_EQ(0, bstr_cmp_c(h_content_type->value, "text/html")); h_server = (htp_header_t *) htp_table_get_c(tx->response_headers, "server"); ASSERT_TRUE(h_server != NULL); ASSERT_EQ(0, bstr_cmp_c(h_server->value, "Apache")); htp_tx_state_response_complete(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_COMPLETE_invoked); } /** * Use a POST request in order to test request body processing and parameter parsing. */ TEST_F(HybridParsing, PostUrlecodedTest) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Request begins htp_tx_state_request_start(tx); // Request line data htp_tx_req_set_method(tx, "POST", 4, HTP_ALLOC_COPY); htp_tx_req_set_method_number(tx, HTP_M_GET); htp_tx_req_set_uri(tx, "/", 1, HTP_ALLOC_COPY); htp_tx_req_set_protocol(tx, "HTTP/1.1", 8, HTP_ALLOC_COPY); htp_tx_req_set_protocol_number(tx, HTP_PROTOCOL_1_1); htp_tx_req_set_protocol_0_9(tx, 0); // Request line complete htp_tx_state_request_line(tx); // Configure headers to trigger the URLENCODED parser htp_tx_req_set_header(tx, "Content-Type", 12, HTP_URLENCODED_MIME_TYPE, strlen(HTP_URLENCODED_MIME_TYPE), HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "Content-Length", 14, "7", 1, HTP_ALLOC_COPY); // Request headers complete htp_tx_state_request_headers(tx); // Send request body htp_tx_req_process_body_data(tx, "p=1", 3); htp_tx_req_process_body_data(tx, NULL, 0); htp_tx_req_process_body_data(tx, "&", 1); htp_tx_req_process_body_data(tx, "q=2", 3); // Check that the API is rejecting NULL data. ASSERT_EQ(HTP_ERROR, htp_tx_req_process_body_data(tx, NULL, 1)); // Trailing request headers htp_tx_req_set_headers_clear(tx); ASSERT_EQ(0, htp_table_size(tx->request_headers)); htp_tx_req_set_header(tx, "Host", 4, "www.example.com", 15, HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "Connection", 10, "keep-alive", 10, HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "User-Agent", 10, "Mozilla/5.0", 11, HTP_ALLOC_COPY); htp_header_t *h_host = (htp_header_t *) htp_table_get_c(tx->request_headers, "host"); ASSERT_TRUE(h_host != NULL); ASSERT_EQ(0, bstr_cmp_c(h_host->value, "www.example.com")); htp_header_t *h_connection = (htp_header_t *) htp_table_get_c(tx->request_headers, "connection"); ASSERT_TRUE(h_connection != NULL); ASSERT_EQ(0, bstr_cmp_c(h_connection->value, "keep-alive")); htp_header_t *h_ua = (htp_header_t *) htp_table_get_c(tx->request_headers, "user-agent"); ASSERT_TRUE(h_ua != NULL); ASSERT_EQ(0, bstr_cmp_c(h_ua->value, "Mozilla/5.0")); // Request complete htp_tx_state_request_complete(tx); // Check parameters htp_param_t *param_p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); htp_param_t *param_q = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); } static char HybridParsing_CompressedResponse[] = "H4sIAAAAAAAAAG2PwQ6CMBBE73xFU++tXk2pASliAiEhPegRYUOJYEktEP5eqB6dy2ZnJ5O3LJFZ" "yj2WiCBah7zKVPBMT1AjCf2gTWnabmH0e/AY/QXDPLqj8HLO07zw8S52wkiKm1zXvRPeeg//2lbX" "kwpQrauxh5dFqnyj3uVYgJJCxD5W1g5HSud5Jo3WTQek0mR8UgNlDYZOLcz0ZMuH3y+YKzDAaMDJ" "SrihOVL32QceVXUy4QAAAA=="; static void HybridParsing_CompressedResponse_Setup(htp_tx_t *tx) { htp_tx_state_request_start(tx); htp_tx_req_set_method(tx, "GET", 3, HTP_ALLOC_REUSE); htp_tx_req_set_method_number(tx, HTP_M_GET); htp_tx_req_set_uri(tx, "/", 1, HTP_ALLOC_COPY); htp_tx_req_set_protocol(tx, "HTTP/1.1", 8, HTP_ALLOC_REUSE); htp_tx_req_set_protocol_number(tx, HTP_PROTOCOL_1_1); htp_tx_req_set_protocol_0_9(tx, 0); htp_tx_state_request_line(tx); htp_tx_state_request_headers(tx); htp_tx_state_request_complete(tx); htp_tx_state_response_start(tx); htp_tx_res_set_status_line(tx, "HTTP/1.1 200 OK", 15, HTP_ALLOC_REUSE); htp_tx_res_set_header(tx, "Content-Encoding", 16, "gzip", 4, HTP_ALLOC_REUSE); htp_tx_res_set_header(tx, "Content-Length", 14, "187", 3, HTP_ALLOC_REUSE); htp_tx_state_response_headers(tx); bstr *body = htp_base64_decode_mem(HybridParsing_CompressedResponse, strlen(HybridParsing_CompressedResponse)); ASSERT_TRUE(body != NULL); htp_tx_res_process_body_data(tx, bstr_ptr(body), bstr_len(body)); bstr_free(body); htp_tx_state_response_complete(tx); } /** * Test with a compressed response body and decompression enabled. */ TEST_F(HybridParsing, CompressedResponse) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); HybridParsing_CompressedResponse_Setup(tx); ASSERT_EQ(187, tx->response_message_len); ASSERT_EQ(225, tx->response_entity_len); } /** * Test with a compressed response body and decompression disabled. */ TEST_F(HybridParsing, CompressedResponseNoDecompression) { // Disable decompression htp_config_set_response_decompression(cfg, 0); // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); HybridParsing_CompressedResponse_Setup(tx); ASSERT_EQ(187, tx->response_message_len); ASSERT_EQ(187, tx->response_entity_len); } static int HybridParsing_ForcedDecompressionTest_Callback_RESPONSE_HEADERS(htp_tx_t *tx) { tx->response_content_encoding_processing = HTP_COMPRESSION_GZIP; return HTP_OK; } /** * Test forced decompression. */ TEST_F(HybridParsing, ForcedDecompression) { // Disable decompression htp_config_set_response_decompression(cfg, 0); // Register a callback that will force decompression htp_config_register_response_headers(cfg, HybridParsing_ForcedDecompressionTest_Callback_RESPONSE_HEADERS); // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); HybridParsing_CompressedResponse_Setup(tx); ASSERT_EQ(187, tx->response_message_len); ASSERT_EQ(225, tx->response_entity_len); } static int HybridParsing_DisableDecompressionTest_Callback_RESPONSE_HEADERS(htp_tx_t *tx) { tx->response_content_encoding_processing = HTP_COMPRESSION_NONE; return HTP_OK; } /** * Test disabling decompression from a callback. */ TEST_F(HybridParsing, DisableDecompression) { // Disable decompression htp_config_set_response_decompression(cfg, 0); // Register a callback that will force decompression htp_config_register_response_headers(cfg, HybridParsing_DisableDecompressionTest_Callback_RESPONSE_HEADERS); // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); HybridParsing_CompressedResponse_Setup(tx); ASSERT_EQ(187, tx->response_message_len); ASSERT_EQ(187, tx->response_entity_len); } TEST_F(HybridParsing, ParamCaseSensitivity) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Request begins htp_tx_state_request_start(tx); // Request line data htp_tx_req_set_method(tx, "GET", 3, HTP_ALLOC_COPY); htp_tx_req_set_method_number(tx, HTP_M_GET); htp_tx_req_set_uri(tx, "/?p=1&Q=2", 9, HTP_ALLOC_COPY); htp_tx_req_set_protocol(tx, "HTTP/1.1", 8, HTP_ALLOC_COPY); htp_tx_req_set_protocol_number(tx, HTP_PROTOCOL_1_1); htp_tx_req_set_protocol_0_9(tx, 0); // Request line complete htp_tx_state_request_line(tx); // Check the parameters. htp_param_t *param_p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); param_p = htp_tx_req_get_param(tx, "P", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); htp_param_t *param_q = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); param_q = htp_tx_req_get_param_ex(tx, HTP_SOURCE_QUERY_STRING, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); param_q = htp_tx_req_get_param_ex(tx, HTP_SOURCE_QUERY_STRING, "Q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); } /** * Use a POST request in order to test request body processing and parameter * parsing. In hybrid mode, we expect that the body arrives to us dechunked. */ TEST_F(HybridParsing, PostUrlecodedChunked) { // Create a new LibHTP transaction. htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Request begins. htp_tx_state_request_start(tx); // Request line data. htp_tx_req_set_method(tx, "POST", 4, HTP_ALLOC_COPY); htp_tx_req_set_method_number(tx, HTP_M_GET); htp_tx_req_set_uri(tx, "/", 1, HTP_ALLOC_COPY); htp_tx_req_set_protocol(tx, "HTTP/1.1", 8, HTP_ALLOC_COPY); htp_tx_req_set_protocol_number(tx, HTP_PROTOCOL_1_1); htp_tx_req_set_protocol_0_9(tx, 0); htp_tx_state_request_line(tx); // Configure headers to trigger the URLENCODED parser. htp_tx_req_set_header(tx, "Content-Type", 12, HTP_URLENCODED_MIME_TYPE, strlen(HTP_URLENCODED_MIME_TYPE), HTP_ALLOC_COPY); htp_tx_req_set_header(tx, "Transfer-Encoding", 17, "chunked", 7, HTP_ALLOC_COPY); // Request headers complete. htp_tx_state_request_headers(tx); // Send request body. htp_tx_req_process_body_data(tx, "p=1", 3); htp_tx_req_process_body_data(tx, "&", 1); htp_tx_req_process_body_data(tx, "q=2", 3); // Request complete. htp_tx_state_request_complete(tx); // Check the parameters. htp_param_t *param_p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); htp_param_t *param_q = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); } TEST_F(HybridParsing, RequestLineParsing1) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Request begins htp_tx_state_request_start(tx); // Request line data htp_tx_req_set_line(tx, "GET /?p=1&q=2 HTTP/1.0", 22, HTP_ALLOC_COPY); // Request line complete htp_tx_state_request_line(tx); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=1&q=2")); ASSERT_EQ(0, bstr_cmp_c(tx->request_protocol, "HTTP/1.0")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->query, "p=1&q=2")); // Check parameters htp_param_t *param_p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(param_p != NULL); ASSERT_EQ(0, bstr_cmp_c(param_p->value, "1")); htp_param_t *param_q = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(param_q != NULL); ASSERT_EQ(0, bstr_cmp_c(param_q->value, "2")); } TEST_F(HybridParsing, RequestLineParsing2) { htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Feed data to the parser. htp_tx_state_request_start(tx); htp_tx_req_set_line(tx, "GET /", 5, HTP_ALLOC_COPY); htp_tx_state_request_line(tx); // Check the results now. ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_EQ(1, tx->is_protocol_0_9); ASSERT_EQ(HTP_PROTOCOL_0_9, tx->request_protocol_number); ASSERT_TRUE(tx->request_protocol == NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/")); } TEST_F(HybridParsing, ParsedUriSupplied) { htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Feed data to the parser. htp_tx_state_request_start(tx); htp_tx_req_set_line(tx, "GET /?p=1&q=2 HTTP/1.0", 22, HTP_ALLOC_COPY); htp_uri_t *u = htp_uri_alloc(); u->path = bstr_dup_c("/123"); htp_tx_req_set_parsed_uri(tx, u); htp_tx_state_request_line(tx); // Check the results now. ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_protocol != NULL); ASSERT_EQ(HTP_PROTOCOL_1_0, tx->request_protocol_number); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=1&q=2")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/123")); } class HybridParsingNoOpen : public testing::Test { protected: virtual void SetUp() { cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_GENERIC); } virtual void TearDown() { htp_config_destroy(cfg); } htp_cfg_t *cfg; // This must not be in a test stack frame as it will persist to TearDown // as htp user data. HybridParsing_Get_User_Data user_data; }; /** * Test hybrid mode with one complete GET transaction; request then response * with no body. Used to crash in htp_connp_close(). */ TEST_F(HybridParsing, TestRepeatCallbacks) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Configure user data and callbacks htp_tx_set_user_data(tx, &user_data); // Request callbacks RegisterUserCallbacks(); // Request begins htp_tx_state_request_start(tx); ASSERT_EQ(1, user_data.callback_REQUEST_START_invoked); // Request line data htp_tx_req_set_line(tx, "GET / HTTP/1.0", 14, HTP_ALLOC_COPY); // Request line complete htp_tx_state_request_line(tx); ASSERT_EQ(1, user_data.callback_REQUEST_LINE_invoked); // Check request line data ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/")); ASSERT_TRUE(tx->request_protocol != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_protocol, "HTTP/1.0")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/")); // Request headers complete htp_tx_state_request_headers(tx); ASSERT_EQ(1, user_data.callback_REQUEST_HEADERS_invoked); // Request complete htp_tx_state_request_complete(tx); ASSERT_EQ(1, user_data.callback_REQUEST_COMPLETE_invoked); // Response begins htp_tx_state_response_start(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_START_invoked); // Response line data htp_tx_res_set_status_line(tx, "HTTP/1.1 200 OK\r\n", 17, HTP_ALLOC_COPY); // Response line complete htp_tx_state_response_line(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_LINE_invoked); // Response headers complete htp_tx_state_response_headers(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_HEADERS_invoked); // Response complete htp_tx_state_response_complete(tx); ASSERT_EQ(1, user_data.callback_RESPONSE_COMPLETE_invoked); ASSERT_EQ(htp_tx_destroy(tx), HTP_OK); // Close connection CloseConnParser(); ASSERT_EQ(1, user_data.callback_REQUEST_START_invoked); ASSERT_EQ(1, user_data.callback_REQUEST_LINE_invoked); ASSERT_EQ(1, user_data.callback_REQUEST_HEADERS_invoked); ASSERT_EQ(1, user_data.callback_REQUEST_COMPLETE_invoked); ASSERT_EQ(1, user_data.callback_RESPONSE_START_invoked); ASSERT_EQ(1, user_data.callback_RESPONSE_LINE_invoked); ASSERT_EQ(1, user_data.callback_RESPONSE_HEADERS_invoked); ASSERT_EQ(1, user_data.callback_RESPONSE_COMPLETE_invoked); ASSERT_EQ(1, user_data.callback_TRANSACTION_COMPLETE_invoked); } /** * Try to delete a transaction before it is complete. */ TEST_F(HybridParsing, DeleteTransactionBeforeComplete) { // Create a new LibHTP transaction htp_tx_t *tx = htp_connp_tx_create(connp); ASSERT_TRUE(tx != NULL); // Request begins htp_tx_state_request_start(tx); // Request line data htp_tx_req_set_line(tx, "GET / HTTP/1.0", 14, HTP_ALLOC_COPY); ASSERT_EQ(htp_tx_destroy(tx), HTP_ERROR); // Close connection CloseConnParser(); } suricata-3.2.1/libhtp/test/test_multipart.cpp0000644000000000000000000016021613051004451016243 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include #include #include #include "test.h" #include class Multipart : public testing::Test { protected: void parseRequest(char *headers[], char *data[]) { size_t i; // Calculate body length. size_t bodyLen = 0; for (i = 0; data[i] != NULL; i++) { bodyLen += strlen(data[i]); } // Open connection connp = htp_connp_create(cfg); htp_connp_open(connp, "127.0.0.1", 32768, "127.0.0.1", 80, NULL); // Send headers. for (i = 0; headers[i] != NULL; i++) { htp_connp_req_data(connp, NULL, headers[i], strlen(headers[i])); } char buf[32]; snprintf(buf, sizeof (buf), "Content-Length: %zu\r\n", bodyLen); htp_connp_req_data(connp, NULL, buf, strlen(buf)); htp_connp_req_data(connp, NULL, (void *) "\r\n", 2); // Send data. for (i = 0; data[i] != NULL; i++) { htp_connp_req_data(connp, NULL, data[i], strlen(data[i])); } ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_mpartp != NULL); mpartp = tx->request_mpartp; body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); } void parseRequestThenVerify(char *headers[], char *data[]) { parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_TRUE(htp_list_size(body->parts) == 3); ASSERT_FALSE(body->flags & HTP_MULTIPART_INCOMPLETE); // Field 1 htp_multipart_part_t *field1 = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_TRUE(field1 != NULL); ASSERT_EQ(MULTIPART_PART_TEXT, field1->type); ASSERT_TRUE(field1->name != NULL); ASSERT_TRUE(bstr_cmp_c(field1->name, "field1") == 0); ASSERT_TRUE(field1->value != NULL); ASSERT_TRUE(bstr_cmp_c(field1->value, "ABCDEF") == 0); // File 1 htp_multipart_part_t *file1 = (htp_multipart_part_t *) htp_list_get(body->parts, 1); ASSERT_TRUE(file1 != NULL); ASSERT_EQ(MULTIPART_PART_FILE, file1->type); ASSERT_TRUE(file1->name != NULL); ASSERT_TRUE(bstr_cmp_c(file1->name, "file1") == 0); ASSERT_TRUE(file1->file->filename != NULL); ASSERT_TRUE(bstr_cmp_c(file1->file->filename, "file.bin") == 0); // Field 2 htp_multipart_part_t *field2 = (htp_multipart_part_t *) htp_list_get(body->parts, 2); ASSERT_TRUE(field2 != NULL); ASSERT_EQ(MULTIPART_PART_TEXT, field2->type); ASSERT_TRUE(field2->name != NULL); ASSERT_TRUE(bstr_cmp_c(field2->name, "field2") == 0); ASSERT_TRUE(field2->value != NULL); ASSERT_TRUE(bstr_cmp_c(field2->value, "GHIJKL") == 0); } void parseParts(char *parts[]) { mpartp = htp_mpartp_create(cfg, bstr_dup_c("0123456789"), 0 /* flags */); size_t i = 0; for (;;) { if (parts[i] == NULL) break; htp_mpartp_parse(mpartp, parts[i], strlen(parts[i])); i++; } htp_mpartp_finalize(mpartp); body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); } void parsePartsThenVerify(char *parts[]) { parseParts(parts); // Examine the result body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); ASSERT_TRUE(htp_list_size(body->parts) == 2); for (size_t i = 0, n = htp_list_size(body->parts); i < n; i++) { htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, i); switch (i) { case 0: ASSERT_EQ(MULTIPART_PART_TEXT, part->type); ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "field1") == 0); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "ABCDEF") == 0); break; case 1: ASSERT_EQ(MULTIPART_PART_TEXT, part->type); ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "field2") == 0); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "GHIJKL") == 0); break; } } } virtual void SetUp() { cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_APACHE_2); htp_config_register_multipart_parser(cfg); connp = NULL; mpartp = NULL; body = NULL; tx = NULL; } virtual void TearDown() { if (connp != NULL) { htp_connp_destroy_all(connp); } else if (mpartp != NULL) { htp_mpartp_destroy(mpartp); } if (cfg != NULL) { htp_config_destroy(cfg); } } htp_tx_t *tx; htp_connp_t *connp; htp_multipart_t *body; htp_mpartp_t *mpartp; htp_cfg_t *cfg; }; TEST_F(Multipart, Test1) { mpartp = htp_mpartp_create(cfg, bstr_dup_c("---------------------------41184676334"), 0 /* flags */); char *parts[999]; size_t i = 0; parts[i++] = (char *) "-----------------------------41184676334\r\n"; parts[i++] = (char *) "Content-Disposition: form-data;\n name=\"field1\"\r\n"; parts[i++] = (char *) "\r\n"; parts[i++] = (char *) "0123456789\r\n-"; parts[i++] = (char *) "-------------"; parts[i++] = (char *) "---------------41184676334\r\n"; parts[i++] = (char *) "Content-Disposition: form-data;\n name=\"field2\"\r\n"; parts[i++] = (char *) "\r\n"; parts[i++] = (char *) "0123456789\r\n-"; parts[i++] = (char *) "-------------"; parts[i++] = (char *) "--------------X\r\n"; parts[i++] = (char *) "-----------------------------41184676334\r\n"; parts[i++] = (char *) "Content-Disposition: form-data;\n"; parts[i++] = (char *) " "; parts[i++] = (char *) "name=\"field3\"\r\n"; parts[i++] = (char *) "\r\n"; parts[i++] = (char *) "9876543210\r\n"; parts[i++] = (char *) "-----------------------------41184676334\r\n"; parts[i++] = (char *) "Content-Disposition: form-data; name=\"file1\"; filename=\"New Text Document.txt\"\r\nContent-Type: text/plain\r\n\r\n"; parts[i++] = (char *) "1FFFFFFFFFFFFFFFFFFFFFFFFFFF\r\n"; parts[i++] = (char *) "2FFFFFFFFFFFFFFFFFFFFFFFFFFE\r"; parts[i++] = (char *) "3FFFFFFFFFFFFFFFFFFFFFFFFFFF\r\n4FFFFFFFFFFFFFFFFFFFFFFFFF123456789"; parts[i++] = (char *) "\r\n"; parts[i++] = (char *) "-----------------------------41184676334\r\n"; parts[i++] = (char *) "Content-Disposition: form-data; name=\"file2\"; filename=\"New Text Document.txt\"\r\n"; parts[i++] = (char *) "Content-Type: text/plain\r\n"; parts[i++] = (char *) "\r\n"; parts[i++] = (char *) "FFFFFFFFFFFFFFFFFFFFFFFFFFFZ"; parts[i++] = (char *) "\r\n-----------------------------41184676334--"; parts[i++] = NULL; i = 0; for (;;) { if (parts[i] == NULL) break; htp_mpartp_parse(mpartp, parts[i], strlen(parts[i])); i++; } htp_mpartp_finalize(mpartp); // Examine the result htp_multipart_t *body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(5, htp_list_size(body->parts)); for (size_t i = 0, n = htp_list_size(body->parts); i < n; i++) { htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, i); switch (i) { case 0: ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "field1") == 0); ASSERT_EQ(MULTIPART_PART_TEXT, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "0123456789") == 0); break; case 1: ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "field2") == 0); ASSERT_EQ(MULTIPART_PART_TEXT, part->type); ASSERT_TRUE(bstr_cmp_c(part->value, "0123456789\r\n----------------------------X") == 0); break; case 2: ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "field3") == 0); ASSERT_EQ(MULTIPART_PART_TEXT, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "9876543210") == 0); break; case 3: ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "file1") == 0); ASSERT_EQ(MULTIPART_PART_FILE, part->type); break; case 4: ASSERT_TRUE(part->name != NULL); ASSERT_TRUE(bstr_cmp_c(part->name, "file2") == 0); ASSERT_EQ(MULTIPART_PART_FILE, part->type); break; default: FAIL() << "More parts than expected"; break; } } ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); htp_mpartp_destroy(mpartp); mpartp = NULL; } TEST_F(Multipart, Test2) { mpartp = htp_mpartp_create(cfg, bstr_dup_c("BBB"), 0 /* flags */); const char *i1 = "x0000x\n--BBB\n\nx1111x\n--\nx2222x\n--"; const char *i2 = "BBB\n\nx3333x\n--B"; const char *i3 = "B\n\nx4444x\n--BB\r"; const char *i4 = "\n--B"; const char *i5 = "B"; const char *i6 = "B\n\nx5555x\r"; const char *i7 = "\n--x6666x\r"; const char *i8 = "-"; const char *i9 = "-"; htp_mpartp_parse(mpartp, i1, strlen(i1)); htp_mpartp_parse(mpartp, i2, strlen(i2)); htp_mpartp_parse(mpartp, i3, strlen(i3)); htp_mpartp_parse(mpartp, i4, strlen(i4)); htp_mpartp_parse(mpartp, i5, strlen(i5)); htp_mpartp_parse(mpartp, i6, strlen(i6)); htp_mpartp_parse(mpartp, i7, strlen(i7)); htp_mpartp_parse(mpartp, i8, strlen(i8)); htp_mpartp_parse(mpartp, i9, strlen(i9)); htp_mpartp_finalize(mpartp); htp_multipart_t *body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(4, htp_list_size(body->parts)); for (size_t i = 0, n = htp_list_size(body->parts); i < n; i++) { htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, i); switch (i) { case 0: ASSERT_EQ(MULTIPART_PART_PREAMBLE, part->type); ASSERT_TRUE(bstr_cmp_c(part->value, "x0000x") == 0); break; case 1: ASSERT_EQ(MULTIPART_PART_UNKNOWN, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "x1111x\n--\nx2222x") == 0); break; case 2: ASSERT_EQ(MULTIPART_PART_UNKNOWN, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "x3333x\n--BB\n\nx4444x\n--BB") == 0); break; case 3: ASSERT_EQ(MULTIPART_PART_UNKNOWN, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "x5555x\r\n--x6666x\r--") == 0); break; default: FAIL(); } } ASSERT_TRUE(body->flags & HTP_MULTIPART_INCOMPLETE); htp_mpartp_destroy(mpartp); mpartp = NULL; } TEST_F(Multipart, Test3) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n", "--0", "1", "2", "4: Value\r\n", "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); } TEST_F(Multipart, BeginsWithoutLine) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); } TEST_F(Multipart, BeginsWithCrLf) { char *parts[] = { "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); } TEST_F(Multipart, BeginsWithLf) { char *parts[] = { "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); } TEST_F(Multipart, CrLfLineEndings) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_FALSE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_TRUE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, LfLineEndings) { char *parts[] = { "--0123456789\n" "Content-Disposition: form-data; name=\"field1\"\n" "\n" "ABCDEF" "\n--0123456789\n" "Content-Disposition: form-data; name=\"field2\"\n" "\n" "GHIJKL" "\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_FALSE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, CrAndLfLineEndings1) { char *parts[] = { "--0123456789\n" "Content-Disposition: form-data; name=\"field1\"\n" "\n" "ABCDEF" "\r\n--0123456789\n" "Content-Disposition: form-data; name=\"field2\"\n" "\n" "GHIJKL" "\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_TRUE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, CrAndLfLineEndings2) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\n" "\n" "ABCDEF" "\n--0123456789\n" "Content-Disposition: form-data; name=\"field2\"\n" "\n" "GHIJKL" "\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_TRUE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, CrAndLfLineEndings3) { char *parts[] = { "--0123456789\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_TRUE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, CrAndLfLineEndings4) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_LF_LINE); ASSERT_TRUE(body->flags & HTP_MULTIPART_CRLF_LINE); } TEST_F(Multipart, BoundaryInstanceWithLwsAfter) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789 \r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_BBOUNDARY_LWS_AFTER); } TEST_F(Multipart, BoundaryInstanceWithNonLwsAfter1) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789 X \r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_BBOUNDARY_NLWS_AFTER); } TEST_F(Multipart, BoundaryInstanceWithNonLwsAfter2) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789-\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_BBOUNDARY_NLWS_AFTER); } TEST_F(Multipart, BoundaryInstanceWithNonLwsAfter3) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_BBOUNDARY_NLWS_AFTER); } TEST_F(Multipart, WithPreamble) { char *parts[] = { "Preamble" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789 X \r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_HAS_PREAMBLE); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_TRUE(part != NULL); ASSERT_EQ(MULTIPART_PART_PREAMBLE, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "Preamble") == 0); } TEST_F(Multipart, WithEpilogue1) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--\r\n" "Epilogue", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_HAS_EPILOGUE); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 2); ASSERT_TRUE(part != NULL); ASSERT_EQ(MULTIPART_PART_EPILOGUE, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "Epilogue") == 0); ASSERT_FALSE(body->flags & HTP_MULTIPART_INCOMPLETE); ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); } TEST_F(Multipart, WithEpilogue2) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--\r\n" "Epi\nlogue", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_HAS_EPILOGUE); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 2); ASSERT_TRUE(part != NULL); ASSERT_EQ(MULTIPART_PART_EPILOGUE, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "Epi\nlogue") == 0); ASSERT_FALSE(body->flags & HTP_MULTIPART_INCOMPLETE); ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); } TEST_F(Multipart, WithEpilogue3) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--\r\n" "Epi\r", "\n--logue", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_HAS_EPILOGUE); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 2); ASSERT_TRUE(part != NULL); ASSERT_EQ(MULTIPART_PART_EPILOGUE, part->type); ASSERT_TRUE(part->value != NULL); ASSERT_TRUE(bstr_cmp_c(part->value, "Epi\r\n--logue") == 0); ASSERT_FALSE(body->flags & HTP_MULTIPART_INCOMPLETE); ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); } TEST_F(Multipart, WithEpilogue4) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--\r\n" "Epilogue1" "\r\n--0123456789--\r\n" "Epilogue2", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(4, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_HAS_EPILOGUE); htp_multipart_part_t *ep1 = (htp_multipart_part_t *) htp_list_get(body->parts, 2); ASSERT_TRUE(ep1 != NULL); ASSERT_EQ(MULTIPART_PART_EPILOGUE, ep1->type); ASSERT_TRUE(ep1->value != NULL); ASSERT_TRUE(bstr_cmp_c(ep1->value, "Epilogue1") == 0); htp_multipart_part_t *ep2 = (htp_multipart_part_t *) htp_list_get(body->parts, 3); ASSERT_TRUE(ep2 != NULL); ASSERT_EQ(MULTIPART_PART_EPILOGUE, ep2->type); ASSERT_TRUE(ep2->value != NULL); ASSERT_TRUE(bstr_cmp_c(ep2->value, "Epilogue2") == 0); ASSERT_FALSE(body->flags & HTP_MULTIPART_INCOMPLETE); ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); } TEST_F(Multipart, HasLastBoundary) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(2, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY); } TEST_F(Multipart, DoesNotHaveLastBoundary) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789", NULL }; parsePartsThenVerify(parts); ASSERT_FALSE(body->flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY); } TEST_F(Multipart, PartAfterLastBoundary) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789--\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789", NULL }; parsePartsThenVerify(parts); ASSERT_TRUE(body->flags & HTP_MULTIPART_SEEN_LAST_BOUNDARY); } TEST_F(Multipart, UnknownPart) { char *parts[] = { "--0123456789\r\n" "\r\n" "ABCDEF" "\r\n--0123456789--", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(1, htp_list_size(body->parts)); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_EQ(MULTIPART_PART_UNKNOWN, part->type); } TEST_F(Multipart, WithFile) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"; filename=\"test.bin\"\r\n" "Content-Type: application/octet-stream \r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(2, htp_list_size(body->parts)); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 1); ASSERT_EQ(MULTIPART_PART_FILE, part->type); ASSERT_TRUE(part->content_type != NULL); ASSERT_TRUE(bstr_cmp_c(part->content_type, "application/octet-stream") == 0); ASSERT_TRUE(part->file != NULL); ASSERT_TRUE(bstr_cmp_c(part->file->filename, "test.bin") == 0); ASSERT_EQ(6, part->file->len); } TEST_F(Multipart, WithFileExternallyStored) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"; filename=\"test.bin\"\r\n" "Content-Type: application/octet-stream \r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; cfg->extract_request_files = 1; cfg->tmpdir = "/tmp"; parseParts(parts); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(2, htp_list_size(body->parts)); htp_multipart_part_t *part = (htp_multipart_part_t *) htp_list_get(body->parts, 1); ASSERT_EQ(MULTIPART_PART_FILE, part->type); ASSERT_TRUE(part->content_type != NULL); ASSERT_TRUE(bstr_cmp_c(part->content_type, "application/octet-stream") == 0); ASSERT_TRUE(part->file != NULL); ASSERT_TRUE(bstr_cmp_c(part->file->filename, "test.bin") == 0); ASSERT_EQ(6, part->file->len); ASSERT_TRUE(part->file->tmpname != NULL); int fd = open(part->file->tmpname, O_RDONLY | O_BINARY); ASSERT_TRUE(fd >= 0); struct stat statbuf; ASSERT_TRUE((fstat(fd, &statbuf) >= 0)); ASSERT_EQ(6, statbuf.st_size); char buf[7]; ssize_t result = read(fd, buf, 6); ASSERT_EQ(6, result); buf[6] = '\0'; ASSERT_STREQ("GHIJKL", buf); close(fd); } TEST_F(Multipart, PartHeadersEmptyLineBug) { char *parts[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r", "\n" "GHIJKL" "\r\n--0123456789--", NULL }; parsePartsThenVerify(parts); } TEST_F(Multipart, CompleteRequest) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_FALSE(body->flags & HTP_MULTIPART_PART_HEADER_FOLDING); } TEST_F(Multipart, InvalidHeader1) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Colon missing. char *data[] = { "--0123456789\r\n" "Content-Disposition form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidHeader2) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Whitespace after header name. char *data[] = { "--0123456789\r\n" "Content-Disposition : form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidHeader3) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Whitespace before header name. char *data[] = { "--0123456789\r\n" " Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidHeader4) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Invalid header name; contains a space. char *data[] = { "--0123456789\r\n" "Content Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidHeader5) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // No header name. char *data[] = { "--0123456789\r\n" ": form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidHeader6) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // No header name. char *data[] = { "--0123456789\r\n" "Content-Disposition: \r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, NulByte) { mpartp = htp_mpartp_create(cfg, bstr_dup_c("0123456789"), 0 /* flags */); // NUL byte in the part header. char i1[] = "--0123456789\r\n" "Content-Disposition: form-data; "; char i2[] = ""; char i3[] = "name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--"; htp_mpartp_parse(mpartp, i1, strlen(i1)); htp_mpartp_parse(mpartp, i2, 1); htp_mpartp_parse(mpartp, i3, strlen(i3)); htp_mpartp_finalize(mpartp); htp_multipart_t *body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_NUL_BYTE); ASSERT_TRUE(body->flags & HTP_MULTIPART_INVALID); } TEST_F(Multipart, MultipleContentTypeHeadersEvasion) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data\r\n" "Content-Type: boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(tx->request_content_type != NULL); ASSERT_TRUE(bstr_cmp_c(tx->request_content_type, "multipart/form-data") == 0); } TEST_F(Multipart, BoundaryNormal) { char *inputs[] = { "multipart/form-data; boundary=----WebKitFormBoundaryT4AfwQCOgIxNVwlD", "multipart/form-data; boundary=---------------------------21071316483088", "multipart/form-data; boundary=---------------------------7dd13e11c0452", "multipart/form-data; boundary=----------2JL5oh7QWEDwyBllIRc7fh", "multipart/form-data; boundary=----WebKitFormBoundaryre6zL3b0BelnTY5S", NULL }; char *outputs[] = { "----WebKitFormBoundaryT4AfwQCOgIxNVwlD", "---------------------------21071316483088", "---------------------------7dd13e11c0452", "----------2JL5oh7QWEDwyBllIRc7fh", "----WebKitFormBoundaryre6zL3b0BelnTY5S", NULL }; for (size_t i = 0; inputs[i] != NULL; i++) { bstr *input = bstr_dup_c(inputs[i]); bstr *boundary = NULL; uint64_t flags = 0; SCOPED_TRACE(inputs[i]); htp_status_t rc = htp_mpartp_find_boundary(input, &boundary, &flags); ASSERT_EQ(HTP_OK, rc); ASSERT_TRUE(boundary != NULL); ASSERT_TRUE(bstr_cmp_c(boundary, outputs[i]) == 0); ASSERT_EQ(0, flags); bstr_free(boundary); bstr_free(input); } } TEST_F(Multipart, BoundaryParsing) { char *inputs[] = { "multipart/form-data; boundary=1 ", "multipart/form-data; boundary=1, boundary=2", "multipart/form-data; boundary=\"1\"", "multipart/form-data; boundary=\"1\" ", "multipart/form-data; boundary=\"1", NULL }; char *outputs[] = { "1", "1", "1", "1", "\"1", NULL }; for (size_t i = 0; inputs[i] != NULL; i++) { bstr *input = bstr_dup_c(inputs[i]); bstr *boundary = NULL; uint64_t flags = 0; SCOPED_TRACE(inputs[i]); htp_status_t rc = htp_mpartp_find_boundary(input, &boundary, &flags); ASSERT_EQ(HTP_OK, rc); ASSERT_TRUE(boundary != NULL); ASSERT_TRUE(bstr_cmp_c(boundary, outputs[i]) == 0); bstr_free(boundary); bstr_free(input); } } TEST_F(Multipart, BoundaryInvalid) { char *inputs[] = { "multipart/form-data boundary=1", "multipart/form-data ; boundary=1", "multipart/form-data, boundary=1", "multipart/form-data , boundary=1", "multipart/form-datax; boundary=1", "multipart/; boundary=1", "multipart; boundary=1", "application/octet-stream; boundary=1", "boundary=1", "multipart/form-data; boundary", "multipart/form-data; boundary=", "multipart/form-data; boundaryX=", "multipart/form-data; boundary=\"\"", "multipart/form-data; bounDary=1", "multipart/form-data; boundary=1; boundary=2", "multipart/form-data; boundary=1 2", "multipart/form-data boundary=01234567890123456789012345678901234567890123456789012345678901234567890123456789", NULL }; for (size_t i = 0; inputs[i] != NULL; i++) { bstr *input = bstr_dup_c(inputs[i]); bstr *boundary = NULL; uint64_t flags = 0; SCOPED_TRACE(inputs[i]); htp_status_t rc = htp_mpartp_find_boundary(input, &boundary, &flags); ASSERT_TRUE(rc != HTP_ERROR); ASSERT_TRUE(flags & HTP_MULTIPART_HBOUNDARY_INVALID); bstr_free(boundary); bstr_free(input); } } TEST_F(Multipart, BoundaryUnusual) { char *inputs[] = { "multipart/form-data; boundary=1 ", "multipart/form-data; boundary =1", "multipart/form-data; boundary= 1", "multipart/form-data; boundary=\"1\"", "multipart/form-data; boundary=\" 1 \"", //"multipart/form-data; boundary=1-2", "multipart/form-data; boundary=\"1?2\"", NULL }; for (size_t i = 0; inputs[i] != NULL; i++) { bstr *input = bstr_dup_c(inputs[i]); bstr *boundary = NULL; uint64_t flags = 0; SCOPED_TRACE(inputs[i]); htp_status_t rc = htp_mpartp_find_boundary(input, &boundary, &flags); ASSERT_EQ(HTP_OK, rc); ASSERT_TRUE(boundary != NULL); ASSERT_TRUE(flags & HTP_MULTIPART_HBOUNDARY_UNUSUAL); bstr_free(boundary); bstr_free(input); } } TEST_F(Multipart, CaseInsitiveBoundaryMatching) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=grumpyWizards\r\n", NULL }; // The second boundary is all-lowercase and shouldn't be matched on. char *data[] = { "--grumpyWizards\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n-grumpywizards\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--grumpyWizards\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--grumpyWizards--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(2, htp_list_size(body->parts)); } TEST_F(Multipart, FoldedContentDisposition) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\";\r\n" " filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_FOLDING); } TEST_F(Multipart, FoldedContentDisposition2) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\";\r\n" "\rfilename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_FOLDING); } TEST_F(Multipart, InvalidPartNoData) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // The first part terminates abruptly by the next boundary. This // actually works in PHP because its part header parser will // consume everything (even boundaries) until the next empty line. char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); htp_multipart_part_t *field1 = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_TRUE(field1 != NULL); ASSERT_EQ(MULTIPART_PART_UNKNOWN, field1->type); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INCOMPLETE); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidPartNoContentDisposition) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // A part without a Content-Disposition header. char *data[] = { "--0123456789\r\n" "Content-Type: text/html\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_UNKNOWN); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidPartMultipleCD) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // When we encounter a part with more than one C-D header, we // don't know which one the backend will use. Thus, we raise // HTP_MULTIPART_PART_INVALID. char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "Content-Disposition: form-data; name=\"field3\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_REPEATED); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidPartUnknownHeader) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Unknown C-D header "Unknown". char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "Unknown: Header\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_HEADER_UNKNOWN); ASSERT_TRUE(body->flags & HTP_MULTIPART_PART_INVALID); } TEST_F(Multipart, InvalidContentDispositionMultipleParams1) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Two "name" parameters in a C-D header. char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"; name=\"field3\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_PARAM_REPEATED); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_INVALID); } TEST_F(Multipart, InvalidContentDispositionMultipleParams2) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Two "filename" parameters in a C-D header. char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"; filename=\"file2.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_PARAM_REPEATED); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_INVALID); } TEST_F(Multipart, InvalidContentDispositionUnknownParam) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; // Unknown C-D parameter "test". char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\"; test=\"param\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_PARAM_UNKNOWN); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_INVALID); } TEST_F(Multipart, InvalidContentDispositionSyntax) { char *inputs[] = { // Parameter value not quoted. "form-data; name=field1", // Using single quotes around parameter value. "form-data; name='field1'", // No semicolon after form-data in the C-D header. "form-data name=\"field1\"", // No semicolon after C-D parameter. "form-data; name=\"file1\" filename=\"file.bin\"", // Missing terminating quote in C-D parameter value. "form-data; name=\"field1", // Backslash as the last character in parameter value "form-data; name=\"field1\\", // C-D header does not begin with "form-data". "invalid-syntax; name=\"field1", // Escape the terminating double quote. "name=\"field1\\\"", // Incomplete header. "form-data; ", // Incomplete header. "form-data; name", // Incomplete header. "form-data; name ", // Incomplete header. "form-data; name ?", // Incomplete header. "form-data; name=", // Incomplete header. "form-data; name= ", NULL }; for (size_t i = 0; inputs[i] != NULL; i++) { SCOPED_TRACE(inputs[i]); mpartp = htp_mpartp_create(cfg, bstr_dup_c("123"), 0 /* flags */); htp_multipart_part_t *part = (htp_multipart_part_t *) calloc(1, sizeof (htp_multipart_part_t)); part->headers = htp_table_create(4); part->parser = mpartp; htp_header_t *h = (htp_header_t *) calloc(1, sizeof (htp_header_t)); h->name = bstr_dup_c("Content-Disposition"); h->value = bstr_dup_c(inputs[i]); htp_table_add(part->headers, h->name, h); htp_status_t rc = htp_mpart_part_parse_c_d(part); ASSERT_EQ(HTP_DECLINED, rc); body = htp_mpartp_get_multipart(mpartp); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_SYNTAX_INVALID); ASSERT_TRUE(body->flags & HTP_MULTIPART_CD_INVALID); htp_mpart_part_destroy(part, 0); htp_mpartp_destroy(mpartp); mpartp = NULL; } } TEST_F(Multipart, ParamValueEscaping) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"---\\\"---\\\\---\"\r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequest(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); ASSERT_EQ(3, htp_list_size(body->parts)); ASSERT_FALSE(body->flags & HTP_MULTIPART_CD_INVALID); htp_multipart_part_t *field1 = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_TRUE(field1 != NULL); ASSERT_EQ(MULTIPART_PART_TEXT, field1->type); ASSERT_TRUE(field1->name != NULL); ASSERT_TRUE(bstr_cmp_c(field1->name, "---\"---\\---") == 0); ASSERT_TRUE(field1->value != NULL); ASSERT_TRUE(bstr_cmp_c(field1->value, "ABCDEF") == 0); } TEST_F(Multipart, HeaderValueTrim) { char *headers[] = { "POST / HTTP/1.0\r\n" "Content-Type: multipart/form-data; boundary=0123456789\r\n", NULL }; char *data[] = { "--0123456789\r\n" "Content-Disposition: form-data; name=\"field1\" \r\n" "\r\n" "ABCDEF" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"file.bin\"\r\n" "\r\n" "FILEDATA" "\r\n--0123456789\r\n" "Content-Disposition: form-data; name=\"field2\"\r\n" "\r\n" "GHIJKL" "\r\n--0123456789--", NULL }; parseRequestThenVerify(headers, data); ASSERT_TRUE(body != NULL); ASSERT_TRUE(body->parts != NULL); htp_multipart_part_t *field1 = (htp_multipart_part_t *) htp_list_get(body->parts, 0); ASSERT_TRUE(field1 != NULL); htp_header_t *h = (htp_header_t *) htp_table_get_c(field1->headers, "content-disposition"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(bstr_cmp_c(h->value, "form-data; name=\"field1\" ") == 0); } suricata-3.2.1/libhtp/test/test_bstr.cpp0000644000000000000000000003671113051004451015176 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @brief Test for the bstr code. * * @author Craig Forbes */ #include #include #include TEST(BstrTest, Alloc) { bstr *p1; p1 = bstr_alloc(10); EXPECT_EQ(10, bstr_size(p1)); EXPECT_EQ(0, bstr_len(p1)); bstr_free(p1); } TEST(BstrTest, ExpandLocal) { bstr *p1; bstr *p2; p1 = bstr_alloc(10); p2 = bstr_expand(p1, 100); ASSERT_NE(reinterpret_cast(NULL), p2); EXPECT_EQ(100, bstr_size(p2)); EXPECT_EQ(0, bstr_len(p2)); bstr_free(p2); } TEST(BstrTest, ExpandSmaller) { bstr *p1; bstr *p2; p1 = bstr_alloc(100); p2 = bstr_expand(p1, 10); ASSERT_TRUE(p2 == NULL); bstr_free(p1); } TEST(BstrTest, ExpandPtr) { bstr *b; b = (bstr*) malloc(sizeof(bstr)); ASSERT_NE((bstr*)NULL, b); b->realptr = (unsigned char*) malloc(10); b->len = 0; b->size = 10; ASSERT_NE((unsigned char*)NULL, bstr_ptr(b)); bstr *p2 = bstr_expand(b, 100); EXPECT_TRUE(p2 == NULL); free(b->realptr); bstr_free(b); } /* // For the time being, expansion is not allowed // when data is externally stored. This feature // is currently only used when wrapping existing // memory areas. TEST(BstrTest, ExpandPtr) { bstr *b; b = (bstr*) malloc(sizeof(bstr)); ASSERT_NE((bstr*)NULL, b); b->ptr = (unsigned char*) malloc(10); b->len = 0; b->size = 10; ASSERT_NE((unsigned char*)NULL, bstr_ptr(b)); bstr *p2; p2 = bstr_expand(b, 100); EXPECT_TRUE(p2 != NULL); EXPECT_EQ(100, bstr_size(p2)); EXPECT_EQ(0, bstr_len(p2)); free(p2->ptr); bstr_free(p2); } */ TEST(BstrTest, DupC) { bstr *p1; p1 = bstr_dup_c("arfarf"); EXPECT_EQ(6, bstr_size(p1)); EXPECT_EQ(6, bstr_len(p1)); EXPECT_EQ(0, memcmp("arfarf", bstr_ptr(p1), 6)); bstr_free(p1); } TEST(BstrTest, DupStr) { bstr *p1; bstr *p2; p1 = bstr_dup_c("s0123456789abcdefghijklmnopqrstuvwxyz"); p2 = bstr_dup(p1); EXPECT_EQ(bstr_len(p1), bstr_len(p2)); EXPECT_EQ(0, memcmp(bstr_ptr(p1), bstr_ptr(p2), bstr_len(p1))); bstr_free(p1); bstr_free(p2); } TEST(BstrTest, DupBin) { bstr *src = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); bstr *dst; dst = bstr_dup(src); EXPECT_EQ(bstr_len(src), bstr_len(dst)); EXPECT_EQ(0, memcmp(bstr_ptr(src), bstr_ptr(dst), bstr_len(src))); bstr_free(src); bstr_free(dst); } TEST(BstrTest, DupEx) { bstr *p1; bstr *p2; p1 = bstr_dup_c("0123456789abcdefghijkl"); p2 = bstr_dup_ex(p1, 4, 10); EXPECT_EQ(10, bstr_size(p2)); EXPECT_EQ(10, bstr_len(p2)); EXPECT_EQ(0, memcmp("456789abcd", bstr_ptr(p2),10)); bstr_free(p1); bstr_free(p2); } TEST(BstrTest, DupMem) { bstr *dst; dst = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 18); EXPECT_EQ(0, memcmp("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", bstr_ptr(dst), 18)); bstr_free(dst); } TEST(BstrTest, DupLower) { bstr *p1; bstr *p2; p1 = bstr_dup_c("0123456789ABCDEFGhIJKL"); p2 = bstr_dup_lower(p1); EXPECT_EQ(0, memcmp("0123456789abcdefghijkl", bstr_ptr(p2), 22)); bstr_free(p1); bstr_free(p2); } TEST(BstrTest, ChrRchr) { bstr *p1 = bstr_dup_c("0123456789abcdefghijklmnopqrstuvwxyz"); EXPECT_EQ(13, bstr_chr(p1, 'd')); EXPECT_EQ(-1, bstr_chr(p1, '?')); EXPECT_EQ(13, bstr_chr(p1, 'd')); EXPECT_EQ(-1, bstr_chr(p1, '?')); bstr_free(p1); } TEST(BstrTest, Cmp) { bstr *p1; bstr *p2; bstr *p3; bstr *p4; p1 = bstr_dup_c("arfarf"); p2 = bstr_dup_c("arfarf"); p3 = bstr_dup_c("arfArf"); p4 = bstr_dup_c("arfarf2"); EXPECT_EQ(0, bstr_cmp(p1,p1)); EXPECT_EQ(0, bstr_cmp(p1,p2)); EXPECT_EQ(0, bstr_cmp(p2,p1)); EXPECT_EQ(1, bstr_cmp(p1,p3)); EXPECT_EQ(-1, bstr_cmp(p3,p1)); EXPECT_EQ(-1, bstr_cmp(p1,p4)); EXPECT_EQ(1, bstr_cmp(p4,p1)); bstr_free(p1); bstr_free(p2); bstr_free(p3); bstr_free(p4); } TEST(BstrTest, CmpNocase) { bstr *p1; bstr *p2; bstr *p3; p1 = bstr_dup_c("arfarf"); p2 = bstr_dup_c("arfarf"); p3 = bstr_dup_c("arfArf"); EXPECT_EQ(0, bstr_cmp_nocase(p1,p1)); EXPECT_EQ(0, bstr_cmp_nocase(p1,p2)); EXPECT_EQ(0, bstr_cmp_nocase(p2,p1)); EXPECT_EQ(0, bstr_cmp_nocase(p1,p3)); EXPECT_EQ(0, bstr_cmp_nocase(p3,p1)); bstr_free(p1); bstr_free(p2); bstr_free(p3); } TEST(BstrTest, CmpC) { bstr *p1; p1 = bstr_dup_c("arfarf"); EXPECT_EQ(0, bstr_cmp_c(p1, "arfarf")); EXPECT_EQ(-1, bstr_cmp_c(p1, "arfarf2")); EXPECT_EQ(1, bstr_cmp_c(p1, "arf")); EXPECT_EQ(-1, bstr_cmp_c(p1, "not equal")); bstr_free(p1); } TEST(BstrTest, CmpCNocase) { bstr *p1; p1 = bstr_dup_c("arfarf"); EXPECT_EQ(0, bstr_cmp_c_nocase(p1, "arfarf")); EXPECT_EQ(0, bstr_cmp_c_nocase(p1, "arfARF")); EXPECT_EQ(1, bstr_cmp_c_nocase(p1, "ArF")); EXPECT_EQ(-1, bstr_cmp_c_nocase(p1, "Not equal")); bstr_free(p1); } TEST(BstrTest, CmpEx) { const char *s1 = "arfarf12345"; const char *s2 = "arfarF2345"; EXPECT_EQ(0, bstr_util_cmp_mem(s1, 5, s2, 5)); EXPECT_EQ(1, bstr_util_cmp_mem(s1, 6, s2, 6)); EXPECT_EQ(1, bstr_util_cmp_mem(s1, 5, s2, 4)); EXPECT_EQ(-1, bstr_util_cmp_mem(s2, 4, s1, 5)); } TEST(BstrTest, CmpNocaseEx) { const char *s1 = "arfarf12345"; const char *s2 = "arfarF2345"; EXPECT_EQ(0, bstr_util_cmp_mem_nocase(s1, 6, s2, 6)); EXPECT_EQ(1, bstr_util_cmp_mem_nocase(s1, 6, s2, 5)); EXPECT_EQ(-1, bstr_util_cmp_mem_nocase(s2, 5, s1, 6)); } TEST(BstrTest, CmpMem) { bstr *s = bstr_dup_c("arfArf"); EXPECT_EQ(0, bstr_cmp_mem(s, "arfArf", 6)); bstr_free(s); } TEST(BstrTest, ToLowercase) { bstr *p1; bstr *p2; p1 = bstr_dup_c("aRf3ArF"); p2 = bstr_to_lowercase(p1); EXPECT_EQ(p1, p2); EXPECT_EQ(1, bstr_cmp_c(p1, "aRf3ArF")); EXPECT_EQ(0, bstr_cmp_c(p1, "arf3arf")); bstr_free(p1); } TEST(BstrTest, Add) { bstr *src1; bstr *src2; bstr *dest; src1 = bstr_dup_c("testtest"); src2 = bstr_dup_c("0123456789abcdefghijklmnopqrstuvwxyz"); dest = bstr_add(src1, src2); EXPECT_EQ(0, bstr_cmp_c(dest, "testtest0123456789abcdefghijklmnopqrstuvwxyz")); // src1 is either invalid or the same as dest after bstr_add bstr_free(src2); bstr_free(dest); } TEST(BstrTest, AddC) { bstr *p1; bstr *p2; p1 = bstr_dup_c("testtest"); p2 = bstr_add_c(p1, "1234"); EXPECT_EQ(0, bstr_cmp_c(p2, "testtest1234")); bstr_free(p2); } TEST(BstrTest, AddMem) { bstr *p1; bstr *p2; p1 = bstr_dup_c("testtest"); p2 = bstr_add_mem(p1, "12345678", 4); EXPECT_EQ(0, bstr_cmp_c(p2, "testtest1234")); bstr_free(p2); } TEST(BstrTest, AddNoex) { bstr *p1; bstr *p2; bstr *p3; p1 = bstr_alloc(10); p1 = bstr_add_c(p1, "12345"); p2 = bstr_dup_c("abcdef"); p3 = bstr_add_noex(p1,p2); EXPECT_EQ(p1,p3); EXPECT_EQ(0,bstr_cmp_c(p3,"12345abcde")); bstr_free(p1); bstr_free(p2); } TEST(BstrTest, AddCNoex) { bstr *p1; bstr *p2; p1 = bstr_alloc(10); p1 = bstr_add_c(p1, "12345"); p2 = bstr_add_c_noex(p1,"abcdefghijk"); EXPECT_EQ(p1,p2); EXPECT_EQ(0,bstr_cmp_c(p2,"12345abcde")); bstr_free(p1); } TEST(BstrTest, AddMemNoex) { bstr *p1; bstr *p2; p1 = bstr_alloc(10); p1 = bstr_add_c(p1, "12345"); p2 = bstr_add_mem_noex(p1,"abcdefghijklmnop",6); EXPECT_EQ(p1,p2); EXPECT_EQ(0,bstr_cmp_c(p2,"12345abcde")); bstr_free(p1); } TEST(BstrTest, IndexOf) { bstr *haystack = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); bstr *p1 = bstr_dup_c("NOPQ"); bstr *p2 = bstr_dup_c("siej"); bstr *p3 = bstr_dup_c("TUVWXYZ"); bstr *p4 = bstr_dup_c("nopq"); EXPECT_EQ(13, bstr_index_of(haystack, p1)); EXPECT_EQ(-1, bstr_index_of(haystack, p2)); EXPECT_EQ(-1, bstr_index_of(haystack, p3)); EXPECT_EQ(-1, bstr_index_of(haystack, p4)); EXPECT_EQ(13, bstr_index_of_nocase(haystack, p4)); EXPECT_EQ(16, bstr_index_of_c(haystack, "QRS")); EXPECT_EQ(-1, bstr_index_of_c(haystack, "qrs")); EXPECT_EQ(16, bstr_index_of_c_nocase(haystack, "qrs")); EXPECT_EQ(16, bstr_index_of_mem(haystack, "QRSSDF",3)); EXPECT_EQ(-1, bstr_index_of_mem(haystack, "qrssdf",3)); EXPECT_EQ(16, bstr_index_of_mem_nocase(haystack, "qrssdf",3)); bstr_free(p1); bstr_free(p2); bstr_free(p3); bstr_free(p4); bstr_free(haystack); } TEST(BstrTest, MemIndexOf) { EXPECT_EQ(0, bstr_util_mem_index_of_c("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20, "ABC")); EXPECT_EQ(-1, bstr_util_mem_index_of_c("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20, "ABD")); EXPECT_EQ(-1, bstr_util_mem_index_of_c("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20, "CBA")); } TEST(BstrTest, BeginsWith) { bstr *haystack = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); bstr *p1 = bstr_dup_c("ABCD"); bstr *p2 = bstr_dup_c("aBcD"); EXPECT_EQ(1, bstr_begins_with(haystack,p1)); EXPECT_NE(1, bstr_begins_with(haystack,p2)); EXPECT_EQ(1, bstr_begins_with_nocase(haystack,p2)); EXPECT_EQ(1, bstr_begins_with_c(haystack, "AB")); EXPECT_NE(1, bstr_begins_with_c(haystack, "ab")); EXPECT_EQ(1, bstr_begins_with_c_nocase(haystack, "ab")); EXPECT_EQ(1, bstr_begins_with_mem(haystack, "ABq",2)); EXPECT_NE(1, bstr_begins_with_mem(haystack, "abq",2)); EXPECT_EQ(1, bstr_begins_with_mem_nocase(haystack, "abq",2)); bstr_free(p1); bstr_free(p2); bstr_free(haystack); } TEST(BstrTest, BeginsWith2) { bstr *haystack = bstr_dup_c("ABC"); bstr *p1 = bstr_dup_c("ABCD"); bstr *p2 = bstr_dup_c("EDFG"); EXPECT_EQ(0, bstr_begins_with_mem(haystack, bstr_ptr(p1), bstr_len(p1))); EXPECT_EQ(0, bstr_begins_with_mem_nocase(haystack, bstr_ptr(p1), bstr_len(p1))); EXPECT_EQ(0, bstr_begins_with_mem_nocase(haystack, bstr_ptr(p2), bstr_len(p2))); bstr_free(p1); bstr_free(p2); bstr_free(haystack); } TEST(BstrTest, CharAt) { bstr *str = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); EXPECT_EQ('\000', bstr_char_at(str, 12)); EXPECT_EQ(-1, bstr_char_at(str, 45)); bstr_free(str); } TEST(BstrTest, CharAtEnd) { bstr *str = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); EXPECT_EQ('T', bstr_char_at_end(str, 0)); EXPECT_EQ('\000', bstr_char_at_end(str, 7)); EXPECT_EQ(-1, bstr_char_at_end(str, bstr_len(str))); bstr_free(str); } TEST(BstrTest, Chop) { bstr *p1 = bstr_dup_c("abcdef"); bstr *p2 = bstr_alloc(10); bstr_chop(p1); EXPECT_EQ(0, bstr_cmp_c(p1,"abcde")); bstr_chop(p2); EXPECT_EQ(0, bstr_len(p2)); bstr_free(p1); bstr_free(p2); } TEST(BstrTest, AdjustLen) { bstr *p1 = bstr_dup_c("abcdef"); bstr_adjust_len(p1, 3); EXPECT_EQ(3, bstr_len(p1)); EXPECT_EQ(0, bstr_cmp_c(p1,"abc")); bstr_free(p1); } TEST(BstrTest, ToPint) { size_t lastlen; EXPECT_EQ(-1, bstr_util_mem_to_pint("abc", 3, 10, &lastlen)); EXPECT_EQ(-2, bstr_util_mem_to_pint("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 40, 16, &lastlen)); EXPECT_EQ(0x7fffffffffffffffLL, bstr_util_mem_to_pint("7fffffffffffffff", 16, 16, &lastlen)); EXPECT_EQ(-2, bstr_util_mem_to_pint("9223372036854775808", 19, 10, &lastlen)); EXPECT_EQ(0xabc, bstr_util_mem_to_pint("abc", 3, 16, &lastlen)); EXPECT_EQ(4, lastlen); EXPECT_EQ(0xabc, bstr_util_mem_to_pint("ABC", 3, 16, &lastlen)); EXPECT_EQ(131, bstr_util_mem_to_pint("abc", 3, 12, &lastlen)); EXPECT_EQ(2, lastlen); EXPECT_EQ(83474, bstr_util_mem_to_pint("83474abc", 8, 10, &lastlen)); EXPECT_EQ(5, lastlen); EXPECT_EQ(5, bstr_util_mem_to_pint("0101", 4, 2, &lastlen)); EXPECT_EQ(5, lastlen); EXPECT_EQ(5, bstr_util_mem_to_pint("0101", 4, 2, &lastlen)); EXPECT_EQ(5, lastlen); } TEST(BstrTest, DupToC) { char *c; bstr *str = bstr_dup_mem("ABCDEFGHIJKL\000NOPQRSTUVWXYZ", 20); c = bstr_util_memdup_to_c("1234\0006789", 9); EXPECT_STREQ("1234\\06789", c); free(c); c = bstr_util_strdup_to_c(str); EXPECT_STREQ("ABCDEFGHIJKL\\0NOPQRST", c); free(c); bstr_free(str); } TEST(BstrTest, RChr) { bstr *b = bstr_dup_c("---I---I---"); EXPECT_EQ(bstr_rchr(b, 'I'), 7); EXPECT_EQ(bstr_rchr(b, 'M'), -1); bstr_free(b); } TEST(BstrTest, AdjustRealPtr) { bstr *b = bstr_dup_c("ABCDEFGHIJKLMNOPQRSTUVWXYZ"); char c[] = "0123456789"; bstr_adjust_realptr(b, c); bstr_adjust_len(b, strlen(c)); EXPECT_TRUE((char *)bstr_ptr(b) == c); bstr_free(b); } TEST(BstrTest, UtilMemTrim) { char d[] = " \r\t0123456789\f\v "; char *data = &d[0]; size_t len = strlen(data); bstr_util_mem_trim((unsigned char **)&data, &len); EXPECT_EQ(0, bstr_util_cmp_mem(data, len, "0123456789", 10)); } TEST(BstrTest, Wrap) { bstr *s = bstr_wrap_c("ABC"); EXPECT_EQ(0, bstr_cmp_mem(s, "ABC", 3)); bstr_free(s); } TEST(BstrBuilder, CreateDestroy) { bstr_builder_t *bb = bstr_builder_create(); EXPECT_EQ(0, bstr_builder_size(bb)); bstr_builder_append_c(bb, "ABC"); bstr_builder_destroy(bb); } TEST(BstrBuilder, Append) { bstr_builder_t *bb = bstr_builder_create(); bstr *str1 = bstr_dup_c("0123456789"); bstr *str2 = bstr_dup_c("abcdefghijklmnopqrstuvwxyz"); EXPECT_EQ(0, bstr_builder_size(bb)); bstr_builder_appendn(bb, str1); bstr_builder_append_c(bb, "#"); bstr_builder_appendn(bb, str2); bstr_builder_append_c(bb, "#"); bstr_builder_append_mem(bb, "!@#$%^&*()", 4); EXPECT_EQ(5, bstr_builder_size(bb)); bstr *result = bstr_builder_to_str(bb); EXPECT_EQ(42, bstr_len(result)); EXPECT_EQ(0, memcmp("0123456789#abcdefghijklmnopqrstuvwxyz#!@#$", bstr_ptr(result),42)); bstr_free(result); bstr_builder_clear(bb); EXPECT_EQ(0, bstr_builder_size(bb)); bstr_builder_destroy(bb); } suricata-3.2.1/libhtp/test/test_main.cpp0000644000000000000000000017114113051004451015145 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * * @author Ivan Ristic */ #include #include #include #include "test.h" class ConnectionParsing : public testing::Test { protected: virtual void SetUp() { home = getenv("srcdir"); if (home == NULL) { fprintf(stderr, "This program needs environment variable 'srcdir' set."); exit(EXIT_FAILURE); } cfg = htp_config_create(); htp_config_set_server_personality(cfg, HTP_SERVER_APACHE_2); htp_config_register_urlencoded_parser(cfg); htp_config_register_multipart_parser(cfg); } virtual void TearDown() { htp_connp_destroy_all(connp); htp_config_destroy(cfg); } htp_connp_t *connp; htp_cfg_t *cfg; char *home; }; TEST_F(ConnectionParsing, AdHoc) { int rc = test_run(home, "00-adhoc.t", cfg, &connp); ASSERT_GE(rc, 0); } TEST_F(ConnectionParsing, Get) { int rc = test_run(home, "01-get.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=%20")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->query != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->query, "p=%20")); htp_param_t *p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, " ")); } TEST_F(ConnectionParsing, ApacheHeaderParsing) { int rc = test_run(home, "02-header-test-apache2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(9, htp_table_size(tx->request_headers)); // Check every header int count = 0; bstr *key = NULL; htp_header_t *h = NULL; for (int i = 0, n = htp_table_size(tx->request_headers); i < n; i++) { h = (htp_header_t *) htp_table_get_index(tx->request_headers, i, &key); switch (count) { case 0: ASSERT_EQ(0, bstr_cmp_c(h->name, " Invalid-Folding")); ASSERT_EQ(0, bstr_cmp_c(h->value, "1")); break; case 1: ASSERT_EQ(0, bstr_cmp_c(h->name, "Valid-Folding")); ASSERT_EQ(0, bstr_cmp_c(h->value, "2 2")); break; case 2: ASSERT_EQ(0, bstr_cmp_c(h->name, "Normal-Header")); ASSERT_EQ(0, bstr_cmp_c(h->value, "3")); break; case 3: ASSERT_EQ(0, bstr_cmp_c(h->name, "Invalid Header Name")); ASSERT_EQ(0, bstr_cmp_c(h->value, "4")); break; case 4: ASSERT_EQ(0, bstr_cmp_c(h->name, "Same-Name-Headers")); ASSERT_EQ(0, bstr_cmp_c(h->value, "5, 6")); break; case 5: ASSERT_EQ(0, bstr_cmp_c(h->name, "Empty-Value-Header")); ASSERT_EQ(0, bstr_cmp_c(h->value, "")); break; case 6: ASSERT_EQ(0, bstr_cmp_c(h->name, "")); ASSERT_EQ(0, bstr_cmp_c(h->value, "8, ")); break; case 7: ASSERT_EQ(0, bstr_cmp_c(h->name, "Header-With-LWS-After")); ASSERT_EQ(0, bstr_cmp_c(h->value, "9")); break; case 8: ASSERT_EQ(0, bstr_cmp_c(h->name, "Header-With-NUL")); ASSERT_EQ(0, bstr_cmp_c(h->value, "BEFORE")); break; } count++; } } TEST_F(ConnectionParsing, PostUrlencoded) { int rc = test_run(home, "03-post-urlencoded.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); htp_param_t *p = htp_tx_req_get_param(tx1, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, "0123456789")); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx1->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx1->response_progress); htp_header_t *h = (htp_header_t *)htp_table_get_c(tx1->response_headers, "Server"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(h->value != NULL); ASSERT_EQ(0, bstr_cmp_c(h->value, "Apache")); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx2->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx2->response_progress); h = (htp_header_t *)htp_table_get_c(tx2->response_headers, "Server"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(h->value != NULL); ASSERT_EQ(0, bstr_cmp_c(h->value, "Apache")); } TEST_F(ConnectionParsing, PostUrlencodedChunked) { int rc = test_run(home, "04-post-urlencoded-chunked.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); htp_param_t *p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, "0123456789")); ASSERT_EQ(25, tx->request_message_len); ASSERT_EQ(12, tx->request_entity_len); } TEST_F(ConnectionParsing, Expect) { int rc = test_run(home, "05-expect.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); // The interim header from the 100 response should not be among the final headers. htp_header_t *h = (htp_header_t *) htp_table_get_c(tx->request_headers, "Header1"); ASSERT_TRUE(h == NULL); } TEST_F(ConnectionParsing, UriNormal) { int rc = test_run(home, "06-uri-normal.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); } TEST_F(ConnectionParsing, PipelinedConn) { int rc = test_run(home, "07-pipelined-connection.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); ASSERT_TRUE(connp->conn->flags & HTP_CONN_PIPELINED); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); } TEST_F(ConnectionParsing, NotPipelinedConn) { int rc = test_run(home, "08-not-pipelined-connection.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); ASSERT_FALSE(connp->conn->flags & HTP_CONN_PIPELINED); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_FALSE(tx->flags & HTP_MULTI_PACKET_HEAD); } TEST_F(ConnectionParsing, MultiPacketRequest) { int rc = test_run(home, "09-multi-packet-request-head.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_MULTI_PACKET_HEAD); } TEST_F(ConnectionParsing, HeaderHostParsing) { int rc = test_run(home, "10-host-in-headers.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(4, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_TRUE(tx1->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx1->request_hostname, "www.example.com")); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_TRUE(tx2->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx2->request_hostname, "www.example.com.")); htp_tx_t *tx3 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 2); ASSERT_TRUE(tx3 != NULL); ASSERT_TRUE(tx3->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx3->request_hostname, "www.example.com")); htp_tx_t *tx4 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 3); ASSERT_TRUE(tx4 != NULL); ASSERT_TRUE(tx4->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx4->request_hostname, "www.example.com")); } TEST_F(ConnectionParsing, ResponseWithoutContentLength) { int rc = test_run(home, "11-response-stream-closure.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); } TEST_F(ConnectionParsing, FailedConnectRequest) { int rc = test_run(home, "12-connect-request.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "CONNECT")); ASSERT_EQ(405, tx->response_status_number); } TEST_F(ConnectionParsing, CompressedResponseContentType) { int rc = test_run(home, "13-compressed-response-gzip-ct.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(187, tx->response_message_len); ASSERT_EQ(225, tx->response_entity_len); } TEST_F(ConnectionParsing, CompressedResponseChunked) { int rc = test_run(home, "14-compressed-response-gzip-chunked.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(28261, tx->response_message_len); ASSERT_EQ(159590, tx->response_entity_len); } TEST_F(ConnectionParsing, SuccessfulConnectRequest) { int rc = test_run(home, "15-connect-complete.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); // TODO: Update the test_run() function to provide better // simulation of real traffic. At the moment, it does not // invoke inbound parsing after outbound parsing returns // HTP_DATA_OTHER, which is why the check below fails. //ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "CONNECT")); ASSERT_EQ(200, tx->response_status_number); } TEST_F(ConnectionParsing, ConnectRequestWithExtraData) { int rc = test_run(home, "16-connect-extra.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx1)); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx2)); } TEST_F(ConnectionParsing, Multipart) { int rc = test_run(home, "17-multipart-1.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); htp_param_t *field1 = htp_tx_req_get_param(tx, "field1", 6); ASSERT_TRUE(field1 != NULL); ASSERT_EQ(0, bstr_cmp_c(field1->value, "0123456789")); htp_param_t *field2 = htp_tx_req_get_param(tx, "field2", 6); ASSERT_TRUE(field2 != NULL); ASSERT_EQ(0, bstr_cmp_c(field2->value, "9876543210")); } TEST_F(ConnectionParsing, CompressedResponseDeflate) { int rc = test_run(home, "18-compressed-response-deflate.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(755, tx->response_message_len); ASSERT_EQ(1433, tx->response_entity_len); } TEST_F(ConnectionParsing, UrlEncoded) { int rc = test_run(home, "19-urlencoded-test.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "POST")); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=1&q=2")); htp_param_t *body_p = htp_tx_req_get_param_ex(tx, HTP_SOURCE_BODY, "p", 1); ASSERT_TRUE(body_p != NULL); ASSERT_EQ(0, bstr_cmp_c(body_p->value, "3")); htp_param_t *body_q = htp_tx_req_get_param_ex(tx, HTP_SOURCE_BODY, "q", 1); ASSERT_TRUE(body_q != NULL); ASSERT_EQ(0, bstr_cmp_c(body_q->value, "4")); htp_param_t *body_z = htp_tx_req_get_param_ex(tx, HTP_SOURCE_BODY, "z", 1); ASSERT_TRUE(body_z != NULL); ASSERT_EQ(0, bstr_cmp_c(body_z->value, "5")); } TEST_F(ConnectionParsing, AmbiguousHost) { int rc = test_run(home, "20-ambiguous-host.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(5, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx1)); ASSERT_FALSE(tx1->flags & HTP_HOST_AMBIGUOUS); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx2)); ASSERT_TRUE(tx2->flags & HTP_HOST_AMBIGUOUS); ASSERT_TRUE(tx2->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx2->request_hostname, "example.com")); htp_tx_t *tx3 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 2); ASSERT_TRUE(tx3 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx3)); ASSERT_FALSE(tx3->flags & HTP_HOST_AMBIGUOUS); ASSERT_TRUE(tx3->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx3->request_hostname, "www.example.com")); ASSERT_EQ(8001, tx3->request_port_number); htp_tx_t *tx4 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 3); ASSERT_TRUE(tx4 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx4)); ASSERT_TRUE(tx4->flags & HTP_HOST_AMBIGUOUS); ASSERT_TRUE(tx4->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx4->request_hostname, "www.example.com")); ASSERT_EQ(8002, tx4->request_port_number); htp_tx_t *tx5 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 4); ASSERT_TRUE(tx5 != NULL); ASSERT_TRUE(htp_tx_is_complete(tx5)); ASSERT_FALSE(tx5->flags & HTP_HOST_AMBIGUOUS); ASSERT_TRUE(tx5->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx5->request_hostname, "www.example.com")); ASSERT_EQ(80, tx5->request_port_number); } TEST_F(ConnectionParsing, Http_0_9) { int rc = test_run(home, "21-http09.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); ASSERT_FALSE(connp->conn->flags & HTP_CONN_HTTP_0_9_EXTRA); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); } TEST_F(ConnectionParsing, PhpParamProcessing) { cfg->parameter_processor = htp_php_parameter_processor; int rc = test_run(home, "22-php-param-processing.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); htp_param_t *p1 = htp_tx_req_get_param(tx, "p_q_", 4); ASSERT_TRUE(p1 != NULL); ASSERT_EQ(0, bstr_cmp_c(p1->value, "1")); htp_param_t *p2 = htp_tx_req_get_param(tx, "q", 1); ASSERT_TRUE(p2 != NULL); ASSERT_EQ(0, bstr_cmp_c(p2->value, "2")); htp_param_t *p3 = htp_tx_req_get_param(tx, "z_w", 3); ASSERT_TRUE(p3 != NULL); ASSERT_EQ(0, bstr_cmp_c(p3->value, "3")); } TEST_F(ConnectionParsing, Http11HostMissing) { int rc = test_run(home, "22-http_1_1-host_missing", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_HOST_MISSING); } TEST_F(ConnectionParsing, Http_0_9_Multiple) { int rc = test_run(home, "23-http09-multiple.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); ASSERT_TRUE(connp->conn->flags & HTP_CONN_HTTP_0_9_EXTRA); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); } TEST_F(ConnectionParsing, Http_0_9_Explicit) { int rc = test_run(home, "24-http09-explicit.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(0, tx->is_protocol_0_9); } TEST_F(ConnectionParsing, SmallChunks) { int rc = test_run(home, "25-small-chunks.t", cfg, &connp); ASSERT_GE(rc, 0); } static int ConnectionParsing_RequestHeaderData_REQUEST_HEADER_DATA(htp_tx_data_t *d) { static int counter = 0; switch (counter) { case 0: if (!((d->len == 11) && (memcmp(d->data, "User-Agent:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 0"); counter = -1; } break; case 1: if (!((d->len == 5) && (memcmp(d->data, " Test", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -1; } break; case 2: if (!((d->len == 5) && (memcmp(d->data, " User", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 2"); counter = -1; } break; case 3: if (!((d->len == 30) && (memcmp(d->data, " Agent\nHost: www.example.com\n\n", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 3"); counter = -1; } break; default: if (counter >= 0) { SCOPED_TRACE("Seen more than 4 chunks"); counter = -1; } break; } if (counter >= 0) { counter++; } htp_tx_set_user_data(d->tx, &counter); return HTP_OK; } TEST_F(ConnectionParsing, RequestHeaderData) { htp_config_register_request_header_data(cfg, ConnectionParsing_RequestHeaderData_REQUEST_HEADER_DATA); int rc = test_run(home, "26-request-headers-raw.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); int *counter = (int *) htp_tx_get_user_data(tx); ASSERT_TRUE(counter != NULL); ASSERT_EQ(4, *counter); } static int ConnectionParsing_RequestTrailerData_REQUEST_TRAILER_DATA(htp_tx_data_t *d) { static int counter = 0; switch (counter) { case 0: if (!((d->len == 7) && (memcmp(d->data, "Cookie:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 0"); counter = -1; } break; case 1: if (!((d->len == 6) && (memcmp(d->data, " 2\r\n\r\n", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -2; } break; default: if (counter >= 0) { SCOPED_TRACE("Seen more than 4 chunks"); counter = -3; } break; } if (counter >= 0) { counter++; } htp_tx_set_user_data(d->tx, &counter); return HTP_OK; } TEST_F(ConnectionParsing, RequestTrailerData) { htp_config_register_request_trailer_data(cfg, ConnectionParsing_RequestTrailerData_REQUEST_TRAILER_DATA); int rc = test_run(home, "27-request-trailer-raw.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); int *counter = (int *) htp_tx_get_user_data(tx); ASSERT_TRUE(counter != NULL); ASSERT_EQ(2, *counter); } static int ConnectionParsing_ResponseHeaderData_RESPONSE_HEADER_DATA(htp_tx_data_t *d) { static int counter = 0; switch (counter) { case 0: if (!((d->len == 5) && (memcmp(d->data, "Date:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 0"); counter = -1; } break; case 1: if (!((d->len == 5) && (memcmp(d->data, " Mon,", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -2; } break; case 2: if (!((d->len == 34) && (memcmp(d->data, " 31 Aug 2009 20:25:50 GMT\r\nServer:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 2"); counter = -3; } break; case 3: if (!((d->len == 83) && (memcmp(d->data, " Apache\r\nConnection: close\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\n\r\n", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 3"); counter = -4; } break; default: if (counter >= 0) { SCOPED_TRACE("Seen more than 4 chunks"); counter = -5; } break; } if (counter >= 0) { counter++; } htp_tx_set_user_data(d->tx, &counter); return HTP_OK; } TEST_F(ConnectionParsing, ResponseHeaderData) { htp_config_register_response_header_data(cfg, ConnectionParsing_ResponseHeaderData_RESPONSE_HEADER_DATA); int rc = test_run(home, "28-response-headers-raw.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); int *counter = (int *) htp_tx_get_user_data(tx); ASSERT_TRUE(counter != NULL); ASSERT_EQ(4, *counter); } static int ConnectionParsing_ResponseTrailerData_RESPONSE_TRAILER_DATA(htp_tx_data_t *d) { static int counter = 0; switch (counter) { case 0: if (!((d->len == 11) && (memcmp(d->data, "Set-Cookie:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 0"); counter = -1; } break; case 1: if (!((d->len == 6) && (memcmp(d->data, " name=", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -2; } break; case 2: if (!((d->len == 22) && (memcmp(d->data, "value\r\nAnother-Header:", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -3; } break; case 3: if (!((d->len == 17) && (memcmp(d->data, " Header-Value\r\n\r\n", d->len) == 0))) { SCOPED_TRACE("Mismatch in chunk 1"); counter = -4; } break; default: if (counter >= 0) { SCOPED_TRACE("Seen more than 4 chunks"); counter = -5; } break; } if (counter >= 0) { counter++; } htp_tx_set_user_data(d->tx, &counter); return HTP_OK; } TEST_F(ConnectionParsing, ResponseTrailerData) { htp_config_register_response_trailer_data(cfg, ConnectionParsing_ResponseTrailerData_RESPONSE_TRAILER_DATA); int rc = test_run(home, "29-response-trailer-raw.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); int *counter = (int *) htp_tx_get_user_data(tx); ASSERT_TRUE(counter != NULL); ASSERT_EQ(4, *counter); } TEST_F(ConnectionParsing, GetIPv6) { int rc = test_run(home, "30-get-ipv6.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "http://[::1]:8080/?p=%20")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->hostname, "[::1]")); ASSERT_EQ(8080, tx->parsed_uri->port_number); ASSERT_TRUE(tx->parsed_uri->query != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->query, "p=%20")); htp_param_t *p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_TRUE(p->value != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, " ")); } TEST_F(ConnectionParsing, GetRequestLineNul) { int rc = test_run(home, "31-get-request-line-nul.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=%20")); } TEST_F(ConnectionParsing, InvalidHostname1) { int rc = test_run(home, "32-invalid-hostname.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_HOSTH_INVALID); ASSERT_TRUE(tx->flags & HTP_HOSTU_INVALID); ASSERT_TRUE(tx->flags & HTP_HOST_INVALID); } TEST_F(ConnectionParsing, InvalidHostname2) { int rc = test_run(home, "33-invalid-hostname.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_FALSE(tx->flags & HTP_HOSTH_INVALID); ASSERT_TRUE(tx->flags & HTP_HOSTU_INVALID); ASSERT_TRUE(tx->flags & HTP_HOST_INVALID); } TEST_F(ConnectionParsing, InvalidHostname3) { int rc = test_run(home, "34-invalid-hostname.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_HOSTH_INVALID); ASSERT_FALSE(tx->flags & HTP_HOSTU_INVALID); ASSERT_TRUE(tx->flags & HTP_HOST_INVALID); } TEST_F(ConnectionParsing, API_connp_get_connection) { int rc = test_run(home, "34-invalid-hostname.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(connp->conn, htp_connp_get_connection(connp)); } TEST_F(ConnectionParsing, EarlyResponse) { int rc = test_run(home, "35-early-response.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(htp_tx_is_complete(tx)); } TEST_F(ConnectionParsing, InvalidRequest1) { int rc = test_run(home, "36-invalid-request-1-invalid-c-l.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_HEADERS, tx->request_progress); ASSERT_TRUE(tx->flags & HTP_REQUEST_INVALID); ASSERT_TRUE(tx->flags & HTP_REQUEST_INVALID_C_L); ASSERT_TRUE(tx->request_hostname != NULL); } TEST_F(ConnectionParsing, InvalidRequest2) { int rc = test_run(home, "37-invalid-request-2-t-e-and-c-l.t", cfg, &connp); ASSERT_GE(rc, 0); // No error, flags only. htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_TRUE(tx->flags & HTP_REQUEST_SMUGGLING); ASSERT_TRUE(tx->request_hostname != NULL); } TEST_F(ConnectionParsing, InvalidRequest3) { int rc = test_run(home, "38-invalid-request-3-invalid-t-e.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_HEADERS, tx->request_progress); ASSERT_TRUE(tx->flags & HTP_REQUEST_INVALID); ASSERT_TRUE(tx->flags & HTP_REQUEST_INVALID_T_E); ASSERT_TRUE(tx->request_hostname != NULL); } TEST_F(ConnectionParsing, AutoDestroyCrash) { htp_config_set_tx_auto_destroy(cfg, 1); int rc = test_run(home, "39-auto-destroy-crash.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(4, htp_list_size(connp->conn->transactions)); } TEST_F(ConnectionParsing, AuthBasic) { int rc = test_run(home, "40-auth-basic.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_BASIC, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_auth_username, "ivanr")); ASSERT_TRUE(tx->request_auth_password != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_auth_password, "secret")); } TEST_F(ConnectionParsing, AuthDigest) { int rc = test_run(home, "41-auth-digest.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_DIGEST, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_auth_username, "ivanr")); ASSERT_TRUE(tx->request_auth_password == NULL); } TEST_F(ConnectionParsing, Http_0_9_MethodOnly) { int rc = test_run(home, "42-http_0_9-method_only.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "HELLO")); ASSERT_TRUE(tx->request_uri == NULL); ASSERT_EQ(1, tx->is_protocol_0_9); } TEST_F(ConnectionParsing, InvalidProtocol) { int rc = test_run(home, "43-invalid-protocol.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_PROTOCOL_INVALID, tx->request_protocol_number); } TEST_F(ConnectionParsing, AuthBasicInvalid) { int rc = test_run(home, "44-auth-basic-invalid.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_BASIC, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username == NULL); ASSERT_TRUE(tx->request_auth_password == NULL); ASSERT_TRUE(tx->flags & HTP_AUTH_INVALID); } TEST_F(ConnectionParsing, AuthDigestUnquotedUsername) { int rc = test_run(home, "45-auth-digest-unquoted-username.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_DIGEST, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username == NULL); ASSERT_TRUE(tx->request_auth_password == NULL); ASSERT_TRUE(tx->flags & HTP_AUTH_INVALID); } TEST_F(ConnectionParsing, AuthDigestInvalidUsername1) { int rc = test_run(home, "46-auth-digest-invalid-username.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_DIGEST, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username == NULL); ASSERT_TRUE(tx->request_auth_password == NULL); ASSERT_TRUE(tx->flags & HTP_AUTH_INVALID); } TEST_F(ConnectionParsing, AuthUnrecognized) { int rc = test_run(home, "47-auth-unrecognized.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_UNRECOGNIZED, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username == NULL); ASSERT_TRUE(tx->request_auth_password == NULL); } TEST_F(ConnectionParsing, InvalidResponseHeaders1) { int rc = test_run(home, "48-invalid-response-headers-1.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); ASSERT_EQ(8, htp_table_size(tx->response_headers)); htp_header_t *h_empty = (htp_header_t *) htp_table_get_c(tx->response_headers, ""); ASSERT_TRUE(h_empty != NULL); ASSERT_EQ(0, bstr_cmp_c(h_empty->value, "No Colon")); ASSERT_TRUE(h_empty->flags & HTP_FIELD_INVALID); ASSERT_TRUE(h_empty->flags & HTP_FIELD_UNPARSEABLE); htp_header_t *h_lws = (htp_header_t *) htp_table_get_c(tx->response_headers, "Lws"); ASSERT_TRUE(h_lws != NULL); ASSERT_EQ(0, bstr_cmp_c(h_lws->value, "After Header Name")); ASSERT_TRUE(h_lws->flags & HTP_FIELD_INVALID); htp_header_t *h_nottoken = (htp_header_t *) htp_table_get_c(tx->response_headers, "Header@Name"); ASSERT_TRUE(h_nottoken != NULL); ASSERT_EQ(0, bstr_cmp_c(h_nottoken->value, "Not Token")); ASSERT_TRUE(h_nottoken->flags & HTP_FIELD_INVALID); } TEST_F(ConnectionParsing, InvalidResponseHeaders2) { int rc = test_run(home, "49-invalid-response-headers-2.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); ASSERT_EQ(6, htp_table_size(tx->response_headers)); htp_header_t *h_empty = (htp_header_t *) htp_table_get_c(tx->response_headers, ""); ASSERT_TRUE(h_empty != NULL); ASSERT_EQ(0, bstr_cmp_c(h_empty->value, "Empty Name")); ASSERT_TRUE(h_empty->flags & HTP_FIELD_INVALID); } TEST_F(ConnectionParsing, Util) { int rc = test_run(home, "50-util.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); char *in_state = htp_connp_in_state_as_string(tx->connp); ASSERT_TRUE(in_state != NULL); char *out_state = htp_connp_out_state_as_string(tx->connp); ASSERT_TRUE(out_state != NULL); char *request_progress = htp_tx_request_progress_as_string(tx); ASSERT_TRUE(request_progress != NULL); char *response_progress = htp_tx_response_progress_as_string(tx); ASSERT_TRUE(response_progress != NULL); FILE *null = fopen("/dev/null", "w"); ASSERT_TRUE(null != NULL); fprint_bstr(null, "test", NULL); fprint_bstr(null, "test", tx->request_line); fprint_raw_data(null, "test", bstr_ptr(tx->request_line), bstr_len(tx->request_line)); fprint_raw_data_ex(null, "test", bstr_ptr(tx->request_line), 0, bstr_len(tx->request_line)); // Message too long. tx->connp->cfg->log_level = HTP_LOG_ERROR; char long_message[1300]; for (size_t i = 0; i < 1299; i++) { long_message[i] = 'X'; } long_message[1299] = '\0'; htp_log(tx->connp, __FILE__, __LINE__, HTP_LOG_ERROR, 0, long_message); ASSERT_TRUE(tx->connp->last_error != NULL); ASSERT_TRUE(tx->connp->last_error->msg != NULL); ASSERT_EQ(1023, strlen(tx->connp->last_error->msg)); ASSERT_EQ('+', tx->connp->last_error->msg[1022]); // A message that should not be logged. size_t log_message_count = htp_list_size(tx->connp->conn->messages); tx->connp->cfg->log_level = HTP_LOG_NONE; htp_log(tx->connp, __FILE__, __LINE__, HTP_LOG_ERROR, 0, "Log message"); ASSERT_EQ(log_message_count, htp_list_size(tx->connp->conn->messages)); } TEST_F(ConnectionParsing, GetIPv6Invalid) { int rc = test_run(home, "51-get-ipv6-invalid.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "http://[::1:8080/?p=%20")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->hostname, "[::1:8080")); } TEST_F(ConnectionParsing, InvalidPath) { int rc = test_run(home, "52-invalid-path.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_method != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, "GET")); ASSERT_TRUE(tx->request_uri != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "invalid/path?p=%20")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "invalid/path")); } TEST_F(ConnectionParsing, PathUtf8_None) { int rc = test_run(home, "53-path-utf8-none.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_FALSE(tx->flags & HTP_PATH_UTF8_VALID); ASSERT_FALSE(tx->flags & HTP_PATH_UTF8_OVERLONG); ASSERT_FALSE(tx->flags & HTP_PATH_HALF_FULL_RANGE); } TEST_F(ConnectionParsing, PathUtf8_Valid) { int rc = test_run(home, "54-path-utf8-valid.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_VALID); } TEST_F(ConnectionParsing, PathUtf8_Overlong2) { int rc = test_run(home, "55-path-utf8-overlong-2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); } TEST_F(ConnectionParsing, PathUtf8_Overlong3) { int rc = test_run(home, "56-path-utf8-overlong-3.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); } TEST_F(ConnectionParsing, PathUtf8_Overlong4) { int rc = test_run(home, "57-path-utf8-overlong-4.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); } TEST_F(ConnectionParsing, PathUtf8_Invalid) { int rc = test_run(home, "58-path-utf8-invalid.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_INVALID); ASSERT_FALSE(tx->flags & HTP_PATH_UTF8_VALID); } TEST_F(ConnectionParsing, PathUtf8_FullWidth) { int rc = test_run(home, "59-path-utf8-fullwidth.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_HALF_FULL_RANGE); } TEST_F(ConnectionParsing, PathUtf8_Decode_Valid) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "54-path-utf8-valid.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/Ristic.txt")); } TEST_F(ConnectionParsing, PathUtf8_Decode_Overlong2) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "55-path-utf8-overlong-2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/&.txt")); } TEST_F(ConnectionParsing, PathUtf8_Decode_Overlong3) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "56-path-utf8-overlong-3.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/&.txt")); } TEST_F(ConnectionParsing, PathUtf8_Decode_Overlong4) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "57-path-utf8-overlong-4.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_OVERLONG); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/&.txt")); } TEST_F(ConnectionParsing, PathUtf8_Decode_Invalid) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "58-path-utf8-invalid.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_UTF8_INVALID); ASSERT_FALSE(tx->flags & HTP_PATH_UTF8_VALID); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/Ristic?.txt")); } TEST_F(ConnectionParsing, PathUtf8_Decode_FullWidth) { htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); int rc = test_run(home, "59-path-utf8-fullwidth.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->flags & HTP_PATH_HALF_FULL_RANGE); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->path != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->path, "/&.txt")); } TEST_F(ConnectionParsing, RequestCookies) { int rc = test_run(home, "60-request-cookies.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(3, htp_table_size(tx->request_cookies)); bstr *key = NULL; bstr *value = NULL; value = (bstr *) htp_table_get_index(tx->request_cookies, 0, &key); ASSERT_TRUE(key != NULL); ASSERT_TRUE(value != NULL); ASSERT_EQ(0, bstr_cmp_c(key, "p")); ASSERT_EQ(0, bstr_cmp_c(value, "1")); value = (bstr *) htp_table_get_index(tx->request_cookies, 1, &key); ASSERT_TRUE(key != NULL); ASSERT_TRUE(value != NULL); ASSERT_EQ(0, bstr_cmp_c(key, "q")); ASSERT_EQ(0, bstr_cmp_c(value, "2")); value = (bstr *) htp_table_get_index(tx->request_cookies, 2, &key); ASSERT_TRUE(key != NULL); ASSERT_TRUE(value != NULL); ASSERT_EQ(0, bstr_cmp_c(key, "z")); ASSERT_EQ(0, bstr_cmp_c(value, "")); } TEST_F(ConnectionParsing, EmptyLineBetweenRequests) { int rc = test_run(home, "61-empty-line-between-requests.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx != NULL); ASSERT_EQ(1, tx->request_ignored_lines); } TEST_F(ConnectionParsing, PostNoBody) { int rc = test_run(home, "62-post-no-body.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx1->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx1->response_progress); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx2->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx2->response_progress); } TEST_F(ConnectionParsing, PostChunkedInvalid1) { int rc = test_run(home, "63-post-chunked-invalid-1.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. } TEST_F(ConnectionParsing, PostChunkedInvalid2) { int rc = test_run(home, "64-post-chunked-invalid-2.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. } TEST_F(ConnectionParsing, PostChunkedInvalid3) { int rc = test_run(home, "65-post-chunked-invalid-3.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. } TEST_F(ConnectionParsing, PostChunkedSplitChunk) { int rc = test_run(home, "66-post-chunked-split-chunk.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); htp_param_t *p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_TRUE(p->value != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, "0123456789")); } TEST_F(ConnectionParsing, LongRequestLine1) { int rc = test_run(home, "67-long-request-line.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/0123456789/0123456789/")); } TEST_F(ConnectionParsing, LongRequestLine2) { htp_config_set_field_limits(cfg, 0, 16); int rc = test_run(home, "67-long-request-line.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_LINE, tx->request_progress); } TEST_F(ConnectionParsing, InvalidRequestHeader) { int rc = test_run(home, "68-invalid-request-header.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); htp_header_t *h = (htp_header_t *) htp_table_get_c(tx->request_headers, "Header-With-NUL"); ASSERT_TRUE(h != NULL); ASSERT_EQ(0, bstr_cmp_c(h->value, "BEFORE")); } TEST_F(ConnectionParsing, TestGenericPersonality) { htp_config_set_server_personality(cfg, HTP_SERVER_IDS); int rc = test_run(home, "02-header-test-apache2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); } TEST_F(ConnectionParsing, LongResponseHeader) { htp_config_set_field_limits(cfg, 0, 16); int rc = test_run(home, "69-long-response-header.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_HEADERS, tx->response_progress); } TEST_F(ConnectionParsing, ResponseInvalidChunkLength) { int rc = test_run(home, "70-response-invalid-chunk-length.t", cfg, &connp); ASSERT_EQ(rc, 1); // Expect success as we're very liberal } TEST_F(ConnectionParsing, ResponseSplitChunk) { int rc = test_run(home, "71-response-split-chunk.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } TEST_F(ConnectionParsing, ResponseBody) { int rc = test_run(home, "72-response-split-body.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } TEST_F(ConnectionParsing, ResponseContainsTeAndCl) { int rc = test_run(home, "73-response-te-and-cl.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); ASSERT_TRUE(tx->flags & HTP_REQUEST_SMUGGLING); } TEST_F(ConnectionParsing, ResponseMultipleCl) { int rc = test_run(home, "74-response-multiple-cl.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); ASSERT_TRUE(tx->flags & HTP_REQUEST_SMUGGLING); htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, "Content-Length"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(h->value != NULL); ASSERT_TRUE(h->flags & HTP_FIELD_REPEATED); ASSERT_EQ(0, bstr_cmp_c(h->value, "12")); } TEST_F(ConnectionParsing, ResponseMultipleClMismatch) { int rc = test_run(home, "88-response-multiple-cl-mismatch.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_HEADERS, tx->response_progress); } TEST_F(ConnectionParsing, ResponseInvalidCl) { int rc = test_run(home, "75-response-invalid-cl.t", cfg, &connp); ASSERT_LT(rc, 0); // Expect error. ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_HEADERS, tx->response_progress); ASSERT_FALSE(tx->flags & HTP_REQUEST_SMUGGLING); } TEST_F(ConnectionParsing, ResponseNoBody) { int rc = test_run(home, "76-response-no-body.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx1->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx1->response_progress); htp_header_t *h = (htp_header_t *)htp_table_get_c(tx1->response_headers, "Server"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(h->value != NULL); ASSERT_EQ(0, bstr_cmp_c(h->value, "Apache")); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx2->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx2->response_progress); ASSERT_TRUE(tx1 != tx2); } TEST_F(ConnectionParsing, ResponseFoldedHeaders) { int rc = test_run(home, "77-response-folded-headers.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); htp_tx_t *tx1 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx1 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx1->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx1->response_progress); htp_header_t *h = (htp_header_t *)htp_table_get_c(tx1->response_headers, "Server"); ASSERT_TRUE(h != NULL); ASSERT_TRUE(h->value != NULL); ASSERT_EQ(0, bstr_cmp_c(h->value, "Apache Server")); htp_tx_t *tx2 = (htp_tx_t *) htp_list_get(connp->conn->transactions, 1); ASSERT_TRUE(tx2 != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx2->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx2->response_progress); } TEST_F(ConnectionParsing, ResponseNoStatusHeaders) { int rc = test_run(home, "78-response-no-status-headers.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } TEST_F(ConnectionParsing, ConnectInvalidHostport) { int rc = test_run(home, "79-connect-invalid-hostport.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(2, htp_list_size(connp->conn->transactions)); } TEST_F(ConnectionParsing, HostnameInvalid1) { int rc = test_run(home, "80-hostname-invalid-1.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); } TEST_F(ConnectionParsing, HostnameInvalid2) { int rc = test_run(home, "81-hostname-invalid-2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); } TEST_F(ConnectionParsing, Put) { int rc = test_run(home, "82-put.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_hostname, "www.example.com")); } TEST_F(ConnectionParsing, AuthDigestInvalidUsername2) { int rc = test_run(home, "83-auth-digest-invalid-username-2.t", cfg, &connp); ASSERT_GE(rc, 0); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_AUTH_DIGEST, tx->request_auth_type); ASSERT_TRUE(tx->request_auth_username == NULL); ASSERT_TRUE(tx->request_auth_password == NULL); ASSERT_TRUE(tx->flags & HTP_AUTH_INVALID); } TEST_F(ConnectionParsing, ResponseNoStatusHeaders2) { int rc = test_run(home, "84-response-no-status-headers-2.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } /* TEST_F(ConnectionParsing, ZeroByteRequestTimeout) { int rc = test_run(home, "85-zero-byte-request-timeout.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_NOT_STARTED, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } */ TEST_F(ConnectionParsing, PartialRequestTimeout) { int rc = test_run(home, "86-partial-request-timeout.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } TEST_F(ConnectionParsing, IncorrectHostAmbiguousWarning) { int rc = test_run(home, "87-issue-55-incorrect-host-ambiguous-warning.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_TRUE(tx->parsed_uri_raw != NULL); ASSERT_TRUE(tx->parsed_uri_raw->port != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri_raw->port, "443")); ASSERT_TRUE(tx->parsed_uri_raw->hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri_raw->hostname, "www.example.com")); ASSERT_EQ(443, tx->parsed_uri_raw->port_number); ASSERT_TRUE(tx->request_hostname != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_hostname, "www.example.com")); ASSERT_FALSE(tx->flags & HTP_HOST_AMBIGUOUS); } TEST_F(ConnectionParsing, GetWhitespace) { int rc = test_run(home, "89-get-whitespace.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->request_method, " GET")); ASSERT_EQ(0, bstr_cmp_c(tx->request_uri, "/?p=%20")); ASSERT_TRUE(tx->parsed_uri != NULL); ASSERT_TRUE(tx->parsed_uri->query != NULL); ASSERT_EQ(0, bstr_cmp_c(tx->parsed_uri->query, "p=%20")); htp_param_t *p = htp_tx_req_get_param(tx, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p->value, " ")); } TEST_F(ConnectionParsing, RequestUriTooLarge) { int rc = test_run(home, "90-request-uri-too-large.t", cfg, &connp); ASSERT_GE(rc, 0); ASSERT_EQ(1, htp_list_size(connp->conn->transactions)); htp_tx_t *tx = (htp_tx_t *) htp_list_get(connp->conn->transactions, 0); ASSERT_TRUE(tx != NULL); ASSERT_EQ(HTP_REQUEST_COMPLETE, tx->request_progress); ASSERT_EQ(HTP_RESPONSE_COMPLETE, tx->response_progress); } suricata-3.2.1/libhtp/test/test_utils.cpp0000644000000000000000000014772413051004451015373 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @brief Tests for various utility functions. * * @author Craig Forbes * @author Ivan Ristic */ #include #include #include TEST(Utf8, SingleByte) { uint32_t state = HTP_UTF8_ACCEPT; uint32_t codep; uint32_t result; result = htp_utf8_decode(&state, &codep, 0x00); EXPECT_EQ(0, result); EXPECT_EQ(HTP_UTF8_ACCEPT, state); EXPECT_EQ(0, codep); } TEST(Base64, Single) { EXPECT_EQ(62, htp_base64_decode_single('+')); EXPECT_EQ(63, htp_base64_decode_single('/')); EXPECT_EQ(-1, htp_base64_decode_single(',')); EXPECT_EQ(-1, htp_base64_decode_single(0)); EXPECT_EQ(-1, htp_base64_decode_single('~')); EXPECT_EQ(26, htp_base64_decode_single('a')); EXPECT_EQ(0, htp_base64_decode_single('A')); } TEST(Base64, Decode) { const char *input = "dGhpcyBpcyBhIHRlc3QuLg=="; bstr *out = htp_base64_decode_mem(input, strlen(input)); EXPECT_EQ(0, bstr_cmp_c(out, "this is a test..")); bstr_free(out); } TEST(UtilTest, Separator) { EXPECT_EQ(0, htp_is_separator('a')); EXPECT_EQ(0, htp_is_separator('^')); EXPECT_EQ(0, htp_is_separator('-')); EXPECT_EQ(0, htp_is_separator('_')); EXPECT_EQ(0, htp_is_separator('&')); EXPECT_EQ(1, htp_is_separator('(')); EXPECT_EQ(1, htp_is_separator('\\')); EXPECT_EQ(1, htp_is_separator('/')); EXPECT_EQ(1, htp_is_separator('=')); EXPECT_EQ(1, htp_is_separator('\t')); } TEST(UtilTest, Text) { EXPECT_EQ(1, htp_is_text('\t')); EXPECT_EQ(1, htp_is_text('a')); EXPECT_EQ(1, htp_is_text('~')); EXPECT_EQ(1, htp_is_text(' ')); EXPECT_EQ(0, htp_is_text('\n')); EXPECT_EQ(0, htp_is_text('\r')); EXPECT_EQ(0, htp_is_text('\r')); EXPECT_EQ(0, htp_is_text(31)); } TEST(UtilTest, Token) { EXPECT_EQ(1, htp_is_token('a')); EXPECT_EQ(1, htp_is_token('&')); EXPECT_EQ(1, htp_is_token('+')); EXPECT_EQ(0, htp_is_token('\t')); EXPECT_EQ(0, htp_is_token('\n')); } TEST(UtilTest, Chomp) { char data[100]; size_t len; int result; strcpy(data, "test\r\n"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(2, result); EXPECT_EQ(4, len); strcpy(data, "test\r\n\n"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(2, result); EXPECT_EQ(4, len); strcpy(data, "test\r\n\r\n"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(2, result); EXPECT_EQ(4, len); strcpy(data, "te\nst"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(0, result); EXPECT_EQ(5, len); strcpy(data, "foo\n"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(1, result); EXPECT_EQ(3, len); strcpy(data, "arfarf"); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(0, result); EXPECT_EQ(6, len); strcpy(data, ""); len = strlen(data); result = htp_chomp((unsigned char *) data, &len); EXPECT_EQ(0, result); EXPECT_EQ(0, len); } TEST(UtilTest, Space) { EXPECT_EQ(0, htp_is_space('a')); EXPECT_EQ(1, htp_is_space(' ')); EXPECT_EQ(1, htp_is_space('\f')); EXPECT_EQ(1, htp_is_space('\n')); EXPECT_EQ(1, htp_is_space('\r')); EXPECT_EQ(1, htp_is_space('\t')); EXPECT_EQ(1, htp_is_space('\v')); } TEST(UtilTest, Method) { bstr *method = bstr_dup_c("GET"); EXPECT_EQ(HTP_M_GET, htp_convert_method_to_number(method)); bstr_free(method); } TEST(UtilTest, IsLineEmpty) { char data[100]; strcpy(data, "arfarf"); EXPECT_EQ(0, htp_is_line_empty((unsigned char*) data, 6)); strcpy(data, "\r\n"); EXPECT_EQ(1, htp_is_line_empty((unsigned char*) data, 2)); strcpy(data, "\r"); EXPECT_EQ(1, htp_is_line_empty((unsigned char*) data, 1)); EXPECT_EQ(0, htp_is_line_empty((unsigned char*) data, 0)); } TEST(UtilTest, IsLineWhitespace) { char data[100]; strcpy(data, "arfarf"); EXPECT_EQ(0, htp_is_line_whitespace((unsigned char*) data, 6)); strcpy(data, "\r\n"); EXPECT_EQ(1, htp_is_line_whitespace((unsigned char*) data, 2)); strcpy(data, "\r"); EXPECT_EQ(1, htp_is_line_whitespace((unsigned char*) data, 1)); EXPECT_EQ(1, htp_is_line_whitespace((unsigned char*) data, 0)); } TEST(UtilTest, ParsePositiveIntegerWhitespace) { EXPECT_EQ(123, htp_parse_positive_integer_whitespace( (unsigned char*) "123 ", 6, 10)); EXPECT_EQ(123, htp_parse_positive_integer_whitespace( (unsigned char*) " 123", 6, 10)); EXPECT_EQ(123, htp_parse_positive_integer_whitespace( (unsigned char*) " 123 ", 9, 10)); EXPECT_EQ(-1, htp_parse_positive_integer_whitespace( (unsigned char*) "a123", 4, 10)); EXPECT_EQ(-1001, htp_parse_positive_integer_whitespace( (unsigned char*) " \t", 4, 10)); EXPECT_EQ(-1002, htp_parse_positive_integer_whitespace( (unsigned char*) "123b ", 5, 10)); EXPECT_EQ(-1, htp_parse_positive_integer_whitespace( (unsigned char*) " a123 ", 9, 10)); EXPECT_EQ(-1002, htp_parse_positive_integer_whitespace( (unsigned char*) " 123b ", 9, 10)); EXPECT_EQ(0x123, htp_parse_positive_integer_whitespace( (unsigned char*) " 123 ", 9, 16)); } TEST(UtilTest, ParseContentLength) { bstr *str = bstr_dup_c("134"); EXPECT_EQ(134, htp_parse_content_length(str)); bstr_free(str); } TEST(UtilTest, ParseChunkedLength) { EXPECT_EQ(0x12a5, htp_parse_chunked_length((unsigned char*) "12a5", 4)); } TEST(UtilTest, IsLineFolded) { EXPECT_EQ(-1, htp_connp_is_line_folded((unsigned char*) "", 0)); EXPECT_EQ(1, htp_connp_is_line_folded((unsigned char*) "\tline", 5)); EXPECT_EQ(1, htp_connp_is_line_folded((unsigned char*) " line", 5)); EXPECT_EQ(0, htp_connp_is_line_folded((unsigned char*) "line ", 5)); } static void free_htp_uri_t(htp_uri_t **urip) { htp_uri_t *uri = *urip; if (uri == NULL) { return; } bstr_free(uri->scheme); bstr_free(uri->username); bstr_free(uri->password); bstr_free(uri->hostname); bstr_free(uri->port); bstr_free(uri->path); bstr_free(uri->query); bstr_free(uri->fragment); free(uri); *urip = NULL; } struct uri_expected { const char *scheme; const char *username; const char *password; const char *hostname; const char *port; const char *path; const char *query; const char *fragment; }; struct uri_test { const char *uri; uri_expected expected; }; bool bstr_equal_c(const bstr *b, const char *c) { if ((c == NULL) || (b == NULL)) { return (c == NULL) && (b == NULL); } else { return (0 == bstr_cmp_c(b, c)); } } void append_message(std::ostream & o, const char *label, const char *expected, bstr *actual) { o << label << " missmatch: "; if (expected != NULL) { o << "'" << expected << "'"; } else { o << ""; } o << " != "; if (actual != NULL) { o << "'"; o.write((const char *) bstr_ptr(actual), bstr_len(actual)); o << "'"; } else { o << ""; } o << std::endl; } static ::testing::AssertionResult UriIsExpected(const char *expected_var, const char *actual_var, const uri_expected &expected, const htp_uri_t *actual) { std::stringstream msg; bool equal = true; if (!bstr_equal_c(actual->scheme, expected.scheme)) { equal = false; append_message(msg, "scheme", expected.scheme, actual->scheme); } if (!bstr_equal_c(actual->username, expected.username)) { equal = false; append_message(msg, "username", expected.username, actual->username); } if (!bstr_equal_c(actual->password, expected.password)) { equal = false; append_message(msg, "password", expected.password, actual->password); } if (!bstr_equal_c(actual->hostname, expected.hostname)) { equal = false; append_message(msg, "hostname", expected.hostname, actual->hostname); } if (!bstr_equal_c(actual->port, expected.port)) { equal = false; append_message(msg, "port", expected.port, actual->port); } if (!bstr_equal_c(actual->path, expected.path)) { equal = false; append_message(msg, "path", expected.path, actual->path); } if (!bstr_equal_c(actual->query, expected.query)) { equal = false; append_message(msg, "query", expected.query, actual->query); } if (!bstr_equal_c(actual->fragment, expected.fragment)) { equal = false; append_message(msg, "fragment", expected.fragment, actual->fragment); } if (equal) { return ::testing::AssertionSuccess(); } else { return ::testing::AssertionFailure() << msg.str(); } } struct uri_test uri_tests[] = { {"http://user:pass@www.example.com:1234/path1/path2?a=b&c=d#frag", {"http", "user", "pass", "www.example.com", "1234", "/path1/path2", "a=b&c=d", "frag"}}, {"http://host.com/path", {"http", NULL, NULL, "host.com", NULL, "/path", NULL, NULL}}, {"http://", {"http", NULL, NULL, NULL, NULL, "//", NULL, NULL}}, {"/path", {NULL, NULL, NULL, NULL, NULL, "/path", NULL, NULL}}, {"://", {"", NULL, NULL, NULL, NULL, "//", NULL, NULL}}, {"", {NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL}}, {"http://user@host.com", {"http", "user", NULL, "host.com", NULL, "", NULL, NULL}}, {NULL, { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }} }; TEST(UtilTest, HtpParseUri) { bstr *input = NULL; htp_uri_t *uri = NULL; uri_test *test; input = bstr_dup_c(""); EXPECT_EQ(HTP_OK, htp_parse_uri(input, &uri)); bstr_free(input); free_htp_uri_t(&uri); test = uri_tests; while (test->uri != NULL) { input = bstr_dup_c(test->uri); EXPECT_EQ(HTP_OK, htp_parse_uri(input, &uri)); EXPECT_PRED_FORMAT2(UriIsExpected, test->expected, uri) << "Failed URI = " << test->uri << std::endl; bstr_free(input); free_htp_uri_t(&uri); ++test; } } TEST(UtilTest, ParseHostPort1) { bstr *i = bstr_dup_c("www.example.com"); bstr *host; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(bstr_cmp(i, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(i); } TEST(UtilTest, ParseHostPort2) { bstr *i = bstr_dup_c(" www.example.com "); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort3) { bstr *i = bstr_dup_c(" www.example.com:8001 "); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(8001, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort4) { bstr *i = bstr_dup_c(" www.example.com : 8001 "); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(8001, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort5) { bstr *i = bstr_dup_c("www.example.com."); bstr *e = bstr_dup_c("www.example.com."); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort6) { bstr *i = bstr_dup_c("www.example.com.:8001"); bstr *e = bstr_dup_c("www.example.com."); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(8001, port); ASSERT_EQ(0, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort7) { bstr *i = bstr_dup_c("www.example.com:"); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort8) { bstr *i = bstr_dup_c("www.example.com:ff"); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort9) { bstr *i = bstr_dup_c("www.example.com:0"); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort10) { bstr *i = bstr_dup_c("www.example.com:65536"); bstr *e = bstr_dup_c("www.example.com"); bstr *host = NULL; int port; int flag = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &flag)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, flag); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort11) { bstr *i = bstr_dup_c("[::1]:8080"); bstr *e = bstr_dup_c("[::1]"); bstr *host = NULL; int port; int invalid = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &invalid)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(8080, port); ASSERT_EQ(0, invalid); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort12) { bstr *i = bstr_dup_c("[::1]:"); bstr *e = bstr_dup_c("[::1]"); bstr *host = NULL; int port; int invalid = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &invalid)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, invalid); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort13) { bstr *i = bstr_dup_c("[::1]x"); bstr *e = bstr_dup_c("[::1]"); bstr *host = NULL; int port; int invalid = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &invalid)); ASSERT_TRUE(host != NULL); ASSERT_TRUE(bstr_cmp(e, host) == 0); ASSERT_EQ(-1, port); ASSERT_EQ(1, invalid); bstr_free(host); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseHostPort14) { bstr *i = bstr_dup_c("[::1"); bstr *host = NULL; int port; int invalid = 0; ASSERT_EQ(HTP_OK, htp_parse_hostport(i, &host, NULL, &port, &invalid)); ASSERT_TRUE(host == NULL); ASSERT_EQ(-1, port); ASSERT_EQ(1, invalid); bstr_free(host); bstr_free(i); } TEST(UtilTest, ParseContentType1) { bstr *i = bstr_dup_c("multipart/form-data"); bstr *e = bstr_dup_c("multipart/form-data"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseContentType2) { bstr *i = bstr_dup_c("multipart/form-data;boundary=X"); bstr *e = bstr_dup_c("multipart/form-data"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseContentType3) { bstr *i = bstr_dup_c("multipart/form-data boundary=X"); bstr *e = bstr_dup_c("multipart/form-data"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseContentType4) { bstr *i = bstr_dup_c("multipart/form-data,boundary=X"); bstr *e = bstr_dup_c("multipart/form-data"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseContentType5) { bstr *i = bstr_dup_c("multipart/FoRm-data"); bstr *e = bstr_dup_c("multipart/form-data"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ParseContentType6) { bstr *i = bstr_dup_c("multipart/form-data\t boundary=X"); bstr *e = bstr_dup_c("multipart/form-data\t"); bstr *ct = NULL; ASSERT_EQ(HTP_OK, htp_parse_ct_header(i, &ct)); ASSERT_TRUE(ct != NULL); ASSERT_TRUE(bstr_cmp(e, ct) == 0); bstr_free(ct); bstr_free(e); bstr_free(i); } TEST(UtilTest, ValidateHostname1) { bstr *i = bstr_dup_c("www.example.com"); ASSERT_EQ(1, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname2) { bstr *i = bstr_dup_c(".www.example.com"); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname3) { bstr *i = bstr_dup_c("www..example.com"); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname4) { bstr *i = bstr_dup_c("www.example.com.."); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname5) { bstr *i = bstr_dup_c("www example com"); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname6) { bstr *i = bstr_dup_c(""); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname7) { // Label over 63 characters. bstr *i = bstr_dup_c("www.exampleexampleexampleexampleexampleexampleexampleexampleexampleexample.com"); ASSERT_EQ(0, htp_validate_hostname(i)); bstr_free(i); } TEST(UtilTest, ValidateHostname8) { bstr *i = bstr_dup_c("www.ExAmplE-1984.com"); ASSERT_EQ(1, htp_validate_hostname(i)); bstr_free(i); } class DecodingTest : public testing::Test { protected: virtual void SetUp() { testing::Test::SetUp(); cfg = htp_config_create(); connp = htp_connp_create(cfg); htp_connp_open(connp, "127.0.0.1", 32768, "127.0.0.1", 80, NULL); tx = htp_connp_tx_create(connp); } virtual void TearDown() { htp_connp_destroy_all(connp); htp_config_destroy(cfg); testing::Test::TearDown(); } htp_connp_t *connp; htp_cfg_t *cfg; htp_tx_t *tx; }; TEST_F(DecodingTest, DecodeUrlencodedInplace1_Identity) { bstr *i = bstr_dup_c("/dest"); bstr *e = bstr_dup_c("/dest"); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace2_Urlencoded) { bstr *i = bstr_dup_c("/%64est"); bstr *e = bstr_dup_c("/dest"); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace3_UrlencodedInvalidPreserve) { bstr *i = bstr_dup_c("/%xxest"); bstr *e = bstr_dup_c("/%xxest"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace4_UrlencodedInvalidRemove) { bstr *i = bstr_dup_c("/%xxest"); bstr *e = bstr_dup_c("/xxest"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace5_UrlencodedInvalidDecode) { bstr *i = bstr_dup_c("/%}9est"); bstr *e = bstr_dup_c("/iest"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace6_UrlencodedInvalidNotEnoughBytes) { bstr *i = bstr_dup_c("/%a"); bstr *e = bstr_dup_c("/%a"); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace7_UrlencodedInvalidNotEnoughBytes) { bstr *i = bstr_dup_c("/%"); bstr *e = bstr_dup_c("/%"); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace8_Uencoded) { bstr *i = bstr_dup_c("/%u0064"); bstr *e = bstr_dup_c("/d"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace9_UencodedDoNotDecode) { bstr *i = bstr_dup_c("/%u0064"); bstr *e = bstr_dup_c("/%u0064"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 0); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace10_UencodedInvalidNotEnoughBytes) { bstr *i = bstr_dup_c("/%u006"); bstr *e = bstr_dup_c("/%u006"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace11_UencodedInvalidPreserve) { bstr *i = bstr_dup_c("/%u006"); bstr *e = bstr_dup_c("/%u006"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace12_UencodedInvalidRemove) { bstr *i = bstr_dup_c("/%uXXXX"); bstr *e = bstr_dup_c("/uXXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace13_UencodedInvalidDecode) { bstr *i = bstr_dup_c("/%u00}9"); bstr *e = bstr_dup_c("/i"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace14_UencodedInvalidPreserve) { bstr *i = bstr_dup_c("/%u00"); bstr *e = bstr_dup_c("/%u00"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace15_UencodedInvalidPreserve) { bstr *i = bstr_dup_c("/%u0"); bstr *e = bstr_dup_c("/%u0"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace16_UencodedInvalidPreserve) { bstr *i = bstr_dup_c("/%u"); bstr *e = bstr_dup_c("/%u"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace17_UrlencodedNul) { bstr *i = bstr_dup_c("/%00"); bstr *e = bstr_dup_mem("/\0", 2); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace18_UrlencodedNulTerminates) { bstr *i = bstr_dup_c("/%00ABC"); bstr *e = bstr_dup_c("/"); htp_config_set_nul_encoded_terminates(cfg, HTP_DECODER_DEFAULTS, 1); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace19_RawNulTerminates) { bstr *i = bstr_dup_mem("/\0ABC", 5); bstr *e = bstr_dup_c("/"); htp_config_set_nul_raw_terminates(cfg, HTP_DECODER_DEFAULTS, 1); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodeUrlencodedInplace20_UencodedBestFit) { bstr *i = bstr_dup_c("/%u0107"); bstr *e = bstr_dup_c("/c"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_tx_urldecode_params_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace1_UrlencodedInvalidNotEnoughBytes) { bstr *i = bstr_dup_c("/%a"); bstr *e = bstr_dup_c("/%a"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace2_UencodedInvalidNotEnoughBytes) { bstr *i = bstr_dup_c("/%uX"); bstr *e = bstr_dup_c("/%uX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace3_UencodedValid) { bstr *i = bstr_dup_c("/%u0107"); bstr *e = bstr_dup_c("/c"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace4_UencodedInvalidNotHexDigits_Remove) { bstr *i = bstr_dup_c("/%uXXXX"); bstr *e = bstr_dup_c("/uXXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace5_UencodedInvalidNotHexDigits_Preserve) { bstr *i = bstr_dup_c("/%uXXXX"); bstr *e = bstr_dup_c("/%uXXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace6_UencodedInvalidNotHexDigits_Process) { bstr *i = bstr_dup_c("/%u00}9"); bstr *e = bstr_dup_c("/i"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace7_UencodedNul) { bstr *i = bstr_dup_c("/%u0000"); bstr *e = bstr_dup_mem("/\0", 2); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_ENCODED_NUL); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace8_UencodedNotEnough_Remove) { bstr *i = bstr_dup_c("/%uXXX"); bstr *e = bstr_dup_c("/uXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace9_UencodedNotEnough_Preserve) { bstr *i = bstr_dup_c("/%uXXX"); bstr *e = bstr_dup_c("/%uXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace10_UrlencodedNul) { bstr *i = bstr_dup_c("/%00123"); bstr *e = bstr_dup_mem("/\000123", 5); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_ENCODED_NUL); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace11_UrlencodedNul_Terminates) { bstr *i = bstr_dup_c("/%00123"); bstr *e = bstr_dup_mem("/", 1); htp_config_set_nul_encoded_terminates(cfg, HTP_DECODER_DEFAULTS, 1); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_ENCODED_NUL); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace12_EncodedSlash) { bstr *i = bstr_dup_c("/one%2ftwo"); bstr *e = bstr_dup_c("/one%2ftwo"); htp_config_set_path_separators_decode(cfg, HTP_DECODER_DEFAULTS, 0); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_ENCODED_SEPARATOR); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace13_EncodedSlash_Decode) { bstr *i = bstr_dup_c("/one%2ftwo"); bstr *e = bstr_dup_c("/one/two"); htp_config_set_path_separators_decode(cfg, HTP_DECODER_DEFAULTS, 1); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_ENCODED_SEPARATOR); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace14_Urlencoded_Invalid_Preserve) { bstr *i = bstr_dup_c("/%HH"); bstr *e = bstr_dup_c("/%HH"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace15_Urlencoded_Invalid_Remove) { bstr *i = bstr_dup_c("/%HH"); bstr *e = bstr_dup_c("/HH"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace16_Urlencoded_Invalid_Process) { bstr *i = bstr_dup_c("/%}9"); bstr *e = bstr_dup_c("/i"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace17_Urlencoded_NotEnough_Remove) { bstr *i = bstr_dup_c("/%H"); bstr *e = bstr_dup_c("/H"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_REMOVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace18_Urlencoded_NotEnough_Preserve) { bstr *i = bstr_dup_c("/%H"); bstr *e = bstr_dup_c("/%H"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PRESERVE_PERCENT); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace19_Urlencoded_NotEnough_Process) { bstr *i = bstr_dup_c("/%H"); bstr *e = bstr_dup_c("/%H"); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_DEFAULTS, HTP_URL_DECODE_PROCESS_INVALID); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); ASSERT_TRUE(tx->flags & HTP_PATH_INVALID_ENCODING); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace20_RawNul1) { bstr *i = bstr_dup_mem("/\000123", 5); bstr *e = bstr_dup_c("/"); htp_config_set_nul_raw_terminates(cfg, HTP_DECODER_DEFAULTS, 1); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace21_RawNul1) { bstr *i = bstr_dup_mem("/\000123", 5); bstr *e = bstr_dup_mem("/\000123", 5); htp_config_set_nul_raw_terminates(cfg, HTP_DECODER_DEFAULTS, 0); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace22_ConvertBackslash1) { bstr *i = bstr_dup_c("/one\\two"); bstr *e = bstr_dup_c("/one/two"); htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_DEFAULTS, 1); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, DecodePathInplace23_ConvertBackslash2) { bstr *i = bstr_dup_c("/one\\two"); bstr *e = bstr_dup_c("/one\\two"); htp_config_set_backslash_convert_slashes(cfg, HTP_DECODER_DEFAULTS, 0); htp_decode_path_inplace(tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } TEST_F(DecodingTest, InvalidUtf8) { bstr *i = bstr_dup_c("\xf1."); bstr *e = bstr_dup_c("?."); htp_config_set_utf8_convert_bestfit(cfg, HTP_DECODER_URL_PATH, 1); htp_utf8_decode_path_inplace(cfg, tx, i); ASSERT_TRUE(bstr_cmp(i, e) == 0); bstr_free(e); bstr_free(i); } class UrlencodedParser : public testing::Test { protected: virtual void SetUp() { cfg = htp_config_create(); connp = htp_connp_create(cfg); htp_connp_open(connp, "127.0.0.1", 32768, "127.0.0.1", 80, NULL); tx = htp_connp_tx_create(connp); urlenp = htp_urlenp_create(tx); } virtual void TearDown() { htp_urlenp_destroy(urlenp); htp_connp_destroy_all(connp); htp_config_destroy(cfg); } htp_connp_t *connp; htp_cfg_t *cfg; htp_tx_t *tx; htp_urlenp_t *urlenp; }; TEST_F(UrlencodedParser, Empty) { htp_urlenp_parse_complete(urlenp, "", 0); ASSERT_EQ(0, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, EmptyKey1) { htp_urlenp_parse_complete(urlenp, "&", 1); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "", 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, EmptyKey2) { htp_urlenp_parse_complete(urlenp, "=&", 2); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "", 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, EmptyKey3) { htp_urlenp_parse_complete(urlenp, "=1&", 3); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "", 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "1")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, EmptyKeyAndValue) { htp_urlenp_parse_complete(urlenp, "=", 1); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "", 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, OnePairEmptyValue) { htp_urlenp_parse_complete(urlenp, "p=", 2); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, OnePair) { htp_urlenp_parse_complete(urlenp, "p=1", 3); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "1")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, TwoPairs) { htp_urlenp_parse_complete(urlenp, "p=1&q=2", 7); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "1")); bstr *q = (bstr *) htp_table_get_mem(urlenp->params, "q", 1); ASSERT_TRUE(q != NULL); ASSERT_EQ(0, bstr_cmp_c(q, "2")); ASSERT_EQ(2, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, KeyNoValue1) { htp_urlenp_parse_complete(urlenp, "p", 1); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, KeyNoValue2) { htp_urlenp_parse_complete(urlenp, "p&", 2); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, KeyNoValue3) { htp_urlenp_parse_complete(urlenp, "p&q", 3); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); bstr *q = (bstr *) htp_table_get_mem(urlenp->params, "q", 1); ASSERT_TRUE(q != NULL); ASSERT_EQ(0, bstr_cmp_c(q, "")); ASSERT_EQ(2, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, KeyNoValue4) { htp_urlenp_parse_complete(urlenp, "p&q=2", 5); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); bstr *q = (bstr *) htp_table_get_mem(urlenp->params, "q", 1); ASSERT_TRUE(q != NULL); ASSERT_EQ(0, bstr_cmp_c(q, "2")); ASSERT_EQ(2, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial1) { htp_urlenp_parse_partial(urlenp, "p", 1); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial2) { htp_urlenp_parse_partial(urlenp, "p", 1); htp_urlenp_parse_partial(urlenp, "x", 1); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "px", 2); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial3) { htp_urlenp_parse_partial(urlenp, "p", 1); htp_urlenp_parse_partial(urlenp, "x&", 2); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "px", 2); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial4) { htp_urlenp_parse_partial(urlenp, "p", 1); htp_urlenp_parse_partial(urlenp, "=", 1); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial5) { htp_urlenp_parse_partial(urlenp, "p", 1); htp_urlenp_parse_partial(urlenp, "", 0); htp_urlenp_parse_partial(urlenp, "", 0); htp_urlenp_parse_partial(urlenp, "", 0); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "p", 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "")); ASSERT_EQ(1, htp_table_size(urlenp->params)); } TEST_F(UrlencodedParser, Partial6) { htp_urlenp_parse_partial(urlenp, "px", 2); htp_urlenp_parse_partial(urlenp, "n", 1); htp_urlenp_parse_partial(urlenp, "", 0); htp_urlenp_parse_partial(urlenp, "=", 1); htp_urlenp_parse_partial(urlenp, "1", 1); htp_urlenp_parse_partial(urlenp, "2", 1); htp_urlenp_parse_partial(urlenp, "&", 1); htp_urlenp_parse_partial(urlenp, "qz", 2); htp_urlenp_parse_partial(urlenp, "n", 1); htp_urlenp_parse_partial(urlenp, "", 0); htp_urlenp_parse_partial(urlenp, "=", 1); htp_urlenp_parse_partial(urlenp, "2", 1); htp_urlenp_parse_partial(urlenp, "3", 1); htp_urlenp_parse_partial(urlenp, "&", 1); htp_urlenp_finalize(urlenp); bstr *p = (bstr *) htp_table_get_mem(urlenp->params, "pxn", 3); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(p, "12")); bstr *q = (bstr *) htp_table_get_mem(urlenp->params, "qzn", 3); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, bstr_cmp_c(q, "23")); ASSERT_EQ(2, htp_table_size(urlenp->params)); } TEST(List, Misc) { htp_list_t *l = htp_list_create(16); htp_list_push(l, (void *) "1"); htp_list_push(l, (void *) "2"); htp_list_push(l, (void *) "3"); ASSERT_EQ(3, htp_list_size(l)); char *p = (char *) htp_list_pop(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("3", p)); ASSERT_EQ(2, htp_list_size(l)); p = (char *) htp_list_shift(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("1", p)); ASSERT_EQ(1, htp_list_size(l)); p = (char *) htp_list_shift(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("2", p)); p = (char *) htp_list_shift(l); ASSERT_TRUE(p == NULL); p = (char *) htp_list_pop(l); ASSERT_TRUE(p == NULL); htp_list_destroy(l); } TEST(List, Misc2) { htp_list_t *l = htp_list_create(1); htp_list_push(l, (void *) "1"); char *p = (char *) htp_list_shift(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("1", p)); htp_list_push(l, (void *) "2"); p = (char *) htp_list_shift(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("2", p)); ASSERT_EQ(0, htp_list_size(l)); htp_list_destroy(l); } TEST(List, Misc3) { htp_list_t *l = htp_list_create(2); htp_list_push(l, (void *) "1"); htp_list_push(l, (void *) "2"); char *p = (char *) htp_list_shift(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("1", p)); htp_list_push(l, (void *) "3"); p = (char *) htp_list_get(l, 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("3", p)); ASSERT_EQ(2, htp_list_size(l)); htp_list_replace(l, 1, (void *) "4"); p = (char *) htp_list_pop(l); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("4", p)); htp_list_destroy(l); } TEST(List, Expand1) { htp_list_t *l = htp_list_create(2); htp_list_push(l, (void *) "1"); htp_list_push(l, (void *) "2"); ASSERT_EQ(2, htp_list_size(l)); htp_list_push(l, (void *) "3"); ASSERT_EQ(3, htp_list_size(l)); char *p = (char *) htp_list_get(l, 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("1", p)); p = (char *) htp_list_get(l, 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("2", p)); p = (char *) htp_list_get(l, 2); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("3", p)); htp_list_destroy(l); } TEST(List, Expand2) { htp_list_t *l = htp_list_create(2); htp_list_push(l, (void *) "1"); htp_list_push(l, (void *) "2"); ASSERT_EQ(2, htp_list_size(l)); htp_list_shift(l); ASSERT_EQ(1, htp_list_size(l)); htp_list_push(l, (void *) "3"); htp_list_push(l, (void *) "4"); ASSERT_EQ(3, htp_list_size(l)); char *p = (char *) htp_list_get(l, 0); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("2", p)); p = (char *) htp_list_get(l, 1); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("3", p)); p = (char *) htp_list_get(l, 2); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("4", p)); htp_list_destroy(l); } TEST(Table, Misc) { htp_table_t *t = htp_table_create(2); bstr *pkey = bstr_dup_c("p"); bstr *qkey = bstr_dup_c("q"); htp_table_addk(t, pkey, "1"); htp_table_addk(t, qkey, "2"); char *p = (char *) htp_table_get_mem(t, "z", 1); ASSERT_TRUE(p == NULL); p = (char *) htp_table_get(t, pkey); ASSERT_TRUE(p != NULL); ASSERT_EQ(0, strcmp("1", p)); htp_table_clear_ex(t); bstr_free(qkey); bstr_free(pkey); htp_table_destroy(t); } TEST(Util, ExtractQuotedString) { bstr *s; size_t end_offset; htp_status_t rc = htp_extract_quoted_string_as_bstr((unsigned char *) "\"test\"", 6, &s, &end_offset); ASSERT_EQ(HTP_OK, rc); ASSERT_TRUE(s != NULL); ASSERT_EQ(0, bstr_cmp_c(s, "test")); ASSERT_EQ(5, end_offset); bstr_free(s); rc = htp_extract_quoted_string_as_bstr((unsigned char *) "\"te\\\"st\"", 8, &s, &end_offset); ASSERT_EQ(HTP_OK, rc); ASSERT_TRUE(s != NULL); ASSERT_EQ(0, bstr_cmp_c(s, "te\"st")); ASSERT_EQ(7, end_offset); bstr_free(s); } TEST(Util, NormalizeUriPath) { bstr *s = NULL; s = bstr_dup_c("/a/b/c/./../../g"); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "/a/g")); bstr_free(s); s = bstr_dup_c("mid/content=5/../6"); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "mid/6")); bstr_free(s); s = bstr_dup_c("./one"); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "one")); bstr_free(s); s = bstr_dup_c("../one"); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "one")); bstr_free(s); s = bstr_dup_c("."); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "")); bstr_free(s); s = bstr_dup_c(".."); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "")); bstr_free(s); s = bstr_dup_c("one/."); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "one")); bstr_free(s); s = bstr_dup_c("one/.."); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "")); bstr_free(s); s = bstr_dup_c("one/../"); htp_normalize_uri_path_inplace(s); ASSERT_EQ(0, bstr_cmp_c(s, "")); bstr_free(s); } TEST_F(UrlencodedParser, UrlDecode1) { bstr *s = NULL; uint64_t flags; s = bstr_dup_c("/one/tw%u006f/three/%u123"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URLENCODED, HTP_URL_DECODE_PRESERVE_PERCENT); htp_urldecode_inplace(cfg, HTP_DECODER_URLENCODED, s, &flags); ASSERT_EQ(0, bstr_cmp_c(s, "/one/two/three/%u123")); bstr_free(s); s = bstr_dup_c("/one/tw%u006f/three/%uXXXX"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URLENCODED, HTP_URL_DECODE_PRESERVE_PERCENT); htp_urldecode_inplace(cfg, HTP_DECODER_URLENCODED, s, &flags); ASSERT_EQ(0, bstr_cmp_c(s, "/one/two/three/%uXXXX")); bstr_free(s); s = bstr_dup_c("/one/tw%u006f/three/%u123"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URLENCODED, HTP_URL_DECODE_REMOVE_PERCENT); htp_urldecode_inplace(cfg, HTP_DECODER_URLENCODED, s, &flags); ASSERT_EQ(0, bstr_cmp_c(s, "/one/two/three/u123")); bstr_free(s); s = bstr_dup_c("/one/tw%u006f/three/%3"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URLENCODED, HTP_URL_DECODE_REMOVE_PERCENT); htp_urldecode_inplace(cfg, HTP_DECODER_URLENCODED, s, &flags); ASSERT_EQ(0, bstr_cmp_c(s, "/one/two/three/3")); bstr_free(s); s = bstr_dup_c("/one/tw%u006f/three/%3"); htp_config_set_u_encoding_decode(cfg, HTP_DECODER_URLENCODED, 1); htp_config_set_url_encoding_invalid_handling(cfg, HTP_DECODER_URLENCODED, HTP_URL_DECODE_PROCESS_INVALID); htp_urldecode_inplace(cfg, HTP_DECODER_URLENCODED, s, &flags); ASSERT_EQ(0, bstr_cmp_c(s, "/one/two/three/%3")); bstr_free(s); } suricata-3.2.1/libhtp/test/test.c0000644000000000000000000003037313051004451013602 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #include #include #include #include #include #include #include #include #include "../htp/htp.h" #include "test.h" /** * Destroys a test. * * @param[in] test */ static void test_destroy(test_t *test) { if (test->buf != NULL) { free(test->buf); test->buf = NULL; } } /** * Checks if there's a chunk boundary at the given position. * * @param[in] test * @param[in] pos * @return Zero if there is no boundary, SERVER or CLIENT if a boundary * was found, and a negative value on error (e.g., not enough data * to determine if a boundary is present). */ static int test_is_boundary(test_t *test, size_t pos) { // Check that there's enough room if (pos + 3 >= test->len) return -1; if ((test->buf[pos] == '<') && (test->buf[pos + 1] == '<') && (test->buf[pos + 2] == '<')) { if (test->buf[pos + 3] == '\n') { return SERVER; } if (test->buf[pos + 3] == '\r') { if (pos + 4 >= test->len) return -1; else if (test->buf[pos + 4] == '\n') { return SERVER; } } } if ((test->buf[pos] == '>') && (test->buf[pos + 1] == '>') && (test->buf[pos + 2] == '>')) { if (test->buf[pos + 3] == '\n') { return CLIENT; } if (test->buf[pos + 3] == '\r') { if (pos + 4 >= test->len) return -1; else if (test->buf[pos + 4] == '\n') { return CLIENT; } } } return 0; } /** * Initializes test by loading the entire data file into a memory block. * * @param[in] test * @param[in] filename * @return Non-negative value on success, negative value on error. */ static int test_init(test_t *test, const char *filename, int clone_count) { memset(test, 0, sizeof (test_t)); int fd = open(filename, O_RDONLY | O_BINARY); if (fd < 0) return -1; struct stat buf; if (fstat(fd, &buf) < 0) { close(fd); return -1; } test->buf = malloc(buf.st_size * clone_count + clone_count - 1); test->len = 0; test->pos = 0; // Check that we received our memory. assert(test->buf != NULL); int bytes_read = 0; while ((bytes_read = read(fd, test->buf + test->len, buf.st_size - test->len)) > 0) { test->len += bytes_read; } if ((int)test->len != buf.st_size) { free(test->buf); close(fd); return -2; } close(fd); int i = 1; for (i = 1; i < clone_count; i++) { test->buf[i * buf.st_size + (i-1)] = '\n'; memcpy(test->buf + i * buf.st_size + i, test->buf, buf.st_size); } test->len = buf.st_size * clone_count + clone_count - 1; return 1; } static void test_start(test_t *test) { test->pos = 0; } /** * Finds the next data chunk in the given test. * * @param[in] test * @return One if a chunk is found or zero if there are no more chunks in the test. On * success, test->chunk will point to the beginning of the chunk, while * test->chunk_len will contain its length. */ static int test_next_chunk(test_t *test) { if (test->pos >= test->len) { return 0; } test->chunk = NULL; while (test->pos < test->len) { // Do we need to start another chunk? if (test->chunk == NULL) { // Are we at a boundary test->chunk_direction = test_is_boundary(test, test->pos); if (test->chunk_direction <= 0) { // Error return -1; } // Move over the boundary test->pos += 4; if (test->buf[test->pos] == '\n') test->pos++; // Start new chunk test->chunk = test->buf + test->pos; test->chunk_offset = test->pos; } // Are we at the end of a line? if (test->buf[test->pos] == '\n') { int r = test_is_boundary(test, test->pos + 1); if ((r == CLIENT) || (r == SERVER)) { // We got ourselves a chunk test->chunk_len = test->pos - test->chunk_offset; // Remove one '\r' (in addition to the '\n' that we've already removed), // which belongs to the next boundary if ((test->chunk_len > 0) && (test->chunk[test->chunk_len - 1] == '\r')) { test->chunk_len--; } // Position at the next boundary line test->pos++; return 1; } } test->pos++; } if (test->chunk != NULL) { test->chunk_len = test->pos - test->chunk_offset; return 1; } return 0; } static int parse_filename(const char *filename, char **remote_addr, int *remote_port, char **local_addr, int *local_port) { char *copy = strdup(filename); char *p, *saveptr; char *start = copy; char *q = strrchr(copy, '/'); if (q != NULL) start = q; q = strrchr(start, '\\'); if (q != NULL) start = q; int count = 0; p = strtok_r(start, "_", &saveptr); while (p != NULL) { count++; // printf("%i %s\n", count, p); switch (count) { case 2: *remote_addr = strdup(p); break; case 3: *remote_port = atoi(p); break; case 4: *local_addr = strdup(p); break; case 5: *local_port = atoi(p); break; } p = strtok_r(NULL, "_", &saveptr); } free(copy); return 0; } /** * Runs a single test. * * @param[in] filename * @param[in] cfg * @return A pointer to the instance of htp_connp_t created during * the test, or NULL if the test failed for some reason. */ int test_run_ex(const char *testsdir, const char *testname, htp_cfg_t *cfg, htp_connp_t **connp, int clone_count) { char filename[1025]; test_t test; struct timeval tv_start, tv_end; int rc; *connp = NULL; strncpy(filename, testsdir, 1024); strncat(filename, "/", 1024 - strlen(filename)); strncat(filename, testname, 1024 - strlen(filename)); // printf("Filename: %s\n", filename); // Initinialize test rc = test_init(&test, filename, clone_count); if (rc < 0) { return rc; } gettimeofday(&tv_start, NULL); test_start(&test); // Create parser *connp = htp_connp_create(cfg); if (*connp == NULL) { fprintf(stderr, "Failed to create connection parser\n"); exit(1); } htp_connp_set_user_data(*connp, (void *) 0x02); // Does the filename contain connection metdata? if (strncmp(testname, "stream", 6) == 0) { // It does; use it char *remote_addr = NULL, *local_addr = NULL; int remote_port = -1, local_port = -1; parse_filename(testname, &remote_addr, &remote_port, &local_addr, &local_port); htp_connp_open(*connp, (const char *) remote_addr, remote_port, (const char *) local_addr, local_port, &tv_start); free(remote_addr); free(local_addr); } else { // No connection metadata; provide some fake information instead htp_connp_open(*connp, (const char *) "127.0.0.1", 10000, (const char *) "127.0.0.1", 80, &tv_start); } // Find all chunks and feed them to the parser int in_data_other = 0; char *in_data = NULL; size_t in_data_len = 0; size_t in_data_offset = 0; int out_data_other = 0; char *out_data = NULL; size_t out_data_len = 0; size_t out_data_offset = 0; for (;;) { if (test_next_chunk(&test) <= 0) { break; } if (test.chunk_direction == CLIENT) { if (in_data_other) { test_destroy(&test); fprintf(stderr, "Unable to buffer more than one inbound chunk.\n"); return -1; } rc = htp_connp_req_data(*connp, &tv_start, test.chunk, test.chunk_len); if (rc == HTP_STREAM_ERROR) { test_destroy(&test); return -101; } if (rc == HTP_STREAM_DATA_OTHER) { // Parser needs to see the outbound stream in order to continue // parsing the inbound stream. in_data_other = 1; in_data = test.chunk; in_data_len = test.chunk_len; in_data_offset = htp_connp_req_data_consumed(*connp); } } else { if (out_data_other) { rc = htp_connp_res_data(*connp, &tv_start, out_data + out_data_offset, out_data_len - out_data_offset); if (rc == HTP_STREAM_ERROR) { test_destroy(&test); return -104; } out_data_other = 0; } rc = htp_connp_res_data(*connp, &tv_start, test.chunk, test.chunk_len); if (rc == HTP_STREAM_ERROR) { test_destroy(&test); return -102; } if (rc == HTP_STREAM_DATA_OTHER) { // Parser needs to see the outbound stream in order to continue // parsing the inbound stream. out_data_other = 1; out_data = test.chunk; out_data_len = test.chunk_len; out_data_offset = htp_connp_res_data_consumed(*connp); // printf("# YYY out offset is %d\n", out_data_offset); } if (in_data_other) { rc = htp_connp_req_data(*connp, &tv_start, in_data + in_data_offset, in_data_len - in_data_offset); if (rc == HTP_STREAM_ERROR) { test_destroy(&test); return -103; } in_data_other = 0; } } } if (out_data_other) { rc = htp_connp_res_data(*connp, &tv_start, out_data + out_data_offset, out_data_len - out_data_offset); if (rc == HTP_STREAM_ERROR) { test_destroy(&test); return -104; } out_data_other = 0; } gettimeofday(&tv_end, NULL); // Close the connection htp_connp_close(*connp, &tv_end); // Clean up test_destroy(&test); return 1; } int test_run(const char *testsdir, const char *testname, htp_cfg_t *cfg, htp_connp_t **connp) { return test_run_ex(testsdir, testname, cfg, connp, 1); } suricata-3.2.1/libhtp/test/Makefile.am0000644000000000000000000000212513051004451014505 00000000000000LDADD = $(top_builddir)/htp/libhtp.la -lz @LIBICONV@ AM_CFLAGS = -D_GNU_SOURCE -g -Wall -Wextra -std=gnu99 -pedantic \ -Wextra -Wno-missing-field-initializers -Wshadow -Wpointer-arith \ -Wstrict-prototypes -Wmissing-prototypes -Wno-unused-parameter AM_CPPFLAGS = -I$(top_srcdir) -I$(top_builddir)/htp -Wno-write-strings -DGTEST_USE_OWN_TR1_TUPLE=1 \ -D_GNU_SOURCE -g -Wall -Wextra -Wno-unused-parameter AUTOMAKE_OPTIONS = subdir-objects EXTRA_DIST = files check_PROGRAMS = test_all check_LIBRARIES = libgtest.a test_all_SOURCES = test_bstr.cpp test_gunzip.cpp test_hybrid.cpp test_main.cpp test_multipart.cpp test.c test.h test_utils.cpp test_bench.cpp test_all_LDADD = libgtest.a -lpthread $(LDADD) libgtest_a_SOURCES = gtest/gtest-all.cc gtest/gtest_main.cc gtest/gtest.h TESTS_ENVIRONMENT = srcdir=$(srcdir)/files TESTS = test_all test: check @echo test-compile-only: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_LIBRARIES) $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) check-compile-only: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_LIBRARIES) $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) suricata-3.2.1/libhtp/test/Makefile.in0000644000000000000000000011415213051004463014525 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ check_PROGRAMS = test_all$(EXEEXT) TESTS = test_all$(EXEEXT) subdir = test ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ $(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/lib-ld.m4 \ $(top_srcdir)/m4/lib-link.m4 $(top_srcdir)/m4/lib-prefix.m4 \ $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/htp_config_auto_gen.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = ARFLAGS = cru AM_V_AR = $(am__v_AR_@AM_V@) am__v_AR_ = $(am__v_AR_@AM_DEFAULT_V@) am__v_AR_0 = @echo " AR " $@; am__v_AR_1 = libgtest_a_AR = $(AR) $(ARFLAGS) libgtest_a_LIBADD = am__dirstamp = $(am__leading_dot)dirstamp am_libgtest_a_OBJECTS = gtest/gtest-all.$(OBJEXT) \ gtest/gtest_main.$(OBJEXT) libgtest_a_OBJECTS = $(am_libgtest_a_OBJECTS) am_test_all_OBJECTS = test_bstr.$(OBJEXT) test_gunzip.$(OBJEXT) \ test_hybrid.$(OBJEXT) test_main.$(OBJEXT) \ test_multipart.$(OBJEXT) test.$(OBJEXT) test_utils.$(OBJEXT) \ test_bench.$(OBJEXT) test_all_OBJECTS = $(am_test_all_OBJECTS) am__DEPENDENCIES_1 = $(top_builddir)/htp/libhtp.la test_all_DEPENDENCIES = libgtest.a $(am__DEPENDENCIES_1) AM_V_lt = $(am__v_lt_@AM_V@) am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) am__v_lt_0 = --silent am__v_lt_1 = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CFLAGS) $(CFLAGS) AM_V_CC = $(am__v_CC_@AM_V@) am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) am__v_CC_0 = @echo " CC " $@; am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; am__v_CCLD_1 = CXXCOMPILE = $(CXX) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CXXFLAGS) $(CXXFLAGS) LTCXXCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CXX) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CXXFLAGS) $(CXXFLAGS) AM_V_CXX = $(am__v_CXX_@AM_V@) am__v_CXX_ = $(am__v_CXX_@AM_DEFAULT_V@) am__v_CXX_0 = @echo " CXX " $@; am__v_CXX_1 = CXXLD = $(CXX) CXXLINK = $(LIBTOOL) $(AM_V_lt) --tag=CXX $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CXXLD) $(AM_CXXFLAGS) \ $(CXXFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CXXLD = $(am__v_CXXLD_@AM_V@) am__v_CXXLD_ = $(am__v_CXXLD_@AM_DEFAULT_V@) am__v_CXXLD_0 = @echo " CXXLD " $@; am__v_CXXLD_1 = SOURCES = $(libgtest_a_SOURCES) $(test_all_SOURCES) DIST_SOURCES = $(libgtest_a_SOURCES) $(test_all_SOURCES) am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags am__tty_colors_dummy = \ mgn= red= grn= lgn= blu= brg= std=; \ am__color_tests=no am__tty_colors = { \ $(am__tty_colors_dummy); \ if test "X$(AM_COLOR_TESTS)" = Xno; then \ am__color_tests=no; \ elif test "X$(AM_COLOR_TESTS)" = Xalways; then \ am__color_tests=yes; \ elif test "X$$TERM" != Xdumb && { test -t 1; } 2>/dev/null; then \ am__color_tests=yes; \ fi; \ if test $$am__color_tests = yes; then \ red=''; \ grn=''; \ lgn=''; \ blu=''; \ mgn=''; \ brg=''; \ std=''; \ fi; \ } am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } am__recheck_rx = ^[ ]*:recheck:[ ]* am__global_test_result_rx = ^[ ]*:global-test-result:[ ]* am__copy_in_global_log_rx = ^[ ]*:copy-in-global-log:[ ]* # A command that, given a newline-separated list of test names on the # standard input, print the name of the tests that are to be re-run # upon "make recheck". am__list_recheck_tests = $(AWK) '{ \ recheck = 1; \ while ((rc = (getline line < ($$0 ".trs"))) != 0) \ { \ if (rc < 0) \ { \ if ((getline line2 < ($$0 ".log")) < 0) \ recheck = 0; \ break; \ } \ else if (line ~ /$(am__recheck_rx)[nN][Oo]/) \ { \ recheck = 0; \ break; \ } \ else if (line ~ /$(am__recheck_rx)[yY][eE][sS]/) \ { \ break; \ } \ }; \ if (recheck) \ print $$0; \ close ($$0 ".trs"); \ close ($$0 ".log"); \ }' # A command that, given a newline-separated list of test names on the # standard input, create the global log from their .trs and .log files. am__create_global_log = $(AWK) ' \ function fatal(msg) \ { \ print "fatal: making $@: " msg | "cat >&2"; \ exit 1; \ } \ function rst_section(header) \ { \ print header; \ len = length(header); \ for (i = 1; i <= len; i = i + 1) \ printf "="; \ printf "\n\n"; \ } \ { \ copy_in_global_log = 1; \ global_test_result = "RUN"; \ while ((rc = (getline line < ($$0 ".trs"))) != 0) \ { \ if (rc < 0) \ fatal("failed to read from " $$0 ".trs"); \ if (line ~ /$(am__global_test_result_rx)/) \ { \ sub("$(am__global_test_result_rx)", "", line); \ sub("[ ]*$$", "", line); \ global_test_result = line; \ } \ else if (line ~ /$(am__copy_in_global_log_rx)[nN][oO]/) \ copy_in_global_log = 0; \ }; \ if (copy_in_global_log) \ { \ rst_section(global_test_result ": " $$0); \ while ((rc = (getline line < ($$0 ".log"))) != 0) \ { \ if (rc < 0) \ fatal("failed to read from " $$0 ".log"); \ print line; \ }; \ printf "\n"; \ }; \ close ($$0 ".trs"); \ close ($$0 ".log"); \ }' # Restructured Text title. am__rst_title = { sed 's/.*/ & /;h;s/./=/g;p;x;s/ *$$//;p;g' && echo; } # Solaris 10 'make', and several other traditional 'make' implementations, # pass "-e" to $(SHELL), and POSIX 2008 even requires this. Work around it # by disabling -e (using the XSI extension "set +e") if it's set. am__sh_e_setup = case $$- in *e*) set +e;; esac # Default flags passed to test drivers. am__common_driver_flags = \ --color-tests "$$am__color_tests" \ --enable-hard-errors "$$am__enable_hard_errors" \ --expect-failure "$$am__expect_failure" # To be inserted before the command running the test. Creates the # directory for the log if needed. Stores in $dir the directory # containing $f, in $tst the test, in $log the log. Executes the # developer- defined test setup AM_TESTS_ENVIRONMENT (if any), and # passes TESTS_ENVIRONMENT. Set up options for the wrapper that # will run the test scripts (or their associated LOG_COMPILER, if # thy have one). am__check_pre = \ $(am__sh_e_setup); \ $(am__vpath_adj_setup) $(am__vpath_adj) \ $(am__tty_colors); \ srcdir=$(srcdir); export srcdir; \ case "$@" in \ */*) am__odir=`echo "./$@" | sed 's|/[^/]*$$||'`;; \ *) am__odir=.;; \ esac; \ test "x$$am__odir" = x"." || test -d "$$am__odir" \ || $(MKDIR_P) "$$am__odir" || exit $$?; \ if test -f "./$$f"; then dir=./; \ elif test -f "$$f"; then dir=; \ else dir="$(srcdir)/"; fi; \ tst=$$dir$$f; log='$@'; \ if test -n '$(DISABLE_HARD_ERRORS)'; then \ am__enable_hard_errors=no; \ else \ am__enable_hard_errors=yes; \ fi; \ case " $(XFAIL_TESTS) " in \ *[\ \ ]$$f[\ \ ]* | *[\ \ ]$$dir$$f[\ \ ]*) \ am__expect_failure=yes;; \ *) \ am__expect_failure=no;; \ esac; \ $(AM_TESTS_ENVIRONMENT) $(TESTS_ENVIRONMENT) # A shell command to get the names of the tests scripts with any registered # extension removed (i.e., equivalently, the names of the test logs, with # the '.log' extension removed). The result is saved in the shell variable # '$bases'. This honors runtime overriding of TESTS and TEST_LOGS. Sadly, # we cannot use something simpler, involving e.g., "$(TEST_LOGS:.log=)", # since that might cause problem with VPATH rewrites for suffix-less tests. # See also 'test-harness-vpath-rewrite.sh' and 'test-trs-basic.sh'. am__set_TESTS_bases = \ bases='$(TEST_LOGS)'; \ bases=`for i in $$bases; do echo $$i; done | sed 's/\.log$$//'`; \ bases=`echo $$bases` RECHECK_LOGS = $(TEST_LOGS) AM_RECURSIVE_TARGETS = check recheck TEST_SUITE_LOG = test-suite.log TEST_EXTENSIONS = @EXEEXT@ .test LOG_DRIVER = $(SHELL) $(top_srcdir)/test-driver LOG_COMPILE = $(LOG_COMPILER) $(AM_LOG_FLAGS) $(LOG_FLAGS) am__set_b = \ case '$@' in \ */*) \ case '$*' in \ */*) b='$*';; \ *) b=`echo '$@' | sed 's/\.log$$//'`; \ esac;; \ *) \ b='$*';; \ esac am__test_logs1 = $(TESTS:=.log) am__test_logs2 = $(am__test_logs1:@EXEEXT@.log=.log) TEST_LOGS = $(am__test_logs2:.test.log=.log) TEST_LOG_DRIVER = $(SHELL) $(top_srcdir)/test-driver TEST_LOG_COMPILE = $(TEST_LOG_COMPILER) $(AM_TEST_LOG_FLAGS) \ $(TEST_LOG_FLAGS) am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp \ $(top_srcdir)/test-driver DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CXX = @CXX@ CXXCPP = @CXXCPP@ CXXDEPMODE = @CXXDEPMODE@ CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DOXYGEN = @DOXYGEN@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GENERIC_API_VERSION = @GENERIC_API_VERSION@ GENERIC_LIBRARY_NAME = @GENERIC_LIBRARY_NAME@ GENERIC_LIBRARY_VERSION = @GENERIC_LIBRARY_VERSION@ GENERIC_RELEASE = @GENERIC_RELEASE@ GENERIC_VERSION = @GENERIC_VERSION@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBICONV = @LIBICONV@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBICONV = @LTLIBICONV@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ RANLIB = @RANLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ doxygen = @doxygen@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ LDADD = $(top_builddir)/htp/libhtp.la -lz @LIBICONV@ AM_CFLAGS = -D_GNU_SOURCE -g -Wall -Wextra -std=gnu99 -pedantic \ -Wextra -Wno-missing-field-initializers -Wshadow -Wpointer-arith \ -Wstrict-prototypes -Wmissing-prototypes -Wno-unused-parameter AM_CPPFLAGS = -I$(top_srcdir) -I$(top_builddir)/htp -Wno-write-strings -DGTEST_USE_OWN_TR1_TUPLE=1 \ -D_GNU_SOURCE -g -Wall -Wextra -Wno-unused-parameter AUTOMAKE_OPTIONS = subdir-objects EXTRA_DIST = files check_LIBRARIES = libgtest.a test_all_SOURCES = test_bstr.cpp test_gunzip.cpp test_hybrid.cpp test_main.cpp test_multipart.cpp test.c test.h test_utils.cpp test_bench.cpp test_all_LDADD = libgtest.a -lpthread $(LDADD) libgtest_a_SOURCES = gtest/gtest-all.cc gtest/gtest_main.cc gtest/gtest.h TESTS_ENVIRONMENT = srcdir=$(srcdir)/files all: all-am .SUFFIXES: .SUFFIXES: .c .cc .cpp .lo .log .o .obj .test .test$(EXEEXT) .trs $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu test/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu test/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): clean-checkLIBRARIES: -test -z "$(check_LIBRARIES)" || rm -f $(check_LIBRARIES) gtest/$(am__dirstamp): @$(MKDIR_P) gtest @: > gtest/$(am__dirstamp) gtest/$(DEPDIR)/$(am__dirstamp): @$(MKDIR_P) gtest/$(DEPDIR) @: > gtest/$(DEPDIR)/$(am__dirstamp) gtest/gtest-all.$(OBJEXT): gtest/$(am__dirstamp) \ gtest/$(DEPDIR)/$(am__dirstamp) gtest/gtest_main.$(OBJEXT): gtest/$(am__dirstamp) \ gtest/$(DEPDIR)/$(am__dirstamp) libgtest.a: $(libgtest_a_OBJECTS) $(libgtest_a_DEPENDENCIES) $(EXTRA_libgtest_a_DEPENDENCIES) $(AM_V_at)-rm -f libgtest.a $(AM_V_AR)$(libgtest_a_AR) libgtest.a $(libgtest_a_OBJECTS) $(libgtest_a_LIBADD) $(AM_V_at)$(RANLIB) libgtest.a clean-checkPROGRAMS: @list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \ echo " rm -f" $$list; \ rm -f $$list || exit $$?; \ test -n "$(EXEEXT)" || exit 0; \ list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ echo " rm -f" $$list; \ rm -f $$list test_all$(EXEEXT): $(test_all_OBJECTS) $(test_all_DEPENDENCIES) $(EXTRA_test_all_DEPENDENCIES) @rm -f test_all$(EXEEXT) $(AM_V_CXXLD)$(CXXLINK) $(test_all_OBJECTS) $(test_all_LDADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) -rm -f gtest/*.$(OBJEXT) distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_bench.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_bstr.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_gunzip.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_hybrid.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_main.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_multipart.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/test_utils.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@gtest/$(DEPDIR)/gtest-all.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@gtest/$(DEPDIR)/gtest_main.Po@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\ @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $< .c.obj: @am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\ @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\ @am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .c.lo: @am__fastdepCC_TRUE@ $(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\ @am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCC_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< .cc.o: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\ @am__fastdepCXX_TRUE@ $(CXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ $< .cc.obj: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\ @am__fastdepCXX_TRUE@ $(CXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .cc.lo: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\ @am__fastdepCXX_TRUE@ $(LTCXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(LTCXXCOMPILE) -c -o $@ $< .cpp.o: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\ @am__fastdepCXX_TRUE@ $(CXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ $< .cpp.obj: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\ @am__fastdepCXX_TRUE@ $(CXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Po @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(CXXCOMPILE) -c -o $@ `$(CYGPATH_W) '$<'` .cpp.lo: @am__fastdepCXX_TRUE@ $(AM_V_CXX)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\ @am__fastdepCXX_TRUE@ $(LTCXXCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\ @am__fastdepCXX_TRUE@ $(am__mv) $$depbase.Tpo $$depbase.Plo @AMDEP_TRUE@@am__fastdepCXX_FALSE@ $(AM_V_CXX)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCXX_FALSE@ DEPDIR=$(DEPDIR) $(CXXDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCXX_FALSE@ $(AM_V_CXX@am__nodep@)$(LTCXXCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-am TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-am CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-am cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags # Recover from deleted '.trs' file; this should ensure that # "rm -f foo.log; make foo.trs" re-run 'foo.test', and re-create # both 'foo.log' and 'foo.trs'. Break the recipe in two subshells # to avoid problems with "make -n". .log.trs: rm -f $< $@ $(MAKE) $(AM_MAKEFLAGS) $< # Leading 'am--fnord' is there to ensure the list of targets does not # expand to empty, as could happen e.g. with make check TESTS=''. am--fnord $(TEST_LOGS) $(TEST_LOGS:.log=.trs): $(am__force_recheck) am--force-recheck: @: $(TEST_SUITE_LOG): $(TEST_LOGS) @$(am__set_TESTS_bases); \ am__f_ok () { test -f "$$1" && test -r "$$1"; }; \ redo_bases=`for i in $$bases; do \ am__f_ok $$i.trs && am__f_ok $$i.log || echo $$i; \ done`; \ if test -n "$$redo_bases"; then \ redo_logs=`for i in $$redo_bases; do echo $$i.log; done`; \ redo_results=`for i in $$redo_bases; do echo $$i.trs; done`; \ if $(am__make_dryrun); then :; else \ rm -f $$redo_logs && rm -f $$redo_results || exit 1; \ fi; \ fi; \ if test -n "$$am__remaking_logs"; then \ echo "fatal: making $(TEST_SUITE_LOG): possible infinite" \ "recursion detected" >&2; \ elif test -n "$$redo_logs"; then \ am__remaking_logs=yes $(MAKE) $(AM_MAKEFLAGS) $$redo_logs; \ fi; \ if $(am__make_dryrun); then :; else \ st=0; \ errmsg="fatal: making $(TEST_SUITE_LOG): failed to create"; \ for i in $$redo_bases; do \ test -f $$i.trs && test -r $$i.trs \ || { echo "$$errmsg $$i.trs" >&2; st=1; }; \ test -f $$i.log && test -r $$i.log \ || { echo "$$errmsg $$i.log" >&2; st=1; }; \ done; \ test $$st -eq 0 || exit 1; \ fi @$(am__sh_e_setup); $(am__tty_colors); $(am__set_TESTS_bases); \ ws='[ ]'; \ results=`for b in $$bases; do echo $$b.trs; done`; \ test -n "$$results" || results=/dev/null; \ all=` grep "^$$ws*:test-result:" $$results | wc -l`; \ pass=` grep "^$$ws*:test-result:$$ws*PASS" $$results | wc -l`; \ fail=` grep "^$$ws*:test-result:$$ws*FAIL" $$results | wc -l`; \ skip=` grep "^$$ws*:test-result:$$ws*SKIP" $$results | wc -l`; \ xfail=`grep "^$$ws*:test-result:$$ws*XFAIL" $$results | wc -l`; \ xpass=`grep "^$$ws*:test-result:$$ws*XPASS" $$results | wc -l`; \ error=`grep "^$$ws*:test-result:$$ws*ERROR" $$results | wc -l`; \ if test `expr $$fail + $$xpass + $$error` -eq 0; then \ success=true; \ else \ success=false; \ fi; \ br='==================='; br=$$br$$br$$br$$br; \ result_count () \ { \ if test x"$$1" = x"--maybe-color"; then \ maybe_colorize=yes; \ elif test x"$$1" = x"--no-color"; then \ maybe_colorize=no; \ else \ echo "$@: invalid 'result_count' usage" >&2; exit 4; \ fi; \ shift; \ desc=$$1 count=$$2; \ if test $$maybe_colorize = yes && test $$count -gt 0; then \ color_start=$$3 color_end=$$std; \ else \ color_start= color_end=; \ fi; \ echo "$${color_start}# $$desc $$count$${color_end}"; \ }; \ create_testsuite_report () \ { \ result_count $$1 "TOTAL:" $$all "$$brg"; \ result_count $$1 "PASS: " $$pass "$$grn"; \ result_count $$1 "SKIP: " $$skip "$$blu"; \ result_count $$1 "XFAIL:" $$xfail "$$lgn"; \ result_count $$1 "FAIL: " $$fail "$$red"; \ result_count $$1 "XPASS:" $$xpass "$$red"; \ result_count $$1 "ERROR:" $$error "$$mgn"; \ }; \ { \ echo "$(PACKAGE_STRING): $(subdir)/$(TEST_SUITE_LOG)" | \ $(am__rst_title); \ create_testsuite_report --no-color; \ echo; \ echo ".. contents:: :depth: 2"; \ echo; \ for b in $$bases; do echo $$b; done \ | $(am__create_global_log); \ } >$(TEST_SUITE_LOG).tmp || exit 1; \ mv $(TEST_SUITE_LOG).tmp $(TEST_SUITE_LOG); \ if $$success; then \ col="$$grn"; \ else \ col="$$red"; \ test x"$$VERBOSE" = x || cat $(TEST_SUITE_LOG); \ fi; \ echo "$${col}$$br$${std}"; \ echo "$${col}Testsuite summary for $(PACKAGE_STRING)$${std}"; \ echo "$${col}$$br$${std}"; \ create_testsuite_report --maybe-color; \ echo "$$col$$br$$std"; \ if $$success; then :; else \ echo "$${col}See $(subdir)/$(TEST_SUITE_LOG)$${std}"; \ if test -n "$(PACKAGE_BUGREPORT)"; then \ echo "$${col}Please report to $(PACKAGE_BUGREPORT)$${std}"; \ fi; \ echo "$$col$$br$$std"; \ fi; \ $$success || exit 1 check-TESTS: @list='$(RECHECK_LOGS)'; test -z "$$list" || rm -f $$list @list='$(RECHECK_LOGS:.log=.trs)'; test -z "$$list" || rm -f $$list @test -z "$(TEST_SUITE_LOG)" || rm -f $(TEST_SUITE_LOG) @set +e; $(am__set_TESTS_bases); \ log_list=`for i in $$bases; do echo $$i.log; done`; \ trs_list=`for i in $$bases; do echo $$i.trs; done`; \ log_list=`echo $$log_list`; trs_list=`echo $$trs_list`; \ $(MAKE) $(AM_MAKEFLAGS) $(TEST_SUITE_LOG) TEST_LOGS="$$log_list"; \ exit $$?; recheck: all $(check_LIBRARIES) $(check_PROGRAMS) @test -z "$(TEST_SUITE_LOG)" || rm -f $(TEST_SUITE_LOG) @set +e; $(am__set_TESTS_bases); \ bases=`for i in $$bases; do echo $$i; done \ | $(am__list_recheck_tests)` || exit 1; \ log_list=`for i in $$bases; do echo $$i.log; done`; \ log_list=`echo $$log_list`; \ $(MAKE) $(AM_MAKEFLAGS) $(TEST_SUITE_LOG) \ am__force_recheck=am--force-recheck \ TEST_LOGS="$$log_list"; \ exit $$? test_all.log: test_all$(EXEEXT) @p='test_all$(EXEEXT)'; \ b='test_all'; \ $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ --log-file $$b.log --trs-file $$b.trs \ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ "$$tst" $(AM_TESTS_FD_REDIRECT) .test.log: @p='$<'; \ $(am__set_b); \ $(am__check_pre) $(TEST_LOG_DRIVER) --test-name "$$f" \ --log-file $$b.log --trs-file $$b.trs \ $(am__common_driver_flags) $(AM_TEST_LOG_DRIVER_FLAGS) $(TEST_LOG_DRIVER_FLAGS) -- $(TEST_LOG_COMPILE) \ "$$tst" $(AM_TESTS_FD_REDIRECT) @am__EXEEXT_TRUE@.test$(EXEEXT).log: @am__EXEEXT_TRUE@ @p='$<'; \ @am__EXEEXT_TRUE@ $(am__set_b); \ @am__EXEEXT_TRUE@ $(am__check_pre) $(TEST_LOG_DRIVER) --test-name "$$f" \ @am__EXEEXT_TRUE@ --log-file $$b.log --trs-file $$b.trs \ @am__EXEEXT_TRUE@ $(am__common_driver_flags) $(AM_TEST_LOG_DRIVER_FLAGS) $(TEST_LOG_DRIVER_FLAGS) -- $(TEST_LOG_COMPILE) \ @am__EXEEXT_TRUE@ "$$tst" $(AM_TESTS_FD_REDIRECT) distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_LIBRARIES) $(check_PROGRAMS) $(MAKE) $(AM_MAKEFLAGS) check-TESTS check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: -test -z "$(TEST_LOGS)" || rm -f $(TEST_LOGS) -test -z "$(TEST_LOGS:.log=.trs)" || rm -f $(TEST_LOGS:.log=.trs) -test -z "$(TEST_SUITE_LOG)" || rm -f $(TEST_SUITE_LOG) clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) -rm -f gtest/$(DEPDIR)/$(am__dirstamp) -rm -f gtest/$(am__dirstamp) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-am clean-am: clean-checkLIBRARIES clean-checkPROGRAMS clean-generic \ clean-libtool mostlyclean-am distclean: distclean-am -rm -rf ./$(DEPDIR) gtest/$(DEPDIR) -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) gtest/$(DEPDIR) -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: check-am install-am install-strip .PHONY: CTAGS GTAGS TAGS all all-am check check-TESTS check-am clean \ clean-checkLIBRARIES clean-checkPROGRAMS clean-generic \ clean-libtool cscopelist-am ctags ctags-am distclean \ distclean-compile distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ maintainer-clean maintainer-clean-generic mostlyclean \ mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ pdf pdf-am ps ps-am recheck tags tags-am uninstall \ uninstall-am .PRECIOUS: Makefile test: check @echo test-compile-only: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_LIBRARIES) $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) check-compile-only: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_LIBRARIES) $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/libhtp/test/gtest/0000755000000000000000000000000013051004503013655 500000000000000suricata-3.2.1/libhtp/test/gtest/gtest_main.cc0000644000000000000000000000335413051004451016245 00000000000000// Copyright 2006, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include #include "gtest/gtest.h" GTEST_API_ int main(int argc, char **argv) { std::cout << "Running main() from gtest_main.cc\n"; testing::InitGoogleTest(&argc, argv); return RUN_ALL_TESTS(); } suricata-3.2.1/libhtp/test/gtest/gtest-all.cc0000644000000000000000000122217413051004451016013 00000000000000// Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: mheule@google.com (Markus Heule) // // Google C++ Testing Framework (Google Test) // // Sometimes it's desirable to build Google Test by compiling a single file. // This file serves this purpose. // This line ensures that gtest.h can be compiled on its own, even // when it's fused. #include "gtest/gtest.h" // The following lines pull in the real gtest *.cc files. // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // The Google C++ Testing Framework (Google Test) // Copyright 2007, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // Utilities for testing Google Test itself and code that uses Google Test // (e.g. frameworks built on top of Google Test). #ifndef GTEST_INCLUDE_GTEST_GTEST_SPI_H_ #define GTEST_INCLUDE_GTEST_GTEST_SPI_H_ namespace testing { // This helper class can be used to mock out Google Test failure reporting // so that we can test Google Test or code that builds on Google Test. // // An object of this class appends a TestPartResult object to the // TestPartResultArray object given in the constructor whenever a Google Test // failure is reported. It can either intercept only failures that are // generated in the same thread that created this object or it can intercept // all generated failures. The scope of this mock object can be controlled with // the second argument to the two arguments constructor. class GTEST_API_ ScopedFakeTestPartResultReporter : public TestPartResultReporterInterface { public: // The two possible mocking modes of this object. enum InterceptMode { INTERCEPT_ONLY_CURRENT_THREAD, // Intercepts only thread local failures. INTERCEPT_ALL_THREADS // Intercepts all failures. }; // The c'tor sets this object as the test part result reporter used // by Google Test. The 'result' parameter specifies where to report the // results. This reporter will only catch failures generated in the current // thread. DEPRECATED explicit ScopedFakeTestPartResultReporter(TestPartResultArray* result); // Same as above, but you can choose the interception scope of this object. ScopedFakeTestPartResultReporter(InterceptMode intercept_mode, TestPartResultArray* result); // The d'tor restores the previous test part result reporter. virtual ~ScopedFakeTestPartResultReporter(); // Appends the TestPartResult object to the TestPartResultArray // received in the constructor. // // This method is from the TestPartResultReporterInterface // interface. virtual void ReportTestPartResult(const TestPartResult& result); private: void Init(); const InterceptMode intercept_mode_; TestPartResultReporterInterface* old_reporter_; TestPartResultArray* const result_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ScopedFakeTestPartResultReporter); }; namespace internal { // A helper class for implementing EXPECT_FATAL_FAILURE() and // EXPECT_NONFATAL_FAILURE(). Its destructor verifies that the given // TestPartResultArray contains exactly one failure that has the given // type and contains the given substring. If that's not the case, a // non-fatal failure will be generated. class GTEST_API_ SingleFailureChecker { public: // The constructor remembers the arguments. SingleFailureChecker(const TestPartResultArray* results, TestPartResult::Type type, const string& substr); ~SingleFailureChecker(); private: const TestPartResultArray* const results_; const TestPartResult::Type type_; const string substr_; GTEST_DISALLOW_COPY_AND_ASSIGN_(SingleFailureChecker); }; } // namespace internal } // namespace testing // A set of macros for testing Google Test assertions or code that's expected // to generate Google Test fatal failures. It verifies that the given // statement will cause exactly one fatal Google Test failure with 'substr' // being part of the failure message. // // There are two different versions of this macro. EXPECT_FATAL_FAILURE only // affects and considers failures generated in the current thread and // EXPECT_FATAL_FAILURE_ON_ALL_THREADS does the same but for all threads. // // The verification of the assertion is done correctly even when the statement // throws an exception or aborts the current function. // // Known restrictions: // - 'statement' cannot reference local non-static variables or // non-static members of the current object. // - 'statement' cannot return a value. // - You cannot stream a failure message to this macro. // // Note that even though the implementations of the following two // macros are much alike, we cannot refactor them to use a common // helper macro, due to some peculiarity in how the preprocessor // works. The AcceptsMacroThatExpandsToUnprotectedComma test in // gtest_unittest.cc will fail to compile if we do that. #define EXPECT_FATAL_FAILURE(statement, substr) \ do { \ class GTestExpectFatalFailureHelper {\ public:\ static void Execute() { statement; }\ };\ ::testing::TestPartResultArray gtest_failures;\ ::testing::internal::SingleFailureChecker gtest_checker(\ >est_failures, ::testing::TestPartResult::kFatalFailure, (substr));\ {\ ::testing::ScopedFakeTestPartResultReporter gtest_reporter(\ ::testing::ScopedFakeTestPartResultReporter:: \ INTERCEPT_ONLY_CURRENT_THREAD, >est_failures);\ GTestExpectFatalFailureHelper::Execute();\ }\ } while (::testing::internal::AlwaysFalse()) #define EXPECT_FATAL_FAILURE_ON_ALL_THREADS(statement, substr) \ do { \ class GTestExpectFatalFailureHelper {\ public:\ static void Execute() { statement; }\ };\ ::testing::TestPartResultArray gtest_failures;\ ::testing::internal::SingleFailureChecker gtest_checker(\ >est_failures, ::testing::TestPartResult::kFatalFailure, (substr));\ {\ ::testing::ScopedFakeTestPartResultReporter gtest_reporter(\ ::testing::ScopedFakeTestPartResultReporter:: \ INTERCEPT_ALL_THREADS, >est_failures);\ GTestExpectFatalFailureHelper::Execute();\ }\ } while (::testing::internal::AlwaysFalse()) // A macro for testing Google Test assertions or code that's expected to // generate Google Test non-fatal failures. It asserts that the given // statement will cause exactly one non-fatal Google Test failure with 'substr' // being part of the failure message. // // There are two different versions of this macro. EXPECT_NONFATAL_FAILURE only // affects and considers failures generated in the current thread and // EXPECT_NONFATAL_FAILURE_ON_ALL_THREADS does the same but for all threads. // // 'statement' is allowed to reference local variables and members of // the current object. // // The verification of the assertion is done correctly even when the statement // throws an exception or aborts the current function. // // Known restrictions: // - You cannot stream a failure message to this macro. // // Note that even though the implementations of the following two // macros are much alike, we cannot refactor them to use a common // helper macro, due to some peculiarity in how the preprocessor // works. If we do that, the code won't compile when the user gives // EXPECT_NONFATAL_FAILURE() a statement that contains a macro that // expands to code containing an unprotected comma. The // AcceptsMacroThatExpandsToUnprotectedComma test in gtest_unittest.cc // catches that. // // For the same reason, we have to write // if (::testing::internal::AlwaysTrue()) { statement; } // instead of // GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement) // to avoid an MSVC warning on unreachable code. #define EXPECT_NONFATAL_FAILURE(statement, substr) \ do {\ ::testing::TestPartResultArray gtest_failures;\ ::testing::internal::SingleFailureChecker gtest_checker(\ >est_failures, ::testing::TestPartResult::kNonFatalFailure, \ (substr));\ {\ ::testing::ScopedFakeTestPartResultReporter gtest_reporter(\ ::testing::ScopedFakeTestPartResultReporter:: \ INTERCEPT_ONLY_CURRENT_THREAD, >est_failures);\ if (::testing::internal::AlwaysTrue()) { statement; }\ }\ } while (::testing::internal::AlwaysFalse()) #define EXPECT_NONFATAL_FAILURE_ON_ALL_THREADS(statement, substr) \ do {\ ::testing::TestPartResultArray gtest_failures;\ ::testing::internal::SingleFailureChecker gtest_checker(\ >est_failures, ::testing::TestPartResult::kNonFatalFailure, \ (substr));\ {\ ::testing::ScopedFakeTestPartResultReporter gtest_reporter(\ ::testing::ScopedFakeTestPartResultReporter::INTERCEPT_ALL_THREADS,\ >est_failures);\ if (::testing::internal::AlwaysTrue()) { statement; }\ }\ } while (::testing::internal::AlwaysFalse()) #endif // GTEST_INCLUDE_GTEST_GTEST_SPI_H_ #include #include #include #include #include #include #include #include #include // NOLINT #include #include #if GTEST_OS_LINUX // TODO(kenton@google.com): Use autoconf to detect availability of // gettimeofday(). # define GTEST_HAS_GETTIMEOFDAY_ 1 # include // NOLINT # include // NOLINT # include // NOLINT // Declares vsnprintf(). This header is not available on Windows. # include // NOLINT # include // NOLINT # include // NOLINT # include // NOLINT # include #elif GTEST_OS_SYMBIAN # define GTEST_HAS_GETTIMEOFDAY_ 1 # include // NOLINT #elif GTEST_OS_ZOS # define GTEST_HAS_GETTIMEOFDAY_ 1 # include // NOLINT // On z/OS we additionally need strings.h for strcasecmp. # include // NOLINT #elif GTEST_OS_WINDOWS_MOBILE // We are on Windows CE. # include // NOLINT #elif GTEST_OS_WINDOWS // We are on Windows proper. # include // NOLINT # include // NOLINT # include // NOLINT # include // NOLINT # if GTEST_OS_WINDOWS_MINGW // MinGW has gettimeofday() but not _ftime64(). // TODO(kenton@google.com): Use autoconf to detect availability of // gettimeofday(). // TODO(kenton@google.com): There are other ways to get the time on // Windows, like GetTickCount() or GetSystemTimeAsFileTime(). MinGW // supports these. consider using them instead. # define GTEST_HAS_GETTIMEOFDAY_ 1 # include // NOLINT # endif // GTEST_OS_WINDOWS_MINGW // cpplint thinks that the header is already included, so we want to // silence it. # include // NOLINT #else // Assume other platforms have gettimeofday(). // TODO(kenton@google.com): Use autoconf to detect availability of // gettimeofday(). # define GTEST_HAS_GETTIMEOFDAY_ 1 // cpplint thinks that the header is already included, so we want to // silence it. # include // NOLINT # include // NOLINT #endif // GTEST_OS_LINUX #if GTEST_HAS_EXCEPTIONS # include #endif #if GTEST_CAN_STREAM_RESULTS_ # include // NOLINT # include // NOLINT #endif // Indicates that this translation unit is part of Google Test's // implementation. It must come before gtest-internal-inl.h is // included, or there will be a compiler error. This trick is to // prevent a user from accidentally including gtest-internal-inl.h in // his code. #define GTEST_IMPLEMENTATION_ 1 // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // Utility functions and classes used by the Google C++ testing framework. // // Author: wan@google.com (Zhanyong Wan) // // This file contains purely Google Test's internal implementation. Please // DO NOT #INCLUDE IT IN A USER PROGRAM. #ifndef GTEST_SRC_GTEST_INTERNAL_INL_H_ #define GTEST_SRC_GTEST_INTERNAL_INL_H_ // GTEST_IMPLEMENTATION_ is defined to 1 iff the current translation unit is // part of Google Test's implementation; otherwise it's undefined. #if !GTEST_IMPLEMENTATION_ // A user is trying to include this from his code - just say no. # error "gtest-internal-inl.h is part of Google Test's internal implementation." # error "It must not be included except by Google Test itself." #endif // GTEST_IMPLEMENTATION_ #ifndef _WIN32_WCE # include #endif // !_WIN32_WCE #include #include // For strtoll/_strtoul64/malloc/free. #include // For memmove. #include #include #include #if GTEST_OS_WINDOWS # include // NOLINT #endif // GTEST_OS_WINDOWS namespace testing { // Declares the flags. // // We don't want the users to modify this flag in the code, but want // Google Test's own unit tests to be able to access it. Therefore we // declare it here as opposed to in gtest.h. GTEST_DECLARE_bool_(death_test_use_fork); namespace internal { // The value of GetTestTypeId() as seen from within the Google Test // library. This is solely for testing GetTestTypeId(). GTEST_API_ extern const TypeId kTestTypeIdInGoogleTest; // Names of the flags (needed for parsing Google Test flags). const char kAlsoRunDisabledTestsFlag[] = "also_run_disabled_tests"; const char kBreakOnFailureFlag[] = "break_on_failure"; const char kCatchExceptionsFlag[] = "catch_exceptions"; const char kColorFlag[] = "color"; const char kFilterFlag[] = "filter"; const char kListTestsFlag[] = "list_tests"; const char kOutputFlag[] = "output"; const char kPrintTimeFlag[] = "print_time"; const char kRandomSeedFlag[] = "random_seed"; const char kRepeatFlag[] = "repeat"; const char kShuffleFlag[] = "shuffle"; const char kStackTraceDepthFlag[] = "stack_trace_depth"; const char kStreamResultToFlag[] = "stream_result_to"; const char kThrowOnFailureFlag[] = "throw_on_failure"; // A valid random seed must be in [1, kMaxRandomSeed]. const int kMaxRandomSeed = 99999; // g_help_flag is true iff the --help flag or an equivalent form is // specified on the command line. GTEST_API_ extern bool g_help_flag; // Returns the current time in milliseconds. GTEST_API_ TimeInMillis GetTimeInMillis(); // Returns true iff Google Test should use colors in the output. GTEST_API_ bool ShouldUseColor(bool stdout_is_tty); // Formats the given time in milliseconds as seconds. GTEST_API_ std::string FormatTimeInMillisAsSeconds(TimeInMillis ms); // Parses a string for an Int32 flag, in the form of "--flag=value". // // On success, stores the value of the flag in *value, and returns // true. On failure, returns false without changing *value. GTEST_API_ bool ParseInt32Flag( const char* str, const char* flag, Int32* value); // Returns a random seed in range [1, kMaxRandomSeed] based on the // given --gtest_random_seed flag value. inline int GetRandomSeedFromFlag(Int32 random_seed_flag) { const unsigned int raw_seed = (random_seed_flag == 0) ? static_cast(GetTimeInMillis()) : static_cast(random_seed_flag); // Normalizes the actual seed to range [1, kMaxRandomSeed] such that // it's easy to type. const int normalized_seed = static_cast((raw_seed - 1U) % static_cast(kMaxRandomSeed)) + 1; return normalized_seed; } // Returns the first valid random seed after 'seed'. The behavior is // undefined if 'seed' is invalid. The seed after kMaxRandomSeed is // considered to be 1. inline int GetNextRandomSeed(int seed) { GTEST_CHECK_(1 <= seed && seed <= kMaxRandomSeed) << "Invalid random seed " << seed << " - must be in [1, " << kMaxRandomSeed << "]."; const int next_seed = seed + 1; return (next_seed > kMaxRandomSeed) ? 1 : next_seed; } // This class saves the values of all Google Test flags in its c'tor, and // restores them in its d'tor. class GTestFlagSaver { public: // The c'tor. GTestFlagSaver() { also_run_disabled_tests_ = GTEST_FLAG(also_run_disabled_tests); break_on_failure_ = GTEST_FLAG(break_on_failure); catch_exceptions_ = GTEST_FLAG(catch_exceptions); color_ = GTEST_FLAG(color); death_test_style_ = GTEST_FLAG(death_test_style); death_test_use_fork_ = GTEST_FLAG(death_test_use_fork); filter_ = GTEST_FLAG(filter); internal_run_death_test_ = GTEST_FLAG(internal_run_death_test); list_tests_ = GTEST_FLAG(list_tests); output_ = GTEST_FLAG(output); print_time_ = GTEST_FLAG(print_time); random_seed_ = GTEST_FLAG(random_seed); repeat_ = GTEST_FLAG(repeat); shuffle_ = GTEST_FLAG(shuffle); stack_trace_depth_ = GTEST_FLAG(stack_trace_depth); stream_result_to_ = GTEST_FLAG(stream_result_to); throw_on_failure_ = GTEST_FLAG(throw_on_failure); } // The d'tor is not virtual. DO NOT INHERIT FROM THIS CLASS. ~GTestFlagSaver() { GTEST_FLAG(also_run_disabled_tests) = also_run_disabled_tests_; GTEST_FLAG(break_on_failure) = break_on_failure_; GTEST_FLAG(catch_exceptions) = catch_exceptions_; GTEST_FLAG(color) = color_; GTEST_FLAG(death_test_style) = death_test_style_; GTEST_FLAG(death_test_use_fork) = death_test_use_fork_; GTEST_FLAG(filter) = filter_; GTEST_FLAG(internal_run_death_test) = internal_run_death_test_; GTEST_FLAG(list_tests) = list_tests_; GTEST_FLAG(output) = output_; GTEST_FLAG(print_time) = print_time_; GTEST_FLAG(random_seed) = random_seed_; GTEST_FLAG(repeat) = repeat_; GTEST_FLAG(shuffle) = shuffle_; GTEST_FLAG(stack_trace_depth) = stack_trace_depth_; GTEST_FLAG(stream_result_to) = stream_result_to_; GTEST_FLAG(throw_on_failure) = throw_on_failure_; } private: // Fields for saving the original values of flags. bool also_run_disabled_tests_; bool break_on_failure_; bool catch_exceptions_; String color_; String death_test_style_; bool death_test_use_fork_; String filter_; String internal_run_death_test_; bool list_tests_; String output_; bool print_time_; bool pretty_; internal::Int32 random_seed_; internal::Int32 repeat_; bool shuffle_; internal::Int32 stack_trace_depth_; String stream_result_to_; bool throw_on_failure_; } GTEST_ATTRIBUTE_UNUSED_; // Converts a Unicode code point to a narrow string in UTF-8 encoding. // code_point parameter is of type UInt32 because wchar_t may not be // wide enough to contain a code point. // The output buffer str must containt at least 32 characters. // The function returns the address of the output buffer. // If the code_point is not a valid Unicode code point // (i.e. outside of Unicode range U+0 to U+10FFFF) it will be output // as '(Invalid Unicode 0xXXXXXXXX)'. GTEST_API_ char* CodePointToUtf8(UInt32 code_point, char* str); // Converts a wide string to a narrow string in UTF-8 encoding. // The wide string is assumed to have the following encoding: // UTF-16 if sizeof(wchar_t) == 2 (on Windows, Cygwin, Symbian OS) // UTF-32 if sizeof(wchar_t) == 4 (on Linux) // Parameter str points to a null-terminated wide string. // Parameter num_chars may additionally limit the number // of wchar_t characters processed. -1 is used when the entire string // should be processed. // If the string contains code points that are not valid Unicode code points // (i.e. outside of Unicode range U+0 to U+10FFFF) they will be output // as '(Invalid Unicode 0xXXXXXXXX)'. If the string is in UTF16 encoding // and contains invalid UTF-16 surrogate pairs, values in those pairs // will be encoded as individual Unicode characters from Basic Normal Plane. GTEST_API_ String WideStringToUtf8(const wchar_t* str, int num_chars); // Reads the GTEST_SHARD_STATUS_FILE environment variable, and creates the file // if the variable is present. If a file already exists at this location, this // function will write over it. If the variable is present, but the file cannot // be created, prints an error and exits. void WriteToShardStatusFileIfNeeded(); // Checks whether sharding is enabled by examining the relevant // environment variable values. If the variables are present, // but inconsistent (e.g., shard_index >= total_shards), prints // an error and exits. If in_subprocess_for_death_test, sharding is // disabled because it must only be applied to the original test // process. Otherwise, we could filter out death tests we intended to execute. GTEST_API_ bool ShouldShard(const char* total_shards_str, const char* shard_index_str, bool in_subprocess_for_death_test); // Parses the environment variable var as an Int32. If it is unset, // returns default_val. If it is not an Int32, prints an error and // and aborts. GTEST_API_ Int32 Int32FromEnvOrDie(const char* env_var, Int32 default_val); // Given the total number of shards, the shard index, and the test id, // returns true iff the test should be run on this shard. The test id is // some arbitrary but unique non-negative integer assigned to each test // method. Assumes that 0 <= shard_index < total_shards. GTEST_API_ bool ShouldRunTestOnShard( int total_shards, int shard_index, int test_id); // STL container utilities. // Returns the number of elements in the given container that satisfy // the given predicate. template inline int CountIf(const Container& c, Predicate predicate) { // Implemented as an explicit loop since std::count_if() in libCstd on // Solaris has a non-standard signature. int count = 0; for (typename Container::const_iterator it = c.begin(); it != c.end(); ++it) { if (predicate(*it)) ++count; } return count; } // Applies a function/functor to each element in the container. template void ForEach(const Container& c, Functor functor) { std::for_each(c.begin(), c.end(), functor); } // Returns the i-th element of the vector, or default_value if i is not // in range [0, v.size()). template inline E GetElementOr(const std::vector& v, int i, E default_value) { return (i < 0 || i >= static_cast(v.size())) ? default_value : v[i]; } // Performs an in-place shuffle of a range of the vector's elements. // 'begin' and 'end' are element indices as an STL-style range; // i.e. [begin, end) are shuffled, where 'end' == size() means to // shuffle to the end of the vector. template void ShuffleRange(internal::Random* random, int begin, int end, std::vector* v) { const int size = static_cast(v->size()); GTEST_CHECK_(0 <= begin && begin <= size) << "Invalid shuffle range start " << begin << ": must be in range [0, " << size << "]."; GTEST_CHECK_(begin <= end && end <= size) << "Invalid shuffle range finish " << end << ": must be in range [" << begin << ", " << size << "]."; // Fisher-Yates shuffle, from // http://en.wikipedia.org/wiki/Fisher-Yates_shuffle for (int range_width = end - begin; range_width >= 2; range_width--) { const int last_in_range = begin + range_width - 1; const int selected = begin + random->Generate(range_width); std::swap((*v)[selected], (*v)[last_in_range]); } } // Performs an in-place shuffle of the vector's elements. template inline void Shuffle(internal::Random* random, std::vector* v) { ShuffleRange(random, 0, static_cast(v->size()), v); } // A function for deleting an object. Handy for being used as a // functor. template static void Delete(T* x) { delete x; } // A predicate that checks the key of a TestProperty against a known key. // // TestPropertyKeyIs is copyable. class TestPropertyKeyIs { public: // Constructor. // // TestPropertyKeyIs has NO default constructor. explicit TestPropertyKeyIs(const char* key) : key_(key) {} // Returns true iff the test name of test property matches on key_. bool operator()(const TestProperty& test_property) const { return String(test_property.key()).Compare(key_) == 0; } private: String key_; }; // Class UnitTestOptions. // // This class contains functions for processing options the user // specifies when running the tests. It has only static members. // // In most cases, the user can specify an option using either an // environment variable or a command line flag. E.g. you can set the // test filter using either GTEST_FILTER or --gtest_filter. If both // the variable and the flag are present, the latter overrides the // former. class GTEST_API_ UnitTestOptions { public: // Functions for processing the gtest_output flag. // Returns the output format, or "" for normal printed output. static String GetOutputFormat(); // Returns the absolute path of the requested output file, or the // default (test_detail.xml in the original working directory) if // none was explicitly specified. static String GetAbsolutePathToOutputFile(); // Functions for processing the gtest_filter flag. // Returns true iff the wildcard pattern matches the string. The // first ':' or '\0' character in pattern marks the end of it. // // This recursive algorithm isn't very efficient, but is clear and // works well enough for matching test names, which are short. static bool PatternMatchesString(const char *pattern, const char *str); // Returns true iff the user-specified filter matches the test case // name and the test name. static bool FilterMatchesTest(const String &test_case_name, const String &test_name); #if GTEST_OS_WINDOWS // Function for supporting the gtest_catch_exception flag. // Returns EXCEPTION_EXECUTE_HANDLER if Google Test should handle the // given SEH exception, or EXCEPTION_CONTINUE_SEARCH otherwise. // This function is useful as an __except condition. static int GTestShouldProcessSEH(DWORD exception_code); #endif // GTEST_OS_WINDOWS // Returns true if "name" matches the ':' separated list of glob-style // filters in "filter". static bool MatchesFilter(const String& name, const char* filter); }; // Returns the current application's name, removing directory path if that // is present. Used by UnitTestOptions::GetOutputFile. GTEST_API_ FilePath GetCurrentExecutableName(); // The role interface for getting the OS stack trace as a string. class OsStackTraceGetterInterface { public: OsStackTraceGetterInterface() {} virtual ~OsStackTraceGetterInterface() {} // Returns the current OS stack trace as a String. Parameters: // // max_depth - the maximum number of stack frames to be included // in the trace. // skip_count - the number of top frames to be skipped; doesn't count // against max_depth. virtual String CurrentStackTrace(int max_depth, int skip_count) = 0; // UponLeavingGTest() should be called immediately before Google Test calls // user code. It saves some information about the current stack that // CurrentStackTrace() will use to find and hide Google Test stack frames. virtual void UponLeavingGTest() = 0; private: GTEST_DISALLOW_COPY_AND_ASSIGN_(OsStackTraceGetterInterface); }; // A working implementation of the OsStackTraceGetterInterface interface. class OsStackTraceGetter : public OsStackTraceGetterInterface { public: OsStackTraceGetter() : caller_frame_(NULL) {} virtual String CurrentStackTrace(int max_depth, int skip_count); virtual void UponLeavingGTest(); // This string is inserted in place of stack frames that are part of // Google Test's implementation. static const char* const kElidedFramesMarker; private: Mutex mutex_; // protects all internal state // We save the stack frame below the frame that calls user code. // We do this because the address of the frame immediately below // the user code changes between the call to UponLeavingGTest() // and any calls to CurrentStackTrace() from within the user code. void* caller_frame_; GTEST_DISALLOW_COPY_AND_ASSIGN_(OsStackTraceGetter); }; // Information about a Google Test trace point. struct TraceInfo { const char* file; int line; String message; }; // This is the default global test part result reporter used in UnitTestImpl. // This class should only be used by UnitTestImpl. class DefaultGlobalTestPartResultReporter : public TestPartResultReporterInterface { public: explicit DefaultGlobalTestPartResultReporter(UnitTestImpl* unit_test); // Implements the TestPartResultReporterInterface. Reports the test part // result in the current test. virtual void ReportTestPartResult(const TestPartResult& result); private: UnitTestImpl* const unit_test_; GTEST_DISALLOW_COPY_AND_ASSIGN_(DefaultGlobalTestPartResultReporter); }; // This is the default per thread test part result reporter used in // UnitTestImpl. This class should only be used by UnitTestImpl. class DefaultPerThreadTestPartResultReporter : public TestPartResultReporterInterface { public: explicit DefaultPerThreadTestPartResultReporter(UnitTestImpl* unit_test); // Implements the TestPartResultReporterInterface. The implementation just // delegates to the current global test part result reporter of *unit_test_. virtual void ReportTestPartResult(const TestPartResult& result); private: UnitTestImpl* const unit_test_; GTEST_DISALLOW_COPY_AND_ASSIGN_(DefaultPerThreadTestPartResultReporter); }; // The private implementation of the UnitTest class. We don't protect // the methods under a mutex, as this class is not accessible by a // user and the UnitTest class that delegates work to this class does // proper locking. class GTEST_API_ UnitTestImpl { public: explicit UnitTestImpl(UnitTest* parent); virtual ~UnitTestImpl(); // There are two different ways to register your own TestPartResultReporter. // You can register your own repoter to listen either only for test results // from the current thread or for results from all threads. // By default, each per-thread test result repoter just passes a new // TestPartResult to the global test result reporter, which registers the // test part result for the currently running test. // Returns the global test part result reporter. TestPartResultReporterInterface* GetGlobalTestPartResultReporter(); // Sets the global test part result reporter. void SetGlobalTestPartResultReporter( TestPartResultReporterInterface* reporter); // Returns the test part result reporter for the current thread. TestPartResultReporterInterface* GetTestPartResultReporterForCurrentThread(); // Sets the test part result reporter for the current thread. void SetTestPartResultReporterForCurrentThread( TestPartResultReporterInterface* reporter); // Gets the number of successful test cases. int successful_test_case_count() const; // Gets the number of failed test cases. int failed_test_case_count() const; // Gets the number of all test cases. int total_test_case_count() const; // Gets the number of all test cases that contain at least one test // that should run. int test_case_to_run_count() const; // Gets the number of successful tests. int successful_test_count() const; // Gets the number of failed tests. int failed_test_count() const; // Gets the number of disabled tests. int disabled_test_count() const; // Gets the number of all tests. int total_test_count() const; // Gets the number of tests that should run. int test_to_run_count() const; // Gets the elapsed time, in milliseconds. TimeInMillis elapsed_time() const { return elapsed_time_; } // Returns true iff the unit test passed (i.e. all test cases passed). bool Passed() const { return !Failed(); } // Returns true iff the unit test failed (i.e. some test case failed // or something outside of all tests failed). bool Failed() const { return failed_test_case_count() > 0 || ad_hoc_test_result()->Failed(); } // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. const TestCase* GetTestCase(int i) const { const int index = GetElementOr(test_case_indices_, i, -1); return index < 0 ? NULL : test_cases_[i]; } // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. TestCase* GetMutableTestCase(int i) { const int index = GetElementOr(test_case_indices_, i, -1); return index < 0 ? NULL : test_cases_[index]; } // Provides access to the event listener list. TestEventListeners* listeners() { return &listeners_; } // Returns the TestResult for the test that's currently running, or // the TestResult for the ad hoc test if no test is running. TestResult* current_test_result(); // Returns the TestResult for the ad hoc test. const TestResult* ad_hoc_test_result() const { return &ad_hoc_test_result_; } // Sets the OS stack trace getter. // // Does nothing if the input and the current OS stack trace getter // are the same; otherwise, deletes the old getter and makes the // input the current getter. void set_os_stack_trace_getter(OsStackTraceGetterInterface* getter); // Returns the current OS stack trace getter if it is not NULL; // otherwise, creates an OsStackTraceGetter, makes it the current // getter, and returns it. OsStackTraceGetterInterface* os_stack_trace_getter(); // Returns the current OS stack trace as a String. // // The maximum number of stack frames to be included is specified by // the gtest_stack_trace_depth flag. The skip_count parameter // specifies the number of top frames to be skipped, which doesn't // count against the number of frames to be included. // // For example, if Foo() calls Bar(), which in turn calls // CurrentOsStackTraceExceptTop(1), Foo() will be included in the // trace but Bar() and CurrentOsStackTraceExceptTop() won't. String CurrentOsStackTraceExceptTop(int skip_count); // Finds and returns a TestCase with the given name. If one doesn't // exist, creates one and returns it. // // Arguments: // // test_case_name: name of the test case // type_param: the name of the test's type parameter, or NULL if // this is not a typed or a type-parameterized test. // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case TestCase* GetTestCase(const char* test_case_name, const char* type_param, Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc); // Adds a TestInfo to the unit test. // // Arguments: // // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case // test_info: the TestInfo object void AddTestInfo(Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc, TestInfo* test_info) { // In order to support thread-safe death tests, we need to // remember the original working directory when the test program // was first invoked. We cannot do this in RUN_ALL_TESTS(), as // the user may have changed the current directory before calling // RUN_ALL_TESTS(). Therefore we capture the current directory in // AddTestInfo(), which is called to register a TEST or TEST_F // before main() is reached. if (original_working_dir_.IsEmpty()) { original_working_dir_.Set(FilePath::GetCurrentDir()); GTEST_CHECK_(!original_working_dir_.IsEmpty()) << "Failed to get the current working directory."; } GetTestCase(test_info->test_case_name(), test_info->type_param(), set_up_tc, tear_down_tc)->AddTestInfo(test_info); } #if GTEST_HAS_PARAM_TEST // Returns ParameterizedTestCaseRegistry object used to keep track of // value-parameterized tests and instantiate and register them. internal::ParameterizedTestCaseRegistry& parameterized_test_registry() { return parameterized_test_registry_; } #endif // GTEST_HAS_PARAM_TEST // Sets the TestCase object for the test that's currently running. void set_current_test_case(TestCase* a_current_test_case) { current_test_case_ = a_current_test_case; } // Sets the TestInfo object for the test that's currently running. If // current_test_info is NULL, the assertion results will be stored in // ad_hoc_test_result_. void set_current_test_info(TestInfo* a_current_test_info) { current_test_info_ = a_current_test_info; } // Registers all parameterized tests defined using TEST_P and // INSTANTIATE_TEST_CASE_P, creating regular tests for each test/parameter // combination. This method can be called more then once; it has guards // protecting from registering the tests more then once. If // value-parameterized tests are disabled, RegisterParameterizedTests is // present but does nothing. void RegisterParameterizedTests(); // Runs all tests in this UnitTest object, prints the result, and // returns true if all tests are successful. If any exception is // thrown during a test, this test is considered to be failed, but // the rest of the tests will still be run. bool RunAllTests(); // Clears the results of all tests, except the ad hoc tests. void ClearNonAdHocTestResult() { ForEach(test_cases_, TestCase::ClearTestCaseResult); } // Clears the results of ad-hoc test assertions. void ClearAdHocTestResult() { ad_hoc_test_result_.Clear(); } enum ReactionToSharding { HONOR_SHARDING_PROTOCOL, IGNORE_SHARDING_PROTOCOL }; // Matches the full name of each test against the user-specified // filter to decide whether the test should run, then records the // result in each TestCase and TestInfo object. // If shard_tests == HONOR_SHARDING_PROTOCOL, further filters tests // based on sharding variables in the environment. // Returns the number of tests that should run. int FilterTests(ReactionToSharding shard_tests); // Prints the names of the tests matching the user-specified filter flag. void ListTestsMatchingFilter(); const TestCase* current_test_case() const { return current_test_case_; } TestInfo* current_test_info() { return current_test_info_; } const TestInfo* current_test_info() const { return current_test_info_; } // Returns the vector of environments that need to be set-up/torn-down // before/after the tests are run. std::vector& environments() { return environments_; } // Getters for the per-thread Google Test trace stack. std::vector& gtest_trace_stack() { return *(gtest_trace_stack_.pointer()); } const std::vector& gtest_trace_stack() const { return gtest_trace_stack_.get(); } #if GTEST_HAS_DEATH_TEST void InitDeathTestSubprocessControlInfo() { internal_run_death_test_flag_.reset(ParseInternalRunDeathTestFlag()); } // Returns a pointer to the parsed --gtest_internal_run_death_test // flag, or NULL if that flag was not specified. // This information is useful only in a death test child process. // Must not be called before a call to InitGoogleTest. const InternalRunDeathTestFlag* internal_run_death_test_flag() const { return internal_run_death_test_flag_.get(); } // Returns a pointer to the current death test factory. internal::DeathTestFactory* death_test_factory() { return death_test_factory_.get(); } void SuppressTestEventsIfInSubprocess(); friend class ReplaceDeathTestFactory; #endif // GTEST_HAS_DEATH_TEST // Initializes the event listener performing XML output as specified by // UnitTestOptions. Must not be called before InitGoogleTest. void ConfigureXmlOutput(); #if GTEST_CAN_STREAM_RESULTS_ // Initializes the event listener for streaming test results to a socket. // Must not be called before InitGoogleTest. void ConfigureStreamingOutput(); #endif // Performs initialization dependent upon flag values obtained in // ParseGoogleTestFlagsOnly. Is called from InitGoogleTest after the call to // ParseGoogleTestFlagsOnly. In case a user neglects to call InitGoogleTest // this function is also called from RunAllTests. Since this function can be // called more than once, it has to be idempotent. void PostFlagParsingInit(); // Gets the random seed used at the start of the current test iteration. int random_seed() const { return random_seed_; } // Gets the random number generator. internal::Random* random() { return &random_; } // Shuffles all test cases, and the tests within each test case, // making sure that death tests are still run first. void ShuffleTests(); // Restores the test cases and tests to their order before the first shuffle. void UnshuffleTests(); // Returns the value of GTEST_FLAG(catch_exceptions) at the moment // UnitTest::Run() starts. bool catch_exceptions() const { return catch_exceptions_; } private: friend class ::testing::UnitTest; // Used by UnitTest::Run() to capture the state of // GTEST_FLAG(catch_exceptions) at the moment it starts. void set_catch_exceptions(bool value) { catch_exceptions_ = value; } // The UnitTest object that owns this implementation object. UnitTest* const parent_; // The working directory when the first TEST() or TEST_F() was // executed. internal::FilePath original_working_dir_; // The default test part result reporters. DefaultGlobalTestPartResultReporter default_global_test_part_result_reporter_; DefaultPerThreadTestPartResultReporter default_per_thread_test_part_result_reporter_; // Points to (but doesn't own) the global test part result reporter. TestPartResultReporterInterface* global_test_part_result_repoter_; // Protects read and write access to global_test_part_result_reporter_. internal::Mutex global_test_part_result_reporter_mutex_; // Points to (but doesn't own) the per-thread test part result reporter. internal::ThreadLocal per_thread_test_part_result_reporter_; // The vector of environments that need to be set-up/torn-down // before/after the tests are run. std::vector environments_; // The vector of TestCases in their original order. It owns the // elements in the vector. std::vector test_cases_; // Provides a level of indirection for the test case list to allow // easy shuffling and restoring the test case order. The i-th // element of this vector is the index of the i-th test case in the // shuffled order. std::vector test_case_indices_; #if GTEST_HAS_PARAM_TEST // ParameterizedTestRegistry object used to register value-parameterized // tests. internal::ParameterizedTestCaseRegistry parameterized_test_registry_; // Indicates whether RegisterParameterizedTests() has been called already. bool parameterized_tests_registered_; #endif // GTEST_HAS_PARAM_TEST // Index of the last death test case registered. Initially -1. int last_death_test_case_; // This points to the TestCase for the currently running test. It // changes as Google Test goes through one test case after another. // When no test is running, this is set to NULL and Google Test // stores assertion results in ad_hoc_test_result_. Initially NULL. TestCase* current_test_case_; // This points to the TestInfo for the currently running test. It // changes as Google Test goes through one test after another. When // no test is running, this is set to NULL and Google Test stores // assertion results in ad_hoc_test_result_. Initially NULL. TestInfo* current_test_info_; // Normally, a user only writes assertions inside a TEST or TEST_F, // or inside a function called by a TEST or TEST_F. Since Google // Test keeps track of which test is current running, it can // associate such an assertion with the test it belongs to. // // If an assertion is encountered when no TEST or TEST_F is running, // Google Test attributes the assertion result to an imaginary "ad hoc" // test, and records the result in ad_hoc_test_result_. TestResult ad_hoc_test_result_; // The list of event listeners that can be used to track events inside // Google Test. TestEventListeners listeners_; // The OS stack trace getter. Will be deleted when the UnitTest // object is destructed. By default, an OsStackTraceGetter is used, // but the user can set this field to use a custom getter if that is // desired. OsStackTraceGetterInterface* os_stack_trace_getter_; // True iff PostFlagParsingInit() has been called. bool post_flag_parse_init_performed_; // The random number seed used at the beginning of the test run. int random_seed_; // Our random number generator. internal::Random random_; // How long the test took to run, in milliseconds. TimeInMillis elapsed_time_; #if GTEST_HAS_DEATH_TEST // The decomposed components of the gtest_internal_run_death_test flag, // parsed when RUN_ALL_TESTS is called. internal::scoped_ptr internal_run_death_test_flag_; internal::scoped_ptr death_test_factory_; #endif // GTEST_HAS_DEATH_TEST // A per-thread stack of traces created by the SCOPED_TRACE() macro. internal::ThreadLocal > gtest_trace_stack_; // The value of GTEST_FLAG(catch_exceptions) at the moment RunAllTests() // starts. bool catch_exceptions_; GTEST_DISALLOW_COPY_AND_ASSIGN_(UnitTestImpl); }; // class UnitTestImpl // Convenience function for accessing the global UnitTest // implementation object. inline UnitTestImpl* GetUnitTestImpl() { return UnitTest::GetInstance()->impl(); } #if GTEST_USES_SIMPLE_RE // Internal helper functions for implementing the simple regular // expression matcher. GTEST_API_ bool IsInSet(char ch, const char* str); GTEST_API_ bool IsAsciiDigit(char ch); GTEST_API_ bool IsAsciiPunct(char ch); GTEST_API_ bool IsRepeat(char ch); GTEST_API_ bool IsAsciiWhiteSpace(char ch); GTEST_API_ bool IsAsciiWordChar(char ch); GTEST_API_ bool IsValidEscape(char ch); GTEST_API_ bool AtomMatchesChar(bool escaped, char pattern, char ch); GTEST_API_ bool ValidateRegex(const char* regex); GTEST_API_ bool MatchRegexAtHead(const char* regex, const char* str); GTEST_API_ bool MatchRepetitionAndRegexAtHead( bool escaped, char ch, char repeat, const char* regex, const char* str); GTEST_API_ bool MatchRegexAnywhere(const char* regex, const char* str); #endif // GTEST_USES_SIMPLE_RE // Parses the command line for Google Test flags, without initializing // other parts of Google Test. GTEST_API_ void ParseGoogleTestFlagsOnly(int* argc, char** argv); GTEST_API_ void ParseGoogleTestFlagsOnly(int* argc, wchar_t** argv); #if GTEST_HAS_DEATH_TEST // Returns the message describing the last system error, regardless of the // platform. GTEST_API_ String GetLastErrnoDescription(); # if GTEST_OS_WINDOWS // Provides leak-safe Windows kernel handle ownership. class AutoHandle { public: AutoHandle() : handle_(INVALID_HANDLE_VALUE) {} explicit AutoHandle(HANDLE handle) : handle_(handle) {} ~AutoHandle() { Reset(); } HANDLE Get() const { return handle_; } void Reset() { Reset(INVALID_HANDLE_VALUE); } void Reset(HANDLE handle) { if (handle != handle_) { if (handle_ != INVALID_HANDLE_VALUE) ::CloseHandle(handle_); handle_ = handle; } } private: HANDLE handle_; GTEST_DISALLOW_COPY_AND_ASSIGN_(AutoHandle); }; # endif // GTEST_OS_WINDOWS // Attempts to parse a string into a positive integer pointed to by the // number parameter. Returns true if that is possible. // GTEST_HAS_DEATH_TEST implies that we have ::std::string, so we can use // it here. template bool ParseNaturalNumber(const ::std::string& str, Integer* number) { // Fail fast if the given string does not begin with a digit; // this bypasses strtoXXX's "optional leading whitespace and plus // or minus sign" semantics, which are undesirable here. if (str.empty() || !IsDigit(str[0])) { return false; } errno = 0; char* end; // BiggestConvertible is the largest integer type that system-provided // string-to-number conversion routines can return. # if GTEST_OS_WINDOWS && !defined(__GNUC__) // MSVC and C++ Builder define __int64 instead of the standard long long. typedef unsigned __int64 BiggestConvertible; const BiggestConvertible parsed = _strtoui64(str.c_str(), &end, 10); # else typedef unsigned long long BiggestConvertible; // NOLINT const BiggestConvertible parsed = strtoull(str.c_str(), &end, 10); # endif // GTEST_OS_WINDOWS && !defined(__GNUC__) const bool parse_success = *end == '\0' && errno == 0; // TODO(vladl@google.com): Convert this to compile time assertion when it is // available. GTEST_CHECK_(sizeof(Integer) <= sizeof(parsed)); const Integer result = static_cast(parsed); if (parse_success && static_cast(result) == parsed) { *number = result; return true; } return false; } #endif // GTEST_HAS_DEATH_TEST // TestResult contains some private methods that should be hidden from // Google Test user but are required for testing. This class allow our tests // to access them. // // This class is supplied only for the purpose of testing Google Test's own // constructs. Do not use it in user tests, either directly or indirectly. class TestResultAccessor { public: static void RecordProperty(TestResult* test_result, const TestProperty& property) { test_result->RecordProperty(property); } static void ClearTestPartResults(TestResult* test_result) { test_result->ClearTestPartResults(); } static const std::vector& test_part_results( const TestResult& test_result) { return test_result.test_part_results(); } }; } // namespace internal } // namespace testing #endif // GTEST_SRC_GTEST_INTERNAL_INL_H_ #undef GTEST_IMPLEMENTATION_ #if GTEST_OS_WINDOWS # define vsnprintf _vsnprintf #endif // GTEST_OS_WINDOWS namespace testing { using internal::CountIf; using internal::ForEach; using internal::GetElementOr; using internal::Shuffle; // Constants. // A test whose test case name or test name matches this filter is // disabled and not run. static const char kDisableTestFilter[] = "DISABLED_*:*/DISABLED_*"; // A test case whose name matches this filter is considered a death // test case and will be run before test cases whose name doesn't // match this filter. static const char kDeathTestCaseFilter[] = "*DeathTest:*DeathTest/*"; // A test filter that matches everything. static const char kUniversalFilter[] = "*"; // The default output file for XML output. static const char kDefaultOutputFile[] = "test_detail.xml"; // The environment variable name for the test shard index. static const char kTestShardIndex[] = "GTEST_SHARD_INDEX"; // The environment variable name for the total number of test shards. static const char kTestTotalShards[] = "GTEST_TOTAL_SHARDS"; // The environment variable name for the test shard status file. static const char kTestShardStatusFile[] = "GTEST_SHARD_STATUS_FILE"; namespace internal { // The text used in failure messages to indicate the start of the // stack trace. const char kStackTraceMarker[] = "\nStack trace:\n"; // g_help_flag is true iff the --help flag or an equivalent form is // specified on the command line. bool g_help_flag = false; } // namespace internal GTEST_DEFINE_bool_( also_run_disabled_tests, internal::BoolFromGTestEnv("also_run_disabled_tests", false), "Run disabled tests too, in addition to the tests normally being run."); GTEST_DEFINE_bool_( break_on_failure, internal::BoolFromGTestEnv("break_on_failure", false), "True iff a failed assertion should be a debugger break-point."); GTEST_DEFINE_bool_( catch_exceptions, internal::BoolFromGTestEnv("catch_exceptions", true), "True iff " GTEST_NAME_ " should catch exceptions and treat them as test failures."); GTEST_DEFINE_string_( color, internal::StringFromGTestEnv("color", "auto"), "Whether to use colors in the output. Valid values: yes, no, " "and auto. 'auto' means to use colors if the output is " "being sent to a terminal and the TERM environment variable " "is set to xterm, xterm-color, xterm-256color, linux or cygwin."); GTEST_DEFINE_string_( filter, internal::StringFromGTestEnv("filter", kUniversalFilter), "A colon-separated list of glob (not regex) patterns " "for filtering the tests to run, optionally followed by a " "'-' and a : separated list of negative patterns (tests to " "exclude). A test is run if it matches one of the positive " "patterns and does not match any of the negative patterns."); GTEST_DEFINE_bool_(list_tests, false, "List all tests without running them."); GTEST_DEFINE_string_( output, internal::StringFromGTestEnv("output", ""), "A format (currently must be \"xml\"), optionally followed " "by a colon and an output file name or directory. A directory " "is indicated by a trailing pathname separator. " "Examples: \"xml:filename.xml\", \"xml::directoryname/\". " "If a directory is specified, output files will be created " "within that directory, with file-names based on the test " "executable's name and, if necessary, made unique by adding " "digits."); GTEST_DEFINE_bool_( print_time, internal::BoolFromGTestEnv("print_time", true), "True iff " GTEST_NAME_ " should display elapsed time in text output."); GTEST_DEFINE_int32_( random_seed, internal::Int32FromGTestEnv("random_seed", 0), "Random number seed to use when shuffling test orders. Must be in range " "[1, 99999], or 0 to use a seed based on the current time."); GTEST_DEFINE_int32_( repeat, internal::Int32FromGTestEnv("repeat", 1), "How many times to repeat each test. Specify a negative number " "for repeating forever. Useful for shaking out flaky tests."); GTEST_DEFINE_bool_( show_internal_stack_frames, false, "True iff " GTEST_NAME_ " should include internal stack frames when " "printing test failure stack traces."); GTEST_DEFINE_bool_( shuffle, internal::BoolFromGTestEnv("shuffle", false), "True iff " GTEST_NAME_ " should randomize tests' order on every run."); GTEST_DEFINE_int32_( stack_trace_depth, internal::Int32FromGTestEnv("stack_trace_depth", kMaxStackTraceDepth), "The maximum number of stack frames to print when an " "assertion fails. The valid range is 0 through 100, inclusive."); GTEST_DEFINE_string_( stream_result_to, internal::StringFromGTestEnv("stream_result_to", ""), "This flag specifies the host name and the port number on which to stream " "test results. Example: \"localhost:555\". The flag is effective only on " "Linux."); GTEST_DEFINE_bool_( throw_on_failure, internal::BoolFromGTestEnv("throw_on_failure", false), "When this flag is specified, a failed assertion will throw an exception " "if exceptions are enabled or exit the program with a non-zero code " "otherwise."); namespace internal { // Generates a random number from [0, range), using a Linear // Congruential Generator (LCG). Crashes if 'range' is 0 or greater // than kMaxRange. UInt32 Random::Generate(UInt32 range) { // These constants are the same as are used in glibc's rand(3). state_ = (1103515245U*state_ + 12345U) % kMaxRange; GTEST_CHECK_(range > 0) << "Cannot generate a number in the range [0, 0)."; GTEST_CHECK_(range <= kMaxRange) << "Generation of a number in [0, " << range << ") was requested, " << "but this can only generate numbers in [0, " << kMaxRange << ")."; // Converting via modulus introduces a bit of downward bias, but // it's simple, and a linear congruential generator isn't too good // to begin with. return state_ % range; } // GTestIsInitialized() returns true iff the user has initialized // Google Test. Useful for catching the user mistake of not initializing // Google Test before calling RUN_ALL_TESTS(). // // A user must call testing::InitGoogleTest() to initialize Google // Test. g_init_gtest_count is set to the number of times // InitGoogleTest() has been called. We don't protect this variable // under a mutex as it is only accessed in the main thread. int g_init_gtest_count = 0; static bool GTestIsInitialized() { return g_init_gtest_count != 0; } // Iterates over a vector of TestCases, keeping a running sum of the // results of calling a given int-returning method on each. // Returns the sum. static int SumOverTestCaseList(const std::vector& case_list, int (TestCase::*method)() const) { int sum = 0; for (size_t i = 0; i < case_list.size(); i++) { sum += (case_list[i]->*method)(); } return sum; } // Returns true iff the test case passed. static bool TestCasePassed(const TestCase* test_case) { return test_case->should_run() && test_case->Passed(); } // Returns true iff the test case failed. static bool TestCaseFailed(const TestCase* test_case) { return test_case->should_run() && test_case->Failed(); } // Returns true iff test_case contains at least one test that should // run. static bool ShouldRunTestCase(const TestCase* test_case) { return test_case->should_run(); } // AssertHelper constructor. AssertHelper::AssertHelper(TestPartResult::Type type, const char* file, int line, const char* message) : data_(new AssertHelperData(type, file, line, message)) { } AssertHelper::~AssertHelper() { delete data_; } // Message assignment, for assertion streaming support. void AssertHelper::operator=(const Message& message) const { UnitTest::GetInstance()-> AddTestPartResult(data_->type, data_->file, data_->line, AppendUserMessage(data_->message, message), UnitTest::GetInstance()->impl() ->CurrentOsStackTraceExceptTop(1) // Skips the stack frame for this function itself. ); // NOLINT } // Mutex for linked pointers. GTEST_DEFINE_STATIC_MUTEX_(g_linked_ptr_mutex); // Application pathname gotten in InitGoogleTest. String g_executable_path; // Returns the current application's name, removing directory path if that // is present. FilePath GetCurrentExecutableName() { FilePath result; #if GTEST_OS_WINDOWS result.Set(FilePath(g_executable_path).RemoveExtension("exe")); #else result.Set(FilePath(g_executable_path)); #endif // GTEST_OS_WINDOWS return result.RemoveDirectoryName(); } // Functions for processing the gtest_output flag. // Returns the output format, or "" for normal printed output. String UnitTestOptions::GetOutputFormat() { const char* const gtest_output_flag = GTEST_FLAG(output).c_str(); if (gtest_output_flag == NULL) return String(""); const char* const colon = strchr(gtest_output_flag, ':'); return (colon == NULL) ? String(gtest_output_flag) : String(gtest_output_flag, colon - gtest_output_flag); } // Returns the name of the requested output file, or the default if none // was explicitly specified. String UnitTestOptions::GetAbsolutePathToOutputFile() { const char* const gtest_output_flag = GTEST_FLAG(output).c_str(); if (gtest_output_flag == NULL) return String(""); const char* const colon = strchr(gtest_output_flag, ':'); if (colon == NULL) return String(internal::FilePath::ConcatPaths( internal::FilePath( UnitTest::GetInstance()->original_working_dir()), internal::FilePath(kDefaultOutputFile)).ToString() ); internal::FilePath output_name(colon + 1); if (!output_name.IsAbsolutePath()) // TODO(wan@google.com): on Windows \some\path is not an absolute // path (as its meaning depends on the current drive), yet the // following logic for turning it into an absolute path is wrong. // Fix it. output_name = internal::FilePath::ConcatPaths( internal::FilePath(UnitTest::GetInstance()->original_working_dir()), internal::FilePath(colon + 1)); if (!output_name.IsDirectory()) return output_name.ToString(); internal::FilePath result(internal::FilePath::GenerateUniqueFileName( output_name, internal::GetCurrentExecutableName(), GetOutputFormat().c_str())); return result.ToString(); } // Returns true iff the wildcard pattern matches the string. The // first ':' or '\0' character in pattern marks the end of it. // // This recursive algorithm isn't very efficient, but is clear and // works well enough for matching test names, which are short. bool UnitTestOptions::PatternMatchesString(const char *pattern, const char *str) { switch (*pattern) { case '\0': case ':': // Either ':' or '\0' marks the end of the pattern. return *str == '\0'; case '?': // Matches any single character. return *str != '\0' && PatternMatchesString(pattern + 1, str + 1); case '*': // Matches any string (possibly empty) of characters. return (*str != '\0' && PatternMatchesString(pattern, str + 1)) || PatternMatchesString(pattern + 1, str); default: // Non-special character. Matches itself. return *pattern == *str && PatternMatchesString(pattern + 1, str + 1); } } bool UnitTestOptions::MatchesFilter(const String& name, const char* filter) { const char *cur_pattern = filter; for (;;) { if (PatternMatchesString(cur_pattern, name.c_str())) { return true; } // Finds the next pattern in the filter. cur_pattern = strchr(cur_pattern, ':'); // Returns if no more pattern can be found. if (cur_pattern == NULL) { return false; } // Skips the pattern separater (the ':' character). cur_pattern++; } } // TODO(keithray): move String function implementations to gtest-string.cc. // Returns true iff the user-specified filter matches the test case // name and the test name. bool UnitTestOptions::FilterMatchesTest(const String &test_case_name, const String &test_name) { const String& full_name = String::Format("%s.%s", test_case_name.c_str(), test_name.c_str()); // Split --gtest_filter at '-', if there is one, to separate into // positive filter and negative filter portions const char* const p = GTEST_FLAG(filter).c_str(); const char* const dash = strchr(p, '-'); String positive; String negative; if (dash == NULL) { positive = GTEST_FLAG(filter).c_str(); // Whole string is a positive filter negative = String(""); } else { positive = String(p, dash - p); // Everything up to the dash negative = String(dash+1); // Everything after the dash if (positive.empty()) { // Treat '-test1' as the same as '*-test1' positive = kUniversalFilter; } } // A filter is a colon-separated list of patterns. It matches a // test if any pattern in it matches the test. return (MatchesFilter(full_name, positive.c_str()) && !MatchesFilter(full_name, negative.c_str())); } #if GTEST_HAS_SEH // Returns EXCEPTION_EXECUTE_HANDLER if Google Test should handle the // given SEH exception, or EXCEPTION_CONTINUE_SEARCH otherwise. // This function is useful as an __except condition. int UnitTestOptions::GTestShouldProcessSEH(DWORD exception_code) { // Google Test should handle a SEH exception if: // 1. the user wants it to, AND // 2. this is not a breakpoint exception, AND // 3. this is not a C++ exception (VC++ implements them via SEH, // apparently). // // SEH exception code for C++ exceptions. // (see http://support.microsoft.com/kb/185294 for more information). const DWORD kCxxExceptionCode = 0xe06d7363; bool should_handle = true; if (!GTEST_FLAG(catch_exceptions)) should_handle = false; else if (exception_code == EXCEPTION_BREAKPOINT) should_handle = false; else if (exception_code == kCxxExceptionCode) should_handle = false; return should_handle ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH; } #endif // GTEST_HAS_SEH } // namespace internal // The c'tor sets this object as the test part result reporter used by // Google Test. The 'result' parameter specifies where to report the // results. Intercepts only failures from the current thread. ScopedFakeTestPartResultReporter::ScopedFakeTestPartResultReporter( TestPartResultArray* result) : intercept_mode_(INTERCEPT_ONLY_CURRENT_THREAD), result_(result) { Init(); } // The c'tor sets this object as the test part result reporter used by // Google Test. The 'result' parameter specifies where to report the // results. ScopedFakeTestPartResultReporter::ScopedFakeTestPartResultReporter( InterceptMode intercept_mode, TestPartResultArray* result) : intercept_mode_(intercept_mode), result_(result) { Init(); } void ScopedFakeTestPartResultReporter::Init() { internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); if (intercept_mode_ == INTERCEPT_ALL_THREADS) { old_reporter_ = impl->GetGlobalTestPartResultReporter(); impl->SetGlobalTestPartResultReporter(this); } else { old_reporter_ = impl->GetTestPartResultReporterForCurrentThread(); impl->SetTestPartResultReporterForCurrentThread(this); } } // The d'tor restores the test part result reporter used by Google Test // before. ScopedFakeTestPartResultReporter::~ScopedFakeTestPartResultReporter() { internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); if (intercept_mode_ == INTERCEPT_ALL_THREADS) { impl->SetGlobalTestPartResultReporter(old_reporter_); } else { impl->SetTestPartResultReporterForCurrentThread(old_reporter_); } } // Increments the test part result count and remembers the result. // This method is from the TestPartResultReporterInterface interface. void ScopedFakeTestPartResultReporter::ReportTestPartResult( const TestPartResult& result) { result_->Append(result); } namespace internal { // Returns the type ID of ::testing::Test. We should always call this // instead of GetTypeId< ::testing::Test>() to get the type ID of // testing::Test. This is to work around a suspected linker bug when // using Google Test as a framework on Mac OS X. The bug causes // GetTypeId< ::testing::Test>() to return different values depending // on whether the call is from the Google Test framework itself or // from user test code. GetTestTypeId() is guaranteed to always // return the same value, as it always calls GetTypeId<>() from the // gtest.cc, which is within the Google Test framework. TypeId GetTestTypeId() { return GetTypeId(); } // The value of GetTestTypeId() as seen from within the Google Test // library. This is solely for testing GetTestTypeId(). extern const TypeId kTestTypeIdInGoogleTest = GetTestTypeId(); // This predicate-formatter checks that 'results' contains a test part // failure of the given type and that the failure message contains the // given substring. AssertionResult HasOneFailure(const char* /* results_expr */, const char* /* type_expr */, const char* /* substr_expr */, const TestPartResultArray& results, TestPartResult::Type type, const string& substr) { const String expected(type == TestPartResult::kFatalFailure ? "1 fatal failure" : "1 non-fatal failure"); Message msg; if (results.size() != 1) { msg << "Expected: " << expected << "\n" << " Actual: " << results.size() << " failures"; for (int i = 0; i < results.size(); i++) { msg << "\n" << results.GetTestPartResult(i); } return AssertionFailure() << msg; } const TestPartResult& r = results.GetTestPartResult(0); if (r.type() != type) { return AssertionFailure() << "Expected: " << expected << "\n" << " Actual:\n" << r; } if (strstr(r.message(), substr.c_str()) == NULL) { return AssertionFailure() << "Expected: " << expected << " containing \"" << substr << "\"\n" << " Actual:\n" << r; } return AssertionSuccess(); } // The constructor of SingleFailureChecker remembers where to look up // test part results, what type of failure we expect, and what // substring the failure message should contain. SingleFailureChecker:: SingleFailureChecker( const TestPartResultArray* results, TestPartResult::Type type, const string& substr) : results_(results), type_(type), substr_(substr) {} // The destructor of SingleFailureChecker verifies that the given // TestPartResultArray contains exactly one failure that has the given // type and contains the given substring. If that's not the case, a // non-fatal failure will be generated. SingleFailureChecker::~SingleFailureChecker() { EXPECT_PRED_FORMAT3(HasOneFailure, *results_, type_, substr_); } DefaultGlobalTestPartResultReporter::DefaultGlobalTestPartResultReporter( UnitTestImpl* unit_test) : unit_test_(unit_test) {} void DefaultGlobalTestPartResultReporter::ReportTestPartResult( const TestPartResult& result) { unit_test_->current_test_result()->AddTestPartResult(result); unit_test_->listeners()->repeater()->OnTestPartResult(result); } DefaultPerThreadTestPartResultReporter::DefaultPerThreadTestPartResultReporter( UnitTestImpl* unit_test) : unit_test_(unit_test) {} void DefaultPerThreadTestPartResultReporter::ReportTestPartResult( const TestPartResult& result) { unit_test_->GetGlobalTestPartResultReporter()->ReportTestPartResult(result); } // Returns the global test part result reporter. TestPartResultReporterInterface* UnitTestImpl::GetGlobalTestPartResultReporter() { internal::MutexLock lock(&global_test_part_result_reporter_mutex_); return global_test_part_result_repoter_; } // Sets the global test part result reporter. void UnitTestImpl::SetGlobalTestPartResultReporter( TestPartResultReporterInterface* reporter) { internal::MutexLock lock(&global_test_part_result_reporter_mutex_); global_test_part_result_repoter_ = reporter; } // Returns the test part result reporter for the current thread. TestPartResultReporterInterface* UnitTestImpl::GetTestPartResultReporterForCurrentThread() { return per_thread_test_part_result_reporter_.get(); } // Sets the test part result reporter for the current thread. void UnitTestImpl::SetTestPartResultReporterForCurrentThread( TestPartResultReporterInterface* reporter) { per_thread_test_part_result_reporter_.set(reporter); } // Gets the number of successful test cases. int UnitTestImpl::successful_test_case_count() const { return CountIf(test_cases_, TestCasePassed); } // Gets the number of failed test cases. int UnitTestImpl::failed_test_case_count() const { return CountIf(test_cases_, TestCaseFailed); } // Gets the number of all test cases. int UnitTestImpl::total_test_case_count() const { return static_cast(test_cases_.size()); } // Gets the number of all test cases that contain at least one test // that should run. int UnitTestImpl::test_case_to_run_count() const { return CountIf(test_cases_, ShouldRunTestCase); } // Gets the number of successful tests. int UnitTestImpl::successful_test_count() const { return SumOverTestCaseList(test_cases_, &TestCase::successful_test_count); } // Gets the number of failed tests. int UnitTestImpl::failed_test_count() const { return SumOverTestCaseList(test_cases_, &TestCase::failed_test_count); } // Gets the number of disabled tests. int UnitTestImpl::disabled_test_count() const { return SumOverTestCaseList(test_cases_, &TestCase::disabled_test_count); } // Gets the number of all tests. int UnitTestImpl::total_test_count() const { return SumOverTestCaseList(test_cases_, &TestCase::total_test_count); } // Gets the number of tests that should run. int UnitTestImpl::test_to_run_count() const { return SumOverTestCaseList(test_cases_, &TestCase::test_to_run_count); } // Returns the current OS stack trace as a String. // // The maximum number of stack frames to be included is specified by // the gtest_stack_trace_depth flag. The skip_count parameter // specifies the number of top frames to be skipped, which doesn't // count against the number of frames to be included. // // For example, if Foo() calls Bar(), which in turn calls // CurrentOsStackTraceExceptTop(1), Foo() will be included in the // trace but Bar() and CurrentOsStackTraceExceptTop() won't. String UnitTestImpl::CurrentOsStackTraceExceptTop(int skip_count) { (void)skip_count; return String(""); } // Returns the current time in milliseconds. TimeInMillis GetTimeInMillis() { #if GTEST_OS_WINDOWS_MOBILE || defined(__BORLANDC__) // Difference between 1970-01-01 and 1601-01-01 in milliseconds. // http://analogous.blogspot.com/2005/04/epoch.html const TimeInMillis kJavaEpochToWinFileTimeDelta = static_cast(116444736UL) * 100000UL; const DWORD kTenthMicrosInMilliSecond = 10000; SYSTEMTIME now_systime; FILETIME now_filetime; ULARGE_INTEGER now_int64; // TODO(kenton@google.com): Shouldn't this just use // GetSystemTimeAsFileTime()? GetSystemTime(&now_systime); if (SystemTimeToFileTime(&now_systime, &now_filetime)) { now_int64.LowPart = now_filetime.dwLowDateTime; now_int64.HighPart = now_filetime.dwHighDateTime; now_int64.QuadPart = (now_int64.QuadPart / kTenthMicrosInMilliSecond) - kJavaEpochToWinFileTimeDelta; return now_int64.QuadPart; } return 0; #elif GTEST_OS_WINDOWS && !GTEST_HAS_GETTIMEOFDAY_ __timeb64 now; # ifdef _MSC_VER // MSVC 8 deprecates _ftime64(), so we want to suppress warning 4996 // (deprecated function) there. // TODO(kenton@google.com): Use GetTickCount()? Or use // SystemTimeToFileTime() # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4996) // Temporarily disables warning 4996. _ftime64(&now); # pragma warning(pop) // Restores the warning state. # else _ftime64(&now); # endif // _MSC_VER return static_cast(now.time) * 1000 + now.millitm; #elif GTEST_HAS_GETTIMEOFDAY_ struct timeval now; gettimeofday(&now, NULL); return static_cast(now.tv_sec) * 1000 + now.tv_usec / 1000; #else # error "Don't know how to get the current time on your system." #endif } // Utilities // class String // Returns the input enclosed in double quotes if it's not NULL; // otherwise returns "(null)". For example, "\"Hello\"" is returned // for input "Hello". // // This is useful for printing a C string in the syntax of a literal. // // Known issue: escape sequences are not handled yet. String String::ShowCStringQuoted(const char* c_str) { return c_str ? String::Format("\"%s\"", c_str) : String("(null)"); } // Copies at most length characters from str into a newly-allocated // piece of memory of size length+1. The memory is allocated with new[]. // A terminating null byte is written to the memory, and a pointer to it // is returned. If str is NULL, NULL is returned. static char* CloneString(const char* str, size_t length) { if (str == NULL) { return NULL; } else { char* const clone = new char[length + 1]; posix::StrNCpy(clone, str, length); clone[length] = '\0'; return clone; } } // Clones a 0-terminated C string, allocating memory using new. The // caller is responsible for deleting[] the return value. Returns the // cloned string, or NULL if the input is NULL. const char * String::CloneCString(const char* c_str) { return (c_str == NULL) ? NULL : CloneString(c_str, strlen(c_str)); } #if GTEST_OS_WINDOWS_MOBILE // Creates a UTF-16 wide string from the given ANSI string, allocating // memory using new. The caller is responsible for deleting the return // value using delete[]. Returns the wide string, or NULL if the // input is NULL. LPCWSTR String::AnsiToUtf16(const char* ansi) { if (!ansi) return NULL; const int length = strlen(ansi); const int unicode_length = MultiByteToWideChar(CP_ACP, 0, ansi, length, NULL, 0); WCHAR* unicode = new WCHAR[unicode_length + 1]; MultiByteToWideChar(CP_ACP, 0, ansi, length, unicode, unicode_length); unicode[unicode_length] = 0; return unicode; } // Creates an ANSI string from the given wide string, allocating // memory using new. The caller is responsible for deleting the return // value using delete[]. Returns the ANSI string, or NULL if the // input is NULL. const char* String::Utf16ToAnsi(LPCWSTR utf16_str) { if (!utf16_str) return NULL; const int ansi_length = WideCharToMultiByte(CP_ACP, 0, utf16_str, -1, NULL, 0, NULL, NULL); char* ansi = new char[ansi_length + 1]; WideCharToMultiByte(CP_ACP, 0, utf16_str, -1, ansi, ansi_length, NULL, NULL); ansi[ansi_length] = 0; return ansi; } #endif // GTEST_OS_WINDOWS_MOBILE // Compares two C strings. Returns true iff they have the same content. // // Unlike strcmp(), this function can handle NULL argument(s). A NULL // C string is considered different to any non-NULL C string, // including the empty string. bool String::CStringEquals(const char * lhs, const char * rhs) { if ( lhs == NULL ) return rhs == NULL; if ( rhs == NULL ) return false; return strcmp(lhs, rhs) == 0; } #if GTEST_HAS_STD_WSTRING || GTEST_HAS_GLOBAL_WSTRING // Converts an array of wide chars to a narrow string using the UTF-8 // encoding, and streams the result to the given Message object. static void StreamWideCharsToMessage(const wchar_t* wstr, size_t length, Message* msg) { // TODO(wan): consider allowing a testing::String object to // contain '\0'. This will make it behave more like std::string, // and will allow ToUtf8String() to return the correct encoding // for '\0' s.t. we can get rid of the conditional here (and in // several other places). for (size_t i = 0; i != length; ) { // NOLINT if (wstr[i] != L'\0') { *msg << WideStringToUtf8(wstr + i, static_cast(length - i)); while (i != length && wstr[i] != L'\0') i++; } else { *msg << '\0'; i++; } } } #endif // GTEST_HAS_STD_WSTRING || GTEST_HAS_GLOBAL_WSTRING } // namespace internal #if GTEST_HAS_STD_WSTRING // Converts the given wide string to a narrow string using the UTF-8 // encoding, and streams the result to this Message object. Message& Message::operator <<(const ::std::wstring& wstr) { internal::StreamWideCharsToMessage(wstr.c_str(), wstr.length(), this); return *this; } #endif // GTEST_HAS_STD_WSTRING #if GTEST_HAS_GLOBAL_WSTRING // Converts the given wide string to a narrow string using the UTF-8 // encoding, and streams the result to this Message object. Message& Message::operator <<(const ::wstring& wstr) { internal::StreamWideCharsToMessage(wstr.c_str(), wstr.length(), this); return *this; } #endif // GTEST_HAS_GLOBAL_WSTRING // AssertionResult constructors. // Used in EXPECT_TRUE/FALSE(assertion_result). AssertionResult::AssertionResult(const AssertionResult& other) : success_(other.success_), message_(other.message_.get() != NULL ? new ::std::string(*other.message_) : static_cast< ::std::string*>(NULL)) { } // Returns the assertion's negation. Used with EXPECT/ASSERT_FALSE. AssertionResult AssertionResult::operator!() const { AssertionResult negation(!success_); if (message_.get() != NULL) negation << *message_; return negation; } // Makes a successful assertion result. AssertionResult AssertionSuccess() { return AssertionResult(true); } // Makes a failed assertion result. AssertionResult AssertionFailure() { return AssertionResult(false); } // Makes a failed assertion result with the given failure message. // Deprecated; use AssertionFailure() << message. AssertionResult AssertionFailure(const Message& message) { return AssertionFailure() << message; } namespace internal { // Constructs and returns the message for an equality assertion // (e.g. ASSERT_EQ, EXPECT_STREQ, etc) failure. // // The first four parameters are the expressions used in the assertion // and their values, as strings. For example, for ASSERT_EQ(foo, bar) // where foo is 5 and bar is 6, we have: // // expected_expression: "foo" // actual_expression: "bar" // expected_value: "5" // actual_value: "6" // // The ignoring_case parameter is true iff the assertion is a // *_STRCASEEQ*. When it's true, the string " (ignoring case)" will // be inserted into the message. AssertionResult EqFailure(const char* expected_expression, const char* actual_expression, const String& expected_value, const String& actual_value, bool ignoring_case) { Message msg; msg << "Value of: " << actual_expression; if (actual_value != actual_expression) { msg << "\n Actual: " << actual_value; } msg << "\nExpected: " << expected_expression; if (ignoring_case) { msg << " (ignoring case)"; } if (expected_value != expected_expression) { msg << "\nWhich is: " << expected_value; } return AssertionFailure() << msg; } // Constructs a failure message for Boolean assertions such as EXPECT_TRUE. String GetBoolAssertionFailureMessage(const AssertionResult& assertion_result, const char* expression_text, const char* actual_predicate_value, const char* expected_predicate_value) { const char* actual_message = assertion_result.message(); Message msg; msg << "Value of: " << expression_text << "\n Actual: " << actual_predicate_value; if (actual_message[0] != '\0') msg << " (" << actual_message << ")"; msg << "\nExpected: " << expected_predicate_value; return msg.GetString(); } // Helper function for implementing ASSERT_NEAR. AssertionResult DoubleNearPredFormat(const char* expr1, const char* expr2, const char* abs_error_expr, double val1, double val2, double abs_error) { const double diff = fabs(val1 - val2); if (diff <= abs_error) return AssertionSuccess(); // TODO(wan): do not print the value of an expression if it's // already a literal. return AssertionFailure() << "The difference between " << expr1 << " and " << expr2 << " is " << diff << ", which exceeds " << abs_error_expr << ", where\n" << expr1 << " evaluates to " << val1 << ",\n" << expr2 << " evaluates to " << val2 << ", and\n" << abs_error_expr << " evaluates to " << abs_error << "."; } // Helper template for implementing FloatLE() and DoubleLE(). template AssertionResult FloatingPointLE(const char* expr1, const char* expr2, RawType val1, RawType val2) { // Returns success if val1 is less than val2, if (val1 < val2) { return AssertionSuccess(); } // or if val1 is almost equal to val2. const FloatingPoint lhs(val1), rhs(val2); if (lhs.AlmostEquals(rhs)) { return AssertionSuccess(); } // Note that the above two checks will both fail if either val1 or // val2 is NaN, as the IEEE floating-point standard requires that // any predicate involving a NaN must return false. ::std::stringstream val1_ss; val1_ss << std::setprecision(std::numeric_limits::digits10 + 2) << val1; ::std::stringstream val2_ss; val2_ss << std::setprecision(std::numeric_limits::digits10 + 2) << val2; return AssertionFailure() << "Expected: (" << expr1 << ") <= (" << expr2 << ")\n" << " Actual: " << StringStreamToString(&val1_ss) << " vs " << StringStreamToString(&val2_ss); } } // namespace internal // Asserts that val1 is less than, or almost equal to, val2. Fails // otherwise. In particular, it fails if either val1 or val2 is NaN. AssertionResult FloatLE(const char* expr1, const char* expr2, float val1, float val2) { return internal::FloatingPointLE(expr1, expr2, val1, val2); } // Asserts that val1 is less than, or almost equal to, val2. Fails // otherwise. In particular, it fails if either val1 or val2 is NaN. AssertionResult DoubleLE(const char* expr1, const char* expr2, double val1, double val2) { return internal::FloatingPointLE(expr1, expr2, val1, val2); } namespace internal { // The helper function for {ASSERT|EXPECT}_EQ with int or enum // arguments. AssertionResult CmpHelperEQ(const char* expected_expression, const char* actual_expression, BiggestInt expected, BiggestInt actual) { if (expected == actual) { return AssertionSuccess(); } return EqFailure(expected_expression, actual_expression, FormatForComparisonFailureMessage(expected, actual), FormatForComparisonFailureMessage(actual, expected), false); } // A macro for implementing the helper functions needed to implement // ASSERT_?? and EXPECT_?? with integer or enum arguments. It is here // just to avoid copy-and-paste of similar code. #define GTEST_IMPL_CMP_HELPER_(op_name, op)\ AssertionResult CmpHelper##op_name(const char* expr1, const char* expr2, \ BiggestInt val1, BiggestInt val2) {\ if (val1 op val2) {\ return AssertionSuccess();\ } else {\ return AssertionFailure() \ << "Expected: (" << expr1 << ") " #op " (" << expr2\ << "), actual: " << FormatForComparisonFailureMessage(val1, val2)\ << " vs " << FormatForComparisonFailureMessage(val2, val1);\ }\ } // Implements the helper function for {ASSERT|EXPECT}_NE with int or // enum arguments. GTEST_IMPL_CMP_HELPER_(NE, !=) // Implements the helper function for {ASSERT|EXPECT}_LE with int or // enum arguments. GTEST_IMPL_CMP_HELPER_(LE, <=) // Implements the helper function for {ASSERT|EXPECT}_LT with int or // enum arguments. GTEST_IMPL_CMP_HELPER_(LT, < ) // Implements the helper function for {ASSERT|EXPECT}_GE with int or // enum arguments. GTEST_IMPL_CMP_HELPER_(GE, >=) // Implements the helper function for {ASSERT|EXPECT}_GT with int or // enum arguments. GTEST_IMPL_CMP_HELPER_(GT, > ) #undef GTEST_IMPL_CMP_HELPER_ // The helper function for {ASSERT|EXPECT}_STREQ. AssertionResult CmpHelperSTREQ(const char* expected_expression, const char* actual_expression, const char* expected, const char* actual) { if (String::CStringEquals(expected, actual)) { return AssertionSuccess(); } return EqFailure(expected_expression, actual_expression, String::ShowCStringQuoted(expected), String::ShowCStringQuoted(actual), false); } // The helper function for {ASSERT|EXPECT}_STRCASEEQ. AssertionResult CmpHelperSTRCASEEQ(const char* expected_expression, const char* actual_expression, const char* expected, const char* actual) { if (String::CaseInsensitiveCStringEquals(expected, actual)) { return AssertionSuccess(); } return EqFailure(expected_expression, actual_expression, String::ShowCStringQuoted(expected), String::ShowCStringQuoted(actual), true); } // The helper function for {ASSERT|EXPECT}_STRNE. AssertionResult CmpHelperSTRNE(const char* s1_expression, const char* s2_expression, const char* s1, const char* s2) { if (!String::CStringEquals(s1, s2)) { return AssertionSuccess(); } else { return AssertionFailure() << "Expected: (" << s1_expression << ") != (" << s2_expression << "), actual: \"" << s1 << "\" vs \"" << s2 << "\""; } } // The helper function for {ASSERT|EXPECT}_STRCASENE. AssertionResult CmpHelperSTRCASENE(const char* s1_expression, const char* s2_expression, const char* s1, const char* s2) { if (!String::CaseInsensitiveCStringEquals(s1, s2)) { return AssertionSuccess(); } else { return AssertionFailure() << "Expected: (" << s1_expression << ") != (" << s2_expression << ") (ignoring case), actual: \"" << s1 << "\" vs \"" << s2 << "\""; } } } // namespace internal namespace { // Helper functions for implementing IsSubString() and IsNotSubstring(). // This group of overloaded functions return true iff needle is a // substring of haystack. NULL is considered a substring of itself // only. bool IsSubstringPred(const char* needle, const char* haystack) { if (needle == NULL || haystack == NULL) return needle == haystack; return strstr(haystack, needle) != NULL; } bool IsSubstringPred(const wchar_t* needle, const wchar_t* haystack) { if (needle == NULL || haystack == NULL) return needle == haystack; return wcsstr(haystack, needle) != NULL; } // StringType here can be either ::std::string or ::std::wstring. template bool IsSubstringPred(const StringType& needle, const StringType& haystack) { return haystack.find(needle) != StringType::npos; } // This function implements either IsSubstring() or IsNotSubstring(), // depending on the value of the expected_to_be_substring parameter. // StringType here can be const char*, const wchar_t*, ::std::string, // or ::std::wstring. template AssertionResult IsSubstringImpl( bool expected_to_be_substring, const char* needle_expr, const char* haystack_expr, const StringType& needle, const StringType& haystack) { if (IsSubstringPred(needle, haystack) == expected_to_be_substring) return AssertionSuccess(); const bool is_wide_string = sizeof(needle[0]) > 1; const char* const begin_string_quote = is_wide_string ? "L\"" : "\""; return AssertionFailure() << "Value of: " << needle_expr << "\n" << " Actual: " << begin_string_quote << needle << "\"\n" << "Expected: " << (expected_to_be_substring ? "" : "not ") << "a substring of " << haystack_expr << "\n" << "Which is: " << begin_string_quote << haystack << "\""; } } // namespace // IsSubstring() and IsNotSubstring() check whether needle is a // substring of haystack (NULL is considered a substring of itself // only), and return an appropriate error message when they fail. AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const char* needle, const char* haystack) { return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const wchar_t* needle, const wchar_t* haystack) { return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const char* needle, const char* haystack) { return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const wchar_t* needle, const wchar_t* haystack) { return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const ::std::string& needle, const ::std::string& haystack) { return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const ::std::string& needle, const ::std::string& haystack) { return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack); } #if GTEST_HAS_STD_WSTRING AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const ::std::wstring& needle, const ::std::wstring& haystack) { return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack); } AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const ::std::wstring& needle, const ::std::wstring& haystack) { return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack); } #endif // GTEST_HAS_STD_WSTRING namespace internal { #if GTEST_OS_WINDOWS namespace { // Helper function for IsHRESULT{SuccessFailure} predicates AssertionResult HRESULTFailureHelper(const char* expr, const char* expected, long hr) { // NOLINT # if GTEST_OS_WINDOWS_MOBILE // Windows CE doesn't support FormatMessage. const char error_text[] = ""; # else // Looks up the human-readable system message for the HRESULT code // and since we're not passing any params to FormatMessage, we don't // want inserts expanded. const DWORD kFlags = FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS; const DWORD kBufSize = 4096; // String::Format can't exceed this length. // Gets the system's human readable message string for this HRESULT. char error_text[kBufSize] = { '\0' }; DWORD message_length = ::FormatMessageA(kFlags, 0, // no source, we're asking system hr, // the error 0, // no line width restrictions error_text, // output buffer kBufSize, // buf size NULL); // no arguments for inserts // Trims tailing white space (FormatMessage leaves a trailing cr-lf) for (; message_length && IsSpace(error_text[message_length - 1]); --message_length) { error_text[message_length - 1] = '\0'; } # endif // GTEST_OS_WINDOWS_MOBILE const String error_hex(String::Format("0x%08X ", hr)); return ::testing::AssertionFailure() << "Expected: " << expr << " " << expected << ".\n" << " Actual: " << error_hex << error_text << "\n"; } } // namespace AssertionResult IsHRESULTSuccess(const char* expr, long hr) { // NOLINT if (SUCCEEDED(hr)) { return AssertionSuccess(); } return HRESULTFailureHelper(expr, "succeeds", hr); } AssertionResult IsHRESULTFailure(const char* expr, long hr) { // NOLINT if (FAILED(hr)) { return AssertionSuccess(); } return HRESULTFailureHelper(expr, "fails", hr); } #endif // GTEST_OS_WINDOWS // Utility functions for encoding Unicode text (wide strings) in // UTF-8. // A Unicode code-point can have upto 21 bits, and is encoded in UTF-8 // like this: // // Code-point length Encoding // 0 - 7 bits 0xxxxxxx // 8 - 11 bits 110xxxxx 10xxxxxx // 12 - 16 bits 1110xxxx 10xxxxxx 10xxxxxx // 17 - 21 bits 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx // The maximum code-point a one-byte UTF-8 sequence can represent. const UInt32 kMaxCodePoint1 = (static_cast(1) << 7) - 1; // The maximum code-point a two-byte UTF-8 sequence can represent. const UInt32 kMaxCodePoint2 = (static_cast(1) << (5 + 6)) - 1; // The maximum code-point a three-byte UTF-8 sequence can represent. const UInt32 kMaxCodePoint3 = (static_cast(1) << (4 + 2*6)) - 1; // The maximum code-point a four-byte UTF-8 sequence can represent. const UInt32 kMaxCodePoint4 = (static_cast(1) << (3 + 3*6)) - 1; // Chops off the n lowest bits from a bit pattern. Returns the n // lowest bits. As a side effect, the original bit pattern will be // shifted to the right by n bits. inline UInt32 ChopLowBits(UInt32* bits, int n) { const UInt32 low_bits = *bits & ((static_cast(1) << n) - 1); *bits >>= n; return low_bits; } // Converts a Unicode code point to a narrow string in UTF-8 encoding. // code_point parameter is of type UInt32 because wchar_t may not be // wide enough to contain a code point. // The output buffer str must containt at least 32 characters. // The function returns the address of the output buffer. // If the code_point is not a valid Unicode code point // (i.e. outside of Unicode range U+0 to U+10FFFF) it will be output // as '(Invalid Unicode 0xXXXXXXXX)'. char* CodePointToUtf8(UInt32 code_point, char* str) { if (code_point <= kMaxCodePoint1) { str[1] = '\0'; str[0] = static_cast(code_point); // 0xxxxxxx } else if (code_point <= kMaxCodePoint2) { str[2] = '\0'; str[1] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[0] = static_cast(0xC0 | code_point); // 110xxxxx } else if (code_point <= kMaxCodePoint3) { str[3] = '\0'; str[2] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[1] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[0] = static_cast(0xE0 | code_point); // 1110xxxx } else if (code_point <= kMaxCodePoint4) { str[4] = '\0'; str[3] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[2] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[1] = static_cast(0x80 | ChopLowBits(&code_point, 6)); // 10xxxxxx str[0] = static_cast(0xF0 | code_point); // 11110xxx } else { // The longest string String::Format can produce when invoked // with these parameters is 28 character long (not including // the terminating nul character). We are asking for 32 character // buffer just in case. This is also enough for strncpy to // null-terminate the destination string. posix::StrNCpy( str, String::Format("(Invalid Unicode 0x%X)", code_point).c_str(), 32); str[31] = '\0'; // Makes sure no change in the format to strncpy leaves // the result unterminated. } return str; } // The following two functions only make sense if the the system // uses UTF-16 for wide string encoding. All supported systems // with 16 bit wchar_t (Windows, Cygwin, Symbian OS) do use UTF-16. // Determines if the arguments constitute UTF-16 surrogate pair // and thus should be combined into a single Unicode code point // using CreateCodePointFromUtf16SurrogatePair. inline bool IsUtf16SurrogatePair(wchar_t first, wchar_t second) { return sizeof(wchar_t) == 2 && (first & 0xFC00) == 0xD800 && (second & 0xFC00) == 0xDC00; } // Creates a Unicode code point from UTF16 surrogate pair. inline UInt32 CreateCodePointFromUtf16SurrogatePair(wchar_t first, wchar_t second) { const UInt32 mask = (1 << 10) - 1; return (sizeof(wchar_t) == 2) ? (((first & mask) << 10) | (second & mask)) + 0x10000 : // This function should not be called when the condition is // false, but we provide a sensible default in case it is. static_cast(first); } // Converts a wide string to a narrow string in UTF-8 encoding. // The wide string is assumed to have the following encoding: // UTF-16 if sizeof(wchar_t) == 2 (on Windows, Cygwin, Symbian OS) // UTF-32 if sizeof(wchar_t) == 4 (on Linux) // Parameter str points to a null-terminated wide string. // Parameter num_chars may additionally limit the number // of wchar_t characters processed. -1 is used when the entire string // should be processed. // If the string contains code points that are not valid Unicode code points // (i.e. outside of Unicode range U+0 to U+10FFFF) they will be output // as '(Invalid Unicode 0xXXXXXXXX)'. If the string is in UTF16 encoding // and contains invalid UTF-16 surrogate pairs, values in those pairs // will be encoded as individual Unicode characters from Basic Normal Plane. String WideStringToUtf8(const wchar_t* str, int num_chars) { if (num_chars == -1) num_chars = static_cast(wcslen(str)); ::std::stringstream stream; for (int i = 0; i < num_chars; ++i) { UInt32 unicode_code_point; if (str[i] == L'\0') { break; } else if (i + 1 < num_chars && IsUtf16SurrogatePair(str[i], str[i + 1])) { unicode_code_point = CreateCodePointFromUtf16SurrogatePair(str[i], str[i + 1]); i++; } else { unicode_code_point = static_cast(str[i]); } char buffer[32]; // CodePointToUtf8 requires a buffer this big. stream << CodePointToUtf8(unicode_code_point, buffer); } return StringStreamToString(&stream); } // Converts a wide C string to a String using the UTF-8 encoding. // NULL will be converted to "(null)". String String::ShowWideCString(const wchar_t * wide_c_str) { if (wide_c_str == NULL) return String("(null)"); return String(internal::WideStringToUtf8(wide_c_str, -1).c_str()); } // Similar to ShowWideCString(), except that this function encloses // the converted string in double quotes. String String::ShowWideCStringQuoted(const wchar_t* wide_c_str) { if (wide_c_str == NULL) return String("(null)"); return String::Format("L\"%s\"", String::ShowWideCString(wide_c_str).c_str()); } // Compares two wide C strings. Returns true iff they have the same // content. // // Unlike wcscmp(), this function can handle NULL argument(s). A NULL // C string is considered different to any non-NULL C string, // including the empty string. bool String::WideCStringEquals(const wchar_t * lhs, const wchar_t * rhs) { if (lhs == NULL) return rhs == NULL; if (rhs == NULL) return false; return wcscmp(lhs, rhs) == 0; } // Helper function for *_STREQ on wide strings. AssertionResult CmpHelperSTREQ(const char* expected_expression, const char* actual_expression, const wchar_t* expected, const wchar_t* actual) { if (String::WideCStringEquals(expected, actual)) { return AssertionSuccess(); } return EqFailure(expected_expression, actual_expression, String::ShowWideCStringQuoted(expected), String::ShowWideCStringQuoted(actual), false); } // Helper function for *_STRNE on wide strings. AssertionResult CmpHelperSTRNE(const char* s1_expression, const char* s2_expression, const wchar_t* s1, const wchar_t* s2) { if (!String::WideCStringEquals(s1, s2)) { return AssertionSuccess(); } return AssertionFailure() << "Expected: (" << s1_expression << ") != (" << s2_expression << "), actual: " << String::ShowWideCStringQuoted(s1) << " vs " << String::ShowWideCStringQuoted(s2); } // Compares two C strings, ignoring case. Returns true iff they have // the same content. // // Unlike strcasecmp(), this function can handle NULL argument(s). A // NULL C string is considered different to any non-NULL C string, // including the empty string. bool String::CaseInsensitiveCStringEquals(const char * lhs, const char * rhs) { if (lhs == NULL) return rhs == NULL; if (rhs == NULL) return false; return posix::StrCaseCmp(lhs, rhs) == 0; } // Compares two wide C strings, ignoring case. Returns true iff they // have the same content. // // Unlike wcscasecmp(), this function can handle NULL argument(s). // A NULL C string is considered different to any non-NULL wide C string, // including the empty string. // NB: The implementations on different platforms slightly differ. // On windows, this method uses _wcsicmp which compares according to LC_CTYPE // environment variable. On GNU platform this method uses wcscasecmp // which compares according to LC_CTYPE category of the current locale. // On MacOS X, it uses towlower, which also uses LC_CTYPE category of the // current locale. bool String::CaseInsensitiveWideCStringEquals(const wchar_t* lhs, const wchar_t* rhs) { if (lhs == NULL) return rhs == NULL; if (rhs == NULL) return false; #if GTEST_OS_WINDOWS return _wcsicmp(lhs, rhs) == 0; #elif GTEST_OS_LINUX && !GTEST_OS_LINUX_ANDROID return wcscasecmp(lhs, rhs) == 0; #else // Android, Mac OS X and Cygwin don't define wcscasecmp. // Other unknown OSes may not define it either. wint_t left, right; do { left = towlower(*lhs++); right = towlower(*rhs++); } while (left && left == right); return left == right; #endif // OS selector } // Compares this with another String. // Returns < 0 if this is less than rhs, 0 if this is equal to rhs, or > 0 // if this is greater than rhs. int String::Compare(const String & rhs) const { const char* const lhs_c_str = c_str(); const char* const rhs_c_str = rhs.c_str(); if (lhs_c_str == NULL) { return rhs_c_str == NULL ? 0 : -1; // NULL < anything except NULL } else if (rhs_c_str == NULL) { return 1; } const size_t shorter_str_len = length() <= rhs.length() ? length() : rhs.length(); for (size_t i = 0; i != shorter_str_len; i++) { if (lhs_c_str[i] < rhs_c_str[i]) { return -1; } else if (lhs_c_str[i] > rhs_c_str[i]) { return 1; } } return (length() < rhs.length()) ? -1 : (length() > rhs.length()) ? 1 : 0; } // Returns true iff this String ends with the given suffix. *Any* // String is considered to end with a NULL or empty suffix. bool String::EndsWith(const char* suffix) const { if (suffix == NULL || CStringEquals(suffix, "")) return true; if (c_str() == NULL) return false; const size_t this_len = strlen(c_str()); const size_t suffix_len = strlen(suffix); return (this_len >= suffix_len) && CStringEquals(c_str() + this_len - suffix_len, suffix); } // Returns true iff this String ends with the given suffix, ignoring case. // Any String is considered to end with a NULL or empty suffix. bool String::EndsWithCaseInsensitive(const char* suffix) const { if (suffix == NULL || CStringEquals(suffix, "")) return true; if (c_str() == NULL) return false; const size_t this_len = strlen(c_str()); const size_t suffix_len = strlen(suffix); return (this_len >= suffix_len) && CaseInsensitiveCStringEquals(c_str() + this_len - suffix_len, suffix); } // Formats a list of arguments to a String, using the same format // spec string as for printf. // // We do not use the StringPrintf class as it is not universally // available. // // The result is limited to 4096 characters (including the tailing 0). // If 4096 characters are not enough to format the input, or if // there's an error, "" is // returned. String String::Format(const char * format, ...) { va_list args; va_start(args, format); char buffer[4096]; const int kBufferSize = sizeof(buffer)/sizeof(buffer[0]); // MSVC 8 deprecates vsnprintf(), so we want to suppress warning // 4996 (deprecated function) there. #ifdef _MSC_VER // We are using MSVC. # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4996) // Temporarily disables warning 4996. const int size = vsnprintf(buffer, kBufferSize, format, args); # pragma warning(pop) // Restores the warning state. #else // We are not using MSVC. const int size = vsnprintf(buffer, kBufferSize, format, args); #endif // _MSC_VER va_end(args); // vsnprintf()'s behavior is not portable. When the buffer is not // big enough, it returns a negative value in MSVC, and returns the // needed buffer size on Linux. When there is an output error, it // always returns a negative value. For simplicity, we lump the two // error cases together. if (size < 0 || size >= kBufferSize) { return String(""); } else { return String(buffer, size); } } // Converts the buffer in a stringstream to a String, converting NUL // bytes to "\\0" along the way. String StringStreamToString(::std::stringstream* ss) { const ::std::string& str = ss->str(); const char* const start = str.c_str(); const char* const end = start + str.length(); // We need to use a helper stringstream to do this transformation // because String doesn't support push_back(). ::std::stringstream helper; for (const char* ch = start; ch != end; ++ch) { if (*ch == '\0') { helper << "\\0"; // Replaces NUL with "\\0"; } else { helper.put(*ch); } } return String(helper.str().c_str()); } // Appends the user-supplied message to the Google-Test-generated message. String AppendUserMessage(const String& gtest_msg, const Message& user_msg) { // Appends the user message if it's non-empty. const String user_msg_string = user_msg.GetString(); if (user_msg_string.empty()) { return gtest_msg; } Message msg; msg << gtest_msg << "\n" << user_msg_string; return msg.GetString(); } } // namespace internal // class TestResult // Creates an empty TestResult. TestResult::TestResult() : death_test_count_(0), elapsed_time_(0) { } // D'tor. TestResult::~TestResult() { } // Returns the i-th test part result among all the results. i can // range from 0 to total_part_count() - 1. If i is not in that range, // aborts the program. const TestPartResult& TestResult::GetTestPartResult(int i) const { if (i < 0 || i >= total_part_count()) internal::posix::Abort(); return test_part_results_.at(i); } // Returns the i-th test property. i can range from 0 to // test_property_count() - 1. If i is not in that range, aborts the // program. const TestProperty& TestResult::GetTestProperty(int i) const { if (i < 0 || i >= test_property_count()) internal::posix::Abort(); return test_properties_.at(i); } // Clears the test part results. void TestResult::ClearTestPartResults() { test_part_results_.clear(); } // Adds a test part result to the list. void TestResult::AddTestPartResult(const TestPartResult& test_part_result) { test_part_results_.push_back(test_part_result); } // Adds a test property to the list. If a property with the same key as the // supplied property is already represented, the value of this test_property // replaces the old value for that key. void TestResult::RecordProperty(const TestProperty& test_property) { if (!ValidateTestProperty(test_property)) { return; } internal::MutexLock lock(&test_properites_mutex_); const std::vector::iterator property_with_matching_key = std::find_if(test_properties_.begin(), test_properties_.end(), internal::TestPropertyKeyIs(test_property.key())); if (property_with_matching_key == test_properties_.end()) { test_properties_.push_back(test_property); return; } property_with_matching_key->SetValue(test_property.value()); } // Adds a failure if the key is a reserved attribute of Google Test // testcase tags. Returns true if the property is valid. bool TestResult::ValidateTestProperty(const TestProperty& test_property) { internal::String key(test_property.key()); if (key == "name" || key == "status" || key == "time" || key == "classname") { ADD_FAILURE() << "Reserved key used in RecordProperty(): " << key << " ('name', 'status', 'time', and 'classname' are reserved by " << GTEST_NAME_ << ")"; return false; } return true; } // Clears the object. void TestResult::Clear() { test_part_results_.clear(); test_properties_.clear(); death_test_count_ = 0; elapsed_time_ = 0; } // Returns true iff the test failed. bool TestResult::Failed() const { for (int i = 0; i < total_part_count(); ++i) { if (GetTestPartResult(i).failed()) return true; } return false; } // Returns true iff the test part fatally failed. static bool TestPartFatallyFailed(const TestPartResult& result) { return result.fatally_failed(); } // Returns true iff the test fatally failed. bool TestResult::HasFatalFailure() const { return CountIf(test_part_results_, TestPartFatallyFailed) > 0; } // Returns true iff the test part non-fatally failed. static bool TestPartNonfatallyFailed(const TestPartResult& result) { return result.nonfatally_failed(); } // Returns true iff the test has a non-fatal failure. bool TestResult::HasNonfatalFailure() const { return CountIf(test_part_results_, TestPartNonfatallyFailed) > 0; } // Gets the number of all test parts. This is the sum of the number // of successful test parts and the number of failed test parts. int TestResult::total_part_count() const { return static_cast(test_part_results_.size()); } // Returns the number of the test properties. int TestResult::test_property_count() const { return static_cast(test_properties_.size()); } // class Test // Creates a Test object. // The c'tor saves the values of all Google Test flags. Test::Test() : gtest_flag_saver_(new internal::GTestFlagSaver) { } // The d'tor restores the values of all Google Test flags. Test::~Test() { delete gtest_flag_saver_; } // Sets up the test fixture. // // A sub-class may override this. void Test::SetUp() { } // Tears down the test fixture. // // A sub-class may override this. void Test::TearDown() { } // Allows user supplied key value pairs to be recorded for later output. void Test::RecordProperty(const char* key, const char* value) { UnitTest::GetInstance()->RecordPropertyForCurrentTest(key, value); } // Allows user supplied key value pairs to be recorded for later output. void Test::RecordProperty(const char* key, int value) { Message value_message; value_message << value; RecordProperty(key, value_message.GetString().c_str()); } namespace internal { void ReportFailureInUnknownLocation(TestPartResult::Type result_type, const String& message) { // This function is a friend of UnitTest and as such has access to // AddTestPartResult. UnitTest::GetInstance()->AddTestPartResult( result_type, NULL, // No info about the source file where the exception occurred. -1, // We have no info on which line caused the exception. message, String()); // No stack trace, either. } } // namespace internal // Google Test requires all tests in the same test case to use the same test // fixture class. This function checks if the current test has the // same fixture class as the first test in the current test case. If // yes, it returns true; otherwise it generates a Google Test failure and // returns false. bool Test::HasSameFixtureClass() { internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); const TestCase* const test_case = impl->current_test_case(); // Info about the first test in the current test case. const TestInfo* const first_test_info = test_case->test_info_list()[0]; const internal::TypeId first_fixture_id = first_test_info->fixture_class_id_; const char* const first_test_name = first_test_info->name(); // Info about the current test. const TestInfo* const this_test_info = impl->current_test_info(); const internal::TypeId this_fixture_id = this_test_info->fixture_class_id_; const char* const this_test_name = this_test_info->name(); if (this_fixture_id != first_fixture_id) { // Is the first test defined using TEST? const bool first_is_TEST = first_fixture_id == internal::GetTestTypeId(); // Is this test defined using TEST? const bool this_is_TEST = this_fixture_id == internal::GetTestTypeId(); if (first_is_TEST || this_is_TEST) { // The user mixed TEST and TEST_F in this test case - we'll tell // him/her how to fix it. // Gets the name of the TEST and the name of the TEST_F. Note // that first_is_TEST and this_is_TEST cannot both be true, as // the fixture IDs are different for the two tests. const char* const TEST_name = first_is_TEST ? first_test_name : this_test_name; const char* const TEST_F_name = first_is_TEST ? this_test_name : first_test_name; ADD_FAILURE() << "All tests in the same test case must use the same test fixture\n" << "class, so mixing TEST_F and TEST in the same test case is\n" << "illegal. In test case " << this_test_info->test_case_name() << ",\n" << "test " << TEST_F_name << " is defined using TEST_F but\n" << "test " << TEST_name << " is defined using TEST. You probably\n" << "want to change the TEST to TEST_F or move it to another test\n" << "case."; } else { // The user defined two fixture classes with the same name in // two namespaces - we'll tell him/her how to fix it. ADD_FAILURE() << "All tests in the same test case must use the same test fixture\n" << "class. However, in test case " << this_test_info->test_case_name() << ",\n" << "you defined test " << first_test_name << " and test " << this_test_name << "\n" << "using two different test fixture classes. This can happen if\n" << "the two classes are from different namespaces or translation\n" << "units and have the same name. You should probably rename one\n" << "of the classes to put the tests into different test cases."; } return false; } return true; } #if GTEST_HAS_SEH // Adds an "exception thrown" fatal failure to the current test. This // function returns its result via an output parameter pointer because VC++ // prohibits creation of objects with destructors on stack in functions // using __try (see error C2712). static internal::String* FormatSehExceptionMessage(DWORD exception_code, const char* location) { Message message; message << "SEH exception with code 0x" << std::setbase(16) << exception_code << std::setbase(10) << " thrown in " << location << "."; return new internal::String(message.GetString()); } #endif // GTEST_HAS_SEH #if GTEST_HAS_EXCEPTIONS // Adds an "exception thrown" fatal failure to the current test. static internal::String FormatCxxExceptionMessage(const char* description, const char* location) { Message message; if (description != NULL) { message << "C++ exception with description \"" << description << "\""; } else { message << "Unknown C++ exception"; } message << " thrown in " << location << "."; return message.GetString(); } static internal::String PrintTestPartResultToString( const TestPartResult& test_part_result); // A failed Google Test assertion will throw an exception of this type when // GTEST_FLAG(throw_on_failure) is true (if exceptions are enabled). We // derive it from std::runtime_error, which is for errors presumably // detectable only at run time. Since std::runtime_error inherits from // std::exception, many testing frameworks know how to extract and print the // message inside it. class GoogleTestFailureException : public ::std::runtime_error { public: explicit GoogleTestFailureException(const TestPartResult& failure) : ::std::runtime_error(PrintTestPartResultToString(failure).c_str()) {} }; #endif // GTEST_HAS_EXCEPTIONS namespace internal { // We put these helper functions in the internal namespace as IBM's xlC // compiler rejects the code if they were declared static. // Runs the given method and handles SEH exceptions it throws, when // SEH is supported; returns the 0-value for type Result in case of an // SEH exception. (Microsoft compilers cannot handle SEH and C++ // exceptions in the same function. Therefore, we provide a separate // wrapper function for handling SEH exceptions.) template Result HandleSehExceptionsInMethodIfSupported( T* object, Result (T::*method)(), const char* location) { #if GTEST_HAS_SEH __try { return (object->*method)(); } __except (internal::UnitTestOptions::GTestShouldProcessSEH( // NOLINT GetExceptionCode())) { // We create the exception message on the heap because VC++ prohibits // creation of objects with destructors on stack in functions using __try // (see error C2712). internal::String* exception_message = FormatSehExceptionMessage( GetExceptionCode(), location); internal::ReportFailureInUnknownLocation(TestPartResult::kFatalFailure, *exception_message); delete exception_message; return static_cast(0); } #else (void)location; return (object->*method)(); #endif // GTEST_HAS_SEH } // Runs the given method and catches and reports C++ and/or SEH-style // exceptions, if they are supported; returns the 0-value for type // Result in case of an SEH exception. template Result HandleExceptionsInMethodIfSupported( T* object, Result (T::*method)(), const char* location) { // NOTE: The user code can affect the way in which Google Test handles // exceptions by setting GTEST_FLAG(catch_exceptions), but only before // RUN_ALL_TESTS() starts. It is technically possible to check the flag // after the exception is caught and either report or re-throw the // exception based on the flag's value: // // try { // // Perform the test method. // } catch (...) { // if (GTEST_FLAG(catch_exceptions)) // // Report the exception as failure. // else // throw; // Re-throws the original exception. // } // // However, the purpose of this flag is to allow the program to drop into // the debugger when the exception is thrown. On most platforms, once the // control enters the catch block, the exception origin information is // lost and the debugger will stop the program at the point of the // re-throw in this function -- instead of at the point of the original // throw statement in the code under test. For this reason, we perform // the check early, sacrificing the ability to affect Google Test's // exception handling in the method where the exception is thrown. if (internal::GetUnitTestImpl()->catch_exceptions()) { #if GTEST_HAS_EXCEPTIONS try { return HandleSehExceptionsInMethodIfSupported(object, method, location); } catch (const GoogleTestFailureException&) { // NOLINT // This exception doesn't originate in code under test. It makes no // sense to report it as a test failure. throw; } catch (const std::exception& e) { // NOLINT internal::ReportFailureInUnknownLocation( TestPartResult::kFatalFailure, FormatCxxExceptionMessage(e.what(), location)); } catch (...) { // NOLINT internal::ReportFailureInUnknownLocation( TestPartResult::kFatalFailure, FormatCxxExceptionMessage(NULL, location)); } return static_cast(0); #else return HandleSehExceptionsInMethodIfSupported(object, method, location); #endif // GTEST_HAS_EXCEPTIONS } else { return (object->*method)(); } } } // namespace internal // Runs the test and updates the test result. void Test::Run() { if (!HasSameFixtureClass()) return; internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported(this, &Test::SetUp, "SetUp()"); // We will run the test only if SetUp() was successful. if (!HasFatalFailure()) { impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported( this, &Test::TestBody, "the test body"); } // However, we want to clean up as much as possible. Hence we will // always call TearDown(), even if SetUp() or the test body has // failed. impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported( this, &Test::TearDown, "TearDown()"); } // Returns true iff the current test has a fatal failure. bool Test::HasFatalFailure() { return internal::GetUnitTestImpl()->current_test_result()->HasFatalFailure(); } // Returns true iff the current test has a non-fatal failure. bool Test::HasNonfatalFailure() { return internal::GetUnitTestImpl()->current_test_result()-> HasNonfatalFailure(); } // class TestInfo // Constructs a TestInfo object. It assumes ownership of the test factory // object. // TODO(vladl@google.com): Make a_test_case_name and a_name const string&'s // to signify they cannot be NULLs. TestInfo::TestInfo(const char* a_test_case_name, const char* a_name, const char* a_type_param, const char* a_value_param, internal::TypeId fixture_class_id, internal::TestFactoryBase* factory) : test_case_name_(a_test_case_name), name_(a_name), type_param_(a_type_param ? new std::string(a_type_param) : NULL), value_param_(a_value_param ? new std::string(a_value_param) : NULL), fixture_class_id_(fixture_class_id), should_run_(false), is_disabled_(false), matches_filter_(false), factory_(factory), result_() {} // Destructs a TestInfo object. TestInfo::~TestInfo() { delete factory_; } namespace internal { // Creates a new TestInfo object and registers it with Google Test; // returns the created object. // // Arguments: // // test_case_name: name of the test case // name: name of the test // type_param: the name of the test's type parameter, or NULL if // this is not a typed or a type-parameterized test. // value_param: text representation of the test's value parameter, // or NULL if this is not a value-parameterized test. // fixture_class_id: ID of the test fixture class // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case // factory: pointer to the factory that creates a test object. // The newly created TestInfo instance will assume // ownership of the factory object. TestInfo* MakeAndRegisterTestInfo( const char* test_case_name, const char* name, const char* type_param, const char* value_param, TypeId fixture_class_id, SetUpTestCaseFunc set_up_tc, TearDownTestCaseFunc tear_down_tc, TestFactoryBase* factory) { TestInfo* const test_info = new TestInfo(test_case_name, name, type_param, value_param, fixture_class_id, factory); GetUnitTestImpl()->AddTestInfo(set_up_tc, tear_down_tc, test_info); return test_info; } #if GTEST_HAS_PARAM_TEST void ReportInvalidTestCaseType(const char* test_case_name, const char* file, int line) { Message errors; errors << "Attempted redefinition of test case " << test_case_name << ".\n" << "All tests in the same test case must use the same test fixture\n" << "class. However, in test case " << test_case_name << ", you tried\n" << "to define a test using a fixture class different from the one\n" << "used earlier. This can happen if the two fixture classes are\n" << "from different namespaces and have the same name. You should\n" << "probably rename one of the classes to put the tests into different\n" << "test cases."; fprintf(stderr, "%s %s", FormatFileLocation(file, line).c_str(), errors.GetString().c_str()); } #endif // GTEST_HAS_PARAM_TEST } // namespace internal namespace { // A predicate that checks the test name of a TestInfo against a known // value. // // This is used for implementation of the TestCase class only. We put // it in the anonymous namespace to prevent polluting the outer // namespace. // // TestNameIs is copyable. class TestNameIs { public: // Constructor. // // TestNameIs has NO default constructor. explicit TestNameIs(const char* name) : name_(name) {} // Returns true iff the test name of test_info matches name_. bool operator()(const TestInfo * test_info) const { return test_info && internal::String(test_info->name()).Compare(name_) == 0; } private: internal::String name_; }; } // namespace namespace internal { // This method expands all parameterized tests registered with macros TEST_P // and INSTANTIATE_TEST_CASE_P into regular tests and registers those. // This will be done just once during the program runtime. void UnitTestImpl::RegisterParameterizedTests() { #if GTEST_HAS_PARAM_TEST if (!parameterized_tests_registered_) { parameterized_test_registry_.RegisterTests(); parameterized_tests_registered_ = true; } #endif } } // namespace internal // Creates the test object, runs it, records its result, and then // deletes it. void TestInfo::Run() { if (!should_run_) return; // Tells UnitTest where to store test result. internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); impl->set_current_test_info(this); TestEventListener* repeater = UnitTest::GetInstance()->listeners().repeater(); // Notifies the unit test event listeners that a test is about to start. repeater->OnTestStart(*this); const TimeInMillis start = internal::GetTimeInMillis(); impl->os_stack_trace_getter()->UponLeavingGTest(); // Creates the test object. Test* const test = internal::HandleExceptionsInMethodIfSupported( factory_, &internal::TestFactoryBase::CreateTest, "the test fixture's constructor"); // Runs the test only if the test object was created and its // constructor didn't generate a fatal failure. if ((test != NULL) && !Test::HasFatalFailure()) { // This doesn't throw as all user code that can throw are wrapped into // exception handling code. test->Run(); } // Deletes the test object. impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported( test, &Test::DeleteSelf_, "the test fixture's destructor"); result_.set_elapsed_time(internal::GetTimeInMillis() - start); // Notifies the unit test event listener that a test has just finished. repeater->OnTestEnd(*this); // Tells UnitTest to stop associating assertion results to this // test. impl->set_current_test_info(NULL); } // class TestCase // Gets the number of successful tests in this test case. int TestCase::successful_test_count() const { return CountIf(test_info_list_, TestPassed); } // Gets the number of failed tests in this test case. int TestCase::failed_test_count() const { return CountIf(test_info_list_, TestFailed); } int TestCase::disabled_test_count() const { return CountIf(test_info_list_, TestDisabled); } // Get the number of tests in this test case that should run. int TestCase::test_to_run_count() const { return CountIf(test_info_list_, ShouldRunTest); } // Gets the number of all tests. int TestCase::total_test_count() const { return static_cast(test_info_list_.size()); } // Creates a TestCase with the given name. // // Arguments: // // name: name of the test case // a_type_param: the name of the test case's type parameter, or NULL if // this is not a typed or a type-parameterized test case. // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case TestCase::TestCase(const char* a_name, const char* a_type_param, Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc) : name_(a_name), type_param_(a_type_param ? new std::string(a_type_param) : NULL), set_up_tc_(set_up_tc), tear_down_tc_(tear_down_tc), should_run_(false), elapsed_time_(0) { } // Destructor of TestCase. TestCase::~TestCase() { // Deletes every Test in the collection. ForEach(test_info_list_, internal::Delete); } // Returns the i-th test among all the tests. i can range from 0 to // total_test_count() - 1. If i is not in that range, returns NULL. const TestInfo* TestCase::GetTestInfo(int i) const { const int index = GetElementOr(test_indices_, i, -1); return index < 0 ? NULL : test_info_list_[index]; } // Returns the i-th test among all the tests. i can range from 0 to // total_test_count() - 1. If i is not in that range, returns NULL. TestInfo* TestCase::GetMutableTestInfo(int i) { const int index = GetElementOr(test_indices_, i, -1); return index < 0 ? NULL : test_info_list_[index]; } // Adds a test to this test case. Will delete the test upon // destruction of the TestCase object. void TestCase::AddTestInfo(TestInfo * test_info) { test_info_list_.push_back(test_info); test_indices_.push_back(static_cast(test_indices_.size())); } // Runs every test in this TestCase. void TestCase::Run() { if (!should_run_) return; internal::UnitTestImpl* const impl = internal::GetUnitTestImpl(); impl->set_current_test_case(this); TestEventListener* repeater = UnitTest::GetInstance()->listeners().repeater(); repeater->OnTestCaseStart(*this); impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported( this, &TestCase::RunSetUpTestCase, "SetUpTestCase()"); const internal::TimeInMillis start = internal::GetTimeInMillis(); for (int i = 0; i < total_test_count(); i++) { GetMutableTestInfo(i)->Run(); } elapsed_time_ = internal::GetTimeInMillis() - start; impl->os_stack_trace_getter()->UponLeavingGTest(); internal::HandleExceptionsInMethodIfSupported( this, &TestCase::RunTearDownTestCase, "TearDownTestCase()"); repeater->OnTestCaseEnd(*this); impl->set_current_test_case(NULL); } // Clears the results of all tests in this test case. void TestCase::ClearResult() { ForEach(test_info_list_, TestInfo::ClearTestResult); } // Shuffles the tests in this test case. void TestCase::ShuffleTests(internal::Random* random) { Shuffle(random, &test_indices_); } // Restores the test order to before the first shuffle. void TestCase::UnshuffleTests() { for (size_t i = 0; i < test_indices_.size(); i++) { test_indices_[i] = static_cast(i); } } // Formats a countable noun. Depending on its quantity, either the // singular form or the plural form is used. e.g. // // FormatCountableNoun(1, "formula", "formuli") returns "1 formula". // FormatCountableNoun(5, "book", "books") returns "5 books". static internal::String FormatCountableNoun(int count, const char * singular_form, const char * plural_form) { return internal::String::Format("%d %s", count, count == 1 ? singular_form : plural_form); } // Formats the count of tests. static internal::String FormatTestCount(int test_count) { return FormatCountableNoun(test_count, "test", "tests"); } // Formats the count of test cases. static internal::String FormatTestCaseCount(int test_case_count) { return FormatCountableNoun(test_case_count, "test case", "test cases"); } // Converts a TestPartResult::Type enum to human-friendly string // representation. Both kNonFatalFailure and kFatalFailure are translated // to "Failure", as the user usually doesn't care about the difference // between the two when viewing the test result. static const char * TestPartResultTypeToString(TestPartResult::Type type) { switch (type) { case TestPartResult::kSuccess: return "Success"; case TestPartResult::kNonFatalFailure: case TestPartResult::kFatalFailure: #ifdef _MSC_VER return "error: "; #else return "Failure\n"; #endif default: return "Unknown result type"; } } // Prints a TestPartResult to a String. static internal::String PrintTestPartResultToString( const TestPartResult& test_part_result) { return (Message() << internal::FormatFileLocation(test_part_result.file_name(), test_part_result.line_number()) << " " << TestPartResultTypeToString(test_part_result.type()) << test_part_result.message()).GetString(); } // Prints a TestPartResult. static void PrintTestPartResult(const TestPartResult& test_part_result) { const internal::String& result = PrintTestPartResultToString(test_part_result); printf("%s\n", result.c_str()); fflush(stdout); // If the test program runs in Visual Studio or a debugger, the // following statements add the test part result message to the Output // window such that the user can double-click on it to jump to the // corresponding source code location; otherwise they do nothing. #if GTEST_OS_WINDOWS && !GTEST_OS_WINDOWS_MOBILE // We don't call OutputDebugString*() on Windows Mobile, as printing // to stdout is done by OutputDebugString() there already - we don't // want the same message printed twice. ::OutputDebugStringA(result.c_str()); ::OutputDebugStringA("\n"); #endif } // class PrettyUnitTestResultPrinter namespace internal { enum GTestColor { COLOR_DEFAULT, COLOR_RED, COLOR_GREEN, COLOR_YELLOW }; #if GTEST_OS_WINDOWS && !GTEST_OS_WINDOWS_MOBILE // Returns the character attribute for the given color. WORD GetColorAttribute(GTestColor color) { switch (color) { case COLOR_RED: return FOREGROUND_RED; case COLOR_GREEN: return FOREGROUND_GREEN; case COLOR_YELLOW: return FOREGROUND_RED | FOREGROUND_GREEN; default: return 0; } } #else // Returns the ANSI color code for the given color. COLOR_DEFAULT is // an invalid input. const char* GetAnsiColorCode(GTestColor color) { switch (color) { case COLOR_RED: return "1"; case COLOR_GREEN: return "2"; case COLOR_YELLOW: return "3"; default: return NULL; }; } #endif // GTEST_OS_WINDOWS && !GTEST_OS_WINDOWS_MOBILE // Returns true iff Google Test should use colors in the output. bool ShouldUseColor(bool stdout_is_tty) { const char* const gtest_color = GTEST_FLAG(color).c_str(); if (String::CaseInsensitiveCStringEquals(gtest_color, "auto")) { #if GTEST_OS_WINDOWS // On Windows the TERM variable is usually not set, but the // console there does support colors. return stdout_is_tty; #else // On non-Windows platforms, we rely on the TERM variable. const char* const term = posix::GetEnv("TERM"); const bool term_supports_color = String::CStringEquals(term, "xterm") || String::CStringEquals(term, "xterm-color") || String::CStringEquals(term, "xterm-256color") || String::CStringEquals(term, "screen") || String::CStringEquals(term, "linux") || String::CStringEquals(term, "cygwin"); return stdout_is_tty && term_supports_color; #endif // GTEST_OS_WINDOWS } return String::CaseInsensitiveCStringEquals(gtest_color, "yes") || String::CaseInsensitiveCStringEquals(gtest_color, "true") || String::CaseInsensitiveCStringEquals(gtest_color, "t") || String::CStringEquals(gtest_color, "1"); // We take "yes", "true", "t", and "1" as meaning "yes". If the // value is neither one of these nor "auto", we treat it as "no" to // be conservative. } // Helpers for printing colored strings to stdout. Note that on Windows, we // cannot simply emit special characters and have the terminal change colors. // This routine must actually emit the characters rather than return a string // that would be colored when printed, as can be done on Linux. void ColoredPrintf(GTestColor color, const char* fmt, ...) { va_list args; va_start(args, fmt); #if GTEST_OS_WINDOWS_MOBILE || GTEST_OS_SYMBIAN || GTEST_OS_ZOS const bool use_color = false; #else static const bool in_color_mode = ShouldUseColor(posix::IsATTY(posix::FileNo(stdout)) != 0); const bool use_color = in_color_mode && (color != COLOR_DEFAULT); #endif // GTEST_OS_WINDOWS_MOBILE || GTEST_OS_SYMBIAN || GTEST_OS_ZOS // The '!= 0' comparison is necessary to satisfy MSVC 7.1. if (!use_color) { vprintf(fmt, args); va_end(args); return; } #if GTEST_OS_WINDOWS && !GTEST_OS_WINDOWS_MOBILE const HANDLE stdout_handle = GetStdHandle(STD_OUTPUT_HANDLE); // Gets the current text color. CONSOLE_SCREEN_BUFFER_INFO buffer_info; GetConsoleScreenBufferInfo(stdout_handle, &buffer_info); const WORD old_color_attrs = buffer_info.wAttributes; // We need to flush the stream buffers into the console before each // SetConsoleTextAttribute call lest it affect the text that is already // printed but has not yet reached the console. fflush(stdout); SetConsoleTextAttribute(stdout_handle, GetColorAttribute(color) | FOREGROUND_INTENSITY); vprintf(fmt, args); fflush(stdout); // Restores the text color. SetConsoleTextAttribute(stdout_handle, old_color_attrs); #else printf("\033[0;3%sm", GetAnsiColorCode(color)); vprintf(fmt, args); printf("\033[m"); // Resets the terminal to default. #endif // GTEST_OS_WINDOWS && !GTEST_OS_WINDOWS_MOBILE va_end(args); } void PrintFullTestCommentIfPresent(const TestInfo& test_info) { const char* const type_param = test_info.type_param(); const char* const value_param = test_info.value_param(); if (type_param != NULL || value_param != NULL) { printf(", where "); if (type_param != NULL) { printf("TypeParam = %s", type_param); if (value_param != NULL) printf(" and "); } if (value_param != NULL) { printf("GetParam() = %s", value_param); } } } // This class implements the TestEventListener interface. // // Class PrettyUnitTestResultPrinter is copyable. class PrettyUnitTestResultPrinter : public TestEventListener { public: PrettyUnitTestResultPrinter() {} static void PrintTestName(const char * test_case, const char * test) { printf("%s.%s", test_case, test); } // The following methods override what's in the TestEventListener class. virtual void OnTestProgramStart(const UnitTest& /*unit_test*/) {} virtual void OnTestIterationStart(const UnitTest& unit_test, int iteration); virtual void OnEnvironmentsSetUpStart(const UnitTest& unit_test); virtual void OnEnvironmentsSetUpEnd(const UnitTest& /*unit_test*/) {} virtual void OnTestCaseStart(const TestCase& test_case); virtual void OnTestStart(const TestInfo& test_info); virtual void OnTestPartResult(const TestPartResult& result); virtual void OnTestEnd(const TestInfo& test_info); virtual void OnTestCaseEnd(const TestCase& test_case); virtual void OnEnvironmentsTearDownStart(const UnitTest& unit_test); virtual void OnEnvironmentsTearDownEnd(const UnitTest& /*unit_test*/) {} virtual void OnTestIterationEnd(const UnitTest& unit_test, int iteration); virtual void OnTestProgramEnd(const UnitTest& /*unit_test*/) {} private: static void PrintFailedTests(const UnitTest& unit_test); internal::String test_case_name_; }; // Fired before each iteration of tests starts. void PrettyUnitTestResultPrinter::OnTestIterationStart( const UnitTest& unit_test, int iteration) { if (GTEST_FLAG(repeat) != 1) printf("\nRepeating all tests (iteration %d) . . .\n\n", iteration + 1); const char* const filter = GTEST_FLAG(filter).c_str(); // Prints the filter if it's not *. This reminds the user that some // tests may be skipped. if (!internal::String::CStringEquals(filter, kUniversalFilter)) { ColoredPrintf(COLOR_YELLOW, "Note: %s filter = %s\n", GTEST_NAME_, filter); } if (internal::ShouldShard(kTestTotalShards, kTestShardIndex, false)) { const Int32 shard_index = Int32FromEnvOrDie(kTestShardIndex, -1); ColoredPrintf(COLOR_YELLOW, "Note: This is test shard %d of %s.\n", static_cast(shard_index) + 1, internal::posix::GetEnv(kTestTotalShards)); } if (GTEST_FLAG(shuffle)) { ColoredPrintf(COLOR_YELLOW, "Note: Randomizing tests' orders with a seed of %d .\n", unit_test.random_seed()); } ColoredPrintf(COLOR_GREEN, "[==========] "); printf("Running %s from %s.\n", FormatTestCount(unit_test.test_to_run_count()).c_str(), FormatTestCaseCount(unit_test.test_case_to_run_count()).c_str()); fflush(stdout); } void PrettyUnitTestResultPrinter::OnEnvironmentsSetUpStart( const UnitTest& /*unit_test*/) { ColoredPrintf(COLOR_GREEN, "[----------] "); printf("Global test environment set-up.\n"); fflush(stdout); } void PrettyUnitTestResultPrinter::OnTestCaseStart(const TestCase& test_case) { test_case_name_ = test_case.name(); const internal::String counts = FormatCountableNoun(test_case.test_to_run_count(), "test", "tests"); ColoredPrintf(COLOR_GREEN, "[----------] "); printf("%s from %s", counts.c_str(), test_case_name_.c_str()); if (test_case.type_param() == NULL) { printf("\n"); } else { printf(", where TypeParam = %s\n", test_case.type_param()); } fflush(stdout); } void PrettyUnitTestResultPrinter::OnTestStart(const TestInfo& test_info) { ColoredPrintf(COLOR_GREEN, "[ RUN ] "); PrintTestName(test_case_name_.c_str(), test_info.name()); printf("\n"); fflush(stdout); } // Called after an assertion failure. void PrettyUnitTestResultPrinter::OnTestPartResult( const TestPartResult& result) { // If the test part succeeded, we don't need to do anything. if (result.type() == TestPartResult::kSuccess) return; // Print failure message from the assertion (e.g. expected this and got that). PrintTestPartResult(result); fflush(stdout); } void PrettyUnitTestResultPrinter::OnTestEnd(const TestInfo& test_info) { if (test_info.result()->Passed()) { ColoredPrintf(COLOR_GREEN, "[ OK ] "); } else { ColoredPrintf(COLOR_RED, "[ FAILED ] "); } PrintTestName(test_case_name_.c_str(), test_info.name()); if (test_info.result()->Failed()) PrintFullTestCommentIfPresent(test_info); if (GTEST_FLAG(print_time)) { printf(" (%s ms)\n", internal::StreamableToString( test_info.result()->elapsed_time()).c_str()); } else { printf("\n"); } fflush(stdout); } void PrettyUnitTestResultPrinter::OnTestCaseEnd(const TestCase& test_case) { if (!GTEST_FLAG(print_time)) return; test_case_name_ = test_case.name(); const internal::String counts = FormatCountableNoun(test_case.test_to_run_count(), "test", "tests"); ColoredPrintf(COLOR_GREEN, "[----------] "); printf("%s from %s (%s ms total)\n\n", counts.c_str(), test_case_name_.c_str(), internal::StreamableToString(test_case.elapsed_time()).c_str()); fflush(stdout); } void PrettyUnitTestResultPrinter::OnEnvironmentsTearDownStart( const UnitTest& /*unit_test*/) { ColoredPrintf(COLOR_GREEN, "[----------] "); printf("Global test environment tear-down\n"); fflush(stdout); } // Internal helper for printing the list of failed tests. void PrettyUnitTestResultPrinter::PrintFailedTests(const UnitTest& unit_test) { const int failed_test_count = unit_test.failed_test_count(); if (failed_test_count == 0) { return; } for (int i = 0; i < unit_test.total_test_case_count(); ++i) { const TestCase& test_case = *unit_test.GetTestCase(i); if (!test_case.should_run() || (test_case.failed_test_count() == 0)) { continue; } for (int j = 0; j < test_case.total_test_count(); ++j) { const TestInfo& test_info = *test_case.GetTestInfo(j); if (!test_info.should_run() || test_info.result()->Passed()) { continue; } ColoredPrintf(COLOR_RED, "[ FAILED ] "); printf("%s.%s", test_case.name(), test_info.name()); PrintFullTestCommentIfPresent(test_info); printf("\n"); } } } void PrettyUnitTestResultPrinter::OnTestIterationEnd(const UnitTest& unit_test, int /*iteration*/) { ColoredPrintf(COLOR_GREEN, "[==========] "); printf("%s from %s ran.", FormatTestCount(unit_test.test_to_run_count()).c_str(), FormatTestCaseCount(unit_test.test_case_to_run_count()).c_str()); if (GTEST_FLAG(print_time)) { printf(" (%s ms total)", internal::StreamableToString(unit_test.elapsed_time()).c_str()); } printf("\n"); ColoredPrintf(COLOR_GREEN, "[ PASSED ] "); printf("%s.\n", FormatTestCount(unit_test.successful_test_count()).c_str()); int num_failures = unit_test.failed_test_count(); if (!unit_test.Passed()) { const int failed_test_count = unit_test.failed_test_count(); ColoredPrintf(COLOR_RED, "[ FAILED ] "); printf("%s, listed below:\n", FormatTestCount(failed_test_count).c_str()); PrintFailedTests(unit_test); printf("\n%2d FAILED %s\n", num_failures, num_failures == 1 ? "TEST" : "TESTS"); } int num_disabled = unit_test.disabled_test_count(); if (num_disabled && !GTEST_FLAG(also_run_disabled_tests)) { if (!num_failures) { printf("\n"); // Add a spacer if no FAILURE banner is displayed. } ColoredPrintf(COLOR_YELLOW, " YOU HAVE %d DISABLED %s\n\n", num_disabled, num_disabled == 1 ? "TEST" : "TESTS"); } // Ensure that Google Test output is printed before, e.g., heapchecker output. fflush(stdout); } // End PrettyUnitTestResultPrinter // class TestEventRepeater // // This class forwards events to other event listeners. class TestEventRepeater : public TestEventListener { public: TestEventRepeater() : forwarding_enabled_(true) {} virtual ~TestEventRepeater(); void Append(TestEventListener *listener); TestEventListener* Release(TestEventListener* listener); // Controls whether events will be forwarded to listeners_. Set to false // in death test child processes. bool forwarding_enabled() const { return forwarding_enabled_; } void set_forwarding_enabled(bool enable) { forwarding_enabled_ = enable; } virtual void OnTestProgramStart(const UnitTest& unit_test); virtual void OnTestIterationStart(const UnitTest& unit_test, int iteration); virtual void OnEnvironmentsSetUpStart(const UnitTest& unit_test); virtual void OnEnvironmentsSetUpEnd(const UnitTest& unit_test); virtual void OnTestCaseStart(const TestCase& test_case); virtual void OnTestStart(const TestInfo& test_info); virtual void OnTestPartResult(const TestPartResult& result); virtual void OnTestEnd(const TestInfo& test_info); virtual void OnTestCaseEnd(const TestCase& test_case); virtual void OnEnvironmentsTearDownStart(const UnitTest& unit_test); virtual void OnEnvironmentsTearDownEnd(const UnitTest& unit_test); virtual void OnTestIterationEnd(const UnitTest& unit_test, int iteration); virtual void OnTestProgramEnd(const UnitTest& unit_test); private: // Controls whether events will be forwarded to listeners_. Set to false // in death test child processes. bool forwarding_enabled_; // The list of listeners that receive events. std::vector listeners_; GTEST_DISALLOW_COPY_AND_ASSIGN_(TestEventRepeater); }; TestEventRepeater::~TestEventRepeater() { ForEach(listeners_, Delete); } void TestEventRepeater::Append(TestEventListener *listener) { listeners_.push_back(listener); } // TODO(vladl@google.com): Factor the search functionality into Vector::Find. TestEventListener* TestEventRepeater::Release(TestEventListener *listener) { for (size_t i = 0; i < listeners_.size(); ++i) { if (listeners_[i] == listener) { listeners_.erase(listeners_.begin() + i); return listener; } } return NULL; } // Since most methods are very similar, use macros to reduce boilerplate. // This defines a member that forwards the call to all listeners. #define GTEST_REPEATER_METHOD_(Name, Type) \ void TestEventRepeater::Name(const Type& parameter) { \ if (forwarding_enabled_) { \ for (size_t i = 0; i < listeners_.size(); i++) { \ listeners_[i]->Name(parameter); \ } \ } \ } // This defines a member that forwards the call to all listeners in reverse // order. #define GTEST_REVERSE_REPEATER_METHOD_(Name, Type) \ void TestEventRepeater::Name(const Type& parameter) { \ if (forwarding_enabled_) { \ for (int i = static_cast(listeners_.size()) - 1; i >= 0; i--) { \ listeners_[i]->Name(parameter); \ } \ } \ } GTEST_REPEATER_METHOD_(OnTestProgramStart, UnitTest) GTEST_REPEATER_METHOD_(OnEnvironmentsSetUpStart, UnitTest) GTEST_REPEATER_METHOD_(OnTestCaseStart, TestCase) GTEST_REPEATER_METHOD_(OnTestStart, TestInfo) GTEST_REPEATER_METHOD_(OnTestPartResult, TestPartResult) GTEST_REPEATER_METHOD_(OnEnvironmentsTearDownStart, UnitTest) GTEST_REVERSE_REPEATER_METHOD_(OnEnvironmentsSetUpEnd, UnitTest) GTEST_REVERSE_REPEATER_METHOD_(OnEnvironmentsTearDownEnd, UnitTest) GTEST_REVERSE_REPEATER_METHOD_(OnTestEnd, TestInfo) GTEST_REVERSE_REPEATER_METHOD_(OnTestCaseEnd, TestCase) GTEST_REVERSE_REPEATER_METHOD_(OnTestProgramEnd, UnitTest) #undef GTEST_REPEATER_METHOD_ #undef GTEST_REVERSE_REPEATER_METHOD_ void TestEventRepeater::OnTestIterationStart(const UnitTest& unit_test, int iteration) { if (forwarding_enabled_) { for (size_t i = 0; i < listeners_.size(); i++) { listeners_[i]->OnTestIterationStart(unit_test, iteration); } } } void TestEventRepeater::OnTestIterationEnd(const UnitTest& unit_test, int iteration) { if (forwarding_enabled_) { for (int i = static_cast(listeners_.size()) - 1; i >= 0; i--) { listeners_[i]->OnTestIterationEnd(unit_test, iteration); } } } // End TestEventRepeater // This class generates an XML output file. class XmlUnitTestResultPrinter : public EmptyTestEventListener { public: explicit XmlUnitTestResultPrinter(const char* output_file); virtual void OnTestIterationEnd(const UnitTest& unit_test, int iteration); private: // Is c a whitespace character that is normalized to a space character // when it appears in an XML attribute value? static bool IsNormalizableWhitespace(char c) { return c == 0x9 || c == 0xA || c == 0xD; } // May c appear in a well-formed XML document? static bool IsValidXmlCharacter(char c) { return IsNormalizableWhitespace(c) || c >= 0x20; } // Returns an XML-escaped copy of the input string str. If // is_attribute is true, the text is meant to appear as an attribute // value, and normalizable whitespace is preserved by replacing it // with character references. static String EscapeXml(const char* str, bool is_attribute); // Returns the given string with all characters invalid in XML removed. static string RemoveInvalidXmlCharacters(const string& str); // Convenience wrapper around EscapeXml when str is an attribute value. static String EscapeXmlAttribute(const char* str) { return EscapeXml(str, true); } // Convenience wrapper around EscapeXml when str is not an attribute value. static String EscapeXmlText(const char* str) { return EscapeXml(str, false); } // Streams an XML CDATA section, escaping invalid CDATA sequences as needed. static void OutputXmlCDataSection(::std::ostream* stream, const char* data); // Streams an XML representation of a TestInfo object. static void OutputXmlTestInfo(::std::ostream* stream, const char* test_case_name, const TestInfo& test_info); // Prints an XML representation of a TestCase object static void PrintXmlTestCase(FILE* out, const TestCase& test_case); // Prints an XML summary of unit_test to output stream out. static void PrintXmlUnitTest(FILE* out, const UnitTest& unit_test); // Produces a string representing the test properties in a result as space // delimited XML attributes based on the property key="value" pairs. // When the String is not empty, it includes a space at the beginning, // to delimit this attribute from prior attributes. static String TestPropertiesAsXmlAttributes(const TestResult& result); // The output file. const String output_file_; GTEST_DISALLOW_COPY_AND_ASSIGN_(XmlUnitTestResultPrinter); }; // Creates a new XmlUnitTestResultPrinter. XmlUnitTestResultPrinter::XmlUnitTestResultPrinter(const char* output_file) : output_file_(output_file) { if (output_file_.c_str() == NULL || output_file_.empty()) { fprintf(stderr, "XML output file may not be null\n"); fflush(stderr); exit(EXIT_FAILURE); } } // Called after the unit test ends. void XmlUnitTestResultPrinter::OnTestIterationEnd(const UnitTest& unit_test, int /*iteration*/) { FILE* xmlout = NULL; FilePath output_file(output_file_); FilePath output_dir(output_file.RemoveFileName()); if (output_dir.CreateDirectoriesRecursively()) { xmlout = posix::FOpen(output_file_.c_str(), "w"); } if (xmlout == NULL) { // TODO(wan): report the reason of the failure. // // We don't do it for now as: // // 1. There is no urgent need for it. // 2. It's a bit involved to make the errno variable thread-safe on // all three operating systems (Linux, Windows, and Mac OS). // 3. To interpret the meaning of errno in a thread-safe way, // we need the strerror_r() function, which is not available on // Windows. fprintf(stderr, "Unable to open file \"%s\"\n", output_file_.c_str()); fflush(stderr); exit(EXIT_FAILURE); } PrintXmlUnitTest(xmlout, unit_test); fclose(xmlout); } // Returns an XML-escaped copy of the input string str. If is_attribute // is true, the text is meant to appear as an attribute value, and // normalizable whitespace is preserved by replacing it with character // references. // // Invalid XML characters in str, if any, are stripped from the output. // It is expected that most, if not all, of the text processed by this // module will consist of ordinary English text. // If this module is ever modified to produce version 1.1 XML output, // most invalid characters can be retained using character references. // TODO(wan): It might be nice to have a minimally invasive, human-readable // escaping scheme for invalid characters, rather than dropping them. String XmlUnitTestResultPrinter::EscapeXml(const char* str, bool is_attribute) { Message m; if (str != NULL) { for (const char* src = str; *src; ++src) { switch (*src) { case '<': m << "<"; break; case '>': m << ">"; break; case '&': m << "&"; break; case '\'': if (is_attribute) m << "'"; else m << '\''; break; case '"': if (is_attribute) m << """; else m << '"'; break; default: if (IsValidXmlCharacter(*src)) { if (is_attribute && IsNormalizableWhitespace(*src)) m << String::Format("&#x%02X;", unsigned(*src)); else m << *src; } break; } } } return m.GetString(); } // Returns the given string with all characters invalid in XML removed. // Currently invalid characters are dropped from the string. An // alternative is to replace them with certain characters such as . or ?. string XmlUnitTestResultPrinter::RemoveInvalidXmlCharacters(const string& str) { string output; output.reserve(str.size()); for (string::const_iterator it = str.begin(); it != str.end(); ++it) if (IsValidXmlCharacter(*it)) output.push_back(*it); return output; } // The following routines generate an XML representation of a UnitTest // object. // // This is how Google Test concepts map to the DTD: // // <-- corresponds to a UnitTest object // <-- corresponds to a TestCase object // <-- corresponds to a TestInfo object // ... // ... // ... // <-- individual assertion failures // // // // Formats the given time in milliseconds as seconds. std::string FormatTimeInMillisAsSeconds(TimeInMillis ms) { ::std::stringstream ss; ss << ms/1000.0; return ss.str(); } // Streams an XML CDATA section, escaping invalid CDATA sequences as needed. void XmlUnitTestResultPrinter::OutputXmlCDataSection(::std::ostream* stream, const char* data) { const char* segment = data; *stream << ""); if (next_segment != NULL) { stream->write( segment, static_cast(next_segment - segment)); *stream << "]]>]]>"); } else { *stream << segment; break; } } *stream << "]]>"; } // Prints an XML representation of a TestInfo object. // TODO(wan): There is also value in printing properties with the plain printer. void XmlUnitTestResultPrinter::OutputXmlTestInfo(::std::ostream* stream, const char* test_case_name, const TestInfo& test_info) { const TestResult& result = *test_info.result(); *stream << " \n"; *stream << " "; const string location = internal::FormatCompilerIndependentFileLocation( part.file_name(), part.line_number()); const string message = location + "\n" + part.message(); OutputXmlCDataSection(stream, RemoveInvalidXmlCharacters(message).c_str()); *stream << "\n"; } } if (failures == 0) *stream << " />\n"; else *stream << " \n"; } // Prints an XML representation of a TestCase object void XmlUnitTestResultPrinter::PrintXmlTestCase(FILE* out, const TestCase& test_case) { fprintf(out, " \n", FormatTimeInMillisAsSeconds(test_case.elapsed_time()).c_str()); for (int i = 0; i < test_case.total_test_count(); ++i) { ::std::stringstream stream; OutputXmlTestInfo(&stream, test_case.name(), *test_case.GetTestInfo(i)); fprintf(out, "%s", StringStreamToString(&stream).c_str()); } fprintf(out, " \n"); } // Prints an XML summary of unit_test to output stream out. void XmlUnitTestResultPrinter::PrintXmlUnitTest(FILE* out, const UnitTest& unit_test) { fprintf(out, "\n"); fprintf(out, "\n"); for (int i = 0; i < unit_test.total_test_case_count(); ++i) PrintXmlTestCase(out, *unit_test.GetTestCase(i)); fprintf(out, "\n"); } // Produces a string representing the test properties in a result as space // delimited XML attributes based on the property key="value" pairs. String XmlUnitTestResultPrinter::TestPropertiesAsXmlAttributes( const TestResult& result) { Message attributes; for (int i = 0; i < result.test_property_count(); ++i) { const TestProperty& property = result.GetTestProperty(i); attributes << " " << property.key() << "=" << "\"" << EscapeXmlAttribute(property.value()) << "\""; } return attributes.GetString(); } // End XmlUnitTestResultPrinter #if GTEST_CAN_STREAM_RESULTS_ // Streams test results to the given port on the given host machine. class StreamingListener : public EmptyTestEventListener { public: // Escapes '=', '&', '%', and '\n' characters in str as "%xx". static string UrlEncode(const char* str); StreamingListener(const string& host, const string& port) : sockfd_(-1), host_name_(host), port_num_(port) { MakeConnection(); Send("gtest_streaming_protocol_version=1.0\n"); } virtual ~StreamingListener() { if (sockfd_ != -1) CloseConnection(); } void OnTestProgramStart(const UnitTest& /* unit_test */) { Send("event=TestProgramStart\n"); } void OnTestProgramEnd(const UnitTest& unit_test) { // Note that Google Test current only report elapsed time for each // test iteration, not for the entire test program. Send(String::Format("event=TestProgramEnd&passed=%d\n", unit_test.Passed())); // Notify the streaming server to stop. CloseConnection(); } void OnTestIterationStart(const UnitTest& /* unit_test */, int iteration) { Send(String::Format("event=TestIterationStart&iteration=%d\n", iteration)); } void OnTestIterationEnd(const UnitTest& unit_test, int /* iteration */) { Send(String::Format("event=TestIterationEnd&passed=%d&elapsed_time=%sms\n", unit_test.Passed(), StreamableToString(unit_test.elapsed_time()).c_str())); } void OnTestCaseStart(const TestCase& test_case) { Send(String::Format("event=TestCaseStart&name=%s\n", test_case.name())); } void OnTestCaseEnd(const TestCase& test_case) { Send(String::Format("event=TestCaseEnd&passed=%d&elapsed_time=%sms\n", test_case.Passed(), StreamableToString(test_case.elapsed_time()).c_str())); } void OnTestStart(const TestInfo& test_info) { Send(String::Format("event=TestStart&name=%s\n", test_info.name())); } void OnTestEnd(const TestInfo& test_info) { Send(String::Format( "event=TestEnd&passed=%d&elapsed_time=%sms\n", (test_info.result())->Passed(), StreamableToString((test_info.result())->elapsed_time()).c_str())); } void OnTestPartResult(const TestPartResult& test_part_result) { const char* file_name = test_part_result.file_name(); if (file_name == NULL) file_name = ""; Send(String::Format("event=TestPartResult&file=%s&line=%d&message=", UrlEncode(file_name).c_str(), test_part_result.line_number())); Send(UrlEncode(test_part_result.message()) + "\n"); } private: // Creates a client socket and connects to the server. void MakeConnection(); // Closes the socket. void CloseConnection() { GTEST_CHECK_(sockfd_ != -1) << "CloseConnection() can be called only when there is a connection."; close(sockfd_); sockfd_ = -1; } // Sends a string to the socket. void Send(const string& message) { GTEST_CHECK_(sockfd_ != -1) << "Send() can be called only when there is a connection."; const int len = static_cast(message.length()); if (write(sockfd_, message.c_str(), len) != len) { GTEST_LOG_(WARNING) << "stream_result_to: failed to stream to " << host_name_ << ":" << port_num_; } } int sockfd_; // socket file descriptor const string host_name_; const string port_num_; GTEST_DISALLOW_COPY_AND_ASSIGN_(StreamingListener); }; // class StreamingListener // Checks if str contains '=', '&', '%' or '\n' characters. If yes, // replaces them by "%xx" where xx is their hexadecimal value. For // example, replaces "=" with "%3D". This algorithm is O(strlen(str)) // in both time and space -- important as the input str may contain an // arbitrarily long test failure message and stack trace. string StreamingListener::UrlEncode(const char* str) { string result; result.reserve(strlen(str) + 1); for (char ch = *str; ch != '\0'; ch = *++str) { switch (ch) { case '%': case '=': case '&': case '\n': result.append(String::Format("%%%02x", static_cast(ch))); break; default: result.push_back(ch); break; } } return result; } void StreamingListener::MakeConnection() { GTEST_CHECK_(sockfd_ == -1) << "MakeConnection() can't be called when there is already a connection."; addrinfo hints; memset(&hints, 0, sizeof(hints)); hints.ai_family = AF_UNSPEC; // To allow both IPv4 and IPv6 addresses. hints.ai_socktype = SOCK_STREAM; addrinfo* servinfo = NULL; // Use the getaddrinfo() to get a linked list of IP addresses for // the given host name. const int error_num = getaddrinfo( host_name_.c_str(), port_num_.c_str(), &hints, &servinfo); if (error_num != 0) { GTEST_LOG_(WARNING) << "stream_result_to: getaddrinfo() failed: " << gai_strerror(error_num); } // Loop through all the results and connect to the first we can. for (addrinfo* cur_addr = servinfo; sockfd_ == -1 && cur_addr != NULL; cur_addr = cur_addr->ai_next) { sockfd_ = socket( cur_addr->ai_family, cur_addr->ai_socktype, cur_addr->ai_protocol); if (sockfd_ != -1) { // Connect the client socket to the server socket. if (connect(sockfd_, cur_addr->ai_addr, cur_addr->ai_addrlen) == -1) { close(sockfd_); sockfd_ = -1; } } } freeaddrinfo(servinfo); // all done with this structure if (sockfd_ == -1) { GTEST_LOG_(WARNING) << "stream_result_to: failed to connect to " << host_name_ << ":" << port_num_; } } // End of class Streaming Listener #endif // GTEST_CAN_STREAM_RESULTS__ // Class ScopedTrace // Pushes the given source file location and message onto a per-thread // trace stack maintained by Google Test. // L < UnitTest::mutex_ ScopedTrace::ScopedTrace(const char* file, int line, const Message& message) { TraceInfo trace; trace.file = file; trace.line = line; trace.message = message.GetString(); UnitTest::GetInstance()->PushGTestTrace(trace); } // Pops the info pushed by the c'tor. // L < UnitTest::mutex_ ScopedTrace::~ScopedTrace() { UnitTest::GetInstance()->PopGTestTrace(); } // class OsStackTraceGetter // Returns the current OS stack trace as a String. Parameters: // // max_depth - the maximum number of stack frames to be included // in the trace. // skip_count - the number of top frames to be skipped; doesn't count // against max_depth. // // L < mutex_ // We use "L < mutex_" to denote that the function may acquire mutex_. String OsStackTraceGetter::CurrentStackTrace(int, int) { return String(""); } // L < mutex_ void OsStackTraceGetter::UponLeavingGTest() { } const char* const OsStackTraceGetter::kElidedFramesMarker = "... " GTEST_NAME_ " internal frames ..."; } // namespace internal // class TestEventListeners TestEventListeners::TestEventListeners() : repeater_(new internal::TestEventRepeater()), default_result_printer_(NULL), default_xml_generator_(NULL) { } TestEventListeners::~TestEventListeners() { delete repeater_; } // Returns the standard listener responsible for the default console // output. Can be removed from the listeners list to shut down default // console output. Note that removing this object from the listener list // with Release transfers its ownership to the user. void TestEventListeners::Append(TestEventListener* listener) { repeater_->Append(listener); } // Removes the given event listener from the list and returns it. It then // becomes the caller's responsibility to delete the listener. Returns // NULL if the listener is not found in the list. TestEventListener* TestEventListeners::Release(TestEventListener* listener) { if (listener == default_result_printer_) default_result_printer_ = NULL; else if (listener == default_xml_generator_) default_xml_generator_ = NULL; return repeater_->Release(listener); } // Returns repeater that broadcasts the TestEventListener events to all // subscribers. TestEventListener* TestEventListeners::repeater() { return repeater_; } // Sets the default_result_printer attribute to the provided listener. // The listener is also added to the listener list and previous // default_result_printer is removed from it and deleted. The listener can // also be NULL in which case it will not be added to the list. Does // nothing if the previous and the current listener objects are the same. void TestEventListeners::SetDefaultResultPrinter(TestEventListener* listener) { if (default_result_printer_ != listener) { // It is an error to pass this method a listener that is already in the // list. delete Release(default_result_printer_); default_result_printer_ = listener; if (listener != NULL) Append(listener); } } // Sets the default_xml_generator attribute to the provided listener. The // listener is also added to the listener list and previous // default_xml_generator is removed from it and deleted. The listener can // also be NULL in which case it will not be added to the list. Does // nothing if the previous and the current listener objects are the same. void TestEventListeners::SetDefaultXmlGenerator(TestEventListener* listener) { if (default_xml_generator_ != listener) { // It is an error to pass this method a listener that is already in the // list. delete Release(default_xml_generator_); default_xml_generator_ = listener; if (listener != NULL) Append(listener); } } // Controls whether events will be forwarded by the repeater to the // listeners in the list. bool TestEventListeners::EventForwardingEnabled() const { return repeater_->forwarding_enabled(); } void TestEventListeners::SuppressEventForwarding() { repeater_->set_forwarding_enabled(false); } // class UnitTest // Gets the singleton UnitTest object. The first time this method is // called, a UnitTest object is constructed and returned. Consecutive // calls will return the same object. // // We don't protect this under mutex_ as a user is not supposed to // call this before main() starts, from which point on the return // value will never change. UnitTest * UnitTest::GetInstance() { // When compiled with MSVC 7.1 in optimized mode, destroying the // UnitTest object upon exiting the program messes up the exit code, // causing successful tests to appear failed. We have to use a // different implementation in this case to bypass the compiler bug. // This implementation makes the compiler happy, at the cost of // leaking the UnitTest object. // CodeGear C++Builder insists on a public destructor for the // default implementation. Use this implementation to keep good OO // design with private destructor. #if (_MSC_VER == 1310 && !defined(_DEBUG)) || defined(__BORLANDC__) static UnitTest* const instance = new UnitTest; return instance; #else static UnitTest instance; return &instance; #endif // (_MSC_VER == 1310 && !defined(_DEBUG)) || defined(__BORLANDC__) } // Gets the number of successful test cases. int UnitTest::successful_test_case_count() const { return impl()->successful_test_case_count(); } // Gets the number of failed test cases. int UnitTest::failed_test_case_count() const { return impl()->failed_test_case_count(); } // Gets the number of all test cases. int UnitTest::total_test_case_count() const { return impl()->total_test_case_count(); } // Gets the number of all test cases that contain at least one test // that should run. int UnitTest::test_case_to_run_count() const { return impl()->test_case_to_run_count(); } // Gets the number of successful tests. int UnitTest::successful_test_count() const { return impl()->successful_test_count(); } // Gets the number of failed tests. int UnitTest::failed_test_count() const { return impl()->failed_test_count(); } // Gets the number of disabled tests. int UnitTest::disabled_test_count() const { return impl()->disabled_test_count(); } // Gets the number of all tests. int UnitTest::total_test_count() const { return impl()->total_test_count(); } // Gets the number of tests that should run. int UnitTest::test_to_run_count() const { return impl()->test_to_run_count(); } // Gets the elapsed time, in milliseconds. internal::TimeInMillis UnitTest::elapsed_time() const { return impl()->elapsed_time(); } // Returns true iff the unit test passed (i.e. all test cases passed). bool UnitTest::Passed() const { return impl()->Passed(); } // Returns true iff the unit test failed (i.e. some test case failed // or something outside of all tests failed). bool UnitTest::Failed() const { return impl()->Failed(); } // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. const TestCase* UnitTest::GetTestCase(int i) const { return impl()->GetTestCase(i); } // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. TestCase* UnitTest::GetMutableTestCase(int i) { return impl()->GetMutableTestCase(i); } // Returns the list of event listeners that can be used to track events // inside Google Test. TestEventListeners& UnitTest::listeners() { return *impl()->listeners(); } // Registers and returns a global test environment. When a test // program is run, all global test environments will be set-up in the // order they were registered. After all tests in the program have // finished, all global test environments will be torn-down in the // *reverse* order they were registered. // // The UnitTest object takes ownership of the given environment. // // We don't protect this under mutex_, as we only support calling it // from the main thread. Environment* UnitTest::AddEnvironment(Environment* env) { if (env == NULL) { return NULL; } impl_->environments().push_back(env); return env; } // Adds a TestPartResult to the current TestResult object. All Google Test // assertion macros (e.g. ASSERT_TRUE, EXPECT_EQ, etc) eventually call // this to report their results. The user code should use the // assertion macros instead of calling this directly. // L < mutex_ void UnitTest::AddTestPartResult(TestPartResult::Type result_type, const char* file_name, int line_number, const internal::String& message, const internal::String& os_stack_trace) { Message msg; msg << message; internal::MutexLock lock(&mutex_); if (impl_->gtest_trace_stack().size() > 0) { msg << "\n" << GTEST_NAME_ << " trace:"; for (int i = static_cast(impl_->gtest_trace_stack().size()); i > 0; --i) { const internal::TraceInfo& trace = impl_->gtest_trace_stack()[i - 1]; msg << "\n" << internal::FormatFileLocation(trace.file, trace.line) << " " << trace.message; } } if (os_stack_trace.c_str() != NULL && !os_stack_trace.empty()) { msg << internal::kStackTraceMarker << os_stack_trace; } const TestPartResult result = TestPartResult(result_type, file_name, line_number, msg.GetString().c_str()); impl_->GetTestPartResultReporterForCurrentThread()-> ReportTestPartResult(result); if (result_type != TestPartResult::kSuccess) { // gtest_break_on_failure takes precedence over // gtest_throw_on_failure. This allows a user to set the latter // in the code (perhaps in order to use Google Test assertions // with another testing framework) and specify the former on the // command line for debugging. if (GTEST_FLAG(break_on_failure)) { #if GTEST_OS_WINDOWS // Using DebugBreak on Windows allows gtest to still break into a debugger // when a failure happens and both the --gtest_break_on_failure and // the --gtest_catch_exceptions flags are specified. DebugBreak(); #else // Dereference NULL through a volatile pointer to prevent the compiler // from removing. We use this rather than abort() or __builtin_trap() for // portability: Symbian doesn't implement abort() well, and some debuggers // don't correctly trap abort(). *static_cast(NULL) = 1; #endif // GTEST_OS_WINDOWS } else if (GTEST_FLAG(throw_on_failure)) { #if GTEST_HAS_EXCEPTIONS throw GoogleTestFailureException(result); #else // We cannot call abort() as it generates a pop-up in debug mode // that cannot be suppressed in VC 7.1 or below. exit(1); #endif } } } // Creates and adds a property to the current TestResult. If a property matching // the supplied value already exists, updates its value instead. void UnitTest::RecordPropertyForCurrentTest(const char* key, const char* value) { const TestProperty test_property(key, value); impl_->current_test_result()->RecordProperty(test_property); } // Runs all tests in this UnitTest object and prints the result. // Returns 0 if successful, or 1 otherwise. // // We don't protect this under mutex_, as we only support calling it // from the main thread. int UnitTest::Run() { // Captures the value of GTEST_FLAG(catch_exceptions). This value will be // used for the duration of the program. impl()->set_catch_exceptions(GTEST_FLAG(catch_exceptions)); #if GTEST_HAS_SEH const bool in_death_test_child_process = internal::GTEST_FLAG(internal_run_death_test).length() > 0; // Either the user wants Google Test to catch exceptions thrown by the // tests or this is executing in the context of death test child // process. In either case the user does not want to see pop-up dialogs // about crashes - they are expected. if (impl()->catch_exceptions() || in_death_test_child_process) { # if !GTEST_OS_WINDOWS_MOBILE // SetErrorMode doesn't exist on CE. SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOALIGNMENTFAULTEXCEPT | SEM_NOGPFAULTERRORBOX | SEM_NOOPENFILEERRORBOX); # endif // !GTEST_OS_WINDOWS_MOBILE # if (defined(_MSC_VER) || GTEST_OS_WINDOWS_MINGW) && !GTEST_OS_WINDOWS_MOBILE // Death test children can be terminated with _abort(). On Windows, // _abort() can show a dialog with a warning message. This forces the // abort message to go to stderr instead. _set_error_mode(_OUT_TO_STDERR); # endif # if _MSC_VER >= 1400 && !GTEST_OS_WINDOWS_MOBILE // In the debug version, Visual Studio pops up a separate dialog // offering a choice to debug the aborted program. We need to suppress // this dialog or it will pop up for every EXPECT/ASSERT_DEATH statement // executed. Google Test will notify the user of any unexpected // failure via stderr. // // VC++ doesn't define _set_abort_behavior() prior to the version 8.0. // Users of prior VC versions shall suffer the agony and pain of // clicking through the countless debug dialogs. // TODO(vladl@google.com): find a way to suppress the abort dialog() in the // debug mode when compiled with VC 7.1 or lower. if (!GTEST_FLAG(break_on_failure)) _set_abort_behavior( 0x0, // Clear the following flags: _WRITE_ABORT_MSG | _CALL_REPORTFAULT); // pop-up window, core dump. # endif } #endif // GTEST_HAS_SEH return internal::HandleExceptionsInMethodIfSupported( impl(), &internal::UnitTestImpl::RunAllTests, "auxiliary test code (environments or event listeners)") ? 0 : 1; } // Returns the working directory when the first TEST() or TEST_F() was // executed. const char* UnitTest::original_working_dir() const { return impl_->original_working_dir_.c_str(); } // Returns the TestCase object for the test that's currently running, // or NULL if no test is running. // L < mutex_ const TestCase* UnitTest::current_test_case() const { internal::MutexLock lock(&mutex_); return impl_->current_test_case(); } // Returns the TestInfo object for the test that's currently running, // or NULL if no test is running. // L < mutex_ const TestInfo* UnitTest::current_test_info() const { internal::MutexLock lock(&mutex_); return impl_->current_test_info(); } // Returns the random seed used at the start of the current test run. int UnitTest::random_seed() const { return impl_->random_seed(); } #if GTEST_HAS_PARAM_TEST // Returns ParameterizedTestCaseRegistry object used to keep track of // value-parameterized tests and instantiate and register them. // L < mutex_ internal::ParameterizedTestCaseRegistry& UnitTest::parameterized_test_registry() { return impl_->parameterized_test_registry(); } #endif // GTEST_HAS_PARAM_TEST // Creates an empty UnitTest. UnitTest::UnitTest() { impl_ = new internal::UnitTestImpl(this); } // Destructor of UnitTest. UnitTest::~UnitTest() { delete impl_; } // Pushes a trace defined by SCOPED_TRACE() on to the per-thread // Google Test trace stack. // L < mutex_ void UnitTest::PushGTestTrace(const internal::TraceInfo& trace) { internal::MutexLock lock(&mutex_); impl_->gtest_trace_stack().push_back(trace); } // Pops a trace from the per-thread Google Test trace stack. // L < mutex_ void UnitTest::PopGTestTrace() { internal::MutexLock lock(&mutex_); impl_->gtest_trace_stack().pop_back(); } namespace internal { UnitTestImpl::UnitTestImpl(UnitTest* parent) : parent_(parent), #ifdef _MSC_VER # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4355) // Temporarily disables warning 4355 // (using this in initializer). default_global_test_part_result_reporter_(this), default_per_thread_test_part_result_reporter_(this), # pragma warning(pop) // Restores the warning state again. #else default_global_test_part_result_reporter_(this), default_per_thread_test_part_result_reporter_(this), #endif // _MSC_VER global_test_part_result_repoter_( &default_global_test_part_result_reporter_), per_thread_test_part_result_reporter_( &default_per_thread_test_part_result_reporter_), #if GTEST_HAS_PARAM_TEST parameterized_test_registry_(), parameterized_tests_registered_(false), #endif // GTEST_HAS_PARAM_TEST last_death_test_case_(-1), current_test_case_(NULL), current_test_info_(NULL), ad_hoc_test_result_(), os_stack_trace_getter_(NULL), post_flag_parse_init_performed_(false), random_seed_(0), // Will be overridden by the flag before first use. random_(0), // Will be reseeded before first use. elapsed_time_(0), #if GTEST_HAS_DEATH_TEST internal_run_death_test_flag_(NULL), death_test_factory_(new DefaultDeathTestFactory), #endif // Will be overridden by the flag before first use. catch_exceptions_(false) { listeners()->SetDefaultResultPrinter(new PrettyUnitTestResultPrinter); } UnitTestImpl::~UnitTestImpl() { // Deletes every TestCase. ForEach(test_cases_, internal::Delete); // Deletes every Environment. ForEach(environments_, internal::Delete); delete os_stack_trace_getter_; } #if GTEST_HAS_DEATH_TEST // Disables event forwarding if the control is currently in a death test // subprocess. Must not be called before InitGoogleTest. void UnitTestImpl::SuppressTestEventsIfInSubprocess() { if (internal_run_death_test_flag_.get() != NULL) listeners()->SuppressEventForwarding(); } #endif // GTEST_HAS_DEATH_TEST // Initializes event listeners performing XML output as specified by // UnitTestOptions. Must not be called before InitGoogleTest. void UnitTestImpl::ConfigureXmlOutput() { const String& output_format = UnitTestOptions::GetOutputFormat(); if (output_format == "xml") { listeners()->SetDefaultXmlGenerator(new XmlUnitTestResultPrinter( UnitTestOptions::GetAbsolutePathToOutputFile().c_str())); } else if (output_format != "") { printf("WARNING: unrecognized output format \"%s\" ignored.\n", output_format.c_str()); fflush(stdout); } } #if GTEST_CAN_STREAM_RESULTS_ // Initializes event listeners for streaming test results in String form. // Must not be called before InitGoogleTest. void UnitTestImpl::ConfigureStreamingOutput() { const string& target = GTEST_FLAG(stream_result_to); if (!target.empty()) { const size_t pos = target.find(':'); if (pos != string::npos) { listeners()->Append(new StreamingListener(target.substr(0, pos), target.substr(pos+1))); } else { printf("WARNING: unrecognized streaming target \"%s\" ignored.\n", target.c_str()); fflush(stdout); } } } #endif // GTEST_CAN_STREAM_RESULTS_ // Performs initialization dependent upon flag values obtained in // ParseGoogleTestFlagsOnly. Is called from InitGoogleTest after the call to // ParseGoogleTestFlagsOnly. In case a user neglects to call InitGoogleTest // this function is also called from RunAllTests. Since this function can be // called more than once, it has to be idempotent. void UnitTestImpl::PostFlagParsingInit() { // Ensures that this function does not execute more than once. if (!post_flag_parse_init_performed_) { post_flag_parse_init_performed_ = true; #if GTEST_HAS_DEATH_TEST InitDeathTestSubprocessControlInfo(); SuppressTestEventsIfInSubprocess(); #endif // GTEST_HAS_DEATH_TEST // Registers parameterized tests. This makes parameterized tests // available to the UnitTest reflection API without running // RUN_ALL_TESTS. RegisterParameterizedTests(); // Configures listeners for XML output. This makes it possible for users // to shut down the default XML output before invoking RUN_ALL_TESTS. ConfigureXmlOutput(); #if GTEST_CAN_STREAM_RESULTS_ // Configures listeners for streaming test results to the specified server. ConfigureStreamingOutput(); #endif // GTEST_CAN_STREAM_RESULTS_ } } // A predicate that checks the name of a TestCase against a known // value. // // This is used for implementation of the UnitTest class only. We put // it in the anonymous namespace to prevent polluting the outer // namespace. // // TestCaseNameIs is copyable. class TestCaseNameIs { public: // Constructor. explicit TestCaseNameIs(const String& name) : name_(name) {} // Returns true iff the name of test_case matches name_. bool operator()(const TestCase* test_case) const { return test_case != NULL && strcmp(test_case->name(), name_.c_str()) == 0; } private: String name_; }; // Finds and returns a TestCase with the given name. If one doesn't // exist, creates one and returns it. It's the CALLER'S // RESPONSIBILITY to ensure that this function is only called WHEN THE // TESTS ARE NOT SHUFFLED. // // Arguments: // // test_case_name: name of the test case // type_param: the name of the test case's type parameter, or NULL if // this is not a typed or a type-parameterized test case. // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case TestCase* UnitTestImpl::GetTestCase(const char* test_case_name, const char* type_param, Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc) { // Can we find a TestCase with the given name? const std::vector::const_iterator test_case = std::find_if(test_cases_.begin(), test_cases_.end(), TestCaseNameIs(test_case_name)); if (test_case != test_cases_.end()) return *test_case; // No. Let's create one. TestCase* const new_test_case = new TestCase(test_case_name, type_param, set_up_tc, tear_down_tc); // Is this a death test case? if (internal::UnitTestOptions::MatchesFilter(String(test_case_name), kDeathTestCaseFilter)) { // Yes. Inserts the test case after the last death test case // defined so far. This only works when the test cases haven't // been shuffled. Otherwise we may end up running a death test // after a non-death test. ++last_death_test_case_; test_cases_.insert(test_cases_.begin() + last_death_test_case_, new_test_case); } else { // No. Appends to the end of the list. test_cases_.push_back(new_test_case); } test_case_indices_.push_back(static_cast(test_case_indices_.size())); return new_test_case; } // Helpers for setting up / tearing down the given environment. They // are for use in the ForEach() function. static void SetUpEnvironment(Environment* env) { env->SetUp(); } static void TearDownEnvironment(Environment* env) { env->TearDown(); } // Runs all tests in this UnitTest object, prints the result, and // returns true if all tests are successful. If any exception is // thrown during a test, the test is considered to be failed, but the // rest of the tests will still be run. // // When parameterized tests are enabled, it expands and registers // parameterized tests first in RegisterParameterizedTests(). // All other functions called from RunAllTests() may safely assume that // parameterized tests are ready to be counted and run. bool UnitTestImpl::RunAllTests() { // Makes sure InitGoogleTest() was called. if (!GTestIsInitialized()) { printf("%s", "\nThis test program did NOT call ::testing::InitGoogleTest " "before calling RUN_ALL_TESTS(). Please fix it.\n"); return false; } // Do not run any test if the --help flag was specified. if (g_help_flag) return true; // Repeats the call to the post-flag parsing initialization in case the // user didn't call InitGoogleTest. PostFlagParsingInit(); // Even if sharding is not on, test runners may want to use the // GTEST_SHARD_STATUS_FILE to query whether the test supports the sharding // protocol. internal::WriteToShardStatusFileIfNeeded(); // True iff we are in a subprocess for running a thread-safe-style // death test. bool in_subprocess_for_death_test = false; #if GTEST_HAS_DEATH_TEST in_subprocess_for_death_test = (internal_run_death_test_flag_.get() != NULL); #endif // GTEST_HAS_DEATH_TEST const bool should_shard = ShouldShard(kTestTotalShards, kTestShardIndex, in_subprocess_for_death_test); // Compares the full test names with the filter to decide which // tests to run. const bool has_tests_to_run = FilterTests(should_shard ? HONOR_SHARDING_PROTOCOL : IGNORE_SHARDING_PROTOCOL) > 0; // Lists the tests and exits if the --gtest_list_tests flag was specified. if (GTEST_FLAG(list_tests)) { // This must be called *after* FilterTests() has been called. ListTestsMatchingFilter(); return true; } random_seed_ = GTEST_FLAG(shuffle) ? GetRandomSeedFromFlag(GTEST_FLAG(random_seed)) : 0; // True iff at least one test has failed. bool failed = false; TestEventListener* repeater = listeners()->repeater(); repeater->OnTestProgramStart(*parent_); // How many times to repeat the tests? We don't want to repeat them // when we are inside the subprocess of a death test. const int repeat = in_subprocess_for_death_test ? 1 : GTEST_FLAG(repeat); // Repeats forever if the repeat count is negative. const bool forever = repeat < 0; for (int i = 0; forever || i != repeat; i++) { // We want to preserve failures generated by ad-hoc test // assertions executed before RUN_ALL_TESTS(). ClearNonAdHocTestResult(); const TimeInMillis start = GetTimeInMillis(); // Shuffles test cases and tests if requested. if (has_tests_to_run && GTEST_FLAG(shuffle)) { random()->Reseed(random_seed_); // This should be done before calling OnTestIterationStart(), // such that a test event listener can see the actual test order // in the event. ShuffleTests(); } // Tells the unit test event listeners that the tests are about to start. repeater->OnTestIterationStart(*parent_, i); // Runs each test case if there is at least one test to run. if (has_tests_to_run) { // Sets up all environments beforehand. repeater->OnEnvironmentsSetUpStart(*parent_); ForEach(environments_, SetUpEnvironment); repeater->OnEnvironmentsSetUpEnd(*parent_); // Runs the tests only if there was no fatal failure during global // set-up. if (!Test::HasFatalFailure()) { for (int test_index = 0; test_index < total_test_case_count(); test_index++) { GetMutableTestCase(test_index)->Run(); } } // Tears down all environments in reverse order afterwards. repeater->OnEnvironmentsTearDownStart(*parent_); std::for_each(environments_.rbegin(), environments_.rend(), TearDownEnvironment); repeater->OnEnvironmentsTearDownEnd(*parent_); } elapsed_time_ = GetTimeInMillis() - start; // Tells the unit test event listener that the tests have just finished. repeater->OnTestIterationEnd(*parent_, i); // Gets the result and clears it. if (!Passed()) { failed = true; } // Restores the original test order after the iteration. This // allows the user to quickly repro a failure that happens in the // N-th iteration without repeating the first (N - 1) iterations. // This is not enclosed in "if (GTEST_FLAG(shuffle)) { ... }", in // case the user somehow changes the value of the flag somewhere // (it's always safe to unshuffle the tests). UnshuffleTests(); if (GTEST_FLAG(shuffle)) { // Picks a new random seed for each iteration. random_seed_ = GetNextRandomSeed(random_seed_); } } repeater->OnTestProgramEnd(*parent_); return !failed; } // Reads the GTEST_SHARD_STATUS_FILE environment variable, and creates the file // if the variable is present. If a file already exists at this location, this // function will write over it. If the variable is present, but the file cannot // be created, prints an error and exits. void WriteToShardStatusFileIfNeeded() { const char* const test_shard_file = posix::GetEnv(kTestShardStatusFile); if (test_shard_file != NULL) { FILE* const file = posix::FOpen(test_shard_file, "w"); if (file == NULL) { ColoredPrintf(COLOR_RED, "Could not write to the test shard status file \"%s\" " "specified by the %s environment variable.\n", test_shard_file, kTestShardStatusFile); fflush(stdout); exit(EXIT_FAILURE); } fclose(file); } } // Checks whether sharding is enabled by examining the relevant // environment variable values. If the variables are present, // but inconsistent (i.e., shard_index >= total_shards), prints // an error and exits. If in_subprocess_for_death_test, sharding is // disabled because it must only be applied to the original test // process. Otherwise, we could filter out death tests we intended to execute. bool ShouldShard(const char* total_shards_env, const char* shard_index_env, bool in_subprocess_for_death_test) { if (in_subprocess_for_death_test) { return false; } const Int32 total_shards = Int32FromEnvOrDie(total_shards_env, -1); const Int32 shard_index = Int32FromEnvOrDie(shard_index_env, -1); if (total_shards == -1 && shard_index == -1) { return false; } else if (total_shards == -1 && shard_index != -1) { const Message msg = Message() << "Invalid environment variables: you have " << kTestShardIndex << " = " << shard_index << ", but have left " << kTestTotalShards << " unset.\n"; ColoredPrintf(COLOR_RED, msg.GetString().c_str()); fflush(stdout); exit(EXIT_FAILURE); } else if (total_shards != -1 && shard_index == -1) { const Message msg = Message() << "Invalid environment variables: you have " << kTestTotalShards << " = " << total_shards << ", but have left " << kTestShardIndex << " unset.\n"; ColoredPrintf(COLOR_RED, msg.GetString().c_str()); fflush(stdout); exit(EXIT_FAILURE); } else if (shard_index < 0 || shard_index >= total_shards) { const Message msg = Message() << "Invalid environment variables: we require 0 <= " << kTestShardIndex << " < " << kTestTotalShards << ", but you have " << kTestShardIndex << "=" << shard_index << ", " << kTestTotalShards << "=" << total_shards << ".\n"; ColoredPrintf(COLOR_RED, msg.GetString().c_str()); fflush(stdout); exit(EXIT_FAILURE); } return total_shards > 1; } // Parses the environment variable var as an Int32. If it is unset, // returns default_val. If it is not an Int32, prints an error // and aborts. Int32 Int32FromEnvOrDie(const char* var, Int32 default_val) { const char* str_val = posix::GetEnv(var); if (str_val == NULL) { return default_val; } Int32 result; if (!ParseInt32(Message() << "The value of environment variable " << var, str_val, &result)) { exit(EXIT_FAILURE); } return result; } // Given the total number of shards, the shard index, and the test id, // returns true iff the test should be run on this shard. The test id is // some arbitrary but unique non-negative integer assigned to each test // method. Assumes that 0 <= shard_index < total_shards. bool ShouldRunTestOnShard(int total_shards, int shard_index, int test_id) { return (test_id % total_shards) == shard_index; } // Compares the name of each test with the user-specified filter to // decide whether the test should be run, then records the result in // each TestCase and TestInfo object. // If shard_tests == true, further filters tests based on sharding // variables in the environment - see // http://code.google.com/p/googletest/wiki/GoogleTestAdvancedGuide. // Returns the number of tests that should run. int UnitTestImpl::FilterTests(ReactionToSharding shard_tests) { const Int32 total_shards = shard_tests == HONOR_SHARDING_PROTOCOL ? Int32FromEnvOrDie(kTestTotalShards, -1) : -1; const Int32 shard_index = shard_tests == HONOR_SHARDING_PROTOCOL ? Int32FromEnvOrDie(kTestShardIndex, -1) : -1; // num_runnable_tests are the number of tests that will // run across all shards (i.e., match filter and are not disabled). // num_selected_tests are the number of tests to be run on // this shard. int num_runnable_tests = 0; int num_selected_tests = 0; for (size_t i = 0; i < test_cases_.size(); i++) { TestCase* const test_case = test_cases_[i]; const String &test_case_name = test_case->name(); test_case->set_should_run(false); for (size_t j = 0; j < test_case->test_info_list().size(); j++) { TestInfo* const test_info = test_case->test_info_list()[j]; const String test_name(test_info->name()); // A test is disabled if test case name or test name matches // kDisableTestFilter. const bool is_disabled = internal::UnitTestOptions::MatchesFilter(test_case_name, kDisableTestFilter) || internal::UnitTestOptions::MatchesFilter(test_name, kDisableTestFilter); test_info->is_disabled_ = is_disabled; const bool matches_filter = internal::UnitTestOptions::FilterMatchesTest(test_case_name, test_name); test_info->matches_filter_ = matches_filter; const bool is_runnable = (GTEST_FLAG(also_run_disabled_tests) || !is_disabled) && matches_filter; const bool is_selected = is_runnable && (shard_tests == IGNORE_SHARDING_PROTOCOL || ShouldRunTestOnShard(total_shards, shard_index, num_runnable_tests)); num_runnable_tests += is_runnable; num_selected_tests += is_selected; test_info->should_run_ = is_selected; test_case->set_should_run(test_case->should_run() || is_selected); } } return num_selected_tests; } // Prints the names of the tests matching the user-specified filter flag. void UnitTestImpl::ListTestsMatchingFilter() { for (size_t i = 0; i < test_cases_.size(); i++) { const TestCase* const test_case = test_cases_[i]; bool printed_test_case_name = false; for (size_t j = 0; j < test_case->test_info_list().size(); j++) { const TestInfo* const test_info = test_case->test_info_list()[j]; if (test_info->matches_filter_) { if (!printed_test_case_name) { printed_test_case_name = true; printf("%s.\n", test_case->name()); } printf(" %s\n", test_info->name()); } } } fflush(stdout); } // Sets the OS stack trace getter. // // Does nothing if the input and the current OS stack trace getter are // the same; otherwise, deletes the old getter and makes the input the // current getter. void UnitTestImpl::set_os_stack_trace_getter( OsStackTraceGetterInterface* getter) { if (os_stack_trace_getter_ != getter) { delete os_stack_trace_getter_; os_stack_trace_getter_ = getter; } } // Returns the current OS stack trace getter if it is not NULL; // otherwise, creates an OsStackTraceGetter, makes it the current // getter, and returns it. OsStackTraceGetterInterface* UnitTestImpl::os_stack_trace_getter() { if (os_stack_trace_getter_ == NULL) { os_stack_trace_getter_ = new OsStackTraceGetter; } return os_stack_trace_getter_; } // Returns the TestResult for the test that's currently running, or // the TestResult for the ad hoc test if no test is running. TestResult* UnitTestImpl::current_test_result() { return current_test_info_ ? &(current_test_info_->result_) : &ad_hoc_test_result_; } // Shuffles all test cases, and the tests within each test case, // making sure that death tests are still run first. void UnitTestImpl::ShuffleTests() { // Shuffles the death test cases. ShuffleRange(random(), 0, last_death_test_case_ + 1, &test_case_indices_); // Shuffles the non-death test cases. ShuffleRange(random(), last_death_test_case_ + 1, static_cast(test_cases_.size()), &test_case_indices_); // Shuffles the tests inside each test case. for (size_t i = 0; i < test_cases_.size(); i++) { test_cases_[i]->ShuffleTests(random()); } } // Restores the test cases and tests to their order before the first shuffle. void UnitTestImpl::UnshuffleTests() { for (size_t i = 0; i < test_cases_.size(); i++) { // Unshuffles the tests in each test case. test_cases_[i]->UnshuffleTests(); // Resets the index of each test case. test_case_indices_[i] = static_cast(i); } } // Returns the current OS stack trace as a String. // // The maximum number of stack frames to be included is specified by // the gtest_stack_trace_depth flag. The skip_count parameter // specifies the number of top frames to be skipped, which doesn't // count against the number of frames to be included. // // For example, if Foo() calls Bar(), which in turn calls // GetCurrentOsStackTraceExceptTop(..., 1), Foo() will be included in // the trace but Bar() and GetCurrentOsStackTraceExceptTop() won't. String GetCurrentOsStackTraceExceptTop(UnitTest* /*unit_test*/, int skip_count) { // We pass skip_count + 1 to skip this wrapper function in addition // to what the user really wants to skip. return GetUnitTestImpl()->CurrentOsStackTraceExceptTop(skip_count + 1); } // Used by the GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_ macro to // suppress unreachable code warnings. namespace { class ClassUniqueToAlwaysTrue {}; } bool IsTrue(bool condition) { return condition; } bool AlwaysTrue() { #if GTEST_HAS_EXCEPTIONS // This condition is always false so AlwaysTrue() never actually throws, // but it makes the compiler think that it may throw. if (IsTrue(false)) throw ClassUniqueToAlwaysTrue(); #endif // GTEST_HAS_EXCEPTIONS return true; } // If *pstr starts with the given prefix, modifies *pstr to be right // past the prefix and returns true; otherwise leaves *pstr unchanged // and returns false. None of pstr, *pstr, and prefix can be NULL. bool SkipPrefix(const char* prefix, const char** pstr) { const size_t prefix_len = strlen(prefix); if (strncmp(*pstr, prefix, prefix_len) == 0) { *pstr += prefix_len; return true; } return false; } // Parses a string as a command line flag. The string should have // the format "--flag=value". When def_optional is true, the "=value" // part can be omitted. // // Returns the value of the flag, or NULL if the parsing failed. const char* ParseFlagValue(const char* str, const char* flag, bool def_optional) { // str and flag must not be NULL. if (str == NULL || flag == NULL) return NULL; // The flag must start with "--" followed by GTEST_FLAG_PREFIX_. const String flag_str = String::Format("--%s%s", GTEST_FLAG_PREFIX_, flag); const size_t flag_len = flag_str.length(); if (strncmp(str, flag_str.c_str(), flag_len) != 0) return NULL; // Skips the flag name. const char* flag_end = str + flag_len; // When def_optional is true, it's OK to not have a "=value" part. if (def_optional && (flag_end[0] == '\0')) { return flag_end; } // If def_optional is true and there are more characters after the // flag name, or if def_optional is false, there must be a '=' after // the flag name. if (flag_end[0] != '=') return NULL; // Returns the string after "=". return flag_end + 1; } // Parses a string for a bool flag, in the form of either // "--flag=value" or "--flag". // // In the former case, the value is taken as true as long as it does // not start with '0', 'f', or 'F'. // // In the latter case, the value is taken as true. // // On success, stores the value of the flag in *value, and returns // true. On failure, returns false without changing *value. bool ParseBoolFlag(const char* str, const char* flag, bool* value) { // Gets the value of the flag as a string. const char* const value_str = ParseFlagValue(str, flag, true); // Aborts if the parsing failed. if (value_str == NULL) return false; // Converts the string value to a bool. *value = !(*value_str == '0' || *value_str == 'f' || *value_str == 'F'); return true; } // Parses a string for an Int32 flag, in the form of // "--flag=value". // // On success, stores the value of the flag in *value, and returns // true. On failure, returns false without changing *value. bool ParseInt32Flag(const char* str, const char* flag, Int32* value) { // Gets the value of the flag as a string. const char* const value_str = ParseFlagValue(str, flag, false); // Aborts if the parsing failed. if (value_str == NULL) return false; // Sets *value to the value of the flag. return ParseInt32(Message() << "The value of flag --" << flag, value_str, value); } // Parses a string for a string flag, in the form of // "--flag=value". // // On success, stores the value of the flag in *value, and returns // true. On failure, returns false without changing *value. bool ParseStringFlag(const char* str, const char* flag, String* value) { // Gets the value of the flag as a string. const char* const value_str = ParseFlagValue(str, flag, false); // Aborts if the parsing failed. if (value_str == NULL) return false; // Sets *value to the value of the flag. *value = value_str; return true; } // Determines whether a string has a prefix that Google Test uses for its // flags, i.e., starts with GTEST_FLAG_PREFIX_ or GTEST_FLAG_PREFIX_DASH_. // If Google Test detects that a command line flag has its prefix but is not // recognized, it will print its help message. Flags starting with // GTEST_INTERNAL_PREFIX_ followed by "internal_" are considered Google Test // internal flags and do not trigger the help message. static bool HasGoogleTestFlagPrefix(const char* str) { return (SkipPrefix("--", &str) || SkipPrefix("-", &str) || SkipPrefix("/", &str)) && !SkipPrefix(GTEST_FLAG_PREFIX_ "internal_", &str) && (SkipPrefix(GTEST_FLAG_PREFIX_, &str) || SkipPrefix(GTEST_FLAG_PREFIX_DASH_, &str)); } // Prints a string containing code-encoded text. The following escape // sequences can be used in the string to control the text color: // // @@ prints a single '@' character. // @R changes the color to red. // @G changes the color to green. // @Y changes the color to yellow. // @D changes to the default terminal text color. // // TODO(wan@google.com): Write tests for this once we add stdout // capturing to Google Test. static void PrintColorEncoded(const char* str) { GTestColor color = COLOR_DEFAULT; // The current color. // Conceptually, we split the string into segments divided by escape // sequences. Then we print one segment at a time. At the end of // each iteration, the str pointer advances to the beginning of the // next segment. for (;;) { const char* p = strchr(str, '@'); if (p == NULL) { ColoredPrintf(color, "%s", str); return; } ColoredPrintf(color, "%s", String(str, p - str).c_str()); const char ch = p[1]; str = p + 2; if (ch == '@') { ColoredPrintf(color, "@"); } else if (ch == 'D') { color = COLOR_DEFAULT; } else if (ch == 'R') { color = COLOR_RED; } else if (ch == 'G') { color = COLOR_GREEN; } else if (ch == 'Y') { color = COLOR_YELLOW; } else { --str; } } } static const char kColorEncodedHelpMessage[] = "This program contains tests written using " GTEST_NAME_ ". You can use the\n" "following command line flags to control its behavior:\n" "\n" "Test Selection:\n" " @G--" GTEST_FLAG_PREFIX_ "list_tests@D\n" " List the names of all tests instead of running them. The name of\n" " TEST(Foo, Bar) is \"Foo.Bar\".\n" " @G--" GTEST_FLAG_PREFIX_ "filter=@YPOSTIVE_PATTERNS" "[@G-@YNEGATIVE_PATTERNS]@D\n" " Run only the tests whose name matches one of the positive patterns but\n" " none of the negative patterns. '?' matches any single character; '*'\n" " matches any substring; ':' separates two patterns.\n" " @G--" GTEST_FLAG_PREFIX_ "also_run_disabled_tests@D\n" " Run all disabled tests too.\n" "\n" "Test Execution:\n" " @G--" GTEST_FLAG_PREFIX_ "repeat=@Y[COUNT]@D\n" " Run the tests repeatedly; use a negative count to repeat forever.\n" " @G--" GTEST_FLAG_PREFIX_ "shuffle@D\n" " Randomize tests' orders on every iteration.\n" " @G--" GTEST_FLAG_PREFIX_ "random_seed=@Y[NUMBER]@D\n" " Random number seed to use for shuffling test orders (between 1 and\n" " 99999, or 0 to use a seed based on the current time).\n" "\n" "Test Output:\n" " @G--" GTEST_FLAG_PREFIX_ "color=@Y(@Gyes@Y|@Gno@Y|@Gauto@Y)@D\n" " Enable/disable colored output. The default is @Gauto@D.\n" " -@G-" GTEST_FLAG_PREFIX_ "print_time=0@D\n" " Don't print the elapsed time of each test.\n" " @G--" GTEST_FLAG_PREFIX_ "output=xml@Y[@G:@YDIRECTORY_PATH@G" GTEST_PATH_SEP_ "@Y|@G:@YFILE_PATH]@D\n" " Generate an XML report in the given directory or with the given file\n" " name. @YFILE_PATH@D defaults to @Gtest_details.xml@D.\n" #if GTEST_CAN_STREAM_RESULTS_ " @G--" GTEST_FLAG_PREFIX_ "stream_result_to=@YHOST@G:@YPORT@D\n" " Stream test results to the given server.\n" #endif // GTEST_CAN_STREAM_RESULTS_ "\n" "Assertion Behavior:\n" #if GTEST_HAS_DEATH_TEST && !GTEST_OS_WINDOWS " @G--" GTEST_FLAG_PREFIX_ "death_test_style=@Y(@Gfast@Y|@Gthreadsafe@Y)@D\n" " Set the default death test style.\n" #endif // GTEST_HAS_DEATH_TEST && !GTEST_OS_WINDOWS " @G--" GTEST_FLAG_PREFIX_ "break_on_failure@D\n" " Turn assertion failures into debugger break-points.\n" " @G--" GTEST_FLAG_PREFIX_ "throw_on_failure@D\n" " Turn assertion failures into C++ exceptions.\n" " @G--" GTEST_FLAG_PREFIX_ "catch_exceptions=0@D\n" " Do not report exceptions as test failures. Instead, allow them\n" " to crash the program or throw a pop-up (on Windows).\n" "\n" "Except for @G--" GTEST_FLAG_PREFIX_ "list_tests@D, you can alternatively set " "the corresponding\n" "environment variable of a flag (all letters in upper-case). For example, to\n" "disable colored text output, you can either specify @G--" GTEST_FLAG_PREFIX_ "color=no@D or set\n" "the @G" GTEST_FLAG_PREFIX_UPPER_ "COLOR@D environment variable to @Gno@D.\n" "\n" "For more information, please read the " GTEST_NAME_ " documentation at\n" "@G" GTEST_PROJECT_URL_ "@D. If you find a bug in " GTEST_NAME_ "\n" "(not one in your own code or tests), please report it to\n" "@G<" GTEST_DEV_EMAIL_ ">@D.\n"; // Parses the command line for Google Test flags, without initializing // other parts of Google Test. The type parameter CharType can be // instantiated to either char or wchar_t. template void ParseGoogleTestFlagsOnlyImpl(int* argc, CharType** argv) { for (int i = 1; i < *argc; i++) { const String arg_string = StreamableToString(argv[i]); const char* const arg = arg_string.c_str(); using internal::ParseBoolFlag; using internal::ParseInt32Flag; using internal::ParseStringFlag; // Do we see a Google Test flag? if (ParseBoolFlag(arg, kAlsoRunDisabledTestsFlag, >EST_FLAG(also_run_disabled_tests)) || ParseBoolFlag(arg, kBreakOnFailureFlag, >EST_FLAG(break_on_failure)) || ParseBoolFlag(arg, kCatchExceptionsFlag, >EST_FLAG(catch_exceptions)) || ParseStringFlag(arg, kColorFlag, >EST_FLAG(color)) || ParseStringFlag(arg, kDeathTestStyleFlag, >EST_FLAG(death_test_style)) || ParseBoolFlag(arg, kDeathTestUseFork, >EST_FLAG(death_test_use_fork)) || ParseStringFlag(arg, kFilterFlag, >EST_FLAG(filter)) || ParseStringFlag(arg, kInternalRunDeathTestFlag, >EST_FLAG(internal_run_death_test)) || ParseBoolFlag(arg, kListTestsFlag, >EST_FLAG(list_tests)) || ParseStringFlag(arg, kOutputFlag, >EST_FLAG(output)) || ParseBoolFlag(arg, kPrintTimeFlag, >EST_FLAG(print_time)) || ParseInt32Flag(arg, kRandomSeedFlag, >EST_FLAG(random_seed)) || ParseInt32Flag(arg, kRepeatFlag, >EST_FLAG(repeat)) || ParseBoolFlag(arg, kShuffleFlag, >EST_FLAG(shuffle)) || ParseInt32Flag(arg, kStackTraceDepthFlag, >EST_FLAG(stack_trace_depth)) || ParseStringFlag(arg, kStreamResultToFlag, >EST_FLAG(stream_result_to)) || ParseBoolFlag(arg, kThrowOnFailureFlag, >EST_FLAG(throw_on_failure)) ) { // Yes. Shift the remainder of the argv list left by one. Note // that argv has (*argc + 1) elements, the last one always being // NULL. The following loop moves the trailing NULL element as // well. for (int j = i; j != *argc; j++) { argv[j] = argv[j + 1]; } // Decrements the argument count. (*argc)--; // We also need to decrement the iterator as we just removed // an element. i--; } else if (arg_string == "--help" || arg_string == "-h" || arg_string == "-?" || arg_string == "/?" || HasGoogleTestFlagPrefix(arg)) { // Both help flag and unrecognized Google Test flags (excluding // internal ones) trigger help display. g_help_flag = true; } } if (g_help_flag) { // We print the help here instead of in RUN_ALL_TESTS(), as the // latter may not be called at all if the user is using Google // Test with another testing framework. PrintColorEncoded(kColorEncodedHelpMessage); } } // Parses the command line for Google Test flags, without initializing // other parts of Google Test. void ParseGoogleTestFlagsOnly(int* argc, char** argv) { ParseGoogleTestFlagsOnlyImpl(argc, argv); } void ParseGoogleTestFlagsOnly(int* argc, wchar_t** argv) { ParseGoogleTestFlagsOnlyImpl(argc, argv); } // The internal implementation of InitGoogleTest(). // // The type parameter CharType can be instantiated to either char or // wchar_t. template void InitGoogleTestImpl(int* argc, CharType** argv) { g_init_gtest_count++; // We don't want to run the initialization code twice. if (g_init_gtest_count != 1) return; if (*argc <= 0) return; internal::g_executable_path = internal::StreamableToString(argv[0]); #if GTEST_HAS_DEATH_TEST g_argvs.clear(); for (int i = 0; i != *argc; i++) { g_argvs.push_back(StreamableToString(argv[i])); } #endif // GTEST_HAS_DEATH_TEST ParseGoogleTestFlagsOnly(argc, argv); GetUnitTestImpl()->PostFlagParsingInit(); } } // namespace internal // Initializes Google Test. This must be called before calling // RUN_ALL_TESTS(). In particular, it parses a command line for the // flags that Google Test recognizes. Whenever a Google Test flag is // seen, it is removed from argv, and *argc is decremented. // // No value is returned. Instead, the Google Test flag variables are // updated. // // Calling the function for the second time has no user-visible effect. void InitGoogleTest(int* argc, char** argv) { internal::InitGoogleTestImpl(argc, argv); } // This overloaded version can be used in Windows programs compiled in // UNICODE mode. void InitGoogleTest(int* argc, wchar_t** argv) { internal::InitGoogleTestImpl(argc, argv); } } // namespace testing // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan), vladl@google.com (Vlad Losev) // // This file implements death tests. #if GTEST_HAS_DEATH_TEST # if GTEST_OS_MAC # include # endif // GTEST_OS_MAC # include # include # include # include # if GTEST_OS_WINDOWS # include # else # include # include # endif // GTEST_OS_WINDOWS #endif // GTEST_HAS_DEATH_TEST // Indicates that this translation unit is part of Google Test's // implementation. It must come before gtest-internal-inl.h is // included, or there will be a compiler error. This trick is to // prevent a user from accidentally including gtest-internal-inl.h in // his code. #define GTEST_IMPLEMENTATION_ 1 #undef GTEST_IMPLEMENTATION_ namespace testing { // Constants. // The default death test style. static const char kDefaultDeathTestStyle[] = "fast"; GTEST_DEFINE_string_( death_test_style, internal::StringFromGTestEnv("death_test_style", kDefaultDeathTestStyle), "Indicates how to run a death test in a forked child process: " "\"threadsafe\" (child process re-executes the test binary " "from the beginning, running only the specific death test) or " "\"fast\" (child process runs the death test immediately " "after forking)."); GTEST_DEFINE_bool_( death_test_use_fork, internal::BoolFromGTestEnv("death_test_use_fork", false), "Instructs to use fork()/_exit() instead of clone() in death tests. " "Ignored and always uses fork() on POSIX systems where clone() is not " "implemented. Useful when running under valgrind or similar tools if " "those do not support clone(). Valgrind 3.3.1 will just fail if " "it sees an unsupported combination of clone() flags. " "It is not recommended to use this flag w/o valgrind though it will " "work in 99% of the cases. Once valgrind is fixed, this flag will " "most likely be removed."); namespace internal { GTEST_DEFINE_string_( internal_run_death_test, "", "Indicates the file, line number, temporal index of " "the single death test to run, and a file descriptor to " "which a success code may be sent, all separated by " "colons. This flag is specified if and only if the current " "process is a sub-process launched for running a thread-safe " "death test. FOR INTERNAL USE ONLY."); } // namespace internal #if GTEST_HAS_DEATH_TEST // ExitedWithCode constructor. ExitedWithCode::ExitedWithCode(int exit_code) : exit_code_(exit_code) { } // ExitedWithCode function-call operator. bool ExitedWithCode::operator()(int exit_status) const { # if GTEST_OS_WINDOWS return exit_status == exit_code_; # else return WIFEXITED(exit_status) && WEXITSTATUS(exit_status) == exit_code_; # endif // GTEST_OS_WINDOWS } # if !GTEST_OS_WINDOWS // KilledBySignal constructor. KilledBySignal::KilledBySignal(int signum) : signum_(signum) { } // KilledBySignal function-call operator. bool KilledBySignal::operator()(int exit_status) const { return WIFSIGNALED(exit_status) && WTERMSIG(exit_status) == signum_; } # endif // !GTEST_OS_WINDOWS namespace internal { // Utilities needed for death tests. // Generates a textual description of a given exit code, in the format // specified by wait(2). static String ExitSummary(int exit_code) { Message m; # if GTEST_OS_WINDOWS m << "Exited with exit status " << exit_code; # else if (WIFEXITED(exit_code)) { m << "Exited with exit status " << WEXITSTATUS(exit_code); } else if (WIFSIGNALED(exit_code)) { m << "Terminated by signal " << WTERMSIG(exit_code); } # ifdef WCOREDUMP if (WCOREDUMP(exit_code)) { m << " (core dumped)"; } # endif # endif // GTEST_OS_WINDOWS return m.GetString(); } // Returns true if exit_status describes a process that was terminated // by a signal, or exited normally with a nonzero exit code. bool ExitedUnsuccessfully(int exit_status) { return !ExitedWithCode(0)(exit_status); } # if !GTEST_OS_WINDOWS // Generates a textual failure message when a death test finds more than // one thread running, or cannot determine the number of threads, prior // to executing the given statement. It is the responsibility of the // caller not to pass a thread_count of 1. static String DeathTestThreadWarning(size_t thread_count) { Message msg; msg << "Death tests use fork(), which is unsafe particularly" << " in a threaded context. For this test, " << GTEST_NAME_ << " "; if (thread_count == 0) msg << "couldn't detect the number of threads."; else msg << "detected " << thread_count << " threads."; return msg.GetString(); } # endif // !GTEST_OS_WINDOWS // Flag characters for reporting a death test that did not die. static const char kDeathTestLived = 'L'; static const char kDeathTestReturned = 'R'; static const char kDeathTestThrew = 'T'; static const char kDeathTestInternalError = 'I'; // An enumeration describing all of the possible ways that a death test can // conclude. DIED means that the process died while executing the test // code; LIVED means that process lived beyond the end of the test code; // RETURNED means that the test statement attempted to execute a return // statement, which is not allowed; THREW means that the test statement // returned control by throwing an exception. IN_PROGRESS means the test // has not yet concluded. // TODO(vladl@google.com): Unify names and possibly values for // AbortReason, DeathTestOutcome, and flag characters above. enum DeathTestOutcome { IN_PROGRESS, DIED, LIVED, RETURNED, THREW }; // Routine for aborting the program which is safe to call from an // exec-style death test child process, in which case the error // message is propagated back to the parent process. Otherwise, the // message is simply printed to stderr. In either case, the program // then exits with status 1. void DeathTestAbort(const String& message) { // On a POSIX system, this function may be called from a threadsafe-style // death test child process, which operates on a very small stack. Use // the heap for any additional non-minuscule memory requirements. const InternalRunDeathTestFlag* const flag = GetUnitTestImpl()->internal_run_death_test_flag(); if (flag != NULL) { FILE* parent = posix::FDOpen(flag->write_fd(), "w"); fputc(kDeathTestInternalError, parent); fprintf(parent, "%s", message.c_str()); fflush(parent); _exit(1); } else { fprintf(stderr, "%s", message.c_str()); fflush(stderr); posix::Abort(); } } // A replacement for CHECK that calls DeathTestAbort if the assertion // fails. # define GTEST_DEATH_TEST_CHECK_(expression) \ do { \ if (!::testing::internal::IsTrue(expression)) { \ DeathTestAbort(::testing::internal::String::Format( \ "CHECK failed: File %s, line %d: %s", \ __FILE__, __LINE__, #expression)); \ } \ } while (::testing::internal::AlwaysFalse()) // This macro is similar to GTEST_DEATH_TEST_CHECK_, but it is meant for // evaluating any system call that fulfills two conditions: it must return // -1 on failure, and set errno to EINTR when it is interrupted and // should be tried again. The macro expands to a loop that repeatedly // evaluates the expression as long as it evaluates to -1 and sets // errno to EINTR. If the expression evaluates to -1 but errno is // something other than EINTR, DeathTestAbort is called. # define GTEST_DEATH_TEST_CHECK_SYSCALL_(expression) \ do { \ int gtest_retval; \ do { \ gtest_retval = (expression); \ } while (gtest_retval == -1 && errno == EINTR); \ if (gtest_retval == -1) { \ DeathTestAbort(::testing::internal::String::Format( \ "CHECK failed: File %s, line %d: %s != -1", \ __FILE__, __LINE__, #expression)); \ } \ } while (::testing::internal::AlwaysFalse()) // Returns the message describing the last system error in errno. String GetLastErrnoDescription() { return String(errno == 0 ? "" : posix::StrError(errno)); } // This is called from a death test parent process to read a failure // message from the death test child process and log it with the FATAL // severity. On Windows, the message is read from a pipe handle. On other // platforms, it is read from a file descriptor. static void FailFromInternalError(int fd) { Message error; char buffer[256]; int num_read; do { while ((num_read = posix::Read(fd, buffer, 255)) > 0) { buffer[num_read] = '\0'; error << buffer; } } while (num_read == -1 && errno == EINTR); if (num_read == 0) { GTEST_LOG_(FATAL) << error.GetString(); } else { const int last_error = errno; GTEST_LOG_(FATAL) << "Error while reading death test internal: " << GetLastErrnoDescription() << " [" << last_error << "]"; } } // Death test constructor. Increments the running death test count // for the current test. DeathTest::DeathTest() { TestInfo* const info = GetUnitTestImpl()->current_test_info(); if (info == NULL) { DeathTestAbort("Cannot run a death test outside of a TEST or " "TEST_F construct"); } } // Creates and returns a death test by dispatching to the current // death test factory. bool DeathTest::Create(const char* statement, const RE* regex, const char* file, int line, DeathTest** test) { return GetUnitTestImpl()->death_test_factory()->Create( statement, regex, file, line, test); } const char* DeathTest::LastMessage() { return last_death_test_message_.c_str(); } void DeathTest::set_last_death_test_message(const String& message) { last_death_test_message_ = message; } String DeathTest::last_death_test_message_; // Provides cross platform implementation for some death functionality. class DeathTestImpl : public DeathTest { protected: DeathTestImpl(const char* a_statement, const RE* a_regex) : statement_(a_statement), regex_(a_regex), spawned_(false), status_(-1), outcome_(IN_PROGRESS), read_fd_(-1), write_fd_(-1) {} // read_fd_ is expected to be closed and cleared by a derived class. ~DeathTestImpl() { GTEST_DEATH_TEST_CHECK_(read_fd_ == -1); } void Abort(AbortReason reason); virtual bool Passed(bool status_ok); const char* statement() const { return statement_; } const RE* regex() const { return regex_; } bool spawned() const { return spawned_; } void set_spawned(bool is_spawned) { spawned_ = is_spawned; } int status() const { return status_; } void set_status(int a_status) { status_ = a_status; } DeathTestOutcome outcome() const { return outcome_; } void set_outcome(DeathTestOutcome an_outcome) { outcome_ = an_outcome; } int read_fd() const { return read_fd_; } void set_read_fd(int fd) { read_fd_ = fd; } int write_fd() const { return write_fd_; } void set_write_fd(int fd) { write_fd_ = fd; } // Called in the parent process only. Reads the result code of the death // test child process via a pipe, interprets it to set the outcome_ // member, and closes read_fd_. Outputs diagnostics and terminates in // case of unexpected codes. void ReadAndInterpretStatusByte(); private: // The textual content of the code this object is testing. This class // doesn't own this string and should not attempt to delete it. const char* const statement_; // The regular expression which test output must match. DeathTestImpl // doesn't own this object and should not attempt to delete it. const RE* const regex_; // True if the death test child process has been successfully spawned. bool spawned_; // The exit status of the child process. int status_; // How the death test concluded. DeathTestOutcome outcome_; // Descriptor to the read end of the pipe to the child process. It is // always -1 in the child process. The child keeps its write end of the // pipe in write_fd_. int read_fd_; // Descriptor to the child's write end of the pipe to the parent process. // It is always -1 in the parent process. The parent keeps its end of the // pipe in read_fd_. int write_fd_; }; // Called in the parent process only. Reads the result code of the death // test child process via a pipe, interprets it to set the outcome_ // member, and closes read_fd_. Outputs diagnostics and terminates in // case of unexpected codes. void DeathTestImpl::ReadAndInterpretStatusByte() { char flag; int bytes_read; // The read() here blocks until data is available (signifying the // failure of the death test) or until the pipe is closed (signifying // its success), so it's okay to call this in the parent before // the child process has exited. do { bytes_read = posix::Read(read_fd(), &flag, 1); } while (bytes_read == -1 && errno == EINTR); if (bytes_read == 0) { set_outcome(DIED); } else if (bytes_read == 1) { switch (flag) { case kDeathTestReturned: set_outcome(RETURNED); break; case kDeathTestThrew: set_outcome(THREW); break; case kDeathTestLived: set_outcome(LIVED); break; case kDeathTestInternalError: FailFromInternalError(read_fd()); // Does not return. break; default: GTEST_LOG_(FATAL) << "Death test child process reported " << "unexpected status byte (" << static_cast(flag) << ")"; } } else { GTEST_LOG_(FATAL) << "Read from death test child process failed: " << GetLastErrnoDescription(); } GTEST_DEATH_TEST_CHECK_SYSCALL_(posix::Close(read_fd())); set_read_fd(-1); } // Signals that the death test code which should have exited, didn't. // Should be called only in a death test child process. // Writes a status byte to the child's status file descriptor, then // calls _exit(1). void DeathTestImpl::Abort(AbortReason reason) { // The parent process considers the death test to be a failure if // it finds any data in our pipe. So, here we write a single flag byte // to the pipe, then exit. const char status_ch = reason == TEST_DID_NOT_DIE ? kDeathTestLived : reason == TEST_THREW_EXCEPTION ? kDeathTestThrew : kDeathTestReturned; GTEST_DEATH_TEST_CHECK_SYSCALL_(posix::Write(write_fd(), &status_ch, 1)); // We are leaking the descriptor here because on some platforms (i.e., // when built as Windows DLL), destructors of global objects will still // run after calling _exit(). On such systems, write_fd_ will be // indirectly closed from the destructor of UnitTestImpl, causing double // close if it is also closed here. On debug configurations, double close // may assert. As there are no in-process buffers to flush here, we are // relying on the OS to close the descriptor after the process terminates // when the destructors are not run. _exit(1); // Exits w/o any normal exit hooks (we were supposed to crash) } // Returns an indented copy of stderr output for a death test. // This makes distinguishing death test output lines from regular log lines // much easier. static ::std::string FormatDeathTestOutput(const ::std::string& output) { ::std::string ret; for (size_t at = 0; ; ) { const size_t line_end = output.find('\n', at); ret += "[ DEATH ] "; if (line_end == ::std::string::npos) { ret += output.substr(at); break; } ret += output.substr(at, line_end + 1 - at); at = line_end + 1; } return ret; } // Assesses the success or failure of a death test, using both private // members which have previously been set, and one argument: // // Private data members: // outcome: An enumeration describing how the death test // concluded: DIED, LIVED, THREW, or RETURNED. The death test // fails in the latter three cases. // status: The exit status of the child process. On *nix, it is in the // in the format specified by wait(2). On Windows, this is the // value supplied to the ExitProcess() API or a numeric code // of the exception that terminated the program. // regex: A regular expression object to be applied to // the test's captured standard error output; the death test // fails if it does not match. // // Argument: // status_ok: true if exit_status is acceptable in the context of // this particular death test, which fails if it is false // // Returns true iff all of the above conditions are met. Otherwise, the // first failing condition, in the order given above, is the one that is // reported. Also sets the last death test message string. bool DeathTestImpl::Passed(bool status_ok) { if (!spawned()) return false; const String error_message = GetCapturedStderr(); bool success = false; Message buffer; buffer << "Death test: " << statement() << "\n"; switch (outcome()) { case LIVED: buffer << " Result: failed to die.\n" << " Error msg:\n" << FormatDeathTestOutput(error_message); break; case THREW: buffer << " Result: threw an exception.\n" << " Error msg:\n" << FormatDeathTestOutput(error_message); break; case RETURNED: buffer << " Result: illegal return in test statement.\n" << " Error msg:\n" << FormatDeathTestOutput(error_message); break; case DIED: if (status_ok) { const bool matched = RE::PartialMatch(error_message.c_str(), *regex()); if (matched) { success = true; } else { buffer << " Result: died but not with expected error.\n" << " Expected: " << regex()->pattern() << "\n" << "Actual msg:\n" << FormatDeathTestOutput(error_message); } } else { buffer << " Result: died but not with expected exit code:\n" << " " << ExitSummary(status()) << "\n" << "Actual msg:\n" << FormatDeathTestOutput(error_message); } break; case IN_PROGRESS: default: GTEST_LOG_(FATAL) << "DeathTest::Passed somehow called before conclusion of test"; } DeathTest::set_last_death_test_message(buffer.GetString()); return success; } # if GTEST_OS_WINDOWS // WindowsDeathTest implements death tests on Windows. Due to the // specifics of starting new processes on Windows, death tests there are // always threadsafe, and Google Test considers the // --gtest_death_test_style=fast setting to be equivalent to // --gtest_death_test_style=threadsafe there. // // A few implementation notes: Like the Linux version, the Windows // implementation uses pipes for child-to-parent communication. But due to // the specifics of pipes on Windows, some extra steps are required: // // 1. The parent creates a communication pipe and stores handles to both // ends of it. // 2. The parent starts the child and provides it with the information // necessary to acquire the handle to the write end of the pipe. // 3. The child acquires the write end of the pipe and signals the parent // using a Windows event. // 4. Now the parent can release the write end of the pipe on its side. If // this is done before step 3, the object's reference count goes down to // 0 and it is destroyed, preventing the child from acquiring it. The // parent now has to release it, or read operations on the read end of // the pipe will not return when the child terminates. // 5. The parent reads child's output through the pipe (outcome code and // any possible error messages) from the pipe, and its stderr and then // determines whether to fail the test. // // Note: to distinguish Win32 API calls from the local method and function // calls, the former are explicitly resolved in the global namespace. // class WindowsDeathTest : public DeathTestImpl { public: WindowsDeathTest(const char* a_statement, const RE* a_regex, const char* file, int line) : DeathTestImpl(a_statement, a_regex), file_(file), line_(line) {} // All of these virtual functions are inherited from DeathTest. virtual int Wait(); virtual TestRole AssumeRole(); private: // The name of the file in which the death test is located. const char* const file_; // The line number on which the death test is located. const int line_; // Handle to the write end of the pipe to the child process. AutoHandle write_handle_; // Child process handle. AutoHandle child_handle_; // Event the child process uses to signal the parent that it has // acquired the handle to the write end of the pipe. After seeing this // event the parent can release its own handles to make sure its // ReadFile() calls return when the child terminates. AutoHandle event_handle_; }; // Waits for the child in a death test to exit, returning its exit // status, or 0 if no child process exists. As a side effect, sets the // outcome data member. int WindowsDeathTest::Wait() { if (!spawned()) return 0; // Wait until the child either signals that it has acquired the write end // of the pipe or it dies. const HANDLE wait_handles[2] = { child_handle_.Get(), event_handle_.Get() }; switch (::WaitForMultipleObjects(2, wait_handles, FALSE, // Waits for any of the handles. INFINITE)) { case WAIT_OBJECT_0: case WAIT_OBJECT_0 + 1: break; default: GTEST_DEATH_TEST_CHECK_(false); // Should not get here. } // The child has acquired the write end of the pipe or exited. // We release the handle on our side and continue. write_handle_.Reset(); event_handle_.Reset(); ReadAndInterpretStatusByte(); // Waits for the child process to exit if it haven't already. This // returns immediately if the child has already exited, regardless of // whether previous calls to WaitForMultipleObjects synchronized on this // handle or not. GTEST_DEATH_TEST_CHECK_( WAIT_OBJECT_0 == ::WaitForSingleObject(child_handle_.Get(), INFINITE)); DWORD status_code; GTEST_DEATH_TEST_CHECK_( ::GetExitCodeProcess(child_handle_.Get(), &status_code) != FALSE); child_handle_.Reset(); set_status(static_cast(status_code)); return status(); } // The AssumeRole process for a Windows death test. It creates a child // process with the same executable as the current process to run the // death test. The child process is given the --gtest_filter and // --gtest_internal_run_death_test flags such that it knows to run the // current death test only. DeathTest::TestRole WindowsDeathTest::AssumeRole() { const UnitTestImpl* const impl = GetUnitTestImpl(); const InternalRunDeathTestFlag* const flag = impl->internal_run_death_test_flag(); const TestInfo* const info = impl->current_test_info(); const int death_test_index = info->result()->death_test_count(); if (flag != NULL) { // ParseInternalRunDeathTestFlag() has performed all the necessary // processing. set_write_fd(flag->write_fd()); return EXECUTE_TEST; } // WindowsDeathTest uses an anonymous pipe to communicate results of // a death test. SECURITY_ATTRIBUTES handles_are_inheritable = { sizeof(SECURITY_ATTRIBUTES), NULL, TRUE }; HANDLE read_handle, write_handle; GTEST_DEATH_TEST_CHECK_( ::CreatePipe(&read_handle, &write_handle, &handles_are_inheritable, 0) // Default buffer size. != FALSE); set_read_fd(::_open_osfhandle(reinterpret_cast(read_handle), O_RDONLY)); write_handle_.Reset(write_handle); event_handle_.Reset(::CreateEvent( &handles_are_inheritable, TRUE, // The event will automatically reset to non-signaled state. FALSE, // The initial state is non-signalled. NULL)); // The even is unnamed. GTEST_DEATH_TEST_CHECK_(event_handle_.Get() != NULL); const String filter_flag = String::Format("--%s%s=%s.%s", GTEST_FLAG_PREFIX_, kFilterFlag, info->test_case_name(), info->name()); const String internal_flag = String::Format( "--%s%s=%s|%d|%d|%u|%Iu|%Iu", GTEST_FLAG_PREFIX_, kInternalRunDeathTestFlag, file_, line_, death_test_index, static_cast(::GetCurrentProcessId()), // size_t has the same with as pointers on both 32-bit and 64-bit // Windows platforms. // See http://msdn.microsoft.com/en-us/library/tcxf1dw6.aspx. reinterpret_cast(write_handle), reinterpret_cast(event_handle_.Get())); char executable_path[_MAX_PATH + 1]; // NOLINT GTEST_DEATH_TEST_CHECK_( _MAX_PATH + 1 != ::GetModuleFileNameA(NULL, executable_path, _MAX_PATH)); String command_line = String::Format("%s %s \"%s\"", ::GetCommandLineA(), filter_flag.c_str(), internal_flag.c_str()); DeathTest::set_last_death_test_message(""); CaptureStderr(); // Flush the log buffers since the log streams are shared with the child. FlushInfoLog(); // The child process will share the standard handles with the parent. STARTUPINFOA startup_info; memset(&startup_info, 0, sizeof(STARTUPINFO)); startup_info.dwFlags = STARTF_USESTDHANDLES; startup_info.hStdInput = ::GetStdHandle(STD_INPUT_HANDLE); startup_info.hStdOutput = ::GetStdHandle(STD_OUTPUT_HANDLE); startup_info.hStdError = ::GetStdHandle(STD_ERROR_HANDLE); PROCESS_INFORMATION process_info; GTEST_DEATH_TEST_CHECK_(::CreateProcessA( executable_path, const_cast(command_line.c_str()), NULL, // Retuned process handle is not inheritable. NULL, // Retuned thread handle is not inheritable. TRUE, // Child inherits all inheritable handles (for write_handle_). 0x0, // Default creation flags. NULL, // Inherit the parent's environment. UnitTest::GetInstance()->original_working_dir(), &startup_info, &process_info) != FALSE); child_handle_.Reset(process_info.hProcess); ::CloseHandle(process_info.hThread); set_spawned(true); return OVERSEE_TEST; } # else // We are not on Windows. // ForkingDeathTest provides implementations for most of the abstract // methods of the DeathTest interface. Only the AssumeRole method is // left undefined. class ForkingDeathTest : public DeathTestImpl { public: ForkingDeathTest(const char* statement, const RE* regex); // All of these virtual functions are inherited from DeathTest. virtual int Wait(); protected: void set_child_pid(pid_t child_pid) { child_pid_ = child_pid; } private: // PID of child process during death test; 0 in the child process itself. pid_t child_pid_; }; // Constructs a ForkingDeathTest. ForkingDeathTest::ForkingDeathTest(const char* a_statement, const RE* a_regex) : DeathTestImpl(a_statement, a_regex), child_pid_(-1) {} // Waits for the child in a death test to exit, returning its exit // status, or 0 if no child process exists. As a side effect, sets the // outcome data member. int ForkingDeathTest::Wait() { if (!spawned()) return 0; ReadAndInterpretStatusByte(); int status_value; GTEST_DEATH_TEST_CHECK_SYSCALL_(waitpid(child_pid_, &status_value, 0)); set_status(status_value); return status_value; } // A concrete death test class that forks, then immediately runs the test // in the child process. class NoExecDeathTest : public ForkingDeathTest { public: NoExecDeathTest(const char* a_statement, const RE* a_regex) : ForkingDeathTest(a_statement, a_regex) { } virtual TestRole AssumeRole(); }; // The AssumeRole process for a fork-and-run death test. It implements a // straightforward fork, with a simple pipe to transmit the status byte. DeathTest::TestRole NoExecDeathTest::AssumeRole() { const size_t thread_count = GetThreadCount(); if (thread_count != 1) { GTEST_LOG_(WARNING) << DeathTestThreadWarning(thread_count); } int pipe_fd[2]; GTEST_DEATH_TEST_CHECK_(pipe(pipe_fd) != -1); DeathTest::set_last_death_test_message(""); CaptureStderr(); // When we fork the process below, the log file buffers are copied, but the // file descriptors are shared. We flush all log files here so that closing // the file descriptors in the child process doesn't throw off the // synchronization between descriptors and buffers in the parent process. // This is as close to the fork as possible to avoid a race condition in case // there are multiple threads running before the death test, and another // thread writes to the log file. FlushInfoLog(); const pid_t child_pid = fork(); GTEST_DEATH_TEST_CHECK_(child_pid != -1); set_child_pid(child_pid); if (child_pid == 0) { GTEST_DEATH_TEST_CHECK_SYSCALL_(close(pipe_fd[0])); set_write_fd(pipe_fd[1]); // Redirects all logging to stderr in the child process to prevent // concurrent writes to the log files. We capture stderr in the parent // process and append the child process' output to a log. LogToStderr(); // Event forwarding to the listeners of event listener API mush be shut // down in death test subprocesses. GetUnitTestImpl()->listeners()->SuppressEventForwarding(); return EXECUTE_TEST; } else { GTEST_DEATH_TEST_CHECK_SYSCALL_(close(pipe_fd[1])); set_read_fd(pipe_fd[0]); set_spawned(true); return OVERSEE_TEST; } } // A concrete death test class that forks and re-executes the main // program from the beginning, with command-line flags set that cause // only this specific death test to be run. class ExecDeathTest : public ForkingDeathTest { public: ExecDeathTest(const char* a_statement, const RE* a_regex, const char* file, int line) : ForkingDeathTest(a_statement, a_regex), file_(file), line_(line) { } virtual TestRole AssumeRole(); private: // The name of the file in which the death test is located. const char* const file_; // The line number on which the death test is located. const int line_; }; // Utility class for accumulating command-line arguments. class Arguments { public: Arguments() { args_.push_back(NULL); } ~Arguments() { for (std::vector::iterator i = args_.begin(); i != args_.end(); ++i) { free(*i); } } void AddArgument(const char* argument) { args_.insert(args_.end() - 1, posix::StrDup(argument)); } template void AddArguments(const ::std::vector& arguments) { for (typename ::std::vector::const_iterator i = arguments.begin(); i != arguments.end(); ++i) { args_.insert(args_.end() - 1, posix::StrDup(i->c_str())); } } char* const* Argv() { return &args_[0]; } private: std::vector args_; }; // A struct that encompasses the arguments to the child process of a // threadsafe-style death test process. struct ExecDeathTestArgs { char* const* argv; // Command-line arguments for the child's call to exec int close_fd; // File descriptor to close; the read end of a pipe }; # if GTEST_OS_MAC inline char** GetEnviron() { // When Google Test is built as a framework on MacOS X, the environ variable // is unavailable. Apple's documentation (man environ) recommends using // _NSGetEnviron() instead. return *_NSGetEnviron(); } # else // Some POSIX platforms expect you to declare environ. extern "C" makes // it reside in the global namespace. extern "C" char** environ; inline char** GetEnviron() { return environ; } # endif // GTEST_OS_MAC // The main function for a threadsafe-style death test child process. // This function is called in a clone()-ed process and thus must avoid // any potentially unsafe operations like malloc or libc functions. static int ExecDeathTestChildMain(void* child_arg) { ExecDeathTestArgs* const args = static_cast(child_arg); GTEST_DEATH_TEST_CHECK_SYSCALL_(close(args->close_fd)); // We need to execute the test program in the same environment where // it was originally invoked. Therefore we change to the original // working directory first. const char* const original_dir = UnitTest::GetInstance()->original_working_dir(); // We can safely call chdir() as it's a direct system call. if (chdir(original_dir) != 0) { DeathTestAbort(String::Format("chdir(\"%s\") failed: %s", original_dir, GetLastErrnoDescription().c_str())); return EXIT_FAILURE; } // We can safely call execve() as it's a direct system call. We // cannot use execvp() as it's a libc function and thus potentially // unsafe. Since execve() doesn't search the PATH, the user must // invoke the test program via a valid path that contains at least // one path separator. execve(args->argv[0], args->argv, GetEnviron()); DeathTestAbort(String::Format("execve(%s, ...) in %s failed: %s", args->argv[0], original_dir, GetLastErrnoDescription().c_str())); return EXIT_FAILURE; } // Two utility routines that together determine the direction the stack // grows. // This could be accomplished more elegantly by a single recursive // function, but we want to guard against the unlikely possibility of // a smart compiler optimizing the recursion away. // // GTEST_NO_INLINE_ is required to prevent GCC 4.6 from inlining // StackLowerThanAddress into StackGrowsDown, which then doesn't give // correct answer. bool StackLowerThanAddress(const void* ptr) GTEST_NO_INLINE_; bool StackLowerThanAddress(const void* ptr) { int dummy; return &dummy < ptr; } bool StackGrowsDown() { int dummy; return StackLowerThanAddress(&dummy); } // A threadsafe implementation of fork(2) for threadsafe-style death tests // that uses clone(2). It dies with an error message if anything goes // wrong. static pid_t ExecDeathTestFork(char* const* argv, int close_fd) { ExecDeathTestArgs args = { argv, close_fd }; pid_t child_pid = -1; # if GTEST_HAS_CLONE const bool use_fork = GTEST_FLAG(death_test_use_fork); if (!use_fork) { static const bool stack_grows_down = StackGrowsDown(); const size_t stack_size = getpagesize(); // MMAP_ANONYMOUS is not defined on Mac, so we use MAP_ANON instead. void* const stack = mmap(NULL, stack_size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); GTEST_DEATH_TEST_CHECK_(stack != MAP_FAILED); void* const stack_top = static_cast(stack) + (stack_grows_down ? stack_size : 0); child_pid = clone(&ExecDeathTestChildMain, stack_top, SIGCHLD, &args); GTEST_DEATH_TEST_CHECK_(munmap(stack, stack_size) != -1); } # else const bool use_fork = true; # endif // GTEST_HAS_CLONE if (use_fork && (child_pid = fork()) == 0) { ExecDeathTestChildMain(&args); _exit(0); } GTEST_DEATH_TEST_CHECK_(child_pid != -1); return child_pid; } // The AssumeRole process for a fork-and-exec death test. It re-executes the // main program from the beginning, setting the --gtest_filter // and --gtest_internal_run_death_test flags to cause only the current // death test to be re-run. DeathTest::TestRole ExecDeathTest::AssumeRole() { const UnitTestImpl* const impl = GetUnitTestImpl(); const InternalRunDeathTestFlag* const flag = impl->internal_run_death_test_flag(); const TestInfo* const info = impl->current_test_info(); const int death_test_index = info->result()->death_test_count(); if (flag != NULL) { set_write_fd(flag->write_fd()); return EXECUTE_TEST; } int pipe_fd[2]; GTEST_DEATH_TEST_CHECK_(pipe(pipe_fd) != -1); // Clear the close-on-exec flag on the write end of the pipe, lest // it be closed when the child process does an exec: GTEST_DEATH_TEST_CHECK_(fcntl(pipe_fd[1], F_SETFD, 0) != -1); const String filter_flag = String::Format("--%s%s=%s.%s", GTEST_FLAG_PREFIX_, kFilterFlag, info->test_case_name(), info->name()); const String internal_flag = String::Format("--%s%s=%s|%d|%d|%d", GTEST_FLAG_PREFIX_, kInternalRunDeathTestFlag, file_, line_, death_test_index, pipe_fd[1]); Arguments args; args.AddArguments(GetArgvs()); args.AddArgument(filter_flag.c_str()); args.AddArgument(internal_flag.c_str()); DeathTest::set_last_death_test_message(""); CaptureStderr(); // See the comment in NoExecDeathTest::AssumeRole for why the next line // is necessary. FlushInfoLog(); const pid_t child_pid = ExecDeathTestFork(args.Argv(), pipe_fd[0]); GTEST_DEATH_TEST_CHECK_SYSCALL_(close(pipe_fd[1])); set_child_pid(child_pid); set_read_fd(pipe_fd[0]); set_spawned(true); return OVERSEE_TEST; } # endif // !GTEST_OS_WINDOWS // Creates a concrete DeathTest-derived class that depends on the // --gtest_death_test_style flag, and sets the pointer pointed to // by the "test" argument to its address. If the test should be // skipped, sets that pointer to NULL. Returns true, unless the // flag is set to an invalid value. bool DefaultDeathTestFactory::Create(const char* statement, const RE* regex, const char* file, int line, DeathTest** test) { UnitTestImpl* const impl = GetUnitTestImpl(); const InternalRunDeathTestFlag* const flag = impl->internal_run_death_test_flag(); const int death_test_index = impl->current_test_info() ->increment_death_test_count(); if (flag != NULL) { if (death_test_index > flag->index()) { DeathTest::set_last_death_test_message(String::Format( "Death test count (%d) somehow exceeded expected maximum (%d)", death_test_index, flag->index())); return false; } if (!(flag->file() == file && flag->line() == line && flag->index() == death_test_index)) { *test = NULL; return true; } } # if GTEST_OS_WINDOWS if (GTEST_FLAG(death_test_style) == "threadsafe" || GTEST_FLAG(death_test_style) == "fast") { *test = new WindowsDeathTest(statement, regex, file, line); } # else if (GTEST_FLAG(death_test_style) == "threadsafe") { *test = new ExecDeathTest(statement, regex, file, line); } else if (GTEST_FLAG(death_test_style) == "fast") { *test = new NoExecDeathTest(statement, regex); } # endif // GTEST_OS_WINDOWS else { // NOLINT - this is more readable than unbalanced brackets inside #if. DeathTest::set_last_death_test_message(String::Format( "Unknown death test style \"%s\" encountered", GTEST_FLAG(death_test_style).c_str())); return false; } return true; } // Splits a given string on a given delimiter, populating a given // vector with the fields. GTEST_HAS_DEATH_TEST implies that we have // ::std::string, so we can use it here. static void SplitString(const ::std::string& str, char delimiter, ::std::vector< ::std::string>* dest) { ::std::vector< ::std::string> parsed; ::std::string::size_type pos = 0; while (::testing::internal::AlwaysTrue()) { const ::std::string::size_type colon = str.find(delimiter, pos); if (colon == ::std::string::npos) { parsed.push_back(str.substr(pos)); break; } else { parsed.push_back(str.substr(pos, colon - pos)); pos = colon + 1; } } dest->swap(parsed); } # if GTEST_OS_WINDOWS // Recreates the pipe and event handles from the provided parameters, // signals the event, and returns a file descriptor wrapped around the pipe // handle. This function is called in the child process only. int GetStatusFileDescriptor(unsigned int parent_process_id, size_t write_handle_as_size_t, size_t event_handle_as_size_t) { AutoHandle parent_process_handle(::OpenProcess(PROCESS_DUP_HANDLE, FALSE, // Non-inheritable. parent_process_id)); if (parent_process_handle.Get() == INVALID_HANDLE_VALUE) { DeathTestAbort(String::Format("Unable to open parent process %u", parent_process_id)); } // TODO(vladl@google.com): Replace the following check with a // compile-time assertion when available. GTEST_CHECK_(sizeof(HANDLE) <= sizeof(size_t)); const HANDLE write_handle = reinterpret_cast(write_handle_as_size_t); HANDLE dup_write_handle; // The newly initialized handle is accessible only in in the parent // process. To obtain one accessible within the child, we need to use // DuplicateHandle. if (!::DuplicateHandle(parent_process_handle.Get(), write_handle, ::GetCurrentProcess(), &dup_write_handle, 0x0, // Requested privileges ignored since // DUPLICATE_SAME_ACCESS is used. FALSE, // Request non-inheritable handler. DUPLICATE_SAME_ACCESS)) { DeathTestAbort(String::Format( "Unable to duplicate the pipe handle %Iu from the parent process %u", write_handle_as_size_t, parent_process_id)); } const HANDLE event_handle = reinterpret_cast(event_handle_as_size_t); HANDLE dup_event_handle; if (!::DuplicateHandle(parent_process_handle.Get(), event_handle, ::GetCurrentProcess(), &dup_event_handle, 0x0, FALSE, DUPLICATE_SAME_ACCESS)) { DeathTestAbort(String::Format( "Unable to duplicate the event handle %Iu from the parent process %u", event_handle_as_size_t, parent_process_id)); } const int write_fd = ::_open_osfhandle(reinterpret_cast(dup_write_handle), O_APPEND); if (write_fd == -1) { DeathTestAbort(String::Format( "Unable to convert pipe handle %Iu to a file descriptor", write_handle_as_size_t)); } // Signals the parent that the write end of the pipe has been acquired // so the parent can release its own write end. ::SetEvent(dup_event_handle); return write_fd; } # endif // GTEST_OS_WINDOWS // Returns a newly created InternalRunDeathTestFlag object with fields // initialized from the GTEST_FLAG(internal_run_death_test) flag if // the flag is specified; otherwise returns NULL. InternalRunDeathTestFlag* ParseInternalRunDeathTestFlag() { if (GTEST_FLAG(internal_run_death_test) == "") return NULL; // GTEST_HAS_DEATH_TEST implies that we have ::std::string, so we // can use it here. int line = -1; int index = -1; ::std::vector< ::std::string> fields; SplitString(GTEST_FLAG(internal_run_death_test).c_str(), '|', &fields); int write_fd = -1; # if GTEST_OS_WINDOWS unsigned int parent_process_id = 0; size_t write_handle_as_size_t = 0; size_t event_handle_as_size_t = 0; if (fields.size() != 6 || !ParseNaturalNumber(fields[1], &line) || !ParseNaturalNumber(fields[2], &index) || !ParseNaturalNumber(fields[3], &parent_process_id) || !ParseNaturalNumber(fields[4], &write_handle_as_size_t) || !ParseNaturalNumber(fields[5], &event_handle_as_size_t)) { DeathTestAbort(String::Format( "Bad --gtest_internal_run_death_test flag: %s", GTEST_FLAG(internal_run_death_test).c_str())); } write_fd = GetStatusFileDescriptor(parent_process_id, write_handle_as_size_t, event_handle_as_size_t); # else if (fields.size() != 4 || !ParseNaturalNumber(fields[1], &line) || !ParseNaturalNumber(fields[2], &index) || !ParseNaturalNumber(fields[3], &write_fd)) { DeathTestAbort(String::Format( "Bad --gtest_internal_run_death_test flag: %s", GTEST_FLAG(internal_run_death_test).c_str())); } # endif // GTEST_OS_WINDOWS return new InternalRunDeathTestFlag(fields[0], line, index, write_fd); } } // namespace internal #endif // GTEST_HAS_DEATH_TEST } // namespace testing // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: keith.ray@gmail.com (Keith Ray) #include #if GTEST_OS_WINDOWS_MOBILE # include #elif GTEST_OS_WINDOWS # include # include #elif GTEST_OS_SYMBIAN || GTEST_OS_NACL // Symbian OpenC and NaCl have PATH_MAX in sys/syslimits.h # include #else # include # include // Some Linux distributions define PATH_MAX here. #endif // GTEST_OS_WINDOWS_MOBILE #if GTEST_OS_WINDOWS # define GTEST_PATH_MAX_ _MAX_PATH #elif defined(PATH_MAX) # define GTEST_PATH_MAX_ PATH_MAX #elif defined(_XOPEN_PATH_MAX) # define GTEST_PATH_MAX_ _XOPEN_PATH_MAX #else # define GTEST_PATH_MAX_ _POSIX_PATH_MAX #endif // GTEST_OS_WINDOWS namespace testing { namespace internal { #if GTEST_OS_WINDOWS // On Windows, '\\' is the standard path separator, but many tools and the // Windows API also accept '/' as an alternate path separator. Unless otherwise // noted, a file path can contain either kind of path separators, or a mixture // of them. const char kPathSeparator = '\\'; const char kAlternatePathSeparator = '/'; const char kPathSeparatorString[] = "\\"; const char kAlternatePathSeparatorString[] = "/"; # if GTEST_OS_WINDOWS_MOBILE // Windows CE doesn't have a current directory. You should not use // the current directory in tests on Windows CE, but this at least // provides a reasonable fallback. const char kCurrentDirectoryString[] = "\\"; // Windows CE doesn't define INVALID_FILE_ATTRIBUTES const DWORD kInvalidFileAttributes = 0xffffffff; # else const char kCurrentDirectoryString[] = ".\\"; # endif // GTEST_OS_WINDOWS_MOBILE #else const char kPathSeparator = '/'; const char kPathSeparatorString[] = "/"; const char kCurrentDirectoryString[] = "./"; #endif // GTEST_OS_WINDOWS // Returns whether the given character is a valid path separator. static bool IsPathSeparator(char c) { #if GTEST_HAS_ALT_PATH_SEP_ return (c == kPathSeparator) || (c == kAlternatePathSeparator); #else return c == kPathSeparator; #endif } // Returns the current working directory, or "" if unsuccessful. FilePath FilePath::GetCurrentDir() { #if GTEST_OS_WINDOWS_MOBILE // Windows CE doesn't have a current directory, so we just return // something reasonable. return FilePath(kCurrentDirectoryString); #elif GTEST_OS_WINDOWS char cwd[GTEST_PATH_MAX_ + 1] = { '\0' }; return FilePath(_getcwd(cwd, sizeof(cwd)) == NULL ? "" : cwd); #else char cwd[GTEST_PATH_MAX_ + 1] = { '\0' }; return FilePath(getcwd(cwd, sizeof(cwd)) == NULL ? "" : cwd); #endif // GTEST_OS_WINDOWS_MOBILE } // Returns a copy of the FilePath with the case-insensitive extension removed. // Example: FilePath("dir/file.exe").RemoveExtension("EXE") returns // FilePath("dir/file"). If a case-insensitive extension is not // found, returns a copy of the original FilePath. FilePath FilePath::RemoveExtension(const char* extension) const { String dot_extension(String::Format(".%s", extension)); if (pathname_.EndsWithCaseInsensitive(dot_extension.c_str())) { return FilePath(String(pathname_.c_str(), pathname_.length() - 4)); } return *this; } // Returns a pointer to the last occurence of a valid path separator in // the FilePath. On Windows, for example, both '/' and '\' are valid path // separators. Returns NULL if no path separator was found. const char* FilePath::FindLastPathSeparator() const { const char* const last_sep = strrchr(c_str(), kPathSeparator); #if GTEST_HAS_ALT_PATH_SEP_ const char* const last_alt_sep = strrchr(c_str(), kAlternatePathSeparator); // Comparing two pointers of which only one is NULL is undefined. if (last_alt_sep != NULL && (last_sep == NULL || last_alt_sep > last_sep)) { return last_alt_sep; } #endif return last_sep; } // Returns a copy of the FilePath with the directory part removed. // Example: FilePath("path/to/file").RemoveDirectoryName() returns // FilePath("file"). If there is no directory part ("just_a_file"), it returns // the FilePath unmodified. If there is no file part ("just_a_dir/") it // returns an empty FilePath (""). // On Windows platform, '\' is the path separator, otherwise it is '/'. FilePath FilePath::RemoveDirectoryName() const { const char* const last_sep = FindLastPathSeparator(); return last_sep ? FilePath(String(last_sep + 1)) : *this; } // RemoveFileName returns the directory path with the filename removed. // Example: FilePath("path/to/file").RemoveFileName() returns "path/to/". // If the FilePath is "a_file" or "/a_file", RemoveFileName returns // FilePath("./") or, on Windows, FilePath(".\\"). If the filepath does // not have a file, like "just/a/dir/", it returns the FilePath unmodified. // On Windows platform, '\' is the path separator, otherwise it is '/'. FilePath FilePath::RemoveFileName() const { const char* const last_sep = FindLastPathSeparator(); String dir; if (last_sep) { dir = String(c_str(), last_sep + 1 - c_str()); } else { dir = kCurrentDirectoryString; } return FilePath(dir); } // Helper functions for naming files in a directory for xml output. // Given directory = "dir", base_name = "test", number = 0, // extension = "xml", returns "dir/test.xml". If number is greater // than zero (e.g., 12), returns "dir/test_12.xml". // On Windows platform, uses \ as the separator rather than /. FilePath FilePath::MakeFileName(const FilePath& directory, const FilePath& base_name, int number, const char* extension) { String file; if (number == 0) { file = String::Format("%s.%s", base_name.c_str(), extension); } else { file = String::Format("%s_%d.%s", base_name.c_str(), number, extension); } return ConcatPaths(directory, FilePath(file)); } // Given directory = "dir", relative_path = "test.xml", returns "dir/test.xml". // On Windows, uses \ as the separator rather than /. FilePath FilePath::ConcatPaths(const FilePath& directory, const FilePath& relative_path) { if (directory.IsEmpty()) return relative_path; const FilePath dir(directory.RemoveTrailingPathSeparator()); return FilePath(String::Format("%s%c%s", dir.c_str(), kPathSeparator, relative_path.c_str())); } // Returns true if pathname describes something findable in the file-system, // either a file, directory, or whatever. bool FilePath::FileOrDirectoryExists() const { #if GTEST_OS_WINDOWS_MOBILE LPCWSTR unicode = String::AnsiToUtf16(pathname_.c_str()); const DWORD attributes = GetFileAttributes(unicode); delete [] unicode; return attributes != kInvalidFileAttributes; #else posix::StatStruct file_stat; return posix::Stat(pathname_.c_str(), &file_stat) == 0; #endif // GTEST_OS_WINDOWS_MOBILE } // Returns true if pathname describes a directory in the file-system // that exists. bool FilePath::DirectoryExists() const { bool result = false; #if GTEST_OS_WINDOWS // Don't strip off trailing separator if path is a root directory on // Windows (like "C:\\"). const FilePath& path(IsRootDirectory() ? *this : RemoveTrailingPathSeparator()); #else const FilePath& path(*this); #endif #if GTEST_OS_WINDOWS_MOBILE LPCWSTR unicode = String::AnsiToUtf16(path.c_str()); const DWORD attributes = GetFileAttributes(unicode); delete [] unicode; if ((attributes != kInvalidFileAttributes) && (attributes & FILE_ATTRIBUTE_DIRECTORY)) { result = true; } #else posix::StatStruct file_stat; result = posix::Stat(path.c_str(), &file_stat) == 0 && posix::IsDir(file_stat); #endif // GTEST_OS_WINDOWS_MOBILE return result; } // Returns true if pathname describes a root directory. (Windows has one // root directory per disk drive.) bool FilePath::IsRootDirectory() const { #if GTEST_OS_WINDOWS // TODO(wan@google.com): on Windows a network share like // \\server\share can be a root directory, although it cannot be the // current directory. Handle this properly. return pathname_.length() == 3 && IsAbsolutePath(); #else return pathname_.length() == 1 && IsPathSeparator(pathname_.c_str()[0]); #endif } // Returns true if pathname describes an absolute path. bool FilePath::IsAbsolutePath() const { const char* const name = pathname_.c_str(); #if GTEST_OS_WINDOWS return pathname_.length() >= 3 && ((name[0] >= 'a' && name[0] <= 'z') || (name[0] >= 'A' && name[0] <= 'Z')) && name[1] == ':' && IsPathSeparator(name[2]); #else return IsPathSeparator(name[0]); #endif } // Returns a pathname for a file that does not currently exist. The pathname // will be directory/base_name.extension or // directory/base_name_.extension if directory/base_name.extension // already exists. The number will be incremented until a pathname is found // that does not already exist. // Examples: 'dir/foo_test.xml' or 'dir/foo_test_1.xml'. // There could be a race condition if two or more processes are calling this // function at the same time -- they could both pick the same filename. FilePath FilePath::GenerateUniqueFileName(const FilePath& directory, const FilePath& base_name, const char* extension) { FilePath full_pathname; int number = 0; do { full_pathname.Set(MakeFileName(directory, base_name, number++, extension)); } while (full_pathname.FileOrDirectoryExists()); return full_pathname; } // Returns true if FilePath ends with a path separator, which indicates that // it is intended to represent a directory. Returns false otherwise. // This does NOT check that a directory (or file) actually exists. bool FilePath::IsDirectory() const { return !pathname_.empty() && IsPathSeparator(pathname_.c_str()[pathname_.length() - 1]); } // Create directories so that path exists. Returns true if successful or if // the directories already exist; returns false if unable to create directories // for any reason. bool FilePath::CreateDirectoriesRecursively() const { if (!this->IsDirectory()) { return false; } if (pathname_.length() == 0 || this->DirectoryExists()) { return true; } const FilePath parent(this->RemoveTrailingPathSeparator().RemoveFileName()); return parent.CreateDirectoriesRecursively() && this->CreateFolder(); } // Create the directory so that path exists. Returns true if successful or // if the directory already exists; returns false if unable to create the // directory for any reason, including if the parent directory does not // exist. Not named "CreateDirectory" because that's a macro on Windows. bool FilePath::CreateFolder() const { #if GTEST_OS_WINDOWS_MOBILE FilePath removed_sep(this->RemoveTrailingPathSeparator()); LPCWSTR unicode = String::AnsiToUtf16(removed_sep.c_str()); int result = CreateDirectory(unicode, NULL) ? 0 : -1; delete [] unicode; #elif GTEST_OS_WINDOWS int result = _mkdir(pathname_.c_str()); #else int result = mkdir(pathname_.c_str(), 0777); #endif // GTEST_OS_WINDOWS_MOBILE if (result == -1) { return this->DirectoryExists(); // An error is OK if the directory exists. } return true; // No error. } // If input name has a trailing separator character, remove it and return the // name, otherwise return the name string unmodified. // On Windows platform, uses \ as the separator, other platforms use /. FilePath FilePath::RemoveTrailingPathSeparator() const { return IsDirectory() ? FilePath(String(pathname_.c_str(), pathname_.length() - 1)) : *this; } // Removes any redundant separators that might be in the pathname. // For example, "bar///foo" becomes "bar/foo". Does not eliminate other // redundancies that might be in a pathname involving "." or "..". // TODO(wan@google.com): handle Windows network shares (e.g. \\server\share). void FilePath::Normalize() { if (pathname_.c_str() == NULL) { pathname_ = ""; return; } const char* src = pathname_.c_str(); char* const dest = new char[pathname_.length() + 1]; char* dest_ptr = dest; memset(dest_ptr, 0, pathname_.length() + 1); while (*src != '\0') { *dest_ptr = *src; if (!IsPathSeparator(*src)) { src++; } else { #if GTEST_HAS_ALT_PATH_SEP_ if (*dest_ptr == kAlternatePathSeparator) { *dest_ptr = kPathSeparator; } #endif while (IsPathSeparator(*src)) src++; } dest_ptr++; } *dest_ptr = '\0'; pathname_ = dest; delete[] dest; } } // namespace internal } // namespace testing // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) #include #include #include #include #if GTEST_OS_WINDOWS_MOBILE # include // For TerminateProcess() #elif GTEST_OS_WINDOWS # include # include #else # include #endif // GTEST_OS_WINDOWS_MOBILE #if GTEST_OS_MAC # include # include # include #endif // GTEST_OS_MAC // Indicates that this translation unit is part of Google Test's // implementation. It must come before gtest-internal-inl.h is // included, or there will be a compiler error. This trick is to // prevent a user from accidentally including gtest-internal-inl.h in // his code. #define GTEST_IMPLEMENTATION_ 1 #undef GTEST_IMPLEMENTATION_ namespace testing { namespace internal { #if defined(_MSC_VER) || defined(__BORLANDC__) // MSVC and C++Builder do not provide a definition of STDERR_FILENO. const int kStdOutFileno = 1; const int kStdErrFileno = 2; #else const int kStdOutFileno = STDOUT_FILENO; const int kStdErrFileno = STDERR_FILENO; #endif // _MSC_VER #if GTEST_OS_MAC // Returns the number of threads running in the process, or 0 to indicate that // we cannot detect it. size_t GetThreadCount() { const task_t task = mach_task_self(); mach_msg_type_number_t thread_count; thread_act_array_t thread_list; const kern_return_t status = task_threads(task, &thread_list, &thread_count); if (status == KERN_SUCCESS) { // task_threads allocates resources in thread_list and we need to free them // to avoid leaks. vm_deallocate(task, reinterpret_cast(thread_list), sizeof(thread_t) * thread_count); return static_cast(thread_count); } else { return 0; } } #else size_t GetThreadCount() { // There's no portable way to detect the number of threads, so we just // return 0 to indicate that we cannot detect it. return 0; } #endif // GTEST_OS_MAC #if GTEST_USES_POSIX_RE // Implements RE. Currently only needed for death tests. RE::~RE() { if (is_valid_) { // regfree'ing an invalid regex might crash because the content // of the regex is undefined. Since the regex's are essentially // the same, one cannot be valid (or invalid) without the other // being so too. regfree(&partial_regex_); regfree(&full_regex_); } free(const_cast(pattern_)); } // Returns true iff regular expression re matches the entire str. bool RE::FullMatch(const char* str, const RE& re) { if (!re.is_valid_) return false; regmatch_t match; return regexec(&re.full_regex_, str, 1, &match, 0) == 0; } // Returns true iff regular expression re matches a substring of str // (including str itself). bool RE::PartialMatch(const char* str, const RE& re) { if (!re.is_valid_) return false; regmatch_t match; return regexec(&re.partial_regex_, str, 1, &match, 0) == 0; } // Initializes an RE from its string representation. void RE::Init(const char* regex) { pattern_ = posix::StrDup(regex); // Reserves enough bytes to hold the regular expression used for a // full match. const size_t full_regex_len = strlen(regex) + 10; char* const full_pattern = new char[full_regex_len]; snprintf(full_pattern, full_regex_len, "^(%s)$", regex); is_valid_ = regcomp(&full_regex_, full_pattern, REG_EXTENDED) == 0; // We want to call regcomp(&partial_regex_, ...) even if the // previous expression returns false. Otherwise partial_regex_ may // not be properly initialized can may cause trouble when it's // freed. // // Some implementation of POSIX regex (e.g. on at least some // versions of Cygwin) doesn't accept the empty string as a valid // regex. We change it to an equivalent form "()" to be safe. if (is_valid_) { const char* const partial_regex = (*regex == '\0') ? "()" : regex; is_valid_ = regcomp(&partial_regex_, partial_regex, REG_EXTENDED) == 0; } EXPECT_TRUE(is_valid_) << "Regular expression \"" << regex << "\" is not a valid POSIX Extended regular expression."; delete[] full_pattern; } #elif GTEST_USES_SIMPLE_RE // Returns true iff ch appears anywhere in str (excluding the // terminating '\0' character). bool IsInSet(char ch, const char* str) { return ch != '\0' && strchr(str, ch) != NULL; } // Returns true iff ch belongs to the given classification. Unlike // similar functions in , these aren't affected by the // current locale. bool IsAsciiDigit(char ch) { return '0' <= ch && ch <= '9'; } bool IsAsciiPunct(char ch) { return IsInSet(ch, "^-!\"#$%&'()*+,./:;<=>?@[\\]_`{|}~"); } bool IsRepeat(char ch) { return IsInSet(ch, "?*+"); } bool IsAsciiWhiteSpace(char ch) { return IsInSet(ch, " \f\n\r\t\v"); } bool IsAsciiWordChar(char ch) { return ('a' <= ch && ch <= 'z') || ('A' <= ch && ch <= 'Z') || ('0' <= ch && ch <= '9') || ch == '_'; } // Returns true iff "\\c" is a supported escape sequence. bool IsValidEscape(char c) { return (IsAsciiPunct(c) || IsInSet(c, "dDfnrsStvwW")); } // Returns true iff the given atom (specified by escaped and pattern) // matches ch. The result is undefined if the atom is invalid. bool AtomMatchesChar(bool escaped, char pattern_char, char ch) { if (escaped) { // "\\p" where p is pattern_char. switch (pattern_char) { case 'd': return IsAsciiDigit(ch); case 'D': return !IsAsciiDigit(ch); case 'f': return ch == '\f'; case 'n': return ch == '\n'; case 'r': return ch == '\r'; case 's': return IsAsciiWhiteSpace(ch); case 'S': return !IsAsciiWhiteSpace(ch); case 't': return ch == '\t'; case 'v': return ch == '\v'; case 'w': return IsAsciiWordChar(ch); case 'W': return !IsAsciiWordChar(ch); } return IsAsciiPunct(pattern_char) && pattern_char == ch; } return (pattern_char == '.' && ch != '\n') || pattern_char == ch; } // Helper function used by ValidateRegex() to format error messages. String FormatRegexSyntaxError(const char* regex, int index) { return (Message() << "Syntax error at index " << index << " in simple regular expression \"" << regex << "\": ").GetString(); } // Generates non-fatal failures and returns false if regex is invalid; // otherwise returns true. bool ValidateRegex(const char* regex) { if (regex == NULL) { // TODO(wan@google.com): fix the source file location in the // assertion failures to match where the regex is used in user // code. ADD_FAILURE() << "NULL is not a valid simple regular expression."; return false; } bool is_valid = true; // True iff ?, *, or + can follow the previous atom. bool prev_repeatable = false; for (int i = 0; regex[i]; i++) { if (regex[i] == '\\') { // An escape sequence i++; if (regex[i] == '\0') { ADD_FAILURE() << FormatRegexSyntaxError(regex, i - 1) << "'\\' cannot appear at the end."; return false; } if (!IsValidEscape(regex[i])) { ADD_FAILURE() << FormatRegexSyntaxError(regex, i - 1) << "invalid escape sequence \"\\" << regex[i] << "\"."; is_valid = false; } prev_repeatable = true; } else { // Not an escape sequence. const char ch = regex[i]; if (ch == '^' && i > 0) { ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'^' can only appear at the beginning."; is_valid = false; } else if (ch == '$' && regex[i + 1] != '\0') { ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'$' can only appear at the end."; is_valid = false; } else if (IsInSet(ch, "()[]{}|")) { ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'" << ch << "' is unsupported."; is_valid = false; } else if (IsRepeat(ch) && !prev_repeatable) { ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'" << ch << "' can only follow a repeatable token."; is_valid = false; } prev_repeatable = !IsInSet(ch, "^$?*+"); } } return is_valid; } // Matches a repeated regex atom followed by a valid simple regular // expression. The regex atom is defined as c if escaped is false, // or \c otherwise. repeat is the repetition meta character (?, *, // or +). The behavior is undefined if str contains too many // characters to be indexable by size_t, in which case the test will // probably time out anyway. We are fine with this limitation as // std::string has it too. bool MatchRepetitionAndRegexAtHead( bool escaped, char c, char repeat, const char* regex, const char* str) { const size_t min_count = (repeat == '+') ? 1 : 0; const size_t max_count = (repeat == '?') ? 1 : static_cast(-1) - 1; // We cannot call numeric_limits::max() as it conflicts with the // max() macro on Windows. for (size_t i = 0; i <= max_count; ++i) { // We know that the atom matches each of the first i characters in str. if (i >= min_count && MatchRegexAtHead(regex, str + i)) { // We have enough matches at the head, and the tail matches too. // Since we only care about *whether* the pattern matches str // (as opposed to *how* it matches), there is no need to find a // greedy match. return true; } if (str[i] == '\0' || !AtomMatchesChar(escaped, c, str[i])) return false; } return false; } // Returns true iff regex matches a prefix of str. regex must be a // valid simple regular expression and not start with "^", or the // result is undefined. bool MatchRegexAtHead(const char* regex, const char* str) { if (*regex == '\0') // An empty regex matches a prefix of anything. return true; // "$" only matches the end of a string. Note that regex being // valid guarantees that there's nothing after "$" in it. if (*regex == '$') return *str == '\0'; // Is the first thing in regex an escape sequence? const bool escaped = *regex == '\\'; if (escaped) ++regex; if (IsRepeat(regex[1])) { // MatchRepetitionAndRegexAtHead() calls MatchRegexAtHead(), so // here's an indirect recursion. It terminates as the regex gets // shorter in each recursion. return MatchRepetitionAndRegexAtHead( escaped, regex[0], regex[1], regex + 2, str); } else { // regex isn't empty, isn't "$", and doesn't start with a // repetition. We match the first atom of regex with the first // character of str and recurse. return (*str != '\0') && AtomMatchesChar(escaped, *regex, *str) && MatchRegexAtHead(regex + 1, str + 1); } } // Returns true iff regex matches any substring of str. regex must be // a valid simple regular expression, or the result is undefined. // // The algorithm is recursive, but the recursion depth doesn't exceed // the regex length, so we won't need to worry about running out of // stack space normally. In rare cases the time complexity can be // exponential with respect to the regex length + the string length, // but usually it's must faster (often close to linear). bool MatchRegexAnywhere(const char* regex, const char* str) { if (regex == NULL || str == NULL) return false; if (*regex == '^') return MatchRegexAtHead(regex + 1, str); // A successful match can be anywhere in str. do { if (MatchRegexAtHead(regex, str)) return true; } while (*str++ != '\0'); return false; } // Implements the RE class. RE::~RE() { free(const_cast(pattern_)); free(const_cast(full_pattern_)); } // Returns true iff regular expression re matches the entire str. bool RE::FullMatch(const char* str, const RE& re) { return re.is_valid_ && MatchRegexAnywhere(re.full_pattern_, str); } // Returns true iff regular expression re matches a substring of str // (including str itself). bool RE::PartialMatch(const char* str, const RE& re) { return re.is_valid_ && MatchRegexAnywhere(re.pattern_, str); } // Initializes an RE from its string representation. void RE::Init(const char* regex) { pattern_ = full_pattern_ = NULL; if (regex != NULL) { pattern_ = posix::StrDup(regex); } is_valid_ = ValidateRegex(regex); if (!is_valid_) { // No need to calculate the full pattern when the regex is invalid. return; } const size_t len = strlen(regex); // Reserves enough bytes to hold the regular expression used for a // full match: we need space to prepend a '^', append a '$', and // terminate the string with '\0'. char* buffer = static_cast(malloc(len + 3)); full_pattern_ = buffer; if (*regex != '^') *buffer++ = '^'; // Makes sure full_pattern_ starts with '^'. // We don't use snprintf or strncpy, as they trigger a warning when // compiled with VC++ 8.0. memcpy(buffer, regex, len); buffer += len; if (len == 0 || regex[len - 1] != '$') *buffer++ = '$'; // Makes sure full_pattern_ ends with '$'. *buffer = '\0'; } #endif // GTEST_USES_POSIX_RE const char kUnknownFile[] = "unknown file"; // Formats a source file path and a line number as they would appear // in an error message from the compiler used to compile this code. GTEST_API_ ::std::string FormatFileLocation(const char* file, int line) { const char* const file_name = file == NULL ? kUnknownFile : file; if (line < 0) { return String::Format("%s:", file_name).c_str(); } #ifdef _MSC_VER return String::Format("%s(%d):", file_name, line).c_str(); #else return String::Format("%s:%d:", file_name, line).c_str(); #endif // _MSC_VER } // Formats a file location for compiler-independent XML output. // Although this function is not platform dependent, we put it next to // FormatFileLocation in order to contrast the two functions. // Note that FormatCompilerIndependentFileLocation() does NOT append colon // to the file location it produces, unlike FormatFileLocation(). GTEST_API_ ::std::string FormatCompilerIndependentFileLocation( const char* file, int line) { const char* const file_name = file == NULL ? kUnknownFile : file; if (line < 0) return file_name; else return String::Format("%s:%d", file_name, line).c_str(); } GTestLog::GTestLog(GTestLogSeverity severity, const char* file, int line) : severity_(severity) { const char* const marker = severity == GTEST_INFO ? "[ INFO ]" : severity == GTEST_WARNING ? "[WARNING]" : severity == GTEST_ERROR ? "[ ERROR ]" : "[ FATAL ]"; GetStream() << ::std::endl << marker << " " << FormatFileLocation(file, line).c_str() << ": "; } // Flushes the buffers and, if severity is GTEST_FATAL, aborts the program. GTestLog::~GTestLog() { GetStream() << ::std::endl; if (severity_ == GTEST_FATAL) { fflush(stderr); posix::Abort(); } } // Disable Microsoft deprecation warnings for POSIX functions called from // this class (creat, dup, dup2, and close) #ifdef _MSC_VER # pragma warning(push) # pragma warning(disable: 4996) #endif // _MSC_VER #if GTEST_HAS_STREAM_REDIRECTION // Object that captures an output stream (stdout/stderr). class CapturedStream { public: // The ctor redirects the stream to a temporary file. CapturedStream(int fd) : fd_(fd), uncaptured_fd_(dup(fd)) { # if GTEST_OS_WINDOWS char temp_dir_path[MAX_PATH + 1] = { '\0' }; // NOLINT char temp_file_path[MAX_PATH + 1] = { '\0' }; // NOLINT ::GetTempPathA(sizeof(temp_dir_path), temp_dir_path); const UINT success = ::GetTempFileNameA(temp_dir_path, "gtest_redir", 0, // Generate unique file name. temp_file_path); GTEST_CHECK_(success != 0) << "Unable to create a temporary file in " << temp_dir_path; const int captured_fd = creat(temp_file_path, _S_IREAD | _S_IWRITE); GTEST_CHECK_(captured_fd != -1) << "Unable to open temporary file " << temp_file_path; filename_ = temp_file_path; # else // There's no guarantee that a test has write access to the // current directory, so we create the temporary file in the /tmp // directory instead. char name_template[] = "/tmp/captured_stream.XXXXXX"; const int captured_fd = mkstemp(name_template); filename_ = name_template; # endif // GTEST_OS_WINDOWS fflush(NULL); dup2(captured_fd, fd_); close(captured_fd); } ~CapturedStream() { remove(filename_.c_str()); } String GetCapturedString() { if (uncaptured_fd_ != -1) { // Restores the original stream. fflush(NULL); dup2(uncaptured_fd_, fd_); close(uncaptured_fd_); uncaptured_fd_ = -1; } FILE* const file = posix::FOpen(filename_.c_str(), "r"); const String content = ReadEntireFile(file); posix::FClose(file); return content; } private: // Reads the entire content of a file as a String. static String ReadEntireFile(FILE* file); // Returns the size (in bytes) of a file. static size_t GetFileSize(FILE* file); const int fd_; // A stream to capture. int uncaptured_fd_; // Name of the temporary file holding the stderr output. ::std::string filename_; GTEST_DISALLOW_COPY_AND_ASSIGN_(CapturedStream); }; // Returns the size (in bytes) of a file. size_t CapturedStream::GetFileSize(FILE* file) { fseek(file, 0, SEEK_END); return static_cast(ftell(file)); } // Reads the entire content of a file as a string. String CapturedStream::ReadEntireFile(FILE* file) { const size_t file_size = GetFileSize(file); char* const buffer = new char[file_size]; size_t bytes_last_read = 0; // # of bytes read in the last fread() size_t bytes_read = 0; // # of bytes read so far fseek(file, 0, SEEK_SET); // Keeps reading the file until we cannot read further or the // pre-determined file size is reached. do { bytes_last_read = fread(buffer+bytes_read, 1, file_size-bytes_read, file); bytes_read += bytes_last_read; } while (bytes_last_read > 0 && bytes_read < file_size); const String content(buffer, bytes_read); delete[] buffer; return content; } # ifdef _MSC_VER # pragma warning(pop) # endif // _MSC_VER static CapturedStream* g_captured_stderr = NULL; static CapturedStream* g_captured_stdout = NULL; // Starts capturing an output stream (stdout/stderr). void CaptureStream(int fd, const char* stream_name, CapturedStream** stream) { if (*stream != NULL) { GTEST_LOG_(FATAL) << "Only one " << stream_name << " capturer can exist at a time."; } *stream = new CapturedStream(fd); } // Stops capturing the output stream and returns the captured string. String GetCapturedStream(CapturedStream** captured_stream) { const String content = (*captured_stream)->GetCapturedString(); delete *captured_stream; *captured_stream = NULL; return content; } // Starts capturing stdout. void CaptureStdout() { CaptureStream(kStdOutFileno, "stdout", &g_captured_stdout); } // Starts capturing stderr. void CaptureStderr() { CaptureStream(kStdErrFileno, "stderr", &g_captured_stderr); } // Stops capturing stdout and returns the captured string. String GetCapturedStdout() { return GetCapturedStream(&g_captured_stdout); } // Stops capturing stderr and returns the captured string. String GetCapturedStderr() { return GetCapturedStream(&g_captured_stderr); } #endif // GTEST_HAS_STREAM_REDIRECTION #if GTEST_HAS_DEATH_TEST // A copy of all command line arguments. Set by InitGoogleTest(). ::std::vector g_argvs; // Returns the command line as a vector of strings. const ::std::vector& GetArgvs() { return g_argvs; } #endif // GTEST_HAS_DEATH_TEST #if GTEST_OS_WINDOWS_MOBILE namespace posix { void Abort() { DebugBreak(); TerminateProcess(GetCurrentProcess(), 1); } } // namespace posix #endif // GTEST_OS_WINDOWS_MOBILE // Returns the name of the environment variable corresponding to the // given flag. For example, FlagToEnvVar("foo") will return // "GTEST_FOO" in the open-source version. static String FlagToEnvVar(const char* flag) { const String full_flag = (Message() << GTEST_FLAG_PREFIX_ << flag).GetString(); Message env_var; for (size_t i = 0; i != full_flag.length(); i++) { env_var << ToUpper(full_flag.c_str()[i]); } return env_var.GetString(); } // Parses 'str' for a 32-bit signed integer. If successful, writes // the result to *value and returns true; otherwise leaves *value // unchanged and returns false. bool ParseInt32(const Message& src_text, const char* str, Int32* value) { // Parses the environment variable as a decimal integer. char* end = NULL; const long long_value = strtol(str, &end, 10); // NOLINT // Has strtol() consumed all characters in the string? if (*end != '\0') { // No - an invalid character was encountered. Message msg; msg << "WARNING: " << src_text << " is expected to be a 32-bit integer, but actually" << " has value \"" << str << "\".\n"; printf("%s", msg.GetString().c_str()); fflush(stdout); return false; } // Is the parsed value in the range of an Int32? const Int32 result = static_cast(long_value); if (long_value == LONG_MAX || long_value == LONG_MIN || // The parsed value overflows as a long. (strtol() returns // LONG_MAX or LONG_MIN when the input overflows.) result != long_value // The parsed value overflows as an Int32. ) { Message msg; msg << "WARNING: " << src_text << " is expected to be a 32-bit integer, but actually" << " has value " << str << ", which overflows.\n"; printf("%s", msg.GetString().c_str()); fflush(stdout); return false; } *value = result; return true; } // Reads and returns the Boolean environment variable corresponding to // the given flag; if it's not set, returns default_value. // // The value is considered true iff it's not "0". bool BoolFromGTestEnv(const char* flag, bool default_value) { const String env_var = FlagToEnvVar(flag); const char* const string_value = posix::GetEnv(env_var.c_str()); return string_value == NULL ? default_value : strcmp(string_value, "0") != 0; } // Reads and returns a 32-bit integer stored in the environment // variable corresponding to the given flag; if it isn't set or // doesn't represent a valid 32-bit integer, returns default_value. Int32 Int32FromGTestEnv(const char* flag, Int32 default_value) { const String env_var = FlagToEnvVar(flag); const char* const string_value = posix::GetEnv(env_var.c_str()); if (string_value == NULL) { // The environment variable is not set. return default_value; } Int32 result = default_value; if (!ParseInt32(Message() << "Environment variable " << env_var, string_value, &result)) { printf("The default value %s is used.\n", (Message() << default_value).GetString().c_str()); fflush(stdout); return default_value; } return result; } // Reads and returns the string environment variable corresponding to // the given flag; if it's not set, returns default_value. const char* StringFromGTestEnv(const char* flag, const char* default_value) { const String env_var = FlagToEnvVar(flag); const char* const value = posix::GetEnv(env_var.c_str()); return value == NULL ? default_value : value; } } // namespace internal } // namespace testing // Copyright 2007, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // Google Test - The Google C++ Testing Framework // // This file implements a universal value printer that can print a // value of any type T: // // void ::testing::internal::UniversalPrinter::Print(value, ostream_ptr); // // It uses the << operator when possible, and prints the bytes in the // object otherwise. A user can override its behavior for a class // type Foo by defining either operator<<(::std::ostream&, const Foo&) // or void PrintTo(const Foo&, ::std::ostream*) in the namespace that // defines Foo. #include #include #include // NOLINT #include namespace testing { namespace { using ::std::ostream; #if GTEST_OS_WINDOWS_MOBILE // Windows CE does not define _snprintf_s. # define snprintf _snprintf #elif _MSC_VER >= 1400 // VC 8.0 and later deprecate snprintf and _snprintf. # define snprintf _snprintf_s #elif _MSC_VER # define snprintf _snprintf #endif // GTEST_OS_WINDOWS_MOBILE // Prints a segment of bytes in the given object. void PrintByteSegmentInObjectTo(const unsigned char* obj_bytes, size_t start, size_t count, ostream* os) { char text[5] = ""; for (size_t i = 0; i != count; i++) { const size_t j = start + i; if (i != 0) { // Organizes the bytes into groups of 2 for easy parsing by // human. if ((j % 2) == 0) *os << ' '; else *os << '-'; } snprintf(text, sizeof(text), "%02X", obj_bytes[j]); *os << text; } } // Prints the bytes in the given value to the given ostream. void PrintBytesInObjectToImpl(const unsigned char* obj_bytes, size_t count, ostream* os) { // Tells the user how big the object is. *os << count << "-byte object <"; const size_t kThreshold = 132; const size_t kChunkSize = 64; // If the object size is bigger than kThreshold, we'll have to omit // some details by printing only the first and the last kChunkSize // bytes. // TODO(wan): let the user control the threshold using a flag. if (count < kThreshold) { PrintByteSegmentInObjectTo(obj_bytes, 0, count, os); } else { PrintByteSegmentInObjectTo(obj_bytes, 0, kChunkSize, os); *os << " ... "; // Rounds up to 2-byte boundary. const size_t resume_pos = (count - kChunkSize + 1)/2*2; PrintByteSegmentInObjectTo(obj_bytes, resume_pos, count - resume_pos, os); } *os << ">"; } } // namespace namespace internal2 { // Delegates to PrintBytesInObjectToImpl() to print the bytes in the // given object. The delegation simplifies the implementation, which // uses the << operator and thus is easier done outside of the // ::testing::internal namespace, which contains a << operator that // sometimes conflicts with the one in STL. void PrintBytesInObjectTo(const unsigned char* obj_bytes, size_t count, ostream* os) { PrintBytesInObjectToImpl(obj_bytes, count, os); } } // namespace internal2 namespace internal { // Depending on the value of a char (or wchar_t), we print it in one // of three formats: // - as is if it's a printable ASCII (e.g. 'a', '2', ' '), // - as a hexidecimal escape sequence (e.g. '\x7F'), or // - as a special escape sequence (e.g. '\r', '\n'). enum CharFormat { kAsIs, kHexEscape, kSpecialEscape }; // Returns true if c is a printable ASCII character. We test the // value of c directly instead of calling isprint(), which is buggy on // Windows Mobile. inline bool IsPrintableAscii(wchar_t c) { return 0x20 <= c && c <= 0x7E; } // Prints a wide or narrow char c as a character literal without the // quotes, escaping it when necessary; returns how c was formatted. // The template argument UnsignedChar is the unsigned version of Char, // which is the type of c. template static CharFormat PrintAsCharLiteralTo(Char c, ostream* os) { switch (static_cast(c)) { case L'\0': *os << "\\0"; break; case L'\'': *os << "\\'"; break; case L'\\': *os << "\\\\"; break; case L'\a': *os << "\\a"; break; case L'\b': *os << "\\b"; break; case L'\f': *os << "\\f"; break; case L'\n': *os << "\\n"; break; case L'\r': *os << "\\r"; break; case L'\t': *os << "\\t"; break; case L'\v': *os << "\\v"; break; default: if (IsPrintableAscii(c)) { *os << static_cast(c); return kAsIs; } else { *os << String::Format("\\x%X", static_cast(c)); return kHexEscape; } } return kSpecialEscape; } // Prints a char c as if it's part of a string literal, escaping it when // necessary; returns how c was formatted. static CharFormat PrintAsWideStringLiteralTo(wchar_t c, ostream* os) { switch (c) { case L'\'': *os << "'"; return kAsIs; case L'"': *os << "\\\""; return kSpecialEscape; default: return PrintAsCharLiteralTo(c, os); } } // Prints a char c as if it's part of a string literal, escaping it when // necessary; returns how c was formatted. static CharFormat PrintAsNarrowStringLiteralTo(char c, ostream* os) { return PrintAsWideStringLiteralTo(static_cast(c), os); } // Prints a wide or narrow character c and its code. '\0' is printed // as "'\\0'", other unprintable characters are also properly escaped // using the standard C++ escape sequence. The template argument // UnsignedChar is the unsigned version of Char, which is the type of c. template void PrintCharAndCodeTo(Char c, ostream* os) { // First, print c as a literal in the most readable form we can find. *os << ((sizeof(c) > 1) ? "L'" : "'"); const CharFormat format = PrintAsCharLiteralTo(c, os); *os << "'"; // To aid user debugging, we also print c's code in decimal, unless // it's 0 (in which case c was printed as '\\0', making the code // obvious). if (c == 0) return; *os << " (" << String::Format("%d", c).c_str(); // For more convenience, we print c's code again in hexidecimal, // unless c was already printed in the form '\x##' or the code is in // [1, 9]. if (format == kHexEscape || (1 <= c && c <= 9)) { // Do nothing. } else { *os << String::Format(", 0x%X", static_cast(c)).c_str(); } *os << ")"; } void PrintTo(unsigned char c, ::std::ostream* os) { PrintCharAndCodeTo(c, os); } void PrintTo(signed char c, ::std::ostream* os) { PrintCharAndCodeTo(c, os); } // Prints a wchar_t as a symbol if it is printable or as its internal // code otherwise and also as its code. L'\0' is printed as "L'\\0'". void PrintTo(wchar_t wc, ostream* os) { PrintCharAndCodeTo(wc, os); } // Prints the given array of characters to the ostream. // The array starts at *begin, the length is len, it may include '\0' characters // and may not be null-terminated. static void PrintCharsAsStringTo(const char* begin, size_t len, ostream* os) { *os << "\""; bool is_previous_hex = false; for (size_t index = 0; index < len; ++index) { const char cur = begin[index]; if (is_previous_hex && IsXDigit(cur)) { // Previous character is of '\x..' form and this character can be // interpreted as another hexadecimal digit in its number. Break string to // disambiguate. *os << "\" \""; } is_previous_hex = PrintAsNarrowStringLiteralTo(cur, os) == kHexEscape; } *os << "\""; } // Prints a (const) char array of 'len' elements, starting at address 'begin'. void UniversalPrintArray(const char* begin, size_t len, ostream* os) { PrintCharsAsStringTo(begin, len, os); } // Prints the given array of wide characters to the ostream. // The array starts at *begin, the length is len, it may include L'\0' // characters and may not be null-terminated. static void PrintWideCharsAsStringTo(const wchar_t* begin, size_t len, ostream* os) { *os << "L\""; bool is_previous_hex = false; for (size_t index = 0; index < len; ++index) { const wchar_t cur = begin[index]; if (is_previous_hex && isascii(cur) && IsXDigit(static_cast(cur))) { // Previous character is of '\x..' form and this character can be // interpreted as another hexadecimal digit in its number. Break string to // disambiguate. *os << "\" L\""; } is_previous_hex = PrintAsWideStringLiteralTo(cur, os) == kHexEscape; } *os << "\""; } // Prints the given C string to the ostream. void PrintTo(const char* s, ostream* os) { if (s == NULL) { *os << "NULL"; } else { *os << ImplicitCast_(s) << " pointing to "; PrintCharsAsStringTo(s, strlen(s), os); } } // MSVC compiler can be configured to define whar_t as a typedef // of unsigned short. Defining an overload for const wchar_t* in that case // would cause pointers to unsigned shorts be printed as wide strings, // possibly accessing more memory than intended and causing invalid // memory accesses. MSVC defines _NATIVE_WCHAR_T_DEFINED symbol when // wchar_t is implemented as a native type. #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED) // Prints the given wide C string to the ostream. void PrintTo(const wchar_t* s, ostream* os) { if (s == NULL) { *os << "NULL"; } else { *os << ImplicitCast_(s) << " pointing to "; PrintWideCharsAsStringTo(s, wcslen(s), os); } } #endif // wchar_t is native // Prints a ::string object. #if GTEST_HAS_GLOBAL_STRING void PrintStringTo(const ::string& s, ostream* os) { PrintCharsAsStringTo(s.data(), s.size(), os); } #endif // GTEST_HAS_GLOBAL_STRING void PrintStringTo(const ::std::string& s, ostream* os) { PrintCharsAsStringTo(s.data(), s.size(), os); } // Prints a ::wstring object. #if GTEST_HAS_GLOBAL_WSTRING void PrintWideStringTo(const ::wstring& s, ostream* os) { PrintWideCharsAsStringTo(s.data(), s.size(), os); } #endif // GTEST_HAS_GLOBAL_WSTRING #if GTEST_HAS_STD_WSTRING void PrintWideStringTo(const ::std::wstring& s, ostream* os) { PrintWideCharsAsStringTo(s.data(), s.size(), os); } #endif // GTEST_HAS_STD_WSTRING } // namespace internal } // namespace testing // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: mheule@google.com (Markus Heule) // // The Google C++ Testing Framework (Google Test) // Indicates that this translation unit is part of Google Test's // implementation. It must come before gtest-internal-inl.h is // included, or there will be a compiler error. This trick is to // prevent a user from accidentally including gtest-internal-inl.h in // his code. #define GTEST_IMPLEMENTATION_ 1 #undef GTEST_IMPLEMENTATION_ namespace testing { using internal::GetUnitTestImpl; // Gets the summary of the failure message by omitting the stack trace // in it. internal::String TestPartResult::ExtractSummary(const char* message) { const char* const stack_trace = strstr(message, internal::kStackTraceMarker); return stack_trace == NULL ? internal::String(message) : internal::String(message, stack_trace - message); } // Prints a TestPartResult object. std::ostream& operator<<(std::ostream& os, const TestPartResult& result) { return os << result.file_name() << ":" << result.line_number() << ": " << (result.type() == TestPartResult::kSuccess ? "Success" : result.type() == TestPartResult::kFatalFailure ? "Fatal failure" : "Non-fatal failure") << ":\n" << result.message() << std::endl; } // Appends a TestPartResult to the array. void TestPartResultArray::Append(const TestPartResult& result) { array_.push_back(result); } // Returns the TestPartResult at the given index (0-based). const TestPartResult& TestPartResultArray::GetTestPartResult(int index) const { if (index < 0 || index >= size()) { printf("\nInvalid index (%d) into TestPartResultArray.\n", index); internal::posix::Abort(); } return array_[index]; } // Returns the number of TestPartResult objects in the array. int TestPartResultArray::size() const { return static_cast(array_.size()); } namespace internal { HasNewFatalFailureHelper::HasNewFatalFailureHelper() : has_new_fatal_failure_(false), original_reporter_(GetUnitTestImpl()-> GetTestPartResultReporterForCurrentThread()) { GetUnitTestImpl()->SetTestPartResultReporterForCurrentThread(this); } HasNewFatalFailureHelper::~HasNewFatalFailureHelper() { GetUnitTestImpl()->SetTestPartResultReporterForCurrentThread( original_reporter_); } void HasNewFatalFailureHelper::ReportTestPartResult( const TestPartResult& result) { if (result.fatally_failed()) has_new_fatal_failure_ = true; original_reporter_->ReportTestPartResult(result); } } // namespace internal } // namespace testing // Copyright 2008 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) namespace testing { namespace internal { #if GTEST_HAS_TYPED_TEST_P // Skips to the first non-space char in str. Returns an empty string if str // contains only whitespace characters. static const char* SkipSpaces(const char* str) { while (IsSpace(*str)) str++; return str; } // Verifies that registered_tests match the test names in // defined_test_names_; returns registered_tests if successful, or // aborts the program otherwise. const char* TypedTestCasePState::VerifyRegisteredTestNames( const char* file, int line, const char* registered_tests) { typedef ::std::set::const_iterator DefinedTestIter; registered_ = true; // Skip initial whitespace in registered_tests since some // preprocessors prefix stringizied literals with whitespace. registered_tests = SkipSpaces(registered_tests); Message errors; ::std::set tests; for (const char* names = registered_tests; names != NULL; names = SkipComma(names)) { const String name = GetPrefixUntilComma(names); if (tests.count(name) != 0) { errors << "Test " << name << " is listed more than once.\n"; continue; } bool found = false; for (DefinedTestIter it = defined_test_names_.begin(); it != defined_test_names_.end(); ++it) { if (name == *it) { found = true; break; } } if (found) { tests.insert(name); } else { errors << "No test named " << name << " can be found in this test case.\n"; } } for (DefinedTestIter it = defined_test_names_.begin(); it != defined_test_names_.end(); ++it) { if (tests.count(*it) == 0) { errors << "You forgot to list test " << *it << ".\n"; } } const String& errors_str = errors.GetString(); if (errors_str != "") { fprintf(stderr, "%s %s", FormatFileLocation(file, line).c_str(), errors_str.c_str()); fflush(stderr); posix::Abort(); } return registered_tests; } #endif // GTEST_HAS_TYPED_TEST_P } // namespace internal } // namespace testing suricata-3.2.1/libhtp/test/gtest/gtest.h0000644000000000000000000303564413051004451015115 00000000000000// Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // The Google C++ Testing Framework (Google Test) // // This header file defines the public API for Google Test. It should be // included by any test program that uses Google Test. // // IMPORTANT NOTE: Due to limitation of the C++ language, we have to // leave some internal implementation details in this header file. // They are clearly marked by comments like this: // // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. // // Such code is NOT meant to be used by a user directly, and is subject // to CHANGE WITHOUT NOTICE. Therefore DO NOT DEPEND ON IT in a user // program! // // Acknowledgment: Google Test borrowed the idea of automatic test // registration from Barthelemy Dagenais' (barthelemy@prologique.com) // easyUnit framework. #ifndef GTEST_INCLUDE_GTEST_GTEST_H_ #define GTEST_INCLUDE_GTEST_GTEST_H_ #include #include // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: wan@google.com (Zhanyong Wan), eefacm@gmail.com (Sean Mcafee) // // The Google C++ Testing Framework (Google Test) // // This header file declares functions and macros used internally by // Google Test. They are subject to change without notice. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_ // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: wan@google.com (Zhanyong Wan) // // Low-level types and utilities for porting Google Test to various // platforms. They are subject to change without notice. DO NOT USE // THEM IN USER CODE. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PORT_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PORT_H_ // The user can define the following macros in the build script to // control Google Test's behavior. If the user doesn't define a macro // in this list, Google Test will define it. // // GTEST_HAS_CLONE - Define it to 1/0 to indicate that clone(2) // is/isn't available. // GTEST_HAS_EXCEPTIONS - Define it to 1/0 to indicate that exceptions // are enabled. // GTEST_HAS_GLOBAL_STRING - Define it to 1/0 to indicate that ::string // is/isn't available (some systems define // ::string, which is different to std::string). // GTEST_HAS_GLOBAL_WSTRING - Define it to 1/0 to indicate that ::string // is/isn't available (some systems define // ::wstring, which is different to std::wstring). // GTEST_HAS_POSIX_RE - Define it to 1/0 to indicate that POSIX regular // expressions are/aren't available. // GTEST_HAS_PTHREAD - Define it to 1/0 to indicate that // is/isn't available. // GTEST_HAS_RTTI - Define it to 1/0 to indicate that RTTI is/isn't // enabled. // GTEST_HAS_STD_WSTRING - Define it to 1/0 to indicate that // std::wstring does/doesn't work (Google Test can // be used where std::wstring is unavailable). // GTEST_HAS_TR1_TUPLE - Define it to 1/0 to indicate tr1::tuple // is/isn't available. // GTEST_HAS_SEH - Define it to 1/0 to indicate whether the // compiler supports Microsoft's "Structured // Exception Handling". // GTEST_HAS_STREAM_REDIRECTION // - Define it to 1/0 to indicate whether the // platform supports I/O stream redirection using // dup() and dup2(). // GTEST_USE_OWN_TR1_TUPLE - Define it to 1/0 to indicate whether Google // Test's own tr1 tuple implementation should be // used. Unused when the user sets // GTEST_HAS_TR1_TUPLE to 0. // GTEST_LINKED_AS_SHARED_LIBRARY // - Define to 1 when compiling tests that use // Google Test as a shared library (known as // DLL on Windows). // GTEST_CREATE_SHARED_LIBRARY // - Define to 1 when compiling Google Test itself // as a shared library. // This header defines the following utilities: // // Macros indicating the current platform (defined to 1 if compiled on // the given platform; otherwise undefined): // GTEST_OS_AIX - IBM AIX // GTEST_OS_CYGWIN - Cygwin // GTEST_OS_HPUX - HP-UX // GTEST_OS_LINUX - Linux // GTEST_OS_LINUX_ANDROID - Google Android // GTEST_OS_MAC - Mac OS X // GTEST_OS_NACL - Google Native Client (NaCl) // GTEST_OS_SOLARIS - Sun Solaris // GTEST_OS_SYMBIAN - Symbian // GTEST_OS_WINDOWS - Windows (Desktop, MinGW, or Mobile) // GTEST_OS_WINDOWS_DESKTOP - Windows Desktop // GTEST_OS_WINDOWS_MINGW - MinGW // GTEST_OS_WINDOWS_MOBILE - Windows Mobile // GTEST_OS_ZOS - z/OS // // Among the platforms, Cygwin, Linux, Max OS X, and Windows have the // most stable support. Since core members of the Google Test project // don't have access to other platforms, support for them may be less // stable. If you notice any problems on your platform, please notify // googletestframework@googlegroups.com (patches for fixing them are // even more welcome!). // // Note that it is possible that none of the GTEST_OS_* macros are defined. // // Macros indicating available Google Test features (defined to 1 if // the corresponding feature is supported; otherwise undefined): // GTEST_HAS_COMBINE - the Combine() function (for value-parameterized // tests) // GTEST_HAS_DEATH_TEST - death tests // GTEST_HAS_PARAM_TEST - value-parameterized tests // GTEST_HAS_TYPED_TEST - typed tests // GTEST_HAS_TYPED_TEST_P - type-parameterized tests // GTEST_USES_POSIX_RE - enhanced POSIX regex is used. Do not confuse with // GTEST_HAS_POSIX_RE (see above) which users can // define themselves. // GTEST_USES_SIMPLE_RE - our own simple regex is used; // the above two are mutually exclusive. // GTEST_CAN_COMPARE_NULL - accepts untyped NULL in EXPECT_EQ(). // // Macros for basic C++ coding: // GTEST_AMBIGUOUS_ELSE_BLOCKER_ - for disabling a gcc warning. // GTEST_ATTRIBUTE_UNUSED_ - declares that a class' instances or a // variable don't have to be used. // GTEST_DISALLOW_ASSIGN_ - disables operator=. // GTEST_DISALLOW_COPY_AND_ASSIGN_ - disables copy ctor and operator=. // GTEST_MUST_USE_RESULT_ - declares that a function's result must be used. // // Synchronization: // Mutex, MutexLock, ThreadLocal, GetThreadCount() // - synchronization primitives. // GTEST_IS_THREADSAFE - defined to 1 to indicate that the above // synchronization primitives have real implementations // and Google Test is thread-safe; or 0 otherwise. // // Template meta programming: // is_pointer - as in TR1; needed on Symbian and IBM XL C/C++ only. // IteratorTraits - partial implementation of std::iterator_traits, which // is not available in libCstd when compiled with Sun C++. // // Smart pointers: // scoped_ptr - as in TR2. // // Regular expressions: // RE - a simple regular expression class using the POSIX // Extended Regular Expression syntax on UNIX-like // platforms, or a reduced regular exception syntax on // other platforms, including Windows. // // Logging: // GTEST_LOG_() - logs messages at the specified severity level. // LogToStderr() - directs all log messages to stderr. // FlushInfoLog() - flushes informational log messages. // // Stdout and stderr capturing: // CaptureStdout() - starts capturing stdout. // GetCapturedStdout() - stops capturing stdout and returns the captured // string. // CaptureStderr() - starts capturing stderr. // GetCapturedStderr() - stops capturing stderr and returns the captured // string. // // Integer types: // TypeWithSize - maps an integer to a int type. // Int32, UInt32, Int64, UInt64, TimeInMillis // - integers of known sizes. // BiggestInt - the biggest signed integer type. // // Command-line utilities: // GTEST_FLAG() - references a flag. // GTEST_DECLARE_*() - declares a flag. // GTEST_DEFINE_*() - defines a flag. // GetArgvs() - returns the command line as a vector of strings. // // Environment variable utilities: // GetEnv() - gets the value of an environment variable. // BoolFromGTestEnv() - parses a bool environment variable. // Int32FromGTestEnv() - parses an Int32 environment variable. // StringFromGTestEnv() - parses a string environment variable. #include // for isspace, etc #include // for ptrdiff_t #include #include #include #ifndef _WIN32_WCE # include # include #endif // !_WIN32_WCE #include // NOLINT #include // NOLINT #include // NOLINT #define GTEST_DEV_EMAIL_ "googletestframework@@googlegroups.com" #define GTEST_FLAG_PREFIX_ "gtest_" #define GTEST_FLAG_PREFIX_DASH_ "gtest-" #define GTEST_FLAG_PREFIX_UPPER_ "GTEST_" #define GTEST_NAME_ "Google Test" #define GTEST_PROJECT_URL_ "http://code.google.com/p/googletest/" // Determines the version of gcc that is used to compile this. #ifdef __GNUC__ // 40302 means version 4.3.2. # define GTEST_GCC_VER_ \ (__GNUC__*10000 + __GNUC_MINOR__*100 + __GNUC_PATCHLEVEL__) #endif // __GNUC__ // Determines the platform on which Google Test is compiled. #ifdef __CYGWIN__ # define GTEST_OS_CYGWIN 1 #elif defined __SYMBIAN32__ # define GTEST_OS_SYMBIAN 1 #elif defined _WIN32 # define GTEST_OS_WINDOWS 1 # ifdef _WIN32_WCE # define GTEST_OS_WINDOWS_MOBILE 1 # elif defined(__MINGW__) || defined(__MINGW32__) # define GTEST_OS_WINDOWS_MINGW 1 # else # define GTEST_OS_WINDOWS_DESKTOP 1 # endif // _WIN32_WCE #elif defined __APPLE__ # define GTEST_OS_MAC 1 #elif defined __linux__ # define GTEST_OS_LINUX 1 # ifdef ANDROID # define GTEST_OS_LINUX_ANDROID 1 # endif // ANDROID #elif defined __MVS__ # define GTEST_OS_ZOS 1 #elif defined(__sun) && defined(__SVR4) # define GTEST_OS_SOLARIS 1 #elif defined(_AIX) # define GTEST_OS_AIX 1 #elif defined(__hpux) # define GTEST_OS_HPUX 1 #elif defined __native_client__ # define GTEST_OS_NACL 1 #endif // __CYGWIN__ // Brings in definitions for functions used in the testing::internal::posix // namespace (read, write, close, chdir, isatty, stat). We do not currently // use them on Windows Mobile. #if !GTEST_OS_WINDOWS // This assumes that non-Windows OSes provide unistd.h. For OSes where this // is not the case, we need to include headers that provide the functions // mentioned above. # include # if !GTEST_OS_NACL // TODO(vladl@google.com): Remove this condition when Native Client SDK adds // strings.h (tracked in // http://code.google.com/p/nativeclient/issues/detail?id=1175). # include // Native Client doesn't provide strings.h. # endif #elif !GTEST_OS_WINDOWS_MOBILE # include # include #endif // Defines this to true iff Google Test can use POSIX regular expressions. #ifndef GTEST_HAS_POSIX_RE # define GTEST_HAS_POSIX_RE (!GTEST_OS_WINDOWS) #endif #if GTEST_HAS_POSIX_RE // On some platforms, needs someone to define size_t, and // won't compile otherwise. We can #include it here as we already // included , which is guaranteed to define size_t through // . # include // NOLINT # define GTEST_USES_POSIX_RE 1 #elif GTEST_OS_WINDOWS // is not available on Windows. Use our own simple regex // implementation instead. # define GTEST_USES_SIMPLE_RE 1 #else // may not be available on this platform. Use our own // simple regex implementation instead. # define GTEST_USES_SIMPLE_RE 1 #endif // GTEST_HAS_POSIX_RE #ifndef GTEST_HAS_EXCEPTIONS // The user didn't tell us whether exceptions are enabled, so we need // to figure it out. # if defined(_MSC_VER) || defined(__BORLANDC__) // MSVC's and C++Builder's implementations of the STL use the _HAS_EXCEPTIONS // macro to enable exceptions, so we'll do the same. // Assumes that exceptions are enabled by default. # ifndef _HAS_EXCEPTIONS # define _HAS_EXCEPTIONS 1 # endif // _HAS_EXCEPTIONS # define GTEST_HAS_EXCEPTIONS _HAS_EXCEPTIONS # elif defined(__GNUC__) && __EXCEPTIONS // gcc defines __EXCEPTIONS to 1 iff exceptions are enabled. # define GTEST_HAS_EXCEPTIONS 1 # elif defined(__SUNPRO_CC) // Sun Pro CC supports exceptions. However, there is no compile-time way of // detecting whether they are enabled or not. Therefore, we assume that // they are enabled unless the user tells us otherwise. # define GTEST_HAS_EXCEPTIONS 1 # elif defined(__IBMCPP__) && __EXCEPTIONS // xlC defines __EXCEPTIONS to 1 iff exceptions are enabled. # define GTEST_HAS_EXCEPTIONS 1 # elif defined(__HP_aCC) // Exception handling is in effect by default in HP aCC compiler. It has to // be turned of by +noeh compiler option if desired. # define GTEST_HAS_EXCEPTIONS 1 # else // For other compilers, we assume exceptions are disabled to be // conservative. # define GTEST_HAS_EXCEPTIONS 0 # endif // defined(_MSC_VER) || defined(__BORLANDC__) #endif // GTEST_HAS_EXCEPTIONS #if !defined(GTEST_HAS_STD_STRING) // Even though we don't use this macro any longer, we keep it in case // some clients still depend on it. # define GTEST_HAS_STD_STRING 1 #elif !GTEST_HAS_STD_STRING // The user told us that ::std::string isn't available. # error "Google Test cannot be used where ::std::string isn't available." #endif // !defined(GTEST_HAS_STD_STRING) #ifndef GTEST_HAS_GLOBAL_STRING // The user didn't tell us whether ::string is available, so we need // to figure it out. # define GTEST_HAS_GLOBAL_STRING 0 #endif // GTEST_HAS_GLOBAL_STRING #ifndef GTEST_HAS_STD_WSTRING // The user didn't tell us whether ::std::wstring is available, so we need // to figure it out. // TODO(wan@google.com): uses autoconf to detect whether ::std::wstring // is available. // Cygwin 1.7 and below doesn't support ::std::wstring. // Solaris' libc++ doesn't support it either. Android has // no support for it at least as recent as Froyo (2.2). # define GTEST_HAS_STD_WSTRING \ (!(GTEST_OS_LINUX_ANDROID || GTEST_OS_CYGWIN || GTEST_OS_SOLARIS)) #endif // GTEST_HAS_STD_WSTRING #ifndef GTEST_HAS_GLOBAL_WSTRING // The user didn't tell us whether ::wstring is available, so we need // to figure it out. # define GTEST_HAS_GLOBAL_WSTRING \ (GTEST_HAS_STD_WSTRING && GTEST_HAS_GLOBAL_STRING) #endif // GTEST_HAS_GLOBAL_WSTRING // Determines whether RTTI is available. #ifndef GTEST_HAS_RTTI // The user didn't tell us whether RTTI is enabled, so we need to // figure it out. # ifdef _MSC_VER # ifdef _CPPRTTI // MSVC defines this macro iff RTTI is enabled. # define GTEST_HAS_RTTI 1 # else # define GTEST_HAS_RTTI 0 # endif // Starting with version 4.3.2, gcc defines __GXX_RTTI iff RTTI is enabled. # elif defined(__GNUC__) && (GTEST_GCC_VER_ >= 40302) # ifdef __GXX_RTTI # define GTEST_HAS_RTTI 1 # else # define GTEST_HAS_RTTI 0 # endif // __GXX_RTTI // Starting with version 9.0 IBM Visual Age defines __RTTI_ALL__ to 1 if // both the typeid and dynamic_cast features are present. # elif defined(__IBMCPP__) && (__IBMCPP__ >= 900) # ifdef __RTTI_ALL__ # define GTEST_HAS_RTTI 1 # else # define GTEST_HAS_RTTI 0 # endif # else // For all other compilers, we assume RTTI is enabled. # define GTEST_HAS_RTTI 1 # endif // _MSC_VER #endif // GTEST_HAS_RTTI // It's this header's responsibility to #include when RTTI // is enabled. #if GTEST_HAS_RTTI # include #endif // Determines whether Google Test can use the pthreads library. #ifndef GTEST_HAS_PTHREAD // The user didn't tell us explicitly, so we assume pthreads support is // available on Linux and Mac. // // To disable threading support in Google Test, add -DGTEST_HAS_PTHREAD=0 // to your compiler flags. # define GTEST_HAS_PTHREAD (GTEST_OS_LINUX || GTEST_OS_MAC || GTEST_OS_HPUX) #endif // GTEST_HAS_PTHREAD #if GTEST_HAS_PTHREAD // gtest-port.h guarantees to #include when GTEST_HAS_PTHREAD is // true. # include // NOLINT // For timespec and nanosleep, used below. # include // NOLINT #endif // Determines whether Google Test can use tr1/tuple. You can define // this macro to 0 to prevent Google Test from using tuple (any // feature depending on tuple with be disabled in this mode). #ifndef GTEST_HAS_TR1_TUPLE // The user didn't tell us not to do it, so we assume it's OK. # define GTEST_HAS_TR1_TUPLE 1 #endif // GTEST_HAS_TR1_TUPLE // Determines whether Google Test's own tr1 tuple implementation // should be used. #ifndef GTEST_USE_OWN_TR1_TUPLE // The user didn't tell us, so we need to figure it out. // We use our own TR1 tuple if we aren't sure the user has an // implementation of it already. At this time, GCC 4.0.0+ and MSVC // 2010 are the only mainstream compilers that come with a TR1 tuple // implementation. NVIDIA's CUDA NVCC compiler pretends to be GCC by // defining __GNUC__ and friends, but cannot compile GCC's tuple // implementation. MSVC 2008 (9.0) provides TR1 tuple in a 323 MB // Feature Pack download, which we cannot assume the user has. # if (defined(__GNUC__) && !defined(__CUDACC__) && (GTEST_GCC_VER_ >= 40000)) \ || _MSC_VER >= 1600 # define GTEST_USE_OWN_TR1_TUPLE 0 # else # define GTEST_USE_OWN_TR1_TUPLE 1 # endif #endif // GTEST_USE_OWN_TR1_TUPLE // To avoid conditional compilation everywhere, we make it // gtest-port.h's responsibility to #include the header implementing // tr1/tuple. #if GTEST_HAS_TR1_TUPLE # if GTEST_USE_OWN_TR1_TUPLE // This file was GENERATED by a script. DO NOT EDIT BY HAND!!! // Copyright 2009 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // Implements a subset of TR1 tuple needed by Google Test and Google Mock. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TUPLE_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TUPLE_H_ #include // For ::std::pair. // The compiler used in Symbian has a bug that prevents us from declaring the // tuple template as a friend (it complains that tuple is redefined). This // hack bypasses the bug by declaring the members that should otherwise be // private as public. // Sun Studio versions < 12 also have the above bug. #if defined(__SYMBIAN32__) || (defined(__SUNPRO_CC) && __SUNPRO_CC < 0x590) # define GTEST_DECLARE_TUPLE_AS_FRIEND_ public: #else # define GTEST_DECLARE_TUPLE_AS_FRIEND_ \ template friend class tuple; \ private: #endif // GTEST_n_TUPLE_(T) is the type of an n-tuple. #define GTEST_0_TUPLE_(T) tuple<> #define GTEST_1_TUPLE_(T) tuple #define GTEST_2_TUPLE_(T) tuple #define GTEST_3_TUPLE_(T) tuple #define GTEST_4_TUPLE_(T) tuple #define GTEST_5_TUPLE_(T) tuple #define GTEST_6_TUPLE_(T) tuple #define GTEST_7_TUPLE_(T) tuple #define GTEST_8_TUPLE_(T) tuple #define GTEST_9_TUPLE_(T) tuple #define GTEST_10_TUPLE_(T) tuple // GTEST_n_TYPENAMES_(T) declares a list of n typenames. #define GTEST_0_TYPENAMES_(T) #define GTEST_1_TYPENAMES_(T) typename T##0 #define GTEST_2_TYPENAMES_(T) typename T##0, typename T##1 #define GTEST_3_TYPENAMES_(T) typename T##0, typename T##1, typename T##2 #define GTEST_4_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3 #define GTEST_5_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4 #define GTEST_6_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4, typename T##5 #define GTEST_7_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4, typename T##5, typename T##6 #define GTEST_8_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4, typename T##5, typename T##6, typename T##7 #define GTEST_9_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4, typename T##5, typename T##6, \ typename T##7, typename T##8 #define GTEST_10_TYPENAMES_(T) typename T##0, typename T##1, typename T##2, \ typename T##3, typename T##4, typename T##5, typename T##6, \ typename T##7, typename T##8, typename T##9 // In theory, defining stuff in the ::std namespace is undefined // behavior. We can do this as we are playing the role of a standard // library vendor. namespace std { namespace tr1 { template class tuple; // Anything in namespace gtest_internal is Google Test's INTERNAL // IMPLEMENTATION DETAIL and MUST NOT BE USED DIRECTLY in user code. namespace gtest_internal { // ByRef::type is T if T is a reference; otherwise it's const T&. template struct ByRef { typedef const T& type; }; // NOLINT template struct ByRef { typedef T& type; }; // NOLINT // A handy wrapper for ByRef. #define GTEST_BY_REF_(T) typename ::std::tr1::gtest_internal::ByRef::type // AddRef::type is T if T is a reference; otherwise it's T&. This // is the same as tr1::add_reference::type. template struct AddRef { typedef T& type; }; // NOLINT template struct AddRef { typedef T& type; }; // NOLINT // A handy wrapper for AddRef. #define GTEST_ADD_REF_(T) typename ::std::tr1::gtest_internal::AddRef::type // A helper for implementing get(). template class Get; // A helper for implementing tuple_element. kIndexValid is true // iff k < the number of fields in tuple type T. template struct TupleElement; template struct TupleElement { typedef T0 type; }; template struct TupleElement { typedef T1 type; }; template struct TupleElement { typedef T2 type; }; template struct TupleElement { typedef T3 type; }; template struct TupleElement { typedef T4 type; }; template struct TupleElement { typedef T5 type; }; template struct TupleElement { typedef T6 type; }; template struct TupleElement { typedef T7 type; }; template struct TupleElement { typedef T8 type; }; template struct TupleElement { typedef T9 type; }; } // namespace gtest_internal template <> class tuple<> { public: tuple() {} tuple(const tuple& /* t */) {} tuple& operator=(const tuple& /* t */) { return *this; } }; template class GTEST_1_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_() {} explicit tuple(GTEST_BY_REF_(T0) f0) : f0_(f0) {} tuple(const tuple& t) : f0_(t.f0_) {} template tuple(const GTEST_1_TUPLE_(U)& t) : f0_(t.f0_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_1_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_1_TUPLE_(U)& t) { f0_ = t.f0_; return *this; } T0 f0_; }; template class GTEST_2_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1) : f0_(f0), f1_(f1) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_) {} template tuple(const GTEST_2_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_) {} template tuple(const ::std::pair& p) : f0_(p.first), f1_(p.second) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_2_TUPLE_(U)& t) { return CopyFrom(t); } template tuple& operator=(const ::std::pair& p) { f0_ = p.first; f1_ = p.second; return *this; } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_2_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; return *this; } T0 f0_; T1 f1_; }; template class GTEST_3_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2) : f0_(f0), f1_(f1), f2_(f2) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_) {} template tuple(const GTEST_3_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_3_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_3_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; return *this; } T0 f0_; T1 f1_; T2 f2_; }; template class GTEST_4_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3) : f0_(f0), f1_(f1), f2_(f2), f3_(f3) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_) {} template tuple(const GTEST_4_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_4_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_4_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; }; template class GTEST_5_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_) {} template tuple(const GTEST_5_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_5_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_5_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; }; template class GTEST_6_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_(), f5_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4, GTEST_BY_REF_(T5) f5) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4), f5_(f5) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_) {} template tuple(const GTEST_6_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_6_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_6_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; f5_ = t.f5_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; T5 f5_; }; template class GTEST_7_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_(), f5_(), f6_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4, GTEST_BY_REF_(T5) f5, GTEST_BY_REF_(T6) f6) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4), f5_(f5), f6_(f6) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_) {} template tuple(const GTEST_7_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_7_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_7_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; f5_ = t.f5_; f6_ = t.f6_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; T5 f5_; T6 f6_; }; template class GTEST_8_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_(), f5_(), f6_(), f7_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4, GTEST_BY_REF_(T5) f5, GTEST_BY_REF_(T6) f6, GTEST_BY_REF_(T7) f7) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4), f5_(f5), f6_(f6), f7_(f7) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_) {} template tuple(const GTEST_8_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_8_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_8_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; f5_ = t.f5_; f6_ = t.f6_; f7_ = t.f7_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; T5 f5_; T6 f6_; T7 f7_; }; template class GTEST_9_TUPLE_(T) { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_(), f5_(), f6_(), f7_(), f8_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4, GTEST_BY_REF_(T5) f5, GTEST_BY_REF_(T6) f6, GTEST_BY_REF_(T7) f7, GTEST_BY_REF_(T8) f8) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4), f5_(f5), f6_(f6), f7_(f7), f8_(f8) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_), f8_(t.f8_) {} template tuple(const GTEST_9_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_), f8_(t.f8_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_9_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_9_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; f5_ = t.f5_; f6_ = t.f6_; f7_ = t.f7_; f8_ = t.f8_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; T5 f5_; T6 f6_; T7 f7_; T8 f8_; }; template class tuple { public: template friend class gtest_internal::Get; tuple() : f0_(), f1_(), f2_(), f3_(), f4_(), f5_(), f6_(), f7_(), f8_(), f9_() {} explicit tuple(GTEST_BY_REF_(T0) f0, GTEST_BY_REF_(T1) f1, GTEST_BY_REF_(T2) f2, GTEST_BY_REF_(T3) f3, GTEST_BY_REF_(T4) f4, GTEST_BY_REF_(T5) f5, GTEST_BY_REF_(T6) f6, GTEST_BY_REF_(T7) f7, GTEST_BY_REF_(T8) f8, GTEST_BY_REF_(T9) f9) : f0_(f0), f1_(f1), f2_(f2), f3_(f3), f4_(f4), f5_(f5), f6_(f6), f7_(f7), f8_(f8), f9_(f9) {} tuple(const tuple& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_), f8_(t.f8_), f9_(t.f9_) {} template tuple(const GTEST_10_TUPLE_(U)& t) : f0_(t.f0_), f1_(t.f1_), f2_(t.f2_), f3_(t.f3_), f4_(t.f4_), f5_(t.f5_), f6_(t.f6_), f7_(t.f7_), f8_(t.f8_), f9_(t.f9_) {} tuple& operator=(const tuple& t) { return CopyFrom(t); } template tuple& operator=(const GTEST_10_TUPLE_(U)& t) { return CopyFrom(t); } GTEST_DECLARE_TUPLE_AS_FRIEND_ template tuple& CopyFrom(const GTEST_10_TUPLE_(U)& t) { f0_ = t.f0_; f1_ = t.f1_; f2_ = t.f2_; f3_ = t.f3_; f4_ = t.f4_; f5_ = t.f5_; f6_ = t.f6_; f7_ = t.f7_; f8_ = t.f8_; f9_ = t.f9_; return *this; } T0 f0_; T1 f1_; T2 f2_; T3 f3_; T4 f4_; T5 f5_; T6 f6_; T7 f7_; T8 f8_; T9 f9_; }; // 6.1.3.2 Tuple creation functions. // Known limitations: we don't support passing an // std::tr1::reference_wrapper to make_tuple(). And we don't // implement tie(). inline tuple<> make_tuple() { return tuple<>(); } template inline GTEST_1_TUPLE_(T) make_tuple(const T0& f0) { return GTEST_1_TUPLE_(T)(f0); } template inline GTEST_2_TUPLE_(T) make_tuple(const T0& f0, const T1& f1) { return GTEST_2_TUPLE_(T)(f0, f1); } template inline GTEST_3_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2) { return GTEST_3_TUPLE_(T)(f0, f1, f2); } template inline GTEST_4_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3) { return GTEST_4_TUPLE_(T)(f0, f1, f2, f3); } template inline GTEST_5_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4) { return GTEST_5_TUPLE_(T)(f0, f1, f2, f3, f4); } template inline GTEST_6_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4, const T5& f5) { return GTEST_6_TUPLE_(T)(f0, f1, f2, f3, f4, f5); } template inline GTEST_7_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4, const T5& f5, const T6& f6) { return GTEST_7_TUPLE_(T)(f0, f1, f2, f3, f4, f5, f6); } template inline GTEST_8_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4, const T5& f5, const T6& f6, const T7& f7) { return GTEST_8_TUPLE_(T)(f0, f1, f2, f3, f4, f5, f6, f7); } template inline GTEST_9_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4, const T5& f5, const T6& f6, const T7& f7, const T8& f8) { return GTEST_9_TUPLE_(T)(f0, f1, f2, f3, f4, f5, f6, f7, f8); } template inline GTEST_10_TUPLE_(T) make_tuple(const T0& f0, const T1& f1, const T2& f2, const T3& f3, const T4& f4, const T5& f5, const T6& f6, const T7& f7, const T8& f8, const T9& f9) { return GTEST_10_TUPLE_(T)(f0, f1, f2, f3, f4, f5, f6, f7, f8, f9); } // 6.1.3.3 Tuple helper classes. template struct tuple_size; template struct tuple_size { static const int value = 0; }; template struct tuple_size { static const int value = 1; }; template struct tuple_size { static const int value = 2; }; template struct tuple_size { static const int value = 3; }; template struct tuple_size { static const int value = 4; }; template struct tuple_size { static const int value = 5; }; template struct tuple_size { static const int value = 6; }; template struct tuple_size { static const int value = 7; }; template struct tuple_size { static const int value = 8; }; template struct tuple_size { static const int value = 9; }; template struct tuple_size { static const int value = 10; }; template struct tuple_element { typedef typename gtest_internal::TupleElement< k < (tuple_size::value), k, Tuple>::type type; }; #define GTEST_TUPLE_ELEMENT_(k, Tuple) typename tuple_element::type // 6.1.3.4 Element access. namespace gtest_internal { template <> class Get<0> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(0, Tuple)) Field(Tuple& t) { return t.f0_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(0, Tuple)) ConstField(const Tuple& t) { return t.f0_; } }; template <> class Get<1> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(1, Tuple)) Field(Tuple& t) { return t.f1_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(1, Tuple)) ConstField(const Tuple& t) { return t.f1_; } }; template <> class Get<2> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(2, Tuple)) Field(Tuple& t) { return t.f2_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(2, Tuple)) ConstField(const Tuple& t) { return t.f2_; } }; template <> class Get<3> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(3, Tuple)) Field(Tuple& t) { return t.f3_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(3, Tuple)) ConstField(const Tuple& t) { return t.f3_; } }; template <> class Get<4> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(4, Tuple)) Field(Tuple& t) { return t.f4_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(4, Tuple)) ConstField(const Tuple& t) { return t.f4_; } }; template <> class Get<5> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(5, Tuple)) Field(Tuple& t) { return t.f5_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(5, Tuple)) ConstField(const Tuple& t) { return t.f5_; } }; template <> class Get<6> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(6, Tuple)) Field(Tuple& t) { return t.f6_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(6, Tuple)) ConstField(const Tuple& t) { return t.f6_; } }; template <> class Get<7> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(7, Tuple)) Field(Tuple& t) { return t.f7_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(7, Tuple)) ConstField(const Tuple& t) { return t.f7_; } }; template <> class Get<8> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(8, Tuple)) Field(Tuple& t) { return t.f8_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(8, Tuple)) ConstField(const Tuple& t) { return t.f8_; } }; template <> class Get<9> { public: template static GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(9, Tuple)) Field(Tuple& t) { return t.f9_; } // NOLINT template static GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(9, Tuple)) ConstField(const Tuple& t) { return t.f9_; } }; } // namespace gtest_internal template GTEST_ADD_REF_(GTEST_TUPLE_ELEMENT_(k, GTEST_10_TUPLE_(T))) get(GTEST_10_TUPLE_(T)& t) { return gtest_internal::Get::Field(t); } template GTEST_BY_REF_(GTEST_TUPLE_ELEMENT_(k, GTEST_10_TUPLE_(T))) get(const GTEST_10_TUPLE_(T)& t) { return gtest_internal::Get::ConstField(t); } // 6.1.3.5 Relational operators // We only implement == and !=, as we don't have a need for the rest yet. namespace gtest_internal { // SameSizeTuplePrefixComparator::Eq(t1, t2) returns true if the // first k fields of t1 equals the first k fields of t2. // SameSizeTuplePrefixComparator(k1, k2) would be a compiler error if // k1 != k2. template struct SameSizeTuplePrefixComparator; template <> struct SameSizeTuplePrefixComparator<0, 0> { template static bool Eq(const Tuple1& /* t1 */, const Tuple2& /* t2 */) { return true; } }; template struct SameSizeTuplePrefixComparator { template static bool Eq(const Tuple1& t1, const Tuple2& t2) { return SameSizeTuplePrefixComparator::Eq(t1, t2) && ::std::tr1::get(t1) == ::std::tr1::get(t2); } }; } // namespace gtest_internal template inline bool operator==(const GTEST_10_TUPLE_(T)& t, const GTEST_10_TUPLE_(U)& u) { return gtest_internal::SameSizeTuplePrefixComparator< tuple_size::value, tuple_size::value>::Eq(t, u); } template inline bool operator!=(const GTEST_10_TUPLE_(T)& t, const GTEST_10_TUPLE_(U)& u) { return !(t == u); } // 6.1.4 Pairs. // Unimplemented. } // namespace tr1 } // namespace std #undef GTEST_0_TUPLE_ #undef GTEST_1_TUPLE_ #undef GTEST_2_TUPLE_ #undef GTEST_3_TUPLE_ #undef GTEST_4_TUPLE_ #undef GTEST_5_TUPLE_ #undef GTEST_6_TUPLE_ #undef GTEST_7_TUPLE_ #undef GTEST_8_TUPLE_ #undef GTEST_9_TUPLE_ #undef GTEST_10_TUPLE_ #undef GTEST_0_TYPENAMES_ #undef GTEST_1_TYPENAMES_ #undef GTEST_2_TYPENAMES_ #undef GTEST_3_TYPENAMES_ #undef GTEST_4_TYPENAMES_ #undef GTEST_5_TYPENAMES_ #undef GTEST_6_TYPENAMES_ #undef GTEST_7_TYPENAMES_ #undef GTEST_8_TYPENAMES_ #undef GTEST_9_TYPENAMES_ #undef GTEST_10_TYPENAMES_ #undef GTEST_DECLARE_TUPLE_AS_FRIEND_ #undef GTEST_BY_REF_ #undef GTEST_ADD_REF_ #undef GTEST_TUPLE_ELEMENT_ #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TUPLE_H_ # elif GTEST_OS_SYMBIAN // On Symbian, BOOST_HAS_TR1_TUPLE causes Boost's TR1 tuple library to // use STLport's tuple implementation, which unfortunately doesn't // work as the copy of STLport distributed with Symbian is incomplete. // By making sure BOOST_HAS_TR1_TUPLE is undefined, we force Boost to // use its own tuple implementation. # ifdef BOOST_HAS_TR1_TUPLE # undef BOOST_HAS_TR1_TUPLE # endif // BOOST_HAS_TR1_TUPLE // This prevents , which defines // BOOST_HAS_TR1_TUPLE, from being #included by Boost's . # define BOOST_TR1_DETAIL_CONFIG_HPP_INCLUDED # include # elif defined(__GNUC__) && (GTEST_GCC_VER_ >= 40000) // GCC 4.0+ implements tr1/tuple in the header. This does // not conform to the TR1 spec, which requires the header to be . # if !GTEST_HAS_RTTI && GTEST_GCC_VER_ < 40302 // Until version 4.3.2, gcc has a bug that causes , // which is #included by , to not compile when RTTI is // disabled. _TR1_FUNCTIONAL is the header guard for // . Hence the following #define is a hack to prevent // from being included. # define _TR1_FUNCTIONAL 1 # include # undef _TR1_FUNCTIONAL // Allows the user to #include // if he chooses to. # else # include // NOLINT # endif // !GTEST_HAS_RTTI && GTEST_GCC_VER_ < 40302 # else // If the compiler is not GCC 4.0+, we assume the user is using a // spec-conforming TR1 implementation. # include // NOLINT # endif // GTEST_USE_OWN_TR1_TUPLE #endif // GTEST_HAS_TR1_TUPLE // Determines whether clone(2) is supported. // Usually it will only be available on Linux, excluding // Linux on the Itanium architecture. // Also see http://linux.die.net/man/2/clone. #ifndef GTEST_HAS_CLONE // The user didn't tell us, so we need to figure it out. # if GTEST_OS_LINUX && !defined(__ia64__) # define GTEST_HAS_CLONE 1 # else # define GTEST_HAS_CLONE 0 # endif // GTEST_OS_LINUX && !defined(__ia64__) #endif // GTEST_HAS_CLONE // Determines whether to support stream redirection. This is used to test // output correctness and to implement death tests. #ifndef GTEST_HAS_STREAM_REDIRECTION // By default, we assume that stream redirection is supported on all // platforms except known mobile ones. # if GTEST_OS_WINDOWS_MOBILE || GTEST_OS_SYMBIAN # define GTEST_HAS_STREAM_REDIRECTION 0 # else # define GTEST_HAS_STREAM_REDIRECTION 1 # endif // !GTEST_OS_WINDOWS_MOBILE && !GTEST_OS_SYMBIAN #endif // GTEST_HAS_STREAM_REDIRECTION // Determines whether to support death tests. // Google Test does not support death tests for VC 7.1 and earlier as // abort() in a VC 7.1 application compiled as GUI in debug config // pops up a dialog window that cannot be suppressed programmatically. #if (GTEST_OS_LINUX || GTEST_OS_MAC || GTEST_OS_CYGWIN || GTEST_OS_SOLARIS || \ (GTEST_OS_WINDOWS_DESKTOP && _MSC_VER >= 1400) || \ GTEST_OS_WINDOWS_MINGW || GTEST_OS_AIX || GTEST_OS_HPUX) # define GTEST_HAS_DEATH_TEST 1 # include // NOLINT #endif // We don't support MSVC 7.1 with exceptions disabled now. Therefore // all the compilers we care about are adequate for supporting // value-parameterized tests. #define GTEST_HAS_PARAM_TEST 1 // Determines whether to support type-driven tests. // Typed tests need and variadic macros, which GCC, VC++ 8.0, // Sun Pro CC, IBM Visual Age, and HP aCC support. #if defined(__GNUC__) || (_MSC_VER >= 1400) || defined(__SUNPRO_CC) || \ defined(__IBMCPP__) || defined(__HP_aCC) # define GTEST_HAS_TYPED_TEST 1 # define GTEST_HAS_TYPED_TEST_P 1 #endif // Determines whether to support Combine(). This only makes sense when // value-parameterized tests are enabled. The implementation doesn't // work on Sun Studio since it doesn't understand templated conversion // operators. #if GTEST_HAS_PARAM_TEST && GTEST_HAS_TR1_TUPLE && !defined(__SUNPRO_CC) # define GTEST_HAS_COMBINE 1 #endif // Determines whether the system compiler uses UTF-16 for encoding wide strings. #define GTEST_WIDE_STRING_USES_UTF16_ \ (GTEST_OS_WINDOWS || GTEST_OS_CYGWIN || GTEST_OS_SYMBIAN || GTEST_OS_AIX) // Determines whether test results can be streamed to a socket. #if GTEST_OS_LINUX # define GTEST_CAN_STREAM_RESULTS_ 1 #endif // Defines some utility macros. // The GNU compiler emits a warning if nested "if" statements are followed by // an "else" statement and braces are not used to explicitly disambiguate the // "else" binding. This leads to problems with code like: // // if (gate) // ASSERT_*(condition) << "Some message"; // // The "switch (0) case 0:" idiom is used to suppress this. #ifdef __INTEL_COMPILER # define GTEST_AMBIGUOUS_ELSE_BLOCKER_ #else # define GTEST_AMBIGUOUS_ELSE_BLOCKER_ switch (0) case 0: default: // NOLINT #endif // Use this annotation at the end of a struct/class definition to // prevent the compiler from optimizing away instances that are never // used. This is useful when all interesting logic happens inside the // c'tor and / or d'tor. Example: // // struct Foo { // Foo() { ... } // } GTEST_ATTRIBUTE_UNUSED_; // // Also use it after a variable or parameter declaration to tell the // compiler the variable/parameter does not have to be used. #if defined(__GNUC__) && !defined(COMPILER_ICC) # define GTEST_ATTRIBUTE_UNUSED_ __attribute__ ((unused)) #else # define GTEST_ATTRIBUTE_UNUSED_ #endif // A macro to disallow operator= // This should be used in the private: declarations for a class. #define GTEST_DISALLOW_ASSIGN_(type)\ void operator=(type const &) // A macro to disallow copy constructor and operator= // This should be used in the private: declarations for a class. #define GTEST_DISALLOW_COPY_AND_ASSIGN_(type)\ type(type const &);\ GTEST_DISALLOW_ASSIGN_(type) // Tell the compiler to warn about unused return values for functions declared // with this macro. The macro should be used on function declarations // following the argument list: // // Sprocket* AllocateSprocket() GTEST_MUST_USE_RESULT_; #if defined(__GNUC__) && (GTEST_GCC_VER_ >= 30400) && !defined(COMPILER_ICC) # define GTEST_MUST_USE_RESULT_ __attribute__ ((warn_unused_result)) #else # define GTEST_MUST_USE_RESULT_ #endif // __GNUC__ && (GTEST_GCC_VER_ >= 30400) && !COMPILER_ICC // Determine whether the compiler supports Microsoft's Structured Exception // Handling. This is supported by several Windows compilers but generally // does not exist on any other system. #ifndef GTEST_HAS_SEH // The user didn't tell us, so we need to figure it out. # if defined(_MSC_VER) || defined(__BORLANDC__) // These two compilers are known to support SEH. # define GTEST_HAS_SEH 1 # else // Assume no SEH. # define GTEST_HAS_SEH 0 # endif #endif // GTEST_HAS_SEH #ifdef _MSC_VER # if GTEST_LINKED_AS_SHARED_LIBRARY # define GTEST_API_ __declspec(dllimport) # elif GTEST_CREATE_SHARED_LIBRARY # define GTEST_API_ __declspec(dllexport) # endif #endif // _MSC_VER #ifndef GTEST_API_ # define GTEST_API_ #endif #ifdef __GNUC__ // Ask the compiler to never inline a given function. # define GTEST_NO_INLINE_ __attribute__((noinline)) #else # define GTEST_NO_INLINE_ #endif namespace testing { class Message; namespace internal { class String; // The GTEST_COMPILE_ASSERT_ macro can be used to verify that a compile time // expression is true. For example, you could use it to verify the // size of a static array: // // GTEST_COMPILE_ASSERT_(ARRAYSIZE(content_type_names) == CONTENT_NUM_TYPES, // content_type_names_incorrect_size); // // or to make sure a struct is smaller than a certain size: // // GTEST_COMPILE_ASSERT_(sizeof(foo) < 128, foo_too_large); // // The second argument to the macro is the name of the variable. If // the expression is false, most compilers will issue a warning/error // containing the name of the variable. template struct CompileAssert { }; #define GTEST_COMPILE_ASSERT_(expr, msg) \ typedef ::testing::internal::CompileAssert<(bool(expr))> \ msg[bool(expr) ? 1 : -1] // Implementation details of GTEST_COMPILE_ASSERT_: // // - GTEST_COMPILE_ASSERT_ works by defining an array type that has -1 // elements (and thus is invalid) when the expression is false. // // - The simpler definition // // #define GTEST_COMPILE_ASSERT_(expr, msg) typedef char msg[(expr) ? 1 : -1] // // does not work, as gcc supports variable-length arrays whose sizes // are determined at run-time (this is gcc's extension and not part // of the C++ standard). As a result, gcc fails to reject the // following code with the simple definition: // // int foo; // GTEST_COMPILE_ASSERT_(foo, msg); // not supposed to compile as foo is // // not a compile-time constant. // // - By using the type CompileAssert<(bool(expr))>, we ensures that // expr is a compile-time constant. (Template arguments must be // determined at compile-time.) // // - The outter parentheses in CompileAssert<(bool(expr))> are necessary // to work around a bug in gcc 3.4.4 and 4.0.1. If we had written // // CompileAssert // // instead, these compilers will refuse to compile // // GTEST_COMPILE_ASSERT_(5 > 0, some_message); // // (They seem to think the ">" in "5 > 0" marks the end of the // template argument list.) // // - The array size is (bool(expr) ? 1 : -1), instead of simply // // ((expr) ? 1 : -1). // // This is to avoid running into a bug in MS VC 7.1, which // causes ((0.0) ? 1 : -1) to incorrectly evaluate to 1. // StaticAssertTypeEqHelper is used by StaticAssertTypeEq defined in gtest.h. // // This template is declared, but intentionally undefined. template struct StaticAssertTypeEqHelper; template struct StaticAssertTypeEqHelper {}; #if GTEST_HAS_GLOBAL_STRING typedef ::string string; #else typedef ::std::string string; #endif // GTEST_HAS_GLOBAL_STRING #if GTEST_HAS_GLOBAL_WSTRING typedef ::wstring wstring; #elif GTEST_HAS_STD_WSTRING typedef ::std::wstring wstring; #endif // GTEST_HAS_GLOBAL_WSTRING // A helper for suppressing warnings on constant condition. It just // returns 'condition'. GTEST_API_ bool IsTrue(bool condition); // Defines scoped_ptr. // This implementation of scoped_ptr is PARTIAL - it only contains // enough stuff to satisfy Google Test's need. template class scoped_ptr { public: typedef T element_type; explicit scoped_ptr(T* p = NULL) : ptr_(p) {} ~scoped_ptr() { reset(); } T& operator*() const { return *ptr_; } T* operator->() const { return ptr_; } T* get() const { return ptr_; } T* release() { T* const ptr = ptr_; ptr_ = NULL; return ptr; } void reset(T* p = NULL) { if (p != ptr_) { if (IsTrue(sizeof(T) > 0)) { // Makes sure T is a complete type. delete ptr_; } ptr_ = p; } } private: T* ptr_; GTEST_DISALLOW_COPY_AND_ASSIGN_(scoped_ptr); }; // Defines RE. // A simple C++ wrapper for . It uses the POSIX Extended // Regular Expression syntax. class GTEST_API_ RE { public: // A copy constructor is required by the Standard to initialize object // references from r-values. RE(const RE& other) { Init(other.pattern()); } // Constructs an RE from a string. RE(const ::std::string& regex) { Init(regex.c_str()); } // NOLINT #if GTEST_HAS_GLOBAL_STRING RE(const ::string& regex) { Init(regex.c_str()); } // NOLINT #endif // GTEST_HAS_GLOBAL_STRING RE(const char* regex) { Init(regex); } // NOLINT ~RE(); // Returns the string representation of the regex. const char* pattern() const { return pattern_; } // FullMatch(str, re) returns true iff regular expression re matches // the entire str. // PartialMatch(str, re) returns true iff regular expression re // matches a substring of str (including str itself). // // TODO(wan@google.com): make FullMatch() and PartialMatch() work // when str contains NUL characters. static bool FullMatch(const ::std::string& str, const RE& re) { return FullMatch(str.c_str(), re); } static bool PartialMatch(const ::std::string& str, const RE& re) { return PartialMatch(str.c_str(), re); } #if GTEST_HAS_GLOBAL_STRING static bool FullMatch(const ::string& str, const RE& re) { return FullMatch(str.c_str(), re); } static bool PartialMatch(const ::string& str, const RE& re) { return PartialMatch(str.c_str(), re); } #endif // GTEST_HAS_GLOBAL_STRING static bool FullMatch(const char* str, const RE& re); static bool PartialMatch(const char* str, const RE& re); private: void Init(const char* regex); // We use a const char* instead of a string, as Google Test may be used // where string is not available. We also do not use Google Test's own // String type here, in order to simplify dependencies between the // files. const char* pattern_; bool is_valid_; #if GTEST_USES_POSIX_RE regex_t full_regex_; // For FullMatch(). regex_t partial_regex_; // For PartialMatch(). #else // GTEST_USES_SIMPLE_RE const char* full_pattern_; // For FullMatch(); #endif GTEST_DISALLOW_ASSIGN_(RE); }; // Formats a source file path and a line number as they would appear // in an error message from the compiler used to compile this code. GTEST_API_ ::std::string FormatFileLocation(const char* file, int line); // Formats a file location for compiler-independent XML output. // Although this function is not platform dependent, we put it next to // FormatFileLocation in order to contrast the two functions. GTEST_API_ ::std::string FormatCompilerIndependentFileLocation(const char* file, int line); // Defines logging utilities: // GTEST_LOG_(severity) - logs messages at the specified severity level. The // message itself is streamed into the macro. // LogToStderr() - directs all log messages to stderr. // FlushInfoLog() - flushes informational log messages. enum GTestLogSeverity { GTEST_INFO, GTEST_WARNING, GTEST_ERROR, GTEST_FATAL }; // Formats log entry severity, provides a stream object for streaming the // log message, and terminates the message with a newline when going out of // scope. class GTEST_API_ GTestLog { public: GTestLog(GTestLogSeverity severity, const char* file, int line); // Flushes the buffers and, if severity is GTEST_FATAL, aborts the program. ~GTestLog(); ::std::ostream& GetStream() { return ::std::cerr; } private: const GTestLogSeverity severity_; GTEST_DISALLOW_COPY_AND_ASSIGN_(GTestLog); }; #define GTEST_LOG_(severity) \ ::testing::internal::GTestLog(::testing::internal::GTEST_##severity, \ __FILE__, __LINE__).GetStream() inline void LogToStderr() {} inline void FlushInfoLog() { fflush(NULL); } // INTERNAL IMPLEMENTATION - DO NOT USE. // // GTEST_CHECK_ is an all-mode assert. It aborts the program if the condition // is not satisfied. // Synopsys: // GTEST_CHECK_(boolean_condition); // or // GTEST_CHECK_(boolean_condition) << "Additional message"; // // This checks the condition and if the condition is not satisfied // it prints message about the condition violation, including the // condition itself, plus additional message streamed into it, if any, // and then it aborts the program. It aborts the program irrespective of // whether it is built in the debug mode or not. #define GTEST_CHECK_(condition) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::IsTrue(condition)) \ ; \ else \ GTEST_LOG_(FATAL) << "Condition " #condition " failed. " // An all-mode assert to verify that the given POSIX-style function // call returns 0 (indicating success). Known limitation: this // doesn't expand to a balanced 'if' statement, so enclose the macro // in {} if you need to use it as the only statement in an 'if' // branch. #define GTEST_CHECK_POSIX_SUCCESS_(posix_call) \ if (const int gtest_error = (posix_call)) \ GTEST_LOG_(FATAL) << #posix_call << "failed with error " \ << gtest_error // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Use ImplicitCast_ as a safe version of static_cast for upcasting in // the type hierarchy (e.g. casting a Foo* to a SuperclassOfFoo* or a // const Foo*). When you use ImplicitCast_, the compiler checks that // the cast is safe. Such explicit ImplicitCast_s are necessary in // surprisingly many situations where C++ demands an exact type match // instead of an argument type convertable to a target type. // // The syntax for using ImplicitCast_ is the same as for static_cast: // // ImplicitCast_(expr) // // ImplicitCast_ would have been part of the C++ standard library, // but the proposal was submitted too late. It will probably make // its way into the language in the future. // // This relatively ugly name is intentional. It prevents clashes with // similar functions users may have (e.g., implicit_cast). The internal // namespace alone is not enough because the function can be found by ADL. template inline To ImplicitCast_(To x) { return x; } // When you upcast (that is, cast a pointer from type Foo to type // SuperclassOfFoo), it's fine to use ImplicitCast_<>, since upcasts // always succeed. When you downcast (that is, cast a pointer from // type Foo to type SubclassOfFoo), static_cast<> isn't safe, because // how do you know the pointer is really of type SubclassOfFoo? It // could be a bare Foo, or of type DifferentSubclassOfFoo. Thus, // when you downcast, you should use this macro. In debug mode, we // use dynamic_cast<> to double-check the downcast is legal (we die // if it's not). In normal mode, we do the efficient static_cast<> // instead. Thus, it's important to test in debug mode to make sure // the cast is legal! // This is the only place in the code we should use dynamic_cast<>. // In particular, you SHOULDN'T be using dynamic_cast<> in order to // do RTTI (eg code like this: // if (dynamic_cast(foo)) HandleASubclass1Object(foo); // if (dynamic_cast(foo)) HandleASubclass2Object(foo); // You should design the code some other way not to need this. // // This relatively ugly name is intentional. It prevents clashes with // similar functions users may have (e.g., down_cast). The internal // namespace alone is not enough because the function can be found by ADL. template // use like this: DownCast_(foo); inline To DownCast_(From* f) { // so we only accept pointers // Ensures that To is a sub-type of From *. This test is here only // for compile-time type checking, and has no overhead in an // optimized build at run-time, as it will be optimized away // completely. if (false) { const To to = NULL; ::testing::internal::ImplicitCast_(to); } #if GTEST_HAS_RTTI // RTTI: debug mode only! GTEST_CHECK_(f == NULL || dynamic_cast(f) != NULL); #endif return static_cast(f); } // Downcasts the pointer of type Base to Derived. // Derived must be a subclass of Base. The parameter MUST // point to a class of type Derived, not any subclass of it. // When RTTI is available, the function performs a runtime // check to enforce this. template Derived* CheckedDowncastToActualType(Base* base) { #if GTEST_HAS_RTTI GTEST_CHECK_(typeid(*base) == typeid(Derived)); return dynamic_cast(base); // NOLINT #else return static_cast(base); // Poor man's downcast. #endif } #if GTEST_HAS_STREAM_REDIRECTION // Defines the stderr capturer: // CaptureStdout - starts capturing stdout. // GetCapturedStdout - stops capturing stdout and returns the captured string. // CaptureStderr - starts capturing stderr. // GetCapturedStderr - stops capturing stderr and returns the captured string. // GTEST_API_ void CaptureStdout(); GTEST_API_ String GetCapturedStdout(); GTEST_API_ void CaptureStderr(); GTEST_API_ String GetCapturedStderr(); #endif // GTEST_HAS_STREAM_REDIRECTION #if GTEST_HAS_DEATH_TEST // A copy of all command line arguments. Set by InitGoogleTest(). extern ::std::vector g_argvs; // GTEST_HAS_DEATH_TEST implies we have ::std::string. const ::std::vector& GetArgvs(); #endif // GTEST_HAS_DEATH_TEST // Defines synchronization primitives. #if GTEST_HAS_PTHREAD // Sleeps for (roughly) n milli-seconds. This function is only for // testing Google Test's own constructs. Don't use it in user tests, // either directly or indirectly. inline void SleepMilliseconds(int n) { const timespec time = { 0, // 0 seconds. n * 1000L * 1000L, // And n ms. }; nanosleep(&time, NULL); } // Allows a controller thread to pause execution of newly created // threads until notified. Instances of this class must be created // and destroyed in the controller thread. // // This class is only for testing Google Test's own constructs. Do not // use it in user tests, either directly or indirectly. class Notification { public: Notification() : notified_(false) {} // Notifies all threads created with this notification to start. Must // be called from the controller thread. void Notify() { notified_ = true; } // Blocks until the controller thread notifies. Must be called from a test // thread. void WaitForNotification() { while(!notified_) { SleepMilliseconds(10); } } private: volatile bool notified_; GTEST_DISALLOW_COPY_AND_ASSIGN_(Notification); }; // As a C-function, ThreadFuncWithCLinkage cannot be templated itself. // Consequently, it cannot select a correct instantiation of ThreadWithParam // in order to call its Run(). Introducing ThreadWithParamBase as a // non-templated base class for ThreadWithParam allows us to bypass this // problem. class ThreadWithParamBase { public: virtual ~ThreadWithParamBase() {} virtual void Run() = 0; }; // pthread_create() accepts a pointer to a function type with the C linkage. // According to the Standard (7.5/1), function types with different linkages // are different even if they are otherwise identical. Some compilers (for // example, SunStudio) treat them as different types. Since class methods // cannot be defined with C-linkage we need to define a free C-function to // pass into pthread_create(). extern "C" inline void* ThreadFuncWithCLinkage(void* thread) { static_cast(thread)->Run(); return NULL; } // Helper class for testing Google Test's multi-threading constructs. // To use it, write: // // void ThreadFunc(int param) { /* Do things with param */ } // Notification thread_can_start; // ... // // The thread_can_start parameter is optional; you can supply NULL. // ThreadWithParam thread(&ThreadFunc, 5, &thread_can_start); // thread_can_start.Notify(); // // These classes are only for testing Google Test's own constructs. Do // not use them in user tests, either directly or indirectly. template class ThreadWithParam : public ThreadWithParamBase { public: typedef void (*UserThreadFunc)(T); ThreadWithParam( UserThreadFunc func, T param, Notification* thread_can_start) : func_(func), param_(param), thread_can_start_(thread_can_start), finished_(false) { ThreadWithParamBase* const base = this; // The thread can be created only after all fields except thread_ // have been initialized. GTEST_CHECK_POSIX_SUCCESS_( pthread_create(&thread_, 0, &ThreadFuncWithCLinkage, base)); } ~ThreadWithParam() { Join(); } void Join() { if (!finished_) { GTEST_CHECK_POSIX_SUCCESS_(pthread_join(thread_, 0)); finished_ = true; } } virtual void Run() { if (thread_can_start_ != NULL) thread_can_start_->WaitForNotification(); func_(param_); } private: const UserThreadFunc func_; // User-supplied thread function. const T param_; // User-supplied parameter to the thread function. // When non-NULL, used to block execution until the controller thread // notifies. Notification* const thread_can_start_; bool finished_; // true iff we know that the thread function has finished. pthread_t thread_; // The native thread object. GTEST_DISALLOW_COPY_AND_ASSIGN_(ThreadWithParam); }; // MutexBase and Mutex implement mutex on pthreads-based platforms. They // are used in conjunction with class MutexLock: // // Mutex mutex; // ... // MutexLock lock(&mutex); // Acquires the mutex and releases it at the end // // of the current scope. // // MutexBase implements behavior for both statically and dynamically // allocated mutexes. Do not use MutexBase directly. Instead, write // the following to define a static mutex: // // GTEST_DEFINE_STATIC_MUTEX_(g_some_mutex); // // You can forward declare a static mutex like this: // // GTEST_DECLARE_STATIC_MUTEX_(g_some_mutex); // // To create a dynamic mutex, just define an object of type Mutex. class MutexBase { public: // Acquires this mutex. void Lock() { GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_lock(&mutex_)); owner_ = pthread_self(); } // Releases this mutex. void Unlock() { // We don't protect writing to owner_ here, as it's the caller's // responsibility to ensure that the current thread holds the // mutex when this is called. owner_ = 0; GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_unlock(&mutex_)); } // Does nothing if the current thread holds the mutex. Otherwise, crashes // with high probability. void AssertHeld() const { GTEST_CHECK_(owner_ == pthread_self()) << "The current thread is not holding the mutex @" << this; } // A static mutex may be used before main() is entered. It may even // be used before the dynamic initialization stage. Therefore we // must be able to initialize a static mutex object at link time. // This means MutexBase has to be a POD and its member variables // have to be public. public: pthread_mutex_t mutex_; // The underlying pthread mutex. pthread_t owner_; // The thread holding the mutex; 0 means no one holds it. }; // Forward-declares a static mutex. # define GTEST_DECLARE_STATIC_MUTEX_(mutex) \ extern ::testing::internal::MutexBase mutex // Defines and statically (i.e. at link time) initializes a static mutex. # define GTEST_DEFINE_STATIC_MUTEX_(mutex) \ ::testing::internal::MutexBase mutex = { PTHREAD_MUTEX_INITIALIZER, 0 } // The Mutex class can only be used for mutexes created at runtime. It // shares its API with MutexBase otherwise. class Mutex : public MutexBase { public: Mutex() { GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_init(&mutex_, NULL)); owner_ = 0; } ~Mutex() { GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_destroy(&mutex_)); } private: GTEST_DISALLOW_COPY_AND_ASSIGN_(Mutex); }; // We cannot name this class MutexLock as the ctor declaration would // conflict with a macro named MutexLock, which is defined on some // platforms. Hence the typedef trick below. class GTestMutexLock { public: explicit GTestMutexLock(MutexBase* mutex) : mutex_(mutex) { mutex_->Lock(); } ~GTestMutexLock() { mutex_->Unlock(); } private: MutexBase* const mutex_; GTEST_DISALLOW_COPY_AND_ASSIGN_(GTestMutexLock); }; typedef GTestMutexLock MutexLock; // Helpers for ThreadLocal. // pthread_key_create() requires DeleteThreadLocalValue() to have // C-linkage. Therefore it cannot be templatized to access // ThreadLocal. Hence the need for class // ThreadLocalValueHolderBase. class ThreadLocalValueHolderBase { public: virtual ~ThreadLocalValueHolderBase() {} }; // Called by pthread to delete thread-local data stored by // pthread_setspecific(). extern "C" inline void DeleteThreadLocalValue(void* value_holder) { delete static_cast(value_holder); } // Implements thread-local storage on pthreads-based systems. // // // Thread 1 // ThreadLocal tl(100); // 100 is the default value for each thread. // // // Thread 2 // tl.set(150); // Changes the value for thread 2 only. // EXPECT_EQ(150, tl.get()); // // // Thread 1 // EXPECT_EQ(100, tl.get()); // In thread 1, tl has the original value. // tl.set(200); // EXPECT_EQ(200, tl.get()); // // The template type argument T must have a public copy constructor. // In addition, the default ThreadLocal constructor requires T to have // a public default constructor. // // An object managed for a thread by a ThreadLocal instance is deleted // when the thread exits. Or, if the ThreadLocal instance dies in // that thread, when the ThreadLocal dies. It's the user's // responsibility to ensure that all other threads using a ThreadLocal // have exited when it dies, or the per-thread objects for those // threads will not be deleted. // // Google Test only uses global ThreadLocal objects. That means they // will die after main() has returned. Therefore, no per-thread // object managed by Google Test will be leaked as long as all threads // using Google Test have exited when main() returns. template class ThreadLocal { public: ThreadLocal() : key_(CreateKey()), default_() {} explicit ThreadLocal(const T& value) : key_(CreateKey()), default_(value) {} ~ThreadLocal() { // Destroys the managed object for the current thread, if any. DeleteThreadLocalValue(pthread_getspecific(key_)); // Releases resources associated with the key. This will *not* // delete managed objects for other threads. GTEST_CHECK_POSIX_SUCCESS_(pthread_key_delete(key_)); } T* pointer() { return GetOrCreateValue(); } const T* pointer() const { return GetOrCreateValue(); } const T& get() const { return *pointer(); } void set(const T& value) { *pointer() = value; } private: // Holds a value of type T. class ValueHolder : public ThreadLocalValueHolderBase { public: explicit ValueHolder(const T& value) : value_(value) {} T* pointer() { return &value_; } private: T value_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ValueHolder); }; static pthread_key_t CreateKey() { pthread_key_t key; // When a thread exits, DeleteThreadLocalValue() will be called on // the object managed for that thread. GTEST_CHECK_POSIX_SUCCESS_( pthread_key_create(&key, &DeleteThreadLocalValue)); return key; } T* GetOrCreateValue() const { ThreadLocalValueHolderBase* const holder = static_cast(pthread_getspecific(key_)); if (holder != NULL) { return CheckedDowncastToActualType(holder)->pointer(); } ValueHolder* const new_holder = new ValueHolder(default_); ThreadLocalValueHolderBase* const holder_base = new_holder; GTEST_CHECK_POSIX_SUCCESS_(pthread_setspecific(key_, holder_base)); return new_holder->pointer(); } // A key pthreads uses for looking up per-thread values. const pthread_key_t key_; const T default_; // The default value for each thread. GTEST_DISALLOW_COPY_AND_ASSIGN_(ThreadLocal); }; # define GTEST_IS_THREADSAFE 1 #else // GTEST_HAS_PTHREAD // A dummy implementation of synchronization primitives (mutex, lock, // and thread-local variable). Necessary for compiling Google Test where // mutex is not supported - using Google Test in multiple threads is not // supported on such platforms. class Mutex { public: Mutex() {} void AssertHeld() const {} }; # define GTEST_DECLARE_STATIC_MUTEX_(mutex) \ extern ::testing::internal::Mutex mutex # define GTEST_DEFINE_STATIC_MUTEX_(mutex) ::testing::internal::Mutex mutex class GTestMutexLock { public: explicit GTestMutexLock(Mutex*) {} // NOLINT }; typedef GTestMutexLock MutexLock; template class ThreadLocal { public: ThreadLocal() : value_() {} explicit ThreadLocal(const T& value) : value_(value) {} T* pointer() { return &value_; } const T* pointer() const { return &value_; } const T& get() const { return value_; } void set(const T& value) { value_ = value; } private: T value_; }; // The above synchronization primitives have dummy implementations. // Therefore Google Test is not thread-safe. # define GTEST_IS_THREADSAFE 0 #endif // GTEST_HAS_PTHREAD // Returns the number of threads running in the process, or 0 to indicate that // we cannot detect it. GTEST_API_ size_t GetThreadCount(); // Passing non-POD classes through ellipsis (...) crashes the ARM // compiler and generates a warning in Sun Studio. The Nokia Symbian // and the IBM XL C/C++ compiler try to instantiate a copy constructor // for objects passed through ellipsis (...), failing for uncopyable // objects. We define this to ensure that only POD is passed through // ellipsis on these systems. #if defined(__SYMBIAN32__) || defined(__IBMCPP__) || defined(__SUNPRO_CC) // We lose support for NULL detection where the compiler doesn't like // passing non-POD classes through ellipsis (...). # define GTEST_ELLIPSIS_NEEDS_POD_ 1 #else # define GTEST_CAN_COMPARE_NULL 1 #endif // The Nokia Symbian and IBM XL C/C++ compilers cannot decide between // const T& and const T* in a function template. These compilers // _can_ decide between class template specializations for T and T*, // so a tr1::type_traits-like is_pointer works. #if defined(__SYMBIAN32__) || defined(__IBMCPP__) # define GTEST_NEEDS_IS_POINTER_ 1 #endif template struct bool_constant { typedef bool_constant type; static const bool value = bool_value; }; template const bool bool_constant::value; typedef bool_constant false_type; typedef bool_constant true_type; template struct is_pointer : public false_type {}; template struct is_pointer : public true_type {}; template struct IteratorTraits { typedef typename Iterator::value_type value_type; }; template struct IteratorTraits { typedef T value_type; }; template struct IteratorTraits { typedef T value_type; }; #if GTEST_OS_WINDOWS # define GTEST_PATH_SEP_ "\\" # define GTEST_HAS_ALT_PATH_SEP_ 1 // The biggest signed integer type the compiler supports. typedef __int64 BiggestInt; #else # define GTEST_PATH_SEP_ "/" # define GTEST_HAS_ALT_PATH_SEP_ 0 typedef long long BiggestInt; // NOLINT #endif // GTEST_OS_WINDOWS // Utilities for char. // isspace(int ch) and friends accept an unsigned char or EOF. char // may be signed, depending on the compiler (or compiler flags). // Therefore we need to cast a char to unsigned char before calling // isspace(), etc. inline bool IsAlpha(char ch) { return isalpha(static_cast(ch)) != 0; } inline bool IsAlNum(char ch) { return isalnum(static_cast(ch)) != 0; } inline bool IsDigit(char ch) { return isdigit(static_cast(ch)) != 0; } inline bool IsLower(char ch) { return islower(static_cast(ch)) != 0; } inline bool IsSpace(char ch) { return isspace(static_cast(ch)) != 0; } inline bool IsUpper(char ch) { return isupper(static_cast(ch)) != 0; } inline bool IsXDigit(char ch) { return isxdigit(static_cast(ch)) != 0; } inline char ToLower(char ch) { return static_cast(tolower(static_cast(ch))); } inline char ToUpper(char ch) { return static_cast(toupper(static_cast(ch))); } // The testing::internal::posix namespace holds wrappers for common // POSIX functions. These wrappers hide the differences between // Windows/MSVC and POSIX systems. Since some compilers define these // standard functions as macros, the wrapper cannot have the same name // as the wrapped function. namespace posix { // Functions with a different name on Windows. #if GTEST_OS_WINDOWS typedef struct _stat StatStruct; # ifdef __BORLANDC__ inline int IsATTY(int fd) { return isatty(fd); } inline int StrCaseCmp(const char* s1, const char* s2) { return stricmp(s1, s2); } inline char* StrDup(const char* src) { return strdup(src); } # else // !__BORLANDC__ # if GTEST_OS_WINDOWS_MOBILE inline int IsATTY(int /* fd */) { return 0; } # else inline int IsATTY(int fd) { return _isatty(fd); } # endif // GTEST_OS_WINDOWS_MOBILE inline int StrCaseCmp(const char* s1, const char* s2) { return _stricmp(s1, s2); } inline char* StrDup(const char* src) { return _strdup(src); } # endif // __BORLANDC__ # if GTEST_OS_WINDOWS_MOBILE inline int FileNo(FILE* file) { return reinterpret_cast(_fileno(file)); } // Stat(), RmDir(), and IsDir() are not needed on Windows CE at this // time and thus not defined there. # else inline int FileNo(FILE* file) { return _fileno(file); } inline int Stat(const char* path, StatStruct* buf) { return _stat(path, buf); } inline int RmDir(const char* dir) { return _rmdir(dir); } inline bool IsDir(const StatStruct& st) { return (_S_IFDIR & st.st_mode) != 0; } # endif // GTEST_OS_WINDOWS_MOBILE #else typedef struct stat StatStruct; inline int FileNo(FILE* file) { return fileno(file); } inline int IsATTY(int fd) { return isatty(fd); } inline int Stat(const char* path, StatStruct* buf) { return stat(path, buf); } inline int StrCaseCmp(const char* s1, const char* s2) { return strcasecmp(s1, s2); } inline char* StrDup(const char* src) { return strdup(src); } inline int RmDir(const char* dir) { return rmdir(dir); } inline bool IsDir(const StatStruct& st) { return S_ISDIR(st.st_mode); } #endif // GTEST_OS_WINDOWS // Functions deprecated by MSVC 8.0. #ifdef _MSC_VER // Temporarily disable warning 4996 (deprecated function). # pragma warning(push) # pragma warning(disable:4996) #endif inline const char* StrNCpy(char* dest, const char* src, size_t n) { return strncpy(dest, src, n); } // ChDir(), FReopen(), FDOpen(), Read(), Write(), Close(), and // StrError() aren't needed on Windows CE at this time and thus not // defined there. #if !GTEST_OS_WINDOWS_MOBILE inline int ChDir(const char* dir) { return chdir(dir); } #endif inline FILE* FOpen(const char* path, const char* mode) { return fopen(path, mode); } #if !GTEST_OS_WINDOWS_MOBILE inline FILE *FReopen(const char* path, const char* mode, FILE* stream) { return freopen(path, mode, stream); } inline FILE* FDOpen(int fd, const char* mode) { return fdopen(fd, mode); } #endif inline int FClose(FILE* fp) { return fclose(fp); } #if !GTEST_OS_WINDOWS_MOBILE inline int Read(int fd, void* buf, unsigned int count) { return static_cast(read(fd, buf, count)); } inline int Write(int fd, const void* buf, unsigned int count) { return static_cast(write(fd, buf, count)); } inline int Close(int fd) { return close(fd); } inline const char* StrError(int errnum) { return strerror(errnum); } #endif inline const char* GetEnv(const char* name) { #if GTEST_OS_WINDOWS_MOBILE // We are on Windows CE, which has no environment variables. return NULL; #elif defined(__BORLANDC__) || defined(__SunOS_5_8) || defined(__SunOS_5_9) // Environment variables which we programmatically clear will be set to the // empty string rather than unset (NULL). Handle that case. const char* const env = getenv(name); return (env != NULL && env[0] != '\0') ? env : NULL; #else return getenv(name); #endif } #ifdef _MSC_VER # pragma warning(pop) // Restores the warning state. #endif #if GTEST_OS_WINDOWS_MOBILE // Windows CE has no C library. The abort() function is used in // several places in Google Test. This implementation provides a reasonable // imitation of standard behaviour. void Abort(); #else inline void Abort() { abort(); } #endif // GTEST_OS_WINDOWS_MOBILE } // namespace posix // The maximum number a BiggestInt can represent. This definition // works no matter BiggestInt is represented in one's complement or // two's complement. // // We cannot rely on numeric_limits in STL, as __int64 and long long // are not part of standard C++ and numeric_limits doesn't need to be // defined for them. const BiggestInt kMaxBiggestInt = ~(static_cast(1) << (8*sizeof(BiggestInt) - 1)); // This template class serves as a compile-time function from size to // type. It maps a size in bytes to a primitive type with that // size. e.g. // // TypeWithSize<4>::UInt // // is typedef-ed to be unsigned int (unsigned integer made up of 4 // bytes). // // Such functionality should belong to STL, but I cannot find it // there. // // Google Test uses this class in the implementation of floating-point // comparison. // // For now it only handles UInt (unsigned int) as that's all Google Test // needs. Other types can be easily added in the future if need // arises. template class TypeWithSize { public: // This prevents the user from using TypeWithSize with incorrect // values of N. typedef void UInt; }; // The specialization for size 4. template <> class TypeWithSize<4> { public: // unsigned int has size 4 in both gcc and MSVC. // // As base/basictypes.h doesn't compile on Windows, we cannot use // uint32, uint64, and etc here. typedef int Int; typedef unsigned int UInt; }; // The specialization for size 8. template <> class TypeWithSize<8> { public: #if GTEST_OS_WINDOWS typedef __int64 Int; typedef unsigned __int64 UInt; #else typedef long long Int; // NOLINT typedef unsigned long long UInt; // NOLINT #endif // GTEST_OS_WINDOWS }; // Integer types of known sizes. typedef TypeWithSize<4>::Int Int32; typedef TypeWithSize<4>::UInt UInt32; typedef TypeWithSize<8>::Int Int64; typedef TypeWithSize<8>::UInt UInt64; typedef TypeWithSize<8>::Int TimeInMillis; // Represents time in milliseconds. // Utilities for command line flags and environment variables. // Macro for referencing flags. #define GTEST_FLAG(name) FLAGS_gtest_##name // Macros for declaring flags. #define GTEST_DECLARE_bool_(name) GTEST_API_ extern bool GTEST_FLAG(name) #define GTEST_DECLARE_int32_(name) \ GTEST_API_ extern ::testing::internal::Int32 GTEST_FLAG(name) #define GTEST_DECLARE_string_(name) \ GTEST_API_ extern ::testing::internal::String GTEST_FLAG(name) // Macros for defining flags. #define GTEST_DEFINE_bool_(name, default_val, doc) \ GTEST_API_ bool GTEST_FLAG(name) = (default_val) #define GTEST_DEFINE_int32_(name, default_val, doc) \ GTEST_API_ ::testing::internal::Int32 GTEST_FLAG(name) = (default_val) #define GTEST_DEFINE_string_(name, default_val, doc) \ GTEST_API_ ::testing::internal::String GTEST_FLAG(name) = (default_val) // Parses 'str' for a 32-bit signed integer. If successful, writes the result // to *value and returns true; otherwise leaves *value unchanged and returns // false. // TODO(chandlerc): Find a better way to refactor flag and environment parsing // out of both gtest-port.cc and gtest.cc to avoid exporting this utility // function. bool ParseInt32(const Message& src_text, const char* str, Int32* value); // Parses a bool/Int32/string from the environment variable // corresponding to the given Google Test flag. bool BoolFromGTestEnv(const char* flag, bool default_val); GTEST_API_ Int32 Int32FromGTestEnv(const char* flag, Int32 default_val); const char* StringFromGTestEnv(const char* flag, const char* default_val); } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PORT_H_ #if GTEST_OS_LINUX # include # include # include # include #endif // GTEST_OS_LINUX #include #include #include #include #include // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: wan@google.com (Zhanyong Wan), eefacm@gmail.com (Sean Mcafee) // // The Google C++ Testing Framework (Google Test) // // This header file declares the String class and functions used internally by // Google Test. They are subject to change without notice. They should not used // by code external to Google Test. // // This header file is #included by . // It should not be #included by other files. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_ #ifdef __BORLANDC__ // string.h is not guaranteed to provide strcpy on C++ Builder. # include #endif #include #include namespace testing { namespace internal { // String - a UTF-8 string class. // // For historic reasons, we don't use std::string. // // TODO(wan@google.com): replace this class with std::string or // implement it in terms of the latter. // // Note that String can represent both NULL and the empty string, // while std::string cannot represent NULL. // // NULL and the empty string are considered different. NULL is less // than anything (including the empty string) except itself. // // This class only provides minimum functionality necessary for // implementing Google Test. We do not intend to implement a full-fledged // string class here. // // Since the purpose of this class is to provide a substitute for // std::string on platforms where it cannot be used, we define a copy // constructor and assignment operators such that we don't need // conditional compilation in a lot of places. // // In order to make the representation efficient, the d'tor of String // is not virtual. Therefore DO NOT INHERIT FROM String. class GTEST_API_ String { public: // Static utility methods // Returns the input enclosed in double quotes if it's not NULL; // otherwise returns "(null)". For example, "\"Hello\"" is returned // for input "Hello". // // This is useful for printing a C string in the syntax of a literal. // // Known issue: escape sequences are not handled yet. static String ShowCStringQuoted(const char* c_str); // Clones a 0-terminated C string, allocating memory using new. The // caller is responsible for deleting the return value using // delete[]. Returns the cloned string, or NULL if the input is // NULL. // // This is different from strdup() in string.h, which allocates // memory using malloc(). static const char* CloneCString(const char* c_str); #if GTEST_OS_WINDOWS_MOBILE // Windows CE does not have the 'ANSI' versions of Win32 APIs. To be // able to pass strings to Win32 APIs on CE we need to convert them // to 'Unicode', UTF-16. // Creates a UTF-16 wide string from the given ANSI string, allocating // memory using new. The caller is responsible for deleting the return // value using delete[]. Returns the wide string, or NULL if the // input is NULL. // // The wide string is created using the ANSI codepage (CP_ACP) to // match the behaviour of the ANSI versions of Win32 calls and the // C runtime. static LPCWSTR AnsiToUtf16(const char* c_str); // Creates an ANSI string from the given wide string, allocating // memory using new. The caller is responsible for deleting the return // value using delete[]. Returns the ANSI string, or NULL if the // input is NULL. // // The returned string is created using the ANSI codepage (CP_ACP) to // match the behaviour of the ANSI versions of Win32 calls and the // C runtime. static const char* Utf16ToAnsi(LPCWSTR utf16_str); #endif // Compares two C strings. Returns true iff they have the same content. // // Unlike strcmp(), this function can handle NULL argument(s). A // NULL C string is considered different to any non-NULL C string, // including the empty string. static bool CStringEquals(const char* lhs, const char* rhs); // Converts a wide C string to a String using the UTF-8 encoding. // NULL will be converted to "(null)". If an error occurred during // the conversion, "(failed to convert from wide string)" is // returned. static String ShowWideCString(const wchar_t* wide_c_str); // Similar to ShowWideCString(), except that this function encloses // the converted string in double quotes. static String ShowWideCStringQuoted(const wchar_t* wide_c_str); // Compares two wide C strings. Returns true iff they have the same // content. // // Unlike wcscmp(), this function can handle NULL argument(s). A // NULL C string is considered different to any non-NULL C string, // including the empty string. static bool WideCStringEquals(const wchar_t* lhs, const wchar_t* rhs); // Compares two C strings, ignoring case. Returns true iff they // have the same content. // // Unlike strcasecmp(), this function can handle NULL argument(s). // A NULL C string is considered different to any non-NULL C string, // including the empty string. static bool CaseInsensitiveCStringEquals(const char* lhs, const char* rhs); // Compares two wide C strings, ignoring case. Returns true iff they // have the same content. // // Unlike wcscasecmp(), this function can handle NULL argument(s). // A NULL C string is considered different to any non-NULL wide C string, // including the empty string. // NB: The implementations on different platforms slightly differ. // On windows, this method uses _wcsicmp which compares according to LC_CTYPE // environment variable. On GNU platform this method uses wcscasecmp // which compares according to LC_CTYPE category of the current locale. // On MacOS X, it uses towlower, which also uses LC_CTYPE category of the // current locale. static bool CaseInsensitiveWideCStringEquals(const wchar_t* lhs, const wchar_t* rhs); // Formats a list of arguments to a String, using the same format // spec string as for printf. // // We do not use the StringPrintf class as it is not universally // available. // // The result is limited to 4096 characters (including the tailing // 0). If 4096 characters are not enough to format the input, // "" is returned. static String Format(const char* format, ...); // C'tors // The default c'tor constructs a NULL string. String() : c_str_(NULL), length_(0) {} // Constructs a String by cloning a 0-terminated C string. String(const char* a_c_str) { // NOLINT if (a_c_str == NULL) { c_str_ = NULL; length_ = 0; } else { ConstructNonNull(a_c_str, strlen(a_c_str)); } } // Constructs a String by copying a given number of chars from a // buffer. E.g. String("hello", 3) creates the string "hel", // String("a\0bcd", 4) creates "a\0bc", String(NULL, 0) creates "", // and String(NULL, 1) results in access violation. String(const char* buffer, size_t a_length) { ConstructNonNull(buffer, a_length); } // The copy c'tor creates a new copy of the string. The two // String objects do not share content. String(const String& str) : c_str_(NULL), length_(0) { *this = str; } // D'tor. String is intended to be a final class, so the d'tor // doesn't need to be virtual. ~String() { delete[] c_str_; } // Allows a String to be implicitly converted to an ::std::string or // ::string, and vice versa. Converting a String containing a NULL // pointer to ::std::string or ::string is undefined behavior. // Converting a ::std::string or ::string containing an embedded NUL // character to a String will result in the prefix up to the first // NUL character. String(const ::std::string& str) { ConstructNonNull(str.c_str(), str.length()); } operator ::std::string() const { return ::std::string(c_str(), length()); } #if GTEST_HAS_GLOBAL_STRING String(const ::string& str) { ConstructNonNull(str.c_str(), str.length()); } operator ::string() const { return ::string(c_str(), length()); } #endif // GTEST_HAS_GLOBAL_STRING // Returns true iff this is an empty string (i.e. ""). bool empty() const { return (c_str() != NULL) && (length() == 0); } // Compares this with another String. // Returns < 0 if this is less than rhs, 0 if this is equal to rhs, or > 0 // if this is greater than rhs. int Compare(const String& rhs) const; // Returns true iff this String equals the given C string. A NULL // string and a non-NULL string are considered not equal. bool operator==(const char* a_c_str) const { return Compare(a_c_str) == 0; } // Returns true iff this String is less than the given String. A // NULL string is considered less than "". bool operator<(const String& rhs) const { return Compare(rhs) < 0; } // Returns true iff this String doesn't equal the given C string. A NULL // string and a non-NULL string are considered not equal. bool operator!=(const char* a_c_str) const { return !(*this == a_c_str); } // Returns true iff this String ends with the given suffix. *Any* // String is considered to end with a NULL or empty suffix. bool EndsWith(const char* suffix) const; // Returns true iff this String ends with the given suffix, not considering // case. Any String is considered to end with a NULL or empty suffix. bool EndsWithCaseInsensitive(const char* suffix) const; // Returns the length of the encapsulated string, or 0 if the // string is NULL. size_t length() const { return length_; } // Gets the 0-terminated C string this String object represents. // The String object still owns the string. Therefore the caller // should NOT delete the return value. const char* c_str() const { return c_str_; } // Assigns a C string to this object. Self-assignment works. const String& operator=(const char* a_c_str) { return *this = String(a_c_str); } // Assigns a String object to this object. Self-assignment works. const String& operator=(const String& rhs) { if (this != &rhs) { delete[] c_str_; if (rhs.c_str() == NULL) { c_str_ = NULL; length_ = 0; } else { ConstructNonNull(rhs.c_str(), rhs.length()); } } return *this; } private: // Constructs a non-NULL String from the given content. This // function can only be called when c_str_ has not been allocated. // ConstructNonNull(NULL, 0) results in an empty string (""). // ConstructNonNull(NULL, non_zero) is undefined behavior. void ConstructNonNull(const char* buffer, size_t a_length) { char* const str = new char[a_length + 1]; memcpy(str, buffer, a_length); str[a_length] = '\0'; c_str_ = str; length_ = a_length; } const char* c_str_; size_t length_; }; // class String // Streams a String to an ostream. Each '\0' character in the String // is replaced with "\\0". inline ::std::ostream& operator<<(::std::ostream& os, const String& str) { if (str.c_str() == NULL) { os << "(null)"; } else { const char* const c_str = str.c_str(); for (size_t i = 0; i != str.length(); i++) { if (c_str[i] == '\0') { os << "\\0"; } else { os << c_str[i]; } } } return os; } // Gets the content of the stringstream's buffer as a String. Each '\0' // character in the buffer is replaced with "\\0". GTEST_API_ String StringStreamToString(::std::stringstream* stream); // Converts a streamable value to a String. A NULL pointer is // converted to "(null)". When the input value is a ::string, // ::std::string, ::wstring, or ::std::wstring object, each NUL // character in it is replaced with "\\0". // Declared here but defined in gtest.h, so that it has access // to the definition of the Message class, required by the ARM // compiler. template String StreamableToString(const T& streamable); } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_ // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: keith.ray@gmail.com (Keith Ray) // // Google Test filepath utilities // // This header file declares classes and functions used internally by // Google Test. They are subject to change without notice. // // This file is #included in . // Do not include this header file separately! #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_FILEPATH_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_FILEPATH_H_ namespace testing { namespace internal { // FilePath - a class for file and directory pathname manipulation which // handles platform-specific conventions (like the pathname separator). // Used for helper functions for naming files in a directory for xml output. // Except for Set methods, all methods are const or static, which provides an // "immutable value object" -- useful for peace of mind. // A FilePath with a value ending in a path separator ("like/this/") represents // a directory, otherwise it is assumed to represent a file. In either case, // it may or may not represent an actual file or directory in the file system. // Names are NOT checked for syntax correctness -- no checking for illegal // characters, malformed paths, etc. class GTEST_API_ FilePath { public: FilePath() : pathname_("") { } FilePath(const FilePath& rhs) : pathname_(rhs.pathname_) { } explicit FilePath(const char* pathname) : pathname_(pathname) { Normalize(); } explicit FilePath(const String& pathname) : pathname_(pathname) { Normalize(); } FilePath& operator=(const FilePath& rhs) { Set(rhs); return *this; } void Set(const FilePath& rhs) { pathname_ = rhs.pathname_; } String ToString() const { return pathname_; } const char* c_str() const { return pathname_.c_str(); } // Returns the current working directory, or "" if unsuccessful. static FilePath GetCurrentDir(); // Given directory = "dir", base_name = "test", number = 0, // extension = "xml", returns "dir/test.xml". If number is greater // than zero (e.g., 12), returns "dir/test_12.xml". // On Windows platform, uses \ as the separator rather than /. static FilePath MakeFileName(const FilePath& directory, const FilePath& base_name, int number, const char* extension); // Given directory = "dir", relative_path = "test.xml", // returns "dir/test.xml". // On Windows, uses \ as the separator rather than /. static FilePath ConcatPaths(const FilePath& directory, const FilePath& relative_path); // Returns a pathname for a file that does not currently exist. The pathname // will be directory/base_name.extension or // directory/base_name_.extension if directory/base_name.extension // already exists. The number will be incremented until a pathname is found // that does not already exist. // Examples: 'dir/foo_test.xml' or 'dir/foo_test_1.xml'. // There could be a race condition if two or more processes are calling this // function at the same time -- they could both pick the same filename. static FilePath GenerateUniqueFileName(const FilePath& directory, const FilePath& base_name, const char* extension); // Returns true iff the path is NULL or "". bool IsEmpty() const { return c_str() == NULL || *c_str() == '\0'; } // If input name has a trailing separator character, removes it and returns // the name, otherwise return the name string unmodified. // On Windows platform, uses \ as the separator, other platforms use /. FilePath RemoveTrailingPathSeparator() const; // Returns a copy of the FilePath with the directory part removed. // Example: FilePath("path/to/file").RemoveDirectoryName() returns // FilePath("file"). If there is no directory part ("just_a_file"), it returns // the FilePath unmodified. If there is no file part ("just_a_dir/") it // returns an empty FilePath (""). // On Windows platform, '\' is the path separator, otherwise it is '/'. FilePath RemoveDirectoryName() const; // RemoveFileName returns the directory path with the filename removed. // Example: FilePath("path/to/file").RemoveFileName() returns "path/to/". // If the FilePath is "a_file" or "/a_file", RemoveFileName returns // FilePath("./") or, on Windows, FilePath(".\\"). If the filepath does // not have a file, like "just/a/dir/", it returns the FilePath unmodified. // On Windows platform, '\' is the path separator, otherwise it is '/'. FilePath RemoveFileName() const; // Returns a copy of the FilePath with the case-insensitive extension removed. // Example: FilePath("dir/file.exe").RemoveExtension("EXE") returns // FilePath("dir/file"). If a case-insensitive extension is not // found, returns a copy of the original FilePath. FilePath RemoveExtension(const char* extension) const; // Creates directories so that path exists. Returns true if successful or if // the directories already exist; returns false if unable to create // directories for any reason. Will also return false if the FilePath does // not represent a directory (that is, it doesn't end with a path separator). bool CreateDirectoriesRecursively() const; // Create the directory so that path exists. Returns true if successful or // if the directory already exists; returns false if unable to create the // directory for any reason, including if the parent directory does not // exist. Not named "CreateDirectory" because that's a macro on Windows. bool CreateFolder() const; // Returns true if FilePath describes something in the file-system, // either a file, directory, or whatever, and that something exists. bool FileOrDirectoryExists() const; // Returns true if pathname describes a directory in the file-system // that exists. bool DirectoryExists() const; // Returns true if FilePath ends with a path separator, which indicates that // it is intended to represent a directory. Returns false otherwise. // This does NOT check that a directory (or file) actually exists. bool IsDirectory() const; // Returns true if pathname describes a root directory. (Windows has one // root directory per disk drive.) bool IsRootDirectory() const; // Returns true if pathname describes an absolute path. bool IsAbsolutePath() const; private: // Replaces multiple consecutive separators with a single separator. // For example, "bar///foo" becomes "bar/foo". Does not eliminate other // redundancies that might be in a pathname involving "." or "..". // // A pathname with multiple consecutive separators may occur either through // user error or as a result of some scripts or APIs that generate a pathname // with a trailing separator. On other platforms the same API or script // may NOT generate a pathname with a trailing "/". Then elsewhere that // pathname may have another "/" and pathname components added to it, // without checking for the separator already being there. // The script language and operating system may allow paths like "foo//bar" // but some of the functions in FilePath will not handle that correctly. In // particular, RemoveTrailingPathSeparator() only removes one separator, and // it is called in CreateDirectoriesRecursively() assuming that it will change // a pathname from directory syntax (trailing separator) to filename syntax. // // On Windows this method also replaces the alternate path separator '/' with // the primary path separator '\\', so that for example "bar\\/\\foo" becomes // "bar\\foo". void Normalize(); // Returns a pointer to the last occurence of a valid path separator in // the FilePath. On Windows, for example, both '/' and '\' are valid path // separators. Returns NULL if no path separator was found. const char* FindLastPathSeparator() const; String pathname_; }; // class FilePath } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_FILEPATH_H_ // This file was GENERATED by command: // pump.py gtest-type-util.h.pump // DO NOT EDIT BY HAND!!! // Copyright 2008 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // Type utilities needed for implementing typed and type-parameterized // tests. This file is generated by a SCRIPT. DO NOT EDIT BY HAND! // // Currently we support at most 50 types in a list, and at most 50 // type-parameterized tests in one type-parameterized test case. // Please contact googletestframework@googlegroups.com if you need // more. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TYPE_UTIL_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TYPE_UTIL_H_ // #ifdef __GNUC__ is too general here. It is possible to use gcc without using // libstdc++ (which is where cxxabi.h comes from). # ifdef __GLIBCXX__ # include # elif defined(__HP_aCC) # include # endif // __GLIBCXX__ namespace testing { namespace internal { // GetTypeName() returns a human-readable name of type T. // NB: This function is also used in Google Mock, so don't move it inside of // the typed-test-only section below. template String GetTypeName() { # if GTEST_HAS_RTTI const char* const name = typeid(T).name(); # if defined(__GLIBCXX__) || defined(__HP_aCC) int status = 0; // gcc's implementation of typeid(T).name() mangles the type name, // so we have to demangle it. # ifdef __GLIBCXX__ using abi::__cxa_demangle; # endif // __GLIBCXX__ char* const readable_name = __cxa_demangle(name, 0, 0, &status); const String name_str(status == 0 ? readable_name : name); free(readable_name); return name_str; # else return name; # endif // __GLIBCXX__ || __HP_aCC # else return ""; # endif // GTEST_HAS_RTTI } #if GTEST_HAS_TYPED_TEST || GTEST_HAS_TYPED_TEST_P // AssertyTypeEq::type is defined iff T1 and T2 are the same // type. This can be used as a compile-time assertion to ensure that // two types are equal. template struct AssertTypeEq; template struct AssertTypeEq { typedef bool type; }; // A unique type used as the default value for the arguments of class // template Types. This allows us to simulate variadic templates // (e.g. Types, Type, and etc), which C++ doesn't // support directly. struct None {}; // The following family of struct and struct templates are used to // represent type lists. In particular, TypesN // represents a type list with N types (T1, T2, ..., and TN) in it. // Except for Types0, every struct in the family has two member types: // Head for the first type in the list, and Tail for the rest of the // list. // The empty type list. struct Types0 {}; // Type lists of length 1, 2, 3, and so on. template struct Types1 { typedef T1 Head; typedef Types0 Tail; }; template struct Types2 { typedef T1 Head; typedef Types1 Tail; }; template struct Types3 { typedef T1 Head; typedef Types2 Tail; }; template struct Types4 { typedef T1 Head; typedef Types3 Tail; }; template struct Types5 { typedef T1 Head; typedef Types4 Tail; }; template struct Types6 { typedef T1 Head; typedef Types5 Tail; }; template struct Types7 { typedef T1 Head; typedef Types6 Tail; }; template struct Types8 { typedef T1 Head; typedef Types7 Tail; }; template struct Types9 { typedef T1 Head; typedef Types8 Tail; }; template struct Types10 { typedef T1 Head; typedef Types9 Tail; }; template struct Types11 { typedef T1 Head; typedef Types10 Tail; }; template struct Types12 { typedef T1 Head; typedef Types11 Tail; }; template struct Types13 { typedef T1 Head; typedef Types12 Tail; }; template struct Types14 { typedef T1 Head; typedef Types13 Tail; }; template struct Types15 { typedef T1 Head; typedef Types14 Tail; }; template struct Types16 { typedef T1 Head; typedef Types15 Tail; }; template struct Types17 { typedef T1 Head; typedef Types16 Tail; }; template struct Types18 { typedef T1 Head; typedef Types17 Tail; }; template struct Types19 { typedef T1 Head; typedef Types18 Tail; }; template struct Types20 { typedef T1 Head; typedef Types19 Tail; }; template struct Types21 { typedef T1 Head; typedef Types20 Tail; }; template struct Types22 { typedef T1 Head; typedef Types21 Tail; }; template struct Types23 { typedef T1 Head; typedef Types22 Tail; }; template struct Types24 { typedef T1 Head; typedef Types23 Tail; }; template struct Types25 { typedef T1 Head; typedef Types24 Tail; }; template struct Types26 { typedef T1 Head; typedef Types25 Tail; }; template struct Types27 { typedef T1 Head; typedef Types26 Tail; }; template struct Types28 { typedef T1 Head; typedef Types27 Tail; }; template struct Types29 { typedef T1 Head; typedef Types28 Tail; }; template struct Types30 { typedef T1 Head; typedef Types29 Tail; }; template struct Types31 { typedef T1 Head; typedef Types30 Tail; }; template struct Types32 { typedef T1 Head; typedef Types31 Tail; }; template struct Types33 { typedef T1 Head; typedef Types32 Tail; }; template struct Types34 { typedef T1 Head; typedef Types33 Tail; }; template struct Types35 { typedef T1 Head; typedef Types34 Tail; }; template struct Types36 { typedef T1 Head; typedef Types35 Tail; }; template struct Types37 { typedef T1 Head; typedef Types36 Tail; }; template struct Types38 { typedef T1 Head; typedef Types37 Tail; }; template struct Types39 { typedef T1 Head; typedef Types38 Tail; }; template struct Types40 { typedef T1 Head; typedef Types39 Tail; }; template struct Types41 { typedef T1 Head; typedef Types40 Tail; }; template struct Types42 { typedef T1 Head; typedef Types41 Tail; }; template struct Types43 { typedef T1 Head; typedef Types42 Tail; }; template struct Types44 { typedef T1 Head; typedef Types43 Tail; }; template struct Types45 { typedef T1 Head; typedef Types44 Tail; }; template struct Types46 { typedef T1 Head; typedef Types45 Tail; }; template struct Types47 { typedef T1 Head; typedef Types46 Tail; }; template struct Types48 { typedef T1 Head; typedef Types47 Tail; }; template struct Types49 { typedef T1 Head; typedef Types48 Tail; }; template struct Types50 { typedef T1 Head; typedef Types49 Tail; }; } // namespace internal // We don't want to require the users to write TypesN<...> directly, // as that would require them to count the length. Types<...> is much // easier to write, but generates horrible messages when there is a // compiler error, as gcc insists on printing out each template // argument, even if it has the default value (this means Types // will appear as Types in the compiler // errors). // // Our solution is to combine the best part of the two approaches: a // user would write Types, and Google Test will translate // that to TypesN internally to make error messages // readable. The translation is done by the 'type' member of the // Types template. template struct Types { typedef internal::Types50 type; }; template <> struct Types { typedef internal::Types0 type; }; template struct Types { typedef internal::Types1 type; }; template struct Types { typedef internal::Types2 type; }; template struct Types { typedef internal::Types3 type; }; template struct Types { typedef internal::Types4 type; }; template struct Types { typedef internal::Types5 type; }; template struct Types { typedef internal::Types6 type; }; template struct Types { typedef internal::Types7 type; }; template struct Types { typedef internal::Types8 type; }; template struct Types { typedef internal::Types9 type; }; template struct Types { typedef internal::Types10 type; }; template struct Types { typedef internal::Types11 type; }; template struct Types { typedef internal::Types12 type; }; template struct Types { typedef internal::Types13 type; }; template struct Types { typedef internal::Types14 type; }; template struct Types { typedef internal::Types15 type; }; template struct Types { typedef internal::Types16 type; }; template struct Types { typedef internal::Types17 type; }; template struct Types { typedef internal::Types18 type; }; template struct Types { typedef internal::Types19 type; }; template struct Types { typedef internal::Types20 type; }; template struct Types { typedef internal::Types21 type; }; template struct Types { typedef internal::Types22 type; }; template struct Types { typedef internal::Types23 type; }; template struct Types { typedef internal::Types24 type; }; template struct Types { typedef internal::Types25 type; }; template struct Types { typedef internal::Types26 type; }; template struct Types { typedef internal::Types27 type; }; template struct Types { typedef internal::Types28 type; }; template struct Types { typedef internal::Types29 type; }; template struct Types { typedef internal::Types30 type; }; template struct Types { typedef internal::Types31 type; }; template struct Types { typedef internal::Types32 type; }; template struct Types { typedef internal::Types33 type; }; template struct Types { typedef internal::Types34 type; }; template struct Types { typedef internal::Types35 type; }; template struct Types { typedef internal::Types36 type; }; template struct Types { typedef internal::Types37 type; }; template struct Types { typedef internal::Types38 type; }; template struct Types { typedef internal::Types39 type; }; template struct Types { typedef internal::Types40 type; }; template struct Types { typedef internal::Types41 type; }; template struct Types { typedef internal::Types42 type; }; template struct Types { typedef internal::Types43 type; }; template struct Types { typedef internal::Types44 type; }; template struct Types { typedef internal::Types45 type; }; template struct Types { typedef internal::Types46 type; }; template struct Types { typedef internal::Types47 type; }; template struct Types { typedef internal::Types48 type; }; template struct Types { typedef internal::Types49 type; }; namespace internal { # define GTEST_TEMPLATE_ template class // The template "selector" struct TemplateSel is used to // represent Tmpl, which must be a class template with one type // parameter, as a type. TemplateSel::Bind::type is defined // as the type Tmpl. This allows us to actually instantiate the // template "selected" by TemplateSel. // // This trick is necessary for simulating typedef for class templates, // which C++ doesn't support directly. template struct TemplateSel { template struct Bind { typedef Tmpl type; }; }; # define GTEST_BIND_(TmplSel, T) \ TmplSel::template Bind::type // A unique struct template used as the default value for the // arguments of class template Templates. This allows us to simulate // variadic templates (e.g. Templates, Templates, // and etc), which C++ doesn't support directly. template struct NoneT {}; // The following family of struct and struct templates are used to // represent template lists. In particular, TemplatesN represents a list of N templates (T1, T2, ..., and TN). Except // for Templates0, every struct in the family has two member types: // Head for the selector of the first template in the list, and Tail // for the rest of the list. // The empty template list. struct Templates0 {}; // Template lists of length 1, 2, 3, and so on. template struct Templates1 { typedef TemplateSel Head; typedef Templates0 Tail; }; template struct Templates2 { typedef TemplateSel Head; typedef Templates1 Tail; }; template struct Templates3 { typedef TemplateSel Head; typedef Templates2 Tail; }; template struct Templates4 { typedef TemplateSel Head; typedef Templates3 Tail; }; template struct Templates5 { typedef TemplateSel Head; typedef Templates4 Tail; }; template struct Templates6 { typedef TemplateSel Head; typedef Templates5 Tail; }; template struct Templates7 { typedef TemplateSel Head; typedef Templates6 Tail; }; template struct Templates8 { typedef TemplateSel Head; typedef Templates7 Tail; }; template struct Templates9 { typedef TemplateSel Head; typedef Templates8 Tail; }; template struct Templates10 { typedef TemplateSel Head; typedef Templates9 Tail; }; template struct Templates11 { typedef TemplateSel Head; typedef Templates10 Tail; }; template struct Templates12 { typedef TemplateSel Head; typedef Templates11 Tail; }; template struct Templates13 { typedef TemplateSel Head; typedef Templates12 Tail; }; template struct Templates14 { typedef TemplateSel Head; typedef Templates13 Tail; }; template struct Templates15 { typedef TemplateSel Head; typedef Templates14 Tail; }; template struct Templates16 { typedef TemplateSel Head; typedef Templates15 Tail; }; template struct Templates17 { typedef TemplateSel Head; typedef Templates16 Tail; }; template struct Templates18 { typedef TemplateSel Head; typedef Templates17 Tail; }; template struct Templates19 { typedef TemplateSel Head; typedef Templates18 Tail; }; template struct Templates20 { typedef TemplateSel Head; typedef Templates19 Tail; }; template struct Templates21 { typedef TemplateSel Head; typedef Templates20 Tail; }; template struct Templates22 { typedef TemplateSel Head; typedef Templates21 Tail; }; template struct Templates23 { typedef TemplateSel Head; typedef Templates22 Tail; }; template struct Templates24 { typedef TemplateSel Head; typedef Templates23 Tail; }; template struct Templates25 { typedef TemplateSel Head; typedef Templates24 Tail; }; template struct Templates26 { typedef TemplateSel Head; typedef Templates25 Tail; }; template struct Templates27 { typedef TemplateSel Head; typedef Templates26 Tail; }; template struct Templates28 { typedef TemplateSel Head; typedef Templates27 Tail; }; template struct Templates29 { typedef TemplateSel Head; typedef Templates28 Tail; }; template struct Templates30 { typedef TemplateSel Head; typedef Templates29 Tail; }; template struct Templates31 { typedef TemplateSel Head; typedef Templates30 Tail; }; template struct Templates32 { typedef TemplateSel Head; typedef Templates31 Tail; }; template struct Templates33 { typedef TemplateSel Head; typedef Templates32 Tail; }; template struct Templates34 { typedef TemplateSel Head; typedef Templates33 Tail; }; template struct Templates35 { typedef TemplateSel Head; typedef Templates34 Tail; }; template struct Templates36 { typedef TemplateSel Head; typedef Templates35 Tail; }; template struct Templates37 { typedef TemplateSel Head; typedef Templates36 Tail; }; template struct Templates38 { typedef TemplateSel Head; typedef Templates37 Tail; }; template struct Templates39 { typedef TemplateSel Head; typedef Templates38 Tail; }; template struct Templates40 { typedef TemplateSel Head; typedef Templates39 Tail; }; template struct Templates41 { typedef TemplateSel Head; typedef Templates40 Tail; }; template struct Templates42 { typedef TemplateSel Head; typedef Templates41 Tail; }; template struct Templates43 { typedef TemplateSel Head; typedef Templates42 Tail; }; template struct Templates44 { typedef TemplateSel Head; typedef Templates43 Tail; }; template struct Templates45 { typedef TemplateSel Head; typedef Templates44 Tail; }; template struct Templates46 { typedef TemplateSel Head; typedef Templates45 Tail; }; template struct Templates47 { typedef TemplateSel Head; typedef Templates46 Tail; }; template struct Templates48 { typedef TemplateSel Head; typedef Templates47 Tail; }; template struct Templates49 { typedef TemplateSel Head; typedef Templates48 Tail; }; template struct Templates50 { typedef TemplateSel Head; typedef Templates49 Tail; }; // We don't want to require the users to write TemplatesN<...> directly, // as that would require them to count the length. Templates<...> is much // easier to write, but generates horrible messages when there is a // compiler error, as gcc insists on printing out each template // argument, even if it has the default value (this means Templates // will appear as Templates in the compiler // errors). // // Our solution is to combine the best part of the two approaches: a // user would write Templates, and Google Test will translate // that to TemplatesN internally to make error messages // readable. The translation is done by the 'type' member of the // Templates template. template struct Templates { typedef Templates50 type; }; template <> struct Templates { typedef Templates0 type; }; template struct Templates { typedef Templates1 type; }; template struct Templates { typedef Templates2 type; }; template struct Templates { typedef Templates3 type; }; template struct Templates { typedef Templates4 type; }; template struct Templates { typedef Templates5 type; }; template struct Templates { typedef Templates6 type; }; template struct Templates { typedef Templates7 type; }; template struct Templates { typedef Templates8 type; }; template struct Templates { typedef Templates9 type; }; template struct Templates { typedef Templates10 type; }; template struct Templates { typedef Templates11 type; }; template struct Templates { typedef Templates12 type; }; template struct Templates { typedef Templates13 type; }; template struct Templates { typedef Templates14 type; }; template struct Templates { typedef Templates15 type; }; template struct Templates { typedef Templates16 type; }; template struct Templates { typedef Templates17 type; }; template struct Templates { typedef Templates18 type; }; template struct Templates { typedef Templates19 type; }; template struct Templates { typedef Templates20 type; }; template struct Templates { typedef Templates21 type; }; template struct Templates { typedef Templates22 type; }; template struct Templates { typedef Templates23 type; }; template struct Templates { typedef Templates24 type; }; template struct Templates { typedef Templates25 type; }; template struct Templates { typedef Templates26 type; }; template struct Templates { typedef Templates27 type; }; template struct Templates { typedef Templates28 type; }; template struct Templates { typedef Templates29 type; }; template struct Templates { typedef Templates30 type; }; template struct Templates { typedef Templates31 type; }; template struct Templates { typedef Templates32 type; }; template struct Templates { typedef Templates33 type; }; template struct Templates { typedef Templates34 type; }; template struct Templates { typedef Templates35 type; }; template struct Templates { typedef Templates36 type; }; template struct Templates { typedef Templates37 type; }; template struct Templates { typedef Templates38 type; }; template struct Templates { typedef Templates39 type; }; template struct Templates { typedef Templates40 type; }; template struct Templates { typedef Templates41 type; }; template struct Templates { typedef Templates42 type; }; template struct Templates { typedef Templates43 type; }; template struct Templates { typedef Templates44 type; }; template struct Templates { typedef Templates45 type; }; template struct Templates { typedef Templates46 type; }; template struct Templates { typedef Templates47 type; }; template struct Templates { typedef Templates48 type; }; template struct Templates { typedef Templates49 type; }; // The TypeList template makes it possible to use either a single type // or a Types<...> list in TYPED_TEST_CASE() and // INSTANTIATE_TYPED_TEST_CASE_P(). template struct TypeList { typedef Types1 type; }; template struct TypeList > { typedef typename Types::type type; }; #endif // GTEST_HAS_TYPED_TEST || GTEST_HAS_TYPED_TEST_P } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_TYPE_UTIL_H_ // Due to C++ preprocessor weirdness, we need double indirection to // concatenate two tokens when one of them is __LINE__. Writing // // foo ## __LINE__ // // will result in the token foo__LINE__, instead of foo followed by // the current line number. For more details, see // http://www.parashift.com/c++-faq-lite/misc-technical-issues.html#faq-39.6 #define GTEST_CONCAT_TOKEN_(foo, bar) GTEST_CONCAT_TOKEN_IMPL_(foo, bar) #define GTEST_CONCAT_TOKEN_IMPL_(foo, bar) foo ## bar // Google Test defines the testing::Message class to allow construction of // test messages via the << operator. The idea is that anything // streamable to std::ostream can be streamed to a testing::Message. // This allows a user to use his own types in Google Test assertions by // overloading the << operator. // // util/gtl/stl_logging-inl.h overloads << for STL containers. These // overloads cannot be defined in the std namespace, as that will be // undefined behavior. Therefore, they are defined in the global // namespace instead. // // C++'s symbol lookup rule (i.e. Koenig lookup) says that these // overloads are visible in either the std namespace or the global // namespace, but not other namespaces, including the testing // namespace which Google Test's Message class is in. // // To allow STL containers (and other types that has a << operator // defined in the global namespace) to be used in Google Test assertions, // testing::Message must access the custom << operator from the global // namespace. Hence this helper function. // // Note: Jeffrey Yasskin suggested an alternative fix by "using // ::operator<<;" in the definition of Message's operator<<. That fix // doesn't require a helper function, but unfortunately doesn't // compile with MSVC. template inline void GTestStreamToHelper(std::ostream* os, const T& val) { *os << val; } class ProtocolMessage; namespace proto2 { class Message; } namespace testing { // Forward declarations. class AssertionResult; // Result of an assertion. class Message; // Represents a failure message. class Test; // Represents a test. class TestInfo; // Information about a test. class TestPartResult; // Result of a test part. class UnitTest; // A collection of test cases. template ::std::string PrintToString(const T& value); namespace internal { struct TraceInfo; // Information about a trace point. class ScopedTrace; // Implements scoped trace. class TestInfoImpl; // Opaque implementation of TestInfo class UnitTestImpl; // Opaque implementation of UnitTest // How many times InitGoogleTest() has been called. extern int g_init_gtest_count; // The text used in failure messages to indicate the start of the // stack trace. GTEST_API_ extern const char kStackTraceMarker[]; // A secret type that Google Test users don't know about. It has no // definition on purpose. Therefore it's impossible to create a // Secret object, which is what we want. class Secret; // Two overloaded helpers for checking at compile time whether an // expression is a null pointer literal (i.e. NULL or any 0-valued // compile-time integral constant). Their return values have // different sizes, so we can use sizeof() to test which version is // picked by the compiler. These helpers have no implementations, as // we only need their signatures. // // Given IsNullLiteralHelper(x), the compiler will pick the first // version if x can be implicitly converted to Secret*, and pick the // second version otherwise. Since Secret is a secret and incomplete // type, the only expression a user can write that has type Secret* is // a null pointer literal. Therefore, we know that x is a null // pointer literal if and only if the first version is picked by the // compiler. char IsNullLiteralHelper(Secret* p); char (&IsNullLiteralHelper(...))[2]; // NOLINT // A compile-time bool constant that is true if and only if x is a // null pointer literal (i.e. NULL or any 0-valued compile-time // integral constant). #ifdef GTEST_ELLIPSIS_NEEDS_POD_ // We lose support for NULL detection where the compiler doesn't like // passing non-POD classes through ellipsis (...). # define GTEST_IS_NULL_LITERAL_(x) false #else # define GTEST_IS_NULL_LITERAL_(x) \ (sizeof(::testing::internal::IsNullLiteralHelper(x)) == 1) #endif // GTEST_ELLIPSIS_NEEDS_POD_ // Appends the user-supplied message to the Google-Test-generated message. GTEST_API_ String AppendUserMessage(const String& gtest_msg, const Message& user_msg); // A helper class for creating scoped traces in user programs. class GTEST_API_ ScopedTrace { public: // The c'tor pushes the given source file location and message onto // a trace stack maintained by Google Test. ScopedTrace(const char* file, int line, const Message& message); // The d'tor pops the info pushed by the c'tor. // // Note that the d'tor is not virtual in order to be efficient. // Don't inherit from ScopedTrace! ~ScopedTrace(); private: GTEST_DISALLOW_COPY_AND_ASSIGN_(ScopedTrace); } GTEST_ATTRIBUTE_UNUSED_; // A ScopedTrace object does its job in its // c'tor and d'tor. Therefore it doesn't // need to be used otherwise. // Converts a streamable value to a String. A NULL pointer is // converted to "(null)". When the input value is a ::string, // ::std::string, ::wstring, or ::std::wstring object, each NUL // character in it is replaced with "\\0". // Declared here but defined in gtest.h, so that it has access // to the definition of the Message class, required by the ARM // compiler. template String StreamableToString(const T& streamable); // The Symbian compiler has a bug that prevents it from selecting the // correct overload of FormatForComparisonFailureMessage (see below) // unless we pass the first argument by reference. If we do that, // however, Visual Age C++ 10.1 generates a compiler error. Therefore // we only apply the work-around for Symbian. #if defined(__SYMBIAN32__) # define GTEST_CREF_WORKAROUND_ const& #else # define GTEST_CREF_WORKAROUND_ #endif // When this operand is a const char* or char*, if the other operand // is a ::std::string or ::string, we print this operand as a C string // rather than a pointer (we do the same for wide strings); otherwise // we print it as a pointer to be safe. // This internal macro is used to avoid duplicated code. #define GTEST_FORMAT_IMPL_(operand2_type, operand1_printer)\ inline String FormatForComparisonFailureMessage(\ operand2_type::value_type* GTEST_CREF_WORKAROUND_ str, \ const operand2_type& /*operand2*/) {\ return operand1_printer(str);\ }\ inline String FormatForComparisonFailureMessage(\ const operand2_type::value_type* GTEST_CREF_WORKAROUND_ str, \ const operand2_type& /*operand2*/) {\ return operand1_printer(str);\ } GTEST_FORMAT_IMPL_(::std::string, String::ShowCStringQuoted) #if GTEST_HAS_STD_WSTRING GTEST_FORMAT_IMPL_(::std::wstring, String::ShowWideCStringQuoted) #endif // GTEST_HAS_STD_WSTRING #if GTEST_HAS_GLOBAL_STRING GTEST_FORMAT_IMPL_(::string, String::ShowCStringQuoted) #endif // GTEST_HAS_GLOBAL_STRING #if GTEST_HAS_GLOBAL_WSTRING GTEST_FORMAT_IMPL_(::wstring, String::ShowWideCStringQuoted) #endif // GTEST_HAS_GLOBAL_WSTRING #undef GTEST_FORMAT_IMPL_ // The next four overloads handle the case where the operand being // printed is a char/wchar_t pointer and the other operand is not a // string/wstring object. In such cases, we just print the operand as // a pointer to be safe. #define GTEST_FORMAT_CHAR_PTR_IMPL_(CharType) \ template \ String FormatForComparisonFailureMessage(CharType* GTEST_CREF_WORKAROUND_ p, \ const T&) { \ return PrintToString(static_cast(p)); \ } GTEST_FORMAT_CHAR_PTR_IMPL_(char) GTEST_FORMAT_CHAR_PTR_IMPL_(const char) GTEST_FORMAT_CHAR_PTR_IMPL_(wchar_t) GTEST_FORMAT_CHAR_PTR_IMPL_(const wchar_t) #undef GTEST_FORMAT_CHAR_PTR_IMPL_ // Constructs and returns the message for an equality assertion // (e.g. ASSERT_EQ, EXPECT_STREQ, etc) failure. // // The first four parameters are the expressions used in the assertion // and their values, as strings. For example, for ASSERT_EQ(foo, bar) // where foo is 5 and bar is 6, we have: // // expected_expression: "foo" // actual_expression: "bar" // expected_value: "5" // actual_value: "6" // // The ignoring_case parameter is true iff the assertion is a // *_STRCASEEQ*. When it's true, the string " (ignoring case)" will // be inserted into the message. GTEST_API_ AssertionResult EqFailure(const char* expected_expression, const char* actual_expression, const String& expected_value, const String& actual_value, bool ignoring_case); // Constructs a failure message for Boolean assertions such as EXPECT_TRUE. GTEST_API_ String GetBoolAssertionFailureMessage( const AssertionResult& assertion_result, const char* expression_text, const char* actual_predicate_value, const char* expected_predicate_value); // This template class represents an IEEE floating-point number // (either single-precision or double-precision, depending on the // template parameters). // // The purpose of this class is to do more sophisticated number // comparison. (Due to round-off error, etc, it's very unlikely that // two floating-points will be equal exactly. Hence a naive // comparison by the == operation often doesn't work.) // // Format of IEEE floating-point: // // The most-significant bit being the leftmost, an IEEE // floating-point looks like // // sign_bit exponent_bits fraction_bits // // Here, sign_bit is a single bit that designates the sign of the // number. // // For float, there are 8 exponent bits and 23 fraction bits. // // For double, there are 11 exponent bits and 52 fraction bits. // // More details can be found at // http://en.wikipedia.org/wiki/IEEE_floating-point_standard. // // Template parameter: // // RawType: the raw floating-point type (either float or double) template class FloatingPoint { public: // Defines the unsigned integer type that has the same size as the // floating point number. typedef typename TypeWithSize::UInt Bits; // Constants. // # of bits in a number. static const size_t kBitCount = 8*sizeof(RawType); // # of fraction bits in a number. static const size_t kFractionBitCount = std::numeric_limits::digits - 1; // # of exponent bits in a number. static const size_t kExponentBitCount = kBitCount - 1 - kFractionBitCount; // The mask for the sign bit. static const Bits kSignBitMask = static_cast(1) << (kBitCount - 1); // The mask for the fraction bits. static const Bits kFractionBitMask = ~static_cast(0) >> (kExponentBitCount + 1); // The mask for the exponent bits. static const Bits kExponentBitMask = ~(kSignBitMask | kFractionBitMask); // How many ULP's (Units in the Last Place) we want to tolerate when // comparing two numbers. The larger the value, the more error we // allow. A 0 value means that two numbers must be exactly the same // to be considered equal. // // The maximum error of a single floating-point operation is 0.5 // units in the last place. On Intel CPU's, all floating-point // calculations are done with 80-bit precision, while double has 64 // bits. Therefore, 4 should be enough for ordinary use. // // See the following article for more details on ULP: // http://www.cygnus-software.com/papers/comparingfloats/comparingfloats.htm. static const size_t kMaxUlps = 4; // Constructs a FloatingPoint from a raw floating-point number. // // On an Intel CPU, passing a non-normalized NAN (Not a Number) // around may change its bits, although the new value is guaranteed // to be also a NAN. Therefore, don't expect this constructor to // preserve the bits in x when x is a NAN. explicit FloatingPoint(const RawType& x) { u_.value_ = x; } // Static methods // Reinterprets a bit pattern as a floating-point number. // // This function is needed to test the AlmostEquals() method. static RawType ReinterpretBits(const Bits bits) { FloatingPoint fp(0); fp.u_.bits_ = bits; return fp.u_.value_; } // Returns the floating-point number that represent positive infinity. static RawType Infinity() { return ReinterpretBits(kExponentBitMask); } // Non-static methods // Returns the bits that represents this number. const Bits &bits() const { return u_.bits_; } // Returns the exponent bits of this number. Bits exponent_bits() const { return kExponentBitMask & u_.bits_; } // Returns the fraction bits of this number. Bits fraction_bits() const { return kFractionBitMask & u_.bits_; } // Returns the sign bit of this number. Bits sign_bit() const { return kSignBitMask & u_.bits_; } // Returns true iff this is NAN (not a number). bool is_nan() const { // It's a NAN if the exponent bits are all ones and the fraction // bits are not entirely zeros. return (exponent_bits() == kExponentBitMask) && (fraction_bits() != 0); } // Returns true iff this number is at most kMaxUlps ULP's away from // rhs. In particular, this function: // // - returns false if either number is (or both are) NAN. // - treats really large numbers as almost equal to infinity. // - thinks +0.0 and -0.0 are 0 DLP's apart. bool AlmostEquals(const FloatingPoint& rhs) const { // The IEEE standard says that any comparison operation involving // a NAN must return false. if (is_nan() || rhs.is_nan()) return false; return DistanceBetweenSignAndMagnitudeNumbers(u_.bits_, rhs.u_.bits_) <= kMaxUlps; } private: // The data type used to store the actual floating-point number. union FloatingPointUnion { RawType value_; // The raw floating-point number. Bits bits_; // The bits that represent the number. }; // Converts an integer from the sign-and-magnitude representation to // the biased representation. More precisely, let N be 2 to the // power of (kBitCount - 1), an integer x is represented by the // unsigned number x + N. // // For instance, // // -N + 1 (the most negative number representable using // sign-and-magnitude) is represented by 1; // 0 is represented by N; and // N - 1 (the biggest number representable using // sign-and-magnitude) is represented by 2N - 1. // // Read http://en.wikipedia.org/wiki/Signed_number_representations // for more details on signed number representations. static Bits SignAndMagnitudeToBiased(const Bits &sam) { if (kSignBitMask & sam) { // sam represents a negative number. return ~sam + 1; } else { // sam represents a positive number. return kSignBitMask | sam; } } // Given two numbers in the sign-and-magnitude representation, // returns the distance between them as an unsigned number. static Bits DistanceBetweenSignAndMagnitudeNumbers(const Bits &sam1, const Bits &sam2) { const Bits biased1 = SignAndMagnitudeToBiased(sam1); const Bits biased2 = SignAndMagnitudeToBiased(sam2); return (biased1 >= biased2) ? (biased1 - biased2) : (biased2 - biased1); } FloatingPointUnion u_; }; // Typedefs the instances of the FloatingPoint template class that we // care to use. typedef FloatingPoint Float; typedef FloatingPoint Double; // In order to catch the mistake of putting tests that use different // test fixture classes in the same test case, we need to assign // unique IDs to fixture classes and compare them. The TypeId type is // used to hold such IDs. The user should treat TypeId as an opaque // type: the only operation allowed on TypeId values is to compare // them for equality using the == operator. typedef const void* TypeId; template class TypeIdHelper { public: // dummy_ must not have a const type. Otherwise an overly eager // compiler (e.g. MSVC 7.1 & 8.0) may try to merge // TypeIdHelper::dummy_ for different Ts as an "optimization". static bool dummy_; }; template bool TypeIdHelper::dummy_ = false; // GetTypeId() returns the ID of type T. Different values will be // returned for different types. Calling the function twice with the // same type argument is guaranteed to return the same ID. template TypeId GetTypeId() { // The compiler is required to allocate a different // TypeIdHelper::dummy_ variable for each T used to instantiate // the template. Therefore, the address of dummy_ is guaranteed to // be unique. return &(TypeIdHelper::dummy_); } // Returns the type ID of ::testing::Test. Always call this instead // of GetTypeId< ::testing::Test>() to get the type ID of // ::testing::Test, as the latter may give the wrong result due to a // suspected linker bug when compiling Google Test as a Mac OS X // framework. GTEST_API_ TypeId GetTestTypeId(); // Defines the abstract factory interface that creates instances // of a Test object. class TestFactoryBase { public: virtual ~TestFactoryBase() {} // Creates a test instance to run. The instance is both created and destroyed // within TestInfoImpl::Run() virtual Test* CreateTest() = 0; protected: TestFactoryBase() {} private: GTEST_DISALLOW_COPY_AND_ASSIGN_(TestFactoryBase); }; // This class provides implementation of TeastFactoryBase interface. // It is used in TEST and TEST_F macros. template class TestFactoryImpl : public TestFactoryBase { public: virtual Test* CreateTest() { return new TestClass; } }; #if GTEST_OS_WINDOWS // Predicate-formatters for implementing the HRESULT checking macros // {ASSERT|EXPECT}_HRESULT_{SUCCEEDED|FAILED} // We pass a long instead of HRESULT to avoid causing an // include dependency for the HRESULT type. GTEST_API_ AssertionResult IsHRESULTSuccess(const char* expr, long hr); // NOLINT GTEST_API_ AssertionResult IsHRESULTFailure(const char* expr, long hr); // NOLINT #endif // GTEST_OS_WINDOWS // Types of SetUpTestCase() and TearDownTestCase() functions. typedef void (*SetUpTestCaseFunc)(); typedef void (*TearDownTestCaseFunc)(); // Creates a new TestInfo object and registers it with Google Test; // returns the created object. // // Arguments: // // test_case_name: name of the test case // name: name of the test // type_param the name of the test's type parameter, or NULL if // this is not a typed or a type-parameterized test. // value_param text representation of the test's value parameter, // or NULL if this is not a type-parameterized test. // fixture_class_id: ID of the test fixture class // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case // factory: pointer to the factory that creates a test object. // The newly created TestInfo instance will assume // ownership of the factory object. GTEST_API_ TestInfo* MakeAndRegisterTestInfo( const char* test_case_name, const char* name, const char* type_param, const char* value_param, TypeId fixture_class_id, SetUpTestCaseFunc set_up_tc, TearDownTestCaseFunc tear_down_tc, TestFactoryBase* factory); // If *pstr starts with the given prefix, modifies *pstr to be right // past the prefix and returns true; otherwise leaves *pstr unchanged // and returns false. None of pstr, *pstr, and prefix can be NULL. GTEST_API_ bool SkipPrefix(const char* prefix, const char** pstr); #if GTEST_HAS_TYPED_TEST || GTEST_HAS_TYPED_TEST_P // State of the definition of a type-parameterized test case. class GTEST_API_ TypedTestCasePState { public: TypedTestCasePState() : registered_(false) {} // Adds the given test name to defined_test_names_ and return true // if the test case hasn't been registered; otherwise aborts the // program. bool AddTestName(const char* file, int line, const char* case_name, const char* test_name) { if (registered_) { fprintf(stderr, "%s Test %s must be defined before " "REGISTER_TYPED_TEST_CASE_P(%s, ...).\n", FormatFileLocation(file, line).c_str(), test_name, case_name); fflush(stderr); posix::Abort(); } defined_test_names_.insert(test_name); return true; } // Verifies that registered_tests match the test names in // defined_test_names_; returns registered_tests if successful, or // aborts the program otherwise. const char* VerifyRegisteredTestNames( const char* file, int line, const char* registered_tests); private: bool registered_; ::std::set defined_test_names_; }; // Skips to the first non-space char after the first comma in 'str'; // returns NULL if no comma is found in 'str'. inline const char* SkipComma(const char* str) { const char* comma = strchr(str, ','); if (comma == NULL) { return NULL; } while (IsSpace(*(++comma))) {} return comma; } // Returns the prefix of 'str' before the first comma in it; returns // the entire string if it contains no comma. inline String GetPrefixUntilComma(const char* str) { const char* comma = strchr(str, ','); return comma == NULL ? String(str) : String(str, comma - str); } // TypeParameterizedTest::Register() // registers a list of type-parameterized tests with Google Test. The // return value is insignificant - we just need to return something // such that we can call this function in a namespace scope. // // Implementation note: The GTEST_TEMPLATE_ macro declares a template // template parameter. It's defined in gtest-type-util.h. template class TypeParameterizedTest { public: // 'index' is the index of the test in the type list 'Types' // specified in INSTANTIATE_TYPED_TEST_CASE_P(Prefix, TestCase, // Types). Valid values for 'index' are [0, N - 1] where N is the // length of Types. static bool Register(const char* prefix, const char* case_name, const char* test_names, int index) { typedef typename Types::Head Type; typedef Fixture FixtureClass; typedef typename GTEST_BIND_(TestSel, Type) TestClass; // First, registers the first type-parameterized test in the type // list. MakeAndRegisterTestInfo( String::Format("%s%s%s/%d", prefix, prefix[0] == '\0' ? "" : "/", case_name, index).c_str(), GetPrefixUntilComma(test_names).c_str(), GetTypeName().c_str(), NULL, // No value parameter. GetTypeId(), TestClass::SetUpTestCase, TestClass::TearDownTestCase, new TestFactoryImpl); // Next, recurses (at compile time) with the tail of the type list. return TypeParameterizedTest ::Register(prefix, case_name, test_names, index + 1); } }; // The base case for the compile time recursion. template class TypeParameterizedTest { public: static bool Register(const char* /*prefix*/, const char* /*case_name*/, const char* /*test_names*/, int /*index*/) { return true; } }; // TypeParameterizedTestCase::Register() // registers *all combinations* of 'Tests' and 'Types' with Google // Test. The return value is insignificant - we just need to return // something such that we can call this function in a namespace scope. template class TypeParameterizedTestCase { public: static bool Register(const char* prefix, const char* case_name, const char* test_names) { typedef typename Tests::Head Head; // First, register the first test in 'Test' for each type in 'Types'. TypeParameterizedTest::Register( prefix, case_name, test_names, 0); // Next, recurses (at compile time) with the tail of the test list. return TypeParameterizedTestCase ::Register(prefix, case_name, SkipComma(test_names)); } }; // The base case for the compile time recursion. template class TypeParameterizedTestCase { public: static bool Register(const char* /*prefix*/, const char* /*case_name*/, const char* /*test_names*/) { return true; } }; #endif // GTEST_HAS_TYPED_TEST || GTEST_HAS_TYPED_TEST_P // Returns the current OS stack trace as a String. // // The maximum number of stack frames to be included is specified by // the gtest_stack_trace_depth flag. The skip_count parameter // specifies the number of top frames to be skipped, which doesn't // count against the number of frames to be included. // // For example, if Foo() calls Bar(), which in turn calls // GetCurrentOsStackTraceExceptTop(..., 1), Foo() will be included in // the trace but Bar() and GetCurrentOsStackTraceExceptTop() won't. GTEST_API_ String GetCurrentOsStackTraceExceptTop(UnitTest* unit_test, int skip_count); // Helpers for suppressing warnings on unreachable code or constant // condition. // Always returns true. GTEST_API_ bool AlwaysTrue(); // Always returns false. inline bool AlwaysFalse() { return !AlwaysTrue(); } // Helper for suppressing false warning from Clang on a const char* // variable declared in a conditional expression always being NULL in // the else branch. struct GTEST_API_ ConstCharPtr { ConstCharPtr(const char* str) : value(str) {} operator bool() const { return true; } const char* value; }; // A simple Linear Congruential Generator for generating random // numbers with a uniform distribution. Unlike rand() and srand(), it // doesn't use global state (and therefore can't interfere with user // code). Unlike rand_r(), it's portable. An LCG isn't very random, // but it's good enough for our purposes. class GTEST_API_ Random { public: static const UInt32 kMaxRange = 1u << 31; explicit Random(UInt32 seed) : state_(seed) {} void Reseed(UInt32 seed) { state_ = seed; } // Generates a random number from [0, range). Crashes if 'range' is // 0 or greater than kMaxRange. UInt32 Generate(UInt32 range); private: UInt32 state_; GTEST_DISALLOW_COPY_AND_ASSIGN_(Random); }; // Defining a variable of type CompileAssertTypesEqual will cause a // compiler error iff T1 and T2 are different types. template struct CompileAssertTypesEqual; template struct CompileAssertTypesEqual { }; // Removes the reference from a type if it is a reference type, // otherwise leaves it unchanged. This is the same as // tr1::remove_reference, which is not widely available yet. template struct RemoveReference { typedef T type; }; // NOLINT template struct RemoveReference { typedef T type; }; // NOLINT // A handy wrapper around RemoveReference that works when the argument // T depends on template parameters. #define GTEST_REMOVE_REFERENCE_(T) \ typename ::testing::internal::RemoveReference::type // Removes const from a type if it is a const type, otherwise leaves // it unchanged. This is the same as tr1::remove_const, which is not // widely available yet. template struct RemoveConst { typedef T type; }; // NOLINT template struct RemoveConst { typedef T type; }; // NOLINT // MSVC 8.0, Sun C++, and IBM XL C++ have a bug which causes the above // definition to fail to remove the const in 'const int[3]' and 'const // char[3][4]'. The following specialization works around the bug. // However, it causes trouble with GCC and thus needs to be // conditionally compiled. #if defined(_MSC_VER) || defined(__SUNPRO_CC) || defined(__IBMCPP__) template struct RemoveConst { typedef typename RemoveConst::type type[N]; }; #endif // A handy wrapper around RemoveConst that works when the argument // T depends on template parameters. #define GTEST_REMOVE_CONST_(T) \ typename ::testing::internal::RemoveConst::type // Turns const U&, U&, const U, and U all into U. #define GTEST_REMOVE_REFERENCE_AND_CONST_(T) \ GTEST_REMOVE_CONST_(GTEST_REMOVE_REFERENCE_(T)) // Adds reference to a type if it is not a reference type, // otherwise leaves it unchanged. This is the same as // tr1::add_reference, which is not widely available yet. template struct AddReference { typedef T& type; }; // NOLINT template struct AddReference { typedef T& type; }; // NOLINT // A handy wrapper around AddReference that works when the argument T // depends on template parameters. #define GTEST_ADD_REFERENCE_(T) \ typename ::testing::internal::AddReference::type // Adds a reference to const on top of T as necessary. For example, // it transforms // // char ==> const char& // const char ==> const char& // char& ==> const char& // const char& ==> const char& // // The argument T must depend on some template parameters. #define GTEST_REFERENCE_TO_CONST_(T) \ GTEST_ADD_REFERENCE_(const GTEST_REMOVE_REFERENCE_(T)) // ImplicitlyConvertible::value is a compile-time bool // constant that's true iff type From can be implicitly converted to // type To. template class ImplicitlyConvertible { private: // We need the following helper functions only for their types. // They have no implementations. // MakeFrom() is an expression whose type is From. We cannot simply // use From(), as the type From may not have a public default // constructor. static From MakeFrom(); // These two functions are overloaded. Given an expression // Helper(x), the compiler will pick the first version if x can be // implicitly converted to type To; otherwise it will pick the // second version. // // The first version returns a value of size 1, and the second // version returns a value of size 2. Therefore, by checking the // size of Helper(x), which can be done at compile time, we can tell // which version of Helper() is used, and hence whether x can be // implicitly converted to type To. static char Helper(To); static char (&Helper(...))[2]; // NOLINT // We have to put the 'public' section after the 'private' section, // or MSVC refuses to compile the code. public: // MSVC warns about implicitly converting from double to int for // possible loss of data, so we need to temporarily disable the // warning. #ifdef _MSC_VER # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4244) // Temporarily disables warning 4244. static const bool value = sizeof(Helper(ImplicitlyConvertible::MakeFrom())) == 1; # pragma warning(pop) // Restores the warning state. #elif defined(__BORLANDC__) // C++Builder cannot use member overload resolution during template // instantiation. The simplest workaround is to use its C++0x type traits // functions (C++Builder 2009 and above only). static const bool value = __is_convertible(From, To); #else static const bool value = sizeof(Helper(ImplicitlyConvertible::MakeFrom())) == 1; #endif // _MSV_VER }; template const bool ImplicitlyConvertible::value; // IsAProtocolMessage::value is a compile-time bool constant that's // true iff T is type ProtocolMessage, proto2::Message, or a subclass // of those. template struct IsAProtocolMessage : public bool_constant< ImplicitlyConvertible::value || ImplicitlyConvertible::value> { }; // When the compiler sees expression IsContainerTest(0), if C is an // STL-style container class, the first overload of IsContainerTest // will be viable (since both C::iterator* and C::const_iterator* are // valid types and NULL can be implicitly converted to them). It will // be picked over the second overload as 'int' is a perfect match for // the type of argument 0. If C::iterator or C::const_iterator is not // a valid type, the first overload is not viable, and the second // overload will be picked. Therefore, we can determine whether C is // a container class by checking the type of IsContainerTest(0). // The value of the expression is insignificant. // // Note that we look for both C::iterator and C::const_iterator. The // reason is that C++ injects the name of a class as a member of the // class itself (e.g. you can refer to class iterator as either // 'iterator' or 'iterator::iterator'). If we look for C::iterator // only, for example, we would mistakenly think that a class named // iterator is an STL container. // // Also note that the simpler approach of overloading // IsContainerTest(typename C::const_iterator*) and // IsContainerTest(...) doesn't work with Visual Age C++ and Sun C++. typedef int IsContainer; template IsContainer IsContainerTest(int /* dummy */, typename C::iterator* /* it */ = NULL, typename C::const_iterator* /* const_it */ = NULL) { return 0; } typedef char IsNotContainer; template IsNotContainer IsContainerTest(long /* dummy */) { return '\0'; } // EnableIf::type is void when 'Cond' is true, and // undefined when 'Cond' is false. To use SFINAE to make a function // overload only apply when a particular expression is true, add // "typename EnableIf::type* = 0" as the last parameter. template struct EnableIf; template<> struct EnableIf { typedef void type; }; // NOLINT // Utilities for native arrays. // ArrayEq() compares two k-dimensional native arrays using the // elements' operator==, where k can be any integer >= 0. When k is // 0, ArrayEq() degenerates into comparing a single pair of values. template bool ArrayEq(const T* lhs, size_t size, const U* rhs); // This generic version is used when k is 0. template inline bool ArrayEq(const T& lhs, const U& rhs) { return lhs == rhs; } // This overload is used when k >= 1. template inline bool ArrayEq(const T(&lhs)[N], const U(&rhs)[N]) { return internal::ArrayEq(lhs, N, rhs); } // This helper reduces code bloat. If we instead put its logic inside // the previous ArrayEq() function, arrays with different sizes would // lead to different copies of the template code. template bool ArrayEq(const T* lhs, size_t size, const U* rhs) { for (size_t i = 0; i != size; i++) { if (!internal::ArrayEq(lhs[i], rhs[i])) return false; } return true; } // Finds the first element in the iterator range [begin, end) that // equals elem. Element may be a native array type itself. template Iter ArrayAwareFind(Iter begin, Iter end, const Element& elem) { for (Iter it = begin; it != end; ++it) { if (internal::ArrayEq(*it, elem)) return it; } return end; } // CopyArray() copies a k-dimensional native array using the elements' // operator=, where k can be any integer >= 0. When k is 0, // CopyArray() degenerates into copying a single value. template void CopyArray(const T* from, size_t size, U* to); // This generic version is used when k is 0. template inline void CopyArray(const T& from, U* to) { *to = from; } // This overload is used when k >= 1. template inline void CopyArray(const T(&from)[N], U(*to)[N]) { internal::CopyArray(from, N, *to); } // This helper reduces code bloat. If we instead put its logic inside // the previous CopyArray() function, arrays with different sizes // would lead to different copies of the template code. template void CopyArray(const T* from, size_t size, U* to) { for (size_t i = 0; i != size; i++) { internal::CopyArray(from[i], to + i); } } // The relation between an NativeArray object (see below) and the // native array it represents. enum RelationToSource { kReference, // The NativeArray references the native array. kCopy // The NativeArray makes a copy of the native array and // owns the copy. }; // Adapts a native array to a read-only STL-style container. Instead // of the complete STL container concept, this adaptor only implements // members useful for Google Mock's container matchers. New members // should be added as needed. To simplify the implementation, we only // support Element being a raw type (i.e. having no top-level const or // reference modifier). It's the client's responsibility to satisfy // this requirement. Element can be an array type itself (hence // multi-dimensional arrays are supported). template class NativeArray { public: // STL-style container typedefs. typedef Element value_type; typedef Element* iterator; typedef const Element* const_iterator; // Constructs from a native array. NativeArray(const Element* array, size_t count, RelationToSource relation) { Init(array, count, relation); } // Copy constructor. NativeArray(const NativeArray& rhs) { Init(rhs.array_, rhs.size_, rhs.relation_to_source_); } ~NativeArray() { // Ensures that the user doesn't instantiate NativeArray with a // const or reference type. static_cast(StaticAssertTypeEqHelper()); if (relation_to_source_ == kCopy) delete[] array_; } // STL-style container methods. size_t size() const { return size_; } const_iterator begin() const { return array_; } const_iterator end() const { return array_ + size_; } bool operator==(const NativeArray& rhs) const { return size() == rhs.size() && ArrayEq(begin(), size(), rhs.begin()); } private: // Initializes this object; makes a copy of the input array if // 'relation' is kCopy. void Init(const Element* array, size_t a_size, RelationToSource relation) { if (relation == kReference) { array_ = array; } else { Element* const copy = new Element[a_size]; CopyArray(array, a_size, copy); array_ = copy; } size_ = a_size; relation_to_source_ = relation; } const Element* array_; size_t size_; RelationToSource relation_to_source_; GTEST_DISALLOW_ASSIGN_(NativeArray); }; } // namespace internal } // namespace testing #define GTEST_MESSAGE_AT_(file, line, message, result_type) \ ::testing::internal::AssertHelper(result_type, file, line, message) \ = ::testing::Message() #define GTEST_MESSAGE_(message, result_type) \ GTEST_MESSAGE_AT_(__FILE__, __LINE__, message, result_type) #define GTEST_FATAL_FAILURE_(message) \ return GTEST_MESSAGE_(message, ::testing::TestPartResult::kFatalFailure) #define GTEST_NONFATAL_FAILURE_(message) \ GTEST_MESSAGE_(message, ::testing::TestPartResult::kNonFatalFailure) #define GTEST_SUCCESS_(message) \ GTEST_MESSAGE_(message, ::testing::TestPartResult::kSuccess) // Suppresses MSVC warnings 4072 (unreachable code) for the code following // statement if it returns or throws (or doesn't return or throw in some // situations). #define GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement) \ if (::testing::internal::AlwaysTrue()) { statement; } #define GTEST_TEST_THROW_(statement, expected_exception, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::ConstCharPtr gtest_msg = "") { \ bool gtest_caught_expected = false; \ try { \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ } \ catch (expected_exception const&) { \ gtest_caught_expected = true; \ } \ catch (...) { \ gtest_msg.value = \ "Expected: " #statement " throws an exception of type " \ #expected_exception ".\n Actual: it throws a different type."; \ goto GTEST_CONCAT_TOKEN_(gtest_label_testthrow_, __LINE__); \ } \ if (!gtest_caught_expected) { \ gtest_msg.value = \ "Expected: " #statement " throws an exception of type " \ #expected_exception ".\n Actual: it throws nothing."; \ goto GTEST_CONCAT_TOKEN_(gtest_label_testthrow_, __LINE__); \ } \ } else \ GTEST_CONCAT_TOKEN_(gtest_label_testthrow_, __LINE__): \ fail(gtest_msg.value) #define GTEST_TEST_NO_THROW_(statement, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::AlwaysTrue()) { \ try { \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ } \ catch (...) { \ goto GTEST_CONCAT_TOKEN_(gtest_label_testnothrow_, __LINE__); \ } \ } else \ GTEST_CONCAT_TOKEN_(gtest_label_testnothrow_, __LINE__): \ fail("Expected: " #statement " doesn't throw an exception.\n" \ " Actual: it throws.") #define GTEST_TEST_ANY_THROW_(statement, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::AlwaysTrue()) { \ bool gtest_caught_any = false; \ try { \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ } \ catch (...) { \ gtest_caught_any = true; \ } \ if (!gtest_caught_any) { \ goto GTEST_CONCAT_TOKEN_(gtest_label_testanythrow_, __LINE__); \ } \ } else \ GTEST_CONCAT_TOKEN_(gtest_label_testanythrow_, __LINE__): \ fail("Expected: " #statement " throws an exception.\n" \ " Actual: it doesn't.") // Implements Boolean test assertions such as EXPECT_TRUE. expression can be // either a boolean expression or an AssertionResult. text is a textual // represenation of expression as it was passed into the EXPECT_TRUE. #define GTEST_TEST_BOOLEAN_(expression, text, actual, expected, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (const ::testing::AssertionResult gtest_ar_ = \ ::testing::AssertionResult(expression)) \ ; \ else \ fail(::testing::internal::GetBoolAssertionFailureMessage(\ gtest_ar_, text, #actual, #expected).c_str()) #define GTEST_TEST_NO_FATAL_FAILURE_(statement, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::AlwaysTrue()) { \ ::testing::internal::HasNewFatalFailureHelper gtest_fatal_failure_checker; \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ if (gtest_fatal_failure_checker.has_new_fatal_failure()) { \ goto GTEST_CONCAT_TOKEN_(gtest_label_testnofatal_, __LINE__); \ } \ } else \ GTEST_CONCAT_TOKEN_(gtest_label_testnofatal_, __LINE__): \ fail("Expected: " #statement " doesn't generate new fatal " \ "failures in the current thread.\n" \ " Actual: it does.") // Expands to the name of the class that implements the given test. #define GTEST_TEST_CLASS_NAME_(test_case_name, test_name) \ test_case_name##_##test_name##_Test // Helper macro for defining tests. #define GTEST_TEST_(test_case_name, test_name, parent_class, parent_id)\ class GTEST_TEST_CLASS_NAME_(test_case_name, test_name) : public parent_class {\ public:\ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)() {}\ private:\ virtual void TestBody();\ static ::testing::TestInfo* const test_info_ GTEST_ATTRIBUTE_UNUSED_;\ GTEST_DISALLOW_COPY_AND_ASSIGN_(\ GTEST_TEST_CLASS_NAME_(test_case_name, test_name));\ };\ \ ::testing::TestInfo* const GTEST_TEST_CLASS_NAME_(test_case_name, test_name)\ ::test_info_ =\ ::testing::internal::MakeAndRegisterTestInfo(\ #test_case_name, #test_name, NULL, NULL, \ (parent_id), \ parent_class::SetUpTestCase, \ parent_class::TearDownTestCase, \ new ::testing::internal::TestFactoryImpl<\ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)>);\ void GTEST_TEST_CLASS_NAME_(test_case_name, test_name)::TestBody() #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_ // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // The Google C++ Testing Framework (Google Test) // // This header file defines the public API for death tests. It is // #included by gtest.h so a user doesn't need to include this // directly. #ifndef GTEST_INCLUDE_GTEST_GTEST_DEATH_TEST_H_ #define GTEST_INCLUDE_GTEST_GTEST_DEATH_TEST_H_ // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: wan@google.com (Zhanyong Wan), eefacm@gmail.com (Sean Mcafee) // // The Google C++ Testing Framework (Google Test) // // This header file defines internal utilities needed for implementing // death tests. They are subject to change without notice. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_DEATH_TEST_INTERNAL_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_DEATH_TEST_INTERNAL_H_ #include namespace testing { namespace internal { GTEST_DECLARE_string_(internal_run_death_test); // Names of the flags (needed for parsing Google Test flags). const char kDeathTestStyleFlag[] = "death_test_style"; const char kDeathTestUseFork[] = "death_test_use_fork"; const char kInternalRunDeathTestFlag[] = "internal_run_death_test"; #if GTEST_HAS_DEATH_TEST // DeathTest is a class that hides much of the complexity of the // GTEST_DEATH_TEST_ macro. It is abstract; its static Create method // returns a concrete class that depends on the prevailing death test // style, as defined by the --gtest_death_test_style and/or // --gtest_internal_run_death_test flags. // In describing the results of death tests, these terms are used with // the corresponding definitions: // // exit status: The integer exit information in the format specified // by wait(2) // exit code: The integer code passed to exit(3), _exit(2), or // returned from main() class GTEST_API_ DeathTest { public: // Create returns false if there was an error determining the // appropriate action to take for the current death test; for example, // if the gtest_death_test_style flag is set to an invalid value. // The LastMessage method will return a more detailed message in that // case. Otherwise, the DeathTest pointer pointed to by the "test" // argument is set. If the death test should be skipped, the pointer // is set to NULL; otherwise, it is set to the address of a new concrete // DeathTest object that controls the execution of the current test. static bool Create(const char* statement, const RE* regex, const char* file, int line, DeathTest** test); DeathTest(); virtual ~DeathTest() { } // A helper class that aborts a death test when it's deleted. class ReturnSentinel { public: explicit ReturnSentinel(DeathTest* test) : test_(test) { } ~ReturnSentinel() { test_->Abort(TEST_ENCOUNTERED_RETURN_STATEMENT); } private: DeathTest* const test_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ReturnSentinel); } GTEST_ATTRIBUTE_UNUSED_; // An enumeration of possible roles that may be taken when a death // test is encountered. EXECUTE means that the death test logic should // be executed immediately. OVERSEE means that the program should prepare // the appropriate environment for a child process to execute the death // test, then wait for it to complete. enum TestRole { OVERSEE_TEST, EXECUTE_TEST }; // An enumeration of the three reasons that a test might be aborted. enum AbortReason { TEST_ENCOUNTERED_RETURN_STATEMENT, TEST_THREW_EXCEPTION, TEST_DID_NOT_DIE }; // Assumes one of the above roles. virtual TestRole AssumeRole() = 0; // Waits for the death test to finish and returns its status. virtual int Wait() = 0; // Returns true if the death test passed; that is, the test process // exited during the test, its exit status matches a user-supplied // predicate, and its stderr output matches a user-supplied regular // expression. // The user-supplied predicate may be a macro expression rather // than a function pointer or functor, or else Wait and Passed could // be combined. virtual bool Passed(bool exit_status_ok) = 0; // Signals that the death test did not die as expected. virtual void Abort(AbortReason reason) = 0; // Returns a human-readable outcome message regarding the outcome of // the last death test. static const char* LastMessage(); static void set_last_death_test_message(const String& message); private: // A string containing a description of the outcome of the last death test. static String last_death_test_message_; GTEST_DISALLOW_COPY_AND_ASSIGN_(DeathTest); }; // Factory interface for death tests. May be mocked out for testing. class DeathTestFactory { public: virtual ~DeathTestFactory() { } virtual bool Create(const char* statement, const RE* regex, const char* file, int line, DeathTest** test) = 0; }; // A concrete DeathTestFactory implementation for normal use. class DefaultDeathTestFactory : public DeathTestFactory { public: virtual bool Create(const char* statement, const RE* regex, const char* file, int line, DeathTest** test); }; // Returns true if exit_status describes a process that was terminated // by a signal, or exited normally with a nonzero exit code. GTEST_API_ bool ExitedUnsuccessfully(int exit_status); // Traps C++ exceptions escaping statement and reports them as test // failures. Note that trapping SEH exceptions is not implemented here. # if GTEST_HAS_EXCEPTIONS # define GTEST_EXECUTE_DEATH_TEST_STATEMENT_(statement, death_test) \ try { \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ } catch (const ::std::exception& gtest_exception) { \ fprintf(\ stderr, \ "\n%s: Caught std::exception-derived exception escaping the " \ "death test statement. Exception message: %s\n", \ ::testing::internal::FormatFileLocation(__FILE__, __LINE__).c_str(), \ gtest_exception.what()); \ fflush(stderr); \ death_test->Abort(::testing::internal::DeathTest::TEST_THREW_EXCEPTION); \ } catch (...) { \ death_test->Abort(::testing::internal::DeathTest::TEST_THREW_EXCEPTION); \ } # else # define GTEST_EXECUTE_DEATH_TEST_STATEMENT_(statement, death_test) \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement) # endif // This macro is for implementing ASSERT_DEATH*, EXPECT_DEATH*, // ASSERT_EXIT*, and EXPECT_EXIT*. # define GTEST_DEATH_TEST_(statement, predicate, regex, fail) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::AlwaysTrue()) { \ const ::testing::internal::RE& gtest_regex = (regex); \ ::testing::internal::DeathTest* gtest_dt; \ if (!::testing::internal::DeathTest::Create(#statement, >est_regex, \ __FILE__, __LINE__, >est_dt)) { \ goto GTEST_CONCAT_TOKEN_(gtest_label_, __LINE__); \ } \ if (gtest_dt != NULL) { \ ::testing::internal::scoped_ptr< ::testing::internal::DeathTest> \ gtest_dt_ptr(gtest_dt); \ switch (gtest_dt->AssumeRole()) { \ case ::testing::internal::DeathTest::OVERSEE_TEST: \ if (!gtest_dt->Passed(predicate(gtest_dt->Wait()))) { \ goto GTEST_CONCAT_TOKEN_(gtest_label_, __LINE__); \ } \ break; \ case ::testing::internal::DeathTest::EXECUTE_TEST: { \ ::testing::internal::DeathTest::ReturnSentinel \ gtest_sentinel(gtest_dt); \ GTEST_EXECUTE_DEATH_TEST_STATEMENT_(statement, gtest_dt); \ gtest_dt->Abort(::testing::internal::DeathTest::TEST_DID_NOT_DIE); \ break; \ } \ default: \ break; \ } \ } \ } else \ GTEST_CONCAT_TOKEN_(gtest_label_, __LINE__): \ fail(::testing::internal::DeathTest::LastMessage()) // The symbol "fail" here expands to something into which a message // can be streamed. // A class representing the parsed contents of the // --gtest_internal_run_death_test flag, as it existed when // RUN_ALL_TESTS was called. class InternalRunDeathTestFlag { public: InternalRunDeathTestFlag(const String& a_file, int a_line, int an_index, int a_write_fd) : file_(a_file), line_(a_line), index_(an_index), write_fd_(a_write_fd) {} ~InternalRunDeathTestFlag() { if (write_fd_ >= 0) posix::Close(write_fd_); } String file() const { return file_; } int line() const { return line_; } int index() const { return index_; } int write_fd() const { return write_fd_; } private: String file_; int line_; int index_; int write_fd_; GTEST_DISALLOW_COPY_AND_ASSIGN_(InternalRunDeathTestFlag); }; // Returns a newly created InternalRunDeathTestFlag object with fields // initialized from the GTEST_FLAG(internal_run_death_test) flag if // the flag is specified; otherwise returns NULL. InternalRunDeathTestFlag* ParseInternalRunDeathTestFlag(); #else // GTEST_HAS_DEATH_TEST // This macro is used for implementing macros such as // EXPECT_DEATH_IF_SUPPORTED and ASSERT_DEATH_IF_SUPPORTED on systems where // death tests are not supported. Those macros must compile on such systems // iff EXPECT_DEATH and ASSERT_DEATH compile with the same parameters on // systems that support death tests. This allows one to write such a macro // on a system that does not support death tests and be sure that it will // compile on a death-test supporting system. // // Parameters: // statement - A statement that a macro such as EXPECT_DEATH would test // for program termination. This macro has to make sure this // statement is compiled but not executed, to ensure that // EXPECT_DEATH_IF_SUPPORTED compiles with a certain // parameter iff EXPECT_DEATH compiles with it. // regex - A regex that a macro such as EXPECT_DEATH would use to test // the output of statement. This parameter has to be // compiled but not evaluated by this macro, to ensure that // this macro only accepts expressions that a macro such as // EXPECT_DEATH would accept. // terminator - Must be an empty statement for EXPECT_DEATH_IF_SUPPORTED // and a return statement for ASSERT_DEATH_IF_SUPPORTED. // This ensures that ASSERT_DEATH_IF_SUPPORTED will not // compile inside functions where ASSERT_DEATH doesn't // compile. // // The branch that has an always false condition is used to ensure that // statement and regex are compiled (and thus syntactically correct) but // never executed. The unreachable code macro protects the terminator // statement from generating an 'unreachable code' warning in case // statement unconditionally returns or throws. The Message constructor at // the end allows the syntax of streaming additional messages into the // macro, for compilational compatibility with EXPECT_DEATH/ASSERT_DEATH. # define GTEST_UNSUPPORTED_DEATH_TEST_(statement, regex, terminator) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (::testing::internal::AlwaysTrue()) { \ GTEST_LOG_(WARNING) \ << "Death tests are not supported on this platform.\n" \ << "Statement '" #statement "' cannot be verified."; \ } else if (::testing::internal::AlwaysFalse()) { \ ::testing::internal::RE::PartialMatch(".*", (regex)); \ GTEST_SUPPRESS_UNREACHABLE_CODE_WARNING_BELOW_(statement); \ terminator; \ } else \ ::testing::Message() #endif // GTEST_HAS_DEATH_TEST } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_DEATH_TEST_INTERNAL_H_ namespace testing { // This flag controls the style of death tests. Valid values are "threadsafe", // meaning that the death test child process will re-execute the test binary // from the start, running only a single death test, or "fast", // meaning that the child process will execute the test logic immediately // after forking. GTEST_DECLARE_string_(death_test_style); #if GTEST_HAS_DEATH_TEST // The following macros are useful for writing death tests. // Here's what happens when an ASSERT_DEATH* or EXPECT_DEATH* is // executed: // // 1. It generates a warning if there is more than one active // thread. This is because it's safe to fork() or clone() only // when there is a single thread. // // 2. The parent process clone()s a sub-process and runs the death // test in it; the sub-process exits with code 0 at the end of the // death test, if it hasn't exited already. // // 3. The parent process waits for the sub-process to terminate. // // 4. The parent process checks the exit code and error message of // the sub-process. // // Examples: // // ASSERT_DEATH(server.SendMessage(56, "Hello"), "Invalid port number"); // for (int i = 0; i < 5; i++) { // EXPECT_DEATH(server.ProcessRequest(i), // "Invalid request .* in ProcessRequest()") // << "Failed to die on request " << i); // } // // ASSERT_EXIT(server.ExitNow(), ::testing::ExitedWithCode(0), "Exiting"); // // bool KilledBySIGHUP(int exit_code) { // return WIFSIGNALED(exit_code) && WTERMSIG(exit_code) == SIGHUP; // } // // ASSERT_EXIT(client.HangUpServer(), KilledBySIGHUP, "Hanging up!"); // // On the regular expressions used in death tests: // // On POSIX-compliant systems (*nix), we use the library, // which uses the POSIX extended regex syntax. // // On other platforms (e.g. Windows), we only support a simple regex // syntax implemented as part of Google Test. This limited // implementation should be enough most of the time when writing // death tests; though it lacks many features you can find in PCRE // or POSIX extended regex syntax. For example, we don't support // union ("x|y"), grouping ("(xy)"), brackets ("[xy]"), and // repetition count ("x{5,7}"), among others. // // Below is the syntax that we do support. We chose it to be a // subset of both PCRE and POSIX extended regex, so it's easy to // learn wherever you come from. In the following: 'A' denotes a // literal character, period (.), or a single \\ escape sequence; // 'x' and 'y' denote regular expressions; 'm' and 'n' are for // natural numbers. // // c matches any literal character c // \\d matches any decimal digit // \\D matches any character that's not a decimal digit // \\f matches \f // \\n matches \n // \\r matches \r // \\s matches any ASCII whitespace, including \n // \\S matches any character that's not a whitespace // \\t matches \t // \\v matches \v // \\w matches any letter, _, or decimal digit // \\W matches any character that \\w doesn't match // \\c matches any literal character c, which must be a punctuation // . matches any single character except \n // A? matches 0 or 1 occurrences of A // A* matches 0 or many occurrences of A // A+ matches 1 or many occurrences of A // ^ matches the beginning of a string (not that of each line) // $ matches the end of a string (not that of each line) // xy matches x followed by y // // If you accidentally use PCRE or POSIX extended regex features // not implemented by us, you will get a run-time failure. In that // case, please try to rewrite your regular expression within the // above syntax. // // This implementation is *not* meant to be as highly tuned or robust // as a compiled regex library, but should perform well enough for a // death test, which already incurs significant overhead by launching // a child process. // // Known caveats: // // A "threadsafe" style death test obtains the path to the test // program from argv[0] and re-executes it in the sub-process. For // simplicity, the current implementation doesn't search the PATH // when launching the sub-process. This means that the user must // invoke the test program via a path that contains at least one // path separator (e.g. path/to/foo_test and // /absolute/path/to/bar_test are fine, but foo_test is not). This // is rarely a problem as people usually don't put the test binary // directory in PATH. // // TODO(wan@google.com): make thread-safe death tests search the PATH. // Asserts that a given statement causes the program to exit, with an // integer exit status that satisfies predicate, and emitting error output // that matches regex. # define ASSERT_EXIT(statement, predicate, regex) \ GTEST_DEATH_TEST_(statement, predicate, regex, GTEST_FATAL_FAILURE_) // Like ASSERT_EXIT, but continues on to successive tests in the // test case, if any: # define EXPECT_EXIT(statement, predicate, regex) \ GTEST_DEATH_TEST_(statement, predicate, regex, GTEST_NONFATAL_FAILURE_) // Asserts that a given statement causes the program to exit, either by // explicitly exiting with a nonzero exit code or being killed by a // signal, and emitting error output that matches regex. # define ASSERT_DEATH(statement, regex) \ ASSERT_EXIT(statement, ::testing::internal::ExitedUnsuccessfully, regex) // Like ASSERT_DEATH, but continues on to successive tests in the // test case, if any: # define EXPECT_DEATH(statement, regex) \ EXPECT_EXIT(statement, ::testing::internal::ExitedUnsuccessfully, regex) // Two predicate classes that can be used in {ASSERT,EXPECT}_EXIT*: // Tests that an exit code describes a normal exit with a given exit code. class GTEST_API_ ExitedWithCode { public: explicit ExitedWithCode(int exit_code); bool operator()(int exit_status) const; private: // No implementation - assignment is unsupported. void operator=(const ExitedWithCode& other); const int exit_code_; }; # if !GTEST_OS_WINDOWS // Tests that an exit code describes an exit due to termination by a // given signal. class GTEST_API_ KilledBySignal { public: explicit KilledBySignal(int signum); bool operator()(int exit_status) const; private: const int signum_; }; # endif // !GTEST_OS_WINDOWS // EXPECT_DEBUG_DEATH asserts that the given statements die in debug mode. // The death testing framework causes this to have interesting semantics, // since the sideeffects of the call are only visible in opt mode, and not // in debug mode. // // In practice, this can be used to test functions that utilize the // LOG(DFATAL) macro using the following style: // // int DieInDebugOr12(int* sideeffect) { // if (sideeffect) { // *sideeffect = 12; // } // LOG(DFATAL) << "death"; // return 12; // } // // TEST(TestCase, TestDieOr12WorksInDgbAndOpt) { // int sideeffect = 0; // // Only asserts in dbg. // EXPECT_DEBUG_DEATH(DieInDebugOr12(&sideeffect), "death"); // // #ifdef NDEBUG // // opt-mode has sideeffect visible. // EXPECT_EQ(12, sideeffect); // #else // // dbg-mode no visible sideeffect. // EXPECT_EQ(0, sideeffect); // #endif // } // // This will assert that DieInDebugReturn12InOpt() crashes in debug // mode, usually due to a DCHECK or LOG(DFATAL), but returns the // appropriate fallback value (12 in this case) in opt mode. If you // need to test that a function has appropriate side-effects in opt // mode, include assertions against the side-effects. A general // pattern for this is: // // EXPECT_DEBUG_DEATH({ // // Side-effects here will have an effect after this statement in // // opt mode, but none in debug mode. // EXPECT_EQ(12, DieInDebugOr12(&sideeffect)); // }, "death"); // # ifdef NDEBUG # define EXPECT_DEBUG_DEATH(statement, regex) \ do { statement; } while (::testing::internal::AlwaysFalse()) # define ASSERT_DEBUG_DEATH(statement, regex) \ do { statement; } while (::testing::internal::AlwaysFalse()) # else # define EXPECT_DEBUG_DEATH(statement, regex) \ EXPECT_DEATH(statement, regex) # define ASSERT_DEBUG_DEATH(statement, regex) \ ASSERT_DEATH(statement, regex) # endif // NDEBUG for EXPECT_DEBUG_DEATH #endif // GTEST_HAS_DEATH_TEST // EXPECT_DEATH_IF_SUPPORTED(statement, regex) and // ASSERT_DEATH_IF_SUPPORTED(statement, regex) expand to real death tests if // death tests are supported; otherwise they just issue a warning. This is // useful when you are combining death test assertions with normal test // assertions in one test. #if GTEST_HAS_DEATH_TEST # define EXPECT_DEATH_IF_SUPPORTED(statement, regex) \ EXPECT_DEATH(statement, regex) # define ASSERT_DEATH_IF_SUPPORTED(statement, regex) \ ASSERT_DEATH(statement, regex) #else # define EXPECT_DEATH_IF_SUPPORTED(statement, regex) \ GTEST_UNSUPPORTED_DEATH_TEST_(statement, regex, ) # define ASSERT_DEATH_IF_SUPPORTED(statement, regex) \ GTEST_UNSUPPORTED_DEATH_TEST_(statement, regex, return) #endif } // namespace testing #endif // GTEST_INCLUDE_GTEST_GTEST_DEATH_TEST_H_ // Copyright 2005, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // The Google C++ Testing Framework (Google Test) // // This header file defines the Message class. // // IMPORTANT NOTE: Due to limitation of the C++ language, we have to // leave some internal implementation details in this header file. // They are clearly marked by comments like this: // // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. // // Such code is NOT meant to be used by a user directly, and is subject // to CHANGE WITHOUT NOTICE. Therefore DO NOT DEPEND ON IT in a user // program! #ifndef GTEST_INCLUDE_GTEST_GTEST_MESSAGE_H_ #define GTEST_INCLUDE_GTEST_GTEST_MESSAGE_H_ #include namespace testing { // The Message class works like an ostream repeater. // // Typical usage: // // 1. You stream a bunch of values to a Message object. // It will remember the text in a stringstream. // 2. Then you stream the Message object to an ostream. // This causes the text in the Message to be streamed // to the ostream. // // For example; // // testing::Message foo; // foo << 1 << " != " << 2; // std::cout << foo; // // will print "1 != 2". // // Message is not intended to be inherited from. In particular, its // destructor is not virtual. // // Note that stringstream behaves differently in gcc and in MSVC. You // can stream a NULL char pointer to it in the former, but not in the // latter (it causes an access violation if you do). The Message // class hides this difference by treating a NULL char pointer as // "(null)". class GTEST_API_ Message { private: // The type of basic IO manipulators (endl, ends, and flush) for // narrow streams. typedef std::ostream& (*BasicNarrowIoManip)(std::ostream&); public: // Constructs an empty Message. // We allocate the stringstream separately because otherwise each use of // ASSERT/EXPECT in a procedure adds over 200 bytes to the procedure's // stack frame leading to huge stack frames in some cases; gcc does not reuse // the stack space. Message() : ss_(new ::std::stringstream) { // By default, we want there to be enough precision when printing // a double to a Message. *ss_ << std::setprecision(std::numeric_limits::digits10 + 2); } // Copy constructor. Message(const Message& msg) : ss_(new ::std::stringstream) { // NOLINT *ss_ << msg.GetString(); } // Constructs a Message from a C-string. explicit Message(const char* str) : ss_(new ::std::stringstream) { *ss_ << str; } #if GTEST_OS_SYMBIAN // Streams a value (either a pointer or not) to this object. template inline Message& operator <<(const T& value) { StreamHelper(typename internal::is_pointer::type(), value); return *this; } #else // Streams a non-pointer value to this object. template inline Message& operator <<(const T& val) { ::GTestStreamToHelper(ss_.get(), val); return *this; } // Streams a pointer value to this object. // // This function is an overload of the previous one. When you // stream a pointer to a Message, this definition will be used as it // is more specialized. (The C++ Standard, section // [temp.func.order].) If you stream a non-pointer, then the // previous definition will be used. // // The reason for this overload is that streaming a NULL pointer to // ostream is undefined behavior. Depending on the compiler, you // may get "0", "(nil)", "(null)", or an access violation. To // ensure consistent result across compilers, we always treat NULL // as "(null)". template inline Message& operator <<(T* const& pointer) { // NOLINT if (pointer == NULL) { *ss_ << "(null)"; } else { ::GTestStreamToHelper(ss_.get(), pointer); } return *this; } #endif // GTEST_OS_SYMBIAN // Since the basic IO manipulators are overloaded for both narrow // and wide streams, we have to provide this specialized definition // of operator <<, even though its body is the same as the // templatized version above. Without this definition, streaming // endl or other basic IO manipulators to Message will confuse the // compiler. Message& operator <<(BasicNarrowIoManip val) { *ss_ << val; return *this; } // Instead of 1/0, we want to see true/false for bool values. Message& operator <<(bool b) { return *this << (b ? "true" : "false"); } // These two overloads allow streaming a wide C string to a Message // using the UTF-8 encoding. Message& operator <<(const wchar_t* wide_c_str) { return *this << internal::String::ShowWideCString(wide_c_str); } Message& operator <<(wchar_t* wide_c_str) { return *this << internal::String::ShowWideCString(wide_c_str); } #if GTEST_HAS_STD_WSTRING // Converts the given wide string to a narrow string using the UTF-8 // encoding, and streams the result to this Message object. Message& operator <<(const ::std::wstring& wstr); #endif // GTEST_HAS_STD_WSTRING #if GTEST_HAS_GLOBAL_WSTRING // Converts the given wide string to a narrow string using the UTF-8 // encoding, and streams the result to this Message object. Message& operator <<(const ::wstring& wstr); #endif // GTEST_HAS_GLOBAL_WSTRING // Gets the text streamed to this object so far as a String. // Each '\0' character in the buffer is replaced with "\\0". // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. internal::String GetString() const { return internal::StringStreamToString(ss_.get()); } private: #if GTEST_OS_SYMBIAN // These are needed as the Nokia Symbian Compiler cannot decide between // const T& and const T* in a function template. The Nokia compiler _can_ // decide between class template specializations for T and T*, so a // tr1::type_traits-like is_pointer works, and we can overload on that. template inline void StreamHelper(internal::true_type /*dummy*/, T* pointer) { if (pointer == NULL) { *ss_ << "(null)"; } else { ::GTestStreamToHelper(ss_.get(), pointer); } } template inline void StreamHelper(internal::false_type /*dummy*/, const T& value) { ::GTestStreamToHelper(ss_.get(), value); } #endif // GTEST_OS_SYMBIAN // We'll hold the text streamed to this object here. const internal::scoped_ptr< ::std::stringstream> ss_; // We declare (but don't implement) this to prevent the compiler // from implementing the assignment operator. void operator=(const Message&); }; // Streams a Message to an ostream. inline std::ostream& operator <<(std::ostream& os, const Message& sb) { return os << sb.GetString(); } } // namespace testing #endif // GTEST_INCLUDE_GTEST_GTEST_MESSAGE_H_ // This file was GENERATED by command: // pump.py gtest-param-test.h.pump // DO NOT EDIT BY HAND!!! // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: vladl@google.com (Vlad Losev) // // Macros and functions for implementing parameterized tests // in Google C++ Testing Framework (Google Test) // // This file is generated by a SCRIPT. DO NOT EDIT BY HAND! // #ifndef GTEST_INCLUDE_GTEST_GTEST_PARAM_TEST_H_ #define GTEST_INCLUDE_GTEST_GTEST_PARAM_TEST_H_ // Value-parameterized tests allow you to test your code with different // parameters without writing multiple copies of the same test. // // Here is how you use value-parameterized tests: #if 0 // To write value-parameterized tests, first you should define a fixture // class. It is usually derived from testing::TestWithParam (see below for // another inheritance scheme that's sometimes useful in more complicated // class hierarchies), where the type of your parameter values. // TestWithParam is itself derived from testing::Test. T can be any // copyable type. If it's a raw pointer, you are responsible for managing the // lifespan of the pointed values. class FooTest : public ::testing::TestWithParam { // You can implement all the usual class fixture members here. }; // Then, use the TEST_P macro to define as many parameterized tests // for this fixture as you want. The _P suffix is for "parameterized" // or "pattern", whichever you prefer to think. TEST_P(FooTest, DoesBlah) { // Inside a test, access the test parameter with the GetParam() method // of the TestWithParam class: EXPECT_TRUE(foo.Blah(GetParam())); ... } TEST_P(FooTest, HasBlahBlah) { ... } // Finally, you can use INSTANTIATE_TEST_CASE_P to instantiate the test // case with any set of parameters you want. Google Test defines a number // of functions for generating test parameters. They return what we call // (surprise!) parameter generators. Here is a summary of them, which // are all in the testing namespace: // // // Range(begin, end [, step]) - Yields values {begin, begin+step, // begin+step+step, ...}. The values do not // include end. step defaults to 1. // Values(v1, v2, ..., vN) - Yields values {v1, v2, ..., vN}. // ValuesIn(container) - Yields values from a C-style array, an STL // ValuesIn(begin,end) container, or an iterator range [begin, end). // Bool() - Yields sequence {false, true}. // Combine(g1, g2, ..., gN) - Yields all combinations (the Cartesian product // for the math savvy) of the values generated // by the N generators. // // For more details, see comments at the definitions of these functions below // in this file. // // The following statement will instantiate tests from the FooTest test case // each with parameter values "meeny", "miny", and "moe". INSTANTIATE_TEST_CASE_P(InstantiationName, FooTest, Values("meeny", "miny", "moe")); // To distinguish different instances of the pattern, (yes, you // can instantiate it more then once) the first argument to the // INSTANTIATE_TEST_CASE_P macro is a prefix that will be added to the // actual test case name. Remember to pick unique prefixes for different // instantiations. The tests from the instantiation above will have // these names: // // * InstantiationName/FooTest.DoesBlah/0 for "meeny" // * InstantiationName/FooTest.DoesBlah/1 for "miny" // * InstantiationName/FooTest.DoesBlah/2 for "moe" // * InstantiationName/FooTest.HasBlahBlah/0 for "meeny" // * InstantiationName/FooTest.HasBlahBlah/1 for "miny" // * InstantiationName/FooTest.HasBlahBlah/2 for "moe" // // You can use these names in --gtest_filter. // // This statement will instantiate all tests from FooTest again, each // with parameter values "cat" and "dog": const char* pets[] = {"cat", "dog"}; INSTANTIATE_TEST_CASE_P(AnotherInstantiationName, FooTest, ValuesIn(pets)); // The tests from the instantiation above will have these names: // // * AnotherInstantiationName/FooTest.DoesBlah/0 for "cat" // * AnotherInstantiationName/FooTest.DoesBlah/1 for "dog" // * AnotherInstantiationName/FooTest.HasBlahBlah/0 for "cat" // * AnotherInstantiationName/FooTest.HasBlahBlah/1 for "dog" // // Please note that INSTANTIATE_TEST_CASE_P will instantiate all tests // in the given test case, whether their definitions come before or // AFTER the INSTANTIATE_TEST_CASE_P statement. // // Please also note that generator expressions (including parameters to the // generators) are evaluated in InitGoogleTest(), after main() has started. // This allows the user on one hand, to adjust generator parameters in order // to dynamically determine a set of tests to run and on the other hand, // give the user a chance to inspect the generated tests with Google Test // reflection API before RUN_ALL_TESTS() is executed. // // You can see samples/sample7_unittest.cc and samples/sample8_unittest.cc // for more examples. // // In the future, we plan to publish the API for defining new parameter // generators. But for now this interface remains part of the internal // implementation and is subject to change. // // // A parameterized test fixture must be derived from testing::Test and from // testing::WithParamInterface, where T is the type of the parameter // values. Inheriting from TestWithParam satisfies that requirement because // TestWithParam inherits from both Test and WithParamInterface. In more // complicated hierarchies, however, it is occasionally useful to inherit // separately from Test and WithParamInterface. For example: class BaseTest : public ::testing::Test { // You can inherit all the usual members for a non-parameterized test // fixture here. }; class DerivedTest : public BaseTest, public ::testing::WithParamInterface { // The usual test fixture members go here too. }; TEST_F(BaseTest, HasFoo) { // This is an ordinary non-parameterized test. } TEST_P(DerivedTest, DoesBlah) { // GetParam works just the same here as if you inherit from TestWithParam. EXPECT_TRUE(foo.Blah(GetParam())); } #endif // 0 #if !GTEST_OS_SYMBIAN # include #endif // scripts/fuse_gtest.py depends on gtest's own header being #included // *unconditionally*. Therefore these #includes cannot be moved // inside #if GTEST_HAS_PARAM_TEST. // Copyright 2008 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: vladl@google.com (Vlad Losev) // Type and function utilities for implementing parameterized tests. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_H_ #include #include #include // scripts/fuse_gtest.py depends on gtest's own header being #included // *unconditionally*. Therefore these #includes cannot be moved // inside #if GTEST_HAS_PARAM_TEST. // Copyright 2003 Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Authors: Dan Egnor (egnor@google.com) // // A "smart" pointer type with reference tracking. Every pointer to a // particular object is kept on a circular linked list. When the last pointer // to an object is destroyed or reassigned, the object is deleted. // // Used properly, this deletes the object when the last reference goes away. // There are several caveats: // - Like all reference counting schemes, cycles lead to leaks. // - Each smart pointer is actually two pointers (8 bytes instead of 4). // - Every time a pointer is assigned, the entire list of pointers to that // object is traversed. This class is therefore NOT SUITABLE when there // will often be more than two or three pointers to a particular object. // - References are only tracked as long as linked_ptr<> objects are copied. // If a linked_ptr<> is converted to a raw pointer and back, BAD THINGS // will happen (double deletion). // // A good use of this class is storing object references in STL containers. // You can safely put linked_ptr<> in a vector<>. // Other uses may not be as good. // // Note: If you use an incomplete type with linked_ptr<>, the class // *containing* linked_ptr<> must have a constructor and destructor (even // if they do nothing!). // // Bill Gibbons suggested we use something like this. // // Thread Safety: // Unlike other linked_ptr implementations, in this implementation // a linked_ptr object is thread-safe in the sense that: // - it's safe to copy linked_ptr objects concurrently, // - it's safe to copy *from* a linked_ptr and read its underlying // raw pointer (e.g. via get()) concurrently, and // - it's safe to write to two linked_ptrs that point to the same // shared object concurrently. // TODO(wan@google.com): rename this to safe_linked_ptr to avoid // confusion with normal linked_ptr. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_LINKED_PTR_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_LINKED_PTR_H_ #include #include namespace testing { namespace internal { // Protects copying of all linked_ptr objects. GTEST_API_ GTEST_DECLARE_STATIC_MUTEX_(g_linked_ptr_mutex); // This is used internally by all instances of linked_ptr<>. It needs to be // a non-template class because different types of linked_ptr<> can refer to // the same object (linked_ptr(obj) vs linked_ptr(obj)). // So, it needs to be possible for different types of linked_ptr to participate // in the same circular linked list, so we need a single class type here. // // DO NOT USE THIS CLASS DIRECTLY YOURSELF. Use linked_ptr. class linked_ptr_internal { public: // Create a new circle that includes only this instance. void join_new() { next_ = this; } // Many linked_ptr operations may change p.link_ for some linked_ptr // variable p in the same circle as this object. Therefore we need // to prevent two such operations from occurring concurrently. // // Note that different types of linked_ptr objects can coexist in a // circle (e.g. linked_ptr, linked_ptr, and // linked_ptr). Therefore we must use a single mutex to // protect all linked_ptr objects. This can create serious // contention in production code, but is acceptable in a testing // framework. // Join an existing circle. // L < g_linked_ptr_mutex void join(linked_ptr_internal const* ptr) { MutexLock lock(&g_linked_ptr_mutex); linked_ptr_internal const* p = ptr; while (p->next_ != ptr) p = p->next_; p->next_ = this; next_ = ptr; } // Leave whatever circle we're part of. Returns true if we were the // last member of the circle. Once this is done, you can join() another. // L < g_linked_ptr_mutex bool depart() { MutexLock lock(&g_linked_ptr_mutex); if (next_ == this) return true; linked_ptr_internal const* p = next_; while (p->next_ != this) p = p->next_; p->next_ = next_; return false; } private: mutable linked_ptr_internal const* next_; }; template class linked_ptr { public: typedef T element_type; // Take over ownership of a raw pointer. This should happen as soon as // possible after the object is created. explicit linked_ptr(T* ptr = NULL) { capture(ptr); } ~linked_ptr() { depart(); } // Copy an existing linked_ptr<>, adding ourselves to the list of references. template linked_ptr(linked_ptr const& ptr) { copy(&ptr); } linked_ptr(linked_ptr const& ptr) { // NOLINT assert(&ptr != this); copy(&ptr); } // Assignment releases the old value and acquires the new. template linked_ptr& operator=(linked_ptr const& ptr) { depart(); copy(&ptr); return *this; } linked_ptr& operator=(linked_ptr const& ptr) { if (&ptr != this) { depart(); copy(&ptr); } return *this; } // Smart pointer members. void reset(T* ptr = NULL) { depart(); capture(ptr); } T* get() const { return value_; } T* operator->() const { return value_; } T& operator*() const { return *value_; } bool operator==(T* p) const { return value_ == p; } bool operator!=(T* p) const { return value_ != p; } template bool operator==(linked_ptr const& ptr) const { return value_ == ptr.get(); } template bool operator!=(linked_ptr const& ptr) const { return value_ != ptr.get(); } private: template friend class linked_ptr; T* value_; linked_ptr_internal link_; void depart() { if (link_.depart()) delete value_; } void capture(T* ptr) { value_ = ptr; link_.join_new(); } template void copy(linked_ptr const* ptr) { value_ = ptr->get(); if (value_) link_.join(&ptr->link_); else link_.join_new(); } }; template inline bool operator==(T* ptr, const linked_ptr& x) { return ptr == x.get(); } template inline bool operator!=(T* ptr, const linked_ptr& x) { return ptr != x.get(); } // A function to convert T* into linked_ptr // Doing e.g. make_linked_ptr(new FooBarBaz(arg)) is a shorter notation // for linked_ptr >(new FooBarBaz(arg)) template linked_ptr make_linked_ptr(T* ptr) { return linked_ptr(ptr); } } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_LINKED_PTR_H_ // Copyright 2007, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // Google Test - The Google C++ Testing Framework // // This file implements a universal value printer that can print a // value of any type T: // // void ::testing::internal::UniversalPrinter::Print(value, ostream_ptr); // // A user can teach this function how to print a class type T by // defining either operator<<() or PrintTo() in the namespace that // defines T. More specifically, the FIRST defined function in the // following list will be used (assuming T is defined in namespace // foo): // // 1. foo::PrintTo(const T&, ostream*) // 2. operator<<(ostream&, const T&) defined in either foo or the // global namespace. // // If none of the above is defined, it will print the debug string of // the value if it is a protocol buffer, or print the raw bytes in the // value otherwise. // // To aid debugging: when T is a reference type, the address of the // value is also printed; when T is a (const) char pointer, both the // pointer value and the NUL-terminated string it points to are // printed. // // We also provide some convenient wrappers: // // // Prints a value to a string. For a (const or not) char // // pointer, the NUL-terminated string (but not the pointer) is // // printed. // std::string ::testing::PrintToString(const T& value); // // // Prints a value tersely: for a reference type, the referenced // // value (but not the address) is printed; for a (const or not) char // // pointer, the NUL-terminated string (but not the pointer) is // // printed. // void ::testing::internal::UniversalTersePrint(const T& value, ostream*); // // // Prints value using the type inferred by the compiler. The difference // // from UniversalTersePrint() is that this function prints both the // // pointer and the NUL-terminated string for a (const or not) char pointer. // void ::testing::internal::UniversalPrint(const T& value, ostream*); // // // Prints the fields of a tuple tersely to a string vector, one // // element for each field. Tuple support must be enabled in // // gtest-port.h. // std::vector UniversalTersePrintTupleFieldsToStrings( // const Tuple& value); // // Known limitation: // // The print primitives print the elements of an STL-style container // using the compiler-inferred type of *iter where iter is a // const_iterator of the container. When const_iterator is an input // iterator but not a forward iterator, this inferred type may not // match value_type, and the print output may be incorrect. In // practice, this is rarely a problem as for most containers // const_iterator is a forward iterator. We'll fix this if there's an // actual need for it. Note that this fix cannot rely on value_type // being defined as many user-defined container types don't have // value_type. #ifndef GTEST_INCLUDE_GTEST_GTEST_PRINTERS_H_ #define GTEST_INCLUDE_GTEST_GTEST_PRINTERS_H_ #include // NOLINT #include #include #include #include namespace testing { // Definitions in the 'internal' and 'internal2' name spaces are // subject to change without notice. DO NOT USE THEM IN USER CODE! namespace internal2 { // Prints the given number of bytes in the given object to the given // ostream. GTEST_API_ void PrintBytesInObjectTo(const unsigned char* obj_bytes, size_t count, ::std::ostream* os); // For selecting which printer to use when a given type has neither << // nor PrintTo(). enum TypeKind { kProtobuf, // a protobuf type kConvertibleToInteger, // a type implicitly convertible to BiggestInt // (e.g. a named or unnamed enum type) kOtherType // anything else }; // TypeWithoutFormatter::PrintValue(value, os) is called // by the universal printer to print a value of type T when neither // operator<< nor PrintTo() is defined for T, where kTypeKind is the // "kind" of T as defined by enum TypeKind. template class TypeWithoutFormatter { public: // This default version is called when kTypeKind is kOtherType. static void PrintValue(const T& value, ::std::ostream* os) { PrintBytesInObjectTo(reinterpret_cast(&value), sizeof(value), os); } }; // We print a protobuf using its ShortDebugString() when the string // doesn't exceed this many characters; otherwise we print it using // DebugString() for better readability. const size_t kProtobufOneLinerMaxLength = 50; template class TypeWithoutFormatter { public: static void PrintValue(const T& value, ::std::ostream* os) { const ::testing::internal::string short_str = value.ShortDebugString(); const ::testing::internal::string pretty_str = short_str.length() <= kProtobufOneLinerMaxLength ? short_str : ("\n" + value.DebugString()); *os << ("<" + pretty_str + ">"); } }; template class TypeWithoutFormatter { public: // Since T has no << operator or PrintTo() but can be implicitly // converted to BiggestInt, we print it as a BiggestInt. // // Most likely T is an enum type (either named or unnamed), in which // case printing it as an integer is the desired behavior. In case // T is not an enum, printing it as an integer is the best we can do // given that it has no user-defined printer. static void PrintValue(const T& value, ::std::ostream* os) { const internal::BiggestInt kBigInt = value; *os << kBigInt; } }; // Prints the given value to the given ostream. If the value is a // protocol message, its debug string is printed; if it's an enum or // of a type implicitly convertible to BiggestInt, it's printed as an // integer; otherwise the bytes in the value are printed. This is // what UniversalPrinter::Print() does when it knows nothing about // type T and T has neither << operator nor PrintTo(). // // A user can override this behavior for a class type Foo by defining // a << operator in the namespace where Foo is defined. // // We put this operator in namespace 'internal2' instead of 'internal' // to simplify the implementation, as much code in 'internal' needs to // use << in STL, which would conflict with our own << were it defined // in 'internal'. // // Note that this operator<< takes a generic std::basic_ostream type instead of the more restricted std::ostream. If // we define it to take an std::ostream instead, we'll get an // "ambiguous overloads" compiler error when trying to print a type // Foo that supports streaming to std::basic_ostream, as the compiler cannot tell whether // operator<<(std::ostream&, const T&) or // operator<<(std::basic_stream, const Foo&) is more // specific. template ::std::basic_ostream& operator<<( ::std::basic_ostream& os, const T& x) { TypeWithoutFormatter::value ? kProtobuf : internal::ImplicitlyConvertible::value ? kConvertibleToInteger : kOtherType)>::PrintValue(x, &os); return os; } } // namespace internal2 } // namespace testing // This namespace MUST NOT BE NESTED IN ::testing, or the name look-up // magic needed for implementing UniversalPrinter won't work. namespace testing_internal { // Used to print a value that is not an STL-style container when the // user doesn't define PrintTo() for it. template void DefaultPrintNonContainerTo(const T& value, ::std::ostream* os) { // With the following statement, during unqualified name lookup, // testing::internal2::operator<< appears as if it was declared in // the nearest enclosing namespace that contains both // ::testing_internal and ::testing::internal2, i.e. the global // namespace. For more details, refer to the C++ Standard section // 7.3.4-1 [namespace.udir]. This allows us to fall back onto // testing::internal2::operator<< in case T doesn't come with a << // operator. // // We cannot write 'using ::testing::internal2::operator<<;', which // gcc 3.3 fails to compile due to a compiler bug. using namespace ::testing::internal2; // NOLINT // Assuming T is defined in namespace foo, in the next statement, // the compiler will consider all of: // // 1. foo::operator<< (thanks to Koenig look-up), // 2. ::operator<< (as the current namespace is enclosed in ::), // 3. testing::internal2::operator<< (thanks to the using statement above). // // The operator<< whose type matches T best will be picked. // // We deliberately allow #2 to be a candidate, as sometimes it's // impossible to define #1 (e.g. when foo is ::std, defining // anything in it is undefined behavior unless you are a compiler // vendor.). *os << value; } } // namespace testing_internal namespace testing { namespace internal { // UniversalPrinter::Print(value, ostream_ptr) prints the given // value to the given ostream. The caller must ensure that // 'ostream_ptr' is not NULL, or the behavior is undefined. // // We define UniversalPrinter as a class template (as opposed to a // function template), as we need to partially specialize it for // reference types, which cannot be done with function templates. template class UniversalPrinter; template void UniversalPrint(const T& value, ::std::ostream* os); // Used to print an STL-style container when the user doesn't define // a PrintTo() for it. template void DefaultPrintTo(IsContainer /* dummy */, false_type /* is not a pointer */, const C& container, ::std::ostream* os) { const size_t kMaxCount = 32; // The maximum number of elements to print. *os << '{'; size_t count = 0; for (typename C::const_iterator it = container.begin(); it != container.end(); ++it, ++count) { if (count > 0) { *os << ','; if (count == kMaxCount) { // Enough has been printed. *os << " ..."; break; } } *os << ' '; // We cannot call PrintTo(*it, os) here as PrintTo() doesn't // handle *it being a native array. internal::UniversalPrint(*it, os); } if (count > 0) { *os << ' '; } *os << '}'; } // Used to print a pointer that is neither a char pointer nor a member // pointer, when the user doesn't define PrintTo() for it. (A member // variable pointer or member function pointer doesn't really point to // a location in the address space. Their representation is // implementation-defined. Therefore they will be printed as raw // bytes.) template void DefaultPrintTo(IsNotContainer /* dummy */, true_type /* is a pointer */, T* p, ::std::ostream* os) { if (p == NULL) { *os << "NULL"; } else { // C++ doesn't allow casting from a function pointer to any object // pointer. // // IsTrue() silences warnings: "Condition is always true", // "unreachable code". if (IsTrue(ImplicitlyConvertible::value)) { // T is not a function type. We just call << to print p, // relying on ADL to pick up user-defined << for their pointer // types, if any. *os << p; } else { // T is a function type, so '*os << p' doesn't do what we want // (it just prints p as bool). We want to print p as a const // void*. However, we cannot cast it to const void* directly, // even using reinterpret_cast, as earlier versions of gcc // (e.g. 3.4.5) cannot compile the cast when p is a function // pointer. Casting to UInt64 first solves the problem. *os << reinterpret_cast( reinterpret_cast(p)); } } } // Used to print a non-container, non-pointer value when the user // doesn't define PrintTo() for it. template void DefaultPrintTo(IsNotContainer /* dummy */, false_type /* is not a pointer */, const T& value, ::std::ostream* os) { ::testing_internal::DefaultPrintNonContainerTo(value, os); } // Prints the given value using the << operator if it has one; // otherwise prints the bytes in it. This is what // UniversalPrinter::Print() does when PrintTo() is not specialized // or overloaded for type T. // // A user can override this behavior for a class type Foo by defining // an overload of PrintTo() in the namespace where Foo is defined. We // give the user this option as sometimes defining a << operator for // Foo is not desirable (e.g. the coding style may prevent doing it, // or there is already a << operator but it doesn't do what the user // wants). template void PrintTo(const T& value, ::std::ostream* os) { // DefaultPrintTo() is overloaded. The type of its first two // arguments determine which version will be picked. If T is an // STL-style container, the version for container will be called; if // T is a pointer, the pointer version will be called; otherwise the // generic version will be called. // // Note that we check for container types here, prior to we check // for protocol message types in our operator<<. The rationale is: // // For protocol messages, we want to give people a chance to // override Google Mock's format by defining a PrintTo() or // operator<<. For STL containers, other formats can be // incompatible with Google Mock's format for the container // elements; therefore we check for container types here to ensure // that our format is used. // // The second argument of DefaultPrintTo() is needed to bypass a bug // in Symbian's C++ compiler that prevents it from picking the right // overload between: // // PrintTo(const T& x, ...); // PrintTo(T* x, ...); DefaultPrintTo(IsContainerTest(0), is_pointer(), value, os); } // The following list of PrintTo() overloads tells // UniversalPrinter::Print() how to print standard types (built-in // types, strings, plain arrays, and pointers). // Overloads for various char types. GTEST_API_ void PrintTo(unsigned char c, ::std::ostream* os); GTEST_API_ void PrintTo(signed char c, ::std::ostream* os); inline void PrintTo(char c, ::std::ostream* os) { // When printing a plain char, we always treat it as unsigned. This // way, the output won't be affected by whether the compiler thinks // char is signed or not. PrintTo(static_cast(c), os); } // Overloads for other simple built-in types. inline void PrintTo(bool x, ::std::ostream* os) { *os << (x ? "true" : "false"); } // Overload for wchar_t type. // Prints a wchar_t as a symbol if it is printable or as its internal // code otherwise and also as its decimal code (except for L'\0'). // The L'\0' char is printed as "L'\\0'". The decimal code is printed // as signed integer when wchar_t is implemented by the compiler // as a signed type and is printed as an unsigned integer when wchar_t // is implemented as an unsigned type. GTEST_API_ void PrintTo(wchar_t wc, ::std::ostream* os); // Overloads for C strings. GTEST_API_ void PrintTo(const char* s, ::std::ostream* os); inline void PrintTo(char* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } // signed/unsigned char is often used for representing binary data, so // we print pointers to it as void* to be safe. inline void PrintTo(const signed char* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } inline void PrintTo(signed char* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } inline void PrintTo(const unsigned char* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } inline void PrintTo(unsigned char* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } // MSVC can be configured to define wchar_t as a typedef of unsigned // short. It defines _NATIVE_WCHAR_T_DEFINED when wchar_t is a native // type. When wchar_t is a typedef, defining an overload for const // wchar_t* would cause unsigned short* be printed as a wide string, // possibly causing invalid memory accesses. #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED) // Overloads for wide C strings GTEST_API_ void PrintTo(const wchar_t* s, ::std::ostream* os); inline void PrintTo(wchar_t* s, ::std::ostream* os) { PrintTo(ImplicitCast_(s), os); } #endif // Overload for C arrays. Multi-dimensional arrays are printed // properly. // Prints the given number of elements in an array, without printing // the curly braces. template void PrintRawArrayTo(const T a[], size_t count, ::std::ostream* os) { UniversalPrint(a[0], os); for (size_t i = 1; i != count; i++) { *os << ", "; UniversalPrint(a[i], os); } } // Overloads for ::string and ::std::string. #if GTEST_HAS_GLOBAL_STRING GTEST_API_ void PrintStringTo(const ::string&s, ::std::ostream* os); inline void PrintTo(const ::string& s, ::std::ostream* os) { PrintStringTo(s, os); } #endif // GTEST_HAS_GLOBAL_STRING GTEST_API_ void PrintStringTo(const ::std::string&s, ::std::ostream* os); inline void PrintTo(const ::std::string& s, ::std::ostream* os) { PrintStringTo(s, os); } // Overloads for ::wstring and ::std::wstring. #if GTEST_HAS_GLOBAL_WSTRING GTEST_API_ void PrintWideStringTo(const ::wstring&s, ::std::ostream* os); inline void PrintTo(const ::wstring& s, ::std::ostream* os) { PrintWideStringTo(s, os); } #endif // GTEST_HAS_GLOBAL_WSTRING #if GTEST_HAS_STD_WSTRING GTEST_API_ void PrintWideStringTo(const ::std::wstring&s, ::std::ostream* os); inline void PrintTo(const ::std::wstring& s, ::std::ostream* os) { PrintWideStringTo(s, os); } #endif // GTEST_HAS_STD_WSTRING #if GTEST_HAS_TR1_TUPLE // Overload for ::std::tr1::tuple. Needed for printing function arguments, // which are packed as tuples. // Helper function for printing a tuple. T must be instantiated with // a tuple type. template void PrintTupleTo(const T& t, ::std::ostream* os); // Overloaded PrintTo() for tuples of various arities. We support // tuples of up-to 10 fields. The following implementation works // regardless of whether tr1::tuple is implemented using the // non-standard variadic template feature or not. inline void PrintTo(const ::std::tr1::tuple<>& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo(const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } template void PrintTo( const ::std::tr1::tuple& t, ::std::ostream* os) { PrintTupleTo(t, os); } #endif // GTEST_HAS_TR1_TUPLE // Overload for std::pair. template void PrintTo(const ::std::pair& value, ::std::ostream* os) { *os << '('; // We cannot use UniversalPrint(value.first, os) here, as T1 may be // a reference type. The same for printing value.second. UniversalPrinter::Print(value.first, os); *os << ", "; UniversalPrinter::Print(value.second, os); *os << ')'; } // Implements printing a non-reference type T by letting the compiler // pick the right overload of PrintTo() for T. template class UniversalPrinter { public: // MSVC warns about adding const to a function type, so we want to // disable the warning. #ifdef _MSC_VER # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4180) // Temporarily disables warning 4180. #endif // _MSC_VER // Note: we deliberately don't call this PrintTo(), as that name // conflicts with ::testing::internal::PrintTo in the body of the // function. static void Print(const T& value, ::std::ostream* os) { // By default, ::testing::internal::PrintTo() is used for printing // the value. // // Thanks to Koenig look-up, if T is a class and has its own // PrintTo() function defined in its namespace, that function will // be visible here. Since it is more specific than the generic ones // in ::testing::internal, it will be picked by the compiler in the // following statement - exactly what we want. PrintTo(value, os); } #ifdef _MSC_VER # pragma warning(pop) // Restores the warning state. #endif // _MSC_VER }; // UniversalPrintArray(begin, len, os) prints an array of 'len' // elements, starting at address 'begin'. template void UniversalPrintArray(const T* begin, size_t len, ::std::ostream* os) { if (len == 0) { *os << "{}"; } else { *os << "{ "; const size_t kThreshold = 18; const size_t kChunkSize = 8; // If the array has more than kThreshold elements, we'll have to // omit some details by printing only the first and the last // kChunkSize elements. // TODO(wan@google.com): let the user control the threshold using a flag. if (len <= kThreshold) { PrintRawArrayTo(begin, len, os); } else { PrintRawArrayTo(begin, kChunkSize, os); *os << ", ..., "; PrintRawArrayTo(begin + len - kChunkSize, kChunkSize, os); } *os << " }"; } } // This overload prints a (const) char array compactly. GTEST_API_ void UniversalPrintArray(const char* begin, size_t len, ::std::ostream* os); // Implements printing an array type T[N]. template class UniversalPrinter { public: // Prints the given array, omitting some elements when there are too // many. static void Print(const T (&a)[N], ::std::ostream* os) { UniversalPrintArray(a, N, os); } }; // Implements printing a reference type T&. template class UniversalPrinter { public: // MSVC warns about adding const to a function type, so we want to // disable the warning. #ifdef _MSC_VER # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4180) // Temporarily disables warning 4180. #endif // _MSC_VER static void Print(const T& value, ::std::ostream* os) { // Prints the address of the value. We use reinterpret_cast here // as static_cast doesn't compile when T is a function type. *os << "@" << reinterpret_cast(&value) << " "; // Then prints the value itself. UniversalPrint(value, os); } #ifdef _MSC_VER # pragma warning(pop) // Restores the warning state. #endif // _MSC_VER }; // Prints a value tersely: for a reference type, the referenced value // (but not the address) is printed; for a (const) char pointer, the // NUL-terminated string (but not the pointer) is printed. template void UniversalTersePrint(const T& value, ::std::ostream* os) { UniversalPrint(value, os); } inline void UniversalTersePrint(const char* str, ::std::ostream* os) { if (str == NULL) { *os << "NULL"; } else { UniversalPrint(string(str), os); } } inline void UniversalTersePrint(char* str, ::std::ostream* os) { UniversalTersePrint(static_cast(str), os); } // Prints a value using the type inferred by the compiler. The // difference between this and UniversalTersePrint() is that for a // (const) char pointer, this prints both the pointer and the // NUL-terminated string. template void UniversalPrint(const T& value, ::std::ostream* os) { UniversalPrinter::Print(value, os); } #if GTEST_HAS_TR1_TUPLE typedef ::std::vector Strings; // This helper template allows PrintTo() for tuples and // UniversalTersePrintTupleFieldsToStrings() to be defined by // induction on the number of tuple fields. The idea is that // TuplePrefixPrinter::PrintPrefixTo(t, os) prints the first N // fields in tuple t, and can be defined in terms of // TuplePrefixPrinter. // The inductive case. template struct TuplePrefixPrinter { // Prints the first N fields of a tuple. template static void PrintPrefixTo(const Tuple& t, ::std::ostream* os) { TuplePrefixPrinter::PrintPrefixTo(t, os); *os << ", "; UniversalPrinter::type> ::Print(::std::tr1::get(t), os); } // Tersely prints the first N fields of a tuple to a string vector, // one element for each field. template static void TersePrintPrefixToStrings(const Tuple& t, Strings* strings) { TuplePrefixPrinter::TersePrintPrefixToStrings(t, strings); ::std::stringstream ss; UniversalTersePrint(::std::tr1::get(t), &ss); strings->push_back(ss.str()); } }; // Base cases. template <> struct TuplePrefixPrinter<0> { template static void PrintPrefixTo(const Tuple&, ::std::ostream*) {} template static void TersePrintPrefixToStrings(const Tuple&, Strings*) {} }; // We have to specialize the entire TuplePrefixPrinter<> class // template here, even though the definition of // TersePrintPrefixToStrings() is the same as the generic version, as // Embarcadero (formerly CodeGear, formerly Borland) C++ doesn't // support specializing a method template of a class template. template <> struct TuplePrefixPrinter<1> { template static void PrintPrefixTo(const Tuple& t, ::std::ostream* os) { UniversalPrinter::type>:: Print(::std::tr1::get<0>(t), os); } template static void TersePrintPrefixToStrings(const Tuple& t, Strings* strings) { ::std::stringstream ss; UniversalTersePrint(::std::tr1::get<0>(t), &ss); strings->push_back(ss.str()); } }; // Helper function for printing a tuple. T must be instantiated with // a tuple type. template void PrintTupleTo(const T& t, ::std::ostream* os) { *os << "("; TuplePrefixPrinter< ::std::tr1::tuple_size::value>:: PrintPrefixTo(t, os); *os << ")"; } // Prints the fields of a tuple tersely to a string vector, one // element for each field. See the comment before // UniversalTersePrint() for how we define "tersely". template Strings UniversalTersePrintTupleFieldsToStrings(const Tuple& value) { Strings result; TuplePrefixPrinter< ::std::tr1::tuple_size::value>:: TersePrintPrefixToStrings(value, &result); return result; } #endif // GTEST_HAS_TR1_TUPLE } // namespace internal template ::std::string PrintToString(const T& value) { ::std::stringstream ss; internal::UniversalTersePrint(value, &ss); return ss.str(); } } // namespace testing #endif // GTEST_INCLUDE_GTEST_GTEST_PRINTERS_H_ #if GTEST_HAS_PARAM_TEST namespace testing { namespace internal { // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Outputs a message explaining invalid registration of different // fixture class for the same test case. This may happen when // TEST_P macro is used to define two tests with the same name // but in different namespaces. GTEST_API_ void ReportInvalidTestCaseType(const char* test_case_name, const char* file, int line); template class ParamGeneratorInterface; template class ParamGenerator; // Interface for iterating over elements provided by an implementation // of ParamGeneratorInterface. template class ParamIteratorInterface { public: virtual ~ParamIteratorInterface() {} // A pointer to the base generator instance. // Used only for the purposes of iterator comparison // to make sure that two iterators belong to the same generator. virtual const ParamGeneratorInterface* BaseGenerator() const = 0; // Advances iterator to point to the next element // provided by the generator. The caller is responsible // for not calling Advance() on an iterator equal to // BaseGenerator()->End(). virtual void Advance() = 0; // Clones the iterator object. Used for implementing copy semantics // of ParamIterator. virtual ParamIteratorInterface* Clone() const = 0; // Dereferences the current iterator and provides (read-only) access // to the pointed value. It is the caller's responsibility not to call // Current() on an iterator equal to BaseGenerator()->End(). // Used for implementing ParamGenerator::operator*(). virtual const T* Current() const = 0; // Determines whether the given iterator and other point to the same // element in the sequence generated by the generator. // Used for implementing ParamGenerator::operator==(). virtual bool Equals(const ParamIteratorInterface& other) const = 0; }; // Class iterating over elements provided by an implementation of // ParamGeneratorInterface. It wraps ParamIteratorInterface // and implements the const forward iterator concept. template class ParamIterator { public: typedef T value_type; typedef const T& reference; typedef ptrdiff_t difference_type; // ParamIterator assumes ownership of the impl_ pointer. ParamIterator(const ParamIterator& other) : impl_(other.impl_->Clone()) {} ParamIterator& operator=(const ParamIterator& other) { if (this != &other) impl_.reset(other.impl_->Clone()); return *this; } const T& operator*() const { return *impl_->Current(); } const T* operator->() const { return impl_->Current(); } // Prefix version of operator++. ParamIterator& operator++() { impl_->Advance(); return *this; } // Postfix version of operator++. ParamIterator operator++(int /*unused*/) { ParamIteratorInterface* clone = impl_->Clone(); impl_->Advance(); return ParamIterator(clone); } bool operator==(const ParamIterator& other) const { return impl_.get() == other.impl_.get() || impl_->Equals(*other.impl_); } bool operator!=(const ParamIterator& other) const { return !(*this == other); } private: friend class ParamGenerator; explicit ParamIterator(ParamIteratorInterface* impl) : impl_(impl) {} scoped_ptr > impl_; }; // ParamGeneratorInterface is the binary interface to access generators // defined in other translation units. template class ParamGeneratorInterface { public: typedef T ParamType; virtual ~ParamGeneratorInterface() {} // Generator interface definition virtual ParamIteratorInterface* Begin() const = 0; virtual ParamIteratorInterface* End() const = 0; }; // Wraps ParamGeneratorInterface and provides general generator syntax // compatible with the STL Container concept. // This class implements copy initialization semantics and the contained // ParamGeneratorInterface instance is shared among all copies // of the original object. This is possible because that instance is immutable. template class ParamGenerator { public: typedef ParamIterator iterator; explicit ParamGenerator(ParamGeneratorInterface* impl) : impl_(impl) {} ParamGenerator(const ParamGenerator& other) : impl_(other.impl_) {} ParamGenerator& operator=(const ParamGenerator& other) { impl_ = other.impl_; return *this; } iterator begin() const { return iterator(impl_->Begin()); } iterator end() const { return iterator(impl_->End()); } private: linked_ptr > impl_; }; // Generates values from a range of two comparable values. Can be used to // generate sequences of user-defined types that implement operator+() and // operator<(). // This class is used in the Range() function. template class RangeGenerator : public ParamGeneratorInterface { public: RangeGenerator(T begin, T end, IncrementT step) : begin_(begin), end_(end), step_(step), end_index_(CalculateEndIndex(begin, end, step)) {} virtual ~RangeGenerator() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, begin_, 0, step_); } virtual ParamIteratorInterface* End() const { return new Iterator(this, end_, end_index_, step_); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, T value, int index, IncrementT step) : base_(base), value_(value), index_(index), step_(step) {} virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } virtual void Advance() { value_ = value_ + step_; index_++; } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const T* Current() const { return &value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const int other_index = CheckedDowncastToActualType(&other)->index_; return index_ == other_index; } private: Iterator(const Iterator& other) : ParamIteratorInterface(), base_(other.base_), value_(other.value_), index_(other.index_), step_(other.step_) {} // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; T value_; int index_; const IncrementT step_; }; // class RangeGenerator::Iterator static int CalculateEndIndex(const T& begin, const T& end, const IncrementT& step) { int end_index = 0; for (T i = begin; i < end; i = i + step) end_index++; return end_index; } // No implementation - assignment is unsupported. void operator=(const RangeGenerator& other); const T begin_; const T end_; const IncrementT step_; // The index for the end() iterator. All the elements in the generated // sequence are indexed (0-based) to aid iterator comparison. const int end_index_; }; // class RangeGenerator // Generates values from a pair of STL-style iterators. Used in the // ValuesIn() function. The elements are copied from the source range // since the source can be located on the stack, and the generator // is likely to persist beyond that stack frame. template class ValuesInIteratorRangeGenerator : public ParamGeneratorInterface { public: template ValuesInIteratorRangeGenerator(ForwardIterator begin, ForwardIterator end) : container_(begin, end) {} virtual ~ValuesInIteratorRangeGenerator() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, container_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, container_.end()); } private: typedef typename ::std::vector ContainerType; class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, typename ContainerType::const_iterator iterator) : base_(base), iterator_(iterator) {} virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } virtual void Advance() { ++iterator_; value_.reset(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } // We need to use cached value referenced by iterator_ because *iterator_ // can return a temporary object (and of type other then T), so just // having "return &*iterator_;" doesn't work. // value_ is updated here and not in Advance() because Advance() // can advance iterator_ beyond the end of the range, and we cannot // detect that fact. The client code, on the other hand, is // responsible for not calling Current() on an out-of-range iterator. virtual const T* Current() const { if (value_.get() == NULL) value_.reset(new T(*iterator_)); return value_.get(); } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; return iterator_ == CheckedDowncastToActualType(&other)->iterator_; } private: Iterator(const Iterator& other) // The explicit constructor call suppresses a false warning // emitted by gcc when supplied with the -Wextra option. : ParamIteratorInterface(), base_(other.base_), iterator_(other.iterator_) {} const ParamGeneratorInterface* const base_; typename ContainerType::const_iterator iterator_; // A cached value of *iterator_. We keep it here to allow access by // pointer in the wrapping iterator's operator->(). // value_ needs to be mutable to be accessed in Current(). // Use of scoped_ptr helps manage cached value's lifetime, // which is bound by the lifespan of the iterator itself. mutable scoped_ptr value_; }; // class ValuesInIteratorRangeGenerator::Iterator // No implementation - assignment is unsupported. void operator=(const ValuesInIteratorRangeGenerator& other); const ContainerType container_; }; // class ValuesInIteratorRangeGenerator // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Stores a parameter value and later creates tests parameterized with that // value. template class ParameterizedTestFactory : public TestFactoryBase { public: typedef typename TestClass::ParamType ParamType; explicit ParameterizedTestFactory(ParamType parameter) : parameter_(parameter) {} virtual Test* CreateTest() { TestClass::SetParam(¶meter_); return new TestClass(); } private: const ParamType parameter_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ParameterizedTestFactory); }; // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // TestMetaFactoryBase is a base class for meta-factories that create // test factories for passing into MakeAndRegisterTestInfo function. template class TestMetaFactoryBase { public: virtual ~TestMetaFactoryBase() {} virtual TestFactoryBase* CreateTestFactory(ParamType parameter) = 0; }; // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // TestMetaFactory creates test factories for passing into // MakeAndRegisterTestInfo function. Since MakeAndRegisterTestInfo receives // ownership of test factory pointer, same factory object cannot be passed // into that method twice. But ParameterizedTestCaseInfo is going to call // it for each Test/Parameter value combination. Thus it needs meta factory // creator class. template class TestMetaFactory : public TestMetaFactoryBase { public: typedef typename TestCase::ParamType ParamType; TestMetaFactory() {} virtual TestFactoryBase* CreateTestFactory(ParamType parameter) { return new ParameterizedTestFactory(parameter); } private: GTEST_DISALLOW_COPY_AND_ASSIGN_(TestMetaFactory); }; // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // ParameterizedTestCaseInfoBase is a generic interface // to ParameterizedTestCaseInfo classes. ParameterizedTestCaseInfoBase // accumulates test information provided by TEST_P macro invocations // and generators provided by INSTANTIATE_TEST_CASE_P macro invocations // and uses that information to register all resulting test instances // in RegisterTests method. The ParameterizeTestCaseRegistry class holds // a collection of pointers to the ParameterizedTestCaseInfo objects // and calls RegisterTests() on each of them when asked. class ParameterizedTestCaseInfoBase { public: virtual ~ParameterizedTestCaseInfoBase() {} // Base part of test case name for display purposes. virtual const string& GetTestCaseName() const = 0; // Test case id to verify identity. virtual TypeId GetTestCaseTypeId() const = 0; // UnitTest class invokes this method to register tests in this // test case right before running them in RUN_ALL_TESTS macro. // This method should not be called more then once on any single // instance of a ParameterizedTestCaseInfoBase derived class. virtual void RegisterTests() = 0; protected: ParameterizedTestCaseInfoBase() {} private: GTEST_DISALLOW_COPY_AND_ASSIGN_(ParameterizedTestCaseInfoBase); }; // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // ParameterizedTestCaseInfo accumulates tests obtained from TEST_P // macro invocations for a particular test case and generators // obtained from INSTANTIATE_TEST_CASE_P macro invocations for that // test case. It registers tests with all values generated by all // generators when asked. template class ParameterizedTestCaseInfo : public ParameterizedTestCaseInfoBase { public: // ParamType and GeneratorCreationFunc are private types but are required // for declarations of public methods AddTestPattern() and // AddTestCaseInstantiation(). typedef typename TestCase::ParamType ParamType; // A function that returns an instance of appropriate generator type. typedef ParamGenerator(GeneratorCreationFunc)(); explicit ParameterizedTestCaseInfo(const char* name) : test_case_name_(name) {} // Test case base name for display purposes. virtual const string& GetTestCaseName() const { return test_case_name_; } // Test case id to verify identity. virtual TypeId GetTestCaseTypeId() const { return GetTypeId(); } // TEST_P macro uses AddTestPattern() to record information // about a single test in a LocalTestInfo structure. // test_case_name is the base name of the test case (without invocation // prefix). test_base_name is the name of an individual test without // parameter index. For the test SequenceA/FooTest.DoBar/1 FooTest is // test case base name and DoBar is test base name. void AddTestPattern(const char* test_case_name, const char* test_base_name, TestMetaFactoryBase* meta_factory) { tests_.push_back(linked_ptr(new TestInfo(test_case_name, test_base_name, meta_factory))); } // INSTANTIATE_TEST_CASE_P macro uses AddGenerator() to record information // about a generator. int AddTestCaseInstantiation(const string& instantiation_name, GeneratorCreationFunc* func, const char* /* file */, int /* line */) { instantiations_.push_back(::std::make_pair(instantiation_name, func)); return 0; // Return value used only to run this method in namespace scope. } // UnitTest class invokes this method to register tests in this test case // test cases right before running tests in RUN_ALL_TESTS macro. // This method should not be called more then once on any single // instance of a ParameterizedTestCaseInfoBase derived class. // UnitTest has a guard to prevent from calling this method more then once. virtual void RegisterTests() { for (typename TestInfoContainer::iterator test_it = tests_.begin(); test_it != tests_.end(); ++test_it) { linked_ptr test_info = *test_it; for (typename InstantiationContainer::iterator gen_it = instantiations_.begin(); gen_it != instantiations_.end(); ++gen_it) { const string& instantiation_name = gen_it->first; ParamGenerator generator((*gen_it->second)()); Message test_case_name_stream; if ( !instantiation_name.empty() ) test_case_name_stream << instantiation_name << "/"; test_case_name_stream << test_info->test_case_base_name; int i = 0; for (typename ParamGenerator::iterator param_it = generator.begin(); param_it != generator.end(); ++param_it, ++i) { Message test_name_stream; test_name_stream << test_info->test_base_name << "/" << i; MakeAndRegisterTestInfo( test_case_name_stream.GetString().c_str(), test_name_stream.GetString().c_str(), NULL, // No type parameter. PrintToString(*param_it).c_str(), GetTestCaseTypeId(), TestCase::SetUpTestCase, TestCase::TearDownTestCase, test_info->test_meta_factory->CreateTestFactory(*param_it)); } // for param_it } // for gen_it } // for test_it } // RegisterTests private: // LocalTestInfo structure keeps information about a single test registered // with TEST_P macro. struct TestInfo { TestInfo(const char* a_test_case_base_name, const char* a_test_base_name, TestMetaFactoryBase* a_test_meta_factory) : test_case_base_name(a_test_case_base_name), test_base_name(a_test_base_name), test_meta_factory(a_test_meta_factory) {} const string test_case_base_name; const string test_base_name; const scoped_ptr > test_meta_factory; }; typedef ::std::vector > TestInfoContainer; // Keeps pairs of // received from INSTANTIATE_TEST_CASE_P macros. typedef ::std::vector > InstantiationContainer; const string test_case_name_; TestInfoContainer tests_; InstantiationContainer instantiations_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ParameterizedTestCaseInfo); }; // class ParameterizedTestCaseInfo // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // ParameterizedTestCaseRegistry contains a map of ParameterizedTestCaseInfoBase // classes accessed by test case names. TEST_P and INSTANTIATE_TEST_CASE_P // macros use it to locate their corresponding ParameterizedTestCaseInfo // descriptors. class ParameterizedTestCaseRegistry { public: ParameterizedTestCaseRegistry() {} ~ParameterizedTestCaseRegistry() { for (TestCaseInfoContainer::iterator it = test_case_infos_.begin(); it != test_case_infos_.end(); ++it) { delete *it; } } // Looks up or creates and returns a structure containing information about // tests and instantiations of a particular test case. template ParameterizedTestCaseInfo* GetTestCasePatternHolder( const char* test_case_name, const char* file, int line) { ParameterizedTestCaseInfo* typed_test_info = NULL; for (TestCaseInfoContainer::iterator it = test_case_infos_.begin(); it != test_case_infos_.end(); ++it) { if ((*it)->GetTestCaseName() == test_case_name) { if ((*it)->GetTestCaseTypeId() != GetTypeId()) { // Complain about incorrect usage of Google Test facilities // and terminate the program since we cannot guaranty correct // test case setup and tear-down in this case. ReportInvalidTestCaseType(test_case_name, file, line); posix::Abort(); } else { // At this point we are sure that the object we found is of the same // type we are looking for, so we downcast it to that type // without further checks. typed_test_info = CheckedDowncastToActualType< ParameterizedTestCaseInfo >(*it); } break; } } if (typed_test_info == NULL) { typed_test_info = new ParameterizedTestCaseInfo(test_case_name); test_case_infos_.push_back(typed_test_info); } return typed_test_info; } void RegisterTests() { for (TestCaseInfoContainer::iterator it = test_case_infos_.begin(); it != test_case_infos_.end(); ++it) { (*it)->RegisterTests(); } } private: typedef ::std::vector TestCaseInfoContainer; TestCaseInfoContainer test_case_infos_; GTEST_DISALLOW_COPY_AND_ASSIGN_(ParameterizedTestCaseRegistry); }; } // namespace internal } // namespace testing #endif // GTEST_HAS_PARAM_TEST #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_H_ // This file was GENERATED by command: // pump.py gtest-param-util-generated.h.pump // DO NOT EDIT BY HAND!!! // Copyright 2008 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: vladl@google.com (Vlad Losev) // Type and function utilities for implementing parameterized tests. // This file is generated by a SCRIPT. DO NOT EDIT BY HAND! // // Currently Google Test supports at most 50 arguments in Values, // and at most 10 arguments in Combine. Please contact // googletestframework@googlegroups.com if you need more. // Please note that the number of arguments to Combine is limited // by the maximum arity of the implementation of tr1::tuple which is // currently set at 10. #ifndef GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_GENERATED_H_ #define GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_GENERATED_H_ // scripts/fuse_gtest.py depends on gtest's own header being #included // *unconditionally*. Therefore these #includes cannot be moved // inside #if GTEST_HAS_PARAM_TEST. #if GTEST_HAS_PARAM_TEST namespace testing { // Forward declarations of ValuesIn(), which is implemented in // include/gtest/gtest-param-test.h. template internal::ParamGenerator< typename ::testing::internal::IteratorTraits::value_type> ValuesIn(ForwardIterator begin, ForwardIterator end); template internal::ParamGenerator ValuesIn(const T (&array)[N]); template internal::ParamGenerator ValuesIn( const Container& container); namespace internal { // Used in the Values() function to provide polymorphic capabilities. template class ValueArray1 { public: explicit ValueArray1(T1 v1) : v1_(v1) {} template operator ParamGenerator() const { return ValuesIn(&v1_, &v1_ + 1); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray1& other); const T1 v1_; }; template class ValueArray2 { public: ValueArray2(T1 v1, T2 v2) : v1_(v1), v2_(v2) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray2& other); const T1 v1_; const T2 v2_; }; template class ValueArray3 { public: ValueArray3(T1 v1, T2 v2, T3 v3) : v1_(v1), v2_(v2), v3_(v3) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray3& other); const T1 v1_; const T2 v2_; const T3 v3_; }; template class ValueArray4 { public: ValueArray4(T1 v1, T2 v2, T3 v3, T4 v4) : v1_(v1), v2_(v2), v3_(v3), v4_(v4) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray4& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; }; template class ValueArray5 { public: ValueArray5(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray5& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; }; template class ValueArray6 { public: ValueArray6(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray6& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; }; template class ValueArray7 { public: ValueArray7(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray7& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; }; template class ValueArray8 { public: ValueArray8(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray8& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; }; template class ValueArray9 { public: ValueArray9(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray9& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; }; template class ValueArray10 { public: ValueArray10(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray10& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; }; template class ValueArray11 { public: ValueArray11(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray11& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; }; template class ValueArray12 { public: ValueArray12(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray12& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; }; template class ValueArray13 { public: ValueArray13(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray13& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; }; template class ValueArray14 { public: ValueArray14(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray14& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; }; template class ValueArray15 { public: ValueArray15(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray15& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; }; template class ValueArray16 { public: ValueArray16(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray16& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; }; template class ValueArray17 { public: ValueArray17(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray17& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; }; template class ValueArray18 { public: ValueArray18(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray18& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; }; template class ValueArray19 { public: ValueArray19(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray19& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; }; template class ValueArray20 { public: ValueArray20(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray20& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; }; template class ValueArray21 { public: ValueArray21(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray21& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; }; template class ValueArray22 { public: ValueArray22(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray22& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; }; template class ValueArray23 { public: ValueArray23(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray23& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; }; template class ValueArray24 { public: ValueArray24(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray24& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; }; template class ValueArray25 { public: ValueArray25(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray25& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; }; template class ValueArray26 { public: ValueArray26(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray26& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; }; template class ValueArray27 { public: ValueArray27(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray27& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; }; template class ValueArray28 { public: ValueArray28(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray28& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; }; template class ValueArray29 { public: ValueArray29(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray29& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; }; template class ValueArray30 { public: ValueArray30(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray30& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; }; template class ValueArray31 { public: ValueArray31(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray31& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; }; template class ValueArray32 { public: ValueArray32(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray32& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; }; template class ValueArray33 { public: ValueArray33(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray33& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; }; template class ValueArray34 { public: ValueArray34(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray34& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; }; template class ValueArray35 { public: ValueArray35(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray35& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; }; template class ValueArray36 { public: ValueArray36(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray36& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; }; template class ValueArray37 { public: ValueArray37(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray37& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; }; template class ValueArray38 { public: ValueArray38(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray38& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; }; template class ValueArray39 { public: ValueArray39(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray39& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; }; template class ValueArray40 { public: ValueArray40(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray40& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; }; template class ValueArray41 { public: ValueArray41(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray41& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; }; template class ValueArray42 { public: ValueArray42(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray42& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; }; template class ValueArray43 { public: ValueArray43(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray43& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; }; template class ValueArray44 { public: ValueArray44(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray44& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; }; template class ValueArray45 { public: ValueArray45(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray45& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; }; template class ValueArray46 { public: ValueArray46(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45), v46_(v46) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_, v46_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray46& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; const T46 v46_; }; template class ValueArray47 { public: ValueArray47(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45), v46_(v46), v47_(v47) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_, v46_, v47_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray47& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; const T46 v46_; const T47 v47_; }; template class ValueArray48 { public: ValueArray48(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45), v46_(v46), v47_(v47), v48_(v48) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_, v46_, v47_, v48_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray48& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; const T46 v46_; const T47 v47_; const T48 v48_; }; template class ValueArray49 { public: ValueArray49(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48, T49 v49) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45), v46_(v46), v47_(v47), v48_(v48), v49_(v49) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_, v46_, v47_, v48_, v49_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray49& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; const T46 v46_; const T47 v47_; const T48 v48_; const T49 v49_; }; template class ValueArray50 { public: ValueArray50(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48, T49 v49, T50 v50) : v1_(v1), v2_(v2), v3_(v3), v4_(v4), v5_(v5), v6_(v6), v7_(v7), v8_(v8), v9_(v9), v10_(v10), v11_(v11), v12_(v12), v13_(v13), v14_(v14), v15_(v15), v16_(v16), v17_(v17), v18_(v18), v19_(v19), v20_(v20), v21_(v21), v22_(v22), v23_(v23), v24_(v24), v25_(v25), v26_(v26), v27_(v27), v28_(v28), v29_(v29), v30_(v30), v31_(v31), v32_(v32), v33_(v33), v34_(v34), v35_(v35), v36_(v36), v37_(v37), v38_(v38), v39_(v39), v40_(v40), v41_(v41), v42_(v42), v43_(v43), v44_(v44), v45_(v45), v46_(v46), v47_(v47), v48_(v48), v49_(v49), v50_(v50) {} template operator ParamGenerator() const { const T array[] = {v1_, v2_, v3_, v4_, v5_, v6_, v7_, v8_, v9_, v10_, v11_, v12_, v13_, v14_, v15_, v16_, v17_, v18_, v19_, v20_, v21_, v22_, v23_, v24_, v25_, v26_, v27_, v28_, v29_, v30_, v31_, v32_, v33_, v34_, v35_, v36_, v37_, v38_, v39_, v40_, v41_, v42_, v43_, v44_, v45_, v46_, v47_, v48_, v49_, v50_}; return ValuesIn(array); } private: // No implementation - assignment is unsupported. void operator=(const ValueArray50& other); const T1 v1_; const T2 v2_; const T3 v3_; const T4 v4_; const T5 v5_; const T6 v6_; const T7 v7_; const T8 v8_; const T9 v9_; const T10 v10_; const T11 v11_; const T12 v12_; const T13 v13_; const T14 v14_; const T15 v15_; const T16 v16_; const T17 v17_; const T18 v18_; const T19 v19_; const T20 v20_; const T21 v21_; const T22 v22_; const T23 v23_; const T24 v24_; const T25 v25_; const T26 v26_; const T27 v27_; const T28 v28_; const T29 v29_; const T30 v30_; const T31 v31_; const T32 v32_; const T33 v33_; const T34 v34_; const T35 v35_; const T36 v36_; const T37 v37_; const T38 v38_; const T39 v39_; const T40 v40_; const T41 v41_; const T42 v42_; const T43 v43_; const T44 v44_; const T45 v45_; const T46 v46_; const T47 v47_; const T48 v48_; const T49 v49_; const T50 v50_; }; # if GTEST_HAS_COMBINE // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Generates values from the Cartesian product of values produced // by the argument generators. // template class CartesianProductGenerator2 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator2(const ParamGenerator& g1, const ParamGenerator& g2) : g1_(g1), g2_(g2) {} virtual ~CartesianProductGenerator2() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current2_; if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; ParamType current_value_; }; // class CartesianProductGenerator2::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator2& other); const ParamGenerator g1_; const ParamGenerator g2_; }; // class CartesianProductGenerator2 template class CartesianProductGenerator3 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator3(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3) : g1_(g1), g2_(g2), g3_(g3) {} virtual ~CartesianProductGenerator3() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current3_; if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; ParamType current_value_; }; // class CartesianProductGenerator3::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator3& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; }; // class CartesianProductGenerator3 template class CartesianProductGenerator4 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator4(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4) : g1_(g1), g2_(g2), g3_(g3), g4_(g4) {} virtual ~CartesianProductGenerator4() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current4_; if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; ParamType current_value_; }; // class CartesianProductGenerator4::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator4& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; }; // class CartesianProductGenerator4 template class CartesianProductGenerator5 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator5(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5) {} virtual ~CartesianProductGenerator5() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current5_; if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; ParamType current_value_; }; // class CartesianProductGenerator5::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator5& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; }; // class CartesianProductGenerator5 template class CartesianProductGenerator6 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator6(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5, const ParamGenerator& g6) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6) {} virtual ~CartesianProductGenerator6() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin(), g6_, g6_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end(), g6_, g6_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5, const ParamGenerator& g6, const typename ParamGenerator::iterator& current6) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5), begin6_(g6.begin()), end6_(g6.end()), current6_(current6) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current6_; if (current6_ == end6_) { current6_ = begin6_; ++current5_; } if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_ && current6_ == typed_other->current6_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_), begin6_(other.begin6_), end6_(other.end6_), current6_(other.current6_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_, *current6_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_ || current6_ == end6_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; const typename ParamGenerator::iterator begin6_; const typename ParamGenerator::iterator end6_; typename ParamGenerator::iterator current6_; ParamType current_value_; }; // class CartesianProductGenerator6::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator6& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; const ParamGenerator g6_; }; // class CartesianProductGenerator6 template class CartesianProductGenerator7 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator7(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5, const ParamGenerator& g6, const ParamGenerator& g7) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7) {} virtual ~CartesianProductGenerator7() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin(), g6_, g6_.begin(), g7_, g7_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end(), g6_, g6_.end(), g7_, g7_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5, const ParamGenerator& g6, const typename ParamGenerator::iterator& current6, const ParamGenerator& g7, const typename ParamGenerator::iterator& current7) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5), begin6_(g6.begin()), end6_(g6.end()), current6_(current6), begin7_(g7.begin()), end7_(g7.end()), current7_(current7) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current7_; if (current7_ == end7_) { current7_ = begin7_; ++current6_; } if (current6_ == end6_) { current6_ = begin6_; ++current5_; } if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_ && current6_ == typed_other->current6_ && current7_ == typed_other->current7_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_), begin6_(other.begin6_), end6_(other.end6_), current6_(other.current6_), begin7_(other.begin7_), end7_(other.end7_), current7_(other.current7_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_, *current6_, *current7_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_ || current6_ == end6_ || current7_ == end7_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; const typename ParamGenerator::iterator begin6_; const typename ParamGenerator::iterator end6_; typename ParamGenerator::iterator current6_; const typename ParamGenerator::iterator begin7_; const typename ParamGenerator::iterator end7_; typename ParamGenerator::iterator current7_; ParamType current_value_; }; // class CartesianProductGenerator7::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator7& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; const ParamGenerator g6_; const ParamGenerator g7_; }; // class CartesianProductGenerator7 template class CartesianProductGenerator8 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator8(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5, const ParamGenerator& g6, const ParamGenerator& g7, const ParamGenerator& g8) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8) {} virtual ~CartesianProductGenerator8() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin(), g6_, g6_.begin(), g7_, g7_.begin(), g8_, g8_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end(), g6_, g6_.end(), g7_, g7_.end(), g8_, g8_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5, const ParamGenerator& g6, const typename ParamGenerator::iterator& current6, const ParamGenerator& g7, const typename ParamGenerator::iterator& current7, const ParamGenerator& g8, const typename ParamGenerator::iterator& current8) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5), begin6_(g6.begin()), end6_(g6.end()), current6_(current6), begin7_(g7.begin()), end7_(g7.end()), current7_(current7), begin8_(g8.begin()), end8_(g8.end()), current8_(current8) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current8_; if (current8_ == end8_) { current8_ = begin8_; ++current7_; } if (current7_ == end7_) { current7_ = begin7_; ++current6_; } if (current6_ == end6_) { current6_ = begin6_; ++current5_; } if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_ && current6_ == typed_other->current6_ && current7_ == typed_other->current7_ && current8_ == typed_other->current8_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_), begin6_(other.begin6_), end6_(other.end6_), current6_(other.current6_), begin7_(other.begin7_), end7_(other.end7_), current7_(other.current7_), begin8_(other.begin8_), end8_(other.end8_), current8_(other.current8_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_, *current6_, *current7_, *current8_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_ || current6_ == end6_ || current7_ == end7_ || current8_ == end8_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; const typename ParamGenerator::iterator begin6_; const typename ParamGenerator::iterator end6_; typename ParamGenerator::iterator current6_; const typename ParamGenerator::iterator begin7_; const typename ParamGenerator::iterator end7_; typename ParamGenerator::iterator current7_; const typename ParamGenerator::iterator begin8_; const typename ParamGenerator::iterator end8_; typename ParamGenerator::iterator current8_; ParamType current_value_; }; // class CartesianProductGenerator8::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator8& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; const ParamGenerator g6_; const ParamGenerator g7_; const ParamGenerator g8_; }; // class CartesianProductGenerator8 template class CartesianProductGenerator9 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator9(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5, const ParamGenerator& g6, const ParamGenerator& g7, const ParamGenerator& g8, const ParamGenerator& g9) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8), g9_(g9) {} virtual ~CartesianProductGenerator9() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin(), g6_, g6_.begin(), g7_, g7_.begin(), g8_, g8_.begin(), g9_, g9_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end(), g6_, g6_.end(), g7_, g7_.end(), g8_, g8_.end(), g9_, g9_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5, const ParamGenerator& g6, const typename ParamGenerator::iterator& current6, const ParamGenerator& g7, const typename ParamGenerator::iterator& current7, const ParamGenerator& g8, const typename ParamGenerator::iterator& current8, const ParamGenerator& g9, const typename ParamGenerator::iterator& current9) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5), begin6_(g6.begin()), end6_(g6.end()), current6_(current6), begin7_(g7.begin()), end7_(g7.end()), current7_(current7), begin8_(g8.begin()), end8_(g8.end()), current8_(current8), begin9_(g9.begin()), end9_(g9.end()), current9_(current9) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current9_; if (current9_ == end9_) { current9_ = begin9_; ++current8_; } if (current8_ == end8_) { current8_ = begin8_; ++current7_; } if (current7_ == end7_) { current7_ = begin7_; ++current6_; } if (current6_ == end6_) { current6_ = begin6_; ++current5_; } if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_ && current6_ == typed_other->current6_ && current7_ == typed_other->current7_ && current8_ == typed_other->current8_ && current9_ == typed_other->current9_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_), begin6_(other.begin6_), end6_(other.end6_), current6_(other.current6_), begin7_(other.begin7_), end7_(other.end7_), current7_(other.current7_), begin8_(other.begin8_), end8_(other.end8_), current8_(other.current8_), begin9_(other.begin9_), end9_(other.end9_), current9_(other.current9_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_, *current6_, *current7_, *current8_, *current9_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_ || current6_ == end6_ || current7_ == end7_ || current8_ == end8_ || current9_ == end9_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; const typename ParamGenerator::iterator begin6_; const typename ParamGenerator::iterator end6_; typename ParamGenerator::iterator current6_; const typename ParamGenerator::iterator begin7_; const typename ParamGenerator::iterator end7_; typename ParamGenerator::iterator current7_; const typename ParamGenerator::iterator begin8_; const typename ParamGenerator::iterator end8_; typename ParamGenerator::iterator current8_; const typename ParamGenerator::iterator begin9_; const typename ParamGenerator::iterator end9_; typename ParamGenerator::iterator current9_; ParamType current_value_; }; // class CartesianProductGenerator9::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator9& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; const ParamGenerator g6_; const ParamGenerator g7_; const ParamGenerator g8_; const ParamGenerator g9_; }; // class CartesianProductGenerator9 template class CartesianProductGenerator10 : public ParamGeneratorInterface< ::std::tr1::tuple > { public: typedef ::std::tr1::tuple ParamType; CartesianProductGenerator10(const ParamGenerator& g1, const ParamGenerator& g2, const ParamGenerator& g3, const ParamGenerator& g4, const ParamGenerator& g5, const ParamGenerator& g6, const ParamGenerator& g7, const ParamGenerator& g8, const ParamGenerator& g9, const ParamGenerator& g10) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8), g9_(g9), g10_(g10) {} virtual ~CartesianProductGenerator10() {} virtual ParamIteratorInterface* Begin() const { return new Iterator(this, g1_, g1_.begin(), g2_, g2_.begin(), g3_, g3_.begin(), g4_, g4_.begin(), g5_, g5_.begin(), g6_, g6_.begin(), g7_, g7_.begin(), g8_, g8_.begin(), g9_, g9_.begin(), g10_, g10_.begin()); } virtual ParamIteratorInterface* End() const { return new Iterator(this, g1_, g1_.end(), g2_, g2_.end(), g3_, g3_.end(), g4_, g4_.end(), g5_, g5_.end(), g6_, g6_.end(), g7_, g7_.end(), g8_, g8_.end(), g9_, g9_.end(), g10_, g10_.end()); } private: class Iterator : public ParamIteratorInterface { public: Iterator(const ParamGeneratorInterface* base, const ParamGenerator& g1, const typename ParamGenerator::iterator& current1, const ParamGenerator& g2, const typename ParamGenerator::iterator& current2, const ParamGenerator& g3, const typename ParamGenerator::iterator& current3, const ParamGenerator& g4, const typename ParamGenerator::iterator& current4, const ParamGenerator& g5, const typename ParamGenerator::iterator& current5, const ParamGenerator& g6, const typename ParamGenerator::iterator& current6, const ParamGenerator& g7, const typename ParamGenerator::iterator& current7, const ParamGenerator& g8, const typename ParamGenerator::iterator& current8, const ParamGenerator& g9, const typename ParamGenerator::iterator& current9, const ParamGenerator& g10, const typename ParamGenerator::iterator& current10) : base_(base), begin1_(g1.begin()), end1_(g1.end()), current1_(current1), begin2_(g2.begin()), end2_(g2.end()), current2_(current2), begin3_(g3.begin()), end3_(g3.end()), current3_(current3), begin4_(g4.begin()), end4_(g4.end()), current4_(current4), begin5_(g5.begin()), end5_(g5.end()), current5_(current5), begin6_(g6.begin()), end6_(g6.end()), current6_(current6), begin7_(g7.begin()), end7_(g7.end()), current7_(current7), begin8_(g8.begin()), end8_(g8.end()), current8_(current8), begin9_(g9.begin()), end9_(g9.end()), current9_(current9), begin10_(g10.begin()), end10_(g10.end()), current10_(current10) { ComputeCurrentValue(); } virtual ~Iterator() {} virtual const ParamGeneratorInterface* BaseGenerator() const { return base_; } // Advance should not be called on beyond-of-range iterators // so no component iterators must be beyond end of range, either. virtual void Advance() { assert(!AtEnd()); ++current10_; if (current10_ == end10_) { current10_ = begin10_; ++current9_; } if (current9_ == end9_) { current9_ = begin9_; ++current8_; } if (current8_ == end8_) { current8_ = begin8_; ++current7_; } if (current7_ == end7_) { current7_ = begin7_; ++current6_; } if (current6_ == end6_) { current6_ = begin6_; ++current5_; } if (current5_ == end5_) { current5_ = begin5_; ++current4_; } if (current4_ == end4_) { current4_ = begin4_; ++current3_; } if (current3_ == end3_) { current3_ = begin3_; ++current2_; } if (current2_ == end2_) { current2_ = begin2_; ++current1_; } ComputeCurrentValue(); } virtual ParamIteratorInterface* Clone() const { return new Iterator(*this); } virtual const ParamType* Current() const { return ¤t_value_; } virtual bool Equals(const ParamIteratorInterface& other) const { // Having the same base generator guarantees that the other // iterator is of the same type and we can downcast. GTEST_CHECK_(BaseGenerator() == other.BaseGenerator()) << "The program attempted to compare iterators " << "from different generators." << std::endl; const Iterator* typed_other = CheckedDowncastToActualType(&other); // We must report iterators equal if they both point beyond their // respective ranges. That can happen in a variety of fashions, // so we have to consult AtEnd(). return (AtEnd() && typed_other->AtEnd()) || ( current1_ == typed_other->current1_ && current2_ == typed_other->current2_ && current3_ == typed_other->current3_ && current4_ == typed_other->current4_ && current5_ == typed_other->current5_ && current6_ == typed_other->current6_ && current7_ == typed_other->current7_ && current8_ == typed_other->current8_ && current9_ == typed_other->current9_ && current10_ == typed_other->current10_); } private: Iterator(const Iterator& other) : base_(other.base_), begin1_(other.begin1_), end1_(other.end1_), current1_(other.current1_), begin2_(other.begin2_), end2_(other.end2_), current2_(other.current2_), begin3_(other.begin3_), end3_(other.end3_), current3_(other.current3_), begin4_(other.begin4_), end4_(other.end4_), current4_(other.current4_), begin5_(other.begin5_), end5_(other.end5_), current5_(other.current5_), begin6_(other.begin6_), end6_(other.end6_), current6_(other.current6_), begin7_(other.begin7_), end7_(other.end7_), current7_(other.current7_), begin8_(other.begin8_), end8_(other.end8_), current8_(other.current8_), begin9_(other.begin9_), end9_(other.end9_), current9_(other.current9_), begin10_(other.begin10_), end10_(other.end10_), current10_(other.current10_) { ComputeCurrentValue(); } void ComputeCurrentValue() { if (!AtEnd()) current_value_ = ParamType(*current1_, *current2_, *current3_, *current4_, *current5_, *current6_, *current7_, *current8_, *current9_, *current10_); } bool AtEnd() const { // We must report iterator past the end of the range when either of the // component iterators has reached the end of its range. return current1_ == end1_ || current2_ == end2_ || current3_ == end3_ || current4_ == end4_ || current5_ == end5_ || current6_ == end6_ || current7_ == end7_ || current8_ == end8_ || current9_ == end9_ || current10_ == end10_; } // No implementation - assignment is unsupported. void operator=(const Iterator& other); const ParamGeneratorInterface* const base_; // begin[i]_ and end[i]_ define the i-th range that Iterator traverses. // current[i]_ is the actual traversing iterator. const typename ParamGenerator::iterator begin1_; const typename ParamGenerator::iterator end1_; typename ParamGenerator::iterator current1_; const typename ParamGenerator::iterator begin2_; const typename ParamGenerator::iterator end2_; typename ParamGenerator::iterator current2_; const typename ParamGenerator::iterator begin3_; const typename ParamGenerator::iterator end3_; typename ParamGenerator::iterator current3_; const typename ParamGenerator::iterator begin4_; const typename ParamGenerator::iterator end4_; typename ParamGenerator::iterator current4_; const typename ParamGenerator::iterator begin5_; const typename ParamGenerator::iterator end5_; typename ParamGenerator::iterator current5_; const typename ParamGenerator::iterator begin6_; const typename ParamGenerator::iterator end6_; typename ParamGenerator::iterator current6_; const typename ParamGenerator::iterator begin7_; const typename ParamGenerator::iterator end7_; typename ParamGenerator::iterator current7_; const typename ParamGenerator::iterator begin8_; const typename ParamGenerator::iterator end8_; typename ParamGenerator::iterator current8_; const typename ParamGenerator::iterator begin9_; const typename ParamGenerator::iterator end9_; typename ParamGenerator::iterator current9_; const typename ParamGenerator::iterator begin10_; const typename ParamGenerator::iterator end10_; typename ParamGenerator::iterator current10_; ParamType current_value_; }; // class CartesianProductGenerator10::Iterator // No implementation - assignment is unsupported. void operator=(const CartesianProductGenerator10& other); const ParamGenerator g1_; const ParamGenerator g2_; const ParamGenerator g3_; const ParamGenerator g4_; const ParamGenerator g5_; const ParamGenerator g6_; const ParamGenerator g7_; const ParamGenerator g8_; const ParamGenerator g9_; const ParamGenerator g10_; }; // class CartesianProductGenerator10 // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Helper classes providing Combine() with polymorphic features. They allow // casting CartesianProductGeneratorN to ParamGenerator if T is // convertible to U. // template class CartesianProductHolder2 { public: CartesianProductHolder2(const Generator1& g1, const Generator2& g2) : g1_(g1), g2_(g2) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator2( static_cast >(g1_), static_cast >(g2_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder2& other); const Generator1 g1_; const Generator2 g2_; }; // class CartesianProductHolder2 template class CartesianProductHolder3 { public: CartesianProductHolder3(const Generator1& g1, const Generator2& g2, const Generator3& g3) : g1_(g1), g2_(g2), g3_(g3) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator3( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder3& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; }; // class CartesianProductHolder3 template class CartesianProductHolder4 { public: CartesianProductHolder4(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4) : g1_(g1), g2_(g2), g3_(g3), g4_(g4) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator4( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder4& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; }; // class CartesianProductHolder4 template class CartesianProductHolder5 { public: CartesianProductHolder5(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator5( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder5& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; }; // class CartesianProductHolder5 template class CartesianProductHolder6 { public: CartesianProductHolder6(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator6( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_), static_cast >(g6_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder6& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; const Generator6 g6_; }; // class CartesianProductHolder6 template class CartesianProductHolder7 { public: CartesianProductHolder7(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator7( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_), static_cast >(g6_), static_cast >(g7_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder7& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; const Generator6 g6_; const Generator7 g7_; }; // class CartesianProductHolder7 template class CartesianProductHolder8 { public: CartesianProductHolder8(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator8( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_), static_cast >(g6_), static_cast >(g7_), static_cast >(g8_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder8& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; const Generator6 g6_; const Generator7 g7_; const Generator8 g8_; }; // class CartesianProductHolder8 template class CartesianProductHolder9 { public: CartesianProductHolder9(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8, const Generator9& g9) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8), g9_(g9) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator9( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_), static_cast >(g6_), static_cast >(g7_), static_cast >(g8_), static_cast >(g9_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder9& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; const Generator6 g6_; const Generator7 g7_; const Generator8 g8_; const Generator9 g9_; }; // class CartesianProductHolder9 template class CartesianProductHolder10 { public: CartesianProductHolder10(const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8, const Generator9& g9, const Generator10& g10) : g1_(g1), g2_(g2), g3_(g3), g4_(g4), g5_(g5), g6_(g6), g7_(g7), g8_(g8), g9_(g9), g10_(g10) {} template operator ParamGenerator< ::std::tr1::tuple >() const { return ParamGenerator< ::std::tr1::tuple >( new CartesianProductGenerator10( static_cast >(g1_), static_cast >(g2_), static_cast >(g3_), static_cast >(g4_), static_cast >(g5_), static_cast >(g6_), static_cast >(g7_), static_cast >(g8_), static_cast >(g9_), static_cast >(g10_))); } private: // No implementation - assignment is unsupported. void operator=(const CartesianProductHolder10& other); const Generator1 g1_; const Generator2 g2_; const Generator3 g3_; const Generator4 g4_; const Generator5 g5_; const Generator6 g6_; const Generator7 g7_; const Generator8 g8_; const Generator9 g9_; const Generator10 g10_; }; // class CartesianProductHolder10 # endif // GTEST_HAS_COMBINE } // namespace internal } // namespace testing #endif // GTEST_HAS_PARAM_TEST #endif // GTEST_INCLUDE_GTEST_INTERNAL_GTEST_PARAM_UTIL_GENERATED_H_ #if GTEST_HAS_PARAM_TEST namespace testing { // Functions producing parameter generators. // // Google Test uses these generators to produce parameters for value- // parameterized tests. When a parameterized test case is instantiated // with a particular generator, Google Test creates and runs tests // for each element in the sequence produced by the generator. // // In the following sample, tests from test case FooTest are instantiated // each three times with parameter values 3, 5, and 8: // // class FooTest : public TestWithParam { ... }; // // TEST_P(FooTest, TestThis) { // } // TEST_P(FooTest, TestThat) { // } // INSTANTIATE_TEST_CASE_P(TestSequence, FooTest, Values(3, 5, 8)); // // Range() returns generators providing sequences of values in a range. // // Synopsis: // Range(start, end) // - returns a generator producing a sequence of values {start, start+1, // start+2, ..., }. // Range(start, end, step) // - returns a generator producing a sequence of values {start, start+step, // start+step+step, ..., }. // Notes: // * The generated sequences never include end. For example, Range(1, 5) // returns a generator producing a sequence {1, 2, 3, 4}. Range(1, 9, 2) // returns a generator producing {1, 3, 5, 7}. // * start and end must have the same type. That type may be any integral or // floating-point type or a user defined type satisfying these conditions: // * It must be assignable (have operator=() defined). // * It must have operator+() (operator+(int-compatible type) for // two-operand version). // * It must have operator<() defined. // Elements in the resulting sequences will also have that type. // * Condition start < end must be satisfied in order for resulting sequences // to contain any elements. // template internal::ParamGenerator Range(T start, T end, IncrementT step) { return internal::ParamGenerator( new internal::RangeGenerator(start, end, step)); } template internal::ParamGenerator Range(T start, T end) { return Range(start, end, 1); } // ValuesIn() function allows generation of tests with parameters coming from // a container. // // Synopsis: // ValuesIn(const T (&array)[N]) // - returns a generator producing sequences with elements from // a C-style array. // ValuesIn(const Container& container) // - returns a generator producing sequences with elements from // an STL-style container. // ValuesIn(Iterator begin, Iterator end) // - returns a generator producing sequences with elements from // a range [begin, end) defined by a pair of STL-style iterators. These // iterators can also be plain C pointers. // // Please note that ValuesIn copies the values from the containers // passed in and keeps them to generate tests in RUN_ALL_TESTS(). // // Examples: // // This instantiates tests from test case StringTest // each with C-string values of "foo", "bar", and "baz": // // const char* strings[] = {"foo", "bar", "baz"}; // INSTANTIATE_TEST_CASE_P(StringSequence, SrtingTest, ValuesIn(strings)); // // This instantiates tests from test case StlStringTest // each with STL strings with values "a" and "b": // // ::std::vector< ::std::string> GetParameterStrings() { // ::std::vector< ::std::string> v; // v.push_back("a"); // v.push_back("b"); // return v; // } // // INSTANTIATE_TEST_CASE_P(CharSequence, // StlStringTest, // ValuesIn(GetParameterStrings())); // // // This will also instantiate tests from CharTest // each with parameter values 'a' and 'b': // // ::std::list GetParameterChars() { // ::std::list list; // list.push_back('a'); // list.push_back('b'); // return list; // } // ::std::list l = GetParameterChars(); // INSTANTIATE_TEST_CASE_P(CharSequence2, // CharTest, // ValuesIn(l.begin(), l.end())); // template internal::ParamGenerator< typename ::testing::internal::IteratorTraits::value_type> ValuesIn(ForwardIterator begin, ForwardIterator end) { typedef typename ::testing::internal::IteratorTraits ::value_type ParamType; return internal::ParamGenerator( new internal::ValuesInIteratorRangeGenerator(begin, end)); } template internal::ParamGenerator ValuesIn(const T (&array)[N]) { return ValuesIn(array, array + N); } template internal::ParamGenerator ValuesIn( const Container& container) { return ValuesIn(container.begin(), container.end()); } // Values() allows generating tests from explicitly specified list of // parameters. // // Synopsis: // Values(T v1, T v2, ..., T vN) // - returns a generator producing sequences with elements v1, v2, ..., vN. // // For example, this instantiates tests from test case BarTest each // with values "one", "two", and "three": // // INSTANTIATE_TEST_CASE_P(NumSequence, BarTest, Values("one", "two", "three")); // // This instantiates tests from test case BazTest each with values 1, 2, 3.5. // The exact type of values will depend on the type of parameter in BazTest. // // INSTANTIATE_TEST_CASE_P(FloatingNumbers, BazTest, Values(1, 2, 3.5)); // // Currently, Values() supports from 1 to 50 parameters. // template internal::ValueArray1 Values(T1 v1) { return internal::ValueArray1(v1); } template internal::ValueArray2 Values(T1 v1, T2 v2) { return internal::ValueArray2(v1, v2); } template internal::ValueArray3 Values(T1 v1, T2 v2, T3 v3) { return internal::ValueArray3(v1, v2, v3); } template internal::ValueArray4 Values(T1 v1, T2 v2, T3 v3, T4 v4) { return internal::ValueArray4(v1, v2, v3, v4); } template internal::ValueArray5 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5) { return internal::ValueArray5(v1, v2, v3, v4, v5); } template internal::ValueArray6 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6) { return internal::ValueArray6(v1, v2, v3, v4, v5, v6); } template internal::ValueArray7 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7) { return internal::ValueArray7(v1, v2, v3, v4, v5, v6, v7); } template internal::ValueArray8 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8) { return internal::ValueArray8(v1, v2, v3, v4, v5, v6, v7, v8); } template internal::ValueArray9 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9) { return internal::ValueArray9(v1, v2, v3, v4, v5, v6, v7, v8, v9); } template internal::ValueArray10 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10) { return internal::ValueArray10(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10); } template internal::ValueArray11 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11) { return internal::ValueArray11(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11); } template internal::ValueArray12 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12) { return internal::ValueArray12(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12); } template internal::ValueArray13 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13) { return internal::ValueArray13(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13); } template internal::ValueArray14 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14) { return internal::ValueArray14(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14); } template internal::ValueArray15 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15) { return internal::ValueArray15(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15); } template internal::ValueArray16 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16) { return internal::ValueArray16(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16); } template internal::ValueArray17 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17) { return internal::ValueArray17(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17); } template internal::ValueArray18 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18) { return internal::ValueArray18(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18); } template internal::ValueArray19 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19) { return internal::ValueArray19(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19); } template internal::ValueArray20 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20) { return internal::ValueArray20(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20); } template internal::ValueArray21 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21) { return internal::ValueArray21(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21); } template internal::ValueArray22 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22) { return internal::ValueArray22(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22); } template internal::ValueArray23 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23) { return internal::ValueArray23(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23); } template internal::ValueArray24 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24) { return internal::ValueArray24(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24); } template internal::ValueArray25 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25) { return internal::ValueArray25(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25); } template internal::ValueArray26 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26) { return internal::ValueArray26(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26); } template internal::ValueArray27 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27) { return internal::ValueArray27(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27); } template internal::ValueArray28 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28) { return internal::ValueArray28(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28); } template internal::ValueArray29 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29) { return internal::ValueArray29(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29); } template internal::ValueArray30 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30) { return internal::ValueArray30(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30); } template internal::ValueArray31 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31) { return internal::ValueArray31(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31); } template internal::ValueArray32 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32) { return internal::ValueArray32(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32); } template internal::ValueArray33 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33) { return internal::ValueArray33(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33); } template internal::ValueArray34 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34) { return internal::ValueArray34(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34); } template internal::ValueArray35 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35) { return internal::ValueArray35(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35); } template internal::ValueArray36 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36) { return internal::ValueArray36(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36); } template internal::ValueArray37 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37) { return internal::ValueArray37(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37); } template internal::ValueArray38 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38) { return internal::ValueArray38(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38); } template internal::ValueArray39 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39) { return internal::ValueArray39(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39); } template internal::ValueArray40 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40) { return internal::ValueArray40(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40); } template internal::ValueArray41 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41) { return internal::ValueArray41(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41); } template internal::ValueArray42 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42) { return internal::ValueArray42(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42); } template internal::ValueArray43 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43) { return internal::ValueArray43(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43); } template internal::ValueArray44 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44) { return internal::ValueArray44(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44); } template internal::ValueArray45 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45) { return internal::ValueArray45(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45); } template internal::ValueArray46 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46) { return internal::ValueArray46(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45, v46); } template internal::ValueArray47 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47) { return internal::ValueArray47(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45, v46, v47); } template internal::ValueArray48 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48) { return internal::ValueArray48(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45, v46, v47, v48); } template internal::ValueArray49 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48, T49 v49) { return internal::ValueArray49(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45, v46, v47, v48, v49); } template internal::ValueArray50 Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8, T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15, T16 v16, T17 v17, T18 v18, T19 v19, T20 v20, T21 v21, T22 v22, T23 v23, T24 v24, T25 v25, T26 v26, T27 v27, T28 v28, T29 v29, T30 v30, T31 v31, T32 v32, T33 v33, T34 v34, T35 v35, T36 v36, T37 v37, T38 v38, T39 v39, T40 v40, T41 v41, T42 v42, T43 v43, T44 v44, T45 v45, T46 v46, T47 v47, T48 v48, T49 v49, T50 v50) { return internal::ValueArray50(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15, v16, v17, v18, v19, v20, v21, v22, v23, v24, v25, v26, v27, v28, v29, v30, v31, v32, v33, v34, v35, v36, v37, v38, v39, v40, v41, v42, v43, v44, v45, v46, v47, v48, v49, v50); } // Bool() allows generating tests with parameters in a set of (false, true). // // Synopsis: // Bool() // - returns a generator producing sequences with elements {false, true}. // // It is useful when testing code that depends on Boolean flags. Combinations // of multiple flags can be tested when several Bool()'s are combined using // Combine() function. // // In the following example all tests in the test case FlagDependentTest // will be instantiated twice with parameters false and true. // // class FlagDependentTest : public testing::TestWithParam { // virtual void SetUp() { // external_flag = GetParam(); // } // } // INSTANTIATE_TEST_CASE_P(BoolSequence, FlagDependentTest, Bool()); // inline internal::ParamGenerator Bool() { return Values(false, true); } # if GTEST_HAS_COMBINE // Combine() allows the user to combine two or more sequences to produce // values of a Cartesian product of those sequences' elements. // // Synopsis: // Combine(gen1, gen2, ..., genN) // - returns a generator producing sequences with elements coming from // the Cartesian product of elements from the sequences generated by // gen1, gen2, ..., genN. The sequence elements will have a type of // tuple where T1, T2, ..., TN are the types // of elements from sequences produces by gen1, gen2, ..., genN. // // Combine can have up to 10 arguments. This number is currently limited // by the maximum number of elements in the tuple implementation used by Google // Test. // // Example: // // This will instantiate tests in test case AnimalTest each one with // the parameter values tuple("cat", BLACK), tuple("cat", WHITE), // tuple("dog", BLACK), and tuple("dog", WHITE): // // enum Color { BLACK, GRAY, WHITE }; // class AnimalTest // : public testing::TestWithParam > {...}; // // TEST_P(AnimalTest, AnimalLooksNice) {...} // // INSTANTIATE_TEST_CASE_P(AnimalVariations, AnimalTest, // Combine(Values("cat", "dog"), // Values(BLACK, WHITE))); // // This will instantiate tests in FlagDependentTest with all variations of two // Boolean flags: // // class FlagDependentTest // : public testing::TestWithParam > { // virtual void SetUp() { // // Assigns external_flag_1 and external_flag_2 values from the tuple. // tie(external_flag_1, external_flag_2) = GetParam(); // } // }; // // TEST_P(FlagDependentTest, TestFeature1) { // // Test your code using external_flag_1 and external_flag_2 here. // } // INSTANTIATE_TEST_CASE_P(TwoBoolSequence, FlagDependentTest, // Combine(Bool(), Bool())); // template internal::CartesianProductHolder2 Combine( const Generator1& g1, const Generator2& g2) { return internal::CartesianProductHolder2( g1, g2); } template internal::CartesianProductHolder3 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3) { return internal::CartesianProductHolder3( g1, g2, g3); } template internal::CartesianProductHolder4 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4) { return internal::CartesianProductHolder4( g1, g2, g3, g4); } template internal::CartesianProductHolder5 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5) { return internal::CartesianProductHolder5( g1, g2, g3, g4, g5); } template internal::CartesianProductHolder6 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6) { return internal::CartesianProductHolder6( g1, g2, g3, g4, g5, g6); } template internal::CartesianProductHolder7 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7) { return internal::CartesianProductHolder7( g1, g2, g3, g4, g5, g6, g7); } template internal::CartesianProductHolder8 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8) { return internal::CartesianProductHolder8( g1, g2, g3, g4, g5, g6, g7, g8); } template internal::CartesianProductHolder9 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8, const Generator9& g9) { return internal::CartesianProductHolder9( g1, g2, g3, g4, g5, g6, g7, g8, g9); } template internal::CartesianProductHolder10 Combine( const Generator1& g1, const Generator2& g2, const Generator3& g3, const Generator4& g4, const Generator5& g5, const Generator6& g6, const Generator7& g7, const Generator8& g8, const Generator9& g9, const Generator10& g10) { return internal::CartesianProductHolder10( g1, g2, g3, g4, g5, g6, g7, g8, g9, g10); } # endif // GTEST_HAS_COMBINE # define TEST_P(test_case_name, test_name) \ class GTEST_TEST_CLASS_NAME_(test_case_name, test_name) \ : public test_case_name { \ public: \ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)() {} \ virtual void TestBody(); \ private: \ static int AddToRegistry() { \ ::testing::UnitTest::GetInstance()->parameterized_test_registry(). \ GetTestCasePatternHolder(\ #test_case_name, __FILE__, __LINE__)->AddTestPattern(\ #test_case_name, \ #test_name, \ new ::testing::internal::TestMetaFactory< \ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)>()); \ return 0; \ } \ static int gtest_registering_dummy_; \ GTEST_DISALLOW_COPY_AND_ASSIGN_(\ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)); \ }; \ int GTEST_TEST_CLASS_NAME_(test_case_name, \ test_name)::gtest_registering_dummy_ = \ GTEST_TEST_CLASS_NAME_(test_case_name, test_name)::AddToRegistry(); \ void GTEST_TEST_CLASS_NAME_(test_case_name, test_name)::TestBody() # define INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) \ ::testing::internal::ParamGenerator \ gtest_##prefix##test_case_name##_EvalGenerator_() { return generator; } \ int gtest_##prefix##test_case_name##_dummy_ = \ ::testing::UnitTest::GetInstance()->parameterized_test_registry(). \ GetTestCasePatternHolder(\ #test_case_name, __FILE__, __LINE__)->AddTestCaseInstantiation(\ #prefix, \ >est_##prefix##test_case_name##_EvalGenerator_, \ __FILE__, __LINE__) } // namespace testing #endif // GTEST_HAS_PARAM_TEST #endif // GTEST_INCLUDE_GTEST_GTEST_PARAM_TEST_H_ // Copyright 2006, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) // // Google C++ Testing Framework definitions useful in production code. #ifndef GTEST_INCLUDE_GTEST_GTEST_PROD_H_ #define GTEST_INCLUDE_GTEST_GTEST_PROD_H_ // When you need to test the private or protected members of a class, // use the FRIEND_TEST macro to declare your tests as friends of the // class. For example: // // class MyClass { // private: // void MyMethod(); // FRIEND_TEST(MyClassTest, MyMethod); // }; // // class MyClassTest : public testing::Test { // // ... // }; // // TEST_F(MyClassTest, MyMethod) { // // Can call MyClass::MyMethod() here. // } #define FRIEND_TEST(test_case_name, test_name)\ friend class test_case_name##_##test_name##_Test #endif // GTEST_INCLUDE_GTEST_GTEST_PROD_H_ // Copyright 2008, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: mheule@google.com (Markus Heule) // #ifndef GTEST_INCLUDE_GTEST_GTEST_TEST_PART_H_ #define GTEST_INCLUDE_GTEST_GTEST_TEST_PART_H_ #include #include namespace testing { // A copyable object representing the result of a test part (i.e. an // assertion or an explicit FAIL(), ADD_FAILURE(), or SUCCESS()). // // Don't inherit from TestPartResult as its destructor is not virtual. class GTEST_API_ TestPartResult { public: // The possible outcomes of a test part (i.e. an assertion or an // explicit SUCCEED(), FAIL(), or ADD_FAILURE()). enum Type { kSuccess, // Succeeded. kNonFatalFailure, // Failed but the test can continue. kFatalFailure // Failed and the test should be terminated. }; // C'tor. TestPartResult does NOT have a default constructor. // Always use this constructor (with parameters) to create a // TestPartResult object. TestPartResult(Type a_type, const char* a_file_name, int a_line_number, const char* a_message) : type_(a_type), file_name_(a_file_name), line_number_(a_line_number), summary_(ExtractSummary(a_message)), message_(a_message) { } // Gets the outcome of the test part. Type type() const { return type_; } // Gets the name of the source file where the test part took place, or // NULL if it's unknown. const char* file_name() const { return file_name_.c_str(); } // Gets the line in the source file where the test part took place, // or -1 if it's unknown. int line_number() const { return line_number_; } // Gets the summary of the failure message. const char* summary() const { return summary_.c_str(); } // Gets the message associated with the test part. const char* message() const { return message_.c_str(); } // Returns true iff the test part passed. bool passed() const { return type_ == kSuccess; } // Returns true iff the test part failed. bool failed() const { return type_ != kSuccess; } // Returns true iff the test part non-fatally failed. bool nonfatally_failed() const { return type_ == kNonFatalFailure; } // Returns true iff the test part fatally failed. bool fatally_failed() const { return type_ == kFatalFailure; } private: Type type_; // Gets the summary of the failure message by omitting the stack // trace in it. static internal::String ExtractSummary(const char* message); // The name of the source file where the test part took place, or // NULL if the source file is unknown. internal::String file_name_; // The line in the source file where the test part took place, or -1 // if the line number is unknown. int line_number_; internal::String summary_; // The test failure summary. internal::String message_; // The test failure message. }; // Prints a TestPartResult object. std::ostream& operator<<(std::ostream& os, const TestPartResult& result); // An array of TestPartResult objects. // // Don't inherit from TestPartResultArray as its destructor is not // virtual. class GTEST_API_ TestPartResultArray { public: TestPartResultArray() {} // Appends the given TestPartResult to the array. void Append(const TestPartResult& result); // Returns the TestPartResult at the given index (0-based). const TestPartResult& GetTestPartResult(int index) const; // Returns the number of TestPartResult objects in the array. int size() const; private: std::vector array_; GTEST_DISALLOW_COPY_AND_ASSIGN_(TestPartResultArray); }; // This interface knows how to report a test part result. class TestPartResultReporterInterface { public: virtual ~TestPartResultReporterInterface() {} virtual void ReportTestPartResult(const TestPartResult& result) = 0; }; namespace internal { // This helper class is used by {ASSERT|EXPECT}_NO_FATAL_FAILURE to check if a // statement generates new fatal failures. To do so it registers itself as the // current test part result reporter. Besides checking if fatal failures were // reported, it only delegates the reporting to the former result reporter. // The original result reporter is restored in the destructor. // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. class GTEST_API_ HasNewFatalFailureHelper : public TestPartResultReporterInterface { public: HasNewFatalFailureHelper(); virtual ~HasNewFatalFailureHelper(); virtual void ReportTestPartResult(const TestPartResult& result); bool has_new_fatal_failure() const { return has_new_fatal_failure_; } private: bool has_new_fatal_failure_; TestPartResultReporterInterface* original_reporter_; GTEST_DISALLOW_COPY_AND_ASSIGN_(HasNewFatalFailureHelper); }; } // namespace internal } // namespace testing #endif // GTEST_INCLUDE_GTEST_GTEST_TEST_PART_H_ // Copyright 2008 Google Inc. // All Rights Reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // // Author: wan@google.com (Zhanyong Wan) #ifndef GTEST_INCLUDE_GTEST_GTEST_TYPED_TEST_H_ #define GTEST_INCLUDE_GTEST_GTEST_TYPED_TEST_H_ // This header implements typed tests and type-parameterized tests. // Typed (aka type-driven) tests repeat the same test for types in a // list. You must know which types you want to test with when writing // typed tests. Here's how you do it: #if 0 // First, define a fixture class template. It should be parameterized // by a type. Remember to derive it from testing::Test. template class FooTest : public testing::Test { public: ... typedef std::list List; static T shared_; T value_; }; // Next, associate a list of types with the test case, which will be // repeated for each type in the list. The typedef is necessary for // the macro to parse correctly. typedef testing::Types MyTypes; TYPED_TEST_CASE(FooTest, MyTypes); // If the type list contains only one type, you can write that type // directly without Types<...>: // TYPED_TEST_CASE(FooTest, int); // Then, use TYPED_TEST() instead of TEST_F() to define as many typed // tests for this test case as you want. TYPED_TEST(FooTest, DoesBlah) { // Inside a test, refer to TypeParam to get the type parameter. // Since we are inside a derived class template, C++ requires use to // visit the members of FooTest via 'this'. TypeParam n = this->value_; // To visit static members of the fixture, add the TestFixture:: // prefix. n += TestFixture::shared_; // To refer to typedefs in the fixture, add the "typename // TestFixture::" prefix. typename TestFixture::List values; values.push_back(n); ... } TYPED_TEST(FooTest, HasPropertyA) { ... } #endif // 0 // Type-parameterized tests are abstract test patterns parameterized // by a type. Compared with typed tests, type-parameterized tests // allow you to define the test pattern without knowing what the type // parameters are. The defined pattern can be instantiated with // different types any number of times, in any number of translation // units. // // If you are designing an interface or concept, you can define a // suite of type-parameterized tests to verify properties that any // valid implementation of the interface/concept should have. Then, // each implementation can easily instantiate the test suite to verify // that it conforms to the requirements, without having to write // similar tests repeatedly. Here's an example: #if 0 // First, define a fixture class template. It should be parameterized // by a type. Remember to derive it from testing::Test. template class FooTest : public testing::Test { ... }; // Next, declare that you will define a type-parameterized test case // (the _P suffix is for "parameterized" or "pattern", whichever you // prefer): TYPED_TEST_CASE_P(FooTest); // Then, use TYPED_TEST_P() to define as many type-parameterized tests // for this type-parameterized test case as you want. TYPED_TEST_P(FooTest, DoesBlah) { // Inside a test, refer to TypeParam to get the type parameter. TypeParam n = 0; ... } TYPED_TEST_P(FooTest, HasPropertyA) { ... } // Now the tricky part: you need to register all test patterns before // you can instantiate them. The first argument of the macro is the // test case name; the rest are the names of the tests in this test // case. REGISTER_TYPED_TEST_CASE_P(FooTest, DoesBlah, HasPropertyA); // Finally, you are free to instantiate the pattern with the types you // want. If you put the above code in a header file, you can #include // it in multiple C++ source files and instantiate it multiple times. // // To distinguish different instances of the pattern, the first // argument to the INSTANTIATE_* macro is a prefix that will be added // to the actual test case name. Remember to pick unique prefixes for // different instances. typedef testing::Types MyTypes; INSTANTIATE_TYPED_TEST_CASE_P(My, FooTest, MyTypes); // If the type list contains only one type, you can write that type // directly without Types<...>: // INSTANTIATE_TYPED_TEST_CASE_P(My, FooTest, int); #endif // 0 // Implements typed tests. #if GTEST_HAS_TYPED_TEST // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Expands to the name of the typedef for the type parameters of the // given test case. # define GTEST_TYPE_PARAMS_(TestCaseName) gtest_type_params_##TestCaseName##_ // The 'Types' template argument below must have spaces around it // since some compilers may choke on '>>' when passing a template // instance (e.g. Types) # define TYPED_TEST_CASE(CaseName, Types) \ typedef ::testing::internal::TypeList< Types >::type \ GTEST_TYPE_PARAMS_(CaseName) # define TYPED_TEST(CaseName, TestName) \ template \ class GTEST_TEST_CLASS_NAME_(CaseName, TestName) \ : public CaseName { \ private: \ typedef CaseName TestFixture; \ typedef gtest_TypeParam_ TypeParam; \ virtual void TestBody(); \ }; \ bool gtest_##CaseName##_##TestName##_registered_ GTEST_ATTRIBUTE_UNUSED_ = \ ::testing::internal::TypeParameterizedTest< \ CaseName, \ ::testing::internal::TemplateSel< \ GTEST_TEST_CLASS_NAME_(CaseName, TestName)>, \ GTEST_TYPE_PARAMS_(CaseName)>::Register(\ "", #CaseName, #TestName, 0); \ template \ void GTEST_TEST_CLASS_NAME_(CaseName, TestName)::TestBody() #endif // GTEST_HAS_TYPED_TEST // Implements type-parameterized tests. #if GTEST_HAS_TYPED_TEST_P // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Expands to the namespace name that the type-parameterized tests for // the given type-parameterized test case are defined in. The exact // name of the namespace is subject to change without notice. # define GTEST_CASE_NAMESPACE_(TestCaseName) \ gtest_case_##TestCaseName##_ // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // // Expands to the name of the variable used to remember the names of // the defined tests in the given test case. # define GTEST_TYPED_TEST_CASE_P_STATE_(TestCaseName) \ gtest_typed_test_case_p_state_##TestCaseName##_ // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE DIRECTLY. // // Expands to the name of the variable used to remember the names of // the registered tests in the given test case. # define GTEST_REGISTERED_TEST_NAMES_(TestCaseName) \ gtest_registered_test_names_##TestCaseName##_ // The variables defined in the type-parameterized test macros are // static as typically these macros are used in a .h file that can be // #included in multiple translation units linked together. # define TYPED_TEST_CASE_P(CaseName) \ static ::testing::internal::TypedTestCasePState \ GTEST_TYPED_TEST_CASE_P_STATE_(CaseName) # define TYPED_TEST_P(CaseName, TestName) \ namespace GTEST_CASE_NAMESPACE_(CaseName) { \ template \ class TestName : public CaseName { \ private: \ typedef CaseName TestFixture; \ typedef gtest_TypeParam_ TypeParam; \ virtual void TestBody(); \ }; \ static bool gtest_##TestName##_defined_ GTEST_ATTRIBUTE_UNUSED_ = \ GTEST_TYPED_TEST_CASE_P_STATE_(CaseName).AddTestName(\ __FILE__, __LINE__, #CaseName, #TestName); \ } \ template \ void GTEST_CASE_NAMESPACE_(CaseName)::TestName::TestBody() # define REGISTER_TYPED_TEST_CASE_P(CaseName, ...) \ namespace GTEST_CASE_NAMESPACE_(CaseName) { \ typedef ::testing::internal::Templates<__VA_ARGS__>::type gtest_AllTests_; \ } \ static const char* const GTEST_REGISTERED_TEST_NAMES_(CaseName) = \ GTEST_TYPED_TEST_CASE_P_STATE_(CaseName).VerifyRegisteredTestNames(\ __FILE__, __LINE__, #__VA_ARGS__) // The 'Types' template argument below must have spaces around it // since some compilers may choke on '>>' when passing a template // instance (e.g. Types) # define INSTANTIATE_TYPED_TEST_CASE_P(Prefix, CaseName, Types) \ bool gtest_##Prefix##_##CaseName GTEST_ATTRIBUTE_UNUSED_ = \ ::testing::internal::TypeParameterizedTestCase::type>::Register(\ #Prefix, #CaseName, GTEST_REGISTERED_TEST_NAMES_(CaseName)) #endif // GTEST_HAS_TYPED_TEST_P #endif // GTEST_INCLUDE_GTEST_GTEST_TYPED_TEST_H_ // Depending on the platform, different string classes are available. // On Linux, in addition to ::std::string, Google also makes use of // class ::string, which has the same interface as ::std::string, but // has a different implementation. // // The user can define GTEST_HAS_GLOBAL_STRING to 1 to indicate that // ::string is available AND is a distinct type to ::std::string, or // define it to 0 to indicate otherwise. // // If the user's ::std::string and ::string are the same class due to // aliasing, he should define GTEST_HAS_GLOBAL_STRING to 0. // // If the user doesn't define GTEST_HAS_GLOBAL_STRING, it is defined // heuristically. namespace testing { // Declares the flags. // This flag temporary enables the disabled tests. GTEST_DECLARE_bool_(also_run_disabled_tests); // This flag brings the debugger on an assertion failure. GTEST_DECLARE_bool_(break_on_failure); // This flag controls whether Google Test catches all test-thrown exceptions // and logs them as failures. GTEST_DECLARE_bool_(catch_exceptions); // This flag enables using colors in terminal output. Available values are // "yes" to enable colors, "no" (disable colors), or "auto" (the default) // to let Google Test decide. GTEST_DECLARE_string_(color); // This flag sets up the filter to select by name using a glob pattern // the tests to run. If the filter is not given all tests are executed. GTEST_DECLARE_string_(filter); // This flag causes the Google Test to list tests. None of the tests listed // are actually run if the flag is provided. GTEST_DECLARE_bool_(list_tests); // This flag controls whether Google Test emits a detailed XML report to a file // in addition to its normal textual output. GTEST_DECLARE_string_(output); // This flags control whether Google Test prints the elapsed time for each // test. GTEST_DECLARE_bool_(print_time); // This flag specifies the random number seed. GTEST_DECLARE_int32_(random_seed); // This flag sets how many times the tests are repeated. The default value // is 1. If the value is -1 the tests are repeating forever. GTEST_DECLARE_int32_(repeat); // This flag controls whether Google Test includes Google Test internal // stack frames in failure stack traces. GTEST_DECLARE_bool_(show_internal_stack_frames); // When this flag is specified, tests' order is randomized on every iteration. GTEST_DECLARE_bool_(shuffle); // This flag specifies the maximum number of stack frames to be // printed in a failure message. GTEST_DECLARE_int32_(stack_trace_depth); // When this flag is specified, a failed assertion will throw an // exception if exceptions are enabled, or exit the program with a // non-zero code otherwise. GTEST_DECLARE_bool_(throw_on_failure); // When this flag is set with a "host:port" string, on supported // platforms test results are streamed to the specified port on // the specified host machine. GTEST_DECLARE_string_(stream_result_to); // The upper limit for valid stack trace depths. const int kMaxStackTraceDepth = 100; namespace internal { class AssertHelper; class DefaultGlobalTestPartResultReporter; class ExecDeathTest; class NoExecDeathTest; class FinalSuccessChecker; class GTestFlagSaver; class TestResultAccessor; class TestEventListenersAccessor; class TestEventRepeater; class WindowsDeathTest; class UnitTestImpl* GetUnitTestImpl(); void ReportFailureInUnknownLocation(TestPartResult::Type result_type, const String& message); // Converts a streamable value to a String. A NULL pointer is // converted to "(null)". When the input value is a ::string, // ::std::string, ::wstring, or ::std::wstring object, each NUL // character in it is replaced with "\\0". // Declared in gtest-internal.h but defined here, so that it has access // to the definition of the Message class, required by the ARM // compiler. template String StreamableToString(const T& streamable) { return (Message() << streamable).GetString(); } } // namespace internal // The friend relationship of some of these classes is cyclic. // If we don't forward declare them the compiler might confuse the classes // in friendship clauses with same named classes on the scope. class Test; class TestCase; class TestInfo; class UnitTest; // A class for indicating whether an assertion was successful. When // the assertion wasn't successful, the AssertionResult object // remembers a non-empty message that describes how it failed. // // To create an instance of this class, use one of the factory functions // (AssertionSuccess() and AssertionFailure()). // // This class is useful for two purposes: // 1. Defining predicate functions to be used with Boolean test assertions // EXPECT_TRUE/EXPECT_FALSE and their ASSERT_ counterparts // 2. Defining predicate-format functions to be // used with predicate assertions (ASSERT_PRED_FORMAT*, etc). // // For example, if you define IsEven predicate: // // testing::AssertionResult IsEven(int n) { // if ((n % 2) == 0) // return testing::AssertionSuccess(); // else // return testing::AssertionFailure() << n << " is odd"; // } // // Then the failed expectation EXPECT_TRUE(IsEven(Fib(5))) // will print the message // // Value of: IsEven(Fib(5)) // Actual: false (5 is odd) // Expected: true // // instead of a more opaque // // Value of: IsEven(Fib(5)) // Actual: false // Expected: true // // in case IsEven is a simple Boolean predicate. // // If you expect your predicate to be reused and want to support informative // messages in EXPECT_FALSE and ASSERT_FALSE (negative assertions show up // about half as often as positive ones in our tests), supply messages for // both success and failure cases: // // testing::AssertionResult IsEven(int n) { // if ((n % 2) == 0) // return testing::AssertionSuccess() << n << " is even"; // else // return testing::AssertionFailure() << n << " is odd"; // } // // Then a statement EXPECT_FALSE(IsEven(Fib(6))) will print // // Value of: IsEven(Fib(6)) // Actual: true (8 is even) // Expected: false // // NB: Predicates that support negative Boolean assertions have reduced // performance in positive ones so be careful not to use them in tests // that have lots (tens of thousands) of positive Boolean assertions. // // To use this class with EXPECT_PRED_FORMAT assertions such as: // // // Verifies that Foo() returns an even number. // EXPECT_PRED_FORMAT1(IsEven, Foo()); // // you need to define: // // testing::AssertionResult IsEven(const char* expr, int n) { // if ((n % 2) == 0) // return testing::AssertionSuccess(); // else // return testing::AssertionFailure() // << "Expected: " << expr << " is even\n Actual: it's " << n; // } // // If Foo() returns 5, you will see the following message: // // Expected: Foo() is even // Actual: it's 5 // class GTEST_API_ AssertionResult { public: // Copy constructor. // Used in EXPECT_TRUE/FALSE(assertion_result). AssertionResult(const AssertionResult& other); // Used in the EXPECT_TRUE/FALSE(bool_expression). explicit AssertionResult(bool success) : success_(success) {} // Returns true iff the assertion succeeded. operator bool() const { return success_; } // NOLINT // Returns the assertion's negation. Used with EXPECT/ASSERT_FALSE. AssertionResult operator!() const; // Returns the text streamed into this AssertionResult. Test assertions // use it when they fail (i.e., the predicate's outcome doesn't match the // assertion's expectation). When nothing has been streamed into the // object, returns an empty string. const char* message() const { return message_.get() != NULL ? message_->c_str() : ""; } // TODO(vladl@google.com): Remove this after making sure no clients use it. // Deprecated; please use message() instead. const char* failure_message() const { return message(); } // Streams a custom failure message into this object. template AssertionResult& operator<<(const T& value) { AppendMessage(Message() << value); return *this; } // Allows streaming basic output manipulators such as endl or flush into // this object. AssertionResult& operator<<( ::std::ostream& (*basic_manipulator)(::std::ostream& stream)) { AppendMessage(Message() << basic_manipulator); return *this; } private: // Appends the contents of message to message_. void AppendMessage(const Message& a_message) { if (message_.get() == NULL) message_.reset(new ::std::string); message_->append(a_message.GetString().c_str()); } // Stores result of the assertion predicate. bool success_; // Stores the message describing the condition in case the expectation // construct is not satisfied with the predicate's outcome. // Referenced via a pointer to avoid taking too much stack frame space // with test assertions. internal::scoped_ptr< ::std::string> message_; GTEST_DISALLOW_ASSIGN_(AssertionResult); }; // Makes a successful assertion result. GTEST_API_ AssertionResult AssertionSuccess(); // Makes a failed assertion result. GTEST_API_ AssertionResult AssertionFailure(); // Makes a failed assertion result with the given failure message. // Deprecated; use AssertionFailure() << msg. GTEST_API_ AssertionResult AssertionFailure(const Message& msg); // The abstract class that all tests inherit from. // // In Google Test, a unit test program contains one or many TestCases, and // each TestCase contains one or many Tests. // // When you define a test using the TEST macro, you don't need to // explicitly derive from Test - the TEST macro automatically does // this for you. // // The only time you derive from Test is when defining a test fixture // to be used a TEST_F. For example: // // class FooTest : public testing::Test { // protected: // virtual void SetUp() { ... } // virtual void TearDown() { ... } // ... // }; // // TEST_F(FooTest, Bar) { ... } // TEST_F(FooTest, Baz) { ... } // // Test is not copyable. class GTEST_API_ Test { public: friend class TestInfo; // Defines types for pointers to functions that set up and tear down // a test case. typedef internal::SetUpTestCaseFunc SetUpTestCaseFunc; typedef internal::TearDownTestCaseFunc TearDownTestCaseFunc; // The d'tor is virtual as we intend to inherit from Test. virtual ~Test(); // Sets up the stuff shared by all tests in this test case. // // Google Test will call Foo::SetUpTestCase() before running the first // test in test case Foo. Hence a sub-class can define its own // SetUpTestCase() method to shadow the one defined in the super // class. static void SetUpTestCase() {} // Tears down the stuff shared by all tests in this test case. // // Google Test will call Foo::TearDownTestCase() after running the last // test in test case Foo. Hence a sub-class can define its own // TearDownTestCase() method to shadow the one defined in the super // class. static void TearDownTestCase() {} // Returns true iff the current test has a fatal failure. static bool HasFatalFailure(); // Returns true iff the current test has a non-fatal failure. static bool HasNonfatalFailure(); // Returns true iff the current test has a (either fatal or // non-fatal) failure. static bool HasFailure() { return HasFatalFailure() || HasNonfatalFailure(); } // Logs a property for the current test. Only the last value for a given // key is remembered. // These are public static so they can be called from utility functions // that are not members of the test fixture. // The arguments are const char* instead strings, as Google Test is used // on platforms where string doesn't compile. // // Note that a driving consideration for these RecordProperty methods // was to produce xml output suited to the Greenspan charting utility, // which at present will only chart values that fit in a 32-bit int. It // is the user's responsibility to restrict their values to 32-bit ints // if they intend them to be used with Greenspan. static void RecordProperty(const char* key, const char* value); static void RecordProperty(const char* key, int value); protected: // Creates a Test object. Test(); // Sets up the test fixture. virtual void SetUp(); // Tears down the test fixture. virtual void TearDown(); private: // Returns true iff the current test has the same fixture class as // the first test in the current test case. static bool HasSameFixtureClass(); // Runs the test after the test fixture has been set up. // // A sub-class must implement this to define the test logic. // // DO NOT OVERRIDE THIS FUNCTION DIRECTLY IN A USER PROGRAM. // Instead, use the TEST or TEST_F macro. virtual void TestBody() = 0; // Sets up, executes, and tears down the test. void Run(); // Deletes self. We deliberately pick an unusual name for this // internal method to avoid clashing with names used in user TESTs. void DeleteSelf_() { delete this; } // Uses a GTestFlagSaver to save and restore all Google Test flags. const internal::GTestFlagSaver* const gtest_flag_saver_; // Often a user mis-spells SetUp() as Setup() and spends a long time // wondering why it is never called by Google Test. The declaration of // the following method is solely for catching such an error at // compile time: // // - The return type is deliberately chosen to be not void, so it // will be a conflict if a user declares void Setup() in his test // fixture. // // - This method is private, so it will be another compiler error // if a user calls it from his test fixture. // // DO NOT OVERRIDE THIS FUNCTION. // // If you see an error about overriding the following function or // about it being private, you have mis-spelled SetUp() as Setup(). struct Setup_should_be_spelled_SetUp {}; virtual Setup_should_be_spelled_SetUp* Setup() { return NULL; } // We disallow copying Tests. GTEST_DISALLOW_COPY_AND_ASSIGN_(Test); }; typedef internal::TimeInMillis TimeInMillis; // A copyable object representing a user specified test property which can be // output as a key/value string pair. // // Don't inherit from TestProperty as its destructor is not virtual. class TestProperty { public: // C'tor. TestProperty does NOT have a default constructor. // Always use this constructor (with parameters) to create a // TestProperty object. TestProperty(const char* a_key, const char* a_value) : key_(a_key), value_(a_value) { } // Gets the user supplied key. const char* key() const { return key_.c_str(); } // Gets the user supplied value. const char* value() const { return value_.c_str(); } // Sets a new value, overriding the one supplied in the constructor. void SetValue(const char* new_value) { value_ = new_value; } private: // The key supplied by the user. internal::String key_; // The value supplied by the user. internal::String value_; }; // The result of a single Test. This includes a list of // TestPartResults, a list of TestProperties, a count of how many // death tests there are in the Test, and how much time it took to run // the Test. // // TestResult is not copyable. class GTEST_API_ TestResult { public: // Creates an empty TestResult. TestResult(); // D'tor. Do not inherit from TestResult. ~TestResult(); // Gets the number of all test parts. This is the sum of the number // of successful test parts and the number of failed test parts. int total_part_count() const; // Returns the number of the test properties. int test_property_count() const; // Returns true iff the test passed (i.e. no test part failed). bool Passed() const { return !Failed(); } // Returns true iff the test failed. bool Failed() const; // Returns true iff the test fatally failed. bool HasFatalFailure() const; // Returns true iff the test has a non-fatal failure. bool HasNonfatalFailure() const; // Returns the elapsed time, in milliseconds. TimeInMillis elapsed_time() const { return elapsed_time_; } // Returns the i-th test part result among all the results. i can range // from 0 to test_property_count() - 1. If i is not in that range, aborts // the program. const TestPartResult& GetTestPartResult(int i) const; // Returns the i-th test property. i can range from 0 to // test_property_count() - 1. If i is not in that range, aborts the // program. const TestProperty& GetTestProperty(int i) const; private: friend class TestInfo; friend class UnitTest; friend class internal::DefaultGlobalTestPartResultReporter; friend class internal::ExecDeathTest; friend class internal::TestResultAccessor; friend class internal::UnitTestImpl; friend class internal::WindowsDeathTest; // Gets the vector of TestPartResults. const std::vector& test_part_results() const { return test_part_results_; } // Gets the vector of TestProperties. const std::vector& test_properties() const { return test_properties_; } // Sets the elapsed time. void set_elapsed_time(TimeInMillis elapsed) { elapsed_time_ = elapsed; } // Adds a test property to the list. The property is validated and may add // a non-fatal failure if invalid (e.g., if it conflicts with reserved // key names). If a property is already recorded for the same key, the // value will be updated, rather than storing multiple values for the same // key. void RecordProperty(const TestProperty& test_property); // Adds a failure if the key is a reserved attribute of Google Test // testcase tags. Returns true if the property is valid. // TODO(russr): Validate attribute names are legal and human readable. static bool ValidateTestProperty(const TestProperty& test_property); // Adds a test part result to the list. void AddTestPartResult(const TestPartResult& test_part_result); // Returns the death test count. int death_test_count() const { return death_test_count_; } // Increments the death test count, returning the new count. int increment_death_test_count() { return ++death_test_count_; } // Clears the test part results. void ClearTestPartResults(); // Clears the object. void Clear(); // Protects mutable state of the property vector and of owned // properties, whose values may be updated. internal::Mutex test_properites_mutex_; // The vector of TestPartResults std::vector test_part_results_; // The vector of TestProperties std::vector test_properties_; // Running count of death tests. int death_test_count_; // The elapsed time, in milliseconds. TimeInMillis elapsed_time_; // We disallow copying TestResult. GTEST_DISALLOW_COPY_AND_ASSIGN_(TestResult); }; // class TestResult // A TestInfo object stores the following information about a test: // // Test case name // Test name // Whether the test should be run // A function pointer that creates the test object when invoked // Test result // // The constructor of TestInfo registers itself with the UnitTest // singleton such that the RUN_ALL_TESTS() macro knows which tests to // run. class GTEST_API_ TestInfo { public: // Destructs a TestInfo object. This function is not virtual, so // don't inherit from TestInfo. ~TestInfo(); // Returns the test case name. const char* test_case_name() const { return test_case_name_.c_str(); } // Returns the test name. const char* name() const { return name_.c_str(); } // Returns the name of the parameter type, or NULL if this is not a typed // or a type-parameterized test. const char* type_param() const { if (type_param_.get() != NULL) return type_param_->c_str(); return NULL; } // Returns the text representation of the value parameter, or NULL if this // is not a value-parameterized test. const char* value_param() const { if (value_param_.get() != NULL) return value_param_->c_str(); return NULL; } // Returns true if this test should run, that is if the test is not disabled // (or it is disabled but the also_run_disabled_tests flag has been specified) // and its full name matches the user-specified filter. // // Google Test allows the user to filter the tests by their full names. // The full name of a test Bar in test case Foo is defined as // "Foo.Bar". Only the tests that match the filter will run. // // A filter is a colon-separated list of glob (not regex) patterns, // optionally followed by a '-' and a colon-separated list of // negative patterns (tests to exclude). A test is run if it // matches one of the positive patterns and does not match any of // the negative patterns. // // For example, *A*:Foo.* is a filter that matches any string that // contains the character 'A' or starts with "Foo.". bool should_run() const { return should_run_; } // Returns the result of the test. const TestResult* result() const { return &result_; } private: #if GTEST_HAS_DEATH_TEST friend class internal::DefaultDeathTestFactory; #endif // GTEST_HAS_DEATH_TEST friend class Test; friend class TestCase; friend class internal::UnitTestImpl; friend TestInfo* internal::MakeAndRegisterTestInfo( const char* test_case_name, const char* name, const char* type_param, const char* value_param, internal::TypeId fixture_class_id, Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc, internal::TestFactoryBase* factory); // Constructs a TestInfo object. The newly constructed instance assumes // ownership of the factory object. TestInfo(const char* test_case_name, const char* name, const char* a_type_param, const char* a_value_param, internal::TypeId fixture_class_id, internal::TestFactoryBase* factory); // Increments the number of death tests encountered in this test so // far. int increment_death_test_count() { return result_.increment_death_test_count(); } // Creates the test object, runs it, records its result, and then // deletes it. void Run(); static void ClearTestResult(TestInfo* test_info) { test_info->result_.Clear(); } // These fields are immutable properties of the test. const std::string test_case_name_; // Test case name const std::string name_; // Test name // Name of the parameter type, or NULL if this is not a typed or a // type-parameterized test. const internal::scoped_ptr type_param_; // Text representation of the value parameter, or NULL if this is not a // value-parameterized test. const internal::scoped_ptr value_param_; const internal::TypeId fixture_class_id_; // ID of the test fixture class bool should_run_; // True iff this test should run bool is_disabled_; // True iff this test is disabled bool matches_filter_; // True if this test matches the // user-specified filter. internal::TestFactoryBase* const factory_; // The factory that creates // the test object // This field is mutable and needs to be reset before running the // test for the second time. TestResult result_; GTEST_DISALLOW_COPY_AND_ASSIGN_(TestInfo); }; // A test case, which consists of a vector of TestInfos. // // TestCase is not copyable. class GTEST_API_ TestCase { public: // Creates a TestCase with the given name. // // TestCase does NOT have a default constructor. Always use this // constructor to create a TestCase object. // // Arguments: // // name: name of the test case // a_type_param: the name of the test's type parameter, or NULL if // this is not a type-parameterized test. // set_up_tc: pointer to the function that sets up the test case // tear_down_tc: pointer to the function that tears down the test case TestCase(const char* name, const char* a_type_param, Test::SetUpTestCaseFunc set_up_tc, Test::TearDownTestCaseFunc tear_down_tc); // Destructor of TestCase. virtual ~TestCase(); // Gets the name of the TestCase. const char* name() const { return name_.c_str(); } // Returns the name of the parameter type, or NULL if this is not a // type-parameterized test case. const char* type_param() const { if (type_param_.get() != NULL) return type_param_->c_str(); return NULL; } // Returns true if any test in this test case should run. bool should_run() const { return should_run_; } // Gets the number of successful tests in this test case. int successful_test_count() const; // Gets the number of failed tests in this test case. int failed_test_count() const; // Gets the number of disabled tests in this test case. int disabled_test_count() const; // Get the number of tests in this test case that should run. int test_to_run_count() const; // Gets the number of all tests in this test case. int total_test_count() const; // Returns true iff the test case passed. bool Passed() const { return !Failed(); } // Returns true iff the test case failed. bool Failed() const { return failed_test_count() > 0; } // Returns the elapsed time, in milliseconds. TimeInMillis elapsed_time() const { return elapsed_time_; } // Returns the i-th test among all the tests. i can range from 0 to // total_test_count() - 1. If i is not in that range, returns NULL. const TestInfo* GetTestInfo(int i) const; private: friend class Test; friend class internal::UnitTestImpl; // Gets the (mutable) vector of TestInfos in this TestCase. std::vector& test_info_list() { return test_info_list_; } // Gets the (immutable) vector of TestInfos in this TestCase. const std::vector& test_info_list() const { return test_info_list_; } // Returns the i-th test among all the tests. i can range from 0 to // total_test_count() - 1. If i is not in that range, returns NULL. TestInfo* GetMutableTestInfo(int i); // Sets the should_run member. void set_should_run(bool should) { should_run_ = should; } // Adds a TestInfo to this test case. Will delete the TestInfo upon // destruction of the TestCase object. void AddTestInfo(TestInfo * test_info); // Clears the results of all tests in this test case. void ClearResult(); // Clears the results of all tests in the given test case. static void ClearTestCaseResult(TestCase* test_case) { test_case->ClearResult(); } // Runs every test in this TestCase. void Run(); // Runs SetUpTestCase() for this TestCase. This wrapper is needed // for catching exceptions thrown from SetUpTestCase(). void RunSetUpTestCase() { (*set_up_tc_)(); } // Runs TearDownTestCase() for this TestCase. This wrapper is // needed for catching exceptions thrown from TearDownTestCase(). void RunTearDownTestCase() { (*tear_down_tc_)(); } // Returns true iff test passed. static bool TestPassed(const TestInfo* test_info) { return test_info->should_run() && test_info->result()->Passed(); } // Returns true iff test failed. static bool TestFailed(const TestInfo* test_info) { return test_info->should_run() && test_info->result()->Failed(); } // Returns true iff test is disabled. static bool TestDisabled(const TestInfo* test_info) { return test_info->is_disabled_; } // Returns true if the given test should run. static bool ShouldRunTest(const TestInfo* test_info) { return test_info->should_run(); } // Shuffles the tests in this test case. void ShuffleTests(internal::Random* random); // Restores the test order to before the first shuffle. void UnshuffleTests(); // Name of the test case. internal::String name_; // Name of the parameter type, or NULL if this is not a typed or a // type-parameterized test. const internal::scoped_ptr type_param_; // The vector of TestInfos in their original order. It owns the // elements in the vector. std::vector test_info_list_; // Provides a level of indirection for the test list to allow easy // shuffling and restoring the test order. The i-th element in this // vector is the index of the i-th test in the shuffled test list. std::vector test_indices_; // Pointer to the function that sets up the test case. Test::SetUpTestCaseFunc set_up_tc_; // Pointer to the function that tears down the test case. Test::TearDownTestCaseFunc tear_down_tc_; // True iff any test in this test case should run. bool should_run_; // Elapsed time, in milliseconds. TimeInMillis elapsed_time_; // We disallow copying TestCases. GTEST_DISALLOW_COPY_AND_ASSIGN_(TestCase); }; // An Environment object is capable of setting up and tearing down an // environment. The user should subclass this to define his own // environment(s). // // An Environment object does the set-up and tear-down in virtual // methods SetUp() and TearDown() instead of the constructor and the // destructor, as: // // 1. You cannot safely throw from a destructor. This is a problem // as in some cases Google Test is used where exceptions are enabled, and // we may want to implement ASSERT_* using exceptions where they are // available. // 2. You cannot use ASSERT_* directly in a constructor or // destructor. class Environment { public: // The d'tor is virtual as we need to subclass Environment. virtual ~Environment() {} // Override this to define how to set up the environment. virtual void SetUp() {} // Override this to define how to tear down the environment. virtual void TearDown() {} private: // If you see an error about overriding the following function or // about it being private, you have mis-spelled SetUp() as Setup(). struct Setup_should_be_spelled_SetUp {}; virtual Setup_should_be_spelled_SetUp* Setup() { return NULL; } }; // The interface for tracing execution of tests. The methods are organized in // the order the corresponding events are fired. class TestEventListener { public: virtual ~TestEventListener() {} // Fired before any test activity starts. virtual void OnTestProgramStart(const UnitTest& unit_test) = 0; // Fired before each iteration of tests starts. There may be more than // one iteration if GTEST_FLAG(repeat) is set. iteration is the iteration // index, starting from 0. virtual void OnTestIterationStart(const UnitTest& unit_test, int iteration) = 0; // Fired before environment set-up for each iteration of tests starts. virtual void OnEnvironmentsSetUpStart(const UnitTest& unit_test) = 0; // Fired after environment set-up for each iteration of tests ends. virtual void OnEnvironmentsSetUpEnd(const UnitTest& unit_test) = 0; // Fired before the test case starts. virtual void OnTestCaseStart(const TestCase& test_case) = 0; // Fired before the test starts. virtual void OnTestStart(const TestInfo& test_info) = 0; // Fired after a failed assertion or a SUCCEED() invocation. virtual void OnTestPartResult(const TestPartResult& test_part_result) = 0; // Fired after the test ends. virtual void OnTestEnd(const TestInfo& test_info) = 0; // Fired after the test case ends. virtual void OnTestCaseEnd(const TestCase& test_case) = 0; // Fired before environment tear-down for each iteration of tests starts. virtual void OnEnvironmentsTearDownStart(const UnitTest& unit_test) = 0; // Fired after environment tear-down for each iteration of tests ends. virtual void OnEnvironmentsTearDownEnd(const UnitTest& unit_test) = 0; // Fired after each iteration of tests finishes. virtual void OnTestIterationEnd(const UnitTest& unit_test, int iteration) = 0; // Fired after all test activities have ended. virtual void OnTestProgramEnd(const UnitTest& unit_test) = 0; }; // The convenience class for users who need to override just one or two // methods and are not concerned that a possible change to a signature of // the methods they override will not be caught during the build. For // comments about each method please see the definition of TestEventListener // above. class EmptyTestEventListener : public TestEventListener { public: virtual void OnTestProgramStart(const UnitTest& /*unit_test*/) {} virtual void OnTestIterationStart(const UnitTest& /*unit_test*/, int /*iteration*/) {} virtual void OnEnvironmentsSetUpStart(const UnitTest& /*unit_test*/) {} virtual void OnEnvironmentsSetUpEnd(const UnitTest& /*unit_test*/) {} virtual void OnTestCaseStart(const TestCase& /*test_case*/) {} virtual void OnTestStart(const TestInfo& /*test_info*/) {} virtual void OnTestPartResult(const TestPartResult& /*test_part_result*/) {} virtual void OnTestEnd(const TestInfo& /*test_info*/) {} virtual void OnTestCaseEnd(const TestCase& /*test_case*/) {} virtual void OnEnvironmentsTearDownStart(const UnitTest& /*unit_test*/) {} virtual void OnEnvironmentsTearDownEnd(const UnitTest& /*unit_test*/) {} virtual void OnTestIterationEnd(const UnitTest& /*unit_test*/, int /*iteration*/) {} virtual void OnTestProgramEnd(const UnitTest& /*unit_test*/) {} }; // TestEventListeners lets users add listeners to track events in Google Test. class GTEST_API_ TestEventListeners { public: TestEventListeners(); ~TestEventListeners(); // Appends an event listener to the end of the list. Google Test assumes // the ownership of the listener (i.e. it will delete the listener when // the test program finishes). void Append(TestEventListener* listener); // Removes the given event listener from the list and returns it. It then // becomes the caller's responsibility to delete the listener. Returns // NULL if the listener is not found in the list. TestEventListener* Release(TestEventListener* listener); // Returns the standard listener responsible for the default console // output. Can be removed from the listeners list to shut down default // console output. Note that removing this object from the listener list // with Release transfers its ownership to the caller and makes this // function return NULL the next time. TestEventListener* default_result_printer() const { return default_result_printer_; } // Returns the standard listener responsible for the default XML output // controlled by the --gtest_output=xml flag. Can be removed from the // listeners list by users who want to shut down the default XML output // controlled by this flag and substitute it with custom one. Note that // removing this object from the listener list with Release transfers its // ownership to the caller and makes this function return NULL the next // time. TestEventListener* default_xml_generator() const { return default_xml_generator_; } private: friend class TestCase; friend class TestInfo; friend class internal::DefaultGlobalTestPartResultReporter; friend class internal::NoExecDeathTest; friend class internal::TestEventListenersAccessor; friend class internal::UnitTestImpl; // Returns repeater that broadcasts the TestEventListener events to all // subscribers. TestEventListener* repeater(); // Sets the default_result_printer attribute to the provided listener. // The listener is also added to the listener list and previous // default_result_printer is removed from it and deleted. The listener can // also be NULL in which case it will not be added to the list. Does // nothing if the previous and the current listener objects are the same. void SetDefaultResultPrinter(TestEventListener* listener); // Sets the default_xml_generator attribute to the provided listener. The // listener is also added to the listener list and previous // default_xml_generator is removed from it and deleted. The listener can // also be NULL in which case it will not be added to the list. Does // nothing if the previous and the current listener objects are the same. void SetDefaultXmlGenerator(TestEventListener* listener); // Controls whether events will be forwarded by the repeater to the // listeners in the list. bool EventForwardingEnabled() const; void SuppressEventForwarding(); // The actual list of listeners. internal::TestEventRepeater* repeater_; // Listener responsible for the standard result output. TestEventListener* default_result_printer_; // Listener responsible for the creation of the XML output file. TestEventListener* default_xml_generator_; // We disallow copying TestEventListeners. GTEST_DISALLOW_COPY_AND_ASSIGN_(TestEventListeners); }; // A UnitTest consists of a vector of TestCases. // // This is a singleton class. The only instance of UnitTest is // created when UnitTest::GetInstance() is first called. This // instance is never deleted. // // UnitTest is not copyable. // // This class is thread-safe as long as the methods are called // according to their specification. class GTEST_API_ UnitTest { public: // Gets the singleton UnitTest object. The first time this method // is called, a UnitTest object is constructed and returned. // Consecutive calls will return the same object. static UnitTest* GetInstance(); // Runs all tests in this UnitTest object and prints the result. // Returns 0 if successful, or 1 otherwise. // // This method can only be called from the main thread. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. int Run() GTEST_MUST_USE_RESULT_; // Returns the working directory when the first TEST() or TEST_F() // was executed. The UnitTest object owns the string. const char* original_working_dir() const; // Returns the TestCase object for the test that's currently running, // or NULL if no test is running. const TestCase* current_test_case() const; // Returns the TestInfo object for the test that's currently running, // or NULL if no test is running. const TestInfo* current_test_info() const; // Returns the random seed used at the start of the current test run. int random_seed() const; #if GTEST_HAS_PARAM_TEST // Returns the ParameterizedTestCaseRegistry object used to keep track of // value-parameterized tests and instantiate and register them. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. internal::ParameterizedTestCaseRegistry& parameterized_test_registry(); #endif // GTEST_HAS_PARAM_TEST // Gets the number of successful test cases. int successful_test_case_count() const; // Gets the number of failed test cases. int failed_test_case_count() const; // Gets the number of all test cases. int total_test_case_count() const; // Gets the number of all test cases that contain at least one test // that should run. int test_case_to_run_count() const; // Gets the number of successful tests. int successful_test_count() const; // Gets the number of failed tests. int failed_test_count() const; // Gets the number of disabled tests. int disabled_test_count() const; // Gets the number of all tests. int total_test_count() const; // Gets the number of tests that should run. int test_to_run_count() const; // Gets the elapsed time, in milliseconds. TimeInMillis elapsed_time() const; // Returns true iff the unit test passed (i.e. all test cases passed). bool Passed() const; // Returns true iff the unit test failed (i.e. some test case failed // or something outside of all tests failed). bool Failed() const; // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. const TestCase* GetTestCase(int i) const; // Returns the list of event listeners that can be used to track events // inside Google Test. TestEventListeners& listeners(); private: // Registers and returns a global test environment. When a test // program is run, all global test environments will be set-up in // the order they were registered. After all tests in the program // have finished, all global test environments will be torn-down in // the *reverse* order they were registered. // // The UnitTest object takes ownership of the given environment. // // This method can only be called from the main thread. Environment* AddEnvironment(Environment* env); // Adds a TestPartResult to the current TestResult object. All // Google Test assertion macros (e.g. ASSERT_TRUE, EXPECT_EQ, etc) // eventually call this to report their results. The user code // should use the assertion macros instead of calling this directly. void AddTestPartResult(TestPartResult::Type result_type, const char* file_name, int line_number, const internal::String& message, const internal::String& os_stack_trace); // Adds a TestProperty to the current TestResult object. If the result already // contains a property with the same key, the value will be updated. void RecordPropertyForCurrentTest(const char* key, const char* value); // Gets the i-th test case among all the test cases. i can range from 0 to // total_test_case_count() - 1. If i is not in that range, returns NULL. TestCase* GetMutableTestCase(int i); // Accessors for the implementation object. internal::UnitTestImpl* impl() { return impl_; } const internal::UnitTestImpl* impl() const { return impl_; } // These classes and funcions are friends as they need to access private // members of UnitTest. friend class Test; friend class internal::AssertHelper; friend class internal::ScopedTrace; friend Environment* AddGlobalTestEnvironment(Environment* env); friend internal::UnitTestImpl* internal::GetUnitTestImpl(); friend void internal::ReportFailureInUnknownLocation( TestPartResult::Type result_type, const internal::String& message); // Creates an empty UnitTest. UnitTest(); // D'tor virtual ~UnitTest(); // Pushes a trace defined by SCOPED_TRACE() on to the per-thread // Google Test trace stack. void PushGTestTrace(const internal::TraceInfo& trace); // Pops a trace from the per-thread Google Test trace stack. void PopGTestTrace(); // Protects mutable state in *impl_. This is mutable as some const // methods need to lock it too. mutable internal::Mutex mutex_; // Opaque implementation object. This field is never changed once // the object is constructed. We don't mark it as const here, as // doing so will cause a warning in the constructor of UnitTest. // Mutable state in *impl_ is protected by mutex_. internal::UnitTestImpl* impl_; // We disallow copying UnitTest. GTEST_DISALLOW_COPY_AND_ASSIGN_(UnitTest); }; // A convenient wrapper for adding an environment for the test // program. // // You should call this before RUN_ALL_TESTS() is called, probably in // main(). If you use gtest_main, you need to call this before main() // starts for it to take effect. For example, you can define a global // variable like this: // // testing::Environment* const foo_env = // testing::AddGlobalTestEnvironment(new FooEnvironment); // // However, we strongly recommend you to write your own main() and // call AddGlobalTestEnvironment() there, as relying on initialization // of global variables makes the code harder to read and may cause // problems when you register multiple environments from different // translation units and the environments have dependencies among them // (remember that the compiler doesn't guarantee the order in which // global variables from different translation units are initialized). inline Environment* AddGlobalTestEnvironment(Environment* env) { return UnitTest::GetInstance()->AddEnvironment(env); } // Initializes Google Test. This must be called before calling // RUN_ALL_TESTS(). In particular, it parses a command line for the // flags that Google Test recognizes. Whenever a Google Test flag is // seen, it is removed from argv, and *argc is decremented. // // No value is returned. Instead, the Google Test flag variables are // updated. // // Calling the function for the second time has no user-visible effect. GTEST_API_ void InitGoogleTest(int* argc, char** argv); // This overloaded version can be used in Windows programs compiled in // UNICODE mode. GTEST_API_ void InitGoogleTest(int* argc, wchar_t** argv); namespace internal { // Formats a comparison assertion (e.g. ASSERT_EQ, EXPECT_LT, and etc) // operand to be used in a failure message. The type (but not value) // of the other operand may affect the format. This allows us to // print a char* as a raw pointer when it is compared against another // char*, and print it as a C string when it is compared against an // std::string object, for example. // // The default implementation ignores the type of the other operand. // Some specialized versions are used to handle formatting wide or // narrow C strings. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. template String FormatForComparisonFailureMessage(const T1& value, const T2& /* other_operand */) { // C++Builder compiles this incorrectly if the namespace isn't explicitly // given. return ::testing::PrintToString(value); } // The helper function for {ASSERT|EXPECT}_EQ. template AssertionResult CmpHelperEQ(const char* expected_expression, const char* actual_expression, const T1& expected, const T2& actual) { #ifdef _MSC_VER # pragma warning(push) // Saves the current warning state. # pragma warning(disable:4389) // Temporarily disables warning on // signed/unsigned mismatch. #endif if (expected == actual) { return AssertionSuccess(); } #ifdef _MSC_VER # pragma warning(pop) // Restores the warning state. #endif return EqFailure(expected_expression, actual_expression, FormatForComparisonFailureMessage(expected, actual), FormatForComparisonFailureMessage(actual, expected), false); } // With this overloaded version, we allow anonymous enums to be used // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous enums // can be implicitly cast to BiggestInt. GTEST_API_ AssertionResult CmpHelperEQ(const char* expected_expression, const char* actual_expression, BiggestInt expected, BiggestInt actual); // The helper class for {ASSERT|EXPECT}_EQ. The template argument // lhs_is_null_literal is true iff the first argument to ASSERT_EQ() // is a null pointer literal. The following default implementation is // for lhs_is_null_literal being false. template class EqHelper { public: // This templatized version is for the general case. template static AssertionResult Compare(const char* expected_expression, const char* actual_expression, const T1& expected, const T2& actual) { return CmpHelperEQ(expected_expression, actual_expression, expected, actual); } // With this overloaded version, we allow anonymous enums to be used // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous // enums can be implicitly cast to BiggestInt. // // Even though its body looks the same as the above version, we // cannot merge the two, as it will make anonymous enums unhappy. static AssertionResult Compare(const char* expected_expression, const char* actual_expression, BiggestInt expected, BiggestInt actual) { return CmpHelperEQ(expected_expression, actual_expression, expected, actual); } }; // This specialization is used when the first argument to ASSERT_EQ() // is a null pointer literal, like NULL, false, or 0. template <> class EqHelper { public: // We define two overloaded versions of Compare(). The first // version will be picked when the second argument to ASSERT_EQ() is // NOT a pointer, e.g. ASSERT_EQ(0, AnIntFunction()) or // EXPECT_EQ(false, a_bool). template static AssertionResult Compare( const char* expected_expression, const char* actual_expression, const T1& expected, const T2& actual, // The following line prevents this overload from being considered if T2 // is not a pointer type. We need this because ASSERT_EQ(NULL, my_ptr) // expands to Compare("", "", NULL, my_ptr), which requires a conversion // to match the Secret* in the other overload, which would otherwise make // this template match better. typename EnableIf::value>::type* = 0) { return CmpHelperEQ(expected_expression, actual_expression, expected, actual); } // This version will be picked when the second argument to ASSERT_EQ() is a // pointer, e.g. ASSERT_EQ(NULL, a_pointer). template static AssertionResult Compare( const char* expected_expression, const char* actual_expression, // We used to have a second template parameter instead of Secret*. That // template parameter would deduce to 'long', making this a better match // than the first overload even without the first overload's EnableIf. // Unfortunately, gcc with -Wconversion-null warns when "passing NULL to // non-pointer argument" (even a deduced integral argument), so the old // implementation caused warnings in user code. Secret* /* expected (NULL) */, T* actual) { // We already know that 'expected' is a null pointer. return CmpHelperEQ(expected_expression, actual_expression, static_cast(NULL), actual); } }; // A macro for implementing the helper functions needed to implement // ASSERT_?? and EXPECT_??. It is here just to avoid copy-and-paste // of similar code. // // For each templatized helper function, we also define an overloaded // version for BiggestInt in order to reduce code bloat and allow // anonymous enums to be used with {ASSERT|EXPECT}_?? when compiled // with gcc 4. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. #define GTEST_IMPL_CMP_HELPER_(op_name, op)\ template \ AssertionResult CmpHelper##op_name(const char* expr1, const char* expr2, \ const T1& val1, const T2& val2) {\ if (val1 op val2) {\ return AssertionSuccess();\ } else {\ return AssertionFailure() \ << "Expected: (" << expr1 << ") " #op " (" << expr2\ << "), actual: " << FormatForComparisonFailureMessage(val1, val2)\ << " vs " << FormatForComparisonFailureMessage(val2, val1);\ }\ }\ GTEST_API_ AssertionResult CmpHelper##op_name(\ const char* expr1, const char* expr2, BiggestInt val1, BiggestInt val2) // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. // Implements the helper function for {ASSERT|EXPECT}_NE GTEST_IMPL_CMP_HELPER_(NE, !=); // Implements the helper function for {ASSERT|EXPECT}_LE GTEST_IMPL_CMP_HELPER_(LE, <=); // Implements the helper function for {ASSERT|EXPECT}_LT GTEST_IMPL_CMP_HELPER_(LT, < ); // Implements the helper function for {ASSERT|EXPECT}_GE GTEST_IMPL_CMP_HELPER_(GE, >=); // Implements the helper function for {ASSERT|EXPECT}_GT GTEST_IMPL_CMP_HELPER_(GT, > ); #undef GTEST_IMPL_CMP_HELPER_ // The helper function for {ASSERT|EXPECT}_STREQ. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTREQ(const char* expected_expression, const char* actual_expression, const char* expected, const char* actual); // The helper function for {ASSERT|EXPECT}_STRCASEEQ. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTRCASEEQ(const char* expected_expression, const char* actual_expression, const char* expected, const char* actual); // The helper function for {ASSERT|EXPECT}_STRNE. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTRNE(const char* s1_expression, const char* s2_expression, const char* s1, const char* s2); // The helper function for {ASSERT|EXPECT}_STRCASENE. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTRCASENE(const char* s1_expression, const char* s2_expression, const char* s1, const char* s2); // Helper function for *_STREQ on wide strings. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTREQ(const char* expected_expression, const char* actual_expression, const wchar_t* expected, const wchar_t* actual); // Helper function for *_STRNE on wide strings. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult CmpHelperSTRNE(const char* s1_expression, const char* s2_expression, const wchar_t* s1, const wchar_t* s2); } // namespace internal // IsSubstring() and IsNotSubstring() are intended to be used as the // first argument to {EXPECT,ASSERT}_PRED_FORMAT2(), not by // themselves. They check whether needle is a substring of haystack // (NULL is considered a substring of itself only), and return an // appropriate error message when they fail. // // The {needle,haystack}_expr arguments are the stringified // expressions that generated the two real arguments. GTEST_API_ AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const char* needle, const char* haystack); GTEST_API_ AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const wchar_t* needle, const wchar_t* haystack); GTEST_API_ AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const char* needle, const char* haystack); GTEST_API_ AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const wchar_t* needle, const wchar_t* haystack); GTEST_API_ AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const ::std::string& needle, const ::std::string& haystack); GTEST_API_ AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const ::std::string& needle, const ::std::string& haystack); #if GTEST_HAS_STD_WSTRING GTEST_API_ AssertionResult IsSubstring( const char* needle_expr, const char* haystack_expr, const ::std::wstring& needle, const ::std::wstring& haystack); GTEST_API_ AssertionResult IsNotSubstring( const char* needle_expr, const char* haystack_expr, const ::std::wstring& needle, const ::std::wstring& haystack); #endif // GTEST_HAS_STD_WSTRING namespace internal { // Helper template function for comparing floating-points. // // Template parameter: // // RawType: the raw floating-point type (either float or double) // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. template AssertionResult CmpHelperFloatingPointEQ(const char* expected_expression, const char* actual_expression, RawType expected, RawType actual) { const FloatingPoint lhs(expected), rhs(actual); if (lhs.AlmostEquals(rhs)) { return AssertionSuccess(); } ::std::stringstream expected_ss; expected_ss << std::setprecision(std::numeric_limits::digits10 + 2) << expected; ::std::stringstream actual_ss; actual_ss << std::setprecision(std::numeric_limits::digits10 + 2) << actual; return EqFailure(expected_expression, actual_expression, StringStreamToString(&expected_ss), StringStreamToString(&actual_ss), false); } // Helper function for implementing ASSERT_NEAR. // // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM. GTEST_API_ AssertionResult DoubleNearPredFormat(const char* expr1, const char* expr2, const char* abs_error_expr, double val1, double val2, double abs_error); // INTERNAL IMPLEMENTATION - DO NOT USE IN USER CODE. // A class that enables one to stream messages to assertion macros class GTEST_API_ AssertHelper { public: // Constructor. AssertHelper(TestPartResult::Type type, const char* file, int line, const char* message); ~AssertHelper(); // Message assignment is a semantic trick to enable assertion // streaming; see the GTEST_MESSAGE_ macro below. void operator=(const Message& message) const; private: // We put our data in a struct so that the size of the AssertHelper class can // be as small as possible. This is important because gcc is incapable of // re-using stack space even for temporary variables, so every EXPECT_EQ // reserves stack space for another AssertHelper. struct AssertHelperData { AssertHelperData(TestPartResult::Type t, const char* srcfile, int line_num, const char* msg) : type(t), file(srcfile), line(line_num), message(msg) { } TestPartResult::Type const type; const char* const file; int const line; String const message; private: GTEST_DISALLOW_COPY_AND_ASSIGN_(AssertHelperData); }; AssertHelperData* const data_; GTEST_DISALLOW_COPY_AND_ASSIGN_(AssertHelper); }; } // namespace internal #if GTEST_HAS_PARAM_TEST // The pure interface class that all value-parameterized tests inherit from. // A value-parameterized class must inherit from both ::testing::Test and // ::testing::WithParamInterface. In most cases that just means inheriting // from ::testing::TestWithParam, but more complicated test hierarchies // may need to inherit from Test and WithParamInterface at different levels. // // This interface has support for accessing the test parameter value via // the GetParam() method. // // Use it with one of the parameter generator defining functions, like Range(), // Values(), ValuesIn(), Bool(), and Combine(). // // class FooTest : public ::testing::TestWithParam { // protected: // FooTest() { // // Can use GetParam() here. // } // virtual ~FooTest() { // // Can use GetParam() here. // } // virtual void SetUp() { // // Can use GetParam() here. // } // virtual void TearDown { // // Can use GetParam() here. // } // }; // TEST_P(FooTest, DoesBar) { // // Can use GetParam() method here. // Foo foo; // ASSERT_TRUE(foo.DoesBar(GetParam())); // } // INSTANTIATE_TEST_CASE_P(OneToTenRange, FooTest, ::testing::Range(1, 10)); template class WithParamInterface { public: typedef T ParamType; virtual ~WithParamInterface() {} // The current parameter value. Is also available in the test fixture's // constructor. This member function is non-static, even though it only // references static data, to reduce the opportunity for incorrect uses // like writing 'WithParamInterface::GetParam()' for a test that // uses a fixture whose parameter type is int. const ParamType& GetParam() const { return *parameter_; } private: // Sets parameter value. The caller is responsible for making sure the value // remains alive and unchanged throughout the current test. static void SetParam(const ParamType* parameter) { parameter_ = parameter; } // Static value used for accessing parameter during a test lifetime. static const ParamType* parameter_; // TestClass must be a subclass of WithParamInterface and Test. template friend class internal::ParameterizedTestFactory; }; template const T* WithParamInterface::parameter_ = NULL; // Most value-parameterized classes can ignore the existence of // WithParamInterface, and can just inherit from ::testing::TestWithParam. template class TestWithParam : public Test, public WithParamInterface { }; #endif // GTEST_HAS_PARAM_TEST // Macros for indicating success/failure in test code. // ADD_FAILURE unconditionally adds a failure to the current test. // SUCCEED generates a success - it doesn't automatically make the // current test successful, as a test is only successful when it has // no failure. // // EXPECT_* verifies that a certain condition is satisfied. If not, // it behaves like ADD_FAILURE. In particular: // // EXPECT_TRUE verifies that a Boolean condition is true. // EXPECT_FALSE verifies that a Boolean condition is false. // // FAIL and ASSERT_* are similar to ADD_FAILURE and EXPECT_*, except // that they will also abort the current function on failure. People // usually want the fail-fast behavior of FAIL and ASSERT_*, but those // writing data-driven tests often find themselves using ADD_FAILURE // and EXPECT_* more. // // Examples: // // EXPECT_TRUE(server.StatusIsOK()); // ASSERT_FALSE(server.HasPendingRequest(port)) // << "There are still pending requests " << "on port " << port; // Generates a nonfatal failure with a generic message. #define ADD_FAILURE() GTEST_NONFATAL_FAILURE_("Failed") // Generates a nonfatal failure at the given source file location with // a generic message. #define ADD_FAILURE_AT(file, line) \ GTEST_MESSAGE_AT_(file, line, "Failed", \ ::testing::TestPartResult::kNonFatalFailure) // Generates a fatal failure with a generic message. #define GTEST_FAIL() GTEST_FATAL_FAILURE_("Failed") // Define this macro to 1 to omit the definition of FAIL(), which is a // generic name and clashes with some other libraries. #if !GTEST_DONT_DEFINE_FAIL # define FAIL() GTEST_FAIL() #endif // Generates a success with a generic message. #define GTEST_SUCCEED() GTEST_SUCCESS_("Succeeded") // Define this macro to 1 to omit the definition of SUCCEED(), which // is a generic name and clashes with some other libraries. #if !GTEST_DONT_DEFINE_SUCCEED # define SUCCEED() GTEST_SUCCEED() #endif // Macros for testing exceptions. // // * {ASSERT|EXPECT}_THROW(statement, expected_exception): // Tests that the statement throws the expected exception. // * {ASSERT|EXPECT}_NO_THROW(statement): // Tests that the statement doesn't throw any exception. // * {ASSERT|EXPECT}_ANY_THROW(statement): // Tests that the statement throws an exception. #define EXPECT_THROW(statement, expected_exception) \ GTEST_TEST_THROW_(statement, expected_exception, GTEST_NONFATAL_FAILURE_) #define EXPECT_NO_THROW(statement) \ GTEST_TEST_NO_THROW_(statement, GTEST_NONFATAL_FAILURE_) #define EXPECT_ANY_THROW(statement) \ GTEST_TEST_ANY_THROW_(statement, GTEST_NONFATAL_FAILURE_) #define ASSERT_THROW(statement, expected_exception) \ GTEST_TEST_THROW_(statement, expected_exception, GTEST_FATAL_FAILURE_) #define ASSERT_NO_THROW(statement) \ GTEST_TEST_NO_THROW_(statement, GTEST_FATAL_FAILURE_) #define ASSERT_ANY_THROW(statement) \ GTEST_TEST_ANY_THROW_(statement, GTEST_FATAL_FAILURE_) // Boolean assertions. Condition can be either a Boolean expression or an // AssertionResult. For more information on how to use AssertionResult with // these macros see comments on that class. #define EXPECT_TRUE(condition) \ GTEST_TEST_BOOLEAN_(condition, #condition, false, true, \ GTEST_NONFATAL_FAILURE_) #define EXPECT_FALSE(condition) \ GTEST_TEST_BOOLEAN_(!(condition), #condition, true, false, \ GTEST_NONFATAL_FAILURE_) #define ASSERT_TRUE(condition) \ GTEST_TEST_BOOLEAN_(condition, #condition, false, true, \ GTEST_FATAL_FAILURE_) #define ASSERT_FALSE(condition) \ GTEST_TEST_BOOLEAN_(!(condition), #condition, true, false, \ GTEST_FATAL_FAILURE_) // Includes the auto-generated header that implements a family of // generic predicate assertion macros. // Copyright 2006, Google Inc. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following disclaimer // in the documentation and/or other materials provided with the // distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived from // this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // This file is AUTOMATICALLY GENERATED on 09/24/2010 by command // 'gen_gtest_pred_impl.py 5'. DO NOT EDIT BY HAND! // // Implements a family of generic predicate assertion macros. #ifndef GTEST_INCLUDE_GTEST_GTEST_PRED_IMPL_H_ #define GTEST_INCLUDE_GTEST_GTEST_PRED_IMPL_H_ // Makes sure this header is not included before gtest.h. #ifndef GTEST_INCLUDE_GTEST_GTEST_H_ # error Do not include gtest_pred_impl.h directly. Include gtest.h instead. #endif // GTEST_INCLUDE_GTEST_GTEST_H_ // This header implements a family of generic predicate assertion // macros: // // ASSERT_PRED_FORMAT1(pred_format, v1) // ASSERT_PRED_FORMAT2(pred_format, v1, v2) // ... // // where pred_format is a function or functor that takes n (in the // case of ASSERT_PRED_FORMATn) values and their source expression // text, and returns a testing::AssertionResult. See the definition // of ASSERT_EQ in gtest.h for an example. // // If you don't care about formatting, you can use the more // restrictive version: // // ASSERT_PRED1(pred, v1) // ASSERT_PRED2(pred, v1, v2) // ... // // where pred is an n-ary function or functor that returns bool, // and the values v1, v2, ..., must support the << operator for // streaming to std::ostream. // // We also define the EXPECT_* variations. // // For now we only support predicates whose arity is at most 5. // Please email googletestframework@googlegroups.com if you need // support for higher arities. // GTEST_ASSERT_ is the basic statement to which all of the assertions // in this file reduce. Don't use this in your code. #define GTEST_ASSERT_(expression, on_failure) \ GTEST_AMBIGUOUS_ELSE_BLOCKER_ \ if (const ::testing::AssertionResult gtest_ar = (expression)) \ ; \ else \ on_failure(gtest_ar.failure_message()) // Helper function for implementing {EXPECT|ASSERT}_PRED1. Don't use // this in your code. template AssertionResult AssertPred1Helper(const char* pred_text, const char* e1, Pred pred, const T1& v1) { if (pred(v1)) return AssertionSuccess(); return AssertionFailure() << pred_text << "(" << e1 << ") evaluates to false, where" << "\n" << e1 << " evaluates to " << v1; } // Internal macro for implementing {EXPECT|ASSERT}_PRED_FORMAT1. // Don't use this in your code. #define GTEST_PRED_FORMAT1_(pred_format, v1, on_failure)\ GTEST_ASSERT_(pred_format(#v1, v1),\ on_failure) // Internal macro for implementing {EXPECT|ASSERT}_PRED1. Don't use // this in your code. #define GTEST_PRED1_(pred, v1, on_failure)\ GTEST_ASSERT_(::testing::AssertPred1Helper(#pred, \ #v1, \ pred, \ v1), on_failure) // Unary predicate assertion macros. #define EXPECT_PRED_FORMAT1(pred_format, v1) \ GTEST_PRED_FORMAT1_(pred_format, v1, GTEST_NONFATAL_FAILURE_) #define EXPECT_PRED1(pred, v1) \ GTEST_PRED1_(pred, v1, GTEST_NONFATAL_FAILURE_) #define ASSERT_PRED_FORMAT1(pred_format, v1) \ GTEST_PRED_FORMAT1_(pred_format, v1, GTEST_FATAL_FAILURE_) #define ASSERT_PRED1(pred, v1) \ GTEST_PRED1_(pred, v1, GTEST_FATAL_FAILURE_) // Helper function for implementing {EXPECT|ASSERT}_PRED2. Don't use // this in your code. template AssertionResult AssertPred2Helper(const char* pred_text, const char* e1, const char* e2, Pred pred, const T1& v1, const T2& v2) { if (pred(v1, v2)) return AssertionSuccess(); return AssertionFailure() << pred_text << "(" << e1 << ", " << e2 << ") evaluates to false, where" << "\n" << e1 << " evaluates to " << v1 << "\n" << e2 << " evaluates to " << v2; } // Internal macro for implementing {EXPECT|ASSERT}_PRED_FORMAT2. // Don't use this in your code. #define GTEST_PRED_FORMAT2_(pred_format, v1, v2, on_failure)\ GTEST_ASSERT_(pred_format(#v1, #v2, v1, v2),\ on_failure) // Internal macro for implementing {EXPECT|ASSERT}_PRED2. Don't use // this in your code. #define GTEST_PRED2_(pred, v1, v2, on_failure)\ GTEST_ASSERT_(::testing::AssertPred2Helper(#pred, \ #v1, \ #v2, \ pred, \ v1, \ v2), on_failure) // Binary predicate assertion macros. #define EXPECT_PRED_FORMAT2(pred_format, v1, v2) \ GTEST_PRED_FORMAT2_(pred_format, v1, v2, GTEST_NONFATAL_FAILURE_) #define EXPECT_PRED2(pred, v1, v2) \ GTEST_PRED2_(pred, v1, v2, GTEST_NONFATAL_FAILURE_) #define ASSERT_PRED_FORMAT2(pred_format, v1, v2) \ GTEST_PRED_FORMAT2_(pred_format, v1, v2, GTEST_FATAL_FAILURE_) #define ASSERT_PRED2(pred, v1, v2) \ GTEST_PRED2_(pred, v1, v2, GTEST_FATAL_FAILURE_) // Helper function for implementing {EXPECT|ASSERT}_PRED3. Don't use // this in your code. template AssertionResult AssertPred3Helper(const char* pred_text, const char* e1, const char* e2, const char* e3, Pred pred, const T1& v1, const T2& v2, const T3& v3) { if (pred(v1, v2, v3)) return AssertionSuccess(); return AssertionFailure() << pred_text << "(" << e1 << ", " << e2 << ", " << e3 << ") evaluates to false, where" << "\n" << e1 << " evaluates to " << v1 << "\n" << e2 << " evaluates to " << v2 << "\n" << e3 << " evaluates to " << v3; } // Internal macro for implementing {EXPECT|ASSERT}_PRED_FORMAT3. // Don't use this in your code. #define GTEST_PRED_FORMAT3_(pred_format, v1, v2, v3, on_failure)\ GTEST_ASSERT_(pred_format(#v1, #v2, #v3, v1, v2, v3),\ on_failure) // Internal macro for implementing {EXPECT|ASSERT}_PRED3. Don't use // this in your code. #define GTEST_PRED3_(pred, v1, v2, v3, on_failure)\ GTEST_ASSERT_(::testing::AssertPred3Helper(#pred, \ #v1, \ #v2, \ #v3, \ pred, \ v1, \ v2, \ v3), on_failure) // Ternary predicate assertion macros. #define EXPECT_PRED_FORMAT3(pred_format, v1, v2, v3) \ GTEST_PRED_FORMAT3_(pred_format, v1, v2, v3, GTEST_NONFATAL_FAILURE_) #define EXPECT_PRED3(pred, v1, v2, v3) \ GTEST_PRED3_(pred, v1, v2, v3, GTEST_NONFATAL_FAILURE_) #define ASSERT_PRED_FORMAT3(pred_format, v1, v2, v3) \ GTEST_PRED_FORMAT3_(pred_format, v1, v2, v3, GTEST_FATAL_FAILURE_) #define ASSERT_PRED3(pred, v1, v2, v3) \ GTEST_PRED3_(pred, v1, v2, v3, GTEST_FATAL_FAILURE_) // Helper function for implementing {EXPECT|ASSERT}_PRED4. Don't use // this in your code. template AssertionResult AssertPred4Helper(const char* pred_text, const char* e1, const char* e2, const char* e3, const char* e4, Pred pred, const T1& v1, const T2& v2, const T3& v3, const T4& v4) { if (pred(v1, v2, v3, v4)) return AssertionSuccess(); return AssertionFailure() << pred_text << "(" << e1 << ", " << e2 << ", " << e3 << ", " << e4 << ") evaluates to false, where" << "\n" << e1 << " evaluates to " << v1 << "\n" << e2 << " evaluates to " << v2 << "\n" << e3 << " evaluates to " << v3 << "\n" << e4 << " evaluates to " << v4; } // Internal macro for implementing {EXPECT|ASSERT}_PRED_FORMAT4. // Don't use this in your code. #define GTEST_PRED_FORMAT4_(pred_format, v1, v2, v3, v4, on_failure)\ GTEST_ASSERT_(pred_format(#v1, #v2, #v3, #v4, v1, v2, v3, v4),\ on_failure) // Internal macro for implementing {EXPECT|ASSERT}_PRED4. Don't use // this in your code. #define GTEST_PRED4_(pred, v1, v2, v3, v4, on_failure)\ GTEST_ASSERT_(::testing::AssertPred4Helper(#pred, \ #v1, \ #v2, \ #v3, \ #v4, \ pred, \ v1, \ v2, \ v3, \ v4), on_failure) // 4-ary predicate assertion macros. #define EXPECT_PRED_FORMAT4(pred_format, v1, v2, v3, v4) \ GTEST_PRED_FORMAT4_(pred_format, v1, v2, v3, v4, GTEST_NONFATAL_FAILURE_) #define EXPECT_PRED4(pred, v1, v2, v3, v4) \ GTEST_PRED4_(pred, v1, v2, v3, v4, GTEST_NONFATAL_FAILURE_) #define ASSERT_PRED_FORMAT4(pred_format, v1, v2, v3, v4) \ GTEST_PRED_FORMAT4_(pred_format, v1, v2, v3, v4, GTEST_FATAL_FAILURE_) #define ASSERT_PRED4(pred, v1, v2, v3, v4) \ GTEST_PRED4_(pred, v1, v2, v3, v4, GTEST_FATAL_FAILURE_) // Helper function for implementing {EXPECT|ASSERT}_PRED5. Don't use // this in your code. template AssertionResult AssertPred5Helper(const char* pred_text, const char* e1, const char* e2, const char* e3, const char* e4, const char* e5, Pred pred, const T1& v1, const T2& v2, const T3& v3, const T4& v4, const T5& v5) { if (pred(v1, v2, v3, v4, v5)) return AssertionSuccess(); return AssertionFailure() << pred_text << "(" << e1 << ", " << e2 << ", " << e3 << ", " << e4 << ", " << e5 << ") evaluates to false, where" << "\n" << e1 << " evaluates to " << v1 << "\n" << e2 << " evaluates to " << v2 << "\n" << e3 << " evaluates to " << v3 << "\n" << e4 << " evaluates to " << v4 << "\n" << e5 << " evaluates to " << v5; } // Internal macro for implementing {EXPECT|ASSERT}_PRED_FORMAT5. // Don't use this in your code. #define GTEST_PRED_FORMAT5_(pred_format, v1, v2, v3, v4, v5, on_failure)\ GTEST_ASSERT_(pred_format(#v1, #v2, #v3, #v4, #v5, v1, v2, v3, v4, v5),\ on_failure) // Internal macro for implementing {EXPECT|ASSERT}_PRED5. Don't use // this in your code. #define GTEST_PRED5_(pred, v1, v2, v3, v4, v5, on_failure)\ GTEST_ASSERT_(::testing::AssertPred5Helper(#pred, \ #v1, \ #v2, \ #v3, \ #v4, \ #v5, \ pred, \ v1, \ v2, \ v3, \ v4, \ v5), on_failure) // 5-ary predicate assertion macros. #define EXPECT_PRED_FORMAT5(pred_format, v1, v2, v3, v4, v5) \ GTEST_PRED_FORMAT5_(pred_format, v1, v2, v3, v4, v5, GTEST_NONFATAL_FAILURE_) #define EXPECT_PRED5(pred, v1, v2, v3, v4, v5) \ GTEST_PRED5_(pred, v1, v2, v3, v4, v5, GTEST_NONFATAL_FAILURE_) #define ASSERT_PRED_FORMAT5(pred_format, v1, v2, v3, v4, v5) \ GTEST_PRED_FORMAT5_(pred_format, v1, v2, v3, v4, v5, GTEST_FATAL_FAILURE_) #define ASSERT_PRED5(pred, v1, v2, v3, v4, v5) \ GTEST_PRED5_(pred, v1, v2, v3, v4, v5, GTEST_FATAL_FAILURE_) #endif // GTEST_INCLUDE_GTEST_GTEST_PRED_IMPL_H_ // Macros for testing equalities and inequalities. // // * {ASSERT|EXPECT}_EQ(expected, actual): Tests that expected == actual // * {ASSERT|EXPECT}_NE(v1, v2): Tests that v1 != v2 // * {ASSERT|EXPECT}_LT(v1, v2): Tests that v1 < v2 // * {ASSERT|EXPECT}_LE(v1, v2): Tests that v1 <= v2 // * {ASSERT|EXPECT}_GT(v1, v2): Tests that v1 > v2 // * {ASSERT|EXPECT}_GE(v1, v2): Tests that v1 >= v2 // // When they are not, Google Test prints both the tested expressions and // their actual values. The values must be compatible built-in types, // or you will get a compiler error. By "compatible" we mean that the // values can be compared by the respective operator. // // Note: // // 1. It is possible to make a user-defined type work with // {ASSERT|EXPECT}_??(), but that requires overloading the // comparison operators and is thus discouraged by the Google C++ // Usage Guide. Therefore, you are advised to use the // {ASSERT|EXPECT}_TRUE() macro to assert that two objects are // equal. // // 2. The {ASSERT|EXPECT}_??() macros do pointer comparisons on // pointers (in particular, C strings). Therefore, if you use it // with two C strings, you are testing how their locations in memory // are related, not how their content is related. To compare two C // strings by content, use {ASSERT|EXPECT}_STR*(). // // 3. {ASSERT|EXPECT}_EQ(expected, actual) is preferred to // {ASSERT|EXPECT}_TRUE(expected == actual), as the former tells you // what the actual value is when it fails, and similarly for the // other comparisons. // // 4. Do not depend on the order in which {ASSERT|EXPECT}_??() // evaluate their arguments, which is undefined. // // 5. These macros evaluate their arguments exactly once. // // Examples: // // EXPECT_NE(5, Foo()); // EXPECT_EQ(NULL, a_pointer); // ASSERT_LT(i, array_size); // ASSERT_GT(records.size(), 0) << "There is no record left."; #define EXPECT_EQ(expected, actual) \ EXPECT_PRED_FORMAT2(::testing::internal:: \ EqHelper::Compare, \ expected, actual) #define EXPECT_NE(expected, actual) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperNE, expected, actual) #define EXPECT_LE(val1, val2) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperLE, val1, val2) #define EXPECT_LT(val1, val2) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperLT, val1, val2) #define EXPECT_GE(val1, val2) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperGE, val1, val2) #define EXPECT_GT(val1, val2) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperGT, val1, val2) #define GTEST_ASSERT_EQ(expected, actual) \ ASSERT_PRED_FORMAT2(::testing::internal:: \ EqHelper::Compare, \ expected, actual) #define GTEST_ASSERT_NE(val1, val2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperNE, val1, val2) #define GTEST_ASSERT_LE(val1, val2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperLE, val1, val2) #define GTEST_ASSERT_LT(val1, val2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperLT, val1, val2) #define GTEST_ASSERT_GE(val1, val2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperGE, val1, val2) #define GTEST_ASSERT_GT(val1, val2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperGT, val1, val2) // Define macro GTEST_DONT_DEFINE_ASSERT_XY to 1 to omit the definition of // ASSERT_XY(), which clashes with some users' own code. #if !GTEST_DONT_DEFINE_ASSERT_EQ # define ASSERT_EQ(val1, val2) GTEST_ASSERT_EQ(val1, val2) #endif #if !GTEST_DONT_DEFINE_ASSERT_NE # define ASSERT_NE(val1, val2) GTEST_ASSERT_NE(val1, val2) #endif #if !GTEST_DONT_DEFINE_ASSERT_LE # define ASSERT_LE(val1, val2) GTEST_ASSERT_LE(val1, val2) #endif #if !GTEST_DONT_DEFINE_ASSERT_LT # define ASSERT_LT(val1, val2) GTEST_ASSERT_LT(val1, val2) #endif #if !GTEST_DONT_DEFINE_ASSERT_GE # define ASSERT_GE(val1, val2) GTEST_ASSERT_GE(val1, val2) #endif #if !GTEST_DONT_DEFINE_ASSERT_GT # define ASSERT_GT(val1, val2) GTEST_ASSERT_GT(val1, val2) #endif // C String Comparisons. All tests treat NULL and any non-NULL string // as different. Two NULLs are equal. // // * {ASSERT|EXPECT}_STREQ(s1, s2): Tests that s1 == s2 // * {ASSERT|EXPECT}_STRNE(s1, s2): Tests that s1 != s2 // * {ASSERT|EXPECT}_STRCASEEQ(s1, s2): Tests that s1 == s2, ignoring case // * {ASSERT|EXPECT}_STRCASENE(s1, s2): Tests that s1 != s2, ignoring case // // For wide or narrow string objects, you can use the // {ASSERT|EXPECT}_??() macros. // // Don't depend on the order in which the arguments are evaluated, // which is undefined. // // These macros evaluate their arguments exactly once. #define EXPECT_STREQ(expected, actual) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperSTREQ, expected, actual) #define EXPECT_STRNE(s1, s2) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperSTRNE, s1, s2) #define EXPECT_STRCASEEQ(expected, actual) \ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperSTRCASEEQ, expected, actual) #define EXPECT_STRCASENE(s1, s2)\ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperSTRCASENE, s1, s2) #define ASSERT_STREQ(expected, actual) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperSTREQ, expected, actual) #define ASSERT_STRNE(s1, s2) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperSTRNE, s1, s2) #define ASSERT_STRCASEEQ(expected, actual) \ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperSTRCASEEQ, expected, actual) #define ASSERT_STRCASENE(s1, s2)\ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperSTRCASENE, s1, s2) // Macros for comparing floating-point numbers. // // * {ASSERT|EXPECT}_FLOAT_EQ(expected, actual): // Tests that two float values are almost equal. // * {ASSERT|EXPECT}_DOUBLE_EQ(expected, actual): // Tests that two double values are almost equal. // * {ASSERT|EXPECT}_NEAR(v1, v2, abs_error): // Tests that v1 and v2 are within the given distance to each other. // // Google Test uses ULP-based comparison to automatically pick a default // error bound that is appropriate for the operands. See the // FloatingPoint template class in gtest-internal.h if you are // interested in the implementation details. #define EXPECT_FLOAT_EQ(expected, actual)\ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperFloatingPointEQ, \ expected, actual) #define EXPECT_DOUBLE_EQ(expected, actual)\ EXPECT_PRED_FORMAT2(::testing::internal::CmpHelperFloatingPointEQ, \ expected, actual) #define ASSERT_FLOAT_EQ(expected, actual)\ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperFloatingPointEQ, \ expected, actual) #define ASSERT_DOUBLE_EQ(expected, actual)\ ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperFloatingPointEQ, \ expected, actual) #define EXPECT_NEAR(val1, val2, abs_error)\ EXPECT_PRED_FORMAT3(::testing::internal::DoubleNearPredFormat, \ val1, val2, abs_error) #define ASSERT_NEAR(val1, val2, abs_error)\ ASSERT_PRED_FORMAT3(::testing::internal::DoubleNearPredFormat, \ val1, val2, abs_error) // These predicate format functions work on floating-point values, and // can be used in {ASSERT|EXPECT}_PRED_FORMAT2*(), e.g. // // EXPECT_PRED_FORMAT2(testing::DoubleLE, Foo(), 5.0); // Asserts that val1 is less than, or almost equal to, val2. Fails // otherwise. In particular, it fails if either val1 or val2 is NaN. GTEST_API_ AssertionResult FloatLE(const char* expr1, const char* expr2, float val1, float val2); GTEST_API_ AssertionResult DoubleLE(const char* expr1, const char* expr2, double val1, double val2); #if GTEST_OS_WINDOWS // Macros that test for HRESULT failure and success, these are only useful // on Windows, and rely on Windows SDK macros and APIs to compile. // // * {ASSERT|EXPECT}_HRESULT_{SUCCEEDED|FAILED}(expr) // // When expr unexpectedly fails or succeeds, Google Test prints the // expected result and the actual result with both a human-readable // string representation of the error, if available, as well as the // hex result code. # define EXPECT_HRESULT_SUCCEEDED(expr) \ EXPECT_PRED_FORMAT1(::testing::internal::IsHRESULTSuccess, (expr)) # define ASSERT_HRESULT_SUCCEEDED(expr) \ ASSERT_PRED_FORMAT1(::testing::internal::IsHRESULTSuccess, (expr)) # define EXPECT_HRESULT_FAILED(expr) \ EXPECT_PRED_FORMAT1(::testing::internal::IsHRESULTFailure, (expr)) # define ASSERT_HRESULT_FAILED(expr) \ ASSERT_PRED_FORMAT1(::testing::internal::IsHRESULTFailure, (expr)) #endif // GTEST_OS_WINDOWS // Macros that execute statement and check that it doesn't generate new fatal // failures in the current thread. // // * {ASSERT|EXPECT}_NO_FATAL_FAILURE(statement); // // Examples: // // EXPECT_NO_FATAL_FAILURE(Process()); // ASSERT_NO_FATAL_FAILURE(Process()) << "Process() failed"; // #define ASSERT_NO_FATAL_FAILURE(statement) \ GTEST_TEST_NO_FATAL_FAILURE_(statement, GTEST_FATAL_FAILURE_) #define EXPECT_NO_FATAL_FAILURE(statement) \ GTEST_TEST_NO_FATAL_FAILURE_(statement, GTEST_NONFATAL_FAILURE_) // Causes a trace (including the source file path, the current line // number, and the given message) to be included in every test failure // message generated by code in the current scope. The effect is // undone when the control leaves the current scope. // // The message argument can be anything streamable to std::ostream. // // In the implementation, we include the current line number as part // of the dummy variable name, thus allowing multiple SCOPED_TRACE()s // to appear in the same block - as long as they are on different // lines. #define SCOPED_TRACE(message) \ ::testing::internal::ScopedTrace GTEST_CONCAT_TOKEN_(gtest_trace_, __LINE__)(\ __FILE__, __LINE__, ::testing::Message() << (message)) // Compile-time assertion for type equality. // StaticAssertTypeEq() compiles iff type1 and type2 are // the same type. The value it returns is not interesting. // // Instead of making StaticAssertTypeEq a class template, we make it a // function template that invokes a helper class template. This // prevents a user from misusing StaticAssertTypeEq by // defining objects of that type. // // CAVEAT: // // When used inside a method of a class template, // StaticAssertTypeEq() is effective ONLY IF the method is // instantiated. For example, given: // // template class Foo { // public: // void Bar() { testing::StaticAssertTypeEq(); } // }; // // the code: // // void Test1() { Foo foo; } // // will NOT generate a compiler error, as Foo::Bar() is never // actually instantiated. Instead, you need: // // void Test2() { Foo foo; foo.Bar(); } // // to cause a compiler error. template bool StaticAssertTypeEq() { (void)internal::StaticAssertTypeEqHelper(); return true; } // Defines a test. // // The first parameter is the name of the test case, and the second // parameter is the name of the test within the test case. // // The convention is to end the test case name with "Test". For // example, a test case for the Foo class can be named FooTest. // // The user should put his test code between braces after using this // macro. Example: // // TEST(FooTest, InitializesCorrectly) { // Foo foo; // EXPECT_TRUE(foo.StatusIsOK()); // } // Note that we call GetTestTypeId() instead of GetTypeId< // ::testing::Test>() here to get the type ID of testing::Test. This // is to work around a suspected linker bug when using Google Test as // a framework on Mac OS X. The bug causes GetTypeId< // ::testing::Test>() to return different values depending on whether // the call is from the Google Test framework itself or from user test // code. GetTestTypeId() is guaranteed to always return the same // value, as it always calls GetTypeId<>() from the Google Test // framework. #define GTEST_TEST(test_case_name, test_name)\ GTEST_TEST_(test_case_name, test_name, \ ::testing::Test, ::testing::internal::GetTestTypeId()) // Define this macro to 1 to omit the definition of TEST(), which // is a generic name and clashes with some other libraries. #if !GTEST_DONT_DEFINE_TEST # define TEST(test_case_name, test_name) GTEST_TEST(test_case_name, test_name) #endif // Defines a test that uses a test fixture. // // The first parameter is the name of the test fixture class, which // also doubles as the test case name. The second parameter is the // name of the test within the test case. // // A test fixture class must be declared earlier. The user should put // his test code between braces after using this macro. Example: // // class FooTest : public testing::Test { // protected: // virtual void SetUp() { b_.AddElement(3); } // // Foo a_; // Foo b_; // }; // // TEST_F(FooTest, InitializesCorrectly) { // EXPECT_TRUE(a_.StatusIsOK()); // } // // TEST_F(FooTest, ReturnsElementCountCorrectly) { // EXPECT_EQ(0, a_.size()); // EXPECT_EQ(1, b_.size()); // } #define TEST_F(test_fixture, test_name)\ GTEST_TEST_(test_fixture, test_name, test_fixture, \ ::testing::internal::GetTypeId()) // Use this macro in main() to run all tests. It returns 0 if all // tests are successful, or 1 otherwise. // // RUN_ALL_TESTS() should be invoked after the command line has been // parsed by InitGoogleTest(). #define RUN_ALL_TESTS()\ (::testing::UnitTest::GetInstance()->Run()) } // namespace testing #endif // GTEST_INCLUDE_GTEST_GTEST_H_ suricata-3.2.1/libhtp/test/files/0000755000000000000000000000000013051004451013633 500000000000000suricata-3.2.1/libhtp/test/files/48-invalid-response-headers-1.t0000644000000000000000000000041013051004451021215 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 No Colon Lws : After Header Name Header@Name: Not Token Hello World!suricata-3.2.1/libhtp/test/files/47-auth-unrecognized.t0000644000000000000000000000012713051004451017623 00000000000000>>> GET / HTTP/1.1 Host: www.example.com Authorization: Turbo customAuthDataHere suricata-3.2.1/libhtp/test/files/31-get-request-line-nul.t0000644000000000000000000000032113051004451020143 00000000000000>>> GET /?p=%20%21 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/32-invalid-hostname.t0000644000000000000000000000037313051004451017427 00000000000000>>> GET http://www..example.com/?p=%20 HTTP/1.0 Host: www example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/78-response-no-status-headers.t0000644000000000000000000000010013051004451021365 00000000000000>>> GET / HTTP/1.0 User-Agent: Mozilla <<< Hello World!suricata-3.2.1/libhtp/test/files/23-http09-multiple.t0000644000000000000000000000035513051004451017146 00000000000000>>> GET /?foo=bar GET /?foo=bar <<< 301 Moved Permanently

Moved Permanently

The document has moved.

suricata-3.2.1/libhtp/test/files/gztest-02-fname.gz0000644000000000000000000000010213051004451016731 00000000000000‹œTôPÿfile.txt ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/42-http_0_9-method_only.t0000644000000000000000000000001613051004451020125 00000000000000>>> HELLO suricata-3.2.1/libhtp/test/files/85-zero-byte-request-timeout.t0000644000000000000000000000063213051004451021265 00000000000000<<< HTTP/1.0 408 Request Time-out Server: AkamaiGHost Mime-Version: 1.0 Date: Fri, 27 Sep 2013 16:37:37 GMT Content-Type: text/html Content-Length: 218 Expires: Fri, 27 Sep 2013 16:37:37 GMT Request Timeout

Request Timeout

The server timed out while waiting for the browser's request.

Reference #2.9efcd4d9.1380708056.0 suricata-3.2.1/libhtp/test/files/anchor.empty0000644000000000000000000000000013051004451016073 00000000000000suricata-3.2.1/libhtp/test/files/gztest-04-fhcrc.gz0000644000000000000000000000007313051004451016741 00000000000000‹œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/82-put.t0000644000000000000000000000037613051004451015005 00000000000000>>> PUT / HTTP/1.0 Host: www.example.com User-Agent: Mozilla Content-Length: 12 Hello World! <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/53-path-utf8-none.t0000644000000000000000000000035013051004451016740 00000000000000>>> GET /Ristic.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-05-fextra.gz0000644000000000000000000000010013051004451017135 00000000000000‹œTôPÿEXTRA ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/41-auth-digest.t0000644000000000000000000000045513051004451016404 00000000000000>>> GET / HTTP/1.1 Host: www.example.com Authorization: Digest username="ivanr", realm="Book Review", nonce="OgmPjb/jAwA=7c5a49c2ed9416dba1b04b5307d6d935f74a859d", uri="/review/", algorithm=MD5, response="3c430d26043cc306e0282635929d57cb", qop=auth, nc=00000004, cnonce="c3bcee9534c051a0" suricata-3.2.1/libhtp/test/files/35-early-response.t0000644000000000000000000000045013051004451017134 00000000000000>>> POST / HTTP/1.0 Content-Length: 12 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla <<< HTTP/1.0 400 Bad Request Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 11 Bad Request >>> p=0123456789suricata-3.2.1/libhtp/test/files/gztest-08-freserved2.gz0000644000000000000000000000007113051004451017725 00000000000000‹@œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/21-http09.t0000644000000000000000000000033613051004451015312 00000000000000>>> GET /?foo=bar <<< 301 Moved Permanently

Moved Permanently

The document has moved.

suricata-3.2.1/libhtp/test/files/57-path-utf8-overlong-4.t0000644000000000000000000000035613051004451020007 00000000000000>>> GET /%f0%80%80%a6.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/62-post-no-body.t0000644000000000000000000000072513051004451016523 00000000000000>>> POST / HTTP/1.0 Content-Length: 0 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World! >>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked 9 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/44-auth-basic-invalid.t0000644000000000000000000000013313051004451017626 00000000000000>>> GET / HTTP/1.0 Host: www.example.com Authorization: Basic notBase64:EncodedStuff suricata-3.2.1/libhtp/test/files/08-not-pipelined-connection.t0000644000000000000000000000025713051004451021075 00000000000000>>> GET /first HTTP/1.1 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World! >>> GET /second HTTP/1.1 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/90-request-uri-too-large.t0000644000000000000000000000057013051004451020344 00000000000000>>> GET /blaaaaaaaaaaaaaaaaaaaaaaaaa <<< HTTP/1.0 414 Request-URI Too Large Server: MyBigFatServer Mime-Version: 1.0 Date: Fri, 27 Sep 2013 16:37:37 GMT Content-Type: text/html Content-Length: 139 Expires: Fri, 27 Sep 2013 16:37:37 GMT Request-URI Too Large

Request-URI Too Large

The Request-URI is Too Large suricata-3.2.1/libhtp/test/files/37-invalid-request-2-t-e-and-c-l.t0000644000000000000000000000057013051004451021340 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Length: 12 Host: www.example.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 b p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/11-response-stream-closure.t0000644000000000000000000000026313051004451020761 00000000000000>>> GET / HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Hello World!suricata-3.2.1/libhtp/test/files/84-response-no-status-headers-2.t0000644000000000000000000000007713051004451021536 00000000000000>>> GET / HTTP/1.0 User-Agent: Mozilla <<< Hello World!suricata-3.2.1/libhtp/test/files/70-response-invalid-chunk-length.t0000644000000000000000000000030713051004451022033 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked g 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/24-http09-explicit.t0000644000000000000000000000027213051004451017133 00000000000000>>> GET /?foo=bar HTTP/0.9 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/02-header-test-apache2.t0000644000000000000000000000061213051004451017664 00000000000000>>> GET / HTTP/1.0 Invalid-Folding: 1 Valid-Folding: 2 2 Normal-Header: 3 Invalid Header Name: 4 Same-Name-Headers: 5 Same-Name-Headers: 6 Empty-Value-Header: : 8 Header-With-LWS-After : 9 : Header-With-NUL: BEFOREAFTER <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/29-response-trailer-raw.t0000644000000000000000000000050413051004451020254 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: <<< Mon, <<< 31 Aug 2009 20:25:50 GMT Server: <<< Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked b Hello World 1 ! 0 Set-Cookie: <<< name= <<< value Another-Header: <<< Header-Value suricata-3.2.1/libhtp/test/files/33-invalid-hostname.t0000644000000000000000000000037613051004451017433 00000000000000>>> GET http://www.example.com:XXX/?p=%20 HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/26-request-headers-raw.t0000644000000000000000000000043513051004451020057 00000000000000>>> GET >>> /?x=y >>> HTTP/1.0 User-Agent: >>> Test >>> User >>> Agent Host: www.example.com <<< HTTP/1.0 <<< 200 <<< OK Date: <<< Mon, <<< 31 <<< Aug <<< 2009 <<< 20:25:50 <<< GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/28-response-headers-raw.t0000644000000000000000000000050413051004451020224 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: <<< Mon, <<< 31 Aug 2009 20:25:50 GMT Server: <<< Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked b Hello World 1 ! 0 Set-Cookie: <<< name= <<< value Another-Header: <<< Header-Value suricata-3.2.1/libhtp/test/files/87-issue-55-incorrect-host-ambiguous-warning.t0000644000000000000000000000023713051004451024152 00000000000000>>> CONNECT www.example.com:443 HTTP/1.1 Host: www.example.com:443 Accept: */* Content-Type: text/html Proxy-Connection: Keep-Alive Content-length: 0 suricata-3.2.1/libhtp/test/files/74-response-multiple-cl.t0000644000000000000000000000030613051004451020252 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-14-invalid-xfl.gz0000644000000000000000000000007113051004451020070 00000000000000‹œTôPÿÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/25-small-chunks.t0000644000000000000000000000043513051004451016567 00000000000000>>> GET >>> /?x=y >>> HTTP/1.0 User-Agent: >>> Test >>> User >>> Agent Host: www.example.com <<< HTTP/1.0 <<< 200 <<< OK Date: <<< Mon, <<< 31 <<< Aug <<< 2009 <<< 20:25:50 <<< GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/36-invalid-request-1-invalid-c-l.t0000644000000000000000000000046113051004451021536 00000000000000>>> POST / HTTP/1.0 Host: www.example.com Content-Length: ABC Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla p=0123456789 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/09-multi-packet-request-head.t0000644000000000000000000000016613051004451021155 00000000000000>>> GET / HTTP/1.0 >>> Host: www.example.com >>> <<< HTTP/1.0 200 OK Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-09-freserved3.gz0000644000000000000000000000007113051004451017727 00000000000000‹€œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/05-expect.t0000644000000000000000000000150013051004451015446 00000000000000>>> POST / HTTP/1.1 User-Agent: curl/7.18.2 (i486-pc-linux-gnu) libcurl/7.18.2 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.8 libssh2/0.18 Accept: */* Content-Length: 216 Expect: 100-continue Content-Type: multipart/form-data; boundary=----------------------------07869933ca1b <<< HTTP/1.1 100 Continue Header1: This Header2: That >>> ------------------------------07869933ca1b Content-Disposition: form-data; name="file"; filename="404.php" Content-Type: application/octet-stream >>> >>> ------------------------------07869933ca1b-- <<< HTTP/1.1 200 OK Date: Tue, 03 Nov 2009 09:27:47 GMT Server: Apache Last-Modified: Thu, 30 Apr 2009 12:20:49 GMT ETag: "2dcada-2d-468c4b9ec6a40" Accept-Ranges: bytes Content-Length: 45 Vary: Accept-Encoding Content-Type: text/html

It works!

suricata-3.2.1/libhtp/test/files/18-compressed-response-deflate.t0000644000000000000000000000327113051004451021573 00000000000000>>> GET / HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/msword, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/vnd.ms-powerpoint, */* Accept-Language: en-gb User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Accept-Encoding: gzip, deflate Host: 192.168.3.141 Connection: Keep-Alive <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 755 Content-Type: text/html Content-Location: http://192.168.3.141/iisstart.htm Last-Modified: Fri, 21 Feb 2003 18:48:30 GMT Accept-Ranges: bytes ETag: "0938ad3d9d9c21:2e4" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Encoding: deflate Vary: Accept-Encoding uTMsÜ6 ½g&ÿUfzòz­Í:MI;èЩoê3Ea%N(R!¡µ7¿¾¥MR×Yñxxx Pô4Øêå‹—/ŠUË«b@Rðq·»]}øësýw™]{Gèhµ;Ž˜Á²+3ÂGZ‹û{н ©¼7®õq•o.7YBe<2dê›2-Ä«úìZ ‚)LšŒwÅ:ÝJüõB„—oÐtÚ[ʇÞP2 ÕÌ–Ò›Àåð6ø1ƒi©/»€ƒ²¦s%ùæ•f☜ÌЉר: Á‡š·1è2;œwfŸ-H¯ß@¦ë©Ü¾}.à½X-¶Û‹‹EÍ\Œ±néh±Ìö¬ÞU¾i¿ Zå+()^½Ú¢üDºâVü¯ý00ç¼*~Y­8‡V«j¾ÌúŽÍžU´Ïg*?#m¾# }ÐjŠ¯Š'˜-FU…ýñwÂ{ó_ÞUú‹°Þõœ)— Ž~(ë€< >@ë1‚óz éØ#ôꀠ Å½š,àj‚AqéŒbÐ1x1‚ßó¡ NcT‹-(×2 ·7Ý°=?åËuòêÖ¢Š‰£˜8sSbT«Ø„#í×HÆZÀǃA§ñT?Kþƒ++ÙðÝ=6 Z;gXvEülæÚ¾ú†e>ËSf0û©§ÂyæÕ=)õ¿ )Å=¢M¶I¯€ͳOY-p¢U*ߌsÞ~ý:yzÿÁq½…»`ݘ¸ìnŽN FŸšz¶œº¾ƒhÇ%¡Ka-}™W;J§Zœlø¥]Ê‹õ2H kĶ™,÷z^][£¿@ÑTw¤ë¦:K8[útùirruþÄ}SÕsõÙäÏ“ ÈÆ?rU¤¯øÊ8¤¡ !‘úƒŸ&·1¨qDLOa_W¿?œ€ç ˜Ûc:ûÁIÎaçG£ãsܶ?R«e¨0¨ÝÞ‡AI÷Á†ƒa™’o±žµYS;ÂüY™¬eÔÍÓoÈÿsuricata-3.2.1/libhtp/test/files/40-auth-basic.t0000644000000000000000000000012513051004451016177 00000000000000>>> GET / HTTP/1.0 Host: www.example.com Authorization: Basic aXZhbnI6c2VjcmV0 suricata-3.2.1/libhtp/test/files/46-auth-digest-invalid-username.t0000644000000000000000000000045513051004451021652 00000000000000>>> GET / HTTP/1.1 Host: www.example.com Authorization: Digest username = ivanr, realm="Book Review", nonce="OgmPjb/jAwA=7c5a49c2ed9416dba1b04b5307d6d935f74a859d", uri="/review/", algorithm=MD5, response="3c430d26043cc306e0282635929d57cb", qop=auth, nc=00000004, cnonce="c3bcee9534c051a0" suricata-3.2.1/libhtp/test/files/52-invalid-path.t0000644000000000000000000000035213051004451016544 00000000000000>>> GET invalid/path?p=%20 HTTP/1.0 Host: [::1]:8080 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/17-multipart-1.t0000644000000000000000000000237513051004451016353 00000000000000>>> POST /upload.php?qsp1=1&%20p%20q=2 HTTP/1.1 Host: 192.168.3.100:8080 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729) Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Content-Type: multipart/form-data; boundary=---------------------------41184676334 Content-Length: 610 -----------------------------41184676334 Content-Disposition: form-data; name="field1" 0123456789 -----------------------------41184676334 Content-Disposition: form-data; name="field2" 9876543210 -----------------------------41184676334 Content-Disposition: form-data; name="file1"; filename="New Text Document.txt" Content-Type: text/plain FFFFFFFFFFFFFFFFFFFFFFFFFFFF -----------------------------41184676334 Content-Disposition: form-data; name="file2"; filename="New Text Document.txt" Content-Type: text/plain FFFFFFFFFFFFFFFFFFFFFFFFFFFF -----------------------------41184676334-- <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Hello World!suricata-3.2.1/libhtp/test/files/76-response-no-body.t0000644000000000000000000000112013051004451017367 00000000000000>>> POST /?qsp1=1&%20p%20q=2&u=Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_ HTTP/1.0 Content-Length: 12 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla p=0123456789 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 0 >>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked 9 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/50-util.t0000644000000000000000000000031513051004451015136 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/06-uri-normal.t0000644000000000000000000000022713051004451016251 00000000000000>>> GET http://username:password@www.example.com:8080/sub/folder/file.jsp?p=q#f HTTP/1.0 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/73-response-te-and-cl.t0000644000000000000000000000033313051004451017566 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 10 Transfer-Encoding: chunked 9 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/gztest-03-fcomment.gz0000644000000000000000000000010113051004451017453 00000000000000‹œTôPÿCOMMENT ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/10-host-in-headers.t0000644000000000000000000000057213051004451017154 00000000000000>>> GET / HTTP/1.1 Host: www.example.com <<< HTTP/1.0 200 OK Content-Length: 12 Hello World! >>> GET / HTTP/1.1 Host: www.example.com. <<< HTTP/1.0 200 OK Content-Length: 12 >>> GET / HTTP/1.1 Host: WwW.ExamPle.cOm <<< HTTP/1.0 200 OK Content-Length: 12 >>> GET / HTTP/1.1 Host: www.example.com:80 <<< HTTP/1.0 200 OK Content-Length: 12suricata-3.2.1/libhtp/test/files/19-urlencoded-test.t0000644000000000000000000000041313051004451017266 00000000000000>>> POST /?p=1&q=2 HTTP/1.0 Content-Type: application/x-www-form-urlencoded Content-Length: 11 p=3&q=4&z=5 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/60-request-cookies.t0000644000000000000000000000037313051004451017310 00000000000000>>> GET / HTTP/1.0 Host: www.example.com User-Agent: Mozilla Cookie: =0; p=1; q=2; =; z= <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/49-invalid-response-headers-2.t0000644000000000000000000000033313051004451021223 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 : Empty Name Hello World!suricata-3.2.1/libhtp/test/files/89-get-whitespace.t0000644000000000000000000000031613051004451017107 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/64-post-chunked-invalid-2.t0000644000000000000000000000051613051004451020360 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 -1 p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/13-compressed-response-gzip-ct.t0000644000000000000000000000266613051004451021546 00000000000000>>> GET /accounts/SetSID?sidt=vK3vmyQBAAA%3D.oenpjG1Pg49yNd9fJqlAqsQfT1JaaIXDIFaamjgKAHyFKT%2B8dLsVtMjfZ17iRgjEUlBN9PsEihvvCsb9xVGHxAj9AY5wCMVh89obVI9a3UuBucRvJhUV9IiqFPTstpqrXSt%2B248yNj7SfFkh7lYlpJ80HdhzNIcZRWz2p331pNFUyjKXJvlCZxJfx5hvYMqcBMGEGPM6wMWI%2Bmq0ahGSOv3JtFQe1AgI0PqNpXxj4Ft27ryBCyHbUA799OkHaldklb7yvJhSKFr3a4ZC6u7jN8fX4P%2BlqujZ%2BB88VUOYCjg%3D.ikGdYhavO5kZ0oOKV8Wx8Q%3D%3D&continue=http%3A%2F%2Fwww.google.co.uk%2Freader%2Fview%2F%3Ftab%3Dmy HTTP/1.1 Host: www.google.co.uk User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive <<< HTTP/1.0 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Location: http://www.google.co.uk/reader/view/?tab=my Content-Encoding: gzip Date: Wed, 28 Oct 2009 16:15:06 GMT Expires: Wed, 28 Oct 2009 16:15:06 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Content-Length: 187 Server: GFE/2.0 X-Cache: MISS from . Via: 1.0 .:80 (squid) Connection: keep-alive ‹mÁ‚0Dï|ESï­^M©)b!!=èaC‰`I-þ^¨Ëfg'“·,‘YÊ=–ˆ Z‡¼ÊTðLOP# ý MiÚnaô{ðýÃ<º£ðrÎÓ¼ðñ.vÂHŠ›\×½ÞzÿÚVד P­«±‡—Eª|£ÞåX€’BÄ>VÖGJçy&ÖM¤Òd|Re †N-Ìôdˇß/˜+0ÀhÀÉJ¸¡9R÷ÙUu2ásuricata-3.2.1/libhtp/test/files/30-get-ipv6.t0000644000000000000000000000036013051004451015620 00000000000000>>> GET http://[::1]:8080/?p=%20 HTTP/1.0 Host: [::1]:8080 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-13-invalid-isize.gz0000644000000000000000000000011713051004451020422 00000000000000‹œTôPÿs/*Í-¨TϬJ,J)VÈMÌNU(ɯÈLVH*J-WHË/R(ÉHUp-ËÌQ,MMÍSHÌKQðJLÎÖe¹g¨suricata-3.2.1/libhtp/test/files/27-request-trailer-raw.t0000644000000000000000000000051513051004451020106 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 b p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-12-invalid-crc32.gz0000644000000000000000000000007113051004451020211 00000000000000‹œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÿÿÿÿ%suricata-3.2.1/libhtp/test/files/16-connect-extra.t0000644000000000000000000000137413051004451016743 00000000000000>>> CONNECT www.feistyduck.com:80 HTTP/1.1 Host: www.feistyduck.com HEAD / HTTP/1.0 <<< HTTP/1.1 301 Moved Permanently Date: Wed, 06 Jan 2010 17:41:34 GMT Server: Apache Location: https://www.feistyduck.com/ Vary: Accept-Encoding Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 301 Moved Permanently

Moved Permanently

The document has moved here.

HTTP/1.1 301 Moved Permanently Date: Wed, 06 Jan 2010 17:41:46 GMT Server: Apache Location: https://www.feistyduck.com/ Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=iso-8859-1 suricata-3.2.1/libhtp/test/files/gztest-07-freserved1.gz0000644000000000000000000000007113051004451017723 00000000000000‹ œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/04-post-urlencoded-chunked.t0000644000000000000000000000051513051004451020710 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 b p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/75-response-invalid-cl.t0000644000000000000000000000026213051004451020047 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: -1 Hello World!suricata-3.2.1/libhtp/test/files/39-auto-destroy-crash.t0000644000000000000000000000057213051004451017732 00000000000000>>> GET / HTTP/1.1 Host: www.example.com <<< HTTP/1.0 200 OK Content-Length: 12 Hello World! >>> GET / HTTP/1.1 Host: www.example.com. <<< HTTP/1.0 200 OK Content-Length: 12 >>> GET / HTTP/1.1 Host: WwW.ExamPle.cOm <<< HTTP/1.0 200 OK Content-Length: 12 >>> GET / HTTP/1.1 Host: www.example.com:80 <<< HTTP/1.0 200 OK Content-Length: 12suricata-3.2.1/libhtp/test/files/07-pipelined-connection.t0000644000000000000000000000024313051004451020271 00000000000000>>> GET /first HTTP/1.1 GET /second HTTP/1.1 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World! HTTP/1.0 200 OK Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/61-empty-line-between-requests.t0000644000000000000000000000026113051004451021546 00000000000000>>> GET /first HTTP/1.1 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World! >>> GET /second HTTP/1.1 <<< HTTP/1.0 200 OK Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/80-hostname-invalid-1.t0000644000000000000000000000035713051004451017572 00000000000000>>> GET http://www.example.com/?p=%20 HTTP/1.0 Host: [:80 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/03-post-urlencoded.t0000644000000000000000000000113513051004451017267 00000000000000>>> POST /?qsp1=1&%20p%20q=2&u=Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_Ivan+Risti%C4%87_ HTTP/1.0 Content-Length: 12 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla p=0123456789 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World! >>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked 9 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/54-path-utf8-valid.t0000644000000000000000000000035513051004451017106 00000000000000>>> GET /Risti%C4%87.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/79-connect-invalid-hostport.t0000644000000000000000000000136213051004451021134 00000000000000>>> CONNECT [:80 HTTP/1.1 Host: www.feistyduck.com HEAD / HTTP/1.0 <<< HTTP/1.1 301 Moved Permanently Date: Wed, 06 Jan 2010 17:41:34 GMT Server: Apache Location: https://www.feistyduck.com/ Vary: Accept-Encoding Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 301 Moved Permanently

Moved Permanently

The document has moved here.

HTTP/1.1 301 Moved Permanently Date: Wed, 06 Jan 2010 17:41:46 GMT Server: Apache Location: https://www.feistyduck.com/ Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=iso-8859-1 suricata-3.2.1/libhtp/test/files/88-response-multiple-cl-mismatch.t0000644000000000000000000000030613051004451022062 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 11 Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/71-response-split-chunk.t0000644000000000000000000000031613051004451020262 00000000000000>>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Transfer-Encoding: chunked 9 01234 <<< 5678 1 9 0 suricata-3.2.1/libhtp/test/files/67-long-request-line.t0000644000000000000000000000034413051004451017545 00000000000000>>> GET /0123456789/ >>> 0123456789/ HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-15-invalid-fhcrc.gz0000644000000000000000000000007313051004451020367 00000000000000‹œTôPÿãÙ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/gztest-11-invalid-method.gz0000644000000000000000000000007113051004451020554 00000000000000‹œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/83-auth-digest-invalid-username-2.t0000644000000000000000000000012513051004451022004 00000000000000>>> GET / HTTP/1.1 Host: www.example.com Authorization: Digest username="ivanr suricata-3.2.1/libhtp/test/files/59-path-utf8-fullwidth.t0000644000000000000000000000035313051004451020014 00000000000000>>> GET /%EF%BC%86.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/22-php-param-processing.t0000644000000000000000000000034113051004451020216 00000000000000>>> GET /?%20p%20q%20=1&q=2&z%20w=3 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/86-partial-request-timeout.t0000644000000000000000000000064213051004451021003 00000000000000>>> GET <<< HTTP/1.0 408 Request Time-out Server: AkamaiGHost Mime-Version: 1.0 Date: Fri, 27 Sep 2013 16:37:37 GMT Content-Type: text/html Content-Length: 218 Expires: Fri, 27 Sep 2013 16:37:37 GMT Request Timeout

Request Timeout

The server timed out while waiting for the browser's request.

Reference #2.9efcd4d9.1380708056.0 suricata-3.2.1/libhtp/test/files/51-get-ipv6-invalid.t0000644000000000000000000000035713051004451017255 00000000000000>>> GET http://[::1:8080/?p=%20 HTTP/1.0 Host: [::1]:8080 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/72-response-split-body.t0000644000000000000000000000032413051004451020107 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello <<< World!suricata-3.2.1/libhtp/test/files/43-invalid-protocol.t0000644000000000000000000000002713051004451017450 00000000000000>>> GET / JUNK/1.0 suricata-3.2.1/libhtp/test/files/gztest-06-ftext.gz0000644000000000000000000000007113051004451017006 00000000000000‹œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/81-hostname-invalid-2.t0000644000000000000000000000035713051004451017574 00000000000000>>> GET http://[:80/?p=%20 HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/58-path-utf8-invalid.t0000644000000000000000000000036013051004451017435 00000000000000>>> GET /Risti%C4%87%80.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-10-multipart.gz0000644000000000000000000000021413051004451017667 00000000000000‹œTôPÿfile1.txt ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%‹œTôPÿfile2.txt ÉHU(,ÍLÎVH*Ê/ÏSH˯PÈ*Í-(VÈ/K-R(Jç$VU*¤ä§ëé%Q,suricata-3.2.1/libhtp/test/files/22-http_1_1-host_missing0000644000000000000000000000031513051004451020041 00000000000000>>> GET /?p=%20 HTTP/1.1 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/14-compressed-response-gzip-chunked.t0000644000000000000000000007057313051004451022564 00000000000000>>> GET / HTTP/1.1 Host: www.engadget.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive <<< HTTP/1.1 200 OK Date: Wed, 28 Oct 2009 16:38:02 GMT Server: Apache/2.2 Cache-Control: max-age=60, max-age=900 Content-Encoding: gzip Expires: Wed, 28 Oct 2009 16:53:02 GMT Connection: close Transfer-Encoding: chunked Content-Type: text/html 6e5a ‹ì½[ɲ.ö¼ÌÈáž5-aºxë»4݃–Z·µ¤‘¶º%­µ×Yh$«’d©‹U5•U¤¨ ØO¶?°}ür^ ?ØÇ€°ütþÊÁ9°áó_dV±Èfwó&‰=[{ÏR“ÅÊÈÌÈÈÈÈ/##~þþäÕ£³¿¼~,ºi/¯ß>|ñü‘¨8µÚû­GµÚÉÙ‰øó³³—/D£Zg‰ µŸúQ(ƒZíñ¯Qé¦i|¿V ÕÁV5J:µ³7µ Õ@aûÑIK%«^êUŽîüÌ~ì¡>œB¦qpp`Jó»Jzô'õÓ@=;Òë¨ôçšù~ççÀ/D7Qí1JʾWu£^-ѺJ•U—9¬¼9=Íj¾cú*ã8ð]‰âÕŸøÕDôKª$”©ªˆUÕS©n¦*L+©ú˜ÖÐÈÂíÊD«ô0KÛÎ~E Žú-óû‡•Gæu猪ª\&Fã¯û=I­Ž¢ %“)¯Ë€šÊµ:‰ZQª§¼“&™Ê_zyzÚ“Iz&;úu¢úôûkj©v¦”ËËxJ»‰ƒ×¼u¡†ƒ(ñJ 0Ï;QÔ ”C®œ¾Jü¶åleDbïáûΣðõx×}©vžŸt~­oGOýIGoÿÑwßœüéÓãúŸÏ‡O;†ï/Ÿ[òÃsª¸DËmxÛM%÷¶÷›­úAk¯’KŸîFIêf©ð]´à’”´‚¨£{~Úí)Ï—,+—„‡ªµe4œ~³JM³Fõ@‚”“F™Ûu–®j’X5¦á²¢ÊâQãã-Ðé0Pº«TºTÝiWõTÕÕ:¯…œ¿£>#åŸ>Ⱦ4O+B'îÜÕ¶·&£Ÿ{ÔÕºrôsÍœ«¾¨JT\/d¢ÒÓøßû„X©’¹ˆÒïß;ÎéªôØ{ûæÅÝÚy&©‘^L¬¯b¾oÜ{p§VszwD•JýÕo‹ Ï‹½¿}ŽÁñUªzñÕ£óý_Uèùí¿™–YµÙŠ¼¡p©IÓªÚ/¾‹®Æù/]ßSÄ$i›÷÷v~UŽN/üX¤‘°jìçš$VÆTÔóûÂ÷+Q/ôÓ,Ai<â®=åwºéýúzlùÈ°“ +$vŸZv3·û2ú\ºn”±’‹‚A+ïÿ&kÑâá£î»ÃüË#:µ†«¥-ÏB¿{…|\Ó^}ÞÜÝ©ÆíÏO+Õ©<ÈÑû¿BO•Þ?‰Š¸Oÿ£¿Ï¢ž*^Ö*!I5@«HB^­bøÇHŸñ  `ÏC^¡‚'>–*É‘,ßß,ËPQª×û؉ġÀ2QO¢¸qXy|©RzÞ<o6¿Û¼z±q÷ ª½RGøÁþ䃃‰Íúäjr;IÆŸQËš zd…ʼ|4Ò»÷øí»æÙ=/r³ItuÐR•?”,mñ8ôÄ)½óH¦2êTàMAC§iY»/žUUa¦M€#óoi~d4.ü&##Ÿ&Å/“óïò²¢H39`{Ñ "(9?îF!½þ$QJœ½=~/ü×x"HñQ›hŒ‡ÂOE ¾73wÔ¼S*Ò?u»Êc±©Lhð+ç-š <<< •\c¸ÏÉÊÑñ«âL¹]TpçŽé¸}'h%“žJ*Gßݤw¿cfg4/ýîÆR´ßÝÆ=öÞ?»»q°µUß®ïoolŠ½æ>þÔùR!þÎÃøÝH=wç»|x0¢µjÑ2¹¼Ù̳Jiüº2õ™Ê$mÿ#·6 ø÷P¥d]ð£À/©ÐÂÚ|œ‘\*ŠV£º1ÏÄžL’à44XóPC‚¢Þ˜ôÞ…¼,q06õŠé}_w+G¯¹œùÀÿîÎш:©ûœzG%=^¦î©éÔó÷OT–j·Kô¼¼ æ¹é‡ý6%ÇÚç\â†(³ãS·h°DéËíu»~¨ô¦Mˆg÷ ¾X9úÿ×þÿüÏÿÝ¿ÿ?ÿíø×ÿÅT.ÍPi8½>í÷hSÑö•WªîýÏþýÿýß^SÝySud,/u²VÔšÿ\9úÿÃÿøþÍÿòÿ«ÿrjEÉM]$WTñ§(Q(ðŸþûóÿþÿöÿû×ÿûú¯ÿ›+‡B,m¥ÇyvôXÇòßýoQP¦3¥\y©éítôìdŽB½¨åÊ|ÉŸÇ ç<Ñ*Pnª¼ézxœ/¥ée&@ã0 m2R‡ãŸ–~óÃUŠÅ>]¬ÏLŒlÉh¼IEõEßdâvÛQÒ˵Ø4åF¼àÕˆ_vRÙr`¦V¦2( ]Z´.hGªÈ …)tÆËYÏækí—ßIa×IgO%…-lɶ ´zP)ÔÅTÞ^nÚ{Õ*Z6C‹,_ÍêÝ|`býâ‡ýÈlZÙàŽiŲ?ø-SÉpJW¨Ô“ û~©:*GDóúž?ï±ú\Içyk¹XßM3Ðý›z?s%•#Côúþ¿£mK´šî÷Aj±îs+féýÌuTŽ˜æõÿU V4ô!QZ¬ëhÃ,=Ÿµ†Ê(^ßïD$X ãʵŠŸ,ÖqnÄå ¿D•#¦9e²¶ð—>gÍmXb?Kt+¹¦eN–GàiÓ÷g?Œ³²ÝCx¿:\=žTD_v˜…Ïo×&‰t}ÏSaNf¼o‘¢–@+KÓ(, ¦ÎZ=Ÿ~½4xüü/‹§üæÝ û3Ü´!/mù2FÑ®§ßütH¿8ú~=v€¤Â¥D‰VâCÄÛ ÌËÙënÔº±“…4¸Z’¿95d'íµ¢—ÔÛò°¡î0Œ¨uÄ®šÆÛO°’šaTJÐœŠ9Ô›77/•B‰´W1Z¸‰l§< 9¤¡°Z ³]›0$èL R IØÔ7/íf! W•µqÞÎX&)i½6Í•ô€^%V>zùê”7$ù¦yÞk)²_ÇAÚ²NW訧„¯uFäx>·Ir=~‰÷~èE-öh+I,@@ÓJšÑC-qõ|šm$‰r£Nè‚$ö"¢˜’öé mzIbâ¶]GítAÑYG$qh+~ï(2{häsêÓwÍK,~ͨcÄZV!%8¥ C½è¤¤iF|ZèIpLÇJ^€‰râ»j“ôÕ'XwÌ:À (§Bw7Í43Òe5xàzN‹ø@‹}Ç‘N¢Œ’"1ëÙÝL³˜œ¤åx„iÁ”½Im•}é2Ÿ.?lïÐ>æ–+‰Ã4%h¶‡Xã0#=o4OPõÐ!3SN ™ÐllÒ*1S4ØêõCÍò5Š¹/5˜–uÑ’’H†8wt‡h$½KCõ0 :2àrX¢1Þ‘‘9S,ˆ2©é^tˆÖ/ÖdžX‚álQ)YAhšfê 1ž_ÔÒûû¼vï’Í÷Èþ"Ó0ñ³ê­Æ$:£ƒè‚ 愲_9*A¹¨ç¤Ì•âY ¡Êø¹aÕ—1SŽr+CU–,Ò_Ú`Êya¼U&ÏøX«[õULÚ‘DSòª<`=·´Ê®4¤ùèšMÕ£bãX<»/ÕÅ~I±6U6û;b|s&~üûÝíy·î‹¯Ò×3Óìi]Ênµ²OŸ.wO«ü»Lèë/†òÛ/¤ºÆXRÐYLá7}0—>¸,LDüéÓ4yJˆ˜ŸN×æ·[¿¼\fÉîØT+"Íz´ßÉâhŠÛ»o^ø2æÔôîmlàÃœ4ä|úª@wnO½f)²¥{0¯±ùWü0Ùã’güåaü^DÍŽéxIä{NÛOtêäû…Ë ýKûº8yóêù‰à׋½î÷ân{´oºoFfàFB»Rf¤y¾ %^ß[§ÿén&‰çìî6¼§ÿ#¿*Îì«‹âô“5Þ>œ¾ÞN_ð°g[IøcëÿìÏi¡K7ž©89Qs;õ'ö‘8% G˜øâ§hh ¾ŸŽï/ <<< êóô8ÇêÌ7@¾Úè+щR^ÇfByîÔÈ¢Å_ƒV…ŒºñD¢å ?>¤ŠJ Ì;aP €©5ƒás*šˆíŒŒ‹xÿøÍÙ_rðÓV¥›Lq 6øý¦Õ– |E-÷-¦Ån H*ŽÈoa±Ç:ÕQà{e*žjû¤ò`¤`CØ­#ˆÇYÊf…†& ú´ÆÐèª –Q;»²¯¬NèRïHAX¥a3î‹3„þ6©$ d¨¤©×ïn%|§Áü9ôú[†G-øÍ3žªs>p÷îéAÿ‡%á \mù$õ ,ƒ~À¼y˜`¾m’µDV”i_ʤÛ"‰¢ÊŒ³Ð†I>ïbª¬¹‹:Nc“G‹0¢ÅCIð*2êÓcÇaÛÉw³@&ôàK­èE}fmBÕÀaUƒ…dÒy–Ž‘Æž-˜‹]BÞú¨` ¨¢@v:É–‡,à¸ò†ö•F>Xn3ö¾ë§@°iŠ–_Ó)1KX2ã´Ï!à´R$Ášæ0ßú ÓKè(°g ཎJW‚0 Å'b6–Uj€ÞÍÙæwS¿§ óG= ËV‡Ä5ŸÆòrË.ÔÐ`«©¼¤ ÎÑбøfšqáÍ|>ê¬Ív­êFϧ±âiëÄ‘¹Àhà!ÍÔ|ÚØñ¬M–0u#Ó£y 1s/ð#ñŽ–­H€hTYGÂé…Z¯€²ó ¤†¡ð§i;Þ—|gi¦pª: L|$‘1×ft~äÑ£!Õ%!éyøâí1vB§y¾&©Øn3†Ðxm¿ÃŠ£Á”ÀgªëB©XXÒˆz8Ö€°mfS¦˜…vQ~kL‡Ñ"m4«äm‚;rhÆÀð~1éþ •`2»z´©IÎÀÜ9¢¥!ðhñ0UŠæ}‹›‰w9M¼ xÿ{ÒÁÄ£Š¨£ééÉêÊ[¥®½i 9š¬Rènb#ú, ¾ô'–FË{[^üÔ<¼ódÔíM–ßõ¦Þ˜9E¦Ü ÆÙL뙪on×õݽÚ5–È\ 7®oŸÓ–µ× ¥˜UÜÚÖ–™#³nfïËΊûÒh~½¾l7VÛ—æÖWìKsÅ}ùšã²¿b;˜§/£íé—T[|ô‘80m.ë,ó#Û=+WXåŠÁýfcu³Vq½ñeér?V7#¸_hB\êG}gµýøBJêr?vWÛ/´^–«÷cgAåôù&®WÕóºC¬ r[Ì#beÇí72e‘Ãô½Æí9Mßjl××ù4ýú*aö«ÈKÇåc8š!ý ›‹­ï‰ùMÇ ·ç<|Þž|¥Óîfmq–½¢I[:Îþ6_癯kq¢ý…UüYõž¯öLz¾SÛž8—íæß2¿ƒ3£øMWÄm¡w¢P&çq@ÆÚsï°±upP¯ï?(~óéYs§±·»7z¦FñíÓàp{§>úÚ=l–¾~ènÐçj:¨ÚGàÙƃ"¾Ëì >è2 úJ ι׎Ïó§cÁ ¦0f±“x¢=d¬ºtUÏ•HÑ'Gúa”_®È4ßvØ­×/ÒŸR©SP%gâ±¥$Ž‰RîzóöÔøÅ©…ÏåÝnâk瓯:J®;•„Å?š=“¯ížÈ7.È?Ä-5¸Ú^âŸ}ºÒSùœhéT>¯]˜xËÊOÓß¹x›ª–ŒãÚÀÕ4þ\pd¨´ö:‰¼ÌMOŒÃÚ/."jEhŒúÎNÚuT‚Ÿ4ìLjzà˜o±!Aöû;;MÚ}íî’|ìîî]}°>vpQ‚þ;pê §~€éšÄcØ„å,ã£Vqœu­]A6κƢ0—híQêHRÙ˜Cù”DI@fÌèD‰$½ƒK^c³|C_; <<< §F‘nX¡j•#üaùeë)eÕ@R 5’ ˜V|õ¢Ã™¹¹Æ`hŽäc4 µ‡°¸à…zµ‰_Q\Êd(ö« Ñ#FÇþGX/Åï&ŠVca…}ƒÏâ5}a&Ú+X›"M|šÄpû<}}llÃ÷þæ­Û[MñQ4·ë¹›¦af]~"]¸2XH\×J©H~Âz_œ>&iÓ[¬mÎÏqëH‘±dKÚû ¾xÄk«ž>=ßM¢Óqw¨`Ò˜o›Ü’—Ô»d(NSez*q}>˜¿'\2˜«â9dÂ8àò;›æËJ<ÃŒÏ^±8màŠ\ A`Íèà*ƒŸ+;ß×Jù–›ÅI|åRki¾R¢ë’Ùa¢\wÄù¨ÍÚì)>)Æ•+s…‹Xû$ ‚hPº·•Ë’õ8¨«ê€ ^ðçE—°>Û5ª. ãËÁh)¸v˜ãžÕ×nêïý"Ö2ó`и¹{‹0ãæÞþ:cÆ ]iǽ°vš@Åç5¥¸¿£h}ñã%6Á·Z^a'¿ê¼ø¼/éŧ}A›ñóÌøµ@ ¿ê‚±FxôšñaµèôÊ̵¾*UŠvC›Tå9Žô>¸ñê”-ŽáAqñôô¥à˜w¹üRw¤TÜu§M{¯@ÝtIŠÞ/hWl^^âšÔx¥· •mÜßn/Ïl¦›HKø>Õõ澕¾zcX,9]Ni&òzP#Í%dèÚ!ë•š5ÓL§Oå{Mšï˜»"ˆWC¾ñÌë/=‰êùZ ¿«žï…´ˆ«˜á \TŠ`:Æç°-»‰ï©qÇ憊=-¦uó,káŒöU[О0…Ä#žíàüp“k_:ˆ6‡~³sd{ÄZÕÒvÖŽ H ý@*Ò€ÉÑ'UG»ýîþ8d°Ðo•#Ì}›,"¿Áà Ÿ FƆŠ+ÉÐI¹ƒ2æhL½LÇàdÈ€ÉÜ.Ï”ö²C¡)z~˜¥´2ìÙÛ%| ÄF³Âå*²;TÈ×Cp³…³8iârÂ\ ÙÉ#`u­z‰¹ÿ ¢ØRÁ½$/‘ ”_Èá4R8+WA»JFJüÆÀ⎠» /¯Gd[9_sÏoQ¡Ìäå {Âüû×3’‡ êÇ;ŸÌ¤ðSô71¦ë¿¼‡ß KÁ’7¯ëåÚw37@m¶oQÜœ­f}{Q›ùÆëj爛ó@såêc݇nñjq• _T}¯/D3¯|{p™e{¶.€7Mç«\oœÍ%ÜåÛDžg"¯òò¥”þ,_¯ËŸÕÛoNàá3yÿù!ÌKÉ©zgN—Éù×*Ï+÷ÜEÒ¶ 'mkn5+›¢²U¯ãOs§Ž—J…*—3j®Ìõn‚Á9žË|T⢿ƒ|…%ŸH7uÌ=pÚÁõoDzrrPï ¹ûâ"ˆ9ÁÍüfù¯QÁ±±›v—Æ‚-Ãj'q÷:è„ß/ñÞ¢ÐX]· þ©ßonÿËrÊC.Žjÿ“ɉ/ÅŒˆ|ru§¹W5)¶?¯Ïՙϳ‰©ÈÞÕç—°®QýñA$ÉÔãp-pg€–}§EÚ2êÝÝøcñpØ}±MO ïå#íÔ9­-âPlLî°¬^Ëçö9Ïíó|nŸwýTŸÛÙ}žÏáó]äß9§©¾ñ@\òD.s«¨GÆ>Á™t4æ=ê{%.àÝ1³~kìåÌÕŽ$“Ä1AªL;Ôj‹ßñÆ;aµgXïEuÔ‰"Ï^˜€Ÿ &¶sCÐè-MV9‡'¡U2ï¿q,C4Ë <<< ñÞ‡ƒ•†m‡à .n ò>[[Úsw2â®xèwÄãC6¦#ùTcB›Š»@’ôK½ŽÌ7-—¤§[2U÷ªâWDXÁÝæRQ›ß‚ùÈçz#’ìƬËÙ× ­Ñîû4XŽVßÌ0!j 'fèÌ+ ^Іûˆ°Ÿ{ÎÑ"oœm0^÷ž1bõ(~ 7×%íçãtiŒ½|%þuCqJLåÌLÀõ‚‰ã¥û97+>BÑ{ŠqÁ ÇòIT »ŸÆÓÀças\äiÓà_(ñîßWó–rô!o꽚ØõFƒQƒ"‡è7ï|Ñ‚ú.ò]†Oô`«ºg‚WZ'Jqwg[|Ûûu„¼‚ ¡mîmŠ’§§KK`"Å]¦êMçÅãÑ&åÚ½¢­,ôêlc®‘ÆÿÎŽövO IíK»…yŒšX@™LíD)™­œÖÐü eßïp+‡êsà¦édˆOs˜™ECþ”)ˆ—2Ö$Ñùûû»ß߃£#ÔHãÈq:9„ÖPÉ.§ý]Ú*ï~ÌXÝE¤#ãd§N=v­Ð¤ÉOYû˜Ø×@yþâšÑçúŠâ 8ÿ)ŠsœÆš8ûü<Ρ&üÈ+·ŠåÎ[Å¡Ì®5÷r­é©¾ 8i‚Ñ%u‰è•£Y;TÒG ¤À€Û½ÞàSm]ÿèÎM3¾[ø[†„Ì8ôÛ>®ZešFžŠ,ì+GUÇAâ.©6q:å²w=εL¦kÕCÜ»,î$9JçXˆrçfðçH ½"©t~–Ã'tŠplšƒ=>ñà2º‘ò£Ôˤ‘=Õ–YÀ¾sr”+„5:±Êç˜zÇl©>ßãªóÍÉ<à@Bg7ȼ<$ŠlùÍUgOz¨>¾ôIieÚçL×0kù ŠSyt:ÊÚ2Œ¢q‡4Ev¯MaD«ŽË]æ=ŠvTDœŠ»æ‘Í>’H¬÷“©Ìeð9•Iab" âœôªe®Mµ{’¨…T.æÜÊ.Í;b“y`hø˜RË” zȇ4¤qT)_åØ´!O°ï2gÐ8·ËTóˆ*Íbò^cÀÈ"2Y°Cer`·x/ÀWDÔG¿:Ó¥é>@˜îÈp#…Éóù=TÆGà†ù(Ò§½nr›,ÉÏáø(tqThî~p•C÷¦‹‘äÓw©ùìÙ¤õIDwqÛØä|ˆ|`n|"=]41¾¤½v´ <<< ÍÑc‹Ä‰*ŠeÚ­ŠSÚÖÐÂGæüLp<.Cæ'±‡ä¹ –“ê˜ô.Hl8MÚ3X¸HlœQ¿‡YDœ ü~éB0 [æq@ Xç÷eˆ’²#ß|·rXøÛ|☞+Ù¿–¹\N^Ž=–‡!€W .1v€0B§Œ'ŒJ© mŽv-Þ½F㇤¬ŸDŠw$€OiúF$Õ¸L¼+)çvÇì¡N¶I…HóžÚ#Yz‰G[§QX§ûÏÎÙSÏÎU"h'´øQ’X÷Õ’Aˆ:ôöyUŒçTyrÑ<¦§LfJYÈeKjjõhFq6‹ IÑ@H>—§“ÉÓ+Fd‡Ä÷¤~Gw¤Œj¢ÁçÜIœˆÐÜ>Ý´×ÁešgÞ !;,¹Ô¥ŠäøR2é»Z1p²Œ±©ˆÇªÌ7ÊWØ9+O ìXL>)£s†ÖကùÐË£+ÌŒªpÆDbÒ¤Û§ÂQCÂwÝ1ˆ>íòwáa—ƒÆ¦ì±Á¥ +ÜS©r’E~(’VèFRª‰‡ÕL,p×pî8@kOGbºXÌ'«ôó…†({µ39TÈc.Ÿ~/.÷k¨ö‚.4Q{lA1Éœ0é¡ílï–¼\¾¿‡„F¼ÀÑiÓÊ­O¥Xr­_JXÏ,?Æ»›W232MmÊõæ J’¡½ug¦´±€°C%¬-#y ²*îÐM¿óö™Nû­B¦Ÿ.&W:•O£hå‡Ëœò_Ñ‚æÖÁÁÖþöªr8½(J¤s9$Ãĉ·­¡û™}¯í×ÊrRLé×þWì×Êr;”úE5Áªq‚Fý+öley›¦ô,n|MY<ø =+lS;rú÷… MçEçØmÆ,:±6Z#Ë¥>—~œÒ>ŒæÎ^}£ÙÉ+3µxÚ=¯ïl}½re?W‘eij?·‘ÕÏ×ÏU¸Mïgsú¹’•~z?·ÖªŸ«Xù§÷s‘5ä‹úz-{Š0¯·×j¾rp…0o¥úÞíñWj6›koaÙ!,Ž®R´/9+})h^XLý:ü{ͱïõõXZþÈööø,­¾¯_Ékii Qø-­TA”\–¾é†ytÃZø-­é²³FNK·†C«õXZµWÏšæ—ÚÝÞÞû–_ªõ ÙR¤1±= ‘™ÀéeÚwi3¤NBã¬ù2¢KjÄ#j;AÔW—}¸^„DNH0!„ÖI2GLˆ@‰ÐÂîZÌé|ÈBu·Ö ¼%þ˜…jQg­R=·ÌWëàþÎþ ‚—–ŒúSC=,ïkTÂÆ„“Ñ35Ü4~ ˆØ36Ò‚)‡ÃæØ×|záó™8õ¿º Y(´Å“Ä>`Ïpǽ¥Ú/ÉjˆM3Ýî'Iî„Tqåˆï¸·pÈO=7÷nÅ7~;‘ YiRMÞ0ÇžúöHQŠŽ/ợÌÄ[ÀýrÓ)t¬äíÉiMk·9Ü1ÁÄÇD0,Ø<ô «‚¸JrŽËÚAfÙÒ–³öóõË×5ÒÅ/_›¶ s‹`ã’cZñðêe¢¦÷ZùÑ·Îbj&wÕ·“Y¦-SòNÀS\"hgÁœŒŽƒÈíÊÑnUíà ȥ9X_ Èü1>HZ,ý°4ìð-É<¹õAöŒÓƒå Œ7xßÏ]IÐxß…Òô4 2szL"ÈÝáüƒãW³ã<^=KdèœR“8ñ*wNoi/šêÑF,do“½éE¬¢8Ã!‘p• ñ×p:¡/ ˆ‚ïÉÔHKz$fCà0ŠS¥ƒ7Üiæ“Xy~›].R¤½ EEoƒ’cO’±ÓŒøaáPÄuõvðp,vê;_NOpCü‡É¤/[iÂöâ-'æÃF§Z-0Ý``Ù€„hZ <<< B¯¿Yœç:Œqõi…FMæÎÌ™ég¢ôïý2ä¢VÁ‚°âÎ-B9¾Àú¢Š‹Ž\iÓ² %7 ~¶•{|)¾%Ë0­­×¬«ë .¾?¸=€áêúø•€Â…'}.:çGXà·é>×t_ ,ðë-k÷­V‹è­ ÛY¯Û‡œ|ÓÖIU/ŽvvtFS¡õÅ0ß ÐÇVôÑÙÚ’ýeNG”舜Ž8½rÆ^RP4&:‚è|KÀó…!¬æÍÃV´ÝaØjºŠ€ïuø[æÃö UZË¿˜ 7ƒƒÝ½’hÅ4ut!<%¡úrðlb´Õ×KȘó´ÝÇe»ÊQåÒãÌfET¤ðhïÕÃÇ6-wôÔwiéyžò]»戊ôiÿp[_·‡hÝt/È^KÍ嬇*¤ºžáGÄePi;ð?Žè$ÊÈA¦qƒH¦|¦rùz—ι³Øj0w¨°‹Ïš){eJmN0luÊôw£-.œ‹ h·EÛª7v×E[pàÊKR—r#­ßr^jùZ­²ë ¡-¼a¹=Úʺøµâƒ-8ßGÁ›î¥äIßfú3}-г¯µH¬v¶>,Xqô®Õ`Lëœéa¯åËÐéF&þ˜ŒcG§4±eyÌôHwŒŠ‚`n¦‚µ3À½*¢x¡¿¥ÿì€\³¾Z@Ž“¯bsX5—·ÑäªÌFÏù ‡<ÇcÚ잧ü¹ª?ùêðíÙgŸ¿ê[Ç <<< h>¡ÿ˜,UD¶ú!¦G€è:Ô¨Ó‡^â¸}ú`l–àðƒ4 ¥¨€qïÏ9;pýðò•ÒD¸š”á¦ÉNyÅ4¯În¢!#¸DLVDl¢à6Ì3ZãcŒW^šY¿˜ô:ðÛò±€§QÖéVűæ0²³ÝÁ43¸–Oeù!É,ViŽðg=´ ²(²D[` pÎN,JmÒ4‚yÂizèkš…ˆ-+{ˆ G.øΧÑMKÎ^Ûª\?6ý/ÔÈÅPt²¡ KÞ$2`²<Š/?æ!7fÆ$ö!‚Ä h„冊°U`Äð˜sä_釤®Cã9O2ê"~®}Ò”vUñ—ÜP"ÃhÕ¢\˜<±ŒU2ˆ*ãò}MÓÊŒ!@7:¤8j;£1URBЕæ kÂÍE[øãEˆºóQ…ðíʘi~àdW2lØɈ›ÄµyŠŠ ‰1ØHEGHˆòøWÆ£V_ ÇÉ ¿+[’&mŽÆ©°ö‡fý¦WðÙi ÌöO¿ªÁOòC裡ýÓ#’‚ŸÞ°üAþɈ”ÉãxtœÓâ„e°î \ÅœQeåêʨªBM-£¢Œz2ªiB-Í™­eûï Ý’ÆÒbØÝî-‚îêûë Ý-9~¥MÊòfî$–÷–ÓèßÁb¾¾¸ÞÒÛ©Ûï­¼«_ å[V)`ß tÂöû¦æRk®Óò²F˜àz³eµ áŠá´õ {Ú×lu‡^Gªf³Yw¨íŽR7”»yèfÃÙ¥§n×¥všróõô9å{"(΢X?A1"(^?† h6ª†`)Wí·Cl‚ÀÞ7Ð𳃆q+En+!nËûç‘”²éGaÜŒÈÍ„ƒA.I,k•£\B™A*øJõ´ÍG§>’z6“ž4P¡B ö0³IÔ8Ë­¯f+D£[¬hZ2»DÈРu/-é^`S¥sG.i|ÆdZ#8ás2³©“Âó5\‚ÅÝÆæͦ¢±Y߯#b-²·%JGA†C·{æh­4Û  ib›ldE^Ã÷¼7×bO<ƒ%ð:Q=?#«aûéC˜''oš¢§zQ‚œƒbw»NÏ‘qKx‰5ü×wÏOžÓŸª'¡â`«^/Ò’¨Ù¬…šƒºÝ%sb¦ÑyΩOž¥½ `Œ]Ú03±rŸ¼|n#¼¡eˆª@»ƒ<[ø…¶"4G‰Œã™ø´ïrî2øâ‰fµùôÙ'Ú‚'J4ÅI‰³Ý]êµ³Ymà§×H“–õÄÙ6:'2‚E C…EvA ¢:=>;Æ-ˆ˜Fj뉆5ª[NOudìTì"#çSÃè:²Ák ñ[mÔ_“v2‹Ù ‹åD“³Ÿò©+‰äqOòAjbŽaBÈb¬H/q½v9[!¬½?‡òÏûø¹:Žx‘\±|l×hî9Ú<94™£îW6#5-…/ì9°gKCü‰/ 68Vù4!¡™ÏuR ê#ïÙlï©ãH¶]6$€ôº2=£ÃÝm~D_›ü}w×QD¾7¶¶*Š£‰ï£<òƒj@2×4F2Û¹TÃaë\k¶™LR<(H©ÿ°uB¯ŒÒ€rím_žC @X.ñ/ÍßáaýïÇÚeF¸4þHv´"(uuwP—3ÃΚ·(¢[ã`ggÁ³%°|×fuvß%¸qÒßë«ëõÑ–ÞgÜmå]ýZW—T£ ¬+Ô %'ºojaµ°`ÚZ.7k„ªÝþ¬ø>ìj¨õ‚×>ô]¹âM,<’‡~tZAæ$²¸çÛ"…­œCÝBünêùǾӊ—ñµ?¾{ÄÉç-ÎN Šâ¡¡( EŠfsXP~ç<|Ýh|CÕ>3ª <<< ¶çàK jKÀiJ+a\Ï—ÜØŒ ÛtÓÔÜîU´R^7®ÝR|÷z£V߯õýO~ä|Èz±vÆôº™yof†Ÿj§ßJH:K–§ÉÓ>0›e‡†Ç½°Áð;ÙP›´í×Õãüéþõ×kGÜ{;ôßd[̧^y|/ŸT¡{áÐæÍ“Cj’&µdB™ •L ûyÛ¬+>`£‡dÂåÄì™}eã2²&ÈÐÃuV S€‰<ÙÕÙY¼]kîðøÒðÆ­Æ$C5ͨÄ×J3WdÄNï¢ïX«Æ †[ŽÓC“ÏÊGÚ/ƒÿ]?´7B}… bˆ´öi=Ø=ƨœ”觮¢1Âkê‰O%‘ž ¿ÚÀWMç£=îcÛd²ëd¤è/79å\€ß|WRçîæœ äq{¸COŒÎä軶“ˆÎžuŽÔè]vÅc®OûtI¯ÜË•kqOÆé"ÐW;¾áP¿‰„°r›ùB±åMMœ¼;áµø…ãwžŒ E†>Õ-À‹oO’°»Ê†¤ÙòI|†E”á@ îÌ<Ÿã÷dªùö3Ü iÖGB›¿!KÛ4Gp„Ì7BL>8QB`±¬iSWúð:‰Ú¸ªÑ¬Öã@!÷û/â•»@qh»ÄWŒïÙë#©ÉQ*¼ˆ§«¡G¢†ÛÕnMÉ—LÈâàÌÔ©ÀœHË¢ÎFµÄœ¢æ;«^§PÈé$v ìóv œyâ×›ô—vˆ‘ƒ)¬±¶%1‘úv@”œ®çx}I© 1“N¢hvèX¹°ãIÄ>ÉÐç{ÓI–³NÄ7ÉÉŸ€;íºø6†3h±LÞ¯`‘æ(q|²²_¥ À·’^ý ã_z‘§‚çÞáËW'/êÍýƒ†’tt‘¡j÷À~í¨ÃFåȶF’Pâ+\'™W=ë’µ§I%µëûký8WtÝzYkiÞk×+0¦¾r®ÞpìwŸT£Q_gvÙ,mú–çKþ‹7Û~#[lF;lŠ¥´2+ øòvËú‚®Ëï>oêºú¾~%Øui…Pà®Ë냒ïâ7U0›*X  u•5ÂW×›-«…UW<®®j@¤<) u0PžË$bÃß8àMZsË¢ÅØM¹×üîù?>•ÃàÆi"èáݵ¥" •…áÓm ½DZ’vÝ×á§I©œä/.  Ž×vûÔ.3Ofæ˜ÝÑŒûù)J0ä³C©.SYÏIþ΃΄gâÛ½Ò°˜å‹_bc%9o…5ºQJËN˜áBh £ÜÁ¨É øœç¨#ÀhA¬UŽ ÈösúÅ£ñìäì]y6W\iC,;\1Ð FZŠÃˆ³~bm%ø!µH®T«¢¬i¶Ô!"]ïHò‚;c£y$jv&rKiÙ…ûfÏ:ã476§¾Ò<[1ó²¸*^…6ž_þ&É4£›œ eºÞG$dÖñA=tqì÷èQ_y&Q+‚p- QÂ"L0pƒÂÛ1QæÈ— \š»ÒVf´…I‡Áׇ%¿ A;NÙ+îBÀF·ïJÄÜ„M£>‚ÆÓ˜¦sÄ÷*Ù–J¨MQZ•„Äö¨Í-ïQKݳ¶‹Œù®3®‘rCsNÞ% j?lmŒÂsÎq“á· 1„ÑüaÇb}ø†K$&ùçA.¸¸Ùaø„×4«„Yl®B›¸º«\@‘ÌÛªx‰‡–=£!igH8k¯Lâð úð¨EV™y1¨Å¡¯ ;-ȘE¼ý¶nÔ´ÞÞ~‹ŒZÉä]DR'¥•¬ˆ¥Õí˯l† Ÿ{™Z_Li1ËûöàH«éßWÂŽšá^´ÐADßæöÌs{-@¢¯ <<< °¬´½_-ä³ Pd½`ßAíè(I7¸€`©4¢Éä@oÑ>ÅqáSàhšZÜiöý$ a2^†|ü꤭Ë)(¾ã;asŠÂR®qâÀdÅЖ(nrÀu¾QË×hPê÷"ý´¾ :ó{âÔ¼¶(T®éÖá@ÛÕµCscvœAø(Ób~¿¹sPó!mŽ7¤ðݲÐÔ÷ÍW'ŽˆvY çB V,†K9šN›Þze‚D5÷­ƒ)É0ÎLxª;Ï ƒ꣛™]ÿ›{9¥_ùι¡ø ¥Á;è¾ð-[~ØÛ'fÊ,¢a°Y¤äÐÀZøÒ̾ûH³ <³Õ¢}¸«bëÌÏw÷áJ¼¨p¡ÊÛb½¥h_N/¡&ãúl¶¡ÊD•3wZ©Ö6\õ» ÁÈ‹ .Lü0 2®K^Uœ’Q5Ì-”Í2d’ûT à"Ü…â¼Ë´¾%õE³0¿nà[è¥*î?âž`\%Š%Ê\qGÀ"HTM›læ{‚Ì3$öšEýîÕZc»æÿ–IR¾YhήŸµÊ xà³ H°Û¸?q˜’™îÿʦWŽŽ›'¯¹ Îó_BÚ5Ì-0ˆôŸ’=#ùirtbbC —/tùrù$…®$ŽHœSÑ€ÔÚÀ§ ¶=É̽$ Òéq#ÙBÜɵi;f_·¶jd+‘ˆ$N[°Ln 8²Ž_vdÒ²™Œ®·VŸìõ3©Ä9S¿~.Åü;`·¬´.w›’Oìï6×–[vK»’Û“èÝ·UÆU}á»åwT·Ê[}_¿¬·´†( ¾U+ˆú÷M7Ì®Öþ[ßegPÂÛĤՂ‰«†ÞÖ X4ƽvöh3æ*d¯¦õzÝñ¢žFÔ¥ K•Ó§É]FGwïóÒbo“J SZ˜Òâ.¿·0Hؤçë@öÁá¨Pø.•´ ½º(X8Yã­ ›+ e¢ó,⦵yòæñ4–#q¢ Ml†»‡I_žvZYþ2¿73]%ú•³Ü.ñEnÚܯP+÷LÅWg¬xÞe’ì6gÞsbuNûîv•J¦ÝK»zÎí–_S¯° «³² w \b¢™:¤$q«V9%ðV´XGC¥l¶ZÏñ†@o”½Èhô¹ds´\/‚[z¦ÍºŸâ¸oD½œd!èÅIÔ‹ï1§v2ŸÒ~H–¨E’lÞ+ª>]죔r7s®iŽ#ô &Hœ¨4¥¦f|”("2ôýÔÐBƒ+: f~I,®ˆÑElÀñ{ÒETT¾íª„M Ûè™ å–=W•>b”òDØhr-»ft©Bš”[|Mn¢ƒ9BÀðܺœÕBánåb#LZdD;m2Ø‚¡ÓɆîHú20·§.v~¤±æ|ÐW쇇[¤f«Šã.ŽA°iýÉø6 N…û³ wÀ),Žn—$)âàƒôxÓzŒA~§pNCN\ö-K2?µtÄ·@¶`³NMz[DÇ˯D>Šˆ[_âFä\ëÔ¼®gó.cŸ-×ìвs`‘_BçÿÎ1ÉyÅv‘;¨õÛt u¯±·Îä\ãUÚÓ̧A&áÄ9m)ÖÀ¿K`}áÄ9÷Q·;\²c_ (œo¨àœÓxú}›Á³Ïàµý¾Œ¢_#ïkuxµ`ÜRpÕz!oíìƒßöƒž¦®ô¢D:œ€fI$Ìa×ám’|Ÿˆ8HÉe0î‰%¸¡Å¦˜§´)#©8›Q†¢`ŠÒO¿ÕùÍo&X®¾lD¼)lòbãG3òÇÿÓÜ«oçrf¤ŒE¢*uü¢ë¡æqá¶Ît{Ns§eo’;ßÍägÅ”huŒÚ›&5Aåèí¨†¸ <<< ¥Cÿ-›dŠ©Í⢢}yJ2jÄGfºçÅ×h] Å#IRÙR2tÜgù„V’VĶoë²3?£NþÅ# 4$˸èø½<6ÃõAðŠÎåã>R èňÅ8;Ñ&?ì…²aºF$¨i>òX±Óœ‰æ»K:_u`´àzFöL`bD˜sÂN†Á´½¹Ù¬ÍZ¦cÖ¨ÁÜe!ÄS>&t3ÔÚöiнÈÍ°™%ŽÑZ{ŲÁói“Ë'˜Å©Y!~(ùÈQ“>ð9„°«â® ¢8òtU<äw|,Zœ³;xXs»nä [E*¦ž-·+ûô»R©5šRñc ˆñA³y ?líÕï™ØaEf ­8°µ È~µqgÈ;üÂm‹é†9ýÕT@¿sègÙõ}14hïaAûÛk}KtÙ,Ñ«Xà.ß ¶R­Ñ*u¹Ó_aÉY_Ähyûÿö€H«ïëW•–Ö Ô´•P¾súM̤ Ö}Z³¥e`ªµçÌjñ¬Uƒ@ëq²åÈÌÑN{ç#ý¿ÃÑ~ÈÑnÄqãô”FTòOJ#[ì~f/Ž[•Ùßh$ %QP%1¢£˜)}Ëñð™­½û;[«E´ŒÌpCã$ú ÜT×Ì ×®†¬+N³jåÕ6 ¸öi}`JNb¼¶Ü\=Ÿ»µF³Ö<¨q¾‡ãfIŽ–î”b^Ô´“ÅN+É´¦ÙñÔG_:)nv°¶2‥Oj8P;” %ZŠú.áYØÙ/Š6SíD‘ädëvZ屬H¿±§6-›ÒGŽS:‚dŽÓ(÷(ûÈÓùph³·Ã—¼×òC™_ä”A†£Þ¦xP£áTµi£C WÈTMÝîÙœ¸“ªKUsvk’lz‡Y¥yŸ²=þüH‘2€ ø¥D4 >•Ø‹É(†‘: ~>»nyäN– ¼Ã*T\Á‰ ¹­Àj u²Y1ÐÊc8î’IjR¦X±ÑØ 7„•$¦"¡6Ø”…Ä[R¼Hƒ‰ëz|¯ÒªÑÓâ._>¥·:ˆ™†@`“ è{ÖC @k¢«ÕQÒ{×!agä‡qžRq6Ö¤Œ…™Ç—Ìm„ y¤E{çszd_5h‚ÇÎר3FзÂùk“,4ã-Çi"Ð`’8.î‹^d^„K§*ñ%b’-º¸Ìë¶øÚóÙÜĮёs@w×iÚß96·„ì,º­yk@¹úÁözƒr‹Ž\i_°è„žàÄÒòÅ’ü/~9^_ømñ½ÉíÝV×ǯ·-<Û ˜máÉ^@kßæùló|-€µ¯¸<¬ˆ¶V\X-`¶*Hi½€2„Çù-£M¦J8ÝZI¯…û]Úªn„k™èÕäÓÎÔaŒßt~J<ÿW¡–”C¥ 'Fô*&£%h Ì kl âç(’Ø3_ ãÄJ;¾o^bŸSÛÚ[S¹€.âNÆÊ¿£”1«ð!†ºæf-à€4ÍÝß?¨ýâÆC÷Ãð#“´ Œ:ÓdäP¶µ³Sr(›œ¢˜G“€¿Ñ4À_K¹|ð/˜ øK³¿F þÐœÀL þ±ir\ºIú%»<¥Ü< âc Á›É‰‹¬æÈnÎ!Ÿø*Šï¥°bdü2úijé5[öJ_¾`Mh-snGÛÉiSŸ#åkR r¨7ºq47™‡€õ¨!Lì)!ýŽó¾ÙUÝvMGáPCóøyqì´÷à¿K1øî+©ƒî°•ø¤ÉðÄIÎ]Z#àç"@>s ¿Ù“î×.Ù³tH2[ŒXÍ$ÈB™ŸsŒR3w¥¾[3ÐŒó1Mµ;¤>$Îîþßã•å!‡ŽÐ¨;ºë3^ð6ÅrŦ! ÚÀî <<< Ú«¤ð|{·sÜN«€g.¤r%ûÏ#4ââqrÖæB¸a6_£æ[C@Á˳$Àd­Šc/Š ¾ Q y•Å¥r<WIÙìMH‘Ê€¸5%Á)äÌ?w©Ox½ˆøÚBp¡!ø#€‘MF?¡•„Z_3³›Ñ²B$YÌ„žr;̸f5UB’!ž¾{‘à;Ò G=ÉF,Ž ]¾&̵mS‘YÁ·7º¾ç!—Ÿðœ²k MqÄ]a'?c¦ûlÓûHÁ€Vy`iJ¥`·Å€TcžÇ¢Ç—(|ð.åCE»‚–¢BØö'/Û™fÝ1Nç‰:£µ?4wÌFá ªø)iàM3Ëe±Æ —Mš˜oÛ¤æHHjÚ“wußùr®0s»µb püI2)VÇ S62AxŒÈDQÿm"µë´zÔ4 ÖÕ:6µ…®M3p^®œ-ƒ ªŽS55wœXÑ|J̹‰:™žn;íîníì7šÕnJv€ÅF‘•ZœLQ‚4¯þ J”¯éËÜ‹e©êcæè45¼"Ñ•Á¥Ë™§‹¦[õ[š6šû[kZu¹ñ+í ?÷Æâ2Äz…ñ4a­ƒ4n˜¬Ô(™b3\²Öi]vs{{ðÖU÷ô+¡®Kª‹{ýìÚ¢ŒÑ~S³+Šµ€joÍ¢´FÀî-æÙjaàÕ¦ë·]×¹ ™ðÖ1uË„ pÒ>J“¬ÇÑ£°‡‚nõÊ­àGÄëãžSPgïDN‡0§6˾ìûr˜o£¹Z?Ê(Ä@Uú7–¦Šïªvú°Q¯×ÛÍíúNso{¯¾µ³·½[ߦ·ö¶ê[õæÖÁýf7˳å[ÞçÒÆæû´k¶r©§dÜx¯ÿÀå ìÔÏ ÐCxtŽ5I51höG¢”iñT…’–Õ¾ð«â}Wq(^€<’¯°ÏÝlÓ“þk6xzº]éCU`"…Ö®¢4XJ;´Óÿ²4¡J‡N’P8ÕÍËÍ×#fK'ÓidÐÉg²Ï¶íŒÈ)ƒæ͘îq³h”8'-Žt‚q:#µFsTû`˜ê¬Ý£BTI24·KHø¨;9îëfðNÉ\kùi.D°UñE3Ì~èrubû)<0CªÓDEAG (óqÖ‡Ll‰‚›½ME‚û½† °p Ř7®sqýdfIªo3;lœh‡'¥àõ[ðë¢Ér_ꀥ£³r†wØ¿5éqÄÚØz›˜*e/²W’Š•L«Q­óÑI¨û?*7KóËK|c[¿)’W-ÒQ¡b܆™üa·IuÅÏeÆ’Ä8y˜ßi_1`‰ú-óѧDò=õ(Dr.ÑRŒ Ôà<=L¤²– ´Y¹ Vo;d"=ržešH0„])½`X…Þ³/ n¢ÌMm€¨äÉ¥à œn\:IE0´NúËéó¦üí¾%jQ£†EVãˆCHJNêfv']ÀÑľ²iÁJzÔ¯bl0§}ôØŠ!Gõ´Šï©å–âð^|¢Z ™}ÔËYAî.™ŠÚ¢x„qÓ‚Ýcø"<Ü©oí’e‡—Ä)Þ2ö»£¿¢Uz¯ßUÙ¿s᥌ðÝ„oâ½·»»Îˆ÷RÃW¾C¸ÄîiòÂþç0\ <<< §˜•s˜”##ïïzCì3aë‹d/¹3¿=@öŠ;úµ.ë/¥F7õ—Ñ£úߦÿÌÓ-ðéuXBÖz^Ov¬ø6þ*‘×õ•á“Ök²/šì“†Ý¥ƒm³Ó‡«tÄP– 60èFÎ@Ò.i œ|Êt)è˜í÷;C§„9aè,î0LKœÔN⻸ú|Ë0¿(Þð‹ ; ÕvË äÝûÛ»_ÑmØŠQ>1нûûõZ«é²ì©®Ý&Q¨älÀygþ¾€¬$¯‡€Ax;~B»m?0– QÄi'?îѦ}wï $‹!ã^´­xìÑÙsš|ÀN—Àï+ƒNOMs¬uÆËÜ›ç/y•Ï§‡ç{|DŒœ¾Š‘/íF‰kÖrEÛqŽ@'ëÄ*4áHô 5¢QÑ(ÑʆœÜƒÏ„ͱ›M[Âf )ŽÂ—ã<ÉKòZ•AŸ"7ˆäÍ)±%ÒÎŽSgÍ‘MÇvkûŠ_F]ììÔóšW…‘MA‰Û•ZUűù±¶1lÙÏf“æ”_âDe4ÉI~hÔë‚G"Ä)%±1 Ee~ÇëàcÊØTîi6§é rà‹¹ÝÅyŽÎÂ¥}qhì׿çÀÍT›”Ð, –s´*(:Öƒ×1™õH«JÜG@‡œY¦‹"„*± }B峡—‹KH¤wÄ]¼Äðû½u`NHmâÙ…`NsUÌ©×Z2 •Éß"Š©ƒª´U0Œ58YL zÈï ¶įxSàMÄb]“¿úUÙ„$â=ZÝV•ŠQî…¸1ï2¯¸‡«q²°}ä0ôÃo™ï^”5ó¯j |+¶£_¢MºŒ#“›bü+öWeb®“NK…]EÝѤmWÄÈ('ÿI#D²ï)Tç >mÙ _VÊâP‰|,N©È}ñœËˆ‡´¡zFeH¹°…¾ºv¯ïÕ∽£猪^ôvj× Ê»û¼|ì}v™³õzÓÄSÐ)±±`ákS^PyáˆF½ÚÜ©‚Â4®ã·°¾pùò²åÅOIÖ?¦Æâ*£ô:±Ì <<< €Z–­8z<¢sôš¾š¢£7¸Lé|7â¹õÛÍZ4%½,Pö@Ô>ä8£täœñ‚–Gu±«Ü0Dªö) •ÓõŠŽÿ#}ÏNÄãpÁ÷&Ž.ë#áªOZ"· pZø¡4)'’YÞ$^èT7uiâ%QÑ«gghV%d=‡lqŠÇý(è‰þ¡çÔ¨¦Öº‡y÷®nÑØÙ¬ý÷È-¯²èk…ÅľbØ:é‹d¼Íã/cb7±7œW®‹Ÿ9VSÛh^¾+ðΨ­¤¹Gœïƒ°Eú»;¥ Çð&ß÷BÀsLWÆŽË°_„sÉVigŠ8T9ŸØž–zû;æ"Ólñ¬Æéù SÊ›înÑ*×G¬V…OÉ5æ … ngs@Ï•ø®¦OŽD:Y?d}™iÆvëõ+„ Äà ÔzÉ ‡J‚’(( <-%ql<3¨÷ö”™ˆTpZfw±O  Ê.ƒã9"`hêG?²û˱mɪ'y7±ÎÉaÖZüê¾ø5CpSX¯Å_£>Ÿ¡‹Ý´›'=^˜§(ê0HÏÓæöÍäÐi ÍßPöýŽ mDsÛñ"²²2;ZiÔÛr\]ºòI¾>e‚í–æm‰ Ü„ªBšÏ ñö9&w®­›Õú’,Ý«ÙÖ9M§^Ü”ËG8¢·ÊC/´w± ûæ¬h’UåÛÂbTXpapæôäO rb·Ë çÄþGCKÞ¶Ùu;Žúè™öû m%CƒR°¾iÔëfW²0s–¯{’_¯‰žxMô0'Ao4;¢DŽp§&Àk¦GRÓÅ4ÄÆãÔ”[ vx§–:+«‰,ì+?Ð-_¸:ê 쌳Wþ“hÓ?Ë°céª'™uæ¼4¾þ%eɉhá|ŒXŒ/‰Ä¦øa¯ô•™i{ňîÄÆ .Ú„;üÙ„¥\Í[µÂ Ïèg×Ì5§~&%”:ˆ°HOŒGšy…~ÔVR–aóÒU_1M7´8áÕ(…¡·É119Z¤Lð}‰ @K1ŸÉÑ®ha^J—ô"mÈO*$3ÜŽ 4²W¥_if³•vÙGÚµhµ”²‚Ê/­º=>=eÉ{l +dž xüâô±xþëÙÛçgÏ_ýjÄ_Œ(æ7\H'æA›<Ú—ôô´CÀòéÕØîÅœÕå›3»}ó Û}5}vi7–ïùjØ ™ò˜c/VP™}Öž¨m;±›N­V·o˜ó@LÜÍbO¦ê¾ l¿)ü^œ(Ž‡@ÓãƒÅ´×ú—jý¯‡¹ß˜jBÇëo³—$¼%w21£~¼vg=ðÏ(g)u¿ŠÊŸ½¯-AÌ ¹a½,…|; |]°M,ÂÁI—áЊN`è—7žâ¹Í‰‹Í£4…s'ô™΀6`]ÇO—ëí¢Už œ8yÔÜ!ËÛ–+k›û6Ò‡ØxH%7~ú˶÷UG¾KXÜ œ"/Ðpöa£½ ÛS¼às¬g‹öÚEðF§°©8O.ׯk|ÃÎvù]ÜRT­“r˜É‘­†r o-–=ôYbkñÙÏ›î‹K'{‚H]ÉYBÄCÞ:$ ²o»†{mAàwTè*2ØûæèÞ2Œ¹ŽèãÒ/÷Å)G®'°·°™®r˜!hX' ;Ê1‰b;h9C|ò¤Çm¤#¾wÎï0"M»—ק¯ÅÓè—©Vr+;rS ŸÕ”O6¼‘Õ\>Õ0¶øÈL¾d8 vùöÌÁ˜ }­gŒ=½â¥Bèì6áÙ <<< ¨¶Å¯èÅ3Âîetï°äT3ZÑÓdÍWh1Òfc¨A×[•âëzW*½g'K(¶¢ÎÖî÷2§#JtDNGœ^ øµ \þLtÑ™Y(/7üCßu>D~h¯ g-XHI'‘E›;iÀæm‰0|ÎǾӊ—{ðÇwdIÁˆ"d…¡(@ÑXKEñçwÎÃ×ÆéûŸüÈiá>²éMXyÒ‡Øñ5·kn‘ê¦0"Ó"žÿãóWÂ1hÛãN¶Î× ‰ƒu–Š0T–hóºEV^¨v£¥­ºa.íDd/û©Z$ b[Íó?}qhxH#MÑ͆)5K”ã—¯0Ôdz=¶ë˜Þ¦¹ÄÍ}ŸiåɈž¯Vk]ï*}¦I<±,«Õr:Wê´Sûš­L{ ½6F¦4¬Æ†ÎÁé“3@ú¥Ì![¾AFÛQä9}àB*ÑVig5-d~Àg,‰ *àx'Þs2©·Õ_«âÌOˆ¬xgÉr<KöF½ª+Q+Œ>âf…C¢’N£…ÑàŠŽº "K!®L¦æ°Ì‰ÐîDÄ1õá ÐbcGü…“î¾ ök$Ìþ‘L–h1ô—'±Œ[U öd̆5Üb JŠü^Ð!Ö!lÊ©²Ð+ö­÷…ÅK_ÊX“ôˆ þ"^EqÆÃ&ÜÆéð˜4ð B8çé„ 8Àpµ¢”Œ´Vƒº5tdÒ^nù#&@툜L@¼AAñ^"—Û Ü8”âYFÊná62 OéVoPD‚.›—æž–œbý¶¼¥¾|ÿ pQÍÈ´GOÙ¤„¾=£ÂW«¡¼]ãÊèïFÚ(Íä`YM“ZèìíñûONjBé4çÑ:²Ðû=…–`"&ª“ÐÛÈŽ Á#Á™t7Š§ˆ¹¥p_$Š Ê–ÇëœÄ23­Œ´Y@Û,‹0AšÙ@"¡ñÍaê-‡‰¤‹œÿã0II”]nõ?°=Ÿ?KMVRAÕIˆþmo==ÝO™,é $è£2¯-Ý›•ÍÔ¾“YþuÄ[EÚø´ÍャRH‘p’Öá.’ÑIúqŠ¯•² CGŒÑ11&”`:¦S™ÎBM¦yIzìÔ#³ÈÞjà2;_UùÂÔÃWáàUZ¼Ïí!sËá-“)Òˆ”.@,Ô`†Øý+“!/1Ìü…ŠáÔí$à ,~f×Ô¶ZmrjÎ9ïóCJÚ&Ž‘÷'^e*UñblD4…ìHø3˜³š( ¼êÕʈuÂV‘èeÕ €lNý[&/YE'öGqŠ_ÐL—¨/a]¦UÒj™#x’±€CÉ4•¸ÒI¢ß«Iy ¡1}ÝådêòоÏ) KIXJÂR‚©€%J7Jâµí·Æ„!<¥/ÒȘ´ˆµÕ=ãëÀ/!h UOY¢­!aðKŒ1&fÔÂéKãçð.'Æ…Ãåzar¤:ù;ÎóÓWŽ×÷ì† Á}´³GÓ.óp”ÅDzS†`´ï¦•?Ž`›’ÕùÞ{–€8ýõøÉ[£ÆL U,òV,×¥.& <<< °%D°ƒ ÉFùÊ8t§!F.1wèð«NOõ¦téYNFädŒï 4ÀsKæ¾`:âYAçûåÚ®óµÄJ—¹ö,Ÿ—Ž<Â-Ä´&§Î'?fùÊiNÙ æ‹Š•°"hŽö‹`³ˆãôÈÜÿèÇ,d…±ˆýÕÚîäÅéUÊîC4¤Eø·ež%3©êþh/ ãJ—1ÀÊdJc˜(Úx´E¢Õ¹O«lÖ‹/Ñt27ãAS–¨7¶à}ì|úÈïaJbs~n6S®hYŽ›•ñ4ˆRõ2j K­ŒHÛQONÑU9jVFÓ@eS”Ȉ j²¡³!˜Ð¢N»¿‘Œ‡F²›© ÙžÚÎ` ¨é$<Öê"EK·‹û<ê#õÏŸfœ=ûQÐ=¸½ÿXXzÂÐ{ ^‚"'¸h7ôCU`÷Ê`ø ý‰a^!8éÐú–MNiöS ~Ïmy‘—cØU\^”Ê/ÜÊÈcÆÊÄñ}Ÿ–µŽ–8=ŒSÖóuJQêäç´µŒ¾—‰xþü¹<Å rˉKCä¨æÕÊ%Ÿã fê c9†@hÐ*o” ¶¤yNÇQ<ðg–3YN^#ELYvUi‘š‘+‡@è_¸ªá|Gøûf^’mùÜÿaÞ‚yÔÆòYý©}6/-l ¥ =2ŸDiõ½Fʃ™ä£`‘FâÔŽS®jyðhÇ£:Öq¬5ûË°–Ï_Ž±‡±)Ÿ.û¥Â×DŽõEäÜTÂUA`Bh¢—Å—›‹ñûOozÑ|xûÄ~¼±ˆÉ2ä’VH$´i‡™'7—×ì=Ï%ÍÇ›Š3ÞÔOùïsž¾¾±÷°b»*ðØu,ÿ|c!/Å ´g'gïn|5ê)Žrœ’þ6§€GÏxëqùáÍTlJ.m?ßT(77©Ln2ÎTþT:/Ä_n*ÈØJÐ ó馬ŽbWŠèõ£ʤ’ßOåÍÂ’{¾ôµ[O¯sý%»å ù—›ŠÅ*ñã.É=¤È)ÿvcAq)ûñæ"$3-Zv2ϸœù.Žñ`ÖÒÖÙaTztøšÒ ø¢± àÞØT .´ü©ùtcѺpi9¸ªHL«™0òôé¦ÜÝÔHÞžEô8Ç3 ŠŽ=¸©ø€¬Ô…JßçŸo,d!-”±',ƒ=×j´hÙÐ\epÚ®rA»Šå°2‘ €¬s2ådŒ`b+ Úµ…h]]Úµ[Ÿ5h×DÌ®QÛÌ">Å:(6]¥ [þ¾¹;Š¿³? ÍÀú™Ì⬃ݘðš¶áüã Fûû2ÞZ±¡wÞ–v{wÆÇlÂV¹Âà64‘˜ÍeÚ²ÀÑî–¹¸oŸw9†° õ;ÕÊ(î™Î†‘ïŸÿ*¬J4bhJ‹ö»"2]¹â¼i66¸ +üª ˆR• 1®äá©/E%>ÎÒHñªsBL,7ÝHʳž‘[Qú¿« IIQ5Ž©_KæãMT7'¼ŠŽxŠ_ç Žúº{%½Sóû±VZ]Iñ‘ù}ŠWw÷ÔïÅßöi®ÌO÷C|%Ý?Jê÷|Ô²‹+©½ýÓt¼«YwœµÅ‰Êҹƣ\Iïq(žÐ¢òïþ'éë)Yã7 ³ÄD:+œÅK³ir.<ÊgM—‘E2îÇÎæ`Ô%Ý9Ú*.H¥ëMÐÏN$Ur,‘3½ LÎ+ú¹Ø伊Ør“ÓÎÀ+©/0E½«©=å@©Ã9ˆ]$WûS”(9©8¸’Ôë(ÐóÐÊú•ƒ2·B¿äA†¯ý:'•âœ“N ïòqê½™TOþËÂ*è…ßVìV~ízäoͪ‚: Óåªõ©ù6'_‚죯ó‘zÁ_æ[Ʀ¸ødÆýñùñõõˆè°¨M§¸ëmêd˜Æ½ÿÀß&é‡}ÅþUÀ(íÇ…‰qÜ8Ã"0ÀM|ís„ü‘xÄ® ësl‘s˜1}a,È0ã5wË8–IBÏ £ŽI§ÄÅ©Qó“´ÃÁ+^æ—"˜Ê v†?K‚¼˜•#9íÄ÷äÐA*X"Ï1†h…g´5+㯋ԅy?BãÊÖ&ê:•Á’ý"Ùp³@’˜è‚û#æ‹G£Ÿ—ªÆS­‡<-Ú­È(=,B1Q©Ÿ08äŸW#}DÜNKLô7£/s¨ò¼ÞyõùØá Ž_½¸f·×~ñ½ßðužé×ëÉ6À,LB„^ÎӿЕ’¦WŠ€3“Œzt|Œ«_üÛœ$[R_¨+‰>,~ˇ¹Ä:IóøôÑñ›yZؽԬgóU' ÚžÒ£yvp2L¥Nå<¶*æçE¸Oò0N­o$k»N£¾íÐÌ‚Ts‚j{CÉÜ.Y¿N_#K'C„ÒH¿eê=Cr“'•oLéR›þn¾ÆÔ÷5'o K/œ[='Ò—Ò“í¥üÈI2YjÁÎm÷ˆŠÌ {ñañ£•„öÏÁ,ö@ÊoÎh ˜—‹ e;@‡4 ‚„³æÁ3GONPìÒv<€gýYœ »açݱ›†ž¿Ì£Ÿ&I&™¯±<2o\_š»L•£wöœk/Æö¶9¹Y°ïEN°ݼ>â9ŒÄ8 |2žuašÁ«Ç<óâg¼ÉåÛ":79Û.B縧øƒxDs9Kæ1qà©‹a`Á˜wËnç%\pÞò=“^2ÆÓxq0»rú>o¢¾¯ÚT° Ñ÷çÿ2í»åFàû¼pí¨ø˜Å6iýÝ\"=ŸT¾ï©Z«E[sYv=[¬- ’âR}®ô¥nžsJs«\§Ïfµ›'y†˜én;—ÿ^ ÙJë¶q[¡Â1é‰@Ø„Šæ^À~ÄÇH¶ÅÐ6§e÷Ûa‡3~°)žÓ#tC€>“Ô¸/¥’>ã#®» 9:¦ü1QÎiÂ÷LT ¨Í×wæoBÙ‹¨*f!'>ioÀn¯Í' ¾Ë“p&&s{ìð‡¿hù)üZ J:DÁÄÄÁ­Ø¡ÑàÓÊ–çiÏW/J›£ØŒoÙÕŽ¤ÂíâR;iR©’™­ ¹U€—T¶´­YQ 8Ý.Gd‹B—Xsÿ>ŽšjJqb™»5óµöËo‡›¢¾)6&©nÜ{ lÑ6­DêA <<< )ÒŒ)£Áµm†6ågåü°˜wô×>úÅû‘Y±á*x8l°O§rb8RíÉpJÐêÎDXºeëai¾žÏ9óÓŠ˜Ài¤æm Øp橨rd_Ïv*^Øcya6˜–ÌÂ…yê!SrÌmz*0ÿWÄ(—…YÀ혅sÔ2aHLíÿ ¢,€ÇZÆOf€iÈe…°\=•#¦[æ58,`HÖ*±ã_ˆ ’]±+¹fýÞöqåDÁÝùg?Œ³²³uÅRø͸õrxB´ú2È8¹W¾Íà×k“Thoì©0§3Þ©‚HÑ9K •¥)mTFCi‚S­—†ŽxÆîħüêÝ û³Ú4¼•7b‚dþññ›GϬÇöâîÕvÄ[iÈîÕƇ۴Ì$m3}ã*s¾†!:šô7/hÁžéã?³Íür­!0™Ø­‹Ï7j%2ô&ì…‰*Ê‘J;‰ï5‘×Ð\Þ°ÔðÔá'T ¤ÈóÃ2ãáÕÿxB“©à+]ŠÎÏiq'n{.îO¹È,ɬ"|”AoäpßØ­Žø»Š©†×5GhÝ·ûÐßîCO¿mîî¦Þ%)Ÿ_®¯ B²´tÏê#}ƒ¨‹lò-²Ér‘MV8[&ƒ‰™Iâô–˜'ÎÉ3MŠoɾ$+$+‰xÍ?—- ù¥;. ˜R¯tq˜BŽfæ!âz¦‰0…N9ÖñS'“Ü»™6A'í@919ZµÓ¦71"œªB:ܤK*jx ‚Âä|ŠfÄÆn PO,E\-å6VÈMss$¹ë»uA/ýîÁráØäÉ3¤˜$"YQÑ$˜É—ûò'CEäT„¥r_<7Ñ„s2¢Dææ¤)×7]ÓLH²!SÄujº›¥4.YŠÞSb*¿öu×7ÞöýT|nöÓ¿‹Xý¤P‚¬7EòéŸ%¿D¡1ðe&I/•›ˆÖ‡+¶ƒ(h“ÎÄ1bÛÂÊ‘YÚ…“å%®n Àê{[jC‹§(†µ®RâØ”CžsØâ}w(^ ]¦Ý$Š‡$ˆj|ª>Þl6Lo4°ø’4¤F@X„êÁÔleºë¨DRœ»9ük¨ØDñ¹Ö´€ƒ\ uäÌä­œh/)øôÈ,[*BÅ÷J<›Åp»¢í´J¥2&eÒØvâ!q*äh­ÈãÐݺ—u`ÒÑÀô-"u’ ¦mf^ÒÊtJ¢±-^J„‡D‰³×Jˆ€‰_™ÈøòÍ #gg }íõã›$¿\¶4AD;ÖÆþÁÒÉb8YËI;䯑ûÊÚ™6^äS ËR yPÝÈ4=q:ô¯6©O©Ê6½‰Ô=iÛ/ši:mz÷üäñ+Zq@Q0EQPLÑä Q H4Ñᇤ7zdQnLß!¯Ð šÄ|éáŠ+Žø:Óôøý[Hô9B¢®•cÌ—ÍÎîùòÓã²ûß³Qlã¦Ætg¿ÚÀ˜6Í I–Âx¸A”MW çÈ„ôÆÚÈ/QF¥F²JåîH· .Sw.·ùù™a–”8eRšþ‘!%hA{““¢Ž)pÿmÉÁù³Hò” 'VÐö‚VÐÌáS®‘é)4Ê r"Dî¦E’wX2 - <<< ­o$«±=Í©Ã6 ¹)Vl[tÓS²ý1Râ!È KN9%nàcP––,¦$F”–h<ò4ôäÉ‚iÅ¥ŒK{>¥ñ|¥U€†ïä‰Î;)Ãê2gJû¾|/ˆò‹1bÂCÛsbâé™É™…ÍÏÛêiõóÈÄ ;ºs9ûvŒKy™‰¾þÕo‹ Ï‹½¿ñ²9À´aJa¥Ä€l«tåªÀ[EŒ,jÃ_Uèùí¿qƒ® ×µT«>ðá3ÚT®ü³×G¤¢ 8‹¾xÅœ=x¢ÖÏYmñp®*îøÝÅ©Æ÷‡‡¤v‚¶øñGäÆÎTUiJª$QIµ'É&»‹À…jÿUí_ þ©±¹ÿϵ{÷Ä?Ý4Iâj`}¨é1WݽÑSLð{îüóY‡OÌû2­_ÏÝvGŠúîNWÜ­L²¡ò·ïîüóƒ±ØoâFâwÛ´†£iwïýªqsç‘gï®2‡76åá_]ñÓÆ]ëušÄà¿mz‡9“6»‡^•šñ80\ÏdçWÙSw7&mãÞ_ëÛÔ›þfp(«5:í>€ú¸ëÖø?üŸ~º÷Ošˆ¸´AN•¥swÃ4tãÞ]å.lLtaƒ~€ÄÈ¿ú{Э’LùÞ]}ïÁ?ÿ󽻊WâÉÏ5@*ÐH¯wt“d@;Ý)Daø)u …6ÄObcš–Ì4‘HYã·I?è[ýÃ#}øcúéðÇ søcBßMÿăÃ?4Ÿü趻Û̓ƒ-„×»NuåM8"öÜ©ÕŒ6-úFù§i6ÊÔVRãh੪S.ýÓ‰¯¡Â½¼ÍžjË,H¯júÞöÖÎÖ>ýgM“lÑY1%Û†ÖŸ„–8W°WIÑâ;ÿ?ÿÿM¦§·fo 0 suricata-3.2.1/libhtp/test/files/65-post-chunked-invalid-3.t0000644000000000000000000000051413051004451020360 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/63-post-chunked-invalid-1.t0000644000000000000000000000052413051004451020355 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 80000000 p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/56-path-utf8-overlong-3.t0000644000000000000000000000035313051004451020002 00000000000000>>> GET /%e0%80%a6.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/69-long-response-header.t0000644000000000000000000000037613051004451020223 00000000000000>>> GET / HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Apache Apache Apache <<< Apache Apache Apache Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/gztest-01-minimal.gz0000644000000000000000000000007113051004451017275 00000000000000‹œTôPÿ ÉHUHË,KUHʯÈÌKW(ϬJ,J)VÈ*Í-P(,ÍLÎΩÔÍ*‘Þ%suricata-3.2.1/libhtp/test/files/66-post-chunked-split-chunk.t0000644000000000000000000000052413051004451021035 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: chunked Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 b p=01234 >>> 5678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/00-adhoc.t0000644000000000000000000000030013051004451015224 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/generate-gzip-tests.php0000755000000000000000000001716013051004451020175 00000000000000#!/usr/bin/env php compressionMethod = $m; } public function setCrc32($crc) { $this->crc32 = $crc; } public function setInputSize($len) { $this->isize = $len; } public function setXfl($xfl) { $this->xfl = $xfl; } public function setFilename($filename) { $this->filename = $filename; } public function setComment($comment) { $this->comment = $comment; } public function setExtra($extra) { $this->extra = $extra; } public function setTextFlag($b) { $this->textFlag = $b; } public function useHeaderCrc($b) { $this->useHeaderCrc = $b; } public function setHeaderCrc($crc) { $this->headerCrc = $crc; } public function setFlags($f) { $this->forcedFlags = $f; } public function getFlags() { if ($this->forcedFlags !== false) { return $this->forcedFlags; } $flags = 0; // FTEXT if ($this->textFlag) { $flags = $flags | 0x01; } // FHCRC if ($this->useHeaderCrc) { $flags = $flags | 0x02; } // FEXTRA if ($this->extra !== false) { $flags = $flags | 0x04; } // FNAME if ($this->filename !== false) { $flags = $flags | 0x08; } // FCOMMENT if ($this->comment !== false) { $flags = $flags | 0x16; } return $flags; } public function setData($data) { $this->data = $data; } public function writeTo($filename) { $fp = fopen($filename, "w+"); $this->write($fp); fclose($fp); } public function write($fp) { $header = ""; // header (ID1 + ID2) $header .= "\x1f\x8b"; // compression method (CM) $header .= pack("C", $this->compressionMethod); // flags (FLG) $header .= pack("C", $this->getFlags()); // mtime (MTIME) $header .= "\x9c\x54\xf4\x50"; // extra flags (XFL) $header .= pack("C", $this->xfl); // operating system (OS) $header .= "\xff"; // FEXTRA if ($this->extra !== false) { $header .= pack("v", strlen($this->extra)); $header .= $this->extra; } // FNAME if ($this->filename !== false) { $header .= $this->filename; $header .= "\x00"; } // FCOMMENT if ($this->comment !== false) { $header .= $this->comment; $header .= "\x00"; } fwrite($fp, $header); // FHCRC if ($this->useHeaderCrc) { if ($this->headerCrc !== false) { // "The CRC16 consists of the two least significant bytes of the CRC32 [...]" fwrite($fp, pack("v", crc32($header))); } else { fwrite($fp, pack("v", $this->headerCrc)); } } // compressed blocks $compressedData = gzcompress($this->data); // The gzcompress() function does not produce output that's fully compatible with gzip, // so we need to strip out the extra data: remove 2 bytes from the beginning // (CMF and FLG) and 4 bytes from the end (Adler CRC). $compressedData = substr($compressedData, 2, strlen($compressedData) - 6); fwrite($fp, $compressedData); // CRC32 if ($this->crc32 === false) { fwrite($fp, pack("V", crc32($this->data))); } else { fwrite($fp, pack("V", $this->crc32)); } // uncompressed size (ISIZE) if ($this->isize === false) { fwrite($fp, pack("V", strlen($this->data))); } else { fwrite($fp, pack("V", $this->isize)); } } } // 01: minimal file $gz = new GzipTest(); $gz->writeTo("gztest-01-minimal.gz"); // 02: with FNAME $gz = new GzipTest(); $gz->setFilename("file.txt"); $gz->writeTo("gztest-02-fname.gz"); // 03: with FCOMMENT $gz = new GzipTest(); $gz->setComment("COMMENT"); $gz->writeTo("gztest-03-fcomment.gz"); // 04: with FHCRC $gz = new GzipTest(); $gz->useHeaderCrc(true); $gz->writeTo("gztest-04-fhcrc.gz"); // 05: with FEXTRA $gz = new GzipTest(); $gz->setExtra("EXTRA"); $gz->writeTo("gztest-05-fextra.gz"); // 06: with FTEXT $gz = new GzipTest(); $gz->setTextFlag(true); $gz->writeTo("gztest-06-ftext.gz"); // 07: with FRESERVED1 $gz = new GzipTest(); $gz->setFlags($gz->getFlags() | 0x20); $gz->writeTo("gztest-07-freserved1.gz"); // 08: with FRESERVED2 $gz = new GzipTest(); $gz->setFlags($gz->getFlags() | 0x40); $gz->writeTo("gztest-08-freserved2.gz"); // 09: with FRESERVED3 $gz = new GzipTest(); $gz->setFlags($gz->getFlags() | 0x80); $gz->writeTo("gztest-09-freserved3.gz"); // 10: Two parts (compressed streams) $gz = new GzipTest(); $fp = fopen("gztest-10-multipart.gz", "w+"); $gz->setFilename("file1.txt"); $gz->write($fp); $gz->setData("The quick brown fox jumps over the lazy dog."); $gz->setFilename("file2.txt"); $gz->write($fp); fclose($fp); // 11: Invalid compression method $gz = new GzipTest(); $gz->setCompressionMethod(0x07); $gz->writeTo("gztest-11-invalid-method.gz"); // 12: Invalid CRC32 $gz = new GzipTest(); $gz->setCrc32(0xffffffff); $gz->writeTo("gztest-12-invalid-crc32.gz"); // 13: Invalid ISIZE $gz = new GzipTest(); $gz->setData("Grumpy Wizards make toxic brew for the Evil Queen and Jack."); $gz->setInputSize(0x10); $gz->writeTo("gztest-13-invalid-isize.gz"); // 14: Invalid extra flags (XFL) $gz = new GzipTest(); $gz->setXfl(0xff); $gz->writeTo("gztest-14-invalid-xfl.gz"); // 15: Invalid header CRC (FHCRC) $gz = new GzipTest(); $gz->useHeaderCrc(true); $gz->setHeaderCrc(0xffff); $gz->writeTo("gztest-15-invalid-fhcrc.gz"); ?> suricata-3.2.1/libhtp/test/files/20-ambiguous-host.t0000644000000000000000000000157213051004451017132 00000000000000>>> GET http://example.com/1 HTTP/1.1 Host: example.com <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 8 12345678 >>> GET http://example.com/2 HTTP/1.1 Host: foo.com <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 8 12345678 >>> POST http://www.example.com:8001/3 HTTP/1.1 Host: www.example.com:8001 Content-Length: 8 12345678 <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 8 12345678 >>> POST http://www.example.com:8002/4 HTTP/1.1 Host: www.example.com:8003 Content-Length: 8 12345678 <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 8 12345678 >>> POST http://www.example.com:80/5 HTTP/1.1 Host: www.example.com Content-Length: 8 12345678 <<< HTTP/1.1 200 OK Date: Mon, 26 Apr 2010 13:56:31 GMT Content-Length: 8 12345678suricata-3.2.1/libhtp/test/files/38-invalid-request-3-invalid-t-e.t0000644000000000000000000000054013051004451021552 00000000000000>>> POST / HTTP/1.1 Transfer-Encoding: ABC Host: www.example.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla Cookie: 1 b p=012345678 1 9 0 Cookie: >>> 2 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/68-invalid-request-header.t0000644000000000000000000000041313051004451020533 00000000000000>>> GET / HTTP/1.0 Host: www.example.com User-Agent Mozilla Header-With-NUL: BEFORE AFTER Cookie: p=1 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/77-response-folded-headers.t0000644000000000000000000000073613051004451020703 00000000000000>>> POST / HTTP/1.0 Content-Length: 12 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla p=0123456789 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Server Connection: close Content-Type: text/html Content-Length: 0 >>> GET / HTTP/1.0 <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apach2 Connection: close Content-Type: text/html Transfer-Encoding: chunked 9 012345678 1 9 0 suricata-3.2.1/libhtp/test/files/34-invalid-hostname.t0000644000000000000000000000034513051004451017430 00000000000000>>> GET /?p=%20 HTTP/1.0 Host: www.example.com: User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/45-auth-digest-unquoted-username.t0000644000000000000000000000045313051004451022065 00000000000000>>> GET / HTTP/1.1 Host: www.example.com Authorization: Digest username=ivanr, realm="Book Review", nonce="OgmPjb/jAwA=7c5a49c2ed9416dba1b04b5307d6d935f74a859d", uri="/review/", algorithm=MD5, response="3c430d26043cc306e0282635929d57cb", qop=auth, nc=00000004, cnonce="c3bcee9534c051a0" suricata-3.2.1/libhtp/test/files/01-get.t0000644000000000000000000000031513051004451014734 00000000000000>>> GET /?p=%20 HTTP/1.0 User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/files/12-connect-request.t0000644000000000000000000000107013051004451017275 00000000000000>>> CONNECT www.ssllabs.com:443 HTTP/1.0 <<< HTTP/1.1 405 Method Not Allowed Date: Sat, 12 Dec 2009 05:08:45 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8g PHP/5.3.0 Allow: GET,HEAD,POST,OPTIONS,TRACE Vary: Accept-Encoding Content-Length: 230 Connection: close Content-Type: text/html; charset=iso-8859-1 405 Method Not Allowed

Method Not Allowed

The requested method CONNECT is not allowed for the URL /.

suricata-3.2.1/libhtp/test/files/15-connect-complete.t0000644000000000000000000002063113051004451017424 00000000000000>>> CONNECT www.feistyduck.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729) Proxy-Connection: keep-alive Host: www.feistyduck.com <<< HTTP/1.0 200 Connection Established <<< Proxy-agent: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny4 with Suhosin-Patch >>> ¤ KCZæ|ö›„ðµæûɱå8·êçÈyêCØ`1å|—šFÀ Àˆ‡98ÀÀ„5ÀÀ ÀÀED32À ÀÀÀ–A/ÀÀÀ Àþÿ 1www.feistyduck.com  # <<< 0,KCZæ5šIò|Ö„ßí.JLFf*OOî¢iŒP oA9#È ÄÁé0‚å0‚Í ešÜ£wb0  *†H†÷ 0Ê1 0 UUS10UArizona10U Scottsdale10U GoDaddy.com, Inc.1301U *http://certificates.godaddy.com/repository100.U'Go Daddy Secure Certification Authority10U079692870 090629122404Z 110629122404Z0]10U www.feistyduck.com1!0U Domain Control Validated10Uwww.feistyduck.com0Ÿ0  *†H†÷ 0‰ÜÍ‘‹Ÿ«Ê2K< ~uԆČõyЩße:—ìUqð!º£«¢Ý5—iÛ#ïF‘ûýé4A_ò¹«ñ+Šþ”ŠÑïߦøÙéŽ ØÆrÛ‡j è¢ÞÎ/ý<ôfBï°Èb„×tY€~Ë#žzþ¹^Ñhšç¢¾TðAÈV•£‚¿0‚»0Uÿ00U%0++0Uÿ 02U+0)0' % #†!http://crl.godaddy.com/gds1-6.crl0SU L0J0H `†H†ým0907++http://certificates.godaddy.com/repository/0€+t0r0$+0†http://ocsp.godaddy.com/0J+0†>http://certificates.godaddy.com/repository/gd_intermediate.crt0U#0€ý¬a2“lEÖâî…_šºçv™hÌç0-U&0$‚www.feistyduck.com‚feistyduck.com0UŒ¶Ôçc÷íÆì›[£C†Ô=50  *†H†÷ ‚t(¥j~³¯ÙR=.ì1™¨à4ÒFîÅ·¿îÝ3´ÌY»ÁpÜ´ôÌÊ Bè¨lôN„…xP—L¾¹tvÕ¢U,Ƈ£µ™¬„‡uü¿LÌnÄß=·qôèñQ@"(IàK‡¨4Ì¢ÝZц6d5oownëò…P˜^«S­‘#cœÍ¹²c:áôh5•Sîÿ0‚û0‚d  0  *†H†÷ 0»1$0"UValiCert Validation Network10U ValiCert, Inc.1503U ,ValiCert Class 2 Policy Validation Authority1!0Uhttp://www.valicert.com/1 0 *†H†÷  info@valicert.com0 040629170620Z 240629170620Z0c1 0 UUS1!0U The Go Daddy Group, Inc.110/U (Go Daddy Class 2 Certifi <<< cation Authority0‚ 0  *†H†÷ ‚ 0‚‚Þ×êWI¡[ë×_H†ê¾Ýÿäïgôeh³Wq ^w»í›Iép€=VcoÚòÌÐ?T"TزÔÀu=KÇwÃ>x«µ k/j+±Åˆ~Ä»°ÁØE'oª7X÷‡&×Ø-ö©·r6N¦?e˜’Û*n]¢þˆà ÞåáëË:Õâ¢-ØŽ¯_= ¶\¥e8E™£``tÅA¥rbbÅo_B¾Qe¨®#jüx©M€Ãú«Zü¡@¤Êþ²Èï^s îw½šöy˜¼±g¢ Ý XÆD{ >b(_ºASXÏ~8tÅøÿµi„tê—¯£‚á0‚Ý0UÒÄ°Ò‘ÔLq³aË=¡þݨjÔã0ÒU#Ê0Ç¡Á¤¾0»1$0"UValiCert Validation Network10U ValiCert, Inc.1503U ,ValiCert Class 2 Policy Validation Authority1!0Uhttp://www.valicert.com/1 0 *†H†÷  info@valicert.com‚0Uÿ0ÿ03+'0%0#+0†http://ocsp.godaddy.com0DU=0;09 7 5†3http://certificates.godaddy.com/repository/root.crl0KU D0B0@U 0806+*http://certificates.godaddy.com/repository0Uÿ0  *†H†÷ µ@ù§öêþ¤BZD÷Ô…F‰À¾žããëÅãX‰’ŸW¨q,HѲy¬5°NX³˜ÑÈɃŸxD  ˜Üvze m€Ä Ë­G>q¾wKÌwÐôVkKšŠˆ#¨QðƒL«5¿F~9Üu¤®è)ûï9OUgë0‚ç0‚P0  *†H†÷ 0»1$0"UValiCert Validation Network10U ValiCert, Inc.1503U ,ValiCert Class 2 Policy Validation Authority1!0Uhttp://www.valicert.com/1 0 *†H†÷  info@valicert.com0 990626001954Z 190626001954Z0»1$0"UValiCert Validation Network10U ValiCert, Inc.1503U ,ValiCert Class 2 Policy Validation Authority1!0Uhttp://www.valicert.com/1 0 *†H†÷  info@valicert.com0Ÿ0  *†H†÷ 0‰Î:qÊå«ÈY’U׫ØtùîÙöUGYeGUÜë˜6<\S]Ó0Ï8ì½A‰í%B $k <<< ^³|ÝR-LæÔÖ}ZY©eÔI-$MPoµÁ…T;þqäÓ\Bù€à‘ [96gó?U|?´_ds4ã´¿‡døÚÿ7'Á³C»ï{n.i÷0  *†H†÷ ;PooP”™Ib88Kø¥È>§‚ö+ÇèÅÎè:‚ËŽM½¨X¡yµ»é¯AÙ4î! 2I(ôÄŽVÕR3ýPÕ~™läÉLüËl«f³J!Œåµ 2>²Ìl¡Üš˜L[óιž¥rJ·?<æhø¾ítL¼[ÕbCÝ ‰€Ö}ä@Ë»Ü6Ö“ÓJý Õ „Ò9¤_R ¸t˘¼éQ„Ÿ‘.cœrû´´×~ÕZÁyºB *)þ2JFzc^ÿY7{íÜý3ŠF­;rÚè†x[§ÛÊxt}êŸÌÝ3ÝbÛˆ®ªt}àôÖâ½h°ç9>$!Ž³€·;3›X滎™Wƒ[GCÙÔu¯¾¿MW'9jÏ;˜Rqâ&…¯É·‘Àä”Ý*QÿæLÇPb£„Ü4g#d)´šQ.‘gÆP›qQê“ÀZNuè½¾KÙØ׶$Yx[­¥Xgþ’qŠmX”Œ?:jÀ)m-_ÜNÁ€j÷hhk¦çÌõ¥só6ÛY[:øfÚ:×ýÞ{ÐÆ8Ý"4*n´*GÒqJ~\-8xáwõÌ­vdCj.uÙ?´þ©¼>> †‚€¢7Ì]g¡Öª½!bçd’gf’E[z'Í;¬?ú5+ê…T“T'0y‰Ò ã^¯àöÚæ×gÁLW„s1¼Ö¦cÊ½Ê 'nç¨*ÅÄøá°M1c¡x éïñ„×óDOœxu÷§:»M+jkÜÒ.ÐUÚ~¥HVr0ç„[ÊBÑÓ×®%ç|ædÖ¨ µÁ˜ÿAYT^k?PÁm­‘?; .?D…´­ö <<< ÚÖÐæDÔ@ˆêQÎ3°~Ëz=¦…c+%¸Ætai²²ýÇÆ\¼hÊKá•Õ¤Ï>ñwhÊìI梨œç–>(#þ(ÿÍ V³‡;Hbä¨ê\ZVF¦Šñ1˜ŸØa¾»í½OÓ=cåÑrBs׌šKÒ‘Ó7-\“$·Á‚…›#jËßßúvâ–zôÑ:ˆ4øü3â™úôŽ¦^,=g˜&†nÃLÿWÞòˆÇãc ðííè0ÖÖ$`­DÍ‚éÒãwe½4{é;Ùùcʪ__\àÑ0õÀ:øg%‘\z­ˆ.§Ð.ü­˜æF_xÑ,;i D½»´ k>> ÀqieâUc/ìĦÜ7ÒýóU:€i{'EÚdE±ÙªW‰k&öN1™Ò¿Þf‚ “}6¹òXutí:Nþ4þ¸\¸›¾ZóÁ -á{a9:ƒ®Ñm·'9aÄpóZÓ7M/I‰“½ËÚ­s×·ŒÂEšÑlsÛ.ëüé wû”é‹Dœ9mùu ÃP½›Ü 8Ä ‹Ö׳;æßBœô.ëîZ€rgsùèö®–<.î^„+E ´,ö'ÍëOþpqæ áZ©¤Š§LŸ\Й**9¬äk‡¹+…r/tâ¯Êq¹~¿¤#k¢×ºêJ(óE¤9Ê5ÙÀøK{¢cÆ…ÕCæðUÔ}É ˜jLY¼yôg3×AFz›\}`ˆ;1ý¹QX»¶õº¾s„ì%znÂRlˆcOBõ@@%f±Xý‰ñ¡ì™FÀÙ˜ýÒ¢çºòN(Ýn}%ebG¥}%±¶@sÃgy•6Û›ÑHµ±1hìòz\t:D·1t¯a{Îc:6ÑHÊý?]úŒŠ¶ý¢ûü Ña °Ÿ¶^BÄD%i)>ö‰åd¤*[²·ò.ù~/[ÎýBJo<{£­’!FHÀi…Öê0š¦þ~-Áò Ø¦Ž¥·¸þpÍšž†EÖþ?¿6Pþ¶åV:—Dr÷–˜‚ÕfËíâL¨UôØ—µ®Ž» u&ëܽ[ã ´´Á¢Ë²¼ç¤ñÊJ—ßU­tù6Ye%­Þ]øÁ5ªÕ]†¿[v®×=´Në[ûº]˜‰âÙ –µk\Ã[Úû¡ â¥Í0²,ý°Àû^I-=z8Ò0áÍ4m¹SzÉ@®žÂ+É "±‚Ý•ÌÙÀƒ ´UPí¤i¸]KöËý ðö©–ŸeA <<< 0[ž^z'äõ€¿8çnW®uà¥'—È‚ev\o5¶Åø:e]Jµ¥ìHÈש$ѧ*‹¸~ j·ŠxtV.t¢0…Õ<\1 퇔rÁÑQºòFþ9É—¹qðë;÷;{­o…¬ô žÂ:ž¯׋†K¥\ùOâ™òu¦Ž ×´Ü¿µÏãgÁáÈXX+‰aóXc`B ¦U¤Ê¯õá¨.z$Á¤äB){ d/ò‚ís ¦ˆ<êêlHKÑUâ– óì4ò³Äc ‰êømÔ™—‚]˜l¼Ê+­×‚±dX œIÂ)6ê ²½;¾õ ¢AaÍ@rs“’Ä&M1IÚG\VÆ,—¿ñ'ö`Å2× ûf9Ýg[Éæ"±owL‘”rí #ùéØk@s’\T^Ö¡Áá¢ú<2Ab!ŸÇú>ÊèÊÖ\´K¾ªÐÕ.Ä¡îZ4)Úk8„á¸CqâÇœü®h:Øz”~!¡~҉«£þŽq ì²Aâcµ4ꨗA´™S@/fÖ™klCì•©ì 5ÿ_¨õ‘Æ»ç´Nƒ‡Û»Y,4³¯ï§|ˆÂÊÍn®ÜÇbfÏÿ4ƒ»°?`«’qÿÍ‘tçx{º*(ZÂå×TÄ7Óf—72Ê*WúÜ- Øa•vÁúo§‰Ü»ÄúèÎt÷~†Ôˆ1É?p`ç7¥H\ŽÙÒ´(–³¹˜FÕyOª¿¦‹i2ÇËú»Tü· ”nã®÷çãRi ‰#¤,nLç °Xø[hîÑ‘,fB5~¥Û¦sÔ_^!i«Ù#&ß¿—(B/ì¹C†ÎžŒz\h¤zf…M%óù¨©± Çtyú9¨óÔ‡½­É¼7{ÁÚ0hâ$„3ì™&y…3 f3ÆàŒDÃŽ¿ÇüÀÒ­)šatèÙ…Ö·=\àu¿ C†€Ñ_Ž¾HŸw‹èWHLoó2ÿÙ¸jŽìÞª¿Ê _{Ë©ÇÝô«²Ë3›ÅbÆ%&b«#õY,%U]s5\Še8츩yZûD{ëòO®,e´ìåkrkÅ}ÞÑäù%uà>eXbœÓ-.ìL‚˳ÍQÅMâinåØ>s_•÷ÀðoM`èö rµ*ÁÓb‰VÁ5‘[Çg—Ð#÷äKAù›hv”@ÁµÞVù£¼Ø:ZâQÐçÉb6*÷Æv#ÏFÁXê~Ÿ¤!³†ÊA@$Ëè³ò³cå!«oÛj`ì2‰3b’ÂœŸ­s¡Pˤy4 rÀ î7Puù-„©¸„%.%-ã¶Yj ˆ&ü=ôÐ5]UñżBïÈÙC«àÔAˆ—Pzu½Åï2cÙpê+¤»X†ý 2å¾ì¶Èཨœ<‰I)5 ½žxò²o› °yØïÊJt¾B­ð0×Úì«|èPeHîÈü$Zˆ÷0CFpW‚º.ßõEðe1uø(e˜v ÓOŸ\jCJÈ5>JÃw~$ø_R¹NÑpáŽI>Ï›Œž8c7ª÷2Ëƪ¿Ç/Ä£e§?[hƒ©— r½AF‡F¢<3èG HIÖhMv÷’ŠìUøù#‘M&äËHû^ÝJóŽ»Ú~µË„ߌ5øÞÌ-7uߦ\åê´zfuK±/ì35?kruñ5`hâ¾MúG*Q ¼½%$(<´ì>ê8Oòæ¡ÿ¾uô*Z»ÛWòï<qÖšx¿”Öu!?CÀ5Ô†ÙoĬPÈ:È !n09à̾C^@ä4 ÞÝŒcmo2ä¢*Øö‘³ï€Æ«ž@y)Ó\ <<< þHyœ´ÓØ=wB¥†¸ - !ÈN5G âgb_L–&¶º$öÎF¤U„óX?f¶y(¤—£Ùܾ8eí=–ä°lßrç·)ŠBÿ¸%ó0.ȵ­ÙƸæ¹lÑîbŸ]÷ÌsˆŒô­Äaõ! Z„¥–²IÓ4V%ûÚ—}öMó™êÚ?;U/D¹ª3í1ØÐEò`©H;l•ëñ¯”í^]k¬òß‹Bx®ƒ2䀷L]¼,*±snßÊ°]Ò^–èÌî²Sg *ðKxH6Ê%”õÐô >>>  _øÜ#÷Þuy6ÝÀ˜øV€‡:h(¨Ì ˆWXòaЩsuricata-3.2.1/libhtp/test/files/55-path-utf8-overlong-2.t0000644000000000000000000000035013051004451017775 00000000000000>>> GET /%c0%a6.txt HTTP/1.0 Host: www.example.com User-Agent: Mozilla <<< HTTP/1.0 200 OK Date: Mon, 31 Aug 2009 20:25:50 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 12 Hello World!suricata-3.2.1/libhtp/test/test.h0000644000000000000000000000504413051004451013604 00000000000000/*************************************************************************** * Copyright (c) 2009-2010 Open Information Security Foundation * Copyright (c) 2010-2013 Qualys, Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * - Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * - Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * - Neither the name of the Qualys, Inc. nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ /** * @file * @author Ivan Ristic */ #ifndef _TEST_H #define _TEST_H #include #include #include #include #include #define UNKNOWN 0 #define CLIENT 1 #define SERVER 2 #ifndef O_BINARY #define O_BINARY 0 #endif #ifdef __cplusplus extern "C" { #endif typedef struct test_t test_t; struct test_t { char *buf; size_t pos; size_t len; char *chunk; size_t chunk_offset; size_t chunk_len; int chunk_direction; }; int test_run(const char *testsdir, const char *testname, htp_cfg_t *cfg, htp_connp_t **connp); int test_run_ex(const char *testsdir, const char *testname, htp_cfg_t *cfg, htp_connp_t **connp, int clone_count); #ifdef __cplusplus } #endif #endif /* _TEST_H */ suricata-3.2.1/libhtp/README0000644000000000000000000000506613051004451012361 00000000000000LibHTP ============================================================================ Copyright 2009-2010 Open Information Security Foundation Copyright 2010-2013 Qualys, Inc. ============================================================================ LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. The goals of the project, in the order of importance, are as follows: 1. Completeness of coverage; LibHTP must be able to parse virtually all traffic that is found in practice. 2. Permissive parsing; LibHTP must never fail to parse a stream that would be parsed by some other web server. 3. Awareness of evasion techniques; LibHTP must be able to detect and effectively deal with various evasion techniques, producing, where practical, identical or practically identical results as the web server processing the same traffic stream. 4. Performance; The performance must be adequate for the desired tasks. Completeness and security are often detrimental to performance. Our idea of handling the conflicting requirements is to put the library user in control, allowing him to choose the most desired library characteristic. | IMPORTANT LIBHTP IS NOT YET CONSIDERED STABLE. USE AT YOUR OWN RISK. DO NOT | USE IN PRODUCTION. WORK IS CURRENTLY UNDER WAY TO ENSURE THAT | LIBHTP IS SECURE AND THAT IT PERFORMS WELL. | STATUS LIBHTP IS VERY YOUNG AT THIS POINT. IT WILL BE SOME TIME BEFORE | IT CAN BE CONSIDER COMPLETE. AT THE MOMENT, THE FOCUS OF DEVELOPMENT | IS ON ACHIEVING THE FIRST TWO GOALS. See the LICENSE, COPYING and NOTICE files distributed with this work for information regarding licensing, copying and copyright ownership. INSTALLATION ------------ Assuming you're using an already packaged version of LibHTP, the installation process should be as simple as: $ ./configure $ make $ sudo make install If you've retrieved your LibHTP directly from the repository, you will need to perform the following steps first: 1. Update the version number in VERSION. 2. Run autogen.sh, which will update the build system. DOCUMENTATION ------------- The best documentation at this time is the code itself and the Doxygen output (which should be all right). There's also a quick start guide in the doc/ folder, which should give you enough information to get going. LICENSE ------- LibHTP is licensed under the BSD 3-Clause license (also known as "BSD New" and "BSD Simplified".) The complete text of the license is enclosed in the file LICENSE. suricata-3.2.1/m4/0000755000000000000000000000000013051004502010605 500000000000000suricata-3.2.1/m4/libtool.m40000644000000000000000000112631113051004463012446 00000000000000# libtool.m4 - Configure libtool for the host system. -*-Autoconf-*- # # Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc. # Written by Gordon Matzigkeit, 1996 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. m4_define([_LT_COPYING], [dnl # Copyright (C) 2014 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program or library that is built # using GNU Libtool, you may include this file under the same # distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . ]) # serial 58 LT_INIT # LT_PREREQ(VERSION) # ------------------ # Complain and exit if this libtool version is less that VERSION. m4_defun([LT_PREREQ], [m4_if(m4_version_compare(m4_defn([LT_PACKAGE_VERSION]), [$1]), -1, [m4_default([$3], [m4_fatal([Libtool version $1 or higher is required], 63)])], [$2])]) # _LT_CHECK_BUILDDIR # ------------------ # Complain if the absolute build directory name contains unusual characters m4_defun([_LT_CHECK_BUILDDIR], [case `pwd` in *\ * | *\ *) AC_MSG_WARN([Libtool does not cope well with whitespace in `pwd`]) ;; esac ]) # LT_INIT([OPTIONS]) # ------------------ AC_DEFUN([LT_INIT], [AC_PREREQ([2.62])dnl We use AC_PATH_PROGS_FEATURE_CHECK AC_REQUIRE([AC_CONFIG_AUX_DIR_DEFAULT])dnl AC_BEFORE([$0], [LT_LANG])dnl AC_BEFORE([$0], [LT_OUTPUT])dnl AC_BEFORE([$0], [LTDL_INIT])dnl m4_require([_LT_CHECK_BUILDDIR])dnl dnl Autoconf doesn't catch unexpanded LT_ macros by default: m4_pattern_forbid([^_?LT_[A-Z_]+$])dnl m4_pattern_allow([^(_LT_EOF|LT_DLGLOBAL|LT_DLLAZY_OR_NOW|LT_MULTI_MODULE)$])dnl dnl aclocal doesn't pull ltoptions.m4, ltsugar.m4, or ltversion.m4 dnl unless we require an AC_DEFUNed macro: AC_REQUIRE([LTOPTIONS_VERSION])dnl AC_REQUIRE([LTSUGAR_VERSION])dnl AC_REQUIRE([LTVERSION_VERSION])dnl AC_REQUIRE([LTOBSOLETE_VERSION])dnl m4_require([_LT_PROG_LTMAIN])dnl _LT_SHELL_INIT([SHELL=${CONFIG_SHELL-/bin/sh}]) dnl Parse OPTIONS _LT_SET_OPTIONS([$0], [$1]) # This can be used to rebuild libtool when needed LIBTOOL_DEPS=$ltmain # Always use our own libtool. LIBTOOL='$(SHELL) $(top_builddir)/libtool' AC_SUBST(LIBTOOL)dnl _LT_SETUP # Only expand once: m4_define([LT_INIT]) ])# LT_INIT # Old names: AU_ALIAS([AC_PROG_LIBTOOL], [LT_INIT]) AU_ALIAS([AM_PROG_LIBTOOL], [LT_INIT]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_PROG_LIBTOOL], []) dnl AC_DEFUN([AM_PROG_LIBTOOL], []) # _LT_PREPARE_CC_BASENAME # ----------------------- m4_defun([_LT_PREPARE_CC_BASENAME], [ # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in @S|@*""; do case $cc_temp in compile | *[[\\/]]compile | ccache | *[[\\/]]ccache ) ;; distcc | *[[\\/]]distcc | purify | *[[\\/]]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } ])# _LT_PREPARE_CC_BASENAME # _LT_CC_BASENAME(CC) # ------------------- # It would be clearer to call AC_REQUIREs from _LT_PREPARE_CC_BASENAME, # but that macro is also expanded into generated libtool script, which # arranges for $SED and $ECHO to be set by different means. m4_defun([_LT_CC_BASENAME], [m4_require([_LT_PREPARE_CC_BASENAME])dnl AC_REQUIRE([_LT_DECL_SED])dnl AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl func_cc_basename $1 cc_basename=$func_cc_basename_result ]) # _LT_FILEUTILS_DEFAULTS # ---------------------- # It is okay to use these file commands and assume they have been set # sensibly after 'm4_require([_LT_FILEUTILS_DEFAULTS])'. m4_defun([_LT_FILEUTILS_DEFAULTS], [: ${CP="cp -f"} : ${MV="mv -f"} : ${RM="rm -f"} ])# _LT_FILEUTILS_DEFAULTS # _LT_SETUP # --------- m4_defun([_LT_SETUP], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl AC_REQUIRE([_LT_PREPARE_SED_QUOTE_VARS])dnl AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH])dnl _LT_DECL([], [PATH_SEPARATOR], [1], [The PATH separator for the build system])dnl dnl _LT_DECL([], [host_alias], [0], [The host system])dnl _LT_DECL([], [host], [0])dnl _LT_DECL([], [host_os], [0])dnl dnl _LT_DECL([], [build_alias], [0], [The build system])dnl _LT_DECL([], [build], [0])dnl _LT_DECL([], [build_os], [0])dnl dnl AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([LT_PATH_LD])dnl AC_REQUIRE([LT_PATH_NM])dnl dnl AC_REQUIRE([AC_PROG_LN_S])dnl test -z "$LN_S" && LN_S="ln -s" _LT_DECL([], [LN_S], [1], [Whether we need soft or hard links])dnl dnl AC_REQUIRE([LT_CMD_MAX_LEN])dnl _LT_DECL([objext], [ac_objext], [0], [Object file suffix (normally "o")])dnl _LT_DECL([], [exeext], [0], [Executable file suffix (normally "")])dnl dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_CHECK_SHELL_FEATURES])dnl m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl m4_require([_LT_CMD_RELOAD])dnl m4_require([_LT_CHECK_MAGIC_METHOD])dnl m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl m4_require([_LT_CMD_OLD_ARCHIVE])dnl m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl m4_require([_LT_WITH_SYSROOT])dnl m4_require([_LT_CMD_TRUNCATE])dnl _LT_CONFIG_LIBTOOL_INIT([ # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes INIT. if test -n "\${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi ]) if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi _LT_CHECK_OBJDIR m4_require([_LT_TAG_COMPILER])dnl case $host_os in aix3*) # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi ;; esac # Global variables: ofile=libtool can_build_shared=yes # All known linkers require a '.a' archive for static linking (except MSVC, # which needs '.lib'). libext=a with_gnu_ld=$lt_cv_prog_gnu_ld old_CC=$CC old_CFLAGS=$CFLAGS # Set sane defaults for various variables test -z "$CC" && CC=cc test -z "$LTCC" && LTCC=$CC test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS test -z "$LD" && LD=ld test -z "$ac_objext" && ac_objext=o _LT_CC_BASENAME([$compiler]) # Only perform the check for file, if the check method requires it test -z "$MAGIC_CMD" && MAGIC_CMD=file case $deplibs_check_method in file_magic*) if test "$file_magic_cmd" = '$MAGIC_CMD'; then _LT_PATH_MAGIC fi ;; esac # Use C for the default configuration in the libtool script LT_SUPPORTED_TAG([CC]) _LT_LANG_C_CONFIG _LT_LANG_DEFAULT_CONFIG _LT_CONFIG_COMMANDS ])# _LT_SETUP # _LT_PREPARE_SED_QUOTE_VARS # -------------------------- # Define a few sed substitution that help us do robust quoting. m4_defun([_LT_PREPARE_SED_QUOTE_VARS], [# Backslashify metacharacters that are still active within # double-quoted strings. sed_quote_subst='s/\([["`$\\]]\)/\\\1/g' # Same as above, but do not quote variable references. double_quote_subst='s/\([["`\\]]\)/\\\1/g' # Sed substitution to delay expansion of an escaped shell variable in a # double_quote_subst'ed string. delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g' # Sed substitution to delay expansion of an escaped single quote. delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g' # Sed substitution to avoid accidental globbing in evaled expressions no_glob_subst='s/\*/\\\*/g' ]) # _LT_PROG_LTMAIN # --------------- # Note that this code is called both from 'configure', and 'config.status' # now that we use AC_CONFIG_COMMANDS to generate libtool. Notably, # 'config.status' has no value for ac_aux_dir unless we are using Automake, # so we pass a copy along to make sure it has a sensible value anyway. m4_defun([_LT_PROG_LTMAIN], [m4_ifdef([AC_REQUIRE_AUX_FILE], [AC_REQUIRE_AUX_FILE([ltmain.sh])])dnl _LT_CONFIG_LIBTOOL_INIT([ac_aux_dir='$ac_aux_dir']) ltmain=$ac_aux_dir/ltmain.sh ])# _LT_PROG_LTMAIN ## ------------------------------------- ## ## Accumulate code for creating libtool. ## ## ------------------------------------- ## # So that we can recreate a full libtool script including additional # tags, we accumulate the chunks of code to send to AC_CONFIG_COMMANDS # in macros and then make a single call at the end using the 'libtool' # label. # _LT_CONFIG_LIBTOOL_INIT([INIT-COMMANDS]) # ---------------------------------------- # Register INIT-COMMANDS to be passed to AC_CONFIG_COMMANDS later. m4_define([_LT_CONFIG_LIBTOOL_INIT], [m4_ifval([$1], [m4_append([_LT_OUTPUT_LIBTOOL_INIT], [$1 ])])]) # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_INIT]) # _LT_CONFIG_LIBTOOL([COMMANDS]) # ------------------------------ # Register COMMANDS to be passed to AC_CONFIG_COMMANDS later. m4_define([_LT_CONFIG_LIBTOOL], [m4_ifval([$1], [m4_append([_LT_OUTPUT_LIBTOOL_COMMANDS], [$1 ])])]) # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS]) # _LT_CONFIG_SAVE_COMMANDS([COMMANDS], [INIT_COMMANDS]) # ----------------------------------------------------- m4_defun([_LT_CONFIG_SAVE_COMMANDS], [_LT_CONFIG_LIBTOOL([$1]) _LT_CONFIG_LIBTOOL_INIT([$2]) ]) # _LT_FORMAT_COMMENT([COMMENT]) # ----------------------------- # Add leading comment marks to the start of each line, and a trailing # full-stop to the whole comment if one is not present already. m4_define([_LT_FORMAT_COMMENT], [m4_ifval([$1], [ m4_bpatsubst([m4_bpatsubst([$1], [^ *], [# ])], [['`$\]], [\\\&])]m4_bmatch([$1], [[!?.]$], [], [.]) )]) ## ------------------------ ## ## FIXME: Eliminate VARNAME ## ## ------------------------ ## # _LT_DECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION], [IS-TAGGED?]) # ------------------------------------------------------------------- # CONFIGNAME is the name given to the value in the libtool script. # VARNAME is the (base) name used in the configure script. # VALUE may be 0, 1 or 2 for a computed quote escaped value based on # VARNAME. Any other value will be used directly. m4_define([_LT_DECL], [lt_if_append_uniq([lt_decl_varnames], [$2], [, ], [lt_dict_add_subkey([lt_decl_dict], [$2], [libtool_name], [m4_ifval([$1], [$1], [$2])]) lt_dict_add_subkey([lt_decl_dict], [$2], [value], [$3]) m4_ifval([$4], [lt_dict_add_subkey([lt_decl_dict], [$2], [description], [$4])]) lt_dict_add_subkey([lt_decl_dict], [$2], [tagged?], [m4_ifval([$5], [yes], [no])])]) ]) # _LT_TAGDECL([CONFIGNAME], VARNAME, VALUE, [DESCRIPTION]) # -------------------------------------------------------- m4_define([_LT_TAGDECL], [_LT_DECL([$1], [$2], [$3], [$4], [yes])]) # lt_decl_tag_varnames([SEPARATOR], [VARNAME1...]) # ------------------------------------------------ m4_define([lt_decl_tag_varnames], [_lt_decl_filter([tagged?], [yes], $@)]) # _lt_decl_filter(SUBKEY, VALUE, [SEPARATOR], [VARNAME1..]) # --------------------------------------------------------- m4_define([_lt_decl_filter], [m4_case([$#], [0], [m4_fatal([$0: too few arguments: $#])], [1], [m4_fatal([$0: too few arguments: $#: $1])], [2], [lt_dict_filter([lt_decl_dict], [$1], [$2], [], lt_decl_varnames)], [3], [lt_dict_filter([lt_decl_dict], [$1], [$2], [$3], lt_decl_varnames)], [lt_dict_filter([lt_decl_dict], $@)])[]dnl ]) # lt_decl_quote_varnames([SEPARATOR], [VARNAME1...]) # -------------------------------------------------- m4_define([lt_decl_quote_varnames], [_lt_decl_filter([value], [1], $@)]) # lt_decl_dquote_varnames([SEPARATOR], [VARNAME1...]) # --------------------------------------------------- m4_define([lt_decl_dquote_varnames], [_lt_decl_filter([value], [2], $@)]) # lt_decl_varnames_tagged([SEPARATOR], [VARNAME1...]) # --------------------------------------------------- m4_define([lt_decl_varnames_tagged], [m4_assert([$# <= 2])dnl _$0(m4_quote(m4_default([$1], [[, ]])), m4_ifval([$2], [[$2]], [m4_dquote(lt_decl_tag_varnames)]), m4_split(m4_normalize(m4_quote(_LT_TAGS)), [ ]))]) m4_define([_lt_decl_varnames_tagged], [m4_ifval([$3], [lt_combine([$1], [$2], [_], $3)])]) # lt_decl_all_varnames([SEPARATOR], [VARNAME1...]) # ------------------------------------------------ m4_define([lt_decl_all_varnames], [_$0(m4_quote(m4_default([$1], [[, ]])), m4_if([$2], [], m4_quote(lt_decl_varnames), m4_quote(m4_shift($@))))[]dnl ]) m4_define([_lt_decl_all_varnames], [lt_join($@, lt_decl_varnames_tagged([$1], lt_decl_tag_varnames([[, ]], m4_shift($@))))dnl ]) # _LT_CONFIG_STATUS_DECLARE([VARNAME]) # ------------------------------------ # Quote a variable value, and forward it to 'config.status' so that its # declaration there will have the same value as in 'configure'. VARNAME # must have a single quote delimited value for this to work. m4_define([_LT_CONFIG_STATUS_DECLARE], [$1='`$ECHO "$][$1" | $SED "$delay_single_quote_subst"`']) # _LT_CONFIG_STATUS_DECLARATIONS # ------------------------------ # We delimit libtool config variables with single quotes, so when # we write them to config.status, we have to be sure to quote all # embedded single quotes properly. In configure, this macro expands # each variable declared with _LT_DECL (and _LT_TAGDECL) into: # # ='`$ECHO "$" | $SED "$delay_single_quote_subst"`' m4_defun([_LT_CONFIG_STATUS_DECLARATIONS], [m4_foreach([_lt_var], m4_quote(lt_decl_all_varnames), [m4_n([_LT_CONFIG_STATUS_DECLARE(_lt_var)])])]) # _LT_LIBTOOL_TAGS # ---------------- # Output comment and list of tags supported by the script m4_defun([_LT_LIBTOOL_TAGS], [_LT_FORMAT_COMMENT([The names of the tagged configurations supported by this script])dnl available_tags='_LT_TAGS'dnl ]) # _LT_LIBTOOL_DECLARE(VARNAME, [TAG]) # ----------------------------------- # Extract the dictionary values for VARNAME (optionally with TAG) and # expand to a commented shell variable setting: # # # Some comment about what VAR is for. # visible_name=$lt_internal_name m4_define([_LT_LIBTOOL_DECLARE], [_LT_FORMAT_COMMENT(m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [description])))[]dnl m4_pushdef([_libtool_name], m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [libtool_name])))[]dnl m4_case(m4_quote(lt_dict_fetch([lt_decl_dict], [$1], [value])), [0], [_libtool_name=[$]$1], [1], [_libtool_name=$lt_[]$1], [2], [_libtool_name=$lt_[]$1], [_libtool_name=lt_dict_fetch([lt_decl_dict], [$1], [value])])[]dnl m4_ifval([$2], [_$2])[]m4_popdef([_libtool_name])[]dnl ]) # _LT_LIBTOOL_CONFIG_VARS # ----------------------- # Produce commented declarations of non-tagged libtool config variables # suitable for insertion in the LIBTOOL CONFIG section of the 'libtool' # script. Tagged libtool config variables (even for the LIBTOOL CONFIG # section) are produced by _LT_LIBTOOL_TAG_VARS. m4_defun([_LT_LIBTOOL_CONFIG_VARS], [m4_foreach([_lt_var], m4_quote(_lt_decl_filter([tagged?], [no], [], lt_decl_varnames)), [m4_n([_LT_LIBTOOL_DECLARE(_lt_var)])])]) # _LT_LIBTOOL_TAG_VARS(TAG) # ------------------------- m4_define([_LT_LIBTOOL_TAG_VARS], [m4_foreach([_lt_var], m4_quote(lt_decl_tag_varnames), [m4_n([_LT_LIBTOOL_DECLARE(_lt_var, [$1])])])]) # _LT_TAGVAR(VARNAME, [TAGNAME]) # ------------------------------ m4_define([_LT_TAGVAR], [m4_ifval([$2], [$1_$2], [$1])]) # _LT_CONFIG_COMMANDS # ------------------- # Send accumulated output to $CONFIG_STATUS. Thanks to the lists of # variables for single and double quote escaping we saved from calls # to _LT_DECL, we can put quote escaped variables declarations # into 'config.status', and then the shell code to quote escape them in # for loops in 'config.status'. Finally, any additional code accumulated # from calls to _LT_CONFIG_LIBTOOL_INIT is expanded. m4_defun([_LT_CONFIG_COMMANDS], [AC_PROVIDE_IFELSE([LT_OUTPUT], dnl If the libtool generation code has been placed in $CONFIG_LT, dnl instead of duplicating it all over again into config.status, dnl then we will have config.status run $CONFIG_LT later, so it dnl needs to know what name is stored there: [AC_CONFIG_COMMANDS([libtool], [$SHELL $CONFIG_LT || AS_EXIT(1)], [CONFIG_LT='$CONFIG_LT'])], dnl If the libtool generation code is destined for config.status, dnl expand the accumulated commands and init code now: [AC_CONFIG_COMMANDS([libtool], [_LT_OUTPUT_LIBTOOL_COMMANDS], [_LT_OUTPUT_LIBTOOL_COMMANDS_INIT])]) ])#_LT_CONFIG_COMMANDS # Initialize. m4_define([_LT_OUTPUT_LIBTOOL_COMMANDS_INIT], [ # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH sed_quote_subst='$sed_quote_subst' double_quote_subst='$double_quote_subst' delay_variable_subst='$delay_variable_subst' _LT_CONFIG_STATUS_DECLARATIONS LTCC='$LTCC' LTCFLAGS='$LTCFLAGS' compiler='$compiler_DEFAULT' # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$[]1 _LTECHO_EOF' } # Quote evaled strings. for var in lt_decl_all_varnames([[ \ ]], lt_decl_quote_varnames); do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[[\\\\\\\`\\"\\\$]]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done # Double-quote double-evaled strings. for var in lt_decl_all_varnames([[ \ ]], lt_decl_dquote_varnames); do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[[\\\\\\\`\\"\\\$]]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done _LT_OUTPUT_LIBTOOL_INIT ]) # _LT_GENERATED_FILE_INIT(FILE, [COMMENT]) # ------------------------------------ # Generate a child script FILE with all initialization necessary to # reuse the environment learned by the parent script, and make the # file executable. If COMMENT is supplied, it is inserted after the # '#!' sequence but before initialization text begins. After this # macro, additional text can be appended to FILE to form the body of # the child script. The macro ends with non-zero status if the # file could not be fully written (such as if the disk is full). m4_ifdef([AS_INIT_GENERATED], [m4_defun([_LT_GENERATED_FILE_INIT],[AS_INIT_GENERATED($@)])], [m4_defun([_LT_GENERATED_FILE_INIT], [m4_require([AS_PREPARE])]dnl [m4_pushdef([AS_MESSAGE_LOG_FD])]dnl [lt_write_fail=0 cat >$1 <<_ASEOF || lt_write_fail=1 #! $SHELL # Generated by $as_me. $2 SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$1 <<\_ASEOF || lt_write_fail=1 AS_SHELL_SANITIZE _AS_PREPARE exec AS_MESSAGE_FD>&1 _ASEOF test 0 = "$lt_write_fail" && chmod +x $1[]dnl m4_popdef([AS_MESSAGE_LOG_FD])])])# _LT_GENERATED_FILE_INIT # LT_OUTPUT # --------- # This macro allows early generation of the libtool script (before # AC_OUTPUT is called), incase it is used in configure for compilation # tests. AC_DEFUN([LT_OUTPUT], [: ${CONFIG_LT=./config.lt} AC_MSG_NOTICE([creating $CONFIG_LT]) _LT_GENERATED_FILE_INIT(["$CONFIG_LT"], [# Run this file to recreate a libtool stub with the current configuration.]) cat >>"$CONFIG_LT" <<\_LTEOF lt_cl_silent=false exec AS_MESSAGE_LOG_FD>>config.log { echo AS_BOX([Running $as_me.]) } >&AS_MESSAGE_LOG_FD lt_cl_help="\ '$as_me' creates a local libtool stub from the current configuration, for use in further configure time tests before the real libtool is generated. Usage: $[0] [[OPTIONS]] -h, --help print this help, then exit -V, --version print version number, then exit -q, --quiet do not print progress messages -d, --debug don't remove temporary files Report bugs to ." lt_cl_version="\ m4_ifset([AC_PACKAGE_NAME], [AC_PACKAGE_NAME ])config.lt[]dnl m4_ifset([AC_PACKAGE_VERSION], [ AC_PACKAGE_VERSION]) configured by $[0], generated by m4_PACKAGE_STRING. Copyright (C) 2011 Free Software Foundation, Inc. This config.lt script is free software; the Free Software Foundation gives unlimited permision to copy, distribute and modify it." while test 0 != $[#] do case $[1] in --version | --v* | -V ) echo "$lt_cl_version"; exit 0 ;; --help | --h* | -h ) echo "$lt_cl_help"; exit 0 ;; --debug | --d* | -d ) debug=: ;; --quiet | --q* | --silent | --s* | -q ) lt_cl_silent=: ;; -*) AC_MSG_ERROR([unrecognized option: $[1] Try '$[0] --help' for more information.]) ;; *) AC_MSG_ERROR([unrecognized argument: $[1] Try '$[0] --help' for more information.]) ;; esac shift done if $lt_cl_silent; then exec AS_MESSAGE_FD>/dev/null fi _LTEOF cat >>"$CONFIG_LT" <<_LTEOF _LT_OUTPUT_LIBTOOL_COMMANDS_INIT _LTEOF cat >>"$CONFIG_LT" <<\_LTEOF AC_MSG_NOTICE([creating $ofile]) _LT_OUTPUT_LIBTOOL_COMMANDS AS_EXIT(0) _LTEOF chmod +x "$CONFIG_LT" # configure is writing to config.log, but config.lt does its own redirection, # appending to config.log, which fails on DOS, as config.log is still kept # open by configure. Here we exec the FD to /dev/null, effectively closing # config.log, so it can be properly (re)opened and appended to by config.lt. lt_cl_success=: test yes = "$silent" && lt_config_lt_args="$lt_config_lt_args --quiet" exec AS_MESSAGE_LOG_FD>/dev/null $SHELL "$CONFIG_LT" $lt_config_lt_args || lt_cl_success=false exec AS_MESSAGE_LOG_FD>>config.log $lt_cl_success || AS_EXIT(1) ])# LT_OUTPUT # _LT_CONFIG(TAG) # --------------- # If TAG is the built-in tag, create an initial libtool script with a # default configuration from the untagged config vars. Otherwise add code # to config.status for appending the configuration named by TAG from the # matching tagged config vars. m4_defun([_LT_CONFIG], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl _LT_CONFIG_SAVE_COMMANDS([ m4_define([_LT_TAG], m4_if([$1], [], [C], [$1]))dnl m4_if(_LT_TAG, [C], [ # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes. if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi cfgfile=${ofile}T trap "$RM \"$cfgfile\"; exit 1" 1 2 15 $RM "$cfgfile" cat <<_LT_EOF >> "$cfgfile" #! $SHELL # Generated automatically by $as_me ($PACKAGE) $VERSION # Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`: # NOTE: Changes made to this file will be lost: look at ltmain.sh. # Provide generalized library-building support services. # Written by Gordon Matzigkeit, 1996 _LT_COPYING _LT_LIBTOOL_TAGS # Configured defaults for sys_lib_dlsearch_path munging. : \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"} # ### BEGIN LIBTOOL CONFIG _LT_LIBTOOL_CONFIG_VARS _LT_LIBTOOL_TAG_VARS # ### END LIBTOOL CONFIG _LT_EOF cat <<'_LT_EOF' >> "$cfgfile" # ### BEGIN FUNCTIONS SHARED WITH CONFIGURE _LT_PREPARE_MUNGE_PATH_LIST _LT_PREPARE_CC_BASENAME # ### END FUNCTIONS SHARED WITH CONFIGURE _LT_EOF case $host_os in aix3*) cat <<\_LT_EOF >> "$cfgfile" # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi _LT_EOF ;; esac _LT_PROG_LTMAIN # We use sed instead of cat because bash on DJGPP gets confused if # if finds mixed CR/LF and LF-only lines. Since sed operates in # text mode, it properly converts lines to CR/LF. This bash problem # is reportedly fixed, but why not run on old versions too? sed '$q' "$ltmain" >> "$cfgfile" \ || (rm -f "$cfgfile"; exit 1) mv -f "$cfgfile" "$ofile" || (rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile") chmod +x "$ofile" ], [cat <<_LT_EOF >> "$ofile" dnl Unfortunately we have to use $1 here, since _LT_TAG is not expanded dnl in a comment (ie after a #). # ### BEGIN LIBTOOL TAG CONFIG: $1 _LT_LIBTOOL_TAG_VARS(_LT_TAG) # ### END LIBTOOL TAG CONFIG: $1 _LT_EOF ])dnl /m4_if ], [m4_if([$1], [], [ PACKAGE='$PACKAGE' VERSION='$VERSION' RM='$RM' ofile='$ofile'], []) ])dnl /_LT_CONFIG_SAVE_COMMANDS ])# _LT_CONFIG # LT_SUPPORTED_TAG(TAG) # --------------------- # Trace this macro to discover what tags are supported by the libtool # --tag option, using: # autoconf --trace 'LT_SUPPORTED_TAG:$1' AC_DEFUN([LT_SUPPORTED_TAG], []) # C support is built-in for now m4_define([_LT_LANG_C_enabled], []) m4_define([_LT_TAGS], []) # LT_LANG(LANG) # ------------- # Enable libtool support for the given language if not already enabled. AC_DEFUN([LT_LANG], [AC_BEFORE([$0], [LT_OUTPUT])dnl m4_case([$1], [C], [_LT_LANG(C)], [C++], [_LT_LANG(CXX)], [Go], [_LT_LANG(GO)], [Java], [_LT_LANG(GCJ)], [Fortran 77], [_LT_LANG(F77)], [Fortran], [_LT_LANG(FC)], [Windows Resource], [_LT_LANG(RC)], [m4_ifdef([_LT_LANG_]$1[_CONFIG], [_LT_LANG($1)], [m4_fatal([$0: unsupported language: "$1"])])])dnl ])# LT_LANG # _LT_LANG(LANGNAME) # ------------------ m4_defun([_LT_LANG], [m4_ifdef([_LT_LANG_]$1[_enabled], [], [LT_SUPPORTED_TAG([$1])dnl m4_append([_LT_TAGS], [$1 ])dnl m4_define([_LT_LANG_]$1[_enabled], [])dnl _LT_LANG_$1_CONFIG($1)])dnl ])# _LT_LANG m4_ifndef([AC_PROG_GO], [ ############################################################ # NOTE: This macro has been submitted for inclusion into # # GNU Autoconf as AC_PROG_GO. When it is available in # # a released version of Autoconf we should remove this # # macro and use it instead. # ############################################################ m4_defun([AC_PROG_GO], [AC_LANG_PUSH(Go)dnl AC_ARG_VAR([GOC], [Go compiler command])dnl AC_ARG_VAR([GOFLAGS], [Go compiler flags])dnl _AC_ARG_VAR_LDFLAGS()dnl AC_CHECK_TOOL(GOC, gccgo) if test -z "$GOC"; then if test -n "$ac_tool_prefix"; then AC_CHECK_PROG(GOC, [${ac_tool_prefix}gccgo], [${ac_tool_prefix}gccgo]) fi fi if test -z "$GOC"; then AC_CHECK_PROG(GOC, gccgo, gccgo, false) fi ])#m4_defun ])#m4_ifndef # _LT_LANG_DEFAULT_CONFIG # ----------------------- m4_defun([_LT_LANG_DEFAULT_CONFIG], [AC_PROVIDE_IFELSE([AC_PROG_CXX], [LT_LANG(CXX)], [m4_define([AC_PROG_CXX], defn([AC_PROG_CXX])[LT_LANG(CXX)])]) AC_PROVIDE_IFELSE([AC_PROG_F77], [LT_LANG(F77)], [m4_define([AC_PROG_F77], defn([AC_PROG_F77])[LT_LANG(F77)])]) AC_PROVIDE_IFELSE([AC_PROG_FC], [LT_LANG(FC)], [m4_define([AC_PROG_FC], defn([AC_PROG_FC])[LT_LANG(FC)])]) dnl The call to [A][M_PROG_GCJ] is quoted like that to stop aclocal dnl pulling things in needlessly. AC_PROVIDE_IFELSE([AC_PROG_GCJ], [LT_LANG(GCJ)], [AC_PROVIDE_IFELSE([A][M_PROG_GCJ], [LT_LANG(GCJ)], [AC_PROVIDE_IFELSE([LT_PROG_GCJ], [LT_LANG(GCJ)], [m4_ifdef([AC_PROG_GCJ], [m4_define([AC_PROG_GCJ], defn([AC_PROG_GCJ])[LT_LANG(GCJ)])]) m4_ifdef([A][M_PROG_GCJ], [m4_define([A][M_PROG_GCJ], defn([A][M_PROG_GCJ])[LT_LANG(GCJ)])]) m4_ifdef([LT_PROG_GCJ], [m4_define([LT_PROG_GCJ], defn([LT_PROG_GCJ])[LT_LANG(GCJ)])])])])]) AC_PROVIDE_IFELSE([AC_PROG_GO], [LT_LANG(GO)], [m4_define([AC_PROG_GO], defn([AC_PROG_GO])[LT_LANG(GO)])]) AC_PROVIDE_IFELSE([LT_PROG_RC], [LT_LANG(RC)], [m4_define([LT_PROG_RC], defn([LT_PROG_RC])[LT_LANG(RC)])]) ])# _LT_LANG_DEFAULT_CONFIG # Obsolete macros: AU_DEFUN([AC_LIBTOOL_CXX], [LT_LANG(C++)]) AU_DEFUN([AC_LIBTOOL_F77], [LT_LANG(Fortran 77)]) AU_DEFUN([AC_LIBTOOL_FC], [LT_LANG(Fortran)]) AU_DEFUN([AC_LIBTOOL_GCJ], [LT_LANG(Java)]) AU_DEFUN([AC_LIBTOOL_RC], [LT_LANG(Windows Resource)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_CXX], []) dnl AC_DEFUN([AC_LIBTOOL_F77], []) dnl AC_DEFUN([AC_LIBTOOL_FC], []) dnl AC_DEFUN([AC_LIBTOOL_GCJ], []) dnl AC_DEFUN([AC_LIBTOOL_RC], []) # _LT_TAG_COMPILER # ---------------- m4_defun([_LT_TAG_COMPILER], [AC_REQUIRE([AC_PROG_CC])dnl _LT_DECL([LTCC], [CC], [1], [A C compiler])dnl _LT_DECL([LTCFLAGS], [CFLAGS], [1], [LTCC compiler flags])dnl _LT_TAGDECL([CC], [compiler], [1], [A language specific compiler])dnl _LT_TAGDECL([with_gcc], [GCC], [0], [Is the compiler the GNU compiler?])dnl # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC ])# _LT_TAG_COMPILER # _LT_COMPILER_BOILERPLATE # ------------------------ # Check for compiler boilerplate output or warnings with # the simple compiler test code. m4_defun([_LT_COMPILER_BOILERPLATE], [m4_require([_LT_DECL_SED])dnl ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" >conftest.$ac_ext eval "$ac_compile" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_compiler_boilerplate=`cat conftest.err` $RM conftest* ])# _LT_COMPILER_BOILERPLATE # _LT_LINKER_BOILERPLATE # ---------------------- # Check for linker boilerplate output or warnings with # the simple link test code. m4_defun([_LT_LINKER_BOILERPLATE], [m4_require([_LT_DECL_SED])dnl ac_outfile=conftest.$ac_objext echo "$lt_simple_link_test_code" >conftest.$ac_ext eval "$ac_link" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_linker_boilerplate=`cat conftest.err` $RM -r conftest* ])# _LT_LINKER_BOILERPLATE # _LT_REQUIRED_DARWIN_CHECKS # ------------------------- m4_defun_once([_LT_REQUIRED_DARWIN_CHECKS],[ case $host_os in rhapsody* | darwin*) AC_CHECK_TOOL([DSYMUTIL], [dsymutil], [:]) AC_CHECK_TOOL([NMEDIT], [nmedit], [:]) AC_CHECK_TOOL([LIPO], [lipo], [:]) AC_CHECK_TOOL([OTOOL], [otool], [:]) AC_CHECK_TOOL([OTOOL64], [otool64], [:]) _LT_DECL([], [DSYMUTIL], [1], [Tool to manipulate archived DWARF debug symbol files on Mac OS X]) _LT_DECL([], [NMEDIT], [1], [Tool to change global to local symbols on Mac OS X]) _LT_DECL([], [LIPO], [1], [Tool to manipulate fat objects and archives on Mac OS X]) _LT_DECL([], [OTOOL], [1], [ldd/readelf like tool for Mach-O binaries on Mac OS X]) _LT_DECL([], [OTOOL64], [1], [ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4]) AC_CACHE_CHECK([for -single_module linker flag],[lt_cv_apple_cc_single_mod], [lt_cv_apple_cc_single_mod=no if test -z "$LT_MULTI_MODULE"; then # By default we will add the -single_module flag. You can override # by either setting the environment variable LT_MULTI_MODULE # non-empty at configure time, or by adding -multi_module to the # link flags. rm -rf libconftest.dylib* echo "int foo(void){return 1;}" > conftest.c echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c 2>conftest.err _lt_result=$? # If there is a non-empty error log, and "single_module" # appears in it, assume the flag caused a linker warning if test -s conftest.err && $GREP single_module conftest.err; then cat conftest.err >&AS_MESSAGE_LOG_FD # Otherwise, if the output was created with a 0 exit code from # the compiler, it worked. elif test -f libconftest.dylib && test 0 = "$_lt_result"; then lt_cv_apple_cc_single_mod=yes else cat conftest.err >&AS_MESSAGE_LOG_FD fi rm -rf libconftest.dylib* rm -f conftest.* fi]) AC_CACHE_CHECK([for -exported_symbols_list linker flag], [lt_cv_ld_exported_symbols_list], [lt_cv_ld_exported_symbols_list=no save_LDFLAGS=$LDFLAGS echo "_main" > conftest.sym LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym" AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])], [lt_cv_ld_exported_symbols_list=yes], [lt_cv_ld_exported_symbols_list=no]) LDFLAGS=$save_LDFLAGS ]) AC_CACHE_CHECK([for -force_load linker flag],[lt_cv_ld_force_load], [lt_cv_ld_force_load=no cat > conftest.c << _LT_EOF int forced_loaded() { return 2;} _LT_EOF echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD cat > conftest.c << _LT_EOF int main() { return 0;} _LT_EOF echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&AS_MESSAGE_LOG_FD $LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err _lt_result=$? if test -s conftest.err && $GREP force_load conftest.err; then cat conftest.err >&AS_MESSAGE_LOG_FD elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then lt_cv_ld_force_load=yes else cat conftest.err >&AS_MESSAGE_LOG_FD fi rm -f conftest.err libconftest.a conftest conftest.c rm -rf conftest.dSYM ]) case $host_os in rhapsody* | darwin1.[[012]]) _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;; darwin1.*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; darwin*) # darwin 5.x on # if running on 10.5 or later, the deployment target defaults # to the OS version, if on x86, and 10.4, the deployment # target defaults to 10.4. Don't you love it? case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in 10.0,*86*-darwin8*|10.0,*-darwin[[91]]*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; 10.[[012]][[,.]]*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; 10.*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; esac ;; esac if test yes = "$lt_cv_apple_cc_single_mod"; then _lt_dar_single_mod='$single_module' fi if test yes = "$lt_cv_ld_exported_symbols_list"; then _lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym' else _lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib' fi if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then _lt_dsymutil='~$DSYMUTIL $lib || :' else _lt_dsymutil= fi ;; esac ]) # _LT_DARWIN_LINKER_FEATURES([TAG]) # --------------------------------- # Checks for linker and compiler features on darwin m4_defun([_LT_DARWIN_LINKER_FEATURES], [ m4_require([_LT_REQUIRED_DARWIN_CHECKS]) _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported if test yes = "$lt_cv_ld_force_load"; then _LT_TAGVAR(whole_archive_flag_spec, $1)='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`' m4_case([$1], [F77], [_LT_TAGVAR(compiler_needs_object, $1)=yes], [FC], [_LT_TAGVAR(compiler_needs_object, $1)=yes]) else _LT_TAGVAR(whole_archive_flag_spec, $1)='' fi _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=$_lt_dar_allow_undefined case $cc_basename in ifort*|nagfor*) _lt_dar_can_shared=yes ;; *) _lt_dar_can_shared=$GCC ;; esac if test yes = "$_lt_dar_can_shared"; then output_verbose_link_cmd=func_echo_all _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil" _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil" _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil" _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil" m4_if([$1], [CXX], [ if test yes != "$lt_cv_apple_cc_single_mod"; then _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil" _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil" fi ],[]) else _LT_TAGVAR(ld_shlibs, $1)=no fi ]) # _LT_SYS_MODULE_PATH_AIX([TAGNAME]) # ---------------------------------- # Links a minimal program and checks the executable # for the system default hardcoded library path. In most cases, # this is /usr/lib:/lib, but when the MPI compilers are used # the location of the communication and MPI libs are included too. # If we don't find anything, use the default library path according # to the aix ld manual. # Store the results from the different compilers for each TAGNAME. # Allow to override them for all tags through lt_cv_aix_libpath. m4_defun([_LT_SYS_MODULE_PATH_AIX], [m4_require([_LT_DECL_SED])dnl if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else AC_CACHE_VAL([_LT_TAGVAR([lt_cv_aix_libpath_], [$1])], [AC_LINK_IFELSE([AC_LANG_PROGRAM],[ lt_aix_libpath_sed='[ /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }]' _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi],[]) if test -z "$_LT_TAGVAR([lt_cv_aix_libpath_], [$1])"; then _LT_TAGVAR([lt_cv_aix_libpath_], [$1])=/usr/lib:/lib fi ]) aix_libpath=$_LT_TAGVAR([lt_cv_aix_libpath_], [$1]) fi ])# _LT_SYS_MODULE_PATH_AIX # _LT_SHELL_INIT(ARG) # ------------------- m4_define([_LT_SHELL_INIT], [m4_divert_text([M4SH-INIT], [$1 ])])# _LT_SHELL_INIT # _LT_PROG_ECHO_BACKSLASH # ----------------------- # Find how we can fake an echo command that does not interpret backslash. # In particular, with Autoconf 2.60 or later we add some code to the start # of the generated configure script that will find a shell with a builtin # printf (that we can use as an echo command). m4_defun([_LT_PROG_ECHO_BACKSLASH], [ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO AC_MSG_CHECKING([how to print strings]) # Test print first, because it will be a builtin if present. if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \ test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='print -r --' elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='printf %s\n' else # Use this function as a fallback that always works. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $[]1 _LTECHO_EOF' } ECHO='func_fallback_echo' fi # func_echo_all arg... # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "$*" } case $ECHO in printf*) AC_MSG_RESULT([printf]) ;; print*) AC_MSG_RESULT([print -r]) ;; *) AC_MSG_RESULT([cat]) ;; esac m4_ifdef([_AS_DETECT_SUGGESTED], [_AS_DETECT_SUGGESTED([ test -n "${ZSH_VERSION+set}${BASH_VERSION+set}" || ( ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO PATH=/empty FPATH=/empty; export PATH FPATH test "X`printf %s $ECHO`" = "X$ECHO" \ || test "X`print -r -- $ECHO`" = "X$ECHO" )])]) _LT_DECL([], [SHELL], [1], [Shell to use when invoking shell scripts]) _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes]) ])# _LT_PROG_ECHO_BACKSLASH # _LT_WITH_SYSROOT # ---------------- AC_DEFUN([_LT_WITH_SYSROOT], [AC_MSG_CHECKING([for sysroot]) AC_ARG_WITH([sysroot], [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@], [Search for dependent libraries within DIR (or the compiler's sysroot if not specified).])], [], [with_sysroot=no]) dnl lt_sysroot will always be passed unquoted. We quote it here dnl in case the user passed a directory name. lt_sysroot= case $with_sysroot in #( yes) if test yes = "$GCC"; then lt_sysroot=`$CC --print-sysroot 2>/dev/null` fi ;; #( /*) lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"` ;; #( no|'') ;; #( *) AC_MSG_RESULT([$with_sysroot]) AC_MSG_ERROR([The sysroot must be an absolute path.]) ;; esac AC_MSG_RESULT([${lt_sysroot:-no}]) _LT_DECL([], [lt_sysroot], [0], [The root where to search for ]dnl [dependent libraries, and where our libraries should be installed.])]) # _LT_ENABLE_LOCK # --------------- m4_defun([_LT_ENABLE_LOCK], [AC_ARG_ENABLE([libtool-lock], [AS_HELP_STRING([--disable-libtool-lock], [avoid locking (might break parallel builds)])]) test no = "$enable_libtool_lock" || enable_libtool_lock=yes # Some flags need to be propagated to the compiler or linker for good # libtool support. case $host in ia64-*-hpux*) # Find out what ABI is being produced by ac_compile, and set mode # options accordingly. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.$ac_objext` in *ELF-32*) HPUX_IA64_MODE=32 ;; *ELF-64*) HPUX_IA64_MODE=64 ;; esac fi rm -rf conftest* ;; *-*-irix6*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then if test yes = "$lt_cv_prog_gnu_ld"; then case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -melf32bsmip" ;; *N32*) LD="${LD-ld} -melf32bmipn32" ;; *64-bit*) LD="${LD-ld} -melf64bmip" ;; esac else case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -32" ;; *N32*) LD="${LD-ld} -n32" ;; *64-bit*) LD="${LD-ld} -64" ;; esac fi fi rm -rf conftest* ;; mips64*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then emul=elf case `/usr/bin/file conftest.$ac_objext` in *32-bit*) emul="${emul}32" ;; *64-bit*) emul="${emul}64" ;; esac case `/usr/bin/file conftest.$ac_objext` in *MSB*) emul="${emul}btsmip" ;; *LSB*) emul="${emul}ltsmip" ;; esac case `/usr/bin/file conftest.$ac_objext` in *N32*) emul="${emul}n32" ;; esac LD="${LD-ld} -m $emul" fi rm -rf conftest* ;; x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \ s390*-*linux*|s390*-*tpf*|sparc*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. Note that the listed cases only cover the # situations where additional linker options are needed (such as when # doing 32-bit compilation for a host where ld defaults to 64-bit, or # vice versa); the common cases where no linker options are needed do # not appear in the list. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.o` in *32-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_i386_fbsd" ;; x86_64-*linux*) case `/usr/bin/file conftest.o` in *x86-64*) LD="${LD-ld} -m elf32_x86_64" ;; *) LD="${LD-ld} -m elf_i386" ;; esac ;; powerpc64le-*linux*) LD="${LD-ld} -m elf32lppclinux" ;; powerpc64-*linux*) LD="${LD-ld} -m elf32ppclinux" ;; s390x-*linux*) LD="${LD-ld} -m elf_s390" ;; sparc64-*linux*) LD="${LD-ld} -m elf32_sparc" ;; esac ;; *64-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_x86_64_fbsd" ;; x86_64-*linux*) LD="${LD-ld} -m elf_x86_64" ;; powerpcle-*linux*) LD="${LD-ld} -m elf64lppc" ;; powerpc-*linux*) LD="${LD-ld} -m elf64ppc" ;; s390*-*linux*|s390*-*tpf*) LD="${LD-ld} -m elf64_s390" ;; sparc*-*linux*) LD="${LD-ld} -m elf64_sparc" ;; esac ;; esac fi rm -rf conftest* ;; *-*-sco3.2v5*) # On SCO OpenServer 5, we need -belf to get full-featured binaries. SAVE_CFLAGS=$CFLAGS CFLAGS="$CFLAGS -belf" AC_CACHE_CHECK([whether the C compiler needs -belf], lt_cv_cc_needs_belf, [AC_LANG_PUSH(C) AC_LINK_IFELSE([AC_LANG_PROGRAM([[]],[[]])],[lt_cv_cc_needs_belf=yes],[lt_cv_cc_needs_belf=no]) AC_LANG_POP]) if test yes != "$lt_cv_cc_needs_belf"; then # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf CFLAGS=$SAVE_CFLAGS fi ;; *-*solaris*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo 'int i;' > conftest.$ac_ext if AC_TRY_EVAL(ac_compile); then case `/usr/bin/file conftest.o` in *64-bit*) case $lt_cv_prog_gnu_ld in yes*) case $host in i?86-*-solaris*|x86_64-*-solaris*) LD="${LD-ld} -m elf_x86_64" ;; sparc*-*-solaris*) LD="${LD-ld} -m elf64_sparc" ;; esac # GNU ld 2.21 introduced _sol2 emulations. Use them if available. if ${LD-ld} -V | grep _sol2 >/dev/null 2>&1; then LD=${LD-ld}_sol2 fi ;; *) if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then LD="${LD-ld} -64" fi ;; esac ;; esac fi rm -rf conftest* ;; esac need_locks=$enable_libtool_lock ])# _LT_ENABLE_LOCK # _LT_PROG_AR # ----------- m4_defun([_LT_PROG_AR], [AC_CHECK_TOOLS(AR, [ar], false) : ${AR=ar} : ${AR_FLAGS=cru} _LT_DECL([], [AR], [1], [The archiver]) _LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive]) AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file], [lt_cv_ar_at_file=no AC_COMPILE_IFELSE([AC_LANG_PROGRAM], [echo conftest.$ac_objext > conftest.lst lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&AS_MESSAGE_LOG_FD' AC_TRY_EVAL([lt_ar_try]) if test 0 -eq "$ac_status"; then # Ensure the archiver fails upon bogus file names. rm -f conftest.$ac_objext libconftest.a AC_TRY_EVAL([lt_ar_try]) if test 0 -ne "$ac_status"; then lt_cv_ar_at_file=@ fi fi rm -f conftest.* libconftest.a ]) ]) if test no = "$lt_cv_ar_at_file"; then archiver_list_spec= else archiver_list_spec=$lt_cv_ar_at_file fi _LT_DECL([], [archiver_list_spec], [1], [How to feed a file listing to the archiver]) ])# _LT_PROG_AR # _LT_CMD_OLD_ARCHIVE # ------------------- m4_defun([_LT_CMD_OLD_ARCHIVE], [_LT_PROG_AR AC_CHECK_TOOL(STRIP, strip, :) test -z "$STRIP" && STRIP=: _LT_DECL([], [STRIP], [1], [A symbol stripping program]) AC_CHECK_TOOL(RANLIB, ranlib, :) test -z "$RANLIB" && RANLIB=: _LT_DECL([], [RANLIB], [1], [Commands used to install an old-style archive]) # Determine commands to create old-style static archives. old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs' old_postinstall_cmds='chmod 644 $oldlib' old_postuninstall_cmds= if test -n "$RANLIB"; then case $host_os in bitrig* | openbsd*) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib" ;; *) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib" ;; esac old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib" fi case $host_os in darwin*) lock_old_archive_extraction=yes ;; *) lock_old_archive_extraction=no ;; esac _LT_DECL([], [old_postinstall_cmds], [2]) _LT_DECL([], [old_postuninstall_cmds], [2]) _LT_TAGDECL([], [old_archive_cmds], [2], [Commands used to build an old-style archive]) _LT_DECL([], [lock_old_archive_extraction], [0], [Whether to use a lock for old archive extraction]) ])# _LT_CMD_OLD_ARCHIVE # _LT_COMPILER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS, # [OUTPUT-FILE], [ACTION-SUCCESS], [ACTION-FAILURE]) # ---------------------------------------------------------------- # Check whether the given compiler option works AC_DEFUN([_LT_COMPILER_OPTION], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_SED])dnl AC_CACHE_CHECK([$1], [$2], [$2=no m4_if([$4], , [ac_outfile=conftest.$ac_objext], [ac_outfile=$4]) echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="$3" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&AS_MESSAGE_LOG_FD echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then $2=yes fi fi $RM conftest* ]) if test yes = "[$]$2"; then m4_if([$5], , :, [$5]) else m4_if([$6], , :, [$6]) fi ])# _LT_COMPILER_OPTION # Old name: AU_ALIAS([AC_LIBTOOL_COMPILER_OPTION], [_LT_COMPILER_OPTION]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_COMPILER_OPTION], []) # _LT_LINKER_OPTION(MESSAGE, VARIABLE-NAME, FLAGS, # [ACTION-SUCCESS], [ACTION-FAILURE]) # ---------------------------------------------------- # Check whether the given linker option works AC_DEFUN([_LT_LINKER_OPTION], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_SED])dnl AC_CACHE_CHECK([$1], [$2], [$2=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS $3" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&AS_MESSAGE_LOG_FD $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then $2=yes fi else $2=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS ]) if test yes = "[$]$2"; then m4_if([$4], , :, [$4]) else m4_if([$5], , :, [$5]) fi ])# _LT_LINKER_OPTION # Old name: AU_ALIAS([AC_LIBTOOL_LINKER_OPTION], [_LT_LINKER_OPTION]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_LINKER_OPTION], []) # LT_CMD_MAX_LEN #--------------- AC_DEFUN([LT_CMD_MAX_LEN], [AC_REQUIRE([AC_CANONICAL_HOST])dnl # find the maximum length of command line arguments AC_MSG_CHECKING([the maximum length of command line arguments]) AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl i=0 teststring=ABCD case $build_os in msdosdjgpp*) # On DJGPP, this test can blow up pretty badly due to problems in libc # (any single argument exceeding 2000 bytes causes a buffer overrun # during glob expansion). Even if it were fixed, the result of this # check would be larger than it should be. lt_cv_sys_max_cmd_len=12288; # 12K is about right ;; gnu*) # Under GNU Hurd, this test is not required because there is # no limit to the length of command line arguments. # Libtool will interpret -1 as no limit whatsoever lt_cv_sys_max_cmd_len=-1; ;; cygwin* | mingw* | cegcc*) # On Win9x/ME, this test blows up -- it succeeds, but takes # about 5 minutes as the teststring grows exponentially. # Worse, since 9x/ME are not pre-emptively multitasking, # you end up with a "frozen" computer, even though with patience # the test eventually succeeds (with a max line length of 256k). # Instead, let's just punt: use the minimum linelength reported by # all of the supported platforms: 8192 (on NT/2K/XP). lt_cv_sys_max_cmd_len=8192; ;; mint*) # On MiNT this can take a long time and run out of memory. lt_cv_sys_max_cmd_len=8192; ;; amigaos*) # On AmigaOS with pdksh, this test takes hours, literally. # So we just punt and use a minimum line length of 8192. lt_cv_sys_max_cmd_len=8192; ;; bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*) # This has been around since 386BSD, at least. Likely further. if test -x /sbin/sysctl; then lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax` elif test -x /usr/sbin/sysctl; then lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax` else lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs fi # And add a safety zone lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` ;; interix*) # We know the value 262144 and hardcode it with a safety zone (like BSD) lt_cv_sys_max_cmd_len=196608 ;; os2*) # The test takes a long time on OS/2. lt_cv_sys_max_cmd_len=8192 ;; osf*) # Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure # due to this test when exec_disable_arg_limit is 1 on Tru64. It is not # nice to cause kernel panics so lets avoid the loop below. # First set a reasonable default. lt_cv_sys_max_cmd_len=16384 # if test -x /sbin/sysconfig; then case `/sbin/sysconfig -q proc exec_disable_arg_limit` in *1*) lt_cv_sys_max_cmd_len=-1 ;; esac fi ;; sco3.2v5*) lt_cv_sys_max_cmd_len=102400 ;; sysv5* | sco5v6* | sysv4.2uw2*) kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null` if test -n "$kargmax"; then lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[ ]]//'` else lt_cv_sys_max_cmd_len=32768 fi ;; *) lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null` if test -n "$lt_cv_sys_max_cmd_len" && \ test undefined != "$lt_cv_sys_max_cmd_len"; then lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` else # Make teststring a little bigger before we do anything with it. # a 1K string should be a reasonable start. for i in 1 2 3 4 5 6 7 8; do teststring=$teststring$teststring done SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}} # If test is not a shell built-in, we'll probably end up computing a # maximum length that is only half of the actual maximum length, but # we can't tell. while { test X`env echo "$teststring$teststring" 2>/dev/null` \ = "X$teststring$teststring"; } >/dev/null 2>&1 && test 17 != "$i" # 1/2 MB should be enough do i=`expr $i + 1` teststring=$teststring$teststring done # Only check the string length outside the loop. lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1` teststring= # Add a significant safety factor because C++ compilers can tack on # massive amounts of additional arguments before passing them to the # linker. It appears as though 1/2 is a usable value. lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2` fi ;; esac ]) if test -n "$lt_cv_sys_max_cmd_len"; then AC_MSG_RESULT($lt_cv_sys_max_cmd_len) else AC_MSG_RESULT(none) fi max_cmd_len=$lt_cv_sys_max_cmd_len _LT_DECL([], [max_cmd_len], [0], [What is the maximum length of a command?]) ])# LT_CMD_MAX_LEN # Old name: AU_ALIAS([AC_LIBTOOL_SYS_MAX_CMD_LEN], [LT_CMD_MAX_LEN]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_SYS_MAX_CMD_LEN], []) # _LT_HEADER_DLFCN # ---------------- m4_defun([_LT_HEADER_DLFCN], [AC_CHECK_HEADERS([dlfcn.h], [], [], [AC_INCLUDES_DEFAULT])dnl ])# _LT_HEADER_DLFCN # _LT_TRY_DLOPEN_SELF (ACTION-IF-TRUE, ACTION-IF-TRUE-W-USCORE, # ACTION-IF-FALSE, ACTION-IF-CROSS-COMPILING) # ---------------------------------------------------------------- m4_defun([_LT_TRY_DLOPEN_SELF], [m4_require([_LT_HEADER_DLFCN])dnl if test yes = "$cross_compiling"; then : [$4] else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF [#line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; }] _LT_EOF if AC_TRY_EVAL(ac_link) && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&AS_MESSAGE_LOG_FD 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) $1 ;; x$lt_dlneed_uscore) $2 ;; x$lt_dlunknown|x*) $3 ;; esac else : # compilation failed $3 fi fi rm -fr conftest* ])# _LT_TRY_DLOPEN_SELF # LT_SYS_DLOPEN_SELF # ------------------ AC_DEFUN([LT_SYS_DLOPEN_SELF], [m4_require([_LT_HEADER_DLFCN])dnl if test yes != "$enable_dlopen"; then enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown else lt_cv_dlopen=no lt_cv_dlopen_libs= case $host_os in beos*) lt_cv_dlopen=load_add_on lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ;; mingw* | pw32* | cegcc*) lt_cv_dlopen=LoadLibrary lt_cv_dlopen_libs= ;; cygwin*) lt_cv_dlopen=dlopen lt_cv_dlopen_libs= ;; darwin*) # if libdl is installed we need to link against it AC_CHECK_LIB([dl], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl],[ lt_cv_dlopen=dyld lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ]) ;; tpf*) # Don't try to run any link tests for TPF. We know it's impossible # because TPF is a cross-compiler, and we know how we open DSOs. lt_cv_dlopen=dlopen lt_cv_dlopen_libs= lt_cv_dlopen_self=no ;; *) AC_CHECK_FUNC([shl_load], [lt_cv_dlopen=shl_load], [AC_CHECK_LIB([dld], [shl_load], [lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld], [AC_CHECK_FUNC([dlopen], [lt_cv_dlopen=dlopen], [AC_CHECK_LIB([dl], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl], [AC_CHECK_LIB([svld], [dlopen], [lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld], [AC_CHECK_LIB([dld], [dld_link], [lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld]) ]) ]) ]) ]) ]) ;; esac if test no = "$lt_cv_dlopen"; then enable_dlopen=no else enable_dlopen=yes fi case $lt_cv_dlopen in dlopen) save_CPPFLAGS=$CPPFLAGS test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H" save_LDFLAGS=$LDFLAGS wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\" save_LIBS=$LIBS LIBS="$lt_cv_dlopen_libs $LIBS" AC_CACHE_CHECK([whether a program can dlopen itself], lt_cv_dlopen_self, [dnl _LT_TRY_DLOPEN_SELF( lt_cv_dlopen_self=yes, lt_cv_dlopen_self=yes, lt_cv_dlopen_self=no, lt_cv_dlopen_self=cross) ]) if test yes = "$lt_cv_dlopen_self"; then wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\" AC_CACHE_CHECK([whether a statically linked program can dlopen itself], lt_cv_dlopen_self_static, [dnl _LT_TRY_DLOPEN_SELF( lt_cv_dlopen_self_static=yes, lt_cv_dlopen_self_static=yes, lt_cv_dlopen_self_static=no, lt_cv_dlopen_self_static=cross) ]) fi CPPFLAGS=$save_CPPFLAGS LDFLAGS=$save_LDFLAGS LIBS=$save_LIBS ;; esac case $lt_cv_dlopen_self in yes|no) enable_dlopen_self=$lt_cv_dlopen_self ;; *) enable_dlopen_self=unknown ;; esac case $lt_cv_dlopen_self_static in yes|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;; *) enable_dlopen_self_static=unknown ;; esac fi _LT_DECL([dlopen_support], [enable_dlopen], [0], [Whether dlopen is supported]) _LT_DECL([dlopen_self], [enable_dlopen_self], [0], [Whether dlopen of programs is supported]) _LT_DECL([dlopen_self_static], [enable_dlopen_self_static], [0], [Whether dlopen of statically linked programs is supported]) ])# LT_SYS_DLOPEN_SELF # Old name: AU_ALIAS([AC_LIBTOOL_DLOPEN_SELF], [LT_SYS_DLOPEN_SELF]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_DLOPEN_SELF], []) # _LT_COMPILER_C_O([TAGNAME]) # --------------------------- # Check to see if options -c and -o are simultaneously supported by compiler. # This macro does not hard code the compiler like AC_PROG_CC_C_O. m4_defun([_LT_COMPILER_C_O], [m4_require([_LT_DECL_SED])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_TAG_COMPILER])dnl AC_CACHE_CHECK([if $compiler supports -c -o file.$ac_objext], [_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)], [_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [[^ ]]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&AS_MESSAGE_LOG_FD echo "$as_me:$LINENO: \$? = $ac_status" >&AS_MESSAGE_LOG_FD if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then _LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes fi fi chmod u+w . 2>&AS_MESSAGE_LOG_FD $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* ]) _LT_TAGDECL([compiler_c_o], [lt_cv_prog_compiler_c_o], [1], [Does compiler simultaneously support -c and -o options?]) ])# _LT_COMPILER_C_O # _LT_COMPILER_FILE_LOCKS([TAGNAME]) # ---------------------------------- # Check to see if we can do hard links to lock some files if needed m4_defun([_LT_COMPILER_FILE_LOCKS], [m4_require([_LT_ENABLE_LOCK])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl _LT_COMPILER_C_O([$1]) hard_links=nottested if test no = "$_LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)" && test no != "$need_locks"; then # do not overwrite the value of need_locks provided by the user AC_MSG_CHECKING([if we can lock with hard links]) hard_links=yes $RM conftest* ln conftest.a conftest.b 2>/dev/null && hard_links=no touch conftest.a ln conftest.a conftest.b 2>&5 || hard_links=no ln conftest.a conftest.b 2>/dev/null && hard_links=no AC_MSG_RESULT([$hard_links]) if test no = "$hard_links"; then AC_MSG_WARN(['$CC' does not support '-c -o', so 'make -j' may be unsafe]) need_locks=warn fi else need_locks=no fi _LT_DECL([], [need_locks], [1], [Must we lock files when doing compilation?]) ])# _LT_COMPILER_FILE_LOCKS # _LT_CHECK_OBJDIR # ---------------- m4_defun([_LT_CHECK_OBJDIR], [AC_CACHE_CHECK([for objdir], [lt_cv_objdir], [rm -f .libs 2>/dev/null mkdir .libs 2>/dev/null if test -d .libs; then lt_cv_objdir=.libs else # MS-DOS does not allow filenames that begin with a dot. lt_cv_objdir=_libs fi rmdir .libs 2>/dev/null]) objdir=$lt_cv_objdir _LT_DECL([], [objdir], [0], [The name of the directory that contains temporary libtool files])dnl m4_pattern_allow([LT_OBJDIR])dnl AC_DEFINE_UNQUOTED([LT_OBJDIR], "$lt_cv_objdir/", [Define to the sub-directory where libtool stores uninstalled libraries.]) ])# _LT_CHECK_OBJDIR # _LT_LINKER_HARDCODE_LIBPATH([TAGNAME]) # -------------------------------------- # Check hardcoding attributes. m4_defun([_LT_LINKER_HARDCODE_LIBPATH], [AC_MSG_CHECKING([how to hardcode library paths into programs]) _LT_TAGVAR(hardcode_action, $1)= if test -n "$_LT_TAGVAR(hardcode_libdir_flag_spec, $1)" || test -n "$_LT_TAGVAR(runpath_var, $1)" || test yes = "$_LT_TAGVAR(hardcode_automatic, $1)"; then # We can hardcode non-existent directories. if test no != "$_LT_TAGVAR(hardcode_direct, $1)" && # If the only mechanism to avoid hardcoding is shlibpath_var, we # have to relink, otherwise we might link with an installed library # when we should be linking with a yet-to-be-installed one ## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, $1)" && test no != "$_LT_TAGVAR(hardcode_minus_L, $1)"; then # Linking always hardcodes the temporary library directory. _LT_TAGVAR(hardcode_action, $1)=relink else # We can link without hardcoding, and we can hardcode nonexisting dirs. _LT_TAGVAR(hardcode_action, $1)=immediate fi else # We cannot hardcode anything, or else we can only hardcode existing # directories. _LT_TAGVAR(hardcode_action, $1)=unsupported fi AC_MSG_RESULT([$_LT_TAGVAR(hardcode_action, $1)]) if test relink = "$_LT_TAGVAR(hardcode_action, $1)" || test yes = "$_LT_TAGVAR(inherit_rpath, $1)"; then # Fast installation is not supported enable_fast_install=no elif test yes = "$shlibpath_overrides_runpath" || test no = "$enable_shared"; then # Fast installation is not necessary enable_fast_install=needless fi _LT_TAGDECL([], [hardcode_action], [0], [How to hardcode a shared library path into an executable]) ])# _LT_LINKER_HARDCODE_LIBPATH # _LT_CMD_STRIPLIB # ---------------- m4_defun([_LT_CMD_STRIPLIB], [m4_require([_LT_DECL_EGREP]) striplib= old_striplib= AC_MSG_CHECKING([whether stripping libraries is possible]) if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then test -z "$old_striplib" && old_striplib="$STRIP --strip-debug" test -z "$striplib" && striplib="$STRIP --strip-unneeded" AC_MSG_RESULT([yes]) else # FIXME - insert some real tests, host_os isn't really good enough case $host_os in darwin*) if test -n "$STRIP"; then striplib="$STRIP -x" old_striplib="$STRIP -S" AC_MSG_RESULT([yes]) else AC_MSG_RESULT([no]) fi ;; *) AC_MSG_RESULT([no]) ;; esac fi _LT_DECL([], [old_striplib], [1], [Commands to strip libraries]) _LT_DECL([], [striplib], [1]) ])# _LT_CMD_STRIPLIB # _LT_PREPARE_MUNGE_PATH_LIST # --------------------------- # Make sure func_munge_path_list() is defined correctly. m4_defun([_LT_PREPARE_MUNGE_PATH_LIST], [[# func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x@S|@2 in x) ;; *:) eval @S|@1=\"`$ECHO @S|@2 | $SED 's/:/ /g'` \@S|@@S|@1\" ;; x:*) eval @S|@1=\"\@S|@@S|@1 `$ECHO @S|@2 | $SED 's/:/ /g'`\" ;; *::*) eval @S|@1=\"\@S|@@S|@1\ `$ECHO @S|@2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval @S|@1=\"`$ECHO @S|@2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \@S|@@S|@1\" ;; *) eval @S|@1=\"`$ECHO @S|@2 | $SED 's/:/ /g'`\" ;; esac } ]])# _LT_PREPARE_PATH_LIST # _LT_SYS_DYNAMIC_LINKER([TAG]) # ----------------------------- # PORTME Fill in your ld.so characteristics m4_defun([_LT_SYS_DYNAMIC_LINKER], [AC_REQUIRE([AC_CANONICAL_HOST])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_OBJDUMP])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_CHECK_SHELL_FEATURES])dnl m4_require([_LT_PREPARE_MUNGE_PATH_LIST])dnl AC_MSG_CHECKING([dynamic linker characteristics]) m4_if([$1], [], [ if test yes = "$GCC"; then case $host_os in darwin*) lt_awk_arg='/^libraries:/,/LR/' ;; *) lt_awk_arg='/^libraries:/' ;; esac case $host_os in mingw* | cegcc*) lt_sed_strip_eq='s|=\([[A-Za-z]]:\)|\1|g' ;; *) lt_sed_strip_eq='s|=/|/|g' ;; esac lt_search_path_spec=`$CC -print-search-dirs | awk $lt_awk_arg | $SED -e "s/^libraries://" -e $lt_sed_strip_eq` case $lt_search_path_spec in *\;*) # if the path contains ";" then we assume it to be the separator # otherwise default to the standard path separator (i.e. ":") - it is # assumed that no part of a normal pathname contains ";" but that should # okay in the real world where ";" in dirpaths is itself problematic. lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED 's/;/ /g'` ;; *) lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED "s/$PATH_SEPARATOR/ /g"` ;; esac # Ok, now we have the path, separated by spaces, we can step through it # and add multilib dir if necessary... lt_tmp_lt_search_path_spec= lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null` # ...but if some path component already ends with the multilib dir we assume # that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer). case "$lt_multi_os_dir; $lt_search_path_spec " in "/; "* | "/.; "* | "/./; "* | *"$lt_multi_os_dir "* | *"$lt_multi_os_dir/ "*) lt_multi_os_dir= ;; esac for lt_sys_path in $lt_search_path_spec; do if test -d "$lt_sys_path$lt_multi_os_dir"; then lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir" elif test -n "$lt_multi_os_dir"; then test -d "$lt_sys_path" && \ lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path" fi done lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" | awk ' BEGIN {RS = " "; FS = "/|\n";} { lt_foo = ""; lt_count = 0; for (lt_i = NF; lt_i > 0; lt_i--) { if ($lt_i != "" && $lt_i != ".") { if ($lt_i == "..") { lt_count++; } else { if (lt_count == 0) { lt_foo = "/" $lt_i lt_foo; } else { lt_count--; } } } } if (lt_foo != "") { lt_freq[[lt_foo]]++; } if (lt_freq[[lt_foo]] == 1) { print lt_foo; } }'` # AWK program above erroneously prepends '/' to C:/dos/paths # for these hosts. case $host_os in mingw* | cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" |\ $SED 's|/\([[A-Za-z]]:\)|\1|g'` ;; esac sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" | $lt_NL2SP` else sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" fi]) library_names_spec= libname_spec='lib$name' soname_spec= shrext_cmds=.so postinstall_cmds= postuninstall_cmds= finish_cmds= finish_eval= shlibpath_var= shlibpath_overrides_runpath=unknown version_type=none dynamic_linker="$host_os ld.so" sys_lib_dlsearch_path_spec="/lib /usr/lib" need_lib_prefix=unknown hardcode_into_libs=no # when you set need_version to no, make sure it does not cause -set_version # flags to be left without arguments need_version=unknown AC_ARG_VAR([LT_SYS_LIBRARY_PATH], [User-defined run-time library search path.]) case $host_os in aix3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname.a' shlibpath_var=LIBPATH # AIX 3 has no versioning support, so we append a major version to the name. soname_spec='$libname$release$shared_ext$major' ;; aix[[4-9]]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no hardcode_into_libs=yes if test ia64 = "$host_cpu"; then # AIX 5 supports IA64 library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH else # With GCC up to 2.95.x, collect2 would create an import file # for dependence libraries. The import file would start with # the line '#! .'. This would cause the generated library to # depend on '.', always an invalid library. This was fixed in # development snapshots of GCC prior to 3.0. case $host_os in aix4 | aix4.[[01]] | aix4.[[01]].*) if { echo '#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)' echo ' yes ' echo '#endif'; } | $CC -E - | $GREP yes > /dev/null; then : else can_build_shared=no fi ;; esac # Using Import Files as archive members, it is possible to support # filename-based versioning of shared library archives on AIX. While # this would work for both with and without runtime linking, it will # prevent static linking of such archives. So we do filename-based # shared library versioning with .so extension only, which is used # when both runtime linking and shared linking is enabled. # Unfortunately, runtime linking may impact performance, so we do # not want this to be the default eventually. Also, we use the # versioned .so libs for executables only if there is the -brtl # linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only. # To allow for filename-based versioning support, we need to create # libNAME.so.V as an archive file, containing: # *) an Import File, referring to the versioned filename of the # archive as well as the shared archive member, telling the # bitwidth (32 or 64) of that shared object, and providing the # list of exported symbols of that shared object, eventually # decorated with the 'weak' keyword # *) the shared object with the F_LOADONLY flag set, to really avoid # it being seen by the linker. # At run time we better use the real file rather than another symlink, # but for link time we create the symlink libNAME.so -> libNAME.so.V case $with_aix_soname,$aix_use_runtimelinking in # AIX (on Power*) has no versioning support, so currently we cannot hardcode correct # soname into executable. Probably we can add versioning support to # collect2, so additional links can be useful in future. aix,yes) # traditional libtool dynamic_linker='AIX unversionable lib.so' # If using run time linking (on AIX 4.2 or later) use lib.so # instead of lib.a to let people know that these are not # typical AIX shared libraries. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; aix,no) # traditional AIX only dynamic_linker='AIX lib.a[(]lib.so.V[)]' # We preserve .a as extension for shared libraries through AIX4.2 # and later when we are not doing run time linking. library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' ;; svr4,*) # full svr4 only dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)]" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,yes) # both, prefer svr4 dynamic_linker="AIX lib.so.V[(]$shared_archive_member_spec.o[)], lib.a[(]lib.so.V[)]" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # unpreferred sharedlib libNAME.a needs extra handling postinstall_cmds='test -n "$linkname" || linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" || test -z "$striplib" || $striplib "$destdir/$func_stripname_result.$libext"' postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" || func_append rmfiles " $odir/$func_stripname_result.$libext"' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,no) # both, prefer aix dynamic_linker="AIX lib.a[(]lib.so.V[)], lib.so.V[(]$shared_archive_member_spec.o[)]" library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' # unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling postinstall_cmds='test -z "$dlname" || $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" || test -z "$striplib" || $striplib $destdir/$dlname~test -n "$linkname" || linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)' postuninstall_cmds='test -z "$dlname" || func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"' ;; esac shlibpath_var=LIBPATH fi ;; amigaos*) case $host_cpu in powerpc) # Since July 2007 AmigaOS4 officially supports .so libraries. # When compiling the executable, add -use-dynld -Lsobjs: to the compileline. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; m68k) library_names_spec='$libname.ixlibrary $libname.a' # Create ${libname}_ixlibrary.a entries in /sys/libs. finish_eval='for lib in `ls $libdir/*.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" | $SED '\''s%^.*/\([[^/]]*\)\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a || exit 1; done' ;; esac ;; beos*) library_names_spec='$libname$shared_ext' dynamic_linker="$host_os ld.so" shlibpath_var=LIBRARY_PATH ;; bsdi[[45]]*) version_type=linux # correct to gnu/linux during the next big refactor need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib" sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib" # the default ld.so.conf also contains /usr/contrib/lib and # /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow # libtool to hard-code these into programs ;; cygwin* | mingw* | pw32* | cegcc*) version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no case $GCC,$cc_basename in yes,*) # gcc library_names_spec='$libname.dll.a' # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes case $host_os in cygwin*) # Cygwin DLLs use 'cyg' prefix rather than 'lib' soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' m4_if([$1], [],[ sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"]) ;; mingw* | cegcc*) # MinGW DLLs use traditional 'lib' prefix soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' ;; pw32*) # pw32 DLLs use 'pw' prefix rather than 'lib' library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' ;; esac dynamic_linker='Win32 ld.exe' ;; *,cl*) # Native MSVC libname_spec='$name' soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext' library_names_spec='$libname.dll.lib' case $build_os in mingw*) sys_lib_search_path_spec= lt_save_ifs=$IFS IFS=';' for lt_path in $LIB do IFS=$lt_save_ifs # Let DOS variable expansion print the short 8.3 style file name. lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"` sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path" done IFS=$lt_save_ifs # Convert to MSYS style. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'` ;; cygwin*) # Convert to unix form, then to dos form, then back to unix form # but this time dos style (no spaces!) so that the unix form looks # like /cygdrive/c/PROGRA~1:/cygdr... sys_lib_search_path_spec=`cygpath --path --unix "$LIB"` sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null` sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` ;; *) sys_lib_search_path_spec=$LIB if $ECHO "$sys_lib_search_path_spec" | [$GREP ';[c-zC-Z]:/' >/dev/null]; then # It is most probably a Windows format PATH. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's/;/ /g'` else sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` fi # FIXME: find the short name or the path components, as spaces are # common. (e.g. "Program Files" -> "PROGRA~1") ;; esac # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes dynamic_linker='Win32 link.exe' ;; *) # Assume MSVC wrapper library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib' dynamic_linker='Win32 ld.exe' ;; esac # FIXME: first we should search . and the directory the executable is in shlibpath_var=PATH ;; darwin* | rhapsody*) dynamic_linker="$host_os dyld" version_type=darwin need_lib_prefix=no need_version=no library_names_spec='$libname$release$major$shared_ext $libname$shared_ext' soname_spec='$libname$release$major$shared_ext' shlibpath_overrides_runpath=yes shlibpath_var=DYLD_LIBRARY_PATH shrext_cmds='`test .$module = .yes && echo .so || echo .dylib`' m4_if([$1], [],[ sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib"]) sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib' ;; dgux*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; freebsd* | dragonfly*) # DragonFly does not have aout. When/if they implement a new # versioning mechanism, adjust this. if test -x /usr/bin/objformat; then objformat=`/usr/bin/objformat` else case $host_os in freebsd[[23]].*) objformat=aout ;; *) objformat=elf ;; esac fi version_type=freebsd-$objformat case $version_type in freebsd-elf*) library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' need_version=no need_lib_prefix=no ;; freebsd-*) library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' need_version=yes ;; esac shlibpath_var=LD_LIBRARY_PATH case $host_os in freebsd2.*) shlibpath_overrides_runpath=yes ;; freebsd3.[[01]]* | freebsdelf3.[[01]]*) shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; freebsd3.[[2-9]]* | freebsdelf3.[[2-9]]* | \ freebsd4.[[0-5]] | freebsdelf4.[[0-5]] | freebsd4.1.1 | freebsdelf4.1.1) shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; *) # from 4.6 on, and DragonFly shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; esac ;; haiku*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no dynamic_linker="$host_os runtime_loader" library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LIBRARY_PATH shlibpath_overrides_runpath=no sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib' hardcode_into_libs=yes ;; hpux9* | hpux10* | hpux11*) # Give a soname corresponding to the major version so that dld.sl refuses to # link against other versions. version_type=sunos need_lib_prefix=no need_version=no case $host_cpu in ia64*) shrext_cmds='.so' hardcode_into_libs=yes dynamic_linker="$host_os dld.so" shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' if test 32 = "$HPUX_IA64_MODE"; then sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib" sys_lib_dlsearch_path_spec=/usr/lib/hpux32 else sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64" sys_lib_dlsearch_path_spec=/usr/lib/hpux64 fi ;; hppa*64*) shrext_cmds='.sl' hardcode_into_libs=yes dynamic_linker="$host_os dld.sl" shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; *) shrext_cmds='.sl' dynamic_linker="$host_os dld.sl" shlibpath_var=SHLIB_PATH shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' ;; esac # HP-UX runs *really* slowly unless shared libraries are mode 555, ... postinstall_cmds='chmod 555 $lib' # or fails outright, so override atomically: install_override_mode=555 ;; interix[[3-9]]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; irix5* | irix6* | nonstopux*) case $host_os in nonstopux*) version_type=nonstopux ;; *) if test yes = "$lt_cv_prog_gnu_ld"; then version_type=linux # correct to gnu/linux during the next big refactor else version_type=irix fi ;; esac need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext' case $host_os in irix5* | nonstopux*) libsuff= shlibsuff= ;; *) case $LD in # libtool.m4 will add one of these switches to LD *-32|*"-32 "|*-melf32bsmip|*"-melf32bsmip ") libsuff= shlibsuff= libmagic=32-bit;; *-n32|*"-n32 "|*-melf32bmipn32|*"-melf32bmipn32 ") libsuff=32 shlibsuff=N32 libmagic=N32;; *-64|*"-64 "|*-melf64bmip|*"-melf64bmip ") libsuff=64 shlibsuff=64 libmagic=64-bit;; *) libsuff= shlibsuff= libmagic=never-match;; esac ;; esac shlibpath_var=LD_LIBRARY${shlibsuff}_PATH shlibpath_overrides_runpath=no sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff" sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff" hardcode_into_libs=yes ;; # No shared lib support for Linux oldld, aout, or coff. linux*oldld* | linux*aout* | linux*coff*) dynamic_linker=no ;; linux*android*) version_type=none # Android doesn't support versioned libraries. need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext' soname_spec='$libname$release$shared_ext' finish_cmds= shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes dynamic_linker='Android linker' # Don't embed -rpath directories since the linker doesn't support them. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no # Some binutils ld are patched to set DT_RUNPATH AC_CACHE_VAL([lt_cv_shlibpath_overrides_runpath], [lt_cv_shlibpath_overrides_runpath=no save_LDFLAGS=$LDFLAGS save_libdir=$libdir eval "libdir=/foo; wl=\"$_LT_TAGVAR(lt_prog_compiler_wl, $1)\"; \ LDFLAGS=\"\$LDFLAGS $_LT_TAGVAR(hardcode_libdir_flag_spec, $1)\"" AC_LINK_IFELSE([AC_LANG_PROGRAM([],[])], [AS_IF([ ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null], [lt_cv_shlibpath_overrides_runpath=yes])]) LDFLAGS=$save_LDFLAGS libdir=$save_libdir ]) shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes # Ideally, we could use ldconfig to report *all* directores which are # searched for libraries, however this is still not possible. Aside from not # being certain /sbin/ldconfig is available, command # 'ldconfig -N -X -v | grep ^/' on 64bit Fedora does not report /usr/lib64, # even though it is searched at run-time. Try to do the best guess by # appending ld.so.conf contents (and includes) to the search path. if test -f /etc/ld.so.conf; then lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" fi # We used to test for /lib/ld.so.1 and disable shared libraries on # powerpc, because MkLinux only supported shared libraries with the # GNU dynamic linker. Since this was broken with cross compilers, # most powerpc-linux boxes support dynamic linking these days and # people can always --disable-shared, the test was removed, and we # assume the GNU/Linux dynamic linker is in use. dynamic_linker='GNU/Linux ld.so' ;; netbsdelf*-gnu) version_type=linux need_lib_prefix=no need_version=no library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}' soname_spec='${libname}${release}${shared_ext}$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='NetBSD ld.elf_so' ;; netbsd*) version_type=sunos need_lib_prefix=no need_version=no if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' dynamic_linker='NetBSD (a.out) ld.so' else library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='NetBSD ld.elf_so' fi shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; newsos6) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; *nto* | *qnx*) version_type=qnx need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='ldqnx.so' ;; openbsd* | bitrig*) version_type=sunos sys_lib_dlsearch_path_spec=/usr/lib need_lib_prefix=no if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then need_version=no else need_version=yes fi library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; os2*) libname_spec='$name' version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no # OS/2 can only load a DLL with a base name of 8 characters or less. soname_spec='`test -n "$os2dllname" && libname="$os2dllname"; v=$($ECHO $release$versuffix | tr -d .-); n=$($ECHO $libname | cut -b -$((8 - ${#v})) | tr . _); $ECHO $n$v`$shared_ext' library_names_spec='${libname}_dll.$libext' dynamic_linker='OS/2 ld.exe' shlibpath_var=BEGINLIBPATH sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' ;; osf3* | osf4* | osf5*) version_type=osf need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; rdos*) dynamic_linker=no ;; solaris*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes # ldd complains unless libraries are executable postinstall_cmds='chmod +x $lib' ;; sunos4*) version_type=sunos library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes if test yes = "$with_gnu_ld"; then need_lib_prefix=no fi need_version=yes ;; sysv4 | sysv4.3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH case $host_vendor in sni) shlibpath_overrides_runpath=no need_lib_prefix=no runpath_var=LD_RUN_PATH ;; siemens) need_lib_prefix=no ;; motorola) need_lib_prefix=no need_version=no shlibpath_overrides_runpath=no sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib' ;; esac ;; sysv4*MP*) if test -d /usr/nec; then version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext' soname_spec='$libname$shared_ext.$major' shlibpath_var=LD_LIBRARY_PATH fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) version_type=sco need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes if test yes = "$with_gnu_ld"; then sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib' else sys_lib_search_path_spec='/usr/ccs/lib /usr/lib' case $host_os in sco3.2v5*) sys_lib_search_path_spec="$sys_lib_search_path_spec /lib" ;; esac fi sys_lib_dlsearch_path_spec='/usr/lib' ;; tpf*) # TPF is a cross-target only. Preferred cross-host = GNU/Linux. version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; uts4*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; *) dynamic_linker=no ;; esac AC_MSG_RESULT([$dynamic_linker]) test no = "$dynamic_linker" && can_build_shared=no variables_saved_for_relink="PATH $shlibpath_var $runpath_var" if test yes = "$GCC"; then variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH" fi if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec fi if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec fi # remember unaugmented sys_lib_dlsearch_path content for libtool script decls... configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec # ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH" # to be used as default LT_SYS_LIBRARY_PATH value in generated libtool configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH _LT_DECL([], [variables_saved_for_relink], [1], [Variables whose values should be saved in libtool wrapper scripts and restored at link time]) _LT_DECL([], [need_lib_prefix], [0], [Do we need the "lib" prefix for modules?]) _LT_DECL([], [need_version], [0], [Do we need a version for libraries?]) _LT_DECL([], [version_type], [0], [Library versioning type]) _LT_DECL([], [runpath_var], [0], [Shared library runtime path variable]) _LT_DECL([], [shlibpath_var], [0],[Shared library path variable]) _LT_DECL([], [shlibpath_overrides_runpath], [0], [Is shlibpath searched before the hard-coded library search path?]) _LT_DECL([], [libname_spec], [1], [Format of library name prefix]) _LT_DECL([], [library_names_spec], [1], [[List of archive names. First name is the real one, the rest are links. The last name is the one that the linker finds with -lNAME]]) _LT_DECL([], [soname_spec], [1], [[The coded name of the library, if different from the real name]]) _LT_DECL([], [install_override_mode], [1], [Permission mode override for installation of shared libraries]) _LT_DECL([], [postinstall_cmds], [2], [Command to use after installation of a shared archive]) _LT_DECL([], [postuninstall_cmds], [2], [Command to use after uninstallation of a shared archive]) _LT_DECL([], [finish_cmds], [2], [Commands used to finish a libtool library installation in a directory]) _LT_DECL([], [finish_eval], [1], [[As "finish_cmds", except a single script fragment to be evaled but not shown]]) _LT_DECL([], [hardcode_into_libs], [0], [Whether we should hardcode library paths into libraries]) _LT_DECL([], [sys_lib_search_path_spec], [2], [Compile-time system search path for libraries]) _LT_DECL([sys_lib_dlsearch_path_spec], [configure_time_dlsearch_path], [2], [Detected run-time system search path for libraries]) _LT_DECL([], [configure_time_lt_sys_library_path], [2], [Explicit LT_SYS_LIBRARY_PATH set during ./configure time]) ])# _LT_SYS_DYNAMIC_LINKER # _LT_PATH_TOOL_PREFIX(TOOL) # -------------------------- # find a file program that can recognize shared library AC_DEFUN([_LT_PATH_TOOL_PREFIX], [m4_require([_LT_DECL_EGREP])dnl AC_MSG_CHECKING([for $1]) AC_CACHE_VAL(lt_cv_path_MAGIC_CMD, [case $MAGIC_CMD in [[\\/*] | ?:[\\/]*]) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR dnl $ac_dummy forces splitting on constant user-supplied paths. dnl POSIX.2 word splitting is done only on the output of word expansions, dnl not every word. This closes a longstanding sh security hole. ac_dummy="m4_if([$2], , $PATH, [$2])" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$1"; then lt_cv_path_MAGIC_CMD=$ac_dir/"$1" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac]) MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then AC_MSG_RESULT($MAGIC_CMD) else AC_MSG_RESULT(no) fi _LT_DECL([], [MAGIC_CMD], [0], [Used to examine libraries when file_magic_cmd begins with "file"])dnl ])# _LT_PATH_TOOL_PREFIX # Old name: AU_ALIAS([AC_PATH_TOOL_PREFIX], [_LT_PATH_TOOL_PREFIX]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_PATH_TOOL_PREFIX], []) # _LT_PATH_MAGIC # -------------- # find a file program that can recognize a shared library m4_defun([_LT_PATH_MAGIC], [_LT_PATH_TOOL_PREFIX(${ac_tool_prefix}file, /usr/bin$PATH_SEPARATOR$PATH) if test -z "$lt_cv_path_MAGIC_CMD"; then if test -n "$ac_tool_prefix"; then _LT_PATH_TOOL_PREFIX(file, /usr/bin$PATH_SEPARATOR$PATH) else MAGIC_CMD=: fi fi ])# _LT_PATH_MAGIC # LT_PATH_LD # ---------- # find the pathname to the GNU or non-GNU linker AC_DEFUN([LT_PATH_LD], [AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_PROG_ECHO_BACKSLASH])dnl AC_ARG_WITH([gnu-ld], [AS_HELP_STRING([--with-gnu-ld], [assume the C compiler uses GNU ld @<:@default=no@:>@])], [test no = "$withval" || with_gnu_ld=yes], [with_gnu_ld=no])dnl ac_prog=ld if test yes = "$GCC"; then # Check if gcc -print-prog-name=ld gives a path. AC_MSG_CHECKING([for ld used by $CC]) case $host in *-*-mingw*) # gcc leaves a trailing carriage return, which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [[\\/]]* | ?:[[\\/]]*) re_direlt='/[[^/]][[^/]]*/\.\./' # Canonicalize the pathname of ld ac_prog=`$ECHO "$ac_prog"| $SED 's%\\\\%/%g'` while $ECHO "$ac_prog" | $GREP "$re_direlt" > /dev/null 2>&1; do ac_prog=`$ECHO $ac_prog| $SED "s%$re_direlt%/%"` done test -z "$LD" && LD=$ac_prog ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test yes = "$with_gnu_ld"; then AC_MSG_CHECKING([for GNU ld]) else AC_MSG_CHECKING([for non-GNU ld]) fi AC_CACHE_VAL(lt_cv_path_LD, [if test -z "$LD"; then lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then lt_cv_path_LD=$ac_dir/$ac_prog # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some variants of GNU ld only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$lt_cv_path_LD" -v 2>&1 &1 conftest.i cat conftest.i conftest.i >conftest2.i : ${lt_DD:=$DD} AC_PATH_PROGS_FEATURE_CHECK([lt_DD], [dd], [if "$ac_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=: fi]) rm -f conftest.i conftest2.i conftest.out]) ])# _LT_PATH_DD # _LT_CMD_TRUNCATE # ---------------- # find command to truncate a binary pipe m4_defun([_LT_CMD_TRUNCATE], [m4_require([_LT_PATH_DD]) AC_CACHE_CHECK([how to truncate binary pipes], [lt_cv_truncate_bin], [printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i lt_cv_truncate_bin= if "$ac_cv_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1" fi rm -f conftest.i conftest2.i conftest.out test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"]) _LT_DECL([lt_truncate_bin], [lt_cv_truncate_bin], [1], [Command to truncate a binary pipe]) ])# _LT_CMD_TRUNCATE # _LT_CHECK_MAGIC_METHOD # ---------------------- # how to check for library dependencies # -- PORTME fill in with the dynamic library characteristics m4_defun([_LT_CHECK_MAGIC_METHOD], [m4_require([_LT_DECL_EGREP]) m4_require([_LT_DECL_OBJDUMP]) AC_CACHE_CHECK([how to recognize dependent libraries], lt_cv_deplibs_check_method, [lt_cv_file_magic_cmd='$MAGIC_CMD' lt_cv_file_magic_test_file= lt_cv_deplibs_check_method='unknown' # Need to set the preceding variable on all platforms that support # interlibrary dependencies. # 'none' -- dependencies not supported. # 'unknown' -- same as none, but documents that we really don't know. # 'pass_all' -- all dependencies passed with no checks. # 'test_compile' -- check by making test program. # 'file_magic [[regex]]' -- check by looking for files in library path # that responds to the $file_magic_cmd with a given extended regex. # If you have 'file' or equivalent on your system and you're not sure # whether 'pass_all' will *always* work, you probably want this one. case $host_os in aix[[4-9]]*) lt_cv_deplibs_check_method=pass_all ;; beos*) lt_cv_deplibs_check_method=pass_all ;; bsdi[[45]]*) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)' lt_cv_file_magic_cmd='/usr/bin/file -L' lt_cv_file_magic_test_file=/shlib/libc.so ;; cygwin*) # func_win32_libid is a shell function defined in ltmain.sh lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' ;; mingw* | pw32*) # Base MSYS/MinGW do not provide the 'file' command needed by # func_win32_libid shell function, so use a weaker test based on 'objdump', # unless we find 'file', for example because we are cross-compiling. if ( file / ) >/dev/null 2>&1; then lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' else # Keep this pattern in sync with the one in func_win32_libid. lt_cv_deplibs_check_method='file_magic file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' lt_cv_file_magic_cmd='$OBJDUMP -f' fi ;; cegcc*) # use the weaker test based on 'objdump'. See mingw*. lt_cv_deplibs_check_method='file_magic file format pe-arm-.*little(.*architecture: arm)?' lt_cv_file_magic_cmd='$OBJDUMP -f' ;; darwin* | rhapsody*) lt_cv_deplibs_check_method=pass_all ;; freebsd* | dragonfly*) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then case $host_cpu in i*86 ) # Not sure whether the presence of OpenBSD here was a mistake. # Let's accept both of them until this is cleared up. lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*` ;; esac else lt_cv_deplibs_check_method=pass_all fi ;; haiku*) lt_cv_deplibs_check_method=pass_all ;; hpux10.20* | hpux11*) lt_cv_file_magic_cmd=/usr/bin/file case $host_cpu in ia64*) lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64' lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so ;; hppa*64*) [lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]'] lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl ;; *) lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|PA-RISC[[0-9]]\.[[0-9]]) shared library' lt_cv_file_magic_test_file=/usr/lib/libc.sl ;; esac ;; interix[[3-9]]*) # PIC code is broken on Interix 3.x, that's why |\.a not |_pic\.a here lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so|\.a)$' ;; irix5* | irix6* | nonstopux*) case $LD in *-32|*"-32 ") libmagic=32-bit;; *-n32|*"-n32 ") libmagic=N32;; *-64|*"-64 ") libmagic=64-bit;; *) libmagic=never-match;; esac lt_cv_deplibs_check_method=pass_all ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) lt_cv_deplibs_check_method=pass_all ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so|_pic\.a)$' fi ;; newos6*) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=/usr/lib/libnls.so ;; *nto* | *qnx*) lt_cv_deplibs_check_method=pass_all ;; openbsd* | bitrig*) if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|\.so|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$' fi ;; osf3* | osf4* | osf5*) lt_cv_deplibs_check_method=pass_all ;; rdos*) lt_cv_deplibs_check_method=pass_all ;; solaris*) lt_cv_deplibs_check_method=pass_all ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) lt_cv_deplibs_check_method=pass_all ;; sysv4 | sysv4.3*) case $host_vendor in motorola) lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib) M[[0-9]][[0-9]]* Version [[0-9]]' lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*` ;; ncr) lt_cv_deplibs_check_method=pass_all ;; sequent) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB (shared object|dynamic lib )' ;; sni) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method="file_magic ELF [[0-9]][[0-9]]*-bit [[LM]]SB dynamic lib" lt_cv_file_magic_test_file=/lib/libc.so ;; siemens) lt_cv_deplibs_check_method=pass_all ;; pc) lt_cv_deplibs_check_method=pass_all ;; esac ;; tpf*) lt_cv_deplibs_check_method=pass_all ;; os2*) lt_cv_deplibs_check_method=pass_all ;; esac ]) file_magic_glob= want_nocaseglob=no if test "$build" = "$host"; then case $host_os in mingw* | pw32*) if ( shopt | grep nocaseglob ) >/dev/null 2>&1; then want_nocaseglob=yes else file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ | $SED -e "s/\(..\)/s\/[[\1]]\/[[\1]]\/g;/g"` fi ;; esac fi file_magic_cmd=$lt_cv_file_magic_cmd deplibs_check_method=$lt_cv_deplibs_check_method test -z "$deplibs_check_method" && deplibs_check_method=unknown _LT_DECL([], [deplibs_check_method], [1], [Method to check whether dependent libraries are shared objects]) _LT_DECL([], [file_magic_cmd], [1], [Command to use when deplibs_check_method = "file_magic"]) _LT_DECL([], [file_magic_glob], [1], [How to find potential files when deplibs_check_method = "file_magic"]) _LT_DECL([], [want_nocaseglob], [1], [Find potential files using nocaseglob when deplibs_check_method = "file_magic"]) ])# _LT_CHECK_MAGIC_METHOD # LT_PATH_NM # ---------- # find the pathname to a BSD- or MS-compatible name lister AC_DEFUN([LT_PATH_NM], [AC_REQUIRE([AC_PROG_CC])dnl AC_CACHE_CHECK([for BSD- or MS-compatible name lister (nm)], lt_cv_path_NM, [if test -n "$NM"; then # Let the user override the test. lt_cv_path_NM=$NM else lt_nm_to_check=${ac_tool_prefix}nm if test -n "$ac_tool_prefix" && test "$build" = "$host"; then lt_nm_to_check="$lt_nm_to_check nm" fi for lt_tmp_nm in $lt_nm_to_check; do lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. tmp_nm=$ac_dir/$lt_tmp_nm if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext"; then # Check to see if the nm accepts a BSD-compat flag. # Adding the 'sed 1q' prevents false positives on HP-UX, which says: # nm: unknown option "B" ignored # Tru64's nm complains that /dev/null is an invalid object file # MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty case $build_os in mingw*) lt_bad_file=conftest.nm/nofile ;; *) lt_bad_file=/dev/null ;; esac case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in *$lt_bad_file* | *'Invalid file or object type'*) lt_cv_path_NM="$tmp_nm -B" break 2 ;; *) case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in */dev/null*) lt_cv_path_NM="$tmp_nm -p" break 2 ;; *) lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but continue # so that we can try to find one that supports BSD flags ;; esac ;; esac fi done IFS=$lt_save_ifs done : ${lt_cv_path_NM=no} fi]) if test no != "$lt_cv_path_NM"; then NM=$lt_cv_path_NM else # Didn't find any BSD compatible name lister, look for dumpbin. if test -n "$DUMPBIN"; then : # Let the user override the test. else AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :) case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in *COFF*) DUMPBIN="$DUMPBIN -symbols -headers" ;; *) DUMPBIN=: ;; esac fi AC_SUBST([DUMPBIN]) if test : != "$DUMPBIN"; then NM=$DUMPBIN fi fi test -z "$NM" && NM=nm AC_SUBST([NM]) _LT_DECL([], [NM], [1], [A BSD- or MS-compatible name lister])dnl AC_CACHE_CHECK([the name lister ($NM) interface], [lt_cv_nm_interface], [lt_cv_nm_interface="BSD nm" echo "int some_variable = 0;" > conftest.$ac_ext (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&AS_MESSAGE_LOG_FD) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&AS_MESSAGE_LOG_FD (eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&AS_MESSAGE_LOG_FD) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&AS_MESSAGE_LOG_FD (eval echo "\"\$as_me:$LINENO: output\"" >&AS_MESSAGE_LOG_FD) cat conftest.out >&AS_MESSAGE_LOG_FD if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" fi rm -f conftest*]) ])# LT_PATH_NM # Old names: AU_ALIAS([AM_PROG_NM], [LT_PATH_NM]) AU_ALIAS([AC_PROG_NM], [LT_PATH_NM]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_PROG_NM], []) dnl AC_DEFUN([AC_PROG_NM], []) # _LT_CHECK_SHAREDLIB_FROM_LINKLIB # -------------------------------- # how to determine the name of the shared library # associated with a specific link library. # -- PORTME fill in with the dynamic library characteristics m4_defun([_LT_CHECK_SHAREDLIB_FROM_LINKLIB], [m4_require([_LT_DECL_EGREP]) m4_require([_LT_DECL_OBJDUMP]) m4_require([_LT_DECL_DLLTOOL]) AC_CACHE_CHECK([how to associate runtime and link libraries], lt_cv_sharedlib_from_linklib_cmd, [lt_cv_sharedlib_from_linklib_cmd='unknown' case $host_os in cygwin* | mingw* | pw32* | cegcc*) # two different shell functions defined in ltmain.sh; # decide which one to use based on capabilities of $DLLTOOL case `$DLLTOOL --help 2>&1` in *--identify-strict*) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib ;; *) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback ;; esac ;; *) # fallback: assume linklib IS sharedlib lt_cv_sharedlib_from_linklib_cmd=$ECHO ;; esac ]) sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO _LT_DECL([], [sharedlib_from_linklib_cmd], [1], [Command to associate shared and link libraries]) ])# _LT_CHECK_SHAREDLIB_FROM_LINKLIB # _LT_PATH_MANIFEST_TOOL # ---------------------- # locate the manifest tool m4_defun([_LT_PATH_MANIFEST_TOOL], [AC_CHECK_TOOL(MANIFEST_TOOL, mt, :) test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt AC_CACHE_CHECK([if $MANIFEST_TOOL is a manifest tool], [lt_cv_path_mainfest_tool], [lt_cv_path_mainfest_tool=no echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&AS_MESSAGE_LOG_FD $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out cat conftest.err >&AS_MESSAGE_LOG_FD if $GREP 'Manifest Tool' conftest.out > /dev/null; then lt_cv_path_mainfest_tool=yes fi rm -f conftest*]) if test yes != "$lt_cv_path_mainfest_tool"; then MANIFEST_TOOL=: fi _LT_DECL([], [MANIFEST_TOOL], [1], [Manifest tool])dnl ])# _LT_PATH_MANIFEST_TOOL # _LT_DLL_DEF_P([FILE]) # --------------------- # True iff FILE is a Windows DLL '.def' file. # Keep in sync with func_dll_def_p in the libtool script AC_DEFUN([_LT_DLL_DEF_P], [dnl test DEF = "`$SED -n dnl -e '\''s/^[[ ]]*//'\'' dnl Strip leading whitespace -e '\''/^\(;.*\)*$/d'\'' dnl Delete empty lines and comments -e '\''s/^\(EXPORTS\|LIBRARY\)\([[ ]].*\)*$/DEF/p'\'' dnl -e q dnl Only consider the first "real" line $1`" dnl ])# _LT_DLL_DEF_P # LT_LIB_M # -------- # check for math library AC_DEFUN([LT_LIB_M], [AC_REQUIRE([AC_CANONICAL_HOST])dnl LIBM= case $host in *-*-beos* | *-*-cegcc* | *-*-cygwin* | *-*-haiku* | *-*-pw32* | *-*-darwin*) # These system don't have libm, or don't need it ;; *-ncr-sysv4.3*) AC_CHECK_LIB(mw, _mwvalidcheckl, LIBM=-lmw) AC_CHECK_LIB(m, cos, LIBM="$LIBM -lm") ;; *) AC_CHECK_LIB(m, cos, LIBM=-lm) ;; esac AC_SUBST([LIBM]) ])# LT_LIB_M # Old name: AU_ALIAS([AC_CHECK_LIBM], [LT_LIB_M]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_CHECK_LIBM], []) # _LT_COMPILER_NO_RTTI([TAGNAME]) # ------------------------------- m4_defun([_LT_COMPILER_NO_RTTI], [m4_require([_LT_TAG_COMPILER])dnl _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)= if test yes = "$GCC"; then case $cc_basename in nvcc*) _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -Xcompiler -fno-builtin' ;; *) _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin' ;; esac _LT_COMPILER_OPTION([if $compiler supports -fno-rtti -fno-exceptions], lt_cv_prog_compiler_rtti_exceptions, [-fno-rtti -fno-exceptions], [], [_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)="$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1) -fno-rtti -fno-exceptions"]) fi _LT_TAGDECL([no_builtin_flag], [lt_prog_compiler_no_builtin_flag], [1], [Compiler flag to turn off builtin functions]) ])# _LT_COMPILER_NO_RTTI # _LT_CMD_GLOBAL_SYMBOLS # ---------------------- m4_defun([_LT_CMD_GLOBAL_SYMBOLS], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([AC_PROG_AWK])dnl AC_REQUIRE([LT_PATH_NM])dnl AC_REQUIRE([LT_PATH_LD])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_TAG_COMPILER])dnl # Check for command to grab the raw symbol name followed by C symbol from nm. AC_MSG_CHECKING([command to parse $NM output from $compiler object]) AC_CACHE_VAL([lt_cv_sys_global_symbol_pipe], [ # These are sane defaults that work on at least a few old systems. # [They come from Ultrix. What could be older than Ultrix?!! ;)] # Character class describing NM global symbol codes. symcode='[[BCDEGRST]]' # Regexp to match symbols that can be accessed directly from C. sympat='\([[_A-Za-z]][[_A-Za-z0-9]]*\)' # Define system-specific variables. case $host_os in aix*) symcode='[[BCDT]]' ;; cygwin* | mingw* | pw32* | cegcc*) symcode='[[ABCDGISTW]]' ;; hpux*) if test ia64 = "$host_cpu"; then symcode='[[ABCDEGRST]]' fi ;; irix* | nonstopux*) symcode='[[BCDEGRST]]' ;; osf*) symcode='[[BCDEGQRST]]' ;; solaris*) symcode='[[BDRT]]' ;; sco3.2v5*) symcode='[[DT]]' ;; sysv4.2uw2*) symcode='[[DT]]' ;; sysv5* | sco5v6* | unixware* | OpenUNIX*) symcode='[[ABDT]]' ;; sysv4) symcode='[[DFNSTU]]' ;; esac # If we're using GNU nm, then use its standard symbol codes. case `$NM -V 2>&1` in *GNU* | *'with BFD'*) symcode='[[ABCDGIRSTW]]' ;; esac if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Gets list of data symbols to import. lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'" # Adjust the below global symbol transforms to fixup imported variables. lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'" lt_c_name_hook=" -e 's/^I .* \(.*\)$/ {\"\1\", (void *) 0},/p'" lt_c_name_lib_hook="\ -e 's/^I .* \(lib.*\)$/ {\"\1\", (void *) 0},/p'\ -e 's/^I .* \(.*\)$/ {\"lib\1\", (void *) 0},/p'" else # Disable hooks by default. lt_cv_sys_global_symbol_to_import= lt_cdecl_hook= lt_c_name_hook= lt_c_name_lib_hook= fi # Transform an extracted symbol line into a proper C declaration. # Some systems (esp. on ia64) link data and code symbols differently, # so use this general approach. lt_cv_sys_global_symbol_to_cdecl="sed -n"\ $lt_cdecl_hook\ " -e 's/^T .* \(.*\)$/extern int \1();/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'" # Transform an extracted symbol line into symbol name and symbol address lt_cv_sys_global_symbol_to_c_name_address="sed -n"\ $lt_c_name_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/p'" # Transform an extracted symbol line into symbol name with lib prefix and # symbol address. lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\ $lt_c_name_lib_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(lib.*\)$/ {\"\1\", (void *) \&\1},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"lib\1\", (void *) \&\1},/p'" # Handle CRLF in mingw tool chain opt_cr= case $build_os in mingw*) opt_cr=`$ECHO 'x\{0,1\}' | tr x '\015'` # option cr in regexp ;; esac # Try without a prefix underscore, then with it. for ac_symprfx in "" "_"; do # Transform symcode, sympat, and symprfx into a raw symbol and a C symbol. symxfrm="\\1 $ac_symprfx\\2 \\2" # Write the raw and C identifiers. if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Fake it for dumpbin and say T for any non-static function, # D for any global variable and I for any imported variable. # Also find C++ and __fastcall symbols from MSVC++, # which start with @ or ?. lt_cv_sys_global_symbol_pipe="$AWK ['"\ " {last_section=section; section=\$ 3};"\ " /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\ " /Section length .*#relocs.*(pick any)/{hide[last_section]=1};"\ " /^ *Symbol name *: /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\ " /^ *Type *: code/{print \"T\",si,substr(si,length(prfx))};"\ " /^ *Type *: data/{print \"I\",si,substr(si,length(prfx))};"\ " \$ 0!~/External *\|/{next};"\ " / 0+ UNDEF /{next}; / UNDEF \([^|]\)*()/{next};"\ " {if(hide[section]) next};"\ " {f=\"D\"}; \$ 0~/\(\).*\|/{f=\"T\"};"\ " {split(\$ 0,a,/\||\r/); split(a[2],s)};"\ " s[1]~/^[@?]/{print f,s[1],s[1]; next};"\ " s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\ " ' prfx=^$ac_symprfx]" else lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[ ]]\($symcode$symcode*\)[[ ]][[ ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'" fi lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'" # Check to see that the pipe works correctly. pipe_works=no rm -f conftest* cat > conftest.$ac_ext <<_LT_EOF #ifdef __cplusplus extern "C" { #endif char nm_test_var; void nm_test_func(void); void nm_test_func(void){} #ifdef __cplusplus } #endif int main(){nm_test_var='a';nm_test_func();return(0);} _LT_EOF if AC_TRY_EVAL(ac_compile); then # Now try to grab the symbols. nlist=conftest.nm if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then # Try sorting and uniquifying the output. if sort "$nlist" | uniq > "$nlist"T; then mv -f "$nlist"T "$nlist" else rm -f "$nlist"T fi # Make sure that we snagged all the symbols we need. if $GREP ' nm_test_var$' "$nlist" >/dev/null; then if $GREP ' nm_test_func$' "$nlist" >/dev/null; then cat <<_LT_EOF > conftest.$ac_ext /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT@&t@_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT@&t@_DLSYM_CONST #else # define LT@&t@_DLSYM_CONST const #endif #ifdef __cplusplus extern "C" { #endif _LT_EOF # Now generate the symbol file. eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" | $GREP -v main >> conftest.$ac_ext' cat <<_LT_EOF >> conftest.$ac_ext /* The mapping between symbol names and symbols. */ LT@&t@_DLSYM_CONST struct { const char *name; void *address; } lt__PROGRAM__LTX_preloaded_symbols[[]] = { { "@PROGRAM@", (void *) 0 }, _LT_EOF $SED "s/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/" < "$nlist" | $GREP -v main >> conftest.$ac_ext cat <<\_LT_EOF >> conftest.$ac_ext {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt__PROGRAM__LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif _LT_EOF # Now try linking the two files. mv conftest.$ac_objext conftstm.$ac_objext lt_globsym_save_LIBS=$LIBS lt_globsym_save_CFLAGS=$CFLAGS LIBS=conftstm.$ac_objext CFLAGS="$CFLAGS$_LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)" if AC_TRY_EVAL(ac_link) && test -s conftest$ac_exeext; then pipe_works=yes fi LIBS=$lt_globsym_save_LIBS CFLAGS=$lt_globsym_save_CFLAGS else echo "cannot find nm_test_func in $nlist" >&AS_MESSAGE_LOG_FD fi else echo "cannot find nm_test_var in $nlist" >&AS_MESSAGE_LOG_FD fi else echo "cannot run $lt_cv_sys_global_symbol_pipe" >&AS_MESSAGE_LOG_FD fi else echo "$progname: failed program was:" >&AS_MESSAGE_LOG_FD cat conftest.$ac_ext >&5 fi rm -rf conftest* conftst* # Do not use the global_symbol_pipe unless it works. if test yes = "$pipe_works"; then break else lt_cv_sys_global_symbol_pipe= fi done ]) if test -z "$lt_cv_sys_global_symbol_pipe"; then lt_cv_sys_global_symbol_to_cdecl= fi if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then AC_MSG_RESULT(failed) else AC_MSG_RESULT(ok) fi # Response file support. if test "$lt_cv_nm_interface" = "MS dumpbin"; then nm_file_list_spec='@' elif $NM --help 2>/dev/null | grep '[[@]]FILE' >/dev/null; then nm_file_list_spec='@' fi _LT_DECL([global_symbol_pipe], [lt_cv_sys_global_symbol_pipe], [1], [Take the output of nm and produce a listing of raw symbols and C names]) _LT_DECL([global_symbol_to_cdecl], [lt_cv_sys_global_symbol_to_cdecl], [1], [Transform the output of nm in a proper C declaration]) _LT_DECL([global_symbol_to_import], [lt_cv_sys_global_symbol_to_import], [1], [Transform the output of nm into a list of symbols to manually relocate]) _LT_DECL([global_symbol_to_c_name_address], [lt_cv_sys_global_symbol_to_c_name_address], [1], [Transform the output of nm in a C name address pair]) _LT_DECL([global_symbol_to_c_name_address_lib_prefix], [lt_cv_sys_global_symbol_to_c_name_address_lib_prefix], [1], [Transform the output of nm in a C name address pair when lib prefix is needed]) _LT_DECL([nm_interface], [lt_cv_nm_interface], [1], [The name lister interface]) _LT_DECL([], [nm_file_list_spec], [1], [Specify filename containing input files for $NM]) ]) # _LT_CMD_GLOBAL_SYMBOLS # _LT_COMPILER_PIC([TAGNAME]) # --------------------------- m4_defun([_LT_COMPILER_PIC], [m4_require([_LT_TAG_COMPILER])dnl _LT_TAGVAR(lt_prog_compiler_wl, $1)= _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)= m4_if([$1], [CXX], [ # C++ specific cases for pic, static, wl, etc. if test yes = "$GXX"; then _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' ;; *djgpp*) # DJGPP does not support shared libraries at all _LT_TAGVAR(lt_prog_compiler_pic, $1)= ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. _LT_TAGVAR(lt_prog_compiler_static, $1)= ;; interix[[3-9]]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic fi ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac else case $host_os in aix[[4-9]]*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' else _LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp' fi ;; chorus*) case $cc_basename in cxch68*) # Green Hills C++ Compiler # _LT_TAGVAR(lt_prog_compiler_static, $1)="--no_auto_instantiation -u __main -u __premain -u _abort -r $COOL_DIR/lib/libOrb.a $MVME_DIR/lib/CC/libC.a $MVME_DIR/lib/classix/libcx.s.a" ;; esac ;; mingw* | cygwin* | os2* | pw32* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) ;; dgux*) case $cc_basename in ec++*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' ;; ghcx*) # Green Hills C++ Compiler _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; *) ;; esac ;; freebsd* | dragonfly*) # FreeBSD uses GNU C++ ;; hpux9* | hpux10* | hpux11*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' if test ia64 != "$host_cpu"; then _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' fi ;; aCC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' ;; esac ;; *) ;; esac ;; interix*) # This is c89, which is MS Visual C++ (no shared libs) # Anyone wants to do a port? ;; irix5* | irix6* | nonstopux*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' # CC pic flag -KPIC is the default. ;; *) ;; esac ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # KAI C++ Compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; ecpc* ) # old Intel C++ for x86_64, which still supported -KPIC. _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; icpc* ) # Intel C++, used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; pgCC* | pgcpp*) # Portland Group C++ compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; cxx*) # Compaq C++ # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; xlc* | xlC* | bgxl[[cC]]* | mpixl[[cC]]*) # IBM XL 8.0, 9.0 on PPC and BlueGene _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; esac ;; esac ;; lynxos*) ;; m88k*) ;; mvs*) case $cc_basename in cxx*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-W c,exportall' ;; *) ;; esac ;; netbsd* | netbsdelf*-gnu) ;; *qnx* | *nto*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='--backend -Wl,' ;; RCC*) # Rational C++ 2.4.1 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; cxx*) # Digital/Compaq C++ _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # Make sure the PIC flag is empty. It appears that all Alpha # Linux and Compaq Tru64 Unix objects are PIC. _LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; *) ;; esac ;; psos*) ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; gcx*) # Green Hills C++ Compiler _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' ;; *) ;; esac ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; lcc*) # Lucid _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' ;; *) ;; esac ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) case $cc_basename in CC*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' ;; *) ;; esac ;; vxworks*) ;; *) _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; esac fi ], [ if test yes = "$GCC"; then _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. _LT_TAGVAR(lt_prog_compiler_static, $1)= ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac ;; interix[[3-9]]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; msdosdjgpp*) # Just because we use GCC doesn't mean we suddenly get shared libraries # on systems that don't support them. _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no enable_shared=no ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)=-Kconform_pic fi ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' ;; esac case $cc_basename in nvcc*) # Cuda Compiler Driver 2.2 _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Xlinker ' if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then _LT_TAGVAR(lt_prog_compiler_pic, $1)="-Xcompiler $_LT_TAGVAR(lt_prog_compiler_pic, $1)" fi ;; esac else # PORTME Check for flag to pass linker flags through the system compiler. case $host_os in aix*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' else _LT_TAGVAR(lt_prog_compiler_static, $1)='-bnso -bI:/lib/syscalls.exp' fi ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fno-common' case $cc_basename in nagfor*) # NAG Fortran compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). m4_if([$1], [GCJ], [], [_LT_TAGVAR(lt_prog_compiler_pic, $1)='-DDLL_EXPORT']) case $host_os in os2*) _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-static' ;; esac ;; hpux9* | hpux10* | hpux11*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # PIC is the default for IA64 HP-UX and 64-bit HP-UX, but # not for PA HP-UX. case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)='+Z' ;; esac # Is there a better lt_prog_compiler_static that works with the bundled CC? _LT_TAGVAR(lt_prog_compiler_static, $1)='$wl-a ${wl}archive' ;; irix5* | irix6* | nonstopux*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # PIC (with -KPIC) is the default. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in # old Intel for x86_64, which still supported -KPIC. ecc*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; # icc used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. icc* | ifort*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; # Lahey Fortran 8.1. lf95*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='--shared' _LT_TAGVAR(lt_prog_compiler_static, $1)='--static' ;; nagfor*) # NAG Fortran compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,-Wl,,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; tcc*) # Fabrice Bellard et al's Tiny C Compiler _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; pgcc* | pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group compilers (*not* the Pentium gcc compiler, # which looks to be a dead project) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; ccc*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # All Alpha code is PIC. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; xl* | bgxl* | bgf* | mpixl*) # IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-qpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*) # Sun Fortran 8.3 passes all unrecognized flags to the linker _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='' ;; *Sun\ F* | *Sun*Fortran*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' ;; *Sun\ C*) # Sun C 5.9 _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' ;; *Intel*\ [[CF]]*Compiler*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-static' ;; *Portland\ Group*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fpic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; esac ;; esac ;; newsos6) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. _LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC -shared' ;; osf3* | osf4* | osf5*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' # All OSF/1 code is PIC. _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; rdos*) _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared' ;; solaris*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' case $cc_basename in f77* | f90* | f95* | sunf77* | sunf90* | sunf95*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ';; *) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,';; esac ;; sunos4*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Qoption ld ' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-PIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; sysv4 | sysv4.2uw2* | sysv4.3*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(lt_prog_compiler_pic, $1)='-Kconform_pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' fi ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; unicos*) _LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,' _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; uts4*) _LT_TAGVAR(lt_prog_compiler_pic, $1)='-pic' _LT_TAGVAR(lt_prog_compiler_static, $1)='-Bstatic' ;; *) _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no ;; esac fi ]) case $host_os in # For platforms that do not support PIC, -DPIC is meaningless: *djgpp*) _LT_TAGVAR(lt_prog_compiler_pic, $1)= ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)="$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])" ;; esac AC_CACHE_CHECK([for $compiler option to produce PIC], [_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)], [_LT_TAGVAR(lt_cv_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_prog_compiler_pic, $1)]) _LT_TAGVAR(lt_prog_compiler_pic, $1)=$_LT_TAGVAR(lt_cv_prog_compiler_pic, $1) # # Check to make sure the PIC flag actually works. # if test -n "$_LT_TAGVAR(lt_prog_compiler_pic, $1)"; then _LT_COMPILER_OPTION([if $compiler PIC flag $_LT_TAGVAR(lt_prog_compiler_pic, $1) works], [_LT_TAGVAR(lt_cv_prog_compiler_pic_works, $1)], [$_LT_TAGVAR(lt_prog_compiler_pic, $1)@&t@m4_if([$1],[],[ -DPIC],[m4_if([$1],[CXX],[ -DPIC],[])])], [], [case $_LT_TAGVAR(lt_prog_compiler_pic, $1) in "" | " "*) ;; *) _LT_TAGVAR(lt_prog_compiler_pic, $1)=" $_LT_TAGVAR(lt_prog_compiler_pic, $1)" ;; esac], [_LT_TAGVAR(lt_prog_compiler_pic, $1)= _LT_TAGVAR(lt_prog_compiler_can_build_shared, $1)=no]) fi _LT_TAGDECL([pic_flag], [lt_prog_compiler_pic], [1], [Additional compiler flags for building library objects]) _LT_TAGDECL([wl], [lt_prog_compiler_wl], [1], [How to pass a linker flag through the compiler]) # # Check to make sure the static flag actually works. # wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1) eval lt_tmp_static_flag=\"$_LT_TAGVAR(lt_prog_compiler_static, $1)\" _LT_LINKER_OPTION([if $compiler static flag $lt_tmp_static_flag works], _LT_TAGVAR(lt_cv_prog_compiler_static_works, $1), $lt_tmp_static_flag, [], [_LT_TAGVAR(lt_prog_compiler_static, $1)=]) _LT_TAGDECL([link_static_flag], [lt_prog_compiler_static], [1], [Compiler flag to prevent dynamic linking]) ])# _LT_COMPILER_PIC # _LT_LINKER_SHLIBS([TAGNAME]) # ---------------------------- # See if the linker supports building shared libraries. m4_defun([_LT_LINKER_SHLIBS], [AC_REQUIRE([LT_PATH_LD])dnl AC_REQUIRE([LT_PATH_NM])dnl m4_require([_LT_PATH_MANIFEST_TOOL])dnl m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_DECL_SED])dnl m4_require([_LT_CMD_GLOBAL_SYMBOLS])dnl m4_require([_LT_TAG_COMPILER])dnl AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries]) m4_if([$1], [CXX], [ _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*'] case $host_os in aix[[4-9]]*) # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi ;; pw32*) _LT_TAGVAR(export_symbols_cmds, $1)=$ltdll_cmds ;; cygwin* | mingw* | cegcc*) case $cc_basename in cl*) _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' ;; *) _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1 DATA/;s/^.*[[ ]]__nm__\([[^ ]]*\)[[ ]][[^ ]]*/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname'] ;; esac ;; linux* | k*bsd*-gnu | gnu*) _LT_TAGVAR(link_all_deplibs, $1)=no ;; *) _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' ;; esac ], [ runpath_var= _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_cmds, $1)= _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(compiler_needs_object, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(old_archive_from_new_cmds, $1)= _LT_TAGVAR(old_archive_from_expsyms_cmds, $1)= _LT_TAGVAR(thread_safe_flag_spec, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= # include_expsyms should be a list of space-separated symbols to be *always* # included in the symbol list _LT_TAGVAR(include_expsyms, $1)= # exclude_expsyms can be an extended regexp of symbols to exclude # it will be wrapped by ' (' and ')$', so one must not match beginning or # end of line. Example: 'a|bc|.*d.*' will exclude the symbols 'a' and 'bc', # as well as any symbol that contains 'd'. _LT_TAGVAR(exclude_expsyms, $1)=['_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*'] # Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out # platforms (ab)use it in PIC code, but their linkers get confused if # the symbol is explicitly referenced. Since portable code cannot # rely on this symbol name, it's probably fine to never include it in # preloaded symbol tables. # Exclude shared library initialization/finalization symbols. dnl Note also adjust exclude_expsyms for C++ above. extract_expsyms_cmds= case $host_os in cygwin* | mingw* | pw32* | cegcc*) # FIXME: the MSVC++ port hasn't been tested in a loooong time # When not using gcc, we currently assume that we are using # Microsoft Visual C++. if test yes != "$GCC"; then with_gnu_ld=no fi ;; interix*) # we just hope/assume this is gcc and not c89 (= MSVC++) with_gnu_ld=yes ;; openbsd* | bitrig*) with_gnu_ld=no ;; linux* | k*bsd*-gnu | gnu*) _LT_TAGVAR(link_all_deplibs, $1)=no ;; esac _LT_TAGVAR(ld_shlibs, $1)=yes # On some targets, GNU ld is compatible enough with the native linker # that we're better off using the native interface for both. lt_use_gnu_ld_interface=no if test yes = "$with_gnu_ld"; then case $host_os in aix*) # The AIX port of GNU ld has always aspired to compatibility # with the native linker. However, as the warning in the GNU ld # block says, versions before 2.19.5* couldn't really create working # shared libraries, regardless of the interface used. case `$LD -v 2>&1` in *\ \(GNU\ Binutils\)\ 2.19.5*) ;; *\ \(GNU\ Binutils\)\ 2.[[2-9]]*) ;; *\ \(GNU\ Binutils\)\ [[3-9]]*) ;; *) lt_use_gnu_ld_interface=yes ;; esac ;; *) lt_use_gnu_ld_interface=yes ;; esac fi if test yes = "$lt_use_gnu_ld_interface"; then # If archive_cmds runs LD, not CC, wlarc should be empty wlarc='$wl' # Set some defaults for GNU ld with shared library support. These # are reset later if shared libraries are not supported. Putting them # here allows them to be overridden if necessary. runpath_var=LD_RUN_PATH _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # ancient GNU ld didn't support --whole-archive et. al. if $LD --help 2>&1 | $GREP 'no-whole-archive' > /dev/null; then _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else _LT_TAGVAR(whole_archive_flag_spec, $1)= fi supports_anon_versioning=no case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in *GNU\ gold*) supports_anon_versioning=yes ;; *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11 *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ... *\ 2.11.92.0.12\ *) supports_anon_versioning=yes ;; # Mandrake 8.2 ... *\ 2.11.*) ;; # other 2.11 versions *) supports_anon_versioning=yes ;; esac # See if GNU ld supports shared libraries. case $host_os in aix[[3-9]]*) # On AIX/PPC, the GNU linker is very broken if test ia64 != "$host_cpu"; then _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: the GNU linker, at least up to release 2.19, is reported *** to be unable to reliably create shared libraries on AIX. *** Therefore, libtool is disabling shared libraries support. If you *** really care for shared libraries, you may want to install binutils *** 2.20 or above, or modify your PATH so that a non-GNU linker is found. *** You will then need to restart the configuration process. _LT_EOF fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='' ;; m68k) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME _LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; cygwin* | mingw* | pw32* | cegcc*) # _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless, # as there is no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1 DATA/;s/^.*[[ ]]__nm__\([[^ ]]*\)[[ ]][[^ ]]*/\1 DATA/;/^I[[ ]]/d;/^[[AITW]][[ ]]/s/.* //'\'' | sort | uniq > $export_symbols' _LT_TAGVAR(exclude_expsyms, $1)=['[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname'] if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; haiku*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(link_all_deplibs, $1)=yes ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; interix[[3-9]]*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu) tmp_diet=no if test linux-dietlibc = "$host_os"; then case $cc_basename in diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn) esac fi if $LD --help 2>&1 | $EGREP ': supported targets:.* elf' > /dev/null \ && test no = "$tmp_diet" then tmp_addflag=' $pic_flag' tmp_sharedflag='-shared' case $cc_basename,$host_cpu in pgcc*) # Portland Group C compiler _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag' ;; pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group f77 and f90 compilers _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag -Mnomain' ;; ecc*,ia64* | icc*,ia64*) # Intel C compiler on ia64 tmp_addflag=' -i_dynamic' ;; efc*,ia64* | ifort*,ia64*) # Intel Fortran compiler on ia64 tmp_addflag=' -i_dynamic -nofor_main' ;; ifc* | ifort*) # Intel Fortran compiler tmp_addflag=' -nofor_main' ;; lf95*) # Lahey Fortran 8.1 _LT_TAGVAR(whole_archive_flag_spec, $1)= tmp_sharedflag='--shared' ;; nagfor*) # NAGFOR 5.3 tmp_sharedflag='-Wl,-shared' ;; xl[[cC]]* | bgxl[[cC]]* | mpixl[[cC]]*) # IBM XL C 8.0 on PPC (deal with xlf below) tmp_sharedflag='-qmkshrobj' tmp_addflag= ;; nvcc*) # Cuda Compiler Driver 2.2 _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes ;; esac case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C 5.9 _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes tmp_sharedflag='-G' ;; *Sun\ F*) # Sun Fortran 8.3 tmp_sharedflag='-G' ;; esac _LT_TAGVAR(archive_cmds, $1)='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi case $cc_basename in tcc*) _LT_TAGVAR(export_dynamic_flag_spec, $1)='-rdynamic' ;; xlf* | bgf* | bgxlf* | mpixlf*) # IBM XL Fortran 10.1 on PPC cannot create shared libs itself _LT_TAGVAR(whole_archive_flag_spec, $1)='--whole-archive$convenience --no-whole-archive' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib' fi ;; esac else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib' wlarc= else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' fi ;; solaris*) if $LD -v 2>&1 | $GREP 'BFD 2\.8' > /dev/null; then _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: The releases 2.8.* of the GNU linker cannot reliably *** create shared libraries on Solaris systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.9.1 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF elif $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX*) case `$LD -v 2>&1` in *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.1[[0-5]].*) _LT_TAGVAR(ld_shlibs, $1)=no cat <<_LT_EOF 1>&2 *** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot *** reliably create shared libraries on SCO systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.16.91.0.3 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF ;; *) # For security reasons, it is highly recommended that you always # use absolute paths for naming shared libraries, and exclude the # DT_RUNPATH tag from executables and libraries. But doing so # requires that you compile everything twice, which is a pain. if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; sunos4*) _LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags' wlarc= _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac if test no = "$_LT_TAGVAR(ld_shlibs, $1)"; then runpath_var= _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= fi else # PORTME fill in a description of your system's linker (not GNU ld) case $host_os in aix3*) _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname' # Note: this linker hardcodes the directories in LIBPATH if there # are no directories specified by -L. _LT_TAGVAR(hardcode_minus_L, $1)=yes if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then # Neither direct hardcoding nor static linking is supported with a # broken collect2. _LT_TAGVAR(hardcode_direct, $1)=unsupported fi ;; aix[[4-9]]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[[23]]|aix4.[[23]].*|aix[[5-9]]*) for ld_flag in $LDFLAGS; do if (test x-brtl = "x$ld_flag" || test x-Wl,-brtl = "x$ld_flag"); then aix_use_runtimelinking=yes break fi done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. _LT_TAGVAR(archive_cmds, $1)='' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(file_list_spec, $1)='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # traditional, no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no ;; esac if test yes = "$GCC"; then case $host_os in aix4.[[012]]|aix4.[[012]].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 _LT_TAGVAR(hardcode_direct, $1)=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)= fi ;; esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag="$shared_flag "'$wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to export. _LT_TAGVAR(always_export_symbols, $1)=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. _LT_TAGVAR(allow_undefined_flag, $1)='-berok' # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib' _LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs" _LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. _LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok' _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives _LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience' fi _LT_TAGVAR(archive_cmds_need_lc, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([[, ]]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared libraries. _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d' fi fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='' ;; m68k) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac ;; bsdi[[45]]*) _LT_TAGVAR(export_dynamic_flag_spec, $1)=-rdynamic ;; cygwin* | mingw* | pw32* | cegcc*) # When not using gcc, we currently assume that we are using # Microsoft Visual C++. # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. case $cc_basename in cl*) # Native MSVC _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(file_list_spec, $1)='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[[BCDGRS]][[ ]]/s/.*[[ ]]\([[^ ]]*\)/\1,DATA/'\'' | $SED -e '\''/^[[AITW]][[ ]]/s/.*[[ ]]//'\'' | sort | uniq > $export_symbols' # Don't use ranlib _LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib' _LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # Assume MSVC wrapper _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" | $SED '\''s/ -lc$//'\''` -link -dll~linknames=' # The linker will automatically build a .lib file if we build a DLL. _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' # FIXME: Should let the user specify the lib program. _LT_TAGVAR(old_archive_cmds, $1)='lib -OUT:$oldlib$oldobjs$old_deplibs' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; esac ;; darwin* | rhapsody*) _LT_DARWIN_LINKER_FEATURES($1) ;; dgux*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor # support. Future versions do this automatically, but an explicit c++rt0.o # does not break anything, and helps significantly (at the cost of a little # extra space). freebsd2.2*) _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # Unfortunately, older versions of FreeBSD 2 do not have this feature. freebsd2.*) _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; # FreeBSD 3 and greater uses gcc -shared to do shared libraries. freebsd* | dragonfly*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; hpux9*) if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_direct, $1)=yes # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' ;; hpux10*) if test yes,no = "$GCC,$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes fi ;; hpux11*) if test yes,no = "$GCC,$with_gnu_ld"; then case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' ;; esac else case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) m4_if($1, [], [ # Older versions of the 11.00 compiler do not understand -b yet # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does) _LT_LINKER_OPTION([if $CC understands -b], _LT_TAGVAR(lt_cv_prog_compiler__b, $1), [-b], [_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'], [_LT_TAGVAR(archive_cmds, $1)='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'])], [_LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags']) ;; esac fi if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: case $host_cpu in hppa*64*|ia64*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. _LT_TAGVAR(hardcode_minus_L, $1)=yes ;; esac fi ;; irix5* | irix6* | nonstopux*) if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' # Try to use the -exported_symbol ld option, if it does not # work, assume that -exports_file does not work either and # implicitly export all symbols. # This should be the same for all languages, so no per-tag cache variable. AC_CACHE_CHECK([whether the $host_os linker accepts -exported_symbol], [lt_cv_irix_exported_symbol], [save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null" AC_LINK_IFELSE( [AC_LANG_SOURCE( [AC_LANG_CASE([C], [[int foo (void) { return 0; }]], [C++], [[int foo (void) { return 0; }]], [Fortran 77], [[ subroutine foo end]], [Fortran], [[ subroutine foo end]])])], [lt_cv_irix_exported_symbol=yes], [lt_cv_irix_exported_symbol=no]) LDFLAGS=$save_LDFLAGS]) if test yes = "$lt_cv_irix_exported_symbol"; then _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib' fi _LT_TAGVAR(link_all_deplibs, $1)=no else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(inherit_rpath, $1)=yes _LT_TAGVAR(link_all_deplibs, $1)=yes ;; linux*) case $cc_basename in tcc*) # Fabrice Bellard et al's Tiny C Compiler _LT_TAGVAR(ld_shlibs, $1)=yes _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out else _LT_TAGVAR(archive_cmds, $1)='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; newsos6) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *nto* | *qnx*) ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=yes if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' fi else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; osf3*) if test yes = "$GCC"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: ;; osf4* | osf5*) # as osf3* with the addition of -msym flag if test yes = "$GCC"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' else _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp' # Both c and cxx compiler support -rpath directly _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' fi _LT_TAGVAR(archive_cmds_need_lc, $1)='no' _LT_TAGVAR(hardcode_libdir_separator, $1)=: ;; solaris*) _LT_TAGVAR(no_undefined_flag, $1)=' -z defs' if test yes = "$GCC"; then wlarc='$wl' _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' else case `$CC -V 2>&1` in *"Compilers 5.0"*) wlarc='' _LT_TAGVAR(archive_cmds, $1)='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp' ;; *) wlarc='$wl' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' ;; esac fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. GCC discards it without '$wl', # but is careful enough not to reorder. # Supported since Solaris 2.6 (maybe 2.5.1?) if test yes = "$GCC"; then _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' else _LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract' fi ;; esac _LT_TAGVAR(link_all_deplibs, $1)=yes ;; sunos4*) if test sequent = "$host_vendor"; then # Use $CC to link under sequent, because it throws in some extra .o # files that make .init and .fini sections work. _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; sysv4) case $host_vendor in sni) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=yes # is this really true??? ;; siemens) ## LD is ld it makes a PLAMLIB ## CC just makes a GrossModule. _LT_TAGVAR(archive_cmds, $1)='$LD -G -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(reload_cmds, $1)='$CC -r -o $output$reload_objs' _LT_TAGVAR(hardcode_direct, $1)=no ;; motorola) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_direct, $1)=no #Motorola manual says yes, but my tests say they lie ;; esac runpath_var='LD_RUN_PATH' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; sysv4.3*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)='-Bexport' ;; sysv4*MP*) if test -d /usr/nec; then _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var=LD_RUN_PATH hardcode_runpath_var=yes _LT_TAGVAR(ld_shlibs, $1)=yes fi ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[[01]].[[10]]* | unixware7* | sco3.2v5.0.[[024]]*) _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport' runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; uts4*) _LT_TAGVAR(archive_cmds, $1)='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(ld_shlibs, $1)=no ;; esac if test sni = "$host_vendor"; then case $host in sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*) _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Blargedynsym' ;; esac fi fi ]) AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)]) test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no _LT_TAGVAR(with_gnu_ld, $1)=$with_gnu_ld _LT_DECL([], [libext], [0], [Old archive suffix (normally "a")])dnl _LT_DECL([], [shrext_cmds], [1], [Shared library suffix (normally ".so")])dnl _LT_DECL([], [extract_expsyms_cmds], [2], [The commands to extract the exported symbol list from a shared archive]) # # Do we need to explicitly link libc? # case "x$_LT_TAGVAR(archive_cmds_need_lc, $1)" in x|xyes) # Assume -lc should be added _LT_TAGVAR(archive_cmds_need_lc, $1)=yes if test yes,yes = "$GCC,$enable_shared"; then case $_LT_TAGVAR(archive_cmds, $1) in *'~'*) # FIXME: we may have to deal with multi-command sequences. ;; '$CC '*) # Test whether the compiler implicitly links with -lc since on some # systems, -lgcc has to come before -lc. If gcc already passes -lc # to ld, don't add -lc before -lgcc. AC_CACHE_CHECK([whether -lc should be explicitly linked in], [lt_cv_]_LT_TAGVAR(archive_cmds_need_lc, $1), [$RM conftest* echo "$lt_simple_compile_test_code" > conftest.$ac_ext if AC_TRY_EVAL(ac_compile) 2>conftest.err; then soname=conftest lib=conftest libobjs=conftest.$ac_objext deplibs= wl=$_LT_TAGVAR(lt_prog_compiler_wl, $1) pic_flag=$_LT_TAGVAR(lt_prog_compiler_pic, $1) compiler_flags=-v linker_flags=-v verstring= output_objdir=. libname=conftest lt_save_allow_undefined_flag=$_LT_TAGVAR(allow_undefined_flag, $1) _LT_TAGVAR(allow_undefined_flag, $1)= if AC_TRY_EVAL(_LT_TAGVAR(archive_cmds, $1) 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) then lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=no else lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1)=yes fi _LT_TAGVAR(allow_undefined_flag, $1)=$lt_save_allow_undefined_flag else cat conftest.err 1>&5 fi $RM conftest* ]) _LT_TAGVAR(archive_cmds_need_lc, $1)=$lt_cv_[]_LT_TAGVAR(archive_cmds_need_lc, $1) ;; esac fi ;; esac _LT_TAGDECL([build_libtool_need_lc], [archive_cmds_need_lc], [0], [Whether or not to add -lc for building shared libraries]) _LT_TAGDECL([allow_libtool_libs_with_static_runtimes], [enable_shared_with_static_runtimes], [0], [Whether or not to disallow shared libs when runtime libs are static]) _LT_TAGDECL([], [export_dynamic_flag_spec], [1], [Compiler flag to allow reflexive dlopens]) _LT_TAGDECL([], [whole_archive_flag_spec], [1], [Compiler flag to generate shared objects directly from archives]) _LT_TAGDECL([], [compiler_needs_object], [1], [Whether the compiler copes with passing no objects directly]) _LT_TAGDECL([], [old_archive_from_new_cmds], [2], [Create an old-style archive from a shared archive]) _LT_TAGDECL([], [old_archive_from_expsyms_cmds], [2], [Create a temporary old-style archive to link instead of a shared archive]) _LT_TAGDECL([], [archive_cmds], [2], [Commands used to build a shared archive]) _LT_TAGDECL([], [archive_expsym_cmds], [2]) _LT_TAGDECL([], [module_cmds], [2], [Commands used to build a loadable module if different from building a shared archive.]) _LT_TAGDECL([], [module_expsym_cmds], [2]) _LT_TAGDECL([], [with_gnu_ld], [1], [Whether we are building with GNU ld or not]) _LT_TAGDECL([], [allow_undefined_flag], [1], [Flag that allows shared libraries with undefined symbols to be built]) _LT_TAGDECL([], [no_undefined_flag], [1], [Flag that enforces no undefined symbols]) _LT_TAGDECL([], [hardcode_libdir_flag_spec], [1], [Flag to hardcode $libdir into a binary during linking. This must work even if $libdir does not exist]) _LT_TAGDECL([], [hardcode_libdir_separator], [1], [Whether we need a single "-rpath" flag with a separated argument]) _LT_TAGDECL([], [hardcode_direct], [0], [Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_direct_absolute], [0], [Set to "yes" if using DIR/libNAME$shared_ext during linking hardcodes DIR into the resulting binary and the resulting library dependency is "absolute", i.e impossible to change by setting $shlibpath_var if the library is relocated]) _LT_TAGDECL([], [hardcode_minus_L], [0], [Set to "yes" if using the -LDIR flag during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_shlibpath_var], [0], [Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR into the resulting binary]) _LT_TAGDECL([], [hardcode_automatic], [0], [Set to "yes" if building a shared library automatically hardcodes DIR into the library and all subsequent libraries and executables linked against it]) _LT_TAGDECL([], [inherit_rpath], [0], [Set to yes if linker adds runtime paths of dependent libraries to runtime path list]) _LT_TAGDECL([], [link_all_deplibs], [0], [Whether libtool must link a program against all its dependency libraries]) _LT_TAGDECL([], [always_export_symbols], [0], [Set to "yes" if exported symbols are required]) _LT_TAGDECL([], [export_symbols_cmds], [2], [The commands to list exported symbols]) _LT_TAGDECL([], [exclude_expsyms], [1], [Symbols that should not be listed in the preloaded symbols]) _LT_TAGDECL([], [include_expsyms], [1], [Symbols that must always be exported]) _LT_TAGDECL([], [prelink_cmds], [2], [Commands necessary for linking programs (against libraries) with templates]) _LT_TAGDECL([], [postlink_cmds], [2], [Commands necessary for finishing linking programs]) _LT_TAGDECL([], [file_list_spec], [1], [Specify filename containing input files]) dnl FIXME: Not yet implemented dnl _LT_TAGDECL([], [thread_safe_flag_spec], [1], dnl [Compiler flag to generate thread safe objects]) ])# _LT_LINKER_SHLIBS # _LT_LANG_C_CONFIG([TAG]) # ------------------------ # Ensure that the configuration variables for a C compiler are suitably # defined. These variables are subsequently used by _LT_CONFIG to write # the compiler configuration to 'libtool'. m4_defun([_LT_LANG_C_CONFIG], [m4_require([_LT_DECL_EGREP])dnl lt_save_CC=$CC AC_LANG_PUSH(C) # Source file extension for C test sources. ac_ext=c # Object file extension for compiled C test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(){return(0);}' _LT_TAG_COMPILER # Save the default compiler, since it gets overwritten when the other # tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP. compiler_DEFAULT=$CC # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) LT_SYS_DLOPEN_SELF _LT_CMD_STRIPLIB # Report what library types will actually be built AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_CONFIG($1) fi AC_LANG_POP CC=$lt_save_CC ])# _LT_LANG_C_CONFIG # _LT_LANG_CXX_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for a C++ compiler are suitably # defined. These variables are subsequently used by _LT_CONFIG to write # the compiler configuration to 'libtool'. m4_defun([_LT_LANG_CXX_CONFIG], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl m4_require([_LT_DECL_EGREP])dnl m4_require([_LT_PATH_MANIFEST_TOOL])dnl if test -n "$CXX" && ( test no != "$CXX" && ( (test g++ = "$CXX" && `g++ -v >/dev/null 2>&1` ) || (test g++ != "$CXX"))); then AC_PROG_CXXCPP else _lt_caught_CXX_error=yes fi AC_LANG_PUSH(C++) _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(compiler_needs_object, $1)=no _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=unsupported _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for C++ test sources. ac_ext=cpp # Object file extension for compiled C++ test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the CXX compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_caught_CXX_error"; then # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(int, char *[[]]) { return(0); }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_LD=$LD lt_save_GCC=$GCC GCC=$GXX lt_save_with_gnu_ld=$with_gnu_ld lt_save_path_LD=$lt_cv_path_LD if test -n "${lt_cv_prog_gnu_ldcxx+set}"; then lt_cv_prog_gnu_ld=$lt_cv_prog_gnu_ldcxx else $as_unset lt_cv_prog_gnu_ld fi if test -n "${lt_cv_path_LDCXX+set}"; then lt_cv_path_LD=$lt_cv_path_LDCXX else $as_unset lt_cv_path_LD fi test -z "${LDCXX+set}" || LD=$LDCXX CC=${CXX-"c++"} CFLAGS=$CXXFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) if test -n "$compiler"; then # We don't want -fno-exception when compiling C++ code, so set the # no_builtin_flag separately if test yes = "$GXX"; then _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)=' -fno-builtin' else _LT_TAGVAR(lt_prog_compiler_no_builtin_flag, $1)= fi if test yes = "$GXX"; then # Set up default GNU C++ configuration LT_PATH_LD # Check if GNU C++ uses GNU ld as the underlying linker, since the # archiving commands below assume that GNU ld is being used. if test yes = "$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC $pic_flag -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # If archive_cmds runs LD, not CC, wlarc should be empty # XXX I think wlarc can be eliminated in ltcf-cxx, but I need to # investigate it a little bit more. (MM) wlarc='$wl' # ancient GNU ld didn't support --whole-archive et. al. if eval "`$CC -print-prog-name=ld` --help 2>&1" | $GREP 'no-whole-archive' > /dev/null; then _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else _LT_TAGVAR(whole_archive_flag_spec, $1)= fi else with_gnu_ld=no wlarc= # A generic and very simple default shared library creation # command for GNU C++ for the case where it uses the native # linker, instead of GNU ld. If possible, this setting should # overridden to take advantage of the native linker features on # the platform it is being used on. _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' fi # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else GXX=no with_gnu_ld=no wlarc= fi # PORTME: fill in a description of your system's C++ link characteristics AC_MSG_CHECKING([whether the $compiler linker ($LD) supports shared libraries]) _LT_TAGVAR(ld_shlibs, $1)=yes case $host_os in aix3*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aix[[4-9]]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[[23]]|aix4.[[23]].*|aix[[5-9]]*) for ld_flag in $LDFLAGS; do case $ld_flag in *-brtl*) aix_use_runtimelinking=yes break ;; esac done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. _LT_TAGVAR(archive_cmds, $1)='' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(file_list_spec, $1)='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no ;; esac if test yes = "$GXX"; then case $host_os in aix4.[[012]]|aix4.[[012]].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 _LT_TAGVAR(hardcode_direct, $1)=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)= fi esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag=$shared_flag' $wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to # export. _LT_TAGVAR(always_export_symbols, $1)=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. # The "-G" linker flag allows undefined symbols. _LT_TAGVAR(no_undefined_flag, $1)='-bernotok' # Determine the default libpath from the value encoded in an empty # executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $libdir:/usr/lib:/lib' _LT_TAGVAR(allow_undefined_flag, $1)="-z nodefs" _LT_TAGVAR(archive_expsym_cmds, $1)="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. _LT_SYS_MODULE_PATH_AIX([$1]) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. _LT_TAGVAR(no_undefined_flag, $1)=' $wl-bernotok' _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives _LT_TAGVAR(whole_archive_flag_spec, $1)='$convenience' fi _LT_TAGVAR(archive_cmds_need_lc, $1)=yes _LT_TAGVAR(archive_expsym_cmds, $1)='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([[, ]]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared # libraries. Need -bnortl late, we may have -brtl in LDFLAGS. _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi _LT_TAGVAR(archive_expsym_cmds, $1)="$_LT_TAGVAR(archive_expsym_cmds, $1)"'~$RM -r $output_objdir/$realname.d' fi fi ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then _LT_TAGVAR(allow_undefined_flag, $1)=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME _LT_TAGVAR(archive_cmds, $1)='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; chorus*) case $cc_basename in *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; cygwin* | mingw* | pw32* | cegcc*) case $GXX,$cc_basename in ,cl* | no,cl*) # Native MSVC # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' ' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=yes _LT_TAGVAR(file_list_spec, $1)='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. _LT_TAGVAR(archive_cmds, $1)='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, $1)='true' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes # Don't use ranlib _LT_TAGVAR(old_postinstall_cmds, $1)='chmod 644 $oldlib' _LT_TAGVAR(postlink_cmds, $1)='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ func_to_tool_file "$lt_outputfile"~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # g++ # _LT_TAGVAR(hardcode_libdir_flag_spec, $1) is actually meaningless, # as there is no search path for DLLs. _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-all-symbols' _LT_TAGVAR(allow_undefined_flag, $1)=unsupported _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... _LT_TAGVAR(archive_expsym_cmds, $1)='if _LT_DLL_DEF_P([$export_symbols]); then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared -nostdlib $output_objdir/$soname.def $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; darwin* | rhapsody*) _LT_DARWIN_LINKER_FEATURES($1) ;; os2*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-L$libdir' _LT_TAGVAR(hardcode_minus_L, $1)=yes _LT_TAGVAR(allow_undefined_flag, $1)=unsupported shrext_cmds=.dll _LT_TAGVAR(archive_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(archive_expsym_cmds, $1)='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes ;; dgux*) case $cc_basename in ec++*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; ghcx*) # Green Hills C++ Compiler # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; freebsd2.*) # C++ shared libraries reported to be fairly broken before # switch to ELF _LT_TAGVAR(ld_shlibs, $1)=no ;; freebsd-elf*) _LT_TAGVAR(archive_cmds_need_lc, $1)=no ;; freebsd* | dragonfly*) # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF # conventions _LT_TAGVAR(ld_shlibs, $1)=yes ;; haiku*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(link_all_deplibs, $1)=yes ;; hpux9*) _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH, # but as the default # location of the library. case $cc_basename in CC*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aCC*) _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -b $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then _LT_TAGVAR(archive_cmds, $1)='$RM $output_objdir/$soname~$CC -shared -nostdlib $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; hpux10*|hpux11*) if test no = "$with_gnu_ld"; then _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl+b $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: case $host_cpu in hppa*64*|ia64*) ;; *) _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' ;; esac fi case $host_cpu in hppa*64*|ia64*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no ;; *) _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(hardcode_minus_L, $1)=yes # Not in the search PATH, # but as the default # location of the library. ;; esac case $cc_basename in CC*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; aCC*) case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then case $host_cpu in hppa*64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC $wl+h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; ia64*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' ;; esac fi else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; interix[[3-9]]*) _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; irix5* | irix6*) case $cc_basename in CC*) # SGI C++ _LT_TAGVAR(archive_cmds, $1)='$CC -shared -all -multigot $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' # Archives containing C++ object files must be created using # "CC -ar", where "CC" is the IRIX C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -ar -WR,-u -o $oldlib $oldobjs' ;; *) if test yes = "$GXX"; then if test no = "$with_gnu_ld"; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` -o $lib' fi fi _LT_TAGVAR(link_all_deplibs, $1)=yes ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: _LT_TAGVAR(inherit_rpath, $1)=yes ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. _LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo $lib | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib $wl-retain-symbols-file,$export_symbols; mv \$templib $lib' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 | $GREP "ld"`; rm -f libconftest$shared_ext; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' # Archives containing C++ object files must be created using # "CC -Bstatic", where "CC" is the KAI C++ compiler. _LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs' ;; icpc* | ecpc* ) # Intel C++ with_gnu_ld=yes # version 8.0 and above of icpc choke on multiply defined symbols # if we add $predep_objects and $postdep_objects, however 7.1 and # earlier do not add the objects themselves. case `$CC -V 2>&1` in *"Version 7."*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 8.0 or newer tmp_idyn= case $host_cpu in ia64*) tmp_idyn=' -i_dynamic';; esac _LT_TAGVAR(archive_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared'"$tmp_idyn"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive$convenience $wl--no-whole-archive' ;; pgCC* | pgcpp*) # Portland Group C++ compiler case `$CC -V` in *pgCC\ [[1-5]].* | *pgcpp\ [[1-5]].*) _LT_TAGVAR(prelink_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~ compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"' _LT_TAGVAR(old_archive_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~ $AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~ $RANLIB $oldlib' _LT_TAGVAR(archive_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='tpldir=Template.dir~ rm -rf $tpldir~ $CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~ $CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; *) # Version 6 and above use weak symbols _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl--rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' ;; cxx*) # Compaq C++ _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname -o $lib $wl-retain-symbols-file $wl$export_symbols' runpath_var=LD_RUN_PATH _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld .*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "X$list" | $Xsed' ;; xl* | mpixl* | bgxl*) # IBM XL 8.0 on PPC, with GNU ld _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl--export-dynamic' _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C++ 5.9 _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file $wl$export_symbols' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' _LT_TAGVAR(compiler_needs_object, $1)=yes # Not sure whether something based on # $CC $CFLAGS -v conftest.$objext -o libconftest$shared_ext 2>&1 # would be better. output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs' ;; esac ;; esac ;; lynxos*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; m88k*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; mvs*) case $cc_basename in cxx*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; netbsd*) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then _LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $predep_objects $libobjs $deplibs $postdep_objects $linker_flags' wlarc= _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no fi # Workaround some broken pre-1.5 toolchains output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP conftest.$objext | $SED -e "s:-lgcc -lc -lgcc::"' ;; *nto* | *qnx*) _LT_TAGVAR(ld_shlibs, $1)=yes ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then _LT_TAGVAR(hardcode_direct, $1)=yes _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=yes _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' if test -z "`echo __ELF__ | $CC -E - | grep __ELF__`"; then _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-retain-symbols-file,$export_symbols -o $lib' _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-E' _LT_TAGVAR(whole_archive_flag_spec, $1)=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' fi output_verbose_link_cmd=func_echo_all else _LT_TAGVAR(ld_shlibs, $1)=no fi ;; osf3* | osf4* | osf5*) case $cc_basename in KCC*) # Kuck and Associates, Inc. (KAI) C++ Compiler # KCC will only create a shared library if the output file # ends with ".so" (or ".sl" for HP-UX), so rename the library # to its proper name (with version) after linking. _LT_TAGVAR(archive_cmds, $1)='tempext=`echo $shared_ext | $SED -e '\''s/\([[^()0-9A-Za-z{}]]\)/\\\\\1/g'\''`; templib=`echo "$lib" | $SED -e "s/\$tempext\..*/.so/"`; $CC $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags --soname $soname -o \$templib; mv \$templib $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Archives containing C++ object files must be created using # the KAI C++ compiler. case $host in osf3*) _LT_TAGVAR(old_archive_cmds, $1)='$CC -Bstatic -o $oldlib $oldobjs' ;; *) _LT_TAGVAR(old_archive_cmds, $1)='$CC -o $oldlib $oldobjs' ;; esac ;; RCC*) # Rational C++ 2.4.1 # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; cxx*) case $host in osf3*) _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $soname `test -n "$verstring" && func_echo_all "$wl-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' ;; *) _LT_TAGVAR(allow_undefined_flag, $1)=' -expect_unresolved \*' _LT_TAGVAR(archive_cmds, $1)='$CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done~ echo "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags -msym -soname $soname $wl-input $wl$lib.exp `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~ $RM $lib.exp' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-rpath $libdir' ;; esac _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. # # There doesn't appear to be a way to prevent this compiler from # explicitly linking system object files so we need to strip them # from the output so that they don't get included in the library # dependencies. output_verbose_link_cmd='templist=`$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP "ld" | $GREP -v "ld:"`; templist=`func_echo_all "$templist" | $SED "s/\(^.*ld.*\)\( .*ld.*$\)/\1/"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"' ;; *) if test yes,no = "$GXX,$with_gnu_ld"; then _LT_TAGVAR(allow_undefined_flag, $1)=' $wl-expect_unresolved $wl\*' case $host in osf3*) _LT_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $allow_undefined_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' ;; esac _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=: # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no fi ;; esac ;; psos*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; sunos4*) case $cc_basename in CC*) # Sun C++ 4.x # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; lcc*) # Lucid # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; solaris*) case $cc_basename in CC* | sunCC*) # Sun C++ 4.2, 5.x and Centerline C++ _LT_TAGVAR(archive_cmds_need_lc,$1)=yes _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs' _LT_TAGVAR(archive_cmds, $1)='$CC -G$allow_undefined_flag -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag $wl-M $wl$lib.exp -h$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir' _LT_TAGVAR(hardcode_shlibpath_var, $1)=no case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. # Supported since Solaris 2.6 (maybe 2.5.1?) _LT_TAGVAR(whole_archive_flag_spec, $1)='-z allextract$convenience -z defaultextract' ;; esac _LT_TAGVAR(link_all_deplibs, $1)=yes output_verbose_link_cmd='func_echo_all' # Archives containing C++ object files must be created using # "CC -xar", where "CC" is the Sun C++ compiler. This is # necessary to make sure instantiated templates are included # in the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC -xar -o $oldlib $oldobjs' ;; gcx*) # Green Hills C++ Compiler _LT_TAGVAR(archive_cmds, $1)='$CC -shared $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' # The C++ compiler must be used to create the archive. _LT_TAGVAR(old_archive_cmds, $1)='$CC $LDFLAGS -archive -o $oldlib $oldobjs' ;; *) # GNU C++ compiler with Solaris linker if test yes,no = "$GXX,$with_gnu_ld"; then _LT_TAGVAR(no_undefined_flag, $1)=' $wl-z ${wl}defs' if $CC --version | $GREP -v '^2\.7' > /dev/null; then _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' else # g++ 2.7 appears to require '-G' NOT '-shared' on this # platform. _LT_TAGVAR(archive_cmds, $1)='$CC -G -nostdlib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags $wl-h $wl$soname -o $lib' _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G -nostdlib $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~$RM $lib.exp' # Commands to make compiler produce verbose output that lists # what "hidden" libraries, object files and flags are used when # linking a shared library. output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"' fi _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir' case $host_os in solaris2.[[0-5]] | solaris2.[[0-5]].*) ;; *) _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' ;; esac fi ;; esac ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[[01]].[[10]]* | unixware7* | sco3.2v5.0.[[024]]*) _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no runpath_var='LD_RUN_PATH' case $cc_basename in CC*) _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. _LT_TAGVAR(no_undefined_flag, $1)='$wl-z,text' _LT_TAGVAR(allow_undefined_flag, $1)='$wl-z,nodefs' _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(hardcode_shlibpath_var, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R,$libdir' _LT_TAGVAR(hardcode_libdir_separator, $1)=':' _LT_TAGVAR(link_all_deplibs, $1)=yes _LT_TAGVAR(export_dynamic_flag_spec, $1)='$wl-Bexport' runpath_var='LD_RUN_PATH' case $cc_basename in CC*) _LT_TAGVAR(archive_cmds, $1)='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(old_archive_cmds, $1)='$CC -Tprelink_objects $oldobjs~ '"$_LT_TAGVAR(old_archive_cmds, $1)" _LT_TAGVAR(reload_cmds, $1)='$CC -Tprelink_objects $reload_objs~ '"$_LT_TAGVAR(reload_cmds, $1)" ;; *) _LT_TAGVAR(archive_cmds, $1)='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; tandem*) case $cc_basename in NCC*) # NonStop-UX NCC 3.20 # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac ;; vxworks*) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; *) # FIXME: insert proper C++ library support _LT_TAGVAR(ld_shlibs, $1)=no ;; esac AC_MSG_RESULT([$_LT_TAGVAR(ld_shlibs, $1)]) test no = "$_LT_TAGVAR(ld_shlibs, $1)" && can_build_shared=no _LT_TAGVAR(GCC, $1)=$GXX _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_SYS_HIDDEN_LIBDEPS($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS LDCXX=$LD LD=$lt_save_LD GCC=$lt_save_GCC with_gnu_ld=$lt_save_with_gnu_ld lt_cv_path_LDCXX=$lt_cv_path_LD lt_cv_path_LD=$lt_save_path_LD lt_cv_prog_gnu_ldcxx=$lt_cv_prog_gnu_ld lt_cv_prog_gnu_ld=$lt_save_with_gnu_ld fi # test yes != "$_lt_caught_CXX_error" AC_LANG_POP ])# _LT_LANG_CXX_CONFIG # _LT_FUNC_STRIPNAME_CNF # ---------------------- # func_stripname_cnf prefix suffix name # strip PREFIX and SUFFIX off of NAME. # PREFIX and SUFFIX must not contain globbing or regex special # characters, hashes, percent signs, but SUFFIX may contain a leading # dot (in which case that matches only a dot). # # This function is identical to the (non-XSI) version of func_stripname, # except this one can be used by m4 code that may be executed by configure, # rather than the libtool script. m4_defun([_LT_FUNC_STRIPNAME_CNF],[dnl AC_REQUIRE([_LT_DECL_SED]) AC_REQUIRE([_LT_PROG_ECHO_BACKSLASH]) func_stripname_cnf () { case @S|@2 in .*) func_stripname_result=`$ECHO "@S|@3" | $SED "s%^@S|@1%%; s%\\\\@S|@2\$%%"`;; *) func_stripname_result=`$ECHO "@S|@3" | $SED "s%^@S|@1%%; s%@S|@2\$%%"`;; esac } # func_stripname_cnf ])# _LT_FUNC_STRIPNAME_CNF # _LT_SYS_HIDDEN_LIBDEPS([TAGNAME]) # --------------------------------- # Figure out "hidden" library dependencies from verbose # compiler output when linking a shared library. # Parse the compiler output and extract the necessary # objects, libraries and library flags. m4_defun([_LT_SYS_HIDDEN_LIBDEPS], [m4_require([_LT_FILEUTILS_DEFAULTS])dnl AC_REQUIRE([_LT_FUNC_STRIPNAME_CNF])dnl # Dependencies to place before and after the object being linked: _LT_TAGVAR(predep_objects, $1)= _LT_TAGVAR(postdep_objects, $1)= _LT_TAGVAR(predeps, $1)= _LT_TAGVAR(postdeps, $1)= _LT_TAGVAR(compiler_lib_search_path, $1)= dnl we can't use the lt_simple_compile_test_code here, dnl because it contains code intended for an executable, dnl not a library. It's possible we should let each dnl tag define a new lt_????_link_test_code variable, dnl but it's only used here... m4_if([$1], [], [cat > conftest.$ac_ext <<_LT_EOF int a; void foo (void) { a = 0; } _LT_EOF ], [$1], [CXX], [cat > conftest.$ac_ext <<_LT_EOF class Foo { public: Foo (void) { a = 0; } private: int a; }; _LT_EOF ], [$1], [F77], [cat > conftest.$ac_ext <<_LT_EOF subroutine foo implicit none integer*4 a a=0 return end _LT_EOF ], [$1], [FC], [cat > conftest.$ac_ext <<_LT_EOF subroutine foo implicit none integer a a=0 return end _LT_EOF ], [$1], [GCJ], [cat > conftest.$ac_ext <<_LT_EOF public class foo { private int a; public void bar (void) { a = 0; } }; _LT_EOF ], [$1], [GO], [cat > conftest.$ac_ext <<_LT_EOF package foo func foo() { } _LT_EOF ]) _lt_libdeps_save_CFLAGS=$CFLAGS case "$CC $CFLAGS " in #( *\ -flto*\ *) CFLAGS="$CFLAGS -fno-lto" ;; *\ -fwhopr*\ *) CFLAGS="$CFLAGS -fno-whopr" ;; *\ -fuse-linker-plugin*\ *) CFLAGS="$CFLAGS -fno-use-linker-plugin" ;; esac dnl Parse the compiler output and extract the necessary dnl objects, libraries and library flags. if AC_TRY_EVAL(ac_compile); then # Parse the compiler output and extract the necessary # objects, libraries and library flags. # Sentinel used to keep track of whether or not we are before # the conftest object file. pre_test_object_deps_done=no for p in `eval "$output_verbose_link_cmd"`; do case $prev$p in -L* | -R* | -l*) # Some compilers place space between "-{L,R}" and the path. # Remove the space. if test x-L = "$p" || test x-R = "$p"; then prev=$p continue fi # Expand the sysroot to ease extracting the directories later. if test -z "$prev"; then case $p in -L*) func_stripname_cnf '-L' '' "$p"; prev=-L; p=$func_stripname_result ;; -R*) func_stripname_cnf '-R' '' "$p"; prev=-R; p=$func_stripname_result ;; -l*) func_stripname_cnf '-l' '' "$p"; prev=-l; p=$func_stripname_result ;; esac fi case $p in =*) func_stripname_cnf '=' '' "$p"; p=$lt_sysroot$func_stripname_result ;; esac if test no = "$pre_test_object_deps_done"; then case $prev in -L | -R) # Internal compiler library paths should come after those # provided the user. The postdeps already come after the # user supplied libs so there is no need to process them. if test -z "$_LT_TAGVAR(compiler_lib_search_path, $1)"; then _LT_TAGVAR(compiler_lib_search_path, $1)=$prev$p else _LT_TAGVAR(compiler_lib_search_path, $1)="${_LT_TAGVAR(compiler_lib_search_path, $1)} $prev$p" fi ;; # The "-l" case would never come before the object being # linked, so don't bother handling this case. esac else if test -z "$_LT_TAGVAR(postdeps, $1)"; then _LT_TAGVAR(postdeps, $1)=$prev$p else _LT_TAGVAR(postdeps, $1)="${_LT_TAGVAR(postdeps, $1)} $prev$p" fi fi prev= ;; *.lto.$objext) ;; # Ignore GCC LTO objects *.$objext) # This assumes that the test object file only shows up # once in the compiler output. if test "$p" = "conftest.$objext"; then pre_test_object_deps_done=yes continue fi if test no = "$pre_test_object_deps_done"; then if test -z "$_LT_TAGVAR(predep_objects, $1)"; then _LT_TAGVAR(predep_objects, $1)=$p else _LT_TAGVAR(predep_objects, $1)="$_LT_TAGVAR(predep_objects, $1) $p" fi else if test -z "$_LT_TAGVAR(postdep_objects, $1)"; then _LT_TAGVAR(postdep_objects, $1)=$p else _LT_TAGVAR(postdep_objects, $1)="$_LT_TAGVAR(postdep_objects, $1) $p" fi fi ;; *) ;; # Ignore the rest. esac done # Clean up. rm -f a.out a.exe else echo "libtool.m4: error: problem compiling $1 test program" fi $RM -f confest.$objext CFLAGS=$_lt_libdeps_save_CFLAGS # PORTME: override above test on systems where it is broken m4_if([$1], [CXX], [case $host_os in interix[[3-9]]*) # Interix 3.5 installs completely hosed .la files for C++, so rather than # hack all around it, let's just trust "g++" to DTRT. _LT_TAGVAR(predep_objects,$1)= _LT_TAGVAR(postdep_objects,$1)= _LT_TAGVAR(postdeps,$1)= ;; esac ]) case " $_LT_TAGVAR(postdeps, $1) " in *" -lc "*) _LT_TAGVAR(archive_cmds_need_lc, $1)=no ;; esac _LT_TAGVAR(compiler_lib_search_dirs, $1)= if test -n "${_LT_TAGVAR(compiler_lib_search_path, $1)}"; then _LT_TAGVAR(compiler_lib_search_dirs, $1)=`echo " ${_LT_TAGVAR(compiler_lib_search_path, $1)}" | $SED -e 's! -L! !g' -e 's!^ !!'` fi _LT_TAGDECL([], [compiler_lib_search_dirs], [1], [The directories searched by this compiler when creating a shared library]) _LT_TAGDECL([], [predep_objects], [1], [Dependencies to place before and after the objects being linked to create a shared library]) _LT_TAGDECL([], [postdep_objects], [1]) _LT_TAGDECL([], [predeps], [1]) _LT_TAGDECL([], [postdeps], [1]) _LT_TAGDECL([], [compiler_lib_search_path], [1], [The library search path used internally by the compiler when linking a shared library]) ])# _LT_SYS_HIDDEN_LIBDEPS # _LT_LANG_F77_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for a Fortran 77 compiler are # suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_F77_CONFIG], [AC_LANG_PUSH(Fortran 77) if test -z "$F77" || test no = "$F77"; then _lt_disable_F77=yes fi _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for f77 test sources. ac_ext=f # Object file extension for compiled f77 test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the F77 compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_disable_F77"; then # Code to be used in simple compile tests lt_simple_compile_test_code="\ subroutine t return end " # Code to be used in simple link tests lt_simple_link_test_code="\ program t end " # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_GCC=$GCC lt_save_CFLAGS=$CFLAGS CC=${F77-"f77"} CFLAGS=$FFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) GCC=$G77 if test -n "$compiler"; then AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_TAGVAR(GCC, $1)=$G77 _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS fi # test yes != "$_lt_disable_F77" AC_LANG_POP ])# _LT_LANG_F77_CONFIG # _LT_LANG_FC_CONFIG([TAG]) # ------------------------- # Ensure that the configuration variables for a Fortran compiler are # suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_FC_CONFIG], [AC_LANG_PUSH(Fortran) if test -z "$FC" || test no = "$FC"; then _lt_disable_FC=yes fi _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(allow_undefined_flag, $1)= _LT_TAGVAR(always_export_symbols, $1)=no _LT_TAGVAR(archive_expsym_cmds, $1)= _LT_TAGVAR(export_dynamic_flag_spec, $1)= _LT_TAGVAR(hardcode_direct, $1)=no _LT_TAGVAR(hardcode_direct_absolute, $1)=no _LT_TAGVAR(hardcode_libdir_flag_spec, $1)= _LT_TAGVAR(hardcode_libdir_separator, $1)= _LT_TAGVAR(hardcode_minus_L, $1)=no _LT_TAGVAR(hardcode_automatic, $1)=no _LT_TAGVAR(inherit_rpath, $1)=no _LT_TAGVAR(module_cmds, $1)= _LT_TAGVAR(module_expsym_cmds, $1)= _LT_TAGVAR(link_all_deplibs, $1)=unknown _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds _LT_TAGVAR(no_undefined_flag, $1)= _LT_TAGVAR(whole_archive_flag_spec, $1)= _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=no # Source file extension for fc test sources. ac_ext=${ac_fc_srcext-f} # Object file extension for compiled fc test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # No sense in running all these tests if we already determined that # the FC compiler isn't working. Some variables (like enable_shared) # are currently assumed to apply to all compilers on this platform, # and will be corrupted by setting them based on a non-working compiler. if test yes != "$_lt_disable_FC"; then # Code to be used in simple compile tests lt_simple_compile_test_code="\ subroutine t return end " # Code to be used in simple link tests lt_simple_link_test_code="\ program t end " # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_GCC=$GCC lt_save_CFLAGS=$CFLAGS CC=${FC-"f95"} CFLAGS=$FCFLAGS compiler=$CC GCC=$ac_cv_fc_compiler_gnu _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) if test -n "$compiler"; then AC_MSG_CHECKING([if libtool supports shared libraries]) AC_MSG_RESULT([$can_build_shared]) AC_MSG_CHECKING([whether to build shared libraries]) test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[[4-9]]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac AC_MSG_RESULT([$enable_shared]) AC_MSG_CHECKING([whether to build static libraries]) # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes AC_MSG_RESULT([$enable_static]) _LT_TAGVAR(GCC, $1)=$ac_cv_fc_compiler_gnu _LT_TAGVAR(LD, $1)=$LD ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... _LT_SYS_HIDDEN_LIBDEPS($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_SYS_DYNAMIC_LINKER($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi # test -n "$compiler" GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS fi # test yes != "$_lt_disable_FC" AC_LANG_POP ])# _LT_LANG_FC_CONFIG # _LT_LANG_GCJ_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for the GNU Java Compiler compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_GCJ_CONFIG], [AC_REQUIRE([LT_PROG_GCJ])dnl AC_LANG_SAVE # Source file extension for Java test sources. ac_ext=java # Object file extension for compiled Java test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="class foo {}" # Code to be used in simple link tests lt_simple_link_test_code='public class conftest { public static void main(String[[]] argv) {}; }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC=yes CC=${GCJ-"gcj"} CFLAGS=$GCJFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_TAGVAR(LD, $1)=$LD _LT_CC_BASENAME([$compiler]) # GCJ did not exist at the time GCC didn't implicitly link libc in. _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi AC_LANG_RESTORE GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_GCJ_CONFIG # _LT_LANG_GO_CONFIG([TAG]) # -------------------------- # Ensure that the configuration variables for the GNU Go compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_GO_CONFIG], [AC_REQUIRE([LT_PROG_GO])dnl AC_LANG_SAVE # Source file extension for Go test sources. ac_ext=go # Object file extension for compiled Go test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="package main; func main() { }" # Code to be used in simple link tests lt_simple_link_test_code='package main; func main() { }' # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC=yes CC=${GOC-"gccgo"} CFLAGS=$GOFLAGS compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_TAGVAR(LD, $1)=$LD _LT_CC_BASENAME([$compiler]) # Go did not exist at the time GCC didn't implicitly link libc in. _LT_TAGVAR(archive_cmds_need_lc, $1)=no _LT_TAGVAR(old_archive_cmds, $1)=$old_archive_cmds _LT_TAGVAR(reload_flag, $1)=$reload_flag _LT_TAGVAR(reload_cmds, $1)=$reload_cmds ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then _LT_COMPILER_NO_RTTI($1) _LT_COMPILER_PIC($1) _LT_COMPILER_C_O($1) _LT_COMPILER_FILE_LOCKS($1) _LT_LINKER_SHLIBS($1) _LT_LINKER_HARDCODE_LIBPATH($1) _LT_CONFIG($1) fi AC_LANG_RESTORE GCC=$lt_save_GCC CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_GO_CONFIG # _LT_LANG_RC_CONFIG([TAG]) # ------------------------- # Ensure that the configuration variables for the Windows resource compiler # are suitably defined. These variables are subsequently used by _LT_CONFIG # to write the compiler configuration to 'libtool'. m4_defun([_LT_LANG_RC_CONFIG], [AC_REQUIRE([LT_PROG_RC])dnl AC_LANG_SAVE # Source file extension for RC test sources. ac_ext=rc # Object file extension for compiled RC test sources. objext=o _LT_TAGVAR(objext, $1)=$objext # Code to be used in simple compile tests lt_simple_compile_test_code='sample MENU { MENUITEM "&Soup", 100, CHECKED }' # Code to be used in simple link tests lt_simple_link_test_code=$lt_simple_compile_test_code # ltmain only uses $CC for tagged configurations so make sure $CC is set. _LT_TAG_COMPILER # save warnings/boilerplate of simple test code _LT_COMPILER_BOILERPLATE _LT_LINKER_BOILERPLATE # Allow CC to be a program name with arguments. lt_save_CC=$CC lt_save_CFLAGS=$CFLAGS lt_save_GCC=$GCC GCC= CC=${RC-"windres"} CFLAGS= compiler=$CC _LT_TAGVAR(compiler, $1)=$CC _LT_CC_BASENAME([$compiler]) _LT_TAGVAR(lt_cv_prog_compiler_c_o, $1)=yes if test -n "$compiler"; then : _LT_CONFIG($1) fi GCC=$lt_save_GCC AC_LANG_RESTORE CC=$lt_save_CC CFLAGS=$lt_save_CFLAGS ])# _LT_LANG_RC_CONFIG # LT_PROG_GCJ # ----------- AC_DEFUN([LT_PROG_GCJ], [m4_ifdef([AC_PROG_GCJ], [AC_PROG_GCJ], [m4_ifdef([A][M_PROG_GCJ], [A][M_PROG_GCJ], [AC_CHECK_TOOL(GCJ, gcj,) test set = "${GCJFLAGS+set}" || GCJFLAGS="-g -O2" AC_SUBST(GCJFLAGS)])])[]dnl ]) # Old name: AU_ALIAS([LT_AC_PROG_GCJ], [LT_PROG_GCJ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_GCJ], []) # LT_PROG_GO # ---------- AC_DEFUN([LT_PROG_GO], [AC_CHECK_TOOL(GOC, gccgo,) ]) # LT_PROG_RC # ---------- AC_DEFUN([LT_PROG_RC], [AC_CHECK_TOOL(RC, windres,) ]) # Old name: AU_ALIAS([LT_AC_PROG_RC], [LT_PROG_RC]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_RC], []) # _LT_DECL_EGREP # -------------- # If we don't have a new enough Autoconf to choose the best grep # available, choose the one first in the user's PATH. m4_defun([_LT_DECL_EGREP], [AC_REQUIRE([AC_PROG_EGREP])dnl AC_REQUIRE([AC_PROG_FGREP])dnl test -z "$GREP" && GREP=grep _LT_DECL([], [GREP], [1], [A grep program that handles long lines]) _LT_DECL([], [EGREP], [1], [An ERE matcher]) _LT_DECL([], [FGREP], [1], [A literal string matcher]) dnl Non-bleeding-edge autoconf doesn't subst GREP, so do it here too AC_SUBST([GREP]) ]) # _LT_DECL_OBJDUMP # -------------- # If we don't have a new enough Autoconf to choose the best objdump # available, choose the one first in the user's PATH. m4_defun([_LT_DECL_OBJDUMP], [AC_CHECK_TOOL(OBJDUMP, objdump, false) test -z "$OBJDUMP" && OBJDUMP=objdump _LT_DECL([], [OBJDUMP], [1], [An object symbol dumper]) AC_SUBST([OBJDUMP]) ]) # _LT_DECL_DLLTOOL # ---------------- # Ensure DLLTOOL variable is set. m4_defun([_LT_DECL_DLLTOOL], [AC_CHECK_TOOL(DLLTOOL, dlltool, false) test -z "$DLLTOOL" && DLLTOOL=dlltool _LT_DECL([], [DLLTOOL], [1], [DLL creation program]) AC_SUBST([DLLTOOL]) ]) # _LT_DECL_SED # ------------ # Check for a fully-functional sed program, that truncates # as few characters as possible. Prefer GNU sed if found. m4_defun([_LT_DECL_SED], [AC_PROG_SED test -z "$SED" && SED=sed Xsed="$SED -e 1s/^X//" _LT_DECL([], [SED], [1], [A sed program that does not truncate output]) _LT_DECL([], [Xsed], ["\$SED -e 1s/^X//"], [Sed that helps us avoid accidentally triggering echo(1) options like -n]) ])# _LT_DECL_SED m4_ifndef([AC_PROG_SED], [ ############################################################ # NOTE: This macro has been submitted for inclusion into # # GNU Autoconf as AC_PROG_SED. When it is available in # # a released version of Autoconf we should remove this # # macro and use it instead. # ############################################################ m4_defun([AC_PROG_SED], [AC_MSG_CHECKING([for a sed that does not truncate output]) AC_CACHE_VAL(lt_cv_path_SED, [# Loop through the user's path and test for sed and gsed. # Then use that list of sed's as ones to test for truncation. as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for lt_ac_prog in sed gsed; do for ac_exec_ext in '' $ac_executable_extensions; do if $as_executable_p "$as_dir/$lt_ac_prog$ac_exec_ext"; then lt_ac_sed_list="$lt_ac_sed_list $as_dir/$lt_ac_prog$ac_exec_ext" fi done done done IFS=$as_save_IFS lt_ac_max=0 lt_ac_count=0 # Add /usr/xpg4/bin/sed as it is typically found on Solaris # along with /bin/sed that truncates output. for lt_ac_sed in $lt_ac_sed_list /usr/xpg4/bin/sed; do test ! -f "$lt_ac_sed" && continue cat /dev/null > conftest.in lt_ac_count=0 echo $ECHO_N "0123456789$ECHO_C" >conftest.in # Check for GNU sed and select it if it is found. if "$lt_ac_sed" --version 2>&1 < /dev/null | grep 'GNU' > /dev/null; then lt_cv_path_SED=$lt_ac_sed break fi while true; do cat conftest.in conftest.in >conftest.tmp mv conftest.tmp conftest.in cp conftest.in conftest.nl echo >>conftest.nl $lt_ac_sed -e 's/a$//' < conftest.nl >conftest.out || break cmp -s conftest.out conftest.nl || break # 10000 chars as input seems more than enough test 10 -lt "$lt_ac_count" && break lt_ac_count=`expr $lt_ac_count + 1` if test "$lt_ac_count" -gt "$lt_ac_max"; then lt_ac_max=$lt_ac_count lt_cv_path_SED=$lt_ac_sed fi done done ]) SED=$lt_cv_path_SED AC_SUBST([SED]) AC_MSG_RESULT([$SED]) ])#AC_PROG_SED ])#m4_ifndef # Old name: AU_ALIAS([LT_AC_PROG_SED], [AC_PROG_SED]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([LT_AC_PROG_SED], []) # _LT_CHECK_SHELL_FEATURES # ------------------------ # Find out whether the shell is Bourne or XSI compatible, # or has some other useful features. m4_defun([_LT_CHECK_SHELL_FEATURES], [if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then lt_unset=unset else lt_unset=false fi _LT_DECL([], [lt_unset], [0], [whether the shell understands "unset"])dnl # test EBCDIC or ASCII case `echo X|tr X '\101'` in A) # ASCII based system # \n is not interpreted correctly by Solaris 8 /usr/ucb/tr lt_SP2NL='tr \040 \012' lt_NL2SP='tr \015\012 \040\040' ;; *) # EBCDIC based system lt_SP2NL='tr \100 \n' lt_NL2SP='tr \r\n \100\100' ;; esac _LT_DECL([SP2NL], [lt_SP2NL], [1], [turn spaces into newlines])dnl _LT_DECL([NL2SP], [lt_NL2SP], [1], [turn newlines into spaces])dnl ])# _LT_CHECK_SHELL_FEATURES # _LT_PATH_CONVERSION_FUNCTIONS # ----------------------------- # Determine what file name conversion functions should be used by # func_to_host_file (and, implicitly, by func_to_host_path). These are needed # for certain cross-compile configurations and native mingw. m4_defun([_LT_PATH_CONVERSION_FUNCTIONS], [AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([AC_CANONICAL_BUILD])dnl AC_MSG_CHECKING([how to convert $build file names to $host format]) AC_CACHE_VAL(lt_cv_to_host_file_cmd, [case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32 ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32 ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32 ;; esac ;; *-*-cygwin* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_noop ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin ;; esac ;; * ) # unhandled hosts (and "normal" native builds) lt_cv_to_host_file_cmd=func_convert_file_noop ;; esac ]) to_host_file_cmd=$lt_cv_to_host_file_cmd AC_MSG_RESULT([$lt_cv_to_host_file_cmd]) _LT_DECL([to_host_file_cmd], [lt_cv_to_host_file_cmd], [0], [convert $build file names to $host format])dnl AC_MSG_CHECKING([how to convert $build file names to toolchain format]) AC_CACHE_VAL(lt_cv_to_tool_file_cmd, [#assume ordinary cross tools, or native build. lt_cv_to_tool_file_cmd=func_convert_file_noop case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32 ;; esac ;; esac ]) to_tool_file_cmd=$lt_cv_to_tool_file_cmd AC_MSG_RESULT([$lt_cv_to_tool_file_cmd]) _LT_DECL([to_tool_file_cmd], [lt_cv_to_tool_file_cmd], [0], [convert $build files to toolchain format])dnl ])# _LT_PATH_CONVERSION_FUNCTIONS suricata-3.2.1/m4/ltversion.m40000644000000000000000000000127313051004463013025 00000000000000# ltversion.m4 -- version numbers -*- Autoconf -*- # # Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc. # Written by Scott James Remnant, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # @configure_input@ # serial 4179 ltversion.m4 # This file is part of GNU Libtool m4_define([LT_PACKAGE_VERSION], [2.4.6]) m4_define([LT_PACKAGE_REVISION], [2.4.6]) AC_DEFUN([LTVERSION_VERSION], [macro_version='2.4.6' macro_revision='2.4.6' _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?]) _LT_DECL(, macro_revision, 0) ]) suricata-3.2.1/m4/ltoptions.m40000644000000000000000000003426213051004463013037 00000000000000# Helper functions for option handling. -*- Autoconf -*- # # Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software # Foundation, Inc. # Written by Gary V. Vaughan, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 8 ltoptions.m4 # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTOPTIONS_VERSION], [m4_if([1])]) # _LT_MANGLE_OPTION(MACRO-NAME, OPTION-NAME) # ------------------------------------------ m4_define([_LT_MANGLE_OPTION], [[_LT_OPTION_]m4_bpatsubst($1__$2, [[^a-zA-Z0-9_]], [_])]) # _LT_SET_OPTION(MACRO-NAME, OPTION-NAME) # --------------------------------------- # Set option OPTION-NAME for macro MACRO-NAME, and if there is a # matching handler defined, dispatch to it. Other OPTION-NAMEs are # saved as a flag. m4_define([_LT_SET_OPTION], [m4_define(_LT_MANGLE_OPTION([$1], [$2]))dnl m4_ifdef(_LT_MANGLE_DEFUN([$1], [$2]), _LT_MANGLE_DEFUN([$1], [$2]), [m4_warning([Unknown $1 option '$2'])])[]dnl ]) # _LT_IF_OPTION(MACRO-NAME, OPTION-NAME, IF-SET, [IF-NOT-SET]) # ------------------------------------------------------------ # Execute IF-SET if OPTION is set, IF-NOT-SET otherwise. m4_define([_LT_IF_OPTION], [m4_ifdef(_LT_MANGLE_OPTION([$1], [$2]), [$3], [$4])]) # _LT_UNLESS_OPTIONS(MACRO-NAME, OPTION-LIST, IF-NOT-SET) # ------------------------------------------------------- # Execute IF-NOT-SET unless all options in OPTION-LIST for MACRO-NAME # are set. m4_define([_LT_UNLESS_OPTIONS], [m4_foreach([_LT_Option], m4_split(m4_normalize([$2])), [m4_ifdef(_LT_MANGLE_OPTION([$1], _LT_Option), [m4_define([$0_found])])])[]dnl m4_ifdef([$0_found], [m4_undefine([$0_found])], [$3 ])[]dnl ]) # _LT_SET_OPTIONS(MACRO-NAME, OPTION-LIST) # ---------------------------------------- # OPTION-LIST is a space-separated list of Libtool options associated # with MACRO-NAME. If any OPTION has a matching handler declared with # LT_OPTION_DEFINE, dispatch to that macro; otherwise complain about # the unknown option and exit. m4_defun([_LT_SET_OPTIONS], [# Set options m4_foreach([_LT_Option], m4_split(m4_normalize([$2])), [_LT_SET_OPTION([$1], _LT_Option)]) m4_if([$1],[LT_INIT],[ dnl dnl Simply set some default values (i.e off) if boolean options were not dnl specified: _LT_UNLESS_OPTIONS([LT_INIT], [dlopen], [enable_dlopen=no ]) _LT_UNLESS_OPTIONS([LT_INIT], [win32-dll], [enable_win32_dll=no ]) dnl dnl If no reference was made to various pairs of opposing options, then dnl we run the default mode handler for the pair. For example, if neither dnl 'shared' nor 'disable-shared' was passed, we enable building of shared dnl archives by default: _LT_UNLESS_OPTIONS([LT_INIT], [shared disable-shared], [_LT_ENABLE_SHARED]) _LT_UNLESS_OPTIONS([LT_INIT], [static disable-static], [_LT_ENABLE_STATIC]) _LT_UNLESS_OPTIONS([LT_INIT], [pic-only no-pic], [_LT_WITH_PIC]) _LT_UNLESS_OPTIONS([LT_INIT], [fast-install disable-fast-install], [_LT_ENABLE_FAST_INSTALL]) _LT_UNLESS_OPTIONS([LT_INIT], [aix-soname=aix aix-soname=both aix-soname=svr4], [_LT_WITH_AIX_SONAME([aix])]) ]) ])# _LT_SET_OPTIONS ## --------------------------------- ## ## Macros to handle LT_INIT options. ## ## --------------------------------- ## # _LT_MANGLE_DEFUN(MACRO-NAME, OPTION-NAME) # ----------------------------------------- m4_define([_LT_MANGLE_DEFUN], [[_LT_OPTION_DEFUN_]m4_bpatsubst(m4_toupper([$1__$2]), [[^A-Z0-9_]], [_])]) # LT_OPTION_DEFINE(MACRO-NAME, OPTION-NAME, CODE) # ----------------------------------------------- m4_define([LT_OPTION_DEFINE], [m4_define(_LT_MANGLE_DEFUN([$1], [$2]), [$3])[]dnl ])# LT_OPTION_DEFINE # dlopen # ------ LT_OPTION_DEFINE([LT_INIT], [dlopen], [enable_dlopen=yes ]) AU_DEFUN([AC_LIBTOOL_DLOPEN], [_LT_SET_OPTION([LT_INIT], [dlopen]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'dlopen' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_DLOPEN], []) # win32-dll # --------- # Declare package support for building win32 dll's. LT_OPTION_DEFINE([LT_INIT], [win32-dll], [enable_win32_dll=yes case $host in *-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-cegcc*) AC_CHECK_TOOL(AS, as, false) AC_CHECK_TOOL(DLLTOOL, dlltool, false) AC_CHECK_TOOL(OBJDUMP, objdump, false) ;; esac test -z "$AS" && AS=as _LT_DECL([], [AS], [1], [Assembler program])dnl test -z "$DLLTOOL" && DLLTOOL=dlltool _LT_DECL([], [DLLTOOL], [1], [DLL creation program])dnl test -z "$OBJDUMP" && OBJDUMP=objdump _LT_DECL([], [OBJDUMP], [1], [Object dumper program])dnl ])# win32-dll AU_DEFUN([AC_LIBTOOL_WIN32_DLL], [AC_REQUIRE([AC_CANONICAL_HOST])dnl _LT_SET_OPTION([LT_INIT], [win32-dll]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'win32-dll' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_WIN32_DLL], []) # _LT_ENABLE_SHARED([DEFAULT]) # ---------------------------- # implement the --enable-shared flag, and supports the 'shared' and # 'disable-shared' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_SHARED], [m4_define([_LT_ENABLE_SHARED_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([shared], [AS_HELP_STRING([--enable-shared@<:@=PKGS@:>@], [build shared libraries @<:@default=]_LT_ENABLE_SHARED_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_shared=yes ;; no) enable_shared=no ;; *) enable_shared=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_shared=yes fi done IFS=$lt_save_ifs ;; esac], [enable_shared=]_LT_ENABLE_SHARED_DEFAULT) _LT_DECL([build_libtool_libs], [enable_shared], [0], [Whether or not to build shared libraries]) ])# _LT_ENABLE_SHARED LT_OPTION_DEFINE([LT_INIT], [shared], [_LT_ENABLE_SHARED([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-shared], [_LT_ENABLE_SHARED([no])]) # Old names: AC_DEFUN([AC_ENABLE_SHARED], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[shared]) ]) AC_DEFUN([AC_DISABLE_SHARED], [_LT_SET_OPTION([LT_INIT], [disable-shared]) ]) AU_DEFUN([AM_ENABLE_SHARED], [AC_ENABLE_SHARED($@)]) AU_DEFUN([AM_DISABLE_SHARED], [AC_DISABLE_SHARED($@)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_ENABLE_SHARED], []) dnl AC_DEFUN([AM_DISABLE_SHARED], []) # _LT_ENABLE_STATIC([DEFAULT]) # ---------------------------- # implement the --enable-static flag, and support the 'static' and # 'disable-static' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_STATIC], [m4_define([_LT_ENABLE_STATIC_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([static], [AS_HELP_STRING([--enable-static@<:@=PKGS@:>@], [build static libraries @<:@default=]_LT_ENABLE_STATIC_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_static=yes ;; no) enable_static=no ;; *) enable_static=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_static=yes fi done IFS=$lt_save_ifs ;; esac], [enable_static=]_LT_ENABLE_STATIC_DEFAULT) _LT_DECL([build_old_libs], [enable_static], [0], [Whether or not to build static libraries]) ])# _LT_ENABLE_STATIC LT_OPTION_DEFINE([LT_INIT], [static], [_LT_ENABLE_STATIC([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-static], [_LT_ENABLE_STATIC([no])]) # Old names: AC_DEFUN([AC_ENABLE_STATIC], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[static]) ]) AC_DEFUN([AC_DISABLE_STATIC], [_LT_SET_OPTION([LT_INIT], [disable-static]) ]) AU_DEFUN([AM_ENABLE_STATIC], [AC_ENABLE_STATIC($@)]) AU_DEFUN([AM_DISABLE_STATIC], [AC_DISABLE_STATIC($@)]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AM_ENABLE_STATIC], []) dnl AC_DEFUN([AM_DISABLE_STATIC], []) # _LT_ENABLE_FAST_INSTALL([DEFAULT]) # ---------------------------------- # implement the --enable-fast-install flag, and support the 'fast-install' # and 'disable-fast-install' LT_INIT options. # DEFAULT is either 'yes' or 'no'. If omitted, it defaults to 'yes'. m4_define([_LT_ENABLE_FAST_INSTALL], [m4_define([_LT_ENABLE_FAST_INSTALL_DEFAULT], [m4_if($1, no, no, yes)])dnl AC_ARG_ENABLE([fast-install], [AS_HELP_STRING([--enable-fast-install@<:@=PKGS@:>@], [optimize for fast installation @<:@default=]_LT_ENABLE_FAST_INSTALL_DEFAULT[@:>@])], [p=${PACKAGE-default} case $enableval in yes) enable_fast_install=yes ;; no) enable_fast_install=no ;; *) enable_fast_install=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_fast_install=yes fi done IFS=$lt_save_ifs ;; esac], [enable_fast_install=]_LT_ENABLE_FAST_INSTALL_DEFAULT) _LT_DECL([fast_install], [enable_fast_install], [0], [Whether or not to optimize for fast installation])dnl ])# _LT_ENABLE_FAST_INSTALL LT_OPTION_DEFINE([LT_INIT], [fast-install], [_LT_ENABLE_FAST_INSTALL([yes])]) LT_OPTION_DEFINE([LT_INIT], [disable-fast-install], [_LT_ENABLE_FAST_INSTALL([no])]) # Old names: AU_DEFUN([AC_ENABLE_FAST_INSTALL], [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[fast-install]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'fast-install' option into LT_INIT's first parameter.]) ]) AU_DEFUN([AC_DISABLE_FAST_INSTALL], [_LT_SET_OPTION([LT_INIT], [disable-fast-install]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'disable-fast-install' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_ENABLE_FAST_INSTALL], []) dnl AC_DEFUN([AM_DISABLE_FAST_INSTALL], []) # _LT_WITH_AIX_SONAME([DEFAULT]) # ---------------------------------- # implement the --with-aix-soname flag, and support the `aix-soname=aix' # and `aix-soname=both' and `aix-soname=svr4' LT_INIT options. DEFAULT # is either `aix', `both' or `svr4'. If omitted, it defaults to `aix'. m4_define([_LT_WITH_AIX_SONAME], [m4_define([_LT_WITH_AIX_SONAME_DEFAULT], [m4_if($1, svr4, svr4, m4_if($1, both, both, aix))])dnl shared_archive_member_spec= case $host,$enable_shared in power*-*-aix[[5-9]]*,yes) AC_MSG_CHECKING([which variant of shared library versioning to provide]) AC_ARG_WITH([aix-soname], [AS_HELP_STRING([--with-aix-soname=aix|svr4|both], [shared library versioning (aka "SONAME") variant to provide on AIX, @<:@default=]_LT_WITH_AIX_SONAME_DEFAULT[@:>@.])], [case $withval in aix|svr4|both) ;; *) AC_MSG_ERROR([Unknown argument to --with-aix-soname]) ;; esac lt_cv_with_aix_soname=$with_aix_soname], [AC_CACHE_VAL([lt_cv_with_aix_soname], [lt_cv_with_aix_soname=]_LT_WITH_AIX_SONAME_DEFAULT) with_aix_soname=$lt_cv_with_aix_soname]) AC_MSG_RESULT([$with_aix_soname]) if test aix != "$with_aix_soname"; then # For the AIX way of multilib, we name the shared archive member # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o', # and 'shr.imp' or 'shr_64.imp', respectively, for the Import File. # Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag, # the AIX toolchain works better with OBJECT_MODE set (default 32). if test 64 = "${OBJECT_MODE-32}"; then shared_archive_member_spec=shr_64 else shared_archive_member_spec=shr fi fi ;; *) with_aix_soname=aix ;; esac _LT_DECL([], [shared_archive_member_spec], [0], [Shared archive member basename, for filename based shared library versioning on AIX])dnl ])# _LT_WITH_AIX_SONAME LT_OPTION_DEFINE([LT_INIT], [aix-soname=aix], [_LT_WITH_AIX_SONAME([aix])]) LT_OPTION_DEFINE([LT_INIT], [aix-soname=both], [_LT_WITH_AIX_SONAME([both])]) LT_OPTION_DEFINE([LT_INIT], [aix-soname=svr4], [_LT_WITH_AIX_SONAME([svr4])]) # _LT_WITH_PIC([MODE]) # -------------------- # implement the --with-pic flag, and support the 'pic-only' and 'no-pic' # LT_INIT options. # MODE is either 'yes' or 'no'. If omitted, it defaults to 'both'. m4_define([_LT_WITH_PIC], [AC_ARG_WITH([pic], [AS_HELP_STRING([--with-pic@<:@=PKGS@:>@], [try to use only PIC/non-PIC objects @<:@default=use both@:>@])], [lt_p=${PACKAGE-default} case $withval in yes|no) pic_mode=$withval ;; *) pic_mode=default # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for lt_pkg in $withval; do IFS=$lt_save_ifs if test "X$lt_pkg" = "X$lt_p"; then pic_mode=yes fi done IFS=$lt_save_ifs ;; esac], [pic_mode=m4_default([$1], [default])]) _LT_DECL([], [pic_mode], [0], [What type of objects to build])dnl ])# _LT_WITH_PIC LT_OPTION_DEFINE([LT_INIT], [pic-only], [_LT_WITH_PIC([yes])]) LT_OPTION_DEFINE([LT_INIT], [no-pic], [_LT_WITH_PIC([no])]) # Old name: AU_DEFUN([AC_LIBTOOL_PICMODE], [_LT_SET_OPTION([LT_INIT], [pic-only]) AC_DIAGNOSE([obsolete], [$0: Remove this warning and the call to _LT_SET_OPTION when you put the 'pic-only' option into LT_INIT's first parameter.]) ]) dnl aclocal-1.4 backwards compatibility: dnl AC_DEFUN([AC_LIBTOOL_PICMODE], []) ## ----------------- ## ## LTDL_INIT Options ## ## ----------------- ## m4_define([_LTDL_MODE], []) LT_OPTION_DEFINE([LTDL_INIT], [nonrecursive], [m4_define([_LTDL_MODE], [nonrecursive])]) LT_OPTION_DEFINE([LTDL_INIT], [recursive], [m4_define([_LTDL_MODE], [recursive])]) LT_OPTION_DEFINE([LTDL_INIT], [subproject], [m4_define([_LTDL_MODE], [subproject])]) m4_define([_LTDL_TYPE], []) LT_OPTION_DEFINE([LTDL_INIT], [installable], [m4_define([_LTDL_TYPE], [installable])]) LT_OPTION_DEFINE([LTDL_INIT], [convenience], [m4_define([_LTDL_TYPE], [convenience])]) suricata-3.2.1/m4/lt~obsolete.m40000644000000000000000000001377413051004463013363 00000000000000# lt~obsolete.m4 -- aclocal satisfying obsolete definitions. -*-Autoconf-*- # # Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software # Foundation, Inc. # Written by Scott James Remnant, 2004. # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 5 lt~obsolete.m4 # These exist entirely to fool aclocal when bootstrapping libtool. # # In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN), # which have later been changed to m4_define as they aren't part of the # exported API, or moved to Autoconf or Automake where they belong. # # The trouble is, aclocal is a bit thick. It'll see the old AC_DEFUN # in /usr/share/aclocal/libtool.m4 and remember it, then when it sees us # using a macro with the same name in our local m4/libtool.m4 it'll # pull the old libtool.m4 in (it doesn't see our shiny new m4_define # and doesn't know about Autoconf macros at all.) # # So we provide this file, which has a silly filename so it's always # included after everything else. This provides aclocal with the # AC_DEFUNs it wants, but when m4 processes it, it doesn't do anything # because those macros already exist, or will be overwritten later. # We use AC_DEFUN over AU_DEFUN for compatibility with aclocal-1.6. # # Anytime we withdraw an AC_DEFUN or AU_DEFUN, remember to add it here. # Yes, that means every name once taken will need to remain here until # we give up compatibility with versions before 1.7, at which point # we need to keep only those names which we still refer to. # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTOBSOLETE_VERSION], [m4_if([1])]) m4_ifndef([AC_LIBTOOL_LINKER_OPTION], [AC_DEFUN([AC_LIBTOOL_LINKER_OPTION])]) m4_ifndef([AC_PROG_EGREP], [AC_DEFUN([AC_PROG_EGREP])]) m4_ifndef([_LT_AC_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_AC_PROG_ECHO_BACKSLASH])]) m4_ifndef([_LT_AC_SHELL_INIT], [AC_DEFUN([_LT_AC_SHELL_INIT])]) m4_ifndef([_LT_AC_SYS_LIBPATH_AIX], [AC_DEFUN([_LT_AC_SYS_LIBPATH_AIX])]) m4_ifndef([_LT_PROG_LTMAIN], [AC_DEFUN([_LT_PROG_LTMAIN])]) m4_ifndef([_LT_AC_TAGVAR], [AC_DEFUN([_LT_AC_TAGVAR])]) m4_ifndef([AC_LTDL_ENABLE_INSTALL], [AC_DEFUN([AC_LTDL_ENABLE_INSTALL])]) m4_ifndef([AC_LTDL_PREOPEN], [AC_DEFUN([AC_LTDL_PREOPEN])]) m4_ifndef([_LT_AC_SYS_COMPILER], [AC_DEFUN([_LT_AC_SYS_COMPILER])]) m4_ifndef([_LT_AC_LOCK], [AC_DEFUN([_LT_AC_LOCK])]) m4_ifndef([AC_LIBTOOL_SYS_OLD_ARCHIVE], [AC_DEFUN([AC_LIBTOOL_SYS_OLD_ARCHIVE])]) m4_ifndef([_LT_AC_TRY_DLOPEN_SELF], [AC_DEFUN([_LT_AC_TRY_DLOPEN_SELF])]) m4_ifndef([AC_LIBTOOL_PROG_CC_C_O], [AC_DEFUN([AC_LIBTOOL_PROG_CC_C_O])]) m4_ifndef([AC_LIBTOOL_SYS_HARD_LINK_LOCKS], [AC_DEFUN([AC_LIBTOOL_SYS_HARD_LINK_LOCKS])]) m4_ifndef([AC_LIBTOOL_OBJDIR], [AC_DEFUN([AC_LIBTOOL_OBJDIR])]) m4_ifndef([AC_LTDL_OBJDIR], [AC_DEFUN([AC_LTDL_OBJDIR])]) m4_ifndef([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH], [AC_DEFUN([AC_LIBTOOL_PROG_LD_HARDCODE_LIBPATH])]) m4_ifndef([AC_LIBTOOL_SYS_LIB_STRIP], [AC_DEFUN([AC_LIBTOOL_SYS_LIB_STRIP])]) m4_ifndef([AC_PATH_MAGIC], [AC_DEFUN([AC_PATH_MAGIC])]) m4_ifndef([AC_PROG_LD_GNU], [AC_DEFUN([AC_PROG_LD_GNU])]) m4_ifndef([AC_PROG_LD_RELOAD_FLAG], [AC_DEFUN([AC_PROG_LD_RELOAD_FLAG])]) m4_ifndef([AC_DEPLIBS_CHECK_METHOD], [AC_DEFUN([AC_DEPLIBS_CHECK_METHOD])]) m4_ifndef([AC_LIBTOOL_PROG_COMPILER_NO_RTTI], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_NO_RTTI])]) m4_ifndef([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE], [AC_DEFUN([AC_LIBTOOL_SYS_GLOBAL_SYMBOL_PIPE])]) m4_ifndef([AC_LIBTOOL_PROG_COMPILER_PIC], [AC_DEFUN([AC_LIBTOOL_PROG_COMPILER_PIC])]) m4_ifndef([AC_LIBTOOL_PROG_LD_SHLIBS], [AC_DEFUN([AC_LIBTOOL_PROG_LD_SHLIBS])]) m4_ifndef([AC_LIBTOOL_POSTDEP_PREDEP], [AC_DEFUN([AC_LIBTOOL_POSTDEP_PREDEP])]) m4_ifndef([LT_AC_PROG_EGREP], [AC_DEFUN([LT_AC_PROG_EGREP])]) m4_ifndef([LT_AC_PROG_SED], [AC_DEFUN([LT_AC_PROG_SED])]) m4_ifndef([_LT_CC_BASENAME], [AC_DEFUN([_LT_CC_BASENAME])]) m4_ifndef([_LT_COMPILER_BOILERPLATE], [AC_DEFUN([_LT_COMPILER_BOILERPLATE])]) m4_ifndef([_LT_LINKER_BOILERPLATE], [AC_DEFUN([_LT_LINKER_BOILERPLATE])]) m4_ifndef([_AC_PROG_LIBTOOL], [AC_DEFUN([_AC_PROG_LIBTOOL])]) m4_ifndef([AC_LIBTOOL_SETUP], [AC_DEFUN([AC_LIBTOOL_SETUP])]) m4_ifndef([_LT_AC_CHECK_DLFCN], [AC_DEFUN([_LT_AC_CHECK_DLFCN])]) m4_ifndef([AC_LIBTOOL_SYS_DYNAMIC_LINKER], [AC_DEFUN([AC_LIBTOOL_SYS_DYNAMIC_LINKER])]) m4_ifndef([_LT_AC_TAGCONFIG], [AC_DEFUN([_LT_AC_TAGCONFIG])]) m4_ifndef([AC_DISABLE_FAST_INSTALL], [AC_DEFUN([AC_DISABLE_FAST_INSTALL])]) m4_ifndef([_LT_AC_LANG_CXX], [AC_DEFUN([_LT_AC_LANG_CXX])]) m4_ifndef([_LT_AC_LANG_F77], [AC_DEFUN([_LT_AC_LANG_F77])]) m4_ifndef([_LT_AC_LANG_GCJ], [AC_DEFUN([_LT_AC_LANG_GCJ])]) m4_ifndef([AC_LIBTOOL_LANG_C_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_C_CONFIG])]) m4_ifndef([_LT_AC_LANG_C_CONFIG], [AC_DEFUN([_LT_AC_LANG_C_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_CXX_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_CXX_CONFIG])]) m4_ifndef([_LT_AC_LANG_CXX_CONFIG], [AC_DEFUN([_LT_AC_LANG_CXX_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_F77_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_F77_CONFIG])]) m4_ifndef([_LT_AC_LANG_F77_CONFIG], [AC_DEFUN([_LT_AC_LANG_F77_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_GCJ_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_GCJ_CONFIG])]) m4_ifndef([_LT_AC_LANG_GCJ_CONFIG], [AC_DEFUN([_LT_AC_LANG_GCJ_CONFIG])]) m4_ifndef([AC_LIBTOOL_LANG_RC_CONFIG], [AC_DEFUN([AC_LIBTOOL_LANG_RC_CONFIG])]) m4_ifndef([_LT_AC_LANG_RC_CONFIG], [AC_DEFUN([_LT_AC_LANG_RC_CONFIG])]) m4_ifndef([AC_LIBTOOL_CONFIG], [AC_DEFUN([AC_LIBTOOL_CONFIG])]) m4_ifndef([_LT_AC_FILE_LTDLL_C], [AC_DEFUN([_LT_AC_FILE_LTDLL_C])]) m4_ifndef([_LT_REQUIRED_DARWIN_CHECKS], [AC_DEFUN([_LT_REQUIRED_DARWIN_CHECKS])]) m4_ifndef([_LT_AC_PROG_CXXCPP], [AC_DEFUN([_LT_AC_PROG_CXXCPP])]) m4_ifndef([_LT_PREPARE_SED_QUOTE_VARS], [AC_DEFUN([_LT_PREPARE_SED_QUOTE_VARS])]) m4_ifndef([_LT_PROG_ECHO_BACKSLASH], [AC_DEFUN([_LT_PROG_ECHO_BACKSLASH])]) m4_ifndef([_LT_PROG_F77], [AC_DEFUN([_LT_PROG_F77])]) m4_ifndef([_LT_PROG_FC], [AC_DEFUN([_LT_PROG_FC])]) m4_ifndef([_LT_PROG_CXX], [AC_DEFUN([_LT_PROG_CXX])]) suricata-3.2.1/m4/ltsugar.m40000644000000000000000000001044013051004463012455 00000000000000# ltsugar.m4 -- libtool m4 base layer. -*-Autoconf-*- # # Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software # Foundation, Inc. # Written by Gary V. Vaughan, 2004 # # This file is free software; the Free Software Foundation gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # serial 6 ltsugar.m4 # This is to help aclocal find these macros, as it can't see m4_define. AC_DEFUN([LTSUGAR_VERSION], [m4_if([0.1])]) # lt_join(SEP, ARG1, [ARG2...]) # ----------------------------- # Produce ARG1SEPARG2...SEPARGn, omitting [] arguments and their # associated separator. # Needed until we can rely on m4_join from Autoconf 2.62, since all earlier # versions in m4sugar had bugs. m4_define([lt_join], [m4_if([$#], [1], [], [$#], [2], [[$2]], [m4_if([$2], [], [], [[$2]_])$0([$1], m4_shift(m4_shift($@)))])]) m4_define([_lt_join], [m4_if([$#$2], [2], [], [m4_if([$2], [], [], [[$1$2]])$0([$1], m4_shift(m4_shift($@)))])]) # lt_car(LIST) # lt_cdr(LIST) # ------------ # Manipulate m4 lists. # These macros are necessary as long as will still need to support # Autoconf-2.59, which quotes differently. m4_define([lt_car], [[$1]]) m4_define([lt_cdr], [m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])], [$#], 1, [], [m4_dquote(m4_shift($@))])]) m4_define([lt_unquote], $1) # lt_append(MACRO-NAME, STRING, [SEPARATOR]) # ------------------------------------------ # Redefine MACRO-NAME to hold its former content plus 'SEPARATOR''STRING'. # Note that neither SEPARATOR nor STRING are expanded; they are appended # to MACRO-NAME as is (leaving the expansion for when MACRO-NAME is invoked). # No SEPARATOR is output if MACRO-NAME was previously undefined (different # than defined and empty). # # This macro is needed until we can rely on Autoconf 2.62, since earlier # versions of m4sugar mistakenly expanded SEPARATOR but not STRING. m4_define([lt_append], [m4_define([$1], m4_ifdef([$1], [m4_defn([$1])[$3]])[$2])]) # lt_combine(SEP, PREFIX-LIST, INFIX, SUFFIX1, [SUFFIX2...]) # ---------------------------------------------------------- # Produce a SEP delimited list of all paired combinations of elements of # PREFIX-LIST with SUFFIX1 through SUFFIXn. Each element of the list # has the form PREFIXmINFIXSUFFIXn. # Needed until we can rely on m4_combine added in Autoconf 2.62. m4_define([lt_combine], [m4_if(m4_eval([$# > 3]), [1], [m4_pushdef([_Lt_sep], [m4_define([_Lt_sep], m4_defn([lt_car]))])]]dnl [[m4_foreach([_Lt_prefix], [$2], [m4_foreach([_Lt_suffix], ]m4_dquote(m4_dquote(m4_shift(m4_shift(m4_shift($@)))))[, [_Lt_sep([$1])[]m4_defn([_Lt_prefix])[$3]m4_defn([_Lt_suffix])])])])]) # lt_if_append_uniq(MACRO-NAME, VARNAME, [SEPARATOR], [UNIQ], [NOT-UNIQ]) # ----------------------------------------------------------------------- # Iff MACRO-NAME does not yet contain VARNAME, then append it (delimited # by SEPARATOR if supplied) and expand UNIQ, else NOT-UNIQ. m4_define([lt_if_append_uniq], [m4_ifdef([$1], [m4_if(m4_index([$3]m4_defn([$1])[$3], [$3$2$3]), [-1], [lt_append([$1], [$2], [$3])$4], [$5])], [lt_append([$1], [$2], [$3])$4])]) # lt_dict_add(DICT, KEY, VALUE) # ----------------------------- m4_define([lt_dict_add], [m4_define([$1($2)], [$3])]) # lt_dict_add_subkey(DICT, KEY, SUBKEY, VALUE) # -------------------------------------------- m4_define([lt_dict_add_subkey], [m4_define([$1($2:$3)], [$4])]) # lt_dict_fetch(DICT, KEY, [SUBKEY]) # ---------------------------------- m4_define([lt_dict_fetch], [m4_ifval([$3], m4_ifdef([$1($2:$3)], [m4_defn([$1($2:$3)])]), m4_ifdef([$1($2)], [m4_defn([$1($2)])]))]) # lt_if_dict_fetch(DICT, KEY, [SUBKEY], VALUE, IF-TRUE, [IF-FALSE]) # ----------------------------------------------------------------- m4_define([lt_if_dict_fetch], [m4_if(lt_dict_fetch([$1], [$2], [$3]), [$4], [$5], [$6])]) # lt_dict_filter(DICT, [SUBKEY], VALUE, [SEPARATOR], KEY, [...]) # -------------------------------------------------------------- m4_define([lt_dict_filter], [m4_if([$5], [], [], [lt_join(m4_quote(m4_default([$4], [[, ]])), lt_unquote(m4_split(m4_normalize(m4_foreach(_Lt_key, lt_car([m4_shiftn(4, $@)]), [lt_if_dict_fetch([$1], _Lt_key, [$2], [$3], [_Lt_key ])])))))])[]dnl ]) suricata-3.2.1/m4/libprelude.m40000644000000000000000000001761613051004444013136 00000000000000dnl Autoconf macros for libprelude dnl $id$ # Modified for LIBPRELUDE -- Yoann Vandoorselaere # Modified for LIBGNUTLS -- nmav # Configure paths for LIBGCRYPT # Shamelessly stolen from the one of XDELTA by Owen Taylor # Werner Koch 99-12-09 dnl AM_PATH_LIBPRELUDE([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]], THREAD_SUPPORT) dnl Test for libprelude, and define LIBPRELUDE_PREFIX, LIBPRELUDE_CFLAGS, LIBPRELUDE_PTHREAD_CFLAGS, dnl LIBPRELUDE_LDFLAGS, and LIBPRELUDE_LIBS dnl AC_DEFUN([AM_PATH_LIBPRELUDE], [dnl dnl Get the cflags and libraries from the libprelude-config script dnl AC_ARG_WITH(libprelude-prefix, AC_HELP_STRING(--with-libprelude-prefix=PFX, Prefix where libprelude is installed (optional)), libprelude_config_prefix="$withval", libprelude_config_prefix="") if test x$libprelude_config_prefix != x ; then if test x${LIBPRELUDE_CONFIG+set} != xset ; then LIBPRELUDE_CONFIG=$libprelude_config_prefix/bin/libprelude-config fi fi AC_PATH_PROG(LIBPRELUDE_CONFIG, libprelude-config, no) if test "$LIBPRELUDE_CONFIG" != "no"; then if $($LIBPRELUDE_CONFIG --thread > /dev/null 2>&1); then LIBPRELUDE_PTHREAD_CFLAGS=`$LIBPRELUDE_CONFIG --thread --cflags` if test x$4 = xtrue || test x$4 = xyes; then libprelude_config_args="--thread" else libprelude_config_args="--no-thread" fi else LIBPRELUDE_PTHREAD_CFLAGS=`$LIBPRELUDE_CONFIG --pthread-cflags` fi fi min_libprelude_version=ifelse([$1], ,0.1.0,$1) AC_MSG_CHECKING(for libprelude - version >= $min_libprelude_version) no_libprelude="" if test "$LIBPRELUDE_CONFIG" = "no" ; then no_libprelude=yes else LIBPRELUDE_CFLAGS=`$LIBPRELUDE_CONFIG $libprelude_config_args --cflags` LIBPRELUDE_LDFLAGS=`$LIBPRELUDE_CONFIG $libprelude_config_args --ldflags` LIBPRELUDE_LIBS=`$LIBPRELUDE_CONFIG $libprelude_config_args --libs` LIBPRELUDE_PREFIX=`$LIBPRELUDE_CONFIG $libprelude_config_args --prefix` LIBPRELUDE_CONFIG_PREFIX=`$LIBPRELUDE_CONFIG $libprelude_config_args --config-prefix` libprelude_config_version=`$LIBPRELUDE_CONFIG $libprelude_config_args --version` ac_save_CFLAGS="$CFLAGS" ac_save_LDFLAGS="$LDFLAGS" ac_save_LIBS="$LIBS" CFLAGS="$CFLAGS $LIBPRELUDE_CFLAGS" LDFLAGS="$LDFLAGS $LIBPRELUDE_LDFLAGS" LIBS="$LIBS $LIBPRELUDE_LIBS" dnl dnl Now check if the installed libprelude is sufficiently new. Also sanity dnl checks the results of libprelude-config to some extent dnl rm -f conf.libpreludetest AC_TRY_RUN([ #include #include #include #include int main () { system ("touch conf.libpreludetest"); if( strcmp( prelude_check_version(NULL), "$libprelude_config_version" ) ) { printf("\n*** 'libprelude-config --version' returned %s, but LIBPRELUDE (%s)\n", "$libprelude_config_version", prelude_check_version(NULL) ); printf("*** was found! If libprelude-config was correct, then it is best\n"); printf("*** to remove the old version of LIBPRELUDE. You may also be able to fix the error\n"); printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n"); printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n"); printf("*** required on your system.\n"); printf("*** If libprelude-config was wrong, set the environment variable LIBPRELUDE_CONFIG\n"); printf("*** to point to the correct copy of libprelude-config, and remove the file config.cache\n"); printf("*** before re-running configure\n"); } else if ( strcmp(prelude_check_version(NULL), LIBPRELUDE_VERSION ) ) { printf("\n*** LIBPRELUDE header file (version %s) does not match\n", LIBPRELUDE_VERSION); printf("*** library (version %s)\n", prelude_check_version(NULL) ); } else { if ( prelude_check_version( "$min_libprelude_version" ) ) return 0; else { printf("no\n*** An old version of LIBPRELUDE (%s) was found.\n", prelude_check_version(NULL) ); printf("*** You need a version of LIBPRELUDE newer than %s. The latest version of\n", "$min_libprelude_version" ); printf("*** LIBPRELUDE is always available from http://www.prelude-siem.com/index.php/en/community/download\n"); printf("*** \n"); printf("*** If you have already installed a sufficiently new version, this error\n"); printf("*** probably means that the wrong copy of the libprelude-config shell script is\n"); printf("*** being found. The easiest way to fix this is to remove the old version\n"); printf("*** of LIBPRELUDE, but you can also set the LIBPRELUDE_CONFIG environment to point to the\n"); printf("*** correct copy of libprelude-config. (In this case, you will have to\n"); printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n"); printf("*** so that the correct libraries are found at run-time))\n"); } } return 1; } ],, no_libprelude=yes,[echo $ac_n "cross compiling; assumed OK... $ac_c"]) CFLAGS="$ac_save_CFLAGS" LIBS="$ac_save_LIBS" LDFLAGS="$ac_save_LDFLAGS" fi if test "x$no_libprelude" = x ; then AC_MSG_RESULT(yes) ifelse([$2], , :, [$2]) else if test -f conf.libpreludetest ; then : else AC_MSG_RESULT(no) fi if test "$LIBPRELUDE_CONFIG" = "no" ; then echo "*** The libprelude-config script installed by LIBPRELUDE could not be found" echo "*** If LIBPRELUDE was installed in PREFIX, make sure PREFIX/bin is in" echo "*** your path, or set the LIBPRELUDE_CONFIG environment variable to the" echo "*** full path to libprelude-config." else if test -f conf.libpreludetest ; then : else echo "*** Could not run libprelude test program, checking why..." CFLAGS="$CFLAGS $LIBPRELUDE_CFLAGS" LDFLAGS="$LDFLAGS $LIBPRELUDE_LDFLAGS" LIBS="$LIBS $LIBPRELUDE_LIBS" AC_TRY_LINK([ #include #include #include #include ], [ return !!prelude_check_version(NULL); ], [ echo "*** The test program compiled, but did not run. This usually means" echo "*** that the run-time linker is not finding LIBPRELUDE or finding the wrong" echo "*** version of LIBPRELUDE. If it is not finding LIBPRELUDE, you'll need to set your" echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point" echo "*** to the installed location Also, make sure you have run ldconfig if that" echo "*** is required on your system" echo "***" echo "*** If you have an old version installed, it is best to remove it, although" echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH" echo "***" ], [ echo "*** The test program failed to compile or link. See the file config.log for the" echo "*** exact error that occured. This usually means LIBPRELUDE was incorrectly installed" echo "*** or that you have moved LIBPRELUDE since it was installed. In the latter case, you" echo "*** may want to edit the libprelude-config script: $LIBPRELUDE_CONFIG" ]) CFLAGS="$ac_save_CFLAGS" LDFLAGS="$ac_save_LDFLAGS" LIBS="$ac_save_LIBS" fi fi LIBPRELUDE_CFLAGS="" LIBPRELUDE_LDFLAGS="" LIBPRELUDE_LIBS="" ifelse([$3], , :, [$3]) fi rm -f conf.libpreludetest AC_SUBST(LIBPRELUDE_CFLAGS) AC_SUBST(LIBPRELUDE_PTHREAD_CFLAGS) AC_SUBST(LIBPRELUDE_LDFLAGS) AC_SUBST(LIBPRELUDE_LIBS) AC_SUBST(LIBPRELUDE_PREFIX) AC_SUBST(LIBPRELUDE_CONFIG_PREFIX) m4_ifdef([LT_INIT], [AC_DEFINE([PRELUDE_APPLICATION_USE_LIBTOOL2], [], [Define whether application use libtool >= 2.0])], []) ]) dnl *-*wedit:notab*-* Please keep this as the last line. suricata-3.2.1/config.rpath0000644000000000000000000000000013051004444012505 00000000000000suricata-3.2.1/configure0000755000000000000000000273060513051004466012142 00000000000000#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.69 for suricata 3.2.1. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. # # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # Use a proper internal environment variable to ensure we don't fall # into an infinite loop, continuously re-executing ourselves. if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then _as_can_reexec=no; export _as_can_reexec; # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 as_fn_exit 255 fi # We don't want this to propagate to other subprocesses. { _as_can_reexec=; unset _as_can_reexec;} if test "x$CONFIG_SHELL" = x; then as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in *posix*) set -o posix ;; esac fi " as_required="as_fn_return () { (exit \$1); } as_fn_success () { as_fn_return 0; } as_fn_failure () { as_fn_return 1; } as_fn_ret_success () { return 0; } as_fn_ret_failure () { return 1; } exitcode=0 as_fn_success || { exitcode=1; echo as_fn_success failed.; } as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : else exitcode=1; echo positional parameters were not saved. fi test x\$exitcode = x0 || exit 1 test -x / || exit 1" as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 test -n \"\${ZSH_VERSION+set}\${BASH_VERSION+set}\" || ( ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO ECHO=\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO\$ECHO PATH=/empty FPATH=/empty; export PATH FPATH test \"X\`printf %s \$ECHO\`\" = \"X\$ECHO\" \\ || test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) || exit 1 test \$(( 1 + 1 )) = 2 || exit 1" if (eval "$as_required") 2>/dev/null; then : as_have_required=yes else as_have_required=no fi if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. as_found=: case $as_dir in #( /*) for as_base in sh bash ksh sh5; do # Try only shells that exist, to save several forks. as_shell=$as_dir/$as_base if { test -f "$as_shell" || test -f "$as_shell.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : CONFIG_SHELL=$as_shell as_have_required=yes if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : break 2 fi fi done;; esac as_found=false done $as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : CONFIG_SHELL=$SHELL as_have_required=yes fi; } IFS=$as_save_IFS if test "x$CONFIG_SHELL" != x; then : export CONFIG_SHELL # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 exit 255 fi if test x$as_have_required = xno; then : $as_echo "$0: This script requires a shell more modern than all" $as_echo "$0: the shells that I found on your system." if test x${ZSH_VERSION+set} = xset ; then $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" $as_echo "$0: be upgraded to zsh 4.3.4 or later." else $as_echo "$0: Please tell bug-autoconf@gnu.org about your system, $0: including any error possibly output before this $0: message. Then install a modern shell, or manually run $0: the script under such a shell if you do have one." fi exit 1 fi fi fi SHELL=${CONFIG_SHELL-/bin/sh} export SHELL # Unset more variables known to interfere with behavior of common tools. CLICOLOR_FORCE= GREP_OPTIONS= unset CLICOLOR_FORCE GREP_OPTIONS ## --------------------- ## ## M4sh Shell Functions. ## ## --------------------- ## # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_lineno_1=$LINENO as_lineno_1a=$LINENO as_lineno_2=$LINENO as_lineno_2a=$LINENO eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } # If we had to re-execute with $CONFIG_SHELL, we're ensured to have # already done that, so ensure we don't try to do so again and fall # in an infinite loop. This has already happened in practice. _as_can_reexec=no; export _as_can_reexec # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" SHELL=${CONFIG_SHELL-/bin/sh} as_awk_strverscmp=' # Use only awk features that work with 7th edition Unix awk (1978). # My, what an old awk you have, Mr. Solaris! END { while (length(v1) && length(v2)) { # Set d1 to be the next thing to compare from v1, and likewise for d2. # Normally this is a single character, but if v1 and v2 contain digits, # compare them as integers and fractions as strverscmp does. if (v1 ~ /^[0-9]/ && v2 ~ /^[0-9]/) { # Split v1 and v2 into their leading digit string components d1 and d2, # and advance v1 and v2 past the leading digit strings. for (len1 = 1; substr(v1, len1 + 1) ~ /^[0-9]/; len1++) continue for (len2 = 1; substr(v2, len2 + 1) ~ /^[0-9]/; len2++) continue d1 = substr(v1, 1, len1); v1 = substr(v1, len1 + 1) d2 = substr(v2, 1, len2); v2 = substr(v2, len2 + 1) if (d1 ~ /^0/) { if (d2 ~ /^0/) { # Compare two fractions. while (d1 ~ /^0/ && d2 ~ /^0/) { d1 = substr(d1, 2); len1-- d2 = substr(d2, 2); len2-- } if (len1 != len2 && ! (len1 && len2 && substr(d1, 1, 1) == substr(d2, 1, 1))) { # The two components differ in length, and the common prefix # contains only leading zeros. Consider the longer to be less. d1 = -len1 d2 = -len2 } else { # Otherwise, compare as strings. d1 = "x" d1 d2 = "x" d2 } } else { # A fraction is less than an integer. exit 1 } } else { if (d2 ~ /^0/) { # An integer is greater than a fraction. exit 2 } else { # Compare two integers. d1 += 0 d2 += 0 } } } else { # The normal case, without worrying about digits. d1 = substr(v1, 1, 1); v1 = substr(v1, 2) d2 = substr(v2, 1, 1); v2 = substr(v2, 2) } if (d1 < d2) exit 1 if (d1 > d2) exit 2 } # Beware Solaris /usr/xgp4/bin/awk (at least through Solaris 10), # which mishandles some comparisons of empty strings to integers. if (length(v2)) exit 1 if (length(v1)) exit 2 } ' test -n "$DJDIR" || exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= # Identity of this package. PACKAGE_NAME='suricata' PACKAGE_TARNAME='suricata' PACKAGE_VERSION='3.2.1' PACKAGE_STRING='suricata 3.2.1' PACKAGE_BUGREPORT='' PACKAGE_URL='' ac_unique_file="src/suricata.c" # Factoring default headers for most tests. ac_includes_default="\ #include #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_STAT_H # include #endif #ifdef STDC_HEADERS # include # include #else # ifdef HAVE_STDLIB_H # include # endif #endif #ifdef HAVE_STRING_H # if !defined STDC_HEADERS && defined HAVE_MEMORY_H # include # endif # include #endif #ifdef HAVE_STRINGS_H # include #endif #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif #ifdef HAVE_UNISTD_H # include #endif" enable_option_checking=no ac_subst_vars='am__EXEEXT_FALSE am__EXEEXT_TRUE LTLIBOBJS CONFIGURE_LOCALSTATEDIR CONFIGURE_SYSCONDIR CONFIGURE_PREFIX e_enable_evelog e_magic_file_comment e_magic_file e_localstatedir e_sysconfrulesdir e_sysconfdir e_logcertsdir e_logfilesdir e_rundir e_logdir HAVE_GIT_CMD HAVE_PDFLATEX_FALSE HAVE_PDFLATEX_TRUE HAVE_PDFLATEX HAVE_SURICATA_MAN_FALSE HAVE_SURICATA_MAN_TRUE HAVE_SPHINXBUILD_FALSE HAVE_SPHINXBUILD_TRUE HAVE_SPHINXBUILD HAVE_GETCONF_CMD LUAJIT_LIBS LUAJIT_CFLAGS LUA_LIBS LUA_CFLAGS libnss_LIBS libnss_CFLAGS libnspr_LIBS libnspr_CFLAGS __SC_CUDA_SUPPORT___FALSE __SC_CUDA_SUPPORT___TRUE BUILD_CUDA_FALSE BUILD_CUDA_TRUE pkgpyexecdir pyexecdir pkgpythondir pythondir PYTHON_PLATFORM PYTHON_EXEC_PREFIX PYTHON_PREFIX PYTHON_VERSION PYTHON NVCC HTP_LDADD HTP_DIR subdirs LIBHTPDEVVERSION_LIBS LIBHTPDEVVERSION_CFLAGS LIBHTPMINVERSION_LIBS LIBHTPMINVERSION_CFLAGS libhtp_LIBS libhtp_CFLAGS PCAP_CFLAGS HAVE_PCAP_CONFIG LIBPRELUDE_CONFIG_PREFIX LIBPRELUDE_PREFIX LIBPRELUDE_LIBS LIBPRELUDE_LDFLAGS LIBPRELUDE_PTHREAD_CFLAGS LIBPRELUDE_CFLAGS LIBPRELUDE_CONFIG libnetfilter_queue_LIBS libnetfilter_queue_CFLAGS libhs_LIBS libhs_CFLAGS LIBPCREVERSION_LIBS LIBPCREVERSION_CFLAGS BUILD_PCIE_LOGGING_FALSE BUILD_PCIE_LOGGING_TRUE HAVE_COCCINELLE_FALSE HAVE_COCCINELLE_TRUE HAVE_COCCINELLE_CONFIG DEBUG_FALSE DEBUG_TRUE BUILD_UNITTESTS_FALSE BUILD_UNITTESTS_TRUE OPTIMIZATION_CFLAGS SECLDFLAGS SECCFLAGS LIBOBJS HAVE_WGET_COMMAND_FALSE HAVE_WGET_COMMAND_TRUE HAVE_FETCH_COMMAND_FALSE HAVE_FETCH_COMMAND_TRUE HAVE_CURL HAVE_WGET HAVE_PYTHON_FALSE HAVE_PYTHON_TRUE HAVE_PYTHON_CONFIG HAVE_PKG_CONFIG GCC_CFLAGS CLANG_CFLAGS PKG_CONFIG_LIBDIR PKG_CONFIG_PATH PKG_CONFIG CPP LT_SYS_LIBRARY_PATH OTOOL64 OTOOL LIPO NMEDIT DSYMUTIL MANIFEST_TOOL RANLIB ac_ct_AR AR DLLTOOL OBJDUMP LN_S NM ac_ct_DUMPBIN DUMPBIN LD FGREP EGREP GREP SED host_os host_vendor host_cpu host build_os build_vendor build_cpu build LIBTOOL am__fastdepCC_FALSE am__fastdepCC_TRUE CCDEPMODE am__nodep AMDEPBACKSLASH AMDEP_FALSE AMDEP_TRUE am__quote am__include DEPDIR OBJEXT EXEEXT ac_ct_CC CPPFLAGS LDFLAGS CFLAGS CC am__untar am__tar AMTAR am__leading_dot SET_MAKE AWK mkdir_p MKDIR_P INSTALL_STRIP_PROGRAM STRIP install_sh MAKEINFO AUTOHEADER AUTOMAKE AUTOCONF ACLOCAL VERSION PACKAGE CYGPATH_W am__isrc INSTALL_DATA INSTALL_SCRIPT INSTALL_PROGRAM AM_BACKSLASH AM_DEFAULT_VERBOSITY AM_DEFAULT_V AM_V target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir runstatedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_URL PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking enable_silent_rules enable_dependency_tracking enable_shared enable_static with_pic enable_fast_install with_aix_soname with_gnu_ld with_sysroot enable_libtool_lock enable_python enable_largefile enable_afl enable_threading_tls enable_gccprotect enable_gccprofile enable_gccmarch_native enable_unittests enable_old_barnyard2 enable_debug enable_debug_validation enable_profiling enable_profiling_locks enable_ipfw enable_coccinelle enable_detection with_libpcre_includes with_libpcre_libraries with_libhs_includes with_libhs_libraries with_libyaml_includes with_libyaml_libraries with_libpthread_includes with_libpthread_libraries with_libjansson_includes with_libjansson_libraries enable_unix_socket enable_nflog enable_nfqueue with_libnfnetlink_includes with_libnfnetlink_libraries with_libnetfilter_queue_includes with_libnetfilter_queue_libraries with_netfilterforwin_includes with_libnetfilter_log_includes with_libnetfilter_log_libraries enable_prelude with_libprelude_prefix with_libnet_includes with_libnet_libraries with_libpcap_includes with_libpcap_libraries enable_pfring with_libpfring_includes with_libpfring_libraries enable_af_packet enable_netmap with_netmap_includes enable_non_bundled_htp with_libhtp_includes with_libhtp_libraries enable_cuda with_cuda_includes with_cuda_libraries with_cuda_nvcc with_libcap_ng_includes with_libcap_ng_libraries enable_dag with_dag_includes with_dag_libraries with_libnspr_includes with_libnspr_libraries with_libnss_includes with_libnss_libraries enable_libmagic with_libmagic_includes with_libmagic_libraries enable_napatech with_napatech_includes with_napatech_libraries enable_lua enable_luajit with_liblua_includes with_liblua_libraries with_libluajit_includes with_libluajit_libraries enable_geoip with_libgeoip_includes with_libgeoip_libraries enable_pie enable_hiredis with_libhiredis_includes with_libhiredis_libraries ' ac_precious_vars='build_alias host_alias target_alias CC CFLAGS LDFLAGS LIBS CPPFLAGS LT_SYS_LIBRARY_PATH CPP PKG_CONFIG PKG_CONFIG_PATH PKG_CONFIG_LIBDIR LIBPCREVERSION_CFLAGS LIBPCREVERSION_LIBS libhs_CFLAGS libhs_LIBS libnetfilter_queue_CFLAGS libnetfilter_queue_LIBS libhtp_CFLAGS libhtp_LIBS LIBHTPMINVERSION_CFLAGS LIBHTPMINVERSION_LIBS LIBHTPDEVVERSION_CFLAGS LIBHTPDEVVERSION_LIBS PYTHON libnspr_CFLAGS libnspr_LIBS libnss_CFLAGS libnss_LIBS LUA_CFLAGS LUA_LIBS LUAJIT_CFLAGS LUAJIT_LIBS' ac_subdirs_all='libhtp' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *=) ac_optarg= ;; *) ac_optarg=yes ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -runstatedir | --runstatedir | --runstatedi | --runstated \ | --runstate | --runstat | --runsta | --runst | --runs \ | --run | --ru | --r) ac_prev=runstatedir ;; -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ | --run=* | --ru=* | --r=*) runstatedir=$ac_optarg ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) as_fn_error $? "unrecognized option: \`$ac_option' Try \`$0 --help' for more information" ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. case $ac_envvar in #( '' | [0-9]* | *[!_$as_cr_alnum]* ) as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; esac eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}" ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` as_fn_error $? "missing argument to $ac_option" fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir runstatedir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || as_fn_error $? "working directory cannot be determined" test "X$ac_ls_di" = "X$ac_pwd_ls_di" || as_fn_error $? "pwd does not report name of working directory" # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures suricata 3.2.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/suricata] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF Program names: --program-prefix=PREFIX prepend PREFIX to installed program names --program-suffix=SUFFIX append SUFFIX to installed program names --program-transform-name=PROGRAM run sed PROGRAM on installed program names System types: --build=BUILD configure for building on BUILD [guessed] --host=HOST cross-compile to build programs to run on HOST [BUILD] _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of suricata 3.2.1:";; esac cat <<\_ACEOF Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --enable-silent-rules less verbose build output (undo: "make V=1") --disable-silent-rules verbose build output (undo: "make V=0") --enable-dependency-tracking do not reject slow dependency extractors --disable-dependency-tracking speeds up one-time build --enable-shared[=PKGS] build shared libraries [default=yes] --enable-static[=PKGS] build static libraries [default=yes] --enable-fast-install[=PKGS] optimize for fast installation [default=yes] --disable-libtool-lock avoid locking (might break parallel builds) --enable-python Enable python --disable-largefile omit support for large files --enable-afl Enable AFL fuzzing logic] --disable-threading-tls Disable TLS (thread local storage) --enable-gccprotect Detect and use gcc hardening options --enable-gccprofile Enable gcc profile info i.e -pg flag is set --enable-gccmarch-native Enable gcc march=native gcc 4.2 and later only --enable-unittests Enable compilation of the unit tests --enable-old-barnyard2 Use workaround for old barnyard2 in unified2 output --enable-debug Enable debug output --enable-debug-validation Enable (debug) validation code output --enable-profiling Enable performance profiling --enable-profiling-locks Enable performance profiling for locks --enable-ipfw Enable FreeBSD IPFW support for inline IDP --disable-coccinelle Disable coccinelle QA steps during make check --disable-detection Disable Detection Modules --enable-unix-socket Enable unix socket [default=test] --enable-nflog Enable libnetfilter_log support --enable-nfqueue Enable NFQUEUE support for inline IDP --enable-prelude Enable Prelude support for alerts --enable-pfring Enable Native PF_RING support --enable-af-packet Enable AF_PACKET support [default=yes] --enable-netmap Enable Netmap support --enable-non-bundled-htp Enable the use of an already installed version of htp --enable-cuda Enable experimental CUDA pattern matching --enable-dag Enable DAG capture --enable-libmagic Enable libmagic support [default=yes] --enable-napatech Enabled Napatech Devices --enable-lua Enable Lua support --enable-luajit Enable Luajit support --enable-geoip Enable GeoIP support --enable-pie Enable compiling as a position independent executable --enable-hiredis Enable Redis support Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-pic[=PKGS] try to use only PIC/non-PIC objects [default=use both] --with-aix-soname=aix|svr4|both shared library versioning (aka "SONAME") variant to provide on AIX, [default=aix]. --with-gnu-ld assume the C compiler uses GNU ld [default=no] --with-sysroot[=DIR] Search for dependent libraries within DIR (or the compiler's sysroot if not specified). --with-libpcre-includes=DIR libpcre include directory --with-libpcre-libraries=DIR libpcre library directory --with-libhs-includes=DIR libhs include directory --with-libhs-libraries=DIR libhs library directory --with-libyaml-includes=DIR libyaml include directory --with-libyaml-libraries=DIR libyaml library directory --with-libpthread-includes=DIR libpthread include directory --with-libpthread-libraries=DIR libpthread library directory --with-libjansson-includes=DIR libjansson include directory --with-libjansson-libraries=DIR libjansson library directory --with-libnfnetlink-includes=DIR libnfnetlink include directory --with-libnfnetlink-libraries=DIR libnfnetlink library directory --with-libnetfilter_queue-includes=DIR libnetfilter_queue include directory --with-libnetfilter_queue-libraries=DIR libnetfilter_queue library directory --with-netfilterforwin-includes=DIR netfilterforwin include directory --with-libnetfilter_log-includes=DIR libnetfilter_log include directory --with-libnetfilter_log-libraries=DIR libnetfilter_log library directory --with-libprelude-prefix=PFX Prefix where libprelude is installed (optional) --with-libnet-includes=DIR libnet include directory --with-libnet-libraries=DIR libnet library directory --with-libpcap-includes=DIR libpcap include directory --with-libpcap-libraries=DIR libpcap library directory --with-libpfring-includes=DIR libpfring include directory --with-libpfring-libraries=DIR libpfring library directory --with-netmap-includes=DIR netmap include directory --with-libhtp-includes=DIR libhtp include directory --with-libhtp-libraries=DIR libhtp library directory --with-cuda-includes=DIR cuda include directory --with-cuda-libraries=DIR cuda library directory --with-cuda-nvcc=DIR cuda nvcc compiler directory --with-libcap_ng-includes=DIR libcap_ng include directory --with-libcap_ng-libraries=DIR libcap_ng library directory --with-dag-includes=DIR dagapi include directory --with-dag-libraries=DIR dagapi library directory --with-libnspr-includes=DIR libnspr include directory --with-libnspr-libraries=DIR libnspr library directory --with-libnss-includes=DIR libnss include directory --with-libnss-libraries=DIR libnss library directory --with-libmagic-includes=DIR libmagic include directory --with-libmagic-libraries=DIR libmagic library directory --with-napatech-includes=DIR napatech include directory --with-napatech-libraries=DIR napatech library directory --with-liblua-includes=DIR liblua include directory --with-liblua-libraries=DIR liblua library directory --with-libluajit-includes=DIR libluajit include directory --with-libluajit-libraries=DIR libluajit library directory --with-libgeoip-includes=DIR libgeoip include directory --with-libgeoip-libraries=DIR libgeoip library directory --with-libhiredis-includes=DIR libhiredis include directory --with-libhiredis-libraries=DIR libhiredis library directory Some influential environment variables: CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L if you have libraries in a nonstandard directory LIBS libraries to pass to the linker, e.g. -l CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I if you have headers in a nonstandard directory LT_SYS_LIBRARY_PATH User-defined run-time library search path. CPP C preprocessor PKG_CONFIG path to pkg-config utility PKG_CONFIG_PATH directories to add to pkg-config's search path PKG_CONFIG_LIBDIR path overriding pkg-config's built-in search path LIBPCREVERSION_CFLAGS C compiler flags for LIBPCREVERSION, overriding pkg-config LIBPCREVERSION_LIBS linker flags for LIBPCREVERSION, overriding pkg-config libhs_CFLAGS C compiler flags for libhs, overriding pkg-config libhs_LIBS linker flags for libhs, overriding pkg-config libnetfilter_queue_CFLAGS C compiler flags for libnetfilter_queue, overriding pkg-config libnetfilter_queue_LIBS linker flags for libnetfilter_queue, overriding pkg-config libhtp_CFLAGS C compiler flags for libhtp, overriding pkg-config libhtp_LIBS linker flags for libhtp, overriding pkg-config LIBHTPMINVERSION_CFLAGS C compiler flags for LIBHTPMINVERSION, overriding pkg-config LIBHTPMINVERSION_LIBS linker flags for LIBHTPMINVERSION, overriding pkg-config LIBHTPDEVVERSION_CFLAGS C compiler flags for LIBHTPDEVVERSION, overriding pkg-config LIBHTPDEVVERSION_LIBS linker flags for LIBHTPDEVVERSION, overriding pkg-config PYTHON the Python interpreter libnspr_CFLAGS C compiler flags for libnspr, overriding pkg-config libnspr_LIBS linker flags for libnspr, overriding pkg-config libnss_CFLAGS C compiler flags for libnss, overriding pkg-config libnss_LIBS linker flags for libnss, overriding pkg-config LUA_CFLAGS C compiler flags for LUA, overriding pkg-config LUA_LIBS linker flags for LUA, overriding pkg-config LUAJIT_CFLAGS C compiler flags for LUAJIT, overriding pkg-config LUAJIT_LIBS linker flags for LUAJIT, overriding pkg-config Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to the package provider. _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for guested configure. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF suricata configure 3.2.1 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi ## ------------------------ ## ## Autoconf initialization. ## ## ------------------------ ## # ac_fn_c_try_compile LINENO # -------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_compile # ac_fn_c_try_link LINENO # ----------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_link () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest$ac_exeext if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || test -x conftest$ac_exeext }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would # interfere with the next link command; also delete a directory that is # left behind by Apple's compiler. We do this before executing the actions. rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_link # ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists and can be compiled using the include files in # INCLUDES, setting the cache variable VAR accordingly. ac_fn_c_check_header_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_compile # ac_fn_c_try_cpp LINENO # ---------------------- # Try to preprocess conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_cpp () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_cpp conftest.$ac_ext" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } > conftest.i && { test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || test ! -s conftest.err }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_cpp # ac_fn_c_try_run LINENO # ---------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. Assumes # that executables *can* be run. ac_fn_c_try_run () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then : ac_retval=0 else $as_echo "$as_me: program exited with status $ac_status" >&5 $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=$ac_status fi rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_run # ac_fn_c_check_func LINENO FUNC VAR # ---------------------------------- # Tests whether FUNC exists, setting the cache variable VAR accordingly ac_fn_c_check_func () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Define $2 to an innocuous variant, in case declares $2. For example, HP-UX 11i declares gettimeofday. */ #define $2 innocuous_$2 /* System header to define __stub macros and hopefully few prototypes, which can conflict with char $2 (); below. Prefer to if __STDC__ is defined, since exists even on freestanding compilers. */ #ifdef __STDC__ # include #else # include #endif #undef $2 /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char $2 (); /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined __stub_$2 || defined __stub___$2 choke me #endif int main () { return $2 (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_func # ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists, giving a warning if it cannot be compiled using # the include files in INCLUDES and setting the cache variable VAR # accordingly. ac_fn_c_check_header_mongrel () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if eval \${$3+:} false; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } else # Is the header compilable? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5 $as_echo_n "checking $2 usability... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_header_compiler=yes else ac_header_compiler=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5 $as_echo "$ac_header_compiler" >&6; } # Is the header present? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5 $as_echo_n "checking $2 presence... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include <$2> _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : ac_header_preproc=yes else ac_header_preproc=no fi rm -f conftest.err conftest.i conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5 $as_echo "$ac_header_preproc" >&6; } # So? What about this header? case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #(( yes:no: ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5 $as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ;; no:yes:* ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5 $as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5 $as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5 $as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5 $as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else eval "$3=\$ac_header_compiler" fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_mongrel # ac_fn_c_check_type LINENO TYPE VAR INCLUDES # ------------------------------------------- # Tests whether TYPE exists after having included INCLUDES, setting cache # variable VAR accordingly. ac_fn_c_check_type () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else eval "$3=no" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main () { if (sizeof ($2)) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main () { if (sizeof (($2))) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else eval "$3=yes" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_type # ac_fn_c_check_decl LINENO SYMBOL VAR INCLUDES # --------------------------------------------- # Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR # accordingly. ac_fn_c_check_decl () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack as_decl_name=`echo $2|sed 's/ *(.*//'` as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'` { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5 $as_echo_n "checking whether $as_decl_name is declared... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main () { #ifndef $as_decl_name #ifdef __cplusplus (void) $as_decl_use; #else (void) $as_decl_name; #endif #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_decl cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by suricata $as_me 3.2.1, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. $as_echo "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; 2) as_fn_append ac_configure_args1 " '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi as_fn_append ac_configure_args " '$ac_arg'" ;; esac done done { ac_configure_args0=; unset ac_configure_args0;} { ac_configure_args1=; unset ac_configure_args1;} # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo $as_echo "## ---------------- ## ## Cache variables. ## ## ---------------- ##" echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo $as_echo "## ----------------- ## ## Output variables. ## ## ----------------- ##" echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then $as_echo "## ------------------- ## ## File substitutions. ## ## ------------------- ##" echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then $as_echo "## ----------- ## ## confdefs.h. ## ## ----------- ##" echo cat confdefs.h echo fi test "$ac_signal" != 0 && $as_echo "$as_me: caught signal $ac_signal" $as_echo "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h $as_echo "/* confdefs.h */" > confdefs.h # Predefined preprocessor variables. cat >>confdefs.h <<_ACEOF #define PACKAGE_NAME "$PACKAGE_NAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_TARNAME "$PACKAGE_TARNAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_VERSION "$PACKAGE_VERSION" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_STRING "$PACKAGE_STRING" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_URL "$PACKAGE_URL" _ACEOF # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. ac_site_file1=NONE ac_site_file2=NONE if test -n "$CONFIG_SITE"; then # We do not want a PATH search for config.site. case $CONFIG_SITE in #(( -*) ac_site_file1=./$CONFIG_SITE;; */*) ac_site_file1=$CONFIG_SITE;; *) ac_site_file1=./$CONFIG_SITE;; esac elif test "x$prefix" != xNONE; then ac_site_file1=$prefix/share/config.site ac_site_file2=$prefix/etc/config.site else ac_site_file1=$ac_default_prefix/share/config.site ac_site_file2=$ac_default_prefix/etc/config.site fi for ac_site_file in "$ac_site_file1" "$ac_site_file2" do test "x$ac_site_file" = xNONE && continue if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 $as_echo "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" \ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed to load site script $ac_site_file See \`config.log' for more details" "$LINENO" 5; } fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special files # actually), so we avoid doing that. DJGPP emulates it as a regular file. if test /dev/null != "$cache_file" && test -f "$cache_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 $as_echo "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 $as_echo "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 $as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 $as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 $as_echo "$as_me: former value: \`$ac_old_val'" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 $as_echo "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) as_fn_append ac_configure_args " '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 $as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 fi ## -------------------- ## ## Main body of script. ## ## -------------------- ## ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu # Check whether --enable-silent-rules was given. if test "${enable_silent_rules+set}" = set; then : enableval=$enable_silent_rules; fi case $enable_silent_rules in # ((( yes) AM_DEFAULT_VERBOSITY=0;; no) AM_DEFAULT_VERBOSITY=1;; *) AM_DEFAULT_VERBOSITY=0;; esac am_make=${MAKE-make} { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5 $as_echo_n "checking whether $am_make supports nested variables... " >&6; } if ${am_cv_make_support_nested_variables+:} false; then : $as_echo_n "(cached) " >&6 else if $as_echo 'TRUE=$(BAR$(V)) BAR0=false BAR1=true V=1 am__doit: @$(TRUE) .PHONY: am__doit' | $am_make -f - >/dev/null 2>&1; then am_cv_make_support_nested_variables=yes else am_cv_make_support_nested_variables=no fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5 $as_echo "$am_cv_make_support_nested_variables" >&6; } if test $am_cv_make_support_nested_variables = yes; then AM_V='$(V)' AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)' else AM_V=$AM_DEFAULT_VERBOSITY AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY fi AM_BACKSLASH='\' ac_config_headers="$ac_config_headers config.h" am__api_version='1.15' ac_aux_dir= for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do if test -f "$ac_dir/install-sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break elif test -f "$ac_dir/install.sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install.sh -c" break elif test -f "$ac_dir/shtool"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/shtool install -c" break fi done if test -z "$ac_aux_dir"; then as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5 fi # These three variables are undocumented and unsupported, # and are intended to be withdrawn in a future Autoconf release. # They can cause serious problems if a builder's source tree is in a directory # whose full name contains unusual characters. ac_config_guess="$SHELL $ac_aux_dir/config.guess" # Please don't use this var. ac_config_sub="$SHELL $ac_aux_dir/config.sub" # Please don't use this var. ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var. # Find a good install program. We prefer a C program (faster), # so one script is as good as another. But avoid the broken or # incompatible versions: # SysV /etc/install, /usr/sbin/install # SunOS /usr/etc/install # IRIX /sbin/install # AIX /bin/install # AmigaOS /C/install, which installs bootblocks on floppy discs # AIX 4 /usr/bin/installbsd, which doesn't work without a -g flag # AFS /usr/afsws/bin/install, which mishandles nonexistent args # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff" # OS/2's system install, which has a completely different semantic # ./install, which can be erroneously created by make from ./install.sh. # Reject install programs that cannot install multiple files. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5 $as_echo_n "checking for a BSD-compatible install... " >&6; } if test -z "$INSTALL"; then if ${ac_cv_path_install+:} false; then : $as_echo_n "(cached) " >&6 else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. # Account for people who put trailing slashes in PATH elements. case $as_dir/ in #(( ./ | .// | /[cC]/* | \ /etc/* | /usr/sbin/* | /usr/etc/* | /sbin/* | /usr/afsws/bin/* | \ ?:[\\/]os2[\\/]install[\\/]* | ?:[\\/]OS2[\\/]INSTALL[\\/]* | \ /usr/ucb/* ) ;; *) # OSF1 and SCO ODT 3.0 have their own names for install. # Don't use installbsd from OSF since it installs stuff as root # by default. for ac_prog in ginstall scoinst install; do for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext"; then if test $ac_prog = install && grep dspmsg "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # AIX install. It has an incompatible calling convention. : elif test $ac_prog = install && grep pwplus "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # program-specific install script used by HP pwplus--don't use. : else rm -rf conftest.one conftest.two conftest.dir echo one > conftest.one echo two > conftest.two mkdir conftest.dir if "$as_dir/$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir" && test -s conftest.one && test -s conftest.two && test -s conftest.dir/conftest.one && test -s conftest.dir/conftest.two then ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c" break 3 fi fi fi done done ;; esac done IFS=$as_save_IFS rm -rf conftest.one conftest.two conftest.dir fi if test "${ac_cv_path_install+set}" = set; then INSTALL=$ac_cv_path_install else # As a last resort, use the slow shell script. Don't cache a # value for INSTALL within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the value is a relative name. INSTALL=$ac_install_sh fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5 $as_echo "$INSTALL" >&6; } # Use test -z because SunOS4 sh mishandles braces in ${var-val}. # It thinks the first close brace ends the variable substitution. test -z "$INSTALL_PROGRAM" && INSTALL_PROGRAM='${INSTALL}' test -z "$INSTALL_SCRIPT" && INSTALL_SCRIPT='${INSTALL}' test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644' { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether build environment is sane" >&5 $as_echo_n "checking whether build environment is sane... " >&6; } # Reject unsafe characters in $srcdir or the absolute working directory # name. Accept space and tab only in the latter. am_lf=' ' case `pwd` in *[\\\"\#\$\&\'\`$am_lf]*) as_fn_error $? "unsafe absolute working directory name" "$LINENO" 5;; esac case $srcdir in *[\\\"\#\$\&\'\`$am_lf\ \ ]*) as_fn_error $? "unsafe srcdir value: '$srcdir'" "$LINENO" 5;; esac # Do 'set' in a subshell so we don't clobber the current shell's # arguments. Must try -L first in case configure is actually a # symlink; some systems play weird games with the mod time of symlinks # (eg FreeBSD returns the mod time of the symlink's containing # directory). if ( am_has_slept=no for am_try in 1 2; do echo "timestamp, slept: $am_has_slept" > conftest.file set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null` if test "$*" = "X"; then # -L didn't work. set X `ls -t "$srcdir/configure" conftest.file` fi if test "$*" != "X $srcdir/configure conftest.file" \ && test "$*" != "X conftest.file $srcdir/configure"; then # If neither matched, then we have a broken ls. This can happen # if, for instance, CONFIG_SHELL is bash and it inherits a # broken ls alias from the environment. This has actually # happened. Such a system could not be considered "sane". as_fn_error $? "ls -t appears to fail. Make sure there is not a broken alias in your environment" "$LINENO" 5 fi if test "$2" = conftest.file || test $am_try -eq 2; then break fi # Just in case. sleep 1 am_has_slept=yes done test "$2" = conftest.file ) then # Ok. : else as_fn_error $? "newly created file is older than distributed files! Check your system clock" "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } # If we didn't sleep, we still need to ensure time stamps of config.status and # generated files are strictly newer. am_sleep_pid= if grep 'slept: no' conftest.file >/dev/null 2>&1; then ( sleep 1 ) & am_sleep_pid=$! fi rm -f conftest.file test "$program_prefix" != NONE && program_transform_name="s&^&$program_prefix&;$program_transform_name" # Use a double $ so make ignores it. test "$program_suffix" != NONE && program_transform_name="s&\$&$program_suffix&;$program_transform_name" # Double any \ or $. # By default was `s,x,x', remove it if useless. ac_script='s/[\\$]/&&/g;s/;s,x,x,$//' program_transform_name=`$as_echo "$program_transform_name" | sed "$ac_script"` # Expand $ac_aux_dir to an absolute path. am_aux_dir=`cd "$ac_aux_dir" && pwd` if test x"${MISSING+set}" != xset; then case $am_aux_dir in *\ * | *\ *) MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;; *) MISSING="\${SHELL} $am_aux_dir/missing" ;; esac fi # Use eval to expand $SHELL if eval "$MISSING --is-lightweight"; then am_missing_run="$MISSING " else am_missing_run= { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: 'missing' script is too old or missing" >&5 $as_echo "$as_me: WARNING: 'missing' script is too old or missing" >&2;} fi if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; *) install_sh="\${SHELL} $am_aux_dir/install-sh" esac fi # Installed binaries are usually stripped using 'strip' when the user # run "make install-strip". However 'strip' might not be the right # tool to use in cross-compilation environments, therefore Automake # will honor the 'STRIP' environment variable to overrule this program. if test "$cross_compiling" != no; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args. set dummy ${ac_tool_prefix}strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$STRIP"; then ac_cv_prog_STRIP="$STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_STRIP="${ac_tool_prefix}strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi STRIP=$ac_cv_prog_STRIP if test -n "$STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5 $as_echo "$STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_STRIP"; then ac_ct_STRIP=$STRIP # Extract the first word of "strip", so it can be a program name with args. set dummy strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_STRIP"; then ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_STRIP="strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP if test -n "$ac_ct_STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5 $as_echo "$ac_ct_STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_STRIP" = x; then STRIP=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac STRIP=$ac_ct_STRIP fi else STRIP="$ac_cv_prog_STRIP" fi fi INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a thread-safe mkdir -p" >&5 $as_echo_n "checking for a thread-safe mkdir -p... " >&6; } if test -z "$MKDIR_P"; then if ${ac_cv_path_mkdir+:} false; then : $as_echo_n "(cached) " >&6 else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/opt/sfw/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in mkdir gmkdir; do for ac_exec_ext in '' $ac_executable_extensions; do as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext" || continue case `"$as_dir/$ac_prog$ac_exec_ext" --version 2>&1` in #( 'mkdir (GNU coreutils) '* | \ 'mkdir (coreutils) '* | \ 'mkdir (fileutils) '4.1*) ac_cv_path_mkdir=$as_dir/$ac_prog$ac_exec_ext break 3;; esac done done done IFS=$as_save_IFS fi test -d ./--version && rmdir ./--version if test "${ac_cv_path_mkdir+set}" = set; then MKDIR_P="$ac_cv_path_mkdir -p" else # As a last resort, use the slow shell script. Don't cache a # value for MKDIR_P within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the value is a relative name. MKDIR_P="$ac_install_sh -d" fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MKDIR_P" >&5 $as_echo "$MKDIR_P" >&6; } for ac_prog in gawk mawk nawk awk do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AWK+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AWK"; then ac_cv_prog_AWK="$AWK" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_AWK="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AWK=$ac_cv_prog_AWK if test -n "$AWK"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5 $as_echo "$AWK" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AWK" && break done { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5 $as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; } set x ${MAKE-make} ac_make=`$as_echo "$2" | sed 's/+/p/g; s/[^a-zA-Z0-9_]/_/g'` if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then : $as_echo_n "(cached) " >&6 else cat >conftest.make <<\_ACEOF SHELL = /bin/sh all: @echo '@@@%%%=$(MAKE)=@@@%%%' _ACEOF # GNU make sometimes prints "make[1]: Entering ...", which would confuse us. case `${MAKE-make} -f conftest.make 2>/dev/null` in *@@@%%%=?*=@@@%%%*) eval ac_cv_prog_make_${ac_make}_set=yes;; *) eval ac_cv_prog_make_${ac_make}_set=no;; esac rm -f conftest.make fi if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } SET_MAKE= else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } SET_MAKE="MAKE=${MAKE-make}" fi rm -rf .tst 2>/dev/null mkdir .tst 2>/dev/null if test -d .tst; then am__leading_dot=. else am__leading_dot=_ fi rmdir .tst 2>/dev/null if test "`cd $srcdir && pwd`" != "`pwd`"; then # Use -I$(srcdir) only when $(srcdir) != ., so that make's output # is not polluted with repeated "-I." am__isrc=' -I$(srcdir)' # test to see if srcdir already configured if test -f $srcdir/config.status; then as_fn_error $? "source directory already configured; run \"make distclean\" there first" "$LINENO" 5 fi fi # test whether we have cygpath if test -z "$CYGPATH_W"; then if (cygpath --version) >/dev/null 2>/dev/null; then CYGPATH_W='cygpath -w' else CYGPATH_W=echo fi fi # Define the identity of the package. PACKAGE='suricata' VERSION='3.2.1' cat >>confdefs.h <<_ACEOF #define PACKAGE "$PACKAGE" _ACEOF cat >>confdefs.h <<_ACEOF #define VERSION "$VERSION" _ACEOF # Some tools Automake needs. ACLOCAL=${ACLOCAL-"${am_missing_run}aclocal-${am__api_version}"} AUTOCONF=${AUTOCONF-"${am_missing_run}autoconf"} AUTOMAKE=${AUTOMAKE-"${am_missing_run}automake-${am__api_version}"} AUTOHEADER=${AUTOHEADER-"${am_missing_run}autoheader"} MAKEINFO=${MAKEINFO-"${am_missing_run}makeinfo"} # For better backward compatibility. To be removed once Automake 1.9.x # dies out for good. For more background, see: # # mkdir_p='$(MKDIR_P)' # We need awk for the "check" target (and possibly the TAP driver). The # system "awk" is bad on some platforms. # Always define AMTAR for backward compatibility. Yes, it's still used # in the wild :-( We should find a proper way to deprecate it ... AMTAR='$${TAR-tar}' # We'll loop over all known methods to create a tar archive until one works. _am_tools='gnutar pax cpio none' am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -' # POSIX will say in a future version that running "rm -f" with no argument # is OK; and we want to be able to make that assumption in our Makefile # recipes. So use an aggressive probe to check that the usage we want is # actually supported "in the wild" to an acceptable degree. # See automake bug#10828. # To make any issue more visible, cause the running configure to be aborted # by default if the 'rm' program in use doesn't match our expectations; the # user can still override this though. if rm -f && rm -fr && rm -rf; then : OK; else cat >&2 <<'END' Oops! Your 'rm' program seems unable to run without file operands specified on the command line, even when the '-f' option is present. This is contrary to the behaviour of most rm programs out there, and not conforming with the upcoming POSIX standard: Please tell bug-automake@gnu.org about your system, including the value of your $PATH and any error possibly output before this message. This can help us improve future automake versions. END if test x"$ACCEPT_INFERIOR_RM_PROGRAM" = x"yes"; then echo 'Configuration will proceed anyway, since you have set the' >&2 echo 'ACCEPT_INFERIOR_RM_PROGRAM variable to "yes"' >&2 echo >&2 else cat >&2 <<'END' Aborting the configuration process, to ensure you take notice of the issue. You can download and install GNU coreutils to get an 'rm' implementation that behaves properly: . If you want to complete the configuration process using your problematic 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM to "yes", and re-run configure. END as_fn_error $? "Your 'rm' program is bad, sorry." "$LINENO" 5 fi fi $as_echo "#define RELEASE 1" >>confdefs.h ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu DEPDIR="${am__leading_dot}deps" ac_config_commands="$ac_config_commands depfiles" am_make=${MAKE-make} cat > confinc << 'END' am__doit: @echo this is the am__doit target .PHONY: am__doit END # If we don't find an include directive, just comment out the code. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for style of include used by $am_make" >&5 $as_echo_n "checking for style of include used by $am_make... " >&6; } am__include="#" am__quote= _am_result=none # First try GNU make style include. echo "include confinc" > confmf # Ignore all kinds of additional output from 'make'. case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=include am__quote= _am_result=GNU ;; esac # Now try BSD make style include. if test "$am__include" = "#"; then echo '.include "confinc"' > confmf case `$am_make -s -f confmf 2> /dev/null` in #( *the\ am__doit\ target*) am__include=.include am__quote="\"" _am_result=BSD ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $_am_result" >&5 $as_echo "$_am_result" >&6; } rm -f confinc confmf # Check whether --enable-dependency-tracking was given. if test "${enable_dependency_tracking+set}" = set; then : enableval=$enable_dependency_tracking; fi if test "x$enable_dependency_tracking" != xno; then am_depcomp="$ac_aux_dir/depcomp" AMDEPBACKSLASH='\' am__nodep='_no' fi if test "x$enable_dependency_tracking" != xno; then AMDEP_TRUE= AMDEP_FALSE='#' else AMDEP_TRUE='#' AMDEP_FALSE= fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 $as_echo_n "checking whether the C compiler works... " >&6; } ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` # The possible output files: ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ac_rmfiles= for ac_file in $ac_files do case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; * ) ac_rmfiles="$ac_rmfiles $ac_file";; esac done rm -f $ac_rmfiles if { { ac_try="$ac_link_default" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link_default") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' # in a Makefile. We should not override ac_cv_exeext if it was cached, # so that the user can short-circuit this test for compilers unknown to # Autoconf. for ac_file in $ac_files '' do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; [ab].out ) # We found the default executable, but exeext='' is most # certainly right. break;; *.* ) if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; then :; else ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` fi # We set ac_cv_exeext here because the later test for it is not # safe: cross compilers may not add the suffix if given an `-o' # argument, so we may need to know it at that point already. # Even if this section looks crufty: it has the advantage of # actually working. break;; * ) break;; esac done test "$ac_cv_exeext" = no && ac_cv_exeext= else ac_file='' fi if test -z "$ac_file"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error 77 "C compiler cannot create executables See \`config.log' for more details" "$LINENO" 5; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 $as_echo_n "checking for C compiler default output file name... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 $as_echo "$ac_file" >&6; } ac_exeext=$ac_cv_exeext rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 $as_echo_n "checking for suffix of executables... " >&6; } if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # If both `conftest.exe' and `conftest' are `present' (well, observable) # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. for ac_file in conftest.exe conftest conftest.*; do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` break;; * ) break;; esac done else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of executables: cannot compile and link See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest conftest$ac_cv_exeext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 $as_echo "$ac_cv_exeext" >&6; } rm -f conftest.$ac_ext EXEEXT=$ac_cv_exeext ac_exeext=$EXEEXT cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { FILE *f = fopen ("conftest.out", "w"); return ferror (f) || fclose (f) != 0; ; return 0; } _ACEOF ac_clean_files="$ac_clean_files conftest.out" # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 $as_echo_n "checking whether we are cross compiling... " >&6; } if test "$cross_compiling" != yes; then { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if { ac_try='./conftest$ac_cv_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then cross_compiling=no else if test "$cross_compiling" = maybe; then cross_compiling=yes else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details" "$LINENO" 5; } fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 $as_echo "$cross_compiling" >&6; } rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 $as_echo_n "checking for suffix of object files... " >&6; } if ${ac_cv_objext+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.o conftest.obj if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : for ac_file in conftest.o conftest.obj conftest.*; do test -f "$ac_file" || continue; case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of object files: cannot compile See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest.$ac_cv_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 $as_echo "$ac_cv_objext" >&6; } OBJEXT=$ac_cv_objext ac_objext=$OBJEXT { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if ${ac_cv_c_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if ${ac_cv_prog_cc_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes else CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if ${ac_cv_prog_cc_c89+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include struct stat; /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac if test "x$ac_cv_prog_cc_c89" != xno; then : fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC understands -c and -o together" >&5 $as_echo_n "checking whether $CC understands -c and -o together... " >&6; } if ${am_cv_prog_cc_c_o+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF # Make sure it works both with $CC and with simple cc. # Following AC_PROG_CC_C_O, we do the test twice because some # compilers refuse to overwrite an existing .o file with -o, # though they will create one. am_cv_prog_cc_c_o=yes for am_i in 1 2; do if { echo "$as_me:$LINENO: $CC -c conftest.$ac_ext -o conftest2.$ac_objext" >&5 ($CC -c conftest.$ac_ext -o conftest2.$ac_objext) >&5 2>&5 ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } \ && test -f conftest2.$ac_objext; then : OK else am_cv_prog_cc_c_o=no break fi done rm -f core conftest* unset am_i fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_cc_c_o" >&5 $as_echo "$am_cv_prog_cc_c_o" >&6; } if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. # FIXME: It is wrong to rewrite CC. # But if we don't then we get into trouble of one sort or another. # A longer-term fix would be to have automake use am__CC in this case, # and then we could set am__CC="\$(top_srcdir)/compile \$(CC)" CC="$am_aux_dir/compile $CC" fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu depcc="$CC" am_compiler_list= { $as_echo "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5 $as_echo_n "checking dependency style of $depcc... " >&6; } if ${am_cv_CC_dependencies_compiler_type+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_CC_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n 's/^#*\([a-zA-Z0-9]*\))$/\1/p' < ./depcomp` fi am__universal=false case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_CC_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_CC_dependencies_compiler_type=none fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_CC_dependencies_compiler_type" >&5 $as_echo "$am_cv_CC_dependencies_compiler_type" >&6; } CCDEPMODE=depmode=$am_cv_CC_dependencies_compiler_type if test "x$enable_dependency_tracking" != xno \ && test "$am_cv_CC_dependencies_compiler_type" = gcc3; then am__fastdepCC_TRUE= am__fastdepCC_FALSE='#' else am__fastdepCC_TRUE='#' am__fastdepCC_FALSE= fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C99" >&5 $as_echo_n "checking for $CC option to accept ISO C99... " >&6; } if ${ac_cv_prog_cc_c99+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c99=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include #include // Check varargs macros. These examples are taken from C99 6.10.3.5. #define debug(...) fprintf (stderr, __VA_ARGS__) #define showlist(...) puts (#__VA_ARGS__) #define report(test,...) ((test) ? puts (#test) : printf (__VA_ARGS__)) static void test_varargs_macros (void) { int x = 1234; int y = 5678; debug ("Flag"); debug ("X = %d\n", x); showlist (The first, second, and third items.); report (x>y, "x is %d but y is %d", x, y); } // Check long long types. #define BIG64 18446744073709551615ull #define BIG32 4294967295ul #define BIG_OK (BIG64 / BIG32 == 4294967297ull && BIG64 % BIG32 == 0) #if !BIG_OK your preprocessor is broken; #endif #if BIG_OK #else your preprocessor is broken; #endif static long long int bignum = -9223372036854775807LL; static unsigned long long int ubignum = BIG64; struct incomplete_array { int datasize; double data[]; }; struct named_init { int number; const wchar_t *name; double average; }; typedef const char *ccp; static inline int test_restrict (ccp restrict text) { // See if C++-style comments work. // Iterate through items via the restricted pointer. // Also check for declarations in for loops. for (unsigned int i = 0; *(text+i) != '\0'; ++i) continue; return 0; } // Check varargs and va_copy. static void test_varargs (const char *format, ...) { va_list args; va_start (args, format); va_list args_copy; va_copy (args_copy, args); const char *str; int number; float fnumber; while (*format) { switch (*format++) { case 's': // string str = va_arg (args_copy, const char *); break; case 'd': // int number = va_arg (args_copy, int); break; case 'f': // float fnumber = va_arg (args_copy, double); break; default: break; } } va_end (args_copy); va_end (args); } int main () { // Check bool. _Bool success = false; // Check restrict. if (test_restrict ("String literal") == 0) success = true; char *restrict newvar = "Another string"; // Check varargs. test_varargs ("s, d' f .", "string", 65, 34.234); test_varargs_macros (); // Check flexible array members. struct incomplete_array *ia = malloc (sizeof (struct incomplete_array) + (sizeof (double) * 10)); ia->datasize = 10; for (int i = 0; i < ia->datasize; ++i) ia->data[i] = i * 1.234; // Check named initializers. struct named_init ni = { .number = 34, .name = L"Test wide string", .average = 543.34343, }; ni.number = 58; int dynamic_array[ni.number]; dynamic_array[ni.number - 1] = 543; // work around unused variable warnings return (!success || bignum == 0LL || ubignum == 0uLL || newvar[0] == 'x' || dynamic_array[ni.number - 1] != 543); ; return 0; } _ACEOF for ac_arg in '' -std=gnu99 -std=c99 -c99 -AC99 -xc99=all -qlanglvl=extc99 do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c99=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c99" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c99" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c99" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5 $as_echo "$ac_cv_prog_cc_c99" >&6; } ;; esac if test "x$ac_cv_prog_cc_c99" != xno; then : fi case `pwd` in *\ * | *\ *) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5 $as_echo "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;; esac macro_version='2.4.6' macro_revision='2.4.6' ltmain=$ac_aux_dir/ltmain.sh # Make sure we can run config.sub. $SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 || as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5 $as_echo_n "checking build system type... " >&6; } if ${ac_cv_build+:} false; then : $as_echo_n "(cached) " >&6 else ac_build_alias=$build_alias test "x$ac_build_alias" = x && ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"` test "x$ac_build_alias" = x && as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5 ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` || as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5 $as_echo "$ac_cv_build" >&6; } case $ac_cv_build in *-*-*) ;; *) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;; esac build=$ac_cv_build ac_save_IFS=$IFS; IFS='-' set x $ac_cv_build shift build_cpu=$1 build_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: build_os=$* IFS=$ac_save_IFS case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5 $as_echo_n "checking host system type... " >&6; } if ${ac_cv_host+:} false; then : $as_echo_n "(cached) " >&6 else if test "x$host_alias" = x; then ac_cv_host=$ac_cv_build else ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` || as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5 fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5 $as_echo "$ac_cv_host" >&6; } case $ac_cv_host in *-*-*) ;; *) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;; esac host=$ac_cv_host ac_save_IFS=$IFS; IFS='-' set x $ac_cv_host shift host_cpu=$1 host_vendor=$2 shift; shift # Remember, the first character of IFS is used to create $*, # except with old shells: host_os=$* IFS=$ac_save_IFS case $host_os in *\ *) host_os=`echo "$host_os" | sed 's/ /-/g'`;; esac # Backslashify metacharacters that are still active within # double-quoted strings. sed_quote_subst='s/\(["`$\\]\)/\\\1/g' # Same as above, but do not quote variable references. double_quote_subst='s/\(["`\\]\)/\\\1/g' # Sed substitution to delay expansion of an escaped shell variable in a # double_quote_subst'ed string. delay_variable_subst='s/\\\\\\\\\\\$/\\\\\\$/g' # Sed substitution to delay expansion of an escaped single quote. delay_single_quote_subst='s/'\''/'\'\\\\\\\'\''/g' # Sed substitution to avoid accidental globbing in evaled expressions no_glob_subst='s/\*/\\\*/g' ECHO='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5 $as_echo_n "checking how to print strings... " >&6; } # Test print first, because it will be a builtin if present. if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \ test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='print -r --' elif test "X`printf %s $ECHO 2>/dev/null`" = "X$ECHO"; then ECHO='printf %s\n' else # Use this function as a fallback that always works. func_fallback_echo () { eval 'cat <<_LTECHO_EOF $1 _LTECHO_EOF' } ECHO='func_fallback_echo' fi # func_echo_all arg... # Invoke $ECHO with all args, space-separated. func_echo_all () { $ECHO "" } case $ECHO in printf*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: printf" >&5 $as_echo "printf" >&6; } ;; print*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: print -r" >&5 $as_echo "print -r" >&6; } ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: cat" >&5 $as_echo "cat" >&6; } ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5 $as_echo_n "checking for a sed that does not truncate output... " >&6; } if ${ac_cv_path_SED+:} false; then : $as_echo_n "(cached) " >&6 else ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/ for ac_i in 1 2 3 4 5 6 7; do ac_script="$ac_script$as_nl$ac_script" done echo "$ac_script" 2>/dev/null | sed 99q >conftest.sed { ac_script=; unset ac_script;} if test -z "$SED"; then ac_path_SED_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in sed gsed; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_SED="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_SED" || continue # Check for GNU ac_path_SED and select it if it is found. # Check for GNU $ac_path_SED case `"$ac_path_SED" --version 2>&1` in *GNU*) ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo '' >> "conftest.nl" "$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_SED_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_SED="$ac_path_SED" ac_path_SED_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_SED_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_SED"; then as_fn_error $? "no acceptable sed could be found in \$PATH" "$LINENO" 5 fi else ac_cv_path_SED=$SED fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5 $as_echo "$ac_cv_path_SED" >&6; } SED="$ac_cv_path_SED" rm -f conftest.sed test -z "$SED" && SED=sed Xsed="$SED -e 1s/^X//" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 $as_echo_n "checking for grep that handles long lines and -e... " >&6; } if ${ac_cv_path_GREP+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$GREP"; then ac_path_GREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in grep ggrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_GREP" || continue # Check for GNU ac_path_GREP and select it if it is found. # Check for GNU $ac_path_GREP case `"$ac_path_GREP" --version 2>&1` in *GNU*) ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'GREP' >> "conftest.nl" "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_GREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_GREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_GREP"; then as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_GREP=$GREP fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 $as_echo "$ac_cv_path_GREP" >&6; } GREP="$ac_cv_path_GREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 $as_echo_n "checking for egrep... " >&6; } if ${ac_cv_path_EGREP+:} false; then : $as_echo_n "(cached) " >&6 else if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 then ac_cv_path_EGREP="$GREP -E" else if test -z "$EGREP"; then ac_path_EGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in egrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_EGREP" || continue # Check for GNU ac_path_EGREP and select it if it is found. # Check for GNU $ac_path_EGREP case `"$ac_path_EGREP" --version 2>&1` in *GNU*) ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'EGREP' >> "conftest.nl" "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_EGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_EGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_EGREP"; then as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_EGREP=$EGREP fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 $as_echo "$ac_cv_path_EGREP" >&6; } EGREP="$ac_cv_path_EGREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5 $as_echo_n "checking for fgrep... " >&6; } if ${ac_cv_path_FGREP+:} false; then : $as_echo_n "(cached) " >&6 else if echo 'ab*c' | $GREP -F 'ab*c' >/dev/null 2>&1 then ac_cv_path_FGREP="$GREP -F" else if test -z "$FGREP"; then ac_path_FGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in fgrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_FGREP="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_FGREP" || continue # Check for GNU ac_path_FGREP and select it if it is found. # Check for GNU $ac_path_FGREP case `"$ac_path_FGREP" --version 2>&1` in *GNU*) ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'FGREP' >> "conftest.nl" "$ac_path_FGREP" FGREP < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_FGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_FGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_FGREP"; then as_fn_error $? "no acceptable fgrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_FGREP=$FGREP fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5 $as_echo "$ac_cv_path_FGREP" >&6; } FGREP="$ac_cv_path_FGREP" test -z "$GREP" && GREP=grep # Check whether --with-gnu-ld was given. if test "${with_gnu_ld+set}" = set; then : withval=$with_gnu_ld; test no = "$withval" || with_gnu_ld=yes else with_gnu_ld=no fi ac_prog=ld if test yes = "$GCC"; then # Check if gcc -print-prog-name=ld gives a path. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5 $as_echo_n "checking for ld used by $CC... " >&6; } case $host in *-*-mingw*) # gcc leaves a trailing carriage return, which upsets mingw ac_prog=`($CC -print-prog-name=ld) 2>&5 | tr -d '\015'` ;; *) ac_prog=`($CC -print-prog-name=ld) 2>&5` ;; esac case $ac_prog in # Accept absolute paths. [\\/]* | ?:[\\/]*) re_direlt='/[^/][^/]*/\.\./' # Canonicalize the pathname of ld ac_prog=`$ECHO "$ac_prog"| $SED 's%\\\\%/%g'` while $ECHO "$ac_prog" | $GREP "$re_direlt" > /dev/null 2>&1; do ac_prog=`$ECHO $ac_prog| $SED "s%$re_direlt%/%"` done test -z "$LD" && LD=$ac_prog ;; "") # If it fails, then pretend we aren't using GCC. ac_prog=ld ;; *) # If it is relative, then search for the first ld in PATH. with_gnu_ld=unknown ;; esac elif test yes = "$with_gnu_ld"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5 $as_echo_n "checking for GNU ld... " >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5 $as_echo_n "checking for non-GNU ld... " >&6; } fi if ${lt_cv_path_LD+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$LD"; then lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/$ac_prog" || test -f "$ac_dir/$ac_prog$ac_exeext"; then lt_cv_path_LD=$ac_dir/$ac_prog # Check to see if the program is GNU ld. I'd rather use --version, # but apparently some variants of GNU ld only accept -v. # Break only if it was the GNU/non-GNU ld that we prefer. case `"$lt_cv_path_LD" -v 2>&1 &5 $as_echo "$LD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5 $as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; } if ${lt_cv_prog_gnu_ld+:} false; then : $as_echo_n "(cached) " >&6 else # I'd rather use --version here, but apparently some GNU lds only accept -v. case `$LD -v 2>&1 &5 $as_echo "$lt_cv_prog_gnu_ld" >&6; } with_gnu_ld=$lt_cv_prog_gnu_ld { $as_echo "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5 $as_echo_n "checking for BSD- or MS-compatible name lister (nm)... " >&6; } if ${lt_cv_path_NM+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$NM"; then # Let the user override the test. lt_cv_path_NM=$NM else lt_nm_to_check=${ac_tool_prefix}nm if test -n "$ac_tool_prefix" && test "$build" = "$host"; then lt_nm_to_check="$lt_nm_to_check nm" fi for lt_tmp_nm in $lt_nm_to_check; do lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. tmp_nm=$ac_dir/$lt_tmp_nm if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext"; then # Check to see if the nm accepts a BSD-compat flag. # Adding the 'sed 1q' prevents false positives on HP-UX, which says: # nm: unknown option "B" ignored # Tru64's nm complains that /dev/null is an invalid object file # MSYS converts /dev/null to NUL, MinGW nm treats NUL as empty case $build_os in mingw*) lt_bad_file=conftest.nm/nofile ;; *) lt_bad_file=/dev/null ;; esac case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in *$lt_bad_file* | *'Invalid file or object type'*) lt_cv_path_NM="$tmp_nm -B" break 2 ;; *) case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in */dev/null*) lt_cv_path_NM="$tmp_nm -p" break 2 ;; *) lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but continue # so that we can try to find one that supports BSD flags ;; esac ;; esac fi done IFS=$lt_save_ifs done : ${lt_cv_path_NM=no} fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5 $as_echo "$lt_cv_path_NM" >&6; } if test no != "$lt_cv_path_NM"; then NM=$lt_cv_path_NM else # Didn't find any BSD compatible name lister, look for dumpbin. if test -n "$DUMPBIN"; then : # Let the user override the test. else if test -n "$ac_tool_prefix"; then for ac_prog in dumpbin "link -dump" do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DUMPBIN+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DUMPBIN"; then ac_cv_prog_DUMPBIN="$DUMPBIN" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DUMPBIN="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DUMPBIN=$ac_cv_prog_DUMPBIN if test -n "$DUMPBIN"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5 $as_echo "$DUMPBIN" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$DUMPBIN" && break done fi if test -z "$DUMPBIN"; then ac_ct_DUMPBIN=$DUMPBIN for ac_prog in dumpbin "link -dump" do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DUMPBIN+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DUMPBIN"; then ac_cv_prog_ac_ct_DUMPBIN="$ac_ct_DUMPBIN" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DUMPBIN="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DUMPBIN=$ac_cv_prog_ac_ct_DUMPBIN if test -n "$ac_ct_DUMPBIN"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5 $as_echo "$ac_ct_DUMPBIN" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_DUMPBIN" && break done if test "x$ac_ct_DUMPBIN" = x; then DUMPBIN=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DUMPBIN=$ac_ct_DUMPBIN fi fi case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in *COFF*) DUMPBIN="$DUMPBIN -symbols -headers" ;; *) DUMPBIN=: ;; esac fi if test : != "$DUMPBIN"; then NM=$DUMPBIN fi fi test -z "$NM" && NM=nm { $as_echo "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5 $as_echo_n "checking the name lister ($NM) interface... " >&6; } if ${lt_cv_nm_interface+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_nm_interface="BSD nm" echo "int some_variable = 0;" > conftest.$ac_ext (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&5) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&5 (eval echo "\"\$as_me:$LINENO: $NM \\\"conftest.$ac_objext\\\"\"" >&5) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&5 (eval echo "\"\$as_me:$LINENO: output\"" >&5) cat conftest.out >&5 if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5 $as_echo "$lt_cv_nm_interface" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5 $as_echo_n "checking whether ln -s works... " >&6; } LN_S=$as_ln_s if test "$LN_S" = "ln -s"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5 $as_echo "no, using $LN_S" >&6; } fi # find the maximum length of command line arguments { $as_echo "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5 $as_echo_n "checking the maximum length of command line arguments... " >&6; } if ${lt_cv_sys_max_cmd_len+:} false; then : $as_echo_n "(cached) " >&6 else i=0 teststring=ABCD case $build_os in msdosdjgpp*) # On DJGPP, this test can blow up pretty badly due to problems in libc # (any single argument exceeding 2000 bytes causes a buffer overrun # during glob expansion). Even if it were fixed, the result of this # check would be larger than it should be. lt_cv_sys_max_cmd_len=12288; # 12K is about right ;; gnu*) # Under GNU Hurd, this test is not required because there is # no limit to the length of command line arguments. # Libtool will interpret -1 as no limit whatsoever lt_cv_sys_max_cmd_len=-1; ;; cygwin* | mingw* | cegcc*) # On Win9x/ME, this test blows up -- it succeeds, but takes # about 5 minutes as the teststring grows exponentially. # Worse, since 9x/ME are not pre-emptively multitasking, # you end up with a "frozen" computer, even though with patience # the test eventually succeeds (with a max line length of 256k). # Instead, let's just punt: use the minimum linelength reported by # all of the supported platforms: 8192 (on NT/2K/XP). lt_cv_sys_max_cmd_len=8192; ;; mint*) # On MiNT this can take a long time and run out of memory. lt_cv_sys_max_cmd_len=8192; ;; amigaos*) # On AmigaOS with pdksh, this test takes hours, literally. # So we just punt and use a minimum line length of 8192. lt_cv_sys_max_cmd_len=8192; ;; bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*) # This has been around since 386BSD, at least. Likely further. if test -x /sbin/sysctl; then lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax` elif test -x /usr/sbin/sysctl; then lt_cv_sys_max_cmd_len=`/usr/sbin/sysctl -n kern.argmax` else lt_cv_sys_max_cmd_len=65536 # usable default for all BSDs fi # And add a safety zone lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` ;; interix*) # We know the value 262144 and hardcode it with a safety zone (like BSD) lt_cv_sys_max_cmd_len=196608 ;; os2*) # The test takes a long time on OS/2. lt_cv_sys_max_cmd_len=8192 ;; osf*) # Dr. Hans Ekkehard Plesser reports seeing a kernel panic running configure # due to this test when exec_disable_arg_limit is 1 on Tru64. It is not # nice to cause kernel panics so lets avoid the loop below. # First set a reasonable default. lt_cv_sys_max_cmd_len=16384 # if test -x /sbin/sysconfig; then case `/sbin/sysconfig -q proc exec_disable_arg_limit` in *1*) lt_cv_sys_max_cmd_len=-1 ;; esac fi ;; sco3.2v5*) lt_cv_sys_max_cmd_len=102400 ;; sysv5* | sco5v6* | sysv4.2uw2*) kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null` if test -n "$kargmax"; then lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[ ]//'` else lt_cv_sys_max_cmd_len=32768 fi ;; *) lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null` if test -n "$lt_cv_sys_max_cmd_len" && \ test undefined != "$lt_cv_sys_max_cmd_len"; then lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4` lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3` else # Make teststring a little bigger before we do anything with it. # a 1K string should be a reasonable start. for i in 1 2 3 4 5 6 7 8; do teststring=$teststring$teststring done SHELL=${SHELL-${CONFIG_SHELL-/bin/sh}} # If test is not a shell built-in, we'll probably end up computing a # maximum length that is only half of the actual maximum length, but # we can't tell. while { test X`env echo "$teststring$teststring" 2>/dev/null` \ = "X$teststring$teststring"; } >/dev/null 2>&1 && test 17 != "$i" # 1/2 MB should be enough do i=`expr $i + 1` teststring=$teststring$teststring done # Only check the string length outside the loop. lt_cv_sys_max_cmd_len=`expr "X$teststring" : ".*" 2>&1` teststring= # Add a significant safety factor because C++ compilers can tack on # massive amounts of additional arguments before passing them to the # linker. It appears as though 1/2 is a usable value. lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 2` fi ;; esac fi if test -n "$lt_cv_sys_max_cmd_len"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5 $as_echo "$lt_cv_sys_max_cmd_len" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5 $as_echo "none" >&6; } fi max_cmd_len=$lt_cv_sys_max_cmd_len : ${CP="cp -f"} : ${MV="mv -f"} : ${RM="rm -f"} if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then lt_unset=unset else lt_unset=false fi # test EBCDIC or ASCII case `echo X|tr X '\101'` in A) # ASCII based system # \n is not interpreted correctly by Solaris 8 /usr/ucb/tr lt_SP2NL='tr \040 \012' lt_NL2SP='tr \015\012 \040\040' ;; *) # EBCDIC based system lt_SP2NL='tr \100 \n' lt_NL2SP='tr \r\n \100\100' ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5 $as_echo_n "checking how to convert $build file names to $host format... " >&6; } if ${lt_cv_to_host_file_cmd+:} false; then : $as_echo_n "(cached) " >&6 else case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_w32 ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_cygwin_to_w32 ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_w32 ;; esac ;; *-*-cygwin* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_host_file_cmd=func_convert_file_msys_to_cygwin ;; *-*-cygwin* ) lt_cv_to_host_file_cmd=func_convert_file_noop ;; * ) # otherwise, assume *nix lt_cv_to_host_file_cmd=func_convert_file_nix_to_cygwin ;; esac ;; * ) # unhandled hosts (and "normal" native builds) lt_cv_to_host_file_cmd=func_convert_file_noop ;; esac fi to_host_file_cmd=$lt_cv_to_host_file_cmd { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5 $as_echo "$lt_cv_to_host_file_cmd" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5 $as_echo_n "checking how to convert $build file names to toolchain format... " >&6; } if ${lt_cv_to_tool_file_cmd+:} false; then : $as_echo_n "(cached) " >&6 else #assume ordinary cross tools, or native build. lt_cv_to_tool_file_cmd=func_convert_file_noop case $host in *-*-mingw* ) case $build in *-*-mingw* ) # actually msys lt_cv_to_tool_file_cmd=func_convert_file_msys_to_w32 ;; esac ;; esac fi to_tool_file_cmd=$lt_cv_to_tool_file_cmd { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5 $as_echo "$lt_cv_to_tool_file_cmd" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5 $as_echo_n "checking for $LD option to reload object files... " >&6; } if ${lt_cv_ld_reload_flag+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_reload_flag='-r' fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5 $as_echo "$lt_cv_ld_reload_flag" >&6; } reload_flag=$lt_cv_ld_reload_flag case $reload_flag in "" | " "*) ;; *) reload_flag=" $reload_flag" ;; esac reload_cmds='$LD$reload_flag -o $output$reload_objs' case $host_os in cygwin* | mingw* | pw32* | cegcc*) if test yes != "$GCC"; then reload_cmds=false fi ;; darwin*) if test yes = "$GCC"; then reload_cmds='$LTCC $LTCFLAGS -nostdlib $wl-r -o $output$reload_objs' else reload_cmds='$LD$reload_flag -o $output$reload_objs' fi ;; esac if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args. set dummy ${ac_tool_prefix}objdump; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OBJDUMP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OBJDUMP"; then ac_cv_prog_OBJDUMP="$OBJDUMP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OBJDUMP="${ac_tool_prefix}objdump" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OBJDUMP=$ac_cv_prog_OBJDUMP if test -n "$OBJDUMP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5 $as_echo "$OBJDUMP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OBJDUMP"; then ac_ct_OBJDUMP=$OBJDUMP # Extract the first word of "objdump", so it can be a program name with args. set dummy objdump; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OBJDUMP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OBJDUMP"; then ac_cv_prog_ac_ct_OBJDUMP="$ac_ct_OBJDUMP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OBJDUMP="objdump" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OBJDUMP=$ac_cv_prog_ac_ct_OBJDUMP if test -n "$ac_ct_OBJDUMP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5 $as_echo "$ac_ct_OBJDUMP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OBJDUMP" = x; then OBJDUMP="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OBJDUMP=$ac_ct_OBJDUMP fi else OBJDUMP="$ac_cv_prog_OBJDUMP" fi test -z "$OBJDUMP" && OBJDUMP=objdump { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5 $as_echo_n "checking how to recognize dependent libraries... " >&6; } if ${lt_cv_deplibs_check_method+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_file_magic_cmd='$MAGIC_CMD' lt_cv_file_magic_test_file= lt_cv_deplibs_check_method='unknown' # Need to set the preceding variable on all platforms that support # interlibrary dependencies. # 'none' -- dependencies not supported. # 'unknown' -- same as none, but documents that we really don't know. # 'pass_all' -- all dependencies passed with no checks. # 'test_compile' -- check by making test program. # 'file_magic [[regex]]' -- check by looking for files in library path # that responds to the $file_magic_cmd with a given extended regex. # If you have 'file' or equivalent on your system and you're not sure # whether 'pass_all' will *always* work, you probably want this one. case $host_os in aix[4-9]*) lt_cv_deplibs_check_method=pass_all ;; beos*) lt_cv_deplibs_check_method=pass_all ;; bsdi[45]*) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object|dynamic lib)' lt_cv_file_magic_cmd='/usr/bin/file -L' lt_cv_file_magic_test_file=/shlib/libc.so ;; cygwin*) # func_win32_libid is a shell function defined in ltmain.sh lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' ;; mingw* | pw32*) # Base MSYS/MinGW do not provide the 'file' command needed by # func_win32_libid shell function, so use a weaker test based on 'objdump', # unless we find 'file', for example because we are cross-compiling. if ( file / ) >/dev/null 2>&1; then lt_cv_deplibs_check_method='file_magic ^x86 archive import|^x86 DLL' lt_cv_file_magic_cmd='func_win32_libid' else # Keep this pattern in sync with the one in func_win32_libid. lt_cv_deplibs_check_method='file_magic file format (pei*-i386(.*architecture: i386)?|pe-arm-wince|pe-x86-64)' lt_cv_file_magic_cmd='$OBJDUMP -f' fi ;; cegcc*) # use the weaker test based on 'objdump'. See mingw*. lt_cv_deplibs_check_method='file_magic file format pe-arm-.*little(.*architecture: arm)?' lt_cv_file_magic_cmd='$OBJDUMP -f' ;; darwin* | rhapsody*) lt_cv_deplibs_check_method=pass_all ;; freebsd* | dragonfly*) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then case $host_cpu in i*86 ) # Not sure whether the presence of OpenBSD here was a mistake. # Let's accept both of them until this is cleared up. lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[3-9]86 (compact )?demand paged shared library' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*` ;; esac else lt_cv_deplibs_check_method=pass_all fi ;; haiku*) lt_cv_deplibs_check_method=pass_all ;; hpux10.20* | hpux11*) lt_cv_file_magic_cmd=/usr/bin/file case $host_cpu in ia64*) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF-[0-9][0-9]) shared object file - IA64' lt_cv_file_magic_test_file=/usr/lib/hpux32/libc.so ;; hppa*64*) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|ELF[ -][0-9][0-9])(-bit)?( [LM]SB)? shared object( file)?[, -]* PA-RISC [0-9]\.[0-9]' lt_cv_file_magic_test_file=/usr/lib/pa20_64/libc.sl ;; *) lt_cv_deplibs_check_method='file_magic (s[0-9][0-9][0-9]|PA-RISC[0-9]\.[0-9]) shared library' lt_cv_file_magic_test_file=/usr/lib/libc.sl ;; esac ;; interix[3-9]*) # PIC code is broken on Interix 3.x, that's why |\.a not |_pic\.a here lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so|\.a)$' ;; irix5* | irix6* | nonstopux*) case $LD in *-32|*"-32 ") libmagic=32-bit;; *-n32|*"-n32 ") libmagic=N32;; *-64|*"-64 ") libmagic=64-bit;; *) libmagic=never-match;; esac lt_cv_deplibs_check_method=pass_all ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) lt_cv_deplibs_check_method=pass_all ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so|_pic\.a)$' fi ;; newos6*) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (executable|dynamic lib)' lt_cv_file_magic_cmd=/usr/bin/file lt_cv_file_magic_test_file=/usr/lib/libnls.so ;; *nto* | *qnx*) lt_cv_deplibs_check_method=pass_all ;; openbsd* | bitrig*) if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|\.so|_pic\.a)$' else lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$' fi ;; osf3* | osf4* | osf5*) lt_cv_deplibs_check_method=pass_all ;; rdos*) lt_cv_deplibs_check_method=pass_all ;; solaris*) lt_cv_deplibs_check_method=pass_all ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) lt_cv_deplibs_check_method=pass_all ;; sysv4 | sysv4.3*) case $host_vendor in motorola) lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [ML]SB (shared object|dynamic lib) M[0-9][0-9]* Version [0-9]' lt_cv_file_magic_test_file=`echo /usr/lib/libc.so*` ;; ncr) lt_cv_deplibs_check_method=pass_all ;; sequent) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method='file_magic ELF [0-9][0-9]*-bit [LM]SB (shared object|dynamic lib )' ;; sni) lt_cv_file_magic_cmd='/bin/file' lt_cv_deplibs_check_method="file_magic ELF [0-9][0-9]*-bit [LM]SB dynamic lib" lt_cv_file_magic_test_file=/lib/libc.so ;; siemens) lt_cv_deplibs_check_method=pass_all ;; pc) lt_cv_deplibs_check_method=pass_all ;; esac ;; tpf*) lt_cv_deplibs_check_method=pass_all ;; os2*) lt_cv_deplibs_check_method=pass_all ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5 $as_echo "$lt_cv_deplibs_check_method" >&6; } file_magic_glob= want_nocaseglob=no if test "$build" = "$host"; then case $host_os in mingw* | pw32*) if ( shopt | grep nocaseglob ) >/dev/null 2>&1; then want_nocaseglob=yes else file_magic_glob=`echo aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ | $SED -e "s/\(..\)/s\/[\1]\/[\1]\/g;/g"` fi ;; esac fi file_magic_cmd=$lt_cv_file_magic_cmd deplibs_check_method=$lt_cv_deplibs_check_method test -z "$deplibs_check_method" && deplibs_check_method=unknown if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}dlltool", so it can be a program name with args. set dummy ${ac_tool_prefix}dlltool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DLLTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DLLTOOL"; then ac_cv_prog_DLLTOOL="$DLLTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DLLTOOL="${ac_tool_prefix}dlltool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DLLTOOL=$ac_cv_prog_DLLTOOL if test -n "$DLLTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5 $as_echo "$DLLTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_DLLTOOL"; then ac_ct_DLLTOOL=$DLLTOOL # Extract the first word of "dlltool", so it can be a program name with args. set dummy dlltool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DLLTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DLLTOOL"; then ac_cv_prog_ac_ct_DLLTOOL="$ac_ct_DLLTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DLLTOOL="dlltool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DLLTOOL=$ac_cv_prog_ac_ct_DLLTOOL if test -n "$ac_ct_DLLTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5 $as_echo "$ac_ct_DLLTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_DLLTOOL" = x; then DLLTOOL="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DLLTOOL=$ac_ct_DLLTOOL fi else DLLTOOL="$ac_cv_prog_DLLTOOL" fi test -z "$DLLTOOL" && DLLTOOL=dlltool { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5 $as_echo_n "checking how to associate runtime and link libraries... " >&6; } if ${lt_cv_sharedlib_from_linklib_cmd+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_sharedlib_from_linklib_cmd='unknown' case $host_os in cygwin* | mingw* | pw32* | cegcc*) # two different shell functions defined in ltmain.sh; # decide which one to use based on capabilities of $DLLTOOL case `$DLLTOOL --help 2>&1` in *--identify-strict*) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib ;; *) lt_cv_sharedlib_from_linklib_cmd=func_cygming_dll_for_implib_fallback ;; esac ;; *) # fallback: assume linklib IS sharedlib lt_cv_sharedlib_from_linklib_cmd=$ECHO ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5 $as_echo "$lt_cv_sharedlib_from_linklib_cmd" >&6; } sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO if test -n "$ac_tool_prefix"; then for ac_prog in ar do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AR+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AR"; then ac_cv_prog_AR="$AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_AR="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AR=$ac_cv_prog_AR if test -n "$AR"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5 $as_echo "$AR" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AR" && break done fi if test -z "$AR"; then ac_ct_AR=$AR for ac_prog in ar do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_AR+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_AR"; then ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_AR="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_AR=$ac_cv_prog_ac_ct_AR if test -n "$ac_ct_AR"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5 $as_echo "$ac_ct_AR" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_AR" && break done if test "x$ac_ct_AR" = x; then AR="false" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac AR=$ac_ct_AR fi fi : ${AR=ar} : ${AR_FLAGS=cru} { $as_echo "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5 $as_echo_n "checking for archiver @FILE support... " >&6; } if ${lt_cv_ar_at_file+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ar_at_file=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : echo conftest.$ac_objext > conftest.lst lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&5' { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5 (eval $lt_ar_try) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if test 0 -eq "$ac_status"; then # Ensure the archiver fails upon bogus file names. rm -f conftest.$ac_objext libconftest.a { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5 (eval $lt_ar_try) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if test 0 -ne "$ac_status"; then lt_cv_ar_at_file=@ fi fi rm -f conftest.* libconftest.a fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5 $as_echo "$lt_cv_ar_at_file" >&6; } if test no = "$lt_cv_ar_at_file"; then archiver_list_spec= else archiver_list_spec=$lt_cv_ar_at_file fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args. set dummy ${ac_tool_prefix}strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$STRIP"; then ac_cv_prog_STRIP="$STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_STRIP="${ac_tool_prefix}strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi STRIP=$ac_cv_prog_STRIP if test -n "$STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5 $as_echo "$STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_STRIP"; then ac_ct_STRIP=$STRIP # Extract the first word of "strip", so it can be a program name with args. set dummy strip; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_STRIP+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_STRIP"; then ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_STRIP="strip" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP if test -n "$ac_ct_STRIP"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5 $as_echo "$ac_ct_STRIP" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_STRIP" = x; then STRIP=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac STRIP=$ac_ct_STRIP fi else STRIP="$ac_cv_prog_STRIP" fi test -z "$STRIP" && STRIP=: if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args. set dummy ${ac_tool_prefix}ranlib; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_RANLIB+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$RANLIB"; then ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi RANLIB=$ac_cv_prog_RANLIB if test -n "$RANLIB"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5 $as_echo "$RANLIB" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_RANLIB"; then ac_ct_RANLIB=$RANLIB # Extract the first word of "ranlib", so it can be a program name with args. set dummy ranlib; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_RANLIB+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_RANLIB"; then ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_RANLIB="ranlib" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB if test -n "$ac_ct_RANLIB"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5 $as_echo "$ac_ct_RANLIB" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_RANLIB" = x; then RANLIB=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac RANLIB=$ac_ct_RANLIB fi else RANLIB="$ac_cv_prog_RANLIB" fi test -z "$RANLIB" && RANLIB=: # Determine commands to create old-style static archives. old_archive_cmds='$AR $AR_FLAGS $oldlib$oldobjs' old_postinstall_cmds='chmod 644 $oldlib' old_postuninstall_cmds= if test -n "$RANLIB"; then case $host_os in bitrig* | openbsd*) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB -t \$tool_oldlib" ;; *) old_postinstall_cmds="$old_postinstall_cmds~\$RANLIB \$tool_oldlib" ;; esac old_archive_cmds="$old_archive_cmds~\$RANLIB \$tool_oldlib" fi case $host_os in darwin*) lock_old_archive_extraction=yes ;; *) lock_old_archive_extraction=no ;; esac # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC # Check for command to grab the raw symbol name followed by C symbol from nm. { $as_echo "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5 $as_echo_n "checking command to parse $NM output from $compiler object... " >&6; } if ${lt_cv_sys_global_symbol_pipe+:} false; then : $as_echo_n "(cached) " >&6 else # These are sane defaults that work on at least a few old systems. # [They come from Ultrix. What could be older than Ultrix?!! ;)] # Character class describing NM global symbol codes. symcode='[BCDEGRST]' # Regexp to match symbols that can be accessed directly from C. sympat='\([_A-Za-z][_A-Za-z0-9]*\)' # Define system-specific variables. case $host_os in aix*) symcode='[BCDT]' ;; cygwin* | mingw* | pw32* | cegcc*) symcode='[ABCDGISTW]' ;; hpux*) if test ia64 = "$host_cpu"; then symcode='[ABCDEGRST]' fi ;; irix* | nonstopux*) symcode='[BCDEGRST]' ;; osf*) symcode='[BCDEGQRST]' ;; solaris*) symcode='[BDRT]' ;; sco3.2v5*) symcode='[DT]' ;; sysv4.2uw2*) symcode='[DT]' ;; sysv5* | sco5v6* | unixware* | OpenUNIX*) symcode='[ABDT]' ;; sysv4) symcode='[DFNSTU]' ;; esac # If we're using GNU nm, then use its standard symbol codes. case `$NM -V 2>&1` in *GNU* | *'with BFD'*) symcode='[ABCDGIRSTW]' ;; esac if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Gets list of data symbols to import. lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'" # Adjust the below global symbol transforms to fixup imported variables. lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'" lt_c_name_hook=" -e 's/^I .* \(.*\)$/ {\"\1\", (void *) 0},/p'" lt_c_name_lib_hook="\ -e 's/^I .* \(lib.*\)$/ {\"\1\", (void *) 0},/p'\ -e 's/^I .* \(.*\)$/ {\"lib\1\", (void *) 0},/p'" else # Disable hooks by default. lt_cv_sys_global_symbol_to_import= lt_cdecl_hook= lt_c_name_hook= lt_c_name_lib_hook= fi # Transform an extracted symbol line into a proper C declaration. # Some systems (esp. on ia64) link data and code symbols differently, # so use this general approach. lt_cv_sys_global_symbol_to_cdecl="sed -n"\ $lt_cdecl_hook\ " -e 's/^T .* \(.*\)$/extern int \1();/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'" # Transform an extracted symbol line into symbol name and symbol address lt_cv_sys_global_symbol_to_c_name_address="sed -n"\ $lt_c_name_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/p'" # Transform an extracted symbol line into symbol name with lib prefix and # symbol address. lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\ $lt_c_name_lib_hook\ " -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\ " -e 's/^$symcode$symcode* .* \(lib.*\)$/ {\"\1\", (void *) \&\1},/p'"\ " -e 's/^$symcode$symcode* .* \(.*\)$/ {\"lib\1\", (void *) \&\1},/p'" # Handle CRLF in mingw tool chain opt_cr= case $build_os in mingw*) opt_cr=`$ECHO 'x\{0,1\}' | tr x '\015'` # option cr in regexp ;; esac # Try without a prefix underscore, then with it. for ac_symprfx in "" "_"; do # Transform symcode, sympat, and symprfx into a raw symbol and a C symbol. symxfrm="\\1 $ac_symprfx\\2 \\2" # Write the raw and C identifiers. if test "$lt_cv_nm_interface" = "MS dumpbin"; then # Fake it for dumpbin and say T for any non-static function, # D for any global variable and I for any imported variable. # Also find C++ and __fastcall symbols from MSVC++, # which start with @ or ?. lt_cv_sys_global_symbol_pipe="$AWK '"\ " {last_section=section; section=\$ 3};"\ " /^COFF SYMBOL TABLE/{for(i in hide) delete hide[i]};"\ " /Section length .*#relocs.*(pick any)/{hide[last_section]=1};"\ " /^ *Symbol name *: /{split(\$ 0,sn,\":\"); si=substr(sn[2],2)};"\ " /^ *Type *: code/{print \"T\",si,substr(si,length(prfx))};"\ " /^ *Type *: data/{print \"I\",si,substr(si,length(prfx))};"\ " \$ 0!~/External *\|/{next};"\ " / 0+ UNDEF /{next}; / UNDEF \([^|]\)*()/{next};"\ " {if(hide[section]) next};"\ " {f=\"D\"}; \$ 0~/\(\).*\|/{f=\"T\"};"\ " {split(\$ 0,a,/\||\r/); split(a[2],s)};"\ " s[1]~/^[@?]/{print f,s[1],s[1]; next};"\ " s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\ " ' prfx=^$ac_symprfx" else lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[ ]\($symcode$symcode*\)[ ][ ]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'" fi lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'" # Check to see that the pipe works correctly. pipe_works=no rm -f conftest* cat > conftest.$ac_ext <<_LT_EOF #ifdef __cplusplus extern "C" { #endif char nm_test_var; void nm_test_func(void); void nm_test_func(void){} #ifdef __cplusplus } #endif int main(){nm_test_var='a';nm_test_func();return(0);} _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then # Now try to grab the symbols. nlist=conftest.nm if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5 (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "$nlist"; then # Try sorting and uniquifying the output. if sort "$nlist" | uniq > "$nlist"T; then mv -f "$nlist"T "$nlist" else rm -f "$nlist"T fi # Make sure that we snagged all the symbols we need. if $GREP ' nm_test_var$' "$nlist" >/dev/null; then if $GREP ' nm_test_func$' "$nlist" >/dev/null; then cat <<_LT_EOF > conftest.$ac_ext /* Keep this code in sync between libtool.m4, ltmain, lt_system.h, and tests. */ #if defined _WIN32 || defined __CYGWIN__ || defined _WIN32_WCE /* DATA imports from DLLs on WIN32 can't be const, because runtime relocations are performed -- see ld's documentation on pseudo-relocs. */ # define LT_DLSYM_CONST #elif defined __osf__ /* This system does not cope well with relocations in const data. */ # define LT_DLSYM_CONST #else # define LT_DLSYM_CONST const #endif #ifdef __cplusplus extern "C" { #endif _LT_EOF # Now generate the symbol file. eval "$lt_cv_sys_global_symbol_to_cdecl"' < "$nlist" | $GREP -v main >> conftest.$ac_ext' cat <<_LT_EOF >> conftest.$ac_ext /* The mapping between symbol names and symbols. */ LT_DLSYM_CONST struct { const char *name; void *address; } lt__PROGRAM__LTX_preloaded_symbols[] = { { "@PROGRAM@", (void *) 0 }, _LT_EOF $SED "s/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/" < "$nlist" | $GREP -v main >> conftest.$ac_ext cat <<\_LT_EOF >> conftest.$ac_ext {0, (void *) 0} }; /* This works around a problem in FreeBSD linker */ #ifdef FREEBSD_WORKAROUND static const void *lt_preloaded_setup() { return lt__PROGRAM__LTX_preloaded_symbols; } #endif #ifdef __cplusplus } #endif _LT_EOF # Now try linking the two files. mv conftest.$ac_objext conftstm.$ac_objext lt_globsym_save_LIBS=$LIBS lt_globsym_save_CFLAGS=$CFLAGS LIBS=conftstm.$ac_objext CFLAGS="$CFLAGS$lt_prog_compiler_no_builtin_flag" if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s conftest$ac_exeext; then pipe_works=yes fi LIBS=$lt_globsym_save_LIBS CFLAGS=$lt_globsym_save_CFLAGS else echo "cannot find nm_test_func in $nlist" >&5 fi else echo "cannot find nm_test_var in $nlist" >&5 fi else echo "cannot run $lt_cv_sys_global_symbol_pipe" >&5 fi else echo "$progname: failed program was:" >&5 cat conftest.$ac_ext >&5 fi rm -rf conftest* conftst* # Do not use the global_symbol_pipe unless it works. if test yes = "$pipe_works"; then break else lt_cv_sys_global_symbol_pipe= fi done fi if test -z "$lt_cv_sys_global_symbol_pipe"; then lt_cv_sys_global_symbol_to_cdecl= fi if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5 $as_echo "failed" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5 $as_echo "ok" >&6; } fi # Response file support. if test "$lt_cv_nm_interface" = "MS dumpbin"; then nm_file_list_spec='@' elif $NM --help 2>/dev/null | grep '[@]FILE' >/dev/null; then nm_file_list_spec='@' fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5 $as_echo_n "checking for sysroot... " >&6; } # Check whether --with-sysroot was given. if test "${with_sysroot+set}" = set; then : withval=$with_sysroot; else with_sysroot=no fi lt_sysroot= case $with_sysroot in #( yes) if test yes = "$GCC"; then lt_sysroot=`$CC --print-sysroot 2>/dev/null` fi ;; #( /*) lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"` ;; #( no|'') ;; #( *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5 $as_echo "$with_sysroot" >&6; } as_fn_error $? "The sysroot must be an absolute path." "$LINENO" 5 ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5 $as_echo "${lt_sysroot:-no}" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5 $as_echo_n "checking for a working dd... " >&6; } if ${ac_cv_path_lt_DD+:} false; then : $as_echo_n "(cached) " >&6 else printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i : ${lt_DD:=$DD} if test -z "$lt_DD"; then ac_path_lt_DD_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in dd; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_lt_DD="$as_dir/$ac_prog$ac_exec_ext" as_fn_executable_p "$ac_path_lt_DD" || continue if "$ac_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && ac_cv_path_lt_DD="$ac_path_lt_DD" ac_path_lt_DD_found=: fi $ac_path_lt_DD_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_lt_DD"; then : fi else ac_cv_path_lt_DD=$lt_DD fi rm -f conftest.i conftest2.i conftest.out fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5 $as_echo "$ac_cv_path_lt_DD" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5 $as_echo_n "checking how to truncate binary pipes... " >&6; } if ${lt_cv_truncate_bin+:} false; then : $as_echo_n "(cached) " >&6 else printf 0123456789abcdef0123456789abcdef >conftest.i cat conftest.i conftest.i >conftest2.i lt_cv_truncate_bin= if "$ac_cv_path_lt_DD" bs=32 count=1 conftest.out 2>/dev/null; then cmp -s conftest.i conftest.out \ && lt_cv_truncate_bin="$ac_cv_path_lt_DD bs=4096 count=1" fi rm -f conftest.i conftest2.i conftest.out test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q" fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5 $as_echo "$lt_cv_truncate_bin" >&6; } # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in $*""; do case $cc_temp in compile | *[\\/]compile | ccache | *[\\/]ccache ) ;; distcc | *[\\/]distcc | purify | *[\\/]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } # Check whether --enable-libtool-lock was given. if test "${enable_libtool_lock+set}" = set; then : enableval=$enable_libtool_lock; fi test no = "$enable_libtool_lock" || enable_libtool_lock=yes # Some flags need to be propagated to the compiler or linker for good # libtool support. case $host in ia64-*-hpux*) # Find out what ABI is being produced by ac_compile, and set mode # options accordingly. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.$ac_objext` in *ELF-32*) HPUX_IA64_MODE=32 ;; *ELF-64*) HPUX_IA64_MODE=64 ;; esac fi rm -rf conftest* ;; *-*-irix6*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '#line '$LINENO' "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then if test yes = "$lt_cv_prog_gnu_ld"; then case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -melf32bsmip" ;; *N32*) LD="${LD-ld} -melf32bmipn32" ;; *64-bit*) LD="${LD-ld} -melf64bmip" ;; esac else case `/usr/bin/file conftest.$ac_objext` in *32-bit*) LD="${LD-ld} -32" ;; *N32*) LD="${LD-ld} -n32" ;; *64-bit*) LD="${LD-ld} -64" ;; esac fi fi rm -rf conftest* ;; mips64*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo '#line '$LINENO' "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then emul=elf case `/usr/bin/file conftest.$ac_objext` in *32-bit*) emul="${emul}32" ;; *64-bit*) emul="${emul}64" ;; esac case `/usr/bin/file conftest.$ac_objext` in *MSB*) emul="${emul}btsmip" ;; *LSB*) emul="${emul}ltsmip" ;; esac case `/usr/bin/file conftest.$ac_objext` in *N32*) emul="${emul}n32" ;; esac LD="${LD-ld} -m $emul" fi rm -rf conftest* ;; x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \ s390*-*linux*|s390*-*tpf*|sparc*-*linux*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. Note that the listed cases only cover the # situations where additional linker options are needed (such as when # doing 32-bit compilation for a host where ld defaults to 64-bit, or # vice versa); the common cases where no linker options are needed do # not appear in the list. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.o` in *32-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_i386_fbsd" ;; x86_64-*linux*) case `/usr/bin/file conftest.o` in *x86-64*) LD="${LD-ld} -m elf32_x86_64" ;; *) LD="${LD-ld} -m elf_i386" ;; esac ;; powerpc64le-*linux*) LD="${LD-ld} -m elf32lppclinux" ;; powerpc64-*linux*) LD="${LD-ld} -m elf32ppclinux" ;; s390x-*linux*) LD="${LD-ld} -m elf_s390" ;; sparc64-*linux*) LD="${LD-ld} -m elf32_sparc" ;; esac ;; *64-bit*) case $host in x86_64-*kfreebsd*-gnu) LD="${LD-ld} -m elf_x86_64_fbsd" ;; x86_64-*linux*) LD="${LD-ld} -m elf_x86_64" ;; powerpcle-*linux*) LD="${LD-ld} -m elf64lppc" ;; powerpc-*linux*) LD="${LD-ld} -m elf64ppc" ;; s390*-*linux*|s390*-*tpf*) LD="${LD-ld} -m elf64_s390" ;; sparc*-*linux*) LD="${LD-ld} -m elf64_sparc" ;; esac ;; esac fi rm -rf conftest* ;; *-*-sco3.2v5*) # On SCO OpenServer 5, we need -belf to get full-featured binaries. SAVE_CFLAGS=$CFLAGS CFLAGS="$CFLAGS -belf" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5 $as_echo_n "checking whether the C compiler needs -belf... " >&6; } if ${lt_cv_cc_needs_belf+:} false; then : $as_echo_n "(cached) " >&6 else ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_cc_needs_belf=yes else lt_cv_cc_needs_belf=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5 $as_echo "$lt_cv_cc_needs_belf" >&6; } if test yes != "$lt_cv_cc_needs_belf"; then # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf CFLAGS=$SAVE_CFLAGS fi ;; *-*solaris*) # Find out what ABI is being produced by ac_compile, and set linker # options accordingly. echo 'int i;' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then case `/usr/bin/file conftest.o` in *64-bit*) case $lt_cv_prog_gnu_ld in yes*) case $host in i?86-*-solaris*|x86_64-*-solaris*) LD="${LD-ld} -m elf_x86_64" ;; sparc*-*-solaris*) LD="${LD-ld} -m elf64_sparc" ;; esac # GNU ld 2.21 introduced _sol2 emulations. Use them if available. if ${LD-ld} -V | grep _sol2 >/dev/null 2>&1; then LD=${LD-ld}_sol2 fi ;; *) if ${LD-ld} -64 -r -o conftest2.o conftest.o >/dev/null 2>&1; then LD="${LD-ld} -64" fi ;; esac ;; esac fi rm -rf conftest* ;; esac need_locks=$enable_libtool_lock if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}mt", so it can be a program name with args. set dummy ${ac_tool_prefix}mt; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_MANIFEST_TOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$MANIFEST_TOOL"; then ac_cv_prog_MANIFEST_TOOL="$MANIFEST_TOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_MANIFEST_TOOL="${ac_tool_prefix}mt" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi MANIFEST_TOOL=$ac_cv_prog_MANIFEST_TOOL if test -n "$MANIFEST_TOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5 $as_echo "$MANIFEST_TOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_MANIFEST_TOOL"; then ac_ct_MANIFEST_TOOL=$MANIFEST_TOOL # Extract the first word of "mt", so it can be a program name with args. set dummy mt; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_MANIFEST_TOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_MANIFEST_TOOL"; then ac_cv_prog_ac_ct_MANIFEST_TOOL="$ac_ct_MANIFEST_TOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_MANIFEST_TOOL="mt" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_MANIFEST_TOOL=$ac_cv_prog_ac_ct_MANIFEST_TOOL if test -n "$ac_ct_MANIFEST_TOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5 $as_echo "$ac_ct_MANIFEST_TOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_MANIFEST_TOOL" = x; then MANIFEST_TOOL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac MANIFEST_TOOL=$ac_ct_MANIFEST_TOOL fi else MANIFEST_TOOL="$ac_cv_prog_MANIFEST_TOOL" fi test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5 $as_echo_n "checking if $MANIFEST_TOOL is a manifest tool... " >&6; } if ${lt_cv_path_mainfest_tool+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_path_mainfest_tool=no echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&5 $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out cat conftest.err >&5 if $GREP 'Manifest Tool' conftest.out > /dev/null; then lt_cv_path_mainfest_tool=yes fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5 $as_echo "$lt_cv_path_mainfest_tool" >&6; } if test yes != "$lt_cv_path_mainfest_tool"; then MANIFEST_TOOL=: fi case $host_os in rhapsody* | darwin*) if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}dsymutil", so it can be a program name with args. set dummy ${ac_tool_prefix}dsymutil; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_DSYMUTIL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$DSYMUTIL"; then ac_cv_prog_DSYMUTIL="$DSYMUTIL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_DSYMUTIL="${ac_tool_prefix}dsymutil" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi DSYMUTIL=$ac_cv_prog_DSYMUTIL if test -n "$DSYMUTIL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5 $as_echo "$DSYMUTIL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_DSYMUTIL"; then ac_ct_DSYMUTIL=$DSYMUTIL # Extract the first word of "dsymutil", so it can be a program name with args. set dummy dsymutil; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_DSYMUTIL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_DSYMUTIL"; then ac_cv_prog_ac_ct_DSYMUTIL="$ac_ct_DSYMUTIL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_DSYMUTIL="dsymutil" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_DSYMUTIL=$ac_cv_prog_ac_ct_DSYMUTIL if test -n "$ac_ct_DSYMUTIL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5 $as_echo "$ac_ct_DSYMUTIL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_DSYMUTIL" = x; then DSYMUTIL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac DSYMUTIL=$ac_ct_DSYMUTIL fi else DSYMUTIL="$ac_cv_prog_DSYMUTIL" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}nmedit", so it can be a program name with args. set dummy ${ac_tool_prefix}nmedit; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_NMEDIT+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$NMEDIT"; then ac_cv_prog_NMEDIT="$NMEDIT" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_NMEDIT="${ac_tool_prefix}nmedit" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi NMEDIT=$ac_cv_prog_NMEDIT if test -n "$NMEDIT"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5 $as_echo "$NMEDIT" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_NMEDIT"; then ac_ct_NMEDIT=$NMEDIT # Extract the first word of "nmedit", so it can be a program name with args. set dummy nmedit; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_NMEDIT+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_NMEDIT"; then ac_cv_prog_ac_ct_NMEDIT="$ac_ct_NMEDIT" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_NMEDIT="nmedit" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_NMEDIT=$ac_cv_prog_ac_ct_NMEDIT if test -n "$ac_ct_NMEDIT"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5 $as_echo "$ac_ct_NMEDIT" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_NMEDIT" = x; then NMEDIT=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac NMEDIT=$ac_ct_NMEDIT fi else NMEDIT="$ac_cv_prog_NMEDIT" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}lipo", so it can be a program name with args. set dummy ${ac_tool_prefix}lipo; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_LIPO+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$LIPO"; then ac_cv_prog_LIPO="$LIPO" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_LIPO="${ac_tool_prefix}lipo" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi LIPO=$ac_cv_prog_LIPO if test -n "$LIPO"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5 $as_echo "$LIPO" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_LIPO"; then ac_ct_LIPO=$LIPO # Extract the first word of "lipo", so it can be a program name with args. set dummy lipo; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_LIPO+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_LIPO"; then ac_cv_prog_ac_ct_LIPO="$ac_ct_LIPO" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_LIPO="lipo" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_LIPO=$ac_cv_prog_ac_ct_LIPO if test -n "$ac_ct_LIPO"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5 $as_echo "$ac_ct_LIPO" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_LIPO" = x; then LIPO=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac LIPO=$ac_ct_LIPO fi else LIPO="$ac_cv_prog_LIPO" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}otool", so it can be a program name with args. set dummy ${ac_tool_prefix}otool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OTOOL"; then ac_cv_prog_OTOOL="$OTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OTOOL="${ac_tool_prefix}otool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OTOOL=$ac_cv_prog_OTOOL if test -n "$OTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5 $as_echo "$OTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OTOOL"; then ac_ct_OTOOL=$OTOOL # Extract the first word of "otool", so it can be a program name with args. set dummy otool; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OTOOL+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OTOOL"; then ac_cv_prog_ac_ct_OTOOL="$ac_ct_OTOOL" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OTOOL="otool" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OTOOL=$ac_cv_prog_ac_ct_OTOOL if test -n "$ac_ct_OTOOL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5 $as_echo "$ac_ct_OTOOL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OTOOL" = x; then OTOOL=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OTOOL=$ac_ct_OTOOL fi else OTOOL="$ac_cv_prog_OTOOL" fi if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}otool64", so it can be a program name with args. set dummy ${ac_tool_prefix}otool64; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_OTOOL64+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$OTOOL64"; then ac_cv_prog_OTOOL64="$OTOOL64" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_OTOOL64="${ac_tool_prefix}otool64" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi OTOOL64=$ac_cv_prog_OTOOL64 if test -n "$OTOOL64"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5 $as_echo "$OTOOL64" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_OTOOL64"; then ac_ct_OTOOL64=$OTOOL64 # Extract the first word of "otool64", so it can be a program name with args. set dummy otool64; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_OTOOL64+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_OTOOL64"; then ac_cv_prog_ac_ct_OTOOL64="$ac_ct_OTOOL64" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_OTOOL64="otool64" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_OTOOL64=$ac_cv_prog_ac_ct_OTOOL64 if test -n "$ac_ct_OTOOL64"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5 $as_echo "$ac_ct_OTOOL64" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_OTOOL64" = x; then OTOOL64=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac OTOOL64=$ac_ct_OTOOL64 fi else OTOOL64="$ac_cv_prog_OTOOL64" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5 $as_echo_n "checking for -single_module linker flag... " >&6; } if ${lt_cv_apple_cc_single_mod+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_apple_cc_single_mod=no if test -z "$LT_MULTI_MODULE"; then # By default we will add the -single_module flag. You can override # by either setting the environment variable LT_MULTI_MODULE # non-empty at configure time, or by adding -multi_module to the # link flags. rm -rf libconftest.dylib* echo "int foo(void){return 1;}" > conftest.c echo "$LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c" >&5 $LTCC $LTCFLAGS $LDFLAGS -o libconftest.dylib \ -dynamiclib -Wl,-single_module conftest.c 2>conftest.err _lt_result=$? # If there is a non-empty error log, and "single_module" # appears in it, assume the flag caused a linker warning if test -s conftest.err && $GREP single_module conftest.err; then cat conftest.err >&5 # Otherwise, if the output was created with a 0 exit code from # the compiler, it worked. elif test -f libconftest.dylib && test 0 = "$_lt_result"; then lt_cv_apple_cc_single_mod=yes else cat conftest.err >&5 fi rm -rf libconftest.dylib* rm -f conftest.* fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5 $as_echo "$lt_cv_apple_cc_single_mod" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5 $as_echo_n "checking for -exported_symbols_list linker flag... " >&6; } if ${lt_cv_ld_exported_symbols_list+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_exported_symbols_list=no save_LDFLAGS=$LDFLAGS echo "_main" > conftest.sym LDFLAGS="$LDFLAGS -Wl,-exported_symbols_list,conftest.sym" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_ld_exported_symbols_list=yes else lt_cv_ld_exported_symbols_list=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5 $as_echo "$lt_cv_ld_exported_symbols_list" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5 $as_echo_n "checking for -force_load linker flag... " >&6; } if ${lt_cv_ld_force_load+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_ld_force_load=no cat > conftest.c << _LT_EOF int forced_loaded() { return 2;} _LT_EOF echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5 $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5 echo "$AR cru libconftest.a conftest.o" >&5 $AR cru libconftest.a conftest.o 2>&5 echo "$RANLIB libconftest.a" >&5 $RANLIB libconftest.a 2>&5 cat > conftest.c << _LT_EOF int main() { return 0;} _LT_EOF echo "$LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a" >&5 $LTCC $LTCFLAGS $LDFLAGS -o conftest conftest.c -Wl,-force_load,./libconftest.a 2>conftest.err _lt_result=$? if test -s conftest.err && $GREP force_load conftest.err; then cat conftest.err >&5 elif test -f conftest && test 0 = "$_lt_result" && $GREP forced_load conftest >/dev/null 2>&1; then lt_cv_ld_force_load=yes else cat conftest.err >&5 fi rm -f conftest.err libconftest.a conftest conftest.c rm -rf conftest.dSYM fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5 $as_echo "$lt_cv_ld_force_load" >&6; } case $host_os in rhapsody* | darwin1.[012]) _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;; darwin1.*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; darwin*) # darwin 5.x on # if running on 10.5 or later, the deployment target defaults # to the OS version, if on x86, and 10.4, the deployment # target defaults to 10.4. Don't you love it? case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in 10.0,*86*-darwin8*|10.0,*-darwin[91]*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; 10.[012][,.]*) _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;; 10.*) _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;; esac ;; esac if test yes = "$lt_cv_apple_cc_single_mod"; then _lt_dar_single_mod='$single_module' fi if test yes = "$lt_cv_ld_exported_symbols_list"; then _lt_dar_export_syms=' $wl-exported_symbols_list,$output_objdir/$libname-symbols.expsym' else _lt_dar_export_syms='~$NMEDIT -s $output_objdir/$libname-symbols.expsym $lib' fi if test : != "$DSYMUTIL" && test no = "$lt_cv_ld_force_load"; then _lt_dsymutil='~$DSYMUTIL $lib || :' else _lt_dsymutil= fi ;; esac # func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x$2 in x) ;; *:) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'` \$$1\" ;; x:*) eval $1=\"\$$1 `$ECHO $2 | $SED 's/:/ /g'`\" ;; *::*) eval $1=\"\$$1\ `$ECHO $2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval $1=\"`$ECHO $2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\" ;; *) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'`\" ;; esac } ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 $as_echo_n "checking how to run the C preprocessor... " >&6; } # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if ${ac_cv_prog_CPP+:} false; then : $as_echo_n "(cached) " >&6 else # Double quotes because CPP needs to be expanded for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" do ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : break fi done ac_cv_prog_CPP=$CPP fi CPP=$ac_cv_prog_CPP else ac_cv_prog_CPP=$CPP fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 $as_echo "$CPP" >&6; } ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C preprocessor \"$CPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 $as_echo_n "checking for ANSI C header files... " >&6; } if ${ac_cv_header_stdc+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_stdc=yes else ac_cv_header_stdc=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test $ac_cv_header_stdc = yes; then # SunOS 4.x string.h does not declare mem*, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "memchr" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "free" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. if test "$cross_compiling" = yes; then : : else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #if ((' ' & 0x0FF) == 0x020) # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) #else # define ISLOWER(c) \ (('a' <= (c) && (c) <= 'i') \ || ('j' <= (c) && (c) <= 'r') \ || ('s' <= (c) && (c) <= 'z')) # define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) #endif #define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) int main () { int i; for (i = 0; i < 256; i++) if (XOR (islower (i), ISLOWER (i)) || toupper (i) != TOUPPER (i)) return 2; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : else ac_cv_header_stdc=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 $as_echo "$ac_cv_header_stdc" >&6; } if test $ac_cv_header_stdc = yes; then $as_echo "#define STDC_HEADERS 1" >>confdefs.h fi # On IRIX 5.3, sys/types and inttypes.h are conflicting. for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \ inttypes.h stdint.h unistd.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default " if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in dlfcn.h do : ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default " if test "x$ac_cv_header_dlfcn_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_DLFCN_H 1 _ACEOF fi done # Set options enable_dlopen=no enable_win32_dll=no # Check whether --enable-shared was given. if test "${enable_shared+set}" = set; then : enableval=$enable_shared; p=${PACKAGE-default} case $enableval in yes) enable_shared=yes ;; no) enable_shared=no ;; *) enable_shared=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_shared=yes fi done IFS=$lt_save_ifs ;; esac else enable_shared=yes fi # Check whether --enable-static was given. if test "${enable_static+set}" = set; then : enableval=$enable_static; p=${PACKAGE-default} case $enableval in yes) enable_static=yes ;; no) enable_static=no ;; *) enable_static=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_static=yes fi done IFS=$lt_save_ifs ;; esac else enable_static=yes fi # Check whether --with-pic was given. if test "${with_pic+set}" = set; then : withval=$with_pic; lt_p=${PACKAGE-default} case $withval in yes|no) pic_mode=$withval ;; *) pic_mode=default # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for lt_pkg in $withval; do IFS=$lt_save_ifs if test "X$lt_pkg" = "X$lt_p"; then pic_mode=yes fi done IFS=$lt_save_ifs ;; esac else pic_mode=default fi # Check whether --enable-fast-install was given. if test "${enable_fast_install+set}" = set; then : enableval=$enable_fast_install; p=${PACKAGE-default} case $enableval in yes) enable_fast_install=yes ;; no) enable_fast_install=no ;; *) enable_fast_install=no # Look at the argument we got. We use all the common list separators. lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR, for pkg in $enableval; do IFS=$lt_save_ifs if test "X$pkg" = "X$p"; then enable_fast_install=yes fi done IFS=$lt_save_ifs ;; esac else enable_fast_install=yes fi shared_archive_member_spec= case $host,$enable_shared in power*-*-aix[5-9]*,yes) { $as_echo "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5 $as_echo_n "checking which variant of shared library versioning to provide... " >&6; } # Check whether --with-aix-soname was given. if test "${with_aix_soname+set}" = set; then : withval=$with_aix_soname; case $withval in aix|svr4|both) ;; *) as_fn_error $? "Unknown argument to --with-aix-soname" "$LINENO" 5 ;; esac lt_cv_with_aix_soname=$with_aix_soname else if ${lt_cv_with_aix_soname+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_with_aix_soname=aix fi with_aix_soname=$lt_cv_with_aix_soname fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5 $as_echo "$with_aix_soname" >&6; } if test aix != "$with_aix_soname"; then # For the AIX way of multilib, we name the shared archive member # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o', # and 'shr.imp' or 'shr_64.imp', respectively, for the Import File. # Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag, # the AIX toolchain works better with OBJECT_MODE set (default 32). if test 64 = "${OBJECT_MODE-32}"; then shared_archive_member_spec=shr_64 else shared_archive_member_spec=shr fi fi ;; *) with_aix_soname=aix ;; esac # This can be used to rebuild libtool when needed LIBTOOL_DEPS=$ltmain # Always use our own libtool. LIBTOOL='$(SHELL) $(top_builddir)/libtool' test -z "$LN_S" && LN_S="ln -s" if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5 $as_echo_n "checking for objdir... " >&6; } if ${lt_cv_objdir+:} false; then : $as_echo_n "(cached) " >&6 else rm -f .libs 2>/dev/null mkdir .libs 2>/dev/null if test -d .libs; then lt_cv_objdir=.libs else # MS-DOS does not allow filenames that begin with a dot. lt_cv_objdir=_libs fi rmdir .libs 2>/dev/null fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5 $as_echo "$lt_cv_objdir" >&6; } objdir=$lt_cv_objdir cat >>confdefs.h <<_ACEOF #define LT_OBJDIR "$lt_cv_objdir/" _ACEOF case $host_os in aix3*) # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi ;; esac # Global variables: ofile=libtool can_build_shared=yes # All known linkers require a '.a' archive for static linking (except MSVC, # which needs '.lib'). libext=a with_gnu_ld=$lt_cv_prog_gnu_ld old_CC=$CC old_CFLAGS=$CFLAGS # Set sane defaults for various variables test -z "$CC" && CC=cc test -z "$LTCC" && LTCC=$CC test -z "$LTCFLAGS" && LTCFLAGS=$CFLAGS test -z "$LD" && LD=ld test -z "$ac_objext" && ac_objext=o func_cc_basename $compiler cc_basename=$func_cc_basename_result # Only perform the check for file, if the check method requires it test -z "$MAGIC_CMD" && MAGIC_CMD=file case $deplibs_check_method in file_magic*) if test "$file_magic_cmd" = '$MAGIC_CMD'; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5 $as_echo_n "checking for ${ac_tool_prefix}file... " >&6; } if ${lt_cv_path_MAGIC_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $MAGIC_CMD in [\\/*] | ?:[\\/]*) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR ac_dummy="/usr/bin$PATH_SEPARATOR$PATH" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/${ac_tool_prefix}file"; then lt_cv_path_MAGIC_CMD=$ac_dir/"${ac_tool_prefix}file" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac fi MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5 $as_echo "$MAGIC_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test -z "$lt_cv_path_MAGIC_CMD"; then if test -n "$ac_tool_prefix"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for file" >&5 $as_echo_n "checking for file... " >&6; } if ${lt_cv_path_MAGIC_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $MAGIC_CMD in [\\/*] | ?:[\\/]*) lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path. ;; *) lt_save_MAGIC_CMD=$MAGIC_CMD lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR ac_dummy="/usr/bin$PATH_SEPARATOR$PATH" for ac_dir in $ac_dummy; do IFS=$lt_save_ifs test -z "$ac_dir" && ac_dir=. if test -f "$ac_dir/file"; then lt_cv_path_MAGIC_CMD=$ac_dir/"file" if test -n "$file_magic_test_file"; then case $deplibs_check_method in "file_magic "*) file_magic_regex=`expr "$deplibs_check_method" : "file_magic \(.*\)"` MAGIC_CMD=$lt_cv_path_MAGIC_CMD if eval $file_magic_cmd \$file_magic_test_file 2> /dev/null | $EGREP "$file_magic_regex" > /dev/null; then : else cat <<_LT_EOF 1>&2 *** Warning: the command libtool uses to detect shared libraries, *** $file_magic_cmd, produces output that libtool cannot recognize. *** The result is that libtool may fail to recognize shared libraries *** as such. This will affect the creation of libtool libraries that *** depend on shared libraries, but programs linked with such libtool *** libraries will work regardless of this problem. Nevertheless, you *** may want to report the problem to your system manager and/or to *** bug-libtool@gnu.org _LT_EOF fi ;; esac fi break fi done IFS=$lt_save_ifs MAGIC_CMD=$lt_save_MAGIC_CMD ;; esac fi MAGIC_CMD=$lt_cv_path_MAGIC_CMD if test -n "$MAGIC_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5 $as_echo "$MAGIC_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi else MAGIC_CMD=: fi fi fi ;; esac # Use C for the default configuration in the libtool script lt_save_CC=$CC ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu # Source file extension for C test sources. ac_ext=c # Object file extension for compiled C test sources. objext=o objext=$objext # Code to be used in simple compile tests lt_simple_compile_test_code="int some_variable = 0;" # Code to be used in simple link tests lt_simple_link_test_code='int main(){return(0);}' # If no C compiler was specified, use CC. LTCC=${LTCC-"$CC"} # If no C compiler flags were specified, use CFLAGS. LTCFLAGS=${LTCFLAGS-"$CFLAGS"} # Allow CC to be a program name with arguments. compiler=$CC # Save the default compiler, since it gets overwritten when the other # tags are being tested, and _LT_TAGVAR(compiler, []) is a NOP. compiler_DEFAULT=$CC # save warnings/boilerplate of simple test code ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" >conftest.$ac_ext eval "$ac_compile" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_compiler_boilerplate=`cat conftest.err` $RM conftest* ac_outfile=conftest.$ac_objext echo "$lt_simple_link_test_code" >conftest.$ac_ext eval "$ac_link" 2>&1 >/dev/null | $SED '/^$/d; /^ *+/d' >conftest.err _lt_linker_boilerplate=`cat conftest.err` $RM -r conftest* ## CAVEAT EMPTOR: ## There is no encapsulation within the following macros, do not change ## the running order or otherwise move them around unless you know exactly ## what you are doing... if test -n "$compiler"; then lt_prog_compiler_no_builtin_flag= if test yes = "$GCC"; then case $cc_basename in nvcc*) lt_prog_compiler_no_builtin_flag=' -Xcompiler -fno-builtin' ;; *) lt_prog_compiler_no_builtin_flag=' -fno-builtin' ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5 $as_echo_n "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; } if ${lt_cv_prog_compiler_rtti_exceptions+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_rtti_exceptions=no ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-fno-rtti -fno-exceptions" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_rtti_exceptions=yes fi fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5 $as_echo "$lt_cv_prog_compiler_rtti_exceptions" >&6; } if test yes = "$lt_cv_prog_compiler_rtti_exceptions"; then lt_prog_compiler_no_builtin_flag="$lt_prog_compiler_no_builtin_flag -fno-rtti -fno-exceptions" else : fi fi lt_prog_compiler_wl= lt_prog_compiler_pic= lt_prog_compiler_static= if test yes = "$GCC"; then lt_prog_compiler_wl='-Wl,' lt_prog_compiler_static='-static' case $host_os in aix*) # All AIX code is PIC. if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static='-Bstatic' fi lt_prog_compiler_pic='-fPIC' ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support lt_prog_compiler_pic='-fPIC' ;; m68k) # FIXME: we need at least 68020 code to build shared libraries, but # adding the '-m68020' flag to GCC prevents building anything better, # like '-m68040'. lt_prog_compiler_pic='-m68020 -resident32 -malways-restore-a4' ;; esac ;; beos* | irix5* | irix6* | nonstopux* | osf3* | osf4* | osf5*) # PIC is the default for these OSes. ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). # Although the cygwin gcc ignores -fPIC, still need this for old-style # (--disable-auto-import) libraries lt_prog_compiler_pic='-DDLL_EXPORT' case $host_os in os2*) lt_prog_compiler_static='$wl-static' ;; esac ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files lt_prog_compiler_pic='-fno-common' ;; haiku*) # PIC is the default for Haiku. # The "-static" flag exists, but is broken. lt_prog_compiler_static= ;; hpux*) # PIC is the default for 64-bit PA HP-UX, but not for 32-bit # PA HP-UX. On IA64 HP-UX, PIC is the default but the pic flag # sets the default TLS model and affects inlining. case $host_cpu in hppa*64*) # +Z the default ;; *) lt_prog_compiler_pic='-fPIC' ;; esac ;; interix[3-9]*) # Interix 3.x gcc -fpic/-fPIC options generate broken code. # Instead, we relocate shared libraries at runtime. ;; msdosdjgpp*) # Just because we use GCC doesn't mean we suddenly get shared libraries # on systems that don't support them. lt_prog_compiler_can_build_shared=no enable_shared=no ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic='-fPIC -shared' ;; sysv4*MP*) if test -d /usr/nec; then lt_prog_compiler_pic=-Kconform_pic fi ;; *) lt_prog_compiler_pic='-fPIC' ;; esac case $cc_basename in nvcc*) # Cuda Compiler Driver 2.2 lt_prog_compiler_wl='-Xlinker ' if test -n "$lt_prog_compiler_pic"; then lt_prog_compiler_pic="-Xcompiler $lt_prog_compiler_pic" fi ;; esac else # PORTME Check for flag to pass linker flags through the system compiler. case $host_os in aix*) lt_prog_compiler_wl='-Wl,' if test ia64 = "$host_cpu"; then # AIX 5 now supports IA64 processor lt_prog_compiler_static='-Bstatic' else lt_prog_compiler_static='-bnso -bI:/lib/syscalls.exp' fi ;; darwin* | rhapsody*) # PIC is the default on this platform # Common symbols not allowed in MH_DYLIB files lt_prog_compiler_pic='-fno-common' case $cc_basename in nagfor*) # NAG Fortran compiler lt_prog_compiler_wl='-Wl,-Wl,,' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; esac ;; mingw* | cygwin* | pw32* | os2* | cegcc*) # This hack is so that the source file can tell whether it is being # built for inclusion in a dll (and should export symbols for example). lt_prog_compiler_pic='-DDLL_EXPORT' case $host_os in os2*) lt_prog_compiler_static='$wl-static' ;; esac ;; hpux9* | hpux10* | hpux11*) lt_prog_compiler_wl='-Wl,' # PIC is the default for IA64 HP-UX and 64-bit HP-UX, but # not for PA HP-UX. case $host_cpu in hppa*64*|ia64*) # +Z the default ;; *) lt_prog_compiler_pic='+Z' ;; esac # Is there a better lt_prog_compiler_static that works with the bundled CC? lt_prog_compiler_static='$wl-a ${wl}archive' ;; irix5* | irix6* | nonstopux*) lt_prog_compiler_wl='-Wl,' # PIC (with -KPIC) is the default. lt_prog_compiler_static='-non_shared' ;; linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) case $cc_basename in # old Intel for x86_64, which still supported -KPIC. ecc*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-static' ;; # icc used to be incompatible with GCC. # ICC 10 doesn't accept -KPIC any more. icc* | ifort*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; # Lahey Fortran 8.1. lf95*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='--shared' lt_prog_compiler_static='--static' ;; nagfor*) # NAG Fortran compiler lt_prog_compiler_wl='-Wl,-Wl,,' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; tcc*) # Fabrice Bellard et al's Tiny C Compiler lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; pgcc* | pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group compilers (*not* the Pentium gcc compiler, # which looks to be a dead project) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fpic' lt_prog_compiler_static='-Bstatic' ;; ccc*) lt_prog_compiler_wl='-Wl,' # All Alpha code is PIC. lt_prog_compiler_static='-non_shared' ;; xl* | bgxl* | bgf* | mpixl*) # IBM XL C 8.0/Fortran 10.1, 11.1 on PPC and BlueGene lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-qpic' lt_prog_compiler_static='-qstaticlink' ;; *) case `$CC -V 2>&1 | sed 5q` in *Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [1-7].* | *Sun*Fortran*\ 8.[0-3]*) # Sun Fortran 8.3 passes all unrecognized flags to the linker lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='' ;; *Sun\ F* | *Sun*Fortran*) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='-Qoption ld ' ;; *Sun\ C*) # Sun C 5.9 lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' lt_prog_compiler_wl='-Wl,' ;; *Intel*\ [CF]*Compiler*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fPIC' lt_prog_compiler_static='-static' ;; *Portland\ Group*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-fpic' lt_prog_compiler_static='-Bstatic' ;; esac ;; esac ;; newsos6) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; *nto* | *qnx*) # QNX uses GNU C++, but need to define -shared option too, otherwise # it will coredump. lt_prog_compiler_pic='-fPIC -shared' ;; osf3* | osf4* | osf5*) lt_prog_compiler_wl='-Wl,' # All OSF/1 code is PIC. lt_prog_compiler_static='-non_shared' ;; rdos*) lt_prog_compiler_static='-non_shared' ;; solaris*) lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' case $cc_basename in f77* | f90* | f95* | sunf77* | sunf90* | sunf95*) lt_prog_compiler_wl='-Qoption ld ';; *) lt_prog_compiler_wl='-Wl,';; esac ;; sunos4*) lt_prog_compiler_wl='-Qoption ld ' lt_prog_compiler_pic='-PIC' lt_prog_compiler_static='-Bstatic' ;; sysv4 | sysv4.2uw2* | sysv4.3*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; sysv4*MP*) if test -d /usr/nec; then lt_prog_compiler_pic='-Kconform_pic' lt_prog_compiler_static='-Bstatic' fi ;; sysv5* | unixware* | sco3.2v5* | sco5v6* | OpenUNIX*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_pic='-KPIC' lt_prog_compiler_static='-Bstatic' ;; unicos*) lt_prog_compiler_wl='-Wl,' lt_prog_compiler_can_build_shared=no ;; uts4*) lt_prog_compiler_pic='-pic' lt_prog_compiler_static='-Bstatic' ;; *) lt_prog_compiler_can_build_shared=no ;; esac fi case $host_os in # For platforms that do not support PIC, -DPIC is meaningless: *djgpp*) lt_prog_compiler_pic= ;; *) lt_prog_compiler_pic="$lt_prog_compiler_pic -DPIC" ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5 $as_echo_n "checking for $compiler option to produce PIC... " >&6; } if ${lt_cv_prog_compiler_pic+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic=$lt_prog_compiler_pic fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5 $as_echo "$lt_cv_prog_compiler_pic" >&6; } lt_prog_compiler_pic=$lt_cv_prog_compiler_pic # # Check to make sure the PIC flag actually works. # if test -n "$lt_prog_compiler_pic"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5 $as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; } if ${lt_cv_prog_compiler_pic_works+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_pic_works=no ac_outfile=conftest.$ac_objext echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="$lt_prog_compiler_pic -DPIC" ## exclude from sc_useless_quotes_in_assignment # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. # The option is referenced via a variable to avoid confusing sed. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' >conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if test ! -s conftest.er2 || diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_pic_works=yes fi fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5 $as_echo "$lt_cv_prog_compiler_pic_works" >&6; } if test yes = "$lt_cv_prog_compiler_pic_works"; then case $lt_prog_compiler_pic in "" | " "*) ;; *) lt_prog_compiler_pic=" $lt_prog_compiler_pic" ;; esac else lt_prog_compiler_pic= lt_prog_compiler_can_build_shared=no fi fi # # Check to make sure the static flag actually works. # wl=$lt_prog_compiler_wl eval lt_tmp_static_flag=\"$lt_prog_compiler_static\" { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5 $as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; } if ${lt_cv_prog_compiler_static_works+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_static_works=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS $lt_tmp_static_flag" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&5 $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler_static_works=yes fi else lt_cv_prog_compiler_static_works=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5 $as_echo "$lt_cv_prog_compiler_static_works" >&6; } if test yes = "$lt_cv_prog_compiler_static_works"; then : else lt_prog_compiler_static= fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5 $as_echo "$lt_cv_prog_compiler_c_o" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5 $as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; } if ${lt_cv_prog_compiler_c_o+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler_c_o=no $RM -r conftest 2>/dev/null mkdir conftest cd conftest mkdir out echo "$lt_simple_compile_test_code" > conftest.$ac_ext lt_compiler_flag="-o out/conftest2.$ac_objext" # Insert the option either (1) after the last *FLAGS variable, or # (2) before a word containing "conftest.", or (3) at the end. # Note that $ac_compile itself does not contain backslashes and begins # with a dollar sign (not a hyphen), so the echo should work correctly. lt_compile=`echo "$ac_compile" | $SED \ -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` (eval echo "\"\$as_me:$LINENO: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 echo "$as_me:$LINENO: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings $ECHO "$_lt_compiler_boilerplate" | $SED '/^$/d' > out/conftest.exp $SED '/^$/d; /^ *+/d' out/conftest.err >out/conftest.er2 if test ! -s out/conftest.er2 || diff out/conftest.exp out/conftest.er2 >/dev/null; then lt_cv_prog_compiler_c_o=yes fi fi chmod u+w . 2>&5 $RM conftest* # SGI C++ compiler will create directory out/ii_files/ for # template instantiation test -d out/ii_files && $RM out/ii_files/* && rmdir out/ii_files $RM out/* && rmdir out cd .. $RM -r conftest $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5 $as_echo "$lt_cv_prog_compiler_c_o" >&6; } hard_links=nottested if test no = "$lt_cv_prog_compiler_c_o" && test no != "$need_locks"; then # do not overwrite the value of need_locks provided by the user { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5 $as_echo_n "checking if we can lock with hard links... " >&6; } hard_links=yes $RM conftest* ln conftest.a conftest.b 2>/dev/null && hard_links=no touch conftest.a ln conftest.a conftest.b 2>&5 || hard_links=no ln conftest.a conftest.b 2>/dev/null && hard_links=no { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5 $as_echo "$hard_links" >&6; } if test no = "$hard_links"; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5 $as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;} need_locks=warn fi else need_locks=no fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5 $as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; } runpath_var= allow_undefined_flag= always_export_symbols=no archive_cmds= archive_expsym_cmds= compiler_needs_object=no enable_shared_with_static_runtimes=no export_dynamic_flag_spec= export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols' hardcode_automatic=no hardcode_direct=no hardcode_direct_absolute=no hardcode_libdir_flag_spec= hardcode_libdir_separator= hardcode_minus_L=no hardcode_shlibpath_var=unsupported inherit_rpath=no link_all_deplibs=unknown module_cmds= module_expsym_cmds= old_archive_from_new_cmds= old_archive_from_expsyms_cmds= thread_safe_flag_spec= whole_archive_flag_spec= # include_expsyms should be a list of space-separated symbols to be *always* # included in the symbol list include_expsyms= # exclude_expsyms can be an extended regexp of symbols to exclude # it will be wrapped by ' (' and ')$', so one must not match beginning or # end of line. Example: 'a|bc|.*d.*' will exclude the symbols 'a' and 'bc', # as well as any symbol that contains 'd'. exclude_expsyms='_GLOBAL_OFFSET_TABLE_|_GLOBAL__F[ID]_.*' # Although _GLOBAL_OFFSET_TABLE_ is a valid symbol C name, most a.out # platforms (ab)use it in PIC code, but their linkers get confused if # the symbol is explicitly referenced. Since portable code cannot # rely on this symbol name, it's probably fine to never include it in # preloaded symbol tables. # Exclude shared library initialization/finalization symbols. extract_expsyms_cmds= case $host_os in cygwin* | mingw* | pw32* | cegcc*) # FIXME: the MSVC++ port hasn't been tested in a loooong time # When not using gcc, we currently assume that we are using # Microsoft Visual C++. if test yes != "$GCC"; then with_gnu_ld=no fi ;; interix*) # we just hope/assume this is gcc and not c89 (= MSVC++) with_gnu_ld=yes ;; openbsd* | bitrig*) with_gnu_ld=no ;; linux* | k*bsd*-gnu | gnu*) link_all_deplibs=no ;; esac ld_shlibs=yes # On some targets, GNU ld is compatible enough with the native linker # that we're better off using the native interface for both. lt_use_gnu_ld_interface=no if test yes = "$with_gnu_ld"; then case $host_os in aix*) # The AIX port of GNU ld has always aspired to compatibility # with the native linker. However, as the warning in the GNU ld # block says, versions before 2.19.5* couldn't really create working # shared libraries, regardless of the interface used. case `$LD -v 2>&1` in *\ \(GNU\ Binutils\)\ 2.19.5*) ;; *\ \(GNU\ Binutils\)\ 2.[2-9]*) ;; *\ \(GNU\ Binutils\)\ [3-9]*) ;; *) lt_use_gnu_ld_interface=yes ;; esac ;; *) lt_use_gnu_ld_interface=yes ;; esac fi if test yes = "$lt_use_gnu_ld_interface"; then # If archive_cmds runs LD, not CC, wlarc should be empty wlarc='$wl' # Set some defaults for GNU ld with shared library support. These # are reset later if shared libraries are not supported. Putting them # here allows them to be overridden if necessary. runpath_var=LD_RUN_PATH hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' export_dynamic_flag_spec='$wl--export-dynamic' # ancient GNU ld didn't support --whole-archive et. al. if $LD --help 2>&1 | $GREP 'no-whole-archive' > /dev/null; then whole_archive_flag_spec=$wlarc'--whole-archive$convenience '$wlarc'--no-whole-archive' else whole_archive_flag_spec= fi supports_anon_versioning=no case `$LD -v | $SED -e 's/(^)\+)\s\+//' 2>&1` in *GNU\ gold*) supports_anon_versioning=yes ;; *\ [01].* | *\ 2.[0-9].* | *\ 2.10.*) ;; # catch versions < 2.11 *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ... *\ 2.11.92.0.12\ *) supports_anon_versioning=yes ;; # Mandrake 8.2 ... *\ 2.11.*) ;; # other 2.11 versions *) supports_anon_versioning=yes ;; esac # See if GNU ld supports shared libraries. case $host_os in aix[3-9]*) # On AIX/PPC, the GNU linker is very broken if test ia64 != "$host_cpu"; then ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: the GNU linker, at least up to release 2.19, is reported *** to be unable to reliably create shared libraries on AIX. *** Therefore, libtool is disabling shared libraries support. If you *** really care for shared libraries, you may want to install binutils *** 2.20 or above, or modify your PATH so that a non-GNU linker is found. *** You will then need to restart the configuration process. _LT_EOF fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='' ;; m68k) archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes ;; esac ;; beos*) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then allow_undefined_flag=unsupported # Joseph Beckenbach says some releases of gcc # support --undefined. This deserves some investigation. FIXME archive_cmds='$CC -nostart $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' else ld_shlibs=no fi ;; cygwin* | mingw* | pw32* | cegcc*) # _LT_TAGVAR(hardcode_libdir_flag_spec, ) is actually meaningless, # as there is no search path for DLLs. hardcode_libdir_flag_spec='-L$libdir' export_dynamic_flag_spec='$wl--export-all-symbols' allow_undefined_flag=unsupported always_export_symbols=no enable_shared_with_static_runtimes=yes export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[BCDGRS][ ]/s/.*[ ]\([^ ]*\)/\1 DATA/;s/^.*[ ]__nm__\([^ ]*\)[ ][^ ]*/\1 DATA/;/^I[ ]/d;/^[AITW][ ]/s/.* //'\'' | sort | uniq > $export_symbols' exclude_expsyms='[_]+GLOBAL_OFFSET_TABLE_|[_]+GLOBAL__[FID]_.*|[_]+head_[A-Za-z0-9_]+_dll|[A-Za-z0-9_]+_dll_iname' if $LD --help 2>&1 | $GREP 'auto-import' > /dev/null; then archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' # If the export-symbols file already is a .def file, use it as # is; otherwise, prepend EXPORTS... archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp $export_symbols $output_objdir/$soname.def; else echo EXPORTS > $output_objdir/$soname.def; cat $export_symbols >> $output_objdir/$soname.def; fi~ $CC -shared $output_objdir/$soname.def $libobjs $deplibs $compiler_flags -o $output_objdir/$soname $wl--enable-auto-image-base -Xlinker --out-implib -Xlinker $lib' else ld_shlibs=no fi ;; haiku*) archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' link_all_deplibs=yes ;; os2*) hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes allow_undefined_flag=unsupported shrext_cmds=.dll archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' enable_shared_with_static_runtimes=yes ;; interix[3-9]*) hardcode_direct=no hardcode_shlibpath_var=no hardcode_libdir_flag_spec='$wl-rpath,$libdir' export_dynamic_flag_spec='$wl-E' # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc. # Instead, shared libraries are loaded at an image base (0x10000000 by # default) and relocated if they conflict, which is a slow very memory # consuming and fragmenting process. To avoid this, we pick a random, # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link # time. Moving up from 0x10000000 also allows more sbrk(2) space. archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' archive_expsym_cmds='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib' ;; gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu) tmp_diet=no if test linux-dietlibc = "$host_os"; then case $cc_basename in diet\ *) tmp_diet=yes;; # linux-dietlibc with static linking (!diet-dyn) esac fi if $LD --help 2>&1 | $EGREP ': supported targets:.* elf' > /dev/null \ && test no = "$tmp_diet" then tmp_addflag=' $pic_flag' tmp_sharedflag='-shared' case $cc_basename,$host_cpu in pgcc*) # Portland Group C compiler whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag' ;; pgf77* | pgf90* | pgf95* | pgfortran*) # Portland Group f77 and f90 compilers whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' tmp_addflag=' $pic_flag -Mnomain' ;; ecc*,ia64* | icc*,ia64*) # Intel C compiler on ia64 tmp_addflag=' -i_dynamic' ;; efc*,ia64* | ifort*,ia64*) # Intel Fortran compiler on ia64 tmp_addflag=' -i_dynamic -nofor_main' ;; ifc* | ifort*) # Intel Fortran compiler tmp_addflag=' -nofor_main' ;; lf95*) # Lahey Fortran 8.1 whole_archive_flag_spec= tmp_sharedflag='--shared' ;; nagfor*) # NAGFOR 5.3 tmp_sharedflag='-Wl,-shared' ;; xl[cC]* | bgxl[cC]* | mpixl[cC]*) # IBM XL C 8.0 on PPC (deal with xlf below) tmp_sharedflag='-qmkshrobj' tmp_addflag= ;; nvcc*) # Cuda Compiler Driver 2.2 whole_archive_flag_spec='$wl--whole-archive`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' compiler_needs_object=yes ;; esac case `$CC -V 2>&1 | sed 5q` in *Sun\ C*) # Sun C 5.9 whole_archive_flag_spec='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive' compiler_needs_object=yes tmp_sharedflag='-G' ;; *Sun\ F*) # Sun Fortran 8.3 tmp_sharedflag='-G' ;; esac archive_cmds='$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' if test yes = "$supports_anon_versioning"; then archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib' fi case $cc_basename in tcc*) export_dynamic_flag_spec='-rdynamic' ;; xlf* | bgf* | bgxlf* | mpixlf*) # IBM XL Fortran 10.1 on PPC cannot create shared libs itself whole_archive_flag_spec='--whole-archive$convenience --no-whole-archive' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib' if test yes = "$supports_anon_versioning"; then archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~ cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~ echo "local: *; };" >> $output_objdir/$libname.ver~ $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib' fi ;; esac else ld_shlibs=no fi ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib' wlarc= else archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' fi ;; solaris*) if $LD -v 2>&1 | $GREP 'BFD 2\.8' > /dev/null; then ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: The releases 2.8.* of the GNU linker cannot reliably *** create shared libraries on Solaris systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.9.1 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF elif $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX*) case `$LD -v 2>&1` in *\ [01].* | *\ 2.[0-9].* | *\ 2.1[0-5].*) ld_shlibs=no cat <<_LT_EOF 1>&2 *** Warning: Releases of the GNU linker prior to 2.16.91.0.3 cannot *** reliably create shared libraries on SCO systems. Therefore, libtool *** is disabling shared libraries support. We urge you to upgrade GNU *** binutils to release 2.16.91.0.3 or newer. Another option is to modify *** your PATH or compiler configuration so that the native linker is *** used, and then restart. _LT_EOF ;; *) # For security reasons, it is highly recommended that you always # use absolute paths for naming shared libraries, and exclude the # DT_RUNPATH tag from executables and libraries. But doing so # requires that you compile everything twice, which is a pain. if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; esac ;; sunos4*) archive_cmds='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags' wlarc= hardcode_direct=yes hardcode_shlibpath_var=no ;; *) if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib' else ld_shlibs=no fi ;; esac if test no = "$ld_shlibs"; then runpath_var= hardcode_libdir_flag_spec= export_dynamic_flag_spec= whole_archive_flag_spec= fi else # PORTME fill in a description of your system's linker (not GNU ld) case $host_os in aix3*) allow_undefined_flag=unsupported always_export_symbols=yes archive_expsym_cmds='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname' # Note: this linker hardcodes the directories in LIBPATH if there # are no directories specified by -L. hardcode_minus_L=yes if test yes = "$GCC" && test -z "$lt_prog_compiler_static"; then # Neither direct hardcoding nor static linking is supported with a # broken collect2. hardcode_direct=unsupported fi ;; aix[4-9]*) if test ia64 = "$host_cpu"; then # On IA64, the linker does run time linking by default, so we don't # have to do anything special. aix_use_runtimelinking=no exp_sym_flag='-Bexport' no_entry_flag= else # If we're using GNU nm, then we don't want the "-C" option. # -C means demangle to GNU nm, but means don't demangle to AIX nm. # Without the "-l" option, or with the "-B" option, AIX nm treats # weak defined symbols like other global defined symbols, whereas # GNU nm marks them as "W". # While the 'weak' keyword is ignored in the Export File, we need # it in the Import File for the 'aix-soname' feature, so we have # to replace the "-B" option with "-P" for AIX nm. if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then export_symbols_cmds='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && (substr(\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols' else export_symbols_cmds='`func_echo_all $NM | $SED -e '\''s/B\([^B]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && (substr(\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols' fi aix_use_runtimelinking=no # Test if we are trying to use run time linking or normal # AIX style linking. If -brtl is somewhere in LDFLAGS, we # have runtime linking enabled, and use it for executables. # For shared libraries, we enable/disable runtime linking # depending on the kind of the shared library created - # when "with_aix_soname,aix_use_runtimelinking" is: # "aix,no" lib.a(lib.so.V) shared, rtl:no, for executables # "aix,yes" lib.so shared, rtl:yes, for executables # lib.a static archive # "both,no" lib.so.V(shr.o) shared, rtl:yes # lib.a(lib.so.V) shared, rtl:no, for executables # "both,yes" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a(lib.so.V) shared, rtl:no # "svr4,*" lib.so.V(shr.o) shared, rtl:yes, for executables # lib.a static archive case $host_os in aix4.[23]|aix4.[23].*|aix[5-9]*) for ld_flag in $LDFLAGS; do if (test x-brtl = "x$ld_flag" || test x-Wl,-brtl = "x$ld_flag"); then aix_use_runtimelinking=yes break fi done if test svr4,no = "$with_aix_soname,$aix_use_runtimelinking"; then # With aix-soname=svr4, we create the lib.so.V shared archives only, # so we don't have lib.a shared libs to link our executables. # We have to force runtime linking in this case. aix_use_runtimelinking=yes LDFLAGS="$LDFLAGS -Wl,-brtl" fi ;; esac exp_sym_flag='-bexport' no_entry_flag='-bnoentry' fi # When large executables or shared objects are built, AIX ld can # have problems creating the table of contents. If linking a library # or program results in "error TOC overflow" add -mminimal-toc to # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS. archive_cmds='' hardcode_direct=yes hardcode_direct_absolute=yes hardcode_libdir_separator=':' link_all_deplibs=yes file_list_spec='$wl-f,' case $with_aix_soname,$aix_use_runtimelinking in aix,*) ;; # traditional, no import file svr4,* | *,yes) # use import file # The Import File defines what to hardcode. hardcode_direct=no hardcode_direct_absolute=no ;; esac if test yes = "$GCC"; then case $host_os in aix4.[012]|aix4.[012].*) # We only want to do this on AIX 4.2 and lower, the check # below for broken collect2 doesn't work under 4.3+ collect2name=`$CC -print-prog-name=collect2` if test -f "$collect2name" && strings "$collect2name" | $GREP resolve_lib_name >/dev/null then # We have reworked collect2 : else # We have old collect2 hardcode_direct=unsupported # It fails to find uninstalled libraries when the uninstalled # path is not listed in the libpath. Setting hardcode_minus_L # to unsupported forces relinking hardcode_minus_L=yes hardcode_libdir_flag_spec='-L$libdir' hardcode_libdir_separator= fi ;; esac shared_flag='-shared' if test yes = "$aix_use_runtimelinking"; then shared_flag="$shared_flag "'$wl-G' fi # Need to ensure runtime linking is disabled for the traditional # shared library, or the linker may eventually find shared libraries # /with/ Import File - we do not want to mix them. shared_flag_aix='-shared' shared_flag_svr4='-shared $wl-G' else # not using gcc if test ia64 = "$host_cpu"; then # VisualAge C++, Version 5.5 for AIX 5L for IA-64, Beta 3 Release # chokes on -Wl,-G. The following line is correct: shared_flag='-G' else if test yes = "$aix_use_runtimelinking"; then shared_flag='$wl-G' else shared_flag='$wl-bM:SRE' fi shared_flag_aix='$wl-bM:SRE' shared_flag_svr4='$wl-G' fi fi export_dynamic_flag_spec='$wl-bexpall' # It seems that -bexpall does not export symbols beginning with # underscore (_), so it is better to generate a list of symbols to export. always_export_symbols=yes if test aix,yes = "$with_aix_soname,$aix_use_runtimelinking"; then # Warning - without using the other runtime loading flags (-brtl), # -berok will link without error, but may produce a broken library. allow_undefined_flag='-berok' # Determine the default libpath from the value encoded in an # empty executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath_+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath_ fi hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath" archive_expsym_cmds='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag else if test ia64 = "$host_cpu"; then hardcode_libdir_flag_spec='$wl-R $libdir:/usr/lib:/lib' allow_undefined_flag="-z nodefs" archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols" else # Determine the default libpath from the value encoded in an # empty executable. if test set = "${lt_cv_aix_libpath+set}"; then aix_libpath=$lt_cv_aix_libpath else if ${lt_cv_aix_libpath_+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_aix_libpath_sed=' /Import File Strings/,/^$/ { /^0/ { s/^0 *\([^ ]*\) *$/\1/ p } }' lt_cv_aix_libpath_=`dump -H conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` # Check for a 64-bit object if we didn't find anything. if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"` fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext if test -z "$lt_cv_aix_libpath_"; then lt_cv_aix_libpath_=/usr/lib:/lib fi fi aix_libpath=$lt_cv_aix_libpath_ fi hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath" # Warning - without using the other run time loading flags, # -berok will link without error, but may produce a broken library. no_undefined_flag=' $wl-bernotok' allow_undefined_flag=' $wl-berok' if test yes = "$with_gnu_ld"; then # We only use this code for GNU lds that support --whole-archive. whole_archive_flag_spec='$wl--whole-archive$convenience $wl--no-whole-archive' else # Exported symbols can be pulled into shared objects from archives whole_archive_flag_spec='$convenience' fi archive_cmds_need_lc=yes archive_expsym_cmds='$RM -r $output_objdir/$realname.d~$MKDIR $output_objdir/$realname.d' # -brtl affects multiple linker settings, -berok does not and is overridden later compiler_flags_filtered='`func_echo_all "$compiler_flags " | $SED -e "s%-brtl\\([, ]\\)%-berok\\1%g"`' if test svr4 != "$with_aix_soname"; then # This is similar to how AIX traditionally builds its shared libraries. archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_aix' -o $output_objdir/$realname.d/$soname $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$realname.d/$soname' fi if test aix != "$with_aix_soname"; then archive_expsym_cmds="$archive_expsym_cmds"'~$CC '$shared_flag_svr4' -o $output_objdir/$realname.d/$shared_archive_member_spec.o $libobjs $deplibs $wl-bnoentry '$compiler_flags_filtered'$wl-bE:$export_symbols$allow_undefined_flag~$STRIP -e $output_objdir/$realname.d/$shared_archive_member_spec.o~( func_echo_all "#! $soname($shared_archive_member_spec.o)"; if test shr_64 = "$shared_archive_member_spec"; then func_echo_all "# 64"; else func_echo_all "# 32"; fi; cat $export_symbols ) > $output_objdir/$realname.d/$shared_archive_member_spec.imp~$AR $AR_FLAGS $output_objdir/$soname $output_objdir/$realname.d/$shared_archive_member_spec.o $output_objdir/$realname.d/$shared_archive_member_spec.imp' else # used by -dlpreopen to get the symbols archive_expsym_cmds="$archive_expsym_cmds"'~$MV $output_objdir/$realname.d/$soname $output_objdir' fi archive_expsym_cmds="$archive_expsym_cmds"'~$RM -r $output_objdir/$realname.d' fi fi ;; amigaos*) case $host_cpu in powerpc) # see comment about AmigaOS4 .so support archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib' archive_expsym_cmds='' ;; m68k) archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)' hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes ;; esac ;; bsdi[45]*) export_dynamic_flag_spec=-rdynamic ;; cygwin* | mingw* | pw32* | cegcc*) # When not using gcc, we currently assume that we are using # Microsoft Visual C++. # hardcode_libdir_flag_spec is actually meaningless, as there is # no search path for DLLs. case $cc_basename in cl*) # Native MSVC hardcode_libdir_flag_spec=' ' allow_undefined_flag=unsupported always_export_symbols=yes file_list_spec='@' # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. archive_cmds='$CC -o $output_objdir/$soname $libobjs $compiler_flags $deplibs -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~linknames=' archive_expsym_cmds='if test DEF = "`$SED -n -e '\''s/^[ ]*//'\'' -e '\''/^\(;.*\)*$/d'\'' -e '\''s/^\(EXPORTS\|LIBRARY\)\([ ].*\)*$/DEF/p'\'' -e q $export_symbols`" ; then cp "$export_symbols" "$output_objdir/$soname.def"; echo "$tool_output_objdir$soname.def" > "$output_objdir/$soname.exp"; else $SED -e '\''s/^/-link -EXPORT:/'\'' < $export_symbols > $output_objdir/$soname.exp; fi~ $CC -o $tool_output_objdir$soname $libobjs $compiler_flags $deplibs "@$tool_output_objdir$soname.exp" -Wl,-DLL,-IMPLIB:"$tool_output_objdir$libname.dll.lib"~ linknames=' # The linker will not automatically build a static lib if we build a DLL. # _LT_TAGVAR(old_archive_from_new_cmds, )='true' enable_shared_with_static_runtimes=yes exclude_expsyms='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*' export_symbols_cmds='$NM $libobjs $convenience | $global_symbol_pipe | $SED -e '\''/^[BCDGRS][ ]/s/.*[ ]\([^ ]*\)/\1,DATA/'\'' | $SED -e '\''/^[AITW][ ]/s/.*[ ]//'\'' | sort | uniq > $export_symbols' # Don't use ranlib old_postinstall_cmds='chmod 644 $oldlib' postlink_cmds='lt_outputfile="@OUTPUT@"~ lt_tool_outputfile="@TOOL_OUTPUT@"~ case $lt_outputfile in *.exe|*.EXE) ;; *) lt_outputfile=$lt_outputfile.exe lt_tool_outputfile=$lt_tool_outputfile.exe ;; esac~ if test : != "$MANIFEST_TOOL" && test -f "$lt_outputfile.manifest"; then $MANIFEST_TOOL -manifest "$lt_tool_outputfile.manifest" -outputresource:"$lt_tool_outputfile" || exit 1; $RM "$lt_outputfile.manifest"; fi' ;; *) # Assume MSVC wrapper hardcode_libdir_flag_spec=' ' allow_undefined_flag=unsupported # Tell ltmain to make .lib files, not .a files. libext=lib # Tell ltmain to make .dll files, not .so files. shrext_cmds=.dll # FIXME: Setting linknames here is a bad hack. archive_cmds='$CC -o $lib $libobjs $compiler_flags `func_echo_all "$deplibs" | $SED '\''s/ -lc$//'\''` -link -dll~linknames=' # The linker will automatically build a .lib file if we build a DLL. old_archive_from_new_cmds='true' # FIXME: Should let the user specify the lib program. old_archive_cmds='lib -OUT:$oldlib$oldobjs$old_deplibs' enable_shared_with_static_runtimes=yes ;; esac ;; darwin* | rhapsody*) archive_cmds_need_lc=no hardcode_direct=no hardcode_automatic=yes hardcode_shlibpath_var=unsupported if test yes = "$lt_cv_ld_force_load"; then whole_archive_flag_spec='`for conv in $convenience\"\"; do test -n \"$conv\" && new_convenience=\"$new_convenience $wl-force_load,$conv\"; done; func_echo_all \"$new_convenience\"`' else whole_archive_flag_spec='' fi link_all_deplibs=yes allow_undefined_flag=$_lt_dar_allow_undefined case $cc_basename in ifort*|nagfor*) _lt_dar_can_shared=yes ;; *) _lt_dar_can_shared=$GCC ;; esac if test yes = "$_lt_dar_can_shared"; then output_verbose_link_cmd=func_echo_all archive_cmds="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil" module_cmds="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil" archive_expsym_cmds="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil" module_expsym_cmds="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil" else ld_shlibs=no fi ;; dgux*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_libdir_flag_spec='-L$libdir' hardcode_shlibpath_var=no ;; # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor # support. Future versions do this automatically, but an explicit c++rt0.o # does not break anything, and helps significantly (at the cost of a little # extra space). freebsd2.2*) archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o' hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; # Unfortunately, older versions of FreeBSD 2 do not have this feature. freebsd2.*) archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes hardcode_minus_L=yes hardcode_shlibpath_var=no ;; # FreeBSD 3 and greater uses gcc -shared to do shared libraries. freebsd* | dragonfly*) archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; hpux9*) if test yes = "$GCC"; then archive_cmds='$RM $output_objdir/$soname~$CC -shared $pic_flag $wl+b $wl$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' else archive_cmds='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib' fi hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: hardcode_direct=yes # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes export_dynamic_flag_spec='$wl-E' ;; hpux10*) if test yes,no = "$GCC,$with_gnu_ld"; then archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi if test no = "$with_gnu_ld"; then hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: hardcode_direct=yes hardcode_direct_absolute=yes export_dynamic_flag_spec='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes fi ;; hpux11*) if test yes,no = "$GCC,$with_gnu_ld"; then case $host_cpu in hppa*64*) archive_cmds='$CC -shared $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) archive_cmds='$CC -shared $pic_flag $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' ;; esac else case $host_cpu in hppa*64*) archive_cmds='$CC -b $wl+h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' ;; ia64*) archive_cmds='$CC -b $wl+h $wl$soname $wl+nodefaultrpath -o $lib $libobjs $deplibs $compiler_flags' ;; *) # Older versions of the 11.00 compiler do not understand -b yet # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does) { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5 $as_echo_n "checking if $CC understands -b... " >&6; } if ${lt_cv_prog_compiler__b+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_prog_compiler__b=no save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -b" echo "$lt_simple_link_test_code" > conftest.$ac_ext if (eval $ac_link 2>conftest.err) && test -s conftest$ac_exeext; then # The linker can only warn and ignore the option if not recognized # So say no if there are warnings if test -s conftest.err; then # Append any errors to the config.log. cat conftest.err 1>&5 $ECHO "$_lt_linker_boilerplate" | $SED '/^$/d' > conftest.exp $SED '/^$/d; /^ *+/d' conftest.err >conftest.er2 if diff conftest.exp conftest.er2 >/dev/null; then lt_cv_prog_compiler__b=yes fi else lt_cv_prog_compiler__b=yes fi fi $RM -r conftest* LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5 $as_echo "$lt_cv_prog_compiler__b" >&6; } if test yes = "$lt_cv_prog_compiler__b"; then archive_cmds='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' fi ;; esac fi if test no = "$with_gnu_ld"; then hardcode_libdir_flag_spec='$wl+b $wl$libdir' hardcode_libdir_separator=: case $host_cpu in hppa*64*|ia64*) hardcode_direct=no hardcode_shlibpath_var=no ;; *) hardcode_direct=yes hardcode_direct_absolute=yes export_dynamic_flag_spec='$wl-E' # hardcode_minus_L: Not really in the search PATH, # but as the default location of the library. hardcode_minus_L=yes ;; esac fi ;; irix5* | irix6* | nonstopux*) if test yes = "$GCC"; then archive_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' # Try to use the -exported_symbol ld option, if it does not # work, assume that -exports_file does not work either and # implicitly export all symbols. # This should be the same for all languages, so no per-tag cache variable. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5 $as_echo_n "checking whether the $host_os linker accepts -exported_symbol... " >&6; } if ${lt_cv_irix_exported_symbol+:} false; then : $as_echo_n "(cached) " >&6 else save_LDFLAGS=$LDFLAGS LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int foo (void) { return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : lt_cv_irix_exported_symbol=yes else lt_cv_irix_exported_symbol=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5 $as_echo "$lt_cv_irix_exported_symbol" >&6; } if test yes = "$lt_cv_irix_exported_symbol"; then archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib' fi link_all_deplibs=no else archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib' fi archive_cmds_need_lc='no' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: inherit_rpath=yes link_all_deplibs=yes ;; linux*) case $cc_basename in tcc*) # Fabrice Bellard et al's Tiny C Compiler ld_shlibs=yes archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' ;; esac ;; netbsd* | netbsdelf*-gnu) if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out else archive_cmds='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF fi hardcode_libdir_flag_spec='-R$libdir' hardcode_direct=yes hardcode_shlibpath_var=no ;; newsos6) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: hardcode_shlibpath_var=no ;; *nto* | *qnx*) ;; openbsd* | bitrig*) if test -f /usr/libexec/ld.so; then hardcode_direct=yes hardcode_shlibpath_var=no hardcode_direct_absolute=yes if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols' hardcode_libdir_flag_spec='$wl-rpath,$libdir' export_dynamic_flag_spec='$wl-E' else archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags' hardcode_libdir_flag_spec='$wl-rpath,$libdir' fi else ld_shlibs=no fi ;; os2*) hardcode_libdir_flag_spec='-L$libdir' hardcode_minus_L=yes allow_undefined_flag=unsupported shrext_cmds=.dll archive_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ emxexp $libobjs | $SED /"_DLL_InitTerm"/d >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' archive_expsym_cmds='$ECHO "LIBRARY ${soname%$shared_ext} INITINSTANCE TERMINSTANCE" > $output_objdir/$libname.def~ $ECHO "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~ $ECHO "DATA MULTIPLE NONSHARED" >> $output_objdir/$libname.def~ $ECHO EXPORTS >> $output_objdir/$libname.def~ prefix_cmds="$SED"~ if test EXPORTS = "`$SED 1q $export_symbols`"; then prefix_cmds="$prefix_cmds -e 1d"; fi~ prefix_cmds="$prefix_cmds -e \"s/^\(.*\)$/_\1/g\""~ cat $export_symbols | $prefix_cmds >> $output_objdir/$libname.def~ $CC -Zdll -Zcrtdll -o $output_objdir/$soname $libobjs $deplibs $compiler_flags $output_objdir/$libname.def~ emximp -o $lib $output_objdir/$libname.def' old_archive_From_new_cmds='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def' enable_shared_with_static_runtimes=yes ;; osf3*) if test yes = "$GCC"; then allow_undefined_flag=' $wl-expect_unresolved $wl\*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' else allow_undefined_flag=' -expect_unresolved \*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' fi archive_cmds_need_lc='no' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' hardcode_libdir_separator=: ;; osf4* | osf5*) # as osf3* with the addition of -msym flag if test yes = "$GCC"; then allow_undefined_flag=' $wl-expect_unresolved $wl\*' archive_cmds='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib' hardcode_libdir_flag_spec='$wl-rpath $wl$libdir' else allow_undefined_flag=' -expect_unresolved \*' archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib' archive_expsym_cmds='for i in `cat $export_symbols`; do printf "%s %s\\n" -exported_symbol "\$i" >> $lib.exp; done; printf "%s\\n" "-hidden">> $lib.exp~ $CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp' # Both c and cxx compiler support -rpath directly hardcode_libdir_flag_spec='-rpath $libdir' fi archive_cmds_need_lc='no' hardcode_libdir_separator=: ;; solaris*) no_undefined_flag=' -z defs' if test yes = "$GCC"; then wlarc='$wl' archive_cmds='$CC -shared $pic_flag $wl-z ${wl}text $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -shared $pic_flag $wl-z ${wl}text $wl-M $wl$lib.exp $wl-h $wl$soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' else case `$CC -V 2>&1` in *"Compilers 5.0"*) wlarc='' archive_cmds='$LD -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $linker_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $LD -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$RM $lib.exp' ;; *) wlarc='$wl' archive_cmds='$CC -G$allow_undefined_flag -h $soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='echo "{ global:" > $lib.exp~cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $lib.exp~echo "local: *; };" >> $lib.exp~ $CC -G$allow_undefined_flag -M $lib.exp -h $soname -o $lib $libobjs $deplibs $compiler_flags~$RM $lib.exp' ;; esac fi hardcode_libdir_flag_spec='-R$libdir' hardcode_shlibpath_var=no case $host_os in solaris2.[0-5] | solaris2.[0-5].*) ;; *) # The compiler driver will combine and reorder linker options, # but understands '-z linker_flag'. GCC discards it without '$wl', # but is careful enough not to reorder. # Supported since Solaris 2.6 (maybe 2.5.1?) if test yes = "$GCC"; then whole_archive_flag_spec='$wl-z ${wl}allextract$convenience $wl-z ${wl}defaultextract' else whole_archive_flag_spec='-z allextract$convenience -z defaultextract' fi ;; esac link_all_deplibs=yes ;; sunos4*) if test sequent = "$host_vendor"; then # Use $CC to link under sequent, because it throws in some extra .o # files that make .init and .fini sections work. archive_cmds='$CC -G $wl-h $soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags' fi hardcode_libdir_flag_spec='-L$libdir' hardcode_direct=yes hardcode_minus_L=yes hardcode_shlibpath_var=no ;; sysv4) case $host_vendor in sni) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=yes # is this really true??? ;; siemens) ## LD is ld it makes a PLAMLIB ## CC just makes a GrossModule. archive_cmds='$LD -G -o $lib $libobjs $deplibs $linker_flags' reload_cmds='$CC -r -o $output$reload_objs' hardcode_direct=no ;; motorola) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_direct=no #Motorola manual says yes, but my tests say they lie ;; esac runpath_var='LD_RUN_PATH' hardcode_shlibpath_var=no ;; sysv4.3*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_shlibpath_var=no export_dynamic_flag_spec='-Bexport' ;; sysv4*MP*) if test -d /usr/nec; then archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_shlibpath_var=no runpath_var=LD_RUN_PATH hardcode_runpath_var=yes ld_shlibs=yes fi ;; sysv4*uw2* | sysv5OpenUNIX* | sysv5UnixWare7.[01].[10]* | unixware7* | sco3.2v5.0.[024]*) no_undefined_flag='$wl-z,text' archive_cmds_need_lc=no hardcode_shlibpath_var=no runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; sysv5* | sco3.2v5* | sco5v6*) # Note: We CANNOT use -z defs as we might desire, because we do not # link with -lc, and that would cause any symbols used from libc to # always be unresolved, which means just about no library would # ever link correctly. If we're not using GNU ld we use -z text # though, which does catch some bad symbols but isn't as heavy-handed # as -z defs. no_undefined_flag='$wl-z,text' allow_undefined_flag='$wl-z,nodefs' archive_cmds_need_lc=no hardcode_shlibpath_var=no hardcode_libdir_flag_spec='$wl-R,$libdir' hardcode_libdir_separator=':' link_all_deplibs=yes export_dynamic_flag_spec='$wl-Bexport' runpath_var='LD_RUN_PATH' if test yes = "$GCC"; then archive_cmds='$CC -shared $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -shared $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' else archive_cmds='$CC -G $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' archive_expsym_cmds='$CC -G $wl-Bexport:$export_symbols $wl-h,$soname -o $lib $libobjs $deplibs $compiler_flags' fi ;; uts4*) archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags' hardcode_libdir_flag_spec='-L$libdir' hardcode_shlibpath_var=no ;; *) ld_shlibs=no ;; esac if test sni = "$host_vendor"; then case $host in sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*) export_dynamic_flag_spec='$wl-Blargedynsym' ;; esac fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5 $as_echo "$ld_shlibs" >&6; } test no = "$ld_shlibs" && can_build_shared=no with_gnu_ld=$with_gnu_ld # # Do we need to explicitly link libc? # case "x$archive_cmds_need_lc" in x|xyes) # Assume -lc should be added archive_cmds_need_lc=yes if test yes,yes = "$GCC,$enable_shared"; then case $archive_cmds in *'~'*) # FIXME: we may have to deal with multi-command sequences. ;; '$CC '*) # Test whether the compiler implicitly links with -lc since on some # systems, -lgcc has to come before -lc. If gcc already passes -lc # to ld, don't add -lc before -lgcc. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5 $as_echo_n "checking whether -lc should be explicitly linked in... " >&6; } if ${lt_cv_archive_cmds_need_lc+:} false; then : $as_echo_n "(cached) " >&6 else $RM conftest* echo "$lt_simple_compile_test_code" > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } 2>conftest.err; then soname=conftest lib=conftest libobjs=conftest.$ac_objext deplibs= wl=$lt_prog_compiler_wl pic_flag=$lt_prog_compiler_pic compiler_flags=-v linker_flags=-v verstring= output_objdir=. libname=conftest lt_save_allow_undefined_flag=$allow_undefined_flag allow_undefined_flag= if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5 (eval $archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } then lt_cv_archive_cmds_need_lc=no else lt_cv_archive_cmds_need_lc=yes fi allow_undefined_flag=$lt_save_allow_undefined_flag else cat conftest.err 1>&5 fi $RM conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5 $as_echo "$lt_cv_archive_cmds_need_lc" >&6; } archive_cmds_need_lc=$lt_cv_archive_cmds_need_lc ;; esac fi ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5 $as_echo_n "checking dynamic linker characteristics... " >&6; } if test yes = "$GCC"; then case $host_os in darwin*) lt_awk_arg='/^libraries:/,/LR/' ;; *) lt_awk_arg='/^libraries:/' ;; esac case $host_os in mingw* | cegcc*) lt_sed_strip_eq='s|=\([A-Za-z]:\)|\1|g' ;; *) lt_sed_strip_eq='s|=/|/|g' ;; esac lt_search_path_spec=`$CC -print-search-dirs | awk $lt_awk_arg | $SED -e "s/^libraries://" -e $lt_sed_strip_eq` case $lt_search_path_spec in *\;*) # if the path contains ";" then we assume it to be the separator # otherwise default to the standard path separator (i.e. ":") - it is # assumed that no part of a normal pathname contains ";" but that should # okay in the real world where ";" in dirpaths is itself problematic. lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED 's/;/ /g'` ;; *) lt_search_path_spec=`$ECHO "$lt_search_path_spec" | $SED "s/$PATH_SEPARATOR/ /g"` ;; esac # Ok, now we have the path, separated by spaces, we can step through it # and add multilib dir if necessary... lt_tmp_lt_search_path_spec= lt_multi_os_dir=/`$CC $CPPFLAGS $CFLAGS $LDFLAGS -print-multi-os-directory 2>/dev/null` # ...but if some path component already ends with the multilib dir we assume # that all is fine and trust -print-search-dirs as is (GCC 4.2? or newer). case "$lt_multi_os_dir; $lt_search_path_spec " in "/; "* | "/.; "* | "/./; "* | *"$lt_multi_os_dir "* | *"$lt_multi_os_dir/ "*) lt_multi_os_dir= ;; esac for lt_sys_path in $lt_search_path_spec; do if test -d "$lt_sys_path$lt_multi_os_dir"; then lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path$lt_multi_os_dir" elif test -n "$lt_multi_os_dir"; then test -d "$lt_sys_path" && \ lt_tmp_lt_search_path_spec="$lt_tmp_lt_search_path_spec $lt_sys_path" fi done lt_search_path_spec=`$ECHO "$lt_tmp_lt_search_path_spec" | awk ' BEGIN {RS = " "; FS = "/|\n";} { lt_foo = ""; lt_count = 0; for (lt_i = NF; lt_i > 0; lt_i--) { if ($lt_i != "" && $lt_i != ".") { if ($lt_i == "..") { lt_count++; } else { if (lt_count == 0) { lt_foo = "/" $lt_i lt_foo; } else { lt_count--; } } } } if (lt_foo != "") { lt_freq[lt_foo]++; } if (lt_freq[lt_foo] == 1) { print lt_foo; } }'` # AWK program above erroneously prepends '/' to C:/dos/paths # for these hosts. case $host_os in mingw* | cegcc*) lt_search_path_spec=`$ECHO "$lt_search_path_spec" |\ $SED 's|/\([A-Za-z]:\)|\1|g'` ;; esac sys_lib_search_path_spec=`$ECHO "$lt_search_path_spec" | $lt_NL2SP` else sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" fi library_names_spec= libname_spec='lib$name' soname_spec= shrext_cmds=.so postinstall_cmds= postuninstall_cmds= finish_cmds= finish_eval= shlibpath_var= shlibpath_overrides_runpath=unknown version_type=none dynamic_linker="$host_os ld.so" sys_lib_dlsearch_path_spec="/lib /usr/lib" need_lib_prefix=unknown hardcode_into_libs=no # when you set need_version to no, make sure it does not cause -set_version # flags to be left without arguments need_version=unknown case $host_os in aix3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname.a' shlibpath_var=LIBPATH # AIX 3 has no versioning support, so we append a major version to the name. soname_spec='$libname$release$shared_ext$major' ;; aix[4-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no hardcode_into_libs=yes if test ia64 = "$host_cpu"; then # AIX 5 supports IA64 library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH else # With GCC up to 2.95.x, collect2 would create an import file # for dependence libraries. The import file would start with # the line '#! .'. This would cause the generated library to # depend on '.', always an invalid library. This was fixed in # development snapshots of GCC prior to 3.0. case $host_os in aix4 | aix4.[01] | aix4.[01].*) if { echo '#if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 97)' echo ' yes ' echo '#endif'; } | $CC -E - | $GREP yes > /dev/null; then : else can_build_shared=no fi ;; esac # Using Import Files as archive members, it is possible to support # filename-based versioning of shared library archives on AIX. While # this would work for both with and without runtime linking, it will # prevent static linking of such archives. So we do filename-based # shared library versioning with .so extension only, which is used # when both runtime linking and shared linking is enabled. # Unfortunately, runtime linking may impact performance, so we do # not want this to be the default eventually. Also, we use the # versioned .so libs for executables only if there is the -brtl # linker flag in LDFLAGS as well, or --with-aix-soname=svr4 only. # To allow for filename-based versioning support, we need to create # libNAME.so.V as an archive file, containing: # *) an Import File, referring to the versioned filename of the # archive as well as the shared archive member, telling the # bitwidth (32 or 64) of that shared object, and providing the # list of exported symbols of that shared object, eventually # decorated with the 'weak' keyword # *) the shared object with the F_LOADONLY flag set, to really avoid # it being seen by the linker. # At run time we better use the real file rather than another symlink, # but for link time we create the symlink libNAME.so -> libNAME.so.V case $with_aix_soname,$aix_use_runtimelinking in # AIX (on Power*) has no versioning support, so currently we cannot hardcode correct # soname into executable. Probably we can add versioning support to # collect2, so additional links can be useful in future. aix,yes) # traditional libtool dynamic_linker='AIX unversionable lib.so' # If using run time linking (on AIX 4.2 or later) use lib.so # instead of lib.a to let people know that these are not # typical AIX shared libraries. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; aix,no) # traditional AIX only dynamic_linker='AIX lib.a(lib.so.V)' # We preserve .a as extension for shared libraries through AIX4.2 # and later when we are not doing run time linking. library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' ;; svr4,*) # full svr4 only dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,yes) # both, prefer svr4 dynamic_linker="AIX lib.so.V($shared_archive_member_spec.o), lib.a(lib.so.V)" library_names_spec='$libname$release$shared_ext$major $libname$shared_ext' # unpreferred sharedlib libNAME.a needs extra handling postinstall_cmds='test -n "$linkname" || linkname="$realname"~func_stripname "" ".so" "$linkname"~$install_shared_prog "$dir/$func_stripname_result.$libext" "$destdir/$func_stripname_result.$libext"~test -z "$tstripme" || test -z "$striplib" || $striplib "$destdir/$func_stripname_result.$libext"' postuninstall_cmds='for n in $library_names $old_library; do :; done~func_stripname "" ".so" "$n"~test "$func_stripname_result" = "$n" || func_append rmfiles " $odir/$func_stripname_result.$libext"' # We do not specify a path in Import Files, so LIBPATH fires. shlibpath_overrides_runpath=yes ;; *,no) # both, prefer aix dynamic_linker="AIX lib.a(lib.so.V), lib.so.V($shared_archive_member_spec.o)" library_names_spec='$libname$release.a $libname.a' soname_spec='$libname$release$shared_ext$major' # unpreferred sharedlib libNAME.so.V and symlink libNAME.so need extra handling postinstall_cmds='test -z "$dlname" || $install_shared_prog $dir/$dlname $destdir/$dlname~test -z "$tstripme" || test -z "$striplib" || $striplib $destdir/$dlname~test -n "$linkname" || linkname=$realname~func_stripname "" ".a" "$linkname"~(cd "$destdir" && $LN_S -f $dlname $func_stripname_result.so)' postuninstall_cmds='test -z "$dlname" || func_append rmfiles " $odir/$dlname"~for n in $old_library $library_names; do :; done~func_stripname "" ".a" "$n"~func_append rmfiles " $odir/$func_stripname_result.so"' ;; esac shlibpath_var=LIBPATH fi ;; amigaos*) case $host_cpu in powerpc) # Since July 2007 AmigaOS4 officially supports .so libraries. # When compiling the executable, add -use-dynld -Lsobjs: to the compileline. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' ;; m68k) library_names_spec='$libname.ixlibrary $libname.a' # Create ${libname}_ixlibrary.a entries in /sys/libs. finish_eval='for lib in `ls $libdir/*.ixlibrary 2>/dev/null`; do libname=`func_echo_all "$lib" | $SED '\''s%^.*/\([^/]*\)\.ixlibrary$%\1%'\''`; $RM /sys/libs/${libname}_ixlibrary.a; $show "cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a"; cd /sys/libs && $LN_S $lib ${libname}_ixlibrary.a || exit 1; done' ;; esac ;; beos*) library_names_spec='$libname$shared_ext' dynamic_linker="$host_os ld.so" shlibpath_var=LIBRARY_PATH ;; bsdi[45]*) version_type=linux # correct to gnu/linux during the next big refactor need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/shlib /usr/lib /usr/X11/lib /usr/contrib/lib /lib /usr/local/lib" sys_lib_dlsearch_path_spec="/shlib /usr/lib /usr/local/lib" # the default ld.so.conf also contains /usr/contrib/lib and # /usr/X11R6/lib (/usr/X11 is a link to /usr/X11R6), but let us allow # libtool to hard-code these into programs ;; cygwin* | mingw* | pw32* | cegcc*) version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no case $GCC,$cc_basename in yes,*) # gcc library_names_spec='$libname.dll.a' # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes case $host_os in cygwin*) # Cygwin DLLs use 'cyg' prefix rather than 'lib' soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api" ;; mingw* | cegcc*) # MinGW DLLs use traditional 'lib' prefix soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; pw32*) # pw32 DLLs use 'pw' prefix rather than 'lib' library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' ;; esac dynamic_linker='Win32 ld.exe' ;; *,cl*) # Native MSVC libname_spec='$name' soname_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext' library_names_spec='$libname.dll.lib' case $build_os in mingw*) sys_lib_search_path_spec= lt_save_ifs=$IFS IFS=';' for lt_path in $LIB do IFS=$lt_save_ifs # Let DOS variable expansion print the short 8.3 style file name. lt_path=`cd "$lt_path" 2>/dev/null && cmd //C "for %i in (".") do @echo %~si"` sys_lib_search_path_spec="$sys_lib_search_path_spec $lt_path" done IFS=$lt_save_ifs # Convert to MSYS style. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([a-zA-Z]\\):| /\\1|g' -e 's|^ ||'` ;; cygwin*) # Convert to unix form, then to dos form, then back to unix form # but this time dos style (no spaces!) so that the unix form looks # like /cygdrive/c/PROGRA~1:/cygdr... sys_lib_search_path_spec=`cygpath --path --unix "$LIB"` sys_lib_search_path_spec=`cygpath --path --dos "$sys_lib_search_path_spec" 2>/dev/null` sys_lib_search_path_spec=`cygpath --path --unix "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` ;; *) sys_lib_search_path_spec=$LIB if $ECHO "$sys_lib_search_path_spec" | $GREP ';[c-zC-Z]:/' >/dev/null; then # It is most probably a Windows format PATH. sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's/;/ /g'` else sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e "s/$PATH_SEPARATOR/ /g"` fi # FIXME: find the short name or the path components, as spaces are # common. (e.g. "Program Files" -> "PROGRA~1") ;; esac # DLL is installed to $(libdir)/../bin by postinstall_cmds postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; echo \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; echo \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' shlibpath_overrides_runpath=yes dynamic_linker='Win32 link.exe' ;; *) # Assume MSVC wrapper library_names_spec='$libname`echo $release | $SED -e 's/[.]/-/g'`$versuffix$shared_ext $libname.lib' dynamic_linker='Win32 ld.exe' ;; esac # FIXME: first we should search . and the directory the executable is in shlibpath_var=PATH ;; darwin* | rhapsody*) dynamic_linker="$host_os dyld" version_type=darwin need_lib_prefix=no need_version=no library_names_spec='$libname$release$major$shared_ext $libname$shared_ext' soname_spec='$libname$release$major$shared_ext' shlibpath_overrides_runpath=yes shlibpath_var=DYLD_LIBRARY_PATH shrext_cmds='`test .$module = .yes && echo .so || echo .dylib`' sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/local/lib" sys_lib_dlsearch_path_spec='/usr/local/lib /lib /usr/lib' ;; dgux*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; freebsd* | dragonfly*) # DragonFly does not have aout. When/if they implement a new # versioning mechanism, adjust this. if test -x /usr/bin/objformat; then objformat=`/usr/bin/objformat` else case $host_os in freebsd[23].*) objformat=aout ;; *) objformat=elf ;; esac fi version_type=freebsd-$objformat case $version_type in freebsd-elf*) library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' need_version=no need_lib_prefix=no ;; freebsd-*) library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' need_version=yes ;; esac shlibpath_var=LD_LIBRARY_PATH case $host_os in freebsd2.*) shlibpath_overrides_runpath=yes ;; freebsd3.[01]* | freebsdelf3.[01]*) shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; freebsd3.[2-9]* | freebsdelf3.[2-9]* | \ freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1) shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; *) # from 4.6 on, and DragonFly shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; esac ;; haiku*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no dynamic_linker="$host_os runtime_loader" library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LIBRARY_PATH shlibpath_overrides_runpath=no sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib' hardcode_into_libs=yes ;; hpux9* | hpux10* | hpux11*) # Give a soname corresponding to the major version so that dld.sl refuses to # link against other versions. version_type=sunos need_lib_prefix=no need_version=no case $host_cpu in ia64*) shrext_cmds='.so' hardcode_into_libs=yes dynamic_linker="$host_os dld.so" shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' if test 32 = "$HPUX_IA64_MODE"; then sys_lib_search_path_spec="/usr/lib/hpux32 /usr/local/lib/hpux32 /usr/local/lib" sys_lib_dlsearch_path_spec=/usr/lib/hpux32 else sys_lib_search_path_spec="/usr/lib/hpux64 /usr/local/lib/hpux64" sys_lib_dlsearch_path_spec=/usr/lib/hpux64 fi ;; hppa*64*) shrext_cmds='.sl' hardcode_into_libs=yes dynamic_linker="$host_os dld.sl" shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH shlibpath_overrides_runpath=yes # Unless +noenvvar is specified. library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' sys_lib_search_path_spec="/usr/lib/pa20_64 /usr/ccs/lib/pa20_64" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; *) shrext_cmds='.sl' dynamic_linker="$host_os dld.sl" shlibpath_var=SHLIB_PATH shlibpath_overrides_runpath=no # +s is required to enable SHLIB_PATH library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' ;; esac # HP-UX runs *really* slowly unless shared libraries are mode 555, ... postinstall_cmds='chmod 555 $lib' # or fails outright, so override atomically: install_override_mode=555 ;; interix[3-9]*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; irix5* | irix6* | nonstopux*) case $host_os in nonstopux*) version_type=nonstopux ;; *) if test yes = "$lt_cv_prog_gnu_ld"; then version_type=linux # correct to gnu/linux during the next big refactor else version_type=irix fi ;; esac need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$release$shared_ext $libname$shared_ext' case $host_os in irix5* | nonstopux*) libsuff= shlibsuff= ;; *) case $LD in # libtool.m4 will add one of these switches to LD *-32|*"-32 "|*-melf32bsmip|*"-melf32bsmip ") libsuff= shlibsuff= libmagic=32-bit;; *-n32|*"-n32 "|*-melf32bmipn32|*"-melf32bmipn32 ") libsuff=32 shlibsuff=N32 libmagic=N32;; *-64|*"-64 "|*-melf64bmip|*"-melf64bmip ") libsuff=64 shlibsuff=64 libmagic=64-bit;; *) libsuff= shlibsuff= libmagic=never-match;; esac ;; esac shlibpath_var=LD_LIBRARY${shlibsuff}_PATH shlibpath_overrides_runpath=no sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff" sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff" hardcode_into_libs=yes ;; # No shared lib support for Linux oldld, aout, or coff. linux*oldld* | linux*aout* | linux*coff*) dynamic_linker=no ;; linux*android*) version_type=none # Android doesn't support versioned libraries. need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext' soname_spec='$libname$release$shared_ext' finish_cmds= shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes dynamic_linker='Android linker' # Don't embed -rpath directories since the linker doesn't support them. hardcode_libdir_flag_spec='-L$libdir' ;; # This must be glibc/ELF. linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' finish_cmds='PATH="\$PATH:/sbin" ldconfig -n $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no # Some binutils ld are patched to set DT_RUNPATH if ${lt_cv_shlibpath_overrides_runpath+:} false; then : $as_echo_n "(cached) " >&6 else lt_cv_shlibpath_overrides_runpath=no save_LDFLAGS=$LDFLAGS save_libdir=$libdir eval "libdir=/foo; wl=\"$lt_prog_compiler_wl\"; \ LDFLAGS=\"\$LDFLAGS $hardcode_libdir_flag_spec\"" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null; then : lt_cv_shlibpath_overrides_runpath=yes fi fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS=$save_LDFLAGS libdir=$save_libdir fi shlibpath_overrides_runpath=$lt_cv_shlibpath_overrides_runpath # This implies no fast_install, which is unacceptable. # Some rework will be needed to allow for fast_install # before this can be enabled. hardcode_into_libs=yes # Ideally, we could use ldconfig to report *all* directores which are # searched for libraries, however this is still not possible. Aside from not # being certain /sbin/ldconfig is available, command # 'ldconfig -N -X -v | grep ^/' on 64bit Fedora does not report /usr/lib64, # even though it is searched at run-time. Try to do the best guess by # appending ld.so.conf contents (and includes) to the search path. if test -f /etc/ld.so.conf; then lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" fi # We used to test for /lib/ld.so.1 and disable shared libraries on # powerpc, because MkLinux only supported shared libraries with the # GNU dynamic linker. Since this was broken with cross compilers, # most powerpc-linux boxes support dynamic linking these days and # people can always --disable-shared, the test was removed, and we # assume the GNU/Linux dynamic linker is in use. dynamic_linker='GNU/Linux ld.so' ;; netbsdelf*-gnu) version_type=linux need_lib_prefix=no need_version=no library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}' soname_spec='${libname}${release}${shared_ext}$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='NetBSD ld.elf_so' ;; netbsd*) version_type=sunos need_lib_prefix=no need_version=no if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' dynamic_linker='NetBSD (a.out) ld.so' else library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' dynamic_linker='NetBSD ld.elf_so' fi shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes ;; newsos6) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; *nto* | *qnx*) version_type=qnx need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes dynamic_linker='ldqnx.so' ;; openbsd* | bitrig*) version_type=sunos sys_lib_dlsearch_path_spec=/usr/lib need_lib_prefix=no if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then need_version=no else need_version=yes fi library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/sbin" ldconfig -m $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes ;; os2*) libname_spec='$name' version_type=windows shrext_cmds=.dll need_version=no need_lib_prefix=no # OS/2 can only load a DLL with a base name of 8 characters or less. soname_spec='`test -n "$os2dllname" && libname="$os2dllname"; v=$($ECHO $release$versuffix | tr -d .-); n=$($ECHO $libname | cut -b -$((8 - ${#v})) | tr . _); $ECHO $n$v`$shared_ext' library_names_spec='${libname}_dll.$libext' dynamic_linker='OS/2 ld.exe' shlibpath_var=BEGINLIBPATH sys_lib_search_path_spec="/lib /usr/lib /usr/local/lib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec postinstall_cmds='base_file=`basename \$file`~ dlpath=`$SHELL 2>&1 -c '\''. $dir/'\''\$base_file'\''i; $ECHO \$dlname'\''`~ dldir=$destdir/`dirname \$dlpath`~ test -d \$dldir || mkdir -p \$dldir~ $install_prog $dir/$dlname \$dldir/$dlname~ chmod a+x \$dldir/$dlname~ if test -n '\''$stripme'\'' && test -n '\''$striplib'\''; then eval '\''$striplib \$dldir/$dlname'\'' || exit \$?; fi' postuninstall_cmds='dldll=`$SHELL 2>&1 -c '\''. $file; $ECHO \$dlname'\''`~ dlpath=$dir/\$dldll~ $RM \$dlpath' ;; osf3* | osf4* | osf5*) version_type=osf need_lib_prefix=no need_version=no soname_spec='$libname$release$shared_ext$major' library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH sys_lib_search_path_spec="/usr/shlib /usr/ccs/lib /usr/lib/cmplrs/cc /usr/lib /usr/local/lib /var/shlib" sys_lib_dlsearch_path_spec=$sys_lib_search_path_spec ;; rdos*) dynamic_linker=no ;; solaris*) version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes # ldd complains unless libraries are executable postinstall_cmds='chmod +x $lib' ;; sunos4*) version_type=sunos library_names_spec='$libname$release$shared_ext$versuffix $libname$shared_ext$versuffix' finish_cmds='PATH="\$PATH:/usr/etc" ldconfig $libdir' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes if test yes = "$with_gnu_ld"; then need_lib_prefix=no fi need_version=yes ;; sysv4 | sysv4.3*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH case $host_vendor in sni) shlibpath_overrides_runpath=no need_lib_prefix=no runpath_var=LD_RUN_PATH ;; siemens) need_lib_prefix=no ;; motorola) need_lib_prefix=no need_version=no shlibpath_overrides_runpath=no sys_lib_search_path_spec='/lib /usr/lib /usr/ccs/lib' ;; esac ;; sysv4*MP*) if test -d /usr/nec; then version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$shared_ext.$versuffix $libname$shared_ext.$major $libname$shared_ext' soname_spec='$libname$shared_ext.$major' shlibpath_var=LD_LIBRARY_PATH fi ;; sysv5* | sco3.2v5* | sco5v6* | unixware* | OpenUNIX* | sysv4*uw2*) version_type=sco need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=yes hardcode_into_libs=yes if test yes = "$with_gnu_ld"; then sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib' else sys_lib_search_path_spec='/usr/ccs/lib /usr/lib' case $host_os in sco3.2v5*) sys_lib_search_path_spec="$sys_lib_search_path_spec /lib" ;; esac fi sys_lib_dlsearch_path_spec='/usr/lib' ;; tpf*) # TPF is a cross-target only. Preferred cross-host = GNU/Linux. version_type=linux # correct to gnu/linux during the next big refactor need_lib_prefix=no need_version=no library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' shlibpath_var=LD_LIBRARY_PATH shlibpath_overrides_runpath=no hardcode_into_libs=yes ;; uts4*) version_type=linux # correct to gnu/linux during the next big refactor library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext' soname_spec='$libname$release$shared_ext$major' shlibpath_var=LD_LIBRARY_PATH ;; *) dynamic_linker=no ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5 $as_echo "$dynamic_linker" >&6; } test no = "$dynamic_linker" && can_build_shared=no variables_saved_for_relink="PATH $shlibpath_var $runpath_var" if test yes = "$GCC"; then variables_saved_for_relink="$variables_saved_for_relink GCC_EXEC_PREFIX COMPILER_PATH LIBRARY_PATH" fi if test set = "${lt_cv_sys_lib_search_path_spec+set}"; then sys_lib_search_path_spec=$lt_cv_sys_lib_search_path_spec fi if test set = "${lt_cv_sys_lib_dlsearch_path_spec+set}"; then sys_lib_dlsearch_path_spec=$lt_cv_sys_lib_dlsearch_path_spec fi # remember unaugmented sys_lib_dlsearch_path content for libtool script decls... configure_time_dlsearch_path=$sys_lib_dlsearch_path_spec # ... but it needs LT_SYS_LIBRARY_PATH munging for other configure-time code func_munge_path_list sys_lib_dlsearch_path_spec "$LT_SYS_LIBRARY_PATH" # to be used as default LT_SYS_LIBRARY_PATH value in generated libtool configure_time_lt_sys_library_path=$LT_SYS_LIBRARY_PATH { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5 $as_echo_n "checking how to hardcode library paths into programs... " >&6; } hardcode_action= if test -n "$hardcode_libdir_flag_spec" || test -n "$runpath_var" || test yes = "$hardcode_automatic"; then # We can hardcode non-existent directories. if test no != "$hardcode_direct" && # If the only mechanism to avoid hardcoding is shlibpath_var, we # have to relink, otherwise we might link with an installed library # when we should be linking with a yet-to-be-installed one ## test no != "$_LT_TAGVAR(hardcode_shlibpath_var, )" && test no != "$hardcode_minus_L"; then # Linking always hardcodes the temporary library directory. hardcode_action=relink else # We can link without hardcoding, and we can hardcode nonexisting dirs. hardcode_action=immediate fi else # We cannot hardcode anything, or else we can only hardcode existing # directories. hardcode_action=unsupported fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5 $as_echo "$hardcode_action" >&6; } if test relink = "$hardcode_action" || test yes = "$inherit_rpath"; then # Fast installation is not supported enable_fast_install=no elif test yes = "$shlibpath_overrides_runpath" || test no = "$enable_shared"; then # Fast installation is not necessary enable_fast_install=needless fi if test yes != "$enable_dlopen"; then enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown else lt_cv_dlopen=no lt_cv_dlopen_libs= case $host_os in beos*) lt_cv_dlopen=load_add_on lt_cv_dlopen_libs= lt_cv_dlopen_self=yes ;; mingw* | pw32* | cegcc*) lt_cv_dlopen=LoadLibrary lt_cv_dlopen_libs= ;; cygwin*) lt_cv_dlopen=dlopen lt_cv_dlopen_libs= ;; darwin*) # if libdl is installed we need to link against it { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5 $as_echo_n "checking for dlopen in -ldl... " >&6; } if ${ac_cv_lib_dl_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dl_dlopen=yes else ac_cv_lib_dl_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5 $as_echo "$ac_cv_lib_dl_dlopen" >&6; } if test "x$ac_cv_lib_dl_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl else lt_cv_dlopen=dyld lt_cv_dlopen_libs= lt_cv_dlopen_self=yes fi ;; tpf*) # Don't try to run any link tests for TPF. We know it's impossible # because TPF is a cross-compiler, and we know how we open DSOs. lt_cv_dlopen=dlopen lt_cv_dlopen_libs= lt_cv_dlopen_self=no ;; *) ac_fn_c_check_func "$LINENO" "shl_load" "ac_cv_func_shl_load" if test "x$ac_cv_func_shl_load" = xyes; then : lt_cv_dlopen=shl_load else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5 $as_echo_n "checking for shl_load in -ldld... " >&6; } if ${ac_cv_lib_dld_shl_load+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char shl_load (); int main () { return shl_load (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dld_shl_load=yes else ac_cv_lib_dld_shl_load=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5 $as_echo "$ac_cv_lib_dld_shl_load" >&6; } if test "x$ac_cv_lib_dld_shl_load" = xyes; then : lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld else ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen" if test "x$ac_cv_func_dlopen" = xyes; then : lt_cv_dlopen=dlopen else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5 $as_echo_n "checking for dlopen in -ldl... " >&6; } if ${ac_cv_lib_dl_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldl $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dl_dlopen=yes else ac_cv_lib_dl_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5 $as_echo "$ac_cv_lib_dl_dlopen" >&6; } if test "x$ac_cv_lib_dl_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5 $as_echo_n "checking for dlopen in -lsvld... " >&6; } if ${ac_cv_lib_svld_dlopen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lsvld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dlopen (); int main () { return dlopen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_svld_dlopen=yes else ac_cv_lib_svld_dlopen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5 $as_echo "$ac_cv_lib_svld_dlopen" >&6; } if test "x$ac_cv_lib_svld_dlopen" = xyes; then : lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5 $as_echo_n "checking for dld_link in -ldld... " >&6; } if ${ac_cv_lib_dld_dld_link+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldld $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dld_link (); int main () { return dld_link (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dld_dld_link=yes else ac_cv_lib_dld_dld_link=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5 $as_echo "$ac_cv_lib_dld_dld_link" >&6; } if test "x$ac_cv_lib_dld_dld_link" = xyes; then : lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld fi fi fi fi fi fi ;; esac if test no = "$lt_cv_dlopen"; then enable_dlopen=no else enable_dlopen=yes fi case $lt_cv_dlopen in dlopen) save_CPPFLAGS=$CPPFLAGS test yes = "$ac_cv_header_dlfcn_h" && CPPFLAGS="$CPPFLAGS -DHAVE_DLFCN_H" save_LDFLAGS=$LDFLAGS wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $export_dynamic_flag_spec\" save_LIBS=$LIBS LIBS="$lt_cv_dlopen_libs $LIBS" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5 $as_echo_n "checking whether a program can dlopen itself... " >&6; } if ${lt_cv_dlopen_self+:} false; then : $as_echo_n "(cached) " >&6 else if test yes = "$cross_compiling"; then : lt_cv_dlopen_self=cross else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF #line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; } _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&5 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) lt_cv_dlopen_self=yes ;; x$lt_dlneed_uscore) lt_cv_dlopen_self=yes ;; x$lt_dlunknown|x*) lt_cv_dlopen_self=no ;; esac else : # compilation failed lt_cv_dlopen_self=no fi fi rm -fr conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5 $as_echo "$lt_cv_dlopen_self" >&6; } if test yes = "$lt_cv_dlopen_self"; then wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\" { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5 $as_echo_n "checking whether a statically linked program can dlopen itself... " >&6; } if ${lt_cv_dlopen_self_static+:} false; then : $as_echo_n "(cached) " >&6 else if test yes = "$cross_compiling"; then : lt_cv_dlopen_self_static=cross else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF #line $LINENO "configure" #include "confdefs.h" #if HAVE_DLFCN_H #include #endif #include #ifdef RTLD_GLOBAL # define LT_DLGLOBAL RTLD_GLOBAL #else # ifdef DL_GLOBAL # define LT_DLGLOBAL DL_GLOBAL # else # define LT_DLGLOBAL 0 # endif #endif /* We may have to define LT_DLLAZY_OR_NOW in the command line if we find out it does not work in some platform. */ #ifndef LT_DLLAZY_OR_NOW # ifdef RTLD_LAZY # define LT_DLLAZY_OR_NOW RTLD_LAZY # else # ifdef DL_LAZY # define LT_DLLAZY_OR_NOW DL_LAZY # else # ifdef RTLD_NOW # define LT_DLLAZY_OR_NOW RTLD_NOW # else # ifdef DL_NOW # define LT_DLLAZY_OR_NOW DL_NOW # else # define LT_DLLAZY_OR_NOW 0 # endif # endif # endif # endif #endif /* When -fvisibility=hidden is used, assume the code has been annotated correspondingly for the symbols needed. */ #if defined __GNUC__ && (((__GNUC__ == 3) && (__GNUC_MINOR__ >= 3)) || (__GNUC__ > 3)) int fnord () __attribute__((visibility("default"))); #endif int fnord () { return 42; } int main () { void *self = dlopen (0, LT_DLGLOBAL|LT_DLLAZY_OR_NOW); int status = $lt_dlunknown; if (self) { if (dlsym (self,"fnord")) status = $lt_dlno_uscore; else { if (dlsym( self,"_fnord")) status = $lt_dlneed_uscore; else puts (dlerror ()); } /* dlclose (self); */ } else puts (dlerror ()); return status; } _LT_EOF if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5 (eval $ac_link) 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then (./conftest; exit; ) >&5 2>/dev/null lt_status=$? case x$lt_status in x$lt_dlno_uscore) lt_cv_dlopen_self_static=yes ;; x$lt_dlneed_uscore) lt_cv_dlopen_self_static=yes ;; x$lt_dlunknown|x*) lt_cv_dlopen_self_static=no ;; esac else : # compilation failed lt_cv_dlopen_self_static=no fi fi rm -fr conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5 $as_echo "$lt_cv_dlopen_self_static" >&6; } fi CPPFLAGS=$save_CPPFLAGS LDFLAGS=$save_LDFLAGS LIBS=$save_LIBS ;; esac case $lt_cv_dlopen_self in yes|no) enable_dlopen_self=$lt_cv_dlopen_self ;; *) enable_dlopen_self=unknown ;; esac case $lt_cv_dlopen_self_static in yes|no) enable_dlopen_self_static=$lt_cv_dlopen_self_static ;; *) enable_dlopen_self_static=unknown ;; esac fi striplib= old_striplib= { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5 $as_echo_n "checking whether stripping libraries is possible... " >&6; } if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then test -z "$old_striplib" && old_striplib="$STRIP --strip-debug" test -z "$striplib" && striplib="$STRIP --strip-unneeded" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else # FIXME - insert some real tests, host_os isn't really good enough case $host_os in darwin*) if test -n "$STRIP"; then striplib="$STRIP -x" old_striplib="$STRIP -S" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } ;; esac fi # Report what library types will actually be built { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5 $as_echo_n "checking if libtool supports shared libraries... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5 $as_echo "$can_build_shared" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5 $as_echo_n "checking whether to build shared libraries... " >&6; } test no = "$can_build_shared" && enable_shared=no # On AIX, shared libraries and static libraries use the same namespace, and # are all built from PIC. case $host_os in aix3*) test yes = "$enable_shared" && enable_static=no if test -n "$RANLIB"; then archive_cmds="$archive_cmds~\$RANLIB \$lib" postinstall_cmds='$RANLIB $lib' fi ;; aix[4-9]*) if test ia64 != "$host_cpu"; then case $enable_shared,$with_aix_soname,$aix_use_runtimelinking in yes,aix,yes) ;; # shared object as lib.so file only yes,svr4,*) ;; # shared object as lib.so archive member only yes,*) enable_static=no ;; # shared object in lib.a archive as well esac fi ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5 $as_echo "$enable_shared" >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5 $as_echo_n "checking whether to build static libraries... " >&6; } # Make sure either enable_shared or enable_static is yes. test yes = "$enable_shared" || enable_static=yes { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5 $as_echo "$enable_static" >&6; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu CC=$lt_save_CC ac_config_commands="$ac_config_commands libtool" # Only expand once: if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args. set dummy ${ac_tool_prefix}pkg-config; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_PKG_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $PKG_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_PKG_CONFIG="$PKG_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi PKG_CONFIG=$ac_cv_path_PKG_CONFIG if test -n "$PKG_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKG_CONFIG" >&5 $as_echo "$PKG_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_path_PKG_CONFIG"; then ac_pt_PKG_CONFIG=$PKG_CONFIG # Extract the first word of "pkg-config", so it can be a program name with args. set dummy pkg-config; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_ac_pt_PKG_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $ac_pt_PKG_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_ac_pt_PKG_CONFIG="$ac_pt_PKG_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_ac_pt_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi ac_pt_PKG_CONFIG=$ac_cv_path_ac_pt_PKG_CONFIG if test -n "$ac_pt_PKG_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKG_CONFIG" >&5 $as_echo "$ac_pt_PKG_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_pt_PKG_CONFIG" = x; then PKG_CONFIG="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac PKG_CONFIG=$ac_pt_PKG_CONFIG fi else PKG_CONFIG="$ac_cv_path_PKG_CONFIG" fi fi if test -n "$PKG_CONFIG"; then _pkg_min_version=0.21 { $as_echo "$as_me:${as_lineno-$LINENO}: checking pkg-config is at least version $_pkg_min_version" >&5 $as_echo_n "checking pkg-config is at least version $_pkg_min_version... " >&6; } if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } PKG_CONFIG="" fi fi # 0.21 is the CentOS 5.11 version { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether GCC or Clang is our compiler" >&5 $as_echo_n "checking whether GCC or Clang is our compiler... " >&6; } ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu compiler=unknown cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if ! __clang__ #error #endif _ACEOF if ac_fn_c_try_compile "$LINENO"; then : compiler=clang else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if ! __GNUC__ #error #endif _ACEOF if ac_fn_c_try_compile "$LINENO"; then : compiler=gcc fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${compiler}" >&5 $as_echo "${compiler}" >&6; } case "$compiler" in clang) CLANG_CFLAGS="-Wextra -Werror-implicit-function-declaration -Wno-error=unused-command-line-argument" { $as_echo "$as_me:${as_lineno-$LINENO}: checking clang __sync_bool_compare_and_swap support" >&5 $as_echo_n "checking clang __sync_bool_compare_and_swap support... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { unsigned int i = 0; (void)__sync_bool_compare_and_swap(&i, 1, 1); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : $as_echo "#define __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1 1" >>confdefs.h $as_echo "#define __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2 1" >>confdefs.h $as_echo "#define __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4 1" >>confdefs.h $as_echo "#define __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8 1" >>confdefs.h { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ;; gcc) { $as_echo "$as_me:${as_lineno-$LINENO}: checking gcc version" >&5 $as_echo_n "checking gcc version... " >&6; } gccver=$($CC -dumpversion) gccvermajor=$(echo $gccver | cut -d . -f1) gccverminor=$(echo $gccver | cut -d . -f2) gccvernum=$(expr $gccvermajor "*" 100 + $gccverminor) { $as_echo "$as_me:${as_lineno-$LINENO}: result: $gccver" >&5 $as_echo "$gccver" >&6; } if test "$gccvernum" -ge "400"; then GCC_CFLAGS="-Wextra -Werror-implicit-function-declaration" # remove optimization options that break our code # VJ 2010/06/27: no-tree-pre added. It breaks ringbuffers code. GCC_CFLAGS="$GCC_CFLAGS -fno-tree-pre" else GCC_CFLAGS="-W" fi ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unsupported/untested compiler, this may or may not work" >&5 $as_echo "$as_me: WARNING: unsupported/untested compiler, this may or may not work" >&2;} ;; esac # Checks for programs. for ac_prog in gawk mawk nawk awk do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AWK+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AWK"; then ac_cv_prog_AWK="$AWK" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_AWK="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AWK=$ac_cv_prog_AWK if test -n "$AWK"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5 $as_echo "$AWK" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AWK" && break done ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="${ac_tool_prefix}cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if ${ac_cv_c_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if ${ac_cv_prog_cc_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes else CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if ${ac_cv_prog_cc_c89+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include struct stat; /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac if test "x$ac_cv_prog_cc_c89" != xno; then : fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC understands -c and -o together" >&5 $as_echo_n "checking whether $CC understands -c and -o together... " >&6; } if ${am_cv_prog_cc_c_o+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF # Make sure it works both with $CC and with simple cc. # Following AC_PROG_CC_C_O, we do the test twice because some # compilers refuse to overwrite an existing .o file with -o, # though they will create one. am_cv_prog_cc_c_o=yes for am_i in 1 2; do if { echo "$as_me:$LINENO: $CC -c conftest.$ac_ext -o conftest2.$ac_objext" >&5 ($CC -c conftest.$ac_ext -o conftest2.$ac_objext) >&5 2>&5 ac_status=$? echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } \ && test -f conftest2.$ac_objext; then : OK else am_cv_prog_cc_c_o=no break fi done rm -f core conftest* unset am_i fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_cc_c_o" >&5 $as_echo "$am_cv_prog_cc_c_o" >&6; } if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. # FIXME: It is wrong to rewrite CC. # But if we don't then we get into trouble of one sort or another. # A longer-term fix would be to have automake use am__CC in this case, # and then we could set am__CC="\$(top_srcdir)/compile \$(CC)" CC="$am_aux_dir/compile $CC" fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu depcc="$CC" am_compiler_list= { $as_echo "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5 $as_echo_n "checking dependency style of $depcc... " >&6; } if ${am_cv_CC_dependencies_compiler_type+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then # We make a subdir and do the tests there. Otherwise we can end up # making bogus files that we don't know about and never remove. For # instance it was reported that on HP-UX the gcc test will end up # making a dummy file named 'D' -- because '-MD' means "put the output # in D". rm -rf conftest.dir mkdir conftest.dir # Copy depcomp to subdir because otherwise we won't find it if we're # using a relative directory. cp "$am_depcomp" conftest.dir cd conftest.dir # We will build objects and dependencies in a subdirectory because # it helps to detect inapplicable dependency modes. For instance # both Tru64's cc and ICC support -MD to output dependencies as a # side effect of compilation, but ICC will put the dependencies in # the current directory while Tru64 will put them in the object # directory. mkdir sub am_cv_CC_dependencies_compiler_type=none if test "$am_compiler_list" = ""; then am_compiler_list=`sed -n 's/^#*\([a-zA-Z0-9]*\))$/\1/p' < ./depcomp` fi am__universal=false case " $depcc " in #( *\ -arch\ *\ -arch\ *) am__universal=true ;; esac for depmode in $am_compiler_list; do # Setup a source with many dependencies, because some compilers # like to wrap large dependency lists on column 80 (with \), and # we should not choose a depcomp mode which is confused by this. # # We need to recreate these files for each test, as the compiler may # overwrite some of them when testing with obscure command lines. # This happens at least with the AIX C compiler. : > sub/conftest.c for i in 1 2 3 4 5 6; do echo '#include "conftst'$i'.h"' >> sub/conftest.c # Using ": > sub/conftst$i.h" creates only sub/conftst1.h with # Solaris 10 /bin/sh. echo '/* dummy */' > sub/conftst$i.h done echo "${am__include} ${am__quote}sub/conftest.Po${am__quote}" > confmf # We check with '-c' and '-o' for the sake of the "dashmstdout" # mode. It turns out that the SunPro C++ compiler does not properly # handle '-M -o', and we need to detect this. Also, some Intel # versions had trouble with output in subdirs. am__obj=sub/conftest.${OBJEXT-o} am__minus_obj="-o $am__obj" case $depmode in gcc) # This depmode causes a compiler race in universal mode. test "$am__universal" = false || continue ;; nosideeffect) # After this tag, mechanisms are not by side-effect, so they'll # only be used when explicitly requested. if test "x$enable_dependency_tracking" = xyes; then continue else break fi ;; msvc7 | msvc7msys | msvisualcpp | msvcmsys) # This compiler won't grok '-c -o', but also, the minuso test has # not run yet. These depmodes are late enough in the game, and # so weak that their functioning should not be impacted. am__obj=conftest.${OBJEXT-o} am__minus_obj= ;; none) break ;; esac if depmode=$depmode \ source=sub/conftest.c object=$am__obj \ depfile=sub/conftest.Po tmpdepfile=sub/conftest.TPo \ $SHELL ./depcomp $depcc -c $am__minus_obj sub/conftest.c \ >/dev/null 2>conftest.err && grep sub/conftst1.h sub/conftest.Po > /dev/null 2>&1 && grep sub/conftst6.h sub/conftest.Po > /dev/null 2>&1 && grep $am__obj sub/conftest.Po > /dev/null 2>&1 && ${MAKE-make} -s -f confmf > /dev/null 2>&1; then # icc doesn't choke on unknown options, it will just issue warnings # or remarks (even with -Werror). So we grep stderr for any message # that says an option was ignored or not supported. # When given -MP, icc 7.0 and 7.1 complain thusly: # icc: Command line warning: ignoring option '-M'; no argument required # The diagnosis changed in icc 8.0: # icc: Command line remark: option '-MP' not supported if (grep 'ignoring option' conftest.err || grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else am_cv_CC_dependencies_compiler_type=$depmode break fi fi done cd .. rm -rf conftest.dir else am_cv_CC_dependencies_compiler_type=none fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_CC_dependencies_compiler_type" >&5 $as_echo "$am_cv_CC_dependencies_compiler_type" >&6; } CCDEPMODE=depmode=$am_cv_CC_dependencies_compiler_type if test "x$enable_dependency_tracking" != xno \ && test "$am_cv_CC_dependencies_compiler_type" = gcc3; then am__fastdepCC_TRUE= am__fastdepCC_FALSE='#' else am__fastdepCC_TRUE='#' am__fastdepCC_FALSE= fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 $as_echo_n "checking how to run the C preprocessor... " >&6; } # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if ${ac_cv_prog_CPP+:} false; then : $as_echo_n "(cached) " >&6 else # Double quotes because CPP needs to be expanded for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" do ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : break fi done ac_cv_prog_CPP=$CPP fi CPP=$ac_cv_prog_CPP else ac_cv_prog_CPP=$CPP fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 $as_echo "$CPP" >&6; } ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C preprocessor \"$CPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5 $as_echo_n "checking whether ln -s works... " >&6; } LN_S=$as_ln_s if test "$LN_S" = "ln -s"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5 $as_echo "no, using $LN_S" >&6; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5 $as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; } set x ${MAKE-make} ac_make=`$as_echo "$2" | sed 's/+/p/g; s/[^a-zA-Z0-9_]/_/g'` if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then : $as_echo_n "(cached) " >&6 else cat >conftest.make <<\_ACEOF SHELL = /bin/sh all: @echo '@@@%%%=$(MAKE)=@@@%%%' _ACEOF # GNU make sometimes prints "make[1]: Entering ...", which would confuse us. case `${MAKE-make} -f conftest.make 2>/dev/null` in *@@@%%%=?*=@@@%%%*) eval ac_cv_prog_make_${ac_make}_set=yes;; *) eval ac_cv_prog_make_${ac_make}_set=no;; esac rm -f conftest.make fi if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } SET_MAKE= else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } SET_MAKE="MAKE=${MAKE-make}" fi # Extract the first word of "pkg-config", so it can be a program name with args. set dummy pkg-config; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_PKG_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_PKG_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_PKG_CONFIG="$HAVE_PKG_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_PKG_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_PKG_CONFIG" && ac_cv_path_HAVE_PKG_CONFIG=""no"" ;; esac fi HAVE_PKG_CONFIG=$ac_cv_path_HAVE_PKG_CONFIG if test -n "$HAVE_PKG_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_PKG_CONFIG" >&5 $as_echo "$HAVE_PKG_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_PKG_CONFIG" = "no"; then echo echo " ERROR! pkg-config not found, go get it " echo " http://pkg-config.freedesktop.org/wiki/ " echo " or install from your distribution " echo exit 1 fi # Check whether --enable-python was given. if test "${enable_python+set}" = set; then : enableval=$enable_python; else enable_python=yes fi # Extract the first word of "python", so it can be a program name with args. set dummy python; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_PYTHON_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_PYTHON_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_PYTHON_CONFIG="$HAVE_PYTHON_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_PYTHON_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_PYTHON_CONFIG" && ac_cv_path_HAVE_PYTHON_CONFIG=""no"" ;; esac fi HAVE_PYTHON_CONFIG=$ac_cv_path_HAVE_PYTHON_CONFIG if test -n "$HAVE_PYTHON_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_PYTHON_CONFIG" >&5 $as_echo "$HAVE_PYTHON_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$enable_python" = "xno" ; then echo echo " Warning! python disabled, you will not be " echo " able to install suricatasc unix socket client " echo enable_python="no" fi if test "$HAVE_PYTHON_CONFIG" = "no"; then echo echo " Warning! python not found, you will not be " echo " able to install suricatasc unix socket client " echo enable_python="no" fi if test "x$enable_python" = "xyes"; then HAVE_PYTHON_TRUE= HAVE_PYTHON_FALSE='#' else HAVE_PYTHON_TRUE='#' HAVE_PYTHON_FALSE= fi # Extract the first word of "wget", so it can be a program name with args. set dummy wget; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_WGET+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_WGET in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_WGET="$HAVE_WGET" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_WGET="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_WGET" && ac_cv_path_HAVE_WGET=""no"" ;; esac fi HAVE_WGET=$ac_cv_path_HAVE_WGET if test -n "$HAVE_WGET"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_WGET" >&5 $as_echo "$HAVE_WGET" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_WGET" = "no"; then # Extract the first word of "curl", so it can be a program name with args. set dummy curl; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_CURL+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_CURL in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_CURL="$HAVE_CURL" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_CURL="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_CURL" && ac_cv_path_HAVE_CURL=""no"" ;; esac fi HAVE_CURL=$ac_cv_path_HAVE_CURL if test -n "$HAVE_CURL"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_CURL" >&5 $as_echo "$HAVE_CURL" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_CURL" = "no"; then echo echo " Warning curl or wget not found, you won't be able to" echo " download latest ruleset with 'make install-rules'" fi fi if test "x$HAVE_WGET" != "xno" || test "x$HAVE_CURL" != "xno"; then HAVE_FETCH_COMMAND_TRUE= HAVE_FETCH_COMMAND_FALSE='#' else HAVE_FETCH_COMMAND_TRUE='#' HAVE_FETCH_COMMAND_FALSE= fi if test "x$HAVE_WGET" != "xno"; then HAVE_WGET_COMMAND_TRUE= HAVE_WGET_COMMAND_FALSE='#' else HAVE_WGET_COMMAND_TRUE='#' HAVE_WGET_COMMAND_FALSE= fi # Checks for libraries. # Checks for header files. for ac_header in stddef.h do : ac_fn_c_check_header_mongrel "$LINENO" "stddef.h" "ac_cv_header_stddef_h" "$ac_includes_default" if test "x$ac_cv_header_stddef_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_STDDEF_H 1 _ACEOF fi done for ac_header in arpa/inet.h assert.h ctype.h errno.h fcntl.h inttypes.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in getopt.h do : ac_fn_c_check_header_mongrel "$LINENO" "getopt.h" "ac_cv_header_getopt_h" "$ac_includes_default" if test "x$ac_cv_header_getopt_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_GETOPT_H 1 _ACEOF fi done for ac_header in limits.h netdb.h netinet/in.h poll.h sched.h signal.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in stdarg.h stdint.h stdio.h stdlib.h string.h strings.h sys/ioctl.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in syslog.h sys/prctl.h sys/socket.h sys/stat.h sys/syscall.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in sys/time.h time.h unistd.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in sys/ioctl.h linux/if_ether.h linux/if_packet.h linux/filter.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in linux/ethtool.h linux/sockios.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done ac_fn_c_check_header_mongrel "$LINENO" "glob.h" "ac_cv_header_glob_h" "$ac_includes_default" if test "x$ac_cv_header_glob_h" = xyes; then : else as_fn_error $? "glob.h not found ..." "$LINENO" 5 fi for ac_header in dirent.h fnmatch.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in sys/socket.h net/if.h sys/mman.h linux/if_arp.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "#ifdef HAVE_SYS_SOCKET_H #include #include #endif " if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in windows.h winsock2.h ws2tcpip.h w32api/wtypes.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" " #ifndef _X86_ #define _X86_ #endif " if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done for ac_header in w32api/winbase.h do : ac_fn_c_check_header_compile "$LINENO" "w32api/winbase.h" "ac_cv_header_w32api_winbase_h" " #ifndef _X86_ #define _X86_ #endif #include " if test "x$ac_cv_header_w32api_winbase_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_W32API_WINBASE_H 1 _ACEOF fi done # Checks for typedefs, structures, and compiler characteristics. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for inline" >&5 $as_echo_n "checking for inline... " >&6; } if ${ac_cv_c_inline+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_inline=no for ac_kw in inline __inline__ __inline; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifndef __cplusplus typedef int foo_t; static $ac_kw foo_t static_foo () {return 0; } $ac_kw foo_t foo () {return 0; } #endif _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_inline=$ac_kw fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_inline" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5 $as_echo "$ac_cv_c_inline" >&6; } case $ac_cv_c_inline in inline | yes) ;; *) case $ac_cv_c_inline in no) ac_val=;; *) ac_val=$ac_cv_c_inline;; esac cat >>confdefs.h <<_ACEOF #ifndef __cplusplus #define inline $ac_val #endif _ACEOF ;; esac ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default" if test "x$ac_cv_type_pid_t" = xyes; then : else cat >>confdefs.h <<_ACEOF #define pid_t int _ACEOF fi ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default" if test "x$ac_cv_type_size_t" = xyes; then : else cat >>confdefs.h <<_ACEOF #define size_t unsigned int _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int32_t" >&5 $as_echo_n "checking for int32_t... " >&6; } if ${ac_cv_c_int32_t+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_int32_t=no for ac_type in 'int32_t' 'int' 'long int' \ 'long long int' 'short int' 'signed char'; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(0 < ($ac_type) (((($ac_type) 1 << (32 - 2)) - 1) * 2 + 1))]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(($ac_type) (((($ac_type) 1 << (32 - 2)) - 1) * 2 + 1) < ($ac_type) (((($ac_type) 1 << (32 - 2)) - 1) * 2 + 2))]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else case $ac_type in int32_t) ac_cv_c_int32_t=yes ;; *) ac_cv_c_int32_t=$ac_type ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_int32_t" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_int32_t" >&5 $as_echo "$ac_cv_c_int32_t" >&6; } case $ac_cv_c_int32_t in #( no|yes) ;; #( *) cat >>confdefs.h <<_ACEOF #define int32_t $ac_cv_c_int32_t _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint16_t" >&5 $as_echo_n "checking for uint16_t... " >&6; } if ${ac_cv_c_uint16_t+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_uint16_t=no for ac_type in 'uint16_t' 'unsigned int' 'unsigned long int' \ 'unsigned long long int' 'unsigned short int' 'unsigned char'; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(($ac_type) -1 >> (16 - 1) == 1)]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : case $ac_type in uint16_t) ac_cv_c_uint16_t=yes ;; *) ac_cv_c_uint16_t=$ac_type ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_uint16_t" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_uint16_t" >&5 $as_echo "$ac_cv_c_uint16_t" >&6; } case $ac_cv_c_uint16_t in #( no|yes) ;; #( *) cat >>confdefs.h <<_ACEOF #define uint16_t $ac_cv_c_uint16_t _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint32_t" >&5 $as_echo_n "checking for uint32_t... " >&6; } if ${ac_cv_c_uint32_t+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_uint32_t=no for ac_type in 'uint32_t' 'unsigned int' 'unsigned long int' \ 'unsigned long long int' 'unsigned short int' 'unsigned char'; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(($ac_type) -1 >> (32 - 1) == 1)]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : case $ac_type in uint32_t) ac_cv_c_uint32_t=yes ;; *) ac_cv_c_uint32_t=$ac_type ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_uint32_t" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_uint32_t" >&5 $as_echo "$ac_cv_c_uint32_t" >&6; } case $ac_cv_c_uint32_t in #( no|yes) ;; #( *) $as_echo "#define _UINT32_T 1" >>confdefs.h cat >>confdefs.h <<_ACEOF #define uint32_t $ac_cv_c_uint32_t _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint64_t" >&5 $as_echo_n "checking for uint64_t... " >&6; } if ${ac_cv_c_uint64_t+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_uint64_t=no for ac_type in 'uint64_t' 'unsigned int' 'unsigned long int' \ 'unsigned long long int' 'unsigned short int' 'unsigned char'; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(($ac_type) -1 >> (64 - 1) == 1)]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : case $ac_type in uint64_t) ac_cv_c_uint64_t=yes ;; *) ac_cv_c_uint64_t=$ac_type ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_uint64_t" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_uint64_t" >&5 $as_echo "$ac_cv_c_uint64_t" >&6; } case $ac_cv_c_uint64_t in #( no|yes) ;; #( *) $as_echo "#define _UINT64_T 1" >>confdefs.h cat >>confdefs.h <<_ACEOF #define uint64_t $ac_cv_c_uint64_t _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint8_t" >&5 $as_echo_n "checking for uint8_t... " >&6; } if ${ac_cv_c_uint8_t+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_uint8_t=no for ac_type in 'uint8_t' 'unsigned int' 'unsigned long int' \ 'unsigned long long int' 'unsigned short int' 'unsigned char'; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { static int test_array [1 - 2 * !(($ac_type) -1 >> (8 - 1) == 1)]; test_array [0] = 0; return test_array [0]; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : case $ac_type in uint8_t) ac_cv_c_uint8_t=yes ;; *) ac_cv_c_uint8_t=$ac_type ;; esac fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_uint8_t" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_uint8_t" >&5 $as_echo "$ac_cv_c_uint8_t" >&6; } case $ac_cv_c_uint8_t in #( no|yes) ;; #( *) $as_echo "#define _UINT8_T 1" >>confdefs.h cat >>confdefs.h <<_ACEOF #define uint8_t $ac_cv_c_uint8_t _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for stdbool.h that conforms to C99" >&5 $as_echo_n "checking for stdbool.h that conforms to C99... " >&6; } if ${ac_cv_header_stdbool_h+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #ifndef bool "error: bool is not defined" #endif #ifndef false "error: false is not defined" #endif #if false "error: false is not 0" #endif #ifndef true "error: true is not defined" #endif #if true != 1 "error: true is not 1" #endif #ifndef __bool_true_false_are_defined "error: __bool_true_false_are_defined is not defined" #endif struct s { _Bool s: 1; _Bool t; } s; char a[true == 1 ? 1 : -1]; char b[false == 0 ? 1 : -1]; char c[__bool_true_false_are_defined == 1 ? 1 : -1]; char d[(bool) 0.5 == true ? 1 : -1]; /* See body of main program for 'e'. */ char f[(_Bool) 0.0 == false ? 1 : -1]; char g[true]; char h[sizeof (_Bool)]; char i[sizeof s.t]; enum { j = false, k = true, l = false * true, m = true * 256 }; /* The following fails for HP aC++/ANSI C B3910B A.05.55 [Dec 04 2003]. */ _Bool n[m]; char o[sizeof n == m * sizeof n[0] ? 1 : -1]; char p[-1 - (_Bool) 0 < 0 && -1 - (bool) 0 < 0 ? 1 : -1]; /* Catch a bug in an HP-UX C compiler. See http://gcc.gnu.org/ml/gcc-patches/2003-12/msg02303.html http://lists.gnu.org/archive/html/bug-coreutils/2005-11/msg00161.html */ _Bool q = true; _Bool *pq = &q; int main () { bool e = &s; *pq |= q; *pq |= ! q; /* Refer to every declared value, to avoid compiler optimizations. */ return (!a + !b + !c + !d + !e + !f + !g + !h + !i + !!j + !k + !!l + !m + !n + !o + !p + !q + !pq); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_stdbool_h=yes else ac_cv_header_stdbool_h=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdbool_h" >&5 $as_echo "$ac_cv_header_stdbool_h" >&6; } ac_fn_c_check_type "$LINENO" "_Bool" "ac_cv_type__Bool" "$ac_includes_default" if test "x$ac_cv_type__Bool" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE__BOOL 1 _ACEOF fi if test $ac_cv_header_stdbool_h = yes; then $as_echo "#define HAVE_STDBOOL_H 1" >>confdefs.h fi # Checks for library functions. for ac_header in stdlib.h do : ac_fn_c_check_header_mongrel "$LINENO" "stdlib.h" "ac_cv_header_stdlib_h" "$ac_includes_default" if test "x$ac_cv_header_stdlib_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_STDLIB_H 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible malloc" >&5 $as_echo_n "checking for GNU libc compatible malloc... " >&6; } if ${ac_cv_func_malloc_0_nonnull+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_malloc_0_nonnull=no else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if defined STDC_HEADERS || defined HAVE_STDLIB_H # include #else char *malloc (); #endif int main () { return ! malloc (0); ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_malloc_0_nonnull=yes else ac_cv_func_malloc_0_nonnull=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_malloc_0_nonnull" >&5 $as_echo "$ac_cv_func_malloc_0_nonnull" >&6; } if test $ac_cv_func_malloc_0_nonnull = yes; then : $as_echo "#define HAVE_MALLOC 1" >>confdefs.h else $as_echo "#define HAVE_MALLOC 0" >>confdefs.h case " $LIBOBJS " in *" malloc.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS malloc.$ac_objext" ;; esac $as_echo "#define malloc rpl_malloc" >>confdefs.h fi for ac_header in stdlib.h do : ac_fn_c_check_header_mongrel "$LINENO" "stdlib.h" "ac_cv_header_stdlib_h" "$ac_includes_default" if test "x$ac_cv_header_stdlib_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_STDLIB_H 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible realloc" >&5 $as_echo_n "checking for GNU libc compatible realloc... " >&6; } if ${ac_cv_func_realloc_0_nonnull+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_realloc_0_nonnull=no else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if defined STDC_HEADERS || defined HAVE_STDLIB_H # include #else char *realloc (); #endif int main () { return ! realloc (0, 0); ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_realloc_0_nonnull=yes else ac_cv_func_realloc_0_nonnull=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_realloc_0_nonnull" >&5 $as_echo "$ac_cv_func_realloc_0_nonnull" >&6; } if test $ac_cv_func_realloc_0_nonnull = yes; then : $as_echo "#define HAVE_REALLOC 1" >>confdefs.h else $as_echo "#define HAVE_REALLOC 0" >>confdefs.h case " $LIBOBJS " in *" realloc.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS realloc.$ac_objext" ;; esac $as_echo "#define realloc rpl_realloc" >>confdefs.h fi for ac_func in gettimeofday memset strcasecmp strchr strdup strerror strncasecmp strtol strtoul memchr memrchr do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done OCFLAGS=$CFLAGS CFLAGS="" for ac_func in strlcpy strlcat do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done CFLAGS=$OCFLAGS # Add large file support # Check whether --enable-largefile was given. if test "${enable_largefile+set}" = set; then : enableval=$enable_largefile; fi if test "$enable_largefile" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5 $as_echo_n "checking for special C compiler options needed for large files... " >&6; } if ${ac_cv_sys_largefile_CC+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_sys_largefile_CC=no if test "$GCC" != yes; then ac_save_CC=$CC while :; do # IRIX 6.2 and later do not support large files by default, # so use the C compiler's -n32 option if that helps. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : break fi rm -f core conftest.err conftest.$ac_objext CC="$CC -n32" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_largefile_CC=' -n32'; break fi rm -f core conftest.err conftest.$ac_objext break done CC=$ac_save_CC rm -f conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5 $as_echo "$ac_cv_sys_largefile_CC" >&6; } if test "$ac_cv_sys_largefile_CC" != no; then CC=$CC$ac_cv_sys_largefile_CC fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5 $as_echo_n "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; } if ${ac_cv_sys_file_offset_bits+:} false; then : $as_echo_n "(cached) " >&6 else while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_file_offset_bits=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _FILE_OFFSET_BITS 64 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_file_offset_bits=64; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_sys_file_offset_bits=unknown break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5 $as_echo "$ac_cv_sys_file_offset_bits" >&6; } case $ac_cv_sys_file_offset_bits in #( no | unknown) ;; *) cat >>confdefs.h <<_ACEOF #define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits _ACEOF ;; esac rm -rf conftest* if test $ac_cv_sys_file_offset_bits = unknown; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5 $as_echo_n "checking for _LARGE_FILES value needed for large files... " >&6; } if ${ac_cv_sys_large_files+:} false; then : $as_echo_n "(cached) " >&6 else while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_large_files=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _LARGE_FILES 1 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_large_files=1; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_sys_large_files=unknown break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5 $as_echo "$ac_cv_sys_large_files" >&6; } case $ac_cv_sys_large_files in #( no | unknown) ;; *) cat >>confdefs.h <<_ACEOF #define _LARGE_FILES $ac_cv_sys_large_files _ACEOF ;; esac rm -rf conftest* fi fi #check for os { $as_echo "$as_me:${as_lineno-$LINENO}: checking host os" >&5 $as_echo_n "checking host os... " >&6; } # lua pkg-config name differs per OS LUA_PC_NAME="lua5.1" LUA_LIB_NAME="lua5.1" # If no host os was detected, try with uname if test -z "$host" ; then host="`uname`" fi echo -n "installation for $host OS... " e_magic_file="" e_magic_file_comment="#" case "$host" in *-*-*freebsd*) LUA_PC_NAME="lua-5.1" LUA_LIB_NAME="lua-5.1" CFLAGS="${CFLAGS} -DOS_FREEBSD" CPPFLAGS="${CPPFLAGS} -I/usr/local/include -I/usr/local/include/libnet11" LDFLAGS="${LDFLAGS} -L/usr/local/lib -L/usr/local/lib/libnet11" ;; *-*-openbsd*) LUA_PC_NAME="lua51" CFLAGS="${CFLAGS} -D__OpenBSD__" CPPFLAGS="${CPPFLAGS} -I/usr/local/include -I/usr/local/include/libnet-1.1" LDFLAGS="${LDFLAGS} -L/usr/local/lib -I/usr/local/lib/libnet-1.1" ;; *darwin*|*Darwin*) LUA_PC_NAME="lua-5.1" LUA_LIB_NAME="lua-5.1" CFLAGS="${CFLAGS} -DOS_DARWIN" CPPFLAGS="${CPPFLAGS} -I/opt/local/include" LDFLAGS="${LDFLAGS} -L/opt/local/lib" ;; *-*-linux*) #for now do nothing ;; *-*-mingw32*) CFLAGS="${CFLAGS} -DOS_WIN32" LDFLAGS="${LDFLAGS} -lws2_32" WINDOWS_PATH="yes" ;; *-*-cygwin) LUA_PC_NAME="lua" LUA_LIB_NAME="lua" WINDOWS_PATH="yes" ;; *-*-solaris*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: support for Solaris/Illumos/SunOS is experimental" >&5 $as_echo "$as_me: WARNING: support for Solaris/Illumos/SunOS is experimental" >&2;} LDFLAGS="${LDFLAGS} -lsocket -lnsl" ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unsupported OS this may or may not work" >&5 $as_echo "$as_me: WARNING: unsupported OS this may or may not work" >&2;} ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5 $as_echo "ok" >&6; } # enable modifications for AFL fuzzing # Check whether --enable-afl was given. if test "${enable_afl+set}" = set; then : enableval=$enable_afl; enable_afl="$enableval" else enable_afl=no fi if test "x$enable_afl" = "xyes"; then : $as_echo "#define AFLFUZZ_NO_RANDOM 1" >>confdefs.h $as_echo "#define AFLFUZZ_DISABLE_MGTTHREADS 1" >>confdefs.h $as_echo "#define AFLFUZZ_PCAP_RUNMODE 1" >>confdefs.h $as_echo "#define AFLFUZZ_CONF_TEST 1" >>confdefs.h $as_echo "#define AFLFUZZ_APPLAYER 1" >>confdefs.h $as_echo "#define AFLFUZZ_MIME 1" >>confdefs.h $as_echo "#define AFLFUZZ_DECODER 1" >>confdefs.h $as_echo "#define AFLFUZZ_DER 1" >>confdefs.h $as_echo "#define AFLFUZZ_RULES 1" >>confdefs.h # test for AFL PERSISTANT_MODE support CFLAGS_ORIG=$CFLAGS CFLAGS="-Werror" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { while (__AFL_LOOP(1000)) ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : $as_echo "#define AFLFUZZ_PERSISTANT_MODE 1" >>confdefs.h fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext CFLAGS=$CFLAGS_ORIG fi # disable TLS on user request # Check whether --enable-threading-tls was given. if test "${enable_threading_tls+set}" = set; then : enableval=$enable_threading_tls; enable_tls="$enableval" else enable_tls=yes fi if test "x$enable_tls" = "xyes"; then : # check if our target supports thread local storage { $as_echo "$as_me:${as_lineno-$LINENO}: checking for thread local storage __thread support" >&5 $as_echo_n "checking for thread local storage __thread support... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { static __thread int i; i = 1; i++; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : $as_echo "#define TLS 1" >>confdefs.h { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi #Enable support for gcc compile time security options. There is no great way to do detection of valid cflags that I have found #AX_CFLAGS_GCC_OPTION don't seem to do a better job than the code below and are a pain because of extra m4 files etc. #These flags seem to be supported on CentOS 5+, Ubuntu 8.04+, and FedoreCore 11+ #Options are taken from https://wiki.ubuntu.com/CompilerFlags # Check whether --enable-gccprotect was given. if test "${enable_gccprotect+set}" = set; then : enableval=$enable_gccprotect; else enable_gccprotect=no fi if test "x$enable_gccprotect" = "xyes"; then : #buffer overflow protection { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -fstack-protector" >&5 $as_echo_n "checking for -fstack-protector... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -fstack-protector" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : SECCFLAGS="-fstack-protector" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext CFLAGS="${TMPCFLAGS}" #compile-time best-practices errors for certain libc functions, provides checks of buffer lengths and memory regions { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -D_FORTIFY_SOURCE=2" >&5 $as_echo_n "checking for -D_FORTIFY_SOURCE=2... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : SECCFLAGS="${SECCFLAGS} -D_FORTIFY_SOURCE=2" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext CFLAGS="${TMPCFLAGS}" #compile-time warnings about misuse of format strings { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -Wformat -Wformat-security" >&5 $as_echo_n "checking for -Wformat -Wformat-security... " >&6; } TMPCFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wformat -Wformat-security" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : SECCFLAGS="${SECCFLAGS} -Wformat -Wformat-security" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext CFLAGS="${TMPCFLAGS}" #provides a read-only relocation table area in the final ELF { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -z relro" >&5 $as_echo_n "checking for -z relro... " >&6; } TMPLDFLAGS="${LDFLAGS}" LDFLAGS="${LDFLAGS} -z relro" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : SECLDFLAGS="${SECLDFLAGS} -z relro" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS="${TMPLDFLAGS}" #forces all relocations to be resolved at run-time { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -z now" >&5 $as_echo_n "checking for -z now... " >&6; } TMPLDFLAGS="${LDFLAGS}" LDFLAGS="${LDFLAGS} -z now" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : SECLDFLAGS="${SECLDFLAGS} -z now" { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LDFLAGS="${TMPLDFLAGS}" fi #enable profile generation # Check whether --enable-gccprofile was given. if test "${enable_gccprofile+set}" = set; then : enableval=$enable_gccprofile; else enable_gccprofile=no fi if test "x$enable_gccprofile" = "xyes"; then : CFLAGS="${CFLAGS} -pg" fi #enable gcc march=native gcc 4.2 or later # Check whether --enable-gccmarch_native was given. if test "${enable_gccmarch_native+set}" = set; then : enableval=$enable_gccmarch_native; else enable_gccmarch_native=yes fi if test "x$enable_gccmarch_native" = "xyes"; then : case "$host" in *powerpc*) ;; *) OFLAGS="$CFLAGS" CFLAGS="$CFLAGS -march=native" { $as_echo "$as_me:${as_lineno-$LINENO}: checking checking if $CC supports -march=native" >&5 $as_echo_n "checking checking if $CC supports -march=native... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } OPTIMIZATION_CFLAGS="-march=native" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } CFLAGS="$OFLAGS" enable_gccmarch_native=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ;; esac fi # options # enable the running of unit tests # Check whether --enable-unittests was given. if test "${enable_unittests+set}" = set; then : enableval=$enable_unittests; else enable_unittests=no fi if test "x$enable_unittests" = "xyes"; then : $as_echo "#define UNITTESTS 1" >>confdefs.h fi if test "x$enable_unittests" = "xyes"; then BUILD_UNITTESTS_TRUE= BUILD_UNITTESTS_FALSE='#' else BUILD_UNITTESTS_TRUE='#' BUILD_UNITTESTS_FALSE= fi # enable workaround for old barnyard2 for unified alert output # Check whether --enable-old-barnyard2 was given. if test "${enable_old_barnyard2+set}" = set; then : enableval=$enable_old_barnyard2; else enable_old_barnyard2=no fi if test "x$enable_old_barnyard2" = "xyes"; then : $as_echo "#define HAVE_OLD_BARNYARD2 1" >>confdefs.h fi # enable debug output # Check whether --enable-debug was given. if test "${enable_debug+set}" = set; then : enableval=$enable_debug; else enable_debug=no fi if test "x$enable_debug" = "xyes"; then : $as_echo "#define DEBUG 1" >>confdefs.h fi if test "x$enable_debug" = "xyes"; then DEBUG_TRUE= DEBUG_FALSE='#' else DEBUG_TRUE='#' DEBUG_FALSE= fi # enable debug validation functions & macro's output # Check whether --enable-debug-validation was given. if test "${enable_debug_validation+set}" = set; then : enableval=$enable_debug_validation; else enable_debug_validation=no fi if test "x$enable_debug_validation" = "xyes"; then : if test "$enable_unittests" = "yes"; then as_fn_error $? "debug_validation can't be enabled with enabled unittests!" "$LINENO" 5 else $as_echo "#define DEBUG_VALIDATION 1" >>confdefs.h fi fi # profiling support # Check whether --enable-profiling was given. if test "${enable_profiling+set}" = set; then : enableval=$enable_profiling; else enable_profiling=no fi if test "x$enable_profiling" = "xyes"; then : case "$host" in *-*-openbsd*) as_fn_error $? "profiling is not supported on OpenBSD" "$LINENO" 5 ;; *) $as_echo "#define PROFILING 1" >>confdefs.h ;; esac fi # profiling support, locking # Check whether --enable-profiling-locks was given. if test "${enable_profiling_locks+set}" = set; then : enableval=$enable_profiling_locks; else enable_profiling_locks=no fi if test "x$enable_profiling_locks" = "xyes"; then : $as_echo "#define PROFILING 1" >>confdefs.h $as_echo "#define PROFILE_LOCKING 1" >>confdefs.h fi # enable support for IPFW # Check whether --enable-ipfw was given. if test "${enable_ipfw+set}" = set; then : enableval=$enable_ipfw; else enable_ipfw=no fi if test "x$enable_ipfw" = "xyes"; then : $as_echo "#define IPFW 1" >>confdefs.h fi # Check whether --enable-coccinelle was given. if test "${enable_coccinelle+set}" = set; then : enableval=$enable_coccinelle; enable_coccinelle="$enableval" else enable_coccinelle=yes fi if test "x$enable_coccinelle" = "xyes"; then : # Extract the first word of "spatch", so it can be a program name with args. set dummy spatch; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_COCCINELLE_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_COCCINELLE_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_COCCINELLE_CONFIG="$HAVE_COCCINELLE_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_COCCINELLE_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_COCCINELLE_CONFIG" && ac_cv_path_HAVE_COCCINELLE_CONFIG=""no"" ;; esac fi HAVE_COCCINELLE_CONFIG=$ac_cv_path_HAVE_COCCINELLE_CONFIG if test -n "$HAVE_COCCINELLE_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_COCCINELLE_CONFIG" >&5 $as_echo "$HAVE_COCCINELLE_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_COCCINELLE_CONFIG" = "no"; then enable_coccinelle=no fi fi if test "x$enable_coccinelle" != "xno"; then HAVE_COCCINELLE_TRUE= HAVE_COCCINELLE_FALSE='#' else HAVE_COCCINELLE_TRUE='#' HAVE_COCCINELLE_FALSE= fi # disable detection # Check whether --enable-detection was given. if test "${enable_detection+set}" = set; then : enableval=$enable_detection; enable_detection="$enableval" else enable_detection=yes fi if test "x$enable_detection" = "xno"; then : $as_echo "#define HAVE_DETECT_DISABLED 1" >>confdefs.h fi # Tilera PCIE logging if test ! -z "$TILERA_ROOT"; then BUILD_PCIE_LOGGING_TRUE= BUILD_PCIE_LOGGING_FALSE='#' else BUILD_PCIE_LOGGING_TRUE='#' BUILD_PCIE_LOGGING_FALSE= fi # libraries { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Mpipe" >&5 $as_echo_n "checking for Mpipe... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } $as_echo "#define HAVE_MPIPE 1" >>confdefs.h LDFLAGS="$LDFLAGS -lgxpci -lgxio -ltmc" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext #libpcre # Check whether --with-libpcre_includes was given. if test "${with_libpcre_includes+set}" = set; then : withval=$with_libpcre_includes; with_libpcre_includes="$withval" else with_libpcre_includes=no fi # Check whether --with-libpcre_libraries was given. if test "${with_libpcre_libraries+set}" = set; then : withval=$with_libpcre_libraries; with_libpcre_libraries="$withval" else with_libpcre_libraries="no" fi if test "$with_libpcre_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpcre_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "pcre.h" "ac_cv_header_pcre_h" "$ac_includes_default" if test "x$ac_cv_header_pcre_h" = xyes; then : else as_fn_error $? "pcre.h not found ..." "$LINENO" 5 fi if test "$with_libpcre_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpcre_libraries}" fi PCRE="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcre_get_substring in -lpcre" >&5 $as_echo_n "checking for pcre_get_substring in -lpcre... " >&6; } if ${ac_cv_lib_pcre_pcre_get_substring+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpcre $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pcre_get_substring (); int main () { return pcre_get_substring (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pcre_pcre_get_substring=yes else ac_cv_lib_pcre_pcre_get_substring=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcre_pcre_get_substring" >&5 $as_echo "$ac_cv_lib_pcre_pcre_get_substring" >&6; } if test "x$ac_cv_lib_pcre_pcre_get_substring" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPCRE 1 _ACEOF LIBS="-lpcre $LIBS" else PCRE="no" fi if test "$PCRE" = "no"; then echo echo " ERROR! pcre library not found, go get it" echo " from www.pcre.org." echo exit 1 fi # libpcre 8.35 (especially on debian) has a known issue that results in segfaults # see https://redmine.openinfosecfoundation.org/issues/1693 if test "$with_libpcre_libraries" = "no"; then pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBPCREVERSION" >&5 $as_echo_n "checking for LIBPCREVERSION... " >&6; } if test -n "$LIBPCREVERSION_CFLAGS"; then pkg_cv_LIBPCREVERSION_CFLAGS="$LIBPCREVERSION_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libpcre = 8.35\""; } >&5 ($PKG_CONFIG --exists --print-errors "libpcre = 8.35") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBPCREVERSION_CFLAGS=`$PKG_CONFIG --cflags "libpcre = 8.35" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LIBPCREVERSION_LIBS"; then pkg_cv_LIBPCREVERSION_LIBS="$LIBPCREVERSION_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libpcre = 8.35\""; } >&5 ($PKG_CONFIG --exists --print-errors "libpcre = 8.35") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBPCREVERSION_LIBS=`$PKG_CONFIG --libs "libpcre = 8.35" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LIBPCREVERSION_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libpcre = 8.35" 2>&1` else LIBPCREVERSION_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libpcre = 8.35" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LIBPCREVERSION_PKG_ERRORS" >&5 libprce_buggy_found="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } libprce_buggy_found="no" else LIBPCREVERSION_CFLAGS=$pkg_cv_LIBPCREVERSION_CFLAGS LIBPCREVERSION_LIBS=$pkg_cv_LIBPCREVERSION_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } libpcre_buggy_found="yes" fi if test "$libpcre_buggy_found" = "yes"; then echo echo " Warning! vulnerable libpcre version 8.35 found" echo " This version has a known issue that could result in segfaults" echo " please upgrade to a newer version of pcre which you can get from" echo " www.pcre.org. For more information, see issue #1693" echo echo " Continuing for now with JIT disabled..." echo fi fi # To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work # see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful PCRE="" TMPLIBS="${LIBS}" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcre_dfa_exec in -lpcre" >&5 $as_echo_n "checking for pcre_dfa_exec in -lpcre... " >&6; } if ${ac_cv_lib_pcre_pcre_dfa_exec+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpcre $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pcre_dfa_exec (); int main () { return pcre_dfa_exec (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pcre_pcre_dfa_exec=yes else ac_cv_lib_pcre_pcre_dfa_exec=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcre_pcre_dfa_exec" >&5 $as_echo "$ac_cv_lib_pcre_pcre_dfa_exec" >&6; } if test "x$ac_cv_lib_pcre_pcre_dfa_exec" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPCRE 1 _ACEOF LIBS="-lpcre $LIBS" else PCRE="no" fi if test "$PCRE" = "no"; then echo echo " ERROR! pcre library was found but version was < 6.0" echo " please upgrade to a newer version of pcre which you can get from" echo " www.pcre.org." echo exit 1 fi LIBS="${TMPLIBS}" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { int eo = 0; eo |= PCRE_EXTRA_MATCH_LIMIT_RECURSION; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : pcre_match_limit_recursion_available=yes else : fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test "$pcre_match_limit_recursion_available" != "yes"; then echo echo " Warning! pcre extra opt PCRE_EXTRA_MATCH_LIMIT_RECURSION not found" echo " This could lead to potential DoS please upgrade to pcre >= 6.5" echo " from www.pcre.org." echo " Continuing for now...." echo $as_echo "#define NO_PCRE_MATCH_RLIMIT 1" >>confdefs.h fi TMPCFLAGS="${CFLAGS}" CFLAGS="-O0 -g -Werror -Wall" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { pcre_extra *extra = NULL; pcre_free_study(extra); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : $as_echo "#define HAVE_PCRE_FREE_STUDY 1" >>confdefs.h else : fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext CFLAGS="${TMPCFLAGS}" #enable support for PCRE-jit available since pcre-8.20 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PCRE JIT support" >&5 $as_echo_n "checking for PCRE JIT support... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { int jit = 0; pcre_config(PCRE_CONFIG_JIT, &jit); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : pcre_jit_available=yes else pcre_jit_available=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext # bug 1693, libpcre 8.35 is broken and debian jessie is still using that if test "$libpcre_buggy_found" = "yes"; then pcre_jit_available="no, libpcre 8.35 blacklisted" fi if test "x$pcre_jit_available" = "xyes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } $as_echo "#define PCRE_HAVE_JIT 1" >>confdefs.h { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PCRE JIT support usability" >&5 $as_echo_n "checking for PCRE JIT support usability... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { const char* regexstr = "(a|b|c|d)"; pcre *re; const char *error; pcre_extra *extra; int err_offset; re = pcre_compile(regexstr,0, &error, &err_offset,NULL); extra = pcre_study(re, PCRE_STUDY_JIT_COMPILE, &error); if (extra == NULL) exit(EXIT_FAILURE); int jit = 0; int ret = pcre_fullinfo(re, extra, PCRE_INFO_JIT, &jit); if (ret != 0 || jit != 1) exit(EXIT_FAILURE); exit(EXIT_SUCCESS); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : pcre_jit_works=yes else : fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test "x$pcre_jit_works" != "xyes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } echo echo " PCRE JIT support detection worked but testing it failed" echo " something odd is going on, please file a bug report." echo exit 1 else { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi # libhs enable_hyperscan="no" # Try pkg-config first: pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libhs" >&5 $as_echo_n "checking for libhs... " >&6; } if test -n "$libhs_CFLAGS"; then pkg_cv_libhs_CFLAGS="$libhs_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libhs\""; } >&5 ($PKG_CONFIG --exists --print-errors "libhs") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libhs_CFLAGS=`$PKG_CONFIG --cflags "libhs" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$libhs_LIBS"; then pkg_cv_libhs_LIBS="$libhs_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libhs\""; } >&5 ($PKG_CONFIG --exists --print-errors "libhs") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libhs_LIBS=`$PKG_CONFIG --libs "libhs" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then libhs_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libhs" 2>&1` else libhs_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libhs" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$libhs_PKG_ERRORS" >&5 with_pkgconfig_libhs=no elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } with_pkgconfig_libhs=no else libhs_CFLAGS=$pkg_cv_libhs_CFLAGS libhs_LIBS=$pkg_cv_libhs_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi if test "$with_pkgconfig_libhs" != "no"; then CPPFLAGS="${CPPFLAGS} ${libhs_CFLAGS}" LIBS="${LIBS} ${libhs_LIBS}" fi # Check whether --with-libhs_includes was given. if test "${with_libhs_includes+set}" = set; then : withval=$with_libhs_includes; with_libhs_includes="$withval" else with_libhs_includes=no fi # Check whether --with-libhs_libraries was given. if test "${with_libhs_libraries+set}" = set; then : withval=$with_libhs_libraries; with_libhs_libraries="$withval" else with_libhs_libraries="no" fi if test "$with_libhs_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libhs_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "hs.h" "ac_cv_header_hs_h" "$ac_includes_default" if test "x$ac_cv_header_hs_h" = xyes; then : HYPERSCAN="yes" else HYPERSCAN="no" fi if test "$HYPERSCAN" = "yes"; then if test "$with_libhs_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhs_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for hs_compile in -lhs" >&5 $as_echo_n "checking for hs_compile in -lhs... " >&6; } if ${ac_cv_lib_hs_hs_compile+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhs $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char hs_compile (); int main () { return hs_compile (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_hs_hs_compile=yes else ac_cv_lib_hs_hs_compile=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_hs_hs_compile" >&5 $as_echo "$ac_cv_lib_hs_hs_compile" >&6; } if test "x$ac_cv_lib_hs_hs_compile" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBHS 1 _ACEOF LIBS="-lhs $LIBS" else HYPERSCAN="no" fi for ac_func in hs_valid_platform do : ac_fn_c_check_func "$LINENO" "hs_valid_platform" "ac_cv_func_hs_valid_platform" if test "x$ac_cv_func_hs_valid_platform" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_HS_VALID_PLATFORM 1 _ACEOF fi done enable_hyperscan="yes" if test "$HYPERSCAN" = "no"; then echo echo " Hyperscan headers are present, but link test failed." echo " Check that you have a shared library and C++ linkage available." echo enable_hyperscan="no" fi fi if test "x$enable_hyperscan" = "xyes"; then : $as_echo "#define BUILD_HYPERSCAN 1" >>confdefs.h fi # libyaml # Check whether --with-libyaml_includes was given. if test "${with_libyaml_includes+set}" = set; then : withval=$with_libyaml_includes; with_libyaml_includes="$withval" else with_libyaml_includes=no fi # Check whether --with-libyaml_libraries was given. if test "${with_libyaml_libraries+set}" = set; then : withval=$with_libyaml_libraries; with_libyaml_libraries="$withval" else with_libyaml_libraries="no" fi if test "$with_libyaml_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libyaml_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "yaml.h" "ac_cv_header_yaml_h" "$ac_includes_default" if test "x$ac_cv_header_yaml_h" = xyes; then : else LIBYAML="no" fi if test "$with_libyaml_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libyaml_libraries}" fi LIBYAML="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for yaml_parser_initialize in -lyaml" >&5 $as_echo_n "checking for yaml_parser_initialize in -lyaml... " >&6; } if ${ac_cv_lib_yaml_yaml_parser_initialize+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lyaml $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char yaml_parser_initialize (); int main () { return yaml_parser_initialize (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_yaml_yaml_parser_initialize=yes else ac_cv_lib_yaml_yaml_parser_initialize=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_yaml_yaml_parser_initialize" >&5 $as_echo "$ac_cv_lib_yaml_yaml_parser_initialize" >&6; } if test "x$ac_cv_lib_yaml_yaml_parser_initialize" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBYAML 1 _ACEOF LIBS="-lyaml $LIBS" else LIBYAML="no" fi if test "$LIBYAML" = "no"; then echo echo " ERROR! libyaml library not found, go get it" echo " from http://pyyaml.org/wiki/LibYAML " echo " or your distribution:" echo echo " Ubuntu: apt-get install libyaml-dev" echo " Fedora: yum install libyaml-devel" echo exit 1 fi # libpthread # Check whether --with-libpthread_includes was given. if test "${with_libpthread_includes+set}" = set; then : withval=$with_libpthread_includes; with_libpthread_includes="$withval" else with_libpthread_includes=no fi # Check whether --with-libpthread_libraries was given. if test "${with_libpthread_libraries+set}" = set; then : withval=$with_libpthread_libraries; with_libpthread_libraries="$withval" else with_libpthread_libraries="no" fi if test "$with_libpthread_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpthread_includes}" fi if test "$with_libpthread_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpthread_libraries}" fi PTHREAD="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lpthread" >&5 $as_echo_n "checking for pthread_create in -lpthread... " >&6; } if ${ac_cv_lib_pthread_pthread_create+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpthread $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pthread_create (); int main () { return pthread_create (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pthread_pthread_create=yes else ac_cv_lib_pthread_pthread_create=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pthread_pthread_create" >&5 $as_echo "$ac_cv_lib_pthread_pthread_create" >&6; } if test "x$ac_cv_lib_pthread_pthread_create" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPTHREAD 1 _ACEOF LIBS="-lpthread $LIBS" else PTHREAD="no" fi if test "$PTHREAD" = "no"; then echo echo " ERROR! libpthread library not found, glibc problem?" echo exit 1 fi # libjansson enable_jansson="no" # Check whether --with-libjansson_includes was given. if test "${with_libjansson_includes+set}" = set; then : withval=$with_libjansson_includes; with_libjansson_includes="$withval" else with_libjansson_includes=no fi # Check whether --with-libjansson_libraries was given. if test "${with_libjansson_libraries+set}" = set; then : withval=$with_libjansson_libraries; with_libjansson_libraries="$withval" else with_libjansson_libraries="no" fi if test "$with_libjansson_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libjansson_includes}" fi enable_jansson="no" enable_unixsocket="no" # Check whether --enable-unix-socket was given. if test "${enable_unix_socket+set}" = set; then : enableval=$enable_unix_socket; enable_unixsocket="$enableval" else enable_unixsocket=test fi ac_fn_c_check_header_mongrel "$LINENO" "jansson.h" "ac_cv_header_jansson_h" "$ac_includes_default" if test "x$ac_cv_header_jansson_h" = xyes; then : JANSSON="yes" else JANSSON="no" fi if test "$JANSSON" = "yes"; then if test "$with_libjansson_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libjansson_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for json_dump_callback in -ljansson" >&5 $as_echo_n "checking for json_dump_callback in -ljansson... " >&6; } if ${ac_cv_lib_jansson_json_dump_callback+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ljansson $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char json_dump_callback (); int main () { return json_dump_callback (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_jansson_json_dump_callback=yes else ac_cv_lib_jansson_json_dump_callback=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_jansson_json_dump_callback" >&5 $as_echo "$ac_cv_lib_jansson_json_dump_callback" >&6; } if test "x$ac_cv_lib_jansson_json_dump_callback" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBJANSSON 1 _ACEOF LIBS="-ljansson $LIBS" else JANSSON="no" fi enable_jansson="yes" if test "$JANSSON" = "no"; then echo echo " Jansson >= 2.2 is required for features like unix socket" echo " Go get it from your distribution or from:" echo " http://www.digip.org/jansson/" echo if test "x$enable_unixsocket" = "xyes"; then exit 1 fi enable_unixsocket="no" enable_jansson="no" else case $host in *-*-mingw32*) ;; *-*-cygwin) ;; *) if test "x$enable_unixsocket" = "xtest"; then enable_unixsocket="yes" fi ;; esac fi else if test "x$enable_unixsocket" = "xyes"; then echo echo " Jansson >= 2.2 is required for features like unix socket" echo " Go get it from your distribution or from:" echo " http://www.digip.org/jansson/" echo exit 1 fi enable_unixsocket="no" fi if test "x$enable_unixsocket" = "xyes"; then : $as_echo "#define BUILD_UNIX_SOCKET 1" >>confdefs.h fi e_enable_evelog=$enable_jansson # Check whether --enable-nflog was given. if test "${enable_nflog+set}" = set; then : enableval=$enable_nflog; enable_nflog="yes" else enable_nflog="no" fi # Check whether --enable-nfqueue was given. if test "${enable_nfqueue+set}" = set; then : enableval=$enable_nfqueue; enable_nfqueue=yes else enable_nfqueue=no fi if test "$enable_nfqueue" != "no"; then pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnetfilter_queue" >&5 $as_echo_n "checking for libnetfilter_queue... " >&6; } if test -n "$libnetfilter_queue_CFLAGS"; then pkg_cv_libnetfilter_queue_CFLAGS="$libnetfilter_queue_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnetfilter_queue\""; } >&5 ($PKG_CONFIG --exists --print-errors "libnetfilter_queue") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnetfilter_queue_CFLAGS=`$PKG_CONFIG --cflags "libnetfilter_queue" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$libnetfilter_queue_LIBS"; then pkg_cv_libnetfilter_queue_LIBS="$libnetfilter_queue_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnetfilter_queue\""; } >&5 ($PKG_CONFIG --exists --print-errors "libnetfilter_queue") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnetfilter_queue_LIBS=`$PKG_CONFIG --libs "libnetfilter_queue" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then libnetfilter_queue_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "libnetfilter_queue" 2>&1` else libnetfilter_queue_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "libnetfilter_queue" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$libnetfilter_queue_PKG_ERRORS" >&5 enable_nfqueue=no elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } enable_nfqueue=no else libnetfilter_queue_CFLAGS=$pkg_cv_libnetfilter_queue_CFLAGS libnetfilter_queue_LIBS=$pkg_cv_libnetfilter_queue_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } enable_nfqueue=yes fi CPPFLAGS="${CPPFLAGS} ${libnetfilter_queue_CFLAGS}" fi if test "x$enable_nflog" = "xyes" || test "x$enable_nfqueue" = "xyes"; then # libnfnetlink case $host in *-*-mingw32*) ;; *) # Check whether --with-libnfnetlink_includes was given. if test "${with_libnfnetlink_includes+set}" = set; then : withval=$with_libnfnetlink_includes; with_libnfnetlink_includes="$withval" else with_libnfnetlink_includes=no fi # Check whether --with-libnfnetlink_libraries was given. if test "${with_libnfnetlink_libraries+set}" = set; then : withval=$with_libnfnetlink_libraries; with_libnfnetlink_libraries="$withval" else with_libnfnetlink_libraries="no" fi if test "$with_libnfnetlink_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnfnetlink_includes}" fi if test "$with_libnfnetlink_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnfnetlink_libraries}" fi NFNL="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfnl_fd in -lnfnetlink" >&5 $as_echo_n "checking for nfnl_fd in -lnfnetlink... " >&6; } if ${ac_cv_lib_nfnetlink_nfnl_fd+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnfnetlink $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfnl_fd (); int main () { return nfnl_fd (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_nfnetlink_nfnl_fd=yes else ac_cv_lib_nfnetlink_nfnl_fd=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nfnetlink_nfnl_fd" >&5 $as_echo "$ac_cv_lib_nfnetlink_nfnl_fd" >&6; } if test "x$ac_cv_lib_nfnetlink_nfnl_fd" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNFNETLINK 1 _ACEOF LIBS="-lnfnetlink $LIBS" else NFNL="no" fi if test "$NFNL" = "no"; then echo echo " ERROR! nfnetlink library not found, go get it" echo " from www.netfilter.org." echo " we automatically append libnetfilter_queue/ when searching" echo " for headers etc. when the --with-libnfnetlink-includes directive" echo " is used" echo fi ;; esac fi # enable support for NFQUEUE if test "x$enable_nfqueue" = "xyes"; then : cat >>confdefs.h <<_ACEOF #define NFQ 1 _ACEOF #libnetfilter_queue # Check whether --with-libnetfilter_queue_includes was given. if test "${with_libnetfilter_queue_includes+set}" = set; then : withval=$with_libnetfilter_queue_includes; with_libnetfilter_queue_includes="$withval" else with_libnetfilter_queue_includes=no fi # Check whether --with-libnetfilter_queue_libraries was given. if test "${with_libnetfilter_queue_libraries+set}" = set; then : withval=$with_libnetfilter_queue_libraries; with_libnetfilter_queue_libraries="$withval" else with_libnetfilter_queue_libraries="no" fi if test "$with_libnetfilter_queue_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnetfilter_queue_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "libnetfilter_queue/libnetfilter_queue.h" "ac_cv_header_libnetfilter_queue_libnetfilter_queue_h" "$ac_includes_default" if test "x$ac_cv_header_libnetfilter_queue_libnetfilter_queue_h" = xyes; then : else as_fn_error $? "libnetfilter_queue/libnetfilter_queue.h not found ..." "$LINENO" 5 fi if test "$with_libnetfilter_queue_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnetfilter_queue_libraries}" fi #LDFLAGS="${LDFLAGS} -lnetfilter_queue" NFQ="" case $host in *-*-mingw32*) { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_open in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_open in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue -lws2_32 $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_open (); int main () { return nfq_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_open=yes else ac_cv_lib_netfilter_queue_nfq_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_open" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_open" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNETFILTER_QUEUE 1 _ACEOF LIBS="-lnetfilter_queue $LIBS" else NFQ="no" fi # Check whether --with-netfilterforwin_includes was given. if test "${with_netfilterforwin_includes+set}" = set; then : withval=$with_netfilterforwin_includes; with_netfilterforwin_includes="$withval" else with_netfilterforwin_includes=no fi if test "$with_netfilterforwin_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_netfilterforwin_includes}" else CPPFLAGS="${CPPFLAGS} -I../../netfilterforwin" fi ;; *) { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_open in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_open in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_open (); int main () { return nfq_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_open=yes else ac_cv_lib_netfilter_queue_nfq_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_open" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_open" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNETFILTER_QUEUE 1 _ACEOF LIBS="-lnetfilter_queue $LIBS" else NFQ="no" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_set_queue_maxlen in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_set_queue_maxlen in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue -lnfnetlink $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_set_queue_maxlen (); int main () { return nfq_set_queue_maxlen (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen=yes else ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_set_queue_maxlen" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_NFQ_MAXLEN 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_set_verdict2 in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_set_verdict2 in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_set_verdict2+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue -lnfnetlink $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_set_verdict2 (); int main () { return nfq_set_verdict2 (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_set_verdict2=yes else ac_cv_lib_netfilter_queue_nfq_set_verdict2=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_set_verdict2" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict2" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict2" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_NFQ_SET_VERDICT2 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_set_queue_flags in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_set_queue_flags in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_set_queue_flags+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue -lnfnetlink $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_set_queue_flags (); int main () { return nfq_set_queue_flags (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_set_queue_flags=yes else ac_cv_lib_netfilter_queue_nfq_set_queue_flags=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_set_queue_flags" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_set_queue_flags" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_set_queue_flags" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_NFQ_SET_QUEUE_FLAGS 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nfq_set_verdict_batch in -lnetfilter_queue" >&5 $as_echo_n "checking for nfq_set_verdict_batch in -lnetfilter_queue... " >&6; } if ${ac_cv_lib_netfilter_queue_nfq_set_verdict_batch+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_queue -lnfnetlink $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nfq_set_verdict_batch (); int main () { return nfq_set_verdict_batch (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_queue_nfq_set_verdict_batch=yes else ac_cv_lib_netfilter_queue_nfq_set_verdict_batch=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_queue_nfq_set_verdict_batch" >&5 $as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict_batch" >&6; } if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict_batch" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_NFQ_SET_VERDICT_BATCH 1 _ACEOF fi # check if the argument to nfq_get_payload is signed or unsigned { $as_echo "$as_me:${as_lineno-$LINENO}: checking for signed nfq_get_payload payload argument" >&5 $as_echo_n "checking for signed nfq_get_payload payload argument... " >&6; } STORECFLAGS="${CFLAGS}" if test `basename $CC` = "clang"; then CFLAGS="${CFLAGS} -Werror=incompatible-pointer-types" else CFLAGS="${CFLAGS} -Werror" fi cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { char *pktdata; nfq_get_payload(NULL, &pktdata); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : libnetfilter_queue_nfq_get_payload_signed="yes" else libnetfilter_queue_nfq_get_payload_signed="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $libnetfilter_queue_nfq_get_payload_signed" >&5 $as_echo "$libnetfilter_queue_nfq_get_payload_signed" >&6; } if test "x$libnetfilter_queue_nfq_get_payload_signed" = "xyes"; then $as_echo "#define NFQ_GET_PAYLOAD_SIGNED 1" >>confdefs.h fi CFLAGS="${STORECFLAGS}" ;; esac if test "$NFQ" = "no"; then echo echo " ERROR! libnetfilter_queue library not found, go get it" echo " from www.netfilter.org." echo " we automatically append libnetfilter_queue/ when searching" echo " for headers etc. when the --with-libnfq-includes directive" echo " is used" echo exit 1 fi fi # libnetfilter_log # Check whether --with-libnetfilter_log_includes was given. if test "${with_libnetfilter_log_includes+set}" = set; then : withval=$with_libnetfilter_log_includes; with_libnetfilter_log_includes="$withval" else with_libnetfilter_log_includes="no" fi # Check whether --with-libnetfilter_log_libraries was given. if test "${with_libnetfilter_log_libraries+set}" = set; then : withval=$with_libnetfilter_log_libraries; with_libnetfilter_log_libraries="$withval" else with_libnetfilter_log_libraries="no" fi if test "$enable_nflog" = "yes"; then if test "$with_libnetfilter_log_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnetfilter_log_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "libnetfilter_log/libnetfilter_log.h" "ac_cv_header_libnetfilter_log_libnetfilter_log_h" "$ac_includes_default" if test "x$ac_cv_header_libnetfilter_log_libnetfilter_log_h" = xyes; then : else as_fn_error $? "libnetfilter_log.h not found ..." "$LINENO" 5 fi if test "$with_libnetfilter_log_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnetfilter_log_libraries}" fi NFLOG="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nflog_open in -lnetfilter_log" >&5 $as_echo_n "checking for nflog_open in -lnetfilter_log... " >&6; } if ${ac_cv_lib_netfilter_log_nflog_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnetfilter_log $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char nflog_open (); int main () { return nflog_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_netfilter_log_nflog_open=yes else ac_cv_lib_netfilter_log_nflog_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_netfilter_log_nflog_open" >&5 $as_echo "$ac_cv_lib_netfilter_log_nflog_open" >&6; } if test "x$ac_cv_lib_netfilter_log_nflog_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNETFILTER_LOG 1 _ACEOF LIBS="-lnetfilter_log $LIBS" else NFLOG="no" fi if test "$NFLOG" = "no"; then echo echo " ERROR! libnetfilter_log library not found, go get it" echo " from http://www.netfilter.org." echo exit 1 else $as_echo "#define HAVE_NFLOG 1" >>confdefs.h enable_nflog="yes" fi fi # prelude # Check whether --enable-prelude was given. if test "${enable_prelude+set}" = set; then : enableval=$enable_prelude; else enable_prelude=no fi # Prelude doesn't work with -Werror STORECFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Wno-error=unused-result" if test "x$enable_prelude" = "xyes"; then : # Check whether --with-libprelude-prefix was given. if test "${with_libprelude_prefix+set}" = set; then : withval=$with_libprelude_prefix; libprelude_config_prefix="$withval" else libprelude_config_prefix="" fi if test x$libprelude_config_prefix != x ; then if test x${LIBPRELUDE_CONFIG+set} != xset ; then LIBPRELUDE_CONFIG=$libprelude_config_prefix/bin/libprelude-config fi fi # Extract the first word of "libprelude-config", so it can be a program name with args. set dummy libprelude-config; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_LIBPRELUDE_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $LIBPRELUDE_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_LIBPRELUDE_CONFIG="$LIBPRELUDE_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_LIBPRELUDE_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_LIBPRELUDE_CONFIG" && ac_cv_path_LIBPRELUDE_CONFIG="no" ;; esac fi LIBPRELUDE_CONFIG=$ac_cv_path_LIBPRELUDE_CONFIG if test -n "$LIBPRELUDE_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIBPRELUDE_CONFIG" >&5 $as_echo "$LIBPRELUDE_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$LIBPRELUDE_CONFIG" != "no"; then if $($LIBPRELUDE_CONFIG --thread > /dev/null 2>&1); then LIBPRELUDE_PTHREAD_CFLAGS=`$LIBPRELUDE_CONFIG --thread --cflags` if test xno = xtrue || test xno = xyes; then libprelude_config_args="--thread" else libprelude_config_args="--no-thread" fi else LIBPRELUDE_PTHREAD_CFLAGS=`$LIBPRELUDE_CONFIG --pthread-cflags` fi fi min_libprelude_version=0.9.9 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libprelude - version >= $min_libprelude_version" >&5 $as_echo_n "checking for libprelude - version >= $min_libprelude_version... " >&6; } no_libprelude="" if test "$LIBPRELUDE_CONFIG" = "no" ; then no_libprelude=yes else LIBPRELUDE_CFLAGS=`$LIBPRELUDE_CONFIG $libprelude_config_args --cflags` LIBPRELUDE_LDFLAGS=`$LIBPRELUDE_CONFIG $libprelude_config_args --ldflags` LIBPRELUDE_LIBS=`$LIBPRELUDE_CONFIG $libprelude_config_args --libs` LIBPRELUDE_PREFIX=`$LIBPRELUDE_CONFIG $libprelude_config_args --prefix` LIBPRELUDE_CONFIG_PREFIX=`$LIBPRELUDE_CONFIG $libprelude_config_args --config-prefix` libprelude_config_version=`$LIBPRELUDE_CONFIG $libprelude_config_args --version` ac_save_CFLAGS="$CFLAGS" ac_save_LDFLAGS="$LDFLAGS" ac_save_LIBS="$LIBS" CFLAGS="$CFLAGS $LIBPRELUDE_CFLAGS" LDFLAGS="$LDFLAGS $LIBPRELUDE_LDFLAGS" LIBS="$LIBS $LIBPRELUDE_LIBS" rm -f conf.libpreludetest if test "$cross_compiling" = yes; then : echo $ac_n "cross compiling; assumed OK... $ac_c" else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { system ("touch conf.libpreludetest"); if( strcmp( prelude_check_version(NULL), "$libprelude_config_version" ) ) { printf("\n*** 'libprelude-config --version' returned %s, but LIBPRELUDE (%s)\n", "$libprelude_config_version", prelude_check_version(NULL) ); printf("*** was found! If libprelude-config was correct, then it is best\n"); printf("*** to remove the old version of LIBPRELUDE. You may also be able to fix the error\n"); printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n"); printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n"); printf("*** required on your system.\n"); printf("*** If libprelude-config was wrong, set the environment variable LIBPRELUDE_CONFIG\n"); printf("*** to point to the correct copy of libprelude-config, and remove the file config.cache\n"); printf("*** before re-running configure\n"); } else if ( strcmp(prelude_check_version(NULL), LIBPRELUDE_VERSION ) ) { printf("\n*** LIBPRELUDE header file (version %s) does not match\n", LIBPRELUDE_VERSION); printf("*** library (version %s)\n", prelude_check_version(NULL) ); } else { if ( prelude_check_version( "$min_libprelude_version" ) ) return 0; else { printf("no\n*** An old version of LIBPRELUDE (%s) was found.\n", prelude_check_version(NULL) ); printf("*** You need a version of LIBPRELUDE newer than %s. The latest version of\n", "$min_libprelude_version" ); printf("*** LIBPRELUDE is always available from http://www.prelude-siem.com/index.php/en/community/download\n"); printf("*** \n"); printf("*** If you have already installed a sufficiently new version, this error\n"); printf("*** probably means that the wrong copy of the libprelude-config shell script is\n"); printf("*** being found. The easiest way to fix this is to remove the old version\n"); printf("*** of LIBPRELUDE, but you can also set the LIBPRELUDE_CONFIG environment to point to the\n"); printf("*** correct copy of libprelude-config. (In this case, you will have to\n"); printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n"); printf("*** so that the correct libraries are found at run-time))\n"); } } return 1; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : else no_libprelude=yes fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi CFLAGS="$ac_save_CFLAGS" LIBS="$ac_save_LIBS" LDFLAGS="$ac_save_LDFLAGS" fi if test "x$no_libprelude" = x ; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : else if test -f conf.libpreludetest ; then : else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$LIBPRELUDE_CONFIG" = "no" ; then echo "*** The libprelude-config script installed by LIBPRELUDE could not be found" echo "*** If LIBPRELUDE was installed in PREFIX, make sure PREFIX/bin is in" echo "*** your path, or set the LIBPRELUDE_CONFIG environment variable to the" echo "*** full path to libprelude-config." else if test -f conf.libpreludetest ; then : else echo "*** Could not run libprelude test program, checking why..." CFLAGS="$CFLAGS $LIBPRELUDE_CFLAGS" LDFLAGS="$LDFLAGS $LIBPRELUDE_LDFLAGS" LIBS="$LIBS $LIBPRELUDE_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { return !!prelude_check_version(NULL); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : echo "*** The test program compiled, but did not run. This usually means" echo "*** that the run-time linker is not finding LIBPRELUDE or finding the wrong" echo "*** version of LIBPRELUDE. If it is not finding LIBPRELUDE, you'll need to set your" echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point" echo "*** to the installed location Also, make sure you have run ldconfig if that" echo "*** is required on your system" echo "***" echo "*** If you have an old version installed, it is best to remove it, although" echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH" echo "***" else echo "*** The test program failed to compile or link. See the file config.log for the" echo "*** exact error that occured. This usually means LIBPRELUDE was incorrectly installed" echo "*** or that you have moved LIBPRELUDE since it was installed. In the latter case, you" echo "*** may want to edit the libprelude-config script: $LIBPRELUDE_CONFIG" fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext CFLAGS="$ac_save_CFLAGS" LDFLAGS="$ac_save_LDFLAGS" LIBS="$ac_save_LIBS" fi fi LIBPRELUDE_CFLAGS="" LIBPRELUDE_LDFLAGS="" LIBPRELUDE_LIBS="" as_fn_error $? "Cannot find libprelude: Is libprelude-config in the path?" "$LINENO" 5 fi rm -f conf.libpreludetest $as_echo "#define PRELUDE_APPLICATION_USE_LIBTOOL2 /**/" >>confdefs.h if test "x${LIBPRELUDE_CFLAGS}" != "x"; then CPPFLAGS="${CPPFLAGS} ${LIBPRELUDE_CFLAGS}" fi if test "x${LIBPRELUDE_LDFLAGS}" != "x"; then LDFLAGS="${LDFLAGS} ${LIBPRELUDE_LDFLAGS}" fi if test "x${LIBPRELUDE_LIBS}" != "x"; then LDFLAGS="${LDFLAGS} ${LIBPRELUDE_LIBS}" fi $as_echo "#define PRELUDE 1" >>confdefs.h fi CFLAGS="${STORECFLAGS}" # libnet # Check whether --with-libnet_includes was given. if test "${with_libnet_includes+set}" = set; then : withval=$with_libnet_includes; with_libnet_includes="$withval" else with_libnet_includes="no" fi # Check whether --with-libnet_libraries was given. if test "${with_libnet_libraries+set}" = set; then : withval=$with_libnet_libraries; with_libnet_libraries="$withval" else with_libnet_libraries="no" fi if test "x$with_libnet_includes" != "xno"; then CPPFLAGS="${CPPFLAGS} -I${with_libnet_includes}" libnet_dir="${with_libnet_includes}" else libnet_dir="/usr/include /usr/local/include /usr/local/include/libnet11 /opt/local/include /usr/local/include/libnet-1.1" fi if test "x$with_libnet_libraries" != "xno"; then LDFLAGS="${LDFLAGS} -L${with_libnet_libraries}" fi LIBNET_DETECT_FAIL="no" LIBNET_INC_DIR="" for i in $libnet_dir; do if test -r "$i/libnet.h"; then LIBNET_INC_DIR="$i" fi done enable_libnet="no" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnet.h version 1.1.x" >&5 $as_echo_n "checking for libnet.h version 1.1.x... " >&6; } if test "$LIBNET_INC_DIR" != ""; then LIBNET_VER=`grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep '1.[12]' | sed 's/[^"]*"\([^"]*\).*/\1/'` if test -z "$LIBNET_VER" ; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi #CentOS, Fedora, Ubuntu-LTS, Ubuntu all set defines to the same values. libnet-config seems #to have been depreciated but all distro's seem to include it as part of the package. if test "$LIBNET_DETECT_FAIL" = "no"; then LLIBNET="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnet_write in -lnet" >&5 $as_echo_n "checking for libnet_write in -lnet... " >&6; } if ${ac_cv_lib_net_libnet_write+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnet $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char libnet_write (); int main () { return libnet_write (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_net_libnet_write=yes else ac_cv_lib_net_libnet_write=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_net_libnet_write" >&5 $as_echo "$ac_cv_lib_net_libnet_write" >&6; } if test "x$ac_cv_lib_net_libnet_write" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNET 1 _ACEOF LIBS="-lnet $LIBS" else LLIBNET="no" fi if test "$LLIBNET" != "no"; then $as_echo "#define HAVE_LIBNET11 1" >>confdefs.h $as_echo "#define _DEFAULT_SOURCE 1" >>confdefs.h $as_echo "#define _BSD_SOURCE 1" >>confdefs.h $as_echo "#define __BSD_SOURCE 1" >>confdefs.h $as_echo "#define __FAVOR_BSD 1" >>confdefs.h $as_echo "#define HAVE_NET_ETHERNET_H 1" >>confdefs.h enable_libnet="yes" fi # see if we have the patched libnet 1.1 # http://www.inliniac.net/blog/2007/10/16/libnet-11-ipv6-fixes-and-additions.html # # To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work # see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful if test "$enable_libnet" = "yes"; then LLIBNET="" TMPLIBS="${LIBS}" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnet_build_icmpv6_unreach in -lnet" >&5 $as_echo_n "checking for libnet_build_icmpv6_unreach in -lnet... " >&6; } if ${ac_cv_lib_net_libnet_build_icmpv6_unreach+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnet $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char libnet_build_icmpv6_unreach (); int main () { return libnet_build_icmpv6_unreach (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_net_libnet_build_icmpv6_unreach=yes else ac_cv_lib_net_libnet_build_icmpv6_unreach=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_net_libnet_build_icmpv6_unreach" >&5 $as_echo "$ac_cv_lib_net_libnet_build_icmpv6_unreach" >&6; } if test "x$ac_cv_lib_net_libnet_build_icmpv6_unreach" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNET 1 _ACEOF LIBS="-lnet $LIBS" else LLIBNET="no" fi if test "$LLIBNET" != "no"; then $as_echo "#define HAVE_LIBNET_ICMPV6_UNREACH 1" >>confdefs.h fi LIBS="${TMPLIBS}" fi # See if we have libnet 1.1.6 or newer - these versions handle capabilities correctly # Some patched 1.1.4 versions are also good, but it's not guaranteed for all distros. # # Details: https://bugzilla.redhat.com/show_bug.cgi?id=589770 as_arg_v1=LIBNET_VER as_arg_v2=1.1.6 awk "$as_awk_strverscmp" v1="$as_arg_v1" v2="$as_arg_v2" /dev/null case $? in 1) : ;; 0) $as_echo "#define HAVE_LIBNET_CAPABILITIES 1" >>confdefs.h ;; 2) $as_echo "#define HAVE_LIBNET_CAPABILITIES 1" >>confdefs.h ;; esac # check if the argument to libnet_init is char* or const char* { $as_echo "$as_me:${as_lineno-$LINENO}: checking libnet_init dev type" >&5 $as_echo_n "checking libnet_init dev type... " >&6; } STORECFLAGS="${CFLAGS}" if test `basename $CC` = "clang"; then CFLAGS="${CFLAGS} -Werror=incompatible-pointer-types" else CFLAGS="${CFLAGS} -Werror" fi cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { const char dev[32] = ""; char ebuf[LIBNET_ERRBUF_SIZE]; (void)libnet_init(LIBNET_LINK, dev, ebuf); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : libnet_init_const="yes" else libnet_init_const="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $libnet_init_const" >&5 $as_echo "$libnet_init_const" >&6; } if test "x$libnet_init_const" = "xyes"; then $as_echo "#define HAVE_LIBNET_INIT_CONST 1" >>confdefs.h fi CFLAGS="${STORECFLAGS}" fi else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi # libpcap # Check whether --with-libpcap_includes was given. if test "${with_libpcap_includes+set}" = set; then : withval=$with_libpcap_includes; with_libpcap_includes="$withval" else with_libpcap_includes=no fi # Check whether --with-libpcap_libraries was given. if test "${with_libpcap_libraries+set}" = set; then : withval=$with_libpcap_libraries; with_libpcap_libraries="$withval" else with_libpcap_libraries="no" fi if test "$with_libpcap_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpcap_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "pcap.h" "ac_cv_header_pcap_h" "$ac_includes_default" if test "x$ac_cv_header_pcap_h" = xyes; then : else as_fn_error $? "pcap.h not found ..." "$LINENO" 5 fi if test "$with_libpcap_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpcap_libraries}" fi for ac_header in pcap.h pcap/pcap.h pcap/bpf.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done LIBPCAP="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcap_open_live in -lpcap" >&5 $as_echo_n "checking for pcap_open_live in -lpcap... " >&6; } if ${ac_cv_lib_pcap_pcap_open_live+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpcap $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pcap_open_live (); int main () { return pcap_open_live (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pcap_pcap_open_live=yes else ac_cv_lib_pcap_pcap_open_live=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcap_pcap_open_live" >&5 $as_echo "$ac_cv_lib_pcap_pcap_open_live" >&6; } if test "x$ac_cv_lib_pcap_pcap_open_live" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPCAP 1 _ACEOF LIBS="-lpcap $LIBS" else LIBPCAP="no" fi if test "$LIBPCAP" = "no"; then echo echo " ERROR! libpcap library not found, go get it" echo " from http://www.tcpdump.org or your distribution:" echo echo " Ubuntu: apt-get install libpcap-dev" echo " Fedora: yum install libpcap-devel" echo exit 1 fi # pcap_activate and pcap_create only exists in libpcap >= 1.0 LIBPCAPVTEST="" #To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work #see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful TMPLIBS="${LIBS}" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcap_activate in -lpcap" >&5 $as_echo_n "checking for pcap_activate in -lpcap... " >&6; } if ${ac_cv_lib_pcap_pcap_activate+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpcap $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pcap_activate (); int main () { return pcap_activate (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pcap_pcap_activate=yes else ac_cv_lib_pcap_pcap_activate=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcap_pcap_activate" >&5 $as_echo "$ac_cv_lib_pcap_pcap_activate" >&6; } if test "x$ac_cv_lib_pcap_pcap_activate" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPCAP 1 _ACEOF LIBS="-lpcap $LIBS" else LPCAPVTEST="no" fi if test "$LPCAPVTEST" != "no"; then # Extract the first word of "pcap-config", so it can be a program name with args. set dummy pcap-config; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_PCAP_CONFIG+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_PCAP_CONFIG in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_PCAP_CONFIG="$HAVE_PCAP_CONFIG" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_PCAP_CONFIG="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_PCAP_CONFIG" && ac_cv_path_HAVE_PCAP_CONFIG=""no"" ;; esac fi HAVE_PCAP_CONFIG=$ac_cv_path_HAVE_PCAP_CONFIG if test -n "$HAVE_PCAP_CONFIG"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_PCAP_CONFIG" >&5 $as_echo "$HAVE_PCAP_CONFIG" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_PCAP_CONFIG" = "no" -o "$cross_compiling" = "yes"; then $as_echo "#define LIBPCAP_VERSION_MAJOR 1" >>confdefs.h else PCAP_CFLAGS="$(pcap-config --defines) $(pcap-config --cflags)" $as_echo "#define LIBPCAP_VERSION_MAJOR 1" >>confdefs.h fi else $as_echo "#define LIBPCAP_VERSION_MAJOR 0" >>confdefs.h fi LIBS="${TMPLIBS}" #Appears as if pcap_set_buffer_size is linux only? LIBPCAPSBUFF="" #To prevent duping the lib link we reset LIBS after this check. Setting action-if-found to NULL doesn't seem to work #see: http://blog.flameeyes.eu/2008/04/29/i-consider-ac_check_lib-harmful TMPLIBS="${LIBS}" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pcap_set_buffer_size in -lpcap" >&5 $as_echo_n "checking for pcap_set_buffer_size in -lpcap... " >&6; } if ${ac_cv_lib_pcap_pcap_set_buffer_size+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpcap $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pcap_set_buffer_size (); int main () { return pcap_set_buffer_size (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pcap_pcap_set_buffer_size=yes else ac_cv_lib_pcap_pcap_set_buffer_size=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pcap_pcap_set_buffer_size" >&5 $as_echo "$ac_cv_lib_pcap_pcap_set_buffer_size" >&6; } if test "x$ac_cv_lib_pcap_pcap_set_buffer_size" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPCAP 1 _ACEOF LIBS="-lpcap $LIBS" else LPCAPSBUFF="no" fi if test "$LPCAPSBUFF" != "no"; then $as_echo "#define HAVE_PCAP_SET_BUFF 1" >>confdefs.h fi LIBS="${TMPLIBS}" # libpfring # libpfring (currently only supported for libpcap enabled pfring) # Error on the side of caution. If libpfring enabled pcap is being used and we don't link against -lpfring compilation will fail. # Check whether --enable-pfring was given. if test "${enable_pfring+set}" = set; then : enableval=$enable_pfring; else enable_pfring=no fi if test "x$enable_pfring" = "xyes"; then : $as_echo "#define HAVE_PFRING 1" >>confdefs.h #We have to set CFLAGS for AC_TRY_COMPILE as it doesn't pay attention to CPPFLAGS # Check whether --with-libpfring_includes was given. if test "${with_libpfring_includes+set}" = set; then : withval=$with_libpfring_includes; with_libpfring_includes="$withval" else with_libpfring_includes=no fi # Check whether --with-libpfring_libraries was given. if test "${with_libpfring_libraries+set}" = set; then : withval=$with_libpfring_libraries; with_libpfring_libraries="$withval" else with_libpfring_libraries="no" fi if test "$with_libpfring_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libpfring_includes}" fi if test "$with_libpfring_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libpfring_libraries}" fi LIBPFRING="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pfring_open in -lpfring" >&5 $as_echo_n "checking for pfring_open in -lpfring... " >&6; } if ${ac_cv_lib_pfring_pfring_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lpfring -lpcap $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char pfring_open (); int main () { return pfring_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_pfring_pfring_open=yes else ac_cv_lib_pfring_pfring_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pfring_pfring_open" >&5 $as_echo "$ac_cv_lib_pfring_pfring_open" >&6; } if test "x$ac_cv_lib_pfring_pfring_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBPFRING 1 _ACEOF LIBS="-lpfring $LIBS" else LIBPFRING="no" fi if test "$LIBPFRING" != "no"; then STORECFLAGS="${CFLAGS}" CFLAGS="${CFLAGS} -Werror" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { pfring_recv_chunk(NULL, NULL, 0, 0); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : pfring_recv_chunk="yes" else pfring_recv_chunk="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext CFLAGS="${STORECFLAGS}" if test "x$pfring_recv_chunk" != "xyes"; then if test "x$enable_pfring" = "xyes"; then echo echo " ERROR! --enable-pfring was passed but the library version is < 6, go get it" echo " from http://www.ntop.org/products/pf_ring/" echo exit 1 fi fi else if test "x$enable_pfring" = "xyes"; then echo echo " ERROR! --enable-pfring was passed but the library was not found, go get it" echo " from http://www.ntop.org/products/pf_ring/" echo exit 1 fi fi fi # AF_PACKET support # Check whether --enable-af-packet was given. if test "${enable_af_packet+set}" = set; then : enableval=$enable_af_packet; else enable_af_packet=yes fi if test "x$enable_af_packet" = "xyes"; then : ac_fn_c_check_decl "$LINENO" "TPACKET_V2" "ac_cv_have_decl_TPACKET_V2" "#include #include " if test "x$ac_cv_have_decl_TPACKET_V2" = xyes; then : $as_echo "#define HAVE_AF_PACKET 1" >>confdefs.h else enable_af_packet="no" fi ac_fn_c_check_decl "$LINENO" "PACKET_FANOUT_QM" "ac_cv_have_decl_PACKET_FANOUT_QM" "#include " if test "x$ac_cv_have_decl_PACKET_FANOUT_QM" = xyes; then : $as_echo "#define HAVE_PACKET_FANOUT 1" >>confdefs.h fi ac_fn_c_check_decl "$LINENO" "TPACKET_V3" "ac_cv_have_decl_TPACKET_V3" "#include #include " if test "x$ac_cv_have_decl_TPACKET_V3" = xyes; then : $as_echo "#define HAVE_TPACKET_V3 1" >>confdefs.h fi ac_fn_c_check_decl "$LINENO" "SOF_TIMESTAMPING_RAW_HARDWARE" "ac_cv_have_decl_SOF_TIMESTAMPING_RAW_HARDWARE" "#include " if test "x$ac_cv_have_decl_SOF_TIMESTAMPING_RAW_HARDWARE" = xyes; then : $as_echo "#define HAVE_HW_TIMESTAMPING 1" >>confdefs.h fi fi # Netmap support # Check whether --enable-netmap was given. if test "${enable_netmap+set}" = set; then : enableval=$enable_netmap; else enable_netmap=no fi # Check whether --with-netmap_includes was given. if test "${with_netmap_includes+set}" = set; then : withval=$with_netmap_includes; with_netmap_includes="$withval" else with_netmap_includes=no fi if test "x$enable_netmap" = "xyes"; then : $as_echo "#define HAVE_NETMAP 1" >>confdefs.h if test "$with_netmap_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_netmap_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "net/netmap_user.h" "ac_cv_header_net_netmap_user_h" "$ac_includes_default" if test "x$ac_cv_header_net_netmap_user_h" = xyes; then : else as_fn_error $? "net/netmap_user.h not found ..." "$LINENO" 5 fi fi # libhtp # Check whether --enable-non-bundled-htp was given. if test "${enable_non_bundled_htp+set}" = set; then : enableval=$enable_non_bundled_htp; else enable_non_bundled_htp=no fi if test "x$enable_non_bundled_htp" = "xyes"; then : pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libhtp" >&5 $as_echo_n "checking for libhtp... " >&6; } if test -n "$libhtp_CFLAGS"; then pkg_cv_libhtp_CFLAGS="$libhtp_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libhtp_CFLAGS=`$PKG_CONFIG --cflags "htp" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$libhtp_LIBS"; then pkg_cv_libhtp_LIBS="$libhtp_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libhtp_LIBS=`$PKG_CONFIG --libs "htp" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then libhtp_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "htp" 2>&1` else libhtp_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "htp" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$libhtp_PKG_ERRORS" >&5 with_pkgconfig_htp=no elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } with_pkgconfig_htp=no else libhtp_CFLAGS=$pkg_cv_libhtp_CFLAGS libhtp_LIBS=$pkg_cv_libhtp_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi if test "$with_pkgconfig_htp" != "no"; then CPPFLAGS="${CPPFLAGS} ${libhtp_CFLAGS}" LIBS="${LIBS} ${libhtp_LIBS}" fi # Check whether --with-libhtp_includes was given. if test "${with_libhtp_includes+set}" = set; then : withval=$with_libhtp_includes; with_libhtp_includes="$withval" else with_libhtp_includes=no fi # Check whether --with-libhtp_libraries was given. if test "${with_libhtp_libraries+set}" = set; then : withval=$with_libhtp_libraries; with_libhtp_libraries="$withval" else with_libhtp_libraries="no" fi if test "$with_libhtp_includes" != "no"; then CPPFLAGS="-I${with_libhtp_includes} ${CPPFLAGS}" fi if test "$with_libhtp_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhtp_libraries}" fi ac_fn_c_check_header_mongrel "$LINENO" "htp/htp.h" "ac_cv_header_htp_htp_h" "$ac_includes_default" if test "x$ac_cv_header_htp_htp_h" = xyes; then : else as_fn_error $? "htp/htp.h not found ..." "$LINENO" 5 fi LIBHTP="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for htp_conn_create in -lhtp" >&5 $as_echo_n "checking for htp_conn_create in -lhtp... " >&6; } if ${ac_cv_lib_htp_htp_conn_create+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhtp $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char htp_conn_create (); int main () { return htp_conn_create (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_htp_htp_conn_create=yes else ac_cv_lib_htp_htp_conn_create=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_htp_htp_conn_create" >&5 $as_echo "$ac_cv_lib_htp_htp_conn_create" >&6; } if test "x$ac_cv_lib_htp_htp_conn_create" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBHTP 1 _ACEOF LIBS="-lhtp $LIBS" else LIBHTP="no" fi if test "$LIBHTP" = "no"; then echo echo " ERROR! libhtp library not found" echo exit 1 fi pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBHTPMINVERSION" >&5 $as_echo_n "checking for LIBHTPMINVERSION... " >&6; } if test -n "$LIBHTPMINVERSION_CFLAGS"; then pkg_cv_LIBHTPMINVERSION_CFLAGS="$LIBHTPMINVERSION_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp >= 0.5.20\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp >= 0.5.20") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBHTPMINVERSION_CFLAGS=`$PKG_CONFIG --cflags "htp >= 0.5.20" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LIBHTPMINVERSION_LIBS"; then pkg_cv_LIBHTPMINVERSION_LIBS="$LIBHTPMINVERSION_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp >= 0.5.20\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp >= 0.5.20") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBHTPMINVERSION_LIBS=`$PKG_CONFIG --libs "htp >= 0.5.20" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LIBHTPMINVERSION_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "htp >= 0.5.20" 2>&1` else LIBHTPMINVERSION_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "htp >= 0.5.20" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LIBHTPMINVERSION_PKG_ERRORS" >&5 libhtp_minver_found="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } libhtp_minver_found="no" else LIBHTPMINVERSION_CFLAGS=$pkg_cv_LIBHTPMINVERSION_CFLAGS LIBHTPMINVERSION_LIBS=$pkg_cv_LIBHTPMINVERSION_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } libhtp_minver_found="yes" fi if test "$libhtp_minver_found" = "no"; then pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBHTPDEVVERSION" >&5 $as_echo_n "checking for LIBHTPDEVVERSION... " >&6; } if test -n "$LIBHTPDEVVERSION_CFLAGS"; then pkg_cv_LIBHTPDEVVERSION_CFLAGS="$LIBHTPDEVVERSION_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp = 0.5.X\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp = 0.5.X") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBHTPDEVVERSION_CFLAGS=`$PKG_CONFIG --cflags "htp = 0.5.X" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LIBHTPDEVVERSION_LIBS"; then pkg_cv_LIBHTPDEVVERSION_LIBS="$LIBHTPDEVVERSION_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"htp = 0.5.X\""; } >&5 ($PKG_CONFIG --exists --print-errors "htp = 0.5.X") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LIBHTPDEVVERSION_LIBS=`$PKG_CONFIG --libs "htp = 0.5.X" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LIBHTPDEVVERSION_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "htp = 0.5.X" 2>&1` else LIBHTPDEVVERSION_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "htp = 0.5.X" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LIBHTPDEVVERSION_PKG_ERRORS" >&5 libhtp_devver_found="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } libhtp_devver_found="no" else LIBHTPDEVVERSION_CFLAGS=$pkg_cv_LIBHTPDEVVERSION_CFLAGS LIBHTPDEVVERSION_LIBS=$pkg_cv_LIBHTPDEVVERSION_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } libhtp_devver_found="yes" fi if test "$libhtp_devver_found" = "no"; then echo echo " ERROR! libhtp was found but it is neither >= 0.5.20, nor the dev 0.5.X" echo exit 1 fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for htp_config_register_request_uri_normalize in -lhtp" >&5 $as_echo_n "checking for htp_config_register_request_uri_normalize in -lhtp... " >&6; } if ${ac_cv_lib_htp_htp_config_register_request_uri_normalize+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhtp -lhtp $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char htp_config_register_request_uri_normalize (); int main () { return htp_config_register_request_uri_normalize (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_htp_htp_config_register_request_uri_normalize=yes else ac_cv_lib_htp_htp_config_register_request_uri_normalize=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_htp_htp_config_register_request_uri_normalize" >&5 $as_echo "$ac_cv_lib_htp_htp_config_register_request_uri_normalize" >&6; } if test "x$ac_cv_lib_htp_htp_config_register_request_uri_normalize" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_HTP_URI_NORMALIZE_HOOK 1 _ACEOF fi # check for htp_tx_get_response_headers_raw { $as_echo "$as_me:${as_lineno-$LINENO}: checking for htp_tx_get_response_headers_raw in -lhtp" >&5 $as_echo_n "checking for htp_tx_get_response_headers_raw in -lhtp... " >&6; } if ${ac_cv_lib_htp_htp_tx_get_response_headers_raw+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhtp -lhtp $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char htp_tx_get_response_headers_raw (); int main () { return htp_tx_get_response_headers_raw (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_htp_htp_tx_get_response_headers_raw=yes else ac_cv_lib_htp_htp_tx_get_response_headers_raw=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_htp_htp_tx_get_response_headers_raw" >&5 $as_echo "$ac_cv_lib_htp_htp_tx_get_response_headers_raw" >&6; } if test "x$ac_cv_lib_htp_htp_tx_get_response_headers_raw" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for htp_decode_query_inplace in -lhtp" >&5 $as_echo_n "checking for htp_decode_query_inplace in -lhtp... " >&6; } if ${ac_cv_lib_htp_htp_decode_query_inplace+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhtp -lhtp $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char htp_decode_query_inplace (); int main () { return htp_decode_query_inplace (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_htp_htp_decode_query_inplace=yes else ac_cv_lib_htp_htp_decode_query_inplace=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_htp_htp_decode_query_inplace" >&5 $as_echo "$ac_cv_lib_htp_htp_decode_query_inplace" >&6; } if test "x$ac_cv_lib_htp_htp_decode_query_inplace" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_HTP_DECODE_QUERY_INPLACE 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for htp_config_set_response_decompression_layer_limit in -lhtp" >&5 $as_echo_n "checking for htp_config_set_response_decompression_layer_limit in -lhtp... " >&6; } if ${ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhtp -lhtp $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char htp_config_set_response_decompression_layer_limit (); int main () { return htp_config_set_response_decompression_layer_limit (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit=yes else ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit" >&5 $as_echo "$ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit" >&6; } if test "x$ac_cv_lib_htp_htp_config_set_response_decompression_layer_limit" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT 1 _ACEOF fi cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "htp_config_set_path_decode_u_encoding" >/dev/null 2>&1; then : cat >>confdefs.h <<_ACEOF #define HAVE_HTP_SET_PATH_DECODE_U_ENCODING 1 _ACEOF fi rm -f conftest* fi if test "x$enable_non_bundled_htp" = "xno"; then # test if we have a bundled htp if test -d "$srcdir/libhtp"; then subdirs="$subdirs libhtp" HTP_DIR="libhtp" HTP_LDADD="../libhtp/htp/libhtp.la" # make sure libhtp is added to the includes CPPFLAGS="-I\${srcdir}/../libhtp/ ${CPPFLAGS}" ac_fn_c_check_header_mongrel "$LINENO" "iconv.h" "ac_cv_header_iconv_h" "$ac_includes_default" if test "x$ac_cv_header_iconv_h" = xyes; then : else as_fn_error $? "iconv.h not found ..." "$LINENO" 5 fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libiconv_close in -liconv" >&5 $as_echo_n "checking for libiconv_close in -liconv... " >&6; } if ${ac_cv_lib_iconv_libiconv_close+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-liconv $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char libiconv_close (); int main () { return libiconv_close (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_iconv_libiconv_close=yes else ac_cv_lib_iconv_libiconv_close=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_iconv_libiconv_close" >&5 $as_echo "$ac_cv_lib_iconv_libiconv_close" >&6; } if test "x$ac_cv_lib_iconv_libiconv_close" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBICONV 1 _ACEOF LIBS="-liconv $LIBS" fi cat >>confdefs.h <<_ACEOF #define HAVE_HTP_URI_NORMALIZE_HOOK 1 _ACEOF cat >>confdefs.h <<_ACEOF #define HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW 1 _ACEOF cat >>confdefs.h <<_ACEOF #define HAVE_HTP_DECODE_QUERY_INPLACE 1 _ACEOF # enable when libhtp has been updated cat >>confdefs.h <<_ACEOF #define HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT 1 _ACEOF else echo echo " ERROR: Libhtp is not bundled. Get libhtp by doing:" echo " git clone https://github.com/OISF/libhtp" echo " Then re-run Suricata's autogen.sh and configure script." echo " Or, if libhtp is installed in a different location," echo " pass --enable-non-bundled-htp to Suricata's configure script." echo " Add --with-libhtp-includes= and --with-libhtp-libraries= if" echo " libhtp is not installed in the include and library paths." echo exit 1 fi fi # enable CUDA output # Check whether --enable-cuda was given. if test "${enable_cuda+set}" = set; then : enableval=$enable_cuda; else enable_cuda=no fi if test "x$enable_cuda" = "xyes"; then : # Check whether --with-cuda_includes was given. if test "${with_cuda_includes+set}" = set; then : withval=$with_cuda_includes; with_cuda_includes="$withval" else with_cuda_includes=no fi # Check whether --with-cuda_libraries was given. if test "${with_cuda_libraries+set}" = set; then : withval=$with_cuda_libraries; with_cuda_libraries="$withval" else with_cuda_libraries="no" fi # Check whether --with-cuda_nvcc was given. if test "${with_cuda_nvcc+set}" = set; then : withval=$with_cuda_nvcc; with_cuda_nvcc="$withval" else with_cuda_nvcc=no fi $as_echo "#define __SC_CUDA_SUPPORT__ 1" >>confdefs.h if test "$with_cuda_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_cuda_includes}" else CPPFLAGS="${CPPFLAGS} -I/usr/local/cuda/include" fi if test "$with_cuda_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_cuda_libraries}" fi if test "$with_cuda_nvcc" != "no"; then NVCC_DIR="${with_cuda_nvcc}" else NVCC_DIR="/usr/local/cuda/bin" fi ac_fn_c_check_header_mongrel "$LINENO" "cuda.h" "ac_cv_header_cuda_h" "$ac_includes_default" if test "x$ac_cv_header_cuda_h" = xyes; then : else as_fn_error $? "cuda.h not found ..." "$LINENO" 5 fi LIBCUDA="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for cuArray3DCreate in -lcuda" >&5 $as_echo_n "checking for cuArray3DCreate in -lcuda... " >&6; } if ${ac_cv_lib_cuda_cuArray3DCreate+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lcuda $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char cuArray3DCreate (); int main () { return cuArray3DCreate (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_cuda_cuArray3DCreate=yes else ac_cv_lib_cuda_cuArray3DCreate=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_cuda_cuArray3DCreate" >&5 $as_echo "$ac_cv_lib_cuda_cuArray3DCreate" >&6; } if test "x$ac_cv_lib_cuda_cuArray3DCreate" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBCUDA 1 _ACEOF LIBS="-lcuda $LIBS" else LIBCUDA="no" fi if test "$LIBCUDA" = "no"; then echo echo " ERROR! libcuda library not found" echo exit 1 fi # Extract the first word of "nvcc", so it can be a program name with args. set dummy nvcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_NVCC+:} false; then : $as_echo_n "(cached) " >&6 else case $NVCC in [\\/]* | ?:[\\/]*) ac_cv_path_NVCC="$NVCC" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_dummy="$PATH:$NVCC_DIR" for as_dir in $as_dummy do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_NVCC="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_NVCC" && ac_cv_path_NVCC="no" ;; esac fi NVCC=$ac_cv_path_NVCC if test -n "$NVCC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NVCC" >&5 $as_echo "$NVCC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$NVCC" = "xno"; then echo echo " ERROR! CUDA nvcc compiler not found: use --with-cuda-nvcc=DIR" echo exit 1 fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for nvcc version" >&5 $as_echo_n "checking for nvcc version... " >&6; } NVCCVER=`$NVCC --version | grep "release" | sed 's/.*release \([0-9]\)\.\([0-9]\).*/\1\2/'` { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NVCCVER" >&5 $as_echo "$NVCCVER" >&6; } if test "$NVCCVER" -lt 31; then echo echo " Warning! Your CUDA nvcc version might be outdated." echo " If compilation fails try the latest CUDA toolkit from" echo " www.nvidia.com/object/cuda_develop.html" echo fi # Find any Python interpreter. if test -z "$PYTHON"; then for ac_prog in python python2 python3 python3.3 python3.2 python3.1 python3.0 python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 python2.0 do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_PYTHON+:} false; then : $as_echo_n "(cached) " >&6 else case $PYTHON in [\\/]* | ?:[\\/]*) ac_cv_path_PYTHON="$PYTHON" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_PYTHON="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS ;; esac fi PYTHON=$ac_cv_path_PYTHON if test -n "$PYTHON"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5 $as_echo "$PYTHON" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$PYTHON" && break done test -n "$PYTHON" || PYTHON=":" fi am_display_PYTHON=python if test "$PYTHON" = :; then no else { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON version" >&5 $as_echo_n "checking for $am_display_PYTHON version... " >&6; } if ${am_cv_python_version+:} false; then : $as_echo_n "(cached) " >&6 else am_cv_python_version=`$PYTHON -c "import sys; sys.stdout.write(sys.version[:3])"` fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_version" >&5 $as_echo "$am_cv_python_version" >&6; } PYTHON_VERSION=$am_cv_python_version PYTHON_PREFIX='${prefix}' PYTHON_EXEC_PREFIX='${exec_prefix}' { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON platform" >&5 $as_echo_n "checking for $am_display_PYTHON platform... " >&6; } if ${am_cv_python_platform+:} false; then : $as_echo_n "(cached) " >&6 else am_cv_python_platform=`$PYTHON -c "import sys; sys.stdout.write(sys.platform)"` fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_platform" >&5 $as_echo "$am_cv_python_platform" >&6; } PYTHON_PLATFORM=$am_cv_python_platform # Just factor out some code duplication. am_python_setup_sysconfig="\ import sys # Prefer sysconfig over distutils.sysconfig, for better compatibility # with python 3.x. See automake bug#10227. try: import sysconfig except ImportError: can_use_sysconfig = 0 else: can_use_sysconfig = 1 # Can't use sysconfig in CPython 2.7, since it's broken in virtualenvs: # try: from platform import python_implementation if python_implementation() == 'CPython' and sys.version[:3] == '2.7': can_use_sysconfig = 0 except ImportError: pass" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON script directory" >&5 $as_echo_n "checking for $am_display_PYTHON script directory... " >&6; } if ${am_cv_python_pythondir+:} false; then : $as_echo_n "(cached) " >&6 else if test "x$prefix" = xNONE then am_py_prefix=$ac_default_prefix else am_py_prefix=$prefix fi am_cv_python_pythondir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix') sys.stdout.write(sitedir)"` case $am_cv_python_pythondir in $am_py_prefix*) am__strip_prefix=`echo "$am_py_prefix" | sed 's|.|.|g'` am_cv_python_pythondir=`echo "$am_cv_python_pythondir" | sed "s,^$am__strip_prefix,$PYTHON_PREFIX,"` ;; *) case $am_py_prefix in /usr|/System*) ;; *) am_cv_python_pythondir=$PYTHON_PREFIX/lib/python$PYTHON_VERSION/site-packages ;; esac ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_pythondir" >&5 $as_echo "$am_cv_python_pythondir" >&6; } pythondir=$am_cv_python_pythondir pkgpythondir=\${pythondir}/$PACKAGE { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $am_display_PYTHON extension module directory" >&5 $as_echo_n "checking for $am_display_PYTHON extension module directory... " >&6; } if ${am_cv_python_pyexecdir+:} false; then : $as_echo_n "(cached) " >&6 else if test "x$exec_prefix" = xNONE then am_py_exec_prefix=$am_py_prefix else am_py_exec_prefix=$exec_prefix fi am_cv_python_pyexecdir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_prefix') sys.stdout.write(sitedir)"` case $am_cv_python_pyexecdir in $am_py_exec_prefix*) am__strip_prefix=`echo "$am_py_exec_prefix" | sed 's|.|.|g'` am_cv_python_pyexecdir=`echo "$am_cv_python_pyexecdir" | sed "s,^$am__strip_prefix,$PYTHON_EXEC_PREFIX,"` ;; *) case $am_py_exec_prefix in /usr|/System*) ;; *) am_cv_python_pyexecdir=$PYTHON_EXEC_PREFIX/lib/python$PYTHON_VERSION/site-packages ;; esac ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_python_pyexecdir" >&5 $as_echo "$am_cv_python_pyexecdir" >&6; } pyexecdir=$am_cv_python_pyexecdir pkgpyexecdir=\${pyexecdir}/$PACKAGE fi if test "x$PYTHON" = "xno"; then echo echo " ERROR! Compiling CUDA kernels requires python." echo exit 1 fi fi if test "x$enable_cuda" = "xyes"; then BUILD_CUDA_TRUE= BUILD_CUDA_FALSE='#' else BUILD_CUDA_TRUE='#' BUILD_CUDA_FALSE= fi if test "x$enable_cuda" = "xyes"; then __SC_CUDA_SUPPORT___TRUE= __SC_CUDA_SUPPORT___FALSE='#' else __SC_CUDA_SUPPORT___TRUE='#' __SC_CUDA_SUPPORT___FALSE= fi # Check for libcap-ng case $host in *-*-linux*) # Check whether --with-libcap_ng_includes was given. if test "${with_libcap_ng_includes+set}" = set; then : withval=$with_libcap_ng_includes; with_libcap_ng_includes="$withval" else with_libcap_ng_includes=no fi # Check whether --with-libcap_ng_libraries was given. if test "${with_libcap_ng_libraries+set}" = set; then : withval=$with_libcap_ng_libraries; with_libcap_ng_libraries="$withval" else with_libcap_ng_libraries="no" fi if test "$with_libcap_ng_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libcap_ng_includes}" fi if test "$with_libcap_ng_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libcap_ng_libraries}" fi ac_fn_c_check_header_mongrel "$LINENO" "cap-ng.h" "ac_cv_header_cap_ng_h" "$ac_includes_default" if test "x$ac_cv_header_cap_ng_h" = xyes; then : else LIBCAP_NG="no" fi if test "$LIBCAP_NG" != "no"; then LIBCAP_NG="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for capng_clear in -lcap-ng" >&5 $as_echo_n "checking for capng_clear in -lcap-ng... " >&6; } if ${ac_cv_lib_cap_ng_capng_clear+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lcap-ng $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char capng_clear (); int main () { return capng_clear (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_cap_ng_capng_clear=yes else ac_cv_lib_cap_ng_capng_clear=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_cap_ng_capng_clear" >&5 $as_echo "$ac_cv_lib_cap_ng_capng_clear" >&6; } if test "x$ac_cv_lib_cap_ng_capng_clear" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBCAP_NG 1 _ACEOF LIBS="-lcap-ng $LIBS" else LIBCAP_NG="no" fi fi if test "$LIBCAP_NG" != "no"; then $as_echo "#define HAVE_LIBCAP_NG 1" >>confdefs.h fi if test "$LIBCAP_NG" = "no"; then echo echo " WARNING! libcap-ng library not found, go get it" echo " from http://people.redhat.com/sgrubb/libcap-ng/" echo " or your distribution:" echo echo " Ubuntu: apt-get install libcap-ng-dev" echo " Fedora: yum install libcap-ng-devel" echo echo " Suricata will be built without support for dropping privs." echo fi ;; esac # Check for DAG support. # Check whether --enable-dag was given. if test "${enable_dag+set}" = set; then : enableval=$enable_dag; enable_dag=yes else enable_dag=no fi # Check whether --with-dag_includes was given. if test "${with_dag_includes+set}" = set; then : withval=$with_dag_includes; with_dag_includes="$withval" else with_dag_includes="no" fi # Check whether --with-dag_libraries was given. if test "${with_dag_libraries+set}" = set; then : withval=$with_dag_libraries; with_dag_libraries="$withval" else with_dag_libraries="no" fi if test "$enable_dag" = "yes"; then if test "$with_dag_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_dag_includes}" fi if test "$with_dag_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_dag_libraries}" fi ac_fn_c_check_header_mongrel "$LINENO" "dagapi.h" "ac_cv_header_dagapi_h" "$ac_includes_default" if test "x$ac_cv_header_dagapi_h" = xyes; then : DAG="yes" else DAG="no" fi if test "$DAG" != "no"; then DAG="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dag_open in -ldag" >&5 $as_echo_n "checking for dag_open in -ldag... " >&6; } if ${ac_cv_lib_dag_dag_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-ldag $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char dag_open (); int main () { return dag_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_dag_dag_open=yes else ac_cv_lib_dag_dag_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dag_dag_open" >&5 $as_echo "$ac_cv_lib_dag_dag_open" >&6; } if test "x$ac_cv_lib_dag_dag_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBDAG 1 _ACEOF LIBS="-ldag $LIBS" else DAG="no" fi fi if test "$DAG" = "no"; then echo echo " ERROR! libdag library not found" echo exit 1 fi $as_echo "#define HAVE_DAG 1" >>confdefs.h fi # libnspr enable_nspr="no" # Try pkg-config first: pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnspr" >&5 $as_echo_n "checking for libnspr... " >&6; } if test -n "$libnspr_CFLAGS"; then pkg_cv_libnspr_CFLAGS="$libnspr_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"nspr\""; } >&5 ($PKG_CONFIG --exists --print-errors "nspr") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnspr_CFLAGS=`$PKG_CONFIG --cflags "nspr" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$libnspr_LIBS"; then pkg_cv_libnspr_LIBS="$libnspr_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"nspr\""; } >&5 ($PKG_CONFIG --exists --print-errors "nspr") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnspr_LIBS=`$PKG_CONFIG --libs "nspr" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then libnspr_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "nspr" 2>&1` else libnspr_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "nspr" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$libnspr_PKG_ERRORS" >&5 with_pkgconfig_nspr=no elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } with_pkgconfig_nspr=no else libnspr_CFLAGS=$pkg_cv_libnspr_CFLAGS libnspr_LIBS=$pkg_cv_libnspr_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi if test "$with_pkgconfig_nspr" != "no"; then CPPFLAGS="${CPPFLAGS} ${libnspr_CFLAGS}" LIBS="${LIBS} ${libnspr_LIBS}" fi # Check whether --with-libnspr_includes was given. if test "${with_libnspr_includes+set}" = set; then : withval=$with_libnspr_includes; with_libnspr_includes="$withval" else with_libnspr_includes=no fi # Check whether --with-libnspr_libraries was given. if test "${with_libnspr_libraries+set}" = set; then : withval=$with_libnspr_libraries; with_libnspr_libraries="$withval" else with_libnspr_libraries="no" fi if test "$with_libnspr_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnspr_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "nspr.h" "ac_cv_header_nspr_h" "$ac_includes_default" if test "x$ac_cv_header_nspr_h" = xyes; then : NSPR="yes" else NSPR="no" fi if test "$NSPR" = "yes"; then if test "$with_libnspr_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnspr_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PR_GetCurrentThread in -lnspr4" >&5 $as_echo_n "checking for PR_GetCurrentThread in -lnspr4... " >&6; } if ${ac_cv_lib_nspr4_PR_GetCurrentThread+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnspr4 $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char PR_GetCurrentThread (); int main () { return PR_GetCurrentThread (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_nspr4_PR_GetCurrentThread=yes else ac_cv_lib_nspr4_PR_GetCurrentThread=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nspr4_PR_GetCurrentThread" >&5 $as_echo "$ac_cv_lib_nspr4_PR_GetCurrentThread" >&6; } if test "x$ac_cv_lib_nspr4_PR_GetCurrentThread" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNSPR4 1 _ACEOF LIBS="-lnspr4 $LIBS" else NSPR="no" fi if test "$NSPR" = "no"; then echo echo " ERROR! libnspr library not found, go get it" echo " from Mozilla or your distribution:" echo echo " Ubuntu: apt-get install libnspr4-dev" echo " Fedora: yum install nspr-devel" echo exit 1 fi enable_nspr="yes" fi # libnss enable_nss="no" # Try pkg-config first: pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnss" >&5 $as_echo_n "checking for libnss... " >&6; } if test -n "$libnss_CFLAGS"; then pkg_cv_libnss_CFLAGS="$libnss_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"nss\""; } >&5 ($PKG_CONFIG --exists --print-errors "nss") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnss_CFLAGS=`$PKG_CONFIG --cflags "nss" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$libnss_LIBS"; then pkg_cv_libnss_LIBS="$libnss_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"nss\""; } >&5 ($PKG_CONFIG --exists --print-errors "nss") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_libnss_LIBS=`$PKG_CONFIG --libs "nss" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then libnss_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "nss" 2>&1` else libnss_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "nss" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$libnss_PKG_ERRORS" >&5 with_pkgconfig_nss=no elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } with_pkgconfig_nss=no else libnss_CFLAGS=$pkg_cv_libnss_CFLAGS libnss_LIBS=$pkg_cv_libnss_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi if test "$with_pkgconfig_nss" != "no"; then CPPFLAGS="${CPPFLAGS} ${libnss_CFLAGS}" LIBS="${LIBS} ${libnss_LIBS}" fi # Check whether --with-libnss_includes was given. if test "${with_libnss_includes+set}" = set; then : withval=$with_libnss_includes; with_libnss_includes="$withval" else with_libnss_includes=no fi # Check whether --with-libnss_libraries was given. if test "${with_libnss_libraries+set}" = set; then : withval=$with_libnss_libraries; with_libnss_libraries="$withval" else with_libnss_libraries="no" fi if test "$with_libnss_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libnss_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "sechash.h" "ac_cv_header_sechash_h" "$ac_includes_default" if test "x$ac_cv_header_sechash_h" = xyes; then : NSS="yes" else NSS="no" fi if test "$NSS" = "yes"; then if test "$with_libnss_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libnss_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for HASH_Begin in -lnss3" >&5 $as_echo_n "checking for HASH_Begin in -lnss3... " >&6; } if ${ac_cv_lib_nss3_HASH_Begin+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lnss3 $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char HASH_Begin (); int main () { return HASH_Begin (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_nss3_HASH_Begin=yes else ac_cv_lib_nss3_HASH_Begin=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nss3_HASH_Begin" >&5 $as_echo "$ac_cv_lib_nss3_HASH_Begin" >&6; } if test "x$ac_cv_lib_nss3_HASH_Begin" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBNSS3 1 _ACEOF LIBS="-lnss3 $LIBS" else NSS="no" fi if test "$NSS" = "no"; then echo echo " ERROR! libnss library not found, go get it" echo " from Mozilla or your distribution:" echo echo " Ubuntu: apt-get install libnss3-dev" echo " Fedora: yum install nss-devel" echo exit 1 fi $as_echo "#define HAVE_NSS 1" >>confdefs.h enable_nss="yes" fi # libmagic enable_magic="no" # Check whether --enable-libmagic was given. if test "${enable_libmagic+set}" = set; then : enableval=$enable_libmagic; else enable_magic=yes fi if test "$enable_magic" = "yes"; then # Check whether --with-libmagic_includes was given. if test "${with_libmagic_includes+set}" = set; then : withval=$with_libmagic_includes; with_libmagic_includes="$withval" else with_libmagic_includes=no fi # Check whether --with-libmagic_libraries was given. if test "${with_libmagic_libraries+set}" = set; then : withval=$with_libmagic_libraries; with_libmagic_libraries="$withval" else with_libmagic_libraries="no" fi if test "$with_libmagic_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libmagic_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "magic.h" "ac_cv_header_magic_h" "$ac_includes_default" if test "x$ac_cv_header_magic_h" = xyes; then : else MAGIC="no" fi if test "$MAGIC" != "no"; then MAGIC="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for magic_open in -lmagic" >&5 $as_echo_n "checking for magic_open in -lmagic... " >&6; } if ${ac_cv_lib_magic_magic_open+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lmagic $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char magic_open (); int main () { return magic_open (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_magic_magic_open=yes else ac_cv_lib_magic_magic_open=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_magic_magic_open" >&5 $as_echo "$ac_cv_lib_magic_magic_open" >&6; } if test "x$ac_cv_lib_magic_magic_open" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBMAGIC 1 _ACEOF LIBS="-lmagic $LIBS" else MAGIC="no" fi fi if test "x$MAGIC" != "xno"; then if test "$with_libmagic_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libmagic_libraries}" fi $as_echo "#define HAVE_MAGIC 1" >>confdefs.h else echo echo " WARNING! magic library not found, go get it" echo " from http://www.darwinsys.com/file/ or your distribution:" echo echo " Ubuntu: apt-get install libmagic-dev" echo " Fedora: yum install file-devel" echo enable_magic="no" fi fi # Napatech - Using the 3GD API # Check whether --enable-napatech was given. if test "${enable_napatech+set}" = set; then : enableval=$enable_napatech; enable_napatech=yes else enable_napatech=no fi # Check whether --with-napatech_includes was given. if test "${with_napatech_includes+set}" = set; then : withval=$with_napatech_includes; with_napatech_includes="$withval" else with_napatech_includes="/opt/napatech3/include" fi # Check whether --with-napatech_libraries was given. if test "${with_napatech_libraries+set}" = set; then : withval=$with_napatech_libraries; with_napatech_libraries="$withval" else with_napatech_libraries="/opt/napatech3/lib" fi if test "$enable_napatech" = "yes"; then CPPFLAGS="${CPPFLAGS} -I${with_napatech_includes}" LDFLAGS="${LDFLAGS} -L${with_napatech_libraries} -lntapi" ac_fn_c_check_header_mongrel "$LINENO" "nt.h" "ac_cv_header_nt_h" "$ac_includes_default" if test "x$ac_cv_header_nt_h" = xyes; then : NAPATECH="yes" else NAPATECH="no" fi if test "$NAPATECH" != "no"; then NAPATECH="" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for NT_Init in -lntapi" >&5 $as_echo_n "checking for NT_Init in -lntapi... " >&6; } if ${ac_cv_lib_ntapi_NT_Init+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lntapi $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char NT_Init (); int main () { return NT_Init (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_ntapi_NT_Init=yes else ac_cv_lib_ntapi_NT_Init=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ntapi_NT_Init" >&5 $as_echo "$ac_cv_lib_ntapi_NT_Init" >&6; } if test "x$ac_cv_lib_ntapi_NT_Init" = xyes; then : NAPATECH="yes" else NAPATECH="no" fi fi if test "$NAPATECH" = "no"; then echo echo " ERROR! libntapi library not found" echo exit 1 fi $as_echo "#define HAVE_NAPATECH 1" >>confdefs.h fi # liblua # Check whether --enable-lua was given. if test "${enable_lua+set}" = set; then : enableval=$enable_lua; enable_lua="yes" else enable_lua="no" fi # Check whether --enable-luajit was given. if test "${enable_luajit+set}" = set; then : enableval=$enable_luajit; enable_luajit="yes" else enable_luajit="no" fi if test "$enable_lua" = "yes"; then if test "$enable_luajit" = "yes"; then echo "ERROR: can't enable liblua and luajit at the same time." echo "For LuaJIT, just use --enable-luajit. For liblua (no jit)" echo "support, use just --enable-lua." echo "Both options will enable the Lua scripting capabilities" echo "in Suricata". echo exit 1 fi fi # Check whether --with-liblua_includes was given. if test "${with_liblua_includes+set}" = set; then : withval=$with_liblua_includes; with_liblua_includes="$withval" else with_liblua_includes="no" fi # Check whether --with-liblua_libraries was given. if test "${with_liblua_libraries+set}" = set; then : withval=$with_liblua_libraries; with_liblua_libraries="$withval" else with_liblua_libraries="no" fi if test "$enable_lua" = "yes"; then if test "$with_liblua_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_liblua_includes}" else # lua lua51 lua5.1 lua-5.1 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi CPPFLAGS="${CPPFLAGS} ${LUA_CFLAGS}" fi ac_fn_c_check_header_mongrel "$LINENO" "lualib.h" "ac_cv_header_lualib_h" "$ac_includes_default" if test "x$ac_cv_header_lualib_h" = xyes; then : LUA="yes" else LUA="no" fi if test "$LUA" = "yes"; then if test "$with_liblua_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_liblua_libraries}" as_ac_Lib=`$as_echo "ac_cv_lib_${LUA_LIB_NAME}''_luaL_openlibs" | $as_tr_sh` { $as_echo "$as_me:${as_lineno-$LINENO}: checking for luaL_openlibs in -l${LUA_LIB_NAME}" >&5 $as_echo_n "checking for luaL_openlibs in -l${LUA_LIB_NAME}... " >&6; } if eval \${$as_ac_Lib+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-l${LUA_LIB_NAME} $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char luaL_openlibs (); int main () { return luaL_openlibs (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : eval "$as_ac_Lib=yes" else eval "$as_ac_Lib=no" fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi eval ac_res=\$$as_ac_Lib { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } if eval test \"x\$"$as_ac_Lib"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_LIB${LUA_LIB_NAME}" | $as_tr_cpp` 1 _ACEOF LIBS="-l${LUA_LIB_NAME} $LIBS" else LUA="no" fi if test "$LUA" = "no"; then echo echo " ERROR! liblua library not found, go get it" echo " from http://lua.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install liblua5.1-dev" echo " CentOS/Fedora: yum install lua-devel" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-liblua-libraries configure option." echo exit 1 fi else # lua lua51 lua5.1 lua-5.1 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua-5.1\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua-5.1") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua-5.1" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua-5.1" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua-5.1" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUA" >&5 $as_echo_n "checking for LUA... " >&6; } if test -n "$LUA_CFLAGS"; then pkg_cv_LUA_CFLAGS="$LUA_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_CFLAGS=`$PKG_CONFIG --cflags "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUA_LIBS"; then pkg_cv_LUA_LIBS="$LUA_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lua51\""; } >&5 ($PKG_CONFIG --exists --print-errors "lua51") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUA_LIBS=`$PKG_CONFIG --libs "lua51" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUA_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lua51" 2>&1` else LUA_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lua51" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUA_PKG_ERRORS" >&5 LUA="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUA="no" else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi else LUA_CFLAGS=$pkg_cv_LUA_CFLAGS LUA_LIBS=$pkg_cv_LUA_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } LUA="yes" fi LDFLAGS="${LDFLAGS} ${LUA_LIBS}" fi if test "$LUA" = "no"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for luaL_openlibs in -llua" >&5 $as_echo_n "checking for luaL_openlibs in -llua... " >&6; } if ${ac_cv_lib_lua_luaL_openlibs+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-llua $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char luaL_openlibs (); int main () { return luaL_openlibs (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_lua_luaL_openlibs=yes else ac_cv_lib_lua_luaL_openlibs=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_lua_luaL_openlibs" >&5 $as_echo "$ac_cv_lib_lua_luaL_openlibs" >&6; } if test "x$ac_cv_lib_lua_luaL_openlibs" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBLUA 1 _ACEOF LIBS="-llua $LIBS" else LUA="no" fi fi if test "$LUA" = "yes"; then $as_echo "#define HAVE_LUA 1" >>confdefs.h enable_lua="yes" fi else echo echo " ERROR! liblua headers not found, go get them" echo " from http://lua.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install liblua5.1-dev" echo " CentOS/Fedora: yum install lua-devel" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-liblua-includes and --with-liblua-libraries" echo " configure option." echo exit 1 fi fi # libluajit # Check whether --with-libluajit_includes was given. if test "${with_libluajit_includes+set}" = set; then : withval=$with_libluajit_includes; with_libluajit_includes="$withval" else with_libluajit_includes="no" fi # Check whether --with-libluajit_libraries was given. if test "${with_libluajit_libraries+set}" = set; then : withval=$with_libluajit_libraries; with_libluajit_libraries="$withval" else with_libluajit_libraries="no" fi if test "$enable_luajit" = "yes"; then if test "$with_libluajit_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libluajit_includes}" else pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUAJIT" >&5 $as_echo_n "checking for LUAJIT... " >&6; } if test -n "$LUAJIT_CFLAGS"; then pkg_cv_LUAJIT_CFLAGS="$LUAJIT_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"luajit\""; } >&5 ($PKG_CONFIG --exists --print-errors "luajit") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUAJIT_CFLAGS=`$PKG_CONFIG --cflags "luajit" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUAJIT_LIBS"; then pkg_cv_LUAJIT_LIBS="$LUAJIT_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"luajit\""; } >&5 ($PKG_CONFIG --exists --print-errors "luajit") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUAJIT_LIBS=`$PKG_CONFIG --libs "luajit" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUAJIT_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "luajit" 2>&1` else LUAJIT_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "luajit" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUAJIT_PKG_ERRORS" >&5 LUAJIT="no" elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } LUAJIT="no" else LUAJIT_CFLAGS=$pkg_cv_LUAJIT_CFLAGS LUAJIT_LIBS=$pkg_cv_LUAJIT_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi CPPFLAGS="${CPPFLAGS} ${LUAJIT_CFLAGS}" fi ac_fn_c_check_header_mongrel "$LINENO" "lualib.h" "ac_cv_header_lualib_h" "$ac_includes_default" if test "x$ac_cv_header_lualib_h" = xyes; then : LUAJIT="yes" else LUAJIT="no" fi if test "$LUAJIT" = "yes"; then if test "$with_libluajit_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libluajit_libraries}" else pkg_failed=no { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LUAJIT" >&5 $as_echo_n "checking for LUAJIT... " >&6; } if test -n "$LUAJIT_CFLAGS"; then pkg_cv_LUAJIT_CFLAGS="$LUAJIT_CFLAGS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"luajit\""; } >&5 ($PKG_CONFIG --exists --print-errors "luajit") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUAJIT_CFLAGS=`$PKG_CONFIG --cflags "luajit" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test -n "$LUAJIT_LIBS"; then pkg_cv_LUAJIT_LIBS="$LUAJIT_LIBS" elif test -n "$PKG_CONFIG"; then if test -n "$PKG_CONFIG" && \ { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"luajit\""; } >&5 ($PKG_CONFIG --exists --print-errors "luajit") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then pkg_cv_LUAJIT_LIBS=`$PKG_CONFIG --libs "luajit" 2>/dev/null` test "x$?" != "x0" && pkg_failed=yes else pkg_failed=yes fi else pkg_failed=untried fi if test $pkg_failed = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then _pkg_short_errors_supported=yes else _pkg_short_errors_supported=no fi if test $_pkg_short_errors_supported = yes; then LUAJIT_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "luajit" 2>&1` else LUAJIT_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "luajit" 2>&1` fi # Put the nasty error message in config.log where it belongs echo "$LUAJIT_PKG_ERRORS" >&5 as_fn_error $? "Package requirements (luajit) were not met: $LUAJIT_PKG_ERRORS Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables LUAJIT_CFLAGS and LUAJIT_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details." "$LINENO" 5 elif test $pkg_failed = untried; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. Alternatively, you may set the environment variables LUAJIT_CFLAGS and LUAJIT_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. To get pkg-config, see . See \`config.log' for more details" "$LINENO" 5; } else LUAJIT_CFLAGS=$pkg_cv_LUAJIT_CFLAGS LUAJIT_LIBS=$pkg_cv_LUAJIT_LIBS { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi LDFLAGS="${LDFLAGS} ${LUAJIT_LIBS}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for luaL_openlibs in -lluajit-5.1" >&5 $as_echo_n "checking for luaL_openlibs in -lluajit-5.1... " >&6; } if ${ac_cv_lib_luajit_5_1_luaL_openlibs+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lluajit-5.1 $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char luaL_openlibs (); int main () { return luaL_openlibs (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_luajit_5_1_luaL_openlibs=yes else ac_cv_lib_luajit_5_1_luaL_openlibs=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_luajit_5_1_luaL_openlibs" >&5 $as_echo "$ac_cv_lib_luajit_5_1_luaL_openlibs" >&6; } if test "x$ac_cv_lib_luajit_5_1_luaL_openlibs" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBLUAJIT_5_1 1 _ACEOF LIBS="-lluajit-5.1 $LIBS" else LUAJIT="no" fi if test "$LUAJIT" = "no"; then echo echo " ERROR! libluajit library not found, go get it" echo " from http://luajit.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install libluajit-5.1-dev" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-libluajit-libraries configure option." echo exit 1 fi $as_echo "#define HAVE_LUA 1" >>confdefs.h $as_echo "#define HAVE_LUAJIT 1" >>confdefs.h enable_lua="yes, through luajit" enable_luajit="yes" else echo echo " ERROR! libluajit headers not found, go get them" echo " from http://luajit.org/index.html or your distribution:" echo echo " Ubuntu: apt-get install libluajit-5.1-dev" echo echo " If you installed software in a non-standard prefix" echo " consider adjusting the PKG_CONFIG_PATH environment variable" echo " or use --with-libluajit-includes and --with-libluajit-libraries" echo " configure option." echo exit 1 fi fi # libgeoip # Check whether --enable-geoip was given. if test "${enable_geoip+set}" = set; then : enableval=$enable_geoip; enable_geoip="yes" else enable_geoip="no" fi # Check whether --with-libgeoip_includes was given. if test "${with_libgeoip_includes+set}" = set; then : withval=$with_libgeoip_includes; with_libgeoip_includes="$withval" else with_libgeoip_includes="no" fi # Check whether --with-libgeoip_libraries was given. if test "${with_libgeoip_libraries+set}" = set; then : withval=$with_libgeoip_libraries; with_libgeoip_libraries="$withval" else with_libgeoip_libraries="no" fi if test "$enable_geoip" = "yes"; then if test "$with_libgeoip_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libgeoip_includes}" fi ac_fn_c_check_header_mongrel "$LINENO" "GeoIP.h" "ac_cv_header_GeoIP_h" "$ac_includes_default" if test "x$ac_cv_header_GeoIP_h" = xyes; then : GEOIP="yes" else GEOIP="no" fi if test "$GEOIP" = "yes"; then if test "$with_libgeoip_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libgeoip_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GeoIP_country_code_by_ipnum in -lGeoIP" >&5 $as_echo_n "checking for GeoIP_country_code_by_ipnum in -lGeoIP... " >&6; } if ${ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lGeoIP $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char GeoIP_country_code_by_ipnum (); int main () { return GeoIP_country_code_by_ipnum (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum=yes else ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum" >&5 $as_echo "$ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum" >&6; } if test "x$ac_cv_lib_GeoIP_GeoIP_country_code_by_ipnum" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBGEOIP 1 _ACEOF LIBS="-lGeoIP $LIBS" else GEOIP="no" fi fi if test "$GEOIP" = "no"; then echo echo " ERROR! libgeoip library not found, go get it" echo " from http://www.maxmind.com/en/geolite or your distribution:" echo echo " Ubuntu: apt-get install libgeoip-dev" echo " Fedora: yum install GeoIP-devel" echo exit 1 fi $as_echo "#define HAVE_GEOIP 1" >>confdefs.h enable_geoip="yes" fi # Position Independent Executable # Check whether --enable-pie was given. if test "${enable_pie+set}" = set; then : enableval=$enable_pie; enable_pie="yes" else enable_pie="no" fi if test "$enable_pie" = "yes"; then CPPFLAGS="${CPPFLAGS} -fPIC" LDFLAGS="${LDFLAGS} -pie" fi # libhiredis # Check whether --enable-hiredis was given. if test "${enable_hiredis+set}" = set; then : enableval=$enable_hiredis; enable_hiredis="yes" else enable_hiredis="no" fi # Check whether --with-libhiredis_includes was given. if test "${with_libhiredis_includes+set}" = set; then : withval=$with_libhiredis_includes; with_libhiredis_includes="$withval" else with_libhiredis_includes="no" fi # Check whether --with-libhiredis_libraries was given. if test "${with_libhiredis_libraries+set}" = set; then : withval=$with_libhiredis_libraries; with_libhiredis_libraries="$withval" else with_libhiredis_libraries="no" fi if test "$enable_hiredis" = "yes"; then if test "$with_libhiredis_includes" != "no"; then CPPFLAGS="${CPPFLAGS} -I${with_libhiredis_includes}" fi as_ac_Header=`$as_echo "ac_cv_header_"hiredis/hiredis.h"" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" ""hiredis/hiredis.h"" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : HIREDIS="yes" else HIREDIS="no" fi if test "$HIREDIS" = "yes"; then if test "$with_libhiredis_libraries" != "no"; then LDFLAGS="${LDFLAGS} -L${with_libhiredis_libraries}" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for redisConnect in -lhiredis" >&5 $as_echo_n "checking for redisConnect in -lhiredis... " >&6; } if ${ac_cv_lib_hiredis_redisConnect+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lhiredis $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char redisConnect (); int main () { return redisConnect (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_hiredis_redisConnect=yes else ac_cv_lib_hiredis_redisConnect=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_hiredis_redisConnect" >&5 $as_echo "$ac_cv_lib_hiredis_redisConnect" >&6; } if test "x$ac_cv_lib_hiredis_redisConnect" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBHIREDIS 1 _ACEOF LIBS="-lhiredis $LIBS" else HIREDIS="no" fi fi if test "$HIREDIS" = "no"; then echo echo " ERROR! libhiredis library not found, go get it" echo " from https://github.com/redis/hiredis or your distribution:" echo echo " Ubuntu: apt-get install libhiredis-dev" echo " Fedora: dnf install hiredis-devel" echo " RHEL/CentOS: yum install hiredis-devel" echo exit 1 fi if test "$HIREDIS" = "yes"; then $as_echo "#define HAVE_LIBHIREDIS 1" >>confdefs.h enable_hiredis="yes" fi fi # get cache line size # Extract the first word of "getconf", so it can be a program name with args. set dummy getconf; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_GETCONF_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_GETCONF_CMD in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_GETCONF_CMD="$HAVE_GETCONF_CMD" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_GETCONF_CMD="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_GETCONF_CMD" && ac_cv_path_HAVE_GETCONF_CMD=""no"" ;; esac fi HAVE_GETCONF_CMD=$ac_cv_path_HAVE_GETCONF_CMD if test -n "$HAVE_GETCONF_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_GETCONF_CMD" >&5 $as_echo "$HAVE_GETCONF_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_GETCONF_CMD" != "no"; then CLS=$(getconf LEVEL1_DCACHE_LINESIZE) if test "$CLS" != "" && test "$CLS" != "0"; then cat >>confdefs.h <<_ACEOF #define CLS ${CLS} _ACEOF else $as_echo "#define CLS 64" >>confdefs.h fi else $as_echo "#define CLS 64" >>confdefs.h fi # sphinx for documentation # Extract the first word of "sphinx-build", so it can be a program name with args. set dummy sphinx-build; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_SPHINXBUILD+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_SPHINXBUILD in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_SPHINXBUILD="$HAVE_SPHINXBUILD" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_SPHINXBUILD="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_SPHINXBUILD" && ac_cv_path_HAVE_SPHINXBUILD=""no"" ;; esac fi HAVE_SPHINXBUILD=$ac_cv_path_HAVE_SPHINXBUILD if test -n "$HAVE_SPHINXBUILD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_SPHINXBUILD" >&5 $as_echo "$HAVE_SPHINXBUILD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_SPHINXBUILD" = "no"; then enable_sphinxbuild=no if test -e "$srcdir/doc/userguide/suricata.1"; then have_suricata_man=yes fi fi if test "x$enable_sphinxbuild" != "xno"; then HAVE_SPHINXBUILD_TRUE= HAVE_SPHINXBUILD_FALSE='#' else HAVE_SPHINXBUILD_TRUE='#' HAVE_SPHINXBUILD_FALSE= fi if test "x$have_suricata_man" = "xyes"; then HAVE_SURICATA_MAN_TRUE= HAVE_SURICATA_MAN_FALSE='#' else HAVE_SURICATA_MAN_TRUE='#' HAVE_SURICATA_MAN_FALSE= fi # pdflatex for the pdf version of the user manual # Extract the first word of "pdflatex", so it can be a program name with args. set dummy pdflatex; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_PDFLATEX+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_PDFLATEX in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_PDFLATEX="$HAVE_PDFLATEX" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_PDFLATEX="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_PDFLATEX" && ac_cv_path_HAVE_PDFLATEX=""no"" ;; esac fi HAVE_PDFLATEX=$ac_cv_path_HAVE_PDFLATEX if test -n "$HAVE_PDFLATEX"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_PDFLATEX" >&5 $as_echo "$HAVE_PDFLATEX" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_PDFLATEX" = "no"; then enable_pdflatex=no fi if test "x$enable_pdflatex" != "xno"; then HAVE_PDFLATEX_TRUE= HAVE_PDFLATEX_FALSE='#' else HAVE_PDFLATEX_TRUE='#' HAVE_PDFLATEX_FALSE= fi # get revision if test -f ./revision; then REVISION=`cat ./revision` cat >>confdefs.h <<_ACEOF #define REVISION ${REVISION} _ACEOF else # Extract the first word of "git", so it can be a program name with args. set dummy git; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_path_HAVE_GIT_CMD+:} false; then : $as_echo_n "(cached) " >&6 else case $HAVE_GIT_CMD in [\\/]* | ?:[\\/]*) ac_cv_path_HAVE_GIT_CMD="$HAVE_GIT_CMD" # Let the user override the test with a path. ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then ac_cv_path_HAVE_GIT_CMD="$as_dir/$ac_word$ac_exec_ext" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS test -z "$ac_cv_path_HAVE_GIT_CMD" && ac_cv_path_HAVE_GIT_CMD=""no"" ;; esac fi HAVE_GIT_CMD=$ac_cv_path_HAVE_GIT_CMD if test -n "$HAVE_GIT_CMD"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $HAVE_GIT_CMD" >&5 $as_echo "$HAVE_GIT_CMD" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "$HAVE_GIT_CMD" != "no"; then if test -d .git ; then REVISION=`git rev-parse --short HEAD` cat >>confdefs.h <<_ACEOF #define REVISION ${REVISION} _ACEOF fi fi fi # suricata log dir if test "$WINDOWS_PATH" = "yes"; then systemtype="`systeminfo | grep \"based PC\"`" case "$systemtype" in *x64*) e_winbase="C:\\\\Program Files (x86)\\\\Suricata" ;; *) e_winbase="C:\\\\Program Files\\\\Suricata" ;; esac e_sysconfdir="$e_winbase\\\\" e_sysconfrulesdir="$e_winbase\\\\rules\\\\" e_magic_file="$e_winbase\\\\magic.mgc" e_logdir="$e_winbase\\\\log" e_logfilesdir="$e_logdir\\\\files" e_logcertsdir="$e_logdir\\\\certs" else e_logdir=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_logdir" in *\$* ) eval "e_logdir=$e_logdir" ;; *) break ;; esac done eval "e_logdir=$e_logdir"/log/suricata/"" e_rundir=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_rundir" in *\$* ) eval "e_rundir=$e_rundir" ;; *) break ;; esac done eval "e_rundir=$e_rundir"/run/"" e_logfilesdir=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_logfilesdir" in *\$* ) eval "e_logfilesdir=$e_logfilesdir" ;; *) break ;; esac done eval "e_logfilesdir=$e_logfilesdir"/log/suricata/files"" e_logcertsdir=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_logcertsdir" in *\$* ) eval "e_logcertsdir=$e_logcertsdir" ;; *) break ;; esac done eval "e_logcertsdir=$e_logcertsdir"/log/suricata/certs"" e_sysconfdir=$sysconfdir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_sysconfdir" in *\$* ) eval "e_sysconfdir=$e_sysconfdir" ;; *) break ;; esac done eval "e_sysconfdir=$e_sysconfdir"/suricata/"" e_sysconfrulesdir=$sysconfdir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_sysconfrulesdir" in *\$* ) eval "e_sysconfrulesdir=$e_sysconfrulesdir" ;; *) break ;; esac done eval "e_sysconfrulesdir=$e_sysconfrulesdir"/suricata/rules"" e_localstatedir=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$e_localstatedir" in *\$* ) eval "e_localstatedir=$e_localstatedir" ;; *) break ;; esac done eval "e_localstatedir=$e_localstatedir"/run/suricata"" fi cat >>confdefs.h <<_ACEOF #define CONFIG_DIR "$e_sysconfdir" _ACEOF CONFIGURE_PREFIX=$prefix if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$CONFIGURE_PREFIX" in *\$* ) eval "CONFIGURE_PREFIX=$CONFIGURE_PREFIX" ;; *) break ;; esac done eval "CONFIGURE_PREFIX=$CONFIGURE_PREFIX" CONFIGURE_SYSCONDIR=$sysconfdir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$CONFIGURE_SYSCONDIR" in *\$* ) eval "CONFIGURE_SYSCONDIR=$CONFIGURE_SYSCONDIR" ;; *) break ;; esac done eval "CONFIGURE_SYSCONDIR=$CONFIGURE_SYSCONDIR" CONFIGURE_LOCALSTATEDIR=$localstatedir if test $prefix = 'NONE'; then prefix="/usr/local" fi while true; do case "$CONFIGURE_LOCALSTATEDIR" in *\$* ) eval "CONFIGURE_LOCALSTATEDIR=$CONFIGURE_LOCALSTATEDIR" ;; *) break ;; esac done eval "CONFIGURE_LOCALSTATEDIR=$CONFIGURE_LOCALSTATEDIR" ac_config_files="$ac_config_files Makefile src/Makefile qa/Makefile qa/coccinelle/Makefile rules/Makefile doc/Makefile doc/userguide/Makefile contrib/Makefile contrib/file_processor/Makefile contrib/file_processor/Action/Makefile contrib/file_processor/Processor/Makefile contrib/tile_pcie_logd/Makefile suricata.yaml scripts/Makefile scripts/suricatasc/Makefile scripts/suricatasc/suricatasc" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes: double-quote # substitution turns \\\\ into \\, and sed turns \\ into \. sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then if test "x$cache_file" != "x/dev/null"; then { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 $as_echo "$as_me: updating cache $cache_file" >&6;} if test ! -f "$cache_file" || test -h "$cache_file"; then cat confcache >"$cache_file" else case $cache_file in #( */* | ?:*) mv -f confcache "$cache_file"$$ && mv -f "$cache_file"$$ "$cache_file" ;; #( *) mv -f confcache "$cache_file" ;; esac fi fi else { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 $as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' DEFS=-DHAVE_CONFIG_H ac_libobjs= ac_ltlibobjs= U= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`$as_echo "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs { $as_echo "$as_me:${as_lineno-$LINENO}: checking that generated files are newer than configure" >&5 $as_echo_n "checking that generated files are newer than configure... " >&6; } if test -n "$am_sleep_pid"; then # Hide warnings about reused PIDs. wait $am_sleep_pid 2>/dev/null fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: done" >&5 $as_echo "done" >&6; } if test -n "$EXEEXT"; then am__EXEEXT_TRUE= am__EXEEXT_FALSE='#' else am__EXEEXT_TRUE='#' am__EXEEXT_FALSE= fi if test -z "${AMDEP_TRUE}" && test -z "${AMDEP_FALSE}"; then as_fn_error $? "conditional \"AMDEP\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${am__fastdepCC_TRUE}" && test -z "${am__fastdepCC_FALSE}"; then as_fn_error $? "conditional \"am__fastdepCC\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${am__fastdepCC_TRUE}" && test -z "${am__fastdepCC_FALSE}"; then as_fn_error $? "conditional \"am__fastdepCC\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_PYTHON_TRUE}" && test -z "${HAVE_PYTHON_FALSE}"; then as_fn_error $? "conditional \"HAVE_PYTHON\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_FETCH_COMMAND_TRUE}" && test -z "${HAVE_FETCH_COMMAND_FALSE}"; then as_fn_error $? "conditional \"HAVE_FETCH_COMMAND\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_WGET_COMMAND_TRUE}" && test -z "${HAVE_WGET_COMMAND_FALSE}"; then as_fn_error $? "conditional \"HAVE_WGET_COMMAND\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${BUILD_UNITTESTS_TRUE}" && test -z "${BUILD_UNITTESTS_FALSE}"; then as_fn_error $? "conditional \"BUILD_UNITTESTS\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${DEBUG_TRUE}" && test -z "${DEBUG_FALSE}"; then as_fn_error $? "conditional \"DEBUG\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_COCCINELLE_TRUE}" && test -z "${HAVE_COCCINELLE_FALSE}"; then as_fn_error $? "conditional \"HAVE_COCCINELLE\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${BUILD_PCIE_LOGGING_TRUE}" && test -z "${BUILD_PCIE_LOGGING_FALSE}"; then as_fn_error $? "conditional \"BUILD_PCIE_LOGGING\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${BUILD_CUDA_TRUE}" && test -z "${BUILD_CUDA_FALSE}"; then as_fn_error $? "conditional \"BUILD_CUDA\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${__SC_CUDA_SUPPORT___TRUE}" && test -z "${__SC_CUDA_SUPPORT___FALSE}"; then as_fn_error $? "conditional \"__SC_CUDA_SUPPORT__\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_SPHINXBUILD_TRUE}" && test -z "${HAVE_SPHINXBUILD_FALSE}"; then as_fn_error $? "conditional \"HAVE_SPHINXBUILD\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_SURICATA_MAN_TRUE}" && test -z "${HAVE_SURICATA_MAN_FALSE}"; then as_fn_error $? "conditional \"HAVE_SURICATA_MAN\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi if test -z "${HAVE_PDFLATEX_TRUE}" && test -z "${HAVE_PDFLATEX_FALSE}"; then as_fn_error $? "conditional \"HAVE_PDFLATEX\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 $as_echo "$as_me: creating $CONFIG_STATUS" >&6;} as_write_fail=0 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 ## ----------------------------------- ## ## Main body of $CONFIG_STATUS script. ## ## ----------------------------------- ## _ASEOF test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Save the log message, to keep $0 and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by suricata $as_me 3.2.1, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac case $ac_config_headers in *" "*) set x $ac_config_headers; shift; ac_config_headers=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" config_headers="$ac_config_headers" config_commands="$ac_config_commands" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files and other configuration actions from templates according to the current configuration. Unless the files and actions are specified as TAGs, all are instantiated by default. Usage: $0 [OPTION]... [TAG]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit --config print configuration, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE --header=FILE[:TEMPLATE] instantiate the configuration header FILE Configuration files: $config_files Configuration headers: $config_headers Configuration commands: $config_commands Report bugs to the package provider." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ suricata config.status 3.2.1 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" Copyright (C) 2012 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' INSTALL='$INSTALL' MKDIR_P='$MKDIR_P' AWK='$AWK' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=?*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; --*=) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg= ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) $as_echo "$ac_cs_version"; exit ;; --config | --confi | --conf | --con | --co | --c ) $as_echo "$ac_cs_config"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; '') as_fn_error $? "missing file argument" ;; esac as_fn_append CONFIG_FILES " '$ac_optarg'" ac_need_defaults=false;; --header | --heade | --head | --hea ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append CONFIG_HEADERS " '$ac_optarg'" ac_need_defaults=false;; --he | --h) # Conflict between --help and --header as_fn_error $? "ambiguous option: \`$1' Try \`$0 --help' for more information.";; --help | --hel | -h ) $as_echo "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) as_fn_error $? "unrecognized option: \`$1' Try \`$0 --help' for more information." ;; *) as_fn_append ac_config_targets " $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX $as_echo "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # # INIT-COMMANDS # AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir" # The HP-UX ksh and POSIX shell print the target directory to stdout # if CDPATH is set. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH sed_quote_subst='$sed_quote_subst' double_quote_subst='$double_quote_subst' delay_variable_subst='$delay_variable_subst' macro_version='`$ECHO "$macro_version" | $SED "$delay_single_quote_subst"`' macro_revision='`$ECHO "$macro_revision" | $SED "$delay_single_quote_subst"`' enable_shared='`$ECHO "$enable_shared" | $SED "$delay_single_quote_subst"`' enable_static='`$ECHO "$enable_static" | $SED "$delay_single_quote_subst"`' pic_mode='`$ECHO "$pic_mode" | $SED "$delay_single_quote_subst"`' enable_fast_install='`$ECHO "$enable_fast_install" | $SED "$delay_single_quote_subst"`' shared_archive_member_spec='`$ECHO "$shared_archive_member_spec" | $SED "$delay_single_quote_subst"`' SHELL='`$ECHO "$SHELL" | $SED "$delay_single_quote_subst"`' ECHO='`$ECHO "$ECHO" | $SED "$delay_single_quote_subst"`' PATH_SEPARATOR='`$ECHO "$PATH_SEPARATOR" | $SED "$delay_single_quote_subst"`' host_alias='`$ECHO "$host_alias" | $SED "$delay_single_quote_subst"`' host='`$ECHO "$host" | $SED "$delay_single_quote_subst"`' host_os='`$ECHO "$host_os" | $SED "$delay_single_quote_subst"`' build_alias='`$ECHO "$build_alias" | $SED "$delay_single_quote_subst"`' build='`$ECHO "$build" | $SED "$delay_single_quote_subst"`' build_os='`$ECHO "$build_os" | $SED "$delay_single_quote_subst"`' SED='`$ECHO "$SED" | $SED "$delay_single_quote_subst"`' Xsed='`$ECHO "$Xsed" | $SED "$delay_single_quote_subst"`' GREP='`$ECHO "$GREP" | $SED "$delay_single_quote_subst"`' EGREP='`$ECHO "$EGREP" | $SED "$delay_single_quote_subst"`' FGREP='`$ECHO "$FGREP" | $SED "$delay_single_quote_subst"`' LD='`$ECHO "$LD" | $SED "$delay_single_quote_subst"`' NM='`$ECHO "$NM" | $SED "$delay_single_quote_subst"`' LN_S='`$ECHO "$LN_S" | $SED "$delay_single_quote_subst"`' max_cmd_len='`$ECHO "$max_cmd_len" | $SED "$delay_single_quote_subst"`' ac_objext='`$ECHO "$ac_objext" | $SED "$delay_single_quote_subst"`' exeext='`$ECHO "$exeext" | $SED "$delay_single_quote_subst"`' lt_unset='`$ECHO "$lt_unset" | $SED "$delay_single_quote_subst"`' lt_SP2NL='`$ECHO "$lt_SP2NL" | $SED "$delay_single_quote_subst"`' lt_NL2SP='`$ECHO "$lt_NL2SP" | $SED "$delay_single_quote_subst"`' lt_cv_to_host_file_cmd='`$ECHO "$lt_cv_to_host_file_cmd" | $SED "$delay_single_quote_subst"`' lt_cv_to_tool_file_cmd='`$ECHO "$lt_cv_to_tool_file_cmd" | $SED "$delay_single_quote_subst"`' reload_flag='`$ECHO "$reload_flag" | $SED "$delay_single_quote_subst"`' reload_cmds='`$ECHO "$reload_cmds" | $SED "$delay_single_quote_subst"`' OBJDUMP='`$ECHO "$OBJDUMP" | $SED "$delay_single_quote_subst"`' deplibs_check_method='`$ECHO "$deplibs_check_method" | $SED "$delay_single_quote_subst"`' file_magic_cmd='`$ECHO "$file_magic_cmd" | $SED "$delay_single_quote_subst"`' file_magic_glob='`$ECHO "$file_magic_glob" | $SED "$delay_single_quote_subst"`' want_nocaseglob='`$ECHO "$want_nocaseglob" | $SED "$delay_single_quote_subst"`' DLLTOOL='`$ECHO "$DLLTOOL" | $SED "$delay_single_quote_subst"`' sharedlib_from_linklib_cmd='`$ECHO "$sharedlib_from_linklib_cmd" | $SED "$delay_single_quote_subst"`' AR='`$ECHO "$AR" | $SED "$delay_single_quote_subst"`' AR_FLAGS='`$ECHO "$AR_FLAGS" | $SED "$delay_single_quote_subst"`' archiver_list_spec='`$ECHO "$archiver_list_spec" | $SED "$delay_single_quote_subst"`' STRIP='`$ECHO "$STRIP" | $SED "$delay_single_quote_subst"`' RANLIB='`$ECHO "$RANLIB" | $SED "$delay_single_quote_subst"`' old_postinstall_cmds='`$ECHO "$old_postinstall_cmds" | $SED "$delay_single_quote_subst"`' old_postuninstall_cmds='`$ECHO "$old_postuninstall_cmds" | $SED "$delay_single_quote_subst"`' old_archive_cmds='`$ECHO "$old_archive_cmds" | $SED "$delay_single_quote_subst"`' lock_old_archive_extraction='`$ECHO "$lock_old_archive_extraction" | $SED "$delay_single_quote_subst"`' CC='`$ECHO "$CC" | $SED "$delay_single_quote_subst"`' CFLAGS='`$ECHO "$CFLAGS" | $SED "$delay_single_quote_subst"`' compiler='`$ECHO "$compiler" | $SED "$delay_single_quote_subst"`' GCC='`$ECHO "$GCC" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_pipe='`$ECHO "$lt_cv_sys_global_symbol_pipe" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_cdecl='`$ECHO "$lt_cv_sys_global_symbol_to_cdecl" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_import='`$ECHO "$lt_cv_sys_global_symbol_to_import" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_c_name_address='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address" | $SED "$delay_single_quote_subst"`' lt_cv_sys_global_symbol_to_c_name_address_lib_prefix='`$ECHO "$lt_cv_sys_global_symbol_to_c_name_address_lib_prefix" | $SED "$delay_single_quote_subst"`' lt_cv_nm_interface='`$ECHO "$lt_cv_nm_interface" | $SED "$delay_single_quote_subst"`' nm_file_list_spec='`$ECHO "$nm_file_list_spec" | $SED "$delay_single_quote_subst"`' lt_sysroot='`$ECHO "$lt_sysroot" | $SED "$delay_single_quote_subst"`' lt_cv_truncate_bin='`$ECHO "$lt_cv_truncate_bin" | $SED "$delay_single_quote_subst"`' objdir='`$ECHO "$objdir" | $SED "$delay_single_quote_subst"`' MAGIC_CMD='`$ECHO "$MAGIC_CMD" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_no_builtin_flag='`$ECHO "$lt_prog_compiler_no_builtin_flag" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_pic='`$ECHO "$lt_prog_compiler_pic" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_wl='`$ECHO "$lt_prog_compiler_wl" | $SED "$delay_single_quote_subst"`' lt_prog_compiler_static='`$ECHO "$lt_prog_compiler_static" | $SED "$delay_single_quote_subst"`' lt_cv_prog_compiler_c_o='`$ECHO "$lt_cv_prog_compiler_c_o" | $SED "$delay_single_quote_subst"`' need_locks='`$ECHO "$need_locks" | $SED "$delay_single_quote_subst"`' MANIFEST_TOOL='`$ECHO "$MANIFEST_TOOL" | $SED "$delay_single_quote_subst"`' DSYMUTIL='`$ECHO "$DSYMUTIL" | $SED "$delay_single_quote_subst"`' NMEDIT='`$ECHO "$NMEDIT" | $SED "$delay_single_quote_subst"`' LIPO='`$ECHO "$LIPO" | $SED "$delay_single_quote_subst"`' OTOOL='`$ECHO "$OTOOL" | $SED "$delay_single_quote_subst"`' OTOOL64='`$ECHO "$OTOOL64" | $SED "$delay_single_quote_subst"`' libext='`$ECHO "$libext" | $SED "$delay_single_quote_subst"`' shrext_cmds='`$ECHO "$shrext_cmds" | $SED "$delay_single_quote_subst"`' extract_expsyms_cmds='`$ECHO "$extract_expsyms_cmds" | $SED "$delay_single_quote_subst"`' archive_cmds_need_lc='`$ECHO "$archive_cmds_need_lc" | $SED "$delay_single_quote_subst"`' enable_shared_with_static_runtimes='`$ECHO "$enable_shared_with_static_runtimes" | $SED "$delay_single_quote_subst"`' export_dynamic_flag_spec='`$ECHO "$export_dynamic_flag_spec" | $SED "$delay_single_quote_subst"`' whole_archive_flag_spec='`$ECHO "$whole_archive_flag_spec" | $SED "$delay_single_quote_subst"`' compiler_needs_object='`$ECHO "$compiler_needs_object" | $SED "$delay_single_quote_subst"`' old_archive_from_new_cmds='`$ECHO "$old_archive_from_new_cmds" | $SED "$delay_single_quote_subst"`' old_archive_from_expsyms_cmds='`$ECHO "$old_archive_from_expsyms_cmds" | $SED "$delay_single_quote_subst"`' archive_cmds='`$ECHO "$archive_cmds" | $SED "$delay_single_quote_subst"`' archive_expsym_cmds='`$ECHO "$archive_expsym_cmds" | $SED "$delay_single_quote_subst"`' module_cmds='`$ECHO "$module_cmds" | $SED "$delay_single_quote_subst"`' module_expsym_cmds='`$ECHO "$module_expsym_cmds" | $SED "$delay_single_quote_subst"`' with_gnu_ld='`$ECHO "$with_gnu_ld" | $SED "$delay_single_quote_subst"`' allow_undefined_flag='`$ECHO "$allow_undefined_flag" | $SED "$delay_single_quote_subst"`' no_undefined_flag='`$ECHO "$no_undefined_flag" | $SED "$delay_single_quote_subst"`' hardcode_libdir_flag_spec='`$ECHO "$hardcode_libdir_flag_spec" | $SED "$delay_single_quote_subst"`' hardcode_libdir_separator='`$ECHO "$hardcode_libdir_separator" | $SED "$delay_single_quote_subst"`' hardcode_direct='`$ECHO "$hardcode_direct" | $SED "$delay_single_quote_subst"`' hardcode_direct_absolute='`$ECHO "$hardcode_direct_absolute" | $SED "$delay_single_quote_subst"`' hardcode_minus_L='`$ECHO "$hardcode_minus_L" | $SED "$delay_single_quote_subst"`' hardcode_shlibpath_var='`$ECHO "$hardcode_shlibpath_var" | $SED "$delay_single_quote_subst"`' hardcode_automatic='`$ECHO "$hardcode_automatic" | $SED "$delay_single_quote_subst"`' inherit_rpath='`$ECHO "$inherit_rpath" | $SED "$delay_single_quote_subst"`' link_all_deplibs='`$ECHO "$link_all_deplibs" | $SED "$delay_single_quote_subst"`' always_export_symbols='`$ECHO "$always_export_symbols" | $SED "$delay_single_quote_subst"`' export_symbols_cmds='`$ECHO "$export_symbols_cmds" | $SED "$delay_single_quote_subst"`' exclude_expsyms='`$ECHO "$exclude_expsyms" | $SED "$delay_single_quote_subst"`' include_expsyms='`$ECHO "$include_expsyms" | $SED "$delay_single_quote_subst"`' prelink_cmds='`$ECHO "$prelink_cmds" | $SED "$delay_single_quote_subst"`' postlink_cmds='`$ECHO "$postlink_cmds" | $SED "$delay_single_quote_subst"`' file_list_spec='`$ECHO "$file_list_spec" | $SED "$delay_single_quote_subst"`' variables_saved_for_relink='`$ECHO "$variables_saved_for_relink" | $SED "$delay_single_quote_subst"`' need_lib_prefix='`$ECHO "$need_lib_prefix" | $SED "$delay_single_quote_subst"`' need_version='`$ECHO "$need_version" | $SED "$delay_single_quote_subst"`' version_type='`$ECHO "$version_type" | $SED "$delay_single_quote_subst"`' runpath_var='`$ECHO "$runpath_var" | $SED "$delay_single_quote_subst"`' shlibpath_var='`$ECHO "$shlibpath_var" | $SED "$delay_single_quote_subst"`' shlibpath_overrides_runpath='`$ECHO "$shlibpath_overrides_runpath" | $SED "$delay_single_quote_subst"`' libname_spec='`$ECHO "$libname_spec" | $SED "$delay_single_quote_subst"`' library_names_spec='`$ECHO "$library_names_spec" | $SED "$delay_single_quote_subst"`' soname_spec='`$ECHO "$soname_spec" | $SED "$delay_single_quote_subst"`' install_override_mode='`$ECHO "$install_override_mode" | $SED "$delay_single_quote_subst"`' postinstall_cmds='`$ECHO "$postinstall_cmds" | $SED "$delay_single_quote_subst"`' postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`' finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`' finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`' hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`' sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`' configure_time_dlsearch_path='`$ECHO "$configure_time_dlsearch_path" | $SED "$delay_single_quote_subst"`' configure_time_lt_sys_library_path='`$ECHO "$configure_time_lt_sys_library_path" | $SED "$delay_single_quote_subst"`' hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`' enable_dlopen='`$ECHO "$enable_dlopen" | $SED "$delay_single_quote_subst"`' enable_dlopen_self='`$ECHO "$enable_dlopen_self" | $SED "$delay_single_quote_subst"`' enable_dlopen_self_static='`$ECHO "$enable_dlopen_self_static" | $SED "$delay_single_quote_subst"`' old_striplib='`$ECHO "$old_striplib" | $SED "$delay_single_quote_subst"`' striplib='`$ECHO "$striplib" | $SED "$delay_single_quote_subst"`' LTCC='$LTCC' LTCFLAGS='$LTCFLAGS' compiler='$compiler_DEFAULT' # A function that is used when there is no print builtin or printf. func_fallback_echo () { eval 'cat <<_LTECHO_EOF \$1 _LTECHO_EOF' } # Quote evaled strings. for var in SHELL \ ECHO \ PATH_SEPARATOR \ SED \ GREP \ EGREP \ FGREP \ LD \ NM \ LN_S \ lt_SP2NL \ lt_NL2SP \ reload_flag \ OBJDUMP \ deplibs_check_method \ file_magic_cmd \ file_magic_glob \ want_nocaseglob \ DLLTOOL \ sharedlib_from_linklib_cmd \ AR \ AR_FLAGS \ archiver_list_spec \ STRIP \ RANLIB \ CC \ CFLAGS \ compiler \ lt_cv_sys_global_symbol_pipe \ lt_cv_sys_global_symbol_to_cdecl \ lt_cv_sys_global_symbol_to_import \ lt_cv_sys_global_symbol_to_c_name_address \ lt_cv_sys_global_symbol_to_c_name_address_lib_prefix \ lt_cv_nm_interface \ nm_file_list_spec \ lt_cv_truncate_bin \ lt_prog_compiler_no_builtin_flag \ lt_prog_compiler_pic \ lt_prog_compiler_wl \ lt_prog_compiler_static \ lt_cv_prog_compiler_c_o \ need_locks \ MANIFEST_TOOL \ DSYMUTIL \ NMEDIT \ LIPO \ OTOOL \ OTOOL64 \ shrext_cmds \ export_dynamic_flag_spec \ whole_archive_flag_spec \ compiler_needs_object \ with_gnu_ld \ allow_undefined_flag \ no_undefined_flag \ hardcode_libdir_flag_spec \ hardcode_libdir_separator \ exclude_expsyms \ include_expsyms \ file_list_spec \ variables_saved_for_relink \ libname_spec \ library_names_spec \ soname_spec \ install_override_mode \ finish_eval \ old_striplib \ striplib; do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[\\\\\\\`\\"\\\$]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED \\"\\\$sed_quote_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done # Double-quote double-evaled strings. for var in reload_cmds \ old_postinstall_cmds \ old_postuninstall_cmds \ old_archive_cmds \ extract_expsyms_cmds \ old_archive_from_new_cmds \ old_archive_from_expsyms_cmds \ archive_cmds \ archive_expsym_cmds \ module_cmds \ module_expsym_cmds \ export_symbols_cmds \ prelink_cmds \ postlink_cmds \ postinstall_cmds \ postuninstall_cmds \ finish_cmds \ sys_lib_search_path_spec \ configure_time_dlsearch_path \ configure_time_lt_sys_library_path; do case \`eval \\\\\$ECHO \\\\""\\\\\$\$var"\\\\"\` in *[\\\\\\\`\\"\\\$]*) eval "lt_\$var=\\\\\\"\\\`\\\$ECHO \\"\\\$\$var\\" | \\\$SED -e \\"\\\$double_quote_subst\\" -e \\"\\\$sed_quote_subst\\" -e \\"\\\$delay_variable_subst\\"\\\`\\\\\\"" ## exclude from sc_prohibit_nested_quotes ;; *) eval "lt_\$var=\\\\\\"\\\$\$var\\\\\\"" ;; esac done ac_aux_dir='$ac_aux_dir' # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes INIT. if test -n "\${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi PACKAGE='$PACKAGE' VERSION='$VERSION' RM='$RM' ofile='$ofile' _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in "config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;; "depfiles") CONFIG_COMMANDS="$CONFIG_COMMANDS depfiles" ;; "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;; "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;; "qa/Makefile") CONFIG_FILES="$CONFIG_FILES qa/Makefile" ;; "qa/coccinelle/Makefile") CONFIG_FILES="$CONFIG_FILES qa/coccinelle/Makefile" ;; "rules/Makefile") CONFIG_FILES="$CONFIG_FILES rules/Makefile" ;; "doc/Makefile") CONFIG_FILES="$CONFIG_FILES doc/Makefile" ;; "doc/userguide/Makefile") CONFIG_FILES="$CONFIG_FILES doc/userguide/Makefile" ;; "contrib/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/Makefile" ;; "contrib/file_processor/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/file_processor/Makefile" ;; "contrib/file_processor/Action/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/file_processor/Action/Makefile" ;; "contrib/file_processor/Processor/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/file_processor/Processor/Makefile" ;; "contrib/tile_pcie_logd/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/tile_pcie_logd/Makefile" ;; "suricata.yaml") CONFIG_FILES="$CONFIG_FILES suricata.yaml" ;; "scripts/Makefile") CONFIG_FILES="$CONFIG_FILES scripts/Makefile" ;; "scripts/suricatasc/Makefile") CONFIG_FILES="$CONFIG_FILES scripts/suricatasc/Makefile" ;; "scripts/suricatasc/suricatasc") CONFIG_FILES="$CONFIG_FILES scripts/suricatasc/suricatasc" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers test "${CONFIG_COMMANDS+set}" = set || CONFIG_COMMANDS=$config_commands fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= ac_tmp= trap 'exit_status=$? : "${ac_tmp:=$tmp}" { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status ' 0 trap 'as_fn_exit 1' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 ac_tmp=$tmp # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=`echo X | tr X '\015'` # On cygwin, bash can eat \r inside `` if the user requested igncr. # But we know of no other shell where ac_cr would be empty at this # point, so we can use a bashism as a fallback. if test "x$ac_cr" = x; then eval ac_cr=\$\'\\r\' fi ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$ac_tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\)..*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\)..*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$ac_tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 _ACEOF # VPATH may cause trouble with some makes, so we remove sole $(srcdir), # ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ h s/// s/^/:/ s/[ ]*$/:/ s/:\$(srcdir):/:/g s/:\${srcdir}:/:/g s/:@srcdir@:/:/g s/^:*// s/:*$// x s/\(=[ ]*\).*/\1/ G s/\n// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" # Set up the scripts for CONFIG_HEADERS section. # No need to generate them if there are no CONFIG_HEADERS. # This happens for instance with `./config.status Makefile'. if test -n "$CONFIG_HEADERS"; then cat >"$ac_tmp/defines.awk" <<\_ACAWK || BEGIN { _ACEOF # Transform confdefs.h into an awk script `defines.awk', embedded as # here-document in config.status, that substitutes the proper values into # config.h.in to produce config.h. # Create a delimiter string that does not exist in confdefs.h, to ease # handling of long lines. ac_delim='%!_!# ' for ac_last_try in false false :; do ac_tt=`sed -n "/$ac_delim/p" confdefs.h` if test -z "$ac_tt"; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done # For the awk script, D is an array of macro values keyed by name, # likewise P contains macro parameters if any. Preserve backslash # newline sequences. ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]* sed -n ' s/.\{148\}/&'"$ac_delim"'/g t rset :rset s/^[ ]*#[ ]*define[ ][ ]*/ / t def d :def s/\\$// t bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3"/p s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2"/p d :bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3\\\\\\n"\\/p t cont s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2\\\\\\n"\\/p t cont d :cont n s/.\{148\}/&'"$ac_delim"'/g t clear :clear s/\\$// t bsnlc s/["\\]/\\&/g; s/^/"/; s/$/"/p d :bsnlc s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p b cont ' >$CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 for (key in D) D_is_set[key] = 1 FS = "" } /^[\t ]*#[\t ]*(define|undef)[\t ]+$ac_word_re([\t (]|\$)/ { line = \$ 0 split(line, arg, " ") if (arg[1] == "#") { defundef = arg[2] mac1 = arg[3] } else { defundef = substr(arg[1], 2) mac1 = arg[2] } split(mac1, mac2, "(") #) macro = mac2[1] prefix = substr(line, 1, index(line, defundef) - 1) if (D_is_set[macro]) { # Preserve the white space surrounding the "#". print prefix "define", macro P[macro] D[macro] next } else { # Replace #undef with comments. This is necessary, for example, # in the case of _POSIX_SOURCE, which is predefined and required # on some systems where configure will not decide to define it. if (defundef == "undef") { print "/*", prefix defundef, macro, "*/" next } } } { print } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 as_fn_error $? "could not setup config headers machinery" "$LINENO" 5 fi # test -n "$CONFIG_HEADERS" eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS :C $CONFIG_COMMANDS" shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$ac_tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;; esac case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac as_fn_append ac_file_inputs " '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 $as_echo "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`$as_echo "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$ac_tmp/stdin" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # case $INSTALL in [\\/$]* | ?:[\\/]* ) ac_INSTALL=$INSTALL ;; *) ac_INSTALL=$ac_top_build_prefix$INSTALL ;; esac ac_MKDIR_P=$MKDIR_P case $MKDIR_P in [\\/$]* | ?:[\\/]* ) ;; */*) ac_MKDIR_P=$ac_top_build_prefix$MKDIR_P ;; esac _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 $as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t s&@INSTALL@&$ac_INSTALL&;t t s&@MKDIR_P@&$ac_MKDIR_P&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \ >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5 test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \ "$ac_tmp/out"`; test -z "$ac_out"; } && { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&5 $as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&2;} rm -f "$ac_tmp/stdin" case $ac_file in -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";; *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";; esac \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; :H) # # CONFIG_HEADER # if test x"$ac_file" != x-; then { $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" } >"$ac_tmp/config.h" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5 $as_echo "$as_me: $ac_file is unchanged" >&6;} else rm -f "$ac_file" mv "$ac_tmp/config.h" "$ac_file" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 fi else $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \ || as_fn_error $? "could not create -" "$LINENO" 5 fi # Compute "$ac_file"'s index in $config_headers. _am_arg="$ac_file" _am_stamp_count=1 for _am_header in $config_headers :; do case $_am_header in $_am_arg | $_am_arg:* ) break ;; * ) _am_stamp_count=`expr $_am_stamp_count + 1` ;; esac done echo "timestamp for $_am_arg" >`$as_dirname -- "$_am_arg" || $as_expr X"$_am_arg" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$_am_arg" : 'X\(//\)[^/]' \| \ X"$_am_arg" : 'X\(//\)$' \| \ X"$_am_arg" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$_am_arg" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'`/stamp-h$_am_stamp_count ;; :C) { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5 $as_echo "$as_me: executing $ac_file commands" >&6;} ;; esac case $ac_file$ac_mode in "depfiles":C) test x"$AMDEP_TRUE" != x"" || { # Older Autoconf quotes --file arguments for eval, but not when files # are listed without --file. Let's play safe and only enable the eval # if we detect the quoting. case $CONFIG_FILES in *\'*) eval set x "$CONFIG_FILES" ;; *) set x $CONFIG_FILES ;; esac shift for mf do # Strip MF so we end up with the name of the file. mf=`echo "$mf" | sed -e 's/:.*$//'` # Check whether this is an Automake generated Makefile or not. # We used to match only the files named 'Makefile.in', but # some people rename them; so instead we look at the file content. # Grep'ing the first line is not enough: some people post-process # each Makefile.in and add a new line on top of each file to say so. # Grep'ing the whole file is not good either: AIX grep has a line # limit of 2048, but all sed's we know have understand at least 4000. if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then dirpart=`$as_dirname -- "$mf" || $as_expr X"$mf" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$mf" : 'X\(//\)[^/]' \| \ X"$mf" : 'X\(//\)$' \| \ X"$mf" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$mf" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` else continue fi # Extract the definition of DEPDIR, am__include, and am__quote # from the Makefile without running 'make'. DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"` test -z "$DEPDIR" && continue am__include=`sed -n 's/^am__include = //p' < "$mf"` test -z "$am__include" && continue am__quote=`sed -n 's/^am__quote = //p' < "$mf"` # Find all dependency output files, they are included files with # $(DEPDIR) in their names. We invoke sed twice because it is the # simplest approach to changing $(DEPDIR) to its actual value in the # expansion. for file in `sed -n " s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \ sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do # Make sure the directory exists. test -f "$dirpart/$file" && continue fdir=`$as_dirname -- "$file" || $as_expr X"$file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$file" : 'X\(//\)[^/]' \| \ X"$file" : 'X\(//\)$' \| \ X"$file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir=$dirpart/$fdir; as_fn_mkdir_p # echo "creating $dirpart/$file" echo '# dummy' > "$dirpart/$file" done done } ;; "libtool":C) # See if we are running on zsh, and set the options that allow our # commands through without removal of \ escapes. if test -n "${ZSH_VERSION+set}"; then setopt NO_GLOB_SUBST fi cfgfile=${ofile}T trap "$RM \"$cfgfile\"; exit 1" 1 2 15 $RM "$cfgfile" cat <<_LT_EOF >> "$cfgfile" #! $SHELL # Generated automatically by $as_me ($PACKAGE) $VERSION # Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`: # NOTE: Changes made to this file will be lost: look at ltmain.sh. # Provide generalized library-building support services. # Written by Gordon Matzigkeit, 1996 # Copyright (C) 2014 Free Software Foundation, Inc. # This is free software; see the source for copying conditions. There is NO # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # GNU Libtool is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of of the License, or # (at your option) any later version. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program or library that is built # using GNU Libtool, you may include this file under the same # distribution terms that you use for the rest of that program. # # GNU Libtool is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # The names of the tagged configurations supported by this script. available_tags='' # Configured defaults for sys_lib_dlsearch_path munging. : \${LT_SYS_LIBRARY_PATH="$configure_time_lt_sys_library_path"} # ### BEGIN LIBTOOL CONFIG # Which release of libtool.m4 was used? macro_version=$macro_version macro_revision=$macro_revision # Whether or not to build shared libraries. build_libtool_libs=$enable_shared # Whether or not to build static libraries. build_old_libs=$enable_static # What type of objects to build. pic_mode=$pic_mode # Whether or not to optimize for fast installation. fast_install=$enable_fast_install # Shared archive member basename,for filename based shared library versioning on AIX. shared_archive_member_spec=$shared_archive_member_spec # Shell to use when invoking shell scripts. SHELL=$lt_SHELL # An echo program that protects backslashes. ECHO=$lt_ECHO # The PATH separator for the build system. PATH_SEPARATOR=$lt_PATH_SEPARATOR # The host system. host_alias=$host_alias host=$host host_os=$host_os # The build system. build_alias=$build_alias build=$build build_os=$build_os # A sed program that does not truncate output. SED=$lt_SED # Sed that helps us avoid accidentally triggering echo(1) options like -n. Xsed="\$SED -e 1s/^X//" # A grep program that handles long lines. GREP=$lt_GREP # An ERE matcher. EGREP=$lt_EGREP # A literal string matcher. FGREP=$lt_FGREP # A BSD- or MS-compatible name lister. NM=$lt_NM # Whether we need soft or hard links. LN_S=$lt_LN_S # What is the maximum length of a command? max_cmd_len=$max_cmd_len # Object file suffix (normally "o"). objext=$ac_objext # Executable file suffix (normally ""). exeext=$exeext # whether the shell understands "unset". lt_unset=$lt_unset # turn spaces into newlines. SP2NL=$lt_lt_SP2NL # turn newlines into spaces. NL2SP=$lt_lt_NL2SP # convert \$build file names to \$host format. to_host_file_cmd=$lt_cv_to_host_file_cmd # convert \$build files to toolchain format. to_tool_file_cmd=$lt_cv_to_tool_file_cmd # An object symbol dumper. OBJDUMP=$lt_OBJDUMP # Method to check whether dependent libraries are shared objects. deplibs_check_method=$lt_deplibs_check_method # Command to use when deplibs_check_method = "file_magic". file_magic_cmd=$lt_file_magic_cmd # How to find potential files when deplibs_check_method = "file_magic". file_magic_glob=$lt_file_magic_glob # Find potential files using nocaseglob when deplibs_check_method = "file_magic". want_nocaseglob=$lt_want_nocaseglob # DLL creation program. DLLTOOL=$lt_DLLTOOL # Command to associate shared and link libraries. sharedlib_from_linklib_cmd=$lt_sharedlib_from_linklib_cmd # The archiver. AR=$lt_AR # Flags to create an archive. AR_FLAGS=$lt_AR_FLAGS # How to feed a file listing to the archiver. archiver_list_spec=$lt_archiver_list_spec # A symbol stripping program. STRIP=$lt_STRIP # Commands used to install an old-style archive. RANLIB=$lt_RANLIB old_postinstall_cmds=$lt_old_postinstall_cmds old_postuninstall_cmds=$lt_old_postuninstall_cmds # Whether to use a lock for old archive extraction. lock_old_archive_extraction=$lock_old_archive_extraction # A C compiler. LTCC=$lt_CC # LTCC compiler flags. LTCFLAGS=$lt_CFLAGS # Take the output of nm and produce a listing of raw symbols and C names. global_symbol_pipe=$lt_lt_cv_sys_global_symbol_pipe # Transform the output of nm in a proper C declaration. global_symbol_to_cdecl=$lt_lt_cv_sys_global_symbol_to_cdecl # Transform the output of nm into a list of symbols to manually relocate. global_symbol_to_import=$lt_lt_cv_sys_global_symbol_to_import # Transform the output of nm in a C name address pair. global_symbol_to_c_name_address=$lt_lt_cv_sys_global_symbol_to_c_name_address # Transform the output of nm in a C name address pair when lib prefix is needed. global_symbol_to_c_name_address_lib_prefix=$lt_lt_cv_sys_global_symbol_to_c_name_address_lib_prefix # The name lister interface. nm_interface=$lt_lt_cv_nm_interface # Specify filename containing input files for \$NM. nm_file_list_spec=$lt_nm_file_list_spec # The root where to search for dependent libraries,and where our libraries should be installed. lt_sysroot=$lt_sysroot # Command to truncate a binary pipe. lt_truncate_bin=$lt_lt_cv_truncate_bin # The name of the directory that contains temporary libtool files. objdir=$objdir # Used to examine libraries when file_magic_cmd begins with "file". MAGIC_CMD=$MAGIC_CMD # Must we lock files when doing compilation? need_locks=$lt_need_locks # Manifest tool. MANIFEST_TOOL=$lt_MANIFEST_TOOL # Tool to manipulate archived DWARF debug symbol files on Mac OS X. DSYMUTIL=$lt_DSYMUTIL # Tool to change global to local symbols on Mac OS X. NMEDIT=$lt_NMEDIT # Tool to manipulate fat objects and archives on Mac OS X. LIPO=$lt_LIPO # ldd/readelf like tool for Mach-O binaries on Mac OS X. OTOOL=$lt_OTOOL # ldd/readelf like tool for 64 bit Mach-O binaries on Mac OS X 10.4. OTOOL64=$lt_OTOOL64 # Old archive suffix (normally "a"). libext=$libext # Shared library suffix (normally ".so"). shrext_cmds=$lt_shrext_cmds # The commands to extract the exported symbol list from a shared archive. extract_expsyms_cmds=$lt_extract_expsyms_cmds # Variables whose values should be saved in libtool wrapper scripts and # restored at link time. variables_saved_for_relink=$lt_variables_saved_for_relink # Do we need the "lib" prefix for modules? need_lib_prefix=$need_lib_prefix # Do we need a version for libraries? need_version=$need_version # Library versioning type. version_type=$version_type # Shared library runtime path variable. runpath_var=$runpath_var # Shared library path variable. shlibpath_var=$shlibpath_var # Is shlibpath searched before the hard-coded library search path? shlibpath_overrides_runpath=$shlibpath_overrides_runpath # Format of library name prefix. libname_spec=$lt_libname_spec # List of archive names. First name is the real one, the rest are links. # The last name is the one that the linker finds with -lNAME library_names_spec=$lt_library_names_spec # The coded name of the library, if different from the real name. soname_spec=$lt_soname_spec # Permission mode override for installation of shared libraries. install_override_mode=$lt_install_override_mode # Command to use after installation of a shared archive. postinstall_cmds=$lt_postinstall_cmds # Command to use after uninstallation of a shared archive. postuninstall_cmds=$lt_postuninstall_cmds # Commands used to finish a libtool library installation in a directory. finish_cmds=$lt_finish_cmds # As "finish_cmds", except a single script fragment to be evaled but # not shown. finish_eval=$lt_finish_eval # Whether we should hardcode library paths into libraries. hardcode_into_libs=$hardcode_into_libs # Compile-time system search path for libraries. sys_lib_search_path_spec=$lt_sys_lib_search_path_spec # Detected run-time system search path for libraries. sys_lib_dlsearch_path_spec=$lt_configure_time_dlsearch_path # Explicit LT_SYS_LIBRARY_PATH set during ./configure time. configure_time_lt_sys_library_path=$lt_configure_time_lt_sys_library_path # Whether dlopen is supported. dlopen_support=$enable_dlopen # Whether dlopen of programs is supported. dlopen_self=$enable_dlopen_self # Whether dlopen of statically linked programs is supported. dlopen_self_static=$enable_dlopen_self_static # Commands to strip libraries. old_striplib=$lt_old_striplib striplib=$lt_striplib # The linker used to build libraries. LD=$lt_LD # How to create reloadable object files. reload_flag=$lt_reload_flag reload_cmds=$lt_reload_cmds # Commands used to build an old-style archive. old_archive_cmds=$lt_old_archive_cmds # A language specific compiler. CC=$lt_compiler # Is the compiler the GNU compiler? with_gcc=$GCC # Compiler flag to turn off builtin functions. no_builtin_flag=$lt_lt_prog_compiler_no_builtin_flag # Additional compiler flags for building library objects. pic_flag=$lt_lt_prog_compiler_pic # How to pass a linker flag through the compiler. wl=$lt_lt_prog_compiler_wl # Compiler flag to prevent dynamic linking. link_static_flag=$lt_lt_prog_compiler_static # Does compiler simultaneously support -c and -o options? compiler_c_o=$lt_lt_cv_prog_compiler_c_o # Whether or not to add -lc for building shared libraries. build_libtool_need_lc=$archive_cmds_need_lc # Whether or not to disallow shared libs when runtime libs are static. allow_libtool_libs_with_static_runtimes=$enable_shared_with_static_runtimes # Compiler flag to allow reflexive dlopens. export_dynamic_flag_spec=$lt_export_dynamic_flag_spec # Compiler flag to generate shared objects directly from archives. whole_archive_flag_spec=$lt_whole_archive_flag_spec # Whether the compiler copes with passing no objects directly. compiler_needs_object=$lt_compiler_needs_object # Create an old-style archive from a shared archive. old_archive_from_new_cmds=$lt_old_archive_from_new_cmds # Create a temporary old-style archive to link instead of a shared archive. old_archive_from_expsyms_cmds=$lt_old_archive_from_expsyms_cmds # Commands used to build a shared archive. archive_cmds=$lt_archive_cmds archive_expsym_cmds=$lt_archive_expsym_cmds # Commands used to build a loadable module if different from building # a shared archive. module_cmds=$lt_module_cmds module_expsym_cmds=$lt_module_expsym_cmds # Whether we are building with GNU ld or not. with_gnu_ld=$lt_with_gnu_ld # Flag that allows shared libraries with undefined symbols to be built. allow_undefined_flag=$lt_allow_undefined_flag # Flag that enforces no undefined symbols. no_undefined_flag=$lt_no_undefined_flag # Flag to hardcode \$libdir into a binary during linking. # This must work even if \$libdir does not exist hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec # Whether we need a single "-rpath" flag with a separated argument. hardcode_libdir_separator=$lt_hardcode_libdir_separator # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary. hardcode_direct=$hardcode_direct # Set to "yes" if using DIR/libNAME\$shared_ext during linking hardcodes # DIR into the resulting binary and the resulting library dependency is # "absolute",i.e impossible to change by setting \$shlibpath_var if the # library is relocated. hardcode_direct_absolute=$hardcode_direct_absolute # Set to "yes" if using the -LDIR flag during linking hardcodes DIR # into the resulting binary. hardcode_minus_L=$hardcode_minus_L # Set to "yes" if using SHLIBPATH_VAR=DIR during linking hardcodes DIR # into the resulting binary. hardcode_shlibpath_var=$hardcode_shlibpath_var # Set to "yes" if building a shared library automatically hardcodes DIR # into the library and all subsequent libraries and executables linked # against it. hardcode_automatic=$hardcode_automatic # Set to yes if linker adds runtime paths of dependent libraries # to runtime path list. inherit_rpath=$inherit_rpath # Whether libtool must link a program against all its dependency libraries. link_all_deplibs=$link_all_deplibs # Set to "yes" if exported symbols are required. always_export_symbols=$always_export_symbols # The commands to list exported symbols. export_symbols_cmds=$lt_export_symbols_cmds # Symbols that should not be listed in the preloaded symbols. exclude_expsyms=$lt_exclude_expsyms # Symbols that must always be exported. include_expsyms=$lt_include_expsyms # Commands necessary for linking programs (against libraries) with templates. prelink_cmds=$lt_prelink_cmds # Commands necessary for finishing linking programs. postlink_cmds=$lt_postlink_cmds # Specify filename containing input files. file_list_spec=$lt_file_list_spec # How to hardcode a shared library path into an executable. hardcode_action=$hardcode_action # ### END LIBTOOL CONFIG _LT_EOF cat <<'_LT_EOF' >> "$cfgfile" # ### BEGIN FUNCTIONS SHARED WITH CONFIGURE # func_munge_path_list VARIABLE PATH # ----------------------------------- # VARIABLE is name of variable containing _space_ separated list of # directories to be munged by the contents of PATH, which is string # having a format: # "DIR[:DIR]:" # string "DIR[ DIR]" will be prepended to VARIABLE # ":DIR[:DIR]" # string "DIR[ DIR]" will be appended to VARIABLE # "DIRP[:DIRP]::[DIRA:]DIRA" # string "DIRP[ DIRP]" will be prepended to VARIABLE and string # "DIRA[ DIRA]" will be appended to VARIABLE # "DIR[:DIR]" # VARIABLE will be replaced by "DIR[ DIR]" func_munge_path_list () { case x$2 in x) ;; *:) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'` \$$1\" ;; x:*) eval $1=\"\$$1 `$ECHO $2 | $SED 's/:/ /g'`\" ;; *::*) eval $1=\"\$$1\ `$ECHO $2 | $SED -e 's/.*:://' -e 's/:/ /g'`\" eval $1=\"`$ECHO $2 | $SED -e 's/::.*//' -e 's/:/ /g'`\ \$$1\" ;; *) eval $1=\"`$ECHO $2 | $SED 's/:/ /g'`\" ;; esac } # Calculate cc_basename. Skip known compiler wrappers and cross-prefix. func_cc_basename () { for cc_temp in $*""; do case $cc_temp in compile | *[\\/]compile | ccache | *[\\/]ccache ) ;; distcc | *[\\/]distcc | purify | *[\\/]purify ) ;; \-*) ;; *) break;; esac done func_cc_basename_result=`$ECHO "$cc_temp" | $SED "s%.*/%%; s%^$host_alias-%%"` } # ### END FUNCTIONS SHARED WITH CONFIGURE _LT_EOF case $host_os in aix3*) cat <<\_LT_EOF >> "$cfgfile" # AIX sometimes has problems with the GCC collect2 program. For some # reason, if we set the COLLECT_NAMES environment variable, the problems # vanish in a puff of smoke. if test set != "${COLLECT_NAMES+set}"; then COLLECT_NAMES= export COLLECT_NAMES fi _LT_EOF ;; esac ltmain=$ac_aux_dir/ltmain.sh # We use sed instead of cat because bash on DJGPP gets confused if # if finds mixed CR/LF and LF-only lines. Since sed operates in # text mode, it properly converts lines to CR/LF. This bash problem # is reportedly fixed, but why not run on old versions too? sed '$q' "$ltmain" >> "$cfgfile" \ || (rm -f "$cfgfile"; exit 1) mv -f "$cfgfile" "$ofile" || (rm -f "$ofile" && cp "$cfgfile" "$ofile" && rm -f "$cfgfile") chmod +x "$ofile" ;; esac done # for ac_tag as_fn_exit 0 _ACEOF ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || as_fn_exit 1 fi # # CONFIG_SUBDIRS section. # if test "$no_recursion" != yes; then # Remove --cache-file, --srcdir, and --disable-option-checking arguments # so they do not pile up. ac_sub_configure_args= ac_prev= eval "set x $ac_configure_args" shift for ac_arg do if test -n "$ac_prev"; then ac_prev= continue fi case $ac_arg in -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* \ | --c=*) ;; --config-cache | -C) ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) ;; --disable-option-checking) ;; *) case $ac_arg in *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append ac_sub_configure_args " '$ac_arg'" ;; esac done # Always prepend --prefix to ensure using the same prefix # in subdir configurations. ac_arg="--prefix=$prefix" case $ac_arg in *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac ac_sub_configure_args="'$ac_arg' $ac_sub_configure_args" # Pass --silent if test "$silent" = yes; then ac_sub_configure_args="--silent $ac_sub_configure_args" fi # Always prepend --disable-option-checking to silence warnings, since # different subdirs can have different --enable and --with options. ac_sub_configure_args="--disable-option-checking $ac_sub_configure_args" ac_popdir=`pwd` for ac_dir in : $subdirs; do test "x$ac_dir" = x: && continue # Do not complain, so a configure script can configure whichever # parts of a large source tree are present. test -d "$srcdir/$ac_dir" || continue ac_msg="=== configuring in $ac_dir (`pwd`/$ac_dir)" $as_echo "$as_me:${as_lineno-$LINENO}: $ac_msg" >&5 $as_echo "$ac_msg" >&6 as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" # Check for guested configure; otherwise get Cygnus style configure. if test -f "$ac_srcdir/configure.gnu"; then ac_sub_configure=$ac_srcdir/configure.gnu elif test -f "$ac_srcdir/configure"; then ac_sub_configure=$ac_srcdir/configure elif test -f "$ac_srcdir/configure.in"; then # This should be Cygnus configure. ac_sub_configure=$ac_aux_dir/configure else { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: no configuration information is in $ac_dir" >&5 $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2;} ac_sub_configure= fi # The recursion is here. if test -n "$ac_sub_configure"; then # Make the cache file name correct relative to the subdirectory. case $cache_file in [\\/]* | ?:[\\/]* ) ac_sub_cache_file=$cache_file ;; *) # Relative name. ac_sub_cache_file=$ac_top_build_prefix$cache_file ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: running $SHELL $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_srcdir" >&5 $as_echo "$as_me: running $SHELL $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_srcdir" >&6;} # The eval makes quoting arguments work. eval "\$SHELL \"\$ac_sub_configure\" $ac_sub_configure_args \ --cache-file=\"\$ac_sub_cache_file\" --srcdir=\"\$ac_srcdir\"" || as_fn_error $? "$ac_sub_configure failed for $ac_dir" "$LINENO" 5 fi cd "$ac_popdir" done fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi SURICATA_BUILD_CONF="Suricata Configuration: AF_PACKET support: ${enable_af_packet} PF_RING support: ${enable_pfring} NFQueue support: ${enable_nfqueue} NFLOG support: ${enable_nflog} IPFW support: ${enable_ipfw} Netmap support: ${enable_netmap} DAG enabled: ${enable_dag} Napatech enabled: ${enable_napatech} Unix socket enabled: ${enable_unixsocket} Detection enabled: ${enable_detection} Libmagic support: ${enable_magic} libnss support: ${enable_nss} libnspr support: ${enable_nspr} libjansson support: ${enable_jansson} hiredis support: ${enable_hiredis} Prelude support: ${enable_prelude} PCRE jit: ${pcre_jit_available} LUA support: ${enable_lua} libluajit: ${enable_luajit} libgeoip: ${enable_geoip} Non-bundled htp: ${enable_non_bundled_htp} Old barnyard2 support: ${enable_old_barnyard2} CUDA enabled: ${enable_cuda} Hyperscan support: ${enable_hyperscan} Libnet support: ${enable_libnet} Suricatasc install: ${enable_python} Profiling enabled: ${enable_profiling} Profiling locks enabled: ${enable_profiling_locks} Development settings: Coccinelle / spatch: ${enable_coccinelle} Unit tests enabled: ${enable_unittests} Debug output enabled: ${enable_debug} Debug validation enabled: ${enable_debug_validation} Generic build parameters: Installation prefix: ${prefix} Configuration directory: ${e_sysconfdir} Log directory: ${e_logdir} --prefix ${CONFIGURE_PREFIX} --sysconfdir ${CONFIGURE_SYSCONDIR} --localstatedir ${CONFIGURE_LOCALSTATEDIR} Host: ${host} Compiler: ${CC} (exec name) / ${compiler} (real) GCC Protect enabled: ${enable_gccprotect} GCC march native enabled: ${enable_gccmarch_native} GCC Profile enabled: ${enable_gccprofile} Position Independent Executable enabled: ${enable_pie} CFLAGS ${CFLAGS} PCAP_CFLAGS ${PCAP_CFLAGS} SECCFLAGS ${SECCFLAGS}" echo echo "$SURICATA_BUILD_CONF" echo "printf(" >src/build-info.h echo "$SURICATA_BUILD_CONF" | sed -e 's/^/"/' | sed -e 's/$/\\n"/' >>src/build-info.h echo ");" >>src/build-info.h echo " To build and install run 'make' and 'make install'. You can run 'make install-conf' if you want to install initial configuration files to ${e_sysconfdir}. Running 'make install-full' will install configuration and rules and provide you a ready-to-run suricata." echo echo "To install Suricata into /usr/bin/suricata, have the config in /etc/suricata and use /var/log/suricata as log dir, use: ./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/" echo suricata-3.2.1/qa/0000755000000000000000000000000013051004503010667 500000000000000suricata-3.2.1/qa/sock_to_gzip_file.py0000755000000000000000000000371313051004444014665 00000000000000#!/usr/bin/python #I love the python Power Glove. It's so bad! #Usage: sudo -u suricata ./sock_to_gzip_file.py --output-file="http.log.gz" --listen-sock="http.log.sock" import socket,os import gzip import sys from optparse import OptionParser if __name__ == "__main__": parser = OptionParser() #Path to the socket parser.add_option("--listen-sock", dest="lsock", type="string", help="Path to the socket we will listen on.") #Path to gzip file we will write parser.add_option("--output-file", dest="output", type="string", help="Path to file name to output gzip file we will write to.") #parse the opts (options, args) = parser.parse_args() options.usage = "example: sudo -u suricata ./sock_to_gzip_file.py --output-file=\"http.log.gz\" --listen-sock=\"http.log.sock\"\n" #Open the output file if options.output: try: f = gzip.open(options.output, 'wb') except Exception,e: print("Error: could not open output file %s:\n%s\n", options.output, e) sys.exit(-1) else: print("Error: --output-file option required and was not specified\n%s" % (options.usage)) sys.exit(-1) #Open our socket and bind if options.lsock: if os.path.exists(options.lsock): try: os.remove(options.lsock) except OSError: pass try: s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.bind(options.lsock) s.listen(1) conn, addr = s.accept() except Exception,e: print("Error: Failed to bind socket %s\n%s\n", options.lsock, e) sys.exit(-1) else: print("Error: --listen-sock option required and was not specified\n%s" % (options.usage)) sys.exit(-1) #Read data from the socket and write to the file while 1: data = conn.recv(1024) if not data: break f.write(data) conn.close() f.close() suricata-3.2.1/qa/coccinelle/0000755000000000000000000000000013051004503012767 500000000000000suricata-3.2.1/qa/coccinelle/malloc-error-check.cocci0000644000000000000000000000215313051004444017367 00000000000000@malloced@ expression x; position p1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x@p1 = func(...) @inlinetested@ expression x, E; statement S; position malloced.p1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ ( if ((x@p1 = func(...)) == NULL) S | if (E && (x@p1 = func(...)) == NULL) S ) @realloc exists@ position malloced.p1; expression x, E1; identifier func =~ "(SCMalloc|SCCalloc|SCMallocAligned)"; @@ x@p1 = func(...) ... when != x x = SCRealloc(x, E1) @istested depends on !realloc exists@ expression x, E1; position malloced.p1; statement S1, S2; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)"; @@ x@p1 = func(...) ... when != x ( if (unlikely(x == NULL)) S1 | if (unlikely(x == NULL)) S1 else S2 | if (likely(x != NULL)) S1 | if (x == NULL) S1 | if (x != NULL) S1 else S2 | if (x && E1) S1 | BUG_ON(x == NULL) ) @script:python depends on !realloc && !istested && !inlinetested@ p1 << malloced.p1; @@ print "Structure malloced at %s:%s but error is not checked." % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/struct-flags.cocci0000644000000000000000000000322413051004444016334 00000000000000@flags@ SignatureHeader *struct0; identifier struct_flags0 =~ "^(?!SIG_FLAG).+"; Signature *struct1; identifier struct_flags1 =~ "^(?!SIG_FLAG).+"; Signature *struct2; identifier struct_flags2 =~ "^(?!SIG_FLAG_INIT_).+"; Flow *struct3; identifier struct_flags3 =~ "^(?!FLOW_).+"; TcpSegment *struct4; identifier struct_flags4 =~ "^(?!SEGMENTTCP_FLAG).+"; TcpStream *struct5; identifier struct_flags5 =~ "^(?!STREAMTCP_STREAM_FLAG_).+"; TcpSession *struct6; identifier struct_flags6 =~ "^(?!STREAMTCP_FLAG).+"; Packet *struct7; identifier struct_flags7 =~ "^(?!FLOW_PKT_).+"; position p1; @@ ( struct0->flags@p1 |= struct_flags0 | struct0->flags@p1 & struct_flags0 | struct0->flags@p1 &= ~struct_flags0 | struct1->flags@p1 |= struct_flags1 | struct1->flags@p1 & struct_flags1 | struct1->flags@p1 &= ~struct_flags1 | struct2->init_flags@p1 |= struct_flags2 | struct2->init_flags@p1 & struct_flags2 | struct2->init_flags@p1 &= ~struct_flags2 | struct3->flags@p1 |= struct_flags3 | struct3->flags@p1 & struct_flags3 | struct3->flags@p1 &= ~struct_flags3 | struct4->flags@p1 |= struct_flags4 | struct4->flags@p1 & struct_flags4 | struct4->flags@p1 &= ~struct_flags4 | struct5->flags@p1 |= struct_flags5 | struct5->flags@p1 & struct_flags5 | struct5->flags@p1 &= ~struct_flags5 | struct6->flags@p1 |= struct_flags6 | struct6->flags@p1 & struct_flags6 | struct6->flags@p1 &= ~struct_flags6 | struct7->flowflags@p1 |= struct_flags7 | struct7->flowflags@p1 & struct_flags7 | struct7->flowflags@p1 &= ~struct_flags7 ) @script:python@ p1 << flags.p1; @@ print "Invalid usage of flags field at %s:%s, flags value is incorrect (wrong family)." % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/sz3.cocci0000644000000000000000000000151213051004444014433 00000000000000// // Take size of pointed value, not pointer // // Target: Linux, Generic // Copyright: 2012 - LIP6/INRIA // License: Licensed under GPLv2 or any later version. // Author: Julia Lawall // URL: http://coccinelle.lip6.fr/ // URL: http://coccinellery.org/ // Modified by Eric Leblond for suricata test system @preuse@ expression *e; type T; identifier f; position p1; @@ f(..., sizeof(e@p1) ,...,(T)e,...) @ script:python @ p1 << preuse.p1; @@ print "Size of pointed value not pointer used at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) @postuse@ expression *e; type T; identifier f; position p1; @@ f(...,(T)e,..., sizeof(e@p1) ,...) @ script:python @ p1 << postuse.p1; @@ print "Size of pointed value not pointer used at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/size_t.cocci0000644000000000000000000000143513051004444015215 00000000000000@sizet@ size_t p; identifier func =~ "^(sprintf|printf|SCLog.*)$"; identifier funcn =~ "^.*nprintf$"; position p1; typedef uint16_t; typedef uint32_t; typedef uint64_t; expression E1, E2; @@ ( func(..., p, ...)@p1; | func(..., (int) p, ...)@p1; | func(..., (unsigned int) p, ...)@p1; | func(..., (uint16_t) p, ...)@p1; | func(..., (uint32_t) p, ...)@p1; | func(..., (uint64_t) p, ...)@p1; | funcn(E1, E2,..., p, ...)@p1; | funcn(E1, E2,..., (int) p, ...)@p1; | funcn(E1, E2,..., (unsigned int) p, ...)@p1; | funcn(E1, E2,..., (uint16_t) p, ...)@p1; | funcn(E1, E2,..., (uint32_t) p, ...)@p1; | funcn(E1, E2,..., (uint64_t) p, ...)@p1; ) @ script:python @ p1 << sizet.p1; @@ print "Invalid printf with size_t (not casted to uintmax_t) at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/Makefile.am0000644000000000000000000000100313051004444014741 00000000000000EXTRA_DIST= access-pkt-packet.cocci \ action-pkt.cocci \ banned-functions.cocci \ direct-packet.cocci \ malloc-error-check.cocci \ pktnotset-packet.cocci \ size_t.cocci \ struct-flags.cocci \ sz3.cocci \ run_check.sh struct-flags.py if HAVE_COCCINELLE struct-flags.cocci: $(srcdir)/struct-flags.py > $(top_builddir)/qa/coccinelle/struct-flags.cocci check: $(top_srcdir)/qa/coccinelle/run_check.sh distclean-local: -rm $(top_builddir)/qa/coccinelle/struct-flags.cocci endif suricata-3.2.1/qa/coccinelle/Makefile.in0000644000000000000000000003546613051004467015003 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = qa/coccinelle ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = access-pkt-packet.cocci \ action-pkt.cocci \ banned-functions.cocci \ direct-packet.cocci \ malloc-error-check.cocci \ pktnotset-packet.cocci \ size_t.cocci \ struct-flags.cocci \ sz3.cocci \ run_check.sh struct-flags.py all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu qa/coccinelle/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu qa/coccinelle/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile installdirs: install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." @HAVE_COCCINELLE_FALSE@distclean-local: clean: clean-am clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic distclean-local dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distclean-local distdir dvi dvi-am html \ html-am info info-am install install-am install-data \ install-data-am install-dvi install-dvi-am install-exec \ install-exec-am install-html install-html-am install-info \ install-info-am install-man install-pdf install-pdf-am \ install-ps install-ps-am install-strip installcheck \ installcheck-am installdirs maintainer-clean \ maintainer-clean-generic mostlyclean mostlyclean-generic \ mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \ uninstall-am .PRECIOUS: Makefile @HAVE_COCCINELLE_TRUE@struct-flags.cocci: @HAVE_COCCINELLE_TRUE@ $(srcdir)/struct-flags.py > $(top_builddir)/qa/coccinelle/struct-flags.cocci @HAVE_COCCINELLE_TRUE@check: @HAVE_COCCINELLE_TRUE@ $(top_srcdir)/qa/coccinelle/run_check.sh @HAVE_COCCINELLE_TRUE@distclean-local: @HAVE_COCCINELLE_TRUE@ -rm $(top_builddir)/qa/coccinelle/struct-flags.cocci # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/qa/coccinelle/run_check.sh0000755000000000000000000000210313051004444015207 00000000000000#!/bin/sh if [ $1 ]; then case $1 in *[ch]) LIST=$@; ;; *..*) LIST=$(git diff --pretty="format:" --name-only $1 | grep -E '[ch]$') PREFIX=$(git rev-parse --show-toplevel)/ ;; *) LIST=$(git show --pretty="format:" --name-only $1 | grep -E '[ch]$') PREFIX=$(git rev-parse --show-toplevel)/ ;; esac else LIST=$(git ls-tree -r --name-only --full-tree HEAD src/ | grep -E '*.c$') PREFIX=$(git rev-parse --show-toplevel)/ fi if [ -z "$CONCURRENCY_LEVEL" ]; then CONCURRENCY_LEVEL=1 echo "No concurrency" else echo "Using concurrency level $CONCURRENCY_LEVEL" fi for SMPL in $(git rev-parse --show-toplevel)/qa/coccinelle/*.cocci; do echo "Testing cocci file: $SMPL" if command -v parallel >/dev/null; then echo -n $LIST | parallel -d ' ' -j $CONCURRENCY_LEVEL spatch --very-quiet -sp_file $SMPL --undefined UNITTESTS $PREFIX{} || if [ -z "$NOT_TERMINAL" ]; then exit 1; fi else for FILE in $LIST ; do spatch --very-quiet -sp_file $SMPL --undefined UNITTESTS $PREFIX$FILE || if [ -z "$NOT_TERMINAL" ]; then exit 1; fi done fi done exit 0 suricata-3.2.1/qa/coccinelle/banned-functions.cocci0000644000000000000000000000044013051004444017150 00000000000000@banned@ identifier i; position p1; @@ \(strtok@i\|sprintf@i\|strcat@i\|strcpy@i\|strncpy@i\|strncat@i\|strndup@i\|strchrnul@i\)(...)@p1 @script:python@ p1 << banned.p1; i << banned.i; @@ print("Banned function '%s' used at %s:%s" % (i, p1[0].file, p1[0].line)) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/pktnotset-packet.cocci0000644000000000000000000000057313051004444017222 00000000000000@zeroed@ typedef Packet; typedef uint8_t; Packet *p; position p1; @@ memset(p@p1, 0, ...); @isset@ Packet *p; position zeroed.p1; @@ memset(p@p1, 0, ...); ... when != p ( p->pkt | PACKET_INITIALIZE(p) ) @script:python depends on !isset@ p1 << zeroed.p1; @@ print "Packet zeroed at %s:%s but pkt field is not set afterward." % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/access-pkt-packet.cocci0000644000000000000000000000133613051004444017222 00000000000000@init@ typedef Packet; Packet *p; expression E; statement S; @@ ( memset(p, ...); p->pkt = E; | p = SCCalloc(...); S p->pkt = E; ) @pktfield depends on !init@ identifier func !~ "^PacketCopyDataOffset$"; Packet *p; position p1; @@ func(...) { <... p->pkt@p1 ...> } @ script:python @ p1 << pktfield.p1; @@ print "Invalid Packet->pkt usage, GET_PKT_DATA macro must be used at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) @pktlenfield@ identifier func !~ "^PacketCopyDataOffset$"; Packet *p; position p1; @@ func(...) { <... p->pktlen@p1 ...> } @ script:python @ p1 << pktlenfield.p1; @@ print "Invalid Packet->pktlen usage, GET_PKT_LEN macro must be used at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/direct-packet.cocci0000644000000000000000000000037013051004444016434 00000000000000@directpacket@ identifier p; typedef Packet; position p1; @@ Packet p@p1; @ script:python @ p1 << directpacket.p1; @@ print "Invalid Packet definition, explicit allocation must be used at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/coccinelle/struct-flags.py0000755000000000000000000000240613051004444015710 00000000000000#!/usr/bin/env python import re from os import listdir SRC_DIR="../../src/" class Structure: def __init__(self, string): (self.struct, self.flags, self.values) = string.split(":") cmd = "grep -h coccinelle ../../src/*[ch] | sed -e 's/.*coccinelle: \(.*\) \*\//\1/'" struct_list = [] dirList = listdir(SRC_DIR) for fname in dirList: if re.search("\.[ch]$", fname): for line in open(SRC_DIR + fname): if "coccinelle:" in line: m = re.search("coccinelle: (.*) \*\/", line) struct = Structure(m.group(1)) struct_list.append(struct) header = "@flags@" body = [] i = 0 for struct in struct_list: header += """ %s *struct%d; identifier struct_flags%d =~ "^(?!%s).+";""" % ( struct.struct, i, i, struct.values) body.append(""" struct%d->%s@p1 |= struct_flags%d | struct%d->%s@p1 & struct_flags%d | struct%d->%s@p1 &= ~struct_flags%d """ % (i, struct.flags, i, i, struct.flags, i, i, struct.flags, i)) i+=1 print header print "position p1;" print "@@" print "" print "(" + "|".join(body) + ")" print "" print """@script:python@ p1 << flags.p1; @@ print "Invalid usage of flags field at %s:%s, flags value is incorrect (wrong family)." % (p1[0].file, p1[0].line) import sys sys.exit(1)""" suricata-3.2.1/qa/coccinelle/action-pkt.cocci0000644000000000000000000000033213051004444015764 00000000000000@action@ typedef Packet; Packet *p; position p1; @@ p->action@p1 @ script:python @ p1 << action.p1; @@ print "Invalid usage of p->action, please use macro at %s:%s" % (p1[0].file, p1[0].line) import sys sys.exit(1) suricata-3.2.1/qa/Makefile.am0000644000000000000000000000012513051004444012645 00000000000000SUBDIRS = coccinelle EXTRA_DIST = wirefuzz.pl sock_to_gzip_file.py drmemory.suppress suricata-3.2.1/qa/wirefuzz.pl0000755000000000000000000005722713051004444013055 00000000000000#!/usr/bin/perl -w #Author:William Metcalf #File:wirefuzz.pl #Copyright (C) 2010-2015 Open Information Security Foundation #You can copy, redistribute or modify this Program under the terms of #the GNU General Public License version 2 as published by the Free #Software Foundation. # #This program is distributed in the hope that it will be useful, #but WITHOUT ANY WARRANTY; without even the implied warranty of #MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #GNU General Public License for more details. # #You should have received a copy of the GNU General Public License #version 2 along with this program; if not, write to the Free Software #Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA #02110-1301, USA. #This script is useful if you want to fuzz and or otherwise try to make suricata explode during decoding/proto parsing using saved pcaps. #It is simply a reimplimentation of the technique described here, hence the name: #http://wiki.wireshark.org/FuzzTesting # #Options for getting thre required perl modules: #Ubuntu 9.10 #sudo apt-get install libdevel-gdb-perl libcapture-tiny-perl # #RedHatES/CentOS 5 #yum -y install cpanspec perl-Module-Build #cpanspec --packager OISF -v -s --follow Capture::Tiny #cpanspec --packager OISF -v -s --follow Devel::GDB #rpmbuild --rebuild *.src.rpm #rpm -ivh /usr/src/redhat/RPMS/noarch/perl-Devel-GDB*.rpm #rpm -ivh /usr/src/redhat/RPMS/noarch/perl-Capture-Tiny*.rpm # #Fedora Core 12 #yum -y install perl-Capture-Tiny perl-Devel-GDB # #Other debain based versions, try the Ubunutu instructions if this doesn't work try the following. #sudo apt-get install dh-make-perl #mkdir fuzzmodules && cd fuzzmodules #dh-make-perl --cpan Devel-GDB --build #dh-make-perl --cpan Capture-Tiny --build #sudo dpkg -i *.deb #TODO: Figure out a better way to deal with signal handling. #TODO: Try to determine flow/stream that caused segv by extracting from the bt and extract it from the pcap. #TODO: E-mail notification on segv? #TODO: Parse Valgrind output and alert on errors use strict; use warnings; use Capture::Tiny 'capture'; use List::Util 'shuffle'; use Devel::GDB; use File::Find; use Getopt::Long qw(:config no_ignore_case); use File::Basename; #globals my %config; my @tmpfiles; my @files; my $suricatabin; my $loopnum; my $loopnum_per_file = 0; my $rules; my $rules_exclusive = 0; my $logdir; my $configfile; my $editeratio; my $valgrindopt; my $shuffle; my $useltsuri; my $ltsuribin; my $core_dump; my $excluderegex; my %excludefuzz; my $timestamp; my $keeplogs; my $file_was_fuzzed = 0; Getopt::Long::Configure("prefix_pattern=(-|--)"); GetOptions( \%config, qw(n=s N=s r=s c=s e=s v=s p=s l=s s=s S=s x=s k y z=s h help) ); &parseopts(); #Parse the options sub parseopts { #display help if asked if ( $config{h} || $config{help} ) { &printhelp(); } #filemask of pcaps to read? if ( $config{r} ) { @tmpfiles = <$config{r}>; if(@tmpfiles eq 0){ print "parseopts: Pcap filemask was invalid we couldn't find any matching files\n"; exit(1); } else { #escapes for filenames foreach my $file (@tmpfiles) { $file =~ s/\(/\\(/g; $file =~ s/\)/\\)/g; $file =~ s/\&/\\&/g; } } } else { print "parseopts: Pcap filemask not specified or doesn't exist\n"; &printhelp(); } #filemask do we have a path to suricata bin? if ( $config{p} && -e $config{p} ) { $suricatabin = $config{p}; #do wrapper script detection lt-suricata won't be created until first run but .libs/suricata should exist. if ( -T $suricatabin ) { open my $in, '<', $suricatabin or die "Can't read old file: $!"; while (<$in>) { if ( $_ =~ m/suricata \- temporary wrapper script for \.libs\/suricata/ ) { print "parseopts: suricata bin file appears to be a wrapper script going to try to find the real bin for gdb.\n"; my $tmpdirname = dirname $suricatabin; my $tmpltsuriname = $tmpdirname . "/.libs/suricata"; if ( -e $tmpltsuriname && -B $tmpltsuriname ) { $ltsuribin = $tmpltsuriname; print "parseopts: telling gdb to use " . $ltsuribin . "\n"; $useltsuri = "yes"; } last; } } close $in; } elsif ( -B $suricatabin ) { print "parseopts: suricata bin file checks out\n"; } else { print "parseopts: suricata bin file is not a text or a bin exiting.\n"; exit(1); } } else { print "parseopts: Path to suricata bin not provided or doesn't exist\n"; &printhelp(); } if ( $config{n} && $config{N} ) { print "ERROR: can't mix -n and -N\n"; exit(1); } #number of times to loop if ( $config{n} ) { $loopnum = $config{n}; $loopnum_per_file = 1; print "parseopts: looping through the pcaps " . $loopnum . " times or until we have an error\n"; } else { $loopnum = "infinity"; } if ( $config{N} ) { $loopnum = $config{N}; print "parseopts: looping through the pcaps " . $loopnum . " times or until we have an error\n"; } else { $loopnum = "infinity"; } if ( $loopnum == "infinity") { print "parseopts: looping through the pcaps forever or until we have an error\n"; } #rules file do we have a path and does it exist if ( $config{s} && -e $config{s} ) { $rules = $config{s}; print "parseopts: telling suricata to use rules file " . $rules . "\n"; } else { print("parseopts: rules file not specified or doesn't exist\n"); } # exclusive rules file: do we have a path and does it exist if ( $config{S} && -e $config{S} ) { $rules = $config{S}; $rules_exclusive = 1; print "parseopts: telling suricata to use rules file exclusively " . $rules . "\n"; } else { print("parseopts: rules file not specified or doesn't exist\n"); } #log dir does it exist if ( $config{l} && -e $config{l} ) { $logdir = $config{l} . "/"; print "parseopts: using log dir " . $logdir . "\n"; } else { $logdir = "./"; } #config file do we have a path and does it exist if ( $config{c} && -e $config{c} ) { $configfile = $config{c}; print "parseopts: telling suricata to use the config file " . $configfile . "\n"; } else { print "parseopts: config file not specified or doesn't exist\n"; &printhelp(); } #% chance that a byte will be modified. if ( $config{e} ) { #valid range? my $tmperatio = $config{e} * 100; if ( $tmperatio <= 100 && $tmperatio >= 0 ) { $editeratio = $config{e}; print "parseopts: using error ratio " . $editeratio . "\n"; } else { print "parseopts: error ratio specified but outside of range. Valid range is 0.00-1.0\n"; exit(1); } } else { print("parseopts: not going to fuzz pcap(s)\n"); } #parse the valgrind opts if ( $config{v} ) { if ( $config{v} =~ /^(memcheck|drd|helgrind|callgrind)$/ ) { $valgrindopt = $config{v}; print "parseopts: using valgrind opt " . $valgrindopt . "\n"; } else { print "invalid valgrind opt " . $valgrindopt . "\n"; } } #shuffle the array if we are starting multiple fuzzers at once. GO-GO gadget shuffle if ( $config{y} ) { print "parseopts: going to shuffle the array\n"; $shuffle = "yes"; } #keep logs instead of removing them after each run if ( $config{k} ) { print "parseopts: going to keep logs instead of removing them\n"; $keeplogs = "yes"; } else { $keeplogs = "no"; } #we want to process some files but not fuzz them add them to a hash and check it later if ( $config{z} ) { print "will process but not fuzz files that match regex of " . $config{z} . "\n"; $excluderegex = $config{z}; my $tmpfilepos = 0; while ($tmpfilepos <= $#tmpfiles) { if ($tmpfiles[$tmpfilepos] =~ m/$excluderegex/) { print "adding " . $tmpfiles[$tmpfilepos] . " to fuzz_exclude_hash because it matches our regex\n"; $excludefuzz{$tmpfiles[$tmpfilepos]} = 1; } $tmpfilepos++ } } #maybe we want to exclude a file based on some regex so we can restart the fuzzer after an error #and not have to worry about hitting the same file. if ( $config{x} ) { print "excluding files that match regex of " . $config{x} . "\n"; $excluderegex = $config{x}; my $tmpfilepos = 0; while ($tmpfilepos <= $#tmpfiles) { if ($tmpfiles[$tmpfilepos] =~ m/$excluderegex/) { print "removing " . $tmpfiles[$tmpfilepos] . " because it matches our exclude regex\n"; splice(@tmpfiles, $tmpfilepos, 1); } else { $tmpfilepos++ } } } print "******************Initialization Complete**********************\n"; return; } sub printhelp { print " -h or help -r= -n=<(optional) number of iterations or if not specified will run until error> -N=<(optional) number of iterations of all files in the test set> -s=<(optional) path to ids rules file will be passed as -s to suricata> -S=<(optional) path to ids rules file will be passed as -S to suricata> -e=<(optional) editcap error ratio to introduce if not specified will not fuzz. Valid range for this is 0.00 - 1.0> -p= -l=<(optional) log dir for output if not specified will use current directory.> -v=<(optional) (memcheck|drd|helgrind|callgrind) will run the command through one of the specified valgrind tools.> -x=<(optional) regex for excluding certian files incase something blows up but we want to continue fuzzing .> -z=<(optional) regex for excluding certian files from fuzzing but still process them note: the original files will be processed and not removed.> -y -k Example usage: First thing to do is download and build suricata from git with -O0 so vars don't get optimized out. See the example below: git clone git://phalanx.openinfosecfoundation.org/oisf.git suricatafuzz1 && cd suricatafuzz1 && ./autogen.sh && CFLAGS=\"-g -O0\" ./configure && make Second thing to do is to edit suricata.yaml to fit your environment. Third go ahead and run the script. In the example below the script will loop forever until an error is encountered will behave in the following way. 1.-r Process all pcaps in subdirectories of /home/somepath/pcaps/ 2.-s Tell suricata to use the rules file /home/somepath/current-all.rules 3.-y Shuffle the array of pcaps this is useful if running multiple instances of this script. 4.-c Tell suricata to use the suricata.yaml in the current dir. 6.-e Tell editcap to introduce a 2% error ratio, i.e. there is a 2% chance that a byte will be fuzzed see http://wiki.wireshark.org/FuzzTesting for more info. 7.-p Use src/suricata as our suricata bin file. The script will determin if the argument passed is a bin file or a txt wrapper and will adjust accordingly. /usr/bin/wirefuzz.pl -r=/home/somepath/pcaps/*/* -s=/home/somepath/current-all.rules -y -c=suricata.yaml -e=0.02 -p src/suricata If an error is encountered a file named ERR.txt will be created in the log dir (current dir in this example) that will contain output from stderr,stdout, and gdb. Take a look at the opts make it work for you environtment and from the OISF QA team thanks for helping us make our meerkat fuzzier! ;-)\n"; exit; } my $logfile = $logdir . "wirefuzzlog.txt"; open( LOGFILE, ">>$logfile" ) || die( print "error: Could not open logfile! $logfile\n" ); my $successcnt = 0; while ( $successcnt < $loopnum ) { if ( defined $shuffle ) { @files = shuffle(@tmpfiles); } else { @files = @tmpfiles; } foreach my $file (@files) { my $file_was_fuzzed = 0; #split out the path from the filename my $filedir = dirname $file; my $filename = basename $file; my ( $fuzzedfile, $editcapcmd, $editcapout, $editcaperr, $editcapexit, $editcap_sys_signal, $editcap_sys_coredump ); my ( $fuzzedfiledir, $fuzzedfilename, $fullcmd, $out, $err, $exit, $suricata_sys_signal, $suricata_sys_coredump, $report); print "Going to work with file: $file\n"; my ( $sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $isdst ) = localtime(time); $timestamp = sprintf "%4d-%02d-%02d-%02d-%02d-%02d", $year + 1900, $mon + 1, $mday, $hour, $min, $sec; if ( defined $editeratio and !exists $excludefuzz{$file}) { $file_was_fuzzed = 1; $fuzzedfile = $logdir . $filename . "-fuzz-" . $timestamp; $editcapcmd = "editcap -E " . $editeratio . " " . $file . " " . $fuzzedfile; print( "editcap: " . $editcapcmd . "\n" ); ( $editcapout, $editcaperr ) = capture { system $editcapcmd; $editcapexit = $? >> 8; $editcap_sys_signal = $? & 127; $editcap_sys_coredump = $? & 128; }; if ( $editcapexit ne 0 ) { #this could still cause us to loop forever if all pcaps are bad but it's better than nothing. if ( @files < 2 ) { print "editcap: had an error and this was our only pcap:" . $editcaperr . "\n"; exit(1); } else { print "editcap: had an error going to the next pcap:" . $editcaperr . "\n"; next; } } elsif ( $editcap_sys_signal eq 2 ) { print "editcap: system() got a ctl+c we are bailing as well\n"; exit(1); } else { print("editcap: ran successfully\n"); print "******************Editcap Complete**********************\n"; } } else { $fuzzedfile = $file; } #split out the path from the filename $fuzzedfiledir = dirname $fuzzedfile; $fuzzedfilename = basename $fuzzedfile; $fullcmd = "ulimit -c unlimited; "; if ( defined $valgrindopt ) { if ( $valgrindopt eq "memcheck" ) { $fullcmd = $fullcmd . "valgrind -v --log-file=" . $logdir . $fuzzedfilename . $timestamp . "-memcheck-vg.log "; } elsif ( $valgrindopt eq "drd" ) { $fullcmd = $fullcmd . "valgrind --tool=drd --var-info=yes -v --log-file=" . $logdir . $fuzzedfilename . $timestamp . "-drd-vg.log "; } elsif ( $valgrindopt eq "helgrind" ) { $fullcmd = $fullcmd . "valgrind --tool=helgrind -v --log-file=" . $logdir . $fuzzedfilename . $timestamp . "-helgrind-vg.log "; } elsif ( $valgrindopt eq "callgrind" ) { $fullcmd = $fullcmd . "valgrind --tool=callgrind -v --callgrind-out-file=" . $logdir . $fuzzedfilename . $timestamp . "-callgrind-vg.log "; } } $fullcmd = $fullcmd . $suricatabin . " -c " . $configfile . " -r " . $fuzzedfile . " -l " . $logdir; if ( defined $rules ) { if ($rules_exclusive == 1) { $fullcmd = $fullcmd . " -S " . $rules; } else { $fullcmd = $fullcmd . " -s " . $rules; } } print "suricata: $fullcmd \n"; my $starttime = time(); ( $out, $err ) = capture { system $fullcmd; $exit = $? >> 8; $suricata_sys_signal = $? & 127; $suricata_sys_coredump = $? & 128; }; my $stoptime = time(); my $timetotal = $stoptime - $starttime; print LOGFILE $fullcmd . "," . $timetotal . "," . $exit . "," . $suricata_sys_signal . "," . $suricata_sys_coredump . "\n"; print "suricata: exit value $exit\n"; if ( $exit ne 0 ) { my $knownerr = 0; #fuzzer genrated some random link type we can't deal with if ( $err =~ /datalink type \d+ not \(yet\) supported in module PcapFile\./ ) { print "suricata: we matched a known error going to the next file\n"; $knownerr = 1; } if ( $knownerr eq 1 ) { if ($loopnum_per_file == 1) { $successcnt++; } print "suricata: we have run with success " . $successcnt . " times\n"; if( $keeplogs eq "yes" ) { &keep_logs($fuzzedfilename); $report = $logdir . $fuzzedfilename . "-OUT.txt"; &generate_report($report, $fullcmd, $out, $err, $exit, "none"); } &clean_logs($fuzzedfilename,$file_was_fuzzed); } else { my $report = $logdir . $fuzzedfilename . "-ERR.txt"; &process_core_dump(); if ($core_dump) { print "core dump \n $core_dump"; system( "mv " . $ENV{'PWD'} . "/core* " . $logdir . $fuzzedfilename . ".core" ); &generate_report($report, $fullcmd, $out, $err, $exit, $core_dump); }else{ &generate_report($report, $fullcmd, $out, $err, $exit, "none"); } exit(1); } } elsif ( $suricata_sys_signal eq 2 ) { print "suricata: system() got a ctl+c we are bailing as well\n"; if( $keeplogs eq "yes" ) { &keep_logs($fuzzedfilename); } &clean_logs($fuzzedfilename,$file_was_fuzzed); exit; } else { if ($loopnum_per_file == 1) { $successcnt++; } print "suricata: we have run with success " . $successcnt . " times\n"; print "******************Suricata Complete**********************\n"; if( $keeplogs eq "yes" ) { &keep_logs($fuzzedfilename); $report = $logdir . $fuzzedfilename . "-OUT.txt"; &generate_report($report, $fullcmd, $out, $err, $exit, "none"); } &clean_logs($fuzzedfilename,$file_was_fuzzed); print "******************Next Packet or Exit *******************\n"; } if ($successcnt >= $loopnum) { last; } } if ($loopnum_per_file == 0) { $successcnt++; } if ($successcnt >= $loopnum) { last; } } sub process_core_dump { my $gdbbin; my $gdb = new Devel::GDB(); my $coremask = $ENV{'PWD'} . "/core*"; my @coredumps = <${coremask}>; if (@coredumps eq 1 ) { my $corefile = $coredumps[0]; print "gdb: core dump found $corefile processesing with"; if ( $useltsuri eq "yes" ) { $gdbbin = $ltsuribin; } else { $gdbbin = $suricatabin; } print " the following bin file" . $gdbbin . "\n"; $core_dump .= join '', $gdb->get("file $gdbbin"), $gdb->get("core $corefile"), $gdb->get('info threads'), $gdb->get('thread apply all bt full'); print "gdb: core dump \n $core_dump"; } elsif ( @coredumps > 1 ) { print "gdb: multiple core dumps, please clear all core dumps and try the test again. We found:\n"; foreach my $corefile (@coredumps) { print $corefile . "\n"; } } else { print "gdb: no coredumps found returning.\n"; print @coredumps; print " $#coredumps" . "\n"; } print "******************GDB Complete**********************\n"; return; } sub clean_logs { my $deleteme = shift; my $file_was_fuzzed = shift; my $deletemerge = $logdir . $deleteme; my $rmcmd; if ( defined $editeratio and $file_was_fuzzed) { if ( unlink($deletemerge) == 1 ) { print "clean_logs: " . $deletemerge . " deleted successfully.\n"; } else { print "clean_logs: error " . $deletemerge . " was not deleted. You may have to delete the file manually.\n"; } } if ( defined $valgrindopt ) { #uncomment the following lines if you want to remove valgrind logs #$rmcmd = "rm -f " . $deletemerge . "*vg.log"; #print( "running " . $rmcmd . "\n" ); #system("$rmcmd"); } foreach my $file (glob "$logdir/unified2.* $logdir/*.log $logdir/*.json") { #print $file . "\n"; if (unlink($file) <= 0) { print "clean_logs: failed to delete log file $file\n"; } } return; } sub keep_logs { my $saveme = shift; unless(defined($editeratio) || $loopnum eq '1'){ my $saveme = $saveme . "-" . $timestamp; } my $savecmd; if (-e $logdir . "alert-debug.log"){ $savecmd = "mv -f " . $logdir . "alert-debug.log " . $logdir . $saveme . "-alert-debug.log"; system($savecmd); } if (-e $logdir . "fast.log"){ $savecmd = "mv -f " . $logdir . "fast.log " . $logdir . $saveme . "-fast.log"; system($savecmd); } if (-e $logdir . "http.log"){ $savecmd = "mv -f " . $logdir . "http.log " . $logdir . $saveme . "-http.log"; system($savecmd); } if (-e $logdir . "stats.log"){ $savecmd = "mv -f " . $logdir . "stats.log " . $logdir . $saveme . "-stats.log"; system($savecmd); } print "******************Log Move Complete**********************\n"; return; } sub generate_report { my ($report, $fullcmd, $stdout, $stderr, $exit, $coredump) = ($_[0], $_[1], $_[2], $_[3], $_[4], $_[5]); open( REPORT, ">$report" ) || ( print "Could not open report file! $report\n" ); print REPORT "COMMAND:$fullcmd\n"; print REPORT "EXITVAL:$exit\n"; print REPORT "STDERR:$stderr\n"; print REPORT "STDOUT:$stdout\n"; if($coredump ne "none"){ print REPORT "COREDUMP:$coredump\n"; } close(REPORT); } suricata-3.2.1/qa/Makefile.in0000644000000000000000000005063413051004467012675 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = qa ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ distdir am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = coccinelle EXTRA_DIST = wirefuzz.pl sock_to_gzip_file.py drmemory.suppress all: all-recursive .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu qa/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu qa/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done check-am: all-am check: check-recursive all-am: Makefile installdirs: installdirs-recursive installdirs-am: install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f Makefile distclean-am: clean-am distclean-generic distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: .MAKE: $(am__recursive_targets) install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \ check-am clean clean-generic clean-libtool cscopelist-am ctags \ ctags-am distclean distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags tags-am uninstall uninstall-am .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/qa/drmemory.suppress0000644000000000000000000000230213051004444014254 00000000000000UNADDRESSABLE ACCESS name=magic issue, not important libc.so.6!__strnlen_sse2 libc.so.6!_IO_vfprintf_internal libc.so.6!__GI___vasprintf_chk libc.so.6!__asprintf_chk libmagic.so.1!? libmagic.so.1!file_apprentice libmagic.so.1!magic_load suricata!main LEAK name=useless warning, likely DrMemory bug * libpcre.so.3!pcre_get_substring LEAK name=libmagic minor leak 1 libmagic.so.1!? libmagic.so.1!? libmagic.so.1!magic_load suricata!MagicInit LEAK name=libmagic minor leak 2 libmagic.so.1!? libmagic.so.1!magic_load suricata!MagicInit UNINITIALIZED READ name=Hyperscan false positives due to DrMemory limitations 1 ... libhs.so.*!hs_compile_ext_multi * UNINITIALIZED READ name=Hyperscan false positives due to DrMemory limitations 2 ... libhs.so.*!hs_compile * WARNING name=Prefetch warnings 1 ... libhs.so.*!hs_scan suricata!SCHSSearch ... suricata!main WARNING name=Prefetch warnings 2 ... libhs.so.*!hs_scan suricata!SCHSSearch ... libc.so.6!__clone WARNING name=Prefetch warnings 3 ... libhs.so.*!hs_scan suricata!HSScan ... suricata!main WARNING name=Prefetch warnings 4 ... libhs.so.*!hs_scan suricata!HSScan ... libc.so.6!__clone WARNING name=Prefetch warnings 5 ... libhs.so.*!hs_scan suricata!HSScan * suricata-3.2.1/doc/0000755000000000000000000000000013051004504011034 500000000000000suricata-3.2.1/doc/INSTALL.WINDOWS0000644000000000000000000001365013051004444013146 00000000000000Before you start ================ An up to date version of this document can be found online: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Windows Alternatively, an installation document for using CYGWIN instead of MinGW can be found here: https://redmine.openinfosecfoundation.org/attachments/download/676/SurWinInstallGuide.pdf This file describes how to build and run Suricata on Windows. Currently Windows XP and above are supported. Preparing the build environment =============================== 1. Setup MinGW environment from http://mingw.org Do not use the automatic installer as it is deprecated. Manually unpack the following packages to c:\mingw (use newer versions if you like): * binutils o binutils-2.20–1-mingw32-bin.tar.gz * mingw-runtime (dev and dll): o mingwrt-3.17-mingw32-dll.tar.gz o mingwrt-3.17-mingw32-dev.tar.gz * w32api o w32api-3.14-mingw32-dev.tar.gz * required runtime libraries for GCC (gmp, libiconv, MPFR and pthreads): o gmp-4.2.4-mingw32-dll.tar.gz o libiconv-1.13.1–1-mingw32-dll-2.tar.lzma o mpfr-2.4.1-mingw32-dll.tar.gz o pthreads-w32–2.8.0-mingw32-dll.tar.gz * gcc-core (bin and dll): o gcc-core-4.4.0-mingw32-bin.tar.gz o gcc-core-4.4.0-mingw32-dll.tar.gz * make o make-3.81–20090914-mingw32-bin.tar.gz * zlib o libz-1.2.3-1-mingw32-dll-1.tar.gz o libz-1.2.3-1-mingw32-dev.tar.gz 2. Install MSYS http://sourceforge.net/projects/mingw/files/ MSYS-1.0.11.exe (MSYS Base System) msysDTK-1.0.1.exe (MSYS Suplementary Tools) autoconf-2.63–1-msys-1.0.11-bin.tar.lzma automake-1.11–1-msys-1.0.11-bin.tar.lzma libtool-2.2.7a-1-msys-1.0.11-bin.tar.lzma MSYS will ask questions during the installation: Accept Post Install: [y] MinGW Installed? : [y] path to MinGW: [c:/MinGW] 3. Install pkg-config taken from http://wiki.videolan.org/Win32CompileMSYSNew#PKG-CONFIG Download and extract the following into c:\Msys\1.0 http://ftp.gnome.org/pub/GNOME/binaries/win32/glib/2.18/glib_2.18.2-1_win32.zip ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config_0.23-3_win32.zip ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config-dev_0.23-3_win32.zip Set PKG_CONFIG_PATH=/win32/lib/pkgconfig (e.g. by adding the Windows enviroment variable PKG_CONFIG_PATH in "Control Panel"->"System"->"Advanced System Settings"->"Environment Variables" and setting the value to /win32/lib/pkgconfig) 4. Get git Download portable GIT from this URL: http://code.google.com/p/msysgit/ - unpack to /msys/1.0 - don't forget to edit your ~/.gitconfig to at least give youreself a name :-) 5. Get libpcre http://www.pcre.org/ ./configure --enable-utf8 --disable-cpp --prefix=/mingw make make install 6. Get libyaml http://pyyaml.org/wiki/LibYAML It does not support mingw compilation. However it works in static mode: ./configure --prefix=/mingw CFLAGS="-DYAML_DECLARE_STATIC" make make install 7. Get libpcap Guide can be found here: - Download Devlopers pack http://www.winpcap.org/devel.htm - Download and install a coresponding installer package http://www.winpcap.org/install/default.htm (to have the driver in the system) - Copy includes to c:/mingw/include and libs (.a) to c:/mingw/lib - Rename libwpcap to libpcap 8. Get and compile Suricata git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf Because of some weird autools port bug we do the following: dos2unix.exe libhtp/configure.ac dos2unix.exe libhtp/htp.pc.in dos2unix.exe libhtp/Makefile.am ./autogen.sh ./configure CFLAGS="-DYAML_DECLARE_STATIC" # add --enable-nfqueue as parameter to configure to enable inline mode make If everything goes well, you'll end up with suricata.exe in src/.lib. To test it you will need libpcre-0.dll, libz-1.dll, and pthreadGC2.dll which you already have somewhere under c:/mingw or c:/msys. To prepare the runtime environment: - copy the executable and the DLLs to a dedicated directory - get there classification.config and suricata.yaml - edit suricata.yaml (at least set the directories correctly) PCAP Mode ========= Make sure you have winpcap runtime and driver installed and then: - determine your eth device UUID in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ - now cross your fingers and do: suricata.exe -c suricata.yaml -i \DEVICE\{your device uuid} Inline Mode =========== You need to downoad, compile and install netfilterforwin (the netfilter.sys driver and Windows port of the libnetfilter_queue library): 1. Download and install Windows Driver Kit from Microsoft http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=36a2630f-5d56-43b5-b996-7633f2ec14ff 2. Download netfilterforwin http://sourceforge.net/projects/netfilterforwin/ Unpack it so the netfilterforwin directory (omit the version from its name) is beside the oisf directory. 3. Compile the driver - Open the build environment from you Start menu: Start->All Programs->windows Driver Kits->WDK xxxx.yyyy.z->Build Environments ->Windows Server 2003->x86 Free Build Environment (or the one which is proper for your system) - cd to netfilterforwin/netfilter - enter command: nmake 4. Install the driver - copy inf/* files and the freshly built netfilter.sys to a separate directory - open network connecions - right-click an interface, select properties - click install... - select service - click add - click 'have disk...' - browse to the directory with the inf files and netfilter.sys, select netfilter.inf anc click ok - confirm everything You should have the driver installed now. 5. Run Suricata in inline mode: suricata.exe -c suricata.yaml -q 0 suricata-3.2.1/doc/Installation_from_GIT_with_PCRE-JIT.txt0000644000000000000000000000604413051004444020203 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PCRE-JIT Installation from GIT with PCRE-JIT In this guide will be explained how to install and use the most recent code of Suricata on Ubuntu together with PCRE with JIT 8.20-RC1 support. The goal of PCRE-JIT is to improve the pcre pattern matching performance of the pcre library. The easiest way to see performance difference is to create a couple of pcre only rules or use for example the SSN rules from ET, and compare the performance statistics for rules. Installing from GIT on other operating systems is basically the same, except that some commands are Ubuntu-specific (like sudo and apt-get). In case you are using another operating system, you should replace those commands by your operating-specific commands. Pre-installation requirements Before you can build Suricata with PCRE-JIT for your system, run the following command to ensure that you have everything you need for the installation. sudo apt-get -y install build-essential autoconf automake \ libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev \ zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make g++ sudo apt-get install git-core Depending on the current status of your system, it may take a while to complete this process. PCRE with JIT support Enter the following commands for PCRE JIT installation: wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/Testing/pcre-8.20- RC1.tar.gz tar -xzvf pcre-8.20-RC1.tar.gz cd pcre-8.20-RC1 ./configure --enable-jit Make sure you see that JIT compiling support is enabled, see example: make sudo make install HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter: sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0 Suricata First, it is convenient to create a directory for Suricata. Name it 'suricata' for example. Open the terminal and enter: mkdir suricata Followed by: cd suricata Next, enter the following line in the terminal: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf Followed by: ./autogen.sh Compile and install To configure, please enter: ./configure --enable-pcre-jit \ --with-libpcre-includes=/usr/local/include \ --with-libpcre-libraries=/usr/local/lib After entering the previous, make sure that your screen looks like the following example and you have PCRE with JIT support: make sudo make install sudo ldconfig To check the build information you can enter: suricata --build-info Please continue with Basic_Setup. In case you have already made a map for the most recent code, downloaded the code into that map, and want to download recent code again, please enter: cd suricata/oisf next, enter: git pull After that, you start again at running autogen. suricata-3.2.1/doc/INSTALL0000644000000000000000000000077013051004444012014 00000000000000About ===== Suricata is a multi-threaded intrusion detection/prevention engine. engine available from the Open Information Security Foundation (http://www.openinfosecfoundation.org). Suricata and the HTP library are licensed under the GPLv2. A copy of this license is available in this tarball, or at: http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt Up to date installation guides are available online, at: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation suricata-3.2.1/doc/AUTHORS0000644000000000000000000000017313051004444012030 00000000000000Team: http://suricata-ids.org/about/team/ All contributors: https://www.ohloh.net/p/suricata-engine/contributors/summary suricata-3.2.1/doc/userguide/0000755000000000000000000000000013051004530013027 500000000000000suricata-3.2.1/doc/userguide/rules/0000755000000000000000000000000013051004444014165 500000000000000suricata-3.2.1/doc/userguide/rules/modbus-keyword.rst0000644000000000000000000000761513051004444017623 00000000000000Modbus Keyword ============== The modbus keyword can be used for matching on various properties of Modbus requests. There are two ways of using this keyword: * matching on functions properties with the setting "function"; * matching on directly on data access with the setting "access". With the setting **function**, you can match on: * an action based on a function code field and a sub-function code when applicable; * one of three categories of Modbus functions; * public functions that are publicly defined (setting "public") * user-defined functions (setting "user") * reserved functions that are dedicated to proprietary extensions of Modbus (keyword "reserved") * one of the two sub-groups of public functions: * assigned functions whose definition is already given in the Modbus specification (keyword "assigned"); * unassigned functions, which are reserved for future use (keyword "unassigned"). Syntax:: modbus: function modbus: function , subfunction modbus: function [!] Sign '!' is negation Examples:: modbus: function 21 # Write File record function modbus: function 4, subfunction 4 # Force Listen Only Mode (Diagnostics) function modbus: function assigned # defined by Modbus Application Protocol Specification V1.1b3 modbus: function public # validated by the Modbus.org community modbus: function user # internal use and not supported by the specification modbus: function reserved # used by some companies for legacy products and not available for public use modbus: function !reserved # every function but reserved function With the **access** setting, you can match on: * a type of data access (read or write); * one of primary tables access (Discretes Input, Coils, Input Registers and Holding Registers); * a range of addresses access; * a written value. Syntax:: modbus: access modbus: access modbus: access , address modbus: access , address , value With __ setting matches on the address or value as it is being accessed or written as follows:: address 100 # exactly address 100 address 100<>200 # greater than address 100 and smaller than address 200 address >100 # greater than address 100 address <100 # smaller than address 100 Examples:: modbus: access read # Read access modbus: access write # Write access modbus: access read input # Read access to Discretes Input table modbus: access write coils # Write access to Coils table modbus: access read discretes, address <100 # Read access at address smaller than 100 of Discretes Input table modbus: access write holding, address 500, value >200 # Write value greather than 200 at address 500 of Holding Registers table (cf. http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf) **Note:** Address of read and write are starting at 1. So if your system is using a start at 0, you need to add 1 the address values. **Note:** According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it is recommended to keep the TCP connection opened with a remote device and not to open and close it for each MODBUS/TCP transaction. In that case, it is important to set the depth of the stream reassembling as unlimited (stream.reassembly.depth: 0) (cf. http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf) Paper and presentation (in french) on Modbus support are available : http://www.ssi.gouv.fr/agence/publication/detection-dintrusion-dans-les-systemes-industriels-suricata-et-le-cas-modbus/ suricata-3.2.1/doc/userguide/rules/dns-keywords/0000755000000000000000000000000013051004444016616 500000000000000suricata-3.2.1/doc/userguide/rules/dns-keywords/dns_query.png0000644000000000000000000001555613051004444021271 00000000000000‰PNG  IHDRREqnxbKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ  :ÈPoûIDATxÚí]ytUÕõþÞéñ2¼$$aL0‰@Â&!1•T  µ€ muµBE—ü(*¬em—Še’-È\"kE° "(ÐLHB  !óôöïí}CÞ}cB8ßZw%÷¾sï9wŸs¾³÷>ûœ« "‚€€€€€ËP "D* ˆT@@@@©€€€€€ RA¤‚H‘ "Dê ÄêVA¤-„B¡5( ˆTàÞjñrZ½å5‚Pþî‘öìÙ7nÜRîÀZ¼œVoyM…X±bêêêÚ´|®æQXXˆÀÀ@ìÛ·»víBPPJKKÛ½­¶´÷#.]º„îÝ»ãîÝ»‚\)O‡&Ò7n ¢¢B°W'Ák¯½†«W¯vÈ<pûöm”——£´´ÅÅÅNùÐ[«­¶´÷#>úè#øùùÁÛÛ»Cpƒ+妽€€€€@`` t:T*t:Ý[ŽöB}}=¶oߎyóæuˆ9‹{UžV#Ò 6 ::]ºtÁøñãeµŠÈÈHäååaéÒ¥ …F£A\\.]ºd–.++ S¦LApp0¼¼¼Ð·o_¼þú먮®v©LZ­&L@II ÂÃÃQXXhH†›7oZÜÛ§O‹ëÿùÏðØcA§Ó¡_¿~Xºt)ÌžõÍ7ß !!îîî¬Y³ýúõCSS“Ùó €ŒŒ À”)S0lØ0³gZÃÁƒ1zôhhµZDDDàOúÍÒœ?O=õ‚‚‚н{w¤¤¤àÇtºN’““ ²ÿþP(HIIqX.-ÍcêÔ©:t¨M¹xyyA£Ñ þþþ€RÉÍ»¤¤ .DDD4 1iÒ$\¹rÅì555xõÕWÑ£Gx{{#..ÇwJö¶Ê!W¿¸~ý:-Z„ž={ÂÛÛ±±±†6áL[kŽÖ“#rnŽôôt”••aÖ¬Y†kí)oGÊãL¿rÔ Øºu+©ÕjZºt)¥¥¥ÑË/¿LÑÑѤV«)33ÓÅÇÇSLL ­^½š¶mÛFƒ¦Aƒ‘^¯'"¢ÆÆFêÕ«M›6¶mÛFÿú׿護Þ"úÅ/~ár™.\H‰‰‰À¢L¦çÖ®§§§“J¥¢… ÒñãÇéÿø…„„ÐŒ3ÌŒ¤éÓ§Sjj*íß¿ŸˆˆvïÞMèË/¿4Ëãƒ> ¥RIׯ_'"¢¨¨(òõõ¥ÊÊJ›ïvðàAR©TôÊ+¯ÐÁƒé½÷Þ3œK8yò$¹¹¹Ñ³Ï>K{öì¡={öPrr2iµZºzõªSu’M‡&´yóf:|ø0]¾|Ù)¹´$èèhòññ±+—÷ߟÊÊʨ°°V¯^MDDuuu4hÐ R(ôÇ?þ‘:D©©©GãÆ3+ãÈ‘#éÑG¥-[¶ÐÞ½{iúôé¤R©èÛo¿uJörå°V¿(66–âãã ùΘ1ƒT*9sÆ©|­µ?GëÉQ9›"))‰&Mšd8¿ò¶UgúUKÐ*DÚ·o_Z¾|¹Ùµ×_]–´üqª©©1\»xñ" ’’""ÊËË#”——gö¼Ý»wÓ’%KZT¦7ÞxÃ%"mjj¢¨¨(š={¶Yš£G:}ú´ážgŸ}Ö@jjjH§ÓÑóÏ?ov=&&†&L˜`8¯¬¬¤²²2»ï6tèPZ¶l™‰ 6Ìp>fÌz饗ÌÒèõzJJJ¢¹sç:U'ÖdåŒ\\̓ˆ¨ªªŠJKK]j›•••4cÆ Ú°aƒÙõ3gΧ§§Y¾ ÔØØh&¯©S§RJJŠS²·U–æõ €ÆŽk‘ï3Ïù„"""œªk²rF.®æÑZ(//§½{÷ÒÊ•+iÑ¢E4yòd25ÈÐ?ÿùO‹û>ýôS sXöNw@€8 ›ohh¨SùZkŽÖ“³X¾|9Q}}}‡·­ò´5Ô-u ‚ƒƒÍ®wïÞ]6}HHˆÙ¹J¥2wÚ*•ÈÈÈÀ_ÿúW:tùË_P__ÄÄD¬\¹?üp«—IÆÝav.ù{÷»ßɆ ùùù΃‚‚dŸùüóÏcíÚµøì³Ï’’‚;w¢k×®˜8q¢Sò¾uë [·n6ÓèõzôîÝ[6ì$??ß©:±gäâj­ôôtÌœ9aaa=z4‚‚‚dÛQhh¨Åµnݺdîˆì]\=¹š¯\ûs¦žœp "55³gφ››Û=—·­ò´ ZÊÄÕÕÕ²£Fvv¶ËþÈæšKFF%''ÓðáÃ[T¦¬¬,Ù2]¼xÑÂD0MwáÂ@'Ož´«X{½^Oƒ ¢©S§’^¯§ˆˆzíµ×\–·©ŸÓTV’ŸJ¥RQvv¶EšPß¾}]ª“æ×Z*—öÐHëêêÈ××—Ö¬YcvýüùóÒ¾}ûdåé°ì]ÑHåòMKK3XŽækMvŽÖ“38qâ„lß¹Wò¶VžöB‹gí½¼¼?þØìú¦M›\z^ii)zõê…‚‚ƒæÅ‹#;;Û©2íܹÓn™••e8×ëõXºt©Å̶ŸŸöíÛgv½¬¬ Ó§OÇÑ£Gí–I¡Pà׿þ5:„S§Náòå˘7ožYš¦¦&»1‡^^^2d¶oßnv}åÊ•@}}=ÜÝÝñÈ#àÃ?´µ×¯_„„„– ¼­*G,‚êêj—ƒÚ Q^^n6‹KDíV­Ze6,Ék̘1ËÞ¬Õ¯\¾7nlµ|­'gä¼eËŒ5 ÑÑÑBÞÖÊãh¿ê³öÛ·o'•JEo¾ù&¥¥¥Ñ‚ hðàÁ.i¤z½žFŽIƒ ¢+VÐþýûé­·Þ¢ÈÈHš9s¦ÓeZ¶l¥¥¥Ñüùó)**ŠÜÝÝÍÊðË_þ’zôèAëÖ­£M›6Ñøñã)&&Æ"ÝÆI©TÒË/¿L_|ñmß¾FŒA¾¾¾†Óž6U\\Lnnn4fÌŠµø}øðá4bÄ‹É9?§J¥¢E‹Qzz:­ZµŠ<<üÐüº^Om¨¬Ø¬ß{Ý]A||<Íš5ë¾)O{ô+5Úsb»ví¬Y³ Õj-~OJJÂÚµk… ZOà … vRW®óæ*°s'°e   áç´m„ÎP¿—/_ƱcÇpäÈ‘û¦<í!÷û’Hí­¡¥vØ$B¯×£²V}–——£  iii8{ö¬Å$˜„'NÀÓÓS`ë5sb|äiö8u ˆŠ>øŠ^<< Ðë™pÛhvëÖ/omØÞëÛwíÚ…°°0Œ;¶CT±#åi—~õ Yxýû÷§¢¢"ë “ÏkjÒ۽緿ý-uéÒ…ÂÂÂdƒÚÁ¬'"zî9¢n݈”J"ww"€¤$¢£G‰Lýœíaë¯À»uë–¯¢·˜4Ñ·“k‚ˆ(??_6¬Žª«Ùm²oÑíÛí&?«åig(ˆÄ–½f éÿee@a!ЯŸYZÖ ~ÖLÓ tLèõ€R ¤§ëׇ¦›XÓ¦/¾ bVÏè0_b ÀÐÊšk¤¦¿ÝlÜȲ€¡C… I“??ü\P£L;á—-‘6#SCÇ),öì>û øßÿ€§žœ;›iúNÞ@:eÝÞ¾ ìÝ ,_üô“yº^½€ñãØXö§ŠºuÐI¨f—‰äÑh€¸8`Ù2`ôè8( "m»Ž¦PUUÀ»ïrGËÉ1OãéÉÚÊìÙÀo~˜.EûY35k(¢vŒ:5%RéšBÁÖÆïìÚ%Rð·¿½{‹º´‡/¾`-ôòeîÒ–—Àœ9À@ö{5D¦‚H›w¼²2`âDžŒ0%ÈæððfÎ^}•Í—=äµÑï-6?¯®f-ô«¯€wÞaËCnoK©îüýÿ>\ÈÕž¦_\ ¼ý6°mÐü3~~¬áÏ „‡^^‚H;}øz8xØ·øúkû÷  $&#FÏpâŸü¼›…æéæ„…±+GzÞ’%¬]Iu'êÉ~=H8~xáÀd üô»L: ‘Ê59Ó¼¶–}§_|\¿Î$ÛÔÄ3Á¶´›„à•WØôˆ`ÇYR°”Ë^BSO –•±æ¹b…õAÏ͸¦&ž\òô xÊÓ“MÏ?ÿ™5'QŽYUUL o¿ œ<É×Õj–uMy¿zè!àÛoNô-+A¤Ž4œæöË/¹!= \¸TT°ïÍž(˜n@ ¬©T€·7û\­ùž¢•{?kïzçkœµµ\×®7n;vp§m®qªÕê¤Ñ0Jh¿~ÀÀ¬==ñשRÉõ´jз¯ÐFmµÉª*–ûÁƒ¬õò‰‘@}}9]ÿþÀ£²?ZÂâÅL¸nn´àGc€µ˜ü|àüy #ÈÍeb­­åßÝݹˉ¸gOÖR5`Ô(žÌÐh€  `ÀKb•Ë¿³‘«µ÷¸v—wVU±yþùçÀÍ›@y9›ãr“E:“mUOlhµìj‰Œä°œÈH&J†óõõåÑÝã·m3þ&HÔR›OOŽ3šðlèt¼Š,1HNæ~k´6là‰ÚN$[±Ö¾%&M÷î| ÌšÅæþ÷ßsÃIOç/A£amIº7?ŸɧäéÉ#¹NÇKCBØçÎa8áá–Ήv‚µW¹ëÒùgŸ±yXTÄš~VûÔêëy`j®ušN’lËÊxPš1ƒ;qïÞFŸu—.æ÷íÙÃÏV(€ÐP¶Ôê“Dm¹Pòò€÷Þ㉻œÈ Öì³²€ÊJ LNf"õóc‹ëÿþïW*ybö¡‡:Ø‘:¬»+äš“èéÉæbXÿöÜsLùùÀêÕ—JÄš¦·7wtéóÌÜ%³ÕôSÖj55{zò½!!ÜѧOÆ“ïèÎ’¨#Äë,9ÛK+ùÕ>ý”µšÓ§Yˬ«ãëµµö]%*•Ñ=’›Ë²îÞ'Š^|‘ S«µ®ÝKå8rÄèO-*b_¶Zý`hó9…‚gß—,aEÁ4¬ià@6í³²€ùóÙ¯ìåÅš§és¤Ïn×Õ±¢ õ‘ÎD´oesÔVNM °v-O†±)ÙØȤZUÅ÷H“WÎVK×®ìzüq >žã›—›“Š©¯PšpôJz½Q#ll4šÏuu¬-šN¼)ü{Fæ?ð„Ž3P*¾´†&ÇÐP„$¿gŸ>ª4c†c¾½æuöôÓìßS*¹“ïßo\&ú µ] EELš{÷²/ÓtPW«y°R«¹ÍÌœ ¼ñ†õçææcDz•L ¬\ÉõÖ‰´}¡‘¶–¦*§¹6?÷ò-â.^þû_n´ÅÅ㘗ǚYE…q¢¤©‰ É4iÄ—ò).æãØ1Ûå â™ê®]Y3öñaÿ VkŸ¼%-2?ßøI û0 íÇf6Vów¸nnL’õõ¬‰s'ìÞµE__&Ïøxó…Ö6kuß}Ç“LË")‰µ¦ÎdÖ7F1•?`”õ¬==Ê‚ŽM//¬‡ FŽ´¸ä¢]fbV«¹GŽ4_(ˆTÀa‚µÖ¹ àCºVXÈÚi}=›øß|Ãd{ý:Ÿ—–²É«×s㯨°ž·JÅéš“[Qm •Š;Œ››ÑÇV_oÔf‰˜¸ÜÝåÕhX“ö÷g²89xyño|ØÒ6›»ì‘aCsa!Ë80 û~ŸÄkîŠiþ.·oó;Ÿ;ÇqÒeeì÷¬­5ºBüüÌÝIsæ°¯¹OKù[“õõëLÂJ%·ß°0®s[± R§´ÖæDÂÚ—„G5wøÿôkO99¬}JååÜHKK¹ƒ”—³/Kn6Û´ ’ßU2ó‰Œ~[9›ˆŸoºk’5H¾`ÓÍ,t:Ö8CB¸Ci4ÜY{öäô!CØt7õ×™ÊÊV(˜3äiŠQ£€¿ÿý¤¹¹<"iL…D¥w)(`m³¨ˆWw>mLçãÃuSWÇõ6`“g|<0y2וi iYk_¥¥ÀÙ³FK#:š*[Ä+|¤mæ¿rd眺:&Ð’nÀ’ßR¯gÍU"×òrÖ¼JJX ¹s‡'Å$ÿ¦´¹±µÁ@Ò.ˆøÿ’#±ÊíK0|8ûѺvåA¢wo&Nƾ?³­5krmã ž[µMÈ•¿¾žë¶¡5ÂÝ»ùov6»LMûà`n+ [cÇr”ÃÀæ³ë®ìtöý÷¼óSM ¢óçøƒ9™ Ó^ ]´X[ ØôÜÃýŸAAö;£ä“‰ššŒ\öfíU*£Û ¢‚?Ùqék7×®ýܪÔFm83X³†Íç¸8.ñž•ÍgoÛ{¥—½HŒŽFœÍgÔM‘™ÉGu5Ë÷óÏYó¼{—#BÜÝ…¸¹±%л7kžQQ;ëïÏ®Óe±Íý©Îh’>>LÌW¯ò̾Zm$ÑNZ&4Òû]cµG~mmB1!ggó$Ô‘#ÀæͬùJ&Ú%¹<=ÙÏÖ§w¶ñãyW [Dbï¼5:f{í/k«îÝŠ1'‡¿9•“Ãäyå Ë_Ú¾`Rôõe—PSkO<Á]»rl²4o+òÄUYèõlååq˜Tß¾¼¢Æç "}ÐÜmõL©IîòràÍ7y­Û·{ ܹcù,IËU*yVþ¹ç€ ˜p]5ÏÛúý[:Ð9ç»kï¨ôÃÆ…æ&¾JÅ減›ò••L”ÉÉ\AA,cÉ×iêólm9YsC´õÀ.ˆT Óuóóêjþ¼Ç‘#Lªwï²_® À˜ÖÚĘRÉîiK…‚ÍT­–‰A"h)?¥ÒÛ‘äCdtŸ˜:ÅÅìg®®6úŸÏœaâ¸Þ½™tMý}¦Ä¬R±9ëî·¤¥Ù#á¦&cdƒ¤yKþæ¦&K_³QqëÇçå'~Çï¿ç·ª*ù<%ߦ$K˸Z&ÏQ£,bˆ½‘ t2r•ëÔ••¬‘ÕÖ²Ézêû[‹Šø·«W1ž¦Z«»»Q3«®6ÆËJ»iùøðïR„©ÆªVsšÀ@&dµÚ¸ÚËÝ]~Õ kÒR,lm-ee쬨0'R uuœ¾ºÚè+V©¬‡™iµÆUC:ûƒƒ9d,*Š‰\ýýù=í¹:™ "è¤djÍ i}’)œ—ÇÑ%%ÆUU_ÍšlAuB’HÉÃɳ±ÑH€r¾:Gf¥M»Šé7 Î§K&a) ]Ú7 ²Ò<öV¡`ïÙ“5j)$ÌÃßG­æÉ ˆž“Ö®›ú7­•Kl.ˆT@¬CDp÷.k€55Æ`"ö7Þ¸ÁZlNŽqéje¥y|¬^o$lS Ò‘%®’ù/’[Á44‰ˆµa??&Äž=yhÄ&MµšISÚÞOZécK>¶^@©€€Ã®€–hY¦$WSÃD\[kt H.[ÏW©˜%"T*™åv˜r¥œŽ„C "hur½ß46keŸšD* pÏ ¶­Ò·æs;y R—¡"D* ˆT@@@@©€€€€ RA¤‚H‘ "D* ˆT@@@à~ÃÿàØ4kkšyIEND®B`‚suricata-3.2.1/doc/userguide/rules/pcre/0000755000000000000000000000000013051004444015116 500000000000000suricata-3.2.1/doc/userguide/rules/pcre/pcre3.png0000644000000000000000000005132413051004444016565 00000000000000‰PNG  IHDR õ™`¶þsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ *cõÌ IDATxÚìw\G×ÇÏìÞBGE±÷® ‚tbï=ök4&ö®‰ÆÞ{ï½÷®1ö^D¤ Òn¿»{Þ?.( (ÍóñÝÎÛiCsâ¿ìÚ­"2ƨ-ˆOÃò’°˜Øøv}nØq µñ_…^§ÑŸ\ºx5ñõcÌ®xù’5}¨ˆÿ*tšô7¯/R;ùæà‚ #‚ #‚ #ˆ¯„çùÒŠ?ñ12jâ vëÖ­yóæ½W4Dôòòòòò¢¦!HàˆÿyŒFA­VgõÝbbb¨Y¢AGAGAGAGAGAG A A A A A A A$pA$pA$pAßÚÑ7'¼Y6Õ—DŸ‘W0ž£‘1P˜ƒ CD–ù=È͈`4‚ÂDŠäÀŽŒ™L‡E#ˆBÖ íŒ)Ì@2‚Q€Ì|Aar% !Pdw‚ ûñ̈€µA.çÀ¨NRqrî¿®Zisà•ìêØÚÏ’ŠvYqÚ ‘I »6(Ýõ«[y†ÀxYâ®>eûœªçb¶­}@åyO²çÀÃÎ.šòH…$HʸÔî:¿RY“È!2õãÍÛϵ«ó[‡Á-L"&ç_oéÔ\gSHƃ IfÅ WiÒ ÿÏJ@F"G$p_0h—+Êt_ÑÔ¿ªˆÀ"ÏN;=»UÙ%§ÍeLxy(Äèáç|áä«–å$ΡñvmšT¹ÞN+ cõªOtq-R<¯0ãXõÐGïÝÑÆwL§áÛ­- Â˳óÏÎm¦˜}µŒ-“˲Ê6˜u{-eh’8Ž™Ïœ+U c u{Ãð=Ó»ÎüÏôò‚Èåv¦&øIÐõ èÁ ƒ¢îCeJuºZ<<¿|È¡jãR?¥ž'Jˆ6îÃ]«¤œ[»ç™˜pü~ˆ¡é]À˜{ü:ÆAÂ_3õ6n;uRrhÔ òešŒ ¨gyeÞ< ùô›î›ÕëÞ¥ ÄÝ Ód…Šzô`ÔoSÖwìNû´#×/¾a@±ò‚«Œ Ɉ’B&“qoCÿ¼[!¨­YQ_¹•f`ŒIz¬Ós¶æöŠç±)'gN/?pGK.¯¹1&ƒ¨‹W,\Ìœ˜cL Xã >!ˆÈ{yb‡¹[³B êölºþÉä÷åȇ1£Ñº„‹Sʳã Q ‚îˤMÐ z`ÐjÞ‰íic%O:» ©x—jŽòB~v—7ŸÀ˜dY»É€v×g¦X5ð¬QX’òÌ–¡>]Í[·Ëv€— ‘) äÎ¥ î]¬+fšs©*Cî † T2Šj’7‚ø4—‹ÅùýÈU3à¶eÚlhäV‹ãáöÍ»VbÁ“ó† –ðzVš¦™C€ÂN]Í {«œÁ}Ro”v!4, Ý fY4A Œç8&>[b)\žzú² É._ kX-ד:-ÂÜÜM¢*AÀ}‘çØlFßZ" ȧŸ üg-°=H×ç÷}ò"»v ã>ãN¡ŽÛ<Ú?ƒu݃ˆŒ1@ää,êøBV¤Ÿ\Æ®¼P¢ñ(w €êÊá…ãÕ ÙÈsŽÒ‹—7BËjGúF4DýB…CI’¥ u`O7­’ù -[²xbå +W XÿÎÁ›×¸¼'ùx3P˜gþ§”ÐÞe„ñùÁE³Ò Li ¹¼gôŸOøf#{ðQÙ«•C™ÅÊ(ZÖ¶BwKË„7¯cMÂÉ›Ü æ ¼½}tR?¨=Ü¥†9 A÷:•(ˆYœ1vçi°Û(Q0yk€SÍ7º¼ûµbY[@4jÓÅlbƒ‚!ý¯ŸkßȘBC(ÕeÀô±‚Á®Ùüó·vü~ddM‘([M;c§Ä˜ÝCRlº—r”£éÍ 9×jögö®19HÓ/t½Ê@4¼uùò¾#´n‡FzŽ >CÌÝ ˆKè7iy«AÓþßI¾9€ŒïµSZ€ Ó›q™ÃD¦°I‚À@i ¢)#"(­ ›w'^‹Œ1Ó/äJ` A4€ ãÍA† ×}Ð,D` PÊA§Î–J èA’þŸþ’A§QíØ¢a€Ö1{õêÕ;tè@÷3AÜç<8-dù}c À Éðå ËQ£é 0¨³¥b,ãH¶‡ cçK`Ôæ<.éÀÙ~×Å€ôƼr#[Äg 98‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ #‚ #‚ #‚ #‚ #‚ #‚Ž ‚Ž ‚Ž ‚Ž ‚î» 7(S‚Löù¨ñˆÈ+@&üªè/È@a_™Ø´oº Ê¯Ï HàþÿèC4nêY=AÍÎL¨xêpðgwgrvcëáí÷¾nqÙ»ó:éÙ3H~zZŸäŒgÑ×Ì8Š´9AÀ}N047‹V­¡ño/[UEŽ7I p<0ˆh Óc:Â1à•Ör™^TÆ™"0d¦bÀñ5Ê2¹™¥Ëž¿L)Þ[7S+ˈ­Åq`JÈñ‘ Çeø›œÜJa&'Ó ÜçI¹¸¤@³ž .̨{þD(§ [ÕßG“|ïø¤†ºŸÙ„ñŒ1fLy|dŒÏú}¯ž»ŒË+†ê×ÇŽñ_?ÐýðŠE:‰1IshˆÛŸ"8Ž1ž…íí¹cÆt.‡·Å8ýÛûF{­ï_ïêÅ»¼»üKhÄÃ<.†hć£VLÛ{mÞÖ!n›Æô~§_·e˜ç¶)£Òôäµ \¾¨€ú[çcëÖ)‰¼Üœãpr9/Þ8ålï5—¥ëcoÜJc¾IƒŠö<ÐkÉ%—¢wÝM6 •˜°ïÀ¼?|ÆžîµüFòÉ{g âä-çm _×11¥ˆý®[Ožœ#N#o|}~ç£Ö¿_éµdkÌþ>a!Ÿ‰Û™ZÙ|éu¿Jæ¼¥µ2fiªCßnKoxŽ TúOí¶ð¯j WŽì“‘õ‚.úÆ$]b<*ì­s„‹—û÷lÉ1@TÚU(¦Ž~¥OznT˜;W°gŒ™×ìW©cÒ³õ‹¬Ûm)ZX)S@ù aÊðGZ`Š*-œNmß~uãl—ËÌÌïOÄB~Czã˜Y%‹BVê”$Æ8`œ)„ þå+Dë 8eñbÖJ`Pªd‘”ÄFÖ#ˆOBqQßAw uWÈr !y ˜b¢2ŽDQÏXÆ0@ ÌìmT€B\¦î¾þ°IïP©QqP²Ú·Xm7Þ;Æ¡ßuì È9°”[YrÀ$Œ1@)Ç hVXÆ€Ç3fcª @Z9%¸üÂCÌ©Í¥Ûžd¹ ^³|B&3GÐ c „t 80ÎÚ±ã±$àx4(HL}cö;…·Uøö'/~¨\ÊŒ"6 Qÿñªñí½GrçªÖð™·ß$¥M%Q¯IR/–v?ÛgÉT?A’h¬JyÜØyMåÄÆ%ô›´¼Õ iÿ?8Žñ<FdŒ!"/c€ J “ƒh4½ã†œŒ1QDÆ'Æ@8`&åa LÇQIDÆËA2‚„È2‹N‚ 0&“ƒh@0*g(‚$!ãÏŠ "Èx¦A/ãy…ÌÏ ÏxâGkÿbtÕÞ‰-øg±V¯^½C‡t?9 98ÈP&Q0-\cL2 €hÌø€¡çHﻌƒ™^؇Á‡ä 2‹@Ì<(3sgÌ”–1ˆRf„ÌÜD!#[2s@ y=‚ !*A$pA$pA$pA$pA$pA$pAÀAÀAÀAÀAÀAÀAÀAGAGAGAGAGAG A A AÄ?KžqQñmLÄËÇ·>bÀs<5ÙW€€vçcÃYÁ–|‚:Àñ¿$IrŽRí¾w•rk)År‹oàÀ‘Àñxj€À1†ˆÀ˜é°‘3¬™ùÖê( D ɲ–²³­d àok÷ý.2.é‹SeO$©ÓU Õ*•AÌø SëŒ(4*­1? ¢Z¥¥¯™³DɨR©Q2ªÒÕbzµZkü¸Ð>|ógŸ®Rãw2¡©º_eÁ©P2ªT*ITé*A0hÔZcŽS>úw¢á½Eò2©Q¯Öè„<,‚ÿ%1u`ÐjTAÊ÷ñÝnXµjµJ¥Ò„o^(dÓgΫ1`"ˆL@-è¦=îkÂDÞ•>VíF—ÝмXWà¾MñßGà‰º¤†M'û¢Tš'G:Û’=Qd[¯=oÔüíx­1ú­£Ï±$ödK×&ÃÏå¯+©›7kò(^û—’¾¿IãvÚø#õÝZ¿–r?çÊú=&žÏiQÆ®Nj~WŒ±„ƒãgn¿ÅØ·nç¤{®þíÓ¿O—gŒ oóCÒZP2¦6 ¯ÏžJL:ÕدyJâ…úu›?C¸»½W‡Ñ's$4¼}Þ¨íR>æ•“_î ì¨;X¿^›ˆ<,r~u·ÞS/~|EÇ7{ eŒ±ø½¿ÌÙ{ïÛ[äíͺþÔù;÷ž¾M‡€!]ý·_‰Ëµ=µ¡çZ÷_ûíë™SúˆêÁÔoÜaPïö~ÞÞÛï§3øƲªgÚ`íy“…‘ 2‰×ÊÒþx6H,ˆÈ C‘1e66,Ô]FdÀ€}OÃOXÄŸ®ˆ¹¨<"ÞðL«GEnÏdDÀ\Ÿ Â_¿àyYö'y™‘#”r°Z7Û«T‚îæ©w®­ŠBí~‡®­mšëƒ³×Ÿqï{~ÂÏÊ’ßÿcSºeQY(ÖÎݹ|>Öa¹·Þ¾óï”– .\£03ËÕ?Á<”ÙÀ<<£ÂnÏÉRqütæ¹1WšÊ‰}úJg™ë9ˆyY‚ÕZTfó>·*k[œ+Ò¸y@e{Τ5í¦e O %ƱÜl”½bvåZæìÁ±£Kò6ü'/ãc‹\HVšœ¹¥03ÿöqð ¹sÌêSÉ¡¹€ÝéàøQ¹ b£B9N–‡1ó°]¾n^Ó1üpë™üPQÿʵÛöž:4³Ó“&c®â¸s,T¼/n¹ˆ"ˆÈ€ƒ%aSu¶ÉJÁ6Ⱦû˜2 x‰ç!ûvŠ.Ë˖̘úó þ×^§Û IÊ’õWlù£„ ^ž?lÖN«ÒÕ“_†Ù¹wݼ`ˆ2-¤Zý zT=e‹1÷Ÿ¤WØrx¹CbXÿa¿1½Ø§÷ ikW…m›6kãÙ¢¥K¿Žö4wN_W¶úŸkòu‘–w”_¸òÓ‚Aú+cVŸÐè­†Œ ^º`ÆÞ¾ f[ö½¿´£ÑÖÃ×L<Q±~€€E>æX¿žàÁÚƒnüxc}P÷æuœ½ºÜUÌ<ýÒ³´{÷øØqÀØÊ1]¶^‰«X¾¨ÞÚ)óIÏ.mž>sÃSe¼Îý£Ÿë½M£ûVÞ?8 .Mo71&è⪾òLá2j›Oi ž=ÛD_ÝZÿ×!×O°ì}J4$vih´…ǨûN[öcãꧦu¿ \B¿²ààHyØA ð®éÛm\ëªW Bì£Bµû•øØ Œ±7Û:5>Ú.xwGÀ¨‹Z-¾{T{f€Ï.Ïwë 5;·È¿¢ï¸»÷ÏØÀ[¿j.¿hTQ™íˆ8ÛõÇ™q`+¥&Ôj0péŒ>°næÐ-gŸ–.]4òE¬{©sûKw§Vža9¤òó™CÔýK²ò]6-:uÐ`µYòÀ>ºÎ^ÓÄÞ0}XÿSÁïʆ7IüˆÙëÚ¸ØGìïÒþLÇ:ÆvÅìîÝøË­ýÄé]ªô<…Þ½NZ¹Z{tNÛ5CÎmCCbÃ1Ó @rå ^Å"D1½{³¦:s><*­û¸Åƒkêû])¼ãû÷‹œ·vé´n®ŠòÝc“¢m4¡¡*û…]K.½¢ßÜ{mírÓDI“ØjÚ,3)ÞoÀ°B‘ç×5˜|ôŵÃ9ç tñK>0ûÈÊ‹.#/˜<’bÛ—Ùþ‚ ¬¤ê,,7ÿöœ¬à m%`(“ø=)«S‘*¼lû˜µ8I&1#CÅ·ôX1n®ìÖ°× Óç9ƒ‚†/=I]kûž5‡·q™¶íªÂ길ÿ´ÿµéè„NÓ÷D"¢êñúãQ ÙîäÒú¹õ¯<œïD«qÓ´: 7¥ _׫f絈xnÍ ®#¶˜¦D¿zlú,Iÿ"âÜ!Í GćÚù :…ˆý:´·ÉtÆ•É üF^BÄ´K¿Wó蓈ˆˆïî¬öñò¸£Cv8ÕiœQ™× <œoG©q~oÿÑ®»Ô J0HïËËV0¢„hP%‡¾ÎÑVçWvðkÐ6 _lù©jËY¦b]¼ïgh>g÷]DÄôðºnžý¶†˜.0`Öé¼Lðfgçîû2*u©ºg;¢æ¯‘nu¼ï¾•nÕtož†ˆh|ñ<8]/~H,!"ná5ûà3DD1>ÈÍíD¬AuyZ-Ï> ¦S’î»»{=W øtŽSu—“á""¢:ÂÝË;JeÄ´ujtJCDÄç;ôj;ÅÔÑç—ÔnÜ_@Œ9ÙÏÓÕ?Έˆ¨¹»µZ@ Qÿ|I=ß_MUЦ&<™½Fˆˆ76vöõk/!"†ï_µÙDD ¿0% ÕlÓ ã4j?z¥)îžþcŽ#"¢ª·KµÍ‘˜Ó"éï‚_„çhº“KÚù5ꘂˆˆ!†Tký""¾mììóHDDœÒ;hÁ¡‡ˆˆia.®w†™Îè?dîù¼,¾­«KÏCˆ8[ͳ“Qõçðz.>ß!"bܵêî­Tˆ(_<V}d‘.õ–y…ˆˆÉÝê9ûô;‚ˆýÛ¹oº÷æüzσ3Î<=nîDükÛðvýך®˜5n×ÓÝ7ÎßyÜ_éˆØ¿s@›±M'\ÒÀwäEDÙÖgú®‡ˆˆ˜ÔÂÝíÈ­þîâÚÝ£DDñíwµÕ‰Ñ!᱈i=œÝ6G3ëªåSyþD”R"_„ť㷠Bû|ìë6*1E¼žzô—WmyÙöpÜz”PB %IÊrï}ò¢êlä>´ŸI]y|ñÐÆáÁ”%Šš¼]ÎÇÅýá³?ä̇µ(c:Z „æ]<è " d8µûª§«YtÈóçÏŸ¿ÒUµ´= €Ærµ[šR•t))&ÄFQM5°u,[Á±À{Oþ½Gõà~‚wýÒÙgv ͼMY•ª[Rˆ —.ž}Q¶©!@°­Ù™ç€;»çªg]óŒÊh«Z8£æ-z¸í×)CFõY³¯°<Ëð)KÁ¦ÿË- T©Xæãyï‚U:Û`…ze¥¤·z0À¨G$…ÌU&ÿ©MyÓðÀÉÙ'2ò¯/œ¬e+ßêö9žq² •«X)¸ì£æÈWQiõýª"²"ÇoÞlZT¾wóíŠÝ{6MƒØUvaÏs50Ðð­_š@àÍAb)F F`h0ìX}½RÛ–¡ÏŸ?þÜPʹhä£Kj©DG{ yq{1==-Óîz0³)\¹\É\Æñ(Y–ïlªCi—Òâ»$€Á(J‹’ÁÕÕXq€Ž=¼À²L!ãÛ!§E¬ V©Púc‹©ÖÉ+y”ã `4 €Q f±2åO­ËfX¤–çëˆ_:ãl°ö¯R0‡d*W±Ìi‘W‰ Zײ¦{eD»¬ïya¡Re¥W—í?÷,,R,Ùø·Ñ-À(Hˆ¢Éùqü”ª~`ï®»vƒ5÷æE²©­‚|Þw~16 &äõ»ú k!¢Ý‘ë7[”0Û»ö²c£Ã«çÏŸ‡%É+;®‹BŽ•JõÈ,äïM$SÊÀ ˜mÉ å¬¾É2rà$ƒd–|øÝ IYUéÖÜ¡;‚ôÞGfðçózMħ–9[óYîqÐêTr™%@ÆBHA ³´$0Œ“ƒi8—‰ÁDµ`¹6vâ#S×åŠ6H3 ó÷©Ãü´ÄìyZ¨]]Ëœ_ð¼üCÀ[•±@Aó I`c €%ªCÈ_c'>άŒc!Ó2¬]í^²%7N;™Cæµ|Y7³ÎrÓ}rªœ1댡 ˜+:cÊw›"ùz»GJÑ æ S2ŽÅ¥£½Yf=y+)&Ùrs>ó.ü¨òÆ8µ,zÿœ)G3¾)X«Lj(Mï*1€/\Œ0·Î¬—ë°"‹AÁLÎ ÿ‹¬¹ZäÓ•ã8›L‹X˜)´Fí—[Ä!_Rõ‚¥¹Â4…–Öú!ó õ¯ž[?mÒ¬±ëcÃ#Ô7íîèZ2Ëø‡7kü¢°ÇO}[—+`þV.½áÞ·•,£­@€­ÑÂB™Íîñ*Iqh|È錞_¾lºZÌR3E¥›&B1Ó¤¦&Q%+g/C€o&7 x£Bb\²r z;C¥ ²ÞÅÇ $1Sø> )yÙŲFQáyh T²C`‚V¥–äm쵺`ˆÀXTrJQ›jð¹w/*µU ܹp˜é•eI”Ç}®·"`Æ-cJõ¾þ\sįã°ü\X ;eü»TS!’¨A ¤ŠE-øjMv.ž£2çW- )¿´EtóQGÏ.lÁ2 ÍVºiŠ8ó8|õD(J±z,e )%¹€¹}ÞJ I¦bõjËs¥$Û#àC­¸â¶æªÄd‰Y0` IM‘,l«;Ê.E&g\èCSxbÊÏÕج¦£(õ\º¶UDd $ 9b|fîrmï}‡á³¥|½E$1FŽr`oSR š—ü¤EDS±:µÖ´&ò¹®œÅ"2{ EZš˜9coîÇ䨳©4c逗[\šö >šå)óøQ´nÕžÙ•-1Ãá4Ìk  xAKUB¢Ä,3ì.šÛÖ(®8S¥ËÎ ­MEä8–Å4ÍÜåkN½V¹*"°´û÷µ¥'–ùPû¿oD´2³–R¤KñÇRQ%ph¹ß%QdCfZPù.ä5Då[hûtñ =Û·Ùü]w‹:¹ÛFEλ‘Œ¼>zúšo`{Ècžcœ´U IDATñrÐ%rîý;J§7ïÖ1Æ@Œoèó*ÏÄÉŒÚd“Ó~ýÔÑ›¯³4+À¦‡ÑMœkåçAÞ¨KüáÝwTÀî®ûÙ(ºõí€g¶ìʨLB‹@ÿ‘é€aÃ~Ú8~É’:×[ܘ³/,1}çô¢­'r•1Mü˽GβüX›1†R’‘c¼JŸá04Ž»Çä?r²’k›¼2°«VCzLÀœ<°ÕBù‰wztÇöí‰M³»:…jW,³zÃn` Sž4iõ\-ÆtKÝ9ë^20Æ’žœ|mnÖ£’EîÍÉË9Cš€o?þ‡à}“E`Œ½ýk}ÝÀÁÈÓîL—hºü”ˆÇûN^ÉçÁx9j¹/í挩c_ì=z>ŸáPL2pŒO×é3|=4Œ³Ô§Nœ­æÚòáCŽiƒ#ûvZ(ó®/jîÛ¯³ŸP²hIû}G¯cbâéWYz¾âêÖ‰ÎÏÐ:Á *mÍ/´ïäöJ]R²È{|pñK«ÔXU®Ò*mjׯÛŒAú«F-Ÿ¨ÅÆ¿ôTíþýB”È“RC4jüZ-0Æ‚o8¼þ=nßà*d VL_R®IóRŒaø•#ÇîÅ|‹eM¦P(™ab0ãÕm õw•â8.ÃëünïÁpy­¾4Q¯NÏÒ\ié(åÒÍ2í´‹[@”´štiP–¦Ï%hUiz1gnIÏ®L_º!ç Z§Ris²bûÕåãòÚÇÃúµ<1g@ƒ>³@Á#o±tU× ?—Ú¾–­gOéZ!/‹XÖþ¹·¿¾¡—wóýJöxc²ˆ&M¥Ï|…DH3Y„¥.˜=5,IÌñfƪU‹Ósvqï=÷êº)µÓRR@£NÓëu>Ý'u«ïëîêá^/hê£ ÇVÚÔõï¢ÞZÏ·•Jpœõk÷_Ú¹û4ûË¢ÅÚÙ?Elé:þJ²N“­ó§© 0aõæÆüŸuë¸ 6o‹{A9 Ú»uêúþõÜݺ̷d[9+9¼8±mÂò½`UÒw×ÂᣃêÕvr -ÖnÃœM/’üµlêüÃ/¾Éœe %3ƒBLauí˜~Ó0üžïùåµú e_Í$)Ë:؇5F)ëç÷kŽŸ\ ‘$)Ë™YNΖ꣬²¦Á\ÊÊ‘U®uøø`Ö|²|›Ç…H¢nL›yä=e®^×ÝÿNúD•ð“m—åC¶&Øطխį0¢ôÁˆ¦†Í-íG•”rXMÊÅ‚Ÿ¨Ã‡F–>ezÌnO)ÇjlfBí/íº~½ER_ÔqokÄon‘µ?4»ÿî£ÓóÎ!—ΉRþkñ‰ÎŸÇÍ+aîÿCe$DÄà;ž|“MÁ¨ý92è—ˆQÆpñŸAö‰Ö'þ̾Æøþ3ûÄɹf•5UÎW?sœüþ“) c¹†OÖàãÃç“{é™^Wî=5ëÔJö ä¯ @à3ÆG¢öáãPÈ1ÖA4/R¹’£yž-ž³¹EÉwhB_aÄ,Dzµ`3±|¥Ê½“äU‡¼²ÜzËý­jÆ q/kôžôõ1F)s4ƒLÔ<|üâc‹X:T®P,ÿ Á¨Z?žjÏó.Ê¥sæ{äöéÎÏ>g—¼î wåúØ ®_µòöÑ<ª å+k¹Mq¾˜Ä€C€ïü  Û)Š"Uz·ø;ímîåénÆe¹Éu±Ë׬7WdŸ+„BÞc&w*•ï|ù>?4üj‘¢Õhö7Òó^žnʬÑD-[½>猧$ñ;¡}Éü[ºßÿ‚æ-êÛû[yÉÜß®¹«]s¼„À± þ ¿ÿy ‚øÿŽé7X˜áT#ûG<88‚ þµÐ–åAÀAÀAÀAÀAÀAÀAGAGñu`.¢iOÈ¿ý• ˆÿ$ P’$ÆDyy’ÀëÊxýý ÌɃ#â?êÁ! ã@RÈ÷¢Ž$o›ÜÁøM~ªJAÿAuC`À4|òÅäã7bN€uº¦€­šSÙ¢ AÿJfrȲl!‚¢Ï¦Jq«"'« ]°–DV ˆJ+Gåßß„ŽŽ ˆDßH¢ˆÏ2ÆLA‚Dx†Oö¾Y(‚^¯̵²z6õ”èh†–ßdøï4‡DúËSeOÕ«AÐÁhMÿVíöFhÄ‹ü°<ŸÙ­šÒiÞÞ°¯ª~pçÍn&ÆviÜæ\ÞQýFhôn\^—ð~ªo¾Õ½Ú\ Nù'{gÊ«Cí;ôÖÇoÕ¨ÇS˜]lÛöÝ4 íÛîôã·ù°c¼ØR¿ó,Ó‰ºW‡÷îÜ®]û1lQg^þܹ°SûvíÛ·í5tòË´™JÏW´™|æÈÊ_GÏÛ5¿§›§·c ¡ûµuÛöí2hÛ¶Ýà±¼Ö €þv‡&­_¿{Ö®A»[:ŸÈ!/²÷‘%#eÙsÝý-±3Ng—,èç²ËšÙ÷1Kàà›,£rßGÞ˜1ý•›÷h×,‚ °¸+[ô_—=‘MåŠvPzºÚ$àËNÜ8Ÿ¦½‹KQ¿ÊöÅle:®€SUkcÞWø6N= »÷G÷ßöÜc c[»¸ÝR}ÈïûãÏÕŠ[|«<³>‘rÇ̦´—$š—SŠ:‰¼‹|òN]ÔŒƒ· qšáöÌŽóŽ<Î×…Ócâ’ öÞz¿Ž¿Ôí0xܸ1oøW3vù·vãN‰S¦õWÙ7éëɵiÔ>‚1@€ƒKOzúWHOLHLɤÍþ..É´“âbËtþyú´©S§N:uRýb‰íü›>ÓðE­D½NV´¼£\`$>ÿÄE‹Ñ;#'šzš8…( †›bg0Q¦7ˆ]m‡·vèaÍ9 CSèo²&÷‰{IHx²yÕÒEË7<ŠÕ¼¿þ<¾{ñ¢E+7îŽR‰Ú„…ËÖ¨÷®_:Á² c@H‰š¿h‰‚\L{vaï‚ 7î9mDH|áçŒI·—®X'!<9´iå‰G6…¬˜q¾ƸQˆi‘·Ghb,ß Ú½néüË.=‹ÏÌX³Ëê… —߉•ä܇kypñðÒÅ‹VmÜ«–àí³c+WíGÓE o–þ¾8D“õò 3ëbNvæŽrµ«-¦¯[º02Eü¸•äf²»'¶-\´t÷©Ûsríâ+ !î_ìòƒí³v‡+®\´÷yê¡-KžD§_ܳnþ‚ÅûÎÝÿ +!ÆÜœ³êp¦öHV/}¨‡Äs×Õ¾}°hé â³Ç÷ß©éô깇åŒÁøììêWŸœß³pÁ‚{Î2Ë2Ä>Ú´rÉâŸ&èTóWlÔ¡Ë—.ŒW àmèµË-Y¶öÖ«4S«Eþubé®3 7wH,èknSIr¬]œvy£cÛ¡¦–›ÉnÛºpÑÒ½gî@ÔñUKþz÷ìâžõG¯‚>náò I›W,\¸b}X¢NL{³~Ù‚¥«¶Æ‹Yï°lÄoÓOÿäëâRwÔÒΩ§w=KÛ²/jâòÑÕª•‘Y9øt:»O7‘F†À@Ú’P¿j9?3.*T¶jõ5kÖ¬Y³fí#fw´›¶ã5ÈJªmª—µ±+`i^[ ‚6~Åòe)z‰Dè»’(FKÏ@ÆôQúˆÍ‘s•ÌÊLk1¶Üb'kITðp ~ÃBó8–q©^£±`[X–8$Èÿð“Æ Ë6˜}øAéJUÌ“¶ô º›Ä@LÛ¶mÛðîƒÍ*yxU·œÖ¥Ù‘HàÌl«C”¬j»¸TjG·n¸þFL•ªãþÚQ¯õ8•ÄàÙí£K~›²;̬¿Çý3¬þËÚ±B±¢™ya§ÚµÀÛwBŒÍ~^TÅr=×T´”I±mØw@HÙºuÛˆC­«xzV5›Ü¡é©(` žÐÂ{ïýäÊUÊšÔóB¤©ûK&¶½þ¢cù*Š¤­µ~¦†Â¼/îœsà…š1¶gƘ+ÚB•³ºD¨ýeÁ<[Ô×µÚÀpçæõÔo&;5ï—ýÏô%ìe;¦ œt)Ù¦B^!Ù;–«U®”C¥êj‘•«éTµ°ÕùSûÇú˜/ï_¯ò‘Ùý9žWéí£ »/¾ÿëàÞíÑÉнںmË„QKììí9ÆŽìßþú­Ãî^ MÈ¡ôÍ£ckLÚ*ó÷ó|qlNç »c)a§Ý›yËÛââú7ò;’Æ·[¶nûµ÷T‹…ä<rä ¾3%ûò% ¦tòÝœÊÒ¢Bo>~ ³8´o43¦¯Z3F Û¿õåÝÊô·ŸŽ„Kâ¶Nê?íÏ4› .LŽ…KT¨U¾$S¶lÝ2¼Ïä²n‰uêûÓÄI ªx5°{w.0pâûªK³®¾\T(S÷5ƒÌº€wmnÍÜ=©‘q28Þ»¤  þEœºj¥b_쮊J39H꥛f™Iš^3YHFõÍ›·ômmý]'áÀFfɉæFD@I¶]½€“3”Øàj¿ÛËJ!CÆÈ$öMò ·µ«ŸKÇea¦Ða—·,˜¿ÿOmÈY'¿–†Ì@g ~n5töT‡Õqñ>þ.#ÆØìÁ¾ã×=FĤ»s=üÇê#w«Ù~úûl;4ð>ø$7MkÖuÄ S*í•_ª6ùCB<¹r`—a?KÍpcjåƳÓžÕvö9šQîÔþÞÓ·§¿¸\×?HŸ‘\ø±~õ ƒuÑ÷\|ª3sØ:½ý€iGÑuȵn—„W‡½ÜºDçñ.·8wYèÞÖoÂÞÛ¦ÏÖ¶ñé}PBß#pÁÁ{ˆˆ†¸@ï[é"éê÷óÚ3¦ Òƒ—z¸vWåQœáÁšJþ#2K66oPïjhF¬VÍû’6£’íëx˜ô¾69r:½°eÓöc2"û©ÎºV x¸©—SÕᦓϮ³øè-L½[³¶×þ¤ŒT}×Øt#ÍôYsgº‹ÿ$]^aô$ĸkudDêëØÒwÊ‘‡¦ÏwV¶ªßÿˆ„8ºSãe'#"¦=wªã{UmŠ÷À¿j#Ñ(I¨O óöòx«E|º¬’ßÏRÖ`„ú´Z4µEm|ŸÎmëÕqªÛ ÓºƒãS5¦ËM86°ñ̈¸iZÏžÖe­Ý½¥#ÜûÎ5]GŸzîãŽ=Œ 7ñúäÚ .>­"ŒÙÛ,ktD$¾#o´/Æ„·LQ•áã'…uÿ²k¸ôEIÊ"Qú¦Ÿ»/ºŽ*c>øöé rqmvrS¸V€jEˉ¾òÊšV º2¥\²MÛþù ÑÖ:æ—Ñ"êŒpåUbëêE@mk›R)­Í9A“Í1eù¿'3¯aeª ð ¹(“ßEZ˜ÛÊ‘1|ÉJÕÀ’ß¾P2㤟G›¡%Eê“ì4—o9Õou³ŽÓÆ®9í˜ç;Ó9âÜes·„êŽ^„¹5Ôyú’±¼cySòÂuy~—Æ–Ê/x‰–¥œÍrDÌË£V(š•®ŸQoËêŽæq/“´—bÝñ¥M'7ì÷kCH¹‡r;Sš°˜wŠ Û§?Þ‹€B²\‘bEn&`ðôöíÒå¼Þ7B­bE2¡ 3ª?2“²¼0 íÊÆ€q öq<Ʀ· jZºíôcƒ) ¯ß¹àUÓîk\²jzê¼óçý ëV>´¸J~ÚíúÂÑwyÀ Ú4ÛŠ-N]:dÏ0›±ó HH|k8IίfšgÚ{Ì)¸&ò^¥±&p˜=Í·´C^Çxéý–)H"Ëúû0 !?ë<…ë4™3±»A|Ÿõ7sAY‹·IÇ8E¡³~“½Ž3Îä»Þye”Éd¯ÞÄ‚³ý·©ÀçNEįšb`ÿ5É$DÆ8’ÉŽ˜5€f¦%8Q/õš8׫À‡¯\žg¦w.¨Ñéx–Ž‘¥ùY®Ïˆü6Ùý]’Ý'ñ† |Ñz‹çý¾~søMö=‘}­@Î+ôF}Vû'«…¥üý\ã9»Ç¹€×§—·›ËšûÄ£Œø®#TPHæ“"ÓïJÝÇK WK?ßBÍ%0r’üû=[òšƒ³jXGvmï]Ó¢ØÕÕ3-Ú]¾Tù”äwz†ÈžD‡V)Z%ï ÁŒŽäãìr÷5ð ¹\®P(^>yÅ8îs …Þ±È÷ÌJíJhµ©FÆ"€úEp*€dW¸²V—jP*L5HMˆÑs2Hº4í ÖëÊ¥-fôÿ3![A˜Ë2ãç—³œcÒÀ÷÷6§xjúB~Q€ªy¹or¥ :!ã-Èt£^üÜšêGµb¼6ülFÅßÞ|c(UÙά¾“ìúþ&«\XO­ œ¸0úà1sV¬]0eÜʣ͚ñå½r[÷µïÈ‘%“‡í¼g9tPä±ô¤°+ Ú;kV®ÀÆ¿6“]h7dÒÞLܾïØXuž7­µ¥Ã›°³›6o1;?kèóÏ°/xÜ¢U…º~Š7]Žß¶së}ÒKDEÑê“lÝqÀ¦Ý6,œÚ¦U×s/4búëNcOmÞ9Q¦¬rcQB¿q Ú= ï‚ªÝ”h1þ—»Ÿ»rͼ‰6œkÕ(ÄlÙŽÒ}Õ¸îs×íܳye·¦M–œ`vÍï4fY6 èîVö“®Xa^qrÿö.ü‹ÍxpÊ°_÷>5=!ä%êŽñæ¶è5éuøÕYOß•8jlPÈÞú’0Ä’-†v×5hÐaÜ䳦ŽíÖÌó•}›_z{åÔdÆ¡÷ô¥¯ÿ\y0*‡GÉ i/»vé§ɳûž0/ãPx½F‘Ú¿ô4x|ÆÛ ß­éù©S§æÚÕ6¥ûuðMŽ5šýqêlï²VˆœsÓnUl Ññ6e\fÎçh†À€“[º8×2ÅgŒ+U¡VYG+…mÕ6¨”ÕjÖmÝ£{1HNH)XÞu΢‰E” €1Æ+[³bI[“Îò6eëÖ*]ºjm[Ðéù‚Nµª •²xÅÚå ç©Él˸Ö*œÂÊ¥N-¥)’,ãÊTª]º¨]ãîÝ-4‰)*l9b²oi ‡ÒU˳®âßÑÅQÏÙ”1m–W)‹¨{§ 8÷iä䈎Î~…“ƒíKÙ‚åNµä|Žö–ï]Wªq¯6ÙžÇU­î\ÄÖäŒq–Eª8Uqð ¨ËÔé|’5+–oÒ´–&9µp…šaW¶ú YQ¿PÂËDÁ¿Ëðþþå2‡`9;‚uP«€ä×Ï¢…ž§”´U®Q» …œ3/ìæ\…Ï,·zMg;+y⳿ ¬bž5‹—×·?³8£µíÓðÄ*~ÇõkÂ!šÙ•ëÛÎë]Lœ`é8|Æœz%-€Sظ֩)ÀB•¼ÚûW©–ÌšöÛ§~yuZ(àè\¥tÖfttR•š•ÊyßÕj8Û[+LÏ+‡jµ*ñnXUir»R5+”àd–.uj)0Ž³tru²dÀd óÚNN žqÖ%\k—7µ….=ͪlµÅmLƒÓjõ;º—µHMK|üZ× AÃñÓ§–·Ÿ¿0´në[PÆ€1DιqÇƵ‹ê¢eb‡LÔRmËñòÊÎN¥¬å&‰“Y¯_‚Ÿ¥;Õ*òÏZÞݹ¶nÛ^6 Ú{â»ÉCv6u‡L0¯©ôs·m¦÷ÝØwÕ·¼WQ‰,?4êmüúÕ!=ÖœŽÌçÉù/åèü¡G“>ZE߬í¸+ÿªæ—ÂúÌ:ý³7¤µòé–.Ð*ê÷´!¢QHÑ|Tx«tCªiáô€~‹š'ð›ÏìüúŸþŠ¢(åX ?øëò2Y6—}‡!³\ʘç³^ÍG-ý¸V’$ ¢ô¯jV~ýøòyø¼ß &·>teÛß±/‘¯MÎÌ:½HõBn–r3@†ìŸhn†HS«ßÿe ²ížð©{éïÜg¹•EÿH`àÔ# ¿É}$pAüGaŒ“dz‘%‰i|¢¾, rÀoðK.ÚM„ ˆÿ ÷†ÀÀÈ¡BP ¯¿©>v4vƒÎB9§dU!#âÚ{c’()€{ ·v½Xn”ëAik&Ój@¦ü?Å'#âpÕL{‡dÙBÑ´•<Çs»^­ V^äz¢(”Õ8ÙJ¶À¾Áž_ÿí—ë¾fùÙûðï쌖}DÌ%záh絕ùÇÊý¨µMñt2eùö}³eïËŸ¯hæ¹·ô˜6ß%~>c€¯šekÿ6ûAö¡ì÷uÉYY c_Ö™ÿ úÆD0p,cCy‘!'JÏ- '{#x‰«Èê5qPT^8c{¥¿]î÷Yd@Œê‹ _˜ÊóhõÎëÙ=Ø—žå6¾N÷­PcM¨J¸:ÊÆyL~:clf×_Ö<ýŠÎÃðNb/Ɔ;¯~ ‰åZc¬C ó¶«Q9î‚ô»{ÏÜ{cúëåÑ¥úo»cŒù×-sàNâ?vS0ÆŸ­sªS_µ¥j)ï—"dbÒs'×½„Œ±åÚ×võÙþLȈP…,ùèϾ¿î`1G ”k¤û|E{{½\͆©,w:cLˆõ¨Õ Nd9cË<ž^ÊýW!G.ÚàÓû.<ÏOƳ¹\ù˜1d –MîáTµR…Jnõ[,Ø~2Duð©q9bïäïåçãìæåâ´ìL(dÒ»'×ú:‰ iî;~ï-ö!Â/íçã9þÇž»9”ßÿ&ѽtõ­Qû³1©ÈÄ8!$ãÈ9qSÄŒhóWÀ%£rh±E?ŸP”·3MÌ}“¹O¹ 9ÿÄÏÁÜ} àô¡ûß–e>ðs<¯sß„ŽÁ›ÇW/ÜxÙR•7±Má‚Ö–µ*f-“ù,H»?ò(7Ça…™…RÎåZí,]Ì%ü«Û£½¥]™ùÓ:XB^aÍÌ-e<—Ý »<‹U™l[´#-°RŸ:œ£µsXâÒð¶uís«w “›5>s KäF(T¡m%Ë"X¬«_ÝJ–<ƒè—í«öP0éî}Uó܆aëgÎÊÈ`ãëcË”WgÍr³uÎ*q¼¥¥˳ã}d,Y±Å Ï_§± É),-ì£ÞxûÔñ»/s÷³7~fŸa/¶ØqOÜýWphXèñ…=Ì&h¯½aA¾Žøû°±žýyð·2?l¿¹eðÖ!o'0ˆ »\¨r%fæÊì[ÒËÌ,,”2€*Æ´³_µ ¨˜ŸgøÇÙ\°PýóMá“E@@žgÜÎø¡²[2½E¹ó”²+Å9ø†¢Ïå髃p~ó _w×:.“ל40ÀTQ÷†vjìéííá¸òè]`Œ¥<+_Ó+üÑ‘Þí›ù¹»õž²ÙÀ˜6úGãÁÌpÉËÍ;TËâŸ^èÓ*ÀÓËË?è‡Ë!IŒclùðºÝø}DÏF Ÿ¹Àþ{"z™Ã*¥ÿŒ0|ÜêRZØØAuë87é1î­ÀÏj÷Ûµ7ûgè0ež¾n§ô²!õý~º×7¨ê²g‡umUßÏ'¨Ïäx²Üû33Ü]æàÒ?3æ±à_¯ÚÅ4öbk Ïw÷Žsv÷OGô®vä^câ(‡~Ûã³ÇÀc'z4{qÆÐîÖ÷iÞçn”š24ž^?ŧžkºžÓ7ž32Æ⯕v 9;Ûµ®sÈ[#Ó¶Íáíááéáýë’ƒz`ÀصC+·ù•10ª“,‚F˜ó© ·¶EàÁÞ­žCº0KOí3qpáš›Oo{%2ñÚëx§òy̱F =cow­ÖûȾ¥ã›6ôôn´õJ8`L:¸`¤››[ƒ¦ß{?âe†¤•úyyzzzøOÛpÃèCµË»?J@†i/Ü+×<¡ÿѧȻ¡ï ËdòÛÇ–5ô­ç\»ÞüXØò?ï½ûç¶qÍN~¹¹…Û° K'jàåßfØˤ„¹#{5¨ïØsb²!«EŒïñÃÏ/ePØ©}û’‰go§3Àðí+ËôhËàmt’yÍ4Zµ²²Íß¹áZàÁž­žC»|òÅhUáK¸%Ñ·–Ü°Šã'Ú½#'±4\.¡€rÎ$zj¸Ä ––Êô²'ãœdÆPä¿e©yE£y~l‚_à¦Ï#;{OÞpuáõk¸-¼©BDķݼ«.<‡ª..õšO½l:sD㪜|‹ˆiæ{Ôˆ˜ö§O5×ï$D”Þ^öu«úΈˆ›¦µð ìnDDÄ[ÓÚºÚ…ˆg× ê:|‹)«ˆ›gOÜÏÉ“€ÇpcjåƳÓž:×qk=óšéø «.9—„éaõœ½v„‹ˆhx¼Ñݹö„ ÏИÔÎÙuò©(DDŒîæ^uáŸéˆâæ>~]×°ÓõùÛg¹ˆˆ¨›Ý/lÔÆ{ˆx,s|Ìô5ˆøͬÞC?:ŠˆøëöàØ…–⻚š¹û"j‹ŽGDE—èxD\>sðû«Ž"âí]£"»F–O‹î6¼g÷‰zÿH".~':}ÍU´P…ŠóÑm#¨©0­oôw¿*Qf¦G‰9ýÚ4.+¸¤À‰/¶ÊûŽoF€xE†¹¹È€|›ÎÃÄGÈk­ŸÜ¼Áð" ¢Ýõï ®Pl:Á¨ÄyaZWñÀ§eò¢â’»×¤ÞžIþåíFǼ,"©¸sþ¡‡çì>~à›<¢ÿÙ›$o|±÷Ñæ‰æ¼y½EêÔ¸@4qhbò‰²Â@/'©ÕZ—7m‚3Ä ÒܸF( <¼A,dHL|M,9e†ìZNåorO"á¨÷´ aæ«7Ò/1Ü_a5$8 bóã} žÕÁ®•ß†§eˆ§³¿9‘– H(:Íže'ó®¾ùÖX1ÃÔés2«¼Z…ÅG×.‰q­¡¾r®¬Y`c€ë‡/.Øôg‚à7óµ—ïàç5Ÿ·7Hn¾"åÜ:ú8 ‚G`S®\]°}å-Þ™ã€ý‡¦h8 €E—ŠN ŽSM¹³î„nï®îX¼~öü̬üæ[çFx'Uo;Wi9ÖÈÂ&&´FEƒ—K8 EJk$NüFzÈü½ZEF»@Ÿ–äúJ[‚'Ú›¹½»‰Y°®‡3 ­¾¬æÛ4€ä¶å|”ôuÖçeÿ|;:²ë†Ó„ê«çË^ ô©—#Ѩ]è“ØÄMúÂo CG”pÕ„XS¸ÀU¯j,o1¶å Dqè  ùSëö¢¨Ú%²ŸšýëˆDBªÔ¥ Gw±%àãîZRX"u6N*%Dæ›Ýß{¬{rjsçÎÅP’ãÊîWB¢ÔÉ£¦”DJÌKÁS׬ý™;‘¹Hk³KPó¤T.s—c|*/•ˆFóõÕÝ"ºÔÜý¼Á¥L,½íÝИ¹§VØuD²LNXGRUÊš-ê¥2™EÇÍgç‚››·ÑMä)!eþ·E°QéîiÛÐÛh•´QKcÃÝݔեê'7Ë#}¦£ (Wx×°¤š¸þýõÎ jT«¡j=¸*l  ç¼’ ­âǶ2Æåqã'ò)ß?½ú%ËF©¼ebûküp³ü;‹íWº;£€†G™ó¤þkBTàÑÙ@A&ŒÙ)ÁÉKS6ž3ÆI‡—}òNßëh*ªòRÖÊì´pþ9yãÀ*d £Úö “G{z ZúÉ÷gºù)€»¿³²ñh_eÍÒ'°ë°µë&ov_7¤"yx‚Ëg^>äß>ÙÞÎhø´÷õЮ)ï€Dª†‚m–ð€U´b–ï*GêÍFžƒS¸Š~ÕCKem|ÛIéÂñj0n‡SZ­uSªžim}\å½Æîÿxìs ƒƒŠÔµ1zm™ ‰Âý‡Cû,L€ªÑ'S¾’>oÝ‘ì1í?D¢ÕT‰ÕRC¥.2)@ÝÑ´ÅyöÜ€Vï1µZ§tsR5uåŠJ8t°ó…§Â þû¡k==mÞ„¢ß ¤òýGžpÕ%ÇOžêúg áéïÙ Û§÷›oõn+®%APgâÇ„z€’|6ëÃw´*'G"S}xñÖífn¥;ŠÛ&ˆÌÁ”™ýo­Y¸û§G¢Ø/~»âȃª©½‚¬f•Â«W*uô…·q G"9¯=å\§˜ e( TŠñ/›\ÈìEÂFg½zaRp—îPéÑ*vÅÌDÃŽìQ©#:¯mXrïa›³ÓšCõMV[;b½–3PP5ëë‚otîµdûáeiwfÆE¸4jRZXÔ>öíæ^ 0pZ½Üx÷ œF+€Öí»Ýý23vàñ];·øpB†jÜ¥ÉæFŒÓèć­¨E½µiÁ±ì%×ä-G„ÌÌôNI“{D Ò^KMtøÌ…†NÿRJƼhï•ÓT½Ní!åuZúuj;ù£”S‡ìÉž9(Ä-¥ktèølà"›Añƒ¥XõoôYµe¢ÔÞüÈ7ñ^›{ oï[AŽrª@A£Õ×fÑé´xGRäàV. ð:³=âèÙ·Þù8/ïå4Z®¶1Z†"@ThèØOßpáèòN«¯qÆñœ^ÇÕ´JÐku<5U`‘i£—y¾qîÓ‘D[r«€wk¢r@Ò$v]Æí9c{|@%tØ=G. U_Twp4{EðÄ•s ™éCfUI‘oÒîÕ´ _i¨°øª·GÄOúú—„6Š{ '#2BG¢Ðéuq-GÕx¢üµ{ÜÛ‹>PJ­©Už§I”>-bQÖúÊ&9M2›•²y©§‰Ô¤]u×kh’B-«5­Æ$÷ÞI¯û•Ú¼ˆ½.˜Ö;iXÄêï íVQgkM»mÚuJñáé¯fÕXFQÇ%¾wÜ|”lŒ¦…(­ê¥hSªÏµ™¶P«Tó!¤¶4æ♧6´È– L5ÓFE¦±ÖJ­:k®3OÏ•ŸLXvÏÞR¬SµŒ]þל‘û „<†JQà¹éýÓï½Î_Æç4–Ø÷ä«Cb "¦¿ëÆšÓ$³Y)›—zšHLÚUw½Ö‰Ž]Bêô×B@·¶"ª½7±y{]0­—€…»òz[P´ï?"Ä´ë„À·;LVÖ'^g=š¢´’±çy†¨Í´…X¥š!±¥6Ϥ8±¡E¶eª™6*2툵þbÕYË`@Í1'ñIîädOßÈ3]„‚ëîv÷Á?\† '7(ˆÀ· ­ész²™½l_).(vmIû#/ò)"Ù¸iþs~¥ù¿‚UÒ¶1¾£(‘Ë(¢äyt˜üž8ã7ê°Õ»áuÅlÿH<÷¿ô £>Ê)~=„âŸô¦)3p ãÿöÉrƒÁ ƒÁ`0Ç`0ÌÀ1 3p ƒÁ ƒÁ`0Ç`0˜c0 fà ƒ8ƒÁ`ŽÁ`0˜c0 fà 3p ƒÁ ƒÁ`0Ç`0ÌÀ1 3p ƒÁ ƒÁ`ŽÁ`0˜c0Œÿ!þ3Ó{sûœIEND®B`‚suricata-3.2.1/doc/userguide/rules/pcre/pcre4.png0000644000000000000000000005314213051004444016566 00000000000000‰PNG  IHDR óO9UãsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ×t\ IDATxÚìuxÉö÷Oõx\pXînÁ‚»;‹³8ìâ‹-îîÎâîÁ!¸KÜÝ&Ÿ®óþ1qC.ì»÷þÎçá!Ó5Ý%çT}»¤§‹!"Aü/" ‚ #‚ #‚ #‚ #‚ #‚ #‚Ž ‚Ž ‚Ž ‚Ž âg ýL• ˆÿj¤9|>kÎ<©LFf"þ}°‚ùrÏ=‹ A|§Àmß³¿b¯v¹œÉLÄ¿ ™N¯œJv ¾_à˜(š¹™¬Düë r²‘3´È@ A AüS°ÌA´ôO¤EJ& þK1èõ/^4™L)!f³¹U«VÖÖÖd‚ŽøïÆd6?{öÔlSB¬¬¬Þ¼yãêêJÆ!Hàˆÿþ1*Ó2² ‘šƒ#‚Ž ‚Ž ‚Ž ‚Ž ‚Ž ‚Ž 8‚ 8‚ 8‚ 8‚ 8‚ 8‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà~6Yî[’²›IÚi¶8Á4'búx0‹P² I„Y¥ûµY%½²< $Bôñ!Íó+¤ uqáRUÁš“ΔʇŒ1©Rö÷ºa¦Ò¿n>¬2ð¸cSš—êw¤Jå¢ à}è÷ŽU'Ü-_Âph@ëRK^TΛ^•$¦O§MˆC™ êevù‹vZS¯^I`ÌûìàŸ#¹uÇþËg €ÀtçG7ŽR9(åRÑ«×q•³K1]r3Ìrƒ)‚ #d§r'^¬Q,ÚáyjÊýCÊ,܉4w—DRMqàþ•Àæ ¡àЦO×CÛf¸lRÖ'aÉ»@1†NMÆ«Ì÷ââ1ýîÏ]:Ÿ* èqnƒ³˜kcŒ!‡’]:àǃz‘E$pß‚)>41:Dõþìå­KóWÎ8œ%V‘ßкd½úªû{o 0f¶®Ù¸_û˺˜éUÕÅŠç4÷oJÔ ª|i€ s$L4šxßš«á`ù{ÈãõùYcYÇ(XdLÃ9¹‹ ²€æಣúž˜)Pb¿Æ„k..yQÔÝ}§t8rvñ)&ê­ŒqKMb¹ `Ý^Ê=g«Žžð¥Í9å¹r þŸü aÄ43gÆÑ,Ȭd<ðü›`•ó˹^ŠL«·y|¦f­Ñ¢9‹¸ŒÁ¸´°LšvÝ• ¸/ M¡Ôà½5 &ï*Œæ°Mž3×ÊAi®Íìý:PSÓÅ&Íc_ŠX„‚íz?Þ:×`º*— 0ˆ °àã ô¹ú;ÙÁÇ gÊvn9` ¥(ƒOG'NõM]X•aìŒÓßÝÿÈ¡Í.9éAÐõ5,ÿ3¿ØºÓ®Ã_NNÎÖŽy¬ó¨‹ºu+ûnÛz3ËI_$J«’ÿ)mJ(¨Œ:½tRt‚¨°¹‚yŸŸyíAxëñCåB¬çí{…Zý¡²ÏmIEž»AÉ*ªg¯Yúz‚ÂZ®™ $¦Ðûkú†˜Š´lV9éAPîk‡§hÔ&ˆé&¶˜1úÕ‹PS÷F%“;C»º³ù¡Ö‘ãòçRp“6AL'5ÜlLx8±Ò£äQ+ËßvØâEf£Uó¥î/Ž-½6«†Z#2æ­Ü¾Ùœ»TQWþ ¶©¤BCÒèÍPºfëCG÷4ëÛФMx·´ÁG!7ŠÇ¢u{vý}”J ôAdÝ–1ûgáç.Za]£Ÿ½sÞÿ{]7Ûׂ™cÒB'"L®£6­š “[Y"` °³Ež´<Š ›ô£G2Ë°TÂdr`€h³ S0¹ôÚät-©L¡ƒdÖi„ ÁlQöRÛ¤28¸pT£ŠD1u Y¥R¹¹¹¹ººRÃ&¨—½ê30i,Xj‚QkéߥéêAr 0j2^dÔdŽ<éÑà`Òg G#ÒFaI…ƒA ÀÀ¤Í"«AdÍÁAGAGAGAGAGAG A A A A A A$pA$pA$pA$pA$p?D°¼L-¯Ç/_€À’vÈúžô’’ûÎË ‚ ûz½a̺gd=™YýÕË/¾œIÙ«Îðø¾wˆ3SÌžQµÃbµé/Gœvu&¸ªo ‹~#ØÔWH¡ùÔ+åÊÕ¶;L"$ßmO&H䙵ÑgkÇ·üiß‚ ûa0âžm³kö» Àó#ÓübY›³kf‹¸¿eعe#Þ¼ö’–ád¼Çî±ç—øð)Z*¤ŽV½Çžñç— ¹î$S<ÜòûËWŸ@0º¸lº)SÏL¢Àׇ&_1ÌãÖ=© yê¥ù|òÏ—.JµÏ®™†Üß}íàók&‡©EõÇ[k]\;-J‡´ï3AÀ}mN`ڷ׃k¸ý±o5Z}¤ç½ó+6o7½~÷®ï7vyëg0þÊÔfÑ6ujvÏ¿ú¨O’GÓǃã»ò_Z×ì:Ò*æÒþÙ3ѵ[û×ÛƆë3†]X¹ªhïÙ²Œ¶ÇËGÉKu®Ú¼uб‘îONVÊ…B V«íÊQùùÁÅÍÇ*ô˜S¥4»²j°û‘S•zΫTEvfêp2R8‚È m˜ÅUŒx$ÿ¥¹2m§Ž¡™U3?Ÿ AR´`Y‡ÈŸ ò¸P“CŸ®=e T¨õªRìc®¹Ò­}³ •XöqD‡`-/”»eƒ¦goïß[+ß]V~RÙB*ÄŒ›þ¹ü¶¾ì/¶(a•Ü¶¾òðm,˜užŽNN  .©6|R.)ÊòTíSxú1'@çQÊãíµ:PX‘ç‚îËTˆò~l“§IÆýâ¥ÖŽ2° R©ÈÍFMDb/¢ ì‹æJ}š»h…u~öÎyÉLÄ¿n&AŽjT±€(Š)*•ÊÍÍÍÕÕ•ìCЕ 8‚ 8‚ 8‚ 8‚ 8‚ 8‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ #‚ #‚ #‚ #‚ #‚ #‚ #‚Ž ‚Ž ‚Ž â'#Íñ[”ÊR9Y錬ðcÉAèöLüW¢˜ËÑí“åJUJˆV£MLL$«}J+6‘Èý˜ ćûc¹Vd "§z’ÃÎöˆÈXºÖèááqåÊ• Ä×và2Ù“øíÉ9OB;ÛßЃËÜÍf³(ŠÔJ ‚ø¯€f1‚ #‚ #‚ø— ý¦³lllhîGÁXN‹<ÄwØÓÑÑ‘ì@¤V‰oj`´HüË¡*J|¿ÀAüAspAÀAÀAÀAÀAÀAÀAGAGAGAGAGAG A A A A A A$pA$pA$pA$pA$pA$pA$pAÀAÀAÀAä `êqêÿ$pAü÷Šš9338¢ ¹^D†¨`$pAüwØD0KÌ‘qÐ1~3Êý ÿ2†ªïèÁIÉšAü{àœsI% ^ =ôFM-Р¬Ÿÿ®"ZþüçWy?½´åï3†ÐÛkWïÕ# èüVlØ`Ø°~mP¼ñ«¢¿¿hý)ü®²ø½¸²yßISøÝ5«ö貉âùÕm‡®zg]œt~¼©íZóÔKý“Üø]ÙÎúªgWŽí:w/æóå›r€ƒ»Ö=ñŠýîäB>ÜÚ¸ãõpõŠ ÙœÿþöŽ½ç>ýqÊ©ýkî¾ýªS5ËVo×ÀÅؘ3ÿºrǼÞ{üö÷yJxáü-Ô‡Ÿ9zÙMŸžœ¾ö88sqNÿVý~¼ÈóÛ7nÔŠ+ŒýxõQÇEëLüçTvæ³sÔ¸õ7¿)Ûìó†þ³ö>ÊpU|ØçË·_ˆ gNÞâWÏýœ˜á€ƒ“†-¹ø5É‚ÏŸ¾Æ ‘çŽ^Òcvw¦sîdvÊ•‘5¯‡écÁ'çô›uòÇ:Å"긭á뜢 ÿûȘÔQ±ÚìÚŶî5^‹ì‡f5kߎ;Ó´õPÌŠ‡NhWçôû¨Ÿ(rŽ˜Ú¡IZSc¯t·–{NÓH#¸Ô¤Ð K *¶HÂ%À~ä""˜µÁþ¾^Þ¾‘qš×%Æ„ûx{yûøÅ$,§†zÇiͱaž^^!‘–\Ä>¼¨ ñ ÓrÐÄFøz{ùøúÇëDKL¨‹òôD³ÆÏÇËÛÛ/^Ï &àÞÓpU°o`¸LþÞž‰F¬T£ªRQDY¸•$O%• àÑã+%ÝúSôí? ¯ 1ž~áÀuþ>^^Þ¾±:1徬‰ óöööŽàiÍcÒùûxyy‡F©PôóòŽ5pË5Ú¸P_ÿд>/W¥š\^T^¨µ,_%+ô±áÞaYUCÐdžy{{û†™-µ<ðÕ±·ÊH?o¿SO"d昀 @³™›Bü}¼¼¼Ãc59õص‘Ÿ}Ó]Âý|½5Œñž~¡¢QíííeâЮ۠Š…­0ÊÏ30Ö˜…ý|¼||£ô)7äø¨P‹G´&À?o­IŒ ñ÷ôò CdÐñ'Qct@P’AÔQa>Þ^>~#DDô÷õÖ›ÅÈ`?O/ïàˆXЇñPƒ6" $£ý½ý£õФYgë|¹K6áN,5 Lèåí ƨSars¬` èããcM!þ>^Þ¾1 F@sŸ·—·¯Zo€¢ekHåÅdÚX¬h'€!>Ê; $+Ÿ€>.ÜÛÛÛ/ ÔdqJÐÛïäѾ>>~çŸ*!Þ? ûúxESh€§—wXLBý%ÔEöM©!àç Á˜àéÌM >>ž[tX£„Fû{D2´-0¨£|}¼}ýCÌ(X’‘i>¼G ‹Û£Â‚¼½½}üÔâŸ\öR…zû…hÌÀÚ _/oï€Ë ±ž~aiš€99ÿ<2$ÐÛÛ;(,“KÄ ~Þ^^>–º‡àã¥c[Ö¯t¾~îä‘ÃÆÎ>·¨ñÌ)»9Fù{ÆÀ1†F@Ò=ç"2Qr!b×Á¨õr+4r^K(µbhÁEEñ»†¨ÒûRúÞíÛDÛºTÎ w{Ûw}PEð…Ùç]«Ý²£c§ëO|—Ÿ½VÏY¶bÖ ¼z´]‘ž5¬ÖnÚÛnéñÉuó¿¸v1ZÆï]¹ŒÉ=–µr¦FËŽªˆW÷>Źvé@À¡.ýÛ:z•î80æÑþ#7ñòó“O®\Œ•Šw/_Á.¿åUEŽéßcìþ'UŽËÖŽ1é·îŸ,0Ý»àÛýJ14Åÿ6°ßªCתÎuþ¨[¾€‚m‡è_Ùs1ñÌ“ó…ä,úý…ƒ–ÔhÖ:Oì3½Bâ\Þ¶I'(U§iiéå3׫޵t@ýÍ9]oÔ}|d”§wlškî£? #Xî\ âôv+67ë‚6í"x{vË«ÆGf°XBà£f]Ö5©WøÁ‡.Yó[CŸWöäÖõx{åóH³îÅ­ÇÎÚ×8 <*Iƒ¾¥ùû Í:»c~ÌÒÆW»ÛÏVº¶M£†ô™¹õZ=ÅÎCÎýêàZ¤ÎÂeËÿקñØ“ýæÝ?¦ÇËΧ÷*’6WÜÙºig©K…2Vqwž†Î:ãÞñöéÀè_ÕoÕQz~ó}ü®k+ª`ÒïýKæ+Y¨nsíªÍ'~Û³s”Çó° >sâÔ¿P~ÿÓS{/¿_¿Uí§‡V¯pââèáýküR(ªX3·|1+·œuôN«€/£Õ6žÜùűoçcû]k´íÄïBµÅfO­¨ÑxïÜ=Z`ž'vó7ÕpawèµåRÝÓ'&õ ÷GÎ:×ûm`ÿÆ…åú ïΟñ†qe£B*üf~¼wχÒOn,7ë«wÍàúÐU;§)‡o[èØø^·Z>2¢DÚ¶Åõ~mÚõÎW©Qy›ˆ—þz¥„€ÎcY§ÕÅÞýãê†ÑóNû7kì¦þt÷ÎKÓÁ'W£Ý/‡IÙÃkWY»~¬ÍÃ;7 ±*W§RÁ‡×n™ê̸²´ =ßyèýîù ´ªydÏ…ÄÓOÏÿ"g'æv[w7ѵf¥ï—é½dÝP71ú]“æƒì«5©ÿ‹þÒ…Û]þ:ñGËbüÔ”gk¯>3¾è«'1ÝæV·h®}›y§~¯›\A…ÇôôèpòïÁ.?FáPú ñT=ÛÖRpIL‡¶<ƒ›J©\æîv£*Û5’£€Øw÷§³Ãks¯öZ>vßÔ¾ÿŸM]›Ö8æf üpxp½–sŒˆ“7ºø°%0àP¿ª=÷""jŸ×­ÐÌ ‘sm»Fµ.¾‰²œà±½w“ûDDôÜX¾ŒÛÃDDnÖ´häz×;Ö.ßÊ/) Ü`Ћœ§Íçˆ!§ª´š€ˆÜ×È­îó` úï/W¶þXË)b—–µÎ>DÄ]ƒª÷\üÔzù¯aå›Màˆwæ·h4úŒˆˆˆfŸ3ku‹FDnÒ´ÁŽ‡¡×Öí6f#"òtI¦É¢h6Œ¦ æ:¸°CÛ>“-Ÿc.N)Ór>"¢1´UõúÔ"".ÿ£ÓÌÍ7‘ë£Ô¯?÷†¯åä;»‡µé±8;/è,-ÕlfRÒ¢¾u“Ú÷<Õrº|y׃Iç êìºÏ=‘› z£™gˆáéâ6nœ·|¾»N¯‰PÙ¸~‡ –Àëë{´þu GìÑ¡á”÷-Ï7uª?ô".Ñ~î®»ˆhV6¨Wÿe¸Ör‰…ºO:‡Üܾ¥ÛŸ§^Xï¯jÛdôŽ8³ëeG-–çf£ÁhÓØ/éÿÝ]Ÿ”±—:¹<‰ˆ«Çw™ºþ"¢QÝÈ­þ†Gˆˆ¢wËò•&_CDÄøµÊ^Å Náf“Þ`ÌPö kº´è<Ê’vüù¥›NãˆhŠéP»ž{¸·Îè1véyDä&M³&õ§Ÿ{k¹ðÅÑ?š¶›É–Ižm,Õx\ò‘صe­‹/c1âz… ®»¼“J:æ×:ëÏû'ß,fˆááŸÍêŒ8eùìym[u·1ˆ‰7Ç•k¿Ñ4¶nùþIg¾yü0$NúÏ +5zkFDĸ]Õ#"¢)þ£[× DŽþÊ•­=¹ tkUëô³HÝ«c•öÖX´OZ5ìê‰xx|ƒ.³o%äÕ–òu‡&&»É`ß5*Uï‰!%§Ñj•»‚ÙÕ®ïF‹ÆÉ~-ß«Ÿ#GŽœsñ™æÖ$ÿ³|:Íý8,AŒ¹Íœ‹œ£ù»SÉ¡'ž¸Z}PM‹–l8òlCãëèX(W&/"0êvgëVh8€h*U¼"0Ç‚Ž˜#H’{÷¨yŸ¨Ç÷·?E¦‰-`ò;oû©ÌN«ØXþRA"èŒæ */—+29Ÿº_¥n Áf»’µ,uA*“êFõƒ×†ZSª[jš—1]``>y92W‹ðý{ö €L¢É«¼=óJ·ŸXݦÇàD!ß‘ £1u¶#ý `©\’ù^aÎ]¢¥eHèè’ ´Fy¶“ØتL.D`Š×IÐ\ýÖ;“YY¨Å/M#Íl.0œ¸Y{A]‹ë÷[¿/hÃn›Dyñ<6?«Þ&ñÂ%„±ÀM5Š»XüèPÀïFó4ùOˆzÇ<;·Ç²Ï+×Í._Ð õ¿ö’œzj`À˜Ál– Ò¤°$Õ5ëL’ÜöÖ*•ånbõûŸã]ÒÊË“K©Kt¶\“¨³v´ø±ËcL"em÷Ô HyÝRü’uí=Š#"c§³·G¶~pïBÃww|9côòK»&·Æä)¸t½9Kw†±,ÂsšÎÌ¢-|Ž7TÍ«bÀ⣽UÒBÙºAÊP4''käæ/—;}Æ” J¾ûþP«"‹|wçslÛZE˜˜¨¥0òF)/‘SQ+Û¢ ­:wÏ-&št(W!³¯Â,m^¾Ñ\߸^öN”dRnÌ‚g\b}°eÀ4Qž2á!›¨$†¢“Ji4ÅoªÁ IDATtŠ¬RA<õ>Üò!Blh˜D–V¼yXX´K¥z.•êõ:~ño\¼[©O¡”Œž8ý¶Ú€aͪ•ß}žö X4_žÈȧÀ.;[­{ª.&ÿÜ {vËŒñ„D“­uÚÜå­\Aöô¦o›î.Lÿð@˜cÓr6©ðë-ü…»‚¤Þ±a`‡Â– $À&[fÈ8³tÿã„r¸'²æs§â¹)'{…‡l™>ðÐ]²\Í+–X¾agxttx໩cþ®=i*»dJ…˜ðâSD¸Æ±ué"3–n ŽŒŒ ó[6°a·Ù·0;e–©”büK¯È0µ™±ø K~ŽYšV#>ß\¹[Iö5Ê.m=°É‹ø…†Xuí¥BÐ~ÖÔ ý~ôŒŒxp`žk§? À¢Ÿn8äSb^Ï ýæ/ =ø×)3cxwß3ÿ~šÑŒ…>¾°d癯r³ U¢éŇ€Ð8³Rª ñ‰` Øæ)Ë=C£¢Â>nYq¼T—?²iÒ(+S+Oؽ«þêuÌ­S4æœÑÍÍ ÷=ŠIŸ1ÖvîäØÃÜßú†‡ù-™:ìÆ.±-Ú0ŸÝôÍg#¢£ÂýŸ.\p¾á¸?³+ŒB"ö‰ˆˆTæ)Ù$—bä²c!‘‘aÞ3zÖ¾öYv6P2ÿŸˆˆhÆøÝË·ßýÊV¡(BC|"Â#¿íÖÍXäËK¶ý:§J_~ò5)¥ÊÈpŸˆðpKgzÏÜÕŸB¢¢Â>¯[ðw±n$YG†’’UóG=½àŸ Žy¸krŒ!‡DñîöÅ;ïE¤Ï˜Ðyb§Ð-{†D„ûmÙ¸I™®!iÚjË]Ï°ððÐ`¿÷á1Å ‰B)jŸ 5º–±{ûqDlL§Çð?N!cAA¡YU,мmÙ¨c÷> q_?zÖž·ÇŽ|±~À[¿ÈˆðkëF×é9cŒ?ؽrëÍ@èÝgÐùÍ“^øù{½î6éòð…ÃŒá­-‹ö<Œþaªp¦”Ùh ~·¢Ïù §AnìWx¬χg\ò£º‹9>&âÐüÊéµ—–íÕgxb­‡—vÄñ[Ž,1¨W·þ£þjºô̪N@®PÊRê‚ W)d²²Mª·qdï ÷c&î:5¦lôÐÞ=z£ê´îÜ_˜T¥”§¤§T(%€¼òŸcj®úë¶ÇñÚ[—ΫyZá?}èe—¶ÕSŽ ¥À CT …R"0tí»fR§¡úŽ[trõòÑR.šœÊô¼zpîö™Ãzöèµëm®û·vÉ4!ݧœYud=C—]»bÀ†ñƒ9@ø‡×/}£3›&ÖóÅéë2ÞÕeJyÊ}˜É”J€$×ÚÅÏ2ÿä›ß'»¿gÈŒ pó–Á{f íÚkL¾Aë6ô/–Í]˜mÃë­ܾkï?x›Õ.Î6fä™Ë+•0|sõäµ÷‰ühåÒíÒþ?wÌÑ«ßïù{¬Y;Þ A¶àø•ŽÒ‡ýzv8~}¿í×þlb—Oòj• ‘+R3iX¤ûŽ¡³¶(œºÞÝúé >=û ™Zþ÷»ÆVG…Òbm‹žË• L›94ðâúáí`®Ÿ¿þ>&‹AzR¶-ãϤ䆦~¼ð´u ”JerŠ)TÊ”*&W*¥™¬ï÷öôÕ»™ú¿ EªS¤J¥œ€`¿vYÏ óFÎ>ôdÀè†×GM\Áh^¹nÄ‘¹#ºömÓ}éÎa¥³y••ëîí£· íÐ¥×ÈÄÆËËpQ&Q*,Méd?\;}ù­:CÛ²«1uý”ÆóFõ<~Uyëå(˜@bi;EN?8rhnï_í7rzË™†5/’"Ëç´Ø=¶ÿÊÁµ¦ìUÜ¿{§®s÷¼Ø{nßÄf%§é§W¤­r‹+Y¡ý7/ç~º®¿þ{+Ý<3_†Xªñè3ë†-þ£¯^½ÏÆ»>º°˜!৯¾€mFY3pÙƒY8`ÃéÑõ\,Ϫ½»zòê»Ä7Fe2®ÔÆkÑ{e&i9ѵ4¯Ã%¢€€ì;~”õí«¨i‘sÎ9Ï°ŒÂSB8Oó-çiÏäWByjìY}•á›ÌA–¼d̨%ÚtùÉ\&ž¹é¿Ì˜jÆó9Gô2b~–Ù¶üåÙ¦…É«¨õ^%/Gf‘D6ɪ¼iìðhç_/M9Ç¥Óú.ƒsÈIgesUNu § ÓÅœÖ?<ËÚ‰4¤ß¤ouJj*&M³Fuøª³¨Ùßè”tÆDŒzwèOMNM+SYÕÙlVõ35ÇôÏâë,ëú†›uk ~ºgÞsÃZEÕsÓj¿q;Îðëµ>p’ˆF‘s9ŠÈñ‡­ÕJ¿4PN÷\\VµY¦àÌGI‡,Ë5Ê4‡,ó¢cYG˜6,ˈ³ÉJÆèYæàÌCTs¼læœñiç3$ʲM+›Õ n<öbæ…iÞšíëÊÖ1IåM ´ÊWoJi†IˬÏ2O{±,ý˜ƒå29+Ë«rÊFN²!:s‚tÚâ?¿Õ),‡.Š—Ïž×gúŒ$wÕõ]rpJºÔ$6Uf–µÊèøR95Ÿì ± dýuåì ^fÊ\µ§‘ÃZo‹ 2+Qf]ò@–Gž²5D¥Û—Õì ¸Øÿ'×[Mœ8© ­,M ã:³˜YM_1{ç"¥¿y)óÆ)¶y‹Ûþ'³5ò±ã'uV¤׉fžé×V÷9Å¡p™ÿ §8ù¡AnL&P”U•, u± Z“„íÇ™Šá?ù;Z‚ ËÍM»¼ç{ O¦»v[I~Æ-€zpAü€¤Y‘.1µœÑÚ̾û§XÔƒ#â_FÊC¦2¥‡?eOGÄÿ,ôÊr‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ Hà‚ #‚ #‚ #‚ #‚ #‚ #â¿Ì´wí7¿„Ž ˆ™¸qŽÌÈM(‚ˆh3ÍßñB%z]Aÿ.Dà‚Y@ ˜ð"áþ“Ø›:ßY¥w}GTôF_‚ þEpΘ ŸŽìV3?³Â¨• ÉCÔoëÄýDKÚ;í»;¿÷*“^£5JˆO4Ù;Øiâ˜ÜÖJ!ù k™cÕ{{;áÛw«EnˆWëíìTêxƒ½4ëÍÃ1^oec'“éæ,ï(EHÚüÍðe Úx#XÙZÉþÁ‘&ÆÇ3k;fHä¥JܤI0Êí•bl‚ÙÁÁ†}o F¹½­‚˜:΀Èd ¥µJˆŒ^«ÑÍ Hd66Ö,Å°&Ú(—£NLÎRRÑ%jD‰ƒ ââÓî#HdV6ÖR€æø¸D+{[m|‚ÒÞAA6ÿ\UÆ’Õ  C`Œ1üaô…ó E&Š AÆmK™òp0 ß®W?Ñ¥Œ±Ã:xc³fŒ­ØÉ?ýU÷.é>jŽæÖ6-‡%ü5ºåêS~_úcãVÝ£ø÷äß~©MóÎqQî-\;¼Ín?y®ïÖ©íCÿ„ôÞcÁûF®»øŽ1`ŒÝû³­‡Zd?úu̧—vºüÅ?[-õc[µYð zí„~3v^±yÌë4ÿa$øïvm7ÔɕëetevžÕjô9п;Ò¸AÓV­Û´oÕ²eË‹®ø2Æý=·Q³¶£ÆŽh×kxÛÖ-û.9—²»ÝÓ]æÜÚ4uÐŒWÒFørÓ¤6·Y²=¾u›N}>lØ°aÃ÷ïÕ¢e‹–-‡èE|ÝÁµÉƒÈÐNõ[]Œ!Ùùç` Mœ™Qäœ@dœ1‘‘± Þ“Ï©ÿP4Úmâdýóý1¸ä"¥?|‘3ô­ óœ]–³xˆ »æ‘h•Õ9–®M6W%Þy¡µN=  Q÷žŽF+›²Cíl È–ì{<³Wñ¬ÓÍVêþŠ˜))Lý„käyÛ±É/äiÑ¡Y™\²lŒ’’LÚ"0¸p'D¡²ŽßˆUÚH¾lßÌÁˆˆ©ÅIoAÞsÞ­Ãsj!fé…ìl›­²:LrAjS­ÛÕ³„›>½ƒ­Ô€'®uשîl‰˜eråíç«/W-LkÇ)S—6·ùáƒw=:¿cÔ…i‚Äøµ«.Î9u{Ç¢¡¹Zλ{ûˆúÐØS^k×ÞÒüV=9kS¦æ¨ùìíGŽ=zô艳—Ý:UXûnÒå ªulUÕ9O¡eÓj¶O-)MKÿ'=gI}kÎq“äƆHÌr£Q/é8sJùM¥eµä Gß±È Íy¨¸qΨƒ7ßÚ)À`Sfé¾m5mÑèu~àØåQòüÖ†(sÞÊ[w®* a¿÷¨îTe¨÷ç7ùìŒwÞDüµûïV.¶[Ç÷ñSš&þ6´ñ”C­oµ0TšW¦·.Ûx߆9 dðvE±Éñsê…¿L°zwÏP óþíS¶Œé¬Ò4¤ÅÌ­K„6(í:ã¼o St÷ÉãMšÐ¾ §+&÷©f×ö蟽KøëÙýú¯uøE¥“í›'«uš¶hL;`ÆÃ~½í­wqVä+[[’t«g'ÖNßpòaþ‚¹ý}âZOX;«G¹;k‡L|\âÉÁiྠëL¿–·v “'· nŒj*ÓfÖ³×mØ‚AÕcëYÙÛªJƒNó»WZqáý¤Íw4‡žVŸ_ëD¿:ó¦¼Zß%m ƳËͯìkr }}ߪâÀ­«G)îìŸ7Ë¥£S´ÑvêÚmÊ:nžPïr´ÿÍ͹ڭ99«ú©õ3׿Ÿ¯`nŸØVãÖþÙ«<@B¯²ÅË®÷žÓÌúõ3Ö¹‡óËKÒž]ÜÀÀœ Û) $*å‰åÃ>ŒŒöô,X»ßþS·Žé¤2ŒýmHó[{…Œ¯¶©|¿Â/ãE¸{ë]ÇE»|/·Ï-{âñvð‚}Lι¶ËïË*5¯lчRm•Å&QÔkŒÀä )xâ™—B& €)>ØWt(ê(ù¢$ñ´û›*òt*É7¾…¶ÎyêôªÀŒ§Õ:É ²QÙª“Nzµ+«$úésm Øí?¥Gþ©Žr'Ëø” ²•££X¨T&8êŠüVrŠƒÔÐê?Ú:‡]ïcoάÞt\"""ÞÛ1²a×…±oóº O¾µœprj‹úƒˆˆ“7o3b¹%ðÕÒö5†žBD4¿­[¾y"¢©w£:KÏ}°œ°sT£=àˆè¹¡r¹ªû^ë1±¹[Çþ4>­]®UHRŒÞ¼Ž×ó ›1¨îâ#Þˆ|apÝšnÁDDÝëãýjB 88°zóéDD|zpzm·Váf®¾¦Šë¯&DDõ´žk-¯8#"Îî^wαO†ÐÕk¶ 7räÉi%àÉGf½úÍÛf1}fÌÚft˜zÀr´ý·Zmg?Aĉ=šo¹öcZW¯ÿ\ˆ8yPÓCYÎô90´R³yúl,/†zT®Ó&!ùpÉðºÓv{¡.¬Nz}×ܵ™×¬÷|Dç÷ñ}`lÆž/®R¡Ê·3$¶v«}éS4z«Rµã'"bÜÕ•j ŠAÜ=¯]“N£,¥Ò¿X_¥v/?£Åý/ê»Öüc@½ß¾ U‹˜Þ$ˆèwû¯&£ÎsDôÜT¹Bµ57‚1¼Yƒ|Ñøܵ|«`DD4=™V½Bí籈ˆŸÎM©S·n°ˆˆx{í„6V!¢ï±¾µûK1.çí_£õ´Ä›;'V®Ö`ö_ÓZL>kL=!øÁâFÃÏpÄÅ#»ü±îlZ x¬^gØZDDÔv­³è¹:Õ8QoÚÔr]ÿ2&­«9GDÓÇ7¯ãu"?ŽZÔN lÿJ}9Š&n>²xŠ_¯YÞ÷ú®E4Š\D¢È‘¿Gr¢òÛï•2Øë Þä~|3Ѷm\ÞÒ‰o<|~:˜ˆÜØ°a K×¾hsˆ¿#04pݧP­¡v1kÿÀ*]zÄ^ÛläÀô¶5»VT r™D&×êÁhƤ<ÈÊT¨h§`9 ¡y¡yå€ÊüÎb¢6àÔ1ïòÃÈ¡rîFÀÑM7 ¶ë ó÷÷÷L´/+È.ùÆÀ¼µKnn²h섾瑱Ôéðä,ùH¢°­P¾Œ$‹íùƒ[YÊ^±~as˜?pD³É`2 €Ñ²:Ôkfyí<Ô>újîÛzõltŸê–´R2j_¤tÙB™-£WÕêPÞÒUÖT©.}Š~pþaîF JIí\'¼z¼ËPt)לÀñ-× ´m§ ÷÷÷÷ˆ·)+U\ö‰Š•¯”ÏV€ô&€;ÛÏvÓÒr¬WUܤ "w”)äjŒFLv%3äm[Á@™¿¼Üºlˆà’Û6.A“Åè Çÿöçõ¹S‹lÿ¶âîñ¥’è@ݳ-+—™¶õ²eRóöÖÓí“3ó@øÜøŽÍš6mÚ´i³& j´[¨ÉÐÑ•-Cr‹«ié í”´ÖðŒPAÁåRƒIH†Â³„›OLÏ%Ìø‹¢n—ßEQ@¥fQ‘}¿GrX•àñËNž¦±˜ãŒ¢µ•HåŒÅ™9¢D¦°Tz Xúƒ)–KU‹',-“ ŽNv" T)ø6D”[VîXrêyíå–0©Ja©ÄÁjTßÚ5øÁ>K•–8;å‹3äo0ÊuÉ–E®×T}çÖŒˆr‰$9u!çuY¥SR‚µTHÔ›T9ÈY¶á+3Émr¥Ì9Û2O)*Ñ`«²²8SÊŠ\j›Ûr¢FµçÞßH²’£cîxS¶ÒaôÝõÙùT餩_”[É“³Í c”©$©ê˜R¯X– M÷vŽÚþì—«Ççaò"¬MÑ:ã'$>?QäÎXyÏƶ¸Tü½‘¸ãƒÝ±² K,i'@äÀ$©‘·_}fzU[¸´¦ßæ·.þ-i‘—øÿ%q‚Àdz½Ou%øÞÛ¥ ùÌņ•˜ˆ‚D€’$úþ=Ss8¡b>v$ Þ²,ˆÀM&³\–W%KP'S00&!æ‘ñi y‰¨]sð^‡Œ ?ƒ"Np/Rk1‹>NmÙ2»\>ɽšÎOj•¡‘\Y·Þ«Ô¢úŸ:κu~Acø)›Ï¦¸T’PŒ}˜Qt²Qd+n˜2idÔ˜¾#5!>X àˆ~1èâ(/ìlgq(ch4eòt9(“Wê^yÌ…©í2ÏÆfT+Ñï^Bþ–ƒ¯»|}æ ¦’×Mµ¨]‡[+îÄÌÞ€›•r«R.,Ð[í™`ÎS܉¶s¸”’cÆØ=ïh—byS"4ô¶ÐzÔ‚M5º.x8jVR™ÿ¿'gª ¸0Ñ™oó.³¶–•#KÌ.3LÛ±úþF™CCè2µkèÎY^ZWWöiÞk JŠÏí¼÷ì=Ëc^Ûgl°o7-Ûj"ÌlL”E‹ÛØ®;zÇ|eiŸ®3¯cv7O&0³^›t »uùb„æžò@€®ýË^¿,\ù{RƠäž‘/ñˆ¶F`Çöí?Åxz`êÒ•nãv¯Ìº¤cïîí:q#șĨËWošøW¶RA#òd­âj0ÙÕ³ÇD`p~Á2mÙ>…³8ÁÖÁZ›ðÒb…³×Þ賟dÅÐçî7^gþÂJ|¹ý‚?€Ñï¥QÓ¡\¾*Ý[ÝÏ÷F`r~FÕºcÒÛ®ý¤žÑ—?Œ´8¤S‡vï£õŒ‰¯^øiÎн|ýôLÁzC0Û¬ ¤ºòÛ&  Voà¢ä–„l *o¯_´õ^„µJÁdJо¹áñºTõ:ožœÌ_w˜E7:À|eçŒÝ÷-šxo×Ô£¼ëÙ%ƒª2Ù¼}ÔÅé=bM<Ó]Öè~åRx¢HÚó€R•Þv,r-ÚZ¡D2½Äj)SpÁĸð£:B‹Šr¿¯˜Üjh“š5kÖØé_ùà¡) qãÁí¹Ÿ­­ß aƒú#ë;9½hÕzcRµ@³&>A ¬8°¥]ÏŠ5GÜvrWþWë]ëÖ«_·îÑøºÛæ7c€ êãÕš”‡ Ôj“ÈÁªzŸ&ÊÎkŽ; 5ó÷ÁOƒ3>„¦MTëŒ"p£&>ÑÜ(Lññ ·ýºÍeM«×hØ´]\¥þña1ð˯;V ZؽNƒ†nõ[ŽêüûâÒŽŠ¹}äî?¯Ca)óÝÚrûÎþ‰pïü’íG3DözÊœy‰žG@HP«Íɪg6$$hŒ0´{ƒÓ{7¶dyÇv+1¦~õ^^ʘ±Mˆc{uhØ ÎJÿÒG6÷gÙuj¬JnÓnª[vºM>*´l蘠ÑðxµZLn“mB¢Î ÷WNµÿyæ8tù:VˆÚÕ¦y£µ~m1rm­_lÀ¹é¡Ý“ uu­S»ÿ>Íókì ÚΔÔú öعjÈÒ^u4t«ß|X‡Q‹Ë:+t+ÿpèe†ùBé­»®œ$oܯI)ŒZ­6ŠTÕú5µêR±æØã¡ j“j êäy7nÔª5:àÆÄxMò|èWèºô^òÜœ]z,ïY­õäð½j´šÑvΑ~UÙñM÷z ­jÉ:º;¹¬¬P¶\ùrÖyÈמ¼Ñ´ˆ  &^­3ó”Š]¨vßNN!í†n7e¼ËÆÏŸ:öE°‰ÔçÐ7D¸\­Œy£~$3ð^N#åèÈ.åì‡=ª“óoQ1Ó^ 2X,Áܷ̈¤œ™a˜c9L}Þ?ÓW)£XÆ2æ#å„Ô3Ó>>ÝÆYiãÔKR£Iw>"0XÝ©ù°ã׬Óü¦!u"+}Ù!«‚OP?oÇý»Mi6¿ÈjT˜UZˆÀXØ°ÍŸ·tK{²øbI¹I‰Ÿn,HgÆÞ~#X²‚™OH±Mz/¤;ÿ‹®L7/‘jjÈhm‹+Süžž€ÑwÚÿýËù±E³Ìp¦yšä«2Æ–&›i3ŒˆŒú£[®™ÇÝò‘ýtŒhÞâ?5Pæ-5)Ëʪö/8²”9Ò‡“~a©#ýÔ/¤[qHœqÎ8}ÕÎPÑYÚS³ú*Ã7YF•uÂÙÌgÎ"È>ÆL±>~µ&©Òÿb‹AÖeÏ>Ýô#&SBp¸:£'­ó9ZK³sFúâbÐé-ƒÚŒÏj"–aº«XfI¿hœ;Ò…§7×—\ YœÀ²­C+QÒ³²ÄÄæVÙe8»Ä2Å–vn‡¥Ï®ù™S»y¤nÿ@ÿ Pn–3«LV"Š½ N„¤õÉ&m_#pD*2ÇbkgûOb°up¶VJÒµð€S}‡²Êðä°¨¯;ìï™]òe¼P§¹…2‡Êlò8ÿ¯-ʬ 4.÷SS.œ7ªú?Æ“È@+15Uµ—ŠR~ʽ.韛rÈô«ûœ~†Žÿ‘»S~Æü£âO?3šz®úhôXPá8‘¡„Ž ˆÿ8GÄê¸9—Ä™ƒ üœ;1 Aÿü€&ÍêNº…*8‚ ˆ¯ƒ~vG A A A A A A$pA$pA$pA$pA$pA$pAü·€˜üL~Kÿ÷¼„ÞèKÄ¿MÞ82ÎPÊŠf2& Ùï"L=8‚ þKŽ`–‰‚f!Dþí¿c“×ÔïP7êÁñï‚sŽL@ ×@Ì¡€íøV'OÔðï|¡9 Aÿx €eØ•49„1Æ=O¼q2b7H¸AÊe¢}qÑ‘ƒI@Ù·Ê Aÿ4 PäŒ1΀1Æ‘Álb’“a«_$zHeF-3åÖ媫UMǶ—ðÍï5ÿ‰spI‹ ߸ö‘åUQïï=ymŽ÷r¿õØðî™û§ ÍWEgT߸uÏð]ë/¢>Äýæ£!üÖÕÛq<»ìŠwï¸GiL™îOI…Hy#ü3|Ї»O>Äþ³·]ñ¹»ûÛHç_z‡ZÂLÑon¿²|ýöO>Aj¡!äó×zmð“›O‚¾jxûáêÝ_Ÿ#“6âö·™ƒqï¯ÝýÀ³è7|­/¢}Þ{Ž– îݳ‡îîîž¼Jä©Eûyxøh@æsﶻ»»ûûO¢t©'ø¾½÷>Ô¨‹ù|ûöS1M¢f]¬ûíÛ<_<öð ‰ |}ÿñÛÿk'€ÞÑ"Zœq\Ø0ã¥éÈL´n#ï>¾ÔÆ&=mÁøŽ]~¢À1ÆVu­ÿù7ËaŒýÕ¾¡oú«¼žœ[¸vŸ1ôÖŸÓ×è®ÛtëuÌWE§ ˜4}~<ÿžü‹ê7s§ÍOHøŸõçFSšb½gþ9;Áo8û$ðÉÑÅ«ý_ëÄqPîø<15̲•=g¢À—û÷†OŒ›íxž)ÅV5ÎßKŽVLàð½;Ò9÷¥QEQ9OíXqÎÓˆ¢ÈS‚“ïà!w<å€À3\…É÷Eäf‘§&‘tUÀc?‚å*E3"º¶jeÎV%{[9–Œ[xhX«B€<]˜ÜeJ I[ïSŤ|sQ9Oþ–‹¢˜ÚÀe¹šæ±s‘çjд~éü²¤Ë³Û£y’E8?í¡±’1à0þÄS ã"ÇäÌŠ©ÅÍ66D³˜zËçS'g€s“ÉÄ[Þµ|TŤ”9σŶimžÔ£Lu¦FŽ\ÔiMȤÍaR_EÑÌ)ç/h\!¯tÔŽÖNæø Ïľå`íÚÍ=fì[6¦Ì€%O"@âóñUºæ†|-–_Ö2%­tõ$»x†Ê—ždöYj(Š›\U%ÆwщÙUÿtU áÁÛk)p1)¦¤xšLð >y³zÄ}«.7.œ:°ßñ3çÚæUϹô €îÍ¡à¢} áʱ›{®>°vé”\¹ÊlØîbQcÄ^udž­rha|èø…TÊÊM:K”…²såÿ*FAëgóÉ[óÖò g¸ÏkQŒ$Z%ByiãéEÖÚ€“Ô(— ´§ðw Í^Þc0¶o‡ç‘¬¤¼ g»Ð1?S?X×aâþü•Ý5>o"ØÖÓ'Ê©ØänB®¦ÞÖ²¼|÷ñÃ6\ÉùÔŠEaJóÖ¿60¥MÜÞ¶#·å®Ü@õÁÇè|êÌ~ða}¥)}ò½STkíqìa@Ñs7¶]\º$RiØ4a£ß¦·+ÚªzãÉ'ÞWpÊÒ‰&Mð¼mÓ37°mý÷ôžÅÏêy©eþ¸ÛÍ›U»{dï½+G2ˆïݱS¬ªhyg} ÖQ&$™fÅØÞ§ß'Ô¯^Üã†G®‹ÿžÞ(èÌì6;Ä×—ÀŒhúw‘9çg4JéI¢!j亥¶<ºÑ qyâ}ï6é=ãúí;ŽŠŒ¶ö>8yÑSm~YÌûPœsæR¹Ûko„©ÎìLjE\ü °«ûô÷zY›8¹k¸Ô¦Y ö÷Ù»#ÖX9WÖÆR­óÜ/ÚÀ²Q â\÷/éeU·i!•mÏ„ÊÇ-=s¸åi¶èàìšçF4[l?þÑŠic0?YTm¾º…Ãçü®-ï~—XýÌùÕÖ^0`ã¿Ò¥\Þ~úuñ¾±õ íšÕ⦮«ÏóKUº/ÚòGÅUãûœ|_¯zIÿ¯½ëŽ«âØþgvo+bbT,(J¤\Z(B Š¨O "*&1jžc‹FŸÆ^õÅ5F“¢Æ.¨ólQùDÄ‚"»·íœßK»bÚï÷ûwfgÎœ9çÌÙ™svÙËm‡.ÛûYª nÎN_dÎõ·¼[èáo›}¹ÛÄw½€+¾ÿ‚íЮ¹îí9Xôó)r³+WFO?c§`óSÛ»¹0ù?ŽzxHú÷#–ýÝÿ©<,¿¼r°«õ¨•{>R:¼¸~hÈGk;º¸Û¼Èìâá(!…|~âçã–žtòx«0ãJi;ŸÓß-æËò|Â&|süL¯Vò¼¤Í‘ÓÏßÕöÉùÞc{[vsÙüèçV¯?¿vìýŽ^[q!~ïÅl[½zKÕ„.gß9àÕÉôéÛ*&/ÿ%ñèˆÀ û¿·ò@¤g‡::]Þ[—öa3%ÖÓ‘|ý‚€'.Y9õ–miA/gƒ[{¡}Ô·?aX¸•p¢ç@eÓ§•{[å_ôâúÒµÀñÉ—5½üeÄ«ààd¼œU7ç[T‚L—z[žÍRÍëÖoEÚ~(%HôR`Púû@Ø8žÄMtö¥3Ž,±€"?2È}{Ú¡ÁÅ#½†®Ó#Î|/hô¼BeÎö‘ýÇÄ!"ª3”½‚î#"j†½åþÝÅÇBƒ¤áÁ±GyDÌÙäÜÃ#ñ©P]ìçv1¯¹+î½ÞίaA_\X ÖQ#ÆæÅ(W컇ˆO¼§t +Ò!"jïéå=JxëŸÃß¹‘GDÄ;§6¸ù¾] §¥Isƒf–#""­ÈõöôÌ*æqý”°éÏUçusQ®£HkǪýAkK¼NSXXÌSCfôª Ÿ÷·¦ ¥ý3}CçœCÄOF Ü|*‘/ uõ¾Z…ˆ8+&`ø¬MBËâÔ¹ý”Óª‘<ÿìJ_Ï°ÊÚâÊ•ŸîÊE§×ôƒÙBå¾ÏƒF/¾‚H¹²â¢rΈ‚þ—}zº%>Jªð·”² 4éÛ}bJQ“—à¡Œ*@Üõù ·#gíÊNÍwœ^&ªîû*=®ªiiQA•†¢¡H17iFðœsˆ8ëo». •w¾‹´ì<"n˜9hɇˆøè@ô›cö#â²Ø¿MýR ’¿g\Ÿ‘;q}ŒÛûk.•[ÞïºõÅ·<ø])Ðõ«>ð‰Ý˜Žˆ’z…/F,9ÀãP®ùÒ³¾sŒæO¯-ì×Û#5_‡ˆ´<ÇÃË'¯B‹ˆß,Œœºü"'Orï?¨Hˆ˜ºó¯Ð‚'Í‹²ú "^Ø<$$öt½²)ED¾ðBÀ—s*1nùˆi;î"¢®(ý-W—ˆÑQ¾¡ã¯æÔõX¸-å9">¾´ÆÛg<Ç׳WõäªÒÇ·HÅÊ“ªÍ©òzÊú "¡pê0WusþÝwçÞµ§`5Ïk)å‘"¥”6X“¿MQù„}w\F¿-@Ä>á ’íí¢GGaßkð8(HªB^ëÒ×C„´íÞ†–>ç€ç@«o•p<)½›’’’’š¦jïÆ]ÓRm‹~~í„Ç„‘Hª4Zày¨ y±­ììå’¦¼7uÒR(µµ¦juÀñäB—È`ºôõÖê(ìËjßß!óljJJÊÙ«÷:3Lb^9L[õåÃCÿˆýâ³ø½ÖRÿ5ÚÚ¤¶ÄHdvv­Ì|ùÈ ¾ÂÜ;õjCK )Ï g$à…ßT׿R8ç·òÑœ»üTõSOÀŒöë,ŒUǨ¢E«ÖÖ ÓÖë~5» Ù€f²äÜÒ‹govtïÓ¥¯¸tá{{ |‡®Íû²ÚõsÈ:›š’’’zùngF’t¯€Ø´¶o&#`(š¸õ_£?Rè',Üåi'œL»Ùº2Ü@›~¾88¬“¡¶tÝ}…±ìÚÐÒB€ÊôëU†)FwÒé)<»ŸIšË˳Υ¤¤¤¤žµhÓóaF"8„, µNŽˆj=niD e+’v·ˆ…á4¶þ^%HdÖ@¡RG@pS5öí8¨% `imoÓÊI€l%eœ™h!wO}å0ÿ£M‰ÞVú ' ÕÙÖ®i—ÓæÄ7ãž~þ^¨ïð)·UPu3KëíÝÆ@{æ uò$òFTù¿™e@FÊX<­xªÕžg‹x /ç,#mc ‘ÔÊ…B¬É?õˆ €Å4·4Xì´ZOriÍ#+Œ¤!UBä„a%õª2∯F"¿úS²%‹‚·ðpÂÐÈJY€?ôIk©pb$P\ 6–¡Ž•²‚Ý—rOn&~.D8:ØÉ$VÝý»‘½9­¾t”üîkKSÓ›îNeV5-‰ŒeÔZ¾iwf yY&-ZÈkZ)H…š¯ÔèR™ P¬Ÿ+e-[…R5ÂÓì¤ÓE‚”:ùûÛ+¤ø¡:'®ÀîŒ@œzwkÀµ¬W¯®ððûŒ6ï¸?|Ž +­ÑT êJµ´…  ·±ô¥ÓqÀcJr !€„iíÞ¯³0ì°à>‘k~š£ì€@€ $°­Í•Ûúø¼nh ¦–!ó"ceuFC[oç¦M‘ðù)Ãfý>=ÕEˆ@žŸ¼`é³Áª¶5kãb½37>nqÜì° ?panу®‘=eB¾àkæ(Ä –Õ« DÛŒÓ=?X¼‘c)Jæõø'CeHô •"ùs¾sß„ƒcÝÙÍ7 ¬Ñsåy‹»wéØLQURÆ„¨‹o#t’³¿6ˆÂQª÷g/émK@= Á_?BMl±)ÇcBÆ© {T.ÄÔ«KJ–@ÿÎÒ3–¡KF "!DÍiärȈ[t@ëÿõ»wÂ'ÿ¶5Š`M8Ñ0®‰Xg¿Å 2G$¥Åù]¬¸¯Ö·i¡h4:S»Ó@¢*S¿L¨Á(Ë”äØ#ÀœÚÝ^ÑUeýô|q͆„hs²ï9ôèÑÍþŽ²$IÈÒÅÃJ©nê 'ŽžÝ¸fÑ¡·¥@ÍØ!À¹Ý§½Ã¢_BD6Zª<Ñ“¶,r?=Ÿa;@‹íyV²hùr9 Bu:"‘VÝš¼õ—o×ÇŽûdfHÚΖˆ„@Lt¯¡§3Þ7rp¿ñÎÑt´Y°b‹¼fóœ~0µŸðê’ÙS§ÏÙð­½yŽºé“Ìc[®‡Ž\$ͪm_ŠË5haAÁ>¿‘È°,¥uÕËLý¿)‹JKeåò¢òê«rÊŽ}m:«³",^BYdþ$×Ä• ^8±:nÖ¥ÇÝ¿8ò“•çiׯSÇß‚¨/]ññ×c>oÖ¨‡”JxîI Û޵ݒm‡‘ ö»éÁ!Ó±1öY©D_ýŒªø];–Ó—Ÿ) ŸâóxÓ‚{•”~ÿ–Ur–@ÐgSt?.9v§’R¬~~Í?00»DÜÕKS—­›ß{܆Ö7¶ì¾ñ‚’ÿó±%›Œ-ŒMÙã]{â4<¾ 3,a‹+*€"F‚üãr-‘$Š+DByí7³V¯‰Ío±im§.K}ª£«3vžÉi"³†yÉ {Ê5]’œ»Ó±º ý†VѳÓèáVWo¼ô‚òúŒSFMÝkØæNÖ^~8»‚RTfÜ(R¢;±çë«uFǪÌË'‚©"À¾¬<¿7Ýá×îbâ©ô2yÓÚø“=måSÇLõ˜µÆ«9€Äæ‡}Ÿmz»Šn^I8õ/S¨KîmÚ¾ƒãÑh1×°-,W½šÓè`îÇÃO­žòÑzØ/Ÿáµ|¨ïØm™R¢9~®)Ã=”>Ç,Þ9¾6¢Ñ ƒ¼ó»gláåí²=ßë][Žã¨Šãj‡–ÓhyÈØ»iKâS*Õ¶ƒ#»Þ õóˆ˜?å«C}ÚZ€ÂõpÒŽ¬5#=<½–]ãÔÑErV­Ññ5ã68zä«ó†z*=O\¿&@¿vÉé»F»ÈꃻîŽÛÅÌ}ŠÀ£ÌL…{?뚃»^­Rë@«á4ºZ;¡Z§E€ÈÙÛƒí²¸+#>X½iå°Š’R=0¶ß¦wL_é­Tzú ë½uÃä¾YßNº ùXÙF}ºÒÖ.J-#]_oŸ|]SõìÎc'(Pm5§­[J*ŽžþõðÌ:߈ɈZ•ºæñlª×qêšÆT«4ÈëÔœ¦>‚Ÿ~jÉWÛkK—ÎëƒüZ!@dkNœÕ2]éþ8ÿ¬‡OtÏé;wÔä>lÕóuK „Q¬>yzÅë˜0Ÿ®îóâlÿ1q¶[sÓ§3ã7o=yû9 Êx %: ]3)e‡·ŸRçш¹(×97ƒô¥”"R㜭«¡´ÁUJ¶4ê%©a¾Ò´e=1s ¨aÆ“š·1Œè4¸JÍ·§Q3/x`µaJ—6¸NM2°Ftfõúâà=#¢æånv æÆ¢ˆˆ·&í¼hšEíð™ Í&„`FãFâ¤fX§æ¹§ ôb¢/;1C¡ VkÉÖqEÍ)ËÄ0ÌJµAŽ®¡|ŒUÙÐTêJuj.ö©‘ ½ìÒª¯Éž´ýü+’EÕéµëL›‘þSéªÿ«F‘¼|´¢fçl¼&†‰GbRmZª)Ã|¥iKBÌåœêò›fndoZm†4N†^U“¦Ræ÷Ù2 Ã÷<ÂήÊU©TëΙ-:5íBXȯkß'—¶õ€À'­0 ÜKŠèå”Ðû Îå+ÀÙÍûßjÑÞƺ¹m‚b™w³y+`ôð Å=£ŽO¹R·K;MËUn$Y‰¸þÐ¥^WÊ8 ‘ªö±“nÅÇ DH Þ.lÊp±+Ѻ^ÙœVŠB ×ÊÞö Á!qÀ8†á!jA59ôÞÙÝ‚´ÔGGGäoÝ­qTB?‰l0Àdp+÷ž^Y›RÌݸTìU¥è†ßÖìòþh§³D”»Ü ™MfIïâUª€ÐY’P(ª¤—omXR Ý[;]­*õ®n>\¢‡Ÿ5 CÐ9è@5«ì2†aË3jjø“«Ç €PçÞprÓ&>d‚„C Búûö§‰@âøþ‹Ýz6$ ˆôÕßÿÆÔí¥Êzþt˜G÷‚º'·î@­Ú”9fêE±±s¶Qí»içòû¨FU±[A’?ŠÝK5êV²Þ£P>"îÄ1 \žF¦vkù¶ÈÂ(’î¼_uä/uß)&ö¯þdrl‡Ãùl I¨–ýÏ_Ï$Š4hsßLA›dD²,€"Ý_3C)>°€íßêöV›Îã?µ KuRØ/ý[_~"j“2k!¢7öïv,W£€šŠ¬o “žƒËóÁ}&Eƒr¥Š ‹ì ç&.ùµàë·Ÿ#- ³½mÚ:= b G6ßþåó¡Q‰ª­=êdÓµÕN^OywDOEÝÞw¢X»1”.®*©Óæ;?ϵtàPÖëmAg‡¶:ÓåE}Î ªßoº¦±º1 ÷àò‚fN5õYN†»+ƈ23œí1m‚ Aòª^hëæMµêfa4¥$e] P4·u@ÕŒïrµ©ÆtÐÔüß»½gþÁIu’Iv*áÝ£Õ— =\m#÷Îz¤÷jYÕ–ÌéCª;8qÇèDÃh͘ºoê‚Ó€HÛ’žïµžùC!Y÷Þ&G¿„(מ–=Gu÷½bþïN‰d”%0Ÿíž%=H̦,¨[=˜R‰PB{0§¦Í…Y«¶eÿ†“‘Ð22•Qo(h ¨ !Ú ^“!óÆ]D{PRA²9S·[S@S^4$þ·÷¬w/QÁ9ÑÞÞþ™…4hPÑ¢E¹…sŽÉÙfP( 2öp¤7$ÍZŽ@PÁ¤¦‡˜S!c¦ßfNµ’Úÿ(ÆìᤀY¬–€é9ƒf-ggÆ<Ç0 Ã0 Ã0 Ã0 Ã0 Ã0 Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀY…áΞC”ØËß>pò’(áÜá5‹4ù–CM:µvz|’é¥RaÜÁÃkViY_5OD’- ådT†aþ³G€’.õÖ®=öEô€˜× îž;AoÖZÂxÿü^ƒé厤GÃÝ»çÎf+‰¤ÇkSj‡ÏÀ0™ùÏ:ƒâñÚØŠ8€©L»Š%Ü 9ò¾Î¥ÂRSM²­‹‹{ABD%)<9)õN®å€+%9:%!žPgçVÌÞ^ZR\h”Sñ2: @4Ľ¸ëvu³?¸yöÞ*¢½ú<Ý¿(ªp‡²êA‡ïÅŸž÷Àо÷ŒÑ’Æ Ç°ÀýK;pâjpt•À*Z¦é*I¶1¨Þ¥Ïûš€6×í9äX%hËd—zß·îí O¶yÊî«k ÙR£z ˆ?6xÛÜŽ¿ü°Î€ùkG ë|äñ·òµY\ñ-MdÒ‘äPûš£:t±—@¶IÝ>°ÖÕûŸW+ ˜\{z—€¶¯ÿ¹S+~;ýøº+ôÜèã[†H;6­ÕµË×}ëW™'×¢Ïå{ª~! Qûu|ý'×Âjú÷Òo9ðNëaEì¢$ˆ}Pxʱ2NP£ŽËŠQ£]?»\ù-ò®úÑ{qI£=¸Ú3,pÿÎþ€ö$)ν` ç¬#>%ñšB#´/˜ŸŒ±D©!AÆ¢ê­ZY;  ÜJMVn= € ”‘"v'?tsªÖzd—íSßrínÞš–åØf²/V®ZñsK>JNI!„D²5'€Þ©\Úr]— ïÂÎ…ùQl˜©t•2$€Pö›ºdÍ „CµÒ%$0¬³µÑÌ©rÚHØrà´CÉbù€@§" (XÜ@vCI ñ•aû×NÀ™n/Öª r¶É¶àH(É”Ñò ³"ÛØ %™d£OK ¶ÆØÇ([Î_¶©ÐJ@ŽEkŠ¸eNu;ÚÈZ–c›•‡;ÖL›Uíý/*•+£wПü¢IÆozI@@ÙŽÀD iz„ÕY/Ñó§Ò$ Ó&¥LqYܸ¯Âi··ªÜm$¨iž\ûzèâæjŽ K‚¢ÎDü$ e@_Z'%—n<¼¤‡D€ˆª¦É²L&ývH¹ûc6´¾v­Nõ*Å…”AÈg+ùy6òWèñ~J*º§_(Ñh,Ž¨&#“lJ::¥&DÑÑ“_1:–,àž$@Â"²”Kç4·ßæ¿Êi›˜b®GëËÉÿÂýbš†¥ýëFnúX1›R/Þ©·¢T°x±Òg·ý¬&4ã½íWÎZz|ðÛäH× jl3zäŹÃb@I<Ü:åüÅ'‚³›[jL˜IÓ„f::{šæâhŒ‰xnå2£F$¯®YdWw”L%*×¹ùë×iª!dç÷C#£RPV﬛påv<æ¶ u©ñI-ËÌðÀý—¨Æè?LJiG½EH5ªŠªÙ i"-š0«f3iPªå‚ªŒkFûnüâã=F™âã5 ò÷Kõ÷×ðZ=ºI°]žcûhwWîÝ~§éØω ÷¬[ÇnÏü9:ˆ8³9è~ ðûЫ®îóË—–°¨A`Ë[+:üñT¨¦”æ}~ÙlùðÀÄòcÚw¯j\V§\êša^k>ý J¿µß)²öôäúàÇ)BQÌÏökfƒ¦ ¡/Þ¨£×éÉ~;;/Išbʈ T“!£s§š ¼˜ùoÙ(÷*ß²ç¨Îã¾WÌÿš¢¬M%Ë£Œ2‚ª’¬C"J(Ë )D€’ ’ Tui$Éh~’!0- ê4$= M#dÌÈ $e*H2h*Hºô¬4"K2Ê€Ð@@Y–Õ@ÔéÒ®ED²I!ÒŠM4iPg“ö%þe« ˆ°{éŒ Î‰öööBˆAƒ-Z”[øœÿÒ"h*X8"‚ …–ñ;¦Z~NÓ‹´¾Rz ’™z†éI,¹€dQDÈš¤ÖTK/ëY -%ƒL‘-a–8˜q iñY8¥å†™#h dšHÀ0•‹^X2>£êH(ݹs'%5•­ö$É‚o“!¹j@¶ór7aü'ÙBV¬XÂVcþi¨ªÊF`^Nàr¢(Š¦il5æ7PEd#09áE†aXà†aXà†aþ!¼Ü\©R¥xîÍBD<ôÆÑ4ÍÙÙ™íÀ qSdæ¿.p Ã0ÿ_ðÃ0,p Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0Ì¿‰¬oOÉ8=ûõ•_;ÎÇ0Ìß JDªª™-‚†$TP…ŠB¼òY0,p Ãü$„ BÑI¨W €PÕ™€@•^½ ÇÇ0Ì?BãH•tš„D˜.zzM–$YÀ«váXà†ù›!$0éÌHf‡5“ P¨fú꧕²À1 ó÷PI¢Ä‰Ó£ô:¤´)JGk»wKøê‹ |.*Ã0ÿ€œ Ô¢%ŒO]#cÂè1¦dI³YáE†aþÏeNI±Û„i3„0¡éÊ›'O䈧øEXà†ù»‡¨DBB“‡‡^2ÙoÚ¥ -JZL‡62عxÀW^eø?¸lÒMD[éYà‹³¡Ì¼l(gr-ç_?è§L7÷O÷fö¾nÉó䚌­£Ÿk(Ou”þyÍá°?£D ëÞG |„{PxÛƒû:hÛVü7ú$™?méñ—M¥%‡vï3Wɪîc[4î»ôä¾ú·ê90zûçMGÏÇä[å*ÕNRðÅúŽy²rÝÑ„øòÄ{ߪ´ø~jÛ:õæœzl5 L}R׳ÁÕcÎç  —Ýu+òÍWÄ+‹šWyo+!þIþ¼³èƒ#O_Ö›ÉçV›»/[QC.üäåÓÒº±FÙF× /­êÒ¨Ï&‘¹ä0ªï„Ä<Ý{JµÇ ›3¬Mß©«¬»qpWïï~½›óÇÓ³ú^Mxrɤ…‡þ ×~X¸þ$ÌSÅăÃ*¶š‡ˆ?«0úXn]üÑà§UïêÐ≠½ë·nß®¶W£aKNÿ)UŒ\&OTlìH‚”Ï>‰jÖE/C¢ úF¡0ÿsp”ó;å|\Z` œ9}=ÙdíÙED”Ë Rï>IÐg-À7K·Ízô³#gK´o4öô§ŠA7/–vÖS.Ã,‘P–%ë·–åÉIdÅoû´e1‡?´(쨲n#,gîK§›'þè‰Çv°åךެ=‘r“U»e³iõA{¯o耹ö¬>†­Ø!·‚mÞz“l­–3×’#\½t#!UË\"(^­S1)?éàSÞ Q–e”²UxôǵpG°nª¬Ÿ®éWÊ>ßÝQrÈ­T’$KY›¦%–_ïÈŽ\AÄ+¿ ôkØ´‰ŸË÷»ˆ8s`­3ŒØ·k—žþm¶_zj¸}¸i×I`8ܬI‹ëÉxoÏ‚·=TÄ+{o¶lPçѦC>qþú#¯&•!þf…*uƒ“¼2³˜ÿ¸“¿ìÕ£k ߺý&.7 © ³>ìVϧQËw;.Ýw;½ŠãåÝ?·oêÛ4 ©O£v+?@ÄãKÇÔj> ‰0öø÷k´¹kÊÜÔ°X®pâ@¢™‚€Ê°ê}W‡ç|°$^ÛÖ³M W­êÝ>~¬ ¢6´}Ûh‡¸.­ßíخՖXmÞ°ÎÌßQ§ËTõ=¹uvÏ÷:·ò÷é0ìëhÀ\„µ»[ŠWkmB´Ømzïj¿¿¦¸º5«ìZ3Ç·v•i;â¯.nQµÛVB¼ôÃÈÒCrô05øè þÞ |¼üZ/Ûs ððú9Íy7 hêë÷îO»®">X[¼n?vÎéÛó½Ö~ž]F}ŸŒ¸sTÓ])ÒŒ^­‡®8‚ˆ±· lïß8 л~“i+"")ÉÞu*oß²npïžÞmæÛnЭ$íáò±cמ¼}`N‡žCáæ•úÎGC|x¹¾ã0:ŸWûâ–ú&iߎéÕ¤qƒšµ}çm½DÆèŽ-z©6÷Z4i¶-ƒÖ´«>pçœÏ†wëØÒ³AÛßnDÎ3´[×v ·Ý{3@ü±ÿ~»w ^>þ´YÇVbq‹·ëN<‘³Ç¤DßÕµUÞõ»Ÿ|œˆˆË4: òè–­:´k3õ׋WvÎìØçC$%À»Ò’¥+úvïÚþÝf:¿§ä²Q…1ºnÍ*g‚“-®¹8/ j¯=ˆøñ{ÕÆÎÙÚ«v‹)—MÇGñ™ˆqwT¨R=-}ëûvì9äz¼bùuÓ$ïÀ1Çñì–­šø6nÒħßô%ûñãÎ-BìSº5o9ûº‚ˆÛNlì]¿±¿Ÿ·‡u§Cm)^»Ó•Ýsû¾ÿ^k¯NÃçÄ# ùé©á]êûøxù6ÿé× –:£-!†_ÞR¾Z8_¹Í¾q/w p,×ð’GOœÀ”°s•*¾«¾Áþœ¬—]† LÕ4l dŽc†“&t$¿ÖUÔ;‹ëÔhs×LDt}Å€~ŸˆëØnèK„£³Tk;‰ˆîmííãUÿnQòµ5ýÚ¦Ñw¶÷Ã!"Š»0×Ó§ÝS3QìÕM^> £Œýði«­ûZr Z4¤jç™Dyv†w“I–ÀäÈàý‡O‰´‰gÿßS×ïS3Åß®Sßÿa’™‚T¯RmÚÎP""2wö«ºñ|<][õ~ƒ¦ªDD´mFOÏFïF ¢ÇëëUó?MDD ç׫vú‰‘HÌ}Ïs઻D)]¼VŸ #!2¬aù˜ ˆÄÕ#{¯<5d1YÊc//ïÆý´|ûº}õwg\D”r NåöÑDDZßm7£‰ˆ¢/Ô¬íÙæ«3–Èóúyvšø{®¾¸·£’OWcú×YC|Fýt‡Ì‰Mü|‡,³^[ÞÉ»ÿo‚(!øúþ“W²¤DÆð–5=œ%"ñø`­ZM®™Ètí»Ú5›ß´x+þb£úµÏøvkFy÷}Ö³ÅkˆH5Ä8p0Ù¬ÑA"šª¥8:¨’‚öÞ*C$T! âÕ¯’[߶~ûkÑÞÃËéˆ*÷^rùð ;H8yøzÓ!53<ÿí}‡“€¨P—ÒN@ŽÅ ©)Æh @$4@];}CÙáßÕiš¦å«ðŽÉ¼/$@(•=»Xƾo7|Ûôô©ÀlÖ„ ¼àW3[,}Ù[K——ëÖLŸõYj´«1¬UÐ;º»ÄEǘw¬¾VyìDšwèiP¶|½Á½ÛH/w¡išæX£^ÁB‡®ÜÀó—]YÎ@ص’ùÑÌ&PL4ABSÓ‹¤ö~/Àâš:ƒ>t ÞbzÙeAµ¶O >«kôNMüleÌ:yú0* u# °ýªkQMdÎÈÖÎÞæÀÁ‹DB€Ûº_~©än&3 ™,Ý¿=÷ZU0)þapppê[¶öÉñ‰(º¢S>xÇâŽBå %>y’u3ÊFêîU È£îÙóGj;Q.ml]Š4n¨— UUìmlžÕ.;ɘbÙέiÓÆŽú70‰OD€‚ˆ4ãÒU”š @$Añ_·¦J‚t ½òHX—Û5ïDjE8Z&>ÓCc#’ì‹”A*ènŸ%ÀÑCJ¯^9ÆåÊ( þþ}Ϲ E5»¶iq–ª†¿l×Â_‘%ƒ1ÕRõIIЄ“îyš–‘±9Åü²®ÙÉV—’bp@ˆ{…øNm/Xy檽3L‰A×Ï6¸Fݽ- <«C‹FÍ’ZOÞ8®cð’çvóz›üIŠ  ƒ´:€PÒz[x¶Õ ~y—5Aá:pöiBÆÅ߸S%IDQ-ÚäWä8S~SŠýo[I‰—u®B¢Wî(æ–Pjû~½àõkB4ĈÓ?T¬Ü&<êy–<¶z³å©pgý²°’~MÜžWM4ú®=/~7+)­ „>qz´I{Žžƒj°I«.q÷‚SÖÚd|°9¹X·òRƒì[4ñ¸ôÓZKÊcûvÚÙ ´ïësoíª‡i[Q”YS&_KE4ÿ0zHÅA?÷þj£ë©i?A¡$_ºxÉ2°ÍV]ƒƒÂÕ¼ö¸4³‰@‘téÖIùvãMKM;x§[ÉÀ\›€«³œÿÄòÅtõÌÕ¤ç\Íqïqx¶†í^¼’.9e×­8D@Ó&*o“;÷­´fU´¥ˆ)ÁgS’;T+™[φÉ*Ö­e¼ô{Hšùv/ýjíѧ˜»7µô!jRÄãaqy¬ƒjz¥jMñ!÷F§æy|$̲dyv ¡¥÷yô¿ì9fqÍÕ ‹S 4/fŸK;‘uz’B ]KX¶õy›74sʽûÁªÈZ°l¡"ögŽÜDóÌMO%)£â ˆ<2bÌfÉÖ¥Bmÿ²¶rx²AS4Ih`kŸV¸m_7J²l­iG öªºëPD@õqËÊ•W<Ô:Xo ¨“îÝÖˆªõ{_:¶qÿc)òìÉëáMü¼@(†{÷˜µ×_DMÛ€ªât²AhnÛ6›%ÕM‚Ä5õˆêó»Û¯¶Šêâ?u€ŸÜÙ·AÇv-ÚNü}Ê–uÌÔ.þÔ´cï=Ú ]ywÖ܉6¤©Š’!X¤˜Ó¬U§Â;‡×OëÒLѶ߷.Ð(°_ÿÞµ £·ÜmeÐTEÍ0ifE%×·Ú)G[´huò‘úäÄƶ½†dÓÂ#óV5ÒZJ/¨Ù¬Pzòg}UÑ@ýIÚâÛ¼}ç6M÷Ǹ›’ ½×¸Ñ­]ÞoÜ°Oÿ~õ½Ï…º•-âpnå”ÍƺóûT&²_8­×ܱ=0)îÖÀþ½%ä”cõë÷OÝ“-Ô¬˜3ÆLB¨Š*ÜêÔ,Õ¡a‹ÏvÄ5-ï>óƒ÷ºMZ ¶غ4šö^ï]šù®»_vú¬Ž¹Ž· 4Ý@êáÿÞ´é_tì½®‚o Ål EQDÆÖ¡(Š€[ë¿i;âël ‹Î¥6Îî¸zx`Ëv}÷©Ô}Ü{EÀ-`F?µc“æƒõmä? bçÙ¾¥]€„ٜŒª ;6-çòY׶ݧoÃ">k¾ œÝݧkïþíû|·'Ò·Q1ÈZ˜4×V+_õÒÞ¹ßd"ø}êŸo°ÒòÒKnIiV€¢ Ëä¿ÛÚ¿ùOgŒ EÕÒ•Ír•œ•wËж}^Éî°ô*DªÙ’‰MáÆeôC›4ïýÃ9ÏÊUNýúuç>Ãf/ºÒª]~ÝÛßfüjɨ\{¶z牭ÊOëÿþ¤é3öÛ`pÅhL³[–º­@Ò£3ºõˆ1Šl½¥ÏtØ;§O‹NÝÛ4k8¢®9Õš¦(š&lèl<ÒدiŸ~ýÞ ð‹{˳K¥‚àT­^‰„.¾-Çl ù`JÏø c;õÒµ]‹¾ß–.àðÑ€>wâ%³òl/©¦*šF`W`ÓÜ[Ç·kÖ¦C£FK´Þç-]Ž¶P¦ˆÄÜþ½}׉f'Ÿ9“Ú~ÝÝ·ióÀºí?køù*ÿR:0D_ïú^ç'‰Úëï€ÓH¡éØIL1h0y†¨ã¥j¨7O˜ŒHô=÷ç,läü.„ȶöñ,IJ’é‡lK$Ù“e,IŠLË3=zŽœ„™cgNž9ç\²¹]A¤åð[¢Ç—ŽÙŸd5Ž”Ù,ÂêME_¨îÙ,\±z—Ï1À‹/G¤~6xt^¼i%P<³dælE–eñƒæ( åp‘°~k™ëU£ ‘§ ‰Èü°Ç⫹ø7W×dº¥Cs¯­ç#)÷ü×X»œ¥Æ®ìæmÐ^à›¬¬5ë%³Òβ {óµ^²ØYX«ü$‘ØÐÓïaâ뮢 "UÓÈL¿úNr¶#"…L±]z[)q÷NMyó«¨Væ0Ë‚Cúô`Fb¦4˜%fŽ=Y˜)aÚ¥õ˜S©ÙsBÄ̱3'Ïœs.ÙanWÀ´^` ؼiïð'²'mþ;§‰ž?-ô’k¹].áØw¡ÅóâM+øÌ’™³Å, Êøƒf+LÎdKn½þX5bž2¸<ÿÃÞÍKçâß\]ƒÏÝÄ›7>ïrˆ¨D]ÿ1©¥«DÏ÷MÖŠÖõZc¥e)@öæk½d±3Z«ü€¨&>šÝ´ˆ³ôšcT€€€¢µª`±Ï¿ ˜H8ÿ<_“Éì4uè$~]Ò_JÚ,ì«­´Zˆ>[ºáèSWOÑ¥ç`÷oÑ-ge7•îujYß¼—,m­ú5ŠöopÍkX€Hmæ[½ÿìC]½ e~Ü¿Å…ÆìÃ^çòÇv,—tÍ¿Á7oî^ˆ€HD15aâçÎãÆš ¶ݯ]©ø­ûª¦:‘öÊTÊ÷÷V<)RæU-æÏ_¥Åì ‚\íϾyý–@šY’%R4$&Iˆ*Jz3Q𭔊5dPõ7®è*U{³«¨ÌŸJÎA÷ó · ¿Ò5Ó5ϱ?ûæ5ôdYB”TD Ìɲ¦V¨Lµ«˜d'Ý+çÏÇ0Ìßøíúíe|²ªÁ»Ÿš¬›"/@ ?ܨՀdD„øÛSFôz÷Ý6ïûìz|Úa(‰OìÛ¹MÛ¶­ÛvYðÛUD¤t?Ìü°Ýú׺ú·Þ›ùH#Ú<¤yŸŸo!"bhß&ÍÚ´y7Öm~üõ} "ª—;øžŠ ïÚ¤õöÕí/FEå®ñpÚÓ …$tB2. ž|OwC&5UR>)4¯¹™îÂŽ^BÜþL#À[K>úÍž—ª*hŒºV×w\¶Fâé_Å”œúVù É1I€º¡#?®TÔ!o9Š˜˜ØìGíæ;¯†åLšðô*cH6åèØäœê3«µ×uÍÒ*ÅßæOßh›±ˆ…}Å®“7|ãÙ¾ÈXNµë•2ú6(e2ZNPÕ6}w¤]»r`N‰ŠM¤¦XÖ¥ÞÙ$‘'h樘x€Ä#M;¥–o3iÒÄ.uú6<œrq}ÓnÓZ _.5vøØg~8îÇC˜VàØ3'R}êåÎzî(€!>&.ÕrH¨ˆ òöåôéÓ§OŸ>mÚç <íܸåõr¡¢ùlM²«gM XÝþê>\°¼áé·IjÚ²ø¾íe[Õ¡ˆTvJÁÅÎr@BzYßH¹€ÌÑ~ݸ|Åêƒçïf<Šÿ±qõ²åËW¾l‰}mÛº#á1AgW.ûyõúíO @DÑ'·,8{ÿÄšÍ;Ì‘û·­_ºtÅΣ—3ZÒ¹ýkŽÝN¾fÏÒ¥K7n?”"ÀyÑò•¶òÓ‹7Aüë+7nˆUÝc*/œßÁKùPÈãG)& ÿeËéè°ëÇV,ýyí¦]Qf "H~rmÃê«ÖoPl2µ]õÂÁß–/_¾á×–3é#oX»n¯°Üšˆ]»hùÕ„ÌÍÓ®²G|ãÒvålâ‹/ @—6/Ýr!ƪ‡4-fËÚå«Vo¸¥À‰Mߌ°Ùµ|žÇI»ÖÎ2h¿,[y"Ü°nͪxcÊ¡mk~^ºâÀÙ»™;8Ù`Œ[¹jm‚)í`Ýà37z {¶®¼õ4fÿ/Ë7ˆÒR"‚ŸÆ@rèíë7«Y³"Ò¶¬_Ÿrâ·õ?/]¾ûøõŒË%?¹²iõòk·Ü‹S ‘ËWoTŒ!W-¹bD-îÁö «–-[uøòC‹ä‘·aå²D Àñmwc“ÒúŠúˆrE $?ÞeP4m„Aüëú+W­ûãi*\Üòý¶G6Ö.ßy;â®/^ÿ;(áVü¼|í槉Š–ºiÕÒk¶„™²~ÝÈ RÛÙߌèT·n½wûN^^÷ýÞ;gN\¨Ð } Ïjn:x»²÷¼©ãœl’-síʲÐêJÚ˜_$áX¤bµêjÔîñÉÜNaS×Õ¹–¨žßþm‡¤:€iǪÅ<5³öü5“PAÎg‰$“tÉtö–4‡‚PlhÉö¶Î6†@#ÐÒ8DŒíÞâÝUG®›S"Oì5jÍUD|rl‘oû‘7cÑNJ\8¦Ó¨EG îÎÖ‹}²èX™J•#.­ïÖ~ Úä+¢¢ÉÆƱ {2…¶lÐrÝ™ÇÎŽ´ëûq/Vàìï«fO›6û`dÅwÊ]=mÀ—›m]¤²GÁ¢6$…ÞÞºëw0–2 °‚©`ýe3I¨+—ýx7Â!lüaþ‚‰k¯–«T1èð’}&!"¦^oӱߙ‡Izã£1Ýû¤÷iµ¹´ülù>½ƒýƒ«5¦BUÖÿ4eÏý$D<¹|æϧTsͼê¢æo2Õ+Ÿ^Ô=¸õÛtcÿ–}×ãrËÖ.áÓþC§Ðà »Þ÷ 6‚›³m¢@‚îvº|vJª&¹,œO6ýüóâQßÿÃà^¶ 4ï£ÓDæ6"cÌ‹–ÄÓîþ±åË÷<€›–Î;iÛåpESÐŽïVŸC䃭¿íËqÈ8­]½ôã^ýD;•+æ¸ôó~ãwÜGÄ𳫴ùGXJ\ÐÑn¾=4€=á¢I=ß „I÷ÕoØõȃT]âOc:[p@$îܶ9<™Ìå;ͨbCrÃ/Ú×-B‘®¢km7[llS¾è×+(A ½z°Ó€ËIàìêœ@èä^ÀÃAÉ×øñ§ñC'(W)öĺvƒ§|>~ŠK™JêíMÍ&¤f*z÷•§öMjþl¤àh/—-YàöÍSc’@’1_Ýö“ú·±Ìl_|¤Õ»µA}ÙƒÖÉV²)£ç|•ŸŒ•{Ï+)€rð×M·#UŸ¿fÎ ]SHa´.t&h¶noÍ’%ÔJR–³—ó>WmõÀé»óºÕê»Ôrô´1êx^Å}Ö¾êØ•÷ÒÎÈ~°´j¥6‰îmíííÓ'Ùrv؉ªž-#Ñì‘í>þn™ÒÔk莴ŒSùz6<c$¢Æ·è6bžåœló™éå}¢…ŸæÝd¢)Ç)öÏJ¦Z5õÚs5†ˆN-íÒ¸ÙÅréû[ßñêšLtzB³zC6[JžqÁ×ÇûBHr̾Y•‡ed2e`À„ŸNQjÐÊzuû$$žo\¥éESî'˜çZ¢«Ó«Vö»d$!H¨†VM¼vþE†«¾Uý¯«DD»»NåvO‰„)Î߯ÁŒC÷,éžžüÂÛ{`J.WÔâ‚<½Ç›,_|Ý,pì)"Ò£ñ ¹[-ñû†Vn»0·3Ò…P:´ô¿ñ´åkʹõjöL$šÞ¹ÚGkŸXncãô?_s˜’oÕªí½àvª%æ¢~µºÏ¾’–K莪5;„=÷öc ;u[xŸˆ(haåŠ Ž$§Ùª×»ž?xL¦à€š¾ç’4"¢'+VjrA%AD†ã +WÙöˆˆH5ïå”%Ù5"M(É9·I¢ Z|!+úµ,œ6ÜkÒ¤}!·Ü‹zê¨ýÛsœÒˈҋL™\.!b.Ë„ g–OÜ §Ž-wÍ´uCok¯C2}å´ˆ_êw_õi8<_n=È$Y&‘šå9)  wJ{†h Þ{®w€“?ùä¡B~àM!óØéìéjÌ™›Æ²m öu¥"BV‘$À×Z•r«„~•l¯yh™ÿ %lÁwó’ d¹bÊÍ‹1HDD}þ‘¹d¢/Ðf»¦ÕåOì«×¬U³fÍZµjñ(VÖMÿÂd϶¼Ì^d¨Un]´d £HTÛ=2N­R£VÍš5kÖªU¦DÉòeŠ@ê­5ß]´Û¿ý»]_t>!íβk ¼bqÒ7‡¤Þ½zíz¼¢n4ó‡—Ý•Ôêã÷“7}þËÉëAw®,øô"$ Rû׊>2dÁž ûn]:ôÞ»M~> Æ°žïÏûtÅOK5úbpµñ|†ˆˆ1ãö>þHÁìjE¿›øÝÐ<Gïà %=yóöÓ°w³S#_¼û Ê €›§Î Ð üvfÂo#'/ùõâ¥KgŽîìß±K¾]Ê:QŽÝ+.㾞zqÃÄ« Y·° "LùäÈ}÷ëþš.œ ’DÂô)&C¯²ãÒ¤IÀ×ÝÈ–û6»:{ö­‰Ü3oôÇ“BÞ²{Aw$jÐë‹ÕšÏ?rÄGŸçïúõƉ@¶uuwµKÏOïážÏ2Ç2dì0݃ýŸ~³BïÑèȾ%76|3løˆå'SœÝWÜAçü.Žéó^:Gw(T­—o9Ó¤qS&‚!6ìÒÕk9š5æËïn«“@oï–ÏÕ.­J¶n +×oÕì¾›g?uqÃ)Kz¸PÑ¥¯¶c̨‘Ÿ}·uº£C=¹ìSÉkT‡2ŽDÔ°ïdÏÔöD¨á!’L9Õ„_:qìnRŽìè‘?cw5äËçn«—@.;kZ›Ýߌ_y6ì¼?Tgù¤±;nÄÌ…ŸY2eȇS;~¹rpå\úƒH’ë²Ý+c·ÍìÙóƒãÔ`îàšùì4pqËï`—6«…¶.n`JŒ8q쨕á®04cÜu3†Žšdö·q¬y¾7iýçm¾ŸôÉ'Ó—Z°³¯)@ÙÝ=¿œþGå Ú·t̺oÆùáQ“×é}ót R¯\:—mÄ]½ž¯G‹|iÊ*ÛÈï’! ®ùÜímeŠ|?§ÛÑ&-: z{w×ôºüò¥O‘HùÝ=t€lSÀÝ-#‡¸ÇwO^¼š.¦äÙã³ß°yþWWLðý—_ÉÆþöíðøÐ;ù<x8Ê„€@ùʵüýÄnׇ¦O2{ñŽ&¯Ú²øs"Hù<Üíå u¦ÕÚNñµ?d^Žý ê•ãûïÅh,>É€@MÒ4!·.ÒË^u†L“8¯­žÏYÛÈñ=û¢È¼à$2¥Ybf_›"SBË¿Âz̜˖ÂJpæK !¬e’30{r‘cµ4G&Q××N:“d}Á-kþ™/÷,Š)ο‘÷É ôÜEÉÜ œù*BdÊV¢èšwÕ²—AéÐÜkëùˆléEŽ¢Š¬Ù縴È|wÂZq²þ#²Üuδ–Ò?K$rÞž¥ ÙJ˜þ¯yj`ý X%«ÙÅs-¬än¥dþüó¨^»#yó¯YD%³HžÜutP £0(otõZ÷‚i“lß³Î2Ö²ìQÁl}~È5YÚh=¦•èV‚3_:—dÎàìÉ1ÇjiÎq§[Ý •3¯E`ÎdV ƒÏëÇ^Ù|ðJYãV¨r‹s[ÊÍvǨûÓyx»â ŠjµÀY2¶æØlÿ`æL²äo­ªX½½¬•"ÛÝèõ;ì]å¬fÇ:­8Íšû ñÈé¥ pïꯚƒ#Çâ¢lµþ6d‹D$½±E~]ÒKàZ¬Ük¥—íGŽ]ÚÝ.‹v¨&“¢ê䬿)TƒY¼ÄDƒkùRV‚ ù¨|IçߘÆ9¿ÇŸ}ÒeJp…ÿˆ¨„0¸Ìôô—½É%m~]Ã0ÿZø•å ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0Ì?”¬/üHÿG¦Ç¿òAXà†ù›A "PÇùàIDAT‰HU5%ý"$¡*T¯~0 Ã0ÿ‰!ƒ0ê$Ô©i'|j² (Ò«wáXà†ùGhœÐ$[UBAoˆÖi:ÔÉD¯~: Ã03„„ AMÒQZ‡L@¤˜t*rŽa˜ÿß*’$b‡Œì؉tÏÎÙÀÛ•uë%zÕ¿²œa˜¿½(ÈX´˜9"Ìþá]¹D) ô al‘Â&3Ž‰àE†aþÏeN3êÑ6iÆ,BfLÙ¿K¡‹Ä4 dcæÿqˆJ$$L-PP–̶whhƒ’šòÁH[Ú¹–Qì?LàÒ7ëÑ«¤Ê’Œ(!&:6ÅdLŽ‹ŽM¢è¨H£’§Sõˆ´ÈÈH³&^éDLDd¢Y$ÄFǧs¥$†G%PöëRÆ¿iŸÿ„©aŒ NþËk£‘¤P\tT¢!íHxÍ•hùL QQÑ DÏîX5ÄE'*dN JÌ›×DTž]lIdPrþbJ‰‰Š3ÐkTNÍ“’îSJNˆŒŒŒŠŽI5kÏ2R“#b’„•lÌ!5":@ÄDF¦d¹/2ÆEE%Ôèðˆd•b£"“Lê®ï†(ÙnÒÈ.1BlØB®:?~(‰í¼FÛùóŽ«ŽÞùŨ9û^6•ÿȯÙ$SÖ£É?mÛ¼ÿ²“¿ÿ8øÝ÷§fhî_g÷•˜<ågˆômàs!$ù•î!¶kõ:SÏ'MèÑbôâÜoäêôw}jμ~hËjÚç :?ýl·wP…Öóÿò“ÈCÛVª9û†ñƒæ~S¶_²Ûè“#‘DD¡¿û6iÚ´a³8³–q@ùÎáÞŸŸKRÎL*ë?)O^S’ýë¼—÷z´ W׬øèÔÏnÕrT³Ð5ÿ\>Ow»½oÍ.+-Ÿ÷Û«·Wƒ†Þ^õ=ë5?F$ ^:´ÃW›ˆbÇzÖ÷nÙÚ¿Q«fžõêÏ:–`‰ºuJó1ßÅvðô^r#sÕ»‡úOüèqË ÕÞ5toÔà›ÃAÿÅÓíIQ¬£³Y‚¸ª•B‹•6ÉR4€)辪™^9céÅ©Lß³¯HY]£°ì[9u鉭XOÖ7(õ¶¢J6Y 0cA÷â¶Ð¤kO¹d·çÐùÕò[¿tÖË¡”ûí<‹F™Ÿå™Âó}»°ÃÛò—“[¹ê¬%ÌôÊž³yÏé$ÙuéŽÉ)VÎœÙVY/MnÍ~ºýÛ°Ìô¢Œs:‘¬º'›;³„ùbF«· Ú.˜PÀÞ@‹ž‚Ôr€åó¿÷µfþàºa9Ò´ÐEçìVwÔy~qïÐ$òâ5ÌÕÚ”ÅSéßðí^½‚70[þd§ ì;fkoÖë®u&œ_ÿñÖ„e;ž>~ôä银)9gÒd@„‡ï5«ã|dëE›šGOîjSÒ~øü=«§t[=©†[_õªÚsz"%ÆO,]ÈnÉ,ÿÂN¶¹”ç_3+Ÿh’ÙÃD- ÅÙEæáçÞ³×ïx¹\¬x¾~}^çû×¹ûì½×Úk­½ö^{í{ï¤D“ýµ?ÐäÚÚÖàÁ7ùyy„ùûD%Ÿ¼§A ¬.ž“ë;9§¸Úë’öÙüŒ³çÌ õ÷\¸î"]ÿÇKN}¾~Æ‚•ˆ¸{Å<߀qc#½|"¶¸‰ˆ¸6Ã=y顤ÉÓ³fÍðð Ù{YsíÛøk@U0!>ñr^ÍÞ>hDˆñBAÕØQ.wJª_œN‚:ÀsØ¿.T"âÉM!¾³ÿ•ž2}öìÌQ~>Ëvå"¢ðÆœñ^ñqcÒ_û¨Y„?fo‹9æùqžn¾ó¶d#bÙùìœBh«Ïî<êrà£ÿÕŠ2‹ê­ø®bÃ<Øz¿güWÿˆ­þx›³0?¸6="*b„½ý„Œ Ä·³â®˜ÑüIIÏ—/I™RmQ5mbâ»Å•®Ž{Ö.NLž‘šë™r®†Ú¸áƒ¬úŠƒ£Ûj^”Õñ¾>Yˆ˜1|Ū-^nîÉ[¯Ug§ô ÙŒˆw Þèâ§bú~‰´a>Ã6¬\™”š6%Þ#lRÁ}5aݵ¦Äºûú¹;'d¼QNˆU;zŸØ8ÍÛsÄ‘su¨­X>+ÉÃt\TP`d‰K5ÈÔ—]Ÿ}æä -€î—²£Ÿ‚Ó…ŠÑ®ƒ@y§äž¢[o ¨ÈÙ{®ÏâÈîcW–ïŸs³–aíå ]zÛÊ?ýr/¯—‘â]‘î™Gç̘1{ÎÌ`¯—7EDؼp’ÇHßøqqS_ü‡Ðdˆ¨«^9;ÙÃ?,.:8 |ÂÑ‹UHüÎTïÈ¥Ç/5ó=Ö1`˜"/¯Ôˆcg¨Îêìì±lW"þ´5cï¥9»—ÌZµ÷êû±.iG^Èš9'}’‡{ðîü’´äé³gMóõ :øÝý~ÔŸ]õú’D@„^v•5å ºp½ÖÕýi^'ðr`:íÀà´ïrˈØ÷çnû„ þ•ÀŸlE§ÏZ?÷4€nžs·„½wéIþËûŸ2S“ÎófÖ Ì”g2âd:PÌœŽ“ìɇ¨ª³kÝïÑõ# ‡{Ï©'Ú:{tüüÝb… »²ì‚_à‰®Nòt÷¾¥&"R_ÎîUGDD›æÄ.ÚšGDò–¸ú§TQÃÕcî^÷”:"ÚòR¸lºØÛý³íbVÑÃïVŽ XÒÈCUiaÑ%¦·‹%bL§ ‘}±‚ˆNïŽ÷ö­!"¢Úo÷Øš¬#ºÿIÚpïL±ðæñe^ž#ÏþROw³]íý¾ÇCe“üí·ä•QΊq¡ ñs#Üß8z›c"ãt‰ØÝÏþx·¡uˆêäà´%ï1  övÊ-®%¡ØÇÞ¿1ÒhøÒÅ.¶œˆø*?ïð¥GÅâüÕÑnãÞÒ¶!¡ªÄ}¤ïêÆÍù—«C‚çŸ&¢ô„€ ä7ÄÂêvÑÛ‰HSSVxîáï"ÿÚ1£}Cæ½ÛÈæö ÃÂ×j‰ö,ŠŽ_°O,\0ÁïÅ]ùTÿ³³‹GÂú±ðøƤ Äåâsñ¡åNái”ç kÔÒÎÅχfcD›¦¯9ò“Xxví¸ÉÛNQÁþyc^ÊeDš3K.%¢KMòòð+Õ)øÄÁw¬Š¨2{ÞPiå¢zò×x{¸‰!êÉí)£&4ÚÃÕÏV;…NÕÕŒ9üðÅšŠs÷™(ªäùÏ/Þs®9.n QwÇ{{]Q•æn0YøK !ëŸ'ÑzÝüÊtDD_lŸæî$òpâ̈ù› BTq䌑fUjhò²‰ˆÝÝﱞQýÍÄ°‘‰ fFúïɽöˆŠO] D¤«h;D5*»~þß%eöW Q1A+Õ*ÌtœB‡æw]1ÀTLxâ!*ûx{^¿Ä$["꽺(c¨ü¶àšÿ´©@@)3zÜþú«Z êÿ´™MA¥©tŒ˜N  Ý¿þøÀäY²ªÊŠŠ mûÁZ]ö%ãŸu#(½\úh˨4¼ ˆ±†¢S—áCðÑ.¶U2…˜¢ßøŽdÙ¯»®¶¾àÈâgS¦XA/ÏDà >Î3w÷iQYQQQQiêéèTtê8¼ü~ç‹«—eL.±K]Þ[ÿ†h@{Ú9Ûõ´h-,¥¹G²ÿÓDì)SsEM}ðÚÇ¥Èï~Z£ý½+’6 0À`£bjeãâhϵ^íI;!ÊK$7x|šåý£åÐp*·ØgZ"ÑšN®Jñ„¦óRÝ þèGß9OM«¨¨¨¨¨èÕíjÑW €œ¹£‹‹•Y£€ô…óíÙ¡™¡š¿…e¥E?G€à<o¬Mpæã“!ÓGaËE{·12·}JhPW|vðç ñ]€ «ût…©h™ÊO÷ŸvLÉ™±õÝãæ¥Ü:²zoCÒªe+V.Û¶eŸ9Äú;œþ>׈…ôÿ›¨Ç¾ÚšújѾ mcV„úLì"°î6 “í°®D0¨»eemƒ‘`‘©îg„…ZEîye œÙþ¾{r0EŸ}Ǿ™d{[)¼ûÚd¯°/.WЅ݆<ï÷[¢,=©b¿a®lLÿ û7"D`D@Ê[M4&pd»w—#’×î4ƒI[G@7ª˜µ¹žÐ ¦BiÞ½3t»_ýÀÜ›ÓêìBw³š»õÎÌðwš ÌLºÝWà K ’™uhö íº®L¨°j¶ ‘üíjèÞÉ\,ãLäâ¡NY­š/. ‰8ÕÜÐÆÓå;æzZ˜ûÚ‘íW‘ÂÊ´i¶ã¯$´ÉZa&V‘™tD¨Õ òß•:eæ¬kÖœXG ËFÆde\¯®*S*l¬D%êÏ-™µLä½¾Lc~þ•Ø‚æØÉ ®<€QýÛ8ÒÓü¸ÿj¯£ƒÀ4".\ï]‡˜¸0P~|opn_#ÃGZ#$¸SźY[ˆeˆ²¦c¸†û*Å/¯ŽyÄ ^~Á–`æ>'Ø*ð¬IØ:ñ»ŠôTh,-~µ s éZt¦~h‡Ì,Ë94…fKj=«©'EÇ?›¹e{Œ ©¶}S›6­‰¾?8qîÍœ/zÿýó¾—7%¥§xäÞyª4j‰ƒØ¶:Uc¤Rü—¼#‚(Çq\­R9/Ë„c¦©e7gÎë÷UŽR#b»nŠ˜´EsPWîLY}£4öÜɦƒª´Ð  ¼JÕÑÖúWIÈueuSÞßû̱ØZÃ7Õ*ñƒÀkÄyÞ³“¹bhðɯ(³ŠIËrN Z:iÄ¡×þƒoõþVmÖ¨5„€:u%µ\ö˜s×G3LS«i5®^Y`ƒ€¤©Ô Ö¦Š®¶UwË»c·‹¬{š«ìß<÷Š£\ÑØòNŸ–l%~@÷w¾Ì³>Ô~ýž¦­5WTÓ¨5bZj¼ÙcÙ«ƒzÀ†³Ë] òX¼wv"2ZûϹû6& @䆌rmßlŽ=÷ßÒ"‚ «äê›ê î;øºÒÛjËA=-àì¡í·\ÒÇöE¦™ðôâO‹•U%`Ž €Ì¼·\8s¥.Õ®K³ýåÝÐõóèmpGÄî~J$@•y×®š Ëü\¦|(W<Å8âžô=8ŒJ¸÷Áöbâíì¥C'×@gïA_íÝ%.vg¶½U184Àêqk™Àäù9!—6/)M\ucÚ´Œ{*Ýcæ$ðu¦â±nuiaѥ߻9‰íW¼çÝ@¸œ½™ˆØˆX¿úS¹Ùwëlx1õ½¯ï"j·OßcÊ®ø¬µ»|“¹1TyÇŽþR+´žÎ÷.½tOù[§ÓidM{SZ@9r[öäˆÎâë]o ýž·ncûÆ)ÌMµB‰šÐ]Û™]ñ óµ ÏýÀZgÜPþÞ‡ÇEr§vlVöÓ Ì=GÙ}õö›âæéå ~ooiæ¡ãÜò×½Úx²~å_ ¯ó€ÄTE……µ2ðÁù…_t‹ ÖˆÇ¿û·ƒ[´Ñ·ˆŠé_òÁ‡áÖTZ‘"|¢Ç7ë—%þú“Ò^S¢öÇÌ-gWý=#ã••§7§ÿÔô b®gþqîœ=™Stû± !òíŠzФã¤)“­ä„ˆPýÓf—jc P]zn뢅*3¥ßœ(ídÕ÷ÖþêþIÌE%˜¿¸,ââêÌ?W‰†qêý¥u3Z­tã¿KòjÓ Æò°ƒÎÇŽð(X#Ôï9`¡Xû]g[4N/¼œô\ª¿[`€O¶[[>{Ç(}é†>åÙÞÁQc"—ŸÒ½óæ"`Zµ²ùŽ% JQ+£Ü]¾Ú·8l|¦ÿ²A]b¼½cb£¼ƒ¦övŽµ57^£RóM~„ñõJ5tÚQ÷µ——Ámá—o?IHŸ×ÚÓ¨” â/hUJµ®™t½RI½&ìkÿ ÐÍ3<,ô­âÁ‚J¥ô Û³&nGÒˆˆ˜1~#Fü 8Æø>}ù؆7{nNv!‚¹¯-¿ðî‹Ÿ]×T.Ÿ;£àfë³1:03nÁ‡7[ÅŒšeóöŠTJ¥V P Œv2ää3åKÐÉÓçÙšpïE‡Ê„‰Ï\‰‹䳩¤ÿη“dmím=×NuY:#sÖÔ¬÷ÆMÒÐÐjµ’×5ê›tê%/žHÊZ¨iÝã£4ÄE‰°¤°Ë[o§r@S^Z;P•?ÜÝÏÛuø­NÁ¯f„‚À”Jñ:%…¤¯÷ízÃÕ+ 6*48sgPL¬)ñ·§'ŒýþžÁʤÍû¤(4Á± ¦Î?q9 vHã[¡QPÌPk*`³i²[Ýh—á£ÃVžé+'^£È/e]PÏR7¯Q±ÑaÓ·úEQõó#'[´Ó£§Ü¬·ÏÛ3Žœ_¯ psqéÜ? ã’{ Ú²ˆ9ôàªôˆÔÇ7[/ÓòJ•¦éY£Tó¢•z뱶êü؈à’êÆ®?žˆD˜¶6¼Wµ¯Ãð·Kê–ŒqŽ[‘=sÅŽü5ûG¥4O«îþ‹_Oõ|kÖhû¡Cíì×øÊþœá=­(lM}ãxÅ_À¿¡@ ªóòeAǘÉÆì¹aø¡ }òYT#Ç3`x ñQ ¢^lQÓ0»'^`Bý—h¼fSuc\'ˆÆ:i]hØ ™mÅ4œÚ¶â…p[ýÅÄpÆÈ5?“V´3½ÿo䬉¡©"Ýh?ç©k¾çÞ]Rßi(¢:þ“„U£±‰‰Œÿé«"Ä€€ ÈÉy¥zÓÅŒTµug3¤c%žŽ}ÎÿÌ…À'o_ÿ’ƒûãTÙlðz.òq³à?Ké%'AŸo9 çdiy‚xäÌx‚ò»5½ú›‚Nvá{S§'™dðß؉ Ùñ75xbä$Hø“98B3@™ñràP‡(m½ ã{öÆ‘N¹e»û—œ þ—}!Gpœ\Æg‚ò29‚é¿«ãb˜mÿvEJ!ª þ¤á+2¶÷¦¯äà$Hð§ôo-Rfí<²‘BT $ü9£×¶>HN‚ $'A‚ÉÁI A‚äà$H Arp$H 98 $Hœ $HN‚ ’ƒ“ A‚ÉÁI A‚äà$H áÄÿ‰ÈÿàÜ5E‘IEND®B`‚suricata-3.2.1/doc/userguide/rules/pcre/pcre5.png0000644000000000000000000005057413051004444016575 00000000000000‰PNG  IHDR è&(§»sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛdÏœ IDATxÚìu|W×Çϵ8Ü­P$„ˆ’àŽXñ"E -m‘*´E‹+^Ü)VÜÝ!@„x6ë»3sÏûÇ&a“l дOßç9ß~>%;;såœ;¿{î½³s"AÄ#™€ 8‚ 8‚ 8‚ 8‚ 8‚ 8‚ Hà‚ Hà‚ Hà‚ Hà"¯ÐÏ ‰ÜPæñ¼Ïg|ý46™sN&#þUX̦¡};7iÒ„LA¼»ÀÝNj?iŽÍB#þ]¤$$Ÿ>½ŽøKˆ¢$YŒøw!Ù,Œ¬@äÍÁAGAGñ/AI& þ_ÀEÇÄœÜM#ô·n?…œ€ ö*R¹A…Úïq "c´C(AP—wëÄÝÞ¿Zo¹-õÑÁßG=K40`L÷dçíSG®,"" ÇÊ\[=ý~""0»þÛçQñXÒ dÓƒ[ü.aVuóÙïZn]øCb|¼hN»üÛÚÁ·ïÇ BºþXÏ,ü!úô†[÷Ÿê%›Ü>¼Iâ(™ï^];dù'ÃS-¤nAÜ[ÂE¡z›¡%\™À¼ç´:ºõð‡#; ÀÃÍóÊvÛ¿¾s|²¡Œ·;x‡4ízdîG•¿Yøóõ—ÎÅ·˜ÿ±(:M£¥ïÄVíñÓ<)XÐÅ™[æ´-òý…âdLN½móè20tÝúMõü?e’=†äîuÚpQ(Õpc^«]SGöþa‚ÎEpo=\e ˾_Ôú<š3c]I¬T2´–ljƒWbéFS‹[®8þ °ÿ—Åï8§´K.‚ƒ Ñ|ñAjÃáÓ\d`Œ1ÑÍZ±’…î\½(0ÆH8ñ¥²Ò'î~S¼-ž<µ¦•K Yáý¾KA¾‘`´º Ü;€v‘»yþe!¿: „§·©¡‘ lï™üäç)@d=M]˜°½_Ô†žqÊ ÂêȈ¹è%€ôB¶Š d™"Š•ŠˆzÆ Øžÿ¹?!¸K5•*×¼sé¥Àœ)/ . pùE‚‰ô hˆú(4pnÞ@%C q‰º²=[7–r{ïéª_,Rº¸Ô/Z\x|ûݪˆ .Ø8ÄûðñG­g¬d‡Å‚œ’‰Ü®OŽaP(Ê)wÿŠV¯(@ƒ¾=.²FÛ©‡s±ÌÔ`‚ Hàò —°RãÁ…Ô"Sº)ñÞûL†´Ó«â¹*é«€KˆÀE9vß^¿€±`@(Þ°-;º«`! ¾vBŒ)K *¥!-ÍÛ³`ú‰ˆÀXL‚±XP)¦€Çû—J æ¥Ø5Œ),7O> ®C(¬:SuC@š„#¸<MeV¬f` —ŒÏ2€nœ9P¡ÅÜ6=øýñ–¸ºo㨘ѕ‹3` ¸ ÀñuÑ Ü«•*pjÓêr“ÆRú"O8û2!ÜÇ_zqøÊ£B]Öœ-ÊÒ£´è-SŽžý­aØ4kVuS¨!jÇ稩ZÔÃåM™ ñ:]B…éüãÚ†ƒÂ,ÆôhÉÆŠ–«UåÑÉ]ïuí ç6PdRJÌ]µþŒœªpÕ^êú“ÖÅOí¸qúÓЮý]]”¦˜?ÿX»¶rϵåJ¹Þ߲˫fHaØxz¾ew·Žb˜V ˜”úüZ@” Qû¿»ýHj6c«R ð HàÞ•‹Wá, 1ŒÅì\§ôZ©È™Ïp¨¹aÃk¯J€ÂÅų€£Ò0Aãê¥>µ|bÆù¶"ÍW6/%IEZ}2æè¢+›¦[¬Ü£|P§yg ¹(¬Ï¯^ªÐqŸœ9‹Ç˜ìP7Èëî®3Å#4®^ê“KÇ(ÝJ×ïÙtf£è rĈyš›î2p\«±sEëÿX¸–17ö*2ÊÌòÃÌÑþćãAÌå'ö¯sÊ’cŽ!¾æ§ ÿÃâ¦M|yà»^5Ê<Â9¯W¯^Û¶méö&(‚{­ügû SG²jÍ«ç]²ãÉ ¢|Ê€-å†ÕÅ¥ba[jìËäXm™-S/¯a¥:¯,”°ðÈì>†÷>¬W"Çf¨bª=]$”¬XÜ¿*O9È2G”$¸­’OhB™i¼Õj×D¶ ,`3¦¢-õ–ìâú~yOÑ #T í¨¼M ø ŽLUh@0Þ»õ²L÷²RVáSy¤DŒ C‹Ñ¤*塲}ª‚^Èc,jåý?ô˸Œ©‹û2œCd‡Èu¿ì ûj$aŽØ ™ÚË~Àsˆ*cÀ@¥Êò½,jód³§«vñ¥§Œe®Ä € Ò\T”~_#Çןéâá!êµV(¥sl< (5Å);Ï>¨R¾Ò ™Rw®ÞÓ¨sçc ¦Uùîk´ýµÑ#fÕ>MQDçÈCC’ZY„ž/!¢f Óˆ½·¿P­>ñõ ĹP)¤rÜæÙJ5¨=àÜÑSJ%uášîÓÙËOUP»ÃÕ%Þs1ùÜŒ®…:®©ÚzZÝÒ·¬Þ­@9õÖUfkîÏÙ1Út*ÍgÒPS¨¦‹Ù|ån’Ê\\ wl-Ò`('…#HàÈŽ(”–G‡®TkR#]Td³Õdܦ·YÄ m³XŒ&àP®í’2^×— ^5º[µvíÌÉÉ:Ì^*±|Xزþ!É:7jWG{nú¤Êáa>² êõrhò•(3Jqç7~¥7s­z›-cHÌÍ“ ŠVïh}¶vùðVD³N–íRˆ¢Q'eh—hÒJ@YèƒY ;{ÿ:2bÙÐŽžÍç5iZi… óÖÏw8®Õع¢õ¿}ˆŠ rÙlߦVƒÕŒ 5S0°Y1@°™)Ô Trmþ¤&¨@¡† ‰ K(¨˜J 63cö,в *WÌÀj&0íé  ÑØ“b*W`63*]A–TnÀ- s•C+H™ýá; ‚lYþ_yFD›øòÀw½5jä\ózõêµmÛ–no‚æà²ê=É cBfæ–1ÆEà. ÁfN4—‹`ËììÓï1¸˜™&C lRú·Yˆæô²¤Ï_%%¦ŸÉ$KzñÒ/·?Ç›þ70m ;T„ ¢AGAGAGAGAGAG A A A A A A$pA$pA$pA$pA$pA$pAÀAÀAÀAÀAümäu_ÔÔä„ wJ;? L ­Óß±WQ(¹$‘õòcZª$s²ñ›–ÿtãú5`îé—)”;wîLHH ¾L`È‘ì?ÆhѼ™Ífc´Ù5ñnÇ+âíѸ‰ãÁ¢< <' ÿqDQ$u#œ–ÈAÀAÀAü;P¾ó•¢(J’D$þm ¢(Šd"¾[JKKKNN& æØ;:‚pÚ8«T©Bv Þ]à‚ þýÐA$pA$pA$pA$pA$pA$pAÀAÀAÀAÀAÀAÀAGñß‚’L@Ä¿   co¿Õ&EpAüë˜d@&23ZÃ;½¸’"8‚ þ5ʆÈ“*E7TJÀl¿%-ºc¾TÏ%ðƒ’cÞa¯t8‚ þ-ØßݯAVI_n<£;„.fÉUHã&x§oIà‚øOŒAY¦laÆf”õËŸ/Dƒ†‰‚Bmý 7v8åm“öd âŸG–›À•L!Ø—8é…»äÉ8Pªd™‚ÕBz–ý˜£‚19Ì3ÿÄ"C††¾–¦ŸõÑj6š-\² ¦ôo¸¨7š¹Þ`àyËE³Þh}·š˜³(Û,&“Å–Ë9Ü`0ÈÙKâ`gõÊ;KïZ¯<õ¸ðöÅF§É’Õ`0"·éõF`5ÌV)/:¿OSËå|›Åh²H¹7K|—ÊåÉò;4K«Ù`¶Êùç…w½g‘[ÌF½Á`2[ÿŽLˆf D{ Å1‘§È ó”5j“ÆT\®:µüŠ¥GsdöNcÔBàcLnsÃÊ{»«~êßéYÖk,™Úõ“¹I~hÕf¤ Íïå¢k6úáPT夔n£†˜RŸüv²½èO?ì2®¤=¬þááó'‹ßø¼Ú¬Â£ªßá…ž]?éZ½Ïò‡+Ònîê;ú[«w…‚ÜÜ­£·Ý\ÌøxôGã.'+J»è ®çý²°rÃðfáÅGî™Þ®cúö ºÍ?Ö³~‰ÌVpõ¼µKóª÷/Ýì;°#_جꖈíǧød³×ó½³?Ý|Í”ôÜVÄéö%U¤äaƒ&`é?x¨¦=q‘Æ 9iQ·§£ëÿR¥KéMáÇWΔ 5z/D'%clJO_M›_ô¬À¶ö ]×äÁ¶¾?Ž º]`ؽ?––í¼x¹ÿ’ÚßV~|pìÓƒ‹›Ì8ôèÔöliD?ü‹ÕP x²ž˜:÷£¦ÕÁš2~äð3OÍ‹àË4õÈ?P¿ÌÍÕ‡\èÿ¾qO‘âž—.\j:`æÄæÅúŽ˜Í,¼_ßÁ3–,+'Ge·[AuN×wÒÜùíFÁeð{óÍ=2±Ó¤ä°[«F’“:NÿB°=o;q¼'³%ÝíÚbº¨Ág©ÂÄù+›ëNX¼×ló:êæ¢ù_wl\·IdÇqz1öfJAßo[‹ÎIÚ;§µ•{ïZ0Ì15/€{›f·YúàÑ‘UÙ (êcz´laÕ@L’<껥ý‚+f6Ë¢®Š»÷^º<ÿâù£ößð¯Ù¨ÿô.5ĺóØ›O…:¿nžS&¼ÜԻѦf¶õŒ¿X­Å”«W+þã·´V;ÜxA:úkÿš}Ÿ?YRmlS£j§Õû×wsÔ§ÍrÇÕW,Qå§1Ã7߈-_Ü#&6¥Ý/&4+Þgø+/xÇž8fFzyÉ)bÊ —,._@åì,æ—£‡<cò°&®ÞvѲ/¼ðôø/£¿Z¥)Y9îá³Z]',ß飵sâÂÕ›«ÿ(Ù®C9 ª`…7å® ãËäfÞ·ÑÜ4²«YÐrDé×øzµÅl4 ­<«š¢2"S¢À•‚ x—Õ…,ºÿZ8ò¨í¾uÛݵçæÖi0@‹¸`Tó>Ÿm²ŸriaŸÖ³DÄMß´oÜnýà³ÕCkvž‡ˆˆqM|ÞFDÄÛ‡}ºúœý„-Z4ûôGÄ'+}jø-¿jBDDs³°zçžÐv) F˸ô2XïÞºe°òôÙÿáS÷ùGN战öÐ?0ò¥UÆ[³ëÖôß÷DBD4F…„ÆèEDœÚ;ø“E§ìkìÛi".ý¤m¯iëíOÎé0p9"ê l“„¸}b›îß~•ß«?2‹Á£n?Š7e1—%!((¤ÛìýöO³ºÕýhá=DÄg+üŒQ¾\³I ""šNŒ¯çã÷ç ŽˆhxÐðº^ÊÍŸ÷ œ¹é©ýï„í}º¯CÄÅÓZ7î2Ö~Ðpll¶óѪK¼uïq6'bÊ­À:a§’yÔ_ŸvOOüÜ­q¯oí§DïžY³ÑG&Äû¿÷ nš†ˆˆº ßo:õ×çENµŸéÔnN]qÓØö.¶L‹}|÷iBÎz-žÚ&¢Ã»/~ß­vˆxxéО¯±ŸÐ­]xŸö!"Ê/"|ý[}u;Õ©¹7!{--©q·<͖Ŧo:„·ì­CDÄ› Öìüs¶fùY¿–?í¼‰ˆ¨{ä_?hàšûö þÑì?róÈË-ýí^@DÉ'¨µQº2µ^ #Ñ6DäÚŒf‰Ò£Û7“Mr¶œ6ËycÂÆ-¾c|q>0¬iz“K½úÉg‹Ä¬^8´væ×K¥Û°w³¾«Îçæ…}ßtn?r¥ýट¯?Ij‡~‘M|–ý‡ˆ’Uûö]‘ãOƒ»|¼ìPF1å ýu_ws1ï;3é~‡ñß ˆÇ6q¿Ï¤'Oév"GEäéÿ9Þ€ï@†¨ Nï?çÝ0è=% ¢WÀØkçW€Ô³§ŸFôëjZý?Y0zÏ}—ÊÔþÀ—ñ/+'ÄÚÀfÍø_ôƒç)þµJDEEE=~R½c7Ñ_ŒÀâ^§»¯+"W)Õê4“l6`>gÎÔÕkÖtWg¬#gô¡7Öî¨Ù!$«¸3KÁF‘ WD¦e€Ä{·S‚Û…ØK;¹WyŽ ;qü¡o“ਨ¨¨¨¨rm;+Înx*ƒG•¦ ‡”í2`Ö·W¼–~ÒÙ+K8þ˘w¥•‹¹æ4Ù¤!öx¾rÖ„ Û$n« l)™=”bî¥üÀ²ýžéí:(.UóišmÄ¡öô®Y­b6'Fß¹ª,W:¤ Tì|õúÎò`Þ±éVàÇcí=]¹6½ÊÆ_<š ˆ¨(ßÝ=+—Ó´«(r@ª»׋¢Ä‘§Ïî{•¬X½|Qg}¬­f`WW@¨Y™'¼DùÕ…ÀmmCë %¹Ðs@x—((¦$cÖZ‚¦`ñšUËçœÀ/çÛÍk…U’^fm– s”¤ŒiS¦×¹Š}Àæëö,úÔ[†&ÌâTN•>W‘1¥^¹F­Â®Ùn7§Í2½Äj÷bžbÚw¿¸cñòýá«aJ/ bÓÞS{„ýcßîmÛ¶ÚT<6:œy@Ü·ývðÐí“߬?úewΞWV)ÿžíqTTTÔãÔ:ïÕºtñ$(Ô5jTW2°Ê²‹2sxÇÜÔ`3Ù 7ó¾ó¢•¨æ`ÓaÊaó«‹¹¶âÙ€AæºÂ_™üËÓ5ÙhñиÚ†éá¢!ÕìRÄ ìw?StQéô@¦vË(’}åƒk%¥ÇŠ/G«Ò²â%]$ûz‘R­L¯ æÑBŒÁog5ÿ8 û7jWE†YØϦÓ[Ü º¥?vãYª tÜýðœ1§{ŽÌ»¼»Á è>mGê ôûä7O%8èÛ[ÌÐjXf„×_Jª3î"˜`Þ²¥p¥G‘¼´“Y¯R¸gµ±5Π *¬Ê‚®¦D=T;8Ø0+Nìftæú¼"{¦¹œ^¨T(ÒO@æªÊ*iyÌÂÅ3ýl&¼~A…—"=i7Æ,jßúîõ*¦ÎÓ‰N›ezÊØ>sü¤q¿ÅÅÅêúÍ^>ºMmÇòš©=–^W~ºdÿE;B¤_‘¥ç¢Ó ,ÛŽ$È}jÉ,þ_1¯C¸%‹”}ry€’Kã*~ÃT 0YH_™úëyic¾›ã©½ëîJ fÛ„€ÆSŒàѲÁ¡%?Ø+¼ê“9BÓáUs+€ËZ€¢¾•Ë-Y±ÙÞØÏéÝ|Ìî\Û‚ `’Ù`oGh<°kg’‰gÑ—{+bßëWU“—; H ÿ2‡Vo`Ú {RêÈÖ!»~ša/ÌÝßƆôý®nûf·Üx~÷šÛ¾m=´ËcòÁ_ç¼obÙÛ7>úsϱ{Ú<9[¡,) IV]†mݤÓÛ/$2ÆLO/ÜuuïVÕ5· y—xùô°M\ûLÈ=44Æ=Úyè$s,BIŸú1O¿þ3€éÏ.ðªŽÃ[_ûi¬]=üø‹Á¯e„Gîî°$«\sÚ-÷ö¥”­Z] IDATŒ½¼~jß¹y½1˜R´êÞzt˜þÙ]‡Ïå)—WÍŒ¢”9ž ô©¿ÿyµ¡í¼{Ö®7rós``*;ÀëêOMÃúÌ6ci)àü‰€!c§OÎ oÚ²ßdz¾›¤MÒ€Õ¤Ï|„ESšÞ ×þ˜:gIv'º”߶oaôÏ4hP¿Í7×Wl[\ЧÌ)ʇ‡‡¯|Qaë/S€Û :£-sþK›f@€‚Õº•Pœ­[7øjœ”Ãnss½OHÓƒu¡­´6¸¼zÎøÅûsV-Kd“Vg€àÈÎñ~ ŠìdA0èÓl²}…†´4[ÆXʤÓæ|öÅéíŸþœý!Ç76Ë¡½›ï˜Ù¿ñ€Y @áú]7±{ëÈzuXÃ>5°FnQ×3°)oÖ0¼]ç~ºjµqÉVMZ½9{³óŸ;óÔ–-ÜÌÙ,ÀbÒÍÖ’þG´v‰   ëµhê¯Kª8z!ÞmÊ÷ŸîÞäÓýŠµËg)N|ÖoÑŸ ѳ¦¡}¾éU¿®¿Ÿ_@É–ÓÆvª šª[,~òs— ÐÀàÆå:|5¨Y90'Þ™8y¢^D€ÒË7,¹øm—:uý†­K[upKAU®æ}}cÀdg\!©ÜTŠºš@`OXåçwy[‹à9?sžõ ç™G8ϺØépfö«².‹fK/göNþàÜñJǤÎA'Ùf-XÖeRîXÎ[#Jº‹Ã÷Æ;µçŽ)8­ šNŒ¯ÑúÇÜjýd-¡c^ˆÖ)Ýz¿)þz'f±aî®É¼Ì©ë9™¿± ¹\èàÇÆ–½Næñý†ç–EnÍòºG~‘/lyóHί²T!K³ÜûÙ€]1¹žžóPÎÄ9æµm¼¾¦ö[ÆI]²¶Q'÷†3ó¾#eɺS»ä“Ç®êOKü/-•¾†¼>çäs¶0Õ!leŽkYÃY§Á-s¼ÌÙ™ì5d}žcRÙÊãl%—jÚ/gÙËÅrœýðÐÑií&dŸÌQ„l6ÈfÇ,ý).*Ö˜-'D,S¡²«JÈ­Ùò²Ä\-Öá“X9Fدub¶D_k¹W²¹Þ™“Ù«Ë…ohö/LÏTé8"‹G²ú‘½¦!:,Ýd nq루gÙ׊ÕË–-êâd¢Ôi xâùQÙ\OÏy(g_Ù8sm®5u~fó‹Ó,œ™÷WS¶•.É*ùº#à;ýÒ4/‹Úôcûÿ–«?öZYlë¼^¯Ö:/ÌðãE¶ÛI¶Mùqm­’.d±¿ã³ÃfÌ[ñKÑÌîDw¿ã€énš¬Ì\.ØhÆ‚¡UYì§à€! ã2C!ýÁ8‚ ˆü[d ‚ #‚ #‚ #‚ #‚ #‚Ž ‚Ž ‚Ž "9ç\|uD´qx~þô€Ž ˆ†( À™þr *¹8g×·Þ’ÀñoŒà¢‰)¹ eª™€ã ™qÈ¿ŸÝÓoQ ‚øÇáhpဈ,ý½h〠• –oEpAüócT¦yöÈth›(0Lá˜Â¤Uë´‚œŸï¡Ž ˆÿÚÆú3GË¢ @e× „ú °XÉb{wþ³¯,'‚Èo1÷ €&eöLÎÍ`²æÆEiß.€‚ø ¥Kº ¢Ëú=¢àŠ Œ s‘@£p³ïô?'pèìSÆטyÎ;ŒÅñ5Ÿ2xçôÿ’Aþùæ0H¦yÿbav<Α„ýåú¹TûÈápn$gª4]óOb —Îo_Q=‰cbÉ«·Õ æÙ½;ÏÇøío8YwïIâÛ^%&FÅ$ê1ñ¤O©ª—âïÔ.Qc¯ž½ØÔ±|«UyؾŒ1ƺ7¯¹üÈówxr–Lu,· Ú„×Þp66KúY« ‹¾ùj£­|‚16¨õ{ßüþ„ýƒ¯ÍÎndŒ±î5ö=f¿}ÖuÊ‘lFàæ´›÷^ä©6¦—5kû>H³1Æb.íîÝ2¸Zõõ#;®=|1&Yóux Ÿº¾ >[z@D†ˆ€ ÒÔô 1>Yþ~…È8þjKnnP«ê͉1v|å§5ëøÔMÇק^Ãió·8cÌÔ¹Zq&ÿ lø/£7ÿS °Ð÷ß$Ð(!åÃc'(E‹YDÛ€ÞŒK쟸lÝ"æPXtÚõ!"0¸`Õ7ËÿtÒ=":¿ü9ÿó'eé‰UõÚ6òWxÖ˜02¼ JwÛ½ïC§}nÎßó€F)äì‚ tÈÊá4ÇL5¹Ærž^j¥[øªQÝ5cb"§‘ˆCšµôË÷>˜Ü¹â«r¿!lÉRÉ\NsÕd¹&›A€|'ÖÔ°¨]=Ý]•ÙZqÜý“fïpÚa¶’1æåå%0€˜]Î ÿtÓý{wŽ-¹ê«!›ï&=Z9eÒnÝñs——(sõÚɨm³¿;x—1 b£.•¬òF©ñ*à™õÆ<½ (¥Æ¥¼oë«é\»qv“öÈC',p±xh 7˜0µgµÆY@Iüm¡S¸Ž¡¥ââiqÝF3Zã*VñŠŒñý%2Æ,ý¼iXH³N]LäŒ1Df{qiD6¡ ú ýì…1Æøµ9>Ly¸¿cÓ†ámÖ_IaŒ=[÷i¿÷Fø¹é2ƬÑ'‡tiÒhè—¿ŠŒ¡½ÿo|êÁóïFv 8õdìúŒŸ‰ÙýãÇÆÏaLžß! ë’ªÇBºnuO¢¸]ôÙ Œ±¨µ[Ž7'žëѪQXXó_ŽG3ÆciOÏõlÑ(¢íæ›ú̊Ц›7i`£Fa­»¿`bŒY;®u×)öJ±Ä½Áµš\1:Þ&¯2 Ö·Æ4kp;AÌÙèTÖÅã{†„†õŸ’¥ ¦ÎÛ60`KŠbBëð‘žMê¼úè£ïFtmبÿ”_DžÛ½Ää‡;j…@ÆìAè NÁ›Î$±¸“¾‘½S£~ }l`ú6\¸7†1¾¨£_¥³n‰Åî¯ê1þÌáeS#ÃBZtyWÇ‘1ÐßÝק]“ðs~?ÇCQ×8¢aÔ£?;„×[u*1öòâ–n­"6lüÙò#È2–t÷`hÓÖf³’vÍ÷èÒËÓÞ˜xlÑ„Fµé=ᥒŽ.k7v¡þÉÆF­ÌŒ î¼ûRÔWƒÚ‡„EN]v’ñ¤ }Z‡6^°ï†CÁ…M ÷Tøù †eÑ£JääÚêõGc®DiƒCƒLQÍòe ‡…U±_p{ÏÊšƒ½¹#uo©JØã^Ô5{pO»÷¼¢œ¨éS€ÿЦ΀5Ï‘B¹ †ã²²cQ’˜Ué6A)”^:Ë\`Šü£¾q;Ôù£ºu²,55%æú߀ÆM2ꎆûøm¾«Õjïýùk`£–Ifïÿ\·~Ðô_O Æ„'§CƒB¢Ó$Y”W~ÕkÀ¤5F½QŒßßÐ/àÔý—ZmÚ¾ùŸDôkÏ£[»ð†]§ÇêŒfSÊ÷í}{/{,Y-z5ÿzÝI“ÉŒ(Ÿ\9wÍÙDDÙ*ÊÈe«UDÄØú÷܈ˆø|‹_à°o÷ë F]Òf~gc¬¨»æÓ`Ùå¸ÔÔ”‹+Fù¯9þ1¡pý±ë¯¦¤¦&>Üé_ÿèsDÔ¬=ã”?îòÃÎ;Y 9fÊm© ~œ§—²™©[»ð°f]MÑ&ÇLh\§Ç/« i£ZÔ=ò<ÅÌq\¿È 6£žéŒFCêªÁ¡'ÌÍôâƒmÕCûenÙ¿}ƒõ§0ùLÿÐ^#—Æ'&Jˆc{ÍÛÈO­œ³ö\R¶oîÒ(òàÍgFƒñÚæ¯ë¶"!Úžý\7òò“øTmÂg=‡|}ECxXh‹®3b“Œ6¼{è§ÐÈÑ É©))sú·é4s "âïý8©MæY ‘Ë_µ‹Ü|57}Ý>4²óþ{/“““–|Ô:lôzDücň¶½æèÒôqp÷Ȉ~3“&ݳ+ 5ûàóø4ƒ5étDàSDÓËÀà†Ó¬Yw>•G5 ûâØSÃÉ9µëE,;tnLóVY÷÷Lîéþ€£³¦O»8ùUõeKLdÿíDO®û²EŸ‰Ž­úØÒÉáýÆ!¢Õbåˆ6«UFDäG—}¿éR*39—d¢ÉÓK46Áå‰Z’YæÜ&Ëù¸Kªò * Ú#—n}¼i}Á¬ OÓó j8ÿv±ÜrR¿’ˆX a·òÖå[¢tCÕ‚Yª0¢°‚[i… ãôær^.j…Âæâæá²ùãE‡ÿò^ h9rÒ¼_:ž·B€¥>Ãz—ôtpkÕ­úA]US¹¸¹ºº Bè‡cCQ­d Vgë­™M.:yb æþ~oÍ‹8í£Ë'¬ïò+Žõü\~C}!öľ[Þµ/ôð(زsØêý»þˆÖtƺeÁ»5ý¨Ò­Â}ç¶{w/c µÒ3Edª‚#ÆŒ…œ»B¢Üuâ'>% úðÃjÃ_†Tά(=‚›§— 9²}Ç2ž®n½gŒ_Òj~’ÔÌ[ùýž,)?ž;¸˜*ËÁÇ… b–Y$\ð ¯UF…X§KÏŸwÚ›ÖÏ疶¯B1˜ðÓƨ¤ô¸¦ß—ÃÊz·Ì]:íZ¹¢*·â³Í5¾Š™Ú¹\±jcFVGƒ¢åTŠ±W¥ö‘x™Z-ZT+ˆƒ>ªÿãø;€»‹’)Ôž^(uèÔ¡°› ¸U­.Éï6±˜—;@p½â‰7žbH¥³r`œ1¸ßíÊ÷4,覆m~Õï˜vÅ`mß­Ÿ_Dçφ¶eÀ¬/<*U©*ùM†3%=šÿóÏ2"c˜ôâÁÁƒW'¬Ù€jTj5 ²ˆAã!§%‰|ßÉ âå[V½N-¸0`åN6*4n‚‚åã©oº·xLªÁÝ»°€ °jõ`Óë{MJ@úf±ªÚñJŒ ªº—,hßt–1Œgy+€xö&Ä o±EÆ0ž§{Œï3@^ÄÝîJ•Šq³6óÌ1W®A¨K!ïŒ3ÆáERjáBE2.W¸zi€ ± BêÃ-Zد2¦&p}.%~í¢´ðÜúÃ?*0÷ÍsÛlP.áå•^M¶*dµ§ä]´\zZîåUÊ8£ ÞFàÕž•T¹.;d?¹tUúñBe=M÷âŸ(|`a{<‹–÷- °‚‡}F-õN¼&öë¶-¾µ'(Å7“ œ·³Š3Žh]Ú–ñbv#¸xWM_ÖqÑZr̺ɞîv+ J`å §W[!—yö‰LÛ±=4ûôȈVöQ|•À¶K~oóI㦆uZõÍŒ^ ã#®\ÄB¡}»YÒ²Q‹z~Ï_²”*]€#*+5YØK¯È†õ†§Ü8y[WaÛ±ñW¶N=¦8s¨5,˜Ð²ùˆé—|§p¤ÍðŸŽ9àªÈš°íYÛ¦çï:_«˜êAŠCÖò>éÞ' Û§&Œ½Ö´ó° ŠxäܽÑËvºæ–L©Æ]KNéÞcbߕ׮¹X xŽ¹9—v >ÑzÇ–a•³Sµe¯6‚C«_8|È·ÅȪ8tU¥]mÂ[Ÿ¬QÐtíùó‡Óý`ò‚_ZŒìº;¸¢êôé‹£tH¹¸õð9è`&¦Æ>PºUóÒ8SÞô½KÖˆºnè°ûßÎ_ôVܽý‹û/»xnÇ*{©æΙִ۰c¿‹©W‡ˆgI¶¹«÷§ZAõ ¥—\¹qõWmºÞ>WY¸ &Ekru­²çÀP‡9̇jüûàð磧ïYþe¶bÿôAÀíWX–‚»¿Gß Îl÷ï Ïc•Jné1@ݪpP™‡Op¿Ù\@æÛÞ¼Üh3µZmšN/Ú—š8¢,tiZ­Vo0qûi’9Ukàë[iZ­M∈²¨ÓjµizŽˆ²M¯KÓjµ:ƒIN_C]šÖ"¦¯~I½Voáˆ\²¦iµiz"7¥iuæì —²U¯ÕYì«e©Z}æ¢Kfj\²éÒ´ZmšUâ]šÙ&!çˆÜdÐkµZmšÎ^<‹1Mg°ØWíe]jªYä²hÕ¦¥Ù‹—Å\Ú< ñ­¤ì…ySP¶™´Z­AÂq}‚çízl1è´Z­ÞhÎX tnwY²¦i3« µØd”m©Ú´Ì¥BƒNk¶Jˆ˜tïH¯u/²¯¢néØo«ÍfÖjµi:ƒÄÓóÊ´ŒÉ*f:K”y¦»eѪKÓjµZƒÉÂí%qfY²iµž±âe1¥é¶Œ5`SªÖhÏÌîpÎQ¯ÓšmvÓq}ªÖ"¥§fLK5‹¹¬Õj¥Œ,$«Y«Ó;6BÉf6_ŽhÒØyÍJë›öOÅ^;&vrx&âþ’&#wh²=û"™{NßÚ+¸PcpÆXÎg¢Öwl·½Û­-ÝÙ™þ¶‡8ÒFDZGýÛ<(s¦d1eø¨ÆHUªi@ÆÇUÊ”~‘d–ÅBùªH$pÿèüªý¾qPÈ׉å_™‡x%AŽ "ÿ»(”m‚ÀP‚ $P¨DίŸ·DXÕÏ¢eÊý#«¨D¾’dùIÕëÖxò!/R7âßtg â €‚‰Œ1¥Ä˜À¬…,Õ ’*—20—ül±J²9AÿX Ç@Á’1`Œ1†jw%qô'âÁ]è]òo•†¨Aü³"À!ýa‡y$” Lòo`IGÄ¿Dõœ~øKÐAÿyX®Hà‚ Hà‚ #‚ #‚ #‚ #âŠì[Æáÿ§}Q ‚ œ©š„ˆ²$Û³ C. %Æù?º/*AD¾KœÜ¦˜JBûcoÈ$¥M!$ägGGÄBád¦’Æ1ã ’¦T"Òƒ¾Aü†!ÁÆl@%¦lhe€²M)‚#âÿ÷u_~ó²y ‡™¬ýMÚ·Wæ_G?¶'â?€å½êâÃû.÷®+ªV@K)Rبt+ÿüq‘}ʃ:cæ9ï äøšO¼súÉ ÿ‰|sÄѼ˜£l9žÀ|v–Cæè´œïjÇJ¡SË;­¸Ó² sÛî+Ôà «×´i3™nÝ*uZª2áËWS÷ !ÆÞÜ}üîÛ^eº{ø콸,¡¦xÒ§Ô{—ão×*^cŸž=ßжTó_óðæ|ÆëÑ¢öŠ#ÏßáÕ¶Ž™îÕ±Ü2há³ñ\l–ô³V!öä¦Xk>ï¶ÉëߢÒì-ÿÉWöf72ÆX׆5þx*3Æ¢Ž|W7¢ÑäƒqoKg<ö|ÍÀVlþµ*¾§}SQßÚYŒÉ_FÔØœÀ²µfI¨íS÷fŠ5›Søæ ‡Ä¼Tôì¤Ò!Ÿ3ÆXÒýÛ‡W­V­ºOƒŸ-J’™ýð/ÖöhþýYÆÌ+¿T¯¾__Ÿ!Sç3NØ?­á)rôŠ•šÄñWïXæÖ˜€ÚÕn%±{6óÓÃÝc4ÀñèÝË`­RU,.{ÿàL hÇLÕ0æ^©¦ý™‘Nà²÷Nú4tI!"0¸r÷ö#÷œthˆÎ/DÇÖüzæ~b–ÞNÔ!²žª`ÍÏÇGq2=vÇà4„Kß.ÌwOµRÈ­+άæìH2õv͵«u÷ðT9îPŸµ °vÖO/QÈCLä´·wˆk²–~åÇŸv©ôªÜNb¨œsx1Ë5٠¬—žËMB*(’f|±oÇ­g¦ IÓpÿæÙÊ>ݦ¾|ëI“êßÆYN :¹JÑqTÓõ¿\ÄÊçéé)8È›½5<[0'ËK“Wºzy¸¦ÞnÓû뚃>¼ÿÞµ}®¶Lš¹‘1(-\÷||çš×NþõI™³—.F/uùÆ Í­-Ó~¿ÂHþírr‡ÂLP{zºgÍ”yxz ÷?¤œ ¬Úè£bn…^ë»ÿ6€ËˆQf ]mi¶KðêIϤ†(ŒüˆC~†Â]͸iͬáAõýƒ›tÞw+`ñ7ö÷lÕ( °y×áWbŒ1¼2«|‹YQg׶mÒ080lÞþÀXÌÚI}æîypôûˆv}cÏ/nëÚ<¬Aý€n£¾‰· 0ÆÚ4ªuàüõ©:u:Ë€ìú—m¿ü3fÛwCÚŽûž1ùûÈj-¾ À_ðÑàÃG ‚Øß»Wïø0Æ®):,îî®NÍÂÏÜtÉþäçWv¶ ­ÒtÁQí…YSžLüA`PPX‹GîÄ1ÆέÜl80†Èø£uµªFÜ0;6EÙ1Sn}àSýF¼˜óa¶øƒÚùûù·2Û± ¦üôû‡uw”£"ƒ‡ï6ªcíy[/|úa»ààöCf¥Z9s.qLº¿¹¬_Wd,=®iVk͉{¬b½1çÕ¯ç¥gÃ;Õ™³ã)c|NãJmæ=dYöz`w—¶ñúdžïF‡7 nؼçéh#d £þ\Ý6<ȯ~ÈäE»%ÆЖVßß÷úùß#뽿ü„–1¼¶ga‹°À€úA#¾^o0–xkwí M2f3¾Ø¼°D¯®n×·.³4Z^Sä³pËü?ÛßÒzuïæúƒº#·5 ;—~:äIDATò9þ@÷6ÎBÆðΡå­Ãƒê~ôÅJÌú¬Mí: ncŒ±†µèýÙºêõº$Ÿ\Äs’ëŽìÒįNÝþÓWÉŒIÆ؆Áݸp-¨ŽÿÉkûËôzy{k»ÈP¿À¦»n%Ü9¸¼uãÐà°¶G¢-ŽDôÃÛCZŽo[yìÐøîÓ;À­ÚSð)éuç…±V­÷Ì2¢0gåºï»ú!‚õÁùG¥*W|íp+öìÙ*¡mµ/_”è<œ188ºU!«þ'vôBtmÝR,]‘‰?}ß²'(¤$4ö.c>ŽÖß´é3~Õ·íÀïv ¢%îj½Àðz ã·Õ ü󅌈)÷w‡†Å%|0ÏÏ×÷›Ñ–ö ,$èqªˆˆ¾é;xÚfD4?YÒ ü‘VBÄË›f†t`Ϥ[»ˆ ^ßKˆˆ|EºçÞEÄOû´˜³õŠ}á+;Û{#5sËÞô zw|èßs#"âóßëÔñ¹ä*""&µñ=eÆÄþ5CvÄ""ÆîÔÀoÍñ(Å´÷ñ›y8Ñp¥•ÍDDë×m|ÇìŽGÄþí‚V{ê¸+#wÈ”#rQ·ñ·ß’Œr6;ukÐüãDŽˆ–™­}Û};KÄ„–õBÏ¥Iˆ8®_ãÆÛ÷[ÞûIã€Á[rÛR|°­zh¿Ìoû·o°þT&Ÿ©S7¨ç§;íÇÇö š·;‘_Û¹fïÍÔìû¢nît5΄ˆÏ,®ÙÏ‚hº¿,¨~Û&Dć6ê3yŠ†ð°ÐÆ}XñòÖ/ÃÛôµoà¼fl·¦~EDSò“µ¶Šœ;zsŽ\žÔ*b×ÍxDí‡á·däˆÈc×kóBDÄg­}[Å!rÙÚ22ðäô·pâƒÃß7lÒÙ #"ný¼䈹ˆ¨‹>Ò°‰ÖÊõ~]£É'D´Å· ³fuŠ%!((¤a§™&ŽˆÚÞ»!¥¨¥þ †1þ ß¨µQˆh:3=°ÿÏ{ï â“Ó‹5ï'q´]˜^½Ù,ÇM¿íµ^ñiﾟýŠˆi··ûID´\YR×7`æúý#›·´¥7Žˆ§ÖNë9y"J1kø´‹s( l‰‰ ò¿(fkeÏNíÞpìÎÿÈ©“%ù»ï$é\\M*fRiÆ Ñ&åçÆÏÂâHHºx/ªoïö€¨)^çÈÞß+»û¾_ïÞebX) U¬"I›¤c&e!í+#‚ʵ$SñF‹coºñÓùåÆ®ª\@~]‡yp÷„É.±â!(XPûê)×®§OPƒ}¦V¨Û®W«Úíq»Ó¾Í"”Ÿú‘/"q+䟬»{ü¼Æ·~û’€%[ͪT„è㇪ÔÚ¸€{Ý|< þdÍÆ“³{î›Ý3®ÎÄáåÑa*„¥GC ‘)=»õêUÄMÈ1Ö•OåÍ@Ó±Wõ´›7«`âe 2ÅVíÚ+X³ÉWV$ŠoÚKÜuòWí²wê´ëÓªVÁìCÜ-²FqWÄÿkïÜã¢*Ó8þ{Ïœ™a¸ ‚‚ Š·\%³ÄE'ƒ/-^Áó®hÞ>©å¦Vë¥Â òî’­k©©å¥ü¤RY[©»jÛbb¢yC ä> 3sÎûî3#sÔøðiõýþ‡ç½>ÏyÎû>Ï{8,8vx§[?~RŒÝËþÖñ…µA0`æÚÃë°t+ý¥$˜ö¾ûáS/e+ã2–|hü;¦&%Š„0û a´æL…áñN·Ï~×wáŠc m—Ît1¿Xú‹ŠÇz´¾ev¯ÙÞçå^$.Q>zà<ƒOHôÚ?û¦¬þlê²]omxU eàô^Æ­¹z×¹z5kž†ðÕÅ…”å]¼³Ë·DyÌb»E©  ÿ“¨÷Ê€VmŸ0š‹e×¼!Ș‘”})8sY€ÿ¾·!|VŠ¨Ã¦|ypsMÎæSUUƒââÇ¿´Åà_G>Õ=7ìî¶ka¬nhRLèCq°0¥J©’VA™Æ$ƒ)f('$™) hÂvûª-¨4øøiaùʦֿ%€ÜSǸ–°~›NÙÍåð0/‹õ[ÙÔ^Oæs×ñKæX]¦Õ`ªiÅ×WØS=õöð´¨YPˆ`sˆ¥Ôí¹êí¤ÊGk“0•U´ðñ³ÙQ{«@„âÒRZô“N§³2ôªk”~ÝvM LÞpi×ñhà›ÂÄÙñÙ™?máåmùQ¡T: ÁQRnád©€x´Q*JjÌ€ò^4¦òj«¨7DïÜZ›'”ÖëÚ¶>µWJÌ…7Ð¥ƒeJ/?@Òhã¥Tæ—y\Ÿßÿ˜-^j.;ÿ+º¸8¹àP™_r°Ä°øéauNŽNMpðío{"å~”ÕJ”——Äêlw™\úÃ-„¶EŸ¹;åØ}ÂÚøG4–CïºÉk2-~/YpœŽVÖ …IvžÑCkiT!2æå©QÔ£;ú—ñCoõœ”³>QÉXEæçæå‹ü-ÞRÛîñ×·ì2Ä%¤oÎغ`òðÅmŽ¬ìº?ï‘¡u±SâÆ©¹7°‡ã£Ó„IðmI A%“êÉÓ¼Úub2“¨š.ÉИƒZh”5úZÀ̦‚ÖÞÂwÕµ6ÍÑâjøˆõ>™¬(‚µ´÷‚#YO·h†¼¸§Zm4ë­-HµÀ|4ž!a_îÌrŽ¡oÍÞôó³‘K7åìX8 I_q™ BLµÕÖ¼T%SO•¢AyÛ˜ÝÓâî»GªŠ(,ÄÚòÑßKµìB™É– quÙš–ÊÚ¨gætrÊx¸oóÌ–mº™Ù¢“‡µU{2çû˜¬ *Ù²¨ÕæÐmg–twîÉ…,”B¥ý+N&ë"ÚŠŒm—D\œPnJöW:ô”4a$G®("+f$ŠŒ1BŒ7óÑtV€œÍ9Ü**¡½ÆL‰¢}çG_ß¾¸ÏSûòõû†k-¦ïÛ^%WàÉ! †Kf³è¥y?Úi{ ‚ ¢~ùëZ„IfAô;ÛÀÈ ÍõÑ $$ÈçxÎ9B@HErأI|¶×Ï»÷—YL¨âò)3ÛÓ¯þG„R “ÒÂN¾•aݵ꯬zc«©þA0ÙúWVQx½¨òž6rrG;ÞúéréÚÁ%˜Ü½w¯ª y§K­ýܽií÷ù•„Ћ&´LÊœŸù‘t`Ážs· ÕVþ”w‰ºîS¨tãú “|W÷ÝÆÌ Õ×ß·ø€¼·üãZ©ÝWh}ú²B‹ï©:UXl¬_çõN)Ü[hÓÅoΫC†t £R;»a³!Ç×Ï~rôbÇZ½â‡v=úf¶uÕ}ýÄšÍG"›j®ß(pœZýöÑÚÉ‘îT †ïÿqDH£–êNY >ª{ÎêõV¡Â“«×Ì@L%gǽû^Æ‚w¦GÌŸÿW3!`LÔtU×^,®¡W/äWË ­d£ˆ{>E>kÖ­ ô`–)Ws?õ MUÀ‡›Vel; hBD ÷píñÕ‰Sýú ´F)´Ñ’ Ù‡)!ˆ¡hÕÌ%š¨y!^έJ o–T=ð+7J)›g\¶Ô$(ÌJY`¸2*YCaˆ‚2FšçcÈZó·ïN6z .–„§¤‡j¼c_™ª«}&nHúÌÉ1§ôûF*0j–ên}I’,·C·ÎŸ;ž•œ6+hÔúyÑO'L›’öô ”b¨³IÚÊQI’)€È.v¾1oìü ›S¦e_rÙ1Èf‰ZÃZ’tç²$K”2¯ðÔ9aÕ#ãÆKœþÏ€`/I¦ÒmY·xDäs“§ˆŽÜz¬¨kmþ±Më.½?7’1Ï+ƾ2kaEÙ¥É&¹\cæcFÄç•HNׂÒ?ºƒrÖà„ç7ý(sWEéàa)Ó&Œ™ø~ÉkÛ¨ê›üÖ±ÓªG I[³úµ¡ökƒ¼%Yv¬,I”2€mKúþU7•„ŽMO|fæ¬)ǯœ2µÐ!yã“­rŸ|jðÈ!ѯì-Z³e%$I¢Öh!6/ËÿÚ®ÈÁ£§N›ºÂ·s'¥sF&Õ:L©½}õŠàÓÉ[å·‘Ëík9 ÊÃnŠè=) ,zÆúå‡#Žœ6)5fÌ"UÛÕ¯¦ŽëÿòŽ`5BSVÆ+?Ÿ›ù!‚jNœÏÆWÃÒ¤![O×X•rÇX¨$Q @Ü¿µçÃãŽ7Hu›VV'̘dé!•Ív»ZªÏÓõý¹Âúë‰ì}f cluÖªÂC+#"úŸÖW‰é3ûïW¶o|îTÎ9]B/€€€1’½çŠœÌ¾a½uý"ÂbFýGŒ9¸nŒëšàÄòç‡ÿåãzýfõqŒ tæL_‘(Í´ºg„“ßùL忨eAR0Ò„GOwPêò+u±O°Q·e)uÍÑR»Ä\°¤Ý5êÚ%J{ö׈«¼k!§‘3Æ>™40÷¶\O%õ ¡îçy©ýÖ¸Ro ö¶N˜Rû¶(cú‚Sãwßr΢îIÿ‘Óœj¥vÍÔåFÚ¤ÔMoíʹí½[k¹e¹ë‰]¯lÀ1½ë(êh-´f\ ÛöGÇp²>[æ¹qñN£¿Ûsœ´êÉ+>|ÀÓ§2•%™šL·!È)ñó3^7(aô+WËŒ©™6SÕ]ÈÓr¶ÛU„ØJ‰Û²Î¡Sb/@ˆ°Ãy.7UÙ•"í6¦u½è$ïZÈiäLª|óFT¹¯¤¾!û[ɳúyömà›¯ÍÞÆ}²ÊQN}±À@sQ“ÛìŠ]¹Æâåĵÿw¡,w=±ëµƒ 8X“¨£µšq5l稢UÈÑúlШáCdÇÑßíÙ_ºùÁ¼°~áø ŽQ" Ç¿ð«¤Ì÷Ч̷u9ñˆX¾øEB™ ƒ4]ùa sÞ÷Z—ˆÚŸ-w Ïß5ú*£Ùq§—»6Œ€0b ³‚Bùö5¹g_uÓ½ÉÀ‡Ãù]l_ˆ5-ÖT‘cîà8Î Áq8îà8‡;8‡ÃáŽÃáp¸ƒãp8îà8‡;8‡Ã‡ÃápÇáp8ÜÁq8wp‡Ã‡ÃápÇáp¸ƒãp8îà8‡;8‡ÃáŽÃáp¸ƒãp8îà8wp‡ó ò?2£Fg¼£aIEND®B`‚suricata-3.2.1/doc/userguide/rules/pcre/pcre.png0000644000000000000000000012071313051004444016501 00000000000000‰PNG  IHDRz˜e9µúsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ €«.Ìòn$ýRþò²ÓÈ Ïožîu{‡ñš\MˆM%n·ÍyZ*C†ˆ¤2M(lrûy²1íßÊIˆ”õäx{ýàÌÅÛ¾rD!¥mÖ~æÚíAíµVÆ…î{òA ªKR"Ñ‘›Ïšžu [ºìJ†_S@BÈ¢X÷MFü5ˆÑ!h–& FQHð¹ÚI/Òuïmì5v'M¾*!?tMF‚¿zÿ.Y †:ôš÷7}°?Ìîé{â½uµ‹¾Œbw'8-±Úqn`çªzÎŽsž™Ê;~+££€ÀóK+‡¬zvïÊŸ’æî‘C–%O>”6¨SúåÛÉÅ=Nóï_ ˆµrx¨&G8šNãÌÛ'=œÊ…Ò½Eh‘Œ?ygPͯAørÙ1vç3GÍõÿöYòÙ½EðºOO÷i{'2c»Ç={Ïx‘›¶ÕnÌ™-F Þ Ñé„B U¦I°õÝÇ'uhõ¢®(ªú·øÁÂö¾ ëd ê| ê|¬‘Oú3ÞÝéµ¢”E¬ùI0Ö­Óú´bÑ·«áÛ¾pž¶m×íU9"~ ´°IÊ“ÏYeÛ~ï[DÄ—–víæwàúKiÂW×£{8„Í<"ýsåÀÞ¡>^Ö§Èõö¥w¨³Up."bQxgÛÝßñg}—AÑ›$Ïp{ïÏ)Ë_]s苈ȹélé–JáÇÝÃaƒv]!¥ë2Š’GR!²œ¢Ü矊ëÉ€Xæh“œ-ÎNY?ùç˵µ6}Ù"\7¢ßÐÄË Ü?<Û9h„sSæÚyÄŠå’%ŸÝœKå>dßÙæÑc ¢šøCœ—=ãVý]þæ’‡­ã¾"DLèâÛsbb2¦{GxQÕª4ÛÉÑûÜl¿°Mªjxyu½WÏaø qb‰‡o˜“k„ ’4ßήt– El˜³ËÒ'œzŠvi·ý¥¢©R‡Ê G±:{Í,5«G¹ÛŸU¤`䨟Lªöšª‹[q/k¯ˆMpŽ¿'’_rîêS®¼¿_’79FOQºdkM©@%boœÔ¯«ƒsPÔØw%)s;6Û9bñí~¬iw !ïÓŽ†ù¸899ùöv'§”B‰ôí°ûäµ1‘Áî®.a£–±%„TÊW„Ĩ®7Äô!,·i·‹‰°pÍ”þv¶NÞáççBòGšG9²vŠŸ·»³GÈù§ù¤†lVòù‡¶­µ!‡'¤„<­N‘É™·-têåÔ‚üÓÏD%žéïÙAZ‘Q{Ï];7¹‘ø‚'ý@yõr»yö<%“ñÅƹíGj‰ÄUu9µ@¢T*@³ãWÝÑk’Z‚#!À(Å”ÃEÉg¯ JprýT–££C7û¨Ik ø@y¸ÍŸ5åöŽùcü|<½Ão¾c›zµëµö%"ErJX‡Ù‡Þ(DVT’?¼·OÌŒ¯?‰‹ýùìr}óæt®@,æsšzŒ½~Q_ @"ä+œ4Ý"F>^|ø¹}ç_[h“ ½ºNQ*8TÍReòµ˜Ç©ú­cî7 çܹi‘àé ïoÚvM îÐÀ›»Gµ³‚¦Î)Ø_ úƒcÕÐÜ/¢Ñ×Ở×Dñ*ê™p  ¹BS…ïÏ.Eù³œœœœ½{'?É#„¼«Íº†å>û+2Ä×ÕÞ~ê–Ë„Àx÷æñ'óˆTÒ&Øùý_ åªöÍYoõúú[!û¦;Æ®¸“0*ÒËÍ)tä*vÑ›éƒz»:: Z°ŸBßß:êãêääà})+Ÿ ,e×ÍÞ'tpÖ³Ó-;ôä"(~Ô¥Sǯí6æº&m-Ú˜ªIg"G¨´Ã\(IÝyûºBàêö‘)yeÜ9xãÊ éL t˜å¥n[y9ãö 'ør(zÔ–¥ß½{÷ø’ Iqál €®qã'26%»™–>@ýbÏñç±zåàðƒÉZÚöÛ·V°Œ&FDµ“ñàaÚÉs‡x' #“ìMz/º|ífʦÁ³ÆŒ*«}ÃÞáÍf†õM}ñÅ BC}uÙd%À«à–V‚€_.%@y^6GOo„•:T"A¨7êèLJ7ßfË°jÖK+uû31A@J<÷LÞDŸöB VQOÀ)//«ž@\ïÉS³áúÕYg³Øµ×9AN9¯º¢òrÉ/œd ¯éËS¸·ïÝËȼßùdüŠ} id sBælº|õÆmÆÏÞá –&Ï¡*Ro¿³Ý^az­Yg.^¿°,lË´®¶î[“ DµúÕÎÁAsDÔا¹¥”H@º™žì,ò…9’TAÄq›ö矟7¬Ooóa»œkc½“©ryê–˱vyò sϼcZ³ZH¿Wpõ͹#aš¸vý Ø¿äGüLÔsiaƹ‘•÷3¡»çÀ‡ÝCÞ–ë2k·B~FTðD¿T)ïmÿÁ+"Þ¾{÷î“#—E‡¿àhhQ_æÜj›töJÚý´G§\|%ˆ>âÁùMÒþcÞÑb–oWÓ*]  xÅ⻽fFJCǤѧÛ[çnIº~ë.óã÷˜ƒ‹wÿ•v/Epjí¾\ ÄCg¬_6íîÝŒ‰CæOŽç|;?iC2?-óþÕÓ»-^cÚÄ„ ¦ÝráâeF4D护­Fˆn£w j-k´¢‚#?o©?Uì¨)cÒ—=µ_½_ªÌXÙÉ{ŸtïÇFm¼Làôê¿ŒcfvÑD0°ðlÃY|([8Ú\PÙ/HZ‹ûèñ«ïH‚4è•œ^$±€ñõU^þŠ`G¤7v|pï¡A¾ºw·æˆ¨×™eÁN8ñ5¯žJ1 N8§%Å/ÜXÀÙåñŽÞx¢ŸM# 3È®8ßò;hŸMgÐÔkó\u‹†x#§ÀD|è±tû–›Æ‰Kî~Cçv¦ZÕü˜ÇFÅjíkÀÖe#ìꛬ µyr Ç¤¥þW–ËghŠGôô©)sÿå«m4®ÄjšsÉðK‹~”ó;67M|”/ fÓS: BWsÞ¶‡|3 wÒµ7‹Å^ÆŒ;[“ZÄD5QÎÅ‘ÙÄa÷™ @‡OpX"¸¾GOná.Ýuáþ™- 7(\÷Ü®1oÿY¯fšäíÉõžUk¯¦Q§GÓ¥ëC¯í²h³)Ç G´@ò“µN„媗$£ýíÔÝÚp}ÙØ·: ðK?æèw Ÿe­^…]#Ÿ‘£Î°â^?8ÇKŽy‘Šç—.¨uyhË$€‹Ã[÷Zw)bÿÀß]€¦Ý21¶U¿¡‰™'ÆÖJ½>7öZµªVÒÐqÎÉ5?¯T£Ý•û׊¿çå#£½™aYÞ7Q'}"¦7\4Æ aêšê„q–LÈ’€%O'ìrˆß¨'¿eI„÷’-õ¥ 8@qË.ý¤iæ F»aj†.-ø¯sø`¦FW£§>þ2À¥iêyç’ɉ™–³ÎjÀ”áQgܺºQÏÐjM¯—USçö«^4Ý¿n¦4&'»©ø\¢Þ½!€iS™”šqKéx¼Ë5·Ó¯DL½µäÍw!˜«%1Ð7–iUÕ‹óBÑw®PW[¤úJZ¥º‰2m¯.A5Ìt…ŸŠ)hN«šˆØÆ5r{¢áÀSMv„äGDšì½åc!Ž=™Ñ°ªöÒh;@ÐÔ2–ˆ(€ÊsÁ«ïÄÌÜ´rƈ»÷ø¼zaŒ{°džç‚£%ÕlK1Ó‡·¬}Ø$õ’»AÈÒ^§|ì¼=—%¿+2eÞlÁü½ª ðñ®È »ìû[µ4-ýPD# dÑn@@F> €a²bHÃÑó®xmêqðîã~ ÖÈ&% œ9üü§ ‚"§ðãÂm+'°dï‰û/?ic§SsÉ!¢}ÏQËh‚m½'·I‹îçß6%•vˆœ±ktPÝn Yg'âïoÕkæÕ”ê?éªëµ½qaoªœGÌŸhc„jûæ…Ó[ŽØ·Ll…9jkž„È–©]¹ºi4»L %ËVdœf¹íUÅÆ%m«%Š¢Œ42fŽH×2¨:ªhk2ª¶IDŠF7>}tËŒ±1›&‹ ôM/ØÜÏÑø}­M#™Û¤m#JDA½g!±@óÔ½+ Ôj©| !»Ñ0Ö–Éx]ɇ„4¬…N3úbnåF(úZFë`¤&í(—[.%DÈ& GSˆ–š©ƒÃåÑ^dTVÏÎ0åjôª{¼Ü¬£~Ä…x"…DMø[ÛƯ?~ò±0¬A4ÙÚ[––®¾Ç™ë¬ƒ•WO¢‚7wÁà°‹~uv®cóŸÎɸ#>¾ØDžÝPXk~JhDX´,ÞÙgž¯ÝRyåA]Îû cÆ_9n“ͼkK}àqÉ£}•mÉ€‘K©}Ã8l½?X«-µåQ÷ˆßE(@}ÓÀÿ|oæü ióÎM8¡Óófž¸|Ë)Öíî‡6 eEµœãƒÀ“?þö òòò©&nJ…I+ê»çõè;aÍÌ âa%ú}[1jÌ?B¿zœ! ÓÈfÓ‰T1¯ìó³‹}‡ÇÙ=¹l¢é0r¿³ ýçSPAÿHºQvg¥íéevoëB,IzÉT#µÎȽ‡y~<˜‡@Ÿ3ž34Xhæ‰Ó¤ôIÛµZõaÒkô)‰€@š73Ö;šòaŽGg›‹%¥çPÀ}“þJ§I¯ÖÕE5éß7Ïš—ü–«£¥Ncj‚ çÉçÏ­š5­¯ Ókûœ×óÀµÒ”¼7rب¶ãÚ©×ÈèÙÜíMÓ$M"ŒÕkÓ„©M~Õ2D~þ5ôš?¬Ã¢ø•LZu!muøݪhê4Iè’ÏÛ.Ý!U]C·µ«žxÞ¸߉1š5¦)ijÑ©K—.]ºXµhdðýá ÿ™ÇýMÏxrst/÷†úµÖ6y·nâÄG?@[¡¦¡Må?ÊñÚék"©¡¨ËdûÔÑÝ' 訠¶þä†ÇËãÒ?sÒAB¯æ`â°v&kÍð‘5sD´ê5§eþÕÄ҄LJŽ–Y{÷·koeeeeeÕŲóœ1¬”Ä#YU´ß1m"„Ó|@l7ɲ}—ä'CSûÌkè„^Å#Î,W€jj@SX Mº¸u(y?gÆæ¸%ƒÕjîu4ºº¡}åðàOyœ0÷|ìU ¦©×ÚÁA_Ì-•@O“Œû¤´Ý~ओ”˜óøñÓj•eM2i3ÿ`Þþ²tƒÁ“6¥ ÓÍ=ÉX‹1uœó™„2 @,äòøb)×`ÚŒ_8”ãé®g [\ƱhŸLÜ’üÍÕúö åp‹9úwŒ¡É‰‚Àhá¤cãê8fçîÝ‹‡™ê¸A$ ¿4ÀJ„í‡%ÏY‘_žû¹(fÒêòeùî[óyöHïù|:Ñz¯V¯‘Û;é”s+8¢ÝG.§\H 6õœ¼o¡áš­“ÉeÐ@¯‰ExÔ܉qþÒ\ÀãÒD6éê®›·¨ç–#4ŠSÁ¥Ï¯XÓÝzƒÜDõϼHm§xq8ü*"ú™wø¸×Kf+©L*†_kkš¼ƒšSfæVéPRb!‡ËST+sÜÚÉ1£YaÛÍ%Z×-Š5ÇdAG§JII‰*8¼ÊÕ©6wQ°ÏðãÛW[Ö#å›Ù†ß<.['DÁn¥f1hÕøâ™!v%4 5ñ¡nê Äl«Oðøw¶LµÙJäo—&ìN霵n}V“;7ú"D=»åƒ» 8åæ•-&²Ãœ„éqÉG‰EÅylll䪷s}lsÃHªíëì£fXlwZ}ûÐd–€ËŠ%R~€tÝÍûç:‡ÍoîCÀž#IÞ}ŽV=Mç ]©ö;®ùŠEïVµE ¸v?è¨[—2±€ËV âèõ+.ºöXÉDMNÅ¡.GåÈEQÌí÷3*7>§\Á¢ElïbàŒ½_hSmðž°-¼xä¬(ýýóË+¸U¹y\ŽHLýéÓ­~vÉB¯ö Ò™áÍÔÝûîÞLD.O,»p¹ŒÊßBn_ŒÌ¦]'»²Ü tKÊ„þ“gÛÒÇíµ‹ëïâ}¹¡®fL\ïá]–¾Ž‰Š¾”ù¢‰NMe"Š’Wkëꂨ¦çuïÖi>‰HÈáòCdü©ÝMå'IÍ$J¡ÁÐp§ý7¿)³Q‘ÿ«®UûÊ(«Þ;•c!ûSœ-lë×j; J™¡JMû“:¦òF Õ?«¬(eæ5Š-UêZXPò•ÖOèzrÖ¶NRZ«Å·œ¢wRø/‚¬©ì”õÏrë78Rhe…5-HjQÿ§$©E@EC[³ZJáGýSÊñWˆC}(SJqø9&µí¤(DÌ:<*`â…e¨ÜcÝâØTMlÌ`ÅU‡]iÒ$|v¨ƒ÷e4ù)Îu§zý VŸ[û­fQ~š£”òäÿR"EåXÈþ«·ì¤U'©S¬ÒþDI¤F¾:H)—òÅ‚Š ¾¤î¹À@_·fóäç']iR=9I½j#i+‹ùe…ßsúL¹¼æì%ðG'ìšMéµsé)ùÕ#»<ùjü¨3NõT%gcBêZ¯ÔøŸ¥~MÇÀç”ñEuŽ¥t¦®ÖOpPÞo…8üâ¨Ê à–¼K‹Y“}ú~€‚AD$Mú„˜ïÙv>kz°¥4¹æ, õ+•Ê_nóràÜA3úŽ­G\Õ/¿aÞþŽªøÏ©®¡FûÓYNcj¨ÿ%uýVVð_„GIÃgø^›i·ºunüW!;uå¨5Çí¼àØPë_d6U`ÒÚÖþáÀ²˜¤ôòÚÆ1 |ï™ùßEìÂŽi›¯”¬9™ÜBáa˜œ½ÿôÀ÷«S}Z©ÿ®\ßzÒɵ“†E h¬~÷ ÷ÿ•ëÑ¿~Égê·´ùR>÷+‹ä?Óû­¿•ôFìNCÕ þÒ *ß0ªÖ×l*µÖ沿3»Q T ‚ß;LIò2Æ-;ªÉ¤Éôÿˆ â«Y·Ìðã•e‰—±Ò»GMËлwœŸuS™U )û¸wß‘ç Õ4X}ÌåÙéËÛv%¿§ší°yýÚi˘mÙû1s¶´›7ÉÓ …‚£ôã&ÆØV±ï­ñûŒOti(Ϩs¦Ü8dÝÚvr7³¢×ÇÖHLO;2ç>é?)¢ýO©pioü£!#BZן-9qõõwߤW€ žqþ])Ûdßÿcrª Tð%>S:M|=ÝÝÜÜ\-îßIëdÏrssóðq7¢¿,7ãá/oïní ÖõŸ¹óD€GIK»:õ~Å3preÙ˜›™Ééøùøx{Û´Ò[4$hþÅÊQBÈXwϯ*^£Ô/ÝÐôš††5 7{Ýší^Á-teŒ)F×ñð§™4cÓ˜½a3 qÎÓ‰NÎ=q=´ƒ¾toˆ0"À³ÿº dì¦CH«äÅ«ª„ñ±MÇ#V^:6"â9‡ê¢C¤âŒšNÐdØÀ ×÷Žû½ã%CÛÈ€!/g‡×RJM;{ui κ—–ý½TǤ©—«-­Rú _^þ«°M÷ÊJ^Þ»PªcçÔ¹|Ý-:útÊ,]ÙWÂ¯Ì  ˆ„ÓÓ¾ü¨Ð2jäæf¯‘²ãy¹Ú•³çm݃,õU3M*ø;U£3iðrëlnƒØúX}1¦¾acLÞÁ9?”8Í"ΓcgiŽ#»6JðgN_—Yí"¨p¼R÷]RÒ;îo©²$Ù§g¯½(/gä¦mž°lO§öM$«‡ÌØzŠÃ¯¸´s©}ø"nUsÀÐÝ™3~¹¥¦oì¥c¦åé7¨ýˆMæl @eN Òè`¡§šf*PòÃTý XÌÏ ëÙQ@L¦-?ÙÛ©-¥NIÍ·`@æà¨t‡Ï>y2{ÌŠ¢˜ú]š2DçßÆZšV%ë[D…5Ú1êÀórOCþ:ð¿?ö‰NÚsíš™€Ì¬¯ôÜùsg‹)±ˆv3» Ô²¡”óÑôšn*œwñë®Þ-öœ¸Û·×ô:÷ŒØÖÈÞI½ ¢0{Õ¸Ažƒôoîþðe^ëÎ-¤ú@tÒ׸™]×I%Õ¨@ÿ*»A5f7®¦” öpùÄ–zÓ<º7ÙpàŒp|WF•å(?û<_ØÔ¤òe&™$ÈüËžnÛú]‹17Ð~žT Èû¹IѧÆɹm¨M>rÐÇ;âEïtò»„ñåù™ }ÌFG,¸rn!hÐÆnÆÔá•&ÁSèšò.ТVNÙÙg®°÷ö´;y³—Ú)²j@é?Ó6ó“.fº»e~ˆ«•ˆUæ*PÁߥ»‘^#è%̼{ñ”B Eôj}aÊî´¯¤ÚC–7hÜ_vñ+ é0d÷åI P¢„ÖÑLö\M‹ž}(ó¾ rÄ´)FÝf)<–’ogZÙDp~³„òk£Ûn©Uç—ãs2¾U¨óÿUv„F34í2'ªTRù*Îd¨@›Øä÷§"*”€Á`ÒiD~窖Z†½MfÖ+US]À`2C7œ»‘šššzãö½‡™çÖº¶oõ3ž4$ùê¡>7Ø~æöˬÇÏ_fm˜²w¢ÿ‰ÇßHÍ ÷ÃÑ)—¡ïœ>V@¦:“¦¸-á‚°·©îÞ:wî|ƃ‡ƒºQ"GU½OÈ»»ñžIäëKOçÅ,õàä¾<ž¸þ=ºCà¤ÚiceKãNjkèèë6Ъ+¡I)sëê;Ÿ½i§WÒ®F' (Vcç—“;êÈM¨¸¬B©¤âÜÙGê ÇÁdÐHm$ˆ:“I0]Wg.FTX3MÉ µ?*âäËššº\ !iÝÇÜäÒ5bùsѬ²*£*<*“3k×óSQ]ÅnuØLs„Ø…—jfÏ9Ú©ïq$€ÝØi×c0!ÜÒ²mþ¼¹Cúx{¹Ú»‡œ¼ÿEž(¢;3¹Ì#„¼¼äæéãëêä4yù4* ƒñìº~^¶;LH@rî‹èÎòíîçì²ïFŽôy2Qá‹1}|=»÷ê7øY‰¨ÖÛÝ·fþUL-<þh&áY<.ʉåéãÁê7nñw*;Y,Z79Ö™åáãÉê9.‹-&€„÷eÉØ(woOkÄ‚DBHlN›¶íö°³‘dnÃ*¯|3-÷Ì¢Ö>£²wׇ†zzwïîää»úø}B€’±¹»Ûä+‘>.Îc“ Ev4^v­Luû 4ðKÖ¥ÕAÑ«PRìïd{óc9"\Ýæ; ?vŒ;M!â§]»¾""¾80ÒÎwŽHø%*}ÝÛÞj×NŸ/X8E )±ÀÇ“ÕcÎyéç QVC·½¯Ù¾p²[û„Ô ¤Ã]\fü¨[Á~ÕÃÚ~ÃK"¾X׹φŸÇ›(¹âÜ5¤P‚" ³½:9¦”Ê'‹'y´_z½ ßo×¥SüÚ™O_~ûQ&§ñ}w+ÛÌDÞ;wk·Lžâh,ëzº<(ÕFV›¤$ÌÞùB¾°VN‰ üöít¸vxœÕNsï—!âÌ.kNe#bÖ‘ÑnÁã¥yžíŸÑ9`2ŠÞØv ’"=Ôß+<ÀûÌ+"ÞX±ú%%á¤ßº]. ñØ¢þ=Ǭ•–=15Ì}ê)Dj,«Ýîײ6GŠ}QÀEÞMÛN½ØˆˆXø`]¿ÈYÒä”Uc‚'®AÄׇ#]œžW "~<·´k0¹ßœÜ>rDÂ{óÛw_‚ˆó¼Í—eʺ3sTì­·%øílKÛ Û¥_ ü\mî~ä`aªCGÖUiÐ ^–§}—gùDÜ4ÑwÀì£ÒâÑ.Ö½k'ÒÍõÊW"®ÜÎAiÒÉIöƒ+€gÛ&»Û(ýýíÊ’¨øDLˆ ²ê¬ôã–8÷UqtŒ·÷€Rœ&ºÚ.yÈ‘fX>ºG|â-ä~ôîd¿û™t6äG¸vÜŸYŠˆÏ’¢\Ý‚ *çìÓôÔÅ"üÿ~fwC3Ü7ÍuÔ¥\E‰Wö_nÚ§=±cÿ-™—¤Æ³tŠ=¾_¤ÃüäA]5•†„@jê@éæÓÒ¶÷sN=X\šäïeß}˜‘Ç ±˜PP*Ôkøó÷Ø™§¸-iP7(I-ÖÛ6jÝý+‡Ô²/%ÄOîäåì7ài@ê^ñtͼR×Ivmg‡ª',HE¬Žßþ)íXx¿È¨¨Ès…0´TTTïAËJuhz!-„§±«¶i½™:®®ÎLz­H4b1‚D$«Ax<ñ¶íäÅR¼-c›å¤Þ™Gšæÿå9¥fc,>|À?âÛÀ!€¦åÌrÕa€ŠKg2=â³Ùl6›Ý}Ê(á…í…@42¼²oÿâ¾Ú´k_GSMP€ˆ&¶ã÷lŸüáõóÌÌL ©þaNŒzZh´ŠnYøðj¡‚Þš57¾½{sþbž@¼dó>V;@¨µœ=ÔL5´5K8‚{ÇS4Ý}Yº¥l6›ÍoÒÕÐäòë/e™·?³âúJi½¸ ‰œ¤MJ@ˆ|vÆ·£¥9{ÎÊx²;_¨xŒ›²ÝL{÷½´‚ÛÐgæ¡ÅÝ ¾øìÉf³Ù첩#‹N¬æ%õ@ ³XÉ wJ¾¦¥}ˆ`åfeðZ4ëÝ‚Ïf³Ù¥Zöv÷n_“ÊÔ¦ÞÆ•«¨‹³{ C•eù/øL5]Ç:è½á̳u"~e ŒÌjå knž= Dö­Ö뢈êtze´ÃŸp=¿„ýsLààü^ØÖE‚Ъ¥^ñýO(ÇA¤®£Ò÷•«]QΦYSy^C¡¼C"¡Ù³~ ¬æoØ/-{qýØýûß¾|B `Ñõ\#3qq—@ÈÓd/;SZb ×¾'\ûÀúPW—íì 2l”R€Ö¢1ó\N1€é œà[ͪ¡Fe‡ Œ´*¾ß ‡ÙûÅ|.vŽs‹(™›ðBh×æ«jðä²"±öÉIÁ§+Q£iKŠ80ûèõ} §†…îD‰Ä²×ìM“èr«:ÿîš^SOÇŽêÖά‚/"UänhQ9x:ÆZ¼Â €:þa#vß0Yß·w˜D,jë;aÇü¾ `hjVŽ @òËøü¬t¿ÀkUãÔé üGÓT0la¤ü@Ì.æj™èJ# 1MÔèÅ|SAÖÆÁÓ/4=?eb¿¯¥b 1ÛŸ|¤n1Ÿ®»zhÐR¥ÑÓ!J´´ô¤O4rž‹£Køc¨óë¾Ù uÕ‡7ÜRª,?$$´ªæF†e²_FÍT§§ße7ˆH¶î˜áê6Ö~ÙàZi­5¿ÿ(•)ÁPE£Ñ€DÎØÕS;5xä€Ð뇴ÿŽhG(‘EPï?}É>ÛþÛ^ Þ‘„´ˆÐhÝп^LïÈ„ÊwÈOM|ï³`Z÷êÑ™ÚL·r›c7eV¤¿ø;VÁ7Oó5Gšëˆù%N%÷ˆˆ¦WÆŸ ˆ:}ÿä´É;øå‹ÁÑ´}ÆD tà ÷ì™øV8¶½:Ô`· €’H?qçsDê:Ì?%‰F[cqN.,ô ðW·±´èÉÞ±ë¡è}Ÿ¨ýÐ@ÇìÉ uš·±«YÖÐL½Âoëѵý4´ÌÙ;K"à•Fö<êoÕ¬ÙS“Ü–]™ájs®ãëJ¡¬(‡ ”r´›(ÄV=|òêðI”P(Ñ»Gâµ.c:)v›ikXõ¸±iFÍ„Rcm^!ˆ ïYy„({ùÈÈT‡›_Ä€Åû*’k2•ÌiBšØ%‹EŸ.Ï‹ —–¶T›*›r$瑉‘¡×ÈK“úë÷Ó™§Cb†€žŽ1M¯Qjò1+ùUÅr²¼¡ï¤°VK6Ô¬>Øm`òsûRóy~`t7¯x ¥¯§ÛÌsøÂîTDlùû¬$дذ:jÿ¤þ””Sh8NŒ°]>"tß­iŽ# -ºð=À®FL…†ÖV´ì;•Gý‰ñ!WfG=(/š1h ݵO¸ÐA²qÙºAKŽU$‡7oÐ7mЖ†'ín>zN ] M†ó§w9:i•¸¶*åbªú[Å÷7{“NKÿιu6)õUÕièÖ{Ò¥‹i¥xÙÕ+×’ŸRŒÑg¬ÿ³5S¤„IÛ”XjÕÃCôš´g–f­¿Uѽ•!€¶u—²5GÏw ¤8ׯ\) €¦o¨sòºEÒŠÞî;|Pσ]Ã_Š€ÐèÚFšt „FD!ÃLKüUúz¼àÕÖÓ©(»}#Xpâ³ çÔÁÜfŽ>†uQýÔÛ%$ƒ@hLuM-QòneÛÇ_pýôé©s?§xPæ— };×f©;öK°žzò»4Èzɻ̽'¯UÓzάÎçvï’V¿kê*¦ßä† ÅszÏœaÓ·]55†©©¡˜¢‹@ßÖ²íÞIÒjÕITHmJÎÊÆEAs…ÈŸ2xBíRD“Ÿ«r²ÔœuÛª—nRüï%ÎÜóVu1…jÊOP5”õ‡¯¿ Ü Òj†R¯SB>®½‚àçD1µ¾ˆSw¬rcÍxã}®½¶÷Ëz2kx?ëT¯¨Ü“âSÖÞN'¤Ö³£DÂ/*öœ­Ï$õW#O·¤”'QŒ"Q€´‚óM½4ù”ú¨]ge9VÊ}s«}èpéµ€Ò¶€ èýç’º/Àš5m­£AÿYêÎçºmÕ;—*Çé¨UT;•lóÿ‹&"|¿¶yn¦ñŽ™ýþëÈœ]3âÅìÉMTŽçÿvx¿?bÎeuFM¥„?tþ–4ˆ« TìF*øßÜô*-þŽ Ûÿ!U1Öùù»|I¡Çpýåõ#òw3FDÄOÍ×Üüç"÷ݨ5œUžtrÎ^5¾¸#!Ôñ ¯á²_‹bÿEg%EÎV@ÌhD ø¤æGE±¾Êke«é”ÿÝT¼»éìÌê7dÔ‰ r8ý°ðwå~BÈ«ƒnCÏcÍÓõƒ-þŽCRïG§ì»•ý ò—ÄËÙòÆÛÒñà1"rRymI¿î–oÿi>ì|ñ]ÑïÑïõîÆ]âå¼…ð-iâô¿[Jðù~ÔèÝ5»ÁŽîbwƒGnNeEøH¨L/;{ÿ‰Û«t„püœ¬ß–BHNJ¢}Ø0YÉ p¶·upqµëjçá´ëA¹´ÀöI±ý—'UsR£‚|ú­¼LÉi+ò®¹¸ôèçÞ9õ õ_  !°Ûï5A¿' †}_€æ­@xŽ”Ù9RbТA“i@éa¯2ÞG`'Ð`!@0Ô¡MÙos&=@©¹€+/ý“å&š2BÄ)dšu8²s‹ Mêõ‹Ê7.TÌy ©ieˆh7*åÞNpþÊ;dh@½ž¸ˆHýú,Os}E^¼ 7@TTÙ——oJtjï¯xäRV–™Bÿàúä5¥ë`„²æŸÏ!Úð^˃òí!ÖƒòW`Pij;+£â œ»ü˜ÊZTü0âo/+¸µ"¦ªj3M5A¯žA#]@"Vï`ú~צkß«& Ъxt®! "ý"´X£/§?ÈHO{ðèþöÑ[Fv¿[$ Ñh2-²(!20×fÄ¡©~ònÄ45]MŸ¨1šÚ4E>Ùø+u}¢Jí™Xgâ5h   © ÆÆ¢øà7@ý9u\âÈj£Ñ@J]f8IBZÃ…—Ð.î?†Ç™0Ôr.Bû1²üÒõKüšÀ“RXz¦vÿ'‹Ã Ù )}x~Ðüý’â·qŠ«øytj…¿›CxD„›=kìʳ„ˆbº¶ù+—ûuWk«íÏ‹ BòCÚY§ñ¥ãR6$4°gO{Ÿí)/!·öpvéÕÖqÞŸX9iêöó„”.åäÞ+ØÙ'ôØ£¯„wÉÍÝzB%>®V©oK‰$wFLOWŸ Þ!þ®=¢®}å ©Vøz²z…‡{º8Ÿ·³[çyyxôíæêÚcSÊGBccFˆ˜#ûŤ—È_v‘¨«C·¿ü±`pg¯áaÎ~ág_){wfÑ »á3¶õë?tÌð~7óx„¹qvSv¸Ú;ÛšÖÆtõðèâá²ûê{BÈՃ΋·M4ç¯û¤ìõè¨`V÷Ðð`ßQ£Þ”‰”L}oö4µŒ4òbo¨ó¸äžžîÞÎBn\èíêÐ݇›úMD¹»tP»ð…uôÎäâÎ9ž®Žþ~^î!ƒî¤¾¤ÆõôòêÒÝ3lhüB!}ü¬·®[7dôèAŽþ1OyäÕæ1‡rØÇ–M˜¶ë!$7}O/§Þ.öîS¶\#„üÔÖÝ®l?f„Á.=,,#¤ôÉ…¡ ö—}89pÈ8 ¿8›7½ùQ 4h@c€¦Q!í´@T.™5{ÌÎE3+Q¶4Øé J›,¤-½;EbîqhÇN+}y3aIâؾ馡g†Ók¾÷ÊÔi9 ' ¨ßÐfZ@ˆ$ÞÞ¬ÿÞ¼÷ƒïw!Ðy,t6B€i =“%ÝÜM € j0Ï'°Y M™@:!04 Ì°ô@`ïL°·ƒ½9è|1hÒ ¾Œt“¡`î €þJ¯ú„Åpá@Cxx ì¬Àʶ\‡QCa¶·|? º3\ùÓÂŒ€zýfþGkEþʈß2x„•þìxúA~ºdÕÅ7SæK]âasæyYâÌ°øOñÛíyQ«Vù̽‰ˆ¢¬}–!SñåÁHWgÖ"bÁub؈v„y¹‚ˆ“úøì¾õ¿¦r "k;çÜ„E')D~iAÖëlD¤(q ã­wåY;gzŽ['ÍVúxÿ´u·¹ýì;\—¹‹sç̘S žl²vŒÌ!" soÙ;¹Š(,:ÞÕz ¿Ž¡ÄÀ0Ç#é’7ºôŸ*ý"x}|Òò Ê 6VNðóé?Cú;çÐP+¿EBÄ¥üýbçI?æ×Íw‚‹´t–yTÇz³Îg—"â†1ÝãœfN[ѵ÷±2+…·ÌY#)Ä÷§¸ºJ‹ßµêÚûƒñë•]ÝÆs)ä|ÿô<;¯ÖŠ_ì²êõß™ÙÍgšqD°ë¼¤GÒ,G§øx?N!Æöö ?$ýx~²kÀìûˆ8¾—÷Þ;Ÿ‹ž8Z².K+ÂâË£Š°(ÝÒ²Ûœ™Ïs¤¯Õ©‡%ˆøèÄäžq[¥>ý/³ž• ¨ZFW(ÎtìÜ·qç8ߘE±¢»“ÍÛRDÄœ”D‡^ÃñÒp— ×”&qò€k’N/Œõê;M‘} UËà ‘úúúÙÇ"a\_#ÿºƒ·¡A0E!bÁ@Ý.ø*×õCœt / ª™â°™¸t/Þœ·‘Âin€…|Dęހ3Ë[ŒUÿg‹%ˆˆmÔ±É(LŒF\û%"Ô¦cÓiˆˆÁúÈE,HFôØ©ÈÞ ±½:‚÷E´™ù3°®G8PŒ(gÛJèofÚw³Ó“J›N ›\|ú*ÐÁéIÖ5HÝqeÐÀ’k{Ên_{âèd/åf´½›1L=Â[—=M-ªX)±HfÍàË«mgo½ýø•j´vV ªë™vn/ï‹€M;´eß½pøJFΗ|=ë˜åãYš-šì^¹õéËw¥—oØN$LÎP @ *{W‹åš¶h)|}÷…ôwŸ¾©µ_=-@©DJ‰lºH…éVaÃô~¤äK(‘£7ˆ%fv;™ €†¶~æ¥9§r(1…  JîÞùäÓ[*иŒ¯•}â«àç:šiwé>©gî4òójIDlì3÷áÍušµ6ïÔºQ­1¼˜”Þ¬g`cDl²äþ•åjðùÃ×Ò@?iëÞCGˆ^% p• Y-욉ò>HGG"ÀÛôÖÍÍïß¿ÿ>›Ý¥•ùG€F$̆c»›JKiê딕—€HL!%õo`tèl©Ã$µŒ®¤  ^¿€1¾2Ô  $.`Î_­ŒàÐahæpö+À’«€K¬e~¢5xr ˜š _ùẼaë0Óz)‹JšÔíY•‰·AàÉr(¢þùA[=ð )åò´Õµeê[€†ºô‚2N_ׂG/Jö½Ór52jªõú3ngÝ·s÷—-“V•mhékJ½d¡ÙšuûêîÜKÛ'е³ËÉGyŠìQÐÀyPê±ù™G׌ÜÏÚÆ/ýs.;q£GƒO fNìáî0|Åi Â÷rŠsçØäé3ããã§ÍH·mU\&®¿oÚ‚n_Øøæ즉ÃúÛXº§¼ú¡Ô )¦®‰lØištG(@Š©m u5Ï+'f†ÌÊ©¡i¢%üή¡‚gó4Œt¥ïP©0è¥<áÏeP¢o&ýõ£B «¡Qsý*Fµ B¤¯U3'UÊii©ËZWcê#°¥|U®Vؽf}>—b›:=>>>>~Æ´g<5ÐèŒÊÖɨ'M¬wÌv˜ÞoªB¾nÑQ¯àþ#ªæ#„ò×1 ý&œÚ·}Ï\÷Éá= øçëLßBÖH#5€”|°0‘µÚ¾#´jR š–µ,s™`÷bHH€¡];øôC!Ç«Ç®€¦qÍ$cHY|6 ¼´:etÌܸ_C¡T’ò?Êàö^@ Lº€þáOþòH566(.ͯTß’wŶ¦z e¨5öLÖGžþÇa¼ IDAT!ª“QÖǧÏë rÒ‘Q=ÿ5!4DBŠò9zÍŠ Ðm·hóA€ì}¶Á#œ^žmTG%‡”D§¹ãÚG 4cy÷^£®eîW§‘“–EN°]Ï÷°l¼Ú)öØÌ D$$¤Ñä×±}?åR5ãÎË·%€øåVǾ#ºe0V̟霟:ä|JLµ™òêE5ËÆp1»\ "!ÅŸ*´ýÍjL¯¦¼/ybbLB ,‡/1ÓûÐçmè~{Q PÌf—ëÊ4ù5õfZûó*sR"vi…¡¡™žfEq)-Bø¥i¤­>«h0lvìØ^)É¢¡AÉÝzKUã‚Ê_ê2«Í2¿%÷Êêní–C'jõ"?Ö²¡º´.‚E¬Vk¯G·×uh0oÖ ¿`ÿ ׯ­×¢ÕÓ(E¦ø‰ìÛ;@s}µ¸ò"Y@„?LÝ!®ÊõŸ4×'ëÓ §)P‰Á ( ( ÑA#*RÚ…ÖFÁgÍ€}Á@£A-yN§3hÒáË x4ºð¿Q®tÂéƒ5ÈX¹¦Þ€ puÜ?Y}óëÒ eèÇ|pcßk !*2ïç~ííМºm[³½Ï à7ÐõØîÕ%N=›VJ³Tñ¹×e!äÉÞ…æî^ÚòšW›/€Œcó{ \&0|‰º¡@Ù×WÇÎ]¯¦y`ÞÐa‹džþ"ŸÒ4Õâ¥{w ~Å“q#Cušßô¸ò¤…7¿Š !‚ÇnÞßÄtMXÂB¸oVmØ!®ªšÆ¼œ85rü檚%FJ† jw¯•žŽÄ/Û iXcdiýæÅän÷]„GGö•˜[‡š Rħ´¼“·®”Nˆµ£Wë†MoÄø›fÛ˜žpãÈ‘WBðtÇP¿ˆb?²ÒŽ_{RC"Cp.¾x.[LînŠ ŒÝ.Sëv-w> „ð×MÝÚ¤ß"–}~4*Ü×ÁÑÑ+d`úûRÕUaÆ‘Öæ6' eú7ï.í•=ùpƒ¯ÃØ{æ wqìæ<ôéw."fnö³t‘BÌ»¾ÁÎʲûØ-ˆÂó[ãÝíºDOÌúVˆo“7Yxô‘ªŠ=;]ÃFQپţ]ìízŸÿ¹LˆˆîžèÛݵ›½½³wÈÞo¤šÉüç—¢{°ºÙÛ{…ÄÝz_Œˆˆ¢n:ÛÉüxvÞÊ=PªÍðëtàÖ7sN¬›Âr°sp°Ž›þöOYVŽußrcáÐ^ööÝz šWÈ“ â¼!Ýfl\å¶÷6u_°§³½½Cäø_+DR_Öœ3 6VV!sO" Îog9tstdÍÜ’Ì“PJ5|¯v™YÇQˆo†wí³_RùùÇ›ÔèW[»n}Ç.“"pwÙ›+ëVÿür__ç®vÝ¢'¯-PˆŠÊv'Œpv°wrõY‘”.ÕR÷öëràÖi‘§ûB#Pˆ_¯®³µ²ôŸˆˆ¼ÿÇÞWDµm¯=ÃÐ% ¢¢˜(Š ÒÒ ¢ˆbc‚Ývwwww·"¢Ø(¢(= ]ÓuÖ÷Ç 0À Þwï{?ßûØÜ+sö^{­µ÷Ùgí•…ßæFö´³³ïpìQ2…ˆEOL:y•TN4È¿ëþéˆ(ÈûàÛÝ¢§sOœåÔÉ4.CT'ñsËVEÕª\é¥ÉΖ:|)CDü~c»…ï°J•¨äÛ³ Â]--­l}7œŠåT¦ßÜ>¡èÒ£ ™f <í»ŒÝW¿ŽR²ÀÉtÜ)VMUñi@«qå‚ØÒs¸•ŒûŒN­éñL"bî@ýðêáï¯b+M@CK|›#ÿ1Ú0úînFü\ùgc@ð*& # êNADt@^¥ê—õû9ÊÌìhîŽo3äšT+Åò>w3þXU1ü<”™ªÊ\7¹¾PXJi$/E¡’¸ðŸDâþV·š8QÊbtFQ?E®ÿ¸YpøKýáÍJ¢ÿÕ¨e%Qùõ… #æ‹Þ¡ÔÂX«_­ÙkEäÿþêüfHw]t)¬?;@-8õˆ×šŽª1_‡Ìg‡—%J”7“ê`÷ÓÖÛ‡¢ê'»f¤~->Sõô¬o/ÖÌ·P ö7¶ïŸÊ‚t•삲˜íº”ÁøäßDàWáàÊzI*ŠºMYO¡þXäŸßs¤µe[}3B«¥«!_Ç÷…ü‚ Àc¾HÊ&5•(HIÛYöl¬£¤®¥6yÜÔ”ˆáuTD ©ok,Ùo²ýW!ÝuÑ­aM”BUëO”OG”Þל´œ¯?Ë‘þK{ˆr5/©› à—yê{ZS§#§´žžõi Q‚3ù•¢ú¿IUü?ÔTt›ðmþó>¯jgüKÝœ‚ØÍõÿQt”%_¿õ¬VÔ2J…þÆÖu~k´:ô²‡†ö³fåÙ§×ÚÀàaÐÞ¡9ÿ±ÖÞÐZCû£¤¥Æcù¿xY}¢|ìOþ]CÉ®0‘X%2Ã*4n*¤Æºj]&@"€Âyç&Í€ATGtm¨]4¦æx!ŠÊ® Æ«‰8PPFÆPœDš*!Ó ¡ªDçiæ›*‹w-3üjÒºÛ ÿÛYú?Üh¿>hdwÅV_B€ùíAÕª„§û°\H€8ºšé! nóÔ¾s: ZO¯³*Ë·¬wb)šúLZ@ ha)å@‰UÍàZjåaWCVƒ ËAOæð#Z˜@‹`b)i×@¯1´hö+ž‚¦š@xŽqÍ@Ô×ûÀÄš5ÀãÕÇÐéÐÒX¹`b­‡ÄŽB`ã'˜Ôhº@ý¾Ë!„„úÙßýTò7_ Š¢þI&!„ûx†Eïÿö³A®H „lžâ}0E™îŽÄm š/{ôs¦¡ýýÅ/ÚóÙxñv#¸é&FNÄ’w€Úƒª;ÄïG´\€ˆheŒØÆ'OĶÚ€F¡X5SòPn«£«£PZ[—.æbßéx-ÕàÍUxø+~¾¸äŠEˆˆsú 6íŠÍðQ~mT7Ú#jµÇö:€þS)‹qMgÀ刈{§"žÏG±‡"ª5F+@mÓšú) Ò5LQZ‰ëD¤[ "òxÈ""&/BÜ—‡K-aøWuõ¡~öw>ÿ=}?§·ÃÀÒÎ|@!"º9ŽãÖ5˜(µ= Jó Ùÿn£…(æ¦9ºÎ–y0°KóË8"¥=ìÂÂR""–ù:DT4¤þ¯©¢ ±yÐÏ Þ!Ì„‡Ÿ à'1!üÈâ i/`ÛøQáÁ0Õ ¤•"Ò¡Ó4¸v¤ˆ/­­K@ê)è} „ç x%‘Ë^4Paœ¸M½!ï=¤3‚¦ÔÄ´f¾(H…Ô ðk·OPQ…¢” ‘ÐÀ± Ð g¹=À‡l˜h&”*¢Dµ @¢ R_‚y{ ²ÁÎÜfè›i‚~ `È xÃó§ðæ»I‘ýcmôäá##÷^}Y‹ÍÒò̵1S""FÌZº[)Wæ$^›5rÄÈÑÜ–ß¾$ù»—Ï6|øÄ9+“+@<}̈È7pÈé‡#¦-’‹'Ò/'CGo•%…G.Dá·c‡ 1ñ~j¹ˆÎl]1mÑæ2©|ºüwGL™‡ÒÒQÃÇ‹É÷Ñ&ñàÞÞ ë¯¤ï[µãeßVÍ™8lXļDŽ øtxÊjz@ñò6.œ1bú¢M¥YÒÖøã×€(mθáÃ#Æ_ÿ\¦T‚¾¸{Ũˆác'ÎOeWe¸xpró˜æ.Ú^@¸$}ø˜YDš4"|p†®Xp:.çä”þ+îW¯ÙÁ¥#wßÌJ¾±rÕ±dDÞø‘c9${|DÄð¡CŽ$ ª¥,š1êNR!óÉ™á³×7ÔeŠ@Ì1·+kM8}´ᣠH|“–Cj€œ¹ f€JåÛ~ô4µ…`w€ð˜Ú{N«5\Ý « ƒVĄ́a‰N…\€níÔôxWA±–†TfHÒ’U”ƒö–%ðJ‰ô_©¥!p7’Ÿƒ€(nä¨B#PuRt/K xðñ=¼M0òƒ}{ÁA Á²# œ\ÀkYmVJ¿¸ Òv0sÊhæÙi#×<®žIò5À)z†Ïž3Ë»U¶»×¤ %O÷õ¾0`ÜŒ93&é|Úæ}—2£oPn èÁî-ÃòE´Yã<ø|£9kÖôu2/Š½w¥H^•òø›M»Y¨Š+RÞÇ žruü‚Õ‹§‡¬äûƒOHŬ·‡Ò.scbB­ÁÏ-$K@E]«‰‘®;oL‘ÈdÞšµfšÀ­È¹}x£¦ûÈ ­@ðÎÛ3\ÏiðüÑ6Œ®AQÅÎþü½ˆ4#ÄÁ“c:{άàŽ%ÞcŠá¥¼½;nÞ¨ùkÍ^?Ôçc‘´–/Áâp— ¬&ÓæD³Ž zÎ#pÏľ{?2&LŸíÛ2ßÇs”È ÍÜa–Rh·påÊ ÈÏþš™Oõ 0´}=" H“NžûÚëUEÁ÷Ôõè('Àxö²µ½íŒ®Ú%c _?~˜maÞ˜®¡ÛÔ°QÃð‡]¦„©ØF¿Ip¤#.8„¬×õ^¦(ÄW‡°C~c ŒÀr!<ï `èFDÄ@5ÀQMÏ( ÎÃA‡y ÛØc1Ê/SË’©§€}fÊäed` ^‚]pý)¼w ðB"âzËêËÔb?T¼¾8è!êšá'IË‚Uu*7Ÿ .ŠÇŠ/€*~Jü¾(D”àâh\u±#߬â4óŒ¬ ¯øëéK÷¨ªË”˜›“[Œˆ±X,)õq°N.Ƈbœ†Ï¯¼0H¸|"w ½å±DùÍ©¢¤\JQ˜Á¦ëPÙO϶…ùE•yà v·¾ûC„yO:wu{.’{Ñ­ÕgæáÇEq»õW…Xô ß­·>)R"MßoÛs‚ì2uyCH¿1ëe÷¨§ û:θ w¨“øX;\Ê—rc§wî½QÌgæʨ"¯·£å‹\ æß5·òùRy p¸þ® g XLDD©„BÜÒiê­2©(ÏÝÑö{™TVãåÚ‘£_¹Xña³}/ùejÓ”^ÑS$E)ÝÜ‹Ä"&ïŸî8~'">Þ4û ""ó„M·QˆTö£®ÝCŠ©¤õýüWÅþNÍŸ†öŸróSlŒvV€pèó5(*Tkå0ë>rGBú[8uî>„›GáæQ`‹A[–î°4K—Á§?Ü<R`U Qkãy9Ì´A€yŠß@uJ*ŸUã-~Ä Ô@"€ç_ ³#Ì tC°µ…WoA_!ÄFãÝaÏcðÅHÑkáÙ[8º,›€ ÔjJçV‚ß|hç ¯Ã÷ þößëˆ>ŠNYtX²º.#Ÿ¥ð:öj*ë¢a`6°¯™¢…0öЂ-W“MM›Ð ò(:EI-GÎ x9Ѿk çÀ°¾}¼ì3gE.™îµÑ¦ÿ° €óFDQÃk]|a.ûk¦NQïçÕ–ù€jú ¹X»FÚ/‹Ë³ÔóÕ*¾ —-]qN™q s5SþI5›ÛÈħ)B«¾¦2,Ðu»é Ò¾U´«@ÂÉ•kμ5mc¬Bƒ± E!Ð5 LªÝ ‰”Â’¬”ÏYE€¡mÒÓºuî›ëýWÕiÞ\S•^^¤m&–¢à‡X¬£­ACÔ‚#†»Î·’nØ.L»ýuùýƒ‡ELP®Ï6qÓ~ÆÒ‹yÛB¯ºÉšÔ¶ÊÔØP ã0„+I_¹*ªêœ$yJgB€™ ÐÌ D¥ÁÃVÐÆæÙÀ|‹MaYdr ³>Üy D6®ÞËQë`Ðñ깪¬êÊ};Ûƒ*@~)€Tf © í;‚:„@4:AZ‰¼û87xÅU$§”VÚÚ¿BX„x·†Àù°?&µ¬ÁºˆÙÀÃ…wúÐS¸?· T§jcuÔh_·éZâ«ÇÀñurÃy{ÎÌøðøÒÆm לùlß îý&ßè7YXøíÐÞí£Ã6Ÿ|ø´MõA‡š-:»Ó8‡Sø[/ š¹I~UFJ\¹–|¡TM…¦ÊPÑngæÀJ¥&deæ'9$mUÂI*Iy"¢Ï UWÚï×÷®Šå$¾y"û„8ÙÖ4;VÓ›úìîîÛoU5›øØYÑg¬Ú¿ñÚ+Û&4ØÕÇâ+!ꄈ¤T]çŠZ2Æ.í¸dÿ’ëÁ‰É*<Û×·*“§\^½ý¢rDf][êüZ áÕ݇'@è@Ô2ë"4n ø;bÏf Y@`ç0à¿‚N¡±ð€Ï6 öf0Tƒì0lT°Í6:hû¤ Ø}ƒøç&d=p7—7¡àkÀÀ f©)ðñ#|{4k„À×B༇½q`êŠws®â2ayox±_žÂ¡ØXÀý4 áÄn€NãCp¤<—uŸi ¦ Ì407„Lhäö+}BÁ±pöYM/!ðw7ùp-A „°ÞŸµs ­ÔMÑrËø-Û¶’ýQðh-GL€Ð¿>»üøC tq =txíÝ./÷ðÉXPkl6~Á;yÌÊ”¿ŠêsÖ\~ìØ×Òd¯9MXx5’=~S˜×Ó´EGs³¼”ï啨=½û°T@B’ŠÅâJ§ªîAâÝüÝ¥x©ìyYÖs©ÎKªüÌåãrwí²„u…BZ=9Ÿ¥vƒ¦ž:vìرã{6 QžX¤c¬GÌ~íä‚U/ðÒ¸u ²µöP@Ðu€B ÈÉ!¿ÁU)D‘î¤èd¾Å÷²—W`˜mko¿ÚwWïǹýV[$Ñe%äu[بQÜæK&µœ>5ÀÊÁ£½¾øaÜsë™u4›¿»:øäÙÝ.=º°R>Ó¯h£ ôÎMÕV6}K˜µV£®U˜½+ºDwЭugÏë5»s0ÿÄt£èÀn*Œnk‚Ïzø¸»»±Þ>L,huû‰'0_^°âJÂÍÓ4ck]ú £ÇŽ^¼_A°@“ˆ½½®y„õ¶iñèÊÖ‹,ÕªE={W‡ü 1£çk5-}•f6ÇÔäþžU‹šÍôø·4º56 &LšíÔŒ7ÓpÙÓ5»f\±Ú¿º[ÿa{Ø•|}!í9|L+ueH.LŽŠœºz_•·(MM@3Õ9g>ÇìÛPrÓ.†ª['Œ;xö¶ “•5g_.=wG~ ¦ÝØ5øØ÷—¶6œ€ª¸( Ó2PZO ²˜‡Ì,LOÇÌl¬àUÕX–)013ÓÓ1# Ë8•Ñ·™ø#½&4!¦§an)"ba¦e( cUTËóÊ0# 3³QTOØ.»ÓÓ1=9B…8nUñÎI4Ì©ìÏ+—c››_ ¤ð%‚±I=@Íf(¥)ÌøňˆR¦¥az^½>"/—`‹ J” ‹òYÌÜÜÓóóryB "òÊ‹˜Lf~Q"òÊ ™9,!…N+—ÉÌÍ-*­C‹ ò˜L&+¿_™¡¼8ŸÉÌåeÑÆ¢a½œï¤•ÉŸå=±° å"UÀÊeæ²8Bieì5UV\ ƒ#”ÈÃèÅ|Nnž\[Z˜ÇdæòÅÈ-Ë+,å×&™[XR![N•ª‘_QÌd2ó K)D~y3'W âåäT­|~^.W ©æ-°Y¹¹¹¬¡%"37·LH!"§¬8—ÉÌ+(Sò¸þâ|“ÉJ±¼˜UR!W£‹Ù¹L¦H*_=~y^^1_FQYQ“™ËQˆ˜÷z£sÈzI•ó¤4fddƒúöH@ñ‡4Ùq3å~ûŠBÉ_«§E<ü–Š³ÛU7g#ö^‹Yõ;×mñC§…ˆ\¼³Pµ½’c÷ç^r­qÞ¹ÿ0·dìɹ¿ÚÖe¯òÝ«ßo걆# á¸©l®UÚÔßýK.WCxW†"7­ Õêÿ²%½År>X‚êx>õ/Ïûö%ò©ÿtf|þw[Ûî>I% §#ëQ οmη+‚Í;ÙlKû“÷ѵíQ6Ýl–Ž­›L§ÁþŸlrDxëÁ_5'(Ò«Rú“0¾_…žþÙüªêúï XT4fý±!‘5l0HýŸ¶† ­¡5´ÿ[Cøï}KìRV.³Œû_`MDa)3¿ü'øåù¥‚ÿBÄlf^É_úDT~Q@\Ád•üC_¬ÿI­Ȳ¢<¶€JÌ+Èc±Xy¥lAQ”„_˜Ïb±òÙ È F#rÊŠY,VAQ…Uu“©òâÂÜÜÜüÂ)Ê&@”ä±X"JWTyI!‹Å*(*‘"ÔöyW°rs%TÃÑñÏZ¦~Œ(âÕ½ßàQçãXÿ*„ÿŒ¦Qø|ž¹ÿúŸt»³10l^üŸ£ß¬7üúË! •›fº¿–©‹¿nëè2Sô'­7D»<ÓÞcø%›ŸñÌ­ßƪ_ƺÛÆ—¢¤è£[·n^¡ý}ìl&d!"r„Øغû† ÷µ·íþš)7Ÿ½?7ßÞÙmDÔ87—Þ åKÏÌïÝËÓoùª•<ÝlBËuç‚‚9}z:;9oOæTqàüÒA.îÃFpíåÒ=l½ cD«ƒztÏä6èaþ¹ †ªë.!R éµòèÊÒB••âÚ›­Të8¤¢<)I½ €7VYõ2Å߀Ժtc¥GsÍúJˆ²zŠ¤. Ê¿ùJ¼h•Bjg«Ý©îPÌ„\šå'L õ:ùvùù¡r`Ù_Ù éùxáDµÞSÊ' lI”R#%®ø¤Â`¨ÔÕŠÔ@O‰Vëf³– *d¥h¨WÖî*½ýF%hŸ>œ5Aß}Áå½ ÷ü4ïŇÞ[rko´ªóŒG[@ÆÑȾs½; %oF­y}úE¬$C|í/%z„è¿\öHíEÂUˆ™7$ÈþZBä@ÇæëÙ¯¾ÎRÅAÒÉù7¤Ï^=2Šìíûy¤_gCÙFbů»Þh°Fá‘šj1lˆ„øͦü¸!„ÜÙ°3whñË#m{¯<1·Çþ…c>ÍêÖ¹Õû_l#·o‰´\µ`O¾}ÎL¯~sô¤0ü›Ô kÁ§ öüg}Ìõm Ü1¬üÕ!ÓÀe§æÙ^u(.½kçÖI/’­GoÝ6Þ–™>ÄA³eà·bn–’s>->s-¸9C’z%xìZhÜ–ÊÿÞ¸sÿ{f3".%Ùtjúþuj¯){V± $×ÝÒyñ¯n­çç»^ÐØzv5áÅFw]ß$õÖŒ ˽ϖ Í~~²S¿õûœkoxBàóá‘;:Ú÷(Ê,vt—¾,OØ>÷¤¡¹æ¦hšŸ=¿Ý=¶|×DK”Ã5Üpù¬½Tv…/û šÃ64kEceòuŽž;Õ\•ôcǽ™`Q ji}ÿôµVãwP±»,lÚÆ^½ì<ñhÌs’iƒÃ_•¨Ø˜ª|ø̱òä(×æ?ÎŽxÚOóç)Woxî½ ‹E³l¡•0ûÒâÃ÷gÛŽýðãévÂgÙºõŸãÓò%­«NñÛ»Gžê¤÷W Z|)ͪ§Õ\Û6Iê=·yîøH#ÛçF; Ÿ3RèÚ[&‡¼a7*øô^·Cï §–ÑÞ­´Z­Œ7Sô]X£1œ IDAT®ì_^ül똓Í:Û|N¢wéwmÇT’°eTô©”vÖVÙŸ“õœF\\7ZX:sÑ^àP³f-X2/xT¿éÜ&š1J?åHœ¹d¬¿$Ñ"`ÑbOµ$-{øŸa|æþ¡’//²év;ë?^%6òœ|~Õ@nêó…Û.ðóÔ£ç•-[± åÈ…ý‡@È¢«ªz²oQóŽM¥ü2P.}vÚ{Nvt·6Yoýäo¢H•ÄwZÚ›1d' ŠKûö±ïÞ†z¢„0´*Y‘_œ|걺-Va[¨Zô{q¿w#ÙiBÓ`¨ªˆ%RÙ_Té·Aó\‹½6Ðå°Œ¬׶íx÷åÞ‘†säï^¦îó!3¨²ãVY¹M”’%ÙÙ»d ¤ˆ,ÿ®¶ïùˆˆ±ëC}Ç– ̹µ´KÀ<)â“ýÜý†Ê$mÎÓuV½ÆÉLÙTég{§tžgñ8O^q=qcÓø;ˆ8)ÄaóTDDª¸ŸÝ¦¸ônLWïY²ðoQÎS[¯B %,&S ¦ñÂBA+ßËàpcc:oAÄ+ûzõ/÷)¬u™¢¢ø¾½ìnÊêaÞ°ž–aóâ) ßÏÉþb’Üè~x–Wø¬KˆÈº0¡{ßu2Ÿ‡{§ö·U‘W+F¸ÎØ-¿ˆ½Ú1ØiôI ³Nuîäp;‘ÿe—Sn)e"~<³Ú#r"~=:Â!|“ŒÃ¥¯Z¹ f]åäè_$AD,‹Ûná:ZŽßóí.=Ò+ð˳^S)DäçÙÙ9ο“%ÇaX÷'~ˆ ’»Û»á "J˜wÜ­­–OAªÈ×Æù½H~™êڹǥ¯µíÿ4.TU Œ >DZÁûëÓÞ$f¶±ë¢'˳l7FCõDmúˆÊ0çf2u›é———”0ÕuôÍ4Лûº˜/H@"Y& ®¿™C(`‹)huw2¡@)ëƒTSMœú"î 4³xõî š4múÀ“Çv]),‘ÒGM¥´H­Ô%R ’ظdLÚ¸V³ØÕÑÁÞʨEí+2ô‡ÚéÉPÕÐÓâq¹ßÞ¿SkÞ¨â}\´ú&/>}âØL"E‡k•Ë O·4Àªè]"X7©ov«ˆ#ým2%HS«Þ¿*4R H¥b:©®‚¬ªB“ð¥RU½¦´,qA^O"0Ñ'" C¹Y\¶²©÷ööŸ{ÿÀ½+†*ˆ@R®¯¾¡Õ硳!RÕSjè4×hXþöeJÆu¢e [R>;åÎýbY¸[ÇßF5T1â2¡Šøã£éòK¼k_U1ð‰¶„âowî—Ë tðó3¤ËŒbH£«ÔŒç%jj Å<XÂ*;éî½LÙ6´êí¯û[)h‘¦Ù¨^O ‡B M¿­¦«€…tš\]¤¦ª!’r°º* Üù†'@´—÷8ª2ìˆO@OšìŸ4:]žæUHáÒbM˜?_EÆ4‡P_uYt¤Ž¡¬[ ÒRÕMŠЕ˜é•|“ÅÔ‹%<Ñ®b¥º¾†’dh*ꊣä©ëÊ.“ ‰}øP¥¯Ù²G»VÀIswìo3¸Ÿ—Ž®ZÖݵ¡k?îÑ…O\صôäØïÒU§/›ëÖº»ªÔ˜”Dšw÷Þ«Tͬ;™ÔÈ3/ùt ¨ËhS†|S!/{RŸ@ôXz*º/"Ñm¢ÎÏ­Ô‘PƨëiC«O̪Ò1KÅ[è–ÄYö˜xuD.°ù²ËŠp»úΚ'‡çM=›îù-3u@Âý8}ÑíÉG%%%r)Bÿòὶ•¥–Jà ò7 VIÛ6êWEK— -Ë×ÔR<Õu­MÄéîÓ–÷6DDBP(¢ÔTá©‚=³[óå®K— ‘Càð5µëû.´4Òå±òÅÝ´T€@Ö‡w’Ö]{¶cÚM½¥ ½‚+ 3R\˜¦£Þ€æІ¾ó |Ú AYÞ·ÜŠ®UÙjZ4Óæ8 ]0ÜR ! S4í—§¡š][¸Õcìòˆ¶2¢|±ºd+0­™¾f!³´R±\*Ky¼jhJ¤EX©‹ÍK/3pTTcý<‘ÿ¨¥ÝRJ`þ²å‘‰PHWSËI³#ßoŽÈ-çðùüW¦uë»´æŽFÇãw6œz›'à Rãœ=}3ùÊ_ ´\{tݹm'O((Jï9GªN÷^4]t>ævr¡€/`¾»jçÙ§ !œ#»¶g•S`lÖ¥ìã%‘P$”/ºüC•Vïò'ÇŬÞCÃÔØPw÷•ç ëÙ‰c™j€@S7µ5Ò_vü±@$–§nÛpÕ~Ô´d2÷Ô´gi%B!gçÜAÛÎ~ žì\ºáÖU¿ÏãqDB>—}y^°KäYü çվ˦çìŽHÎ+çóÉ×Öu ˜(®ùúÛùÙ•<¾óˆ%ðØggP¿‚‰”¾‰S~$©P $ìžù†«&²(ùž_ÁH…j·´ì ‚Éžsù|¿pj?‡¥§Suu› %y>_À[µ\j¤U’“/A 14‘—Ãæ¶L6qËUŸÇãó|OWkfA#ðþ̶e'”¿ŠH;y¶e}ž}á —Ç°³ÃýN'ä¡!æ0¹œŠ#ß¹ZÈlb·wLÊë8}apK6›Íáp**8R„€1³^›ò£”Ëar~àâñšš¾´¿Zu—Ãaÿ¸µ"!µQoï]ì»—|xy9µŒÏçóÊR¯Í íÑPÊ®¨àrØÍa³ù")0ïŽY—täÄ.[Þøb)£CÐÉc‡9räȑÇv¨I«÷Ÿv7×)K}½óøµ†³æ‘nªü h8ܹtæ´‘[2ÊŒÚ;œyÛB Rrg©¶.“ϯo:±¿_‡²ôùâÚXUù­€€ºÝíÇgM½#½Ì°mÏS÷›jÐäs *j­`â–S­wÇø{¸Ó:m¿t«½*€ªûÝ›»§Nº<‡ÝÔÜõê£;†ØçŽìk8®•Íaàr¿W£Ý==[Ù†ZÒ}JE%@E•8—õãA«Õ0Žú©Ë'fDŒqÛÅó¿jSdÇõŸy@h¯Ý=¾zºŸçºžéÔ=÷zÛè!iÚçÆ)õ¨‰ýÒÙ$(rÑÁáîÔ÷øûxþ³Ú…Eïl}ys˜;Õ\Ãg=]Djr°æ¿å¨h·xó¨Þø1!é%ÂvöaOîíg(âLZ÷¹¼‡Õ¿—HÏlÃá‹ZƒŸˆVÓ‰K. ph ÐawÔã0íæ]wíÛxÝÈEƒ[Û< í2ÂL+0À·ÏÙ»7^ì‹ ô]'µ#ïœNÈyóì>-â¨|)ˆñÉø»¢§ønÉPmd:oï}¯ŽF`å:ºÑæ¾~ÏD‚ö¦MÔ€€øéÍ/ül¿C2BŽúñ×ÍíïïÔ›îŸ+Ô½üè¨^­ˆÊ¼Kñ—Lóó[ÞÂÊûFüùÆt€VÏî´˜7#bCz±¦Qûù7þ‡à^£ÅZª´¤)ý.ÚOÞEÅ#=ݪõŒÞ½,¸«Ò£4õõ‘‹'ëÝpŽü-ËU;€MYQz…Gu¾R¿¡ºO²ò5¡QJ†S 3 ¥¼j»"ŠEì‹"Ã"k ¨œ.ü þŠÝ¨ºc°Æ”5«ÇS?EÕªTÏ/~òäMå/^ζ_ EµÉ«Å=‰à]Âã*/¾YÛãÊ=÷”0¥–áç§+¥,½ž DQu·‚"ªuaÊÒb(á$UïÊWü7@P%G1EQuH–-kAäàÉ ö¦ÿÍK“r‹R‹èLõÿø`=(‹òv/kïãÛ½íÓ»—2š¼¿uígx#€xGD¯B˾Þß^Ý~’ß&þÊzµ†¸ÄO“° ÒJUÍZé50ø7[CˆæŸ,xW<‹O(âˆôš¶v³ïòË°k™_uâ³Øœ"¶ºnS'{-zCñÚ†ÖpÜ4´†ÖÐþ?k#"¼†žòOêâü¿¤}û;«ð7‡ÿáKùßF]ÃqSŸ\DÈ©£»Yš/?›ùÇKëDøtfKוÿ“6KBHdo‹-×þÊ*  ˜ŸÃ*• óíz">çŸâ ·0GøO¿Ûåy9rE$¢‹»EùÍ¥$„Ìh¹äÄ÷† åŸ{ÜÔøtÔýŽÈ-™¹§.½ÞùäËÂpÓÚ]AnG¥¯Z¿£Â7­ZšR˜¡æ •’@TÔu´ÔêŠc¨€ª¢Q¾Ö#€šÏj¢©0k}„N/Öæy=œ®‡¯U³ï»öyZ°iýü¬ûBÁÇ;cgË£"´´t*´z¯Ã—*F×%@º;¢ÿWIýbIý²IÝ¥¯„)Y5hHN%æǽ;À^ÉžUF)"¬?óqÉö ÒÍŸ{ÜBînê¹óÓªÑÁ¾ Ÿ(û6oLW7Qs6 !DØÏwP¹¦î¼¾ŽËO¥BJ?Ýâãîæ³ôðc „òh[èÈm׌ ñž÷”@ù÷‘\ÝJ>ø[[~šVRRšx}£“o˜@B!âìÑ^Î}¦e”²¹œ’íý»Ø™‚ˆûç í7kGQqQúÛ]í¼Ó…ˆü—žÖÝ.½É*)-;¾¸WßшˆX±{ÃÚ´I}á—7„ôò•™_X&¬›^+÷Ò(Çi÷©”`O‘’Šû¸;ÅžžÝe¬’Ia¸ƒ£¯›PJ!bÌÏ=òNÏ÷˜x0©‚›¾C†„m~ˆˆXžØ­G_v•S†äƒ¿µõ¡ø´’’’w769ù„ñ%"Îíí6x^>›S–“dgçຠ¯ŒÍÏ{ÜËÂå ÙS¼œÆî/*.)ü~ßÛÆöv&"ûk·îNýÇlÍÍË!nžÑwÀôm¥¥%ß__õðsï9ô,"Nì°ûv6"&äìü<-ŸÍáÜ[1Ò9j"¾;?½—G³ ¨™40Ľ«ß" ñÑÑɃח—•SˆÃû¹»úŒIÌ.,)LŸîÞeÄ¡LD võê“š_XÁǜׇœœ}¿1 Š‹‹6î·â<"&]¶wž[PXTT0#Ô{Ωgˆ(.Nöèæò¬ ‚Oñú¹X_z•Q\\œñú¢¹EÍ vq]ˆ³ß y¥lvÅùÉþž1×ñåÙ½‚†3 ‹‹ X1Σ½ADIA‚£•çû >OL!ÿ•½Ót"JÓúÚôØú8½° ÿÖ²>ý7K, ﹺ¤¤$ãÃ]ïÛðcˆ¸h´Óšs?|^þ„FûÉ¥WßÈÜ¥±‘žÚÓUë„Á‹‡:´nÔH¿{Èô…Y±Åum] ­«¥©J_¹Ùvþ¥öÍÎ8¸8ûØ¡ýŽ½Ú53ÒWOX»0o„S›Fô»MkUšû¨@€Rß~á¦úZšZú µÌzò €{÷éÛÈIã ´¶ñ?»c%CBÝ_´‚>hs_Û–ôõ{ Ý(íË6茛9§M#zý$@ÓVÖ­ÊÃk´¦>“i Ë*ân꺅u)LɠĬ®F÷Óš'_I£@˜ö© Y÷ ÝŠT>ÀKM®èi×ÔÚ©oæÓ³ðíÔ>ßs+®]ä$¾7èØQ»ræçë6òücF:·iÔ¨‘uà4ÓòÜGB{ôm¢­©×¢}')å¶0º©ž¶zS×®ó’³ ,õÕ ÔßélhÐȨWD°Õ­s×€¤h“·LiÖ´ 8¯¾ œ8I_O¿]÷Þãš ëz|h¸Ù·i¢¥©åf[ðéÜÜw¯{ÌŽæF†Í»ÌìÕ^DÐÑ`ÐèjºzºP:cF7ÃFF­#"̲Þ"*drDû&†:êÔ¹å›mæ_êм±á´‹™'g˜ûÌ}p´YãFšš:ö-ž'þm‚ ­§£ND< ]ªªk```Ú=41þ’víë Õª“¿eS=-->ÃlX¯“àü¾ã½mnd`ØØxÕ¹¶l, kku ’uj«Éð¡?®]Îíä6ŵµaã&þ í˜ëAAƒ÷}§Íi¤¯ojå3©ÕpúÓÚÏP¨wY¥×4 c›÷NY=‚R!ç~*ϧqUWöûFƺÞÞd/9Åå~.- ÍºÊ $¦ „©»}¼÷É!ð9÷¿sý›©Juu e*ƒ  »¸B»‰¡¬=éؽ þ.æ¼^æsŸ†„`±„ý໨W7Õ_In”zÓÎÊóÛ!M+}Í9Åð)6©kϵV*7N|Ä(<#é©Mkne^ñ⃸söóæv½Û°·G%}}ˆ÷F¡Ø¢ÜÅ ^ðdÂÔåtëZ¼ô\z›Zo·ÞºÅS—ÎðZ#1îåÒ«ßð(§j5‚U™ÊV‡®Ê”¥•h¾Šö¹Cdi %\n“ôj<·ÏŠÜÙÒóŠ€ü¸Õ±±íÉ,Ó6m!Û9àÔ)¢$¾sø@¶D‘êÕwh§ÆZ /ÿŸtÜ@uºCMÒzè²Scœk>®ÚµŒF I—ý÷gµ­ñø)@Õ·×P“´¸àÌ8Ÿk@[]EÀhUV[!ÐX Ìm?ÜߢÖ5PYòOˆ$uI¨«+%H i¡÷†Yð!)µï ãæ:!»Ýµà]™| ¼¬¬½{ ïnûÎiª6êùįmî;ž`ܵ?ãM÷¥@w™&¸·oþésVÆäÀS]«¨j’–áóÏŽ÷¬;¯¢>³í UMºv³û·ÏÕø•ó ©”BUt‘°’>n^9À/9J×R•²…r¯ˆýs›Ö”pe“6R•Xî»?»bGatŸÍ&?Ü6 $­=)¯6(Kßaç}‡ ‹3¯?:}X¿‹Ï¶¤ýU MŒ;{oaÍ>üJqHÂ~]³›é€¶º_į¹j*bAeœ+'¯¼V–ÔâÜÂ"€â‰¤ oþŸjG µüpò¢<­Å>¸ç_ª˜šH³woÓNÊŸ'½ô¼„à>–ŸÎ\‘¿È=´ç8WZŸ¨kÒÆTëYÜgB€v„u§ÉÂþáo÷Ÿ”×¢–”Ø{F@–‹¤šú:’â Ùû|ãêW:½Þ7J"`3ó e=Gõ¼zÿj2ßÑ^Z™Y—~<|$‡˜ë‚O¨ýë7×î~lÚz]Õ˜çvű‚mÌ@#l°É®s7éí‡iÒ!8Ø2þñgâ€Ran.KŠÔÇòó™+eÕôãþ2y?b“––ââÂwÅò7&öòɤ^ÍN­L›SI¯s `ùꓬ_zÏK@ÕÙŠ‘pá•,ÛÎÎÓUUˆL¼Cê7Khh„„˜>X¢j}\LñÔÚ[5—m‰íÏ3iÕ ¡QJ`X¹ù: fhÚÜ431'© %,&SXÏÒS åÚËøîî»òóŒùìÔ½d))€„ySÜ4ÜH¡[‹üwŸ³¥„HXw¬Ìœò ySLŒÏ$¼Udzkž«ªCæ/Š‰‰‰‰™oÓB·áÍÿ³¤DJžS€®×’Q7ù¹ûöìÖéÛË ‹a£¢R•ážÓöíî=Ä)è¶]µ7ï¿õ™³«†Õ–€¶û‚È›CüÝ|zÚX|{õLÕlȈ(rUödŠB¤6­˜ì9êáéŽô‚dÕÎýfZ¨ƒÅÆÐký½<í­Û%¿|nÔ#j @^O·…W>»¶ft÷³ròÆ…›rÔ™Ï {´ÁsÂJ€Šô 0ãφlŠû(Ñt/˜ÓGoÀB0nߺ 5]¯sU: úš¼ëU`¢*¶jœ8––e;]¼îŸF®ðÜ|Ÿ í–;sH‹ÞS€_ð®Oèô;Ÿ¸Íê9$Àͧ‡Eê«gªfƒGDÑêb¤pí£n`vf‘˨ç¶ÖŽÜïo³Ðü\Ÿ!ÀªrD é5o@ÒmDz/I#§w]zµŠ8¬M2 …(ŠYspôÌAY=Õ³_{‡ÛKŽPФe·¢Œ]ÃG|ÜyðUcä (¤ä>îS÷ïê=Ä)èŽ]õ7ïSBfíÐ3ÙyÎXg–‹C³ă«ûœxhá “åCºI"ýú;ŒX.y³ÇÍ÷@7óÖ)ïè]݃ ¨ÜÁÁ~ëo$uoÎ@ùö©”T) Æ,Ú|¥ï$··g¬¥¯“s&n=  ÞÊÚ¨b„ßzA¦ã¦›t  Ö9lõ€Ûƒz9µïÐúËw֘ÌF>rõÔ8G^ÊÛSº¾=‹ +ßÐþï›ò †šµ  nþM…ªÊŠ (”9ø)„ê>Õ%j$PZ‰P¡(\Û”“ XžZ;"bî‘ŠRx9eª‡×~¤H‹âÓšÕe „ŸÐ SW±RÙ¨šàgI;1hpü¨{½kß.kѬÀOA 때”›skÞh”¬‚bõͺë[«¬hU,×OrM)–¾¨³Á@éÒ+Ý]JkcÔ½_çž¾ÕïíáÞµ0lh¢ßMMÕ©ÛAñQF~BuŸj ¿+Œ$uT/ #”äÖD _“»À IDATêß„ÿåF‚N`Í.5ç$¤æðÚgS|ªˆ6ù5½Ê~W:ª&øM³Âǯ¹(SÝÄìÎìÙ£.ɵhNº43(l–ì¯uû^ö ìRGŸ¤dÿ_w}ëø1)aBý´ÔÝ`Ê—^éî"uV¡ªí_2tÔÂ#2ÅpôδÑ=~©Äkhÿ÷ÒÍÿlû÷–ÌþO |Öúè©çŸeÐT4B&-êFûiI+D)ï즹›Î¾D»°)kfÕþ_ GlY0ýÄãT:]- jÑ‚QÞ*Ð Õ47 íï˜õýýë!ÿùuÿæ4´†ã¦¡5´†ö?ØêµLå§&dˆÌì:)þ˜›ò” {tjôˆï_>nÒɹ¹Þª&;ã^b¹·k׿û•?xöÉÕÝI^h„Ï|˜Äö´7¯Ý˼÷&ÏÛÕö¯L‡ˆ˜ÿÄDW-UlìÕ£â×—›ö:¥ëãÜñã“{*ææF´wOâˬzšz­l:kÊ«äæÇÆ~ëáí¢]=½èÙã'ævê)Ëýž’Æä‹)5M=³.ÖF4¹¢’<‰fÝV÷Í÷ Z¥:Fž§˜Rwu7›(¥Uê°i*F-ÚY¶o.›Sö_I9+)%Í34t;t¶j¢Í¨x_¦!šMZ÷´h]%V¼zþD Ý¶—•I%µÔûø§Å´&ΪT/yïbs›9Ú«ÕÃ:ÉëÇšÙx™èÒåY/Þ§C¥åÎPoefÙº‰Nu*1ûóÇä >¡ÑªykcÝŸÈqŸ3Š*d «j˜´³lk¬]_ÿ*-}ƒ¬ôï’nîl F DnINJò—–ý7˜â*{Ó>ÝÜÿ¼úäô@ ¹q¨èÑÌåײӿÐmúŸ^2FŽ—ø‹×är¾Ñ•WgŒå=Éd¯7ÜÒ§žz¶×– ½=®ç•>·÷úÖÃ<îP‡îÁ?„[0ò> ›xÄÙÉžF‘*a¥Lú>hëíɽ#^V\ïþÓÕ[thÖÄPÊ.Iÿþ­[䎣I='ÈᘱǾrÌ[K)iavæ甯ã÷Ýnc\ß". ps+®UÃñ·¯»ÊÛí ýçÇ‹<6›Íå dÉ¡E—/ADJÄcóD±Íf³9\±)ŠB 1ó°Mÿ=ò,ÝbGþ”B¤¸ì ¡„’e§(ŠÃf‹¥RR>WÖ‹'–"R6›#¥¢’ˆ*ØIejt›-¡))ŸÇe³Ù_žÝûëA3—ÉD›ÍæpÄRe‰±%"Ù$B±Tž œ’Ê~I(ÃJdSW ^3Îç="%àqe4Š$"¢TTÁæU¦ð¦x\›ÍŠ¥"—'Ë‚<¹›ÍæòøÒÊLàå‰kÇßBÄ©avkÏ~¨ÆN’îm×ím®Q4˵ãÒǤ„㜗¸‡¢G ^q¬*!ü‡UÁV}öR²¿ªö—'ßM‚¯~–Þ)‰@"{ xl6›ÍæD²• „\6G iˆÀü×C4Ð8y¯]½Â—.žíïí¾üò;¸±¡oä†D཈qwpèШ ׯÍ>v ! Äî¸áâìx×AæLèëê<¤ȲI›Î}‚H@ÊK ðö*‘mS‡x…Y³~íØ0/ÿ IðuþRŠ„À÷‡GÜÜ}ÏäÊÄõ§^ÎQl§—÷ Ý°i}Oßéçe•—ê’Åœ§-\èåæ1žK)¦³!”¸4ÈË+dÄä™cÂœì_–êäwï>kÖ.ñðˆœ>­ïÖ+iPšìäÕ¿² «à]"ÛÍÃ8áØ\Oÿ ekÖMèâÐ/Wyµ»ß$ €ÞŒôp\±v¥¿çU«‡Lßþ¤œnAç¬[»"4À#jÕ™‡È-—‡Nv€QÞNç®Þ¬âqêžÙ­ÆY7cÔ»„hØ6§Ê˜e¿úp¨i© >¬ „ ˆ0`ÅÞSÑýeitîî¸1Õ‰ü¦À êfšª4_ ·Nï´tëÖ òN¡Ö)4&ÂüÖæµÊS‚#A©pÁã¢èÞf#ÜÎ\½¤øÐ(|›—nìƳoþžºš €¡‰PˆPtsN>·ë´‹* išm<|hªó›à¸\±^{S™ãõ©Å|{¯Û¼q„¿—C¿•"€ëûö–¨‰NîØñ¢xÉû½ÝÝg/Y½pÊ0g¿ØÀ³£<¶~h]þuÝ š¨ )>þ @˜´¥GÄú ¡§ª¶— C…$]Yÿꎉ* snÞuàv>€À¾¤âé“ÚÀþåsmGïÛ>® Îïçs$>+ÂÕ)òñ½èA]@úé%âÎsš«—=Nø²1ö½,|tç©Ò434HNËílÐ"ñÕ-çу.ý0$ÆŠyþˆfèpíÄ+k<|GæÏðòŽOóq ¹oºì}1  ¤¼@/Ÿ;_‹ú™U¾®ðnkÏjVì¶`¸¸vÂÁ½z 1ÝòIãvüÆtöK?·±­½i ïNúñÔ6,èÒÙûoEœø4Öàeì#š°º®„›·öiÅ¡ÛÌ TA˜ÒÛ~@‹at~aòЊ½xâ‚ûñÙMT²ç»ê¹¶ZÐ%r¢ñö¾WYÑ!Æ”pöù¼è]¡u|µêz’ù¯O`êmÜîWKÙ|ÃŽ©ÁS=ž´lÙ²£Í€ÁýlLån{üìÙîš2”—K¯Ô"©iV®<À©¹£³ÀÅ¢¥*€ðÛ‚¶ }«ýúA€ÎæN¹ÏëÙ9 H;V!èÔ¥¥¶VÄxà ý”ÍðÔ“OLIÄ›6ϱ÷Œ ê{ßJõ¯2„A«š¤bëÆMÍMGàë)Ú® ´¡C Óé?…EË}{{Á¼d)bþ¯y궗öz÷ÍñU±šÏâ/èÀÂùa~®^ <&|åÞ/Q3§¶êÐä#6+¯oro ™Ÿ_T°ËÁ@wàÿkïÌãjÎþ?þ>w¿·=m*‰J¨´šJJ¥H´ ”D4valÕPÖ!ÆH¶,![Æš”‰¡bdk¥&íû]Ïï[¹¥ÌïÌ÷ñû=æ<ÿ(>÷Ó9çóùœóºçœÏ{9žîEa5ùKúžÝ`¡Ü`O ``»«‹ž¿ìîHÌWwîÏL•–¯¥µjºš€Ú{ÙßM1`@[RVØj ûÞŸzïz¾@Ô[¶jƒ+€ühµµþþ›£~+¬8º8²)0ßIý|ÎÞ[íK'Û×d€ØË%®#ÒÒþPìO¹êäÉ“'ã/)Q˜)oþ ð¤ ]Q¨Lkiú­×µÍä^¸Vaíg/^6N]³?fµ×ûŠ·R²ý”©€@ÆÒD¿gúघT—)–Ô >£cfO^»u_Ϋ–Žj,xM¯0HiÊ200‡N´‘ÀlEýA‚Šé³~Øw¹«8;š#€¦ªB>C_žAѧxê_‹9µ}̨n“rÑSú<Ý•ùcMÍÌLMM­¬¬ü¶ÞÛxवì_½CÄxð˜yy™7#7®µÑ¦î v³rp¿_ÕEt)€/äödÊà S33333s[ëL†câÍÝ2€D|!Ð4É?EtMԧכ`ïÊã£6í’B í7mpBô„$NV°ÖO;lÝþ¯í¬Bn©™˜‘V–6SeÆ­=}`.ð˜Â¤í.‚‚¶‘·×Ô©S¦Î Ðn¼¿æ×›ð8÷µ†ñ¹Ž=7š¢Bê«â  ¸-õºâ¿8d[Jö«VFe1Ft‡Í 5ùä€ÂQèü2dÒ)‚žn´Tt›@Cæ>p^¢H~›€Ê¤w¾3C7òv:õ¦íÏÂwTù êLÀxÅ‘Ñ¡sÔpùêéc<æ…´‹ðÐÿ¢„ÛÐxÿ™ª‰Žªº|Ý‹6Þ¯i²Òíß²˜,Ád2™L¦Ç¢¥N:J€œÎÉ’b 6¾¤3$nâ!“v¥B—‚X]MgpzöÔsÅŽf†€±ãâƒö¬2RæEÿ8ÙÁcöÛºO>"a;ê4fɱrq÷³VÎœÄ+ÎtûÎlÞ¶³ 4㈒ûrêð÷™êù ýº eË&¥éÛåé½X¼ººý$7÷É“'Q‹D,ùq¦:¬û©4BH2×·@$ÂT*E\…£hhj9kqÈå»y¿úêmÞ-xuûü…Õ · ýöèInnnnn¶•,Ÿi0a€ `.]”þ°Gd΢÷/•ä•?mÿIô^í»„jœæbiiiii¹ëÒ»ÜWDÝ}P<×EÈfŽyÒþU•ÊÔÊ“§*¨×µvG 0±Õ¨ËHæöºµoÆì~šÆfæ#GÚ:yì¿t±êꚌ">—/ Óè]ë5)jâò%}V”m–§Äïk¨t5z¹™µëåç­Ý””ðrƒ(ÜòœŽ¾Ôò²ª]MKþ‹ó\€S{îÎ4 à=R‹0Fòo$$V€Ë„i3N—¤ìV´]ä"¶•|h4°;wYèå´ûÒyi¿¿ç¬Ë~Ê™³ Œ­f´§•<®£8iÉƒÑ ÅZ¾¼§—·———···ãh‡1:Š€ÒP\Ú ò넦šÒíbÙéÃã;Å€UäßOH$/«ÜΫéì‹íåï»_JIq¥¦±.0ÿÃûŠF£üç-ÿíÊ=[VåéŒü.i ±ÔÔ„z_<®@¢öúâ?)ÖcÝ–ÿ´ãÁÓS¯ïy p.&Áìa«,eâ=‰šý ,2íœoÔKA{Gh…ïf¬3©¾±äè3$n¬´ù@…ª¬Ç5âœÈ öÎá?yC´T¨_[²»Ã« ,̵øMÍ"À¿Ÿx;oÆà/§-GÚ[Å•úóÉ_³~ùþy-ïYùw£Êu^^Iì‘›ÖÓWž]å·òšØõ ‘[/Ï”€Âk?³Ô¼²³Šyô8Ë¢.kgV{·¤¾iÛ£¡ ¨ œ¯z¯!þ*ÁT½ðån;×sÂZÓÃy7Î=¬ìj!‚¦ {ãß jÿr‡uÜ•AoiiÕÓTª(¯‚ÎÛû´¶ÍBSQ"¥1®®(QÐ6šì7/êÄõCOî=ÐÝŽð‹)T_õèÒ×ee%{—GÊN ÔýrO¶ž«BÎZ²âÇ7yîŒäÝóŸ¾yñ$m~Ä/2lÖ?žúâþ®¥ëBÆ ¼ôër.óyqqñÒŠD “~t07Ј‰O1±w€Ñ³öoÜ¡8‹  ã3ghñÕµ'î–”–<¼î4~ÂÓŠV`rZ~Y¬¤¬<ÿÞ™?Z©“‡©´o_4ëÊí01<ôãÉÀäœço_=]·fEq­”ü c¹†÷;®ç–••Ä…..¥uëñM©QB§ %@—NtÝ•øø]Qñ›—Ïòªê ¨u}dzäôú3;Ïß)//»ôKÈ3ºj(Jòœàõ0¿°¸¸èÉõ¤&•!ƒš__ÇšNò]ª‚è>‹§] ]AS±ÔaR¾¤aý)úçÇV¼jEùÅÞ{ƒýâo=,(ÈOûýÀØI{÷¨P@ÙdD{ÖÙ ó#å?/|ùâQf¢ûŠóžó}éU÷SÙCí8ÿ[»˜ÚÏf͵™ £y€0ÆúãÌ7¹t>“œ™_ÿðvÂı޴q+Ã\”5l\‹îEħf?{pþÜÍ?œ\&‚ècÄî|ïmË$'%~ ïDmë¾ÃÚvsg*¿Y÷-Å€Í|×¹ÐrçlME˜1dG óÞyÎ!û.<ÍËËɸ1ÓqTÝ`ž%µ×ÿùæå‹çÏ_ä?}´{{5Óbä09miÃ*î†Í.+/{z+æi=ÝÛjХ؂ºÏŠJkZ#gûºþæ]qÑ»×wh €³b6ýšTŠˆUÎ7oÓhÒÓ6J?=¾ìçõS/GøGNU3˜Šê*²w—ÂTWWå5¾VV³WdS1Ø|jH¼J\Xèª6¶úö„4 @TÝežýN¼b#€3ÍÒÓ†oÚqê}ƒ´êÝWÓ†q(ƒßxÓ›o ]¬¥0€¼Átvã†e.0Æ'ïÜÚ³!,øâ ó™YºÔ1”†¹E.¾pÑ¢&†ÆÞë)Z²T^MEy}Àœ·ÏJ¯¯à±§‡ñ¥o\² dñqÙÕQÇì6Ø!D*]]M•pùRÅ¢ €AãBVòΈ +WP¥ÕæF'N2P€2) 5%À4ι”‹«‚V,L m>8«qò]„†ùÞŽå¬ +oä©é¾šr¼©à¢¡#$|½1˜:L•=œc¾QÒ©SAUCš…P?55yµk\)êßìppÝ’çŽ, "lqglÖÖÈ*›UôÌÏݹ§' PÄÞÎL<öËÞ-ë›H^]?äxòèÁ²¯oÿÎÜ¡çÃeËôWQ”8ÀPSïÏ t™bGä™k~>³¼|­´0¦Ìº<¥àæÖèC>¶È¨ê­‹½9ZWc,­ép;nSpøÎ H.$þÖX}éê‚L¾ùB}š„“8X:ø ö×MQMÓ‘òa s#Ýüá§~ì/¬è‘R ):*]ZMMYÂ^Œ¾jGä´ÕÇ ùcõé`¸={ÊœíÛ÷lÞÏS÷Ù–èi9à f~Ò J8;kMè@¦¹Ó¢{<‹ûXòžõaKã?¨•˜vCž‚nZ7v׆«VÇnOz·+t݇4™ ³¶‡O4Uä¤6»»»œ¿|¡ø/œ ZR“’¿s,Cá|§£väÌ4ã|UXÄÏL¾¢gç®Ê¡@„»Z’¹ÞYžt©¿ü­ù·¿ì†ÿÖ´Þíe·–ŽÙhÓ5ßúDZ+Þ¼oî9Á" m]6òíϹ¥ò͇ϋÅÚ:ÿA±"7áÿ<_áiØ[n÷Þ¾ãÞr¼ö–åµÏƒŸ-Ã{€û¬ëKýCs¥>¯÷~{"75BïÎÊéNô÷ø.^Íȇß#”,¿úІæFF¦Æ&sâ„j«ž§L²3³°°u›“þ¶ !À€*ó’g¸ÚšYXØyÌÍ(jǽÌK‰õt²±··3Î7áA)ˆ­I056|˜îˆøªO–ˆWµ/lž™ÑScÓ6h¡ŽÁ1BèRÄSk».46Ƶ¿ß½j–Ùcó%[ŽqêR„PjTà„ã$¬a„ó²¹wD=«»ˆºT|aȨÙüî½lʤ…;Äÿó°sÚ”‰1Æ·n&#ŽåÔcŒ›óã¬Lm+[EXøÊÕÄøä“FŒqÓcVæöÕí"\qÉl¸s~;Æãš6Ö#Ë›øã0/Çù›wú˜Œ¼ðñS]‘AîÁQb÷êµG»üœÓõQåÃ8s[W[gW¡HÔÕ¾îÍõ~ŸÝñGŸŸ€1óçzcŒqk°³¥ç¯Ý äF¸ZEfÕo`¡¯Ù 6•…ÿàeieemïz$õ% Å¿k™ù ,HŽ^eme9nê‚?>ò;U#Ñ!O ÇmÀÈvRĺ`ñ²fÕj‹ú;©|€¢3±U¦~³-ä°”ïpE”òºªèDLíwþ&2Xv„ÿiá­¢ÚºG¹úŽ†LÀƒŒ•Â(má¦oùí@èèž°ÉÌÉcÓꀀúãfué·âÅ ®\±øàŽ#;:\ÊÜ0bÖ¯Ý7‘ g³ŽÇ/q«GŒ…qö®™=ÊÚÊÖÙëZn9B°×]ßçÐ;Ô/=ÔÛhíñ—µ/­¸`Ïi[ƒ¿ ìeËŒkÒS„é¡ÓLæBa`,Û·åÒê™\!™Ýþíôù:p_€kãŒä¬ƒjñý&ŒQR¼ê©Hå°™P•qê}RF–mï*ÅÖ]› •**Ú`7uvÇBðÕ˜ÚÞ‡é9¯«‡è Ÿ ˆ2Fƒ–òª‘ñ¦n˜žeÇA Í^%Öûxøk…|ŸTºÊE‹ÚXzGœá lÀhøM€ºS3Gï9Ÿê:œ5hÚI ˆ [ª6÷×Qìö.uÑqñ_=R©çõËI˸˜ÍÙ—wËD­ó]¥ÇÜß>¸o¼G¯8œ7ù§B6 ƒŽQFi)Ïœ9?”]ËZ¹d 0rñ ìl€(16[Çç'*€žÛìUÍš€0ÈišÉqk²ëø¶Jtò¢”@䦄"\‘÷yº0â®Þ£P)PÚ±Ùs!ê¶ÞªßåècXàç–#Þ*1tnØi^%þ™»8êµ~ê‘áÐÌm—–ꊫ€”¤Pcm[—+Ãêv°¡¦ ÀðÐá`÷‘l†1ŠM’c Üwvq]Y‡æÇ”§ÎÒ {Ž”fn¶h-{Ü¥LjÎß÷býEiã©Ïœj„Z>佤1Ó§0õÆŸŽ?>oÄöæS%\á`õîÁå)Þƒ@Q{¦Ÿ6tZ‹‰ËLÙx¶Å>ÕWkXMð懲&ã®!8û´ÞÖI…t8‘›Ï6t¿¾gýÓÍ::ºÖ‹ÖÍÕ1ÂAø²éhËB 0 ŸH(‚ÄÙãb–O=Zd”¾OlQŦ3ÛøÜ®*ê[±´“Cc´òº¼fp]+H˱ZïEyl*¼þ »?›ÖRõÊÍÝ©ßåkUNŸ›µH¸oÉäӚ߸Φ@ý¼u×&§‡ÅÂQ$ë}ni*’ €¸­• äÕq¥^;Ç œÀø[®UõÒ<Ÿ•ã³bƒ¤Ij§Öðw¹ßà9&&®¦IèYçoê0-zRa5¹!¹é¦ÜÀÕ{άÆm…ÏrCW.?2àôÜÁb%¢(Jáš&ø?mÕM*¥‡ „£‚\ÒûÍȼ4“Š;§é ÅýÙ•âDwß ÇèÉš6Ê(è:(¼û^ä ¯xåDîP·þl–RÑq”CqOk­Çsz„D‘ÎeìŽ0@ ×Bž44.qµ'­¦¶µw5M[¾(úCcÈ#šTfúÍÊ;1lÙî9;°Ë”ìbÝõ£UºÍ³0FHák_bºêÖšÉ ‘(²ÛTQ ¢Ðˆ]áßNY4! ×”Š[ßÄÆT]©¢®¡#µ+ ·qÊžÔ —ï°:|ûp]ù»Òš6@(5zñ-)Ÿ‹ÛfÒ$òÝõñ¦e^¼UÆ„ÚŠÓóêD.CT†úû¢ô3é„€Pó›ÔçÍT—Á ¦Ã_ÜÉæv(AãÃf‘ýà®(, `ƧåJÜ”¥x&b:¥³.¹Iû_üp´Üe„9ç6ï×›¤ €Üæ7ïŠÅYhϯ÷e¸æؚɒS§Öåo?tm3  u ”Io#ÙM¯‡ûOüFì7PŸ_[‚GìoU¥í\0 ŽÕó›1Ê)I…ÞjïéØzã…€øÌž§­eüd{:­½°³;Ñ1Ú„ê‰wÏȱM÷혹ÜÏvÕ*’ ÚISšŠaäÞ-¾+§ÚÀ`µ‰ä漬ÊAª;_Ìr²±Ó¬ùþu‘þ˜9Suå î¦ã„!ƒÒÌD›]ì")Èkïå¥Æôß²*©oíìb:VF0àFÚ)™ÎÈj­ÍÍÜv®c B¢W/*™w|Yw•´sùbeClåß,¢ŸŽ°ª p8:Wc@4öcNh⋨ßGŠWRu¯ÓÝ~~’“Á„úÉ/ëè»í’wuè7CïfòѬKWÔº<=€×TCße$ûw;ÿÏèÉ᳔:ŸòÉ÷êi+‘n¾lU²˜êE…Ðg>%‘G½ÿY2û^6HPo{&½æ ï»ø/7³ûfL·€NèãµðA–=<$P·‚z©·û£Íë«•CŒG‹St5lúeqì…h Ìnþ%ÆõóÿF*D‰:.¬w»ªö[°%ÉÁH ðTv0ú¯i@ä†@ Äc@ä†@ ¹!"7È @ rCn@ rC ˆÜ‘@ä†@ ¹!"7È @ ¹!Dn‘@øoð?ÚüÆ÷‡÷IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords.rst0000644000000000000000000002526413051004444017745 00000000000000Header Keywords =============== IP-keywords ----------- ttl ^^^ The ttl keyword is used to check for a specific IP time-to-live value in the header of a packet. The format is:: ttl: For example:: ttl:10; At the end of the ttl keyword you can enter the value on which you want to match. The Time-to-live value determines the maximal amount of time a packet can be in the Internet-system. If this field is set to 0, then the packet has to be destroyed. The time-to-live is based on hop count. Each hop/router the packet passes subtracts one of the packet TTL counter. The purpose of this mechanism is to limit the existence of packets so that packets can not end up in infinite routing loops. Example of the ttl keyword in a rule: .. image:: header-keywords/ttl.png Ipopts ^^^^^^ With the ipopts keyword you can check if a specific ip option is set. Ipopts has to be used at the beginning of a rule. You can only match on one option per rule. There are several options on which can be matched. These are: .. image:: header-keywords/ipopts.png Format of the ipopts keyword:: ipopts: For example:: ipopts: lsrr; Example of ipopts in a rule: .. image:: header-keywords/ipopts_rule.png sameip ^^^^^^ Every packet has a source IP-address and a destination IP-address. It can be that the source IP is the same as the destination IP. With the sameip keyword you can check if the IP address of the source is the same as the IP address of the destination. The format of the sameip keyword is:: sameip; Example of sameip in a rule: .. image:: header-keywords/sameip.png ip_proto ^^^^^^^^ With the ip_proto keyword you can match on the IP protocol in the packet-header. You can use the name or the number of the protocol. You can match for example on the following protocols:: 1 ICMP Internet Control Message 6 TCP Transmission Control Protocol 17 UDP User Datagram 47 GRE General Routing Encapsulation 50 ESP Encap Security Payload for IPv6 51 AH Authentication Header for Ipv6 58 IPv6-ICMP ICMP for Ipv6 For the complete list of protocols and their numbers see http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers Example of ip_proto in a rule: .. image:: header-keywords/ip_proto.png The named variante of that example would be:: ip_proto:PIM Id ^^ With the id keyword, you can match on a specific IP ID value. The ID identifies each packet sent by a host and increments usually with one with each packet that is being send. The IP ID is uses as a fragment identification number. Each packet has an IP ID, and when the packet becomes fragmented, all fragments of this packet have the same ID. In this way, the receiver of the packet knows which fragments belong to the same packet. (IP ID does not take care of the order, in that case offset is used. It clarifies the order of the fragments.) Format of id:: id:; Example of id in a rule: .. image:: header-keywords/id.png Geoip ^^^^^ The geoip keyword enables (you) to match on the source, destination or source and destination IP addresses of network traffic, and to see to which country it belongs. To be able to do this, Suricata uses GeoIP API of Maxmind. The syntax of geoip:: geoip: src, RU; geoip: both, CN, RU; geoip: dst, CN, RU, IR; geoip: both, US, CA, UK; geoip: any, CN, IR; So, you can see you can use the following to make clear on which direction you would like to match:: both: both directions have to match with the given geoip (geopip’s) any: one of the directions have to match with the given geoip (’s). dest: if the destination matches with the given geoip. src: the source matches with the given geoip. Fragments --------- Fragbits ^^^^^^^^ With the fragbits keyword, you can check if the fragmentation and reserved bits are set in the IP header. The fragbits keyword should be placed at the beginning of a rule. Fragbits is used to modify the fragmentation mechanism. During routing of messages from one Internet module to the other, it can occur that a packet is bigger than the maximal packet size a network can process. In that case, a packet can be send in fragments. This maximum of the packet size is called Maximal Transmit Unit (MTU). You can match on the following bits:: M - More Fragments D - Do not Fragment R - Reserved Bit Matching on this bits can be more specified with the following modifiers:: + match on the specified bits, plus any others * match if any of the specified bits are set ! match if the specified bits are not set Format:: fragbits:[*+!]<[MDR]>; Example of fragbits in a rule: .. image:: header-keywords/fragbits.png Fragoffset ^^^^^^^^^^ With the fragoffset keyword you can match on specific decimal values of the IP fragment offset field. If you would like to check the first fragments of a session, you have to combine fragoffset 0 with the More Fragment option. The fragmentation offset field is convenient for reassembly. The id is used to determine which fragments belong to which packet and the fragmentation offset field clarifies the order of the fragments. You can use the following modifiers:: < match if the value is smaller than the specified value > match if the value is greater than the specified value ! match if the specified value is not present Format of fragoffset:: fragoffset:[!|<|>]; Example of fragoffset in a rule: .. image:: header-keywords/fragoffset.png TCP keywords ------------ seq ^^^ The seq keyword can be used in a signature to check for a specific TCP sequence number. A sequence number is a number that is generated practically at random by both endpoints of a TCP-connection. The client and the server both create a sequence number, which increases with one with every byte that they send. So this sequence number is different for both sides. This sequence number has to be acknowledged by both sides of the connection. Through sequence numbers, TCP handles acknowledgement, order and retransmission. Its number increases with every data-byte the sender has send. The seq helps keeping track of to what place in a data-stream a byte belongs. If the SYN flag is set at 1, than the sequence number of the first byte of the data is this number plus 1 (so, 2). Example:: seq:0; Example of seq in a signature: .. image:: header-keywords/seq.png Example of seq in a packet (Wireshark): .. image:: header-keywords/Wireshark_seq.png ack ^^^ The ack is the acknowledgement of the receipt of all previous (data)-bytes send by the other side of the TCP-connection. In most occasions every packet of a TCP connection has an ACK flag after the first SYN and a ack-number which increases with the receipt of every new data-byte. The ack-keyword can be used in a signature to check for a specific TCP acknowledgement number. Format of ack:: ack:1; Example of ack in a signature: .. image:: header-keywords/ack.png Example of ack in a packet (Wireshark): .. image:: header-keywords/Wireshark_ack.png window ^^^^^^ The window keyword is used to check for a specific TCP window size. The TCP window size is a mechanism that has control of the data-flow. The window is set by the receiver (receiver advertised window size) and indicates the amount of bytes that can be received. This amount of data has to be acknowledged by the receiver first, before the sender can send the same amount of new data. This mechanism is used to prevent the receiver from being overflowed by data. The value of the window size is limited and can be 2 to 65.535 bytes. To make more use of your bandwidth you can use a bigger TCP-window. The format of the window keyword:: window:[!]; Example of window in a rule: .. image:: header-keywords/Window.png ICMP keywords ------------- ICMP (Internet Control Message Protocol) is a part of IP. IP at itself is not reliable when it comes to delivering data (datagram). ICMP gives feedback in case problems occur. It does not prevent problems from happening, but helps in understanding what went wrong and where. If reliability is necessary, protocols that use IP have to take care of reliability themselves. In different situations ICMP messages will be send. For instance when the destination is unreachable, if there is not enough buffer-capacity to forward the data, or when a datagram is send fragmented when it should not be, etcetera. More can be found in the list with message-types. There are four important contents of a ICMP message on which can be matched with corresponding ICMP-keywords. These are: the type, the code, the id and the sequence of a message. itype ^^^^^ The itype keyword is for matching on a specific ICMP type (number). ICMP has several kinds of messages and uses codes to clarify those messages. The different messages are distinct by different names, but more important by numeric values. For more information see the table with message-types and codes. The format of the itype keyword:: itype:min<>max; itype:[<|>]; Example This example looks for an ICMP type greater than 10:: itype:>10; Example of the itype keyword in a signature: .. image:: header-keywords/icmp_type.png icode ^^^^^ With the icode keyword you can match on a specific ICMP code. The code of a ICMP message clarifies the message. Together with the ICMP-type it indicates with what kind of problem you are dealing with. A code has a different purpose with every ICMP-type. The format of the icode keyword:: icode:min<>max; icode:[<|>]; Example: This example looks for an ICMP code greater than 5:: icode:>5; Example of the icode keyword in a rule: .. image:: header-keywords/icode.png icmp_id ^^^^^^^ With the icmp_id keyword you can match on specific ICMP id-values. Every ICMP-packet gets an id when it is being send. At the moment the receiver has received the packet, it will send a reply using the same id so the sender will recognize it and connects it with the correct ICMP-request. Format of the icmp_id keyword:: icmp_id:; Example: This example looks for an ICMP ID of 0:: icmp_id:0; Example of the icmp_id keyword in a rule: .. image:: header-keywords/icmp_id.png icmp_seq ^^^^^^^^ You can use the icmp_seq keyword to check for a ICMP sequence number. ICMP messages all have sequence numbers. This can be useful (together with the id) for checking which reply message belongs to which request message. Format of the icmp_seq keyword:: icmp_seq:; Example: This example looks for an ICMP Sequence of 0:: icmp_seq:0; Example of icmp_seq in a rule: .. image:: header-keywords/icmp_seq.png Message types and numbers: .. image:: header-keywords/ICMP_types.png Meaning of type-numbers en codes combined: .. image:: header-keywords/ICMP_type_code.png suricata-3.2.1/doc/userguide/rules/xbits.rst0000644000000000000000000000311313051004444015766 00000000000000Xbits ===== Set, unset, toggle and check for bits stored per host or ip_pair. Syntax:: xbits:noalert; xbits:,,track ; xbits:,,track \ [,expire ]; xbits:,,track \ [,expire ]; YAML settings ------------- Bits that are stored per host are stored in the Host table. Bits that are stored per IP pair are stored in the IPPair table. Threading --------- Due to subtle timing issues between threads the order of sets and checks can be slightly unpredictible. Example: create a SSH blacklist ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Below is an example of rules incoming to a SSH server. The first 2 rules match on a SSH software version often used in bots. They drop the traffic and create an 'xbit' 'badssh' for the source ip. It expires in an hour:: drop ssh any any -> $MYSERVER 22 (msg:"DROP libssh incoming"; \ flow:to_server,established; ssh.softwareversion:"libssh"; \ xbits:set, badssh, track ip_src, expire 3600; sid:4000000005;) drop ssh any any -> $MYSERVER 22 (msg:"DROP PUTTY incoming"; \ flow:to_server,established; ssh.softwareversion:"PUTTY"; \ xbits:set, badssh, track ip_src, expire 3600; sid:4000000007;) Then the following rule simply drops any incoming traffic to that server that is on that 'badssh' list:: drop ssh any any -> $MYSERVER 22 (msg:"DROP BLACKLISTED"; \ xbits:isset, badssh, track ip_src; sid:4000000006;) suricata-3.2.1/doc/userguide/rules/pcre.rst0000644000000000000000000001210613051004444015570 00000000000000pcre (Perl Compatible Regular Expressions) ========================================== The keyword pcre matches specific on regular expressions. More information about regular expressions can be found here http://en.wikipedia.org/wiki/Regular_expression. The complexity of pcre comes with a high price though: it has a negative influence on performance. So, to mitigate Suricata from having to check pcre often, pcre is mostly combined with 'content'. In that case, the content has to match first, before pcre will be checked. Format of pcre:: “//optsâ€; Example of pcre:: pcre:â€/[0-9]{6}/â€; In this example there will be a match if the payload contains six numbers following. Example of pcre in a signature: .. image:: pcre/pcre.png There are a few qualities of pcre which can be modified: * By default pcre is case-sensitive. * The . (dot) is a part of regex. It matches on every byte except for newline characters. * By default the payload will be inspected as one line. These qualities can be modified with the following characters:: i pcre is case insensitive s pcre does check newline characters m can make one line (of the payload) count as two lines These options are perl compatible modifiers. To use these modifiers, you should add them to pcre, behind regex. Like this:: pcre: “//iâ€; *Pcre compatible modifiers* There are a few pcre compatible modifiers which can change the qualities of pcre as well. These are: * ``A``: A pattern has to match at the beginning of a buffer. (In pcre ^ is similar to A.) * ``E``: Ignores newline characters at the end of the buffer/payload. * ``G``: Inverts the greediness. .. note:: The following characters must be escaped inside the content: ``;`` ``\`` ``"`` Suricata's modifiers ~~~~~~~~~~~~~~~~~~~~ Suricata has its own specific pcre modifiers. These are: * ``R``: Match relative to the last pattern match. It is similar to distance:0; * ``U``: Makes pcre match on the normalized uri. It matches on the uri_buffer just like uricontent and content combined with http_uri.U can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-uri buffer. Read more about :doc:`http-uri-normalization`. .. image:: pcre/pcre3.png .. image:: pcre/pcre4.png .. image:: pcre/pcre5.png .. image:: pcre/pcre6.png * ``I``: Makes pcre match on the HTTP-raw-uri. It matches on the same buffer as http_raw_uri. I can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-raw-uri buffer. Read more about :doc:`http-uri-normalization`. * ``P``: Makes pcre match on the HTTP- request-body. So, it matches on the same buffer as http_client_body. P can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-request body. * ``Q``: Makes pcre match on the HTTP- response-body. So, it matches on the same buffer as http_server_body. Q can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-response body. * ``H``: Makes pcre match on the HTTP-header. H can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-header body. * ``D``: Makes pcre match on the unnormalized header. So, it matches on the same buffer as http_raw_header. D can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-raw-header. * ``M``: Makes pcre match on the request-method. So, it matches on the same buffer as http_method. M can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-method buffer. * ``C``: Makes pcre match on the HTTP-cookie. So, it matches on the same buffer as http_cookie. C can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-cookie buffer. * ``S``: Makes pcre match on the HTTP-stat-code. So, it matches on the same buffer as http_stat_code. S can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-stat-code buffer. * ``Y``: Makes pcre match on the HTTP-stat-msg. So, it matches on the same buffer as http_stat_msg. Y can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-stat-msg buffer. * ``B``: You can encounter B in signatures but this is just for compatibility. So, Suricata does not use B but supports it so it does not cause errors. * ``O``: Overrides the configures pcre match limit. * ``V``: Makes pcre match on the HTTP-User-Agent. So, it matches on the same buffer as http_user_agent. V can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-User-Agent buffer. * ``W``: Makes pcre match on the HTTP-Host. So, it matches on the same buffer as http_host. W can be combined with /R. Note that R is relative to the previous match so both matches have to be in the HTTP-Host buffer. suricata-3.2.1/doc/userguide/rules/fast-pattern-explained.rst0000644000000000000000000002027213051004444021221 00000000000000Suricata Fast Pattern Determination Explained ============================================= If the 'fast_pattern' keyword is explicitly set in a rule, Suricata will use that as the fast pattern match. The 'fast_pattern' keyword can only be set once per rule. If 'fast_pattern' is not set, Suricata automatically determines the content to use as the fast pattern match. The following explains the logic Suricata uses to automatically determine the fast pattern match to use. Be aware that if there are positive (i.e. non-negated) content matches, then negated content matches are ignored for fast pattern determination. Otherwise, negated content matches are considered. The fast_pattern selection criteria are as follows: #. Suricata first identifies all content matches that have the highest "priority" that are used in the signature. The priority is based off of the buffer being matched on and generally 'http_*' buffers have a higher priority (lower number is higher priority). See :ref:`Appendix B ` for details on which buffers have what priority. #. Within the content matches identified in step 1 (the highest priority content matches), the longest (in terms of character/byte length) content match is used as the fast pattern match. #. If multiple content matches have the same highest priority and qualify for the longest length, the one with the highest character/byte diversity score ("Pattern Strength") is used as the fast pattern match. See :ref:`Appendix C ` for details on the algorithm used to determine Pattern Strength. #. If multiple content matches have the same highest priority, qualify for the longest length, and the same highest Pattern Strength, the buffer ("list_id") that was *registered last* is used as the fast pattern match. See :ref:`Appendix B ` for the registration order of the different buffers/lists. #. If multiple content matches have the same highest priority, qualify for the longest length, the same highest Pattern Strength, and have the same list_id (i.e. are looking in the same buffer), then the one that comes first (from left-to-right) in the rule is used as the fast pattern match. It is worth noting that for content matches that have the same priority, length, and Pattern Strength, 'http_stat_msg', 'http_stat_code', and 'http_method' take precedence over regular 'content' matches. Appendices ---------- .. _fast-pattern-explained-appendix-a: Appendix A - Buffers, list_id values, and Registration Order for Suricata 1.3.4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This should be pretty much the same for Suricata 1.1.x - 1.4.x. ======= ============================== ======================== ================== list_id Content Modifier Keyword Buffer Name Registration Order ======= ============================== ======================== ================== 1 (regular content match) DETECT_SM_LIST_PMATCH 1 (first) 2 http_uri DETECT_SM_LIST_UMATCH 2 6 http_client_body DETECT_SM_LIST_HCBDMATCH 3 7 http_server_body DETECT_SM_LIST_HSBDMATCH 4 8 http_header DETECT_SM_LIST_HHDMATCH 5 9 http_raw_header DETECT_SM_LIST_HRHDMATCH 6 10 http_method DETECT_SM_LIST_HMDMATCH 7 11 http_cookie DETECT_SM_LIST_HCDMATCH 8 12 http_raw_uri DETECT_SM_LIST_HRUDMATCH 9 13 http_stat_msg DETECT_SM_LIST_HSMDMATCH 10 14 http_stat_code DETECT_SM_LIST_HSCDMATCH 11 15 http_user_agent DETECT_SM_LIST_HUADMATCH 12 (last) ======= ============================== ======================== ================== Note: registration order doesn't matter when it comes to determining the fast pattern match for Suricata 1.3.4 but list_id value does. .. _fast-pattern-explained-appendix-b: Appendix B - Buffers, list_id values, Priorities, and Registration Order for Suricata 2.0.7 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This should be pretty much the same for Suricata 2.0.x. ========================================== ================== ============================== ============================= ======= Priority (lower number is higher priority) Registration Order Content Modifier Keyword Buffer Name list_id ========================================== ================== ============================== ============================= ======= 3 11 (regular content match) DETECT_SM_LIST_PMATCH 1 3 12 http_method DETECT_SM_LIST_HMDMATCH 12 3 13 http_stat_code DETECT_SM_LIST_HSCDMATCH 9 3 14 http_stat_msg DETECT_SM_LIST_HSMDMATCH 8 2 1 (first) http_client_body DETECT_SM_LIST_HCBDMATCH 4 2 2 http_server_body DETECT_SM_LIST_HSBDMATCH 5 2 3 http_header DETECT_SM_LIST_HHDMATCH 6 2 4 http_raw_header DETECT_SM_LIST_HRHDMATCH 7 2 5 http_uri DETECT_SM_LIST_UMATCH 2 2 6 http_raw_uri DETECT_SM_LIST_HRUDMATCH 3 2 7 http_host DETECT_SM_LIST_HHHDMATCH 10 2 8 http_raw_host DETECT_SM_LIST_HRHHDMATCH 11 2 9 http_cookie DETECT_SM_LIST_HCDMATCH 13 2 10 http_user_agent DETECT_SM_LIST_HUADMATCH 14 2 15 (last) dns_query DETECT_SM_LIST_DNSQUERY_MATCH 20 ========================================== ================== ============================== ============================= ======= Note: list_id value doesn't matter when it comes to determining the fast pattern match for Suricata 2.0.7 but registration order does. .. _fast-pattern-explained-appendix-c: Appendix C - Pattern Strength Algorithm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From detect-engine-mpm.c. Basically the Pattern Strength "score" starts at zero and looks at each character/byte in the passed in byte array from left to right. If the character/byte has not been seen before in the array, it adds 3 to the score if it is an alpha character; else it adds 4 to the score if it is a printable character, 0x00, 0x01, or 0xFF; else it adds 6 to the score. If the character/byte has been seen before it adds 1 to the score. The final score is returned. .. code-block:: c /** \brief Predict a strength value for patterns * * Patterns with high character diversity score higher. * Alpha chars score not so high * Other printable + a few common codes a little higher * Everything else highest. * Longer patterns score better than short patters. * * \param pat pattern * \param patlen length of the patternn * * \retval s pattern score */ uint32_t PatternStrength(uint8_t *pat, uint16_t patlen) { uint8_t a[256]; memset(&a, 0 ,sizeof(a)); uint32_t s = 0; uint16_t u = 0; for (u = 0; u < patlen; u++) { if (a[pat[u]] == 0) { if (isalpha(pat[u])) s += 3; else if (isprint(pat[u]) || pat[u] == 0x00 || pat[u] == 0x01 || pat[u] == 0xFF) s += 4; else s += 6; a[pat[u]] = 1; } else { s++; } } return s; } suricata-3.2.1/doc/userguide/rules/normalized-buffers/0000755000000000000000000000000013051004444017763 500000000000000suricata-3.2.1/doc/userguide/rules/normalized-buffers/normalization1.png0000644000000000000000000005716613051004444023377 00000000000000‰PNG  IHDRzVè¬ÁŠsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ)ºº9 IDATxÚìw|U×Çgf[6›„ $!”@€„&`A:(MAÅ.Š¾ ‚>*ê£Pñ±‹]QPìø("ÍAéE:„z ¤g“-3çýc6Ë&ÙPƒ"œï'ع3sï;¿=çÜ2äõz!‚pöQ¤ A¹AäFAäF‘ADnADnA¹A¹AäF‘A‘ADnADnA¹AäFAäF‘A‘ADnA¹A¹AäFAäF‘ADnADnA¹A8%LR•`f©A8 ˆHäæÔ´FQE£ONùÙÑ4íøŠ#ÏÕ)+´ §‡È "7‚ ˆÜ‚ ˆÜœE‚öXÛN»3«Òþ¯çAïر’pàÇ  šædÏ|nUùèUóz,ÓúYjUÉÁóuœV}vkUäæd[“·xïOÝQÏN!õZ=þ‰HÏþˆ‚qã—Å›ŸJº«öEwT KÑÎWšQ×ÿþóÃÕìþù²¤»ˆˆèAÿèŸF© ñDôYnðÊ"Lyä:ŶüëÎÒ³[«ÞóÇã=þ_•ôº®s¶w ”&_­:ÀÌÌÞïÝc¬_ó03³–=€òqÐ][£ç;«OR<<~±’ÿéèú;×µmÞï9ffÞÛ4+W¯\ÀjÓ¯º:hºÃø²q<´Í}ZÙÒõ³Uâ¢ßìHÞTyóŠ:Àèeîø–Ùÿ°8ûØ–¬_Þ±Ç[õ´Uw-ùd4·ÙÊ¢­×4ÔKöi•j^/^6Ùt½ï_f¨_篎On»uZï.cfþú‘n@òVçißsÝSåªÄùeÝ0³ª²ªbÓ&;V¹újµS'%2R5›ƒÿEEñI¯\;tAX«ÎmCÛÆ13 vñÆ®•3_žTâ©9 *ûÏé9èÞ®%àžñ꿯êÓ»wŸ«þýê×n¿[¸uâ˜[z÷ê5ð†‘³ÖdûlóüMýû÷_»?ûÍû‡uïÙû® _ØüÍó}{v»êÆmqùÜËf¼v]ÿ^½¯øì§ø¶nù°Ó û5}÷Ãúvë=`üGKÌ~yL÷î=oûÊQ€Ì@éç~e¯žý®¾ùÃŒ=F~}7úò»¾pþí¦Ý»ö0é‹ß}•Å`Ò¿Y¾ºý-wYÿãíUQõ¬EþöhײB¦aÀ9eâ}}{÷èsÕõo|÷'€âm‹zõzûnìÖã‰UN(Åì}ý{ôºrø¸É…Zyý¸÷¾úðˆÞ½z ¾eÌÂN_µåmìß¿ÿšÌã®ï=ð™µØ1µæ‹ üúßΞ£Rÿú&ïHyÿóÏ ý±xM>XóÈ\šóò⽿>Ó›ªuÜJ'¿tèã_&Y™™‡<69»¾ÉØ,ÎÔqk\QXU±{7~úI8ÐD¤¦§+o¾I?ü@Ë–QqqµÖ«w2v2ÈõÕïk/ïÿïd+³`s½vWÝ{ëÀpÓ1É2Ûª‰îœ”=ŽÌÕKÜ–ËÛ7¶~x{êЗ~iÙùÊÞ—¤üòòu ®{“ˆ¸dCÃèfS7¸û º¦¹5몶uŸû=ЋfÏž}G÷[’¯yàöÞ3ÇkÒõ¶a_yä¡:{¦¥Ö½©D¤sOë‹oy)ªMï~]xû¥-n{—ˆÈ³kÉwÓû·”4hÌmëN~É NßÜÛìÑݾõ³]vÍd"íî]oòo¹—_9 M½²=’&ý¸€ž·bñW/ô¼â‘Ëo{÷€FÏ »ì†/÷Pº~Õ®˜»‡D1hÆ»?&·ëe£clÓØZ! KÊÞÒqߧ«/é3¤k‹°§µºúÅ_ñ)7tƒîü¿ÞõÌ`¥·OZXÒ {ûä_^sÙƒ_\»ÚD&¾´äh¯«®NtoìÚ8úËnýŒìyýj¥YÇÆápí¬ñ"®ÉOüvÇM—½³&k…fa³˜kÖÏ·…F(--j•¨Õ˜'ﾬ>{´ê~Ýȹz[.ºJaÁ‘|U4þ·f›8SÇõ•,ЭV‚þéÕlg@OKóœ„3¥»w6nšv(À$¯€áL…õ%ß~lÉ©8SŸÿ«AÌ틘 ¨¸þ—"fÖ™õ²}¬Îdæ·E!áæ>—ûÕyÌœ» Àˆ)¿Y»¯[3k‹ž†e½oÁûý‘Ã%›føxéa㔼fPwM©á˜˜ÞßëefÖ÷·âG~d”1cl7´è­3sÁÖO¦~‘ã5²ÃïµCøm0óÁiËŒr+}öó¡v=ÌÌÌ9ßöEÛ§˜Y×µ¾ÍéÚ·÷T,`uiô¬·®…¹ÅÍw­#ß šmav®~hàLáÁ•¾jÜúß戮1ÿ>2I£µòúùô¾d4x¸¬¼~z¾0‡^ÓEÎ]af®/æÊmgE<{Dddd-ƒÈÈÐPkÍ9S:3ÿþáÝ€é÷ì µz¬Õå϶€‚:SÚ¡OÛÜcmÔûRKDÝ=õì9SÿÌI Ìl2ÁåR† £Ÿ~ªd¿0@ÑÑA ¬ V+·lÉééˆE­Zp8XQÈéDv6ÒÒNêr¤ë€ª*`€mWœ¹QvùÎç~ØôH¿Tà®gßêQËå?ΣÆYN¡T%_LÞýȦKÓ­÷_2¤GÃ#C¯¾îú›†î|qÅS¾Ëm2²+•—±i‡ká|}OjÚ4H˜€0³%.¦©0#Ä °Û[×XõógG–hlæâpúlKYk+õºÔQ…D)éIF1&Ì —GLá)ýÛo¾÷ªÞ;Žæ¹¼\° žÄR_–Õ+zEúòS?¥;´ÿî+Dípï»Í:ú!äݾz“uê­   XæY»BZ6¬«LLˆé6:WÌ߃•ëªþíé!Æ­Žm gžúÛŸg;Z¼óú+e^©{&c÷g{\“šú¦5ïþ¡Æ‹ì\»Ü…–mRC™P)Òªý'LÕÔê5º©HÝ¿rÆȧ>:ƒÖO@î]W÷ Uà’£{~[±ùžéë/©S¡VOî9ÒE=æáIëg±kêŸ'7¬ª”•¥¼òŠòÚkÇôà0#$„j×æ:u”¤wë¦ß~;*M€b&@/wˆH×Oh¬ÂS;_û0¦†‡|.Òá$Šõ÷0j@ë^½Ô=]›x×Ô™Þæ62ùš~_qñkÏø¿çïé{×5ÎqŸ®xþ†&9%¨zL¾¬– ¨Ì[þ(ŠQ ©»Ü'`Zž1g“jô@Ó¥W\é˺Ñà|©M UjÚ%KŸ¼ä‘^#'èòº1¡·µ~Äß íQ!þ–¤Z€Rm~q“þvÇV ={¨Ñ=W„T, ªIÃÈ/õÚ,!d'S¨ 8ZRµºT³/w>o•àÉ)ö®Ÿ5ûflQ,ýúuPË= ›Ù‚cRP“Eö*Xñ^ÈÀgÔàͧA§¾}:øÂVeã™? S¢Í:€=^øjTÇ¡Ì b­2@'l׊#!Îý`›‘Úµí0êÅGˆÜ”Ë ³2t¨2cF… ·j…•+ѱ£öÕWˆ@Ì "fhZЈ“þ-a°­w›–æÏ%–ï,Ú|H(È?Ô‹ÁÁ•ËòР]‹H€¿|ôãž#çV* ‡ÖK´¨çÈÛ~DŒ'WËÛrh^Ø}‚\ê°^šŒå]ÆÎ}ï6T,"\§|3N©Èuxkòº± {ý…ÏAÔ^~µYHÅvJ8X^«|-œÚ6ÅŽ…¿äÜvC ”íùö†§%ŸŒZç¡bVU僔ÈHeÆŒc#šRSp÷îú¤IZi©öÇOFUU?PÞþHUUUU”••9r$77÷èÑ£yyy%%%UÆ9žþì–»7j;pá.ŸQ]²gÙ˜!ƒ÷ êÕö' ­Ôó; çô΂5m{Ü 0Jk:c¯o_L|‚ÑÄîyù†‚›Ÿkl.|ë?ï…_óbcëIùž :t‰žùÀ÷Tç-|!¹õÀlïIÕ|m»RTè4*"óû秒;ßäòOñEg¼2­Æ6¶aÍâ©æËŸllJ·=¹7]Ú¶R ÁÓ¸úþ!Øöë «|½}¯ÝòRÇ\ RT Ïåܪ† ‘¯?úþßø:‘ðáèË.ºóÛÓs N©ÈIyŸM-htošíDšÖñ×j`Ó§GÅ–©¯ùæƒ~ÜPëæ+š|úÔÆ€¦ßÞ}ê"uk]n[^€Ö 3›L´k—2x°²vmy®Ml6#> j‹!&†¼^"ªjÈ0³1ª´´Ôår1snnnQQ‘Ûíö漢¾cÇŽ•l!Žºlå?¹«gC{y»³5¿ìÊo¶¬ÜÔÌ>_ ׆T¾Oiý&üùÃãþÓ—î Æ–¶áÊÂÇ¿íÈÙ;?sʉ42¡Q$ågPîxïÛ6|:á¶îWס†-Ó÷¬ÛP»ë­;g\f°@Ó|mÝãr•¹Ý¾ë錱­á-3ÿx©}¿Ê‹ñ)QeÛx‡?1­®‰¡{²ro]€[óy—ìq¡Ìà[&=<1íZª›šQXœ*:€öãèܹªÖäääìڵ˯ƪæf³Ùjµ&'';­Ü ’W,Âß˹%7Ê£*“&ù¾4h€ìlm÷n²Ù‚š¯çÏ?ÿ4"¾ˆÈn·;κuëÆÇÇû|mM“{,"7UìšçžS&MòõÃÅÅqb¢¶cU1IŒ¾§;wæææþ3Ûív—ËݤI#,‘ œkœ±VUúüsõ†€ª¢qc$%ióçWr #5ÅÅņ֘ÍfEQBBBš4i¢ëgº £Äná´ŸH¨xÙ2õ2ßZ!œ’ÂõêéA;¡¼^ïºuëü}O!!!.—«E‹‹¥¦ªLäFÎ[¹af54Ƹû¸8¤§kóæU +Š’““³sçN£<†(DGGׯ_¿†3#r#gGnLoáv«¡¡¾ &'sýúÚ¼y¤i•|(c.¾}ûL&3[,fNNN—þ&Aø§ðwÊ ›LÊ!¾ QQ8xPÛ±#¨]c†(‡Ãáv»ÓÓÓ_$"‚ÈMõZ(ãÇ+3gà&MÀ¬ee‘®WÒUU333N("2™LV«5%%Eúžá\s¦N˜æï‰Ý0íÛ§$% ³DZF:v¬ÚµgϞdzŸL&SXXXÆ Oè"žI•×’Ö#§úìèº~ŽÆnÔ |C‡[¶Ô_\Y‰öïßäÈÿìíZµj%$$œ=­AùÙ3ïP„ >˜ƒÜ°ª*ãÆksýúˆ‹ãÁƒ«†lòòò:äךØØظ¸¸ʧ ç®ýÅδy³š–cM‰°0mçΪZãt:7lØ`ôI›ÍæZµj%%%‰Ñ!ÿhþj놘•ë®óÅ” õÿý¯R··ánݺÕd20›Í‡#!!A´FDnNÍ¢—^¢M›pûöܵ+_~yàèa#¸½aÃC\ìv{HHHrr²øP‚ ÎÔ)‰ #?_­]›8TR¢=Š°° +$íÝ»÷ðáÃÌlµZ´hÑ5·˜£ #]/›Lxç¾¼K—""¢’•““sèÐ!ÇÒu½eË–¢5‚ ÖÍ©sô¨ €›6…Ý®­\8¨Ï˜¬´zõjcEaUU›4ib·ÛEká¼á¯ŠÝ0+×^kDˆiëÖJZ@Q”7«aÙíöÈÈH‡Ã!sAäæ¥ €.ÀõêéÝ»s»v•Ö—(((p:L&“Û펋‹­‘›SGU©K0›átòãWh£(Jff¦D_jjªh œœýP13íÙ£,ZÄÛíHIá””Js£233éÝf³9**J¦, ‚ÈÍi©¢`Ñ"”¯@¬-YBU‚ÓyyyTUU¥~ýú‘›Ó»‚¢Þ|3ŒU&¢£TTUmР¼;ADnN÷o¾ #Z¼{·þÐCoV`梢"—Ëe˜6þ—ÏÉ]‘›Óp¥˜fÌð{R><)"Úºu«1¨¯´´4""BÆõ ‚ÈÍ骢ÐæÍ> ‰Œä„à†™=OII‰ñ5,,Ìb±ˆ'%"7§}b…|nÖ Ž ·!¢¢¢"C_,K£F¤CJDnÎÊÉ€¬,îß?0H¬ªjVV›Íf„ŠÅ´‘›38ïøñ0F÷•–ê£G·)..öx<<Ott´DmAäæÌL›5k`¼FªmÛJ»8`LÂ$¢ØØX1mááì óc†±þyb"Ø'ÅÌFØf³ÅÄÄÈ )AëæÌ´†;w@x8'%&Ö4ÍívÐu=44T<)A¹9µ!BAÏAÚ¶ -ZöImß¾ˆL&“Çãq8âI ‚ÈÍ ª4b‡¢pll 'åt:‰HÓ´hc1 A.N-vs2³( P…ûõƒÍ†ÄÄÀÔ.—«V­ZL&SRRÒåIÉTA8µ9S̬(Š,îyªB@Ó4‘Aœ)A‘ADnA.(¹9j檛NñT8Ó3‚p>Ë Ñ¡…DôvÆ~:ADoe8µh,ƒ¡-œ¿Ð bÖZÕ¢Vw-”x® œ%Lïå™ùŒæƒ+&V³‚¸®¥¥¥f‹ÕÒ|Òz¸w\{åÝð–†PVd;¡Ø¤M¹kÝ0ëÝuå¤Y‡~ÿhü•=»ö|ç¼,åÀÓž|e^½û?þÖ.ßøÓë× yîÏŒérͽeлëÊç¿ß?ûå1½ºu:jb»ú×õíÖ»ÿs·åú=eŸÿwHŸÞ={öûÜÇ\ÉíÉß2dÈ[‹w.žÖûWôëÓó±¶Us8Š·-êÕ{èaì»±['V;Ÿ½ÿš§?ÙZžs甉÷õíÝ£ÏU׿ñÝŸÆŽþü¯Îÿ÷¹^¸vÄ5½»vëûŸ÷æù‹)Â_ 7 (+—f¼úÐð‡™ï{äß­lkû4¨½.Dž÷‡%öó~âeW ìÕêûGúÅöxœ‰ÙõÛ7Ó_}ìÃu—µo©@Y¹4ãŇFL9Òüá‡îÌžñŸÚøÈŒkÇ>Ö+vcߦݷ˜ùóQm/¾á…:íºõëÕvÙ[#”‹Æ;ÍWîìÙ³÷å–EÖkz¥Aßþ½Ò­sæýRê@ðÃa­Ýä†îq€cÐÿ×»žé÷Œ¹K7ç ÊÞÒqߧ«/é3¤k‹°§µºúÅ Jáªßf¼Ý¿÷¨Knzà¾aé¯ÝÝçÆïÈhA8Y¼§‚ÇãÑ4+¢ëúmBwÍ̺Îú¾¦,:X²~&€ifÖ™uÞøúC3óã’€„­¥¬ëº®ëW´±5ï>Î8ÛÂn”%‡˜™u÷®FÀckX×õ¥ó?û~ÁvÖuùàoX¸_çìŦ,:À0õ·CDzU²½9ÐýéYFƒÎì\ýÐ|³®{»§ Çƒ¿3ëYo] s‹3ëÌ|ä»@³-ÌyßuÂæ”ø®ðþ-ah÷.Ÿ£ŒÇ+65»!š+¾Y/0ö¥nïîë[ËÔÚ`€€æCRñèôÕÅýº;ÀoH²@Ì Í]»Yc.¹54hV?Ì€9"px‰L{w{ù_wÿOfaI™×™Àíò'ô4q@»-Yúxf&PðÃaj®ÍÊØÒ²a]`bBL·Ñ¡¸bþ^ÜÀÔ£“Ý—ÐŽ¥‡½{L.œP±º Õ\1HK.w)`·˜À€ »Ðë;Èpm&Õðòp“B *ΘK%'þhíöæ¤ñ-êÇ87ÿÔíÖG«ÏýðèåÿY™v°à¹0f1—jp’‡@~©×f !€ ™Bm@®±”»jVuV<)Aø+å¦ôèȺ@nn!S(€žµ Ñà4º~-þ9ËóÌŽù·7€Ì£‹Žcl¯~zÀ¤?>Üé­ë—ƒS8ZÔsäm?¢†²hy[Ž©u­Ò`áï #øï;k‰u‰&µÄØñÔÄÜ”ûÓN«§Ù >`èØöq£ÿí³§”J† 9wüÜø¢'&Îß}{òI¢y.€Hõ—çêû‡`Û¯/¬ò^»å!¤Ž¹®–´Aø»å†W™îò”/Ê:¯Î¨ÕjÇ/O¯züòðÄÔÔ¤¨þ“7>5}V¬Â¼žR”yügp•±Ëí[ñO×<@™¿oÙx4!íîÖ~ÒåÔ¦mz­Øžý¦üÞ8ýÒ›|¾K i èØâøä‰ÙŒ)£»7òÑ ÛMOQ5‡º¶&צÚ6'ûå“Ö³—GÍÆ,xýÖ—:Z’RÓ"íÏíOɘ=t\.Þ¼ž2”y¤\NÖ4©ñ(¸ÜÞ ²Â‹/’R¾½ê˜¼c[øx–SÕãªKz‚ë;®Êvfö¿ æ„¥@ÕCe A8 ±ÿ#äé"ª°½šÇšj;¥Ò ’1:ùR‚p–œ)A‘ADnA¹9SdÂb$B,¦S}rt]'¢jUEQ”%K@³™ëÔá„š¦•••;CBBDqáýé=¥Žð£ªJJ ååq£FhÖLŸ2@aaáîÝ»X,–fÍšI¥ ‚X75áK¨_Û·ÃfC­Z~ËãñPUUj\.XÎÂK{;w@ \\ü®„vAä¦æ|3MãÖ­@×QTd¨‹¼O„³bÝ@Q|^Õ¡CÆ¿%Ö ˆÜÔ(6ŒYGL&_„HÓ4©qA¹©964¬ÊÍ…Ë(7F/˜Ø8‚ rS3pãÆ(Ÿã¨<ÿ<«ªáLcÇ#ƒPAä¦æ§Nlµ*ì7gŒòòò¤ÒAä¦æäfÔ(ärñîÝÆßR¥°°P¬A¹©ÈëÕÇ÷}‰ˆ uëX­VcƒÓé”J‘›šÒ"Mƒª2@š†½{™9**ÊxãR Ï™áw¦p‡ ¸˜¾ÿžUµvíÚ¾ë)ŠËå’z‘›3p¸~}/ôýè#¿Ñ@UU·Û-õ."75gÝŒ£;Üë¥åËQ-öz½2ØODn. IDATjTnzõò} Q&Ob,—STT$S‚ rS“è×]€JK±f ˆÌf³1ô&??_äFDnj òzùæ›}Ÿ7n$æÐÐPc¼_ii©Ô» ˆÜÔ Þ:uòV®½66.N×uf6™L‡–ª‘›ƒ#"ØX*”ß~«”•™ÍfÃ*,,”‰š‚ rSsö¦iË—û>;ú‚qqqt]/++“ð ˆÜÔ yÃd·ÄQ\LãÇÛëÖ5Œ—Ëu¼×9‚ rsŠæ à®]}ßV¬°oØ€ò·Ç©Ó4m×®c_ÝîôoÜzèÐYŠ3 vïN;wŠ#œÜà¤$mÍ(ŠaàØvîLíÚ5kûvR”W# ­ôïÏ&“(Ž \prCºŽ´4þá*WÛ¾} š7/Þ¿ÿlõRmß®^}5d³ \hrc ÷é£Ïœ‰ò éº=5Õ3gŽ1N§Æ=8š9“f΄ªë J#„¿È¼øCż*UUæÍ£þý¡iÇdè“OøÆIÓÎÔ)û¾l[¸°4<<-=]×u™®%Üø„`ëVµE ”ÇYpÛ¶ÚªU Ag.7ÞØØÑ&SãÆÅÆ„Syžøô~¡Ï-¹¢ðÁƒÜ Ùã9V¶ÐP~öY}ÌòzOÓÌ &7rú÷ß5~|“&MÂÂÂ*Õ¦¢(2kT‚âõzOOnα'J×)6Öëv^z©ßñAI‰2v¬zÅز¥fGÇüðƒcݺ-™™^¯W A8IÓæô͉s°<MÃüùÛ'LÐ…Ê+úñG5-Mmßž5­¦¤fwÝe;thûöí¾„³î½œ›Ù ‰;výôée‰‰~i`€V®T­VuÐ Þ³‡Uõ û­s³Q£ m¶]»v‰âÂ…(7j…†ÖïÝ{uFÆ[nñ†…fŽÑ©„~05l¨¶l‰ŸÆ¬ª§-=ØöîM3&/????_„ œ=αPqŠ‹‹·lÙBŠÒtìØðåËIÓ8°ßÊøìpèÏ<ãFù¶T5Rª ²þË/K’’.j×ΘBqœPqUWÎÅê½J¿þÊEE†áÃ&Óñª` åõ×ÛŽݼysuõhÜÁ?¿žÐ:%^ñßýÎW\ð™VK¦R‚‘qï\t×°wV½Öó”N8~ÍVß5üÃã$øüëÖ:à³Å(Ÿ=ÇæÎrΧ7+ Ý*åjÉ´‘Šµ¹,p[Ù=1Jø]Sqx‘œZó¶­¬n×Oeà#Ÿ(Š¢(&“ÉdREQÌÑÒßF˶ÏUå÷lxê¿úX%®ã­Õå{ËœçÖR³]Q”ä‹zoÍ;gÖ{òþðx§|ËŸŽ¯4¼æ5™™—|2ˆß_õHÖýŸò—O°¢ `Ÿ®WL¼.Ž¥%UÏ¡ëAÙRåšþ/zsVwx5' 84ø¥Ë7êÌ9}ìxfÖ¦ªg(OSÐê"73óçÕCê$-øyN˜çÁH¯ë|’Uç¯é‰}›¶6¥ÒÞ%ŸŒâ6;·•Ž‰G̨i›^OCè­=Õ]Zöt¾ 8çÌÇ»ø(ËW¸ŸŽA‘næÿöˆŒo{õõí›Çwº#xiÝK“¡ïüiÔð°$sû¦rÍ¡ëºÇã9½ùŸ1´„ˆÒÓÓ#""Lšæu8vLœ¸fÎœŸ|R Uåèh¿r¼¨ð‰ö†nÜØäá‡9RTT$‘¶·[—ñ‰w}øó”qÑå?:{ríÚ•Sï 8?–ïúENEZ5¶.ÍzkObÛvvpöÒ/kLD}ÓÓ5c†Ѿ_^K¯k'¢˜¦]¾ßp˜ˆæ¥ãÈÚ.7û×ËB‰,]G}¤SéohODµÓ¯ÝXêëßÓ‹÷?2ä«Jf{Üè·~Ó‰ˆèÀÔŽÔìÉ«ß­B¤Öºï½ß¹l÷ ê)-¯úO®F†u·ë—wÛ%Ö""G\ÚówˆÞ»1ÔÖîüÉw…«Djô£_­)/yw¯™ëD§¶Í€ yf.h±Zg ¥Oü)ÌLPM›f=o'¢;ÞXè?O`žï}Û—çýSÚS‹ ë¿»Ÿˆfn¡iwGÙý8ÿµ;DÞè‹5Ù[絋·Y†>ñ•q*"mñ;cÃ,D—våâ]…DÄìé–LW?³ò…›/1Ù¢[~²¡ˆÈºæ¬ÚÚù®›N«ÍjN/Øí<¥]%~Sžþ®C-|úÎ*£íüñå›mŸxØ ý¢[ÞÛ¿êiu,Õ¹:›^˜¸+î²OîNÿpÖÃ;ß{z“„ŠOíîiZãÆ4h`<»”4k¶nÎœµóæmæ×ĉhÚÔç[ÅÄpݺ°ZOÁh6 ½¨(¥¬LÓ´íÛ·k•ºÛÅ›V¯ÆßtE€¬ˆâZµKrP@R  ÒNÚ/¦>ü½E»Á&.¸¬É%/Ÿ¸jíºU gx¾¾9úºï¬ûæ„ž÷Ýúæ¼ Ö9¾ó ´Ø§3ŠÁDÜ«;Ýžñ΢­[2ÞYøöð¸¸îµï™¾g÷Ö+Õ}¯z°½[lýoï_¼zý²ùoþ~OçÎOÍ`ÁÖ—î™nZ´uÏò·®zíî®ÍÓî¾óÃ%{7ÿ¬Ïšxpmy±aÏÿëñü¬5k×Ì{uÀ½W6}·€5"̵pÄ<½ÏšY.xõ½ëÚþߧ{*Ú´êWD\ß*ž‚çasy°}¸jËœ±½J¼*ö|0q‘ýûÅk~ñÄ÷v½ÿ‡Bpåì`îH]†3õi¾ƒkåçÿДÝ̬»ýj_ê>æëÏôkÔ™Òuý¡Ív½÷ØÏÎFÀK´sÁ™2ý“zш˜ÍæÔÔÔÜÜ\ãå `f³Ùôùç…ÌÔ·Ûc‹‹OéÌž¨(óÑ£ë¿þÚ\P"f.--ÍÊÊJJJò§QU3¯Wó9F¥K¯ê7 ü2qKKt´vRÜfçf!U¬›“‰äP²bÕž¸—‡SF lþﮑ¯$vxè‘Ǽûª( €?îB¯Úù{(:Ä7øß®ÍåÇ×nbœÅl&Fç´[x= ž·4Þ½×jÔ&<‡€µ‡1˜!m’`äÑn.Oñ-¨fƒ·ÔÀT«ÁÖ¯‡tmû­?BšRâÖ2$¦ø{æ„aé3împç‚" —vºö‘W®L 1S£+Æ}gÁué®·þ»ýþñ]‚÷®¸J€\­¢)ìÌG^‰+pKYœEeAÛr]ìfÀäWÉóâÝßõÞÙ÷íè§F‹zlöÚ‹§íìÓ£°iæÔ©oLõ@ä'›—vÙþ°™ÈR÷òÞ?ûttÏsdÁƒs}&‘òä“ÊÓOûíI EHbbм¹þÑGn¬†ãŸPXXxäÈ—ËåVÕÖÍšUúPë±XæOžL.WåŸòÐкuëŠÅb‰ŠŠª_¿þ±žê sŒeN·æ/X3®lûwUWff"T¹Šïê¾³13ùƒ/²ÄÌTX­pÒò83ˆt†R~¬ßÄ;NѦŒ¹mù3¼êîŠÙ¤À"ruy®zÚŠeg6~/NgfH96à àꬳÒ©¾zÏTUïû[ÆKŽm ¨„*9¯\ºŠ·ŽËk,Ø-¨6qsM\?°Ùh$“öjXÕ Ö8íI çzì†Ú³GmØÐhI¾¹%M›"3“ï¿_Ÿ0ÁXèÏ¿À¨HÖ4-44444”™½ŠR©ö p‡„Xóóg}ó¹¬ Õ¯¡c·ÛM&Sýúõý7,h-ÛŽÊǬQµ1 ÿ®êÎSžƒàW-¦ãO+n%2¥U“§hD•³xÆ꯶Æ*Ÿ*hl§rž}ZS%Þ>>þܪ8*%h%TWºŠ·ŽªÛrÜÄt‚ªsà.Ÿ;ÑÎagŠ™UU™4IINö›‚œ–FªÊW^©ïÛ§O˜@UL3#¥ªªÅÅÅ;vìX·nݦùó+é—f·«š¶àÝwM¥¥A}a³ÙÌÌv»]Q””””šýq8Ïp•ä"¿ì]„¢|–xåVþ˜Î]­ñz•[oU>ûÌ·!, v;ÌfmÛ6nØ4­ê’éD¤iZQQÑ®]»¼^¯õÉÍ­pb›Í½ûÉ'9!ÁRqxŽ¡;†e2™JKKÓÓÓEkŽ—FLÓGÔ´¹þ×zê것Œ“%œ‡rÃ&“N¥¥¾p­ZÐ4¾ÿ~~ðA0])™÷ìÙsäÈCwÔrÉTRhÚèf3† I¹õV%3³°š²ñä´iÓF„æ‘?¢sÍ\?ÕTãÆ ˆÜq~¾Z¿¾¡5ТåähüÁÉÉAWGWUu÷îÝ999þW¸vŠÝn/--UVYGZšÒ³§åå—¹úʼnu]7›ÍÉÉÉFHGÎO¹aU¥õëMéé\îø ^=NIÑ6l ¯·’÷dtBìܹÓ•ûÆ¿›LDd2™,Kbbbø‘#Fàž4³þ FÄÇív̓ÃሌŒŒˆˆÀy±À• ˆÜTcÙlØ ¦§6.GD‘6~èá€AzuëÖ5 Ÿ¤ªÈÌDXmÙ¢8@ñ@­bˆ™­V«ªªM›6­„óYnhçNµiSŸÖÄÆÂéÔçÌA‡Aíš}ûöPPZ† œwrÃÌ&“ã³kRRP\¬gfrBUÑ—˵yóf¿eµZu]OHH¯nT5y½Úºu¾¾ó[&Ю1†ç¤¤¤XOe@AþQrà "¥E :zGF";[ÿõWTÔCJJJ6lØ`¸†á#r#5Ëß3º„UÕT»6òó àfÍ¥¿÷žñ >ó.—kûöí&“ @hh¨®ëééé&S H¤¦in·ÛýÈÐaAøk Óß“Ù/¿Dq16àååUËçr¹6nÜhøP¡¡¡Z´hQS“˜˜¹iÓ¦jõ+Ý‚Póþ_¿šçç›b|k§r“&úçŸWc¼¥WUUÇbææÍ›=Ö5¢5Æ@¹ý‚p^;SÌêС¾˜Íš¡eK´n]uÞÖ­[ Ó#$$D×õ´´´šÒ”/‹#÷^Îg놅–-S/¹„r8ØáЬäFÑ–-[Œq1f³Ùˆ “¼ån ‚X7'k× ¬ÌШ*ׯ¯ÿ}Õõk>lLò6¦D¥¦¦ŠÖ‚ÈÍ)ª Íšc5› ¡¡Ü¾}%­q»ÝÆ«xu]·ÙlIII6›M´FÄ™:E¹QU“!f3ׯ¯mÝJ‹<s—Ö­[gäÇl6ÛíöFÉzz‚ ÖÍ©:R¬\{­ïsB÷ï_IDEÙ»w¯Ûí6ºTUMII¬§'bÝœ†Þ(!!äõ2€ðp­  Òd…âââ­[·0:¿SSS­V«h œOüÃüXU•Q£|ï„jÓ†ï¿{¾UUݹs§²1›Íqqq!!!2‡@ĺ9e»ÅÅjd$ £¢"­¤W–9pàÀÁƒËw¦¦¦JÈFÎ?Îz솉°p!ÈjÕ¾ø‚+®,ÃÌÙÙÙˆÈãñHÈFĺ9}OJˆ ÂB˜Lܨ‘¶eKàX"ÊÌÌÌÏÏ+wEĺ9-=ûùg*,ÀÉÉ|É%•–˜(++3Vº2^’[»vm ÙÂùÊY3+/¿ìÓ;ômÛ;¤E9xð ÿ]tÉÉÉòºA¹9M­É„@ááúÀ•ö»\®Ã‡«ªjµZE±Ûí!q¦NKmL&|öiÜ°!Nq"fÎÊÊ2¦}{<žºuëŠÖÂùÍY ³ªš¬Vv»ÂBÍ륀¸ 3¯^½Úp©l6[‹-ä}r‚ ÖÍé*ÙæÍp» ¨7Ü€€¸ eeeŸ­VkýúõEkAäæ زÅXùIIÚ´iž”¦iG5:¤\.Wxx¸Ü A¹9}OŠž}–b˜4þ½EEE(×BãÆ¥ó[DnÎìÔ+W@Ó¦hÖ,0j£(ʾ}ûˆˆˆTU ¹‘›Ó‡>þØ÷aûvýöÛM—Ëe¼UÎf³Iç· ˆÜœñy¿ý–ØlæþýwíÝ»WUU"*++«_¿¾h ˆÜœÌع“Œ8q·n÷°Óé4FÛívkÅ©á‚ ˆÜœ¢ÖáÏ?a¼FêŽ;*­¤UVVf¼©®nݺÒÿ-"7g4Í?ã3¼‰ÈXF €Ëå²Ùlrá¡æçL±ª*?ìW´h(7L&3Ë’}‚ ÖÍÛ7S§àðp˜ÍåßntHÐ4->>^´FDnÎXnŽ@eez—.ÛÝÆœÀb±Ô©SGäFDnÎLk23}Ÿ\.~üq”k Á¥ \DnÎŒ]»|Η^êïÄ`<ÞIDAT–R%//€Íf³Z­bÚ‚ÈÍSZj-ìp@×ýã‰].—¦i¼^ohh¨˜6‚ rsfÚ,AbÙÙÙ†åõzëÔ©#U/"7g¦6&­ZTnÊÊÊŒf³Ùd2IÕ ‚ÈÍ™B àØXØítÌèaÿ²‡C ÂÈ),ÊÌŠ¢œ æB„_~¡ÒR¶Ûáp }{ÿžÂÂB#ີÎãiM÷fÊ¥wÏ®¼ãொ¢¼ýëA¹‚páÈM°^™ŠÛ˜9H*ß–Âw_þ¦Èh¯T¶`¬6ÅjV+oïÎÌ£ºW³„3ϤIþ¹rC”½„ˆ¾_¾æÎKêQ£ÞåÍzrh¨‰lµ[ÿ°×MD bwöƒƒ.²ÙûŒ}ßEÄ\Ð."b!´ÎJÿ 1»Þº`˜‰È‘ôÌÌ ~GI5óܧ®±›Èšð¯ÙD„C‹‰hÚâl":0µ#5}"wÛŒµÍDjç;^ðy¾â»‰Bj·úz[ɵíC»Œž'¾— üƒ­˜M†ßõÒ­.Þ½uUÄúëÅwX•ö¯­Yûß¼=z@£.û5À³÷’ðºß›ûü±fíª¥s½ßm5x"!lî//¶Wm™3ö ÷öfµŸÛÒ`þ+ûÜëƒÓ®ö7 XÿøÑŸão_¼bõût×=qA–'0öˆlýú‰Ûg,Û±gûþxÜ¥/lðëä¡Ÿ^ðÖÜËæ½öãà„™ë&K¨ÜoAø9ÃP1¾GüçÁËS“À zµl‘™WïÉk.a`ÀÀ[ñ­»¢^Tô”¥+Z´ 7ÃëõNº±ÓE_üä¡Çë$×”Ä&M»òóiÛŠæÏyáÒ†fP»^Ùô“+ èâ¤W¾4¢?3·}û„/¶íÊîšU‡=÷ñ£ÍD‰wˆ¾åãù×ì‹ 3þó¶^i ¼¿ö§yæ‹ ¦ ü“åÆGƒ¨h€¶*JLXL&3ÍË0ÙÔÍã/_—S꓈äË+EQöìÝDÔµ0€¾c&ö5‚0š;¶agP3O¥aÐÌ°tlVþN`‹Ão1°wÉôÐÐÈ «éʽ„¶3u,†cØ:øÏ¿¯pãÌ:é7_òØ»öì?|øð⇺iU&N°®W=²üÜÊ ¯^å@¯ °šü›Ef_Ây"7å‘œ þÖöMË]ˆóW%Õ«]»ö²¹P)`?ÔM ñoß³â×o~üí ¼ŸØT+7™"ÌÎ’{-ç“ÜTCLT<·s“ˆr–LúbåV–º˜a²ªpnÍõˆëؽ%pÏ„@ÄÞ£×éþâ'™§}EöAwÔ[>êúý´éÃ:ltɽ„ºÜ°€Ë£†Š³° ¿°¤|€W㤮7¿vgçþMCmöˆ¡[¬ÉhQ¸"<¤é¶«Ÿê?ª¹îõïÂÜ`åžÅmžHDŠ9&jàäYSog 0_/(q^«Ì£C÷(óêØSW‘ß®r9óïÔ€Ÿûåö¶Ûê[(4¦é†¾ßuoIX± ü­œé\þ¯êõ§$òûIÆW 8?%W—¦Òãc×:vÑò4Ì bÖýwI^"£}}ßÞËë™kÙ6k\“šÕY€Bþ:ëÆÿðjQS¢’ŽU=:H´7pK…Ht…‹R`ŠÀ òüׯŠq4Ù\fݳø€ù–Mľ„¿‘ó³Ã†ýîûfÒÎaÍ#¢Z¾1ýÐ(¹Ý‚ðOv¦ÎeÅ©25>‰Aœ)Aø뜩sWGéÄ[AøÇËM¥)áRË‚ àTc7'õÖEQ¦OÀŠ‚ØXîу˜=jìt8‹å<²¡Hœ)A8Ùçåäc7¶*M03©•”Àlf³Y+)Qt}åÊ•ÆÃÙ°aÃóée)²¢  œëæd-з/¾þ4 f2™¼^/9NyDáÂä,¼ESÓ´É“}_bb°~=Ãbf·Û-•."75§8Ñц™CGŽ ;›ˆˆ¿/vJî› "7'r©š7'ÌÊo°¢ÄÆÆZ£ªª8‚ rSƒæ ¡Iß»Y, (Jùòx<Ò›#"75gÝôìylm«éÓ »†ˆÜn·3þÿöÎ<¬ªªûãkŸsà‚ —YA”I@ÅPQC-C+#3{­·ÒÌÊ·ÁÊ,ʬ̬×)‡·ìÕRKsÊÙÄ´ÌYÔD%q"@4„ 2ßáìõûã\ðâ{ý‰¶>Ͻ—{ÎY{í}¾g­µ÷9—\O$7ÖO˜`Ö•ŠmØvvvrt£Óéê‚‚ Hn¬¡8ÑÑÀ HKÆ” …œCUTTPtC$7Vƒ™Løþû ÏOeg³òrµü'£Ñ¨×ÓÃõ‚äÆjzà * Ì?„ ƒyúùI’J¥²  €\O$7VýüÐÙ˜$AZšJ§E8çÕÕÕäz‚ ¹±^|ùtà€ùµ(â¡C...€ˆ”LÉUᜣ‹ €ÁÀÆw ’«Å555`á ŸAÜXÞ0DÄ„óÛË—m6oÆcìâÅ‹4N$7Ö¾xqÝ[»¹sAƒNGÞ'’«Ò®6Ìüz÷ngg@DA***(Ÿ"’ë8&Nž,¿FÆ<˜ZÍ3™Leee´Þ Hn¬¨7 ãâÐÖ"^½ê˜–†Œ±+W®ÈSãAÜX ÎyF†Y|ªª:L›frt”ó©¼¼<ʧ‚äÆzñ "øø`t´¬+ê?þð^º”pÎKJJèéâArcå”JZ¶¬®NÓ~Ñ"ùEEEçœ*8ArcUÂÃù¸q€J®ÓopÆØ™3ghAÜX5¾1™pòäº0Æqß¾vÇŽ!€Á`¨¬¬¤|Š Hn¬™Oa@€ôí·uŠ6fŒdoÏ9ÏÏϧ‡ Hn¬àŒ¡¡ ‹Nèر ÅÅÅàÉ•&I|Ë–ºÇéàAíöíL¥ÊÍÍ¥)*‚ ¹±6ÒªUuï§NÕ¤§WTTTVVZyŠ 8'#ˆ6» ?2‡ˆ‚ ÆƲ#G䬊«Õ§6l0¹¹EFF ‚`ÑAÆD…ÂÄ9kýO’#"cŒ*JÄ ç\Æo¹‘Ïf…Btw‡«W2fpwO߸ÑÓÇÇÛÛÛ*)Š"[³F9”RR"´ÆP(ÚZoD«®—míG–nÓÕ›1&IÒÉ“¬Ö7ê‚‚îññ^¾\QQaµ¶}÷°]»X~>Þ”ÓIkˆ;ZqÚšI·5Yðò’vì0»@0£FŽÌÌ˳ZÍøøqyÏbP«©ªCÚæ•òvÊ “$<˜O›ÆjçÅm.] 0 +#ƒÕ>…ëÚa!È{6™Ø¼y¨PÐ($(´¹§üí©Ý4Ò¼W^a Ö…9Œ±Ò¬,_ßÿÉÝ¢¨h(ð¦‹Yûö–÷–‚䉸ÃåF’$ªÝ4FZ°€O™"«1DMx¸qûv`ì¦3 V\ÜÀûŒ‰C‡¢ ˜L¦ÛýA¬·hÛmŸK-ãe»>?c·y«ÊÌáCSsõwÁI4õ¥¡Ÿ¦è,ñOeê;½‡Ïhcm6÷Å Oyâ™Æœo÷Núí˜HÉTK!ÿàxñźñ¢¨ªR+W¢(Þ¤âää48"KOg«V]),ÌÌ̼K póÉlý€@`%G—36¤¬¥m³ç,ÏìÕNxÿÝ÷Œ€ˆ¬àäþÛ2\=Õwtù 1üsù¶Ƹ þ1æ>¸ý¸t³Êv‹š ÷…­ªø×}ih,?ppîªm&Smc]‰¼ÚxÞ<¹Ž#/Æaâ“OŠ=zÜdÍ¥¤¤‰ÖŽ-åäH’táÂ…›^SƒõiòCóÇøWäð—ì)¡vL`S{lrc™yì˜|:4¶ªÎ<½{Ò‰šb¡`öã“c íÀr±ßÇUÀ-9\³64ÑtKÛn©Ûšs¨N›“íþÂ'`Mm\ß?Mw™e6ë« Èšp•…Žk¡Åu}1{úZÑ]4¾Gxd'›fºòîÃÔ–0"êü8c@~Z×h¤Y³Œˆ&£±ûÚ²¥n×ÿ1VÒ·ï¡ß?zôhyy¹±ùÆ&ÏéÜÚ(G°Õ:«@áÖ}eŽ„ȱôÂ÷t•CDd¨ è¾·¯!rÎû@·Gf†Ä<òèþÔóù"ŽåçöÄtqPEöìýÞÑJ¼²=®ƒ+Øy„wò°>m¯| ‚o£ÁïåOFE~è‘{Ã]@º>_º²"ÙÇË ]·®1«þD^}Âàñ•º&êÏ$¿øÚö?«L¹x;"GÄWýaüþrD<µñ};Ðúu ôt[ï)Oɽ;º $"ʉ{·áŒˆˆKŸ·‡Þ ‡è=bø`@ôëk–ÿ«÷à‡’zx)•‡äIˆœcÕåÇãÂA© ë ôxæ?XÛö.C? é9èÑî`/<ñ{{{txG%¸ö›bDDäù)Ÿú¹Øª]ý:ù:8Œ˜“&“3? <Ÿ}ëÁྠ÷ÇÚƒK÷­…(7ä‡D›^njÎæËß]÷Ïê|,Ù8ÜÇÎíé`Žaë®HˆÍÙ,õñ‡®¤QÓÿS¬< ¯=‘Ô¥ÏС}ƒ˜àôþÒC;÷JJz@ Ð}Ì:ŽˆˆÇç<æÄÀÉ'¨ƒ›ÚÉçÓ”äܸ{@ÀœÑ‘1 ƒcCÁ¦ýŒ”s²ýu}qzíÜoSK¥òÓ³V@Dn8¯xdIZι±U§Ì­§mÉÉd2!ê23õnnf­UƒhJO7"Z¦[FÓ¦MøW¹@€ó3g¦¦¦¦¥¥I’Ô ¹áÈÑ”¢ yèùƒ¥Ïwû¥ˆß¿Nñùæïe†ÙÂÀäÈù}Ýì^1Õ²œÛ «+ED<“ Ð%Qæè;ð yËÂýó`Ãé2D,Ý8^XgÞë»Q`óð6DÜ=ÿ~°e’-’ÊÙº)£ÐØÐÌFc±b«ÚÿaDDÓèóÍUóᶾ8`ª1ÿ‡G¼RŠå c;¢ßbD\5É@™ZŒˆhÜû,$L=„ˆˆ—{Œþµ׿Îq—å£ê xbq¶Üv»Ày?N‹€ÅÇJ {æ_DÎùÄÇâ;WþNÆêW4'Êó–ÅÀs«ÍçÞgƒUDì2L~óz("ÿ•_#[j‡Þ ç±Kê6Ø¿ôÿ ®zÓ:¼UƒÈyñ:`Mm õª;D/º„X:L„˜eyuã{rBhЀ×óû¢ÄÞϬ’O©Ã+'dê‘sä¼(`â^SÝáj®œ?wîÈÚÙ°3Û€ˆyËzô¼T{Fùþ ¯3UXvr=€æxió6ø§dã€ÞW®ûÐB¦#V4ksWå=IfùC]*ÌÞ~‘#çɃ"¼û<+KCÑ¡°÷Êu—^:{öìÖ—zƒ__½Yn\öU˜Õž¯W|× /8ÞZڦܴÑ{‚ü´Úª~Èú÷¿€‹"Ô*Û·OT*Ť$,(h¹Š,üøcsSª¢¢ äd“JU\\ܺ¢š>÷*€¿—y¶¾öÓ‚ "BœÍU(€ŽníŠ*ò«ÜÌ9;cì¯ÇÒç–|ÃA1÷ƒû.ä›ÿªvs¨kŽ(—ðf Mì?›ŽE÷|Z®ö|°÷ø ~{ f¨äf¯1Sy €£-Ôë‹ÿ§u7$7/Æ‘$??wŸ3_}u|×.®ÑpµëëÎñãÂ}÷‰ WWA~¢E½Ú>3Z^»ÒùÕWMÉd*--µèR€v‘]á—e€0öû¦s>ƒ¾ÇÂŽÏ6˜'ÜAú5ûtH‡{-ZAc×=Ô 6Í9T;T¹qŶk¼5ÈM5{rðÂ-ÇËzŽ»‡¦¿ôõKªTq=·õ—eêâM¿Å1ºe.ÿ…×nrzÿJp¨¶¤—Ú'ÅÃú·¿®³ç`ÊOÙe–ÜÏ@YÓßK~¿kÃœ†Ý¿mëU³=Y'7ƒºO°xzÁ~ûiIž “ԔͶ ýÓ4Iñ°þíoZoscJË‹´¾nr°#Mß‘Æ®O¢^úæ÷jYÞJS ƒôEsów÷ÄTÛ•Y|}}ýýüŒ¿íÞýÇÇ›œœêŸ¯r¯aq±0j”¨T ÞÞâ°aÂȑ´8ÒT……fÎäœgeeYÔÍ ìç¾÷øÏ3ú=ôÜ›É/”4eàŒí¡ Æ.XfÚûLÂÓo~ùÅçOˆÜ~.øóEZØ£Ú£‹μ0vÒ'[t‹>{~çô¸‡žOž÷ù§ÇG ýJfiKë¼]¡ò§×_™¸æx%3ûwо·³¥›ZÏÌW3êYóbjµfç'c;ö¸÷Ýé³f}’Ü?ö1Eß7+¡÷ç{BŠ¾ì<ð‰ù_|1qÔÀ'?ÿsɾ/ì-ë¦1óWK{Çô|düÜys'Œè×{È°mç-¹É–ƒ}\¨>|ì‰E_-°ôJøjÖ§'®€S·}Bߟ½pÚ+>ñÑÉ1«–6ÌËóíÞÓä0­÷¼¦m¾îŸƦ§bÍ6?Ûz›_/B#ã 'Lxç¿ ¦ˆðîÑ¿f§O[øM‘žh óîÝ™ŸôZÔ«î™øiD£¾h´3éò  íÛ[K(™º­+»ÝÜÜ:‰‚PìàÁìääŠÚôª±‹¯^e))쇄©S-¹Lx¬\) ÀXff¦ñ'c z½ü}ί_Ù秧fÖ¼µúÈηbѽûSR~6 |Œ_=2ÐE·eóÖ¼v½Žä•Mèá`n{¸¹¶â䚘ØצvGýcÃ\Ú>²{ˆwÙºµ?veÓÖo>Ûúá3…§Žä™³Ò蟎­¼r`óî ㇫/~Ø{ÿÛqOŽU"€¦mFÄ:ÿ Jh·-Ùܨ¿´f«;÷Š¿7&¬ö/í]lжÓW÷-Ö^ým]Ê©ç—žk榹/ôKݶ· × —NúÚ´ç܃®Ü?kD£¾øËàR:èKòk˜Oœ¶C´…{¦,ªæp~âÄ D”ŸS¦hSRÐÍM(.FÎo¢£1“‹ËñŸfz}DD„J¥ªß[tÏÔí"yŒ×Ëá¦Ò%wæ/:#™Ìzm¸d:ï#¶B^ õ_}ö?kÊ Ý3u³† B·nÝÜÜÜ°¶lùÇôéÇRSÏMŸž3y2 T«1(œ-ÕZD…Nç¼g0–‘‘!Ï ÓÙNÜL‰Ó–¿ägµÝQ2eüýýýýý•J%`F#0VU8|ø¡µk³òò*Þ{cL zxXRù“³³Û† ¨V#baa!=-´- öé{_äܧØûûÛ´N” =­NS2eM?ž;w®ºººÑþ"¢ ~~~nãƱM›n¸+£V+^»v|÷nT©€1I’¢¢¢ä”Š’)⎆’)«E‰Œ±ÐÐÐàà`;;»º»å?qγ³³K‹Šn×ÔøúšììÒ~þ™«Õæõg¢hY͘ î€Ó„’)kŠ·­­mxxx‡lmmë+ºÀ˜`4¶Ô­8ÏX±‚ÛØ°zû¬®®ÖétôˆbâîˆnÚwp¾ Ç2Z­V«Õ †óçÏ›L&ùvUAAË9”²¤$í§Ÿê⚺"âÅ‹ííí•J% Y‚ è¦ T*UDDDHHˆŸŸŸB©Tèš{ÚTwèÀUª;v˜›¼-sssEQ¤ÁAP2ee«î¸Rñ E”Jhª]P©2–,1ºº6w ’¼–¼cÇŽ®®®4j‰;:™¢Rñ-G2™šÓeIIÆâÅ-k cL£ÑµXl&‚ä¦y±f Å©Í› -ßZmgg§V«ƒ‚‚hp”L‘ÜÜ ˆ„¿,ÕCwwVV–½h‘ÁÝ5_±GDµZˆ4^‰» ™jkÜu+ÙrskMQœ={­´´åM5 ç<44”ÖÝE7ˆº Àš5×ßvìˆRz:têÄ9oáR`gg'Š¢¬5´î† dŠäƲ&íÛgWW()ák×BçÎÐœÜÈ9”$I;vl³ýD”LµIΞÔjÙµkÒ¡CÕrmX£ÑH’Nq APtÓÊ0² }}A’¤ƒ1:ZÖšêêê¿J‰œC@HHÅ5%SÝ´žÊJ¦×K«VA×®L2?«º¢¢¢QÈ9”Ñh £çN”L‘ÜÜ”£9çÛ·C||ýª¦¦¦‘Üh4£ÑA9AÜÜT i2Iˆ€È†õî—s(“ÉJ9q·&Sm0ÀîB7KûË$”T›U!¢J¥2 !!!t&AÉÉÍ-ô¾üD®¨¨(Q[Žkh±AP2u3Z#k‡Á` ³$‡jaY AÝ4‹Ñh”s¨°°0KBLâî(-Pts$I’¤®]»Ò<AÜÜZDQìܹ3i AÜÎhëî{š_ÓI£ ´µ'›Äß¿Kí¦Ñ/RArCÉ AÉ A$7A$7AÜArCArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7AÜA˜ù?l–G!éëAIEND®B`‚suricata-3.2.1/doc/userguide/rules/fast-pattern/0000755000000000000000000000000013051004444016575 500000000000000suricata-3.2.1/doc/userguide/rules/fast-pattern/fast_pattern.png0000644000000000000000000002704013051004444021720 00000000000000‰PNG  IHDRzeÌ5¿=sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 6 ŒŒë IDATxÚíw`Å÷öŸÙÛroz’@€PZ ´ÐÞé" ((~APE°Ð *M@Þ«´@$Ô$@Bé··-óþ±7! c}ýÉ|þHîÝ»efvγgÎìž%”R0 ÆßÇš€Á`0¹a0Ln ƒÉ ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0˜Ü0 &7 ƒÉ ƒÁ`0¹a0Ln ƒÉ ƒÁ`rÃ`0˜Ü0 “ƒÁäæÿ8åRÒËéÃkü éKíüɦøðQJ-ù§ Ã`róoׇŠu¢R†F6%B2ßõüútçW ßœ·úgBùåo¿¶dó BHÉ f½4zë;ù;jsë§çƾ0{WÞƒ#þÕÊRªâ”¢¿²oö´I&Lš÷éFðà°È=ûü¸§ÿZR˜ Áx"䆂ä^Õ²û<þw'!„LOh—BËÙ5gÕggY%ÕßL¿H©)É7³ Ênͧ$Í6JJ"+ò+@È«7¥ßÉÙ÷Ñ» ­IBõmñ‹…B~ühâiB’·Í‹þžØ elƒ{'Ö´î:)ÇN@]…9¾sëÕ´¼#‹Þ¹[\BÈ®å/ŸpBqùØîã)pýÌþCçoQ &AŒ­ÜP’à0 zƒÁbw–Ø f£A¯×Í‘R€R* § 9¬&½^o4™ T²ÛÎ^»åëÉõ^@V‹Á 7Œv§(›0¥’Ñhp’Ãj.ÙTâMç.åhm«Å)ÔjÔmÒ¯wÝf!šgºÕq÷¨öD)Ái7 z½Þd¶Š%JB©Ýj6ô£ÉÁ»„‰· VÁi³¤‡½BÓ®M›)Ù’/Þ6¸Ö €Óf1 F“U’›B”ätÚ\õµ9y7’Ó¬79¨È› z½Þ`uðò^DË壷´v£ÁÂCí¦Sݲvs››f¿öâ¨1/.Zô±§5é̵\¹0ÒîÍÛÛNžìqkßÑ»„¸C©Ñ) ì^7ï½w¦å9é†sß~÷-»D ³ÆBù÷G -¼üôˆWïQÏpíf¾bÂòoGGyK¦ŒQ#ÆßqhcTM9qŽ6òãšÉîΧûu‹íx>‰Í|wü´3¢ýøå3‡æûî›ýIŽ"ÏçÛ^˜=˺åíÉ‹öTiԚ˹v×éññꯛ¹7 Ð¥qÓ.—r]¢ýÞ±£zÜs«Þ¼jþ²"­cÝÂù1'Žnæµ GóÓý6ïþ_].´gG_\¾Øàå ]çãz¦ÏŒÿ:Q!ê_“¯Ôl9|õ‚ñ„#ŸOyw݉ZÍZYÒÍÓ„|ùí—ÕµŠ3kGLK^3õSGÍøïV¾ó°¢›Ž¾†öø416à;áã“ÛOiPJȽ£k†ÍüRÖ0È–îV»}ò±]ï­ÛÙ±®OöþžµÅ»^œ·5=µ¾µt}çºÞ†#Sâ¿ŒzÆçˆT·=}ßÏ¿ªíÝÔÆ~óñ¢l7úý’®÷W³øØoýpJ5BQëæ&ÿ$&/Ù’ßüXÏZŽø~ðóg;Œ"x (ô……kÎ&Œ×2sõŠký«ˆì¹÷/ 2þËпŸ 3{uyn•üùÚ¶ÑmÆçRz`aÿÖ}ßµÊK…ì Ñïÿp™: zvïÿú—òâÂÝï5ì8ÆB)¥tÇ’±Ý‡.¡”ÒÛ;Z6i¿í¦kÓݳû¶ý9¥”: ýº·ï;åSy¹~ÿ‚È#L”RÓî– »§ºÊ"å¤_¿o+þVüO´OîßeââmeÊ-ÜتáòSJ¥}Óú'Nÿ̵\Ÿ×óéäøÈ S»›"GMÜÎÂ’AL9ªEeíxnÌ•1³×,·úàÎu[tð¶Ü:}õÞÈù_=Ò*øFÖñÌÐ{ttßÉ‹Æ4\òLâÙÞßm{9ª\!ý»ÍšcÒœ±}ç¯V,²ðjUø7Û^U‚([†ÚzMümT\dUÍÅs¿HQíúVSªB&Îpæå^íǵWä^9›nšüŦ²Ç.ï|¿o½ú#<9B‰kš{ùaÅâ|{çg† x~ñ«Ïf´÷Í?_èK% € k¿æµ˜±ÏõØÝ>„Ë9y1µÇ”åkqˆúž†WŽŒéñboµ|9ñ|cÖÔ¯Ooõ“oí`’z'_íÿlbÝ}s§xt­ .­R Å°É˜ðá¯Eã·ˉ„æãB§l[û\mfBŒß1Šøû/P ’µ0íÎ=»H¼«Uöqù†ô[Y§äæé[3°dܺoÔÔ¹±yfÐ b• v}Nƽ|§7Ÿêá!jHW’þ êkÊF°]½™^¥fä…o_÷ùAKu…§Ôºõã×?üµãѵýØCwŒ•Ü0*Ëþõ ~)l4cb7™G>{úõ ßìÙWËëÇGv,ŸVeÜ‚Ø?äÂîûâu¯ 冼qûše–NSž©£agñ/L1*?ꌮ:gÊû‡Žl¬£+ý3Ì»ù?¦7„8­FƒÙ.­‡§ΠmfƒÂÝ[ý‡v`·8]EÛ‰i ƒÉ ƒÁø—ÂòÝTðõ7—?fäñ7É7­ðÄß_ªÕե§å+³2»F2¹ù{{æï€=³Â|77ú7m¹ð²}Þøcg­%„ohÿö]tHè6iÖÊ"I~š±r^"!W×¾þoºó²}ÉÔnC_á3¿mÛ¸ëi©äV™[Ÿ‹ü!$yÝV£6>¢x¸yÿÔ9%„Xî}ñéíÚ'L˜õ¹U¢~BÈÉïævnÛæ©×ÿžFþë«V6Ûÿ—¦cró÷Š ÉÚ¿2¾ßBá仑¦têp¥üÝö­ÛÕ'iÛ¾"Qàb»/ýäã>úèÃ÷fTÍÛõT [Æß‘ËJ/ˆ_#Ô‰ÖÚxêY³ª'G~O©x@ö¯Ìy1îQ­dÏû5.î%ã?Œ¡äÞù-ÝMm>â˶ Gºõ{5W"›-!Àý¥‹Ö·~eÉ¢—šý®`/¸Òªå‹†¿®j„Ћ;g;!  ?}Øyȱû/¹ð=±r£ü'´D4f»tÃÄsUÂëGÕ vÝwcÉ9{ñªÞ*è|ƒ›E7Òq”ŠÎÇODD·ã3’®e4M›7õTRóó%i¨çþ=û›wLðW#óÚÅÔ¬|ªÔÖjèF) 9O8^£I;š•t5Ë qhÒ¢™—ÂyîÈúKEÊsû[#cc«i¯=XT­Eë¿zÕÕAÕÕõ³%*õårêüC¢š6“ûC³šž»¾t#£°f”@x}vÒå›F»àæåß´Y%¨ü”•Ópá\R‘•†5j¥,–îüÔ)¶†-ªêÏ\ºÉmí¦-júiä*²S½qÛ.*«ÔŠŠª /´ܹ”’fqJî¾U5‹ôàÀi¸›”|ÓäµÞAQѽ¨]M'xF©|{V ¯§•¬§lÜ)"@Y¾O æ¤sç ÌbµÍ}¹R§¡øÖêÌë—R³ $(C#× uæÞÞ¹{§4Þ ²UçZîÌy“¯Yyµ»OTÓf~n„\»pÈæײ:M»˜vSy5hWEëÚ1ìù’®ZEߪµ¢Öˆæ+IÉÙz«Æ3 I³&^*PB S“/å ZGsÀÏß,òë0÷Ùžm)E£º‹~ìÖëçc£;„ež9œêV·cã’J‰Ó‰ã ’»gÌ̵Ö÷†`ýõâÅ\½U¡ö¨槦”‚ÌëÉiYùbIÕòîü¼{+Qšï?×)£â>zíüA«oËjÂËwòn¾MZ5÷SÊëgQÖÅ”›F»¨õ hÝÄ]‰¼ ¾=Sà¨rýÐácQAê廊Šý{÷·è˜à«¢w®^LÏ.€RW+*¦†¿†R@²?~²n“Ø{)góµêö$™ºÆ7H:y*Ï,ù…ÔŽ §¼9÷ä¹ËZvð×qLnþøÅÀ~çh§Óý4‹ô¶œ8ŸÖmî÷3:…:r“Ÿê3^[»içfavïºLZìÛûa`þཙukDÝq¯;¢}•ÕKæˆ5l\ö oÈIÍΖl©©wš$àÈ’gglºÕ*±‡"ûâñäÛ³ÖíLˆðh[8ofXHÓL·ðQB×.{ÏÜs˪—ï\N6qâÔ›5šªm¼~®çW­#Ô5_mäÔÀþ3_j Ê_B]ÿMú|J¹_O€æô¾ý†)ª4j’tøH¦‡ãß¿­Û»Ã:1ÔìÚµùêEŸÔi­“·O=òÉ›'jØ.ôÔ#çägÓ^±¬>½«™;)84¯ÇÔ­ízDyåî}crôø/?»?vï>׿UçáºsÇöµ­~Ú8_]p°[§iÍ;´®ëséľ,[½í»>w î¢e}ˆ#gâì7¼*~2kZÇŽGx”½ö:Žê¸ã~h×î­¯-û¤Vk/ÙºsðÃéŸûöé ßM›´ò\‹ö ¾Î¬'“ÛLý|N¬xãÊU*XSo¤‡5ïL¤¼‘zê굎¸zòXš²ÁÁm‹Ýíë朰uwØ‹žû˶g¾¼íà:­Ù{ ±øT©å{æÌùúOÏYþbg*Z' ìsYìÖ!æò½× ÷ü´Ø¸¹çÛ™‡ÍGZGsÈ?}¢0nmgWÃk¼Úx»Ÿ¼qmt‡°ÓŸ¾»"hri¹¡¢3=íO¥{i724a€ðþˆN{óª¶ëмàÚÙ‹wmë¶m¯ã­¾¸aÚKKÏ4oŸà'Ü;pâR«ÿ}ú~wãj -i7ÒÂb;=ªn_3ç¾-Ôӣѩµóßz«Ö¶ýŸ¨à4ÜèÕw´[hã «\8t$+¨Ë‰õoØó2o›-´ð^Ú­ì•[ZNŽháRS3¢°çÃQs~Êl›ØCÊ8wòJöëw¶­î Þøþœ™‘a /Ä–}B|LyçXJx¶5nl½ñÎÌ·-Ýú¿–{)³ßõÁ7ûýuêÿpÐôogíËñ=^Û%Î<½²m§ç²(Ýþz§6£Öº’±úa=[¿óåI9ßÍóý(/¶_Ø Ý(#¥”Òm‹žëþÌ"‘Rûů›µìq©À!¯“²nt³Þ œ®|7ñcæý /·ž^Ü í°"JiÑΖ‘Ý®'}±‹Œ6¡|¾É9kPÏ΃GÏ3{öìÙÓ&ïӻך#éòïæ[–ºÝ•_‡æ oQq²@)½¿ufdûѹ®¼Ö¡i̯)¥gÖiݲÏm9qŒhÚ­ùÂ-·%Ëý¾[.ÞqC^Ûø˲F­ß“è¾ú½¶Ôµogζ-»M¼tjÑ+ÆÌ(N»SôÓæ6¾t‘%‰J’hÔÙøòétò÷}Ô¨ÝàLWóg&Æ6é¿ŠRzquÿ˜¡ßSÊ¿Ý1rÆ×϶ûIÛ]•(Í:ñ^óÖ¯šäRd_¶b“ѵGãÄ6õgž²QJNyªûÓSå„7bö/q­Ûºe¢”žû°O‹á_ð®ÌE;Ú·è}ÎIo®Ö¸çœâˆsŸ>ë D)o³èf‰RJSºÖk¹%¯¤èâÖq‰]çl ”:LƒÅQ6I¥ôv¿&M7äPJ)5\Yµ|]¶ë4 ‹{5ùÃMJí³:E½ñ‹+a='iû¡+¥÷O½ß¼Õ+&Wò!©Â.ºà•Ä®'ºi¾ÑµU›¯ÎdPJiû—¯ÚQœèÞ3-¬H)¥oî>yáÏòÒïæèûì ‰RëÙÏšÄõ¹bp+é‹á1ý9)¥ö¼î‰ñ#çotí&í³È†­>Mqu¨Óuñ¥Tœz½ž¥ÿp¾›À»É;v"¯ù ²´…¶쀢y‡r›/è'§¶çÑ" ÊÑÛ)àêAb#£ä‰®š¯d·™O@¢ ðˉ+Ú wãµó§N¬§MÛð«ýµh@…f‘MämµU}©Ýfá#Q’ë¹ ¢õô)å ”ù§vs÷õõ)|¼Ü%§ùðöï;6ZÃSéÞ©W›c?ÿ4ßh¡5*•ú<…ÇésÙUÔ$òxÂoPϪκâ%4´{ˆ›<²Qª´j‡Õl-¼¥· :¥þÔ©SÜ”¡¡ÆÛ{³¤>][濲aö Ÿø˜Æ11{÷ë ²]¬}íò·×îؼitL³žý{ ø>—’äçéíó+‰¤KwýkT QSPâ9¤oÈÖý¥ƒÊ6‰Q¯O[cܠئM›ÕkÚ+$ÉÕ¼”RUÕ6ƒÎl_ýY®ÁD9’Ç©p߸Aâýkw–Oç®…Åé¬Ûvd4ÒY PJ¹ª=ÿÒ°ÏÛ˜V½Ubê™Óv‘‚(<ýëå_Ù)HUn:o9ïˆä)§yЉZIDA öðR—«\çP’ƒc^ Fæ¶ûeV^$$]Péï›M›.¦½þ|ÍÇ6kÒ¬^Ó^Aª&ºBçºêò~ቮ§àÝCši¤céù#š‡yÖêÜ3îè†ÏV曬”H&…ÂgÕQPP©tÀXŽ¾êQÕKŸræÂ9«Å©S·]w¼€Š­7Bq.AÚ»¡Vþê_ÓŸÉ¥BåííÍb7K¡]ÝØ]ÒÙÿa/°*#½”®ÎDˆŸ»Âh·ÊýJ¡P>&ßÑÎSCÞG ” ‚½,VÀ à¸âm)~glú7h=ᥡŷ¯I‹vxaqã=3{Ü=0gà›†ëÑ6ÆM#%oùRÞu¡EЪuäç-µîËj7RJÈ" fªpÛºrÞN×lq‹ÑEïv“ömŽ™;oÑÂíkïg»Nþpγí<¢‡ïß5wöüOv¯Ï¹¯oõìœ'>¥æhe2é­NÊ‹PW©tå¢Ý]ÞøÞ¯þŠÅ߯Þøi~¾ÉkÁúoêú•žÌ2œ]Ô{üƸÁ/ lßÔÝ]y{û´$›²Ê eêÀ‘cUøº+]g«Ø r-Ätr㜋*90Êq\@°éwÍÎÏGeÏ1.Íï¨O„®2§JÊÜÞù©w«÷5¦wk_/7rì›LB$L_ÿy½•‹¿[½ñ³ü|ƒçß~Ó¥¾%|…g`Éü‰·évÀí=³žžu¤ë°qOµÕ¨Å [Ö>æ ì¼T˜µ`AIÏä‚kxXl€Õh´ÚS–$*“”úùÿÞöôL êx”¯p_çí»4uå»ÉÐ;ƒ½+3 TÍÇ ߸éKeÙœ.*ßMùI\BKïUG®‰KfÿÔdêš¹ƒ"egM,Î ä­6eÈÉ}s¯æøæJ•Æ£v„7‡H¶|<ý­¥û(Tj÷êµüˆh¤‡f¸W.&Ý7•ŸzoѪvÁõôㅰݘ·ÓPvÖ<}Ò±' •Z^·x» {5¼E O¥h1»ê»ÿ“¿J:‡…>ÚBԽƴNÿbab9¿"²Nç ‚ªÿKo­]’bq­ôõ¯Ìßp‚˜îß¾x%MÞU‡Á}SÖ¾™+„dŸÞx=tlÓ ©¿þz»àq §„Ãáªxê®U»ín6³Ü™4dì‰üâªÕ«Kœ6¹jpUíÑ÷rªìëÛŠÂÝKÉ ‰õB¥§R,9õ›fNÍ„†wPp‚èZN ¡‚]Äõmçü5y}q¯o›7áýŸ+ïd 6Ã¥‹Éf§ô–› ß í7i¶jÛ%ÔÑ+ÎúaM5 Ú³ âÎLìѵOƒê>×.ݪÙgΤ§ªÃQÀóNQ¢&$ŠßsR¯NŒþ»Õ=zœœºrǺùçÿ79qSpû½lÞ÷µOÆÊïL*³-$Ï€oó¸æ‘mº5:gÍKW=×ïÔ€mû§6)²yáòæ;ï\NÑnÒóšÈFqK^LȸÙÆM5àXœÆ”YcøòáüÔ¯ÞT-tÓ„ÓÿÚ ”IDAT׶ÿ¤¶1aõên£§DÏÛè €$òÎ’Ë …Àó¢$Aå³vÕäa“fµÝ¾²Ž¿”z×ÐeäLOB†öo9dÚkí×Õ rK¿•Ñe`j*±GÛo^×nçʈ*î™wîT‰íÒ¿~`ùg”ÄûSFxjÉ¥Wâ=K··®Å„7;íŸÖ©Yµúõ,2vzó·¿´S€Š‚“—€ZC»zÍìãQ=Ò‹ê¯Þ}¸´:`oﯙܽS×>ïl?gäî oôLÞâç¸ëÛóƒ×žÖ¿ÿÉ#6+¨ SòÞ¯””Æ }­ÿ¡zÆÄyùp&ê?tɆ˜@H?O±8tƹŃÊÇWx—-öšðôêá³; º¡Î·Ô´æv¦½üfÇöð™Ò;Æ#,Ò †«÷„ ×,áíµ›»wìÚ{æS;ùTÜME§D‡g»õ¯æ}ãbrõc:4ð0~öБӆ:§4dÔµj°ãåf ®¶¹}ÃÚÓ6~0àâ–¥_¬¬Û,gë·½zyó³m«ß»4ýÅŽª5p3gߣ3–¾äê™Îr½š/}c”“oŸóÜK<ݺúvfêÊw#Ç¥‹£uD¾£ôÁBy)($J !¤øÅ"¥„p„ deù7ŠRû“wˆÇl+Q ¨NIóŠRÍ+¯ûà÷âl@ekRÜÚ(s~‹›¨ìù-ݘ¥ G*èò@‹Pg昒ּѻ¼?'=8u´¸ˆ¥KÈ•º‹üU«Ø×Xørûä ùëf´D©5sêK¥rŸI©üFÏä¸â€XIo™>˪ æÝüqE«èL“ŠO?A!(¥ åV&ågð˜müòÒT´÷‡ ZöhÖ-»]Iq®t6ß2Å®è8•\HÊkŠmù9Í‚9ê‡È/!äá)‚²å,ÛJäÁ–4oåÏ/)³kò¨º§}ÿv“æoV0œæu|”9#Uí7²¸Ó ûØoœú‡^Q×3Kò¯-¾½«ª¢R3Ì»aüs”z³Ü, D)÷á/®YÊö7>üñþÃä¢&Õ»=ñœïG?ÌnMØ erÃ`üU*V)›gü=°T³ÿo¥ÂÏŒ¿êºZaZó?vÃx,·n!57oâþ}ܾ>}0`k“ÆÛí°Za2Áfõk8sâÌ× ¥Ý™Œ &7¤‘Ù8ˆÉ 3të†_~V‹¢"8¤Ç £1Ëù}-\fÌp}v'Ð(@wJ3Eï!x~"EA«eMUY‰rGàÃÙ€5”à8P@ܲá³îî¬Á˜ÜªT©¢R©À¦Àÿõ0oó¡{w—Ü?ŽÈÈGû@.SQ*•!!!!!!<Ï󀂂Ù&•J¥<ÔÒjµ^^^›Žù«lò¯Ø ‹E¯×Ët8‚ T¸¦$I„•Jèãã£R©TÅwN–ÎÚÎ`róC)âãáç‡=û»6•-J§ÓSJM&“Édr8‹Ežë-m´²•Z,–üü|Ù85N§Ójµ*•J¡P¨T*F#þÇÛ€:NyX$Ïór-äaãcdB’$N§Óé4»»»§§g……gBÃSŒ¿~ôQÚÁ±X,EEEƒAžçEQþõ7Ï)¥TvpÇqœì2hµZwwwùë+˜$IV«Õn·;ù«$Iv»½œ2>ʳ“ ÏqœR©”'æ|}}=<; The script filename will be appended to your default rules location. The script has 2 parts, an init function and a match function. First, the init. Init function ------------- .. code-block:: lua function init (args) local needs = {} needs["http.request_line"] = tostring(true) return needs end The init function registers the buffer(s) that need inspection. Currently the following are available: * packet -- entire packet, including headers * payload -- packet payload (not stream) * http.uri * http.uri.raw * http.request_line * http.request_headers * http.request_headers.raw * http.request_cookie * http.request_user_agent * http.request_body * http.response_headers * http.response_headers.raw * http.response_body * http.response_cookie All the HTTP buffers have a limitation: only one can be inspected by a script at a time. Match function -------------- .. code-block:: lua function match(args) a = tostring(args["http.request_line"]) if #a > 0 then if a:find("^POST%s+/.*%.php%s+HTTP/1.0$") then return 1 end end return 0 end The script can return 1 or 0. It should return 1 if the condition(s) it checks for match, 0 if not. Entire script: .. code-block:: lua function init (args) local needs = {} needs["http.request_line"] = tostring(true) return needs end function match(args) a = tostring(args["http.request_line"]) if #a > 0 then if a:find("^POST%s+/.*%.php%s+HTTP/1.0$") then return 1 end end return 0 end return 0 suricata-3.2.1/doc/userguide/rules/thresholding.rst0000644000000000000000000001144413051004444017335 00000000000000Rule Thresholding ================= Thresholding can be configured per rule and also globally, see :doc:`../configuration/global-thresholds`. *Note: mixing rule and global thresholds is not supported in 1.3 and before. See bug #425.* For the state of the support in 1.4 see :ref:`global-thresholds-vs-rule-thresholds` threshold --------- The threshold keyword can be used to control the rule's alert frequency. It has 3 modes: threshold, limit and both. Syntax:: threshold: type , track , count , seconds type "threshold" ~~~~~~~~~~~~~~~~ This type can be used to set a minimum threshold for a rule before it generates alerts. A threshold setting of N means on the Nth time the rule matches an alert is generated. Example:: alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; \ flow:established; content:"mail from|3a|"; nocase; \ threshold: type threshold, track by_src, count 10, seconds 60; \ reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;) This signature only generates an alert if we get 10 inbound emails or more from the same server in a time period of one minute. If a signature sets a flowbit, flowint, etc. those actions are still performed for each of the matches. *Rule actions drop (IPS mode) and reject are applied to each packet (not only the one that meets the threshold condition).* type "limit" ~~~~~~~~~~~~ This type can be used to make sure you're not getting flooded with alerts. If set to limit N, it alerts at most N times. Example:: alert http $HOME_NET any -> any $HTTP_PORTS (msg:"ET USER_AGENTS Internet Explorer 6 in use - Significant Security Risk"; \ flow:to_server,established; content:"|0d 0a|User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b|"; \ threshold: type limit, track by_src, seconds 180, count 1; \ reference:url,doc.emergingthreats.net/2010706; classtype:policy-violation; sid:2010706; rev:7;) In this example at most 1 alert is generated per host within a period of 3 minutes if MSIE 6.0 is detected. If a signature sets a flowbit, flowint, etc. those actions are still performed for each of the matches. *Rule actions drop (IPS mode) and reject are applied to each packet (not only the one that meets the limit condition).* type "both" ~~~~~~~~~~~ This type is a combination of the "threshold" and "limit" types. It applies both thresholding and limiting. Example:: alert tcp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses TCP"; \ flow:established,from_server; content:"SIP/2.0 401 Unauthorized"; depth:24; \ threshold: type both, track by_src, count 5, seconds 360; \ reference:url,doc.emergingthreats.net/2003194; classtype:attempted-dos; sid:2003194; rev:6;) This alert will only generate an alert if within 6 minutes there have been 5 or more "SIP/2.0 401 Unauthorized" responses, and it will alert only once in that 6 minutes. If a signature sets a flowbit, flowint, etc. those actions are still performed for each of the matches. *Rule actions drop (IPS mode) and reject are applied to each packet.* detection_filter ---------------- The detection_filter keyword can be used to alert on every match after a threshold has been reached. It differs from the threshold with type threshold in that it generates an alert for each rule match after the initial threshold has been reached, where the latter will reset it's internal counter and alert again when the threshold has been reached again. Syntax:: detection_filter: track , count , seconds Example:: alert http $EXTERNAL_NET any -> $HOME_NET any \ (msg:"ET WEB_SERVER WebResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"; \ flow:established,to_server; content:"GET"; http_method; content:"WebResource.axd"; http_uri; nocase; \ content:!"&t="; http_uri; nocase; content:!"&|3b|t="; http_uri; nocase; \ detection_filter:track by_src,count 15,seconds 2; \ reference:url,netifera.com/research/; reference:url,www.microsoft.com/technet/security/advisory/2416728.mspx; \ classtype:web-application-attack; sid:2011807; rev:5;) Alerts each time after 15 or more matches have occurred within 2 seconds. If a signature sets a flowbit, flowint, etc. those actions are still performed for each of the matches. *Rule actions drop (IPS mode) and reject are applied to each packet that generate an alert* suricata-3.2.1/doc/userguide/rules/flowint.rst0000644000000000000000000001147113051004444016325 00000000000000Flowint ======= Flowint is a precursor to the Global Variables task we will be adding to the engine very soon, which will allow the capture, storage and comparison of data in a variable. It will be as the name implies Global. So you can compare data from packets in unrelated streams. Flowint allows storage and mathematical operations using variables. It operates much like flowbits but with the addition of mathematical capabilities and the fact that an integer can be stored and manipulated, not just a flag set. We can use this for a number of very useful things, such as counting occurrences, adding or subtracting occurrences, or doing thresholding within a stream in relation to multiple factors. This will be expanded to a global context very soon, so users can perform these operations between streams. The syntax is as follows: flowint: , ; Define a var (not required), or check that one is set or not set. flowint: , , ; flowint: , < +,-,=,>,<,>=,<=,==, != >, ; Compare or alter a var. Add, subtract, compare greater than or less than, greater than or equal to, and less than or equal to are available. The item to compare with can be an integer or another variable. ________________________________________ For example, if you want to count how many times a username is seen in a particular stream and alert if it is over 5. :: alert tcp any any -> any any (msg:"Counting Usernames"; content:"jonkman"; \ flowint: usernamecount, +, 1; noalert;) This will count each occurrence and increment the var usernamecount and not generate an alert for each. Now say we want to generate an alert if there are more than five hits in the stream. :: alert tcp any any -> any any (msg:"More than Five Usernames!"; content:"jonkman"; \ flowint: usernamecount, +, 1; flowint:usernamecount, >, 5;) So we'll get an alert ONLY if usernamecount is over five. So now let’s say we want to get an alert as above but NOT if there have been more occurrences of that username logging out. Assuming this particular protocol indicates a log out with "jonkman logout", let’s try: :: alert tcp any any -> any any (msg:"Username Logged out"; content:"logout jonkman"; \ flowint: usernamecount, -, 1; flowint:usernamecount, >, 5;) So now we'll get an alert ONLY if there are more than five active logins for this particular username. This is a rather simplistic example, but I believe it shows the power of what such a simple function can do for rule writing. I see a lot of applications in things like login tracking, IRC state machines, malware tracking, and brute force login detection. Let’s say we're tracking a protocol that normally allows five login fails per connection, but we have vulnerability where an attacker can continue to login after that five attempts and we need to know about it. :: alert tcp any any -> any any (msg:"Start a login count"; content:"login failed"; \ flowint:loginfail, notset; flowint:loginfail, =, 1; noalert;) So we detect the initial fail if the variable is not yet set and set it to 1 if so. Our first hit. :: alert tcp any any -> any any (msg:"Counting Logins"; content:"login failed"; \ flowint:loginfail, isset; flowint:loginfail, +, 1; noalert;) We are now incrementing the counter if it's set. :: alert tcp any any -> any any (msg:"More than Five login fails in a Stream"; content:"login failed"; \ flowint:loginfail, isset; flowint:loginfail, >, 5;) Now we'll generate an alert if we cross five login fails in the same stream. But let's also say we also need alert if there are two successful logins and a failed login after that. :: alert tcp any any -> any any (msg:"Counting Good Logins"; content:"login successful"; \ flowint:loginsuccess, +, 1; noalert;) Here we're counting good logins, so now we'll count good logins relevant to fails: :: alert tcp any any -> any any (msg:"Login fail after two successes"; content:"login failed"; \ flowint:loginsuccess, isset; flowint:loginsuccess, =, 2;) Here are some other general examples: :: alert tcp any any -> any any (msg:"Setting a flowint counter"; content:"GET"; \ flowint:myvar, notset; flowint:maxvar,notset; flowint:myvar,=,1; flowint: maxvar,=,6;) :: alert tcp any any -> any any (msg:"Adding to flowint counter"; content:"Unauthorized"; \ flowint:myvar,isset; flowint: myvar,+,2;) :: alert tcp any any -> any any (msg:"if the flowint counter is 3 create a new counter"; content:"Unauthorized"; \ flowint:myvar, isset; flowint:myvar,==,3; flowint:cntpackets,notset; flowint:cntpackets, =, 0;) :: alert tcp any any -> any any (msg:"and count the rest of the packets received without generating alerts!!!"; \ flowint:cntpackets,isset; flowint:cntpackets, +, 1; noalert;) :: alert tcp any any -> any any (msg:" and fire this when it reach 6"; flowint: cntpackets, isset; \ flowint: maxvar,isset; flowint: cntpackets, ==, maxvar;) suricata-3.2.1/doc/userguide/rules/payload-keywords/0000755000000000000000000000000013051004444017463 500000000000000suricata-3.2.1/doc/userguide/rules/payload-keywords/content2.png0000644000000000000000000003761313051004444021657 00000000000000‰PNG  IHDRz}…Ç4sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ _´Ã IDATxÚíÝw`U×ðsff[zB(¡„Þ{ï ½#E  RDxT¬Ø{¯è+¨ X("ˆ…*„FêfËÌ=ß›„‚òªŸ&øüþìÎÎÌîÎ<{î;3,"ðÿOÃGˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@Üâàÿ‘QúWñlF¦×ãÁWPTDd„Ãngæ2´Î,"¥yýrrs‡ŒçªPSY¶0€‰qyß{û T7%eY!kŽ™û¬ß‹m   nmxõv4¦þ_Çç!Ä @‘¸Q¢T™[mtâ7€ ìRÅ{p˜¹4GÜ”=Br2ñä|`šfÑÇÃÃÇ®i¥´Õ‚¸(“×56Œ´­¯=æ­3½{ÿút‘˦0‘ï×ùÛµ¿õÅêQd™!_.Uð\Ý&Uâ—ÜŸk’‘çÙ¶/³rÝVUûOÍþ~ËÎM㋬/ùò¨Î¸*Ù~úeÍqƆ‰¸2Ræˆé:¥ÄŸeW¨]#Í°â–-—ÆckGMZWÏ=”‘èAÖ«öé?°Ñ©o^>b%}ýØœr=®½Ú0Eä"[G7í2*Õ¬Q9Z))¬C˜‰4Wý†ÍwÏw&¾DÄ ”ò˜aÃaØI·³Í°¾™÷ó‘ì˜F­\L’¼fçI[ƒ.íÙG‘Ý®‰ôß¾å¨n0 +?E÷­^쟞¼éûµk#šÞ^½JD‘¹€ò¥fºÁ ›&çOÄ5*+¯×›K̤љƒKýfÃZ-Ê“¸*Öë¤Î.9“*|ñ¼aÖ®É:j ¾Í˺Š/£&”#âèüšÏû×Êf=¨bå–úŒ™("§~Úh9Cj7i£;H ëÔ¼M膕ïf y1„‰IH n7äæ㯼’Ü~Ø-C4‘ßì;¹X¢é:‰ˆ(&Ò´Ô£ßm îñi•²|T·u»7í:·¿j»Fê·æn‘f0!q7PzkofÍû{µ VJŠt‹ˆ:÷ [¹«ïkWø°Ý¿öÀO›†ÎÀ ð–ê/ewQÑ ó·ïÎÈöÈ°à¸Sgü~qh\üø‘äOd»Óå &ßþ×å†Ù6ÝüƦ‚0ÒäÐÎím;5b³äâLÄçÍN×"›èø:7PúK¢bcV„ˆ|»“ö i3·iýPQBDâ9½ý›÷“~úL5ËEƒ‹ýs±m¦v»:^ßx<5³iµpSѹa„¬ìßë Ž r1ûö­Ø¬•«Õºß#Ð=¬Ûsv¾°mëg§½ã*é%¦ Qî/©Ç2£'÷ÒÅ âÊ\üè”õÓ3Éž:ÇuöaaÊJÙ´üÈñM~kŒÃàÿuˆKPÇ9M—}¶é¹y•ŸœQ°±ÆÙ»Ÿ=ô둘ß ±“Ê:vðLjùÚ“u]˜hþº¾ƒÛæìؘ4 g¥ü0äs(–䟞¹=3rÄàáb Þ n Œ5°tJß¾bP«ñ±A$f S†E o}e½ïï>’îiR1Hýf!‘stÍ÷ï)`®ƒg¶ûÏÉOþ|îÉ:V©Yó’w}÷ó/Ñ}žèÕ£¢X”¸9ïlVl׫ |‹Õ§|õ'Ó¾ÅsÅ<"bÙ°|nV™¹i‡H͈éyÏì`SÎd@Ü@é­bØT®ŠÓ~þ¡"óÔŽ” ªÛt!«È‰QŠÂ»L¯ñå”Ã?m:¢ ™$¢9£*[.WñäÑ\‘1v_nʱÝEšîس¹ø‰l”y`•Qax£¦AdŽ0ÒCj4ì™—¡‚ WHt5ò®”‚ù†7½¥÷؛à R‚a~—éVZšo‚EDYYY×ÜzßU³_ð{ñeýF#Ĭ$©b…•ô¸ˆ0ë‘"ËœÜd#üY0™é%ý‰I*°Dü¹™^OivgX”M'e 1‰ë¬i¤ü"Eú’„HÓˆ5R&‘vÞÌ…”X5„ÍïPÊúpÎ~=:žw[»ðððÛn»M×KiW;ª›Ë¤¶!Ê߇‹ï«yœ™‹?ÎDb’Ÿ¬pš’È*Ép…®ð‚}€ NÀ$Rùž·6¢H Ž|•8sdÍe ÃüqˆÄ nqƒ7€¸@Üâ7ˆ@Ü nqˆÄ \Fp5¿Ø?réV\ 7ÿº°3ˆ[½ýœ2l_Aë÷m¹u¦3‰ˆ›¸¦‹#'3·|•¿«°á¨Ã»"ã÷®àMáÄÍ¿©)e9‚~¹av|¯ÁÏ•N]ž¸ÓæÎbܤ7ÿBšé×ýWqc[&>søg6u|€¸Ä üýDDDs¡Ó¥ÝøTˆH³‘ÍI6'Ò4¢Kx¡év2l—4q‰ëIL†ƒ ;ý±£ü¥ÿö{ÒÉæ$.i—2@ÜÀÅ1ë.Þ:£Ò'_oµüû»¼Î);?ZùP¿WÆÄ>Uìë“z¯]²0Ëcþî¡oVÙkætXôÌBõÇ“뜱å©÷ÆÕ~ïÞ»¼Öÿ<Qž•÷7zÿå­Úo¾GÖ8kùMóÇõ:“îáóçà]y_ýw_øE3p˜¿ÔAWq*pHwEØlúïýl ë|æó ËWl/×nòˆÉ…;¼§~|sÝ’gNÄg\{ï­¿86W¨Ýiÿc먻}5jÁ€>éìïls†Ùú%Lì -!Y¯Õab¹°Ê‚Ãüˆ¸h=¢‘aÏy§L²ü"¹a6dÓÎMvÞh=!ö'ýøíê­Uú<=pl_ñ“ÕpåºÕ?~pÞ¦­ºj|Aû‰5é:‘òi¿ÑÎÒtÒmÄDb‘é§âƒ“…ˆm‡å×"+WsP‘ÈÖÙ°)?YB6ù="%½K.X2é:’Æl4z—.”çÜnq%î$âŽ_µiÑ §O%“QµÛºŽl/¹¡'o|zå¢%^rUëyw·¡ýÝ,…{k”ºëÍ¥HûÝÛL*éËÓ™öŠSHØ´5hÚ¥BÒÁ’Þ£òÚª]ì ²ˆé!A8•q!MåÚòÞœ›vè¡ávg˜Ý杻ö1 ‰‰‹„™…DBƒÊ¹ÒÓ3‰«æ‚ÒÂ#ËÛŽ:bé­É,ìñëèêWOeG·PZP‘’ÇïN¥¨&üŤۃlÁyDUnnYž£ßÿ— Ú?l‹ º´ú¬Œ8_PåƒD˜YD±³b:Prï ;£5"A‹q}ØØ­¯Ü‘Õ}à#††„9BÃÏ~8ø«3Rb§„;9“5b‹„HÓ<Þ ·«BÔ¹&ñSùŽ½ø£7ÒGÇsAN1Yyq¤¹&jv&aŒ°áŠ¤£ü4Ô\G™yfÞ…;ºÝn×µúÏû LË_¦‘(²ÌKèÃÒ‚ÊéîýyŠBXD˜˜|g3.þ:ŒÐ»L7u|ÿ8]Î$t×¼rT•*Õ‚BÃmº?%Í«iLÌçíeÎúaQ’‡X'Í ¼ýoŧÄ6hV¡è!±¨B³ñaÁi[ßÃc’¦k¤”¹ç­¤oLßñvRE‰ÊÅ´—¬åÇOx5Xg_ÚÎÌ´Œ c.¦VMÓsød\: ‰"•stñ”†Ÿ¿÷õ¥Ô "¤Ç *çØ¿ó§D6˜5Òý'â6ÃjT7ðw³¸rÍ:ô;Ú™uð«Ç÷Hå ÉgS3Ê•?¯M¥…òß<2¾UÿkùÌÆ]ëV„w¸¥N„¦Î&&1¢[÷¿ñêÅϽüYâªjmGGI;WžŒÛÔížnm‚ÔZÑŠAåÎ#£—}²éÙ2\ÉG¶¯øÈçw\p žCÚLh±òÍ/Ë<­Jyóð—Ϥº› 9àRƒ…ÈÖ q—N›>ºáû”I5bû–?›\™XCà nào¥|\oÚ’´wÙöÖ$e ¯Øt̵s­oÞxÿÛ÷¼÷Ã_اAa úµïx³çûç|9ßÒC"›ÝÜéºÉç ¶#fQÜjöèûêý¼òë”ËN™ä¯X½÷Ç =ïø3‰³þà'ßÛøþ‹Ç¾}é¨^±ÇÜXýÀ­êyõ‰e†´š³Ž>|èø¦WüZpånž¼¯JXªØ(=¥š÷6"Cåüú†›Nxìwïßþþé-Ž ]Ÿî­?ñåÖ(]¨øè_­|½ŽÐˆüªN(¸rçZ¥ó‡ ›×lQÙa×±ý nà«o4gÝN“ßU–I¬k†ÁDƒî!¬kþs;¬òQ1Ï{­e±fظ¤.UfS‚kï1uˆ2-"bÍÐtˆÔ…#ø”PHëÎSßUfáÒÖ óÆ2‰Gµ÷\ Ë!ÖmšÆ–*žt"–Útâ|"²T‘A½Ìl%ýðæ+Fx&¼É ¯S47ðï¬Þ˜ˆ”^®Éu/5¿1¿Êò“RíY”±c&½;F™Þ’ÏüÄ ü[ZŒÊOÊOm‹ýù%ù=ÿ/³†¿Æݪ› QöœLçÙ”¿iišfxÜŒ~T@ÜüÛè>úyÆSýþ3¸ÅûOým uf¤.ýøW nþeMYE© Z½·1ño-§˜Ù ]€¸ù×a"{îß¿TôÙÁ?ñûŠ7€¸@Üâ7ˆ@Ü nqÿreà$†Àõ*å‚S qE“¿ß_{í=øÔÒËâ%}J{Ü6›æNZýÂ=J»‡@zZšÏïÃf÷7'?kš(ܬ»Tä¾òf‹”±óúK{ܹ\½ÿŽiú‹^›™.\”€ÍîïÎÜë Ô°ÙjX–U¶jœ2И *áFÔ.—Ëápà‘eºŠqˆÄ ”^eõâ¡š¦®| PŒÍf+Í«ÇeîÐ=‰H^^^NN6¯R± q™ÜŠ.K.—+44qÿvè»Ä n7€¸Ä >@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ ”fBd)Q"IáŠH‘)ŠDâàÏc!RD"¬,QEbˆÉ"²iƒ¸ø‹ªa2‰(ÏÐÈ0¹ ¾ö›ºMͯj @ÜüiJͯٔƢä\Õ£Ù-M34%ÄHÄ À_И"Ò|†Ç.:+²ŒÂ:F”îÕØ/Ê®XácBÜü%ÃvÅ_-7÷þäט‰ cÈvöŒ-+ƒ,fƧt9~ñ83!â£q§j·ð”®•|Fˆ™„ˆéÔ©Ä+û8{ö,÷ò‹J‰¦!rPÝüéÆTöêõåÉ“žâþökRy>ÅÊ÷‡‹ÂŽÈyw‘å â௡W¨(Dšy¯½'¢i–Edù>_¢[bËËÆf‰¸øËS®îݳ‰ˆTÐw›¼™9¬±×&ëÇ_l>qU©«HÇ¡)Ä \ú.ua—˜\dÂß™à7^pÑE•þöT¹pnÛÑ$edœ±}þ•Òµ“CFEF†¸&^¯ˆ]Šˆ›Ë2Šì¶ò^^ø¢b/gf9:²NèØ¥g–Ýw}Ó½ãÜ%wF0Ë‘w5jÛ}Î¥õV0ŸÚöqË:1oíM»µUÃ^3Ÿ+sÝLb™Þ Ç#&2(ýŽÛiÍ·U“Ý¢n»ÝÔ—ÅG‚BÄÍå‡9'quÿ6Ãw ÿ‘ý–™ùÌ=º¾üݾó_Α}úö rè-úõkú³Ö®ð°Pý’VµÉ€†±ÄAƒ&©á²•ÅÖ”è6G‡vfåê:öìôœI“ý~Ó§™Iõ›·mkŠzŠ7¥¸±(3J¨Pä¢Íü‡ƒœzn¶ÛÆ©pDä·_O._NŽÒçÕJDaÕj7êÐ(¢výjŽÐFå‚J:¨XATÂÌKx›DÁ‘•"Bj×­æjß¹fµèjE›ae¤aŦO$Ø—2MM r;¤û²MUÿãÿŠ]lB臸)5iÃÌi¿.8´{§N®™þäÁlfffæ+^¸ªOÇö:]?ëéø 3ðèÎE£»Î^é9½yòˆ®íÛ·;ý©c¹Ì,'?y Ý€»­¨³ãÛu|þ‡cÌÌÙŸš>ºK§v½ŒyçÛ#ÄÌÌ|ì­–]‡IKùà¾q];·í5pÜòY̬̳ÓûvÞfŸÜ=zИ9ÙÌë^Ô¦Eß_íê¾]:µíÖ³ßo¯Í;W±™¸åÎkútnßjèÄ{¤{™YD˜ùìžÏn~E§N®¾õÑ}YÌDY)Éíæ½|E¨ûÇ‘·Þ6”ˆøäâV­ÛÞùÑæ²Ñ°bqê¢Øˆ~ê,¢`Ó¯é†)¢ßU¯iÌŒÆâ¦Ôô¶ðÎÏë{íC¯¸~ÖÌi5Ò¿;øšƒé^æ¼%sÇ^?ï³N£§Ü5kJlêò#ÆoÍï4Ñ(aÙÔÛ^hÍ÷Ý9Am]8ùî—…¸üã¿g,縦>÷ʈÆ1ÙÇ6Œè5h›Ñò¶™w^קæ;ÓMk}þ>âK¿ÿšk÷VìϽ÷ö¬íyhÌ UÇ,ÖCf<ùX ËêtÍíóî½)ˆ(¬bƒÆM…2—ëѳ- ·ìqe½`!¢”Ý ¯··á°³îš4ºËÆWÿs×+«ó¶òRÇß8×ÕåÚÿÌüO}ÿO£Œüæ°Ÿ™÷~õLß1÷Eu7kæ´º¹k¯8jwr^x•FÝëD‰ 7¤¼!DDöèæÅF‡••¬Åº&~.Ã6›áPBdóÿgªX†x©Ë””5JDäìÌ޵Ǽ¼¿àÏ=×´hùØúxÿ‘µ½:7tÙáüÇÍôéƒ ¼k­ˆì\tu«¦m—žÌŸÉÙ/'Ôî>3GDD²N|Õµ~ïíJDäÓ{ºtœ¼¸pY)kf6n<|%rìÍfMZܶdˆ(%rzc÷έ^ü2QDDNOmÛbþªÝ"¢”*\Í"ÿÏ·í­­Ç¼Uøç†é{Ìz^D]ô@ëví_±+æÙ‡G÷mÃ]oY’5§oíÏï.x›û¯kÕò¡ÕûÏÿ@Š/µTwÕSâU"–'cÖÜ&“–®Ÿ ¶D²•(Ó4•X—!£ìõíIÒšbŸšÐ ¿“„?¿ôCw¹ª‡·|–›3ppm IÕÂ;´i·ûçe©Ô“Hyc®T%ÿ®Šå4å¿`Þ§V¯Jn86gù²Å>!"ÕŠ²z}<5¶‘²GnS•Hˆ‰\.󅇮‹´eÎkÖˆµºiÙÖ›ˆˆ²SÞùÉÓÖ¸ Èt÷nÓˆD˜‰BjOi=ûdœ7iÍÆø*LlRð6<»äÃ܈؋/”Jyc*ÐB%6Ñ<»ö¨WŸÓ M4¿©H÷xó~ÚæjÕÊg#‡R¢i(p.?FY\iJ\vpLUG ‡D¨|íFD´-+É4ªV´‘3‘TŽó[Éy‘•stÉ^¤G5)1ÏîY»ø]C+|>$¶’é'²i†Ë0ˆ;´\лû[5$1³?3áõGg°rŸ#",(84Ôs®B×!!ºœ­X»^„g¿ß“—T±ªóÜÛŒ®Õ(:]ey?ëš"òÜ2%Ô›ë׌EÁ–¸”•÷ÃnÝŒÄ ƒn7¥†mÏMË´ˆ´@¯1¥Þžèlà ŽÒÍýiŠ*iH„Ô¬Ÿ%dØì†ÆçÎtËù!…3+Óç3Å°Û ‰HY~¿ßbÝ°ÛŒsåçFáÅ ŠÌ€”×çcÍ°FAœßŸ³'–éó›¤v»Á$~¯W4›Ý–ŸL–ßç·D·Ùlº&¡ÂD¦ßkZ¤Ûì6é‚° Lé9óÝ+ßÛïÝ¥ôÆ ‹%~Ìܳ¯Û¹×®Òº^é6|AlœèׯҺ5†¡åöòÙRM,bû'âJŸœÃ¯?ÿbƒQ^Q?’Jk«‘XŠ5S”áÇYŸ/«ôÆ[¾¨(‘FÌ)'NUŠÖl™Ê-&‰ŽæâJiŸˆ¥H \n³Ô„,ScSØišeé!:³°(¼Wtuþ°Ë§rœq¤N}¤ÍåÍãËãWCÓu™Jó±cÅDLº]H1›féLL^ݱ¼¾ë&zÅí!ò¥ŸÆWŠêàÏ7Dbi¤‰"Ÿn9üšdd™¤ÙÄR~_rùjš'¯BòQ¿„—üM¿l$Dz ¤¶“N3‘ÁDÄ6!böÈwÞµr“üá•ÐKŒêàÿ‘±"S#V¤ó…Gûqð×åMáYcB8…qðG¡?7€¸ø3ŠßYKŠžo*ô¿Þv 7Ç$¦OÄ"Óò°ô ‹X,¦ä‘ODÐU|~õè*† ÀQ–0 “뜉E1É/¤Ù,R†®¢ PÝü™Ö”¥)òˆn¹Ÿ3Ù”hÄ":‰BÖ nþtÚ0>=4»e~£ÈMùÈ$»EšOGÐ nþ²F<YIFr¼e+zMbV¢ •ç´¬üsqð碆Ä&)Cn8Ý}€‘™"…µ “þËY7Lw†fáÊ舸ÔÃ…=ðr± /þ+þÏÈï/°4;z̵quð‘¸ä7Þ`S,²˜ˆNŽG ?<óÔsÊ@Ø n.Ç\¸¤ÿ7bEJÚá™YŽŽ®qͲ3Ÿ=8¾EǾqî’÷ffÿö>uj7n\¯QúÖmÔ°NÓvÝ|{eŽyñÄa>²æµæ k}Ÿ<±q½Á.,[7žR^²Έ൫ÈcZb)!÷ê¯+%&8mzòêåúo§- nÊfeϹg~¸ùªi…ÿÈËÌœöäõ×.üéð/ëÔ±½Ë¦ÕëØ©~xÐoÎZ ïuëc+>_þégË?ýôóùS:®š?ëú'ø£3áÕw©VN‘«ûÈ>ìeìB"zƒÚ9Då§o·HR [lzß~Cìšá·*5èlå·ºqS+2£„ E.ÚÐÈؠ܃{âü|‘ 'psãßZ>y`_ŠÛ:¯V".סK×FµÃ÷èZ=ÜYÒ]ñŠ<Z1¶vý† 4¬ß°IŸñOÜK£Ä%Ï´J\)¢èº-š•¯:bBŸzå"Š¥¿a¥˜lƒz­\‡øÒn¢ë6>°Ã¿d¹n*7Q…93™,Ô6ˆ›Ò’6Ìì‰ÿvöÍ£†:ý¡·-fæÀÍŽnüïäqC‡ 6ó±wR¼Ä"̼ïó)W=ö½dí½÷–ƒ¹í¡·“ýL,§¿xzð OX‘³ ~kË ffuêí‡o1lÐا-Û’LÌÌÌ'õ¿jb¢Û½â¹ÛG 8vüíß'ú™YY™÷¾[7V<1õúIæ0o^pãÀ~ãvz™$=µ|‡ÛÙ¶äêçŸ(¯3åÆ­ð¶ëF 4òêë_\¶U1_¸SÉDÄÔÓt¿Ï"fæܸ•wL9tØ°Û}/I1¥Äí¹ãÕná9«WeŽ»ºq¢>}Î_WúVÊòÙ§LW™⯗ëi)n‰"›i×|ÍÚ¨ÆuØBmƒ¸)-½-¿î•.g$ÕéÔ¾yÎÖ·‡÷˜åg67¾xóÐi/Û«6éоYæÏo=㨟‰ÈçNO=ºú¶¦sín}º6ŽÿæÅI÷¾ÍÄáÍú\7¢ åÙúŸÔ16ÊwfǸÎ=—T-;tª‘ýÔÝ\²ˆÈÌ=súèS× ûøDXï+{Dz÷Îè×Óbv ¾a\9KÕï6èš1}Dšf3l6ˆ¸Ü ¡WÚ‰[õÜ¡ŠCˆÎÆ­8fÊ_Ŷ;5u-~äúÙïl*Ü©t›£0pü™ «W¬ ï:¾±˜(nåü®CïÌŒ¨ß©}Ó³?¼2|Э§Ýfùz퇴Œ qËuU‚_¦n7 C+ߩΚ«K³j=»ŸB˜ÎŒ¾Êµý i'¶ìA÷ÍöIÄ‚¾›Ë”IÙwª?䱟òÿrÿ4´a“'6Ä[ ûvi~ï‚–ñå¿¥Oýÿ$";]ݪi‹ûýW$.¾®NY9""’uâ«®õ{oW""_=Ò»Íuoy stÉ-ZŽ‘ø7›5i>á½ü%š k»ujõÒקDDäô­m[Ì_µ;ð”eú|>_`ÎóË«}ëô}ºp櫧vîyÇ ""¾ÃZ6ïÜ­s¯žÝzöèÖ³G×ÝÚ™8/ÛT"¢ÌôÛûÕõÌÖü—ålX¯és¿œ.aÊôù|f‰Ë.e¼yþ<1Sæ=â&òÙl6#Ï®åcæå*¿òY¦Àe§l^«8uݦƒåø¨} ÖaWûç¼Q­â‘ý+²r¢‡Œi¡1‘ˆ-¨J—ömü¸(Ú)oùᣠŕ«Ãæ…wÔN^õű¶S*ïþq“W‘FåºTñ>µöÕÑHÙ¢®ï^?P\éávE©Âî¡så¢nÓô’ûyÚNY7…ˆÈ“žœtôçd¥×,<¬ÅU[t»¢~L ÇBù27®üò–9‘Ï=ykTòw?yüÖÖùo6¸ó <ŸVR¿µn³•‹üÚlì³(zî줖\—æKù-ŠyæQvºÈ$1.Ge2n|I{ΆT«èÄ!ªÑ®'mû1ѯ׌uzj™HªEEù¬ä\‹H„Âb\¾"Q%ê‰ n{Ê[Î(òe—ä¢0"Ýl؈òoÇIBÿáaf_Æ¢ùsÞüô¿¡ë.RŽÚ碢v·a“¯jG÷Û×£Ñð[ù`ùà©Õ÷f…Ö¨å<÷fk·ïIÞ¦³L•ÔDºM”I>j¨¹ä›é'²¹Ösµ]‘BÜ nJI‡“+ÌÈËÊUDZ X8ûôáT[¬Ýª™‡2‰*®’™ëÕÙuÉ?ù.»Ò®ÿ`ä:ÎóŸ9öçÖ˜‰H–Þ5ô¹ø¦÷=ýZãZÕªÆV>4§û ³„Ôcf‰¬]Ë0ŒÌ3Çôú¡º;3·`?eæ¬Ä¸tG•ÑAew³SD–æ·çùÒW}.¡gxES§Yd·š( wGWqéøe4b{5püpÓY"&f¢Œ§Çô¹oÍ¡ZÕ›;}÷Sv`·+ï—¸_ƒ«v/w©ónpEï' 6þþËC ŒˆûŸv$ÓçõúJ*žŽùÝÙ«n¿}èíëÄVv’ŠO³´"ÕI±AûÌIûöûýfTL {^u{ý]ðfÓÝû¡§J\¶×ëõ[ªÔ÷’.¢¹='®‘™A䱘”®›^ŸfêÄÂDú‰QÝ”,D¶£F´}dîÕÿ3½[ý°MŸ¼ü¥¯ú«]kÇÄ\YÝõßû§„ÍšÚ¢’¬ýðÕÛƒýú:ÛïìJÓ2÷ì9S»^…Óg,˜6{Fð”ëwÌ9´î•ç–vºù©º¿·)¥â㥦ÆDE—ûyá”Ç›~ú~3Çy“Å´©íûtÁGƒjOª¬ýfás/lsµHIÉö”w‘ì^þÖ}Û—*!"Ó½ççï<Õ¯½v`,kU‡÷oöìÝ7V›y[ÇZ®õ _X% ÞëR•.¼]AÂâáS?ê=ç¹Û»×)ÍqÃÌ–°ÿó/¶nÝ`Í#¤>‹W¯æ™ÓMeؘ5!aÁySˆ› Žˆ²¬Gñ@#æ¬øo®>£w£R[Ù(QÄ”ýìAw<¨³ß'$óî×Sµw^c¥'¶j_ý—¦‹©k6쟈(­|)ËÞx¢âÀûºÔ /' ‰²,ÑLÝŸwe¯ uÛˆóÜÝúE|µ({éZç£H³å9®Í›´ØfèL8mê2ƒîÿˉ­Ã¨¹jF”ÎËŠVŠ…u¿ß™ëÕÉãVòÒýd½êÊg( 纵¯¾Ô5›R&²q¥˜=¢J¥HKé͵Uþæ&éÙšaˆä5km4é(Bžà ¨7^2•ß§ÓéûçòÙ,‡¦7rScLÃæ¼jÔîˆò/>c)± r(Ã5vŒ¿Vue§E So%FÇ âàbE¤Hédjz딆¾¶uhÏD†"2MÃ3ÂîÕˆ8zÛ\¬ørÜÐU b±,fElXâ'¯¦Fzà(›OiɉéÕ›„ÚÝ1•Ë8¬9øÐPÝü¡¸aRiĆŦ®tq+Ö˜,MQµêjxoŸW‘3Lì:>1Ä À-¤IXt&f Ò5ƒ™u5‰Épi6!*÷Ì3§ªÖˆž7GØÀ'†ÆÀŸ«qò .:d2Ødѱ‹B8…q€Æ n7PJå_]¨ðéè÷9÷ nþ L¬Ä/ì'E–(Q–‡È4™Dü8 qðV7¤‘Ζai¦¦Ø«Y)zîëù!u‹ ÕM…Ñ Pú²F„‰¼,"ƒô8÷î­9+w»7xBìgÏé=Õ âà¯K&‡=vßžN Ã~ËÃz¸ƒý*/Xòo4ŠÄAÜ\RýR|@Ÿð¹ \|Qè´qìÝø#²”t;û””ÍCªM Q„Û4”Mæ÷ÿ×8ï²3ùA>÷ðÅ~±…„J¸†MÁuEg±¥•_Y ¸l‹(f‹HÈÏÄkN/Û÷™°¥1{œfh¦«iTçAn0$D|P(nPÝ@AŒ3KÚ»<© ¾¯å©/¾ÞŸ1ñ¶iì%>­z‡>?@Ï>C®’çEL”°™ÞYB'2ÈJÝÓ¸Þ¬IܶòýU[ÇL›¶ñ¹ç¬WOìÖ°Ìlyb™ºÝ<"Cˆ™•Å¬YŠ5û†Œåë½K5CSš·cHÄÈÚ‘­*;ê²3 1¢¦ŒBQJÊò¦¥¤ûÿx‘ge¦¦æzý<žûó7Ÿm:î9}pÛªUße[ŸÁÞ ôßOÈ_reC¤èÅë¨Fgzþ}Z¹’>û®ëCu&Ÿ‰(+ñયW$çy¶®þfÓ¡Óeèc÷‘õ}ÆÇnÉ!"&R$šbÑÕÊ3‹Öä,Ôšå⨠±³;FŽ¬ì¨Ëìgf)FÄÍ%Ê=µf@Û»þø ’ïìÕí•ïö_P”T¹õ–qÎ0g¿ÿÜÞÉ¡ëì“f¢ shƇôðçtò4>MI'iÝ»tü=šð4 5rÓÍÕy\éþÅ–©ëÃœôž\svÁúÓßšEše_ÞÎ？[’K=V5¹«ü3u\MmJq vËîmŠ¡,Ç‘ø²Ž>|øÄéTAÏùrÓÇ>|øÈɤTKòož’—‘pät6)Ob‘ÀKL"!ñe¤IH±ë§âN¤æîÐd¦ž>~äðá£ÇŽg¸­ü…ùÒãŽó+ÉL>qäpÜÑc'rÌÀ­´ñ–Ù“ròDÂi‹('õØá¸x·""÷ê}îéC¬Z–ÒiZ~x2éÐ~Úµ‹ö짔œb¹bù)níÚEGNæ÷ˈ¢þOÓ€ytßP µé.ºb<­G+WÇÊØ»veظ.ÔÆ—vjÙŒˆÈ“rèÐád·¿Ô77=b‹ÌÔßNê8_tbžA:Y‘5¤á”š9íÁ,)ƒH‘8ˆÑÏXÆI¤”’ä-‡õiÝ´a«– Zwì|Ëœ·Ü–ˆˆoï#¯ìÒ¢Qí&M¶éÔ}ò³_^²ý¿Ã»Þýéû3{µëܵSÛ&í»õxäÃ"*yí;cFìض͈qã?þõ”Hæ+3®éÚ®I“VM›6iÚoø¨uq™""ñ¯7íÔoé³3:whuå­š4o1hÔÜD%ÊÌzæ¶ÝÚµî7lèŒ{_ËY=¿Gƒ:7»E”?''ODåfgûED‰¤–U¥`<¾DU–ÇD”Ì¿NÒ«mÁS6éûhþ[ýå5!–E{E”¨"AV¢8*¦òºsÜ–ˆø3Ò³óŸß=/¶zƒ‡6ž(å_âÉœ¸9ñ#œ~Èoú”¥òÄ|äØ-wu÷Éᯘç“<¥,¥”Rb‰i‰ß:ï€2¨ ÆëÕ}»›z0[Däàg´iÖaÉž3’søÚÎmM~4MDD,¤Kã¬Ï‘‹®nÛ²ÁMO}#""¾÷&õl<䈈˜)ßv­×wŸˆˆüúé}íº XúkªˆHö¡¹£»·óGDâßlÞ¬YûawÅûEDŽ¯}©K‡f¯¯ ,'㶶-^XX»¤ë¿üj]šYÒš¿ÔA¨²V""ê˜T0dä=ùqC$M®¯ˆˆ¼|‹É£?Šˆ¼3KX“žÿaOËÜÿå_íMq—ò¯ñtΉ»†¿pâN¿Çg‰ÿåcwÌ=4öîc£_Š¿Û·XJÄRß÷¹oʲ²×˜&òüºrMâØ'Ÿ¯BBToØ컆·Ép«3û~>î‘ wßE$BõÝ5¼WÍ_~ÍMD¤M £è›WÈ"Êu…Ú/ñ¸¯ˆHXƒC4Šv•ò!Ãa°3×çVBßg|oS†ßî º¾Ú,VNa Œ¾):8Ý6e]Ù;ÎDþã´zWÖ± ¹F=øíX~Ðc5lè "½qÕZŸÜwV‰¨Êm«ë³ÒIÔóŽÛ’¨¥¿8qØ«Zþžª|)¾”ÝghD‰=¤FD(îß›ßcÉôGp ÿ t6 Q冴u-½¶‡ì¥m›è +xÞ墺Ñ#o¨oyZšL–PH0 QzÕ *¶4•M»ŽRÆb\dJ{¯j-Äa¸,oNŠvbEÚ"§æ"]&U¿;ŒÊ)Íb¥!`7¥£Àñ¹-ÝÐ ã'ÿÎߤLÁN–ÿˆ¡kBVþÏüïï~þ<ãÚ'ß¿±~„¿à5D¢ÙˆŽÿ¹?p!Ì7GФϨAoš0‚&Ï¥™ É,ž£… pÚ‹¦µ‰íÚCmÛ[þþǨåÓ´û,5 -£}†Ù åpsöûæ‘vQ< d\ŒYϲû5"f-PÜ ppdêf¯Úº‚;îç$"bfæ•N~tu|¥Ju|h×i*-Íû;œuÂ/õªþ5šTÈÞ| W³;v‡Ýá´çýúökKÒ/ùC*Ò~)Þ˜b":E“>£VÒþÕtçdjKE'ðxèxIàh”‡V%RŠ¤3µNˆ^z#?}(ÿ@=𠹚P ×yçFKñ5(ÍEªÒÈP†Ç–ë ·Ùüf ¦]¢ú)›èÊ`eSÄ"ÈÄÍ?ÿ»HѳW~cÆ3BDbXðÀÇ;+G;ª4h¡¿òi)bÎMøò›µ{ê]3%ôR‚BQDÿë;îztê÷gH‰0å¼uë”;Ó+^BûN”"f>²éÝùϾsÒÏ´eüDDQÁù‘q|-­õ’.çG¿EÌDLߣéÔgéLT‘6¾H¿¾Kíf‘[ÈRDLË¢Ïâièõlœ÷óÏÌœôýü'Ÿ]—]ÊSºhvËÎ[~Òµ ë£§i³h$iŒÂ©Rñ»(BÆä{?8eú€Þßׯ´ëŽZÃglZ™l•_¿â-w<Ög÷òájï–_Œ}ôÙÑ•ˆÈôådæxÏÍÄrgfç$6ìQAAÇ?õú;ïuíã#·ß8¥O»V-äÜsÐjôÊ[×)ofV¶¥ ÒA¬ìì,?ÐûV½\β—Jû¹÷Ü&ÇýðöK/ù;L™XÕV<"¹:½0‚ft¥%W§Ñ1ÆT¥…¯Ó©‰‡(†?L¡/S¬NûâiÔ“t_§üŸz·Ñâ,;—‚Ÿ§5(û$¥ùhìCôîÌ’wÈÓß>ýââÛºŒîQ½ô¶³„D³X4¿f:•#³Gð†ßIö@vó¹Š./eõM!b²¶·b’§~§þmj„ç7˜ÙÌØ°jõ‰l­qç-ª>\оà@RØÞ`¦Ä_×·ûLÛ~ƒDQòMë¶ÅWk>¨[³Â‰8¿ *¸YIaƒ…Y¼§¿üt•^¹ußnM ¦"ÏpÑú‰˜éÀ÷´â'ªÞ‘Fw#òÑ›/RÕA4 Aþ4«?¤©Ôg4µ¨|î¤éÂÿ¬üˆ~M ÈX>šÊÅΪ.Ú€bNÚ±x±·ÓŒUKõ7¨ÌNÎJÔOÛr¬Gë/µˆ tÕ nJëÖZlg+²sßfå÷Oè+ú‚¢ÙTðÀï4JŠOñ›{L±'‹üQØ-Ít‘ù\0Û‹¼¯ÀÊüúéÉͦ ¨Uš¿@EêÝCÖv}²¾kiºŽ;K¡ï¦´æä}TR ~ ý|Þ|ø¼~wEø"3ûÍ%ýƒ™˜/úl‰³½Èj1³xíÕ5{ÖŠ*í¿#–Ö½F߆¶îµ(ÊbCó¡´Aue¬æ;Wj•î¦‰ˆpàáD8Íg_"nþå)@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä âJ·ÿû¬›$IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/distance4.png0000644000000000000000000006677713051004444022016 00000000000000‰PNG  IHDRz Žå9¾sRGB®ÎébKGD™Ìÿâ~· pHYsÄÄ•+tIMEÛ 'dj¥ IDATxÚìuxW÷ÇÏÛÝ(!Ä=!@  @$¸K©Pª´Pw+oKݽPJ… E w'¸ $@„OvwôüþبüÚ¾ÐÞÏ“‡‡½{ÏÌ;ß9÷\C"ƒÁøëáX0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0W(Âÿ? "²ÛådzÒdü« ¢®]“‰YiüðOYï涉÷Vˆ/°eü{°×V‡™+§|ö +Š¿Ï»“‹û ñψ&ž(ãßCUiÙ©E¯°rø»åtMåx&7Œº¦[ ó÷ÀBÅ ƒÉ ƒÁ`rÃ`0.ÛnàR°¾$ãS^Q~êÔ)»Ý^D×õ„„Ö;Îä†Áø“ý˜¼¼¼¹s窪ZHÓ´ÜÜÜ#F°ÒarÃ`ü™º¡iš¦i G CØcÅä†Áøk`í¦ß 3 &7 ƒÉ ƒÁ`0¹a0Ln “V ƒÉ ƒÁ`rÃ`0Ln “ƒÁä†Á`0˜Ü0ŒlŠæ_KmñÑòÒr¨[o 9ÑâÑÚ¯ ˆH¤ß«ó^AmÛ€rþè^Ã- $Ìh´fŠ^Sp²¤u\OW®ìÜ¡l÷i¦æ¶k¬ n-/8Y[]C‚ÅË3¨«…3t‚FÓÊìsgJMÝ|½¥úƒºí\Ñ©Óu C!oötóðhe!­ÝÂ`rs5P´ý›¬õY–Vþ<n-/2Ð8ìÝuQ-Û»qÊõzð°÷~ò PÏ|5wQÕ˜gµœ*‹ÕY¯ßr*蛓{bÍ¡ ï?šðÖîN¾-˵{½þXE•]ç\L¼&+‡–ø ßvéHèýØô‡·çV¸ß1ö™»8r·—l\?å#¡uˆÄ“f+³ÖØxQôíùÔ k‡:Ä‘ÝM“›+$Î>|òwnœY3yÕŒ{Åm‹ @àÂÆ·•öOv’ßܲüèØÑt¼‡~šp ßª÷?½öÉûƒ±`݇95žƒÆ]Ú%íUìûù¥IÔö†ÁÜíèÆ!¨…GMΚv£ù?‹âC<  ÐËŽîϯLè=öÀÖŸË*&øxõRbȦ´ç熻 ²õÜîY[¾yz‘zË`0€é ƒÅn®| MÇŸ"ƒ_׉žÞjá¾”c;WÄ÷KIY»æå HWŤë×Ïþ˜}ð ‡Èé¹»çýè;è“@óåd‡¼-Ój0°÷{·vÕdPí@¦€ø[¦¤DÚ¶}ú¹,e9Ke=&öú;üµ²c9§xÜ$Ýqª2èdñOžÐ{Ümå»_;W`G¶Å ƒÉÍUèï‚ç7Ï«håäí›púìñs€€H¦ÈáýDíþò*ö}üPyÈøAâI¿ôO€ß½™ïðX÷†åžH·Cè Råü³%€œ¤Ÿ\òƒÇà'=Dï”í-˜¯HØBΈD~{ñ:åŸà˜sÃ`rsU2///G¶ÂmŸ”Wy‡§D"ÂÑ_6¸_çæÊñ¾];òvnåCÿ!Ÿ„ºï[þÚ3NT¥Œ}ˆ×‰.óÀ#pt¡²\wi‡[=ˆ`räyÕZjýø7‡Šƒ»÷ŠÖehÕý1÷Ê9Ž¨p‰œ‘sówª¬®f¡‹Ý\ÎŒ!çÍ{¤Ob×éo£¼À°n=s°4æµq‘ó¸=Ï{î¦kýyD"@÷Þ7Žÿîƒo}F~å¦i¿ê]<†¬^œŽH'ä9 ýàÒõ®QýÜD@Ý;ø†œ]ó}牷_JMÈPt^`û£2˜Ü\ ÞÉã±p: èæÒ±•—™ æ½QÃþÉÝ÷9ºÉÀdÛ»äààQ –¨®®ê÷¡qÁdüz¿^­CÜŠölÖ‡Œ½Nsˆ€C¹tŸ¦x¶ò“ µ8/ÿ”­ìð·÷­©‹*é\Õf+ÝæÚ’"ЊOV!ÝÚÏ Öžb0¹¹ÒÝÞ5¸So·F%mèÀÉdzv—wÿEß]ŒºÈIöW÷îÜ÷©2tª‰'@à püóë¢Fú'<4Êé3×Dš‰œÃp8¬:òól.ö¿A^P»{JIIðèsüêÚÐ"œþñ–»—gvnÝ\i9ŽfÍG±U@DS‹Ý\þBÙ±ÍvƒBâ:ËVRíàø‹î./(«úÕQu¼D ˆfçŸÀ#”61ÌÕºéÝÛÊÌ ¹"U^óÖÍ95áƒ' åõê}߯p離T;¨6°ªañý¢Oÿð‰Ía@0hÑ‚¼^²gÊ­ÛVˆ¹ó+o7 ¦5 æÝ\ᚬ)rÓM\E8µöSÝçž`?Žê‚2 DŽóyuó¬¨{“ º&Û.òntBÛ¶'“vÖIiVÿ±+‡ 1Ð/㵕»¾{%û«²Þµ äíß.½ÿÓ/´qj³ç.‡Œ®‰Fý(aÒÁ?ñF}Ý‹§ržá4ŠU÷ä8Ý&+¼wÛä¤{¿î×F×Ù¸bÆŸáéÿ)ûßõÐS¯I4™Y^ÔÈ!§Ä` ‡›%lúE‹?¾Ä CDGëéâï›fÐ " Ë¨©Ï—ÝË‹¨*-š?ùú¡ƒ4ÞÖN×õîÝ»2„•ónþv9où9mé0^ôE‹?¾ô“ïtYÇ™ ெd˜Ö0Xì†Á`0¹a0 &7 ƒÉ ƒÁ`rÃ`0Ln “ƒÁ`rÃ`0˜Ü0 &7 ƒÁäæŸi‘cýÒ´&S¢ˆHSë¦B£T—êæL‘¦BÓIRõ98L¨MÏà™hœCÃU4¾¨Ë™Ðõæ&ȨO@Ž¬ˆ­Ìä†ñç¢ÚÕœý( "hgO%çšMª"]Us È¡^tƨ©€f l5jÎ~@õ‚<£¦²Ùº5d­ÒòŽ¢€ é :$‘­V/Èc“Hk¶6€Ô9•H@).¹‰Sôs§@”ĉ@™;õÔòs@U„°vͶ”päfJí¯_(ä¼|9/ïf+^ p^FM˜,(™Ù2˜wó!`ßæA« Š‚¿a‹%D·¢3‹§m(‹Œkìz òŽµ(YÌ}FÙVÿä2d¬¡4¬É[–›Ò77aBûÚ%R—^FU…}Ó"sï›°/›%uìIµUÊÞMR·^ 6ñnCÛÒÄN=À0´Â3B@h“A/-æ[û‚¡²3Yš»?L}˜Ü\Õ¸)êÔóçË8õ/·¥™aôÍC kM}GõÈ>D^Jî*ˆmãlË2÷[¿Œr¨Þ…’ELHDMµo\fî9¸qeû"CŠŠ9yÇZS·¾Ð°8*»7ñ¾Áb‡Ž`€QY&oXaê9Èñ´;òQvoäCÚŠmã€@±[•¥¤Þ &ík—ðmø H> à ©¶‹º×7—CyÓr1&Y‰yÛeW–Ô¥'é 9È[–KÓøÀ0ÐòOêçÏñ>AN@H —£‹;ˆ€l3TESÅ1 䘫ÎSW3¨kb-HÖ¿þ¯8]7<¼l ¦9:`@Ù¹žª*¤ä>¤ á1b|7Û²P¨ÓšÛP4K‰=I'"ÂÚK±]웣ˆŸBÙ½ݽLÉ™@: ¡Ñ¼ˆmÅP×Od_»ÍnbLiDIñÝø€PûúŸ&x”·®àüCĶ ¤;¤p~ÁÊž ÎÚ7-#ãĘ$ •Ä˜$$yó²z¶Åßð¡ÑBh4éD˜ºõCž—w¬CÞi¶z®Ó…#ƒÈ !8 Ó/"‡D„€zùyÎÝ‹3» £dL4 ’íµ" ReVW™Ü0~'¢É”6Ô¾nŠ¨Ü¼(õÈp¼Ã{Zò!bB7ûÚ…(¢²k=©ªÐ.Áá‰8ž=®µ¿e[5ETvnÑ$vèäxì „ˆvb»ÎöÍKPBy×Z>0\LèÒØ„Ð6–Š³V¡„òÆ%\k_!8²>$„DÉ"oYÊë— á|pa},)¾ ×ÊGÙ¹%”7/;¥ ám'àXÄTìÜ3Y”}Y(¢mÕ\±}'ÞÛ¯Áß&€d»Q^Šˆzùytñ@Qrø}N‡Èd CU‘T‰¹6Ln¿7:mð~!bç´šÏ_5jª¤ä4PEvA'>¸­Sûí‡èê!%÷jãp Jdœ×Õ:÷ àx©c*éM€BdŒÖ¾fê«œÅ]ìZS‰ÑÐÝ«öûøðöbL—ÆÑe‡âH Ý8ß`ëœi¼_(ݱq?”ĘÐÝ[ÕL}…m'„´mÜÕå4Ñ1•ìÖÚ™ŸH]z aíš› ‚"€çµóç84[÷C9Rr& €lC^dZÃä†ñÇÚo Ÿ:"DwÔKÎÞ|t@Œ’±C¢^|K4"èçrÅèŽFŸhóK"5/[lßY+8Ђ àÀ(-ÛuÖÏœZP'‚QxFŒî¬—!ß<îÈP;“#¶ï¢ŸÉiXï½± £¢Tl› ŸÎi9~È)vÎÅT¡ÎÑ~†—\0žÁäæê™'Çý?Æ»r¼zô@4nJhß´ØÙvàç=8ê¡€œÔµc_9ÖuĆwl$];vÂÛÛ7.@N^DgøYÙ»…olê;TlŸ(ï\‹6~ŒQÙ¹ž÷•ºöÂV¾ÚÖõÀc3òº¥\k_±c º¸É;78Ý‹úx”³VHq©®ƒ†pÞþêíØ,@yËr1>EJéMŠ¬ìÙ \Ó«³V¡hâܽréçoÙ±wkSYM`‡V^~…;ù؉õRB(`áê6-^Á§øŸÜ¦^¨öúïæÎ{px(ÛðnÎñsv sæä—xMè¤{I!D @ë‘Ù˾™¢ˆþ­\”Z¡gûŠïmöÞÝ>ø€šîÏ‹’©pÁ{)Ayû­5²tÇçÀhœB«ZõÆK÷ïS+–AQBt{Ry´îydÆO¡wòÊ@‰ñIµs?G“ÙÔ½³i€HDæÌ5_Äû ‘‡5C]w®çŸà|ƒ‘Ø0bÖ˜úGe€ÎÍ>[Ô¦ß[®y~úø—ë{6¯äù‹jÊÌ´¯[ŠˆD€X>Åðsã[³F½»?WpûÔçxP€ÜwûlhÙGÒg< UžoR„’I$›¢’sØ^ÄIÉ,¥´ošÇ›8îÔhm’:§€¡¨  †£ Ù×ýlÎæQUQÞgèk51 ì'Á¶lŽ¥ßµòîMœ‹„‡cn£I Qq ™å]ëy‰çïàÂ"„¨8 2T H¡mð‚¼}­©[_y×qÅÕ‹ŠkÜê‹5•ò†å¦ƒä K„àHÍËM £>È"ŧ¨G÷+ûŠ‘Õ¶o:õàý‚bÃ:ˆº©w«wŠq)¶%³ÄØd>¨!6 *‰1IZþq­ Ÿ÷ VüÃÐÍÃQJι&‹!Û UæD“^~kÕyžUTÖ˜úGÈ Y‹JxŸ˜XÁºFP›¿÷”ÞrõF¡êˆ@©*¶Ê­=‚ l-ï(²vîT!<†ŒF}ÿbl't1…߈¡íyß`2š-WJbl2ðbíœO¥®Bh[lÜɇHBH4 ¼š½›G7ÆÑ™zÅ£²Ýzái>0µÝ>{ñ_äf—œØ±ë“æöŽlp ç Áúù¸Dï–{Á³c‚}åK§²•žÌÚôösŠ‡{ãJ¡æ zIUËãY8ÐÏŸB¢´â3Žñ/Í1@/©’]½Œ³'.!á Ãs¹€Íç(8LRm çÑŠj«Z¼ "UŽÙΪ(“›ÜrËÌä¨Ú5ïOXóítß~“»Þôžl]3å¹ñ"˜†Nš½ÝÈg¥œ+ß™°cóÉ´gD‡Z¨ñãB ù ûü{êÞOVòÐþcâÉóüZYêÆÿsZÎ~„°g¶–rúíñ+¿xOê?¥c\Ò¬@€*»7ræôa=8­ë5‘ü®õM\ùéÓ%î×›üž™ûæåÈñ¦î…ðv¶¥ß;b( QU•½›¸€ è—–F$µÊ~uìª~Œ˜ôc¨¿€€€<Ê—ð~!¦ôÁØÊËçB±ó¼¡>4 öå³xŸ`S÷œ›§}ýü‹MÈ[V ¡m :ò>ÊÁíظ ´­øQŒM6¥ŽWvmhœvƆìá¼ý…hÒíÜéÆÝÞÎØ°­Íν¶ZÖ/Îb7ÿÁ!Ã’8iF@ «@ä1ò,Ъ£KĸwP© ·è*Í—Ú"’‚2‡¼œéXDKWÁ g&Fy‰a«‘’3 ÚÞöYÔ BíÀ6©ƒÄ,茠(;·€Ù"Åw%xß ±Ûèø#a)÷LÈ@Þ²’÷òã“H#!´- ’צäAj-sÜ°O€ÒÖ^šë?nfìè<-/GòsJ+¤° Nûº|P¤C: ½ßzLÞ0úŽ!0zò_AÍÒ|»D!²=é$ÆuQ<ò-SÏ8­–À1nXìÐU/p!Cç#ÚêååòVg`ЄöóÅ„î¼_0$&tU÷o—·­4õèhs!‡êñƒBH4çîA Aú…"£¦’s÷t†ŠÚ4™“87O£ªœE‰ÕTæÝü¢7ˆ`h É )ÎW¼®€¦4j h šâLyñ[×12ÆñsMu,ì[7šÆÅMJq,p†JÐ&;¦Z×,04ÐTPvn!Å&ÅvuŽÄ#‚ÂùŽÝjV-ÒÐuPöfqn­Äø$Ð A‰þÁÕ rDj•ýÛ8ÿP16 Ž/nÑËã‹w›‡ÇùiãO'ô°¯]Æyzó‘±à0¡†·"ceÇœ&‚š5Ëùð!²½sä±FbT¼Îaíº•ŽÅhäk¤„nàãUœ}Vðh% ÆuE7Oeÿ6Çz7¶%³…¨8>0Bl€˜Øóh­fïvt~+Gö þaœ›‡3ºlïíOºfT;XzÅ0™Qâ8^À³'ón¿KÕ$Sã)Ž…¦01Ͷf.ï„.®R—´ÆKÃA¼Oišuá—œ§7ï$ÆumXHرØUÛxÎÅݶö'ÎÝ‹÷ Â;NÃg&ËËk^®xzÄd¹Åÿ*>´Ú¶ñú5¤“Ö öj6¨ªÛUoß0ò‘ˆ¤Î=Õ‡å¬e¤Èbl²²ë¥Ä_rÝRA ‘”ÐMË=¢Øj\(’ºôröy×›PIŒëªÚ)oY¦ç[2Æ8bà &xOo£¦Ò¨ª ÅeÏ IDATÎyz;bà Š-yüÆïѧëÓtð>çíÃY\ÕÛÄö‰Íºxœ}Û¡aœ—¯^|VìܵùŽáÿAaT[m” ÑêÍâ<Û]÷΄/wÜõõŽë?þÆ×LÚÙ“|h[2šO ¡},¨*!D·oÑ„§9ÈñÁ!†LÝ^Úwï÷›;wŒ0¨®;,*F;•M²•÷ hÑ„Ø%E/<Í{ûq>>-ìÄ@„nž†­-.(ŠŸ«?Ln¿=8¥¢šÜ0V·~ýšÝ›ÑÕÃ2r‚}Ý<ÇæsÍGÞ²š÷ò5gŽ±-žÙ‚Šq¨ìÍ’ÓÅ„TÛ♈è0¤l%Å5Ë— Qñ¦ôaòö5Íf8Nþl®ÛUŒïf_¿´…æ!òæåæ×s¾AöuKQ³RK†ŽÑÇÈ£mÙ,Sê@¡]gåÐΖLÖŸ¾2÷É{ªG¶Ø5ªÊyŸ@à…úUŠÎ€mªÉä†ñ[)+ÏéÑ{Óás&¡„ʾ,4Y¤.iœ»—“l[:³~%*"ì[Wpî^bçn¼o ˜Ðݾü‡úÕóóØåMKÑlB£…°¶bBwû†…(62aByË >8RˆŽçýBxß û:çºèõ&äõó…¶ Bd{!¢½àj[7¯™ ÛÊ9|p$ïí/%$óaòŽÕhª3€Ø×Η:vçýCĶñÈqòö5MLp`_9˔ҟó ;¦p7-ÿD#! 2j*9wäxÎìB¤Øm ƒH@l½»¹Ê]C´ÕxžÉå´¿|ç—*û ŒJ*óÙµÖ””áhð(»²ÈV#uîéèÓáÂ$ž·¯[`ê=ÊéøìÛÆ»{‰ ÉŽu„àHMò楦´¡@Ù¿ó cI'ÔAŠ$[­}åsæhçŽ+ë—s­…ˆЉ„È CÎZmêÞß¹p_Ö*!"Vˆìà˜g!´OA÷l4%õvÄzåíkÄØd!8’ B Ä襦RÞ¼Ú9óÀ¶l®Ï„;zàÄØdeÿVeß6©cª£¥d[3OJìÅû;Lð!zÑY½¤€÷ tÎQ¨©â\Ü°nÂ''™ »;Jf"0ŒÊr®UkVa™Ü\Års§ïÞÍ|ÁÖ1+ôA]0IÓ­Ë¿w½æyû4Y¤Äžõ±a"â}ƒÑd¶¯žcz½}íb¾µŸŸR&ƒxß 24ë¯\FO·®æB…°ö–­ 1:]Ül+g»ŒºÞ¾f™͇E;÷8pLzŠŒCWû–¥æŒ¡¶Eß‹1ÉŽè²3„ð0ȶzŽeàuöÕóÅø®¼oHýšd”˜¦?hß´Ä2p˜uá)1÷ tĆ&¤N=´Ü#Ê/›¥ätëœiæCâÎtâ}ƒõógµüBh[ý|!×ÚyÞ¯A$ÎìbÈ6ª­æÜÝõÒ \+¾arsUÇn‰~\øËßc«°2×XKˆ(J–7Ú–ÎC÷VR—´fû(çÙFŒI²þ8UŒé"vJi¼e¸3r]3¬ ¿B£›íçíèW‚#@‘k¾xWêÒ›‹†‹öràýBŒòëìÏ¥ÄÞBTg·zcѱ¤kÖŸ¿c“y¿‹MˆíH±×L{×”6¬^kr0HˆˆQvm°ÎýÂÜs(ÜdA/Ç9øëgÔ#{ùÐv͸q'g²Z•^zólÃBÅLnþzƒ’õo2%ÚkFòó¼9s É6Л/"åìúµ¸˜z ]k,žvà,næƒ Ù üAÐìjÊ DÍ÷óv "ÎÓÛœ>ŒÁ¸¸T à<½Í=ƒ®]ÊïéÍeŒBAlÙ„Aœ_)´-JæK™@WwÁà D  %Dhqã\…ˆ™Ü0þ?*‡€fj±…@Ä· ¬ .µ°¨c9qàð’ xÿGÖ-'@t,duÉñ¾AõÙA‹ ‚# ~ðÅ&„Ðhp®xs‰«p÷ºœ Çw¬Åä†ñÿUœFÿ^¬FÍœ\çyÙtéZÌíR/•€.›À¯$øU—)"Æ• ëg0Ln “ƒÁ`rÃ`0˜Ü0 &7¬ “ƒÁä†Á`0˜Ü0Œ+–?mT1'-lÂF}þÆÒãEàxžû7äß3’Ÿœ«h!4[$útבÕðÿÜX«ÊVN{žšä&Ëv]g‹ý&j¤R-XÛúó´µk¿TñÆ¿a‡l"W//¿^ìÖªêÒ"M‘ ]Ó5õµ§l«Uì6V{ÿV¹!¢éS?>xà@·qÉ’%ùùùlq€ßB¹Xŵjƒ¥Šßû[ ÇŽµT[aœõv‰Ñº­¯”oˆ÷AXñިܷ÷û1`Ø¿|ᱶð ‹6.œÊW|îêXóÑç_ýB5U¿ÿÔSI·?{‡çÁÛžx« V ós9~älXÿÛf¾v@Õ‘¡C& è?f.1­÷g­!ŸAŸÏx¾ ‚|xÖÍM=kxúPé.ä¡?¿®ƒ;€ñÕËþ°æ—Àv±•¹Çuÿ˜·?|?ÖÛÄç/ºÿŒÿ=‹š_1/:ºè~ѧôë;öU;Ùù¬Wç„!¬%¢%o ìvÛ"²žß?¸[ÇïO8tdÁ ×?>Ï ÒO~Ö¥ãM…DD´dÚã·ÜùšÍ‘¾mXl»Gt"¢ªÃ™}ÒûN|×ùMΪ´´î öV’½äŽéw¾ö³ãø–ÏníØã¡b¢ó›_IN¶Æ‘)ÉS'ôI{hfù2þTXì†ñ7‚P¼Û™¸{0€©Ó]};ˆÍŠ¼I2‰;Vlt|ì0òÅ™oŽF»¬2 ¾ãÍ_2#¸› Ý„7¾¾©ëE1¶&“›(<Çoº}Ó?) xég54ÊOý%+âà ¡äøÑJHj’B©ÈÛzÂÔ'9\ƒGÜñlÔ¨‘ã¾= †ºÝpéìÉbË qÝœ?ÈŸµý¼{9qÐÝ<#]Ý´c»‹† ñ#ÀêümO<óù¤éß L1=¼úÜÔÕyÒzyA¥)°µ «“,vÃø B4—ÒKúˆô¼o^²íàÑÃû¾zü&ÏfÎHMÑ®'o¹îÓeÛË9väàÏ?þÄÇô‹æwñ6©çÖo;r´È§S4¬˜6ûxî©ýY‹n}j_ÛöîEÛ·æWÚ/%€¢OÄè¤vó¦ügÃîÙv|üÂSyn™ÌÐý±ÉÙ=þäÞûŸ½é†Û¦]÷ÁWo¯|ÿöWÞx+)üãᢦi†ÑàhÕ}4ßñÞQ3^yõ¡»+Éœ>öùŒÀ§×¼Ÿ§O~ᵉßƒÉ³ß /.¿sçÄnØŸÿÙ€pÆßÜÔjéI®;ê¨ûG„¿¡·ˆêº”ù5úØB¶-´ûˆuK1¹a0W7,vÃ`0˜Ü0 &7 ƒÁä†Á`0¹a0LnX0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0Ln ÆŸ 5ûÕi¼ù³ 9“ã* À¤£F2Éu»U(Dé†NWÌ~ l'ãêönÈ B žãêv­QIç[Ø Ï]»Ù0ï†Á¸Ê½B]E®–½¾ŪWÈÎYlMãªÖÒ9Ñ@‘C'^&ŽâH¿BN–y7 ÆUݘ"2ôÂÓ¯ †à#Ä)6Q›mÂÎä†Á`üç ÁÈÞ.©‡mõòFm&ĬMÖ_Ã.ê<]±b&7 ÆUíÝhŸÓ¦²@ÿú;#ˆ ú¾•w?°ÍVñ Q›«Gnê{ÐþPO5äÒäçzUYY¥MÑ•š²Ò í29ÛË ¸ü·Ÿ«µº²¼²št{Ù…2»q¥ŽóWtQ/%)åJk5ª­®¨¨¬!kuyy•Üü÷jí…²Jý7ڮϳª¢¢ªö·Ÿ°­¦¼ÌaÚÐËËËjíúﾜ¿[H«©¬(++«¨¬V?|ƒ~¹¨õVÖóÕ0Ð0d4.‡J†åg¸RZSWÜ bÞ÷}¿!ç ! Ô­%OÜÿF6pþ®Þ™þ°óì†Wûö¾éØej G‚ÿõ¿Ùž1åÑ ×Üû’Z0«O—AËËþŽÂ¹°ôµ×¾ÜüÇ Qÿ‰góñ¢áêöá‰=?>"ôèãï{[øæÅ‘cž^ß<ƒCw0©HùmÚž54±çÔå­û®¿å‘µß|šsß3ü‘U5¹Ãûww~Þ¥/ÇøðÉÿ´p9ëÛÀ¨xï¾Ûö|ÃÍ7õ8äÎg?ÒðÏ~ìBâÒ·/Þ2U¿ò.p&8Ûo˜(€d$µ!îJé™úä†Zzû´ðê!jù}T|Ùü¥V½Å<áyÖßÃzr×îSØÜxç«I~¼ÖcB”ŸŸ«ÐÒ;À‘šA/å1]tœ»ÿ¥‰þš@×ßvM'o—Ü˵4 ÔyøÒoó+w\¨½äk.W8g7­?BM¯†@êqÏÝýý<ÅGŸï€‘çš_ÇK¢Ðò³ÝÔ(€%íÎÛ2|×ÜùÔ®s5ˆ€ˆŸ<Þ\úñ¨½úôüÊÌ­ˆˆˆŸÜ˜2«ç½y÷ kï(SlÅ_¼xßÀÌÞ}Œzsö.ªËsÓ'c2ßT|`Áø¡ééýyg®FP¼ü£ôÑOé‘=z>»³ÑþÎð”áom€œù?wŠ‰©>®¦ã¨pdz·é+hï’~1ðÃþ†ú”oƒÞ ºÀè§ÁŽDØô „·ÉF<V„skV@ÇQ&Á~¢Ì³» Ø_–8úÃÍ^¸DHZÍwo<<(#=sèøﶜBD BÄ’=?M;¸wï>Ão¼où"çáŠì!ý{ÏÝynÁ[ôËèÝèøÙû+qÑ]©ïï-Ý¿ôµ>ƒU#"j;žŸt]Ÿ>CÆÞ9W "bþ‚ ]'Ì´o4v@ZzÆ„§?)—¡:{Mߌ[/˜KnîÕûÞ…GµonÊìûÄwˆ@Gsj††ð‡—möì5VlêOé§ç HL}o{5WM¹s»eŒ>Yxâõ»Çôé“1îÑO+.ùxÔ€^®™µ;Œ£§õ¡AphñÆÖé£y„ã Þï5pdv‰Ú¼hPßñíäaýûô|ÿTŠ|Ý÷Õyc†öþàçrkfFFFÿ¡O½7»ZÚcëûgÞ\b*½¥wï{FD¤ê¯>8°OïÞ½ûß;ù«jBDÄšÓ× é5}ýÙ¥<: ³W¿Á×·«¤¾fZúÉuƒ3Ó3‡<õÑ|›@D„Pyò½Ç'ôËìÓè S–D"Äœ¥Súô´·PÃ& Y?Ìôórª¸u™xw¯=|TP[¸gd[kðÏDlQëa€á¥UÒÎÝ0åsA¶ë”¦¤¡_k0„+$vãôþBô÷ôëvËË_nÌÚºlæÝ»tŸ²& cÕ§'÷üÃòMûöí^8ý¥”¤Œ™íDôÉÓƒÒGÜùúôE9¹§m341þÅõUDt!{åð´´ç>›,'—Œ3ê6æ©Ï¶ìÚ»}ý }’o~cžÃZÖôkS‡ÜüÌë_>‘{|ÿª[zÄß5+¬åëg>–œtã†#Çó«5"yös÷<7û0‘^z¾T%Rl•5úèÕ´j5}ö$ÐÒ#DDs2}(*•f-¢yÓɨßdçÎ~‚€£¾£Es©¯7ù &¢ª²R«N¤Ö”WÛˆˆH™ùŸIÿªiÑDÅ/Ží=úÑwÖnÞºvÑŒÁ©IOÏØo\únrbç®Þ»oïêÙï÷NLygS9QÕÑþiCÆÜûÍÊ]¹y¹Ë§¿Ò¥Ï–ª8±óö™žøìС£V*N­ê—ØùÉÏìÞ»wÝüÏvIzK1.¿3)sìƒO¼»÷èÉSG²êŸxÝ{›H·\ùrRÇáËçä•Ùˆ´•¯?úØÔÕDD†­¬¢†È¨(+“‰ˆhê“ýï_iYÏmÒñÅ9ûˆHÿå­Ýo<'ëtv^b×´ën{ví/ÇOÞ>aX·¾7<üâôE'òNgÍy®sÇQ{d"ÝVVYKdT”:ó<»å§.¯BmZ2´gÞ I]ú}µlËÞÝ[§>uÛ€¡é½'-!"ª:5¬_÷·çåJÙÝ“ožüÝÖ»wlYýÚ}ÒîûÞ ùЪW“;[v('¯ÌJúù'‡& ºó¿¶îعmãK“†§]ûrÕæ”>pô=Ó—m?•—·ö‡×»wî¹"W#C[òÖ]Ý3¯ÿiņ¬ËŸ—:ð*YOërË+3¶ïÙ›µræuÝ:=úívǹæïXôУOå”jMΞòoMìôêÞÊú#'6|Ö#s_Ù.ä<ûÐ=‹[ÿ´GÌ04¢Š¯¿µ¨œX3|X1g²qp**´“42'õ¿æ/—›“Ó&& }ÀFD†A¤|÷܃ÏO_JZÅÄ wžCD†a®>3aà ÷MQ‰>}fp¿aU:’½~OúˆÇÖD$Ÿº6=탅¿Ññ)·Æ yØ^oãèñ¯Íшˆ¶~y]JÊMyu?_öæ ”q?QÁÖW“’&9ïNýmºèî£e»‰ˆtˆ(hâL§ÜP^]²]÷x£ÂDݱ¹î‹“H¹Z³Úp)‹ç—¿Ó¹ÏÈåªãœVñÊC“§ÉD¯]?ä¿;ëÓûòØÌ!ÿ©"¢êcý3Óž˜¶ÊùMÉžÞé=¾^—OZÕÃcû=ðú"G¶óïKé~ÿâz+¿ü8±KÆ‹ÕDE+&%Äß«;Ÿˆœï®òžF¤ü<)~ìñ‹ çâêÒN?Ô/þöÏö8_(õrsnAç.éßî/räÿõ³wöuK™L‘.ŒOmÿÖ•¦Oiç·FÅ~õ—ºã5Oôk*7yjUöÈäįrtç´ªüÂrƒHÏý")~LŽã¨R³׶³¥62 ]7Š6ÿÐ#=}G‘NÖü‘ƒÓï{¾³$+Ž ÌLýpá)­¶`\fÇ;ìÖnºëöG*´çåA ×½Sr5ÛŸKžTÐô¬›œ¿±H‡”oNÖ4Ô¬ísÒz¦n*¤K\ï2¨¦V&R‹]=UŽ«äx»ˆV+o¯’ªi†¦«teðW*V7ì) ïd""@ ñ¦—?½zW~!Žî àð1¾MÀÎÂã&õp@$Ì(5ߧ²z{…—…¾6œœš6Ú™õgŒèÈ0{ÖýÜäfAµZkXmh4oûw†sÏ@»ëÁ.tªïˆéau=±×|Ç:ãS?ÇÈÞ[÷ÿÌ4³¸ïH¡‡‡‡§‹àhZ÷»óÙ~'9N)ÿéTªÁ ŠòK™ Ü€Œÿ0p\ $"¢¦*M¯¯dín¥uÏÃ_O/P à* M¦ª­ÇdÐ}Û×5 Í­\8¥V~KáÔ6ôê'︽$é¿3îéÒä2æHO‹£˜L‚`1ùHŽˆg–xP­Í¬AãŸ7Í(ÿ`—øL[@@×½wV7¹[‚kd¯N~S&Ø’Øuèð‘#3:û7‹‰ˆ®£-¯½øàþ³eªnŠÔ½D†ÐÖY’‚€ˆš¦ª5ù%¥üˆ®¾Ž›èâŸ>õ«t€Ú—³j½ýÏ}5}šf’B­ì‡¶–À5>—:ǵá壼N°ÉEâì ¸Ý~›>õC“Áñ¼¦q·ÝÊë! ñWH[ꯖªQ Á$4ÄÐ]7²j.¦úbG‹È«º•…w45ñ·…jUâU{ÞéÓõ%ž6¼Ÿ_?W¤éÏO¼ßÝo¾qàå#bÎYðh8Î € ÀÌ5\àï1kS5E›ýV¶k¼«Å¡ H&Q$²iugr—5£Ôª_]œ›Wåˆ"¶ê;0Õb8#® w!q&û¾×òCÎ\Z`¿&ÔÜRÇ Äi€s|øý¡J¹VáÝL\ýÉ fª›ŸÌ£Ó—¤-ù~É–}sÞô…é¾÷§ÝÓ/ºñU‹÷Œ2É3㦞îççéR}`åïÏnøšk(IG±.k†h›)¡^£€`«ÌÍ;m8¯û ëÓê2caÐÛ×l?W©Õ©µÕ¹x¸þÙs%‰‘€0„ØöăHdh|q·Ô ¾ý5 tó¿Fn„¾Òì¢J€']•U$É×ËÅzúœ A"g+j=ÌA¼ãÁû•Ê)tð»Å½úê —ïåùý\€'×Á óáÉÑP %¾ÔÎÔ×%°æø@( À¡2èäM¶Z]à·ÅæB[»Û”³v…P@@24MÑÉlò ö”OæUCŒ!`IE©Àùºš÷«x·o£þ’vçä[b›}Qü'TnÅóè_]÷Þ¸nãîûnã—·üeÈÓßC>sÞ`qyy^9¸^œŒOzkס· bÞŠg¯yä™Ìƒ?5Ö›c{·WZZ¿öÂ#<ŽŸä/×;Noö÷0×ähà+!¡ÈŠÉì¿´í÷ò‹ã.îG¼Ø D€ q´xÃiHLpÄþÏžÞm˜»†»ÿÙ=Òˆ@ r`­lúמª¨i`|7à d6@DNçá Ñ›¿ºgŠË¼1ݾ{Ǭ#6@¨zhtŸÛ'ÏâÌÚíœñ¹óî(§¶>ÑýZñ×t\àßÑ·fëÆYG¬N‘Èú|£Ö\þ>"‚j­pgœÍÞ—}¶ê¢D&0ÛœŸ¦? 5Õõ£q²á½κôâÓ õƒ0h7†Ã³·;ßYÛ_7(ºøLŒüÃ{Ô6“ÇÄÝ0¿pÖŽ|Ç2ïÝ?bÐÍoÚÁ'53öð´·«œU÷š•k={Üá'þJ…®;Þ¥æÁ·¤üòíÃuÖ²¾ùÏ}o¯»láp ÙÕºœŠs8uþR$ºùˆ÷¼û™ë¡^™½çÿ_Eì¥çöí?lU›½-|»¦úeOV òáo~>¤5½Ÿ‚-oá-ãŸË­k÷y† †ã^kvG Ó$HºÓ1Ts¿þf '\¢²’{Dxï–ï¾v”ýÉÅÿíÜùº†0âî~çÍ\u®® nù[w<û½Šˆˆ¶òÂ}¿¬i2술çø‹çýwûyD(ß5}Ú¶ÔGðÐ嚃ûöUÿ9Ó&6“Á½îm[ IDATó~iï.4]0 ô‹¯] Îø7È ï}uRû/'ö~݃{eÓâžyz< øâKrÇæeŽ¹õч&e¦Ý^ÓéÁw&Æ#€aèG PýGɯg°ëÌ7»iÒÃ%mï}íî¸éû\{Û=“n=êÙŸ"»¤¸‘¡F£0tÀ=¤G ç±ëú|è‡SÊWw_wÏ—û.:_w˜q|>º€øÙ¦÷‡¥á‘À*Cëá°´7$õ‚¸ ˜ZŸOv.öÖ÷ ìÁÚ…@êËpßT¾ØÓR¾¸çš‡¾;Þü%:lúóiËŸ¿¦ß¨q#ú$-Êñzá³çÍãz!Lß7bèµzÔkîÏ <©Jˆú§è!Â•Ò þ—/¯EDˆ —•œ¯¶Ê(˜¼ýü]EtD5[Õù åÿ×ÞyFU¬}|ælKOHHB("B¨J/7tÁ‚ô&¡ŠÀµxAD» HI€ôBI(" Nz!´PÒ{²}Oçýp6Ëf³Ñ{¯r_Ôù}ÝÌ™çœÙ™ÿ™yž)¼„T®þ~* 㺪"£äÓº…§\Dµ•…fðmè"¬¶¤B —–-• h«+õ&– ÆÍÓ×ß×Cî²Z´%&÷¶­|äËMu%Õf÷GZù` 5¥Vrók੨)*0»¶±Ÿg#T|éY¤ñDmÛ lA· Úyó¨Fk†nßCBÞþ¨¥Ÿ5=ˆբ¢ $òðEmœ8PºõCÄê‚!I‹o\:úšJ­ÁŒª™ —«0ÆÀ+*kY‘(5nÍýý]”aŠŠË<|ƒšy¨BHâ Kʽü‚|ÜÕˆ7—ÕHXز•‹#‰­ª¬6q"V¨¼}›û¸kB¢©¼¨VÙ¶Msù%#ËŠëTòG}uiIP{5sÑ–ê”>m½ÿœÚÊBøµ t@K…¼k‹Ö^ìÝrö‘G‚”’ñ^±6°U+WƒÒW—ëxE« #©¼°@ÐÎÏÕ±d_½yÎÌÑ[wm®ppIX´UÕ:ÁJß­SY ëÑ&È ¾¸¤Ìͧ¥¯§ ‰lUU™3®>~^r5ÐW—Õ™xµW@P3WÑ\WV­—{ùµðõP*KªM¢o«VÆŠï~^ù&ŠJÊÜ}ZøzjB¼©®²F/vójÐÌä 6H¬­ª4˜yÄ(ܽýš{»É¿o¬+«5¶lãÒ`-W¡º¼Òȉ*»@s5ƒ!$Yö/X>ïв¾.¿w~–«®}}‰Ëöí®DSÓ§¿{ÚE@`ˆj>e.QÀH Š‡Atèn~ÿ#~ܲ¬`Ô' ;{Тp¤üôø÷Ç}¿ÕWñð¼†ä˜­ }îõ×¾ÝÝÛå÷=/ ‚‘¯vqõÇ Hâº÷7_¯·^G˜1î}ú'$ ``˜‡¡l©Üüê—ürÄ9í÷üÝ ÇZ"“¢ùãžI@”Öe§húöSªTÚÑÃý“¥ÚÏÛ+- úU”JÍü‰J©ú{¸Š)H^@`sXS]ø«¢ù£žÁÖ<ø:£ B‚ ¨ÍÅH)úº¸¯zW‰ÀႹóŒ’îayzÚ»¡Pþ„½$$a„a8Œj+ËÛ>ʨ=Œ•œXÁKwî){õæ1Ë€ §äºt|ê‡AÎiï†Bù3ö’C"HT#©Es¿Äxß“{‚JP!µkûÇo· TXŠã˜›9€Õt{- …ò;[/Œ å¤I¤ß%  B@P§„Ý‚@ܼ†™‡ç†)ÊŸp0E©b€ATI®"#IŒ’A’X©wØ—GD|hîšÊ …ò§LÉ‹÷0F Æ £À)0à Œ1vQjŒT T¥ªÿ ëRćᮩ«˜BùvnêçµnHŠ¼:ÔÏ"&fVºwuê!Ù_‹Ê …ò—$ëêQyç—‡ä˜p*7 åõÝP(*7 …Ê …B¡P¹¡P(Tn( •Z …Ê …B¡rC¡P(Tn( • …Bå†B¡P¨ÜP(*7 …Bå†B¡P¹¡P(Tn( …Ê …B¡rC¡P(Tn( • …Bå†B¡P¨ÜP(*7 …Bå†B¡P¹¡P(k”.k$ÊKH"@aÔŸn ’„ ûÔ@V(ê?V0õG!#0SŸà~z»0ÃÜÏÌÜO„ ôk9!¡û9Ü·h³@0Âãû9X-Úå€Æõ9¨aD£ú@FH¡`Ô d=_Ó:I¡róŸƒ12ñèÇ;¨¹rS¢Ê¼ž­Zi¼½_º¬tqµKŒknÝõ~¤B£Á•¦¦vïÎ(íÔ3U99>íÚ©ÜÝjTššÐ-3 ä­<+Û¿sg…« ƨøÂå >½Uî^õâ „0¨4%µeïÞ ºw˜)OKîƨTŒ •¥föèÑ@@ *KO êÕ+HiJJPŸ'±¢A•ÙÙ-zv'I*ÏÌêÓ§¡ãÒ´´ >}0ƘAÙWƒƒy UQï ÔÖ‡*å/ <ȯ…³ ˆÖïàúþ$Cá½›‡˜JK_’§Í¿ymß^sE™íªû òöîÑÝ»“WŸqÈäêžDsyYÞ¾=¼¶ÖÉ}qlVt¤¾à^nBœhÐ9»u1'>ÎX\˜Ékkå p¹‰ lUåÕÄxb1;¹Þ¨ÏŠŠ0æÆÇ‚À9±`1çÆÇŠ ²¢"$³Éf"§.…ò= | d”Ý—IÎñEyVBœ^xaÃ}qqã¶gÖ­3UU5•@°Xά__w÷8³~½E«m*BÈ©÷Þ,g2JÀ¢Õžþà§÷`{ÌSk׊×” Þd:ýÁD’.¬0À/Ž…F¡P¹ùþÍÞÄûmMþ_V\œ¡¼üÆ‘#²8´CIÓ""ô%%×Ò5RùY ÆŠŠìÄĺ{÷œ6æŒèhKmmnR’,,–Ô;L••9{÷ÊŠÓ8MV\œ¹º:=2ÒTUÕXM–ÍŒeµÚ¬øxÎhl|¹E«MÛµËT]/+Ž¼É”˜hª®Nݱƒ3l&ä¯V‚ž¥Õ’BåæßÆÄÃékF{9 ’”˜h(/—?¦GEi \MNfõz[}I‰œ€B$žOˆ°I@öîݦêjûDžOˆ°ånª¬tH/ ‚l.%<Ü\[k3!÷ŒRÂÂx£Qþ˜ë (¼É”fí¶ˆbJX˜Íœ5Ùœk•6–½²}»œƒÍ«Ó¥lß. ‚Í„À²öŠ¬Õ™¯UJ´^R¨Üü»è88vòFík¶VteëVYk¬IÊÞ½Û~È“¶k—ÃçÚ¡C²ÈdÄÄØš®Ü|3ccõeeÖÆ,I¿úÊ>IÒví² y$Q¼²}»`6Ûš²m­2¢¢Dž·¿ÉÔ;X½^ e/mÚÄÛå ²ìå-[8£ÑšÀbI e9“ïA3¢£ï²D136VCYsà¸+Û·‹g¦ Ûu¡ˆ¥(Tnþm´r¹n:X}ã\MN¶õkìÉ;p@[P 7{cEEƒÎ!D’²êîÝ#’”g¨Wû¾@Ξ=Ú¢"Y¼X×oΞ=¦ª*yÄ 9ˆ<Ÿ-'ȈŠbµÚÃ7B€ÌØXsMÀ²Ù G’(f'$pF#«ÓeÆÆÊjeŸg4¦GFrƒE«ÍˆŠ,‡š`±dÆÄpF£E«ÍNL4q„:Œ)U0üáÑ.‹®UCÿÖ8oÿþºÛ·{ÌëØ8"†1NÛ¹éªruuš wï^Þdê:eŠÆËKþÆ!Yv|¼®¸¸ï’%jOO‡¿Êvyóf¥‹KŸE‹ì'È؛Ȍ‰‘¡çܹŒR‰E¡Óví²TW÷óM…ZÝØHÒÅ]||ú,Zä<ðGHft4F¨ç‚rÈ¿q²ÔðpÞhìÿÆa2Ëñ€64dJ¡³ŠÿCD–õjÝÚRSckü §±F©t 4WV:Ÿ·ƒÂØ£E Álþ•0¾WP«ÓaìD: Ï«ÜÝ]}}-uuÎ,`„ÒÅÅÍÏOâ8§B ñ¼R£qó÷L&§· X,®Íš©ÜÜœÞ$Ƙˆ¢‹··ÚÓ$É© N§sñòÒxyIGk$…λùOSp©òöí•G@yû÷늊I’$]Ý¿_ö¶dÄÄh í½*Vßpd¤< KŒ´yŽïçÀóÑÑò*{÷nc£È´ÈqÙ Ï˾!ûе5 m±¤†…qƒ$Š)áá暇x³9mçNy eŽ9÷ ‹¢ìèi0“}Ãaa"ÇñfsJX˜Ã€,uui;wÊ·¬¸8½ÁBSê»ùÏ\ҧKﳯ&%ÕÞ¾m£Iˆ°y[ˆ$eÅÇ˱íûŽÛèhûÀPÞ¶Ð5!„ˆâ…ïksÉ®Ÿ”°0ÛôIRÂÂä`–ôˆ›·…bº–}Ã6l}Ãò7©;vpõq+BˆÈ²©áá’hÈ(°ìÅM›x“ɦ&’$eFGÛæ×H¢˜e¯G¬V{yËÛ=H<aWôù™¢P¹ù·©3KgoÞóyT_¿.·üì„×/äoä¶zŽwïÖÉþ׌˜9½‰œ½{ÍÕÕ p\Ft´ÅÎ7L9.#&F–$«oØ.n%kœ-«ÕfÆÄ Ç’ d'&Ê*ÉêtÑÑ‚Ùlo‚3m2Êjµ9»wÛÄHNfbÅs÷DZ/)TnþƒÁÔÅ¢†_É}œädSe¥ìýÇ¿H ×¥GDXêêlý û11ÆÊÊK_ÍêtNgôfÅűz}FLLã9»r†7m2UW§lß.°¬Ó)¿©;v˜kk/lØÐ8LZD„`±¤GF6þ!D„ 6˜kkSˆ$56! •íÛÍ557n”DÑ!™ÿ[Ê ò&½‘ýýAx"Xô“ôßÎŒ¶˜ F³ð§˜ °F½‘û½Å% ƒž—œÔ%“Ñ`fE[™4•ÃLÑ áŒz#'<ÜrSß;øåã ~ùš^apjíÚÒ´4§ !ÏÿøöÛuwî8/uBx“éôûïWää4e‚œxç§9È°zý+VÈ~§&LUU§Ö®Õ;¢ ÎhüiÅ ‡›=ú’’ŸV®t:çøÿQnn&Íx|ägÜïo„WÖ>Úgf…ø_ÖýöÿÖ©?…ÜüòÅàV£wþÎLôw/ ëÕí›ÒF•×ÏŸÐçå éðÞì.ƒ^9ÑDó¸°mÅå2ãÿæ©c&v}å¿»öE¦#„8ă¯}óMß%KLUUú¢"û@BD3cbž\¼¸òêU‡Öd’”³wïà•+ïž:¥/)qˆvaŒ‰ \ÿæ›Á«VUæ䘪ªL „–Mß±cÐ;ïÜ=uÊ\Sã4”–—œ;>~èš5׿ù†7›`uºüãLJ¬Z•-'p¸ÉÿIxÀY$P¡RÛ/ GÖŸÐIê&oBˆQj4ªéêCN³qøZ©R«”LSÑodè4YS—;ÿl½À¾r6a}Èò³Å?,DMüjÐTAÛçH¥v×h|¼]c¬T©UJ }Ÿw.l„ÓÇC!ÄM:§'L¥ÒÄ#Ü¿h¢Ìœÿîþ~nžš‡(2Ug¹arEEÙ7W“’´=eDEY7’”-»iø†7l°ÔÕÉßä&%9øn!)áá6oKfl¬Ã*HÛµKöËJ‚pyëVsuµ½cE`Ùó_|a›7ì0mOž˜.ÕÓRwìàí\3Ö;Œ”ÇqË^ظÑÞsLauºK›6YïAÓ""ÁhÎÝ}°¾ùv~IütâØá!c'}¹ï¼üý­s‚Ç}US™þê´§CBF-þ0Ö,Ö—žöæ†åóG1î…9Ñ?ß©Ï„@ù•= & õôÒõ1µ€ºîñ¡" ÖΚ0ùõ¯ä"+½’¼hʸ‘³—­»­åÁÚ=Ïì\=~̈§_˜ô–å‹¥C'¬<Óx”k.Í^ûê¬Ñ#†7åó}iVgYNX¿q‹ªŠOÏ?xöæ¼.ñ³åÏŒ>jÌ '\°=±h*Ýôα#†õÜê°ïE[ÇÀŽ-oŒšôÞý÷ö—ËFÍXŸ.ÿŸ/9÷ΩÇýìôÍ/Ë_^‰˜>hî^(=òJÿñlMÊ’iO6ò¥m«å¬ƒœòÌcó&Ž ÷ɾ+\ÎgýÆüË!ºÉUä†<9òŠI¾îÛ oŒ5â™éËNßÓ-ž:`éæ ØôÖ˜iï]ê?_þ̘‘#GyyÕ×wM@ˆáµ ƒ‡ ôáç®Þ*?ï¹ø'?=zøðQ³—­»]ÇÉOúõ[cælº–stËı!#F<ûÙþ”úZðCÄF>nêÖ#é¶V#–\Zóòô#F>7ãÕcY•ò ÿüÖ ·ä=\‘©ï~¾Y“wêdÅÇëKKí#Syû÷Ëžcë¨FÎãkê mõ-;1±AdJ’röì±Å׋%#*J#Û2«ìÄDÙs ¢ dÆÄ8,ËÌÙ»×6h’£æ¶H–ì9ÎŒ‹³­«bu:yZ°Í„$ÑÑæšùž9ƒ!36Ö^€dϱÍQÅêt¾aÎ`Ȉ‰±¿ åå) {Ï<Б0Ç¿5qè ¯8~òı½óÇ<9ë““pë@hßÑs—-]ñíO§O‰™Ö¿Ç‹»2@2dOØkg/]>qh×óOöxïP®UÓ~Ò§÷ðí{ž:qì£ù!Cf}bïË°ÿýYCg¬ºk ärìš'ûßÿã•Ëçâ¾xãÉAÏTü¾¬O¿ññÇÎ\:÷Óg‹§Œ;ÐQnÀxéÙž]}wúÜ…“GâŸëßgyÄ€[aÝûž7qaì7ßÏÓT®™8xÜÒO:{éìOŽê;uM<­—?1uåæ“gÏŸùéð‚ñƒ&­ˆã‰£ÞlX<ðé•m?Z8ðùwS€-$¤Ÿ,7Ÿ/òìÛg áQÃ~üýéó~9±}夣ÿ©'Ráåè!½‡„?wýn)q÷»S{™’tüÔ…s§#>œßsØ¢| à«åc†Nxe]ؼüÛé§âF÷þäœ\3 ;^?bæ›ßüðóOßÆOéóÒæ  öæñž½VlÙwñò¥c _ŽèÝoGZ­ì±bñ!’­…\*†kIûä…ݹIIkmÑqcy9’!7Z‡5 )áẢ"‘ç¯lÛÆ6T k4=*J¾036–ˆ¢SϱE§“D1eûvÁ¡'B\Ú¼Ù\S#X,¿úÊÁ7lí1……ñ&“$v1l{Ò##EŽ,–”mÛ\¿VÏñÆò*‡‹_}%5tË=¦+Û¶‰<Ï›LÑÑ;ð•Onïì<àë«Ö^sQâk]GΫ±¹]ówtïù|Ž™€¥òÒ¹óu¬„H’tm׊¾Ïή¶8jZSrSx6~ÐÀ‘©õ ø µåÅÕF{¹©þé•à®ã®ÔûOoïžÑeìàüÊѽf}QßÁ2®fh·1k,M¹ê¹ŠÐ®oî.‘‹B0\Ÿ8¸{C¹Ñ/Òí_l>Aóíü"èÏ„ôöý=yÁ ”Ÿ}!åj‘$ ¦èòe ›Þ;ú¹åzbíÞ~¸pðÄ•§ €!çÈ€Áƒ¸f”ø¬ãáó–|X °oñS—}g»½ó‘sžýñïô= Ýü0tž2õÞ©S×ê:mšÚÝì– `„ ËäÉ7¿ýÖRW×eÒ$Ÿ 0F=ùòË75WUÏœ©ñönœ ghhþ÷ßë ‚gÍ …}yäÙmæ̼äd"=BC• ×IÈ)ŸZ²äúÁƒËöY´H©Ñ4NÐû¥—n|û­¥®.xÖ,Ûº‡û&0î>{vNb¢Úݽ×K/1 …CX©|êÕW¯íߊ§–,a.¤À+Tª^óç_Û¿_ÅàY³xêKèAQY~W4m;xB }ÿ™ÑýB(8,ØÅjÛÝß sF„øcgþÊãbx fD“‹—ñò•:4Î;ÿÚmÒÿ£ŽÖ²P‡ï‹F‰wVªîì_½"Ùu4¦µËÍ’J¤=sa&³[my‘:å—0}Gt@a@´íàUÓh¼Ïx>ÒÑ+kõ¢ùeF‹D€¯Õ)‘¬ÇÕ~C[j„Èé+Õ>n⡘h#„°ŠÑûKå?pÝ:û÷|ôæÇ+–ܮ։DCZ(ü›åܦǀÇßÞ»ßàgžynXG<{ýü{uQÊ~ìê㎓ˆÈ¹kBÇAmB€1Fîs¦´‰#MY!–»å5Êa[ÊE¡P·ômîÒÐä9~ÆзVάxªÏð‘cŸvhûÇZ;úL1óX×öñ¾Úöi‘…¤rQ-˜„ÔˆˆªÖƒÜ0ÂÂJ5ð‚PAaƒ\Z¶r—ëC÷±/GEUœJãü†ßLˆ­ ÌÔz©ëÎݶ î®å案H¬N§rwçt:wG"Æ Š‚Ù¬tqáôzgHÏ«=¼»·»úƶ×?ÖÙÖá(5Œõfä æ,¹¹9¶è9jp3‘üoF>¿®ó”E¯Îèç®.?ºõíSuν»Ný›žEþrúÛ¨'RÒ¿x3~9é°~Gø˜Nž —)Ç÷„¤çÀU¥²}ëÙÂóׂËKj7M}Éc„¹Ìÿ±xÛž®ö|wæx̧Ÿ®xëù·?[78cÿš—L«§O»€»¿þÊÒÇ[ú"¾fÍâ…÷ÿ®PÚ ×Ûá#µRáPx“ €Š[™¼š€ü³kí®–~WÝ{@r˜Á¹‰‰'¼ ñô¼uì˜ÚÃãE ‡ŽCV||—É“5žžyÉɘa¼Z·¶ÉÜÿ¼¼ys¯ùó5^^ÑÑíݦãêʸ¸ž¡¡ µ:wß¾ŽO?m¯8r>Ùññ=æÎU¨TY±±ž{εY3{Ï_ٲ婥K*UJXX÷Y³\š5³ï¼!9‰‰½.DeÆÄtŸ=Û^/0Æ@H^RRÏùó1äíÜÙ#4Ô~'ðCFdäSK—"B.oÝúÔâÅJWWû>o2];t¨÷‚D’2¢¢ž˜·ðvmBžîþJÆP]‡°‡ÜĈ$I ¥ª‰ðŠ[—@r«Ïä/VŒoôÇA^–;…&ô˜;„1’D*„§|ìàÑDôíû³¾zs ½½ü]±:È‹1ô~éó½šP¯»¥¤ŠG© „Ec¥y;âãÂNŒšøå3äv™in´µøþjdüìË j¦Aýì´¢S÷OW½ì§FAå1…ó"Æ‘úX Á,ÜW]äõÜüåÏÎÐËñ; [IDAT#1?ñ£WÖôûyÓo´¤j僳Œ&T¿Yaj!£hÞäˆ@ÕÌCc,¯E¨…ü«p¼kê4tÒÚ! öjÔ?¦4|bÈ»F,²SoèB=¡BñºlAüúàëÕ ^g@ØÕZDIR)ýkÆç}óË©í§þûúù@áãÊÜ«†„h<= ãøñÅ—.Õܼi“ËÙ½»ÃÓOË ž˜2¥øÒ¥š7l¡kŒÐÕ½{{ÍŸïâユ÷‚e©©úâb[3–x>#*ªëäÉ µºN™rëøqCi©m%o[ñÄÔ© • ºÏ™“ÿÝwºâb› "yÉÉ}—-S¹º2Je¿eËnÿô[¿’SVŠ¬ØØî/¾(Wíî³f]Ý·Õéî‡ÕM¦œÄÄn³f!Œ çܹ9»w³uu¶"o0Ü$+\ÉÙwkH-d3–Í^z©!ŒFáÖ®ƒ;¼ˆÆ@$N¡AaÆE­LÖ –ÄÖÖ€Rà~M ÚwwcÅ#'RäúðÍgsŸúj%r3½ïõ_Ü®_5|6víŠm~çÆý¤wC$ɯc'Ö*k ó„ ¹{ö¨ÜܼZ·B2¢¢:=ÿ¼›ŸŸÜ×€'&OÎKNviÖÌ= @öËOŸ®ñö¶5þÎ/¼ºcG§gžñjÕ ä%'÷˜3‡Q*­&ê6mZzddç Üüü$QÌصËæ¯Á#€àY³²:=÷œ‹——Ȳé»võ^´È6ü€nÓ¦]Þ²¥û¬Y®¾¾ I×ì5¾M@•*xæÌÔ;z¼ø¢ÚÃC°X2ccû,Z„ Yju¯yó2¢£»Ïš¥P«9½>3&¦ïÒ¥¶_ˆQ*»N›–²}{¯ Ôîî‚ÙœüxϹsmå¦rwbòäŒÒ)7!ïŽQM˜²zõàc»ZAñ=½Ïòø} ”„°¡€ÑÍ>þâʆtêÑÊoܨe^úxª!ôÊò?.ø0dDÊãÌbý¸UëÇx!‘€DB œòîö#S§®Y`çšI¬c¼Ï=Û¯³ÿí´Ë:¯A‘kE½8gþÏëâF=²½7³²MA- $‡7²jÖÏľùô¼ò®.éU>‰ïŽyvÉw‹V«>™ÕŒ@Öù; è÷ûH£‡ß{~Ï♂ýLGN:hsWBwP³eåèQ‡ƒ»tä+®å‘)øÖQýîNŠî±—¿ýýäiýÆ úD~nÉ’7{¾±µ©¥ûkSǾ¼ýË1S·RTs[¶ó’DIÎ —^ߨ{{ü“-Ÿè 1§åÜiÿüô±Í1BŸ ÞŸ=íÐÀÑ‘/0¨SÒ²‚~Oæg¥ty9r€öÕSŸ†¶h«Âìn’±¾×š÷Ž[7vÖº%Ãöuàî™þ ¡€Ù÷;±èÅ1£{öèZw3­@z?nÕàÓýë´Ž…kÕ¸ëûý.YVnÿø£×®gÎt7®o¸þ&ò’“ƒƒïž>ÝmÚ4W__W ä%%õésçäÉà3ï€7n;tè­cǺLžl¿‡`„!9‰‰ ’üxÐPµ»»£PŠbvBB»üï¿ïªrqq0ADñjrr§ñão9"wÆwÏgÆÄt;öö?Èc«Æ3 3cc;Ž{ûĉž¡¡ŒRioÂ" Ìrô@÷»‘Í™jË˪t"V4ó læŽâ´wj\,@îñZêîÔºu’?_Q\¢5sˆQùøµô•ÿ!,Yê Kª8 ¹yùµòÃ!sùµb®cÇGT!„ ¥wŠLÊNQb$YêŠJ«X(]<‚ZµrWÉÝ`Ceq¹ÖŒ¦Å#òÕ·õÄ¿]k/Üð†õUÅeµF¬piѦ­—F*¹{Ç(¨Ú·ñÊ/ÔµëÐÎEë}÷¨¶¼¸Fg"ˆq÷ hè#?[WVT¥'XéßòQ_w¦ª0¿ÆŒ[wèà¡´&`¨++ªÔ™‘Â¥å£í¸ªÛzl×Ê#D,Úâ²j3/b…ʧy ¹ÄLUwŠŒ>ÛùŠ†¢›åÊ΃d[‚¾0¿Bõ¸ü‘7ܹWÊã×ê1Å™WúýÈõÞeš˜ˆhË‹*u¬tmÙ¶¶8Ÿ¸¶lè^YtÓÈ´lßʃXYVª5˜a»OË–j cNWVX¡g\›µo€8}Aq9+€‡oPë/sMia•Á«Mµö®Žø·oã-lyñ-3 h×Ú`Œ Õ¥å5z‚U¾-ý½]­uR2——,£Ôø¶ôóÔ€³=§þÿ7 pºˆAÅsŸ}Vpöì¯,b8³n]YffS‹Dž?¹jÕ¯/bøeýúŠÜܦLH’ôóš5¿rT«Óø׿œ.AÓ++Ï|øaã-5îOÜ2N¬Zõ+9èKKO®^m¿o©ý"†ótŠ¿ BÑï½»ù®u®(1wؘwâèÍ?= i¥Nš™¼æõÇï%*‹Ñ…9ƒ!wß>Cýœ@‡Òví9.uçN]Q‘Ó¦ž.ñ|vb¢Ã¦å÷ç þ¹Èq™11–F›Ê³ÓvìDñâ¦MæÚZ'’'Ii;vIJ³Û¼Â>V¯¿°aÅÔ;Ežoœo6§EDÈgàØÏ9¶ÉMZ)m§´oN44dôòÕïÎ2zà€þß]38™ÎLåæwM$àhŽÙA)ìOb¸~øpÍ­[‚’o©ß ýjR’ýœcys™´ˆÛ$༃uEEM=+.Nž7,‰bnR’Ã4e‘ç³ââä)¼’$eÅÇÛ/#+EzDg2ÉsöìqX¨É›ÍYññr"Çe%$8ˆ«×g'$ȇ=ˆ,›iÓ,kϨ¢"#:ZÖ)‘ãl¹ÙÔéØ[Õtkô¿„Ä\}þäwöï?|ôÄÍ þÞ‡ˆ=¨cí¾Í6—ݺ' 9Ey_>Bl ;!A[¿FA>5Á~äîÛ'ŸÜ"÷)lûòÝNò²”¤lßn;¶Éš`çNÛiS‚ÅreÛ¶ûãùÜ«øx[Gäù̘‰¼¼u«í4Þdº²u«íÔëéÛ¶Ù‡Õé.oÙâ°éDFt´Í(o2e44! ‚|–ƒµ·][}dÿ9V¤ÇÚQ¨Üü'ÂΊpè‡kÕÙÖ•ÎN­Ìÿþ{¹qyË–wÊ’DHîÞ½µùùò™Pœ^ï8¼’¤ìÄDy]UFt´­›`ßžå=%A¸üõ×÷Ï©?eAÅ̘CE…À²©áá¶õP÷=‚¶k—ÜCÉŠ‹kÝ¥BW¦T¹!pÌaŒ*¼º‚{g¶\©2`'a~BÊû(]\ %ŒRíÄBPíß3ØP„œ$ÀT6ï)yñ| Vhœ˜ ªh3@¡Ö +°ÃDxŒ±$ŠuA}©ˆ Ì4~Ž#%ݦ m¯jéIµ†òWæônìú8!d A#¹‘bÈs¤ó×>Ìà¦BÈ.AOø&~= „íü&~3P1ØSƒ.ÿ¤P¨ÜP(Ê C‹€B¡P¹¡P(Tn( …Ê …B¡rC¡P¨ÜP( • …Bå†B¡P¨ÜP(*7 …Ê …B¡P¹¡P(Tn( …Ê …ByHù?»vúÔÂäIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/replace.png0000644000000000000000000001273313051004444021532 00000000000000‰PNG  IHDRã8€Ø÷sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ ![ûTÝ[IDATxÚí]y@Tåú~ÞÙg6YUd\Á%·ÊŒ Ôrߺ¦ijÙz³Ûâ/Ó¶ÛâR–ÖMm5+Ë\*-LRsÍÜESSBa†aö3çýýqÔ®Ö•óüÙ³|ßû½ßó½ÛÇœ!A CÆß Y2d¦Ê!3U†ÌT2þ†PÕúÌ̲Rdüµ ¢†™ªT*ë¼O†ŒkfEQöþ2þWmªÌTrF%C†ÌT2S¯‡¼ê¨æß oä /©åjç®Í@®~Iæ‚>jŸ8ÿéJ…áÿ!¦þIÕŸ¬žÇ‰ÈóËk#Y"}0uìÁÏEŠDD ë5nÓ%<ˆH´dôKîùÎq÷ûÓÇ 5Í,^Å: ¥?˜4à%;]ýz þ|Ò[?…íìèÑ3͵;%ÊýáÖÛR¿ÞYpQa˜d~?¿Ÿ[{ܳ°àÔò¾]o]•[ö̘÷>ýÏŸÓ•âÚò”Ê.'ê~æŠTÏ "zõzsÇ™zw¿ùä¦c'¨¼>Üæn¨©gYœ;¾uçÎœËÂg;xè×Så\’wlÛ¶ƒžK_W´6]ù{2>|-þ‡ˆÍœº¢s·öyYË­7Þr¡ÈŽü­›7å˜\õ¬-öäÜ?|ê¯yº¤Öͧy×¾­¹..8}h×þ“âÕ÷þ@é3×}ëÅ}-Ó 8øbsÇ\½%Èÿö(BCšÔò&5™6Þ6ï9ש{÷o[uÆND\÷ú¯´'u]¹P f(B‡ŒícǺiÓG+•Q~Šºcƒêc * ëhðbƒ­Cç1a\—œ|‘ó5‡]ëïéfçÇé{=¹;·¿€hè&"ÛÚ·‹ö—õܳ‡%˹àn¢?ùqÑ£íZ„èˆ4±}Ö1{Í¿un¾˜˜Ùc¸ÕK—:ÿèÜ7¯ªÕÉóÚª)æŸVWž¯×ä;µX¾0³ß#ª¬%OÑk›lW5!Š"׀Ⱦ’)7FãR3ÿ8g¶|},7õ0»~í¨Dì¨W -f‹¥dûÒ§TÀã«LÌ<ëÞ¨ /ÜZZfs¹ò§Æ@=à]fö¹…Õ¯ßô>âôÚ½¼êÅa€fñÖìb³Ùrê‡N@‡gÓ¥^?y< ͽ³Ö[¬6—«à¹¶@ï—™Y8µHÕ›³ì6»(rÁ¡Œ'§þk[Ž§¦È¢Çír¹=¢Ïët:Qdûî–@Û‘/™Lf‹uÛûc€àeÅÌÌK‰„BsÛäwó M¥¦¬ÉQ@Û‡]ÌÌœ½áÿ˜¹>»ÈdúíÇ· ˜8w«(z]/³èq»¼"3sù¹Ã3¦>ºâ`9׉·è› Ýv¶¸Èbg6?ØT۲ϡœsKéémó‚Ñ+ÍÌüëë­tøyQi™½¼øý»B–šïñ1sΡ^Ê̦¯ @Úkß•ZÌÅfóâÇnZïp°(ò‡{ƒb¾?’o2l~%ˆ\sÜÂ\xoBˆ¾ÝGs ,–Ògã×X™¹¼àðŒÇþ:ÓQ[`Ñçr:Ý^Ÿ(xœN—™Ï"`ÌÇ»ÊJKŠÎ¸§{H5ç»l]¯ N&ÿ–?eåš-%™K¢”Å'™Kîú(`Ê‹½ÜáóyÝ^‹¢ËéDf梃ÿzâ©Ùn¾8DQôù|Âh©l;µ)’0öóbf™™ON»oÊÚ\ïÉ…“ 4~›egQE‘=¹=›éoè?ÃÀqŸìn*Éü&xt•µêú+w'¨šÞoeÞ=+hö“PÙœi±˜}ÌQƒ©Ž¢Ã™G$1½^!暈`î.¯(¤ø£ý‹'*•Pø꤉Ÿ(,Ûó™x6ýüúyæ®h¿––ÕäD½jãô1-Ѭw‘Ë'Ýz|ÉS€jΚwqf[ úÎÏ«ºó›{B=ä³Ï¶#øç~_¼”ùºSU ÝÓ1 #¹gHe°™0ëãE–uŽôAQQ)’†:ø¦ÐÀE%'< ˆbS"¥ó ¿‚£vòá>r°žÌ¹LV "@ GñY`÷Æ<´iˆ>´èÓ¢ò^¿‚Ó}ATRGUgZ«ñoiÈ|〟O‹>‘Á^ Ñéö!rD'µ;‘2¦o8æn>)N;óý!tŸ'er`Ý„YïÔU÷ø\Ötm)‰WÜüòÅ“¿÷I×NtÁº9Ç€a¸­«²ò¡Ðnm€M'Ï´ÕŸoIZ¾ê¦½3MvQÁ¢ðyŽ#Y6 ìWx†Oÿð#Vžð?ž:q…Ô;æJ¶æ;ÑF_À5¨ÍG]þQáz¥1â“b”Î’¬|fN>Ä"P/…÷ØÁR¤ªê‹"/m¾êFÃLõù¼>@£ªè‹¹¢·W Ò¨`2¨É#¸*Bm…’ê‰Ýn È_¯Õ(• ºæžÒ)^]5)§+Xu Ù³–7ïpwÔà§V/(–žÜkàùà^¤…4€B«œ^¼ÀO­¬¡jؗٵF©’ôù<"`Ôiµ©|ǾCºjƒ .?íyu)U€ÓS#W6¯ŸÞ´ßëiÌ]76%2ÈϺ{Eïñ3‚èq:µ¢rv*ä|^ð;ß]—þ#{ù…ù_Æ Är—¨ÖkÒC©VUæNn/hÔkµ>‘ .9åÑNšˆ«YIj˜©FÿÀÉS^D«ÁDÄn‡5†–‘¢×l±‚ü¤Yv5¹Ã㛪.Q\m\, òÊ;÷†_·Rý5ÓË¥Ìö²Âøåsû‡€5û”ã|[ ä¶a`±ýŒ èÐL 4í„ÕÇ‹+(L$¸VéµêË*°U !0°¹èóØ;/t­}O!¥GÏ-%J8Ïžniª­>Þ%ï­WGuY4ç©XÍ’Z¡‹gYÐ9LDð8í>•_hpSöÄ;O%á"êmš„u©Å,ˆLLŠO5†˜` Ý„yÿIÕÔ,—ÿU{TŒ˜¤¸`üðÆë €`Ûñ¢ÎÏA¶˜2êv¸¬ËÒ÷HVÏõû–ŸÏZ:§Œ×6P¶S¥"jyGÿðÓú£Ââ—ÅSú=²ÔW?ˆÁA8Kò÷ìÞSdo T§W«Ñë­0Oóœ\¸•kÕ½bÑ«4›ç¼äQôÛ €ñîÇ“LóŸßhðœèà—4þí:RRgéþÝ»rJ„úÕÕ¾[Œ+æΫòUo<6tÂÜ•TÜþÂç9’ ûæý» ãýª7 Wð)$‡ã91çµ9àˆ´­zö ØñâãR3§—Œ¯;×µW3ÂWóV[¯LüÀü=D$8KöïÚ•SÚ`•V3bd+ñpæº3 |øÙ*À>ChbrKͺ¦Ù+oýòÅ Ÿ±¾Áà*Éß½{¯©Üw%Tm0£bæâ¶=’Zè2öMéüž¹·ˆ½iÐ݃o6Ú3¤€}Ö¸ ´y­*!ÏZœíH333ùîeÕ®ßìCœ—ÞB¥„Tÿ!úFûƒüŸ]û[EîÿÏHD?çªl!oYP¿sÌÌÇ{ð‹ë5hR¡]<¼l&€¹ÛìõæS̬ V+õQ7Œ;<\‹»Þúå¶ zc›é› ¿z¨ :N«»y਴Î1 õ=ó2¤è_°žº9.Jm—^=#tZeÖ‘ ˜­ Æ}VTûÂïóí{sªN”f<­”Í;vW¼ Ö+ ˜¥Œ*úž´Vtê;tPïnºï]ŸÈÌœóA'膕2ûö¼ ¨ÃmãF¥i€¨WDÄt{cŸÝwð}€€¨^=“5 4Kcr13›¿L ¨Zt:ìÎ8@í×33›¯Æ,3ןN‰ÌÌæ q(ùÖ¾7„#ep@1ëÛÓÌìÚó¶?€°vƒ† iL@³EGm\FÅ|ì‹æmµ]AîOµ¾E­P(jy7f&¢²ì½é›”xÍ:÷K餕¼QöÍÛö+TÍÚtº3¥«šD‡¶|¶ÇÔqâˆ$Éb—üöÍç;¸/EË Ÿ}÷+/öDß¼1p\š0¤ï•Öeïÿ—‚™++ðÕ¹Fdï_CÛ»w@d$bbj\ºF¨FM™¥ªžz½‚‡¡ukôè=˜ˆÖ­‘–†}û æï9cÈûWË;ðì³Ø¶í¢w&&bÚ4DD [7ü-Ä./‡ (¨bçîú]N¾JUEÓΑ™ _½Û$‰‰()An.¾øcÆüõbÛlˆ‰Ç»×ûKn.ÆÔFãý‰ðÐC ÂÉ“0`4B¯‡ª2LW«…  ´o6m‹ñãqìÆŒù+™!Ñ4=P©gŸ­8/{ÿëÙûwé— V+ÊËátÂã©>l0#- ﾋèh(•P(®yvU“£ÒêêÕ ;w"!X°÷Ý÷—‰$çþ×nî÷í«û’чj5”JÄÇ׶ĉu¹°`æÌF½qqxï=ÜqÇuOSÙ¦Ö‹‚4­Ü U*‘Í-ZT|íÚ¨¢ŠÒÁoàé§ 9GŽàë¯1thãáh£SëaId$¬V¤¥€Ï‡„<ñ„åèÑR¢²òroå? âj¼²³z"¿hFŒ^z BB0nÜîFESÙ¦^’UãéÓyÁr»I°ÑhÊÈð…†ŠƒV§  ¢JüÙÞ¤W— ŽÃð᜗GR]"7ááøñG4oÞXMÇ¥U©”Je#|Ù/•––º˜E§S—žnXµJ÷ãb@€¢¬ €+-M4í÷ÜãJKS«Õ*¢©hp)ŠªEk§k×Ò† ()Á¾}œ“CÒ»Bõz¾ï>ô莑”t‰{½^»Ý®P(ŒF£B¡¸ÎÈZS¥jll4Ád2Õ8¥ÕªNŸnrÿýÊ¢"0ÃíVZ­UÅzòINMEhhÃ|ÊÍÅ–-´};ýôû|¬©ZÍ ‚Á€Ñ£ÅgžAHHEìqÉKK„¢¢""bf½^|ݘ˜:yXÛ¦6*ƒJD‡Ãb±H1¤É8ù˜Y¥"@}à€¶¼ÜÏíVnÜHË–‘«æ»nš4(Âë… €¨¢Ú¥Ñ@©d…‚Š‹kõ(¦¤ð¤IG“&hÝšÆ ‚^²Ú%9m6[YY™J¥òù|~~~×ÓÄÕi.©1ÿrš´vEQAúF„(ŠÒ·#$‘J¥ Ws¯tò$rrhýzÚ¸RÊU•¼WA­æxÐ Ädzd2+Ø*’(^n†Tef¼^¯ÙlEQ¥R1sPPV«mfEþ¿‹1£°°Pzá¼Z­ «‘{I<»”ÐPÁLÿ 3#BII‰ÇãÑjµÇÏÏO OIÌ&3µ¾ ¾¨¨H"«J¥ ”¬×µaFU/’±·Z­‚ ‘R©”R(Nרò ™©õDÑápØl6‰:J¥Ò`0H<¾,©j–ˆœNgYYYÕ·…øùùùûû_Oi¾ÌÔÿ&o\.—Ãáðx<’}%"¥R©R©4Mµ—_9w¥^¯×ËÌv»]:e•Je0ôzýÕ[!2S¯²Jt´Z­‡ƒˆ …”oIÇþþþ:îÊäv»N§´ ªú’ ƒÑh¬¾ÝÐhi*3õ²)+™X—Ë%Š¢D/ÉÐJ™ 3+ µZ-E“ÕÝ´ôÎ…êµ)º¨*<©ªA§ÓUmÁ4fvÊLý/Ä‘Õë—R,[ç/ÓÕ)êÕjµjµºz +YfêÕÔ#Q­ºAõ-AɧWß_¨ºóÏǸ2SeÈøAþå42SeÈ™*Cfª 2SeȸRü?Å°¯0OJiIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/within_distance.png0000644000000000000000000003505013051004444023270 00000000000000‰PNG  IHDRzAöó©sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ #¥0 IDATxÚíÝe`ÕVðç$¹R/”âîîî î®Ã6Æ ›à Æ6˜ 6Ü™°aÃuÈТE ZZê~5ÉÿýЖ °±½… öÿ}Øè½Ñ“äÉ9'¹‰ "0ÆØó'q0Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cìU ¼øYç/øqé³)¢Â… ûdÏ&„àÂÈB‚ˆ^ü\‡¼=2Öµ—>ûw’CÔ¥Ýûý…‹â¥¯ÝðððªÙc—>û—F\pƒË!Ëqß cŒã†1ÆqÃc§•ÊEÀØã4Uu:‹åÑ'&“Éd2ñµ*ŽƲ’xòÕW_9ÎGšÍæ±cÇrápÜ0–ňtUUÓÇ‹‹  Ç cϯšÃM§¬Ä]ÅŒ1ŽÆÇ cŒqÜ0Æ8nc7\Œ1ŽÆÇ cŒqÜ0Æ8ncÿuü#†Š“îy­šªJB€ˆ„Ñ‚`·! “ IDH¾•žˆ`tÐà°ÃèÝ U£Ì7ÚAŠ ’h*TÒ""Å,d v !uÆ’AiË¥;¡:ÒÄÇÍKWÜÚÉ%û¨.î’Hs8•‚µû54ÎU!@)i͠ʱ®†ÍŸ+ìPÃ,?¼Å¬3…òz‚ $9nÃà*¹ºþдiÁõíkäÿÄ¿nsƨ!ƒÁ~åÇÙ—oŒŠšîU¼A¹ÖcªÖ¯¤:SBK6‹ýãJ^.:hén“F€B˜ºcíE6€4§ ŸõK7V¹V•'Äc7/ Yž­–øp…`Ø6¥ã¾ ¹» ì«é°Ÿj+8¦pô¼‹þ³*1*9š¶hZmïâ/Κ.«$n-íš”{DýæU55JqõP$‘©Z#dqü“Ö7¢ó7{°DIoÁì]Ý-*a}Óf5A X ¾^³è±Ã¿E¼^Ç7¥Q­˜Üò48w)‰pgÿ‚£+û†'l~íµòpÞ0î»yY©V8­pXa'߯չxA3d;²úX…öŠV¨wßrYD(è6¬ˆoöcY¸¯Ó?PY~o¤2=fþ˛쉑‘fŸ|Š”¾yk±©Ùr¤Û"gbL„«wnY–@ÎÄÈp“O>CÚXZRäCé®* Å={N Hµ%ĨN'A(fO77"@·&ÆƸeÏ#æKôÙ-§BI–¤GïT’ .žf7WÒé¿ùppƒ +ÆvlÕ¨fú71xxxŒ3†#ƒk7/Q¼›Ü}óeúLvñöpI©±¤! >ySÿ4<6–ì–#ß“ç@(fOߌU!@vñðqylP¸fOžŽ·‡Ù;c2ò{Xã áŒ1ŽÆÇ cŒqÜ0Æ8nc7\Œ1ŽÆÇ cŒqÜ0Æ8nc7Œ1öBü'3E¤šŸïxAvþë!`80P•`€8 ÀÈ©{í±Ñý[Ë8:ÿ–ŠqÜÀ{C ë7ÅJbô 8ì:Z£gW$& |ULŸ •Æqólòž>Q¦ÚÁYëŸÓô.èÙ±Šf€òâŸókrEÁ¢PUäÉEF‘∉B¾ЀÒåpׄÒå¡ #_AäÉI `aä/³àâ†ü…A:||a4¡Hq$ÄÃ7'T d9„… TÌø]ú T9>xÇͳ¶;ž_ÕCèÿÜzmûµê£G/$7å¦~Ø #'¤ ã ´ï†ÝR¾ªÓu€à幋R>ðñ—)ÿ¶>˜Ø C9nØßÀ]ů–cû±gäG©šB¤ü›Ò=[‹2ö´Ï3®jü0QƵÈ2då9ö‚0Ü=¸¤ÇÍ–­Ëó¼xI‚‡'—7ãÆTVÓ«õåxù‰¸ˆëwñ¤7Õt‡5Qÿk¦&ºÓæ°&ªN 0ëCœ?ýgã9VËÍIº3Éawò{f8nþìünÜpÝô’,휩˜= O\Zûƒõã^‹J´ÿ•´B±ï˜TÿÇé½/ž ~”jÚw#Eo[þ^_ÇTö.ÙC3fØCw¶_7o7w qcê•n€HÂ`†Áiƒ®gjˆ W@³CU)ã3à Š’Òà´§/‘fW8’’+ÂàRát‚ˆ„$L©ß„Ñd‡3eú”2¼N'Š0™aOJ™> Y˜\’?A˜Üàt)íý D$„Á˜òþ¼'½0Š „Á I@×á´¥­A³1>)ÒÖlŶ|FØm&J¾¹„£T$# ÂéLWnBB\ tœÎô…FÈ×}–îÖ¸´¹‘Fz.Öķríæ% "`ëØ«¬ÕlÑ <'?–ÀB‘îl|g͈&‹{”úiþ<‡”ñº,ÂN~½îÍŠ+Þ®·tTç·¦kÊÙv}uï’ç¯Å€DÂú7Šœ:}[ÉïìH8»´GÙ[A€=hE¯¢—"¥”ƒMég?m´zÁ:Ù($YÜ[Ó~ñsÕÔW„ !´È#ßt«ü ÒzÜå%ÝKF-ÆL‚#%H…¬œß}ñÀ:ëǶÞ÷ýŽLiCDÄÍmSW¾Ykͻ͖ }ýìéÛâÑ{ò HÞüá“ñФ6‡~½²\±1’,ÝÚòÎ’^e׎n¹mùÆm«ÞãŸ)"„lxx`êºÑÍw/¶aÖ4kúwÔ@àÁæO»¶QMéJA›š|3eIœ57¯êúÇð;ÑêÛ ý¾ÞÿöüOﮟy9þÄÓ›æz{ãy \zᘿ”¾r¶cû’­ >»4páñ>júôÝ„tÇ‹f,ÝæwýVŽÖŒ\Ý]¯òeÅôG‡»{õ¶ý:[>.¸¾¼[Ó•eŠåH»kGHUÇíõ¼9ë¼_¤#äÀÞãöî“Æ¥]v"’³7j×µöþå $W\ún¨oû >…ò‘§wò B éØÛ—ý½ú,=Ùû‹]óßÎô"!„óæ—Gw]h;÷÷>_ìï?}â••£œ©¿ï ¡dïúñ2£Ck8egƒæÅ(¹z4ÿSuÓлÚ,½ÖçËÝ K_ ²*Æ̯—¬W¯D¿Þ÷ëýoïï¶þÒ©ÐŒóVŒ.®Åº«ÁÈ×.¸1õê6¥T¦]>®k‰¸A’drs$Å:áfH?&«Û¡’ÃÀ­@þ²÷¥2ªžržúí ©R£BîpØÈPþýk`Kð¨1¼ÎÅí?|5ß ÷œÓ‰5+„@Ž³Ê]jøËÜ£ƒò ÞZZ£CªÃÔú1«V|˜h>]vøI7‘®A$€\º\{לð°„jot­N# –¬„€v}ßåí¹jp:àSu}ÿ[ÆÕׯnúÉ«Åt->)š„¹Œ¯lºó §T^J™?T‡Ý Ý€G‹õàR°{ù&yPmðj8;çÏ??^²šT°a׺N Ýóø8âÂòp70ÇÍ9m„œtlݘ· e»U¬UM1èú“2çpM½ÎÍÕdµ%¦¯%$&ZM¦<”ú8Õ2gÝRí¦û`XA{\ ÈÔ3¡;P£ëè¥S¦•~÷w ÈÔ-$É¥‡VÌ·þFTÍþ]u-s¿9аû€e³Tþà"i MNgj0è±ñp÷p!„bBæËRzt<’¼¿vÿ£ “.E[„ÀS¯_е¿åæf³É+y²¤Áàáö¤=ËlHºÄQÃþãq#pmËw¢Ê^£ÞUUHräÙåO:*ìqv®€,‡«¯GúcÇÝÝÕ/Drç­•Ì=$²Yœ^úvîæS¬íWñ —‹œ.2Hv‡O)ÞjüÍeÝêÌßiÌðNn"ñG>¾S½¢÷ñm?_iÛ¾; Y¤Gîütht¼ýÞÕ+ ôîž'ü^œÿ… Ÿ­óÄ8nþ´1E%» s¿·~ÉèΛ&´Nªùmñ’Ž~Ú< &íxÓíV»GíÜ÷&nœØqy¿òjž•”Jks o§6[˜R~Õ¨†«ço­?qu9Ÿé@ Ä߻ÿÔíäÛ껉Ží>%É)M =|×ÁÝ~MS-T ÓrãݯϜ ¤´ž¥£S;¹¼þUÙ®r¶Êz×üyâðx“hùÌq€ö -GN„5ïû†Ó‚=—¨—fYô£Þ)ùJ9¼Z®(žïîš¡5×hr)¤¤nMJß\$"c¹‰µùå½>h³bx+%Ïë^¦Œí]µ%ehcêºK…7ëV–6÷¯¼eR—ç‹å*ìõxŸ˜ÓžVåÑMÓ3`ã:ѯ9AÿD£ú½ “Êô˜ùO­s¾“{KîXuhÖ†äCN6 EépÚI2ÅÕJzÊõf‚$Œ&8l0˜!ÕM{Ê}7"e"N³èܱl¾¡!ß¾%É²Ñ Gê½$² ÁaO½ïFF#‚DP\ ip82Üw£Û¡j$HÂhF¢#JbíX²“0£!mtƒ+Ô!Èá«7–’( pÚ`0?~cAÅI€ª zºo’ë_F7¨¢Gm¸¹ÓѺƒZ¼¼«·‚¦açûr´?P½FÎt}b0¹¤¬5ÌZúsˆ„0™á°¤›™„_Úì¿õN¿±­Å?ÝÏc0aÅØŽ­Õt:Ó’æáá1fÌŽ î»ù?âVÝ‘Úס;áp"]÷ˆ€‡œÖ´Q2÷ª-ßéêpXðè8ÓìÐR§ „€‡5å[! ÙÒ¾MžNòLEêoµVè†t‹¡Â¡¦®Z2„Áöø+!(yHY‘Ì71Rú…ϸvBÀiɸRc&ËIW ©Që““eòÔÛ‹C‚¼ªTÊ™¾SIPÚZ !T{¦ù A)+ž~Yï‡ËîÙ÷)sÜ°—¢mˆ‘ãÀùÜnÌÀ¸7µ^ƒ»Ïølß¼†¿': >•[~º#—ñÿ›ª§&—½ò°P‡¹µx3rÜ°—£ª†¹Ÿ@’0î<¿'%ÇÅÂ’è^¸E—¯Z$·ù4„ÿë§NºêL¿VW@sño8nØË!Àd<Ǹɑ ^ÞtOi@þ­&­ú”¦*ã¸yé›’¤=·U× ÿÜŠå/YFà$%!{dËŽÐ`X,ððDÎ܈ G| F,„ÄD< ,£@a8  ÁhÄÝÛÐ4ø愇܇ÝïlÈá‹°‡HŒÇ„iÈé Æqó 4£©à‰Ý5~nY&»D‰´Gx¾°%Lœ 7 åë0P¢4fÌÅô ˆGž¼øv)¦GtœìÞ‹-?cë&€0g1®\ÀªÅïMD£º˜0Š‚u1r¦Œ…͆"Å1ïkL¤$è¶þÊqÃ8nžIhµF¶>×çªÜŒ=i¾ØíE¯˜Ð`ÍÏ¥¸chËÑk»ôñÓ¶­c¾Þ­ÿ!7²¸vÃþ?­Ã¿xñ*Kÿ|¨Úoöž=c³ÚeŒº÷Z¡:yî]·.€_ÀՆÚ8w!ò á®ýnÔ‡r:":_zÂî™5üòAÝŸè:¯)Rv/ ðÛ²üÔî 4*X©ÇÜXÀ›÷Žö÷­þåO‘†_«­Dg9ü(û˜°]ÇKTêÚÜuúÞtð¹ríA©éeqewê ºAzò8}š”ùJçÒ‡e¬¼ìM@²§;9‰:¼¹ÏqÃþ¾¯DS dôÈ›ß`¿­=w¡Â€Ù•+ÿý­¦%—éÍz宇—̽Y¨m À=gQCâá·¢k•+ža Ù(;â¢ùÁ„7Œým(EzË×UjTÌ9ÚºÇ'V+“G Ú“’¬NðjÝ«©¡K… Ó÷E'&&h©ÕÍ‘”hq Í–h ;-‰I©wå–˜ÄõïªÐòÃCŸ‡c÷ŽµÛØ.jB”,É\8žÆIDiOËKÿG†/ mL‘iZ‚R®Wñ?ÿE¸«˜ý“g»GA!Òÿñ¤¬©ÁþÈ4­ _sÖpcŠ1ÆqÃc7Œ1ŽÆã¸aŒqÜ°©Ô;#ÒþÏ·J0Žö\áÿMÞJ}œBÜÛØ¡dÇÕO¾’L ]‰Mä(b7ìÿÙ) n®&º¬?»®×“«@ ÷O¶íö)¿=˜qÜ°¿Ü~:³y΀~½FO[”DJr%âè'oÏ>˜%»—ëþìí§ [' Ÿù³/&»ÛŒýd¡›©Gìÿ;å$øml1lÅ´O§çs—·Ñ gÈùM£Þj·õ“uÒ‡SG›5èÒhâÂÑ=²‡œÙЬéÀ½ÇVå4{È¥]3wf0uö\¿­_í5ðÔî•p\nѸoó ³G2ïZ0®ûõ›¦·>³nʈå—f|ü‘¯ÿÍ]®†¯˜Ó«:ïE7ì™ô*XÚ§ôš‹kþ©°«š§ê_ˆ`ç’ ÕGz­–/¡ºWàÉÃË£Ò|#ÀT DóÆuÍ@Õê[:Ä&‘p)Q0©LùÒ°Ç,Úq´d±¼º¦U«^aÕêòçµ–EdKö½_7 ÷èðáÚÏ£€€™ãšNß»5U+¬Y¸ò”}ùÊõýg^iYÏÀŠ-ã*4ûâƒ^}x7â¸aÏ¢°wa¿a~ÿt éÙ›~9ÈФFN@‰j…´%áé¿.ÓãÍ:º5¨\¶ükÝìW½L‘ôÓ&[{>î³ô ›·»°9ºª2È[KIþ “AºîøÙ*ôÌ@FϲcF—nE›#¿ue@6³zÍ?õ½x?â¸a/‰¿òÛD!tJyüjW‘© H9¿øå(éŽßÝ0ëÝ~‘y;œ\ûþ£//~3êƒòY??Ø»Ô)ÿs2(¡ê)u°ä§ ™ìÚ Ï—µñÍXEÿ¶òUÃ]Å €o¥ÎóGƒ@DgŽÝ23ìa§ÎÞ²a¬ÝæíV¸þþÃAH¸˜P¶NeSò +B,ÒEëZîçvù {ôÙnºÆ¢h‰"téDpê>qwBã8k¸vÃ^YíßÜgFÿ¯õîñ×ÎÝ R´ì鿹vhÀ¬)ƒ‡ô/â£\8´ÉY³S%¡^ ?­X¶¸zbŸÎÝ´¼\.SØÙoäË•Ûíà–ÕeÞòÄ•¿¤Xý×ßx?¦iiÏ߯ÌÑq‰70jäЮ“zIao•ðrìÝðM|­)>êÀåÕ#O›6Ká¿Ž(g©† ‹ºÜ¼¬ä®9yD—øDcº•„#ÑáQ¦^å¼9J7èV·@À ÿ‡‘qªvølÒ ‘gîòjTX<¼ñAÛ†‹—oÈyjÌߣv‘·CŠÔ¬—C$jîeêTÎ'3Îj¨_¯†ž½út°<ˆqÔë6v\—*DäS¢^÷×J\¹c«ÝeÂÄ~ ù¡X¯fŸoQgŒ½ÜwÃã¸aŒqÜ0ÆÇ cŒã†1ÆqÃEÀã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cìB €@DD”ö!(åCŽÆX¤ë Ò…ª«)Itprí†1–•y#„J‰a*A€P²YÈ0ÌœIDATÓdStAÈŠú Ç c,¹é$ J®Ú£°HVtÅi’„þè#ŽÆØÿ5 è’f‰„dSt%¹2CºP…SÑuU€k7Œ±,jJAH²#¨Tè©ÓH€ Išííwõ;7 ª”%µ‘U}ÎŒ±—¹vûÁÃRÓ&Îü¹LÁš$I8ví´wnVµN‘S¿)Y‘7ÒKX,ðC2uèô£‘¾øýÑŸï½vòûO&~¶ú©£j€Í·žaÖÙo ]ì³éË÷ç¬?ðœÖ=eñÿêÊ'Ÿy¬Äƒ-÷Oúnæ˜ù¿œÊ4ÊÍù“,»ù¥™àw`{ÏqÛfm>xXT¬ß[½ß¼d†%ÑìãF9{/ÀÉõï~°ÈþÂ?·ÝI¸hæØ!Cßüjíž¿?ßû{›‘éÎõ_'¾ûé¡Ç'7}Âàý—¢Ÿaà—|2ü­Áï¾?ý|pbÖ4ižVõpu€Ðån¨D*$aY¶HB¹sGPÖ´¦¤—-lD螯ZY*Ä_Ës½R‘ö £ ŸÒ½ÐXOwå¦ÿý§Ž|þ7'=KIfϦÅÙ³{êwï‡?§u"±q•®±â¯g„4©y,ÙÛÃù QÍáé¼’y×O¼}-ònâÓ+ÞŽ£}&ëå›Uh”+øª¿U¸Y£‚’žiYôË—.ÄXT¾EªW)™ýi <¼~ÝûB¼€Ý zD÷zoÊvëÒ.î·/Û Ÿ¯AüÀqÍ]¿V ÑÙi¯¾í€„°k—nF<>±ŠUëäÉfüÓ°zÔØö56Ý2´ìйVaÛàM~º­?§ÀD¦jÕâ£BÚv$I¶];#mÛerèÙ^k+ YQ»Q^t^ ¡Ý¼x>4Öâ‘£P•rE@$„ÐCÏ]¼™ä ï¼E+—*H€îw<$W"Ú™ 7tÙ­TõÚ¹\`½wuÓá‹FgÁcǎ׫_O¢¤«.FÄÛÝ}óW/_DâþµcqîÕs;o^½er÷­R­‚’±gÏO®æÄ#Ölðš!öÞ¹€°uj¶ªífÍVª`A%·[Êò9‚ H=P«|)E¬çã~,ò”@ír)g?!pæ(‚#áS «¦¶uÍ ¸Ô“<ŠâÝ?s8$[ÕÚŽ2•@Ä=ÿ¡Âœ­b*ˆHýÚE¿ð8«ÉݧRÕŠ®"6𔿭LYP¿›d³w…êÕ<„íÄ¡µ6I;~øH¥Zò»öè ®ÆYµìùKT,‘=òòÑ{ÞõK)§Ï]S%—’Uëäqþ'7ž2U9ò›½brÙÔÓGå­Ô$¿—K«:.A…ÌÕb]â ÙCO\´%‘w­Z’xtò–ÀÛa$›³Wªà™Ý ü·ÃñV×\ża,¤{UÊîU¢T‰¼¥MÐ 'O«X³¡‡IJŠvƇž¿|×rÕª<Úg=|‹vºd¹záRD‚Õèš½l•ÊÞ\9±îZ¼ñôÑß,•ê•öjB˜ß•›‰vÍÝ'_õ %@@bà+‰Mk:}âŒE5ªP½ˆ  !ý/Ü5yå©R¹´H5þÒ…Ëщ¯Ü…«”)’¼“ÄÞ÷¿¦6¬QáÞºwnç¹åýÁDx½aåz»úǾU>›)1äÖ¹ ¤Fµ*?Z‘¸‡ׂmuª—'‚3Ìÿ·ë u×4ŽSG~+U©téâuùðª367¯ ¿ûg3 ÂpáFdôªP½ª‡LBˆ‚EJx»)°G:ФAå 'OÅÚ§D…Òù³|þø=×õJ犿u9ý×ä¼{A µ|4ÙŠ]Q½çÍ •²$*^p톄‹F´6qÖ‘£¦î6ðómBÛÃs5ë¶üzË~ÿ+¿MÒ®ûGัl̬¥ÃFL‰°9ßúi»Uh–Ø»CÕĈûÁá€m`Ë&c¿XuíÚÙ9£û7xs¹*€Ã›§}0峡_î²Ûâ¾™1tèÌ 9n_¿5îÞÝBÄÕCS>ŸO@˜wAMËD»TýfV;‚ŽŽÙP¯'öÅã3lɱ/céht›‚_Ö¢^y|yB@ -Š¦]ðóÏè^µ†”XpXË"^¾]ÞX #ó>š»ë~¦&Âƶê>ø‡}G7|=îµ:]ãœ$„6±O“ÑÏ»ríÊÚOÆToüf„&Ü;6gü'ËL^ä°ý´h|~IB»{ÕOÓ-÷îÞ·êP›Ôj2cåÿ‹G&hÕwö^èwV¿;sш·Ç=Lrúíü²mÝ61„‡Wã„ç ~Þ”±'ƒœ€ª•ÙØ×™wÀðÎålj6mw[ýðÒåÝÍÞ~('/tì–Ù«›½~øZà¦õkuR$ÞuêH ŠþjÃW-¦ë¸YÙÕ2sÚÄ zƪJxŸvÍ¿Zµíòé]½Zvµª)ŸŸûqòÌUW„ÀÈ6ÍÆÌ]qñ²ßæšÕj¯Óƒ—…|70Þ è!m_o>wåO~çŽÍÕçµ÷¶êˆ<4òÃÙ“ûwó´Ýÿ}uÇ:¯ù%B±vÇ~#ßßwäȼIotò™‚ÔØNôÍfÿ+§fëÖrÌfÀ½£?L™¿пßr·ö –ɧ¸ælhvüp#ÀÃÓÛ'¹<}EHŽ¸:â£É½‹?÷Þˆa¢vxw­jØø/TÀýð¾Ýþ 4"^¡9îvðþ±GçMÖsÐt!€¹Óß=z-I7GûhVß×»u}WïfÍv„ ãKfÎþñÏÒ×.þ:åÜgP`b®²eø­š=cÙ¬î*H—GŒ2é€*)׋]¿i’_ª¬=—/„œ57ÞЋ¤SìÑe_{Ùü§Ó¯C“×4úñªÍÇìÓ“? ùµB¹†Wu²Q©l³@'‘X³VÍkQV"Úòyï>£WQÀ7+t[˜2aëÃƵ«½GDkf´h×gbòç¶S³Š×©…žœ^«á8[òÀº®išþh™’ÿ«9hÃwô0!åã Å÷ˆˆª™©ý¸”¿E(JDtm; o²kDDtƒLÙô°ŒS£äyèé×]'Kû†å·_Œ!"¢Äq­/¿þýØRÍÞSS‡оöÜŸÎÑ¥ Ýê×ïmшˆ´Û?—®Ñ>žH\R¹R¿X"":ðQ݆#v¦Ìàá‘ŠU^»G¤žP¾tãëŽä2‰hP·Úï÷(áhÒMn§.‡¦iº®§,iòÿt²ùXP®¯5¥T~)Sï‡Ïëö¸å^¸—eC:V^¸#Ð~÷h•:M"Éå^ïFMÆÒÅÏZT°6eânÔª^ûRœƒR6Fdy³Nõ¯~N]Zme×J½6Ýy´“dØ{µ Öåk_uèRgÂÔñC¿¹JD7¿îðúg(pc‰Z½ìDD4¼}ý…¿^!¢Ó«:7hÔÕ¢9®n(U«KõlUyñPŠ>Y¾|õ A)þˆšoÎ9ûøžã|°µK›×êÔ¬ûñÚ#)û¯–nÿÍ:6»ªkÎ@O_UÈqŠb—8ÓºÃéÌ’Y¼ØÆ”ÀÙ wó•(Iƒ¬júÓ¦öý¯a¹ò‡,[¼P%hÙ}·£ð©^E%÷l™|<`¿m¬k@¤õ ¤þC2 UY´¬‡àHá!–šÕÛ$7+Pg°áÀÍóðÎE€”„-Z$25@Hû`õ“‹õ&à6gç!ëW<(Y¯™œÚr©•Ã÷Pà} *H…Zš$$y¸’ê°îi“Kúù@l¶&×—,ºC€"ÙrkÑ¿Þ¥!€š«nQ’"„°9µŒn!I"ÓY ñÁÁ&oO“”¼îyêf¿/„Cµ#hÛÏ‘» Z¬—:hsr5¶\Ã2ÉÿVÜJr†“\°^1·[×lزo¿þ•kUKß%IDŠOùÜö/t™èPIW…€SרÅjz¤šÁdp8‚n¸zd˦$÷¼\x?`Ÿ´;·ҽe‹jI8sÂñëK…Ê^"uóè9Ý2K‚ˆôÇv’äïòn`_~<þ‹Æ¶›¡%WL©6pî Ÿ¸lGØÀÏKC}˜©??ùr„R¸³I@†ìä°[×ôëoðh˜WN^ ³§«fD¦=GÎÑè³/K]?ºaÎ7SKÔØߣ¤”if£ URò¯XèìÙÃD².Iæ’¥äúu CÑå,™Å‹î»±«š,Ii—Íæ®)­}(fEK°§4dDúDȸ#[œÈæ›;oÞ|É)ôÆG“}ŠfO ù/öl $ÝC¶º˜³]jÃÓus"y£ÁìžzXš@T$%eÑ(}Ðüq?©]#Y’’ÇJùÌæ “AIé­\ Âêp¤.”œv gž–fqˆœùòçÍk #>žVÀ ˆÎ\hÏXÖœN!ÍI’ÐAdô(ÛUÑ ®F³þbû;Éžº‚OܘÓ~8ÖýôÑÓ§O£‘5O½+fK;1àÚÒÃ6)K~UÔ×S‹¹Óõ‘i±™qršæ”Dêg©0-á“;ož<Þ:ÀÐ)Sså6§ßÿ‹yánÌ£ó‘3 \*ZÀãiëR­Oϯ—lÓr†ªÚæ«XI»½Y#Ë™$Ç[Eó òiݘˆXo_Ï?¾B“a+&–Ö…{pÁ¨î0D$n¦î²÷/ÕˆßwärGb$"ó¾FŸñÈñ„]%ÃLÌÅÜ\,áŽÒ 8¿mKb•vÕ‹»{!ôÑ—£ÊÕÍõ§­lÀ³^)Ú©Tnß¡$ ˜¨ÄlÙ…z÷iW{…H9ó¦,eÜÇ]³ewZã-zìÅh4!áVX’­ùš5ÍS"!ªfTdzêe[!2œGåò*ÛîF¦\Ö¥Õ™¡gΤûQ¢lÍ&ek6ycÄýëÔþþfÔ›…:-mý7¿·¬NÙb¢ÃváiIJº¯O$k¬S3„vhóFßÖý—•¾¡Rí:ÔMÝIâ²ùšÒmCçöyûo:ŽEˆ l‡-†ye¼­Aº¹K´vŒß¶XkßnP¢}®àýw.ZL-ó{‰Lq#þïËj$Äc«Þýö÷í%—­b2ëzlÆ«."Ë¢FPŽˆî²©’À«W_ Á…4M†DYpmêEwíÒ³xБ1ëÏ> 9ºð­–_ô‘Ðñýw—¸r/4**jÃ'_)µš6zn ®ñQáÚN›*o¿öØÍÈÈÈ€³¿4nÞìJ„õicÉ&Oa¹bQEÔÍŸ-øNÏ´­<ÊVœ¹…‡0| ªqò,4 Ö-À­¢ép´˜ P·…w7!( ãݵé³€tjÅì%¤› AÊÙ¬lÑYsç‡F„ß>·cðÇ ²y*•†Ïu~íWûoEEEž]÷û½ÄNÍê?5iÌžGð­ ðX+ÚOþ0dYïã×ïGFFœÛúyíֽ㞶?]ÍjìŀȰxUˆ„¥ŸM?¢ŠŒyäY­’)2äàO×F-þüN¼+ˆ$—Ü%JäÚ3ymBDŒåდÝ:­¶Ÿž~¢V­¿üüÓ°DM¤ËÆV#:Z~þrë¥áÁ›' µéšrw´S£ýƒÂÃÃÜ´š9ͲéÍmçîDFF^;¼ºÞëmƒ¬š"ø÷Ÿ÷=€’o-Êå?óÛç> ^÷é(—‚MËg3D¸ß¾OoÈØê&SŽ‚E)bÑï5KP§K…Ÿ~QrèSÆE1 éNàÝÈëßJ:»îë…»®  XÙª wNZv èÁƒ{W÷~þõ÷šèê ¾Þê'²îF!„¦i²Ž¸o–y_?§Á¡Êp¾œg¶“C‚¢ÄËwß Q|Ë‘=®?îÞ­ó’[eîœc"*XgäöEïÌÖ­C‡gÜ[î_óYrSBQ-žPä”öQ»ÞÃŒ÷vö8ÆâÚhß¾5g¾ѱCÛ1ón>z¦‚¯ I’eY<ªr+Š G¹AUó„öëÖûJ$Å]ûù×=”©àSÆ£YTj·6`óØ;?Þ…ÓŠyë0®% •@þQØ9D@.$Æáæl)„•Iˆ½ôؽaäÿëæmç#2ðƯØùv‰Ð>Û¾5ãû¿ªàe$¥êŽ#[Ã6ŒëءݘoýÖî?^+¯’,Ëi«/+ äêÙ±žá®~ °ù”í»gãŒ%ãûtìÐö‹ƒÎÃÇ·{¦[ßä*², ÀXmÒˆªŸ÷o÷õ±HÀ¶o놑jæ “{Ñ~§¾Œþz҆׆åíÞ Gè¹ÑŽuµJ=ü¡é€ ­Æ:ZL´¬YòšJŠüøÞ®;b¶oÝeÕ3Lºèõ Þünt§}Geº9¿‡YÕ4B’e "Gë['nœ4°S§vßÿ惵êçqƒ¹ÞØA¥?îÝöÛS -¿ÚÕQÙÛ¶eËiÖíúadý¼£z´åÑ6†,+’ˆìK­rUÏ.í§ï´nß·Á›È³Ííßîœ=¤c‡6“×úï<~¬€‹ ÂÿôÖ}¿€œ÷—ƒ;îo™Ü¹kÏsî]÷ü0Û@ìíó?ì:˜¹^)yŽhì§-QÐD@ኢücF¶Î—|(%—¼øxÆàË릚¾Êl2¤mÄt›FV!’÷ê´æ…$Ë’$ºyàç_Nß@>Ù“Ãoqß^]OXÖó«_½YÀ½ÃÛ~<u7€$IB8-cÞP$À"¹I’ì²g«f¶HvÊ$HdM=Š^ðÕ©Œ&_ÑÈôYÚ'ºž~œÌCÒããééÆ£ <>ô,ן,¿þ‡+E:‘%xÛ˜á2O]¸:=yõõ c?VÏThºþ´Í ÿqyfÞfOC׉œ6kpÏòLS¦§lšL3Íx™ë Ë‘n‹?î•\JGy|“®… éùöÓ7ŸNRÿã=-ãFÌT|zú-®gü”ž¸¿¿µäpŽ‘ªkQÏ°Cq!Ëwêl†@¿sSSIÓ²æÊÿfêy‰ô?n*QÇCYr;æK4Û±³Ô*ö ¬°3êö¥HÏj¥rüû6%Þù=Þ§r^/Óÿ¿l¬ÀÞ¡£içþx/Ù'àž3(ÂQ©”,äèÆrîÛO’0ˆ,è¼á¸aì?Œ 4AFH±õº?öpÄÐs—¨&§µfC·óçUWWcH¨ê*ÉüÒõÝ0Æþe$@'•«% s/æÙ%A©Žµ“SvÄGŒ|/ùÂTVôÝr톱ÿnåB#M"‡.aaú¹¢yg]Ö$HBwÝ ù­²ÕÅè+ YÐ-ÀµÆþË5€ ]!A>¾¶–­t‰iÒtÊùé|º*ìätdI×nûOWoTA2éB—²jtHšˆ$Yhª®!>)>»-{ßðP£œ·+\àŒý—«72 C"d„,@‚dƒ$ëÙL¦…‹½KæReYqW1×ncO«ú@* è ¬xZ1Ç cìá®bÆÇ cŒã†1Æ8nc7Œ1Ž.ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cìßâ>¤Cêóî½<IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/Legenda_rules.png0000644000000000000000000003235013051004444022665 00000000000000‰PNG  IHDRz®·QJsRGB®Îé pHYsÄÄ•+tIMEÛ %uq2ß IDATxÚíg@G×ÇÏìÞ{¹tPQ±cATº;Š{ïÝÄc‰i&QSÍ“¨Ñ$O|-1jÔ5Ö{‰½6Aªtn¿»sÞM¢D}äü>(»;ewîÌÏœ)Ë‚ þ}*‚ Hn‚ ¹!‚ ¹!‚ä† ’â1 `áXx¦ðçÉM¹Á!˜9ãŒ3䀈 Œ eD† g$8ñÛÍ»y¼uÃd‚3QF& B!KÈ6C¾ ¯#*AÜ<»Ö 2ÆL ©$ ÀȆÔÃiÛã´—uæüOÝ×0P“ÜÄ?BAEP¶ 3†œ L 9WÎ8óàhøƒ#f›&•`˜ž™lPM¥D$7åÕ™‡hÍÅß³6äB¦dË%ÁÞ^lu² œL‚ ¹ùG¦B[0D† ,ÃQ1 ¯KXfí,s ­ؘ%ªûÔ™f';‚@¾‚ ¹ùÛ&DIQdœhq×ã\†²À~Mùæªù¬•µR’‘ ’£¡Vp­q>6~ D@@†Œô† Hnþf_ ë˜äÀ qTˆ‚I–…mißEHÚ¢½ÞNo—W­·ËH¯:JY‰È1FZCOñ†¯¸#S·ò¢Žd¯îéòfM7À.²_R¿Œ6_`¨”SîßÇulUeUj@ÙË®2XØɳ ®Q'^*ð4?„DSÜ1&VY0…˜É ÂñœÍºKGÁ$z›ºL¬óAUE-ÎU¢ "˜_¤6½ð / fÊš6È3ìýpÒ‚äæå1ì@‰² W1‹¹ 2¸¡9½?{‹­ ˜D…¿mçõß”d` @L2(_ädbÆ ™N™#±'J S[ÛZ[Ñ|q‚äæe²nÔèb¾r%IbR0u[Ú÷Œ+¸(ûjû»NDà Q ˜À¦<õpTÙöÈ£'±¬“EѹéÁé£grZ8¥B>Þê¡ÙœÄ‹§L1P1;9]Ÿ#Ú‰ZEîÏ÷æªd•Ymn¢h7¸ñXàÈ,t…0Ëÿø´zÃ˽òßyGݾáµúëÿ‹Î4ÕôíõÖˆNÙ±ÇW¬Ûžf°òôZŸ– ,0¦Îíúqï™(­Ä*×ñ6v„›£"ýÈOó·–ìu+ÞšukàÄQ›€)éÜò5;r¤êÛ™Ð×¥ÀêAA³b,_»;èjÔ¶×k;ªºWÉÍ‹¢’M%fPæ›rP€=©«HyJ•ìh®>°Î$%·CÆEÆJ(̳´WSæÕ g¯¾ñÇ'jû8êîŸ;òÇñè©Öë52¯ÿôÅ1Ézã¡îÆ_§wþê¢Xϵš­’Ç\9³awøÃß;VªY³ºãU™;׬ãâh €N/ë>qy¥z ª: ×/Ýþëëw®l`À”¹7·ŸqÔ¦®dß:ÿå‘;¦å ‡·¢êN¼è.EFËsÞOøEìkQš³3îô™swØÇ ãrådä(¡™se^ŽÙ¥™è٨ŢSɈˆhXüf¯6mÛüv%ï½ÕÉgØ·»o­voØtáŽë–Xù÷Nð«ÿéUŽˆ†´ƒ爈’6ezO¯ÞïoÓX’‹ßÖÔóãáhΚ=¶S‡ÎÝŽÇëQÞ5'°éåH/š =«Ø l¢isÜBkg5çÐÃn´½ä*«L"  …GŒ›gÍÑX½Ó„v®(ºVvQY»z;!ƒÚÍ«ñß$XltÌQË&³Ùj¥‚ÍÀÌfJfhROGÞ²oC[°ªÛ당÷n×p`ÀNîÛÖU# ¡i W9J¢7+A©ê¼a¢RVêT'{4m*÷náØ‘#Š\ ËÊ{¥‚B%öÉuÑ>XðL9·tùÖ˜ûiYÙY’ïçëÕ J¥¤K ϱoêãÈXó¡o6S6 ,TóP<̈“›˜ ¹yш (¸¨A6 vÊ*½† hñ ÿûÍ´Œ#óÍÍû}fÕ´ÍÀ¾[øø4sw|+ȿ쨲$y¢A6éM ´&w0ñ²RqÂ-›‚"3‰² ·Êêì8˜Iª£§Ðàx-WÞ¿å(T÷^þóª)#ú¶ôtSsƒI.#œm€*úÈc÷€Y4k×Ûƒgn8"é Aróòu¥€Éœ …^mpjë,+Å—`GP¦¶Vr®ÉÌ6H’Ù¨Ï;þã{WrU&½Þ"’ d½s»êZú¨ÖÍZŸ£3´éç–}u"ݧ®+ÈÔu"Hn^Ê®² “ÆÔ_\ú·g £Y›“§{˜‡I¯É+vhÔäæëMB𘱾,vÖÈ~cÆŒèÖc³.ÔÇÝáäÇcv^JV©«;9&1zÐ÷® êÊ|ö¹[ƺÁ½{ 6°çëKÜúLѱ1 j5¹}‘E$›49ùªëÄ‹—VèÍC%¸"¾‘‘0¨Ú@P8fdª«'R´`‹wØÐò]‡â9òØÞ;¹¢_`H}g¥6áêKñ-:…Ö©¤Î¸uáø•ûm‚šÕ´ iñk§ÜJ75hÙŧ¶]ñu™–?ž(L™ Hn^„÷ÆÒ-NaDðrL»-9ý·øQñ²ÒwL‚BÜAÐw¦‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹yU@@´|Õ€ûÊð‚¯hÒ”$‚ ¹)r¸ &&J äÈ€s2Õ‚(×6W_áÈe` € L,X-€`bFQ)3‘¾ÍKdÝ<{gŠ È$¹È9ð‚mc(9S€À™ '­!’›gV‚YÐ+A‰È$Y1(¡JFD`2÷† HnÊżQ0uZ¢)ê‚YD X(. d¥Ù ”øóÙ@” Hn^q0&éïuÞ{ˆ ÏA¡`3t&ý²!{О“!˜EêLÉͳÛ6` ¿îwÝ1á?ù'20"&›ts?VîÛŸµg·,R !’›ò€›%Él°I›ü†€€\b樫Š{ñ˜…”xRoŠ HnÊ¡3*Y+A_-E£9vJi6*Hê9P©•Ä™]Md ÞAÜ<{wJp©¤kØ Dà’V޺Ť°ÎÞ¼¦Nz®’‰)í¬¨Ÿ50¤]‹ŠÕi¢#ArS.bŒ£\yåJ»¶ªŒf«_¶2ÉÈexа™Â·)pÅ«fÛ`ѼÎ'Íð¼ÿë ‘Ó®%é©…$7åÓ™bÀmÚb#ÆAHNÅ•+u{þ4¡>—CíŸW™@V4:þª<6cìîðõ¿:xýIÛ¨3Q©TÐ>ëÉM¹a–›âkc@TˆJ•îÝÙvÌ ‹  Áž YPú÷—0Xl ,Ëþúë3P껿›¥,Ãå¡aãàààà`ïð72a1Œ‚äæ¢f¥°éf5Ê\a6+E˜ ôéÉ@! Êõ¸(çŽñìñ͵³›> hÚؽq±sÂïk3eÅ­œÿzk¯úÜwõÖ‘¨4Vª¿ÃÌy35é·äâÖ¯'µönìîé?cÉÎô¤+ &„ù{6hæ×aÁÖ‹Œ1@4Fìù¿a-›y4hêÑlП]HÔ3ÆŒ1#;]V+×ÍìÖov&0]ʵE³ùy¸¹7ó{ýƒnef§M:ÿéد†Í|Ú~ôãY;D9ôå+&Qâ²,›u8ôÓ5ã~?Ù¯eóö-ƒ—¼ž”œ¸ûëÍšvþ# 1-ü»öžMf­þóöÝ»7¯œÒ»}—o¥š‘ËfmÖ¥Ñ~¾ ¶ŸÌÊÌEcø¸öþaS¿ºvûîÝè#3B=Z Z¤Eĸï}}›·mÙcõɘÄû GÖ}ÔÞ«éüÙHÏTä‡7Ëe½”žšdok¬¸`Ò¾ýD³„&Y’y¹ê›dX0=¨Cа8#"爘²cxƒ ùzÄ;›çú· Ü{CƒÈ9Gä¹ï ô šø›TJn>˜Ð!¤ÿgùˆyD?oï1Ë""ç¨ÏˆèçÛèëhDÄ[;g ˜µña¼»+ÞhÖ;&Ïr?Þ×wé‘hDùâ¢q̓Ädd›ss[€.¿g"ÞþÞÛ«ùܽ±h¹¢»?®·ï¨EÑÔ`ˆgAQ±{’ ¸ ýì?•z@QÁ £cÃœ8+ùåÊg‡› †¸© RD øÙ¨D;kwŸÆ¶ˆÀÙ´ðô;z_²4 ö#?‘lVÖ´+è\Ù¨QáW·Šå«¿J¥‚  aŸo~ë“z'6úÊú#1V¢])ËV{èFª«k—ZN€ÈÁ¡~¯Ÿ÷tP;dWU nT -ÏDA )HijQAåÆòÒ˜(¿¤û~)¨DµB6 Ü7±þÉ£ZdjQ,ß o™ÚQ(ôÂbc5¨ò°+ȉUímež¢5•õ1uçìÔócfôŸÏ[ð¦sjΕ*;ÊróÊæ£Fé\[õ0¾¨¬TÅ¥PŒE+Q…_§¦BÜ<%Œ1AƒÔþƒ«Š K‚ÑÆšét6³¿xóR¶Õ˜À$åÿJ/Ýt™ÊN6¥äq°€ð´\Èìm­žrÌí—™£6óÞ›ü_5[kk[Û”5ÓoM,eÝ)lÖRV¢@ÀqIw-<Üƽ}#Vx£dÐ42õL­½`ƒbÌÛ³³jv¶À9Ž“çâjBp”åôïVYq@ÒóùÚzÖÑêb.\Ï-°n ég¢"mÝ{º>åÑ”SפàÁ}Ü«»8ÚÛ©¼™œ' ûµAÁ®£{ÔôS·28Ù±¿O5îPm`HÜ”Ú0@.!˜ARùÓlf À¶.¶ŸÏW§@Q©Þ¸Î…çâÛB€úƒ'öpÈX8s²m‡ÎÛöΘчïÖ}ÿ³O›}í ùÀòå¯ÞIŽúyÁøù»¯&C\\šeKféÚµë ‰©§Ïðʉš9iú–C'Žï^þæô…æNïL¨À©i$7åÒ“Ad“1·T¢”&aµƒ¿‚£‹óÌIAD &ZºtAÑÄʵÙ1¡®»¿o#ç‡'TNî­}ë Àj~²ëÞ~êÃ?}õñW+“í-\¿²c¥Rë˜èæáïÝÀ±ðئi«µ*Ùü–JÛfÍjÛ´tcXŒog¿6vÊÛ§³}wýòi[ørî÷Ùõ† öNùãûÙóVeÛú.Û½& Êƒõ‹?þrÅ[Ÿ¿.~] Ö5[5÷vTVÁÊó…Gmj0Ä3µ€Š6S”œKœ‰‚)»k§Ã´mlNìãÌ™A?~†zíàÝ&ë_á¢^`Öå/yˆŒ1Ë¿ÇŒ1@Y§ÕJœYÙÚ[‰P ˜V2xÃâƒ*0WXÁàTÁEÆÊ&V¢ÊÎÖš˜uùzTÚÛª¤ÉׂBmkcÅ@6i´zÎ6v¶ V¿XŽÅó¥¹~Y7ÿHc1@•¾Í5LÝ{ Ü^˜J6v¸ töBÍÛ7óöü!páßcK‹-j·ŒüÍD;{+J(ºñâ1Š'ÀJ\&ªìím­-”6ö¶ê‚€LaçàhgÑUvŽö¶ V,~±YÉ;'ˆ§£ÂL1Ë·ì0`7iœÞFa=i´Aɬ€1¦tìíhW?;_d(^8=»Só"²nžÑ¾Aº¹)>ž#W®¢€¸¯^Ã%DbjÐËœ HnžÞobùä €ŠgÈL ©d†2ÑdÒcpo“g3³d–Im‚äæ f™™Ë¥ 0À@  PªÀJTŽnàJæã# 4Ÿ– ÊŠç»,YE`(2 "† ™°Ñ¯ËÕ«[÷î.Q!ˆrl}´eR©îVÁ8° àˆùo‚äæ_R›b3MÐ2’EzC$7Aü!PArCÉ AÉ A$7AÜAÜArCArCÉ A$7Ä3C Aâoðjm@ñÑG°k×óÞ‚Ïl†ãÇ¡jUªLñd^­%šMšÀÑ£`eõür´³ƒÐP?FŽ¤ÊDɺpvµú¹fªTR5"ˆ¿Õ@©‚ ¹!‚ä†xéyè{¢o®è£ÀøT>¼â±^ þ½§þOWFÒÉME,«±? 3eNîçòÞ¥'~÷’1ÆNÿ' vßåìo³xþŒ1óE-Ηu/Á«Œ¥ŸjëßའåòµOÆ&ÿܬN§ˆ|™6¬&¹©0¦I>Ü«Uß‹æ'K„`kç`gý×C5[˜Ü×ûŸäoX;kĈ)K´–ÜkG{ÅKR…ƒƒ£µªüîFP98Ú‹¤5å„‚Šàùš&X†F –œ+„¬ÔÉ¢èÖV,?'_Tü¤‰ˆì±¦Iñ ˆõ‚¦Xôù‰²:Eç-GjY¯ÕÌÖ%U¨t,(f©lÊ.‡7Zæm=|ˆÒÙà3{˜ÝãËö‘û!!ëæÚ4aÇgvš²JÊ¿Ò£kPÞC¿ß} c%%1ñÅÐÁ3—h’NðZß°àNcßù澞3†X(ç7=²OHHpPÿQSw^¼Œí]Ò¿ãÈŸ$Ƴd“4;ÈÿCI d%E‰ÝúsõkƒC^{û«èÌAA`欸oçŒïÚ)4$lêüå©f‹n!c,íìúIƒ»……t™¹h‡ ¤8$7ÿËŽ¤Ó'ÙïCkß°ž>ñ{>îñúÛï~û‡gØЮ­ªý¹vÞw»®0ÆKÿzxû/÷ÞõiÚ54¨Šæüˆ“"õàÒºÿäÑ!L«ì9õ­î¾uø•­óƒ†|,×jÙ5´£"nËà!‘©Á*+bùœU'ýºéÚ©ñ• ŸÏ\ùgiSB2jò´&nÌÏIýv νûðrÕ5¼ÏQ¦G¢´÷®_5{›*M¦¼7­@Á³¿9ø÷ÜZ}û÷m\%wÁÐÞoqƘáÁÕñ]BÖGa»à®m½\¶Ï0xîzDp@6hÓctë÷Q®«PP'»5¬ëkçX„T÷ë;Ý_ÿfoMŸŽÝº†6±O™7aäî;šf¾ax}õá ‹¢‚öÄäÕÝÂ$,&d¦£‹ÇõŸ±ÂÞ= kX'Ûû{†õx6ÝÄc†¨©zîŽWµ îÒ©uÞ¥ŸÂz˜ Œ1veǧa¿ÌwñîÒ‰G, žöZÓ¼ªr5ï_š6E½þygŒë×ÿýàé‡'4mÔak¢ Q6.{gpÛÀÎÇ͈ˆ˜õyˆ÷ ¥»‘G¯hêÝb݉DK,Cæ‘­ÜæEʈ˜o {Ð"¢)ïî„àÆÖ„sK8Ý…ž^s¶žGsÖ[c;ur#»àÊ™oB=,+}?á+zøŒ^‹ˆxû¿>^>£~8l9/çÜÝÃ{Ä® Ë9çˆúåz÷µ@c9»Ø«™ÏÄuç-GÒƒkƒC½'ýp ,ìæ;pI^aäìãŸxùtÞ—…È‹ßÀ…zyù´þêhœåИ|¡O—ãÞß`DÄŒð°öM'/¹(„Íÿ<ØmÜîx̺ؽ³ß;«®qDDíÃ:wŸò™VB|p6,ÐoþæDDÔÞØÒÎ÷ÝUÍ‘K™Ÿö÷h;u"æ˜PÛoplŽÑ’hÒ‘;´òÛ‘Œˆ‰ÓÚ×w¸ ;žöyÏV.çKH”dݼÌ5Úv­¥@`‚£µ­RéçYKNn•PæÐdbÔ•‹£;ÔnÊÉH½™+1Ë(ö¯&éøõÄš“§ø3˘‘u˯—ÿ§‡O]@ntpáîĪÔqF‰?ùƸÂih'oD@Amgcm…2¤óeÉ‹u±¸ªêÈŽ-±D[¥JD2÷o‹kÚðþ•ðȈðÈȈäÊm¼Yú±ÛY¥]"B á-ê"ª\›÷¬6߀PÙÿɨÿ›ÙB9?ûÁÝè‹ ‘#€³gŸŽÑ—vêeà)WÿHÊòo;ÈZ,‘æ͘k]¥ÞÃ[(,E#V Ð[>·!†ƒCèÊ„ˆÍîŽ*4ë2R¢nßåˆÈ€Çm;õ Þœ™‹OŒUùv€d”©Æ’«øº + …ŽHdL!6Á‡˜ä\ß>çã•1ù’Ù,™9JeXõúÔ¨|G÷†V€ ‘¹µëî¦l@Yp®U”Ñß™:"ªì”V–ÊߟHƒ µ½BY"c‰qUÒªycV%$I2äK§`ëdk­zX™·g%M¬Î`–A­àɧæÍ[|..Ý$If“,ÈÖîêãý¿ù0:Y+›/ŸÍέޣãG4,/7YR4t³yx?PÙ¹¶‚KÊg¸¾÷»Ï¿Ýžj0If3—,â†ä[çº ¬Æ›F-å;TaIn^q²N/ ›ôÞ}^{FûFõÔ­.L ô-Ã÷¬T †dC‘ùÆœÔl´¯n÷|‡VÊÈÇJ!‹£~<2ÍÛ¹Ì1 æžÉ,ó¢¯#kr ¢R- ‚!ñÌ “™ï€©7soè^ÏuE·s…ê4¥¶÷o·²ëùUüik›GõQP¨™”¢-Ì€MFŽ*[¸õóÄaKcz~ívþõÝê;&ì1å3mlECº # >ÓȨ@®âWùØáH×–ó>žÖ¡eýš•¸.[o.£…ÛÕíà*G쎆Œ˜Ö¼ÖõÍ_΀øb=‚À½C#íΑE6[æöà–¡{og•vWëî§ÜÎ.‘ƒÌM§2kTwµU ñ7#3 5Þ]üIÿÐë¹20eëŠJÃîjî^üņcâ䉥o¡v wµ"æøÉ’?¸uÌäàmeܸ)Ê3løÇ3Ævhé]³Š6?€ƒ•G·úºk#ó &"\þu¯^E¯d’›WV£²µÖyí¾N§M»¹lîäëunJzaÿKŸœ¤1š$»j-]6ÏžvìJ\jr©õŸüxתo ÿM-á`6åfeiÌOì˜u6.Ë;Ÿneìv*fÔcç·×~Ð× j¶ì5.`ÍwóFí¶VHFh>añG#¿X´zÒ̼E‹ßjäíom«t÷ tV‹…îsn2%l~¿qÅ›#ÆÏžxR)2“^ÛjÊây¡5؈¥ßí7vâÐs ÆÊï~2ëÚg_~7u|óýëÇ~üߘ‘þz{¼µRÐIN³V,Ø9ásZ0U~µŸŸã@8ç¼ø˜2/v¡`”¹Ø€3"ÆG]:w!2ÀˆhÊL8þR†Æ„ˆš´ÛçÎOÌÒ"„LŒ<þbBŽ¹d6>ˆÜÖ¹¥ïÊHSÉ[{˜{Aþw£"Î]¸t/[*q_\qîBdŒµ ×ÎEÜ0H $ÅFž;)U#a餉gàÕÚͯY3ÞÛk…„À˜1å¿›_ɉöÅŠ[ëJ„,{9B9¾ŸJ-k`+,”¹x.Îí=ënÝÝ?}_IU°àK%P8ÊŒÁú÷ƒ¿¹ÔáØáùN¿Ù†ÔÃÔžP¶¥VYÐJòÝTï {Ü+qž• ùï®^.™>ûËç¦Âþ£Q¯ÕJ¾õØã°ü—¾Õ·QÍoN[ÏXø¦Ó“v‡`eßÎÊöÑç!­!ß ñ Ñê‹=g‘Yý“¥ÎþýÏ_남R*Ê6™’‚(ÃÀVZýÓÞ/D+µHu¦‚ Hn‚ ¹)×Þásï’〠þfŒ”hinIDATë|¥žÆǼ¼žkûÈÈ__ªIñׯæWgÞ " ‚ü"¶  /ÛDÅ’‚ ^nÈULÉ A$7A$7AÜArCE@É A$7A$7AÜArCArCÉÍËȓך>rõþ£¤‚x¯ÔŠð«kwšuzQ©ô~­7KÑ¿î7iu ¥¢a¯Nv®.76ï×efcÞcû)­­®oØcÈÍ¢[h;'·š·vË»Ÿ î}‚ìkV‹ÙvH“ò€ Ì-¸s£ºñGÎeÝŒ„šm|ªû7½³ÿTöíD`¬v{¿ªÞ©Äßá•Ú^ëÌ—«AÍ’ç¨ÞÚÔŒ‹ßþ,éŒ1Ûj•õ :ûõjIg ¦F=•u\/,YgÖêcJ;'·š¿Ý IN—Mfµ“C³á=Î/\cÈÉcŒ)m­Õ½ºz{Úå.ËY±w«û7=¿x]^B 7I.^îÀhO?‚¨ Ö "2ÆR#¢sï%«ìlëu @Äû§#uéY*{ÛÚíý”¶6É®å'¥)¬¬ÜBÛ EÒù+ù‰iJkuÍv~j'ûô+1Ù·ï *EÝÀ–*{Ûô+±Yq ‚(Öjïg]Ù)3önfô¦k´ô´suɌψŽ·¶«<û´Ÿ;ÅçõþT™¢¢t¦.¯ÞvýçÝî­TÏ3ß康™3Þç5’‚ø ^Wñݧ³o'"ÞêiÌÓÈ&3Õ$‚øK^ß &óý0Ƙ=¤¥ÿ—›Â+òæ«#7±ÛíŸò —¤ç߉ûþH5cÚ×–-üñ>>ILÄ¿¡ã‚c]ß&l”Â?Éßtâ—Uvœ63ÀA„—¨pDAÊOQ¬àó%^¹¹±õÀí½'Qâ/¤b>…u?_ÆÅR§ðo)""– Îê³b7­þ- ËÌäIs¦KÏ®¶ò¼éǯë9+Ÿüt%Ìá¿oýýH¸üÄNVÙÏ[êÔãîót á‰EÿØ’ÁÇdYp…\5¯°ïFT(¿­éüÕ¬ª>Oa]CÞ•ïÖžì1fªâÆ{/Þ”EÇ]´®ï\à¹À¼3{ÿ¸|'Ž>{µ÷py¤ÓσœKK×_¡ãÖZ‡vkÕY‚kÏþ±+âN:S9ùõmÓȉa 7cìîîÿ;ÎüÆv®¶sûþÄC¥ú­õl§*tž˜R®í9t&)G/¨ì=B»øÕf÷þp:«ÍÌ‘þ¬ ˆs¶.ùAì1£¿cÉÒÖßûcס;é+‡í{ lê"@áÃÜ>¿ïÏðXìªÔ êÖÝ­’ª Ðõéÿ=69צZãA=ëÓLÐWGn|& PWrâsηQ¯ÎOé0ÒÜüeÓ&mêÍÇÃÝêTKILZ½ü×yõ«Î¸)ëÓ CÜÊ·µ·‘uºŸW,n;g÷’! õÁæGmüeã ‡Ãrk;CbZÖŽÈØŽ‰›êë×TdƧ¬Úvú³Kú)ÞþíÃþ_p°¶±wPëòòÖ¬ùiîŠ-=›UAÉ”•“Ç™1';Û(!hîM9êòÉÑÞJ«Ñ._òã§{öõªÅ˜æît\ß°†2'!%kÛï7¬›ëT²°yꙵ¿^ï9hh5;d_ܸõœíÍm«/åzÔ¶O^õÃÖïNíjo_¢Ñuš|3Êb~–FÏ‘ˆ÷N®¾ö k½üôûùë6ÞY±ýÕ€éß2ìÏ ÉÞÉóóÖ¯Z<{Ó'ü„’e’t|ëÎw/ŒIc k Æußmw`ã '€¬«ÛûMY 3+G[c^žþ§ïNÌÚøñ0OSVê楟u²ÃKÉ€9jå«O¯÷Š sâŸý¿%(ím yy?-[4kÕ¡ÁÞŽŒÁɽÞÜžâ`ck«´:íÞ¿ó÷åuU M)ïŽîs:Y°V+%“yóîÚV4÷_ 8ç/*ë½û]ÛðûÓÄLÚÒª¹àè ˆˆ˜=¡[“®sÃ1fíÏ}w]Ï@DDÝö/F7oÓåø]=bÉÇLXëïã?dî:K×~™ÔªYÃQ‹ÿDDDyõ[;vr[‡hHŸØË+pä·y–X¦»5¾ú¤å(ïÎÎö»^EDÄ_÷ò {#"ÝŒˆ˜;½W@ð°/ó/ÿ2´¹g“Ùë¯X¢\Y5Ù«CïËIúGÈt~^Óöý£Ó ˆˆ1_y7ó ¹2Ûò qzvh:uåí’?G”¾2dÚˆˆùѺ·íØ}èÅ3""f.åÛ|ÊKèãË_ó|î¾ó÷þg¤WÛ~ײ ”ÉÉ·‚<½ü&~·ßR&·-ëÐìýU8â†:z¾u×h ˜»lX»7eÔÇìîØÖgÉÁ4Žˆ(mß¡ÓÄF™còÁŽm›/Ù“Š(¯œÔ²ûÌ+"¢öîF´n=|¾V昺¿y÷iKY5&ŸæWÿ½óZD<úah³À!ûod "JËf hݦÕW›.aæñÝ0Ænî<²sÈìç?ãά3ÈFÓSj=S 2´¶" ØÔ«]×YÖr7¬‰ðýzïf•ÀºßŒñUõ9®F—v¡ÂvHï0+@¨Ñ¼ƒ`¬;uZ ¥HüëV1ƒ,s@U奛Nï]=ÍsÊšnŽ\g.ð–Mf4qˆûic|Ïé“ü\ˆvf¼19¤Cm€ëí»¾7ÒÛâ‘ðîÐ@2rù¯fTJB•YoôwD@k׆ŽÖ²ÞøÈp €Aæ€(,.0nòåW]€•¼[V—4–²Í;ôˉÀÙïÔPJ’$I6ÝÞþÀ+ÿæÞ[¹e”Iõó_ïb€ ƒÇ ®[ùRä>£ ƒ>øãÒ¯ë©9°kPI0Ê"ª´¶±¹rzG€ìKkcôB”çp1L7ŽK ÷‰weÀ¦ÞÛŸ•/þy.—ƒKÐñ —O낈œ£X¹‘‹¤3ràQËgæQ@¬ßÅ«Qù> 0àÈáÑùrì¯#ÄaÅFИùá¸!GïK-;÷ éÛ= sÛ3cšü\Z–e³Ì, ‚YÒ@Î9BÁø‹u;pn4XMXµoŒ»CioÀ#.Ž¼x³æL°ŒiïørÌ×»ïÖkѵoè IíÚä|ÕsV~A˜zCÞ¨ýÕ;‡RLòùߥfS»T+™çÀPFVô‹XìdyºW÷éìkvëÕ§OØ°æ­Ü…5É/ð-—üi¤êU’¿Iƒªz5”ÏÕUŒœ7ìX¾Ràæeo8+¥@DƒÜËçr­ºV«üTä&_¼p5kܯç'yL}6šyùVóª9áIÙüjXòÛòõ¢ýÇŸòÔÓúžÕsŽ\HãîP0Ȥ¿ôŸG{½5½™³ú‘°yñ©Y2Ú),¡Ý&³ªkK;ˆÙº12hÑ¡/ºÖ±;gæGfס{GóO+~®~èÁ°•ÝŒ† ,Tñv³NÙ™×¥‹³%Q9þð-£ë”šªð=3—Å›w·+øqôfËį*õÝ8‰p·D1ÅE§TxWñ+â»Aĺ[µýp’ x¾‹á‡z¡—Wo/×TFMñ‹]÷ýö#C.›u›®Ñ89·öiö”oH†ŒÉ²( çr^øÊïcÔÈEo\ƹM_Puׂï¢ô€œKy KÛ“–foÿ//Ï@äü¯æ0TÞîÆ×oìK8çŒk6¿óÞÖ+ñ•­”¥ËD‘1뿧çüα ;’5-ýº)d"“• K!O.¸dT X8’.øöÔYqÝ%pdS[€b‰‘ƒ²i§nõNÏy58ç`L˜7}ƒMû 6΢ÄfIÎ9ÜÝ5÷hº—%€ÆÓ{T:±~í¡dC.™ô«Ön¥©WĺaŒÅ>›|áZëw^{Î˦DåÓNES^^¾éá¼DDƒ6/ŸIÐ`à·o^3'´ÍæV^b^üÕûâ¤O—·­£|t-7æåå›%,l¦¼Üü‡n$Ù¨ÍË×p®­{´«²lTØõöž“”(z ®´nã¢ÏPœ3%P©®dm}ïÓño {óÝa³V º9j`»Ž-}êå%F¥Xù-\:Ë@2ir5ż¼²!/OS†«XÒçåi ¼g„AY“Ÿ'J;¹Tu«àÚðÓƧ¼¿h‚V“«3 dÌÏÓš,š8â³AW&ÌîÑÚ¯y3ùAÜ•ÌJ-z·šXz}–­[“êÇÞh{¸‘»³9êrLã¾ïÏ|Ý=&`ö¬é[:ÈY·Ó½:WývÏ™ó=–~1X Ð2 @±r¿o@€³B(˜NÃÍùù¹3G€o.¸qsÊÈ.üšÕɺ}ù¾uóEïN±bÐ"¬§Ïú­ïèàY+'þf~½àV^Žá ßÜ*~6hÎOcãG¿ÜÑË¿1fÄÊ Â¼¤h­I®Èróêìw³cð줳—'ßÜ«°¶zžù.oÔ­Íœ ÿt¿›ÒköŠ/P´\ʽ}fßéàT/$4¨²Y ùH ]’oF1gKAÛ¹svω\›u h(ë3þضKݤkhóš xü¥ƒG¯¦·èÚÇ»†#$„<~5Ñ¡ž_·NþªŸXÑÍâ÷Q¼©—X¢ùħ+ñ òþüm[‚\«×àgVæ‘¥¡€À¤ß8yøÂMeU]ÛÙ°2žšÝåÃü¶‡V~wb×…;ù[‡´ñ¨n©äŒ±ôëÇ^¼e]Û¿G°¿L§¶oLqj; ¨±ù·žS ýúØ”öŽÅË­øóÄß{æFŠsýVÝ;z‰–ÉÃŒ10]Ü¿ãzªäÕ±k‹ú•5‰W·‰ô êç]Ç.øóêýJ;tkgqWè%š¯ŽÜìúv⩈)·ö=g¹¹±e5ß&•Üë–wïðqy†:Z*±"•(Ùú±H[Jý·zÁÅ2üË5ç]&§fwù0¿Í¾eŸÛ(}ˆ’áu1oÿrØ‚?*í8õCíÇæ^²d,©•:ý°À-ÌŠ,3¯ž«Øc`˜l2?ÿáî}»0±ÜýÓ6ºgª¨¥{Ü¥ÒMýßn•ÿÓ”I©÷'++|QjiþÔ÷í¥*;}¾§öc%ö1¹?¾lËõ'$ëæeâî²)x¼ÿÔ¡ûSezH=»ç‚¹Z÷ö-û½c̸{àt¤uµ¦!­=žl_dݼI’ÎDÆí9ÑáÓ7žóàTî½dCNÕ¤—„êmzöþ‡Q¬ª¸õîãöwì+âyu6 _¶ùêºÜü¼=ÿ²Ùüü§2ÉÍ‹„Ëò#;]=Ë·1Ÿ|µø¡çÈžU½Ý©&DEéL€Ç P•­MâɈ”K×À-¸µkK¯´ÈwœFÄÚíýkwhž}÷ðYä¼F+ïºA­²nÆßÜq9ViÚÀ½oPv\BìŽÃ\’]<Ýö옗rcËÙdv¬SÝsToc¾öòŠ-²Yrª_«énš”Œ›÷™´º*Mº¶ò¢šDEnÑ£ˆGÿíýg¤GÅ1ÆAtméu{ß©k?ïÎÓ"¢kwh±rK± L²oÆ×íÜ2ùüµ«kw‚‹³{ß ˜ß^Y½‰¢sýZ {vL:}ùÊOÛ£ÒÎÆsTïì[÷—ý*ª”j'û¦Cº%»¹r+Ê\i£®`W½ U&‚x2¯Ô7 3ænöD@¬Ò´“[­Ü„”×o@¥†u+¹×ͽ—œuêתìá¦MËLˆDûU«ù5Ѧg¥FD£ÌíkU­êÝØ•›rñ:—dueÇZm|%ƒ1áøE.qç­¼Œ¹ùÉ®ËF“•£}­¶¾Ïž Hn‚ ʆÞÉAÜArCArCÉ A$7TAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜQ±ùKÇ.b ÙIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/content6.png0000644000000000000000000006741013051004444021661 00000000000000‰PNG  IHDRŸ8 ™i• pHYsÄÄ•+tIMEÞ&B‹ IDATxÚìw|ÅÕ÷ϙٽ]ÒU—eË]îâÞ1½„ZBè o!<ä Òž’@ @z7½Œ1à†î½È¶duéê¶Ýóþ±{› 6زlé|?úØ{ïîÎζß=gæÌ4M†aº‚/Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n ðº1 ðº1 ðº1 ðº1 ðº1 ðº1 ÃêÆ0 ÃêÆ0 ÃêÆ0 ÃêÆ0 ÓÅêFÔfa˜nαòîk_yOD BJ,"ßw†éþ´÷îÀQ÷þk‡^„£ßl¸1LO5âŽBi;$u#²%ÜYÐ4l»1LO6°)EˆŽ…®Û!Øni'cXVU]c4AöN¦h›G׃ÙÙ.—žÐ‚îå™"¢®‰í[výöÏÅIêšÆ} ÓAñXÔ¯Ó7.8kÖÌé–¥ˆèè4k­ÝÍ9%¬ØµýÕWçž~ݯ,î:e˜nk³hn—ÑPýÙâ÷F ^=kÆ4!„eYGgmµÃSŠ”ýËGœvéE@ ·¿1L·U7—B µŸÊ˜ß°,SHŽNóM;\Y¦j$PŠŸ†éÞê‰F¢DÙIE뎞ikG¹ï”aº«º)@fÌÓ4»6R„Õa˜/ᙀ0 kóŽ-n—&5]eFÅãqD5j”Bui€«Ã0뙦L9]×))ôІ•o¿¶uK…aØö¡ž]P>}ä¤%>edêßr†Õ­‡i©¦MO-|aºóÜ.ID¤ ÀÏ>xöu¿œ2m¬ÉÐaÏ’'zwõÞ¢*ÿñcúø…æÃõÿ½wõ–ø )÷ta‹AB€Ú¶îí?½þråÔŸ|[6¯šû¯mƒKGN˜\(Ð0)ÍñEA±ý+_|÷±?¬\½#fI)€Hx‹G9ç{'sv¯\݈+"”@óþÍ ^šÿŸ'Å´Hpø ãäj Ç¶oœ÷øŸìtû³5‰JqŸþlòUg_÷ƒáý‚`&蛑%Žauë1ž©½¨Ì¨Ae/ûóìi3 V¬i÷'Î{vîÏ ë3pÀ²l$R;_Y½»Â‚xÕ†å»Â}†üC/>ýÌ{çù…ï\7ࢢŽâõ›ç¯|k>â‡c'ʪ\‹DMÓJø¼˜lnš·¾?ÿÁÿ·à³péÄ‹æÌ>¹(KU¯{{É»s<~žç¦A!T½qÏÞ Í¦2Öm¬ØR5ª_~â)TfKYvþßùVy©ÇŒSdÿº•¯>ðñ»÷¿ìÊ˾åê>Ù>Ë$ B6ßV·䙦–…2¿pèÌýñAùˆ~±š=ï-}wÅeʲ=^Üõþku±Ü±çOÛòòŠÝ›7Ÿ0ôxéî;úò_yÿÊÏÞø×ÔÙw ôS¸vëæùo¬0óìK‡ò†v(¡išL6æ%º4Bdû¦ùýpydÈù¿ºè;——åÁš6»|Ôè¹ÿüÓò7ï7|øÔñý„†Hf͆ÕMÙ÷„±{6TTn\š><×m·Þ %r÷;gø@ÀÔÁ#y~sÝ?ºhÚ)ç4D`)6ݘƒ‚ãݺ+ÊŒ…b-m¡X\ùÃú– ÷uá‹Àmn_þÉÚxî9³Nýú ߎ ëW5ǽegžtñ”Ð’g/Ü.hÚ8oÑŸeMºxüìã|ñ¸a¥dÍ‘Q":´T|¾þ7µÁçͺô†¡ýr‘@Y¨ŠN¹dÚ)sü +6-_Ö©Šî«Øº¾Q,Fêö¬Ú¸ÝÝÿø)åÃ\ñ&2- "3à)*>­4WVí^WÝhH bû·TVlŽç âƒùK_üONá¤S/¹ª"!z»Ê„*¦¢õ–˯{ò4¦#l€(ݺ擪>n„FMÕÎõ²ßq£&÷sçŸ8qxéc›7¬¯¬VùýD[¶mC)\^·$¥,+},›o «[”7"¢œ¢òYûùMS²„·¨ï‰g|v6†>ÿhçî ·,þÏÿ­óY¹,BfýÛ4^>=O¡+P6á„3V=2?ïøoL>!× Û“¸uà€p wÆ·Z±%ÒKR1Ó +ÔÜZÀ¯ÝR»qeÃþ¦M Ÿx©®¯V³¨ÆˆÖ¬^³ç΃´7£€EF4jI·îÖdŽâbV·žå˜‘ÒʆŸsçy§eÇÂvË¿¦»RH—W®¯Þ¦èsoþíED²@˜Ï®©þÙI¥.C¡pŠ |æí?.ßÑ&j3<*Ív# -/;<^­©Yß`LÊAŠ)g*‚ÕÒX×Ðò–óò]M{wïØZY·ogÝËwþŠ†dÀ'»v­o6ˆÌ£€0#{÷…É•[ÌÒYÓV·ž-o€šîÍñeåJéÄm(E A6mÚºþÓʬSO¾æ”Þ….eêš±ñÕW_üðÓ»N¹¼<´‡j¥†Êq[YTN0Á—Ûgì°²ÈÊ‹·m¾jòa4’"Ð\€±ú}VV½§Ž+ö…öo~ww(0蔟NœÜß…Q¥±âíŸ{~Ëç[jê X&ÔY‘R ˆPCM¨¦óö…d°ß”B_Ø#dÙ3eXÝz¤gj·é+Ó2Á²À Pšš7lعfEöø»¦^øݾù`Y€aEpÉ{íyõ冫ì‹¢Dš¢væÝEáòy³!2æ4ð[&øûŒ~ò©K}öý§O(üÎwÊŠP"¡ÐŽŸ\øö«Í¹‡Mžà‹VìútIÜU<þ‚+gN¢›qKózKömX¼`õ’ý{†• $…zN ß,‚XL€‚Æ-/|ö•&­Ï¤Çt—²’êÊÒÆ°ºõ4iÙ·HH@¨ k÷Îå;våüÚˆ`¶WY@d‚»Ïì‘¥yÛ7=º²êÇ'!¬„@‰" MH«e˼¥/»wúŒ¸IH¦…ž¬3F 4ô´'­üÞ‚ÿþä±ÝËÆMšë‰×mùhÕ/ïlé=áòëŽÛ+²}áú--®àäýK4!MÓK ¨pj¿¾Ç»—.Û¹gG¸X×Ü.¨\±ö½—"k]¦©Œ†ëßüû§Kkû_òË cÊ4S “€‰;OV·žá&Fb€Ñ´Õ «P‹‰Â'$R¨#ÕmZÿÆÓ•fÿ©ýyì.H4\Áq æ®\ùÒƒŸ|× Xm¡êš½•þÆ0H8JÅ›Zª÷…ö?úâê'¥“—È°´ÁCÏúÃà_|-{àœS¾ÿ'Ï3YòÉ¿^üð)ÉwîàÙ'ó†)gœ¤}kÞÿïæÝû Ï^ÌE”" ŒSÖ€aÅÙÖ Ëç-™^’×2Ô–§^¹û%M"©x”üF]tç)—žWðX–D;ˆy°ÃêÖc¼Q'­#¡VrÒÃ×ö¡’ÑA#šH¿Fˆ¢xÄE¿½öìü#ûIOÅÜÅçüùê²½ZqI$ ² 'ÜtݽçùŠGœ–<Ër{}íÌÛúNhŒ9 @–Â@vÙ8M áȳOùÁðÑgoªo)BéæôRÚ·_V–gL¼é}¯ ˜œ¥i!!€Ù‚9ã¿{áo¦D³Nôùf~ï‘a•õ©Œo¨¹sû•YDE*‘fÓ †cV·eÁ ¿ì´ãzƒÒ´þ*‘-X<îô"B{KŠH ­hʉs,@ÍŠ¡î)9~lÑXºe’Ý3JJÈààô'ÕZW…æ¤×•ž¬’þÂ!¤" RT–ðå š>j  ÐȲ3UI"gøà)åRH,SÜg´Jµö¡@RJt’r&S³gÊ°ºõ0ÏÔN„‹R×%RD ””šÛÞZÙ¹=•"¡iBs¶CD¡iR ¥±Z ]ÊŽN@ˆ(¤æÊ\áhJ]sjh'†C$¡énûBk¿ø„˜¥Æîsòq†Õ­gy¦>-BÆ2&DÊö^É’ìðŠä¬ ˆéÛÙY¾¡Íîmµ’Á»é¤*ä ”BDˆlG35ð ½rkL%BžY9xœi7”¹´ÅäÄħÄä+ö@©V›Aƨ„d¯)àå;jÃÔ¡63[/*×:= ÉæE¾Ï Ûn=Ì3me=Qr¢—ôOv#Ú¬Ðù[Y[dÏú’ZѶ|ÛpCB@°=ÓÔ™‚vk•Ü9a¾µg¸9k“æ&›m «[5Ù2l¯ !H|ÂÄ(PlÏÚKÛÚ–ÚJ\’å´.®U…Ú­¦[|ؾÑÖáðgÊ0 «Ã0 «Ã0 «Ã0 «Ã0 «Ã0 «Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n ðº1 ðº1 ðº1 ðº1 ðº1 QûË|T ÔA‰ïÓùpæñž'n‰YAì ¦ŽÌa0!p<3ÃêÆt¢Ø)@$ .pöÌ¥*1O¶Ì°º1 kŽ¤GÜÍûÁRî KÝðçÞœäœ}¬m «Ó b XǽøÇãÿtW<àï<­!"n€ë¿yÃÒ«oúò5ƒXÚV7¦3Œ7G[„aöÙ<Ë™}ò«? ÃÄNñOÉôx]õu'<ôëü½«õ»[²ò5Ù3eXݘN3ÞH€éòÆT^] ·ï¬Ö7à CDÝAO<¤¤†”¡° ÃêÆ$…©íôðéÄÓAÍgŒÉ@ª¸+jHSGJß=½œv¿!Ú^.Bjˆâ`.Ý$BL£-ß­4Ï1Î@¢”öt rj.Q`ª@–9V7æÈëVrÒŒjíð€"Ö°¯fOUÌ0 =°-˜äÞ%RÊ6Ã/p !áÅ¡2£õ{*B¡¨¶‚¤Z¾Ú{@D‰ ¦ I #ÒØP_±»¥©¹cËŒ:ôL‘bûë++£†(ìX½ õµ·Ei®Úµ_ƒEà¨ZBåT¼¥©bGCC ä`;V7¦K´-alPÒì "$JY±#BOv¿ñÏÿö¯»ëê“©m.%_Þ ¡Àdxš”üDŒ7l÷úoo_´d‡žƒ"峂c-9§* iæ’­‘šu+žûÍÜ?üdãŠE …2)¶™ç˜–.pyPw!‚#]”¦a ”¨»íÛsbÑQ̓n/蚊T¯]µðù-Ûk5Ýšo‹S=¡nWOÚ‡M7 ¤°Bó—½óïu›÷“æ‘ièÌ´ÏQ×h.Zšß(@€Ñ°~þªÞ®nj–npû@w¡p|eç4x`ßæž]ûÁÚ8©Do"×ìhE@@BûYázÜ«p”€ÉÆxR³”Q‡Ýš+OJ—e9£Ðm] \ÙAO Ðãó’Q‡A]îl+žxó•R€(5Dj‰‡ë¡Ð‹uMS*Ã-$ (õ˜Þ¯@×Ý~·7'ÛUèñ»É²]ÀDm…°êcÑfnÝ•¯éši¨´H $+RÓ¸oSØÛgÀ×n,.‘Ö^¥”}ªŠ%Ja¨x]ÜŒ =_“ˆ6ùQxm-ÔÙA—×ã³1n"™£iÙ¨”s8BÞ¬x˜rŒ(î’“nùƒY0F‹€E€€Ø7eucŽ gšìÖBšM[>\öÖs›6í0ÝE}N¼àÄ™'õ*ÈJ´‰9f)±Êϼ6wÃÆ Ùkúä /1°,àè!"J´Z*·-xré¢ZÁ¸‹¦}NŸ,­U£Ahï¢>šûRu,»Ïø³ä))T¦¢PÑÊUkæ=³jÅçQYÜoÒÅ“O=¹Ð§–=zP ¨–Ý Ÿùèɧw×¹±é™Ö¾¾ãú£Ž *P×âõ›Þ_òÆ‹›·ìÍ~Ö¸±}ö,[îqêqÓ&ùuT*Õ†(Åö¯ûôãykVm¥“O<ãâ¡CûëI DBçb(ju2„€̦½Ûß62.«´¼—fÅ£$Xݘ.iu!!¾ç½wî¿íÓ•û=ùAŒ®Þ¸bUeMä¼ožWœã%+Í„nw}úÀOjêã(Tã’›ÖW^ýÛ»†ø"‘!0¾ýKwÎýÏó՛㠯[4oG\ݹB$©¬¦µÿ}úŽŸlåäûöìÚ´&·—éò&´À1ŠP*£vÅ'þüÝy+MwÐE+6.[¼¯öwßüÎY–­4dF‘¦0…­8U‡1ät€Û ëÞ|ç{¯Ü)}>±g_ÅbõƆqW9ÒG½JÍMÍÛV>uGÍÞ0™-M‹Wî­ƒn>¨·tR*}QŒ1"»7½ö¯&múôó§ˆ(Xl¸q»s$Ód« aV~ðÏå+v øÆïoú×¼ŸüåáåñKžÛ¼§ÆJµ¿9ê&"Ë·ì/~óã7=ðÚå—ÍŒ¯úÇË/¬¶Ù&”cHiP¿æå…O?Ö\zÁ%w?ÿ£¿>6gLÖ–'îYµ³š„–LðFfÕª‡~¾®¹lÖOŸ¹ù/O^tÞ ‘Ï_Ýky]"­¡L Zu ^ðÑç'ýô»{ó–?üeú–5/ÿßÇ«"nOB-"(›uù¬«/ï;väÀ ~úèã†^§ÝÁSÈ ˆÐ¦÷ÿýZÌ1íŽP Fãžu󙹧žzÍu#˳4쯅wmºéwkß_xÚÔS0 „`~pò²ò <^Ÿ'§ÄC9P¿Ë®¸®CóŽ ë–îÊuÞì‹.-p—_©\´uÃKQ¦ÛˆÊŒ*oïÁçþ|Ω3JrÁ=çä=ÚS‹[·f·²Ñ;¹< «“þú‘£ È"½ÿ×ÿ§¤¡º¡â³…K+›ª7oútm‹5BÑÚö ¨ãGé£DšÉ[0jôà‚ß[¸»Ñè›ï³£@"…¶UW¬ˆöžS6`ˆ+N¡&ð½âÜOÅùø‘•¨iì[°²G;5¡¶ 4_ï^'Ìv¿ò¶•fó4Œ¦Í;÷7FÍæïý»æ}Ki.³z“­lÚ¾ Ö<¥P@œì>KP†aÆãʲ”· 3YŒˆ4쬉òŠÇÜF €ÏS4hbvp )#S‚È2•'§xÈØ2€hÀt Æ RÄ.&Ãêv Yo¨‰øîeKžhŪ-Q %š¡½µf‘h'Õ2 {@–K0MÈÉÒC¡¥LAiŒ7í×sƒ.ŸN‚¥ w¿á'õÍ‚"G¹”jÙO¨yrsTÌsêÑüeY”–Ù)nEª"ª©©rñ²W¶ RŠ„€úöñÇ#€˜hÄLÏ;%’Df¬Ù”Rx|‚îÎõºÜ¢µ%FDB“~¿‡T2Ä‘ûV·cGÛ’} ¤¹ç³'îyëí ½f_9súìþ%°óõ;__v8Eë¦%Ë@T¶„HØòû<˜hn€B€”ÊPd9‰4«¦jÓ^t÷£d ¡ðå#Y±¦J€Ré"eGùøóG^þõÎÊÒ•iH!ˆ´¬’ŒƒqB.¿PH±˜Jê ¨ýÍm]ÅÖn<ÃîU8:<ÓD븠ª¬Z½Æzãß½}Î×f =:ÇëFÕÞØ,ᆖՕM P¢‡ª6W4›þã{çhŠì® ¤¿Ð›ß×Ø·#ÔØè~¡6¿ðü?ü`m% -1þSÓJ¦C¨~㲈t¨"±ýk›Ð%3TØ-³úåh·¦—Œ›<|ÒÔ‘Ó¦ )/®[½h×î&ÝÓêlÚW7…àÍ)Ë¡–Æí!ÓB š€hó®–pHle–u8hžaXÝŽ!ÏÔ¶RHÅLe*+NºÔö®š÷Ù§«Z”.Ñj(ºðè°uá‹oî­S.ì™÷¥›+sg_ÒËåQvê! P@þ}Mɯ›¿ê“yÕðX{>{éÑåKvûü‘tIÓò¦MŠ{ýmÑÊË M[,{ýuÓåN"éÎ):(ÞñÊ¢…kZLÀhÕÚ—ùÔ÷­Ý­A´8s^% €2•W*£‡*˜;hä®ZñÇO¹-¼u¦¶ɪVD!E*@Å°#eZ¦áœ0‘¥ C™V¢,Jµ&9·ìIJº1]oº9/³²=Ã&_òæØýKß¼£(,Ÿý­Ó¯¿tóÜ¿¯YõÁŽi§÷ïå³íme;§ wø·Æ­[õác¯¿õ÷™yú÷N°L‚Ĩw ƒ¼fO¿áîè¿þ¼úÕ{WS°×„O¹é²¢,,•ˆE!@½`êÿ^òíÆWç¾öæÃV;á6E IDATNù¬©×^[ü¶Ûç±ìœæ1È?îÛç\~çÙÿ,úï'Ê]X:þÖ³®¸it/ˆ´Øñ©ñZº¯0XÜ7+àÆFËéãD¥¢¦«tüÜd¼ùŸG?ñY|Ü€13Ã˪2Òo w°4¯ÄïÑ]öEzvNI0KÄ4gÝBoN¯¡ÙÑ<‘È㉘ˆLéÀR懎Õ92¦›Ɔ¤¬¸È9þ›gŽ·s«¡—ô6)?@C >1ì/è$ ‘¢ ØûÌ\8£xਢq'/«iˆxJÆÖ¢¤ìÒI)ÃtõÙù½Çœ°m—AâS{åk&G%! ¡+ÿ¸ë*žøAu³ ”Ž)-ñî?a”ö7ÚYCÈ$Ô‚åçÜ–?êäÊ={,O¯¢A'ö.ñDC‰q¦HD„ =ù#ÎÓwNäÉ]Qg˜J¡š+êÃ/:ÿ¶)Ó«öyKGÃîWÛú¦Ô}2÷BYàî}Ò5g3òŠòÉC»èÄ9×–Èì~–L*N ÂP>í;÷ŽTC½B$ü#" ”ÉÜ*©†Õ9r­n‰AœHdF1«ÿ¸±ÃÆ!A¼b&;¥L@¬â¦c’™ ŽžUªC¸úM8m°*á"ƒlǹ‰(Ãœ>£N’m’¯¾E†c [åU$øúM9k°f â1|Òi…p˜R)H‘ZÁ°)½ÇÄ# %g/H¦à @W dÔð ¸*«P”h¾CÈæ=ëžýý&sÐÌkožg a‡T""÷™²º1=KôèHF[ ¾Š¤vú“dß à¡vnÚ¦ŸŠQ} 's& Ï°º1GĘ"¡Uç T©˜›@vv"g(iF#~Õʘs>mFäI±Xݘc±‘2<Þ–B—f$ÜÆÃëƒ^°D–éõa eÌ0Ý®§ÜN‹áW±ÚÚ+GÙ «s¬¸£Ê nß8è͹¤ÎðLÈtk®ÆºÜÍke–Hõú²oÈ°º1fµ²bôɃ¶?=éß¿#ÓîF „ŒE5Ý9áܨ¯HX|íV7¦“ÕP®Ÿuusao-éÔ0¡¬h wÿ  Q_¡4Ç·3¬nLgz¥HÐ’WºiÆ7œÏÕij‡¯ ] ÷Z2¬nÌ8aî#r(§ç”“®1¬nL'C‘Hª#cI¦MxÅž)ÃêÆtžgšÊ¦v´Snì™2GÎ<Þ£.sjäNwNYÓV7†aV7†aV7†aX݆aX݆aX݆aº‰ºµ^`˜´Q_mæðÐéѼ‰™žx¦&ã¹H›@05u=s¬ý8õu³'’$jßLcÛ­kµ }jv"ÕEw„2Ì5J~ÉOȱ£lHÇÂï‘v¸ÎWHÍŸH ¬Öo•R<¬°ë‘nò"¡š[÷wáé,ðøÀåF$utû@Ó@)¾Edž´é.0 ]w¹bG½wxÔM)U_[]±i“ f¥2fá$–¥!«[×b(Ípo7ú˜¡Hýžª•aåØ5&)hª5«veYfß溆Ý«XÝŽ!uÓt=ª­¯Úí±¬£<‹»v8Îòó úÞ}৚žQ "š¦ÙØЋŅì{t™gŠÐÅQýSÿ_Ãö‹ç>±©>$eW©—«º¡nz´ù®‹ÞmÜó¢I$øçï˜ðJQ3W±ÐØÑÃQht¿ÔÚ!'!*Ë:tèÓO?"º\î@VŽ”–R¬mÇÒãdÛ7DݽÝÍVî¶ÊEDš¦)¥,KÙp×B×ýÖ’Rd?Œ¤@)¥ˆdÝ "RŠ/)¥x’Ñc‰c%˲vˆiÚ\¸>[~z»´Á„+Ã>Û-mÚë£ö§éÔ-ý”ÚžqÃtc;êç¿æq¦ ÃtOx^…äL5ÍØÆ àÔ mº¡nv»±ÝtÌ÷¾‹ RB‘ÝÍEDD–euY¯&ûÙ@´ûœ˜îÀÑó¦Qô¨ëº®ëRJV·®|æ@“BCDBJMjB—E„hš&¥@D!¥&¥Å=¦ÝIÝt]×´®ôEÓ4;É^³ŸW˲š››#‘Å­=ᑳÀç27ä7ÿ ¦Øäÿ‘Ù]¥nJAa¡õÆžnÈ¿ðÂðÏ~Ö¨ëÀñnÝÅG ÈÊÊ ]Þ—ÚY¶"Ú" ƒA¾ñ]ŒÍÇ°ôù<ÞâbA;n©K’<”I‰ÏåËâ;Ô­4N)Õåñ"Ûg*„ 9:l7¢Ô "꺠³d-ì±|ŠŸ‘îÇÑ §uÚ윕mÄ%…œé5±ÄIGÏ(‘Ê6®ø}!¢ô0I'³›=Œ‚#¾»‡áv”„Âu–í–Tî£á$ùW´Ý«]q_Û¯NGß3ǨՖ.vÝÍvK?O~jÖÇŽ²¬{ü¤t±ë¶Ã0L×ÂêÆ0 «Ã0 «Ã0 «Ã0 «ÃôL(-:ãëV«;. s‡/8@·‰¬æ H s,`‡Åƒ‡ÝηŒ»°séÚ¦¢&–¿DQ¬n Ãt†×®ÁuPúhnÔÁþÝo0{¦ sŒˆš3È–)B Ijo6ºv HŒtCR!Û)Ê0ܺ‹Ì±º1ÌQ©f­šÁ€Hjº¬Û¾jî3o.[_e {.%ò’¦l°Ôdî%D{h7¡ËŸãw"€ ×ÕF ÌÁ檆IÝãËÎöiŠŒpSCSH˜Í áP„4]C·& ÞT[6Pº9Ù^ ŠQѱ;©«s,¼í‰W쫾k”ˆ¤8^Ôd5:L¯‡ö‰ÚŽ¤©Zøü?ÿöÈKkê<ã¿~ÉYm‚°]FDcÇ’¹þíáö‡"X>çÊ[o¹jBß,A5ÿ½ákO˜WÜ{£ñçÛÿ¹!žÝ{Ôœïýè{§)ÞüæîùÅ#ŸUš›öÝ|OîcäÕ¬›÷Û{}eyµÌráo½þÜü`ÙWûØ5ßXݘc€D0CjáËp4ùXI¯ÓnÔÂŽŒ7"@”ãëÞúËOùÐVY6nkÓüçVìÛ³§%ˆ(…”µËŸüé­ÿ»°Ò=x`Y©oÿ‡nÛÞ,žøó CýæÞµ+î€_oÛS™;²ÔS»îÕûÙÉ~øîa½ûô+/ 4Tg—ï_Zâ×¥Šï}ú7ÿÓ,J{—äï_ûÖooÛç4÷ÆqÙ¦iѱ<#·»1]l”¥/ñ\LbGô•ÿ„8liÍô .9}€ãM›Ÿ¹ÿ±íúñwüã©W^Ÿûøÿ\6ýÄã¸*Pµê_/nîÓ̲íÆt¥´i¸\€šF‡±Ø¶"h·µ+Ju¸—eAzVôt¾`G€§¼i%Í %ø|äráËtºCÞ½ðMjÐiW\:iPÀ­ =éŒ ÎzîÕ•ÕBjÑ=kßXØ8zæ çOàxÈÈ>ýÚïOúã·V,Ziž:‘”%½¯¿ýÊÁ99Cg|íòÙ}²áã*o:ÁïÒ…RóºLÉ-xÆ÷o[~á†7V7¦Ë¤M¨¯ÇµkAJ׎ƒq?-«} ‹Å ±,«õ‰–…á0„Ãíh i¶Ó¦Äbîhš·/pDC,æ(£iBa!œ{.̘A.ZÖýe°¢Uëö ט¡CAÓ”!J‹û÷Ézª±nW­mœ÷Øw¿íÑ‘P`¼a]´eàÞmM0 \y“f–˜¦%µì@é¨Zݼk—eÊ""Ë2-%ôÂ)óuGR½¡Cj"Pä>S†ùrH yyðàƒøàƒ²3Úé¾Àiíh•è¸Fˆ/zË;^‹ˆd¯B„xŠŠpð`5q"¹ÝIýjOSæ)3ŠHš[GPÂåugt‚Œx‹‰F¸iÿÖ-Íš°÷½Ž×»(`‚‘Õ+‹^ ¸\`‘edJ?x®n8a«s¤6û•0Î8ƒòóÛ±³¾Ø`H¶£µ»JÊ÷â‹Öº\ e‡B¬ë D;Ö¢àr®w´£òx@JgGË‚ü|5e x<˜°UÛ·ÝÒFC W°Ô£0´¿^™„0cf8fÐtÑÒPxÎ÷üþǧz"ÊåóC­P‘úÄDˆ™±êFôçfç{ÀR­îHkÅn¡u¬nÌvH‘ † ßÿ¾‡NÑlš¨”=à‹r(ÍÛ{ÂpßC[?ÿ´&4©$Û°{׶µõqƒfå•÷ËiÙ²eù®úé…^?´ì|ÿΟ?ÞëÂ[o9¯ª>عª·W€UUµfq¥»dÊØ~ ª,B©iR`»BÖ=Fš²º1G”¤›fY<ÖÚ´À"ðñ¬Ò[^úŸ¯OºnÎÀæå/¼ðÒ§q¨L+«xô9“Jn}çå'^#Ož£7¾ñ»ŸüṆۿþ?¶Wl†?¿ïŒùÅ™Y¡/ÿë±5Zïž9Û dI ⱺݻö7ö73­û¤ aucŽ¸õ–0Xˆ ê[fdrG½ €€D–…ž¢9ß¿uÖšÛ»íêûå´D5Ñ\àAˆÇÃq­øÌë¯w㯞úõÞ¼·;^½eKó)7ÿþº³T¡ÐJÕ‡¿¾xÕ“ù´ËöèìkþçªSz2}EƒJTË«÷Ý9rØïF„£dĬÔÀ/D¬˜Ù .µ¼ãŽ;ø…믔`ֈƗÀUFY(<]…ž²Øz¦é–yúõ* ‚mS‘¥Dvéˆñ#{‰ÆŠ=µrÔ©—^{ÑŒôš:yôà¢`ÙØ©ãú«Úêúæ°ÒJμé®{x^™W„>zäñk?xáþOÖ´ûÍøæÍ¿¼õ²!Yhºýyîx,j,}Â@w<®N=ÿŒÙ^ eD¶­«(~òy'÷#Rt,Øhš&¿ûÝ¥Hê]/w^AþɪøNÔ‚ €§G>:ì\ºÉBÓÚvy(ÓT€B“­úz•aMVÞ=iÔÝõWoÛüûâŒ],D!5iV"iÇØDMH Ó°œá^Çì3ž)Ã…VG*&Q‘iZv²I;ãšÑÈÎùfš uvv… ìee™q" R¶ÏI IYV29"!*P¤‰.á«ÈêÆ0G¥¼%š'“ *ñŒèD?'ÝÆä:[²lT*"Pv&ïÚf¡-“¶"B";\"ç% :)€9š—a˜Ã+o Ui»`hkÇÙTzÙØIS›$F ¤šûÚuŒ÷j³º1L7ÂöZ•"òŸ|Ë]ÃÍ‚\»k@ã‰(YݦǛ|ŽŠé}FŸØ@™†…Çvç«Ã0é%9á(D7š€™Õaz¬gšìŒhÕ~vŒw|%8{%Ãt3«-ᢶ¿‚Õa†Õa†Õa†Õa†Õa†ÕaV7†aV7†aV7†aV7†9²$‡d¶œI­·¤Ž¶lg¯Œìj±3sð8S†ÉÀNÚ€öàÌŒU™—Üà‹G9ÙC«¶6>t÷]Í?ÿù•}W=|ßCo}¶ƒòúN?÷šï]yÖà|—¥„ –ÍóŸÿÛ?þ=oM•¯täYß¼á†oÌ.m~áOüûßK×úC1—~|Éì±YBYJ¥µÜ1¬n sHÆ3ýºB))²å±Û®úÕÓ›<½ûd©†eÏýé¦í5÷ÿëOøƒ¥¹®½5aáËÉ-ÊÏËÏËÏqËŠˆ;»0?¯nå;Oÿûá×WTróDåš'ÿø‹ªÆø=·}£Ÿ;¾éÝG~që]ïWùKJ³kÖ/øÇݵ¦îÿá9ý Š³|¤F?»0Ûï '™oH'!ï¸ã¾ =â}ÌÑø¸Ê(0 …ç ÞªVo_ò£-é ÇÐÅD´»1… µýÅ__÷ëWrιýáÞyÅ9gŒÎÙ÷ÊS¯lòŒ¿ê¼)GõŽî]¸»ø¿ÿÃ-3‡÷-믶o\¯&ÝôÛŸœš÷Ü#oÕ^øó?ÜwÇ_›9÷.]°Nœ}æàØâGîºýÉŠA?úÃ_~÷“ïž1a`ÝêùïmˆŸtÊ™S{‡7T匽ò{·\4m°)=l˜Í7¶Ý˜Ãô‚¨/ᄇ8u‰&ñ£éLi/v,»©æ|–±÷Õ>Ø£Ÿú̽7Mïï€>¹?\6oÑO?µîŽ“Êó )U 7èq æd{ݚ˗““ØnE¥×ëóç÷.ësþ÷sò‡-iê—߶léóêÇ|ëgW]<­—aO=mñ•O­X»a×™çäeûÝ./;˜—¥id™$ºmYÚXݘÃa¸Hn‚H¤T¨ý׋Tû…(•² P ¶šñ®#Y±Í+*ªÜã®›Væ'Ë´@xsÏÛç¿Ï.Y´†X±˜©È4c1¯eÅã†i™Ñ˜‚À¨ãGyqþƒw|oÑ[S§OŸ>eò g}½Q04¯rÇ–†¨çÓ—î¼ñãxÈí^úñæmÍ[j¶7šådš–aÄ Ótâ°Í†Õùª d‚ “©¥l7[ïÚyù@K'§”™ì18°‰‡D±†–JÜ–I@äçø@í­lá³Ãp“¥!R¦t ;é’ŸýŒžxéƒë>øûüÿ^rü7¿û³Ÿ^Vn-šÔ­xs]}4j!b`Àè³+š0¤Å,…­–¦¢îØ|cucáå·0†Ðø©hø=Wµ@AÂ(Zë pºìàý”, ‚Ð:vHèÞ&ŽÚN“Š6Õ ûK‘ÇP:…é‚ìÀU;ö´3í%ôdy¥GímP‰ 7jjŠ‚p€Lj¿â Лwü9×™vnÅæµK—Ìé¥yÏþå1#Väò(Ñ{ÚÙ7ÿß÷GÔ×µ€¨Œ¸©²Jx­­¦jmîòPzV7æp sIŒÂº—±z[†â(ÕÆKB°÷ÛÊA­éØZĶB&R”±­l%¶êI@­Mõ=¥nBRùmªôtR¨3’H }ø袢ç?yeqø;§ç€ˆ[{?^·ÇòM™Xñ­v"”šf6ízõ­~øÝËΞ4`ȉ3gŒÊõüò7/¯­•çîg>׌¡¬¢²Â"ˆ¯yëé'ænŸtÙÕ玑€RÓ4!ÊƲÆêÆJK ") d*ûäžV´ÜPuK¨´yÅ{Œ#L â Ì´#"€ËìÙ@$ T”Ùº*Ž*–Ùˆ*d(“4yJà tA‰”Òõü¯_4õOo?zûMí{ßõCµ}oþów-Þ7êÆËÆhÐ`Ù‚›šà…©bõ§½³(Ø«ì‡çõÄ›wlÝ´×ÊÊò:ò¤‰Æ_ŸzôÁY~8»Oåò—îÿãÝo7O>îš `¡h¤…@XÀ}¦¬nÌ¡´´Ù¯Ž"B²Ç@öÈCmÉ>HÃ’Díu>X@f=U  +Óô “ÈjŸB†#y¤@¸È]b7“}±¾!Ù}(J)áîÎ-·_¶òŽ§oÿú¦JµæMk¶x§\ó‹ëgP¦‹4V5†Bq[Ôp¨¹¦¦©}¥³gŸòÒ¼¿üß¿ñÚý¥®Ù¾»±ü¬ëgŽà)-ºôºë?ýù_ï¼òŒ‡…*¶í1{]|ë7gŽË3+?¯´vñ ¾[æ¸~þµ‰ÃýÒâhÞNôU8Þ­ÈÚö¢Ólv8þäÁý D E»n””Þ´?H/i~вÒþ @Ë=z.èÁ´¿\p僫\à.W]öPö½>GÞ‘z‹†=aP>Ô×5Zîü1'_öã[¿;gX.š–oihlÒ˦>}T®Ff¸¡º‘ ‡Ì8yâ}ûî[,psÄpçõŸuÞß½þâãʲ4tö1jp‰khŒ@ÑÐÉßøöל?½_t{<^ Ë@ñèÇ—÷.p%Z²ºuʃoš&_…îï™:žuEøA*Cüâë/Œq.ˆc,€¢MÕûk›â }YEùY(EdY±æÆš•]TteÆCõ Mq-§0/ÛÊŒ…ëkëš"qÐ<9ÁÜ`ŽO)!QE[êkª£–îÍÊÍËËòhDŠU<ÒP[6eN~^–ÏòÕYÝXݘ¯$/©Dfnk?LGLٌЗغbõœkð…aÆ)yKÔQ B*M)v¶pDT ÷ÑþN)'ù¤ÀT‰Tª]QL•¯H%ºFQ;µ¹“N„SX²º1Ç’˜¶¤Õ¶¬Í7à ÅJM“¯ŽŽ 1¹ÃÑ_¾T–¶Î€ó»1‡ýÛ,´ç:vðÅ¡¼å…|‘^ØÆRBTl›ìjÓvHZ{§…­ƒ_Ò×´S&‹ZgÂ}¦L•`ÇLô?d M[O±•)ؾÝFk7h—’½¥ì™²gÊ0 Þ)Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ãy’1ÍÔùYHä±l8"„az®´Ù1pD‰Óud"`Xݦ‡’”PJu¶Ü¤©à>V7†éégkÜ‘qNÛ´ÁêÆ0L§S ¥L7å$¸ê IDAT:CF•RéMoì™2 Ó‰†[úrçÉM²¡-©nì™2 Óezw@ËÏÎ HH@€üÏN·vBª®›Ò#B†ù*JØFµ(}‘01ùAW «Ã0_ $$… @ NVw;g©ý-(èšô'¬n Ã|Ii#ÂV©B¢B äx¦¨«Ã0Ç‚SjOàí$²GT`ZH@ •BEd °@š‡–tù+½ Ã|ÏÔ,e'ë$d(T $J%D[ZTÈ+²|è…dG«Ã0]¨\­æÅH› SV =¹¢Ós ä°$X ôÚÙ¹ªnaexË”¼3Æç„GÚ?euc&CÛì\ìÎü7ä8¢Î ‰N˜GÒÍ$" ¤fµµeYͼÏ[>jÔbÒˆƒNà9ò§ÂêÆ0Lš¸9ñj /3§bL,'eO)€Hc•ñ+š>Yݼ$lÕ’Cá"4L`—4ð³º1 “"MØH9©R€H©© ÚH€€h`tcËŠù5s÷[I#å…>aù†'Wå#JG8Y݆éj…ä‰æ4Ñ"@BB°[ÚP! DÑ¢šVÕ²°ñÍ:Ø%\…R¨ÐÁ±yÓGåLÑH:¡q¬níXË©ÉÔ3ÝýƒÎ¨’–}%5q[b¹£ÙÛÒæNLï›0Ïí»œèO®µs-$*Ón¹íÖ䀕þÂ<؉㜱~iµj½gûTEÒ7JÒ“¼È¼IÐîMi]ÚAUŒ9˜wÍÈ%;\ ˆLB¨#¢óħ¢Ý,@Q¯ü¨þ•ÕáQˆIÐ 2@Y4*kÒ¸¼éEz?ÝÔEÃŽ uKå½Kk@ì`–ÈŽKpf¯l]DªÕ´Ãƒ"QÚdÀv˜6Ø—œü×inMnï–Úóg¶?éeëÌt_tru%Rò•( }b”œ·¸½TÞÁŒDˆéò&uP@«mÚ)-]™[ï—6c)«Ü—ðL(Ò€‰ •­~„„ ¥¥×¨Ê Ï/ }`IÔ €€å7®tNo}¤$ÚbˆØ%C±Ž1Ï”2 –¯`¶÷±ý¢2¾mýëCM­Égâ`~¤(sσi9À¹~¹K‘¾u«åŽžÂV‰k—™YC¿Mp€ÒR¢f'*k=!2:®9“ô8ÐÕ¤šTm‘èåÕ²ì_x"…  ÆÜ» þåe‘÷ ×@7ö–Cfœ7*k² eX$„]V—Œ4=6Æ*¤y¦˜LÕBe×´þyO¤Ïsìƒdà" !&ÿOº¾˜’-D‚Ð6Ù9 30ˆˆH©¬]j¢Þ‰ZÃÁT:U,ØõI+ýãA^‰ÔEHTÇÎ\HI{’'-’8µnå¹ȱ´ëkŸïÁÞ¤ô2’ò$ëmK£Œ_L«|æƒÒqÍ™Œß @ç7c[úð…Ý÷íŒíH~ $iõÖþ÷›_\×ÔMÜ^å%'—õج‰@†E¤ @´£Hºè²kú¶ãB;«ÒÚÒÚõYU<ƒt¹]šHêNæí3Í)³bá°n¯K“õˆ‡ª+kB2§W¾V¿§ZåýšóêÛºF ›¡Ñ€ü\ðêŽ}î<HÎK†€Ê€úzhŠ@V0¢[ ¡¨tûЊÆM=˜ôy4 „p¥µ0‘#ÞmÒÇÒÏÿüoåM‡]; Ýû% ªÞÂÃ2-ÃÇÚ§†¢T* þòú@þo]­ÿ3„yóæýü––¹óKÇqºw‰‹u¹*êD±ùè?®>é¶÷ˆ 7ë±ÍAìv‘tãï:«Û³öëµåBJ\”Å ç¾5Q¿å­‡.9Lû¥9=¸`³%1';ÅÎ(õ­e Pnú–¼»zcBóYÜŸ @°²¿!|²Áp¤¦àƒ%_¯uæ¯\³µ$,µoR” ÚŠŠ;ü^ìΠóq§( Ίƒß~ðÆëï.«6Ådf&óò½Ÿ¾÷æ›o}Þ”:<+1Â$ ë|¦ßì¹h.8çDÔ Í¾ùbÙ !¥o éðè!"WU'V}ºè­÷?]±vÓžÂ3.!,!6Òj@ÆÛ£ã_lQ@8÷­üü·óHBv¿¤`N»iñæB¨«dÿŠÕçmqIarÅ÷Ïÿõ‡#ŽÔAQ6=£¼ë5oQd•k¿ýö’¯–®Ý”_pÖió ;uNÔ¨­³ðÚ“aŒ+à-—Oœ‘ŠB0¼¿mAdî)tíßÙ¼ª…Õ‰`²ðàÁÖqcî¶ëÃ)S@䀾7%B§Ó¯´CÍ/æ™úM¼Sôº‹#ÕÅjóÚx›ó‰]Ü/ в÷ËÅ/}´ùDƒL„ÀúÅ6G¤£Ø採ïØ°ù«ÿúíÎ |>ž@p&Õm^·jÕ¡Oím×,iõe€  ˜ §ÂòMp¾ÅŸ_@àH|N¨/‹„sÀ¾åøþ§X܈¢ÔTz|ÿ–­û;z`÷Îmª<¾'É? Þ¾Ày ¨ÔaJ€sDh9’¿ä¥w¿Ùr¬ÖC³Á¹cÍâ—¯9^Q/1Æ8ðŽ®dÀÇäÝL2"@óöE¯Îyg×y AH„À™RKeÞ?çÍzvÑÞ ·â®+Xýá3=õÎêB/Š""!B›¿Ù‚ä>öD"A@D©¼hߊå—·øÞsxÑmBÄ.w©ÍeÞã[>xõ“ï6¸¹ÔttÍšõ›4¹ewb—kˆ(òŠuóï½û…ÏwÖyTW]ÑÒמ¼çñWwÖSA@ôÝ鶧LsQ/i›øõ ˆ(‚h&V LP8Rà@¹Rî=µ§%ï<« Í`ɲŽrE`W TFCÁO/ø;ê^É;¶¬ ð We·ËåòÈ”#Aâ_u„pF½n—Óå–UŽ„øžY¦È²¤0@N·Ëåö* a Àëa’G•%Iòª” 2Åëv¹\n¯¥ ÀG¡€À$·ËåöRŽH2¦ª²$)Y–eIåœ1ÉåòH”„šñô´ž±qQICî½mJ¦u¾UȸÇ.7¨ ¬v½Ï' W½Üé·—3B€sð: æ,DõgsßãwÜž2|Ըɗ ÈÊÈrå ¡if£ŠìñH2¥ ö¶ˆAªx].—Ë#3NˆÏŸâuUåÇÆ<úæ‡ón gŠ5$Œá³å³/O8"A¦¦`€8 €*—Ëér+”B@‘=²WR¨$É’äe€3¯ÇåöPàê…3ß.^¥¿ìñ¥ë6mÌ[ýñK÷§ºw~üÕëPdÛ­°ö|(o3`‘ rêu;]nIeÄb²DÚ­“ÎÏ×À©ìq¹œn¯ÂüU‘<²Ê|ƒwK €àTUdY’e¯ìuS­aV{ˆM/‚,{œ.·L9ÔïœÉn·G¥DØÿÆÓKÉW-\²*oÆÕßýÇ]g7/~mi8•=nY¦ôÏ/º‹ÀÿgÏ}}Œü†ª"¥Š*¨*WA­|n·cõ9é¤tf°´ä^zU°>Œ£*$ˆ€H8!>ãÂç¤ýë&ùç»ùb2~†#„ k®:µgë¶EUŠµGöˆ±c÷ 5 ¨8jìÚ²½àdƒG›6ôòËFö‰± ª§x×úü“­}†ôQ* w”ª!É£Æ10Y9y`ýWùÅÕ’kÛ×ßÄ[,Ó'ô cU‡·¬Ý²¿¢ÙK‚zæNœ4,=Ö( îšSë¿\%õÑ'¸6[ÁÕ–1rÒ„ÑýBÔú]_/?PâáºÍｪÞ1ûñ¤ŠOÞ_ã8ùöiýÓSÃãÓ²{…˃ÒÚc¢€+ÍX› Û »?8d@`nŠ'aÓF(¹€æ0z9ŒÍâ´ ·oÁ•‡ I‚Í_’Ôkí1é½RÊY\t”ÙÖèu…ÛƒP.Û½zŞʰ1&êh%É€ôÂÙ£Û6o+,o æ˜#/ËšJ[Nn\“—Nvšv¯þfUÈÄØÖC{5Ž3«>þ‡%hæÄÌ‹§öPþÆ­Š›%°'˜4í²ôh3R „H-¶¬Û~ôœ‹ã2†M½"×vvϪ/·×8lùø]SÍ]÷]ÙÃ}ðÃÅy­†±<:´¹¾¼ØsÃʉÖ„œrí5ÛW/È«h¨V©­dí·«O6$þá†ÉéqªPÐ}"!ª»þØ®M›v¶šzdïçP:¤P¨·òTAþöÝ'*[t¡‰9£ÆŒÈîbëŽm]¾©"!§_«h×¾™3füØ!i!F×¾eßäm¯h®p®ývYôÄd/‘Ëç+Žýx ¨Â›=zÒ¸!q¡½ÀÏ|÷åêÚ~nœ:ܶaK9æê§ï&"„ôùã#·>·xnéž3p_rkåÞåË·)‘c¯¹fh˜» jèä™"G ÀC œ¸YëaçΓ­MÔšn2"d’U´3Æ8RÀH{¹=ÿWαøóO oË%Q€æ²Cß¼õÚÛŸ­/sÊTCû]5{ÎÓ÷NË0º+·~½è•7–(obÀÅàä­w<1gæŸD±â ßüý;SƦ¹«K ‹*/HÆœkî}éïÏö>{`íÚ‚s5nWõúq™×ü!·lÇW/=ÿæ²}2c/.ß|lÁßžžÚ/Ú]s⳧ž(H›<"áü†=•Þ–FSÒ¶yï¼~ç@<°nѳ‰ïþî|mÎý3Íûþñ×ç*î ™”k:¾…½w¤ùìübiÐ]l ´òß’§_ êxxôìÁÔ¬*Àçã÷;QB÷ÜÊŸ{¦Åâ‘ÜR„qÝ÷<5þü(‡`K ±zkªÂzõŒ ÇÞ ß¼þÚŽ>/Ä œIeŒ (à…Sùüíïï/ÛsAV&Äöÿð¼wæØOîÞµóHµ§AݵziZï•;Ÿj‘š¬(+Š˜vËøôð}ß¿1ÿÕ/öV´S©.|ó¾Gžù¡ì0=m)]³øÅ--j=u+¶ôbÇß®Óü~uAƒ`÷ò¹ùÊ{®ŠjÜõÆÂçjBæßó—1!q×=0s\V<gª·ñ|U]ƒ*ºšü¸ä¥¥%cRÇŒK³¶çtQ$JSáúgÏy{ë©FSHh€á):1$jùÁµïüÇ|–wÄ¡pÊõ)#¯òéY7ëS·?ïíç–g¥Óû‹jššY¬Oÿý…ÛÆEœÞºaçþšVoÝÖU«ö½:ǹC_¼^´gQC}”Y´ð•Çož$Vì_²`Áá›-9ㆦ÷ºî®‡L“zQÎeªT~¦†éL=’¡©lÇ¢¿Íwõ{!wê°30ößPSÿ»z¦¾ ºO؆TO˜ÀÜÜqÞ}f¯#Ï­!,QŸ::ôŠp]ã ;n­Ð&‡€Xô_‡Ÿ=«€„   ¢»:ÿ“W_yw½mô] ^x|Z†éøêG›ƒFM­îûlÞ³¯ û—¹s¹}BhÓáo¿Ýäê‘=f@²çÄÎ ;vk0 þÀ_º5ËPž—T M3éÊËÓ[ö* ž<{îc :±ðÁû?/ïyïœ9ýùæ+2Åü¯¿. ™Wæf蜕;¾ÿaW½'nØ5Κù‡ì ƒ«¾Þêì9~â”ËGET],ùÎ÷^~öŠ¬¡ÍdÀÔ©£“‚¨}è•câE·¤Fô›:4N§œ;„ Ÿ |á«ìÏSÎáÚm@c`úÕÀá£9dѸñ6ç>>"ü€ù |êM0(„sàá¿FoÆLÆ)é)‰qöàˆ¾iiqv2&1sÞ9cFeÇGX€3A$žªo=ûâçG2n˜ùì쇮Y’¿lÝGÊÐÉWLê+4íÛåèý§Ç>zÓÔ c{:J·ì5\6ÿ¯ ïºbh¸ëÀ“w=z<üº ž¸ý†kš.~­~ø]ã{ %ëþñØÜ]ƒg,œ÷ø­WŽ¶×ìüzCQÒ´{šÂ7äíµÝ¼èݧoê*e‚%yÔ¤+F%‡†%š0"!jOìܵsÝw_®ÝU7ìŽož˜bR©ÊƒÃ{˜Û/:HϘÿ½,ˆ¤¹8ÿ­Ù³V4e<öòß¿a°¡îàê·9íéã§L]µäµç?ÞéȽí©çž˜qyŠp|ç–cMÖÁ£FZêNíÚ³aGqsïÉ·<òĬ郭‡Ö~·î|XnîÈÜÑ}XËî£$ûá¹/ü);âÔšïW,QcGÜþÐã÷_? uï?”Z‡ŽÞ'ÚŒL• —MžÝoÔØËF¦ŠrsÉ»woþâíNÙ†Î|öžìàŒ£9&sXîðìD“à_ÚñvqV¡-µÀ9£µžŠbùˆÕ`±rÓÇö3ôdeHÈ šlìçëð†Ü/üðÕœújµÜé%ò+g~!E BCeáš¼ý­1çÎúÚ¬ÛWWWõi­£¢¦üøÆ-Ež¤ÏÏ}òúL`tº½îÆGv~·æØÄfA‘ˆ.åÚ‡Ÿ|âδ`¨¾°¹pIuQ•W´öj1¦6(²ê“ù_ï2M_4÷ÉÛrC "Lì:Y8kùºÓ³®Ì®(44ë²³\“ª}z÷ò……eUu“5 1Êd2ösùh#“²ïxéyÕd³YL±ã¨¢Æ¥_ ¨.(. û[ùϳ'ná88—’íjKñ‹m0èn¶ð1.  úF|à;²ü8},2S° Œg À!qÐÃ?%áœRªF_}Ìf >¡êË Vl81ê–¹óŸc†Ž™ß±e÷É+r2û¦FZ‡¦ ÌNŽ1BFbl°É‘4t̨^¡zGQéá ]ßë¦M8¾GˆÆF5 Ÿ›™‹»›–åUYÇ¿ùÊóÓ{éœ(iÿï-õμ¾W°yÚСYIFJÕàÁw?ÒW¬UåDÔ ¨8ª W,zæãíç««ytî]Ó˜µ÷”›Ït‹^UÕ€`E@pÛ²zNyvÎ_ï¯ÈM³µœÚ¿ø,׉JuñÑ݇›úM¾ëÙ§L·ŒîM›šï>|âìù"‘›£ÇÝzßœ9WÄrhùÉ»¯Ù{üúᓇdõŠ ª‰ï—Ý;Ñz$EˆË¾ê¡ù³®LÖƒS*Þ´úŸõUÍJFhþÓŸ«-QÁÓ\±æíyKU:u¾ïŸî–( [ìÛîÏd‚ɦF9G$¨™o—”<ø¢%… “=Hi‘.Rò+Õr‹`b¡Ù¦Ü^†„¢Œ@8v’’øDC&I¿/Ï}aD$®æº#'Z¤ ¬q !Ö˜Ëf<ÙhK„²J+HÏÜýSà Ekê˜ 9釶*n¨IåÄ›;.-*€ØBC,Aª¤ª*‡V¤(‡G¡îíÇ«\܆å{>û ©L4ÏÔJòÙíÇêi"€HzgfH€BxDLOá€Ä¼2¨Ín/¥ÌQßÐcÒ™ì‘& ª¢P@DPˆÌ…õÅ(Æ°AÃ|HÁž ƒ³ùîà24âYÌpÙûÄ%ƒQ‡¥Mà©á…ù7A‹¼¸[BTUõ ÏÀ/ªÔY‚B­œQJÛZe±†Š#Å­AYCÇõ 3g€AéC/º­ªìD“+NñPêu¹E£ØêõÊÔëlllRR¬F{Ïa½ì›—¾úŒçÀ°!9ǾçÉyÖï…]‡Î4‹(Þ´äu&Yýi·£öÌ©c•Í”ÒÒØ꽎ƒ`¶‡›€ªª¿xVoŠÊ1媰úÊû÷/ÿä‡!É3ô0ÙMÀ¨ÊÚ\‚@ëê+•õ½uà`=c`M˜5j¨ù´[¥žêºêÊ ±âäú¯Þݬª‚ >]ÛXCkj«%ÕëfQ#† ìßÃÀC6´V/ºäd]­C wº$ÕëiqÉ’I•519=wP° 3ÚÂu’Ä$…sÁFNUæχ¢ÑÞwääi Íiû×äíþañç#Ÿ¿w˜Ao²Í@©êWj¦ÛO¤|ŠBl¦à`)¸ÒYª‚Ê@µRKosV–u„MŒQH8hS¢¿öú·€ŸÝ°]ÅdùB ^s0T™š¢úŒŒà?´zZô!á&ƒ€#猙¢Â-FÃù7ž‰FÑa&þ~w\Dú€(ˆ"44(^bº°ù›Ï÷šDß7S·Ô³¯MR9œ .Xo´0@@DQ äö´)é‘) ¨0Úžx`Tw XD°[9g`SêÀpTx±h3¼»—Pæ7äSú]@ ¾ð*¶©·0 õ@DÎU¨ß@'mó:ªe£ÎЫ‚^g æUr«Wa$ žðO2"D$œr}dάù8_úçÆï?ÚºêÛÈ„ÔáWÝýè-“íJs+w5Vúê½2Á'Ôaª;",6Ü@B PEaþª[ÕÝØ*ë‚í¡™SïÉœ"7”î[<ö¢¥­¹zlv~ *ª_²þØ H^ÅÙÀl¡¦›_Œb6[cBù9™I´¸<çÏîXÛT¶9ν^é‘©7 ªÛK 1a&»90@Â,:«ÙsÁ£HLú2±œrb1íÌŸ(E†0Ue>ex]‚%Ä;éyd÷¹}}ë®zà‹?½áΡCtTQÚ|0`Œiìö_+*ŒÄdB‹²*0mˆt¤ÿº §qÙvÈŒ‡ÔnLý.ý,A@äŒRÆü€Ñ+DÞX}î¬CÊ ±ÚÔPVZ‡¶(›Ids÷e#„–Âåß쇱×\wyߜ܉øóÙOæ^½mm^ÍÍ7DÌ:bÊ36YéüÆeù«ÄÍ   Q¸ªÊU'7¾ù˘rSF˜ÈIöRÐ[ FQ$œR•ñ@ý)ç  ŠÉ oÊ«#3â“úÁùƒ¸rNzŒ]•RHpºAa­YŸ4žˆi)ZýÑ ßžHzàñǯˆŒrÎå¦èôkn™ºcÁÇoÌ{æäè~¬jïêm%)WÎœ86Uµ’×åqëeÕ¤“Ü—Ó«RNÂÒ®•ðãÊÌò± AÂù#k×bÊôiSâLvݧÛúÜ'smØ7*R­Ü²*ÏÛkʘÜÞÆÈSá&ÝŽ‹Ÿî½kRXÃÆ9¾TòèÖ5÷$gNºyô§ï¿ý̃5{2äÓû¶n;,¸ïÎqbœ5y½þچʜ—Þ|blï`Fߦbû›þç1[ÞþhÖ}-Óàðö;ÎìQÎ'„õ0qRÖ¡|y¶cONÜ…Âí[Ž9ßtGÿ”pzJ!Æ÷ï½€§G¥6îYµò°pý©zWlöhùlÁÒO¿íy}ŠË%yÍ TºÊ^·EV žÍíÞçNMêåÇnvÿ¬ékŸúêÉž<<9Óä­Ì_±´2!÷©oî¼òTÞߟ[,÷}à•çnL°¢ªjÍ.©é,#r‚"‘EP…ä þ¶À8#\ðõ£ð§D-\»´tý]z¦þœ)pÆT4†f]9cV+YüÙª5ߊÁ±xð®{þ42RÆ>0kžðÖk·¯<<4yܬ»½udªÀ\úˆØ”4g˜Íä›!Á”Ø3‘ņêP…ÐaWL˜zêóµûwm-™2kÆS/ ùí¯·oþ¾€¡©Çu?ùÄÍ#í"\Ð[c3²,1!ñµôBze¥Ç™‡¸1“nšXøåîµyW=þ`?Å£=’Ä:°32ä ̱üº¿°&F–íÀoôÐ7‡Ý”Ž¥Œhƒiñ:_äá×…`´Ã5sèƒwóP—a Φ*'¿cþ¼ÆW>Y·îË“ÖäA¹wg+/¬3› ‰WÜüˆ›š>[¹ë»/všB.»åÑ·]•d‚"Ùå¤Ñã¯L·ëò¾9è!aX0ëÚ‘±àÔÚ;ç—eœ/:²ù؈ȰԬ¾á±&½às„¬áñÓ”È =.Ë^x¨ªJ^–tËü—\Q~þãúŠ€ˆ¶Þ×̹ã"9—9“Zë+šl •ð]3ß.í~"#X#I|O]k¶y¤ ”«„ Ðøzâ´Ûn]Œ¸ù/QUõ0ß]!¡žæªò³Uu.]pTbrB„MÏT ‚(‚ÚTsîì¹—*Øcz¦$D™EP™â8®ªÞ’Ø3Ên —]¥eõÜn5‰îºòÓgª˜-ªgÏ„0«Þsá\Iie‹—íÑÉ)‰!&s.»š+N•¨¡‰I :@B¤ê³%çš)© a6=uÖ—––Ö¶ê{ È´:O*‘ã’{%ÆX¸/èiûŠŒÂ[뱤ÜÑq`¨wAl,ØÍœ›±ä 4¹Á ‰)<Ü„ªL†*¸ AL2„sìЦA$Ò‰ÿü`UUÖÄ»o™œ"pŸº8A¹·¹²ìlUƒLö¸žÉqa๷¡êLY³›m7éÐ[}öÔ9)(9.ÚnÒ#DkËÏ”×6JT°†D'õJ²ë©¢0t„yêÊJÊjšTÑ—”ªGÆ‘xêJN–ÖrKtïô$«\{ìd¹Kˆ”#2@dŽÚòÒòZ7m¡±ñqáV=cœ¨u‡óÞÿ»ó±Gÿª* z¿qŽ‚žæšÒâ²&U•¦“jÏ·ØâS"ÌœQOKý¹òò†VÙ•dœüêùÛù.ç‰yܘ騨SŒáÉ©I‘6=§Œ#2©µòLIWŒ‰fõU.!$>%΢6U–ž®øžqÑaFW]ñ±ROtBÏØ« Ó‰ÜUqº¸ê‚“‰¦Ð¨ø¤ÄH£* ºŠ¿ùpñ–Úô'fÝÚ;œ¨Š/õ«q™¿©€(Š]Zyø„P*“«Õ2kN5ô7#ó%ˆ/ôò?ˆ°ù¾…1ök&t~~vóm/À;å%}Ù}ßa¦2æK" ‚Øv -Þ‹DN©ê› "ˆàT¥¾>$  ‚(¶ÇÛ/á?EUT¾`¸€Œ*” :ß9œªŒˆpª¨¬]»áS#2†ˆL:lÄà“¦Q` ¹¯wHûðA¥ÄgÍ " S‘vVÄûØZ÷.}oÙeÔôû¦öãTíЀ‰Ða®:†ÀEA@àL¥”s ‚N ŒRÆ爄ˆBû4pFiÀ‹Cì8C þiäTUŠ:Ó…H:Þ0àœ©”"!ÌU–ÿõ;Ÿ•ôº÷Á#U¡íŽ÷9Ÿ`T¥ "´Q•¢¨#E_½pÛÃ_ xò…Wž¼ÚÞa蜃o¾ÅGi=eÏ™ªRŸú¸ý—¡ vx¦€Q•r@BäÚ#_/ùì´í²™žcPÕ¶ö<»uf7Ÿƒékü‚í:Ý€»Ù©éÃÿ€¦þ%ìö TÑ·e”6.gTe]m_@ôÉB/Î.rêgÜ@ã;¦ª¬í¬Žç OîÔñºþK>L$¥j[j¡ã9èÿ.lßcÁGcœs_£jJ»·Þù”.~:ú¯Ùö{Ú7šñwì@ÖT^ÕÂbúædõ Fîo Ù6T~‰)ñωÿòŽ¿ÀwšÚuŠÛž ®‡|G:|"´Ï‚Ÿbº\ Aîr^(k 2:'#^äTõe{:6ɽø´¶ñu ç øx“QF)§Ü÷ªáÐÑÅéxënð¾PUíp°ë 8GBP[êkºÈœ!YfFX«Áu]¿šQØ 0Јš»¿5íǯÅn·çàmûºB·ìÆ/j¹>ìü¿¸åa—~¼Óf2×xàØåky—Eè/$Á6ŽÆKfÍ»ŠVÄØ~ ïÐ@Ö7rF7ĽþÑd·Š\¥ ;g‡»Û»æ¢)€.spÑLvÕ ts¨ÓÞ9]æë⮢œr“-õê»ûÚ¬6#S¤íŽ´w;UØýˆ¨7Y-F½ˆÝ ø©«µiáâM€.êÿ‰¾WpÒ[îiµØPUb`ð›uvk›ÎN²Í›½âk¿mrûeân ÒnìЀ÷ÚåÐE5¶Ý}ÐeåÂÅ ­;¯î®×¸Äˆºì6wñ.]çmÛýµÒÍ>~u¿(ô™*ØuÑ^¼Þº“‹Ù«»&îØ}½ÑEsØyÅ‹¯ÔF(ˆ‚Ïî@Œþ³/©ënx>e±ÐX´wýÖS‘‡”l䜵Q-^rË°‹ï&üäóÀ‘Ÿ·M©ÊxG[YC÷žiçªQ_/Úÿ²uü¿AÜMÃOÓ|';©Ãv/¿YCââmnÚíµÿÝ°e¢Nç(*ÿŸ‡rþ7ÓÞyóVÍxë>«ð‹}Ëÿû¸›†Kø²]›ùÿw÷Xþ­2\lþþ_†Û#fäÒ;˜þLÔÖiçVÔ67ý·€ÆnÿŽëú÷ox™aûn[Ý}ø¢œçÿ2LoÖÍG4vÓ ág¦œnY_c »iРáçvä5vÓ AÃï„Î:EI‚ó…:å²µœ© š½ökã× @íkРáw Í3Õ áßÝ3ýÕä1ô¿Æ7j¶› ÿ¦h«cëZàøK’鯩5Ôân4hø}B³Ý4hР±› 4hì¦Aƒ »iРAƒÆn4hР±› 4vÓ AƒÝ4hРAc7 4hÐØMƒ 4vÓ AƒÝ4hР±› 4hì¦Aƒ »iРAƒÆn4hР±› 4hì¦AƒÝ4hРAc7 4hÐØMƒ 4vÓ AƒÝ4hРAc7 4hì¦Aƒ »iРAƒÆn4hР±› 4hì¦Aƒ »iРAc7 4hÐØMƒ ~KøOê­Å=L”ß>IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/distance5.png0000644000000000000000000004411213051004444021772 00000000000000‰PNG  IHDRz,Bï-sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ  "sÿ££ IDATxÚìuX××ÇÏ]ǃHÄ †wBÜâîîîÚ6mÒxÚ¸§I#»;qwwß]Vgæ¼ìB€@ì×ö¥íý:’´+N.þï ´e|YzW²nlç¦CçË/rvlÏ’¿ÎÒ{;÷œ{ñ ‡f^\yáyr©jç½ÛáVÇ=6㦋uC™Dsk|5¿Él± &„$êâØúWò9+Bö?0¨Ë(ÍÛeõß0Ÿ7!äÉ–V®]÷B~åÔhÌ,ó,°ùç_òÿÉ{s¼O[¿Ào/asVp„àXqþrSêö bYC,ó."" Ú˜“ÇïñË|lêJ+»©€2ãÅùKÏ„¥tøyýàj¦ü…ß2”ýD#|RÒ¼XV`ø¼ÑÕP`â<²®½¿¼G<–õ”ÄÏ JØáæ‘Ó/bsÊ{ —k@€“;ŽÄ樊?›Á¬F'*v`2orckcžÈÐ@TªD 1¿@ ¡Û˜v(ÖæÛ –± ìË.UCž@b  ÀØ Q7Ö5%e´)‡÷]òGQXÞH Ë™”ÕòŠ›KÁÆì5³öˆ=÷nßyøè¼ÁÝÝcÅ_¤rSÑ£„0·Ì õqóô]{ò1!€WðÛ#ƒ}Üü|ýÆ-ù=Ÿ%„¸}a®ƒO<;»¶u#/߀e'^Bä‘—½‚püG. v%N#ݾpX°Ÿ»`è¿ßÑ$$?ÒÝÝíYô˹Ûøúx¶é;-YÎf]ZÔ}.Q^ðrq¹œMr£.x¹7xžÁÀ›ËÂjJ¿Y¿Q+@æþþŸZ{{{y´ï?9&W]Ôœ˜ì'c:‡xxxôŸù«\‹€0é?ïæïåÒ¶÷¥¨|HºvÅ:°›V• !ý¬ÒîpóöI’•çUvÔœAí|½Ýšuq?Y¥+Mwgl÷¦¾>žÁÍÃöÝ|GAd»·¨·ñì›_§ô ð÷ m?àA²ŠrwJÀ‚kq7wMnܱ7‹ ¹1¦kSofaƒîÅæ„ù…!µÃ×%<Þש©¯—÷œ7!§†¸lŽUïœÑ­õ¨„p{ûzÞJ0êüÌú}j ˜7‘Ú ƒ=‡¢x»Ë×Éõ@Ô‡ÚŸ_:ýöÑUãù5 n;àµT{ÿ-B<B;\ŒW€ôwŒ‚æ«Ü:ÙäE_ötwy‘®-f$„äÅEônéãåå;eÝYŽG€lâÝnÚ $„¸spi«/_Ÿ†íûM|’ªÑæÇ5h'“$´pw]òŠ€:}ùÄþ^ }}¦¯;«HP+kTïðí7ËÇvö÷ój>üU††‚iþèÕÊßÓÛ«ÿôµ9*$„@âÝß»·ð÷öôè<|^’œ!QͨÖiCt‰q´«g£­çv¬ ÖSõx²âGÀûÓkœ[ÈŽüÇäF7,¨°pˆ¸yZ¶ƒæååççç&ökÝpæ†d•SÂwž½U^ “æe®èÔhìVDL93ÀÏßwë…×J¥27ùa3ç³o•Èaê½Åž^ƒSTZŽÍ×Ô¯çÒ²¹,;n|c·[!"Êcüý¼ƒ{/ÍR¨T*é®þÞMfžFÄÇG'4ž’¥Pj9TdGý²vmºœEä4 "j51öÊ\w×–¯Òò¥2ùÓcsý:§jÓ®5ôð n?#!G*ÏOš×ª~“)çÙ”þþ^“÷=I¥ ÷¸y?ÌP°Z Ã!Çj–CDYÒ‹5ë6æ«ØvоkØð»óÑùùùïNÿ\ߧm,ƒ(½Ø¤AƒU×’¤2©<ã~¸—ã¼Ç èäß~t‚L©T\\Øݧ÷wˆÈ¨Ó{7™ºê„J¡Âìó]œwÝM’Éd™o7öp=Ã!¢úîDO/;ï*J…,¦«Ÿãº›RFžÑ§©ßš“ÔJ"÷üðæ '!"Ç1Z–CŽÕh´ˆ¨Š˜â:ƒAdrî´ð¬ûÇ“,DL:ÚÛ¥ÓFD¼¶±S`hã»ï3ÕZæä’ö›í¹­ViŸžZÒ=—AFg]™ˆÊ¬˜_~ù%]ΔhÒGÝݺò¾@.Ky°?Àß˧÷~DÜ13(|ö-ñýoS½ÃFgˤRi~Ìéïýz *"7¸;w~¯aÕš‚Áͽ‡¬8¢K󳓇6 ˜üÛuDDmAÇ–þáÓR TJ…üÄäÖþÃ~EDÅûß\®FgK¥¹§ç·ðj÷ƒ 1úÚšßà' Y2yÁ££?„6O–sˆÚ‹›—í{˜]ªí^Û6§y×q,ÇqˆbnÌÅ@_ß÷˜ygõÆj–ÃÿPák˜Û# æ¦Gä81ᎈgÑšœWýœoÄkã³þðv z Å”3ýÝFå#rrZE§–žÛ.Æ"bþ³Ÿ=½†å!æ¼:ã˜YÔ‘“vz¸õÊÐËÏ—é:˽0¤~óŠ⛳ÓšÌP"êOT$ÅÐ(rs刈j•Zšò¢‘ŸÛ£4Ó®¹¹ûþ‘ Òížõ|­oÃÖ‰ZL»³×+´Yž†CŽCÔ>ºtîM–²¤À–}¢wûzvT¸ƒúîùs12öÖ‚.Þƒ—!êlƒûêß¾ï|ä¸á~s·]×o~±¤¶ï 9""ÎîÛt毹S£ƒ/8[Tø²áíÆ,9‚ˆê»“ê7ì•VX‹I}|fnzŒŒ¼3¿ ^¯Ç•î*ªˆ)Ž¡3Õʨ®! ¶ÝLÔøƒÜthÔá' "‡øîú/Ám²5Èq(¾è/Ã/1ÂûÓk½[†©9õðÀRróhå`¯ðÑY…Ç(ä ·¹;wMCä867'‘Õª5ª»3ZMÙY(7>+Ž?Õy0Ë1pœñÀÖ+îéëÀd^¹x]¸¬½c¿}…5RôôóÞý8¹XÅK˜åô¯ãÛô˜]¤*²Ä;A~¯s±¼¶ô¯GPÑG_llF®QõêB$@ì]|ídIg4ãÊVB½bén#I}›Õвž!€„ðá8®xaÙÙI|N;¢Gg}„•¬*)F •ùU Åøb!á®dd²Ø¹dɋLJÝNâÙXš§Õ"á8 À ¡9€ €ØÂY$Ø–«.3Õ@l.ä$@@àÙ¬ÕÇ!Ð2O™˜cin©÷(@äײ w⽪f}[ÿ‚v•òT‰ÈV2³ „ˆ„„c™çÐÜzËjbÖôì¾™C€Ü”4‘a´î;®RM‹ÂZ>9¦ÌÚ•ýó2gèš]eÐÀ`;D,±"±râ¨,ä!À#|D]ô”|ÖÉYÙF†æ|½ÀÉ·*\/QÏI‹Ã_jåZÛγUç°N-š5©R"q·~Ÿºx‡ÀÊÖH,ÐäHžEAÎÒÄ\÷EB±LD$ÖïUY_¾U“æÒŸ& “ÞãAB¸µêVlN?ªešEÀq¨Ð_ÇjŸåµ¥=^nˆHÀת ¨‹ü DHò@ô÷QÃr|!ÿó|€'0ßõÇãRaÁ‚oÜqÛ…?tZ±·hs"›·íQÔÁX$@DŸ<QƒA' ¥;f™ˆ…|†Ó? Dðú¸†ex„_:YÆECÔí¿x{/Ï2bÑÿü‰ ç°ý8<¸i˃>#|ª|tZ,+ò_Þëø<"«ÿPË5íb;gËÑ9/®^¹æçµ[Ü:»]Rø:ïÕ¤Å[¦l»ÙÞÙÍi=^Qn0g$‚\ [AÔ]¢Øf?ë\:"Qæ-¬fUY®~¡/›€RšÈa53C:^q+XǾ <¿€HÈÕµ3ûÌ^el^O,ÑÆÇçëš¾<ζŸ›8°­RG£•&æhôS\f|–âS­½è©[<¤ÄyD-ú‡ê>¤=Þ¥åôÅFq3M«;¼àýe54°5ûri®–@šå]›/¸™V¢¡–s"÷zUÓâÓ”ze)˜Û¶Ñª×LK_óÈ{QE½{jmîùÙ dQ§F&OÜÓGîb^¾–±Ÿêó¨?Ëž‚)¤ RëŸ&=²uÜ®Ñï$sÿÓAYF¨nk-ÍÏUÝfÍÅ3I¥Ž‹{våyœ \C»ì8²Ã.öÑÅ\(\h Õ“zŽ¦ˆ¨ùõ‘\X~óç€×Æ_rÿÈ}݈U¯ºµhñBkÙÔG|cÏÍB °Ïî½dŠ f©™)çwi|R4CtRûòÀâ=ÂFÿÙ™© >ºAáèþ/l”7ØJ»eûÙþ¿žÃÊSÛ¹|7}Tîˆ~fêä+ww˜½Ó µœR„•DÚcÛ·íòm>½±Õ°!#‡÷ 3c3Nî\˶^³cB“òú˜ÄÔŽSœüm×΀–}«³ÇÍ^3oÍîÚæÅ&«Á¢s+‹Ÿ¾ŸÝpd‡ÔG§n¤Õ@ï‰ÃUZV!Bái}˜éÛVœl:露´í¶²ïà ƒ;…ä½¾ð[¬ð”Wå¢þ “ƒœ7—Çÿ¼oÕºM• ‹N„•[è½ý`øý[y&Ý=tNU몳ÈÄùçC­ûÌ0í×Ì-ùÉ…­5+NŽÂòÛ°_|áöÉCU ¦lr m?pvA×àú™o#~Ù~iÁ—;Õ7)GñùVˆŽ´R…tmßäÂ÷#÷´ß>µC™b†æ.ý§µ<4iü¼«‡ë–È“Ž™½zÁšµÌE÷£j“Þ V œø}Æ "¯ŸŽ©[òJ\lÒýã­1´ƒ¹àí#)ö^MÌÕ¹èÍ›ö¸»yˆù›Öíl]ßø±ý­›Û.>qõÂß–n5Ê’˜½Ñ¬I¯Ñße6q2¹qh#Íu‚ÝŒŸ×v5ËzR£º•##Žm:›qæêÑšf¸ix·Ø¶ë–„Ù•0Fµ–+úüÖ»ãÀÁ]iïì>#Üs£ ¤Ü>8uçímVðÿ[îTÝèÕoéÉ5c²_Ý}§ýþÐõ¡Á¶ˆ¼6³÷nšÜîåõ“—ïÇô[}~i_?Wvñ©Yxy^¾Áö• Pbßul¿FïŸ>‘qân?\18èUÄùk÷#›Où}Ç„&ˆ|à ` C}Ëæ[¸„ú;ñjøêßÚõÅ£—jÂ#|‘µue¯ô(ºýç‡ú™œ?vL]»ûîU“ÖŽí–üôngÚtýÑí¢¸ˆs·Þ´™¹}iXmDDÛxmVÛÚÏïÜH—x¿}ÖÞP€%|‘„IŠÔ” !Ï=ps˜o¥G·o*ªµ=si§ "¢Íæs—ÛÚ©Ïž>‡µÿ¸t¡‘ @CïàZU ýEãšM‚ qʲ…¶Ìýçñ(¨qøú…ÆVÒ‹çξ+¨¼ïæíNõ€TjÐ8 ^Qm4 ªçP ˆdÙŽˆ2ŸF§€™•UYþϼA“€zÂìU;eǹ÷Po°¬îàVEW²‘EõÀ@wàZI>zêñb.å’)zA^µM—¯YÊn\‰¨ÙeÞÊ!mƒ]-À®^ w]s·ùŽSŸ_¿pñ²Ê¶å©ÓÛÁ¤ùœ)³^?V?óÛ ƒ´Ç§¯h _,|!xy@½zà䶶P­Ô® öö``P;!0e*Ä¿‡Ý{ÀðÏÈWˆ(­5•*Aõêàé NN`m P³&88Àß6U÷ÕâK`Ú48¼ì„Pݦ,‰“hW§rS˜>öï¨Z„rpÈbÀÊÆŒ_Ÿ :×U‰ãàÄI˜<l ÀX6Fpù¾¾Îÿ aapò$€ê@>öîðËfprªÐŽI‘xä ê ¾FPK ÄDÓ~^Q܉ÿôÌTÑ@°‰^~ pv°{?¸»CÉŒ(êêÇŽÁŒq`- Oÿ•’ƒlxóçø˜:›èó@“Y°óƒ}ÁÊ©ˆ¢Ã²pæ îNðò9`jý{ð_ši®àü·ÝZ]ŸiÞ€ð ~x"Óç‘Y‹À:F6÷ú0uZEÑ• ÚwW;ø¹ØË@ æ B ÁëÈ?g)\Ý@F(„z=à¡ xª €yÍ«ƒ¯7œ9[Q´¦èbgΗšðc/p0䃔û Xž>‰hª•› „——~È0|$¼L×AðD jøL`›×~…ºÆУ+8_¾èùŸØrraÕhÓ<-!÷*T-#ðr4$†°E â Ukàóÿ!èÞ@«…þƒáq4Ôê /¥À"X À4 ¦…¯#L˜ ¯^ÿ}¦€²Ì¾o?ôî ö¸ò Øåƒ12ÔnÃ×€œ?¿Òƒ5 u¦þÿ9{Ú¶96lÐÌ{ô˜[ÀÏS¾½òRÍB»¶0p$¸¸@êᬇJqqðàìÚOî@-0‚nµ †ƒ\-˜Ô…ÖÝ`ÞÜ?¿?= ]º,Y3f(•0d(¼¼ ’|0áÃAŒD0e4jµA"þ ƒ;EŦg@RlÞGvCeÕ$€Ôä¨Á.ºö‡aCʬ†n]k'T€¨Üü¿Áq¢3úÇAòÇAœ1 rˆ A·Ôá¬s  Z‚ÉÓ E‹%ðxŸéowHDÐ/† eààøá;ÈM[¬…%wH惑=ì;õëò$ú~õE«é”"9€ãÀÑ¢t \ L&‹Œµ¹pÁ~ÉRUƒÖ<¢|¤i Mî^°~3ÔªU¨Î¼?Aw8NG8ví„ŸuTEн+Z„x>Ôó†ýÁÂâÓb§Ñh^½z…ˆ...¢ 8­Fåæ¿B½z ^ bXöíÛ·˜˜h}ï®Íú Ö`-!òA'@Ëš9ƒ‘9ØׄÈèظr`c]nBà¹óž„ÎÁÛH¨f‰1ÀJÁX"|@€‘J¨æ+~/o°²üô8"::Z&“‰D¢úõëó¾müÅçëP« &&&77W'"ÏR©´øæLFs 5 @Äа `¡@ "°­¹ðð„É¡nÝo©À‰“°d)T³„´8ÈI”‚$|àà!dª!J!°h)87Ýële¤Hm£¢¢¤RiQk¯S§Ž©©)møTnþ?X¿ÆŒؾÔµÚüüüèèh½}žMBbÕW¯É­Køâá`FÀ\€ [ÄP?PÊWƒŠ±0i2¨dB1ðø‚¦òsÁÁ hÔ`,c°ðxú¡“nÕ»LdhÁ‚;€—/têÖÖŸVDLMMMMM-þ“o 4ø–׸'N„5k†ÎY–ÏÉùð£1"##›”T8y ï]#Wƒ™,ø`.D`9 d ähAÆ@U00#_•Ì@©CP©e9ÐjÉ@¥€ìçCC0ãÇ!C é Ô® ~­!(Ú´Ýu•c"ï)999##ƒã8ÝGDtpp°±±¡­žÊÍÿˆðô)xzŒ¯ëfˆ¨P(âââT*Uq·ŸCtpr2¯TIüüœ:§Î.d Ô€¡àó@Ìû§$%WM@?ü­fC rðÍÀÐfб= VVŸö˜tnµZ›››””T˜ÐÕÖÈȨFß øò%¸º  [¶èN$“É”Å2Œ !µjÕ257çÀ£Ç°ÿw¸u¸<(H!F"`µ@„|ó ÔÏ]— }.AÅ‹ÀãG@ª¾9˜Ö‘)ôî ½{éS?©¹: hµÚœœœäää¢õª !†††NNN}UÊÍÿ#99`o Ô¨±±Å®T*}ÿþ=Ã0EMy<ž@ ¨S§ŽX"Ñ·úÔT8qb¢!7b£áî¨a" d,èVR" àOFÏBº :¶s°ªuêB÷n’D¾ G!¢R©Œ-¥‰ ¿%vÙÙP¥ hµÅÏ›¯ëÃEÖ°°°ppp „è+@bcáôiHN†ì4x÷>ƒúU• P«Oôf›€¡1¤+A¦‚¶Í¡’ T²77 û¤§â6a&::Z·RRѵ …ºuëŠÅâ¯5" rúGáñxúÄ#o¦róÍéßf`Ù¢ù&]Óä8N&“EGGëäÅ{µH$‹ÅÕªU366.]`^¨Õº «— €eLLàc7ç“Á΢®"“ÉRRRÔjµ¦ð…ƒ¢Zñx°  „Ÿ, „€‘|½ßWt Ã$%%ÉårµZ]¼U‹ÅâZµj~“A€\Z=ô‡ý÷x¦Ö²ìLóZþ;l®ÊÃÿÞÏ(P¹)ÝEñÛ;3gÂÒ¥ëÖÁèÑåô—¼ŒŒŒ¼¼<]üµ¸îðù|+++@Àãñ __úö_…BÁqœV«•ËåÙÙÙ¥F[Àqœ¹¹¹.ú'œ·eK¸xàúuhÔ¨Ì^Ê :8Ž«T©’±±±©©i‘ ÿYvøx,#•J¥Ri~~¾R©,ñ{¸ˆVVV•+W.ãIð5H#ÖyŒüã÷‹—ýlù²ï;_¯û륟B¨vüåF÷QÝܹhÈüÃ3o¿l÷­%¥¦‚—Ԩ˗C`à'Z¹.nªP(T*Uñg». ÉãñÄb±Z­¶µµ555ºH!ä CZ­V÷Ã0,Ëæå奥¥‰ÅbFóñðŠ"‰LLLx<ÞŸÙ«#" gOpp€#G œÀªîtZ­6!!¡  @SòÝN­*Uªdee%‘HD"Ñÿ4AD­V«Õj EFF†B¡(u½„SSS;;»?Eæ´òœÄ,y­º¢®¯m=÷Aßk¿õåSñøŽn8Mþˆ¶mÞMgNw9÷¤oÕ?q¬ôy]HJJ’J¥EcâÙ.Å;€®§)•JSSS‰DÂçóuûðù|–ey<˲Ç)•J¹\.‘H†ÑjµÅ“ïã5‘HdjjZ­Z5@ðéNõñ/ÌágSݾi½F“˜˜¨P(Št§”ÀØØØÐÐP ˆD"ssóÏjÃ0yyy:ƒH¥ÒâŽR‘s¤Sy¡PhaaQµjÕ¿"ª‚ˆ$íáž.CÖM>}«›=U›ÿ¤Ü0ŠŒ“ÏrƒEG§ IDAT̺Ôo~ùÅŸ 7_ß5R©Ô¹|>¿Tûf ŸcÒ}ÔyLÖÖÖb±X$}Y¿B"å‡;’ò ^HçÙ#Ãyð†Š ’™™™››[Ê ¥,ÃãñŠÌ¥ÌUô3¸åÙPgÇ$‰þÒ̽‚È_ÃVkˆIÛóWLÿs}C*7ÿ,g ’»Ôoýÿ"7¥†J¥R*•ªT*•J¥{&k4›ŸS”R‘H$ X,Ö9ESÚ_ÕÜ£.®ë1m[ß1“­x—ömz. ½ôÛ"¿.ÖY¼z …B*•*•JFSd>Ÿ_4·õYƒÉ®X,Ö9§‰D"‘˜™™‰Åâ¿óþ*2"—Lô¼Ú´ÃKÃéðæø§' Tˆ'Lñ>c`` ‘HJõ"À²,Ã0¤œ´4ccc>ŸÏçó%‰‰‰Éžñ³œ=z `ÀÖÉÃ<¡£§¹kçeï•\CþßcCCCÃÖý*n™L& €ã8.ë¼KçÅçóy<ÞÇùÛÆy¹Jž]+0°®;lÒ¸ž~ÍÑ„W¦oAü÷ä¦BJàGÝ x¾ü'†“Qÿ·îú‡q Ÿ !ÂÿïŸOùß ò·ù2/®w*ýî‰!6bÚo¨ÜüCÅèo:#"òÛú_ª4hS]L Â$ŽTè ‚߉AG›´ëáß°ž<=òþ·ý¶\6¥ ·P¹¡”ßk€nׂž[^8<1•Ghnç—:ëȳ]uöɵ“GߥäòkÕ8}G-K*þÊ «ÊNL“Óµ<’“¯AI%k›JFôÖ×Pg~׫éuÃî§OÎ3EúK(_5øIã½ÿSFdÙ˜ÿô‰ð¬‡‹;Ž9ŠÅ²I=/^?¼5½µ…ö@ ²mü{/;ö}{:ŸB¡róÍ] Iù‹л«ãäê^xŸÙ6ŽšˆBå†ò—"ìUç1k#àés”9Ž7âÛ#œ ¨i(Tn(¶/E¾b`H¡P¹¡P(ÿxhþ…B¡rC¡P¨ÜP( • …Bå†B¡P¹¡& P(Tn( • …B¡rC¡P¨ÜP(*7 …Bå†B¡P¹¡P(*7 …Ê …B¡rC¡P(Tn( • …B¡rC¡P¨ÜP(*7 …Bå†B¡P¹¡P(*7 …Ê …B¡rC¡P(Tn( • …B¡rC¡P¨ÜP(*7 …Bå†B¡P¹¡P(*7 …Ê …B¡rC¡P(Tn( • …B¡rC¡P¨ÜP(*7 …Bå†B¡P¹¡P(*7 …Ê …B¡rC¡P(Tn( • …BùÈ ~Éwˆÿà þø põêòq¥>õÝמæ+Múçú NøOéEŸ0K±oðën3•›¿¼?SÛÑÑ¥A—uœÔu®_Ç¥A—µÃÇ­"L~ˆÓ®ë „ü' $íHg»ÆË !{Õë~˜”_ÜûçO”ëÕ"{Ù.Ð}ÿK!ÜëÚ¹¹¹Ö÷kÞeÿÍw„Ë«z ߤò)‰Dàž=z¥ýÄiÉžnN§že“”óu¼çMJaï·v­þ_L_VU™ü¤§¯“t§X5Þ£ÓäsˆäŸÒ‹!×W»v?€%Í‚ˆÔ‡z\{…RòdöÀ6 Ý껹{O_}PÁBÈÞYmÚÌ8€„àAq°‚Âû[;5¨ú„ó²4ùmšxý~+±ÔÇ•.…+õ±Äç´ýœÛÿ‚ˆÈ±Ëa¹%Èú5y_VÈéNË•seïý™J"r¬jt«€Ÿ>AÄÔ “¼=š=Ê`1ëþú÷:Ç^)ås›{/<õjã›ùôÉƲ®L÷Y‘äuîE6¦^vñn§Ð~TçÒŸ™G3œ‚§¨K[µœò /¨øæ¢otÇè>¾ú}QØðͺíëg4ê=ç÷‘å>m·²v(ëîè?reµïc97—+½=b]›ÀG>ÞõÍ©­ç)QÕɹAÿµ7 "{z¹t^ÿsÆ4\ó8ÿTÜÑM±¿‚,Sj±ïìÚ©]º„˜¶,K€HÜ—‹' ;µ”À¼eÓ…‡…/Þ}MÄ×o½¿{XŸ×u©¼Èó“†tïÒ¹ãè™?Ç(€å¸Þ]¢°`BXÇ% Ë;÷éÒ±kמ+ÞB !dáø°=·3ϯ›Ñ9¼Ã ± bd:!'÷æÇɃ»ví2kÅ>}%sž}?a@xxØø…kåPº’@úrÝÝ<—!aî 1¿kŸge"Zz ³­j’ `4ÿ·ïÎÏùV]Þ0œ¨Ò^uí6\Á‹Ø®Íoñ„ˆ8¸z@ŽÝ{ Øu5)ïÀćF÷ïÒµK§‰‹~MÕ”éðÔò¨ÉƒºtëÖcóÅ·Do¸}huÿnºuë¹rß- $ñÑ¡Þý&p‘¨SžvëÞýzB!HwtbçctÃIB0vûÄq[.fGîëÒ¥{ ÀãóÞžXÝ»{X¿¡“e¾¶LîöÅ“ºué4`ôŒÇÉJR¢fˆ N\;wt—ÎzuòY:!!¯Ô³S·}·^ˆÔ¥«pÄý»uè9xÂí )4ÈÑ zuíУ÷Àíç^BÈí탆þòæ͹ ½»´ëÙwäåx–@´ù1sFõ ï¶ùò{‰ ,WUõrüÜ«?ìžo JÉmØ£ÿƱÁ€†uLsMoó´ßGJeþýÕ?6TLø{N‰²i6uâ(£7ô_°¢É¾×´qwpïS`_?ÔŠˆ’ê>‹æÍ0(|¶¼»cä$+§V–‚„ÛOSË»•Ô™ú;QN ª1þLn gª™ïÜC÷õ__ï2E<;Î+xÆ墽· X~äIñ‚òÞ\ð ˆËgt#ê?øºtü¯­j<ì"¾Ú÷}@§A2­~Èœž”Æpfó¬×JçL%D¿HÉÑ r þ\5ÄwÐÝ®cûŽ^ò‡~HþrumŸ>2Ä ZxÜU8Ê[8unƒ'G{„ξQX#¶_K¿µ§_–¸\ET¨—ïå„üâcû] ú¸º:¹z4;öV®/㶠kßãǽŸ0œúÝZ÷†ý²•)ýý½^d²ú/Þ.wv”]†3ÅD,Üxè|¦ÐsJOÍd¹ÒÎTƒúŸ²zodV¯ k1ò„æΧ^Êô®JÂf7Ǧ‘¨åïùÇÛLD<>¿É·nøwXÉ"Êßßôl”ª(á»üö}÷î£6é©YÍ:X wpâO6ðj‘¨á¢· wŸU´ÿ±åÝÛ ÜP²n)=ëí‹Té>ägfÊÕŒ&/:4Àíf¼þŽbì:g×^éˆZY\ÓçKQ*›vtùü­W^¼9ëœ Ó7éÃ.]Ò¯mìÒlœRç‡å½ñõó½“ K8¾´aË^l¡w¶ºc½©Ý߇uµ³¸×¥3ZÌÅ5Î>íbTl¡ 4Ë: Ûuó_ïL þ©2ɱõm«èã•ŒSÀöÜC­ØéÐœ™gYDB ·^$Ÿ”“(à›KøH€ø·©‰{K%…aé§Oà¤IUšô 8ëÓ²×ða«Y‚:×ãƒskéY—ºÊ Ä"d5Zù;¥Rlç`¬ ïû&ö¢Ÿï§†‡Y|w-¡k]Ñ™KÜ̹Þwsæ¼VMâGÝVíneð‰›«5¶ ÒùA` ŽÕ°pýi®©&cî¬i ‡@x9 ¥â>‡#ô7H•î-=Võ Øêà5hȈÎÍ=%ž,-’eù¿¯™}JÀŸÈŒÙ·s!D¥VÚÚŠu6›²"¯Ü‹LLÅ|ÝUˆkµ0቗ dz Àç-K¢“²,,-x:Û¸7²;ø²ôud%&Hj{€<Ù=¥ßêçkÎ]¬%ÖoÕ柉΄;‚nÕ?v8ÇV}GÚh92b´ÐÔªDgâ8€RÆ3¿ú–«wSS’ŸÜ<óðvJïãû7~ø>w@5úmºÐÝ]ÀçÅn?ðá§fîñÃÖ¢‹uZ÷ákÉ ®’c„¦•‹Åj àñ€"„Dä‰ÍZXõâfë‡7Ò ŒEZ¥öKç~Р×Ð16"V÷yØ°6øøh‘Ëžk·S““î]>6¾k3‘K‡³[‚Åí@xe”_µáN«…º½‡'<Ά{?±¨UC(vµÄgo§ŽxŒ¸ô¹–Ç+eW4wô5¢§š+<…@Ä'|)DìóÓÞv™©ñ‘÷oŸµflÔš ]ª"²¢®CÆÔècC†• € Š”Šèï)Þ¬`¹rü–C^±XD™{i•Z‘‘¤X À}Ó»,yfsôê'3(®â†&"µTM'Âÿ9Ã6såG¾ÑØר]³f­Zµj ªXš×33[–ËWª9]°äî¹ØRq yfìû,A»Úm{;qí„É«»Ç’][" |›˜!lß3ØÄØÈÐÐðò»,Ñ';MÑ«{ïAÅÎß¼äû—*Ó¦®$ò­Æ¡¦¾’†B£*–&Å+)4 ‡ „¨–vu ŠN”°A}‡ËÈRZ–žû.K–MÍks¤ÀØÒ®VÍZ5kÕ®UËÎÂÖÞXPVì&å]º\RµzÝÎCf\¹»‡»~ü\~™Ú^Â!Õ–(SS”D7}r+ASÝËÄ6Í,çöìPÝ©1éRåÅãÃ'oŒn\©œÖX^ðë›%%+ªÕ¨­»„*•-lííJÜ=mþë˜ìJ•«6 îøÓö‹Ãƒ.ùÝÄÔI Tl /ܾRåj¦ÕK +LàþÞ Û¯>·³µWi¥ZVwš¸ë2®^u“²›[õÊ•rós@×–ž^Oþx'CsCUvva$‡<Ü6fù»šNmt2€~$¬¿ºô •‰ •› ,@‹ß±'Æì¸ü,99éõ½Ú7?ú(³Ø=+§†Õ@ùÃÎÓ ‰ O.íÞ–-)uýw¬èÝoø˨˜ÄÄø××Î&ˆ,=­ 13`²î>Oˆ—V«l®ºvæQjJbÄÁ…ÉZuArjRN6–“õ4g¾ù½e?yu⇛o©%Ðrþ"õ‘‘¿]}žœœôòΑví[œ~ž]¬Û 1¯RU¿ÊQ€dÀpÿû‹zîºô(:ú]ÄñçÞew m€€x=ºÀÙÁɘ5jà÷êRªÀ30jž¼—Õmï`6í»µÑ‰I‰q‘[Æ6o1jK™íáĪÙýÆΉŠMLˆ{vúD¦yM73ø\ÆòìÛ:×\µje\rrâû73‡­¯Õw”xBÓ†¶†;_®ß¼#qíÑòþá­quê J)J³Þ¼SÞ#¾þè)õ⎎ßr5.1)>êá˜pÿqëc1$ŠÇƒÛ´úíÖë„„„¸è×w£ãkÔq#•jt¬WmÑK£ã¢vOiÛtèjšØ·©gÿÓÒŸßÅÅ¿}|qêÚ­† #ç Æ¦ìäÕ‡RRÞ=˜0jÏ”…UÊyº9µnV)éÙÜC÷ââoîùḪ µ«Þ@sˆ6îì5/¾[<2?ömddddäÛ·ïbµ¨³­úB4ë]Ç–æÝTˆPñ´Fµ'ž-*nßÜwD’>ÜúdN½à‰ DDTÅ_Ý­Y@€O›îÃï¥|\#{7®{S¿€ñËçß›åÞv‹x}MëЧu;<9º<¼¹P€O‡¾co'jt-îëà?éP|î£ýaÍüBB›ýr.1kRx@‹Îc´ˆãûø/ÚùLŽ÷›êùôÌFDÕIwÇtkäßÊÊlµ>R¨Œ»2²kÓ€Ÿ¶=G>LS~\É |[,¾YYL½°_‡ÐÀ@¿}FßM’éSYyç&.;oe!"«‰oï[çÀSÅGi(Ìâ!­|}ýWGHñØ/Ó›‡x‡„Ì\sL¥ËQ¤4mä{þe6¦^iè×<^¡EÄk»¶kìèÛu茗™L© æѬú¦åÝ,Ôè‚¢ÙƒÕ8cé ™”;]y7îP€g5é7ï²þ¬]½[¼W²ˆÈÉâéäÚ*lïõÈÉ3Ç!Ê¢®ŒíÕ:0Ð7¤E‡ g_%ÙœÛ2·eˆwppДe 8,Jš9¾vrÓïF­º{™­Ï bUÛ¿Õ$È»q‹Ͼѕ~}SǦƒöëÃìò¨À€€›±yˆ˜«_Û ÿö?|yhpHÿ½lÉû˜y}‹g³p%Ë!bäñÕ¾~ÁAþúuJÓ"‡¨Íkèqåì_*þÈM©¬°âé\W²Áqe&z•û±Ô ¸²J(³ØÙ¸âÿsåX^š_é-ªÌÛÁ^Ïó°¼!bÞµ™ÎÍfË ?®íÝêbú§ .+)®D*^y•áÊ,‘+‘Y†éŠ¥ðé‹áJ]îIŠÿñ©Š•¿÷¹4?üš4?®t¥¹/kK…Ëf5vZ‘ÿélÌè#£Ü;.S•qTn(‡¾r‡ætìZ—!ãü ±€|ÊÈW£tŸ’#lûÝÊqÝŒ[°{|x­b{D–ûh9,DäN<И J‚^[Ð?²Þ°™­làåò¡— ú_=øƒJ¸ŒÜY3qóªãQ¿']ª¶ˆ_Þ.tK^*÷©Pb@ÊI]iekn ËSùøZZkXÙ„A}îÇ˪™‘™áäMzÖ5ÆÜ·}Ž‹S»9H^={_?|Á†Yíx1Ûû]ø©™úºf?9û‚[qúDc3Ø:{j’³fêDï>ÓG9&÷é=%–X»X©^ÇH»ÌÞ5©] BȲ1¾÷Å#”I÷‚=«Þ¼t¦š÷°Í?õ]2yn¾ìlj“BFýد®Aá(vp³¬ßãæµsŽWÿ>ÓëÒ¦É?î¾æàì‘òâ…¸aÇ£ç J4BvÁðNW^Éì"ŸG;´Ÿ¼ÿ»ž~|-_mõÛò¬è– Çöf#ï:b¥Ü²ž/-N*žÿëïMœÌ ¢ô²„µi`Er^¥²c×îàn]Ôæó˜¿öNÆŸ:f☥«ë’ä!‡¾Éå5¬UéõãHûÖ3výÐWø!dß‚IÑb²qöÄ{=fXðˆV‘Ø©qc“jï_GÕ ¶cÍx@$²¨Á}G¿V7¬J^¾No:aË÷}œ _”"„°¿Ì›Ï3È^:>Æ¥ÿáp Ú³|„³&b’ërËa¦g®É«mÙýÇý-SV¾YÝ©<áy6i°öôÞŽ©Ò妇™ŸúÝ”¡n.+ÿåÚÛAË·é:m±Û·™™&?Ü]²Óóçvñí²wÏ”N‹J5 6êhçKr%¶¦òXµ‰ÿº£[êŠ!ÿöª^3vñª5´†ô÷yüé+w´s¶ŽÚ߹DžÎAx¦rç¤ûÇãÙÀ½ÇWÅ?š2o=áT3ÆŒïóãÚº/W ˜¹KTÃC”“kà°u÷NC>ÉáÞlðäöÎW²mMrÜŒž¼a¸öNqË×3¦òõ½ºÂòrg?¿öóu DŸœÙÐX.â¹­šõ]V¸TÃioßÇ™JLø͹žëÌÓ©ºí;‡7l5ë"¢æ^@½à7ˆˆ¸lXãnÓwêvHº¼ªaHÇ_×öñ%SMî ËÒ»Rõ­`'ÿÛÊRiqÜؾ“7èñ˜ß¯Ñ°ŸŽ 2½•¯ÇòÓït¬íU¿Ù4âûc}üú<ÉÖÝ°ŒÁ.ÇŸä"¢ôé/¿±jDÌ}ÑÈÕs×ÃLÝGg¶µQúÊÇ۫߯ºí7kØooIËs4±èß”w£:¼óÛèQbD¬Ýþ§§w6W‚¼Ëg#}ÇŒ×I¥c€£>ú6x ;Œmk«{ZVq©ªM‹å@£-¤ÜçݱMZZjZZª‘[¨CFÜù4à4ö® ÚUfª|@ÃAMѨ¦ÈÇB­@ÝYÎî½V)п—–––š–&õiÒ*åÊv¶Øè†gßyõŠq9Ï]»|éê$CSLOQ«æXFªüWéJu€»®VNû?=󀃺 žlX|ûULFŽỘߚÝÐh9V ?uè¥Ç¸)äUvöO¿I.z©’ ÐêÞ¤F­Mý^¶<@ÓêÕX•6ŸA€œËç^7ìÙ]W ¬æKT¢3€š`5Ý$±k7?ÝëB&övf‡Wü—˜W î0tîÀ–5Ó²ˆ£o$BîãÓ-ì?óê'‘—{唫o¸þ “Ú1D—¤ºh÷õÍ3Ãó3^ÉÛ9é\ïáã*'^ˆ j«tq¶óEb™\j- È©bŸ?ÐX˜ø[kÓÒRÓÒÒÝ{ `ol×™Š†wrÕÝë¾ÕÙôx¦„åiøæ_äL(ãóÕÌE%[ª4].iXYTØô$UMÙ„5Ôà ÅÅAéHBn˜›ÚîX‘ŸcÌ{ª[òDÆ…~OO;pœÄÈB·sj>£zv¶mdzEE‘¥cñõ Øøß[…ÿTµIßÍ\ K»ûœ&’EƒÚmѪާAù§Öí_¾hT™–ÄüÞÀBTN… R¤"wkq¡A„vfð(÷ë¸#1¨T$[…ëoæì›ß²IDATç0FoæuºY´“„ÿ&U u>ÿŽ2U6Ò¹>„·ô𥭠¦ôí¹›Ï[Þ{ÖM*oM›ì¸l‘u•/è¯ËJ‚œÄ\ô°ü°³6«@clf¨»YúÍŒ:‡CS±þ¶¡¥‘Xš)ƒš 6å}¸ÞÒ!—… Õ»wüàç ¸l9T×-yÃ#E% Õ—³ÜÖ6g¢ÒÅ–$1­b¢JÌÐ@m(“¥|‡r»bq,Q¶7nX­?­~v•Æ~Ý/¯žV^~íÄu•zý¸wZÈÛ6‹+Õ`ù"+Ъ7\{Ñ°t¿æõšq¾× iNÆ“£óú´›påÎFó²kalg¦IHWƒ‹4‰ù`WÉà+/ÅÜJ ÷Ùòr¶ËGQÕ/›‚Ñua·úÃΡßi2ÓSWÎè?j–õλ—¹¿P"Ôª™/)™Ñ°BIÉEÀ„ÖÆbyv>3ýÅ|"Uª€ˆ€6S®6©ü+:˜™ñ$•.^¹hTò7@FÅá¿53%îÐÇóÅúåR $áòâºõÚ¤@¥¦­ë>Øð‹®y¼½ùL îálÜ'Æ#¬V¶^>5.nØ¡ß–vwÚìeŸÈ«aË™ Ó5È–=C2¯\¼“­ßp~Û¢u§bŠïÊCäñôRxiÅÄ8FÄ0<à"ÑÄfõ­ EGO=Ðí“ÿì÷éKä/3òF‚ L-¬š†ðe©ŠÒÕ# UŠŒÚuu}úëJ€0)Ok5ánö%â€ã´^ùÓ)•B[Ö¿¾r¥þSþ›™3e©Ù/O „é1ÃeOT¹Ju·Zò|Ýòt„)Z”°pkg'’ð¬ÔL"ð ÅçÆ2c3…5L‹/íüš5,/: €Ÿú7êy¥ º›'?;çÐC}QüÕ_çm¾ù)GéƒåA[uÿþC%C§¨þ 3SàÒo½ïÅÞMƒBkXðâóD³ÿ8X Û”5ÇûŒ íxßņ<{×hÈšæbqZ†ýp,Dz,`Ô ÀN98¨•g¯ïw,ý©{i~-Ž7´¿yëÓeŽ aYöÃ’mÈ1 `áç^eAVþÃ7üÚïȈeýή#–1«ƒ‡}}OùûçÙ†n›ŽÕ&ðÀˆ…½Ž›ÜùU#ãüwæÝ6w }xvÛGCkY­š?üÞé–û~™¿wÃØ.£G6ÝïTÓDñ&Q6pþF³¡†Ãºy›Õô°HŸÅä‡-ÛQ­äP¦F (¾o߶õøÕÇZŽ\_ÿÖÀ¦m;»Ù<{åÜ{up Ó«ïIjÛ³£›¶pïñ] ²Ê¿Ç0¬.» ïŒåçzõivų¦éÛošM´ñ?Œ)u×ÎèM̱ 茀úmˆ@LMW„ø8ÖwÑfE%HMçü6€ ®UuÉò /®4Ú»q ¯°þÆn½-¤#^僷) p‹†„߈ÏGFÉ0êvMChÎÉ‹­ÌâN¿à\–Õ(Zf“"YµdJØÈ…~g7Xªâ”¿n b8°fP·É]oìõ1W%ÄJë6LèjÈ~x1 Ã!€±}cKñþ-ZôZ|òКn&µ8l×ÐL“ò^j0wëM†ù Ë°lIËŸôPÝ1bþÁË,TJ¾è±Tß™B¢›Ðø¿öî_5Š( àð¹w¬RØko-éca¡¥A$ØŠ `#"ØXˆ/ bkc#bog'Xå|ë€{ŽÅÌfw“`¡•ò}UXæïÙßfv“ÙùU¥·åΰ[öÞ¢¢ê8kš–›IVŽ¬Ö§Þ–Ÿ#ZŸúÆŒÑz_––c¬¦¨<ΚúÔZdŽZ͸‘›±¬s~ŽÅöço‰\m̲òeu•YÕzoQ™Ѧ©GÌ‹XïN,³<6ïx‹§~EEefDôÞ·dµ§^Ÿ—U´Þ"+Ö;pœ9õùnªgrúpŒ1Z¿Ð[äó$U9æ=­ªh±Úªõ‘‰˜oâÑ7DZr<¸}íʽ·O®VÅÉ\';ئ©µøøäàÃÎÍO/ïŸsb¬m=ì-濶־q&DÕÈ\M¿lê|d­@ë-ªZÄÈœ‡wžud›¦µùˆÊ¬“iø§sÃÿìèðõÞ£Ã/_ß]¬sþYº"Úø~c÷îóÏß®_jáùì½øÓ+åÚÙ}üâÖчoƹ%ùùãÙþþÞ«÷×/w­ñÛ üõ›s«ïl9óØúb°JmäÀÅ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜüÆ/ÚlC™üø¿ IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/within1.png0000644000000000000000000004337213051004444021505 00000000000000‰PNG  IHDRzui”¶sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ !.‡‘êc IDATxÚìÝg`Õ×ðçÎlIIH(¡…IH/$ôÞ‘ÞD@TÄ?ŠŠ *b¯*ŠŠ ˆÒ›t¤ RBï=$´$¤—­3çý° ¤‚ò žß%[ffïÌ<{îÙAD`Œ±žÄMÀã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8nþˆx¥0V~¿xv Í¿m„À²ßÖîؽ—·0ÆŠöRAŸ¼?…ãæ1{þò¨¯’ªðvƘ¬ÕïZ4õÐÁaá7?;Çu}U•·4Æ kQÅÝSñ|*fŒqÜ0Æ8ncŒã†±‡‘€,Ëå~àŽŽkxU2ö¯Ž“ɼoß¾ìœÜ2YÓ²eKŽÆØßÉd2ÆÇǧ\º\òAEQjÖ¬Ù AîL1ÆþéªGHÒ¶ÿrÜ0Æ8nc7Œ1ÆqÃã¸aŒqÜp0Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æþ2¾Åƒ‡ˆ$YHe.·DP¬ "Û5´‰HÈB£j…¢¡Ñ¬P*¾Î6A’…¤j&B£Y ¨TÁ…¸‰ „qãGȤBUÈöp‰Eƒ¤’\j:D$$!kWƒ"ªzcyÇ ûWB¤lz}ݼE$ë$‚Ts¾FÓÀÎφ·l"!„¤I_7ûmëÅêô{¼TˆÂ}‹Ÿî£´ø©ÿãíÉ !@²^9øI‹=Ã~2ÃͲñû>ON¿[GV©lÀÉõÚÞùǶ.½xêˆE‘HÕº7jíßfXpóX(„¢X²¿´óX^ãaZµ÷'@Bˆ‚‹?.xã=Eg/ bV5®^þ-}cÆÆH¥‹qÜ°YâhôZ}NŸoªagËó…¥£7ÿ2^ò^éWM%HÙ{w´7O99=»°E;"‡¨VOMXóÓ+Ç"·5ñwµÕ¹[^?åØqÊîZE£st‘Ë—5€"yõÄß×ló>`Æ2g{A¦¬3Kžß9{ÔÙ‹_ÞZ5C\[|0±FX`Õ„#ó•¶oi$€tɽùgûü]Ad¼rlÁ¤ƒ¿FÎ8nØ¿¬¥¸wþä÷öE‘@ ¬f~r‹É¬óòªn6Ø^êæã—ølòõìÆ5ÝlǬ…ÎA@ÖhïlN*j¶Š£i$f ‘;Š•‰BÍ<™b°Ôð© [6ÂÞÃÙ^g2Øæ+ª5jxáàÆËÆg½í*š¬0ž¿žhßüSà¸á¸aÿîı`)U†I‹”?+µ_éZQù° I¡ÑÂj$*‘DtÐH°˜PºËD€ÐèA   $¡ÕÃj$µø÷¶ß>iíPê8’)°˜ BÛO 4eTŠÕ¶ùY0›Êü „VÅ • ÑO¼ÔÛ9knWè°üóñ55Y5½k•êãªêðáÃëׯÏÕ ûGËA ,JÙ E¥h4§ô.\tZ]Ñ›,ÆÜ|Øj¬xv7Š)²Âj­àIÕ å«Q<#T2qΚÿ>ï†1ÆqÃã¸aŒ1ŽÆÇ cŒã†›€1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆØýÀ—׺¯¨vt—{‰û3;UÖ¸¦œ/ðòVe îáJVf…΄$ hè€ ®™G uì‘iFª$Ô×+‡7ÓØ"4A³X,YŠìLèÜžX¹ùy@‹v¨]ËÀPEAïÁðpŬo!Ke É÷fà¸a÷D¶˜:¿Ð#= J¨Ê}˜ó•‹ÎW“TYºÑF(wy«Jd‘|Öä,HU%ÉOŸeRÈ¢D™|´yªj—jÖÐhDTÊÎÜjM’eg¡ªÈËA»XlY‡ìL!¶ª¸aÇfde@x×Ææõ0ÂbBË¨æŠ ¿AoR1èqÀщ·ŽvׄÁÍsùÏë5†û1³ÐÙÓ|6/Ñæ/ûe6ÿîK2aM†¹9ŠƒÓRW{É )3Š’ãì²ÊI/™!e¤Èqó89cbݬô䱟€.U|ü5òr*n$¼ÿ ò!Ëp©!ðéL ¡ÕÁÅà»0áìŠg`ÕlØo37ìzT²óýè¸IŠU¨ª U6ÝÃuÀS£`±â«…Z<*î¶Â§èOOB@(V!Ëps¿ÙÒêà^õæÔììagóOG88ÞüÓÉNÎйÙà‹ã?tx¨˜ÝAo*7¹9¸o—1W߆°·çáŽv™S/Ø—oúûËÕœvngÚ•lºm™äì gçÒ;?`É¿|õä®”3§î¦±¤_:±;/¯¢Î’…ÐwÖn€¨ !ùijU)“€æôƒÉg.o¿7ìqÆ ÉIYÿ”­9{~6~ÛÙÛ”-fà½éøèëR·Ö%!i•CÓY?íÕ[6+½ð‘ öÿ>ãù¤ ×+ª§Ò®cãк4oågr Jwedï}må·‹ ãíãAÂc7ÿˆBÖB’!"(¨jE¬…„¬…@5CQ©Ü=š’’(V(J3BHZÈRÑì ¤ŠŽ $Íͳ¦æÙ,êÞ|$ôÚ¬ô¤ìzã÷?…ÜL"ˆ’±Ur.’°Þ¸ÁæEHl3 Z (!„Xü3V.¡-;¥ÀÉ–˜ åæüˆ,T½ï† ƒQ˜Ã÷Åã¸aw’6BHÂpzá¤;vš,p¬Û¼ùˆ·jx9U¸IÈ82ëÕCŽ G߈'¿ hàIjɽ—ˆÌiûšxêà!‹®F@ß)QqåRK’ÿõ³'N%é«FÄ=ñ¦å‡GˆH@5œ^1åà›fmÕØ'ºÄÿ)ƒ0cvq#,Wv/øè9“Þ Ó£?³o1ü“ÏttcRBˆœ_ÿïرs·ˆc§^úµ[ŠôR¿çºIå:]’l>·`ÌîûT¹jà°™QáuT…‚È! žúðói»û~°°ª‹ÝÍÏ¡©+{/û£å¨©/ #oJ7춽 ÊÙõA—Ó9 › ÿÔÉGf¯~kdi‹«WÐAPÌ™\·ýc­Ÿ™sbñî÷»Y&lnè\¢‘´qJ¿¬ÚýbŸ& ‰ O½ôu°,—ÌIMÝòvÏËÚf­ž~Y¯^??df¶âV¶°9s×G½Ï*‘±#¾pÔÏo¡fd¾dñ"W îøâû¼÷¼Ãà"xk7î,ÔÌô¼ã7rš®œú¼gº%WSß¡‚"„Ô“ó_¯Þl@«Qƒ²O,ÛÿÅ#º7ö6ñÑBB¢|Š-þÔÊŠCÆqÃQu¾½ß¯ïT­¦Õý\ü3öøñüNew$"×VO·èÜÞ¢P†¾‰‡û'o_ä÷¸tó–»Èúý“£Ï€a/Uq!ZjMiþžïæQ²¸)LÜ•œa =Ù'Е„ð¬[-õõ¡e+ PÞîoŽ^Öu}óoOÕ깘H®:*ÙWrôôi¬ª}Àju]õÆ}‚…)-)E24ºÔ7´*o_Ïů?„whˆš•~ñ|Š-°”üTkN¦ZXpg{?Ù9Úkì(íÈYI†¬Cá¹¹©iñס м5"caåÍ„«öwp®aç„ý_ Ï M;¸ÜÒäݺ Î_[?þPÍ)¡j«t3– $‡‹Ëæ½±Ë/È;õÀòÌŸ¸žÊt»ô›Çü¹ãÓž§ÅéóŽ\:w=øÅõUÌ)ÙKÒû´ ­«Ýûë™'Z9O_MÚª.(w€GÓè‰]6ýþUÿ‹A¼Ü(åȆ֦ªUk׽ßè¼8\Ú¿d´)¥‹£áhBB·ú…©i¬„¦-Ñ´%̼™pÜ°¿£¸.þ}'|uäÏ-†¼BŸ^ßEæœ|ýؾC’ZúÇÚ:þ-ú5êü?ËéE‰ )U#GÇuVÕµä‰~¤ZDÀ“k\öÌOI¸ zõh?¤¿O½ªÊ¡“Pû°×¶¹lšsåÊuM¾ÝFõ¿²uªÙݽ̯T+êô›ÿˆßo‰Ç›Ñ ã[ú]„_ê<=•œê¶lWEW&¯T²|u“û†ï.]N×ÔéÛoT¯½ŸDd}™âˆtµý[ôq÷p*®Ï\ê7íëàS $„³8rý ×ð€®vZ™·Žvש$W‹ ïS´—šáì×%ί E½qª ·°¸AaÐôñêM‹{jÙ3t… "Ù;f¨wLq‰ –ü «Õ®^ë§ëÝè^uy¥¸€¥&¥À#¨§GPOÛÛpî E`H©® ¹5òV饡.í_+ÕîÛÊSdM-¸–åá#¨T¬©±ƒoÌœ´UÃ{¿V´0:•‹±u# $¼:µl+ÎJ}œ2qË8nØ-ó¦ÌÎ"*|JÜÑ{+åmßf{üV“Ò¾!³C©hK¿]H–K›¦N®Ùs¸‹½õê¾ÙWDÛ>­k”9YO”ž¹(³0’©¢¢×“jN=¸öÄžKzooY…Â[Ç {Ⱥ~Pïô^U8GM˜ï¾dâþ5Ÿ›Ùµa‡~S^®"Ñ_øu“hÕ¹9“áøŠO®+vQÌDà‡ã†=4T I8 pg—™€j†o¯÷ýú%•b-Ûº …‰‘È-&$d׎ïì€jÊaÃqÃ*fÂK ã_عI)õ“ô¿– ²À¾½X»o}K}FÕRI/ý»ñy7ì¶_I«WcÑ"H÷kçÖÛ7aÏNþ6ä¸aÿ½ xñÏX¹è¾n,’Ä×*æÎû/ú CÅ Ð(›ði~7ìžö[maA[5¦ûqU¨*NÙg¥Ésh …w»h,.ö 5}óEQ…@5$T‚íOÀH×Ó²êj-0±k8:¡is\½Œ“Ç ŠB£‘Žc‡À½*"#q>‰ç ¾øbÿ~d¤C–+sÜ°»¥hõg{ŽŒùâUÜ—› $;]KÉ­í×tÚø{›£ÐB]úÝ$)K5Mu·]ϳ”í.,)Š'€ ù¹ ›¶cß|ótzØ;"®9vïÀâŸ!jÖBPΞÂ_Õk Å,¬Z‚]@\+Lœ€¹3qí*„À³ãÛ’·™‡‰ø^mÀ/t|vÚÃy—!"E'Ôûò$Aü--)Asê‚H»Jz{%$Œ4Ðœ:+²®“ƒ“LhŸ@A.¹º‰†þ°(8} F<¼PÏ……8w ª×‚wmàÌqP»ªUGN6ΟðmWW¤^CòHþMJÝ‚ê?[è°üóñ55Y5½k•|\UÕáÇׯ_Ÿ«VY¼ ÙÙò`.|Ôñ€FÌ€oC ¡4VÀ ø¢è05 Ë ½ùF„”¸p²£›Þ‚K„ÇÜüÓ«:¼ªó–òPâ#SŒ1ŽÆÇ cŒqÜ0Æ8nc7ÜŒ1ŽÆÇ cŒqÜ0Æ8ncÿuÿÆ1(VKa^®ZæbpDÿŸw=Ül·wàvøÞEuvf£N7ÿŒîmbö,|£ÌvñâÅÜÜ\Þøî"ÒjuV«™ožûÿÎb,ŒéÜñaø{P¾¾V¬XqòäIÞòîsâð­œþ%+Âb±”Yü‹ðÙl¶X,¼å±ÿlÇö!øÖ°¶›ÃÍ7•œ+•zʬíâ¿Ô*]g_Úû­+ʬeâÆ2•ü˜v-§¥Zäm'SåÕL‰CE¸¾æÕq‹ÒžûfãV¯Ü¸ïÇ—{gîºîH¶¨xa了‘dY+‘d²æƒpÊxxùÕo4VXIôÑ<å܆I’ ’%¡•þ¹Q›²3E!ȲgÒÈÍbÂZw{tÙáT!„„—vÎÖ½EÓ˜ÈÖ]úÍ\}ØJB‘»ñ)¿Ž¯åçmX§˜˜Èö½ŸÚœhBäZÑ2®ÿ5ÇìáM#MÿMaº?ù©^Íb#Z´éòþüxKÑTÅÉÙ=‡Ìɽ²mT¯–ÑQ‘=†O8ž®¨–ÌÿuŒÚ¦j¦=Õ¹ý ÑÙqqëqQÁ Ž™ÈšwÎT¿“ö.ÞR­Ý@=aÅ÷ãàn!àÑs”ØbedïCTMF‘`‚ éÇѹ „€S=ü/:¶íx{_+ÇO õpo@1$>]÷ÉyWÊÕÀBU –}þBû¸°¨¸Ö¯~µ²ÐjÛ”„)õØ;cúµh×bÌ{?§+¦²†ú¼Oãù©Êï3ŸmÖ¢íÑ\QaC !ęÛHLünüàæq‘-Úöüq×5!Ķg#Æ-ÜŸ{ñç¨à&?\B¤?ß´nÏ/O Šʈ)¡Üñý>Èâfîd'`@$aÑ_%щõÐÖ€Õú]º:$(Ęs%«^Û "÷Õuº|rôfã!ÄÕÑþoï¸dÛj²þü>2*jÚꣶµ}ýøêV¡k3¥œõOú4“­d—\Ë9jÑD®œXóhç¦QპÿôZ¡*„0îxÉ7zÈ£"’WFDG¯=taÞä­â"š·êüÕ¦ÄâMÔ4£gpìs³¡õ:¥ IDAT؇?ñëܽC=m‘Ø9x:19áàÛ}"Û<=U%ëµÃs[…FM]²9!1ÙªRêÑ/¿8vG’Yµd˜ˆ”ìÌL“mÓú44k%mÛJ_?O­>UÜ™r Ïš·š6®¢VµI×.‰ˆLñdö6mø~úzy‘%33G%2ägªDDŠñê'㞘±-£\µžþñ£-;Ž˜ðûŽ]{¶¯÷HHç±?[ˆ(o÷€¦CÞžèÈ¡øͯõmÖlàø ƒRIC=‘fT2Nox¤yÔóïÏ=}ú\¡Bù)•4TÒÜð¨}ÿ·lç±ää ë¾{5*$fm¢5/ùä¤';uìõê¡Sg¯›ˆ(ç»WžxM2UÐPÓûì觵´c ý¯+Õu¢jÏ)ÇÉÔíeÚ²ƒ6,% èCD†<:¼”új?“y=ÓBd5ææ™mš‚Ù¯=ñöŠ eº1kßlÖlÂ&Û¿Ïײg÷þ,¶ýyx阈²×?åÛüÙlRJ­e¢åŸtiÚqðØ ïmÛ¿uÑðXÿžïo "ÃŽ—4}ô²ÑJ×ÖFEGvéõôüm‡’’“þXøalPÈœ£¶Ïg^ûÞØW¾ÝX¦WE¤¬žútXD·ƒi¶þ¤iñ›£^Ÿü^÷Å2ý긷Ë0^ÿ.åíWÎ÷åb¯yi«ªB*©ªªªôO÷žÊxðâfçkqÁN'"RU"ÃãŸÿÅb…Œ¯÷ôë4qÙZqÿ/#BC½HdÜý|£†ÍWeµ¬uÿûþ‘ÝŽ¤‘rá›pÿ·MDDë^ˆöÃÍñ€“÷=c!":¿tpPãNñ–¢)d­}Ò7vôu"ÊÛÖ.8zÞÞ¤â…)³ •pb­?AD¤(DD¾ Q Šã´+¯èe©¿@K½@UÛU%[zÒPêù•f*9SµÔl3w|»îd¾í‰«Ç—6ö¸…Liïßu¼ñÆ{“g‡4]|&ƒˆ •5”éÜÀÑo|¿Õ6åJ*ùçà¨Ï¶ž-Z–k;[5‹˜ºü<©–i/tï2ðÓBÛRª/°m!oР 7ej¢(nÆ’Kó›-{ñ{‚Žþ°åÈYè÷ëåH*œ—JDç¶MŠ}ˆˆ>}ºùÄß7´ëøªmhiÞÈ&:FÅq“Sf--ÿ¤KLtÏ“–¢iÙµQÇÍ%ã&u]tTä› vÍ6ûÌ#íÃ&|{D-±ºn.ZÖúž1¡ÁÁmyzWjñSå_vWCfV«òcú”É燬¹üÝؤî¯]ôiÊ‹¤˜Õj%“ª(¤Þß°!zàλÉÙ°»°Q/ØÊ@²{ü£ïÀrìd‚õf„­o ÀÓ¯M?šê€âêîVÜuq±‡b1)eŽ-¤oŒ7xE^^ôë\³B’dÕV5'lKQúH)Õ¢Š›ÊÞÍAXsMezÕ%Ê^Q¦M@@S¬É»Ph„HòŒÅ/¨ »¢Ÿ¨x5€óé€Ó‰Ýéw.ÂÏ´tÝ}úÜ%Æ¡f-G@T=°÷Oszùî-ð óÑd{síVM4lOÌí×Ð÷ÒP—Ô†@¶ ðr A¯ŠÅX¦•D% l[j\‡P-UÃ\T¬MC}Tôéµ™€g.£e½Ê{ÎKàíç†9$c@+‡9¿òYÓ å-9èêzú·ýC'Õºew@Qkv÷Õ-ˆƒ§‹dÎ7ÚR³–|«×,jFÈ’b1”\]7—Ç1ì©3r3/,ž3oúkãªM›êãTÑËî¶C¥U²ì)Ø椳˳æ?WcŒJ:!¬’ªQ…€€ ܇.Ô \ܘ³LÂ^§)Ú­oí -ZWéÆ&¥ÑØÉ’¡h§²\*Ê7°9×(Y.\“u²x÷’ê…ù ‹jÞ"¡‘ŠßHmý`d8æ^ÇëSÐ:®vèSb!ßX$=4€Ñ((Tá¥/zû_ß& Í@¯•‹&pãpmŽö:]QßÐ;땬BËAë»l(³ - „„2'‰ý¥å.GÍÍ÷¹9Ø…„ŒüúËÍɆ…C¯½»1 ûuk»éî¸Ð'fmBõÈ&ŽŽ¾~Úß6]ïÚà·3UëEx9ßf²^ºM+ IH7AÚrÓ3"ÎK ®mÛÀmžüiõ®wÇý]gÞX%‹ÕΤ!½DRFzO¨¡ó% m«ø‡N~xâƹ‘‡úÛõ<Ÿi]D[ÕËÉtÅ€Æζ64¦›­nÕ]îp²®õݬY=^™3*îXæãøé$æ^Àc¶¯b3òK>› 'J¬@UG@dgJŸN~ǹãåâ¬Rn^„}ÉMÞ®¾;öäµ€Œ+yº»;þ,•7Tʽ7”;¤o~ÒC)Тº Ïvسàï9NëÕßßuΩmÇW6ˆ) 5kÔhó꥿û¨åìæ(ÿãçà ëÎEßï¼î6vô ½€ààl§žI»þ7ÎE§h$@C²M Mí @ A¶JëþV6äi~vû¦¬Ys¬Àö½3±[xÇÑŸ(’OXDÍ#?Î.,.{âW.2ùôŽu¾õ‰SªÕ*pêÚ?èÌ/¿ž7=‘{zÕgßþfºƒ‘v¥ø0¶Õ˜åÊ•K%3Ôë‹þ±t®&µ8R0ÿTÑzß1Ð"¨ Á¨8؉„¢-¢K=8DÃRvó Õ’~åRfR¦ç ·ï>qbÕÛëÇî0è{ º¶}ç¡Ü¢^^=ÿŒSÍ~jz³ÕýFtïÒ²Es9ãÌŸûŽù÷y[ëEqªï«ÍŸùÖ+'£B_ÿJÁÞ¥¿þõÿ¾ÙÞ/¨Ìû‚п7ÀæQ8·b¦øbò|*à«@ÛÓ#1ï4˜·µ"®<¶óª#À­;ââV$ðçqèÊíOæKu±fëŒÁ5J¤(iöúrÔ’'§ ß¹2®®z!þصžŸÎmaô›þø†îÏõlÛ²cû¬Ó›·îŠøExu‡[~KVm ÃÆESÍçV ~þÃàǦ5[Ýÿ¯4”TÛÙ3ãÊšçžIŒ~ìÓ‘qæ·¿8hùâÑËž'$€×'£÷dø¯ApU,=ŒçC0Ï çca=x Û@8]ÇÒuð~Óo[”å>¬ý±®K–¿Tö3E ñMêûN èÃZÕÌüþx¦ÃÄ^n±–_ymü=ÌÓ{~g¶~6"楩Ãöµ0¬KµZ <5×Ï$^1Wi1¼{$Àôý7Å~»~Ró{™™"[uª½JJ°[·&Îa&"ý}î;•ï†¾õÖ[Ö™7BvèÔë‘:.öªë„všðéG1^é<?> µÕ˜kTëE´{qâ”HoPÌ&½O\L`Ñ.A£T­it¸«^‚¶vHcO;;»Z CB6è1àW;ƒÉìàY¿×ãƈ‘‚³pñ‹ô-ú‚SÌf;Ÿ¸è@½pmÕ¶‘,d×ê~‘!þ²¨z×Ј¦Õ¥ÒCÅ݇ÁM‹¼BÄ Åô±ˆì úêi÷(,›‹¼ó(УßsX0¶3ÅHÆcÏ¢®ï†"ÔµD§ÿfy“²kÃU¿þ=‚KVmDT#²o»ÐÚ«ÕÑ;pàè O·kHD€¶y÷¾¼œ òóôîõûŽyûža’m²•6”c«ŽÁUrp«VÅɵ‚†Yäáᤳ ©š¬úð¨zÕ¢‚ ì]k„ÆÆÖv•Œæ:¡q¡µÊš Bã6hÕÎuñí<„:Á¡!Ú€AÏ¢q òàX £§à‡W SÑ^v!:t…GC9§÷ui5(Ƴ\´yTs6yøvìÖ¡‰’‡·Á­IÏAmüu @b²:5hå¯Á͵â/+&—Á1!ÞEg*fáÚ(6²¬XÌvu㢃ôB5ªN‘Q5Üli¨š,R@p”_mW˜ ·FÑþÞDö-ú?XÓÕÉÑѳ–»Þ#ß}û骚¢þMnòÉýRÈæuî)n…¦ìó¹ <žv–]4$l¿¿üÄ}À‘2kÜpØyÏ5ඨÀ®Ÿ__ßà•·c]¬Å>³iê–>w©wÃ+DªP„É,Œvp¤Aüð(ð´!Ký.£âàÿcàïàX»ù¸(—®q„]×â¼ïåÀ‘i ×@o+׊ÎVÿm®nc÷ _ï†1Æqû—ŽvÙݸrí?Töe7Œ±»#˜@Š°’…ÌT|-XHXD!YˆˆÏ*fŒÝsu# ˆ4 €Peý®BV "}Ñ)ë÷o™«ÆÒêÆÖQV«ó4„õF÷I&‹¤HfY*îc}ÃG¦{x "EUdEC2©’¢E½RUUB‚" ù¾-W7Œ=¤Ycë*)’j-„°Êª\<£%3-Z"ó5ÿÌÍy9nû¯U7€2g¡Ó¦u™/OV  ø`¸:mzúÐáéŸc•îëYÆ7Œ=¬Õ äïÛ¯ögŽãz†Bf˜A@ÁÛï»é¤ü¿j‹oÎqûWö‘‘Z2:dæÓš-$´$÷ë\Xs쬪†•›¹ÄqûûÞ m×Ö ©Z­6õ¹ç$HBXÕY³´T¸÷ì-ÝדŠù@8ckÚØÆn23ò¢šê’Îë ¦e«íêºç„Å9I"K•½ò2ÈÞAÈ÷ï\_>«˜±‡“ @äæ–×¼­wâyU꯳ӎœq—µV’ìF?irrÒ)÷u‘þË)ºy³yº»·—ùé[kþ¹…?Î9šmÙ½~éÊõ»-·˜ø…Uøl.,êÏ3mÅOs¶§ä_=¹yþ/¿eª÷¹™îîíåÿu‹†²¦oÝrä»…Ç7]­|‚jÒš•§6$•[œÜõ¿Ì[4Ùx5þ—Ù‹.YîéS›.þþãÂ-¦‹mûÿù}K]u¬|Ã[/oÿqþº|«úW¶õÔÞ-‹çÏýõ×›ãOUrKå{É€`´ªµgMO$h¬«VÛ'žRT«Á^’GÕ(¤ÜßÎÔ7nBËkt9l¾›ûù„bøsâ“ʼ]É=>ã£Oã3-|÷ã‚·Š›Ó³ñòg%n.ÿøñ'«Ïç%XöÅ´9×ïKÜ!N|Ôiü7[ïî“BÐõ5“ÛöýÄPîýåªpÏÆc¦[´ãÚ‰¬ÊA97溜Εk×ìÓ?_¸ç|aʦÏ?šyáÞâÆxfɇ3–›”^ËÇ·}7mÎÞ âæÂê¾ü5W¡;mSA 't9vü¬…«W-üúõçµyòûBÛ˜þÖµ§’Ukçܳ¯Ba"RtZÊ­æé-©Ò}¾¾ßƒ7DUTT¢TzO÷âÂ&ŸLTu•T8ES¥Ê¾9æ=NÎ(ý½¤«Ö¹s‹ jîoNê­Ue©¢/­’“šŠž¢ Þ!…MšÜÝÛM{Œpµ«ê¤© )Ñs¯p–·Ò- À†?s+mÒÊßOD€8z2U§·³/½˜DeÊA+ÁZ˜G]ûM_µ>à¶5g¹m·Î§3õ’T÷'Cüj{8Üü¬%çJ¥¤2k»ø/ÕµÓ·g·éRv-½V*÷1íš|f×Ï5õ2U^Í”ü@×–Œ›¸Öðú¿oX±hþÊí?¿1ÔxüÛõ3JŽ¦Ò=¬H ²vÏ>eÕ g¨ªªÏ6£ÞŠU†„"¿EÖAYg7Ü!:¢I\û>?ÿ™ˆ¢û½+§7~= CLTTX³¶Ý?[´Ë¨@‘»~DÖ/g^ÛýÒ11-»]}"Bä\Þ<¦_ºsÖcÑ᧭BdŸÛ:þ±ÎM£Ãš6kûÆ› HØj˜?viÐÿ‡ôskFölÖaàØ}—Œª%stûÈ?¡™:²}»Og[Ä…MßF7ú刉¬ÙиSì\üg½nƒõ¨Ÿ={!`_ 3¶–ø]œ„”t‡¨‡Ã™Ey„ÀÅ]hî! {âëߨG·ŸëàëqùØqÇ.#kŠ!¡°×°Ù—ËUhB1\ÿù½Q-£š„EÆŽýø×,£m–"7)~âÈnM£Bb¢›>1ifR*„¨¬¡„S{7Zt]Ùðõ3±ÍÚÉB |C !Äé™~!ÍvŸ8>í…þ-â"b[tújc¢bÛ˜ð—íϽ0'"(hÖE!DÚ3a^??.J6”O¯¡™¯Ž˜óä\Ò˜WÔoûýc !L®jÛç«z]~îýaÚ¹#?ú¶Û>÷|ñçT/ýúÍœ Î3juX:n¡ÑBÎßfÈJ64ê@ä¼íÕöƒÃ¢ä)ŵ§ƒ}&mMBDƶ¯›7ùxÅ!Û6”vdyÓÆÁk³¤ìµÃjFŽÊR²Ÿ)±–slU$ß»°_»È°à ^O¿”cBÿëÒÿ²QIËš„„®Ø}âÛW‡¶Š‹h×æãÇDÑ&jú¢S£°§gpmõâŠ3;ú»Ù"¥Ad Jr^n „0¼Ó¢Fì¤mâo£) Ì2,æ”kdAh NýXšø[UUUeÜ×›3QIÉ9»¸uhÔWkv_½šfU)ýä¶É¯OŒO±¨Š1ß`&Rósó,¶I|Ô…`O«âéèZö6´ìhñ=Â5äÕ‚¶ì£»©{CÒùPR!Qáè¥Ytð­ŸKzÐKˆ”ܼ•ÈdÈ7ªDDŠ)uÆ›/þ´+«Ìý¡‰®¼Þ«Y÷1ï>qòô‰øɃÂÚ<þ­‘ˆ²6÷ oüÄ«Ï&$ž?}ðý¡mbûŽM+T*m¨B%?iGïÑ/}º(%å²Q¥ÜÊ*inHxd‡~/í8•”–víÏ_ß ‹ZqÆ\˜vqÊèÎú¼q6årŽ™ˆržò´M—‰¨LCY3Ò˜ñmƒÞ'^ËI5Pöþ_¶_üê’ô³Iiñ[W·ïým£.;&‘bþ}H¿ï"Goùb]ÚÉÄ´]ëçû4_8í<‘š›“k%RÌ………ˆˆ ¼ûâgë’©ôýÛ7¼Û*öÅõ¶Öù|ë¾½û¼³ÐöçÁ…£‚»L5ß#<›Ô’kY!ZþI—ضŒ{û›£§NŸ=ºytsÿΓ×PÉ{„_[ٶ׳›Ž&¦¥¥\ûuó&ßï/´m¼›§Mœ2w[¹ÛÉ›¼3,,â‘c™¶?M¿}ôÒËOßËnRt{q•,*ÑÅsi®žfIk•%ƒ¬7¼ò²Õ¤šUU¬Võ¾Þ'üÁ‹›m/Å„ŸakQ"ÓÂw_~ç‡U*¼ÖÕ·ë”7úТQaÁˆŒ»ŸoԨՆܢ•«ü QD×éD¤\ø&Ü¿óaÑocBßšws6'> |ä„™ˆèüÒÁAݪESÈÙð”oÓQéenV_âæñ¬¾sñ´ó"‘ÕJDäzò×â¸0½,s1´èѳ ©z{*º‘½J?G#&‘¹ì6Uvó*–¾õëÈØØßÏlO¤]ÿÂØI§-´gR›€ž-7Þ{õ×ÈÆÑ¿žºND†ÊÊtn`‹è7¾ßj›r¥ •üspHÔ;Š–%uW«æS—#Õ2í…î]~Zh[Jµâ.ZìUs¿mÐ/)›ˆÔŒï>ø*x赫ÛK¯¯™ó]£.;ÅÍOm&Š?ÄÑû|Ýy©Z~‡«`^*%lÿ":êÉKDDôñ“ÍÞÚ¶µCû—ò‰ˆhöcACç¤â¸É)³–‰–Ò%&¦ïYµhšÇ¿ïÞ¨ýû¦’q“º.:*òí%ñE³Í9ûHû°ñ3«%V×ÍEË\Ó)¤qc¿V=ŸÞ}½ø©ò/»+V«UQT5טÕÔ$Á “0Év×<«“ª-ªIµÒýÍ›î@xöïûMúÔ¶ Ö‚t&}–£§."ò ßøÝ£^sGñù±ëðŸ â®·äd'T«¹ì^Ú¦f·c³f~eV ’’ë¦&mKV|e€Ïp¿â’Sçâ ”3•ü+=¬S² 4hŒYOcÈŸ0Y Ò€¨·vl?MÑIn1˜°5 boÞXê•/ŠGdDÅ3-]wŸI¼ªÓ8V«aGˆ<ý:}>½ÿÞ!cýð:7ïÂ]=®‰nÊÎ yƒý=p/ •¢èÙÎÏÝÅ6< VŠÕ\vˆ´’._u§]ÌÕ9¹ÚWÑn~B¾Ñ‘²hêÄêl3‚]ía)TùöóÔôiê&¿=ƒë':éöztDª˜´)¸ÿí°óSo×¼å‚)jÍvu‹{ vîN’µÐ ”ºÇ•êU­VÔ²,dIµK®®›ËãÒ|æ’•Ù©gç|õå{£ÿäûŸü]o®á{ìKI’D€’tÖíÀÖ,[s®}ú5œÜ/Âd’­iîãˆÊ7–<³Ði47Žóo&“Uëd'ÝؤdN–Œ¦¢Õ/—ÊòkÑR`–¤œkgΔ¢á9)¦cK÷â’¥ŠßxGh l‚ßtøøcÄ4@{t *1vcùÆ”u“Pa$htEoÿë—[3Z-€V#£t×\)0ÁN«Šæ/ sÐ)¹ËýäžJ©èV÷Çš6+BèmS„€°×—š°,ã®ÖˆÙU¯SÏÍáØŸçúYV_¬ÙØÞ¡Ÿýª ×zøý–P­n¨§Óíöct›VBH7AÚ>…sÝ.õø…FùômùØìÕ~8´ù½6ÙÎÞD$IÒµgÿWU@V‘&I.ïL1¿4Öžä³=†5<T%PÀqS9—Æ^êÒ´[¨@* IëUÍÙpáR\mWM,ÌO5Y=¼«)w2Y·†ÖëÍG~2¦å?°ÌG°( ‹/£Ÿík³¥òfÂLp°%J&ÀË Ð£–™ *¾×A%ˆ;׫îê¢RnN>„}ñNF$„½Ÿ'veåE²(íR®>ÌÓþŽ?Kå •ò7·šƒ³^U2 HA°¤åܸQù½žŽ¢ñèúíém‡Ï¯ö- 5÷o´aÝâõçNÕñ«âð_nJëÖ9Ó¶¤ºO|y¤€ «ÙPO ™Óé6 ’ –´Tçíʤ1ë%÷…‹­ %­ ºW“ »öhcã¤û›Üp}—!WV/Û“iûÞÎ×%¼ûsÓ©nDtÝc³¾Î+joË XŒs¼õQ>ÅbÑpè:$*ñןŽæ=‘qàç‰Í+¼ý7‰j•4ÅßûY ¹¦ò3Ô@añã?¼Œ, P-î ]ÆÌE_ç:4©h0¶mÅñü¢|iW.m`åæoNIÎÓ_è94´í€¯žŸÚvuÿÑÝ[GÅ6“¯Ÿ‰?q1æ±n½4N~Œ_M³?2ìÍ7ß(Ø·|ø„/Ÿ›µ{`»Ò•mc ÷ÁðZX÷×ÁãY|ˆñ/à-#‚è‚° ´¿À’õh4±µA@Ÿyè[¡.ˆj…¤?æˆC›Pî.تéÒÄ!íŸÛõÝ£5JæƒT¯ëw/.öÑã.‹¨£^8œhjf‘ñbIDAT2ã—Ðmêè ='<Õ¦³}Öé?ãµ13Øë–ÕÎ3ÐI^ñËÙG>þêôðŸ¶Y5ðŠ@òq¯™¿úña'âžúft óGC;]²fŘ€[î0¡Çð©+6÷y¾w¬zd›R7Fhþjש`úˆŽGz¬\óRp™¥Ò„nteÞArìY€6¤u¬oNg:¿Õ£þ­ÖòÛoÞÛök^ð\¿yužÝùÅ!c¾øßþ¶ïŒìð¹g]/MF•½WÇÝC 0ýøT— Í~Ú2¹ÅÝÍF°ÕLB•XÍ–Úo½Yg’ «._”ÝÈßU–r§~îôòëz/ÇûygMù­·Þz€âF’¾]^Á¾õªV­Ҳ׸wÞqD¤q÷{l`§:®:G·ÖÝÇŽ{%ÐÓ€Ð8º×  ¬_´«ÊvnÕ†5ñwÒIÐxGE5ª[»V@“¿Úµ:÷íZ¿Ž“³K­†aFŽ{¢[ !dsuŸ&!þÞE#CGwÀú:áܪSTÍê5êù6¬§×é½êø…7ñp(Q3Úº|]‡¡±/œ]ÐyÞ°^¨[ Õ|ŠÆ­0ë;¸)p­ƒã0sÙêa |ÑA¨Q†â›Yhd_¢ÓsT2ïèŽß>=ËœßàÚ³Kóïªîu› ý⣱u‰cºô‰ò÷u´×W¯:è™×Gu ˆ Då åТsSoÏêÞõ›„4iääàÔ¥|CBÒWñªèjoYÓ¸º{‡…×ðpð ¯ëU­–O@Ddp5'ÙÑÕ+(<¼aµ 2NèôN>>ÕCüt2AèëèçUÏMïâRã‘Gcõ=2{“W»Þµ;k]¼B«Öw-qprkàå_µÜn#YÒÎvˆíYj.·úõÜüÂ{´ŽñÕB¸ûÕ®Ò ®O÷Ⱥ „ÎѳNPh@=%Ö²_]G—z Cý<‹f­s®þíÝMˆUUÀñsî}ïM“3Ó|©XÚL¢’3M£MPä¦MàBš…a›„­+ÜA˜A‹ MÐÆM«@,¥RI£4mhQÖÌèÜÓbÆ•Biõš±ßoww÷Ü÷øsϽç½3|ïøæµycEÿÚ‘­£Zy«wåÐ}ã÷ öt,|@Ý}«·ŒoY·º+†xKwßÆ­÷ ­L©ùàŽ§ݸ~xxÓØCÛw>½÷ù'{³…™sf§?¯îÞõðº}vBLYŠƒýg¼©§¿oÿ[—CÈcÈëßÎM;p9\øñ§®ÉÇCˆ±÷ ,gu±ÿÙ'Þ>s3í·s_¿÷áô¹™Å£C½³é±c_^º¾eï>÷òg¿.»¡?øÊÞ¿»ö¢Š?ýF¤”ÊTUÕ|JE]¤#Gë“GË"uY—u=W]Ø÷ÆL3”ìâ]ëë¢Jm|î(–·TÏO}qbóÄXë?ßnþŸÛÏŸ<ºóT922¹­³8⃃³#{v˜l\Ï8OOY5:Ñ•‡åuqÎ~uxņ‰¾ŽüÆN;Õ!†j>Ëc(eV6æóª#†¢Èš­ù”êÙéž5ýinööîc§²ÛzÚ7;‘–æSºb ³S¯î;yèt•ßºfûŽGžÙvé$WM¦ÊòT…”§ÊT6S£Ì벊¹*væÍß_{©õ‹3wõ~s¼ÑÙÕ¶S“–ð{«Ê¢6EBL)†˜BH¡ÎRLYH)f¡®BÌBŒ¿œ?3<¶jÏ®Öëo6Û¸ƒÜÀMvs³X7äM!Å…|¯´º¨«üûƒU£«ÙÆ|Ë üÿ&ª1Æ+Ësþîo%äX‚ìÄÈ 7rÈ 7. 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7ÿ†?å{Ô0Ú+IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/within2.png0000644000000000000000000006106013051004444021500 00000000000000‰PNG  IHDRz¸b•°ÌsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ¯€ IDATxÚìw|ÅûÇ?³{-WÒ{%”„’ÐB ô&E©""ˆbA± €¢ VTTPPŠ  Ò©Ò; )¤·Kr}wç÷Ç^BŠ_ËoÞ/_’ÛÛyæ™ÏôB‰U¾Æá_2JÍ„riqxË®ßÏk/B©øÎc­Ã‡~Cnµ®)¡Æ««ß}¾ט˜ØØvâ'<÷ÖÑ+FÂôæß%7Òžß\¿#ù·J›¸sÑÛßV4ò¥vü³†«´¢!ö¥îrW*n’ŽÊÅà¦WÝ–ï' åéÃkC_œ5ÌS©&ÿ3µ! BÁg¯½—a–þË󭧽8ÚG)ù´Ù3¦™^ ðj7WWµ¢;q ƒÁU«æoÝ!ûÞ7º•«'§k6{öP¥êOÍÐwIÚÑ5j@Õ7¯¿y*§xµ««AÅ7êÿÜ”÷÷_=â6Ì-Ú>{gÖòÍéϮؾï·ßüð>wrÛ¬KªÓ›Ú(î|Ç Ñt999§Ð()õá­Û6óÕSJBˆpõbÒ•kE‰7ø·m×RÇQ€”_9t´ p`¼ß¹£Ç¯mj­W˘Ø-(.ü~Kª}òŽí|›žB]`+ÍJ:ŸVjÔ¯ˆ6mÝ””‚Tf9tÍg`× óÇg—YÕZÏÈŽu(=³góþÓ’dÙ·kOxëÎ]®%¹hRvŽ‹5¨ø e‘Ù5Ú[ëæ'ù,¥ç“/”™(Qz…4ïÐ2„È7@8•‰O”X¨Î3¨]Ç–zB倜Rx%9%#ÏJ•>ÁÍ¢[†(O¥£XéÆÛì9š€>Jkٵ㧒=Z÷ŽTÕ …!bENâ¹´2³CãæÕ1ÚCá<KÑÙ¤”B£…(4~MZF7õ(ó‰cG¨_|”{ᩳ©&÷ðkÝBÅQ[^ú¾c?]®”Û)„†umßšç¤k—“Ó²óm"çФCts%¥’õÌñƒVÏÎ|JOžI©²sî~aíÚEhHCË[“öî-óíÙÊpóU•µðà5TôhÒF_g8X²öî9ïÚ¶GŒæºZä¥ìO®Šè×–?vøŒÑNÜ":G‡:J³NœI©xŸÐ–í[q„x)­%ºvÍ J£#Gp7O`)Î:v&Å7ªWkÿÚF3ŸÞuŒmâI) ÙÏÛW"†tëÞR 4çÄoÊàÎþU§Î;ºuu±?¶õp!GOØ[žàMðJ®,ãLbF!å4‘íZ¹ÉåÈ¿rîŠ-¢_\P¸ó¢Ô¯gÛœ¤©ù•œJß´mlS/5sññÃ'Ô‘½cC4¢£Â\AúÎY1¨µ¥ ú®½Ð*vþå,³ÐÆM™—x0Ù¤íÚ¹ƒNÉ1¹¹³{Éüñ¬Ç¾?˜îÝ,ŠË?Ÿc zrÅÚ ‘Z?¼;iñÆ$÷– ÍÝ*Ϲ ´¹~íL? ÷È’6Çæí=¦íÙÎ_üõ—ŸíêøO¿'Œ/;˜%Q×k—Žvøwôå½Ó¾,smßÊ;åè)³O‹E-‰ Ö¤èä'Ï­kUvø€²{L·{û•$vé¶Å$=ñÔ¥«DàO8äðoß)P}lÅÂyéîß}½ÊàI³mÑ//Hp¡ebÄ#ÚŠ¶ÂùS'ì9oiÚ±½Ö”yîRa“1‹×>ÛY³ÊÊw';n÷BéÅÌâf±ã>^<Ù‚Kß¾0yño\@Ë Rx©Hê9îÅ·Ÿè[lõž½øy_XNxŒš1¸'g{mæìN¯zk¨W½°ßqyëèiKšÈ0ï«©©jø÷Ö/nåBļN}5£Ìݱ£)åZeû/¿;½Ò^¶üƒ¹¹þ“|K÷FÄÇó9G¿=”;øÉyóÆuu”æÞĤ°'Ÿ8j7s]:¶Þ»ì™7¿:âÒ,>ÒµìÄÑtCϧ6¿÷€ŽÊÕŸ¼zÑ}r¸ñ×ÐN ªüßÈê÷Ðì&Ô¶¼_—¡.ÆÕ³¦ž¼jï\ BÙbÌИ0KÕå‰/L ¨; <üØ.UÜÚ^ýQEkŽžÛþö¬Ä{Æi­ŠèÏçÝq8-æ±Eöý+cãíÉ¿îH¦Î[:.!¸Ððò‡½½`Nó3mx(MÙ?wæÂ> ½6°¶ÜhSÖ¼´.êŸf&vSê»/>ŸÁG/ÿumK5 >xi®é®ÛÆì˜þ²qÛÏŸ7±•ßw°TŒs'•[L_Bx’¹eÁ»;.FD_K<]Æ7µé»¡~„RiÇš×VÏè$f¬{v^Éó1UÛŒ­ÄxŸÝ½ñ\~ØÛÛ×$è`)¾¸èù©¾/þb¬?§öžþþjðJÀÙ1•Tñ®nJ §—¿þÒ•Ð×/Ó¹ý¿_™¡w‰RJ¯íx©CûaÛrœÇ–ϼ§cï—ò(5_رu%‡Šäã–«»Gôˆ~è”ÒKßOˆ‰n÷Ô×Wä¯Jv}ß­ÛÊ%”R*^z W·>ÜE)¥U){'Œœþ±Õ™vÑÛ÷Çw{j­D)¥4󇉢Ú=±:Uþ®üàò„„.Ÿì,¤”îü|r\÷™eÕ¹,¼túЉs&»$g¸:ã”RZzæã‘CÛct~<¶jNט^Û‹(¥tãÂ{ºÄvœµþ¢üÕ¹/žjßeжsE”Ršù}Ïè.¯n8#uuóóQí†(‰K×ÿµ Ž:˜Zd¯g7Én|ó‘}FÏ+”äìܽósï)Ý0tç^OW:Ï=øÞÄö݇ά¤æœ'ÇõíÑwÄñç öÎì5j‘Å™‰Ï:µ¾ç¤…RJ­ÉŸÄ·Nxoï5ù›ÊK?ÜÝ¥Í3ßdRJ©µè¹Gúwï5d¶ {hN¿6Ã^«êZžRJm)ÇœÊ(«e.éz.ß{ÕÞ\JÍëfßßuèãÇò$J)Íß7 w——Vœ§”îþôÞ¸v±—k¯|æ„!úü˜R!×ùœÞqcßÛtÝ$µŒf-Ë;zèPF‰½ž»¥n{:ªÿUrÅzgðÃßÛ½û†$3¥ÍÜÞ»{üû;•»§Gv}øR©•RJË7÷ˆê½õR)¥”¦~Ò¡cçÞÞ*–Ór\™Ü¿Mÿ—SJ%IXú|¯ø‡·PJ…“³¢£:ŒXø›|–˜jtï¶-M¥”:,e§¸˜o«URaÖ¥“'Žý¼æ­ï}{ÝAA¢”JÅ)§žL¶8$úÿž;*·€mûŠÝîG rØã_^ýãº>ùr¯ªCç±1^²ÂiB;¶ iR˜¸©¥—ÎÓÇ6‘×<#¨H*JKÀf“Q°‹Àµ³§²Ìæ¾OU;ïç=þ¹ Ž=ߟp8?[51ÏŽo.'âîð•%Ep8$BE[uüåÑ¡kl”VI(©•q€[Ôãßl]ÞÛK•Ñhôö T¨-¹96 ¢]Ùùñ1-å3£VYt #ŽoÚgóóÔ³¼6ôõÛ>i«'Õ‘Kõ¿”ª\}ãº&4÷VÖY³ °¯œ¿x¥Í£ÏøȹêùÕ†3ÇuæhÞÑÝI!^ìP=`Ixò¡€’ÜÝiùàÉáÙìîh_"'Ñ#ÜžŸ_Fe³ Ôná—O~à:õx¢W |7}Dÿ®Í›fl_/OfQÉa½;&˜¯N¤©£¨°\ì×-J)UEvêÖ1ܽVÎëO«¨´ü¡w]|Æ}ÙÇù“zkJ”J6»îï¤(  r1è}[¶ 7P À³s¨”_RY+Ü»n4µ»ç®]Ã=kði3,´hϾ2HÙ¼½EÏ{û —“/H?—êpxÇ'¸ÖYز9(ÃfsNM—qŽòr.Tù…Dx;²¯ –ÜŠà§'ÄÊË\œÎÍÅ]oÎÉ…ƽc×n-ýTµr%m_ùÆ£=þâ»Ý[Æ¿'' ”xEvLˆi£Q°iœ;?wSz6‡vq@ !€ÆàhP~.Gô ÷Pó„ÙO]šºk÷TÙ€êü6ÉQ-°{ÉÔQÓW[σÇÁfªƒˆ‚ 'ö=crЗB Ž¼ì2g„\°oÕ·»(à°Ê^¥PY|ñC–ì°ÉkÖæ¸ûvo#{ë Š¾ùñ€Xgm›?jìì˶Fš¿ÝXpxß¾KEö:m‘BãÚºU³´¯^O“ “·Òc~º9Q"~]úÇä}½àx¥S=~yM‰ð]-ƒ ݼÈ<‹‰S\¿ÉÃHâ¡¥{3cÊÔYSÇÏZq–ÞÜnµ,B±_8¼÷xZÙ÷¾ÜŸ;S—¾þÍe;îP¸L¬e¹‡öíK+v4¼sø€nJcúšíç\ãFúDé%­ûz͵¦Ú¹)É è0CyGDG°–ß·79ÏN….T£¸¶á•×2¬r-Ù6¾ñîe]Ëá‘z€]8þÛ±$‹@Ù`ꎦ(…_¯Ù¼~j--”%—KÐô…/ß Ðvú‚iéo½8d‹¸0ué™Ä,ÏÞ³?€RQ¥Úš(ŠÎÎ[šbX¹å½ÑÇ¿:gݲ½úª>ýulXx1±@:eá@ (@(•DQ¬ÕJ’(ȉ„…¶5¨VÞßXëÑó?›}hÉ«¯¦{l\¿:ÂSQwÃa‹Ã~³dÀƒ'£ôe§R+çÌõÚk¯}÷Úúö³-jŠ~Û¤q?6w ΦÆöšÔ5ÒƒR áŸÏ?1õý—â·‡©J¯Õ÷<ûÂo¾f¿N e©‡^ž1'îµC‹†zÖéo†ç_š’øô‡ãôkêuíj¦[@iO ‿¸'镆öoÝ6Êœs)Ó( Ÿü^û ,¥39‹,T[@Ôµ­ÿŠç‡ Šïóé¢gÎH]øæ}ý–·ié#]JºHû/y¤¨$JõE‰R@}Ýò÷¼´zBlåŠg&ž²zß«=ADçeе±ò¹ÝC¾÷M¯Nc} Š¢<Τ’(Öªe*Šb­™5*ÕùXgÎ.yÏK3ö[pèÕîõz7âߧŸaþ†Ë÷¿€E«æm¾]·?jä GäùiÁ™/À§Sç Ç{“Çïˆn;ï¡@Ik’¤ZÆ”$QpfFÅ:ŠT]sá¹yÓ&úÎ:ºò^ã÷Ò³Óž\´nL÷.>þÞ•%ùDç;êñ™¼5€tì£Ù³²Â·}³4ÌMñÿ\nÈþY‡¼ÍÏråò¥üRU¸7‹õ®Ùæ'æf\ÊÎ/uPÞÍ'¸eDˆ¼EÏ”wöT–K—ÎJç SþáÄ«M£›øéH•Ù§“³lThàìÆÜ”ÔÌ «Ä«uAMš‡úèå³¥ éÄU||KçàÌVxôtºOXTÓ@L)ç’KÌ¢kXtt°¾àBbºEÑ®m´NIê͉‚Ü´sW *¡p lì®(¼œx©ÀâëV”˜îhÖ%B‘|ö¢ÑFu-[‡»àú6¿âìË9Eªp÷ ‰l¨hlæF0¬zjü•±›Þìo¨7C‘ªòÏ_ʬ°‰jW‹6‘n5Ûüle—.e”TZˆÂÅ/,¢©¿”B²%Ÿ;c×4ëÐÒG¾‹­èÜÑ4¾s|k ¡¤øJrz~oðïÐ:\ÁÑü+—²òKѸúF´jaPPJA¨ãbòi“¢iLk_9GÉù×i\ç(®žå—Ž«ð‰êÔ̳‘j7å:{-,²]°—šRBˆýâ±#¥Úˆ„–šã§SÜ£"C %™§.yw‰ ã@ÌL>WhwiÛ!RM èÜ¡ UXçÈà†i;*s¿˜2¾èÑ_é¥kèk%\(V¶îë¥@«ò®œ»ZàÒªY°;„’ ‡. ±±Q:%Heþ¥ WŠ©Ú£]3Ý©ó-Ú´ósSËâ—~ñd±#¤S»@Biö¥ã9ö&]ÛúQã¥ç-íc£]U<椤³’®E»HoÑR–”xNÞ9*@-{Ž½ìÚ¥Œk•6Sh¼š‡xP€”¦˜ÿúêg?ù,ÔÀ3¹¹“rc4­Vë?¶´’$ü9òŸ1¥ËŠM÷úÕ9œ——ÇqÿÜ=`ÆÍÍío»½#ç©{žê¿vóPï„Ñ(¥žžž*•êV/(úiÂóG>Zñ†›òÿûâÔ–›ÄÄÄÜÜÜliA6lØߘ±ª`ÿ™’nÝZ+Qg½zëÖ­ Å?7Ò ìСÃßVk¹û“*ztk©¨k´-[¶(•Ê¿¥ÓêÚµ«——×-ž_™vø¼­Yç6~lî†ü÷#ßp€ @¡V7þ-ãÚ„àïhð 6UüOÕùï¼ýûqâJJ ÕÂfCÝUlßÎ䦎%%éº ¯\ÁéÓ8zàÂpxõ&æÂÃQ^_ß}´Ë`rs«®““ƒ `4"+ ééÈËkäL³¹‘ƒGŽ0‰q€|€óçQT„´4df¢ªªþ™¢‡£þÁÜ\””ü›ä¦¶Ö0Ýars{‚·ÞÂK/ÝÒÉj5t:X,psCL ºuÄ ÿ²ðãîp#‘“jÑii·t²ÁB`·£ystë†Þ½ñ/s˜eËðÊ,|¹÷ eíŸÉÍm’šZÇ™(œû1š†#<aaðóƒ—‚ƒÑ¬BBàç÷o ­{òðÖBdfbÎ+è{çóܨÖxx ‘‘ …—||д) —åèiç.|¶‰?#JƒIÃ0ðA,|þþLþwjÿ¯_™:p={:{~ph¡€Q€=ËW"!¡‘Æù?^‚óf… ‡‹_lÀàÁw¬r: 8|´a¨k <ñ4æ½î\wþ÷:äŠ"ÆŽÅÑŸÐœw–¥RÀUì݇6m˜ üÏø÷?^¬{wç„$AQŠ¶J(¼•ðº†ûºaè|ýõõI‡š©Šød €¢"|ò)Zcñt´±C˃´† ÁêUw¬r:³g;?Z)ðV¢°a!Ú6ÁçËa2ÿ+UF&ã fÍB€WB„YDº1p%“i ‹nn¿ïêÞ€N /‚f\­é@ @€Ñ³^ÆÔ©ÿŽÐÆáÀSÓðã&Z çÀP ŽÀ*ᢈùï8 rÉχ¼Ùšç¡áÐJ W$Š*Š ӞƼùÿ2ß°Ú0~NìC„€2¬Ð·ÀŽÝÎ15›-fÑÍmwÎ=æüèé…5?C‡Ô ØD€ DTáÃg¤Ç›¯c×nÔüPð%µeeøî;<þ0¼T8²mìpåÁŠ W šŽDb ¦N½óÙÖëý¼(â¹Y>®È3Ü9ÄHønµxq&ô´^ &6nÄ„ÐÖiÛaƒŽ‡CBŽb;¼¼ g“áç÷/ˆsYtó%- -Z8ÿ..†‡.\À„q(IE8žs>èI(AP¤Ä¸ñ˜5Û¹‚û·wq'Oâýwq`/<«àÁƒ«n0 8gÆcÓðò«ðòr.QÝñÜRŠÑ£±q#øù!?••Xú æÎF¤ |xP‰B 0ªP®Ãĉ˜3ǹ»ïŸ ää`æóØ·žUðª6#¡H³Â¬ÅÆѹ3Û‘ÈäæOSR‚˜dfÀûïcÆ çñm?áËÏqn´vxªÁçon8 Ï‚«DGaàhÄÄ¢u+„‡ÿ/Æ}5Ã¥Œ+8{Gৠ¨(D€ ÞÈO7$V Å6¸7CD<Þ˜Ðп¼a¿ú*æÏww¤¥ÁË E²pݽdŸ„§‚º©äg:àš e":tLjqˆŽB›6p5ü=Ò“_€óÉ8{ë>Gn*|ðsD å*8Ä Á€!xø¡›dÏùs|IA¥RÝÎ3ÿåF1x0v쀖-qñâuÇE””ÐÕ+É¢ùp£hƒ#¨yΑ(Aª$¨R¡G7<øúõ½™RüÉ|~ó –-õl,PVAËCAPó|eBaEáŽ÷— .Ãåëz«+ñO5’ãÇÑ­ð<¶nÅ!rúf«5#)‰¿r¥Ùß«¾ý­5ðU:ƒ‘ÂAaä!ù"0¯ÌE¯^¹R×°b9¾ÿ¡)‡ž‚' ¢„l;*Ô˜4 S¦ÁÇçæ¿ê’‹)BjjªÝn÷õõ ¸ödügåÀ”)Xº|}‘ž½¾Ž39……tå*¯Ò;ò9cuUAÇÞù Pp„ ÔŠ<;Ê€®±ÐyBk@³´ëˆð&0¸‚ã àá@¡€Áw(0[P^³’BÀq$P ùùH¹„Ô ¸šsò²p>Aþ.0( U?‚˜PØ$˜D˜€ öhÒ3žAtÔïöÆ”ÒÊÊÊÌÌLŽãÂÃõZíŸí–k®]°³f(**ºzõ*!'©5~‚Ã÷³Ï]r2z„*ÌÄ „V…QÀ ˆ Qíáá D¶AûhÖÁÁJ¬­V\»†Ô4$žÆ¥dËPU„ƒ'á 4ÑB«€ˆ&ŒhÚC‡ã±Go±«¡¤¤$;;[6)¥ÔÍÍ­yóæÿäç0¹ù»Ù½@’ Ra÷ntëVóÍfKIIJ]L&›ÍwÇ/XúÕq$€À·zC«T·ðò L6ØUPªáá^ µ Ô.(· Ô«-< Ð+a6ÁnÕŒŠr°@ ¸¨  8‚šwÚ€P8(r­È†'§ãî{àççÊ› €ªªª«W¯ÚívI’ð<äëëûG¾]¿~ؽÆŒÁúõÊËËÓjï$D¡Ry¨Õ!..\R]ò.ÙñBRA¯ A!P¨`s Jõ‚E@?tŒ†Ö+|ü`2ƒçA‡&@ P@œzm,©–*8‹ Z3ÄÔàÁ(9p (±¡€¢\Àc“1f<š7‡Ót7š+çææÚív9–‘åÆÏÏ/T½2˜Üü~“•¯w IDATç¼lžx¢æðÙ³gGMl,?³O©×‡DFŽWþüv좢‘ˆ°ᢄÐð ÕOT'ÕX¡Õ_ ÁpD!Iß·BªÿCíW P@¬€Ù­Ô0xcø0Œ /Ï[,¢$If³9??ßh4Öüò”Ò˜˜˜?Õ'oÚ„Q£œÓ7eer›t8ÙÙÙeee´î#ÊCÃÃ=¼½U~ü‘®\E ò`ʆ£j5eõl7O``´Cœ¢Î«à¢…Bj $ » `µÀn…èpZRÅÃCuvv 6 V’ú`(|Ð5Æ#¡ëm {EQ4›Í™™™‹…R#4ƒ! ÀÍÍ ¦˜Üü^çƒÓ§à‰'°lYÍ—‡£   ¨¨H~èlMû vqÑ»ºù¨L&”•Òìrôvÿ‚Ýû ‡»•FÐ)à£j¼™ Á;”jÔA•„ ¬x:w\3B$¸w â{ CGøûÁÃ:Ým5’¼¼<£Ñh2™j÷Ïò:.,,L£Ñü©RZŠšGFeg#8¸fÔf2™222GÍ*•J«Õ†5mªä8Øí(*FY.¥àØ!l\¼Õ®F)A¡ •vPwOØ8d¡}4 G÷ž †·7<=pûòš››[ZZj³Ùj{¾R© vwwçyžM3¹¹V¬Àã@` ®]«iò÷Øl¶ÌÌ̪ª*©zÛHM³!„¸¹¹ùùùi\\”ÕÔ£IçHzLU¨(CöUüvÔ-Ý › œ‹]~±sqZ¯ƒh\ Ð R„‡îêWOè 0?ß[Ïëî.Š¢Ýn/--ÍÏÏo´¦t:]@@€»»û0 Å‚Ž‘’R{ú¦6ÅÅÅV«µ^¤ãêê¨Ñhê<[ÏfÃoûP\ QDIŽCjüô°™á°Âa‡$BÀ 8*%j¸haL":D£c<¡P 8èzsË]cII’d36|Ô¤R©tss “ýá œÉjÌÍ/6ÙŽW¹yûûº»”½Ìî?*7YY sþ]^ŽZÏÖ­q#‹Å"·™ÅA­·i4•Jåéééíí}½¯­ñ“ ••ÎMn¼¢úÑ9´æ¥ç^^hø$Ð[ÛWV{v¦¨¨Èn·WUUÕä°öÐI§ÓëõzŽãîL‡,I˜0ëÖ@p0²³kK¶|wAªªª²²²äùŽÚh4­VëíííêêŠ:¦©EI ¬6ꇳ÷·;3˜ú °Ùl‹Ål6ÛívAA°Z­v»]ŽS†<öçõš‡$Iòl´B¡ày^¥RÉË:...¢=PPzbý‚éïlêúàÌ!1ö¤%o­R÷{rÝh8òwù¼$I²-‹ ò<®¼{Ho׆rø#I’F£Ñh4Ç) y>p¥êÁVn›Ós'‡ uÜd29y@*›±fÊ\oªT*¥R)Ç}56äy^­VüxõoÜžG©ä° ¼JÉËÓm®CŸ¹nݸõç+Ú&x3•ù{åæß6pbBÈŸÜY×èB՟ͧB÷ÄÜå<"k~aîÝÂöL›ô3 ¥T^òûotböÒ“˜ÑôÍóºkS^–kå‚B«b«àuûf‚H ¼irÊàˆ¨>Êê_TØ7/?æÝ®eSù÷“ÿõâÿmP(][6Ôì}ù‘ýY&J%jÎ~gòÂüÀØûZʼE7ÿYœ+QÀ‘5¯¾uJóÜÒÉ%Ǧ+ÿJí¤œÒõ¹9 •Ÿ,{ix‚ ÒØmŽÐèsç?aP²§!3¹ùÏÇMŽ]‹zö»²+¿×΃Ùä/×@ß$nÖÛ±/IÎÀ’®zÍ‘Ùço—köîÝIv^YžuªÄs{wê Q{wíÑIÇvEý™¸†"~öü¤¥ç½æ­xoD;;ñóÆïéMÄ0ïýaþ[¶ùlèÑw‘M¯&×w¡I÷è/·~ÑTÍ*åÏP±ì¡»Wšâ6¬^ÔDÇBWÆÿ{¹¹iË&þ¸Yiÿç3žÿ®ò“oVvò©osâ0þ¿F7Œ¿Áteú¨ÑIB³Ö-ˆéÜ¥K—.]ºtŽïÒ¥K—øxùŸ¸¸.ã’)Ä“³ZÄŒ9[lýã÷(>>¤_ÜSKÎþ j2kK—.]ÞÝ”ñ.Íùö^ŸŽS‹$€¢}_nÜsQ’1#çš^rá‹Á¾ñ³ªnÛÛѼjöÈÞ.εÔþËóÇ îÙµ[Ïcúð͵Ç$Àœ¾}üÀ^*! ô¦)*ÙZµ*Ûþ;²SÖc£:œ}ìe³îÒoÚŽ[Ïù™µcZö_ñ׶EâÈ;÷ÉÒ+ !¨¼0zpü#¯ ÿ¥`ãö-ÿJ©¦ë ÉçÏ&&&&&&®1LëêþææÄÄÄÄÄ3II‰ß·åN­×kë…6”R*÷$Ù0HâµZFÅÕ\x=‘†g×:RýuýÓä›×¹¤Ö)7J¶áQJ)êâ”:^¥àÐ ¿{ßû7—]æËö¬Z½ït¦ó^­×¹Ôë[åëÚ<þkéÉ· [­±’Ë}7!W,^¶×û³U³Bt$w÷+s?Ü?ëûÓ'?{ö¹¿.þåq³>rèüîýnúäýFÜDE(¥ l9ß.ÿ¾P¸q-ÊY!œ‹V§Õð@ˆÚE§Ó(nfÔƒWjõZ5iÄcè ïxk5^»,×’¯_¿Ï\Ë÷\Ô|cy£7Ðòß-ÇMüµó‚[.é rã¼}ýK~ÏòÿÐÁT]/”äBI’Ô¯¥š¤üaÿÅ|¢vkß瞎ÁZgØ-Oîù-éJ¾@4MÚuЩ¹™ßàŽBæúÏáÛ÷ݵ©<}Ç®#™%f•Þ»}·þ Tªøe媪îëèê¼(õàº=Wݽlù¾}Fô÷¤ÔVþóæoªö÷ŠSRÒÆ/Ï{uÛ«3~Ý}$«¸Š¨ ÍÚwëÝ>”€ÂZ¼iÓfuäˆæ¶#{/–6¦©·Ê’é×½‡ó‚O³ŽwG*ËqÉæeßû Û-Ä•RHæâ·l¶ê;Þ;,†ÄÄo¿L é5ØãüÊcºG'ô<ùõ⸽Ÿ}šÙó¡'ÚQj¸ŒÃÛöžÏ%*×è^C:…'oYÖwÒƒ=T„T¥lYè5ulÌ‘Ÿ¶œÍ®Pé|;ÖÆ›wŽ j²@H^ðò¦¾3W´U@nºê®¯Íì JAÃñáÏg¯ž½ ÅŶé?:æ³­Kßþ¦ócU@£šC©¼x`ÍöŸ¯ÚmÛ¾ü,%¢ýØþq!°æíßuàRnQ¹¶ŒëÛ­µ/¹i„Pœqjß‘³ÅU…Ö+:¾{\ ¿ŒÌÇÁ¿;Ÿgrq ì6xHS‘‹HËÒ¶ï>š]jâÔ®-:tïÙ6øV,9(aLBëš²äüúå²I’mí²Ï[ô348ž«Ê9óË®ãF‡Â¯yǽګ@)@ RŽí?~®ÄLÝ›õêÛË_ÇÕµ·l~zåÌþ£g.WØ${`§^ýZû¹8 GMgöýv&-Ç.©C¢:êÚŠ€RJã•“;&•XáÚ¦ß]Ý‘¯²\ؾ÷DžÑªÔz¶îÔ3¾¥/¥”T¦¯Ú¸¯u¯±ÁGwK±R—ðö]tŽ”s ¡bÿ/?§äVh<›ô˜ øßNÞþOïÆ«ù£ Ç=:o]JjòÖ/ÞŸñý¥¯ì[5ûéw¿o,Óîû>yïç4§å&®\¶|åê•yv4íÃwW¥çÛªR¶|¼j§Y‚ÃT^B!ÚÌ‹ çŒWq'ß{dÂ+«/¦žÿqåâ)#ØV%Iß}¼v¿`ÍúeéÚ­ŸNúÙ"7ƒòض%Ý=þ„¹‘À$ã«å‰š°á]¢äö3iþ{×t¦Â2*InþA€*ä…Ñ-’íÌ,µßt”DLÅ9I2›ÍAˆTpò¡Ìùè«ô¼¢ä}g=z÷Œ‰ÒS¨8ûéý÷>ñÙ¶¹ù׎oýtêØ>8QLH#® 4pßÌòöúiç®ùøõÇGOÍ°ƒjIùá®a¼½rKVAqòo_™rßô%{)<~×òi9•u'—ÄòÊR*ØL›$9KW‘ulÂÄ™»’ÒŽþüÍ¢9ϼ¾ñ!„reó‹£ÆOûb×…â‚ËëÞš;rüsW­!µlBIÚ4wâ3×ï»——µ{íÛ ¹>K"„PÁ´øéŸzeÑÁ”¼œKûÞž>~às›„B !…;æ=õ³^|BˆuÅ”!Ï¿þÙ©ÌüK¿-?rJºEñ?ÕzçÏ®|µk^?¤ µ:NÌŠŽŽ5o«|ÔqíШÞíþà¥4ùë)íãÇîÊužyõçw»Äǯ:\D©T'á¢c÷ôzÉYJé¯ïOŠô𮫥T²Íۧ߄EÅÎó„-³îé0bv©H/ÿøa·. ë’íÎœ]ü8¦ÃÝ{sl‰¦¶ø¶‰RJiƯ/ {þÅ1=ûÿzÙL)’¿ê’Ð}݉ ‰ Ÿ?;(~ðÌ ‡3ÝSŸ>ÝuäÑkU´*ý¡{{÷üpR™ó«ÓhÓõñ36çÇoçOLèÖíÝéu @¬šÔaÈJ)¥ç·>7bÖË£{>pÕJ)u$~—Ð{ë1wóC½ž/)SèÕíùvÊ×Jg^ŽŽþòwra¤¢Ócû¶½ÿ­$JiÊW÷Ex½ŠRJiÙž)m[w˜òMš|•õâ¶~Ýcç®Ï¬›‰JïM9ð¾9ER+;*RÞ¼ñëÕK`ô³o~],ŸL)­ÜÞ¿MŠļÕº$I”RÇåcÚŒ8[]ó^½7nàôó&çÇcOêÐkÔé\3­Êœ4ºË½sPJ%[鬉 žÚA)ýjLlÿY«®›ký™ìÜë̺q±íbž[›,ÌÚúF\·Þ_)–DÛS$ U}ͱŒêvÿ™ñÐêß±ü法5þ&—eçg“ãºÏtÖpÅ…1C{õüàÉ"ç9ß<™ÐfôÇJé•Í}ÚÇ¿¸òpµûgÎÞqÀìÝ´ÆtN*ôoyÿʤêÖ5‹_ysM¥4ëÇçÚÇŒø±ÚÏò­èßñ½í×$Jiqâ}=»<=»ßõð«•Õ_­~¢SÇG¾£”wÍîØõ‰BùxÞþ÷ûÆDË–ÿßð?n|àSöáJ¡põÓ¹ëìE¹€é篎z¨o€ó´°A£ZSîÜÙ“¦xN/›¸ë\äcϵÖ:ω›üxháµ#™E7%{{« N:-_„ûf.|º;ilaËêÿô¸6ÎÙ®¶¡’@M•&j½zöTfÄħB8g•Å=:1¨(m{zId›ß±|TK=(©]‡ *Új-†FÝíí ZÚõ‘Šò+€ã?²x¸Þ=¸Kõ€!´ÿ ~U{Ö¤RÔu`OOUÚ¶ïSœSÜêñO¿öÒø(Àüãû½¼;ÜhøuÒV£O9±O È¾\lµÆ&›¸ÇáÝ“šV§e\-lûÐd÷ê™?â“{êçL;8PH:õÑVODyÙVààÎ4Cˆ_| ùïŽc¢‚•ÿÊ…ð[Š¤TzwµBhA!TJ.ñÆŽ<´LöcŽóíß‚‚ÆœšÏ:ðù´ŒS‘ÝŸéÜÄÕ9‚5™ ?¾pÌH¥Ü$K9ŠgYï‰iÿl/÷©Çíƒ=—מ+i7j´‡ 4¨…ŸoÉîƒÆ»†ý¤öTt³Aa¯žOj`³ã—SÔ­ÆGªSÁµruLw9@\‚ƒõ–ô" ˆTTx7Q9ª,£„ó÷vCõR±«¿{ìƒÂ¿I„§GÑoG«úôÏùé‚vBHkþï&g>Ö#ðÐå4]›IÍrob@¥¶¶9B@Ù|@Õnn R}Ç õD ¢Íj3YT¾a|ÝPWÛü±ƒçƒ­dçWÌ4¨`Á·O ' ž!>$1³ 7™Q«ß½äš]Š¾˜6r­SC qäó™#Ú»5zÅ]‹–'ÍY8{X;Á'ºGžÝ»õг­Jž÷¨{WI_ËÄs­Ìõѱí @<ƒÚûß»ÇÞ4ïœÆó™­·{®ÍjCÂà+ó“m“¢3R³bçöùkŒÜhÛ‘¨DyyÃEu{&ÕsP{õlÆÁÍöíýirÿijáU Á&ÞÎ ‚‚bì3,Lð²Õ5 »èà¸ÖøúÖÏ¿÷ÅT«ùêÙ›Ö¯š÷ìš/î}ó¬n7_7¨åL¼‚“jû¨(ŠPr€ÇïXžû£vUò„W{Ï^º.Zg¿éQh ub?PêÑ´×K»Ì6/Ýõí×_½¼áó“×~:ÑMÅ#¨ÿC_>9D¤×ýŸ(TjLjv õv3ÂsDtÔîD¨(ÑëÎYgÔõlZ½’€RI¥ÿìTñ *00¶)½šQ¡Ñ»º¹ººº¹¹¹¨­‹º‘õAÉÞùî9žútÞÝúwfÌ=YFà¢õv·d¤š] ®®®rZ^¡Ñ*@)ˆ×]£zŠ«Ö%'žúYì6­—«b†w (ÌÚó˦3n>q!nÐùÅ…—9”uáB^óñqzЄ4õΟ¼v}¢¹()ÍâÖ1H©^Î<[ú‰ÙÙeò™òÓóop¿·»oîÕß~ý>ÑÛ¿“¿®‚ ÷¸š’ZÔêNšÆ®ùK¶•qJ%¯VØÊŒÕ~Xüθ¡“–üL®o®,"(­î`­(·ë}tµy_Œ­É¯*,2Б–R©Ò¹º9ëEÊko¸©Œ–噥NçÞ&ážW–l|oj÷¼ $‰·QQ‰¸„„ú8.œ¨Ue…gÒ­±!:Àív-O¯¯¹ÞL¾[†¸Ù…*³EáVí|.J…ÚàªâêX‡H¶âÂBÊ«õî¾>ðÞšŸÆŇ]Þðq |;· 9YF½««›ìþn®T€V«!€Ÿ§ŸZmI¿`”-KˆýÔ/[¤—è\ƒ½ÝíOç;EòÏäØüâB5 œ³ºé€ká«4™+LJ(¥’£¼,ßüÿKn$>“F9~ýð£crí–_sß÷¯Ü“ÓØ"¥G!Ï.Š3\~ýù7J¸x‡·‹Œ¸¸fÖ… çùôzh IDATíè’IýÆÏ/å0“t8Ú¶kÞëó'MꀂhvO?’{qíþtßø¡®€JëÞܲfÍW¦Ž=ZÉq5ï×¹Oç /*‘£RûWóטÃ#¶ðAý.Á¥ïè6%?}½5O>ÓºvÓ¶5ˆw‰WÏ~u8'°ó`=àâV±æ«uöø¾-ùú#GB‰Ånæo5d¹ŠwÑ{ÜíY§-ÕÓ&}bÉá•K–Ÿ(•Cðó›¾8Qei™ âå;gŸËÕ´jî!‰ýÉ—;RHƒå.Â+9»©Üi„!½‹6ÌúñŠBAú÷s}òDö6$¦>?úÁ×Vî­1]yy‰èèqË›9U@§nóÖÏ9Q/ç®±E´îv –§ VÚyXKÌÕáõ–‘#«¿Ùät>T~ôìˆ{žÙ*ÕšŽLòÀ'û³«YË,&¢óW}§Þ}«þV$[¾êÂŽ¿÷½Mið‰îÐDëzð댄ÀxðãÉ//N/2©½šFE4Kýúµ «|›ò¥¯¬¥±}‡*pƒxEºkkÉÎÞ|$]®ŽÓ_Í?Wú?U€¿d0% ›ÍV_d©Ãf³×^tØmv‡D&=fL} xÝÌþ¿x5õä*³Šlѽ¹·OpÝ •ì6›C 8×K^7ø‰e‹Ööyçá®/¾ñBÁ ‹Ò;$,Ø’w¥RþÄ3|yJ)!@tB7Ÿ%[ ¼: s“û ÿ½4ó6diž *mÛ Ðm›Nôyê^…3%÷=ùâ¹ì7_Õ;¨IS^–Eøä óš¹+a¢»ÍáŒe)¥¤ÅÈE÷˜²pP‡Ï›6çÌ彆ö¤g~°;„†ÞI‚'(ÞÜ’«{apsÐ:ø¼³õôàr†¾¢ÝjsP ¨› Šö]üý[ƒö}9æÍ-sB]«R»ÝfsH×/qäV[­ŽJ6›Í!4ðA¥{×€#Iǯ™žh®¥¤ãÓ+'>»az¿ÏaÐÒ ³Ò·]×IÏ=ËDHúá ~¨™§<¡¼ïó÷¶t xd@Ëz¥S÷Š _ýLß~‘ ÃÖ¼3mÐÄÓæ¿?¡ÛÊàf|e^]?`ôô!zT•Øí6»l@J›Í!¯Ï¹kÚ»¯&lZæëj*Î,çB'}ôZˆóWµL´Ûì­õÙj³ "Q<ôÌ‹)‹fŽèÜ$´"'ÓîúÌ‹s‚õŠßµ|}_""ã<ÔKF'ôk3þÝUhì6›½–¥›»vûòóIÓç-‹ëýUD>/-Ã¥yßEŸåj}(qí=ë™ó^µÉ%8ÄS]šŸMÝ[þ_{ßÅÑþÿÌîÝ^á€;ŽÞ좈J•*v‰ lÁ.*QÅÞ°E%‰%Ñ$šX5‰Qc1š˜¼5vƒ E@ú×ÛîÎï;r¨Iüæ÷úf?ÁÞîìÌ3Ï>óÌ3Ï|fÚÚy<}þÅÛ—'ötlá&Ðç«ÛDIMjƒ¨ÕïMI[²3!º»—Œ(U£˜A©Ia¾@¢sJ¼7þµ¾Í}ÜÊæ‘>«Mµ À˜Lõzœ¥M¨°¹o&ÝZ¿tèÉÍ­¤l¥]«~Aÿa0²ÿ”ß0~éiÙب¬,UéœÜ¼%T<'CÅã2³‡—›€$XsII ¦œÜí`sU…B£7b@”ØÁÙYÊk<]g OŠËø7©0 ÄV=ÉW"G_O€MÚrE•ÁÌAÚ9899ˆÀš@…}<¹ïX2~þû û‘µÂ4eù =ÏÕ×S„ª+ÊÔ™«TB=}µYW^Q¥7ÓˆàK¤r™D¦KJJ0%ww#«6!Z¯*¯TšhL‰\„ÅEåb©›ÌžB í ¨Jó« <7_O!¬¯*/W›]Å|DkJ ªH_okT—U3˜”¹{ÛcE^©ÑÝÓ]hÉÍbéÒÒb†çäábgV©(_o9ÀèÊ *ÀËÇÕº¡ˆÑ— $®ÎRaÃ4Ü»;"FuwR°»%xƒicee¥Î`Æ€(‘½ÜYÊG–¸½ZòÇjÿ/·½å,(8pþiÁçKú7̪@ ©,­Ö˜¡ƒ‡‹#0†ŠŠJ‘Dˆ$R¹LBk.-)f(OgÆŒ¢´È@8y»Ú€N¥¨ViÍ F$_â(s²5ŽUÅÅ*ÊÇ[nõ{̪üb¥£ÜÝÑŽج­¨¨Ö›™š.£0`ô\É7ÌÐÅæò’R=Žnnö¨¸¸„º¸ÊE–ûLê’¢jž3‰1 dPWU*Õf“|¡T.—xõ’k6^©ª*TZËbÄ88ÉEüš4?Z©P¨t ˆ/²wv–ñk>M„Y[]^¥¦Yà %r…¬–Œ5jÊÕ3Kð(™³£˜‡1F¬¾°H!rpur´&^몋ʵ"/€Y“¢¬\gb¾ÈÙÕY¯x¢ÅR/7É?´ ÿ p÷» Q‘Ý¿yŒ9ÔI“ÁãÓã2?¡fˆ4L§ÑåþÐ3&jå×yµ—¯½|ñWך~Œø¿ðnþ[€1þã׃ÇNüx⇫3v¼—Ò^lã_Œ1B¦òkc^Ÿê›¶oíP_›¢± Ê»Òãö;f~»z U#Àê'¹àä+ñ8yrx…BÅÿ·(¼ãV1qöÆ÷R:`ËÆ;µ«¢€.-9ž}¥ÄŒlߥ߯9ÊôütYªŽ¥^­¤">gk8üÝü·çÜÇÑ„óò ùÔ @4ŒÜsàÀ™8ü;&SõYfž}ü»,]*W©Þ/¥Úø™"y‰Ò­%„©÷rüªÊŸ37Më%B†Šë#ãgS€bÕ§v®HŒ ‰M¹íøu#FtÙõ”îA“?üFÿˆo…›õååJæï}(šÊ ýw2¾BèHv|ë¾›iÔ4MŒY¥BazyÉå´FQ¥ÒÿIAcÖ¤³ !tè­ž~½Þ3 ôw&SÈX¾uAJH@§±_þºµ¯OÂZÓŸ,ÑV)ªµ¸Iéj?Ÿ›þÁ:ÿ£óþóyðéët ²äà_“6êÝJ@ÿĬðå¨ ÐšÊJ¥sæ¦q—<^“6CØoÕúA>Š-é£}qgÔâõÛ¶mžŸì»sÞäåÇòx®w}´ðÉÎyoU<—Žò%t:‚Òó_$öÏ*ÿ%hÞ>èŒ-âΆNÀ3ÛãÄvbþ³ß…Í¥³¦\Ó¿4 ü²thÆÛG™?ù©ŸÙÑwàÊJkµEvbêoV£øÆÙýgîöY´õ“¬~ 6gõçýI^~gܸùûL6]fÌžÙšõîu¿M«Ó…³ªG.œš¶ús'±D(¤Y=š¾³7÷ÖJ_ò…þ Å{µy>.¬JI[vÈÌ™›]Ž€½¸ù½”²7&¼º+'æjG¦¯z½olHHxâ„쌾¢ÖÚ [˜ê±zÁ[t”Vµ3õj•R©RiuÖTZˌ٠Q«”J¥J­yJÆN”*µ™aMz­J©TªTz£5£—Ñ©oåæñø„FoÒš–Ök5*¥R¥RëŒæ§*Ε*•‰fÍ­J©T*U–_1MëÊ/_+˜µjV× [š6ª•#fÌuµ¢Êh‰¦Ò&ƒF¥R*•jÎÌ`›ƬA§±¼H£Õ3,¶$ØV=¹üHEÔJÎ`•Këµa¨­í²²¡2å=*VoDë¿3ºGÇr°ˆ¤•J•±& ڨשTJ¥R©ÖêhÖ¥Y§¾ú @ @½QÇ< ![ê«ÖèÌl½i‰µ³êX_Jz­¢ZÅ0"¿.›»K¤>!±¡Í­yˆFRcÀ¬Y«®VT!`Í:Z©´ô¾Á"?FWx2ÇdÇgT*µ©ok2UßÚ±ëTŸUï8`(½pêðù–¯öuðY\ëþÜW,r÷ôîoÛêj„jÒjÔ5ÍĵŠ‡Y³Îªy*­ÁT£’¬N£Rëi–6ZúR£Õ[¶™ÙRl2èÔ5ýÅÔP—bŒõZ•ZG³´Ic£¾¦Õù'r1ŸnØêW/qbôåûüŽÛûa΀)¿~;>“z·ëždï!Å×ô3Ø7½ÕçëNN~³· *(¯~>{Õ®›åØ‘Ôk>#&ÍJOêB d¼ÿÝÜ•;~/Ð{ºÙW<.q ê¾xÙ¼`w;¸¿=¸û¨™»Íu*YƒÂÑái›5Êr®Z–Ø}ȬZ¦ž¢Þ=¹08plN#fYú³•ccbS.WaŒ±þÁÉÞñ‘kOÑŸß›œðÅ]KAôÑ•ãºÄ÷?s_ƒMʬ)½cbã÷]¶rIž˜8d©ÒÌ4T›Êý:§m³’þUÝ>ê?ópÆ›uÙ3ûÆÄtÝõK©å×Ó³zžW®§±9orb\ê¢ý´V¿zxY“)Ê;ßÛÆ{×óè±e›¤þɆé/8\›âoÙI|y„‡\QuM¡oèÿçý¾PH JhñbÛç½ù#Å)n^y¤ªŽNÉ”ñ,¿xŸ—ÌœûüŒ! ÔðQ‰˱Hîà^}ë‹'ŲØÂC¥ýa÷WöÃ×íh! †®Ls,-;ûAM+x‡½&µž­ k䩼ý ,ËÔ6¶ö„ ƒÑ9mA/0Î=|ø¾@8aRªu;cä„I=îú¨ •—õÞwò›¬DÖl¦…Í{ú¹V]ºZŒ…yÐ:[©|òê™S—nÞ¾þãö>o­Œ3sݜןa»L:#Bˆ¢x/”6Ž€ )Ÿ4¨ö ¥Íµ V‡?‚¡Y‚_ï’Obc-gc¯£‰ÜL³˜/øø6³#q Zñ…R²nèè/ÓÜ„´ÎÈØ:<°Ú›ó'Ï(ŠYshÕªÑI®zµ‰àdãn“„ÅjE%F §16,O µ—Qðë3a|§Úïæ¥v2òv’`DGJíímcÕêªÀ|óõ5;¿ŽSS“}Eº²BÛø¢øÞöúª€A†6³‘ÔD«Ð­B»c(<Ö'9{ÿɸe#cš®ž°+ï«B•Þˆ€é'J-EºüUÊZ^ gK’݇MìâÒ8&øçó[¬ˆ‚âÆõ„tW6&ŒÞ~bh¿a-š|ˆ 0Æ&ýB݉eL´™Ú7d§E”‡§ƒ>÷‘ :‰@ˆ1͘R.ÍL÷ ”ÖÉ`KòTüæN’æ<µuåÑ&iòèI¾’F ± ¼ úr áOáÜÚ—,Xbé„€-^;ñò°¹GV  ê–ÕSsN±Q,’HÄD}9c:SZãÙS¿@ Ïù,¶}øÇ·•¾þþ2¡àâ¡oY«‹`úiß~m›¾}\Øgg@   @۷ýÛoÖðÉ™~Ÿ•µöV±î¹Ÿfi3AÁsƒè,Ô¸t÷i§¡¾Mú¹É?DDb(Q^yê§kµîη[׬Û¡¿h@˜ýeÿ†Ì¥_j5Pa×Ê_ ¦ZªcÌš©FN„ÐÛ]HÓÕÕåÐð<*!"yµ“uŒ1F ×–)ußV \ „>AÍî~²¥±èWÞôÞQɳ¶À5¶w»G_|z×d5g¾>+vèÖ¾%°ÏmEmÈ#"Œw¿’_ó“ò“ +·Í}ž”IJtMÖó÷yŠ¹wƒcû>šÕgŸÀh/€ýâHr0œš0á§ÚÙ±™q›ûñÛ„æÊ E•Î²n΢†Ù6yÓÔã7Ïé÷S¨¿ƒêÊ­\ïþ“Rý²qN¯ÁYo']èê'»õÓO9*Áò&Ø?¯r.òæqd꘩~}Ò³Ó–}vzÚÔ¤þá‘‘öúÂó¿]ÆÞÉÎâg· \;6VdO›v6¤ÓìÌinvMòY-m™{fô;sÏEwmï”ûÛ™«ETÆŽIuÛÈJþî”óãÚÚÿ|â˜Ç°wc]Ø3w³÷¢´ ÎÞâ]‹FM Y™™2äyF.HœÙ…_õàüï7%cì ‘‡åý÷Çö9éLé®^ú­„rÜ3º¡Ç&pm-$üôÉôé?FŽ};%fኡ7ÖÌr®[?å¹ã??qí÷õÊ^Ûã&ó%ñé)ã¦ø%ÎïJ59,ñüÇmš~~êÛo\<Þ5²µäÞù³×Jì™ùW½CÐÒuÞ†MI7¿éÔ‘ÒŸûíŸØB <~+±èâÍS¦\ Jy+­k³.<ƒùÆùyí,y2?‘ýé˜óT&æÚ‘qã/CÆg®äŠ¼_ÊpÇ„V ¿k„¨Ôii‡R×øGhŸ‚[¿=Rz¾¹0]ÐcÂ’½g3ßœ×-Š-¾ýó®¶ymuïN.`~æIånOÕfîÜÙ«F][9ÿõÓÝ‚}x·Î¹¥ð\{¤åsB9µñ¿ºøù´i¿„Ž~g|»gîij]VZ™ø*šrùòå/ge O ½qnÏ…ÒÎÃc½@W­4¤¾^.NNòZ89È;wó@Sp}û'ý'¿Ó»¨ÑÒ<¸èèÁêt ñˆ8aáÌ!aŒüâ‡t÷§«+ZÆ78núüåÝZ;bÄhË´â°ðpo'KiX«RHÜ;E‡ø{µn+Á&J$iÞ¹Më¤a½Ü Rk‘Ø9.yêŠÃI €€Ñ•i!aá¾.Vë£S+D.cB›¤GPËb{×ÖáÁíuNê¦õ•~ënQí¨šÊ;ôíÙtUjëÐ-cñ’>m¥–®A£iÇØ°f”wTÿWuµRköž¸,s@‡öž.ZÌ:¸µíÞÖW@„ÜÇ?< 9%m6bx‚œ¤•jéàÑsDFVF;“v®I¯Å9‰ø½Ž!„þQýç¼¹¼³3Ñ(R,Š‰okÖI±[Pt”#é;8´¥TWQªaÄ¡¯Ê^2Ñßpâƒòm×VL)±C›(?G=vðíÒÂj•hM™Þ122ÌÕÂ<ƒû'ycm¥Ö„|‚zÌY±8ÎGÜø ]ƤÓÒ‚ ˜/!˜4 “½\xK€6T©ÉÝ¢ý#‘W§Ñ}ƒ˜ÕèH(é—²h^ª3…]ý­‰»tŽŠiéÄ«3Ò9xjŽ½š5¼›…O¿¢øaµ‰r’»´nëצE3¹ÜÉI&kæç,`¯\ô lꬄ¶õ-3 \ýÇ ìB1fËkÜwÁúÕ]œƘg” '™ŠJ%_ÖbPZÖâ‘]x`•²ÚÙ78¢³‡Õu7)+¯Ø˜@;€ô¬U›.ÛuˆMo#§5•zšlÑ?+{Q¨Ür¶/V+«¤^AQAžµ…”Ó]c‚ìùâ¨n~f­‰»FE7—"U™BêÕÎíßœwcI®a.|83²û Kåø™ù,Æø×-)‰ÙUMßЈTŽµwÀ²u¯6ümøˆ­Ì–ý³…4.íé-l-bmÝl£Å¬­Ó)mV¸©£,Ÿq¥‰§^´‹Y7Ô U×}¨žØF=l»À&²ccåõ”ˆ€¬sê8ãõƒð>ßÝ,·Õp–mâRŠW§ñY°ì3êÜ” ž]ˆM)¾¢8//vƒ"|ÊŒ‡Ê?=†PS›R02å~•½½`AöD©í@>²BD¶óê  Ðð[Lµ:aŒIDATSe„þl!K{z j"/ ÙºÙF‹‘Íà©­ 7imúJO½pA#A½P5 îCõä€õ°í›lB€1% HÛýø’9¨šæ"À¦Ò+ö·Iàl+c¡&.5¡xu}#Ô á/½B $h«›R|E3p^æžl‹ÿl(¿š:t¼g摵½mÞF—_óú8»Á[¶L‹ ¹Ü8üUh>Kï»8úþ´¦ÖÙŽ¿5$ëfäɽ³åœÒ½êæƺÞû”üͦ)©3]æèá8¼Ä±®îʧ Í«sÇ_Z£çðßgn8pàÀ¡ œ8pàÀ™8pæ†8sÃÎÜpàÀ378pàÀ™8pæ†8sÃÎÜpàÀ378pàÀ™8pæ†8sÃÎÜpàÀ378pàÀ™8pæ†8sÃÎÜpàÀ378pàÀ™8pæ†8sÃÎÜpàÀáߌÿL~ªøûõÊyIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/distance1.png0000644000000000000000000005320313051004444021767 00000000000000‰PNG  IHDRzŠPÞsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ  ÁS* IDATxÚìw|ÕÇgv÷¶ô „¡†B' EŠÒ»4‘f¤ˆ‚¨(Š(ˆbAAzé©¡wB ¤×›{ï–yÜ$¤"O¢™ïçóždï9»ggw;3çì9HDÀ0 óøØ ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 S|冈Øè S2|ò'üöüø>cáíSKÔ)KOøx'O…n;<èUU–ù†cJ,¢¤;µmå„4oÄróØ]@ï²k4hª°Ú0%Zn úÂ~±d9t|á†a¹a†å†a†å†aþMŸ(Üøî—ø’3ÌSÁ&ËgÎœ±ÉJ¾_‚‚þ³}U,7 ót°Z­Ç‹Ž¹—{£¦i¾¾¾~~~L1 óú7Â&DÄÿnï8Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë ›€a–†aXn†aXn†a¹a†å†a†å†a–†a˜ÿž€¢¸¡Ù2Ò´¬ –QÔ9èô:"BD ÐäÌTDƒƒ‚œ™ªj`pp û÷ÄD„$[22£“^'Ù2RIÔë Æ‚_ÛwKŠU¶Y4@ô’ÁA@ ‚ÜÅIN³ZÁàª× ¹ªÛ¬é€ho-¢(è ’^_ 6ðÜ3ÓÏy6<=à3lIËpò©W{èÒ†u¼TA˸±åÍ JÅž 7û¸0ù…~>Üiö–ʾnb졶üøk«©»kUÑžÓ%¡rß¾c'ª5ɾ=¼y]|äu›¦G›Er+ç]©YóQ󽜅Étp}IçßÏÜw¯¿°ïä>¨};¥ÿ¾~Âd›“‡NDRÌ‹êè]É«f¯vCGè‘Yq–›âßêtžÆôe,‚ §ûlà©÷x}þ»¯# ©g>NñÝÐð}HÈõ¾Ýëª2•éòvÓcmö}³ºÜì×u* ÊQ'·¯õlüaµj^š–*è ¢TÈ<•( õÖwÛ>}ß±ÎÀoõ)…úËïß-Þôþäþó>sÎÐŽ¿f hÒéú¯S{y9¢]ˆEPMçkX4Tä°ßÛòéæôÌÞƉ°à0œ»)Æf³e’l›™,ŠK^³]îß>DÜ;õóñÊÁÏV î¼ùýxQµƯp[½oãiBupså°»ºî]^|VPvQüýÓ%Rãñ=_åé„Ö ²f€SÍ>=f®,•±k÷ê½$½³{e(ðÂÇ´Ø[áábT+Ø2Áf&›¬+<µç”òéO„$±sðÜü‹b+A2¢ h²ÓB¾ îÕý+¹Tîn2œ¿vìäR¯y»vQûçħ©—<|>­Ù  &í¡³lfÞ:«@­¦Ý"ÊšJ@#Á¡–_`“Ìë_¦[‰"Žþhl:ÝÝ»FóV.çwü®é LE—•6RI_¶_ÅÚž÷[-³Ú0,7ÿ/P€Ô¨ƒÖLͳFD¸|ò€ƒ{/o“äY£Šw©Û¡ë‰°|ŸEna»¾]fãûº€ÙõÊ=4’AHOŒœJûåòCÀÛ»¼¢$ef¨€÷×\¾êÑìù&šJw™f¸±âR4%ÙwäìYE3_±òZ© çnŠ9–»§Nnø4krXøñƒeº­¨å‡`¹zÙwÜzgh`j6¸Ë¹âl¯•Ò¨²1ðÅo¾ÿæ5džϿÞCPˆþ,–!M„‚Ò!  Ê•~ÔÕëRÅ[$Ÿe*:ÞÜ´©æèç„¢d,ëÿ5¾” ËMq¡”̸„¨kö?ô®~mfªTÙ›R¼§8Éü¸ADY/„ÞÖçÙ*¤}y9ºØª·tI{„~h'w0'$AiýÖD€˜œ”,JF½IÒ’/ŸLAس~ú ûÏ–d’më3­= … Rzj¤hì — ™ý›a¹aŠQ åT­Û³c_ɉ¨HÒH¤è£›¯”i1²Q“šýF1îôʳ»ÞIzæ[´§Nˆ€ˆ­CˆÀ±J=…Â. ¬ÛÓ&g  ¢-úÆQ÷ë.Žtu«%ٱɫ‹\Ñ’}Ó„ï]ôñÕè¤&U<•ÂœÌ<|çÂm·A#íÃo†å¦8 ŽªÊ¹Ç¬!¦^Þ_ƦAƒ}ªºf9"¥Œ1çŽÍ»})¦n@™?V‡¢(å´ššcŽ½êmX;ÿhÕšõëùôŠ91lÝØÑ¥ƒ?¦—´[[×@ýEuê××lYÑм~àâ?~ÚÞàíaYû@A@Küù#ŒK/3°GDz¤pG8Ãró/SDnŸ]ºæüÝr¥DÈX¥µŸ ®ÝW¿Þ`õa}Þ˜~}ë¶N犣*¶5Ó¤Ý;®ÎœüÛ²þ7½}L.^’šš‘›–¤o;c]7Po­>á4²9ØrEK6,ÛáeéÓOnÜVÍ=]ûfü=#*g$ÞÍLŠÊ4¶é9eŽQ!çÇ°ÜgeÑ•iÐÉÙ«fþðÒ5­J­ASÐrÂDÜ› úÇy5@@dômÐE)S­à>¥LKž<ŠÁ³V“ªôý|dPèµã’S üWoÝÁAM£øpÅ¿óð*¥\µœoÀ¥bçêm#Õ˜H¨^¶rËçTQ°ïÚ©Lu¯êík4 +iÀZÃ佑Ÿðúç§CÏÌ\òs¿×*ÜEZ¨ÚQö£›Ïaxð'ý ªGÛgV`X`ŸŽ™K/òE"ñSGÔÁÖ¥³¼”»åý*æ3ûÈ‘#+T¨ÀÞ óøå ߊ…ü3ïŸE{yì±èªùEÿõ”)±ð0?†aXn†a¹a†a¹a†å†a–6Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0ÿ7üEx‰F6Bíõß ¦>¹C„=Ó_19ò7ã,7LɢʞmAN¸_·åSA±5^6ó«{†t6?ËM „ÈæøDß´H 3‹é§1±jÀ¯ßîÔe>¡#RÒŸÖy¾t–›’‰ Ûöl¢Iú'˜·/ÛC’®8œ>jšhñIM®(Ê6¾åXnJ.¾Ç÷h‚¸ýóÝ’åI¼â“S×q£”‡Îò$ŽfsMgàD)S# 6Ã0,7ÅÉ’þÛkD 7ÙWkø+Õ @2‚Þ¢øW¬,A§ø±‰ô&0ÏâÀD„èY J0,7ÿâè‹äįÕÚðõqúOÇDˆH7æ4è™Ø4Ë_8QDÄô3;ÞZ>´Æ¡ý·ÿßç•äMS~ùrßCŒõõ§ƒš„G&ç.„:ŒÛÖõ£W’‰£Öbçnþ"¢ÞR kÔéôü‹ ïj·~ùðŽZ¡Ó´Uî¥Êü…c‹:Hæyuè2©Z)/Ç<Upi4§[Oä~0–›â?¢fILMˆUE£ƒg“IWø"mrZLZb" zÏ Ž­àšsZ£2RS õ&ÏrŽŽ¦|û°$†§§£{…J ªw“cÓ]üªës¤LIŒ¼çP®ºƒ^sÂíÛ’gEg‡\OWjBäCéÊN"@°%E…£³›»[®gßœ!¹—wqu"5%:Ì->®@ø„ f¤Þ²ÉšÎ¹ŒKáBCš9-ö®ÕjCÑäàYÁd’òX Á}!!Ù¢7zŠ¨iy|%ý~jR‚¦‰¥ª):!Aò¬PV BÜÕ|?5>^Éè^ÞÙÙ!¿‘'7oQò5PÐ{:e)ÃrSL³2¨&žÝ¶xrjºÎ˯bê틪S…Ž¯­)åf(°–ZbmœµÅTÎ/#<Ôfª<mSžñk¨ÃĽoìX·=kÌ7ÒärMßü¥zÕ<|´¸MŸ, š¼¥–)Ñ`=>û™[?ðbuÈå‹zÇÈ_‡^Þöæ@²BÂÁO6¯ßñÌ[{\œsÈ!~÷‹GŒœ7-vñç-ŸØäÃnî¹ÊHƴÓw_k6òƒ¹’ ¬Ñ·ÏÛ1`F›¼§/èåïw¿x5½T@SùþÅRu«ˆ¢É¶{¿/}7.µTµºá¡c¹à×¾öñpÈ!éôÚ»1Iª–veï7¾-¦ù×4æ„ð¶Ø«¿-–éXº¢O|4xV8´½Ê‹ŸÍkþ+¢$ß8ë-C¿Œ[§¬ºíl¬ä”×ÈqÛ7.ø²Ó¬m~åri«ÉÇ^_¿·åËŸ¾¾¯9wS®ìûçõ+¸<»öI*â©QmÙÿMStùœwI’ˆ¬¤’=ÁÂ$éæñ?tŽÞ™'ÖDêá焈ZìŽðªÉA?R©kÐòí’Ž^ Ípp2F…l¨6óç·‰!í™xGW—˜ýß(õ'eËЃ“%Ð40+¬fZ yº„ªïð Ý›zËZŽ9@µ‘F€ÞõŒ‚DšªaŽ!3­,!L•:íþÅSëç%ظ9åv7Ò/oÿxuå¾³üÜ ÇÎÖ][wìL¸(áðîwRkõï¦óéÕ uµSI±æ/K(aò™®‡y´;Jò êÕöÜ¢a÷Óó–1óÚ§§ÿ°´ycºÁ¥a›Q®~6""‘~‹º)Ü”ãjUèÑ[ºµëÈáÐôĘě¿Ÿ¹&è˜Òlà×s†¾~tß¹´„˜Œ¸«Ç?lÿã’UšîQDƒTY«Ð¡]úÎWoÄd$E_ÿù(½ ‹ ËMIËÝ€f3ŽÿÊ3zéotܺlaégçµ4Íxç‹_?~WÖòÛJ¨3€jUËN·ˆh0lU#D$# X­9‡#Ð`ÅŠš]Æ ¬–\eõ&Pm ÈYe$øÚ{t\—é+{yt‰¨3€€ © ÛÀà63ä“ûFÉ‚`äA‘óçp‰@4‚„¹M†”Ä£Z|·é²–Šî¥€4Ð"¿j·=â…1ï ׬yl§7¨ [ ‰HgDÁ–™;'E„h4œ jî}"$ìîµ~o‹1‹_Çb9îFÔÁÖ¥³¼”»åý*æ59²B… œ*.ú Š”\›læ?åüCΞÇ&çø*XèÞT[NNùª&'fFºËÕœ|-"©9‡ËÞ§ÖŒûGÅœïpXÍyËd(CY{Î)£Z@±˜â´gsô|¥Kþ“Í¿'+Ø þ$cÍØ·ê\Çw”sH:xè`Jåa(ç·]V3²ŒŠ 4‘²Ï=—Š˜#cÑä"°ÛÃrSÒEírüîyás?èílð.qg¯ZJ7;àℽSGWk&•o=6¨q=UýG&TEÄÌ}3Z\ëk…2Ë ËM‰w¡ˆ@Ó”úêE@½±áÈ•M^ÌN¿( iÿÔäÍDdjÿnh0€&ƒªòDf,7%"IЗô×®–•Ÿ*:ýËÞ h"\¾ÛŠÜ3õ´‡mÀ°wÃ<9ÉÉúßÓ÷3tzÙô¤ÞoV¾ò,7LI$£”/4Z>+à‡ŸÌQUãk4¶=ËM‰õ3Ií‰D–$£ŒBBõ@83rÆç^|rΔ$Iâ´ ËMI$Á¿žë°Á]jáI¨¢¨Èé> ±xtˆ$ˆšNÏwÃróØ1{û~}0öI¬wv³å–›’¢ô&ÐæP‚)qpG8Ã0,7Ì@‡ÀÓã1,7ÿq»c±°<øR0,7ÿuõîÅbˆnfXnJ¿0,7Ìõ-Ø»`Xn˜'È°Ú0,7L >–=†å†yrŽðÜ0 ó_á)|Ä€( X‚…P@žòøA|pE˜'jy¡$N5ø¤å¦bE?ˆ¿r`髹œ‘m¶è˜hM-A‹Í§;%CX÷îP½í)Œ´“tzY¶!€"IŽÿúù“ÛYžð[79ö®ÿ3íYn#îî;·þšocRRÒêÕ«Ífsɱ{ ÄœU·mèNO³ƒ¶ëךUýj5iÌ ðÄi¤ª*ËÍcÕôBHY–5MSUµä,­‚ š¦iðT}:U""Mã§ÿi¸8%+žâýé )i°Ü<ôÀ³ç1,7 Ã0,7ÿ=ø›)¦DQ,&uqqquuutt,!FG@I“ ¼¼½\—§Ù£1ÀÉÙÙäí ¢(–´¾’bˆ»»ûöΧbð½ •´}tz´ï<ßûoß/åPêé¶äÄn+V43†Ÿóââóþw‡â1§\É^iw"Š‰+¡q/x±rþ»çn†a¹a†å†a†å†a–&ŸÝyƆå†y2¸]yˆÃrÃ< ô"3Å°Ü0%å(Êžú`œ*OñÎrÃõÈ° þ†F"nþdð€é{ñÖæñ]^úZÃ"ÇÇåÒ&6Ë Ãüÿ¤&DEƤ€ÁÝÏ¿¢>TœL¬?ëÛ?×.}ªHlæßAù•m=åÓÖÙ>L‡ˆÓ¶Ÿ•Jµ5f{•XÀùA€Â¿T""D(ø`a»–4–æ_/5„æðÓg½{,ÒêãáâR£g >+Ý~å«N¾ku`†²vî‚%afgÑ–¤ºö1åõ¡m¿Ó󈌎_¼º¥ÊâÕË;÷óÍÉz7ƒœBî5GÍüd`O´™PiJúú‰åWíŽ %ýÒíäž#Þš6¢ycëÔY‹Ì4(ÎþÁ3?|¯•¯ÿøeñâ/Ö&ˆBF’cµ–oÌ|§egâàr™'U±ÂýÔ[2ñIJeÅÝ^© Çwîöj%íÝ( fó6ÑÕoŸ¯Þu‘JD”ùV¿!kÂí•Ò}Ú¸u¯+‰’¯÷jÞxцP"¢Ø­ê6[r2Þ^fí[C[wm%"RĮ̈S»f—™{ì?]\úb½àþwÒdʼڷqÃ?ÞjßþËŒàºm¦'Y¾iQ£îÇ!)DDdY1ªcÐà©V-«¹LA8wÃü@åî•“7jŽ}Û €ÜÚÏéí_°œbUÐyÙžvl:ñÐÎüÝôöà5Mrï¼õȾ c‘aÌÒ×ñøÑ#)ìÜp0Åíަݽ{ÿüù§ÞA§óô÷D±ðŸmw菱Vw…¬¾{,SÕîå+ä4üÍק4¿^ùÍ;ôèÓ«gÃ:Õy“)( ¶,œ¹x99ë%d›ArÊé±ÒL>úl½$$M%Œ‰‹EpñôŒ.e›4- |ü¦¦9lziÔ! ÌTtÉG#,íM|_±Ü0…àS¿þîùówÏŸÿÔ[âéé9ùöm}Q“:ÚgZÍÕ“­©TP;kvÿc³q÷oÚõ뻆é«4ÿî«OËcÓ(« €CißT,7Å‹b2ª˜ˆÆ„†þKLæSÚÙ|ýz Ts%D[Ô•xðÊ[F³ÜO0—.åUÁÕkˆÃ!cºt ¿-lú3íÛ”w7:TnõñÊ¥Ó†Œ|ñù®Ó7îé¥ZRÓ2¼4kjZ†Jÿ¯¿Ÿ7}ö¢ºõ?3Ù½V§Ï׾㠕F|ô^êÇ º´žë¬S3„RõæΟQZDönŠ|½ñw&OÍôoàÝ·ï–u.˦xtÉ)ä1ÎÙJD…ùkEŒþ+¸ÏI²g‰²ëºã‡ùwK±wÃü7º‹úmŸ˜w#>|˜·JÁ0œ»a†å†a–†a–†aXn†aXn†a¹a†å†a†å†yòä†N6²a–æŸéÌ\ÿ¶,xggÕ*–ï¾SäÀ]-3ñÀþP+Ža¹aþ ¢ÑÕÕYD„²BÏ\Ù¾ÈϾ!éÖ±·f®Le£1üÍóháªéwÌæá IDATwlÝ•h-[»e¯ìéª2î¬ûù·FVt@kÜ•¿IÎÔ;—jÔ¶s`פã¿~öë6E‹ûæó¥uº¿Ô¥‚>þêÑßB.$[T'¯ ížéRÞM"P3·¬ÿÚPkp=áôŽÃ¬‚S@›n­j–&ûé;w¸`v.S½sÏ`OÁ¾:&GœþíÀ‰¸ Í«bn]Û8Ú?·ä–Ø»aþÝá&ÌÜiÑ—›Ìé¿š2õ§SF Ò#¾þzÕùˆ4„»¿viÓ狧SÓSÏï^9²K§Õ×eÁQ6Çkª‚Þ Âí­óƒMÞüÇåäÄè­+ßï5pÌ}…5Ûö߬X²dÔ­ŽeýÔˆãŸ€ˆ¶¸sݺö[ôÝæˆÈ›¿,Ÿö\ÇQQf@ĸ½s;vñýÑpKÚµï½Ñ¦ß¼dd­ù7¼º˜§¼wSïþ+šµæ…Í]Ë´ÿ¥¬×3°Õs—,½/¨y£5ûï©æ jÙÿ[v•£[×ü¼/œˆ.ny½a“q‰DD´ï—%-ߦf¹3¦q¥ {ˆˆlÉc´ìÔg|JÖòô~uºÏ !¢]sŸiÔ{Qª}sÚé^?Üs’¯öjUòç³ö”6ä™:ã–œäŠ9L=M®Å_K0'ÄgÆgÊ™€)g&šP-Áœ “ f«9Õ–Š€*©É–d 4"Ê°eXU+ÈšœnM·¿6Òmé*©`SmÅbßhVÌihSm¤åL¡™Ý-»{‰ücÿ+ûÛVl›«™¶ß÷Ýõiкš‘€PìûlÍO_Îç&W®Y>cÛÑ[ŽõnRÙÅÕ=¨Û°¬Ci)DЮ÷„†qw®;ŸœzÐ;ald €€f+S½³#Ú›"9y»¨‰1)¿ï «=¥·³½iŽ 6œ81g7$˜­Ï6¯ †:e+‡„n³jŒì¯sî†)ˆÉÃÔ~E{€\s¤Bö Möô‚NÔ (€$H&)kŠGƒ£ˆ"Dƒ}£ åÝÊ €“ÞÉ @/ê] ®H@&½¤'"ƒ›Á AðrðÒ‰:"r3¹¹ê] ˆˆ*ºUÌÛRùN²êâíŒvµp*뮩ùgÛ,ßïݵ¥ž?ÌÊxO™êAƒ>š9H—'&ƒmŸ¾öñúƒ•šuoZ£œ^)²˜«DƒSÎ$2ˆIwRõ~îúœ=رXRH2}ñRðŠìÊŠÍbªìeSå†å†ÉFšy†¹¸…ÕE$?D£`‘­€YR˜Ÿ†BÁ’R6ƒ¿k3Ø–±wçÆ•«ôLtÜúQÏ\ªuó‡ï~õŸ´oÅÐJv„¯y÷úŸ¤[=Mrbš-»…YŠ£Ó™Èª.8z&Ø!ÿIðWœ*f Ø‹å‹N´›û¢Ãîe‚ÝåP÷ﻥ×ç[¾@½zlëÞ3É ÷¨Øeðk#»¶Í¼¼#Ù®v °Å%¤;6lS)«Æµå»c 6w­wˆ§×µ‹ bòìÇý|ªœ¯¿ƒ³v|×-Èv¨]:yú~&°Ö°wÃüëiuˆw*%Ùvý¼~{êµkUÃMïTchPÊÍ?¾Ýon×ÜíØÞ§‚‡6ò-|m& xü[ŸžýÊBK÷úen‡ü´)Ùó«–5¡ŒôJÇ€9‹_ñR_©UÆ!êüþVlòɶIÁeYoŠ5œ-gþl}nM#Š½´sôóíZµl=fÎꌈµA-ž;ŸI1Û·kýá{Áó[>Ò½m›ÖAº÷ÿ|ëûÚÞZúÝ™C:¶lÙêÍÍwl^îܺe‹‘3—¥(tûÈšíZút))‡¶~yááìN+úðµ½&mRˆˆÈ|c÷¤A]ÚµmÙ{ÔôÓñ9-¢ ;?صeëVÍŸ{aòሔœíL±…Wb`þzZ''SRøZD€€àäYñÁá Û/!2¤¯èÜSlv–†ažPÊ’MÀ0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0Ì߇€(÷_dÿÇ_‰ˆÍÊ0Ì•!"DÐ@…@#l"‘½†aþ@Ðt@  2ihA8r~Møüt›ÿŽw#±q†ÉíÚ‚&€¨! x-óØö˜¯“twÒõ¦ÖêuWhð×½–†aòz7"a”vk]ÄgqB¬ ÓÝ¢Ù¬‰vEúËŠÃrÃ0%ÍÉ•~¡¬ð)KB€!4íàŸ˜< ‚¬©(²­’âWÞÛ/;ØúËBÆ©b†)a(šL @¢ h hhêVßœ}[¼N¤¨ ’¼’Kw¯:¢ª¡žDF@B¿,8ìÝó~Kÿdý®]»·÷ö¹<²Ïðó–'tø‹©g¥¯¿’rsÔo[Ü÷· 7õ*i™ú^.£G{¼)€Q§eetì/•¿yÜâLRƽso&g*Ž¾uêV3eûš‰Q׮ݺkQÑÉË·n€¿®9”êÜ°–kìÙËá6M_ºr­Z~^pïôîu¡ ¤8°woíÁ>FH‰ »i–ѵ´_`­J‚Ý[M:Ù°YÓ”›gnÜK•Œ.Õ—q(P]ŸqúpˆXµu ¯GE/Õ§œƒ»æœéÓ¬”ÝæÉwàä9Hµ€Áƒ œÓƒ·–$CÈa¸—n¾Ð¦)ˆ”}w[áÄp7ŒТ%¸ê@ôñò0Õª ÷µ‘ͧ©3‚-íþÉ3—ÊÖi]ÑCÂ|Ž7ØÂ/_¸——jeœ¤,w<ãþÙK7’3l’É¥’m_ R¡V²FßØshsªj9~ðpbõ†e µ~þþå½äÄ»GÿØ•©†î?d®\§¡ŸÄݺt=2Ö¦¡“§OÝ:Õ H€uùp$4öÍ=wÕ¬ˆ^å«Õ­æKDˆšùÆ¥‹1‰é‚É£f` §!û~6Çž¿p-Ñ,½jÔ®ãn²ßzw5ôr24kÜ@ŒÜ·ô\òÄE3+ùá€Iï®ß×gÝÚ³#ê!RÄñQŽ5ZÕ)û˜9­$zš…X{’X@<š¹ïhê&ƒà$upìäÒ•DÒi: 4@’þ‘(ÿéË ª1!Ï~#Ir­SÉóò¥«eêôûfÙToo˜÷Ú­ëû('öý‘QyÀ¶Ÿ§»­ÿò̓0Ò=áP«NíÌçýñPú´Í¿ ¬ K¸zâjršM ÿ#ĹlP°nÿÜÞS~1ø·hìc9²ïŒ±Í´Ÿ  ñè¤7– nìsÈR­OKŸ›¿‹H©ýÝþ¯RsU÷iì#Üûpò§i§V pri0º^—¸pßÏ–w6@ò¨]â]!¸)œ; 6Ø{Zx€ÏU…Kîà‡BÁ0\þ?Ý€ÆAp-R+ÀÝÛà“T»ÇÄ&ÎB¤Pÿ“ÅÍu‰Q¡3&Oî·äô¸–N¹M„?̸lwX…:”ÈÓ‘)åçïØÒÁ å¨#Ï›–jðjѨæí‡Ãï¾_Û¦¬j¥çÒ"CŽžP %ôèQò®XÆ!¾p+Ñ£U×í~oòJï‘'¿˜–ßJIç¡n ¤úÀ³aô]&Kqáív0÷= Rº ¯l‡¥]Áœ»Ù i)™ÝõnT)5áÒÂÏ&:€šðÉë#à•ck†—Ë㣠þúZ§ûÍõÚ·5Ý;µÌ¡|ÎoZø†qo„lÙµÞßáÖ‹]‡_\š6¨eŽ8}ú–:téúñ¾q!X…Ìs!G5Sù†~–ñÕ… *;›O½¨o1ñ÷%/À¡u³?¶­zÛ®þÛ·¿ÇŒ]½qL=/ùÃIý6¾W5 0åæ©8Kõ%»~nàŒpç·nýg%»WlXîܾ#)>M6ü²´´@tæûEÓNÁîk“®ÜÐP½vY @$p*ÓÄÍíô€zÚÎyc¿©¶àøâ>é¡3jNHæLLÑTÂä››— ¨ŒbÝK½Z!v×Fü§žö§ŠFDôý›Ï´ì³ Õ¾åÖú–~¼’H1‡Ú6¨?ë»öÍrô‘Î-j¿µæŒF´`bûVmº]OËÚÇ'Ck·š¼ß^jö MZCD{¬SƒÀéß„ØËX"~ïشƇÛ#5èκÀÀú}lµÿd½²9¨yƒBâòT'"Ívù|d’-O[íÿ98‡‚†fo7S >"":ò ÐÐo²~Ù9ƒ@¢ƒDD[†”¥(ûTËD­gjZî=k‘œ™råÒ¥¸tEËk§ôÃoÔír0ÖþWæô-{¾¼ÌF´fj‡æÝgÄg·pÕ¸fõ{}b!¢¢­”xz~`À{ö­÷‹°Ò#V'->üÊ•Û±Y­Ïg¥IeÉÐ)« |ô@®½‰ˆŽÍ!ÐѾ謟¾…@O—“í—ŸèDÎégïM#Ò¬áW.ÜN°å»2CWÕ«ôÝÉ,ÓüþÙ¸ f¾Þw‡ˆ”Ð…Õw¿–hümyÓfA¡Ùçrm÷’éŸîÓˆèÖç5z†eݱïOŸôÉGì)wvu¨U}å "¢µó;7oÜòpv{ß ÁÈ DtûÄ€FýÏdØ+ÄŒêÔpôü )Œn¿>‡ÏŸPÃýzè9›^êÜHò tó¾zå€fsªô|E§¬tŸwµÒJÌ-T›JDš¢\?u2M/uìÐT–eY–õ¾õx–¾|b¯½ ¦]ÚƒR½·€‘–’»:*× (ï¦ËÝV@"hý6Z ) pñ\»å"²‹9ÃœžYã:Pàü-ÞÛ­:B9ûWnpÉ ßE¤\{FŒ.5jÕòróº®Êöoº5kåmÿLθ`íáMË^ÖÁ½ý7j½4Ù3;&mÝo áæÆSéð+ÙdlpýtQVz¤êèY©F ÞY­Ïm%H…o¢aÒج¦Iþ0¶,ÈÀâMP©>4ò› l6ø€ ÎÝ €%óÙP_©F º|÷ÏÙ×MÎM«{Û3 Aí;tû\]%´mú5DVdEÕüŸ™°`b;Ìs.Dzï© >ß»qÒ½¨°›7oÄ]ÔèÈ4RÀ§W#Ÿ,SøÖõUïÝ&€Í_‡”éÚ5Ѐ€„2«vZ9£ÚÂCCo5xq¼IUdY–·vÏvKÝ»ê:ûTªU­’„ ËC®œ”àh@Ù¦hèU¹–9·Ç÷ع]M—`N¾½57U°fJ©­Ú»÷M@D{7T®ÞÀ&­X r7{'ÅÔ¬”1_.*)-…ÀÅÍÅÞõ†?7ñDF2ièè%f[¡Àð¡¤ÔT@˜Õ?([P)#%Ù½Âlë :]–1»ö{?àêÐvXªC§@pÔÃm€:9•]ÁAŸ½/ÐÄgXàŽ úsñ¶ëqª[Ug¤¼‘blZÞ)KœJéÄ„û)N…[ ÝJPý¡$A €ëƒ³¬ç *ÄXáÖYpsÈenÆýµÛç~²Y'¹™ôY–1¹;tàÝ›ôY6;sñ’ ua­Úµë5h÷êkÃ]ó¾j‘2¾gê—{NU©ßÂÏÛ•ôTE Êî¼wôÒå6‚ùZ,–já ùz‡m±)ä|ûÍàÖÙ›d«9ݬ‹Iƒr.¹òæ:‹UÍé­ÑR2IoÐ=™÷¿§©!ÊJÂyËÑ›b„^ÓyI•ú•~‘4$A4âc“Q äMNz95SÉ7~C/é¬6ì’ša%½¨{!|(ÈqåÁµÄ¼ÅVh7*σYYZ¯í'e‘A0éDpD°ff}à†ÿïpÁÍ(Xe«½úƒ›:%-SËîiAUµé :øg¬ô·†€ê¬òƒ³¼ŸfZÁA€:áÂÎÂú þïÃt¢F6MËÒ.Åb+´1u;üºóHH»½eÝšUßÖá ûê…ÜwaÂåý_í<ÔgÁ¾‰ÁÞ eÜðû¦‡˜‚@r3R¸Õš5> Ç¿M‚ÕÚÿ× “üvzep3ÒU "€L8|þO´¦èËQÍÇÍ’™–œ"#!D…Eäÿb19êìÞÐ$g¿£f¶`ŒtríE²z— 5-Öfulâm?ÃÄóßÝÉÒ$ô¯þqQÙ0ýűï¯&£ÕŠptÝù³¤ÄFÅYÈ…çP¹n-ä‹çnj Q§“jÔm—»=®!ÿHˆzUÊ0¤ ‹£ªÚžóá‚(ŠHHHðxüÔå†Ä./ŒHß=iéæ£W.Û²hÒÚH}ÏZWt^¶daèÕá7¯müâÃ[n=ö|˜è¢è(èî]8wî¬R½]类Ÿ.|;äü•›7®X¿xÀþ_ï»ó° (<¨“F¨Ä.9qõñ”B_š#,ý .^†`ÐðŒœ;a·@„>ƒáÐ8^œ ú*м&À¢¯ i/¼°Nž‚ Ë`é¨;tùŒô»çæÍœ²÷†%_3kOœÕ uÿˆykÏ_¹rrÿ/þ²Ë»j'=ˆ]†Lß1iÕîSááa?wщöÓ§—{¸Cëà¡—o8vùRdªkÃŽ…[鑪§!ª–Ìz{õ,ôe¸èEøýøêw8}ŒÕ%Ëys1è¯BÿYpê,„‡WžÖÁp#åá,ª‰ËgOZy$)Ï¡ª<Û¹‚íÞ+Ö\ºzõâéß¿øö§Q̹+ÂB6NÖçÇý§®]¿~õòÙÍ6êjuª*‚èèeR¢÷ºx)"Ñ»t£!e×úaá7Oìø|â¢HwoÓ!wÍ…£RšN™[5ê‡o¾påòÛ¾úhOhõêA€NÏ?ÿ|ĺ1ßí9qóæ‹'vNÐq좃€¨]Ü°lÆûËRmø´žÓ¥âò÷fí8zêüÙ?Ïy5Åå™áýª"¢ºwñÔw~8‰ø¸ÆýI Jš¨'QQ„J¦ ­A@ø{C‡‹qÏTV\‹8¸ª_p“†êwòú±;™ö<¸jKÛøÉkÁÍë5jؠ߸¹×â²’ýï¼Ô0øÅjö¾{»eƒç¾´çøÓÎ~×¹Qõú ‚Ö]²ªrÆÖeSƒ›4jX·S¿—÷ÝHȪõc:·ŸÏêË øƒ ë|¾ýFÞê6²ÞèPzø1…4:ñ5ô&*טþ¸GñÈäј~NàG×S 7_²wíØÏ'"„š”#2”¥µ' µFüÅí­Õ\~4MËo"2ÇœŸ=êÙ&õë4mÝuÅo—r~Œ ùvH×ÕoÓ¥ÿš½×d-ëxEYIµÄÏܺn½À¾¬­ÐJì!Wίu³»XȲy[Õx|®€èe)gL6 (;…PÖуï“ÎP#r6Èö(ÄWù?ü¨ÿÀ¹>®»€Tˆ…°‹ÕßTEE½¨â“é£f¹a˜øR{0æÙÀrÃ0Ì^‰a–†aXn†aXn†a¹a†å†MÀ0 Ë Ã0,7 Ã0,7 ðÜ0 ó/ƒ²W˜Êù˾†Ë Ã0ÿÊid#"PA#’IË$ 2‘þÖ·U,7 ÃäÒ)ª ‘ŒÒÕŒˆÍw—gØÔìÙoÿ"—a˜Ü® h¢* ¢zO [þY¼‘&Ju•FÎú&Ç»a¹a&¯wC(Ä Ñ›¢VÝ’o (ƒà “lYËÒýõxŠå†aJšÿ’kÖ®ìuÌ·ä Ë®Ì1zéIP I!_³gOŸì`ë/ ÏwÃ0%LpM”H AAUMÝ·]…³ Y4PU¹$¸t­:´†±±#º!²wÃ0Ìÿãdˆ„Š€(ö5L5AT%݆{KÎBˆ$Šªª9in­ ÖíìL®€Y«¸rî&ËK,|Á€¿[4YVPÒ ¤(*ètº"÷­) « ×?êѳ÷Œš¢è$Ý㟅7ûÕô'ý-ºúŸZIµ‚`Ðý‰—¯* ¨€‚ ¢$¡&+$étÂ#6•4›¬ˆ’N4EVHÒIBáç™}ÁŸúüǤÚdEN|B° åxÊ®.]t ! $©"Hʪð÷nH§½E³”•üGùL5¢§ŽPEÿþÜÉÿ©ŽpDL=¾fñêê_²J‘ÕétpùÊSÆîY:¬i“¾YdòÈ80úÂýÌG¾ìû[øV~÷\æ—Sz´í46A{w6jÖ¤O,Oøkk¦=¤úŸZiM0öxøР‡Ðî…îµkŒ]áÚæIõkw:/?r ïíoÖ´Á×ûî€vòíRÕÚ\I´u.ˆòšEGãÓÓ":÷í´†µ^ØñÄ{6éäîÄÕ—S.e¯À€€°;ñ—«úPI#-Sj+=?¹ô{&tÑiÚƒEyþ¶™Š…ÜÈÙW+-$­DE¯cjg{¡xëIDATÿáø¶!g"°Ð½f/SEXý‘gÎTÚHúŽ.ãän y`/.ê ]Š·à"ÓÆ WÆuõv‡á¡s’ć»f#(bsÖ-rÚÍ­[Š¶çCŒ\ z®SüS+éL`0z.Ù«÷@8숆ßd8ºö½F•Öi5ÚŒ®îSÆAE-Ú›¿­‚h2™$Q ±éüäÛ!µ=…[ Ô¨-?íÍøSPÑ׃ ½‹Š¬B.'¢5áÂÛkOøy:$„üV}\‰UÍšÞ-c²’Ĩ]ÐÎîMüÞ`Ó š¾‰®SWï! ’¤éÿ‘ã¹!D´EìŸ÷êè!CO]¸:ZED´{n§¶.ex¿AN[¸êžb_ŒH[9wðÔ5·n‡¬7¬÷ÀÖl8f—ÞC³ŸûðPdì¥öîs0áòïß¾:zàÀƒÞútmFv£¶xᥛ‰)Û>›6x`ß‘/OÝw[)¤º|gænóKÐÝ=w±]%ׄ°›é}ËœÛÝZCíÚТ+l¹‘KbÐ'À˜g¡Nôžiµ¦!ØîÁ¤P§&´í ’P‘ÒÙOª4ìë2vhŸõçÌTÀí9áÇÅ3G é;â•7÷‡¥böšv¶ˆƒó^5hPÿѧï@",ÊJq{¿øÒÛf)rRÿ¾ï‰±¯(UÀJðÈÕ•MS‡ o"n¥ý« E Ôl ßž1÷Cjƒ÷'AýZP§ ,ÚœµfÓCP÷€—ê@ðìû¡‡U)—ž—P­«?ª±s^èöζØïX%î‹wÆ8`Ò;_ܳés¶kW¿é5ôÕÛ©6D„¤³‹g¾2xPÿa£_þrËqL=·cÐàI÷ÄÄéûÏØrÎnŠ£?}#ï{|^—AqBÕfÅ4M%T)ÚóCÌB h¤öNCzV‚ ‰*¡öO-ÒPÖÇ{§¾êöÚ‡JÁíZØίy¾ËK1fѶev÷1n)×´{ßÞàò†ö­‡œMB!.6êÄŽåïýÑwÜ´Ýý7¼=ò#IPíÙ‘>î’[©€!#_ªéJ><ôíïÜ;õ}®]JÈê–ݧFÊ@€×._ü`ìK!B“ɯN pº5¥G糩yªû;YÌV•ÌÁSW5.c2Ôè¶åÓ®×~‚ÀžÕ`Ôh¨!@OX{.ûŒR N ¤úÃÀº¼@  à]¨Qö߃ރ t Ôõ€mÑ@æ –V1 sËWÖÍoiãÍf³¢ŒóbgìòmhBö<¦to·ìh, F_Ô}B¤Ñ¿WŸ¾õ=ÓŒzvÉỈP”•<Ú÷iSÖjqé9rL—*.jVzÄê$[3ÍV€2ò[éÊwÐþEð ‚ Cá›—áÛhÐ ˜í}à“ýÐ{ lï<­f€ö¿öî<®ŠªáøïÌ]€Ë¢,¢(î‰j.¸ î¦I¢¹£–ešùè›i™¹=ödeei.%©i¥••¹ä–¦¡†OâŠ(Š fŠ¨a.w›óþq/ûUé-žzß÷÷ý‡Ï;gîÜ3g~3÷Ì  ÁKã`ÄTLê:feìƒ5”-6¾ïè+4å›m²Â±êƼÝ??i‰ŽÔ¦úå—§Ï/yÏtã̹‹f»T³’bºÆ1Õ|$n`–;Ž{"áˆOã6Ãcš }F=Õ¿E pݤîÏ.ÛÛ8êáþýºÛÎlŒ8ý¦rï\=uàã9ïïïûÔ´g†F$.}~Ú–‹BX.°å’µc¯Þ´çŸîÞå«S9âjâòÎ}&^õ<¸°ùìر{3-Žä°[ÌfY?§>›»êNè¬á‘›ZæÊQaÉb«º½N/¼TÅœiÊRTaј?þež›YE´‘=z>RÔ‡)„ ´ 4âÏ`ï¯!\J)—<ñ`ç¿+ùÔȨ¨'nYÏlŠê±jï/Îé9éqÑíž_¸]•òµÉÝ{ö~úFÑÊ+§tèôä&)¥´çÏÝkø¤UV)Mi[;wŒXµÏY\ý-­϶³VVU)¯nhÕªíìMÇ#Y_ÞÕ)2b;k¥‹;†æ¶˜ÍV›Zf]Îm“‹¾*ù­ ¼*¥”'J@®IuN¿¸JBÈ­©RJù¯éÝUZT)¥TM2&Tö™ªÚJ/YU¥Tív³Ùl³«åÆl¾²zTX¯q7­Žâæž2lÊ"³”‹G·ì<®d$ï}K¶‰ü‡cðó»ÕRÖ¿_iÕ2þŠ”òµT¹âRª6‹Ùlµd^¦–b Cg­Zž¬éó˜”R®"Q_^5:ß9±HÂM&9ÿ>+yÀ¨V¬óò›ÃùÆÍoµŽì±ÿ‚sXñ3[ÞéÔ1⣽W¥”¶co4m{î¶å⎥‘»/yüNæ™äÓ×T)Íéïµ }ô¬³áåý°íËÄcÎofþõT\Dã·ŽX¤”ëç÷ŽìðØù¢qÌw¾ÚýÁÁI)ϼûHx¿ÙùE ôÕ1ã|®Ê—µˆ±§x£¬y¹Wça f)¥TíV‹ÙbQUU•RšR{°ýg—íRÊý>¾)C–ªU‹ÕVu»ÝÏyé/^‰{ç i“«/ÏšviðK—âV_{MµÛT»TeU}ô_}eJ¸œ|<·íòNνšæŸ< eÓE ]؃ÁÎA·|jGxyý”™ôju«ßË_ë<92ø{ÉÌl+ “%!|þlº ¨…W“’.Ð(æ:ZÃ¥KG€RãÞ¡qmÇi½âí Àl6AV/7¬N¯/·®„”é‹œm˜;·nCQp ð-(šÍ½ê9¯à4Š$Î^G¿ðÅEt ãwì:ƒ’»«ŠkE_æCÌ;¿¿V'<º†RB?þÝ/Æ@Fò‰¼ˆ%ÑJÑybý6}Ý?L8yÑ~pYK厘w¯¥v•)N¯)YûRµ„_±˜U´j^Û¯«ðõÔöÀ‘Dœ ÷ÌHû‘uŠ~m![j¡å7‡óÔs×=¼<ƒƒ¼E›„…V8óWƒC[Ö°/í¥¹ƒîÒ¢e«fõB#‚Ê÷ÂH­W·¾Ñ·íZqðj®ÉªZóŒB“§ÐAµ¡nL}7ç7ñ®éƒüÛöo¿ËjÜ%Ìàìmñ™¹n¦¤Ï¯ë–|èG»”€ÆæÕÌž±íŠõétBÑêôÎßÆ9KÆ?é3æ_Ãê+¸{­V‘Ï@ü¦Xl·Î[SRqZ/ܼ5¾ÃkO€ª‘ŠMQµU2‚çßàB¸Ìý­Ð­©§âh²Å¿`Mf“„§Á E¿k<5Fs¾£'ThÝKø–.: Ì…bíü)¥‡ú°_3Z¡”iͨô½KB`óxÄ% fFvCuì]^ª°:MÑKô€Ñ X‘#ÑгhÐùßû‘¶¬|éä^¾¸ÌË)t ­¦uÆ  wóÔjŒw ¿?\K•(~Où°>î%ß²Nu¨ȳ#óõ/Õ uøÍô?k>9fâ¥×@ @kp«ø{]_¿Ëæ¶,œ9cñ»¤Ý¢«Þzé§Ëšû»—Ù¨–¬I±ƒ«ñ£â[‡ûÃtëà– %Hë¡”Ù^BÀœ•¯x{¸9'WŽ=¯Px¦~ø eŽ[†\ +©ä”Ë>»ØôÓ16›M«ÕªRHÕ¨Rþ®“I7x*v­Ic[þwo½PÝÆÕ«·yC£*R Šn øÄð ô,¼žm,@u@¹9e³•¾AS_¿š²· ¿ü㸢º¿¡ðz¶ð¤€0æØlÞ~ž•ý&UYK耜’oy:J0 à§E³nHÛ÷§|ŒÁÍ®æYl€Ì9ùwYÆSßÝ0Õ^påbú¦g2w÷÷ ¼K½Ÿ™šxâWã”õ‰ÃšjØòÎ-/s]¨â…EÕÔ3¹ùåßÔúìyQ+Rf†¹è¦,~‘¸s}®ÑctÏvªãäJõ— †µý0rÿ¶ÅžU¿ËA(ZU“ï~Û «&¬= Ô–P…T !)áýgû«»Š%€àˆˆ€£m4;b_MÚ´þ‹û®…‡‡(Ò~òè%G¯•šq8÷NX£ˆûÿ8“ªš„5ÓHkRâùâcΖϾ<Õå^õ hké »Ó¶¼1ÿj—á/¾ýxØ3sƤŠk[WŸò÷ßvOè1 ¤rÅ; ™Ñ£AÖ ƒ‡xMøvÁ£5ÊÎW“ëaúpäLÃo‡pÀŒÙMðÊ'X‚P˜ÕßÄ£…>XŸžèS·`MM4 Eÿ¤ïÆ¡,|ŸŠ wØæ\:ðôÍ‹·mT»2¹  ã·?19½wD£‹ÿÞ½+9oöÇÏùܳÊÝýC|”ÿ|a^‹®#žíýöãë+ÖRÓÊoôÕsƒ?óºõõ'\ÌúÞ'…ö§Ñµ ¾Ù‚A-°Þð®Z‡!~ªåb]r»c˜ûeÜ—‡Æ‰Ç7¿3¸VéÃU`ŸÇcß[9wò˜cºŠÌÃçoš…(w¾! ªqÕ[ã’êÕ²‰ýö…;÷Ô§…2 ©Ÿ²â•)ó":ÅN{¨Á£péôi×»‡ß½ávÈøÆõSN¬¿½ñ<«ƒ² <0vYôö~#ˆîÔ:çÜþï.hç½=Ðýcò„¾OÍ9ñHt›×Söo?¿lkw‡–¼8ÿ$>MXàQ¦![¤P óGK³o˜Øïˆ/nžÓ·jñR¨BU,ŠÕ n9qs`—Дî&«¢´ùë/„ @úµthÇÊ®ÁºŸ¹Ù$zòÆmïº+R*§¬_·`‚.+%9åJË!/'mš¬“‡GF„×,^Dí:tj]W ô_Ÿýhëà7MZ®ý„µ_,z®†)ãDÊYÿvñßÞÒ¹–FÀ½V—¨Ž^EýŽ:ßÈȨz ¤¸›‡Bß ix]_­‹3²Åé˜Ù‡vÁŠ};0{F´ÀþcpA¿ÇžŽ†·qྊì=ð€„ôÃñ,Œï…Œ4ö@Úôô¯xË¡ÖÃÇ×–›o¯xý°Ú¬µ;§ÆµÏÏÌ(ô‹Xº3qlD5)¥_óI»?Šªi=’|Ô^§ã²¯wÇ…ú:îsYK¨ÖhÀsãb},ÙZw—µTùâþ ›†Ô pyÉ¡#ñÃZÔQq<onÆó£Ñ£9H=¶fbÁS¸|Ç.â™UÈÝoG ÷B.ðsyÔùy(9Y®ùHÎÛz`lt³[ìuY´ìÝž‘QµªëŸFÝ¢"<µ¢FûQ?mz·}-%-õäùlí°é ^è.¥¾13gŒ B¶]£ zóÍkÞŽ°&ÿ”>ì­53Î}v\½ê×óÌuštèÔ:¸xô­Û¶KD€6hé—ߎëÙ,û— Q·çšû75ÈÀȧíYUÓ’rℱz‹·?ß1)²¦c£xÕoÖ¸¾¶ÂnW¯m–5=Š¿•oÝ`“É\e»œ€b—Ðêudx]cÛŸw¥û~gƒ'ÂKV*3&;o .ýdSédÙ®Šx8f.éi•¢TÇkÙÏ»Ûôßý@–sþ Ý4®ÖÂ8»oÿv«÷ÆÖ*?w¹âÒ¹ö®ê¨lµT|Yf!¨¸‰â©÷)ñ{Àr´· O@ßf[fÛ”Ýr_ÎyòÒÐU/…‹{7žŠÓ]Î#!Qjr…­\¡WÍEU âF¥çÁ]7x©Å—T^qû̽°aÆþ:ËŸŒªºnQêÔ,%cVØמÒ¡蟂þ/ê*vÕ ^t›‘‹‹B%µRt+Òݖ⪸(wu¡ìKQ¾Çå‚oŸ½®/B¹Z?Ûì !³úÖr1·ëJ»[ q—÷¨ùòïSü^˹gm¸8âÞk6!„4kBúü#¼|pßí£KOwý5Ë~h…­ŒÊTì]Ú­¸ïWwùÉÅíóæ…ÛÏöéûGþÕÃ}2ߎÍFß0½ìf›â¦µý‡’€ÿï†èÿçl(þ×5¥'0nˆèÿŽÄ@DŒ"bÜ1nˆˆqCDŒV1nˆˆqCDĸ!"Æ 1nˆˆ7Dĸ!"bÜㆈ7DDŒ"bÜ1nˆˆqCDŒ""Æ 1nˆˆ7Dĸ!"Æ ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ 1nˆˆqCDĸ!"Æ ㆈ7Dĸ!"bÜㆈˆqCDŒ"bÜ1nˆˆqCDĸ!"Æ 1nˆˆ7Dĸ!"bÜㆈ7DDŒ"bÜ1nˆˆqCDŒ""Æ 1nˆˆ7Dĸ!"Æ ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ 1nˆˆqCDĸ!"Æ ㆈ7Dĸ!"bÜㆈˆqCDŒ"bÜ1nˆˆqCDĸ!"Æ 1nˆˆ7Dĸ!"bÜㆈ7DDŒ"bÜ1nˆˆqCDŒ""Æ 1nˆˆ7Dĸ!"Æ ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ ýü7¦°®bן|IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/isdataat1.png0000644000000000000000000004405013051004444021767 00000000000000‰PNG  IHDRzAöó©sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ Õ-Ë IDATxÚìwxÅ×ÇÏì­é@è=”tÒ „:H)ŠŠ4AQPQE~*MAz Ejèi¤÷ܶ»sÞ?nR1ú*¡œÏÃÓ»wwfvÊwÏ93s—!"Aü÷TAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜArCArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜArCñË "R„y4< 7©¬Á¼ &¼>O¥µ¢¾F<ËÔ­ãºpædÅ3àiԤܬ\¹Ò¡Y@êpÄ3‹J£Ý½j®N§³±~úŸ»5)7‚ ØÚº8Ôr£>G<»r£ųbàS¨˜ ’‚ Hn‚ Hnâ „1•Jù,ܨ’Úš jIúé'­FSú ç<**ÊÞÞžä† ˆ Îù•ËWÊ8‚ X[[wëÖä† ˆÙŸbŒ•“›rGž(vCÉ A$7A$7AÜArCU@É A$7A$7AÜArCArCÉ AÄ߆v„?ÎŽîÌE(~!SÙ86 ¬SÏE–‘1ˆ ënžÚ%*\[DÀ¤Ä3; Ѿ¹X²¥X0\ÿóð{ߘ.­ƒ; APã&*¾Ù*Ð']N¾§×˜ µ®ÓªŽ»»’"%†Ë¿±#!>ßÅgˆ‹½Š÷-ëRÏÝ»z½øõa‚ÚÆÕ¾¡k];ÙÀ¨=In¨ [3ÜøùÓxIaoï ˆÆÂÌÑÀÿ¾sû¦²„Œ1CúñÓ›Þ×˵lÚ„Ö·V"(ÙŸ¿¬9 ¨·­¹›=©„xqíÜÓ šC€¥_þáCˆ^Ø´i#¹´Þ c õ—׌:vâ¶R¥P[9ðÂl eÁªmÏ9«¬ÕE‰1¦Påœýbæ=£E½×Ný:—hIaÂÁS?l´pm¦¸¬Ï,ÈËGn²ó~¥× £•© Aró¸ƒvmŸ0~¬Y˜,Åm›vhÝð[-5vfL©?[Íõ“ùùüБí¸ÖÁs#.;ôñ‚Z,³E1u÷…ØK-'ì·Ö*ªÌ˜ ‚øMcNm7ñkvžZ5@~|ìéo&oYðbÌ;_;«‹$CwjÅMðè {Ïïiß¿³KlDɦý››Ü,p“!íòö?VÎÙú¹Ð÷•Q ™ ŠÝ¹ÞpI2lÙ¢¤lЮ¿Ê— úó§¤{t­ë?ÈphAš¢l‚æ–ÚË¿ÿé S Ù§>š~ ÂCÝ ê·$3BÖžƒ;/5³: ÐS(™@2¢ÖÕ7d kÓÙs;ÿ@D4žßܾ^pƒÞ3lïí»œ, e-YÙ’ dÔ8µÜá…©º«^»’Ï€ÞÑLrCÄž……ƒ…C)s¨èKm­¦Å!›2ÒÁ4NŽnN*g{ çò‰òâ” ŠÝPArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7A¸`}|Xä£ÉÑíÌ©Ð÷'šò¤É Vð˜|(’âï£0T†G•—‰ìâ €& ‚ ¹!‚ä† ‚äæ Q–%é¿xrI–å”."ç’(Ëÿ¨lÕ»)ä¢,Ëk„K"ç:&¹!þ]È—_ÿlâ°Â}p) ë@ŸÏ§-æÚ 6Œ©àÎwƒ×¾à³ñÝYFþ÷S¸·ðóq½³òÃÎQÂíï>± Ê•0/ö뱎¼I½ã©f¦…Ý‚Ìüºí"‹±Ü‹áÌʯV©5Œ1VrZù—O%Vöœ cÀ„"!c ­J­‚Šg!0ÆŠN«¤TŒ)…œ;'.Ö~ñÀÀÎõt…N(¾Xq1ŠŽó²7&¨•-«xSv( ŠÐl̹i $}é—ß!Øû½ø}—@–i?É Q]‡„)Tp{×âKgbEYa×"*dÀ­PQI@ õì×óî%çZ× 6ÉNÉÊÛ †iGþðMzV¾UƒϽXþD¦`¹ç7œØ»Sg²hÖçÝ V™S±Â¸'wlÊÉm…|ÉVËJ•ŠqSú¯KƤ0ØõÒúÃm{N_¨J’b •éêæ¹×®ÞQ;?ÿòÕµ/È §†F{WÈŒ)Ô¦+›ß¼w_ãØÆoÄ\W›Ò§0¦„¤ÝOÜêÞïå^`,eïÜøùó¹u;/õô©K½ˆœ)¢zU,ƾt`ïéZ>½ÜC"¥6Ì›¯WTòÊl…qxîÐ\ Ïæ~!Ækkw,œn”±Ô–D`ú»;ÖÍšœ£lظ]GEò?N–[(²2âÆ â¾ÝòéRp iÑ%c÷´?.è¡‚l1Lß7ëû÷‚[D›ÈÞêÌÛß‘ª/S*¦°qn-­=úµëÚKUòª_Dž~¯ãÑ#qn~ýêºfþ6wàÝ[W +q·…îì’þ‰ÆÆÍýÃ1yÏžwÇëE,çHšroe¦f—ïŒ\Ÿ§+¤ dÝÕ·nDÉ>|ztк jƒ¦žmzkÌõÛoy7ª õù‰V“µocÇ9´ñÐ~5÷›øŒ‚–®6¼X"5ÜÜú6ó\ØcR/AÑ%rÇÔçã. dL ñÛ?÷9Ñ/ DZwìùÇÔ ¤r2®O8úË/õ{}ÙÛ‹´é#/é|ôÛí}^Œ°Ä’ÒÖ÷ë|Y1šF4óm$•¼ê›1SÊÅëñy­‡ýÏ?Ð Øfžßnùà½Ê7q¦hcö‡¶qâZºå½òp~¡ÁBcAƒä†ø"7*»fíoüñËé“I&£ÈÙ&Á¢Üè”Õ[7·ã˜ªag¶4>¹ U΋¬’®æºŽRÊ "JÐ<æ‹#hùô­KAi ·ôµ†û*9˜8Ø4 ¨wñtyƒBÌ¿¦Ëímó.2Û*UCò~QŽÑÅ'U ä!ÿ®dT9»»pÐÖédm³¤Òûçêú-Ý”ÆÅ$“(ËŒö*ÜÿL0ÜÛ6s`†EÏÎCê:;`ÁÝ„³{*}ª¬50°Ðh$Q,=ê™\ 7ªœ´ ` A2”WÆuzƒÊF«B`€T¶Ö7©s©€+,â·¿‘X2ð¦rp’åjyز¨ãh­QåÎJA­ªÂ™T eŠHa_’â?#;n¦ ÃÞØÔ¢ €)M˪z´‹…&™€ `^¯r°T— T8ØX rô¬ØnEZ$(eD¬Ž"JKå›$óÊ@Yä&‘Úšø‹nCUð_#Ë VcˆÀbäÀ ü¶Âtçòõt…’1Œq»2®ÜŠ=)@ààRßÓ-uï:¦`JŒûqhýÇo¨J…fdæR¯™eÆ‘C&˜ã½K§³Ê‡ŠÔÖ-­-ã÷ÿ&ŠÀ%à’tsÿæ;wóªe} XØ6P¨¥ô«I‚‚òooËÏ—©­ ²nj‡ú>[ybåÔÌ6M“NlVzLµ²½‘°ëmG§y-Ü,,šåöMåûî<SÛÞxëÈÖÍ×u´Â’5- ¹ÈšöYxzþ«[Þ¾T¯IÝÌ+ûr;Ey5¯$—š aŸ7N/Y¼mѹº j%Çž°n yaÈ,jwèßç+§nKïÙ ¡sÖå_ïÜ2ux§OõDP×önéfyá»qÆøžšÜ“÷îh5–ÔÖÉMÍ‚‚KÀ7>f(#³õðèñ`è— 3Æe°mÕ;¤UïâC#; Í KI—ˆ·pÿaá±²Zˆ²dã1úà _1&ë’ÎþfÕfl‡hóãŒy…öõê•.,"‚sŸÎ/˜ÿDûNÆvÔ—ˆ(¢ .ot 4•^m\QbZ&¹!þ†Þ” Ó²J¾b•ÿÆp%‡+ªìHµÊñ׉—˜2JÂéÞžÅ¦Õ è=ÂJmH8º*Ï:¦k€}é uéK+sç•Õ0ö †.Þ½qæQ_¨qr¦.DrC<ÓÊÁ6èÍÃN?¾yvÇRUŽmc†¼<Ñ’—1 þɃþê†ÓûÏ»D,óô°F‰,’âYÖ@Ù$4뻸ŀ¢X—ÿ¥E5ˆhÛyÙ˜.€¸ˆOÌë%’â¿s‘ƒÌ+uÿŸZÆ€CÑàÖK?V“[4ý»‡™XXîxNNŽ,Ó^½G„J­1™Œ5Ûç­U®­ºÛ¾R)hžµúW¨Ôé÷®Aãv$7ÿåÓ ñÍÙ³ß_¼X¥+£õŒ]=uX§Ó‘<šVÐjµƒÕènr'ç¶m£ºß>øZmó 6{=gµJEró_šŒ!âÌY³*}Þfee‘"²gàW™kÒ™ªª~͵Oƒð™oÏx»³gãà)TLÉ AäL=2ëšx6½*‚äæÑ!˲âQý¨8ñXØØ‚ …‚1j÷ˆâÓöö¸=OñþýûÉÉÉÔÛjµZm2™Yv6W®´ 9)I$7EpΞ²+Fæ+Q㤤À?àË/ÓûyŸv3–ª€x LZx¶ó“ÜAÜArCArCÉ A$7A$7AÜAÜArCOöúTë'ÀðožOrCD1Œ±œ# LþÜĪ³e’1Æ®n}Øô-üaçÿ?%éÉS4’‚¨žâ(4–êêïì*L»~1.õ¡jÁÄœ›‘>}ãÙ?ÙõÀtñÇÚyHeO̦q%u#‚¨Žwd¶j•Ê–tos©Bþé'6ŒšþÅÀÙ«FE6W)× ž<€É¦ûÓ_œœé?ûê.Öj• 4¾í“ÿdV2…Š âï¨@aNj¶AS§~Óö½F²ñЄõµÔµ›8¯ÇeAñœTÜɤ"Çpýü 9fÆ(7;k+KxõÏT¡”ïSôÇõ·QíÝÕ×ÎÆÚÊÊ27ó¦Ä1…\píF"ļ2ÐÕÁÎÊÊÒÂøç­l•×I$¹!ˆ§OnÄ対0~úÇrñ‘Ìü\•M=«Ð^m㿘}Õ ûÈ'+®E’¢r­cg84 óÞ³ ÀÙ:'9˜B%3rÀÅÖ–c^JªÄƒôCï/ù¦Ï7(5®NÖ†K§3¤”Y#Þ5Ø[æÞÏ/ºÜ^ð¤¼ã€ä† ªçF‰º¼=ÕŒ…3›J‡Â‚ƒºtéØ>Ìÿ¼ýÉT @çÑK¢< †ztî9á{þÖÔVù9y2(ŽyeôÝe‘»E÷îÿ‚ë¤ÕsG´¿¿aø¸•ûjµìÕ¶nÂßaŸ_hÙkp_¿z¯ éÝ«[Ÿi['®ÙTÏrÙøΟÝm:n\ÿ“óC£»G÷2ÕcÞæ—cÚ]]ÙʦØf=Ø]ééé;vÝí'"TL/~!ˆjhMÉ":¬|Ñ]Åe~¥¾«rÚK½€¢Ü:½ªC×.zÈå$7A<Ó3EÉ A$7A$7AÜArCU@É A$7A$7AÜArCArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A<|,þ„€¥“Üñÿ†1@LÈ%Î9Ù€G#Ã'IpHnâñ¶m˜UJ£„˜§0ý°~ýÍEÓ°'è^”Ôœñ˜ë gÈ(‘0ÝÉô-' v*² L ̨!¹!âßó¦8ÀÏHl½ù•dab*¥J®ÅM…&P¨Ÿ$ã†ä† û2`€ˆ 0D`Ìü-ئ»+¯)¡¥AÉGÔK¦îΣU(ŸöDè&"Rs?¬”;‚È*iÝR'bµš¿ÂYˆ•¦\rbu.I§ª$m•á¿3J%S­ÿn½Õl7C.3ŒŒ«…€€ rDIâúÄyÉr"ãܤÕ\ÕBðÒàe%X 柜ðÍS*.‘ͦŸø ,-Æòw _6y¶.}Ï€Ž½¶$«¾ Öæ¨f×f,kîà~SVí.¼ºªw§!'õ¬ª”YÊýúõÝ›QÝ„‹Ý0¦Û‹›°ª$KÝä?}Ö<¨®òã€ëáè^ظ¶üé` þ'c†Ô)cz½»áVY¥‘±´ãýû÷Ù~:ýñö3¢Ì4HrA$”WÞ|ý$pf•Ðý&×]<´þë*´`ˆÈá“äM=%rƒÀÓO =/ý“ç9ãbz¿vQq†¨½£eöý .Xk˜^Ï«7(CBdª§ÂÉE›“•§PÛr³M9Qcïååål£ªþíóS’RóZWlãÐ6ëÏ&þ³¡ˆÀ nþæë5:­Üõ ˜6o€dZ¶[¾û îäWSñ/\NOMÊÌ3=¤Tbþ(ŸÞwͨ¶óòôr±U=XV°éËòœ0 DuášäùéÚA6¡¬ S÷×p¶‹ª‰fPìæÿ篘—1UðY*÷ ŠÓŸ·²­TB."0¨Ê»`XðgºÞZYÎüfŠƒ¿:pJáÖ'ªa}U¥®r­UQBEnyÙ ì&Oö}óWKmÃÈ&M7°¨Ê_Ctð˜7Ï£d$²Ê|°*ý÷ŠŽDQâ‰û®ZtW+«v€U↷BFÚ •…UÅÞsf'Hõá¹hðÛÀu€6U ŠÒ•ÉsV‰Ÿ ì¯4dÀL¹— å¢R¡}ë·æ½]ÁÉ|¨Û[\›%õQ…ïüïÛ7ùXp(o{¾ÑbT½‰L…rõ÷îYÜÔJh2ؾÜjV]©µ M*®Až,¡yL¬–}î»ç{…„†…ù·í>têñ ™272½k˜wÞ½ºDõùò¡[ÙŒ18¿ oïýkçŒõü‹ã†…†…ÍXºÍÄXá­c#†ÌÈ·Î=dà¬ÿ`Ì°qéô®þ=ûôìøÜ”ù·sEóc}íL¿·2{Ü‹Ç ïÒcÌ)†ÂsÛšo²ºÿú óöÞ`LZÓ¦yÿ9pótz—_±€t½]¸¯µÀ`Õ°d`ëÖ °i oØÀ¸iSLŒ±¤ß™0€çÇöë÷é%é&4ó ¾œ..çAó&%„BSW`XuèД3²[Ëçfÿo`Ç A³ŒPpcñ«#BÃÂbb¢ƒüB'¿¿QbåÝâõbÂBC{vïìï2ñÝoLÀ²¯:a ×Þ}yà€wÜg)û¼<Ûl8ž¾ëUo÷þŸ2föêS†¹Zs»ypÕðnºvëÕ98ªïÈM'RdŒaòwë>Ÿß}D¡/5J‡xãq³+eÕ¼ÉÚ« Y!£õ„&3ëÊî¨ä*T!“©ÓÇ=æQcpÄü3=<¼__Â|`ÍkíÛuYxÿð[~mB~¸m>lúrx°×ÀwDD¼¾´m›6§í0qçû7½#º]I3""&­ñmÙí ""Æí™è¾ë®ù¬Œù=}:½ùƒùÃ÷‹º…øþt!ÇüñÓ-ÂfDDSÜÇÞ­û]ò­Ã;·¾Pº¤EdíF°Ä¯O}\ØÁóu)ØDƒj7L– çQ 8d"¢î €£—]2¦. =xÙ„9GDãÉ]ÿûíJNùZJÜ°éX "?»hp»~/ꋾ0Îy¾ã¨EÇqÛ’˜ ‘wdDDñÒ×Am½ú­âˆ†«…xuÞ™a>?ofðþ3?ED4íäðÓå4ó›?Ù¥Û‹E ~ïÖ²õ»gs1óÔ;¡>Ý~Ï7‘2)ÂćEÕxéç×ý&›Ëš~õä–{s ²! ׬ÄóñøÛ6üb®ü¯$ÿU0å½ø\XH§¡—óÌä/§ˆè9ú¾Ñ|‹ç‡6µþ"baÒî>¯­¸À¿]4<ºçK™æ4òtmÑzñùD̉]äí1¬(ϤÁAþþHÏŽÛÖ*`WQ%`^ì»^­û\BÄŒZ´³óžùøî÷ÆDÅÄçIˆˆ\wxÇæ#7 ÙPÐ4#.fö¡ˆˆ2¿!žžz+æÍ;C¦_©ˆrq?áe^ª?>YÔ¨uÃàæ¾éö6âÌVúss7®]6X òÏŸl±î;c@cs0R5æ½IÚs?ïΗ¹Ó¢ÌÏ»FÍÄ}F¡P”¡$€içg]Æ.ïÞМӬO^ÎÙ²î²ùy€8öŒò´3 Ú´oZpíŠ Š2ŠE,4 ïÑ;ܳ$¦úàg ¹ið¼?HÈ/€VÁé/ ÏC ‚Æ¢=á@8ù;p€×&…L—Ÿ?æ1 J'ÌÕÝF¶²{HøB’$S~Εtó êy+w¯™w|ç…†ßn$"(Û'rƶ÷™W…•2‚Dn.Êþ7ø§ÇÎ#G먅JynN÷I XA.ò?˜2ö|“ù{¾ék!0•Zø¨gó£ðó´_&uÞsl½“”Õ‘—CfÉ @¨4À¨-,=«m‰R5Œ)JšŽåÎ3WŒm,s^R£‚ÀPÒ¹‹§L¸ÜráÞu½µSªÙÝ[œ}h'8®ýÂá{îJpè„AåàÛÀ¤À¶±ÿ’Å3TÔTÖ53]ÂÁVí Ç¼_âW_PÄZpeCeë˜z£9Ê(pªÃ'Vd›Pq7g“˜Ÿ‘ebˆ,7áÏï¿û.\‚šÃµs À€œ|"ÙX/¨á_Jùiä؜߸–oíàììììäìâìl«µ±·TT£Û—ŒÅŠÆôùÛ`Û"ÝÁB Z Ü8÷@dî/žò %ÔÍ@ P» €Wò€Av,zrY­Á2™V¥6yi÷Òò•¶öÎ>‘Þ_»lû¦6}j·¦ÎÆ+—2J„ôê‰dÆ@·çt¡wŽl,ÔjµRÐÿgT)*˜QÒó7 çkCìµZ-c'*c¿ž5?×ÓÍR£V«õóu®T”™O/£ý Ô6  ;ÃìdèÀBU´D¶Ê*-3ëß´ž‹ñöM££“‹“³³“‹‹µ…ÖÚÉI%”j"ñÆÅ[ÐóÕvZF­VΞJV”ªL¡’Aéþ|?‡›ëÎçœ9ù³mØëîV  la™‘™gãââìììäââìâ( ÚV«,]ÂGåL! Ôq®ÇÏÁ!+“¥…¨Ro ã ³ŸÅ<ZSãrƒ ¢º46.[·c ~÷ÁKË¿O°ˆž6÷¼·ö’€§-zå«®C:Z?Ln˜R£s“ó@ˆziŒaëëÎç"câÖ7º ^fzhƒ1¥Vaʼ¯7#~mÏ÷vŸ¬d¡œ›èS!AŒÁ¥UðÎV€Ì¦‚#ë!±ƒ¬ãðËU0ÀJ Þ,S:À‚Ó`WÖLcŒ1ãï›Vï8ŸU¥úO^?aƇz™#"—t Y–NMX…ôöIürúÅ<àI{Þý궊1°ô®Ën^¼ežºŽýá㻂hÊ)A¡Rq)5O tkèl<½ï ){ÁØäº69÷2¼Üøå“qæÒøòà •>=ß\hA©ô)Ù1åÂïë¾ÿ)ÛÀAQmàʸ[ŒAÎ=¸“ nÍ1`Œ_½pÉæ“ìaþ ‚Â%,,äòד®g›0†™ Ç„wu–ögUn œŒ§÷ß4fÌ{þîf.0J˜žj*'`Ù}L‡C«×î?lÿZGsûMçzãß^0;¿q[æuˆr>EÇcX¸ç»U{¯ä?ª™)&+$We=“BÔ—Xáèz3ìÁŒ¡ýÒð§sfÊ<±póÀ´a<=½|=[œüÎål‘#—Žüoi¿Ží:D†‡¿ðæÇ73 ˆˆWÞ©Ý´ýÅ,CÑÅwVÕoê»ÿF""Ïœ?$¸ykÏs~D4Øð~Lß°ˆÐ`ßA“\¸_`žúfv@Û^«¥âÜ÷ܾIû÷ ˆ²!qjŒoóÖž}ß?ˆ(¯êÕªiß7+L¤pÔÝÂn­íì±Ë‹˜p0I@+Àáë0¨%Ú¨G,~0÷tg†52O.£w?¼™WvºËLö$o‡îK/—Ï4~g«Vîë%#¢”röÝWúFD‡Ž™¹ôZ."¢13îÝI}¼=Z…‡†ž½î—¯4êðˆhJ><9&Ð3(¬KtôÌ?wv÷k58ÎÀ˜Õǽ•{‡A¯äŠxa×'Ýš‡DDôì?lãé´?·Îölé>샭ƻ{Çtõñ ïÚ­ûÛënoîèÕ¼CŸñ zÌ»w|@˜»{kqîœøhBc¯ÀKi¢ùŽ®ŸÄ5+ð³ÏpÅ-ï9$¹!ˆµn¢€²bóŠ €ãSô¶)’‚¨Qëg€ …¤’„¿‰qL(3‰áSóÂp%µ7AÔ¸…#sÁ 1Æ•Å& ®B•€OÍ{ãɺ!ˆ•@Æ™(èAÖsPX¬6ÈD&ƒhTŠÀŸŠä† jÖ™bL‰…ï}œñÒ$ %n“ €ðë¯pú OKü†ÞN5kݤ¥å¶ð4䦺ÆßÀúͲ{÷½¼Yƒ&uÿ<#s¦È™"âÿkÝ€”«2åX2mêÄ €@61~ᬵ\ \:/0²n‚ø73²LͨòLùZ­õ­›‚£­B­MnÜÐ1>±€3GÔ1P?zCÖ AÔ¬7…‚³cn­º¨”´ú|ÃÎ]’Z›öÅû.wSÔ fåÝAÍ?÷JrC5ª6Œ€ý¢Å…&Tª˜ðÕ*£ðñ— 2ÊÆ>½d Pñ3ÑXùG²JéR'Vo‰D…³*M¹äÄê&\’NUI>â:ûwŠQêî«U·Þj־ጠi®u2“õ2X®ûN7þE­X˜%0Ç{ BmG%hžÃੱnJdóŸé'>HK‹±¼wíÇo/]eÈ>1û忧™ª7 L90±¬¹\Í®ÍXÞª¹o~´ý¸áÞö™SÞºldU¥Ì².¼ñæÇ®çT7aÆ®ï]ôú’ýXU’¥nòŸ>kTW…„HÙ¿|»|öŒ×f½ùö‡®cŒýÿiŒ³>Z4}ÝÞ{Ù@ô ñXö¥ÙoÎúãjöãf•9HFQûú&(•*Uá„Ô¦#rõkÓUnu8(h‹æãe†0ÆL/EFœ—þɃq){PP׸ C4=þêÑã±²˜{ìh¢®jZ6Â/[á|zµó”î]9{æz"×Ý?zðh¦\õ‰bÁ;wòôrõo'ëö‘}Çï<´®Ø–¼ÖŸMügCéîöóy>­ÜõŒ1Èzó¹®K<âаUËœ53ú _¸M®Þ*ü"­¨Jeé£.ÜÊ}¸ÖÞûúù¨‘+DÆ@*¼sçN®Nzü{¯‚1A-h»v1ÈJAe4¨Õ([hí§MF™+QOË2?eÍ E…º4ï¸/?î*7Ê‹œ›7Ó,l”U¸<ˆÀ *³ž0¼‘V`eSÖüFP ŸÒ{ëèß V·ýèb¯¬´ÀUŽ¥¢„•½ç/î1s‡Â²ù0÷3u,$\¶ðˆ®¡›¾-yt³Ê|0(ë/`Õ>[qÅæî» Š¶µ­ÚADV‰RÜ …¹wU›ŠJ÷ËœŸZýúǺ†*€ç¼ bÑwñ¯÷jl©¨Ê)É›±ª\IJ&Me'ùlG/89Ø©À%pã÷›+æU:ÇÊû @ÉÑ*|çûQiÎÒËGQ¿2é–€L2¡¡w{'g.0PƒÂÓ¡85nÝ0]üÑÙcºµóóöõö1í£[œ2à'¶-ÐÙ/<"440pÄ´®fècxö-7¯žg®Ÿ<¢¯Â:/ûá¬ÌXÁµÝ#GçØdíÔaüÚCŒIÇ·|:(*0¼}hP`è”÷ק¸ù±þÕëÞ>÷lù|Ö~Ý£B¼ºŒ˜y-WÌ=¾1²ÓdƒuâÐÈöS¶]aLZÝ»u³þ³ƒ.´2É ² šØ*øXcÀ4m'Òt…ì8hï ŒÁè%EZ ’BTË¢KBGB‚€ŸÜv)"²£© Þ1¬_s`9ÛZµïRÙþÍX®V­Ý¿=|Ÿ1Æxú÷‹_nê8åÝõéœ1^˜¸bæPÏÈÈNmÎäÊâÌo|¯W˜oHh`¿ÿÈéÞÈ’‘çOëÓ1V%,ףߤ¹™É¹w¾˜;&"Ð7,4 ]PÇ_ïÍö÷¬y«[ˆOhXP ูŸ'äsÆؽo¦öœ¸\€Ña¡ïÄêO-›ÐÔ'èrº…©™hWËMU4nk5­…:]!LJØ#»°®Wôñ­ïEz7ë<ç,cPbþ¸ÞAAA¾Ý†¼´÷Rf¹!/çÜZ1{tx _Xh@»àNï¬Û/cŒí5ìããwϬˆ ë°ïüïmÚ´üú·û¦Ì+]¼ëLýbƒäms{ŸNÒ1®?øÝ’>ÂÛ‡FÌüôÇ|Ù\¦äÁ-­b>¿û(B_̼GAdÉI9©w˜¬%—åËõ‚¸Yþž¢˜GÍÁÑteˆ¿ßøå»9e^¸ll@pßezÄŒsË‚[{y&WE”Ò÷ö ó "âµ¥m=<ÚOX§C”$ñüê×ü:ô¼žaBDñÖ¾îÑç Èïý8ÔÓ÷ÛsÙ&QDÝWÚ·Y¼Ûœå÷ïv \wøž,Iˆùïõh5ÿ"æ^üлußke™#Ê—^ÿõÏG‘˲Ì9—e™sä9{ïBÙ„"Ç©PhŠ:D] 6Ñ Ê /¤¢(aâ^ÀI‡Å»h§Á˜9h2"±·5ÚCÄ¢9—9GDDÃþoWüt&£|%%î Øt,/}4Ò¯×ó÷ó ¢( S&Åø ^x ÷®è×ç\6ESú¡¥þ¾^^ýVqDãµ|š¶ûö¦A–D©0aRTè°·V#rÌ9ØÑ3àûØx”%DÜôÞàÐ!7òdQ”¤„-‘-¼–_.@ÄÌÓ ½›oMDQäy×FûOøl"rij?½ê01Qâ<9vÿêõ›2u2"bî¡n­Ú,9–ƒˆˆâ·/õl?|š^âë7>iëé×yøÇ™2šDÅËC}½†}¸KFY¥ƒ+§‡·?"caÒî>¯­¸À×/>ìv¾,Š’xï‡-¼W\Ó!"7åÏÕyÈäUzIâI‚ƒü7NF®dÞãdäÈ‘KŸ¼ÓmÐüÄØ­o‡ø＞'Š"\ä>dåDDžÿóÚÏvý™ûˆ†Œ(‹9cÆšTL”&d`z–£,K\–9>%Ô¬Üà½KÛ……Ÿ¹/#ç1ãnì[wç#næüÚÿ9/’’¦¡ûò¯/uo¾û¾‘#"Þøª_äwr‘ßýÒ×=ú¢ˆˆòÊ-;¿w¼$ýå¼Ú ¸Q$7Q!¦e%Œ>éêÝû ±ðòRïÖýÌçðâæ圗oiS>Æ' "¢„F#nÿðŠˆºl¬À¯=¸¾—;ÖíŠ⑯O‹Ž§_ÄåkP_®ÇñÒ™V!7òá¹}Ûõs3¯èCAA” çvjÔge\IÎ_ mëÙwG”tYÉ©ùˆˆ’(¡|bf”ÿ¨¹2"æêè°ù|’9üì”´Žˆ’É„(/‰nØÿ«ˆ(f$§""—Dñ·‰Á/¯0_r~ëk~“Ò‹š¡ÌMÜ>øyDë&á:u õ Œy"Åü`yˆÜ,oÕ&ð»›yˆ9¿±qŽO‡nwu%_ßîçßnéÏP÷@nò³RÒr9"Š&GqQ—¿¹ˆ(ëÞÝyÈKkDD,‘ÄŒ3Z‡¸W "¢lº?2¬Ù´YˆÆ÷z4íýÙõ5}èmoŸQ ¥J[±ýÿe¡)~Œ·lËÈU+õJ0)™pê4ÔË…œ£,ãÓ¢75»¹•˜®QÚÙÛ æà†SCŸþ  ýÄ p®Å«µýëh?<›•€ÛZVçP+r™—‹à&Ÿº%ÈÊÕÓ§n”˜lÊÐÀ­3)Ь6r¨åiS)…ZŸI.oá— }–sìUÖpåsh1 ŒÅ5%ÀehYt=rpuéîßPCu‘Ïåì/{TâT@™–ò|ÃgÏóéö°m]=¢† Ö-ÌÓN©HŠKQ·ñr-)y³vuð0€ ±¼°~Π/÷ÉZµÀ"j[/ãB#ÓbÎòY/ì8›¬P)cÜd[[”@PiŽ®ŸöÑwGQ«1_®öÊa¯27‘ùûk¯ì1ù‹÷_ì¢Î¹ñîKgN™úówKm”óPmïn«4ÿöËå»Ùj9ïýY¯h… 2¼|?ç’ó5˜õñ´1;ÏÝ/)p]ña¡t§üÞì½éjÎŒvή>_¼«‡ÀÍ‹‰JÝ©¦ßR™û‰±à¾Jºw9 ê9þe[üKaKs¼J6¥Ÿè¢d\CýFÊ„x …BûÇ>Q˜¥æŽ²<%Á›–|++6FΡÌ>&Œ‹rIy^õÈe¨Ôm¿k‘06è9h`÷/ÌÆÂŽy³>Û1> UÕ0d΃›QjJ‰C±•™jypæîö÷_×—{\¿rõòùã¿|>yÙÛÖ#ÞÙ<%%ΔBy`§>2m§Õ§ßnm[ÛN£Uý¹ ÿ«ÉXA.ô‹' Ù«±vËPWk­ÚJ±¢¯×Iø}aÿ·6þrÓÏ-œm4êÓ:½õócÒæYósBÆo›ÔÀ±ùüo÷òxþ««¯zØ<¼bKä•Çn}9*¹¹¾únéÖ¸X\bÝ»ãž;h3ú›-CjÙhÕÂ'}¼ÎÿEÕ56´Þ¼Ï~ñÍЭþÜü¹ÙõP– IDÌÀVV"/*Æ°QÐÔêQM¦p@4=fŸ›«@&¢¤Yº(cü˪œBvú;MájÔ<-¿wSÃrÓ°–£(åeçJL«@Æ 9)×oßoéëéÓ7\OâÙ)ãÏTƒ«w]€jM4×ö®/ï•ëúO-HF‘iTøW:U~j¨’jÏmÓ´ŒAVâõS0H8Фe€¦¨\˜à–œ4ÀèÒáÄŸÜ,*Ϋ[61rfCãÛ¹`k¾Ã;±ÉŒ€îÇÝIžýgE¶iŒˆŒÎ&HJUi3Ê,×N\Ðõþyj«úæ\⮦š¿Éܲ75ðåy!- "cù§âQÑ°Be•©S1>]¶neñà†¶Ö cR®XÙVNó:vF~ÛÝ;¸¹3 ²®À`amºdóƒÄ«§.écv½ên.0¿v=]xPš*žjžQ/(7væNóµ7aò«P·uñOlÒ²h‚‹"*ÔŠÒKÿ«™)dÀdn˜‚pì—Ï®5à9‡ wïÎÖ Ê´±“Ü.^Prö”,X©ÑÛ@hÚ©½cNÞÊ7wÁ-Kžþµïõ è9¥_Á–v$šÇ„aåÌ/åà¾=º|CP0±0@ÕõÅþfýr¯¨gÿ¾tXä¨OM×AÉLyùE4¿{|ïîc—*Y(ç` Æ(` ƒ¨VIDATR~†9«Œ ¦†C«¡Ð\æ›°ïtœ Jÿp`K–õáÙ Ó[e´Æœ'Ïþºí¸¼*û7ê–¾4jò[kKèMFÁ Á.¨KóÛ+æÇ#0€‚Ó+>?oöA-š9È ·ÒÌÉßÞ·úhN.4)@.çI€ÒÙÕÆxíì}³ö|>yÎ};ë¼t=€}{ñÎÕóå±›–ŸfÊ5›› fÈ20€Ìgwîý-ψz×»ñëžß³À\u×ÖrQÝtH[~á§/¿Þó'{øðe¬M¿Ž÷“>úñ0Æ+¼º½_ÿ˜çÒ¡d°Ò¹–µñZl˜–¿8;ÅÖ*/MgV@Æɘ§4«IªuÜýjÛê¾z³¨là],;í–øõ+'ÒŠJ»cá€Îã×ÉÀêíÙzâŽî¿s¦Ìö§ –så† tI jïþ %n12míÔ U­+qús± Yà ?r5=Ê8¹fXt€w`X¸_«Îý&H9rÓÆ^ õíÓ¿o—ðà>ÏO9y/ñê{õÜ;ý™e(ºøΚ&înd#"Êñ¯v÷q÷ ìûÖOˆ…k¾Ô1ħGL¯¨0¿¨ã÷Åe˜#€ëß ñîû•TœûåZvþЀ(^ÛÙ³•wР%¿#Ê«cÚ4ï?»bd3ckWTÙaóFØ$Ïœ@G@pÆã‰èó6¬Í"¼€%AÒS+°¾‚ÐÕO¥V>Ížìíýáåò™&üâáÙvÃ÷ÑpuÛ ;†EÄÄôˆŠh×ë¹I¿'#"ÄŸœ4¤³¯Ÿo訞Ãço\=¨yÔG¢þêw;xtÔ·ë°Ë󯬉ðl=hü£~ÅèHwßî#^Ïñ·µ3#ýšwïׯoL÷…;nŸÚ0ɧ•×‹+÷æŸ_Ó'¬MH·¾ûtyaᆂ ·mÝ{Ì´$=f\ÛÛ3¤•—oÀ„ooŸüøÅf>Á—ÓDäˆhøîñ<ºôìÙ3*$"ºß'ÿ3ÇìÅ/º4ô™¸¾’p}i÷ö±iº’ÐlÚ©¯Gv hß©oÏŽ¡af|¸Uˆ…‰}"[Nþ8–#î]==Ò¯EÏ~ýúÄôX´ëîѵ¼[{O\¹Q>úÅôv^îááwn÷òj³ö`RI>¦wnÚ¬~·Eg„ ©Íì׳O¯ŽA>݆N9~¿‘' õp¼êîÚóe.›8GĬW¦#ü_{wìIÆqü÷üï šV÷¯^=2UE¿y3ę̂–c¨ø„ï™j'ßeF3‡ÍÝ»‰XýÅ3ë4Ã2!÷î32£Žt÷î™fî>(Þ”wkf¸µ+èF†2"$wŸæ®™»7Ë­¸/˜”Ñǘ˥¥ä®Y÷Ͳ’Ü»±d“iPÊÚ§>9÷¾ÿôÃ×¾º¹9×FuD_ÇŒ®±šjYÛˆíâvQ¤šVˆ® ›ò‘‘iî.EDöíšÑµ´7­bænZP\ææRÛiÖnEM“¦™ú–ï÷QÒá?¼uëî—ßX0ÔÖ÷i3£oÔyÖÖ\ò¦+gw¸©K×ïÙÀ Ú­©cDÚ ó›{§¯>ë^W&Ýýüý[ßûbûÒñÚ§¢–¥2~úùÞöΓŸÝ>wý y®¥òþÞƒÍË++ÿÊ.NŠÆnÅ!¥µ¯É2ºJ3}'ÌðRúÐÜËðìd4Å~Ñ º"³ÏŸ{ÚÌpÅ\M·Ù–°ÅW¹æ“kÁ«g÷Ç;×ß}{ÜFe°/fneQ#Î,¶öLbú^ïǯK¿ßef#Ã5N·øðâƒN¶QKöW!¿ûäÙçßÑx^öL[:Ô>Øâì÷k03ë”Ù>´ùNniÜÕÕ×wönܾtŒ´&«e%åç_~ñ¹_wcëJå¶ÖdêÓ[ùÒ þÛŸOÄ~ùë^>sy9&úqGø©9§^]’«óõ;3µ›Žfó-õ™!eÅUígõ¸­É4Q®‡*ÓÑ·?T;;ª'e÷›ó¯]ãëµð(ófoZÂú™ÚM»ÂŽsÚM*L–*©p»P¯Jvd¹¦¬MGåÕW&*é±­Í¥9"àÿL'jr¹LfYäZ5“VUdéR–s¾±¾þÁG¿ÿO]Yš¸ád 8‰36ɲ½÷ÒR2µ?º/H¥fmu–•b¶Ç¼Ä pjiüëÙÆØ pJ϶ýJÜq€¸@Üq€¸âq€¸âqÄ âqÄ âˆÄ âˆÄ 7ˆÄ 7ˆ n7ˆ n7@Ü n7@Ü n€¸@Ü n€¸@Üq€¸@Üq€¸âq€¸âqÄ âqÄ €3èb¡®o\]ŒJIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/content5.png0000644000000000000000000004133513051004444021656 00000000000000‰PNG  IHDRz‘äAï†sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ 2nJ. IDATxÚíÝwxe×ðsf¶¦‘Bh¡ ¡÷z•Þ¤TT+* *(XETDE@¥+ ÒKè½ÒHß23çûcHB¢¼|”ûw½—/»™¶3÷žç™Æ"Bÿ{ V nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ¸­˜nç™fNHH$Æ7÷¡¢Eƒ<{Áݱ@,"·óüÍúpîüWû-Žmî5)‰ûwhðøãcPÝÜ"‰I‰1ƒŸ«UÜkNÆîßý5S·”ær¸Øöàžãv9î²¾Utâ7ÿ‚ «à¶•™•™ššêv»/¿cF±bÅîУ㈀ەЎ;æÌ™£ëúå÷\.WóæÍ›5k†ênbÚæÖ²²²rÇ®ë†a 1ÿwÍYÅè*Ä n7€¸Ä V nq€¸Ä Ül""DLœ÷ž¿\„(ç}‘Ë/sCDBÙã!’+ÿ(xzW¦xù£ùº<Å+“(hVéªÙ€».b¸c1«¦”Mo¹¨y]ÞÙUß =^ +mÕ5b&V9míØ_ןò‰~µí}Õ™(këÄå?ì.ÿÀ¢:LÙ{º“¶{Þ¸£—ìíG¿÷Û«ûö»cÍ®æËV,”»lÇoK/%§*^ÅK7Õ¬.;ErdÏÌ®}³–.^§”ÙcdkqçÌ*Ç­›ôð%²_›_…Öu{?૲!¸ó=ª¸GO;»?‹û—(W¤x¹"ÅËrò–__ª½s÷i…IH#i˲?/]8¿iz¦›D'¯zãƒÔs±sÆf¸³+ av'®ß÷÷/¾aÝl&r\:“|þ´quÉ⾸mf—oO¼ä0û•(o7¥í›?ð‹çÆ\H1¾\䉻~}Ê…ÃÉ›Þ>—F¹jWÊ™Ø,khö¬OÙ5竇Ú=•¤ ÄAuwF‹Jwy×ײu)Ï5Ê\\ùt—í+¾®1†Ýì<»ã¬C¯TµÑ¡ƒû“ÒB‹ûˆfoÐsÈ‚>ß±ëP³:•5CLV×Ö™O¤ùÝß«gCvØhcÅBû?°k—£Í+ÂB¼˜YDظðÛkW½>¸Û¤~f"&-åÌ©Xÿ C²N|yrÛ±’ËÓåÚEsú·|±Em_ÃðŒ4íïW[üúî›%gN±»…Pâ º;‹a®U/0ëÔáL&Rèâá†; bðCÞY‰{cšTïZ´¨¸ï“Î:ˆ™6¼¿+Á§ù¨G¬n)¤†"ãØÇlH©>fIå2Þž\`"QK´xð%#ýÐþ=…„ˆrŸÿ:þ¼¥úà‘þvß3±¿(ÌW.̆øÕyjv@Ú÷›ÿLAÖ nàΪs<½±”–Á/•H1é§×.åjO+Y+B9±ü§,•˜YwQX¿ƒ½mùâk¡ôí+>÷ V±|.…íóƉÕë942ªR€®Iv7 3YÂ:F»lÞÅ&b6ÑÉÅŸ¹Ê/ãW'Ò?~×–¡ÂîÀBb«P& yÛ:_âՋ,Þl³ÓÅMïÿ±?«d­ºVèü‚Ø“>ѽšK•ê4Ø–ôMìQ""&QìeZth~nûg[?r$1²Í˜ÕÂsD¿˜îU¤„IQ$ï@¢›Bj”Ì:~ÈÉDLœ²eË!©Òº©â ]†z§þ¹egšRØhYˆMV/ýÒatÝ ï1Ù?ž2Kg&!6Ù‚‚«Æ4»¯·aÇZf„Ö«^Ö®0ù„õõ œwvíÒ¨A]ˆ™„‚:N«½­Ùž­ñÕzXÔ,úµn}+"³ZÀˆT›•´,Ïò„]f¯Ê5ÙD¦ž*N<úÃ\W­'ÕÂãDèîy"- nîvZVÀ€uÃZ•ÒtÏ>ÍŠª2“¸“÷ž8oJ=¹àÑFÙçÜÖŒ“+5él&&Ý©†µ;w^¹:õ ’kíò¬úûzŒ‹Ó Q™sw³°B—žR‹u±2 8°šÅñëË=c3t/RŒOS2@-(i˜ÄíLOVKVEÞ nàNè±!bŤ˜L*çyÓ•¼=->>$æµr!æì\:¹xãÚØS©ZEsö™.Ì—ÿs͉¨aõ*¯ŸµþdŠ;¼¨ÙÈîâR“·m=¬„õ­ÁnRŒÃ§·ô©;±FU?O÷°$íø}Å/§*U»jiÛO¥”îÞMzÄ Ü©%mz7]¯Õ±OoÿœnXSƒòûíµuÕÞÊjêÚµ[hWÎúõðj0>ê‡ï×½5¡Øë“ýmžcÒÛNuØ‹EF×Ô…27M=ç¬ØõþÁ¡Ïi8¢rýc+~Úÿ×ß T-»Ê³ˆ8ÏnzëñŒàõj{‘ Â7pgV<ªqjÛ/'ÚÏ.ª¦ 1‹n©QµI©Í&'öZXD¹ÆέèYÇ~2X¹|î[¢M«?v^Ü C–¼Õ¡lXgüžã;Öž?§7ynqp€‰)mëòý¾5:•²‘èžngÖÕ’õ:‡}·è‹ƒËY‰Íö„G.Y¥Zfü‘ÔŒ2^}ÖâºCšˆ›{*W KñíÅlyÏma׹Öèn5›DéZöŽÌ,†Æ¡Íž¾ ¯Nwú·‘¥Hù2Ñ-ò]¬àZ³L”_Þ}ßlRH ªÕçƒUÛ¾™yæøºû3k¿’Í»Ž~ªT1»nd%SÅú5#;‘q%:D£€æ/U=þaò‘Ô²^%¢Ûz“5gÖ%¸FŸ¨ŽÝ½ˆŒkƒ» ßæ'¿6é­ô–"ë㫺*l®\¬”·<¸Ò0Éó¾Hî +ùÊËB†¿jjì¹ÐÓ0<Ç¡˜Ïu˜¹{ b!™‚ÂæNÄný}ÎmÚ¶Íý`)MÓbbbZ´hênå/Å•Ý4ïËTàû¹þÍy^2|ÁScVT.x.®9E¾îBÀÝÇqˆÄ nqƒUˆ@Ü nqˆÄ n7€¸Ä âî"¸›ß­¥itpinRT ¯F"t0–Ä ³…ªGQB">A"TŒÊ•¥ƒ)#D¨Ròó¡í[‰˜…ªGSz;DÄd÷¢JU(þ;CLL¡eèÄ1JI&*]Ž‚¼Î{ÅŸ»e‹˜\!B·Øpÿa@ÜüKK¡)¯ÓAŠBo¾GŠJo¾@$d±Òw?Òïkè«OH„"¢é·iú$JºHn7=ý2µiBÇ‘Ý‹ ƒ¾^A;þ¦÷ß&ÕDÅ‚iƧôÛÏôÓ"b¢¦1ôÈ8Zð1íÝIºNý0úõ»ohƒ¬€`6nÅ“¸Y “#ã‹•‡-™ø²qóÿ+0ˆÞý˜Îœ"ß"Z–DèµéäÈ¢à”IÔ® UªJ$T6ŒR‰Þ˜NçÎÉL*SÑûó)%™||‰ˆ7§R¥É‘EÅŠ1õèOÑuÈ0¨\"¢Gž¢sgÈl¡ÔKÜ£Ó ïàß~Þjκ%Û“ƒúô¬ŠgFâæ6pì=6„–n$Îé5«žý!²Ú¨jõ+/ýÉ?ðÊËÐ2Z&û¥j¢ •¯ŒÖf§jQW^Q@ÑÖ¿HQ4·˜3Éì¸˧:2éö~¶ü?BWñ­ÅL¥§ß¢ÉÙíÄdÅ— ˆ›{”®‘År‹¦UC–- ÑÒ±Öqsï)Sž¾^AVÛ |D„ˆ31É ?ƒ0%¾_éPÍ…ŒX„H5Ó¿qöŒ1©fRºÑÏ‹«¤ª×þ ˆ›H5åL<“6ýËÄͽÁå¢Ãn¬'•YŒÄŃ‹o:ÍÊ]>ËsÞ½pùQ¹ùGÌœ´àƒ>’•õt9…c¿0»o…•k·™Ôû<«¼ã£s¦¬WÌ×ø +6Ž}­Â̪vÎ÷qçŽ!“G>Ï6o¿“ «øÖ:†^|‚­$‹í†vO³ÝWý;–©&Ñ®5b‹Ý‹ÿU… ÈуëvÔzûhƒ2äÖnøÙ»ŠÅÛbU¯?˜ÕÇBfÊ7‡B¦R[ö´“†M q…—*¤šÈéÊ7BÌ&+) ‘á&ÍUÈó´™T+)*‘æ$]¿z"V­¤^&¸8…Uô;x&Ï0Ìf1“ä¾Vc‡ÍVR˜ 4'yfJˆÙj÷Ãœ=çWϪªär’Å‹ÜùÆS¿˜Hµénr»þif‰!j‰¶ËSfšà¹¿ˆ(„ª’¯/yy_éýP8i÷W¿/|ïÜÙ Döâõ78¶XKþ]“UwÂÎUóž8{L ¯Ù÷ÕÚÍ°!—Ÿð-"¬p橵|þʱCÇɧbTÏk·iaš9=0&<÷ä.lùè÷¯>¸É·r÷潪³’o"…2Ž¯zÿÏæ%§¸}Ë7¯7ð¥ðˆr¤] Ö.lþøõGÜ^ʆ1uŽõ™Õ¾U=ýòY„lÊ:½u팱ÇŸ²•nÕöÁn¿NœÜiöÚb¾¶ü™¤§ï_8fÓÏ+2jh³ÇÛ<ð°]ýg¡­²sû°ésCž˜û:9±U¡ï Tª Íù†Tõr­£$·|Úö–ï ›³ïw™Oþ´qÑÇW—ŠÅrø³1>­gŽœ·¯Kšûæ [µòDîÁ˜YÍXõÓË9#^úñáþcG_òئ÷¾åqã“MöœZ‚œ»_\>{¦o›ÙÃ>9ضm¹5}ª[òu$ “~ð³‡×®ü£ñ G}º³Yß?ßéü÷žÌÜ“S‹Õë?u¾O–Qÿ•M1Íêè¹ÎX¶˜?¾ü¨+âùaóŽô~°Ó¼!E‹P‚(VýÈ«g,]ÍÚ=üÍ)Î-Ó~YqTQÿyp{[½ìØ 7P¸ôTúù‡Ü]ÅîLKÅî¯Åt¨cµÙ½JTkY,=#¾ öƒÓ§òèz"“OH›·k6ŠJXûjVîž ÖÌŸå®Ô­SÏ«Ù\$¼wÝzÍͧVÐþ½)¢æ|Ù—6Íÿ¥HÓç:Þ×Øj±•húD‹hMÏ_:YçöìÚùàʳøøVì9£jµ²'W~dHîF!›Ì&R,5okÊ‘xÁÜ°CïŽV“Ù§bï† ëh^>!ºb¯Õ°sŒb²ZËv®Ò°dúÉ8A»)¸i’é‹9Ô¶ y{{Z@jH×úÚ¥„Ä3{/ùs÷¶8s…ö9Ãí nÕu"&ѨBxÄÖ}›YšÝ'çÔ3OÆ]*Z±.éD̆A•¿_yÛßÆÔW/÷³JÆ™³. ¯Z×Ó=dhTº]uÓù¦¥eìÍr¨gW<±levžežKs0„”ëǸÜ>%[*žâM¨tÝ}Íé‚Ô¸T/•D˜ "Uý'cÄ Üf2ôË5'¯\öökqi^aušWˆ®YyãVwAŠ„Í^W¾,“—]ÄÈsΉ¡» —bñÍÕÃ^{¦øÔ‡r†Ñ„Äd²g÷ø)Ö •ò׆–®¹*µáÏŽœùTë?<4&blö½<¬j·sÁ'Ç©lˆøŸ±Ù©z4ùúæìÆÚî'§´ùî«& ¡¸“KbA¥rò¾£R¶‚ÂÌI§Ï™¬^«éJ_±jõ±ú$%&ŽfNßþåÞ ^u:ô°INºÙ|H½”pLá2º!¬²ãØïNÅ”7Hµ—¶˜’(0*$˜D„‰þéÒ‹þ³Ó…X5Y݉; i¥0sÚ‰Ó—ûª H@ß ü¯”¡×Þɵ—éYNÕ椸HÓHœ Û$™Tf¦|:²É+qÃóéNRTVäìŽ?~ñ*;ÔnÍ•Š=ªAØù]+â²È¤²"›–ÌI[¹F}hÐÅ+{綖­å}èçO.褪¬8Ϭúz‡jΓ,dò®æ_Ê7vÁ;¤¢²áØ·næ}Çÿiñf÷ö¹trm\ªÛdbfmËÚMf3ZI€êæÖK¸H_~LcžËùq·ÖèÙýà´÷˜q:ÀK‹?|0$,èôÎ5k¿mЬo;åJ+Gœiڬطϴ-Q¦TòÁuTz@§‘É} œÚNotdࣕŽª¡]Ø‘lTnÓnÍ3+§ÖЩÌÐÏÃ'õ[<²qhDÕôS{üëõ²þº^8WÁÂ&¿VƒŸXþÞÄùÏý]¼¸WÂÞuöÚšµ-Ëú•Éew(e¦W(^!Mê/}²Yhd´ûÂö ê53çTfÊûiÕîrê¹Æ•îvêtZ9Ó]N7îh¸—žFVÓðÑäëGDbˆ¥êÃgt9²yµÛZ¾ÁˆfVÕ(³aAº_¥\§Ô +A½>Ûgè”ÕjóÑ}ªt˜P¾zEÒ$÷ysL¤k¶|_¹óŸÇbšš¨T«6oÿ[TårŸ “Jh«WþˆÚóóÙS‰}Þ -ª ~ZwI®³åXD¬å{öšÞùìÖe —\Q½§…”ò74ÉsžˆÎá6\bä=ÕNw9«û¤jãGœ øn‰”÷lK4«jîÈ]jŽÚ\›Is 3‹.Ñ#ÿ®•óòòP†ƒª½x´:‘–%8›q7H„ =×y7L"ì3Ä“>†[ m2ˆ„DÏ f"ÒÝ$B¶Rõ«‡Ö'!Ñ :E—ÙÐÈÚ0¢tC!ª)¯¼Sâ鮹!ÝMÕ:E‰ˆîæ|'ææ´å¬!u{–bƒäê3˜™™Hwåü+wûÜ™0ÿ¹‘}'Ì©Sµ©aÐo¯ñ-ZßfQs7Ì,ºç_ý2÷4DË÷¾ˆÉÊzrQIlPˆ(\jÓ™|¼¯b&"1rí`Æ•÷óîà”"ýµ€aˆHUÈî¥È5†)¬dÈ>tuíÉÜèR¥hÊ÷##í%Êè‰Ç” ºžzÉtÓ: ™M´gvû$•í8@ÑÈÀF…¸‚¥'Æ‘SnÑÃ÷ïåé¯'–Tnå! Íån8î›F‰©†!Ījõ2©$róZC:Uî÷m…>ŠÙ濉·7™ºµN ¾]oÝí5]Nr¹”ir‹¯œf2Ûý¬ÞE¬^>&U) Åõ$m~V/Ea\Ÿ‰¸kü2딑A·èözbóRm&¯"nœàhLÝ{ ƒ™äëKžkÂDn!/ÎŽý "òa""ƒ(SÈÌÙ÷Ær9…lœý9ˆt"{ÎïE‘AäEä9¤!¤2Ùɨ[£Þ›ÕBÎýìò¡[sk“ê…'LâæöPª Íø„æ¾O+~ 4’ô§aƒéüY"¡ÏSÉjÓ’…‚ƒéó…ôÓrú`*) Å´§'ž¦7^¡ßבÊôô«T«.y˜N'«•Þ˜IAÅhÐJO'__úr =JO=¨ˆ.Vs¸÷ ¶uØzKž3eÁ¡¬ã›ÄÍÿ;«•Â«ÑéSV‘LªNQͺd·‘Ÿ?Ùí¤Õ¬Ci)T©iDå¨Ji.ª\t¢ÈZtî ©& .NªJQ5Ie (FþdµRµ(Š£²ˆˆ|}©rUÑ$0J7ì¾?ÎÛd–[ô 9·—9KPã@¿F·ù½¥_›ôVzHË ‘õïžU.B&&ÏMf\Dº…I%"'‘Ù˜˜H'r ©L–œÆ”&dÎiL9‰„ÈLÙtySEÄD‘SHa²’ÎÔ4éÅ*©ŸTâ”Ý7wš±[ŸóD›¶m\O@Õ4-&&¦E‹¨nàŸ$<“N¤çzé¦+wñd¾r{:f2ˆ¹^jy»`rГA—‡”ìbn82ˆ¸IÕV nàVp²?ãD@ÜÀ- Ù9ˆøß7¥¸ÐÇI nq€¸Ä Ýg º®kWuv Ž¶\ŸÎfÏùïš›qý›Q0žÎòÿÆÐï¶>þÛ=núõíýÂ˯%mýúÊöÏ|!..))Y°\7n vÖŽ¯ßFæ=ÑÞnù7—i«Šª¸¾ûÿ‡3+³qýÚ¹/˜BÜüoU¬öÍ—óò½¹~ýúM›6ÝM_Ãÿêç‘”ªA{ˆNwícQ\X!wfv¹îªoÍtû¯ñ«ßt8n·[Оºnu#¬ë:±¸ÝnEÕ°BîÄĹ›]Å÷ä2 nqpÓÝ‘·×AWñ?XQŠçøV×]ôÊÛkyGÆMƒ RRRðˆ¡ëoš¤†˜’I$22Òt嶀ÿ•Ùlv»qÙçÿ·ÛݤI“;tæÇwîr–Ê–þÜ%kân*pèÎöÕ3 Ê<¼ºO¿Þ>ü{ò®(Éÿ@Üä•ùó/'ê<6ó§O_óSéÔÑ©Žàï·þÚ¹Ø >´€yß/S#Â{žÃ]÷ÿ7p¯b¸cŠ4f#çÉ'ÌŠ¢xrAf/Õ 1„C„È®¹É0±ÂäyHPö˜™I„˜Ùóô ‘Ëï³±jõóóò ƒuŽêîÑ°!f:·éãÁ]šDV«P¥JÕÎ}ø逓ˆ¾|¦ß/I´mÁ냞xxÑ„Ñ“Õ¹ûòx":7}tï†Ñ•"ªV¨Q¿ùCSV'FäÂO mZ«JÕjᵶzlÊ·BtòógF¿µˆMhßo#]ñ?úÉ€»™#N¾»[¾å‹¿¶ :ù'I}cT‡&múÅe"úÔŽuÇ}ù»g¨ãk>lX¿oœˆˆ±srŸˆVý÷¦ŠˆœY?£IµðùGDD~xmHƒý¶Çë"rq˼Žµ+ s@DŽo˜Ý ÎäìÇ&Ø|n.T7w;VïšÆ ~rTŒšüx"!ò}þµÇ9îøŸ§‰šîvzt¸ÜĆC'"ãèi‡_ñÕ|‰ˆJ5ydñokº•¢¤å+þê=uaÍ¢ «;dìàŽ'~œ‘lÃ¥YžŽ´¦Ðw7Æ\ô.I¢Ø³ŠúÕð³ «WÛ+ýïÓ©÷…{ò!µÓ¨þ }+ªI§ŽíZÕ‹Ž¬Ù¸E°)3öt†ùÄÓÖrvG²#91ݘáÂ悸ÿTÝ\Þ_oïÛPüƒóƒ$g${±Ø¤Šn\«£ÀR­ßâu=÷­ÿé›o¿™:ék=‹žúfsßRîÌ4ßW¿[Ñžÿ#°Á nà?QÍô“×m=‡E›Q£_®›•Š]pp¦‹,f!fJÞþWªÏ㡾…~D\¿|ó¹³d“n-z¾Ú¼ç«Îóõë³jÞW}ßhU>èÂê-ŽÍm"ÂÌë¿›¾ñDùgÆ݇qÿMë½äˆËUçÜ~¼ÃþAùíûÆLüfÒ»?myºC„¸3¿~õC½L¥&eƒˆD᣿.ù&sw­ˆ×½-ŽÄ„øÌŒ’eD iÚ.zÞÄ¡»¿œU!Кyág•~f£ÅS8‘+ËIº…TtÝ nàû<„|*“Oå;`>¯Ù5+D\¾×Wï'÷=|íf#+^ÊÎürnIo…HéiWö5 †Û™ž–iY™öÚö÷÷춣ˆ—9+5Ù¿ÁÈG7c¢/¼wéá>C{t ò³¦'ÆÕV³Ìß.ÒEs‹Æ†0Qê¨Ç,?.I^¾TS6ˆ€›Ds»Éíõû_¦ø"1\ì<´Ï|`ŸÂšrñ¬IˆÐšBÜÜ„Æ‘w§ÎBéþ'yVØ̪‘0r´ÉJfM”€²¤âÈÔͨ"qÞÍMÞpó?êZDèêsÄr öÎæ(`ÿæÜÍ=Æì‡áޜݖóÏùp‚œÉé3Õ«X2³²D±_LPSÎ;«Õµhéšê{ú´Z2HT òÕÍŠ†+;ßùp®3kó6¬9ä=iUReçžäw7f‰Ÿ6á½zg¹þÁ6ÌÌœ>¡~©63¶îýñ‘õw¤ý›-Ÿµ¤ÙcºT)½à3ó‘µ³šFU2yñB®Å½j½±;íô{Ϭ[½RDºc&•ìº3â‚*N IDATJ&2ŠdT­Cdx›4íûï]¯¿éåté:¥µhÇ¡%IÌÈÄÍÛÈ8ù­ûû}½ýÔ¿ùfv_ú{Ø}æ|ÂáíºUôU{h½ˆòjá#f‹ÍâmÿÇÓ3×êÐÉßÊ%*GU òýw›þé¿—ñgÊä—v &¢¤Y/̨ýüüi£ÚÝè‚3Ÿ{®g¿Õq™y\ˆÎ>Û£×wçËÍùaåO ßI_ûfÿÁ¯§Þ}"dó ˜9EÓHu[´w'g|ñ­ƒ]©{©Ïßw“›GÂïÕ¸¹º‘k)d[Ï©HÌç¼äÊW®äH Ÿ³Éudÿ1#gB9STkwmW½xÛÂ*U©Y½ø5+#’<ß@Î šªµA—¶µ*)Z©zP‘*Á>×Øö ]&¨xèÒ~&"’´Lk½¦µƒŠøHA+´°qy6›Óe*–¼ð¥M+×gš§¼õJÍJåê5{ù‰‡“Ïþ¼ï´‹sþvm¼³+K³Ô«›Y²¬!nÞ´9•¹q]½TI³fÒXcôÝÜ“q#̬ÿëÙ¡š7mØç¡WbÓˆ™=|óV·Ö ›4mõÌŒïÜD,ÂîÔQ½ê¿¹*þ¯ù;´¨×²u×y›N23³ëù檦/ÇõìÿÈ·0—¾õX› cÚÞ÷þ²Xbff>1§N›A—².Î|¢WÓ&º ~fg21sš¹ Û=¥^z A“Ob“ùâo 5|añ&}篎}DÏ:]kØõ¬$DîóÖ zø“Èn×øë´uZNQÀ¬è‡7,‰é÷qd÷ŸþÖ‘]' 3IÒᵃF~\½ë—Ý_?sA#Ê:r„k^ñä¡ó#?ÂÄÎøû{4øôŒ¼;°ˆ0¥™úäÀ–Í´ízÿ7_ô,ǹ£»ŽMêÉîµ}vèüNcmÖY}=8ý;ffíÜGhÙ¬Q‹¶¦|½Egö„É ßíY',%f-óüà6Žû©o÷hüø´Å¬g>>¸y¯/; :u:Τøù›H˜…ƒEWœY.bÖ·=Y½áüӷ륎,v3;ˆüžy­’‰&r‹ÿ¸çMd&•L†Š°¸7ã†ÓN,oßa襊]Ÿ7®¦ºu@»n{/f1g|6¦Û#lê<âÉqc‡&ÿúF»/‘NêïûìT‰±^Ò¡Üú~¼ÓAd~è­)åu½ùϾ8¶Ÿ™_èóQ¬Ïˆ±ÏŽê×øûç{›ú‘zúéG»ôϪ9ð¥ ãʦo=äáK.£H­®S^ÊiöÇfÌêPÖ‡Lþ‘Uª–ô%RëôîWÑWT¯JÍ£Ëgìü®Ù¨ >µ¾ôHÇڜûhÒ²WVz–D¿xôó.Ÿí7¨Ñ¸~®Õó¾h÷Z¦CˆX’·-¬?ꢃƩP6ñÇýìu7ïÛÓÇ$e#E™E„Ø\©b•°2!y æ¬÷wì²*µòè§ÆßSúÍa­&ý¸ˆ‚Z}ax{2Æ¿?«}hЄ7'†:]mǽýt¯æâLÛ£ëw'‹=üÄ3£û6XòúˆI+03sÒ„­?Úï7bì³#û6^<¾ç°w~4y½8õ¥b™z÷ño?Þ»‘R¾|• ae˜(ªïó›7þRÁ.ÄDLk׬*Y6Ô‡ˆÈ§LTõjÅnßÎV6ˆÒ•R!¬’BdÕ•ô–­MÚé¬jd.¿Y “;1@D« +DD 93ªa½×~;äØ¿¼qÃÚ 6Ç‹†ˆóäÆ–jÎú常RFônÜåÁ‰ºˆaâNÞ-zô ‘øÑu£ßÛpHDÎ|1°Z—ñzÎ4ô“#«¶Ûæ96»zµè‰ã³ÿ°{zx½n'Ò\"âHXÓ4¼ÍnÉ™Ï? #ßìºÖMý°å$WÎËsO™;d¦ˆÿÞ«ï…õع'%ûÇ—Ï.ÕñÏMq"ràþ.\àÈ¥_êöX>ë÷ük¡µóÇsÍ#º½¤å ²oÆ}•ZŒM‘#kç4¬Ûã¨æðìðèÈOdˆHFܦ6QÕ¾>›=†?ß4êýõ"ræ‹Õº<—k¼½NäÄ€ˆš‹O¥6GóhT+²jT½¶ßvå]'ÆÕëçÿycòÌ!Ý-#¡F·bÖUÕ¡XµÕ«3 ÑtC×t÷5Ö8üc¦;/ ]»¾Ýkþl Ê>îZê¥Kœ^ŬþNw—oR·¨1‰¥Ld=oëžÃ{¨us2\e«ubÏb³ùê£ Y_w²t€ï'~  ‘ÊîâÊ™µÇ¤–t[Hÿ(¿ì©ñ5I†œ«#5_š›š=5j ‘3îLüÎ=›7§ªáÙèÁÅ*„ùf-.×±nÄ”}¿mÐPßõ·ñzìj…Š´Zñ‘ÛìSØóJ\øGVûÁMT"&¦j#ž,ýÁSk“¨k`¡kÔâê`š7n”vÿàNm7xv~"¢¬…‹N–,’{+gÖ—Zá…ÞÉÖqÂGщq_̘úÙøaÑϯT¤°Õs;.`Ã0ˆÈêæ“ÃÞ½U#V-$.º0ý½V­²„,,ªN„æÔvÆMúÅ$ÕRÔnõt∈wP o¢Cé b.á›Ý¡ÇD¶²þ¼>#óӫV"bâBúŽ§R…ÍiGŽ•œVIíömB¬BB¤šm Ó•Ë„olk¦¬³[ÆOÞòíߊ¥|J·™95g$ŠÕ¦š8û&¿ò>®øLÒÒ3‰í>Þ—ÐTÔüOaÑ2“u©îã›ýY"²” °¥ŸO!*¥?ûàí)³}7sü¤1gCÜ÷üKšWRO§‰bIͽNê´oSÒ"…•É9³'Eê«P½Æì"­bY¾9vl»ˆÛºqÎLÌîs'ƒ–.RYUÙÈÐoó²ÉÈ òbfaAWñ=7>E‹¸ñYDBÄÌç·®Øï]?د„¢ýžè&31 Qæ¡x öõýga õãÄÚß? çÑå4Û:ñg×88ú¹m'Ë;ù³]eV•¸gXz!ûozV–ÛeØÍŠ01IR½ú‘ÉË.’™’š]Œ1gnßxÖU¦Rƒ²ÿàûôRøì¥dÊN0¢ÌS ¾e¯ó9ÿˆöo¼ßV7 r&Î}ªçèa¯ÿ±qZ¨'Õéôö³ýó¯“BvÚESÍù½Ê’'x1 ù…”=!3ó6îJ Ë¿N—¦¾á“•e!ëEÝiíÝǽxa¦Sã'–~c²¡’(º"&ν×Ul©Ù·¦{Îœ_²7ãð3=ñ󑸪U¢ åôŠuÇ=ÛOjìúmYé5«×ºf܈›T‘½ï°?ý´3#ûûç=ÑtDâu7/asvy”ô÷Ÿ¾zuÛïüqWP­/‹ÊªBä:´?Ëdb"f"#áÂŽµç=E—ãÏow ŒnY’(4º‘yï뵜öÑša¯íÙp4ÿŽ¢»önÿkסÓyLí¸vÑO§sÚ6?¿==¡JËE®µI±Ÿ4©ÝzS¦¢ª&Õ«ø€ÚpÒ¹Tâ~½+l_²dgN\ÄÎ{0¢Ùƒžu"B&“™ˆDôƒ»6ïØw̪TªrjâúC‰Ùù“¾÷CªY*„ˆŒ”#›~ÿë¼ã¶Ûš CÄ-3ƒg͵h¦,qyM›L(BÄj‘ÅËÈpé,&CAÖÜ‹Õ÷œ4ãÇ·í³k@§ê}yªdÔ«MÃUÿð盕œøT¿£×ð>·àÓ,5F÷mV’Ü©†a†äÚÂ.¿RíVmõ²%ÕM1M~ØgE«‘Í›õzðëÙM VíþÄŒ`Ï¡)#÷Í•®¼d6Ùl羘÷óàn1áÎ-ÃG=Óîù¦ôk˜w~mQ½Ê,˜¼h}åÀ²!Ú9ŸÇ_t:ýët“ÕrtÜ Äßú– LØóåº" »W ÷¢Ê¼µ§ñcŸ4‚ÉüÒópåþ‹fŒã\¿Ö5Ÿþ¤åÆνv»ÿÁû’·-[¾3ù±—‡ÙH„Xò.‹§—”ˆüʶ™óLç.}ö°&íþìËu‘£¦‡ÑÀÙ}VÄŒl֬׃XÏlZðë¾áOÌ ö¬7[æ ¾ éÔ´N¥bï¼þèk›æ¿ݳoÄÜCºwíߧ£_æ±Åß-¬Ð¿}½RD¤ï{ÿþAk'¬Û1¼¬r;mKd¨š’qè /‘˜•Kê–|èqƒè¢Åîïv+Ç{w™¢ë9U²"-þ{»õŽ»fÊÓGwxÍÏ?m?šTºFÓNmZ– ° “ëȶuËWnHÐ|êµêÔªQ¤·"$Ɖcßò¥ƒíLD¢ŸŽJµ ka5e/ ;áìñŸVÚ}Ñ»jðûš·ç¿ËÐÎœ\ûîÌ­S¦¿Ò§#"̮ԸÍk–­ÝzØ^2¢CÇöåƒ=g%9ÒâOœI)_¥¢•‰Èu"ö°OX•¢6•ˆ2Nlüíç?÷ž2)Õ¬u‡†Q, ³ž•´cã/žuÒ¾S§èðPUˆ™Žo^<ÿ§-•Z ЪúÉã‡ÜìV®”¤g\økíªµ[öi¶b c:4®SÍG"–Œs_½7ÃÙÿÍa·OÜiLŠìR’·þåߤ¡‹H[¼À§S‡ÕI_|g d'>^±ü¾C†âP؆¼¸çâ&{§¢<»XΫ¼—^u¹dá½›tõu×ûtž‰]«7ψr÷¨znj/+¸€y)`ìBÄ”µ~ÜK¦LÅ×¼.òº rõ% —ÇPà¨r¿™€¼‡Ìr¿ìýW¼MlUä6ªmt&&Cq)”~élXEÕPK¤^pjÄŠ‹SÓ´êÕÝi¬™âüa…_‡V¸Dóžì»ñtKr¯8ß`×M¡#½þ§‰ >¹d¾zA ž—ÆÎäˆñàüûžyuŸÂ.ÈU‹~e Ž*÷›ù(hÑ™Ùõ÷K‹*·,B·ÑTLŠAlfw€oɾ ^·HÓIU ³˜M^gkFY2ÅÄdÙö§²æž­nàJÉ"$t›Ÿóš»Vº­Î¼ƒ˜t—¢°è&CÕT‡ªÛ™\:›UMè©ä2å}Mìz¿÷ÜùØæîÕê(WAwÛŸ_Ÿ»VºæUÈPH˜Ì©¢ºÉmÒlº¢ëŠYa-ƒ5½t9µ_·YÌnlqˆ€ÿÒ˜b""…™˜IUL¬‰…X!Õn2+D^?z^W-1­qïP4¦þKq“ÝÓ$ä9/”…<'_é[×]n9uœÂÊ[Lè¼AÜüÏ);w<$xL8âîè»Ä n7€¸¸C ¤‰çâq!!ÄMBB®ìSºqpsÒ†E1T¢ u4Ò” ]?«ïwi*e߇þ)¸Mt“¦’*¤èKâ>?êÚyÞ÷xÉ—JÛ#qÏ­bÂ*(´´afUT·9+6kÛ’“ 4s‚fv»íötrf·µ9ˆ€›B×uVµé»žÍ¼ä´85³É$^A©^þ>”}Æ1Vâæÿí÷®zôKž;håüYþÉ–zÕOç¿ù-Í5Kyfææ—Ÿ®n·M\{æuƒÖ RTRˆ=·=cƒ…HWØt uûªÔ¯/zŸ6k¬[Ä–ªT ªQ3 MY{bFus”{<®ìÿåù>ά}1¨Ií^Õ“~­_ºüǧòßA‹â?& ç5³F zµ1ó²ßGÔ î¿(î»—¨ß®o‚ëßlÙì>óÖÐV¯MefÞ¼ðåzÕŸ[{c y8ïj`G¡×é^·F•šõ[¾ñå÷ôÐIVØ­‹I!r®ú6XÝt sç×ÉÓ/òi³¨ªE­à¬ðPµ©ý‹ð©M,9qÄÍ?ÙÐøÒô‘Ãï:ýo~‰™Ý)ÛGxâ(ç¿õ^Å–íÊ{)l+^¦€õËf"¯ëŒÜ±‡&.¦yQ«*µêÕ·š¸R½:eíÿò†rÛ¾œõÃ)¿ÙßÍ«ëMdœœ1í›ö“Œiv£ËËÆáqýÚíâ¼wó#’ƒ£ïë¹›Î^ðýÇSÚøá#£&,ÐîcÄžJæ¤~@çtʾ*\'CUMÚ–ä5ß&¼£ÛÜ»ÅfíëûÔð “Crªèž{š!j¹º‘k)ä.%9‰r|王™FÞr%Ï@Rø ˜•ŒÝÛö¹s&”3Eµ~ŸQ%ü{¥êÕkU ¾z¿½fÅä™ ÙId¢þõÉ«hãÖ1‘•ŠÔhÝ$Ä·´Í”kBygM Ÿ}‡ËííU¶nt%•Hqgdú4m[£„¯­ …“üÕKîRNqïÛ¶;Óœgy‰èü·ýeX8óÉ:Uk7ëûz¯f»w,Mv,¹gö6 &r©ê'‡Ç/9ù£çÑ憨 Ñ)÷¹²>ʤvš‚å^.5«š_-“¸t&ƒ‡ß;q#Ì,·¾ð`÷Ö1Íï|Ò¡LbξIÉ–ÅïôîؼULû ³–èD,Âî´Gû7º:qÛÂ×»¶mÒ®C¯[Î23³ëÅî-w¨¦…ãûzü·0SÚwï<Ù©móû|´ò133Ÿü¤Q§a©®¤ÙÏhÕªEïö¦3'¬û´Yçñz॑M[~¶?™ã×4oÑüå·2éÛ~ÞÙ÷±ÑzÖÉj÷?ÖÈF$Dg·P“Jd³S×qäÈM¤Ñ”‡¨˜/ù•¢I?3Óæyä׌H#_Zú÷E¯êc"¬[7žùþÞ qòÖ6­[<=ï·¼[¼03%î|å‘>mbš÷üøÚ£Ïì˜Þý©Ï78“6·©óóŽ¿ÚÅ Mðã×Û7{qE,3“óØÔ'Æ´jÞ¾û€¯6¥œ-°7çÅÛ¶nޥ׋6Çsúá[?˜¤oÙ|ʪ}œqø¾N-Ÿ¾ˆÈص7Î/ À.$ÄDV)Й¡¹uƒ˜ã}¨~íÖ¿¦ÜÆû§P–Ë[=ilËþ¹`-YI›w|ëªIó)겕½Ù0³nS…AÖÜCqÃé§Wµk7è\ñæÃG ¯àø½oëî± fÇWÏô1mu“^ rßÙ¥/µ:)ž˜Hœ.}Ã'Ͼ¿ÏþÀèqÝš>¨Ó¼=."ÓÐ'–ÖõFýG?5²‡™/½Ü;fÆVê5ddŸö‘ Çuùî2""Õ|bLçžÊw;zDÑ‹ºÿÑ—øE¶›øt?N·xcrëPR|ÂÊ”)æk'Rëöî/ªWå˜:aBDgQh}ÒêÒ믒Ϫ;Èó7u©@“·Ñ“/ÑSéåÔôr…·¡O_""út±Ô©Ö¦Skq6«!!Õ^¾t™âþ¾ywÎ8³¶C»>{MQCG<جtÊc=š-Üs‘ˆB»M¸¿I“OÙçß~£NXÕ—_|È'Cï2þ­AµËHâÞ¾­ºmvTúà¨Þ§>Ôoþ¡tfÖÒˆiõS|Éû‡ìR/pêÐVØëS&râ‹#liÜïÅ7{Ö,Cl)Z¦x?‘Òþµ¯6}7ÛKõtظømwP±2~6•ˆL>!åÃÊùÜÎ[“Elf‡ª+š.n!2ÈüÅé7Ò,L&gˆþXÕXTb•™u“[Wt¥Íi˜Üq ªÞ|üRCDN¯Wçµß9üܸaí/6]1 ‘¬ãëZ4ªùáÊ“âJÑ»I§á/h"†aˆ+eX·èÑ0DDâG×~oÃ!9·ppÕŽO»r&áÚúFõªíw¸DŽÍ®^-zÂÚ ÙØ9-¼^·i.q$¬iÞf·ä̈熑wfR3@ªõóüMÄ-K U‡ÈÏc„C%IËðÈGBfÙ'"’¶QH•ä–½° ýðPÍZƒæ^d峫u}×3êuï?Ù¢ã£Éºˆˆ¸÷u­Vgi’ˆÈÉ?æ7®Ûpó¥ì1|=¶ó㠉ȎwÛ×ôáå1Ÿ]þxõ¨ÇEDÛѾRà Y…͆ãþëDEÔhÔs]\¾?W­–ÛËK‡¼~|D¦#MDÿìÔõ¼Ï”ÃcuÉ2tCD7ò.´À¿rwïúz—uĸÚÙý|Tfú’ÅY¾¡Ö.ÖÝe›Ö!&±•«Q×˺çÐ.ŠiN†³|DgÅÓRgÅb6_õóäøú›£e‹û-üìc]ˆˆTÅRR9½æEÛH·… ªåŸ=µ?“Ð šëi.yÚ8”užN¤ÐCýsŽ›èݾT÷{"¢¯·“¿B3&‘"DD–L"7íM¤èâ×îk(hBÇmÒïŸÝšˆD˜˜ê]ä¾¹Ûcêþ,¶Àb%Fæ;^2 OëF‘}§/íKD”òÍwg*6Jøâ³5!"Ö²üõõ[â¨\±kφ¹ÿøiMãŽÏš2{Öë/×™>Ñ[-dfo¿ÞboK‘,=Óév26źwXMŠM÷UþE6¬¤DJÞƒP¨nþ¥;0nÒ.&ªÖ`»5»GÄ·D_¢céñbñS.?cÞ^>€×gdxJ8ÕæGÙÇ ì³tœH!]â¶lu_þsx³FªAB¤šm god7ÖãÉärfP±²Wd”‰$ZDD”œAN­[}e«‰!ÿõlXgR²XBýlÙë„Èd±›/ŧç´Û âS©õ÷S{û³U3Ÿþä™äèÎÃ_záÉjESN¦ªÎ3‡¶¤Ÿ6²—£›Ôõ½þ.Æå"땪״Š^«Ã{¿žyò¾r~wF¯Sqßã—¤ªñ_œ™n1Y5U¸ì3¾h(:*± aîÕ¸ñôs»3D,DÌ|açoíµýŠ³¶)I#“çN×YG⥘Ï? kˆ/'7êùþ3ý.¿¥¹ÝŠI¡ÿí‡Ój'³JçEeÖ©mD*‘¿JFÓêžWDD.'™,ÿf:Ö qMÊÊ^'D®Œ³™®"Åý®ý£Î¥[ ¯ÙP·Û­¥œôh¿aÃÔ?z¤¤¨ýÆMîy¥ t»Mf"½ Ñ®I£{óíóÑÛ÷gW3e¢Kë™gSï”g¥1ÛÅOgý«Ã¯s€I îè38D«bX4öÜ55÷nW±5ºW”seµrlüƒ~¿ÿ\•ÊѤœZ¹á”§ºI?¸ñï¬ô舚׌b“ªÙûõ(»mé²½YÙ8üÕC•ë ºxÝÍL8;°]—vnÛz<>-uc ¡Èúö“œ \£Ç¿&²õ¬MG7Qlzö°¿ò ±a&‹[Õ2ŠfM«èÙ4°ƒaÅPÙ0é̸Šù^>2¥öysšÏö©<µ`á¼»?Z¬ÚcÍÃM[=Ý èÜ'ú=ýÎܽÒsÀ³JØð~-JÑU'Ðäz¡XÍÚº•+¶ìØ_vÈG=JÑ¢åôOÌ~í‘Aïm2ö±ùÏû’YµÚÎóÕê£)NJÚølÞ“ÆôšðMTÓ¾ÑEmD”ôÇË÷÷¹)ýöÞž ²aM1)öAA) ³($ ©Œ¾š›íwÜ (<'†$Ú³rùÒÇ’C#wêÐ.¬˜]ˆ˜ûþX¹ü×?5ï:-:¶oY×W2ôƒ±;•€ªKy3‰v(vûW­XÊ‹‰âv,ù蛵Eªv|lp[#ãâŸk–­Þ´WŠ”kݱsÃa&"Î:»%6)*:¦*DDŽó[ö%DÕˆ°™1¿}õÁÊñ÷{±IsÛžã¥+…û]U?1ÝEsçÒÖÓÔ¨;éI[vSóƤi©ôã´h)Å©ÿÔ¥avcH¿DkvRË4vÝi;¶-û~—ïk£:ç›Jʹ«Y¶eÿ¹À µ;thY¶¨g]]:{äD¢Q=²²‰‰$cÏßûCjÖ 2 %ÛùËÊ•»]ô*Ö¢m‡¦ÑbÎJ<¹nÕ²;Žz…D´ïØ¡Våb66/™óýÆ#͆>Ù©ªÿ®=ûm¡áeŠQV‘Õ+~޴縩HhÓÖšÔ«fg""W¾©ãÞŠœöE—ÀÛ¶)%ìæ¥)sþÈXËœÑÌ~û€žlR ˆ›Ü?й/{¼ü*ïõrrVwÞkó_Wx½Oç™Øu.wÌ3_¹^ä›Æõ/÷"¦ø¥SVø<=¸å,ÍõWc®×¯ßÜÈ·¼ù—CèòðÓÓ|ÆŒÚæÛwk2t÷²äÏ6:~³;-¯VøÒMdÆu—hLå É|—=æz`vÞÁ®;šBGzýO:ªkJ\è4þÁÑJú»ûC¿téÚüªƒd×^šë¯Æ\{õ¥¼EIDAT¯ ^¿y/•ºÖºº<ü…UÇÕíSÛL·ó#o …Š¸ŠÙ\ÞýJ>O†Û„‚¢º¼e„ÜþÇK.W@·ùý(t‘ ãâÖä¿û·4«~¬ ›QÛ nþgùÓT½üÄp¬Ä ܱð$@Üâqˆ@Ü`â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@Üâqw¢ÿžÄ|U¾}:IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/replace1.png0000644000000000000000000001671413051004444021616 00000000000000‰PNG  IHDRzAàæ©sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ+8ÈFº.LIDATxÚíÝy|EÚ𧪺{ŽÌä&! !D „9EPBAo‚¯7*û²ì‚»‚²âªë*êz»"‡Ü( Ü7r_BWr„“d¦{º»êýcH êîú a“ÉóýøñC&ôtWÿºªº§b „P㣸 B7!Œ„¸AaÜ „0nBã!„qƒB7!Œ„Æ BaÜ „0nBã!ÔDI¿ù•B!‚ÁØØÄÅ.iY{Û÷–±…]6&„€FÞÛ¿=n€D£LpG«QÛ"jòºØiAê °‰52™… Ó4¡1GºŒ¦@j ±dÉüˆ(ÀÖÐx§%å%ÅCÓSZ…‡‹vÚ1I:tøh^q©ÀNt#_Ô¬ :_×.>Þ4Í&Ù»àB(Žà6» Îñˆ5Þ)gðLBZè,›Ç]ÛÞêp ìá4J™VQ¬ªžÆþ‡¤Ë?dÙ"ÆM£5&I²Ä£”ŠZÎœ†$Ë’bÁUãÖ¥¦$SÊÀ×Ì8çW~&Gº‹C©FL\8pÀ¢ÈœóèèèøøxJi‹;'P#50!DUUU^þ‰ó%¥º®wìØ1&&¦1º“îî¦ß„€½ûöyUç<999..®ÅÅ jÔ0¢ªªê`f¦¤ü ic¬uëÖÑÆ°Õ"„ê»Ò;BǸA]%7!Œ„Æ BaÜ „0nB7¸ B7!Œ„¸AaÜ „0nBã!„qƒB7¡¦ªÉ/¯%„"+2¥ @¦®ëB\,S!É ¦æÕ ¡L– 7tÃ$„!(“£¦a0I¦aš¦h°¢‡‚P*É %BºnrNˆom3 L’$Æ Ã¸¸R4‘¥nÁ!áû¾€EIü€‚*É2£Tø¾aš†apßrv„)ŠÌ ¯É¹j±(†W3}ÕG¡”I3t2 ¸i˜fƒ%cê’DÜ4t]üب ¥’,³úßF(•$ùbÜ4 “s?[%¶ÉÇ ¡ óîZ³âDÎ)ˆàf@dÂ-w sJÚ¾•ŸçÓ¤»níS]qáÐŽõ$º×MÝ;¨^É–²3ÏMìÞ3?s¯=¾kBÇv2ðú†@%…je—.Ï-®r†ÇÞ0hh»Vv·ê&)egïÉ»ïàô£{¤ˆÎÝã.^Ÿ„@,öòÓ·mù¾´ÂÝ*¾[Ú­éVÐ “B@˜Uy™k¶þÐïöŒ6\ZSVppç¦ÓùeB[PdÏþéÛE SçÜÚXÓL‹¢®úò£íûŽiœˆ¬åoÝ;ô‚jM"jM}~òÌ—ÿ÷”ªØ­¯<óÞ¤‰gjeY’$oñ’ßÞøýñHçªìÌ<®%õW3&ï_8üº®‹×ís׺Žo[òÄàë?Z¼Ã`BV»{ý²×ž|bíšu.a¡„Z÷â÷þv §@çÂ]žûÅ„á#îx¤D£„à*º~7Ì]^´á›9Ûd+²ºkÑã^žü×Ü·Íf=¸föœ·_{÷ÃÙšª²€èšCó&ÿå3E‘ ·«|ÎkãwçƒÃ[ºá›¯¶<¡(¯ßˆ=@^=ýÙ1£2¶íÏö¸«·Íž2´ß€ÌÜj_v蚺æÓ©Ÿþý%ßm¶YJ%WáÉUKæeÏ•)ÉÙ1á®þ/Mû¨¢Zc”øMŠf0wCxªk“ »û±q<þìÔ™Ë;ÕnX¶á49¸d†ès_Z7òõ­J@HR¿ÛzµS?z÷Ÿ¡–=«=W›2|T”4UmX=‡*éù/>òD¿ßÏygú[>;aü_?œ:yìŠ×ŸÚpÄe³*eÙ‡Nä–u»e`õ¹cÙÇó%F„Ûåî1äž{÷ðó/½¿|[yßÄ?ÿC’$‚yÓÜã@˜&È]Ü1fì³ÏMžúÊIJSGge[mú²Ùˆ¿0îôúïò«<†Iœ2½|ÙKßì-aÂ{rë¬Gl/ŒÏðºÝºî5L^× ²Õž½ú“O¾>øä럼4íµGž0uÖº§:'<;É @h5ù›Öì¿÷…Çw|5«’J”7u°…\wË]cžz~ìKïÍZøqþŠ—mØç6)ön®ú†2&É’$I’½UD˜\SYMÀ³xöìác½uåœ^&…Æ&¹ûAמ9sç|»iÓ®Ø>ÃÓúu2ôŸ–é"L*Ú2ÿè÷äƒý™$K²¬Øã{îÛ#bíê6;;žµ¯´´ê‘ç&¨å%G³ Iö½I’$É’,KÖбÇ^<³Ð`óÆ/&p€ʘ$I”Iaáa²ºIJv.9À;\ŸþÐ=.¬X{Ø0L9¼ÛK/?þöïž)ª,øäùË{mm¦ù“B²‚È l_ýmÇ^ƒ»&u¶)’$Ë”*£&ü™ï¿³@'Ü8½i~nûûG Ií`;¼zs¾¢0ß•1&I2£ž4ä¶! Y;¾¯ª¨ö›ñzs‰"8ç&‚[ýáúãö~“ª.ÜTÚóδö×ìP±jå J¥ÄÞÓR»OùŸûJxĨÑ÷3Ý+~¡»DÎ-Llï¤B€„Õb.*(5« Ž>ÎC»Ý885¹59“µ?·Tc”üdvÑß%P=Wè2±Jú¥g-€`šàˆæRp—€¯º\­X¹l™f èØ©ÝêEó’zÞìqïƒk¾™ï1tÐeäÄ!­?zÛ=z¯çÆ NÐ~v=B(xŠ +£ÛXlB€ÀiH§ö!î¼Ü*ÃPW,^4lÔ˜Pgh÷Þ½W/]@riûœCTLûÊÚ ÝаwsÙ-³^|hxÏviÝÚO˜¶pܧ‹ûÅ~=ã‹ðÁkg~´ìëU,"|Õ‚¯˜,1gL÷Óú§vK¸ùŽ¤HE7ù/žAN‡ZæÒ€_AX“óUu†:óNÏ:´ËíÎ_ðÁ§.÷áCûrOæPÆ~Òžôªb ¶QìÛ\‚1X¿žÞ}7¬YŒ B!M?qcjé™N}sb›A½º-ÚãzbÂK=¢Ê×lÉ®­<³zÑû‹=ž=‹¶ž¨!€ZŸxå•òü’q“Ç›õSWÅaW´êC7|•œ0\Uê²Ôœ^»b[‰^¾wÑ‚¹\Å»V*¹Á%B¸ªË슕Qÿ©ÎÔ<⦶J}ôíEëNï8yþ»Í›F¥÷×á¥ßLp}«Zׄ7毙²†0L’ƒCÂl oØÊ !„B!Â4¯é?Ж³n[v™@)!À/”äeÏîÓ­KöÁÝ…ÅRR§våe¥­ºYÊòŽý¡Úð ŸIÝoðnž·ÐÑwh»‹—.Ô€¢@V½ÿ~2g1MÐôG˜†5²ýØw¾>p®xÛ‰‚ù‹g웸ç›Þ°kbC w•K IKM\:{1‚HÎ+µ;œLü¤Û\×ÆLƒ%õíuæØ®â‚J)¹[µ÷éÛÁ¾vÖŒ˜þ#ÃÍÊêo@pÛØH²aùfÙ¢„PJ5kÏíØ”—Ð3Àéô› ¢Í"8…\×TÕãe`*+;gÿÃÓ;cÂþH8'„ºJÏVgýzá¶IÝ B˜&÷õåë§î\eç‹òÏÚÀœ;¢ƒÛ¤ÿîñëß~æq:mJBtHué™%Ÿþ­:ö¶ÔnA³¦íîòÀÿ0ñ>wiq°Z²lïμ!I”BeiaѹP ÑØ4oú¬]fo¡¦aâ­ð_JR]Í~˜—”ˆGÀ@á«Îׄ÷”0M]óxܦêѨM¸V»¶sÿ§ŸxòÁPʼ·Æß4äÕ³/>Ú>Ø‚sÓl„ëZUYñ¹¼³n T L½ïéu«úçf<šÝ*¨üô®7'pÿäáê©o–íyì›ÂáÝ¢]XñùëóV,Ií|§ÐÕŠÒ¢Âü „bwÚ¹W×4¯ðݶ°9ÀëõhºïbB¨l±)Œ×Ô¸©¬X, ×5ÍkÄæ°+òÅ)! Õjšn ‹Õ®(@ º×ÔT•0Åb“ Çkð‹&KŠÝ&«¯bSdæ{®¸ šªyuã*d “ä“÷Û·­¾hïˆ#$IúùŽA)ü·ëù’Í›éر$; nw-&M;ç¤þ0üª‰ ¶}×ÞÖêj¼:á¾Ð-V‹0¼j}‹br€]ñªšW7|…Ú{ «ªêå„JÎ@¥¶ªÖ”1«Í*×·1·æÕ B%‹Õ¢(¾ÙðªºæõRÙæ°QWU­¸økÉŠÕ*ëšW²üØÆLTú“GáÏÉC{nY-[¬ªª2äÆolŒ¢½Mÿ©bB<5îú?û†Hj»þ¾Oèš[ ” ÓPÝÆ?PkÝ?ŸÐ#^Õí½äD˜º§Foø›…©×Öèà©1<¿°iMhG RSeeÿÍÄQR\ º^¿“3GäåñiÓD¿~‚sÒôš˜à¦ê¾´Eq£¶ÆhØ耧Ú}ñO¨®2ê(8÷Ôº¡ySó¸µK~@¸®ºôú—À Ý]£€®ÿ´už%@~ƒ1Ø·¾ú*8—ÅÓ„ßÐW¢JJ ¤¤a¬ ²u+ÍÈàï¾+†”Îñóf-Æ9s†lÚte~UH0ÔºÀËc^5xVäbâœ=K32ÄoˆŒ @ §¥Á(ü®ƒsEXãaÜSÖë·P~ö¥ .}úiòꫤ¬LH’ßÜßEØ»A Ä%Bu1´O‚‚#Pè‚àhèšž Ø{€BX$„KPcƒ„Öpâ(()ºu…âCÁ­¡sG¼°g/hübzôèvƒ[HvèÝ D-=ÕÞ@Búú뢨ˆ¿ø¢HHÀ>Æ ò;Þ‚.¸t˜»Áø1p*á0"&¿ =n‡ñý`ù.jÆÀÜ Ë ºªÚõ…ç„ê€ ¸w0üéM¨â0å °Õ€Faôð—‰P“þæyà62f| ¹ÿ¦×#ÈÌ™´¨ˆOš$RRˆïÞ(†¦Ÿh“‰±°j)+‡)Ó¡` |öÌž}„!Ý (z^ ÛWÂÜeàˆƒ‡î®‚ï1I*`÷F˜7¾ü F<‰apÝH¸ï:X²-j:w„A£ gL>_ááFþšqY»–>û,7HŽ©°wƒü‰€½[a÷^Ђ`pW°¥Á«ý€2h×¥Àºj8sçä‘Sп8ê&{+Ë¡ë=Ð÷&8_Ö0S 9o†½YSÿaNø} Ä·†§‚©á¸ðůڨ#GÈäÉî.]®½Ö0 |`ãùBÀS``!°x>›f}e•|ðº ÁP ÀAeð¾KW™ xüE ­îÑÐê  é@ ع.› K¾‚‚| ÿî¡<_Žé’dÈòÆN*w쎉ƒƒ)äW©PûK L‡õëaýˆë¼˜¢{€Ð.ªòÀ%€ ôºŽì„µßƒˆ‚`;€›÷Á¡à»6ùSx"v¶a°ã{Ø°<ÑŽÿ˜5^Y® \:bÄž=Oœ?¿|éÒœœI’„o j„qƒš1›l–‹Ó±Ï< Ã^­aûNH…Âj0< px{.ìÞ ÝƒàÓ™ÀÀᇾXc¦ÀæM‘K·ÁûKàü2˜yögÂÞýÐÇ ËÖÁÚ9p2öì†ï·ÁÓwAYéÌš áá‹î¹çDB‚Éáüܹs+W®Ü·oŸoq<\8˜BÍÙÔ»@Ô@µ: V º<˜€³‡`üDˆµΗ€áñ§ ÖÞ°çk(¸ÊÀ\¡vÈ+‚Wž‡BÔVÂùj€øýÂw ”]øÅ ñu®Üv{qdäÒ‘#]P¿ ¯Çã¹pá(ŒÔü•5ø‚Cѹ¿b@%j+áLeÝwu8_÷A„üܺoVƒïç5åPS~I˜T”BÅèÔ€Çf;šœ¼15Õc³Õg !Äét&%% 8°á’Òã5õ¹¸ôÿ™é†¬M0Ãqe·D\º1c‚-èÙÓ«(¾Ïú¥4$$¤W¯^}ûö­Ÿ¸ÁñÆ jòLSÜwŸyÇŒ±üüüõëײ_ó±BLìzù›`HRüéÓƒW¯+/¯Ï¯¢xeyå°aÙ:™¾í$Ir:·ÜrKÇŽ1k0nüJý-mÐDe Æxe¥fµz,&ýêC,_‰ÄcÌ«(¢îs侉áÊ  ïn¿=?6VøÖ’ „X,–   ;ï¼³U«Vœsßš›~мþÅ»øñ†[KÎSêßÉòc¬*Ö¬ 37o?ªéâ_ÿµf~ögíØw_Íÿ~² ›­¸uëE÷Ü“×0k¬VkLLLFFF}Ö4ófF¨éÊܺj톽L‘>¬¤ÜµêËé²PoÙ·ù%¿Ìß‚[¦a˜† ”I²$)4kËW'ƒìݺ\C£’,1ê;7¸¡ë¦I©$˹X¾¹ÙïƘÃá “eùWf(!×4Íf·*ð›¢×”åàÒRßN >»:=½"$„™¦ðy„ÄÇÇ9ÒWj¥ùf !„àÜ4L°xËíXwÌxÇÈSÓt]ç$IfŒRI>6wú›ÿÜúôï&Ñ–=TôøñuËkË önYôØ)98ö¦ACºuëÄ$™UÛ—ÏÊ/<Ýuàô~V™jîŠ}ë—:žÒ&)uØí­Cl xs/ëcFttôèÑ£ÿ;ÿüÖ­°nðz­Ï<“YVV¦Ô­€)„ INNNKK3MS4ë ë„€¡º²¶­Þ~àT||d•*dY!ŠNìß±ukÑO§ëÓúöëk-Ø¿tíNÙBKŠË¸€ƒ)? ™©›ñÍÒ×ôN§×¿õæô¹UV›}ÏÒÏÏÖX;wn;ó…‘ ¶ž0×½ÿÌ›3¶vLîr~ÿâ—_šNl6?(Sç;±ÍÿÀä\DDˆñãaêTE CÔ]BCCSRRÒÒÒ|+d7ëY @¸÷äî%þë‘I½¸+ãªMv‡³(sÅ[S_É©²]×+aî«ã–¬ØbÇuŠock{}Ÿ. {7þ7œÒ ÖgXÆ5}ª,ÎÀ67öÛ4yÅÓðƼû‘G2ZµrzŽ¯™·â»1)-óíÓË=#º°”´”;ºj½N¼1ryc èØ‘¿÷tè„@ÝÂû²,‡††:466Ö4ý¤|…×]slÇÎÈ[ŸûèÈŠ“ò² ʹg׆µÜÓÐöQŽ¡iß­Û¸aè ›;¶‹v”H={$ùj<Œ?êÜP¡ÕìY9{áÒ-Ѻ:kÏ\¨dŒRÎydx[Óäšj†EUœ®£²´Ò&«Õâhrûíjm-x/ö2ö½iŠèhˆ‰þ㪣²,ÇÅÅ <844”sÞ¼ÇP 'ªL^Yë ‹ôº)ÌTnz<^qbïÖYo»¬`˜š' ¡‹D¹É¹àÜ0 ‰)-¹mùaÜP&•<¼uÇ‘þON{ùñ»ü#óÝ ¾zóŧ8¡V++,8Ó*tHAQ­ÄéœÂÔþQ¥§w>ÝuÀ@;øÁËÈ5Ó4­Vkrrrzzz@@€?e 0‰;meÅÄZ­û|^tè`•{Ýzïs¯¿ym$ž-òp›#8(?wê¯q#·…GEÚ½z®£"/óˆ«øLæ¡#F¥«0'sóÊ¥Á6cýþ¼!ãÓ öÀðŸý5´°w^Öö}'àoiƒ}s 芈ˆˆhÕªÕÍ7ßl±Xü,k@¶Ú;_×wÁ›‹¾œ‘`­ÎïÚ±O Mê;°]\»~ééavròHfö±cö˜î)éýÂìºÛ!m{vI`MõÀ•Ÿ/,Î=É$É0Œ:ÄÆÆ6ÆYàs7Bèœu¾ùÎîé£@€W3¤þ ç&¡DJ ¡\¸k=œêˆytÊ{Œ€ yTÍÀ"¼Wò„ hÖ×ü»Q#€à\±‡Þ1nÚ]ÒÅ9qÁ w7iÀ]=ÝMªÇcxÕ¸÷½ µÕÏúw7/¡†W5ê¨Óõ]€›Kt6x-ºRŸ?å{W‚«îKj´rIÛóýEÓ«ÖbÃåµB7!Œ„¸AaÜ „Æ Bã!„qƒB7!Œ„¸AaÜ „0nBã!„qƒ¸Á]€¸AaÜ „Æ B¨ÉºÜµŠÂpá«ÊŠ;ôÊ!Y¦ŒµØ·Ï¹`„Æ@pJ¶‡+ Œ^…Â4—72% áù§„n·[Ó4EÓ´5jøøø nàiTs8Û×ÿfè»Ä n7€¸Ä Š7€¸@Üâ7ÿ<3õ,ÅÌKÆ)¤ÙH×…™_f`re“J¶dr~¯‹‰ìI{èÊ%¶ä-_©Ù€Z-»»[R“C„øóóvÔŠ yóË÷ÅFLÄÌ¡;>ýý‡•Šb"C§±÷ضõ‹éjá—',[=nЕ+”É-ÄŠbÛ¿rn™Ö_—Ëg1Y<ó¨d+¶}ü¦õ»+vœ<øÓÆf…R‚öÿ>ç£Õ'÷ž4ݤ3±J÷NÏ1—7ïy‚Þ¯Z85†“‹[¾Ú½g®²(DDw.Ýùã»×Îê6ô-1„è»Éa ÍFšV¡\µ›5¬tüˆn! \µ±`íæU:õ _>.EˆDÌyë5(µkñWº+1IðÒׂ¹C‹¾Íþrb²Þµlm¹^lјâ°Š¹HÃ._ü\0~ö‡˜…HLytÅÁê½/Sþæö• ³<¸{vò®Ù¿ûçsǾÞ{Å]k7opëøŸ61eM°ÔÎ$¯ýKEìüžð%™€¸É‰9£ZH5“j&-1äðþkÅ|k«:¥NŒ¡¶•ªz°GñZ%<¯^˜õq|량H [ô­KfEDK?öÝá]'j¼þmi/Ñ ¼ÄMΪÚ³¢dj—0‡ï[›X †_7‘´Ú ³‘·eõšãN,û½ìÛ혈IaEÉÒÒQ]MÿÓïbú$—ݧlt5±{ÙN¯~ýò¹µŸî_ð–ÝAž¥ê·ü|_ñB^ºn\Z2ƒ}Ç”ÊCzZF‘Aîeºyt¹‘UÒ·}ÝŸˆH1yWëØý뙹ÜMº kàágõ3øã~½‡Œj6t†æø7×c„V2ôŒ½¸âLC“LOˆ(*‘è"DYt“¢fíP1t"vf"Åy?›ÄpþÞ#³J eó@«$:SÆLK[1ÉB+'ª_µhÆŸµÓ4­Gø)ÔnžÍ^&!C§LÝ®é3W ˜YŒôÅ(Ë‚©ÓôlîN³sD"DfH]½AÆ›r®Šîo%ËnãÐÁ£`Ü nq€¸Ä nP€¸Ä â7€¸@ÜâqÏ*|ÅÓ!b÷äê+–ˆ¢>zÆ{Š´•r#…覕IÄS¥’nt-™í†q5OIÒ(ØÊD”ß,Þº–LºE¡Ònt©p%õúeRêô*Ý‹¢›IQ¨lz±­\Av;:õH@Ü< •;÷yI·¸¤ä/üè9íº%2…ˆ8Ÿ»ÆL7R,Š¡µ¸%ù’Í“š®¨ÅÜ“î&J6“ÉE)bJ¹šâƺNf³ÿ‰uqÕ^ŽP=ˆ˜Ú¿Ba·èÄaRŠ‹¥—С}DBv;uèN±1T¼$ nžCwÏSýDŽר÷èJPÚ÷_I`†Æm2ÑVfa"3Ѷ´×DNžö§MåÈw‚åõ¡äS7u…µü©–êë¢ióˆˆT¦y_Sh}>Çþ‡Ðwótñ£ÿsgîÓ>ÿˆ81§¾v~“žóÏŒ¯3þy3œÍéÓÓ£ µ›w»Ë]g•,&²[ŸÌ—ýŠ«l±=Eˆ™ ¢€FTéÞ_Y˜Í.ÄL«Èó=ç&4-ûw¾K¶”û+6±ÙDv+¾Qµxê-.¢¦-¹Q‹”ƒ¯M2Q\ŸÌ%ÇÌÚ™_öª»¥­°²4ü+ ÛV®1oHÛ“b8V«´çŇ-ÂÌöcoLí?’ÝïÏÁ 'îì<ýíé슬AížzÜ ND|t•‹›ë“lÄ)n.n:KZ‹nåwtƒ&|õغÖå³´†8Ðø/7hqóRMúô2ךýö7L)SŠ<.{ÓßL6œ ˆxDHu¡›g_;ÑP½Š7âS»œî f"W¦‘èR ò!"ÕyêèŠE)”§b»ÑåJäÓ%ÓJ E[qöÀ~Í¥HµNï/èjdÙŠE¿°nrppxîJíýJ)Di?•ÀDV+éš™ô°À_Þ¹åZ¸†_ç!î¦ Í7•î¬zóâíÝeëŸóÚ½5Ár¿ÍÃ)A;ŽmùÅ.Þ5û~µõCkÁµêWÊòNU³éîþÙgN]±ä­æÛý-S¦ ’´lÇN÷¶o÷!{zF‘íÊÂÇ*¶Ø÷éј‚'QÑ û±ÏëíÝs¾H­Ö%+–:=¿ÝÁýçN+þ ¹AD&9½}îìº{´ïoĠܾ½ x¸™‹Ô¨Þ¸­‰)õ·`˜)~÷úÏßÑòÖ*]£üá Îßý`…IJyÂéJ©õ¬—~úíÛª‰3þÜŒ$\¾x%˧ǜ¾u9§!j7ð¤ª7J‰NÓ+ñÍåi"¯à?wîoØ°š¦D QÁÂDQuµÖÄCE\„•. a-®mþ©ÊÒ®V=êð¾Ãu‡®ZÁ‹¸‡))>üÚñ*•Z¤gšž|9$¡Á‡ÓËw#né>¿ý­ôš…!Ô³/›èî’—îùæÐz • h›4¥ñ‰_·µìÞ\ÒRɽLü¹\¢òU,UÝ_3îÿVoÈò>µèÓK³Q•zµV¼Ý™ˆl¿¹Víܶ{g‡N¼o,˜wÁ®’IÇáÄÍ?6¤˜ qÛ:û•ˆ{ñ""ºËë©£hlDÓæ“ÉL'éyšÊElg*§ø­¸`…)½=eX/Û“]rÍåü³jïYD¤ghMi)×uÍÕÓÛÝùë™ÅýÊWÒþ™™~YÃa×®ÜHtó>}péCˆˆ-Ö¨SÌÍ}‹œÉv+X+øRv ijµ|E<²{£Ž|…+ë†0“’Û‹u«&8½qó϶¥Œ”àµcúnóeûºµMsôÚ~;Ó{;ˆþÜ@ÅK™<8­é£(Š!:¥7gˆH"Ì ew»\ ‰YáÔj‡bR3µ˜o‡RX°¦‘{Á Ê”6 "¢‚e_Ps•ø ÃqÄ¡“Ù¤ ¥®œ¯˜Y‘û?1ŒCˆ›œ#þŒUó¬Þ¼—YX¡³6Å3íß,D«¤Ê>Ô†8öl’Nž"Ì—ãáV3c°¥ŒÙ%9!ÒV´¤…˜ã¯ˆaïRïwÖª–"Š—’,ìBÄyö&+å3fè¦%ÔÛFÉŠ Û9lBÌZr¢êîi‹w…ÎÓZ~yýèn+&'õúè J!šõ¹¸iGû&y©â}|õ¨!ÉV—j½~ ¨WTŒôz›´æ̪Q?©e˜óÖè½Ð·ïýÚ ™òt;wëŒaÿùs\ÞÊí[jóý´ ÝùyÂLÑ1¢kJþ.]Ç»ì\ÜñHL²êZ¤VŸ55jW‘̵Ý–äp82¿r­5­i‡Ñ›GVãÜêYT2¼£“AeÌÛ½ S!æü…ô+£1ÿM#»ý)×µˆŠ—"Õüwۃ…_õ“<;—;•hó(Ñ°Ë´5ùXèÿ×.b3]û¡Û‰›ù[ÜF·ÿ׈xlÖÕ¨CUŸr[„ºt%…(åo=qÎÌ"ž;wœÚ™™DH úÿǃa“j#Ug2t’'ó$< nàìB?#íïÁ_m13}¿„BƒéÉÿajʤµ„þÿmL&ƒŒû«‡çúnþ§,Lc>¢+žîÇDñq”òÄÍ¿»ryé;ý”SD.)hL=Ç„47û£‡ßº{妼Þ&O""CH2;Dr©LÎÁzšABdVˆˆDH21‘Jf…˜ˆT"ç·åX‰t"ç#MQ²+“‰hÈ0J°â˜âæ9ÄBÁ;´|¯ƒææñÈH’d7Oë¡+;›þ*Ì>JrsÊÖÜ66¹ÞÓ%æ°Ý#Èp¢æ渢ªö“5¿Â”G´6®q;ì¹" óo®nn®^´oMOÄ4v2U¯IÚ“T¼ý°ŒFŽ¤SÇIÓè§ßÈÕ‡7ÏaÜ\î8à\ÏiædR—-fk⹶]Ï”+iúc߸j-UnYçvê¥eûol2mï5ØÈÖÅK)1!Ö¯þõë˜÷ãc¹@a[™Šä]˜:ö C§ UÈÝ“ ¥ˆ;T­&¥õH¥Ë’»'åÉ‹ãÿë룊ŸÝæXæÛUÿü‹·Ž±xJàUüpè*~–? ø¡þÅÔxÄ7€¸@Üâqˆ@Ü n xbp8lqQQºãþw܉ˆ£õd8¿# žÒeqµ¥$£rLÜŒ~«ßºuÓ3N‰ˆˆ¸zõ*ŽÖ¡ªª®ãÇtŸ"//¯ŒO0À37~~~~~~§œ9sfÆ 8ZS†Áxd$GÄ̓t]ÇñƒÕ`Źš Tùqˆ€¿!gôÝ(P W®\ªªâ€=%̌ޱ§ÇápäÏŸåð,~›ßƒDWäh8‡sLÜÀs}7€¸Ä â7€¸Aâ7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq9”Éý—Y^!nàI¥ ÂB 1‰!¢ 1‘–BˆxBiÃ:³ØtÖ4Ö C±1]O>ch¦§œ6ÄòOÔ¡àiG 3ÛÈᢙE­¾»l;«'L/¿’ÄBü·nÂø÷`f]×-d¶™’÷Eÿ±3ê¶$Šá I&Í,Ou눀籓ú?f&&&RX‰1¢VÞøê–rÍd1ÙU2./HóÓoè nžC†AŠXuÅl"1±AÂä ÍL|Å~måÝÉšâ`‘$N,m«Ø¥ÔBæ2f±<í¾\ôÝ<—Õ»F•˜¼„‰Ä0ˆU/YOü5Ia—$%¹˜V¾cÁÞe=««†…Xˆ™…žjß îL<ز:lÚéÄ@bb"ƒXÕèŠqbqÄC59ÄV“¾[vrYÏê,R ræ ?ÝBc àùt"iopÒµš^ˆˆH‹S–…Ͳ¨nf›t):ª¦¥¾.¤:T2éDBüODj7«¢úØ ©“%닇­0ë 9¦…›eÇÿîÕ‡ný }IŸçÁÏXYÉc§g[}Ë4‹§›¢0Qñ¯ )êI#Ǽ‘Çäö°ƒ›åOW7³B$ž­–%ýá`JŽ8³îçCêCN–‡½wɶb’Ý›ÊRð’9oïútÖú³³¶?vôôÉU£N,yså‰x&yJuÚžE„uÍ06Ýý>ÔtC£±W§^í„Ź%vF5ñ?•69!nDˆˆ­a'F¾Ö2 ®o×!‚q̉×w¿ùJ³ºu}_îÔwÇåfG|›&56»9wT÷z¾-º½}!Jgæƒ#&ì Þ¿ìý¦z: ¶ß9ñ~Ÿ6uëú¶xå£ÁqÌÄÌŽƒTh;).tç«-êúú¿?o3y¿Áøm׬þ¨q›nV÷NR»ëpb¾ñ˺š5êDݼáÒjˆ»³"zŒ^(FÌäY‚Vž"I;ˆb§:3¨N“œ#!ˆ™6M¥Ü*± ½3Ÿ ¹µù·µ[&ÇE^ÏOt{ßu6 OÎRÏa-1lÊ°n êÖjÑýíãá1±=úʸ7:Ô¨Ó¨yÇ¥Û/03óµeëwKŒ?÷v×&þ¾¾ý>šg7äÆ‚AÝ'­Š»¾¬nÿˉÌÌaGW½Úª¾¿Ÿo¯‘Óctff¾¹ªR½Îññç‡wkêïëÛçƒÙ6C‚þ3´ËÇ?&†¬ð¯í{>‘CöýàÛàÅ;I:_9r­si5pÝö*~ ç±¢ÝÝÝ£ßü mWõ››”’ZÏK>¹ymƒ.ó+vØøþ*»Ã9Q»1cÒâÊm–4|÷ÆÍûuŽ+›ww(çu~˾’M:›G´¨3pNÆ ‹³üÎÿ6«EÃÚ ›´Yx/-ß8i×°²MdzèÖÓF4mà[¯~Ààñscmµc~ÃîcÙ¶³nuŸMÌlœÿ}v§fuý};öu3ÎÎÌs¦ŽŸÿåÛ×' lëïïÛqÀ¸ðdÃyYFž\Õ³U}¿ºõ†}±Ìª‹sbøɵ½Z7ð÷óíùΔh1“0Ç\ÝVϯæép-ËeìJoM^\;?‘ˆ©të"Eóß¾vˆE mç[öû£IOò²7¨|þÊ"z˜\ßž²QÑTÝ»wƒ "E‘ÿÑÅœ$háScÖŽK·o‡îžÕ¯ZãA±"±±‘Oµ…»¯„G„‡œÛøR­j‹%ˆ#±C‹€†ß½x÷^\lôÚ÷ÚÔ0CDìñÑïõh2rúúؘ8‰ß×¼z•™ž¿ybEãš5×^‘ÓŸÖ¨ã÷ö?GÞ‹¿w¥@Ù±¿GÛbÞïÕløäÕ1÷b C®o_9uÑZIINÖ ÑìV‡!"†$î"YzPBBäø !’3 ""½ò‰[YP‚CdÆá|eùù=¡|râ²]–º,u§ØvÍ]³Ù ‘ØkG¾øjV¼MÏP †7zÕ­9zåáÛaa§6N¯æ×âj’&¶ãíkVý`õÉ»áááAzÔ©0bU¨ˆHèŸjw|{AXtlB|è'-*¾ºà²8l˦ôlÓcrDd´CäÌïÓ½¾yáèz-ºF¥ö‹Ï µÛ¿9÷vtlBüí ­*uŸ{A4ûªé½[ví0äÞµÃS¾ú&Φ‹¡¥¤XEŒ”ä]DâCVn·°Îè«wnïiÞvá«+E$åâÏ Šv¼|üV|èíSC^YÐb‘&rgõ¤ùeû†] O¼{'px¿…•Ú\=#¢§$§"Ö”MDĸ°~î—Ëwg9#¬æøVØx6,"0¹zåFû®Ü¾~÷غüêv qˆÄ_ð÷ómÚsâÍÈØø¸ðù=ë4ÿ‡ˆ„ŸZ\÷…†;ÏݹòÝ°/¾6×!riÛÌ¿.GD„ïX:6 Y‡;I""I¿œ:åv|Æc'†a¤¿0 íNÛ€r«O'Šˆ¡ÅÌúÙ‘`Û¼b ]Ž&mw£ûÄ‹=?ºÑcbÈ d#YÓSD× =}_þi9"nŒÃ:ù ž-"†ˆHÜ/?þtÃ*­ðîêô9}Xû^£ç‰–Ø¡…ßÔõÇó'>-0$YDDÆôj:æÛ­"Æö‘ê^—¾öy£:öó“ˆÈ™O+Vk{MÄy0æŒjðêØí†ÈÇý^õõ&ç™rÿŒÉ²ö º-"¢ÙEDÊ‘L<#"Ò+¯”蘺¬vSˆd[ˆH ’IWR—½{Ræ,-Ó¹™!cî Ú0¥fëžFê Ö­?ýi?ûíºŒJ_êÀOý4$Ù ]S¹ZÃ)©ë8º¨]Ý?ê"föi×ëMDDŸÐºì ÕÑi«îXÇwíÅH¹óKŸûS ü®ƒ_·ïu‘?æö=Ri IDAToÕcºöðÝ“´¸Ùï|"rç—¹y;…‰œîØ|é¤s©óÛîœù~“Ud_½†+ç†:×ç¸s~QegÜd>öFÖËÕù×Ïü¼)m†ä>M+g‰›¥]«vš¼1m~-)Ù*"W¶Œ h4:9õˆE„EÙEÄaw¤Ä5÷¯¼=H“ø þ~~«.D:÷4vëÀÊ/M‘%=ªt˜{ɹÿŽ¤›«VmH™Ò®\ߟÂÓßyWßå·3I¶µaˆh÷&ö­×ý“õFæ÷õCÀa§÷|Ôí£k=Ç\ër>ñ˜¡‰abdwöþSrÄpãÀÅ”²µ Rê°€\úô"².¾¤W{½¤³U,D½ ýJL$FÁÜÞ©Ã\ÌlhZ¦µÙwŸÓØòÓ  !bŠ ‰²—¹º¥\¥ŠRj[V5™HwdíúMk‡gmï™]hõXúðòô"U¡8"«FDd8¨R—ÔeUor%ºG/‡Ò-¢—J¤.^¨ «•í†(óHˆË!Qùòäg"afriÞ«/ýp=¡xérD$ÌDä]ØÇ¡¯·:ÈH\r—vI]‡êbfÞ¹ }ûÜmKìÏïÜL$ÄŠGŽ}7c_©Ãbñ*íš¾ …õÌ >d÷Ò‹£PáÜ©/ úx¸EÅÞµ£ÂC ¤Îo)\½k¢è»!¦Âu ¤–GV²ïmϮ̭GoJå…ÒfpË]À=Ë‚=çÍÛòúøµ'5nÛãµëT-û@g”uÉØŽ¿º—+—‹$ꪡÎ^¤.©ïÝÕ†ƒ(éÐe~á½ÂÎý7¹—îÑ£4QØésÔo£î b6îÚ {¯Õ,z/ã"C#c™È`ײåJ¨"Ĭ%Üü¨×à‚}VNèB"ü˜Âü›L+¤*¤¨ªZÝ£iU×Ú¤RÚØþ_]É9cÜÅD]Oïàg&"6+¤é÷¯=Ó‘{D˔ͪ”ëôÎâ/¦®2ãþ{-ZfZ8œ>ÞMɹ0) Uælï“Adb"•ˆ(õNÈùøª¢¢Qæ‚0)œz¤N×ù~A<úý(¬ë->ù~d¥ ó±BáçžX×¾" +¬šDs¾M1Òæ4ôÿæ¦0+L†qŒ%zÎl¼ü·=Zräæ5K>ØC©;jÏìž÷ð§7Zÿ™{ì#¯©"ZRh»—[=¼K^1›Ä¦eÙE1Œfã–|XUÉTzœûsñ[߬7%9*í8¹¢ 3YϾÖê•‚¯-\;¬Iú'ÄSê&ÑÙ¡+â°†·ÎÛWRŸ 9GÜ™RšÖôºtôºóîsÜg}{l¼ëÒªŽëé]—Òn1ÒÙ;A¥òW&ã‘—3‘¥m]Ó{¯©Š¢(ªuû¶UQsñ°ó7yè-ŒËaT¡*¹©ÄL¶@ºœV´Š™.­K­ÙÃÈNT%QªF´pjÒ]ßJõšP g;š%ã†|ÊŽ¼i%bfÇü!½æM|±z¾àË¡äœHvã ÙRÛÍò˜r`"¢bþUùØæKŠª*Š¢ª|ãbðãn<+ؽôkîîÝøÔ 9šh/^  ¥¼Ÿºî¢³(Åô{—÷¢ôüEJ;Âv†9W∽C†<äFÁƒw’\ê•¡s'BÓv <",9Ër—Ø…Mž…Ú»oËTÇÖ— çö&vßen5¤­‰ˆ™S®®ItÐÃÞ»NnM_Po8å\Þnè€!R¸žýãBÆÒ#ÎøTø½:öø‘‡œ8{rEA!Ãq¯OÛWk\=wXçlüøÂü›tÅpÑ=‡©K‘½wÃôL\é9"n¸Ú»ŸûÜY1èËeû÷í^üQÿM1%[¦zãg>=}ü’_O:¹é‡‰ê½ÞêýˆµäR,—Îî?xèp­¿)}á›wf®:vâø®_¿ëÑ©Í’·5~Aq¹zþÀÁƒíÂç×;bò~ðĬW•Î ;èÏ5Ôv µr§Ë)B#!²…ÒÄE´w ‹¸ Õ(LDôítZÙ‚fÿD?/£–-©ì rËT]Š>¿cø¨1±¶ŒCz¤P«>mCnÄÙ±`bÔñ=»vD&Qäù#F}c}`Ä‘Ýœ0ó̦anê½,ù‰Ê|1Ž·MÚ³`kÈŽ½{zŒÎÓ(¿Jßï7ïÃ3…lÛ¾{èÌl?ê™åä¢ß™õ[æ"çc‡›>ûzõ–Ãû·OøF´«Gæåì«?Öü7{>vxïÂóÔ:Ê*dñ((Ég·mߟ«mCÏ­³¿=vúÔ¶µ³ev3ŸÚ·;ÒÊÙÅ 53Ù¶eøŒå¿ܳyòÐ7B½Û–`êøÞØЕýþ¼õ䉣ëæoßkàåh+3'†¾÷Îð›±F–ÆÛ‘Y}/:ÖʽeËæ­[·lÙòç±+·‰Yô¨OG ÜqÕúD«:\ÜR¶šKÝZ.5tVÌBÜüå»gJ¥ÕÛ6• ßñõ×_Ÿ¶´Ø¼qº‹ˆ¸×ùsç:׳ë?ûìÓŸÏ(«·ooVLˆ¸Páb^niDKžE (D$ôáä‘y#ŽÌ^ò‹Ý\mÃîß‹ßÞúŤ ‹=3ùçƒ#^*JDdÉ[¢XþôCž+_‘‚ùÜHhôÄ‘Þ1ÇgýçÍ ä{á!w"³©0t›JszÒðþ4q%-ÛL ~§äõ´1¼¼iÐRò÷Ý3ëç̘³Ò÷“ ü*äv"b×ü%Šärùô·ã GÏÿjÒäi3oåëº}ù(³H)¿×[ÔpýϬy—£ŒÎ_oíïò¤qcw„_õ㔉¯½´sù·‰nE‹uM« °«wñ"y™(Où{7ÎݺtÚÌÅæFŸlœÖ•DJø÷Ý·qÆåßLœ8a[pÞ'wUõv!"Ý‘|;4ئe©¬hW.¥ ÜýÏœY‹Îsþ·qÿYç?ÝÅF¸™s«¬ˆù™fSžÏÒ¯!’6|%kÅ;­,õÛŸŸ‰"BôˆfBj!¤Í쬧͟q+’Vÿ•¬«sîÑ_GÄü˜ùEˆ£ßlÖwú–M^æG”ƒ³‡,‡ ¥ãlk¦½ÌÛ•Ì]•™ßÚ£|ÈeÛý$ÎÓìÁòÏv•ÙLt<íú¢q¯=ðÆ\¡¤ðlþ•ä¡½¤ì¸óü¹_œ?ÎqŠ–gèßÎtê<ä€;wuF¯vÕgþÞ¢=ßðÏ(->ìàíEß’ü¯/ŠÄ‡ÃÝ}Êö z> CD;tär@@µçþ‘"Ä  ï7ˆ@ÜâEˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä nž°ÿ{¹†¾ë{ IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/dsize.png0000644000000000000000000007510413051004444021236 00000000000000‰PNG  IHDRzsº^»sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ;æÐàÜ IDATxÚì}e@”Ë÷ð™g“…¥AD 0@º‘°»»»Åî.Ì«×NÄn[»èÜfó™÷à ,!÷Þ÷ç½ÎØ'fNÍ™3gÎœaŒ¡ àŸ¢ Ð Ð`n  ÁÜ4@4@4˜›h€h07 Ð Ð`n  þ]æ¦|Cýÿ×Î:®ÒsÐ«í¢ºÇ~•¿†FÙ-Õ»jÄ5]S¹‰M^Õõ…ÿšX~¨Ži× º%ÿ©×5 Ä¿*î8U ÕgkjÿörAcÞ /yÔS&{bûu¶P¡ò¿¿ªE?.[óf݆¹ºDtN^ô~ÇösŠ 3{Ÿ‰£zh á³Y³H)„*°¬Øs䆾Ž²ØÙ3µ=&NèÞc„@/l‹»]¸2nöÑØŸòH@!$‰@!£t‰ 6ÌZ4:–§A#U%åzasw4ÿš|zÓ‘{$©@€12¶uê?fHc&<›5k·…ßèI}œ0(¹‚s÷,O–­Ÿ3®ŒPüõ˜UWÌ;.\eRÖÃ×äS›Ž¼ž·¤­n¬¥¯ŸÕQ± éñ›îiÐ ‚@“`ÓÅëçèýN³R·Þ\;r$ᩘLhöÛÅÍ ø¹`øŠ¶ 7v³¦—=Ÿûîfìî “bÖ7f—\É|yíèùÛ? „4 ·àŽ½CÛ.á–R”ž}'öv·-W4Œ®í^söuîð•«\´òL’•†Ù˜ùkí¨Õ`ýsѨe<‹kv$”ZPüóåÜu'ŬoÌlŒ^ðWž(]×õ·˜Ô€B˜™Z[XZZZZyßž¤|3S¾ic¥G%„/>Îf™Z©¶iaÕØ€‚O“_Ù4·³³³³³klaõâ\WÏ߀eÏŸ¾8¼'ö›¡ÒIœõ1éÍÕéíäî?Ó>þHXS€Ë§@aÁääWb²ÎC±–¾ª¥i6²µ´°´´´¶1ÉH¾Ÿ*Ôµ²²´´°´´µ¢þO,J Ó)Bw·ºú²‰Õ—WŸ­õ¥ëÇF,>‘Š_>Jú!ªð¶˜›ó49Y WÚVîÖè.á#V}㉙™&pO®ÐgfZQ Ó…?ž&¿Ø¸ûº .øä•s/“žÊ¡LÜÚ¹hii£I¯Aé…¯Ÿ$?º¼ôÂÛÂ2¹(„…¥ˆÉSŸ>ý(¢Ø¨6iiik¢–­¥¥…¥¥••9ÿÝÓg™2kKKKK+[ÍßÃú×G=”ž(I’cD"ÔX L’$Ib„‚B(§r¹BA¡PHR!c–æ÷‡ßXþ 9& D*/*Q)%WH…œ‚J!0ÂXA’c„ŠÊ r¦P’T` ATp™Îì>Åöê»9vÚ‰™¯Þ¶1|``àΤɓš‚\Bt?5B_ ¥Žý—Ìx:ªïŠ„ sµ@¶oDÿ¬ãNŽðÀ݇OQê×ãõß=iÓ§«²’T ÑSìjù‡€=pÜxkFÙôËŸûÇ‹3£@LsîíôiðäÓ·¶w#0TyÉ»òäEçèÝgVM{’RÙJ¿Þ⯹¯ê©ðŸ=Ç_ÙÀ‹‡¾‡ŒœÖÛ\­ž ŒI’Tαˆ(• Æå…‚‚& ¥ K¼À …‚ PµÓÆw6-|h5£›;…@¨'9kïÎäè û[æ½¹ôrü¼¸ðFŠ‘§¶ÏﵩVÕ¿1·çîúñwζÕ,óÀÅ“ûv˜:mÞ…}±i8¿?x!oTGCôÛñ4äl…^ªŠ{xô4kÆ/ÈENM謵hîöˆóó¥Î”*ضëÝÏ«ê‹“§OWZ§#/Îÿh=µó¿>vƒ.Æñòé;xX÷ÈàŽ}‡¥äH*?”ó`d·H¿¨¾£‡õð ±ç9ç··÷ÖEÓ}}CFn{±qæüL–bËìèÕ oU_Í8> YÔ†²Ÿ–†x½¡ì÷Õþ©Áž^=†Ü«Ãæhùj“ƒ_ŸøyýFO¿ z„Wh×øÇß+ ˆAA\A!€0 ý×_Mq§Õê…õš¿Í,çìʳ©Y÷wí|§µmé Œþ> „´m¡à'§dãq:Ï\#±öì«P×ÿñš§’à‘<ÆØ®ËOÿJïµöõ—HH;:·}€_ç~Cöˆiß%þQÂvØ ¸°jظé ÏëÔqÏýÏèþ~­Û/–”ŽQ^Z¢··Ç£ŸÒêÚwíÕO÷Í7¿ð¡ÓV<ùÆSÚš*žMƒZülfm94öî±MÔÚb8ÿõÒ{¢aË–´Õ¬ÆÌ5óûe={œ¯(5 LÇÖ¦—v'R¶Hž]v0¨¿/!’ýÖ‘RI³‰û<ðÅyÛ‚ÿÌA£z9¿EwN$ÁÂku@¶820îÜÃøQ*Ó¹dz ·I÷‡kG7åLÔðÑw‚nQ™túe^ËGÖˆÇt]:cóæÖ”Šñ‚Æ —û.…Æ Q€Ì{9~×Ó>q''Z@ÜÈÎt†6tSôõºMü¡Q¶{P·¹[»ÞŠÓVQüNcúîë;;|(v”rå¹?‹±žµ$^CPñÇägºìrµÆ4Cצ„±›Þ?&|ä”— ~u—ÛP1Ô>0¯Ÿ$qiŠ²($¡ÑÖÍI£Ô¼ÓUæ:yþËý)¤ç»ÒpšBÃØqë»aó7]X¦SA×0€pã²DßkØ=çZßkOÚôðæê· ­±¯Ú©¨$Ûsz¯:6ÜÇN/º}çêA^+ƒ©ÁÿxÆ(~ÿlèº,jèöÄ‘~MZ ^Ñ|W·ƒ¯ŽjMA½yrša>ÀÅŠ¡žá±LìÇÆì;ëÛ¾­{WŽˆ”ZúŽÚË×ÍI¯~†#¦w3É Ì#å?²ŠššêQK£/ÁÏç÷äÓ%Ë{"/í‹òµüŸßärkÑÊ| „€Ö²£;cíŸó#;7R²dXg·î[ÏH!œŽ8©;ßÉ×.m³T¡ju%/Ÿ$eÒÊ.aŠ–[k³š$†IÒ^>¹gû…kÒ†œiÁª|Ÿó=õY’*ÊåeÛÒ¹‘6ã¿hnôò—KÅY?s$­-àη H¿¾Nû2{„B¡{ÿ6Ôµ÷ß} hÇÀ€zwP:Ú ‘ÂR ê¿Éüúh( ­µÒMÑÍõàò4¥@åD£™ƒ0ԢϨF¦ß+€(•ae|öúõc[V8Ïí¼“°ìÀ¸àf€Ê„S+¦VéH pïÊÒŸt‡þ­¬<+²è¥P''€ ¢'Ûª:RŠÙñ«G­@ò'ôéÇ d¼Ÿ¹B¦ï¶åN€Ó„]^·æ¬ßí§:È„Ÿ“xÔ¾N@o:ØÍrç¾CŸâÛÕßÁ©¶¯š©¨CL…a¾éÀ^…\žŸù“'–ë0yï2:9Ílö¥4ó·•ßHhÐì<Ýlïǹf(‚â«ñ#Ö®cªºš”¤Ô iÚ ¹tØLøvïèä%c/.Ý1/L ×>+ïzFÅ,]›ÉÍÚ³ÍÌmëîõ:Jáéî¥ÏUšÅ$©ü!–@ƒE«"omS]œ’ÉPš°î87êLº¼·õýóÛR'S­Š‹JÁú…3U~+ÀzÔø”Ú|C£©³®]>öÀíƒC*Ýýzõà´„ ˜MY{¼‹‹ÉÑÜÈÞOé5é>Ï S¸«ž&==£Š2‘æŠíã|—„„¡˜/hš^SÐfiÂ/9î¥Ú !ÐÑbF€t- HEI\3ØF´’G1MO“ÎËæT˜¨¦Ó7z#gà£6sû?š1³wñª›Ñ.  7n‡²«¬£”þ3‚« ú½Õí:¦iâàá›ÎÆOfâÚ] …zì¾9©)Q5štFFÏ2¦)ÈMK§6ó¹ÍP TšÅ˦h7)îÍ?ÕØ̳›‡bÜ9»ë)"@D5þzk¼ò¯­„Ô÷UuÚIÄ€0gÕ豾煄˜h3yïó¨„ *™ßš”ÓMåúÝÝÃwÅm>ªvì8Ýqb•›„²S¯¯Ý— Äž´l¡ ½r=~Ó¡‹™Å:Q®v•ýLŒY6~+÷:ŒŒœ0gëâ‹kf 4åÖÙH YOOôœº4Y: äKÀ€YQ[9? ‘Aãr>‰ÁpÀ°fK—]è½£ë½Ãñ¾³®ð*†ê ŽÞ:[Ù™Á¸.i—iq[:M:ñ4¬»v…ëÎãÖlêíõiòßen0¾½zÍC°{tc«2ò‘ðú'•Ö–T-B\<íöëîz•¶ÊSýb@!-ñB©T†b™¢D‹ ˆ@e‰I Æ€B(‘3ØÌ SßSßÐ;™2±œThèš8‡ ‹ô¾øîÖ pѹ¬‡PvÒ¡‰ü­§‡»2Úꆕ}=¯ óƒ/·s_( @¹ÖK?¼÷™]@g9¯ˆ vmZ|¹øâûëü%ES×WµTÔI§ÊHJ8—šµíôm7c€÷;¿]¸&­ig !½à‘óCv½µ8{ÇÞ=LA…„©ššš '™Êw¤œŸ÷n^Û¾qÈÜ1ªóèÍ}‚éF–qs?dó[6·‘ͼqóIfžj»ð]1¸°Ô(“—(›¾µ­†ß|õÁ§q\š³I_Ÿ¦0ß쩧:‡8 ’Yõå›öT«3þzÍ €Lª†‹ulôF®»Ç¶ê=o­çÖn(äÕÏËÿ-ï&“O—æ ðÞo|¿Šö†ÙÌƆ~ïø«nc`Ñ­+O]CüÙêØ¡LHP1Yº,$,0Š_'eC##+„%ééüfÍÙpãæ':½dˆR$Ùç?Š&9°ïõ…<¢…›i…NVÏE ݶq¬kɈÇòBim ¬!NŒï§[í³àš‡¹@«ø¸¨àÑ“¼|¯ú°ÿ–‰@£èÙ×/Íì?ÿR Ý*t›»¥ûø šQ€ Y§w=Ôhs'v‰Qî n»|Í#ÿ¥Þª&í—}‘*}Õòt¨Šùbj+)²ø'˜ëÚ^2ì7Îs暣Íù©Á«T46`âÐnñâve8¼=8wàÖ;&­‚מºí`Ä,³[ª¯H^Æ÷œ—œpã˜eÙhÏü)Ô`ëך„¢ÓbeWÃá‹çøx^ l¤ ã!…Œ?mÅq[ïߊ¹^:-\œ¨’ý1ÛM\Œˆj$]."Œ¡ùmþWÚ-‰Óª‹+𛛜ú˜›Èö˧œ]¸ÕΞžyîΧ™Í¢ãÏ»c[¾bÆŒ™ãút›5vRnoO[­W·Î_}§}Æ×·²¹Ñ±4Æyk¯òõ™Ðե첮÷pKΨÙëì{¸žßŒ×¢ H Ý½“©dñ´q/¢dße‘ŠœT®¦¶ÁçyÝ–ö¶¥çýyôŠ÷¸u+x³´yS†tš0vØ«J~—¿~ôñ7I™¶'·ù€ø•Iþ»à«Îæ­#Çöñ[=ezQë¾;›Æ®Ï‚Á>ÝOY’¸wQÍ¢¥PðÝm‹ t¨*™§$Òl5on¿ªÒ5zÕÖÎ7œ{³¸sëJ늱ãÁ©n½W>f·ð€íWž:¶íj@€ª 4äÐ’¥ŸDWîºÅ ´(%‰¯H§ñÂ#ê’ÞUµ¯š©`Ö¡M»6òâ]+Wn iʺzîtxH›³»^î:vfˆ3ª~mý*vÎ|iÔ}g TsT¾‘ïÐ3slŒµËŒj•‡‘VÀÔY^ÝzuêìÛ,SX°fQô£›·í».±©S\fŸ!61ÒßÙ¹¥™±”›ó9õµ¬iýkg¢ÊÒן;©y§˜Ç}·¨²9VI(%Юÿ¸{³ºÈ€;ghÀìréÕƒ‹R/©DŠAB6š½b¢ÁïíÝP/^ü«;·Lïp{VÊÛ4i4qÞ¯`(úœ/Òôl¡—­hâÓœ@ kçÝ'Ì>ýýÛïYE¦N‘ë·Î5c ¥¹åEMYeY,¤Û8›bL÷éÕ_W”ñ5=W¿Uä‚Á?³¾žÉ›Î溶óìvj–Ä­Ó˜¹ƒüQùˆD€€mã6 ³kQnæϯ_Å,S¿öëWÏ4g¢ì|™6“B ´õmÛ½™,ºh‘% £]FþvŸ’Ó$-|šê”Xj17_Ä6pwT™Õ¤Yé\ªÐ&…Àº¾ŽŠb._¦éíçÅ¢”Žs-3_¼ÇÏ \ƒ\4HQF6ö ñ`•Nnzö¡~¦q“Ö¾mÍR^|òê3¹E#jùÈ ¯ß(³°ÈÜÖÙ˜YÌ—14(åÝ"†ŽŸ·sµ!ÉjûjåëÚÕHEé4… 33ôÚ¹ZhT5m‹Þ~6ŸÒÞg‘]£×D††Z‘é¿ ]½Zåóèí<”;H¤8?Slìß’€0¦éi=ÙwÜuÂä æ&¨F=ÔÔ7ÐaÑKSéÇ9…õic(ÏÊÉùþ5³QãV‘#Ïíï’fýà8øÚi—sH.#Oß:PÛvïÐ\ÄçKäXËЦә‹ÇuÒ¤–¨–DÄáËõüüZS´›¶-Ìdâ«<ûGaë €Ft$)æ* E ÖöζÆÚÕÐ&ÍúÁsòק–8Ftg{z&ÅØÎÓ7@‡®ÈËÈÓÑg£Š* r¦GˆGY:Ÿ '“bëâ[‹öÿð¿Hün[ Ï>¹ŠºÔÆaø{Vî]Kÿ}èå}8“˜BP«FzG»HÿæÀüOP¥Ó¼s$0ê¦Ô,]ÃÿSæUžÿ6éÙ¥òÈ•3ÍÂ'sXÎÍæQzÍÞ:(®~ÇvkŽèý>‘ ‚ïŸ>c1Ô¬tíÜÂþ«ææï<Þ Ð P4”×j€h€ßy1¥ÌwÊûòðy_NX4snÛÔ€43!ᙼ,ÅŠTè9‡ûZ0¤/%ª¸QÛ "@¹; O}öäkV!PY6-],ukl§2dqÞ•ë݃;kRþ1Éž^¹-<\ dWî=wŒ0b•ØhaÎçï>s…RD¡Y4vnÝ”R²?ʽqöŽ˜ZVCé4jìææÀÄ*ÊHyø2+ }ˆVµ(«¾ŽZºÖvÍ,ôÊëI2®=W TÁ/%e–®QŽ¦´´¤{é ío§ŠmJ^º^T¥Zaìé¨s1ñQYJŸQȨ^ÚÉkéëS>_y‚ 2Í­Ú´nF¨v©ç6¦äí«W5¬¼=[•Õ*L{rç‹0¼}‹¨3•¬"y™Ï^§åpDˆ Ûº µ”‰˜Þ¾œ`äÑņ{÷fª€@eä—ÔÞÒ4hèÕJU(×Oß6 êÐR—¢vD`„’î^Í—ëDy©„¸7ÎÞk·ˆ j¥×dܬk÷Ÿ{…Dé3$/]/T†–¹]ë¦õÈŸÁ'ݽ F^úÿ9sƒçýµð!1VMÌè‚_2ú.;26°‰<ÿ~ì’M–Žö €”+Z6 ôµ`ÉÙjÕH[C™ÓÇ´hà…bפÈC¯åV¶M…_ÒsøCWÿ1Ü׺Úv*cÇöýS?¦C'Ê?™ß$OØ«½Å¹ ?veìf÷H#V$nž8óð+=m–®¾®”S(KŠ }NŸXeNÅY›..vp´Ô$0àbNvf‡aÞîÜÑåL€Œ·×V®¼Ó*¤sSþºLÂÏÌ. yFž#Ž­¥\écQÊš%ËhmuU¤GJ¥faŽ¦´ÛÇ÷\7­bnŠãccS´ ¬tYª…ž4݆FÚÛüyäˆ!\ž. éY7ÒÂ$2Ý&Qí kékï¡79-¬ÍË s³9‚â"Òtãáø+F¥àKM8›iŠ^$ÌÞv>áì^] LŠfÏŠ[Ew¬'3BŸníè?'žÅÒ`éèB_,DzNGÿØlʤ`Pn_6ßsSÇþù×úD¡ ÀÒÌŸY KM°ÂÌ©KEs“µq~Lð©öêÍ B y7I–\ß á¢gy‚YÖæEKóÙ &7}­KX’•»råvï(}Fq|llšYS#¶B.ÉÎÊŠb]¯GV[kÿêôIÛ½{nûÍÍMý6ÂE Ú·pìòÇ÷„U37\Å¿[ïè3UPuƒSü­‹ï‰§™•nü86«©wÏ/<¹òÂÝ¥[u\¥¨¡Š¿?ŸXì5œGb\Û~.Iª}¨ú×*Ü‘nïé³>á-ùó‘¯_ cŒÓöŒpjôÇ‹,YéC¼Üoã;û!1Æ8µC ç ïËnbYaroç6cNe`Œß\]çëÛù[M[²•^W¥?Ò:rè¶båïÂ?{Ï®zJ·OØqLL•;E£}|&{Róžë±>!KΫޭ½¯±KË®ˆyy'ösôíñFTy3·¦v0ÆX¸zGäØCJšæujÛm §Dpõ`&™{}½›“÷Ú„”âÒ÷DœŒ¸Ñ~‘Ã3ĘĘ”þèéa¿æ¡Hå­Ìž-6$Ë«Q¹ÔöÎëßU+¶´-=½£Ÿšß.bÉcÕ·::¯œâ3bWGø©7||}_ªŠ ÿK\_O÷öÓs1&Õ$*$©&{$1IÊ'÷÷ž´ùe%´· õzÄn0|úã§ùâ>öÊßVa3WM7CªiÀªð(  sXtÕýL:ͽ{f[c6Eù³¥£¬X$«¶¤ú#Ŧ >&°„..pwuDz)ýzvrië¿òü›×ç7 Ô'ÌǽçÔMÅ€PáÇÛ{‡úúû„öžpûc!_=É«­SpHû +OŸÙÖݱûa¡ô‡‡íííþ”P[yy77ÕCZ†ÞžºtÑ—èÝ©³Wör2)ƒ0ÛÈzÃ¡Ë û””=A€å5¨z.½˜¯.=¯³ÿ¨ú:¡cÞ6fÍbÞ—ÆQwh¦6É‘ u]•7©ÀXM5ÀšúRY1؆=—ìêÈþ0ué]µ»ØjÛA³ÆÇnR<Û°÷~ïíé¹ ¼µk¢uÊ ¤ý31`Àëâ¯Zû÷šæÀ(Íåej›MYGpÓ.>ú¤þHL€Hëº5†1H3ÍèßÑÝ#bïÊò¯¢òÔb…” Y¾ÏòýÖ¾!u•U…Â2h<ãðQkÁåµG¿ Tœ¾sÑ8_߀@¿àŽCO%e#$×ö,oèäãå=>f®äiIvGwñë5'S„· D=¬Í·),cÅ«Ó:´s÷ò¿â8W¦ŒeQutRn˜8zÄÄÙ±?s0± @žõ|åìI#ÆLÚuñ™R¤T–¶‰±!&åb±$ûݵ~q_†LîÁ¨¶\ACùI¯S‰È>NÊ t,}cÖ«¥m‡®>zòüí^g— ÜúÁioüñkŽS®Ø•&€ÓÆq;ì¾çæ­»öô¢M¹OPtsîªC_ÖÞ}yãúÕèæo–îý¡­§Mè7õ^¶,¶©0òŽ‹hm†uíâV/5cÿÇ7E9—¬Æq阥²µ)Py”•éWan1ËبžÛ‡€ ›;ëõÙç¯e—¤b²XÄÒZ·I™K+¼$Wàºtÿ+}iFôó.¾{¨ðWÚA4ÌÜ, Ý;kòøéËÛNÞؘÕÿª™@Q˜þõg ÿ>€ËMB@3µ÷Õ€K/>ÿÍc¡Œ÷Ó F scsG?6µðîó¯å¸c…”°\8,ìÔ¶%E-K~£Æ-§?¹€7LŸzö‡þÝûw®ßº·wšÇúèîϲINÊí%¯Æž¸wëÆÍî²>ŽÝýFµ‚ÆÉù#Žä4¹q"ÖLã?»É++~¾˜pÒ{厣tYþ¦qúçáëëû~ɾz¾ÿÍÜ‘“&½{hb·° %gWw1“ B¡`ë‘Ä9G„[3é̹°‹»)#.²ñ¾íW‹i¬¶CÆG¶€êÚQÅAðêLŽ¾»vé!kL‚aw'sÐr §ßí2¬Æ![/ëâ7Ÿù`OWP”š `ÖÝ×=餠€âÂÞÇ&ýçx³4éºpà‘ÓÊÂ7,#ÛîÝmA%êY&Q¡ ØÚLå=$I;y=J¡7gíR+Æ4£t†”^Ý:gÿ—Fq[ë­ÑÀÐjÍ+ӵȥQ΋T½@3ôõƒÕ5+Xò–im×Wp0æî¼ÜË£–<÷_íKSÏÐS¡M Ëq IDATôéuj‡Uê"„Æzîk÷¸¨Í6N…ý*3|6²Õ¯b¯4ZšÂtÎß>ŠœÜFsše¯vóÚiN?|o°ocUh?dùÀ›>^¿°<´A6`h¿”ñ@žñðEJ‡]'•M»-Ðá;¯Òš™+$ñþG~[#Cj쾫ˆBÅ@…F}¶cL\ŠÙÙcqôßò¼f}Ì •@F“ÝËzë` È,.~ŽßÆ»ËúúŒ?óbSƒЦe\# ÓVMÍêpÜÄÂóáƒ,¥^µ9q”î´$þëÜ¡icºÍ°giÃ$…Ÿ·ÍŸ9XrýÐô¦Õ´cª‚l^ÚÔ(PKÕéÒµ )ÅE¥c¬eÄ.™Ù(r¶nó÷%ëZ:­vönܱcˆˆÞeaÛHÝRk‚š»™ÁÇêÖ¥K Š‹e€¨ÝÈÜF—A¥HÓOœÉ—ЀÊ@{¸î/)G3³k=>vc­¾SÁ Øi–$3JøÄêW/iÕÌþÕ€÷ì=ë»;©Ûf¬é­_í«˜— £A«k;ʺB¡wǧ=µ2z;lYÂóÃQ)b¿ÌL‚­Á~®°nEùɲ8 Yµ4Þ_Þ BÏ…šïßS`»ùÃœÝ ùƒÂ Tµ‡6táŠ?ûÏKìá‡jÙóåJ…,:KÒy ­³s»&R0 „sE"ÉÏ\vxÈÜvLŽ£Z‡††…„E†ºÙb €¨?îlúþ͘µGÍ™¸îkÁßÛÜ °°Öj1 ÀHÛAŸÅM/Š“YZ˜5÷A”íEÅ`ʦ054pÙè5öhËæ½Ì€%)Q &ƒŽèúM¢×-»â>üböôî&Õµ£2ÉH‚F©5š º7l¼õH0ÈŠnœ:¼aÇŠ-çÓ’âÇÐ( SÙª‘KjˆèYXP1~öñK€]+ €èM¢Ìà$üùçF¥Œåp2©Ba*eyðúºë¼/ò­­ÊŒ ˜ _e¤Fƒ#—«ÝT©Mà¿Ö×óKw‰VK QÛ„Ÿnßütþ®³A¬·gŸjïØÓÕ¤í_a& [|¹{ Â{•ma Hôóz!´±þû†ÆÝßy\ Ë~¾{ù³R’X²3;Ãç©:2XÇ.dyøúè%ûo.s©¶9„¢èóçïº!ÁbÙØgºTÖîNÑ+:E¯àýxyhïÖ˜q»oL=µ²Oc@Ô\hã ©S¦{><å¬ñ÷çeÿ/b7F!¡ú?R¯–(‹âÛL±•‹ì?xÆÉJ2?ÞÃØÎH Ò_œ2xxº¸Ôä?Læéù7a&®ž1b> Œ¦ðeLCvµí¨‚¾µž¬ ÷¢¥$÷éã§4½à>/œYÆJ>¤ »Zá´·9¥^OÌ©ª½•/趌 aÇ/‹Iâ*Ãœ%ÃŽÿþ³€@ŠR³JVªÙU/Ñ—¶-زt±„äÛú÷ÝæTbú"~Îî÷Æ1K#~ñíü%ãgÚô^ÕR_£±ÿŽqmb'ÍúX6qü3LâštóàÕ,@¨$o!¸{x]‘”ÙÙ·õßG2BH~âÑs×n± ×Ê aC?Ïä¤3ÒÊhAÀ¢C- ,Þû²:;‰NÎ’Äuš8²%0›™›*ž]ÿYªbŠ´—e‚œÔ[/8 må4~ÉîQAm?Ý? @ŠÛ†Nì³n„7ž9aa­sÏ¿e1…@ÓgѸf“»–Ìf@fîˆÙã8vCsƒ‘“¦,-žîg«WôùîšÉÖ^4B€m[9Ë¢g¬ÑÕ‡&É?¶i½^»n]L©”!Ý7u›6`ÁööH˜qxÍjÃ34¡e5í¨‚®S¨nFü{ u,HpwLµ¿û´¾ö $y}u»Ô>¸ZMÛwÝ&/ãkúÍø=¹•B*üø`ùŽ³cæ­lªO©¬ÎüŸìŸ×dhðÀQ#,ô±„—öôfü¥Wƒ'·`Ö ¾—˜˜J-Ù’@LývîªÝ Kºu;‹&'ü‚Œs{·¿g¸î9£]J"høÕÍHKVaþ4iáåhÅEW¯^-»A1lêªyï“o^ãIU¼9f·‹ð©ù#D5÷%ædݸqdb~Ú£ û/ì7}U€!QuVm;NO.žôP³ÝÍI®ÊºB-úmºê³zWìqÛÄ!æ„àzcбݟpkï²9[V-—ÚýVìè1Æ&Ag/®]²pãª3ˆ©ç7tÝ´!A5´£ê¦¦KÏ%µ Ó@4†¦«4*€¨líò,c†&›ECV»¯l^³|áAb8øv½t|8 ch9zïJráæEifSÖît¼Ôka ¤üüwïÞò%¸šÕ‡ÖŒ­çú$^»ã‚¡Ó6 òêƒm¦,¥*S´ØlQÝèehi¡Ã[Ö–óSß> ‚¹¡hëi¿?¶a%`L×1 µq/„K¿@Ðt Ùwö¬¾]1@jç:ÄËц¡¡…¸_7l(ÿr´êÉb³¿&]Š{r©BœE`Ú¦ÜÜ º&[‹Y!¸Rk_Àùºzõj ½…{ع[;mt(¸Jà Úv܆»è&í»–1ñÀQ:.{²4nJP¯m{Óú oQ/fbjÿeG¢ú][µ9~ËåSíAg•êyYzµæ£Ò¸u*Ë[®ŒößÕWw«m°ÞÌ5wK{P­f¬R‡¸.h@”¡BÀ¨"#+ÈY=új®°¸®ƒj}çßÍ»ùWŸÿ16¼󅧧øÕ»6Š,ýŒØ’°™Ë"Œr^Ÿ_²ýéÆëW}õN®6@4˜›ŠŽðûý^£—¯8tÞɘVÏ&â¤ÝX¸|Û‡<¡ŽY«‰óc|m˘~4@ƒ¹ùÛ›à¿Üj4@4˜›h€øBý‚r^Q‡Ã'q…´LJ¹_Püßb.w{ÔÜÀb‘Ëåp8./–Ê¡¶ä^©ˆËH+xS¿RÃáÈ*¬'åG*'ëáÇ©Á§Þ< ‘Ïåp8/*HP“µô«bŸ#(–ÿ•F¤Å\_ò+Êù\.‡Ë'1(”4Õƒ½ÿ(ä.‡SÄ+,ÿ+ˆ)¤b‡GˆyE<±âÿÛŠ¤ÚÁ¡‡gÀëü åò‹nÎpuqî?qëëk˜Ä’Y#gç¨)RQ|`zŸ@wŸŽ=»wvsu ïu샤æöÎ,òjÕç4ÆXò3yÀðM¢_ÃFº¬ƒ£³»çñ'éåÕ _yzz^x‘Ww’Šnl˜w©> r–Žôóp íЭ{§pGg°Èa‹þê·HR>¼ƒýð5/ÿJ#—âÂ=‡œ©ûóOb{º9zwµ€«À?Ï,÷t÷îÜoУ¼ßDŒ rwòë}‹R~QîàãÝžž}ó0ÞÕ¯e¿#?ë/1tm=Ùµgi­ÃìK§7Ñ–µ÷±õ ¡>‚±úƒÊ}¼j6ËÕ懲¯(‹°Õã-íªêþ" TM‚ïÏžÿ¤«´€Ð÷l{˜¿xßõˆæÊã²#‹/ëÑ×'éTÙ7+bŠ1Æ]?ìEÙï¿ý(Ô¨&ô¤–DÙËý§‹WvÈ[þçýÞî½ËnP(Ôê?´T•-(éÁ›|‰•Ò#UâS;¾zÉTBc|uÙì‹EÇn^j¬<$ϙٯ×üIËâç©á+Æ%ŸJ¯F@åˆ"Êž ïÔSQÍn·šôB‚B¥Õõ¢Ô2Ud?Êt˜¾åÀ€¶”’Îv =»s±!©£¢–Ô•PåIŒ+g+©0ÅÉOs:{» @áëR¹«å°štÕL-¦&•ªÃ`éié4bWòUÿ¡è%Q_ŽÙ{ŒûÑ7•Èa@’¯®pèv–¥Ù¨àÓƒ }"<=<¼|Ãï¿+Á!Tpqˆ]·íÙïÎõ ðtó^Þ¾aKãï‰1Œ0VŒéê8uç“™=]GîˆëܬÃúwe£¢(aIc·î٠ŸnNc7¼F#Ý>¸$ÄÇÝÙ#`úÆÓ" ¨N”U:y÷øÊ_WW µgž!„0–êÔfüÖ÷Jqî3—ëŸEÛ{´ù£}Ú>Þ-lÈ…I¾s/¾¥$z{{_}Ñ×FE›»U­ÎOIÓ#ÌÓÓË7¸óæ³É @É—†Úª£!¤xòçºí¼ÝÝ<{Ž[ö+C¡‚—...‰w¯õk×6hþí^Ðõ®ónÝqh•¸G IáÞ˜±~žnž>CælK/¿ lÞör¡2 mï×ÊÅ&!@K>…;´>Ï5Ô20¥°™êÒ 'ù”³³óÃRô»-¦"írÒ{y:ŸüYâÔ?=í3ôäÞYÃúMÙŽ1ÆÜ[þ-—'¦åççç}ÖÃÃká¹—cþ݉®ž¾Ñë ¹<¡ }vhË~;?aŒ±4£¯¯ëˆõg òs³3 ˆê5m Æg_pt_v5­°°àõµ}aQAm¢VÊ1& n„;9Å]NË/(Èû|³‡‹ãÜÄŒñõ­Ý}ÃN?þ* St÷ ;ÿ@—'ʾÑÊãàW)ÆøÃÍ->n¾W_ý((,ü’èêq4Ä$Æ_ö´qöì8no‡/äïè8ý$Æ8'y³cßTX(«°4(zwÅÕÃkÀŒµïsÅ•–YŠœg>>¾×Þp”¤ÉZø ä’c|iU{ß‘—HL^ß7Á7xf—/VTKN…²lŠœ>>럈0–Oéç7qÝýÖ¾òññ½ø2WÏ–Ä­Ý|Cûì¹”œ›W pè0xÚ¾¢"Ž¢ŸÖµ¿‘Âã 3_tõlµú&ÄdìøŽ}ç¤çää~XØÇß×·¤/Õsï㧵r÷Ÿ¼îD¾´J¡>òà O—;îææg¼›ä6`ó å[S‡DŒ¾ñ>=§HúìÌ"ÿa9 ¬¬W·arÏÞ7a,ŸÜ×kòÖ7˜Äæé1å[fv~^úÊ!Þa#ãe5ˆR®¬íä¾ú{ùùù?Ó"ÝÛÄœI'Ié„žîÑ;?”–ÿ{îãã{í-G&Ì^å3dÇÕb>O"àœ˜;bŒŸVK)>¶h”§a2r oîŸïÔé}ÆÜ_Ÿ.³_eæårÄÒâ/#ÝÝÏâóE¸èu‰Üy“¢Úu›·?¯° ?/{ßÔ^Þ=§‰±lb/9ÇÓ1ÆXþ¦›¯_˜ÿëŒ1>[Ò2$FŠ±T&'1VÈer‰1æÿ|³ví†ïE²ßªš_‰™BTs/‹+û.Ââs{î߉VZu 3]Ž\¿67¤¹ž®¾UÛ±.ĽgÊÒPD±Øbâ”0]6›¥iaóí^2 „áº?ÎîœÒE__OÏÀx€oÓ¯ßSå/O^Ù¹Ï o®§«×:tp_=¹ 1&†ÒrX/_}}}‹æaíÜ›¾¹þGu§É©,]T¦&S‹Mgi³Deèêê¤Åïª ½ ‡Ï®­ØPì?uR­¾¾¾¾¹Û¤©áï÷¯ÌÇÐÒµ*¥C1™áöý¨i[›šëëë™b!)¸ùüBÇ hcj`¤Ã 1µ©€l]--²¬œwO“¹²™cúêê6ºd ¼}|9ù7iþ-é*>¸(lá¦'Oû’âo;u÷¥Ш@P¨ÆZ­¦Nl¥KýçöªÿÒ׳Ftñ ØxNŒ£èï]BNléÇÊêåÓµ²“vŒ=)c2)0 Œ²Ä¯Õkj e¥Lè)Æ@¡CÖƒ^6eÉ*“¦Žpj†ÐÈÀ•,ÜQû.MVíƲ[oä4½óS£ï+H ‰ 3P±(O€1˜80•…oh˜Ô³6(YÿÒ©H!‘d¾øFå?ZJ!1€¬/B‘EZÉ&C·1³dANÓ`¤TQÝ‚!lÛnÀ†vð»‡WOýqt߆+ë·ù]½¼Rï×)TOŽ´˜eKñ¢eë^x\Âð¸ ܺ{{úÖ˜³éòÔÚÛ‘Æ$˜y³¡ü„´ºÁF‚±“Fim ‚BÁ¤Ä?óxZÍ›31`dn[Ínöé5Ù§×dPð]»xòøÑuWñ™t9%¨™—èõ®·b¿lÀŠ’-ù’SÈlÒBS‰†žeÛAýÚ¤× Ê tYê(à Ûéë_ý™ý«ª^7*T˜ðnªÂa€”–|Ô7mÐÁ!ª¡T „ï …OÌ™|Š‚ ù¿HÏOÔÄ@¿Úp ¢äåg e¨OW2´ìYÜGßÄ1¡q[Ÿ+`xbbªýØn^ßV¾ýÜÓ•zè©´Sÿf•C4ª!³ßÓÜh… ÷\ÐþÈ7™Fü6î=劌??rÇû=§.µ0Ф1¨÷§ÅÕm2#྿Ñgâ†!Ëö÷ð°¤èû¡¹ƒd@b ˆ(cQê_ÌýºÎîáR¶…‡aB…ϪìªÈRXûNšìÀ—¢Ka°ªòºæýì²Àž2çàáàýéfû! n½Èêa¥v/½úš:rÑË*Ì­”–‚WP¤a ‡qÍ̯¼BBˆüsɘÖSÖqÀ¥ŸGÒ20D€H  R¡¹_ò *RŸ÷ ©–:Q¢ éò¬ßõÙùåêt™°=%¿{ëò³äš¿Àµ;U‡!ÝTÅýúÄú*ÌüUœ¸i“u»­íoXv†ÐØX[!'I Îv:q)B3++jÉÞ‹”'6µ²1ÇúÓšÍépêMï#?dsý*ÜdØ6Ò“¤½,Díõ0 AÖ»?¯<í>lpµ¢¬°G@úCôdcŒú\XhȲ H¹T©Yb¾ f¥ik§SP*T@ÓÏžóü' )árAÆkŒšjVC)£‰±ž8¯€iåÜH‰^V¡ øµF5††æ$ó ¤MÌi€ðRR‹õfØj´ìâXpòíçï–“[AXf =ÿŠMêF5Ñ…ö»©r1´$}²ô…V¯Þ+\oe¥“óó[&—/‰v­&-4ø?²kH&3Ð3Ã$'õcn±HôåΖäô)WX$ztö–¾{¶÷Ev±¨øËÃû󀂀ž;u;nÝõ¯| X½rh`Ô´ËuĹý¨¡9GFßzŸ+ ‹²S†÷œ³/¥†€ ÁТJs?Hxò͈fm-Ÿí²êÄ#ËápŠ²>,›=‹Ê²pom:ÆVò~Jª\"òr7\z΢V.³B¡³°ègG ’©'§Ü’i{} ?VU9 í= (Ò+OR@Åã¨#[h:¿(ËåÕ–Ý…ͲiK‹;;×óB±0s×ÚujÔ”¢«CÇû>“ô•Ãår¹Ü¬O-8ÝÒËÖͱË|:nïc¾H(žžÓÅgÀFE}F€1aêîbq(v·”æäÜ\Gu[.7vÏÍ(ä ……—OfÄ‹ÎþÁ‡_ŠÔ’SÆøå¶M¯t¢Ý´ÊýG„€i½ Lcûº?etŠ@À—+0®‰-Bi™ï=|H×ÜÇ{B"z§rÊñQ}Ä"A±D€bÖlj.L é1z}ø¬5•!€1±»wÍïs.vdHPPpPp¿)›Ç­Ž_; a ÔÖ.¶xº:4((8´Ó5fÄCÑÀ  ‹% w tLyzÑzôì²XE±HP,!ÁÈØí3Bõz‡…øD¥™ =µw8 pµ¢TQa®¤Õ<óoÇ;…†v™å3}÷¼Nfpô’뢄°°ðƒ§·Ÿ¬àóE29–ˆ"i Vrq±P$€:SQ®³nÇÇ$¯ìÚ¾l»%‡·ö±e.MeJB0tù¶E]­‡v  µúæªøsí[êV|™¢,‹|qi¯¹†Ï”^oÖ!I7üøΕJÇ«©½Á›'žÍ•ïú[5JM掊0Q;ªù)ûJçýƒu¯q IDATÆõ93¥ZÅ£l™Q1uJMUŽšRøª$4•{vrQVžÐÔ´ä+¶tí™ÔáUüðjr¨ .…o šŠ!åÕP0*O*«’¨§JfuY‹ >Ý WŠøÔX¥¦ñŠ—p2ÜÔ°¥š02Á*ÒË/ÈThšëi(2“zE/?Є¨–ô¶² W%NõJuh#•$º_IóS_z¦zq«_RT4ÔƒŠ:¤nÖT]H5ó¯j)%¨¡pNi¡)Ö¬;ÊWÈÍ]CüöÞrÒÿ¼›òO÷ röULEµTpPJOõåŠÏ—ÿâÝë¾4ᣀÏ/úñ4úpn·ž®Õ4‰TTi¢B_jqC´IIR´©D¦z<ª5µHšC´jZ¨”¬†Š:°¥šàp5Ï`´uÁèÞÃfçqùÁÙÃÛ–-³*AÕÒ[zÕ‘®‹ªÏT©¨žÏ¨zyU#nõ<¬"èúPQGU/P%F•ÑC5ªJ% kÓ„Ä?’n nùO–ÃþœÏ{{Þ옗é‚¡ßeü©½½é¨¡HÄÿ7ÀXZxhÕÜíç^È5ñî¶jéTkZ_þ{r†j]àÿ;æ¦ ñ¸¡øUƒàß G•Ìâ\øþò¸õ™º9 Õ•§­z©Òßڮï(×ÿÕÔQÿ¼ÕÕþùç^ÿ‹}5À?innô°¾¦g®tè»þŸ‹†€%ØØüýÊ­Õ’c»;gB3[°³‡UJ®+ßØ2šÙ€¥5tŸ¢z| aLÆLé¾ä`êß1ñÿÚtU@ t¤ýC#î—‰EÝÙ=´Ç¬ÄúY»_z!tkÇà³o5xq¿Ÿ¹Q6BÔØTð!HJ‚ÝãþZGrÈ©wmÈL×pÎÉÌ7Ò3dk€XÀå D$FL-]=6cŒdü %>¹ù15uõµ™BN>W$¥ÐY††ºÆ ågUƹb_ºú N¡ X‚UKGŸ­AU2\!ñ±Mª3MêÉ©þõbn—ÔÕgˆ 8B Ðô èH^_ U –Žž®&Y¶ißQ®]ö°¡†´ ˆO¡©k ]òýsÌÉÉ”jk7ÎÿQsƒú5ƒ?¾=XÜFå–ÜLá”yIšº°÷&ôn ‰} ËˆX —çÁâî°éaÅåز„ËÑÐ}ˆ¥4:,¸ ‚ÜØ© W?‚›6,î‹€ËqÐ5„À~°s(?¯éÑÒ;‚–~‰·e¬?„ Æ°ñÀî³ÚŽþ³ÄBQ4€@/=•¤¯ @§ô´€›˜ù¶­ä`ç\‹é»èÓº%+?5Gn·æÂ÷òO ãÌ«ú,?£c݆%xþò[ó[öMtYNt¡IÅ4—–sSŸ¤‹lÖ^>æ®{çøѾµ“,3%%‡}øTDVâ¡ @LÙ½i{ç!ݦ½éÏ®¦@±©_àÛ¾—·½:æî輂l©'n¾ë;Ë”°æ°nêà3ϳں9ÿx–,häxâøÆÿ×ÞwÆUu<÷VzADEAŠÒ»"Š V,Ø{‹%ö5šh,±·¨Ø{W"A4vìŠ (H¯·ž}^œ Ò®1ù'O’ßç~?¼àž³g¶Ìîììî̬( ?0º{ŒåÌ[? ¨·³Vä¶+EÖEÙiïE‚¶rdmÝrPÆ+Ø·a£×°¯Êbwä å§vn{5&À¦ôæÚ¾3ð[¹Y©å>xžÛmfÌìž­<òòôöå¯,ºð2®_}Y2½ŸûŽk¢PgõS'ÎuˆÞòýHg&mOðÄ«õÊ<Õ µòšÓ»•àfÌŒ;¯Y8ùprŸ¿)ã.ÙëÛR(ž>´÷Ã\uW«‡‹ý|Êv—VÇÝBCÙçWcF.N`ÏÜttl¿÷8'lFÉÁ†þ²'ñ¿¾orâìΦ\$m^örÊݮƌ\œ6¨mÙ/í¼< îœHza¸%)ÎIÉê¾>÷#ãÏ}e£’#` íGÓL˜AÊmMgÓg( ¡‹)eèÏý(@G¡%%4õmÓ’ºN ”Ò“ Ý–QÊмLšò„>yJ×£åÙÓ\)}ƒTàH3*iEµ7¡sZÁPJ©6(@¯æUÇ1)¡±h˜+eu)÷0z/³V@OJc'Q€9S9¥Aö<: U¨Y{zéµ"ñâ =ÇЯGSêØ“È(¥Ô SnÖ!Zð4ÈÕcKRû`éÈ.ýglê ¯)R†‰]ÿíʉìÛœë;½ÜŸ—ÒÜ{Ç=}:½©ŽshËû/f2Ò¬H×vû”è“_¶,‹¹G)½wt†Oð·RJ)•áüÍ EÞ™‡]\z¼Súl³ƒCÇ ‡ß°¾=4ÎÎsR¥yf;y }V¡0ºv¤wè¼$öÛ‚Œ/³‹êó°èæ´ñsî(³ÈW÷òî¿ñWJ)}³ÍÅ1Z²ò²w» GR6ÚèóPWÏÂÛÛ}Äz6M²±‡Íf(¥O)s~ݼdÏ÷ut :÷Zw5qYŸ×RJ_Å tðŸú}Zšáâà3òT#]RIu”}~qs®¯*)¥”IÝàé`3ï8ËŒâÉíæß.§µÂ]ÜÜÇÇ#è ¹ˆJÇtsšóŠmÛ÷éÏßäWQþÆx7Ø{¢v¡)lCðƒm-mI ,ǵgвAÚÜÞT_52¶€};´ÒÀw»¼| n%€_(ŠŸáé{¸´“Äb(¥ >ÆÕt5 çnCš‰^ÎH>”ÌOÓÜY´¶Ÿ¡T2ü° 6aH Þ?F`¤"q÷þ°ÕGâaì: ž"ûC›Jq‚R¬ó¨³Cý2¥JÈ÷ëÐœ}>Ç/W¥µfØ“íåþôÑíÛ·Ór¤„/-+—kê©Óª½Ë/,ªËú›3¨“¸z&Æêg6îÊÎÍ/¯·ë2nÞ0R0àö[4²äøÎ(%—b›¸º·€Œg:©gKvÑ¢[t“Ò[7‹pxëÕf={µbŠ‹ŠŠŠŠÅîÝ{–_Þ•Ç ÍÛ´nÚÀ!OÏc͆o-J2Ý¿{çÞ}}=äe—KdÕ$R*•À»Ô‡eBžo{ó¢¢¢¢¢¢fÛ½•˜+ W3ö1(ˆFS Ì“í%­Œ5ÊEU ÒH™¯ç×Ê‹Ò¤c×ÕÚÙxêU—:ª~ÿôŠs§2¬zwk–GÛm€¿Nã3fãÕ‘)ûœR9š÷n® ¦íy2“.!Í)èZËßçTÔ¥.‡y„µ.;5ó4´Eùlü bjeÓÒPM¥²üÍ‹©Uàb®øél;‚ÔÕ´@‡o^k^Þ›jÉRçp»á‰bý2멵îb1ÖäiÚ\ܱ¬ÞQÒK ¼ûäp‹Š\…´Ð4hÙ¥KrF¨ËEÂV‡§¯äóûÌEjhe¡Â?qN€ +Ø>Eb”¦cÖãOý{ë¸ú¢Da}ñýOè@ŠÂºc ~–^¯96N@I)ÊJ!’¡½\B)ªÊ1©7")!عkÖàCP„¶>X 콊Êll^o;xx ÎZ¸ò ƒìläd£ŠÁôÞ0¯ÞæãöI|` .ZúÀëÇÈ/A¥×Ï@ 8¶?.Ǽz#׬E.#{øLqt»wzÿ€¡ß|ê‡òr‘Dͼ…b.½tv/^õûïSê†zvu´-x÷L^øxý¶x ¢ÑÖÅoЀp’}[aÉ°1.%ðÓ[šúøĦ•æƒ‡4«îó<Éû¸{…ìϽ~4Oؾ£‰èe™rè\ eÆ£¤ßž°³±¤ª¢B$­ÇÃbÕÑÕe§,ïþ¦— ”QŒ4ZãBO@ÑôÌ[ÚðÉäìêûêȱKÒ/žã–ÙݤV^„øZç=}‘V®ðE}¸{öJ* Þ¹ƒÖó‹¥g^Ÿ¿ª¨¢A §èèèèèèáÃú›òhQãÕ(ûü¯ÚöW|òWáoÒnÆnÃÊ8¼J†… *d˜„‰`¤Ð© Æ/ƒµ9tÕ!— èúZOk͸ßúm«á¿ŠÁ’ÞX‚™ hj .ŠJà1|X89€g4LÕ±åúA_œêÙ›…—÷³ãöÕf2b²1l:¾KÂ7çÐÆ\±)±öÔµþ豧ïÁ¢@i9 Q°n*®³:ÃˤV¥)ßÜuíжc¦ ºèå«SøøÊݹÇ÷U8êíÛZkl›2"¯“óõsG¬{M“ÉWíúiyT?Ï}ë&]¹ÔÑÓ¾UIÆý„ËO‡mßÀÑ‘Ü99>þ×X?Ž¤(ý—¤;NScM€BƒVrÑÑÙÓ¦ûG/éã¬Îãü–­=/^¸½–Wª®YÕêˆI6Ý­¹ç.\í:}ƒ9@‡n <Þ«gT—ϲÉI÷³'Äœf¥à¡ñqÍ'œ_Ò«6 {Dº,¹wì"C{AÖÙe?Žo5ì§ýNM lgÀÛ5cÜ×ÎáSgwkÕŒ—¿pü ÷À^‹‡ùn™à4쫨¤€®vú¢+‰˜6Ñ‘‘_Úe”¹@Mjç5c~çÈ‘½Â};éVf$]¹ÕqÜÆî€ëì5-º é•êé`vý×›.6é:›’êNlìó¿nìH˜Òí@ì˜6*9ò…à.Z´è‹u!ÆM‚Y¸úbÑôê+úÃÁ†N˜:–-áì ÿΘ¾ß®MœÔ vÍ Tƒ›/:ùÃ×÷Ó_Kcx A¸¬¬á郩Kñãh€‚¨¾¡ðó…¶\m¡.¨(U«×qyhÕAÑ©Sõ_üýÐD¿Aèä‡cñFôq4j*ÐÆÞ¾2‡ö€BuÜL‚ç˜Ô²”R³Ž=ƒ:´äƒcbí1eñ_ !@¡µ“USÐ@=!WJÕB†ÍÒ¥£kÔÛuî1³¯¯Ž€K9|#K—±ó–„ÙhŽFdd÷fzZ !ÚMZ÷=}l'KJ©q‹vzZfí]œšhq(é»Ó·ugÎè¥Æêùw7œx¿óBœaÙ‘À$¨Ï˜qá. ”p„aý"­ 5$2·q;c^Pk]Öð„Ž©m{‡–FµW ü¦®=½[ËE"õ&í¾úzzç fú¡š‘½ƒ¯Cc}[G'KÃ&¾~6Zêê-ÛÚÛ4Ó7nÖÕӆLjxš†‘ãæŽïÆ%„'ÔmÖÁцݾá ÔÛ:957Ô@¸| kG›VDI™¡Ö²V^BûN}]­Œ¹\ÓØ2rÄÌáA¶”RŽÀ¤{ˆ·¶:_¨e:hÖü.Vºúf­Û[×óÅVZv~î`mÌåò›·«¦Ãj9ºØksØ~*lnß¡¡€Ã4±thßÚ€MìØÖ„Í”/XÛ:Z5ÓHeNê]5¾ôUräKU•WHƒ†|èã7ÿ±%{õ^²(ܯbJÒÊ`CÅãç[mG\¹r=Θó_iÍÿb™¿7c&;ÏÿÊN¨4çVñÿ6.Å`Æ¡PÖ Ò‚mk·\ºv±X;üt!þ‘0Ö*üç¹j UÜQ‰›?=Sà¿7êÇìàóL[ô>/¨[° vQL<¿žd¡ùßêÛÿÅ24tôë/êUP-¦TPA…8ª&PAþã‹)JAdwκ‘–cé3¢‡»Ñ¿ªÚ•©G6\1øzLçÿ›¸ýLý/]yQ€ 2ãı "]SËðÈîF…Ò^øòæé‹wŠEÄÌÚ¥w˜7¯ÞÆAþõõ1×ÝGÎr7¨Ž?_zäTRV±Ä ™u¯ˆ0}>ý":®ÐÒœ¸Ý'ÞKõƤþ¿»Â`ü2$%ÜH©” ¬:v÷¶ù>]–{æЙô•&–í{÷Pƒ¢oˆ>¦?u1·V.þ=üìAQ–²ëXRí¥(×3zœ›·‘¶çþ¼ý°™_ÏîŽÍk 1BK2NžºY$jjëÓ;Ä…PšõÛñ#ßñj…2f¤‚ž“ǵ|*|Ò±Ý/¤ãôø/i7ì:¬ñÅ!~™´lË«ü**“A_ýÿ:­êmâîã·ÿÏR€–÷ôìM>seÝŸYáVe'wòŽÜq:9ïã» ‡6{-!xzxÿYî¿Í{÷ehý'ì¦áÇŠ7¥oÔ‡©ÿ&?~ŒM—ï™z«Ó°´ëUIõ%·}4â5¯¤Q”±ÞÃÃ_û¹÷ÛÆú3ÒÒ1=:NYw—aJùXÏ=¢p¯|}ÕÛÛû̃5_Ý>0ÍcðÚ¾ö;«ÞO. ö~DÁ!F4±ûäŸn+¥ÃÔnÚz-ý»lb(¥k{xÚŸ\ûIãí«ðÜ–7ÚJ »k½kŒ Sï?¦Vêßá ¥’ìÛ^îîû®)<úóâ—ÚyõÏ–RJéÅ̓¼Â(W0®xd˜ËÜo*Ÿ;¼óˆoN°„*Ò/yyû$¥•Ö#{bñÈÈñëå rd˜’¾~¡ éÙ3¼g¾]» [øXsNá«þ6~ÞÒeõ [¾¬WÀ7‡ï~j Ñ»AÞKGð‹ž^¯~ŒÒ^þz„ƒâÉú–’Öòñè¸äd.€_v.ëÞÉ»gïÞ~þcmäœX=rÑ^ dJ¿Þ+¿!¤‘4„³ßºO>?½OÄ@JŸ-;À3 42<įSĺ³éìEñíz­=½þ«ñ' íÕÉ·çøûe  DR°zÎhoŸ N~>Ý£?xÏÎÑ ó!ïnìo×ÎîF–¨'äY5®[÷0ŸΡg<©$„£s½\F$°}P*ÓÃaÂÆ4BPøàÄànþžÁááaÝ×ìÜçáârünžèí¨þó¥êY£û\ÿ¤rRo§Qß óññ»‡Y ûûvéÖÙ7´ÏÈøç ”RH ^ÌÖÃÓ?¸OdDô¬#ú{Œ^q³žz8aÛ¾ ÃÔØùŸ§­c ).+&ÐÚrêÆ‚H 6ò†ºž^õÓ€<ýÔÜ-i»%d>]õ)©ªäé6á(®%ªið%¢*¥t³§§í¨Ý ïNù6‘C3"Î ýÀ÷ýGÌ)¡¤Ñ4¤ð‘‹‹KÌOK}]]{.{D€7Wbuõéè×oüü—EÒ¿†Ý”"Ýj×~Â>¶:'¶,ñq éäØ}Íë ¥ÛΈIc)B¦ù·±„Hß\˜Ø¯‹opxÏÐÀÐ>£Î>.ª§Ðq mcbvF¸Z°Úž±­9­ªª”_9~¿ýøÑš,S¸ºî¶¶/oœ ²œôgÜô"Õ°rræÑßž½¬£4]]wîýŒe“I½…9ˆúöøÓÁV:õU袴¸LùÈ0?Enºlþ­Zg?xse÷‰’¶{v¨¹nìòÖùŽ“úxZÔºN°q¾ÿk´›7;Ú;º÷]ô+û«âÉ&7§NñYì¯3Cûn~J)͹}ÐÛ'ìó¹4‰›{{{‡\|]ÉŠ×‡_Á&ʽ½×ÛÃõF¦ˆRZ~uJ‡öí—žËa_mŽr ^x‡RzuÇxŸà …l¡M¶í8"[y^•…Y  +V»éèì8}ç}vbXÞ¿ƒ×ð#”Ò“ßvö™p±ZØK'÷sŸ¶íÃȾà?èëÝìóSC½}|Î>̧”Ò·Û\£ó)¥”Nä6V¡lTeîÞcÕ/©ì¯=3…ŽXÀÎç~Œð ™ÁÆfùøëB¯ŽSÖ?TYˆ¡”J>&‡¹ºì~&«žˆ¥ï3ß¾}•²brïÈÁKŠšWÕ´ÞócŸS¦tˆ—Mv“q+¶³WçÄ'Y?~|u'.Ô'8>‡*£C)“u'é⃌†ùB6­íé=zÿ­Ï¥)}êëíÝiĆj%óW[×57Øp<òmÃü¦íý«ØM©üMòÅK²(¥e÷Wut O.¥”Òªû;]Bn—2qs‡…ZÄ°Nåën^ÞÛ/¿¤âÌ~®î“~¾Ê’»¼v’[øˆ æs ë¹%Ãü‡Ì‘SJéëH»Ž;^Ij^_]9ÑoèL¦ôŠŸß岚ï¤1QÞ½6þZ‹Šxû@q»o|vԕͬ«Ý”<ûÕÛÇ'ñ·øQ‘A®âç=È)¯«£Ît\ý°²¦¬•Oö¸y úHé럧yWk7Ÿáû¿A»(‘RÝ™3;dGˆ38+´ûÎhøôÁ9që ‰D@,Rš¦  DÃÍÝRTšqïéË®“g±‰L\{ÙsWŸ¼@)©R÷fÆJîÖž-*ÓSÉ…—m§.Ö(вïšÛIëÌ WVuýfÁÁô«÷0«Ð~êgJ)À E^ÈV²“YFFzžïˆ¡ì,×wüÌšm±X0bņ†ÜÚ1Àˆý_Ø,æä‰]ÚŠËŠóóóí›ë–É üʹԶSfk”Â(h¶½)GÙ-‘<íÓoz»‰†Úr7É1'EöŽì7ôlšpЬ©z„ uÛ¨͇.hCëN$ÍÝûÏ‹v^84"<¼{Ôĵ]l 5ƒ2:”’f;95o¸9óelËP™ŸIC‰Šî–ïúî“Rgïižl8Θ53d¿Ä=ù‹ØM)§¥[§€öÍù‰Õ'M¢Æ¹iƒjÎï_:Ú^ý{e:kÁ‘ÜoW}ÏSQÉðt5>¥Ôr¥¹\\*eÔ´>ÙsuÕPU&®ÙM)Iâ¥@¥ IDAT½²7ƒ?¾»û m!ªªÅêãoV8sùò•h‹ŒÑ£g”2ìý ¥éûVÜ4öŸÒ^Š$3çü±d­QÝ=³Ïðý_s2%Ô6°Í*zœM‹ß-º°’}#W”•ró+QË´[I (¥0i«¦p^~_탃Ž)d -)++ÉÌW´‰†‘Vu¬.—K ò_æ œ,´g6„§¥­”++FÈ ­Í–9ÚÚM@òËÅJÄ$¯¸J·¹‰âÖXmcãÆÛ„‘«¶P•¾›»%áI;GC-aUÆ[>§«g Ú[hƒ½)š ÕuÔ¨’³ìäCç®uº|áP¯OW»rÍŽÞ¹ ÈR/ÇÂÝu¦³Ö“q»+¾8!P¾ºbôëÊ! ïÙLºÙB‡Wš2qøàùï7/Ö¡1:§z¶oR³zjXž/`“õ§”¥áš0ÔÒfŸ¾ÊɳUg#-LÉEË¿˜ÝU)9ÔäkB(@8êjDV^õ‰Ÿb9/à 4yD\)Aå¥"¨i j¶Ø“Ïmå;~í`Èa¯—~’tüRj.—@Ê19.BKÉär¹ øzâ=BµþKçpˆÞÿJ2¡”`{ü Λx„½›^úaX±ÇÒM¨ñ¹µîM…2¾ÿ[Ä Q¸I‚«¯†6WìâV/MF­–Q–&lT&vzS‡HòՅĽ†Ç! Ÿ@¨-”WÊêE+Ë«þA/‘‹dÕ@&—€ yÜZùÑšHK„ÏãHEÕùP©Lù™…¢“~¸÷ËÖć+]ô±àHß1c`<+ÌøBS!fª³`dyƒcOJÉ|pÈô áóöLïn­¸Óš½Ï.Ð77W　kÐ7ÔpÛÉ” Aúwbuã¥ã‡0 Y6ôc'E]ó»mjÓCSBwÅ´ÐáT§©COWÇí׎!º]N:Çï¦Õˆ%JÞï°©NeiJŸ£Vt-5ŽŽM@Âö%õ•¿økÙÍÕSûê(57ÜêÝFN߃ Ž~q2Œ¾ÐØ1¡ic@-Ò’Súļ·ºx}»»ûfíL+¾­„¥.ûAê‡RcíVDÝÒX«àå{øZ±C§â~Ú™×\Ž›wì`zDl—šâ¾{ò$ùþk.P%k9H™¸¡ÐÒ3·†/0µÐçËPõ8å©tÚ¶!˜Ü»3O¾±l7dÈA¢ † ‰žºtkÇÿƒp€zx€îýÓ·C(Í{U*ûãiµ¶ÍÈÍ“/Ù %@zïÚC‘ü3Ö †^NÂäƒ7‡“ÒÔ¾>¾§ ”åUŸ ?ïÖ}(¥È}› ^;c|TR6j-*Ϋ(„-Lt+Ÿ=,!”‚ ãåÃßµP))+à= >« ¸“®¦ì¦.–Ìý ©`³¤gçT5P$HÅ›«ý&®›´ñx¬iƤ>¡Û’E 1(/~Z S!ºÎ=pjÇÆ›7oÞ¼yóOMQÒkq̪Ñv€Ð@SöúEªcH½¯(×àkÓÆè4ÕQ¯S„Ï@ ›¾(MÝvóíhšý2£¤&KynjF!þ"vת„zW/í” ’‚N ôZþHÀÁ­)8yåÐîgæ.}›ñ45·¢´òYZiõ‚£ôþ½—õf*$¯ˆÚüÁ-þÈOfuNó5üzÚÝ߸Oªe ¹›ö¤•[OÊ·°´1º{äWPIVê °mÃÆÚFúÙk° ·ä×è¡S¿Ý¿gÏž={Ç.6RÆ ¡E붔^|öR!yó®Ý.7êÔZÌ´$9&S?Ð[WQrbìt91!fǶ—, ·#MÛm޼ɱ™ú§­åïbª¦®³é?p¶t` ƒøCêþ]{ÚL:ðc¿¶0 Ô'é9r͸UÌ8GsçWOn‹Ï;pþ°c“Æ=nå@·)ó¶DϽ:Ó£…ðƉ•F„JòúøìâœÕq3–oµ3æR^Só؉“rûöâ<Ù²áNðçu€VÎ!¢c;â[Øë•Û¾+_]Ûˆ2„kàÖ6fÍÔÖ’AêEÏþr§Fãâé5×dbwî<ìäÄá|ê“-ì$U;~Þy(¨Æ•sL,›Ì<•x¥K _Èèè=ó§ÿh:ÞFO”{¬JO‹euÊžïܔٶD\µ@ªÙ±ìÙ¯{RØqÌh›ÙG†tìæ°rfïªþz4åÚ…R³…þí!àk HÍÔÍh¨ikÐ2­ÿï¢,áÔ\/û鵿eŒÙ² £ã0‰‹ÆÔé»czÈgMo”±©ÎÓx:«ã3îÙwÄÜQâç÷mÎsš}tqä_ÂnBä§ç=gµmrg§ék¬C ™ÃôroþòrÜ ¡Óu€jX9zªËWýœàèûµ€‚ªYºÍìdþÍŒÉCû6Sß8¹ãBãÅcË59¤àYâ¸ož¿>ÖZ|sÆÉÜÎ=ôOíÙÆÏa®kd”½.×oÀ7F±ƒ'Ì© °7N½vì™VÏÑV„böÄá½'|³÷ª­1séäÁ&þ_ùÙê°fz9w_ñ Mù¤qCKBä…œz@¸Ò· 8·/ÄV=•ƒÈ=´¹Æ«Ö ?¯Û2ñ±1&‡èsXý-ýâ35«AšŸtSž¶¶v 5…\pIõ“/áû?(n†¶m[òkVj­ãNn_½îpìCž¶éðÕÇ{¸¶ €@KߺM+!GiÚF–mZè“ê•£Ó€Eñ¶gWm=²ç¢ÜÌÎ/ñÎ3ÀÕjfÛF«FÓ6²lÓ€IûÈk'–¬Þwì1cë7ãÄØpP¥åÂÌži+—kg·X0gM¶H=rÉ®QA¦”Ò¶Á“|'Ú»gM‚–å¤ï÷™m[ªÇ0juœÞšEgï5´ YµuiX×á„€rLºOzùÌåóZ­šµh#R¦–>ç6M[¸ý|Ì=ˆÉ[z9©ñË&ŸÞÊÓÇÏ&tÖN‘æ–ÓçRù¦#·œ<1Ë—Õò¹BaeA»Õ%bÌÚ4-»œ˜X³-dlÈרo´÷ˆÙvô·çbÒ̾kü¶‘¦¤^'嶰¶5(dCÄ¢„æg~Úujïe±Ž¹ÝæøDgS5 ¢„e䢷ï‹2üËØ$5ie]a ÅnK5ž¦BÍÚº®¯Z8êÌÛÁnëª3G÷ÉxZžÃ6Œp£ »)%„2r†aDÃöØùC?ý¸áÔ‰G&Ö¡§VÖS8ëΘâ7}ÿ›û‚B)?bÉ!‹3?ï:wYƳñž46\R€p¸xþ!¯˜9ØV¯%ÂfNM•`së¤Ö®cã|ÿW„ÿ®YSÇ0ŽQ–¦¡mUCŠ “ÕþùÅv_u õ>gH¦äóW.ÝLQXó•½Hòöñº‘!n4·j3FI±êÛº)î¡”Ò´Qƒ¦1”~¦U³Ac³^c”Û¬1Ÿ{^˜8~ó¯J³ø6ÕË¢±4 l­å_Àîß³^c¼b”v׫Áâ©BRË•‹Æ8Ä4Z†F[Gy]>7 7%e¾ÄrïS²ÆøþwàÏh7¿»“]÷ùý4Õÿ7¤Ø0Y­õFbX“ß/’r+­ ÈÓø] ΕŒŸ0Ì\X~îàN5‡QÎÍJ”ßFsl<›Z«eZù¦0jÚ ¥îWPISeÍAmØøó‚·âi½ýëm«×nð/a©Ç¦ÆÓ(ëµRýßØM>ÛMIÃ")í® ŽÊJËýçüÔFSù¸ø²Œ¾ £A¯Dã}¸ÞWŸ?lªyÛ(ßÿ¨P|)žÞºíÄ­ †ïØûëa¡‰[&¥Ìš…£¨ÃÜ™ýTñnUø߇JÜ|¡\¨'[jŒþyª5“É?ÌKTâFTøŸÂ_ïFVùüe†Y‹6z¼:xÕÇÇoÊlm­ø¤‘‰½ð]zn¬lZ j›P1UYo²JE25mý–fÜêí ¹¨8#ó}•Ú†¦ÍMõÙBHeQî»2p Ìš›ê±v”}ÈúPX®Z“æ–êœ BÒÙïó‹åD`ܬ…±–€=Ì"ù9™‹ËÁè7ifª¯^£ØˆKó2³?ŠåDSϨe3òÿCEaó ™éibžn›–f Wgo^£[úarA·KH«VúoÞ|hÑuÚ¡o"Šâ[QaÓ29†­LåéYe_íYÕš¢—±½‡m¨Ò4o"ü˜ùQ6|]ü7òðØâ¯Ö^ÐjbÉ)}S*Ó]wÚÑ„@·'fýñ7ŽAs]QFn¹öì ½ZrióøEišsʳËõi?ˆpjв;;C'íÔ·uu4–Þüí¾ÀmòéƒùóV¥ ¤bË„¾û5uêutÓì†êjÕ­]Câ镃k¸ªš ÿ¾]‰?~þÙS¼úoŸm¶ñ'¯t—üm׈IkÏ]ïãÓïäÓó[±_yMÌ‘RJ)-Jéíí¸òb!C™Çu‹œ´‰%‘›ëá%¢¢¬(_÷ûn*hnÒ±Û¸*†Ò‚DGïýØ£kYÜ”à€i(¥Jèˆeîû»y®9ÃzÓã‹£ýúÏ’Q*y´ÝÎÖïÄ3Öe™9ñu˜c¿5 ¥ #›1ÀoÄwçÙô¢7½½ÜãS é…iüø\ùÁmƒá-ƒ¼¦®=¶nJt¯ Ë•…ÊÖ ó‰Þôˆª Â¿ Ɖª ;ùyzzzøGlO‘‚üûŽŽŽ§BJ^ý6:ÜÏÅççir*ª­mÉ»±ööö7²¤5 \xtÃTKA]ÚÌÕ¸ mFÎ3ã T×Þ¯CÛ§yÁÔ7¾CF±CL\ƒmÌo)/Ë_¦dRAï7ÖÌ×mÄý7)IòÔ#gª¬;Dµ7Àí7wtÕ/žR@ ‚Ì—2¯‹ŸK'bBïŠç)ÏET®ï¹bíÒ¶z¬[LHo;iÆëb•——[:°ÒZhÔ”KxEåå ÌÞûv£÷Ô]ÇPúø' ×/.¯õu±™÷@æÓ£#:{y{{úuûéèM†€æû®-ƒ—ÞS|K釓ó›wŒø(' µŠ–ÈCfìX;5ROÈ¥u'›ß· "&àö›<íÕ¾éÏKþƒ± *ü S”¦ï]üÍ™¢ ¿iq‰(çNXÿ1æÍÎu3çjkë𹕯X`=üûûÑžIùÌá}5Ôöíz–¦OÿÚRŸ JZú{ ‘¥Ç»;oÕ:)ĨCSÃio J_¬ïÐV@ ˆž§3‹hg41ÒãPÖíßÖÑ°(饨ôm©©QÁ8.¦‹ïf¡a£tòG›rÊÔ\èªe¢+-¸û^foißÝBaC@ÏïLnÒyŠ>@!ðhk{èâ. ZH€Œû×dŒÀ±­@ÝFΚ%ìP_@kkÈßÍ:¤wþöuOþáÔ°QßEý|a³³O”:,xÐ^¦^¦Ý'Ž;¿bÍû9±¦< ½‰ÏýüÂŒ¸ÔºkÔl;pPn+g[ÖÏ«,ƒ£æXÉy(Lí\ ¹¢›^ÙúµR]K¢Â¿F»)+)g¦˜ðù|í^ ‰CÛÕÜ[ÊÉñ´ˆ¡ƒÂ¼A¸5½éánU2…“µ–™ÍˆCÍ´8TÙ ¥¥2Ñ'ûuè©óÄ"‰¬ª@,×ÐÓ¨:<#M”•ˆÄ¢R@Kȯy®¦§Î¬,KÔx¬8#åjªñåe%`¥ST¡×ÆV –Š¿Ë¾ˆ_»#_ƒWP)¯Qç!÷ã.»§¿fjwÖó{ت ä–³§P'ßÞ_ÇMÚzÞN”›îÑCƒÛÕ=ï#G&LZ>L›Çåqè¹ÅkhoG»òù|¢í0kAÄÃu«J»A o¿(" „æ=xøÒ-j¡ÄÂ=td¿Pnµ˜iÔÚÏÔ5dtÿ®Š4jMƒMpéE–JÖ¨ð×nqž27üÞ¤>ö†v½##}Ü[jÕØdrŠKr tô´YƒZØ›Ée¯Qw˜(DÀ'r‘ôÓXË(—ÇáðÔ8D&® ¦J¾€Ëå ©œûÐr±ŒÔy|G^+†&©œ!|H£t„\hÙí_6rù÷¦¦ü’¦]¹pë©s«ÊDñ«'Ï>U¾ñ—SNƬw5³}òЩóÉ„¥-´ÉÍC?NÚ¹åéDO õU_ õÛ(`Åõ4¹üÝžñ1;Eey²JéÇ*X™ÙGqŽ'?ébç[š¼é§ËvW5ZËF˜|wœ[p½-Rõoþó'SÍî>>O*N½ù˶m?Ƭ/‹9ë[Ù„€©™Ýåùsl“Öú•Ï?HÐ\!^çUêk6å¨[¨¼-„§9KKôô=¬LµµµšP|(¡‰&ûÔ%‰¯©skUÿVáß…?BöÛÞïºzzx¸wî5üè½\J)Íèîî~öa¥TR’:3ª‹«›gŸ ßç¿Œ³wî™%¡”ÒwɇÜÝÝ“ßI¨83ÂÃÃÝÃÃÃÃÃÝÝÝÃÃÃÕÅscšHqóQÎÍI}C:º{EMþ!³DZ“ñÛäÃý‚}:ºûµ2®JVãb/ûmÿò.>n¾¡«Žßýä†/)Þ¿t¢Ÿ§›考w>ÔvÏo”Ž\’¿zZ”»«[@÷!ge³ö/WWŒsre‹©€“}Àoå¬)Œèüæy!ÞžîϹ—ËÞ %èá5í`ý6{ýskç^™’OaDÙwf ÷ôôôîÜcÝñdy-«›â_—ÚÙ;Ž>ý¡æÉ¥ïǺô+¦”'øÚ;³Æ¶›³½oB1¥ “¼j‚KÏñ"J)C%ïnûx{ÿú¼DYôTøGðg|¦º'²A}ˆ’· ’(ut¯¹ §îVHC²Ê³!Õ¡hI£Ï¥óÇ\0ÙÖõMv5džŽ]Ÿ±í«°†Uø ÕF_|a•«ÉLòͪ}›9Àí}“'3O:9GCeW¬Â}1Õh°¢ümƒ$J·Ž !o”ìïÅ!Êž7JçKÃ|¢ÝhȤÚ×'ĵÞöÔŒü‘*³1Ü‹®5 ÉPxsÙÚGß혣 ª’5*ü« òÿ‹W¦Õ:Ô?£VP*šÒ'P³÷®Ú•Ï” *q£Âß'mTtTP‰TPA…¿àž)TPA•¸QATâFTP‰TPA•¸QATâFTPA%nTPA•¸QATâFTPA%nTPA•¸QATøü?=¼tâ +IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/content3.png0000644000000000000000000004301313051004444021647 00000000000000‰PNG  IHDRzn…DJsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ m‚¡ƒ IDATxÚìw|E×ÇÏìÞ–Þ „@H§ChBo¡÷¢€4)"Št)‚`A”ª¢t!‚ôÞk @ „ôÞî½»;çýãÞ„TÊóRå|?χ»Ù™ùí9gfg"AijG * ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ ž%ª—°LˆÈ‹¾Ã£'D¼>XètÎÎNÿádˆøë‹onÙ{ÒÞÅš ñº8‚*ëÞå=;ÿ²°° ëæ¹’——×~èôÊU«S+$^GC aßÏx9_ÿÿq¹ÉhŒÔ‰×àŠò·àè1ArCÉ AÄ“£¢* ˆ—£$EGG™rqq±°°øoL !¹!ˆ—Æ =-mýúõ¦ðq‡wß}—¬‚ ž2Š¢È²\øˆ(ŠäLñŒÌœÿìdz ArCÉ AÉ A$7AÜPArCÉ AÉ A/-4«ø•©-A(<ïA6€¢ i6*" Z¦VJ 5Sk@уœ €Æ˜=¨-)`4`‰ù¬À5¨T ƒb|p¡ÂeRé˜(‚¬EÓAÔ‚JU$3Åÿõ¤’›ÿ Œ©´™»‡V½­·Ê_eU¶þ5û\K@dŒ j½$xçáx÷6ëº a"ܺiÕ¿µ?¼Ü°º"0†ˆL0FlÞ-«ú„á“ßØ6²¹¾ÎØÞC‡q,¬"ÀfHºriÛ‚ðS'ô·p«]½ë¸juj5 1_V€ Z8þQàÅ;Ðàý½µjy˜þÂX2`ï±órS†¢µg`ljõZ‡ê4Ъ÷$7ÄËoà0Q«sl³"´Y%EARì¡ïŽ¯–gXÜ¢e°‚(æFœ8/i¬œr•&jdŽ-¾÷>ÔõÆæÙu«}«2+ÜÙ·(Û®íÀ! å©,¬Õj »ŒÀîïºsÓN±b—æ~w°Sß¿¼ùįC#v5èøá/v`–áþ–ˆ(•¨µ¸~¢nPoY6k‰ ±´ð¨ÛeÌg*(™·ÃŽ­w÷pû.Ÿü`#ÞPì†x5ëröní\+Ú¸ùÖ°°–»æúÁƒ\ XúµcÙ‚ºIû¶Ùq·“³ Œ!mZ } oïÙøŽ bÀ˜}äô_»ÚüèYNƒ¥_É©'Ã6ïpiþé࿨XÝÖ=À7ôÃ7>ÿÅ"óbØÆM‚†±|ó*zÇ&½[ÓmË'Þ•¬P–*­k%;·ŠvnÞCÞé=gË<~îà ‘Òs$¹!^-ߊÈŠX©º“’£Gî…oUµ½»¿ã*GŸ8%Š DŸ¡M»ÖŽÝ8$6 §ø,«B×Ýë \z¯Ô6=‡µm1°»¬D`¨€àØ0tÌÙ‡æEÜ` @κx#ʽR}÷vãìôûÏžÍ)Ína€ ¨Ê5öÓÞµ®¯+/c{6”Ò••J Å!¹!^J1Úõ;2 k9Ó"“˜?ŸEɹ“–nŒZ·¨ÿJ“©µ6±ûvUÉ&œÝ|„øDkkmÁHvé—P{xºI×.ÜÄf`(tœJ1¹)Yî~U@nøŽ{ŠŽmðí 0A«Qk/í84¹'K7¦ÓÎ_— [ä†ä†xEì”rŒ¹ +…MÈŠÞ­ÏÈnòixÕ æ#úS~^°çZÂ5™)Ô‚œ›' >4T«Èÿnm//ûâVbçÊö€ˆŒ"T6=U nSß"ÏRÛ¸õúâŒSCÌ=wnþ>6³gy]Q' °¼;GŽ¤–oÙ@«€LCá»!^Õ©{;—]‡ûz‚,"dMíÉlS¯m ãzÎL­ÓY‚&ÿ?­ìëÌ,ç$š?*>´LT35ÜÝ93l÷ÝÃf:1`¢>öò]Å‘Všü+æ‚CÐX ]rÔɈüXJcÉ4–Lc Ƥ3¾™šgY·E'EAÒ²nˆ—ß².å)JñÈKÞ{ú‚Ñwb/lvSgå<êÔ8aafn{;É“äâ[¯£"ã¦Ïß6±àQÓdäšõ]f/ ûvÖö÷¼íý[8ÚkS"öe*î•Ú|ܸ*GàQ?ݾ£j0®›ÀÍᆠu®ieiu÷ÂæÆ-¦¢b4DŸ[ܧR~8ÈΡRæsWtVÉœL›×Ó,Ç—q¾Õ¬O¾”¼ÚV®Z—žPɸ —Œ(¨EQ(zTVEPi„n"0T$ä(¨Ô¦Q(nþ©)|–"KůQ­fˆ\J¸sæPf¶dS©‘wÍÚj•iŽC.) Š…³.KLP©P‘9ç…d…1Q%"þ‡7øŸQkaÝìa ËÛgÊÍÍmôèÑdÝ/æ !¨µ¥U©„bO“1&ª¡Ð>EBÑŸfPkr9C•ÀÐ*Œr@³UÅLåP %L/AeΉj¡´-’HkÈ™"ˆ2¥•|㇔‚ø@¡b‚ Hn‚ ¹!‚ ¹!‚ä† ’ª‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ây@Ëk=GÖÏoslÆA‡´ Aró:"ôƒzÖ2ZÛ=ŸËezxÿûù’‚äæu$`ëÏé•ü÷ÏýUPžùÙ’¥u÷·¨s³%k[ªy‚äæõƒ1E£ÕÛ; Ï\mÀh \TÑî*ÄK…Š ‚ ¹!‚ä†x¶ € †ÇÄB`"ˆ*U`Ú×é‘;""@T=Æ©¥&T ªžp˜ ¨|ènŠˆb)§$‡—s3F‚äæÕƒ193â÷1õ#ÒØ#{/"cÒ…_Ç­ŸÐì—q-6ûQ|r.cèŒL`Q»&þ:ë{YõÄÑdLÅ’ŽÍë²ú>)Ò“%g“®MýqêçLû°3¦bÉk».›þE±ÓcxçÓ¥&)*o#¹!žž#ó8>²ã3íõ¿Ml~ù¶ìÛzDöoØNoÖòÄÙ„R·¯,’X1*’ô¿ˆ!àÝ SÂ,ë½9Æêh>h”ŒÒ#cØ(ë¥R‹§qwvw'­yE¡‘©e˜{¢i/oöÓŠm­ÀÀ˜¼ûç…ê*cú¿ÿÊ5ºŒªðˀ㫇V®¿»Š1s†ìa¾+¸n‰²!"XN¶díZ;°QK†æÓK¹„é/¹»·V$“Gø€o÷ýdm3NrC<æ Þw~Óü˜»1 ²-ßhtÝ–uA*¥K <÷âÚéQwbu!!o³‹DJƒì›KRmBg¿‡²I&PÑ3ï¦C/\ú6=ÑP$CDAÅònl9²õÏIU©í'ªô˜‰Ñû]:qL{¯v“ê4ô• Ê&¨YÂïÏ…GI¿yöæÓW9i ]Bò¯l<²u»AåZóͯ²÷~â4¦Y‡ê%îLDCÌñÅ3Ód‡À®MzõSÁc©c ï-Y·.³÷ôE…Ú9SÄ£ºŒˆ÷vMoq×àä]ÇÑÉòÚºÿn;,”ÔµöÜâ¾Q©ZçÊÕå»›Ö|00!³Hd—©!qß6 ìé€&{…1†ª m,Øéã­}p.",õÌÂ5ŸÏÈÓ”w®àµ®ã}×KØ5LTóËË{þ³ó¨U…šŽ.—tغv;c"ÂÈÁ¦Fw'{•mÅÀÖý,Å©Yüž™k¿þFpòwvOέíÊ•¬Œ¼’U V®ü=íM£s‡¯g¿ŸîúëÕ㇌‰)ñqԌȺ!KnŒ×–Gƒ‡NÿÁæ%·;pïcM‹µ²e¹î]G¾ úçì>þþ3´o|ð¢ÐßÓ[UdàL’¸PÄ*Õ©gV}o×vC× PaÀÐmc;¦:snÀxáËÃU¾Yo£X£Ÿ¿Zß­Kym¾àp°ôëXÎuCr†_`Hh!•d÷ÏnÝPyС¶-<@ÝüÛÌi–¥w©å?=_§€®wÖí ço¶²VHnˆ§ «Î}oˆ"ä&'§Å_¹—'z”–ò<šDƬ<ëû:ﻎ/b ò’Á•Äb¡âøíQÙ^»Õ«||CN]-–T¹y䲕ƒẺ¿L2"ˆŽö,îv¬ÞÃG÷ˆ‘g.uú´lת†7€™ÆÉŽÑ 6É ñ¬Ìž}uýôc»ö«ìœ´V:ƒ\jœ¹ÊÒE‹¦ˆ2‚}96¯pL•ƒÎ©œæRD¤"¶¹à/(ò¤ãË¿[|Я£d&È:'[5 0Æ8èl+– ÝddK˜qxSÁ1­Wññ&×(i’•§•Àcˆ¨R[XèK=Uc§*¯¦˜/É ñ,´†áݵ#^ÕöXpØF§µºäÕö”Ú)%7ÙÀ´ÀdÅ¥©íE|`Ü nm{‹ó—ßJîcÇòƒIq§¯žú·zÓ …ÁÆ]­OÉ–ÁVeš¥Ç 9±•‹ÎR'ê*4ë6þ#fp@‘=JDkw1ûP.- eƒ¡Œs‘Dæõ„BÅÏ)>:ÃÑ7ØÕÑ^c¡S‹Æèx½ ‚P|‚¯ ÖÞ;´AЀ ÓG¹–TÞ«~á™8ÈÁÚo¤»³rzÙÜ, TjT Qç]ú{5nžÞ.…Ofî+ÚÜ=¾e?h™ f*CøÍc×J*†o=ß´['ã2@%‚ BÖéY‹‡¶OãðH­A¡\g«+çöE *&h@IØ™–˜KÏ› ëæ…  ¨ë|yóÆ£~¾žÎÊóâ’óŒ¹WïE%¸{ž½†­¤›?¬ÿ:ªZ§È°ӌ՚tn_x cj—Ž>Üøñg¼·µ|ýžŽÖ†ÛGþΕuÕÇïv¶)"Šâ4ð¿üg|Gߪn×v­ãj/,ê%!€u³Oên6¥I`×w­ W.ìßåú‰ƒ%&Æ`‰Ð ‚X©f³öÿ°'a˜»eüÙ°0ÑÊš ªÒM›BeÃR5 É ñÿÓtì´¤»ÛŸ×Oo¿~§‚weÍ= §û)òÊ÷Jîž’hU±ùè%¶ž®1‡×Ý‹ºëÑáó–M:Ùk‹ᄈ̽Wï¯ëÅ\ÚwïÚ•¬t_÷¼j6svµ6ð¢.Gçútuºy2,):¹Ö°å•*9¤ÝW Ï^aˆŠA¬ûÁ÷sÛn_:¢u³¾b•*X|Jóì8ÝA¶bEÕTyk‘cáÇöß¿ÐY;/üÔ윋&VÓe¤ Œæø“ÚgB—¡VXlþ°öm¿ìÒØ$j1$7ÄÿÎ×:}ÊÕˆ,xÄ·€Àå¦ SY¹W©ƒ¦T༔¯c€ ZWô êÓàJYg v¾-¶d ¸±¼+q Ê¶Bð J!ƒA‘MS‚‹yRÌÊ£ºUÉ ( Ïz×í͵-Æv„¼¸i÷¤j£<‹{ïVþž~,ѦJ›¢Ãm )T¡ˆ%„ˆÀT %#5!’âÉ|*EzÐŹ\àë€òWþ+3zbE*”¬Ìóò¯PÖ,Þb¹=Á—¢›GyݱoÚFz׶†äø¨Û6-?«éüéL¨aLIÿNùwÛ!ëò¡"ùY$7Äëí&Bõák\ƒ÷%ÄÄrPûv¬S©JEFxZ7!èÜëÕèÒ¨BÝŽ Ð7S$7Äk cLQ˜S`§Àñ4fç`Ø·z~æ¤5¯"4NY7ÿICíÓ g< E @ܼ¾Z#xœÙßed'xö_ ¡¨²‰¢:'Hn^S. |'ÇÍ…çäÀž1ËheKAró:¢ÖCtÓÎÏóŠ¤5ÄK…Š ‚ ¹!‚ä† ‚ä† ’‚ Hn¨ ‚ ¹!‚ä† ‚ä† ’‚ Hn^Vhù$âõâ5hï/é7S½ºuúôËùñGl ©Ÿ™™IÍòÙ¾sNõðBޯܭªîù_¾G|)·LÅ҇ܽ{÷Ù³g©]ÿUQ–åb-ßÍÍmôèÑdÝÎóÕjµ$ITùÏŸjÕªýgîå%'¢°Üÿ7„žä† ˆç…Š ‚ ¹!‚ä† ‚ä† ’‚ Hn¨ ‚ ¹!‚ä† ‚ä† ’‚ Hn‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† žXèXø0šþAÜÄSC.#葃ŒœË —QfˆŒªˆä† žšy €¬C&‹(Æbì®ÔÍŸ_}'ÝDZó,PQ¯©Ô 2E`*&IÌ°éÎâh~6G“’ioŸÎ⡵ ¢œÇdYÈ€)‚(óäÜ_cæF«#E&H6Ü?/ä#ß_[Ûõp;Dd Lÿ#^[¹AÆ;úáðž;vûñòDÎcˆ oÿñ£Þ]ÚtîÖÿ§°ë¦£,å@ûŽÝn¥çlújL§íú ÿðB:0ÆÒÏmißuªä˜=®Mè¯×Rc˜quλýCÛ·òÁÜ)dŒíZÜï­e7“/lÒ³M‡ݾÛ|š1Æ[34dOºñĺ9=ûNÎb,lqÿŽGË,75ÚvÔ7ísþ ËÔ¡¾Ùíÿd(”s'wè;”B·’›]룴y&cät .P«=Ddȧ·ŸÚ·SF\d«¹_VU*†ic:þà+‰³BË=3³Í{«@{úðníÚ‡¾ÿéêL…¢©Òrn…Ü-´C‡Ñ3ÆçC4…–ôwöŒÔµC§N¿Z— ω_4cT׎m:wéñÉÏ{eÆÓ'œž6²w‡ö­û˜r))1s|JN¹0stßÐöí‡OüâN†bÎ…±Ôýï7oÒiæÿbB>5ÛÍŠ›3vÇnÀQdÈL³,yF\×q­dPF9Îè;FΙÈ`¦[&^_¹A`ÉWÿlÖîí,Ϧýúv/ÿÜ­Û¸tKÿnh›·ÜmÙý.mjlœÑmÄ×[d`Ài)‰Ÿìu˜Õ6t {öéÑ=$䢕wð”q½…õ›Óf5÷°I¹¸¥mÓîÉÎAýßìë{‡vÚq—€QŸú§I‹ö¶ì;²w{ÿ?¦ ž½/Z¼;;ÐBåݨ˄ñƒ,,¬]]T–N~êVD´ê9¢¿£eAˆ,8o¿ï€+KÁ¥›Ù®ZÔû¦0n,Äÿ–Å°(ðu„“:7 js´Çí M ­hƒvåë4pFDæ`ïìèh_¼z¤¬¬èý#ûŒq é7ì¶Q[¿9ÿoƋؽ°Y÷D¿æýûõp¸÷WÇ®CÂŒ1vçðOM; ©Ú¶ïŽÙçuð‰‘1Æ#Çtnùw’s·¾º·ox|Åø‘_lf Œ›:´–íÜï͵m#ûwxãL.cŒ%œÚЦE¿ýßèãe<Ù­}×bÍámAçäêæª{±í ¢ÙÍS9ÿ˜~2&Ëþÿy¬¯–5ª<›÷+|é+1Ô ²¥ˆ( 7)8IóòP^~8""_Ü; ÃgÇó^ìY½ÎO7ó’w|V³Iû+)Óáøí³«wº‘nÀä°zAAcÖŸEDÎo®­Q¿õÅø\DT24÷ouç¿]·Ûœcú~B»ö}¾Ö#nYÐ¥Q£v׳M‰qŤF-Þ?ˆˆˆ9s:6™¼t"r΋°0)—ÐÕ 7Ü6ÿ<¾0ñÞqTúÎœ(;íµ‘ãÔtiˆŠéŠ ªˆ]&?¢JòÉ>ö~õÀÚ+#Í?ã6½á×áDD4LëÐ}ö!s% ab·ª=gD”ætôé½èª9#ñŽUënˆC~a~Pë·%sæ?í2b"ß7oLӞòeDDnL›Ð/tÙ‰,Dœ3¨Nÿ¯NãóÑ­ºþÞP´f ýûÅðá•Ónô0JÁCi;&Üí;ãNéÑå;\Q8r® „%‰gÈ«1Î@|óUû ‹j™ßZ¬ÆŠ°-ÜQ»w}¤»[µÊÓ,P÷ΫMÛ¼÷^¶_9†‚®G°±V!–ˆáFž<íQ-|õÊ+€Ý϶ÏË:›Å¸ Þƒý¬Ì^‘ÖÆš¥” ³"àÂoU‡˜ wÎ_€=8K5XyC 8w@†#¡þ`¦óÔ°ëHÚG„œ atnÙ×Û\5:GÁt§úS'¯YOXÓLžh7 ¹xj‹”nØYþËaUÍ•© þ埿DGdå&œÝ —wýÚÅŸÏ%k] Ðß%iÝ®‰sêÛ£IõŠó7îà×/^Êó¨wyÕÊó&ç#[o—•q>Oš•RI/ĺa`NÙBf†œh«r9•q`wÒ¯5pE;Ö}¶«à…Œ3d(€ˆj Ö+1Ofê;7ìHªÐÊÞÂNoˆ1rP ¦Ö•x'Uê¨y0Ïâ!¨m™Ü|Ê÷Ã+š(²QR˜9âð?Ç ƒ³ÂØï`ÛmõQ„S Ñ€'ÜÈO+s„ø\Tl €Înš­)Æàò?©…îÍŸ,PQ » Ö<õÆ}¨áÂL3q©:ÑAçäa•›’h•¹2/íßfðogüuÊ‚CÆÍÇO{XªQ¼þu¿‘·Ì9õ™´¤—¢pȾ{tøȱ3sVÌò²B¹õ´ïåÏ¿U$£Ä™V|™š ‡÷ª I·BúÒ sÕImèîúV ¶ •:“x­CÅ–»ÕÈZø]˜ù­•{lÜÛNdC»&þq1—NÄMmæ(ümP IDATêÚU·œ+´ö´z„X ¨ü[þñÉ9ß#™Ù·Nשaü‘µ&še:ùÎÙã'/æ•LrÀ:Wµ çö€é’ X8Ïl…¤Ÿ‡ïC“vjhãÇ7å`! ì 6–ˆ³ñëNœ»z›?¦jë×6®ùê÷üw}̞Ç¿¡vhÝÊ/iÁ‚͇Sw{{òEI“UÞ«jE­(Š ø?•Ë§ èHýΘ~Swv­WSïãë_Pšmø¬­ÀÒŽ2ôƒ[ Ïé`ÿ"Ð–È Ö"Ú’paH¥q ¢È@A@ žçóxU¦˜&_e$DîݹõJLn`ãÐÐ ; @ɽqjïŽ}gŒ–åÛtìR'ÀCrÎ{÷Ý<<-5"€œuû^jyOOJ@”OíXý÷™øNc&6p³ÌJº³o׶ wÒ+ÖiÙ©u°«µ€e¥D§½ÊY›GÉÑéŠs%wKÈ‹?ûóêÍFÇúïŽêfL‰NÉdå½<‹v~} –þqý‡A˪°hDW„ïß…ð(¨d«Áñ{в7ôïÖ¢YVòîÃ_«a÷y¨Ü†¿•Š}¶ƒÈ3’O}2í¯/–­)$p<7áv²èSÉÅt®’›u_íSÑÉT’´Øˆvçß°}‡fA""0†©1»·o»y_©Ù¼sÛàêÖj˜sõØ_Ûödj<:tëT‘¯ûaY¢kÇ ¤Ü¹´k÷îÈÄ7Ÿ Ðv­*»Ù˜Êœ™¹÷ïm—¢³¼ë¶îغ³¥Ê4ïFÎŽùaâG~_®êäð"›Âñ–þìÊûóT “UÆÑ.s+ëª# Cf%“ØÜ2ºZ¸ ÿ–òQ‰ .Z"§âçAái©'¬¢ÂJ+Î#¾ DÆãïŽ=¾pÙÕãö“âŠe¾Á¢wj®‡" ÕMñjyp?¥fnJùÕè:.ù®Æ‹ó×É,B:½*i¾Ðù¼Sn® ¦Ï’É™z¼,+íW±Xß#ßW¬Ì,¸X-.õ’¥äÏ'?ó»AÑO»¢ï'?«žà\Æ ¯4Vâ`á~VFž¥gÎKúglN‹¡5„ù]5†ŒsQäÙ¹9Cü§!ªè;o²nˆ'³SðåP)(^Qcð £›{cEÒ¼ ëNƒA‘>†zaÐj~¯Ò»¡L£ìe5CÙ‹.(ÁU]ÁK ±å b™6dÝÄ33³ÌÓÊÁ´¨ņIn‚ gŠ ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ƒ`Úe0Íü_ùm$7ñT`œÓsä2(L@PX®Â9}8NrCOÛºa d dŠÅ(%r{ÊÆOÂG¥âIlž´ÔÐSiµÅåzâ"ÊZÖ«”èµû´2ÎQ” ,wcä²x¸”«IË´·Oc‰ÎPªˆ¬›§! ÍíÉ?O-œºMÎÒ"Ãêú•Ûp3y_å>K÷–©5J8©±"ÿõŸ ûÖ·öcYk;µ_zõØŠÉ5ê6¿GZóÔàˆ*€IùA„x6C£pp¶3fqE]Ö!HnžÈ]g<ëp£J!çÙÿ² c9³ÚÔ¿øïbi-]«ô©éÍ™í éo—ÈVµ ÀÖú| ˆæÿvΆß>ƒ.˶YtF½ëbŪ¶êÐÐÙ–Äæ -ó>±6*FÀ)«·¥®’Ô™‚ èI%ƒÔ=ü,k0Ò›×Ø™*á¡`¾ Âà‘G å ØØè4:›2¼D(Å2™3ŒYYê´²¥u1H%ªcäÀ>ÚœS©µËy–îôDJ¡ýP:~ cvÃê/Aêj„bkÍ!S[Xa»:®:ˆºoßÒÍ¢ðÂÇÊY–û†¦},JwÉJ7-š^³3.YWÈJ?ŒYëø9€ 3Ž\à"¨ó׬çŠ"ˆ€Ù,wEÔÌ!ÆBTqQÖæj[¹ ¬eÝÂN°AÓâé´îßkkÝ "Céäæï:7®èÓº÷˜.Å3ÆXNì¹¹£»× ¬ä_¥Ö˜OVÄä`I;ªÕ>rêðä7ZÔ®áW'¤óÊo ci§þhØp¸Á9ýÍzÁ˯¤0&ÿû§^-júúù·íóëÞËŒcì¹[}qößSšøùU:sY*gŒ±}«l¹o8°l\ëŽïf2¶iNp Ë[È2¼¿úÇ–kpøVK?€¨CÐ:Àì.Ul‡î•ˆÎ8f2hÜA R®@Ï:æTC?ƒ< ·öí>¨†ó}Åkåo,YfxÝZ~o|º®p'gŒ]\Ó¹Þä° [¿jÙ ª¿ŸŸ±_DçÈæ%ˆ I¿-˜Ð¸¦·¯¯_§ÁÝN77¦üùý¤FÕ}ý«ôûYx’Þ¤ÓvýÔ¿MÝ*ÞUªÕ9ki\¶ŒåîZþQ«zþ¾…¾¹ét,c d‡­œÛºž¿¯·O›¾ï„]ŒcÌ´É;°°¹¯Wà úÓk@@%‡9Ë0íë§ *Á˜-güûq¬:JdÌhÍ«ZÍô[ÓÔº£X™öü`@Zólºñ+çˆxeç¬FAõ7ž‰ÕçfüùQÏê{Gê4\êT£ÍØÅIyRVòµ!]uzkj®Œ˜V¯nP½†Ý÷Feëõy¿<¤AËN·RÈQŸr ¹ËÓ”9žÛøY£F þ8}W2ä^Þ<§Iµ€©;SqË‚.[6™ðÃ.£d̽·»{mß¾?Ü@DTÒfwh2qñvE’ñÊž¥óæ¯L‘ 9cÐQ‡!Ã1;õ™øv]„ò˜¨¤£—=öùøÁ­mžŽ¸5ѶZl2³õ k~Áóó6_sÔ'-]ðÕ†ý—ŠUÒ•ßß nÖpð‡Ësôzcò‰õÚÍ=Žˆ¨æ ëÚû\|¦dH[7£s½:-§!çÊâñ½›†ö½š˜)eßûú:5ÛÍÊAäwnT¥Úœm¹z}ÆÝ#ÝÔ³r"^_Ô¿jã^‡îf%cØ£ƒë59‘†ˆÒÆ }†ö9›!³ÿ^8ªQÝš.ëMå½}tùW_/‹—^dÛY>nóݦ+¹¢èçÅŒ™ÝuzT¿É½¢Œ—$ÌU0[æ¨ä×2Ï€WCn8"bú”ÿ±EåÿLú¨Oו¹á«?¬Û¦G\žù°|ueP­Ç“r19¬^PýoöÝ2·ž˜M5뵺—‹ˆJæ‘æþ­. "J3:Žß™^p¡­_mÙyRâ–5ž”ßò~ý¨E‹÷""bÎœŽM&/ÝU´Q–hÙñøé,¼šiþyñOÀx“Ü8!@‘ÿ¼Úb,GDÜû‚Ææg¸k¶ÀÜRk£”^qå÷7êÔíuC1ËÞ‰ŸºÖð'"êS/wj¸ðX–YɃBëMøþ Ï ïZ»êÒK²)O%ãÜ°n}f`nÄ–ï×ì+Èöð;u;ÌÛ‚(­~«U«÷ç›ûmvÒÖ?7ÝI•é·;7ªñKøƒb|Ô§Åð¹ëQ?ϱÝL¼Ñmæõ7L?9J”‰™=éNß·ûÎ;.÷6Ê\æ J&5’Iž¯Ê.š'¦º~ÝÌ ‚ËÜß·Àê51n5t&GĪê°ù‡îæ{35õ*8› P©JÙ/Ã/ßÔN~g›iÏI–-Ii9 —Á§› ˜×¶e*uÉÀHáQŠ[ñVî0m$&áÃpò,›_è,ú}gæŽ$Ch]ð(é pe7Xtò`Þ74t<„Ž/ø`¥Àl©Ê•:ú ù§h4¦ôÉg3|:4²6ßÚ®‘›Ë¾Øk†»ç£yí.5DS•2Û:?oùÁ¶Û¨ ™‰±Q·#._:}`åVÞT]ú5XúѪ¦½n¾=¸«àm»ô´P³Ì»W²bØ·£Ž ¦ý†1!>OªûÐúyžíÔFAÑèÍ%®:š±ù¢rÍ‚IL´0Ë ¾þ¾¾~~~þ˜‘Š $=d”J» cpò/¸ ‘lý& ƒjžËÈ(›¦ÓC… HÞ Ši¼–Áµ}0à-H+¥•(ÀÃÐ:WµîœóJøÜp.1»œ­›Æ£¶]ÆÕky¦ãŒKißÏž´?Á°düwRð;g÷ýùÑı›ÔwÑšjBºrêH¢âÜ}ØäÕÛŽ…ÿû“˜v}óÖã–6•¬5ÉYZO??SVN¸y%6)÷aõó|­; g&ðäìì4HÝ›µN%Š aˆç'ÑA. 3fŠÏ$7 ÔÒÉj鸯S€|mù¬Ÿ—+oѶsƒŒèðµ§ccˆü÷Ï–åxû¶(g¡Ê5ï\õß©#có€1Òí/ÆÚt×N|Œâ˜˯X¹hñº4¥D+U *°É׬U_ït¦I7ŒAÆ-2,œ¡¦4ê âMøá 0°p,ü%öØfúû+—,üóHøcβt®ëå«ùíë9"c,éòæóщAm;ˆ®íëTÍùaæ1ˆùgîÊM·<ܵ9\míhc*£’tæËó¨@úã³Y“¾]mÖa­ÂÀÂB«u¬êím³ñËù "c,=rÿœg\L·ÆXÔñ_~¿:Q~q½˜C€{U£º$bV—rÕ¹]ËòÓÔf‚ Ò\>r¦J¾¦uœ¶êð¾íš¬`qárÃQ :º©Àí­UÓ#‡k¿«Z5KCbx’åÇ‹W9êÈ”222%^Ð쌙²©ók\ílîMcØÛŸ};dü×7"ÞêÒ¦U/§¸ð³Nm>\=Ò$}ffŽTp}C^ff®i²ŒÆ×Múæ·c¯]øjᇗ,ûaE‡‘Ä¢jT¿7Tš^žP§œ¿ }\„¶Ãáòž } §Îl G6‚€C[X9·€…`ˆ†8k8²”Ú0$üðã’Úo•ïRµˆÄ³3² %¦±åç«?º{—Þ.°yp•ü½ºË˜Æ¶{#Äôë–Ç6Cœ#ôn^f¿0M›g rcáÏÝ «}Ú›>"„RæÐEÎbÖÄ…=»²ËlºéìÁcs„šÛyÙ9~úÀž½®~ËVîÚüI’Y±{žÇ€¶«ðcaÛU•Cêû;1Ì9uðP|÷ªÞ°VeçB¹ðKG÷F¥ñªÁ­}Õ¦©+¦G3¯gŸvëÿ¨¥{1mFápÍxd}Â÷‚À%ÚÎòZÊP'  ŠmtGrSf°¤ÿP0%¶Ø¬Ö²¾v,&[¥eùèÄEçá–=YÖ$¬Ä%‹/ý}Ì©ºüêüygšLü„Z]â*E/g®" %,³l¥fŽˆÀ¤ø>}Vü¼u–-¼(¹Á[†³+“ç©&«Œc\>­¤«jš3l.7i ÅnÊÐÆ"m£à“§b!ŒG6 Vf–N\ô;+öóŠ^¦Œã¥&|dñó–õ90øIÞeÜfñªc%²Ç([©™3ÆØ­S{¦üôá‹Ò93 ó VÆêUþÁaÒ²nâ)*ŽÂ¯O®JùVÎËûÌo£­D <^´Þ ñ_F¸%·×JÖMì;Zp-Ćœ)‚xÖ;®ê þªZ!6í9¨˜D¦ 9Sñl|)DÓxŸéŠ “ÜAÎAÉ A$7A$7AÜArCÿe8š6‚1ïÎMip’‚xª0Àr8p d&3ŽB.K‘Ú¬ôÙÔ7Í»!^gTDEDAa‚x6óÐÕœÓ×2N«ô¹»Î‡äæ©CßL¯«#e~ÑŠ\eH¤5×g©îµ99¶v™,ÝÝäk‘äÜÄSs.Šâº[Ko¨.è5yŠZP¡³C^Š¨è€Ð.š$7ñø GÆ@AÓ7ˆ¦¥µ8Ë”RÿNþõŒrØR-€ŠYèÁ^ãT׶·eµü=ÂIoHn^>»JÛ<»ìÓÊjÇXÊÕ´iy©{|€(Èd(Ø#œ)Š"ª@Hû?ÅMÏT¥[€ ÕÜ1Û¶³×»>êºZ–/JdÝ]N[öÎ1L,½ÖM†Ï‘¥Ðy8·‡D ®Epl#4ö}ú÷²Ð©:Œ\ÃJC=á1mU‹¯NÜt{iµPD‘!Ͼ2ý“$ˆQËÁzºÛw­Ý»ŠhPãÿS« þƒrSÂ1™'s´P‚•¥¥Méyš6€ÂRÓ""€•••¥µµMS@d¡¯쫱2F×ñ®h~·>¬”t²2¡ûèòü³ \5¡càö¸·–ÄèÒ$‹^ ì-ô÷¸{ˆš•¾¹]™%/«þ ÿ½¨]PjN¥Ý–9ùCr/œüy›7™ºôkÊqÓOIzA^5![Ö«%kË\ç©•¿wʪ˜b)"4/„äÆ Aþµ_„6¬àݼûÛ[OE1ÆXVÔÑéÃ:U÷¯èPýí #3€°¤Õj<ö^ïÚ5|k7]²ý"g,ýôŸ48g jØäç«©ŒŽþþ]×j>¾Þõ[uÿqûÆ€1öÇ'[}qfÇ¢÷‚ëúú œ´0QaŒ±•oÔØšb<°||».ïg2öÇÇ üZÜ’@Fõ´µK} Oð=°¹ÀµÐ8ß-r‚¿#ÜÌþ5`Ç€1°öƒ §Í#s ÅV }Ð-À1¾›ö‰yM‡LmãÀÓ¬Û/ú²·ÀÅüV¡båI;®~3ÆV~Ø tÞù?¿Ý°N€¯oàiKî£yÅsL½úÍÄ7kVôññïýά3qóÈ7¾›2 –_%ŸÀêC§~w;›3Prw,ŸÝ¾a•ÀŸ*5|ðÕ¯™â—Ï^¿zå_Ï=G츔ÂCfˆûyÎèÕ½|+ût2qÿµ4ó~;Œ}9¦ví=’žÿæv¦= "g2‚„ê]I«£„û*AoÉÆUc!Ø€ 0•¤2g4ñõwãWÎñÒÖiêÿuù>*úíŸô«ÜãFž‚yçzÔ¬:~yGcæíÝ›txsBŽŒ˜V¯nPPp¯Ãñç|ëgôìp3ňˆræ‘æþ-ÏsDÄSk?nÒxë¥DåÆß_4­æ7~K"nYеq³†“—ý‹ˆJâþ^A>½¾»ŽˆˆÙs:6™´t"GÄðý+.Z“*.&"r4D£[¾ƒ "J8&Á³ïG5 ègï#q|sÀí ˆß F׆hPL9›ó)RòçœcføÂoüs#¹XU­û¬S£ffüz¥¸º×ñysi$"¢7¢YÃf§ÅåÔ¯F·iÒõV¢tÿÝö!¡oÏN•s#§t­Ö Ç"bÌáÖ¬·î\Š¢(™×ÿj]½öìñˆ¸JãêíÞ¿™Å9—~šÔ·iûžñyˆ˜ùU—ÍM¿—Ë‘çü<µã&gã%ÓÛþã⛲•çßl?¿2êÃ[}ïb8J»×θÑoÚí~³o ÍÅTT£‚¹¹N9GâòjÈ GDLØØüöèüŸ÷?ÐkuDÞå•Sëµ5µxŽˆ<â׺5›IÌÅä°zAõˆ4õNŒý³V½VãrQÉ<ÒÜ¿ÕDDã´Söf\hÇ7#ZvŸ…¸eA§F-G'›Ò"þúQ‹ïDDÄœ9›L^º óÿTLÌä&á ðF~ÎÿDŒG¼wÀ9ò¥£§%ö¨`¿:è×%þ$u‚E‹a’›Ð¦íÞKË?¾dRÓö“Ž!bÜ©6Ø-›Uëþ©6 êý|àvÊÕ­!AÁûÌj–teûà7GÝ4`òå­kw]+ÈvmOŸA›o#æ}Õ¦z·ÿšo…í=iàé·6hr>£àô”!As·ž{D-=–Þþhúí>)×ãñÞôÈ~EöÿðFßXã-®ÈœË/ªT¯'¯Æ@8€ŒS'ÒÝæ5v5m„à4cí&XõkŒ«} {˜§Iø· ¿((À…U®×“WgÞ>K¯RkX~»5ïr ²" ‚¦PƒQ[jxŽóCSmJrnv®Õèæ5·–y~ßÑÙ4²$ü¯•ƒ†X¨Yn¦Aÿ!Ъ%Ì÷‚¾ï?8A[¨‰;Xéâm|àçÃÇÁ¶@€ÁÀÓά}‚^QZÉcšB­u/£¬ÏDm9±¸ °Øƒ_ ¶Q)ß {hó–£>s¸z|Þ\²³uä¿[ÿøkɤy‰Ü+ xùêÅ’1Á{Êçó]ÀXP‘¢•ý‹³Cd|Oì:½½A£ˆuÅÖU±‰"H–J§Pqi¸zJÉg$†Èc›?}wñ™ g׌œzɼè>d]:Ÿi[ÇÃøcŒ†¨½+;¤^I¶q+WÞݽ\¹råSoŸÚ$òA[}Ü‘2,föÀÉ¿àf Ü̓ KaD_¨äR䄃·ÍK€Ââ Jy€þ3baÒVÓ€­¹÷ãMØs ‚”|PøÐѨ’88û<":#ˆÍwâ¾àbké^]“ròžl:Îrc/Θ2ñf^æ¢W{ûéßMËß{{`_/ “‡ÂÂÒT½FN_·ëôñ 3Ò#NïH,çT žëœÝÝ˹»—+çnyt÷®˜Ôœ<2La ,8°tÛt­¢¸ª<úz¼ÍÕ rãj…1‰"¹)Í^`Õ‡v³ûéýÏdà\É»¸ä“õ—|*Yµêœsmå±; ¸"ÖÎ]fôño^ÎêQbÁÜZt­¹Úð¨L™sTr®5yÂÞôrâ#-tÎ9cìê¿Ëæ»:µä¤;Ù[ŠDsIDATTDΖ}`ê°j€oÞ£ áø¸˜ @5øe,ï s·,$An Ôð½,éPJOJ¿2ÿ˯wG$?æ<ßš -4Ù¿¬ÿ‡!çÈŽÿ¶*A£ ©éçî×ÚÑ>qÕŠÈ928øûÿÍqµLcag€œ+Ù—×.‰Ð!W fM›¾æ WE™^PÙh: ÄÜ¥+·1àœcøöåó–¯Ôƒ•i6ôáÍ‹¾ÿñ·þìQZSDà §1 Ô0(ÍÁ&È™bˆÀ:|øËÑ!½:4;îínuíFÓ÷—´sÁeÀš¹÷é¼ÛÇGgL‰ÌpúrÅj­(eddJ¼@!Œ™²Iƒ4îö¶1S{½1bÞÒAãçß¹ñfv­¼=ì’o‡{tš½l˜Hy™™9RÁõ y™™9²É ,/±aÞð §þ4ûÚ‘UË×éºâ(Ç}Àg;ø½Qíwø[ó´;÷u_­_aVã>ÜsüàžZÈ™ÙN!ows]òí;ËÔ‹æþð^áãšïòu±bÑ7nW0§¥Ÿ ˆ.k—M0ljÓ~tÕÉ·î¦ûâ×àJ:“Ç{d÷Ê‘5Þ|»Ÿ•ðœ_R(p† R k䦮l² Âc¤6Ϲ¿2Ö¤©íÞ½|ôz|žo½–>Ž¢ÉTgŒA^Ü‘c—$ ·ÆuÔ&û=ÿ¥o꧟™¾fʈ¾|<<±fÓæå­Ô~òê½ jMªW°2Uˆ)µéä‚ òó5žÞ¿Woë×(ÈOÅ ­û·@"@î 8ó7Ä;@—Fæ?]; gc¡Q(øØ?ó?²`׸¯‡ÀPß÷!Q –qlÁ)û m«öïÊ.90Æ€gž>r"ÛÔkÒÈAïé0ÆäŒGNd ŽÁÍê[ç'—’o:wÓÒ£f£êPÊ>¸ÿH…ZM}ݬÀxÿÄñs’: ¨‰—£¦P}çž?r,Ù¨«Û$ÄIkÊÄTPãG݆¿ÿçZ—çþvC®\7œ^u á§Þë5*Ò’›Ç üþð1_iŠYÒ(U¶JËòщ .ú0•üH6+qÉüw¡tÅ2)ñ³ô€E‡Í¼äñ^çênO¨Ø%îµè]çKU‘c ‹ÕP¡ ,5sD–z°×Øð Æhž{“‘Q‰Ï\‘8¯±u»öÎÝQPч—»yLm,¢· ^<2”ÁÊÌòщ‹~QÃr^ÑË=ÎÊ*Ni?Y7‘~ «]»jnOò¾(£¢ŠW`ÉÍmYY5TÖ8wþaÆ;~.uÞÏ/@k@ÁM[¡¥]çÆmÔ “iCÖ A<k¸Ð‚¿~ -Ýñí×1 € þ­íà !Ü”ÀLÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ €Ür 7€Ür 7€ÜÈ 7€ÜÈ 7rÈ 7rÈ €ÜrÈ ÀQËÞ}Û˜ß)IEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/within_distance2.png0000644000000000000000000003166213051004444023357 00000000000000‰PNG  IHDRz/ăsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ #8As=° IDATxÚíÝwxUÛðç™-Ùôžz ½“JBèzï(Í‚Š @E,X_Plˆˆ ˆ APŽô&U ”!½mŸy¾?6„$4>ïßõ^¾aw§œ33÷ž9gv†E„Êž‚*Ä n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä nþ]"$"ØPÎa/ý‹ôåa%˜é÷ÃǦ¿1Û`tÃ&ò);=õ“¹³üýPwvÜÑŠï¾þ‚0¶%”S;×|³oÏîv:¡*îø¸!"‡Ýê°c‹@9¥:ìDŒzø+ÐU ˆ@ÜüG]ÉãcU·D*¸"ÚæM›sóÌ…¯8Žnݺ¹¹a8qð7Ç =vÔ¡j…¯¨ªZ­Zµ-Z r73&fÆàÔ_8Eâ7ˆ@ÜâqˆÄ nqðOÀo¦þeÌy;æN7ëuBBD¬÷k> A³ú§03)”ºíõ#Çíqçê˜ûñu~XmÄÌþ…ÓSÞÑù»7§Æ™|nÍ;iîM¢Û´ÕŠßAˆônt~˧t:ɳb“z*¤ þH=µ`ã/‡êõý_X ÎuË:ENoúh®SÇBÄŠ»ˆº ÝLŠh‚_ Z7whÜíüŽU9îÕ*Õ ¨îåAûçöùúÓ•Ä,":º´õÓeéûWü~ÑÌLšGê•R7Íœ D"""d>¾ræ›Æèqz…2Nl=ŸtªD‘X“V>Þôç?°{ W@`Þ‰o?Óbÿ¡óŠÎõ !qnùøÃŒã[nY[xG–ŒÓÛ~¤ úýý<Òö}ºàÞØý{Oè6€ÖÍL($ö®&Õ݉DˆµŽ]òò3ùý½Üu™¿-Ï Žè\6oQ£DZSjö~uϺn÷\hÓ¢"éèÈ—ÏHøÀV}¯s›'QçÎ×»§y ñüÓìR ±õÙåou ¹/ÔOf1ŸIÊtôzxÌ’Ù_[&êí·äÕœ\½ÃÝÕ<‰ˆXG-¶¼²üí±þïnªâ‰›öZ7ÿÚ:BzSÑئ:YOG·}Òx¬GógŒisÒ3œÌ¤é*v{깤{e›5çñ7nÌë4é9íz·”v^ܾ÷R`â“O±Sˆ˜™Å!ž‘/ùÞ·SÇÌL'9«<æßòÁp÷_víÈa*ev¢’맛62ï]ö²7w~+G„²¥ne…=ŒF]Þºßw[öi¡+V÷ñÜ{è°ŽYDL•zEÖÔ¿ø«õ‹Þ©;øõ 45˜Ìéçôžž~F"áÂî"f®âyþ³¤#v^^·âLìèÞd¡š­zžYÿ–Ž¹Ô¶’8É¿f¤5mÒp2u·iÎ.,Û]!"Õ–yéè&ãt7ò±E‹MqÃkø’éoóÀ ¹¯¼“ßæ#7a!]ƒ‰ßz²ë¥ Ç'6ÑtƒÎ[MÔ‚8*þÂâT‰)÷ô¯f÷Jõ«zêªßmè¯L¹,ÓY¨ô“r½77w¯ð„jF!Q ^1cÛú»‰N;|d¿%c×쑺²B§åýq(­Q½@b"%$ÐÛ[ÄTRoØØðô­è°XÌÂ>,‘#BDçRmA •…N¯œ©ææ/¸·¥k)šbÞôå¾Þš•’ŠzÊ>·ÇÍï !Aç nîГ( hÖ§nu÷"MRͼ˜RkäÒ/|¤ ´wæÀCÛ¾oÖh´S½rî¥ýiCCŒU"ªéS×.ÿuÀж¢¹Î×XMß|1##¡q çåÍ;ö»²£š©`)é¿Íûê“éÒÿËâ+HÌdOúâÀnk«Dƒá€¾›ÿ']8$Ú–…?†ö{ÀÃB63ÙÌdË“FƒúeoXtÉA78›§ÕžŸcËÏvýOUIßÏͱn}â›ysr³³ì–ÜÔ= >5Á¿ûüêU¼NoþέvóŠB¶ü‚¥x‡·W²ÏžÌt09-v›9ÇžŸuië[K^~¹Jï—„"k­›;–ê°k¦0köÓI—/´m}õ¶ÿÌRah­j/ìþvG—~QD¤:¬iŲFU3v|øÉŽ¯DO^ìä} j{êZ¹îàS¿}¦ÝÁ¾µÛweCh §¢·ýéóÐÞÛ4!ab×RçO–áB5-¥q3½ ·´ÄM9IæÄGx_J²y”ÝRüÎÝ;jÊ‘¾b÷ä¡=dÕhÀªZF uËÉ°¯zgÂ7å…f0lžüÞåF1e·ˆˆž+ÑÄ`!»§ïw­Ò[Êj¡¡¶5[ø*¶/ nÊ–²¾aïuoE„¦܉ÐU ˆ@ÜÀ-œ‰ë&xe“V!&â[[Tá2Ó-ÝIVþ¤\¥ܵ†ÿLmâæ?‡uœ¼²ç¢7WJÙ+³ž÷Ìmýã²]·´(f¶§ü´ôÑØ_þP1Þ”ʅwæ<ü€êv½IX’f¿ÿÈâÎE×ð%—ÍÝ(eÿOBWñ?ÐÂÑþ±ûÏ‹h·º(V{f=aê2¿g|}qÜâŠ? ¢äœ+ 8©ÛŠ¼¤R•ÄÕ Ø)7p;Ç7é8ïøêƒÛ¶ØJ`£>MZ5Wí×^"§dþæ÷»t~õšö¾ËŠ>;EˆX²öíYýmžÝX%îîððÊWŸ÷¢2-<ò»;èn"a{JÎÅ3g³¨–ÛÕå“š¾ÿÛ÷³sµ]§è”RΕ=ŸÛôÉéãÇÏJ ºÜçï­+\?ÖSÒ²'Ï[Œt|Ù¶ÜN†u)Z2Gêž½k¿±SP“Ážüú… ­­æW|î,¶´]K߶8LU;>R£’wÑ'ØHöþýëÏ·=ŠWÓYG¿:céÙ®öœLÁ­žÀpöÙ‹_{Ù­bÓŠáuN}yÏÊ¥k.1‚­h™ßoÛt88¼…ýÄ’åÓSôWûW„Ø‘¾yþcc,îÕCÂ|vÍêºqëé«CàšÃ?¼Ó…Í3$ç+z>ôهγz@a'‹è(}ͤ¸3UG$-sü\‰æ†(Šsÿ;]6lÜÒ µîâ·“Ú%çqa HTòoÚÃK4÷Zmê4«KE.ÔÙ÷~ùÌðyÁuñ>4VJžI ‡öQ˜˜X¼j…˜²Ï]Ъ×R®|ßç>æ ëVÛ5¬Øxx»Æ%'7„ Ž«?wé´)ÍßLSŠ¾—“qÁÍ;@ÑH˜U»Î¿fÐåâç¤Ò³eãûO0‘bM³ÚmÛ˜FýiÏ…óæ :UÈAL¤M¥ì*šw£b;“¢Ó«ªƒoôHa@ÜÀ_95ÒŽéíÎ??lf7E§Ëß:ãËõ)¥îêé—”vHJa?Ž«Ãåj玱dd±[²S™¥D׌ëŒøÊ”¥t/éL¡Ñ'^‰ÌŠáfARŠvAñuN&±únþ¡êÓÒΞrÖéßßhr×›ŒçÎÑëJ9&%e¸BÄ|&ÕâW9LW¤åãU­–’¼å +$Â9Ç¿ÿeÑÌbǹÂæƒÿ;”Õ讟Xô€Cñ,:k/Ÿ{~†èˆEô{ÆÉôËö¨i³äC<}ƒ=üBŒzÒ{ûßÌèU…@CFr*ëIˆX;é°:±¹qóoR9¨F}ãKß¾pì·ƒKÇgXÜl—Ïž9q¤ØÈ·-›¿[rñØoÛ>~‰ªÅ×ðºz›æ¤ZwÏ°n¹wÇÚI»–¯ÿpª®B¢\m¥°–{ü›w—u™6ËèßµiÆÙšîÊäB¾ ;øçZµxáÙë·¾qO¦WPñŽ˜j´mfýjÖ+I‡¶ùíóOµým[ÒÍ´Iªõ+;ßÚ²fí…ƒ«×LŸ¢éÐÄÍ¿J³S³ ?Us?¾÷»yRçñöÌŽ;¼æ»bç«žµ+Å?[?4gÿÊ9Ùî­¾0KÔ«w“acH—Q¯~`>úãáÍÂG.ï˜Ø¨ðÔ…u†äͳCÛ½VÅO/šÔî÷Š;eïÜm.¸LŽIÕUíûæOÞ9Û®]îßõÝضmüŒEVšfŠyzcd]Ñ5óŽìÚñøú¶qÕJô,ùÔléça(Y4ÿ¦¾”½÷³[vÆN[áfdf¥X”¹UªX;¼ð•Àêͽ¼LÅšM¦Šk…“†ÝÐwów`&2ÅÞ3ÛõO§šŽœÓ´ØQK¡íg……w¾¿´Ž&"%8®ÍCq3)2ª%ª½JâÛU®,L7cÕúuêZHÜ]ÅLdªÿÔx­ZÉ5dѨV⓵¯vÊïý14ypþµÝ>œwüt’¡ýã u‰ý¼Ól÷ðñ)ºâ4 Ï¢+#añ÷|X²r*ôëó(‘ýj73‹ScE‡=qw€­aöWnðf‡‹ev Í3%2à$eÕ­|fíàC>®\«úÙ½”¯U 5ˆvûKU |téÄ[RCG7B3âîR¦cÍÂŽ€“÷6XN›žòè>}Cfr’Ý©6èôp@¥*¤½úÖç¬Rhä]]"ÇW÷# 7'EÜÀpþFeÞ" kDLlð ¨ÞäjÊýÅ€ò«Öâï™Ü™ÐU|‡Ñp¨Z7ÿ¹F†ˆ17Ë”™Z†ÛÆb¾¶i£‘¦ˆ˜²Ò¸lúnÜr³°qqS¾¬™¹tPÿ¦šÁ­ìaÌË^¼ê˜ÁZdk™iÇïvI|´‡R68BÖ¼J°}qSnš6D:»,_¾¿l Äd°ëRe"‡»§ÝÇÿëÅ;ÊèŒJu£Qm7_ÄM¹ŠVÔb)¥6AUã²y¢ž¦²ÊºŠï¼†U±ÿ@Ü@ÑDcd nà ¤¡iˆÄ nq€¸ùoŒLâþ‘¸ ¿ÑÄ À”—1Øl¶Ë·eøùMÓO-*î‚í ê°ßµîÏ®¾f¾ÚsT§=!+5íøΣ¬¡uUò‰ØÿĈ¼ðÜÔOÌg%§ðŤÓI{÷îÁµ‹¹è›â¬jþãÇY6DÌW |óìŠÝim‘{öÀ+ßUß"‡ŠPýØV‡UqgÇë–”#G)úâž={X§×4ÄM1îtôkÞ2¢Œ:Œz‡q108¸yËHÄMÉÊAÖü5ØŸî<‚çââ5ˆø÷•ßÛkiš¦ª*únJ¶nXˆ©ìªEc\ª&ˆù³]ûçÿ‡¸‘ˆˆˆüü|EAû«Sªé—ã¿tŠët;[¯w:r5ã;ÆÊ•*wêÜ á7æt:#""Pw|ܸƪڴiƒ-TBÚÑ4S’)>>žËîÚb7 ‹ CmÃß m‡;ídJð›)@Ü nqˆÄ àâ@ÜÀ?Áu7?ƶqÿ@Þ n7€¸Ä ”_ø nàŸ€Ûkâ ¼´Ó¼zõª,«Z8ª'DZúÞïÖî¿ö^5g¬Ý¸?•†¸¸-Ž¼ùó?JÍwqÖ¶; {—‰$ié¤W¾º6nŽlX¸|ý9ÔYÑ£ àŽo¿ˆˆÐ•KEDøÊ…¢ ™‚—-ûÒÕ¨9xü”¿oµ¢ÏÃÑ\OìrMÐeüâ.®y¸^wÍ®|µÖ ü§iÖävQMOä3]ÚóUË–œ°1Ñ™îõ¢vædÆDGüžjÍÚþåû+¶d\=í…vôÞ¦Gw6vL爆º>”«->¡ÿÔ­DÔ·s‹×ž?äÁgßymRD\ÛÏ]sÄÍêkœ‰ñ›©tn!U}ÜžI!¢ã»¿mqϨåŸî%"Ûî5Éõ¢£¼ŠNGDþ1F´¯ÞýÅç'2ü±,zêÊ%ó®ÝºÆ‘»íèù|"bEQ&"½ÑãhHÇes^šðôÌ=f½²õŒ“©ÿf6;Íe>n :Dôn9ûÁDQËë}iîñŸ¿÷d¯&¡¿:1nÉëz>“G­¶þº¿yÓX²«…TU!­àŸVÿŽk™ˆ„EÑåÚìDžEšLöέZ¸GZ±Q˜¶.Y%ÒaDÜü§äÙòÊ|ïM'ZTÎJn¼~ÜÇë;þ¡m4Âý'Gø³¡tàRm;ø[³1¯‘ä–ÞT4zêˆnð¨u¢¿ò.N£7ÿÑNÙ/¢'QÏ;꓈«ÞUãR§u?¸Õ‰ rQ×tðüÁû|g&x‹9{M9^¸óXˆÈ£A]÷·®®“Пˆ»ŒmõùG3Ò¢{×(ñIEï°f¡½‚¸¸ýŸ jYqÏŽ“‰½ª‘gÔ˜ä•ëÛ$D‰–“­jDD­;LÝ5'*>1;??;Ç\Ø<ÊÉÉv¨BDvsNžÙAD¹¹ÙvGÁu9š#/;ÇŠ«¹ÿŽ/<)ñŽ2gל·¶¿ulü1TŵgTI‘‹p oEVôï+ 1_òÊŠ¼BT83Œ…ÿE軹ÃXüD³ôNáE*¨h¾”r ÄÂë÷Š€K}Yƒ“©ÿš|{>~¥ ˆÄ nqå—A1 qeÎê´â!S€¸B¾3•ˆÄ nqåF¦qÿ«Ãª0¶ n ìYT n7ð/“ÂÛ*ÉÕ—P-ˆ(÷îÀ«Š™™‡u©ýæŠÓœº#¬Fà víz…H9º;I„¸rÑN 1*Æ;¥ISôŸ^^¾&ƒBÁQOÿ^Ѩ\{I!r¾7îþ$­´æH©M"q½.¥¼H×Î7pólšM§Ü!Ï;bÎ8úóÐî í;öüæH~ÁÃø2öÇ$$¦Ø5&¢ü¤é n“×¥ï°ïg2ók#×Û”‡ÚÇ=±>…YûbÆ£Ú´jß¡ë¬o³sêö¨v}­¶ÓîØ:>aê¼5ìzéë·ŸèÜ6¶ûöe3‹åžzámâÞ7å’UcFÞ”‡³j¸sôZÒ«õüÖwšj’ùK|ý&s·œ¼xáÜÚ7G¶Šn<{e’¤íiÙæ¢M‘ ‰õ§-Ù™œœ|ê莄fu8”iKÞ×(vÃ…ô,›¼:¶}ïGf&'Ÿ?{ò@¿¨³6'‰ˆdìhÒ¬eïûÞ99=;ã±±5_ø)S4çËÃ:}~ÁÙsçþ²°Q˶˜UQïÙ¬Þë+ö^¸xáк÷cbÚÉÑ°ý›p¯b(«¶ÍÞÅ_Û¢úßת¦U˜8ïãïšÿ€%=Ë^5$¬bÅŠDWoÜeðôÔÛX#ÿà_==ð¿¥OëEu¨!D¹½¼ùô„¸jĤiÆɳ®ä!Dqí+¯ßº_¯¶æäÅÙoß]%«T1wš·Íªîzç¥ËqMêÕŒˆÂ*<²dÕÖõº5Á†ù!nî<–ŒGW”ú–FÚ­!E‰nÔཉÛ!Wõ­S9æ8’œW©R*¸§¸ÁËßTü}÷Çžš8mzÓBûöУG¯È:^Eß¾´Õ„gߦ€JÞ&½5ÕÉ´+û¬©ª¹îX®èõ¤9UË)‡ÝÇÇK&&]«^ýˆèÝcf>»lЀ•š‘¤]Ⱦ”tqƒ¸›6¸áàÉ?O¾åý¥4'ˆ•wÆ1)¤Üx`KaåO¯ZvÍah£¡7ŽƒNq:UWÈ“zå±M…šõzè»^93N~2÷͉Cf<¹pkï:…o¦Mž2}Ø»;ïŠò#¢MĽ ×ÉO"VܘíNXH®<1ÁÓHUz<òÅ„^%’w BÜÀÍv´ m4th£¡eÜÃË7¿>7øpËpÿ¿:KDÂÄr"%ÅZìmkò«“õ‰ÓÔ;å½Ì½¶=Þ»žwA„hÉY¹^õø‰;sfìu*‰r½•Ð{Öwwwž<—U£®/“uJB´qƦñí*ÿoÁvmB/a¢¿nkë¥GÖ nàï‚}„jŽœÔâÃÖ½Gd·i¶öû}úPŸbƒÓ¦€5ôüì«æ¢›åžÝýíá”wãZ1«¥O{hJ«ž÷Ö¬©å±'z¶ ùö»_ž½·æ¸9s·¯<¢a)Kb£ÿ›£#GéÓ¶SÛ‰¿9ë­ðñŒžÕûË„.Gön™´ý§Ut?lþÆ ?nýww*8ï×mû,š±ql‡*¾¶ ?¯×UlîñÃÚ=í»vò`"¢S~¾$ [5 #¢óGwý~ê¢â•㫈0Y÷oß~>#ßÍ+(*>ÆG'x68âþp™ nq€¸Ä nP€¸Ä â7€¸@Üâqˆ@Ü nqÿQRÊ¿oò– ˆ¸ù¨Ñ4vF¢‘ˆJb!a¡|¾¹ÀAÜÀÍbaEÕ©ŠSDUYwÊzé«óï’Ó“ä¦î9¿ÀÍ5mD4&EaéŽåïßùÅiÙ—¯óè­¥oÄ ü•:˳oœÒk¤)ì¥f›I|nî:ˆ(шႧ!3“ »^§<%}Æ)E™ˆØéŒõî­z“rSðBÜ@Q,âTI¯gˆ…˜HUUžøyÛ’Ô·/Å©ižš!!`X¤oOwf¾‰¼Ácí®Ÿðú„\r}æÏžÎXâý›šyy*~±^-õ•?®S-·ZêÂ\ûÇ¿[…żÝõºR¢«uVP?Å«ñ6Ê^ä“ÃcB…ˆUç!ûÞ†îM‰Œ³'û®ô-+̈B9‚:÷ª0Ö“<˜T!åæëäÿ×È”ý¾ùË·ßêT¢Z?˜ó­½h 3?Õ3¾ïÿ¾ÙòÑȸ.ãJefjÃtÏϺ‰YÔû¢›ÞõÉo_¼Ø§Ëˆiew­]ôqÖ­OuvͧòœÅKÆwŽøöª_ÞÖ¦ç£ÅV˜™fՠʯÐõJÁL3{3ÇŽlYµÊçg2âª×šý{ÖŸ–š™ßŸÐ|Èó[™9÷Ça>×­¨Kë?<’nùgb—˜7.~)¦yƒ‰_ì¸Ý ÇÌÜ=¦Â{?že&ÍšñÞÜU"Nú8¬~ß¼âódæ£óÚTîºðf—%ÂÌÛÞº«AJëSÿ†ýŠ‰òعø´Óù§Yˆ„˜´‹jÊróMldÓÒ?4,l¼§è„HøÖòW)wQò›…Jê"¥ü"BLI»Y¹îpi³"ºNj;þøtÑ:}ñ©¦½7¡Šžâú>`ô»ÎªyÉ]ÍúË5 Wf|:±ŠQÝó€¿Á»Ø:—(BÉ^[ŠëŸòçÏúÜ^Ú¬ &,}*Z2ãÃM_X&W1^œ;±²A: ~ÐßàSr2£y©èEª˜ˆè?вK´í“ñwwñ÷ øèÝþ¼ô¥nã+e4yº»é‰Ä»Ûç9»^¼¶®¾xãÃsÖëó:±q“Õ[¬PÌüý”.ïl¶¶ 2êu×V¥”|¥Ø< 냈Vn¿4¾[U"rdüü‹-:"R ^^î|ÍÆ­wï†ó«FÑu·rñE3ÛS¶>²"/4À[ÇÅVþ¶O[²‰1 ŸRˆ‰‰òÙ2'é1ƒ¦°ê>8à‘–~íD„ÄH¤‘èoqÎåì¼1÷ühٴǨ§Ng9˜ˆIÛÿý[[5lÙlÀ¸çOç©Ìœ³úîÚƒ?ÝýÃ[‰m"c¢âf¯=EÌç?›<àùÏ/îݪuÇ|•Óþ<¦W눖ͺ zàÈe331ó²g"û¾´ë“îMˆ‹lÕ¡ÿ†“yÖó»#âï"Ù٨ѯ|açÒ†1yN9ùꈨ¸ ÇNTéÿSÞijNÌÄn4ýë«ÓžN]ë3Õê@m ZóêT˜)¨ íO'¦ã_ÿЮYƒ;Ôîu‘öåðæÍùºä ÙV¼;±U‹F-cÛ/Üp‚˜‰ØœòûcÃ;EE6mÛmѯ‡™™™3VgØÒßÌì’ÿÁº$fÕ>:É-§G‹h&IDAT¦/Ô˜9íðO£zÄG´l–8dü±4 3󱹕cÆ\>±r`çØèÍ&Íý™™ ©÷Mžþ±N-G-ÚÁl}¸yðèÏSˆèïVÆFDŸûýhµ~÷e ZžÄLƒž%­pµ4ó>b&f÷©LÌÔ€)•hpªþÈi›_¢/íXq M¨;‘ed“ÀgÌ,r€ 3§ŸXׯM³ˆˆ˜ç>ûM×Éykî©ÜöbvdšvOÏÈÈ摱q/}ºŽ™¿Ùàótå¹~qCg¯f挓[ÆôjѬU»_ÿ–ÄÌbˈl^o×ﻟÞ%:²yŸqÓs5b"Û7o=ÚªE£–­:|ºé¤«z­i'žÓ#*ªy\Ǿ+÷žc&aû‰Øú•MrIí.Ï}ùÁ‹¾F.ÞXIiß ì›C¾úÊÙö5Ã7æ0kö´øuf¯?ÎLÌŽWÛÔœú[ÎNu>\“œwàû¨ÈüSD“¦Çr ¬èÒÎlì×>¢Y£F“?\GÌÌ|â“îõ|NÌÏl8iþþ÷ž×*"¡ÇÈC)VfÎ8¶ªq³&—ÍjA¶HΔ÷OþlaÞéZ“ü‹;š6®w2ÓÉ·û¯g7E,ÙtITrŠó£íŠÂá?©‰_”ÁàƬN˜oýÔMÊM,»Û×mºàP¾Óé<úÉ}õbÇåŠY55®u÷ ‹CÕdëÇ“[v¥‰X¶>Ù¢Ñ'›Î‰¦åžß•”å‘oߺ{àýhª*?Æ7l²êD¾ªJÚïKZEGœÊVEdÅÝcÛv>gqªªv`ÞÄfý&‰HÖþÿED?˜'¢i’wéèüEK쪦iš¦‰ë¿""•Üeê2UÌç…HÖžéî+†Š’©‰S•Áu¤Òpg–(,ïlÑdË!qHñ¹i'~úì³_O”(ÿÜ'ö}ø Ía¹Ô9¡Å’ígÅz¨CƒÆ¯üšªªª8þYóå•)"’·éÁ¨–—n¿ š–}zctlì…<§d®jY¯óUIý>¾QÓŸO™UMRö-ju.W•³‹5j8öÍ-ªªŠd iUëã­9bKNl±>Å,š&âX·øƒµÇó5)¶Âšê £LÿND•s[…Hê͹?Aê%ŠhâT%&Lú½*"" "YrÄ5‚9i"âøñÓ9Û“¬ÅÊœ½?¦q˹‡r5UÍÜ6;¢YÃQ¯ü&"¹¿ß#aÒW»ŠìªùËÌ=™î(ÜsEdòÝ‘¯{^DÌ'&ŽÕãÅoEDrODEÆ'Û´»{6ŸÿK²ˆ$ýúll»IMäÌ'›4öä"UuŠíD¯ÈÚ ·e‹ÈŸõñ…ˆ¼>¡Ct—á™"ªªn|®OÄØ9"bÉ8½à“Ef‡kÍdÇâ:>°DÄÚ7ªÖ†T{ÞÅ… f[ÕÛ>­NÛ”³}?>÷¦8eUöÂg{æÌàæMšêÐÄ¡·HÉoZ¹jÝðÁ¥_åGvÕÐCÑéêÞýîšÏŸr'õëYKë>ú±¿IÏ$±£ÆúŸØûU*“Ùк_|e!ö ¬N"—Í6W¿1³Âß?û†Ç]3k{( 6ÒÄM·öÈ9""Qƒkõ¯lR˜¹qûFygÏç)®Éˆ˜Ä3´îèC ³«ATÐ9‘NÓ‘9Ÿœ^A´úTÁ×{ûûÈIaúô=JþŒ2‰Îí$MhT, Q«{éðR…‹ÌM„kw6¬MíâÍûœ vô}`" éM¡ŸþM‡¡'Vÿ”Þâ©6A 3ékõéÕfÏêO]Ÿ¶ÛöˆbŸ¢ª);±â:÷VXûfêL¯Ñït¨á®0…4Ñ@'kÿ¸DLv®:mb+f…È·BÍ€”¤³ÄŠ«ÎˆYDßnøýÃ=XŠ­0[PšF÷ aªK}L$Dd¦¹iá*"&BÛ>¡¯_¿ÚdV×—¾ë¿Ì$¢ïz׸èjnEË|fÏ.­R•{z1³_̃ýÂKžØìÎŒu:‘òò¢­ÓïªWPLE!f25üyÿîQá&›Ùlñ‹¬”¾ç ™ˆˆ´I“Hˆtñ}ê§íÞC”³iëîþã&!ƒGز%ß´©||ÅW)õ¦u®¨Sòj1¢_üÆ¥‹‰ˆu~ÃFßSÉ[)ýZYaA£î« ¿rF#DÔ¹AóC{&¢CŸ.è5q²¶æ»<¢´ÓG ÞUBŒ,WÎo&rU:‘M«ðÒÿF0+d¬]µ–ßåsÉÅdoÑz° ³ߧiöÑãv"“õQwp׳ÙO¬|äãóß¾?¤èº<+Œ5ÒÇM¹í“)=ëÜ,ËéÃæýë2¾¶¹Ùb|;66Æ+,:.vñ­5oÊ×@øÉKYAþ•¯ÂX¥zU¢Œß“ -QÁ!ZÓ;ï`²ô Ÿ*î…ùB¤iE«WÛ“äÌÞ7­íÊç\¯æedæŸÊ¸/º‰¦ó­R0NG¢i%º9¯­H×ØÁãCiÎjêÒ…üLt’(^ˆˆTÕlU0¡1œˆè2‘í$Q¹¹FuT¿þµ}©…mð"/'_ÊöªX¡`D1°RU":”šîïè:ë ¢J!i§/¬”OS±â]cmw’šyhrÛo]{9åfe«'³F‡°}®¬€ÂŠhqi¥/Ñÿg9M¤ß•±Î¶5è!"Šwsl¤¨D#ªrÝäk÷Ðô¬tS»N«ˆ‚ªû/>Õƒ}ýÊ3O×m<­iËÈ„.ÃÆmCZ‘v?gÏzhì²Ã¶ñ=Ýõ'̦‚Ý@LF×¢½ŽE%J¾œíR¬z÷¥dJòî¶ ­\ÓØòsLM*”è7-½ç·ä˜„ÚõŽž8é‘eÞZó”IõØ~™¼¬ðw½ÃL3„\™Ÿ¢SJìŒ$šÉ;´à}½ŽD•bç¡Žg&¾:~özO""7EÄäAÄ\8:u»ýÆB¢èÅÍ¢ÙV¤½«gGp1šNeÒH3ÜÔˆ÷7¾în»¹øàž!ÀÝ™‘«鈄ȚcÓ×÷d²ÝhŸƒ<)|ÈìE#Zü­.&Û~š³‚NªTS!"jöÅÕ·ÌÙW ÍDDžDšQ©W:ëøJçñŸôá{{­¹"?*Ü¢žnn6gfág¾Íæ¦÷¼‰®@özc>Z8¨a±—Ïí-Ù-Ï7÷%¥ó$ÒÈy¥ IDDäCD”l£töÿ £ÁèÔ¬…´fYȿؼš½2ÿÇW(oûêoÎ|øtμ7î©[XÌ#+æuÞcß–o\ÿž°î3¾îŠxy-y"ß«Õëe2zÕm³nÁŒ[¾¢Ô‡z}ž›ÿ{zÊ~ ®àF µ«íÛqܸ|{¿w?ºa’ÒG®þmÝôòòS¶ãOv_¬ “ä(þSz´îòð²É}+þÅÝ]cM§2=’š—Ó4±ÖtMXјH§*¢û cíåédJ(:¶îÅ=‡/hDÌlÞ]-|³Å»{ç°­ó¾tU„íèúÆjÂo°mXD#R ¨»gáùWºs—-ü<âÞh;ŠêªEÍiÏÉÉ-9ÀáH#" Rˆˆ.í¤ýDˆHçF»ìç…Se¢°";O%&âdb¦]ÎâY#vsn®ÅQ|%*׫ã½õ‡ß˜‰I^ì1fÁ樈é'’Î9‰™˜è·ÛêÖn{Ã:t}?ꪳëã%æ‚­K,ɲª7¨y•]Ã.bÎÍ6ÛµkÕf¤#ÚŸBLDYô^ 1U¢fD/|[ð™Ë[iѯ7 .ÉÏɶ:ŠÍ»Z•ê9©éÄL¤žØ¸+·ø$™óÞž“CDä“8|X‡Ø‹§ö¸– Q®ÅêãSOÛßÙ’é¦^·”UÂkyo[µ‹™˜´ç›ß»x{llãˇŸ¹rÄÖU_¸`af57'Û©]Ù X§0sA7¶«ƒVËÍÉv¨%êÉ¿cGÝ{Ë~v¯{·IGݺ5Ú½yÞªKµ†T¹foõ¶õkz%í=ì…ï.V2¿“ï¶z<3ur¿¶1ï-ßm4êJÿÕû4ôrN>|ü{ˆÓ›=¾"­déh@ jS:&’WM!ÕIDôùgô~_ªß–z&Ph¥«7ÜÀ¶Çº4™¹.»èœ½›t¿·Úåþ­ã&L|0!þ‰ªÃIŠžPø{_ZÑ5.fâ¤ÉÆô|iÙî÷ÜGŠ{#/~ñ¾1½ùcTçvyÇ· xø™§Æõ¹{U‘]«þ:ã¾Îj׶4¢—§=òó{÷t:fXbÔOéUŸïCõ¾9Ìh»˜ÇžzjtÏÖã_\âä.DäHêÓ>jÛ9'ÛOíÝ}ÐÀ¾kÓ-Û>xjðÀ>N›ÃLÄiC;´\}ÌVb)­zíX0;öÞ^ ‘w»¾?®26jê^¼õâU±Û~½çîa“·q™HÖ©õ»¤[KlI›FlÉ%"²\ޗعݙlõöCAcM±)NŸ ½‡~®koØõ…ù×®ì)_W‹“–™au¨z£g€¿·ë*&qXÒ3sœš¸yúø{{Ù2S²u¡!>LD¢¦\Nó vÓ1iδ´t•ôÁÁŠ8³23­Mgpóð׳±%75_õ òs'"ræ_L·††²Hvúe«“ü‚B š%-+/88X¹Ú&[.¥fé)4ŒôJ¾D¾¡d½L¦ äÈ |™¼($ à™Ò/S¾• &ªBTò\[ÖÑ‘³O-}¦[ñ‰í本\³°Þ7 Фg×9™›ƒõFƒBĬÙ2/çèBƒ¯ß?(ĨcKNzŽÙaò ö5éHsdffÚŠßiv•×õ%“•ž¢˜ü}<ª5'=Û¬óð ôv˺|I¼Bü,Ø›DÍÎÊ´ÚÄ:O?/“ˆ4[nZV¾bò òu·çgeæZYïè/¶Ü´¬|ÏÀKfªo@°›^!"‡9-ÃâèÉD¥VonV†Ùê Þ×/Àd`×Uü©—S}+¸éœ—/¥KA¼‘bpð%Ò¾´‡Œ_Ñ+ÜPtjóåŒ\¿P“BDZæåqó ðu'âôÔK&ï`O“B"i©v•¼Ò2¯nŽÌô{€‡Á™Ÿ–nõ ôÈÉLÑô~~ÞnDDŽì‹Z…PqXS3²ƒBBtÅÛËi)—¼ƒÂÜt$šmÁ°6í?ÜRÝGw{‡¡S³¿wfÒy·ccü_«gl¢(LÓu©øÿãü—÷~òôø„ÿ©RO1`ø§_ÖSˆïø¢8ût=÷—E!TîÊ¢æŸïòÚºMï™n7%šº1céáÌ?®õœ“Uëþ®2"nþ¥F_ûs™ÿF©ÿ”¹ð'På°,ú‹¶›ÝP‘RäÇ^ˆ¸£àæ¡€¸Ä â7€¸Aâ7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ ”ÿãËÝú÷R žIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/content.png0000644000000000000000000012027713051004444021574 00000000000000‰PNG  IHDRz–_3ÔŠsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ XOóœ IDATxÚì}e@T_óðœ-Z°ÄÂ.@î¤DP@TìVüYˆý³»»ìTDl»¥;vÙÞ;ï‡]`Ô'ßÿ³óöÞsfæÌ™3炈 %(A ÿz )I %(A©n” %(Õ” %(Õ” ¥ºQ‚” T7JP‚”ðߧndKæÿñµóº bÕÃê·5Ÿ(¬Uó¹âFê®ÂŠZûsºýçI­èI£‘ýó`_oŠø[‡Â¨¥úTGjו—„ÿâ¿j&ÖjÂ\^jù-ŒñÕºÖcsroü§ŒíòéËž!~*@"Œ]?SL"_,&(éë;fÓÒH Ä­žx «ãõm³«Êî~Ò$úÎL7¾Û¸vÓÅ›¸®®Û?0töŒqM™„¤ß\2ëøð£©Q¦Õè[º<æÇé)}@ndñŠª·ôÖæϯPˆà‡„ÍAŸ~ìÁ#U铬Ӌüî¨>ß7ïÇ£]¾vÓäHN ¸“Ž¿k}ÞuÑ•2 ¤Hú†-:8wð¿X™DVí×eßSæÌZô*›ÃçS*MÛÌ^·k™.À7çNý 5Tå ¢éµ"yï–ññ!—6ŽA þ|¦¯ï¦cRNN°¼þN€Ò*H…n½Ú,nÎÖ{oPÝRx=å…fºm·ž¦&¹íÍ<£×¬µ5P€˜¥ã–ľÝqë›BàÕ"¯YÍæÝžî(E›Ÿõ¤ûp} [ûH[ÿbÛÚ;:í£_óƨ¹cné2ïĺ°>Ò¼Œgæƒf¦=J¤,àyî[®<„©ñðɃ»¾ù"Ð)B"mîgCZÿKˆ›FíÉw9¿jØ?»aÑ4s³®Çy\6¼dxêjc§N^Ū49Fkù¬M Lï1ì°š i4šT‡­“ß^oNkT7%÷#}KW×yu Pµ RŠÚ¡jþ[ìiΗ•¯UÂ}»¾Ãjà4Dœç3í§ž~…ˆ6þ4{‹|Åcãý¶%""UôÚÛÄhÚŠ£<é‹ŠŒEÌüg–""âÛ;[]:,¥()6bÁ''s·×ˆˆü16¶ëߊ¸ >&ípp ´¶äR2òe]á8m"þx²ßÙ{DÔ¾0Êià º¨Keª^äŠSŠ¸X yŸÞd– ê/ ŽvëµòV.ÝÚù“óú˜Y믈øݳ«Y<_Q§âŒPÓ ws©Š@kË©yò,ÞÜ¿÷´Û‚ªŸ{gEŒÜrIQ×iŽÝ,Òä~ßÚ2ÖÌ4°T„ˆ·zª——Û ¨ª¦­°3¹ªðýí¡f´¶wf‹¨Ê¡}õèfv½v‚ƒC€©ýó‰´.7ó…•›—ñŒ}Þ@íÉv]¾G…üEùÁjÎ)¨KQX‘vÔÜe2Wá4kpR¥°S¹gâ~6—³ùÙÇÇûmM@üêÞÕ,IXoÜOñV^Áµ±®hWÿèâÑ}­l¼OÏãIµÜù%ö!+Œô°r™ÿ„ò>ᘟ‹­µµÏЙiy<‚b®¹©Ñ³Ô+Ã<í¬¬¦¬=#&¤Ò"„H‚\½8*ßúZÞ($¥ßSÇp±´´ »8‹#!„L ìµñdÒôpG{»ÀI«Ë)Bäì´œ¢’6úÄ>âêÃg¶ 6nØH;¹sŠãð-ó†É¬5ƒ¿w]è+IÜw6M:PÝž'_L@’ãÇν9Ÿ_Õ‚Ë©mÖgjëÛ5,¿ïTºê¥¤zó) \]æ½™æmmmmmßoÿÍtB€òýTPß)w­úËÓÝÙÖ-(ésYÁ£]ìJ+"Ü3ã ½Va=¨–¼¾6ÜÇ>bþ®¯9E¨À>/ûœ§fmÕª‚' D< £¡×'ªËðáW@]‚ ­Íö=Ç,›‡°<„c4q‚¥.bUï Ÿ#߇DÄWlxàqªí,÷É+uÔ2 ÊEÒJ}|G[–ÞZx-—ÔB$Y«vgD- sb ö§•Õk¼ÕBa»Ùa&s–ïSÀ> ¯ª  ¹BE$Ÿœàbkmmí0úYf!„zº¤ÏÆÔ‹›}=]lm]ößýJñ3ú÷úZ*’Ê!/ýL[³|¹!¯98jv¤ )I74vùñòL°·›©¹SÌӬԸ;ýœmüðÅÏ_5-ÔÆÆÆÊÚ~ÞÎË"B!Y/.yY÷±±uÛ~óc„Oßã²á5Ò›sµ€têÒVO¦Ù¶C×ÖÚRFó8õ‚\~M‘(vC|ºyð¡ú³Ô”ë±{îWeÑ@£e«ì„]n§&¬°À¯#fÙvýaÊ£G;Fu1l¬­‰vÓ'Ç.ÞJNMmñdõ¼é•DCDúÙsóøœNwŸ=öÒx?À{ºÏ¶„ǯwÌõñ_"ÐjÑ:öü­Í'.Ý{r2ëÈØwE‚ZÒŽHÉ5S^Îæâ/y8nÔLÃi=zôèÞ¶ØéW‹Ôš6W{>ßaú¦[wOŒé9{Kën⯛ßH‘¬>ùuþÂú¤ kà¬ø—ú694ØÞaà79B±<:͆ë´hÀ€ø´l $­tTª&7-‡HBI¦¹‘ßö­¹†.H_ØAClp¾‰P ¬#I…ëH/à|¹Î«kk0¥Oø|Öüëo®Ë©¥ö ùšxƒÓÓÄZ¢Wö‹‰Ú,ª?T/ˆy>³·w~»}Wb^]äÅ_NØ\á/µ_žzôèÊÇiÁ!\ д´u³Ž|Ô~åVB|ÌòÝË"%ªmB:µÚ˜ô]*‡7ïÄ÷ó Q­áà¾{òBìâÚ“¥Ãà.}iw=þÅ!¿­ãû§· ºr3q”óªy àÚ´/ÿNIII}ô é»Ý[Î}Òw#×M8ÿ2åa¼ý·u A]… ÀµjûS @šÿ†ÓæÚL-ǹëƒL¥”çqj1úÏFŒF nßc£è$éyC¬®mC €ú\›ÀéÕ±úc—wPèà:°ÍÔýqy0¸P‹fzH+:zúlyu  wµÆIPð91Qbf1 - @—¡»_ (ôõ÷“Õ2}ݨC"ʇE“‰iíòàúöåóNq…~î.Ú½üNíˆÒ¤Éy|ÁÍë‚ütM€_N Û7•W¾À°¥Zù[veÈç/[ì?ïD•ö%þIÓË»ÛÆɱùVtØ­ê_"ÓÀÛfÙ5D9¦ÞÞÑ݃ÇîzrnzÏç»wÿþU?+Xfîný…9|å:!X“%bh™¶å¾}Çõ±WÔÜV ÀЦ o[ŠÔ&Íóœ»tÝôÓsòÞdóf˜ulàsímBÏÝ •Tä,Ÿ6zaa¿#é•üçœ2u>µdcA9q:KMÝy>¤O+`¨’Mán›äò÷ÁënÝšIÍ óÀYÜ=#u=V¨Ñ6òÉ#_¯îv½º»ÚØi="ùÌÀT£VŽ®Åäfä³%£÷^lYM)ÔèâºÊuMàä¸[Ûƒå[¼vdgï8hb>S“ïñ¹pn¿!¬Y2Ñ*zaDÒÞšø“×»¬FC­{ä­}¿bÓ²Mz~“ò²2 E4#c/WD©áªÙY5µæzâ ~!Yì¯áì×áí¸¿¸=5‚­¯/ç¶ré¬"£*Eo²(¢#@/7ºàŠ«U[ÐoÕ©Œ›ꚬŒ»ç+FDi0Ȭ­W€¬ÇgTÛ· ÐgžöqæÒP¤o0(bC¬s[_=\ñŠc7œ:êü‹Ôðk!£›¾šìcסRùÒ¯-£yYd4OÒÁ@»*bØV‹ÿ9 bK5Ù·H[S³œ_ª°ƒÂòR-umÙ—¬êCEI´tZÉ‚²*M‹å‰DµùÔåÛ³Ü=¢.^>2)À+²ÓƒíÁh`·fjUã'& 8ƒ ¥ß”ä}.#=9# ¾æóš¶nRÕ&³™µ.}ÞÛb¾æÙ ­GŒP<›}·^k¦];fÝàw»Ó¨ÃÝÏ8M ò•+¦¢Õ)áúø†£ùß­h9.¼_ mÕB!½:â©ÑRV™F“. ô²‘µfFÌ_Y&ò\ÒN­C×}ÂeJ&¬ÙçÚ±"B7sÉ´I÷Þ—xŒ³§Õ´ªÚZíÛ§3ô´îá ‚ Ðþ'îÙw1ç'<ðnZg€„ˆWb3eÿëÓ®Oµï¯ÇjPÀ¨®ÓÏ ®ÛˆO›¶n·©†+2ûLZv=±_KºÛª‚®³-q ¹W2°šÙw¦1û4Û9c†Y„¹ôÂû˜1}þ`n4±ií7cùÅí£ÚË#g6iݶ!6uƒîpPð6Èu¤¸§WX?†¤¼úªKÞïB ŽiÝtÿÓOeŽ¢KõvèÕh©èk>C·Kõ¼¥Ñ5ˆì@5†´%YøÖeýÍy»—ºÙY©hhu² Û¿j §¢DÕ¬cšª–JÞˆ‡‹xêüžÀþ±ºaèjIrKÄL@(ý^Hh¤rš’ôBn%ѹ9–eSùÊEbé¸Ê8Z*Z ;h¦Ñ„ÍË‘‰v•(:SЀH¥šÈ YJì^±Óx] jêšÓwDŸt<ÅàºKyXédõqµ;zû œ/“ DBHbÚ Ï±³äÛ¸YJÒõ1OTµB2ÍóëÞuÅ$?õÚ×–CÛÈ_µ#Aʉ¤øëz¸×FYTAèê`%xñìj!%÷×õ4 guýêiÝÄÝÛhC™r˜f¾¿¿fÑjƒ€*!W6¥Û¸i68ŒÁg3žÄLZrP†å/ŸôJ½ÿ8ÿn5b£Ws..x\êàÐU½6!Ô559D.JÈ0 aM[uüŽJþ„þëi&òªŠÁxzlÅKTòê:`ÑÜGk#—·6o­U³qZ›®Ý»víÚµk75æý5þ¾^8sÝä„S^æ]4Uˆ¼4©°Ø‡–¯:õ²TSC…ÆTÞÇ—™™ ô¥|WÕP 9*Þ]™¶õÍÖ#+QÛ(btvø¢‹„ÆGgª6š«aØoAoá»)GßÕŠÓ ¢ží zÚæEtœó1 n£¦wìܵ[·n]»vëÜgh{Ý¢¤—Y2œ5#)†€&&›{¬šÍ”[©§«¨ýUè4ae(pÇôÀR©oö¡Ýüy¥±ÝÌ<Ø´VË:=»22Ò¸¿æF…†ÝÌÐušµìܺ%·‚Ó¦}—¢Ìœ· ëÚß?J)©ùñYÊ÷‰Â¯šæÈëY7ˆ`6á€ù‹‘}m›7ÑŠúËùļ, @$àpyb©R5›ù÷˜eƒœUÕBf›ÕÛö°dùs’‰=?à——•¥k=dÿ$‹6X w‹«L­ç{pzÏøéÃÌ× hwÙm¿Høîf†CýóK‹%­Ì %Pe—à ¹[rÏ776ajiÝ65îhtn]ˆ¼ ž ½¹°I·3·ÎmX³ÁÅd˜4µ–~ACom©Ž„HÄN…aØ›‘«:q™rÊ9RpÙìC!fGåd](Ò<÷6¹‡B÷@,àTª(8aˆ«¶<= XX˜ýÜÄÄDŽÄbÛÁïZ ó&DœŠºß.D¢Ök¨{OO'7 ëáK–-™4Ó£ýåd7—]Q¹B egĦûµàlÔžtL£Á¯ºCÔn¹YWû£ÕÔüôá9QóüÖKT š׉˜uÔ¹“@¾@Ìžfa,ŸwÃåwyõa÷ÈQ³£Ï÷PC‚£÷ÄÅZØíò6™è(s½ùœr®\^È㧘or`<ýŸKØIÂ.gKÃÖ„ *;N-·p”â‘jc !äóx ‘l- èëNm¶v c+É»¼>æ¸×\M*+ÒåÌémG­?7(Æ_ fO57®J!ÑòÙþ`¥ƒÂx%»*~h:x¦Ù>›Ü2ü+x·—E˜,“S?@Û’ôÔEGJhä²ËÉ~äØÞc¬Ýõt´Ç-?aíëí>èò‹r6¯*㨜͡¤|`ô±ë(|¬?¬WÝ Sû .°åyØë ÅfW-óIØåÒꀻ‚ Àš7?dâ8ÇÕ"MšˆÓ¢—Ǻõ ;ÇšEô2ÑíÜ©‡ÇäŽmoKù°f˜_Ó5Ÿ×ûÕ ÊPB1{r_cù¼® Û³÷gšÈP±+*~Ëbl,ïFÁ#IÍåzªî">%æ¹8Ú¦êË2h8é z¤ÝÖËßëË»©ú5×Ù^>£ ¾L骞ĹŠòÿWe®Ô)ÕPzQÝŒ™ÓdWi,Ÿ¡ÆH)yb ‹ûÙØfò%¦BüRÒUÉý€írTúE™©ÍùÔ«_!H=‰'5)¬ #‰ª‹‹Â®ÊðR$N¿ÁÁ†û¢T®E´Á¶§k¦,UÁþÙÁÓ÷Ü­Åq9ŠQ N"**¬Î> ïgzã ©ðj|´Eý¢5»Qä•ZMŽÔëØÉå˜ÔòÞIãþ6VW20*JŒÈ¦ (ÊtR·ÇZÏ¥¿ê6R¢Bnq1»ŽëKSÑÓm*OBH£C&5œE¨6ÌyÔQ”ù3#~Ïtu«¿Z«Ð°ñ¸B#þˆ˜†S5Ýo' ˜ŠòLú‚Ô`z*&V-‡«´…åyÅu=R¢ÛJ—ä7$AºÖõ±SŽ}ˆ›ùóýÕÕÅ>«-u°qôŠ%î6³Ò†¸i Ô~ùâŠ@œ?ÜÃËlþѺy©û>pz™u×D"«F~1FSs´ä—c9 øWi©«Ë¤ÿ¡¨k7k¥¥Ú(nt /_øÏÁ§«ó¢çÔÖAÚ&7Ž-ûb¢Ìéc¦´vrnUp­uœ?¦†[/ø¿Dœ¶mÔ¢TF-¥1ŽÆÅé0È -,ýë¯r½¾·bç1²dôŠÙ>nîêóÛçþnóÈh}95qùìÙÓŽêv±¹}÷˜ùÇ>I¿×½ò¬b%(A ÿP@¡%(áß8,Té—cæ©1iRMj ‰xÌE±Gu?ž›¾"(i,XZ­B&Íñ15®ŒB¸_“×î8ö!«T½YûЉÓ=ŒôåW¦–Mý¦€KñqöÑS•9¥‰‹'ìH_¹÷LGºÔ¾Ëx~jÖ†›ëŽjWiòÄïŸþN,#羨)Ù6‹XÈE#"F,Üz¸SaŒ÷ʲ‡#¥Eî¹Óï¸Æ¬ölز¼¾{Ùá{o …ÀÔÒõúW¨“a}n‹ìùçE)A ÿ;ê†hè/ž„ÐHɬ‰³'¬Ú×Q›PH7¤C™ ,§@¸mÃ"iI~á‡%½ŸOÞ·p˜%<=|ååŸ3V.ño£Í+ü²vŠï~‹a§×O¯rÃ'F Ä™Csekw ‰Z¯ß„¶çÁ‡5~=e~ÙÏïïG†®¾sz. bNqF^m<‹s³óËyµœðñ'µÒ`@VÉ·Ìâ_¡…˜“û3—Óh1vqž E¯5ãäÿœ;3ôÑÜ›ƒ;+& zY<“z²‰RÖ” T7¨¦º©™äÓQÒµw£2ÿ« ÐÕŒŒŒ!`¼zÚDZWÏ/fUòáܦû™ç'uV—~ÞÍ.ºØ wõš}ÒÝC©ÂéØÃ@‹Qi!!âÒ´7Í›»Cí‡íXè·CC–fCé´ hšqîÈÛ©#zjüÆÈzöô©¡‰µ|ŽRÙ—øý?MŸ1ð.ùê”74V†¶×¦UYoÎîJÐp›êÕUúóKâž›y6“BŒåÛVÕiÕ­— 1>0òÐÀI܉¤üüɘ9ìæzE„ôg‚x׆…R¶yŪA‘Ñ=4•ò¦eìæŸ"‘˜ÁdÀ£ÝtLfvR¬Z$c¶™<-àõ¥ÍõÅÀ À£-s›ø-Õè<¢·vJbZ‰ìÄ @‘C§î5²Lô;ÙŒ(9.®˜W½ÏÏyg‰{÷h[©È·w¯*Tš÷îØF¹ŒïŠyB9£alÔ#ýuZ§FjÂœç_Å}Ú#%,O{ÿ½§±1‹@qÎ÷Œ¼ «vn¡É ‚¢ï‹šwmAziÓgIlÚEƒ: z_²‹+ÓsM»…~‡Ö-¤d$ úþésI…P]§e7C)ÂY_Þæ—‹Úw7j¦¦ÌáV‚RÝ(¡†ƒàØüDí!æ( ¢%üWÅnþo)à¬7‹Þg²»¯™ ÔÅJP‚Òºù—[7Póèd%(A Ju£%(áÿ3E‰¥¥¥b¬^Ð¥DüÒrHå¥l¡Bu…ˆ¥¥¥âzî4G!§¤œÿ+øQbaiYŠJk@—/’ö•§íŠ¼²²ÒÒÒR6§rãgm¬QRZZJ!T”—Uäów_^RÎKk¡DÄ)/+‘ëH^/ó+ʤøG¬¨òÒ‘¥øKDü²r UZZJ)üH¯aærJKJ|^q)ûßó•\‘f IDATºþo’DÀ.e j¿¦$%¥eU?£Q\QRÆýƒQpÊKù5Žs®äŒòÃùÿïÐ}ˆ±³³ Üü²úÉý#6á3ñKL˜Ý˜+ )•UœÏU| s|¤Qà¾_9Ü´èÝm+w +’œ¬¬ƒC‡„…… æíjkkã¸ó§ª÷äƒs,­m휽ú¹ÛÙÙ9ºFpÄ ŽÕ}º-Ägq"…8;Äëï‹ò—=SÇÃ,‚v}@D¼ t²´wó?iR°³­ã¶§eò7#Or6µ´ñûöÇçSˆˆ¯wóšZúàû££žAQ(,r´³ÉçJê©Váïj2|tÒå=ÝìÇKðßg&y¼¯ÿí³ÃmFœ«M‡²O}¬<‹ËnM6>¨°¢äÙ‚Þ^kÅ¿OäÛw2jSàæÉC%ü·Ã¯äÝ MÛ¾ vÒÛ¡w{6gÉgØv =ù Tv ™üóZw=U-%KÃ"ˆ¨éºùµ+H3IõW_ÄDÄWÙ|ô„AåΆ/vŽˆ wëHÎùèIŸï½“`ÑŠE(1ïøT÷þ “n.gÉe*2R§e'Üuj8$³eʦÁ‹ÎMñ‘þÌ}yÔwÜ Ñ)7ÔèJ>m´¸KÒÒ­é§õR´éT|xö45; ê³ ¢Ñ„=ƒmQU@…"VéõŽòñR´:Ô«s’QU¶Ge- ­òâ,øþÒÊ3Nî3zÔÔ¸€üËÉÁÖ£® !dkô{'·Ð@/[·A÷jÜ—IìŸï<£\UGY³ã§ôØK!?㺺MÚ=kð’5ë¦ vò4O ÝITÕ;èu°‰„" °àxÊ ¥k-[UÞGÈP¾ãÖÕ¸ùL¬1Çïnže¼E±ºEbd³ÅUÆŸ^ŸáOß”êpðü¥~Î>Vý'¾»¹N&xu\À¯/_ó»„ æ ñض7šu°ˆœ<ès¢¨3 ia˜Ñ¨Ýòǽ#Å]0g…H…Z6}ú½ôÒª¸\[êag>jâ?G{ïQk(‹=»mK"á}µ³4ßšM’áÕÍþ=…¶†CfD²vz„»ßä Ãlœ7_û@¸_â|­†Œæãèâ9ò!×VOýÄ‚U³¢b¾ ‘Læçê=pLÄ`;[—ÝI•C) tóŒjkk¿úôcùUvkb¯À„Ë[£]ÇNïãd>nµTª3Ã}ÂG µ7ï;qÑ@ÎlÛoФ1!ŽŽîgŸJU@ša¶f¶'Ot÷›^DÉßeC(Qùœ©+ õ.2rN¦„Ĭïèä–tøã‡ÚºûŸ0ÆÙÁnΖ‹€H¸“Øõ›82ÈÙÍ+ás9!äâª~Á3ÚØzŒÜüÌÅÁ"5“-=--#ñp_ÿQ@HñÃmÞŽ–#'Lîgç4û ô¨òäþ^±³õ²æ!_ãvÞð•ë¿âLtôˆ¦GºÛî¸ÿ]¡3ÅN\nâ1[ê8=‹ï¾%RgJðåê+Ÿq¹ü·HT;SÙz÷´<õYŒˆH•;ÚÛ|*ÔçLÙš8˽:4g€O4EQˆÜ@{ãø ÞHB¡8ÛÛÈöOæ5àL‰²SúY÷ö ±`ÙÚÉir×hP(|îÔÓá5‘*lj›«øšŒ¥žöY¿p}bºSÇ4aík7ø¥Ù…åun/ùîjf›!Büvº«Ýx ¢¸ü§µ¹CJ¾Ì¯š6Èzݹñ{'ŒX| Kαw¯SäDä=ÙkºKr3 9bDªèzT¯h)Ë*Þ_6±â"îh>ë~…´µ¤ GS>£ø§³±ógDDgÇ/]~X„ˆˆŸ¯lqò"þ87ÜÎÚ)‹ˆÈy¾·§YHgŠnÑó®Œy¼»²%”äÙscëÇybDä¾»ÜÛ!D„øåÄëÁë¥ã)¸¿ÝÈ}ŠQXðÖÌÊí#_*:O¼,äœ) ñû> ›ébDþÓ½=­‡åÉúùigcó¢T¨Øåýt²´)–¾áýعïœñù®!Î#vIßg^ûÛØg…xmë@÷ã¥OñÝûTúÿѹžÖ'cE¶£¹Ýý,©ÐŠ§´Ø~ã;">>êì9DTé8æeer…”Ò™úÕ¼ aÿîȃ3"|Î/Žîè©€ˆfÁËoŸ'ý¤T¼‰º:õdÌîV¬zOÏitõíD@ ˜„ÐØ¢z/$e©óûYZZZZZZÛX[Ûà¶=L¿{bcáñåýU¼¶3qDPˆÊÓ#%wï¾v´±VÍ5è€søy[›nO“žçC›²Œ›Åà8ÈáÎüQ;žMÿVà0̺kSˆ@ €ˆt}×p/ý]Ö.]ºôà—b_jgb« éi>¦¾oåשª©qëõÓgºŸUJ5~¤&€ …—©.ÕZµ”ðøǽî`×í~bbBBÂGÐk‘õôŠó>ªëhwQ@MóNmUkQF,–P"€»·Ó:¸;èJÑRÕ³bBÜ;Žb©`´2ÔÍŒZyñÎÃRz»‰ci 8uâm{›N‰‰ ?4»jMH D·S?)ÑC–Žú´w{À·˜+œˆÉ¶%9¯Å*ÂÉ ‰Éº-;½xõHú×lëűŠ¦ÛÚ@©4n~gÏ­ÓàqŽ§mº¼Ã¥¶’*æQª ¨u1 ¡[r¡¹äçû¬òŽÝ›Ô¢ÓåçZý>ˆ°BõÖ«À ?«`·ÑµeH]gm5mÕŸÙù`ئê¦ÍšQ—OWa©V»‘¤æÂòE@¯…š­G€ç€©³¾ˆ ˜2kè ûíÕG¤•¦9;ïDJLû‘Z2wMBç> Ë<ÆÞº¯§ šQ[ãhh18%<õ?`žDTA“†, @U&›ÇU3±£}=ÂþÑ/ô³ÚM:éä|+„”´'–³7ÈŠx€™¯“¾Ki`=ÈOS]C7žïxãäÕ»Çlʦ÷Vó¨@·~óÀóm#kEƒûvP;ó.W¸q ^~̱4é (9qñT³‡kúì›xX—ögÍäA‡HÚnZ=tøÔ¡·Î°ˆ_N[vŸd7—%›Ý¤ðõ)×ÈäÔømU•ª,‰P,` @_}­Éo`€™L7IÊÎÿ`øÙêö,_d;~¥QKºt-z{ l-Rí~î~ö½ý×'ªtÃ|WËe Ek]›C ]+THèu•e4¨Rˆ¼ ±ZUPïm,ÏP]«P\&!„‰„|),ìØ®údŸ|ý£BÃR•ÃÌ[½ø˜üêA¤1K›Î̇ºþ £œ‘àVÔÕ‘SVÒÁÒkž¥ì›¶ãàÅm‘fUŸ=;Sœì r5€çO9tZ¥®È~.`:"ÁìlnSÃæµ/û“— G9Ž ´t¹œ?!@ÑÈl;Ã9“ˆE£:#"!Èã‰ÕÔ X£¥@T²åÜzLEèfÐ$ãIŒt ~]J<Û©Õc® Š*èÓ"$ï{~>©¿¥!•b9~qˆ¾´w¾€RUo•Ÿ@éÀá}ºÆ=~×ûÙMo¯Í ¦ÕNB zñbD$DÈã1ÕÔêFŠ”¡âßËE7;,Ÿ5pëŽ=ê5-C›™˜·ÖÄ>Ëb—˜¶ùÔ·JOIкt¤£pâœDaÐîÏÔ`g×ñýYß-I”f*†oÜÓ§ìŠgÐÄ石‹ŠòïŸZÓoüÞ™»ÖÊmŠDZs}½ŠÂ·b@‚8hý"‡›"7_**.ÎÏú¼8Â_d`4¶‹*€ 7ïçȈñ/¾å•ågî™?BM»C¯&¬5K¯˜OŸ$o‡ÌXé—¼x¾k©_¢ÝR—!G·/wNFo;K!„ººfΖ„¼Êž¿¾/hÞÃV‹Î?âv\xÒ¨vÖ402Þ¬S¯Ë9œò¬û—ï}ð÷õë¡~'V­ÕõG'`3ÜíÜÞ B7ÿ„Pñ6žÍB<–Ìœžqëm›Íùpg_ß~"žîíµòæû²²òrvù×ÜB}ý¶@c°(þûŸì2žÄª³Ê³[©.§ðÓí1EeA ¢ÇwÒ39œŠëë¶ Ìý,ëNp*=ÀÚãö碲òò¢ÌÀìÜ„®p­(`ùœìݯ2 ØlöÓ‹Ì¢$ÍÚõÒ(/^›ð½¬¼,uoäÇ ©íCÅ-Ÿ~øQM?3¿¸ÌdX¸vê‰COr9ΧäYêMÃ:i(´—%ù·ú9¾Ï).///xû†£¥g¸xúÇ­áŸóŠÙìò»¦ô ^QWðü¢‡¼ˆ9~ë!„ ú=û2wÝ/e³9¥?GúÚì¾QgÞnÛð¡@¬4u~A݃A¯"·ñ…²'4“ATµ½q}ÿíUc}üCòŒgŸ\€ C:©Æ¬Øß&mïâ3åVZè ÙÉ~4&³zb2™Œº7°2Ò„ɬºÜ °fîßW˜°â›"„ jí½ô`yH·eÓ† ;ö’q;ùnDwµ SÌv£,¸;ÎdKÏûBZÏóɉ½Ù·Ã‚‡Œ‰j9`ÍÍó{hø׶˜£s\7Ï8p`èðHŽñ”økÇX´Â‡YyãÜÌå—ÇššNQa¼ÿX¯‰6s扳íå&TÉ·wɯ?Ië|}tïÉ7®Ô,½}:§›y×#3õÖÉ;éu9Ád0¤G’1™t@¢±ïn|×´~¾ásNo¸œÜ¯:öîÏýùctx€Ž!š?3œÌ€zwâÖ{¢¦Ók{.,íëã³ôrQRÒi2÷=HRMØàç<¬í  óÂ-€Þfí|— Ãü×Ü-ðÞ|±÷¬·§Ïš[âýçãô² ›OñĪÖËUS÷ðóÞ÷IïÒáhDÒS«Æ`Òé@3¹ugëå%£ü|ýÂÿÚò÷©Fj„ά>Ý‘HË«¶ ¼uj馩a¾¾¾{Þ¤ÞÜDCUýk7¼ß2Æß?ôƒébOã–”D “ã_d Þ&Ì¥''ÌÐ˲ž×ïžß9¹¿ß²s…×ï\Qg(²(éúþ7Œ]51ÔÏ×wü¦Ô7c[!¶è5üêþ™‹Fùùú*´|ri1Ðè ¹›6 4õ³Ð|ýB; @Ô¶ßN´Í?5Ðß/pøÜá[oNòh+ðêZÂk§})’()hìJzªÎÕî ®j¯ü§j\ Uë"sJáõïTÝ•ùÛ౑;êÝL_{- øãm[àº=Öª à†uŠRtÛ<ÕøêS­›Ûk(j˜ã¶k_”§Ò&¬?_'ä‰FawÛK;¤1BÑõó¨ð{Jñë¯\?uEp¶†lÕa¢âꈈøæúæ­xßૺƒmP„êJb•°4@´ªZ;Æ…¦–*¦ðiÏ"¸º¨lëu‡'ôþ:ÒˆH².Ìz³uÂîÉP'”,.ÏãЛêh0•±Æ 4/K«•½A:Δð©Z©xªí]ØêýÛPÍÎÊ×7ÐUòòk‹&">Jyjfmâýg¹ÏRS:™Xë¨å›ÿRxö$E ª-ä¤i›M•ÄQª%(A ÿ›¡bD|óàFìéS%H¼÷>«âºIK>Ÿœ^Tëá½›±o3+ ±=ÇÕ« 9N\~ñú05þVÂÏ—n¤æþ<¨J ÿwìð×W®$gÿ‡mÂjßäŸT1ý4lÝ e8¹ v]¸w¶m…SrüÛ{.$‚­Û¡BNN’oÀÎm°m;\Œ¯.x'¬ßWý³ü-lÛëO%×oElÜ çÞÊ(âý; ™óáÉÕÄgÈ+Š=wQ"=b¡,íô7WbbâSÊÏ‚›gOäp€J9üQ†Pf~áƒøkq±±®ÜúœË–W˜wê];bʱˆ¾&fVn%rÑå0ûžòQ4ߥûü;lé‹Üç±–&¦¡£&F/X8còX{SãyÇRËãmM]sÒ¶pÛT¿ ¿6ÿääÜN‰ø_¿}Rcéøyº7Q‘‹À!æçVðEt–šž¾.DßstÛ·c€˜ÿ#»@¿][‚TÖŒ–í;!À.Ì)®ªhèèµÐ€à3UutØ9Ïï~S3ÏÈiÚR¯…*á”—s‘е›ëêh°°8ó‡@Ë@_›É0ô?AjŽIŠòòØ|Áj¡§¯Fో KØMÍ›¨Ks䤭¥«§§Ê œœwg^©„güÈkcÐJ£zìÝ]'êSÍ$üÜÜXÂTÕj¥ÛœŠíJóŠUõüüR®XEC[¿¥äçüPÓÑ«(Ê‘¨è´T¥œœü"±Ô´›ë6ÕvÎë«T;üÈnÙJOWÆ.Î/asÆl®«§¡B«/*ÜÑqüxqS@ÌÈø©×ºU^v¶F³vM5¢ŠÒÜ¢2¤±tõõUé@åüü¡©Û^KµÖ.k¥ù_@ý¶ ¥"K;+ɇ‚@MuAWEðñ ¨è‚¾çM ;àG:Œ9´öðá=té å[ @ýö Å ðéèؾfÒ¡C'`"üx!«´àÃ'èܘðÀT:´0`¨hBó&5ð|.­Ï÷‹^ð…A‹!n À¥¥°Z;&W—â~f½´ ³ Z׬ÎÒhÛšwPeˆ…ÀK ˜ô*&P¼¢Å´¶-èÙ9Å@gé´V!@ˆ„—“[(€vsݦš*H‰fæ´5hž•™Û\¿ƒ:‹&¨(Í/*£€Þ´¥^5:©ÈÏ*!MÚ¶ÔÒPeÑišÀ`P‘F¸¦~íÿ·@™´ëJú×¹+›*Nï$Eyƒ§m¹ûúëVÒ2¢œÇ®¡?xÕ¼º94wøu‰íÕ­‘ e³ÿwZ7Â’¬«£íœvîÚU ¨¶nÏñqòò[»qC„—KŸþ ˆcÜz]ý*FĬg±–¶Ž;>J9 –}"ÊwÎv åâ±8zª£ÍöçEˆ8-ÌæpR^ʱeV}Wî9p?â¼Üfkë0kñÊS‡š;ÜÉCDÑ&ˈ#?‘ÿpAþñìÊö^+Ö¬™êieÌQø#ÖÎÌjbÔ²¥Qm,ìŽ~!R™WæÛØ:Ì[¹~rX€¹×x6búÙMöVv‹¶ï¹ù#?Ì›ë½/JA /ÌÆÆ{èÔµk–zÙ…/ÌEÄ9#'œê:æÀQÙw[s«à‰ó6¬Šö°1[uá5">Ymca¿l÷þ»YÂϧ#­lì£Wl˜=zp»À/õŸûr›Ÿßœ{H‰<\l—ñ:f|òÇŠŠO7ÌúX…O‰š0ØÃÒrP™BäF8ǽæÖÞØ™¸©‚ ?‰oÏCd²Å@œv‘›‰Ø&›¨ úF#"v“™4Ì`Âr@uTa"¨£t}W‡:áh©t ¡;"¢Cf†ÐSس0â"âÇ È¤a!¢ zÌ‘Y7ºh €œz¬6ªB߆Ľ۲dÖM9j‚~U´\/ú¸é¾_ƒL‚ù"DĽ“''Ë¿Xoì=eäàgÏÍééÔ/’BD„z:x‡‰š<ÌÂÔáÒO òr-lœÖ…8Ž›2ùK›cij1vîÊE‘¶ö.ßøˆˆ—g…z,¸€ˆÂò‚ïÙ¥(~üô¢(Äb/ó~ÙDüéÑÝõ;?ßÎÂñ^ ¥ØºAÌ<5ÌÜa_>Ó¡ Ýòx[S×\ž^á4ry#™ÿ9€F*ÏH´wòJ'†ØMÊæ<;ÓËi_VD2ÀÃþtzÑÎÈÁ«O=EÄ»[ƒg9å>û…øcÿ(Ï•·qgT¿“VÈì܇ ,­'ð§…ÙŒÏBþ;ûÞn_%‡‡8N¿-sÖ²¿¾ûYÈE¤$‰„¢äÔp¼u¯ØYï¯=ãŠðztXøžxåó¿~Ì*—ˆÊ\l^Wžïµw®wä†{(*ôêkÿŒ[;%ãæzïÁ‹‰ÊÒímÝØÒm¼TÙóŸêcÙ^AWÉ6§o°´]=ÎcÔZÙqYw¢ÝgÜ–Uÿ°¯·ñà|D|w6vzG!Eq=-SÊT^ÌŠÀˆYÇê³|+ÕØÓÍaáméÞlÜ4¼ïœc_)Ñ‚Þû^!¢D"®‘9B!¢µ*ç§ø`Sä ‚1Jw¢»´@ÌDäfɴçDê‚"¢8ÖE"bKÀæ1°E°LÝàÅ÷ˆöUä"JD¨ÆDÐFé‰Yˆ8â¾â‘NÕC¦.ò? 4˜¢X݈ÝÖ)Ê|’ªMlÍBwñ7< Eê†z½±wO‡çR¿[çÞ×în õuW¸Åè“Ò©q«#ìEa¾¥¥íÆײíûšm»þSúÿûÓ£ÂH*%¸.Ê¢—+­'žE”ª—oˆ™Éë]Gˆ)…ê†:?ÒÎ}ñCÅC(·5ó8´x´qßÁÙÿµÊ¦±áÄúèoÞiݵŠô1¡Ùk«ß~ŸêÞûö‹¢«ç‹'{;rŸì¥]ËéÙE†Ý\¤Íh¨P¯9”‚¸õ EãR„1-6þ¥¾a÷¶ÍT F£Õ0 ™¡Žk{Œš¹"ù}±•™¼"Geì‹2öð¥š- »´Ö’pÞˆ%põèžÍ›7oÞ¼õC‘öÏïå71Õ=Ø‹¡ÙÅTµl€¿ßÂ38š¦}:×À¦Äú¤qKÕNnªø¦L @ {wê €ü‹I‡¡Ž²2]½Úã»×òrî[ÙAW–_ß­»}fÁ«ÆSlPâÞ¥%¥¼˜¹vD$Œeg¯1j†ˆ4½Æ 7Øá“è]AÀ‡/©ðóÀÌ =¨ÌË`Ï›ÊjfÐI€æ=Ê¡¤j/HÎhcmú€s³R8Ú7¡ÞÈ—ÛD&=”*t) Â!{ÀúGªÒ†´€¬íð¸Dq Ј" •(#0Ø;Òȯ'Š0v; ÂvÛZmQ3óÞÒ+,mSuÁí¼swòúúö‘ú–AQ‡— €ÆèßY2>ý”|y~~óæÍ›7o¹øA“ʺ&¦@*ÁµPF€SÛî…‡›ÉÎÀfŠ5¤GÝÈ«×!õNX¦jÅYŽýH{2rÚVéiJÿ…ð'·hJ( F—­£°è„/7 À_¶IȳJÖ0\¯©Óžÿ ÔÓÂÒðÎRJÑYjÒò@Eg¡z·ð»×\?~H»³ªotÞŒÃ͛ԕ©~‘;û}}ûúÑÑ…!‹„úgÎoÞÊýöÝ>?¼½qîHŸEQ!+Ïζ#ª:8»hH7Zº815šÕð2kk|Ê÷OžÝ»áaÝÌqLÜÚqõÉ(a¨V"V¹·Á&æQB °X´Jé¢Ó‰¸Æ¹(F "›wt:]B e^°h€HD¡KÏÛh8[QÌPcÊÖtX*b.€VåÖ én^å*iV9,º‚%‰Àr¬ BJVL†€vå÷ˆ¥èËÕ€Ž¨ Ç?ÂÙfà¶Úu¦”¨Ü> 0³zীÓ2ЗþЄoO¡èAB­† IDAT.´q3eý¾Èúc¨TNn ¡P‚ 0è´Z£ *²=푈Ö×É­·†t‹ª“W@õ¾›Z¬$c¿­îfPƒÈDeyì.'ß°‚~wêâÙ×£CÙž³ÂÅVL9E*#4"óÀ꺌A߃Ü&¯k¿cöãipÏ”¤sÛÖÙy2m ð¸”ïر€‘cëôŸ·ëê 6ÆŽ~ëæo{©ÌÐE™¯`îc!ÕIƒ&w–žññ•JSý>6ž‹¶ž^=ÂüÚ铵NÀá›wßZ´éèØÈž¸Äޜ̸/åßÓxŒæ½Ìg­ÜwakXÂî5Ln„Æmß艉IŸ>Ûµéܹlk¯¢µpBqó_|tèÒ+hôŒ»N—]<ô\TÙÅO+‡“Êj1å_«»ô&o~”uSøø§È°‡®L  ¨ua²¸¥b‚H22^µÒîþ;,Ð51”¤¥äDBàæ¦eGÒŠ«ìšÃjâL€Sçˆz·[hë°y£¬ÌÃÃÍëT4º¨¤å‚•88ÀËÇÏn¬¢¤ú‡]oÞ@¯‘õtl »÷&Ü­û‘×€˜²K&©‡!l´Ö©lST \áòBgCoéÁ XVoÞ@¿bŒÂW?eëÊÜ—l–mGUcÕ§ñ¤ê"çUüÊÝ'jN ítD¥TäúwîØ«­ÒÎ8$üôBAŸö-˜XóäUf3óEîM†Ï¿@WeÖB³MðJUqÒ‘”ý^Nÿê[: ô ½»æØ“§Ïì˜÷žêdÒ¬¬Oì=jì–þ¯1ʬœ¯ïO}?eüó¿Uï«VÑl")>{'ùsùÅ‘Ãæm¼{ï჻×cn¤ô¶vÄοúV¾Ü÷„³bäÀ{Î$?L¹uáÈ“2±c›&÷ö­2ÿvâƒä¤;û_ìଖíÚELYtçÁ£Äk§C}<ŽÜÏ:S[½–ð¦˜þ¬ð€„/Õ¹ ¢ò÷¾GÎßLII>½}GyGË^Ìz œ÷¶œ¹ý8ùîäq»M¦,¨uœÏßk²Ž>y=éÉÄ©#×ÙL›Õ˜jMÄå§Oߺ÷‰1Ö¡ó”¨å÷RŸÆŸÛ»öðÇÑs&ü–l„NxeèØëñ—On>ïh¨ X1udÒW©á{4‡QvÀ9^`ÒÞü„ Å ÑÆXAi Øzƒ[/ˆû~‹Á¨Q ~€Ÿä3`f”^Soð¶„i³à­!ቀ ÎnR—7@ïÞ0ëIcÖÂœ»Ð’”XÝS_CGUØ1 5:XЄ7yµN(ߥ0¢;ü¸ãOÈNŽhN-‚Þ½aá³Zˆ±š³6ÌZõèÉÓ˜m+ 5;øµ¢[Ì_«ù`ѪƒçnžŸ3;š®gUË^;bÐÖùã/ÝMN¾{uêç¹GÓHÊî¿gî ï瀜‹›š š¤^Ë¢"¼–žTIY÷©¤ö5"„Õ~ÿܽã\§,Þx:6îÈ®õnA}G,unZÈ$ÍŒZ»dÔµ¯bø/ËâmÜ™b¨µtr²•Ê”©•K»ª€MÖ_N8»oG\\zËŽfÉ·V²‰[?ßĬáê Ö5Ôªka˜{[©Å×¾«å„ ->;{1·Ïø-・€‰¥K‡–ª@šý?ö¾2 ªfkxÍ)ºìFi¤AZQ1 QìîîînÄÂ1¥ lALò'÷^ß}@@PŸ÷>÷^Ÿû1àì=3{Öš™5kVîÜ7uß•[y]z…ï~úÀÍk¤åÁ‹#ÜMÚPòJªL$4V“®ÖJMN&Ü8¾ïÀÅ xj­ö^Oî®ÝWF¶‹9yñú%Èûmðu2@Äak£:]=~ñj4Ê7]qÛ´*Ù¾hÃÉ{Y @YQT\*hÑÅÆ\ !§ÕõÁÕµ»^ŒNkv0½~e(¯!]"J =¦ša™‹ùºþë†ë@; m&*·qJŠi²eÏé'•,»™‡}ìº "!Í÷ž½ý||nGÓQ«#:]9~!ú4G½ÍØø. GbÒìde¥® @líz7Q`æ u\®iuÙ}2N¢¤}*!¾ƒ2ˆ©/ÙŸ+°ö5aÏ=ðØá×Ýö-ó¶€ûS`Ð!8”!œ9 ƒz"°å¡ÿ@àÈZ[º€Tx ŸïÂø-   òË¢Á1öF6…¸ãà¬à5 «²¶ëXB.(ä¾ÿÅ€Š ­ hýûƒUóúá4ô€´lØpp)Je€žî0°ä l opv7œ» B{X4AÖCߣ Ûsˆpð1”úÁ—ðihý4zYKèx TëÖ©à­šÕgË–“ÅÖgo®ç "·{Ü­3ÛwÉ"CWîgÚ$¥öŠ2™ šù-9«{íЙ‹Pp›åaѸòJÊÜ:ýà]ËctªÙa[W;¥j‚ƒŠûŒÜû¶©vnÐœÃ8tõœöÀaб£QÏŸ<–Woµá|ŠAk% œæNvŒ l¦?ðÄòœðÃú.ŸûG©Âÿ¿vbX>zÄ€=á=êßé?‰nuh¾ó3íM[ÂôÿFs„†¾õûÉ<×rÛzÌ@±Ñ­ó¯á€@W'h0«¡y¾¹ÛÔ¢ŒËô_ÿ¬2Ä…GÙ üõSbBž\ÛqùQIÝZ¶m¹ÿÖ‹1!¤ õÀ¡¸ºŽ¨ÔnáÔ‘¿ ÎìýÇ~NciðÆ—“ “Nפ52”Òî„ÜÍ–$ýœFü¾Õ˜§ü¿8õÈo$7¥±4–dùkš)¬‘½|X#çþìôÆM°¡û4T9Xü„ø±õõk>ÀÚW ŸtŽõx3cí±Õ~ø{Tû{µ,•ÿqºÿs<æŸüÀg#¹†H!äÈLß#Ï%€H‹ÝôŒ#ò¥Õ '!ô ëv‹b˩̘ä?ÐÔܦO7ccÓ#§½È8)BH¥»•¾žëêóG ¯]‡/#„Br®›Y÷ø¥’"’·S|ÝÍÌí¬ÌÍçm"¤. üœ ~Þ†¦6VÆú#B—ˆ‘R±d|€·»mÀÜB€|ÒǦÿБ¹%qæõá^N&æ6½Œ Í*•…+—]aÍ÷³22ßr½ÊúÉ—¨ }W_#Y‡T» 'D ßóôWrŽûö§¿ÉuB²"|ÌFÇKÞº¦èïÜÐ ý–µ|ËÕßaÎP¹‡ßüî§7­+ „¼ÚïÒmH=H#„dsï< ŠyµgÕÖŠÆ=ý¿AnD6LYšYÂÊH;vŠ˜Ã“——g×1UWà²@²|àðr³ÉSïÅÄĦ¥=pn–¶†Ù“°ðÒ‚2³…漫×^ êäg „L ³ëÄ=eÎ×ÝK&ÍØýŒÍæ*é…8x ¹"{ýÄ)"óñR’R“Úgœšx&¿¦¢šr|åø/Z^OÞKJ{Ö½ôö”¨×JKvïeÆá² âÃÍRÓ ‘ÇÛ©sCÆÏè1ró£Ô{÷ÓÒl‰~KRñ»U!¬<±k±çÝS'e;’ÀÞóY®†Ð9 ,ý$¶ÒTl¥ j­›5k¥ö;CËX9yûÇó˜ñ_ƒžÕwž‹#Ƴë2ƒøSî >ª^ý9¥i©Oò~`êr—€ˆH¯‰ÌX=¦+"ü8Þz¹¼¡úñw}xž ¿Ã@Ý ¸ô¨¤J«ëwu5ëü@(9&™W'?çŽËKnPÞlÆ®ùÞ¼ËÊܹͮ ’4X—–¼*âY›TOñø çâÍ©r …Ù[…; 03Š¼põ‡Œî¸eßþVïïg¾zÓzè’ ¡ú4 ý±òÁóœa¾€ÀõŸëÿòÀúÚ‹·2)>Çe|ólþò!÷·€”’Ùc!%ÅVL¢ Ç®M¤ˆ,§Þ-„Ÿ>Ö¤\ ¯Ø”BJFl@ššWj £ GZúðŒí¬Zñ ©ž¥e{H]ÔiàÒšl"bÑË™£Ü-­¬,z{FÞɬ ©àݽ.6v½­,ìæíºHÀÛÇÖ9ÚÙ::ØÛºù\|˜G€”å¥ t´sp´¶°œ½é MÈ"_Ç\…ŠA.n;Sžu30/¢ÉZýõÚòöNS°0±­¡GʹÕCp¶4›¹õ¢”ò.å¬o;G'G['Ÿè‡Ÿ $äæÒÑ:ÃÖH^_õ ÛVö6£ÿpŠgKÝ‹'·Û÷8p§„HJw/µ´²s²·ñ [‘/ a-e°èx&!€’²-sÇZYÙÙ[YøŒ_ZPABNηò[qkVˆÿ žnÃÓ> ê˜à-ؽxœµ•­½µ¥÷ØyÙ% ªòàÊ0ssK3Só…;/"!s|œ ʼ] é‡= G\L^ìf!;´Ù5¼û°-/rN Ðó=K òòäËç{ôõtî­º?ƒÈŽQÎf]â2ÊŸî™Þ±ßŒFÑïÿ*þû%zÁÀÍ73—r¾ñ QZìeby*_Rã=5×QgY\)"¦oj ·tWÔÓW™_Š+jºÂRel{9|"Æëøð£ÿªøm_gÿ·NymEÄœ«ã탢iDÄ綺½³ª2j—dÇ[9õ¥j5–ÌrÐY“TÉô(ÍÚgnèúIŒˆxeÇä …§±8ýˆÇÚïñèÊŒ/¯qp’RVÞW±»¼Ç¬“ýøzÞ¬ß& 3Ovµ_'/XšóòNZfgå±.¶«¯d""$ºd!¾ò³{F\:rë &¬XÉ0Cƒ½Ù(©xgme- þõ>ÖsÔ DÜܯÛÜxY|ª9¡Ãã3ŠQ’ÖK·ß7DDñj÷^“®É’b¯àµ<<¿$阆Ëfr2½øì Þ1×µ‰g*&[››}¬”"báÛgwŸd#â‹‹³½FËÒcìgïv˜ùÿꦑce¾ïWæ 0yWŽ³Y™…ˆïâW ÷_μÝ:hÔÎD<¿q€]ß²€R+¼ÌB/ÔÁê·‡›‡ Ëüj¾¿ÏŠpDL>Òw¤ìC~}-'å¢8ÕL׫˜qª÷µ ¾Š’§öÖÙˆ4bIš‰¾k6bN”ŸeÀEËcŒ{¯D̾¹ßvÐ8Y‰¬}&6Ó*ËòÒã¦7æBøgägSŸ‰;Æ;vž¾ï´]‹_TÕ½3åÚQáÓsó¦‡ èc×Û;,«”b„ÈwVÌVðX­)ÐÄÍÛ àè™·µ8ÜŽ‘ÑÛ;9¶Ì¯V·b¾åªS¶²9rˆXËå8ýÆx^]5îsiYá—Ü‘!§-­ã úùÕN³ÖßÛHrN›µfçévFæ]åêrÚJŠÊÅåL–2|°ó e¨çø"ÕTÛéÚu®õ†ÎÍ)á¶í ¨eûøñõN5Z.Ûut”¡Ú«gO?{×­•ñ²˜°•XTøõç%eåÒ֮έ¶šŽnÿ\X,IWï:aßUDb (àNØàÿpå"1@qJʧ~Þ½@ÊÖœ7²s¡0×ÔŠy•÷0ꚢ“‡•rYiii»KOïjn94éØÓÆ ˆ$b•ÓRAc]@p5êý¤ÙÌÍÄ}ÑLù§G?Ô•µ·Ÿ{pÛ„wé/=zÔBƒ›û®€–v4ÊÜft]ºŠs²¨Úk£©É”cfå¾yõèÑ#eE^Á‡"ÉùCw­§ÍD ¿šäoÙ–SX³-G¿KGNâÓ÷@àÙ­[šfæjÝö%´ ƒ«Bæ³{ˆ'—t[2Q@¥µŽ½‰N#{ñ‘ÝBäškóš¨s«6T«1@زÔlmã•»O^¾s/åaA¥ß¨IE% ï‰Ówúûûûûû?*T»s¼¶eU%eP×jZ[2ÔDŽUQ)’i¾$âr‹Ç=íãäèäädåÆ°¹~í°.ü¼B:½˜Ei(V™³xÜèPóq{ÄWgUœ§{åâåË3ÍÞ°¨vÒplk3r®¥ØÒÁ] ¸-¡Äߤå_îô«Hª,Ïc<¿ëÒ²ùCÜ=Æ.x‘û™Ïç ¥°åšÅÅEfGÌóòèkef™ú†îº=ɸÐw·‹£Ý¨E’ÚBåÎ#9ð"³XÄ¿¹ù³ÍD#Æž«XíFÓL•ý¥\ü¥L(x|ÅÅÝ«ÿþ^ý¥s¹Ÿ… Ÿ´ªœ¨((“k©Iñ:â6“çW|w2#Y×W8öt15½´Œ_.¤ª_,yfYÀ@6|æhãäädçä“OÈç”ÍŽ}¼¢ž—”ñË…R È+åi5!øÓ´0Û­ËÞs)p;:ÂÒ{Rýõ8mç4[·$Qxäp\¯6Ð(±ù3Ê¿`UÌVè /¹ó¼Ô·UÓ*±fö£ ÝT¤Ââ+ç.{ ÁY®k¿ ÃW¸mûÀyy„.Göíd²þÊ“÷ýLFÆ/qUÿ@‡:­›•ää‰u:ó€@QN‚‚’Èé»tPæJÃܾ¾žéV¯)‘xＧ¸ÔÃgYê¥ÅæóçMزuc[. €–‰»tï^¬¯€’g—]/K¸q‘#ùò¾B¥£¦â_[¸\m.¿B„HÒ²ªò‘âë¤Ìƒw¯é(€$FXÅÈ·[søMI%9W¬¼Í^ÆtŽgØ*Ï ´D*0¸Ïž›†-«÷;®Ò ÅeÑï{Þy:®Š ¬(Pbœì‹¥­ÕäZ¡¢‚‰÷­-Óê°« zNÈþ*·Ó½/mA¾@ÒDù{ÎÏÊM ÏöÛ›:Ù17AÒ< šº|ñÆWñô™½×ݘi© wÓÎC!(un*ÎÎ’6Lï4…Po©Î!säôƒ tÞáúQ͆oê=çsàZQÞ§ò–A­TئÖÿîFR^pèp¸¸ƒn¹y›F¥­~óm9)]4Ì=}µMèk·ú¯8Í,fBpûúںݴ@²uÖÉž³×¨))2…¥ÐmÄ–QÏB?:w8úÉ/Ô»Þ–=7lÙ @Z0c~ìÀ5³€°™®”å @ÌîqC&l ?øoy¶jIßZ{ˆÅí5Ô·ôQ ¤Õ§‰¶_&¨‹×ÖƒX@D§íË-¡à㧜òXl"©ü!™@'s#²eî‘Nn®uÓD±XDÂgȶR;ÃÞÒ!a§­òe¢@—弈IzÞ¸áÿtr#*{·aÓ!UF¶Y¯‰GÖŒ;:¥_Ïžz†äÌ‚Nï[†ˆD®éÕø(SáÍ^F&&ÆÆ掟[yžÚ¿®<7õÔWî 5Mæúöó½sL¬[ÛVîºýùç"¡A«ŽmŸmfh`j3²Ï¢=¡ÝxPËîÜƬ´RHÕ741³ ºä¨kµºªO®®¼ûÐqͬ#= ,Þw}éðhB@ppÇÆ·…Òš2˜cKNoSuX‹JÊê1ïÈ8·{Ö®K5/…ˆ¸;êPÓ”µ¦¦¦#6/;pH€•—UHZÎ ÔÇÜÉÅ#IÙc×üá «úì¨8¡¿²ƒµ…µ•í°ÝKÂ÷jƒÚö}Ó²³²¶±´¶Sqœл+(˜ø9ÊõÓ3]~£„ ‚¢‘ž’ ]ÐŒæU7©B»©&ϼ\ìMzºXnsì®jÖg"—F†ÚYÙØX;Žõ¾¡ƒ žElŸ¸ùèôRù&ÜÂÞK€À/+•P2e³sðfÃJ+k[k›$­WÖxÕdÞ&Øž¿ÑÙÞÞ!dÇ›CÇ·(?Ú8|ý%¶¤¼\ ÃJ+Køu’«pBí®Üïek×;`Mêž“{›e8{w/¿µãíåMŒLM,z [éoÙÍ}íÙ}ôLÖ%TÐâò² ³`B=LO_»ä4x³Šhqyi¹@ÝÅÕ Ì^ÏôHš@~ÊJß·%<¯vŠÌ ÉŽ9:së™Æ ÿgk¦hºÞ°° e`þ­tÍ?Ôýy>éš©ºoé_¥~®®ÿ]3õê°M¿ÕÒ†+Óˆ§Â|R¾Ê4SýǬ­]á‡üÏß–N˜½õ§¡ÌôýÛ9Ú’·›ÔÛøQA¥ _’tÍ êvRßLÕsºÞ„î5¿·J¦™¢Šy¬Xšn W8ý0ëÍFO×YTµë?Ü>ÔkeJ `Ê'N\Þ¨ú³5S¤nŒÕ:Âã_>©ç©/äwÓäS^–¼zùJLÕ•5Ÿ·º7êmzƇB>óF®IWqá­¤GÏ„Rº¾Ê@‹õGšiBÁÛ—/]Rnݳ¦©qÍÖiÌ~ÇsˆO‘pí“šHøMñüO¾?¤%ORwÎì/1™k¤­€õÇ–– »žžëÇy-øÈ`¦?»÷*£HU[³NÈá*BýÀ’ú[ÕÙš`Öª]kAÖZTUÿå¿Ž=µ}ìѲƒóÌe‘µ©ÈHr: …ÆÿÍÔ«(hö0ÕÊؽk{‰èÿ¶VD‘»7½*RÖ뢀 -,7„:Ÿ9¼ûK9ÕÐ òdÄßùM³ß¾e}‹4¨ôôt3Öþ %Qu,òk«á6 †êQòÔ­-Œþ}ózåTT¯eìÔðO•¾æ<½óè뱸+š5ì$”t\ú[µmÿwK£Gxci,åŸÃÝÔv’ü³åTõ ¹>@þt0þ%ŸlügLV­1bý¾àõz_Õï¶ö£?Zk¢/±z—P#íøïBÈ…ÍSz[™¿ûõÏvI!¤<×ܶϷÌM!¥7'õ~ÿt0È‘®Ów¿ü+Ãü¾»ˆ´ÂÑÁáu‰øï€òßA kBJŸ[ºøBðäÚiÎö}¹›UÄÄ#&´èèò0‡Þ½‡/ü"  B>?»äëîèàÜÿÈÝ›üéaÿªÐki9f®»ø‰À×'+fN Ýù‰lSñ³ýÇÏø²lZÈØÀ°è§_e Ÿ*;°v~PHè–ð›Õ[!ãNÔ”ÐÀÐIsï¼)cZßZ7sêá‡@åÞ>qCÝM Í+Óo"G->—>zêZc×»§ïؼbï%Nl‡¯oœ2vÜ„éÑ)ï¡:¸BYÖúùSÇM:qëeím‰tvêøÀЉ³o¾*aÆ+y±ßÅü´s!þÓWì—¼¸¸#`làÒ©*ˆ Ò.Ϙ4nüô+O¾2}­™œ–õvùdÿCwŠÀ“è]ゃ？/ž|îž]òV>|º½|òÞôŒ¸Ã!Sçoü,’õ™vnGHpð’Ý—àÓÅÑS|½>e÷µO#Ãæ®d²Pòäé½Ë§…¹™ÀÏ3aŽ¨øþøqAŸÊ¥àÕ­ˆÉ¡ã'Ï»—ů¾QœÞ½j\PङKŸ¢¤èÝØ óXÒ'A£Æ~¥àU|ä”ñÁÁ¡ƤեYâFÌØK•½œ9> 8tÆÝ”lBÅŸv¯˜=vlðª}Ñ _ï Ûx¿,zë‚‘ àÉíˆî>chQ¥œ¡ù‰eC›ihhéûx;5}t+Eœû ªD+rA¿¦M4:8L·î,¼ŸA®Ød3vG'Mµ¦ÍÚœÜ78bö @Ú£ûÎýT””U›´š3ÇäåÉ3@ÎÃϯ&7Ó¢«E™´ˆÝ]ÿè ÿæê-t=Gõ×zt%žñÖ!®.ÒlìÎnÊ2kÆ’·ÉÁÓ4‘¿“ÜЂœÔè-ŸÛ¹„xtø8ÜÞ5¿¥Ãôé“: “ì†LG›>c,G,õŸ¶ÈN¯iVüþ>Á[\GN ò¹4Ëkå<(ø¹}éÆŽžc½Lp IDATÔŸ¬\Cº»ž:90ûØŒ í±„€øéÃÄÑ!û|&.˜?ÙkÛh·Ÿ(B¾9»f7· ö§ï®0ç·mZðÎÄ¡!Sƒ}m6ï},]JäUUÔy€‚oiÏÞVüùó§ ²àÛ‹„Èqa£½@Jÿx3¹w|Ƽ“éã&Ové,½ÿ-“ øúÎi!»ýÆOïßïôTÏ%×¾BõºÃpå^Þãǹ¿mÌôýÈw{E’°îèõqC‚¦„ wØ1ÊáÀs!À¥?½¸±5êµêâ˵>DºùLHT°^¶xvιµ{R?B^3x~¤÷ØI¡£Ý…¸n{P ÙÙo–Nßl48ÄAW-ëÆšõ7F„„õíZî?gÏ“¬Bð9çyöÇJÑûGWÄWv]¸t™ yê7}!$#våøÍñ£Æ…¹u*=wß“¬Â&æÞ®†êÚ]§‡Œp‘_X;ÇáãF¹žšîsò…@üäaÊøIçFªÉsb6N¿ÿáðqS},×øö>‘IÒóX^*Ô7qòp­±îý_S„£Újòà®Èê4sÁ<áå%Ûï òË<6vï«Ú¯JŸ'ž±á^èÜå†ÎàZ"¦ Éd×·´£ëôé[}uµ€t4£™ËÞ'0ÄÙ ôÜ%Ñؾê,9õå«Ö¨qd¾¼o?juëžÿáFÓV‚Öm´ïd¾(¹÷-]Ú29ºý5„ Äйc§gORÅ{Üùô6înl€î#Bôšq¨ïóHØŠ‹W­o¡Àbå½Îo®×“Y'ô§˜ù)-V2¢ªL^YlžŠ²J#ùkrÇŸ—ìóþvÎaŒ}Õ‹Ýaæ¡û«Þ=L­ËhÄwNF™•ˆˆKúu_~«ÊÄìã1ã^¡•ˆK'¸LÙv‰1Ð:`æ{@–³E÷Lt½?"bYº¾‘ý}±ÌÆ,`UDbAþµíÆCfÈIòÃOFS(òµíq³ªu~Âr‡þ«èfw’קtìd‘hi¥ƒeÆW!fîÒíÑ7‡1õâç[8}­eFÍqÒYy«œ18»=ÃÍÈç"=¦w÷“+˜‡_ﯵ±–Ðø`Õ0ÛÙç™!ç=9uùNÍØ£ì»_¬Š?Qô`­mŸÅøl…žÉØ2Dññå N¾˜ÑÝÞÇ{ßCD:̹ÛÁ4Y< IÆsûYbÄࡽ—}À²möè1!ºˆ1h»6Ç·G¿uˆxpŽÃ¤ÏñSL•Ó )]æ¡.VhÄ ýt'],fš\ž1XÏc#"žÛ4&háiDD ßÆÚ:*WÀ vÃD»…‡ž!ÿ‘Íu>3Á ½{ùUf–7;^‡H.ø€ˆHIq‰k—õÉD,~¼ÁÊqž1aÉp—é{eȧD•bi­eôáL·žý˜Y Å|ëWÅ¢ÇG[M=UU£ÔÕÐæ¡1ÔËáÄý\D”dD›šVÇèñâúÇÑëiÄç±ú™Wý6i…¿ËÒ3ˆï]t,…Õ û˜ë¿(¢ §xZY:{ôq°t³´¦aaìŽÙ¾svÿh]·c‚­ïR)ó“ªec˜ôU‚ˆ#­º%|«e˜J7ðý^ùMdµ²šQÆ~{~¨os™-¦±™«ïé^¿¾(ãoí»‡i'¤Ë?R´D»EG Œ‰_¾Mó½Î$Z–ÒTö³"ÐâpäÛsAæFÌbÑ4¼ÉûÒR[SöˆÓÒoX€Œb‘â–©¾{ÙRQ™ X®›Ò°-nn9#k#Ê‹»÷ºCOÚÀ Ë‡g™|æPûš`jh_ í:´ã&ÞÎejå>|ò¡(‰X,¡€£("~VdÓÔO(¨¬¤hhbÔ…õèF&!@‹Ì!´u:˧ÝËböiÎí“Í>\ôsnûôì ’·ÓÊ+˜B ÐZ§‹ÜÝØ,¦÷²ü´´÷å¿¡¿hfl ö…ì|þúì~v·le«n˜|5á_öžHç°q–RÀ³ÐÁ”ko˜&»gT5!€ôïÍtǶ­9I÷d’þoÙžå @ü…–ª4•æ\ºöIž¦«{£ Àƒ«ÇŸå–°,úÚ¸4¸ôQ4HE¸!MíéÖ!-꺌?¡+.GߪÙÒob_v¤Ë@ôÅé}Ò Vž^5¬úôj¡£O >¤ñËáÊĬl#®£é½=ǘeu˶ãPj¢*Íy[A~Þdk±YõÐ^x}n¿;íg]ØPý!–zçWiÉG…‡‡‡?v¢Ï?zz¤]S¤)‘HÜHDþnî¦j*Ô\Œ>ïåäæídeð2!¶´©g¿Î5«,Ú|¬ßDgVÆ-Ä·“ž®Ý‡ñ”peO'Ÿ8ûn*÷âznvi€¥•76×þL_“ž¥½òÝqV `óŠ Î>·-œZÓî<ý´êb8;Á{ëiq‹œ¡­›§Ú‚áK‡Úi:–FØ,ªA•n±“¨mxÃ&N8;`Ô#K’›j2@\¡`ùâiŽc†¿NôÔ({˜Qx2v @Ëw«ÓyWǾƒ [qï?û4ãÔ-:|ŒÛY³-—§¯Y>ÍaÔðä+Ží9Ÿî<~¿äìßa²ç,]ÒÛ'àe‚}7å’øofœˆ­SÁcþòÝcƒÇ¸°Ò¯›{ÑQô¯È xÍ]º?$p\ž I¿nÕßi¢Õ¬Ã“ ‡&Ïy½uõÌ_Žjûò`—àqÎZ’Ü„ç_×]¾N”Œ5”Åþf™©Þö Ô6bãdÓ.m´X¢E¡Á­}œzZ:is ãî=¼9O{ï¾,fŽu½_iâµvà¹~Ž};Yè>‹·óõðvÅí g_“/Uví§„ˆJÒ×Þ—¶jsÄÏï(s?noë·2Ô3b«o_»ö;dg¶¼Ñ¥›ô Y}®oçè– ßr¿qÏÜt`Ïœê7*Ôõ®cs釻iÙÇȳ`ÛìÐäeü¢Ï|iÚ¿yMÃý놮J¬ÐÔŽôó‹@ZÛÈkÃÌaµÈ$±@ _ĸÏ8|ÿz££ùo“_:1P">_ÌSS‘#̵èŠòr±”fqx**J,†)æ+««³ Z"äWWNQIå%„«¬(ÇaxU¤ÄüòJŠFOAYI PÅ%jjÌyÃ/+á*¨ÈsXXQΗPÈáÉ++Ê3œ­DTY!°ä”ä8 æ— Y jJ<@©ˆ_^‰ÀRRU­,+URUã °ˆOi¨+@ª¸´\MMEðÊ”þMg·ÐfaE¹@LqxrÊrXRIÔU@õ‡ä•Tä¹Dfu†R>¿\Š '¯¤(Ï@aY©ˆ£¬¦Èaó ð”师H(Aq¨«)©XP!¢ÕT”PRQVÉRTSà%”W OÖg¸ld©°¼\(eså¹i+Œ6h½¾&¬(‘²”•8´˜_&䪩Ê „E|‰†º ¨j¢Ày¸Äds»WÑ〖–•ñiW]E©¤´TYUÑú ÊKiŽ’’).)¯š ae…PÀ’STRà±-”Uˆ€°UTT€–• TÕåXXQV*A¢ª¦&VDb“M= ù¥"¶’š"(Q_ÌŒ e @—óË%Íæð”U”"@JTZ.Žœ¢²–––•×¾Ë«(É€¨²\ –²8<eEF]@€óË+id)(«Èqdf~bAE¥H 5ð\^V*­ȉŽªªBii­»=‹ÃSU®u×å—É«6á²@¸ÉoÈ´éÈߦ™ú-T§Ð²úBXüiåååy¾þ˘ÿ—t:x÷—MžFÏ°‚ùÉð>ãŽ&7êDþEœŸÚ{Èü'¬¢?¤ü颉LJZ’Þ?u¤’²]K§¾þš ½>c6.¯ÂÅŸhC$%;–L=—Á‰¾ûØ Æ)s°Qò÷ÏM]uAcù—/SåÏXÕ5Õ´äooÒXK#¹i,¥±ü#@qAöÓÇiŸKÿx¥ %|üô¹ä‘À"?ïÑ‹¼¿|§”ݾ ôÓë×ïŠÿ¶«*ü[|Ä«ûÌÏ~^P"ýÍÆtYù[ýŸEn\C*F õÝy4*+¿òbˆÿºG¸àsษ¥ÿdªÒÐ,Pï.L_ý×8[BÛ .!ž_Z¸`×ý¿eâ!‡GZ§ÿ­>âR~ž±ÍªªÏ5cÞ²8¿9$iæéë®6nõ?¡üÚî)©X,¤E"ZA‰G¥…ˆ„°Ø6éGA9gúòÕ•¦(ŠF›Ãf ¤`±‘–JÄ,E"MI) ,6‡ÍB(‘R›’J«2A‘hŠ¢ ‹ÅaË´Â4MQ @Øl6‹¥Š°¹l"-•Ò\.‡9c¥R)‡Ã¤¥4°Y Kå~Ø4EÑ6hJBÑ,—Í@MÑH‹Ã©~E8LÏEM³8\@J$R6GæL.•H ‡Ë–å×"4EQˆ@X,6› L ‡ÃËfsAJJ!¦D$À YÖŠ -•Ò,¡E"ZA‘26‡MI¥‡­w˜™0Z"¥ë"“Áeí&„zñ¹œ' kÎ5@‡Í!„™8ÒR±•¸ˆÕ°0Ws:€Åb³Ë9üzí9ÛB  YeM‹Íf3Áh¾©„Åæ`­)f̸¥@›ÍfeŸ*)ñ¤)‹Ã!%±‰œ>ÛU¡ &€°9l“Œ•¦)ª˜\£©×6îô¹É<3:än?êå©®î3Ì´Ù1cXä³J‹nI1wZùl<6ËlÛæÃ.}dË*Ï!­4sÜú…pºZè©|NyùqÏù] ¹e¡N¥r6i™^ãwLwWÒÇó«FW›öT½ç¡[/ 3oeé¦}¦O0”öÊ~såL"‰N:Ó’gVŒØWг{‡Ç/ÞÚq>ÔPzsÚyÄ:m3'õÒ×/Š.]T8Òooë™·—ºPgôBneÜÙ@ ]œöž»ÝõË“EeŽ’%ݬ^ºÏ±ÛŸ/OÜ¿€Ú1È&òK«¸»ç”ؾ(øöÛò,¹N GWP{}íæiÆ&]TcÙ5’Õûë$Ìú<õá" 9æôqf½ðØ2·®ï= Fo}u[§*PSØ`§¢&zêwnÜw™}|Áà® )ïíÐwH7u¡Éà÷7¢2Zöñ€Ž±Ç‹³;ó:ν¼m !dÞhòŽFÚ ×“LB÷o 0(Š›àm«ú&B»wèá…K‡ÛÅÓ4×Ó|øNSZxw÷Å[]ÞnÔ›±ó¡è¡‘÷ºñ=Ê*Œ†K^œ»ô@éRb„&›^4ÌînQó^ºß7~¹{(öVü–íbî·í«ÖûN bþ;[;OS“VÓÒ=œãª³o^Ÿ·ôשNc6.÷kàÑ÷-·•½ŽüÛ|–GMtk/*|í20¤YgÃör…÷Ÿ¼]|äºsWÕø½óxptÃ;¿I1ã<Ÿ°›Ùèi?Jº×ÁmÊž¹¾5‘0ؾk›ï”»›7ý²7êáêë7\Õ¡ôÞúþ3O÷°u+y™’§lrëÔ,Íß´#*%7lŸ4sjvÄSOW ŠÒ=ÆòÚê6ã¿Î-kþV¸&—š;Ô>µLË´«Ê‹Ze‰ÇãnµzºÔ`…Æë+ÓwûÀÿÒ#<ÚßÖn`%ˆXzkuçiŒáJI¦¹…}®sœŒ,²„ˆˆ'Ú®—†¼?f:p;…¸t‚ëÐy2_áG›¼íƒ#;þýíz½'‰±,ÝÀÐò@†Ìw”‡ÙÙ_…O£zÚû—#"bÅ»³ö®Á•ˆ¡^½v_ÏfªÝÞ2¨ßÄhšFqey¹@‚ØGøN}]Ë„¯Ì'ßÕõ=µÔXŒˆÂ/v6¡öÖÙ%bDœÒßàⓧÖúžßQ\ÒÛÚ~¼ƒÍ«¯BDœ;ÈàèSêþ鹃'BIJÄ9ÇŽÛúGÄŠ‡ÇL|gU÷ýþx€±Ï6 ó·—{Z )CD1ßÆÚzWÚ7DDaªn÷COˆXþ!Ùª·›„¢?Ÿ¬ï¹JÄøˆçß34÷(D,‰Ÿ`aæúE„ˆøíÆ6=×01""~}vÔÆÚ*½H(y°JÇu%ã®×ÓòDÅŒa€K¯[é%ßb7é¹MfFòéñak›¬RFëû•""âÝýCœ='îü¨ =¼·#â¾…ý¼ÇÉìw2÷ 3±ŸéTðòdkÿJÄoqGN%1–Žì»ò"¢8Û®§C&"UùÆÖ¾ŒÁ¶ø󕘪öÒ=¸÷䃷™ÿ/-v¼8™–ðm,ïåÊ<Ó7Otœ¹û"~½¿ÆÖu1ÓÓ¼Ñ'SŠñìÌÞÃW%25ú¸nˆ[xe•žûLŠ÷÷YÛØåVHDI º»ol´yù‡x„#²Zöe®!×b2š·oqõT„„B¤­hñ¥w¢ ]VJn'©uɈˆ–´ 7ûâW”èëš €8ò|^‹>¢Èˆà±Y_¤U€rU<ºÊ1ö¬<9PòøÅë–=;+ ¢bûñ±rr DmÞ߈H |ºSEÆy/®‚÷§ˆUŒL5«Mu Oß³ÓÛèlÄË„æÁf·¯æ”N0(|œÛm±~–NÞé70Zã­T£ï¸Þ÷cÞ~ë®)LÉê4EŸ¥(ï’ì(€Oô®D¿Íó·îúG«Mvz<€)È,16”=Î 2Õ(¹õÍ2ÒŠ¹t/‹Š€Ë« ºZ˜°A»GŠ¯‰–—w"OÞxÅäiôœ?Õ§Ñ8àyUff*Å´¢Åb±X,BxÃfN7Q«O"°U8Lൟ:'X 9<&e¹˜¨*r™ RÔ [8E[6Æ™TS¡DÊes Và‘„âÉóØÌ÷ÕZ™L?ä·88žâOè‘Y_ûÔèû†ëø29ôôÉg‚øHâÖ_ Wç”Ó÷¾><ÖiĨž#}£O=%•:º7PQPPÒðÚ@MYW[ð:=¸gæîV-Vå‹AEA,ÊA ft©‹TËb³€TåC€r1*Ëó‹Åb±ýçÍÐeg+ÈfA ‘Êqy ËåĪWZË®E[‰@,‘çÊU5a7p±–c*|oˆÈ‘S X.&ª \›Åb±(T ]8­£Ä.õ^'1Íšµ“­[ÕQù–ÜþÛÉ3G{Hr’ú[­Ž¬»ÃX„%û@Zˆ Ça3S :ÖýF{ÛÕ¢¤/2òkÏi…„-Ïøž/ b©|5fØì:îÜçÉÑ¢£/D_:ߘæ•ÝÔÚ™]U÷>Õèãˈ ?—4mQ³‡fzmĤ“¯«B@R)a+ÖÒe*Øw‡³ò½|};#"!t_¢ªPo ºK«fù1ï@¶±8òĵA#7U®ÐµôrëÄE @ Å,yB¾GÒf³ 2nà"¬¥íGm ³F —©íÚçãŸÔ$rž¬{“U }<†€‘Cî•37ŸÞ9¬ Jò©ÁG¸/Ûi¬æåÇÒ²+ä­•y0̪mÌó«)¯ÚîÉ©Þó=¸)ÐÃgˆ-20Uh¨"H~Aít寊:âÉ´*úÆo¢¥5 hÓDùcfó%­5Bº­¦rAš¬ -.¨¡óùÍ]ÇqÐcïâb„ˆ„`I‰@]¾|etÞèèží€œÉ«à¨ÖžBqYn!ÏÂÑÃÂÑcÊ‚@Ñf 5ù)#ÊVè Dàæí£%DTÉç(©TãÎï‹8h9¨›v”>MþDÚ´@B^Åœ{ßζc3¥U˜‘VÔ¡nîa[ÝÃjêø)Ο«Ô ÚêñÞ5g’Þå¼K¹zЮßÐÂÚAO‰Yð0=ë]æëÝúxή«ší·lYþq_æ¼{{võØÞc64€¢•û`½ÏwfºýæͫóüŽ%6ð|ûÚ¯^²ðåÛwÙož.j´å¹dýºè—„iß³]ÉãÈ'ùß¾äGoœ.E‚ *kù³Æ¼ú"%€ªæ ¯ÏòµÌä@µjnä“\3#@Tîf¤öîad¡F/%Pl¯ùéDÊs }fƒ›Ž½ri‹\=ß>×n—Ú»4(y—2uq\º’:?)âöãœwï®X`ã3MúKÜrþ…ë ÷Ç<ÌÉy±ÎÆ;DX›#0ðt¢/OÊÈ}ûrMè”ßȺGöw–Ü=s"9#÷íË5ã§ËF¡ !'ÉðüÍ—Ê_3¸nËW–ŒN|šó.ûÊö©¶Ã(Ûpo:Ÿ››s7jÅUš‘™_Ê®¼"UžšùúÕ­®^ñ^fg¿}xùJYó®]¸P^ð8dÒ,iýV9È’×صYÐâ}éÙ9Y¯ïzÚl¸˜ º"óuFFDzƒ^WÿÞÓÃì“ú"ýUÚíqK6¨(È™ vÝŒ8•ú&7ëÅšI³X?CL#­ù#¹®²V-æ„!ˆÎ&\Û°hé¬ÈÂf],âÆ4à¶i×–KõúN¾Ø²ÃÂUóŠÄKï%7‡Ù@ÓmäU˜Øj¨Ü¦oÂEõY‹W¼/–êövÿÌ@D$,^»v­«Yü-Û¨(pµŽÝŽÛ¸pÁÂØâ½C®†öGÄswu¼v`ýÂY–Šç¸c+œº#@aö›×-¬¹ÝND­œ½lÒyv‹Ù[ö÷xîGX\õm›WQWN»¶mØô§Ìgeb Àj3Æ¡Yl…=sä¶î¶õeýæ@€h»hûfÁðå~Ö=6¤iši˶}‹®ýšsRC‡vÐòè©x²»ƒ ÐQqi1 ¢Ù­[á ¬;û©¢½I¿û7W²°Ú´mÓŠá¶îІ'»SñÚ¶iM£sçÌò«f(kÝÓ9å^„€T¡y[m5Ù$hÚ]:³bÖ’ù1*Wï½ãbO!òM:´F¶|û¶­ª‘–­Ú*ɱ¡™Ã¥¨¥³–Í¿ªÚu;èkÎŽ„Pê6òÜî%‹ÇmŒh¢Ö²U³*NT®iû6jš­›©39dkØ&\?0wáúð¯Â.\Ž£÷ÅæLŸ™eláþ,5àR?Û„’6ÆoÇ'j Ú5Åô§¢ÀEÃl“øZÖ†oÇ'µ²=b’ñÿÜpÎÛG‚–VmoÝNnç·çøxýÆ‹ÓŸS]4ÿ‰ )-)..SÈå)4ÕPýeY“¢b1\9Ŧê*ÿ“qhqQQ‰„B®üÿ,˜ä¦±4–ÆÒX~QX¿”ìÔ88ê>l˜Rý$÷À¿Kõ«!ý® «F? $©‡ÿÛÇj×®Ÿ T­}[øþqüa8X_ˆ økcþ±56a¢êùo-˜êÊøÓïcãox„øëUý;Ho,ÿ1rCyyÄËlÔ¬Á‘B¢æõ™™Ø —Š¥憆Ÿ*éÿ #K ó1Øz)ç_cœ !ÄÒ ýÍôRBPy =ì}0?%äýeµŽn’¿ô1$t~²žýà»K{›ÚMWÛ "žiÓ1àÐ[)?ÝX_ïS%MÈ+îF&¦LÑ×íî9rJr¾˜Éj´göà |!WÇõ¶˜s•Dra×b7Û^–6¶fFž#&ÝÍ­$U°œb>çÜ3]Ýžú††úúÝuz¥ŠÄ^u Œe_4ìÑÍÆ}ØÉø Rµq î]3ËÁ\¿‡ž^óq³×¾úò=Y6É;dØ£gOýAK3C (-êe¤g0t?TKHQ¿N]ÍÝ&VïyBÈD«–G2@%!î†÷pD!ˆl,ô«bl gbç±9ü©"FŸžÇMôé©Û]WW×ÆmðÎ7¢,„,¾f¢¯ÏôÕ³‡ž›OàŇ?³`úùIÒH.þ¾àçåõ‰¡½C®ÔN1H×L6X§0„¯Zö]+©[‡®ý]Ýe}} M×ÈPHÓØÐwigŒ²Þ}í}=£üáÓÕ¿>]{DiÑ«†Î8ûCºÆ7êÃÀà0¿Ÿ_Y?xr”¤ä…•åg”McÅ«KÝ-#Jøol­,>WPˆÏìtz½¨ÑEì– ã%RDă‹F­8QóקösZ‹ˆÃ—˜yŽûVXòà”î:îŸ% ¸Ÿ¼MÜ>}o$ôè¥÷‚_ý³ÄWßô@A _¹¸í&=lËi¤%ü±¶†¾ãWÈ2¤VZb`íþV$ƒðÔ¢Ða«Ã«{(¸4Ñ>ì”»­ñ³¯Ò*ùZ ó´]›_Ýj¦‹Î‰¬—_~R¤¹ÇH‹ÓÝÞɯ~Åϸnobyâ=…ˆ¢·ç- {­9~‹yõõEÜG“‘[î5¤y¤‹¯[»TVý¼s`ž©ëЈ+\,žSõ¼®½Bcÿ¢üž™Š÷Î °²0µó |öQ@9·ÄzÀüBHᥑ=Æ^>»mngK{Ï«Ï¿2ÇÔëã;Œ&ŽæIñιþæ¦&–΃¯>û")Iïi`øUH@Rœ°£å$$åÌ&'[ KKsÑ33‹¤7V{-8L!„œ«ol;„\7ÌgýyB$×ö/¶³²°´°žµý‚¨êL’–fÎÞ×ÔÄtÈä åHH­ÃŠ½M ðêmÖ«×€qË?VR€*Íš:ÄÉØÌ:xÉ¡§ç,FžN–=âß”2§íƒ+ÑVþ¤ü¼EA,,­Ì-íV½Ey1-{zK!„”å$q0ëen·4vz¯ŸµöϾ@°¢*G¡…}oA% tyÞ’qƒ,---m\¶K%„Dú›^®äŒ³·vû !•‡–…ZYZXXX†,Ù_„<éch>?¡Ñ ë_½L1Ó"}¹ÁlΡ¤”‡ë\å†] \y%6Èk4Q±¤Ó°å17nŸ›ë2oÁl>[6É^ŒHo7:õá£Äð™óGæ©usÖP>ô¢”1JŠMìãSñ:vÒÔ›wS’“Sû«ÀyŒ[Vò+ªðè+õ6ä@Šû.o½ó•­S·§²’R’Sµ“¶ Ûù€­pìðéÅ'¯=|ôÐîÛiïi×ñ»ï@åsoƒöÄ?¸•yN¿þË¥s'‡ùi·í:våKu5 ¬¢Z¥Ï9ý°¥5Î+ßygJrRjrBÙ­µ‘÷>‹£¦¢DPZ1Ào¶ãƸû© MÂo—(+)ñ3ïNØsçÆÝäääÔ“ÁÍG?€ïO¦¶£ÏÂ]±Òéöâ•™¼àÓ‰ãOûM­ç¯¦<À{MD)©*þÜÜí3nîó_|(¯°L WËEÀÝÄ$c#Ï_Ójn˜ò‡ ºê5€;û¯¨¹.bWgC%z *Ì»õª™ )ÿ˜–ÍSé«Í¸Ð3vÃ~þwÙÅÒ0Xd§ûaè‘›BØuûî&‡æW”¸&%§¤¤$P¹=~u2XOYµÌ·[#5ùeù­álõ¾†ja›ï™*\^sþEêÞ=šq@Û ƒàÓƒ ^ÉÇ,yÕNò,€oO2rçov–V¯´ÔXB`á¢^}–‡Ï¸0‰ %·cÒý¯ºÓ¥·¥å¥‰„V­å5æ%÷ B‹òµÉ•`X˜]¦iª‘ò¤LbÓ”ÿ6ƒ3«—âòÉ7½¥3ŸŸ¼sîéÿ×ÞyG5™t üN „ E±¬ HQˆX@QQl«Š»èŠv+ºŠº Šµ *ºº€Š ÈŠ{AÅŽ B I !É3ß PtwßwÏyÏ·óûƒž:õ>wfî½3$J¸ pÝS¦*ÌŸ'D„¥Î? §¼4eë{ž•½û 7è:íÀ½i€€÷úÙ—Ð타e龺Ä©wÅÊë¹rn6€–®æ»ìÓR¿ùLŠJ¸€ ø©²Á ^Ö!4ÑA,½—ÛŸ€ét&U#ÈûPÓ¿½¶~¿e·Üªòó¤Ý*Œn¯ps@Á'QO éÇßZûLîØ´Ð5´äg²€…¼¥ù¬øô6šß©*=—€›¹bÖ‡O}`0Üšœäf¡ ·³ÿè·+æ[™†Ï¬¼ÉBP'(ùXÊï1{ãs¾« ™Ù™ªë^ÀÖmS'n5‚çõ˜•ƒc4è:Ïá¹\¸Sî×Ó°Aú{mý=fàÀÜ·}v2øKÂææî•GY —ð‹>•qºû­pdÅ“Ê°®¶æ_’_ Mñ¤‘C•¿µŒ‚Öyíë/”,Ϋ°ÇN¹?/ÆLÃ2)X:¼ëW¾ŠÇ˜±`è¢ãC•›‘%ÿ%qÈÜ©¾8,O¨~Zǘ^ß`êqÙËÓ6At(©–èêé(ôm¤P¼9ý#Ø«½? ‚9wöþ0q˜)€éÀÌ_©ý—Öhéê˜ÇžH°5Ôê=¨MnÏP뢩çì!.Œ‹ÅîÎé_¦´ƒòÒ:#Ó{'Ô7^±„R”œcØV¡Ê0µM(\UÜðJ«øú:z 3…PÁ법utm÷Ô²uùÆUgnü¸û²lGDßÞ½uØlÛAA{Vù5\CIxŒ4åîôF8•ÚÜ2†‡Ì¸B¤©«Ýö—ãGŒYy·®8ºü¤œÍŸº±#O>J뛜™áí³£y™KÅôíûºk×aáG¯çoÊüÃËXϵäq J!L×m»dÛáÅ”\"®}{yל±ž;Ïs6*8ûÕåªÅ7¿*ò Ö†ÌEÃ}BãVùq1Æ1­Mñµ‡Ÿa´‰êªOµ€§©ÕŠ¶%,Z{EÚ¹÷ñÅ‹Ž Jlx$#Ó¯çd•ÛYÉ‘ÞžS¯^ßó—f¹ÓV®Ø‘¢³NDŽC³Žý2c@4“Iã kÁX·¾Æò­M(d­ô[¡%_¦÷óù´÷vhÇ ëi0•sÛmô8•56ÄT¨ëê|ç‰W÷¥ŽõFÆl QµPý-Œèw#ís¯*œ¹0n¨B½7µõLξ}ùBZìB»IÞ?ñ<\<žßÍ,8yn”®z.ÓÞ9‘™pmŒ¿+€®]”|«žü‡wÌhˆV+â+ÔiyŸHå[׆Íæ‹êë:ZL‘H¹á9”½(i’‘[Ù†Œuˆ¡í·$úÎíëgRŽÑí‰:y·áÁˆÁFÀox¤°¤ZñÃØf`RVþå é»9úÌÜ:×Ë¿`PÞÑ["Ê7òk¤åiLÚ½¥bÐÕÓ60ÐçX8$oè9y¦¬þ#]£å_Uu¯I;ZPײ_@ßSSK×nÄJsSæ«Ï¼Ïç/´èªñ½ŠÖdèéèÄÿ2?-réenÀ}®¿0wL%ì9¸~â€Qç€ò‡Yû3”»¶Ë±œIcÀ«Û©:m×- š³#”úÀ“:Uå뻯ñ4}¹%ó)‹ùü„™Úl¶¾žkîÊMï/ÄŸü ,¬.ºúÑg úEx$­|¸ïdã IØtÌiþ¦.]¬mlllll¬l†é §“n7ÉWÔ¡È«‘‹ŠYgÇÀi×ú¡±óæ(´½è}K¿ ]µ/M!_xY“|gpºõù–S8F aÙ¤Ÿoì»^×kŒ ]ÇšCÁ‰{e€ .ãôYÇþþ ÀT-PlجW>ÛÀÈÞ¶ƒDÈÀe…÷¾çiò_LIøuŽK"§ø¿­¨ä‰Ù;vícÈÄ™"Þ[Muƒ†€¥Õ‚Ú¯¯ïW³­ô0 À8ztXÈŠž‡Âi@X3 @«Ïr­P—·ÎËÙ€1Øô °8ÖÇý€¾£Ú„Ýe†}û¦Þ1þQÝS[tðCû®–,Œñ„;?„/sí›ÂÑÂL ×è¸Á ªø:tp§‰£Gòª+Q»>ÇŽø"€ëq¢ ‚½vX€qߤÝÓÃ&p7 qleþª°!bùÌ…“Îí3·èà²iq×õ7……&ýÞÁ£'š~øŠQÁþ½× T[rGoów‡Ò Õ ir,4¸G”UÇN½~ô4by§^ã;¦…õqOÐ×aVcÃ剻ߧF[¸¹ •Þ‚1¬pqnÓo{Uöc”  @.¬®–7 ýkwòWÏq·†ä÷6×Á¦ýO%GnܼÌni uŸ-'síÚh`ŒÅ%imÞ<ʵ{-%׶³ï·"!ÛÑP¼>ëÍÊ Õýª°HP-Sùú‹ Õ¨3Mݴ錋çúSƒÖŽ³Åtí¸KÄoÝ8С´]§¿·_rÚ.sÀÀ ›3ü³­Îòš¸8xt—ªÇ§“*Ú=Ñ« l& óºÿÈÚi[DÕ†|aƒ>KF· ;ðº®u%„’I"‘âw­P(¯O1Ƹ»ï’îq®þ?_JY9˜f9ô·Dæ¶Ø}Ým—Ëݤs©‹öLáˆ[sbÀ2±ô«;—‹(©„Îé8iQT¨«œJÝ:?dü±–¤ºÖmRd¤gùôÁ泸½{Î?pxñôŸBgY‡Y¨ŽÑÖyóÞM8{Õ´x‡½WÖ¹òïÄ·M[û6ly«rcÅjjvc“'(B4yBó·(lz®iœoQ¼¨éõT;ªoia ETU¦e`¬Pðò"=·¢˜ŒUj©UÄ’iþäÆ”áêŠr}#cÅ©Ÿ¹hܹ•#MÔoQŒz²;cóÍ_5ªC§0R/jøÞ\…ònÕŽ§R`õ7ÖÇk,vµ#Í»m‹u×J½7dD½$ÚŠTh,¬Òš¿+Z2j©Øÿ\«VmœH}RPÝ@¢ù¥¡âYǪL¶#å?ÒnZªUsV¤º<‰Zº¨ÉPKOhþÕN®v¶åë[H&R7ƒn1wÖÎÊ¡úíZ6¾®ìÙŠSâ 86¹°ÅURˆ’†úûhùE.÷±¼Hÿ­À,é)FMšy‹Eš.íª%Xýšfyi¡V¾•àfKÈ*×59‰š%§¾ŽZ.‡¦õ‹¾™Ù&'URQ'àUŠš­sÑYfÆ­Õf“L´$g1¯´DÞì{ÊÐ62Òc¶R†¨YP+ï–Z~›泞DüOµ›ÿÏ` ¥ïY“ù€®g´zÛ` ÍV c@H¾kMHÎÃlsû5?oè¡“…Š¿ÁÍ„›Oóšäܲ/ÿû5LÉüýÆI¤êC5,ç ÚžfK*‰ˆðÿ)ð?,n¾^÷ž°TÞäàÛÔaS¢Ô5% 7‹›:q|à¬ÜÂrE€Ú·ëCfúŸ²'ãÔOëR—Ï ô˜~ìjQÃÁâÛ§æLç?~Ú¡¬B¨w(€Œ˜9‹¶ªŽÒ¡îó¶åóüý–E’5 Ô ¼7aøÈ´âp`÷ÏÆOŸ4~ÊŒàÌG%M–œ£Bü»_IBþíü­X¹%9y÷šz¿>ßoí±˜R÷À>à61üΣ‚»—ºÙsH1ÆT݇a½Ÿ¿ñôé£%ïLÇ ¿Þíß“›võ^Á㻓=Ý6¦?À?>·Ímèä'/^¿.|2¤WP⌱¬ìñÌa¾³‚†_Òø.êå½ì×Î*(x|pÝ´~cªO…1Þ<ÃÓÕÙ9±è»£(ª%çñ?AÊ꙽Džå?zrïJj{—¸{µjîîåùžÜáoZòA'þ=ÀŸéù™©Û¶nݾ3þa±cŒ+ŸGFQnðz÷Bô¶­{ÏÖì¢7ò‹»7'æW`,[<ýi‰2HÁÙ¨‹NcŒŸîå±0CÙ¿d9:ûUb|1bÀ˜õ7•_°ï5¯ã_çpÚÿNq»4™£Çj ÆE ©w¾¼½²ß«QÜ`^N\àªe‚ozp=ßÊ”‚ãyJĘˆãë¼mâF**ŽŽ‰IåM"‡oŽ‰— žoßU^#ÿ¿Ÿ»=ê—ñÅbŒ©üC[½VÚpùµ“ÑÉ9Eµ¼—¿ÄÆI) c¼.dZ~Q"©×v9ûÆÔ£¤»Î+c+œ;1âip€¢õ™d„îìž²2åqWÇ eÁ^}/½©á‡ã'³1€ðÝï#goáüàØAësðö4-åÚ"þò²à]¹0}Ë®Cv&Š!Ä—¢2=뮲Sçyû‚bMѬ~žË£2.ñLì¥oÛÈv°’IÏ^`ŒaíŽÃ®VZŠœ¿)cwµ€Ê¢ç…Å Ï ð;îÉÅt!Q§ d0Õ:²ØNKÎ+ÃVñy¼Z©ÌêÚg’ ãÔ©ÜÑ; *IÁ¯Ëm/¥Ô"TQ _œÛî4h¶cLIföu;ô’ßðü%Ö{—û:¸¦•7¼´vro›Œ"ŒqÕ’Ñnn#¦ø ëãX-kŒ`ôüÒ^Uí¦qØ"nšê>?&O1$Ú0Öí@þgŒq¸g—Ä"µÁŒÚ°Fð©‡[Z•âŸºq¹ï¤Ê¥…yÄaYõ ÷ž/Ê%ã/¢{øE4Ü¥HÛ»ÜýŽý&W5+Œ«g8;û„ÉpŠ@´›Ö Oßùóó˜ÉÎÇD'dð±KÓh@]…\ú·W¨$]]­æªæa sÞ›‡—ßòàdf¼6ÆÀ6¸%£ƒÉ #6yÉåpûxÔMšcjjRâñ¤aF_fÇ\þ†U À’¯!¾ƒ?v^ڕ殿ÜfÞLWsPl|Mh ÙÙÌ*—¡ãª¯øùºª–upÓ‚¹sçÎ;/*õ½¸ò&ÐuGšé%Üý)Ù¹#½ÕÇ4˜óÞO‰qéxöQ=Œ›α,¥……BbîAø×ÂøîŠ »£ÏÙl,øxdÏöû.û›Õ/k!+l61È$Ò¦]c„Ðñ¥ãv´»‘wŒ¥4g8›ãÇŸjÁV0Ä{SÎÓ^¯ÔTòøS¯‰` ¨¸DЦ³YÝ–èôYg Ú²#Κ£Ñ¸sŠ‚ot`µœN$~å7È×yɉð±ÝËkýÖ^´éV|“FGoj9kæUø®Y8¢mkÇúm<”„Z½{¯µ†jV`AänpÒÏ^ó.ç”®ŽtU3 Å!tfô¨GÆ7®¥ê´b#Ï`Ñ¥­ˆ!þíâQ’+2Ý}~¤³-§-E%7>ô÷F@m€Úsþp¹Á•œ—L¦6¨úÚ T°{zlIÿÉ ÐàjBó›ïvpËAÙUt@ü«éï¬ÜûkƒÑLnèöC8i.ú’ϳ÷í‚èúÚòOïk‘% ÿ]¥£IoY*"ÀAcý‡l:4ÐRéôBc]ÊÉUf’É\5ØÆfõÞIVj›´¢htik† xÖÎF°ìu«£¥.ÞuA{iÏ+GåenÓ¸Úê~L½LX¸ñ©õ­ß™ÐÔªÞ Gö¹TfÒÁ€´97­@Ó¨ººÏkÏ‘!R¼gé9O·„¸uEÑ]‡DÆDŽ +òj#zZk K“jb’Åúxî—²o‚Ί“/lºh/ Q¨@z½"—N2ðØØk“ÇðQ/ì-Ñ­[Ë~½vc¶šF{Žò½óƒ‘ðfþëiWèó×/»Ø»ÌgD?+3ËkãѶLÈJˆ:ûà‹¨âƒ¸¬&4$ÓÛnÛ¾âéÎÙ÷ø–šéÑ!¿S€1Íwm´‡Se¼ƒit`Б¤ªpÔ„°ä´sÍV’¿,1oìµá£M$ïÏ]~°øDŽ%›@ÓµýÚý™k’c$þûkãæGŸËøMÕ¬:zÛº}¥õ9Õ2rزfÖÙ…£µX‘¶¬/†º—y¥m㻑&Gø÷ò]p@>½{Éã×]üÃ&l TÞ+,uv²A‚’÷o¿V2´8vØžWvwêLü©àa‰µ1<)Tqà Mƒn];€äMá+›Xv67ÔV„ÝCTÍËç¯kdtóNÖ&l¦B)ñ>½ýT&Ç´½U[|)*,áKbÆ0ÓÁÉŽÿþžX5Ù涎&šêKÑ“»Ú]¸&, d¢]“|sÕļöþ“7Ýí™õz ìSQq™1Í,;™q´`W½{ü®ª³C6™˜ÿôÕGûn4${öø™T¥ i ‡n+ßܘF;µ¨x}>nNrqnâϤ͈¸ù·@‰yC7^þcýÓÞ»¸8-ì‚UøŒîÆu <û¹Æü1ÅA‹8pˆ¸ùw 2¡òOw{Õ7œˆ—e8#a‘ip"nÿ¨Üi°Š@ â†@ þAH @Ä @ â†@ ˆ¸!DÜ"nH"n7@Ä @ â†@ qC DÜ"nˆð¿Êÿ÷ÐÀŒIDAT‰º2ÁÓyIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/distance.png0000644000000000000000000004265313051004444021715 00000000000000‰PNG  IHDRzkPHÕùsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ (/7T+ IDATxÚìg`Å×ÆŸÙÝ[Ò!¡—Ð{Kè½w”ªÒ;Š"EDlX_Ć(HoÒ›ô¡BIïÉ­»{Þ7 I(â_@Ðóû7»3»³Sž=çÌîŽ "0 Ã<~$®†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–›?ƒDÄmÃ0ÿ2”§°LB`ïÁ#Ó?žãíÀ-Äü;pØ­ƒ_ìÔ¡}{–›§ŽƒÖè2¦lZÜM™)± »7}Ìró”¢:íN;÷Ræ_‚Ónþë!3 ÃrÃ0 Ë Ã0Ìÿ€ÂUÀ0O“’®^½ªªjöFY–CBBXn†y¤rCtáÂ…ï¿ÿ^Ó4×!½öÚkžžžìL1 óˆ-œœÏ¯‘,ËBˆÿN°Ü0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜp0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 óo‚ßú!]uæúê¤$ItÕA’¬€4Í)$E’2ï%D®B‘d¡«NäØ{ç4DB"4@€B’,„k+]ÓTE–¥EÔt]Ë.ŸBH²È•“aXnž~ûS¤¬Ù$Æ`6) dO°“oP¹öíFM‘‘’œ²n\X´½D÷9›üB½øEãýÑíúü–l‡€€#aßO“_ªbœ±dùŒYN"€ \>ø½Ø;îß_¹jYŸSB’äB=æî}yþ¾!ß^è÷ÞÿñŒ\?¡u|šC€— cXnž)t§Õa…Ó§¦âmjW3]Ùz@W ôô}+†4hQ¼Ù€”uÓœDB.تK› «>L"!„¸½åãói!_é,÷ùBÂùsl¡í‡¼æë!9,pXàYªcë‘3õkß_½- @@±8ÐÚûù"Wm’¥œb¢;mpÚà°Bñ-WÌ’æ¨?ï‘ lÜ0,7Ï.šÃ)Œföø3·-!•kø„´–¥ë·®F ‚ðn1³Vù¸MÍ–piïŠJ÷^è®Èt¿0 AõØ“<+O0H@V2r+\+XÆùð‹² €"VÌQ«´+á:Ýë]߱Ƣ¸¢GwP|B_ld?°(EãcXnž­v2¸™Ü`pƒÁˆäÓ?<­WéTOâöÎPó *X@Þ¥CK™ŽìÞ'„éNTïù®±lÃ;œÇ6©"qý’´¸´Í»l ä µA’gÁ@J½OH³;s1¤Z]…©ú„¢Ê®û“ï™Ña ª!ST†•[É„CÅÏ‘Ë^øüM¸”ÇÃÏ¿Þ„° a»|pýå’Ã?qÄÇØH*Ò¡ç¾és#ûv+hB@nؾW•U?œl>r„æø“"fƒÎ4+绹šÍ&³€3fUrœ\±b±Œ¤hcp•Z7ÌÐjÍÅ}L0k‘»ÁÀ­Ç°Ü™ZíÓîZöJêDÅ:ô#¦„'PYÿ)Œ3åfBä…,ñÒeŸ_Sp³×ÂŽïÞözÝè~ï—.UºýöîÏì¹XièoAþ†[Ö÷‚=ÖLõRRù^Ï]\45¥íÏ5ùÖUUQIw¦„¯ÞóÓrßê#«•/ éàý–›gÒTÒóLé—–|l y¾J!ãŽéþ­«T}ãÿû¹Ì„ç “¦Þ}´¸Ÿ®Ú‘ý§Í·íÚ纆¨NcÕQëK]]¿÷§Ùk~ŽÂ=8ôÅ^s–x»I’b»¸þ;÷ºÝ ®g”3-,ŸÒý¥Çµ³Ñ‰HOüýãî®rx•hÔdÊö¢Å €Xk˜ìšsᛧ‡OgÍö®Q¦Z}n!"ÈF@ƒ¦Ý ÷A2@T'!G˜ˆ$ƒÍIIÈhÊl¼Ë·Ò¡ª”ùÎ$$9Ó!ºF „l„ÈJ–Ãm²º d%—C¥kÐÙ®ÉAR̵¼Øºu+]¿ã\ʲݶ~HC¯WÔq¿£5’)åðÄý[.·ÿìT ‡3âÛ'#ìÁÅ<óúM’Ññ¥Þñ»>]fZn®ÿõã¡J(]Ì=g2£»bóöH³·ÑÈÝ’c7Ìß5oPµïÒSf˜M]µç iFj¤5¢JuT®–cšIi;0¿›$ÉJé熹Ǟ¹­æpCDâñ-)žujWB6To7lVÁ¾9R#“¢n…´(IŠ¦jM»«@›–;B"ýÊÞMnö\'ƒY6yz4zíMÇá5QŽ\þ$+’"åPCÉ .¯ÝêÙùãBþ²Í¥_Yh¾×sƒ¤ýš– )IòSLŠ%1l±°uÃ<WŠ„°EíÛ±ðÍÛd6C³ !HÕгd ;ZAš_ „ sQ?÷Œ¸»( dGxS“bƒŸ, å:Ü‘sñerÜ´Û<¼ò)®0݃ò“¦ÀâÅ8Ó?ƒ–ÔÛÚ¶=$—ï$9t}#AþÌFZl¼XÔŸ4@'Ï oë½äFò«"\kp !„ ÒÀOí°Ü0OÀ•’œ¼{ÞCÓ};Õ`ØøÃgÓ!ËX¶—.`ê‡Ù±"r…rM×%IÊeH’ 8AˆÌÀp£UÒ)sp“ªe ™5NG¶é"$ïVö2äż ßÓ+Ì<2A¤Ó}͹{ýdØ™b¿à8¯%'šJ4©d$^Û(ÀÅsˆŒÈ‘NNJ¸& ‘H=o÷-RÀœsòÚ/¨Ý’b×4€„¤_\2j÷®“rIÆâf7KÊÍ €H )"BR$pªpdÊ—IMOÏH³»äJ–­)q p- þ'Vš Æ\Š2 ãZò­4n\†­›§ÌRJùç×/®]Р\ÚåUç¤éª~ÒW2´œï ‰è]KNyä÷5\[7Åê•ô•(G¨Ø«rçÒ> ×/œÝ°Uc5öÐÞ‡ê´ýTË61ÂP @±¢çWN ìÙOrÜ<½o³D20t4—¥C¦bõ+ñܶhzã®=ŒÂzcÓ['âj¿ôþûòŸ½ ¥;µn½O}òÚ©Ò3½lV|b÷ô4së2lÝ‘Žìc Ü ñä:îŠ7CBžà±ìHܹùƒöû6®‰<µãÄâ~7lõj4Ì/òœŸ@zfÙEÎä©ŠZCªåö© q×LŠ°±uÃ< RP Oâ\ÅKAýÛª!§[‰ž/NRv¯\|=ÃéY¬Áó3&x»æùÿžHèöø?~ž'—×¼u0œwO·1,7ÌßDÊU‚Éô$ÎÕºÚµƒão $Á£l·¶SºeGj…6ìQ´ëô àx˜éx†å†ù«h„~} iÿ¥Ä—ãâYLúàÑœˆòxwÀÓÌ<&KÍ¿ŽÝüÓÈß~‡iÓ!?þ!–’„´T®r†­›ÿp œ?…›‘Oâ\aXnþÕiF³Ãý>{Þ~B‰’= ¨Ydš®ç`”,?ã¾»< ËŠ$K’›y@%PÖÚ/¹r ¥Z¬äñ¿+ŽÓÄŽÃró´j âËV¯óùëU—Ý{ýAH7¸Ù%ù`Ó†v^’ÖÜÍrÑi<ë0 æf‹§Ð·Z É–d˜g3 ÃrÃ0 Ë Ã0ÌÿÀ³ô½UU5MãØÍà,RÇßýý×þ4õ¥!ïXõœ…H Gåò8{ßMÄ [}Q:d倱C¦~îŒüáùýÏ9¦„H>Ý³× Çn¦ !®¯Ûeì/÷©½{þ ñÙ­K†öëñBŸW–ï‰B<¾ó+°é0*d@$tUÀàTR´Äy‘ƒlŠU5:ív¹·÷ÈÑ¥>káÓK!³x¬ZóŸ“‚¸þã„–ý¾ 5£bróš'Ô<Øäç#mZ>Óíq:Dü%\‰¸6q‡-%U7̇„Ëc­ !Ä„¦¡§õ¿¬iqó·éº¦åÍ©›R­>>·#¢ô<Ùt;Î]€E}€bàýQX§Tñ‰Œß´¸XÇCO³^ˆ°8tk4¬Qä~…×±M«=óä ‡æéûþÚê-»wk]ý‡×:¼¹t¯Kñ„0¯Ž™a€€ ŠXqã³ÈqiŠÕßYhd‰iU=zÉ$iB"Âc®g&vãº98-©‰)é$O_o7£ËÕìé I©ªƒÙÃßßGAsDÅ&æ ÊoMŠO·k²Áà¯Hp$Ån=åm ¾u;0¸ Q¢´ä„t«Böò ð4+Di±±1^þA”‘˜buHŠÙ?_€AèiqûF»·ŒŠMð÷ ð0¤Äܶ™óù>סèBÆfÞ¥ô„ËEÖˆ‰…Ý Ù€|ÁpWîÜÞÉ‚ë1 ò€›’õ˜ƒ†˜X0y @~+”¯R©©Mk¿) Œ¸èTÙ»€¿G^ËœÔäÄD«C•îþ¾Š PJR‚Åæ„${xûy»‰ H‰õÒÒSs^TìÞã±ní¢â|}< 2RÓ,6‚äáàín Yâc2Ìü•¸¸DUnÞ~~žfgrüŽ“7|ÜJEݾ?¸ ¬ZbRüƒMŠWŸîEWÜÊ«¡ûº™\·³Ä¤Z ¸Á-·c•‡ät@‚¼Í{7RP $×oJÊ¢ðx%¸epñÍEõð/ài’òt KJBŠÅ.s ¸³Ë§LÛŠ¸¹~g¤&¦eØÂèæéçë§ýÖ¥VbãL>þ¾FAš#)1ÉîÔ„¬xùx˜dÖ”èÝ/ÀlOHN#Èž~^fÙÕméÉÉi²—_€§IqCµ¥'&§ª:LÞ>ž®ºj‹KôÉWÀœqiü·G'Í]×½f :M¨:iá¤þ ¼œ–ÔøTkþüùeI<ª;‰.°ß²1Áš4¤deݮؿ¹ö±Ó º9DA½ÚÐÒoè¤M€“„ü¼ÎgFn„ Û©emŽà2ÁŽˆ+‰o­ÞÐ1X8¯llך3°lí’¦#»kX½`)õLÇÎÃûÕ/±ÏQ¶iù»_6ÔyqÚ'CÛÄîùa㙈T§mÑW¶aoO _8â­oö— m¢^?uÍîñåw?W 0Áž4à…5ª6:žhì\'pͯ+«õ_òÉË?|¹(Áä\µèËëõ œÿB£--¾Ý>©¦Õ¿CËî—n•žúvãÌ›C«`lOE“¦8s"?ΟG€ öCÉZ8¸Jedœ‚A@¯ÔÄâS¨Y'Ž¡b_ý¼Nïq•¡þ¡µ¾Y9@_=¼Õ¬à)GæöÌ1Ê„˜ÿfÏ廯—._."ü|ÑZý—}>J±æ£>Ÿ¬:[¾v3õæéðÃKW4.ä[|ßžêT¯4Ù½SXÀê_~):pñ½¿ûòë$“ãׯ¾¸ÞeH¿.¯~sÐŒ ÁU›x§^<m{kþªVåüÒöOhµ°|O¯ír•ö¸¼ùçŽO¶oª¸ÅÚ£-–Ä…óÕÁ“'+ç7v|eÚüµÇB Ñu[ýGEÄ|z¹^çQ‹]Õ¨ý jW]yô6% ­ÙÎv×ö[Ë_)Ór¼FDD ÞìÒkÔ7D¤žY\­rÓí·TWšuS[‡½ôDD¶¸ö-j?7a¡k{Êï3Ê7葬¥o +Ûô|Vâ¯_ºo¹S>""]×uŠÝD-{Qæyƒ'Òè$ IDATf&"z·$tÚµ#Šú-#"Ú:–P”R‰ˆ(y/ú‘8"Òõì#ëÉ·®DD§ä©’Ôí“+…½xÅUüø]+×Z{Ûá82§b•{ã2ÓlžÞºj»lDdnݬv·I߸¶'oy·\ÃR‰(m}hÙfáDD¤En­]9ìçÓI®4ûg=_õ¹w5¢”]Cª•«º"ÜéÚþIßJ]¦&¢eïôèúÊ|×F§5åòå+V§ž£ØYÿUµÿ2³@ß &€vÜ¢¨ýÐ/YÕù~3òk‘ù{r7*Ý"oû뤫¶ˆË—’-ZÎ^A¤¿Ú­ÚKïnrm8´|bºu÷\I!¢‹ËŸ«ôÜ×D4³U©¡b] ì—Ö¼;g­Fä¼ôyµ*}3/5fëk£ß¾”Yä´ñõÊŒÜMDÛçwªÚäRzfGèÞ¬ÂÌ57uk\·†Õß[qʵõóQm»ŒøB'íµçj¿ôîªÌê=ñ}Í°ºgâ¬D¤:Ò¯\¾œî +ûæ× ë’Õ݈(ml½bã÷وȞùêu§¦?ÂñBDo…¿ðñõN‡ƒˆ~‹^òÆõnã#:-¸þ6麖ٷH׳ûÚãç‰ÝÀ~ùjdRý®Mˆ@DÝ'}¿cåÛFÜ>9FhÖðú³ èõdݯŒ»+£¸sQ/w/WA(&£œœd¼‚¢3O“9KœëˆIé=5¶O·ì ]±^GEFCUý+Íù²ò¹›!d$BWQ¥X®´‘€ÿ_ìjRªÍ3Ð+óøóݡ׶n0|óá[ƒ»Ù`2 }¸liÝ¢^9§‘°±cË7œÛ½Ô¹¶¯·Ù®åK³”uÉ®ŠSí NÍÛÓœ»ª‰vÙë»Qm–gÇÄeÝ;Êš³F³¯@º]Ëžž±¤X¤À÷Ç5^tô-z-)\3ëß]›% ‹Á2²È ¡™HÒ….Cz"ÞÓ³*7†|ÆŒ„TWÌ~ÀÂ××lI »F#* ù½Ì£A^Š{…f;œ7Èfÿ{w•¡SQ©Nÿ–¹eò€;{#ïüNµÁ\0!1åÎä¬Èr1iwZ†+#e T—!ýfFÖ´4G’Sóòq{¨²ûy¸+~EwnøÅ{{êÅ¿Ól>’ΰ€<ü »Ãž9Ïüô_’—»Ñ’hÉÌíH·Ü]oBvk9pzËÓão]ùcõŒÁÝGn=´4‡­¨-›8ÇZ·ÿŽ/Æ»þÿlLøýï'Š1À §¥ZÏýPñ7:Ò_Ýrùù༑Šl{ÏÏ¿„$¢ã’¨H €ì§Î$½WF~<£…Â[øiB[zq¢ÝM5¨ÆA“}H²vg^ò‰âgÄ™"ÀR´°÷¾UÛ„„ØüùÐjz[P¤zµü,[éêWjô¹CvgëŠ%¡=@o„®khÚ®z‰SG2k?öôêÅëOÿIw×u-³{Pz|LBºãiϬÎ|h"»BBÒÿ!*ónˆðc(Õè_{w"€vB`]dîž@–¤Ø¸k¹iÛµBäÖWÂy®}H±™g­-ÛTŠ?yöLz掭øÚZ´kU¯ß5M€ÊaUíQÑÛ/§dÎæ\ټ৽WÒUW}hNklL¬ãÕ^%€Y+2•tç÷ €TT« Í‚-—3S]]‡÷–?¸òIWãb¢-ŽÜ§J–(f>¶z¿ëø'l¿kr'~ÞôéáÉ€|…BÚ÷íåqÛåëN×UXðòöÌL}hñŠ87§C¿·EKº»_i?OãÞíÇ\ýpéø®õŸƒŒ¥CJúþ¾lsf2Ëõy³%XU!„®Úccbì*y«Pܬÿ¶õ ë*÷ÌýÚV¥QcP­é1±ñú£œ`€Ù)Û£LIîQÑ7´´±:„$4º¬ úGž}|F¬ÃÇ“û7>¾ùjÅõˆW´WWìpÆMžÜ¬çÛ_ÚS§vnØé^BÇ}¿#(¼xßò¡CþùÁâ=÷ŒéX·J½ææÄðç£ÎYù 2øV,å;²SŸFÎRkAŸ¦Ûš-ÞôF¼²øfÔ†:䓈®†YU0®¯‚¦¢ÊTóG«ŽØ¼ q¥qò%ðÜ×èTþ25¡n‰ÖErßæiÍÈvsƒÞÜ÷Y÷œ7¯€Ž³¬kÕ·yƒjU+^>uØ\ÿ¥±̲?­ã!­ëÖoÑ&ãâ¡ã·2¾üq´éA&M¥Rž1#:ö©ÑiÌçƒ:|=æ·½›~Ö"X¿½÷Ø…v¯/z@Ö"ùŠÝÜúóAǾýu±„Í]†¾7ç—µ òZ+“†cPO\œçy¤•€ˆP¤1¾ê€v¥Q¯|°ñÆ÷'n“åꀎºÍ;þrXΙ)å•_š7¦û¹°ÀŒóɦ’B×sC!_9ùð€Öaë4 2¤îܼÄÀ©5hjº-y¹{ïÚýg¾1¢ÉÂó{;¢‹ÛN-f +=nÑksª~Yóž–‡[ÐWÛw˜ôòþµµ‚ÒÏž¾nœ¶þc¿;¢Yß7Zûµ~ˆÛá]Û…{¼2Z! ýÖÁ=FNþþh«Rù;¹C÷aÍ—Ë'EEDÓĺÌØk[öš½mÃúµlf  “nÖ%¡ÙÉ yõöëºKA†Àcœïþ7¨gä%—{aIˆ¼í†ÅËðp«jZÌùË‘V'yå+T¾d!AK?r"<¤BU?w¤G¸` ­U^!‚šzæÔ+™ÊW©êi¤ÛWÃo'¤B2ä/\ªh7 ROž<‘¯h¥B®H°-êàéØj5«š%$ß¿|;Õ=¸L…Â^‘''ú•«VÌç.3LàÊIDÄÂ쇰Z©ØwAea¸†´²(fÁñpHî¨ c–åÄñ£HL‡WB«ÜmqÆœÞ4ò猟§w»ë¹ÛÕððÄt»Ñ3_™ò%Í™[õ—Ãc’Ò„Á½pÉrAÞ"äêž¿|ñ`@¤DG\½«Êæ"¥Ê{›\Å°§D…_¹aSÉÃ7¸L™b T[ò©3‹W¨åï& DFÂÍË×o;a*Tª|o£ë¶âH½þþËG~»9ÐíÑxN±9méδMÒ{ù½UÕ\ Ê?ïÊð;SÏq»ß™ßyúsÕþË•@jÆ+íûY³²Š â_vm±{Ú÷ýé—óLÒ#»4]W·&¿Í²6ŸšBñ/œ€á ³ÜÉMÀðùO,7 óoG'rRF´óvC1“¤ò?_*–†ù×Ú‚€+œ˜ó8,7 ÃüàO£3 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜp0Ì¿Ê| ŸònÀ“Ÿ“f¹a˜«ÎÀR…*läÈ~¤X‡p 9…þ¼ÎÏÝ0Ì¿UoH§¬•w$É%8:é*HÑu’xÂOþ±uÃ0ÿRµÐ…®B¶ 4—ï$@2iBWtèü5?†a•ç¨²B¤@Ò $»¾~J²*$Rþ™W6Ùºa˜­àHd·nZ£²&gGˆa7©¡‰'+f¹a˜­3¥nÞ’Òù9ëªÕºœù!wa·$´è”6ÿ+¡°uÃ0Ì£²më·?úšé§ï!`‘ÇÞ=æ;⦾ãR$–†a r¡BŠÃ`]±VJ±(ª2Òf}fPɘ’ô”‡å†aþ¥Î`j×Î)eøAŠ9†„d=±WٸŨ’w͆™óT,7 Ã<gJªRÁéî£*ºÿ¾­º&¥M˜ì E“u·Iã:[7 Ã<2ûF J¬Z[V¡]»n޵˴÷¤.éÉF7jÚºÆró¬µ'ýÅt–îzÊûÙzìûîÒÿÅšúóœS!t¯ÜOOEÞ} ¥l$¬vµÄ¦€, );˜¬i6Ò•ñoýüÿ‰wþkrCP“®Ÿ¿ý×;?Ü<"=wF!.7 *8~_ò¬aÍ[¼0ù¾#ALòEÐô?ýÔ¾BX¶V (¸äZr‡*eÇ.Ý%ßÂ7ÎÈ ÿ©&“ož<êý/yÃ×/œüÉowü'68Ȩ7êÜ'ØÝK/£ûÿôðºl4ûzH† ïèçfÿæ‹þFãCçöòõ2î…÷¹ôrÓ‚÷I¨ïšùÆ¢µÇŸ\HE5õèà!¯Wóã©ã§w|ÞiÎË=¾½ŽG~_q-¤C˜š5†B&™t»ÈèÒ…IPAÄᶭoúõ­W‡|u⺣‘ÙFiò…­ï¾1rÄðáÎÿ)ÝuçM 3vÜíŒôÕ_L:lèÔ¿ŽsÀ•o^Ÿ¾êhÒ•µ#‡ˆ´pnþvö¸QC_ðöÖ³‰®³#é­ #^KÛ¹lƈáCÞ|çó+éYfŒx̦}6zا»"õ—)C¦ü|0Ù®œn]ÒÝrñœ±R@€€ôHŒêƒfMѵ?Æ丧W£mtè…ã1™F´D¼9Í›bè;p’w´Õ§yÒì+S"Ðw}<úÕ…{ïa;b–Ïž6fÔðwfGY[)ã×…3ÆŽ:î)kÿˆÌ¬:{Âä×G¹‘¶}ÉÇ ™8}ND ¥¿ÿÚà“vç§#‡ÍÜé:î¾_¾z}Ìб¯N\}è¶kKÊŸýøwgÒééã‡>zéÖÓ®};yêûÒol9dè ’¯îuÜèK  èçw×-d‹Ž²WyÎ¥¯BBü†Ÿ7¾4÷Hâ™­ ÇMœfÕàÒŽï&1rÄș߬%×q“ÏûZŒ5ý×¹S†úö'‹ã —ßk½¹dæÔÑ£†¿7÷‡$—/LXÖýߧcG }mÒ»{.¥e_ÚÖãÆ/Úàôœ7â«OתA¸Wì?´WÑŸ¦-Ò@ûeÊ+S‰x4ºFpH0AMݾMQÁ þj¡E„FBÁ3S¸[öZ§Ñ_z•­â6ghûik®Bˆ‹?iØs2Š…µkÛÄrty½¦ƒn[(ãÀ}S ¼êß`È€ç“|ýʤ…ëv/žßàé_¶k·çƒÜ¬3_jöÉæË¡ÍÚV/"fômøÍáh! H;vôðì×Gí°•øJó ¯ x„±UÓJ›Ò°sæ!þ¥ÅEŧ9gèȯ«û=ŽYðz-!t >Åp^F·ž(”ŽºÁ8—èj}dlD¿Ïв+|cQ#Ç퀀ˆCÉìK@›v¸²ƲHM4ï3R‹ü¶Gí –Ä˜ØKnWF=¸CÛuj­:u´sß·o5(E#!’ßêÑxÑغ-Ú‡…¸ÍÞfÆæ!R9<óÕ‘{ÔJƒöS"Ö¾üÊ›M­›–·Ú º<߬¤àün|Û‰ßýQ¡A›ºüoúÁš3`¹ôÇöï_Ÿüu½îƒ^l]jÉØçgŸ°ÖéZº ÑÝ;¤k÷^ùŒÐœ¶˜è‡N€³`¯¯ÚU̧”íðëÌ€¤dœøm׊녚Ö1%žþ¹JïØD]õì¨þ[ñ«à¿ºZ—ó§Ò‡_ì¹geD‘¶ýq~Ý;®%€ÉÒsÚ‚b‚º~öæó¥ØRâbÓòöŠÚ±í¡ä€Víšß\ýþäí™æ‚f?rhT¢ƒR.µ©ßí¤5°e«Öe}Sƶ ûþŒ¥h“ç=ÜDÁÒ¡]Úµ3HØ·hTç×ç¯R¯YãZ>i0àK› ôû÷NéÿJdþÆCôˆßûÕÀ©ß!„~£OÛŽÛnKauj[Žÿ_ûNã¬B‘>õùf_ì½]·E»Jù¬Sz6\y>ÅU’¬v´¯Ù™\«uU—“M@¹ÒµRcwÚTH‹‹ŠOw>—@F’ß~Ïxè]•¡ŽSL4Ê?Ê¢g]OëӼܿÝ&]׉­ü¸÷ˆ÷ìDov*ÛoæIH×uʸڢnèüí(åXhh­Ow]våµì|-¤þp+}ñFç^#é:Åþ6¥|ãÞiYÇ¿µ~håFo¦‘-®}‹°×n&"]'íÔeB»ÄhDIëÂÊ59åt&»TzÞ‚¦\¢»“¨4hÒN"¢wK¼)-k{]jó‘NŸ´¢€Y飨p0íÉ}á÷>×å/zVì:-+Å­QíÛþa‹^1¾\“~éDD:ÝØ8¬Zõ~±DdnÝ,lÂ7Û]Éճ˄v‹#¢ÄßBË5;£¥ü±¤J½–iÎÌJ;0±\è D¢”C*•k~Ò™Y’ùãêt·M'úæíî]_ž§æ,¢ë¬¹Ù7¨Ç⦜éºNÖè¥;ìùåœvqßürn^·’®©‡Ù4g‡žpeq¹§¤º.5òéŸW’®ÝÝîTHÎÓ]ýfL¥Ví™)œŸw¨T¥ëW:‘žq«UãêËwÇÄŸ][¯vƒóYM›j#Í:ªKÃÉ ~Ï<È©Ý{ŽÞÐu]×)áÔ†ºuCÏ&è”t¨VÍZ³ö]s¥Iÿ}lHƒÑv¢sŸv¨ÜsfV™® m×~õ-õöwÃʵîÈ*Õ¹ûWoù®5W%%¼Zóý-ç²ÿ¾´zfX«IvЯþòxÑu"ûÅ«éÞn²lW$»"¾_Íî°é:éÚ“ÅÏÎáÖð¨hÑ=¬€Ë¾ íöúòn.»¬¶šYE€{Pwìˆæ !W+àçZÔËÍßS8mÀ؉Àî÷|<-?.Z@É™î垸û‚5e€´R…K$„·»P6=oä7ÛÏAõ.…¢»Q­"R2@Àm É ¤#è%x"ó٪¥qí,l¹2ËDÁ¸•édù>çR7îM(]£„ËÒœ³n€ŸÄ*SÔÃe øVî쩽ž„@7@×J.æº(ÙǪÖ;uæ|„›Q]¿ük£!i¿´c¤¢ Õ.£¸Eaòt£„TºguÜó¹1Ýi*ÙT– `ö)ì)ÝŠLN÷».Inžf9tálÖ+;T›Á¯¬—Ë(Ø´¸¾8êža÷{Vþ‘ðÄàâE™¥Pšµ/öõ¦Å$= d­Š†¤á=»Ôª×¼[÷žµË–º=§Z¢RÅ]¾;ÿ£k6§¦;m©ê0‚$¥zWwrðŽh°~wRùf¥²š Øüõëý›½1þÞîË¿^ ê€,ñ>Æøí×lSÊ™s%·[!²Âö¸o¿ú‹3Y¹Óa¶YÍ0¦ VÓ¼-ébãz-FÕÇ©h’ž°;õì„Šu›ª+F rvo»]5¸›²[Mò4!Ýî̺6ñ€ç&­]!$»HJÌPóõèÛÙ;«JBBÎìkx lšˆzƒÐ{"V¯Ç®í(•#¯gþ; 24;@°iP ¹;ÝCõ©4%Ï·:4£lp© ’l–%»ÍyŸ‹Ê3AãT%È©)® IJLuï6 {¾ÌË’¥ûˆÉC9ÂîÞÙýÍh„êÔtÕ¡WY²ç¬U;éFYÉ,£dVþR(3îeSVSÞQh^¸çÐä—:x¤…¿7¤E£.ƒÜVsÇpéý>–5ycú§³æ~ðÚ+9Ï/ç­:JuÀhÈû*‹C7ž””Ù¯J¡ç_hï‘{Ö ¨'ÝJ³g÷¬¤t‹ÑàeÄ£roH'ÒIwØÕ3ÍN9Ms˜f}¤¶k/ëš96Ñ2ûRO~*üÙ±nŒEü<3"#Âß@B83’cSl… ,äg½|9E<ˆHÀr! eòû@§?½”-àá¼æñÚëo ×Ì$iI²Ør*3÷¯lænB£>x½ˆ Rq3»/ Ü8tÇr‰MW%@ ÄÇ¢³¶W/"°8¼Œ9# ÷:—\½ˆaÝ­xd®ÈJñ·n" p™ dz6 {ÒE«V° Oæ~p¥Îç¯*¦¡c'ø]“ºªA‘‘ú0aü¬‚ÝcaX!ëÑWuA$„=!‘üÝÍ>¤§Ù3to“€€#6Î&¹›Ýü%%Íšx ‘v&F(âg#¢œf@sòŤìk¿v82×cB@sÚ4sóî›w€É}Z,˜ÿÝ×Ó{å8ô¹=Gúýþa£Bykç] ä ŸÕ,*ïºv§ ânÞ‹T*lþŽJ½úú›®i:I²”³’ÜÛ7ð³#ÏUsm<å¨o¾V&åNõÝ£_ý¥ÇHšœ~)ÜÐ ’>lˆ¹k/·ju3V,W„’<åm÷á#„€0<é¹ðgĺ!ÀP¸bH‰õ_Ïrõ°ÿ›Ò½ß˜åNø×mRãЂ·BÄŸØ®Ú:Ö¬ø€ç³…öT!úÒsÆã»gìˆsp÷¬ÞM.~Ѐ”d¡ÚR3oƒÚùíkvœ¿GŸð7 *.³Ï 3p;#óOÇoØ!€›Ø{M_¦ ©•Ø’!pqBÊâ–%wéúþ[ŽFæ>—ÔfÌóÎ-K–œU!„ãÜ-Ú¼pÞFõtGv}yÒ!Û‚7ç›ÚŒ«`zðEY]‚Rºes¿›‘3Ö]tUÈéÅþð‘ú  ]Yµ¥È„°%ÝX¿~C¢U¿Ç‘”ô “lB¨§cUGÉ*%Ì•+»g8üpB–ß:¿´é)c`I£—{ø/]8°ü Áxo²AQǶoØN䮑Æ«&=¼ê6 „~kÇôÝ)çÔ‹0\Ú9«S§ÑÉY4R &/@!YvþþŽk2À~aÆ; Ê´’ﶶö¯õ´¬·â2A뱯›µéE—è…=«çü‘꺊ïwo9bBèû6m9v @qºïïëñB@½øÃÂ"ºOªBèçvü¶ëBÒßq¦(ËfÔ-Nàt¨îÀ©;‹å³7j,CËoIwlß™ùíPß—¸Suª\­FhÕòÝ¿}!ƒˆtJ»öéø¾õ6hÓ¢AãÏ}½å"QÒárå+l¹™ñø„üåz&ºÂrëç†V ©W¯ñѺ¶yŸ¶¡ š4n\·fç—&œŠ³éd‹mVzΚKYȯ ”já ¢Œú4(]±z·v9¦…†¾µûaÌ„ýTÚ“_ÊDoýDÛÇ@¯.£W=¨òlêJ¾P·iwžË'“$ ‚½óƒËÎöM»’5Fþ˜'HMÝø¨IDATDV~Ú¾~¥úõÃj5hùùŠ}®l—v,îÙ¢VóV-Õ­ûòÄ™±6t¬Qõk•ž¿ñJVœy^p©f×U"JÿÅz¥+Vïþé^"J<ûÛà.õë6lجah›^#ö\I ¢ämý ÖzÝžuê¯×j2à'è궅u*‡Ô©Ó`ïuõöáÊ–.¾ÿ†ãîFÛÙµé’![Öw¸´n/‹µÝüÑv•ˆˆìç~_Ý´ë¼’í¿,ÚrÍ«ße¨DDÉ›¾[^©åå».®ÓÿÂ/_|Ð3E½ûÚojWxñÃÃ_»5¬}­¡Í¶_8\¦\Å—“2Ïtôµüå_tý±ó»[×­Ô AX­Fm¬9âJpþ÷¯{¶¬Ù¨Y“†µkt2õbªJ¤9¿lSªü ¯]iN¬ûê¹Æի׬Z£A›ykdµ©ó:-><þ·‚ÄDº®ê¢´ôëù‚o•®LDVM×TGÚï›Ó§IŽ*_Y¿W\ÿqó }=íœù7î2;‰€¬ÛQÖ¬qÖüoë‹‹"‡ÑžÃ¼½“÷>N^Ïâá|»üÜG ‚Q¯|täÿ&t¼oHðNRÜóhwQwð9¸Ž“üçeæ.SÞ&Ëq¢¼åÌì‡÷hž¼å"‚éc^_ðù'ã”înGï]…—½û]ÝéŽ#7oîÚÍÓ¯rú€wÕ•‡×w ßW|YïÇ ÒTéÿÛ»›§¡0Ãß—ÄaŠ¢8Œ:W‚ˆ7 ¸÷B½înĽwám(n݉¸Pð¯is\tŠýIÛ‡ëóì:$™ä$óΡ-IUJ·óö]\Ý^¸Þä8¢ªª<Ü;ís;ì~ì¶Ãh·F_=yŸ?ù“×Ë×Êì·—2gVËÜ4Gû#˜,›}¿=×|‚püiðÑ’¶ož?¸s÷vïÞ.­Ø¿µãT®óÉvæ_Ɔ}êðìÛÏÌU§gñ§™ñáÕÃÁ­{ 溺Z{͹ö’è=·³#°´îüè.\W¹îHsºþë—OÝ?øË72"KTÝ›ÝŃ&K]F—²ÿìEÝ8bøþðôo@áÁ/ÿÀ¤n:9‹Lã±Ír"‡ÖEDgT¥D£³åL[«’UéF]Û}ùþmÿJ;j/ýX ö|2Eÿ?w­Ùú9‘CË(õdN»MÉh¢Ž,uS×qéܯÇOšŸŸºÁ^UN{~cvÛ8<êN–él&z)Q²¶‰ºduêo¥È ü_úó€)³`[¹› 7€ÜÈ 7€Ü@n¹@n¹@nä@nä¹ä¹ä@n¹ä@n¹@n¹@nä@nä¹ä¹ä@n¹ä@n¹@n¹@nä@nä¹ä¹ä@n¹ä@n¹@n¹@nä@nä¹ä¹ä@n¹ä@n¹@n¹@nä@nä¹ä¹ä@n¹äàäý(/ÆìòßIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/content4.png0000644000000000000000000004737213051004444021664 00000000000000‰PNG  IHDRz…|¯ sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ ÌÍVh IDATxÚìÝwtUðçÎÌ–ôN ½×¡÷^¤K)*bA± 6¬XPQ±  úYPPéUzKƒôžl¶ÎÜ÷ûc“„€¨tÞßá²»³3³wgž½÷N¹‚ˆÀcŸÂEÀã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncìÚ‹"—>cs/»âv1í²,Uüµÿà̧_ ¨pî0v÷°ðóKÏ>åãëËq+VþP·SÛ·HiðÖÁؤj¦uŸ<‘–žV£FMŽP„°úúù’ä̓± ºsi0™-â \1þnc7Œ1ŽÆã¸aŒ]±4.Æ®=Ò0rsó²³³Ë<¨(Š—§™ã†±króò–.]V*ƒ¤ŒŒŒ5j×ncŒ¡ÙÙÙeΠ%"nL1Æ.tGàr5šÎ†»Šc7Œ1ŽÆã¸aŒqÜ0Æ8n¸c7Œ1ŽÆã¸aŒqÜ0Æ8ncì’àk¦®ND¡ùB§² tƒŠ®–!@hV¨ ¤7 Ta¶n'%f©˜„ÉrÃí†Ù0àq•œäôâ¡hPM 7 Ig\¤SvP44hJéõ—ÐÝ0 ºÒ.öa7×1!4‹mË´v{2Mêéªb‰ˆn6fvÓ¦Uy÷uOæÚçzOÔ«ô_ÒwX3!!c}ôÒë¢Ö >ëkDB"BˆS¿<¼ú‹eÆü2¬ÁÿÆߌ¶wšt§I)tÒ¿vÁÞµ+2Ò³H kØ7zØ]Õ«DœžE+ ç®²Û‘“žJý÷ Y˜^ªÉ¹ç¹Á[N¤«§Oñ¯Õ£ÕèµkV. *þ¢9nØ•9ªI‹ˆjÒºw%£ cßÏ[Þ=öãνÚ“ñKâI74ß¼ãKîf>*´zãû øuù·¿lÛ9¹wçÚ¼{¶plÞ½l©Òð¡Þƒj‘kŸ¢™ žÙÖ&Eö£ß¯_øR|†O–=¢Ú„Ãytêǿ«ÚwZ·Q“ü-¢()H¡g­:™à‚æg;þm+ÚO;"B5i~ê¶êk&Až¼Ì£ë~›= fȋ݆÷7qÞpÜ°+ŠÞ¬Åà{ÍjÑžHQ}n¾Éê9ëHƒDB¦nùå“WóÜ5ú?µ JÅ@UU@Rö¤•Ó^9£…¾C( aFúšrºt¨qlḵœÌ|ÿJþ%SDø„5èOÿ¢ÙëS2iÓﯪӸyóêœ7×ÚæÊEpµ÷â hlV" 0ªUt€#5ÙîtA@uîß½9+´IûFC‡jY‡ŽÅœR½ '-´É û|´#Û?ÿÖ- €‚}‹¶Ï­ÒzlõÈyöE „ÍŸf§Qã)KjU V„"Tÿšc>èí»jqrÞ%Õup÷æŒÐ†mß8Ì”}ôø‰8Eˆ²cÉž~( …4Ÿò\%#åÐÎõÁ¬rÜ°+;~ˆ’€P¿ãÛTøV­ÝÆTk|݈¼c¿ýé1ö«„4Ó¢A…Ìý â2`ìÿe‘NM[Ž«‰³×(€ìS›×¢ñ­š˜ ƒŠûsÈã@ÍEÛvmOT4¶?¤JKdíöæZ7×­|Ý&!èáé1E5ëž½oäÊ Ç »Â:p„" !ˆ²vìØi³FDú[Ͷ#;¨f¿JQAU;¶ÀÑÅÇ2 "ƒü¢¦žëæ´á¾v%‘©»¶ý²"2l™‡~Oq¸ö¸ÅÏGÓsO&%RÃï­Zð ¬þ`?Ÿ9‡Wïk86 $@dX;t™pÓŠ…o­¨Tn톜©nò©ìo!:# „bÖü‘ÒCÐ ŒüÄä“ûDØ]Õ"7Bêßèï3ûЪ=ni£¥˜ƒU=^—àæ×nØ•7¹Çnüæð†ooøúÈŸ?çÈZí¦ýÒ¹{s(HÞ”•TPyÐX€ÀªÍ}ÂBì{?Êq!@¡-o¯Q;ÌaøGõŸ¤ œ3lÌA ܇§œ~‘!ݘöÔM§l‘ƒÆùIŒlææØûa¶go&re¦³ÆYõvE} ož0ýA³vzo5\Ð (&¤o]ì2ùǾÕbžA€PM–ÍÿPj|^PíoàkhXPxljV`• ¿é+!@±Ô‹q&ˆ¥®õ…«d: !ÝÉùÉ9¾Ý›™ † é›?sšâßiù¶^¸š%Àä{89&7¨^ÐY:ž„¢!÷àa íÈqÃqî,†Ûm'h¢t÷ž&YÛ<>lÔ R¡hžs¾þ|cbÌžúµ»zOµ‘·kò<º‰R«UmÛ(ný¼ãúÕñ’ŠcÂŒüísókvíVWz È¿öoL²¶œqã˜A$á]ýЫ_ö{Òñ ëö<Û24û–]Ûòû4óUøT?nL±+ŸŠü-&£B£6ü‚+ú…Vò­äÞ鶪J~Üî]:Îï ³P¥þ TogO¦·^Í,Ð…! ( }ºjñ® Ž·Ö7Kù[?J¢ð­:úW*^°Ž“ª*öø¿vé%{|Šf.éù±ÛÞy&ËÙ¤Uwâ¬áÚ »Â‘JÙ­=j ¯Y£Ž÷òoÄ07nÖ½ÊO¿¬ŒÉy aˆ0þnwÎ?¶ò÷ùûOOC ØsüУ÷­øð£U¯üUµy¯ÈêUWzòÁ5ñ»7;*÷0úfU•röÿ~ÄZ±ríú(¹¦†Í{T‰ÿyuLöCM+€ÌOÞþéC€îÌOÞŸzÒÞpâ W& ¾pŠã†]!©Õìg2›Ï¬“è©û’œžÐ*½CÃT*ºFI’Þéΰ?ž=¸ñD£au…³ÉâsÆŽ­j_83Rg”X¢‹ÂZJð.OŽ­Õzí‚×ã×#% (ª5¤íã7NºÅW’$èi“ÎàÊÃ#µ2+Öù®°uOÜxëØ5ˆ»ŠÙ¿Ž»²Oq±0ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃcß«ø"2L—ᛢè~Æn‚"Ní`LE/K@/1zÑfâ@d‰é ð”žÞ(=Σ|3Ž›Ë‘5ŽÑ뉌r†j¹¸’]"Á{£r“³žGÌI|ú¤I:ÛàµW‘‘!Ð4£ÆáÐA|ñ1TVÜ7ö|úìÐuŒ6Ñx÷]œŠ€°<ò0¶íÁןCÓ`¶bü¨Z sfÁa‡$Œ›ˆMøËg7—”ný¦M®ùÇòÔ¨ŽB—rÑY†…ÜšÉnÓ->P€œ,$ÄB@ò)hmpüòr!€Š‘…ÄÇ@3AÓ`p:{.'tR’¡F#) ±— HIDB4+òrj8~†)a/@N¬>°úð6À8n.i2ŸìÐwå;K4ç%mJ)H·õšÜeÓÓŸå;€&Íñò{°ÀlFxäsæ!; $к^™]‡Ÿá¿Þ‚Ý“a(žÌtÐ0ä½ yx\ðñCpxíäçAUá€[cÌ­7‰7ÆqsI)ºnr@s]ÂEºÝxòA# Èß×¢X-ðŽ;Šâψ`õAå*§***T*5“à‡”˜ÞŠ*ÕN?J6ˆ€@È͆Õ…H0Ž›ë¢NeàT<ÌVh*¨¼Ñ ÎyîoªK7}Ég̸ÜïæŠFD¡@üû¡Ü5zõÇà‘ð¸Ï¶ŠZØ ú÷« Š Òkëã‹ó;GDPœÇ§%BP¼…Tþ|èß—㸹Þ¡¨î#ŸMݺ瘪üÛv4 wß…ñ£á*¿ÇH(“¾ê×·^Îvÿz!$„¦ÙcWÎY=÷‘c®Ókkèxú!¬ýå¼>®"R·¾°ò‹5dúût¤ì^x÷ÚŸ)æ² !’7=÷ó’ß…‰æ¸aÿ qdÎÁ5Éi9ÿ~¿1t|ò~øùU ×°g›Óø÷=,BAúÓ×,û>-5É­—¨Räç#%¹Ùç9{Ê–¸Ãñç³U’nO;øÛÉØLqæÄö”í Çyë¾Òpß͵ÎãÁOßÁê³å"¦"\©qYæÀ¦ýç|’„7 U†Kܦ!Dv~~Ptxøëç¸aÞîE(jáa’ˆŠöÒòvhÅ€`èåOé}R¨…ÇÉ€”D€ ‚”%;>„·ŸÅÛ_#ι¢§×“ %È BÉ…‘P5‹¢ !¬ª”¬$¢IsªZCÎDÂ0 ˜Ò r„ E+Z¢)Ï^,gYgßJÍütOé5e7×g îÔckÞÙ½zYVŽ¤)¸Qÿè‘6lX åìBè©Ç–NÛøÓŠ‡Ë·fÏ–#iÒª‘(=% Èìßmûv^ÜñxÃ^µý­íFÜ^1ÐLuê! N†‹*\‰w|ûú¡{<Šµb›;[¶/o&"!ÊŽ]ý᎕KÒ2 4ŸÈZ=§´ê?&4ÐL()¡˜è¯WÛn=E9öͤ¶MŸ\×±¶¯!"ÀÜׄÍ÷˳ۖ•™]à[£o—[†ì|uzаïú ‰tFÔ™¹óãŸÏOËÈ!Kµúƒžì8°×?ºîC(âðâ.«öNxàÛáâãæz¯ÜÈøßælüa]í1ïöjX‰\)û¾žµù݇_Yi9c·WÕܵÏo0µï6sy€š{äûÙÛ>˜œ{Û]Ú…“< BÎø/V½9ÇÚõéá··¶Û<¼ržkܳ3­Ï‚Õã—z+"síÏsËÑêuùC¸Ÿ¿â™ßÛ`®\v…P5ç¡÷ïÞ´7±éØw{Ö¨àL\»þãWW§$ žú¸Ÿ¹ø¢OŽ·}ãþø¡ý‰½Ÿ~-"ÔZØ $à©Yqú±ßOì¯5ú½^Mª8b—oùä§oP„I-/*4SÖk–Ôm3åËP_ýÔÚ¹;~˜®Uþ£këÀtîŽj°ú˜yC»ÒpgÚeiJé¶ÌXk³ç»îVµ^xÝ.­»öSô#Y¹å´k¤3¯F¯ÙoÖ®×0´V»Îw¾\!L$®šk3JEƒbò_ôŠ«Ñ½C'Ž‹ˆ¬ÞpH—©Y:ž … èzѬõØ5KsœZËÉ 4iR£UÛi_4õÍÓIœ±\òÄþ²cß‘jC?kß½KhµUºÜ5zÆÛÞÕñÉi¥+CÂXÙj1AXýÂÂ-Z‰*7;6çŠ ¼¸Ïàîa‘u«u™Ö²][yŽ$.0š<ôQ½úõ‚#E ï$²c’ˆ[D\»aÿ6äÍM',‹¶[Z^zLìÁ½Þ]¼¼ýO·vœXƇ„‚£šÕªðÛñc¹ÙÒ/T)Š(¶­‡ã,unj© HøÖÑï±h³Ù!gÜ?øø€aKN;&üúÕmìCÁ£5Únχ™g,±G ·É¢9üÇ_Þ³sE)™‰©¹Qµ+ž×,áHQ£e×z†‹$j´ˆÚ°~óYÒÆ0Â7ˆ„á&@“&ÁÝ/7ì¿ôÜåÇnýhöû EB(PÎzð†D@d$¼ý+D©lÌ5\nÀzº ”gW¬¾~¡TØ¥CÂV»9œ²À0 ;z Ç™ƒðæ>Š·£Ð"ššé÷3ì°ç@¡˜ïŸ‰)ù¬¦Z]úù@@ @ÒZ!À¬wÛšCÕsÔü¬aàá¸a 1eäl}禃¹M¢F˜éãé¨R‰†mUÁœŸ”[xîôíkž¸=IUç}‚×?„½4ß À:ÈZ–” @„bBúŸ¿ªvæ^ÅdŽ?¾ÝævÂU@nÜ ‹Ny(!S9¯Ž€„)¸}=q²@Uˆ (ëÈq¾¶€ã†]*j€ÅêÌLˆw:݆ÛnKܶ}ý*t»‡ÎL¡™²>[ýåÚ‚ü\W^jìêwcRÒÃ[O ²–:“FWj5Ð<í—ûŸpÙó]y)1«_Iq¶hX×*MX}dMˆ3¹œÖíÚ«Fêî/>ÌÎÌpdel~í÷Í.M+§vÔ¨KxX@Ü7Ó’]Ž|GæþÍóæ:Bk‡Ÿ×‰{p:Õ©s£Dè‘OÆ&¥»ù¶Ä;7¯åk™¸1Å.Uߥq³~]×|}×÷[êY{A¦Ñ k—„„þúð ½\%,àôÎ(Èm³WíwŸgÃßn©ç«¹rRÒ«Üðb·M`”<÷…Hú¼Ñ6qÊÆWGﬢ¸ÒrsM­ïz½’ðÐܸGmûÄŒª7ÏF×á·õ²úó—–ûÖ×bd§«MÇÞubÑW’ʶ„¤o£wÍþý‡WÍ¢gÇäi-{Þ÷H ¯Je›;d8m.»¹lŒ8ðµÖŽnp2é·•³‡…F„xò3êt´RÑ|ÎL8éÎwÙKœ*CºËž«¸rÚVdxì9.§ÎÍ.Žvî¼1Õµà–Ö›â¥ÀuÚuð5¡^ƒ6ñiZP€•Šwe"éñéòn Ј»Om_‘•§ThÚ»Rå`i”9­X€Ì[Þ³¬á€Í±GŽOµj­zYa8bÿX|tµ†Åí$i¨»?sS« q»6ØeHõ¶ýBüL]úO6Ü%Îd©rï^Ø–~à×”¤ K¥è:-¢Tƒäç4KÃ5cEsÃC¥N:6›PC›÷ypnæ®åIiž -‡U²/9¼–°²"©î˜uÓÇAw "#°ë­œ€„^¶«ˆÔÀzƒç§ ‚î(sê0qÇÇ +‘ DÒ#|jtlR«#Ò Ý-‚ši®@ê%vï#·Õ¯jûÑÕÈå¤~2ÜÂZ½C“š@ †$’ã0x[8 ‚P³^ÏšH‡!I¸ ',5ÃÂCa¦ˆf*4/º¤ ¼… Òa¿©˜Ÿ?&ܺcÝ{YË›sc¤étà³u†Ù ¸LÃQAt£hB0è½M9W6ÇÍ¥ªFHè<°çS·ŒÖä’ÞLS‡Å×”C+œ~Ÿ4éëþš<OŠn}ðÑÛøi)T«aÝ:Ì}º†ÄÛŸ E} ‚ôêÇÃÛïáû¯ ª¨^/ÎC ÷Ü ÝÃÀ—+¡ixâ~œ8 C¢SwÌy/½U?þøøøøò6À8n.UÜèßmð—Ëcè’ÿÈ Š’½èÛ¤ÕG*ÔÒ‚jÕ€–í– "´h ¨Ó]{!;áP¡2\ÀÐÑ8´&+ºô€ h×i)p;Õ V+=o@f*ƒa¶@ÓУƒ Ç™q{ /ŽÔi‹•7@\®¡x^~õõá]†N añ’4âïoÜŽ1O¢Ï.@¼—”뀇 ˜QxݹË{1·€÷~{@'¨ÞÛã(¼å¸¥ÄôÞ_.­ôô&@pƒS—’ªaÉìÉͪÍ\¸Pddä”)S¸vÃ.n“JªÂSߊÿðvǧFñ3œÉ@HÀYzžen¬zééËÌqŸ‹€1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒ]ç.çE BQ<Úü%úaQ½eUß6üÿ®µÂûšqÜr9]G·ÿæk$K\£) ëºað ­/¼”¸ÊDNìÞd1Æ?¬ÕM“:êt•Ä¢¥$kZ-šãˆè駧YÏX_²=§(ÊCû“’ˆ/´ìœæ@ÿìãÛœßI2ýÓoLS5ÝÐy§«5®U),,\Ê+ë~ —'n„Dô̬Ùg¾´jÕª]»v]iÅt ˆ­±ghаAûö} Cå¹Æó†È0Œ+mŠËÖ˜:[AxS7œ” C†Î­ÕëÁ8æ ™bŒqÜ0Æ8ncŒã†1våºâîUìíßRÎÁ ýâ(E(ŠJÄÅ{=""M»¬gö^Qg¸‘®ë <ü·u«õæ›+Ïž1qbžÇsÁŠ×{NïÕ7‘‘‘V«õrí_WVíFa2™êÔ©Ã[Æ—ááÕªEpi\ç¡sÙªØ\úŒ]W.cÓã†1ÆqÃã¸aŒ1ŽÆÇ cŒã†‹€1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆ®täÎJKÏ·»/àN[fZ–‹–ㆱÒ\[oéÖýµ¯wýû¸9=Ú yG>ùùáí&~ÍEËqÃXª¯ŸÙ¤þû·õÓ®lr ïÈ'šÙ×ÏÇÄ%Ëqîó¦•zM”~±ÜºËYGk+|‡E#Ifóß-™ËŸã†]Gi!„HßöåŒÛF6äç?Í) qºš"2~˜÷Ä-£‡Ž1î¹V:"!ô‚ħG ø2ÁHÜøñÔqÃGŒõä{?Ù!„^½åæG>‘ÁÙO òìç¿ÉÂyiR}sƭÆ ½eÊÌ5q!8p8nØõSµÐ÷|ùXï;æÈáBR·/~×\›Iñ&ŽžupúÀþs–í5…Tõ§ŸÎì6î…X·‘ž“™ö×â©c§}nó ±`ógtûR¢DxÛA][×%—ÝwP»Æ5¡Z;6js^p“º• â7LxãÊTðøô»ÞÊ®}¿ÿNBÐ{ï]éë)‰ûnï٠罟$;‰ˆ¨ aîíƒÚvèðââm’hÍ[c›÷y`G²Í;}âæÏûvŠšüüj‘;?nZŸ†­£z.ù+‹ˆˆô#?<Û¶M˧>ÞdÚ±°sƒ¶ÈÂ-cH먨'—Ÿð>ÌÞþY¯NQ÷Ç›ÊÅõveýü ûøŠ= •|fB% ˆßj÷ÜÑÕÐ PÒÿvG‡)[…k.—ËårE¶пJDâ¡5i ÓÚçÉqQ! "¨õ‡Þ7<[÷ÿY Ã£éžâEé®A÷ ® €àšUM&Ípéü\<»’¶„Ý9£[‡(y›6æÆ-+ÉoH(p;˜mN÷þ¾ï+TØ•[Zš¬‘hà¿Ö1 IDATs#Ù°w“ÂWÁ½Zû}u$ËáAÙ6IY©q…¢…r— Ç »ÀL—ûÈ/þ¶o„Hz³¢Ä)Uõ>”ºÓiþ̇÷´«¦Ko¿2„B(+Œ$‹ƒ‹@1idÐ9Ò pw w³ (0f3î¸B\¶cÇâ|úaý«5Jß»+‹¼}‹ôã{S„"HÂZ½n¨í`’ËìãçãëëëçççK·ý¹cßI)¼á¢Æ­;PØ+)äoÞ™V9ȪÎU£b\»aNTÖ®EZþã"X­‡¢üã7†…×”¡u5üüí'>îñáí~B|²š$jöTû¹y/¯°¤[°µkÙ3gWÿ]—¶ðB³üñü·Çº¬'pjõüÿ¥¨mû´÷5! 3oò7ì¢Ó:v¼ÔÍ¢7_kD£±Ã¿øż¡Ã¶îÛìä–åÛ3ª Ý ÐûæÇ–oŸùpßniÄýðÍ÷®Šcž¼7ªèÝÂ'T{玻ŽË?ðÃÏ­•:ŸØ]TÅdµ&.ú`)z´nÝ°:‘4d©”RJîÁ¹ˆÔY³fq)\.x4\¬ÓS„Ô:m;5¯{걘¤Ð¦f>=­sýZõ›5«êk ©Ù£CtX€ˆ=´ïT¾¹ãS}òŽf„tç®ZøQŧ¾ªÿÁ½{NÙ¬Mxð‰‡› üÃ-È‹ýk/Ulܲ^¤o`ÅÆMš5ªZ´+X+V­ß¦eÓjáÞZ.ÖFÈ'm³+Q™ºS©‡DTúd¼¢W=¶øé7t“Ïí|§GX‰ o•ž%÷scŠ±rëN¥žqÞï9+ZÅS—žŠ³†ã†±ÿT'’Λ4¸ÂÎ)Æ.Uû«¸Å8nc×#>Í1ÆqÃã¸aŒ1ŽÆÇ cŒã†‹€1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÎ ¼ÿÿ‰¢g¨èùëeð%ŽÆ.^ÒÀa’Ò.òˆÂ¡‚Ip.¤¤ëf>´—±‹E©(¤A@yÇ&€¡&]Oƒ}r톱‹X»0@äPUYW!O7¦„KWtխ袨qÅqÃû/¤€âQ-ºÐ$ UeÒ̆€Y‘Á}7Œ±ÿÚ˜T·j7KEº*¨xw#24—"Ü É)ÆØ|â;7¯q«ºb(§MI˜ ‡Ew ½¨™ã†1ö¯‘€pÙâûŽÉ=A$' AA¨™'³oçøi…Ð äõ’77Œ]ÄƔ뭕b&'ц?¤€‡¤$€üO‰?¥<1›’‚ã†1öŸéù†Ç ø¥MŸ¡Rt C÷¨?.×|qxŸ€çúÙ 9n»ˆ,Í¢ ÀGq†&ç:W¬UHBCÞüyº‘çã&k(Á ÁG¦cÿ Z½Ú¹aá¤I 2ûõWI˜È–%}aò :dˆgu+¤2•ÞàJ><÷¦XöçÿâÙ'½P?ýƒõ(oºê÷BôÈ7)f~l¯q"žvlÀö]š¡(B»óV‚¼nÎò㸹i#<éÇ;’-w¬û+OˆÒ…B=~Õ7½žNÉrŸ«‘B¤ïš>ó«üuxÿ£ãnxò·Œck?¾uä¸e)eg{®C‘ùˤáwlˆË¹P—•þæS7ßöÊž¿]"!„Ð6¼úØÔ[o3ñÎi‹×ƒWâH÷™z§Ã⌤dÓÆõ™w?æ«j&½y #º™úõ³rܔ˓~2>=Çöß6v™—ž|êTº~ÆnH†ýý×_v*ªýøoO|±#Ü·¼íÔ›yø”G—@ƒ÷müñ„V)\#WzBÌ©\]wæŒ9‘íù‡ë«çƵ¹ôÿ²wd§LHq>ÒSNI.8ü¥¬]_ô~ϊݧ`Òìi‡æÝ7hÒû;ÿA^^©i£“‹9èñ‡IQT˜l32Ç7¤á4‘sèæPýzÚ¯8nÊ•üÌàf}²ÆøO3q~ýÌÔ‘7ÍJ;3‡Ü§Ne›Â}-§U®QEýO‹±%ð„´î>äËG7l<ùÆ>>–FýÇÞP³’ÕréËMÿ}ÁÓCM‹û‡µ=Ò_-üÈQeè{ÿ[þùÂ/¾^úÕ=ƒZúxúò“Wû†$`€„NíÚ?‚¡dæø É„éŽ|xšÐ¡‘I^7ç_qã½aˆ4 ]×u]7¤$òv@$eá ºaÈÓ½&R×uCIYæE"ÒäãcVÃ0Šž,ž¿.eÑtDÒÐuƒˆ¨ðÕÓ‹ ¡š,>V“AD 2t]× @îô+æ®O´j®ß翱:£¨I! ©ëR7d9¤Qôª¤ (7<é+ŽˆI킳÷oÜØo`ï5t]—eêi…]%ÞP¼Zg¹ÔB¥w†Å[ü†PÍ>>¢²Í £t)~ºa€áN;¼3¦ñ¤;y¯šÔ#ZÑìGþJó.Ò0t]7®º– 2)ªÅÔ£«=¼é£ÀCfÝM‘Ͻ!}ý PˆSWË7J€'ç—…/ŽîݲiÃZZ´»íÑ7÷ez„€°Å¬}îÞÑí¢j7hX¿]ÏŸ_°<ËÈXݽMÇ?ßþþãã:µkÞ¤Qƒî7NZ¼îˆ8“öL8z;©Û¿y¾w[÷è€Lûñݧ‡uoѨIý¨fm&L~ýÑ\Ã1÷¾6=_ؼå‹ÇûwkÓªEÃVoxzþê|Àâ‰Ýßßç¶ý9º}¿o\ÈÞ:¨GãNýnÓ!´°¾7Ý6°aP@•–c'Žkäö«W™ün…ÎoUêþùÐìÉST¥ðRf™ûú’7¼Y©ÛÛU~wÇ[1ûóÀ“·qÄÄ}qî‚=?/nzóþÔໞ®m 0ÂÚ~üá= ɈW®Xÿå½¹¥LüÿκwTÛ&u7®×gô}ßîLU4QÜLƒíèdzïîÕ¶aƒ†õ£Û÷xðÅf¸dný_·&?Ûºþ‰[û4mP¯a“f£¦>±z_€_îë1ûÛ­PöOêØûÃ])P(äÎúáí»{tjÙ"ª~»žC_þ|£Hÿ£o—FÝÝsJ‡ZÛawŽl‚¢›NII€¡ZLP{ûðf-Û Ýãºêê6BBUàf?­bTÅPìµj+÷'I¸¯›£àE?dW/)‰hëÿëõè’í¹y‰û—ßÚ½A‡±ïۉȱuR‡èöÃïÝ›š—“ºáƒ©ÍšµžþÅŸDDéknèÑ®C·>O,\——›Ÿ´å-Ûš~2ÏC†AîÃ÷¶¾ïõoròíDŽï¿¹}ÇŽóVîÍÊÊ:õ×O7wiÛmämûÓ òØçÍìÛ©w·ÑS^<–š›yê“cÚwè¸`Sδî٭ϽÇìºÛd‹ÿø­çç¾ÿM–^Þ9¹~qô]§ÅìOq¤§|â÷ßøNý© ©"סÓÞo8äÏïöÛ3sr÷üþMó! zNKJ6HJÒS7ô¾hÌ›99o=‹H•$¢Ü} Ÿ~â…µ‰Ž²KÌØ>aPçN½†.Û—™òë{÷wìÒ¡M»+§Qæ[£;µí?îç} y9™GÖÌëÕÆûNCflÿnPçV]ºw{ø½UéYY'w/Õ±MçáS¦{t{öÒ—ïîÐvü^»áÖ r$ͼ­{‡Î]&?ñqbfvnÚ±×&ÜЮ{ÿŸ8%åÇ|0÷ù7,Í9³@\§ž»½W›ö÷9½3¿^0祹Ÿ&z®ºí“Ü’Hw¸6oÎ Ò³¡*nÅêxúi—Ô $Iî‘dÐõâêŽID2åÉ^µ½¼¡8}v~ýâ ]‡þn£ïLnѹ÷Ò½yE¯Ð¯³zÖï:#¹0nÚò\–Q¸[æ­¾½n‡I‡2¼xÂí£§½ý£G’3nðîQw}wz© »4mûÖ¯I·Ï{´O»¶Ï-zéÄgÚ·}áÞ‰í ݽïƒI%3 ÌŸ…<'^šõA½wíô½ìÚ1xð›uîLHu ;¿lÙûûwJ¬ÀÒUoüþåoê3|ñMïÚrÓX–û7I¹û›»DG¿¶Ñ^´DýS{4i3À79k_nÙ®ãÇ[ò‹ß‘óç¬è½W¥ºsw|7¸sÔIo唃ó:6n5ç—Dž•sïïÐvâ1ï{I3oëÚ¥çøý®¢¹ì™Ó¬m÷/6fȳHÎÕ#»G5ªW§IÛAŸpxW»ÔzKyõüJ)¥Ô‰ lé½ú:4áR4ª%oÜMdó¸u©K¼ÍÿëÃÕ}7?Pʺ §*MT¿°j6ðîíLJYóìÍ ¨Û²i"ˆ&Co©øåGR0Ê Q¹^ï ¢Ö¤¨"»lÅV 1áh^®Z=oÝ¢…ºN„¦æD˜û’2!jBºêã:z{X||ToC¥¼U-çÏ£îÔ„ã2¼GÖ@‚anü`»?'Ä"?>Α©úçoÞ=ÿOI„¢åû™œ©§²Îçðvy'â¶ÙúÞÜɧ°ù"Ô§t{qÂ&ï¹M[â,ªš¸w郡Û)TKÞïì¢Aº] GÞêï jB4š<²ö[¿ì:ùhßâŒ^qµîè&æâò±ˆ¢ò)·@|«·œ5wAzÒ‘Eï/üß3S*¿¶°w å,è*h7!H…ãyæßV{LšE† ûÒïý?|[!E¨×ÑáWÿÍCõ¬˜\kHE_3@B"¡ùUõ ‚‘–ãrhæÈ ¥(ˆ³o¥@KÞ©"Õ¨mîg;ã  Ë£¨û\tDœ>ÿMT¨&@ßPSñ>óo:3IÃcËCźÖÂö>h‘µÍ2Bè¶lCQÓ—þY2 +„[UñRÚpägõÃJìÃæÊ åo¡¦Ùœ φ¥Ÿ+tzG×*„xt ¤5ƒ Ÿ&@øV©îŸ“”‡3w’ð õöšâ,·­#@‘€€ÐüBG·Ñíº7¶v»éÕå_þØíÑ¡¦«ñè…€¢(’H¸ ²Ÿz&BdÃ×סYƒò²-.éþa™rË-&Ãl¨†)×Gæ\õq£XƒL.{Ç(ü–È™w*=¸rˆE5žÌ ¸ðôN¡»ó.K¨ŸZêŽøç. “U·<µeMï3ŠŠtÇyÎäo_E³ú"&ј ëBæ§x„ ˜-ÒæÛíð’zærºÉÿÕ¯=ŠÙ'@É:iBŠ–Hù‰6á­J(>&E(µÞ]µ¤ÞoÎØE¡ìûíYzn†ÝÚÀç,EAåTéJ‡ŸãäϯsÓ#Skûª…ó¬Õ¦™—ì‘0)W]Ö‘ ’PDæo†+ŠBÂ[מæùz‰U¨ S©3b™Ín"3þåÉG¦.5µZ—ÆÖS?îI„ èÄšÏn»yôÒô°N5ƒmöCûctòž· $n_šì×¼CåóŽB¥ µ#‚’¾û6ùt (yqÝ>û3æm!TîŸÞÝM3‡FÖ©«Oœ @Ò †YI¿Š5ÂÒ,N9]{JZöI‘;VÇþí ”¾‚N7I€ªÕZùf¯X @xGØùåj§÷H,-ëDHóÇ6[ñ3v¼Ø¦ùð­y† PL¦ãËWº Û @Þše{Í­ZTýGµ»’S Õµî‹?+(lžÈ>‘„ø‡kJ©¢» N3 I’HxÜ~Ûw膪AfT_ø©ÏÈ[ UTwçg¿û!©P…ೊ¯ž_sÔè1Q›_~jñû“ÓÒãmùø«¯ *T'¯dOüè­7÷KHOKÜûëügÞü«Õø1õµ¿’D6[N^¾-¸a«ÎÍkì|ûÎ/×ïONO?ydÓóÎsVkÒ¶aÍó˜ ¤ÌÏÈv¹ ùÇ^|üžGfÍO3Î aª3¬½ÈÛùÐÛ'÷%ØO~ñæ/Ë ³YdnиFÛêÉ/?ºgõ¡¼ÔÌÜC»ÖMùÔ]µNµ5þ64…™›^ž4áîïã쥺=ZwîQ=س葙ë÷ON:¹kśӗÛM…ÓÔ>²E€kÉkO®Û{<-#íÄîŸf=²(¬×ÀæþŠ@±œÚþúü¥›N&'ÇÚøâ]³’*7ݦnQ4ÙÒ3=.ýoN]¹gϼû±d0GtíÙFûâÉç×ì=–œšt×/ÌOÓÚ÷ëg„#å½î{ðá—ã…VÔ+7¼² ‚¡‹ŸV’Ý!Üòú¹hê*oL "ˆ~÷¾~,fÒœû'~ ¹vÿfo|4­"€ªÃÞ¯`ê}sîš¼Ìß‚¼´”ˆîÓ^šÒÛÛ²Ùò®»„áÈË·IV©Um÷ë?̽ú—WW/šñêÛò¾ÛæL›øqh€^™n‰~í£—…)ÐÉí´åÛK\,@›-ßéñÎÖÚ¸†5ëw qÿ—ߎÈÚ¼y]¶Ùe—€Zvë458t~æ²É®»Îl&[nP‡î9xÛÇ’-¬Ã¼gåm36Ü1}WDäØ´†7üïÉŠH·¸ýÜg+!GÒ–ßÖÅ´È÷”^¢0×èþökÓî¼sÖŒ)‚|ÕŒ\Ëísûã¡gÝÞþüZ½ºàÍS|xê¶`³3+ÙSkÄ‚ÇÇ[Q.wû)wÿöÆÝ?˜‚È™›ž6íý×ÚTód­È@—gýÃÆLxó“;šH§Ýf³”8iÚpåçÛÜ:€+ãÏMë\ÁÂA3‡Þ3{ÎÑÛš~džð@«tÚÒõˆç.¼¹U;wüq(§‰ÍLWAØ¢ðg\5T¥Û'º¥Ú® é2Ëàóm7Þ ¨Êæ?»M;Bè×ÉLâê¿ì¶pðžÌc[·L2‡×éÜ©™Oaµž„гwlÜœ˜GÕ›u®Pø \ô+Yxø€¨øg³ðeäþ¹ê·sõ®=[H>´içÑTŸJ {´k¤œ1“«K?#„~xã/‡²­í{w¯ì£–^ß²!\Yñ¿ít¸üªôíàWz}òìJ:¦V®S»K=ï ”ZäÙg»éãÿjïÔ&å,‘ò·¯[Ÿd37ïÒ½f°¹¸K¨°èà>´õ£Éöˆz­;6‰ôveíX:þ®Ç{-9<=òÔº?vÚL:õê"Š×SÆnýuO Ewï^3ÈZraE”–(÷2+:±sÝ“Ù>áµ:vŠöEB û™ÁwÿæËæÖ«#n¤p+$¹“î4ý?ãþ_~É©Eq ›ÝÞ©³ð(Z:@†ûú9ïæšè£:£E_ü¸lKÿüÚþ¥'*ç=ç9qÖy–ÿ†s¬Ã¿Xï*$¯ºw»׎á–rúÎ(s¾X¢uF¸ðTšÒŸùõ³œYÊÅß! âgÎüö¦·ŸÇU3œI‚ÐÚ¶ šÿ*Õ®eT2€DÐØ›LÂOÀä &溹Uñ5јbç80uŽ¶Ö¿c?µÿëe¿Ö=­KÄ¥ú(ÑD½úŠ%AÀ (D.’>Š‰$UNf³–2`PÈÏ+ì€ßöõæÖ]¯“Àá¸a×ö¾™únÈP „G5LnMÑ©P $ÌBUíÉjíRÍ‘iÇŒÐê×GÏÍõÑÎ.`»õ_5•®«"‚*<ú¨ÀU˜ * R}Õo,o›X=ĉ¼ŽÊ†k7Œ]ÐÊMa£Õ{šHx¯‚ó^‚BEWHDªÝ­›ͬ^7ÙÍqÃØåˆ$:=ª[ã†1Æ ñ½Šc7Œ1ŽÆã¸aŒqÜ0Æ8n¸c7Œ1ŽÆã¸aŒqÜ0Æ8nc—yïTFD…÷,#H=/qÍÝ2ㆱËD’ðH"†0 C8uHºöhà¸aìrÔlˆ@€¡›ˆT‚GH%GÉÛçþëµ3Ö§~#„zí](η×bìrÔl„ "7Ȭ’áž½ÙëÿÌú!M‰µûŠüŸ{WuíÕn8n»lÌn³Ø•¿á÷´¥JšP$”`«êÖ>×äMp8n»m%ïýûPxG?À{w¿Â§¼ƒ„éfcGöÏ?$j4ãëš0¤˜N¡ýP®±ÌáÛk1vQG—BNf Š74¼ƒôIAºJ"ó"óý#Íã!,dÉ65©Ð¾M@ßZ>ÍTï?7ìì" Hên©X4Åð¸¥j6£ËÞãBN‚#þÉxµä²å9¤àïëÈË“fŸë?Øp‰ö|—a ôQ.ØÎWc3üLªø›e“‚ÜN»Óå‘E3ûúújÊÕw‡M"R“Š®B+¬×BBWT!òÛ§ñ')‰šaÒÉãc5U¶WïWû¶H¥™ G£×\ƒŠL•·ÁSÉhø÷Õé3,1DÆŸ_ÏûßÞLØâç½2ï€ýœ3Úù *TÀδp÷ÿð 'òb§´ŒýÂB÷?úd[0sLoØ.Dzÿ2ö<Õ¬ó¸íñçÑAÚ¶Ïï?¸c«f­Û´ê1pÔ3ó¾ÊrWÕï"B¦æåR2¨èæÄ‚TUÕS]'—$>¯Ä˜¤Éa-Ö"‡Zî½½îË5QßLÆéjÍ5×yÃqsf…OqjF×ö¿·R'ñfãX4ãæ¾N.;¸$È“²á°ãÆf'öþA-zµðǹꘪ (Gä¼i­nº½K¸Ùˆ÷Œ©fVÿáÇf«¯Ÿ¯å¿•áÑ)mÚ¾¶bwágW­þþ¾š"þö}°¯¿÷ι'‚»/Ûyìø¡=¯ þqἿî…c\%UûôÐóßǤ+ Å |K²_‹ÅA+ùé&wµÌF÷U›Õ,¬¥€Kª¸VÛ×BÜ”÷ÝxŸ¢òwÏúe¿b!›„ª‰²µ’Ò9~Ú €U!ã“õŒjy²6ýüöÆT¸Ó6|4omæYþ(¹\qÆÏgá«TÞϾڰs˪|ƒ:öl\#¬¢"J®c9P:¨üò={)Îß,ݨæÒ/”÷1JÏ'þ«ÅG*=ôð#u‚,¤ôxè£IU2¿ÿuŸ·åÎ/ý «Þ§”‡½: {‰ax4ã§Ô·Nº5Ý¢º©­1èÁ¦ÏúË0IE·jD*¹é<ǖ渹,_¬¹ûߟ}ï-c†¿súw[ãQ¼ï_ýñƒ·=fìýO¿µ; B!²7ß1~Äü¹I[ÿ÷णF}ä•/’&îdŠ[–÷A¿CMø¬èñ)ª ü¹‰¶}EV¹1Ì#"¢|šÙ‘àCK÷m™OÝóeÑ|@£_!ãŒEèΤ„˜¸„—,]~äù殎MûLúýh†wµw,}®Wˆ‡¼–KDD[?™Ü¼ûmëc³½oIÚöÕ ®MÇ=¹’ˆ~šݤq«>Ýà-á¼Ø?ïÚ¢ãÈ7rˆˆNLnÖâ••yßåÙõXTã¦CŸø<Û»bî”Wnm}Ç…¯æ%?“å,µÒG¿÷ù瞺|Ÿ#Ú~*ß»²†=åıi6×U±y¾yð‘é±×d.'R„gŽutüãñ£%¾æ¤2HJ]~ §¿I׬«¼v#ûŽå¿æx`Bý •P‚‡Ü|ß„±­©@_±l—Q}ÄèîDæˆæ“îæX·l»Ã{’•Q¿ÅȶÕ}¼0Ñ]ëÀ©Kéýé÷H€ ]'¤ùëHœsÈŒ»«Zt]×uÝÚᎇÚ©ŽÄCä–!CïèWÃûsUG#ÅpëÞ™’é)ìN±FV¯U£jES¹?]unGN6Œ¤* èÿíÝypUðïëî™IÈd&Éä 9„„#Ü’ .áˆÆEÁåЕP@Y¤¤¬B]ñ`Q¤´Ö]±R.9ÕÅâá áFB€ $“™é·ÌLî¸Xî‘ãûù#•LwOϼtû×ïuÏ.ï1Üüqâý ˜ñòû@)¾Þ¸°y'Ð/ŽöÌÙa ^šŠäHèµûsLám¢"Û„Eõ’ÿVÖ{Ëý~DJ¬MJH©%¥OìïçåÆŽÕßtŸ8)µ­ÙýþÃ{ Ɉi[³é‚ûp™:{d_$ ýÛõ=$çÖl¿À!Ýé¨X—S Ÿ4:=@‘†°èx›ë¶gªæß*&6*ÐTmk<½uõú-;³ó¯4Es—:ŠoXtltˆŸ±Qlž­ü#”Ÿo\tªúÊÜçK½ÌPlqŸlrY¥Š@ñˆ¦üý½þªbçùïΨáSZYÜ8R [€٠ ¯l¼RìëÓ½ÅóO”€5¢W¨¶1û¢~W uŸÐ8£w§“õÄYáµs¥ª²nÚ Þ!\WnÛ#®CºK¶êfÃo+€¥„f‚v«VáXòOâ@òÈ*•ùƒÝÝýT âÐ8xÐqþÌwÃâíÇŠg—y—¹³—t1ç‚fÔ¦ƒâùY)|ü[‡¶B1À•{°Ðpqż!jÞ·/K.Úm†.Žm`T½_@«&¶WDùùü[h]ë]úXÃÌæŠÝ©Î®ÞÊ/Ø–rÐò=ƒ€ë§ö¼:wú¤é–Ÿ.j\¢èh¿ïÂöÛŽÓÿ,úìr‹›—Á¤X'GÎñ“ºêjsù¾Þ¦7²ü¶K©k WJº¨¹«Šp9]¿â@¢»¥·Bn\ßß·ÌÛë!¨¦ÐøASñ2 ¶ ~$Š¸w À+ï`lUkų*Ï°7zœvh¦ÊZEV¼Sqça'…€PªT¾î¾H b×úå+Wì’æÌa±×®œÚ´ý<“.¬zícWß{ûYïèjaEQ56±‰aáÚÖW_…çrˆ–Í™:ѱËÎ;6÷½Â~í›më·|õÃ-]ÔQv—Ø+ºx딂ø0©žêÓüí1\ñî¬/L@™i=©ý€ãxa§gO.þ³Þ@Vj|R”íÞ¾á‹ûŠk¼ë€±‰Îmk×.uáãò«¾Í¹é‘~Ìw—~yÍ=U”œØ1æ¤%;Š<Ï{v׫›N{–tœ[óŶ2ËÐßE{k2õÊg!JÏe­[»áøu áÃ[—Ý>¸ïx©ûŠ tÛŠ57£Ü΂ï>ûôóì‹Å ÿÊ ]“&@08u'à76hš€" wQ(šÕ=DûdJ@J˜GL}z×ü%ÃrÆJ)=¶uÍæ#‰3>Lõ†-xzÝà¥ÏO>=º_¤Ø¹zõQ½íÜç†û€Ô¥^ý)uoG1 úõûw~¶Á”zßÀcS&¿½fÌCùK¾qxë§Y¹½ÎJíg©{¡úA·âÅdPËJôñ¶ŒŒ1Ž“K^_XdèŸÒÓ¯fÈ0¨–oFê8̉¼¯°xÌöfa}6Ú(pXO SGL…ìuØšƒä©Èè™3‘ö¥ãè$™±ìMh˜3¯ÖUȷμ¹daLjŸÒÇßXµä7>ðÒ¢ÍûCÊÐÌñ™¶kû>ܘÛ:0¤@z*À~ãžï³çÉg§ ÿH”zþóþQhÎ\1·—{ªÑßt`qæ¨ÝãÒÛã«OV+‰x|å3a ù˜ìY;7uÖn&§÷o]׫W$Ušîúþ·fÏ>6scj‡kú3ÓVfÌ›ÿè{33¢,e»×}”]2}Ñ8 ü§÷žš»÷á廵êа³Fjº»7Lú:|Ë ­Ø˜Ü!ÓÄ»„ë£.\¸°±N`d×äÄ(ƒ£àðÁœ›¦¨áÍž7¦‡&¥Ƥa÷ÅkyGrN^Žè=dò´Y÷öl @C@p»I]#Ã|=O¤™C"’¢} àÓFžÉÍ=t¢¸Çд¸nƒÓ:…ºŠ/:tô–_TæÃÓgNæ ˆþ¶º&Dz+"Ÿ€Ð˜I[™-²_Qáå#ÙyQÓ£,>Ám{÷NŽoiª½¡ÅõC'Îîdžp¶Æâ0# ßíC^ &܃°D¼õ*ô³øz”HLyËž…ɾ˜0!FýÏ mÞX…þ6ÏÝGÕª5CH˜ïùƒûÈ´i••…”Ò`‰ëŸï¯Ý:ùÓOEZÔØ'æ>r_rt‡ø„¸pÒh‰HKN²øáTÎüB=ièÄg>ç«ÈýüC\:cté¹C_ KöØœ?ê,%„lZ~*çÈѳ®¾ƒ“ý5?[DB÷ÎíÍ&OšZÄtè’@1Y[ÅõîÛ=1ÌW…OtÆAZùéãGóÎEô:iꌑýb…”Ba åe"²gJLpÃÞ.ty…{K¶êÂ'ÊØ6Å"ªÝûR¥ø¯µÁy¢ABz÷¬@¢25¤¬ ÷ UV\aì}qµ×qlÖð¥3×¾©Öj¿ªï°z[x×V­ÝËlšØýõ ‡×ÿå骬ÙZUÛ°Ö›¯hp÷ÓV[¡÷“îjþ×< ‹Ã_¼³Ûïž?¥Æ6ðÍÒ%Wœç^;óŒÁ\:>ðåŽZ¼]ULÍ:mšÄÇk‰[´7àÙUDÍ®Q󪉊ý¹Þ…jN÷Nµ©«bµ;/*Žˆ•Ï빨¶úlÕ×Zýg•|©c­B8Š¶­ú»vÏ#mÔ:_¨s!QOüR›Ö׆u­¬îëko祬ÍßžüxK4ø! aÖ­28øfXÇ– .8M.¥™ |7Ÿ¡;¢´èš1;%8ô?8:à(-.)µÿ/ËcÅÚqÂô.¡6sí“Å×ÞP|5ÿG£æøŠ`H—*šueÓTN¦èÿqì®v6Ùì÷£Ú̓ʶû*Ȧù‰YŒ"j˜ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ 1nˆˆqCDĸ!"Æ ㆈ7Dĸ!"bÜㆈˆqCDŒ"bÜ1nˆˆqCDĸ!"Æ 1nˆˆ7Dĸ!"bÜㆈ7DDŒ"bÜ1nˆˆqCDŒ""Æ 1nˆˆ7Dĸ!"Æ ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ 1nˆˆqCDĸ!"Æ ㆈ7Dĸ!"bÜㆈˆqCDŒ"bÜ1nˆˆqCDĸ!"Æ 1nˆˆ7Dĸ!"bÜㆈ7DDŒ"bÜ1nˆˆqCDŒ""Æ 1nˆˆ7Dĸ!"Æ ㆈ7DDŒ"bÜㆈˆqCDŒ""Æ 1nˆˆqCDô_ð/5‹¼>FZIEND®B`‚suricata-3.2.1/doc/userguide/rules/payload-keywords/rpc.png0000644000000000000000000005745313051004444020713 00000000000000‰PNG  IHDRzeÌ5¿=sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ*«.è” IDATxÚì]u@UK·ÿÍ>}Ýb (‚Jˆ¤Ø‰-v·×îî¸v\ëÚ}íîî¸^»TJòÀ©½Þ瀀 xë}ß{gýgÏž=±fÍšU3ÈF0‚ŒðÏgDŒ`#»1‚Œ`d7F0‚Œ`d7F0‚ŒìÆF0‚‘ÝÁF0‚‘ÝÁF0²#ÁF0²#ÁFvc#ÁÈnŒ`#ÁÈnŒ`#ÙŒ`#ÙŒ`#»1‚Œ`d7F0‚ŒðßÂn¾œÐõ¯œÕE…ü.ÒÙíüÖ±b_Þåä£"CFEBSAorWóû?rW–»½E°"Õõ׆æ? ú1ö„‡^åwÑ1UÐ\ú¦WþÆØ΂©"æþ÷Ù c¯¶9Uxœ¤b¬¨ß¨ã^¾ŠIþsÕi»7që1ÿ+ šÓcîMéݲf ϪÕÜ=kLZwRÉ3Æ2úû{W©š<ÚOgŒ=ÙØ¿\•zW>3Æ`Œ)4w/Óyé”cƒËVpÍÎ^­ª›þ‡k ŸNŸ‰]Ü<Þí«2«¹{ÞŠÕ0–ØÁÍ͵š{u¸W­æÙaà̱ `Œ­ضBU¿½/•,Œ±µMZíŠÎrh´•Ê7ßHbÙÄÀXæ຾-¦nbEÆØ©5#]«y,=ÿ6wÉ'º¹/<ÏS}ÜW³Rå|q­PvÚ¹Ì7ëšUüò&§ûU":NÖû—˜aò N~½dTgŸZžÕªVsw¯5hζ$ ccê:–›þà ªÁXÌ­/Ç1FD@Vòû=Ë'Ô¨QÅÕÕ­šO×áso÷'£–Ž{Ùvb×þ{w/5H5±Ûh]Р ý=Hçöè@,Ià§|fI#+žÀ‰„b©¥MÅͶڋt¹" ¦03¯Ûwö’Ö5U:õçeZG5{¼ëú¯å‰\aiŠùQ|.¬u`ЮDa®q_æYúÕgdkûíÔɵZ3=:™©©B*.:E™™©bãПê^ÛUYh¨K¤03•0&– -§žº\×\•gœEbÿŽûí `нïÔÐsÞµÁ5%'ø5sÒ-¡°IÀÖôou¸ØèË7¦uk8~ñ®YÃ;¶2&ã×¹ÝÀ¦æ2AžO9¡ØÌÌL¨çýÊ{]›÷ˆWÔœ³ù”«ƒL—•¼söÀ¾mw„Ù3½¹N(1³(ñôÄ™Ä1‘ÖŒFŒ1¤_>ÿ{133±€à8±Lhóóés5Mò£ñ$«03·ãÞÌš´vã¬nDú¡a&fæHåò2ÞÍv/ÃòvV 6ûž°ûë& <öáÈÖU !Ë_1>+nPëö1%ÝÜ,L¤BNŸÈ6‹úåÚg+;­L¢OÔ~ºÙ®åy½†å-HþŽÑåþĪróè–™S&MžµkÛ§ø¼lVýùi£ºÍ·ßŽ+çRæóÝ#MµÿCɼüýìží›—yfi&³®àÁDdfU½š{n®I9Ÿnè›.þÁ¾£WtÀÞ\\ÓtÀ¼­“¥rbëfÏR ŸÜ¾zzíÜ ‹®eÕ ’|<Ý& Ù“T–‡ãˆK”´Û²ùA–šgŒàÚµc«AV丂¸*cŒ‘¼ìÂS-í±û܉®#ŽöYµ¬š%ð}’À Ùr£À õS•1^`½|I§³s¦\NÎ_1Ðs'Ë÷‘• +ódÁÆ×ÙæOiÀÐj§ÏëûjÏÊÑÚ»%þ€ýé«â“'5¯½ìà}‹â¥ÍèÃŒîa«Î½À¥Ý?xè·Ñ]K*Ô®ën³}Æ ±Ç£A™ò™›'ω×3†{'Ÿ¹r×J!-°B".bΞ9ÜÏo™]ݧþ¢í§ßǧÔ@‡*¥•9§áuŒ1°ðlسyÝœÙÇåí¡P/Ÿ1¨?¼8§îÚ±D9cNÖ+Ê,1zӣφÕ1Såï_÷öºE*2¨n«Ÿ Ðå‘–DšM'õ¯º¸ûmfƸÆ«¨CC2»rý"u^ÍSÜ~Po[±†Ïe¬q¨Ý°W˜+ ý»lr?¨Liµõú¯PÍÙ @€5µu]º:Ø,W–+‹ú}¬0ðúŠŽ€v‡×3rϾ¥-8‘qO—ì_g)ø,GÅ ±‹W£ÁÙêÕwàÈêåváKæŽòЮ]½V¡m²S ³vX7¹7ÇX«ÜåퟻW±±{.¡Û~òø^-GôˆX§PŠJî½ð°y€kÎ>?¶®Ë½_PÌk"zÌjPJ?ŠÒ g´Ù1xäx»àá]Üm-Ú~{¢ñê:us98­´\Ôò a‚ü$ÎåŠ~Ý1¿…¦†¼¼FäÚ·sÝós~š¾wÍXAže x¿éô}ûÕ¿VR7|ÆÁy™–I9üYšt%šMèqzVÏþþWZ楑\»°gçõ¢/”¦1«½~IOIËV¦{vžÖ·~;  Bì½¹'/ô ,Íq>úiÀös–êšÄë»áüôð%}ûØ Û¹ò9Ê×ÀùËÇYŠ 6©2s«×mcXgMz̪©cZ-™lãâ;uÚÄêÅe¹†^6dþœÆQ£Bɵ0ùõÀåökK@zŠˆðÛ°È‹’ùiÕéz>‘ú9–4º¥‹ëµŒ/ ZV¥Ž]Öõ›QÓVO.!M‚f­›û.E]ÞB¬I‰=þ6utÃÀu‹ç~A£T5£[gSáqGkºaaGÑwDÏ ßŽ£œV·]|øÁ”&UóbK|~)**êKf^U!dÔ˜(÷¢Q+Tó,RÎÝ„²:¡µ¶¯Y¿óí§,N÷ZÀ‹µyØjÊ¡Ó‰%êñ§ŽÖð¸ V<ãíI%Z€×JƒLEÙœ˜r´ž¢ôêãíGÏž†U^æâPL–à ìK×6!µq—swb>åÁQé×ϵ¸yýÈä9·Íè>cr‰aSç´õu`[Þ32´z.–Î;—ÌÍ<“!$•V—úTÃCÀŠÔV&0mм¥™€ÿ¢.›:gHWæõöœÅ`‰HÀ*ûÖß°s@ñÜ<—ÐâÐ!ý—ß0À3wc´›&m±oÕÝ]!MÚ8ùvB¦Ÿ½ô¯˜@»ݲ5rÁÑgS¹ä‘º4‚ÚMZW”}Ñu5BGAÑ –—¨ç—¸fÑŒw‰ÉžRß©´e²ud W_K?0³7CÆg ¶r /iuâìÑ(ßvÐ>8~Q4öªÇâÈÇèsäWƉÌJ ˜»¹Û“£ûMX·5lÉð ÜCoU©Þ¥‹5îß>;yôŠ3ëÆü§Ùý¢qÇa(—8Y£Õð+M†èGU ìÉ©_FÌØü!]Ò~ô”«S=$bc_Ä Æ(åá©eçbÆôï¬_–Ô€G§öó†¾É‚â[’™¬x™2ɶç[ÕjÉô%XìÑ}OMŠOð´ÎÝ®B3[®åу»7§Û_ÑHúû¦'>kd=¯!Ë· ÿ/DäþX c¼N/Kf>Yø¼H”ÇE&iÔ5àéÊY/³Ûæž¼éaAZ!Óòº|ÄÇ™™‰5Ú·†×ï¹/5ní]ÛþÁŠÕ½ÁüâÒ§ŸøìuOüìÁÁ4º<Щ|]òp:SiìîYÓ÷?Nƒ@Æ8€ã+·dVr/ H‚BlÅËnjոEöó+IDÖU"»ûÙÎ7MËØwã=À˜â{.i=×l6¸² aÂ’ÃùV*Æõ’uƒ~_6ýPŠž—d혷§Xç±.&B…B¡P(ä2±³[}+³äÓ'e»W%_õãû܃1€[ôSêñ›> s¬EDšêü.È…L£Ñ‰9H}tdןÉÏë)m~eÁèk±Šúõ+åYË"‰Ârão1|÷û^“]¼q|p3/‰X–Ýìž™)>ï_±få…hÀ„cœ¸·}w‚ƒCùïrgõÂEQ »f·3Qg(÷é¹M½gm¬Þ¤oó<£+0-ÖÁÅjíâÕ¶å[Ú)¾V7™LñçÐȈ&µ§ ùµ_¿­0—¶.*P´)ÊÐä" GÉäùT8ǾòÓË9‚DþDõwH7»r^nÎVÃÚ5ñ,gûàyüÜ™#~ï;¹K—ÁÓ†ÖÑêjD•šÏŒ8ݳShP…ŠåâŸÜWZ{-Ýé €×iµÚl‚ãĵ˕˜±}FäÍs—¯q2Ïn†¹ÇÈ Ûɽº¤‚Ž Vœï¸0lóïEN§Õä5]xRe¼÷óËËÈY·¹»øXh5a¶ˆ1‰Ã²UÝê4½,¸v_/ ^§ÕéøœQ:·è¶ÿçCñ•‰´÷7mþd»¥CŃ10“b\¬æ:2¨ÉV÷`ÇlÿÝór¢AMCgT§°ÁäyF›‹µØÔÓÏ{Ȳ‹Å|ôðiÖÐ:~"–Ç€Y9xàê)íry4:*˜T‚;4^rlRÝVÝ«˜¥½R;m™R?¢Ç†žShQ=6—W•x­FOŒÚ(|⺠& çº~ÛE¬ÞÜ=ÈŽte˜:‰ˆ9G.Ÿød¤Ö[˜ŒTºzujdˆì¢~ZjÉ@ZÍW'^«Õ’{î]6,â‡/Z±e*/5%eº‰}ißÖsfö Ó{«ôM'¶ÙlAýeQK:ééX«Ñê™Às¢ôž~~¼hô‰?wPƒÂý1†Ïõ‘E5Z t[×ün¢ÁÀ¨Óñ1wøùÉó ¯˜{ô°ö<"^§Õê Y]ØÛ s{L9Æqû5:$b ¯s¼šE.ÐHEiéx·0ôØ Ö®^Ãâ'Ý&ÙŒÍk²B@eêv]5¦ýŸ—Ö~„WÀx­*3KC€H"—ˆ˜J™¡Ö1¹\¬ÌTËr>þ€×ff©tuÁŽår‘D*ðiJ¡ÜD’ËùÇë4ÊL•Tn"ä …óZu–JÃL(KÄ"–YÈëÔÊLÜDÆ€.#-Kjª—mxešR(—‹éÔ™ê‚" $2ia¾)^™®JåbƒöDÓfedjx±ÜT‘*+S£+@N”*9ã Seejy…\V ~tÚ¬Ì,m>ï†B&ÈÈPåÕè™HÄåc[œP,ÿ‘hÒ¿d*À % “/B»Dnx05ån”L.üj¾åÑ0˜@¤0¤c äŠ/B¼©‰8çP"Ë©Y$×çá³2‘…{ø˜D*ƒØªR…Rb¡4—”[¨/ç•á{ƈ¥rq>9ÙÄ4?BÅR“‡Cnb’_‘“+ …ˆe¹ËgŒ‰$¦†ŽIM *–ËõéR…â‡4)Hb"fy°$™dã¾üþ–Iü«îçɼ¨`9Ãjš ±ÜTœÍ;²tqFI/¯âfß9`…;o¿v2ÀÂ¥ryS…Bô¥ÂÔô+fš zƒP,Š tsq®Á(LsðÏɳ{Èb“‚¨á›+<'31Éÿ ”*L dË$2ùwc©Iá™B©IA„obúçùÈ?b*þV«ÓMgåœgŒqþVØûÿ-`ŒØ4õÔïi¼+ÝlN_Ÿÿ¨¦~¸¹|ð¸o³JMݽZ!ø[K'"ØŒ™3î»âп×ßÔÇ#&¯ƒà+P§öŠœØÒËòÿ,MÑsûI™‘\&þà ? YÊ4u¡©™BüÕT&3#S#’Èeá [øǀפ¤gÔCIMeâÿ³ÇÂü·³#Áÿ5ðgøèž®‚¿R¾>w£à¬…e(ð8"8Œ`#üïJ7°]Ãœ¨#%Å"¼Cwß2e%Çøebý‹÷oct)‰ÉÎ&6u’èZUúÝc›š‡ž[wd§‡¹ w¶L0goÙð¶m¢eBíË›'ZÔöë0eÉȦ‡±@?ñXÂÕÍõÆ<½xvªì_ŸóôOlªûNÅ,õññºÝN^¸2ÏÄ8™Œð7³ƘöåÂeÇ»o¹' I}“Zº´CÂû˜t ÉÌlmL2’>|JΈŽ%ìE €‘&ýÃÇ„, ω¤6ö&bN/j$ÇÅ&¥«„2³ö¦ïÞ~°-^R!æ’¢_§IìœìL˜@Á˜Ì`V2™Xª×ªl+Õ ­™3Çš4­Z߻Ú? ­%fñ(íâ¦Ð+I Gd{Yñû±QÕÓß\´âhèèu“Úxãf­ÂËôî6oQãF¿VÊå# Uê«Ød'§bI±±ijXfV¬˜@´ Ÿ>¦)ÕàDæÖvV¦ꔘ÷f%ÌÕï?¥XÉe—î?2‘ño^½)^ª´\ó6ÍÄÙŽ‹~§ƒÐÒÎÑR!ˆ‰NÍÒÉL­‹Ù™d.uƧO ™'”XÛ9˜JÒÞÆkm‹›fÅ~úÌ3¡¥]1K…8[ÌüýQeå ψMP–tr ¯Jûð)Q¥åÅr3GΰW‘:ãÃÇx•–L­‹Y‹’_Ç Ë8Ù¨?G¿O7-[Ò°-*ùÓ›²sr€&ãÃÇ„LN$5)VÌNh8ýB“ðñSj¦šqBSKs¹&%áæ½Ûr©öÍë·Å‹;YŠÊ#».ùÚ­[Wý>O§š¶_׫ªðe©pÇ´;‡.=ëØ¡ÕÎ3o[9Ù¾E0kÓäP.ëiçz=_)½ª8Fß¿ò!³Ìòã[\etwÕÀ>ën—t÷6ýtÇÂÕÿê©‹s·ðs–nîÝ|—ûŒ‹Óë d¥¦/Ÿ` X74wú*XÀDNV .#1ÅȽ<-Nþñ ¨~ÿè" yôkãap„3àÚmé¹öº|Ç”±ØÓ-Ú-o]QòÄÆÏËAµãàéZ‘ãæö °a|Çugߺy×Q¿{ðä³`üê_Ãœ-âÎŽmõ›o½ôͯÍ*ô¯ïwðâ=>C¶uãÖ–#Æ8^ÔbCÅ–¦×Ík„Þ;°ë•ûĪow¤z»^í:ûxäâ­ªÚiC£šÝù ®æQáíý{éVwo_n)`·¶ô}'ÜE}­š¿Âõ=§^X/>±Ý[‘G|y¶h¯«Mñ݋ןÒrÕÉgÿJìáã;t៚ º¼v`U·úW3ôOOWò˜û ˆxÃWic‚Ü.|@D«[¸Õ~±H½|»ßÝÃ;j¡mÉg'Wñlýš(ýüWÏæ7’ ¹NNk\­þôL¢ÇzÔp÷ÝöÐЈ³kûÖm8C„¤Ó}ªWö9MDD)Çý«¸6œu•ˆˆtKš×n·ê ©^ï:hÖ{C©Iƒ}]ŸŽ'¢ ËšûÖô¿gx1¥kVCvèò¶ôáöÞ5êœx£Ö?.é^¿÷J¾’oàï¾üT Åí\Ù§ÓKý ÍÛÎ>Õš­ ¢Ç¿´¬Òr}Ni¿Ž r‘ˆvOjÐv¶aÈ4ÑíCÝÇoÁ«Þ4­áº-Úùñé_ænºKD÷÷ ÷ §ÖÕ—Á2‚ €Œ*V~~¦Q·+î ƒµ€ñ"ó6>öœ'z{rì-Ì4:•F ÇbHŽ]½ÿF›[¡ið IDATÚeMÍ,: 3þzògµw¸A¯iܬù‹õÛD¬J–µÊ+¦ä~ººdhÃ5bÀ–ôIh^¼ïâÅÞr½M Œ!ýctŒ¹LKÐf&íùyÒq涭ge@“¬$S;Ó"ö’8y·ú.z•Ë<0ÒYÙæøk²Üy×.À¿¦¹ÁFâÕÝtÇÜ[Ê1å•´VDÃ6Ž'èÔ€~ײÊ.8¨„þd—2Zi‹¶zMssÀÁ„ âÒÍfÏL~ÿüÉõ„$ Ì-Ù£—ŸdètÖõ«ÚôF·òîî_Öè"%yBàH£ðóuÒÂÆ\¿ö¦ÚÜæŸy"ŽYW³vxp÷ ‚›:ñƱv`ýv{a©Mm;_ýFÿ?Ÿ>úÄuüURbO ’ê¥]n]?ÊZu²·“íûùŸ!,ÍÍ+u«¨ï¯–×o¶ý?‰ž4¿¦Li³²HÇ›˜šæ:ˆ„“p,ç¬V‰@˜Í" [£¬¼Ûþ¶¾Ø„1?ÕŸ¡³0·¨ÖpÐüa:õg•ÖÜJ¡?á ; ýFß…êGÏiꞥ#þéÖà>fïÝá ¢l‹5'¤³ G>p@ ­äÛúÀ¼VŽr (QL÷è5P-¿Ý›dïˆ,Ä‚lV§0“e}LÕ¤'ë,˘Ð_7 XKEÉ i(¹C¡†a±\dÀ8EξìÿÚè=ÍÚÎâˇE†V55¥j8ÊÞ] kgIv^s¹X¥MøGdY­NI)dòrT£3Ù¯tCÅ€IÖYØZÎóRÖ¸ò wdr¼Z3­e½ì,:­Æ¼Z9pfK¶l[:e|³&kÌÌLʬX3ÁÒ8ŒðšŠÿC¾sfW±îʽuµiq·¯›1mÌDsë1õäBN©Ô¦•&UÉŠvƒPnª°°’˜ï€ÉÍÎMí=ÁkÏLËìC×tÖlѾÁ.\^]ŒÁ­qˆpúÊßSšº™Ì­ÆXú¯Ë·ùEõ(“o¿¯SjùlïnzZ–ÄÚDh¡àÒ23 þ^“¢ÖÊÍdÉ`?à Ò,ï?W8üø´Hýó›•ã£sŠLý¤Ä©JµX ûV”³Pè2‚v=윰sªÌVjtRN{Y.×–N¥ß¶gfÁeV^}{²[þDe‡,Ø:„”ÏîßÙºrzÃÖ‹OïhœBF(:üX˜ŸP& ÉɉE½€±g—w¯Þó€ÐÔÎ+´E'ÇØØR“Òf¦š?n}dc¸|ñbö9+¤V¦gdi¿ËôˆÐ¤ÿ$Ó¤ ËöÝe¹Î ÑêçUn“1*Õéegž>iÚŠ”,¾&>ëóŽá­ìº-úê8¦ËØs+FÏD”7ö¿• .Ë…‡;¿¿þào˜ª/ŽmIµ ®iV2Æk‹Ìot‰Y"G'ýÁ·Hðë®2ᘎûtäIª)<|ûÈÚÚSXØf"P²zu«ó+óÙ¶C;ö¼JTÂ@OËè»/Rõý¡ë&èy»ÂÚ”¥¼Ï2pOwn'¬ýýí.,Ùž=º3û÷ýñQ­M¼÷óªcjLîâî×6²bnΧ']s7Î(#ü]Ò Aní)—Üû([Ä(kQæÒiÝΞò«U¡Xܳë§ï5º1ä¢H÷â ¦t‹ÿ=BøâÔG‘oØf©ÝؽÑױDŽ|ã³qÛ0Ú§Áèá^§ÂlØ·3 ,ÊlÛ¼ S»~ þfeni"Ò%%ÅÅf•Z¿ëç’_e –s¿ö‹:S§F1ͱÃÇj´ø©€æ³;mØ®QËÁ©O¯Ÿ¹õjòÚE¦€2o]V–¥²ROŽ6,¤ûœÚßG´{w×&s'Jyj™xëœÒklÇY;¦oôœQ#”õ›ÕªzpÝÄÛÇNÜÆÌS] ݺÈ`}~úioÛIÍ“ÎÕusxtñصwöÛ´P®Ï4ï]­š´÷÷®øðŠ Ëã*°õëí0«ïàÉv=Ì7¯>dS³t:­†Lý¥éÐ&QWC=K¿¸ròâsÙêSÍ8Eñë{û?µÅßË“}~qììM÷[ìTë²Pí1x¨_‡Émj˜­7Fø&Mšô¦bˆªÈnNß×£}€'RØ{º»Ê…¡HRÖ­jYG+àr»RÕ]+™—¬Õ¨–œ#ž9¸x˜4ÓßIBŒ«Ñγ¤L£áKû´Úºâšmg¶lWÂB bÅ*»»9`ˆd•ªW/kkj˜aÓòÁ%-yUš¤‚³-cL$2s«áQ¢ ÕˆHhR"²C;·ÒÅìK”q©ܸìÉýJ˜ ŽñH}ºrç™;wºŠ““yßQC»† ˆ®v£–•íM32Õ6e«÷>ůŒ9Æ å¶=\KpˆË»9šIŽU=ÝmB¹­‹‡kIý}"B‘©[ w±ÞÌ$²q©îZÒʼJCïòÖêL•m…:ã´(_ÙWaÂ,]dÑ~ݹ¸eÜ»–Ξ}Ç«]Lœo7;ã„掕ªW.ÆÀ’ØVêÒ&È”©µLRÑ·Ñ”YÃJI bfáë[ÊDB‰YDÏ‘Áºã›î—ìÓ¦¦H^<ا Ÿ‘˜œ)ê0r\@I™£‹k9K‘¹S—öáVB†„ej„Ÿ1º¢)˜@Ñ¢Eƒbær1»²‘=†õv&"ë’•KZÊL,ªzT/f*0Î(#|Sbù1O8¥÷ vt*1“úשÎî[ôê[ýcôÙ_¼Ÿ'iÿ#œuïöWó Ÿù¿ÛŠ K{uÜùO”üjg{·&Ë.k#ü‡;ÂÁˆÀ“&ô ™Ô¿_À!þTÜ<1N(ysnÐÌ ûCê9±è㧯8·^]ÖRðï‡áÁFøÏT¦ ÆF…“W }êõ‡*%LÿT¥Œˆ•ôiîQ’Tj‰¥S“ÎÆ·pcÿ1‡qrÛÕÝ"îµË®Õ+ÚþE+ì+{Vq4rv#üÛTm<ÁF0¿œF0‚þþ¿èeÒƒå{µ‹Š´È«iÞžXy–õé*¤O›—¬Ñµ»ÕÍ’Kuoü/žã«%|~[.‚J`r÷<éwOàÈh¥o ogC` c8¾×Ch‰Èî(g’®ÂŽ_ñ$¦Åѱ;l³#¦)k· :ŽÕúç¼#î½g†f]àj]À¼ ¦Á©>Z„“û±í&Œ„Œûëx Æ^Þ8|æ¾ÚÖ·gÓ*ÿY$¤NÞ´m[@+wg³¿ÒÉæx T±Ç}—”ibS"¤^˜­ŒXÜÓûn¿Îu°.# N§Î.2Xò‹G.ýžÉ¤®Þ¡^ì á éÑÇŽ_ˆNÊ”[  +i.ü;O÷þa±©ŠW“7š|ÉÊ ?¹Ï""zÞÄ­öY%=_Ò®vÿÅÿjÛ4´¼;鯅Wà¾Þ„$4÷†áåä H(&èdöÏ'H"!€˜ Å*‰ˆ”È„û’îB§T Õ€¡}íþÈ©ÙàtL‰'e9ºo¢¤O¤ÒÒyžt*ú”H'l)%“â“©®Jž§ofS u­×¼÷ÔÕ׿ëÛ44ä_¦ô7au}ÖŸyÿWÊà‰4±µ:ÅýÝ}QÅݯW³FHƒ¶ƒ‡lÖ0ĵN÷—j"¢7§7÷é?pPôjãY½Þùt"¢ç‡ç¹zúµë=¤O—6µ½jo{OD™q÷C|½B›¶2lpË&aU}ZÜMû;±øì&‡H²7þòß'‡BÒ¿~YH2ñÄìŽÏÞ‚Ìçjåy(Ýð…°›Ø6A÷‰b·t¹*wkùQP´YUPËùü…ì«GuD,»á‰Rž˜JЫdúp›LA¦å(CC/×@¨ARéò&€\ºïE9·¥O‰´  ¶ŽˆhU Ôy!%|¤Ve þ׈ˆ6Œ$€ìÛRR*ÝßC"eíüÍ®²u$ÈÔ–¤Ú~ûË«»»ˆI¨˜AHŽög*Qù:\i’âÛº»­ýXH&þ«ç¼îëáù‚7¦F´<ÏPÏó<å!&»‰)¬'ù¨¯ÐÍñIg}kôVR6“r?äÑdaºþA—6¨™g×YW¿úN³²[ƒ> ÑÇNÞUg_þ¬ñäÈìY›oÑÞÕ½úíÊnŠfz‡š†Ÿæ ˜ûÿ<»!¢=ªÕê¹'§»q'–«üFI“:U‹¼{pÏ.:µ «íÕoò–T">ãC¨o•q³ÖuéбSÇ6þþASלÖèF“¶jJß:>>aáaµjÕ¾ä7}™onì‰jZ/4°vÝæ=OÍðØÄ… ¦ßShf[hèU""M£çïN版´1—Ftjä['4"Ø?"²Ï‘Iú3U~ªî0ónŽt³`éÚ¨†á¡!þ5|Bçlº¤#Ò<üÕÙ-ðy’ÊÐÑ£ýj ÐÇý¶h°o5·°zõÛö›}í@Ï2uç&>:Z?<Ð×' AÃ&ËžêèæÄ’~=/¬ìå[Ë}Þá8žÏ\?c@]oï°ððZµ‡,Ø¡#"žT‰ÏÇôhZ«v`£†{MÞÚ-²V—é—òÍúOÏîÿþ^™Ãœ¦ö n?b¿./sJøcgÍÚ­Ÿ¦)/«2ò+Ç+S’3µ9Ìlå`¿ˆ!ÇuDDÚÅANUú¥¢öø×ò¿™hhÎÚqí›v_®%š3(¬vPãwYúCf^4¨ã¹èÐ+ÊŒkV¿ŽO«Ñú^%ßÚZÓ7øzL:Å]›Y·vÛ'úYW"*U_úBG¤êÒg_¼¾º×{†ú¶]ND¿u­>í˜Ah|°Á/¢gœN÷SÇ€¡«óÅõ«è³æ÷,"¢¤Áþ>«N='͇Ž¾>]Ñ—r~É`ïúíRÔ:"í½¿{’l`7Á5 ÔëAÏ~›éáWÿQ’Jûx{UŸ/?ØMÚÉŸÊÐe]›æêv,ˆ(ùþΚ^îÍWQêýyž5z§„ŠyU«yµ›rÊ ÜÞèÓêž_ªo5¬\}Á#˜ÛÒ?d þ“ØC#|<Ýûÿ|·`!C¯#d-ΖþùùCÇïÅüEvÃýAÊÞÅ×^AçÏßvýüƒÀ=HkWº^1 ˆ&Å«[ØÜûã&8€´¡áõ8™{VÌJ;ú4€u¡'.n­À!-5%¹Ö,¥¼w'à8¡ æú9}m¥›Ï=¿©'ŽÃç?nƈݢÎî_fÃXhùò¯?Æ€øSÇEê´pâ= ðÇ7Ýõo\3íùY¼¶AP ýM =ZÖÍÔÀ#qvjYN "m§4)®Ò_Ô}-c¶=‹ó¨ÛÐß  ðŠ@ô¸ö+ÔJƒƒïäq„7ÀݼGw@Õ ˜Ýzá·=X< Ñ)põ^¼€‡å·¢³R@”}ï£þŽ× ÔY`8‚Pýå·)*¨ 0œ²d_¡˜–nøa(F¼ 0Æ7Ĩyè€G !ïxVeàãŠI3±~ ZVÏßÂm1rŒ‡kM8YÀ¦çxþ “=ò[€¢­"ôGÀþ¾ïÐgç 㶮G-ú‰]8vC @M€NÏŽŸˆ/V|L‹Êú<­çþ$¾vþR&N­³6" @»wæ&Û®3ƒ‹ës•êÖ¿å«_¦ À¾iuGˆL--’ß¼èÚ¦Cºê5»ºJ@Ë*»víméí”ðøök ç})ýûÙ¾y}6N ª…6©SÁ<›tM;¶·ˆ¨|“H§”ø/R…L ãÛnÙG„[DæU[öd<µ†xÃ=¾Ä©uÖÃFë‰ÊÔmàÉK;Ý„HOMÉ@ÅÚΙwïÄÊˇV8Î B±\íYa†[ƒ2:*²§E«YƒkH¾ÜbÂXì±Uûu•†×¶ÀÇ&i”—6.zá¶v×áS¿-WœØjÒéj<°tHpHxÿEWÃû 0×K$¬\@ƒ°jŽ1næÊÓ´”¹öebMÒïcºöIQ¥|1‘{›&s \Ÿy‹gÌ\TÙ}nµš¾uü[·ml)@ß·ü1fr½j®Å*{ù×öoÔ2²r1YP÷Q㨎^zVÊ}B½âÑýî>ï^G¾ã™¦m_×Ï©‡xÞÌÂúÀA'[^Ëì}bºBf!dLòK ·bü>¾àž~ªxå=‰ÜzŠV…  ä‘ªÁ»àWÙÀ£‚›#8ÛåäTþûè+ ç†fL„Ðß!«Ñ:oà2&bèÝBÎÞέÈ>‡Ç & „+˜¾³‡£œ?Üñ{,ìóº],\påw€5=¿?…>]á£ç7 ‰Že ïoen­gìo?¥!%ºyýzrL“¬ûp-µÊ~É“ eb»† ˜>§ýLñWÞÂඎ†pöô{ï‘´o|ƒ#Bý9#ꌔt¥,E €˜YIQöáŒã@:žÅ*-LK®|³´wð25ŒÕ®€ãøH¿ø&³Iqiz ÞÞÆ!›*¬Ë˜©ŸÇeÁ"?kÀÀ?ÿ¤u¨b©Ÿê p ,M» brëâbÃgº´ÇcŽ¸-q­à(qï“efD@ÂëDIõÒf0ôE*7—ò»õXÒ“SC†Œµ9wXƒ/·ÅÃÖƒÇ\j3î‘pÈ´ ]ÚÇD`V“lØ~îÃñ!®Qäȵ‘#‘ðâê˜Aƒ£ÞÍ\7:H€ï͈È^}àhþÇS',<96çtZÒdfÏ?^©&±P?vL§UgÏL­RÍd"à7õîvÍaÔå­môßN¨ø`_9äçM!Ð%ŸÙ³yɺEkOÇ\ÿµ/'/7jѦQàœÛ·lÕú¨§ŽÛlãѤâÇ}3´7^¼õê_ÙÖª}ìò³éílâxyåŠVøCÈ Õé çdh”†»ÖEŽçµ0ì FVjØŸ ŒŠó &9Û³ ƒA,€”L½ÿê,¨´É!-Ú>F«Ò`Àû$ÃcJ< Dy9žYÀ“ tYPiÊJPNˆXày <Ì¡Š”€-ìOÀGHøD!Àaò.Lή®Z)@óüú/²_a«Ð×ù rôær¦JÅ©}¥Ã»V}£\‰H(6wÚwh³4ß‹GX¶H!0ÃuÀ’•M\ò庛#‡æ¹„ÓèÔú¡l>"ŠÀKW:\†+`ça™:]61ëTZ¦ä—mtZž˜XÈ´º/lA®* {ÙEðÛzw9oÚÿÚYÃÑÑóVº¯'5Ÿ¥_]¯Ó辺ë—cÊ·Ç:tëÞ{õÌ(Ï<-g½¼z%¡ÕQÿœ¤²­X¬Â𑘹±€ÀÆpâgŒ‡ûÑ¿}tgÏàuÚ·ƒJªWvLŠ‹ÿÅg_*˜úâu\¾<•Ë—HMMzŸ¢ÉΓöìŇ¯J2­ï+½ùÛÍœ‘J‰‹ŽÏ¢opFoW›o>¦3cÚu½ÚÝv¥Tñr(Ÿ=IÓ« @æ^}a¥†Qb‚§1¯õu!ýé½L…Ÿ³ „ây¯7‘áñ•·œ#°ê%…o_ÇA¿Í;wEs†ä Û˜vë½Ø§Q ÃSÂáƒïÄ`«–ÒÞ9óúÃù·b3óS)˜êãýÈNãšNÝ93Ê3[¢úªÛ¿>–z‡;|Iqn©øýäE•AtK{y:]W®’•n~˨_Ö ás´&BÁßv“ånÑd 2‘üç/lWfÿ¢áIRGþÅáÃOôH–š—¬[»šžÅ½<󻨴Ÿe6¯#³iܧنaMzØBœútÅÜC¡ãvÚBÐmlÛ¦ý»Õò+oýùÝ­Uk®Ö¿Û\€?6µÿéRÝçFyü«›‘S£&ÎYÔtlÇ/¯.æÙ½žå«Ù“Æm:ûiÆoGBËH¯iÒoT™˜ã“'M9_bí¡-Ž&"Ô›ñ[»ÒgŒóëÙO?¯˜8¨×@îýo¿Þo8uÐ%ùÖÂYS§Î]kÛìèÆ!I†ï¼Ø¹Šní¢S§Ï>SbËÁ­ÅD„²•üÍ™¦a`%=CÜ«0}O+€Hh5ïÀ ³wógÍÚuC5{úPK¹œ'@æºáÐ6Û·'fN›}#³Òºá2aAGRZì›ûOÞðFf K˜æ=›˜wÀµc¸{ GÌ?ˆŸ#@2Á©wXël°é“IDAT4Ú§¸ñ ½æáÓYœ$°·7hUñ/ðìÞ~‚½=ìMðô ž?GºD˜z›'¢¤6±ñ*VvDØõã;@¦A9o\ú„5IðÇ[t&5áe:\Ì‚¹ R!¼:2µˆè…÷ "€AV ‰Ñ̤BE?ÜŒCŸÚ ¶„@‰¼àá·tˆ Y¥K€BúÑ,­¬dbA6YŒÚr¼—«jõÜ)3æ¯Òy8¹a˜æÖÖ2½1L‡¬?6¸–píü)Óç.˨Úÿôöñ"B¹µYŽÎ&¶®uøćwǧO²xÛÅÖ³öêyDnaiþ¥ffV¦ @DŽóö‰0}±tÞ¬íWÓ–=TÞœHÒaÞî¹m]v,™>eƼ– Ξ^m#æŠ{õüMBž˜¥¹Yÿé3lŸî›4iêMuÕMûVYˆ9âJ/?ð wm]ßÞ{n¾bD ©HÀ±É¶ÞZ>~ÊÏŠðaãÍy˜•lh·gé¢KÑjˆÖVæ\¶¨4u_·Š)3ÇY{üÍìÅ“û÷.;¼é“ªÍ&/xtýÂù+öûÏØãîðeΦÅžMRêwot6’«—,]i€·ÍYHSÒE%œ¬¿˜–ˆ¨ãŒÝs"‹mZ¹xí¾ÛmçïѼ<¯3ô䶩Ê;—-]¾ÿZâˆõ§´(£—h_?½÷úó¿UÌó—Ÿ×,Ü{Ñþ×ù#£ â‹.˜/3_™y®Š|øuøÑÞÃé˜Sÿ‡ª5Ì/_÷¿4õ5¢ +öÛé…UQ`¨¥>qaSª4£O>@ïö.¤º² Ý)…ÇeÒ70“óVzG߈óËþÅ;̯€ Í¢…ùå/¦Pr*ì•.íÕ«¿ç<žV»öˆc£ÅÐ]þ»áµDD¤ÜÞwÀâ{XŒM™k°AŸÌ÷ÞLLûÖ¨¯Ð´tÀ\ïb„QÑ;EMµÕøâðšmºs&51fqŒ9›š0s¥MT6­1›Íaa³bk0”Fý³=ï7ùôËó37Æbq8 ?‘„iRãIòǸY°ê2AcŒ3¾]xKÞùç›7Ïf\xñõ£”¥‡Š¦—,Ùvá÷oež¹tcg"¾È+xïµ"l8tÇ·-$pwú®>ðÕ( 8òˆ!Žk?Ü6?ÖK$ð ˆ9ùTn8—ÒÊR—NóâsÏ)KwK„1¦lèí1±ôqº/×á³å‚qjë 7÷Ä›58'å#þhiÉÕi#|y|ÑÄ¥5´rß—“=DÂ!áñªÆa\ýêAÂø0+ù.ÚyA‹0ÆX~jú‡~K¥y'Gzñ¸Âñ‹RÝØi„1V•ÞŸ>ØÕ]8fî×RMÝNë*ž'ÏŠ ø"ï¡ë¼M"Œ0Ùã3SÃýx<Þ°ñI%†LÇXSþlÙôQ">Oè雸íd5…¾ª2-q,Ï÷1õR¾ºÞjÑHYìçÁãsES—}W©G#Œõ|?öYy ›úx1YñtåŒH¡€ÏzÏX‘V©¥0Æ9ûF|’Š0ÆH+=ÙWÄzm9÷¢N›äeìpæy<)×c@ˆÅþâЉåSB, ŸEÕ¢kß¡ +×ô°Dµwïc×¹êi6Òçç• Ž›aèÀÀà ZVß¼“‡"o¿®®œfÈ„ÊŠIþqO¼+BHYø»ÈÙáçGš†Žr¼.Ž;2ùöú顾Äc¤¿¸wU ŸÇŽ_¸MJƸøü'ϳJ½‘Õã­“]|âÏ`¬œáÖkôžbŒ±a+˜ž0·ÆåÓˆîµÉe1ÆX·Ø³Wð¦ŒP[{ß1¶ºMG¯¼/8oG~HW/‹ Ÿ·µD,~UôøÓ`÷É«.еa~4ÀÁ5cùƒ'<)K$Ò«é‰\Aô3 çÛ)Üð9ù¯J%’²§™©=åw~}Î?x!‘HŠr³‚…Ž«ŽrÉÜhÿ¸¥é•> 9Km¬QÅt/áÊ@Õ}¡H$±8·¼J^%;¿qšKà9E@Áµ]n‚£YùR©4ïæþÁ®¼½O((¼úËÚm{5zîí-ôܸ?S,.Ó¬÷ùEd<,T(÷Núðù?dÉ€Ö¬›—\üJ,.É=‚½è¤IÎ=šPÄ„y ‡N½óRªËïÿò»(àA©¨Ò™^£–(•J%¥ÅÛãÂS¯Ëòª”¹ÑC'®$iÕm‡I?ß–H$₇c½=æîÉõ•'wá˜ÄÃe2¹R^²n”«oâsܗ„¼9{.U”—çf‰ðs2] úìh®óô´«¥RiYÁÝ©.SöÜ]É/>Ž‚´«ybqÉÕñc^’ºû#¹®3v_+“J%%O݃’Œ\k›çGøœ[ðªL*)Ùµ ÔC$8t­ &9fh@\rQ™DRöj×ü˜AÑsT$ @]Ú±zûùÂF½Ô/îšx£K(€šÜs|‘σ2d÷„"矗yÛמw P[#„mÉ­ëíöù‘³öP §ãþ./öUmåÚφ„Æ®&¡ÉªÙ!¾3¿ù•’=ö9ýøHkfá½ »ÓOj¨Fêf¸ç̯ŽÔ2Mr¬Í|.Ï:ÌõôHJ/ ?Í·÷8Q¿£Ÿƒ÷ñJãúÐænwkd+*ÜÛÏÑïzµ‘4t–Wì¶ ÃŸ¼ï¿ä˜¨&i ª‹ŠJ ,“MÝX(š½Ô¿'ôíxKoŒ•ÜßÊs Í5%e†¢Œo¹ƒ†+l›w×Mèë3] ðð› Α‹_ó÷=Ýääè @—õ°_vNi8R]xÍÛCpèºDUpÍSĽXTw¿Üõqôº V7ä]5UØoÑ©:5D(UÚúêfŒëàå—ë"`— `P7æ¢Òë«›†QÉ”òÛÏüý¦¦ú¹#Ec6’u=8*ôMK=@Ÿ6xÈè°Q± ýuJr€›Ó’Z>0³‘ÑÛƒ†ŽZ¬ ´²§"§CjŸPô³@WŸŸHàÆêî”tCiö¶©nQI¦´¼ª‚ "çôR¨¯n†8Ó {<Ðù°ø_ESQUD‘Í;u¶0ðÅ|,jBÜÒœ]³qþˆÌœJ6›…¢)EÑqüW|¹?$Þ—¢¿WØر1|ûîú0 |pÊá¸`n‡¾ÞcÇŽ õoÆa!šªkÍš?3¤…Ëš3Ûƒ;ÜÏ:kÕ-ªßT‰B}Ú·«e×±íݲæn‰vŒ­ìvKÛ¶Œ%o^-Pæ_+ƒç÷s©¨QÛ!„¼è¡Úè:…´5ïnûQÛ>ý‡OˆÍ8þ´l–ƒÕ+MÛ=zwéÑÛ;d\òÄÐóÇŽŒqg`ö0¬[®×0HI|t%í$á|¹ŸuÝ+¬¬B¨Âda^M‹ ݬjéÒ›ºòʺÏ{C¤³Z©´lÕ ¿ùVf±u¯îÐÈ`Dæȉ^mÛY6³µ±Ö¼,TcGÀX–wÿR¶xXHðéÜü×kT"GV–‡P_„¡ò‰’íúAóN-> õÕŠj}7K6Â)³ŸiÚ ïeTæìîM;¹Ljf=,j×ëŸ~=90ÖÏ#9ÝŒƒbËóžÓÈ™a]EŽVß­{+Ô¦}Èìºóóž¶Ñ‘ -˜ƒƯq8Í!îÇÍÓî‘}ììkƒÃ •Žeƒ8ŸàõwŠQ”+ Œ1yéÐ!«A£{·Ü|¾B!ó%¾-%z슧k‡–êü|-êb €Tòrš„èÖmz²XjëÖ=í?´„0†ªŠš¶--êÂkMø«0¥)‘jºwíÚ¯c×~îC¦D§úÇ|•÷ZÝ´pèBýš+Cà Š*Ì–¡ÞEiFªâã¬Â6¦Åû¾–>F/ÝÔ¶uîg×Ò¾¼ž¯#bí?Aõ LN¸U‚¦wÇ#¤©|NPthñ—Ö->´±REW{;+‰We¹²mk„-šsùð›{™R«ûvŸv6XOb ,º„Žðc«”Õa&؈£×#¤^§¨Œ1V£oѾÙûe+~+Ï´èÙשM«owíÑQ$¡«Ü¸:áèo5õšèfÛ‘¸yî9AÚ²ÛóæÄVl¹¤Š¢‰3>±z/Aêt:º(·YönßúÊÁuÑ£g•(´:NSSQ ¨îØÉ!ÄaY(B§=¸1]éÄEiÎ6Õ:ÂàÀ¦½¯ âü¦4y¯þ!=,ÂÓÆ—ÿ÷Û IDMñ¬(Ÿ™[îÂâ{™©Žé(³76§¼ø·«•z=%͹ü¸RÁs²ÛõvíÚùûÔmj=I’Êí«çüpVnaæÛ/ö­sÇž*I’¤Ÿ:úʦy€}·¶nv@¬?x‘¢õ:­zÏ’]lWaÈØD«°,šqˆò’¤ûkÑ‘}:·‘W–Iª5zŠ¾lS™ ¨%U†m§µ¥dÝâ£*Ië+ÒVì±ò™bgaúêÔGàb©¬J9—MQdìù†+Eö —YS;?93ÿHŽŽ$)½êhR¨ ö[!ÿ…qìó«wgUè´ÚÇ“ã¿ùµc;‹c:¿¸µäd©'IdYüwÂ'»Y"ÄêjïÔûúεÕ-Ek~Þ¾†„€nÑk€[›–[Rvk)=A¹Ç×y…ÆæW“ÓY‡w¦_›©nÄ=ðD©Óé=•—ýÕ¡AŽô¡S¼*¾_qEL„öIzRF…ûUÜßµg¿LCc„€&5 Ej)@©£u†Àe¤%>j³jš·¦Z‰>±çë¹ –ÉÕJ[¶qÁÜÿ3Ÿ¬! ‡Ï†~”?{OZ«“=\6OÇQ‰½9H'/ùn×®gú¦ïs°jû¡ g})jô$A…—Ó†„„ß« {ÐÁ³Â+³®¦ìÎ;ïÎë”±wû‰GÕVvþX´0))))))qaâðntKáȤ9ã-B˜úí@Ê‘»2£ÐT9%Š½oi)ßÖØCU¿Üš8ÎÕÉÙÉU°pë/J=ÀòIÎCç_¦^ü~`˜È‰/Å|¾¡P¡NfoÏMÉ¥¡º8å‹É<7>ë™vîIÊÓ©Kü=y<ïå¿,-C©úUæ6£=×cX®Lªœ4‘ƒsz~­IMvO(ò8šqváØ¡€+ öIE- ñàôÎáƒ\>Ÿï5tóÏ7 ùW¿žõ‰G˜\GÀÝ!Ÿøo­³¥®é5*éôÎ/¦ò๺zo:þÀ`ߣUâÔ¥Ÿº99;¹ðæ¬?$od|¥ ELÙŽskgFyŠ¸î!®Ìy:YÞºÙÑB>OÀM^¼£PN<ÛÜÅnh±¾ÖʨW$Eyöup™öCíêjç_ 3Ø¢«§¹:¾ï7c:Š½ 퇌R‘4è«ö-çìÎ÷²þ§ÛTåÍ0þ€A£æÊ.'Ø YøøæþÈ@/W'çˆøõb•¾‘“ñ½c‘ƒÜœ\xÃ'%Ü^׳_d…Á>šwmÞ˜ Ïã §,I}UmÈÆEç^>0Ê—ïæîæ3|êùl£C¤êÅÍy±C@48aó±J-e0]ê*ž,›ìäêîuäò5/—»/]#N[>MàîÊç¹ÇÎûý™!™ìÝËwuVcš…‚¬cÃñx|_0rÆŠÇR5<Ùl´^ýó†Ù|gG¾`ð’}7÷­ â;B<;¹µï@×GR”×¹8 prràè8`à@'§În¡å ûœgë8ÐÙé5‡NXNÓ4­ï\4ÎÙÉÅÙÍ3aÓ9Yˆ ­ÌÛ8;ÒÉÅÕ™ëóej†Š¢@ž™ïæt,[c²6ÄóüâêåZÑ”§¯›-âºòynþ£fœÏ.3L&fMÔG7ᳪº™ªšìÐiøNSW]Ƹþþ[.ÖþÓ.ä÷¾Å˜TG|xR¿à5ä¿Û3ÕØ™ðzFš¿Âb¶ðå¯s¹‘›^—Êî Eµ™€XëÍ6Ø Ç´«kgyE}yÍ ýFJ£ºY™þ¬ñ¹ðçÜ)tSt0 ë5)Áº?š« ŸxÏÓý “͈~è&HRÌsç4ÅÅÒtó´Ù²š’ß&|þç}°`Åñ?þz¦ÅÞ:ÌÏ4Ü ×‹Ã7=ÖäY¦'š-Г¤2ÿRtòíù‰£5@›œ‡šb?ÁæúÑ°&˜Ž7"ÁMŠ4fóyóPqcÖ•út0 ë5ÍéÓÀ,‹ÁÔ(úgÓV¯cf-JfiÖóóšK¥©æ±Ù²+iÛ§ùv7µ[™å6ªG×ÒëÌŸ ó.«Æ#}Ó!ŒIYN:àݽ ñ¾æá13ðƇpÃln,†5Œ1Êøñäç~B9™éÙTßOƒ¼w4ÿà½PK&…fäÔÄ.ÞîÜõµ= (¥RIêßMø¶V¥¬±ÑÿÿÎUÕ(5ý?–’^-¯~ÏBÙ héaô>’vX´·?sØþïî: 4aý~„@ýèЄ¥'¶?Õå}³Û 2En×.Œ×óüÏxSL=o×»ÿá=SO7rR3ø7âÍÉuuÀF°0`À€Q7 0`Ô  0ꆌºaÀ€£n0`À€Q7 0`Ô  0ꆌºaÀ€£n0`À€Q7 0`Ô  0ꆌºaÀ€£n0`À€Q7 0`Ô  0ê†ÿLüKUWêÎ;µšIEND®B`‚suricata-3.2.1/doc/userguide/rules/fast-pattern.rst0000644000000000000000000000371313051004444017253 00000000000000Fast Pattern ============ .. toctree:: fast-pattern-explained Only one content of a signature will be used in the Multi Pattern Matcher (MPM). If there are multiple contents, then Suricata uses the 'strongest' content. This means a combination of length, how varied a content is, and what buffer it is looking in. Generally, the longer and more varied the better. For full details on how Suricata determines the fast pattern match, see :doc:`fast-pattern-explained`. Sometimes a signature writer concludes he wants Suricata to use another content than it does by default. For instance:: User-agent: Mozilla/5.0 Badness; content:â€User-Agent|3A|â€; content:â€Badnessâ€; distance:0; In this example you see the first content is longer and more varied than the second one, so you know Suricata will use this content for the MPM. Because 'User-Agent:' will be a match very often, and 'Badness' appears less often in network traffic, you can make Suricata use the second content by using 'fast_pattern'. :: content:â€User-Agent|3A|â€; content:â€Badnessâ€; distance:0; fast_pattern; The keyword fast_pattern modifies the content previous to it. .. image:: fast-pattern/fast_pattern.png Fast-pattern can also be combined with all previous mentioned keywords, and all mentioned HTTP-modifiers. fast_pattern:only ----------------- Sometimes a signature contains only one content. In that case it is not necessary Suricata will check it any further after a match has been found in MPM. If there is only one content, the whole signature matches. Suricata notices this automatically. In some signatures this is still indicated with 'fast_pattern:only;'. Although Suricata does not need fast_pattern:only, it does support it. Fast_pattern: 'chop' -------------------- If you do not want the MPM to use the whole content, you can use fast_pattern 'chop'. For example:: content: “aaaaaaaaabcâ€; fast_pattern:8,4; This way, MPM uses only the last four characters. suricata-3.2.1/doc/userguide/rules/snort-compatibility.rst0000644000000000000000000000314013051004444020651 00000000000000Snort Compatibility =================== .. contents:: Keyword: content ---------------- *Versions affected: All versions prior to 3.0.* Prior to Suricata 3.0, the argument provided to the content keyword cannot be longer than 255 characters like it can in Snort. Suricata 3.0 and newer can accept content arguments longer than 255 characters. See: * https://redmine.openinfosecfoundation.org/issues/1281 * https://github.com/inliniac/suricata/pull/1475 Keyword: urilen --------------- *Versions affected: all* In Snort the urilen range is inclusive, in Suricata it is not. Example:: urilen:5<>10 In Snort the above will match URIs that are greater than and equal to 5 and less than and equal to 10. *Note that this is not what is documented in the Snort manual.* In Suricata the above will match URIs that are greater than 5 and less than 10, so it will only mathch URIs that are 6, 7, 8, and 9 bytes long. See: * https://redmine.openinfosecfoundation.org/issues/1416 Keyword: isdataat ----------------- *Versions affected: all* ``isdataat`` is off by one from Snort. In Snort the offset starts at 0 where Suricata starts at 1. Keyword: flowbits ----------------- *Versions affected: all prior to 2.0.9* Versions of Suricata prior to 2.0.9 treated leading and trailing whitespace in flowbit names as part of the flowbit name where Snort does not. This was fixed in Suricata 2.0.9. See: * https://redmine.openinfosecfoundation.org/issues/1481 Keyword: flow:not_established ----------------------------- *Versions affected: all* The ``not_established`` argument to the ``flow`` keyword is not supported. suricata-3.2.1/doc/userguide/rules/normalized-buffers.rst0000644000000000000000000000103713051004444020436 00000000000000Normalized Buffers ================== .. toctree:: http-uri-normalization A packet consists of raw data. HTTP and reassembly make a copy of those kinds of packets data. They erase anomalous content, combine packets etcetera. What remains is a called the 'normalized buffer'. Example: .. image:: normalized-buffers/normalization1.png Because the data is being normalized, it is not what it used to be; it is an interpretation. Normalized buffers are: all HTTP-keywords, reassembled streams, TLS-, SSL-, SSH-, FTP- and dcerpc-buffers. suricata-3.2.1/doc/userguide/rules/header-keywords/0000755000000000000000000000000013051004444017262 500000000000000suricata-3.2.1/doc/userguide/rules/header-keywords/Window.png0000644000000000000000000006407113051004444021167 00000000000000‰PNG  IHDRzuÏ㽦sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛêI|Þ IDATxÚì]wTTÉÒÿõ$†œDQŠ €b¨€9çœsXu]sŽkN«kή9ëšsF” ’Ó a˜tëûc†(¢ëâ¾}ï›:Ïpoß¾ÕUÕÕUÕÕuAzЃ~<ðô$Ѓô W7zЃôêFzЃôêFzЃ^ÝèAzЫ=èAzЫ=èAzu£=èAzu£=èA¯nô =èÕô =èÕô ½ºÑƒô ½ºÑƒôðÿOÝ䕶 E• * ÃbËá_ø7ôYÔCùïæþþüGþ¡·4¨té[ÈòMÿwÀ8^$ R¦¨ä#5ŠaÄWå¾*6Åbø_ÍöCRÞ_zTVÔ£ ß( ×Ï\ªÝº©¤àuurØÙÇYþÍ«§v$"ÆdQ÷ÌžwåUl¶\Ågü†Ìž4ÀÚ ½F·•*XþöfVߘëwyi÷‡§/í,kH`ŒOÌèþ˽×Ï_ŸZoÃÍ,­ð#µJ0ñÌí¾eںƋù,¯ON‘Õè—Ûë‚l¶NêµüÜS>_{]-·«â;xìÄ †œ?tÖ¾#¶œîi™ûì‚æŽá“Þljn’K§”ëë=¬²ö[xwc‚õ[{gXýäâVÂo  wϧBWòèréð/"FŒ1‘ÛǶ9–ùâø&àic— ÄÂCÈl½üñ˜ÔAMy!òãÇ1ÆMÝîs¶Nú‡ô1"Ö_äxêû?çÏ]pãmB¶\Åç |;Ÿ=®·™\ò©Z5¦.}þ¼¹yîê›ì(ÝãöÒA Sß=¹{Ëî·^|dDû 탺öïÝÙAÂŒ±­\ZDKÊ»{©‚r'ñîÂvùô]°z\²¯5¨6H&ñ pØŽgÃêK¾€ôË&eÛ¥•k}éÜ:snlñ§—û-¾zïÒqcAX ÿO…8¢”מqc•éœºoðxD:Ž¸ú 9¼jä¿Ë¼¡Žã>»BDŠÛÓ+6§(º Ç}þÅz}Ê×^Ûâí±å-º¬Tç<õy?EbTðªfn;÷nKo}êÜuQb×–>£7œ'JÑØwÄÞ;EI>¼]Ón¿ì'"âˆ/4®\wÕÓl¢¼¾ß]îÕ:D^àÑ×þ•jþY4©vÏäßofþ+gõóðhq5ˆèè²± |›xÕêð^žG²å•G_IÏGWZ?) °ÿßú &Q.2wþâÛ¬K²òÛX¦yتF=?ß%·br»ˆÚ3­~·1DDô¼¥[­m1Åwñ)À«Êoo¿ EKDQ¬ÊGL®ëŠlND¤É”¥«4Ü—ùODª©­«ö]{Ÿ("¨÷¢èŽM½'ï¾EDêä³ÞU\I+Ðx{ßÖÍgìÐþq`FÏÚõ[.=úPû§4ôJHÛ&õƒÆéx@á<¼Úø6Øví}>Ä•k;ÔnáÝpâÚÓDDÙ7¹Õ=)-v´…áu{ºMûÌ:ñ"·Yü¹µ^mºd¨8¢°€*µV…rÅrDÚ£žÛÒÿŽ|ðJÈje ê«ft êҹϪÃPxÝ!ÆXâÓScúuéرóŒÕ‡80Æânvÿpt÷öV_î<(‰Ÿ84°Ãâ§r­vgŒ>l?líiyìéNí:<–1Ƙ*òúÔ¡½;…t›½þ¸ Œ1qttÀ´Ë‰¯Oö ìÜç·›c ЈïL m(‰4€õúes{6¯¡[%TÊ" ?ð×î]!?1oþ™0LŸð‹cÀ¸QÕ òÄJµ …²°‘¨Vj¾L/MŽQIZMZÛÌ"r÷‘h µCŶì’æm½€ÂCÈÁŠ{}æØþ¿ s ÎÝ| °ïãZ¶ÆaîÊG'ô{.-ÚXW+Š5²¦VªòáÆòéa7§ïÜwÄôû‘™L{õÓ¥v]‡e¨“VO4ê§_¥*–ðätçî½¢¤#­¤°­³»Zz“¾h½pÛz5lÓ>dÓ™ç`ZVŽÿ‡'Ìû ¨(‰SŽ›—Ïîâ]éëtI<±þÄ“¾+Œ¬¥]ŽM]ï?¶»zÊÙÁóni_£!Ã~½*lÙ+Wº¹îI6©liÆåR¤*Š€ÅpK©±øyý˜+sF\OüG”ÙÅ¢® 02›Šä˜üÓ“¹cõ<ñò©ÎBL~Ü©s¯Oé©Ûf ìÐiÈäåqÙ,=ê^÷ÎÁc5¹9¹¼wïç8ÆþŽ¢(uà û©Cý¯}GŒÚ·íŸk†Œß|­P“'çû^]½Ý€IãKÞî÷í<]ªøªa“‡®¯Ùi`P³j“ûyÊ3͇Ι׹œ(÷A‡Ö#ük[ZÔž6{v Rßò ˜bá0l@Wîβö£¶ÀãRãlüeOĘ9‹§ iº{tÐò©U^™ºÕkgoŠ“eóx|æU×.o£½Çe÷1‘qµy“»Y4ü̦áã«/YÐ…ˆð DŠùßÔIKÊ€‰­‰V@4á‚mÓ·Î9úž+Ò[xµaatNmíŒfô+¿oçÙïw†•™65{ø—•/\{”1ö9vBÃâ£>Å£¤K­Fðk¶5zd[wnH§.O²c_ùñëá½g—k?zéü‰w X~ÎÖÃCý!ìØ‹`è͉#¡Þݼ¿ì* F}ºp|׈sjÕo·`ížÐDÅgÁ —•³ÖÎÝ/U2¾€eõ¦5ÊZæ®|ˆ§{ÛÓM›B†z™’nÂ2_ªm‡¦±÷6ËÕZ}£¶ ˜du{óu™v"ãε³’²]m%üük°Èè¯ö¨¢r»xI–ÍßTGBCÃïæ˼ӾuY…æ#FîTÏtj·Ž7S‰1€§ù>qÀt¿AKæÏ°‹<1`ÖN犂Äø·Ÿè8‚Èßw=óîÛâoê Aɸdœ(dÖú‘kZñ8‚ÅÓSÃîÝÀÀFùE{ËŽ}~£ÿè×Á @½ZNýú_KlgË#µªÆ¬Å}jX I)â «yTuÌ÷¤¡ƒ‹‹DeW«¶‡8°tŽI‡õ“úÔ% ©¯Ë¨‘Û_+aÌcªDùй#+2b•+viþÄæ £½§ñY.Oøã—oè3lN‡¦ÕÆN˶ò÷-mgÁvÔÛøylã,ؾ¿N) À¨J‡iã.yÏÝ3sÓ ‡oÓ5völ~0uF5N_bª•UUv||‚¶N-?0wèsóÆ´2Ë Žì[ ëxxÃŒ©í~_$(³PËœŒé; €s÷™åWnÒÏøŽe‡c˜¾yns¯ ¿…´ëá*(¨.is×æ{òéL…Äó̱_$ß(‚òKw¬_וã8žÏÓÃnÛ®IW·2c¤Ôø/XÒÖY °©C<®|ÀMn9§‹mϵçF5 îàêÈ*BJé‚4Ež ;Ôôë8?ãý/Sf í°Â³׎e£Lx¹N_¶¢÷¨…MתMʬÜ}ªSKo'[]´Fd¬ã]Ÿ—¯o oã@óðU–]-7Þgï+_ªlVöÍ,5g$@œ°J=OÃýÛïúŽöèâóí–ÜQÌ9™û„[Ø®ÅJ~ž2PZú_Ø?Vô5Ò [9÷LíAkŸöáQ@]ñ…Ø׿ùIAžm­W:vrÅ7r„Þr°žgeâ8æãqdïæKñÞA` 5ž<3¸–=À¦ óô˜ù\‰Þsº;·ÛuafÇÚ„µfM ;¥_·cûòO íþ6¢²XCyBeúÍá™”'¬íØr”LàÎ2qÌÌÁ'¨b©[GĦF06xéΡí– fd*6Ëã¹ZÌ×:/<¯ºæ Ž?ÍFgƒ\‰ÀXXÌ{ck#ažÝcØ»ÂÏ]O'Qöº³uüº ÀQAé141433üŽÔí:Ô÷·“v=YæZ@„DƦƦ†ßÇ‘{ÇõZýËŠ•µÊXììÑð~a® òË6¬ïzyÛþ>óZÜyÓgvË¿«lJ*vñL.´ì׳uY'[›7qÙüB ÊØ™d—oÞ©S§Ž;vêÔ¡E“>å,Á}S¢å…جj–Ö¼x«•Z@þäîD ÀÀ‹–¤Q±)ÉÆö¹:1JýsgïIËr.p*4i,I‹—C"Æujú¦;æ+× âY5˜ÞË{ó¼ñ)ÄþVöqºP1ÁdÞ¶9Q»Fî}"+Ü'‘³w¯€R36^02É1ÀSî-ºÊÍ8õàÞÝ»÷îÝ»wïÞÃG«%=_t-ío%C°R3VL¼·¤ïãÔ¿9²\ï9øÎsàÀµÜJÙÙZ§|Hþšœ2Á¸ëÞŒ{º#£ú¨zV…Ÿ¨ÏšCao^¿~ý:òÕ+Pb؃E£:6 ÿ,½ÔúKÏö®˜ÖÒ«²€åMž¤«{Oß ã8q*7ml”'ûêûŽ+z|ù™O,/ÆÊ ŒmÞkH­›ófä<ÆçÿõH"Á®zP/WZpડ /Œà[Ä_TÕoŸDh•ûŠ!sÒ­Œ¥1_™é¶&ÖŒ9=dÖõ1ãš­É Ü3m¦cÈÒ?¯Ÿ]·pL9 >ß[×­–xrÃØ>϶JÒ¼e©¯ânâ=®«÷áÙ=fciï®vhß'¼\çMê£n‹i§½…tt-b.IÀoŠìŒœZ ©o³jû~qŽ|wü*vüˆ·ÑZKgçôy)Ö&ÒhiñJϼÉߌý'žì?¤Y‰(Š’P7D6Uj_sXŸfÍ[Ͼ(Þ¸e±SÌ)¿ÃdÙò4Y–6MsàÜýëšÖóòñ®ß~ìî?ÿêål N%•j}IÇöM=2‚«Õ¼72×6!À§I;eÔa¯:>?(]›Múi°ßض^žžuÇ_2ß¾¾%‚Üy`Õ”=mš7ªS­µ¨ÅôåÃÝY¾4Yˆël;°Z|}vÍZ¢¢.ÕªÙ0Ô¥ãž_šL™ìò¢!Õ«€ ;§"e|pwQ“Ù}|ˆÆüÁ W¤]›½úÊ–çÝeËdT`järÙº€‚=V«Ò¼Ó|  ÈÊ”edåM"Æë±bq¥û‚¦Ð*yfzfvžUP9:&-SE€êàö­–žãÌDŒGœzIãOßÍâ”ÙÉñϽ=ò^Y½óBöE¿O-KK×äÆ9 ²õW³Ì”ôÌLí]y¶t…¡!Tn×kG¹—.MS¨‹WW¿¡VƒÆþû¸ YþSÿVÏÖO:¦’Je¹Ñ¨³r%° ª›&°hZÖ²ø)D$sàLïr¹Nx¡Q$ ¶í]¦9;µFí˜wGkÕlíÞ}ïìnZ×^š&U|ƒ"#]&Whn9qÃoKGË.,©Uµª{U÷6#Ö7ë3ýІ™<òæÒ¥2 KwÏŠòÔ€A­´Q‰ìŒô¬l•6¡![-›Þ¨0‡ü|èËþˆ&]*Sçq„ßmÍuRzF:—•)Ý\»  Vñn9C™×#—!M“«‹$/`ÁŸôS5ê7nÕ¾ ßÚ’±ÁÑ{zÛû¿ÇÝýçíóeZqß”5öå!æ]ÌýU “«x²|qàÅ¥}E¥‚¯$"Ú33°ÓÌ+•Tæ¤#v蹤¨±MÛ/å¾å£Yþ!ÑqñôûÒ½|,)¢—¯÷X´ ÑWqú2G8"º¸ª{óQ'Kˆ#T2á…Ö–Âú[w›ó”.§y—ó®¼» Å7Ëù[Ð!°Á—}mtù±BCe_~q¤)‚ UÄÍ‚X³â,rÇq_ðõxÚDKVÄ ÙWöÏ¿0ðb¨ÿ*åËÇçԉז/<#´óégTfÁÖõåuÙÇ%Ä"‚u÷`¿Ç’n6l?Å@ôy (7wëÙF®’ GÔI]›†ª-¦¬ÝP]\bù±G4ÿÈ¥EIŠéÿ|%%‹J`«¡„͇ɿ+=GJ+^ÉÒŸm*•8»>[»Š6µ7¾„‰6ä÷U„¿üô×7}¨h¿»’@±ë÷0ø§è_3 sWŽv¡¢âxWÔí<¡)Ìè¿âßýÛ9Â~ V%hÝÀvNèÚhÍ/íœ~’' ¬¶ì·V¡›J>°~®€ŒIß\^µå૨&»y56¤—­Î|½¹cÖºs”ã0 Mìû ªï¢=/8ÜdÍå{TúRº¬bñ€Á3²µB&6shмý à&y¹Üšçý;þ”i(ÌOEReµ˜²o@]ÃÍSG½°ó^5¶KÁ>£†·"1àòWHQ+\ûn™l¼¡çêçb!ÇrŠ³p¥kwX:©ó¯F]ŽN.t†_­óÞ9éÍ>ýW)ù<ˆ ËT®Ø­_CWóÏ̽\—¢¤ Áœ•¯à²ÏÞüÖÄ°øó“ú­qzC·Gæ+ ‰üyô¬g)‚›¶¤ý¹eþÆ3T}Üï}b[Mº½ßr³¢º¹¼eþïo 7.6³g—чÔ1‚þÑØ 1vmÝð žWÚ9ý̓Å#¬HŒŠŸe}JLæ`Êßf \p4¼c¯.mk[ròôW·5õÙ3eÍîn^¶”YiŸ>¥ô9ÌLÀÓ¤%¼Û8ªý•®ËWk·:6*ª¬’+&(”óIYѧ¿_5¥ZžšððØ’j«Ö/Ü´©mía?ÅÇ÷QÕGOö4ÍË(%¦²“ ÔøØ8Áç© ª˜ˆ(›c[8ó²Ñ9Ρ’‘XؤK+Ïã1Ù®•ëÚoê"ȼt5©ñ1éFe´®¯Î—¼**U¸¬¨°-'N¯d¤VegÄD¼šÒÀ¹åè•ó›ò¥0Æ0­¹w׳7«ñKd…aI·v´™óñæù™¢‚fæ•Q ž·Ý6ªE¥ÂŽÄdÃÐɳ¥·óßD\jkÏA;´ÿÌÕþ‚GÀ]˜>öt¬ýÜQÝm$ÉÓg¯0ï47È·$âÖMèK‡›xŠ´øD0ð’>–ŠõJäW7Œ±ì7ËvÞ}x HJæÊ”2‰ý¯"ž‰……±(5!V–­KÌm­LAÄË’&§Ê25`†&ÖÖæ<"0ÆegÄ'¥ª‰giçÀËJHQ;Ú«2Òâ¥Yž¹–F|±‰ã x §Æ.:/ýõæ ³Éê7¨ÆÂ'w­ ©;G¨;„'ià Ò5ð´õÛ°&yhÛoK·ªX»m@íêÙ{Àð?fuœÚmpù»+€FZmƒC>ÿ/  •šu ªúùëv-£ý‘x|Ų ‚Bê‹Y¾ÞÌÝ;‡½H«yõÚ¶óË!˜=ûÏÛäºtH“¼©F\jÌGñâfc¢xjž‰“tŽ¡êSLœ™u)–+%+ƒÌÄÔtð„¶öÆ"žÎ*"UrbR¦BÅã‹Ì­¬Å|•4ùÖÓ7¦F£>:8–6ÊQa™q¯>ã—÷MŒ·v°µŠ‹›Ùid ij“ò¥Í’&'Ê2³Áøs+K1#gŸsq®VÊHMLK—sàšZؘK"-*QYÆÉ2!6N®äÄ3[k3ä3ÒH•ý1ôR: bcâ…V¶–”•‚Ò¶1±I ' cZ.KL‘©4$00´µ±ðšDöå]«—wN‰“fz5nXÞѦ’@'‘ÎSÒ¤&%fÈ•<‘‘µˆÁDÌgLðŸ/1ç$OIHTð¬õ åQ7ÀÃ¥ã“ë , ÛÚzì‡áå"3=:Æýyêq¦élú-ÁÃÃ$fß…§Ó×ío]Õ:ýåÖN7š¸y¹˜Èo?­×}ú²!-ÙØíž&›xÖ.sï1×®eÒÙð¾6ø¿?¿­ûª gÎœ²32è½d•¹™@\=håä,fÕÚËÓ5 "ÖyÒê^™ÂÚCý.圔™ê4¥Æö/ž>Ñ(j=kûžûÍöí}4§o­!G™¶Š‰I•å]+µÝutæ&f,WߨŽlß“j :ýÛ®ÊWý–qéöN[F–~·[qËNÞKØ<`áÛ6¶ò'ý¨ì?qûdï{[†NÜú°¼gS‰,ìI¤tä²!5KÅŸŸè¿³þËãC£×ÛÇôýõaÚöûèyTË)¦:³Èß[¾7¡Z쇶e¸°í§_ Þ° ‡UžÑ˜³kÇ5/ùÀÖí>ý&ù'nòŸ?ÜæÁe¥ãàéÛ|íÞõ©;¸»˜=úó©Øgø™¥Ý"/þ~7:#]úhë–d9Sdxwm“Un7¥ÞÝ–½/ßþów †Cóû®:Z¡jõ˜ÐgçÖ{wüäÖªïÌzFoäÜ Vvð`Í„ÏìŸ^¢W(ÿ€º!p©ë/È:NóÐ] xŸóWܘä.Ä€ºÍ<ûί¹üÜÂÆ žøþvçuëª þ´Áaäî]+ ˜ë‹¤¨OÛF\I«}õÊr+@~¼UÀ,~#€ò-ú©b%æ1—Úõ@è\¯&H“˜›R»ŸÖOÐÙÕ¦ê²"Âx¤&‡‡E , ¾gì ¾±‹­}TÄ3 ¾nïÛ.7ÍóÈ4†åûuk\LçÇwm¿#È}F#°éÙ»ý×´KyÿhÇ6ä¥äçÕ²‹{i“Ï5€rþ¦KÖ<Ì@c13è?&x˾åƒgL©ˆ¬çGê.:‘¼¬½ÞÝܦ*3¸–΋ ðîÔÒóç\Œ€Á=zµi±{ÏÝŸz{¥ü1qû]ã£×»Š`ë˜&C³w××W–^pýÓøÜÐ Õ8Ñþ·Mº ïã]–8ßÀ02›çÚqêw'†­wøz+CíÕkÂ*ÿK‹òýÅ$ëÑ‹¶vmìàÖê±Óö-™°Áê IDATš üÄ—;ü±ØÏ@ ®ÅèUWnË-WJ6åf ktìâI3§XHò£þLêPS[Ñ÷Ö¨×kæì>"ÙÏüë÷8Õ-¸ûÔ6w´n:ý§>@Lð± ­ÇNïb zuG‹âþêŸÉ¿v§Š!ù¢mãGÞéæV±Ž#@TµN}m*M‘KŽËùzmòϨ†ô¤PŽ:9äºÌLm\±“» ˆìl4|ß`mž«b‡cIY¯J²«7/=ï:±ji[ûR¾“GPýqî“[»+íY}—€®ž?[”5.ª¬—¥TÃÈTç?3Uh›Zb„ Œg`½õüiíUo_¾Lp€&þíEKöÕé¼ÊRÌûÎÁ‚ñ îð>Ç‹}vG!ÌÓlYêÞÅ«†ä×îDæ…}ü2¿®n H‰¹sW•/tÃ9Õiÿ¹ºÉ ‡Xˆ˜2CYp‡A¥&@¥øF­:5Y¹c©¢ížlÿ–ÇÝ7®å ϶“ÎN1¨eis+ò5Pçè¾geüû¸ŠtZÅË¿ÃŽ_Ž'jz«5DÄ)ò% ªT QçúãT5¼µO>¾ýL\ÚÁ·´XÛO̓¬ÖL¸%ƒ{^ô[ë>Øo%aﲕ¹ñÂôèÔ¯!(©PºÌ½[‡Ñ}’vÍ… ‚¨@âÏî×}{­ jƒï“bŒIÿ|ÿ.¾Ó˜fÅSä/× (9)&"ÆhýÒëæÞÍ¿\›—øåZvœµòj|û÷7ÊÕè$áç,×iŸÔ:«ej³R†ßÉ”ÝKÏ uYår)ƒÉwø£F† u1b`€*%Kilmœ× 3áþíȤyÇþhæ/bnrÏŠràÿÈÖÿô›ÛØ«ƒ] [çrßò˜“™Pšš¡}嬂?pßõJ&ÍO 1Ié²o(Ì é¦y?Ý‹Ê`n[Ú'¸£Uf\´Í·vOºÿä‰ Œi"‚Ý+Í»“ðYÕRÈ’cÓôÚäŸÚ™’Ø{Kx7Ã>Õ)UÔœý|™yYG ö«PÛ×ÙXqóÎc‡àA € +«µnÓú¯g©‹·³ƒËŸ‰eÞŸÛÖkÍÅS'Ùñ -オÝî0 1«Í•©•H™*S02rZ¼çˆ›ñ×£w<>ŽŒ ¼"ÒM N©èòóážž¢!¯Ž¬îry—«àÈ°|—#k°œ0‘Öõh»[¿´¥º²ßÅãÚ¼È{Û·;®ûêÇYµþeç3ž‡F´»(Ê7IcRÚç†ÂâˆÆ¯ìjÿPþrµãÎ3¿:"#õ‚×  Î–Æ&Èøb“[Žwò°*œnQµ¢Iâðv½k¶¹z`›Ê­U!¯,¶•ÖÝiX…Öオ7¨qã쇬*ó»zÁºý²^g{4oÕ¸Qƒð»7ߣôãÝù€½]ÅŒ¤c}û„vŸ¶±yÅœ$¡‰» ËÏ“ž]h¸zÞ¨ü/a¥ÀuÏLiR£q+Aü‹ïâçoXf¤æŠ’MM'Ùz5ñ(uþÜ9?õ»8eÇèÙËæv6ûLwQ¡EBäPÛ^²­oP/Ï^‹f»å× ½×?#`b‹6)/®ðüWÕ®<úEÃK-__¼Ê1òž0¹UÈÈ6ÞnժǾyDnmÇÕµ-œÃÃpÕ„ÑÏíX¨W(_YJ*«8ù„&‹î]˜k@ó8L^­Zy(CŸ¼5¯TÅVÌ -rªâh éSD|ŠLCÌÈÔªl™R|cŒ“§¼ ‹V1QÙ*•ÎÿÜl£tö…åÞò”Ø°8i%77!Ÿå80(e‘cÓ³”`|‰¹¥££½('£,+-æCtzÅ*n¢",¹ì·OCU¼|&qÖeª:˜åja.òõ™FWQñ¦VvÎö–y5e¼~öAÃ+dÔ‘‘©Cù2ÖŸÂBS²UùÍ žyÙª¥……_ª3²Ì+U*ƒ£êÝóFe=J™ðr«ËD‡…¦*T…ŒN#r«áf N{õúc®{ 44¶/UÚÜHP8w˜ŒÉâÃ#2 m\*؃ä#Û¶±ï½dzHmíÎ,k³0tø™%µÃ#ã8ž¸tWsí~c¤ˆŽˆHÉP $Že\ÌÄŒŒË{–¥æ9W¬b.Îwž83þMx<Ä•+8}xûRdáRÚV’˯Äèðøñ l\ìÌ |:Ò»å®z/Ž  ÉLz«äx¶e*Ú› bÂ^%Éù•Ê[¾|Ÿæ^­¢P5{“ ©^É¡P.s\øÛÄt¥¹s%gƒÄ\!$"MTØ»Ô,•Ä¾‚³mFBäûX™kUQü»d¹[i;@ñöéËÊ6"PVüÓ÷2wwWÐ|Šø’ž-04+[¡Œaƒ$O|3iú¶5›ôáßú,™Ê"YƒZÔZp:ª¸b'_UÔé ã—~Ò==ÄÇ}â…ÒCICnñ“„{êyù¿åHùc©¿ïÀ«oòíÅ’"¶Wí¸ù¿”œÊ×Û{ŽßòõâCÿBÅ 2\9°÷”©½›ív}Ÿâƒ tS¿²sã?jÔ¨üâÉSʧ›YèCs%oÓ2†äËÃG¬ºžÞcåþª&…6ÈþidN/0ÿè§Zªýw.ØLX©Ï®¥z9ý)­çŸ¥0r°3~ß jyBRŠB¥á ÅV66b>H¿óø#@õ)U$1³·6Ëïse¦~JUš;ÚIþI’§ÅE¥«¶ö<¦Ÿ²zu£=èAJèáê/ä9GÿæˆU¾ØÕKò7?àE_eJƒ¥bZþ-¢(Óð6ï>ý…G4r„†âmdÉRÿ/_/ºº ÝÑ·ö¬‡’U7Œ1NöhhH@³à1YL9¢Wë•G?ü £˜òJ1}ÆXöÝ9^óÔì‡yjDŒ±ÐëÛ[µj9êKºàÛ²kT¦ºÄ_§-I•ôòâ´á½[·nÝÊ?pô¬µ²u‡È (%ÆÃŽ™½ƒFÉò²Nˆ1–ôôØà.í[µl;|ö)þžCµ •ÜP±Ç_xDúnn¨ÔºD w†q am÷ÏÒ×bÁn„©EÞu úœc`ÀÚ1p²…Z@z¾t͹ý`o çj8þNªcxr ^n°¶†›N<Õ]×ÃV7€fÏÐáa¶¾ ¦q”žž&Wj~”ûÇØ•1¾KO>/fJ0ÆÖv𼑪*¦ ©2Ód™?P:d«§-²ñ=w`]dËÓ¤éèGäÍî±M{//夃iÐÆ?mG¶ /X¿^c¸6 5;àI š7CäCÔÀôëúÀSñP2;S‰¡ßJ…ö5$"AA–³Œ¤OQ±Éjb&V¥\­Àe¾|î\Ýݘ1ļ{&…m%W{šlÙ›wQ媸 ²SBÃc\*V•ˆT²¢3j¾HâäRÎÌ€%¿»³ÿ9³wý貫 i|TtBš†x&V.ŽVż¹x1ÒÀòÕówå\\,H¢?ŧ¨Á·*UÖÑJò™h2UFRxT¬\+‡rNÖÚå‹S¤}ÿ”¥ÔÄÆ¥]Ê™h#àªôá3²Õ|‘‘£K9s@©^GêZ¹¼£XÄ©Ãß>LTUus*P ›R}Œø–¡`|‘S9;3‘vQdŒâ"Þ%ȲÅfvÅÏ^źUs3`L™‘›­&‘‘™s¹2F<\ô«ç®•Œ@Éó×ÝøyóˆÖ• ‚o®Ï ?ž&y4)PVñþúµ g÷–í²âYþy~îÒeŸÞkW#¢FÕNµúø}¢ƒ»uÂÛç‰Feª–Η_—WQ(Wöæ Ü…¨Ý†@V½‡…\ÕHMƒ6C*ì>Õ¨Y©aO„ØUÀÓÑoð1æ(Í+à’0†ŒD¼ ‡B ± \+ÃDdáÆCˆÌàY ½ƒ$åàbOï@aÏêJÌŒ 93œ¹‚B‡X#’`Ô^LÈÆ#‡B!)‡7W`Š…âúKh¢ñÇGwBÚ!d½…e%LYŽ!0|!ÌŒñð|ªÿ‚Õã1÷>ø@z4€Äôú§ÄÕMø½+áé”úèœÊWvÎ=Ž™páçöÓN–®Ý¤ª…ìÆÕûeÛÏÙ:Õgá˜.Ö=P•¤ÌÐ뽩ױc%|Ä>Û7hÜ‹?n®–…^4bÉúÃ×j˜ìÖ¤gŒm92‘¯¼KtØyë`ÖÝKaj.ûÙkF¼Ê®eÃöMï²üFźõÊ“nÝz^yÀöƒ«=¼x6^€‡×.\,âÎý<댳gsgDÞ|ð®Û¼C›–É'ßLýîHón‹ *Õo଺zá®}‡¥{¦5æe>n<0µLUïªö¡÷®~Ê(÷ûÅÝNøسY·(Ë2>5\>>ºú6ÞfË•#dÌ<®Ó݃óu«¼qù†¼w7Ï_Nô«Ñ”—;Á· o±í ¿Žo½Ìˆ§oã³Wÿ~¢†½ÀE=ÇŠôhÔ¡W]Õ;|(âÌ̓öi—›OÖTª[¯¼é“;×”’‡/“ð•ÛGv¸ÿøȪ`BK<{ü­+30Fã·ïÖ¾É[o©ÉŠcàñ+dxÒ”_Ï‚ñ ;÷H&äó:9­ÏoîË®ÌñËkûñ!bô.¬ì‰Ì'ðjÖ|Ä'_‰n‹ð럇Ï(ðZ@sk:`u6 Ç Õºz-ÁÎ pt:æäÅU¯QÀ*|¿úæ];"2 ¶bù"ÍI2˜ÈÑ >’Fãpu ‡_}8øáù8Ù@àÔ˜ ¾!8 À/ Ë“èTRÞŠc @ŃŠƒ1˜ãþc= ÄHrRÀÑ/³uæŒöè¨ÐVç-4°À àÄGüÀ*ºÿPBiZš•>»CDœZÞ+°Þü}ï8yR'?¯yûžj›IïýZ½®ÿ+9Ííï?våM"¢[ZöÒÓ§Y„TIDWæ6õ_ö”ˆÔŠÌ˜˜X…š¢®í¬ï×.-'ðÐÎmåĥõhâ³áÂí«íXµûôm‹7G–4hœ¦à(ûAãêž6ñl°ëÏhm›ð#«5‘A$¿1±¢ß%7)Ä{ÀÂsÚ™oOyÖkô(Nþæàâ†ízktoÏܳuÛÛxyÌý |['ê®jŽîÞ~?,ˆËJ‰M–}ö±°¤Þµªmˆ "¢ÈcÕ¼Ú„g()ýÕ⟗½ÉÒ5[ÛÁ«ë¶{D¤ÎˆiÛÈsÕ´7V©í×%^Íݘ? ÉÐ_t½*c·mÚ•¥"âÒâceJm_õ«ëÞ$ ûø)³v»ŸUÜï]Ú¨yß4uÑÉš×ÖªÛlLŠŠˆ¸ôÄØø4y1¥¿#£ÒȈþ"˜‘»˜\'oC0¦È z¿Šâµ "ëLzÓ“·tn3 ApÒáå* Љg”!¥™ T!"’'’#ˆéäsJN¤ I"¢±îÄQ¨”Ï@íu¤&€Ö&!¯"* â ÉÉœ‚ˆêw#íhü…sm˜\êQ$œEÕhDmü ¦£HN´²?´ñÉÉÁ”zL${JeŒIâ@íÚ‘!™»Ñ‹ Ý{@ŠÐçõ‚ˆÝ0Æ5GÈ©¢‹ ÉÓÞ¤¤«øU Óºm*ËcŽ¿“Õ.ÿúí €î¿R±Fûnò?c3€´ãgÒû»à‹ŒìE|X9¹eÅ-ZwðñËДLtêÕ·FYShÔDà4mŒ3 ÷P/Çì3ÇìÛ·ïæËâTJ A­AN½•è° ¾£aVhhhhh(s÷³ùøàª4_ @ýîMXJ…ºåµ âù¶®jÅåðä²nXìÛÛO>}&•‹»õë[ÑVlîPF¢LZ¼fßã¡)šÀ}ê”7#b†¶ö–&Ÿ#Ô¦)ôY[ãÊ'ô”Þ¿|äàý¦òYrL:€lÙûŒLª]ÏEû‰ˆ>¼äJ€[ÊÒû×¾ô"4"ö}ö´113[k¡vÁ0­xùÖ¥‘u•x|ëÂfµÜ{N^ŸMß~pš0\ß:~Ìnéú#+,0ck{[3q1;Ù‡Gà§C°ìŠ.¾ˆýàù ˜[ÁÖ°ˆwn[ W4í c ±=Ã;5¬+¡­;ŒL1pH^ã˜ëÜ{£­;,¬0hdþ‰7 4§Fx®ü ˜bþ0àî§×@·àÙ€ôD€IàÑSF 4·÷bñQÈÃÐ.˜9^Ž¿ƒÚÍÀæΨhŽøOˆŒO7 V@îqym)% fðª‚ÌDE"E·jPÈuT Ê@8þÎT‘±?N%Ui$&† ]m‰µD“ª®ÜÑ'aÿ9¸ƒc+nT§ÒÅQ#»ZÆ\:Ͳ3È"ŨœÏ¹s»gO˜Ëûê€Î]ÚôÈUƒn퇅Ìr»¶ø[¿$ÏH¾ehÛua®®î« ,&?V„Iµ0ì>®¼Å}`j[xæ›îë£fw쾉Yp5_}¹ÃÀ/…ôç=@󰯊O/À¶ôÁÀ©°¯Ræ©-íÃ!‹kUk"Vƒ?2ÐZùùÃ÷6£aXäw:õðCÕ _d)dH3ÀŒµUR¤q¢z–صõã–^JÈxÃëR×È2%(qñ±GŽ&ÖöUM„<Ê©c¤;ðÍÜ~Þ|ŒSfÆF¾=däÒ NÓƒËçÓ%ϯ=‰{èqHyøù’ð²"ÆFæà ;¹tÁ’ò˜œ_BCMz·]w{•)<±m¥»N«³Óc?<4pòV—!M*òL\go<2K™û1lüÐa v”šÓÇûÛ·ÏoÞŸY©áåó´á„ðÕº²<±€'ËT‚ŒBúÇ$–sÕڭɯ›(3¥1¯.ö:î¬÷é6.f¹¶¥*+åÞÍ;Õüüu• ‰„¶uM¬¼æJ&šI¾S`ê_·ÛCþa-úšêì6ðpÀТ2ªˆ€Lœ\9Ði—-xChéÙàÄœOý[º@XRŽÕ•€x€… ÊÖåu”f†&¶¸½±jTíVp—•!û#.ÜA† ºµC0­‘¢Æ¥óKÅàî €0†WûÀÂE×AÙ:ÀNœzŽånp-£êB••( §T$ÀG= zA(e* é÷§~ôFxRlhîfmlpíÒízwùØ;ÓÒ!n†€¡oÇß~?œäÐÞÆ®ê[›/=*ݤŸjEFDD¤’Ø›«Û§.:€'’8ºÖªd&I•ÉÀ@€:W|‰§+C)¿=! „<0q*¾@)תâììS·>è´Ì»3sWPç~ÙJm/n?¢û3ãý¼¹Kc2éþ±µsÖ^ ›”®âéj(HÊTFý¹{òüã:”Ê{T¶4I•Id&DGÆ}[Å/Ôêš´'~‹¨³9b“òbc<¹ÿ‘ŒaË‘ÛF"€“~^{ð ‘Ĭl]og¦NÈR”“¦ Iy7aâŒå¿_Õä|[š2£vï ³òi"ÔٲϟËyµ‚DBOÌÏKƹ¾qž´z76´±üõ*¤1‘“³ ;]f-áœ_a[FÀ¤e0ªæ7¿ÕQQ€”×øõ ¢±à—¼[>0ç!tvßAB ~!¨(lÑM‚°å¸  5#â>äJ„4ÊÀà: §! ÝÛ`Ó!\8AýA@?@Ž 6Ò–áò i`ç‰ÚÁðñ>þ|Ž¨0ìÜ­Üа9…#W°ágÈ”hÕ" l8@ƒùû…߆ `V03c˜Ñ½ºãIª^¿”|¨˜ˆˆËÛ{÷ßyS*îàõËï¡D$ûsMc/ÏÀã&Žèé[¯Þ´Ý‰#ŽèÝå­^õêõÿý)—ýS`«>'’u}Å><ìééù(V¥üx§™_£Æm;7®{@cßFmï'Qö²–µ|ýûÿYIê)ýÚù¶h;cú?oï—N×ólÐkä´Ù)£Õ­Ó4hÀâ“Dñg¿úuÛõ>vhOooï™ÛoQÖ ®§(‰ˆ#uر ê{ôž0vhóuû¯ÌæHþöt#o¿ÀãÆ iÓ¨Ió Ð4RÆ)­ìL ‰¸øØO";K!À²ÓS“ÓÒ5à™ZZ›iWHN•ù)>ÅÔÆÞL,(316)›çXÚ^˜Z‘›jëàd `šìôÄd©RÃñ"sk[c)¤1 R9Ú[C™—˜¢Ò0K[ c¡4!Fš ;'G–•œšÅ—X8XÈ’&§È290Cc k c$OŠJF'kmµ\–˜,Uq$44±µ±àë.Jµ_&â ,­mµ—5Ùé‰)R¥šã DæV¶Æ<Ùɯ‡/¾¾uÑà‚dQÇE};”1ªŒÈ8Y)G!eË’¥YàXÛÙ‰yʸØx20-em -1V&WHÌm¹¸pûæ3Æ©ÉijŽø"Cí±U€Kùô1[b_ÊÜ@ëu*³d©Òt¥š˜¡ÄÂÊB¨ÍÔÓdíìãï2ÿb#'ÄDÇææ ÇÒ&M|ô'eÁåY}¶X6 IDATÚZI ’ß]v’¿Üg®bÜGÈä0°A ÈŒÃ'Äæp¶ª4„'€'«#Ѧ†c‰@"¡äPÞ£‘&‡H'[¼ÿNˆJ.º½j¹±‰Ð„†(åQN"¯& ï£ÁÄpuš,„}ʸBÄ Þ¿ Q¡´®}Z¥ @b G»¼" râ¡æ á xºëÉqHIÄÆp,~ÎÞyJ’eà‰Pʆ¼$s:á `ãS±îúû;¨VÇÑ\ÿå©bÝü‡”+³'l¾ú·*ž¨³–Ï¿ñ”Î`9·d¨oÐH5÷w+¨hdá-¼ûÇj¾±7ûG¯¹­gî_†·G†¤¯Ôôì›ÿï*û¯~»Hˆ84³÷òóFÎî6Êð÷Iè³øø€z&ìïaöÝå¼KjPÿáõ¶Gs}Žßç zuóoÑY` yF¶BM`"±‘‘X~7õ¿’‘z=­W7zЃþƒð7Âó«ûÿ1×)_ÜëßövÊßà?€Õÿ¤½RÈxù{¦OQ„ŠjV˜ÁT°\Q¾?èËÙÿŒY?NÝ0R¦·õÙtîcIX”?t Ñ_ê›1¦~´ÄÝo¸œýsUMs%†1&¿9­j‹é_¨ÔÃc›§4žy›ûâEDD§×LhÜÀ+äçÿËå]‰©,Ù¸gŸ¥ÏèûGJDÄ.¯ÔгíKEzCªøã{øø6é3~i‚œc9ßT}~nsp+¿F~þó÷Þb,¯„cŒ[>¨iû 4%Óv¢Iz2¹oG_¿£Ädht5Dˆc/O¬îТ‰_Ë€ÕGÒЧùõé)ZÖÛp&²º"’'¾¨ç9$íGàIôò×!ãö|öu€/îæp)¯þ¸ô@ýÏ–û¿7/xIJsÚC§\yZÌNSØ“Ë7Ÿ%rDïÌiÙ{ƒæ{w·tÛb_ØSg¾m]×cùÉG¡Q²o ñßùBDzSž6«[sÃÙÇaÑégÊè?‡¶kÚ~ؘú5[>ÏÎ#MÚ‡ëÍêz,Ý{áéÓLJV ª×¤o˜Šˆ4×—«Ó¼Ç…;?¸9<°qÏ™Ûs¾¡ÁQÆÝõÞ5k6j¢ Ž(#æ~+Ïêóvœ}òôññµÃ¼|{¼VèH~vݺz_ºýðá­ã=« ÿýý÷—´» ¯B#ã9¡I¥µl ÛMÑ¡ÏÂcR4L`W¶rå2VZýʘ&âÕó¨D)ñ„vÎ+•±Ñ®Ñ¡/Âc“5L`íXν|)eÒÇsçO2Aæ­7 Õj‰K]ϲºì|J »ô4ÍÛ·æó;7í*z!îùû„ c:îÝ÷ÈÉOŸ¾IÉTI,jy¸ ˆÀðéÉÌÞÇÃ%õùßïþ_{çE²íñSÝ=™!*ˆ@T@¢ D$¨€9眳®aW׬«®9`Ö5¬Qל³¢b ‰HP$3y¦C½3Ñ»wß}»Þ»ïöïÛÌôTWŸîþwS§NçaAÖýûQÞuŸ¾Ñvhiý4©®‹¿ch‹SKU´Ø´–»—»©F”P@DzyÒ«×%J)2mâæekF@^Ú“,ìîiY—òž#L½¼˜S_ )²šäW‰…åB qhÖ¼•¡ð F}HM{—ÏPR'¯ueTAüÝã± SZÔcso'S¡àc\T¦¨Q€[}Ãk‹¾Hñðö#)¡€ ä©ÏN=Nèéû÷4®_+«Œ òñ¬xà1±ÏŸ˜ÕoѸ6ûôyB㶦dµŽq Ï£ÌZÑÙ 9Ø!Ä»>äe¾ÎÌ)d QCg¯F6Z^ððñ6€òS©®ISôÛ¤WÙErRdÚÔÝ«Ži…ÀͽM. ‚ý½€âÓ»×oÞkYÒÚÞÅ­‘µáå¥=Éw‹Âøjæ2\TUvðlQ×Ôø¥ªð}RZ–†Aµ:»;ÖŒqÉî«êûz;HAWòàYŠ_«¬„˜<%kUÏ¥yÓ:… IÙ¥bs»V-ÆkÉx•ø±D!Ùx¶t•2{@Ÿöêe~‰ Q& =¬Mô%ï?zFƒ„`åezÇzX—‘ô*§XI‰Í\<¼jK ÃH« ÓÊ4¬©u½–îMˆš¡bœvöŒÝˆM»‚‹C’«†£OŽ­dš/ùahÆàé¹'ò¾øñW? ª»ñjÌÄgBÚÔÇí\?©ùÈ“Y‹G;ˆBLé¤ù'{ vþþ#C#1áKÍæ/ÝcðòÜuïa»c6Mm l⎽ KîEw¬-÷²|Y*Âúòüç‰éÞí,ÄÄ7Üü)rƒB'fŽØúÂÉÇ_œ—!ÞqçšoÕiühÍÀÙ‹½;´¯­ÿ *.tѹ¥}à†©¯¿kØ^P’v÷EVÿmç涱~1oöÞç­‚-õ9wŸ&·Ÿ৖LÒËD̪“_gÊÔwoxrïú"1ÆàÑîõ«ÞÚ=l¶eÍ"̽ԪÑÈ€º—¶,-·èzþè" !¶8¹G÷ ´½g§–¶¯Ü.l2ìÞ¡i"`Ÿì]½CÐëáŽIšü·¥eZAnrêÛV–q³–¿k™ôÊÜmØwmšä÷í=BW»I°SÒ­ÈDÖíê]õ¸Ì³ÓeÅGí• Í¼ab•õüÛ5ÏNˆNS™ž¿r²ŽÅ]]»!¥g-åËþƒßßßúÃLz©™è³Y&„˜ c:^Í­Ý®½OIZì«êƒç/»XŠÐûsó®jê`Z“NnºÙ07ýZ#*xŸšnëÁÄL[’ﮓ–œŸ¼œ‰~¼Ý 0Bèmô…E?Ÿ9y=òð’Háê=]rÒò i•(99óîÇï¦;ñ䪛€–§/5sú©„úeñ+ý8ëÀÃî.Õ €q{6-f-;¦ç¼kÙuZˆwýØ_§Î:øªe‡î²²×Qqsv_îYO‘œúŽElVJ¢¹ÐÞßvÏ|"QÚ1?.êe‰àØå3Mˆ¸Ëk7eö5˺ÜÀ·[ˆ¿Wùã-]¾;Ù m—VÅ·"Ÿ¸ŽýeÇ„ öÊÚM©=-•/ ~oë3QøÓ‹ÍÄèùyÖF5õö7-Jxñ†Üx3²£ R>ß:ùogoù­ëì‡l?ð½?ºËçd»p|¼#¨ÞÎ[°¸[cKeËþîÜËŸæߧo¯[iÄÄ.u­ú¡vçÍûæw€Cóüú\ÙÊ»UNâã2Êûü…0S ˜Ôñpª©_?]vblÚÇu‘Þ‚²äÔ,Œè·É‰f&ÛºÁ†©/g²¡!AžÝORZœ¾z¼˜¼g{Î"½C=Ì\º£ðœr{ïhAµyEŒ‘ûÌÍîÊÜÈÏoùÈOm6uÃZ] mìD¾yÊ(=”åȵUãªc§àôÆ ™ÚÙ®&àÑÚáÊn+¦䜻ohDy-¯ÍÊNPQïÔÛ¾éé7Z—EFd7 îU †ÆI´ °'0€âCÜâ%뷼ݢ.ñ·r¦8L¼îжí™ØCfÙš1Ý'm<‡õέaÓ1æ4òÒ¹±0Ìƽ',91Æov¸»ùl|ntÚ¢Ötk=`[EÅíÌÁí¦­½1¦cÖ:ùOVcŒ‹žo ;ü©bƒŸ‚ݦ^ÿ„1¾¶½_`ÀÀ<Ã^uE½C¼¹™[ÓnåI;Ãö0(³­gËÇS0ÆLÙ».þ¾‡£ŒÛoÖwÔòpŒÙ¹ƒC1V?üÑ©Ã|cŒó†úºnÑœ•ã B:ͼŠ1Þ3·}Ÿ…0Æ¿.:hêÃI è9`GŠ¡Í÷g'6ï¿›Á˜cô%ÅÅZšûÜ‘d&íØgúzãú”Ô‹Þ>!>‹¹¼‰˜äÙu¹c¬zÚÜçnÆ—\_è0¾âXðù݃&œd1¾¾½_@`ŸjŒ1f5Ń‚Û¬9dØF³ß«mïzc|u[¿ÀÀAùFsö öÞw+—-Ëêâï{è¡ÑÛ¦÷¹,3ÊÑ]Ú,9køR™Ñ·kº’ƘS”•«Œ1.õñi·òšáÂÒNï4m‹aû§;¾9c¬¸·ÎÃdŽ¡ÃúÌÁ¾¾_cuæÞm{ÓUÆ£84į߮c}É‹Ž-ý¢c\pa¶{ûéyeŽ-ì2íÆøÐìŽgœ4|ÍÉ3ºùyýUw\‘sÿy§Jg ãw}\½¿«üÌÝ[>2hÆFÍû³m›÷H£«Ö ­ qt½cœwÚÏg`®Þ?âÛ©w‰cœ=ÐÃ{_j•Wûxýä€ñ‹1Æ1«GO9¯o§¾ƒ†ûùvì3.®œÅ³´¶¸¸„f¹¿›3…  '…F'kŒ±ðÐÀúŠ%j”tðøáOn=8¯Ö3åo‹)@`Ö¼uƒÃó¾k8¥¿»››s“€>M|~Z4¥ÙwC›»¹º:ú °`9³2;7?KÁÅG/‚°">9ÃtóW *àh/7£÷d×Ú •F¦kj)oÞÌvœæœœÏrg/­•”½šˆM-ÄŸEöï¼¥… {›`Õ•ë¹-ç÷7µvp>ùá9@çªÕò?Ôìîé“ù%eI|"…Ź àXÒ¾·µ0 !%hTŠšBoæ6yŒäÖ¥S‘E%  ˜,ÍS@Ù§T¼<ì ŽÕ¬]çs4À÷y¶>¾ÎÏO†VÃRO_+{£[õ¸1ö‚@¨ËÄQgV®*œaM)öíN¹j ¤ÀÒʪæéL;»øŒùòE’ÀJŠòÓâ A8˜eíÑüä˱ÀqÀ^:›líÑBþ:>ŽÅ€(ac?æúéO0€#­ClM´å)Er}m+6..Ć y7³õãEsÕ®n.µZ^¡¢ÁËÓh‡™;Ï]û±HÛª®ÀЈH`ã .¾•­iâb*³¬Um „ r©cè¿Axx¸¼W[3±VWξ™RÇË©PŽ'££ƒÕä =nÞ:ûàSq¶ä*`Yp,0çN¥Ø¶)IŠÿÈ`@”¤Q]ø>|”×èûƉñqÑŽ"Yì›äQ$Óf€W{ǼˆB,Ãq¬cŠªyB ¿rñ–±îÙ™@QU# ?kDH,Ãàr [ø<¹ùÑK\M |n×Icv>:7SD‰¬¬Dß8RüçÄnt:©@_KLÓ íýÖÚkÚØ~M,%Ÿ>>ãÊÁ¯:iÇe‡ëví\[.—ë÷ž:àY[ÔsÅY«aaû7î/W¨tµ6ŸhT­\.’.ü¾ÏªkkFäü¶÷˜Ñ\˜ÀœHj^±o¹„-V3šZ”±bÁ ãô Au€ù½ƒJ$Æ»N[ $íÌƉ6K‰P]¨¬~_²oOté³¹aç‘£»·²0ægŠ+Ýu¡ðIe%U²$ýJ¿që ,²ØyÙK~#4d±e‡Áû¶µ2knr©†j5z9‡%b¡–gu ø ÃB|Â÷ÜÕÁ°Ò3G²©û'ß\¼»øBLZq¨$á¦ÞòŒ[ÝßK!ÄX`b4¦B£ÃÊÒ•KUöEb+,–TÕ¶À*¬Ëx8wAtEÑeÂÜR¬¥03ƒŸÆÑ L™œÚ0ÿ¬ñT TÏêS À |f.@4­à°´†0#ç(É¥Í?^­h„°«UPö•JÆÕí@@P­(R3¡‰ñ6•<é4]ضï”AAµÍÅ(*üYMûpŸT ‰¿ñCÊíÊ#5³0¥YE9kRzhÉB¢â2£Ä hæÝ=fVú“¢j5[œ‘IÅq-ŠP*u€M ‡¯.Rµm$–L.j6zdcF¥bÕ:kÔjK¡´–©l+h‰D €jII¢‘ß0WÀ€t?eßØ­™ª™®Røöü9r#•ÔBH®Ò®y†Èâ·Ñ:bÛþÝ--EÕ!vš°¬ÓV­T? ÿ~ò€×ïoµÔnèí†ÎѨT)——OüýÕç«?´Í:.ñýÉÿØËœ¹Ý»âFjäEŽ@™WNyXÄõ%Ú:‹Ïm ’|ÛþgiRK&#_cì, |¹ÆLÜ ú¦ûWž0ï99bõDÃc*RÇýc¯•³°oì¸ ¬Åèôϧ)¿žçvÌ7\ÇÏ+þ+6©M ¹ Éï* ¶é>ÌyÉÀ«ùlêÍD¿Ù¿“–® Zûn§Õ©{[æ4¦žùÏ–v°6“æuÏ]:Y#úÏV /áX‹Úº¾¶Æ UH«Ö)²&õ£;Úü!/_$þŠÀ†b”Ó}ÒÓþð ý –¢²rƒa*ç¶ïD\Ô»ø\ùe™—ú¹ ›Ô‚§­Æ_[:ôóïËëU.??[íCýï{UÇß…¾ýif3À€{ž_êäш”9™JŠß} =tÉ/ʬ–5…¯NÍÈOhA )²O°ïw{¢Ú»2çžæCssÃÌwl^A£:ÁàìßX}£X 4”dÀ" ø·ðg샵½«„f¯D%DK Z^õ0!Hˆ4<㩇Ÿ¦,¤ŽŸ5~a ¤DfêæåΪKAŸõã„Ù r L¤¦nÞ- M™Æðl¢5¤ñª3h~iÕ¢dÎη™1‡ ¢¢n~—ÇD¦Jlz9I¤úzÅl[Wqkh6-[™XŒ”åd¾É.ª8ıô÷¶I¯a-Röo/1þPð()Á¹UÏFB³/lJ½¸õ–F¢Uý#ÅÁ„PV¿zbXÎøßܨ#çå"š3[g3‚¼v'BkÇ„öšµ`@,æ>ï#h8f¨íÁC÷’‹: ­™aƒfu„ñ—üPt~ßþ“Ñ£– 1X’£ÕoRÓäÚßQIðhÍeçœ}i¬€U}pÞÆ‹Ÿÿè>:  òÚãŠÁý‹ÓëW‰¯ÑŽØ¢©™äÊÙ»ÆÑöÃn*gÿÑKæ83[gs‚¼v;Æh‡±¡=gîÈÛÛ˜_?qÍ8ØÈ6wþÚ"=‡þ˜‘ò¾Dÿýÿ ¾>åÏžÝúˆR§t÷tß_bB"BPšxédb45,Cöž˜{ñì‹ŠÒF"Ö¬‰x`Ô¹Yô¶tÅtéÏ‹‹‘Y?ŽMéc8yLî±å©J„èì{^äìbÿiÌÃå§_ ÌÕ{iÇŽ&Àhä©io44þ»n óÆk{[6&ò £´,]%òܾp$Æ¥,Çr˜µjèÓ´¾ì»aƒÚ4¶xþ:ߚѣ¦ü2îÇ5aµn°i\ ƒ{k‘&7á¦ÿÆcB›PŬέí\Z›áâ¸ôÒΫv6P6ð³_èÛµWç¹Gæ[ºmøö†#Ø + ¬ÞYªíÐyHs³¸‰­ƒ§¹I)Œqè”õ'M îÙªYýwñ1¬]×QžµØk‹'lô‹;ðð²otúÜÞaÃ#×|ׂe¹Ê‰j¯‘a¾wÆöíÒ§e³ú¯Ç›´r`œgõC5¯Oĸ½=Ç¿n@g5»mºç´°©k]öû[UÐ s,[3± CŸ‰=w_ßyT‰•›eÖñðŸ‹ç/m¼bÕÀ£ëZ8-(ÂÁ\‘!']·ì˜ Àù4¬»þøêñÖ ³leu,hÞebÉÄÇ÷°«ÚŸ!Èãbï²ïVÄ A om'$lº{ÕÙÏyïq0Ösн7|ì¼ð˜Þ®âÏ|¶¢ûÀ®ÃÑŸC¦ÏìzΡEmîSržnüÊÝ‹eYŒc,nýýâ!o÷iëàÞJŸýúc»öÄ<㑘Ü6¥ï´%A7{Ø«×ＺÏ5' ^5ÇU Kq‹1‰ÝÑõ-œá`¡Ì(']7ŸŸìû®ï¤5÷{Õ#“^¥;‡Ì¬% Ôa#º½}ëâÔ&¸b¯Æc©<Là5yõØøÕ|ö94-úiÛfØd/+‘mÙoKB†Ms—•¤ê›†/÷ï>ký*)Õ:–a”z°à†í&s‹Ý¡]í:¦%úÀ™;G¸ cŒl–¯Ÿ;a锎Gl <Õv>1^PvoĤտ\xÔÊNøÍäæÏÉ/4–\Ѩ4:)–JE1§PÈ…bS±äh­R­å€KdbR+ä4G˜š™ÀªUj=ÃB¡Xj"ÂpµJO³!J ’JĆ„_µRN³ ’š™´Ï‚Úü´óé ƒK¯Þ7¤õ¸ˆmÔz† R™”¬È»Á¬^¥Ò0&HJ"•Âo:¥B Bs™0§—+Õ¦R\ɘ[˜Pù_Z¥R3&(T"!BLì:·ÙYñQ{%:µR£g)ɤˆÓ+”R$aµš™ÉD†›I® D2ù¹«‚hJ¥£AIeRX…B…bS‰ôZ•FKcD˜He"ŠÌêJ F”LŒä°07æaÌÈ*B$1ÂL U•ëAb* ŽV(T,2SS øyBÏb÷ï·ÎéhL Áô™IÝDó¯÷lBU?›*¥œH%bªâä‚N£ÖêhŒPdb"ã(åJ3 !1X£Véh!Bd" )ÐkäFdf*B £×¨5:%K¤Æ”½F®©2'W(b™‰üÒ5!"©ÔÄ0Q•—q"3S1 S&WIMÍ$Àj¹ ÅR±X­JAcsS`@À©U*ša)Ȥ†0+£U©´4¤D*œB®Ä”ÐÔ„’ËÕ3sñH9ÃE‹!’HÅÒÐ+Ìê•* ËaÂØ Á[å¬Ýq÷?±J© Y*Úc@"™©‰árĬJ©¢YL DR©ñ‚G±´N¥Ör€D&!UcÙ'Gkåj½™™at”Œ¡LbbWúFkUj PÑaÚ#ûx†ÝiaCþÈ*þKRk+SÃê>9¬2å•£•C{øn>—ùm: »³Ì©ýtýßÈn†¹ç„£¾-»Å(ªò„YUn§À 9þ›æûþÐOê="‘þ³0Sø20`FÉ·=õü­@eE…ÍY~¬˜ò;7»z(ŽfèjþË_ØW;'O<šØ±wqÊÖ‰Ä@YÆ…îg5¸ìøñðåƒêÍëß3"…ýzƒÿ! XóóˆÞGÞÙ8qîÔɃö½&¬¨Ð9Œ1†[w—œv)[ÇÇdyx¹ù?ûMtáãÛWÏœ9sñúÝ÷å ærsÞ—_®Œ_=¹uæÌÙ[O’XT5Ï_–•tþÊu5 ª—ÑïmZœØ2ɵq#çÁ—y½ˆ¸¢Ài—n¶(bn{T¥HþðR¼ÐuõˆvõëÖ­ßÄ{åüæ±µo®]´î´ñ‡~Ž}û/íàEF½çÇ?8wëÙ—]ÏKºqùYANò“ß.ÝeBʼ´ÈËçÎœ¹ð81 t÷ΟˆÉ­Ê U¤Ý:y%^]?{->1åy÷³‹Gc_Ï®^ƒF³çvûÿŽ@Lô¥ß¹­[ºrŠ2@üø†‡—›Ý•MÎ ÿ«~½’•ýáÁoa}ÛuzXÀ¨÷nß•\À^YÐmܼ- Y¹QÇ–ÿpäqåÒÕÂäGÛöTМԫßùc»¬*V¸iô aa%ÀyÎÞ8©¶òY•IDAT½S•¶úÙÀÔ®©U|Ò§† så”­½Àgæ¡ßVwÂÓ{z–YX@ÖßÂŽ^ù²ëžXàü‹Âb“Ò0@Ù“]»ŽtO}ãùïäωÝXÚ9ÙBñÒ…«Ï^ð¾PãÓ!Ä¥^e2¡(ÉÔÓ„“‹µáuÊ:9ëõÆ2¤@$“I‰Š¨0Ð澘4rŒ}÷…“:6ùÝXŠVÉHÌdõ(ŽÈd–v ?–h*zy~sçÅ1klkJa@ˆ™È$⯵Ãqµ‚dœ:-ç“ÖÔL_HÚëå·ß+š ì!}÷&ª”Éñw ±‹»ƒÆH$‘IE”¡°L^X׳·cI¬ìy` &RSa‚8¸1•ô.ŸÈñüwòçd“VMÏ<ŽÜ»bű=¶X¶¾?l¶1DŒ£W —`@l!ÁÜW¦«Bò¬;CF.l6díæéÁ¿»x½?µzÙ¢Økû 0!ncЈ™-Ž×@ˆ»¾eÚ¢+å»îÜð³úgï…浌Á$VÁ’GÇÂb Ãœ:PM4ÄÞÓ‚è°C¯ƒçz=ùí´Ãˆ³–Ÿ©4Ò$ÍÙøëÂÃ;7Àtù¶m—ytºßÁ¼Æž‘µX•§æ/;^nþuw !`=eùÎÉ,£Q—Ï3híÇ°ï ? Dæ$*Wj…KŠ3 ê‹QBåYw ÿqô¦ #Ú6ø§…BbSKêÚÙP¥‘„öí,ˆ“©…ÐÀš»°`Èštû›7±¦þXÁ‘ éCB[§µùÔ ‡š¿ûŒœ6gcù„‰‡m´¯Ñ€²ìK›ØÙ‰0„0˜¹; ‹îdè:´}1$Ó LüeÇÇŠÿÕ@1Bo7} €HJbZ«®L¬ÕÓ¿³æÖMHÁîóñ& é5¥y ¯Rh#}æìq‹ûnŠѶ¡M£”U´"•ˆ#IÅZy¯:RS“Ô€ €ä ‡ ÞžÖP”ph]´ìôo›¬)¨lc¬ÈÍHHÍú}ÑAb‡¦õ­¯ýÍèe}Œž2}ÁG5ƒ¸Háí‘5'ÍZø8QÆj£y©/Sr`jÙš'/ FHsé%¶ëá,àÞ%Åeé*öA¿ÈbØ[Á¿ñÅb<<óÑ 8x„¥3;t¸Ô¤Q=ùÇtµÈqÕÄþ—0´žå0aî¸~H«V ½yÈI¬øØ}˜ŸfÇ[ÃÄrÖ½ã#6\¹uçné…cq ”½dðÙÊ€ÖlÇó-…ô²qƒ¢²åÀêhnDÇ`’#ï>?¥÷Ò%/FÌèà]ÇÅŠßµWÞ]Ø‹7rz»ñ]‚B…Y»ýÃ7ψÿeÙÔDÛ׶Ôì¡ÃüeÏ×iZW¨ÈÈUõœ2×WÚMãz˧F‡­@_v·@êÔŒn%ÏÆš)ƒ Áq,Çb €A$>[6‰1˲Æ$‰†£2®·ÄEæ¶fM9’€™/jSE"„µ’0"‚ ˜e˜q!„Š"”‹¦._³gs]p,ÃbDQ$ªx…<®(ÇdXÐX銚&(Š4ÖÎÅ,Ã`DR¤a¥håÿI€d\ܶü¥(͸Ñgø¦½wn»Êø ‡Ýü«Þ”ᣢ†“EQ‚Ê$EU¦÷ Œ“5€²bÞ†_-óƒ(ŠúGN\õ6­P‚¯µ‚åwd[¶/ ·dUÉ ,ˆ ©¯õ䋦Yqt¿ó¿Ë‘OGoš€è-\Õbî!^kxøÑÍÿg*K áoY0ÂkˆŒe:£öÎZôÄüî‘•_ÿ‡—ž¿TxпAðxxx¹áááù¯„àMÀÃÃÃË /7<<<<¼ÜððððrÃÃÃÃË /7<<<¼ÜðððððrÃÃÃÃË /7<<<<¼ÜððððrÃÃÃÃÃË /7<<<¼ÜðððððrÃÃÃÃË /7<<<¼ÜððððrÃÃÃÃÃË /7<<<<ÿ;þqiÆ±à† IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/icmp_id.png0000644000000000000000000004602213051004444021320 00000000000000‰PNG  IHDRzbÑ0…sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ/3$ƒ ø IDATxÚì}u\ÔK÷ÿ™ÝeéF@AA$¤»K °;,ìîöª×ÂÂÂÀn»[@ºcës~,±”qï}žÇûýíû_2;sfΙ3gÎœ‰ADB!„øσ&B!47B!„ÐÜ!„BÍB!47B!„ÐÜ!„BÍB!47B!„Bs#„BÍB!47B!„Bs#„BÍB!„ÐÜ!„Bs#„BÍB!„ÐÜ!„ÿwÀøû$Þr|¥ùQND$„"ÆÜÈcEõMXwÈT]òg Á Ûo= 4Ó°Xºlvg øxwï„%ljÀK†Èe™OLžåPÛ/rô´-mºH¨+|ÐÄ‚M‡Ž¯Ùïk9„hx‘r‹[3ÁQl°Çð QÁzI/¿“+†ç>J=÷0PTƒ¬%b&G{õFR'¬ßÜàÛ¢ì»@ª:2¨ßÒƒ»K5ywlLܾÜmÉÇUÄé@r%_šq$y ㇲVB@øi·Ôü ®Më{ÞkÿJW…=‰ã?ù,Hƒb×ÎÛ{9{M¿óϹ <60Iõr‹]1!ø«¦ˆHHùúY3®<Î#4º¾SÿeS"`ÓÄ¡Ÿ­†¬ˆrlÊwxÊ ‹ÆãwE[àÜ°èÄõÅ0´÷Ÿ:DÚÛ¡ý—Ø]:ÉÛ¨¹šú{áasG/××ôÍÍ]q«R[h§Þvê‘鮲í7±övhøˆ¹†Z¨ñåMqËû‡D®=t^]âã@QU-5„¦ßïĤîC–KŠÒøç‹›ÃbÌ:žb'!47€[WVR^ÿC…áëð…±NuãS‚u•/?cNEÑÿ{„cñ^;ëÃÖ->q/'Fï–û ó·÷ñ8µu¢[ÖÌm¶zˆ²jÒtqùuC Ã#Çœ»¶W‘†„T&DŒî>Y§¶¤¤œ?Œ~ˆŠ’ââoûöf÷jÑ…_€UQ\Á¢ ¦¢LÜÈcñ@W6ÕÈ>…šr >r±c-E•:sx¦õÜåÝ(D ùÎÿi[ÒÀãlÔ^?r‡xzèǬ"{ìŽÊ@Gs}æžÙWS^VQËn1êËKKkÙ|…«xw5"fFg×aÓç…ŠÑyÙ'7;Zì¿áäy Ø%¥µ6Ÿ˜àmÔèácæ²ßJJ«ë8ÀeUWq¤¶¬œ‰&Oþ;3"Å.))_:9Ñáæe>CH•–óxE¹E!;9È hˆ¤(ˆ¯_µŒÐPE†O¿*I[ž†Hë& ÿWÁøUµ(y~#ù\V‡¦kçì¨Ûz Âê3>þ\¦¬e2¬¿7 P¹×ŸåŽõ`þqêe jÑö§”ÊžÅÞý‡;ë7¹7·2Òº÷–§²×7÷§Þ¬cv ‰ÚS ({Á¡/‰C{¯_ˆ#Õeè¨XÑÜ»Û]¢ÉõŒ!Pýhÿ¦'&±} “NÞ¢Ëj5H…&¨µ¥GÏW$æ ×fÝgH³bWÏ¡Ö•ƒ8.¦§¯Gk©ßˆ¨é¿$ô˜ë¤Uç÷Oó¹½sÖE¯ôH]@졣Ƿ®r4.M½—¾¾ls! Ôt´õ;µ;NDutt4¾þë®^U4û B(¨£[÷·Ì½2ug|@kIRô4#_R3i¡µý¨µÓn¬ÿ) Óºò…Kc挟èy㘺H«‘Œâ ª=uõ[ÔÔU î0‘©ÜCWO§]xpùÈÕûï€)ë8ÈJKïXÑËg\Uæþ´—%]õm¢Cœ_ßzžf5%È”_®üAÒ–;ݧv¤µ'£{ۧͻ͉‰ÚÏÉ }»Ãzôö[×µ‘϶Ÿ“Vѹ8‰sà"—ú.óP:-z²Fäömc¬ùžšávc…#g|õ¨‹f¨K?wæÍÌ€žt‚È]v½ÐHY¥‰*!®§¯ÿóâ®cØ÷~;wÃ…­¼[‹¯!Š­‹ðriHiêèëw¢µ•7Vç&'§|.­Sìª?t€? ³æ-œ;¼Ï–{+xÒîƒFYt½+÷Œ˜c«Nç3¿mÓJëÀ‘Æ]eþµ±BŠŸrŒœ#ªÞËÔ°ÛñÅÑ3öÞiù{åHo÷“o¹VÖ}*î¶ê7«ŽZÝ«cG÷-Z~BGKCÕÄ™K §©•UÁ®8“z¢ Š@>¤ms^"¦¦£Î,·sxTP¬OGíN˜}ÐÅ?Hîý)ߘÄÄÝ™îAøòPÔÈm‹²NX¹ìØ+Oÿ NUYÞÃ(B Ù–·6âm]žRZG:B†M2lp­h­l ðµ1!)©öÔ¬mvÇmyûÇÁ(¸öëÀsk'±-x\6FçÓšÒIKçN^zá+´zŸž\ýs¹FÐlqý‘jŒ´ì·UþÊ öDø sÖ¼ çÚz 4³Sò:pdVè¤mé=Œúh)qâÂ<î”óàvúùE“§<¥ë÷µ»±yêÔ³ùz6ŠæÎÿŒü%{Ãô-œÞú´¦1óË7óÌ>²ÄÔ&`kòùºg§9¨–´ôÇ#g±) 3Dhâ& (J  2BˆHcU9é·P{õëFÏš¢ihŒRñ‡?ßP@€ª­õ·1O=™ „NÁ…1?ME&~gt|_D5%ÓVγ{ᕼ6˜bIÞø1ØÙëA•´©‰aÕ£C¶¡KY„ëCÊá¤Éq›L=‚lzrÇz¹}¬cÖ•¼HÚ¨{xp÷YùN2¿Ûw~m1%©juø˜—¡¶ŽË›”“ª˜<Ò[ Y¯_¿âNåÇSW˜…lnŽˆé/Nðš>eª÷‘UÍše÷ÖdHÞ ‹ÑFÝÖ§f:Mñü+ËküÆ•}Mž õðÓ´6ÏŽ¬p:¶ª©Nv§~·R&Ò‚¦mì|7U]E ‚Ä/'m¸w ¢+¡ݾ‘£ƒíÈü1ú¡û¯ƒo”£öª“ç>NðÕä–9[+yÁBÚ5Ü„@73¯eæÞËx…ëgϼyVÿy[¦®cö­œ8nYüμ]öñÁ.6Æ’4 ÙL5ÛÈ0Lâšfùß ¤•å¤¬wcEDÕ¡3ûÁÝ|@*xT¿¥^{«âC¤Ï/\é»0UlÛÐƵ©-y*¨!lQ«—w|7¾Hê%ŒLtš?ÓýÀÁ‘."ó¼5k+vÁ‘hW÷ [faÒéÞ†Ý)Šrwµ8ëÜ7·bZB¸eÕÃ7-×C€ÞºÊ[½û\î³qòEöŒP&À‹‹Düæwû—Çn˜âR'VÅŒxZ¡#E‰êx þšö°\ª*sò¤÷²yxõm…§ðäôtè@à‡3ô·Goi‘f H€„ÄÏȽKI«6ߘ’v–À 3(ªOÍI"rÒu·?²ü•D›Œ.Û}ÇÁcÀ{ê9êìƒã›7Ï]²ýÖyQëçv·D@$„ì<–ÕMU=ûÂ6ˆÙð#ç8u0ûæ¾Ríx7ÁwÊלCRÝÊ2¬*-e#€¤Œœ˜H#oôN±ÓJ‹Íúãj{Z€hs”l†NÎNš¿þ…ÔîSÕi¥§m@‹1«¶ i6 †úåp:ƒâ/·Z„º¨:60£¶Y—íø?®W$XÕ®xÄ8c"·W 4,¡dxõä¶_€]t¢ñ^ëg'-öl\ìZ˜놇Ä/C$bòß²VŒ¾Â”'¹Hã«=Oº[whÐV!\O´Ï_‘ë²ê,qþá‚…GÍá'ƒ|¿éb pW´G¦ÂØ[·2ÒÒÒöŽr©çµ4]tPsì¿vÝúõëׯ_¿áÜ­[ËݺH£ÿÜH¡ÑéÈá5H›ÜiÒbÑÞ¾EÓþÐiíüBÕ³˜]7ïKê#s$逢Z¯aÿßOÉ÷å8›ļ=`ñ)캶±†˜Úñ“©©©§Rϳ“|—õ¢¦ÍšK|æ–Uék‡W6·…}jïéÚOÙ^¾~þþþž·ˆÊ§ž}ù—#±–1óÝkÎÅü ¸¤¢¸ìv½Œð U±ÑúÎ;zëFzZZÚTíúv—–|˜Œ!võxBÊÊ#VÄ´TµºY~^AAAA~§çó-JÉ›Q®¶>¾ýÁ.>ûÒ¦à®PãÿY¬zç¡)gŽ)r^<,ç‡-ØßìÆI¨›N÷šÜüW­F\íû«ÅÒþNJüVòüÂÓn-}}FD#J–Ù&âò«"@˜µaÉåU#ª M°«î׉òtûÔøS¬ô{wÒÓÓ®]N¥}g$Ђb#ný¹–Wñ&»«Hâofk~ÕÜÔd½£{sã3q"û¹hKßÈÃZùéçʲžð°Ý^G‘ å>º´{_óµûLj;ù~ÂP1r/ò¡¾à~”›vsdŸõò´©GtK«HÑbØq؇­IÛ¶-‘0vÍŸ¯Ž%^*ë¨Á¿àc 0çÌ;µaÚ‡–´¢¬ŽûR7^è¨#@§@õíÝgëÍ.g4cÛÛ½GÏüªÉÔ%‹/þ_ÓéoñSQ¹DSUDNáæ§ß÷ŽµÃƒ’ì<ÆÖèß™ò(±áö½ŒŒŒŒ›™ýÍÔ?_Ùæä`3p鵇/¦Ý¸ë¦Ó*ZüyÏ›a›»F§Diä;½B×poT29j¡ Á:µq‘¸Vo?…ælúAAì‡Ù‡7ï]óB#ˆ †~ ëÂƤ ù»þñ§J[¾¬}¼“Åû^f›¾~ù/îß9¶¸çÄe´ßÏØüâbJ**¤ó‚©#T¢ÜoŸÞgfÓ§d÷݃i÷-h |u‰XâqÈ=hxEˆsï÷YRî`ZƾABSîŽu?¹û ±h[AìÔÏ‘± ß«ŸNËM^¨µï~Ø,º†NÂÐqÞ>v/ ê.ÒM4ŠéùÇ™íröènÓ¥êN³éús©S -9Ù8uùsfÏ4CŠÝ'ǺƱšyЮ«(Ò;™ZÚwpÿ§‹‡˜Ðá6-]Ž/ŸsO¬y2dSò3–ĵ4²¨`3Óýø¸ØÅgwÍœÁÁ5~÷bÇ` 0`çñóžQbCSÄåýOçO5ోæÎIlpy\ë¨D#© @I=¿Õ矬5´iHû’ufîìG¼f‚rŒëi¨ö£Ád ÞW-XÙW_êÄù¬Éƒ:/IÙpÉe´o»CƒÂ6ŒÞ`¸®ÕÒ¡• ¥t<öÐMIŠïÔ6Dvèh Ù¨¹Ë-d`¦ºhaAΚ!;ïVéö3’e\únü~Ø©ï¢}ëkw—azóôKëðÑ?ZÞtFûÔ­ÉT¾Ñ­ÕÌFXU_f'& X4JYÛ}Â׺$ˆà°s™S(¯qxÑ™ptÙœ,QA Qœ¹d²ÜtÛ×Û`I\Òu1òñÆmŽ#É8¸oßľâíç–3‹³.JØÇ÷´óØ熣š¿È¿ýá•×ÆÛo4z|bÄ÷³QµÏÆìálcÿ‡ðsqßùé¿Ô6pkÇÔ…Ù*¶ÅÿSdïY}§Ëð1ö2ÿC¦¾Gÿk–Œõô4Û|7V‡þ{j,ã_?æ(.›ÃûaoÐ$ ¶ŽùßÂx® $ûøüý饭ٕèºaéÔÿqÛ Ï†Xô•ê±5uÕ?&vD³ð8³ÿÝ:Ô}·˜&BkQV°™2'²;ùŸj‘õq¥zŽÕ¡ÿ¶zþïön.aýŸ²#ÿg¼›ÿ[]ó]æwðn~è‚ ÍBñÿ ~uïàñ¶Ñƒ×_ÿO´&ûØºè„ Põ90(¸´žâïˆ?¿²oÄ °ÀÀÀ¨¡SïçCã¦fî£ä€  >üýGM_“ÇD¤æG†/ºúö;<`íו3Çøû†%®>PÝH“ozÏîZ¿x[)´:Ni[¢ƒ"cxм±{çøZŸ !yÐœT|mgà”å­ê½ºg±` ¿½Aýo8v· í¿ŽÚ¬y.Ñ»ÿ ³(¦n_Ù/Ðß?pÄ”Ï*Øþ›®ÔoŸàï÷¾œÝBá bËÂøàÀ¿€© ·Qð¿›#ëføúîÿÀ~³yT¿¥ç¦ïéF‡þ«:ú5sçàÁ ³þ.3_û»¹Þ/ÿ˜›_ÝNþé¡»ë.ÝtùOx"À©©f@II F€T&ô̪֞;'QUŠ^™÷|ö(¿N“RW ‚÷­ ïÑ™Í}‚“ožÐ£Q•¥% ·#[Sõü‚WÌâØ«WÅ*ëâ³\lt ãc涣Wò:CG†K!BžÞH½˜õœK·ðv5îÆ—ÎÉ=[ŸçÕÚ… Ó(J½\h9;Ó2›êÌ÷hzÎÜ$§º¯°ˆRS¢‡WS®Þ{-¦¢;(:X‘RýñÞ“i¥u”¦‰K¤"‚Û6®ôžðìÔλ«zš»Ez[ÀŽÍËÝLx{nwÖûʦÎ|­ùbùôàʉ«Ùºœk¿Áfdÿ¶å¦>ƒœØÅ´!Ϩ•§IÊ3õL(—½íü“iãb[Ù€×é)'2ßÈi˜ Õ£79/¼²—IÎTq;k›G†º‹¿ËÊ,“6Õ,_µú—\‚F#"r“&A œoGö}[XÛÍØq ¯ "R±yÅF¡3téüÛ6—DÊGoÒÜï¢æÛË͇®Nž8Fä·Œ—ýÂb ©Î}ô€«¡#ˆÀúpìðÎ ºI½Nñž3{ß}Ï€ ö“}ƒ&ì"„|::qäºKÝôM 4å¶M^xñî’HÇ=YE¦½ÓVÇÍK:|å~)”~|õ*¿zúŽÛ·&$TÓ®]”f@ê£×±1Ñ¢Ð|î ÅtGUmí~òí¬*Ê*ù±OÙU½ÇÇw·¯ç¼Â'+=¤§ pK>¤K¬^Êwáù¯h™„/Z?7’N¯ý'î· ¥Øg8”žùZÅiºFÑävþ»>&¶šû½›¾„ÆhjîÅ›ïtLiÀ­t\’YgŸ“ †/ºU W/5bÂW9Ó /ó³ËFÏM¯ „ÜÝ•1k·Š®y/UœÑÏ)õ2®[4y^¾„†š¬Øè”›¶ÒD1`]ò0{àT—>}õ®•.¾¾²6rÆžn†}T¹ÏFo½-Ê ·ø©£ó )Mó>Fßnnö¾ òžœ;—™tÙÞ¦&ÆÆÆ&f–â¥Ï\{Ä ¼¯~ö}ïUÊX[½<¾Ü{ìfB€óêÙÓjþe3Bj>^˜–!»~ YóýÁúÊg/^ÿ¾áXü¼97Å9h5ÿÇ烺}ß!Rˆ¼¢³vf6Ÿk‘BÌOßg: ‘Ú?À.vß}~^VmEE-›SýÉÑÎês%) ±zœ½Qøì›MÄ)ŠjY[Y°µÁ¹—õH!"rj¾=nÀ£Ü’Dü”½ÃÑ#ª)wõ— wC³]o(¤¸S<]ξhŸŠBÄÓk'ú¹Ùéé 3#õúÝ’"V¼Ï°vr¯äðê Üç½MB ¹Ûû;D'¿âÿ”±Nÿ1Û¹ó‚ÇìÏAÄ‚sëmcfµ¢pvS‚µ££·····•‘¾CØ”""EaÕ+Ó>v‡ ²óÒ_w¹˜ßNîóÕf¦Ê ?½øTPHñxÜ´ .}×g!âTÝ%Ëø9/Lêk¸ ‘3ÚVÛãZ>©¢Üo,.•wz¹q¿éˆH!"÷mâÌå¥Üö bÁ%}C—lŸ$ ´9x3WP…Ÿ®ï ôî­¯ë½ùÀ¹·_Kù?®÷³à"…g¬‹Óðc/ùéK½zÍËæRÜgëûŸkø‰ç{Ϲ‡ÏßËaéµ×ü¦å=LqðŠä ªE!âí3ƒ¼ôuõûÅN:tîf~Y"òX…Îv¯K8|]Z;5þvrÊ?ç?5sIŒ¾×èbbëýËï¢Éùú÷¢ ÅTð éÕÔÑY®«ç¦š¯Àkb Ô1^É´±·2#i%™‡¼—^êhwµ£µ.Å‚¸åë Û¾i4Ú/®ÆåpÞ¢©%'®"ò^9¶hâàï[I ‚†kê€݆líØðø›ôL[ç§ÝŠ.ÿªõéâä¤Ož.§§NM¥Ñy% µ-qbAÌü@s9øñkአ¬üÏ?·2¤ݺPË¡èR#&,Ý:wàÛK{˜š ZYu*Î_(€Ž”C-“WοWÑâ×Ü’J¤°ãÉðÇ›kËÂ-'lÉ$ʪ®§‹ËƒT·e¢ËÆVa£í863Ð#`¡èÄ‚l†wšÀEíånªK¶§·¨ÑjÚý‚;®}¢á–°µ¥ål±V¡å®½º“§Y üÕ>:QI·ìJòßæ‰:øôBDÞ†‡\Õ^]8Oï"žKyOhPuíÚ]íf’°ú oùKÏÞYª½ü±A¦Ô»P/¿b^a{(9¸»(Âfàæ& ² †'©ÌøM#¤ŽËå·âÕ½üŸÜ Ýk’xM°ÆšÒZ”T¢KôbŠ²òKëø;3úºîúÈËxÑn|¾sïªØ¯å§é))q?¼/ç+¯.?¿†÷£Íl(˜jòî§á¹vöƒA *ïÉ•è}<ú¿°S2;õ±À^Òá¸þO» ^ëØH‰ì,“uü~£’rr²_ š¢ætõìáéñ Ó§O›>kºÔFLžçj ýóÿ_àÝ(÷ñãí;ÍÅ@ù¡Ar/lŽ[{0ÐÛ]ŠSpühŠÅä£D¢‹»2oÔˆ)‚-oœ¸ ï¨Á·$© ƒŽ¨Ú?Ѿ嬊ÝÂW®)™2ÄÅÞÒÒT½“LIaþëGÙê>ñ#ƒ|õéIÊ–9™2|»DDåæΞÚÄêÈó}Cc¢Øèët'5E/ž<üÄp?=Ì\œz82ÀÍÕ×DO[Nœ|yóè=etúx"À‚C"†-T`Û™3˜VãV„¶48dÓ‚X—á;åÌ<ÚʤâSβ%‹yœšÒ—³¿i ÜîÑ ªË3Mœ<2hÚ`^þÐÎÜÏû÷¤&üy™@'‹>LO,wÒ:sâøÈHõiÉ{Nûhõc­.Ö©SÓZŠ”Œ‚¼´8T¼»9xÖŽ#É»Eÿõ—¨š\÷ÈׯkŠÓ úmò¥Üðg:²óNœzâê%J þÛÛ³9_ûy;ÀËû/>ðhL-#+Óž*@€—qál~5eêðöϾ{êžÛçÍõ3/¥MýÍÕÛú„š‚·™^TÖqĤt-z¨HòÓ« _\¹ó5ÀÏ£õÌŒxûì鯙5†h`€/]àø°ŠoݺWP^ƒ Ò¹{/Ó^ümEþbìÓó{OÞ|eSDEC×®O/D$¤î\Êic÷P5™Æ‹Ú@àúùeOÅú—O $=ô›èß½|¼@DÍßÙJ°]ŸžfÞó­qJ¤)wëeg®ˆ„[q45£o°¿dà ê¤â˳ÙÏÙD\ÏÂY_] ¡®øòÕ›•º‰“oOEöùÔóbZV.joî^{ô¹LN]Ï]—säêkJãÕdÝÈøZRM“1sp×¥!"öë×¾”ÕuÒ0p2ïÕAk-^òÙýúyò=®kO¨¹ët‘n¹ã=ËÎ|û¥‹4¥.öVrt€Ç·Skål­õ•¨Û©§¥­ÝŒ”¥àñ¹äzÓ0ËÎ €Úôó—ò+¹:–n܇Ù%zÞVªçÎœ4²÷é*/5Åï/g½ôu… ¬¼›q'·¸’F'õÖ–FL~C¼{tëñ›<95w[ DBȽ´ó «Õìmô:?¾žú®J2(ÀíÒÙ½¬¼5•Ä øõå̼~ÎZWΟèÑÇSKEÊÞ^½ñ¹[€«6(|—“ùè —ˆj›Øöî®é—O(ë¹ë©K·sì¯èMÂØYiµþ)'ãÞ»BIe-ï>‡¯”„ÚÐê¾½J¿ó´šƒ²*=œú0òŸË©1uV~qñqÇk\qcß~:¼²Œ«ß*Y2*Z®Ž}„ÔœM9cêÚEFpâÃKÇ÷î¡*ìʯ‰ÑC¦\ø=Í üjlùΚßÙç±Eü§Ác­?óê»*DD,çh´$³…â_ ªä¡Èìßg'ˆªzïí>ž¢¨ßsgê×îL!"!Ô0÷9'#,ºüëöáøÜa+OËhê—}ý n²E!Ä¿Í_È‚ß™hnÇozOó—¯h6qôWnú¶)ó»ô“Bñš!„Bˆ¿†_¼¾Ãº¨C^í©uÏ惼Äïož{dÀsv;Ñì%4Ç<›ü«çŽßù³¥Ëø£,¯!Õ÷sÎñ¿Lì¿¡ü{]„_47šàáâÿ­§ eõÁÛ z·9ÐIÕAUU´uÖ m)ȉ!À„¸½ŸV%/vz÷ =†ÿ’µ",ا½‡ƒ™WЀ÷ØÁ %¤$G]Û² !0gÊòšÚ#NZ<ÊÙÙehì` ÇQ+.á/|â“×»4­FðþŽØ¸U¹ã’þ+W ñÛÉù_ë}Fâšóÿ4y êËÆMÙÁý)Ù‘š´ :>ëÿ½Ï•Ñ~IåÁ}$íyQ@h绤?4ºíføN)õ0HN†AŽ€­¾–"X©Ú—à2ê´áò5°•ƒ5C ½ª]úˆ¨7ô«c¡ñ'¼lù;þ<m3cÛD§v:*LIÛ=ï!ÓêÁƒ›—3îǙðÉÍq¯M¾¾¹«D 7ýÆk‰ÖMÇïΟí8/‚¾ ïé+OÕM»¾s×ÞŒôÝÏNÍ~UÌjú þÀ# tQ&£‘µ_u[i# *Ÿ?yžOkYËwæüŽøêàœ^sÝää‘[Õ(Ÿ_=x÷¥¢#Oóûv „@€Æ~•óø+£c·Q°(¡1øÒûyŸ·=åÂv•°ýFþ£Þò¯}#–wBàS ND¹!@؆BS¤dÿ „a@òK8ÈøþÌB`¿·C/Y ´œ ¸cS} 6 j!Ì" §Ÿ5RÑQ0q™×æœw8<àà^ f…ÃÀAPÍœ(^íñ7Š<Ž„Ê7³G„XÙØYÙ8­ÚŸNáÝ™©á·ú膄ýƒÌ-<“sŠV&Œ‹Š¶w ¼þºŠòp³§ùð“3ÇÆö±sö=rëCû<"¼²s©«“ƒ»»‹½«ÿžKOø_8·c‰«“£‡«£Wè¨[ª‘{ôÁ–¶Ž}}ƒöÙ­¥ëZBá¾3Óîz'—@]=tÅaL<  gÂ8öù¤÷äÝ>ØÃÜj1ß(}ÜÃÀ®„ªéï;€Ë|ãåî}ô±–þlþ‡²äŸÞÝ3J35=o]2 "ÌÇÞrØì]u„Š7׆»¸yzÚØx¬:’EÂgÝÕgÓ[B êó^g½N|åcªÒé"ålúH}ÅÅ—+ZÝy õßVÆ ²´¶µ²°ž³ù´àŽÜªu3‡ÙÙ9º:ØúFMz\À ¬¢‡ãú{8¹º;ÚZE'l(B€srC¢£ƒ£‡»³ƒWØñ;ŸêßÜð¸€*¿à㔾a˜vÀ">÷„ìEî¦#±ï,èê6ëø愈ð~n¶Ös·]FBÈókûúy8xxºÛ9¼ù™@BröÎëéMdo[0ÖÞÎÁÕÑγߨÌÏ,BÈÝyÁ{¿Ôþ19*$(pôÊcyþ ŽF!’Š—‰Ã‚\Üì'¯:€„Büœ ’’öŽ2ÈÛÅ~ÐôÍy™{†Gð´1µ*•‚Å9ZFö·S–Œïëh=xÚÖjBê¾æ¸'@]š·‡ß'v{-D`>ænåâ14§„ÝÖå©»>¾gÿk'ö Œ#„Ô~Ìêæêáikã¶d:_6Uo¯Æ8Ú;ØÛz†ÌþB ÅNZggïèéæäÓÌ­÷å„ç{ü-Æ^Z7:*2ÌÖÑ#éê+@µ/È Ï´ëÿ€Wõkûæë hø¹Ñ©Á¥ÇñÂ@°@Dt—G"†½œpM< H£‰/.‡(£ˆxÞdñÄ œ(åßá¡…œ)€Ã·!"n²G [„, ÉxDD¬DT…ˆ¸/ðz=""ÞC ˜Œˆ¨€Åõ‚´_ˆ°zgFzLÞš†ˆÈÉs¶¶I+dá³e¦ÆgßSˆøáÌ$[+Ë×õˆˆç— žù">ßioc_ÀCD¬ÈüSßvPe°«ÞÙÛÚ6\š.¾< ¾±$k¹µs¿Èû‹̽Qˆ¹ÇGX:M`#"bÊâAÎaUˆHÕÞLK«¨§óüõÌÏ—5_—µÐ½õeùi7³[×ZúÔØÚ«„B,:ÔÇt( ±vªCï¹·.dÏé»ôð=,Ê26±²½áêö¸@óåÇ^`í{WËøç¡ "íõvd–#Roï¤=üÂOÌq²Þtéñׯ_îœÞà2¢Šƒˆ¼œŒkJ8­²{FhÔô½ü;Ð!nÖäá›=:ö£¹ˆ¹·WôJl¸ ¾bŒÿ¤Õˆ¸'Ìxø‰"~bÒ¢¡kRÞV}¸iåâÓ@îÙ€!‹yˆy7:û.ADÄoÁ} OB¤9•Öv×òjðÑjS£Þ[oW "òŠ\ì­ïäUcþKCç[Åü#_w­L_—²±2ïmú'ˆXùdS¿8þ…í¬¤Yƒøu÷q>ò¨/o5`Ò~þé–ŽS÷ÝåŸ%[ÜÏrà¶WˆäâŸx‘ýÑÎÄÌuR*ÿ儾ÆéeˆeÏLͬÂ×çðÉN·˜¹ë!"V䬴u›ƒˆ˜ºÝ®›è=û0¿Ô@W{ã Í­O³=L47µ9õ¬ ±.ÏËÈbóÝ ¾Ä:鯾V‚ußÜ­÷¿`!"çÙC“ /ˆÏŽŒwô˧ðüÐ\#ϱ\Äw'¢ímøŠ]tq­aßI|~óÝÊ|]ò÷ÏÝüå~†ôÏÐ3 ¦ƒW,<º 7Ö1,¸“ƒ$¨‚ý‡ a#¸Ð¡²º¹ôšdr€EÛê.ë‡çÙY0ã&ÀÖxèn;f ,¦¤Šÿ`U0ù6X€Åx…€Š¢í¹ …O_ v¤w¾žyÛ©êåÝݺïnM—è¥!ˆ ×E¾°¬’_/é¬H±öÓ.{|á[Þ#CRœN%Ÿ\Y]Õ·<¾…p÷-NÑ=^SUUU¥îàÛåÓ«k5’ôToÒd@𠉨eSˆ¸““Œ(¨¯§D¤š¿û$Êd»DåTìÌ;›@Õˆ|kÙ"D(¼ÿ¸ÔÇ× x4¹9Ã{ñýek=“/ï>ʬﮩūªªªª–q··¹›v€hY:™¨‹ €Ê”Y1gO9rä¼-ç†N!IDblÐêNLUú•ÇÃ=åJf¤iç¦.èb¿÷Ïø¯ï^åääˆ0%ŠŠË@µ›âÓ›¿—×±8ƒg혢œ¦³ª“3ßUV×ð4|Oí™I`±yˆ\€Š§‡ÁÅÃ'@MáÓ¦Šµ²PÇìi#@“39ñ¢üÚŽS2¾ý­$««ªªªiÚÆÒÞ€tg-GKCD”6›¼î·orrrê)©Êê @¤(@.›.ÕpÖóî]ye„«~UUUUu}¿I±_®áÅŽêk€ "×G¢ãü «ºB]a1E$æ6nv»/3€Åæð8—¶§¶×ÂÊ·>; çËmñM^Û ƒH«g˜ºéK@Á›{U*è’ªªªªjq/o·‡Sª¾>ªU” ׺^Ô“‡'Ô}dkºIÿ³ñ¨×H—O™Ê‰Z¤" PÉ@]\R @T{ÛZk+üýØÍ_ýð ç5€šlƒ÷ÞÛFà7EP 5Š’JR-jÊ ¾ððÇæ†ÿ'“@CM`1%KR šo¼ª$¥Z…’Û ¸Š%%#Ñš2%ŸYå/Ió‡g”´Mµ¸¼«   ½»5t1•‹çL;Þgqʼn^¼c¤»ú»RÚ» ±^òðdhÏóyË@]‘ÿF!ˆÊJµ¹†*)Mg•Ö4XœêZ]Rê§s!ô²Š*7&Ÿ ——•9ÇKÔŠˆ)4¬“A^ŠY^W[[Ç¥Êò¼¼}šJ*; š3ò5yêÀ“Š9i—¸Õ®>¢»R{Ê·Wkyaµ„’lkÙòñõæêˆ'ûe¦¥RQUOˆ8x­¼DßµxP?.êd|`ëTqÕÞ×S·L3jsn#:uËþ~fù>ÈKôEn|ÐË”e]¬§PÒªOTdàq%'·œSuÀÙã@SIª NpIRùd›ß¨$çðvúê55ß[8pŠy"“ú{7‘¢‹uâG˜ ‘­š´X³Ö5ô%]DÑ mYIÑʼê)gWßmÛB,®W–mèfyMþWiˇy|1$bëSSõP® ¿¶ºº2¬«ôëÛ·‰ˆ|5.KšN“!-† ëSÃPU¼qTÈ*IÖ䖈ˑ†Dù§ozþUs#¢ð¹ñnáÉ-ð¾FMùÙâ…üO#UC>š_è¢ PÀâ‚$^ðnHóÓ4Ý N¿Ï>ðâ@w“°T‘«.­l „ˆ?1€ ¿£€ÿóÊ¢ñ.²l'B${,ßs–ÇaÕ|Jsa÷èªn'ª&æðÎÁcÙܵrð˜ÿ¨-Bmq9­õS¸Ê6:õYw+¼eÊn}aë*ýôÑQ‚DNg¦QõÜ3ŠûM™=­!™S_ @ +êå$¥$è4õŒÔ䶌ðÿ%ë›­CƒÄbVRäÜ˲ÌBgéÚ¼BÅÆ^jŒ5Ò·*á€ãÊ´™v2ðàó |ÍoÝ}è÷ØÄz{óôþ“tÛ:'œ©h¸éðe.»¾úÕq·¨a¦OÎÒø¢Ä„J­ÞqÿÛ¥ý•ko5¼Kª¾UÈP_Ê «œˆ†SÆ9ö⢘øb/Ÿ¸ÛtÎñ^]à ëÞ(îXùUéœÚ­Wö’þÅQÃã”rAYHIe­œx‹K‚šŠ¢m[P&/QW\  @ ðy>m¹•Rx„Yf “ )¡D$än\:-¨e¯¯òx• Ñ ܹµ '€eE5’êò¿ÛFx3ºƒMøp æ†sBðXˆÛ?]zB d¿ƒÕñ2Á Jÿ±¹™o0 r2`ÈB歷z‚Ó" V}¶xÀÜùà±`r$€® «åìö(+êkwM>x ªÐÃÒâL>û§†oÑñOl€¯Ž|T1öQnç²úí¡ð9@•ÑìƤ¸<„þÓ‚ž­žÂå”óéºäÄ:`„Fi?_·Š ŽØ#Á_bÝ­ôôJ€gôàô­ <@ÈÒ©® À*ÿ–~ë^Çͤvß`¯Ä¹/6MÌø*ïØ[…?ðéX>kõÀÉx|ßÌÐRÉÈ‚ùîý¶ ïº/¾ãÊBàÝÝôœ¯uàéØùQÊéb¾ð©¢´JN"õèæõ¥­ös%íÝŒ/l]Pý]-·ßýÚh 銢Üâoõœ7œJ€5Ò'è|¡‰‰‰©ÈKs¸$/kkÄÐUÀ`ŠÉuïFãrh4`WÒýÕ€a)³ÆT©Zh0 šç᮫ù¬Ï9¶{G¢¢8I+ãlm\]m]|7ŸÌâÿtæÏEŽ¶Ö®.ŽNÞá)·øO°Ö­šejnåìâµ;y§¡uH5"rÞöé©žõ•…È:µq–•QoÓÞÆ£çm­à …˜{뀞S ¯UÅ%ºëÛSˆX>ÌÛÜÈØâ@N-Rrkû;ØGþÙ­ÄÂ,C›€Œ˃}½¬ŒŒFÌÛË—½ºàèèêfce¿úh""g®•º÷Æ7ürçw,p³µrus±µ÷\w0‡ˆX7ÀXmõõŠ–ìSX›·bÊ@cS+s3‹YëO°)Ä—Û”{á"–¾Hõ³5r÷ð =·°ð‰Ÿ¥‘ÿ¨EON ð±spvu´·‰š¸äS RìªÍóFÛÚÚº¹:Ùº']{Žˆµ…=, ¬¬ß—q‘¢°ò±‹¡Iâµ*þ½aêÑj=¯Ä”Íñ¾Þî½Íæï¸Î—ÏÓ+I®ÖÎnn¶KJpÔ zIDATvnkÞä!Rˆ“æj¹ AÄÚWB]Ü=û ö©à]˜±GÄ$D*ë)†&}§&U¼8km¬çàVOQXútfl µ½“£ÍÀ¸Õ…mdˆ‹ƒ‹›­•Í¤eø»•o®DûÙYÛÚX¹†¤d}@¤ÇÚ¿*ÞÁÁÙÝÅ!pÈÔœÜjD|}8Ô$dOý/ɪºÁUˆˆ¼½A†ŽsnüýPñ¯˜›ȶ½N5§PT‹Ñ'˜“ondµÿk‡UwpåV°"ªƒL…ÈC¬ä´xêµù™YªÕ ¡¬EÛP æ&‚‡¶?Pí¼ÊLµ¾R\®o\-ضÕÐ<ޒРêlÁE!r+}í¬^”Ô7.Ì2°ò¯lE³ %DµI‹ ÷w$nÞÎOʶÝ·C¹ Ml]–ÊË°rmšL¨G«u\fàOð%øØpGl÷õßvøjGk¨í/{flåYü£Vµ•^;ºÕ¢[©–‰ívÕ¶|kÁ¶ìæfB É_†î}òß}«¸åÙŽ6x`«0Û÷·ë ×ë¡ßNh­àpàòè"ÚAˆ·m“:~ïöÚ0RŒ&:ÍÀ6!AÁŸÚ 2·|‹¥1‘â~+(jëQ3$•d™­ µ©³5‹Øº®¶¥øíd}½Wj;©U[Úáb}ùôõÆÎ)`J餤@û‡Ä<~vÂÿàT|ù1Ã7ZE/™=к¹wE$•Yð»Æø¥ý_†VÄò„ŽðF¸Bñß2¹B!„ÿüíÅTՇ؄Í붬’týk¿‹[½bÓ…6j‘”§ž´;v]’…<Ô>Ÿ4w­1€@hD©‡í‚¸pqßúS7ŸŠÈiÄNŒ3î"öŸz yryÿî“l†¼Ç€±–]™Üß—Ê1¿Oü]¿Ý#„ÿߘwûÖŸÅæÖ?ÌyÂÁv‡6™øàsu@DZ5,´_CŒ‹!vûÈ¢wu¾œÕѾÙ]CâFc<žâç<úðíОôïwþÚ¿þ8 !É‹b¶>”HÁ¨ù¼bDÐÓ5çg¹*75Ø,rú [Ït—L'e†Ðà!ÄßœÝ~œBÄÿ×Þ½5u`q?7Ä « bqðQl"]* RTXŠEq¬¶vKWѵZ·,*²¬ ) øØ®,«ŒOŠRFAT¨±º(H‹²ÔWx¡<„ô1ììôü>…dîM†¹÷Ÿ“{Ï=÷þݹIî…ÂFÅ"¢º+'¯@Å"Ëâ@Ûƒ|©ä|Aiw÷c7/ÿv-‹ˆÍU×Ï_¯3ž]«=ñ᪔¢u¾³¯(^8£Ý|u÷š.D]ŸÜË{aËwo_ÌÞø~ô%D¶©Tš_Ù:âS©ŸÈ$²'òú/³ ʹg*d¹’œübYŸõ•³¾|¤1ž ¬(Í»ÝÐ¥êzœwñ’ŽeuÉ‘áwZ†Î^ÊϽã’®C쨻™[ZÍ-ÒWuÐ}i´ò§Mƒ'„ü„K4†©>¹)<áD×€¦£áF˜¿oá£AP¶%î?¢`´!!ï–Õ·«5[ÖE˜~FÉËK2KîrËk»ëÂOµ ÔëØV☤Ðè@S !«kìÒp¥Jë£ë3àÁ峟—·ŒXPÿTº?í¤ø@ö³oû@·rsÊé~-[[tÊ' \<•¢8I|n4ÎÓ½‘➉6Ê·gÎIôˆ&;d¼æÀ]¥‘Ýlsòñ2h¯.;]x›+›,çnž<øEÍ“ç C‡Õ “êQ› Úsg¨/¬³EÞ­4Î:¨‡¼öa×ômã5ÏKÚµìð^!d¢Þð<Ñ âÞ/¯nXõ G]ýct†4M_Ñƈk|—m>8Zç"ªoïp´èe±¿ñšÈ'Dcx)iK஌re“ÌÃ/˜ëkËr]½dƒ"6,Ÿÿ;WѼ Ÿ ‹¡¬>y…Ta};2f(øï'|t%ò÷~+Ö)¬Ú;Z kŸ‘Õ«E>ÎÀXÿfª¡~ù®Wè« »«gG¯|IðCuÄ%H÷­5dS£M üKJRbjÊv]yÖñ:Íè}y¨›¼h’ 0 ÈŸ~cÎW&ÆÅÅÆÆÆÆí~ÐÆû¼Þlºû<¥âìc|š_¶fÉðÖ¶¡«;ǹHoþûògûÚ.¥mÍyÈŒ¸Õ<Ã,šÉ¿÷u}92F‡ŠÑÞ3¼ìÊê®æûY‡Š¿ùèE˜5ôªV<Ã^ú ;*?Hª±ù$1‘ÇÇvV˜{(^ºõ-ωÀ€¢ª±+Åûî€okÅåóâÏÃ,ù`- G×ïJ[fôF#¾©qˆ¦@èññŸ-x3‹mQnâÏÿñ„Oͽžä#¢á½‘ÜCÞ”9oäHÅKB·t¯(šøý>Ds¡@ó\C› !?Ç9vƒƒõÕ¦æB‡Yž;ögm]¿vÙ¸/gþ½»ÍÜÜ×)7áó »3N˜uôèßW½¹,ØŠ§öX2ç%3®¾ÐÖd´ZºLJDFÇ&ÈjY5Ùá©7Ú'tœâÜÓÛ+´µ³³µµµ³Ó+UæB pòÛ6Øxô‘$±Û;ÂU߯nä¡ó=e­ ƒu.óÓc\|ë4[0rŒßòw;ûS0Ãï]Wc½<ó}ÒŠ/¤™•µU<3›¤œ27§ 0qšÓÓvÕˆU™Lzýí +î â¸MéÅs ²nÕVó-')•Í°ÀcºkïúŒë‹_±çZsøã­^u™ÅÄ÷â³Ýo\,¹s_mbññ‘‹‹=¦!€¥ÃÔÞÒ&àÿëž}Õ«ŽxÙ¨ÕŸáÿéš©þ{ÿ:ÒûVô‡±x³Ž«Ó;Ží^ •‡ßÞÓ¹±pïbÚ\ùUÄñ‚±¸­¸ñVóÏß\žZV"5çÝÏœ_Kuó?̸1 9B(n!ä—@(!7„ŠB¡¸!„PÜB(nè_@¡¸!„PÜBÅ !„â†BqC!7„ŠB¡¸!„PÜB(n!„â†BqC!7„ŠBÅ !„PÜB(n!äGú/+Ë ‘Æ3IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/seq.png0000644000000000000000000005545413051004444020515 00000000000000‰PNG  IHDRzvIwÏsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ)˜«DÈ IDATxÚì]e\U[ÓŸuš”P°»ƒîE%[lÅnÅV ìÆ»°Ån¯-(¢"Ýuzïy?œC8 ÷zï}|žwÿ?ðãì½rÖZ³ffÍšM0`ÀàŸ‹! vÀ†Ý0`À€Ãn0`À° 0ì† vÀ†Ý0`À€Ãn0`À° 0ì† vÀ†Ý0`À€Ãn0`À° 0ì† vÀ†Ý0`À€Ãn0`À° 0ìæïFi¸uü-"¯«mD5[V’¬ºÉÿÊKDÕö”©+´V%–'sµ(^¶´ŠeTYþY:ÿvã^fÊ’­Ü ©Ë«æUuþ¯&±B+ʦ­ªÈ*éþ ù‡¦HÑ­qÍf ŸmàVk^HOø¨Ý¨¥&Kå9¢üó§[5æþ¤B¿¹v`ñê°/YBYF-m¯Zj×܀ξdm3SÄãBJ’ÓâÂá{ÞL±(èæªÑmÕþy=M€Ú7Îcã.ÎÌñuîšZ@—Ì Enq‘ÆæW=8wm:Œ.Ðà³TËì¾þùêúÛ'õßvï=¥ì$-§uö˜:w†scxt|ñè•çFmˆ riZ’÷ÒÐ6›­\g^B*º(ÉÝ­{ša·7V³´É=³Æ“£?®S-ªlí·ýqæ¦Ë7<ë•’ve×z ³âÂÜuîFÌŸ¸þ2} ý wïoqø…D1ý !ŠêiŠ=æØ͉íõÿ->„(ÿV5§PxyïÚÐ}2‹d4²Z;ö Y6£© {°‰“`æ®°ÁÖ%éåùÑNf½G\LÑ‘¹0ãö©ý;œù˜ZÀbiuvõ?n„UKcE­é1û» X×~À¢óü•#€„ì=`í…Ï+®ßó«§ñé“öÒ@T‰°óÒsë•Mç—Ný„í†Ü¾°X“ "gæí0‡¹‡oݾS[ãGïæ®_4U¦Ò”á€ý·½ß6÷Y¯%`+†@‘)ºéÕWgë±vÃù§ØG³†¿úS@8f`ÔíŽe2!yá—ñÃ×}Vó¯7…$_;lÃÓð“7>m÷Ìbu¿ì¥#úxqºáòÙ5‚¯=rÕ«…Çg±´Ž„ϳñZ¹Ï¿Çˆæ,³oßcQèÅÕZráæc‘ÅÂË3ú…Ò.w7—HiÂåH8|Žî¤KO|¤e99›Ë¾¦fcó^‘ÛeßeW›6läÖmu€Ãèêhœ9Óåqd;Žr-qµjèðKç Hµ¯ÈÈ׺èÜÖ¸ÕA­KfG·F ©.UøšÚ:©!ƒƒ,nì0(æ+íš\F펞9`À¡Ê’ðx0mçý °>žÞ0&âiäñC†|‚@8<Þ¿)¸BË-粄z¾2`~t»ë÷ïmóò°Ýz)eÿÐa¾SÎÜÜjHˆ¦Ž®€§º [G· @Á/zù¿“·Z¹û¼U#]JVx~ã´ ½ì§Û8°6_G¯þ‡k·²çùPð†Ü'Ñ utu¸,,_[«þî+šòee«áñ«Xtl=Iέ=FL¶m¨T@8|]ÀÒÒ©Ñ{ݱeõ$–Yk<`uŽy=øùJë7ýNÒL*§°ø¿“½„õëû €8êÈÎ%Á —,[wéy²ZYNøýÙŽµË,Xvò–2[ÑåË–%¤&F¬ ^qüÝîYÏ é½KƒwÜÿ\’SÿdÁ’uBHZ=oÁ™D ò.ܾdQp让4úlÁ² ByÎñm«æ-Þz誨‚ÜùðÕ·&-lLjj²Y„^çá[æOëŽYÊ4>TÁaDd5:Ýv×Ø¡©BrcGŒ ë¾ò€[}ÂãóÇç°°Ø„ÅŸ­ä"Àá±ø|•2¹Êw@‹Ïãñù|>Ÿ'h÷Y´ÓM¿åDP\v•Ë+×’bíYzÞq|`7—vWWo—ýeYe&¶þ¥/6]ˆ­DF <>·lø|>!Àáñ€ÏãqØÀç+:Êç°H¹i‘÷áÁÖ5˃ƒoØ},C„Ju-éÖœ•{ Žm[5w~ðöƒ—%Ù.]±*¥Töç“!«ö<¥+ÝAè3ã=z :pù9©TÓ¹›ãàmÈf± °@Ðú†AÃìiñφTØä™ï ìÎÝ9ìв—ÇÓÐ6ì· bËø®vNúœ+U’ÕÖºQ̺«y é’Ý[÷©™KSZ¢JC¶êäR‘M*BB×]Ò÷ÈŒio‹Ô«Ol.ŸpUæŸÃGñ?› áðXžb˜Hùa{gö/ ^¸hñªS÷>•<||:dý¹©¯¯®\4oÑÒµwã è[ç­¹_:õ2_Î_¼úkžô?Æn)ñ³ÞxöµQÓVÆyëÆvÛrís¹$)÷wÙ÷œ'­iÒ¶Þ‹£«¬Bó‘UpõÚÕµ“æ>ÉÑ4®¡iÒÊX(cµ4µèXO¯$'W¿~§F™L££] ÈŸ? ç®±5ëÖKv¸§ã !Å’¤\ºt!ÈgX¢^§nö&O,¾ä¤B’,)§M“Zß¾=yó=“B l»Ï@#¢ !‡«†‰*¶NÛ‘ »ë&m»zhã2Q3ŸižÍ¢êOÁæVßpC#.£Ü’¥âÅk‚~œÛ}ú›¬â¶@„1—#‹ G™×êêâ––p)¥@NþÃ!„âÖÙ±uPÔ¢yÏóÕ¶ŽpÿD/Êž{Ö©ÿÌO"Íͦ<>îæ73›B$_/]º0gаcóŽmoï[BàâªÉ×¥­öiPÚ€Úž‹'^[:jœsÔ}•ñA$êÊ¥:uìèñø–^ö²M[Ÿ¦®q­ÿåZ¦Ùqb_³Ûkm9±aR¹™)—$Ž0SÒ]ZfØyâ¦ÙŽÕÜ Xšµ­ÜÙÓ³#†ôNµµ‹x2µ3X,ÌËj¿òö †\hœåqà!Œœ¾ØCsÒÞ{#­€ðÞ®GúÎ[;Uj¯#€ˆ¤‹×èð£è¢ïëçÎèšR«½Ûú•sZÔ,ÑÆY=×¹æïçÛý2 1/2²Å¸þu5Kl]ðtç¼^¸¥+‡–æ (Ira®¸AÇ6JHñ¨¯™³±ôî‹pP Õµ·KÈž5‰Òfº¸\Ïi».÷¯Ÿ‘Ý j¹ZÕÛ¸:øKf®œBab6•©$¡>~ú*kÀùyê°YRc ϾìT­š5€Ò Pj#(Ye ºz/¥‘‰ OÉË7_¹ÈÖrm¢«´5u¬ÇÞòè;˜4);79ÃÖ]ðHx,téÕÔ—ƒ;7°ðß±¨%e»o¢U*Ê9µÙeõÀ¢¯B!ÍÆćߠoc¨ŽhCI‰óàqÖ5d%sBÎ6,^:$3æJ—.çÆ->«Nû®ëÃVtÐP)Áeð´Ãá>«/~ñnUV´!rñT´ËÎý|3ºx/ß–ïºJ€üµ$¬Ùkgöp™¼ãíèqÊÚÚÍ18F›U¢Ð W¯y5kADƒ&VƯÃæOÝ›'’"ÐɯužCh #ûº\ŸëÔÖq¾À,(¸†ËŒë™ƒÜ ©ý‡£íœ‡  Œ1¸r³0K»ÑÌ-'‡=?>xÊÚ‹úLõnWÚ–þ–SW¾Å½ š™øì¸Çþµžã6¯ Ô€f.}ÆÚ5—*ûGhÑו ×)Ø0"°Ø¬ 4eñ9@ÉJ5›€–Ck[[g}µK†YòôþÓÛN;Õ§`óÌ‘£œ/ï®É ?i0-‡æVvNÆê{adâu~çÈêÖ³¶ƒKû:å9.¿Á¦£\M}Ö5ª¬í35ru´TðcŽÇuQÎæ\~5¯_'¿¾aèÛ,žã4alß{ûU-§šÖŽ5ÿÒ‰ !äþ¶‘ÓNŒ kÕº.—#]>âAi ‹]¼â§l=«ö­5¢Ž<è:®ííIþÓ{CYCÈËG­;Ã! ÆÆQoÎ5S2 á‡WOm[õ…eÓu¸·C‹²ÌYajoÔº£1ûm8Ó¹0ÊkøÒ›¯¼{ub€~3‹Òm¦@o- °u´u¸Iï¿Aû¦¥M@’ö$™ÝÚ¤t\eݦ Û>us‘ÏÚ“›nŒØ4 P•º\3{ûæ‚¿2.®#§†Ÿ°þòÇ™µT¦†Q{+;‡zmµR9ï{»Òq8n˜_-~Ò©5 bT?Rf›'œÀiž›Ýþ±,:²]dßÓ‚_Q<ø•©‡Wï’¦íBçÖá"õ¬ˆf9Õ¢®>§ ó¨u3º°¡lS >üY3Sc^df. D&Rä’ ‰€G€€85[¤ÛÈ ì̧Ž¬œEü×hÎJ*Dvc³Ö-Ÿ%½ЯB¢%Îlž£ázÖ§¹.{¡Ux »ŸŸhõ‹£)Y1 4 Û5Öµ÷¸ÖOý›–çbÚíFúvŒZ·:l‚G)¼R¢•GÞ9 œ³u†ÂˆH@²ÄÏûâõËý:ùÿå ÌûNk¿ÅwÕù·-4þ®#Óôð}/\7Ý ´3@B%ˆ%?³ØAÞºVÔ-6A{€_ËòB€õàE1ƒ•¡Ç'×Î =+áÕ™¸rÓ2»æª‘ç'…®XÓszR‘D³¹U3757 VUv7ž^ûº oß:6·ï|¢,‘”Û—?hÎêR[eñ·êeÈö»væàiyÓ›M´Ê³›_ØÈßdëÎq=Œ±X1îï:úòæQžVÍM˦7ÓD@ø.g‘Ÿ2ŽÖãúÔßz1™œ‰ï5büŠlóë¦b>O*“²¸@òc/œM-¢„”j’Ú]º´¼³c’Š…ŸF tûCNÅ (™ˆSá”°@Z€,·‘n¢»QÇ>Q@²ž¸[;Ë,†l¹© ÃÓíÛRëÙº©ÌŸôŸ÷/[X à°9:$ïåý—oëZ8(6- mõÃr9dÙ©Ü5GBuÙPkÅá5§„?L«Ž7›@»Z¯éŽ ¶/ÄŠÃN8³·.”^ßö­8óe¿yŸ˜áäÕCaÉ&„L2‹>q1©x®XoµÔl–ñæ3_¬™y=W£,åµ¹ðW­’5²”ÄB @ï š‘ÆæI„U[ÙIÓᓾ3gÁ1ÿ)=Ùê$¦Rujl÷ouBÃÝ¿9Ю9"–£!‡ÏysÿñÚí'm~fôÕRQ‹? wÁÚ)ü§Ç­M(Têõï®î ÞÖ¶÷¬öFªª\‘­õ·oÙßÈd€.UqÓÒüE"bV~y›·(õo@àjhýåQð4dr¤?8üâ#‘ѬŸ8€›÷óÍÓŸ&ëyy6ûE/½_“nºôònöž«gŸÖú˜¯Ó!|Í Ï€]³$[=¤" KAˆé+–~ZbîЭy]­äïéíºŽµj¥©b±X®P H —Ö²@k×ö~sŽÍv+é«Vã®M w·vqžudOàêßÖ ·¯aœŸ“oÞk€¶†È׬wÝÇ÷° ò8³.Ö)£C!â”Õ+S&-q1éÂÓÓ&×];ʸÖ>K—ûÔÁìWÈN¶6ç¨8bÉͼl™ÐjèÒã½&î6ÓSLdÔ¨ï8Ç»ýô…³œ£"ñKÌ4b1-+gºA¶8ØÑl©Ê ¤¼™ÕØ#[ÇÈ¥‰TVÖD5.dÖeûá{|÷v¡)™X,-õbÖ1›äë[qáW¿š¦U~V|M—OSü¸äÿrʦ§«¨K™÷ûyËnqÙ’rÕf<·pØÜ 9••¦¾ƒêZE+]¾;tÕ…V|YêÿQ­Km~úgíWKuUaµ:Q¶m?ïiÅĪ£ø¿ë»ÆºÞ/ÿ%Ä‘®ð´»“ +išbVuD +æ¢+ÿñ§&Bq~ÕÜ•-‹ÊK¬ºåW«ºa)7çiD¾ífæx?1¿òYV]üªí¦Ü®BÔ¿&Uä"¤|1e«¨ T̨þ±jF£V&­Ø é€jé D]«”½"å_ý¤L5SyB¨ÿG]]å~õ¶îJ;7q —©©™©¥ÃÈY¡qYe å*'Tvœ•¹ùˆí„Å]JBæ^µkßvÈ‚Ó¤81!¿cŒiÀLRޜֿ½I[›Éé¥Åin‚k—Ö ¡ ÝíÆo:¯b¼$9CÌͼC Ÿ7Ü¥ÿ49]Î@˜;ÒÜ|ÌÁ?Ê"IBÏfíÃ!aëˆ}fÂè¦ ~7vƒ(^1d0·{ÈWCøwDbl¨¡¯¥,®@SC[—@_^9ÆÝwba[ÿðc'#ÏD†Œw?Ø-0TŠÀO,.Oà¹"âü™Ó§OŸŽŒ<åß8q„oŸ[Y6W àW¶¢WÂ7ê6ït~ð¶ƒçÏ‹<Ö!7ªoïQ_â°q={_×ÜoÖ©Ó‘‘Çv[s_öóìúGFé1@ü‹`ÔµþÇ‘©PÆþÏÖÐЉ½¾ëZN™›ž€¯æ¢_CC‹z²õ*’h^„/(® òù·œÑ‘ðŠx.ÏWã,ÁxœŠC¯]S_§®.hÖÒÓÑÕbÖƒßÝ’wæÒ'ÁÄ1Ý@žt/üÜs¥ž;vðàÑSÑ_ràù3_yðŽ*R?½8süð¡Ã‡£n?+D¥´@‹2¯ž=~ð౧ñYTê"ŸR”$óÌ‘1ir¢Ç•°["¥ZP˜xwõ…èA«¯Û«eÓÆ 44stýúfG£‚'iJ‹"hתW»^ýúõë5hظ߂}ŒWnŽþy·@t?ò5ï઎ÍÖ®S»~㓶çÖüów‰Ü´#F¾æòÍ)~6lÔ¸uàŠCÛG¶y¾ÿ@^© #:zÚnÊ ‡.5Ïn=¯pIS@ÈêsûÀF€ˆú&/5vþD?Ç< ›GKùµÚ;NÛµÀ ž\-ªác׌_66M=ÿ­B=¶Þ[<ÇK¨D~Ýí;Ǹ ã´WÓTš¢Ê½yM˜qzð7±\ą́m5uÃŒ¼kÇî™#ÖÐBZР^ǽûg³•aY0ãÃ-GGÇÒí¡ó¨ë{SuýD§Íl¥ &—5~plËrU?Ý8cr|Ë·§V1ë„Áßc üuWõg'ìjpÿòlÊ‹r Q_O›Pù9<Ý 4Yažjhñ@"*KdÀâp55µ8DqnDåçPH4tj¤Ÿ ð<å{jÒòüü¾–ž ‚1B©!- %R9°Ø¾@ƒÏe+LT~N>G§†¦ºý]. UM·,N ]m¢RE_GW£ÂÞC¥Ï˜´aÝv†Ý0ø=Ø "Т÷^=BÎŽ°«ûׯgÞ œ9|Ó[(˜ïåñÃ{}D 3BÿA<\3ér£ðeýþ×oi3øï‘n èѧ¥ïOÞÕHã¯LKÅV|bIÀÖKquÛ˜ä&~äÖj±-loCTâ?…’øLd¿»QX ÄB!áið9¬¿8µÐ±˜¢‘—Ïç²YÌDgÀ€a7 0`ð§ñ«'S@Kó>}ú.févl]7î]œA½–ÆzÿPÄbBUbOµÒ|ýƒÚM›Ôù]î=#Ò_>Ærôš52Ö¬BµÉOÿñ#=›"<ã†ÍŒt¸UtŠâãâ )nÛv-“ãcäšMšÖÕ&s³‘"ÎOÿš˜&¥ÙuÖ¯©ýŸÐ¾€]oã P ºµ ] Å×È›Óo§¢ÿ"NŽ¶¶²ðœ¿_.Oëîjµçz"þC ±àÅQ~¤U¦É¹½Å{T˜¼Ê‚¦ ²™´ùþ6 )éè¾Ös÷ÄV‘&ýÉV[+÷žýûö°³±¶½W„U†ûìejæ2rÆŠ9În;fÝ úŸhyâ™î–æö.>½-Ì-C®§ÿ'ȇ(NÇZÚJsÂÂî ªü>ƒÿ X¿È© æƒÈaSdØòal‰¼L÷ŠþVúX]Ð9uù|Mø†ÀæªO¢Lûþ;‹­ˆƒU´£b¥eR¨‹â§¾´Ê#ª‹õWEB¢JÕòm+Š>ñ ÷’ƒWÏ=qñþ² –-ßT6”T¸NûAØfTðžµóôØŠ¸^ê»XI F•qõC#Ï76´ù€%÷nž>|æVÄÌ'VeKh•¡ü½Õ¼ì Q+Ψ|zàp dBÿ`xzLxµö&`l¿~…ÝBÈb_Ë›2­‡³{Xö¦4J"9:ïsèŒÁÖVÖö6Ö½GÌ}œO¨x·æ-'+¿ƒ¸Ñ§eËñy„ !tÑûf®æJøαEµ÷Š@ü'†ôt¶¶µ³²²·do&E>m ¶î¼ðÇ {kÇ»ÙhÑ¥]Án¶V6¶6ÖNÞaWÞBÞ®ì3åàéo÷8Ú¹¾Ê'¨gç¶û¸ÙÛÚÙÙ¹ö=t'NUÌG’óù™ƒ{ØÚÙÙØ8Mßp2O†„*ü:m­µ[ß±×cR BçY=ÅÁÖÚÎÖÚÁ³ß›q„jC}Ë*Áñyrzso'k[[K÷nÉQùBž·r¢¿…¹™©…}ðîËEå©*ß;Ã×Î{rº˜|8·¡U'ËÏ9tÒãG™:µúZ5S,3—©£øÏ®?{`Qsó®é"ªì‡iŽ³ŒH”& ¶÷H——~¾’Êù¼~Æ`KkKËný'?øR¨¸HŸñöÒ 7+S+{ßs^lhÔÆ/“BHNüSw IEÊôâtf „у­çAƒ! #@hX4æ,¡`éy€™sÁÜØ¢üÆÊê ˜1¾0«ý@™ÊŸçØeÖ­ˆ4 “»»Z﹞ˆòœQîÎýFDŠÆ‚Ì» Αã¼ávA»?ш(yÑÓÞ¥»­mt:…ˆ¹÷f´ïµ)YöɈ½¯’årq²Ÿ]‡siŠB¤·¹zμE#ž^?¢›ÿ:1""þ¸·Ø¢SÏ7HÓ4•ißÚ:21lA¿>£vÉh?ßYokéü8ILÓ(M½ÕÝ´ýÆ'beJüÜ«Cç9çi”eÌïfå½ö&"^kã¶è""Ò4•zmi[DZˆ/WX YB!Ò]ø•{L–‘Ž>~êIryÿË.³ÖŽ—Ò¢(Ì{äÙÎbó»"DDYê0{»qÛo""%ÍÖË*híM¤¤cÊM˜3ÐaÀLEs^E:‘+Á—9yæÉ‘VjéÃ-Z‡Ä""fx²ÿèY¡¬œâ Ùêï2xë%Eò9ÃmÇ„¾ WMèí=j•œ¢hÄG‡æØ9ôK–"æÆtµ¶w"%ùŸúxØ™ºŽÎCD¤uo;úÈWiD|¸u`'ÿ½4¢´0åHxøÇ,ÌüxƶK·XQ‰Ò"\ìÚaÜõ4Dg?qð[N9¥–Â6d×Ĉ x÷và#|œ‚ÒOJ=èÐ3|p5›öPæ˜b…hä‚‘Ç° ‚""ÊPkŒYbÄDeö4DDE!¶rD9ˆØo§0ºÌ¿þ)ÅWéÊh„U˜ôþSAÁ¼!}‘¸N^#lì™ob—V¶F_@œšwç2ÕÊ®WÎ÷_’;תw+≽`qôû ”H&¥9¹™Y„UÆ…^MØ%•(jªm1ýÆ#mHÅR¿›i¹O¢ó}=tBB€üü†ýõ'\²¬Ë®±³·K‡[‡#‚,F•ðÚèÝáémWõl À©¹|oy·Ý?f¸ˆåÜba»-|a/áˆä¼49Ôá­6Þ÷ovãiðIgï¡+~J¥þ ›ÏGêjL"£uÍ{µ,¸ó$mR›&ÙqÑŸhz‹Ÿ3 ²¸ú+׆¥åuJ6ûjÿ”5ïkŸ<¼†ˆz;iÜDâB6K‹Í*¡²¦6ŸÎËô[Z kYÖH^:.ªÿ…ài벋ÅMÛØ!ý #ñsŒËêÞ y:Ígum5ì’RYŠiIú7ÀzÂÁ'£iàjÕ0t(¤ýÈ¡PK“WRß@?f €¯ß `È  ­AŠ´ê@Û`Ö^¦Á‡h\ ®Dxí‚33èÇ/Á{€6ù°ï1°µàéh¤ ® N; æG"Òm.@òÜC!^³uä…Ê:wŸ!Úë1²ÅýÉ”ZM˜Ÿ$—kÕâ¢âd€Û°•ŽðåwÑpw“Ù žÈ®Ýkd2½§qâÜWñ-ÉáXzÄ”fe•Ø‚“‡yo p8¤V¯žÝÝ»ÚunV®J˜:kú•÷¢ºÆz,di˜•ûê3d¾Nä¤EN¥¼”›úCVïcYmþí·"VzÜ€”ü‡Êe?^gß–ÝL\lÕiW;÷^=º;;X ˆí’õ^£gx›µ«ÝÁ©§——³“c3MRb¨ðAÑ‚CËÆì»ù­~ƒZ\+?]»E@vn €n ¢ N–íë -Âùz{Ûà×Ñóöžn¬UþS‹±€.]»2‰ U¯Tç&#öæ¼E¡©D_O‹21B#ÉÉËd e“:96“ŸÞ˜% ®YÜîíìÞ½§§»£M'Ræà‰Å"“Q%J¹\$%|Mn%­B-èÛ¯yc×~4Ú²!ñ3ÀÅ1@Æ”&¿øÚdC>€&tùµA—_Ên<}‹“*NBå ”°Š‰ÓÕYçÿÃì ‹ DNÑŠ³H drÐbtîÞ<õdœˆ~ôé³ÙˆNu > {.êÉMåhµnR³ìmFBˆË¨`×QÁE)ïŽîÛ:gôî†÷Ú©l-‡Çõ¿ª;ýуÅý¬é]ÛUh ›Gh«Ùa«¬kTf®äsI–¶Gw.®Àtóá +¸ñxèæE›ö›Þ>µŽÏj¸hÏÉE(s÷ÜÖí›Âwo‹8}ºY žZ"\›9hw¢ý“gKawŸv7mbqÈJˆƒ%V\7!£`Í„¶óGM7}t°%Gå<ÙX¿¦D+‘O‘<ùGn® þÔð‚ g×zìððvs­Ç¸åÅß/.5S²R3PS»€#vTþsGö¬œ5~•åŒ;J9´ëóÙiéÐBPä¼Oç™4ÔªÊEaÛUX‘ëB`×a¸yn‡3qÀãŒ? Ûú¨æÉUfD$€ê¿—jºù9†2Þh4UšÒWÑÿ Sqe uõ›ry’įÊIœýê•Tß½¥@Ã>Òc/bR[uoDϲIþíÏß`]ÿ†ZP"'B¨Â䇯R@«NÛÀùÛC§öN½¼£ Ä ýð3»ëPåTJ;û"CXDÅõj9vb=½ø¶ä¼'íû"Zeçµî`ô-EVzâR–+Zòñõã")"GÇÞ'ðìÕ­ú±÷¯fÁ¸§_3ä'¿Ý'¶ÌO¿ü%·’Ó4Éý´©‡%_ÑdÑÓÓñ\E»k5¢A”’&T´óqÄú™ë÷@‰¼§{ŽØÚ§eú´›Ëª´êÜFœ›û5O¢ô‘{qBmëÆPÕPEµWœ”!pöi§Hÿî–"~¼¡^-šÎÉ/¤CpýÒ'. ͉Ž~lÝú¾cG™%»¹'®ÌåNmÃÚ:¬˜ç @ÈÞÞ|%¨Ý»¹¶úVÂؼ ®äÀò]QW7<ƒ¶&ÇÏ)S†o„µÛ ÚB-‘ÒD@ò^A¶´´à7/àå hmßà7!¡Žc€@¼/^@¡˜CªÿAvƒÈ¯ÓªO‡ú›CW>ýð!öÕÊ™[tÍ]]kq ]÷^6¬*2÷¨ D»esÖÁýgÌGúr€Zš²jöÔkŸå²ü˜é¾[/<ˆ‰}ÿöÕÓs×î™v×ðuD¹±Ïž=ϔ蹙 nï?ûùóË?. ›ñ¤IKï}/ 5yZ¹éo£_<Ï‚Û”yÒË“7Ÿ¾÷ìö©Á}{®?—Pv6äD½¸èÀËظw¯®âÑÁI`ÉÂçL³"ì囘w±o®îÝ—fÔÖÒ¢6¯9eÁ£è7ïßÅ>8{$t­ëéÐWÖÌXqö“ª2Å÷´Ò{yùjô‡Ï±/̘~ÂÔJ?ýñƒ„ìBíæ¦>Ít/_ýè囧÷Î-ß{Ü°U™•À›·{¥Æ“ð™ÇßBR_]Ÿ¼<]H³º»ê·ðÖ£çÜ8ÕoÙ½€qƒ4Hò£s³–¬+Ò?ÛÄø-Ô–^ úøñÓkvEåÊåûê¥F+³ú¤pCØÑ÷Ÿ>=¾~1-“£<œOY1r༈+¯cÞ½{ûòDÄQN{÷Æä~^yöèÆ„ù;;¹4Òâ ¢ÔØ…sçƤÉTZÅçÂÜ`hSçÁâù0u €K{°é  ëØ €IƒaøTX{ &÷@ÇÎ0i44è ¬’¯ÜÈÁÌ ºØB® `â€a] ecØZf°±8솓˜™Á“ Æåïàdª ØÍjþ$DDaJoO‡ý7(^Ü _ÞÓÕÁÑÙcÎÖ‹2…ÏE_»º8‡œ‹Vø`= 2³÷‹•(=²äÂ~vw<.BÄü7§ ñqttròð 9|WQ•ñj¨§½ƒçµx%ÊX2ÚÏÎÎ!`jhŽ ß]Ølkë¼è^¦þ1ÀÍÖÁ¹×“$"ŠnOØÃÁÁÑÓôÕw '4zÖp§iÛ^#Ò4(ÎܱpLWgg7¯e{¯Ki‘†¯šêéâàääT<_䋽<Žÿ‘úw,FBÙ3c\<ý/J÷HhYÁÄáÁÙ„(°{úø/ÿzDòíq@à6IõK—æ îë¾ûJ"3}üc7êÊ°Ùl¥k¼zaE]°u¡P€@έÛ_J> \,l`5$"µ•¨†“QÛ,:ámlª'Ùwîij‰z §²x1¨^FSSWfR\br.¿’d%ßð,U€Y„Íf³XjV]#ªë¢z2`¥ÁfªˆòÀÁ?Énˆ$÷[HPksS+ŸC$¨ð•ÿmí”Öæ–æ6#îÉ*,|D–÷míÔ[k+K+›AÓÖ~Ë“ ´,ïPH£­¥••e¯a³žýQât?goEmlìí,»øÍ!Dy†*Jv³é°éJÊ‹Mî퇞{rf]7GkKs»…ûoKBDšûmý´ÁvÖ–Ö¶® Âni„yBv –Þ( @HúûÛcû¸[YZZÛº/ ¿'A’÷⌹ÃhŠ÷ι‹ù’gÉ}œ»}Ó(`m=æìB0öj˜¯›…¹e€i¯“òñbÄw'7r_œ{ª¯‡£©…Ýœ7¥yŸ‚}¬¬¬{^™"BHÚ©€&=6$<;èÝÕÎÒÜzÌŠÃBš|Ý7¥û”]t~”yGÓÓ©„È|wc‚¿‡¥••ƒG¿câ *ïÈÒ@+K 'Ï'_d¨òùH3SÏø—G=,ÚŽ ûNÉûòhÆ`/+k+[ï°+1@$„Ž»¾ËÇÕÆÔÜzÀÔÐ S^^ÞÛÅÒÊÚ®«ÏÎK/iBI¾Ñ¦“í›/úÚÚÚ:õýø{!„¼]ê8”B˜ãÎ4ò+Qå_†ØXOŽx˜›››üᾓõ®«Ÿ°è»‡³uÄ$”eu±rãºÆàßó*þµÅ´«w¦Xá‰K=½pêÆë,JT²J–žš"GD¤¤RÙçð¹æÞbŠF”.íÚzØ®Ç%Q— ‹ÄˆôáfÝç*‰ÈTWHшg,ÚuG!"î™áÞcüIE‚ó“m½7=GÄ·ú™YO-vi=²bT÷þs¥~>¾´K÷!¥ñRuiß÷KT‘–$§f!"Rr éË£,»®¸†ˆy¯×w1 TÆÝÍ8mÑ®û{ųï‹i_]\fg†xÿÀ$‡n‹…ˆˆxvŒSðµ’&ß ›àÜk9…’éÎ-GŸÌPä”åÇ÷p0SÃn’Ï™t²?ñ]¤èÙ­™îVAá%/?D-°rš)B õnç¿'Aé—K¥ž:™Bã™Q6¶3Ï”8 _›èä61FÌ|`jnü}¦ò–ÉóÅ-¬Çæ•uú¥_]ÿ–Wq|R†Žf >[*…˜{ù[1Ylé÷{ýlJ¥x| )¹†aKàY6gbð¬Î|÷^}öíÙ¦Qmâ¿iÝ¥¡‹-,¶Ytõèߧs«F,UQÝÝ£oXȾ´"ߺ¬Ø­÷¹Ëæ¶QHhT]«šÅ.­uôjÊR)„Ø„¾(y¸ñÅÅ 9ðõy41.V?€'ˆ¿±ÑÖŽ‡Eh‡×€®¼»ß?§ Äçæ¿¡ ¿çIuR¾+~кuŒ”¥rÙÈii¬ LÁç-Wž"Q†íš( ‘u3OT¶ü‚{ïhÌ<8qÂÅg‚ó3¾Ë‹ÒEtÒ— SÇšŠœln ž€ \˜šž«¸Li`l,@ŽV[]ß•s8Q'oàâÞlÎިϙݒïˆ[·­©YÑJÓJ~Áb VóÅK—qY¥¯5õU4ɸð¹$»v«‰—ÃçÜk»†®ª»(§‚VŒj\v…Í׬¦ʬR@¤¡‚?›ͼW{·S%fk±²P%ºÂTËÎûvÓ§O°á¹h ”IDAT”5B£®¹*R— - êÙù­å*.=1'†, ‹òâ+na Ë›±B«ÕýbÀà_3·¨o”_˜W$§ "!øèàŽ°kÏA!NvnÖ±LÇÁ¾Çãñx|üÁçZôåóž†vÍmM]ù$j~Þ¹ÝÑRHúò^NzÆz›~ýÞ6ΓëQYÅC °ÎÛxÿ¾g×\nÙ¶6»xE&=HSøÂ|ÏJÖå7`³À¤YÍœÜ|횆†††††Ú,ž–[å(åQLFƒöí[hñx\6dŒ+‰pP.žžâÿ&mÊ>¼Î7(.’QÚÚÕ';ãÍÇâ%››ÐXOPVHÐq1aǽÉÒÒ3400004Ôâ³5ôôê4©)‰y•©`”$C"”Èõšõ|üòettô«—¸–ÿf–ÀÅ„ÿ!KKOÙÖ:<ž@óæôóŸ‘]3v¬ZùF¤íØŽó(Ši˜’Ãá´Ñáÿü@’9™b𯱬ëÖÃŒNŸ¼á|JFF›[swb± ŠoiÝ 9ì¼gϾädgÆ\ }‘˜#Î-HÎÌêëtß>Ë.¼JKÏÈÈHrõª´^§–¼Â•Ã‡MÙ~!===#=íã«é5vÐàéðå¹/?¤¥æˆ ¹ßÝ—ËwßÒ™3¤qI;¸‚ä½ûnffe§%Ü¿xùe›^#¹ú 0}½>*53+3-ñÈÌÞN#6Ë:;l튛Ÿ%Ð¥¹AÒçñ©™Y™éG×­Õo­÷1!O*g jp%Iï³Ò äÀW4 =5{ ì÷!|ôøĬÌÌøè(Ÿîw“«O/VΖà#)é™Ù)oÂ6_¬ç;¥&‡§M%|MJ̓óÜyw–n¸ò.#33#éýÌ΃W<дëi·}jÌ·”ÌŒÄ#KgЬŸ‹²™3Ï(zד/Ó223S?/ââ=û2xŒ‘9!êeBFzÒù¥£÷=”7×·ù34î®Úy/!+++õÓµ{ŸÚMWÕGðˆøøÆå§^å3ʃíd QZ¼fÊ+3SkWß#¿#"~s´é¼ïæD*&2ÄÙÆÂÆÞm剈és|¬Ì­{*ÂÂÔØ£ûØXYXZÛLY#AD™0}˼‘Væ–––=‡Î|ò­@QűÅ:›ZlyŒˆH‰æûyú.Ø]Cám„—þ‡¢¯íèî`afj·âØÃÒ¶å'oœ1ÄÖÊÜÊÚ~âÊCYbE š/^&—ÝPœªˆO¬ifaéè9ðLtš4㉧­i¯)›Pž?w€³I'‹¹Óñè¢M-m}‚ˆŸnïóíjmnnÞÕwÔ¸ ¥­ûÅÜfã •ÕþèÝ´ÃÞÊÆ?˜hc;÷ˆÂT۪ܺ„س}ºÚ˜v± ”PˆˆÒŒ˜þN]:u²9ôZ„Hç}¾=ÑßÝÂÒÒƥ׶óÏ•ald9·²0wè6ðü«ïþ]ÍÖœŠ«p2uºy—Ø\I‰·(ñÙÌ!^–––VŽÝBÝ‘P ³.õåÎ>og3 ë€i’ Æt:;îúØ>î–VVÎ=G>þªo™÷Úu´¾ÿ5OYÅë% : ÎBDÌeÕlü±TÆüÉ úøõ;SXN™GÄûa¹›~eŒ;XÑ öZ Biy ›œ€n]_ ´3Ts ßK=¢©Ð†Šµ `i\T„"%?éUÙ†Ul¤2Ú0)ñ,Ê ò ïÆË5µß][ÈRé³Ê]CµåBÔÞg.÷°4Ø3ëžêì,ª@ÊWR¶L( D$äéÞ…—M-6ç0{6ƒÉT\qBWø¦\¤”*2–IWf1Ê SR³î…MI4<È®&Vn´,.ŠT]^Š©^ B@ò³a•}®¬|¢>ú6?'UGµ¢¾p¢6!àÉwî䑜ʘ¿©ø_Eæ¿n½Ž¥Yž”•>h™Tö_p_iùE;«©- ÖG…e™ƒêÉ&ÿ-' eu4UÅËøäwnY…‹1°2`Ø  ü—+S¨ºÑÿoÓÿ\GQmz•;×Õ&XÙëîr#)M¯š+7u·ý+ŽöÿµwÝaQ[ÿ KP±Ç5‰é} R-Ò ‚XPb‹Qk¢Æ."vT-z5‰FÀPŠ‚´ewÙÝ·œûDzÈzó廹÷>ïïvgæÌÌ»sÞsfÎüNó'¨±üÀ0ÖøÁ_Ÿ0­ºQV<›<^Äcåãÿº#AJO>Ê%§žús%¤âîg_ ½’UÓjÓ™É\ßßrF=ùÓž"!p#nªñÁ[sÈÿÑa#„¿25õb«ýn¤Ä>nfßœÌkub„<<5–oÎñM-³ãRi¢2–ÉåýÑcÖ"G3skÿ𘠚JJW„O±²° íGY‰>Bò÷/pBJ.çålk#p41±¼ì ¼…\B­y:ÃÕzÿÃÎÃýO¨þGÞÍöX«²ÎómEE²º°ï%CaÛL¶}!mLö‘,¥ YêYQÚJÒfº Co«diÊH«q¹bªu6™™GE½ó`Ã`‡YbM‰pÚzuùWl}ÇڌږÓzªÙ×VÏ£&Oò°Ý|*¿eYÄÚÌ#&V.— äˆH—ýê7ÞåÒ3)"ÊÿØi>‚ø¡*Tñ—.ænq¿#bjìÏåoUÕK®{Ø ‹>W®iŠ5eÒ”ÜFÓ”°ˆò²L{kû·^""Ò…³½Dß^«j%©än’µõÄ¢z¹§'þŸÖ !ÅÌø^\m1s_!!„­ÉÛðå¡€ïìtü×b$¤ôäz×™›€ÇLµ³ß‘…„0•O×Î ø®^3R3Ë !„”8·±1ÇãfZLXÀBy|a·¯›ÐÁ^4gm‚„B’<ÈjîÅòÇgüÝö£#Þ „DBHÞµý¾n";ëª]©‹ª¥ù7"&·wxN[ü¨L¢*zgë—6¾ó¨ÆŠìã”m>nŽŸÐå9• „¤‚½l¶}9ÙÅvÞ9B-+Û´xšÈÁA(óÃm†UàU™5Û_Èwð ^ñ¨ªy»šháÛÍó}íìù^!QÅõ,ABY6Í~ÅáüK;—:‹F»ùxXC·™vÂ[¹u„FZ¼z†§­0xÅ®Ze‹y–•n_ê(ð]—n=.£‘¼G§P½>,*t÷ÞÁúòæz5¹7Dv·^(ˆú¶5[µ6<Ïç œ=¾>t !„$Ǻº|y!„º¾{™“ïârõE3Ñ !¤jŽýЈ3•àÜ…smç¸Ò^O»ä WÇ Õ±¤OHôÆ©¦Hÿ)Ó†‰»©0³+~}W•ÅÑÛiÐÝjóŸàÝMs¬ü³ïÅ%Oµœ“ú05ÎNäžWEB^gžžáåbo/œ¿®DJÂîõ5¿5³iž4d$Œ²÷z!e2ö­¶™,¥‘dÝIÀ>AÁ¢~¼ûÎÞ\ìÜß:ÏÊg!MècëãÑéõ¶«pÙ>fëñõe3+ßò_žd¾‘£òÓ®ç½(ÌI?ïmaºþf6Ôe\IàÛ9ÝÊ-­¨£PrßÓÒdUÒ? ŸÝ=5ÞÜ|ë=1"^ØæÅ?óû×sòŠYd’cÂøBú¼°àùQ!|ïð*9"bñù6£=Öî¹Pòº¢¬ðÞd›á«/× â­„Uv"¿Ûž>ÏyôÍtû1óÒˆ¯Ÿ$ Ì,®d¾H¿´K`%<[¨bc8õ]¢*œ6ãÔÊQ&c¯ffäß:²ÒÂfÒ3 YZâ'rñ˜æî“ì¢j¤_L¶1žµ=%/¿ ÷{ÓˆØámiµæø/9¹¹7VÛNÌ­SbiŠ‰¥ÀÇ;üúƒì¼œk¼ì¿:¢š­•a."Ôßs**+ïŸÝak3úÉ+3lí7sjQQìlºéø‹¢¢¬ôëÓ'¹›9ÍQÅ>o²ø:5'¿ ÿùÓ}‹œíÂO½o"¥m s™}€Ej¾pð¶¦cIYVlLLv¥þÒ—Ìv3[´ÿççùϳFN¶¿öD<¹ÖÅ9â"Þúq¡­÷í'y…ÏWø ¬6ŸÊW‘‚\»,)]ŒˆQž#–]©ûåôž% ""7î{¥P³AšíÓƒÁæc6¦·úÕ߉·ápîƒÈæ§ý°fû‘÷Š²K3­]&EnLz–“Û@ეͶ¶Ni÷ž¾¸–´ÖVà™QÅ·7X[O{¥ÊЊxâë°qAk”,ü|2jó>9Í"âÑ™f“Ž”åÝ>¶lQIJ˜­TÈU¶fÁ¥#·%5ç­üyé(árŽ¿ç£æ»Á7WLÍâ³kU¦lúz/³àíÍ_æ_Zn)Z%F,”·uÍ‘""ÞYél57©¹Ìý£óíÝ×ÉÓ¶{ f©¢åå>Bã=¿J›Ò<>w³äŸÍ®DÄâó¡f–ÓK›lé‹}–]GT.v¶ ¹Be?×—glÞ²¿ ñ‡i¦c64\}@tþGôšlšR_Y¥%+©b!½†€‘æ‹åz÷Nóê" <-Š§ÍþV\;qh7d?1ëÞöª­«”àE~‰Î«î@Ú÷´X¶Ô â×l½#k"“UŒ %ÅTMקØZL }{ýËç„Þ---`•z ÅDºgÏ¡ ŠDÖ1è yèZ®`U5õF"së‰lqOhL8i¼z @ nóÎíëj1 @X¦ý'Ã/hóÍ43Mð*Þ¾ÑæuèØ^[Õ¿‘èó*æ A³}–Åð·õ÷4eZÀ˜®†:-.PVÍ ûÖ/úÐ`­ÖBï‚[º]Úýü\MwF¸Ÿè9@hñ:ë·×irqšË°HÔöÚ½an–E,+·»}"”‡H‚¦jÍó:ôí~·óÔä"hµëß¹½ôå+Štáòmþ]øw\x!D§éF‹Øe°y ¿HÙÈžB¦…iõÓI‹_‹øÉHû@SÛX]‹ðºñˆ¶^ÓzaJËÞs’UÇÆ ¿)íûö~'R½,ûîœí] ÃÂgŽ^# iVUÍ_ÛÀ¨ÕUŠýó½O³A‡Svt1ЦvÖ„±Í¿w-žŽªXõƒÓ^áßGlÞë>ª¯®ŽVöÖ…¥€ŒÚѵZ·4ïŠiÜ`X@Kë} h?}}škQAþ³k瓶ÆÙ†ï8nÝ\ñ陨çô@ë—7ãã¯]ÆJNøÑÒm†û€6Ÿ"Å%º¾*(È}œvf»0.Ò}eÒ¦€Í¡Y¢ÍûðSïØÉ#MµTOC»=¿G»K•;CD¶kŽb¥EÊÕèÏŒï¦Q±#¡V»N.!ŠŸ¾:wpgÈîÂÓmê24 ðéÝHÕCüõ:÷пÀÚ&öŽrgÚ–sý‚û¼{›èôê®m4ÄR[5póÞ½o¾jë™hó´µ”2 €S7³ºy·ät†ê¥VëŒ45o¼¬ÈÊ•ÐN×RÝð‡jÿ£¦ÝSsÕ e©š§ßŠY…§?ÈÈ@F ™›é«ˆgj«êº~€ÈêÓŸ(³2* DBIË®\Kz{Y b®Vwe:BÊÛ ®×íØ´LíD^ݸ/ñ:;o`Otùj9yl99Ïuºôï0¢# aïʵõ@Ûîs½“ù¯€ aÓ/œ£ÌÇÚÿµýwd»ueX±´‰.!9÷^jkk°Šò·Ò^½Xô`!>u¯û”¸‚¹ç?kê©^§ÏÆ–T¼,VíQS„§¬*}Q&Ñdé-+©fûöû¼{¿Ïm]|½“×,ü~]m@bÓ×=t•gg×À®ˆÀÒ5r)Õ¼ÇܬR˜ þ#ýg ™ˆ„Ð9µt##•¹pxÅ´Ó Û;)ÑÐ|IµrÅ„ £È”Õ¶[!„aêû×اíÿEOÅ[Y/3óOTëªëÚw1BCÁbK‰ó±œŠsÙÕþS„Mì]KC]­k“’Ã(=DBHQM]gýÏÞ—‹lƒRÉ6òqø/ˆ»!Âåó;ü–°áZ‰’¦%"Üçžj[á¹@çúÖ]¿¾V*idÅßÍr³8­ÕÊãµëå0lÈé=qš¦i¦ä·ÃN3ˤš³` r=JX\&–³ <¿iö7‰ÏõÆ|Zu4üÖ 1MÓ”ìÕ¼@Ñ¢=È«ûWN^fè>¬sï§Ç K+kò"BöCÝÚòjÕŒ^]º)äUeÕ2†Åüë»òh¹üm= à°$¬cúѯ¯•*)úÍo?Ί‹×ÑçÁ_ &aûëSŠƒ—3‘eꊷüœßNõr—§OMHÊSE±X”ýŒí6¤+e]ñ†µÑ™¥Ôc¿ŠŠŽ‰]ý©–ØzN캑 ¯*JLH|YË´SùSÀh﫯J¥’f¡°è…Na-X ì=Ìž¿¼L¢dQycÛ’J…6: ÷^Ëm€/ŸÒG‰É^³,æßü!ý­ÄU Yú×[n´OHˆæ) …R¡P(J€îNüi‹¦f”ÖS]•s>åîÓá–^XvïRü©«Ô5 çâ;>+~nAµŒ¦qi¦Ÿ—Ëk¯ @‘û㼕 ÙöD @HùÛ§X§¹u©;Î>B†©ÍM9w'ËÂc –ÿþS|ò•f¹¬$÷­¤Çýµ8¥ð[7,U'®g°é=ÑÉýðqÞºµ3„Ñ2¾ßüK üK+Åâzµ>™˜”¨½vÝdá=—)+ÏÏ”\"–*U?k ¼¥»ãîÝ0V`GéÐÏrcü1‹Þ†ÀRÒ:‰¼yEËê%J ü¾ÚbÐyS€3_Æ’NSO‹h8H±'¶}Ìì1+¥Ht»-Ú;×Û”äýtbÓmfZàXè¹ãÛˆˆ™öGÛõ7s;šüxWXôr/þ7¤õ F5°nS–?y8ÍÃÉ°CW×U{ö ÇÍpöª¼˜²'é0¬‰šì°Z¦×mHÌ®–õ TY'–4ûYHËjÅ.@ƒT,“ÓÍþA½XL1H‹Åõƒ`4êD|ä¢Eó;%ŸŽn™à|W †‚CÇ#c£¼÷”É€~fcZÖ @*}“––ú…Ï*‹>-픊k› C¥o²÷ìß3`tPÿN¼w[7½}ŸíUËht J:·fHeªÃué±-1ºk|\‡èw´šš²³ÃÊåÞ*:ö·ˆÜŸâ>€9·í<¥Pú[š5OËö½qÑmItÿn…¨Z‰º]Í\âa€ù—~ÿ¤{¨¿[+ï )i]}Cc¨!¢Û¬8ƒN»æy®£@×èÓ¹qG&‰ú©¼4/'AܬÞìÛ¤+ oÝr¶dRÀ‚z½ÍN%lŒZ±Ät]m»ÎƒnIuÄ‚+ǾÏ4 pW­Ò´„šÏ}l 9ð„³­c®ÚŠGcYõâ ók Ùj3ЫU1õÈ´?æÇâjiˆæk…¨¹BËÕâÕd±¨žâCY ØÅ v¿XÜfØ Û4R6Þôoo>ž©&EƒÀ÷"Û×ÔÊ¢†¹’® [¨±t‹^i(óÞé–úy\ÛýDD”­ h,O•ÍØl¿SÈ}Ìa~†c…´ØAm›†Fæ§Þi‹ ¦u±–ÿ¶Á£‰>æµ4Ѿ´"îÑ\¡e‹ªŒwmÉRc˜ùü;¤í넺®è$åêÔ¿õøÞu„åëÇgtýÌ{´5* R4õé'mÎí„Ú– X™¶Q6ÂG#P‹^ihñ=6"u^¥¶û øöòæúá~ª[R ¬¦Û à®Mý­àn„ÿۥͤcaÿL™~«\”d&ˆ^8zùìÐÜÆ §n8pø莇ˆS78pøŸg=ràÀS78pàÔ 8pꆜºáÀ§n¸)àÀ§n8pàÀ©8pàÔ 8uÃNÝpàÀ§n8pàÀ©8pàÔ 8uÃNÝpàÀ§n8pàð?„oì‰:ÏóæIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/icmp_seq.png0000644000000000000000000005130713051004444021516 00000000000000‰PNG  IHDRzZ9 EsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ07î´j IDATxÚì}u@UMóðìM:$Ån)éTDAÅÀ–6±»±°ETìÎGLìVÀé¾}Ï™ïsIAyâ}}ÞïÇü÷œ=»S;;»;;Kê¡ê¡þóÀªgA=ÔC=Ô››z¨‡z¨77õPõPõæ¦ê¡êÍM=ÔC=Ô››z¨‡z¨‡zsSõPõæ¦ê¡ê¡ÞÜÔC=ÔC½¹©‡z¨‡zsSõPõPonê¡êáÿ#àüå/s’Nžù`Úטüº,"!T*.ÎÛyè¬ï=΂6D$„ä~~ùÎS¡¥bÓ­¯™‘€ðÔöƒEvåéHÉ<Œ4½ÙsñÙÐÐáÚ€@"Rrh÷³!˜|ôQ@aH ¤ÊƒÇ -y}ïRB*T=ìÊmãàÒ4=åÞ¥„T¤i…uç(µìhçfÝ Ú~°@Ã>»™ø²P(SÒÐïìÚ¥¾ £˜/nœK|_àЬLE¾Ñʾ‡“q#aîËcgÑUMZ†x[Ô†jzʽ¸„O}ýuY åGJtxï>×Ác«Ö¬‡])NÜû¸Fe=TƒõÒÜä¾<¹ó²_h_ã_iBÁA=7>8oXù%L|ø¸kÿaz*ÿÚ!¥/÷øŒ:èêåüêV¼¥u“íëW.:zÛ§ƒüÔö¡{Gmn¹¤i9å(G£¶ôíqýSøW× `!—ÞöÚùZˆÒã›> @VÊ“× «64 2Ô¥Ò_ßÛs𖳫ROÔÔ“óêÐínnŒ5)Éýz¿µ{¦¸ÿØó‘K·¶»íÖB•±%9÷N”…¹AòuÝ’èB¶Róî¾ZŠšEyÉ»wö¨»¹Ù]lðÈîÂ.õ2‹õâTôcíaÞ-ø/nž?ð<ßż-åæ†nÒNŽœ‚O>°9,¹8ÿAbR';W >¡iN'Šül‰¢[*ƨš%+}Ò{èF›®ŸîÝ6íÜn÷Æ•c¶_°U>»sWã¶^•ÍÍÛë±ûeÖÝ:#!ò˃W^H·²46ÐV-̾±yù|— ›V‡ºÀ‹›ç÷\{–ÈvÜÚŠi—¼Ú==æpfO-3'ãF¢¼äÝ»öÙ¸8+³*L„§õO¨I}o×®3ÇÞ6¸²Ê¤E‡vmoÝ›175è¡¥9µ*Ûÿ6à/¦i¹L*‹Åb±TN1S²õ?A#Ò44-“JÅb±X"‘S4"ˆ‰X&§¤qI‰…\Ìü¾Ò(£*×L‰ÅbŠV”§)™D,‹%29…ˆ4MK$b9EÉ$±X,•Éi™T"‹¥R9M#"Ê¥b‰ŒRà&‘R4ÒÌ HÃ}\ï¼F,íå'GŒ_:¨ËœÃˆyCÌmV=/®‘VyiFWW‡=>#bVR¬½K—ÏE2Cn/ q [Wù«Ä“½GT!­æW4"ʲ/»Z›Çg"bÎ`Kç+™ù®’2lD:yÅ€nËN”~¿k¢ãø¨„¨¾“.ÑeHä¾9ìhëý]‚uY¢³]ÈŠI]ú̽ªâÞ!¦ã¯!â¾ù#ûNYû“¯™O\l_çQ5ëE™DÊ¥†ˆr©¤’P$4MIÄb9Ec ŒnÔÖhÒ©-‹öß’Èd´¢!ú‡¶©Müg¼‹X:¥«g±Œ~±9ÌuÜÄÒ[û…·¿V.;'Ðcúfæ³Ä•ƒÌl¤ˆ+ª¿»`cÑyѽ"DÜ7/dpÿ Wï F“F”åô·s õôX~2ñOs^¡á^ýç»;Û_~Ï<¡¤y=ì;%d#bNmzøe«Ìš¦¤‰X,–H¤M#MÓ4Íô)F.©Œ¦‘’IÅ©B§h¤)¹X,ù‘©ÿøµwƒ@¾²âbÃæÚ’¯©ß…‹wĺµV«<Ôg°åþ$%+ݼSwßG;e¦«|2ÜgWzo–à·}ó›çO5°ݵ*´ÒŒh)á7¹àÙ„ùm;ïàUÂÈ­Õ!d«6Œõj{cß’àå}·\j¦Á©6 üËþ e”ˆÁ€¦šÞcýÀsíqÏÙ;Uå;ë.=ë=p¬±y;ÑÑ•¹"O=%üy4¨â¡óÖœðžþt¶»•:ëŸs!iûØ°]/›[X’œwߥ*{Žk¢Æì½3cÉJôvk{û ÕvCö® ôóéâ·àh€k3B p°«ýÐ=/üÚój¬ÙØgø§]+ìœ46vŠXµ¸£¯º§C@S‰\û˜ ÀeÜFÓ°M7 ägšL‰WÞøºhG> (f÷üÖÞ&œ˜³xö¬+[@¿c'ÙÙ“ÏJ¨ÎšlÈ{÷(‹×®½zæßI Åæjî™lÝ7,ÂþÆ5üwˆÛól²Ü´S›7_¨ØŸ[J$ù^]}úÙ™<’5·1¸ð8lëѯ‰հnÏ"U;„L÷½1ªû}×Ñ3ì0þŸsI*ÌܽµÒdŠøúh¤Î l«¼›À•Íó3¤MZ(” Es¶, v±´oÿÓí*Ïâ @Á¥oøã{µWçÓ¥‡Sr'Yéÿ%–æéYìßv¼ÿ’+±K«Í\‹Ò’¶Go¥ÊZ¦Ùj£Ô뢉”èna“e‡Wº·Ö€M}íÅ}Ü= —¯"}w%îÒÀHgëq§ì°iMœ¾àHÖ½×Ö»=¯l1ê‡ý žfï°•½Cóî_¿²r¨k®ŽiŸÃCû:s+øË X½äT¯Ð^©q„„ç=­[F²€¯bw­¤F)VXȇwÙœ´$CP,45nåƒ!ÐÒª|ï†b1€œß|^ÎÜÍãæÛ€'Ç7´ Û©zr4].¶pÿöhµ2I!-wìØ©¹æOÙO5ë·ÑiŸëÊýñËì«.üÔ¢‡ukÁÃ’]ÝÚ ÝϲÛÑÏ¡ƒ›Ã}ÙÊÿÀWpWò Š¼¼/t Þ†edoì§O®Ü‰3µŸÅ‚h ýGw¦ŽšØŽ—qüÐþÝ»wH‹²«Œ!Oï=Ujf ž•òòå˗ɯLrŽÐ@Ëì¬Ý[N Lá ýHcÑõk_ì‚ú3í œ»÷tÔ8@Zæda€Ä «³ G:@N¶åêÍzq™:Yv¤sν“UÆÝÐùjâÍÐ.í‰8ÅÄÖ݃|*b:³¼$/'7§¾gb…C­[7ŠÄj têÊHšÎ­T[Nn®„bT”s“œpqu°µŽIRٻðL_ €r§ÐIÝ`æÔ]U{}vÑZAs:ðˆVÄt‹ýKÊþª˜i€NCW5-¾sãSuË%•ðÎÉÎΓ×͆[yܬ‰*_Ø·gïÞ<ÉþZˆrõÖ}¸È7ЦEâ"×9“YWw=€|ÇÚ[¦úñ*Q[cFIä5pðrðjüÚaÆ»WÌMPU´RÛêÌý»zY€L´a¶¿…Ç «¯²•ŠB° hºÜ4ˆ(ø|Ne6.WqÑ2¹Éàù¥g—fHäï6ž‡%›T[.È­,çÜRѯÅB#Y¿jô¥ËŸ ª»Ó?ÑÃ_ð_»óœ)}^ž=½oïž½®ÐÊ$?KÄÐÙÏÙ˜éwÌŒèÜ 9ßЯöEPé—¯NtA$ÿBsô|€­'ŽÜQ[åÓóÓÕð,‰éüôyóæ+FKO¯ "OY êäý—æ‰x6j gªŠ#Êf—×Àc³ª°Yš Ë÷‚4U¨<À-›,mïaÁgÆo‹;~nÑ Ñ“£^ž4± š9Ó\ýG)B¨‚‡S7^[·û’àɇ{ m¥Œ¿"ƒ§f4Á"N ÖUtM¯Çn(~ìì>5 b“K#vÕ 1`ö‚=nÿøؾì)-Ì^÷B¬¤¹ÑÏ/ € J”2Üû<Þ½9ï/Šš«±/*À~ðÔ^/NW~¬ÕÒfþ©eb(+æê•ß¶Ë„@ï6šÊ²«ø¤\x\å²¾L˜? ìèæÀ9¾ï‘¿Ql½Ýº-Tb!Ùvž©  @O‹>=À€ Š²ÓbÂg{RÐÞc`Kev¥ù=Ó’Z·—bά¸z9~ý¨ Ó×¼Œ “ãç»4.GôÌÜ M2¿¡’+'³Œ´+³¿¸à3›()óʬœ®q[’{)™¿ž£LìºêŒLyÒ¼…†^ìöÃføÅ-¿66&¤’ªMÍúó©.½Vš5ÌÓ\U…\cÑe9,V€•[¯¢Õ3ß )ƒ»ÛÒ­ü\Õþµ;SÒ—‰ïò—^vÑLÛ[};ÄP[ƒèµ>}bÇß@C§…¶øCšš+"-§in]JB¨œwn 4½˜ç¡Ã-G‰ 6†G ž»ÆH‘è5+,ÂvK>pk÷å¡Š‡˜î¶pŸ«™ñ®õþþ#úu‹» Ë'ÝñDZN‡… a½Ø#,ÀÏíÒi-.V1`–Ñ+zŽ X×ËŒ¥YIû¥âfÇ.ïÓ"Œ·AG íwüú]÷Ð.yÇÛ!l ÕÕeëNù(³ÿ¾ê§'|E•CÑM•@ž(üŨÒÝ}PìÙ}I³Ñm°ª\½·2ßs¸<’4lNt¶D}òšõ‰Z±X¬J{V)ÑÖ¥ <¦FvДÊi·ñ#µb–¤×.Y`q´Újêî½xÓײ¿¢uD äÚöíœö 4Ë?e©„j3èÄËaÒs¶COÃ?´Ú‚ƒ§/ªN0‹Ed o¸¦dìJýìo^ÀX3}û…ÅÔÍÄs >ŸÎ€ì{çßk7ñkUÑ‘ØÎówm» Á&„ ðÇÊ”µS"WY­Æ…ªë+ƒÞi÷šîcŒˆ-\B›}Š™äÿ6‡õ+w±£÷sêÛ˜¨„ªÆ‹ bûnãmIêêøï<Hv,<ÖzâR%6_ʳ§ÙßÝ~$¯l|WåýŠò«58Dœµ¬àÄÚ£YJ•:!·æÎñK½à¨"cf*™ñ‡.K¸‚‚ŸL+°iÿÐVnÌ\tzÂÒþ¬êÞ"á•ÑÉf‘—GVL<ö-"æàƒøóCڔϾ+xF8¯.ßp@D•Ãººi·Ø´S#þ\Fk¶Ï*9½ίm2»EÐ0ÏeƒícôõUZ9íÙ2ÍËwáÐ%¬%-„%B)€¦ÍÑýÓf.èq‚Ò J šØX»È†…¥Íð”è{:´Yçeaß;üÜrÝrÇ´¤¤”¦½Ç®~•1ÛÂÚA™ˆ[õݼy,‚L((‘É“&± T"WÌÞe¢¡T1ÕÖ2 6à[IÉ÷lièÌ5ú¤ÒÂ.G}_ì¦Y³#,-*©(ÛZš7éì³õh€‘ x×€N{«®|[zhúýq§ Î<˜¡Ä„ùw䎣'¼"/šN÷nÏ”“‹…¥"I•/e’ìÏñæææ•Šå¦_¤dâR°|^ l͵:yŸt¿ã× „%¥ }„µV8÷œ¡l*—½½|0KåJÿfP6å@e‡ælãͱÚÉDâ¯N•šSõZ÷`um^UZ" Ë'ÆÊ焹EœÕ’HEâ××vvº¼+¯™hv½g¯l™³´¤”ÂC­¡õ—6~^M¨5´txM€û qãÚÄxËqÙ€„²’R¦u`0ÌxÙÙü-Í•¾Li:dNìfÙ€Ô|CXÜ-Ƕ,˜niÉWSs°430÷Œ^3@&,)É«Ld"¡@&a,2«¡Ç±Ã×m‰ñ0[#!<äh¸xöÙ{rjc.©X(¢¥,#+#LiëÑ€¥°d ]ó 7¾ùöBãÚ¸/“„T9ÓZ¸÷ÐÞsòu1…€5ëáâ}3ûZÕ¦låUõœ=å\Ðd;Ï+†j|ŸéQ£´§¯žÔMëp¬ ´T^&0”‹J¦¼VS·Æ)ì» 5~Ô-î¦Ò¯š¢r~xF—ÇJ0Ñ•C'Êþ¯xDW—Áªå+ŠV®O„{õ™u»V\+Ú•íæWýÙωþ\ÅgtÑX[TH èÐ?"HW{VS=t ´ÔÖ]ãCºæÆê†yå¿ЋZÂrª"r.r¨ß¼kÿDÀGeÓ<ºþÈ!úz"/ºLGÔÆÊL¯› kʭס¾ŸêØÏù_¥O1dÈ ý\ìo¤Ô$ÌMÜMµQˆüômÅ0^å}•ñ©|œT-óÓjx^y¦JjƦ¼¸Ìkhš™:’:­ÁÈU|WáØ“Ÿ ô:5 Hª=«‘“¿ ½|Ì ¨< „Íf×ØXÝ0¯éu|õפÌE¦(ªèé¾yGDgwù'6DÊq—z ,¡‘Ϫâ‘èý‰¼HU­¬¤nìbºs Klv5EªÇZç§:ösþWíSH#}oëø M_‡6Zð»Î¡üF¿ê™X ËëàÁ)ùƒºÄÏüoýdqç1W•xU'î´\ÝsÛåe–¿=‚Ô˜Þ]Ÿ ¬=´§9ü“r@äy‡Vr~Ä®éy6ï‡y”xÎŽ[½Ì5~¿~ßr´›¨m7à܉ü߬ ÿ³·hVhíoˆWúWòáÏ¿ý/aXyœý­vá7ðÿ_@ￇÿ¬:ó´®; MbÌ(û[sèV”úÁaF¬´ø<|ƒå¥kúªjU5l7âÿÕÈ®ÚPú›­¤ëøcÿA[S=5ÒH~2ÿ“ R»~ã˜I~@Mo…¢Ô¬qÿŒnT„’–7ó{m«ŽzEˆ0b åŒ3ßþ#êKȳØ5öž#i"écÝâÈK  M½{<´¿g'óN6Ã'.IJËW$±@jfw7sKK++++++ËNæ}GÌOú.$À¼r Øz©6<€–œ‰šßÝÕÎÚÆÚÖ©Û­±ªì˜?¢Ìw«¦w¶²0ïdÝ7xÚƒ÷9@*|@Rtma›6m&þJÊ”œ¾m;˜¹Í€â!øriO§GªMþßÝÞÔÉ‚AÛÂÒ¦è¬éÅ„üS½… 8ÇÖÚüú›Âÿ¸CƒÙ¯—Oòw°µ±¶¶öèpìÁ{$ÿ˜¿Œ´lëôA–¦Æ‹Ž|.'P^|yײžîÖÖÖ §ô›þGjù¬¬Þÿ°‹½ûËs‘PCTÔÔÔdw¢®§–OëX<U~õ‡§¡Õú꽄øøøG‰÷ÆuŒØãu.EªùLÉDUU­bò?gm‘ä¿ñõ Uñœy÷Áƒøø„“k‡Ç̾ùÂË¿¯Ù õ”àõ©;·]{¹p`³ÊÎBLH—åWÙ.ÞŠ¿í¨Æ£>½›ƒƒ5io]zO]M¹Ö·úvÏ.7ä³þ–ˆž¬–)a«ðþ-K´œ: ¿ôöº_·>ŠAyrLÈq½mcôç,Š‘¨7¾pAcAÒ¢ˆ¨B–ÁøeKÍ´9Dúýáªõû¿ä‹õ[Ù„M݈‹@HáÛ;+£ÑzãW,¿½~¢ŽëôÁ®bç…Ý3ž9ÌD‰ÃÉ• °ÅRJI¾Ä8‘Î>põl;-6".ÏgܦÆmÏ‹š+U,ò³9Àæò؈Þ3öÜ»cº{Ï;ëQ-AŽäé…JË’&ªñÛxÉžØçŸ Àú¶`ÆFó°cƒMº;ûM?ßR{Í¥ÇBh«Âp&?|QºáúŒ‰n#î ÀQUQ+ J+£ÆÍ9Þ«ó3õ_Gár¹< ‚›ÿÞ¡¾¹ÅtµŸŸyX8ÒMtàØwÓýK@ìÎÕ—SYj}‚'v3ÓgŽ¶>>³cß…‡bP¶õ5ÂÇ”Y8H?yà²D©É„¹“ÊÝå’OwÖl9šQ$5jï4aJ. )~»n펔,‘©‹ß¤aÌço‰:z³HÆ6q8e˜;³¶#bŒšûò&ïwªÕØ|Æ܉¼ŠE PðéªHÚrDOS"‹ ÚtÛ±ZU`dŸ/-Œü8xB»Äµo«4³_<¾$áIJ]9º笘Ö@’´?h—àÈƱLmÛÃG³mpW™8uö”¹Sö¯XÁ5 xw§”«´iV°ƒßò°žŠ3ý {sò gvÂ\meF|úsöžó|•Á¢XDzlËš›I_´vœ>3H€>ůßväK¾Ø Íœ™#ÕÏ—F~4ÛúÍʘó”’QÀ¼p{Ci‡¯{{pÝÀeÓ—~,d9Ò­#â”GbN^¢†gÀT?ûÆPI^æ«{ð*´WèË‹ÇÆ5·!Ȭª?Hâ¬Ûsãµv+ÇEýxŠ1ä;"·$~ÈQnÐÌò,[#½4{÷šÍ‘6.ŒMýÎì.²9\±ºýÞÕþ¯"#cR¾ [uî>oL?@"Ù<.T> jŠ›ãÚ¼>é'¼«Þ:EÞY5é˜ÆÀ¨±Nÿ^ï ¹±~Ÿj·~¦\ :3ùîÁð=Éa³çzh¼2qqô5ÿÉsZɆ÷› D’vßÍ{²wHp`{Î+o÷¡bBHá]¿A“U;õ>Àig@Ÿ3÷eÑÀâ°˜”qü/Ÿ@öÇ%tÑ'Çw+µÛF‹å«ˆæž=íÚb ¾5UŽL ú5Åüv–‹¶.Žþ-d&ð5ÙvêÈ!¤øÖñ'l³åÁÌ¡PE®žeèê¹CU˜)À“õ îMtÛLéˉX~³’SBAóÁŽÊá«þbx',eŽbÅ)3ùJ©@£U#-—|J<¿ã¡¬õP/3ÁŠán{’a`Јþn­7„ôØø ˆrfePXt¼× ÿá8Ã_F!ˆ_Ÿí2`q+ç>ÁAþÍDw»yO  !’W=ºú5²âç“}qQÿg!IgÂ}§´ë=8pxŸ´sáCgÐOÿú~ä‚duÇÙ³¦5̼4#º]ê ­ix·óØÍRJ!‚–¶Ž¦M%üüìÒÚsß fÍ›iøõ”Ïð9›ÁäÙs;ÀáCVQtÉקɟ˫úœšô%[@¿JNž?.²‰[OG“±¡¾,ÕoäŸÎº® ·™}3Áö…ëߤ3âc+éÙZ™óYHHñÂþ]Ïgk÷4¨iñõî>“$„@ÁÍ.=ÇñÍ<‡¶&¸yÏdæ™”ðó³Ëw&ÊÆÏšßÛ’7É·g® “/‡Ýâ}“9ÆAÁÁÝ-tÆwµ½þA²’gI¯¤ˆ–Þ}ýýüýE_RDÊÊ ÊŒwq÷§ÚzŒ9\õc¬ã€9Bš›Í8¶ˆH wÁøãÒáW¸Î,6›Íú­³ªºçLÖuÙ¾EtPÒ2ãŽýÓ˜ÅלM-nå M£\œáek–ƒi·÷Ù{ .P¤ ¢3¿eÉi:~a¿Îcw—E;¥ö´7ßxöSíñfò^&ƒw” %©/“’““““““^½—""-Ÿß·Çè]7Ê°¥kÈ IDAT?(xû‡³‰õ‘ÏŠW£b®þ$ü©$-Áp?[ KçsWïxø꣔Éê´c¶U¿©5Ç´1QU’üžÎŽ'že bΫ Î^¹"&1gp'ûÛyR¤Sz›[î~)ªš(«Þß‹vprðêÞ£GîŽÍl\O¿)e^%ìäÚ%TL#˜ÿ,Öµg­ˆåJ:5ÑÅc²1ãã«/Y"DZ.§^®é¶ϲw[p‡ÁP’ÿÊÕÉîfjñ›«üÆŠ¬¨ÌŒñáÂîv“O+², SæÍY‘%ÂŒ·)‹Q.§¾]ÜbãÌ|³plב‹)²§=lã8NòCÙ‹£Ëúût5íоK¿àÍοMËe^~8hç4I€H#¾¿åäÖ£HŠ4bv ;¯>b9-¼ÞÖcfye³ýíæïÿˆ’|7§7RyÁŠž¹Y9¥ªKAœ—2|€ƒ•i'û®3£â“Þ‰1ûævs¯€2Ü VM™~¿åÅßž&CDŠ¢d’¬îöfw¿Qˆøát㨦lÑ;[{—çYBL;ÜÁÄ#^¦Ð€ÍSÝB–ÇS’ìîΖ×Þ—Qÿvƒ©õØÂÊò¢éÚ𪾢§{¶Ÿu:‡ º{µw‰[ˆétË ŸeL¡ÜôL‘ŒÂ¬xs;¯t±¼¼ºW'f:zŽÎ¢cÃ:{.y¤¨•Êñ²sºü¹°ZoŠ[;jЬˆôóÅ}}ÖÄÖŽÕ¿-Ì0¿¸°µas&áPºm ™) O¦ôi!@X<‹ÐrlâäÝ™ÞæãjÛÞÉwäÈέ X€ ï%&.ÊÆÛè(Õ²·¢°Â|.È„e±ÛTöì‘a*<‚T¡¸I܃úäÅÎyv;hæs›å6{óàf¿žÁª;ï?r Þ?¹~xÿži£÷¢ž÷µSó¸Åœ“ åÛ…•òAþ§+2µÎ­õe2YƒúÒ’³©¹Áfz•jï°pVÿI ÆœÞUln£Ø¸ãJ€’ÇçwO vçîŠóé H³¹s€¯éiêZ*ˆÈ"Р¹EïÉ@_ƒžÖçá·Rfˆâ™¶ÞKÅNý›2¤q•ôX,Ý®ïã­~NöÜýFŽ 4oªC@÷XlÐT!åá€ÖPݼ(ðÒ«lF Êzm4ÓrmÃv á¨(J*àUæ# éÀù'ÍyÉ‹Øyl«À{ÆÎ9}Í›X1ó^O™EqØ@8lÎ/V¥6××þ¹øxÚíw8iIwŽÜ7kÜ‘Šóõ¸ˆ×3ôô0þ8­™ëÖ á‡ËS'„$—Hq(Š`"6²Sfè`³  Œ¢€V5lÏQpˆÃç¡\L S%2‹®r©Ê^¾A%yÕúZU±¿¾ÿÎío­Ët£vVÍä;¾#?×Ë;nne7bĈžŽÆ¦~åxsPQVâóùSrylàÛ4£“W¬9Š³hš Å™©©™DGϨ۠1nâ=¼z©„ÕÕŒ÷üÖ;f*}Ùœ¹¹tV| í;©·†ªŠŸ÷ü] ¿n©) ó‡ø¯ºÏt~†-UžœfÕ¥.—r)U¶ U”-¨S !™÷õš"cŒð4évÍ s²ri‚Hˆ$fÎô‹ßåq‹]ƒ|õT”””øœï—J¥vdG–J[e‘”RmhhhØ°aÆZ|µüºE UUì†-ôį_3‚Oyü™ËcJóŸ¾ÉUÓÔ1±÷^½'ÎËP).þqE¿$™Á:Ž\3¨**2b©w1g%?*Ô7d02” hmåÊn# ›ÐÇ¥£©™©©Y[=®²n³-~ÿõoðn€´ÒÒÿòõ5@³º˜›Ï‰§†/‹_½v¶‘¦RÞÛ«ŸT ítIã ƒæ÷Ú²Û³ýÇÚU¥JŒ¼¨+kæ>j3b^Ÿ6Õöª5[w‰‰ êü"dZ7Ëæ,¹ðÍÃ+ÛN>ê6Ï T~I‰¿Ëe#M·¶pn¬Åa8ݬ»Ñ–¡ÎC¤³B{èªóEE™ĬÕëàÙQ_f¬ß2rj×À¯ãuÑR‚W7m»š¹òÈQ]w¯ÿ¡aÔÞ˜_6r"§¥Y#íS×ï;u¬Œ¼zKˆ®›žÿ¢ï]Ó /'Æ?Pf! •õáá²Û“¢»U+ÒÀÒÃ[{ãˆeæúÙPy) —ßî·å¿E#ù¹ýq=š¤ÜÚ+Sç%}xžå3;d݇m"È.FEÐ@€°_]Ú;ñ@úšåuÕ¸Y/b3uZ[«ƒî¼pmבËêxwP¿»gáXÀ2°5a_ØzÔn¨Ù×Ç'o½ r ž¦¾ïÔ¶õ/™ì«Ú3Üßæ_knøwmÓçÜ#ëÀÕ42(ó! ÏÀH¿¬ –žaC>AŸé Z™Q"×ii³ÿÒÙƱùÐ#Ñ0Ý’‹j-—DŸüì@ ²ß¿}§^ZC¸¢íÈÈ'~¯×®ŽÞx¸*fÎÝo=Z¯Íf¦DKOŸRSªa-=YÊíÈ”Û ~˄×vn܉S6)juñöÕ›îÚ”/¦•µùŒŠÚìiÆXΧ®'œŠ^yrßÅ6vðy”௠}pá‘õ°#ì*çJÉÜ[¿}÷1ÈZ·¡!_ñŽ B·%ûû‡€fõm8|u}]þÖõ‘ÌtC·…YÌÅÖlà«ê訔ՠþÇõÃk,{‚£Ý|Òë]ÕÉ昨)ó×ϾÁë7mÝܱj²QA«÷Ø8swFl8£Òböš'ø³Afq¸éÞÕÃs„´A{§q‡tQÅærܾ9ó×,>%1ó{qB_D˜¶ýÄÜsgÏ:áº4rk»íSý#lÜwt³–ŽD½l­†«ndØ ª'Œ­z_O°Üºjcôú³Rd¶ê´åÂ}KC.pTt u1žªãT°ø*†úz€Êwïž=oÕ´óØ ,2f`Qh!ŸÂ200Tæ²Ë;ºAC.©æ¬9}óᨃû£rr¾º¡ç€•+{Û""¢Þ† ×¢—ÎY±ô¤N[ç qÓTœÇŽZ2nÞ´é­>¼únô¬ˆíkÝO´PÑ1ÔS-wß yl€ª‘¡nyƒêZú:|% dèŠmb£6FÌ ’½ï’ënUåUƒ]Ì{Ÿ/,¨f+}§l#d^äò%:mÝ6­šÙoÔ)9jØݺ¼q銨ùß yÚM'Æ\ö6ւܬ††úl$—pJßÍš>—©C*ä-?{Ü¢i·;5g/Üp6S`ØÁåê£+FlKM‘åWO9ÄÕÔÓWQàYðéu<Ûúß½3EÓˆ%£œŒ£_R5ŸÒÇÊ9(jΓ@}>÷¸ì—p°kÇÃOHãŸ=_¯È‹Pû~ú %jË¥ðC¢†šÓiÔœÀá'©$è:$|¨Ò@Y5åù kÙþ¨S> ºæjéZxN×ÀðÚ“„ÔJK• ¿`]3±uqMÔÑÕuñÇtU²d`å¬UrPÐtmúR[IÆùi>þZ¥k¨ü—)Rjù„®9yK•‡E7'ìOÀßu 9G€ïw¶ù¬xñ4.šüµóò/}Ýú¨Zz{˜7I¼~&‰ãy{ÿTîÿw§õê¡1–_“Ñ ƒõ¯ÒqazŠH«Ž*çwaUÇ.@’ÎÅ|lê×Ç\û¯xP@°äÛÙ 7²K$ÚFm}}\yðúw=ÔÃÿAøN@QõPÿ[P§{¦Êþûo¬#ýØVå…ê>Sí?«ƒL "Ðÿû¶µ™?£ëTêoˬÎøü ÿ@mÝäËÜBȬ1}÷^ÏøÏO}jn‹ò>v|Ÿ©«|DBHfÒűÃýúúì¹ñžò3>/m **ð*ç]©€H=–m¡i[ˆ< ?Ë^A–Œ èsáYÿ̘Hyv.Ú¿¯¾ý†m>ýþ\ ‚´dt@ßóOsþ¦v)ýoõ4,?^ùŒ+©c繸9`ÔªDü¯QÔé„{¯!Ûü—r ÖØ–L›™+¬:†’Ôsz‡Ey…L9yø•eþóÞûŸ§<€ÔTh§ó?nnÜÞíúÀ³ |‚¾00Hí±q„3hX¨q# dß`›{²T9¾4dú‘÷®X:܇˜ þë.ý¹y„œìL¡„þÛ#ŽvöLûoõ4BÈú޶ϥ„ònߌ€ù§þñ–!Åž6Cóë\µ°8;§@òsGò÷z>uJ„ÁárÙ,&±ù”üèmZ6GÝÀÖÉZ槜{!ïåhxýZ¢”£níè¤Ç.¾}ûU,œªqPR|éf¢‡§sÒÝ;™¥´aKã¦?É·XÖ‘?½'£@Ò¸£½ZYìwá—Wñ‹º»;€‡Žø„íïãÑ‘ØmH5³oöp'5ªôÆÕÛ&ŽÝ Õ«F·~{ /JA¯ 0›âïpéK ±1xX|»×>‚uPy ÞCspnYÉpùè´G€—±ð¼z÷w 9›@«ZS—2ÏŸß…äO€lhmöÆŠ‘Šøð¦Å«.ÐA_QøËc¸ûÔ »:l=ôÈùrC`X>Xê (% ü0@ÖwèTKÉáp9\öÛÛ‡c?òݯűl:óÞ&ðÌ{™°™b_^\û iïÐðëµ4£®ÆxûAÅVïäìj¤ÊlB’ϯ¿ù’Eø¦ÖöFšl’ûöéãlìál@Ox>xú•Îf:@ȆpÏöcÏ—Ní®$οq+ÑÆÕK[¹ÚŧDVðùþ£×šß΢skµª/©—|Ë-fñ5L¬ìkr€ɡÓrJØJê&ÖöM˜Ûç$9ññÏóReMC+{+M6ewª€u;•mÁÓ»¦Î>ú*ÌñH¸}I½…£NÉÃWr+SÕߤsTôlÝì4YLÞ8YÊ£‡Ÿ²‹•4ôlímÔØ„ n^ºÑÒÞ»™&¼~rÿsV!᪶·°o®Ë€—7\Kç«\ŠûÎw?ËxZ—¯ÞòìêÊ"¤8#õñË÷bšṲ̂³ISM(úx'±ÐØZ'#!é WËÈÝÙJ’ñæî³w,U'·Î*TÎË /±—SÃ×EÈï`ãØJO…–”\Û#$’«â,\{´UƒooŸ½ú˜Õ–ÍtÊòWP¥ ÷ä °g7QÙÏ.¾Uõh7§yzu峪c¨èŒ‚ï÷_JHÓöæ¦-ô™‡%©“Þ‰i¶a+3«vF úúàÖ÷î­Äw“å,µŽŽnMÕ HŠ¾ßLHvñèªÂ%×»ÙµqÉ•çy@ ~ÓpÿI‹î>M:5·{בB Iεy›ç™,`óïîYÝ{üªSÆfÈy.oìâ=§‘d/Y>½_Ÿ‹o‹éü73C®KÌûÉXÖ–lÏH—)Kw¼ÿ–3'tÛkÅAïÏnDn?_ß¿[z¶c.p%æý:_ÉZ–µvUjîùÒÏÌ€€@øV@ í:(A¿`˜6ºØ@»a@>ï€P˜=Z;B@¸t€¨Ý`h ¡ÐÓ "ÎÜšh}aìèj ‹oÔº¿FLq ˜<¦M²°7Z[Áøé05 Œ àì ^Ÿæ6à?Bú‚‰„CÐ EU¦F`dYb€¸*-Mà"€‹;PðŠ@hlF]˜V´|Ú%?–Šó³r )*,ÈT’ïï]¹ú(ÆY¬ ›øÓPòæà¢ÕÇŽ_Z¼·b|ì}ß !äî¦Àá“={ÿõ~ìÎ~>=ßør'víž3ÀVSUÉÏËf˜õµ€c`¤ +I߸~í÷’j‡3Héû«vîƒ÷ÄÅ?º|`¸W·ÃoÄ•^Êv9LZ¼5)õãÛúõî÷&„5#ý&­ÚúéóƒÓÑ}ì=îç ¿õ´í±öèÏ_>œÜ:Ï»kˆ¡0ý£¨ü¼)*íݲúè­ÅÁTZø´ÙY*ê©76-Y±nlä9ä°n\ÒË{¢”FB`ÍÈÞã#¶}ú–öÇ–p—Þ“Ë\‰Â‘Ï2ä@äGÂœGÍÙðìíÇûç÷îÝýƒ€ANzÂü¡ $KP"‹HÎ]zýñ õýó«ý\vÜú ÙÏb¯ß=cÓ9.W¼oÁ˜žsùÏÝKóØ·Lî3ú ß.Ï_9q؈ +çùÜ}nç槽“ÑÒüü"ŠÀ‹=cŽž•ð:íñåCC{u}’'%-ä¼xÃÑ/ßÞ/p1½¦îüõÌ‚µ{Ž’øì9…ð#†„YÑ{W÷~›Ž_yv÷Ü„!¾kîçB¾ßÞìÜ3èø·i©‰ C{NÙ~oö-Ú°?lz¤£üþNLgßL €(ûíº›Š~é¥Ö%8gD?»MçҤߟÛ;º¾ÉeŽûçóìràßméоK"ó¬äº‹‰Éž9“À·³É¥ïˆEïlí—ßýÊTõåú\{‡°’_µ%J{hçäú69õ/Žð²°õ?A#Ò%—ËiD”&:·s}R‘AæØ6ò94-—Ëkˆ“ZÚ…/³]ØJø©qBWÀóÅx8 ®"âÙ!€ ‰¹ˆßo Ô†ˆmŽh91ë)sf j'F°“/""EáìQ8f)"¢4•õ‡ "R¥¨ÉE0FDt‚w¾ ¸s ¸(ê1À !b2 ^¤hDÄy/ iär-«GÉÅ}¼ìŽÇg¡äƒ§…óƒ"æßßmÞe(#1éócQ2Ä¢ëã;utÎd{ ¤¡½ÜWz,ÍÒ±û!#P¼½u‡ÿ^¹B ŠÜ²/—}ì­Cf„/ŸælãqëC1TV£vŒìŸó®µîÔû‹ ‘fº»ØßJ-ü‰ÄÿB …”óý-›«j¨ÁG€[®\x”vëŽ|@¢¦Kä:æ­Øˆ@ˆ:Ÿƒ‚ ay¶Öffš­ÝØtx¾~’8€•Ÿû‰ÃQÑWç~÷^MÎ$VÙ @¤h`±ªÞ„4 „]vµRmðîP ¡UÖ‡p)ðT€9íêÐcÀ°:òΠÁ‚ü/, o†™¯ Á^«æ¦šhÂóóÐÎZw‚qÓÀ»@îu(Ý;[&õ.@ |Ȇ[l.˜x÷ØX1)K/ŸqÓUü†~ˆË×Jvµú¹ ×­&™mÁ?ùÇ}·žŒÈô]:(Q°;iªÞMÏISÿÄWÂkÇ°  ù†ò¯q"*PÍHHüÕxÒÔ¼OW=ÌMMúv=1Ùµ¥=©¸àª2äÞ}$è<½“Ú#d©Rek <­.6ú §ŒI+,¥ŠŠUuóE\íšE ïÇŽ_ÿvæyÍÅiþþÁŽn^ô·²·¨æCµ [Ü4¦ß…̉>’ÕÛRÆ-šÃ°ŽÝÄ[•AJ¥±¹’èú{qáí¯ºz'ì“Ñ@Rí/ŸìË.èBà¨tql¶hÞ¤¹E4Biž?_TëˆìMf•õñö¾}4p€§Uøø‰#b 7 ÀSkÀb5WåDPæ+Ó4Ål–ÊÔ](jjgÐìjúÇÊÕg§¿&,¸þøS6Q¾IË“‡}ø˜Ñ ¡®šb*ªak¯ŸV㮬¦…V­>Sçnt^eÃ8Íí‚ÏÚÀÇÔ²]Ú#!H:toEGÝI‡žr#7# aó!b™Œé~¿êwužL1Ý™’K8„”ß"[þŠU;IX,ÖÓ Â++B›€ôûÑ„Èe>‹(ÒpTxÕ…Ë3Ôâe—–ãQ”SÌ72`×a%¬¤¢£4ÔA©ŒSJÌ*5@K¹bZTTùÀ&K€D^ëŽõ½ç0#”„pñ øX@ÛA’b€ÆÆÐÓzô€) aÞlP)Q4ÄbAPâW™”U€3]W]ÊTUµ0ùÕb3hOõ¼¸tÞ¼—Ô# ¿_¾Zùà£Ä%9%§dl•J¤‰D"«êw ìÅ©ÒXöê˜?FGÄôrµµsóÙ{lÒµ¥s‹k FÉÙJ¼8 ’´{®^“t]-^¾jý–^:"FaÂ6ŸÝ>?¤)/wÔ>.½CŸ}—å†Lì)ÿšÒÃvД5bºÚE -]]š_ØGK(âv3k¦x®¬Yžˆ†ÏE¡”Êh>‹%–0 nïâݯ«Ue^Is_yxŒàvêµ(|åºMëû7”ü,Å ŠåÈcÑ »$‰Và„ ÅA:N¥a‚E*çÄaþp•ÊóZsÙ,UåèEK áÉ‹Yj-CFôWKe6ʲ}°•8@dÏlÛ·566nÛÁþ… ¹eý§f Å%R–2ŸUU.Åå󽀯đ•0’esHõIû?ºT €´¦fc9],”Ñl><Ž—·²nGêôíçR©¹¾"-ø@¡Q —ºW-¯ª¦KÓ…R96!©ñߪnŸmZÐÏîïÖÓ‘—Þp:n1ªË}:m@@ Šàú>Ørm€¦?üÔ‚ÞótèÒ Þ@c­Ú”²$0m¬Vðh7ócÐÊ X²V0À»×ÀR†† A  ˆ Ôùð6µª…,š€º° ÁÀcÈ °^ÆÑSBq4Ôj¦¼Êõ3ÄÄ9˜Ú0îÛ ­§v”ógg'çè"€Ô|iËêº ¤À 9J™ AZJ±x\Rqm9‘çˆÅ M‚̪µ 8³/IDAT²JC v~zX+Õ(}c#é«ç¹Ð\”f~~“-²éØ’éo_<á5k7y`HH^J!¥ùÅrSgSgŸñ3‡‡öÞsô‚ÅxÏ|±’‡ïPß¡sÃ3{Yö=›>a ZÅM7ˆÚÏÃcãõo¶÷9³š©*EL,‡^DÅ©EÜn yæÍTwJš…ŒÅà/‰8ÊÊ Z˜µÂOešF“¼UYHHÉ‹Œ]Dz½^s ¾ S·€~m9HJ,E%|¬ËÜ¡øëW€Vˆ„oùzª­Ë¤F@S³1²# ˜»ëA&C.—†Ú%¥éÀ &äë«hȵH|“Z³׌!»ssú“ °Ö@ 2Aîó”/mÚj‹>‘J@D©_Eº¦ ¾Ôæ5“_õ»?åÝ­Ñʼ %»/žBºðÍ•ãˆ9u¼²„^5gg H—ìZ­ì6NïVŽÖifÌ—É¢o¾GšÎO‰[›¬À3÷m®£ç[>ØÛëÔ¶ùYRZ.LœuÐqø =ZVtp÷®/…òÚiV…¥ƒ@–üàÀ&ð ‚ػЫéŸØ!œî»/Âø ¡¶ÞYùЮ=t´„ 7àêixÐ:¨›Aãðf+¯½+ ­1XLàÃ⮀rèÔŽíŸUª2Ö-mÈÌ i>h´3=¸VÖ¾ jƒ¾[­£‹ÍEyZ„¢àtb 9a÷ÐàîåE”Ù)»O¼@šå>}–“ëaa¦míÒª(sêgršm×Å{Úe’ñôÆî?nà·h­zlg,AJ.“^Xšnäíe2AÖÞÝ{sTU\Ø^}’¢ÃòDRɺ9AÑ'Þ—K\WKW(ÈÏKi„+W”iäÊ‚’»½ízÞú.“Éä2¹4«T §Ûøí½zÊ2Ò Ùü¦êà(qäÅBQHhºŽp.¸9jáý³ÝÊY /¹{ïSMã»k±ß´ ú·T¶¢öàÐú;™”œByÞ8?§EßB–ݵãm.ª«RTqv‘˜FrmÇš|C‚ÏYl‡§Êål6¯¤8å2§ŽvnZ/'Hɤ [FZõ[^Ç~%NúÊW(ŠBé§k÷›9úá*³¥9yRÐlÙɘ–ÎÚ}‡BQ|hZ·±§ÀØÅšúðfû‹b9E}»¶ñø^MÎle£P†^³B²÷ŒIÎ!ÈO…ÌÝð˜ W—Îv¬¢€¦(jïÜ(Ž[•Z]fqÞçÝ{–Jé_æ·û5 ëÞ1òô'D”•d,çgciéØmÐÅ—Ù4"¾Y×Ðòòöysí%n•ôî@/ÿÂzuS.O0|KÞù­"¾Ÿoð®Ëw4-}°ú£1B@ºl÷y†EDÌÜ0½lêhNyCÉ×|oï’n âÅM“<¼|Çï¸Ñ|óT°wÿ€ˆqR%‹ª–3Ûƒ„>Bàù[*›”ˆx÷øè#¾äúÀK²wú ÆKUˆˆµ¹ÉG´(Y¶pãË¡sîäæïã)\y8Kó„0 c‚òû"»I)­Þ<ÿ_4ï‹R¥ºHùõ“1ƒ}|ý/Ü›ujÓÈðøsúVþâç}g0­—ÀH YdU·ÓöD‰޾¸Oö5qjÍ*&u÷âP¾P8xúê¤:‹ˆ5&ö²A=v «õ÷ó<÷c5"Ö§ú y Qš·$mšmmÖœnƒÖ² w…ÁE™vÈD˜Û—a:=k¨‡À²ˆ¸slTnéÌÖP€Õ-Àš” àÌÍ…[íÍ·7!8a¤z…ë2ŸšógYu…·· K˜q™c:7wMýølë†ËÓûGo2З0&X¡­Ì`DT+ Úv·ÛÒ»h[ìˆqîûY¡ïí¼ÕºôʶáaqçÛy€l;4CŒk›˜—ª0%ÇQ¸ñåàJƒ¶™=%lÛ‰1eÖؽgx]ŒìÞ@&E÷,ÉWŠ‡Ô0Ï*NLè<ë¯ÓòÛˆ‘¾@duòdOî–>ÑW,FäÙ¹õqí¦d@õš¢[†[†Ji-ÿC¿ž&6„Ö®/]‡“˜*LÌhª©Ï„ÑŸþ v J„ùÆ;k‰1—˜ØƒùÆͶ«OÀûs@'Ïž¹Rµwoå_™¹óÁËáfÞµMLïhP'1rtªæÇMC_²o£N#µµÿv4±ù¹øvÆþÏ ú¥þ*Ñ=@íf´Õ*–›kžÖÒÆÜÅhØ b¾Ë¿­ÇÄÈÄÖFZhòºbæÚë%Å“2V¼Ä¡-%ÇŽŸ^géââlm¡{®ïŸøpæÙÎz“"ŸE§— Ÿ)ºÜ²ËÂÙ±u,v®Ð«Vß²t‚‹©¿÷I뎮Ðɹ}¥`_z;ëÎ<½ã`VúÓi,Z?žM7Çß-OÅ¢³Ó²™R–‡j÷ÚU¿òzIÙc¯½ÞÉÞɹ‡í_45ÅÚÞ͹ü±êÑwi|߶¯N P<ð׊õ7§Ðe&¿áOF»ÕøGéáï¬ ¤}z[¿~ùû¢}ežNßÓz\øTYÒ4ÿÿ ¨Þ …Bùƒø­/SÒ;¤›ø¶½nZØ·g¾Â^±C¼nTZúÝÍÆ cG[R{ójröMK­Þë.®ãƈyݺz1ûGmûFŠ¸tè_."Âæ¦-.­¶êòœ(Bܧ§µVàTåKmðÞ©Ô)…òŒ¿q;y}Î÷× ²¾MÙûmþcc.<€ô§¹Sö'çB@UŠæÊʇjª_O?‘t6ŠÏO]Y!·µR<\35jyr~;lÍoÕ:A$DºnbÈÒݧT×äg“]K´^7ÀYûÍÊ7OÿTG€ºÊ3¿Ì·=Ϊä2Ã0ŒL¦ä’YÃȸ1V¥”Ɇ‘©M-ü²˜ÛNÆ0\anÀlÍûâg¬ Œ%WÈã+ïŒô ¹ÚŒˆª‰±ü­_—s‹›Ó^ÍmAdYÃ0*ƒa?¥œ‘)T ¹L"a¸*är­v²J9ÃÈ•Zq(r†‘#¢BÆÈ*D|˜¶K3I¥Û;0K4bv*‹¨RÈ™:‚¨9û“׆&2&U÷)J»àµé7B¶Í™;7!aBLpxä” ÀãïùA1å,®ž5dÈÈE æ†EÄU([ßÎÊcýɸ|ŽªÓ ç0ò³)^¬¡°wÙÒçþ5/ÀxÈ#<žÚ_±°à±Ö–-ÕÁ¢*ýì¤S놿ññ‘°×GL] Ž.ŒÍLXô¶82êG'ã|c×ht05aLÔÒ#ªõQžol¿ ίOÎ<¹S³C`•J‹N½jÿÝÕœãd¸d¨Í7[/ÔP)w ¥C½D¬Œñó̪Wÿ8²gGa™«r<ý#+eí׋ûMUGÕ=Éój¼EEYi“ŒeQQáúC•¢îÚ)ï¾ì÷Ï¥:¸èÞ…QÃFí9–’rü«1Á!ÿ¹rU ¦¼¬\¦Ô÷.Noz#,r\çéü’êëžûX-Œ°9.è­O¯¢ê~´Ÿ×…2.r’ùWDÀþ+eˆl]eÙ#­€`Y͵-×΋›ðÞ¼­\-uUež´º_û–¼7>qýw¢P:Ò»xîEWÛm+6fæT5ÈÞšò‡{«IÏ(íìÛ“sDú´fQ[º¹÷êl»ãÆòWíõu²DCß ñpºÓâûZ¨m\^þ‡³mñÜœ~R¹rëf<ËN/¸¿ ¼Ãy#*û¹]ÞȺaÓÛÙ¾êfQQQÑO·Ü‰jr“T¼Þžý¯¤eEí•ÊZ‡`wDÒÝÕݹëÓðT4Õ5Jå*”Kjªlº;¹;sSÜà÷vùµêWúçD¡tìÈ¢åÖ”K×,Y÷É‚úÚWÑû_®™¢‰%%Ê®n¶š§¬t•"!÷³ö,õüo€C]]}CS Ö××wïÖÝÊ‚ T5$ݪþxÞ`@.lQ:sÆœ‘³ÇùÚT&y{ùfŠéø!$]8#ÔØ°O*-ZÌ5Âã9:º# Ó£=bÎd¬š$º±m½Ý¨å/ZéK€µsÈÒ塶}Ò¬É+RO,׳l=ztf$ ôv¡P:ÐÜh¡»LHÜ4Y¥¼eÚ¨˜íg¼ƒÔëݬk%õèæZ©^ÖèíïŽ+$Ò‘â(ÎXòÈpqäGÓ…/v&LùÙš¦ž}¬ÕÃÌŠ’'uÖ/õ³S«D¹ù?oùYA%ôu3×DîÓÅ¡+qìw*y·Þj×ÑõZ5:«>~MZËâdÐ5‡Å—Ê“¯^0™«Åµ¯,õ*‹h¡ÝOƒ oQXZ[ÐÛ…ByÚx™"„`õ×ÇÅ? „gÕ©‹ÑŽÛýjÅÅ´B9†ìyå­“Ý09ß=”°QK.åææp¤íHTvuÉÉ;ؙ+wÿü å€èOE†^íéÏÝàT¢JŽn¿×‰ì*Yã•ŒL‰%T„!Å…;¯K¸I+&Lß| ¸‹Å=w|v´ÞòyOg;@`ïå¥_/m€ìÙSÿMJ¾)%Žî;dóü0 BêJ 2nÜÕxPPü ÁÉQýÊH¡P:ÄÜ qŠ/îú¶È?r˜8,D${mø”_P)%’&D° L\6Æmß#<]Õ Î§ØSnJ—¬my·•<¿¯÷FÛk”ܵN“c¬¯>–iÛîœóeOä¬ýgyÃI=oÏ“V-Ý3ãƒ6ГNïõú© = Íš_ñ‡¥>¨G0TÈ9l®'¦ÙíuãþUßfppþáNãÍñLc`Mt3îŸWeŸ•!íÜÞxÆ›õUúoùìB•­#þUU¥K§NÍþ÷´”·Ȥ¿Vîæà088@€°³Ë9Œ°ßÈa}å09L€D@84Þ%PØK/oà 088‡˜á÷Ž€NÛíSÓm šžÙb¾þzÉ¿Â{Îar„=OJ pA¡‘í,ÄL 8.8R¶ž„íÙçýŸµÛ:™l³½{gÿ[z‘w5|ß*?rËàY£ÔÑ3rÞš[½£õ£Nç[Tè Ùloý±Ï…6ïŸ>®kï±ãÆ$Yg¿íl[Îxgy|ÚÜ9WéY)®Óû*à<·ʪg‡ó7Gžxc ¨tÎy-³Fò·Fj/ z`ˆ ŒCV¯œÙÇ={${dÍŸ³OJ$YæÍébàò7ú¤ûù a¯žo—^xfŸUøÎe½k^Égyl˜ ’uîýÇ»0ü²‚e·ôxâîÁìõa7&p0—æš}ß>{$Ÿ=rÓÍùvä Î`oúdbҜLJñ·GVÜ–ÑKbàb¦²@ Tê°êVSëÝÅ|L/G¦ýOHõ{^¬Ô­”KÀžï*îXØ|÷GÍíŒ÷ñÄÓôÞ÷ïÚ¿Ï®œÂÔ¡ ®#9…‰C²Êo u3‹”@¥`,)7킼òæÎßÏ­»hvmeO9³Çí½­@ðO¯ìþˬØaB‹ËI?;–ÿ}NÝ+Ë›þ²¸Õ28ãâ8¦–T{½‹”•¨Ââxóöž½÷4}lû=›Ék·d$ƽzfü¼vö~xûï—¦ž›Èqò)=Þž·tÞΡÏUú$uSV²l6u–¢¶mª›úBmƒLƒA~Sç¼Åk€PÚÑ~Ò_K_¬R¼"£/Õžø ¾ع¨|æG-ÍA!#Ä9`}îŽ>W9=_zʬÛŒ®N ~½˜qŠóƒ·wÞ±![qÏ(‹(§!ˆˆßaFeŸ}ZÏH•ä7Aݾ¹©ÜÇU'(PQ«ÃBá7Ú9v«Jí«_V‡v»âá>bá2ÝH‡L@xX¸@ÂãUÎ$ olç°xõ&ÆslÖ<» î¯ ¨(­5Ñœs{‚ ºmÐ]!„“É{ž£ãE 0u€pnÉN™Lùì]þ¶ ÛXîn›˜vur[pÃٙʪÖ÷×ÕžX§3U™šã|O}Û¾ Rÿ›š `˜2ç@½ÿÅå-;9ˆ´_TΫÏ[Û^ÖÊç®ê¼õbç$'>iÎÖ@S«n†…Œ#+ùêxþé×­Ÿ–z5Yûú„”Û RÇ/i°yQí¥¡‡ïùVW‚J¡1ñ „JNGŽxëZÞhȸýäô¬öNI‡ÇDÀ€^Y*–áT vûBí²Ò‡ùg>V± RJ¼Â;CÍÆ‘l'åµ-_„RÏ7|{C“Y;%oÕùê¹”¬n ¶N#AI¦$îöÓáDͶñÒiP– ¦Bü!Àöê;å/TjN«o%• ô(ð8`J©0Yƒ[“l@ÎÖ󔓸i²úÆòœÿbÍ‹§Æ?!ýêiYM%µ…¯4[ °N¸i`oR~ ÄüúA.Š1Ô9C7êR÷Fm÷íÌ9`“tjŒq€q¿Á)A€6· =¬¦"P *u$Ì£©¹ºýªsãYÀûù¦@8çÍò&çÌ2Zxï$%;ÖÕ½ßsrŽýšã?ë°ü~¬sÕÒ=k«`m@°Àƒÿn>ùÚäÅwYW6èPÕIýcšw5nvó6o× w]•ãþ¶#+?%×J^û¼f~vöùƒ]O^Ÿ=´Ùr[/ “ƒÒŽÊÆE„Ë&'ÿà-,L>Ýéý„û·Íºæ&wû „Hö¨OõW}žŽïwéþ8¯ײoöÌ\êq:-CÓåF¿}”Ówáó ĪL?9ëã32¯KlÜÝlâyqt×]½§†×¾ÛðKZo“²“%4™½@hK'—á¾ ‡‰{JPïiDâˆDÕ0šdE°eƒÒÞu!OP©Ãh9ß7Ã`ížÎ#^ÞZ¿Â¨ ?|\Û1.û½ÉÒïʯøÞ¯‘]g!÷_§ô˜.›K–×<ºÔcQ[E@±emU¾ÛÿÏ 2¦ ŽáA}Á¢Ê›ç770.}®ìÕ+sþrQ–§ÃÿàK[ÿºIæª2úüµ0Õ¶¾æ¢¯­Ëf™Ãç¿â¹ŠÙ×ô|ùò„–z÷5¯ÔW‘ß2¶þ‰•/ÄC‘\*´{Ÿ©Ø¤hhº·$ý™ó{~”áIé›8ÖÚ6òyÿË7g=]ÖþE­1>ß%î Fåí Ïxú‘Ág6ÒS{Y×ýÐTíã¿ôXTåÉ+úžØJ/,·5üà‡5ļ 9·ï“zƒ?ìS‚öÖk–f,œœµ>ÖÑârNËâo¾R[JâE•@¨Ô‘ï¾,&ó8ì )#zÛN›˜-k7ÎwwŸ%k¾»üé.(áùRæs˾ø€ƒ …Jƒ5å•ÅMÓ‹ÀÂÙØ{›Á=õîK-ºÔ` Oÿ =þüæÇ @¦ uäcÀ&ABãîÖéw7ƒ”Àú›V£ æòõm!‰› ༣Íÿî’¦um2ÌçþYÜ15íÔ y×ÖºÛ¿jÜÐÁÆ>cÞ9!6Ë%oÝÖpÛW›˜„Mõù/jãʶòGßÛó÷¥n(êúmÖNŸÇŒÜ±íÛ;Þo •:˜¡‡4 ÷Ö÷mÏ}ÕâvFFŸ»6G{Môâ¿æß5¯æë­<Žýì<éSCdÆR˜pǾì©k¾ëÚH( 3 Ç¿iö!PÉA6Z$ñ`Ž!5$P̧Ûô'°I"÷A DJ Ž¿Í&Þ4@pô©\6)É©DáR½<ÖJ%[¬ìˆfß.d0‰’8›”ìTÄë.Áú!>F’Ž«}x³' Æ«Ü&‹Îd,§Jb­¤ÚÍ¢z„=œ´=È:ÓV ~ŽM!œó±GEäð6Bg¸{ƒ´¤6ú bôŸ ‘ÿ©ÕNHÐÄOçâá ä»Z1$$ÉúJÁ“£ÐãèhÏáU)âÕÑŠÂz^ŒC¢-ª«Å`:Úƒ¢jƒ@ 8$ëçÑpôÄÀÄŒ~@ ½)•â]KêQ€"2s3š:'ì|1‰PÙ³Q;…S3>Çä‹~x÷.FCÒ¹`à7k9Ú¼ZNœ¹åÌ?à/³s[‡wiZ‰N@¬Ð%O’Áb4Õ1IºÜáðs/!àLë ޛ軱ͿM‰ÜCÿ‹DA@ T꿱ˆŽ†¼±Ù?Ü›÷W·¹làÖ¦ÆigDSö–íÄú”—r6}R–?Åœ°møôÈD¢(‡pƒ0F˜þÆ3°So ®¸ð›ÿgQ6nèñcå¶ Y7ni(¡ò`÷þ«zr"q œ’`ÆÍÖ}v•¶ÙOc†·ô:µ9÷dwb¶/&€äoŒñ»Á¹ä®–Yz§È¤o¹µßD©üÙžUþöÔþàB¤áK6sƒúÞöÓÀÛÀ0£ÈäÎ-Ù»Oý`7`àÈ4#†;®ü_:».…öqåcÏÚ5îÂnë_×OêØÆ2oÄ(T÷v• áT÷nè 3êbïë¿ò o m®ª÷× Ù7 —˜Y×#/¹j†\>êë?g&ΩMí¹kÂeƒ6ÜÞ¯6ßÔí>µrƒn¦âO.™íPILÓOÞAôÈf’”€”3km¯¦Ë×uÆŠ•G¡R‡×Ð Ðönˆ®^1ãÀ QŒæ)ßvÝÅ–sê`´ž7oM>_Ñ5P»“Ó,?ëKXíà€œT~êk¦ÍJkÆ>Óè µŠ+dsÂì1bð{yicFä6)çn8@pHÖ/Ç çQ“TKøá\q4ûaF§/b“aWÑäîÒqHŽA§†!¾}àP%(.ëqàK1Žu5¨êˆ¾ˆçè—„Q™øxÔhö¥L†Ë‡`uö¸ÅWO ’õKwbböÑÒžÃ>.%S(Rô•^ã!P¥èV)ƒ€„ŸðÁ!Y?ùh2G¬BÒÏ"‹œÖ`ãÿþ¹°A¼Ë@p øR]6P‰ûk·4ÕÖ›ÄæÈ,HɈ'fÔÔñã `öò n¿×;½WžL8'Â9‚c—"ÞÍoóÒS5õMÞÝ —½xó¶2?¡Qbä9!KXþåW^wÃά\¹™hÎæœsN­P-¿0ìØ*6—sP(Öƒ¸¡œTÛ>‡›’ EÆáò¶9ç² ”þâ)8ç’-Ò¾wcøF‰Üxà˜R)Ö¹{ãªØó^š|î…—==.·iϺÕF›5¶oú¾²ð¢G N¾rü׶~÷A^OŠÉJJ)|ó‰':ƒœ€JdßWýþ’ºù¹‹È9g†öÕŒðZóÄ¿ç³9ý{È8pñKB¸gã›oÝõlHŽœ™0oÑ«çÍ_Q­ÈäWû2B$ZñÍ­§–ìþ’?Lˆ¬º×Þ3é‹%Ͳҵ!ÔØüÙíV7é“Ž•bÄ9äúY§ŽJÒ˜§¦©MIÍŠ’ o Vÿ­ÇšëJ¶Ü’ÔÓ!í¨ne4Ê­‘­zÕO[·î–(À ¥²¹dI…lAx•yÑÛwµx%Ôˆ»CeÈJdx‘ª(@![ö~ªk»Dd+¥R$…*¤} !•¥î·“HŠD8ˆ IUö;¬¤B’‰bá t¿¦†ÙßIÚ7º÷ áºíTV©¤„w£4rQDêú ™Md•JRøR$@N©Q­È1UrÁK@ðÿÏ—"€©¤}ãÓ•5)I“Ÿ<¥‰ŽyTFG5““Tl³ª†»Ó ©jt}¨š3bRõgÏ× })}¿|Äô–ÿ4ç©=Õí¶ìi®¸¬þ•™%å;Ÿ¸xÐïîêX¶zø%·Ä¨ZùOnm›rÖÕã):7=w‹>õµ¾ü«ÕŸÎñÕ„ÂË'œwš¾â×ïnt_úbòe¯ä’½Žµ{ó÷´õ½wòÄlö‹³¸5ª¾ø[EÊÌÌŠlÞZãèwá¸Ë.‰SšÖ=} §×-ý~èý¯¥¶­^ùñ?Úôø‚Ë'œ{º "‘¶Ÿ<[\T¬ËÉ9§Þ;rl/hà¬qó[î,¯‹é}ÎØ™WÆÛ‚Pùç_½7ÇK’^pÿÞ锄ꖿ±qɲ·¥Œ¾eÂô1‘öúË×¾pgem(mâ­£NÓu«(!;>|´¸x\…#.¾»GZ 碓@¾TWL?¶ßå/Lœy¶wñë7ÔGéúX*zÓïì¡Ù5Ëß[fÈû®ŠÎ-ÿ¼º%îœiz5ϱþ«·æ^óLjlî¤;ߘžÉš·xüAèÍ5Å›´3PϦ]»6¬_üÖœŒ³Ÿ?óέ۟™ÿî°Èš»¾êûÙI3ÎIe „Ô¯xfg`ô¸ñÙLÿUöªy…FüíâÇ_±—¼´vÑÈ$ÐPZQR1üšû“ôŠ¯>H‡ÝuÆŸrÕ¼ñåg©ß>³~[ÜØÛß›qÅŒš÷®Ü´“IVsç«îæ'ž|ë ÙìËåóæëŒpCii]áu/¶þÝ÷ þ]ß®]´kðu¯qóm¡ew/ùÑ#˔Ȗ–•¯ÆLxô”+f¶,|´dkH<Û=ëÜ¢ê¬Iw¼;îuõ·{ 1V%D«JöͤŽŒþ=&\7ýòª¥ïù££‡ìêAŒ6ÝÀ¹îi²+V><¦apå=ÎÒÇKÊa™"¼iþÎŽA'œ3=.)yЙ·Ûv/lÐ-¥TV$%6>•4´zY AsÏs”VÖ#Xñ£7y†½õŒ¸±`P–%aÀØ NÕ6Ìj*”kjæµù#ó¬r8HHÚÖþmýeÒWÈ ‡”$É‚4÷¦‚A]éÑ/?!Ø\n‚‚ȃ/íÑ'‹ÕÌoK>ÌɅδÜ1^X>»YCÊ”?ŸröЖõŸìÜÑãDûî&ÒñÝæ2{þY3㓲û_òRá°A„sȉƒ&_žšššVpz<ªý&ì½N;骋‚%_íظEµ«-[*¸DÁ4Ç€[f»ú3|¼³aOi8"IÝË~ÚD†\}[zzlæI÷õM¨¬kheÛ‚¨ø™Û>ºÍ?þ_S‡¹t£³sod? |'š1Í|Ðݢǧ+Z[•Û8:‘²c ßÌuf=ú‚±K¾ù°ße‘ËíØåmßúÍýÓ ®y›CMzdÜE²$gdm¬híoÙÂCznýqãîä`µkìLɽØï`&@ Å¥IXç ppnIM ¯I5Ëç.. ÆŽz"ÞEaì¿ïþ>ìq®&Äø$Ádà „(.g0Ýå;J>ºsÀ|AÚæ…¶üoK4Gμ85¡5ïú8åžÝš”h³‚1%­Ç€4ŠÝDQ$«…3pÆ@Á9ÔKæ¤i‡N¬‰÷†4+˜ xu»ë ‡l)ý2vêCGrâoèš'A ¯$fÐ'+V€ƒØâU¸ ný(7VãœsÉæbB¢‚(øqN“'ÜyÚÍ¿s-~ž3âæ×O“‰h™ÕK8gHŸòô˜ñƒBnOÚIŒWÈ8?fæôKÒà)ã·~ú…¦(` ©g¤Ë;kw7ªŽx³yýÆÅË™,CóünÄ5» ¶ã«­?¶º²{ÈéÓœ- j|™™.Ù‘=1°qA}[€è­Û¿ù^\x< IDATê}nŠÃì>9Šƒ«©¹ñI“Æ\0¥dþ‹n4ây[Ψž‰%+ÞùwC}½·iGÙWO×x èÿ+uŠ,™ÓÕ– Mí†Õé ìúrý²bbµ*’ÔYµG7ý•ß}Ø2X 'ŸÜ+®~çò5Á ¯aùã‹ç|¤d•b.Yºšc-›Ö56ó@‹ IuoùwC;ã¾»Ö×'gä†c¥$~BߌŽÊ7јxɨ/ýîcoÀ5I‚hU)pnš4¶÷äS¯2åÂìÞ=ˆE¡Bµ§ ;wðÔ+û)P$«ò1=È"?òŠÖ†NÝà\Êqí½ßþáƒ;'}>ûãø)¥G_òÃ_ÏÝPÃ$g¿ÜøºÆÖ´ä40¥ojŠ›¤d[)yg›”ºêÉSßùÓ…eôìÓ¯?SÖ5¦‡LsoìÎ4´c,nÈ•ýãËÎúÊT"S\É}ë›yòŠïÿ~þüÇo*­Kð»‡ãbd€3C3M9‚2M„›ZÐd€7|ì¹ÓJfÍ|ïö)‹¾ÚÚsä`J g\äýüªwﺰR=yây÷|q_é. »õEuë_æÞ3eÅ:søÙ—[dnjÁ®IÄÌÔ5dŒ¸ÖYñÒwœ¼®T=áâËÌ-­üzU(à‹-Qüòéïÿùoïß šCÀL-¨ñƒoy3¡êùïœðÑ v‹X«Q 8nÂa ƒaQ9ªÝQYm6/#2ðÞæ(¯6Ëpq>ÖÖ ªûSàœ’PºÎIx^…àŒƒP™EÄa„`2H*df† É ¹kOÉJ$]ç rdæ7 kœs"Û@ h:@(QTè¡ððd-È9HxÄ‹"©%€€040Î"Y qh@-D´”p †ÁB$(0è!0ƉDKdòƒ ¨A0Ù JÁŒƒ‚irB‰b'‘¹SL‡aBµ‚ià2¨.wm×8'DµÁF.D’SƒiŠ…Çœ#Õq=‘sT´G¬(|vNX,ò#`†`îý‡ì¶;À4hZøÏ`!h]{²Pdl‘pz`¿s˜A˜]§‡ê:‚ {ÿÐÕžðÆýÚ¦ík$× ‡Šûvë~Òp›öÛ¢ù»»ûu?‡Œ%»ïù €±_³ö¿ë¦í½O J#~@ •Á±Äaø š•ãR&ç8X2X4a0p@gЙxÛÁ!Y?Ý<ŠfþÞì ÆÑ„öÑ*æ ÍÝ“¢8GB |ZÔË­@ 8b( …ÃrøR:ÃüJìîŒBã&bržÞK4‡E Ž;ãÛ”uˆ¯ž@ 8$ë—íÀä ô;TÊäø¸‹«¢òQÍìƒa‰xîG@‰æ7ÎÄ•}ñáN,ªß>@pHŒHÈ䣥1‡}\J"Â]‰€„Íó¥ÀAYüIdJ ‚C1òÑd+Ž\í p€ 4¼…Gד@¬w'ÇŒ/HzÜ–grK×($±uÀ­åùCaD­ç‘ë>Î_÷YëØ·«STQ°M Ž!_Š˜±E÷çokªÿâQ§Äm¸±_I=¢hIvBl•¯Y;OuïQcD h°YÖ»U{`^ÕßNéâº'Z»ìVõr Y>¬5…YH xÁµ5e³t@KÌ€ô ·X *¶&qŽÞ1í馌^¾¼K˲cc·DÓ( dºJ¦=Õ)+˱ÊHùö”þ[6G«Ðñƨù¿‹Õív˜Þ„ª5R÷I”»6Ü:æÛ¯÷ùçæ®Aó§õiúåñ°Èªÿ·»*ùVùú1ë¯Î“jûÏ=­gc°û6µmÁ°Å¯Êb± @¨‹;÷Üf—“+µ óª´ö^ã¢Éî³îÝAÉ©}_]Š-cõýYÕÕB©g•Ž¿0雋“Ú©kNqÅYsš~µp²ìîýÁi®^÷u¶|ßÑ`&žW<éæ )òÑäì„fËÖ þfûéÑÜ]?ÉL f\T2öò ©uAÿå³Á¥Ž–Aw—ÅÀbªÞï³aŽM3B)g”½)px’7ÞŸVñ£…'TŸørUF2¼ú,6ÁÝN‰ì˾aûè3 BÀ™£ò•_Y5Ý=àÏ; Nì&×¾ø­/ö.Y!›DK>£t ~•@Ô7Ž;•"ß3ãë­>mõ­¿·xÔdQµç·ô¥`Æîy«¿'ž‡}%­ŒK1`nË[ùfÇèYÛ²Ò­Õï¬zÍ;1=³%ióy¯IGré§v/­=é¹äï>+>ý/š^ýý-:—tk¬ÚÜP5õýRSÞ¼+’ϯI³pÍÏ2¯[?a€­òõ>51[ÏøÜkñd,¾,]î†ÇÛšë;†<_Ü·|þD|æœÖ˜âÞë?oÿVS‚œZôd=»ÊzÙ]!<³qøƒÎm¬ý²æ‚«•öZ-÷îuùCaÖö™s^NÚä]yÌPõÄ’3æ1ߺA‹^NÈ;ÁÝå$ZšôÙÙ¶cÚ\·]O]qýà•¹ë¦ž CÈ”@p\© Ú‹XÒÈ€Ë,±uù#2ŠV+æä$ÁoéF…â†7çö會¨ðÚ›A€ö…iÀîô,NH  âÍSt÷ÜÜ¢júÍh.¸$/8á& Š5'Ìô8-$Hò9UU÷€%£-u€)«ö– ž~ö:- ÉuC'æ,ù¦÷ö—´êo#×ï‘LSá© §í m–ÁI©LBýˆ' snÌÈc’ì‹ÏfF£ÌÊ©¯ÿÇðïWLCÒÕV_'PÅ5%¤ª»Cqn_‡5Òl[ëòPÎLwœ'å-üÌ¡ê¥B¢‚ãË— $o{<1þ¾M…# ÆíÞfØ.4¢H¢8'¦Æiˆp3H pj‰þ®6 Å mÍj+–F½ƒR£8¨ÂHH²œ¸ù¬'s‹ÞëûÝ¿%ËГïë$ÝÅ.ò§fˆp.tÊ ë2÷\:°†§ ¯!ˆ «èîÛTjó&âFsŸÏnˆÍ¼oó9§jrK¿y7QbtšÀÃÇ£ ' —ö“I3}ùÝÙÚäÍgüÅog=æM‰å]B©X€PF©…uËš`^GÉÓ#+^8¨Õ›MM±Z€@p¼©¯uŸºâÅ¡_JŒ©:²|ÂùÑTþ”´g}wC’Nc¶î&uTŸúZ“=ú-7#‹2€±°™çŽ|3´T6‰@÷)!»ŸÔH–*Nƒ`{ƺ{z——õ&åDŠ¤çNü‰™RÙbGèüN™ e1¡ŒZמÝ%o¦’æpù¦Âá`PncÁE ¡¤Ý#fhVÀ·!. ·3û¶Q ¶®Lu§×¦ü¬§`´¹:=u®ñÛ ŒM‰>¢0Á™ìïµq9 û­–½Éš¦57;sã˜àB”Yá>à¸ó¥`ºÆ”ÍÝ­]V ¾jÚÇU3±Çˆ=§>öÍì­ß” ’°íuKò%íÞ׆/ÓÊ&Ýæ§MŽ¶F_f,'& íŽk)íH E’ë`äý¾²ø¬A îß]xº*é±ñMß—[µ`%¡í=NÎ]üL¤']¡Œ•·¥ÄÜ¿þÄ>>©#uÇæöl_ï•Ëýö€­³’gŸÓ¬¼—»mQeV\ÏÕO²Á¯$Orúm¶Ôí‹ë†æf®ÿ"è€êÙ³7¸–T>»%åF³mN²¯ß—ƒz"ìK=mü[vFŸº$%uÝŸz˜×®;m:ãRÁÑôÈ#¾£ë •£Üþ¾nÿŽz'`r^ÚNzÞ¿ñ$zT–á–ÁXTƒ]î­®Ò±ƒÄóÄ'tõ#š>µ=k´NOöDKÍ'=ʾ³XÆ—Ž>?”8ÙKÊ2K>MªÙìuSy¯A&*ÓÊ~`™Ó|jØÚs ÆÝÿ‚ Vœ²g…Óh|ßÎþàajÇnž8¡Ãe x*XÂhŸ]²u´y3FëŠÄýZ’-ÉÅogì.23®.3™ñø–ôWÙûéõõãiŠód–•xrOlÉaßóIZÕ¦`¯[ÊóÓkóéŒhMöPlkvA{rokõÜÌÝ[<ƒî¨ÊIMÚ½NKîOüž¶>''l}%¹M¯9áöŽØXbtXC–¶´¾Ì–Õš–šPòvÆîµ$á¼’ñ§›Œƒ!R‚ã–Lï‰ ûÑÉ:¬ëKù œ»ßVGeµÙ‹óðØôyP£ùu3P|1îZ‹¯«º=…Ȥ"0B"yz`]¼puZŽHHt Õ°®Ìõðf×þÀ¾ƒn{r„‡ŸX·ŸÃƒa¬k‡ð§H×n ¤knV×ÙÍn{vÿ ëvj³ëtk§Ù5Í‹tmßï³8ÈÙ‰Ð(Áñ ÇèT¼4îh)‹.‹'r<6Á¬ÛÏû¶}³ÿ‹ ó@/-"_ä`‡ý…s±ýQ¸îÓѺfq™œý€ãìÈ?oƒÙí\ü Ÿ=ØÙÁÑÈdP)@ þ{oÄ12œjôEP#ƒD…3š×ê RP‚±ªxÛÁ¯Ã»ry0‡7{‚q´£õQY$X$¸µè¤à€KEЄfŠoŸ@ 8$ ƒ!ÑvøRŒcsê<Ñ—0Å9rãQŠ/K¡Ds'“áìþø©uâ«'Éú%Û1"ãhiÏaÏñ ðëQ©R!ðéP£¹&®ÁÀ8B|šH®‡dý‚ÆQ´„ÈžÁÑË‘š/Å9¡2$ ¸ Óà ÑÒ½ç„P”¦Æ„k"ÇŒJß®¢ß±³†Avö»pÂ¥W¹,Ñq8!Ä»ë³ÕsÞhó™Ä–=ä‡ú÷ËŒî…òBe^-R Hk|{ŒÌÿ…®çœB(˜ÉÿÏ] 3Ôîíd±‰ ]àf Ýã6]iÉמ›öÝ’k?|‰‰Zg}­š˜mQ9œ`ú+MG¶ÓÞí›Âž†&[rOEýà°s„"~²yìÏ>ýáÏÏॴú××~[Ä£$ÜHˆ±}åkÏÆOùû9O¹"\Ê{×»Öä\UBB¯á¶Ð‡9º—˜§ª3uÀåcf 'ŒIRû†Ç/üqá–ÌK (¡˜B@¤®’I&h5wmMyj¾(ˆ7#!\B»ª™]¾×þG T–•ý株ȪÚýe ŠM—¤ áÒ¯‘crÎ •N(iBA(Æ¡eB»ÚÀ8Û¿a<¼D ‘-6‰JTêÚ-\½‚v•$ä à jŒ,S*ó®dÕ),µ÷DfäÔ¦Q©R „Ê* µm_Ѳguqí a7M’x”XyÎ9‰‰MÏ Íö]kÍÌ1q*¸ýk;B)ÔÄÔ¹¼­ž¨9ËožÜ2ì©xý »ßˆ+›µæ›ÅdF’úsïÀ^ÆúOf=®/þ¾~ôå×TòXyu;!\Nš4úŠ?¤Æ‘`Õ·«ßŸÕæ× ¤ <ïáþ3¼;殞;ÇÇdÆ­Y“o>nèÑ:ªí|ëwEò”>æÚÚªJŸž;úÏç¥×~û»éÁ‘KwzðUeý?~üaÁ ìF\qOÏ”½þ‡Þ}­ÍopnXs/˜tÙ%NþŠ/VÏy×Òaé9xæ#ýz°`ãšWvþ{·³3iÒ'Nÿî>UUÛÎa’ĉ®½== R ò‹ïŸ^ÚÒÜ@ÓÏ<ñšßÇ+­Õê¿_óþkmpníqò‡-”ÅrÁÿ¼?}dOgx«77×Ôš’…˜Ñ0!„œZѹñ…•ß• ?ç,™qýöˆÊ6ÕÕ £~å–퉅Ãe‹#ÖôÄM~à­iãšO¿ï{Éëgßÿþ”C¶¾ÿ¢Û’“ÊÙrÖ gÜõwé3¥æ´éÌ=÷¡ÙÕ…«?YÈhó†×¥ãž:û¡ySÎ]³f¡,ûñÍ—\Sž;ëþ9Ó¯¾²ñÛ:õÿæ¶ÅØYsá çüeþ°ø¢í?1jQcÄRpÚCÿLö.Yó}éÐkß8ûwÇ ô¯x{®.#Ôi¦žüعOνä‰Y‰»^Ú\ä–HÕúYOÇœòÜY|râiƒö¬[¬›œ…‚fÜÈ“ïzÆ57´­ü¼“Á jŽükÏxlîÅO~Ô-Z±x7Q$Bi Î[pÃ[g=øNVà‹Ò¢í¡ª7¼ö^ðà™Ìñ»[Ú—<×Øêá¦ÑéKE†l=O½3[AûÂK–ÌzËõÑ”?AYË’'~\2æ¾÷rS)ãÇ@§Y¯Xpý[ Ã+%mês'ŽObF8sö9)6–jÅ_{c¦f%‚¸¼aþyM+² ç\ó6×WeLœàP‰Ibs'Û0ƒ¿ŽU{RFô–)bû_=e hÝ« fÖ¤AÙ”À–šŸ”Ô^Óˆ§ÿÍ3u[¿©ILr¥»LãÙ„Hñ½ÇÄØ¥Îí‹x‘É)q„ }Ä8òÍÜß•Ù9yì£çæÍÝ2 CWs½AÞüC­?süÀž’„„!¿;e(ÙM¬®ô¾C-Š,ÇeYåź K|ºÕ=oá}ø‚!3ä±ÄºARÀtgþÙ ±23Ò3 3j®ãH¡h]]åN9¦@& ‰…i™¡ú¦Ž¬$FE ˆJ•båß¿‡Âëû§«&`ÏÈ067é,Q±r¡ð¿³|YË俼ß+š Ò•ðÕO?ë¤ÇÇMB8Q.‹CWpÉfÀõNЄˆ¦H ¥¦¦wù œ™&SÕÈÐQì`~Só›Pdy¯£è>ÖÈ"Q‰h:#ÊÏUJŒ#‘î á`¦.ueÐE:0’@²(¸éë,ùbÑsk8¨šØ+‡hÁ­Þ³ŸyÚCÏÄÇ™›:¹™è>E’^cŠÊ „tªuѸæ¥5E8鎹i©¶ŠW/XÛ•?"Û­a‰ÊÖ`FÀàž-¯^[B@¨”ž¥JœÂ›¢Q¥ˆ¤’ö«_{Âzí .VöÓÇ«…Ïƨ?[‹èè)B¨¾cÃœy=f<î U·ÔsΕ˜¤4…Fý¨”lµÅƆ¾ÿà?‡”TH<ëuPÀ¼¡@\r<á»9$‰*6{Œ³²Ö+ Jàþ=;%ˈ˜”¼£¹½¹9`¡ª¢Ï6ô=ÐZæõ -ÜÔí<-ÞÂ~V«É–”®æíiÅàdb˜à榊PÖiNvà¢Pt} $ ¶÷ì=õ–;U‰Sè!SVYíÎ6ß+/LŒ¥Ô¿±¢…ÄQЄþVm¾ÇéÄðíÜ´lç )ý~7¼M%©ïMOrP£¾º©“fPB@(õWWCN&¡¦&»+6,¦4®“¡÷oNã „›AP %ü¯9BãR Ö>>;&߳ꙙŸþãïæ°‡O: ’à!`-«šÚÝ¥ßöù—ñäåŸ>|cE'‰z‘ç¼{&7Ù«OágFSÏÉ‹ß±qñ7ž¦[¾šmæ_ÙÓj‰AÚª=µ™C'v~ùÀæâÊöâù‹¿Ü“qâe׈Q£];>|¢ªlóÖwï¬lè¤)Ó‡ 1‹?{«µ©j÷÷Ï5ÚOÊI´±m9‘{L1"áÇÇ._»ä»ŠU,~ê*_ßKú¤:ÿ™æ‡šqFŠoɆå+<Í»¶pÓG/|dÚ“ãåß|ÙZ·mÅ»‹Ó©¯v£ßvâˆáÊöþQ»«hË»w×yLY¢ÝŽþÛSú5­]ÜÔ´§ø˨̌ÆÝ^ DñW¼¶­¨¢}û‡?­ç™}Üdöq£&$”¼ÿt}}Mó¦÷>ô–†V¿0(Áÿé‘G9ŒâÄQÞOçÄ–<äÔ¡g]3ìôK{È£úÑ^{"!Nli'±Ã†wÍÐÓ¯zúUCO¿zø9'ÊÜdQP;ƒq NAîÐþiÒº§EÉuȘó¯tØ$n ŸžÓ3|÷8çœËÉCÏLO2šwnlkñ&Ž¸nôŒéªD@`:i|ÿŒŒXp0’Ú#Aëð8óÆÄ9e"ÇfäzJ¾©Ü¶ÙHš|âeç[¹’œ7À¬Z²»¤"íä›ó‡å6ï,±¤ç÷wŽ¥£h϶ŸHÖ¹£N›a•Pg0®ÏH‡MÓC!’Ü7?>}Õ·©bãZ%S&éõ›RzŒ…¤Lºž–~X±£5kÚý¦n„¼fbï”áçÄêÛ+6,mi“œ{Gô8‘‹.86p¨èé‚ýèX´èð®Üa0,*Gµ;*«Íæ%bDÞÛ 5šk¢ çcm ªº?Î9@$B88ëfYÃ…¬¤ð¤"Ž®iF‘?²}µ'¿¢kø~Ó’ºä#áJœulŠì×íh/Š„çBEC •†®â?ž‘ƒs„Ï°¨´ßþûíÓõÁH÷64|™„ЮýA÷^B¤ÁÂÀ ¢?Æ‚TÆõDrÌQÑY<’㑰â¶Gìu×vÎüܾ-¼[qŠ½õŽ~aÿ®ÓENqà~û•ºˆ/<Ùv¿Ÿÿ›vûyÿÝö;ÈA÷áÝGÅøAnöÞýþ©@ ø_#j¢ @¨”@ ÿ=‡=âÇÃÿ¢1C—GZ΢9½8R46zŸ‚@ øìÆq¡RèéBœ% #öÉv(…iLýŒ¾·M‘—U|õÁ!Y?§GÏLù0_,B†•OŠI +¢yP<œwfJ0D¢Œ@ 8D»!Ãg ñèhÌáÍD÷8ík,ß•Ï霾xjúÍ”h~ÝLl½X…e{ÄWO i˜5#SŽ_ €M”¨ŒøY%P(€ͯ›J`“£ó)‚ßÂúÅÈGÑ$W‘ã'‚£—#¶r@¹ì.sxš)±„bûùbcÁ¢¤žL¸îé±·”ªºÎÕ”ÎÄÞ&%Q\ 'æ•È>ï*œøx"á/©ÛÇ÷KÌ®Y¸‡åu`þbƒÃ-¡ÝŠÿ|‹@ *öÙÔšòWéÏž4JSk;ªO|µ.Å%ËPÚê?¤ù{¶§¤;ê—ÉÉ7m9Ñ[‡PÄ­»#«Ý /9ÌÕ̦ü››R]¿n÷)ì- N$3~íýñ±×Wôï‘%mcŸ•óZÆ<Þn;Líg¶êϲ:²Ëÿ¥Wˆ;{ýø]ýð)¼…ú‹z—U»ÀD A ˆŽÔ•u¦ìúNú|éèßUNüÇÎĪ”²ÕQcá àÿ>½ÙR1ñ/{†Þ\:ê:µâóåÃ<–¦uÔ6¶zÈuU—·Ävä-<7«…$ÿtÿ²EhûlÄ·_A&û*niZÛáÙwCXs\íZ«qP'è?þ9×ÏÓy8ÿùž²¯"®µ¹Û#àŸâÁ:b¶Éæ¾?Q£ÙÕ¸“²ƒž]à¸õ¥ˆ³æä·kÂa–PcŒßÔ’Ò¢Æ&pÛô¢‹¦Ã˜iñV#&S?:âD‹Б1îìxóÔìÍ+«O™fØÖ9;Û@ã¼i#üvŒVWã] 9;=¤}µâMÞßÑcÌ/ßNS÷ƒâ,4Ýëì]‹+èHÎâÜíªÙfXcìîÎŽÞ5 ¥µ(®µ†§7m´ÏaŒfWÝ&‹â–ŒŽô!º, þò¸†R™[ý©£½.Q¥em|k3‹éÝž9Ð$¼Žº 1¾NÈñi£1j¸“!{¶%×Õ@Ivgž`v÷ƒ5q [Uƒh®‚ö” ˆr±ÁñëK0Ö‘õÕÙ#?¹1.ãñƒEM×5ÚÒ¹½ø™aŸ_:`ëŽòñ7êÇF×››‘)À¤³íîüUsX¤Ž¯~÷¸ÃljQ‘³ìö¾¥ë$Ó$̤PMÕþ«WÏ©ž¸é™+žti® RŸ»äÏÉÍA !ë‡;ûm[¤ê!N U½>äÛ'œšL:— üú¶D 3¾¿"wW !pì~­ÿ¦E„sâßÞïû‡’Ü^Ù³vÀ7w&£*m~7¯l1²VÜÙ¯¸*âW]7èÇÅU•ÖùxÖ¦ Ä·5§d‰lêq¥/¬ZDhW‰ûPuï%·e6µ3Þ’µòö¼=mˆp§‚ãÕ—ŠàlõWoëòÞkïËN˜W‘›F!<äÎI û’ cK^ËÛøÅO']fFÿÜ IDAT*ˆÔôË!/¸fÝ3·w3o8u÷ˆevº»:lUWuUõòäÝ 0ˆL6ºJ FÛË^O©k šìDi4ªY„@r ØÇÜØ<ìv0n;¤)qÅ¡ó&Í`&Ì SͧÙ%K,'~»"7q€™ã‚F ˜ãT±ÍêÕ@ѵ,.yÿ{€À­ÔsÌêG«¤ó:~™RŠµ¥mº]*ø{I† ú8"†Ã sþÀõåf<å•-Ήøƒ)±#û惃†œÐ"rpÒ57„3Ž._¾oJ¢*rl'¡k)Ò Á¢ D çìíRI»æaÿ@ Š9Ùo¥„¶»Û¬¹¬sAî¾}å³?h²ÉbûJëÊu@µ>û†.Q „<à)÷mÏßòïÖ)ŸM°€W|{W/º+8ÞÝ "kr”ß–ÊØ/Øw¦Ù­;ýéÐqòá§ú]ŠÑÉýbVݵÿ«¸=óo­nͽP‰”;p9sQ Ûž¿îoq˲7>m²_Ð`=rŒs"p*p*ö Ë€©-ª¶ÐZ­umŽ¸ã<Ø}š0tŒ36~bëô¦µ=~ÇîœÝf%ÿáìNŠs FžÕšyFKÆ„‡=hI€Ö,Ш€QTKÝb³BÀyÐ1ÐØP*j*x[ÊŠŠ׳Þ~äæ™Õoµ€@®û(Ú' ÔÛ`ö´‚s¡³Rf©V‘p€#èəܑrZKÆm±)Š½ (êyãuèøåêRÔS|÷.û²¸ºCV8ŽMzµ15ý?„æœD¼œ1Gg¾Wò¥¥¥TM¸|Wîd ÿñTæ¤×¥T· iè-J8 dÿë¢mwÖÀ_!Û/>œFX½ ø8@ƒŽt­õŸEš+‡Þè‘¡%ëÁ²¦¹9+oRLNêo NºŽ1/U<Ý^àTõ˜ xièqT¼Áºö¡~Íù ܦNwèÇëãΫw¬Ìùú·Å †´Ê ò¶qhèÅ e÷÷_qÄOÛ-jVIF-ó ZØÕh^A ˨ê4kúŠ;l±" ¬N^¶ë£Îñ… 1%oÙKSËÎþ÷v5¢â'œbgÕ[-úú!ŸÉ`l-W²î850‚#µuè8Eñ£g›=¾¬ ñ¿¾<=js²2Ž9¹xt8òÞä.ŠãDWDp4ûçàÎMXZy¼ÅŽú›¨àP%¹O·9a4Ð.ª*ˆ¨LÀƒ¢ß«œð è卵*¦è°õ,4,(]TÓ@DMvh¢0êo£‚S•4ÐB»&ÑßÉ Q,äRH8Q:¥` L²©²Q:¤ Ô¨lTi49h¶AõHAÕd‡&ŠDõˆš¨Œ ´IšA1š¡¹%¿—Q5Fq­CR ˜ÌBÀË(?¨¬)¨(+æ“nÂ9LªÁÆIÄïk†˜ðy”hQDKÏ;¢Ué^¼R”ªA°*kWãÎPµªQ”í]oc×][‚I1›¾Ñ}:tœDÐÏ‹uèСC‡.¥tèСC‡ŽŽÝâ§ñHÍ?­…˜ Eò 3p@ezp:t|_¨'»øq¥”HpyÆ%Fâ%ˆh#îC$+œ*GœW`\¢þÓÓ¡CÇ÷â~éVØOšÛ_\?¡Î-2CP̬<‘í'Á9â-pà×ô_Ÿ:¾ ‚€8ÓIAÌ«Kq`g-ŽuDäv"?#SðéHB¯6á׃°¥:2gA‡?÷K´áôÌ“…œý\J hä©#œC  ’9’¥”J@ŒÌYСCÇÏÂýÄ“é˜C÷ñÓ¡C‡'/~*)Å9ç D¢ A=‰°«Á‚ Jô|o:tèÐq I)Nˆ(©u«žûlîÅ ½iÓš½\Ž4ûS8бµß\ZQÙÖ3Î9çÔÙÜçâ¤Þ:p€äŸJÎ9ÈFü' 8ÑÒ½–s"@2tít~Š=!dShGÅOŽ%ÑJ{ÑóÓ‹]J}aõ_<¼ìóŠ¼ ;m横ׯ[Ó@„K’DEÔ-¸mÿÑš€?ÙÓNˆ`$ÿ0ð¥«Æ½~Ä×o8íõÆÿ㪳KÜD =™Á:ÖÁ5_0 ~;‹Ó”@àÍ›ÿ6ÿåO‰ðólˆ@|ëæ¾òû¿øä;) ZÇ¡Ew_]ï Rð–­/¾ÿ—rúŸ)ׂ^íó‹%„JÅúÇg¾vëù‡«UBÈÏ?¡„ˆÂ‘%7NÜ_è;BÚö¼9ÿ/ï1BS•@ð¿ s®}Lsº”ú_Á‚AKñè[Ÿë×/?qÜU§ ±¶—ìR#Jû…oÏßW=pD c§ÂO‚JÖŒ)<ïÑO.˜»ð‚¹Ÿ\øø[™f@€(B4BA†d„d¥á /  @»vÁD‚(€ÊŒEÚõ鱑†*!!å‚B”@Ä®‡‘Üôûß+5Xp†ž"œƒ¸öùê[0’è¿š~ÑT0„ ÈHFˆRx«. áæ±Sæ€(ƒŠ=´q"†+ém…¦RW¯IO¯ÃODY”ÃwPm½Ë’.’DQä>i©(ˆR¸f¡± *JeP jDé?o¬¬cݣJ —å¼7B¯;G8 Öî¬h,œõçO 3EQ„h8ñ„½æ«{BEˆBWs"Â2ô¨Aô¸ %}'”€HP·?øá[ ¶Þ¢‘RÙ@EYì&°ç]8ýòs(À[Ö/zåcÁî]×!Ax<%9´úöš‚sPêßúæ\W€PÂu•ì”ÄO”m–cÊØ+ÀÔ8¼lËâÕ£EDÌU·œƒxŽmZ¼kØ óø7N‘Ù'‚1ÊâŒ%¬{k«û÷ŸDMwl{:8òáÑC„M¯{ãŠ3.¼LèØ´îí¿Ö5wJ cÇ\öû„Xßönim‘ܹ±ðì³ê«S/<“ ¬yó?6}¾È¥ZGÝ8þ¼‰FÞ±í©›}ãî"ž¨l &O¸}ÔÔ b(s=!škÇêO¾ÎLc;W¬ÐìýG\ÿHF´™HhüúùM_}åa±ÙgÍ9> €·íû¡*HÔ°‘WÜ›šh&\mÜôêúÅ_0û€yà Xí—Omþz$åŸûèÐ)P ´¬[õús¦¬3~ }F[RŽ.¼cëúCrÖY§_SŒÜ±ýÙß¹N{áô¡v^òêµêعòªÛ¶j¦»Îë¸óãa©²ÆAkÜøÚ^Ï œÎ¶lvybz5ûŒèÝóÜýï7Ö¹å®8Z[Á ‹ÊË‹CûþÖ-øÐ'f™8òà–öÉwÜÔúù%öÉ%óv茟üðÈþõk^{É#ä½ò‰ì4#´æ½o<|ðÐ1!fä¨+îNŽ7ùjWl^_Ÿk?¼yÕ;zÌG7~µâÓÍø×KœqÙu&¡{q÷¡¿1ßMú_ú‡ÂÜdϱe·ËS.±åï¸ÛݽfìÝ/'›À9'auËW¼÷j}³Û<~øå÷¥Å÷áÚ»û0· vùÃ99Ò¾'Î.­R*¼`èý ‹cÀt9¥ëRÿ%; m‘Ië–‡GÎüIô‡ pp!ŠƒPÒ¸ã=µðÂü8ƒv í×¾i}bŠ«îËy|ìcCGe•¾vg“õ‚.˜xfòö÷k÷@íصáݳ.þÛÌ_ŸstÕ›-.NÁ‚®êE1Ì~÷ÒÛ.¬úôÿÖ®óM{lñ„5;}  ê¡¿_\ÁNŸ~ÿ#ûyV¿ù‚W᜚VýíXÔõ—Ìû¼Ø¼ã«·ÖX‡œ7 7Qô§é—_f’=^ŸË‹~3û÷‡¹×.xOÑœE—ÜiŽ?ëœG_O¡ ®7\{Þ^öá¦ü«Þ¼àŽûÈæÏßYÔ\ «>ξöÃKﻧ}ùóUÇ:»mKJÇŽh§Ÿ÷ÌÒÑÅʪ7¾`´­þÓçŸî+ºî½sþïÒ†ÎÙ°µC0²²WÎßß>ðÌûæcÜðúc^lÜ°aÁªâ+_ù«sªlaD@Ó’»–.­|ÓüÙWϬzûÒû<‚زcÞí¬ð¶sxÎÙô^uCŸõM¨èßþJ™á™÷ÎKêøôó—¿ÐdÑßZëõ3 <ØQëu!ûú2±£÷î d¹g¥©¾ºÏÿÔœóàåó>NmÿxÕ‡»©ÿ¸hûѬI÷.œ~ÑèƒoÝ^ÑÝYÁ”=ê²eë3~/;.P÷å¼àˆGGœV\þƵâÌé~wÖõ—×®~¥©¾ƒSpÅ]ýÙódÚsî¼²~ñÍ+¿¬Ÿôè¢IÃ[w.|-HyéËö Ÿvßü±Ãɺ7žrù9X°yí?Ê-—_<¥_½¹ÊTø^At»Ÿ.¥þ{xÔÐ{–]øð¼¨w,ÿ×:-2Ž¥¡àmË÷ll:ýLÉ$ˆ VIDäÛ´æ}ó7ÏfÓGOoúèÉ óç{¨DXÅüzÄ„|µä]ÿJÿ,oÉWo•õÃçøy°v±?sF~Aº9el¿ÑS„ÐíZ@̾¾ Rê¨XAŒr¾Ã9x÷·j‹÷–Ç ›sYLœ=s꽉ÊöºŽ …†øY#GgiŠV”Ã÷ûCË¥`ª¥ßM/¦šÊ,{¯¦‘ùšTƉ ¥] «u×Ù§ý¾87NŽ|Ú%§yv¼Ó8S£ú_—ä³ÈHÕ<žŽ>» û°¡c†ð ârú‹‡|ŠïÈÎ])¿úëà~QÎþ3¦^\\·n‘Ò¶jçã_ßoKx¶íHm‹Ç_ó¥VtvNV¢)y䀡£@‚­¶μöÅ~öèÁL:;£vë×Jã² OFþÄ FsBöôßÇ™”¾¿•Å]0aÖklþˆó&jG>nñžè`–J„BEB8ßß΃$õWÇÅ)Ü–; Em<¬uîصG)¸ìÖ8‡Ù^ü«ÁƒYÕ±²®ËB¨B©@‚,úò‘gKö5/.ÔŽ|õæ‘r/U}~¦Ô~æJšœß/Ç”0¼ß„ÙbhBY@̺¦8K“†Æ BÔ°9fÀ9d2 6«M_ì:dzÅ5qñ¶´É÷¥Ëj[< ±SFŽ)`A¤æ£)4¡D¢¤·ÅDtäOøu|B\Ò°KSmŽ5»NC‹”† {£TdîzWL?ûÙs~s‹Õµfû.6ðšÛ““¬I~_œÚX[SO‘JûŽ˜Ýâ÷_œKšK÷ˆiC&§hu˜>â_‹Wû”ñV1Ä”„ÆÏž­(s5>8•€35À·Ìªºä³YâU5¢gŸ˜¢ó r88ç$FâŒ3fHL ˆØ±ýÉë*l玞9Õ€º¦ea®Éœ2Ú¢£(UBLTtX¸5œSBë<æ Ö¯~xêZp€ùÛ¼rG ™B´ZÀ8§”¢G§æ(­ßøÌÿu\7dÜT´í¨:RÚ}ÖÒ[â}íö,“¦‚QÉDÛíppˆvg×8¥¤o)Áhéôœ`\ (ÔWÿî9¯¾€pÕ%¥ùÛT/wmztêp€:ܹ“ýÉž:É4Œsp“ÝL¸âUDµæµ3_}áŠËÔ¿QílQÄ(ƒ ÎA¨É`ŽSÉå„A¨=^ ;ýv"µ–wïëH¯g’Ó à”œy|Ôîp€1pÉéôz¼}ªâ8cr|¹í£¿-]ñ·~õ3Åö¿ÜùøÔÝ„º\éÜ]Þ>}GL‡.¥~0;䞊/çÖd?zÖÔDS›ö”lçKbdŒ"öâù—Ÿ«V:ÿuðýýŨjèâÖ¤-)Ã3‡"=7Ê+!ãP¿ü@µ4úÉS­P;[ƒ ƒ]Sý¡wngÒw™9'æ8“!eÔÝo'™ƒ8ƒ`²Ž~˨ ^õQ™'mê…—&Èðò½ª ÂÐ÷ÚIB$ƒÅë hžVNm²D~ÐA'$™Ò/i\‘SÕhm&ÿbzÇG¶ጠ§{‹]Sü!nç ¢AP YW¿6:Û.+EÉ­¯Ì­¨€ ®ùƒ}3'Íã ]Ìý¬²DAÆA¢iÞÆ…ïå}ønÏjãDvÈðy¼ vÐ|cœá[{J)!@ÓšýÇø°Ç›a‡æuƒ!¿S}œA‡ÿ‡SṈF1nøÿL³vÉ©Ö}«âxºSƒAÀÀ™¦‰Õ rõïsB×n>þöwƼÕ+Yùúí±¿»XfÖâÛæ9ƒ œQƒƒ†Žãº êl]·øýwÒ0zÀyw9ö>¹èÙ›–>sõ棆ž}‘!2–S(´ÈavĘÑ&{Œ@‚Éi…SÀ¾À¹Æx×_ctJª§³Î«y*ö}òW (ŠONšÈË×74y˜«äðÎõÿÁ_š+ˆžSwtç~Áäàûw.^ÐØ·,D¦uTùü æ8Á×ænUÕ¶½–|T:ŒSBáiðzÝáÒDˆËÞòõüºvþêÝŸ­6ï4þÀsNÑ’ž“Yµâ³Nf5”š¯žÞ¿»–ÄN*Hn)ß¼˜Ä[¶gñû¯fL>]=´ª¾©Ci=xxÿnpC\vnÜÑeŸyˆ]–¼•_>]z¸&NŽçeGwT•ŽÚÍï´xú]¼ï`¸§tÕ’4%Úf´[Yç‘0Ãwh~i¡ QÜ~w‹¢òoe¸œsçˆÂtÿ‘%‹¼u+íò¥¦g}çDƒ²æí¨q©¾ª} ßóhA%è–’& Õ›êë:¹·¢dûŠàw§$æ*b&ç%4VlÝIL¸ï^ü¡÷[Êp­£ÊÐúüJ‚®ÊË}*<Õ;RÓã ÝPî©óú|#¡Ž÷®5/?TRÖ¦p³#=ORƒÜ>¦0ÝU¶n=3:h°zÿ¢7Ú]þV¯§]Õˆ.¢t]êá†0¤œ>ᎱŒ1„JTÀ#B!=;B@ÑU‚J§€}kÁoî9SgàÐl“']²rÙ¼Ó÷9½î‰aÂ-_>óèO>6rÂê5žJ£†:Rl¡á"áz8Sƒ]q¬š¦*‹|Ë‹[Þxhþç-Ä”Ñïâ‡ÌõrMSµ9‰3UÓ4ÆtúLá™G>{­ò¬«o˜0uÝ׎ٔ0aôU.¼ñ_Ï»ðþ9I–¿ýûþKs¦ŸÅHôðkOk~rÕÜ3üÜ7âÖ™s&PµƒkJ7×ãšÒÇNȹ¦©áÿgS5Æ‘4ýáqÁG–=0ÎÏÌ1ƒ5aVº¦bÀoÞ ¾q߇·ßCJÁ¹÷[Í‚hœ6|ÌÆÕžEì† )æA¦!í‚gF-|pɽcÌ?òÚÓŠI{Óï¾úÇõï/°gNº:>qEïÃ|¦øÍCgJ[î}÷/‡ÅÔigÞz™àCþ¯î>:ïž×¯6%N¸³°ØêUŽ˜´a)«ž»¨ùžU“ Í¡k~8S5…-yLÕ4MS¥â[Þò¿~ï‚Ûg¦Œ~ç?•“<ï꿦©á÷#€f?ñÒÓ¿xaòA{¿!×>=R¾må¼¹ç=ýÔ¨©«W?;cƒmàÑã u*hªÆÂ"Ÿ©JhD9gLU4Í1ð7¯m{ãþoo„!­è‚¬F!ÀëŽð⚦jœ!qÜ4ÃÓOüë¥Ò™×Ýa•ÃBN“ŒQ–ú%÷žá…£ßeOÅh'gšÆXÒÅã­OØ6öÁsà‰6xäº5;w­G‘£úºòÉ“)ê–wƒoÝóñïfbBîYw;FÊRRs‚+æ^PüКÑéÐô{ÔN9ü¸7w¨ ËÊPÕ‘Ùfsc0<ïîŽðl³ súcS5*{ÏB(7‰P j°‡µ…"xD … I8T? Aèt5VTDå ´Pùé+NžsÛ ÝEˆlóCÕ8ˆ$Cñs€ˆÆPt´ 4ƒI‚çœHD–ôrD6‚N$"Iáv‰ "èC¨¦€Pý T‚$‡·øJ€sÑ ¢@QÂB…ªvÇôÉÕÆ9ˆl@ÐË9ˆ C”º* †MF¡0¦n‚9ˆ …¢² ªÅo/+PÀS@„PsaˆHD Šƒâ猔HFLF@4h*§2e0‡r©‰vMŠL$A焈½éT{ÏcO‰L$.KD"-.@’p{šŽ”ÚsÛL¨YòðW†\zÇy"‡.B$ xhB)‘ á =n|@Cs Î9‰,‡'T2‚h8ÂáaD6ƒ©$ÐÐ4N"ŠPü$¼NT×X8NŽŠD”C5ô~÷ì «× ‚ A‚æå*Ó-~ÿ¸_‚ãÒgþ%éR:NBýùqÜy!`A»ÔD®"Ø}lD ƃM[ÿ±éãNAä M{ÅiTÆÁºŠ(Þ®êBG9ºN²ºLA J ëµP„€!èíÚ9)vûÇÂW%÷®ääBÍ×ó­èuÒ¢ÍßC[Ð×5½Ûê>·ô¾Ÿùøׂʷ—eP|]”>p ŠÁ`¯÷9TÔ¾SÓ]mØðEÀÕ^“¢ôЇÎ>óØÓG®ô”…Ö=ÈC@çjË®·6~Ü*HDAüèË& Ahè™Pµ{ByÏ„7>]s B´p»`áŶ—B­× …‡…ô^'ab ×zg¯™íÓzH\¡{Oè?ú‹S1ºxÎ_‹û<‹p’_øž™Ú .šWÐûô Õ¡K)«áD Lgi­RCŸP¿p)¥2µˆ<—Ò8G0Â/bW8 2(ú©²:¾÷S´“èr¢×{‚q´û#ÕëÆ Â$¡ÍÙ[KD™à F¼¸Õ¡CÇOI€H`5üt)…áà ”uF£çÀLNÁã»`ˆd?…áîAXR…ÃíúOO‡ß‹ûeX15¿)¥q|R啈D1uIFÆá…í€É+NÃõEXPŽe•ú¯O‡ß‹ûHĘ„“…œý\J H)E HˆxÉ Ž„fèÇâ:tèø^Ü鷺¡–ê3¢C‡:NZüTžè¡¨±K,j@(£JD8ÿ…ˆ—úæ­V8ôB:tè8E¤!PŽ¥­y4¹¦LäwúU‡ÇÎñGŠW! ž¬÷‡¤SU€+4æÆ 3.‹äÛ¥B±›„Z¥€‡ ²bŠÓDÚ'ÜIµQSÅDO½ Æ Ò¯D}¢ÊK²v¼EC•\u0¦(“\ Ü”¤ŠßifÐü²Ï­XbõûŒtè8U¤| ›La³w?SÑ*³–]“»»xß°A‘s¥¼W” œöJS´ ¨)²/@äBûç…>‚)3(SCûaYQ2ñv·øù.ﺉùŸz…Š|¿‚„Àµ&½!³²01êÀKQ1¿+ÉÇpðl.^òOylàMÖ¾[$êJÜògÞÿ¹ê”æ¼OÏLZ[–fþŽÅI][}ñá‹_ôèRJ‡ŽSDJqcÓ¨¿ƒ¼ IDAT7S³&PÈÅ1¶lë»èç–R“sŒj”¿±»@@@ô–gðÄÁ!#xUÞâß'Wþº$7¬—à C8aªh¡œ:P»X ÀNÂn&¼ë5Bz*Ñz W¨JÓ†ÐÍ~èßÖ‡\³$¹î’Ê~éM#k ÑCj¨ Gø}t}¥….=ä „zkÍtìöÓ£(½:ÈC‹ªšò"8À “,,Ô‘ã!$,àTÒ$£~{¹§”"„IV@15n±6­ÉhÊ>væÄHRG¸Wb\ôµ) í>{Š&NxÆ c‚Ò.0Îd<£ô‚…ÐêZŸ»æy§×O`lÏ»±làdÍÿõðE8ûï£ ýûè ­/À¹ñ·YÚÎæÏXÁCeIþÜuóœn7¤ôêQÔ¦$ m_ç­ÁîS@cê‡ÞW•‘NøGˆ±æÝþ{¶±«qÆþI×òÖ¯ò×ýÝæWA­-E·VZ?²vïÎY)5|`Ìîä3†ì^#jûú¯8Ãߺ2*ýå­#c3œ›|[[ç¿¢Úª‰yòÉ÷x ÜzøÉ¢«ˆßš:$öhùÞ‹^ðP„(¹ëþ*úäÁ +*‡ÝlÛÿ—èö6/=0þò€\_ôÆ4>aáÜÐŒ Ê\÷§øÖ6Âåμߖž¨XKŸ*Ú±’ˆñíÉ.èìC‡ŽSHJ…´V-i­€1]!Z¯-ôÉÏÖ]†Îcñ% ÝfÁÜ°]ŒþÕžñg±ÈM´J´Ž¼#iås›»£r;“'4f Õ€¦¬å÷˜2žß6d8|ûó—Ý›0 &JT%sè~qN ªl ìriIÌڭî¬OÏ3ä¾¼­_‘\ÿvþùMñ—d.€¾´­ß@±uYñšçÚžw™ aã `š+ÝÓ^*Žá¨Î_þ0Š_ÛZÜOèÜT´ü¹˜”7Ú¨¤I¦ðÀ FE–•˜Q•™Š½×í›2$õß5‘‚SÅàkªg¼Q&ud~r^Bõååé5¹ÛVÖLú 6NŽÝóp’bàÝ·¿JYecoŽ^W¶û¼Xýj)ãÖ-3†mYÍÊ-¾¿¿ É6NóÉHgÒÚ{¤¶_0KSç,¹95ªðhjUîÖ5“>¨7;=_¦êìC‡ŽSOJYš†Þß$PËÎ9E›ÞÞuæ5óC§Ã·_µ‘ijmðçLpͬ³F®?#jÔìÝçM²Ô­N([š¾a~ΆÏµ;bܶêüáŒæ~­)Ö¸öºš¨ÕÁ-þ¬v§®5qî¨ÊœŒÂŸtõž$ ÷û1þ¤ÒüAL@0z|‡íõ(—Çe2v—dΑÍ1qœ¸ÖÆøŽd÷ãªm`G¬ÝÑÞb?¡ìç¬ç0ŠpÅŸ23 pxìf‡ê'í+†~±1О>ÃWúETç'jL‘zìùaó”…ªÜåî_ÌÞ@y\›Òpæ,U¤‚º‚̬æCIJÕ$çwÆĀ•8Á'ÿ[g:tœBRŠ¹bÍGÚ•Ív¾˜T¡ªNРFŠ6¥5=ÌïHä7D+¢f2Š=šèvy¬ž´Y噳ʵæŒÅ—æ®[Ü2" j׺`‚j߶—àL6€æ i!‘M(@óˆZSö’Ë2öÅ覾­sÑÀCÂCu 0jáe@¨¦}_•ƒ b QsQbd5rJÑ[LuŠÝöHVk¿=g=ì±Ñ¤™øÍIä Õ„•—ÅPp.Ø;ó,DuQbUΩحxéСã”RT¤íërK›ÕÓ¯ññ#™[6úSžŠ‘ã>¡*Xú\ë¨?Õ%DÛ¼édÃÊœ""÷ôœ(; V¼Ó2v^s †Ø§5©Ãc?o³¸3Hí-¾ +H gÅ(>ºD]è_cF€µZÜh²ZcòÎ5MÙ¹~ª'Poe ”hNå Ks¾_›oò€@rù<&AÈ!$¿Ÿt7D|—lи1“©[  êäÀ‰¼™ÏÖY×8ä ÕõP¬›1ú XŠ jð{§$Y'`^BÌܵ—)kE!(­RPO2¯CÇO"=~ª†Lcç•%Ô.:wäâ?JÉ÷uZÄxOpÀ0áЄ £·þnä‹s*…}ÓîòEtÖ˜†4[J ¾º)¹t£½~{üƇ–u4 =rÿòüØ„ ²u4ÙŽ<›ÞœØŸ !ͯ–:Û<–X¾T<.JÈ8¼,CYg˜!y²fT»®rèiùì¤Ï=1 “ñÂ@äàPƒê‡\Y5ôššÂ‰~Ù1žè · À²jéèe÷"ñe]Ü)µÄT®jØgDZå¸'kÌPÈ8Ç«îN>ô™Ó}lÌ}íNˆÝc‰?ð~bMuKî9šèlKÉ'þFÁß þ̳}Ie+dÓ¤#£¯ ð¥Ÿô¬O)ùÂá’ªGÝÞn·w»DÕ%kÖ¶„ì‡/óų!¹d©MI/s«Ç,s1ÆcW“ö}×ì­Ï;ƒÐ„Ö”œ€#Ilßâìpù¬ñjô°v‡ItÕò¨QíNÑSÅÃܶÔöô<ûÑÇ×5·äŸkn¬j,š¬v÷Zí4*æ¶Ô~®˜BÚôERÅvoÎõÇò lµ[¹-OS=ÄÓÝ.·7'täÌn3V'\ÓÐÐÑïžêœlpsGz?[å’¸š£y×yL’+i ¦›ýtœŠHµbf:’-'‡éçG½_Ê«âüeø²*"³ÍÎÉţÑ÷n„çDW±îÜ„¥Çe¦IÙÞ)hŸõ~ξñfHØhÅ €qþ=ö „‚3Ì×XæRbcÍßÃFÚ­„#‚Uw}»[ˆIŒ#?Ò¬qJþ‡-QÝU%ª=Ïiÿ¯=™¯±Ü'¥FGõà-:þ üD?ïá…–Y.ýР|1µéÍ-_nç‘bnä„PT~þ„'ùòÙΟ~Åe¾ê#‘~•Qùö«>|¯b犲 ¶¼sÇ—/=]ï@ þ³Û'áJGÉÚ¥þ FˆÖ~ð«#å­Â÷šMB(iÞùn}—þ¦Ý¥{ÿh )!ñ~íÀžVò_9Õr@=^½aîvá¿ÝÎ<öï‡W¬­õÐD:Nf]ŠsSÁ¯ß- ”B ™ ‰–:¿'RnºåT-)?ä/øÝd³‰ ú˜\Þ¥QD² ’¬ñÅ—Žœ5”0.Î}/]ºú%óYwßb&áE×=·=úp¨Ó`à–Êm›“GLã\L:ýæ$@Óº’Év• e'"¤÷P‘Õ¯_d˜~~"`Íš6&«kû¾FŽ§÷èx½2v?à]öãî'à 2ZÖ-hÈ:«Ÿ¦öÐÎy˜²Pš¿µNBWË&¡KÈ‘ç¡ÆéqU…iîM*ÄnNz¥"ì.ÔÝ»ãÆx¢¢ÞK¸*&Ï8íÊ«µ¥¯ßëá•w/\´K»`Îåh\ðÖ­ÏæßðÏ‘ã²Ü%o¹Ô5û··¸¶¿¼ùËUª(kš)sú]C†æÔ¯~ría$yöÑþç ^÷Õ+׈“n{<Î!@–*?¿þ,Ûo¶ŒígÔ«».û¦’Ä ŸÿýÃŒâÌæÊòÎVoÚ…óÆ íRªÐ¹ã™Åó÷½ë¹ö7.)͸:ÿ¥¥á˜—÷ÓÜ„(Ú¶ãµMK–)‚AÓ iSî6X[:wîàÛßMŽ¥G>¹vù–¡×<{›™7®ºóleÎ9¥÷oòÈ4TípÅ ÿÍ_r%®[uè¿ÿÌßRÙÙÒ¬(5¨DÐ0ñ@«Ï¯ÚŠ.Ÿzç[S/žQöÉ_š‚§ÐÖ•ph–!)v¿§¥voúpaڹϟu÷[“f8ðñ{í5—5gœyÏ»gßóÚðÑEŠß;çᨘ“ï|!˪É"Ë•LJ]kÜ™Îzð½3† {?[®ˆly½pþß»èÏÉ»_,+ñ¥_þdf”cðU/öK20jf­sýÖe»\õòì»ßœ<µp÷»kã¢l¶ú+š2.|jöCJ9²Åf­÷R%2<ŠuÐUÓï~}ÚÙcË—.õ üز¿T§Ï¸÷ýsx9ÇóΆ϶Äκ»8‰SžŸ}åìÀ¾å>;V‹g©-{à©Ú[4\nß¼pIöÅ/ξû­©L>²ð¯M*•Œ–@YSÎU¯Ÿ>Y'”7­v妸)w=™àHH—âT2;!¤vQÉd¥”j`í^Ǩ[¦ßûæ”)‡á%€ƒÞŠ/_Z?áž—óRM’Ŭñ÷¿rÞìßË£ë*öW’à®Íó?N;ï…³î~{Ú%gWþ{^#ÏÏÈÛÛZÀü7‰g{j\@ëÞ î7È)¬þò欋žžýðG#üz»¦»ëêÐ¥ÔÿhòãœqnLtó˜ÿ{qÚ˜¦í ÞðENR .9Vg\v®$YC¦êêfžj|ƒ‚¤Õ~ÑnÈMÌL‚Æm™ƒM òsÃʽQ]ëI:+)ÆÌ98ëÙ¾s&§ Kˆ2j ,qÑÄפ2Ø3ÓÚ×<8ÿÖ3ß¾ãÊ£>÷8g8ï*H%­æË@L¿Ø'!bTþ`³º§¶„«¦¼3b-Pl‰æk=n±Qé ±Ll¡j«ô6ÕV¥žvšIÐΚ8Ä]¶Æ§pM3Ow¸×4wðc»S§œ‡Ž «-{«bÒ±Ú/;Ly ±„Pkú›T^Ó¬RhbÆ„¤8!„úkW®û¢bâogæŒ}÷¥h\ŒËKˆs0ƨhV9¹oÿÆ·ÞîwÙ=©1McÐTKá$› f[œYS¬ö«V);1;jIéç0WW7³˜œÜ†º&¬èdùÅ9Þ²¯÷Øa5uF¢3M1LŒ1CeÄžhgÞV]‘Ò¡[üþG%Êuä«7ø›‹Sd 0%$h;[4-2²Ýr!jƒ¼pˆÃÀ5E f=eøçœPB|êÝÆü¨X¨^ËÁ/ß,Ɖ ÇfË–‘ÓüËþUÿ>°àŽMþØa×þ1U8Œ#ݧ/¡óÖºáÙ[‹î?ë“-æÎ÷_¤ño S¼ q¤K'¡DST€ˆÂw 0¡¤·´à`\Ð=¸t¹À9ˆhM)HcÀ5n?·ñÀ–ZWæðüôòíÞŽ5-Îþ&Ty85„6„ˆ”² ÂÁ¹`”ÃGG‚ܾý#‹ÁV{¬5yP"Sú˜yÉqÿ v©¢Á½ñu1ÁIVæÄu=ì³Ç᪇“D ”+ ‹Jî×¹¹6˜U4 ÉâÙ»iCmFCü¨‚¦ ‚Ð{´uèÐ¥ÔÿfR ¢kÿº—1^w““Ú:“mÄ<“ŒˆÈñGFó FDmûì-çÅg·¯­Å:qRa‘ϨB‰$i‡Þ~Æ團’A„Ž!6KåÈë_Š³0B ¨®#. ¾ä!æ÷”~zÿîé£ %T äÛóz+½ÖÂSlfŽµÇÚÄ~”„Ø0 [ÊÀ¹&Æ æí‡T¡v4‚±qNÂ9ïñHø Ìh’ì– sgOH ª˜ËÏl&Á€LJ•½eÕoÂø8«±Ù‚Úݹí§ÇØAㆈ®%~?6Â|~·5>ZâÕ½å‡?vÊ “ÓW.øÇÝÎÞÉu5ä×N(¡à*!no緃곌yxÖîEóþ´·pÁ° Â-\bËž}^ÀIxÐãs3¢eÏ›WVnÙiL»ÔVd4~øQ¹Á™54¦KƒÕ¥“Ýâ÷ÿQ•‚!÷âgÇ U6ÿåòÏ^|Œztòù£hÄ°yÎÒf>ShÛ¾ôñ+¶vœyÃõ~ ¨Rš»fÛÑ«Ë7~²ê©9ö8Æüö.;šYœÑ¼sÑü–º²ò¥s?~ú¥ÎÚ÷¿üë]%{6Wl¯)¯NH‹!Ô$zTÜÒéïÑhz çÄ’oW/]Þ\¾fÅÛ’µ¶šC 7©«áàê·F°€˜x^–yÏöËÚköîXô¾8òÿRÍŒqôøÖœh¤{·Î9•rGŸÞñé};wl?ºfõŸf­Zº›‹F£Yè<¼¼®1h)žåÚ÷•¹¸HäR|¢yï¢5ÖÁ3ˆ=»8½~×’[kí[òJ àò ×z·È95X­ƒ®™<<°ååç;Ôðy$£ ©éRÃö/<ÞÖcKžiP ljŽÐý¾àœQ£Õ˜zÚé“rv>_}@$}ßâLáѳäuìYüAkmÉÁ¥/zÒ/Ì°S8sã…Ý;6{ã ã¹mD²aGUƒ=Öfæ}ûèÖ>§2„¹sçþˆÂ‰£¬ œÁ;àÌÁ³¯2sNva6QOöÜÑf$Û°§%„p"X‡ÏzÖ•ý'œa–%!©'Ç€xTw¢#püyŠæwT«±ÊÝÞaÊœ:æê;RlÐcM¡M[*ìòË…£.¹"&}R‚ÃU³ocSm]̈ëÈ!’Íjó×:$猳 ~)®(>VfblBz !ટ™³óòÓ òƒÇÖÕT{sν5/?ª¾´Ê‘7">ÍÑ|x/Ogaܘš™0`tàèÚª’ÃRÖ¹ãgN œ1% 8s“œƒ½$ªBj|/ò5M5ÄfJ"åLÑ„˜ÄÜ\sÒÐÌLSÃî•u•Î1·Žš2aÏL÷Tí÷Ûs“’³.¦;Íf2ÊFIåQ™§i—Á51nà$^·©òà^ž0iÜÙ3eB8 sjbjáPKÆð»ìè74&Q…V›pÎ4=`”Z½®b÷C¿ëò²,–”b“Yâ²rEJ8 jrRRn øä„âøX‹%w”Ù[â!»lLœkä<à•9£1§Ð¦mÇìÖ¢O{î9pj²H wËR,Á`2 c“32(S‚bt^b’sð D÷O‰ÓýÐuüÿ‚UFº–“ãÒ¢÷æ•aYª:"2Ûln †'ãÝÝ#<ÛìœþØTÊÞ³ /¢½-ï‰pBWPWhQØî~¹ïκâ~xwL!¡Ï „P„6)Âé*º ¢W ¤+<(œ ¡œ@8D¨¶ðÜ„êïŠUêKÔ‹È®ø( 0ð®ÖÃE(8 ¯ýP }Z' $Ô:!„‡SrÐýœƒ §òn]†wõ¨/aèÊ.bB#ÖÝ;ðž 0BzÍEWB¤†ÇsÎÉwÿ3÷K°b\:âÌ'=z@ü/!ñÄ7‘^á¬Çû—{žtÙæzkÇ¡ÏÝò)\‚_ïòEÅáv‘ÑÍÚM zyÖ…ªå½úÁOØ£®Ò¬O뤇ª!}|ë]¢°»uÒ»/„ô¼ÆNð ?Ž°>}a8®Î®XàãÇœôyBºÇ¤÷ç§ô :tèСK):tèСã‡ãG·ø…L)ç„ÄyÏ_D{œsÁ³ C‡ŽŸ‹ûýR¤²£N–#¸ŠdÃS È^p²€œhÄšõ_Ÿ:¾¬2Ä“ÆÐöãJ)¸Ü:Op‘ìâFÀüˆÔYСCÇÏ \ ¢Œ'1?®'ºWÅŒ%XS‰:Î+ÀŸG¢à @Žäå¦aï¯ðÛõøú˜þÓÓ¡CÇ÷€D¼>#⺓HxÁ‡Q%€áRJ%; :tèø9¸ŸE<‰Bt?:tèÐqò⧊êååRÛ>[{½£/j€ÛéDEËËc«€†Ž¨‡Á“:ι!Ñ!3¯@Ð+÷zÝ’ûCfVÿe9% €öà Ð~Úën”ëYtè8õ¤…\ùö€ _ºr§ùÕýÙ[^®>ý5‰æˆIëÌ;íGiHJ)Õ©ºtœ?r§ˆZSzÓ@dìøšÁ—¹ äû ˆ€ %zç3 Æ9‹2¿G†{ˆ 1Öþ+»Öz`Ø”J< ÎÞòU͈›ü†äÚÒÕ:ÿᢑðʬ寵x¸ÝªglÑ¡ã§ÃOeñc®¸Šµþ-yUåø§KcëãJ7DÌv”sW½¡r𵕃¯mw\ýþ¯UŽðø#¹e7lS*FüîØ€s÷—ƒß?'µÉú=®ËàJ]Þʧ Š PoÒ„Æç }s|8%±›oJ¬í Ú‹“sN,O `xïådm.Ø7ó÷mýxbÛqu摦pº½ãˆìIÜtÂn{­û$•ý‡¥Â¿¥/ß+‰9׃Útèø™t)b«™ôz 8૱z”@|jÄü{evƒZ’|è@õé·žf´åw&¶çLkÜñ›+h?ÿ9·D u:ª×š½^Í’ß’:P£DjÛÓxŒp!;ª5.Þ~d½é@¡Ϛ Ï׈Jχ[ô "º¹›²[2G*„^kÍz[g+œÉÜ“©baBåQM]äu^êå„ Áú¨êMÆ€ªZòZÒj„š·Y„\ŸKT[‡jë×’Ö_#Çå¤B箄cDŒoÏç—DPHÍÛ¢Ë}q£ÛââÁÿ‘ت=²ªª–üÖ´ÁBÍÒ”ŠJ1f‰3þ¢v«94¹‚§$ªƒ6'倡uC¬;¡!3Ërl¹l©¶¯±y¨á­IY½Å‡Ô¶ÑéoJrDU—ú¬gC)ãÚ2ÆûeR뎨†#"Œ¾Ø‘m ‰¦êÕfÃЖXKÌ‘ jÜä§jSt]©¦vÐèѬmŧøcF´Ågp¢K):~] € °¶ŒE3F-¸Ñ–öôáþ…v‹!`Þ÷ˆÉ1§Ãi:Eæ¸hA¸ûßÚÉ÷;Û@XÜƳËJ‹ÓVúl¿Ý[à[S´úEò§®»#¹©U1Ù(7øiª 8½š]Q+¸¶æ®º5£^sÅ¥Û÷þ©ßÎÈ°oùíÀ˹)Qó­-Z~¿Ý Õì *‚ÖTE Ææ9û7¸RWÿ&¹¾=`±Ù==pËFPXªþ]ðõ‰ŽŽ{†;rJêßxwfÚÉl+yàƵ Ö¾?è«ç̈ Кìe7dë9–÷Åï:°8-¥n]ÂMNÔTKJPêÙŸÉmk³n (¤ªwòvn‚È¢öý½pím<Ýe¤}OB½áeÖ®xF¢VhÕékîÌ+)ñÆ M lX ¡á“Ëž²ò¨€Øµü†ìŠVÚøIáöÍÎ%ëç¥ÙF(ÄöÅé%_Åíy¡pýŸÍ$Ëeug®z ¶Ù£;bêÐñ3éRaØëÆ>×Ѻ6gãYŽeÙ‰&¨Ôý¹ûšÏšÁø©ÅLB€¦¸ A1à…wcf-=û¶v+Zœ¦¡_~äLJ“ Yý’Ø–2E Qª±¿*–u$ *ˆÀ  cÊMQ Že¥¯Ø °|÷GŽ›G IDATÀÇvô³(á)Ù¶#×Ù›::ÓûÉ?Ü'S3( ¤sQ²+sÏéWùd´Z#—¼ì1–&ˆ3*ŒGEÚ‹u»HáôÞÚŒÀRˇ^Ûn7µêc7n’ùøøÃKYñŸ*úg“=µöϯŒÏvº¤Ê‚óZ¬¤%mœÑ :DŸHYÌ0¯!|a|h¯R逜R€pʸñüÚ¼Áàƒk¾co¯D(W÷,zPðVmJ ”¦WÎîtZ<Ú„Ôu› |Jô‘ÏIÁÊûÀX7xÏ{UãGñ}KM| ?º3XtƒæÙ&² rÝJôeAÿfÍzA]Î@ðuæ[;ëšbsu®¤CÇÏ!¥¸*z[¸)>]Œ/Ú%ì¾ÿªŒ»ƒä O ûÌn˜q0Ðø©¸çõIŠ,¤s‹b¿a§´FɳËf¸½ÁüXá²›QÛҧԧŠÞ•°{Š¹êH eh~N`ªùWîÁ=gŠFU»"û9xÏň(tl…%M€[âU¡ÑææàÁØ°;— ðŽ£•YbQ$ð 4¿ÑßÙrü Æç åÇ$éêò~+ÓW\ç,èLSŸ3 p…h Mèw±@LFˆ&Ê„)€µ9cåífõëf šÑ¦H2NE΃„)_KgFt¨` >Ÿ>&ØÎo§oF·úHƒ§yødìyZR[Fƒ<Õ… &@¿px`*2 „Ê/RYµOU}e†@[óØ×iü©¡nœÉgIŒ­> ª­lŸd*KSJ¶]| aRõèëÐyŒWE*õ29=†=¨?ÆÙñcK@çʹ~ÿÔ3;*1"#z¿5ÍVsXd{d󉀻`ŒñØ'¢©'AKªýØ]Ì,¯Ž*¡AïƖ"þÂ;÷Y×Æ5Wê0µòŒ7ÚRÒ~ò•ÿ°–ùWúìÖÓ¸%*JvÆ•¾Ü¿5hP úƒ)7•GUqtÅ a9[îp˜íœ¿Ë—ûÿšP–¡`HjFg2®#ˆ ×=X?þqP¼ª"“xEîlY ðrõýj³3r¿ÿ£)>žGUå2ö¾Ý–r«/Ó·Îã'>ßÆ$^ñƒaVUŸuY›î zŸ³iô¼Q JS”ˆ©‚ªWäÞò*/ºŒ‰—ƒˆØ2ðw1ë_´úœ†PQÕÄ Uþ¡æ•þµ‹C"ჭ®¼›%ÞâÍÝñgfxº:Ùi1lâQí»ÉÔY©ê㤠ÅÇ«3MQUä$'Kjú}u×åoýxœìå!“y)ˆm}»á¹A«WÉÄm ¨œp©J¨î‹Ô72~k|áæ]‰¯“8ÙËu÷"û8ªj"Iƒ†“6Ó?s¶Ù ¿ƒok¡ó(öö2Á¯¸ 6ƒËrá/E÷áIyü¢+]C—Á]Å°¢æD %7×­q‰  ¹E„L!r€P È«‚‘DÙÏ© 2Πò#ŠŸ¨”ŠV¦ú T¢p*¨‚@õó*§ˆz !N!pT0Sàe¦êL 8Ef‚M…0GQt@eN  ¢"è• a¢‰ÄS¼Ó©Bi` '‡UÁˆ@ü¬*:#C%È)a¼Qåy5È+0Dì$P ð²Ä‹ÊqÝë?§*@D•0ŽòŠ(ɇĨò ìAb¤ráÌŒ ¨!^aŠ(prˆ &öƒÃˆð €Q"y7QŽ*qr VJ€H^$f•'€²‰‘rœ&•4üÇ¥ßèDxiÅÿOÙR'‹õè½lôß’‡‰6凨CžŠÖžF#ÌŠÐësT°ÐÈbV8•÷¿)aKôª®;û×CÞ¤t®;½ÊuéH­×Øxãq³‚·œhb ¯Š]K—è]×–‹7*|ï:ZœAá ½ŸÎx½=©‹ð„Š–´[#[9U×õÓGhQEói  í&ˆª®SãRÑÚ£‹æÿÓ ádhÙf5hРAƒ¦¥4hРAƒMKiРAƒ†ÿ&üìçR> •Uý P†èV@eà“$mµkРᴤŸWú«‘{?oŒŸÊ -ð+¢ö'Aσ‡ŽPtßb±:( iAÎ4h8=ˆPñÆÿ[ŠAG¾eêü›¦|pçå[6 ñ'Þw…ˆ²Óg¦÷èÇ=ñ²LråƘòª*ëјR»ôOlå…Ó˜D¯X~ýøýe¡SÉîHãô4Vƒ¼ë±é{÷×öh O›¾üÝ‚g¿xìÕ8¢ 6ÿ‡akwz¹Ÿ´à9Þ¿çñ³?[V+ˆ§¦N {å¤ZD&µn~æꥄ 0-ï’MK¨¬ÆûÓÓ……}Ç\9n¨Å}lU|ÃpI+-oô81&}äÅæÖn%š#ÔP€–¥7•4çM½ïËK_2ó·5-üÓ®#ABˆ‚=p\§"âu“‹AÀòÀóÀG>ØùŠ!r½ëzB°WÝ&$/D@ÁBW³«¨³S¾órOx€ÓcÉ‚;›ÈuuÀ%O¹ûœs‡© §Á‚8rª6 §7‚€]ÃÓÇc@txøã;š:ɸÛÝu×`:Ûçž ä¸çž°ÀÑEëô™~ó Èw½Û™9‘çþøH¾GÐÙ)߃^ ¢ç±Ûjì5`#T~vce-屋v=" ŠñÃg_xèãš$ ˆššÒÕøÅ<~úäs@V txù¶}áäkÇòÑS^‡ég%·×©È˜Ó\¶NÎÃG÷&9Õy¬Þ^4Ñ‘Ãò.8û±)L)‚ÎCïßp_©jè3ð¢ûû Ê`¾íË_X>òÚ‡bL$|ø³¯¾qŸsÏõ­Ë;lœbßýŒè¼ñ“óÍ¿ïÀ2!í¬q¿½'ÑŠLmÝ÷Öý%‡«ˆ}ÄèßÜŸ–hìéßãElYùà¦U[1qâ„›J6 ðòEîÚ²K’sÏžW4±RpízuÃâeþ0Ä ùͤKçÖ=5soe÷Íüç¥C“‰Ê€¶l}coÚ¬ †QgIñ‚'Ë*š8kÞ€Ëÿ60ÏÊ0\µä¯;6‡IBöô{GMÌwZJQÊw¼ùXYY-3öpñ_ ‹?ò÷™{*ü¸÷œA^Z”εn{gó’…î°9íŒyÏŽ2 txó‹–×J)gÜ'ð=R—#£áŠ­ß¤Ïx(x¥qíó[W~ ¶”ñš0{Ùç4müîáWš=Bö¬†L¨T³ò‰mk·É`H™|ç¸3Ær¸}±ùó÷œ;àŠÉW^jî1_œ(UõÈŽÍÛ%!»ÿÅ ‘XöÜ…[Ž´áÎYž»³•m|ÿñš·©Ïù“®ºÖªãuÙ3†ØßغôÈ—¢Ä´CT š-õO÷î‘ÿ:v<:öó§žÕùüÐ~5ÇRÀ˜¹à›[—\ûÑí3¾[yxØÌ™<ƒ¨VSTæR'«]óðöÕk;Zê^?oŽÓé8"Êå¯ÏÙ×4púCËf]>ñÈwVÕ€I!+âZb²?àñ2FÃ-«^¢ž9q`ÅszÆN¿ÿÓá¥ßy.jéksJÃãÎyxñÄqæ-óŸðUìÞ“ '—~V¢LŸùàü>ÂŽUóׂ ê>¹nãnóÄyK/¸ñ²–E7íÞÝN¼+W¿÷Mþ5^ôÐÛiòš}[åÞôFZLúäyŸL"j§£‹©!O0&,xð‹¿Õ'üöÂÇ¿ž1{PÉ;5)ÐôÕŸÖn†±÷,¹è–ß»—ÞT¼±ž!äªÔ‘sÎùËò™—:òÁíµ $÷¦7ÒcR'Ý·pPqX°ò“59W}8÷îûäïoþvu=o|áúZÝÜ û¤/ÿÕþ£2éñÕar[KËÊL¢Œvlyþ»eUCnþââ{æ±Íw¯\\<ˆ»×ô¹òÍWÏ©]ôDmSPª_°e³{üŸ_pç£p࣠>¥eãÚ÷>I¿øõ‹z%±ý£/ßZCE!òÅA>ýÝ÷Û`ÜÝKνjrù»W— åÜøz›mä­ ‡¥ù·½üÇpþ/xä£BÛî• –P(ÓåLêßµÀ£€¦¢4hZê4=@;ôî•sz)¾|Þê/×)Qs,Ú¹åÃù9W|8籯f^rÖÞþÞ&A4ŸK3¦€uÜ“3.¿j—ozõ¦¥O_»îÓn8÷ö}%¬ðÒ?ÄYô–Â+Rkk*OM'•¨ãªòLáÝûAß‹¯¶ÇÆgžÿì„Yçˆ+öµ ½òj‡Ã”>åÞ,㱆vïñòbL¥öΙ`ŽË(Ú—µ‘5‡ö·æ\yªÝ`È>gôôÔæ£Å %(¾ÆÊ0¦ ½þ­# á1rØ‚',0ÂñÔ]ãjuÛ†ßpÑ£Wêï¯É¼âÌ£>ãŒqçæµ–|/S* YW<7¤P:²ô¥C{”€Ó‡ÈA¤q¦6^o=çÑ¢añ–ì¢iWNj[óßy¨´AÌ›}‰ÅhJ™ñPnl¸çq“ª½$ÁhÐ ÖÚ•pþ=y6!aøø¹£¼{zeK~cfVBLÁÅ…ýBu Í„(wc-³œrÏü‚T‹»|¹Úÿòþ}ÓKÆð fуï5:µ Û·«¥àº'údíEWŒ›Ûpp'‘Ó³¦E5ꨑçL°ÆÙœw“X¶´1„˜1L”Žº¼š”Ó yüNGÐÓPëѽ|fQ¬ÁÊ›­ý¦•.Û’'›ùh`Ú¸¼ òGä¦ò<Äô)²ÒkÚ”Ä4^⺽ ït}À¹TUT÷ÞÏÞ·Žå^0³=ˆ6«Æ€·Ùüþà˜cTLˆG¨¿)„6“¨ ¬ ùVR¿.H›œº%"ý¡ü3ƒcºãx‹)£Êž“cUQàcÂMªéª3n n_øðâÏýÆìs§\s[¬uÚ¶'ïÐÐ÷âGaÉ‹ž{#i…sž;\ )$)VP`\l’ö¨‘BX¼ûÀËפS'̹Ȭwì ŒcŠâlûúÚ7—q4Æ¡~w{,f#0 t¦±WMzÕ§r"!¨m±:ªCàcS˜Ò$Ë €éìvPRU0›Ÿ>íÒ‰çK;Þ\ìåÃo8ãò9Š¯Á`µ0 €3;xtù×XØ-‰´ìù©åvp(n’“všò„z*|›ß>” Ûãü=_i«Ýÿù½V­9ÿ¼¾‘±Cçí€^­¨˜4àÊg_Î=ï,{ùjsÚ'¼^™¤r*‚êkç…¾„‚sGIµ<èÑÛ2b…„zfCFDÂْνçŒñ…*E•¢^/o0 Ú1p‡Í=;'BJ) 'ˆz—OB€ úZ‘³Fêý*~? ÕPX¯©Jï»`Òu¡Ú=߸wýî‰#ÍñRk]*³tŒ”ͼ,äß´pxS)¨À›9숬NbN5'™ú§¿ZE"q-z¦2$²GAÏkRNƒæñ;9ÏǼ辸Òç–>õûoþ~ÍÎúáÃgÏ£åF/ˆ;wô½ÿ‡o_üãw}–<ýOé& Ñ|.…œ¿êë»×,x«©¾!ämmݽhËæ*ûˆi¢mXßÌà±o¾ò+ª[yø€œž‘Îx»¨õAàýÕ7J*öòµÅŒê›8ºl±×ïoÝòäªw_ XÏ,Li+ßRÌtæ9´kÑ{¾°ò#Ñê̘Ÿk._üž3 JKñž5‰ã á£U¯=ÝÐR»ÙO¨ „Éô¶I'_yñ•‹ç·vìÞµâ£`¢È1@MÏBΪv%X¿ÿóL‘¥ ‡’'èm“T’˜3¢cëW-~AÔ© «Ÿ,^ CÓ­žòÕ«R¨uÓK•bÏ›DL7«má°œ!5·ÓŠ÷Ý*øÊv~µÅÜÿ|‹Ž!bËžOÛ½Lî(®<ÊRÓR}%/®ýäãö6 ŒIF³UÙ”u-YZÝ๽dÅJÌ¿4ÙÒ©Ù™!¯0ÏP¾bq-RFܳÄüÅckŸùPRoíS0÷ƒa#3”ô½ùÃÐ;÷|qÛ“Ô˜3èâg²3mHMƒ¦÷_ÿÄ„¦üÁc†ŠO'£=­Ê¦~·¾|ã®/ïy’K7öÚ'L‚~ÀÍï‡ß¹÷ó;î]F¿¹Z bÏî)eÀ"1è”1FUÈùÍk¡î[r益”;óÅ¡Ã9¸ª_æ¼5™&)`Í¿püg’Ì!öOÍm™·aR® ÐÎM£‚-ìÔMݺ÷/gHÉ»òþIçücÔ§þæîÑŸsÖóc&e#«dTQ #¦\qÎò·ÏþÀ?ôúÇØî[ñÚ#Ž§_È¿þ©¹-ó6L~Íd÷s›Ÿ˜ê“Dkß¹“~7€ÉPtë“ß¿øèÇ‚ä©óúܯ*j[0Á‘ªijK¶§ÇOºc‚ç¯kkÊ„GÏš3Œ(M²¢8 ²‹ÿ6­Í‹™3ÿ’™d"ŽßÆï¾÷ë?¿Æ@pŒ¸iòdAL˜p^ÅÆÎÝæbüfö ³8)á1U¹ì«ß–>½oÉ=¯È›6åÖq}ìŒBæ˜üÕ/]ì¼k͸ëïßðÎÍ}â¸æ‘ ¬nÃv±ÿÃ6V´ECtãç­Ü¡Pø®jÝQ™Ç/×E)ðá>¹(ž`…Âe ¸jN˜…H†±ó"0P%PñzñºÈM)P%P# )xDªR€y„p˜E\\×+J¨3åAç5 ªÚˆÎp(Š …€1†ŠHÆ9ð< €*"3ȉWŽ˜ ŠŒ€AV"2œ‘a ‡‘»Y¬«èÙ¦ ŠÄ `Š êÔPD¤ ¼iˆÐy÷ˆª „e€y=pTŠ (Jç±x÷Ï_¾†žwçuF (/Pä®NAäh'Ÿ3Ÿ) G¨ã× *ÈaÆò *HÒqZ€Ê ÈŒ1 " "Ð ( x}ä^(a hÛÚ¯Ÿÿxè¼·rÌ 2Ђü4ü$é—h†qÿ#•;4üz÷'ªªÔóY§4Sàöþ$S@꺆­ÊˆTé^‰<ìÕH·œD R¨ëc‘f€J I½š 2H½ÿ»?鎃‚<‘–“ÛT¿IîF!,°®î{ÑÛù&%ʉ,ì$Í:øÒ¢}×~ûaö¬ßLã{»g§r/nœÄ|`*È^ª!POI âñ€Òƒv&;÷.ú0uöŸ³-@U-I’Íã§AÃÿüî“RcŸß|’ À”ÿteÆPˆvã|`šŠÒ i) 4ô0¶ü òüGúgšŠÒ i©…‚¤Få¹”J±¨/Ä®P` ™j«]ƒ §%ýú+J­óóFOP®Ðè ØÖq ÀŒúú1zÈ «Ú·Oƒ §g¾à,ºÿ[J¦ðIsG_ˆæ€éiðènÐGsŒŸÌ`ÞXV G´Šò4h8=é—e³Ó¡àAK© ¾®‚UµQ9U—äÁ˜x}/€Í+N…?ôƒÅUðmöíÓ AÃiaD"ŒOúÕv?w!’ô%ê¶$r¿\®Ÿ0zgAƒ ÿ é÷«ªPK´Ñ Aƒ ¿ZüR‘è‘ÄH\—Z¤jg¨l”l. ©¸®E"hРAÕ–B©"cÝcÉM5”ËŽŽûM0Š.k!êš¾Êßú–),©Ö1ÇÆßã²F}OÎ[®W0H(o ›â)éÒÇÿÔ#Ø©°òþzãƒFýi¹Øñ­ ‘Úu4ÇüL;‹ã}±9ç¢*xjˆ.=¬ûé‹Uj31`³ÿ³<(d‰g'Œ1"µëd!h¶zÏ„ôÇé:aštœÞ4©¢» ™áÿ÷ä`ªO†ÍŽnbQêЇ1h‰!R‡N‚&kïaT}fHÇŸ±ž·ƒ,`sh’ý¿ ¿˜Ç/˜´í¡rîÞ ¿Þ6ûóµÜý{¢é˜„ë³ñUï ì¸ðóÊ)oÇD€h®(<Ä?{кS–¶ÿüµ¸î%‹IÔóO CP=ñekxUPÍU_¤×·žÞRB@4Ö-´¸ƒ ºŠÓËöý|; ȵ,H¬wþë&;çËøöʾΟüEAjß*Zñ®ðÏ´:švø{rªëºŽÍå‡Nñ5AqæácÇOX{M“ÏQ¶šWTÕ\ýez]ói¹2—_’WíùWÅéG¼gÓÀï_z”e=;ÒËv€©ú½ÁÛVõ"–í_Oj B`[/bBÃGÃW¼%DsP®†ÿœ-ÅôÍcßnF#B~{¬ÙrGœG÷* ɯÉ(ThÏ9/£ô]³r¹—cQÀx«;õêcC†1Jœ©«¯è»ZÜ3óù„ íbv   :ãË6»²Î ®þ·»"îOF~lùIÙEˆ=ü…<ä\/@(afiB玿Ww¬Ç¯­d‘®»ûÒ{"X›0½9@íÚŒ“Þc£]/žÜ; RÞH ßÔu¿{u´‡‰ƒŒˆªÀ3èÁìÝ>`L586zDçÞ“Ï?šÜcØ=T€Ð¼)¹~Tõà¼Î|礋ÿ'B]ñe=YÓˆ«ß­® M‚€*ëü!Ò8€.ª# v;çIW³ÐåÀg=κL7ÄNþãÉ«ˆSy‘!×Í°ã¬RcŒˆ*'t2!2㪹qüÓ ”oH®S=8ÂÝ]üÏ9QåM¬kZê_ô˜1N ¶XZ7§uVO›Må™ðxÆ(k2ÁkŽú˜9È  £~Ê}ÉŸ?mo½ºÉ¡7Ô}œ·k‘H¹ÔÚQn²³´­&·ºP5fâÑñWÇ|}\«:dñï+g½Åm»2ÛxÿžÔmƒÔ5Ø| Meú°©fê«õ‰f®å«¾›>Ò«Œø2¯;2jFÌÚ+³ÕöߊÓßk÷¼5¤4¶xú¥æc¯õ9°–GIJݨyÉǶ;ûHE ¸ÓÑR©S3ʦ?ßfå»×†¶ ]öR{怘ƃúÒ:â銜,פ?žÜÚŠŒ…/·é7 IDAT>2î2a×#…5~lùãÈ%Ðwñö1yàýrÜO5Mý´·¤óv€r°Ï–œÃ^Ø9ûÓCƒdlûÈèü<Ù•¶ÿü…;g¿Wžª M÷[Fï›ýv›AΤpãŒ|{}°ÿ#{æ.*ÉbY;V¢Ÿ¶ {v祋¶_ø4­x.©1Ø1ñ…VSLåÔwêâôˆ:E0B¨8woqÝÄ·wÎþøЀ¬ì¯€Wt¡©Ò9â…=—|]a+É8°½÷R!èSS®ÞwÁ'û†NÞó G îÀs¡‰ûÏÿbû…o´{_/سÛ7ü:+8½¾sâ¹BíjŽ€P¹–¥E¼Aױ͛2‚ª{s·~Ñ6êÕ³?=P4!eë‹f•¨‚Yh®iŸønééCЕ¿8 D_2óY™ïòˆ*BÈX7ñ—,Ú1ýÖCóaàÝߦ7Š%3?Þ}Öƒa E>©ê,|k{Óä×w]ø0Ô¼/M<0û£ý#úÆ—-ç)0Q ¨HÀ<áÀyîž|åÈR=CÊéA¦ØËðY÷pçÌ'œ‚“×õ«ÍŸDãï8pÖ>£Qhª¯›þQUF¦2ÖMœ¿ó’E;ϼÑvè]c@hšð7Ÿeäþóßn3(À>±µpxlóaáÊäVµvÔtÓ±·²Û²žûÙŽ‹æ7ª_ö+^$R.… ô»Ò^œÚL®åc½e²ÛfëÜ®¡ òfqàüv5OWúflP¢¼‘ooòŒzõÀø«VÝgÍã4ïo».üb÷´Û G^°{} wש™ØsÁ‡ “3v,ç³,ˆ‘ ØTêøÄι‹Žd¸úlx› žŠ–°m@mþšpÇþ³î qÍÙkþ¬K¾o÷‹vO¿M_òL¬'@¼«3j¤Ãg¼ëì¿ù0¡Lëš–úw`l|gé™o–dUå¿ÇGÑr"Ù•“®µo¹dÜüñYͶ¦„Dÿu_È£k…™/èHNäIcÃòN+7Br¯ÍÝñÍ­täÏqZMH)CÖ#Ø‘©Šc¤Ób‚„›9Á”¾úŠÇF~xæ˜O®— $îtý°®“ "p+ó@Ol H)’”=q>`L‘“§ù *úm±(µ°% æ,g\"¨ â©ÒΩ~[Gu[ÿaŸÐ0°H߸–‹Ô¦*M› ®7ÁQÝÜ>à"V¦šk«}öÁè\a Ü I€\(ah+³{UªjŸÒa3!€„wo,ØsôÈY÷z xÜÝÇø@JvÜî[G}0mìW÷Û$Pà]›iÜ €^‚£-1u:¦d9qrˆЧJDð'õk6ÐöXBL°yâó z¹î?!ˆ)0ïy*ûÀj˨rI€£ÈFJJâ9^‹@ ¤dÛwß<êƒic¾~Ðæ ¥À(0†Œv&Ÿe44]hØÅ%&~\}gißçÉ?3¨€‹i8Fh\!*\§CM?¬²É~è[àÁ¾ou cŽÄ÷prsOÒFé³üÖ@Œ7Ì€ª1#Úcâ!àÝNlËÎgª¹ŸÇ.ǹ= €ÚµÅ§2NçI¡J+ǺÖ5á̶¸X gnvÃÎEŒ¸yÀ¿Íái.N ¨æaΰ¹]œk#Ä  ÀÅv$öUµË5šÇï_õÄ—|„׶ĈŠMájš9 J´œs2Y‰»hçW¡ Ì¿±è{ꡇW>ÚµDØÂúf³TŸà=P°â·  GõIT³ö³é>ÏÚ´LdYåSqŠn†\ÏÃ$Ê\}–Ý›xçÞ93$§Ïçã)í8Å‹ÄÞ)¬ˆHA!*FøÞúó„¾H/æ3 œ»ý¶!» ÎìNHÄN]¨‚at‹õ/¶ú1ÁŒªäÌø*ØëµÕÇ¡ÝKPO#Å Q ¨•;“Ã0"šÊÞ“…8«Ûã6ëAí<¯ZÒoñmlÐË»¦PÕc—üPõéÜ}1Žï ã8è>¡ÂZôÈð”"½…wî5~rlq¿’™}vÉäßõ$Šzz¨ß—·Ó!¯ìœVD•£—¾xÊ™V­…ún‚Wõ·m äœ'3Š Yö=:ôˆ€\Iývm>Tp¾¾]fjѧ·§TNÍê5ˆ,RÆ‘"JÄNBU?zÚIRÂUF¸Sed  únýÇ@&' ¨!ü髯IA Œ8Úƒ~$tó´s)MKý‹¶ˆÞykÚäÉ×Xiö¶­ÁŒ§%>zÂäˆ/uí ˜û`}²>uÛ+ìÛÃÀ0ê•Tç96Ç[þa4LèpæÒ×›>ß+R@ ”A¨Rk& «‘¼IÛçeUTìÉEÂû‘»c®Š 뇞#é‚Åv?ßÐk‡Œp2›©ªu0Ž ÀÛ%ÎgDü©‡–D/K`Àߤ ~ÂL”‘E´‚®­OVNÉBu¬Go0ëX\íBƒ~‚ÏÌ2X ¯âeAòŠaS“IÀŽî> û¼Vb_3býŸç¿ÝnÄÎpßNÍ.é?RÛ7[ÂCP \ÈIYbð»‘%ü¿lñDW}0ý‚²Ì @*ë·ðw™—×adîzh5ïväê7Bx6[ÃBg´7†`—ñªKkN0e—jv׶ Ì@YL å]³wèPPX€cF•ë8¾90Íh‰ý8mËËBúF¥ÇÎLU„€ 0 ¨"U¯^Àp]…©0¤~nè Þ ÏhˆL+þ€ÛYtÕ#Œzë$H鱋âŒ9!ÊZ'¼[ËÔ p¡)“„ÇÎï"T¯‰uÍã÷¯Aß:öÙc©ÎüoæŒXþw.ãÁ’Qc£&z‚1`±EWY÷Ü1òËÍÖ+KŒö_P¦›ê\ûâjŠã*–å~sYA…Xvæ¼0˜gÕÇ5fíYdðÕÙ÷?6rÙ+Æöw¯¼ÇÞPnì8dk«÷ÆÆ2ÔS©<®i¯(#ÃSºéÒ¼:)éà]ûÖ‚u›½6Åà*CÐ)èµ6m5†U†Lb¶ ZùÝÙ%ëôîÒÌ=Ñìëœ:Š ~| sBŸH„¦>ãÍÛç¥ÔWè;Šó–œÝï^ YDCË:³G‘Rgšê¾•Óú^«!}÷ºpæL…Xg×ÇÔfî_¢÷V¦ìCH¼´ÝÀz:â€Q*Ú¤¬ëK2œ¹k^i×1ži4&–î×7-í·ñ€_ßfqÕ)öóC­Ë2*v™êW¦VoÆ_#ì-ÅÞSìç Þü‰©½Æ\·Á¢ØÝ1zU0 k£µµ‚§]=˜‡ø !ñØ}ã×}7ôë[-îfà TªˆmÞ#Ê]0Òž?Z(},!œåqrÎôiBÉß3ªŽèÜ{³Wœ7tË&àzf®ÙãuuCFÚ›ñÌŸxì#[GCLù»±tD»E=)2LªÈ5¤¿dv×Çy*^ÖkGöä©ÿ˽[uÎ=y;¶…r~䈚UD#º6ÙZë_TÖ7>eÓ6Wƒ¹æÓ¡‹¯·»}JÌl¿sUFùvSÃê´Šï5‡ß¸Gyäçk]¦ðY9”{€3ø³fÔû}ÍÐ+ZÓré¯>÷ÄÀ8˜’/íàSÍÍC~S;ìê–Ô| ,j²fPøã@ø®ÊÜ'Šv.Ш—:ÌGMž&%nZÙ”y.c$2›÷fN#íß'Un1@Ÿò±¿õ9Îðèš*ÖÄ´Trn¨ÊÌÞ" Žê=jò” s‚¹¿Û‚<‹u'dÊ.Ïr¥ökKÎÑ7¬Lhéh)º§)Ñ`¯+ ¤ŒõÄêbkŠ9ûæI¼+¾+c¤¾aEbÍê˜}tø('yÐ늋 ·q†îøÉ/™$„™7i€ÊTý"µ:S ”Ø¢V;:Ž}moªö¹­|ÐP¦BÀ‘dnÜ®3ä;í}@ uäL ê ²Àt’¾µßÌ @yOæd¾uubÕ6Î<åèˆÙ*"Q|DHq91>à”ãGyŒºPúlß…¦þAƒ.¹-9ÞVµ,έ¯w_‡¹#±¦Ù•;Í™[µÊæÁ†‚³™àLÉÅP³ pÅZ€)‚ßçOÔ¨>Źãs ªÁ͇‚¤a‘C* 2x“RÕËqÉ®ø4_âhæÚ’TµÉê#£nŽ5(–Œéh ÆäÈÖ~®X äöd‡­jYœÇX;þ>§±-±¶Å•=!(´;ªw«ISBàs?WŒŒiÌ×H=·#12KAk¢-¶üëøÆR9ýº£#Æ1ª§”0ÖkÂuú±£YO7ºâ}çê{©©êskÀZ=êŸÑˆ4ÀCŒ+>@Å`æ¹RhWbùZ“Ú§bôhHPôîÄ<†ŠGÄ$Wb2ÁXw|‘\4åÂVVœy´XI»òhÑ8JÞï”ãÇ8S2Á0¦£Í—8ÄŸyŸ•$•­¶yXSÑíqqÀ;ÜI 1U«cÜrSÁyªàp¥äiÅÔþM¤™áœ H1ý:<>?k}©€~ßÖFe¶ÙËrá/E÷!€ÍËMC—Á]Å°¢¦Ç,D&ôðX²®+/Ý7°+ëa¼œð{\“ŠH0ÚµùÀ}º_é¾Öƒ=®au?énüø¢®qBÔÝÃc½³0ön§ëŠéêëä›R„à‰½#o“ôîˆÁñ[Ï=©ë¾ÁsBV_ÊŽ?rǨûîö¸cÄàDŠºÿDOšŽîÏôìå”ãa'MSÏI¡]y"ߺ? ðþ’œõÈýþ^™“×ë–Tõ[p{ÚòúD¡k~{¦º€S¬¢SNë½àTÃè^~¬Ç,÷ìNâ9 –[ùß‘~£á¥qPÿ«ŽVQþÝEÇÙ©žŸò¯'ç`'=ì‘ýèøÏ´—awb˽®…öpç±ÞãìivŸüð„~¾=@{¼B¡— ;¡÷žmþÈHz6Îz¿Û“¥ìúí>£éÉÆãá‰Ã`p @ï!ÑS¹OnŸžDÈ |‹Èùæ÷‹Ö}êͽ³<;ïÄP!FT•"í1¿½GõãÃÆÞ„ãÉk¬‡ÂëùðÄ•‰§rj ê¿ š–Ò AÃ)}ÅŒ¥ü¾øê߃I?ÑS¥1`G/YÊé¥×Ó AÓR4høÿ7¸tf`:Á}QK²f¸hˆ~-…q:H2FßJf buÀ!XL`ŽæZ½axq:H6i«]ƒ §%ýú_Q!ÄŸ7zBeЌΠô<yhE÷f‘1°ëÁ/CX {Ò AÃéI?‘ÊÀaø°¥ƒ}Pï‰Ê™Ê‰ƒ!I°ôÑ|Ce0§쬇:öåÓ AÃi!Á#Ó~-ƒùÙÏ¥ ’•?…HQ^–W¡´Dã,hРá?"ýä_“ëE»©­Aƒ ~½ø¥´ceê8  FžDÓ‰U÷ø#cï¦{R¤-( 4høÅ/XÑ}p炧ª›ÜŒR1ýìñWÞdš¨3€4ÜT½ú¹õ_//¸}çø:JPwÅ’'÷ì<¬ê³fO¼òê!Jn0ƻӻU1øÓ†ÏX§æVÕŸø.c@  c?õEDÂU¤ôŒ1 <öÃSɆJNÅÆ€ð€ì§óçÔcAÂRPéi´öó0Š1@{P˜‘„ñ½c €©@ééÌsä$Taÿ6Ë4h¶Ôé+)8úåãUq¿™õçÏ.¸ÿµ,ׂßí QãnD@hXóx#Wh±q…¥˜ûÐâí‡lï\páŸ_Ëö,XûåN&b4TˆDÀú/îZùÒí+Ÿ¿õÛïÚüÕ"gxOÏ"dÀwÖ®“ë¾{nÃæž?yÂcDB½e߬_ºžýTA„HCeÛ?yÛT¢cŒ1€ãNßîEä±ñ›G¬e?1š4ñщçÎÐu×>d´½r{̘sl&ÎÔwÆÿ¾…n¢%e!rà/ß,›F˜ñÛ¾c§`ý—Kï¼ð@ÄqÝ)}~„ÈBMëßù‡/¤#æÌa©)–“%ÏÉ—1D+¾¼åÈ7crÒrÒð¤Õ[íÞg§>¡0-3þTmq–¬¢´d3c'ü‘GiÇíŸÏ/áÄãùN!Á"Ò®{>yë  qý&&9DÆŽôGd> ·4–—ªì ‰üÈ~ÈÐþ‘ñ„ÛKj[{ JEûÀÉ vâ«ÞÝØâïY'‹2cÂàI1f‚<6.»~׎ö“•O/†#(Í{êÊë™vh®á—ôøu­ÊPËÎ¥ÍÕ{*;ÆŒ¸pÇ¢å*cŒÖ8õ=Ñ »=&ËùzñŽ\AùÖ›1šö(†„~)…ƒ ƒœ13³¿¼aõk$>ô”]‡Lõµ•îôxC¼53%¯Pà0Ô| ©¶^eœ)ePRš½}ﲶÊ#Õ;¾O5]0ÄèyArW·ºy+«knh#æô¤~ƒôˆˆÁŽc»nÆ[ãrŠâzÏ¡•Uû*xº6.eVŒ`ÔÀÂmM¥{AE°f%ç„ùëz„L³oK‹GˆÍK.ÈN0R ‘ÛW©£¢=±p¸IÇ!`ãæÚZ™é-©ƒÓíHúª …U>&+9¯¯RµáØÎÊ`Îú–¼™‰6ëÔœ,Ôz´¹ºZaœ!q`Jf Úlïp…éÃ!€ˆàk>t@窭`†¤”‚@Åöv—dJžœGD³ŽêÕpKs­Óª´Ô5€!1±ß0œ!V§ãÊí-¥û¼¾1$8ò‹ áò£[Jê¶újà¬Sã äÚƒæþSb h9ÒR]£0Î40%3Ié¨<¶õ°ÞVS¦Ó›:Cš<öÌÂTPi/Ù*¤°Zywùöö6êò‡™ 0ßÑuNÛÐÔÌX¤@CmÇêâû 2l;ê”cÌÁÒ–VŸ›—Z˜' Ôvp‹â(kYLµr®–Ò=>¿Ä›Ó’òûé"…9¨ÙÞXÛÆÙr’ uŒð„1DPœ¥ZZ‚ú„~É}Ò9Ɖ»  ¯t]Ù®J)w]KŸY‰¥µt§Ûà-™Éù}E‚€ª¿n_sC gË6©@;äÕðËÚRÇ7ÁAO8ä—¼­!¿=\BD€“t*U)é*CGx2™FÛÍYFUªUX8)gß‘ ìkªtaU_ܼmÝ6 áúµO®[½‹z7¯çé6ÄBu»ß»ëH“ ,KÀ‰:Bä†ï_ؼ­NjÞ¼éõ[÷l3ØĪ¯Z»²Œ7@Ó×w¬øàË  RÝÒµ¯?ÜâÂÉ!¿Ê :BÐ[±|ÓŠ €¾Cïß²o@¨æ»Ç¿[²ðбçÓµoÝ}¤F6YB‡Þ»mû¶$½7àî}»Ö­ †ýõkÿñÝÂÍ @èØçß¾øD£Kßþ­/Þ¸ç OÀÚm/ßRr¬0ܸæ¡K¿¥D ùN»'¥¦­k^|¤É`Áª=ïÞ¶«<È‹Ðúí£«>Xd̹õ¹ý•*GbÓ¾·oÛºq;o±¶núëw/ÝWÑÎ딲ͯ?ÔB÷þO7­=@‡·½~ó¶:›µeÃó«¾ÚCt´~Õ3[¶7|ðèçlÙz˜ðìuÅóOyAû$äA'•/|dÝçÏÕ×u¨  ›Ö¼ø—&g+wÏ¿}wyˆXÈ''ˆ:©tÁ½»û9×úuo>ë@Ú³õý²Ø±úî5Ÿ~¢à9øÎ÷ Þ J[PÇêß_ûáü ø*—lY»õ¸1ƒÌ}d麗o>P4Y”c îX¿ºŒ7„Ë>xÝÂœ*Jeß²»øC¹aÃ?¾[´ŽD"ÒÊ÷¶m.QBÕ{ß½}ˆAï?üÞûù9ÑØó̾ýuŠg߶WnÝ··Z÷½}OEƒÌñJȧAÇ ¤fñ­[WoRAnÜðÔºB¸fíÚמnõ*RÝšÝûª9¢9û4ü²¶c Ô§Lü}š W\õÝ¢ù)·Ü¨Þ¥ˆÈëuRXîÔX¡JL‚­´ Òíf)äóƒgÛî]Òè{ïNµ“ì̘¥/Öœ“4ö+w®IÄôA3]¬h,ÒéëÒ·Já A@”qxÑ93 ˜k½kspvnܤfMŒ5™xä†;wÿ¦©Ò=hÀ‹þ-{Áø8#çDŽz¥å›#)gÞ}cŒ²’á‹ç^«?wÇÂM-š1•cÀï¿©d2ö¬ž•Ø%¹hÖïÓLÁ×—Ÿm°±•–ÁÄ¿N8;WAˆ¯^õéÀôŒúF2ä†+úÄ@Ÿ¢)îÅ’$Úô„äŒwXt‘`ÀÇ žpÛ«&« 9ÊW­Ý²þðè‚„›wÄ_²|è0=Ãá®Q‚¼=kðÌ´‚8C øØZûÌqã9£|Íòê¥ÇsD• 9ó\»YŒõ—~³)€Ã‘„ HmMUIW<[e`#§dÔ¶Øìi±‘‹™’‘Z#ÑgDÆ°é"wœ‡ŒRCf¡@Ô@Ý‘E¯¹id<®œ¼ U]î౛ׯ¥C&–~·/nò£z×·n0ÆT-=X/U|RGS›7= *î7Ü\^²775¡æ°’=¡o¯Ð9ªròõ(]Z6(!Œ2ó9Rs±bM5˜€ð‡ÞàléP³5äôÓS`¼Éjº 63U1‰L9¹¡òfEé5uHxµ©Ø¤eÿ"?Q@i ûKëÛ«§Á–Ë(0NHL3³RM8køeµpz]¨|Ã+读9–ÚþI±uôK¡wñ¡_³©Á”`K­šd ¡¶²ö:“!>-iÀdå…g·å8ò¬eë—ʺæiÀ/ý3ha$ˆm«ëBÆɱà§7Ä$90iô5#b™1×½”×Ñä©Ø¸÷“ÛZ/~³(ñT4öˆk@¬ØöÅǦË>ß?Žðí›æ]FÙ)ßâÑ®ÚB!Ø£®]W¬Ø?™ DD¢/ɨFu¹?•ÜÖèo>T¶ú©ï+.›qùÌ“ßnßûf£qüŒ¹êX5ÿêMÁˆ £¬«d•Õ.²XÏNµ­ IDATNoaNÔøÇ™ÐùŠ‰n9«ÿœ€³¦nãë«6­švÿ³=_$|'ûÚö¼Õh™töœóõ¨xûª-ò)(¦2$N»^XÚq,t¤5w¨xðÞ`K0édPxÞÃæL; E48F]²{ÉÞ@j]»yê¨$ñ„3>ªtùªU°‹ýa@èfEçJéúù8O°×"€®Ù¤*"wÒÜ1àBDcL¢‘S“F^=ÌfÃvÖY•TYÑD³†_Üãº>sŸaº¿ízõš0‰Iÿ·Éç5j:×þW¯*ó›Sœ{é­Ë¦á/˜qæ9¿m_÷Ù­Gñ9sælQ•h«µÃT¦R * Õnùu!ÿæ´à=“md¿9cLF‚HCí.êÛÖWº3Ò sÌñ™RëáýU-˜Œ*¥ôÇθH1¤ÄÇ¡²/«\ü È…ÆU:Ãù©Ì§Lá;–ú¼aCŒà«=‚ü;éO ­á±qñû÷—©…#¡eÇ~½ýJ}ðpÉö@Θáö¸t[".g‹$Ÿ ÀSXõ§„=ú‡ pÔu´²¾cdfÈ°éà e-C˜ïPu-µŽü·§Uê(ßQ’8ttŒ-9>;¦þŽ›Ú;T˜L{ÇÑ©a!Æ!ðœê:\Yߌ¥+FO> ÇÎÍŽýôð—_Ó¿O± E âë,fhV¡™*!o[£Á¤£~3jL(r°7/,‹?÷#ªô( O¸pÅ.¯t¶Uçá4š ]¼§À¥LÑ{æ{:BÖ1ÐT3Ò-ýÁ¹AŽ)ö«…zçácÛØÞnpF•—0)†+6¤ŽÊJÖÑ°Óå [ Ä“ÑQ]«ŽÈIΚj/Ñü4üÒ¶c 5÷¹àñü¹€TEb,ZjÓ0F™cìß6MÀãY•È3ô¿ô¼¿]Šª ªÌ¢KGÑ°«aÛ›ëìL øÛZ 9×L¹äBQj;|ꪽ î®MN’Úª¤øóÆOŽ~ývÅöB ¸Ûä~—d¢Øa¡·~øDá¥÷ƒ”eʨ,‡¥.Ý”B3÷í78i×ÛwzûØ¡ï aº£«>L/¼!.‘–|ñ¨rÕ“iL’Ã.væà¡«w.x(ÖavÕÕfϹÏÁ©UrHêÚP3Ù/K'ªüì}wx\ÅÕþ;sËö•´ê’Õ,Ùr‘{ÇcŒép05´’ÐBH! =!!„½Å”ÐÁ¸€m îUî–,[½kµ}÷¶™ß»²%KÆþ}ù/Ü÷áyçÞ;õœ9gN‰E¶ÔLÕb1Fh霫ŸtÉsä½£mĸkæ[¥­kþ¼û°T—ë85ñ«Åí)pmúàn1õ¾q¥iŒiCÏQ^~qUp=%μaõŸÿkÛö?Ž>sî²·²´jœ…Rš)êšP=‰sn(=Mâ†æ LiªMéQNŠS8À´ˆ¦D@¸úõÏÖ}”–î6º«yÅUƒ²µtpä“?¯r™ izB(KzvìÕç¿ô¯¡Ä•?bdÃçOoß<(§¬,öÁëËæ+‘°nÄ•„öü Eï?µqŸ' 4aè”Ë/úòÝ[>/,E¤-¤påÍ6®ëŠbË\âY\7õü‰.n€÷NSÌ©5µsû›¦FgÓnuØ¥?vÕˆ…tƒƒΓ'œ´tÛë¿mÈö[jóξ%Kf-š¢ªg'¢*7¢!Ý`z,&:ë7ÿû/Pšj²ÇþÏY2ZõXÈ`œÃåÉwl~ï.ᚦœ9~Â;ZrsUo½’zʬËægºÐ³ú¡EÏmN±JDŒªÁ˜iäg"qôùZÃúè KjÐàOÊh³e阘‡W*! I<Á:Ã¥XÛˆú~³ Û=ú‰ŠV‹Ó-P’ˆûÄ5%Ô­ëŒPÙâJ¢EºÕ˜ÊA‹Ëj·L {UÕS²h¬[¥.«¤Æb°9`Š/ªˆv·Z8 2²+C4ü‘°aKõ@õÅŠàÎ’‰)Ôæ´ÃˆÅ‚~ƒq*9¬N'%У~•Ûìv #Ò©0‡Íi;DX™ …egª@ ×ÂшnMI¡àFÌ‹D9ÑžjµÊ˜ˆE"Œƒˆ6«Ã-„)þh(B]™6YLè­¸®†»5Í,)V+¢±¤ÚlT vk:¬©BM±XIÌïé¢H 5¤h‚Ýa7” ö Ñ*ºÅfC,³¸Ü”®#QnOqëa¯F]v›Äõh,0'T’i’D¹Ž‚°8=Ê­éV‹~°=Ö«Ñ@€ZS-² !Û=–x`Z(ŒYÒÒEÎ !L y5UãD’©’,ˆÅªÕå­êÕŸìÉùÕy§•zokûâ/_Ö;ÿ‰ѰBe§Õå¢`ª¿“YÓ­s€+JЯŒˆv›ÓE)ŒXP1d»Ã €E»bºÍî¶*¾NØÒ©æק ùT• V·Õa'Ðc>/ufÊ"aŠ/ŠRW–Mbñá=¸À®E|JL%¢Í"Šf±»¦ß·Eý²˜^ˆL»É¥L.õ­r)߃(tïÎë?ª\çý«<2a}k]ùе.ºæ4n˜ƒeâxäRfFy&¾ã\Š‡¤øÄ®O“i¿`„Ä]:glf7“dš8^ar)&¾ÓÇbRÁc z˜ÒáÁ‰=âüD,]SØ6ñ}äRœƒqäÛ܉ÿKækÜxãY¼GæzÿJRÇEì³Ô{d.s…˜8Dý¾/\ŠCÓ‘çJÊ©J³Á"â„É|Âd€EÄ°tä9ÍÝg„‰c‚C†tÜ8|½\Š:‚Éy++2dptIÎ¥8†~†NónÜ„ ÇÁ¢!Õz|(¾V¿ˆŽ3be}2 ½¸ NFùó€œÌËÍÀö+ð³UXQgn=&LFå๓0)ë{ K°‰€„$¼˜‚U%€œä\J%I; &L˜ø6¨ŸC<ŽW¾)Õcÿ»ûãí†îfîðÆVb„ &’N–êÀåÎÍ)Þ& [4}B Ý#y(;ç „DjÒ[jb¹³C6!Îâi`gzG[(ïä¨%©âŽ%R7 'ˆ{<º“ÄãâüŸŸ£ÕÿmwüXšÀ!pÐÃèØ ÇÖYÎAÉÉ⟦´Gfë îÊÑï‘IÍL˜\ê¿“Ù,µÏZ½Ì?ìܨ¶¦dã3'¿Ð˜ëHÓWBÄ®O‡­zÒÝÕØvÚÌ]ã–¦·†¯[`êÏ<©1¹¸!¶òš|éô=.Ñ)!P×”¾´ñä߇¥þRäÍ`ý_”íj¬žr±ñ-F%„†7 Ù²uÿÔk4‘~ÕøÖ’…÷D&>Òæ‘JÞÏʪý{'_ÀŽÈÅ9¾³téƒ.ç¹Û¦ÌgGÍæGˆÔðï[ œpÁb@ z8<þÙ½eÚµ®pÛ‚4o;äBSüƒ/©>Ó ÜŒ/b⻇oŠ^°`F݆ÈÔǪ'\ÚxÂ{³»2ö­IžýD@ºÿýö©¿óÉ=4‹+éõ›kO¹;@“S×G ùvfìúOVW{¬àwvÕˆ| W¹RðÅî@l`Q€^÷-'z·Ó×B¾BMÚ[ ̪ÇöÛ#½o†pøÉQµµDµuí–µ> Õ»þvÂ1ú:þë·²e5£Ïeä(ˆZÏ8eÿ”;ª§ÞÚé0Ü8¥júû¦ÿ¾!Û%7,˜øÑí)ÂøúI·Õ— MÛp˘¯ !ð-œôÁ]–ô «N~¨jâ\Ëîß ß¹ÖdQ&LYê¿¡‰®¦YO71€‘zw@UÊ “‰ºsÞ9þ[3õHnžü ÄýÉ;ùÄÒ;´hý‚®soV› ×V÷™#6#ÚsT=ŸÞ\mß$#N‘:º §Ô°·®HU‡6ª»ê=!û‚©ÊhØ,‚â™Ü^P®ºjÉ©HëJµx^ôP°XÕ]û±ÅyrGV8À¹ìÛœËlÏ-ØúIF¬¼µ¤À]õ¡˜1Ÿ:bF$k†7»ˆ³öôÚíª…¥tëm£Îd¾Ê̦JÉ°„sOñfeÂàO9°ÜôAÊê.œvZÀAÔ–ôÚÏ­ª˜љ]€SAò~™Ñ~€X :ÏRDs4®Hõ¶Rê æÍñ¥»ã-"û²wm•àðÎ:ݽOw4¸'³a£¬ Ѭ“:sóOCC¸Ø¹9·¥ƒÓü”ÎêPÁhntyj—Ù£Qf+í(žª‰TîÞêÖR•Ðz›<ª#çœ[s‚¶.Õ¹˜QÊ­€°®!ëŸóM~¡jø0€Lì*:±âýÛ :f×æfÚÖÈŽkvM;Q µ`ïé9Ùí‚IÎL˜²Ô`ÝÅïÏžöæ Î’G÷T MOwN@ X¯“5¡ èS’|Ò —\ÖÂ>¾e_Ÿã 1²V]W\×ñ[kÿ1jój%­ˆpK8³BÔìm/Ù,½û±Ò5¯ÊÐw ^óœ+¼{ØÒß»Yv0ÕžµöÖŠmµÔ=Ï Yû[wëT88n–æËwl‹¸ìs&ZÛ–íß× ?_²{;DݳýÉ¡«í¼VôùÝiÝ*Œ–ü5¿+«Ù£:Ó‰wå¨Å¿wóü#Ròéµ%Í dx>¿jøöŠg˜¦¬¾â~»ðð •7gu3Å&䮾¥°µƒBüË˪ªTw¶sßã£×®ƒÇö?ýr±á.û‡,¹1ÓOâÉÞûµ 2"«G~ú„E;´^I°rø’_¦i!´òÆ!u‰´.†}PØ.s17˜–Ç5÷Ëë š¼‘ôR©ùÅ1_~H¹ëËÁ_þ² ŠÕÉÑsÈ®ÎÁ ÄsáÏÓÔ²–üÁÐ8 sHeíÅeÙÕ{ æ)AèÕ¡× `¤Œk.mšð˜0e©ÿîæÿìî^5xõÍ¥Ž7ö•å% £"ßUnBòkgýpò¿JòŸ®ƒk!òIQ“¥ú¼ŸúðºÅ _³VüR¡Ì‘1‹r)îh$D¼¢\ÑE·¤‡ÐZg·ÎnŒ~’qåÎѧ²ÍÓVýÃ:毜0.Ÿ·ÂlhÂàD¤ÁÅÃV-;0ç¹°ÕÒ›åsBzýMÂ)×Ò.n/ VÖîzÓêð:)EnCÅUgÆ–Û¥¢_U™‚íá•Ö¿\Ÿ÷?¾ÉOn5¬†À‘vUzÍì!5*~œ*Ú1󲨌°Õž à å{¦\± ~£rò浟zÛ¦bª ´°c÷ž¦¶ŽTÈ]ÅWµ”•Aán¼&#n¯Bœ-8[[|›FN¸=;d·òXaÀ“À{-ö½ç]ï·Ã›bñ|øPºr~„p‰°÷„‹ 8Rfg©¦–]zr@Pl™Rk;6èG›§uØðëitÅ3¦½üòæÁ5QHÂLÑ&L'\ŠëR¸ÙsÕ´¡jæÐmtËįԗܩš9¿e)QEÚ«†}V\¹°k¼€À ‹díx<0rdwjHç$n½f ¥ååvt·eï¢Öq-y»òºÑj­äZ=ô@,m@`¤•0ãc[Œ35£º 9hÈ5B¤8Å䇌ܸ³8éæ‚UOz¼½nKïV”ªIŸ| ¹6Î d%m¬7€i#R¢±Õã·.ï8ca}º^o©» p-Q?éW-çặ`û[±1Ïí-Ì„,nøÐÊ{²2'à £½¦–ZU÷oA`šw¨=2ày‹X9¢«"œ”ò•:f׉±ÈR{$±¸ß*\uvï ] Q‘Yuj‹fLŒfLìÊ.»dø8h^N™øÎá›’eDOkñ )_\_ZùnîæûÇlöv–_¤%‹ Ex4¥êÍœÛtÃY÷ŸÜ9”@jÕ›9»Yt5åÀ›y»Út’¤FVÜVÚT6xÈÆÕÂÁSfGˆÙ‡øs&Rs ¤*×(ÓÀ¡eŽÐKsj¢žžy¶ÖýVF,³ÓmQS'X[vJºÎ›¹}JÈÖ—Íp®eŒï,üQõÈÔÁ›=v€„‰!ê%0º=Þà1_hÄ5Ä¥¡ì þœña‹F…lN"³i²0[´˜¦°´YF¨Ú E<Ûîµy ïoÎuÁ šlØúQV0Õѹ‹rP¥Õ}.é¹ø‰¥Œ#œ9Ο3>l%TÈÑ…~¶‚ ÜsjTÝïôÀ¹ä«²h…^—Hø1ôÒˆæ!–ÒÍoØÂjĨt6¼–Ó–·¿¨F8oÕ&­üPÒ¢ÄЈ²ö r¡j R&LYê¿¥hdè͕õ^3çjoNŒäqï œ1Áp5Où%XLÐÂ5b‚áišz;ŒÕ•¤#D ÇjÑ7üJßîK³Œrp@žT3vÚàÕ?ϲ¥Ò¨Ïȹ8”1%lï,[þ‹–“ŸjÊÝ)ü¦¨mpåɤÑioš8/*€åÍk®»o䧷©¢n¹kf^oðUC¢Áz†PÕ05˜Äoü__±¥¢rÒĸôÉžÚñ—QËvGmš¨‰±À©{ü¾©¤Œ† … ˆà/ûaçê¿Œ^¼T!EbÝcÿèÏ8¡nðkÅKÿ'Í“¡¦žR?hMÉúggÜ´¿|yÉÊ[4™Ê†§öÄrb|)¨±Äd±˜¨DÊj.?ü‹Ÿ[3st×ôýà ˷ÿ£©ø A RÿÊ¡+Þ–"uȽÌë°ŠaUÔbà<’7¯µñŠ%7«’ GB‘¿õe¦ZÌzHÔ4pyj͸©ƒ×ÞžawËÑ wü-A‘»Œ˜ kψ5  cþ"m}xä’ ÉʹJ„ºY¿ Ú,€¥yâ]òú¿þä=M¶ÂPâlœz‡BaÞK™øîák6;o 7 ±{H_5ŽcýÇ¥eøÓD yø±P—?;/Å/Öâ“úÃéÑ£ žð±åD&XAnC%œƒP.X8@˜Bã¢@QP&X@@ô!2£Àtjh@e&ˆ‰:‰… 4.²Pƒ1A1ÂE&ö’8#L%ŒˆŒ0ÊE& Dje”Äëµp©¡1ÁB¦QC"1QŠK?ÔÐÊE gŠÀˆ!Z*8@eFEÀ †Á „€©”‰2¸Nu \°pèÔ0˜(] Ó唂é”q&ˆ}:KD&È ¼g‘1z°w‡FR`‚W‡RN™ ¤}Uã}ï-çC#qÍ$•¹  g3i”é‰0TbTLø›0ñ_S¿©Ùxl:&f~¯d©þ›'‰¶Ó±65ÉL¹hës^m½L­…>ÿ¸`剧hc‡*±zJŒJG®Sdb¯ÚúŒí]?ëiïUOâÑ! N@eFûFî]"XÄ»½Ø!‡*¡râ*ŽˆL:øN¢K6\èÕ#*2zÄΚ}ÁÊŽ<’ 2;Òú,‡?""ûyZ“SŒ2ñ„icg„ &L.e„ &L˜\Ê„ &L|—ðµßK…u@IÊ,ˆŒ Ôqgt0Ž°¨æj7aÂÄ1Q¿ vÜн¯×ÆÏàh‹$et1ØDØEtÆ’[Þä@ºa Šan>&LÑp Ûö}¥8|aø•¤œª ;ìnÔy!$³åÒsІ/jî>&L\¸—Æ|½\Š|¨÷'Ÿç’ŽL6·@Næ¨3È èF½ßÜz&L˜8&ê—ãD¶óûÁ¥š„‘ƒâî¹ñÆÓ¤–¥z"ƘŸ&L˜8Vêwüà‹‰Î9•w¯d: s€$áäD€$ƒ©Ð NBE"7 «œ'S‡L˜0a" ð q)Nˆ(ªõ‹þ¼áóÕ M/<ù–©§M jò¤A䜊$ºgÁ¯¿[tù«cKeÆ@%ø·¼ºú½×ýª#gêON0ÅÓ´ö_w|‚sÏ+ezrôG°`÷ÆÔU<{êy“(yö¯ëN»÷õ\û±° C ‡d‡›þïùYœÿ¯h2!¢Þü§sjF¿<ÿ¼C;âk<ºö?¿yzú/ŸÉL{Ê´oÞ¾V¹üò+§ñ‡¡$²ç‰û—|ú óÎÏŒ#ò2BÀ9¡2ºÞøÑG_Ô ×Ã~CpY¬ ­ô†eÓGHJ÷¾ÿ}÷ÖݪÎ$ÏÈáçütøèa"@jXô× Ÿ¯‰*¨+{ê5ÓÎ9×.Q“Q™0ñMs)09'tó™CòDn+9aý³kkv'å']áŒgκåMøa°žC«ü²G&MÌ„Q3N^ðÁ¦Ocç—ÊÉ3÷TvŠ½ÿD–¬6O¸Gˆ(ƒRp]ã "D)dº ʼk^~zÚMwÙÁ Bç,T "0h$¸*‚* ƒƒQ'„rh @ È BBÈ`ç„P¢{ MË~D!ˆ z"x¬C”DÑAŒ¿—°ˆ(ƒ’DË9ÑbdQ²pè 'T´JLï‘«âýÒ 'DaÎAD'ükßóœþô©ç7t$Ú¯Vã, Œ@W¡œk$íìGçÏÑ)ºã‘«êŠ:{^™¡1É!1ïšåߦUÜ:óæ_;í$Ô°jã+?om¼Î…ƒß¹|eÚ©?ÿwFŠM÷íÚðÜÝ«2Çžqr‘¡›¤É„‰oZãgÉ{.Ug±­Ùªå_¢È“Ç_–Ã3æ"Yjê;)CÎ è(1Úk;¥Acää;÷…ýITïæ/^¸·¡%`É=iúÕ·ç¤Y›–Ü·zé*“sfÜ:sî´÷ͭ~¾aòŸÞ– ÆA…讧o®-»ûìYyŒ¢ñÙyûsï™yfÚŠ»~î<ùòæ%Où4gùü{ÇÙ÷îš¾<ÿÂ}öœo°±ÎÊgîܱc?I?å껋¹Ó;6<¿ú·ƒ*MuÕìË/¶Be¥þ½»×¬X­»FOøÑÃ¥ DmZ÷·ÛvUu¤Oºé¤‹.°D­zñ‰v_Ô:höŒ«‘!ƒ ¬}Ń˗/ÕS*¦^_I–õ`ÉhYúçÕK–„YféÜ{¦\NTB¨ÈjŸúñŠ-1°[ßÖ›ÑDÿ®w¾\ð/oîáϺê·Ûóìmµ%W8VÞo™û÷I£JçÄâ²Y HIµ¤X])L¡zýÒW[7]rùE²vÏüÓ¬ žz î”·ÅurÎY9E…”=~úí¯Äb²(&úœ§¿!Z˜øŸwÓ}'¿ý·Ç¬³SîH*o_BÈa<5‘2ÄèZóä†ÆÁ'\2•ªÉ§‚Ç:÷¶Tmn©ÚØZµ­µ®•P€ }Óc7³Š;.¼ï½)ÊÒ§^µ½¾jyóôÛßÿÛGíõoí®‰VüäQOƉç?ôÎÐŒ àz,¨ª,^…ókªB _CmMxö½‹/¼ñò}ï¼RÀüë_÷–ÿfÎUWØ%­êŸ?ØqÎ= O=}ІçïîzpïöO+G_ÿê%|&§{ÁâÏöKV´}pDzM®“~óþé§çnüÛuu!™Šÿ¦ç¬'?<ïŽß²íÙÚF¨Ï›Ï{æ<4ÿ¾w' éúüÝ…œ½esM¨ü´ß¿1e´¸ü±g"‚˜˜9Š®å÷,ZÔ4þæ/ºíÿ»W®ZÛ €s¦ÓÂ=?³ÂVpÖü`¢Ò¾þó^4ÿéKî}±D_øîS1Y&\ëXö\ÚOŒVÄÁ{Ý[Å_= Aóµ4ÕgÌ<Ý‘(ã`°;?‡uuT‡rfžMêþôÅ×[j«Þ..ÚeYäœs“2™0ñ s)ÏÃÎÓÆÞþñþðÏ܆?|úögzR«Þãê%+:>¿Å’ýSú`Ʊ¤a=ŽÀBÍl\r`ÓÒýíßy€S ÞòNZ1ò¤i²ì,˜~Iztů$iÝ]õÕšµìÄ[ž^”Á8(Žv±Ä!:Š&œcá=c<Ö®ˆn0_éGÈ IDATÃ}Ê”™ãìN‡Ðýiå^ÇØ+®ÎÌ°å͸µ,£±©Ý+»‡Oºä’ÀÆ×¼ý¼7¬ùv×q£cïöÚâKn+ÈLÍ8ágüäæÄ8SìÃn9:ß^8«|ˆ%ì`,¥âšßÙ:–®óïj»ÃíÃÇÏ>ËíÎ|Ò\Wxy½‰»4Ý_S¹£àŠ¿V sº‡2ûâ1m«ßWXÏeYü`B¡ˆÔ}¨”Î1¼H°åŒ:g.ÝûjSˆ®Ð¼šPh‘įšv¦ªšjI±sÏ O8À©ËaãZ0 ¿ñìŸü)×z òõß}òð•‹ž~¸%`Ð~"&Lß×/‰°XûîMbñÍ%:\å³&ìþhmL›í“uàâ†õŸÜ¾h‰vêoÍuƒ%]:!cÔ¥ÓΞ@ƒ@ÑôDíãAÀ‚µÌ’O·D«$E"ŽóN¹R[ýŸ;6¿l¤ŽºjöWÉàˆ_ìÕPÁ"ƒÇÙzbì¤Ôbp.n!°ú®™k€ë£tºªv®üôñÇ‹/úÍØÒì®ÏÚ[›Áõ¨¢#Ý) &{ÊÆS1ÂSSa€s@Jøþ/¼™Ì¸sìéZÃÒ¶EQÔn—DsÉ.I±p”9â 3T]ˆ5=wÚ?Ÿ‹Ÿ:4[q‰¦Ã"&zÄ‘ÈÕi„šdç8ÎjOi á”s93úÑRŠ6›Õîmñb´ƒá„è]þ0ÍJqpŽâ#‹¦8‡qµmû ·|ú¯·/ûÍE‚tÑ„‰ošKñhÃòër~yö9“)¢Í¶Ë©—ÉIÄ¢874FŒs0-ª+ ¢Û÷þ§K|'ÞùLŽ=¦) Dd9ÉæŸJÑK_EùTÝ«é€n(º&9,š»ðò¹]®´ìYûÜ+ןxúH’p{ŽsŸ„€Å ¡Eõ¯"Þ$‘3Ø3-Hûëw§¨œÎ js…Ö>@Æ^ø˦@ æëÞ»ç'5>£uûÂ`¨yûS?|ÿ¡}üðÕ‹Ÿú{ð; ¨a yó Û«7í`\mÙðN·cvž÷Ÿ‹ŸÿW{›Âä4«Ý!* Ò vk‰³(N,n·صA³B­~gg“!uqq mÖˆb_õòe†è`þíë<áqÑ™kÚV™÷Çu{ªy¨I•²J‡äÕþç‰fo8°ãùEÿ¦=ÖoùpFùÄßâ÷êJëªK–±N…þ=;7®×˜Þ²eyÐ>½À¿÷SŠËKë¾Ú³H4Póί·l¨‡0@#mEçˆ5ï¯ë„îݽøc>äÒ|;FÓÎhÎ쇻>^ô{kvïñµì­Yò×_ÜP~éóݪwÝ£Kž¼«fïþH ³»jùºÅK\SÏu™dÉ„‰o^–✋YSN¼íõ>EŒ'G¨Î<ãn{oÜaåçþëÚsûw4yâO¾bI8œäO¼ñÞUÏþâµ·BrÞ¬Y?¾6Í£n½cáï^1 ¦O¸î䉃 õù–üþâÑ¿ÿlB. nEçÝRøè/^󌩷Ž˜½OÓûãp UwŒ¸éßê w¼uûa)~áïR„”]7Ô}Ó»·Ow¾öäk~åäžÿ•vö9áÕÛ–ÞuŠî(wó¥lËác¯ðÌN?yíwOòÏœqõì埽{•³xRvtÉ[7ßÉRGθñ/CïŒw“‘¬ÓýqÙïOŒÎŒI×Î<¡Œ°ÃF„3¦Î¸¸fåÓ?X¥)#/?ÿúsMãøJIñàSÎ ið”_~’õÑýŸ½!¦1Û î|ep¾GS1솷í Úðìµá¨F¬9E§þþœS&ðdñ 7aâRÅ}öD:Ã’4$g´Ù²tLÌÃ+•ÉmVg¸´kûÆüÇž°j@WÅž°X¡E9ã ”ˆVP0h 8•Ñ­¸MÁA„ázÂ_ŠƒÉ ‚é0Ê¡©ìà tƒB$ô(8…,C%.~!‚‚†Ãà@¢„Ð5ˆV@‡¦€Z Š‡¡@7 Ú@ ¨* X 5 k 2D)ÑlÁJÀ9˜A8ô A†H ( ¬ƒ~` «5¦`%”%_Q±Ç_ÊH ˆ`…È À‚s"Ú@T¥ççœA‚(%¤U]ÁA¶â Hȱt &2ñ­S¿l'¦"Ó~\´G4§ä{y8!`1°ÄÁ?ah¯F{žqè}3}0jß+}C¡‡î¤=ýî„$ê‰?Õ¢‰j¬G°"$QU_y«w‰I÷n!0b0zjfJ¼/`Ôžˆz¬WkµC?dÔƒ?ìõ~/KBÈÁ:I¹8ÚGXbÊ¡JØÞ ;4Ú}>”xÚ¿fP`&úÂÌ(o„ &L.e„ &Lüÿãk×øé K¾qáçP“<»ÁÀ“vL˜0ñ­@g8~" |½ÖŒÃ¯€%'}´ˆ°ŠðÅ’;:5R¬ˆjÐ së™0aâØÄpY¾²”ÆðJ5ª’0—9&fâÌA¸k#¬Inãw×|P‹]ÝæÖ3aÂÄ1Q¿Á.œS„òï—28>®Ç’†$Ì–ÃqÉœ˜ç¶r2¯8?…ë°¨ÁÜ}&L˜8&ê793óŽÁîëþ@ÂÁ1 µf$™ߧ›Mg&LèñD+L?&L˜0qüâ›òêå p0*6 ÞëŸR0(@0žMh£OÆ™0a„ɥ ±ªâÕ÷gu´QN”œì~mDJ"E`ty¶?2rýû­gn¬dçÐZò6<ßP-€è©³«Nº%`Ž’né8ê!`19Ô(+QQ·eGžD¿o×*¶Î}†{¸*ÓcšŽD(.„¬,-ìú¿Ñ*öŠâ ˜ÝñcH•V›j »==Ö¬]{‰cXÔ*öi<ï ”T/½Þä†ì­­¥û±Ý‘² Ý âÿ‡ŠΩÒnSå°;­W©néÚKC4½ÅB²Â[¯Gªµ³Š»‡+2Ex”ŽŸg)é#tr#³á¤ûÒçCŸ>ø«C%{ö-SsÎh¨äŠjF_;Þ£¡=ì+ýÅÄ#}‹€ VFéûˆæœ[YØ·BÎa¸Z¦?xøO8@a«ý(32ì€ñFPFúvC ¶úO2ý%ûIQû¤»žõV8s 4Y,œ‡^&=Òg¼1Åš>ƒCzÓ#sô­–Ñľ³æhv?ˆšY'1A8Ô~ÎaxOz¸÷¼é*:¯ƒôŠÞÍ àÔ„¾ N™hㄼœÐK*@ˆª·H'o›4_ÓÑ|âC ±ÜC  °Ö’é+Þ?`}×çÁIç„+é§Ugôm'é»xz/$òÄäRÇ¢ñ#" 8–¥t¬Ëõ90{&ON {&ÐÔ§G@ [ã’ïÎÜ&OíÌ 8K’EK4nÙÖ>ñõ¨M8‡ëœMóOä¶Tpî¨}¦l맕(w´ùuCnÛ¸÷ÿì+ï쨲jöº±³]uŸ»»Œk*g]¨ÓΡ/Ïq”Ý ¬vt×ÄŠ¯ ªô¶ý²‘Q5û±x²u[ϹG•©¼÷îi›Ó¾øáÍYŸþ°H:«•oLõÖZõ¢ê9xSë*ž›:cM­sãÐ/sÇ4pÙ[q×a#¤úg†¯_, á,rÁš2¶ü¹ðÀnPJiAý wµgÉùŸ\6ÈyQ›±6¥»Îj Ù{Úƒ>G/aDk´îÞìŽ.F,#«gþÚïh×'#—=f2"™SÃ1‰z`ÔKëC¯¼[­¡îΑ—®µ©]õ¢uúö97K5®h(]sê¼”íÖžÞl«÷tÖÚ¢®ºÙO¶ä„Ê_˜-M]VmûhøÆOP0#RòÓy¡òªj ¶þŠ=ãFT¼t):ÓÒª>ûw® ¿ËîòŒX*ªOþU8¼bèž"¿¯|ýi¼æ%×°×·;þ=m½¾úÒ_i @óð_œù~‹mëÕO;t0ê+ÿÙþáS0i_œ91rŪó/cDßgã–¾¿ãüG¢ñ<„¸ö=2²ª»ÍtûZ­ª»aæÃ͹|ð‚3=ùW¨­kÚæüÓß½`èæE"•)³wŒ¹½®¤D€^]ðåm­Õ65½nö?›ò”!/Ÿjÿa£h!á/K—<šêmiEõœ¼i­#Ÿ=+vÚêöö{†4ÑùsÃñH3V”¯K†H¹³mÜ/ Ê ÖqW¶ßˆ¹J}Bï¿wXÔ³ûoÙ]Ûd%,¿soÅÐ!ï\öJC~>=ãÓ¹åÆ­«NŸ4ºgð¦ÿ˜¥b¡w߉?Ï{ûtaú/¥hÛ²¡{vˆü¾ákçï:¸põÃiQ¦G ®®šp¶†]£_½ÎÈŸfëÆ -©Öv¥³ê¯#êÑäìL卑E¬õ³Ÿlζ‹M¯\ùŠ,gG2OVýoh߬-l2©ïŒÆ/±â,þ}ö@;åœêZòŒÒ‘•`„K‡¿Y`Õ”xIrô)ºÃ­Û¢™… ¶JnMôÍeë>ì˜òøæs_Þ>ivÎúG]ÌÊ4-¹nÛy/Ôåëe»|õ³ß|ίHýóYa€ˆºÕMôÜê3žÚ2çòÔ=ï©%·Tžû|“§3¯½™SÙ{®+›.[²KjooŸö·Ê¼UgßœW] "·N½…ŸßíÈýõæóßÚ2ëû¾WœQ&êžÆÿµiþ‚gÿÖRõ¯kŸñgŸcÈž3žjs0P›.YÚXÕi/l>諒%|èò§$bÕ-n©ÃÛ:ýï•óÞh°¬ËÝßG“C˜¡ä^²õ‚›æ¿QëªV¹B `ÝrÉýæ½¼sü8‡7Ì ÀE]°)³vœóì® cíØÜ1ù/[æþ-]–ëÓ ÑªK&9ÄÎVßø+ç½Y•ÝZPù%ˆdÈnƒ¶½øÔ¦y¯m>í×ÁgdŸÑ“£úÝžÉç€H†hÕÓÎØrÞCAD”¼Ë¶ž¿`Óü7j{‡UîÕóæ4äy¿Ù;írÅâ4Q-œã×—çuÐño·4µ3%Ëþ úí–¹ ¶œv‡¼÷/€2©kÒÍÿ›éÝ­õ£Xñ1Q8¨¾`¢]èêêžô—Êy v a%+ŸˆM·¥©êÜÛl{‡®þO×äÇ7Ÿûʶ©gfmø‡K'œ©³><ò[æ½µ7ÏW¸y¨dÈn] ÄÒÚÐ1õ±M?xk¿g{ɦ÷É°¤0Nƒ“þÐìÚ&>^—ãòù?#Þrî«Û¦ž“¹é)»ÁíÍÿÉÒ§l™ûrå¬ë¡*ì0]aÎvœýÒÖY?sìúgªæi9=«~;D÷äuØk'ω³˜mØþñ?àÖSvœuÐ%2Ùm y‡eŸÒ˜Whäýf÷´³sVý.Ýuý–ól<÷áhË#ùu €Ì *¹—n™{OPà†hÀD‡ØÙsoå¼×÷ä ·|Ò>ø‹'ÙÈÇ6\ðRõ9­ºdæ”ø.q)ÎÁ9¸Õ[ñ³}³ŸÜQÚZ¼þ1©3ÛÆ{dá7ÖÌüËÖѶâ÷[9’Füç:8=\/Ò½È. ñgfJÆè˜xÀÔ {~ЕÆ )=š?Q¥€œ® Š¬&4¢ÑÌ ŒƒÛKGVę͞*ų? p\ÑÔü9QàBÄí¦ª/qˆU§¥ÎÁ£%FÚÜg=´ÐhÖ ´­7OyéÔioÝœ¦Z©®'´=¼GwCD¹{…‘5>b·r°h‹®I‰\SòOI—#nU½ç†K]ß0úís¦½4»|ÿN)€ÖáŠroÉ(p÷´¶tÆ?$ØBi%0Àl±ŒòˆL@¬š,XTƒ÷âyzöŒ ‚!êN#jGb%)¾ô¼Œ/~Y¸{•, kª8G#FÜ– Á0{0s´!ÊLöèÚºÑoŸ=í¥ÙåöˆA?zÞì¹)²iÈ¥Y»6CBú¶Åzþå1m]z$µ£l ƒaØFø2IŠ¿ƒàqœ^Ÿ§¤Õozª«ºó¦ò>ECϙ᳋0.ÍcÛí Àu%wNÌFà[ìËü™Ù TõŒŠJõéÃгNö¦¦€ZCiP;Á{tqLSóÎ ¸- Ž®!£ÅÐ.I?¤-+!á[šÂ »ò‹9çjÚ؈X›6dÿöXÎhU ç·ge÷ß<\tûsÇ‚¨¥ ;ºSJ ïT4.r0H•V×9-)½í2ø€7j=×~±šôk>à ¤¢ŽÒBg×n€p)51Ì¥C?憖uBÀ!‚!æö¥“DªSTOgñp¨9?hK379Èwê^*˜µãRtc[š @IÍê:]H†×G'n)â;“»kžu9ÏmÊË §äcŸ¤#–,§+ëÐ(kW Rs:wJh¤Ê†&ÄÂâYúaÔàœbÀ„0m\èñ&„ážœ÷¹qè„ÄTÊ);X½èÕÃß»Yñ÷M³§ê¤qÄ;¿X¦Õ£œJ‰ú©…A¥¬ïWúkË‹Cw6ì=õU_š;eíM£|×C =ÒÆ!Éã_49iâœÐ„m{×ôG¶e¾•S÷zEåƒzÞ•»fÌï3 LØš^º«eïœ×|©îÔ57Œð–Ó@רÓË–¿n X [¤¶óÆA¯¡ˆä¯¸!›2pp:ÈkI„µ!ñU\XP¹V´3S¾+çpCÄC—@Ô¡ѸD"ÊH| О5@e O=9\³MÀ™ÅÖÃwmà:é¯`QQmüÙ „2i0'Lá¢ÐÄ/ xÜ ‚PN rŽÔQ]ŽGJt5+»Ë¯e<~¥tŒ{Y#‚‘±êF·À ç\ð§sPÊ_ÕœSÚ÷"M¸d$Þ’ Y&ÜdSß%.EeÝ^þé=Ú¬"lÏàµk¢ÅSÅ$1Ÿ Ü‚M­ƒªµúš#‡qoÑŠ?ê³îôY: ×|¢gý"$÷ÜÍÿÊʳGîzµ¡äM €R9ì“{}'<ßì§ÇJ¢”bŽ Cru¦ŽôÀé×åh” åÈïsnɉ‘°Ëg E÷æ¯}Í_“¢çUœªË€ïóÔ¨ÔBznºd…ƒ3Ý5\ªë(H QäƒÂV8ùW)q%ÿæhÑ|_J*x0-Ð B!¹TAuux$Ð`ŠWáY¤_'ÿ?ee±v„‚C. –^uë˜?Ë9/ €ˆ}j"›£Å—ùÜ©àþ4¨Ðà ÄCȾ¬Sº:§ò}›{~s  Ž1£kÚSõž¸¿DÔN£5 i õô0»§pݽø±ˆwé;”›Qên ñÉñ×S’¡È=ç î«+ïJ*`#ÐBrÔÞáɑ̓8¡rLj0 øê¸8AïeM—à!ÎQQáËú™OuÙ¥†Ê)Åšm „@Ê]¾Pÿ#†&Fƒ 0UŒ ^»bo*=eë“FŠÒ\ZSnc€ °dÄgãŸØ;HXˆÀ ²*Aú¶†K™ ñÚ£€àu©]ªßtŽünÝKY;§þ­ª(VöÉ¥?Š’?îš<•'ÑI„x‹]8éý_;E‡gÃuß¾.+ŠPù-»F,»fâÇ¿·y~²eö9œñ$1[ä0àÿDY8éý_ìú8{ÛããÞø¹-ãò¶\\s›Ò[Š¶¾m÷UåW>-å\Úe=ÚdõΪޛHs©P‰Uz¼mb 2·qM$ œSièåžU·d5lËYukA³W͘¼9»ÖÚZŽX¹#è ¸ºëµë¬ÙÓ¼Ö¦ÆÏõššq^(øAéÞ ¶ÎõC6-ŠTÜ–4r°fÒŸä@KokX‘Ú} cÇórLãµV5½%¯Ì³ú·­{2×Þ›ÁdNøWrà#<ä—ë´æ'9¼5©û>°‹e!— [ìBçÒo'8x¼uZÊx[ýŠ”îÛ_”Tþ5Ö°®YB秮®Fzð+<«£,kжÅþŠ³äñûFæç~ù§To«öµqï^Ÿˆj–œÕ•áÔìl¬(‡q%Yô£a›¾°unºi}lð51Q8‰«"s3»Š¶¼i÷Uçmû§œ9¿ÓÂû7ð± øBéö­¶¶%Ã6”œÇ¨qð‘*Ž–%~Rm¡Q¸þY§¿Ö³û¯“Þÿ£Í`‘ŒÓPólA]¥»úµÜ®Ú—uçVý;¥«.}ïK.if‡CƒVzEwt¡]vÚú±ÞOœ4‹]èüÔí“êFŒJ_y[fë~GóGïü °¡¥ß¢å-iFl£š³Ý9«qy÷æþ€C²™’Ô7t¢¾û¾Ú5†7jPˆx­‘ÂÓšÆ_Ó0îÒŽ¼RvÜGjåÁ¬<<¶  pxÇþOÃø«Ç\Ñ8öêú‰—…&ÆrOlwuø¶4Ø·åûÕgyÜ4 K±Ïß{ÛpÁÕ]:7"t9½5VMòVÜV5n:gL B»Wg4m¥®YUÏÕ‰.êb({„!¢G™£,àv† òpîä¨Ä¨U2§„¸&–@öHƒrªG çÐ`JaÐcO¯ùØÓ­¶ 9]·æúrŠˆfîþT'8ˆä®1ÁÔ4AQ£Y“ƒ%gû,éõkeË 5ÓnŠYÓºò‹lÍËÒbó´_t¦±ôæ¶`á´°“¥6VòÌa1[‰?s°7o¸½iIz[m¬èÚ½£FÃ`D²”Qþ8ˆdî1¡”´ƒtGwŒˆÐú̺Õ4eví¸¹<¶Ë¡d´¾ Š:OÃ’yÉ"l᧠hÑìIŠE \¡B¦ß“pª©JƸ°¤)ÏïÉ"F –¿'#¡.³ ÷gæP%ªäžÖ0d’ØñEFÓ›1¨~Úo}AñÓð»*û3Š¨ªE²')AwŒˆÒÚ̺µ$õÔº±ç"ºË¦et”M&‘ÝŽ‰¸óbãƒN 8tG>eYÃNÐ(#jÁܭͬýÂZ'ÜÚ•ž ® ÌÌÆ‘zW¥ËóªËK>=»×¥Ó™û3Zòj6kù—UM81ƒªQ5cbÐi‚E§Â·&³q‹à8©zâù:%„)sýéÙà z˜Z‡ú²ò¨Q3'E¤¨Rv?²8¯nxèM†ãÌT5š39*KÑô\GûVÉ1¦uÄ…zdsfÃz›‘[;õú°ÕÂÅþT)µaµÔÂ-žì‚C,ƒë³·IÛ÷¡ÃÈ©|UT¶€²ÍVý*ò‡Ž gßÕ„l_n ”X,{rDÒŒ”Š€Ë®¤‘Èg?érûÓ,Kñ…½£~ÑTTn‹dW%J˜BÄ,z.a ä¼xg¡‡©µÜŸ™*>I‹íÌhªŠ¿5Ôõ>Éžp»¿“6~ƒœ8«yŽãCFøZšˆŽyK°89c¢_Z†?MÄW’>&úÎKñ‹µø¤~ Cça>F¯ôûùÊôñ¶Ao/“ƒ~6} Aø ïëÿÏ{Tº7ñ^þa>L½[Òûûr¨ÂÞ_á}þ }ÞßÓ }ë9èutX3ØA;ÉÞN<ØŸé°‘cèfïߢ·ó`²V¥Ç,]+‡¯|©ùÔ§ÚS]‡i+žQ—³á”yE¢>ó8@µGë#ô¾hÜz¯7>cž¨¿×*:ÜCíJßþ‡aû 7οS9L„=ä>Õë‡G^ôkÞ¡ê,Õ2–]=H¸hçÔ3Å–§G­^S}Ö+Ý.á;È£8¦fã±é˜˜ù½º—2q<ª1û+Hú1'ôãU=·Ü®ô IDAT=…½ P¯Â#}¥·¸Iú¾ÖŸ÷ô©³_ÃøWöå°VöÅc¬¶=| ÷I¿®ñ~LôH=âÿ_Ý$üjÀwĺû&¬ÛÑ:ñOí)®þj\p¨q{Þk꿪ڣõ±ÏûäèãÖ{=}Åò8\çʲ×ÿ¸¤säιw*8Ìý–ô©Ûðö~t¨†~a\ê<ñn׊{Æ¿ùìÃëf>ÞíŽrÉ„É¥L˜01ÐaØ€^vÏêrÀè‘-úŠ‘â«*K=¹ˆ,Úf¾×FíèÿOtq%ù§¿|€$´ ¬ “K™0aâ˜Ää¸ÚŠõYzÓ\ÖOÐL–~€ñm4>þ9} ÑÖDòr)dÙPäJ¾ó2m 2Üp&3+W$Šìäœ&L|+Ô/×ñ¸¡_¯õ„ÁÑE’ÚkÚXExcI~`âH³ ¢Caæî3aÂÄ1A¦Ð²ìßYŠslmFc )ç©Ôƒq¹x7¤dNhlp\4ë›Ðè7·ž &Ž YL-8^óµ+³ %Ÿ8Ây"õ®Î@“Y–Ò8cI9 &L˜ø©ßqjN‰ &L˜8nar)&L˜0ñ½çRœƒPmÛÙP¹¬¶rug»ô°ØYǹÌAÀBõM;Vu‡XŸŽ+ޚƻ’(_8眴g8礃¿í… ~SÍŒPŠ{ËðÃ×4@Eà+Ãüq"@ Çõ°š0ar)ŠÐöWÿãÞÚº÷¼½ìџ’¤¹ðá„XóŠOßöÙ“·ìmÐz¥ƒ ܈ìyó¦OþùlDHSoB¨Lܲym5§¡„t}°ô釽 !G¿¿âDù(úki·@¢›žXüò]&ßÄ5!mZ÷èmµ­Úáß#„«Uk^ø»?l5²”ªuÜ»ìËFQ2¯M˜8ž¹ Ø°Âyþ£§\xí„«þ:½¨¥ví*=yˆ:(Z×¾™Þ¯Ù-H„Úæ "{Ÿjê²[ÝöäšxB©Ûàí Šÿ¬4´îÛ©²#0¥¾\›ÇZV<ó—PL'=Bç‹ ‡É%ýEº¯üM¿"û·å@3'GùZ/çXKz9=Ô0WþäÓSfà vÖìQu>Ððcß3¯üýsb‘S†žT\èæ uß$A&LßÃ*#®1×??΀ÎÁƒÍ>ÝV’ŸLwbŒÍ}Âbokì­É¡ Á5«ÿ½aè…Wny{Cr.€^ü^2­»mçš@0&¸Šk•„h˦¦õœ“ò‹2;6¼ÓY»»fÕÇ…'žç±ÄžéÝ{W‡RFZÛ×tu«¶üñƒ†‹<Ô²i5ÍÈó×5åœpzŠŒhÓÖ¦ý5*·§•ÍÈÉsr j×®•]~1íÿ±wÞarGÿÿvOØ.g]Ö)œrD’H"ƒ&ý0Øû50Œ16lclãÆä,‚‰" $¡„„Â)ÇS¸¤ËqwoÃÌt÷ï½;X¼¯ZèÏ£‡ç˜Ýéé™Þ©êª®®˜3x˜M!‘ÖmËÛ:‚Š{@î1vðîýû÷ÕRO¾ß`=ýUÚ»ª¡¦Ž)I©ƒ§¤&ÛÀºê7np¦g´íÛf)žô!““¼Nm®ßúyw”»rÇåägÖ]ß°}m(*™#”Ñ“i‡Pª\Öl *šA,jØ´>iÈ0Eµ¢°ŽË›[„š”6pbrêAù¢®Ýõ;¶ÆL¡§PVF¢Í{?[iu´ï^£{…!@U÷­j¬©³ˆ;©hbF®Ÿ²`}Åç¶ì®} áL<9%É#df8‰ä°¥ƒiu¬ÿóÙoüæÇ­Cÿ4õ´Á$aö™ !Qgì`çS`ãó%g>Tš£%謘€Šž}™fs÷+?Y¿nîõt®{|î¿?aÁeKž}8Èœ6%¸é¥Û¶U·ë.;³4gr†F{uR³qÙsKž¼£.œž’jlyææë[µsû+w/ÿøݨ B«|óã‡ïoŠ¸ucËò\¿­–«v´|tó²9˸F›޽䃹–‚úwo\¾à3Åå l|báì÷-£ñó¥Oü¹Ãr*Á ë+¶S¢"üùƒ?þÏ M¢í ?}äŽý ¤yË‹w,_ô™=³”4}²pÖ{"Û^úÙŽÝ-Ttlyé–M{š‰Ñ\ñÌMÛ÷í«òÍ;–­iPÔÞú»„ÒÖ9K_x<€Àj_¶êùhÚôòèXpÇ‚YoYöTÒñéâGÛØÚ÷ó¥Z“uÍ¢a#4.¦‹Ú³÷UîÌÑë)Ð2ÇÜðŒæpƒpGצOVlÆä³}ii$88»tpçJ !VÛ¦ ÝçÍ?=Ù"§¸;f®]µ ¬dQ·³%ù´ÿ¹Ëç¤-‹¨¯G|Ø„€q÷*nÒÚ§YB"9Œc5ñ×’‹†Ž¬îGË|¼ëã‡æÌnÈô=G¢ä'„h˺÷w¬X2yÇÖw.[Ði¨IeSóGLÍ1u@Ù@ª¥eí²“D[ ý"Üâ¡‹P²Ov…÷u4u !Â{CFAºñéž­uº7'cô%ƒGi©n!”@Xœ³ƒnWQÃ;–…L‚ÖÍ»¾<­_!S¢º““ÒÑÔìòɹå“Ó’mª;KK›¦45îjå‚DçÎùÇ?ÂÞ)©j€úËs˧d— u$ezlГjª ‹ £½¶º×€ 7Xy9Ã&ç˜ä·ÛÝɇŠxaª™ÓÔö½Î°àÑÚ~4{ƒ#÷DÕâÉÅr‡MÉÌÍPüÅN퀊jæÙibçŽÙsÔ1ק8z-"ßÐ G`ÿ–ýœ€[í-Û[Ó32û®ÃÍjKÒu•G[ë÷®·L“÷—1ÎyÏrd¤ùõºŠ] €0×îð¦—jŠAÉñaK AÓ¦Ývfú¢šÊ½’1ú'O ΃™@ÁL,ÒRÛiÚ Ï½A˜-æN;P~žÁÃO÷ÙÄ—°ŽÛ[Š-³_<ˆ0ÌHXp÷”q3V¼~g]ZR¸µ1ë¬Û2ì»?}ý¾Ê•…6 Iù¥Do÷bËòçîôÿþX’ÜSw‚Ú|^ùƒªjª/ó£ÓUÒlEƒñ {ÑŒk_|xîã¹NÕ¶tæŸ÷‡”Œ¿ÙÒoY´:+ÖÞ6íNÝ3|ÜEg|þæÏšÓ³X°ÙòŸ8õ²¼äAe-¹gÞ“Û}n—.±pÄ"î‘WÜ°ôÕ_ÎßU¨‹`(¨ »ì>Ÿ‹›‘îÞÎXf8@|ÓG[°ö…;Ü^5Pʯ,ÒÓŠ†ä¯\þì.¯3Ü\çysFÞ(ôny"PR2X‹g‡§<2œáV$h’‚ñW_ûé›w.¬,&á:#å’Ée@“ &lù—ù»þ°ü…F»Ã“œ1Á±åå•s +¨Ì}êÓ×÷ÙƒQ3‰ â)¿èGí/ýn~c‰n5Œ“'NŸª ÚŠ„z™`f4,~É¡fÂ×:÷·8æïAmWÜùr°üâx–éB $c³1k#t*í=‰/ÊBÈàqØ׎,ŽË˱ª5]‡N ¬pWÜZŸ›’E¢QKwz(à¦éfœŦ۔‚EC¦i ª9u› šWIqƒ€Ðȶ'®Û™wÿù§¦E£Õ\ºÝFÀŒî µùT•Ä¬¹ÑmÄb=íØm$.#!‹1¢Øt»‹RÁ¬HÐbœUu¸U…Bft›†ªkLS±¹‚ÅB¦a PEwi6€Ý!Åî¥ 7HLsº 7ŒH7 šS·Ù`1#æDÑu‡‹’þ!/Ì ›1®»=”`F(D^UV$dY– ªfw©ª"„i„£šÃMH\å[Pìº]·ÂAN6»b„C‚¨ §N›MA¿«v·¦©ˆ?»OUˆà–‰¨N7•A~’oZúe¸1yÒ¾ •;úûÌŽâÐqìñ;t>ð!I0é¢:“úÅaïÝD¨¦»ü}h÷(öƒŠêðòëœqA4§—hÎëk'þt¨î²ë®ƒ¯¢9}ÚAÏ[Ñœ~íà!PlnÅÖ×hï™6OßÁÞËùzþ¤šÍ¥ÅÙÜúÁ´Ùܶ/`Ew)z¿6ݾÞ[öªÖ{ @µ{ÕÞ磻{¬ÍtÈ/éHî}>TÕ])"%’oFKI¾ó/-{ú®´þ›Ê$‰Dj)Éñ¡¥¸êt’àL$œY)‘H¾»ZŠ p„«*/г†s°D–¸ñ…ùc4 }9å®T‰$‘áâ8z‰¿Þè .PÕ‰°‘ãä³#Ý…­‰]«— LEc¡˜|õ$ÉQáÔê‚×ö°¥˜@C ]‰©¥rT$ TÅ &¸–*h5Ñ,µ”D"9:’ ãxÑR_¯-¶pæ,­IÀQ¸  ŽGÙs€žÈ?7†ÍßÇM+ðiµ|õ$ÉQ1,ÏNŸôï€-À¡Z&~°+ Ð\KY $aGA"‘|ÒÏ¥GŽU†$qØb\<8!¡FîËn§ï¸D"‘HÈ–ê…@¶æUþ–j…¸Âi;ÓÒÀG¦ JH÷ÎôºáÜs‚N´{_r}…nq€@XfÊ™-™þÄo‹kS•d]1€ÿ×sV €@Øò-ÇãÓ ¤çU°ë{P`õ~íÑl¼µø–,q(‘Ÿ¶…mï“#>yÔmi¯4ÿÇö‡'xN€­unù‚;‹?{ ½ÓŠK[­}Yñ–Õ ´§HCIB ’äÅWŒ}ë²±o^2öKF¿w[v}+òß6 ÌæÂO~íD¾9% (@¿ÀØ%¼:Á5cæüÎÑ]Y0ïª1óþbñžhMé»×¤w_Q»cÝÀ÷/µb‰®*{wæÈU ¢Ñ3{”v¹DrLm)LÙ¿9p£{Š’ \î:¥`ÏÊÚìÓäE$ ðVÍmœ|Ÿ5ÿÆ>aBͨðM©zx¯xá‰3S&ЂUFúûÊ n8f—̽@?{QU†vÀ<Üú‰Ûä?éWŸ^Xö@rĺIG°®DÇÞ§3kêŒÔ!&ç±Ô‰!—fmÉ'·ù¬ìöìR÷ö?ŒX³;³É 9¦wøýPò:²†Y}îhÒ–Uñ¤'NÚþ\éªGHÒ©ÍÙ®ËîOê°h˼áó~粕w$‘ü…?(¬‹Éå]nÙJÚL ¸UæÜ–9À³öºA›+ÂYŒÈÜ¡Kÿ¥Y‚µ%‹îöˆìù‹oÌîäáä"¢ä´åŸ`P) $’cÇÏWwòómŸ­¸¡ÔñZei^‚ÈtrÄ5nóX<Ø:îU´ºpÉ=c>QVŸzŽH¤AB6:;« L[Ó{Eí®º3&u ‚˜ÿ²šacÐñVn[ÎÖ™WwÛÑeŸû²kÄ8×Þylȯª Æ€?£uµdïøÄùϪÁÙ ã·t,*Û:·ÞkÏk0êfÞÐéC—ßžZó'BT{Û{~ûy«G)(¶±M“V<©—Ý#ˆ ÷ëJ‚¬Íú{VG5" ÷Eª.¸±ÍΤ”œ:Fº?Ðèß1óú€.6fÎËžÑSƒq .bi{æ±ò_W*…CØ3¶`Dêp(áž‚˜á)Ú5½þ½$픵ÃÏb ‚ãvOšûOïøgÃ.?”ÔPz¡ºß 5-””&¬þN8 @a¤\Ñ’;üÒfÏkÎp[{’³Ï«™Rõ‘R|Oå°± S6^;«ú¢ëÃvMˆì`z±© ݶ­£·T7žýbkUêþàšäÐ5Ñ|öSÖ ;‹SnÝŠ¾<¦²PJ1O¤ÃO"µÔ1‘‡–j®ÓWl&o&kÇn~U/º3g‹„†J®_?0Z°}úù“æ½å‰ÐGG;›ä² €2=c÷©Ï´¦Äƒì¹‘”X«[-¹kÿ̈¬QïÞä$ÚÚí¸«yÜ-0š!4?_¼D%D#AC·vhA·N3¢@45êRE m¡aZòÙŸˆ0¶ÑîVwÜH΋Ô E‡nÐÕ¬˜ ‚¹ÇÔ”ƒÔýFgÙI'\°V{÷6A_Ü4mÑöPž ஦ñ·@D³Ž`£‹>Q¯7Yž“D¼B˜;Û" ®0"½O$þïÈzApß.•ô7¬ÓcõÍ.^ºá.¥{½Ý<øaƒ ´ÍA4ï·J*„åën"¡hWd‹å: 8 ”^Ð9úLE©¢$RK£ëðμU·Ø>½½(€ê´H$LˆŸ! @|}…P€sïÎgÝîsë33(]õ„&[ U œ@ ø•#Æ ~S@ü(…—eÏn+:Û  Í•˜ƒ§JûŠs€P-œ}ZS²ƒ !ÈŒz[¦Éf&é *a„q@€: _Isñtrfó=¬i8(ZC€Ú…0(ïwLqZzF[ÑÙ1j¤eà£NÑ«wˆ Téߟ¾!ëù˜¦¯ì‰/) “Bû*Ù„Å!í÷=J[$ýĦœ*„ §7*î…ë³;‡£³àÜ.Ý Í%3 *©µnö„bÈ°>‰ä0Ž•-£¦4M÷,ÿŸÒŠ笹Ć`Ë KÍD1¤û·ÏÊÞ4ÛaZž}¯ål|ÛeÂÔµÜOo/ÞøfÖú‡F­ÙÕ6êÖ°–`ÄTÒ£w7µü§FD;·2†‡\N; Mû }UëÆ`í.}aQ½ÚåMuDwÚ°@úC´*Âߨnì÷¶v@p[ç o7‚þɈb¾AŒáaÍÒy;B܃ojHÔúš› gÎÚç†ú:¼§†Ñ}@ }xÈãU¸ÝP{%:Ñ»½ù¾ªõ ã°*ξ°°.fèšlbU©m1N @8ap˜)'Ѷ­öh°œµë©}|§ëÿn±¨Ý¾R{0IH/‘M$ zˆ"cpOì°uج¤`ú°@r.˜a)°’¦(m[Ñx{ö²Ÿ–o«fŠU¸%•–Dr,m))½q£o‚¯}?ŸÊÓÜ™––@qÛD¨Î}µS~KxŒZš $’wåÆS‡øÚê)†ì9åÊŽôÌÄڳ̬æðB1 ã`›°¯|eáòŸæè.‹D ®ëÈ*h/ûaó²?ŒüèCÆC"åÒí9)Fòžåœó¼E˜Â½ F´±»Çœ6xŵ>ONÌg:8å–™|FmúÆAŸÜÀT]‰!w¶?5C=×" VP±¢PÆížtÑÀµ7'éN…ÙÆþZز÷Ž:±è³Ÿfê Ç\Õ•YÄãš…hmƒ®ñ-{`äGï1)—Weû˜vº±øÃç‰z L¯â4¢¶@NÞÐ5· ÇûóN«Ê[]ºèf¦QÍtîú°±°jDA@XX5ÉËË#H„ FPé ã¤fè QºJ®n^ùçásæX QL¥utY±‚ªi VP1BòöL»qàš[‡ïH‚eþ©»S‡Çü3ª³W úäFK±mØ®q9Üꈚ–Ïk¬™ö×6§”Q’ï:_{¶Ù çc^moèËvÕVÆå%¸,Jgš8ª‚ãóŽ,l½·¯ÂÇ5‡íâ& €ÒÃl( ¤7—àŒ€ApF„ ¨zÈ¥'î\p"Q¢€BÎâ^SÑã8eŠˆÔõõçÀEã_#‡uý ú®NU@„èõé)œ€ J!áTGè‰7.¨aAUò2KPÂ"D=÷Ûïõ=7Á{T¡=ä&"(=ð‡÷¶ß‰½Oñþ ªÉu)É7"ý&fàŸ“16í;eK.»+SÃñkÇôˆ‘ä ã„‚ÐCa¨úŸŽô*€Þ+0I•ƒ•bÿû®{øEp䋯NˆÖ{¤÷,¢EùÂn¥wK=l¹”E‹Ûm∨ï`ÿKôÞ‘8äB@{z‡ŸxàZÉw¹#C"‘H$RKI$‰D"µ”D"‘H¾M|íëRa HÌŠòa \F‚ïbaàÝf¢Ž‚D"9ö„LðãFî}½1~Œcø8ºÛ¯„S…[Cc8q Œ !áDÐ@„ÉWO"‘6È<>6B|í¶T ŒÎhBŽSš /jÛ¡$²[Td8ÐÚŽˆ|õ$ÉQáµa€ïxéÌ׫¥PÝ…Ú®„§Òdd¸°© š’À¿6ÆQžŽêNÔtÉWO"‘.dy¾Z ‰ÿK4§YOu:BÛãÇI‚D"ùF¤ßq%+豿ªA³B$RÆ;!#éÔÑ IDAT(:44]æ•H$’o¥–‚*ÆÞ×ïxí¾Ç¢:Iœ©½ <\½æ_WͺåŒwžxª+ÂHB)Ù#Þ¢@µAµAÕAi‚;h¬„Õ¡P| îF"‘Ã*ˆBBbµ+¶m\ai‰dGÅÜñÊ î«Ï¸mÜþù÷-x+ý‚«fÒ~ÅOCÂ"5ÛßýËŽÍ»-. øóN¹uüÉ´ž”‹_Õ9pÜ< B4½mÉ-§D/\|Ú”$.#%iK½4£J´rþË™åëX´s_ʘs.IJ/rÖêŽ÷£‰\¢Ž€hhz÷æ=¡1§ÞùÆÅ÷¿}î®îøèWë¶uÇSÅ*:t't¥ÇÛ©ÙãÙb(t; Õ iPPTD±AwB·ÇÓ½ Š ºº”TÐDTëýH‹·ÅM…BAmPÔøOª ºZ¼Y€(Ð4P­÷Z=g€ê=G(Dµ{TMSíÐP5H­D"m©ÿ¨£ÑYqwe÷ô“Ú·nŒ%–)Å?‹9ò.êJq;Zë[̼ã‰:ðDa]Õ;Q£ýÉ0¨ùgœùÇéB±q*š7>ýËÍwqGQùÅ÷S$‚+ßûó{'Üø@’‹F·ÎzóÝÎóyö¯·ØOI­øsdìoO<©xÃã·oÞ¼[Ë9}Êu÷d'nÔ¯{úÎm;ª•äqxo~¶§ÇÚ‚ Z=çÁåó–*iSÆ4V­/½ø¾«6þñʦ yb*'ØýÏóZËÿ:nR) ìXõü¯÷T·ÚrNzÍíé>[ÛÚç>¯Éd}´réF%{Æ´[îͲ´kû wT¬ÙBÒ§Nºî%¹k]³àž¿Öµ˜¹§Ý=iÆTUH$Ò–úAOHÛÒï4üÁ÷ÄJ4»,Ü)—ÒSªW×(‹ÆDB =n*¹§œZ¿ø·Ÿ}ø~þ]íКB©ÛùØ¥Û‚SÏy`ñ׿ïßwì­ÌŠE{Ì!fš1¡hÿôYýÌ'&>i"[õÄÝm1„6m]R|ÕK3oº±}áã A©¢$©¥¾TгÎMﾕyõ¿†æAµéšî% ㈡ºÂŒ×T‚`\PUMh±'„ϸ{κö&wdýúWïþø¡Ìö‰6J×ç[v)eÿÀïԜŕ@]mÕ‘o•ȼrÔø|{dÝæ]Ú  .õ{“rÏüÓô‹¾gëøxËÞ¤‘—_šœbÏžò³Ͼý­ÁžzÀÁº%¶1äezí9' +/;rˆÑÑôîž®ÁcÎ;ÅëwŸvcR×ò† Â¤¹žjÄ”¼Ay¼­Ò mß¼-6ð’kS}¾ÌSî?íª«Ä„à飯—ìÊŸ‘—aD£rK³D’¨#ŸÕU׸seÃú³w<Õsäß¿¬=ãƇR¼Ç^N”Ôr5¶"…ÛAx´3qHÑxb/v@õ—žä+9iØB„6/ýÓ-Kþ=ì¢ó;£ÄãqC@@õxÃá/ÈÂ…ž’LD¸9F·²Ò²²‹P¨Ä XÁ 3ÙÄÐ{«Ü²X?„ ŽT]BÝ pi«iô»2ìJʘ_ÏÎ÷Æ(£šƒõÕ%´ùb1B¥wvhª·Î­fœzó\¾ÁSïz*ÕnB8Š®š»›ßF"Á h2„ˆµïÝëÎO—/¶Dò­á˜­K)šÃcszt§Ó¦s#Æ5'! ²cŠ!DêˆËÔ¾ð®¼jÅòڱ߻T‰¼2ETÒ²ä _ø{]UM¸£¡a嬥˪2&Ÿ®ûÆ -5w¾ûZÐDdß쭛ŀü|¡¥Ùº«:»™¦÷m\d0Òß$¾‰C c;ß}µ3hXtßâ×fEü3†ä·ï\ô SìVËç+^x¤+bõXR®Ü)‘µïÕ5w…«—mÞº‹€¢û}¤sËjˉð¦¶7‚Â$içúöT®© š-¼ïãų^ŽiN ÜC†”j»Þ|²µ+Ô²âÁÏ=bª|±%iK}5‘x@¦0¡ ¾ûº@D…@¢¨)gÁ¹3~un\Ç]‘¯:o`Ô¥Ôl!=:@ÄM)­}'õÍÜ7ô¦ÉêÁ Èšíkí°ƒj×ÎÔý{t¬ÿw¾èx } Szä^I$’¯“c¶.ÅU‹ ­Ù[½Ðf*1ÿÐ@rZÙR$´MQ³L€€æ‹éoÈhvê߆*€@€û[l«j:œUO—nZL›ÂcîÚŸ•’¾æ®üý-†#=ädTd måÿ”ຕ'ŽÌXt}èZÝ=â7û;ÊVͲÁI˜(½qïà‰\DR6?”·o'%wMÚuâ÷“VÞïiðë«Nùs§ €Ð”ì®$‘–ò¥|û„«•úçK+æ)ª“Z¢kà{µ×=W¾y[mQ}gïœp #4T0û¼ô´kZÙFW ÊÎï8åÞ “:«Ÿ-Ùø Uì s4¾«.Û–·æq{À9|ÞÎÖ WAó ÏN?ъѯ]¯øûêS¦"ºrô›­:õ—Iû ʃcRå‰7‡œ5CŸ?O-¸PiïÜ}Þßút–­æ±Q+VUÍxª1Õ.—'%’o‘–SYÄÞða’} l)Zù¯¦IWf'Ê{NY $IÄ:¡ðoÃð Åøn0£#kÍkÔurȘëK>¿uê3û3Síû_¶ú¥öSFäÕ„wþL—‹¥n¸7«^àªÓ‚fóhu¡šsŸëÖ÷|ã(nÃà2Ú½aЂ‡ü¹Ã»Ä§ùU]§>Ùm‹d­y(»>¶oü-YË6m>ë6†žu##kÆî’·GWŸ¸eÚ•<¶eÐòYɯVçe¨K†-zÔ_øLXq*ÖsÿÙîrõ‰ió*]¨=ó/¦Î{ï¼´úÚ`AWñªwÚ§<[—f«cøê§Zgþ®~ø囕Mg|­äíXéçÇZ¶œ™áÐ;Ÿj4H}ã<;Mñ^¿ö„©ŒÅm,ß4iˆ¥»à™¾uò –b¦ *º ©Ø^yÖãm~{"ÅþH$RK…8tÔO}¾žPÐä½väöWêÜa$@$¼€ L÷ ÞM9@S¸Ñ>ˆ_ÀL¯øQÊ@Ê¢Vú[θŠóœjñÞ¤TÊÌXr¹Áæ§4ˆ·,ât€¢+u0ÛÓtPCÜ43Oív*èü<9–²o@xTØŠI†/ØÝm.&¾¡‡KWý¤! µnúâz<èZäÁ€šÌLXÞ²°³=9íçIc;=Þþ+DX±ìi¦ÀuÙmÌ ó\JaUJe¦‘44Æßòw‹vÒs·ð—És©èj©é.ý^pû½®0l•kô_:šW´Ç)o{ÉÐü[6T¥´T 0EX»J<Ý6æé6Ÿ \Ö‘H¾m¶”áhÝ!|ã@À\)`± > €Ši¾h‹"ê¢-3£Î£&ºÃ‡@múÀ®a#kË_z7]tà­{Gñ’ŸsÂÅL*çV-!Ù"®PèB¸fnPÊ^ñ³4§¥6¢ôBŽb-… Ñy|@(' \€+šÙÌ Z+"à-\YÔÛsæÊú—¸R šRE^U¥GÚŠ ÌtŸ³yuZí8¥ØÝ ˜¢ôÚ—vBD8¨ÛwÎr¥fëÍ•ÈËEbÇwJ$RKA"ZÞvÚ6ù2#ºfàŠ¥áAOÆÔÄÙxdŸÖþHÁÆ7w “²ñ1ä^ˆ¯Q%¶¨"\u›v„§zäéãÝÈxµÅ áµÕì›öpÀ&N¹B:ÎÛÓJ9 Àn£ü †ÍU¼eü?ê’@ Å©³¡J°¸w¿”Á§U%€ Bz"èú%ðŒ4ŒÏì=‹êÝJ«K'¡£xÒ‚ Ïè¨VY5õá.»eW{»¡ € í¥å¥«ßu§¸Ûlv‘>&ußK~:i_ZŠ¦)¾¶Ò“A 7UZúp¦à@ß‹Ewlí6ç×ùyª3œÒã'‘Ž™ÛÊÙ4ñžZ_åà¯õéË‘án3"q¢¤¸Ö8éÑ@øÝ‘ý8•OÛ2öÌø\;ÁG_žHkX9WìÎ /~V€ë¬º´ö‚u¯x:v¤o¸wü‡SüvEVåïXà­›—³{ž"úœh@„ ñÿÓÇVÍÎ^ñû¤–JÿžgGϾÙ ÉçušŸ”nžëÛ÷Vɺw  Wœ<²9½nÍ$ý½ ñ߃óŒªä®}ÚÓ¾#sÓß]Þ³[]6*z?=d\ú aÀyfmV `ÝKžöiïÿáßu¦ºyðó´ý›t"û‚X×nši¨°\CÝÕ‹EÎÙ1ÕUW6ɹ掬š]ž=ÏÙn4„¼_û\hNá¶kÄäÜùwúbÒã'‘#”{ï½÷ëkÝäx}öPo°èìý£¯®þ½öôlX¢ÿ\õ8dX2NÊÆ?7 Pü/ªuUcáhFHÏÖÔ㎇a~vwªU 3Ìä1Ý/„€Pºs‡Òp½å-74=”wïޘܸUÕïxeTOîÊ)q6W¸C¼¹ì{wf ½PpÆ<%¯‡0fy¼n0¹ç†”ºäýë1wý˜Ÿvú¼P¼¹#õ¶5Þ@¸½ü–úŒthIQ[ØÛ\m¦‹õóÜ‚k`WZÂÎ0cÛ’6+Žñ{Æ\lj‚ --˜’}ŠåÜHtÛ!@¸iùGD\ÞPÞ Þ”Ò¸USËöM¼*ª)Ü‘a¨íž¶†húhCO*,œ5-äM媋S½³ôônMc©“Û’ˆ¯n¹7loý«†l„ ŒFÒGGã5 gž’€Çc¥Œ ‹:Ë ú½R|H¾­äºqÖd»ŽŸÏ×Z¹#láÂù˜W›Ùf//ÁýcQ: Ðùçfaëå¸}>®Á¡{†z"DO&Ò›Bôú²ÈÁ.ÙþTßwúLÊþmøfo&‹ƒ¬¯ÞÖz7KðûÒÈ¡×ê÷Gß,áÐ{ù‚s{.G@{;†~÷‹ƒ;?Bþý2YôJÉ· ‰øçdŒM;.º#+Ê'é/^Õ+ý>=lCîZ GjSôÓEäHMõéýôË9p-ò…ýÇôü #ý33‘/»_r¤O¿ä¸D"ùÚ9Ñ%‰D"µ”D"‘H$_¯×ãG€úoYŠÙ.h9Ip'²[4Æ¡SäºPæ—¿v‰DòŸ@¾êqcÂ|½ÑŒ£5š¨ãdWàPÑMì!dC˜Á`òí“H$G%ýl–@šã;`K  ¢u] 9T%Éw¶AKd·(¸´Ÿ×¡¶K¾}‰ä¨Èpㄼã¥3_»3Kˆ„ܤ/âéd¹HìDH\ôl~•©$ÉÑ íã=!‘H$’ã—c¤¥Ž¸ú%ªŽÜÁÅóde!‰D"9£ð5BˆÑ´µ¾®–Y=å\ÝùÓ32‰âMB…ðνµ»÷¹K¦§x¼´¸ :Qúo¢å`–ä‹=ƒBB‰¢‚‚¨„–õ¥'}wQ4fE_!Õ@ŧ‰ä»®¥@E â¥¥k]£' Æ¢› TFPB"u W¼ü¯†êºÒ›–¥ú‘ÐU ¡j^¼nÃ~ÎbOzáøóN·3ñ%+X„³jî‚ùÍ'þ䪎ùÝ*Î>ýôAÌúj ªËèÓF‚BÙžµÏêGeé 'ˆ¶6)ÚH5Q¶÷JƒÒ¸í P Æ‘øóp5}Ô5SÏMXx÷›·olVœ6pЪ͟^6Ñ­X²F^®v>YÃX|“·¬Ã·‹•BªNaK.™˜é0„@öà)Ž¼L±CÜâ¨+a*6Æyï“P¢Pà?5¢Ø ‚=½\¢(Ô‘;yêOGÄÂí­¯|öèµÝwÍÎ’{Ù%’ÄáX½¯ªM5÷¯úëO×.ùxû»¿ÿøÃŽ‚“¯t$Š!E!‘¦Uomýôã ÁÚ6½³mÑGQA¿ópB ¥Tu—~…¶þ7«6 šq²Ÿt©þ²¬AãÒss‰îóçMí{»C1ÁÂ-u»MëÈ7N“Çf9º"$7³l\fñ`›ÝæЈž5™Õï…"`]¯ßþñ‚=ŠJÁ Ι8RiDš9=™×¶TwˆXGUg»?7ÝÎÆ3ÌM%ëToto[CPiÜŒäæ¥Ñ¦õsZÚ£6_^Á©×å8ƒMõaJ)XŒqÈÍÙ‰´¥ú¬=ÿÌ»ÏÈ_Ú´¿ÉЇNºår Sa&Pj9aE‚QÓ>ðâÛ„……•øŽE–É×ΘzÒcg?õóÜ_?‘<~ì™Ö½ú³}¾$3Ø®}oêyg ÍŸ·ü©ŸùüIÚj™º¸6Üè6`ÒÂñ?¸~ù{·.X•EbË5ü„ËzÓg /[¾ü©Ÿ;ì,ÂsÆÍÈSyØ[¾ø‰ÀÐïÿ±À×[ùÝ Ç¢1L9ñ’³W¾{[KJªh÷O¿!Ë¥ŸÆ®G/X4hÆwÝ°XÈ2cÜ1aü9'¬yã¶Ú$´«3ûì›Òu´Uë^ž­y’ˆÑÍš9©Ìé¨.Òªž]øb͘‹nJ¶K! ‘ßsé¯5ÙÅ1O<÷v²ˆãxY@”¤`l6fm„N¼©&!<~ÇååXU‡š®C§,Ö-¨]ÑßUÄMÓ0©î ”@0fD9 ŠªÛ)%‚Å,Ó Šªr&T›M˜QMÓ(7£ º¦) 83£Œqªh6ª(B0Ë2 !@U›¢ªœQÆ…bs)ôÀ,ÀbŠjÓ ú®NUU³QJ3-&T]ï¿mŠÅ"\±k*À0§6EUúzN¨ªè6JˆŒ1Î9¡ª]UËŠÅ8¨jsP¹.%‘&ý2ܘ<iÎï’-uiž@K:_ÐÕD_yWl®¾;ªiv­÷ˆ¢ö}ÚsÀ¦)¶žU š=®b¨æ8à8&TÑÊ!ÏIÑ4Eëw„*¶C¾¢:4õÀ ‡]½G Ü£PÝI¿¨çDQmÎC.¦ÚeÜŽD’Èud‰D"‘H-%‘H$ÉWçk÷{p&@-Ö@Äë 0–ÈŽ=Æ{F!^Q"‘HŽRú'|½Ñ\ ¦ a#!‡ÊgGª •­Hèv”$£©¡˜|û$ÉQáÔâ„Çöúmò, IDAT°¥˜@£™Â©ð0ÔPÙ-Êr9ÚL´™òÕ“H$G7G' Æñ¢¥¾^[*láÌ9XZ}ÔyŽ'55³ ²ç=‘n ›¿Ÿ®À’jùêI$’£’~òðìTŒKÿØR* '¤–r( Ð\KY NÐp$É7!ý\êq”qáX9³Žh±%P‚šÃ»*#$‰ä[`Kõ@ˆÚöyZS¥j1A ’}Q[Š;qTïòW-p‡º¹«´%¢©i›H$É·Å–"Â^÷NÑž&ÙlÙü–-ÉR§H*! <}ŵ%•Û-§×µûo#>ŸJØœB îìû§øOñ§B€ @ù/ÄñF´£ž5Å3¬kÿÓÚÛþ[SúnJé£ÿ[ÿûº!Ä7ðc軉DÚRÿ7Š«fÌJ9µiðX½o¸Hœl³ÆêÌæ”Ê3~ÓåFsJÒèyo»Ø݉ûGTd¾=tP{²¡k€ ‚ÆRO¯<ñÖ.—Ö+}¿À&®}vâ²ÚÕWÞëùü¶"q嚉£Àú‰ì£©Ð!L5³l®£O G¼{—3ù⊓oéôË´ÔúÙ#–üÃÆb…U®šºN¬îð¸×ח縪Þ*Üø†·³Š7”sî¾±W]v ÌQ=«´b¶«;@ GÓOÚ3ñæ.÷ÿ!UJóGã>ùtãåE¾ú¡A®yÅÿf£ƒ€ Ä^ÿÒˆ Á5gÜÀe™,‰ÔRÿg±ÈUËdN7T€ H¬¤âê„MŒ8QÕÃ_,Õ×2ì÷»ÊG pÂ:R6ÜUþÉ_×ûË(íýiĵŽÕku+ÀÓlÚGü6 `q‹ Pz¿©ö** à  ½?4X@lÏ¥ 7}#ÌžR„РU½ã±_µêìŸZL¡J@{˜!VúÙÏŸNÀ¼;´ØêgËzŠk×ýå›ëêFݳ;5OXÍI»_üÑí;ÎúKÀíPZ>¾bqíIlMÉ€Õ–ºõÁ’µo®ŸvÕA"^éõ/ðøO”@@ 0€ €¨Wt¦ÙÄAFá‘N9øŽ+\þǺiF•ƒ³· ½6_:Þ8S{c{´ÞkI%‘ZêiK1BÛß(íSoÄÑQvó®±'3ž Š*nó P¬ÌMOv—Ý=J»áø6©¸ê1>€$5Ž¼xÀû¯;£ˆ: o+Zv_Z{»‘zÖöo Û4Gõ‹ƒW½ªÓüº¢Áñ“ý[ÿšïm3(uåݙޙáÊ?ÒÁì.ÎÎùô®ÜÚJâ¹{ê½­É^@èMs®xÌSÛ†ýzWyiáœx»m'¼¸´òÂ×[í„­êò ëÛ6ö£ðú“•EóïIokáî±»§ü²=Éo¯³¸Öè½›AÎØ<ýZK(6Ëa¸©éBq[,€ì/­XÑ0áéýùicîW"—VmÛ8l´jTÔ¡MyùÌ´œ¦ÑµYœ“þ£IÞøpÑ–E:]¶uìÿgï¼ã¬*Îÿÿyæ”[önïvX`é½ ¢Hì “˜Ä[LÔX£&jìKL4Qc/Ä.¢ôÞ{]`ÛûÞvÊÌï{wYŠþ0ߨ\÷Ë—Ü=eÎœ9çÌgž™gž´fϾ:ªàãÀ©u­-Ý~·gÈT‹ WÐkéK.žr¸ûé v”‘ÊZr>½ÊÝýsÿ) Þæî·ì<ÙBSÆÒ»³Kö³Oñ˜¿Ô¦;3?š˜Þ„ÔwÎ-›ð‡˜][öœv£©ø2–Þže\¾öŒ1@c×÷¯ÃgÖøßî±î=—íjÍ»v爩6Zr>½:ªëu궿×M|»¾CìÊüy¿sä?½³0 \Vk’ß_§•åÉ"¦|ì«ÇÿFÙwoï5+#&¦8Qxô®I[<=Ã:k_¯aáQH‡Ú½@ôÚͪšaè€hÈ]x­#åºu}Pšp°Ïò˜¹£Ûò™5#_Z7åN­n‘f ÌlÕLDFÌöÌþÏ(ÈOùòÂLÿà-ÎÙÖ?7oñ½Q›;{,}¹ið³&Ý«íýK^¥({0vêºé3ëœaã#˜sé΢"{庳ï:[rü2*ö—.žµ«GB¯f8M.ÀÝûßôdÞ³}ä¥ÐÉ\GþO@ë²;©5)§Ó^GKÚ訒½DLتÍôÙÓ‰•;]­ÕªÍ,ÝÕ¹×Q«Y”sлoêG«Î}„ÿ¹ÏÞF( l_ÂŽ·ëG¸êÒ§iÿs©°‹ ¾|®yàßÖžû(ošë ðcß»-aç{µc?^ué eßß“êj“¿º0»¥ÏÖ ænØ­ë’;¢›Ùá /´xúm¾øý²„ѶÇa™0ë=ÞVõ™KÞÕÉ­1saÑšU‡ÇÏ\}Á_}U3-]Uƒí+žW5îo5…—@6’6?}ÅΞY°¥ï©DÚRÿ%Žº!¬ u±Œ£— Ùô…n F† …fEÞÂ[< ¿Ü’­ù ®ÊAÉbWŒ „‹*XÇkª„£:<9‹š°qÒÙóO¯ê859Ò[NÉ ÔãûºÖÜû¶-§ÿ¦%*>˜4i×äJ³ãÁ#§]é±ÿô?Õ'g<™èŒ@tªý㨠µô¼ºÚ|·çúõ`@Ì9 Úžäò}\si5ó»¯~Ÿ¦+k³ÀÁ´ƒ Õ¶Ùà>­<¹5mç—LñÀ¿«ëê¿»ýA3ñl«~Aju©âÝÿÕM9µÍœ)¬tš§c«TÄM­qJÛ³†„UþI¬QXã<©•_„€H¨zYÂ滺mý"ª©Ô]µ´ë¢ß¦ú—ät‡Z×=¿¸9»x³Ã× ·ìÊØôW·g`›z¤¡fëq®šýŒÛÑÅƶÖRððñªHÜñ“}¾I‡²àá”âö7~D†{dEŠ7mû|¦xØÛeõ³¤À¬sOâoû(«ÔçKHBìD³yV¼(lt²¶ÔQ®=ïÄ·øa”ç®ÿÒÌšîÓí£2#¸Ó%5|ÿàñY«žuuLH¤-õíkCrø“‡ú“;ª„ˆ ¤ç×wÍ?¶Vþ†Þ§ˆéÊìáì}ã¯ñÙC)]gÖ$dÿH·%wŒ\ÝÂÝ}Ž½ßp&ÛëËKòXniáh³Áw´l´ÿÁ£OxG[rûз$5óð{½.‡ {Fœ×séy†ÒTxûÎœTn™ ž¿ xÿ²çÏ;}\:<éÐYÿ(XtßÈ-ô­‡IɨüǶ(—™ué¢×ÇWœ·ô`jïê˜ú.^À Zb̨”n&™—íìSÝcÖ™NîjÉ¿iãˆÓ`·+Ø‚C_—+*ö_ÝoÑ‚Õgvj—H~,|ç1Ñ/X€ùemvzŒnoF|´ÙÓqÛjÌ+ÅQ#jt Ï 5ÀAL€ ‰Nk†ö¶7iB¤‚¡Þ'+|¡}Ôv=4ÕI”N熌Pâ†82X%0ÀhODë4[+4_J qÛ+t¹Ž]Y¥Ž+v† p¼ŒÐ®Ðä­Ž.2Ñé®m€:`J§¹SZû¼%…Ž* #4ͶÓ|©c¦[q[,¡T¡s9…ß1³}FTÇéJç©fÇìmŸ¶z@Z{ GöI$ÿMí7<ÏÂà䟔-%9µ'–tï€qÜÞxûÞPÕLÖjŸ‘Ú¡ÖÑF}.Ð)ñöú”Ú¬#óèÜŠðdÞØOÇœºó¸¯tý’H$'‡K…JȈúiØR^?šX¹ buT5A‰änQ.ãF“ ~ùéI$’“jÛÆ8Ñ%îTÉŽúß,ÊZPÖ‰~°8Ò¢±½ºÁï›ÅÑ/¥Í(k–ŸD"9©Ú/5 ™1? •B{$ŠD™¢pÎ#Ú¹·s\!é¥,‘HN¦ö;¥êŠïi¾”‚i¤iG¶p¦)"fñ!ÀHu€„€ç‘“y‰D"‰X¾'•"FM‹f,˜»À »RPîyo“*"±BAdÕ­]òê£Õ­ÎŒ±£®¸%51*‚ABL'¥s$ÛBàÔWAŒ¶!H%XÖ7žpòÙ!R40À2ÿÿ«K bP´c,[#¦€1à6¸J>t15ì#8l+ôlé¿Í6ˆ!TáR¬F °MŽêA¤êà†àÿƒ¢’H¤J}Wð`kµ™}ã´ËÚ† #6IDŠïã%+Ÿú=Æ<2õ—]ª–<9ÿå7.»ë=rÃz)켯çòêŒèh„àœkI#†]qGvš;æçÄçQpûË3_-½èÙ>¼sƒ¸ü ûÙV{•M'’[ض¦¶¨„DÖ~(1BÝÜOyÀWpùÙ¿¾Éãd_« @!¸wö‚7ÿá3™åoôÑñQÜðÆN{cÚ¸”ëÞظh~sc›PÑÙc\puFj¬ˆ‚u«_^»ð«6o@æJ0à’[³ÒâþëÖ‘0~öî?M™ñT\( ‘¢£ô™1K‚·\vÇŠ €”¦_»cÆÀÇVôI<©ËÁær8ÓEVOÉ÷hK žœŸžmáçÿÒŒý¾m ].úkZ¿‘Nѧý|û†™^Ùá§gB—3=±?q»­rÁK^zrÚÝŽU‚êc‡` 4غSw¹ 5å4¡Ù˜E@¨lŠŠ„úEí•Í"p– ZöΗ“o¿‘„-â€oÛœ¦¸+/»õZÍ/Ž\½=RHUÁ 0‘ž7iâ]cxÍ’§–ìì{þï¦ÃbÎØê%w.^i ¹àÑÔô2›j·¼³òéÛFÝötF’Ç(žýåÇÛ†üöùì”xX͇—>µaöGiWýZk·( hPµð7ƒB€T˜¡‚1 ¦!„SIÕADBsè.Wç—XÌ­wþHºîŽf0¡ ìÜ„eŽ¤ lXA07¼òGפ7ò³`Ù²WY"ùm)#hªq.ˆApœBsÆN¦?JÏÍ+87Ûjö}õ:ë=5N‰ ;øZ˜æÖ]&ŠîzƹëÖ¼ÛÜŠØ82ë7-{õþC宜É㮼%)ÆQ·þŸ‹ÞTs‹† ""”ÍùÓqùÅ—íyãÖ=ÉÄ­zDœ1cÔÐÔMÏß¾}{1bú ýÕCùy $xëî—¾ù|ƒOÍšp߸ɽ×=vyM‹û­kŽzøã|Dó†wÌÚ(ì­ï=T7í†{ÜÖö/ßw°´NI8ü—÷uÉIjÙùΊM¾Ì†O²©¯¿Ö!)ºîÖ[wh¤¸QQBCÉÖ¹[zþü•®=2âsN¿Ã_yé† »2' 6×ÛZ—ô¼T݀Гs&>”ÍAìÈcfh;0ëÉu ù…+eÄ-g\:ÙÉZ×=0½~äýžu÷ï/iNþû±—]ä"4ï|óËW_öÚ©…§)ˆ}síH³€µîy÷ÞuËו”®gýqÔäaŠ@ãÚg½ÿI›ŸÇ]vú¯SýȤÕ´v\Ý=ó‡å:l.ë(ÉOïm*7,áÛñÂœ/þÏS>zfFU“I2]–B Z&?1ë‰ëv»úI"òeŠ˜ª¨ Õ4í\i8s£¢@¢fýó¿·ûÜuÙ“s‡6~ù悾ÍkfÎé}õÌËîý‹]µ:ä·8bªÒ°ä­¸‹_>2o÷?.ÞÏ'žûØâ³/°å{ëš-«eëò·gæýâÕ‹ï~‚6=µf·pÝc1iç_úìÇyp!(fÀågMꫤ_{éï‰÷Ôo~öþÍ—<ùåY“ V¿üDsSZ7|âüĤ__áÀÑ£;"žó†µHJÊÊhß-jBÞè–m{mBtþ°ôè/g=üà® ËkJ‹ý~KÑ¢ö¥0ˆ|¥«÷{ÆÝÿå¼àÙñèÂ¥uª¦( 5Ë?-¸î³+ŸyEÛúbñ®˜»×üû•.—½6ý/s5.niãÇ¿1VË®’ ‹múòÐÆE·ïäB0¥ïÝ´bWÖ„¿,ýÙÝwš‹n]½¬”µÍ_øÚ¼ž7ÎþÙŒYE©‡v­ÚÒíæw ROûãÜÁÙË–KEI$ߟŸ–5þWOÈµäƒ«V~zöÕ¿pD‚N…z&QÂØ[§ð·íÿlÑk¸ïü[ÚÉ-Îw cU®zêó}€ 4TÛ}öh¢ ¼ì£RcÀäI#<.œõ›­y¼d_¹?mTn^º¢¡ûЉ»JëŽJƲÌ_ôA5ŸoÛïðØÏ’Áã¯é¾úÒÃ5-QÆì@æ„‚‚MÉqÝ3~rÛ­ábEhÑ^Ñiá>‚¨þlcîèñcuI}/Ì\xí¡Ú@wâ"þÌA#zê<ìjqB«Eø깦)zgCFhº[øý‚€¸þc®}±r×êÒ ïì8´Ûrvïyî­}úvŸ+„;÷´§µìÿà¾-AÃgØýåbR¡àFtѯÓâ`ñnÙ¹z‹ßkW~Vï8¤WWEGþˆ‹vìZw|Vle}ÉnÆm£`%(pxßîê®—¾˜§Y4rÈ”‹ö.7ä9É[³}UjÌé…ÓŸ0Z¡¦}öΑH"°ÇO°¨Œ>Q¡V0sæ ¼á“bÂC‹ƒƒxó¶CÅÁŒþƒu—žÐm°‡Þ­h°2²ÔïQâ{œ;pLOj6½ýLŸë^íË9D[…·fÍ'7[ÁVBb•Æ=‰ÍédÇÁBh‰ °!|µAjYy÷è•¡M¥`h*gÁáˆÏqþðJLÇ »„·ÂÔâzÈRT'µù,Pcc{(|Í;%.O ,z-¸Õ¡K@ÀÛ $2p¡ÄtÉÞ5{øt0Ô¯zlî[ÿÊ~èñx‡²˜¶¼ùÅ»ë_}×€¬è²×¯Z/ÂɪQnp!@ÂW-´h…ŠîdÚq‚;RǼ`ªb¥iξ;…å ØJzŒÊm‚“d›L}ø„{^ûγsæ߯¦œ>ö7JOj¿é(‘|¿*Õ¶ç½?W¦N1²¯b×/ZáL¹Î©EL1‘¹kí¯ô‰úwAnœ¯xC“7¥(^?f@Îø®É] IQ» :uÒ;'[3·ƒ€â¶éG\”&¼'1'Y@ÄŒÎêÐö¹gö Ù¹d7UlY•9ìBÅæM—T‹Þ……)Üú\’<ë^¿Éa[®ñÀâä©wõ,ì ´¶ù,:¡¥/8œÉdV[ 2ƒ^Ûàßœ«p ©QN…77›,ÓÁ Vcæèˬ63öŒûÆÚM {çÜ·jÞ'çýl¬ˆX‡/+)ÉOœïk\ŠyºŽ9래õÀÅ?rÝ~vñ¨ Ï‘”táé—MÛÿöµŸ<|ùü÷\|{º <òÇ¥„àœCp¤Žºº—˜½äýå\¥œ›ãÞ½wýf(jË®÷¼üªÈžê>¼ôàÞ£qïîµó ÎN,qcûtóížûqºU·nùKÕ5œÙSÝeswí,ö×n]ýâöÕøEEkYKs½igLq õœîI¥»/1m³fÓ»‡Í~yÉŽ“qà†€à±=/¾ªfþm_}ôIUÉþšŸ/{æªCÁÓú÷-àoܶúŸ×¯^²º¹¾¦¹bó¶÷hN–àT;ÒÖ=ÉM»·û £|ÙêxK©É nª™Sã›×غÇl)Ù¿ì?^ë¤>"áLïÑ;ýàž©jåæá%«çíM-:K­ygîŒÛh1¸Æ©Š¦1³¹­¡<`J‰’H¾G[Jè™ãÆß=ŽBënóÐ\ËÈø‰ 8Kvã¹£n ­+,p!";âé.%IW›¥¹öú÷g<{`ä ü¬ä×?½ö•?ϜݬÆ÷úë?»Ýñ#¦Ÿ½øõ_nQrûŽ›âilƒSª` Õ¡ª €m:ºßð~ðõÛ>¹óáÈîyÑ}ÉñN†¾£~yŲ7¯ÝP3N¿stQ²bôÌÉü×ü~5ðÞÙ½“ÀCËÊ+UWp+¶ïM/¯}éÞ÷n¿OM1æš{<:k#UÕì?U×45Ü»'„§ûåÓnÊ\ûÁó WÁ™’5òš³§Nv„@üÐßçH^=û‘Ùï7 æIpÑÄ+¯pª¬cQûŒa×el»ó½Û^Lw÷˜«7癿­œãÖÝJ»«:Ó\Œq¡õqÕ¯¿zóº]vJï3ÏO¬->fFiN•+ÛUw‚#뢿æ÷|qÏCMï6í¥¡ÃS®1âþ='`ˆèîç¾üFj×1E‹þyeÓœÞÃmI?ÉOžïvå‹cA1Êš#¯>‰œ7·D|´ÙéEX]ŽÒÎOA(.b6,C =.ƒî„€Í…ÂA1€Ã2`s0š¶EáL'0 ((†3¢ŽùR¶ÛBS¡ê €[°Lá9U–_ؼ}.°Fº Ã/pÔÕƒà\@!Mƒ8¶]#˜MA0Ðü¤@ÕÃÓ­¸ËA ˜ U {Ÿ –ÑÉ£#7aÙÐà„ fÁ0@ŠdÁ¶…&9¶¦Àò Þ9ö„ƒT‚8{ÂáÝ,)¨* ÀMX¦ ¦CSÐ|)œ ¦“¦`ÊùR’¨öKõ`T’Ý?%[Jrª™‡ð8Âã=!ÏÃß¾SÀê´Þ Âï`›7Á"p#ô#\ŸÚAØG_IØ0^7¤ý˜ðID€ÃjßpôÕAš\|¼?„Ã:²‡àGŸÞq@Ø0íã’8’ÖQ'¾ÎÃnO‚ÃGv¾£PiP§K æQ— %E¡²2Œ£ò%LæQyíØ"%J"\Q^"‘H$R¥$‰D"‘*%‘H$’ßù¸”S…GG$.ÖëTA@´5’½'8œ<ù¶K$’“ªý\§Ò<¡ïÖÇÏæ(mƒÉ#R¥btÄê(m‹p‡E¸° IDATs‚ðš2àŽD"9©ÚÏ­B%¤Eýl)ƒãæUø¢<ò*z.pY>î€Â™pëü¾lì¸w¯Å‚rùñI$’“jÚKÁŒá? •@ІߊH[*hC°à‹èÁ; \ hÃ'm)‰Drrµ_À>…Ï“Þ‰D"9uù¾TJ´¯Dí-úŽ-‘b£=ÿ‰D"ù¾ø¾bOÁ·5oÅ3ñ¾ `qÏØ}£®osFŽD9ª>ê¾ö‡MP3ˆÿ±:9%²"èÕ+=AÞiÉaÛö lNŒ9®õtWnqƒý.õÔ|4`€áa%ÉlK!˜¼åùdçå›Îy{ù/UÿÉÛ²k÷°ñ™Û>Õ¼ ½–<8âw~gWœlÛ<ùzƒ²Ý`9<°õh›…l$p-ÚVuX[óW\?æµòŒd½fVŸ/×f?æ.ûHͺns¿aV'ÚBjVe÷3RõÞyúÙ°Ú‡©$‰T©oݘ³é]cÈ‹ ³×ößð¿µ" Jdëñ‚·10@®øôˆwâ'(­¹¿:PØ+<‚$Tà x·ÆûãK³²A°â¦î¯öxm´ˆY~®jÑ®LGu3xtcsHè#Åâ ~w«!`#z _ÝR>âñF—„b›¶¢8ê÷ÙñcÊRÆ”ÙUÝ>þEÎá›”°×†æ”D"Uê¿D¯úøåÑÂYÓTŠmèñèöCÁ#¥–àjÕð8VÜÛçó7—î8éÇ0",Wí’´Ý%í$lG~mAŸâ¢î½WÞÖ:ø|ÇÁ¿%šg–9!_¾ö³8„L<·9𻂽'³¬ Úú=Þ¦VÇêì€cìnÏw]ýŒÙï µf~Þ¾úíSò%M±Ö?Óu_Jß“^W M¤5¦¦eî{ÝÓõ×JÉËÉ–£^˜pO,É~9wÝK¼ç0Çẖ86Ÿs—çÀŒÜ¦¢ƒ½Nmkcͤò$]¦EÉeYMÉ}LE~ÑÉï6&ºÏ 0¿ an¥}‚,œÂ-_éxp0º½ èíf“Š°3´9v”…ÓqÛjÌ+=:à Q{þäåàöÉYt¸÷NftñÇ 5Ü]XSpfÐáMØþϜޫƒ{öáÏìw8˜wwJñ§IÁÄU]úˆÙ&ÓSü©Ç}fUz8o\ñ§±ÍÐÒêó'µEE¶«zQrÅ>á*h6æô9ØgõEWÙFMâÞÙ1mf }R#6¸õÓ’“Á›öÏŽim厬º‚‰>§vSüÁ¹±ÍMB‰n͙ڳ2yï|—]Óó€ôñ“HþµßðT<7 ƒ“R*ÑfV©ˆå„*%¾¾‰p¼(:µêØu¼H‡¶òÝÿú«t:“Á±ýƒ÷öZ}ÑU¶õmrrâcdŸDò#T)ÙøüišÐô-vщvŸÌ ¯B?áHóÅÄŸ¸¥ô 99ñ1$gõJ$?>¤JI~8¸0ºÝ¾©` ©1‰Dª”äÔ3é8Àe7D"ùTŠ]¢Ñ'1‡¥ !? Q‘,å‡CA×hôM”o»D"9©Ú¯[,´S&nÁwë=asÔø#uò«K…KE½?²úHpÀg!h˯O"‘œ:ƒ ¤º~¶”6FYsäUôB ["eàãÐ#yŽÍqYÖ–£¬E~z‰ä¤j¿TFåœ*ù‘+Ê“Äþ˜îBùH%Iä!UJ"‘H$R¥Ä±ã_BDTãþ¸ÌJËD"‘H¾¾'÷5b*üå+Š‹M%!¥×¸¤xŶ#%ž ؾº]ËêÛôÄžÙ…½4‚"Ö¯B0”N­aöBqŽè‡Ê1R5XÁÿ6B€‘¢Â6åʽ‰T©o1÷¼;ï¥wÇþ<¶aæçŸvúÝOg8)2,A¤àðü;ÖìIì1¨wÙ÷¬¾óÌӉȭ‰˜†’ÿ|C¹ näŠïsÑðóÎvqÁO¢ñ „ …4 Fà&kDdœûùÜʱ7]åúv‰ U‡e÷ÐÜ•ËZO¿ü•}?ÏF¦,3‚Û-É)Ë÷ÔãG¼mï¢9ûôç_2è7Ï÷Z¿máv)¾s2·mYR5ð²{{¹däÅ×6}9³‘ƒErD ÁšÎÜ G^ñçÑ¿øÓÈóγÖ<>ë Ñ×7:ºi‰ˆ¿òÆ_*.¢ô‡ß½+:Ÿ~â# "ØØXYÅ*I„ÚRÂòµú¼i…©Â„ek9Ãóöl[´‹‘`I/[Ðê웨 !ô„¬hu_Y=OLavdWJäLÈOÉëI¤ôJOªyû¯ïU7]˜Mܨ-[· ±Ù¯ÆvËrš Åë÷d ïÔɪ۶wO°`HNñâż!këB;oÄÄ(×o™S^Z)œ9ƒ'ÅǪ¸§DOXР®’ÝVZ²aq³×ŠÊ^ЯƒÝ¸caC옚/Ê+š\Ãò‡ölþtëšÃ-‰ÿ9Ô㊮é R¦$’È´¥‡S׫|LSaÔµXV«Í#Å’‚Õ\ÎÕxM@PÝNÝjiµ~½;BØ܆àààAÁ4ÆÅØóÚ5;÷Rºõ±Šßžûæg¶uhÇÂY>C°ªÖnZ°Øvĺ£ãà.ÈèQäp aî ?üÂ;Ðã_üÕ‹7ù ŒòïÝ·vKMlZ†ÒˆVÑùÁÿb颱ù£­ÕK_y¤ÉaU­á®z;=%Ós`ÍÇ~C°Ë—>_RïcM”o|÷™*3.¸éŸ=ÿw#¡_²§lå3Wî.‡¢¶˜õ×U_Î×âsãrºKHï=Lm\¿eÉ .¨aÛkËnˆéÒ?Ñ]³âé›KÚ`•|>ÿoit¦¦˜›^øõº]†¦å ÿ¹êÓ·ông%™Ÿ/˜qÍŽ2­ë ¡õ_>´«¸fÝÆo,®JËË©œïW˪oÜ>gõ+·•óÞóKÞ»}ÃêZwNwÝ´=Ùƒc=R¢$’ˆµ¥”Ø‚ÁÃwÿçŽm)÷'z¯ÚÔ¢¥«UÉSç_âè-‘+R¦·º¥¦Œ Î}7¿þiLï?¤Æj?Û^;æž«Òb‘‘¤”=þ×’¶ß)¬Sht"¦:¢ââáÌIÊÎdÞm+çíȽ~iÏ>d÷غÿ‚ŠÒÊžY̲»Ÿú‹ôD§àB€@àe^òâ” ª0Ž”é1+in´¢Ä§¬ÿä3¦Ä8àlÝ}ð“VæJÊÈOÚ¹¹¼×ÔžÁ}óKÍASh[Ÿ]5íÅc“M¦WNÛ¸ha+Šˆ¹²úü¬çÈ.FõjEÛ™[(J7ƒ„@Ý~gÞ„Ìü>zÑà¤^ÕÌa–¬Ÿc ýó؉mS¿è³ßØ÷2"Ää\œ›Ÿ-æXúN^ÿ1±ñ”Õ+{omk/÷ŠƒæˆsνÐí@2;4óå—›N˜‘Åc.tZì¢þ½ŸÜp`—zÚ°(Ô#:J\†$”H"T¥8âFþn¢þÁþ ÿiI2tBþš]Éjd¬(/ HË!«Ì4MÓjY±jäAð¦}Ÿo ¬fkÅÆ>1áôÑ*‡]»Áô¤»Ü€ÌãŒj«k0Ø FáBCMÍû[È¡nxfù[ M®úÆ^YPãtMî¤Úu+_Ü°µ11/Oe¾S#0»~yrBÀ“ ¨m‚XNÑ€53g·žÓ³nýFç°+SQ»Õ ŠâW—¾Á84«ÆjÃ^Ó."Eq&& ñGÞ'!’úý<ö?ÏÏÿÛûQi}r†_Ú=‘ûÚ*ÑòÉò7¾â¤¢©ÕlÜÔœ!II°!˜Sskª®61UpfÕn2½m?˜ÁˆXp¿ÙX\Ý •sWv3aÈé€e Ñ^2j®D¹*EÄ›‹7¶¥ž;b “i¾u÷ý)zìƒ:ED@˘ücS­Ÿ©ëJZDQNñˆW)%¹ß/FNĸÔ6•N„ (.Mœ‡j{Î9 IHXŽfŠÎ §ô™”ep®ƒ&:Sò¹Ø§N7kZ¹jþòü?|Þ?SüPóú;@L…°BisË‚ðŽK ü~÷Þ_Êšû\Þ V- 5¶p|^šfsßË“ª‘}‹ž<`øµÏ™Á–Æ-3—½xµ÷Öª#ºëȼÂôP “b¢™Ñ!·Gµ˜Bš§¹ ©¹ƒÎRI€Îì2JqZ•¢“Ê>‰ä»çûšÕKŒW-_ñÌëÍZ÷¯÷j“&"¥šJa¿ñ¹›ÞûËŽ¥ï®|ÿ¥”‰—Äø ’"FŒHqwŸøsçÖûWmj&‚’9!ÆW\WÙ,„ðVìj3ºä¤Æ‘ÑfZ‚‘ÙPuȲBêMÂöÙ6(®fTk‹?.¹ _Jn¾*‚šö5Ë‹€Å‡ØM›ß­ô*Â*)顸¥% ,oMénÃÛUد¯s߬Õ~¹I®%¦&D7Ô©‰yýRó{GQ“Íb;¦1aØ–ÖPBöY‡+TWrƨŸeÇ‹Úª@|jAK½×¥_ZAß­5ȵoð2å–#}œhq&÷H-è—«ïÔ¿¦ Îí—¢%‘D®-%b‡ÿvJÂʪŠZê}Í”ËGF‹“š—sjTåBpJÿÈè´¥õm¹“ÊîQÈEÄOŽ±-–i‡ž%wш^º%û¾—2“† ™6jÝÌ[E{‚Þ`—ónM‰Îì’o­yõÖ˜ÄT5X†Ó¢s»k³ÿõÅ+†N¿yðU·¬xÿ¶Ï×$’åGl¿¡— tË øŽ©¸EìÈACg®î×e)ž¼I}{¯Y;óŸ ·\Û§û‚•ÿ¼Á›íjµ-MÂBúÄ ·>7}†ƒ1NQÝÏÿ}ÛOÍ}:Z%Ë´cz]< Üô·Ø¶€€êN‹¥­‹þ~[ö˜a¶„ Æš¶¿w÷6g³ZÍÄ)#zÅ%ZWt}÷ÉÏŸž£kúÐeZ·\rXþÓ –á÷†DÎ6}¦PÇõë·võK7i.§ÑæKñûœI¶á5ȈÜh5mS=¹gö¶ÿ Ä=5ªo¶Ô*‰ä^‡_•Å± eÍŽûùC989Y-HÄà ¼¹%ýؼ"B$Öâ˜^„Õå(=.2=· J £ÐÍÛ¶lR5F$ç¶!@ S {Ú#FB€©* n[ˆ˜¢ n›‚ €HQ‰1Îm›)jÇC• àV8U%nÙŠªA„61N€à¶e‘¢1BØç °P®7M(c$„¶)HQLQ!B±4@ÄTRAº )LU‚[&˜ÆApÛ¶™¢„à'Ea,|×å@à¶% (  lƒCaŠ‚ÐM)šÂd`LIÄÓ=ÙýS²¥Ž×£H3DŽÏÄ¿‹LÕºR”ö.0"¦¨úÑ÷«*L=¦·P9Ò³GLÑ¡½WeÇ— ±Né(š:åøÄM‘¢)ÊÑG´@DÔ‘aÖ‘eý؇Ǝ¹u*„Ž µ‘¢¨G]’)Ú‘“•öE]؉ò/‘Hþ'5•,‰D"‘H•’H$‰ä[ówSp[DžÏ®àBÀæ°"¹s/àÎ̧ ‘H~¨zãÔ™&ôÝzOpòø͈|N1$¸q !²£Ê ®ñ¨õÁkÈOO"‘œ.ñ.DŸV¿[[ʨ ÂkE`åX nA(‘Ü-ÊÒ8êM4H•’H$'WûÅ åTQ©ïÖ–òY˜<KK"0èÀy=ðøPôxÐ#ù³°í üv–”ȯO"‘œTí×'ÿ> CR~¶TÈr„‘*åRÀÐ#\¥Á­š\¼V"‘œTí¥žB“m¤ŸD"‘HNå–ö Ô"lÅ)í¿;¶híÖÝ©†öøJ$‰äG¨R¡`<äÍüêç×,£pèÞ”±äú¡oM8ïÉhŸuŠ…vQ°´Ë¿öÖ”þ_¾ì4lDôºB@ˆ°èvü õýßWhé `èôCû”mÿ¦×¬S3H"‘H•:YˆÜÚíÓ‹²j‚ªm‚Š„5¿ÊôíœüRYbyÏå/¨6?•f÷˜™¶òúXÇäm“ÿ^«,/Z;›ˆ"xþ4Jû ×¸—ÆŽx}ˆ×ÏùÚ„!³‰o5pò÷e·8|¾ÿMf”¶.ž1xKÞ.M鳫ÊÑÍHÿòW7€J°ê¾À×¾ÐÁŲAä.}eðÂÿ\ñI"‘*õ­/ÙVçðÂÎÁ§sa‡7WåK‡ÝØ›SÛ÷Ž6ßÊxðÔë÷•^“xhÀ¥¾Ø¼Š7ŠŠÙ±&"ÝAhqµE­¿ðÃu|¸îü—ÄoïõÕ 'ë24@:¢Öil PÍ;ƒ–¯‡aUSۧΌ¥Ý EißÆÚ·´wŸr-Êf;ªtÒ»;óÁÛÏ 'è¨õÜ–^¹ (¸æ\8rQ½Ýs iÍï“‚/óòÍ£ÎÇßKÈ,S:eø± %ÉÉñý±žpúáDŠ.R»¡‚–un–ëõ„ºÖÜ~×â«v¶ŠšWéznЪ ýŽÚ¸«)IðhÄÕ(ÓPlMß ºÌšé à&¥u}Á⇛[¬¸1{ÆÞݬnîûÙ§û'<ìs0µü­Z¶LW°äßÌt9|ǔǽjSÆ’;sí"G=\•šÐ¾² Aø’6=P°k#wCï»öô%ˆ»¾U¸æ ·©zs~¹cÌåæ›Õ›µð×ÑÝ^ÚÑ3.nËÃݶ,Tµü²ÑO—g¹R–Ý–÷öÔm}ׯ%{ë€Ï/ß:jBÖWÎ8|éÙC>Ô£Kòœ©=7£x‚{êg‡{»7v¡R¿¨û²qm#iÒks*ñÎV§T5ÿ£ xŸ™rñŽ 7ûØñQï%ÉOÔ–"ÐqkôšMDQv8 µÂÓ-~êTå (F#XçP·ÉvœB9ü¿Üœ~ ÕëU-ËÐTå-¸]î^sÙì}¹¼÷Â:ÀÓn(¦ßŽêUR4Y¤Þ³öÂǽ+ù«‹rZûm¹ø‹MÃe/ùClk0lEôÚ×óK•mçÏYsÎcüðÛ©Í~¥qaïÕó+Ǿ³ò’7úÞüÕPôð A‚™m ·{fôÞmî›úéæá#²^“äUaû›[ÓJ²»òܧ6ugãŒvö†é‹×œyQâÊRjxí„ת£âöMùô`²[±ƒŠeÃ>Øý«‡½_}éG% %ý¾¥0U¢·>­<¿òÊyµþ÷{¬ß&%J"‘¶Ô7i¥¢–…³ö)•ˆ+N“@° ÌR"¾V°b¼Ð«! oL]sù°GÚ@ÝG‰vŸí݇٠»]êÝõ§dï`~‚!}ó¯Ì-g¥Ýàb®.=øE|}y³'?|æâÁñ5{Ì~{Ï~,Dï™/r.¯JK¡dÐäìyoÆã.nobŶÆA3šâãwå–Ià ķ/Â+‚æ!*Ý=;gåýŠ0IaŽ–fÄÓQͦ³†£õÑÅyE\Am¯‹ºì}&ÉwU@yꕇ3ݨÉHIj;@(’]~‰T©¯­,á)4ùjg^`û»Ùã‘©Ñ~ÿFÆ]?<­kè ‹×¥ñª0“.ß5„ç­¿9 µæ]·}Ô%J°ÆtE!´T³#ÑB³fãÑgiVÀp¨àWýÉý@£®)ÌXxC—àˆ£¯÷9}]>»žŽÚ–)(ƒž+B™W£,ÅïŠ`;=àíÖ¤ŒÂ+‘H•:ªj³ ÆmŲÀ fúA:÷œQÿ\rñ¦¦Âžzí²h«G©ÇuÊ 3¹A/©|Ÿ/'3ªb‰5¶Áòˆh‹ŠLO·–´"ˆ¢C½—÷[özù¿‘ŭ݊ (€P-= +žöNZÆ­#KÈÀÒM6çp´Á¶`GÖø$Ûðv¹rká•Ô°¥ÇÂ; ?èLQ›| Áq†JG- JŠ¥êQ~(ÜQ»ƒ<];=€»Óê½¥ÓþÐX»œ&ŽX{ýØœ;²`¶`yUÛÔIª’DA|ÿžè"fÇgÿ²ÇÆÙîƒ/ œõËÂõ*VTÅè{©äá³Þ{Ý•ƒ¯ ( Ä)#B@$•¿Ú³ý®³¯è±»äàÐKmS(‡ÿý­qp@ µÇ5•üƒÂu«Á€„ ضôÛHã|èÖG×Æ¥ñà!·ÁÁÚ’K©œ"òÐA¸†—¥é[>QÉ…À®®Ëñz;Æ¥eOõ^ñ¦£%5ÖVœœ¸?e+y?¹¡VUöÆyVÖ/ZG$fQ i½â6ý#®¹E?ü^¿9wÆš/( NBñîWlÍ„s¸ Æá¬Uo«d)F3H¼Íá;¬Ú¸Á/h ®L+?îMÚý±7­. R¦$iK}=œµô½o}¿cúbÇî:{lØ2í“O“ƒa¤œ»ýœsAz•"\¤)áB€’Q<þšaŸ=‘’ÿNMBFñ„G»/ºcäº6+~üÎñ¿1Tgi¿A=gí®w/-i4˜xsÏhÛþÀ YÛvLù[õÿÑ–Ý6䧈¥W þcKL4Bcxœ9×7–ß9èý Îæ7ïÊNâÊ„]CJ{,˜Vhj­]®Ù0êLXm %,ú¤Š¯×í»¼÷~2QQs*Æþ»2é¡GcÏó‚sŸ¸üÒ#/ï¹ôÒÑë³KÆ=¿'10xÅYÿª)ìÛ÷Ë+\“¿8ÈAJþ¾q·ôXzíèeF0yÚ–ñ?³¹E`¢ãí¢N¿%É)Øçó]ÇD¿`æ—Ed´Ùéxp0º½ñ1ÑwLÇm«1¯´ÓS=tÀK„¥—4À¸#¨o·Úg8…š46ÀC€: S„¦f‡-s à~ô.°Ûg,…R e@ôÐo@o?LmŸ_e6 …2#ÂùäoOÄP£=e €&À:Í”2ÛÃ[P(Û€Jí¿IºùI$¡/GtÚ« IDATex*ž…ÁÉ?M[JrªX‡€ÙéwHŒö-¢}ï#¸}oHlBg…·PXK:]à¨Ç,0FG§’³}WÇVuœbuÊ[ǹF'‹Üè$„¡-üèûB§”;n¼óo‰Drê!c¢K$‰Dª”D"‘H$ßžï¼ÇÏo×w!lp©™?‚ .à·"ÿF$É÷…Ï:…b[~·ÞÇ¡V‘K(VG¢û[À"yÌByѨ  Mª”D"99¢T¨ ™Q?[Š€6?ý‘ù <ˆ×QÕ%’»E¹@—(4yQï“ŸžD"9¹6ºyñ§Jf¾[•ÀáV”6G¢#:¸@F vÕAW"øm³¦£¼eÍòÓ“H$'Uû¥yûÓP©‹Š"Q¦(œóÈöR‡€¤»µD"9éJãÔAúøI$‰äÔåšÕ+„S lp.(´Ú …[àBœºk‡2¯€1Àmp.IK— !@ ?Þ&l@9¶{VppR+Çü;ÍSAö7© Gwà6ĉß!H%&ÀíoÊ·`*HÀ¶Èç(˜Âœ ‰DªT¸šáÊCó[2oEÿÛW ê¦ !loɾOX¹ªü´»çuË8…Ç‚ˆ˜Y¾ý?ïÜWÍIOrÓèi§;"é¡ÓÐ4çŽyKw)Lë+‚JJLœC˜ÁÌóÿJKn«hѹÑÒÖbF'%À6#þ8mJϯn¿,çwïd'~§«jÍ«îšT=þ“ó&¤ÚÖ×ôE0²ê×®~ý‰Ê† É=¦Ý[Ô7'!bNTücÔzçCS¯8}­£©`Jpïk7ïI½ó¼³»ZßÒRX-uF|ZPüwA3ŠgÞ¾#ú†óÏéa¶TÔ6Ç$§G˸¸É¢R؇>´ÖÓ?Õ³…) Ì–ŸjدÎÏt„tš–î-u÷¿j¤K‡#û´´ø7Êk[“=IáE ‰È:´îù۶r]‘ @ÑÔÒÏoøUÊŸ÷ÍÓí¶’¯~¨÷Mÿˆiš7÷‹½™ÁûƒóâJKÒxéÎØž´`õ’Í”:~ì­eGƒ{7/~ü®ý¥Fúä»6>×ZøÐÀ!Ý‘°/ú–V_Ôë×}Ücü°j#7mï õy7Ÿ19{Õ3÷8,\¹½/ytÀ®Ü6ç‘g²öÚ±à〖5àš§û¤ÛM;–¿ùÀÞ½äÎ*¼ôÉaCÒ÷½ûÿØ»îø¸Šã?³¯\Ó©÷.Y²­b˽۸€mL50½… B  ü(¡…fƒ)¦ºÛ¸÷^ä*[½·ÓéÚ+;¿?îN–Üâ$8ÖÁû~ø|8?½·;ÛfvfggîÙa¿÷ü•óg/"mŧÏ^0ñöÃŒX›~Ý8#j ! ²=²sšd’l³…D—‘âpy帙×Ci¯ÓõP²øýl§ˆ¾šåK?ÿ>ç†Ï¯þqJó?ÌÞÀÌêÞ÷*‘¯ºâ•¥c *6¯k%1 vu–“€žÊ͇Ëc&<ýÓ {?êàË‹–Õ‰ )eï’×^·_:ëú×WL<;¾dÁ,wÐd§·p³¤@n&YÂÍMÍîýQ9üå3ÅÞÉ—½ôÓÙÃùŽNQÀ@•ÔQ9DÏî%îÏ^ø»»,¤¥¶u³\E/ÜôÁ†A±»–¼ÍÞ¯ß[sÛ´Wçö5ý¸q“C…#ZLîwõ}æ´[¯zyVzw¬™-N~wüÔñµsßs§Ýyù«k§Ý{UÅTÔ  Õí­F^þƪ /ºuæ×>¦—,x¥.厫f¬üÍ×5-~»Ö#!Y³Ï4´ŸPøÒå"Ê€3#¥:åþîÂþCDáçL43ÑB¤ÿJœ‡ç ýnì[”`‰MrÅT÷º›µåµÞìó¯7 QCî(H!ýøgBdIÑwXòÞ™Ìóù:—Ú^RMFE!,ÌŠM[æÕT;Æ=xÎõטƒ5rM!‚®Ș w®@i®¬jÈ8ïÊ(‹^tMQº ñ«”‘#û .4Y¬è7×rMH»°O^”âƒäÜTj-QÚö•6˜s/˜&›S¦<’©pê4‹‰éÑ8©xIÑ€t‘™Ó.¾?Ý´yåëw-ùâ J› €0,³WQò‚5¾§Y­ôpÁd ÷ì_V¶ï ˜uÞ”žŽ“|¼“â`d»7`ÀتýûŠ `DÍç#´# èÞALe¿Ö³î«oZöô{«ÿ.bj»Ó¥rÉfeÄs´F˜›Ž… [v~´è³ƒo}lpª½òÛ×y4L=ë‰÷¶~ö÷å/¾åcÙn|©OaqBBÁÎÈ¥ªþŒS\SU³Y<Â̹¢éneœ×Ái:I<2!ÌƈQ²«8€ä?yRÛ²Ú¬À9p°ÛcÍî®bêH½Rdr`¬uÓßnØo»âì«o±›[׿p¯ÿ Ed~WVòïÓ²Î{‚Ëolûð¦•n[ú¹ÏŽ» ×ü_Ô骛†”úŸòyÿñ0¿ã È€t  ÿ ÷„w·UŠhŽ‹ Ó+Ký’"‰sï.sôY¢ðËŸ+ˆŒ±`¦bðÿ¬)1#Λrù…Àë\”ép1SÚÛ‰%! ª£Á9ØY&R¹FØzxyì”û{ç¦:níìÈh«^—’9øη{õúͯ,œùXÂ#ïÆÛXÌ h˜ÕXIiÀu¯£NKŠ ;";˜, älçLÉQçÁ¸¡íçú¨i ?Õ{ÎR˜.—X$ s8ê½ò±ûd¿>i-[Ö›ú={Kb{‹‹%ÀÈë²Î¤çE¸Jæÿø×{6,í\8Ã{ÂÀ¯ìŒp;"ÕÝPÖ\]®éài<ÔR]¥hŠ«®¼¹¦R㺫¡¤¥¦Z%ìž—F¸S0vPõìû‹÷W5®cåjoæð±¿x!…àk¯9ØX¾¿©|cÙv/!"Ø3'Þ¯–µ0ô”ÿðèŸ.£ˆìŒ$롯þÑØÖ^µàù=¢€DbB„ÔØ\]'Y¨zí‡Í€d{Bëž튯bŬ–æfî8ìÓƒÒõqÉ‹·nÝZíñi y€YüûÐ-ýû‰ÝýåËõuUå‹ž«3 HŽ ?¢ÔÈÑ)©IåsÞ®kmoXù»ëI@"!6Úæl.=$Z¡nõ›µíâ©N,{^fŒràÛ¯]Š»lÎ3‡=&ÖµS ÔZÒÚÚ¬(´ÆÙÀY½£Â׶Ý_’ìózDZÛqõÀw÷­˜¿¦­Õ§sMçf³ùÈ$ÔŠN/'CD0¤Ô^·å•+¾þç6kXÙìÛ¾ûË=%u‡6¼2íû§{L¸û£[øë}ÕÞnº‡$lÿà¢;ÞºjþW[ònŸ•—.v£0÷ÿ&³]–…£Ø(2Y¶X:o,Lf×ÎÏžÿê]ó_½kþ߯ß^¦‰ HN5îšK|í̇.ßV“5öêsÐ'æÝ4=W^øÝ£S77 ÜǪë:×"ûÞtWí××|ðûiõa§¥Û (qÐéÊw_?|ÞîƬ·Üg­ùÇÚyk™%BbF»tLÙ§7|öà¤ÅKœCncñËâ $N}¿(~ßâéWoÜ9êÚû¬2ëP8ˆäìKï»yîã¯Ú“`ò‘&0`H©í™k¿RYò‘‘¥#ŸÜk‡ˆ'ÿqK–±ûùÕ£:q(B8ÎÑ?ú¿(JkNÜülr£W‘ȤF–zª!Ê$V}V¸êsÏõ†¥ò–9BÚ+{Šä~ŸÜUsÑâÚ(‘µm0ïÃâKßð(Å9+ÿn»Ž³–X2îÏ-ö%ß½ùñ¬Ê6ŸY¼Mž¬{ ¤l[¥&íO ¢]‘J”ÓÙYJ Ms –½+Ø{xmɪSç±±Ò¾]ê8omY‚Œ¾ÒÂï-?ï#·ûû¢5?¶[M>Äë\õôŽ¸¥}w•ÕÆF˜Ýµáõu #Þ(͈’Kß)X3—Gå(–trü¨ô~íPN¯Žºì%¯ç•Ô:˜CKžV–¢ç®þ‡,%’ÖçîvµOòÅnz8­¦]5[$Ÿ·©èáò´,SÃÜÜMß0)œÔ&Ñ2¶ø¬YÕ'=·¯ä¦0PXøEÅ££:7ô\5ƱoÌ#÷¾ÝmªÌŸy˽իU[wxR§¨¼Ùì,óÄOz’£îÙ«¶š] ¶6µväËeYfÿ@J¥3F¬n]Í3^y_ÞÐ2îËšøhƒ÷0¤ÔÉm,Ì¿KíÄî@ˆœô(ÕÝ@07ü^»sâ}³o½·ÏŠÏ§^œ¾ù#È{c[Ÿlðn/øê+E’Íd燢.[ XdcÑc-©9 @ܼ©9;l(WÙ™¹{GýEó+"€9wE7jHãLðV‹£f® É¦0¯¯#/3yÇÇRg6èê^_Í8`º)Vd'rÁ“LrÍGf_8ìãɹU•‚ǤäÞõñÖÔ…¿OÛ»ÊÄÒšÒûéx¼)„@Gåk×V·»5µ€9·.Nb'Üù‘×f ƒ` H\-r™à X#@mAO™]‰hNM9±.†ØQ)âzì`§E_i¤šÓ2˜·IRÌΔD[óA§ƒ=ç_6ô“s.ÇêÑY{ì`ÛÖ§{nú<¢·fŽñJ&G|AÔêûr¶~k÷˜š²Æ(¼6ÂÙ֜уy›$ŸèÌ̵4mEŽÄ$ODpàr‚/*Õ+ €²&I’ªèZÜ0G˜¹Òú¯ØÚ‘:DÌ,í¹ó !vÛ2Oöu> Ç?†.eà×ÕT³0[Ù €¦ºž#tî€Q0®1ÔrºÃ¾žÑ½kÊçn»9fñå=»\E«<÷“¶’yѵ {íš®¦ß¶oày‚9I£u² .ù<³ÜÙñšñŽ¨VŒQW¦ÜÉÜ)ˆ'Þ‚i Dùÿ%pá8ë%päC:2±ó¥‘#±‚–Œ rÿ¿üËê oïJH’j¿°¾ÜÙ·l Ë­X—²þ~ì;ûQGÑ£Ûb~Š©Ú˜±òS³idñ˜KA ûž×r$D²SsÉox`A"ƒÿsA ø?¢D cÇtpÜáÙ÷rdezzKFÉÙÀ uÊ€!¥Nb1£€é&ħ`@(ï|tCÅÅÏ DB @ïxúKF`\::U[¾°oÌÕÔ.êVM¨ð ¾0‡¢LQ % HHÈ ˜æ€²ëP{ÆÝV ¨qŽŠì¤)õ ª#çÒ¶¬KÁ·ºÿ7o…åŸ×jE€ðÑ-ÒÿEÔ¹š3l µ„µš«ÂÃ|(X|2 kõB¼ÐÕè£ 9ãÀ&~±:JS’â¼Øbo‡:€~ ¦Qk;Ñ„4%{H§ÞÚ—&ÐZ™‰õ³DkŸæø$b`i]kÒ{¹q¿5¢*ndÕöüòªÔê»Ù}Iã+“ÆWRiþ§×$6_åLBöûr"h-F«êBÞ1'‰RK™È@@GÃd¯‰Ev¼iQþJÚªBúƒ- {€CJý+‹o<´P¦f“¦ÙKç$6ÙÛ2‡˜*–I¼ZÖ<‘‡¿f–𖜳}Ý34’\·:ÚÑh­=,º!ao›j/hIèA!ºðIÇãØ8v5mo‰.™#ÕZ8wg\Ö&€7îüö­æ‹µDïœ'Þ²aòäªô‚‚5÷'Ñ4¬ú*’™ZKk‰T£K· Ñ{>1S4y¢Øw©[ªV(f kZlq&!q$½$kùÓÞÞw×ÆGYÊ?b‘<¦îœR:tlѦ|Þ)¦Ê¥ÄËÚ¬¶#›!¦.mpß ¥ˆ7hM £€)¤&7Ç™J¾³Zû…ïyË ~Ý‹°ãd”t àžpä͹Uii¹«žl6ÅrðS“Ù|tOQ°£„´CýGô_ýû¤a7{µ}©[>oþ~eì¯ïï‰%k°=¡Tñê[cê«°üågayîp®‹àie1bì–'cÄsÊ3ó…æv)¿66ÎQ0nЪ{Óð'«LÞô¦RøÎÁ|’Þit:Ñ À¸º¬ç¦‚ª$Sò¦Í®ÞÓ½¢rdd9´å\š»ë­òqýü©‹ Æg „ <õÔS§ÑÄáó(i;v]xmµ-ŠÙ™6Â+¸%EóÆdÊ [ÌšÕ‘2D— rO|¾vF¯zô‰†qÉðÚáh)%µì¶;›u[vk¤]R<$ǹÃã»éÚçpWXX ÇåNÈÅpOL+ÌÒå1“Ukr{tRpÓºlB@Æ5äÓ=zT‰H±ÍéýXÛ¾0g«’|iÉ€1\_òH§U³:ê”Ô«Z? bÌðì0…r®^C‚nχIiÆX¿(ö IDATâ3`ÀÀ)q¿Dv›”/§×ÇÔ»@ M]Ä*A„ ªœÀBÙNBÉaÐêf¬> œL"XEè&¹ÉN¯.Å 6TA¹#$w½baH |½äPÖ¥t×ÁºJ(sKÏ€§„Ä0“ñëR 2XHZüˆ ¡-¥4 ÙQ0`ÀÀá~bwbF"O 0Ð}q†¤€¢ ùŸ ¢ $bðn¹ÓèL*cÝ—Ò“·Å@?3$Sà?ñ¨|øßÔä·tª4‚?ý;µˆG×l¬ðß&0#AÿÕˆû)—üÙ‰f)ò ˆR𷆔ú™(HàÞñþ×O]¿§BC†(Èвñ½ï¿pæ£×­˜¿‘ˈÝ2+"24¯žñícÌúó=;÷´ bˆq d6|ç²o—‘ þß%³¹ì³‡/™õð%_þå¾Ýû[D ;‰RóÆ¿^³u ÿ+7äí¥+^y²Ñ£žj1ˆžÊ…óÞÿTÕO=/ê­{—¼ül‹Ú‘»ƒˆ™±þ‡{V.ÜÊOÁŠAD€ Ép¬XfL­øöÉ祓„è­Y2ÿÝO4íÀò¿Þ[Õ¨ÑÏk=Ad¶.}`î§Ku C®CJ–|Ýêç}³ÄÛPáU ɹéí>ž›tÞs¦]Ô4ïŽ% *™Ø à^ÿ—ogoì1íÕ³&æî~kZq™‚@wVºÚÚ Á×\Õ÷¦³ny~ÜÍî[`ÙòÒÅ›K4AÔFÔ< å^…;î½QGà:À.êq—‡Û|ÿR]MµZçïòZð7v.¸êloiÄŽªÿu-Üçj¬ÓéÈ–Pv¾²h…5o|ÿ@ª+<òy—oý!ŸyÍüÏ^ú‚LÁAíÔp¥­®Í© ëxHÇ–\mw6·)®†jM£.ºÞÑ‘À ]ѹäbý¯é}öãQe3Šwס¡LøãLÅžÐu!sÒýS×>zS⤻)2ÿú×IæBáY£g.ܱÌwÎ5R7ì¼i×Ò IW|Ø·O¤ÎîshÉöµËr/;;”},˜9&;6£$æõÑ÷ŽÝ½b}Q‘Øé"0µ—훿²Í+Æ÷;?-=4Ç’õ‹Û\–5¶÷€|Ô‘1wí¦+K«t12¡ÿÅ™‘¤÷–\1Ïácrú¢ÀüIÄÔ†]7,wz…ÈÜszõ`\©Yý•3y$ϵ¹*56üë±m÷œ²ýå,¦°çYlˆÈ\Õ~¨*¯áRt​ÓÓÃIÝ]r`ŧח•Œu’ÅÀÔÊuŸ/N¿zvœªŠ@m•k¾®kh3§Œè9hÌPs(Y»ÔéRäØ>¹CÏ2³Ö ¿òÕË›çh½¦\)–/Û¿m»*Æ¥ÿMj<xýÆY‡JÌ)#{(€VsxÕܦævfÏÊvn¤]:Ñî ¹»êðº¹ÍŸ%eXïÁƒDÔ[÷,©7õ¶–Íõ¦LÊɱ•¬\i‰2WræM&T­?°y½G“#zŒë9 —À½?Íö¤Rw-Š{KÞùç/YöC^¯›D2RH0t©ŸBÂÀË¢¬B§ô­BlÑoú%© éue-RR¾Ôב§¡¥]H͉ÐÐ}`ï]èi.ÑôŸ¤“ĸ®ë€‚©kHn­tÝL? ÖVµæ½×ZÛUî®X÷Æï«Õ¬ŒÂÞµs^²ªJ4CÝÍÿrcDá„”øÖ ¯ßz°DÉ·çÍ[T[Óûõsn|¥ªPoÞ½âõ‡ÄüÌüôÃ_ܽlC“dÒ7ÏÙôås­¦ž6«©ó¬ÐÎ^¿Ã“ߧmÝŒ¹¯+Ô|ýÇEßlî3!9¦nýëw”6€ ºw¿q{isTzß– ÿW×Ú…toùÖZm`QU×€ÉPöéÛöxzõi_ýÔÊE«Z¶Ì¸µÊ•Úg¨vðÃe‹V£h‹HÍBk¯CÇ°’¯ç¾õ¥ Žö,yþŽR·,ˆߎ¿×D§äDšýЦ5u‚YÝóÚ•;öSrÑYaî¥Ëgè;ÁÕ4B$ݹýÝÛ6F¦ t®›¾hÑN&‚óЊ-³>äʈŒ‰Fh:øÝô ›ÇöèÅ«V,~}º'fpV~jéç÷,\P.šõº5³6}3ÃÞË"“-e¤©ne­›V?†.õs[›!™£Ó3Ð~zqS}¿ñw@-˜Â·;YÊH÷©šh6!3E‘æá¡msá¾ÖŠæ*Iuîýrkc€ë1½sL%–Ô÷ƼA9ÜÛ£bÝïœ^]nþ¶ÚrÞ¥çO–Eˆ¾xçÌÞnótÌø?]4H@¥¸)iÖ¯k÷7õ´¬).3 ¼áúÄhˆ¿çPñ;¬µä»æä믘2D¹ÖÏüâmçÈGj`ùÍÐ ÆswçÜ\†Lºòªp’„Ÿ¾þ~]û¨¸I¹p„Ê@…˜ ’έ;ìÈï­‰~Ë•‰‘i¹­dß—$´7–Sr?»ÄAh[²e‹¯ÿw¤Ç@brÔž.ÎË~÷‰¢×µ¤¼!û–댲FÆ¢•˜¸éÓ9 ÑS§~\_il@Ñm¿}É$F€[?ÚR¶GUÆæÜ<3ÅKDº©p }²È«pùøÓ´Æï´L¹ã7ሟZûÙk4O~‰¡®À”Ñ—ŸË<z-A|ÁØ«³zDU,¼_éw÷ð1Ã9ÂøKV|6ûõæsŸcL—#¯8i÷ 1v{[y­/3ת° Rêt«((˜¡zÞ3k7ûÆüáùh:uÃM"¢€ŒëGò¦*ÀÂB{+KZKɲ}ÞíL ë1úîߧ'×èHï#3Ç'‚¤ë( LmÜ©¶ªk>zÑ{@m­ol‡È_¬\¼+6¯ÕÂ>FH­û½R‚ÍDÀ¤›]dJË>½¡|Åûûº÷é-¾&ç–9¨ú’ŽÌ 99]&â:J±).vºAÜñéªåãó -f½Mb yË^Å”`±r´%¬‹ñÕçsŠQH@¼i»GJ²Ù€8IQýú®µì™óLµ–›§5îÕôžW<Îæè|›®‚Æ­¹ýI= é–¬\AYÌ é(ªó_ØS–Á”zŸ.œÐé‡V¿ÙëªÚ4ëY Õ*oó¾ÚV'nÎÌUÐ €Yl&«•sò:*"“£¸„`JÉfúJ—›çæôlÔ@0YdÖàT­/3`H©ÓÌ'™ õßÞ¾dMÄ9<ogZ7Íõ@hŠ 3ù›U%q_ÝAÙ:QåS)@9aÀ5ÃÆ  Cì*¢‚£Ë’Íš˜ÞsôDzM”áríÒ¢.™9²w8JŽukf*Àd*ç~¦¯qM­¶ô!½FAÀ©½Ï5GHÞ À1 u=¦PWdQ©Ü¶d~ì•_ȵ¢Ø¼zõlLFRüê,é:ïj~e(OA¢Á§óÀœ^ñÑ®2qÂÅZÉYüII¥«cF L –Ft$ !u¼ÃD¬ÿvÃÚÒ!O|›jˆŠmŸŸl–Ëaæ¨9£/33½&ˆa6½‘ ]Sd!dÍO9è^@™1€ÀËÀ‰0Á0÷ø%ãLùøq]U4ÅG\õjŠÜ»>Z°”F?ðBœEÑ®uÏÀsH¦¤ìžI¥ó~p*ºî*ÙûÓÁ¸¼ÑRˆ_F? f?é«æ¤1ØÞ,ÇäÄeæÛeÓk3‰œëLbÈÛvÍ)s 茮—×—µל«›ÛnKª¶´XzÆeæ…1G›/L>Ñf ™Z¹£®É HÍ{wë–¾±\ÓEI @îØñeyCÝÃↅ)eU⪣bm[{—Á°„Ekµ5:°„³b¡¢æ@­®ëÍ;ßýá½/4Í \f¯©z×bOõ™IwkÄ¢²ê6mr«:øö¯øóÔu»ÝÂÑ"|œ›@wÕoù¢ÅCüºq’ζª ,,=63?Âí^“éž`O.jݱťr$¥rÍF7*ÚÖùêry .ÚÄ sŸC—ú™Áë·¾þ»j¶8[›>½­ŒEöÿã+ÞÍ ¼ª{Ç›×mÓ €Ì £FÞx»­ûmIÒ.x(ïŸOÍûëŒ[áC£%CÈK!pÅ©ê èž6UÕO"—5·ÎݤzÚ9×LIgåm[ýæm‚$©^H:ûÁlsvÁˆ¡?}pksRBXÎ…CÆg.ûá¯YEÏ=ÌÊoªŒJ´Ç§Ë6]ç<¬Ç…»§ÿôê-‚$j>!uòcˆ {Ê14æbäš…Ïï®­s¶Qßë_ 7GöÙoÙ;77&%Ø{^<䬤•ßLO/xv褫?¸ùpdBx|¢`Vy'÷°ä©áÓ:ïu)èBþÐk®Zýí=ÕóͺÖûÒ'ä´9±÷,ùÆ°è´”¼ â·ÿcá‡éã&çYþ2ÿÕ’—ß–SúÔÓ¿¹Gξv`ž½f}»"k~­Š+NE÷Pì…ý‹~XÿÒµ{â’ã ÏÍMxqé??{Q”êõéŠÇÙqf‰`>`̆mïß±ÝdÖ¼zìˆßeä§rÅí;âq¡«'ç±EWæí{nÑË·J‚¦°^#o¼Î̽º§MQ%j·7£(^æ†+º_.NoLtèpmºó›8j3´;€ßút†´=ȉAÉðñö£ãø"Q‡Ýý×yºiTÕ…°®Ê3 8÷[™ð„ª/ù›8ÄÀë# Ó_;&vºH}{ì· ñHGÏ/ÓPK (&¸w¿zÕ¾¬W.½(SW€€º’ ‡ü7’Ž®¢óË \:ø‘:H¢à§Ž¾% 4åX‚e®'UÚüïvtBýªG7ך<õ\ÃÝÀÏÉýÂ`d:ÄuãÎ3çãwœE¹DƒÜ²Ð„œ•/hcì_½ˆÇâÑœ±ë°v꟎‡'üØâÈm^üOj HXn-¸îÞÒé÷y¯gšGöI Á£k?¶‘uz;ßPîR—êÀñú­«íµó?ŽšfŽBPkn]ÚÐ÷Ž †|2`Xü ]c1vüï¢Úñ—•b‹%ö»ñ¹ø8‘+Þ€!¥ Q1…ÀÁ”Pdú%5‹@Šë›C*0ðË„‘¹Ã€ üŠu)ƒª‡ÞntD „xè#ùGÁpV6`ÀÀ©q?w£„§×Ç4{@M7Y³Vš¼!oO‰2ƒK yqkÀ€ÿd„ð_CFy•Ãû ¸%ô= O€‹2àëÀÊq%T/ …Ù‡`G“±ô 0pJÜ/7¦fBþ¯AJé‹+aQEH•O‡ñIðY1€Ê3N‡Gú XPn¬> œ†$À¤ÔîBÌi?—b]³Ã…Ðv"p¥CÜÅ„†î(0`àLp?Öx…áãgÀ€º/ΔòÇ}Á .çyÓñD`COwýA:Co¯D@B°·ýÿ @ÿysüã%vJ…~*{6"`ÿ]7vÔ §y,üAÑ…SmÙÛ. œ9)EZcÌ–ûƼ=8£N ¤*à ëÿ0䓳‡ã$»  £–Œì·j9þG݈ÞJY!`‡òg^œÐ¬œÞXAˆ¦º¯,xG8•Ø®¨Ä­ûÃÀM»A4̬ üW8#±'@Ûñl$ëÕfÞLU¬Eîþ{nMê¶ þìšÓ_Û{sŸ-#‡A7¼åƒ€õŸ¬ÛÕ?BCØÿ¤¨†>OïëÓˆoÜùPÞO/n¹ð ë"A`— ÷3þÉ¢0…üW#Éÿ;îàÔoI°0è€/ø-p-€U h\´ë¢xô6FVø@ *(þrT „¯¹#:yöáÙ{/þ„D)°ê ¼ãCÔTN€Áw@èÈdæ5dÐ;½ïט9€¾¸ ¶ŸE:—ëZB—'RãÀçšI [äïLêD€lN7ͦfÀÀ¯TJ´äý©ÁÖ^XüY1 Îœ»¶äƺ-fÂëS’êJÖ/ù mÒ®s¯¶|1²5¤í9È«f ÀðÆ‚‹²K>³xÁcE¡}[Ί§b›[Ô˜s‹ÏúC»E¶~;Í,‰e•ç J9èÜzÙ#áëîO“nÚ: „/¿0Ú6¶wÙWè#¿?”ÑÚóÓë¡ÇeÑ»¸rv[˽W͈p鮌wºJe xEÆüûÓªëÜÙw–íÔA€d®ü²×ê·í>ò$ýf÷Y·y%_Òâ»ãcorTþ5¥®ÙqÇ® W‡-¾¦ðP+ì›ÂÄg¤uoÿy]´,´oÌùééX‡C ¹ìŸZÌû ç~Ôš˜¹ó{QÊ)™ð÷Ú˜pïÌYùLb] 7gUø[YzB@H «Íy-åݶëu+O:4öq8ürƒû<7ïu­Ðô}ÁŽæíã«k5©+Ï(;@BtýÀgö*ϬÕO¥TWp9¥fØôÃYI1ÍnÝ™ZÜû€«JÞسxØGí=÷… uö¼SêÛZ ŸªÖÞŒ ô`^ƒ0Ð,~(hÖX@êlNÑ­©n‹@-O-ihÏ«C·´øqk¢*2€Ð?r@1p|`©Y'JéŠ @õ™‹ïa©¬›öcIRSÁªÏe{Κï«Ïšµîâ'ÅúÅ&…¸Ê(¨êr〘îc tgx›¶ëâ7êμeo´ |kõ´™ Ú·ý×®‘Ǭ*Õ;nó•‹‹³Ú3Ëœ¼‹¹×ƼUŸ5Žüpõ´ÙÕÒÊ‹ç  cöï¸F~·úÆ/­oöÜ´¥eì?*ìBÕ¸9%iÉ¢êCbµÙ ÿY¯»rÁÞ\[Þ’×M bØøõ7¬ÚÖ·GÎÊo‘©É[þó»5×þ´é¬ó¢6½®tRÎ@wE4ûv^µtËä܈=ž_}ýWí­Ÿ¥6·qäŒë€~è$uĆi‹×ŸûGÓþwbÜzìîWblW¯½zéÆ W…o›¡ˆÀUÆ9!³”|÷ÈÚß®-‰.Ë_ñHZÒOLÀ©®þ±Ü´°çþz΃0Э¤Ô ÓPkúOÚSþ¸¿w pêŽÎÓëPÈ=yð•Âù¿/\poþÂÛúlk*þ`» à˜«õ+-©ÛšúÞæu®Š­ýQŽÕÌMY59“5FÿzˆQjM½´=*FhþFŽ½¬,'›ì •C®æm‹n®oxÇ$z³n*a]ÊC¿ãίIJ%)¶¦ïTÿy”Wòiiw5D@bEŸ>–¦ ŒcÀÛÿÝAZçÄhÕ=‡è‚Å‘}Y;_×®‘µwef¨à‰ê¥©e2 ªd•7DÕW*IWl»è/Σe„àH™¤sPãÆx£ÕÇD7»£âln_™\´3ÇîèÚ1z÷/7›ˆ‹V¡isT}©wÁö _pˆJ`槨ÉeÉ AKB´ïg¾²ØV­vðõ>ÙâèÿHµMe†‡…ÝÐâwîïL]8-Æz˶¡çq2,õ§{³ ¸’Î/ë™j}Æšã?¨‰ŽôVšÛ6 üpTà5=ÊÕ*’˜ï?AÔ% ±SÙÜ n²úªl¥sG½÷^@2òh«Û+rðÈ €ƒb3å'xktSßÀV@ŽÐ°]V9WíQÀÀ…Üdîy½•LˆÐýR‡Éš ™¼:%êHìÀ?Û^ÍZze]7è…}……]Ž?¹$ £ÎçŽDµgßµO}7kÍm=½æ–üGvßÜçÑ|#cÙuùJxC¿¿ìé߯ã3.ûˆˆ €@wIÜì5·yÂ-²!¤ è^R*½ÀŸDΟAŽx}ê’[ã-·n} (+2±v'$@<"A‡#b(æøAÕ–íŒÏÊ+-XÙoÅ»-ßç Kº×Þ¿øü×\’ ˆV÷TLU;‚ ¸s?7G¸,,ú42_g&sZ{zŸcnÖ’ cS$ã&ÅßÌm°té:Ý”,øÚ%øZEŠðIÌ„LjkÖÐÓH,“Ò 39k[¿ï÷‰šä0 :š(¦Yë‡<]?ôi©ú«þ?Þš‘¸¦,æßSŽ™J­y¿ßÚ÷÷¬qeŸí•`fY´ø­çî\+¸UL².œxe™2›Â1qË—¢¦„oŸžàÉ00Ðí,~¼6{îűª˜d[s}²±ÿŠ¯ ½Úööùî?3Q¢&îœò˜¯;Jv±í©üƒ» Áêo8{ܲ{ØU!sœSÀvG,ñÐøÛ‡üør|î€úèøÃ^Ê]þäð-ÝZtè¬'SôÁá“ó—_“é¹cÕ6Úón®©y`Ä;³<™·”ädezt䢉#MÈÚwßè›z­¼1Ó­û¢ÇïŸ0‘4Ö0ìñ°¥ üü WÖïôJOÕy9b¸wÔ´^+¯Îö;õÚMc§€æCÝçéy³iÛM#«j]Ù÷ì.ê :4Mì¿âNf{VÍ„(þð9/åüôÔˆ­mjÔ¸âqw(°Ÿ) Õ¡À suá•=W=9b]+—SjÆþ³22èƒî߃& H\ RÀªÈdÎPàL¢ÖÜÛ#W=>äóHˆlê;ý`B³^¹ê/Ã67’”P7âeÑ‹g,ð‰¿”¸ "‰Uãž [øØðOÞiðìᤠᆘ2`àdzÁé<¹ukpÉBXPÑÕæ·øÉ]_U„®û @=s?‚+sàéAû1Mªÿ Nç½2÷_ê–¼FƒÝWÂýë`^y'ýƒ.c€r¿Ñ’!HÇÜ(ê¸u¼/ÅÊ>ººbóå(ñÏ=H|—;Xè‚·Ä@ã–ò"¡¨&;Ü;òæü¾}䜊”Hƒè6X–¯„Aq¿Z]ÊÏŒ”cžëGë#Ø-}ü‚|êè§!´9A€ ÿõÿö³u嘿v–Ä Ó½¢â õ˜>PŽútYPOPûQ;ÊáGÍbšKÔTP;& ^óÁ‘étÜ’;šéo ÿ‡z¼ª;ÏÌ£ŠÒNüã¸õb§É¬ßñËW`>»9jŽék|ˆæÖ^OW'"Ê€îfñ3ª›,ÒÒ~»ò:•þ§{n©šüuuU¹B¶yäÄ⩽§pB#b½†”2ðs(a~KÚÿXTt¨&¿€Ë þ&è'Ð# 0ÐFæ 0ðkÕ¥ Ö )a!˜‘ Æ Bd„…r®^Ÿ"ƒX3¤†³Ý€§Àýâ- t®}z}ü8A“'Tc ™°ˆÐì íóˆ6KE7VŸN ’DmþèRœ`K Tµ…ä8õˆ‚~IðM1H¡ Tçð›ØP•mÆÒ3`ÀÀ)!ÞC»MH”Óî=¡sPõÐ;& $NRyhŸmkˆBu 0pf¸_wJìgxO0`À€î CJ0`À€î‹3w_Šî(««j°g °[0Þƃ͵µÈָܘÄ(Љ°Û™©ˆP›6ÖÔê,,<µ0Â.rÞ )=1ÔšµNDD&"èœsà$'d“Û—‘ÉþÛ¶"â!+>8ЄˆL]#82ºD„ ;ʪ"³zÉìèDÃÞ†ƒ=>!)âßõÒ=u J\Zê1OD€ ;Š’ÀPúj·9ôô¸”hà†Q×€¡KýlËÜ¥ózë¾Å¯ÿ¾¤FGDòúqñ«Ú»{G¾z׶âv& v?Ad5?.|ù{vï®Ùðæ‚ÿ{ªÎZìAo>X{pký¡ ;>úã’¯æ×ÞV{`kKCEÕþ}üg0I#qåЊY§‚§m ÀiMˆˆÔ²~Õ›Qê4ºˆÐ¸aÆ–;—£S¯_óÖòe{„ßãÆS³lå—_ëüx„¨—~¸ja)“Ž7ÏôÊ-ÿ|ª¾UE0U0t©Ÿ‹GV¤•› IDAT‚Z¾n^iÓ+÷“)•[°qOŸ3¡' ù)«Z\Xx±È»]—1ôìþæ#o¿.œ–GH‘/N(^¹=vr A¤ƒ9ÿ’Áù ˆž‡¹â§ ¾$OWˆ(üJ@ t"÷ëGˆ@Ä) 1ð„È/;#­¥zÓ[ÞÅDÐéOˆÂ:•|!Pš¿(èH/xèW(ø­ÆI`)ŽYÁ¯…ç ˆëþÜ`@ @UðS ´<åÛ*$ Ä#1Óµ=Ûî.¸ãú_ï\  #â:2D â]{;>=¶ßuOæ$‹ÅïÞ¼U›+j8¼½-bRß>bíþm•%Iç¿8pHO¥öûïßø<µWWK“³©-åÂç†NóGg‚gÛKWì›]½-åªç3Ü VÍùA3ÙuŸ–8öÞCû¢§jëG–¶šì‘ÉÑÂŽm‡ÎºaÆ[™T5ê³ËÎIÐì~xmÑ£'´m}í¼¥ÜlÕ|˜>éÁ¢~9Þêåk¿ø§››Qk§¸Ic.·gÞWJKÔÒwJ^ó‡H €%h[6Ý=1>ÑD¤Õ,{q˺bÁlV<,}ÊÃú§“¨iÅÚw>mª«js' ¼íÅÞ™xèëǶîn6™˜¦ò”ñõÖÛµãÃÕß-à–pÝëìÿÛáçŒ>2Ô¦ýß<¿÷p‹$êŠ3èúGb[nØTác/­Yx]ÿÞ´áÓ·ŽJ»¥çU#.ºÀ"B|þyëßß6iTDw´>0zRŠ ðNÖ à à.žqMq ëÿðÙS¢Ö ·†ÈU—O•#lèO(,Ú“uŸƒó_‚' 2Y6›€‰f­‰ÒîüÓ[ËŠé×oÙ=á²Û¯—*gÎzþ½†KFVÿó/Í=ÿzþÔè«ÜüÊoìÑ'vÎÞRû9½-*ûW+º˜qÅÊ^pÛßb¬ÎªÂk']54Ì¥³ÿ°bþŽÜÛ†H¶0¥\Èä¹pÏÚ/î¿¿®Ï?ÇþîNצ?/Z³¨ÏÀžÈLä ¤ ÷e§E´oxáË™3z|1*ÀQ³+•8ô¾w"¤}‹y'ò² LUjV,yï­–¾¯I‡æò <ïwY…–ïÞe²…!€h±Kb`xs¸(ËLݵî³ÙÉ×|X˜ï9ôýÂOßÉ*|¡mç—¾¼[/Ͼ-{Ó¢ÝÏÌ/ˆWõ†ê:ÎÔ}ë>|?úÊÏõOÔ6/ý¿¿W˜çèØ?g[Yâ¹w?nåU_ܺâ£o¦=zY^æÛmž5%yõ—´æ¿xÞEýÑW±ñ•Ûîí_XjŠN Çâ²Þ/醘2ðËÂá¬';ÄÍ™—<3ü⋼kþ¼~]•ß0Ó fÔE1éLjȔ”e83ÉÌ^ÐßD€áI&ô(MûªšÅô!…èsé˜Ø'¾±rÆœåÙ²ö£‡Jªí=F'&Dq­‚ký¢g.üðžs~ZºÚÛÜNˆ¤kÖCÃDk‚™ Y=P!24ßÔ'&åÅG‡q ìY½emƒ£Sò)]5÷œP·¼NMJÈIÒ}nÁžn««nÑ|õÛl™½-²¦¸ŒIÇ?©A‰×,jÂô¸´Ýç‘crlx ºULä\ô÷•ß~Uß*¦›)qŽh H- Í–š€ZõB_T¯èøpD!<«ÐJ{«›I5÷šœ)“’÷U[w»ä¢ô$mû›îÚ¼"‹²ŠòYòz=%¹W”£zÄÄ{ªÜ,˜BÅUµÞÞ»ÈÂTÕ'$ ꯕ.hö 9öT6Ëéƒ ÀçÒ!!1?¦¡ºÐa3«õÍ>4œv ºÔic‹\q6¡5Ú–Z–]dÝóÙì×Z‡ü5¢ÛYýˆI6“¨´» Ã4g•h*d¿8î@z†tU ‹Zù×5KœPÌŠ¦ü³ŸüàÀÊ*ÿukƒ–Íó½òÀSöÏU ö ¿ýÃԔȆyÍß”vìX02˜:×K~Ä®ÂF0ËHÀ¹OSvÏ|äê€Lëk‘t…@ŠCÖɇ²nê>µ½|Û'HÈ™”ÐÏ„<ºß SîÎ.Ù´|ÛG_¶KE£îxX>vGE\çdò—¬yE„ uM# `9p†%˜€š1üO_$®ü¦rë ç”ÅŒ|DŽÂA R‡ÈPÓ81êm[g-¯œïojö "¡#ºi$jå_?Ú$r"`bvìÐ(d ‰ëFö†”ú™$ " 0D îýö®;>Žâúgf÷zQïÝ’-¹÷Š1ØSƒC ½þ’’ÐRè„ÞC „j÷Þ»ÜeÉêV;Iwº~»;óûãN²äBœc öûÑ«½-oʾ7ïÍ+åóîo.|䬉™Š€ ‚8zå609-=Q.ÛT=ö’<Âд~‡=ÿ*‰áûæ`uœæPk¦k†™OLÄ DõªÔÎÛËÜ¡ŒâónVêV<±iË®çe B©D×cÑ”ôôx*BM9fœÀ°ÅÕ¬ µµQá‰NÛî|D°Ä¡v:¯ÿŸ*LQ•“ .[V ÑC(å- ž˜!“ `,äq)Ka7n-¹òé,‡Š¢H’ä®= gLñã©PW?vuéÞ›Ç2€RJÀ;½;µ:­¤£µ"‘¥Œ‚{‹,P=®p()%‚Ð`ÕAMG ‡ª˜\`T[ê*;ãڜɷ̛÷ê?üCϲF¾ìhGF:\<%Á$±…ÆÂg^9›s0᪳Ak£Ìžc×ˬ'§SET¯Fì J ¨P‡ ÝܧC·øý/ø<<дu~ÙºAEkÝ3ïÀºå^nÉ*×òÁm+~}péKs?Ü›:ù‡á$ûÿWàÂ:èü Õå7¯\°hÏßoßp¨hÀÔ´ïr‡Nw¾NS_Lc:ÜóÑS1ÿ:®2ÇÌ^÷îûvïn*ýÇüß]¹¿ÜÃ[¿XüìÍ»6ni:°®ºtgRN:¡f£ZW³}¹Ï1Y)_US¾ûà²WÜ.N]«š<ÝͦBÖ”:Ï)²uí—Ÿ7UnÙôÕãÈëÒÍQ¿ÁQ7Í6môÇîüõPåžêåþôºƒª3ÿîw·¬_W³úݲƒ rzAjÇÚ·[[küµ2l BáΙÆh;>yµ±zwÅ‚ßòÄS~×槿~ó¹êý;ë6Ïm $dåÚ%“4¬¨Ø³+¨D]Á—]d÷Ø¡ Д ŠlYð¹«jË–/ß“Çߘeæ$ÖñÑ깫[öÎ_ñEEò¤+ìêæ5Ï_½fáꦃÛ.ý„¥’§™`ßûÉ3‡ªvXðd“팼$9Šø¢s-eo®[¹ºµjý†ç.ûüíÅÜÀL[¤|îÁCæQ³†Õ¾sçþ=»›v|8ÿwW¨hˆÚÑä ¦æ¦4®ó4ß7°‡~ød2tT´£#|Ôö’ð7m]ÔÖ.ŠÇ˜Ô[‡µpdJîȬ‚$_Ý~oÀ˜3ã–‘“‹ˆ"Ä©‹DJ° ÃŽÒ&0z¤*H‡ôÏì¨Ù”˜swF<íµQ½\ $uð„³É'˜5«$9ÕuÀf¦¤ä¬,BÀ,)É™é„@rdI°KBR|R~IBñ¬ÌäHsÙV›ä꽨2Kš˜“erU”¶77;K®,1„2«3ÅÒ^}Ð<øªþéÁ†ý¥L»Rv€"˜™#Ì4pÅ[ü3ÖÖZ6áJíÛú5Šè[ ò¶`êÊßĥ߿¿0ü$7!Á6¬¨™zkà¹BÔ¸ÏfÙ{†ôÿÏÞnhùº°"¼wìùâ¨üT# €Ò3 —PXwÞ›©ýøÀ°Ñ‚ë¦Zº”:+\ë¿Ú¾žZŒªè&¢ ”eí}×È]ýXÛð‡¼6ã1EØ7êäØ'ñ¢¸—pCG¹%NéÊÈ£tSw@5µô95çž;šB!j­t;5ûvª´Z:B=“#F/&``~9òÐÍ›¦†zäùÝN¾¼'1ëEW‚SŸ°:t)õÝC“µ”³ßïãë:Íz±Õwâ®?óøq<¢o˜Ä5„-¿Ã°ˆÃÀ4K±/­?TàAk$L@¨o_‚Wø´²ä–¶HâäÆ,gÒþyÅêÉ?ßã0‚À\¿(¡¥šÒ”ö¼Y>»Rû†”ú½Œ“pâÄæ¬~Žý¯%6–v¿á? DJ“k¶4‰ݘ=DµÔ-µZF„ÛÅy¹?ó,·¥1õàF*e¹ Î) Llnõ3Wbs½°6¡è” Š­jÙ>Š7-ѲÎw;dGÕ×NO;7´äOÈ”ù÷&¸U¿¨Lliæ¶M…“ÔØ ´}[Z³|¨h8@…­âŸ,áLO\ @@<Ÿf4ØöµïIm›“ëJea&OnÉÊ ¨f©þ4ÑåVâÇ6çæìM­ÜdTTÕ>¸%wœÂ„7®rÝÛ!ŒÙ®üi!c7Ç Ö±;¹f“A“©Ó]éRû¶ìýŒÏK©aÍYÅ–º ®:ÂRÛògù­2q¨xpѾծIç‚ëÙtüpqª„s^2IÝצ` µOä×U«oIT+X·<ª ´höRÙ·#wÏR& ùJóWÜ—éKw¥§¤m¹»dÉ_iât¯¶tТ'ƽ [ùœCCbã …w;ü@xÝ ¥O ÞøäÄmäÕT… „0{ÓF)êþâ¯mAš7.)~ÇCÅU `ÂVýiÑʇìÆÑm–Ê‹oè¿s½/{:o~¡pû× á²¼ew4‘Ö¼‰¬îµa«—A" Ñ쪪£üƒ~ë§$DÌ&çÆŸ÷ß»+4ˆ´~8dÝß)‡äÛY°ä¶¼V»+oŒéÀŸ‡­[IŽ©ThÌÞðD‚€ï,Øð¦I˜»ÔÇÎ7yÊA#@k]X²è ‹Ü¯#NÎXySñÞ:.Y •ç4Q¿ƒ¤¯¾½hO P5`þíI¡¤Ž”"©ú©># ‰ë®+(¯ $ásK–¿!u3x’ŽÍÞÇ3;œ,{Å…5>Õ–ªAë@ob¶y×%k>ÑâJÂêêÁ‹~c @øR'Ѻ¯ìªžýH‡®K>yTBÞ3hõ¦†Yÿ ©oësÊƅИæa˜\5p¬ ·ÇøjbüõÍ™¹p^ ìþ›Õ߶}}ǸùõýL cIËìäúÉ¥F’Õš=Þg2xÒ&ÉÜ!šÊl¾¤!³8pΫ‚0­)mÑÀ²=(š. Ázy}A(süëFÒ/íH°ÍLß¾Ÿñs•G,9#`ª‡žž9ï gdº§s«LNÙùcÎÕ¨}-õç½×š¤d9¾¼?.4ÇA “ˇNPTŒ˜8yÑkÖI¯ÄZ—8¥Ñù×Ü=Õm£r¥ýoX¬gµ%cÆ=áNlì &_=—åßU1x<_xÕØ/{ó)•fï|¡eÃ+>eù%¿¡®ß™n‡ìNÓPEpIA¹¯æ‚»[ã€ä çW7'û¯iMuâ¨ÿÂ’rÓÆág‚`gpݸõ¯U^q{H–4sÿ ¥©dÛf÷Ô% ù20–5Ÿ—ÔXîË+ÖÌT—èáÞDª/ÛtèRê”[¡ÂI;ßW†>^—2²fÂÐm§Ê(¨Z8 TIH¨Q@#ÁZ3$¥þoùÍœ€!¹£ýæÔ¥?V¸èzÅ>À“}f}ÁX¢vV¼P³6ôמ>Ù·/}Ûãƒ=žíÍBh´óT@ë–2]PS8~¨+w ™êhñ3nŽu©AÙ—yºË¤PäNWly 8DP=M°Ž4NY¼Ñh MrZùyK7^üÑæ ?Ú2õÇBž¸ëÜgÛ­ºÕû`*l7+–Û6“20BBšGÝ‹2ÊK!9égÕ˜lnk! åQ‚™e$T“ؼ›ðð ð\Â:ÊìþÆÆ}Œ ð™¼pLñHíÍêHáIÈDŽH RÛNG sýn"ô›ºWuLkÜ?cýËZá•=|ùH¼ÏFLî–¨Ä ÄÛkK€ê<°Y³ ˜$ã¡æ@„£zj¤DJ³JWHÌN[;ægp Ž©^Ô:ZZ0ßA‹ÏÑæ0“NÑr “ƒj i¸'m¸ß H4…S‚h‹ÛMAK8Λ6“R¬°*™@u›T“·—”õ֡㇥K‰æœ%wÇ©Ât[×ÿ*:«gþ¥Íœ E¹†O’T¡˜ŒÐŽã[¬ã7TñJêa-)!‘”pô¦ø˜Sk¤°— GÕÔ;‹×üzhm2çAʲ«'Œ ,öò?%W$«L•4sÝèPê37ö_rKÓØëý¾?Z¼S1gµ¥OS·¾R¸#ÎÏC’¦àR¤ƒÆ¼ðÂ’ŠïU-4a×3©A—ÅÓÞ0þñ´ØL ŠOÒ4 Åå“®è¿ù¶!æDñòø3Ê’Pì4iûþ«ÇW7ñO¦Ÿ­¿Â̽VÝühmaAÔ × ‹+?'¥a|™F¨§à'M —,X­²QP>ù*²ï^5Ξ¾öÿÌCVozõésTCµÔôÖàÚ*2¥‘@[ñ­ª±¤|â%E[î´ïMÂâ›ÝfÙÔíIáϾ¤ñÐãCnP$*Cî¡¿mOëÈlÜðpqüSï,ÚpßЪd®©¡_åø’ˆQbÕ&Râr]—ÒñÃ6ëœäl³/Ä‚Ú£âc'Z¸{ä gÝV¼B¥šàÒ)]B \^ˆGF£èÝ>ŸÇo÷å¸{=æ×3JI-B sF£=O¸TTÂ!(Ñ" A „F4U0#ˆ€¦PÁ* Ê®PÎ" Ê¢2 !˜QðDâ”M‘8%§àD€™é|;“%Ï×ÃVoÝuæ @9“A/Z„YP›H\!BDPYPjlú°dGǶ?BŒ3DnÔú’͇v͸]a8\EžÊö¡_>S=óU¸J¹µþ Æ Ea*‰6„I1‹bÔ H(§2éFO”l¡RNÀ5ÊÕ¨®Èi´Q*ÕT‰3-Bc ‘eH(½#ƒ^¶«dœ¾VÓñs¿ñ©xnF'ÿu)B…d>®x$×kgËfì¶$‰XÚ…®fì²Ã ‰Å nÌÀ0ÁQ?Â~ÌŒüˆ ó ]9¨LG¾]pÂ5A \¢ÝßÐùêîÓôDpÊ5PÃáí(XÂõIUs3v}åý¢ÂH' yxMÿÌìý‹½#Ïæ¨Ìi·u3D(õ˜´G\s,z@$Þ•É‚JœJGMu GõæYY#ªfŒÔE”Ýâ§CGï‚fY>º@ý¯²4E⦡'1áƼÚ)Ï»S²ŽL/Awñhª£ü” Âí5“~ãµÈº¹O‡.¥tèèUÖ!ä4wzÚw/7e·›ŽýŒmy1‹Æ‘9ˆ€”àÎL8vö£ï¶  &Lô@ß—Õ¡C—R:z¾ Sþ†{{ütÌd€ä=E= ‹(º”:Ù/¨@¤OvM@@¤G«hà~¥¯Ž‚:¾{øð^Ã÷N®ŸÆQåƒÚ7 pØeÄQííËËYäXÑ_Ñ?=:tœÌ$‚ ëC— ‡à ÷Éq¢ÄÐêëËRŠ äZá ÀÒ?=:tœØ݈lGo!æäJ)TzPëéƒ*ˆ@Q"’­ØÚC_._«q JF¥5ýÓÓ¡CÇ q¿4Rm? )€Dÿúš:uò"”ôm‹_Ô©ºŽ‚:N÷ë=Ðs¹êСC‡ŽÞ‹S–mV€A6ˆnÿvýIRìª^¨ "A2A6‚±ÞJç¿k‘!É=2‘w_LQ² Œâd5NÐ}ЉR!ˆI:ª…’16±ÿÓyÅŒÿyŸ ÉÍ¡¡ÇëÐ¥Ôÿ†?hîºy÷¿rÍØ-å ¥„ѱú™7~>ñí_ñö¯f¼}óÔ¯ç×2¹WÚ¨¡h;ðþ/ß¿õ´7ï¸hÙ‚-ís¶4BäÐ[3>{ý_ê±h'ªkÛK—½qË™›ö†èq½G¢,ñ?fŒŠß‰pAHû¶×>zùcñß÷f ‘? IDATžèFÆI„h ‡HgA˜,å¼yŸ¬×Ž°"Ñý_Þ4}ou˜üG-#D6´,»yÄ¢ &+å¢ÐBÞvíhaBTצ/~󋃮0£º ÒñýÂ)‰ê%€V5ÿ‘5;ÑjÕ†…PÕ<ø¾‹v:h˜ÑÁÕ^ÉàoüüÁuÕƒÎýíÓ–p麿޹=é£Ñ#RûXX••­•H&T!Ð"ÐT ØRWm›ùÇ3 P50X4«UD6Ch„IPBD2€’¡A‰ÄÔ¢ "Íd«E ª¬8ðÖ­dú»òá|å¹…d%jœƒÀ4 ‰Ap¨aÁbL_Ä+a‘ ¨ IîN%12T ¡€ ÈF(!!ˆD 2"A!@Žq¯DdC´R#Ô0¨ µïßÐ6üÑC™ª B %®¥­o¿ä’Ç3TîÖ?**™¬’l”Í €†Æ@˜Œuu…@÷·«PD2ÙÀbIÐc× ¨h( l~ïO#nxÌA„Fˆl!±>—SÆL¿`ù'/<ÿàoâôíGº”úŸ }Ò=‰¡«?ëâšJ8,ÛMV;7t[«“^÷Í‘HÃ]5y?z:%Τ’ñÃfä­ßµZö#©/2B%vhù¯e;íŠú…/»Gñÿ0jTÒ†§®vu˜ßzÑÏæM!|üà¦Õ"4µà¬ÿæ™W/ûÍ]Æ¡*–ïsËeUkòéæõ«÷Y‡Ý0ë²âx Æe)ºü… ãÓIøàæç·_•fÊø£ß™œ{à©ÙkË<Ø4Ó}ßWž—mq̾úÂPí²µïü©±5lÉ;kÚµ¿J´Òê/Ûm:¯ß¡ç6mª0Î9í¦[Xç2€Í¿yÉ‹Ÿ¤8Úw—Åû‡ÇÃ+þ²fîJ\ÞÙO™5Œ(þ-KŸx°ºY3Hh|Ï:ãùÎ]óÞX>忶›ihûkÏçüú³Ð-|bÍÂ…~žÔïüÇ&N/&Á=oÏýà}·W±ž?åg·ù߸by©K¬=;xÛÇ“$jƒÛV• ½îw ‚ùË?úíæ5›#RZ¿³=nÆ0¦áÞñú'Ï~ègéîþà¢,nØñÞÃ¥ÛËaL.¼ð±qã A”†¥];o®_³§O¼uÚœ3{|¢µôµûv–€søØŸ>ZXdØñЬò&Vyû¹c›×úÅ‚^jñˆ¤Ñ¿8ý² l£o*ùò¬Ò5×Nš ®s6ºÅïÛ-ã a¦ÄtÖãåBQ"Ý5{[ªözÚ<]…zv{ƒ†”ç‡)½(ìk8^~Ó¾ ¨ˆê©«ª Ÿñ‡Esnº¢ü_ozCq£o}11~ÄÙ/™0T®ùðæ•Ûœ§ývÑïºÙ;ÿWV×RÕ]ÛàIœõÀ“),ܾá÷ÐG¯yæ=gó«Ÿ=óÙ{¾¾âçÊÞ¾¿YEݧOÕ’sÏ{|Ù~qaõ78(úÝòfa|ü„»>cV”P$¬ŠÈÁu/ÿÞ>ý‰KÿðñдŠ¯^ü "I”ˆ–¯ÿ¤Lzñg/•ÝöášÏw‹žñ«æœwÏ}ÚÆç¿þbÏ_~vÙ÷‡Ü°dYƒdòmú¦öŒ›ç<ñÑö¯[]„!T%ˆ™ÕP$ké£_/l}ÇW—Þ}KÇg?]³¾MŽ¬_ðì«i—½wÙ“ŸÈ«-ÿuÖÏ_)Ž7ÿÅ'ãû'ªÖ¶PÓÞ/MD«ýû«w&ŸþТßq£ç«_m^ß áþæš:uÊ}͘=rëϸUÑ´áù}Á þ~ÞÅ7]çZð—j/:6½¸d~í¨Û¿¸âÁ?š¶?4ïÛЙržÔ/ýh¯o¹.˜u^ÑÖ7ÿ¯Ù% ¼ù¥”¤1ç=þE?móâ×_I½à¥Ë}%¹éµ/?ÙJdhÜÖoÚÀ¶] #ºˆÒ¡K©ÿ…Åïhñ#%èÛý¯Ýk¾._ñ·…Oß²mk$Ò À ®rNcüD€JÁÕ¾¼ ÙòGžkä†Æ[ý*' !ÕîßÝŽ™ FcæiãÏ-lÙ¿JáÌž?âüÄÔD *I™Q2 IcÎx[’eÌiVóÇ:X‹ÇƒìýnxÿÎ<ºiù6!‘€ËB@@D§âI jý¿\¶)ƒF –ŒqE3.±6~^ãåaVp]I±%̃R”¶Ê#–ÂÄmYv™Kz6‰´¨Ðûò>SR¼E©¯öMu oùS܉}_'ˆÅÈx‡W¥N¡v¸dÃðuÊëØ]V(yஜ$e¯7H• Içv£œY3EÈ«q€ADüªfµYN ½$! ¡ŒØ3/}üô1ÙªBTN,¦àYøC!ˆ†:"1ñÐTU *KÜœsÍ+S‡Ä©TN̲FlOû¿IÓ¼žƒ ÚðÉßÒn¹66K!¢Þ`’ ¡° [TõzUš&q­£Õ`°Q¡ij8ÁU%Bf¦*ÈyoÑy÷úÊ-øÓ}kûb±5{ÔB¨Þf0§Aîì K²QØKîÿ²(.ÌA!4"Û¸oG´!Ìš‘0vê¬Ëæ0B„&˜l„·`&ªÇ@êÐ-~ß~é.„joèp5jaw½·¥YZóºæ¿òbC‹Ë_»~Íßç›úŸï4÷Æ.ã,yФau=T^Ýâ.}wÝ wθӾ¯BJ˜³‹$W~ürKjÓºM_ïO)ž"±2pƒÃD®}õJ°aÇßßQ5ò‚HDñ<á¨ÞÀ#RÖÅ kÊ÷V î¯\ùi0í¼Ü¸ÎÇLM™EC¿ßäc²¨úìõ+ÊHÊø»«|ñÒ`È[¿èÉj‚SC²ì=Ø"2qWî\£rÉ–7 °fî;® A"žŠÞ·uS=Úç-øÓ½å˜Mv‘¨ºëà ïrå1ÙÒÑR`Î0 ¾â㿹‚PšVo^X‘:`£@¤­bó‚€Â=ËšýsSäÚ嬞·¬Ã­Ps¼Ä L2¤hùúµÚ6…{lü×*ÛÐ9Îhd¡‰¸©ƒ |e‹¿V˜•{vn|ï/m!B%[|ž9ã,Z¹¨¶Á'iËšg–~º€!\»Ùr ²ÎÖtèºÔ·‡Ö°áçW…l”×[Wì 9'<9wð¬Û¼>²äw(²3còƒçþèt¦U¬®70n ŽiœxpùÓ³C†Â’kß\`Z/¤ôß/¢ú(é*©D¢ª-¡€Ð¤œKŸÿáóî¯Èi…ç¾0vR6µ1 ¸‡^Bº´,J¸1êO.›ûú%ïü+wØõ/LÎüýï<œ>èoS-|ñJ÷]KF2J ˆ±hÂu·®zëç¥o(–‚óÎùÅUªJ¢ËÒv´ö;C&ÞzzàÉÕæWÌ Ã¯žvÉ Á¸;Ÿ\üÌ#_É2μ¿Á\pjî?ìÌþ+™¼Â>hÄ„±Æ:¡ ¤Ì|hºúȲ‡&5[ò˜ŸO›˜ÇäÜñ“ö¬üó¹+Bš%çŒ WÝh ¦¼Ó'Ìë¿íËY#SU˜R Ú[•.mH²œ{å‹ã>¸î=ã9½è¼GË Ú~ØSÒœ-óî;-$§ ûéSqŒÚÇ^]÷΃Í{Èq¹g=9®ÀÀúýò´¶ÇWýnZ@Ø3¦>rÎ%#¡º@(ÐTÓÀ›?Œ¼y÷'wÿ²^ü›Ä8Õ²s •%¿›3øÁå§_^»ìµ¯õ KîÌ©7La ˆ!\½bgܸûŒ ºŸŽïNnå•caj==³BEã],‡õ8B „&ˆd“@¨PÂBà”9¢ ÂDŒÎÀ»;ŽÎ6+„ ÔYÄáØ—Þ¦¢r\>ëëPÓc„ F"‘0d Dª&!²j‚@6A ‚ f„$E5ŸÎx©®[‘ Ñ8$HfPU€ƒZ@pF FÐBà"@†lB%0Hˆ„ÙB%.À Âa€ˆD¡„:«Ö N:£äQ²!¶€ˆEVQMk¢EÂë¿2nÎËE¹ID‚l4LB$ 3@’;§\DqøiàPÃи 2‘à!(]ñR Íóî^t`òœ;.’PÑýc°€«`2—Òb1^QsW F¿=/¥„c‹HìEÌx8¾JScÁ$h¡Ò½ÇEdß ÿ|»væ#'3½½ŽoËýRm˜”ƒdËV—"€8ÆY--Ò}¥ß{u¡ ¢ôzJ¿¹ (!Pƒ‡[¡£ó4v=É#ˆô—÷p(¡Øøi!h]Ï ÐéhŽp4L»[×E4 Êjƒ=¦Wé|”P  ›ëB7:c¨ˆ¨=šÖE¿àŠôiœq™¦Ä.ä݈‰uK§Òu¦s ‰ÐzÖo†üɪ/sO;{$ŽêŸèÛµnO†€:bz¾ýˆŽŠ·n7Ä΄cOëÞcZëöemyÓ3)2¸¦¡×¡ëRßR—ê#«‰ãëR} ÇÑ¥~(‹B€ppþ¿m¾„Š^ „!TWûwèСëR:tôE¡ÿûJQU½ ÈATßUû¨Z¯CǿC‡:z/Nº.%3˜ú¦Â&S0I±ƒ¾:À„ôáQСCÇw^µÍqr÷¥4ŽúÔ¾ék“á4 Î×··si;‚€ªz:tè8!˜EJïˆX=¹ ìÇ]ë°äPŸ‹$‚˜S€û†cÐÇ°õå0É°†-ãÁÍX\¯z:tè8¡¥íØdüaìCJ À« =„>(¦àUÀ"!´õéIš€WA[_:tœ î牜pþ—“Ý{B‡:tô^èRJ‡:tèRêhpƒ½e!šu4êÄÁ}æÖŽ¦R‹·¢7&{ ÖÚš·9Zö"Úaúû˜wŸÅÛ~ì Möt4m7…ùÿ¸ï¢ÅA¢“/Ôhs·|G­Õ:¬mÕô›­Ñ‘õ•Y¼žcý´¸öKÿ/brí2…µã¼ò8–X! º­­54Öo:³Ò¡K©ï’Í È­K‹—Ü6lîõéí±pDOÚÚÛmú(©òŸƒæß_ÝJzãV < ÏÿUîåÉ»ž¶ø¶úž# ƒmç­E;–Óc¶0\Ùoé9•ëŽÃ[ãÈ@ ±V½ëtÈÞiµû¿ÝzáD  ám—ýŤð3²á Ü—à?f««ŠÜ‘àýÏ}%Y[Þ××ä6Ž5™ ´ŽÔýó¤c{Þ”÷(«#ÐÅ”]J}·l^I*ûÔ5æ.·,w}|RÝ'ùÍwžóèÁ ”N¾Úg õÒ>#¡´-oš3Ù=õŽŠ3ÿVK—fíßÙ7ßÄ™$Эm¬èˆÒaRó*ÇÞävÈ]e™:™ê ¨€ =ËØv;îÒ/»=ŒÇíÿÒÂɳÊK&f¿¤§ôéqR~šè~p òºÊ%£è®©t`TÜ’pêš¿˜sÿX—™p$å@¸dÑdðÇm 8²»ºnì^(³{W«­‰70AëU]ÄËÙ•SçØ7Þ•€žšOǧ*Ô“5Ž}VjR»YEœûƒ.'Í‘HÜ´–xTô6uJ@iHpû›G  µ ΨÛÊD‰Ö'Ù´fÈ[ñâàÞn 4)™7î=6kõÃÖ@hÀÜk›Çý­ÎVZ¸ò/ÎEsžQ6醀±bÈÛ—’ܳŒ­áê “r·¬lN4Å7W˜HaÅÐ! «m­åZν¥“f°Cÿ´öŸ5§_µwÂùŽÕ7ä65©+o–fü­ÍóÊð²øõ3/sì{&ß&ÂdÆ c¨ÏLMÚxw¿À¹,®­ÊL8xæsÍq„Кá_þ)Ÿl‰ì=ãÚ¤õ¦µu¨ÜqFÙäüæÆoÌ2þ"èßi 6Š¸ öMü©D°pÖ—§Ûó^Þ[2Dsl½}xýäU\*4@øvd¶˜N.ñ®)\õ¼C¡Š’pî ? J÷%í~"£u¯!ì÷¼ßqRûŠ¢õ¯Y"xXM™³wÂ%J¤á²8«§¾Po$ĨÊ×ôÛ¹£vêËÛf¿¹{hqÎêçÍBR 6¹¥¥uÌ“¥}T_žµ{CÏ©j$¡ˆàÛgÝjÞ÷LvhRéì÷¶\ðjƒöñ€Í«ÁŒªÉIÔŒ²Y/nŸý‚¿ãŸ)®­¸Á-Í£¯¶Z!ij[J“«fìÙ‚Çv¤Œž Ù:ÑmàÎYõ˜3éŽm¼¿å¼çÛïe——„DBZÜ»Î}kû´ëí;_ŠS¸³êræ-[.|gë9O7;eYÕö¼”.ÎÚqþ{[/x£Ú²¢hݧ Rç·VW°ô¢à‘mç½·ãô_Z÷<×!š&<è·Þuî þÏûUkûg¾¶õü×&V \ù• žÂ&×:IÓ™•]J}§¿£¹¥ ¼Cv\½âµuc,jIÝúº,Ðc|„@wáI¤¾è:ÑS¡2zS !%(,Ä„ˆˆ4Äu]ýÇs °„¶Âb‹{/á€dñ%—h’pÍYì5ƒÊÌÁ¬q€9S%~YA89Ûºÿ7cß9sÂû?M‰˜i$«Ð':¥:•YûÉ6Ø댑‚ií4Á!T%ý4¿ à:œ$ÜvÄ<à–:t¿ 0k[æ -AÂÈa­]Cjkš5§º!`[¬¤ 3ÖµE„*bU8&$¡[«BD´.!'`¡~¿Øn,H¯XR´øMf¶oÚÏ×4ÖÙ]Ô,„/¶¢!<Ì„'{ùÍéTˆ ù­R·6Š¹êƒ!m_5¶eˆ‰rb BOo¥C—Rß±.­`eCT¸ì‹Ë3•oÁˆbrK¤B¥7&H%0¤yl,¥ª¶ft(œ;B —k}=ðìxê ”¸£ÍD -ãNÉQfÃ#áGØÖ0ô ÅV%ù¤ú®*‚”¡³®†æŽÀ>¦A¡@À%«I^ !'¨ž9"%…‹î)Rp6¶£»Ô¹ÃJ1túÜ£+obþºw2íûÚßÔ]W×$;ów€!5HCŽö0⌠0´T‡M€¨a9ì ЂrØÐn‘ä¶J%efeÆL¨uþuunÃOZ- ñm^ä¦0´” ¹$"DpX‹C“^8ä!ZPP3ó¨TKq8-³tÚå2ͤI $R/$×'tè¿ïÏð ­fiüÁuÎ-‡–$\gT©¿à¼ŽàëÃV_öæ°MÚJ®‹ÐÞ‡d«1Û°ó—ù»W¥l¸«¨%»¡xTMäÒ¥§+K¯8ʱîîÔúJ[Å+öG\…³zn r<¥Ó˜ÓaVÓw,67¯°b³'A³´í#¤PoÜ¡Ö&ˆ°ˆ»¨ÙPš¿{¡¥}gÞ¶÷µ~7ºœˆîCŒ9cÄØ’ºqûÃÙU»Í®5…_Î.Ù¼ŒÔVÿFJ}…½ò¥ŒÖÌÖÄ,"D×s´ô™­|M²¯°=5¾‡Tµf‹ŽÝ&ȹ•ƒJâÖÞÜXe?ð|Q•ìÊ› " µdìû»³í`ò¾w-–Y-ÄítèªW-5‹JB{R‚+oºaçCYUe–ÚOo¯nr-§* †qåÅI™kžt¶U:+^õéíÎ@ˆS³)Oªß@âf[?*Ü¿Þì.ÍYzÕØ¥_‰€Âxh«bë¯1Yéø‚=üðÃ'ïé Ç?*PÑqÔî’ð&”}ï S‡iáj«»9”1>lJiÎÃÚÖǹ•ÖaÿWÝ/§´ jI¦gà¹R€¥98F4¥&Ú­3‹¢ª‰¿vÛhLAì…ู ëPî9ÒYœ¨nê‹K¤-6:ld€F9õ§ V‰`0xS‹55ez«#”P½Ìá35ŽùmSšœS…RG… B%4®#)U#‘„¡^‹BeªÑ—9¥1»¿äZÐhu[cZ¼³©6˜>¦#ÑioÜIÆyMœHižÄê©6á“vΞõiªC‡.¥tè軈Š¥§úÕ] Ö혿v»½&#‘ŠÞkLÖ¡ãû!¥4ð>Y‘G3½ñXjŸÕ- ¢£ ô„¥:tè8!¦¡õ&^qr¥”Dpe!&¥ö=)%†&ÀiÄýãaìËNÀ*G¢WaBªþñéСㄸ_¶ NCo¡çäúøqWJ¬™•)åIDATßÔEÌì4úAIßžp©Vt„ÒÁéСãÄ``01Ø?]Š ¬¯C§O2÷I›‰wÃЗu)ãªaX[‹jþééСã„fÃÔ܆” QÈ´ïÇŒ‚Xß–R*é³£ C‡ŽSÂý¤ÞÄ.¨>$:tèС£×âI)!„(˜ Bbÿ&wû“º®ëu+.â™ J{'•'Ø&GSˆ£~‘¢Ôý˜ÜëFFÆúìXèСã88EñR„0=¯Z¸®àâ'û¥KàáÊÅOíÙV«V'™m©£G_v¥–—¡Fx6¾¹iùŠ”ÛÿÜ{Š‹lš"úœAM€Pže¯ÝízÙï3⎌."$ràïÉnËÍJì:¥T/\ºÄ5ñú+L½ÉƒµaéËeììÓ¦õ㧎0!aÄ # º…U‡Ž>+¥„® Ï/ýb…ÖÑ–„@9uÄeæ|?"IÞÕîh7ˬ7Æ*†ðÖ§?}kýÈëMò~¾ü¹ËqßE©}#ªÔïX±9(kµ;ö¥O+ŽŽM7î*¼µ;MÃ#=Æ.ÐØTY¯‘c¤âë©Úüûè‘ïxS%*G<Ÿˆ`Ë6…ÐΰÜèeÑô|ßü‚£ïÊ@ÛýíG5êèVBxõßßû2áÒÛg‰ˆº¨Ò¡£¯êRÐ~Ë÷>¾ù·×ÅR£jN*´$¤}õ†]ñ#þïR£€v,rjAyûÎ…«“/y}ÔèDœV9{ךŸÖ},‚WדÉg^êX¿`YdR±‘ AîCÛW¶{T{þXÂb6áHûþÚ=;âL`ᨄóVmh3ä™ÖE’Çf姹÷­hjh†Ôô!“v úuk4HöÜq™ÙéjGÕú†ÚFAÎ~“ÒÓ¢lžlÞ݉wúvÖ7ø,9sriͦUAîL)9=)NâZ ¶~çH•ãúef”(4¿kÿÚ–7‘I§¥$î~ª5\¿Ö<ðœÔJ”Ö+ü‰%¤j­¡xfjVëÌ$úô—k¯—ã’ü»_]òÉg*G¤iãÊ—žts§!´gý»÷¯ûrµ0ªUsÿ\zÀÇCÓ¢'h" ÕÝ´qíc||û¦g–Î].ˆpm}}Õ‚5Ì‘"¶.yú®ú°Y–dÈñŽä4¦+Q:tô]]*ªc»žÍ]q°Æ<þÂ<®ö>5*jZRCŠÊ,&-¼@M B ð>¶e/ˆPÝõe­ƒ®Ê…É‘CwímÌœ˜GÛ¶m¬Ê½õ½…àCó¶üBPƒÚôÏZ1äìY—ØM°†**¿  T„ÃÓ¦üä2c`Ïç_nÊüù²’¡²6vRàé9õu­ý°%lT0â4›YJt&7:B;·#sl¿a“ †éiƒÏ‡uu!B5ž>ú´ñ5/íóÜé× ÎàIor~Gð&³É6øçoƒáÀ¡…‹JÕ™#½ eöa¿ìWRBGNN~ÈÈÔC„Öí¯ï¨/>ÿÎ9&Ñe#” ÁÏ™péÙRûÊW4¾÷Â, s›Ÿz¤9p¡rn øʳ§ŸI%MT,k¬•@(£¤3•9“5Ž…[¶DÆ>pwNr³œ_ýù5×Ù§›öZ_Õoèh&OIzH6›üÉi8T˜Þ¿¿‹Þ9ƒuèÐ¥ÔÍ9 ¡ðüD䌷¥^[VF¨8\ïG¨ Æ>è8¥é«ÚF/[ûA«L‚m¾ºý_ø'ßjõVûDÒ dAÒSd¦µî"öIlq‰’t€àš©` ¬·ï÷Àl*{K•"Zƒ>©¹qàèËrÍ­xá—¶ÌaCÏ,œ"^–´îO‹ž_ãÈ–5âÜ~‰”sѵ^1¥¥R  Äš• ‚™˜P9H vñ_*[˜5ή¹+ÂÊd–1úÒêþ2{œ3{dîØ‹r ̨V¾»dÕ–7|hŠnGuµWÓÌ%­e‹¬yó[m*¸Ïç«>Ô¦dy*mIg .8gINQ‹î~§ÑiÍýB«[ûF+Õ ¶;ÊêÛø ‘—U|ðòüÝgöÈœ1äÉðE×^ÇØMÓ¡CG_—R„¡iíÚÄÑ?¡´×fþÄà°­n•ÆIœ ÒrP¶œÆúÔ„ „ÊhXðwÛà«ÓòÒ!˜ßúÎ+»*ohgª•Á„sE#ƒÐ¢ì—«šèdı]+&SÈŽì!ÉE$ç7gä£}äÏþ:Ð×ÞQ±lËÇw´±7& 4þÆgƒ¾6÷¾¹Þ¼É}ÓGcr̪èªÇ$Ž¥Ñ7óºw·íöŸvçó)êÝóޡσ¬ù3NûÕèÏÕ²åÝÕÏ\øõ?ÌT„<–!³Oß»ðËÅ×I¢gñ(‰B’‘Qs|nIœ¬Hî7Ù–bòïeÑE!àŠz$¢å$#“mñ¹%vI\t†=ž˜ÌS¦Þ2,äs¹¶}¸îùë}÷}’AuѤCÇÿ§f_JÁ5«ªàš¢©j”ïQ­¼¶–:Ó3{ñ‡N„)#/?©jÑò&„ÒT±¼,±h’ԇ£@;Vï(Eg_Y0òôü‘§ç›3z„¥rÞb%¾8^nk¬hçÀÿ·wçQrUuÀ¿÷mµuUWUï{zIwÖN •‰(!„¨FŒ 32ÃÄ‘ñ 8ã8€â2(£¢â :£!ƒ”¥Ã¦•­“N'é$½ïÝU]Û{õÞ½óGUwª“väœRE~Ÿ?ºû¼ªºïÖ{¯ïïnïÝøО®^¦œ7C§ÃaCXÑÎSq“MHÍ[_èJ•%3×]–åq9]n½íÕÖcª»¨àòO×Õ×ö·‡[_éh²e—–,ù\M…§§=Àä÷Tña!gÛ²0C}Ç߈è–à¼÷@ãpH8sª«WÞ]¢õ÷t†ÁãY—ß<窻ŠõgÞx󤤰ó/ä¼e¹jžé%3UO·¹s]6hþºÑ¶VÃäB8sz€1¦h6É =ÕÕg0•‚å>)¨æÌ*™±¸¨²Fuº4ôn‰;ü•U×ÜUæ öt„™ÄÀuÎA÷m’Ém)>pøWë{ «?<{_Ÿ–=ó®oW¸PË@ȨJ“§Gý¹BÓR*?õåžÇzñ‡[5³ß*»ë# +XI‰6kããýžë¯)BX:+¼æ†ø7ë>»à+ßøÝ^Ù[k³{ÔÉ2bê”UÓËwüâ_¼>¯Æ{Ìx©xpòírEÃa{ý-<¸¿ióÆã¾Å †ôºËgåZæØdtS7ŒÄ’PÂŒŽ&§¢È…¹¥tm¹ãÞ¿øŠÛåÉ]’«?÷æ–êÚâ–ƒ¿Þb÷æ²X_¤äÆ+j##†öüŸ]÷ÜCwïñ>Ù0§`ÂÒCñ8g¦:{Á߬ÞýÌ=}¹…VhÀò_yå;º‹þøõÆŸ7{\NÍ2 À…\uÕÕ-OÿÛká‡Í¯bQËÞ0Õ’}O}¹='7ìCñõ¹©Ñ–½On¶{ó$½?”·jñ4—£­R=û?¯oè¼ì†u~;•0„üÿ[ïg•ÏäØv íóG˜„°ÌȨunTBRY„¡GtÅá–/vÓDÔä ¡žÿ¿Ä€Gâ†! +ö,Efi;Pnr¬•|æoJ… ™°Ûìê¹ÕÑ…iD"²Ã#33 [’攸ÎT§,KÜŒÅu]@RTÕ2…æt#6›MHÌ) Y¦%˜¤hNYUÁõ°išLRª¦ÂÒæi1Yu*šÊ‡RnéqS²Ù5€Ç#!hnUa†5G–Ä`!Ó0!kªÍféa.4Í¡š±°eq0IÖ\ª*YzÄb6MSŒ Å¥jJâF'3â’SÓd!XV,lZœ1E±;eY„eDL#Î4‡þÖW¶îšû™ïPccAuʈqÉ©¨2„•Ø)“Åî”%IŒmˆ n±°€¬:²¨ód"!P…+ʑ缄ÛRŒÉªË«Nò‚fsii~ e½¤:mª3ecfHL¶»åñ¶Uò·¢¹<‰«BufäoI±Û”dÓ@ÑçÊe;—Sìnå¼]Ø²ä ­â Þ“œ‚Ç$ÅnK¾ ©NÏøÅ 9“ƒ¬eÉc×…äH¾AuxR/!ÙæûF’êÌ>o¿);”‡çü¬j.YdàÜâ›pä±7ž·SvÁHŠ6aï„Lìñ#$ qØfÜzE®_‰Ó± „¢!éÖÑÁ…Z´°¦°èÙF„P”"$Íœ‹K¡I´¾!„K;Jeh½”¥üÌàöA†ŸBÈ]h¤YYñþÎD·8º#àx{£\ ²TôDÑó‰Pà@0Ž˜Iÿ}„÷ThØe0 ÿR˜‰npÜÿvôf^‹„«ËñÅ™¸òÈÊäÁ;ÝBã*|ÿ Þì¦ÿ>BÈ{ŠRssðÕ¹—F”@GÍÃØq&pyâíC€–ÉWœ ÃB[dž3¿û’ò”~^ ñ´Y–fOBI_¥!„P”š”V£ƒÒ¹É‚ÅGÕH¿Tâ€4}¬tbE sTôkÑa9±ÊEÆ>›#jtXš¼u/d}X²&®ClEÕX( Ï 3‚jü¯õÐ.ņ” \€™ŠR¥b^@Ý_õæÝ‹žZYÖŸœ|ÆF÷Ö¾rOÝîŸTîùfýKëó‡tŒ¯–š^å:Ý;µñΙۿ;õëêß|ÂafìDo)VøÇÏ-yæ†Òî‘É^ÖËo.êíMݤto\¸åa›m2 Jb)‘¼¸T@M¹ÊÆß#]pJc¯&ƒ2–²b|ïÉé>‰ôS÷Ƈ5¾ÌWêg K>8—¥|0‘TbKêF0®dY² PRÒIýv„ÄÅšd-õ6üXØ:ý)¡‹Ëª`‰ú$IÈŽ4íï‹wçŽô]¹X¼ýuÓftï•E•q«ÊC¸;v³¢ë{Ê}-¿Óâ«cš‰É[g½öc—åV~FªaøŽèèÊðÆÒ¡â7½´ë¦'»|³ì=¿ÎËöÞüÒ®~>  ºôs‡Œ+.µ»94ÿ»oy<:¼¡¶E;zãÖÝû¸ÿÐ]&€°-ì8µbó®[_>2½¤êÝWÁxn˯ì¥÷îüìK»W=uÆ¥d­+´gæŽ×Ú¯ÝØ^컟\2­»õÌõO·çŪ_û¯yp÷§_<¸èÊ’Ý:L.‡ÒÛ¬×?²ç¶Æ#5VÝk)RbŦOY5Ì_©è6!ƒ›übÞ@…(B.‰¿Éšu#r‡Äð”U=ÕW™×ó{À€4\W&Æ¿„¤AðL•``z“/œ?à/€âé+©+nÚ òê¹Õ3˜^tc¿‡ƒ©òÈë²gî¨ÇÅ?XÔ`&:åxÜÊ_=äÏBd_AÀÓ]¿ÜÒ`ú—õËÞáNË9ÛúSåg³"ö¾¹7è±™®RÇ–ÊÃ/:Íü®†»F)c>´r¯q1È>]²E*–sž]gbT1¸ƒ¥¥ÅÛïX¸ñÚú=[£ RÔ]é:ò³Šæíš6ûÌâ/„„èœòúws¿Ö•ï…)Î òx¼ðS£Ùv·ù)=Së…"ÇŠ® ª§}¡¸7ó>ÒïuÁÄè”+º×»Hmugªý9ïn… ßÁç­²;Ã6*4¹$zü.À#…Ç·F¾×QU 6÷v/ÞõÃö)ߊ¥Ý¬ÙnJq›!à`˜ÑÇ•‘YaJ0Èpœù¯¬`߬ç>É„ 9xÔûØ(P­dQ¸ªŒ™AH‰ï(5Y‚ ÁmN°"2 W¼°¦ €<ƒÅ¦ÈúèÁÕjÅ Óÿ›9_~_0旅+\凞žÙüSá[qôªuõ\ ârJÐ’ˆ±Ú ôí3_|dxéO—×hÝ›æ¾cÁ÷²ÿ¶¬ùgs÷?¤—ÞÑ´ô&!;lGÿ#ß•7ª&T‹„°4'`Uãì´­kx¢AwIJ T[²T¶ èòø¼S £õwÄ·üÒ×;½¼ÛÑùÉ9H´ïéþhB>ÌQ*±Ž8$$À…$ŒdQ%&CèŒ#ý&Y1¨…A'rÚ{Ûs Áuæ îù„•I7ž%]¥‡š»—n>SâÀåhé kÊžšULj=81â 8w”1c„ €A‹$K¤&{¹n±«7·ù8 ÇÀìR´Cr.=uÍ2ÄKwÜW}úìj·å_ybåJD;«¶­«9»öPmø_>Þlèe›çŠîÊi\‚iÖx¥Ôà@¨êÖc5·"Ò4뙿¯ì¾~@ÄÌ)_Û™½¾ñEÅ¿éö©à)Í©Ä®º˜ìo½nó Ã$ÆM!©ö(Á>&3÷ȧ«RÖxœ×v?V¼óGÎÜÏ÷x0¡‰Fùpöø1¡;z÷»;)\Øû÷fw5©Â9TÔàÝýí¼¾^ux÷´oÆÊoŽªiy̘§cÎÕ®wþ¡ìäaßoLkw÷Ö-ɤY_‚AêøMžYßWžÏ;Wì}]õó'žÐÔ%~îzÌ8[°s½Ÿ;„0,ï áàŸJ[ß±ì,mù½|Þeck8U—]¼ý{îЈ£ûù9[îÌ èJÏO.{y½·¯Û6z6+0ÎÎqœýîÜ×Éè±œÌ ¡l×{tžù|´ÉÛßãèx²ìèI3Þ⊄rÝW¿s³#Ðçè?à´²Cnœ;rMï’ãÓ«ªpò n€óÚ³%áò½Ñawëã Ï}Ýiq@桦إ†[+÷¿a•ÝÖÌsyãž~£§ípoýRX€ EÈJ¾ÿþûß¿Ôã›NáTð‚1T²ë[…]m¦·BÞãïhŠU®-±÷z²°ýxtê½ÇçÍ–ØÅê]™íÇòb<àS&TÛÓ ÇºÙØÖ“”ÅH˜å9ý–’ûÙ®ÒBp&ÜZï3gyÿô¥r_cIËv^ö¥Îœ(÷΋f• üyÇ7åõôõ×®Ì9T6‹…ÛU­v0/ôŠ5}gÙ‘§sû}óþµ/?Çò^GJ›žÍë8©^×:¥6ž³Ìˆ¼]vì¹ÜîÖÀ¬¯ž)-N¶ªI﵋‚Á‚RÀ´ž6 —²dðW@”-‰Û§œ}%‡7úbSZ—ÝcD·uÄÏ.¸SîÞRÖü‚o0Ò»è;]yu´MuÌÌñÅóçYƒÛ¼ñ©Ã¹‰9¤\ ´JÙ‹†ü.XRxÊ*6ðû²cÏg‡œmKþ9èt¨£sÌYmžæêwŸ“s>ytéj qm¸þ+†½†¿?|¦þ:SbÔ"—‚Ò,\WŽbWz´ Þו;"&ÖlCcûÄ(•(›Î+ú-Á’÷Í$ª½\@\¼»eÖÖàÁLÝpáÓf'f•übFÓ¿ÀDÓZÜ» /µa|<)y{Sâ°'r>~R[$€|ìg"¶_X"¹¢Ib‡}$ñ‘’HòlŽ5ÝϽ'e€‡¥™ÈŸ˜Ÿñ£Hg<©©Û>öA>–·Dšb²¬Z`ïÚ0û¨µïã· iüÂÿgz{éÎû²¼ÿÔx1+ªüþÎñÓ-<ƒz&.(r¦{ñB;ÔLnpZ/ÅÑ!ôDé_òžJ?Ÿ†ËrPë½¢!„L Wéq(KB™¬“`¥!„¤/ŠR„B(JB!¥!„P”"„B(JB¡(E!„P”"„B(JB¡(E!„P”"„BQŠB¡(E!„P”"„BQŠBy?ý/I³8ÏêŠIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/ICMP_types.png0000644000000000000000000013431513051004444021673 00000000000000‰PNG  IHDR.ûýÑåˆsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ;vƒL¶ IDATxÚìwœ]UÕ÷kŸrûô>™>齓`-†‚ ¾(úòXP)–G•GDDņ ‚ D:$„@!…ôžL2=ÓÛÛOÙûýãÞ;™IA‚3äæa?™9sî9ûìÙ¿³ÖÚm‘‰äTÃdH$RŠ‰DJQ"‘R”H$RŠ‰”¢D"‘R”H¤%‰”¢D"¥(‘H¤%)E‰D"¥(‘H)J$)E‰DJQ"‘H)J$RŠ‰DJQ"‘R”H$RŠ‰”â¿%õ÷;RB¹ÓääZÎÈ6.ñ!ˆÐiQ«tz”T’’¯r¢áo=êp]ˆ l®×uÅ”Ônâ\`tžSuD¥%'óþ†KggTz²=êH\8¥øèºî_¿Ò =µãOK|}i-ðàkí²yINŠÂLýůVçxS[Š4BŠ›EHÄÃd’vQr8m†R]ŠÉð3ÅÛ·8ÑJ)JN&LÑÈõÜ°,÷xÂ)¬ñc‹'3‹HFu¤Z3„@Ä>¾YÒh”|Íœj#ïM5,˜ÜJÂ`rŽ‡Bp0i?%§§‰ÀúÏ¿P\­„€ˆ@SYÇÚ†7™ÐS¡}HÀsΪúþ…ìе¿néw0Ø™ÙËn̬ï ÜùlG¿Þ¬ät”bÜÚS‘¾Ø äu0•‘aX! .·º~G¸(áø½w+?‘ñF£ÊEQqÚ…Óu óç÷qyª€î¸|VÖîónßý÷8ÁfJx’‚‰‹^úÝ­€îzþ–ê‹«?yxÿ7…àPÒ],?Sí‰Ø&À¡± }Q›Tŧ"d 0ò(Ä…ðGí¨H´]]c:S›‹>ƒÇìálЉøü£îÛ¸o_R¤<ñ{]MÜ ÑoØa+kS¡ƒÜî·¥+0xˆ#ÛÉt"Ã⽆àH|œÀï‹ò¨ä4ɇ+"Ù+Är!„@~Vó*¼¶ùÉízê°…n½cúÝ%öݳ§ê¢Iß™DïîëîÑ<çT9UØ¿_ÖpûkÝ~Ù9ž}ªì¦qŽÆ~^˜¥<ölý7_ë鳆/à$B4òr‡raiÚOÎͼü‰ÎßØ\ä¤ÿïÕ£®Ÿäî ó,·xqMÛ—oi [˜4¦å¶ìºŽÞÇö°;ÎJðôʦu©ÿû‰ÂQ*z[ú®x¸þÍÃfVž÷îkJ¯ïêñâ zäù¦ï,ïj7“^»D2R=¨Í+þÍÀ„8"¨ Û¯[o@a›è†Á‘™õÚÛóRC¬·ÏPèVþüBÝü_Ön÷+7\<ê¢Lqí'Fß4I½åæüxϧžñ_YÙ•eÎavóÖ7m4qéÙEWWk°½¦¦ ‹å_^®=¹¢vü·wþ¤Æ¾hAÑO>æ‚„,eéîܾînã—Ÿ;êæÑÊ—î;ðçF#³(íêi>|ñ“U7MqÜÿäÁ?ÜuÙÓ}×_Rrý$ãÒG•Œ´ß#pÁCÿzª±Ê9åÅœO:?×þNM -ÊAøª½Ïí ¼»³÷o{ƒÐô9%T÷M3TtDû¡N)qQ Øåëcdï„ñ>ÿ·—u“ÇýßgçAO*TÁ_?0æî}?ß+È`Í~`T©\Äß0­mÑ?­ìz{EëK)–ùÏw;_ÚÙóÃÕ!€åxæô\?Uç½F †I%.ê†òÉ*Wº\#ùPºmNŒ¢Àßû«öSÜ£Š¼_™â°"ÖƒHFeí!#fÑ°ø< N­@–÷¾ëÜXÐòä«Ä‡yÀUSé·Z^=/sÉœìí Æ.»°òÏ—de0Ñáš®Ä;„è5¬æ x}`¼·ŸCA¿w˜K/Xšó»Ÿª4 `,Oº¢1’«C$§TŠ 0¼²±ýÎ)EŸœ—9#Këêë{L‰ÿÖ«©!8rœ €H”#Æ[Ê–žI?:Ø8àR@Ãðv}¢‘ÛŸî<÷†üÿB¨™iw›‘Áø-wo¹omìüïÍX¾À%ÄÐyž80D§³:€¢ÎàÒŸì^ÓA@²ð*À¤ƒ*95ê‘6¿¿Æ¿¦_|qqN¥íÝØRdIM± &gMÏS³KÒ¯›ìÌ­-¬ðßØ(ÍøÆYYŽtíœ%åë0æ³ãœ#c´ÙîmmìŽÌŸêV „¢*^[ bÀ5»à糜Ð=:Ž2Ž'›)z¾ÞÖ ÜŸ^˜ëÎÐ.){û{c¾2Ë£ÈÖ'ù𥨰øÍ’F€‘¿/ú¯-!ošÓ‰è·_è‡{ $ÜLs¼|ÇÔ†;ªçg°­›»^>…Êÿøt}MLýú§ª»~9íÕÏå—ÁÞØi £IÔÁDÜ0ÿ²²³# F¤¨,ÒÝ¿¬ÍVåÌ ß]öÂSÍMDgÎ,yôš¼¸W¡$XÂÔÅ—´)ÄLÜù·†V¨7^YÙñÀ´•Ÿ-ãÁƺˆ-ûl$¶ƒj[Ïoêj<¬­ï2Á’œiïmá ½Ý²1¦À $ú`Ä3o¶®èT>9ÑÕÒ|èõ®^RÀ¨ñ`Ïì;¢Ÿ_]ícá‡WwµFÅ°­aT°ëy‡ÝæñwÆ®ý=w¼¬MÉTº;‚€u˃{k—äOñˆW×wýë@ôU“ý¿jmùÁüô·w¨®5 ‹7×t¸kW‡Â¢ý¯³Wׄ-B¸¾«òáÏΓ®ôtûFW‹‘òKX$rØ6\«øM[|멦û—·ÁqŒç%¢6lÀÉ ¸HËt”úôoªòÓÕtõwÿ³Ù–¸í S~v¦zßÓµ·,ë#0‚“%¦³` `û€–Éo[R` üre;2&fÁÜ â‹`¸@4y/'ƒˆpÐTB̆ è GD@!¸„lp*P–¨€FЈ`sÄ88 D 9ÆZ!DE¦þô—«f”zNO«ús©G~ ð+oûërÍí`/­hx¹Åcñ¸ËëT%ÍAÐ8Ø+P *ÒÉ2 ûb$¯àPátYFƒ|f€žA?:êM÷Hqàô˜ê _Å}t÷°^"Ô“ ÂãaË—Õ_íaýAcGs$4Ð"UzäÅšõkYmk*™v˜j„šò½,½çSH…—H)¾ ©QKm e ÉÒ‘oꛃõÍ@|79GS"¥8âòDaÞãR‡’rò•D"¥(‘H¤%)E‰D"¥(‘H)J$)E‰DJQ"‘H)J$RŠ‰DJQ"‘R”H$RŠ‰”¢D"‘R”H¤%‰”¢D"¥(‘H¤%)E‰D"¥(‘H)J$)E‰DJñ}rzdF¢Ó«¸’”m@ÃÌ°mI,€X”ÃoÂa§tMZ"³Cè7e³’œ•,ÎGhßúáÊ$%,Žõõá†nSIíLºœ‹±ùºvJ)JNÎÚ8uÌ-wçûTFÃo‡Ë* š§Ã14×Sêa ”hà@§C6.ÉÉáÕÀÐÈXÅá’¢à çkÅC›èCNÃqòZÄͳøÓV™•Crräy0éQì‘ÜJÃf p¨' ¥ºu >8eÿ±ääTÉøkøßâlX‹*‘üßä¡Ž`‰I@Äí¥€%¿GÊ%úLô]‰ã‡ÁÇ{ˆøâø¿ý·U#Ž½× Ê9© ¾”ž91)ÆÝiìÞ¬C¯ù]ÉŸß]<Õ&‘‚iL5ÿÆÂë#¤Á\¾vïéÌŽüƒoJ—†=i'}¯PMÞÁ74ÛJˆˆP3ùs{‹Çóøkë}ŠJ ¾]^ÓÜ>æʈ[— úôe„£%ùïÜ^±ÿMËSq+%ïÜQ¶ÿ-JÉÑGÏÚÒý«mWAÄ7jÐW‘­ Uà@²V³½x÷£Þ`ÿ ‡“Å`à z`_éæG4%'’6*’6*’Qa›ûF¿ùµòÝ ºÇ‘oEâã4èâñã ®®Úü7wØNü1ãgœ/„ >ÊVŒÐµ¬º¾¶áÌ?®®„@ˆ¦ì}®­lnØz# ¤i£;ª/éúñ‚b±Íƒ¹bîl)¶ê⪣ÛÕk¸2’>¹`‘ÍŠ‚tÕ#J¸IW@ÂÕô¾Šs;Ó³—W/³ŒÊ>ÖQ=7èZ¤›Ùœk>Ó•¸¡Gºl-¼O‹E¸æ3Ü@º¥¹À#j Ÿ;s¹Ââv•ŒNGLú2e+ÿhKQTxëw 5=8ª\@Qz¡¹éÇî`{Ø]š’µA`ìèää ž¹çþªm/¨Ì +Í¿h€Ð\®º‡§5lSyØ´Ïýé À{ ¶?P¶­å.„Ñ­hãöŸó¿/íx.9 Ž™ƒ¾lÖÑÍ,@'­«Xó½œÞ áÐœÁpÏ„N»Ì6wÍxúSvÞMýúAÕ6½]ücn®™{©£{¦¬¼98í&΀ èõü¹eúWß¾ð¿`ËvþO¤O°¼¨àÀÕ¼˜ÐÍXê…Š‘iÊ;ø¬©(‰÷Ìí(/g/ÝøJÓO.͆óô¾W\»¸¶Âm›û‹»ÎØü‰gLé[ÿgúÎN\àl}½b÷–Ú¥ÿlÏË„é¯xó‹ßxrÝ7S@ í¬âÜŠ|J¸fTý–húÇ£@Aööïç¶|òLзyúóßËËŸÙšç4Ü9@wý¢cNèÍOÎZñ§ìò…DÂΘÕXuƘú•&Ìü+Š»s-¹'|Jþ/:¨À¸!Hç à@@å$˜š¡ ‘ÑëéÜc³düÌ#vFuGuyzã&–9£-/1ÏÌ=K~É´|²[TžÝ0ýrSXÉ)çÖ&Í®®í<ÿüž¬LXZz_áÇ 7<—½Á¯¬xý¦…Š©»™mÙÞE‡fÑ €ºól O¼ZíÙç°-%”––ÑUÓš[!Â9‹b.À€•='¨üÎh„˜­v¿¤úŸ÷nmËf™ûÞ`¾)Ýùy‰·žó>ÚR´'‰~%é ‘ˆ)\±SsjœàVú¤ú9· LÓ‹Úš;щb#–6Eƒy¬¹ˆ‚â½#ª2]^Dphª^ÁúœüCjšÜ îíôyï­Xÿýõæs¿kŠ¸?ÜåŠ*®]?™µ3Ñáâ}¡ÌQ!@ÜQœŒ^–jk¶‘¼¤…ìE£~Z¾ñõ¶%ÓrÛvªaè€)@$uøQŽ àËcv+Œˆ (±z§u¸Sµe EÐQuB¦¦3;’ä 0ÃÏè„ËO¸âPÌ( @(¤ÚQnS¨”ä“ f9½–;,»vêÕÙ¯ü¼tÿ5‡ÆO€ Pš¡)=ç=[;.V²Õ‚»Õ—ì˜5T›E™z¤ÆW[ù%yÌmú‘'W{NiB‡Ò&ž°‘kÕ°©<;judÖn„("cÏS”>9â+HÕÊPmÍC¾ˆú F³ž]Y½A8 Ô^¹òË•6 EÚ¾)îäF²ÆhíëÝQ:Ǽ]›ÉwžßÄ$‡AîpB?¶àÅ—í›zFц;3û9…]¥yY{žg „c¹ïþÃ×éŸïê^­š€Å¿Ýc¹ÃžÂ#R´ªZQ:ËÖ?l—- h®äà¿ÔáGÚA%÷œó¯·ñÞæqÜlw‡Ñ°àKQO½Ža¸ZVLzµ“³#¯'Aj焯·•_]_µ®òõëó²«(Rã‰dï-ûjô3Á“ož¨ ’@°ø¼Ö¼·Ç¼ö%ÞX Ö¦ûíšEŸ³­!á1qSúÙ€8cðOþnGýec߸{Û’ïG5tÎøAΪO{yO =ËÑ»Ï) _ @Z4PõÖ–ª¦5½)¾¢§ m-ÚOà€k\íø±³7×ì›ñUžpž¥I<=®õŠ09¾µ÷o<<>ÃËrôíóõ6¹ƒ¹3"^_rôùµ·Mƒ)ðË82&NPƒ2[jHQ†V åÌ gdÃŽxÚ·xB}\Ë äO9=°ú2ZvDòfÅœn,R“ÝÚÕ]>3ËïíØ銅â æLŠz3À60¯ J¤%£e_°äc1Ý‘,©}Û3{zû gÇ\n¡Fš}ûTÛZnÞdÃåBl÷Œgo ým蘷¯Chyþ–ÎÞ•ßÚÝ[|¦áPRûŸùÊÊÝ=ôú¤‡7æªðàé 0#÷4³ŠÉ¾{¡Æ2'Dz&'b¥xÇzJÍÿ ‚–wlçرÇzmr…ŠÎ JF_ÙÂÄ÷wŽî¬ !À”Œ`ñ‚à‘“–|p„°ÅÝÕʼny0D‰dLíÌDbìd¹K{+’£¯B Ì3Ì-˜͉¦6‡kR{Uò{ÍÎçÑÒÏE¼>Ð1Ã'’¨ƒJƒ…GCb¤”òN-äQ¿Š»¬bèÁ¸côɉ3<ð#c 4è³|PÅ炼§‚ûn§+Ó°h4%¥kÓↈÀ¹ErŠ¦ääÈw­ŽÔVAöHŠ ´6S}¦‡ÈpL6-ÉI.B®mDùpZņ^li…–òIݦBìl—MKr2/qÀ«cI5¼#³ û0ÏAeÉE©[¡<±‚HNÕ”œœG´Í|t{Påîõ’“ÖâH66¢]$ÿI~‰!¿IMŠøÿ•óH¦‰ÿ°¤"~ÝúÌ®þ³‹ˆ!%ôTGŽ}(’äS n ÿ®í­ÃÁy9}Ѭv"B€˜šðZ¹MÜŽošB®a¼˜ÄHÑŽ,ÕÜç` BÐûÏíDGZ?ÀRLƒ{ÿY{@DăªeŠVqD$8'•1Û @щ8LKЇò'IÜ—‘ª’eüÛ–@Bp€©:qÜ`D‘H4+lódþ8U)R¼’x¤ùÐÚg›jë9œ¹“—ŽŸ;W%–RÕ'„ À_ûÒ¦ç^…Ë ¤y 'UÌ^˜S0*Þd)¡.J6©Ä˘è¨ã?Ê.¡fj̪_ý‡š–‰ç_·˜G“›L º3%/$ŽO¾ÁDÔ2#Š–ÁHôîiÓzÿÂÏ\ë€:è"b % q‚+< ÂZ7ü®öpö¬Ë®r$ß“Ä¢;ÿxKÿØo,\XmÄŽ.ÞÀîÇ  Ùy``#«Á¦i T4ä|ADL¥àGßZežsãçu>°åØ@fŸ£ª‚)‘Ýo=úDÞ쯎™˜/ìx^"F±–7^eÏüënrÇw¸>òA1ðv=½:rª3êÖþò3ßÙí56#ÇYóÌ·V>ùŒ J9«Äz6×7ú ʲK*Òs|áÆU¯Üý™5/½j&ô%@¤èÐœPõv&âæTu ‚H÷aë}ŸÛW×ët9¾L_¶'¾M”ª˜ÍMO´!„H^Ys€1‚ÄÈnßðú}wEAŒAqúÒsÒã;Æ‘¢AsBÓ‰) 穤ª ªšŠBƒÝQ""B°uëáš}œŽh…1»k×Ê–Ö>Æ‚æ ÆÀ´AÏ"h:As€X¢ÔƒBP¢ ÐÐPµ„ß; 5~¾OÁêÝU·c—`Pã÷RÁ‹ˆoâ¯L D$dwµì~«§'¬8 :HÓŽ«jlعÅâ"ñ–dGî’¼­8½WuÄL HEìðîˆoö«î®(u†ÒÜð+Ëßìï¹0'Û“‚uá*˜4å¢/{]‚‹vïøËK¿üž–3oÑ, Õ­­»³Ç™7¡jöª› R‹6XóV0d¸²G—q¦'Üshås‘´Oì蟖]ŲÀ£ãà»› f-5w¿|¨¦É•7±rÖÇt‚`¤ò@ó¦ÕÝíäÌ+™¾8-ÍeöÚ¹r™ßß¾ë¹ ÏúJ77³ÀË@³Z·.ïhé`ž‚QÓÎÉÊÔmýûŸï¦éÅ™=﮵Õìâi‹³r3`±•Œ©Šrôô ¦jŒ”ðþ«wϺÒnx©±®Õ?©üŒyNŽHËÚõ®I³ v._W0õ¼Œì4á†uË»»zyãËgÌs2aYBõ²Hí¦º}{ CI¯š_5©Â ÇÝ b"ØðΊž¾°¯dNåŒ1̘ÊÁ44¾õT·ß̨>«lt±㪛Ùmûöí؉Øî¢i£gN1Œ)ºærô׬©ÝsPËžX5oŽÃˆ1MM˜m•£«ný}}awÑô1³¦Ø‘Ä«à4šÆ¡ÜyçÃÕ½Ôܶ –ô\„ ´ªŠ™‹Ó|n ‘ý¯juŽw¾ËyÊzn…@ÚƒC:¦ÃmëjüÕ³*¤p ª·bvF÷SÛöØÕózŒC/Üõ¹½Û·‘b׿ö§íÛ;Æ,\ 1Ò‚«ž¼åƦÎ^fùkß~tÏÊÍ…g_Ýóâ¡ý‡´ô\_ZFoí+[7ŠiçMý‡Þ}ñϽëþþîîH^¾ºoùoÛõêiS(txÝ#·¾»b¥­j=»_xwÕ†ò9gëVo݆g»{ —73}ÜB4,[õܶq ?¦1s矮^ýÚ&ÕåèÚöìÖU+|Uó2s|ë¿ÿÎK›šwmtä—v=ºù…ãç»=ÎÁ{Yõì¹­;môüÚqšõ¯ý1<êòISŠ˜Í‹¿ÿCýþ†ÆŽ4WhÛ+h=-_8ËØ÷××^=hoøùöC¼lê¼tGÿÊŸ]»cën¦µË9pàp錳\>ê}íO=üp°?bú÷ï~ñ7‡£“ÇÏ(á&‘ݳú¾OlݸÓì«Û÷æãí‡YÙìiF㪽‡úþû·n=¨ycÏ›/²òsJJÒ›yòW?îhêàVgÍòßìnȶp<…w¯_guÕl[ñ|4ÔQ»öïu»û+Ïš':wìÚÔ8añ…NQï†úß{÷5«J´våƒÛ÷:&-œFÖðOŠÑTgÁ£ŸVVñ®EeŠˆõ5¶ÜêؾçæiW|73K…•Òû Å]RCî™Køƒ["oyþ[cUWüâ×£Òaù?{ëÒUÏ/¹ìsÓýé7üY×þä×Ùn kÿËüSW]xú¥—mzùÑKo>νño¯q.SÔþµ¹ßþ¯»?Á TZ?¾&tÕµj -j,¹÷‘Ê\2#ýoü𪵛ë®\2qü³[Ÿm:ó†ï»9o>hƒshzhË7nw,½ãååi$øÚŸ]¼cùKÅeÿ¥åDßöð¨_|Õ«ßýxkSKNnúû4 `L!£?쮼òëŸ×Öüïtþ’Ï馆ǂŸyæËWWFûqèÉ/4Æ^ñó ÒHç³·\ºyÍÒ󖌩iˆŽ=û–E7\êhzñÞŸøQýy/—g¡õÅoêšpõ/ÈÏEÿº‡ŸüÃʶÆk|ªSéXÖ³øÑÏ~w’ ¼yËÌ]olœ5ã’úÆ΂qŸ:ç;7x9º7=óô¾¿õÊË纉ñ`G¿ãê‡^Èö¢sŽÿá…C;>W¡'Þædû·<ó»~ß9Ÿþþw|„®[öã›Þ^µø¬³FÙÆé´ÝÖÈ9¨]0‚m­{Þô·V\Ù—Û`)\?‰P#ÞQ¡g3XV¬³e×ï”;¨aSM˜+wfÅäúíOû£Ó3&Ìb›^ÝôÌ?+ÆŽÍ­šrÞ×~f™ˆöG +0¢ŽAZ†ÈŸºpf´Kp…¹ÙÌØnX<£hæ¼Og·myz? a„ #ØîÄÍXL+ŒéN•¤ªØ¿fSƸ™¾Ì´h%s—Ô¼¼=f@%»|V¦WE„°bžü´X4|ü‘Áý¼ҵá—N>K„!mtn»mØ€m²±SϪ µ¹‚µomðNÿ«~Ë¡˜ELË=¾aÿÛýçΚ{ÝZw®Ýñ䣦ÍìŽvæàá>h…vÍk²çßãcèolÌ—Ýv©–å6Lmæ쥓b<ª³œ ¥{÷´Em6ñâoæîÛ°ÿŸÅ XÏ<hTM¶­”Ï»ÜeÀߎŒyWeÿöñŽŽC% gÛìïêlªKŸzUÏž69ݖǛߵó㬛”ÓªßF±-„ÓHU)mÔœ3??‡Öµ½ñÈÞoÞ_—•²•4ò“JfË&Û™ïR£Ëk×>ýN›ƒ A·Ôô|ŸÑÌù7/Ñ«v½ùüúÍnj£|~æ’ó<ì¦GÑUP²c/É |øÝÕþIØ3¡lìX]U6NMöÉî’6!¡å: $ EOÁ-aÅúkß ²\¯;eó+rÛ2mÓà–!ŒîÍ¿º¹^M8ó‡ÓW<©ªåÕgú,Ep…[Fú—·ÆtÝjzóáÍkö RTWvÑÜËò´r(ܲLa[Çì|t8nÛºÇCœ¸e[¶µ>h™f|(@pÓ¶ ÎöÁ¶Q6}lèp£¿µ—sξö}o¹ §º#|ïñdÈ©8SíÚvhË»¦³-ƒópÍÓ¿ìvOŸ:~”iáx2¦£þµ¹¯rnUûÛ«ú¢Ä¹b›V붕m-˲tw†Ë¶„ê;´m¹)4nY¦¥WÏ©ìÞº¡?dq\ûè5ÓwìídÇ›í „m›ª;ËË ÁcáÆ+–­@Œ¬öúј!¼ïùd䌂ÇYó¤çTµ¬]6Á¹³gßòçºzE|XH:¨ vŒ }vbS˾'¾ÔR\­ð@oScå¹7æ榔ãCü‚LJÖn|âGª¢;ím²œÙŸ¼mìä\3†Š ¾ÝÖöÃWîïÈËË°‚íÝm½£¯˜]^YDÑþCo}¯{ÿT—C³úëÅóçÌXÀôp~¾ºûÙ{í†Y‘@8Š°b¡>Û¶ Ø‘HÀ/€œªylío×<ðº5˪š×ºù÷+yYÁx%ô캿ÞUrÎwò) yÌÈXpó„wnú®†üB;ÔÖÛ•;å“—h*¸áF"3…ÌpLspP(„p•/8ãâ][_ûEÇ»…šCµí¨kîu·ç¦k\" ôZ¦°_v(ìã°B‘þ@ÂUQñÒWüñΕ};;7Ãuövô»rjAÅ´ŠÉÅ;þrpBµ0CÞÂÅé{þ¼÷åßd~>ÿ¢ŸV6}ïõßÞž•í 7oÉ<ïÖêªÜÈÆ@$CrÞ€óGCa=£´bÖämû:M›BvÄ•>&?ïíúïmpŒEcξ֭Ë~!ìpÇÎwòç}²tL>?ŠûgΘónì~ê¡U8”žá3zvùÓ«çeg ~:YÅá\¯¸® ÛÚŽ,Ž¼ŠX ïðþp($À™e™%šïÎ95ÕdsL+€v´YD"7ƒuõœ%Z®âÊN/¨tû<Ä…ˆ¿™ƒm=Í Ó†âJ+Ÿ–å6Ùöý] Õ“V8Λî! Ò¹¯»­]ug;œG3‹ª‹`ºö»ò'z¿¢º¼ãÝZ¨³a?¹ sG•ô7n Âî’ùijkG[,¿ªZa öô6×Ä L÷ŒKËHëÜÜÎÉ+-c†¿i;K–‘‘œ1#óY„îªëëh³9gºÏWPíMO'€˜ÙÖ|°ÖW4=-Ý% ×45ôçVÎÐ̃‡›bEã'©ñi7Dv°­çð!òÀœ¾Âñé™iLSWó!KèÎÌò좂þ†ÍÁ¨šS6ÁápX¡ÖžæC†i©žÂ¬’Ñ™}ûZ[xñ„ áŽM}ÁœÂÑå<ØÙݸ7f)º· »¤2Ú¶£¯/’QPìjsç³ûjBÁ sdg–Lp¹+ÔÜÖÔ“?z²J F†¿©»¥Þ¶Aª'½xœ×ç|˜§ÛŽ ªë9­¤˜Ì˜tœéG§vJÒ ¤xü"%‹ã¼;D2Ú9úðq¦Vþ¼HÎõ$“÷k½AG;¢ƒo—œb&~(†HˆcÝX1EëøÅ<íDÓÉŽ®œÁOtìùGÞ£´ƒï|âªRàÜe8»mFZŠ#ç 8þlßœx¢"Ñ{>Æq;IŽ{©Á:áýWÆû¾2çW'¸“Ekè]è}Uĉv{þÀ‘÷(퉻Ÿþ}}÷âén‰D"¥(‘H)J$)E‰DJQ"‘H)J$RŠ‰DJQ"‘R”H$RŠ‰”¢D"†sª¦À£AMùô5:ƒ xt™ÓMrr¸T0©¤nÃ&E!`«Ð}P)Õ¥H0@÷Èô5’“iဦŒ`vÜa“"ž«Å};áPSºBM·N üf—Lu*99ÊÜxì\äºSÞA58LfŠobÀapASJQrr„-ðkÞ#`ÂèÃ.’©6§x z¢þ‘èTu`]ï ÿí.6Ã|_ù¶ì¡Ž$#ïM  €‚%9#S«–› AXr2‹ Nëa TœÀßqÄt¿¯B ÀJ,ê—JiF^Š‰m Hñ¯-®«í÷ÿB¤âþ”D ËsøíŒÎ…ÃvêªüxÌA°ÿ3~À'¤C'‡×eµP-n¹KzJÆÜ:,‘ÈÞ4"#÷áúÌ í¥!sÂþ‘b¼U©Ý£_¹=ÇÎŒUý¿©¦E¢XgÙºÛ‹v[Þ Q‡íî;XµæÞCW,?œ£Âº‰ï`7{°ÅðèŽlü;°GÌqø£¯9àÌH€Jù³W•¶õÛªËVH5#•ïÔyWKé¤ãXìã–g°[{Lî·÷8Ù}øÉÂÐU¥O!mãi+ÅD[!0+ï­Û3Õ±1ÑD'(Oq @ÂÕùrasÿž+×öåi@¬§bÅWK_»¥ëÚbñ=Ñl¿jEÅÖ2lE̪¶bèñ5¡X=Šðš"¬›1C÷©F/˜ÏR ¡˜½Šm æ6ÞDìOÉk’fé™"ÕÒÒ8”ÄßNJòt’â‘P®¦eåmÞ½g^[þÆ7)U½%ÚÌ}ãƒ. a€Êj8ó—-†¨äjY^¶õQ—© ³3fÕÏúBÀçMßûë±õ¥ë/ý L¡Q뾚+¾¶iÉ<´­˜²úÍÆꉣö­îœôµ¦±s¼u/ßù¢ÃP²Û'\wxôpµ­(Ûòw—©À6¢‹ëg^ÑÕ¤Çáç‹Zúk/yª½È‹Hü`ZËœ8_½æ/ŸøZö¶ïæYîsgãÀè7~ý“¦êrÃÛôRéÎe:wÂ6"E—œy…M±¬½÷õŽéuwy]z¨ÓÊ\thÞgcŒX¤nÔ–_åtv ²ìùõ3®ù¼‚Ìã6ü(³«I÷ù«?W7å"KQ¥Gˆ›סqÿ¨Ý/µN¿©ÏÍOÍñ š}¶Z1åõ»rš¶¸úÛÈOÏyr‚Æ­º‡^·ÿœ;÷Ÿ{G(üòäÕŒ™~G4”¼€P£z4[ l.iè;¸ø‡m•ÓÑ÷̤7ÿÿõ½Üs`|Qåªo´´#¼qüÊŸRÑgöŸsç¾Åß­ž°á9°ÿÀà9¼^M_z¸À‹xF$F€–Ù—ú_Î (dvë±p2¹…©E:Ë w½3nÍïb•78ë{æ}VoúÝ„Û¡ãá̆Dö¹µg~»fÖ¥îÆ?5´€E ¶Ý“+;tÖÝl^ýîSŒ0Ó[7ˆœ³.ºãà¼OgîûSzO‡ÌigÙä¡“gË÷¼l|}é8 ¬OÑ: ‚fÆÜ]Kµíwã_¹†…‘´Òþ¢Kjæ_ÅÒê_÷8&îžxž¡ŒÎø|ÑS¿Ï}…3šžià½ÆÈ ŽÉWõg•CCî[UrÏnª:Ã&`ôm›}šYié{þåJ[¸eæy`+=°èÆùË÷žyep`{a:Â!3³âˆÛÿMÄédê!›3E ‰ß¶¯eµ’÷‰úÉ l9eÍc7OÜô;}öoMŸÞ^6ÅdrÇG}>WïaX"»é@ûÇnógTP·èwÎç åŸÙVµØ‚ˆ8=´¿9#AN«”0RŠñ¿˜B¬óÙÉ[ëjÏÿ¡©Bᜲ¤R°bFÖìÚóg×^WÓª¢ÏfÕüôÌú-ë?ýSWÐoºrl%#Ù®±1µÓ6ü'êÆœ©ég:@ÑŒ^#š“Í€ G¨p:#7ÁÝ“_¾9±Ù¯X®°/„`Z|¬‚ÅVUŽÉþ”ìYQ¹A\UNÂÖb!¥ó•ñ/îŒW³i·Y¿7Ä×óì¸b‰¸`v›Óp™º3þJ²<%AO<T,G®Íø¶Ôáéi©\{¯ÃÎΨû}ú3º4Nùïþ86ñÚî‚Š«®ý`[¸@ˆ/>T±¸ñÀƒó^"¯¶9¦jüH ‹’æˆÓ:` â}§ªÍãv¢RƒsOEëèKf©zÔï­‰gfcáœJåÀ[>ó¿Ê€>¸áõ7(l´?“g Lý8úîÂÊœÒ1f~ÜsŠƒƒ‚Š‘q¼S!TNv"{ZüÀN^V§·WrzYE€«­gÜ×m pLÁ_ûöþÊ‹CéÙ©( ‚ W|Λÿ¥}Ó–€Åó·Àd€ÐÀÜÌl}ß͆í (P{W»EeOšSkUÈ € °"z(Ï1™„Ú]à+ijÔl˜ A•?û%>þ]¹yzSG_å9Vü/ëqÑM*àµÔïX6vÕ_·,ýl"‘Ò»'ÿÐ[=Óÿc1FÂÄÀÀ¢a5R£Þ<­Ùèª>Ÿ@Pümª’e¨Öqú̄͵ˆrȹ—•×Þ?ÿ«Ryÿ‡zP¡…ræ„’Ú¤>Ø$ÂyS¢ŒàüöæKsÖ=ñÒÒwO7tµÒúw—oy4RôÉŽ’,Óº²kËó“ÖÇæÅîÈp~výÒ/‚R£oê3¾4ù­ŸÏø×æq‹cšª÷o„ ¾¸kü؈fMsn}%«cNÈËÝ÷”‹+ñáù`ñyÁ_òfaݘ9ˆÖ•oø…:êŽÍ‹>vœ¿ h9cÙ|Ÿë£Ô]²ùA»ìV[9Ö%)ÎÓSŠÇÆQ¤Z®,;å"D»Œº~ÓÅÕåÛ©\ÿ À¸«´uþCM•³!”Ò½ý­lÃ=ãV½%³kÆýµÀF¨üšý³[+×Ýœï(jt}[ES~Ćà0\é|`€>mûå­~çžñ«ž03çl¿üþ¾L'xùîKŸ(ÛðÓ1o¼È˜··êö3.-Žt>Ááê/¼›7·bãeîÒ£A3}Zóœ_7WΊ‡}Õ76öÝSñö­ÂQÚ8튮p@0ÀJŸ¶ã¢‡+7Ü;îÍ %­kÂuÏášÏr ,+P,G×t@íšü]ÁªÜx·B®î±ß:4y \K·ÎÛr¤ÛŠ*3‚6a¸2I™ßZ‡û·Åc¡ãIFpÑS=ÕÆmÓ` ürG2аB A8˜€5hF‹Ä­Ž…äò‚hÉ“ãÙ»#ŒÁD“^üÙu€000ÄŸ¸&’×ÉÞtL½Y§?ò©Èì?ï›9 ±A¸‚h€5hÖèà[É0U¢ÉÏ:Ä(ù ñ’Ј%KãL^ü#;çF Âƒ§/ÀŒÜÓË*Çò¢œ<ùŸp"Øö‰WfĆO¼Ìä÷ñp.ž).œŒ«‹ÑAñÀǺ& Dà‚R]7uñÔwnþKC9s[*fqR@qÙ ¤Z¶ØÐ%D0ÌAwk2>|räAâW Ä•R£E?‘´aÃχ³ûíµ¦æ›5.†#_Cžuüøz|àÑ=áD×<êâÿ·Ñ7õÇ;fŸ›Vûl^ónÉÎÍã–ù8eK^êè蘓éèGç‰$§§U”üç]KœõNÿλs¿+éUJ¤%n”’ž ˜8õkš%RŠU«xÔ‚J]'_’Ú±¢D"‘R”H¤%‰”¢D"¥(‘H¤%)E‰DòÎqŨD“S1S 11xþ§Dò¾ð«‰5Õ#Á°­Ì°9šB0xªOQ:@ð²iINÒp²ðé`©œÔÝìëJõüŠ\`\PÓ-›–ääpjXP2RÆf8Ôˆ‰ž4%µýSŽˆ ôDäÔ1ÉÉá¶ÿÓ¼ ’ã[u²Ônß"¹0ˆêE•¤Zh3¢ Fö J$©ˆŽä[D¤µ¿·ã[¦IB#v”k-Àm!Þ_Y… FŒÛŒ‚e‰úœGV@ !HzÒRŠÿ¡Çª(C¯ÿ+,Dbó\!yãKÇŸ¡+)·{X¤skýö-‚ ”Œ9³FOžçVÈæï#>€BFË«µMžª™ ¢uÏÖ·Žš¼p–0ã[¥Ù*ã}íG!R‰l[¶R)ÅÿÐ$©hÙòø¼tfV^^+gÔx¤Ô® BM«×?õ¯¢©³U•fÐßô×­Ëç,ºáî¼L…‹£3¢%ìUr4ˆHAìÐë––N[>¼¹f§1åœY0ã—Û]1êmà"foР’ "RpxŃ½Y 'MŸÊR–æQJñD"ˆHŸíÊ{ÁíÓæUs3þz'.¥N«JÈI0wÙ¼]§Û¥Å…EÁõÏÜ~óö5/žsÙ¥°81¦¹ 0#Î .H¡øqÓMã¦(\ü£O]€p@hNR ‹tF\Ҙà F°-˜ˆÄýIuBÕ+B¦-œ.«ãà^{úbg¢~ÎAR‡RŠÌÖ Âè1ˆ)zº0LÛäŠîúúO5¡‚sáuÆØ"so{—Í¡ ³mÃß6<ÿTŸ?¤¥WM¾ì–ñ3§©Lí›]óø嶺hÁ×&eÙ sPí?.|î­E·üñÖÍ¿ùԻ헜5víš5=‹¿þHinøÐò7¯Z‰Yî¢ys®ýziy1EÛv¬úç5{j„#gôÇo¹pîÁßü÷–{´}7Õ<_töÿQ¨ÂæÒ*J)~0kÃÀƒý7;v>ûö暘åʪž]=÷ãi…óÜÁO¢;<§+ámFêÖ×v°´‰…šŽö×ñâßßÿ•ûJ ³Cõo¾ùØ—£ôy JÌO®øýƒUŸ¸wҌѡº76=[¯g”C@qfyÒ<¤g”:v.ëžúùKoœ‘mîyükvúÎýÊŸ³¼jçúß®¼ÿ+gßöÏñyû^}ðkö˜Ï_ø??¢À¶?ÿJ ü›ó¯ý^Óáo:fü÷¬ùs4&u(¥øiF@˜‘°¿³jñÕÔ·kÓ²Ÿµ4¶œ}í n=åZ1%Ö¼~õïnÓHˆ˜¿~kÀ·ðãç/aV°fÕ‹™KšuÆähYÅŸš¸{åþ7ŸœuÞ­M«^µò§Ž[¸(݉ÌÒOÛÿ¶¦C$"ÐDDl ;wÒÅO³ky÷ÀÖ•ŸÛ0n‚3CÞ•·ì_}Uãæ×3 µG½‹/¾./B”]xWµÉ²M¨ªªy²<™¶%ä&ùRŠØ?d‘Ruݧï½Fu»”Y¹¹Ú3¿z²cÑÇËÊKRð Ï4·'«HSaõ7lx'sÁí]q¡Æ7z‚†'´æ»Y¯ÄûNŒ@eiá(z{bwžî„àÂ2)ct?<47‘1ÁÍÀ9"¡>®f6?ñ‰¿<)ˆ˜õõø÷v0[Ñ2\^pKpA¾ÂI`7Æ]fÎ#?²ÛFJñƒ÷…EÓœ ‚„°HËŸîSÿŽESp‡iÁm5oâŒ+¾áuù¾ÈëÖÅ.¹XcS)È»ô‘ŸQ5l€ˆ)Ä7Ä·ÜbߎDãýUCƒæÄx¥¢¨v88úÖs‹c1KŒ1¦ºô¦ïÂà| $\ $·Yü(0R³m„S)|à¥wžz¨'D¹<Ö® Š,Û—’Ë7Ü6c13&ÌJ^_h¿±ü±e– ¦æ攤wïÜF_vZZ®/txkwgH0–ºB}á rª±kT§v¢ qg¸=Ôµ{·#×çËIó¥)5›úú)¿²Ðvu5>ryìº×»õ•\Ñ„àPº Œ i¥UüOì \y…½ï|}Eí¡ê)„¿¡a˪ÌÙß*,.HÅ6%¸Éa–^½àÚkþþÀÛ'Ž™=oÒ„‹¿´û§?}ñÁ¦Š±£# k÷®Û5íæÇP¸ô«y¯]µæO?;¥ºkÛÛ‘¢bÖcÄ•'xbVCbàQ€eŸ{áÇ—ýõæå±ÏdtízáÀnqÞÝ ó§|rÚÄç7üþ¦þ…çªÛž_>éÖ—5ÍåÔÕº·ŸðFwÌüLN:—›äK«øAT.(cÆÒ{×M(Sš7/o®ïsÍ/¼î \¤R7D| ^q¤{3s‘ n ßܛϙŸ[ÿÎ+þ€pV]þ™Ÿý.-²o÷ËjjSμí±É£3¬(·Ó–ÞýT–u`÷ë/¹Îøæ9çïUÝyiÙi‚C÷äx³ÒH¶)rϹëº;n3k_ßþêãýÊŒKþ÷±’t5¼ÓnzfáYã[Öÿ«±Á>ëž·æÏ,5ÍŒÉ.ͪ©Ù´ÅŠ'¶‘yÿO3lK‡¹Àº&lkK,’˜B"ˆtwrð: #*Ní`µÍ1­ØÑ–Hú/­¢‘îD4(Õ„àZé„H@p!˜Â^( ¸ 3 ËJΑQÈáÂ`E`p¸\ˆsSG¨O¨rhù9ˆ ÁéÌŸ`#œ'6Ý×\¤9#ÓD •œë¶€tPOõ+T!×sºuÛ L 3B4°bž¥Z?D¼˜¶)"fræ ˆ˜+ DŒHpí§£DÂrÆqåAC/>øÛcϧ£S`ÐQŸ8a$2V”H$RŠ‰”¢D"‘R”H¤%‰”¢D"¥(‘H¤%)E‰Dòá2œ³mDü+µ'- ÙÿP®—œ\ó§‰ |Úi¾FWÀ§ËÖ%99Ü:–òRiÈò¤úzs!¦„,lZ’“ çš.R;©îßû¶BQSº6mßšŽˆÀ¯wÊ…¸’“sP+†&¹¯°äTIQ(„®W+j¶6ùHSU€´]·OÚóL{ɬוrn(9ÃgÕ,¸+¦ëÇ8¨#N–!˜•Cf:3lÍØd™‚9Àâ;$`ÛÄ *â{ÝÅ7r#SÉ)°Š†_!ÝråÅé9̬#n¥vÐÑRdäjzjÜÚ_y£ÌÙ=úÆýg\% „æU:þ9õõçÜ1¿f§Õ/º·±|2ÉØÿ·êÍ©,CØA3çã{ÎþZTÕ!HêPrJbEÀŠ.n÷,ˬ{ÌŸv1G´p×»þ’ c^RÒ@qëm N¸P "ž4×LzýÁÞýeëØjêxeÎK÷”eM¬+×-kÿè]E[®x5¬óœß˜¸é馊Éζ7Ç®¢õìÇKÊ=<úõÿš¶zìú%—ÂR’S+ °¼ÆYWLYýÈèÀ>Û¨Oë×jf]j*@êí9/˜¢ön©X{HDt0s¿¼ûœ³Òv¼¡§Í©«¨† ‘·dï"¡z|ÄCªénXðÕ°Ö_< {7ëÎŽ ,çâÖ’2ÀSÔSqnÞ†¿xÍKƒ2P”œÊX±ý¥ _è˜ý«–’RËSÿûªu? -þŸ°Ç›r&‘ÛVöìš³¾ÓbEæ…a¹Ã!Ë™ `RùR°ðnR3£ŠHöLJzÔ󕉄Õ'CËäJ§'‚ [66É©Š²êßq˜ZÏèDåÅ|óm¾@GØíMAWMn:2M‡cèaÛRTâfÒ§t$…8:¶LeÜ"‘ÈæFÜT.-¢äß1²³mL]g<ª…(`‘Ãt›©)2 Š †!_PÙÅj_­'b@!¨‘â·n¯ÜÿŽ`Ç{‹EÒKõνšeB¸áé? h³Pͨo IDATû¼r&€ä”YE‹£/ó×¼S²ö½b–àÁŒš'â%ýE)Y¶Þ·kÔŽ?X㊠øG]è/¿²mßÊq«ïj©˜Lþõ% õ‡ÆTAt*V„Dr‚03 TtnïÞoW¯{°£x ,¨?xøŒûM©CÉ¿C¹óÎ;‡åB\`e3Ö·%sìÆgÛè=¥s,r†{T3)º¸qÊ%†Ãq*Ç»Î,Ö·']K!’‹úÀf¶1èËŠ¥‰¦õš½î@7éÍ3nìÊÁA®`ÞSw€àB+ì-œÀÙ}Å3…Ñî÷)ÂÝ9þúÖÒ*p€äÀâiN¦Ž««Q82+]‡-©›Éñ­u¸  í¼‰§<Æ‘;uÆ·Mƒ)ð˃Üó÷N#zÔ‹ƒñTlQ1Ä O8EŠðtG Âƒ§/8]Ö+§Oh¦)–Õ ÄŽ_¤øÁ£Ž ‘ÈÌÑР­rN>ò¤I©J%JN™èèc˜bYÝNX¤÷>8ð€Çž|äœ!§H$'B®W”H¤%‰”¢D"¥(‘H¤%)E‰D"¥(‘H)J$)E‰DJQ"‘¼_†sâ[††QîDÊ´”Å´‘õÿÙûîð8ª«ý÷Ü™ÙÙªÞ-K–-K¶åÞmll`½…HBB* BM#•ôB _¾ÐKB ½šfcš»q·å.«w­¶ïÌÜóûcw¥• |? Éó>~ü¬fggî¹ï=åž{ŽŠ 0ÚmÇ£Ùøxá„2hlŽÙÎ )ÑBØ<Šºeé  'n-Spò\ðjƒ2È#4÷b[;ÔáMEɨ)3vvØCËÆǃ[â `pŠäKm2n!?ªÇ-0ŒC;Í…'o¤,³æØvÃ=É W­µ1œL›A…ÜÆsjðS²nD¿iÊÉiC)Ù$:Ê?KýÃîæOäAô·á£=ú{¾á"ÓÞ 13„Bf4"%)ºS$ÇH!6b†!UÝ)†T6›ÑxÜ ¾=ÄýN(Í2,M× Ç ·7I7£ñC.Å U÷(âꯔÒ2"Bu å®*O iDL)T‡ƒÈV#Ž;*&x(™T«mÝÃ˾ËÈ9é‚ŸüÎm±”LšîzaÙÝwô8gÛ}úÐ-€0 ÁØzç}¿}PsêDœH6E FLËXxâ3^½oÝ%wÜ™í9%w¡ýº˜¤ü$:m…_ûÃW+.ºk|Íèò|:Þ¸ê SνöËfâqGEbf"šŸ»áíõ½Y9e~ÝI3 õ¼ñßÝZX9+Þ­ ñ4K€ÁÚÄ[¾õð-LPÕÐkßži÷Ì™§‹Ç@€eWÿñ*EQK‚¤i2‘PT"HÓ`)ªH( "°´¤”$!™˜ÁéÂD¨žQ NýÉC^꓾HfË0™„"©QH‹"‘ ’YJ RJ©¤e2³PTÄ’B`i™ Šš<9)í¥” @¨Šî¢/Ídê|¡%5RÄ–)%„¦ Õ¥:ö2ìqª &G‹ÊS¾÷ÅÖ'nëiå>OI,”·àÆ{\Ÿ|ëµj룯üabH2,Y&I®gó†Îig_¬µ>³jeOQéˆpW]°«;£raq±·yçúh°[:ËÆ->?í0Q`ÿòkV[ 3†¢gUŒ¯QÓ€Ea3K VÀém`ÿþ×·oí™qÖÅšPÙhÛöÒ}Ž —T«0‚-ûÞ}¢µÍËÊ{ò¸Yó5MV°nõ³YR)¬\|qAa63(z`Ûò—züA˜1½pÊØÎÎôi±ŒvìYñ¯¶Ž æpzGÎ"ÍAÌ P´aÇŠ»ºzÈŠ«95Õ ÏÉô©¬ëóÛ×odÅéÈŸUD¦á`cð¬"°Œsñ©ß*Î÷Z†‘:ÊV„óNùNEY®‡GÐ/±8ÍQ‘È´ÏíØR»f•!!‚l|åáÖîøˆ©KFWhëÿÉÚ7WäTί˜6·kí#[×¾/Á÷—ý×o9wÒèÙg™X¼ùþ›wïÜ}„RBÓ½ŠÓ‡¾º ,áÊ) lypÕ†F·K¶­½wã†ú¬¼ËŒí~ùWÛö„+fŸU9{aË?ûàýU$PÿößV¾²4«æŒÑsÏÏvî{ûþ;º¬ëþU¿e÷®†ÓϪœwjpÃýï>uOÈ„P©ñ½_m\¹£dÆ9•sϵ¯;` EhZxý}?رywÉÔ³ÆÌ9ÃØóÔŠÿܲHíYúú?ï´2&TÎ?·XßúÞœ.ÕfËqj+¦’ Ái'u4…-ë8™¬EU@Ñ]EeçåŒ(P Ïñ=þlFEMáèñfy©oWs;ÑðÏFFž5õ3g:@ŒÞøîŽuïWVÑ,¶R¼eÝs×/î4l<n»àº‹tµfú™¿tï;Ê~¿ëÕ÷']xGA^¦<¸Ó¶š/ÞR:¶˜Y*çwîo ±Ù½ëG N}|ʼqFyÅß=¸éë öz¾]ÛÐ6ãÛTNÐ ¹W~þÑß?Õ¹èô¿ø¢\/” ÕãV<¾GÚd9^mŤ¼9Ìû}ûà‡O×3À€âÒ »<¾DÊoUU¤ âûvD·cã3l0D°1D“eYª’îzd5{ÌÌ«~åɇÖp•!)Q2ÿKs6½üÆß({EÍôI,!c{QŸ'Ë&@Íø\©Šx÷úŽVé9ðâû¼*™YÆCþžÎζÖX+,³eÃ}+7E,duP¼=ìF¼»£Ó9zd>K@j~F± žÖ3fµozxåö¨db³Ѷ` )Tugf93‹­O¹k—e³å8¶ÿO‚úÅ;¥‹zbKJš®ºHH@ö˜¹…ÅSE²4)4_^å¬ÂŒ´yŠaY %ÉåËd«SÑÝ”( M† ˆÁ$ÙdVT§Ss&œ5î1'_œU9’7Kêp‘*…N¾à‹ùùyàfK J­¥‚ØTÍ¥¨ªÂ âù_,ÌÏÜe19”þF+‚a¯(ŸTìsñ ´Â>äoøá¸ã§4ÈU:BödOšvî×5Š+KÓÃÒ2¥©¦© @(èÜðÐò·‹¯ýãÞÿxseÍ´©U¤—9©;ŠRž`ýÚý£53+33ãÕ—Î;1/ @‚4ô4f°B%s¾VSŽxŠ£×º¦ w0Ô!i…Zƒ ø²ò…E³¾:µ± F˜õlêÊÄnЈ 4:¶6*ÎÙ6[ŽK·Mbu_&SדIÕ”’$HH€HeNzÝSXaŒºìÁµOïÛÙ`™`3ðöÏN{ã¹—,æÃæ"!V#"²‚už~rô—~5aÂäɧ,ØñÄ_ºƒE9btƯ¿d2B[Ÿøa[›ŸÅå³çïñ ­Ì¡ú÷ûÞ9Û6·äÌ;+W»_»Ç€†ôðO¯ij3å”ά¨_ñŸÞ47>}SKÔGÒð_˜ïvì~å¯~HFÓò?>ôƒ¯Õí7Gva¸nGãŽ=Š‹Bë^³7ªk¶õ¸•Š ÒÍ-Oÿà† ©¤:4WF–H„ A83s5MKü¡º³œŠ‹M8F|é”ËZWÞÍöŒ\£»ÉS}þÜE'Ð"·«{ý'§¦ X€ç‰_øK©µ,·ðŒÉ£b¦:bÎå£6Þ²uå†O;aâù·‡ýÕ~ô‚jùÝcΚ¿h13ÆŸ÷ãÀ#w,ûÍEN3Ò*?ã¦Ê±E1à³·ýèõîéWo©ŽSÁì‹o(*qË8ÆœqGëý·¿pûºbzª>7é„ -¥§\û²þ{é¯Wi"53f^zSaž*Jn%Mè#ö‘}ñ©šTÉ ž~kšDýwî¿W2~öð“8Žx£CÎïûÕ!ç«`ÿ·¨8¸•¤èš#ºmÒÎB ¡¯ [ê3ê7=ô´ã’ïà!}ðÛÿ¡1‡]|wè pHE,>ìBGyòG>ÿð›ñj6†¿ÛƆ 6mØ°©hÆ ›Š6lØT´aÆME6l*Ú°aæ¢ 6mØ°aSñ˜ÀŽ±ñ¿0ƒ7lŽeà›!2  ïÝÞV*QØ°G—ÉF@ÚêcÞFÄ8*Iùtг£7rœêð®$%+Û°¾}¸—¯±ó aëÛìÑeããÁ§áüÑ(óoU¯ÄßÖÚð~œ¾;aÆ?7Ú¥Nm|,±ˆBN(F¹oxS‘‡ èÇ5n¶ÿØÆÇ£¢[Çàå2Ç´©ú] ©T}©ôé_}òF’9þã!kÒ±z‡÷ˆ?âsN{YžCêÿä¥ìDpÃO*ùuö¥(é~êÛ$N‡uH)}í‡ìX§C·´ÂQZb>B–ñëƒé°™–Ž°¯ÿhZN"Ï8ä'éÏêc6ÉÆQ‘S‰; Âr·mrH·¿p'ÓŸôŽMž`;²ƒy“ ÁÊ V‰Èh?@”¼¬ú‚ùÓ’­6&nª@X‚ÄÇô’®ö®H¨/1å(äWËT¢Žÿ¡GXÝ­» ߤHz-"Šµdu¶û‹j¤íƒ>¨H †d¨”½õwc7.µ²OÙøÙZ‰iU oÝc·®·t—‡ æí÷ãÞLäÉÀÙñzõ²‡¤;‡p\‹-½üÀé´f#ÅÆ´Y¦o4÷å„9Ò(ç´ÏýÍ ¢¦‡'nç-K¾€øQÎ9¼}âT1ó7ß5¢ù ¥¹ +¤™f¸hɶE7Å5‘Ö#>Rú Œ=£Vÿ¦kÊŸ¼å©Ò DZïÚ±«–o:ç·±„»|@«8­~ísê0•*?Åir>Y*&Þ„ƒ²ÞûBUKF¯§ÐgF“^!Ñ|gÍÚõ»Îy ¹¢¡ÚI©tל3Îã¡SPÉ ËÜE›Îº=æÐ@@x_Õk×W¾ð¥Þ+ˆ$º“®ì%Ò € ™HBœ.R’‰¨’ªxzÖeN3Ò%÷g¦ê+¹(”Ù°ÑÓU ˆ3$CúòtK ÐI{EHáhÉi[—Üh0@PÛÞøâ ã¶ÏÝ<}1$'òĺuߥÖHXŠ‰òó‰Î&ƦjDˆ, N*ÑÀ)Îõµ*Ù#qébf8~3PWTLLº é9uã¹Wæ®ø–¯·˜j‘Œºnm)*GXB¯®«UÕÒ($,eAˆËäHtÞ[5¿påkÙM¡ÈHÚ±®lËãž`H÷—_ÐX½Ðœ¹ûåíÕ»Gì­Þ¶§~ö;sÌœØ($[žªÆ)_ñggH4Ý9m3睊)ܽÔŠôV\ÚT–_°õñÌî&+sÞYWF4 ½kåˆ-OzBAVóÚk®j-«ôì¸gÌÞMÂp×¼®×MýjÐëp·¼U²íW4Êzió¤/w€QWµìg\x}(toŽüÌö¹Ÿ•<Àä&))žd©™¿à`õ´©µk1s±oïåÍÙõùÍå»·¶Mÿ}Ëöî}aä®·T‹,WYËÄÏwŒR`6¯~(¿­Nº*¦^Õ“[<@±ï(ÙúDfOH÷:¯iÌ|KXíekþ.>ÕÙüvfO3»kꦟ¯|± a‹Æ-S¾Ú^XnKÅAô &÷N¾2æBZécW˜²$‘2œÝÔÉ.•CíŽãÞ&A`ɤÀØ[½ì^Û2ù²æ±“ ÖÝRY»ŠPnßÁ‡Ê÷´µŽÿlÐçÌÚú‡ k–FŸÓ4ùâmŸüÒM `nÍ<øR齓®n(˹òæñ+Ÿ8§núÎ}ÿ½þ%h$z—Mzñf—kJÓäË;‹óÊ—_5ò@}hÄIÁ kU ω¸ÜŽ¦'§¼üs%gaã”˺²xìkW¶¡˜žž}y»ÔµI-£ÆñÍu`ד#%;§]™Ñh¶?™[ÿ4í­¢¥§7N¹Ôïløâ7‹ZÃPK1Š6ßërŒkžtIØ\7iéíîhŸ3Ž(¶ì›·æõÖ —´–OÊÛôë1;×Al:zW^÷V7íBt¿0ñ¥[rc…3¾ÖëîûÎ_t‹OiKÅAÕ ³ÁJSÛÒ¿5 h²è½K;J·.< CšœYñš^€€žúQµ+HØUì„™}`ñÝ¡å`@[„ýOŽmÚˆI³Xhìl¹ðÁ°,ŒüâúQÅ‘bèÌÌ(Øûå‚6¹¿L*ÃÕ2ùªžl…W†W-Îl-Ÿ *Õ*@Þºß9J®ZwÒÀ€²(Ìõ•[ž¬?ïú¨ËÍ¡Bqb²tý_­q?¯=ñd˜@Õb„¿P¼õ™ÖSNbE3”œº9_–V¬Ð+©:  €ÒøNÙ®­í>)!TŠGç~Çïu!\7ªöÍpͯ÷O Q™sðŠâ͵,žIF$R~þ¾ç€Ñ^¨=',¨XÉÛß[ëß|Ù~Ϧ¯YBs4>5©VšUo¼ä¯1Z_˜uÏ=º%GÍà˜pÏìu@JÌëõÖÕ¥÷Bu`r“i€t€á(Œ:t˜€ÃcAº²Æž©IbŽguD¡½[ýò~bÉ$´`“j’+–°Ø$$ [|~üLÕ ËõÁÝ~U߯ÅOŒ™Ù³¥â‡=r"ß¾Ÿð·ÇR´b…ço¯™Ë›pÕ„uԘߎûKk`2,‚«¤×“Q­UÍÙ$\½9Õ°<5AGØìaObu…ô`³í-[ñ#I’ j¨^ÄÛ¼Ó™„7ìʀŹ"ž\f  â„?ï¨ܦâ1wÛ™WIR¬©ìý[ ýùë/»;èbÈ!Þ¶DlÉÌšú)ª¥wŽšÅR‚„^ÿÀ´å¶Î¼½aÔ”¸'+ïõ³ÆʾB®NŒ(Ù9ö¥« °`ûY¿ dæ¡wý”—¯K«¤E½‰‡¦L')M=7ê+!¶ÀˆùJ{¼£ ²Ò#Xšî¢¨/K0ƒÍiøªM ‡9d“ˆåNo¶‰8 Ä}UÝ¥U0l ¡qÊB§+˜Äˆ©O«QÄÞ¥æùJ,²M ŒÐ#ªÒËÃSÄ“í³ù$Ý6)§œ‰\ðR$ü~¢5ßÏ5'oþìQgòHÀЈEi¹+Z«/0©Ñb, ˜Y [­‚“÷L9Pgv0.}b`mEˆHCFWwëY?í H8:8L‘6ˆ?ìÆÝŸluzÝÂË`qa:¤#f@@Tðšùî“.š‡@@4LÂÍÖÞ#¯—¤&DÃ[Ù:á ³/TÆ8LÍwŠŒ¦”Uƒ³=#0¼£ MBFÝáV(•€±Çw¶¹2ˆôŠºòàÑ4ý›'@@ܬH0>Ò4›‡ŸœÛ†ÀWG­³}§#!«××^ïîÚ/Ž½?³ßßT}šîö´×z:j]þâ¡}=6…ƒ€Ù7w«áŒ\Í¿=§µÁÑU[úÞýªj©½õz(XÍHŠ-+îR2÷¼¢ötyö>5zËû¬;ÛaÖ)J+ „‰öéߤ³~¥ÞÝælZ[ýìÙU›ß…¢3«ÂØ—ÙÖC†Ò:åJ}Û-å›6;ºÛÝßœüÔy£kk¡¨G²i÷"¶D¢G`¦9Qÿ:Ÿ§¬£|žoÓÍuuj¨%çƒæôšmS¾ ŽYª–½ãáü†Ýj¨¹pÕ?œú˜ö‚J!%ƒ-^Žo½æß®Ž&½y˘7¾2uÅRs顽¶I8DR1ñÀ­­Sž¾ÊIjbÕiÊÓ+ ÜrÞýÞ ÏëQYõúûîÑçl>åöˆcȪ “ŒªFäP —Æ}}ÇÍŸ¿Èp7͸}Gõô™O_;åu«¹Ü«Ä#É4½|׉·NZöƒvz¥gn_üÇÞ5ߨ^wƒ?ﾎhF¨ï6jÔ¯Xfò/£WåIù—n8ÝY½ò¶Ùï÷BÉj›tÃžÉ `¡¡æü¢ߟöÜ5›—ÜÙ5ú; «zõ7ËÂQh…Ó| ªr0z…aÙþ5šâ ¨üaE´x$ÉE©µMÿ‰áºkì—T™ddLßñÙG:Š]„õ˜Ù8í’Ìß׸›½S·/ùCн7¦ÅC`¶¼·öÛ1ïÿjÆ3e(½Ÿß>ûl–X>·9Yň¦tߘ†­ f"£pgCâ–•øÓÆ´ Õu˜™ôÃä±¢Ÿˆ‚jᦩ0ÞœÖf¨ˆnâ&<½€ 0$àL8-•† è‰ ˆ@b§–I¼@ 0%p ˆIPDÒy›¸²ÁÉͪzÂæd*.qŽ˜ÉÆD ŽcH‚ àÄõi@¿ýÕ€'ã¢ý—@°$„€ˆ* $.X … QNæs¤œä&OÌ ˜€ €á OõÈ‘öÛ㌠ž\‚éùÇ©Û&|$i=ŠguˆV1@“aâ°pÓÔÀŠ3âig‘>3‹!RQ#œvœ€xÚ¸ §ä¡ÄAij‹¡õ]3Y½ù°s˜Â(ÙŒ>ÿPÂüN|EâÃúÛ÷+™Ö~p²ä]$µ"Õ÷4‘4ÇLì°À¾V%zOùK‰`õñߎ}ûÄÜ6bÐp2âÉtD«æs¨oðH¥#ü}襎öG¹ÎÏé?˜f4Òÿtþ‡üꨧ#û€é¿O+þˆC <~xwl· 6l*Ú°aSц 6mØ°aSц ›Š6lØ°©hÆME6lØT´aãSBE;t†ÿ5ŽYàQˆû¨,ÄLD‘Íöäaãã  b²Þc¶3Ã’ØÚ…ÖÄðß’Qîõ!›‰6>œ㲑ã”A~ìÊׄ…Hhë{+*Z:ˆ…ì¡eãcª~ÔA+Mp,wfø£¨ë¦ ë§iIäºà ßÞ`ãã™`^ k°†Í±¤"eØ;eY%wäÙ°ñ‘¨Èƒk|كцá!!qI–åã´ê‰É¿øHgóU2üh÷=Æã´j“vŽlÌ„DĉŒ§àx¨sŸ ·7¯L$(G uˆÅ¢Bõ¸²FéNåå'’цîŽ!ˆ"œ(FÃ$¼ž¬ÌPOЗ_¦åØ6ŽEeÚƒÐÆ R1UAÆ»¼sÿÚç5r_ø³ß»-H&ž-OÞQ»u7)ŠeDôâs>÷­ÂüLþÄ“03id\úú½ÏªNÁ 4í…¯Ìçs±Œ©Þ3Ï™øîS[>{Ã÷3\‚y@΢„HK–:£~!Gé礎ÌI¬Õºnýû S.>O‹¥*‹4¼^íÈÆùÏ!JtÌvKÙTLjt¤8±÷«·sKÊÇ5ÎDb!Ń–G¾öÞûÊ7ü½(ß%ãÝkï¼bÓŠñ'_xžú‰"bƒÕÑ—÷Ãs!E ½uëiÖ’ÛO=©Úˆºîu~Ò9¦¡ÂA>¢8Ü "3„h ÎLRUÈ8EœHã*rx¡ª€¤XFœA€ ÝÍÌbA©fˆàúÕ[—œwÝyh@<ÎB'§Š¶!“LÂIB"jÀå$¢~HN„€@,&™„7‡8ƒ¡»F´†ÉdóЦbÿÌÏ` ï¸oœqÚi;þôõ¦Î”6AÆ‚Ÿ7Û™_ZB’É—=júˆõíR©ÐÍ' ‰Xqë^UĬ{ž,¡ ;Öþõ…'^ø³?¸¶Üü×Çü Î8iÛKwu…Õª³6kVÞŠß߶[þ´ÏŸô¥oyT0s°nÕªGU YË0óó?¯® ¦÷[ÿÉîmµRøJ^½ðÒÏGžûÅKO¿ H½ç²‹\ý‡1c˺>xâíGÿ«³#àÈ?ýò;j&T­î¥?<³9ÿÎ+_[þøÓVæôÏ|÷¾®7—„‰Ò IDAT?øÇn¿:áò?ÌY4ÍØöï[¯ÓïçzxÕÒðŽ›wÍߪ+²,“Ó„²O³Û†A‚eŒ Ÿæ2,™Ò¾ˆ™-v+.%£ážƒ;ßܵÉ9qš: ’‰ÁJG"ÉBUT Åå‰wî9Ø[ø½Çϸø³»Ÿºþ•‡žuîo.¼ù·´÷ñµo¾)˜ío½ö—›”±—ž~ãÝsOß|Ï›×ï&%¾æ/—·h'œrý½K¾z“«åÉw{6cþw&Ï›Èbòé·ÜUV^kxaé?þZpÒÍgÞrÏܓƯÿË¥;÷t EU=ùÆÞûÚ­™çþôÉ EͯüîÛ[ÖíŸí§_qÚŽnªk·‡¦zò[þðqÞÏž™¿ ðíŸ_X{ ¢(6 m©ØÏ9"+ Å–W41è-fŠ7­ºï½gŸEâE7LZ0SÈá9‘÷Í"¤ºóÇ-<;¯8G-¸ ó‰g 'Ï/W¥ jÌØÒÚÎf8Q÷Ô/Q.øÜen ˜K–+sÜÔ3OÑb(¼àºË?߸þµ1ç i“Ѧb¿¼9ªÈd©ÏùÂ9/î­_¿é…û×¾’5wÉiÃ…ì>¸f•tˆÎîn3dî_ý¦ƒ…N¨˜–‡î[™í9*ßð7îz퉼©7z]Ú0¨.tØ”À}ñ0‡ÄÌ`3Œòó®Ûüç;×<_Z9a¬ÑU»û—óÜ6yŠ²úßñÎýʘqc…ÙU¿v—«h¬î€B.ݳëý cÆV—Tf®]÷ò¾±¹ÜµyÏÖw©Ç¿{M×ìüAHÛÆ2õ°”pÏŽÏ??²²´kÝýí1Ïø©'« Ë^Y´©˜œDªY·ö_¿ +*,ƒ¹}Ý#¿!WÑü¯T”ϹîLoÕÚçî{ÿ¹ *þxêgNV‡66]@Bq0õ­Ñƒ„¢(*ª¨j_qB¡jB$ÃIQ…P ¡•œù™¯;×?{÷Š÷BϽø+ÕÓªHSNøÊ-ëž½ç÷º¥ÐsǾøê/録yŸ+ZuÓúGÿªáçã¾ø÷žû~°ü·d–ÏŸý¹k-y¯üó¡­Tª+$’º) EÕ’õf@¤è”(ÕhE<£/òï®øï¿Yꈮ¿wì(4Ùfáq¦X«HÉXY-ý›¤nº§/ð&q?1–&H!U‡`†‡eÊÄšÂ`wØ’˜Z6·º3#ñ(47Á@ÜHFî •ÄÃÌ é:Œ³d&áðÀŠ%›-tRxŒA "Õ¡ô÷‹™„ U‡P†4aÆך ÁˆÁ² :¡(`3@š 2R@@<ÂL iNAÉ@hnp"ºë™_~Uw^tÍ +’0¢l1ˆˆì:MÇz®ö8°d ò=Ç¡Û†€xè0 D,aDÒmK¡ÖJÝÚ3@‚(q„MŽ™ "²8N¸baµ ‹X1Ž'áÀÌF4=ð-q%Ñ´'< #’,•M3 3õ+0ÇC ñuòâ! %Š0@ÐÁRZ`–ñ¾GMÂ|³Ôt·MêѽŽG)76Ô¥ÝÒÛZý?RãŽò¥Bá ¥2òÛ£?&$w^Å fH ÉÒ4äÒÆ°sÛØÔ©ƒ˜ÙPŠg^úK±Ýl*Ú…:¡ªgú7€Øl<^aïâ?Ž¥âaê¯ÍC›Š6lØ°©hÆME6lØT´aæ¢ 6l*Ú°ñƒ²®xmw²“Úø?HEAÐTÖÅÒ,N&ê×”D’B{ ØøÈl¡Ô˜Ε¤(ôÁí‘ën;ᄡ2X{j%ãÑ=øç8†w,!ñ­ ˆI<¸Ë®¯hãã¡Ô…¿œˆIƒ3‰KÞtÆp°æéi,tDa0öúm§•§øY k°ì/{0Ú°1,ðIQ‘Óœ•©Sý¦ÕšÛ±¯ GýÇCÓ¶cÕ»#wÿ7o‘¾2Ûé5<ÔÃ^["} ƒn„°(éØIlnÁM ”öÕ' "H UÀ}”tBøX'§èËv1¨i/™ ÞÃ’Ç™„(÷Ÿó‘Ú@ \ ˆÃ¶¶ *&^ƒH6Ö<õ=/ÍX{ÑoM ôU_Í5\™Á…›/øWH ò¸<%T!ê~½èå[šØÀ†éœS{â ïnXwÁ‡3= ir~Z%©4ADÎp0ùl@+ªš–©{ÀÀáË*Gû!ÿOç$Oã~Ž9ý5wŸ YÉd>Ìpù+¯Ü3óʈË5`Rèkù¡GÒz-ÛF?…VðýÚ)‹’³m* H꽃Ä}6•Š‚\{ï»}…'ËëH £ÔÛRdÞ†zÂQ+Ùüjh¤"dî[O™¡J |çvª¸¦näHÅ2X- äxwÍ­Ž+AÉ; àÄJ ÷sLI ™’æýûZ*Î fäŠÀö’=¯:£Qé,m«¼(èsA† ¶Ýít^ÒæÞXr`œc'\lF·–ì^ªzgå¥Ý¹ù0ZJ7ýKæ~¡—Þ.l¨e½¬eüçÃNJf ï—âÒðŒj¯œ+y ;»`Ê«·5û”ç€ìÍÙý\vw”œÎŠs{rŠ c¾ƒÏeG«Z³{Kö½¯¯»âÂÎܢĕ¥Ã‘±õ9ÊÔºªÏ01k+©}¶§ââ 7ÛæÕ°rÛÀ0¸{ÖíÅ`™¦ä 2Z*ÖþË?áj¿Ï3”ShŸ"g`Æ"‡ ˜€%Ýë˶¼©I ºªbõ?Êw¼Ëœl«^þšwïWQðxKVÿ¼tß&A6U½úµâƦ˜»Dt¯ÿÊ7³;: PüÞ7ÇìüÀÔKâÂ*^sÝ„ÕK¥^ÄÂëïCó ÿ›ÓŸ¾*·;u‹Î7&¾üÌ@ ÂÈ:ðrÙ+:x0]íÞs×äe¿.ûà Ó;%flÿÚ½1=ù»Ÿµöí܉Jë “^üvf >Då%¶D¢S&ל¬`´V,»¦rç†^jŪ^ûvq['„ån{¿líïÇlYÉš³Z*—~µ¤-»"ž`ÙÊú" “‘4ÿÊâÚ÷IÑmR ?+.H9€¢Ì ÊØû/·2c[õDu¥/.]‘ Gúg+™HI ]ªžÖês;ŠÊP^ZðÈÕfæøæñgJaª-oåµmo¬žâ\õÝ\kò†E?‰:tYô­Ïïy¯;kVÞ¾í§¿[7" Œ†êÓ3+§ª;¿¤ ÍÕ›ß*¬: ˜ s¾'´•Ízì{yµ+üÓÁ<ä}Vî@†ókòšSv{ÁìiZZÜáûàÂßF*H†µo{ëþæ+®gá +Ò0ç†^·žá꾦dýCMg]™£ì{mžÅ…u»{kj@ðî8^xAÈéNºvlu8¹mŽ"…þµåÛ—7œôŸ¸!ˆARÁ »ÿ¿ai¹1g¤fšäŽxs%¦CSLÉ‚‹wŒç÷¶­uË(HŽrw÷6…Nï9¶dõÏ#Ï ûJ¢Ý#=©å&$[™sÚK¶dï~IÈ8+ŠªhV,Q<™§Ä@Ò‘-©¸'_À(Óp˜Š2jf}&®À;©W®è~E.²¤vT<ÏÌ|t9`õº{›ŒÌ;ÏüeXÕÁ†«{¯ôe;[Vº,•óÑñtNäF&ÃtÏ : ’¡…¹=ÛFB”JÀÛQuRyÝKŽêš¸R7bWc׉3¤€ÍÃai+A#&˜ƾu›ÃµÄŠnÎÙGºßOf<§agkáhSÞ¡D Ñ÷™I$ÔpæÄ2LX7…ˆuúZ?`6RÑV1¬7.¸+¶ïå¬Æ×ò{÷;œú™ßmUÕY¼[]³qKÇØ3ƒ¾lV4Ù/¨Bï[Í#V9Ý+–2¼YÏO•R-ºŒªe°Œæ-Ü5ûJ)-6÷V¿ú£Þ _l+,‚É€lq¼=³uSªkùõÓ/6LKa†#“‰À†©*‚c$©ïÚ½#–¨Ûïö†Ã–û½jÕÞâê„*lûO‡È·ã"¸-+¨B¼3æw@BÄ{HZ£VßøÌ{³Žßm xnéÈœ\7ýk’-Hîa@/nÿ•öª˜*{};î¨Z{wWéï@)}˜#6¾}ËÞYç@Žî‚·  êÍOØ Eöf&ØáŒÁT<|èê[zn  ›€¨ª=aÔµ÷µTL º]`ÅNx§ÔÍøK€B@fØÅÑfl@Ü‹Y"ÓRúªqpýC' 5Ú-x÷ôÇ/e­pï ·öd§Ö…¡J‘ˆ"¹N5´®T¤rÿ=˜“HÔ”b¡¤1OISÃÁD¼âçû›¾>þå/ó*T­¦UìŸϸ®¬»Ç?^(»ZšÍÞP¼yÚ­1BYS q÷ŒÇoÜ5ÿ¶†9ŸË{ûΩ•Vü€,»mÛ”ð„¿)μ¤rZ¾Ó´Sª2*=³F¼uÕÅçmß)¼¤q\LNëTâd‘ò^ƒµŒ¦ÉWNzëÅ3KJ¢…‹ëƯ/{ýâ¢Ìñ–Õâé•?s)L lÆ3gå®þNž«Xé­ušvÌ=ñv`PâB]#ç—mü—ñƒvO¸£m©8¬¨H(¯uêEß –„;âöö‹M“bWî)”qjŸM¢ÁÒÙ´à”]+ÙÂXÞÉ»ç„ Áœuö®yáˆKƒ‘spáñ¼QDïø«M[ 6žð_½-ïyB=R;¯·hvÔ¥ÃBâû{ZÞó:I¸êr¦r‹a <ê’Z‘Ët„ÝŽhÁw7¹gfúÛ ïÕ%UýE­oMÜWštC7ª±¼E»WF“†˜³iþ/d®²lƲÔNÿL~ýÎÎqWt–ͶdZ!†³yÞŠ^šòd˜B%gì<9GP ·eÖüåk|þfÞ@ÁÜ°×+LlBŸ°ãÔkrêש´¤gĉQCzÛk®Δ­«g±:âÀ¤ù0ûôm›Vÿ«x¬Šº·¬ÄŸ6¦m’JPKɪJ²ŽÁ@¢2R_TÊ »AqÓTŒ?o>L=OÄy)i-LüO©¸‘ú*ý4¤uR®cuM©ƒ nÈ%ÀèµI\?q¯d€Nê|dXO¢ ˜»¦>ûe”ܹqñŒdU*ɉVý]è;Y¦Åë%®Öפb}/ )ÜøýŠ¦qkÎþºD*즯m‰:òVß4¦Î¹áÌÛ EIÍ¿ÿG¹Â¨ðàÉ%˜žÜyP¼’Gÿª/ké 8v„¯Ò?Ò…ôÕõxÒOH»þ!W–iŸ-î7ÈeêHBÒa]¯săé-L~ –`‘šbR“ŽBèú÷ìÿáà¼Ý§þÉPT;ôtSÑÆ'0q(#wŸø7蕈ãXº.‰½kìµár—ìãaú·p/ص¨2š3>êõõË[6?`Ü¡Âi)%öØRA•FŸz|ø­e=åeI÷cì´²aSñÿûÔEJ¥";VÞËÄÅû øWî¿õa»@lØTü”*¨@KÇôâG»òÀ’Ëö«86JˆýlØ°©hÆ ›Š6lØT´aÆME6l*Ú°aã(8–‹²/%Ùp†)a!ùiÃÆGÔƒ8dŽ%«s°¤º2¬Ÿ§)1>Îc.¹:2ƒVtÌvfHF[ac¸Ç!2é½1{hÙø˜‚K Ç ·6(T<–RqWÖ7AÞ ªÅ˜Q 6¶ØÑË6>Þ$îqàì*x†Q7…àP  oÕ’PÐ„í´²ñÑ©Èp æض£ ÃJŤÊÕ:M¯î6¤zȇôåCó&$îÀƒÚ­þ—44¾xhoÿé "33³HejèKO‘VíÓþ‘õÆÌÌ óQšÀDĉ-ò‰“™mKSb€*Z"Fª0Îÿ×`M^3í™)Pqê]}ò$TDƒû4 ^Æ7"b–,tØùòÛþ#ž1ïôëosZ€ ,âæw2Û‹â¬:ë–™ UÚ>z÷¿ºì‰—}ë×Ù>÷ü9fDÚ6­º÷GÍ~mæUwŸ#­™ƒRÉ%>þ0c1ÉHKãþƒ¹UÓ ZÖþíågÚ.ýùOÜŠãçkb†Œ6¬¸óúæΞä3·b&\E“ÏžqÑw }0å'½ñ—ˆmÝ·~ÉŒ9{w03¾1K"u¼uÇë/­q“×BýÃ:TSÊN¹ñï¹>™×Ðj§l±p(!9D°ß;íJÍ™·Þæõy-kàB%äeòbR&S.%YÌýg¥ÿ‘HÖD3–¢Í›6>ýÒ 7Lr¸œùS¾|q•t*Úášñ€ :½$DyŠ¼lE{ýågÝ>sÖb†P¬î­+þöíWßyÁ?qÅÚ0zå->DD'&™¾ïS[ùÓ›”|.‡´“ˆ mZ¿úÑçϘ5ÛaÁΊ3¨i¦ Tø÷6Ͻæá7~¹¥%e´²B –#Ç•ëöÒLìçþ„NCB¸yU[§;Ã-þN3wäŒ)©®6ö½[¿{¯`«eçªÂª³s¦-­ëAäÈ55· lµÕ¾-<%á–QGMå„œƒ;÷ù:xDÍ3¢"¿}϶H8$_ѸÙ^,£ÝZ÷n›`·¸¦¨|” 5ïû`™?Ø}pí«…3ÎɈ5¶ŒVL™,H‰÷ìoÞ³3nž’ #ËløëwnÌÈ/‹tÔEã1fG~õlŸ×͇dÍg¨º¦»3ûòEæܯ¸þ™»þ¼g×O¦U’ímÛµ¡Ç€„3wtᘧB­[[öì¶T§3w|¶§¡¥%kìŒ µouÕÕÓJ¥!u›–sÖ¢Š±YR 6·îÚŠ˜`Å[ZSX^®YÑîö=ëz{£)ÜEÅã¦9EèÀÆwãF÷ÁUË ÆÌ*ÌËü”›‹ƒXÔÀV„Ë/ýcõø"+O¿§h“î,ö×í_óÊþÍb€ªbXðq`çC¯þ×k7mŠGB‘ÖÍkî»eïÞvŽⱘeD£KÊpÃk+î½£ùàh ³sÇ++îþIKK/ØÚûú—Ýóצƒ¢‘¸áß»þñ›Þ}þ¥p,kß¾þ‰¼uÏï›Û{d¬}× ¿[³|9Å:·¿s×u[·ìˆ»‚¬zàöýÍ] ±ÞV‹­X°Ç”²wÏKËùw\J6v¾÷m;7®‹ôv‡Z7¯¾ç¦›k°"mŸ¼õíÇîêî6Âþƒïþó—ʤu~$>ë]‚hÎØÎ'~üö3üþx nãC7¿ÿò3†JVϪ·þòÝ»ëŒHo熇ßzðûï>÷ºpX{ßøÍòç?H¨2ªÙ²áÑ[Ö¯lÐ\²mÝÝ×­ywu4ˆtl\ù÷ïlÞ´KUyÿÒ_½³ô­H¨;ì¬óŽ—îû·TD<Ü)9ö¦e¯ñž­˜T‘‡&EÝHA¬µ%ÜXÿê_v( d,ïè¾ú§ÒB‡TE Åáuúr+ž“Ÿ—#âÓzö¿Ý°eGõùgŽéÚ׌?éb]—;îºS–^<û¼/94!âó–ßyí®ë‹N[¨ ÒÇΛyÁ*q´}½3òO¼¨f\¹4f÷ìZQ—1{É)ç² W×–{×òt¡g>íÆÒÙ‹<°EËå›7ìŸpá´&ïÙßX}Êe^Z…Óév ]ë|ñoõ¡ü%_¾%?Wy¬ë6¿õB儱šP5À;yA͉'ƒ9Ûí婵±ÏíŽC’OYq# 3H‘­ÛÞ{ô¯TrqÕ87ükÍêMÓ¿ùìôi™˜0ÖxðÎGªž-Þ{¨Y]pÅU×»BtõÞüŒ?/ƒªÓçŒ;’ÞOR4w&;¡£û¥?lmʽø—?Éó*Fd~óå'?ñ¦¦M«}§>8ï´Q±¢sOjm15£pÜL±vÍØS/Ê°`ÉO»ëfðlÅ>;á°¡nB)½`îE5ûŒ¢‘™±ö}«îºzý å}雺:,^3œ™£Ün…¢h.g8JúXÁÌ ÙU¿'sf™ª Ã]šWX¶³í ¤ðæW¨ ˆ lYÜL)™…ƒ(»¤¢ –ÐuÝŠÐ3KŠŠë·>~G Ð+¥Ù{°!–eJšm)ûŠP«~{£·x¦'G'°$WÖ¨9ñ-âqKK­ ¯°zÝæÉK'Œ{îM×¼ðÏ_Þ¿ö71mì)·æ€¼×N™öÍe7Îx?¯„Õ 5§Ý¶Ó°ªfœ¾û_Ÿþî7 ‹uh>_~†eĤ}Ôå'~Ï{wŸµû‰Ñj°>ê3ç‹gy³Š«NYõ‡ùdV{Ô`Og¸úª;JèÍ­ÊÉý÷SWŸZqö§|v–ÿT³ñXîW\Y-ý;3˜Av8` ‰¡Àäð–éN§"Ø߸;+άŒâR‡€e}/Â’˜Z6·ôïÌ`f+æ÷wvg–©Š0‚õÁ šYP¤(2ì8h©yÙ™F°-–™ùEB€A‚ž¦ÝѨéÈ(Î.ʇÅÌjßg‰'à @ƃþ¶6oa™¦ª3Ðz=>¯‡= þåŽPb½­þöh9åšêh:ÈäÍ)íØðG\…ã\ÔÕÓÏ.)DB¥pë¾^@qfe•”;X³Œõ¶Ö;²Ê\.ÀF¤ÓßÊ1Rè¯|cÅz›(Y#¼^O"bAd†:›(®¢Ì¼rÚ»š›L¨îœŠ¬B·–¬aE»›öÅ Ê3¾ãù ^Û¼ä‹?ýºÂˆw4tµ·I%#Te¸¹ÖÔJ³ó=,YuP¸­¾·»“¯pŒ×'Ì8«…Ú‚ÝTgNiv^¦e°j¯ BzNEF–ç+/ÃÊ`axX2ùÿ¯½ïŽ¯«ºÒ]kŸr{Qï]–eɲe¹alŠÁÆô0=Ô“™!LB&õA†Iƒ@ -/Éz/1Å`:îàÞ-Û²dõ®««ÛÏ9{½?ν*¶Lâ7–%Èþ~üðÕ¹çîvö·÷Úk­³–ã«GEÄ#O€Äãkõ`Z{óŠ)ÕŽõÙ}T*ÆU*,¾µ CÄÁmQ$ NÀ¸¹d$~’P©$”'çf†Òae`â+¬‚Qüs\•ñ#ž(Ÿ'` ¸A€€pø¸™£ÆXb QïЖH„L‚DÛ†|òÌErx«;hÂO5ÑM&CÃë—}¼ý¬oþ×m¦a͆ᅘ½,gÔ‹‰·0ž»Õ¼mbo‰cMÅ1WÛp~·âŠD‚¡|o”ð,%‘‡ H4ÚLJŸh‹ÿsðzbŽq‘IJàØ©˜éœð™¤8Á®~¨õ<±©hÌHØÞ#2I  œi›2&3çøQ`Y<º@™ØÃiÀ³ @ð?[D\cCºÞº²'øKR`‘l_*ª ¸À&¨(pLgpXA3E';®MýŠ¬€ÀÄ™6c›Ôm0_TâÂà+¥txD&"Ç÷n«>jŽH87†­M¤Â;,'ÞÿªÆ£'ÌKdU;†±>\bE›hêhÏãÿ—Cí©QGÊÐôB}ÀîCT4k†!3×WàP¨‘`Ì–JÒhï>ÇûÂåH·‹hö\}ì$ÂxäE Á `Z¿5"Ž¤ÿ…H@šìd|(S 1U³¥2>¨õ:Š—Ã2wEAʼnOEsîHè8ôbÉ–7À9o×™wñš(v¯Ðåt=˜³¤aÆ !»u|ÂÒ‚Ú÷EùÆjOÿiÄf7< õiÎTP|[JVÿÚ©Ms~Ù•é>Ø\¶ÿÞ<ÜúŽøU¼.ˆÔ§5íî+:K—ÐÑüÒÔ­Ý/º[5¾ºV6p#ãý2½£`õO<¡#äQÉ€pò¬æ9w÷yÔaD3â{òÈ 8ˆ€Ñô÷g œ½éœ%I$¢ÁÞ û­8O*€ÌÜ[¾7yG”¶@7®úŒç­»Û)_\{î¥:u¿s[ž£¤¶zñø<93ö‹°Ú/€€™Õ@Ð9(Lõmv±©»Ïº+$;0)žtˆÏf€H`È:€ ñu™?Iðæ¯Ì]VGàSƒ3w}Ü7é< ä_½)—k(ÇóBÅo6+åÈ@à €€>¸Ê$¸’nõµôO»«©¤ÆŒFÅ#M¥ŸÜ]þ¾Ë¿Ž˜!à{dv$fÈc9qÝ ®„Ûl¡ €‚À Š§°e d„RY`ü¨R8yïù÷¹×7ÇŸXËBÿ‹Ù-¶]WÜ´Ê©{.xÁ¢¹ÆyEL°l‡žÊìÏkO·dí{O5l¾¢‹;Š+­;œ´ÿ )Ê V?Ô^yWo¦GíÙš¹ïm{$s–µ—Ÿrx€Ç2¶>K[diyÃËά­È*Ú´®©òÔ´O»ƒÚ@îy­e3µÍiÚ§yf7U“U`ˆ¡ý™µï¸üÝ §vMº´/=Ÿù¶}ñ¸+›¼â®žy¿é‹®+¨ó×͹؉E›Ój_óøºIMë.½¤/# Àh[þÎ×{K.µ6¿šÒÝóLmrQÄb9œ \IŽª™ñ5À–y`öm³>üCZ›Þ”%7œ‡–e4l–Áî/üF[QpPÚ^œÔàØ;£2gýÓŽ0È» ¥t6Ä¡ÌuJéW´ä—!0d]¯•ïê–¼ €#%·}êO›ÊÏÔ’["{êž´4ÄÇ.¢ c 5@ºd©îLU!J€M9Y×ÿèÇ#.–vZ—ãÑüƽ}©sÝ;lFÅÞ‚œa -ñ߶(FíÇ¼Ó ¤@îùìЪ®kòDÉ`CÀp˜R‘Fªy4‰3ΤDÒ7Æ™$iš©æLÏÐTƒÄõÆ„‡Kn¶¦7§}ú{ÙíõÅ35IË^ÿƒT:Ú»-†Ä‰$™â•¡x Q¼m>ª”:4ñHCù, pÔ½Rõñsþ¼š"Ì ¦Ô1ÐÍ&úŠÏˆX­ `ŽD`d ”5ƇUÁÚ±aКÔ8ﮨùä­+A‚`é¢ó®Añ…Ù@À½õ×ÕïþÒBÉ`-ÞRb1ŒtdnÉH?Ûo%$²nz«Ús&§n¼Ï¢ä ¸3Fë¸À¸ ¨Æöš¾ea²õ1b³^\ÉÕœÚEu§Ô-üyéÚçìø9¢­¯äæ3.äãhâG#d v!q`Z¯5DqÁt9Ü¡J!b~K(ˆ@Ø?ù»‡"(ïZ äÔö÷´ç”hr¸bQS Eµº™iC¸ê”´¨ÙAíµ„dDð^è;ôƒš×.ŠÙÒ»Ëo¬ŸyãÔ•?«ù°i׬E!x¦æ¥ó:ÎXÞ,¬>äZ,céÞ¹Zñ†» Ör@ÅWtKÝô³9"#] vHºžDÖ`w" FüÄŽ¤[mš‰ó„¸æÖξhöÇß.t¿Ú0eö®³~]²á÷³_~5×Ô¦š;£PyL²-hw7T.»Øáo×Sï^x=%Úa Žm³®-¬ûy$åƨ*U*pL×ñzuXãðŸëà·[‡½™A “÷0§S¤ÎH {40x|Ïkpw5h¿Û>L&0­Û @'ñ0®üÐMÿæ1˜‡ˆŒ„¢XB S˜ø­ža}`,QEª‰¨Râ³”p 0Å}X™ƒ•òÄ)@JüÉjG8ô(æ=fæ§aÈ0x¼IƒOŠ0TÞ;upÕuèÒ°gG ›;6„ß9éåÇëÎyª+#ø×tK$(rÀ«K &í+ª¶ÑF±rÄ“€ŸgñT24p³RNÀbÞðϦ#(0N‰cpâ0¬s|3ï7hH߃&嘜4iÀ‡©û ‘ÚXOŒ‰>ÌÿnÐ1 GVÊ0N3=ñ' »hW4™“|J4Íñ7{LÃþÒÚX|=¦÷)‘ö¼~£å_Ý›™"lRm3ú™aøìè¿:¡’^õáN*x”Nሼà£Þs´bqد2BxøÍ8j¥8²´Õþ;zGFiÕà9¹&é±!£Ôðˆ¢IûÿTºiy,ûÒ='ßj˜/j&N,* |õÏ. c´à{«¯¦xè0ëóù¬IÉv¯×îvB¨îóß_õÞß>E5¾oµy¨#æà€¬“€I +HDLFYÆA©XRP’pè2~y›Ñ|£9´ÿÃ{oéìH ¾6Û¢<–DDföŸ±Oÿædxî€_B@2BuÎäK@$ƒÜ³åÍ>ž´à ›•Ÿa5WZنͯ?æÏZ<6Û²uUèä“V‰PÂHë–OúzCÉSÏw)VI’€©hô:¸{SX³äM?YV-,Š€@ý{÷´äϘյá#–^“™›§¨Ð½gUgK3sdeUîub,Jª úlho¨3Àæ)š[œ­GI±€¿q{[ÝÞ˜!¹òfä•“>b®!g¹%eƒëߪ®º‘€Pôµ6·¸“rã‚©„²Þß²u½¯§O²gäT-°[ ’ð7mm­Ûo€ä.˜“SK€‹Ÿ‘ÿÀ'ïÛŠæ§ggxÃ[öìËN½p‰ÄãÒÎ×îùpÙ=,œœŽ C°ygËþ8RÊfå:µ0¡‚êhر>âiSΰhµmmö²9å½ûVûbù…SŠ€é=‡¶¬c) r ½œƒÅ]{Öµ77€5-·j¡Ë.éœT ôÚÚvpŸÎeWþ¬¼¢|-Ø}à“WzýúOŸ,¸©(ݪ_o1LuŠH<‚y—Ý_’âܶû¥¡ë Œ€€`Qßýߟùœ—Ÿ1§¢ã…€!ëݱiëì·ÎÅ+ïééö9óRP’´m½cë†C)3÷|¼tnyó‹µ{´8Q²¨«~µ~ÍÁS¾ÿJF’¬é„‡ûwq@Ž Eú÷íÚÌåâ¬ILïø|ÍKÏgãɳÏ-ãž¹sù‹¿*©|,XûAý>:û÷Ë Ýjݸü—·6‰!¡sÃÔ@s#Fœ#ƒÞ=ïn]³u殜5 -ºîKßùëë7}缦ϗ9Îzìò˧ê1èÚñÎÚOvð…Õ•ç\VW÷îìœj·Ç bB@ý{»â—ŸÍ1Rûþ‹žÅ?*ó@$Oþ;aP€GýÍ»WÉÓ¾]– F,½dæÜwÞyÿ¤%§Ú´ì­“òkòS¤@IÎÉ3æÖ¯&2¢¾ú}®Ó¾“n@ –Œy™¹©ÊÝpÏ8ý£ÐûÞ~O<×+u´î SsN?oï+ëýÑ¥î̼–5Üžq¡79×=ýŽ‹¦ƒ ÙÓr6ýuKÁe)iy®Â /¾b¢ø™q˜¶‡Ù fŸ½ný‹þù?ö»·Ú^ù½Ùý-ï˜ß{ O=ý[“ú®ÙÝ!#Ìeð5÷âüTGZÖ¡Mo×fËÉ…ž)ž[ºa@ƨý³6|°~îOç(Z”qD€oÒ›Ö<óîÎw‘b¡Þ¨æ™{ÇÃÙhß»= §×dñæÝ{‰É®êS-¯<ÐØé³µì³Ô\˜%Q dwuniQ{Ë—ØXxïþ ”z®RÛ´˜bMª<…?ùtKìJwjVÝÆgwæ^œœ^à*=ïü Ð"¤G£D†Òu+°¯‹u\|·ãJ?­eÍÁ6é¤Ë§Å"0nD4Cèl¯Ý)ÞOß̉i‡xóº ›¿wÖ|g8U,@†¤ƒšá%NÄõh˜;¼VÃdÀ@’ìV'ÌzŠÃ"+„ SÈ7 ƒ¶ë‹~d qÍŸ©é¶i×?ÈV<½ù¹ÿÅiIš\yÁí…©eç}Ÿ>yfÇ«¿â’ËêÎ/;çöÒÒ\~Dœ_εÌégòéîŒF·þÑ癑SšçKä“ 4¯_÷ìƒ)/£ _F-Š"ÈöÉ—ý”¿ÿäÖWdŠÃ–\<ùìÛ ‹Ó ØòùæþhL™–ãáš™ä°Pû’·°º¬z#Š´|¾ñãÎSîúuIq²¦‘hBÝÛÞxXf¦š»Šòbá¨Z6nVe§íËÄÒ£1;ׯ~®ÑŒÝJF,¹À‰bùEwë<³í•@qÚ’ŠÊ–Ü^R’1”Áäï®ú‚Š‡-Tt˜Ýˆ!o«Ý ö‚¤$;7MEã3 DÀ дÂ/WM?y‘*K([æ`°·qÙƒý§Ü§ª²aDL‹62Ô»}È\€L–!ÓãKnðptD˜`2³ ÙCÉ8éô›ÿ&˲ Õ”)3–ÞS„|]M+ïÿô‘û.ùÕï“3 §^ôŸegÃý-Ÿ?±ú‘ÿ“ôà© ŒÃwâJzuq^¤eë[k·¤Í{"ÙK˜ìÖMËz .¼õV‹bAÝ·þÐÇ-`Ï(«¾âÞŠP0ØÝX¿ö©Õÿ÷I?˜³pþíÿZÿä­>ùÜ¥·_12ßÀaˆÝy3JN:@±“ßÚµ~uQÁ% 1UVГ;÷›ÿåµI(É2Èû62MÓÀLxËÉEÖ•„ý€xâä‚’Œ$—ž½øÚ¥!¡,KH$b+v#ÐõIDATéËÏ …z›­}jõã÷%?ð¨ôå³M3F³qƒ 1nƒ#Ή8‚>ÐÓ²YNŸiUGÁN¼ÊQÖW<ç™vIéœsŠgŸU<{qáì%'/œíYwp›ž–—¥u4ûýa@Í·k»$3”lž¬ÌÞ£È Üw ·Ãd'4JN*8p ‘T«[±xußž–ºNŒ5o}óõ@”)¶doî”I —Ê=»}ýÚÞéëÈV+krѼ ¬¡úž Hl”S 5øB¦ƒÁ¹aN¦¯‡5clwEf4nxùYMaëB‘Ö/<$ËŽI§]ž’’̵X ¡A*MËúã¦;E”!ZûìæZyÞ¹•’i$0Âè9õúÜ—žÙ·ú¥²k.)ýôãÏþòã¢É“t_W(ÅkÙ³/JÛô‹wõeg¹µþ¦¨dh¡ i±psÏ™÷MÛñ¯+ÿç‡y¥“0Ö×¾ýS÷¼æOömáÃÚM9ù¹ ßÁ•ž7d¹pçw·oø$§ ˆIàoÚhqe4cHd 2´Hˆˆ€¤”’Ùû<ïÑ|+èŒhH×4D9­tæŽWßX·lÀ®ê‘>wþ´®/þ²½èbÿÞönZU\&a¬ïÐ6WÍåéN%¤GbaÆõK·àê«>xù»ii•ç z5p-ÔõÁä'ä.Y«æ”õ›_úYÏ”j‹lôîþ°ßsvÞŒ™©U‹sWÿø½Çž——®õ·MÉš1éTuÓó_,s&;åˆoO8¶Å4"ðV\XU¶æƒG~RXVŒZÛŽ•jõ÷ ŠªýµïìÚøINA‰ÄŒ¾Æ-Κ¥9Nй޸åµßåÌÿ·32´Ø×Ò½÷Þ{œÔÐì‡ö˜6ª„q:èíQÞÔÉs *¦Ûìv›;Å“]d±X˜êÎÈ(›áv»Nä0A¦ #8l D}ýÞŠù“gªr"5 ÎŒü,kR±7«<§jžËF Ø“ËWÌ™ãÍ,KÉ)°%åL™f‘4É–œ]saá”ê´¢òäô"«#½4£¨\UdóÝšœgx] gzÑéwT̞Ƙ3oæ™;cŠÕ™ZyaõKTIͨœŸìµ‚bs$—.¬^|UBîs#)ÎôìÔüIª$1K’;kjÙœ“¬ŠJ„ª+5¥°Â”lK-ÉÌÍ "«'»`Þ•ÅÓf'¥¨ª§¸|ÑÒd·Œ)vWjùâi§/¶0ÆT;gjZNCtæNON±+®l—ǃ,nâ'’l)9™“kœî¤D¶,%)§<)Ý©Ús.Wʤù™ÙIÜÐe«+½úòYK.PÉŽììÊ™6YcVOfÕY–خ֞âšEÓmÞ²ŒÂУ’Í›3}QVÉÔôâ —ÛŽ²3»êôêL+<õ–ê“«‘¬™S$y,À˜bs¦N>súg«ˆ’=3½0OV­®ìJ¯Ûzˆ¨JPš Ž±I}Ü^æëš`kûÐûŠ¦Sã‘/"Ü4 ø‰5ëª3¶·›/I CD nºXaüi^ ÓÙ“Å—"@d˜Ý‹oWñ#€©ba ˆÇ{ 3Ö%ÜÍãÞ,Ca´; A/L€Lúl¦xâq×ÔDÃL£|ÂÏiÔ‘q2}t˜™fŠðhc¦?'æ÷i&¤¢‘Õ ÷VÇÄ IŒoá†õµ‹o½ÿ:£€ µ-ž¹+Qò`óˆâî£ Ž<%ú{Bq‡ KJ ÍñUÓ Æ×T~ôïxÂGs<×!Ðá¾è‰ë'çðŽìÞ‹)ìµù9^èˆ;qØ„;Âþ3²ÌD!‡é‘Ÿ]¤,d¨ñ£NÜ´õÞ™‰Qj9ZÕ4Š!‹8qÒ%âCÇ‘ø6d§e”F/œŽø­8+ |©†8¡·hÁ$[1Å€¾>ÜTøjˆæžü­"‘H„*¨(0^LDD#J2„¯Ï«‚Š_5uä‰NðptˆØ6‚Š‚Š‚Š‚Š‚Š‚ŠÿLTœø&#LüQd¯8¶¹c9ç‰?ÝÓ3Æ$ßÕq'Èt‰$§ÿ?P¥1̯(Ç)¾º–7Mô¤n:‡‹ Á x¯IL-cCªît€klÞWeb§ˆ¼°Oœ”ŽmŠ8à†Éc%£O5þ"ì?! ‚LŽ czøû‚€ÀÄàùØîètä:ª€;ìŸq?Ž¨FiΈwãi,sX-ôe÷üýÿ^³¿¬/4¶c*R<춙؋Äó0 fç4/J âwŽ£Èˆ„À)Þ*H„ õÎD~¨18Ãò²Á`6éØ“D˜G¥¿Ç)ñPM"Ðϱu6JhªÇé¬xÄ™ÌÜU"ŽCË*>ý¥ÅvÚú¥Ðã¡SxÒÞ‡K¶þMÕ ¹Ò7éúƒ5WE,ʸ¦!!Å(}yjqwê®ó^mÉÏc¤ñ‘´îüæÂÕŽnyL¾è%ŽËG)ù¨1‰¹§þ‰š7~œõȧ/3ø"ÀpæÚg|²aë·7¶y¼Ç2X(÷­˜÷æƒ{Ï}¶+=}Ôcö½|Úÿž\nF—ã¨éSn=X}‰¦(¿å#Õ®ºßÎYuð³§s ¾f¾¢T$ <TÚ »ŠQöÄ…@ YûŸ+×.?pÎSé¹ í›òæõÅJÊž™ç§xjî mÉ U7äÅ’š>lϾÖ` •a|cAàŠ7b·Ç·šø¢ˆÔ4xOðGîoœ0¾éy3pÉL.·|˱`iÅ)ŠF[êÁ=áä%(±/­1ÇÔì‚%fOå˜HÅøȽ٢îòúK^ïpªŒ@·v®¨øäÁIJÊîg‚™,àÈ"ÆåÁí—‘äŒÚ= $³¢Ä·fm\óÄQ11ñäò½K®ô®û‘ÝŸx2XßfÞù]„Ž)MåÅ“Û1†4nL4³±l\;°¹Â6uõJË´KBv‡™ÏTé^¿ýu 9"© º-†™ì×Ùðln_Y£wsÉÎæ™ßíK³:¾“yp•ÌÔìöŠ|i^ÐX(y׳éí8(9íåWõed¸÷¿’ݸy»&-íÎ)ŽÉ&2t{‘ëJ·Õn›;¢2X÷ÿÕÍJ#NK¼ÁJª}9£e/’’Ö9庾”4 ÝŸ|àåôÖÀXRGŵ}©9ÃΗFwþÚ?ÙW¶V c#! W=d•Ì4rÁÒ+Õ¿UÞ´ fœ €€Ï72maÀ GI[Åu^+ø7—n[ÕQT|h%ÚÏäÜ–ªëFtˆ_Ê{ÖzB:Ø,Fú†Pr.—Æy$Xûú´¾öî²+B©3Cr³·§%žv8²yÊ?±»Ni¨¾®ÇÖXºk.K †Sö{DâfæNJ2ê2ë–KæNíÌÚý‘ár%‡8ª)°42*‚A”rÓž™[+_[Ô—]cm_ÃÜgìœ~!Á Ñ…í(G±”¶u\Ð\èníÎ(É=´©µ  Ø>ô`ùçÓ/Ž)Ùe­õËÊ{Mö*êj?ýÛý€Ö™µç9*z¸aÚLA(ùÎÔæ+³6½ÕuÞž¶ƒº{a_f•Hÿíº¢öX$ï«'gQoÖ CHÿѺܛu‡øðÓ&I몺 ¨ö¿Së['å`Ǭqþé¾ Ò@öÛÒlAO&DЗqð·/L—Õf=©ÂŸ>U—ä@jEoI¿¡ªRÄRXÚ‡7ä$í8çÇa›É·áéâ 9Ü®0‰¹s÷ó¹íÝM ø¶eרx¢­¤ tžrcÆ ßÍÚµÁ_aÁ˜ÖyòýiE@Ðtò7óŸþuªÿÎf’ÍÒ>éäêml—œ6¹·].nÈ(3“ZŠóã SÛE-ÁûW¦ô±¶)×¼i,³ØÓQïmÞ*¬ÙÔÌ'óyš×‡‹oW|µ*Wb)¥¶µ¯$Ϲª×a8ý}1Wº!!Žýù9ØÍ (Š¶“û,`¬Ó$#iuþÊ5®€Òe¹ sÆu«^¬ú ÕŸ6­?­"=‹øJÏ®|¤êƒ;)SûÓ+²gsUƒFä¢âaɵè`þCYM4–ÞTÿ’”vK§ÛÈâñÛ¸Åêª_–¹w€˜‚±6UGä <»P[ûXÅÇ;ƒÉ•þŒé¾¬*bfZ+-eÛ}Yu-{¯øÐïÐpØ)–¸?gíÓ"Jjß&E™V?ÿ¡–’ràd õËþ÷ Ö.gÀ U§XÀîß¼’± ŸÃfxekUXîõ„üñÓ,EsÏ lú÷¤žú€³ÂÙ¹*œ:;ì°A\â8agÅQ(j¬Õ÷%±36νÙ`þý÷Wl{¾7gjD=áí‰[,P pw7X|L=$’F¼©hãšÞÅóç€R¼ñĤ„N(ÙâgœÅÜÅQ—Æ€ }îwuk–#kéŽsf&µmpvî(Yù”žvzí)? ¦ž¶{IQRëŽî=ùŸ¿ÆÓ÷.üù€C9l·fÑXOõ¹-³OÏÙw¨éÌE¤÷&¾g¯ýAV°´~Æ%a»¶xZ7™Œf,ܽ8/©}»£s[þº ¼çm;ãßi ^Ÿ;b‹¦ï^Ñ5 b¤ñ6.üS‡[ÝûS±­Î—Ser ‰#—¢žÌ¨]2M°õ•-¿eêÚ—4Ä#m*³E-RκL[õ$ãa†ĺTcŠûˆýš€ÐÞ›V”»wE ë’˜ ƒ™ í+Ùüý²–Ãíé{^•äh)œµñGÞVŒ #°D–°"# ÊIÖòoÙ1§:oÃœÁðÒˆÇGÖÌ–ª«-ueµtO*ëKœºå§¶ Ž¨É­/Î~í‚‚ý ˆ.XÿœŒJZÚ¦§UÏI]74Xl,ãÌ>©vÚÇ/s–0º“ØÇvŠ{+ßø‘$@IÇžé¯^IjæÁù?é«yb_ð?Š>º=æH—FÊùu3.5¤qQÛ H ×/S½3{Óª€% ÛìÖP¿¿ôê–âŠø–H\vEi„’ÌšJÚÑ>eL93 Æ@ö´ÌúfÙæ¿–w¿<Ô3ùöFÇëé›~¨»þÜ1õF×Úû§¿õ·ˆÕ¢{Sïèv9¤[Ä™nH 4˜ò«öÖoeø|ÿ´Ó(‘$GØ™m ºOŸú·oRØSÌ»-¦€,;#Ž$2×5«7·$}Sk[ÅÒ¸Ql‰GNÄã•ÔMãðŸëà·[‡½$E¶ùÚâº3M*1G†!©À@hRb’1G–¡ '„‡Ü] Áï¶ÉR°Eå,êÈ⃺Ó¤i¶ÆÔˆ+ÐPZe]×yšä·b!O&‹v[¢v¥$Tó¨©þVY‹q5)âNƒÈ ¢>k°‡qàª7âNƒc ¬NfW\wzÜŠ¨iýj$u¦"KÐu§šN0–@—îÌ4˜Hr°U† kfÔåÂp-àÓ]E1•aÌo v3"®x#Î ²}š=Ã$`Ñ.[„=é,a¯°ôj®<ƒa\¨AÄh§-Žx 8r` xÄ2Ð&éœ[R"n/ç¼óØ%OõYláaI‹º<`j>kD »ÒLKrÆêK}g¬¹ø:ˆPÜë+GG‚"¼ºjÒ¾zj´…“ŠGß3 5gž6Ä·&09aæñ7oYsÃVóºsåÅâ_'‡<DÜ’¶ K­H Ä\ñÛxÂœc(Þˆ× Ã¯sÉñ8‡jtÐ5Þ©Þˆš(\¶E=¶„ã®%êÉËxÄtG®n¦ûÓ‰Ô”PrŠY)îˆw¤Ä+9"nÇà*íéA+Œ0cJ®ˆ×5Bz$"KzȒвp´FÝEƒ‹Úæˈ‘=;dì šVˆY›–ïïÙsñ%+qV<‘Tü’-îȯÆM¯=lN ¶r}Ô'21·Ž6ÛŽr=‘Bq´ÂlÆ…õÎ/ýv”Šp0ÍÅ?З¸d5òì7üæpÑ'×ç5÷5ÍûU¯Ë1d8<œÆ ¯ˆÀ¹è‹+?š&Æ^¿èµz¦"aN<ÁT"B&DëQUwƒâ÷—½¼" ¨(p¼Î ÿÐ!H(¨( ¨( ¨( ¨( ¨( ¨( ¨( ¨_9³‘°r L¤is|ßâNË€eb¿Š¦(Q;ˆ€¹Ç …J?î^CÇí%)Ã?ôÅ&ºÈËÒ­€]1µŽqãbPì¯:&Þ{ÇŠÂËWàŸc4ÕÙqlœHp"ðOÂñ˜êÇmWÿ]Q@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@@PQ@@@PQ@à+ŠÿSe*G!Æ8IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/ipopts.png0000644000000000000000000010177613051004444021242 00000000000000‰PNG  IHDRz3°•_csRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 6 ¿¿,Ó IDATxÚìw|Õúÿ?çÌlÉn²I6½7¡÷Þ"(EÅ^øª÷ŠíÚ»^˵ëµ\¯Š ˆ‚‚¨té½j€„ôžl6Ù63çüþØ $!*à•!çýÊ‹;;;sæ™9ŸyÎsÎyáœC þz¨0@ r#„Ü@ äF ¹!7@È@ ¹Bn@ r#„Ü@ äF ¹!7@È@ ¹BnA«F>÷]ã*k-yÔ)!L$šƒ¢“È_+7¥vuÍQ{aµrÙ[SÑø­ýCæl­–@p–Ö`Dz@ç8Ó_+7ÇÛ«JvdÕ^þukã:>,Dj<$¢qÕ~ÝQ>sAA¦ÿ¯ê|FÛàa‘ä³ •€)jM)©Q/‚Ø@’v½Ó£[ЙM56׊½•oüT´­’ÿµîG¡]1rÍý‡¾ ç)Iã’ä/ÖVØ®jù6¥Ì¦ ±\)UÑÙîæ>ïøÆL[ ˆÞO?(É8¤gø.+ /çA>«!p¶KBHóÛ½_q†û®Jº>Ò±`c¥ƒP׉ÜÎϾàÕo¿áƒóÓ»“!ˆ=j;ääaÁÆn1†kGO1öÉ}?—1_ ›?þY8ýUÓ2³6*ž‰ÿ:´¹oÚGå·O~$Ýóãúr£ìT~§gØçìÓý¾Á‚K>vã¾åÍ£'@nN ­|*Iß&d’î÷. ‰Þ(00òoÝ‚$—Ô¾öSñáZ€± £SîJ—¾Xœ³;ÐúÏA?çíoOýZÉýÃýgO‹šBšqÞ}m—þrüCWäÏ“Ì¥Õ·Í)Uã1ÉÖ'†[“ÌÔYçžÿkñ·YÈ'MN…Çþ{ÂÝ&bÖ` q¸_Y»¥†Ÿ¥bïÏ>ù~‘ @ 0¼6#ý ý¼"_/„àÒ5##§§› œ­ÝVôúæ:(¨ˆkòøÀ $ê°»ç¬)þ>ÛJÀ9¨áïWEŽ‰×3§2mñÜ#.€·íôîÃÚ¹kýÃfõ’n}#﹉±ì¾·OððÁÃ’ë¢[´âÔ2b™54(@U>\xjY)7›þ{CÜÈ ‰rýç3Ó×®9ñ|yØšiåÕ57ü§ØE 4ôä¡iÔíô,\W<ç 21¶‰^>1 ,»xò/ÊëÓ¢3,dӦ—¶ÖA'Gp©Ë ô2¡êªÜ ƒžJ1~®Æ~ —^üGû§2 öwž£:Þ2<üÿþ™ùÉI-"ÔL=1µý&^:^CÚX'ô°}|ß.‰Æ„, 4*H¤‡$›‡¦[ ,. @Cß‘)›§Y¡©GJÕˆ¶–«{‡=ÿèô•vPž0*¬¿²íK#Ínb ã:øÇ>z¸Ð œg’e™€ÍåyvQþýí“,í†óW+úŸê0#A>ž_g—t¯Íh?6éä•ï1 qÇ­aö÷I›fI°\Ý'ü³ܱÃm´ú|-=üd±Ëd×#tüÜÃ×®¬Ñ›ÍW´ó³b_NÜ” M·ÄúkVÂì?:Ã` hóIŒ|¼mBt㻇Lzfï2‰ 1X Hd°Þª'ÄlÜÖb«V$ ]'í¹1L;Zâ ±Z&ö ›¶øøøÅUÉoPZ@]°ûXßà­ò˜ŒÀödÿôíž ïóÎâ/éw+ ƒ[íÒ)Ä(°º%å¼I0"vx›§2 ngM§'3;=›™ò¥ нyoj¸Žs€6×Þ³?ý‰}/ïS:«Å^PÓûBàr8G¼˜ùì^µ¡Râ­›¦YÏ5îëðÂÁØY¹®¿¶ÍõA @¥—z¸£îÚÿÈÁv“qJ˜Œ?é%µ¥Îb@7:‚¦O‘ »²Nµ{îp·çkÓŒn<˜4: À¯gv}épòc‡¿È´9b̲¦NKM~Z™“öü¡˜GÓ¦·c…wþDŸ$¿ŸÝkžyhmTé9€AfWØßö·}bÿƒ[=äùÁ®Êº¡oæךæ÷â™Û•öáºËæé!€rã{3^8ÿÒIwUòÿ…po[Êb}ç?‡ÃÞ?i›`ÔÕ±þBj—¼wcÜùn7 ²êG|9¯ —Ò1»[(ôTûðDz‡‡ùÈ^“—ãà½1ïÀMMÆ$‹Ä€Ì_WUÃ9~̬z¢sxïŽ~XTæ „hMf4qÞ'ÕLípé¢2#qœ¨ø¤.a†Yº¦—ß׫ÜÞÞý²¨Xãp¹·ç¹{´×··Pðóön7­àè(ý{/=€fžu­‘rÈ ô÷µ—VoWòóDéÞ¾§íLû¾Sµ|x¬ÌH~wu—¬Û[¥1ÀaKûÇþŠê:’ 8šY5§P%Ð7s柷W—3`ÅÞrôŽî”n„ʽö 1ð†âȈ÷7ÂOTÌ)æ0gží½j<D¯à÷I8ÝŽGŒã‡¥e¼w´NÖ%Ô2QG—´Üpo¯+Sµ“¹u/ÌÉþò„ YºeLäÔ07f³ü§²D#«õ–Vátð—‰·–84ðj—Òï;"V?@e¥ÉWŒ,;`†¿E|rs¤Î¬qpüù†—õñ€¶¹’_£€àø ¢8­ÌÁM¡2tÚ¿¿:2 *}B¸éŽáf%¿õAæƒ{åX@­ƒ{ÃÀµ5žZšO‹ë<¿Z*q¨x­[ãñÿ]ûpnñ“ AuucûÁ?HGÀhŠÛ©”@QÝN„‚‹*î}ÿ¾¤¾™F d°'>ÊzS&$¾—a¯,Hi£Çf@õqFp7*Ý,o–À9"ýe¬\ùý–_‘]£ƒèH}B ´Äs¦ñó?UU¸µ±ý# €âÊUèìB½òHÛ…NÈ€›~(`wN|9ÜmѵI ýfzø÷¤x÷¡ã@,¡PƒÊ;uíbÂÖýeÜw‚ßÓ×h³¯%h5É@¥ú{—GH…ÝÃ8‚#uм·öõÚ§ÐÍ}¿ #h±½L Sß_½ q"ß¹-DZ=DZå„Ó þÆÕ"$ŽŒÕû믿>1¨)¯ÊªaÞ¾Ù)ÃÂ:Iþ†›{Z,Þë„ì} C'ë’­º@9S Ùz¨¦@bijÝV“ÔkHÔ52ÀïnóüO/Ž$Å™º'û÷OµÜsCúⱄ§–BÇß]]  ÍÈøžQ:‹Õôå‹N¼š><àúžè˜÷fZ{Ë+wmØY¶ÉâOÜnð¸f`D´¿ß&lõ=‰_ÞÇÏ©3ªoh`ÙlÒß40 +: ûzâ)Ñ¥†é‚ýhC¹9xÒ^ &ôµ^~V“ÔµOÄ~\/¯w‹j h¹Þ͹ÔYØ÷æܾÖðÙ€eÏvd€L jì½_Ê©å¾7í¢rÃþ×»¨ %Ls>±¥¨±ïUÐÏ _ÿR矖œ~ªÁ1Ëmmß,Ê~0ê¹{3žb ”€³¯ß¡ýo_ÚäÞÛSÿîóÛÀÞùèà?÷ºAP²áäc2fu³l}¹³÷ŠÖ¯)Y] p÷‡Ü÷L ÚúJÆ™bÍ‚c{ºá±}½2:wÌí  ì•73WW“çPŽåÒŽW;{íCà~â×*PÀ^»ÙQzé§ç;o_}xÐÞ?°Õ¦¿šŸÿXìÃw·ÀkàÑw²6¨TLœ´¹‘hÖ‚»k¤¢’:(¯ž9OÑ ý¡ÓDþûÕÑ_7YÅü*m®e™öšw—œM§Â¿•®JÔ3ºrWežB@à¾úŸG'¦ÁøŽCnJÿ>¯Úfw¨()=œõXÕ¨4“Õ@Ü.eËaÛÑjïx_>gMþî=dC¥ïà ×Ü',RÏ£Áø¿–æÎó;ó»Ý³õ¸ý¤ù†ËüÕ\–Ø#\'Ÿ*¨]žå„L²léñäƒýcfªG;˜S»5ß™0‡«Ë}û‡v H ”4EÛU³»T…L ²Šî™«Ë/±ûΤª}—h`Ç9Ý•V°§ d.Ÿ”d€ª®Ù]•íò¶[•ë_82¹½a|ßQ—æ)¿wž½Îér€šE‘ÛF§›ÃŒÄãV·±¬d `¥e3çÙë\.·×uØï—ËœžZ1Yð¿}WósžmTP­LûäĦum‰TíŽé]>¦göÑû7Öþÿ‰'¸´ÌW:vxþÐ¥xÇTm¤΋ǾúáøM?ÛD¼Ep±ã/‹ïI×)èR‰ÝÁ%»ù]ñ œRýE3@«¯çœƒßzrм–i¼?÷Z :@$@«÷/døì ÂIó‹Ðcëäw|ícR¾¥ÛÒGRw}³§ß´¦çò– Þlê€âõŠø™à8i®*gzÀ °úò{Ë \$÷\d¹‘ˆe×Ä.ÅwìMÙÝyËŠCWmàYWfT=”³ºã®mû'þTm1^vM*(àõ5M ~*ôù¶E'AÀ•“¼é¹¨‚£„•u~òXÇœ€}ÁüŒMŸú;ÜÎÈ+y¬Î@BìY>fÝá“)ûóv[¿49=îÐG†<]ã $Gp¾üÙP13úóêù1¥±{¯ü¸ÚB˜!€W~no¿çÊ÷í&ýåËç€3Ð%À°£]¾›dš°oÜÜ=#Ÿ4x¨ëæo½Kܘs?ìýËGe=_Û3ößæý=Þ£g?Þqá¤yè¾ñóv}ÛYõuÏ¥OQÆ¡3p8Û­û%oø—º´…kG×EÿGfî¼jvV»Œô¿h’tneS,v¦˜Là€–Ùå»)ÿIû&|½gÌkjÁû=—ý åT>­ž £2À=‰wïë;ˆjmöOYz<Ì/tÇ#ÝÖ—×ÿ½]WÍ>‘líôÝÕ6­\üØ %Žêüþ·ÙÁ! ÄiÏï}C.Ï#QíæªãõËéj'>‰rê§ ‡ÿ®‚ŒÃ׺*@’÷_yËï˜ûN©Ó!l÷GžösòS:ACíÀ·Ì+ß´8µºSŸ[yâ–~×»)!LJÝ=÷°:O ¡`¬²ßåQ±`Ütp±YŸº¿Ó•™"89»è§n5%Í—9MUÇ5ßëÌœûULûT—±àÜßûr· ý®ÖI>zÅmƒ¿þ"ÔõPùo]§Îä2ÕÎÀE«ŽÉú¹ºëŠÒøhp8¬•e¯Þõ]É°É¢þ.²ÜpbêW'¾Å*91tžùx¹©Î¶£Ûâë|µ[’<Ö+öMZd³XÀ=¡Eµ òS6¼F€pT(È µ¡.$?¸¶^‰`ç@Ôñ¯<²¢ÒãgU õy ½ìrUHµ£Ä cµŸ¿wÞ€›bdõ=:žlv" ‘‡»,9S65pHæ„ï«‚­€\^㶤h§»™,j¥×CªÝåøJ €rÜàÔ©åsS6{Ý îç$zì'|2þàâÊ ˆä×à±ã ~—ï$Nî ½bÛ„ç¼qÞÄ¥ã"5“-ÐÆA¸Ä9“ÍŠ!È['À¼îɵz€+”î] ’œ‰xHŒqjh(eÑdMˆ7LN5¯o»ðßlI15 ç–)ïxw‹]15ÎFmAVpÊ8£rÃs1ªÊšvn÷_¡LRü‚U½¯ª²ÍdfŠKl þ?ÈÍ鱿ññ2õt¨8gÄá_ÜÓáÈu™éñàº]¤;6·ë p¯ÁÀ ˆZ³b.¯@t8aººbnŒ¬3™åÒ Ê¸FBàÉ5)æb³çè»~’Vrz7cyo~Qo®É_¨8ÐãQ_ÜÞáÐû;¦ƒÑZ³AWQEæ-›;Û¨XÊ͸Î)ç^”êìÍ4i¬G®sÇÜp*Öè»4¦‚È"t#8ïÈ‹0Á…ꇮßÑþ“‚¶ÝiµyZÖý*š¿<±¨züŽ½Ø秗%0SEÛþ¦}O™Ý€´ø£~s§yHu»a¼êh\q 2¬»¾0´)´ššhHU|[ÙVQU¤$ÛÃ(ùã²É] nÙqwx™  G‘’íq¥.è d„oýTܽ0HB@´æ©ôW($ IGöhå¾V1…VC%@WžjÝý¡€Ž€ÚÛ-›Ööàañ.¶wC˜‡ªjÃ’vÙ¦‰!š‡jõk{Æmi3lû—µÝüï­cîãÖ›2ûŸJ]32˜¬i˜×ëEsp”w|¶¼ôÑn_pû™ RÔë‰r?:nÏ°#ëÆ…íHS´R³œì÷†G¢àš¤º‰×Iä„ÇÌ8ÜvSê’þ±–T®Ù :ö‰Øºge)"ÌCO§""Œ×%ÞV¹gIêæ×ÊÇ?ì×ít2}åÿtM)Ò‘°cžÑ8‡eâñ6_§/º*,¡+œyÕ)å­G)5h¨Ó¸°×§Ã«z|v`è3Æåÿðå(‡%ØPí ›| C;Ñ.8ïtîéµ ê0m65éa á„Kõ²Å<„Ó3[( 2¯C‡ïÎr˜J@8=ÝŽàóN8ÕùZ‘\õ%;#§’7tâméæbÊ©\_W9¸J8ˆÌ)88#LãTB|ÎS€PNÈ™o›Þpªk¾làgËwðú‚‰øpÂo ‡Ó†å¯·‡˜ßÐ:D‹Ga\Âÿ—Ø Õ5’+ª¿l#7„@j|±Þš}æ’‰¯r6ù•ï?Rã(oýÀdrÖ1îéý9¡\:3ˆ©ùh1ýý²„4_¶ÆkðÒð¤g•_x6»Bn@ ¸ôäFD‚VΟó虲¹Á8<­ û çñC¥KéààžÂí=x 3GÜ®ç5wL îÄÏë¾zËk®ä+þÑgäP½‘ä¾9`ÕQH”~K÷¶ÓõøûÓþ ‘±ý_}÷×>sóccˆÊÙ?­›ýnq©Rsì»N¸Æ³iÖ7sëttîu=’Ü8´­‘‰$ ‚!7„gîÂïg½œzë—ýSCY;կÝXÅïÌûæ‡Y¯¥Ü>{`jñœZ?kÆRÛ‡“¯ï¯*-Û^„È:?4òn8•õf뉕ï¹ëék®6×XúóÇ·E¬kÏ70#ÏÑáªgß4Hjö’jíZHÓcB)þö‡Y¯&×›kì?Ú>˜rÀè[è»ð™]'•±3_6ù[Ï%¡•¤ó“õ2¥l×’7ŸM™þù€6¡`ŽÌ/o^ð‰ÿô{Gk~žS:á·Œ¡5‚#7Tìo_á½Þ8¼ƒâ¢"ß´ê‡ùï9†½žûÍ[J‡G ÉPRä Û'.x÷í²)ýƒ[¸Ú8rW|>cE­QHô½7°ä³pRœ““pó×Öp çh7ùÅÃûolzPNÍSÉxxàisÝ1é›wÞ): Äb0êA‰)0ì|‡ªŽr•ùÆ¥E˜†Þ÷¯è¦J„P£Ùèý‚ô"v#hIrÃËr³™Ä—®ù÷zÆ9@{¹äɯ¶9Ne³°«’áá rx_ƒôSY‚[¶Þp¿Ø¡W?ð‚Dx„o½åš_`‡w‰™ÆÜn§18Ñ€Tg•º³ÌX•“ÃCÇ74W?ƒ´´¼ !Â\~q}Ât[f ßÝ=cØ é½{ÄŠð‚–+7€Æ1Eµ O ñ¹å¤Slg({4F$É›ô D&PØe0½“J%ú[ÝP[;„3•ñúýIýßY*Ƽ;ùZKD&PþdÒgNƒ†¼°¼ý¡Í%Ù{sW<±õ¿¬ý-ÿ00A<ô‚)7Œ„†‡iÙæÎí÷ô( à*‡$´Èp~(¿ ˆÆA‰jËò°˜ Kk3/£ú0½¾Ö^ÉD9óÔhî¦mN,aü`Ási¶c-úÏšKs;ÝRHÛÁ!éƒ;N¼/w髾zºS¿Ùg„O ¸¸ü©QÅL•S&Lª[ùtV tzbðDZ¹Ó¿ù`¡Fä6“&¸Ö¿‘UIO zûÞ¯¾ºÍˆ1_Τ3¢Éýͨ “ü’L¡!+gËzèýQ´ú%‡»iMgšœzõD÷ú7•zÍU»ç«/¤nwÆúÿñíkTö’Wîû`ѳÔpÈ: ¦z¸.D¢•à©Ö$HÎ=ýˆ@ðÿÙ»áîúh÷Oo~±ïöÀhµºP3xØÝ©››3ë=²vÛ ýwǸ+JÍi&Ü2Žy8ÕãP•¹8Œæq×d-ùÏm?6ÙÞnúÇý{Ç©n‡¦žn.2Åí`*ƒ8xÒÍ+çýç?÷Î÷“YpÆ?ÓAÅãibFSÆ£}FÕl±ÿ¯¹RÇM¸u¼×\\q)•7£õgÅîÙwt;#1~±“g-aŠSñ¨à°fÜòÄ’ûû#™³LókÛç¡×Íäè+ý.¸m`ìä¹£GÄs&jàb½­ÏýýV§`Õ ”Ô5VÎ !§‡îqæ‹?4ÚÎÁ9Î,B@Î.ÝAôŠ†ë:â»C¯Ô»–AsEæ ¾zœú œsBØÁû­w·æÍxÆ\ÄwRxÝÒhÚÌ=¯U À@!õí&ïJ™Ü{ñO óœ/£Rtѽïí­‹ T‹4¿ýôcÍÁÑò‘’¦—Ùô[¯›@H“Míà[„Šü‘ 9sÒúó7Ú¿ùÂïþ§EÄ·Hh ÅÄn@È@ r#Z+绑)äÖ!P­åJ‚ó­ñ;¹qªh‰¸V0цqøéÑCŒ¿š“éB{˜Îãwn†É+±§¨XTÁþ›Ðyžx´‚fô懱¸°!»ç'S&з ƒRÒ:®T 8O( ‘ ÿ­@ \$©!7à2B$\:g87o1»ÔÊ„jƒÎ@]Éê@Ò¦<<áÜJà*²”7¸ ²bŽ« O­Ÿm& -r# ;ð︢,WûïèÝÌçš½œ*ßY™€s™ZÍ917Š} IDATŸü ë†ù㺠M«‘çRÔ‰³kÌF¡7!7¿]yd ¨€7%&ƒoy#ï;\®¯>* ÕÏ×ÁW3¥†_µˆj¦yLéÆÌû#’~* 1ŸUfÈõ-T PùÙs1õ9ot[õmiŸWO´¢@²‹ß4³ëwî2Ǧ ø¬ÇŧSây´b¹‘HàÎ+»çÞº£‹-mÛ<¿:»;êêýÃvë(Àýr¿Mßò¡¿ÓɹÔ :}ÇrgÊG; ãP Í”–=bvЂ+“¶-Û;`4Ê¿þÃg»Ç<½óÝ {5tILJ¾Q.šZ‚–Ο sh~!Ší½h[‡½ÜtÓR›ýë.»öB"råWÝ–¿^ÝwΖk—m™òŽtøéî[ÖC@T¿(cÞÛµžÛ6må¶kÞ ÜsoÛCÙ-¤&¢‘¼+Þs–}ÞáPQSwýºÛ÷÷#íõ-×­Ø:í뺊¯º­zß—®¦Þ\ÔUdt•WÇNjì­pkUpš_õJÙ¬JjÆÎýǯ\°uÚ/ÓÂÚ®œir+ "óž 5Ë 8¡,íT—>šÎÄuá¥mRŒ{ #lë‡$áñìäXU ™Úg ™l8ò®¿o„æ¶ô®²F2Ù¨øw© Kñ?õmË©JRbv·ÉÖ3¹Ô†¦Úñ±1øŠƒ2T}€jŒ=1âv)÷ÇPW#sQµLR™;8¢‘¼BkÌ:wõÚ˹½§»uFMç_ÝåF·#'¼ªJø6‚Ö-7À‰©ƒ›Ö×ÉÀ™¬ÖZÁíÑ PáÍ^Çz©4×ß› «Z@w_†-B‹^-F‹Jškëô`±>?cÏzœÎRÌ•àJ—+0Z}§U@/‡\lcµJÏ ¨ªâ¬Ë•4Æ©äÛLµ~&ŸMå¸Z½3°Ö!ÔF ä欗?ÂÁ)i|"Õ÷êçD×ðÕ´´|¹šåÄè—ä#OÄå»ê…ƒÓf.™ÑÆ2Ê QšÁàW| Qˈspl¯p#øé,| Óœ ¡¹ùmüm0—ƒúRÓºƒ‹«õóÖYªÍ$¾jÆýœvEoaUŠs-pXn|JÜö‰NDg³è örobap4j¡¶©ÑÏô‘eÑ¡9sôZ}aPBí[‚ʲíI7q¯¸ÇÏãôi·ZdrkÍ~âa¹i.¤ÃPÒkª|ôÕˆ*@" Éæhmî©1x¿×+ p1Èê±àŠ£ÎÈ«xËzHÃ^©­þ¹ma#'å=¦ò¢eÉu ¨šðë'$êŠb4ÈL@ 9W¼\[»¦û··…TÙ #ÐÁ”ýYï%ÓØÉH¬ßÓ•¼eÑPXÌ5úE•ADŠ-œ?]sÈw£ŠžèŽöp%ýØ?Qg•\µu 7ïêw¼ë—p—3òöØU×û;k ¶B{›ûŽvÍh#j©R'Q÷™‰?1à¦k¾T4,S÷´¥­¿¢/ †Zë ´àM‡q¹ýþ«ç'îþ4mÉ`“[c\ów)ÎøGN—‰Ðê@O$º»Î› kƒ[—ßãùZ£A<¬‚–Îy,üRP‡i«°©¤QãÔ;ÌÏ»  ‡D@à“B ÕTc€w¥®¶ûiˆ1ø_{ö>3îR[FAæuèðÝYÛ}ãO—¶~\k0ˆQª—Íß¹®Óvó~ÉÖ` _õwƒºoÒ¢ê`³Ïzšouñ¼ .…ÑâQwAÉçþœwã]3ét_ !¾˜ï銡5i€4€5·”Š¤5)-êGQŸË%Ÿm7üÎμÁDtK Dìæ‚N©¹)K7þžªIª[È‹@Änþ<Ò¡ñ›ÄÔÐß#pò¯·\Í©0‘@ÈÍŸ„NDVÎß7‘Ä%I˜AЪå†~ˆ3_þF©S¡£­âJ‚ó….ômx=Su T žVuáV?T¹Ä£%4ƒA‚å‚fœ_cjÕIÕ^þÖT4ÜÜßdŠçJ h¦•36í¢ÈL¡—Z…AVq¥ÁW iˆ Û ‚‹ƒ@p‘ƒ;Î Î9‘‰Nn~š¤êNÕ ö?÷Å9¨ *p šÆ9³­Qn8¸b;ºyGÊ°ºËºÇŠÈ¤bñ„…‹²©DPÎ!` m§½{£m^ƒ4g¨ÆóÆ ‘tÎmoÝ’g¹mÊ»Ÿ™d€¢lã[?Í}IžÔ«{[Ž’½ßüg@ÿ«üÎ9šZ™sü‘é½c šÝKda\jrCœûç®úe ƒí××îŠòn×½»hó®ŸUÛ:KRÚ˜»“¢ýírPB¼3½8ñpÎMõ%Òâe+—}³®ï­Ïk‡—Ï™Ýýº'*Ö¾}2·Ò?´ß”ÉʱeÛ~ùÁ¶ãïKŽÓ8'Aõþ]?Î++·Ã3:½Ó 5” Û¦Sù–Þï=`¢Ð4aýfŽ’Ûó˜p¥üÀš¹¯Ûxíæwþ:øþÝR8å'W~p<ó°ÆõÖŒñ=F#WÁÚ/_Mó,?øÑÑ£ùúÈ^}¯½•oÝöÃì:Å?iø]é퓸DJÖ<±¯jÚ Þ•[}ãRÍ1ýoêܳ3gbÁÿž?*ÖE÷ŒO `ª%¡ßÕQ’š3Þã÷×Ðظνê‰a»Ž×µŠ§Ö]Tpt¯¢jµEG¶oýà‘²€ªÚøÒ·oðë/ۇܜ¿â•ûË9!„¸²žýЭEŽàø®ýåò-?<=­èl;™Ó‚-¶Ì×Ô8¨L$‰0MŠè1*2"˜˜¢SÒ£T>¦÷øø¨À¹{Ö€uË·XRúD·I(\ùÔ¼7¿Ö(w—ß½ç«grX§ÃƸöþûÛw?X÷íwÑýoJŠqlxwf¡‹Åv¸h÷gkæ-pcZûðÌÿÞ¾nG$ ­\b)9<-±]üî %É®0)<ù&)¹ï°î—)0dZÊ€Ý4¨uY“€Î‡þmà€n ¨ËÞ¼}ÛO}Ÿù)ØŸöI9[:É¥“C‹^”º¼0ö®±D†\gúhôºçO}ø:Êδe4?èžÇ½ÿò÷»ßуczLl?äê°3ãœú…$wI_· +¡Ï(+ yªƒ<4&ihxd0€„耾ü¬Âv]„ž€Ps»ÑCÇç­Ù·rÁܶÏlŒ¥´[‡‚=2³êb»™A)/ËêöÄ/‘F€ö7 gõW³zôzÏ$*‡à’jL×'ÆäÞ­?_ùƪ/_Ohß3:½wdǪËYhM’CCC£9çD§7S)Áh"àà’E¯ãj›òòÂc5c¤üÝ¿jŒƒP¦KTK–;•ëÌÒ™ÆçÜ’qío?µoKyþÑ’#‹~Xòr@ú•n{.&<€±:纠”ž}¬ùîÄêbUÑ4Û)€©Š=ÀµÀð4oa$cx¼ÅJÁÁ‰¿ÑÀ«k] f€± á¡ÀÎ`ŽìEÙìj;LbʘàR’›Æ®‡.ùÚë^ËØ<û•}‹VìpØLi7^yϽ¦Öç–SJH¬LHãE¥X‡œ›ßß²íŒBù„2 §—‘ñ¸>2®ç¤øÞ„JàöÃ?=sç²Ï¿¹ýé;…•Yß=|ƒ#¢Wב-þJί¹Ù9 ÔOj¹K¦õ…á§ÿàvz5•ô€KÓDÕ\ÂrC!’µã û¾fnG]eΆïþõË°+o½VÄé²bÒ9,7|7¦«Qc^E84õLw!Ü]~¬¨ØžØ¡‡×…d*‡»!ÓÚÍù|w-‡©Þ PqøW»ä?ò¾÷¢Á›ó|çzØsÀ»:¹â®áÜ¢9BÅ›øχ+ ¹¹ Jqrù¿¶.Û Éh Œif ó8ÊÄòMÔFCh\—¤ÂÅÕ©@$d¯þxß®¼ÆMNâÜ÷ïeï1Ó¨A¤wüÏ9¿|7«N ¤®qÀjñÕ5vꈘh“»äHáÉ,·G£† ÐÔ>!ÁF¦µ¼P±¢áºŽøîÐo}ïÊÛ²”¶曄Ï벎íËŽï1Ì„Šc»v„·è &wGi‰šØ£¯L¨ùÛ¾—R'EYeWqÞ¡=u·d´†§õ 06žÀ9•Im^fya®Û£‚èü¬ñ© ŒqBHõ‰õe%Õ†˜Þ ÉJÙáÜcY*“ƒSGF™+2W–”º"º­<øk@Âà° gùÁü¬²„>Cô (Ùö­'~||Œ1ïûI+öM¹é‘!y»·+LgIè!¦J~‡Q)Hºørs¹ú 7—ò˜´bßÕ·½p#<¢ þZ¹3ÂA‹ˆÝZ:æÄQéRšÕ„Üþb‚;ÞÕ¯cýâ|Á¥#7*ƒ§ óhàhW*\O|œG¨¸VcPY«°f 5nñ\ Í9)ô¯O^ãÁíë±µäò·fŠ}× ßbñ\ M¡s‡atÜ_,7°{PݺK0Þ:®T 8_¹Á…7qDG¸@ ¸xR%Bn›Öˆ7?„×`Þî<Úø ù.BïΤÁž§7þU­/ò—b˜ß9C¸uãíò” S¾Ô$*W~Ýwá+T61ÔS£v-ì|ov»¾h’WœÚ£·¼{b£A5hTÕ+¼&zÄÉA/TÿUé9 ˜«ë¼örÌüƒzÛ¶Ä캜.ÄðZºÜÔg„"g^«àM·sÞÌö–3ó˜KFMWo1¢ãʼqC…Ñ·ÁºížŽõD­)lhUfÝtoZ¶ëÀø !:p@)H_|mÇE÷oþ¶âÍ:Aêmr:k3Ûlñ¼ÑdžV¤Æ=7œ8ü VGžÐçtæ[s7ð¹~ëçÁ¥(7 ÌzèƒØ“[e¸Be÷žá” 8EðáÇß k[Ê-'º †ÂÁ Áß‹ÏÚ,Ñ°â.÷Æ¥ Å®1ªz‡ÿs€Tö~¿0§Kü®í#ú™‚ĕЊªšˆÑ<ÞVULÖȹ….UóÖ|‰˜N}“tàG£‡ÔÆN8Ök ×88 ÓÉ9)–陹¢í-9é}A`<öp§ìnÛÇ\  Ä|øÁöyƒvŒš'­»Iö\MíÇqUá;GÝ—²ê6öt¡ëÍŒ¬T“º/Ø^Üãž°ÿÉòe•¿P¢?ùT—ƒa;¯º‰ñÓ‚»‘HЮ[32÷Ú’&´› Ö-ï5ÿ½ªAR¢ÖNÎØ¿Å–tmAÚ`ÿCOöYú!åÔµæêö™;mIW•FEƯžÖîà\ ¸¼Yâ©jÐ¥q†"×X‚üË×…eQÈš9¾&$™¬;þÖã×Ù®˜‰yíÇIE³~û”-xûß{¬›ïˆ]œÐÞºû¾®[×Buå™k*N{"Ô•ë_Såõ%õ΂cŸ‡9Š{pÎŒ5'üꜮä;ª­L—vªÇ½¥‘É’íTxî_L‡ÔÆo_å‰éÄØŸ”.\<ï†8C³öWuÿîTZ 8JR¯,*ÉS)• 槞ªÎœðye ?@Jb¬ƒ¾\3½JÝœ’[~lÌ¥a©ó#mNÎÕ¥¿¨ÐËApàÚVä²ìÙ¸öJŃßõÿiJúÊ[ÁáŒX”>­8¡ !¤îpêáyf'Ť4¡sïoïˆ>q$;ÁœrtKQï%'ÚF¤,*ªËúùfeÈïÈ':Îj ú§Fîö¶’Ôöÿ Ú¸Š¤Œàhk÷£ëvê j{¤[4¶;¸XÁNÐ2S~%†tÛô÷ö%#ªbú—%ö±Ç´ƒ† ò&Á¿h­¾”`´ÆÉ!6›SË18-Þ`DUÆã;:ZK]!–Ë,jë‹VIQm–¼U$áîÉAõ±•ú ‚Ž[‘_¾Ï¿òXPѶ¸õ7¦²È²vî3F_—%i\®Û™µ 'n7¤€šÔã§sÂã5”'|êöiSQŸý7PTÿmDkƒ½ÛSÎÌ»â*É D`áfèzU‡YĽ‚"7·w|k‡eARæ⸂ei«ªËz¾z¸ó0Ió€iaGçóúçX M(e.# BÅZòîQ¦¢ຈ¼!ß%·…ÒÐY8Ž%.kgWH—ò¶Së²í±vû_KTÀ>èļâS˜¨ê ` ƒ&5°öG _ι>ðBMúžq!QÛç¾ÊzòÇš®K!4‚–Ó˜" pÄO=?•¨urÅ¢ÞK_Oî]g€äwhì\§¾A[ƒÁ/;ˆÀ.+õ§=3¥E>õTÕô¾¬áÔX¥IÄ€Ù­'~Qc§Öø`.RÑvöo28JUs(¸óÔð9¥–†âj¶i´ÖàŒõI½­ø™=©Ëy–¢üÎÍâ)Hµw¾În‰*KÜ3&BDmµÊü¹·{vÚ²‡¬6'dpƒY ïîæ.ªÖÆvå.[dÁ Èjw¦¯}Ýèö8Ã2˜ª„ç€ГÈÍ· ùò=k©oX~v?;‰ÛgµÝðAd@&yð‰•„q‡%Bµ¤{dCر5 (©k_®¬ÑüRÜ~¡‡—@è‰ÿñ‡~4Ú¢B çŽ#:ï}Óòãò?»p7ó®mǹ3íj‡;/iÛJì@'AbA òntI…í¿ì à0hÅ{xXÿ¢@ tÃ÷ô_ÞuíuaúÚýéB* jµ¹*Gïv„é\)n??0ïl"ÕåúWåI š1ÂÖ†Ág(©.' ªrÙmI®³„z%×eûWP.;C:»HNpµ©2:æ²mM© ÎüK·C†=È­& $S§QGxO—A /~¯Ï²ƒÛoýÈÅDXp! ¢Å£0.áâËÍåJórs¼\^™ºp¤±ýÜé"ºà"˘3ÕjÐÊ·’ÿ«Aë±#µ-˜è´¬Ø %¹6²Ç[šñ`YÚxEÜvÁ_év¾M˜AÐbä¦NZG®bC,b+œ #Ð.tüÄy„Š+œÐW+XÿŒÑ&9Ä£%œ%€AF¸ß_ìÝe¬9‰âÚVàÜ0\×ˉGK 8KnF&µÜ`¼U CõŽn‚fkÇ#r ‚‹„@ äF \^ˆq7çÓheœ„Bç¬I§¡œ“sÀ8çœ5ÛÚ%„’æ'‹Õ÷ýŸÌ&ãœqöÛçúÍë$´QVWî- ç৳`x-AþºYoœkœJé™3ˆÜƒBnZ ùóg,ÏTn|ásƒLÜ…ß|óü«Ìà/Q\uTÉÖôä¡÷ 3Bk”ì]ÝúÚ”ƒ§ò$ÒØ‘$úÏ® ×5WÉóTl[°¨Û-wþ|Òò²ÅÿyúQÏü”xNûxvßóéç¦ÿûøM§‘:ʤxëÇeÌÔôV\öZ5$y@¯»^‹³þ×<›% GÌ_;ñþî#Nî9¾h×áÀÞãG‡¼õÊ çœB¨¯~1­ÁÂ/„úòpsæÝó¬íçð¾w9PæÛÿÒzY/ëèé„ŒxkC²¿·’âÔ’‡—-xÖÜaP·8}C¿‡êtAS¯ýÇ£®†Cuƒ”‚iÜ÷Ú¦„R0æÈ:¹}g—;ï$˜×Ô—Bž3x,"I`šÍçuPŸ/"ËzC½£ÒÀÈõ‡!¾›(Õ/ Cõ²^×DBÑ¿Ë‚Äñ³vÆXÁ^wjùË7üúÊ£S_zÕ@9ç„ІwÜ{ÔÆÛ™Ï="”PMã>ßèôGJ(ã LáQS~}d<‰”ìýµ0¿•@ÎÀ˜÷ñࡘ&üžË_n8!ö›ç¼—W"¥tžütJr(眞»æ­=ë~u+Ü?°×ôGÃü çœH(XûÞ®5Ë]DÏ›MD=ÞÊFˆó䶹¯ÊÉÕ…vë}Û?£ƒÈ¥¿¤ê‚"û´"zìëí¶u>¼t{׿ @#¯„p¦zœœ6© [_\µ0÷Š—? ¢œPRºùŸk¿ÏéuŸµ‹hÔóÃÌQñ3~˜êǸ'kñ¬Ì[æ7df¿+À RúËÜ÷¾óÈ»yß?uèp®ÞšÑóö×c­„`Û?yädv‰ò¨ÁcS¾¨'÷ü׎g †¨¶ãŸêÔ=‘©„¸ Öo˜óvE5‹ú@¯ˆæ¤V³çª1]F†›àvrDJø÷ù.bÒy%CBáúv®þÅé–Ã{Ü0xêdªpÎ Õ¡`ÍÛ;W­t’à”+îë9 'dRüãÍkŽM¼ááIÌ¢CÁ÷7¬Ï>ý¡1Ukþöó¾QãFV-ûü›®w. ι{ÙΡ7Sî‹6eýðñ•µŠ$y:uõŠ½)£ì;ùvýtîsÏ95ÂA¨zìǧ®+Õwè:qfrTÝÏ Ïηµœ±/Äo‘ôS\gO´&DÖˆlÀ™? ñ® 5dnùa™L µm\7gIÊíÿŠé4¾÷ÐvšÝëÎ×2¢õ„ÖìxcìŽCŽöí5~JõêG¾}ÿ3NdÍYU°îí'Yú-#îžgÉ[=ëV‡‡K¼dí³c²íÑ=¦=Ö®­qÓÜ$‰úJ¡f/}jRŽ;¹û”Ǻèq䓉k×î“$B›–¾4SŸÐïú‡‚k׬XuJ–›>\ò2ìýáØÁÃŒP }pŒ%(ˆ€Sê9úÙµ+Ù‘|Å}'ßI1çÙ§*¡Ô}ø“kW-ß—<òžîÇ.¾ûÇï6ÌUå¨už6”æªtÖºA@©Ó•÷˶tûaa²æ®vÖ:¸†+žŠ2Cû¸ùÕô. %Ë^whÞprwnÒx€5Ä"(¾Ì½ªGî‡)_ÛTæº ´ÈGùÏÇß"oÇ¡Áïwì×[cHè:(a`žÅ(»²Þ¾¿¨ÿƒŸ¶IØÆúåådÏÈH.ýö±’ ‰wÜñwx8íÝ¿îÔ…§Ž'Çvg-ä"¼|õÉ,5ff/ª5É$Cê²—ÍdÓbªw×U›@‰uÄCO~õЛY#†—ö†®ãŒni ñáîÈvÍ*·où`_eòËÿ ò“$'¸>}n~IÝq„BÓ¢¯~¼[‡D•Á:zôÞ׿­u¸IÑšSvó°»‹òãd€…Ô,]¸ ‘P²à¾BÓÕw̼Ÿ¸:0&$û«O>í9âýšïߨ¿êšn!*']ûÑW®(j&; œ1sNåëÓ·}zÇF·˜:¤í im:uÒëu„À“»nÛ¾ü¾3—¦%HL ›ýÄ?²ç¥‡–ìÞŸÝuƲí‚@ˆÕ*møeikÀošQ’Yé±´gVÇ ¥õ¯5}t×C'.ªmÇ0iäž-•Úãc@‘wx]@/ütb\æå.7¯8yÐaîXxðç¹ã€äª°J5ʪ‘:aâÿ>²øHßØNÃRû\‘ÖFñ ¬8›”üÉ•ÅPÉa"Zaqq§vÖ™ÕÁm$ ˆ¦ô{òhÐØ%¾i¬¶ìÀg÷eQ¦ÔUÜ©ïuÿ NÖ4Ù;7Ftí?ñú›ôqÄj 7dòÆ5¯LgRò¤™w4½\ŽÂãEzƒ’³á™r’Tmf§J !5„2Î dòÓT{E¡~f«É»ö¯51Ñ¢pßg3WñÝ, %ÀàÚTP[¶30!FbÐ@À¤„Þ’L÷1 IDAT‰ë—°³ƒt\ ø%]ŠOÖ”œ(<°öàì›·‘ȸ Ÿ:ÆVšM8*Žü’yR@©Ó­¨¤4IRStAqÁÞ#X;Þ<©38ý·=fÐ+Âx~3_ÛQ)Æ×3LŽï£Õ®?u"tØCéBkZAì†{<ªÄÊ2ó\Æú®QÕ>*ìùäkï}k~È]ûþî/‹ñ舩Ó4ÕHY[lÔ·»¥]/³ ¹H² NιÚ‚~œB,z Dçßfô3i]5W3Kê™Ö½iìÆ›M˜#,­»¶dÏÉF@mZÍUƒê)>²¥þ×ÄÚ©·‘R€€Â}ûûfW7!JëWc××w~qÍ­ö¼¼ƒŽúºI#;v‘5ÅíᲬ«?$“ñ¬ÚëëàŒšÃÛøG¤ÆvÝ÷ÎYÇæ<°ný¿Š‡“U Wdm®ñÝY´ëàobª ÐK¸wr¦~èš¿Å\ï/ýö·4ØmÚ¹³ÖŽëS·òÞub¬š*’…]îrÃi°5@QzÞ?vLE=Çü“GôOÎ4••¯žÿìKÇz‰7¼û­ïEÖõgP¹Lòl6P äô€‹KÙvL‘Ó&>˜äß`‹ëüÜ1N•[þûbÄøÿjÿ¶vy·ÁÃÛ4ù½%À¦ð!w¿oÔ5h¸q°Êæi0úsnSx** %8ñ ýíw|TÅÚÇŸ™S¶ov7½÷^) €HS©‚"âµ×{í×ò^{»v¯½{E¯¨H¯¤†BM!Ò{Ùd³ýœ3óþ± „fÁá|?|Ð]vÏ™™3óÛçy¦<h ¹ü²æÒ‰Kzt¸Ænˆ °U5"œpŠ—CÜíU[—ë‡Üà«ñ¸ƒTPtþ˜ûlvk€Ú f\ÿv×IOÖ^]…qÝ HÕ4§„ `P Ä“Ê!z¿FäA•|Ÿšphß½m[šfŽ–¤>9“À¡bIRƌֹúÍf°<ðhÜø܆ï·bÔ¸é•[+*;x%âUœÆ?J…DQ” Ñé¼ÛU±§ˆWËt¼óHK‡6fÜGÑŠÊ6à”ÀŠ5KïÎüaýö /{øY–í!ÌòJÄ)¡ÿŒ#éèg7×k®špEVþÔéUKjwR„B’òÀr((g8mª*;Òìi4±nùÚ÷ÿm¤3/J ¡Q’[l¨lP¨€SCÅÎ žõz”²±—ç[ mVœ ,Åo¯ýßB‰á"³B{ílv§ÆÝPXØÆ0§]Ým.^üÎÖùØ%OùÏºÊ Öb^e2èui¼(VìÚÁyž¬å@Á;5·YÕ~ ÌUpjà´¨fù]ßyEÞ'u;`XÛþƒ{:~V-( Jœ¬˜÷‰?öÍã­SÄ hJe­¹¬|Fý;|÷+ëæjÜÛå2 ð~ĨSÙ5oŒß”é¥ÇU%lèиˆ@¢ š|û´¥ŸÜõùæ_´=¤›c4i(Åàg2²¯ÙòTξàxgs)èGŒ+‘ól%¥”’~/È/ûôYþÅÝëNQ¦¤kßKð*ß^T=äÿbô#Î)¾dÅkÌyüÞg¨Zµdé=3üǽ6nüô‰sv|8ùh`¦—ÂÚRSå›yŸšeàÔåʽ¯ùÈI¹ilÿ`zåšt¦«DŸ0Œ u„% ôtfÖu›Ÿq0*Y*;ÌBòµï°"x]úzâöËVß—ëdkªM¸"³q™û”ºa]ì´‡ZöÖßÝó oå±³»£“Wy'ßô¥·(uò3–|tÏçÛSüL¨íÈA>ôj£°öò›¦-úä±Ow~ªƒún›~è£ß¸Rî4®øûŠg‰Œõ«Þs8l\zGIï‚8©RÄSGàã^¶íÛEmI™ûyl„*íÒ‘{_ûBû®Ÿˆ(ä äçø—¯e  Zl§„"K[£Û%ë Aj’R@œ vkÀ¼^ëÄ1½ë»Ü–f[w!À¨Lz_? }ënÀmm«w¹ÜˆÕèüB9æ/kA‚Ù©°°ô´H•¹¾ÇI¡!"˜ÍmÚ8ÅÏ%~±µV;áô}û*ïpÖYßãÔ™‚ýP@ˆ8;»[[4 ŽZ[¹ÜoŒÔiypv5Ø{z( Nã«ó6!JA´t4µê¢xOK‰æö¦¯ÀHŽeDkKË%b¥ÁË[×ÕØ ñT𠥃`mop:€X…>@ë¥í]éç¶XÚ›%‘ò^A:•½½Õm Å'‹ˆ¸z¬æ6Ñ-P@˜S©Œ*%çñŠFBO‹µËìy²:_?Æ3U‘ÛÒlíꢈUzjtÏú?·¥ÉÚÝE€ÕøFrbc·Uëh’¬µæ.Þ;$À³ÈP°ë¶é}‚|€ˆÖ®æz‰2Zÿ8aÛçw>1ò•Uá…&þ“ ᆿ@n&g‘™óÂ¾Ä BÿwήƘ«ÿùƒä°Í#7òž)™ ÊǨaû»û –4×Òܾb0Èùk.–،̟nÞ€Ú/%flTv\žŸgו¬6²ÜÈÈü1¢ò Q„€¬5Yn$ ‚4ðE pQÔTFæWû³èÜ—pÿŠP±Ù n΋` Á9ñ‹ŒÌ™Q3à«þƒ­»3×CaóEÐœœ© ä~%#sº‰Ë&Àá¼3…ÑÅqº1ò9Î22gç>()™?Oªddddd¹‘‘‘@üæu7¢•%œÈ+~SQŠE¢XâÔå:VÏ à’‹‘ܞÜ)æ$Võ×/­¥㶟¼¡VIöO-?þ-O-…„Ô'¯»h僮dnVÅø³o‡¿+—„ÿpS€¹ãòÿ²=”B\çšäMïèº;Ýj?änRHêß1%ãwá¿4kãÐÿý“QxK¸W}x§Õ¥O®Ë{¿>@w.K5Xäµû~6ꉃ¨”²4[éûù®üaò ½ˆ­ÄQÜ·'úø¼ }¿N Àžw zß$XªŠ9‚Ù3«Fg¨»gCÏñP> 'RÂxÿxSx¾uü} NÝ„0ݱ«ïçÿoÛ•× €€iZµâñع‡2F{R½œze€ÞâI½–BïK±ïI}Ïå  ½é`N­àéó$ÅÑ«64iûŽ -á×E­¼¾ëºEVNmãe;^†ãÇmõÉí_^؉öÀœÃ@ LŸÉƒÏÞzžB2gjC™»¡Þ_Κ?fø¼ü¬åÿg°J€8æ|9Ú¿noâ¢KG¬[®Ýÿkj.JúnÌð6; z¥À Uõ¼Áß\:bÞè¬e,=}É–PWÐŽ‡‡~1jø¼q)[¾à@wmL^:mļüáó¯Ž8\ ¸w´ îÍI˦˜7zÈâ¿û¶w¢§Ú΃^6C}Æt"\TòžP<}IYÚ( «&ºà¦a_ä ûß”¸½0F€®ûwÞ—·pñÜ©}"ÿ÷`„ ý“Qÿ»Ž·ü8ø«aY;Ë#Z#6Ü>ì‹Qþ½Ù¿½0Š#EÂA &Œø|tæê§4N=£Á‚7€çoªo|·ÈÖêÛm½­!4Gn¸-狼á_^žP´ÚS6Ôü^Þ×(]BoË4¾š÷ÅMq$ÎÏ󙘕“³×½ TLø~ô -ÅÀ ° ã³·ÔV¾ŸýUÞðyãn;Þz@Z£W_=bÞ˜Œµÿá†Î»Ô¯¥MÖš'7t{®K*o¨öBÉ%/5Hƒ¿ëÕãŒ1à ?±'=R–– XrEoùÌšúXyJ 6€iï#Ù?~Õ6øñƒ—¾V¦O]xEH«Ô»lBx»º2ÿC—<îê^4tá½¼ØüCÎâ‡Ýá7ûzù«LE7 .:)Z _xŸvÓ¡±¯‹Š]vEX«ãÔG¤Ôi°†o}λµ8„]ˆäÉîBÊÒÎ0p#ÊǼY–{›²ôáÌÿ@EFú•ZÄ’€€e°«1eý‚–!/ Z›¼xª‰É¨È{éhrFìòIG«ÀxàÉ!ë>êH{ô९4z;3Ìò¶ý챰Њ‘”*@heê¢ÉÞ0øð˜ÿ”Œº›©|vȺ÷Ž¦8KPþØÈ{©ˆrž/Éž ˆ¸1! Ë7¼ØT:á˃£o6îº=¾º©)yádo’\6æ•êH¯„µpD$O† $gªÏ2Öµ…?Ñžºƒ2»"\jˆì±Sjâ/BÁU@mÉskã†p+.l€=¸|¥%ù»úØ Ôâ—n¨ßæ¿ç“† wqußZ¸ýÓêÖ(À2Ú0ÿiß®Ž[5æ¼›ã.ëQÐŒî€ Ò~EÏÓ¨ÿTdŽ 8Ù÷Äÿø~ýÕœ8ߎRtG&~:xÝ3 «§±Ó~ySü4³o” PížçŒlÞ¦ü‰H¥w?œ¿è+ÃÈk-g->¢Ã<ê…F_¨>áK“·Œ¸EB(›ë¨Ô[ø„–~ß•¾¤>. (Xš&„-íÈŸrzc0Žn ½ÞŽ«<±àj¼½Í„€úÀkÞ4}kþí"¥€P÷¸êüß™\wvžåÀU—1‚Rä4ÆÙ½|ö "*i«O)€1¬=øM â®u§ÑÉûÏN£P¦(v¤í^)ð(7‡]¶ú™¬¦Eæð‰ñS¾á Q€Zµýæ&E4 ¬Šªh‹LèPèÑ„˜º*­¹Qbµ.…ª7 vPk7u™"ó{è;©K§õŽjŠŸÑ&‰¤ÁÔ* á{Âv•" XÑ­¤ÎmJ÷v¶_ì†R¢ËÞ3moïPšú[»î*PEÕä¾YìÓÒc÷É"Rߩɦqvô™·ºÏÞØ{uj”žh‡©¥Ã¥ &žœ”mùZ#¸ö(mØm[¾Ç#{”xÞVŒèzòe áËFGʨ(ãÛ4è¥Òä „PÉÔÚåòŠ?zã+~Û§ËÕùk½*RÝpÑÓ¤Q–É {­C§ì} þɈ®Gø@” bà;§eU¬Ô×/ÊÚý¬=ú–ƒ#ïp{~‘1×?XGN~yá»SnL8‰;nìP 3˜:&" ¾oL"NÂD)ŠÀ'îÿÛ&ßC_ú4—Fý03 bû°Å_`CÅv¥•ë,óá­ÑñäÅsxV¹5Ánmˆ%bbe¾%rŬ˜ó"Ÿ`%J0×OK8‰œÉÑ9aà„c¶éÖ °¿›·«º ïMϤtZE&‚"p)ôˆXX‘ºXŠ@lW»8‹Z€èÚ’ïlKF€ dó5ÑO·Íyήt)Ãî¨H ©oªN™™¢œ¹È¿±¶!i:õØ"¬¯M‰‹ÜPÇlU³þÎîãÊîZ…èÕ¬ÆЀҾÄ8¬g².‘U£dÛº¥Ô£?’“¡Œ„ƒÜcMxôHwÒ‰ËgúÉÀn€Rê{cSpAä÷·Mþ„¶©y®» õ™uJAÛ¡æÁ'ʆ¶s³|ENG¡“ ±=rx †Ši{â²kÃjk`”¾""@âÓF,åŽÿá˜0‹_¤áÀ[Àp¤Ò»uŸ=t6AÐ>„ÚÍUÀ#à@}d¡š÷jö ñ*yðšw0ƒ€à@Pè Dm‰ÃtÅϨvß“º»ðäG„$gQÌÖ—÷oè½½,¡è€3$Ç… eÐh¶~c@7‡€ßrÆÜf/ Ú@âjÑHXˆ*+ï -ŸÜ:FáÖý¡­à`{Ê÷cÓ·|lˆÅ7Ò´÷u„8¬#vÃ-Q•?ÙJslÔ=bç椒ÃÀnKÎÇÍEA‚§l¦=Ÿð^ƒ hü‰Û¬10?¼¿·lŒÀý¢'ãðŠÄT2´Ô@Á¥ßPùð­fÝPQŒOubdúæ™Á»ãì*NÝU)xo ŒRŠˆxâ'‘RtA'é DѶ&÷³NÔ^“U8íõ£¹{­~aø×ûzô*]óawè}‡2“A¢ ËÛ3zrú¶ÙÞ‡;Q«®«»uðk5‹‚ÇâC ÿb¥ÕŽmj·¾æÒ7%©ÏtÖß“1¬Õ'†ïÜÏr)eS†é·n„R|GÑhkâÞòŠÿÏ¥õEîv^äm†”¹7HiàÝeé•ÑK‡ùdSG¥JTVŒú§D|æÖÍO]pUsL×¹¿;.5¨¨ %ˆˆ½ö&ð»îàÐý ë. TGý((‡”Œ¸ŽŒz8cÕ ¹_n·˜|UmûA;nÿ˜˜Ó´DDèÕV/Ϙ¾ùz¿­FøßxhHYüÊÜïlÉ]£v±á‚qú±O’_Õ“ÃtÛC㙶Z qz·bf@ÐØâ±÷!"zVQ÷v¹·•zWW›FUD„Ä\åS’I­¥=áåØÍy÷cýË×j°ÁU°­åäï»;xQáRk»»YÁ €‚Â@1x»YR˜$–õ„9x{—¨ð&,s^·Š‡fCÊÂS½EÆÕÉH'/†8·Êdç\VD)eT¢BOщå|}Í‚§yeß.;ç²!J1§—8¾o刋uY0!€X‰÷’ØSvx„„Vp"Je”¢BOûB§ãêf$€‘x/‰ãú®ìàœL€p:# ‡Û¥1±)·Ú›z%R@W# €XQi$¸ïðñ¾ æûîÉiü¨“·uKjÿÞUÅž«Q7ï0Î ò  €2înFt`Â{‰ýjÍ9»1¡„Ó R8.µ B¢…s9«ÜJëlCØ (xÆÕÆ[Õ{¾ãlc@ëVª<þãhg$‰2ZÁ½cä’gË&-k÷ÖË^Õïë-—ÿ çÝœÁ¸á½]}á?Â{¹y¯SG£Æ¯ßKþ¤—˜2#Ié}Ö³ µ VŸ¡Bgi„Îôù¾÷±BTùžáý“/K9ÀéÎCÀHJ“t†+«µêø{.§ïh\ÍÉ_ǧ}ÎRàSn®tk•§ñn¿b Ia”g¨µ öëW¶ÞQVïf{<‹ªÞH ßþÅ“”}/ņ˜­oÙ£ïhŒŒÝÁ”N­NÖš*–‘ùkáƒÛUu©WùwJ•¦öfsö×V’ç§d¹‘‘ù½‘ +gþ®¸R•­ !¶Je3ø\pûòd¹‘‘¹ ¼] .c’ËxÜÕYk.`¹q€‹!ý».ŽšÊÈüJr®þ鯘™²ºC ]ž°‚—,722g2"Eÿ[7Áª£Ðdø *H0w|sHîZ22g›‰±¼ÜFÀ^ú=+] #sÅ97ä!%##ó'!ËŒŒÌŸ„<þ+½,ŒXp߸’’øÓ‡áRJQ ƒËAѯœ—¥Cï(É ’D¡¿4Å,âNɾA@@{Ù(¤PƒäQ’—ËrsqJ B¤»rCÑ¢÷ë«k ¬ Œ}kÖ¸ËUbkvF§9ÅÏE”~<|Sõ}·=?Üg¾¸hi”~ ž;õŽÔÙ²óÛÝ+ç·µvRB>‰I“ïOÍÎøkB¨u×kË?ü’bÜ{4!¬WTÂe÷gŒÊåй5.8:ySƒê.þàÖ¹ƒo[783Xîx²Üü#÷ÄN}yž‚€vm~îû›ÒþöZNl0¢Tì)ÛòνKö™ñÄý<¥u_ßV®¿}ü¬‰§ÖT„È©_ù»½A8‹CËѲ·gÐißJ ï¿Ì³P7oÎêLÞÝŒöÖ€£¡ àã[[Ž<1þšÉ¿Á„ ”"„~Sƒ#†gyÿ¼Í÷VxjE?nøø-å÷_vûÜ_›Fš"ÀŒåÇçnÌ~mÐ%N{z™Êà'OYnNî¶YjŠZëë$‚ƈ ¤tÞs2“³©¾d¯Íæļ—wÜP“–˜¯ì„?UEC%jèxKÅr 7›)mlvÅÃâóÛp¦RùžCú˜ñ™CSB™üGßõúÞmÅ'ØK¾.9f÷Þ*†¿B¨YÓìLñnª=R’9Yl/o³&ýõ@¹[ëKŠ­6'oˆNIç1mÜþÙ‘fÆXºþˆ+):}Øq_ { [bf¾žé–(hL׌œÒSë°J1f¹rg[c=¡œ:0%$> ‰rÕo8Öè—84gmAUkHÒ¡iëÑzC\’öØžÝÚ¨ËÕHêj,ÙÝc±2ºàÔl%J)b£©¤éX… bu`rhB gÚ @±ÊèíÙ•I)ÕzÏ6zφKÎ9ZYªŠZëj%ʨü“Bc=e7­Ó%ædxÊænØXÙàŸtd×R³u©-jXdÛQ]bŠ TòbuñZuÄxµ}_cm°zŸ”1>zV"€9è:¼µ¥¹ +C3rÚö.GÞ9Aa¾ò*â+7ˆAæϬ˜·Ú+qŒ·Vl8ô ÆL}äY…kÿÂnu$‡ÇDÙ«·lùTúlAJn.zwOk›®õ;edNxöøúío—ö´)Z–hcGFg†ó\n©Tj{ó»STñŒÇh·4[EµwØÌAwÉÇÛOô7Áþé“Ûv¿YX{G\v8é®[öÌ\2DDtT¼¼ËpɌǞuµWÛ©º[ì=¡ý-ʨ5Jh©(Fñ¸0@!xÌmÁ@)Ì¢º…søá¨OÚ$ßV»à.é¾i·Íap”~²yÓФÜêÀ`+ýpKáøäÜÒ´`ëR½yņvMR¬÷8kÁ‹3›»Ù€˜äîÊÂBš2õ¹µ dßýôw¯Ô&\h°ó,J}lÖ]S±øs ¥BA(¦”"7/¿yõÊCÞ)½5]µ ž¥‘·Í¼ïëȼM«¢s3À €ÁUñÙæõ ƒçÚ H²u4jƒp6ï\ðRêõÙ&=¿oÙ+¬±¸ÇMÔZøƶyï_öæ÷~ Ú°ø«×ðKÎÓºËwÄ£bSÎûAa¾ò°rð®ŠÅ }®Y6mL„[°ÞóC±$‘öâ«6øÊÇ?Óq€0ÔnýÊÒ\GƒÂ1§ U sž[d‰æ¤neþsËüt?p=Ô†I½úî¦Wnûöÿ¦F'šÂÓCÓÆ„Äù‘úæÝfØ°’”5õR€9*ç'<½>:!mž °Ð²ö3?ñšçV!€î¯| ´æþìñ×ìZ±1|äõ©‰ÁýÓ!Ô˜ûû—¾úä—¬ ŒˆñŽ6hŒFt-,X_7ôþe©‰¾„‚£ä£¯Þúocû”°íÙj€9ê×3¬:È@Ìknªî<ûå—u, ûá…^WRr4'Ú¹ü‹5±×|2ò’4J!ûÒ5ß¼ôtEùˆ„XŸÓœ`UÐ0FˆtUîÛµEéu¹RÉHõkW–§ß¶ +3ŒPpúö«Wß­®™ésæ‚i}U¼¾)eÆ>Hw{Ÿ‹0æXuõcb‰é­O^S½·Þ7SS¼cgÈ%oMœ5 ahßöï•ŸÛzÃé2UnUøDZòïRß|}|Ô†øÌ©ñDäŠÍ{Ö­IËHUé}CGÌ¡’çp% tùÞFDϼ„½F´ ‰ž¾u~ûR”"¯ÌI/î¬ÞøIyѶú‡ÊW¾(©’FÜñjll0 @©D<)õÈ `FrÃñ£¿ì<ºµÂûò§5‚@A=ìÚÏ·ˆÎz @ˆHN>M‡ª Ÿ~͹%«?=V^Zùîýßþ6)ÿ–Çýt-å¥Xoñ Ú¤‰ÞÂG• ‘AÚŸ¨…Ä%&¦$bÖUñc©aØ“^ ˆP.~æÇ;©̇¾qSêÐÕܬ:Ü1MõIq¾'ï”AˆíZýÏñ¸÷u§ÍJ¼‚sÆ>ø‡ ­ªªè0OÙTÑy¾äµê†æ„hŸ³YFD’àû*)PÁ™‡DJ«B,/Ú-ÄÝbët%ŒFD ^)×k4‹äÁ<Ðc7D]¿­ÿÏÎwf»‘ŽWx'^ýZúàeü¬nûì©EËìJ­—!~ÖøÛnd=©lµÁ¸ßxBÚ |lÂBP"1a£n u«$¸$É^±ào_ËþsUtàiHÄž\5D¬«ÑðÐ7Y,8˜³ß‘RX¿„+M¸œH‚Kp6oó΂wþ9ó‰œ;Æ:†ñX…ˆb­V-öô¸&x¡4ñžkSg·«UJÏ©{@t. ¶ðµÉÇ|%¢hìêƧnÌ£TÒzh¡ïF¬òÈw×ì=;é_¯hP—ÓŠŽåŽ—M­Õ³Õy.J1+Æà2 IDAT«:þc„< ]¢¨ë=„ bŒ‚“ó@—¬ÐÅ\ñxü”Ç»jÖìøbçÇ7û¾°<Ô¤Ò†ŽœøÜbw[cÉæâů~ÿ¶nÆ?fövŽ ³¥(u÷4A~É:Ã)0«L›qß¾â;ÍU((èt¹8-´ªÖ¨Ä»Ë“Ò—bøŸÚwNkwSµ&8…Àfx%ÃGŽ½þòž_iv …‚;éM×Mµ;œX¥f=çöö/9ÓfSŠ5évx €á$`y <ñ?;Bt}˜â·û´EC+´:•’RŠ’.ÿWÉ®ìÝv odšHçUl’ÀyÊæt8°RÅQèÝ!rÜq–<¹z-X…±Ã-@ïõˆHEIÌç?¿ÉÝÅR[Åú/-Apƒ&05mæ=>Rwk—»»bÕþíÇD€Â7(cFBú0±yÇ…Þ¨Øñã³7}W zÜܱ5WS *Oï¡Ý?yr¡êÈ4ŸÖ]!–mX~cRÁ¾&Ï”Üñxü®šuË^¾¥ô@%:®Tj/¯Âjƒ–C~‘Q’½ÇÜiÁ«zS 6E‡š$œVƒœí.€‘«®¸†' Šìß±s‡BÀ²ëïL_QPd ˆcX±á@Ûnˆ6KùÚ‹œ}íB¿!¦$–}ùl½ €1$š ÎŽ¦vOÙÜ »š¨:2$@’€Ój«³¯lBmQÍñ²!Jz“wüÌ)+#ÔZ¡åP# Žæm=òþýnÝ NgÝûѲÍë£2Fk”¤½lM‡6&/@GK« ?ùwSÙäÀÐ ¡½´|Ëþ3ðv b6`äì[–½ÿàÒú!¦à(G{ÚªÚ*öh³‹Môp¨S}pÑîXôØ»Îb­@ðÔW´OܲäåÚˆ˜ÐÎ’•í^¹3ý$Žjˆ½lÕGBí Ô±3¹¾¥sêØ+Fûqý‡«‹Ï0†²ÄÖÕTÙ\~0vö§:že’gK_òã[·&äMUÓæ£?ÌצÞ꣧(“¯×Í»ûǯ’“’j·|kE5§BEð™üfÀ®Yß?ß•ßsd]9%kõbòƤ¬ýüÖ®£Ó}l˾%Çj¼¦¥Vñ?­Å`÷^tѤ-o¿8ãþGø¨‰¹C¿ÚòÁ­£gê˜öc¿æcæD†ûSŠäŒŽ6Ìû2-=¢¡p5$ ‘(ÖE+¡aÇßJ›5è§û Eœ_T|LÑ÷ßÙs¥ÊyèȾV§ù”Ðó橧žú…3ƒ­ßZ5BØ ×iHKÛ±ƒ–öVeÈè¼;žñR"ehvÊ psÕþö†j'ñJžõRNN$¡àl/w³©‘)‘ˆØZË$uzDR:Ïú ¡ê¥m'I+P…M=Z´´XÛ›œv;oˆI¾ò™‘c‡‚Dqaiá]5‡­v&dP¶VôHñÑé±È³ò¥­ÌÉŽN Å|`êÈ‘ö†C-Íꈉcþþ/ ‹ Ò…'ûtVvOxr:îËnL)6$OŠOsv5Z;ÛœAœ5ô–· ¥„Âøe_í£èn*ÛÙÝå ûèØ«&b‰V†‡Fù¶–þØTY8ö‘Á±b{—_tfXkZÍÞ1ÙY 1†Ä‘ã…¶òŽ†:Ö?wô}/{«BAŸ<9"DÓvxWgk³&êŠq÷?nP S|CÑÖlé"¡Y—(™ÞP¥| ¯ª¹¶J3L¯RšÏ лšJw˜;my÷¿v:#Q \PxBxGÙÆÆ#¾#îÎNáZ; Ñ™©€C»¹±†ñªo«¯÷Oc4p G¼ÂsýƒMÔÝQÌ=Ê7Ð<|†N¨i®*s«çßñϺ­Ÿ+¦GÄúÈËnþbL`Pž“òËײ PP -¶“⧯þò\ðÛû¤7)õtÏþ/Ï«Ö$˜ KOßœyÓ“'$ú§gãUóÔý¢–9éË?E¢pÆUÁgý‡“ÖñÖð”R„àôZžRñ~/OÊubFé Õ·”ùŒmH)í×ýýJÔïÚý^Jæ#›llZh”H¶ê%M ùÛ–!ézYnþÆGC¸áOw¦Î(ègßDè¤w.œu g‹_ 8-=ËI5ýÅ-sÆóY¿‚~ñ?œÜÎÇ?v– ô3…ì÷±3œ©¦½ï¹ Ñ›¯ßÿ þ/)Ú\øáö½î¬i7é•îúÂÿö觤 Ö#ÙÀ±™¿Dö)°)·|kXûêî »$Æ”8åêܬ$ô/Þ)/#ËÌÔ ’ ypêØ=N% gxhrC(ˆdà7Š§ŽCM/`Á @^móW4ý9û¬¿"TlÁ%€û"xÀÀG v¹kÉÈœ5:ÅlÝt»àõƒPjø­éà³<¸k«Ü¯ddN³P<’¹°Ü€ÂØÖr´¨6VÕÉ]KFæT0Àí‰çþ]™?Iªddddd¹‘‘‘‘åæ7CR`¸S¶ÿžíýóƒÞôš|ß|ÞŒàòŸ(ý {)@¿úR €àpßÅedÎ7¹Á–R…À€AQËÓF-^ ÌÉë×ôÈüï¾öü[´…DmÝÂÔ…—ú kÔ™£>Ÿ¸ãk…Ð;ÒíˆÚòÍÛ!dØyßèO/S¸O[,Ä õþ©—~öð¿þ¨! ˜umµ\ÇF|ð(PŒôeÏŒ|wPÞ×ÿÖïŸ4þÓ×—WØÉü<îªbL6ݪHú¨*: ÔŒÙPGupÚ!¬Näøó¯­¨æà™ÅÅÇƼW€(€»³|Ü{ÁÕåŒÊ#o…¶ZÝÆð½Mƒn`›æû¸r[¼ªë*[®u*9|+7ªí6IÒ5Á©À3[ù×ñn·¤ðhWó€€oþ.Ð2¨6‚Ë~`‘¦;t’ÙßGdÉl´ÉÍñ¹=ûÐ¥Â=%Õ…œÈX"fØ/î§`3T­Ów·kè›ÔmÔÔ½.¢Ž«JÍò-]¨±»ÝúÄ–˜Q¾~aDùJÅð¢÷;ã¯ÕT-µ^i6q>UÔ¾*BLk ì j ¯NÉB!d«ð¯Ú¦t n]\KL¾2ýL©¼¼‡ú˜ImêT"o6©sú6Ò~4cÝS&sël ÞóÙ‹bF ^Ÿ¶ù­ÍÂ[ŠcÖÏÌÜVQ€"L`0TÏ ­¬\벡+òk¨Ä®ªäÅ3ü¬ççN.äRj•¶R¥Çô6lÌ©|½‹Êð<)aÔ€AÙº(¢tEÂÆ—´Ý5ˆ²íúÕŒèò­Œd÷.yoÈ¢¿iD„Xóæa‹o ©,b]fŸò2—ÌU  `»–…—|—ðÃóDÆ7­LY{SHÁ¬¨Z³CÅí¾;móšŸ2ápƲëCìÂbgäúë"ÛEÚûygÜŠÉ»>Wº]ê†)KÆ×7jßqpA̲§Æ¡Âv>’²k9  Œ–‘ºH«)í >ô©©£ Q–C„ `%^Í·,Œ(-ÓòõˆùsªˑØXôôˆEOpCÍüÈ w|£îi‘‡œlÝœ³Ü¸ŠWY†/;@Öß‚Ž„H®&Æ÷êƒÃ®í2ê ÅôdZÉëŠÌ]ñ³„¢å–ˆéõQñý‹à»÷Eðþ{ñת¬²ôÿÍŸóPm˜úa{­¸nÈÂiVc˜Í7»-rRgpµÅ̵ï_$ù^R7h †‡¶Å ³ :´6<™nØ>å6Cï _{iZÁ’Â˦1”Gª³§`îJø|hLuË„ @,´mn¾n­Y égüü¶`Õ[;Gä‚B×îÄÖÕ˜Œ'gKË…A_t¿–›ºeæ¿$UÙs¿šŠa€AYvOPwÌÎkÞq0tÅ×gnù¨iÎS1гOûCµ¿tÃîá‡v¡áWAZZ—̾µY#Žš^ «[Ò®óÝõ™=·.L¯Ù{Üc ßqÆõï0wù9ªs»'7gé@¼SAÑí9¥·žˆ€ßeï;2b­ŸVZíÛgÅ`"Ÿ!ó{…Š¥– âÕ67t1mƒnì¡=Z»KÁ‰ ÄTWHГšìßM}; }ùöÞÞï.ómì9›Š˜ÖߘT¸“ÞãB¢½(uküz«Bé©rAÀ§#ÌßXü5D 4Õ¦f3€“y‡Ñ$ L͇v¢ä7 Ž¶=@£­Þç)#H-ÁGÛ)Ô©=ºIáî-6ïñ?Zþ³*TüEEbc¬ÞzŸýë@DÉ»t¹ÞìǘÌïdÝpÞ¨íÛÁå«;ÂÇ8y¢¯/ШãKŒZ§³»W%ly¹ÝÈûW,k‰ŸÈ5,ÜûQuÆUpx‡éH«Î¼½/Âm÷D¬}iðš]Ýz…÷±ýÎÐhpœo¦7ì_’wwöêdz[¿t£],UuW©;:^j ôp81ë_óUŒ´¯1óÑ~£•‚„š³ž‹XxoÖ²ý­Á‰Š¶m~ Õµ—tB@c|h¶;£Í3¨e»¯0¬*Þ/òðkÁwþÅ!`ÎyÁ¹àŽ¬¥Uþ¡^5…ŽèD¨#@À‘òVóÑ)™ ¯mEìG|k6Ù’_i‰Hø‰J Ê$Äox¢;rÖÏö¥Êì›sVý+õ­Ã7@ÓXà×ä,5Ñ"2™ã¾Ð/OüÒ#ÀÂcP×?Á=1s­J¢´6°n·=`âáüÿs³´ Á!ªîZ…È5yµ%6Ï‚Íj«Ã6¶1*š³u 6À”Æ8[$m¦ÙÏWÔjóñåm,Õ×|¹CeÃ\tg@È_gÈÀ©ð^é©ž‘dȬM™@A’!…ÔQ7ôɪÄ4 ×–ÀØ;Xdì B¤6Ì&tGE”*Ãê’Æ€³Imë$Ú¤ªÜg[|Œ@¨=dŠÌjK#1æ—æ̲y§³®fP„wëÇ´‡DQÑÓm Íu(€ÜfŽî DO^½‚Ý] çÛ”EÒšÂ:Û8µeü«ÎOÉK!q@•íñӜȪîiÂŒ©eУU‰™@¤.¥èÛšÞ«ñ’Y)v„¥Q .C̬ÄZƒrD°Yý†Ût‰·v8‚ó¬*»Û8&¡=8(• ™µ±YœµZå°¦‡/y¾Kà ÖÙ"iÒÍ~òx €Ù1wN™~Åi~ 6¸ªàb9ïæÐlHY(w-™3Ä_–Ž‡ËÃÿüØŒŒŒŒ,7222²ÜÈÈÈ\¤üº™)§¿lïïŽ.ŽšÊÈüJr®óÆ¿"TÜj‹=Á $’ PÖ-w-™Ó$À[¡Ú?غÑpPÞvQd_ Äê ºUîZ22g¿s]£òëœ)³Ú.¹$ÉEQS™s ç†*–‘‘ù“åFFFF–™+7Á_¥À(p9)`qý3½S ˆîß÷Dq €8PQ>©\F–›‹Ç¶dHésù[„Kn}ìIJ yûËË?ù°ç42*‰Ä”xyö¬û"Ã}%BÑ9Ÿ(Nè*ߪˆ¡bu6|~×È€I+/¹,q@µ&@¤ùÐnSÊP^î[²3%s:ŒR§P©z«à¡“ÿ³÷†÷‹nxÏ-ü«,*xîæ' ß½€"`XûÞ3» @ŠÀ«Þ(ÉŸÿשýýóàQ 5mÿèU»Ü©¦uC)`$´—n´Z¬&(bÄÕþ¾*Àà(û¤¨jÐÈ1~û–ý¯ÇŽ 1£R†çbLê—ÿ»V7.wt¶(zÎäu—¬zúNOwžö”ÃCçû¸EÐJ}( ¨Xû’3àæHõ®’]»$䵑îâyÏû¿uPŒ/‘Ï+PÖ BîÖ-ß>s{Õ±…Î`=ºfõs3Z{\صýÈŽ¥ÞxfqæßÿcaÆØ'Âyhþ[íÄs/{YéÊoHHÜùD@ˆÔ/ºó»·_·¸y•†©ÛðÚWÿ~]àj-_WºæÂU»}’ò´P¶á©©¥m@‘Fr–üö·ç·A㶥ե{Ê_˜aBu R²tÐ~Ãah\|ó¢·^ì’¼´FEÝê§æ=ü/›ˆ¬ûo[°þñ¹=êÄ ÿc«[õùטUMJABꀣÑD%{õî¥ÍÚ]øÊ—OÝ×dF:cçÎO¾zð†V'­‡×—­ÿ´`ù6ïÄ<=S±ñ™i‡Z1èÀ§×mX¶DR˜”¬³bÙ#K?™‡˜“ì.„ÄÊOf,ýäc;hU*éØòǾzužÄ!DÅú}«.~·hOfB`ÙúÌ×Ïþ³©‹Ó¸š•OÍ{æu'Bý[±¨}Ó+?}·GÒ¨µÊÆ­¯/~ì.‡H1ƒ—ܼìÃ7,ĨVÙK¾¸ñ›·J°ÒÛ¨'¢ÈèB¼´JYjœuƒ€¸Ý)W<—2iGQܼåÞ¬EuÓÇÇ ÌÒºí‘olˆôÄŽSwo^µ~Ëèü8>ñ¾`}þžÆŽ ¬EoZü®OpŸï))¥$`䨛ïŠÏJFÒ/°èá¹¥Çî†ýmÒ?ÿ£Àé9ÍGò+7î‹»2=&}BñþïÍ÷3)AUÅVmâË*œ~Äè™î†lßÝÑd œ‘Šè µ‘:öý¸¡$mî—C†ÇP ƒrG}ýÔ½åÅ¥YC“ƒ¡»Æës¢U "Äòù _·\;;vøð- vEæ]¬ÆÄÙÜwç®å üó^tm€Kç¬yáŠÝß.™xýTÌpÐS7þÁ÷T @FnÛÑÜ£ÅÉsÃêö–Äp ÇPJ)Ǫ”‚à ^é“þûiù‘ÊÀaI’sÃa”u{úéŸ]ä®-\ÞÉŠ ZkÊW}‚Rïž©¡OŽØ:*Düb(ÊšâýY¦±¹ã$ |T|„ŠJq‘ôôóêf6ôFLú™Ü]-öÈ[òz“%°ZcXEG1¥S œÿXë©ËjTÄÑA Ã?6dÿ‡wx]q¥oX¼oxl\6HBoŠRF7jZÝÞ-W¸]‚dk¤ˆºn0PQƒ(·¥Üa‚¨¹¢ry±êö†ýŽepfÊÁoÝá¾>0<Î7<&.7@ ùØaijØÑØx¸XÖhluÍí‘A^žô”xì,Yk–Ü ™‹^XþÙ2SÆœ„´$^ÍY·‘ž¾_'Ê*±g|œøѤüQÛ_ý¾ËêôîÙ|LÐMŒ—œ÷}QâÞòúìŠ&!aÌ\¿Ð(än;'b ˆU¡¾j"èM›"2¡C'Ç/\º*7?ÉöÃö„Ù1z ÂO˜qagíÎï9D+½cç~›:4Ü'5$·•R Ï{òV Š8:Ï'(§å±'p €”çv:ÉoH%‹[T©Ô}–* •ŠVÚ«>ÇkD{¥D„Ì»¿÷ZþbÑâgÜ‚(‰^Ãîù4>6È Œh^óô¬Á”2öjï0£dÆýâ:+{œ$‚•2ªÃ_ý½âDÉÖmGèDÂ"Ð+ç]ôAኗJìDr1q³ß6jÛíѵóÓ{N4£Ri³¹dyàrÃ0]Åó¾ÑOúïÔi™¢Œ’6|)þÜ´bãæ¤ß*Úß:ȱ…õ»ÒÛ›ý²üñÇÚŠÊ”wgÇó”‚d=¼ûçb0T¯¡Ï=\yKÓÚ£‰S¢"Pô•¥TÒzð3?Åñ_x =EŒY…#«ËH€(¢.«ªT½Ñ $ô¸¨E€€t»\JŸ± ˆ5*8»Í à (µÛÝ«=ë¸E€uÌÔgâ¦k[mËî7 Þ¸×çÝo½û}ÁѲ£¹£;ç±u‰!ˆ8ëèI?6Ç-+ހǰg‹ãûÒ¥bˆ¢ÐÏÊE³(päWŽºÓÞÑÐYúíÚy÷&®Ð)ÕÀé&¿¸Ê¨ê÷]DÎ:TŒ@$FeÐ{òõìùèp—J’Æ?a$PIPÄM›Þ²æó²¢íQ³näè²ØŒº‰Ä+õ<¥€4nxÙ.2ä'í2D)£Ž Œ¨˜ÿr½]žšô ¢6@DúþP§Þ€‚Æ'žeQSIfaän9Ø$Š¡¡ñ„`÷±’’Ì"Ä€mßwE\d '&‘ÓïÑàc ^M?®¡F v6¶3知F9ÊvÌÿÔæ Xí5æ*µ³±Û~Šíªà5ˆ j¶|$y’þ “ª ÐÇ©u|Í–„‘€¸,ûÑÜêèïa±iï7¯µµ;)¥18,w†‘Úº¬NŸ˜DpZëŽ4PD©§jÏÂo{bŸQ-R ýSí2©u#RŸÔKã×}{{AÕLÇŽz:zÔ¥Á›7¿´3úñ„³B„(¯˜«TÂ͵Žœkcù ¥W`Uš1X³ÿݹŽÌ!-{—àô' ¾Gê–ýËèýo|VsRdæg~õÙeêó†_š²é§½:lJ7eØ’¯n6™æ«±Ô®…°›G÷¶¤!N\Ê*^¨Xü”⚇NôD‘*xìU—÷á=‹*dži[¬m銜’ÝI·Sª-+Ÿ]˜2F¯¡-e›,¦¤¸ #ROwù’5ïÍ®Nçã%4ì]gSŒPÀ†5ûÉ/>à—uSþ%IDΨwžñ+¿Ž™Á&ôw¨>aŠÉK):šðKúÔ÷ÇNIDATFM›î6ŒåDNâàƒÔqÁ1½‘Q*1º„ ˜pDÅ eó¦EêôY Iñ”žwB!ÕJÛNcETF.‡©(@Ȩ{‡àï/!V™aPQ]Pºo©7zB‰!t°O ÑöPj˾ßyï“~Jæ 7“$ePj@X¸Ç6`5qé<þI½¡T;!6)žØ; ã–ǘ™—1„hûÆ¢Ýâ/~ÎwW;©>4çÆ!Ç"B)ò NŠ`N˜ìäGö‰Ê4Õ\PVJÎpt D5+ÿÚT@%’.0Ý/Ø»·FDò ìè1|†—^G$+Ma9s‡OŽIÿu7ñ†øŒ,LD‘ðQËÊÍôÑ‹À¢³µ<Ã3L¾zˆRªÍKÌÊÀBÞ'uFÞ­÷ø“f'©>Y×xƒèB¬Ú/eÊ°kï×ðˆªO˜n+°ºàœó®›Ë# îhdjcä`­œ’ü"Æå¹ýVþbëÂ&@A%´Ø~ƒ;B{=sWó–E/<˜ýèŽØtºR‚³Saaéoó½z+KZ¾¿}m™~Î#¯0诬TþøÇï·^ÿÖ‡ò²™?ŽñÑ~Ny¦þÔ=S!ÒU¸¿`ݱ]ë ãߊ AD°»Bí%K*‹Ö—m9ñðZ£ó}e‘ŒÌù»ùõC¨«±­¡-tܳC.JľËÚrØâÐø×ÊÄ/áÏ©¬&6,ÑWÞ3$sžþÿ%ÎTïËóõ×þwu¦zÿÿOXvvâŽÎýddgêµn$zîÇ”öš7žÂo×@zÅÑ…ÕÎ2f”àÜCð¿ÂºqŠ`v€û"˜\¤~h³É]KFæ r£WüÁ3SçátµŒŒÌ_ö“|N‚€äÅ—222ò$†ŒŒŒ,7222²ÜÈÈÈÈÈr####ËŒŒŒ,7rÈÈÈÈr####ËŒŒŒŒ,7222²ÜÈÈÈÈr#####ËŒŒŒ,72222²ÜÈÈÈÈr####ËŒŒŒŒ,7222²ÜÈÈÈÈÈr####ËŒŒŒ,72222²ÜÈÈÈÈr#####ËŒŒŒ,72225ÿà—}`, ÔSIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/fragoffset.png0000644000000000000000000012775113051004444022053 00000000000000‰PNG  IHDRz˜e9µúsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ™âmm IDATxÚì}e@•ËóðìIº;EETînQTllìîîäÚØÝÝŠŠÝˆ¨4Ò‡“ϼàÊõÞû»ÞÿË|‚çlÌÎÎÎÎÌÎÎD„fh†fh†hÍ$h†fh†fqÓ ÍÐ Í⦚¡š¡YÜ4C34C³¸i†fh†fqÓ ÍÐ ÍÐ,nš¡š¡YÜ4C34C34‹›fh†fh7ÍÐ ÍÐ,nš¡š¡šÅM34C34‹©P{Ûów¸ö‰ÒÐk ^£hJ៷#µ’įµhaÃV%iøsSƃÒZm þM!Ñï(í‹ %fŪÕeŸÑF´†+åWIú»_Mþ^Öy¹3dÀ͈g"šX¾üíÅ—hãmmX‡€®?ëѧ»â/‹=B2_^Z´lc|§ªJÈ 3"Æ/ŸØ‡Ný[vÎQ¥“ïÅ)gô¾·#­ËúÊõ]¿{¼"©üÜç«ö˜ckÛÞè0øœ ÐBB@dÓsÎþyÝF¹xÅrx ÉþE£Î]×æö·Þ`3™ù•f®‘“fõójk†v‹~‘7ÿÔý³êÚ”°8ØÎfÔ¥ÔnFß[»:Å}êõ‚™;ïöÐãÕ¹¥¯Ýñ¸EŽªM GQsÏ·¬–'ï]´PBB?9î1yWìý;ª¬¤À–!Y 2t_|ÀËnýve@H5Ÿ E{êþȶŠÿ 9‚@b5ÊNtâÃKÖìN*åsyƒ©ÐmäôyC‚àÂÚq«îñ\ÜIÿ^?½“™³÷©oÓ;RžþbóÖ]×n?.æ"ËÂÍ?bøÄ0}ñ@£úw9ð2}ܹ×ãÚIlÉ™Gìü–h[÷¿r|>!ï}Z…çË×#]Õ¬ão#¬e¥â+,¸ìê5£e÷yÇ—ö«ص¡[Ý]Úá˃M='ì¡$‡K7p|qycWo÷´PHhP]B 0¼þþ²ý?%oð×€¢¤~y½·‡cÿ“âÿ Ô:7¾Ë’ÃO% !"bN˜cœšJ [‘†N½¯œÞóΦ ƇN»„•o‚Ö½(@üÒ©­MtV#ƒÊ½èea{à}¥½³zž_·YÞP—6k_Õéh’¿ÏøãϤ „³¾oØHÉw7¶²ðPˆ¸iL_o_/¿Èra5õD‚ân®—Ò%(ZüÖÃÉ{ßäÐÀYû$šÉêei¿âEqÓ¦ªhˆ£sH gÿ‡k§©øÙi'ÿÐb…˜Ô¹íŽŒÕç$Ÿ¹{dðêP»QF (ŠÂFæ¨NuJâÿFzffVð©Æ§Q”×ÝÍz[l¡(/&tåküvÃÓÒao’/ožÐ{‚°NµŒžvfßSˆˆù±l-ûŽZ‘ÅÿÄ=µzŒ³­ÅîéâÞÖëéçå2d§°š))DÑ™‰a^¾áƒÿ (DüØÆöHJz© ,¸æíâïåèqè« ¶ØÍ1N½~@ĤGÛÝܺ–þp.Ïñ Œº#½+éKR*Ù¨º5a*þ&øEc ¡xù«¦ö÷ñî±õÊ'¬»! è̆Ù!þÞþAáÛ®~B!FøÏ~tcÇT÷ž“ïLó^ûªè֮錧ª•,"(Mëл™ÓÓÝcé[>!„*þ²hL?__Ÿ~¢2¸„Rv{†mïM¥é·z{{z¯9óœR×0HIÎQïÚ¹r¸(âœÕ¡ÃÛ‡˜«ˆ•O>‡’nthuŽë½yÖ$.²;KWß!›¢—: +GDÀåÖ«+âq¥èÕíR\ê»Þë3~§zÆùk¹(rè4Èš÷fîåT¶ƒ¯c®ÓUÚõ_4µêüá‚_ViãÖ.¬¼¸zW<Õ°#ÀçP™SÅN%%©¥!{pY_o¯€qËð! !7Öuí¶üí«³k;ù{ùõ:ñ¶„þ‚«q§óÄÕ !™'#íº­6ª½À­…½ü½}–¸D<à ÀMÎ/ÖõwW«¨â£ zGOîêiø³©SV¯¡G·ÏÖe‹›e÷˜¶yeg³ ‹7pjtTG›¼¯—Šx"‚H(çÈû,+G[‘Äñ9ÐèÔKƒ*é” £§Žä‰H1,(ÿxS<€+µ+$DX‘¹t|?ïÀN}öÜNFB )ýìë矵ar?O/ŸÞ£–äpHî‹3ÞC³*D"ÓÇ{űxB~Kß fô÷òKm¾mwô¦e#®.´ýiFÝ¥R±¬wǃ9&kvìݶjò‹“O¼¦­êíîwL¯Ý+&ºÌØg¦Îrï9%zÕüÚa2õw¯è^U®µöä™±m™ |ß«czŽÞºm[¿É;,`ËÒ ãüŒ]Y«÷?¶oñÛÃfœJ¯»ÚZ¶çü1uMr±€Æ`€†©ŠL5²åi … !ˆÎ£¢&õ·aÈ’3£–Gµ¦#"þt èlÙ&S.3³ÔT à U—ï[øbeä‹Jª,¹vð°é๠%o?î¾­Oɯ ÓvÖøÀs&ØûÀ–gü §TÝi>»jè´ÃÉ 7nŽÞlZ|%lðJ ËÐ ®|#ã±÷ØéµÓ‚7 ïò¾åß;èãÁe\J¼ÂË×nOè>6”ѨÞMëýèìÁ͆9çìm±ßswð²ÓÚöú%…Çâó€ÀÒâ!]Íÿi§ãW+j¬Ü} ¿åø3- )òþɆñÎë¿O”¡uæîc‘ ìi\“ ! ¨*½¸eYA»¾“Y5ˆ å[‡¶Þ¹xý¡K ªÇd˜¸ÿDz›Ë}ô »oàȳû©IN4Dø…-ˆâ;ét,hòñÏ›û´©ÃLˆîî¼W’ JþOo.“iZÃ>:Eêë«3E"ªOX—£KOV (a“ˆG‚¶K[6:ý[Aˆ_håöEŸ‹¹–ê2Üôø8û­‰ØI#U¹@–Cfn2­ðض-F—êß3Où;‘vo\6gUôÀ~ŸhêmV*…[›hˆ—nij¬•••$Ie˜²®(È©¨ê´Ò­?½ìöƪü”Äb¬ BŸYÝC—í~e† PçWì q\1~smq¦,¬vÞ(ÑW½ûó+3˜?’ À¹ùÛ—tì=ôßmkMF“\'çï8‰¸N;6Nrnš¼Ñ[{úŠIKc (hÝzŒå¢½÷ÒµWBHécZëa‘6Û¿A…£Zöùãôijãow®§‡N´–…~IÜ C²bCD” ]¾…¨Î&ž•ÉÞâ©S˜bM‚*•~úX:ˆ”®»ªxKÁŸwû¡ÂÄT[¬+P:c*ðDêíÍjö%mUƒ a6@¯è‹E“·;VÓà·3¦)xqº÷Œ³ö»}ëæ{wçw@Öo˜ÆR›0mæ 1ÌZ~þú¤3ÉŸè (©'Ó5B æÔ³þ)#!Ë£é8,ÝztçLÇýswŠÅ«KIÛIT¾<0vÛ§mN¯ìÕvá´%"hŠPJИÁ2ªf¯]»víÚµë—# ¸q_ø,¨·§"€Ñœ±]ŽFÍÐ Ôß÷%ëá WO/ooo§À‰2¼óÏPáT@Í4p‚{ÒÊ3L†¤õ/ä ¥ª?ŸàÏ‘k>õÆÍ[·nÝ>±tOôc'­û±)Û¢ŠnDßè·dH½í.þúv7OOOOO—Y5ó\üåþ¸ž¡þž~Oh—¯î56Ñ<ŸÝÂwÃþ3K#[íž½KP]@$ªÃ4<{9XºŠòIoÞƒ„û„@îíÄ 7[¹ïutz+}øúëóÛ,ý0eR„\øÒcèîhå‡Q›cKH*!ÿKí’³»ßÂó+O^½uëæÝ1ÓÚð~̸Lc{íÛ·TeÄgPZNmµÿaÏÍ/ûnRÓSeTôZiË°ÙLZÅɤÕmÉ@ǀ˯W×ÔÑÖÖÖÑÑÑQ‘QR—‘N(ÒÀPcÄâÖN>)>S|bOïÐòE׳Ð ?~B;V² RXÆ4ù®’^˜ç?j3‘Ršz:Èãý@x#B &ÎÚÔqÌ2syâ:=:ywØòË@È_4hE”¸}Ö¨]»áñ’=2êŠ0ˆVt•y¹æaV+/—½ªtŽyùêE Ü9¼ˆÿiGJ‰è׃€ÞcãA•«¶ÜÎ&•žü>™t (/Ãf³¾&¿gÒ²?ª¶ÓUø|ïìÞs‚öƒMYP7–Ųóä÷oÞ¼yóæsüYÀ„KÛ"»{w›qÔeà¬KO^¬ª©(G$8'ùÀ˜ g$ÐÐÒñx?[›2ýíZ=º#E$ÞgªqX9ë r@__…:raȼqgïß>.tîHæßxL7˜3,øÀš”ºüßÒdÂ× =[56›gi?‘S„9kœÓÍkOÞÜߣÙ{‘6óŸÖlþ‚ïÆPÏ°¢ôÚó)­”ɽ“[õ:(¾‹OÈçzÖŽPÕÆ+@yÃèe×ôgQ•WV:Àë·'²Þ´ËzJJbzº¾¡ÁwòȪ²…9Ï>fXkkYŽŸlâ6dê~ï±^zé·6­¹U~w.@ °8›gíž;.˜Q•täè£Ó®K†?h‡Ôú£ÇÐ(ý˜BNAÒ»³Æóœs@@$'|âJBRPÓ7ÒQ<4¾o¢ñÐèÖ(3Ñlÿ!k®÷÷ 2þ‰Q[™Ÿ‘”˜À“Pð]ÑÌÌ°îFDÉrNgëIË£ºxnÕ¬KDÙq+–w0‡"U±hÃkïÑQ  ªÜÊAðμJžá«@ŠÓ>–WŠ‡¨kÒVUî'vDšÑâ¡CwîSTÕ®ýZœðID—$ˆ¼ªž±nS‚zŒM E·?píÚ²ð㥣·3ø^Rz¦¥©Q£8°UF;ê/ŒÚÖ¡ã.úü*­Ïò³íÔjüä^™–ᑬ­ƒ¦ïPègž',«L|vfÞò[kb˜?“7!‹w<Э§kèôåó,ô”„•ù'7-|X ¹aÿèz¾YšÙG¡KtªÕC+výfh›ô)¡œ’™Êš†úšJ?UF ÕÀeÝ.y,¼GkñÝ™&üò)±ˆ!’Øé-Ú™É7A˜ëå¾|ù%]OVtåÀCkå¤÷ïó*Ûk5º¿‚‚÷,çž3vin½Ýávókâµ{Gý4yì@š¢ñ”¨­ Œ2ß…œ´N{¾a5û ª.?wãèš™#úïÐå<{N»7ºS½ST Ì „Ýùþí•ãkYµdPï<¨Ó¡•‘~óN-ïdsòÚ±yÓgÚS¨ÕÎ÷ì¥ ê<€JyÏåc[OÑ/­Œ6mÏÌž6."­ÍÑ[—×,˜?|L2Žœe8xÍùOc€¯tíæ’Q7ëjÄçÎõKßõ´jÝ¥1b¿ 7ï²}Òµ±}[Þ?¡Çª]› ÷ òåüöÁçëN%ÍñÆýuuWAß9;:>už0õøѵ}$IAª˜ú/ó_5ëZ>(Ï|÷+Xîaû}P„S{I/­^kÎÍð$tˆ[?5®¶?AÕä÷íå5z¾³9Z êãr¥ ÆuÄ$w—¹[— V~“¶,ê]§"Õa »bë¦Ñ“ô9Nó¶tû‘!›Gt?pÜþ{ëSJ‡ÀyãV\˜2¶ë½Œ°…Ô¨R=hˆòvnœZ2wñ¸Ã™4¾˜Ž‹¾ÖÙF¹놧þµ*¯ÂÂC·ûÅZ±uÑæœ ¶¢nHÄ‚;ý|é¤Ú‹ßuº¿½My¥‡Lµo£–„Á&—ç¿\WDúô_²d¤ãŸHðcÜ¢ù—†¯¨m²9c‡I–ðå·<¼nÏ”4¤’ Gmý–6mXSµõœ5›*zÝgòÌÝûFµ¯'È« ˆœ¿¯Sò™²MóýeøŨâ{Šmhº#"ÔJ£†£5~*‰bR:BÂ{<Ûr>íãåt)M×õ¯ Þvœ–tccw©…“ú¤~×(Ö ¾£ÿ½ ü æ$«×C æ×ÚRõ»«÷—DÆ:•êè“h¿aG?¿ú'‰RÚ¯[_JYñD×%iÚÁ1}´‰‹žô·˜%â¶9ßnuV¾¹Ð±ÆznÀŸ ¦O×¢dSÕ!„ütH¥ê÷ §ä' ªúG©3øÓ%)É«ßÉRCE½l¹WW†éüó¢æ/S?^µü*©×†Åˆ´Ú š"M뱆)h&Qctš„tƒ$Ñ•öÿÏÜx ‹K3i¤»£% ªHrTNê§ü aýÕCQªúm ÔYtô#ü i ÁOÜ¢RÊÖÝv 3ã_¿xº`ÃëÙû—üMç Õ-°ÔlþÀÖgcÓ)•ˆ´ñiìÓ3!ÊâÒÖàgºLûv­iug¢i Š|??h¼pc-icªêÕÓ—o®o»)ê¦Cþù3©¿$nþ] 2jMÇ„®dc¦ÿÇÀùKo¼©âŠÂ*§¡ûfwÓýMýpÿÈŽKÓ\ïÒAùïep†¬†MËßc.Š^N™¹A^¦¾M(g|êÈ™ßd&„›V®E§3Gf³°)Áÿª1õ/‚¥ôÿwø‰•ø?Ú¹þŒþ?äðÿù(á'^†ßb.$ôÿ!{æ7›¡šá¿nL‰Åø»Ç·Ù¦žfš¬h«Hzõ¬TÉÀÆHñáÓ×½¨ÂÄI¹õD$QÐñ´1Š}ôœ¢°Öˆ­)#ïâiÏú.½+žÜ}ÎgÐê4@‰Œ¬¼Œ8Ÿ¼4±p2T•êP ’üôNÃÌÛΠø[~2J¦¬´äh@D±1ñf^^ZLé{HfÒÇôìBå”4Ú˜·WfU“®ðó›ål/»vüì7Ki¤>îZ¦VíôTj[ã•å>}óÙÖÙ]õ7ìF™/žgkù8¿ìþ“·–ö.ªru˜¡òÛ‹§ß4}ÿym@øåõˬҪ¶¶îÚJÌßfiÔñv7¥7çÕ£TU?g“¿ªìWq骾N&M åOþ³â‘’~rÂÐó†/ŽúÿcÃÃûÑ«^˜ Üڿͼ9³6_ˆã<:={Ë-=] O²Zù{Z†Úµ£Lˆ4‚YM# YD¶©‡¤¸É^9ijEkS-ö÷¨DŠÏï½ØÕÄB6ñÀšYÄÿqô$ñ´U¾;6n×Æ«× ÀçÇgfo¹iÚªÅçddå”PËÏß 4aïãÜ 3<~â¯Ò€[y‹t¿™Å•WR•…¢’²²bᬽgÃm´àÓ¹í³>jÇXRõùƶ-¯LR¼¬ÌE-#%€ž#IŠ›òô×sæ®Ø{1¦ ëoÈq’ýpýÔs_œÌÅ‹—­ÚÖ¾®¸É‹Û8õ„ïëSCþaõšdÝŠî5ÿ¸‹‡ËHÇqS}ø/.Rþüp—¨¼;g¦4‘Ü%Ï·NÚcÿþüè¿“¢g›'íwywnDhI>¬~à´qŒ_›ÿSÚ ",O¹þÑÊ£ág)J^»­óQš?]ÒAˆº<‘gÉ:€°ØP ÀRhqàø~™;Ñ®CGÅG÷p¸ì·èèhk©Æ©H½ÖÙBÊ^6<úȳÎþS6Ù®›àÀ[4{¹]Ä.ßêKtÈ’3Þ¾g¬¸%Š»utDÔªMÛ§5:÷›ÆôºWîpêâ =Y@çÕÑÙC"{Ó¯Ät•ðÞ*{Í<åü´PÏÐakŽumõC‡´uXï”ôG®z§×*íïÞ¹ÑÇBãç¯ X ú)ù‰×(+稴߶:ª.ñ=w—~Þ/¥pô P}ýŠ4dBÒ1SÒ2äUéÒ›G±#â)Öð ¾&î nGuÇðCç—ø˹‡c…ßÖ;ö«áN/³˜`€¼KýÝû̱y÷4©ôõó/ÞÓ×ñ.–÷íÃKÏ GV "1W¯>peU¹E¹z¶=Vmœ¡O‡œG‡ÆÍßšÃÐP•‘›1Ávà”7oßW‚¬S+û­IKÛyøSê& £Ú9\ Å(ÐëãS+O(JúÕÆÕðöADP^³lJÐÐEwûÞåíþD%¸xgØö‘ +‰D¡D¢Úy‘Î1„¼ÛÛyÀãÈÁ:·ò¹y_Þ+Xܹaì©a–{×>X ®·(42Ñç㱩©7·M:RÌT&Ueš>«£*IÜ™*z×ÁgÈ® ÷\Z(¾:¶xÚšó,½J­ûÐnžï÷vŽx9TçöÇ|nÞ—÷ò–·m« Àù|iÒìõŸ+d ’¦c=oÙb'#%ñºØ;„ÍJy}—оæô›5¾«-~?ŠÆÔs'~!äózö Ÿ°êDÖ^Ÿœ9£¾j„Åšò-fפ‡ ˆ"ƒW¦ÒÖ#jå’VªLÀòUÓFž~”¦£©ÞÂ#²üÙrÝ=+úëyyùôè7úí»7‚²´Œ*Ýe "oß/€ÊOiå£ööpÐ q§7Fm?)RÐ(Î)sî;aí¤n06ÜŠØ-|¹Š ѧϩƒÎê•qbé¤]w(!«G÷QÇŽÒŸš»|gC[TÜÆ¿ï¦Å£e !N¯˜uš®k¬¤j8<„c„èÐð;áÃLž|Èå|ý æ¹aõ(€üG&.Ý—%’e ÊåMœ–F­´Ðb!g·ÍÛzô°d¹2S—Fu·3h ®¯¹0†qøØSEêøú»/<”WR(È…NX6§¯ýõYa×Ë)Å¥c9íœ?ê÷ô¤ÿJ.?Äü¡Ž›ÞTç2+‰ë`i}î³ñ]”“Uûéûß!"bb¨¹Õ‰l¤„9aÎçRªë¯™Úgé‘Tôêè>#ú¡8iÜ`O[ÿQDDnÜŸóµYÇjsŒ=>±Ì+°Oü×”äZHJ*(åJ¦LÛÕÝ>lËËF0ÿÚÎfÅý$‰úÉIiy’9ÌžìëäÚÝÝÝ+&ý{Zº¸“˼ƒ” ¿ãòbõP«nó+ï{´sºÕ µÞó¨¡6=æÖϸ†ø`÷·nù"|5Âyàü:ÙÞ8É!NÎ$ ¤¢žÿþš›»Gb‘?èêàp?ˆHåwö´:ò´<óùA7—ÐL."…È/éíç±ùZ<òÒú†t~-ž)áÌŽž#>FÄÏÇúÙô:€ˆXôÁÙÕãiZ9fÜ°¶ò<•&BD¬ühï`Ós_=Otup¸—&î· ³§Õá¸b¬úÖÉÁyö ñŒã¥ÙÝ-»/!R"^D7Ïþ‹ÅßÓŽÌ°™ jßïý©ÕÞÝG‰¿\X×Õݫ˧JqêÄì]ºm{”)þiAßÁ;n"bòñ!v®C³ñõΡÎö6K$"¯¸S Wð´ýâÂ#¬üGV "âÉÙƒ;OZˆ¢”CŽ¼®V'KÌîm>áä7Dœ>,Уë1bù·6Yùõ­ ¯nÞyÀVDÄ»íœv¾æ "båÂ.öÝ7¾EDÌŽµ³ñ8œX…ˆÈKëäädÕm{=Š%èïbo{éS""VEÚ.?ñ%#z†¯¹– .³ª_HŸ¨ãˆXþb•½]ø'"bîÕ¹ím|C̾žÙ!ŠoëÞ€í ¥•…"ˆBŠâ_F÷Õù`ä†Ìž{b}1À—·ñ,-ÕÐl@–ÑÒ®jTCŠäÉúy›É " ÛÁ åûOO¡¼ãÄ©©AmË ó²²²ìY…xzíEƒ!ÍX€ZAKß>Ý«[C©ŒGу×ÅåˆÊßnu»½U\FȯÕ6"@Š%«R‹$ÖÛ Ò ªIïÜÜܪû Ê+h%UP\VÊb¨0é5k«O¤P–Òl+_}+u”Y…•e¼-“Fz•ã७È.L©¤k?>ôµª9Ÿ£zyÊ•Þ:;EÏ´›,  á|ʧ¥lඩæÔ²²BKÿ›”Pæÿ#'SRÒÀüd»Önçµþ¨ð co]Ù¸aöžâÚ¾2tÂçZAN~ù9½òEÀ¬ç»ù3tñønj|«OöN;\hópng®WŠïä¾¾UjÄœb›»W÷‘&Ê8ë0Üøz!©×^ÒBàù›‡Z:}ÿcN³#—„*™d½ñз±Gý óéÕ‹_‹Ïݼi$p+ñ é…2,–â x )Ï.mü„¸0™r8!K¬üUpùl¥ÆoÑÓ™Šª*LPDú[µ$Ë{wç\|Öá+1m•î§ÝxŒ@W`c9ªu‹x‚&iÑ”ƒžsNMìÔ„Âu@EŽ®hpkÇÂzߢ,ŠªªÎ¶D "»Túåª"!€xƒ,åå4eù™ON>OÜ|6ÀÓùcŠ€®-¯*ø ]Á">ÎZ½z×ôé‹.÷]Ú€¥)K9,¾ºÑK¹NOÂâß\Üüb¾–Š2MÀ/ä ¡IySh¢âÛÄRÀV÷ØËÍ6÷ë ¦œ‰’ïsB1 û(Ãレþ‹³³µÅÚÝÛ´ç*°´2·ç—î™0g¹«vÕÅ_Wi=xÝþíAõE.ªyôꮼ¡·žÞž¶_ââÌÂ, –jJ„;]³ýæH«aÃ{ƆuS«üzåƃ±+Oküå'×ô[Ù!oó”™‹= © ·ßþ1ÒlЪã›/ŒZ°2*lÆ ñ/íôùgc¸:FM}ôJ»÷ÆðKÁ;÷òu-ŽtçMɲK×-/¯®b˜Ÿymάoƒ¦¯œãÓ'8Ô/À²Þß~úyøîËÎ*ö!½5–Eöìåííöü‘igsr»!ÅL=þníï›wùÉgåƒû¼• “M/Ÿ=m®_Ù‹W,ÑaèÊ+ëO¶œ4j—õåÐÎá ®æº/?4¶¢‹|«Q¹4Úwû£ë¡1Cܹ½ÆvÌNƒ ¡}_9·ýúøfl²ò‰˜`ȶ`P7®Ìxå±xòàßP»ùõK öôq?èñÁÀÏztéR· 4å]:ûÂ5/ñïÌI{ýìsiÇ@ofCÅH˜}õò3a¸CÅN½5"Éž'¦åðE ¨¦kël¯Â¨¶ªrÞ>|Z,æm/áþ-¿yåfïn&ÊRô/nQÆÍGo¼C•Ù¤$ùÞ½dÝ03”ðέ«ºí¼Ú)‚(çõùÇ)-½»Ù¨WÇqp¾½y™$¤+Øyú(TÅܸ-P1uÕʹ•bÐÍÏxÅnº›Ý¹«O½˜©‚¤·O“˃ýÝiÒÞßüXÚ&Ƚ…øŽ27ûã矅4y#eÞƒ79rFAÖeéï¼þJ±5¼:zÎêíb~lnÝ7n´²õk­#ˆoïݪÐ4s³0€²„¸{yÌ.^öˆH€ûæñãÔ¼2º¬²•“«‘*€<½4œÚkpÒNßL ê¨@C”ÆܼW"d{tÔƒO/&fSÎÌÊ©­Ju4T>¾{?·T ×ÞÑQ#ëÜ f× KIŠ%Ÿê~ªã£Ý÷ï½âÓäm¼üŒ”è„Ÿ—xçid-Ýü[ª‰ߺ^BÓöu"‚¢Ç±OóÊùjúfîm 'íþõÏZáíÞK”ÛÚ·RAa\ìÓìRžŒ’¶‹§«*Uœx=ö#Q1 ö´þ?sŽ…‚ŠôgÛ«‰?ãõ³FDüÓÑë.êf¥¤¦¦f %ZA·4--­ø¯j¼T°VBÀ¨ï?øŽ!p”sŽÁʾ@&pÈŸ“5ˆÁ C@@Z|ú©ß€jò£¿¿³«ø'>àw›ZØGˆo¬”ÜßÚwÒ!DÄÄMmœ†–ü°bÁÓãN.}#‡Ç&”üF. +?^ ê³^Ðä÷g:Øù ™¹­²ük[X¾»¯¤ÿ©>7ôŠ¾ÿµÆ OIõÖcÉ“pg'gо]}×ß/¤Oé7xñ!,KõsµôMÔXûü’äN¾n»÷Ùv>õ¯ÐfÕxÏÁ+ž5¼ sq¹¯ûˆëˆX·/|Ôž?ƒ‡¿, }ÿ#ˆˆ˜ÝÇÚÎÅÉ1î›P’¶õrssÛz/ñGÍôSC´ ǃ—ð½EdG/ĸÌx‚4qÝ>äýù¦–öÀVQôÃ;‹µWΰÁ%4ï6HÐ0xÎþÎÔ÷­%‚‰k Ƨ—Þq//õp|gZŸëî‹!¥oŽ tqótwq8}]føG¢Æ9ÙÙùùwZzèÉ„~Nã6¾ „M3ð›ÿôlTD®Žv®³¢og>>8¬O?WÇ~³v Å×£„ÅG×L÷t÷ðñp î=þÞ—RBù¼ÇÀ®GÂýèa=Cü<üúLMª¤¾_ÐoÑѪ¬³~Þß”ÕÍ?‚‚«{–xºúøx{ø„í¸ü–rl˜Ç©|ˆß0ÊÏÓۯϊ%èç9ÿ@UúyÑÈî®îž^®ûNˆK+#€0öÄÆξÞ>^î¾=ÝûB9?Öë\‘hï¬þ}f®g1˜ W79{¯;t%)·:: ”¼}äÕ `ë®=õs¾ÞÌš´3oojL9;756Bí jm=åšäK%//zu™.bS‘~^3÷&gŸécÚïð¡Eýl½ÃJ” çíü=œ]<<\œ» šù2‹/Îgóàð2O›^Þ×\8½±«ó€Óbr²Föðöt±wí¸ýÒ;1[œ_ìæ0äê×]cÇÿa_`@çÔ*Rð)ftw/owç>ãW¦r !äÝ‘e­ÊT]i@dÈ’¯y| i¡ãC®í¹,?Ó $÷Î… ½6ÚÕ«–pr_Ú˜µ¸šÈ­óÊD[BW8„@÷`­D+Á@B`À"`µÛåõ1Ðc!`ç!à1aLêQ]ž¥ ÷! ~š*ÅE6h»Ü„@ÇGÁJ¯º–e<Ϭö"Zzl ˆ¬< „æ!FàÛ ž”CÒS>ݬk‘1 ä#ŒèD¦þ/?dS·Ì^ ¶phÀžÕÕ]Oc¦Oôß3¦N®è6ï …ˆÜW!žþ=<¾ ñÝáþ®c®á§f®ƒÅÆÔÞ}"ÄÆÔçMVVö½gßâŸ`¶:¾ž‚˜py³g§â ŠÛÛÃÝ=C㲸ˆˆü‚>þ~‹/ˆSˆf‡ Ý|ónL²µî–ÀCDŒ[áho3s÷DÄwK­;X.¼’‡ˆøe·•uçÉgÄYzu°Þ–D!âñ¥‘þ½& 1þü*ßü*f·´²íº4VŒÓ¾›€EÏñîž1=Ö4´k’nÎwq MªDD> t±:ú´Q´¾‹û˜Óo‘ó퇣Ï"âù¡ŽÖˆ³m`æ…iváë)Äœç›\œÞ‰3IÜ °·8ÏEª¬Ÿ·Ç¾‡ÉßUfnö晃½=\ÃG/ÿ”SÎ"ò_x·w‹-¯Å¥j¡¯ÅÄeuSvPˆÔ—»ç.¿È¬Gj^^œ§½W±(f´££ç¶›ÕùA– ÇJ c÷#šFI1¦Ò mKd3Fxìb*2“Å å> …u- @†&VðÿcÆXÛ—¾>Ê£ èÁ]š™W¸žðcV€èö±„#]Aô]‚Š(‰%/ —­ 9Ï •Ÿ(I­@$¢P Ÿ™CÁÎF—ˆÈP;påú‚.„U%¥e!íd>Í .F?59£- ÀyòNs•Ú~IÛnlˆ&@k7õ*zŸéÝÀÈÉ°êã×r€ÒÛ×úÍØ ¾#Ø>l¨QQÑÝo@@@ÓY>Ó]¼kÚ™–ÅÇS" (A ž5 8¿é¢á¨õâ„ 4U;ÝØç„R"E _CªøýS±ûT¿Ëª''Æž^±ßhüKU¢áåÝÖäñ;@ €Šjì¶Î¸¨}ׯ]YØÃdÁ aó/·„OÉ*~Ñe)ËbyQÕwjVŸ<’Ö>];ÙéK˜-B!Š#HãR¦=ZˆËL_wlßò¡Àç”–”Z¶4*(ÉÞ9ùLÕ78HѸӬþ­jîë Àȼ³¥ ¢‘w“òâs_Ê$YE„(ª~×–FËzùPü=xÚÑ«ë@¥E‡ðP&­þí;†,KN"ˆ›Èù»ÙÇ< i×n Æ´’(¬Ö½»ž½Ž1ÕÒ”@k[°0©Ö„ô ¡$>œMÈ/^&˜„‰ûï|xÐz&lçÁ”6ÕD+{_‹A»ÄnÿNðñ Àƒ¹ÀAk{`k{hÛ,Í€(EU€¤@I<»Aj.¤\B¯K‚ŠDßY€#S`Ó€© öö GÀ¾;$%Á‘õ,X@#x™¹Ùpu¨åCߎ dØo.V iò‚šç€^|ÏÏAöß|ëé—úF0µ²ª*=_ʃظxc»u3fСàˆl[×´o Ê•<à AŽY×"áR4„Ñ!°á*Xë°ÁÙ¦­„p3H!Ð]â±ø”Ć¹/@FZþðRXbœ¹ B€ €°ú„€Q“oÒ¸õ¿î»ù%qCt-½HÙ›bîËŸÜ#ÛjÊü2ðAn{ Ð3Öù;w×aBJ’m¾üdÃÙNºtx>¯ëär ²L(Ôæ"_ؘ#°Èe xCߤY÷sækÕ¦² UÊ}wusQ†Ùèðir-¦­Þ?m5õîþ…»£#rßœªÂ¦—œ]ç^÷í½ï™€€ˆ“öéí¾õÜN¥œ|»º¶R[ru ¿fƒKKñZÎ{—'×¥•ü¯RšVãòÍZ¿1:hùƒÉ¾êyön¾€ “ðEßÉË/çÖ®jŠ_ûœž¨’O”dU™Õ[¹­Þwq5–=8|Ûo¨Ûº4VZßÚKFµ.1Ûô W\½áyyÑÑ=ÆNýň]:»ÚÁ½xŽMÈ·Öš¢µ^ù­=÷Þi[FÐiE­ü:p9…@)é¨Ñ„›^•3iÀv3%o¦T/Ԫ&7idÕž}ÿà«š³¡ÊØ;Ï…ÔŸÅT)ÈMñé±X@$(ä>))q4i#uÄDĉ½|² RH,½ºm^¬úùö;`uöUy}µúèñeì“"^ÍÉA"(ûÐ1bÚ&ë›Þº°vö0m±,Õnc©ûôÔ ˆ„Ç^ý¢Ñ2ÌÑà쬩v5bnI…‚…º¸øÙÇÏeè@ìZʧ}Λgé—ïÕp³8%¦úð°ìëKž¼oké ˆŸ{ñüMPòì6bÅÜHÁë3e”t>AÏ1«º3ë¢M ‰ì~kýŽ·¹J~-~"Õ(Mèj pဈ`ÐàÜj@àÁÔX±$ P&ðä(Tw–ƒ@¹ Èÿð EîÐ ®çÃÄÅðð 4à@">šÛÀW †U«ã+€@Q:œ:·?×y iÝÇBU 8õJsááip0 ÃáÑ»¦¬è>©Z×»rÎ^!õ/Þ«øuC®EðД¡«dÝ)M¶ãÒ…'C®&u§\MN5õùÕÍ›Šû¸ÿzD§†¾ˆ WFmòkɼ|ùÆ îÆSöÜù@ÏÛ(G¼Í‹„¿ßøe]ºu4,U9¬ä›7VôŒöäà‚½.y8±8Y—/\0b¬Ö IDATë¿S…_®GO;òêè¾­ò IKˆ»6¢[n¿ý«:i×qº…pÿ§ÑsM«ºz·(aHäôqκ7ùÉ3ï8°:Y‚‚=@Æz¤Æ#gŸ@MXUàÛ’_°ÔààL‹55h©‰_´!.~¬Í+ñ«pøX´äA|"€Ã38m{‡ÀãÕ¥æ gûZÂÁ—w¡×0Yɳ%eÁ‚MЯ+˜Ö×\|÷ƒéE82.Ͳ °ÓkéßJT¡<hÿ–¸¡/Z´è×Ü7L9ney`@€©ž*0Š4í";Y±@Ä-¥Ô=],éˆíl-Iyq*ÚÛ™ó@Óõƒx± ¸å, ‡º’2HÄçR²NöVtn9SÝÂÉR—ÒdÕûøµÏJK+äÊô›åê¤FåqdœÝCBÝZe¥§—Öœõóã/GÓMÂýmÔATU‚ºžÎí袲¡µ§‹€[V¢iéa®ÉTзÔÕ¡0=)§ˆÓʵÇÚ•cè¿„§àîjË&b|*(Åv.6†¦2¼ÒrŒ•£“ªÌ÷øt†¼îà¾~•™)©¹e&.7.¥LC PU^¡ÕÁÁ\W )‡Çtpq’§ÑÌ;l§Yß2Ëx`ã±|l(A¤ËhôB 2ÓsŠ”[:.߸¼ `ùu4/Ï/%C'«öªJ´úþBjmz÷ð,ËýÆcj÷™¼tˆ—‰ÔGxʲo—õó¬«PÂJ.ÝÁÅY‘(¬¬dš¸;´¤"ÒC=8ùß² ¹×uh/W–žÍ·r êîS”™’WN‹\´\%á`\¥÷À œ’ÂvAãú´­|ù1MË–ˆµÚµ3"(fdæµ0k/)M/Cc•ÊÜ¢rd(7kÙZ[™`YæÇ UÓvFjMc ‰~vsCy¹{ÄÈ-OÛwsâ}zÄA«Ãç¶|A&°n˜ÿ‘ÊŽîv¯ç‚ñ©S{t€à}\AœVæn]›½{Ê%6ÇÎlÒ=ïÙc¯µk'½—÷oˆ5ÜN_qëä‰RuóÌ)®~öÒ­œ+ö4#ˆ@òïràÜ…³[ y&ñäQÒ¾>f—ìªÒ >ºw&”¿ &0îêÕUýæù;j~sO, f€d׈˜ÛA¿gU¿˜ŸÓÜÆ:ÿÑ"´8’ºÃ˜ (-NèÃeµ´íjüôæ}‰Uÿë¿&À«Œ:éà磔uGß”Íl`¬nŸ7 Ó|ûÖq] ïÇ X}öò©Åg¢_Ý©0¿Kï–â7[Ž>sàB3åÚœ¤]^Ÿ˜rnÏésPv5vÀú‘–Ò´ÖQ–jy›ÿ¸Ùoý‘d;CYÙûÐè$Y³Ý-š=ºx­¼UܵƒÏìùyèíuþÚÂåbSEfG¯5bAYÚ‘¾Cî]¸·éþq‹ßEk•?ˆŠpwi÷½tÓc×v*á‘qqG6_žéÜ4šèŸ£ ’fÝprðº“+DD”— èî¼öv&柷t ÎÈ°âåòEë³Ø#¢Y^c®”!âÇÓëÝBû)*‘s÷ïü­'{½¾GÜ(E¢´dïÎßËD2Üu³ðy-GDñ8?óÉÇ‹éç‡ç‡‡L8O!¦Œô L˜¨(UxÃÙÖóV‰ÿ˜è7l7»(-zìáâ|ý‘ª,),­ªôqoKO7ç/9"¢¸0ÂÇeíé׈ÈÏ8¿xéoáôš )%MÃê×+é¨Qe|Ÿ+Sù°sæÔiÓ¦M›6yêÜ"]Ý ì[S;½ÖÕFˆª3*Db(½¿2¼WòÍLqû.æ–]èÐAJZ)£ÔÕØ <5 @d®ˆ÷uqssss軾~Ov0””hSMÿ­¡‘ó†ŒZ^%âUÖ¾bšÌD‘YX"`5Óa)Š£™)å Õº˜« Ë yxëùó¶^=úùž½–Ü—7ÀЫ¹ª‚ ¶ùR[SÈuýÛ|7zºY¥”B‚IÝÁEÈÑGÙVOéyU=+¦vçù¿’KÅüÂ=cÆóíßÕPÙÐjɶ£r©˜—{?"vÖùÀsazµÆ¬ià˜3+¶½ñ¸‡×Œê·0¤å¹¶@W¡ÔU— f¢*h÷ˉ%®ì¯Û » 8™Rø•[!o®¥ \3óp×q[–'ÐK48ƒ­ÃbVV ¨,ûXL˜„’´ñ@HªÌê÷ь˄’?ÝYC¢²xïQ½ÛKMyy—N£èš­u$™ù°T@yfeª£,³þ­ø©ùÅò#¦¨°ãáúŠ§^ÚzVZÊÌ&ýn¢ÿì¡]7fQéÁ'%@€È z:Ù,¿‘YS™¤Õûᯎ¬º.Qò(¸{hÙ˜_“¥¬Õ²½…2Æõ])“—ž¢µÛvÔ™@JƒeÉÄ, ìÇz¿eΩ'¼¸¾öŠHûÓË“ Põâú;5݈Žê꾶ÖÌW[ŠsÆ'yU òÞ=ÿP(øºù¤äøë2=­*wéØ€¡Á”óùŠ™Ê¡™ -“€ªv{uå[·Þѳ„UGߪ° e`ØÌÐÐа™¾&¨ëè ò_@àεËì?=}Ë`¶ÒWï6`Ѩ.ñƒ×4fŸäÀŽ³}µq©€`髧Uå6æÄ?Éóì{Ÿ+¹y¨°Z·Ò}¿éÌu“àÁ¬oY:,J{ñ.¯ªi4ÑO?»!v¿¯ˆ1-äˆf YY^K›øîm¡àX"EÄ añÛúÎé›ÝV©º%m——¸``Jûmszøn<8ÓÝoŸ™‰NAN¦¡µOÏ.úª:^›“ç»ûï03ÖÌÍÊ6u l£ L‹îfÒÁ®6½æìëfÒ%XW²[à2ƱJE.nÑÖ660ÚÄTýÝ«®!ºj°1tÔÒËÃƹõêÚZ/+-½­{RGc5ÉŽ¡Ñ©áG¯MéV»ROj™¼eD”D[7÷Å3më~1=ZÀð…ýãÇ$FßvdWåu¼5´jÄÁi=uvX:°Ç˜%ý®îm¯"(ŽOt:±²D \wõ{fÞ–aSÞHrXÍÛJªRD¹XòåŠ9”K%R X,¥™CR6œ ïµè˜×ÜîX'3%KdÐ}ð ÇÇÉ~QLÔ>¼É·ì³:ÌJôð§÷5ŒšÆ`8µÐ_s!}ÅlÅI3Uÿx,Ö:¯×ØâåëtúíßNDD"/ïã¹ü`¬ƒ ýÞùûtZ»i|·z•7ò R}< ëTû“ˆXÿÚ¤Z-màH0Ö?¦Øà±aE"Ò¡6ø57t'(’k#êdn@P@H-öj3ÿÕ»jgEqÙËÁG`ÿ0«¦1ÐD?»«øë1Eê@?5<ÿ:¾©ª±D¬c//þ@uóµkñ{Wé"ÔÖ 2IÈ×W¬’FÛ\¯Ùå©I$tõ pSûµuIͨ•¡.8©ƒ„^·xšžíYëצi4ÑO¿˜úǦ^„@Ññ€°®®õšÃ;tkÙF‘/Ë›úïÇ]&ø—Ã*4ÑÿÌb굧5°Ñ5ÉM£¥‰š¨ÉÜ4Q5QÕ§¿$¹.̿ɬ}œ ÖÎó¯ZEáÏ5þ‰p~n ÔmD]A|×59ßDJúï1Œ¾â°® ú·íýÓ>l°_¿þæ†Rõ|€C7{ŸÞøoB™$„ÈÎ2²Ú8œ !„¬ã<)ÿMË9BIð5›¸õÝÆ5¼{p‡G×’±Ý¸sH1ùëúÝz(ú{šýñÑíJ€Á²W6VviUdíhûI7êv!vë·ëQ"ÿVÓ!…‡ú9M<ÖP&BÒ¶sÉý(ê̼ÐÅΧ\B¶ŒOèÔÙfÝ[Ù—!’Š«ÎfíݼÆI°QÕÜ=ÁÆqð¥oi&”V:v9ñ^BPz}ÿ g[k—ÀÞ¿ßüLÁŸÉÜ`ý›Ó6ÔÉM(GL{|õ€6ùêSˆß‘¢¸ë 1áø=‰õØ«ûi¯?%Š>cªêh«}Ûꫨii¨²ú(‚õåT¿Á ‰õ›_Ìš¡ÙÀñO„©¨ê÷+ŸW&uiLªØ x«&¦)´FYGK“|S8ØˆÖ 6Ô• S&¯©üöçúŸô†åI¬›øKíö#óñ™–IhkMPQÓÒPSªÿ¢NËÒS ™øM­ïÜ›9<¦[mö¾äo[’~ÏT…Ù@5¬¨XGC <{ô¼Mçp-6(«ª5kvQQqÓW €@BÈ«ƒ#û,{ž}ïÀ€¸ÈØ^CŽ¿æBè(“s;õ‰î3lúãR:îàòîåýâ{Æ÷IÚ3ABEÏúÆE?ΗB²Ž wŠ¾Õ›jvr̯çò‰„;¤ìí×ï~Òsðú÷„I-„pÞ]M7èø[AÍíÄ„O©û†&ôì?{Ãq‰b{ !e/N$ˆî5hëÙ§„º†@^¹oÙ´¸Øžý’&ÝøX©*H í=J(Îœ=¬wdlŸ5G_"Û5odxTìôµ'¥P[Tò,elbTtÌè9ë¹ÂËîݻׇÌWSDŒß“E)yyaDÿØØ^I©¹²ëFL\sÌ·þd&!DühYpòYÅ˱b¢¢z¯9þˆæêäÚi11±É)»%ÜG‘ÑËdü1}z}@áøèž)÷9À „•KÆŒî?kã)ZGWô›°+í·£ÂÆí¥Åwí·Uýã{Æ' Ù{=̓â'§Æ îÓ³gìÈ+ŠEH€ˆË>õŠIâ2ó‡„GlHCà¿_:eXtÏž CÆ_|_^÷cKP.38æÂë²Sk¦DGG'ŽYð™Wm)Ey›~Ó3fИ9¯‹Ä€ñä~±/åÒÉÑ=çÜÈ'ï¯ýÞªßP:8“AàÑ¡U q=Œœõª!}.(.¹œ"„#ËûMÚ“ñìèêÞ1‘½ŒMÍ‘B Vä]®9[4_ÚÇoÞ%nMFö¡ÑAI»±ìVHì° E@^õÛòéñ±=ûxýC<‘2vò¦S´ö–_Û5< !Hˆìסk_ àÙÝs{÷§‘ Ì:Y sæTÈ"²ÿÞKK/oJa8ˆœ—·rƨ¸˜ž}Çž}^JO`Ï­8dÉC$„dŸ î3IŽ… ÇôˆŒ±æPÉÏ»ð«VL>‡9~»­! M]ûëh©}ú”õ“-¦˜ÒÜÌφoëÞwtH7mŠ÷*Ô'¾´µßŒ™Sƒ:cü£–ƒÍ°…žFzöKçŒV'p}Ãø> N?uâà¢csbfì"l&?ÿí•_–Ý2|DK]•Œ[;½ãæt 0Àl~/ÿýï%„0%¹Ÿ_³;lÜÂ_{ì_6|Xï$¿Q«SF~8¸hëÝ,B/÷†§ÿ`¶]ÏY3';ëdúùöûÈ'@¨¼ÜÜ_Æm°ˆ•àf%ãúÍ4öIœ<®Ïõ}v\[R ¤0‡S%–RUÁ«\4cÙâY}®/H\~OHÙ3³÷Ê«œaã&E[IÆŒMÉ+-c0TÇ ñÔ†Ï[8 «& °€3³ßøƒÆ%E¥í›|,D"γ3›sš{OpìH_t­|ÀØicƒÏÏŒžuô%!„ûþw¿~‹;… š2y¼«îçÀàä,­–3“œ…ýñ‹—G6+‹ èSÑÆÊÔ©‰a6‹â=wÞ/«GYTR²á—Ù•ñ+–/¶¡³„B¨¬¾~á¯4§LŸë 1,4øb`%'G‰yÊC~Yh­P~üTÕðSÂ*|ºãTQó‘ãÆ»•&†Ä ä åeçÒƒY ,||iªÄrÁòÕ}Ý5§ÆE g?—°Ý[jªš;µ¾»c“é‹*–ozlßÓ+²s d@Ê&Eœ®h3vÊôAA%øï{'öuÖ¸”úóWžVV¥ï}, ÀòÛ yh'€Â«7Y‰AºtkÙÍ»ôÒãýö$PrúYy÷M…JÊ?&xù}6t;iÊ àö‹F^*”@'/¿DÀç~z:dÐÊîƒg­Z4Žsjш?2!Â}{> í€v Ó&Gµ¥CÜ(I¥H$066ú;‡?@œ¶ön›Þ”Ó¿nNëá”|¼æáüa£G”íÖ{åQD¤äÜX/«-·+ª‹_°µ z'C|½¸kÏT¡"yQŒEÿ_?Wcßäø;»ŸzW‚ˆ/~OpqOâ"RRbn˜Ÿóîk¹‚Ï·œÜ»¿/•"E!JûeÊö[i‚7gì<ür«+”¾\bé0ŠS—÷»â,ã«þ%í¸ðLsCý=¦î¿¥¸%íñ‚ŽÝÇÔŃ¡îÿi7hCõ-a’‰¾æ±³n#Š}Íœ*@Š¢( +n9Yx\(“#â‚(ó!»rèü¹/ÏL›·'ûR]ÆÞñá“j~>üm˜{Ør1"]¶²ñ¼\&C¤‹l†ŸÊ¤óœì±å>"áà=ûn cCÂ=—|‚üLw÷…W>Љ·¦9ŽØYÍmn_gó~óï#âÈ8ç¹ûÒ‘z6§«yÈkDgãÄq3n VöíÞuõJ¤( ñöæ6žq%bÙióÐOô 3÷vµð8Q-ÖÛkC\ú¢_5^J!…Xõኃ{Ï•Õ—¨½]ai—T†(,Kòªår¹LZéÒõð"Ê3·ÛZ÷-D•¿òvt¾žGcaYAa•HV÷;a|x÷é;®!R…Ô‹U\«_,²é·¡&×¾”Øè{ä"÷’“yà;(í÷n‰tÕ›§ÅM¢èZÄéþö®Û_aú]{–Ê÷Î Ž›+£åSúÌÁÅóQo¯ŒÞð+ž³÷ ÌçË‘ÿù¦“{÷¥ÌÙ"t\ ?OŒp YŠøÆß"à-""ŽŠò\²w‹Ï¨óbá…µ.ÑÃäHIŸ¬°MÙ5}`⌃•X-¡‘•®LôþûÓG—ø…MSˆ"΋ço‘’ËqWŒEü¾tD<8×7hB*…ˆyÇÌ-=/pZðrWŒ}Ü^ ‹;¹ûæVÊj®¤(DJ°{¼o@Ò.)âßt÷ÝæÇ`;Ò§“…çˆ5Z]Ÿ?﹌B $³ªT_øÉ,LãòXO­Î»D€S¤­Ä¹šAukw¶Q¡¿Z¹/ÒÒ{æÎ%ˆÈ`ÈÙ ¼•É ëlˆhâ¢@a0 ™œ*)Î`1Ôµ5”Q©ÏÜ¥ðúüee"Ý°p.›@ÈÊ4$/ÞT‚»Ö÷˜^y'cShôú2ù½4I{{ V; ýl KË)T sh4{Z]mT*R? œ8Ï?1zx˜ÒF½…eÈbK¨]ù­çmŠŸ2o®œB Œªb>©¼W)d©µS¡s±”aÝJáEÒP™P Pqå©œms2eîE9"!P)`¼Ë˦>Zé €ìîG™y@‹ê A k—_7I·S;Po`©°A*ifQ¹Z M Nî]${>|- JÕØYWQµ²¶‘òP®ÜƒA€äçg²µeÙ<ËѾyÁ/ﶌŸ8ü…Œ dl™TµîÙVÖêÐQ{z¬Gó.îƒ%†ºub Ö°¢d&†-WSaÈ¥R€óÚ¬góçÍ•Q„QôIÆ“>AèW›í›Ÿ´7sPLé)©FkzÚ ìf¶Ò‡+?· IDATY¼Á–uÞ¢ÜÂÐoa)D©œ¨:z°0é„hÙt·-9œÆc£ÿêÑQ½€6ú,à)fw^p´›2w®ƒ_ÊcTÞ+ƒ)Þ–ÅÜ—ÌuÊùȱ˜ëkuj÷&xóé붂 SEN‰m÷÷Ö4à ciê×uÝQrÓ%(ÊZC± ‰3hN ð  %“’®>aÆŠ•LXX´zË5k™§eõ¼ŒRE"µ¶5b(i††©3é$mUô}Vûj‹ƒÁü ŒXŠJ Æ—âŠH"ƒÁT Ó0˜ J$CJŽ@µx¯ûb QøCDX¨âð 6!iO3”v ¿½7Tšé›J)a;ónm4Ý<h@Åñkek‡u41ªð&Wµá’Š+²8¬6íº´h×Å'rÀò!QgNœ ·H¨Yû76Ü»°OqØ–ÝJ(æW1Õ5 (v}€ü§Ï”çlÖShƒ)Î{ Ð V¼©Pòn¡þgc<»þ¨yÕjïu›€‰*kG¿~®rZÜå†Sm]ÅnfÚ«2j÷¯PÆTU&àlg¿ðâ‰s;3#㌬åÒï=Íh·ÕV $iŸsšOvÒ¨;àƒ&„nœrïVÑ-÷©‡ÔkÙ‘»Ó­l½»¶Vl1d1¾'6üK§Ë/µQxÅţ¢ÔbÖ¯Öÿæ‹Qÿš¸ÿÙ“áÌŒ}ry<^EɇAQž)êÎÀ™†¾Ý,÷­M)åñxUUöÎp‰Yñ3Áýâ^oú¾€Ããñ2îò ’ÏoÌ hvìf«Bfnä *²ïàu-œØòÉëNT ø¼*ΉYQ®}×h;™1/ ¸ùo’ïcj°Ks Är`(k(IŠÓ9Ò‚'cbîf•WVVq9Eieå&&m¨;[æÿ²çVcc<¦MÔº½~ÅåÏU<›=!¾û°Õ°ÕØòª÷¹üÒ›[³:‡Ú(Õ‹g–æÞ¼ù¹ˆÏ¼|–(±o?»ÝÞ·=e €*zí;5 u´õÔªk‰»&&¶ù|uÂ<ž€W´<±G蔋 cë¤Süaç+]ÇvàÖÇíÀÆ5wcîíÍUŽ}ÌÈWî4ÌqfÁmÝÉžzµ“;›êçdUòøüªÝ)+Xíµ92Å67ÁìSwµ»ykÑëp{÷„*qÓ{Ùp8œòòr‡ÃI~2sƒ”@(¤ª#ØÆaÇ,¹¹t€¯_XßY1 ¤ôîR‘P$‘Ñß–‘k÷LóR‰ðòóó]ùHçÌéÚ@IBq͇˥÷œm3§ô öññµöî–cçìMÔ€’‰¢/‹R‘P(•SÀÐ[wú˜GÕIÿ="†.µê`ŒC ÃõçNyVžòñò Œ¼©Ó/uïH ®ÌÙ½csWš]GLNh9<À-0¼ÿ‹6“»µb E" RyµºQ¾€ºðÎÕ K¤Àì’¼}IüŽ!>~=S “†ùé ù<H\¸m†¿v| ¯¯oÀE±ý±}ë•€ ‚ç€k“»ˆêîžÝaÔ±Í}™œÏ/Ï]»!G%ë¨^™àççÒŸ´ìÌR?(…5«C±@(­Þ&“‹"©šY 8¼eòžIq>>¾qÉ&o;›èiH …B…ôðSqœ±ašÇÜH÷€ˆAKãì5h=‹„z FIBqÍ‘J„"± ¬ÝlVvÚË/`ЬcÓçŒâ‹äˆš>ÃcšÏí1éH:9_(Â/.‘P$™DD×@€è­9sÊ_r1ØÇË/ ü²J|êþqÐwóÁ®i«=<¼‡/9³èèþÑ~–›&ÆïÏ0ŽwÁ$o·9‡6ö^?"Ò×Ï7(fp—þËg%ºàçÏ>ú¬P‘P*£jV|@³ÇÑ“[rw%ûùùD'یڵc¼=5÷± ­çFôÒÇÛú‹;±¼ÄØgvþÁyA~=F­¿?çÁÖZ,@© ºiµš£Px&d^¿Tmòåô>CmFŒéíÏ\ú'ÒËz@¹@ D@P²Üá€æõy~~>Áý(¿Åç–@`uLèÈÍ­4êØF4Íãʾñpè Ý»úfdäH™D,–Hi#æÕÃMÏØÁ€I;¼$B‘Ì̘æÎöõ ï•l3{É̉üëÓÇì¡$‰$r” õ{êÒ¡›m;Z2K+É•ƒ…ùÇC}}ä7ëàÝ¿+ÌôÇ–kc²ß2_MÓje©žÃý N=Ж†2½¤¯s{õ÷‡|³Eõ iNLí϶·_»Fp|¾F¢i¤9õq|hoO}þI]NjÁ×Ô–Vƒ AµÐsJÀI+ :›Ðæ÷²Î<³i`ËúÒ£¥Z {§,ï³T£}smÞÍn¿Ü~på7•Z«ÊÆà{ê^zß„Øè$¾ž.Õkf-f !} _÷BCÚX¯ò:ÿÖAªû´‚©µønD?눺Žf~‘_lu²N‘?[úÔîc¬ÕSu˜i¸C¾Õÿ¼ï†ÔñØ5Œ2Sïÿoe©þ÷ÛõÔmùvæ¯|eЈ¡i¨Eµ!i¤ï4=&¶k¼þÆù¨÷¤þOh¸\=Ù6&Ïo €Qq­ÈÂ>«·‡tÐ*z²ïø§ÖÛ{·l@zup‚€\9éPVëõ “UA¸yÃa ‡¾*uU•4èf&¤1§~ã-þ³®ûfÛ뼾ᤱ^ø³ž¬‹ET¿1 (Õí´Æô¢Ž ëkwÙêC‘ïZCl~¯¾£êvvÓD?;!"!ÜwW¦ÌYý±D ßÆ~΢k•?ÿh!ó›f¬þ㮘¨yö™2Ô¯ 裉šÌMý©á ßLø¾rMƦ‰šÌM5Qý»èw¦h#Å+/ÎLOÏÈÊ©S5‰€âÂܬϟÓóŠ85çÁPÊÏøœ^&’×®DÂ/ÏÎLOÏÈ*ãѱ0ˆˆ€Ò’‚œôôô¬œ|”ª9ð,p³3ÓÓÓ3 J+á¿æ@ D¹™Ÿ3óÿuF—â|Ì,ùùV %ËÌH¯Ê~HO«•PTü1£úKùú2üëõkFñ>gäPÿÉ‹(~ÑÇÌ¢ŸKC~øøCñƒÞnÎAQ þ®žÞAŸÊ¥H!J+Ƈø:ºø&$Ä8:»õ_Wq©8" > uqqq_ó’û¥–‚s!ÎŽÝ}¢z…uwvt9ø¢ŠÎ»29ÆÅŽg¯xw7Wç°1¥ôÅäy;:»ºņyº8;%¯¿ÿõ᎛Óì}§nüÛ®[æ]ÛÉo¾üãniJPèånwôAñz™=¢t@èºõ|nG÷ñ‚¿’-”VåL©ú댈8"b@AõϲÔ-îÑ#dÔ ï‚ÛxLû©4~P¼wÎ;ïçÒ¿Mðõšr ?ž›îà•\$CD”=óu±?õš‡ˆ”¼2ÌÙûн‰ö sC!%Žò¿þ"]ë“-£ì¢§!bÙ¹‰l{¿Sô!wRd·+ž R£Âœ¤SÓO.¶ê[FÕ18µº¢^·PÔWýD§lŒòH:ú¶:Ë×…(üv=EQH5¤E}m LDŠªÍoMmõ2×+Vu}\s󥆺¥¨†dAQ<¦Ú‡ ªÅiHžõëjtô5XÃ×L×£žÝú ªÍM'÷ñÂÆDÑXýÕ [Šœe7\Ü&5Ô?õªj´]i&b†M¯ªêlG— é5ëê×ù©Æ_»ú¡Å‚§¹Z†Q6&4VOØäÂsÛ³®l;Ó)ir3& ËÐÜÁDïöýû„½íÊÅXç¤f6H@.ÌûXPæG#FÙNÔ~{;•ì.vì\ÜYƒžIjw°h.ÈIG †M[2sD( b[ÇÎò*>G$íÈR3{ß )UgWñÓþV¶áOÎvµ³Øp™C€ºöÛŠ`//¯îÞ1ûR?BóáƒÏ>/!„ìÓm¬}Mq³5_x²äüí¿ u°wðõ [´ÿ^ÿ0»Ù{^a¡‹½ù¡ûÅ„œÃ±œÚ:'!.ÚßÍ!qö>!„ÎË3}ý]ܽ#’ßß[ÔÒr §òsˆß©jz¨·ïº4 „Í~yiSx@;sóè‘ËJB†GZŒ[y:º»£óèó„·k£ãü<½¼Ý]='¬< ” hýÌ¡î®îžn=‚ûŸzQJ©xzÒ3jx{úˇË;úõpïáåéæá³`ûe !µ–>„pßZXÙ\:ûGòÀ„ˆ°@çÀ>×?–@Bàöáuá>^Þ^®ž‘Û/½%„H¸™Qýj¹>~+ÞÈÀ“;O<ûy@ÂËX9©Ÿ££³ƒcòü=$„ª×†„u·w÷ úüîúÖ]"Ë ^cä8‘ú©Üü?f¥]êœ$¨þ¶Ê…iAö–©eÜþ6öëßÔL-åÇFGÏß_«\Ù`;ûšÅ”°è²›µÿ[QÍÓÊQ®R^Գʅƒ\»,º#¨gµl™â—Lç¨Ì~sôôe‰¼ÎÇó[Ù8GM>Aÿν³ÒÅ%ð]"¢¬ðš¯½åÉ÷"Djm”Çð?ž""Êø£üzô]rŒÎ`bœÇÐ%ˆ(¼?ÁÞÎmñ‘wtúÎé}úM£ÿvp¾‹_d…DŽˆgÖD»{x½¯#¢0ûž»›ë“\ ÞZ:­¼]‚ˆòÂG®®îçÒÊPô*ØÜî— yôeN°cÔº'ˆÈ/Í8vüt¥˜BÄ;«Bœ†œW´D\îë´ÿV1ò>º¹ºyØ(W,¦ÆÕ_Lñ2½ÜÝn}ªDÄ‚‡kÂÆŒ š¼)™¸O¨Ë¶ܧ{û¹8ˆ(͈pvsw¾’)EÄ’KÉÝÚ‘ÚgñS ùw‚ü‚Ã{øòåˆxks¬×„ÔÚÓŒuɱ!Ióé„{;¦»„$) ?n´²°}01÷¸µ­gâzÙ=ÈÖvé "^Ý:Î3x­¹ww¸ºº¥qdX|ÅÆÖ9dì!¸Åñá½²dˆˆ©‹cœm—úˆ‚B/—ãJ±øR’³]·}ʱ¢—§ùÚ+e(âDøxLÝ}Q^åífã?A‚ˆÙ;l­ûsªg7¶Ý솯¸BÏšGzuIÜ’ˆ“ûº,U¬@žvµM¹\HW>#о禈xë·±¡chUͺ¾ÒÕ)$WŒˆXòp‰ƒë!"÷õyg¯lZOEy‘>^—ÕŽ~tuuó¾‹þukz]âvDä¼Øäâàó¨„fên}׽υˆˆûl-{+V¢;îi´—yBzOÝA'Oëë>höI”‹FxŽX~šæy`°»Ïà*DáÍ©}fþT‹©t‹E|Qÿb7™jJLVVVÉ™ºj5u]U"ä‰ue‰¸rTUeÕ$¨h(#¯\Tí…#’±½¤>³¦»ªÖ€fe©«Fmx š¼˜Îc?Ô¤¨ðj‘媦ÑfZ DPÑ3BJ+Y7orMŒ“õ‘ad{öÄQ÷V:ïNã´7Ÿ`SÖŽ)سº@M¿MTd¨&›|kV dðØFcnKu“X#¸þ)^<>b´Æƒ+¥rqNqŠ£ƒv+‡Þøb_‰øï^”k[ö±Ðzý* €:¿ëipïn®ÝŠŸ¦Š/žÓìªÇ{ÃáHS|Šîò…(ºóèUä„Yt‚sâÃÌŒk¥"fwšo €ÐÂÆD 3û€a÷¶â·Ÿ+„g÷_p˜º†CháÒ«3âµy@…*“g+zêô®Çfcæ´bxNÙÚZýkß.ªûF:ê!€–Ž±''OÈýTÉD»"0šÏ í ’!Èer¬9ÿ" gMôADm“ªOi ·rò¡ ^=Åíb;Û—Æ—Òš¼*9o÷ªR—øåçN¯U¦$\.—ehÇTâ”UÈ@&§PRX§Ÿ¹Ê&‡O]ðëªû5çFÓšlÖ•ÿ9]pxþ.“ëíéØomßnï_8 “ íÏ;´OÕÛU¨¼çïÓC ¢]És6^>ÁG.Î,Ìç„ć"‚ÖÌXçÿØ¥þOÑF³X*–`Mh·\$§ˆ²ºš*¡x¢ýÀJ*ë±Ýc«3ˆX,`+Œ˜@Lô4Ø´Ç_Rò|ÜÐaà2yÛ´¬>+A¹±mÆÈíïW:äß’U/&¾~Ì<[ÍD0Põ:Ÿ™µy ï6E§Ì°sníÌA>ÅT™ëËT‡ÊËä…rÀ€Òm«§ˆ”/(“jë{ZÏ@•Éx7ÓQ¦ª€H´L4?4t(’BG…­£Ä 46…Ža3È)©À²t___…Í•‹«ªøùUÐLó›v¦ú#uµÆ3±bZE\|?;À`ÿæÜfŸ[dÏ€îáòö Vª€¦æÊŒô¬b”½~¬ãØ7Ìÿl¯k¯ÇkÈ`ÌíjÜmÊ7mRpæVZÇ¡¾¶Oß/ô.:[ÙæL{ö—C ²ü JsßH߃ AQ¥TåÍ Q° []KÁ “JFZ èÄ”S%Ù•ª…sƒ|ÉXÁçQÜaí””MTèTáûbF‡Všt-H´ÔuU°¬š&*5ÁÓ„ˆ2a±D®§«©ˆ~îìÖŽ:QÖ@Au#½êYS èƒE”\Í ýÆìâ*,z_«wDU•¢"ˆÞŸž4c¹Äв½‰Š¸¤ÞÙqsïÕÉï—ôLg'gߨAQ®­¾ŽXÒVaÓbd*)È ˆ_ä’½£|÷+„Âçr´Ô2ë2-ß}>Ã;r€$Ë×hÞŒÖ(PÕÔQq‹b#=EÛÍìÛÈ·•Ö©@’»sû 10°Â j¥¦ô/37ÆÆ"éC© UYP¼\Q‹V†úv¦’gé|謈Գ|qÇ®†UÂTo§¡\œÏNFôl&ûc¹nr[&H î÷‰Jj¸ye’«âø"ri}òìK“©ÇÚ«"ü9*©ž°µ•)—Åg–;×;ýåä+CI %°ýö•öu+ÖŽ'WU‹G^¼¯÷ÍmÑjRe+Ë) ƒ]cÕ”•T[X_9¸á«² ž]z`åß^‰ø&±RVçgë¾WonÄÇŽ®]|aüþ¼ç€@4Œüµ•^æÂÝÞÉóÕ:hóæìæ nYÁ2hg¤lWqÊÓJéù¡ÓZÉú¼}=W[ Ú¾ƒ>Z8j ±hÒ•‡aõË>5Ž^={UEIÏ]WƵ®›¯äj­QÉPe¡@B)¶€ EI¿ë®TÂd1@"«Î+âòá«C öQuEu%õ6Wö­ªû\8mütfܱc£Ì@œÿÄ/nÌן`·^cOöË/xhÿÎUã"˜Û/‡[|[G”tU±Û̃ë}š5¦ ”Œ÷0¿,ÙÕ €¡ÎVóÅŠ¹~µÅe3R‰L±o.®Ö×YÕ›—¯E "»»ìÿçÎø.¦Zu³"Üò§%Z*O·¬“:0èô|Ý6!==–>.)uµul¬•ÔZ77Òxxã)BòïÍk뤂qƒG´ýÇÊ$ør4‡|ú}ê”s²Ë§w´Wý¢CXËýÔ8¿¡Þ:·¶ž®‰âx˜z·\\g„«iwVS—=y ¸kä…÷Ÿ|þJQÚuéľùû‹ê”ª›WË}¯¼C‡6<.7_$%üâç4öì'g›veyy Ì%s?½Í«¢ã-kZ¡¢© ¼ H…b¡ü{üo*m ßo>òXß,R™ ÞÝ;g=Ù»ÿ!ÆY €ò€.<¾~÷•A\'†¹•Æ³=7ﱺ&ê³@;>FÿÛ™§Í@Y¯›nñéí×ßµíC›=Å+ÍÚ²n}[ýòŠ[©Ï¾/¤™«½Úõ­7«¯ÂݼtW$¯WPí<¹þ™6¬È½Ÿ_,ýžeõÖÊÊüœ\!¤~;üQ™Íø¶‰iиÛÙ´)ÎÌ)®æJÈùø®€ÀÍ,WsòïL'¾¹±‹Rà©Ÿ“qÿàåP7îÆì¢KŽZ†øhé ÜÖ¡YÇRRèCô”º‘õ„á>ó÷¦¶3tY›’B÷E1FOwÑgd]Ý3j罃{ÕPjôÓï:~“¦ß^£_9še<¸|ôvåž+Çuk¯15š/MtIœØÿeTt-áµSˆ¬F²3«Õi@ÆŒ2rxri¼SÕ‡>®²¾âi§Þ°QÕ*|ºÇ®½úûºV½¿q‘Ûü„g[%¶ÓÝÅ÷ìâ¯ZùùÌ™ ŽSöÏi¡YòúbÒÜkwh­ÍlåÚ·®]÷»¾g×ö³26ëÛãùfÊ …—Kk‡(¹·7Ûvä˜÷â« m7oÉäéZ-ÚªÓ_ÌæÁIUÁS+:y€……é®­§BW] ×> ßû±‹uüÆj[«“ŽäÂÕ7cŽ8bê’ä¥yí.l˜@¦Œ>q¨(7ÞÞ”uïü‘×”Ûåî6Êß¡7½&ÎÝ7a(çÙEÿåõS—Òô.¸;×Íã;sæ²øYU{Ûòø¬ÚLí{’¥Û6°{Ñ„‘™½ýÊ3-üDS¿ƒxY÷ IDATÙ±à—eIýþ´&‚š®ƒ';ŸŠîâ§ÌýtæÌ%×™g· ñ×ß1%I/ÞïÝ#Um¢døìÝ;5F&ééµcÉ..Y¸Ì¼S»Åó'Þ sè`\”vï|h½}éÖ¾©®+ŒêÖ°™°»µ…_L̈¡®sž\=œZ¼éüiCU%Ðo¯C>/JYÍ|s¾EÂ" …²§ ]”Tžn,ù|âôã¤]—@I3ÄÒdó¬aU}B¯ÏU©±))?%1çÎû;áˆØ¬‹·¹A‡«ÙÒvÊòÕ–,$,ÈÄx-1§BÊvIœ7Ä—ÐçÜ9/>pتš­¬Zé¨)«¨hê5ïÖµJsëèÛʲ¢ÕvÈœÖPZP®Ý¦¥‹­RMêšúvV­+*dÆ&ºÊÊŠDe¶rk[Ǫ¥Uw.\ ŒW®}[ ÊxR Wg[ SÕ°¿ FyA~I¥~'×EkS:h „FvæÆÚˆÐÜ&(ÈÞ´(7«RÌt=kˆí–â+µqshÏ€š­ìú…Û•çe–VJ:yöZ6o¨ˆL"P7²´77¢¿®<ekïh ®lî›ÐUO^RÂÕíà>oMŠ©*‘Xúö¶4€¼ü|©²Aϳx´EJ*¨;{5%PkÖÕ£“îç´÷E­ÑóçéRÂŽ–v-tY<Ú98諳e"‘r[w{3 ”^Oã÷ v³fL¾ŠYÿ8]€R3¬haça×Z Á6V’UØ»ø›·7A€æêl™f»ÁŽj‰²z3±HäÛÖP£•š„ÙÒ½€ @RUAšµu¶4@­¶Î½ƒ¬99™œ*©¹Oÿ%³ú+”„‡†îÎJ(àÉ-ÜœØR!O·««esƒƒã»ó ²ŠÊ­ìCW¬œ¨Ï@9O¢ìâl¯Æ$ˆ¨¬×9Ø©ua~žP¥õ¬•ÓîÝ®oïÖE‹/’ZÛ:i³Q&”¨¶w³kCw¶HÀk×Ù¾½©®kÏþƌҼ"nŸ!Cº­½(=П¡Ü¦}s&_(ogãd¦+¯"¦îNitB©ˆ¯gjmÝÉP,ä·îhש•6A$6þ}Ìõ¨¼üB™Šaܨ9}][!¢u-)'·°Ü2däøÞ=œ•r‹œL:5S•Ä ÛгìªJ KÊ«ÔL¬&/YcmÄA9G«“½][m@Š/B{G=uVµ^µrsìÈbëôî¦\U”W\¡ÝÎ1eÕB = «UçV*¾H¿M—>Ñ>&šÊ´;K¿K(·¶¥ù…”Vës—wÑFBìBÚ©Væ–™ºôíA̙֜®$ Ø­<:üD;áÿbN…ï{‡$IäHáÿ*Ÿ¾è âÿ ð2omÚyò¦„Y‘®Vû_Šþ¼˜LtñÐŽ{ïÛÙw&¸%­üé|Š’¥žØ}åIž">ã×1ν§þœ¬þ_8¢‰2 _êjìÿÙcË”˜/!**lÆ߆iýÏ‘´2-(d ZkKçŽú7nÜ–Z%][Ý÷ÏÀºï,ë=æx¡³—ŸVÅëÔûoFþšÚÏQÿHäO=϶ ´ó­£—3чk·_Ä,¹4ÁÏø'l{Ó‰ð&ú©Æ!Òòœ‡/Òxb¹¦©£]W¥ï@À ³d½}œ–S†L•6æv5þG3èfæ§={›QL1Ø-;wëÒRççl{“¹i¢&j¢ˆ~l#ñëÿjÁA|Ó„}ÙüÇí\-þ𯫭Þ öÌþ«©þ¾·–H(s#Åêà7ªjPzßÑ}ø]Ý‹µ%ƒõn”÷o+â÷HæÛ*úçÌþ.Óz/kp(5"ü“åU#bøFÃÿ™iÇÎnÊžFÚ°rËæ¶ÚìÚÉožû$üпo—^;³¯rÀÆáݵÿiƒ“y4xÚý?.×üKj+¼1î·-»75W¡ïM> `âî€Îõ¯XÁô#!3>°Lý?IÑ­y“ïo::2™£¦\çª@ ßêÜaIc¼†®èÓ½u5¶:}D5ñÈâ°´[»çm¾Œ”bgTE¯u¿±Ó¼;ê ‘>ï±0ñ÷Ã=têk!¤üÍåµ;}Èç²T <Âzr­õ{õÛÒÏðå£GK*ã×à´Óª„2±ÁºÃë›3)éôQýÜFíu §'-:V/_Ïl߆ùŸöÏwŽqpÿm@‚”(søqþc·Ä:jü’0ôc­ÐÚÚÂäAÍ„\ݽøàæÖe“ëÀ˿¯?zùa…˜2heÑoÔÇ–êÕ¼K7%Fe÷ܱ$ÄhïüþÞÉ .÷b{úÁÝö* É;+ÆoÚïŸÝ÷/QŸeS˜ö)£LÆŒ䙸¾§KH?Ñã¥Ñ›4ÎìÕàŒ€q†Í×¾\Ö|ãÁÕú !²ügk~ÝóôSQÖvôÕ×—‰H9²|æ‘g¤Ú¾ë¶²1cš¥ü¾ž g– 3³r$T}S¥kæÀjùmÃK€sûrÞ”_´ÿ?¸²$éÙùYL‚šqŸ§“Ðí’ ³_¼Žî úu»ˆ–Yˆó‡â«¨SëÎ;Í ÀÏýœi_^¿ü‘øK!@Ì/ÏÉãŽ7B‰HÉÊr_ÏŠ÷Šœµ{JOk@avFO^ÿ3Gˆx×ôÄgóz îå¬+©*¹±kÂÞ½Ö6o´nÆDBDåÅYù åðð˜J)2õ`×ÚÍƇ˜Ëd”œhk@J’ûäqÕà®l鳊¬Ì¢c“õ”¾p!ª† SŸ¹Îç|‡LÿýðâD$D´>i@ñ°hG#€ª¢ìlâߧ¿©”™˜÷ìâþ ßk‡/ïk§Uœâœ&~2ÌÏ}8rðÈB}טÀ`=UFiÖ«äP7û~³6MŠ¡a˜Ks2ò+e`ë«n.%é׎ËVšœ‰ÈälÓÆÇ¿8/K`öW©OqA6“+†’{ÿvFõ?Q” 8=GÔè4AI-:2F Gƒº³mÕóÖ‘c:ÈdÅÐU'@ÜØï»ï½ßùü'{æì™Ý3;3; l`ÀggþÞÍÔ¸ìÛ—JŽ@NAµ‹žŒ¾;üÙÐËA¤ñÙßò¿sxS¹“~g5^ ëKIµIWcª¨äyŸr˜†Z*²•%¥•uQU5u5UjJ ʨ]»tÆNEN~¹I7y*ë󎺑2CÀ©Ì/,m€‚ª¦¾¶j£Šò?}®ãƒ’º¶n'¥–5.0"ª¾”4²Fg EQƒ:Va!«–ÂP4좕÷ñ“v—®Š²šn.Ž²Tq’ûªç‡9vÓŒ¨ l¨úVPÒÀ'èrJ:ºrÀ úîΪÔFú5%ùE•lªœ²‘¾ZnÎWƒnÝähA}e~aiŸ 3•tõue)€1 vöñùF*lL€Ù/osz[%¿×Ä Ó ¿¸âå®X‘02*ÝDž"^Ø…¡£F©ÒDj‹·aí÷ˆãÉ }­Úÿ ôxgDÜ]^òãÛ¶²bM'`jèâIÃ"Wlº–°DbyÓökÏmÏ2rðð*I«æERu ò0–æé¥Çh«ÂÓ—¯‹éï¿4å݈q=TÞ^Úq¼Hóò¾qT,.ð×ÙÊeØH Ñ×ÛÛÏ‹Óß~Q§S³Û]óA}lh0KgÚ_‡æ"q]”±Ó=lŒYbé¾nH‹åÔËet/xôíöÙ*†·—ÏÏÏ|Aõ·• fº2_>𪚎¾–²&¸Ÿr>©vWeˆETä”ZÝ ”1]PðÃRér:zúò2H¢ðÕÞÉE©“ˆ5DÑ×/U>SU[³CK/¢É÷1_X“²ù}·¾ž.Í‚ìñ‰yIO#OßžØCA4‚'O ºeYBòÎÌìd8bÔh±&ëíÇ|ï¶j÷­áq¾ÿ¹âq1Òçfµ~7eöÓ÷…þkÏsí’}>"ônÀ£$¨Ë˜9ÉRáæº=GRG®Ø5ÄßHHuóŒBP3Å×ç«@ÉÊPåé«îóv¬v©šsèêe+5DprB'Œ{ö¥É£ÕScRÍÝUyù·ŸõÛ”2¹êØ„C_Þ¼OKœ²éÜø½©á–Še ÆNõsBýÜÛuf½‰m_SÕ—nsûž?KÿrÁwZÆãûG}ù+~LôÉnöÎêåÏ…­ž?ÈJºzÙ½ðrŸÃ3sèc¢ôâþmÜi๣14 *~•%Pꦥ(Óá@` hÎÆ-7'­¾?I>q!Ñ?,f´VÛsX¢ºBÖ–ZœÔB6€|» áÃÏxÇ4ÉÑjýš»¡ iÕK†ýì_ßý—WðäŽ'Œ ÜŽlö›<Öùüªù‹N‡\¸×I–‚q»µVä¬,”_¾ÿˆ¡k»Ò†ó8éT±á¹³s‘Hp"Œ©¦¾S.nÛ]?h‡Üï© /cÇïÒFÏÔ8†ÿæ|òõÚø{WûÊAtd°MàÞÿž îÏqž²17pL–U­áäÐ=ûÑ–FŸŒ”µÍ OP9gòȈ³Sv¾¶ÌcÙ5¶óðìw÷ŒûêÐ(¿¸é¿™š¨ÙyˆhAŒÐ‚ÝWqó)Âlí×G}ë__ÿƒ7S ¨ßwã• ;È=9ÓwQlЃxñü½‡€[4|W‚§9ô¡¾ðÞ—5Ä5^³'Oë …¾cŒºwq !÷¸ûĘ)~§ƒ´çmN-8Ð ^ØPÜyÊp=X?õDŸ6ôe@í—;—²+: @_º"C <ɺk8îÒ±¬pË~ü¯ÙÙrÌujëCW뎊NŽ‘ûEçÎH5@•¹ÅþçO ×€ô8ÿe3×{¦­“˜þ©Û"À*ìÆNÈMß¹dÂ]çvÇj¹þyjÝ0xt|ù‚­j,Ô<ø™¹ÓTóõ™ýÕ¦}nß (;z4ƒ# ÃxøPR/Ÿm‡:@êö¹YϨ Yf楟••tª²1·öÚ7Ž 2º3‡ëŠºmÞ߇zêPY4ÏÂêk×òvxˆ¦x·‘÷ëqV]ïä¡¢‹m_¼óv+n”½{Ó ¯¯£,ƒ¬{ ¶ÅÆì=9È¡WÏž=&NÓÒMPøîCý€u΢‹‡ [~"›Ø[4ìݵöÀév={öìè'R­ï_|ë}оijÐiQšSBrâÈ«j"!‡BgP)-D!&Øi—.2)°°èCæþ«çÄFK7qù•§·©('Ïn-÷§æ@ÅÇ÷lº®¾zg©T !q‡…"äK&e¡êèkr2ËÌÖÛ­’—÷R)Ÿù¼Ú›)ûÞê¾:F[Ús9d®Ô Ã`¶‚ã'X¸ºª@§¾3'©Þ:•RRYi6Æú^¶­²áP+J>!DëÑEd4§ù:ðkæ×ó@V¹ƒb¨žõõòÅ B @ðÞe^:Q¡q0Ø þ~cñ¿ Ý ª² UÜ?Š"Æaó Õ+Ò(HÔ5ñ/{sŠ×kº!øElŠšM¬R7¾i'Ë uìõ8—ëByõ@(ÌJ0°øD‚Iüæý›÷UTÕò4ãO%;é)ôã´$ùÑb#v–’C¼V' êÛÜ2(|vEgÔNÕ$ÿpÏ’º#EO³¼FèòÊ+HFF‡×"›U/c¤@…©Ø• MqÕA¦,nã‰|ó"MÑ~†ÀÒ÷fšÉÊ¥1+O%T°êÜC7¬Þ_â,Wm WN]^¬I1T°E»‰é—»¯\¾&:¥²¼Œ=tîæUAÎÔÊkilËÛº.L!ØMŽœÛÆvÓøí/[:9Ì~ÉuåKÓ–ÆI\ÐèHB˜¨»s3N HUÇìlÆ&鳊¢­ªL-Ê.Kƒ–‘bß>—ÓHO'ÒJIúuEÎ>D…ÖÔE¹ˆEzŒö¶@•¾>û祂ÇWM ˆ9çíî­GkšøÅïŸ\/W$…ÑsüÚx?g,=‚ͨ³bm‹Àl¹rJÊ‹ètY9*Àï;»Hù#[ 7M_ÓU»Ï”ÄùªÞzù¦ßòÝÀËI6fgOÏiã[**в’…íõñ¸uèTq-gyMÅ_-ð@×Õg>þš˜¢‡$+\KÌiNEþô›E×|dfìXù‡cê_7XXÅŠ·û¼òz¾ŠºüvçàÕÑsç‰|²æĭºfcLSÔr×RIúZ“v†¡í£¯"žy¾sR|ÿàqyï.,™á~õáÞ®£¹ ‡³R]\üº0>|yûêjåÔ+F,UJæ'a=[ö €[W…Aaˆ[_‰±ª\‹õ«j¤Âû\À†îÊü—Wg6U‹=µ¼Úº¶Õgœ{⟠ªXÍèd¹nï)!ŸË)|0ÊwyÚˆ´QÍ •”e9¥µš€1pʪ•"’&Ìζ÷Ÿò¹œo·‡ûE¥¼ax1MËÎBNlRé(Ð!8²*ü£®ß%ÏÎÔA1}§nî»°œX •ÑZ·M…Úú)ŽCÙî&æ73’a̲¦ ð€PnâžOê}ŽtÿÙÙqÿÔ}ïÍÛ~"þûuдÍãw_2·P[ütAðÄþSTeÄÌ·ëÑ«¥ãLZ-qÐ9LcEȺ;ìWù¦Úá€Ð³'™Ý¢þöÔ ¹ µáܭ΋j—-.Š‚=+OhØ»d Ôàí½ÁUBPÍå¢ (}W„(ª¿Ö«Á#ŽÚUɦN‡¦üºså]¹äµS°†©Kܶ…­’ÿnê×MgˆhˆM|(ÓGûwVé°büða¹‰9ªã{(`Ïé._nÎã Tý0®»éðl! ›ï|ëÚ¿Žgz,–@‚¼¹ã¦Þ-Dg0ŒÍL.G fÜ]–ÿaÇ¥\kkgêÈñi—÷=S´ê¯N¦é»¶‹YYú4$4²¨^2‚ÂuIïDÝÎ<ž$4öÕ¦C]Éçë÷¸B 7È×öõŽÕ €Ð«”Èž¶“+AÃÁ^åQÂqÑç!ýx|멹y©¢û8c€ÒöFGn¸T†¢a7U4´Hh¤Ó½‡âä+"R§'3híb|TT\šø®®&* hRÎ>α².N£ èLz{æVTr}ã–TöÚ„•T·[írñä~s_«Ï¤¤#NV¡•í—ÍBNΈ>PÊïü_¤&Lßu3`þ•Ÿ‹ÞƒÚ»gKLÆ›Ð$BSŠj³gq$a8ÛNcì8>|0óóô ך»(µë€(4J«dŽLǵ‹ÜS#|]{%þWº{yàÑ®ñ[<(ûjB€ÁmDÿòüç'6°Ÿ>N)ÐGnõ†`6p«GIˆÎ&B!¾õ¶°cÎÒi¿"0gïé毡QÏ Ø"¦e]Þ5'z¿¹C_‘¢Û3Úÿð«Ú@ÀÅô1Â^~ âs-sÃΙ2„€Ç§_#¸¼æ¸Lð¹<á·‡÷kUutdi¢ðFÝ‘|nNçꢥ!_Ìf„ØÝ@Îyé’¾Çv,h†S½:GzÛÉê˜+àªOå´ {µ€©ï«ÍÛù¾a²³>(»M*^8EkhcögÌÛËݯwוý’Wêè®-G%xÜzE³akÆÈàò/%4ãÇ&S¾?M¿úì­›7²00xÃ…gsêÈó+κ3Iª¾¬H _;Ä'U Ué:zbüYôV\.Ê9sE®W%ŒaÐÐIa«]†0Ö’/È/0ìïåa €³…\žxõO›6cùÚácOªrKläñ.Ž9àÈÜõ.W÷k2¿}+4:ftgöáEÁëº7i~BÌÝçç”$iïÃ|Ëa wÍ··âä¤å‡­E.{À>ãOò?z=> <OŠVN€ wQ?'™FšHAﯴ“Šºî)§ããã={om 2ÛÐɨ§ç²óŸÏÿg²ÿZTq»Û¼fgˆ¤[DìØRQ“ÔsÛn ÚÐiOõÇ-ô?Qn5ñMTZ=´_M ¯G[²RÚ”¿uñ Ý~<ÍNŸÙ¶t¯Š¸g’ ˆü û±ÎÿuÉ@íEÇJçUG£‚%9¨Ý!“Ê©LhÞñBËQnꛤ㼆´7šG¯9Oc+²R†£õõö¾ÔMíÛ¡Ùæu:Þ´v0 m&^ãÏÒmoÔà'ö½Ð1—Ú¹¯uoÿ-ۧ߱™BíÇP4¥ô•xQ¦vooó²M^»–tÚc I²Hò‘’¾¿v»í…´GV"!qþØÉ+Egß;%Ý6Yæ;‹¤ÒGŽÇÎ 52ÿº¬ÀTW““i‡?àUG£‚ÚIÓ‹à'Ù!• ¨•ÚÝDAâýP«/ᶵUï;biÛëí΄¤Òlù:¸ÃnïÞVÄ[Îý-uÔZì6ð‘Â¥ö°Uoÿãä‰ðŸÚ +s—GE¥¿*Sað8rF¬Þ9ÎVù×Hñ‹^,ŠZy/—­B­ªö˜¿nçèîr$“ÿSPtÍ#$AV¶õÞJ¨hzâÀê ‚AÍÿ)˵hQŒß— õÏÕT ÅÍß+q~Nÿ¿“ú¡Oâçß3æOþë’‡‘↠ÿѶ©Ò¿)ý?ú5”–âGZr”6íp{YHpãe)lÄíe×iËÿV‰xZ\m§1þ÷ðJÚÔøQ’¤¸‘Ô”*|¾ÏÚÒ¢zt Üðò?m³PÿåѫϬßòÊÕ—Tì¢ÚZ¦‰k´,'ÕKX 1Æ(ïÑÙ Q®6vvVNî+÷¥ ÅÕAëÎn‹r¶±±µ¶ö›µê]`@UŸ2çjgï`çem¿îi-ƘûõÎ@+§È½ ,úÝ©k¦]ðäh_—þOKøã¼këúظ¿«Á‹‹kÃ-IDAT˜ÿ}œãص¢zõ5󇹹/>1.yº½¯“óõÏŒqõËÄþ¶=½¬—d6!môÚÆKLhÈ®ï tP5‚ 0®Y6¸OLúWLâ¿?ÒðÚžãÃÂE!ÞÇïäl˜5ÖÍ„ úëú…!¾>Þ¦„]}U.²"!™‡×Œñó š¿±„]à;öYaBèÕñ™ã7d½ûk÷ÏQãf,ÎãUï¯óô7ýö·ÚÆPôèì®Éc½}ý'í¾üBUfDŒ¼\÷íöŒñ^^ÞöÞÈAe.óÜü´âÞÑÕf-&0††¼¸¨YÞÞÞcCÏ<ÉG!„n™ç¹GÒ‰)zÄëk‡¦Mðõññ _½¯ŒBu™+íitøó’ÖÌõòò ‹9T›Žn—…ù Þ÷˜åªÝf®Œn€AÍy¢×ü«©øjÆ­ÁSW+Æ|ÃB…yÙOªE§v½Ò؃ŠÃŸKœ¯,ÛÒPÅB+.¥oœâ(:oÕ„»{·hxÆÙiÒ0†.fwÓ¦ß}KTs¬¼=âæ Œ׬p,½u» ò›päü½ƒŒä0ÆJƆjŸ²^ „*Âü†z\‡Zø„ C¼Sî欟5Öí„öÑØ%þ¾Þã§Ì½ö¶z¾{‘Ï‚mH¤#a$,}íã7îEQýÇË >Sç5ØlEQ“h­ô‰Á#‚d#„ï‹J[<+‡Kî¨ÈÍԿ𠊪ʣ[㕇yƒ {Œûðïƒ#Gêè^&@e&/œ¿çIÀìÈ£ Wå•”ˆbJ1Qóíî–k¬®·o®òf|`؆sŸ#×m÷ÑóùŠB”Åãžü¶tQØÄg[§ÌÚ“4jmiVrLâûy«ãÖ,ò=½À?ñÀ"xµ2ÍzÐÄèù3)ˆâ韫î¶8jé&†\}¥ä5´õ4U[-‹‚ÓÓâ2ýB"¢…[2†ø,!ˆúòüâ*@ÓôÑ)¹Š‘Ë–ùÙ3ÂânÈ‹k§Ò´ôº¨1)€A½ÏØ?ÿðjÊÌ›ÿ6_Ù¶7ÀÇÜ|†m_M±‹JÁ¬·RÕ¥õ_•„´M\q]f4m]\õåÛ,ÇŠ›Ï….ÃÍ@`AeºhÊÞÿò¢ÞuñÒ¥Ú©²3se{X*˜yÏ‹ÛC´¿Ä©©¬Ò22ª–^Ufë¼(•G¶Ä+ m P±ÈkÈ…JÃð%ËgúXn zàÛvL¿ü´+Ox¢¸øuUN3ê$'£¨ªÛY[$¼ê««dÔõ>>»sáÂÅû¯òšÌ4ªº]tÕ"KSw€zeúÍÜ¿yoGâÀßà·GÂ/9dćD0Õº˜i2¢Pt{;‡ú Æc.åϤsf˜ £Ã”£ Ó‹ŽÓ½vì’Õì wm } ùc쓤 \£ˆ‰ôU«œ-aÙAÙ×BNU­Kö‘è Bˆwnùø2Ýé“ûi`Œ)/Û­¬Q¨º}\B}c€üÓ˯ ­_­ [Má«© ã&§-c¹lWâ§C3º@fÊq-ï#*4Pqï&¦R[^_ühæ’l5&¥àã*l3óüÖ`Y@žîölì$¢1\5Õ2³_‡ïF®ORÜü@ØP¨ìå¡Sšþ6Ôyîx¼ÈI¾^gsqœ¤¬£ôÔˆ~ÓjDgj„Šzõ|€ïï ƒœµE_9Ã!áßѳ…ñ"†êÛ§œwÏÎ'/Ú¼‚?#ötp_•¶í1Æ êvæzZnnÎÃôÔ‰ƒÝt܃ÎÄÎjn@0¦P‘8]„ôóY ;B|+œ.Þ\¦¯ ÊX¡«.[YP XVôÔºO¥4=¦¾2³¢¢]ÙlN%U&CZp—ª‘RÃÇrè‹ò,?–zVJb—Юˆ'¾Ä8ëj¤ŒË5 T4ÏÃë[9©©“ÐcÆ0•J5!€`v2òõö4FõOBT5 èôw«[•ÏÔ¤¤ÉYÛYÐ[èHc }“F&UÃÔCEx#§¼IÜ4 ´œ"ƒ÷G.NÒvóS¦b>_Ú/FÍÇyúv.¦z*JŠr´’Û_©€ “;ûcƒhU}C”ŸõŸË+R( ýî6ÖÖÖ6666ÆݺkÑ;öËŠt€º/…µšÝ\†MJ›3Hÿ¯Ã$N 6k ªøkUÕܪ÷”ðUl¯¸t$£^BO’Ó‘cÔ–– E:Éû‡_i2ÙÐ%ŒÍ)ËÏ \ÖW ˆô €.¦¦ô§W?ˆÝÜߟ= o3¦s?ão¯r`÷ðè{ªÓ¥ ¥ÁƒÔ3“ïŠí!νʺ~æ¦PpsKäÙï{O¦¸©4›Ö-òô¨s]qvý$yÀÐ|V²±·ÒYge¬RQ+°°¶±±¶¶¶¶±êeffa!KÅ ÝgŠ^ÕþU©2íNnUm !NjâþÌ2ñ©[ö›dÒ‰Ùò›¸¼¼©Jì ÅÍoBO•ï_>—ÔÔÖÖT',Û"g¢\‘ý¹˜Î#,Ÿm‰*®¨f×ìÙ´™ú“ä0–Ó6í§¥²:î@E]]MUùµ ½ÇÅð¥KD:…Z\RXWSKTÜ?È35‡UU]]UUñþ[a'ýîøËõãÛS2Z¯ão™5uöÆc5ÕÕÕÕUT+˜H, ù.Õ%©­­©(ÉÙzûƒØRŒj“·oº›ÇCêŸÆ®N¥îˆ›SÃb±Xå,«¼ªLôôÌH^ò²UUU¶>f«¾Õ`S&UÁ}®óéøè ¥å•ù“î+]°5ˆÐÀ®f±Ê«Ë«µåu,«Ž'€¾A+—zô©ººâÚîeDÏ¡.]på›ñ‹ÎEn\cL«f±ÊËËËY¬ !‚§ÃoÖ^9ÕÅb•——³X¬êº@;9>63ÛÁf³€É]óïýqøieMm]Mñ–`÷ R1 ªÏB¿;»v>x«4)À „Š_ÝÚ¶ïŸÀò¬·§—L Í-*«ª®¼¼-ú]e’½1ÎLÚšx¯H|F oç6˜wéL.ÎÿAü^¿zá‹ý¶–îŸÚ f ô°‹NzÕ“Á=3ÕÖÁiÀè ŒœªÒ×gíìgyŠ…¬ø¹þŽŽŽ#½ÿòÒ©ëãü:Œñ‹$+ŸD!ÆãêoçmÌG|bŒ1!¨ac|ò#1&øœ›ç»ö¶wrê3miB1Gˆ1®½5Ó¨_4¯±‘N37ÜŘ(¿ŸÐÏÎÒÕkVA>=ä9ÐÑÑÉÉuèêä >Æ7"}ì×·~ ~Mâš?Üú8899Œxš_‡1®N›nà¶JÔ@P›»8`¨­½“×ôèÒ·{»ZM¨ÂãBO ƒµ7k0&.ÍÝËÆ^v®ƒƒë…cœs'ÙÃÕÑÖÞeᎠÜÆP!§8>b’£ƒ½ûè)ײ+DOm ²Ýlgggoooï}K¨RõùÖÔQýmìœ&El-ãð1Æ…R¬mí$iaîúBˆ· íÑò²mК£cŒK|Lãn×´>á¤Ñv+¿jºÂ-ÿ´*Ô¯·“So—A«Ýà Qì 6ß­Ý ¨ä¦–YÉ1îÞl1ÆöÕÝKú÷v°³u¶>¿–+b[ì`Ó‘›ÅsCÈ­ôèpø^©´àÿ½øâF"ü‹Þ¦£È½š’/9…|Ñß¼ü½]\ß—q±DnñB"í1x’í8n°ñ¶ï³"6ÿ08Q’¦Ô°B¢U(\‡ZþO´ …”ÖùvŸ/ýM‰úqnñäÄÜŽ†Oúø­M-;ßN Œ«?_}¥Ht‰•¹Îz@DEGì"ñߊ_0càÕ|ý^ÕŽa…Æ4ÐÑèÀ. R“шñôÒ–ûó·íZ£Í„Ô}äõ¨Ó›õ¶¸«ev@ÐAR”ÿK¦‘J_vó”óHï6Îkö ©4[÷âGZ‘mÇZŽ~ŠÄÞ´"ü¥~s»vhð‚“m•ûZçoÑêý­‡ Ç Ððuîü3K¤«ò˜üÿ~épʇ=ö“)ʵ6­4h¸=8µò_Ù×B/NoŠNH«æSm†NŠ]2‰†Éi÷ÿŽDyÜÐZqh®=ü·¥V ñ7‰›ŽÀ¿˜¼å7¦•!ñßhFl•Ð“)nH AâW@!Y@‚ RÜ A‚7$H AŠ$H↠¤¸!A‚ RÜ A‚7$H AŠ$H↠¤¸!A‚ RÜ A‚7$H AŠ$Hü‡âÿ¾KÜs&ˆ ×IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/icmp_type.png0000644000000000000000000004624613051004444021715 00000000000000‰PNG  IHDRz\ï@éXsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ2wS5¤ IDATxÚì}u@ÔÍóðìÝ!`¨`€¢ÀÑ¥‚b¡"*!*¨`wbwv¡Ýbw‚ˆ” Hw\~æýã<ÚÇçy~Ï÷eþQ>·1;;;;³;3Kš  š  þy 5‘  š  šÄM4A4‰›&h‚&h‚&qÓMÐM⦠š  šÄM4A4A“¸i‚&h‚&qÓMÐMÐ$nš  š IÜ4A4A“¸i‚&h‚&h7MÐMÐ$nš  š  þEqSZŽ¿dŽ2 üC­/ü \« üVØØÐêêÿÇo•ÿ•¡D­êµ¾àÏjÕú%Rÿû)œI¬ƒ#ëŸA¬N̺˜°!&ÁÆЫšÓÆ™ä7&øo(nɹjØŇC!s,"UXX†Õꓢ󣌽·ýDý_áPBHÅ·—‘½¬­¬-­l†OY[*BÈ‚o ++k°4ïx?K”iWÏ$‘² !vÅtrSQ‘Ù¥«´¼•••¤ª••Íž/›ZZ5§¼œ×]»ÛsDHð¥CG³Lb;!ž|9mÒÙ¢Š¯¤ïl{¥œüψ›Ê öoœm”7VŠ¢…埜§òjü&âWð„øÏ€XPàåØýÒÇÒ«+ǯ¾]znùמÑB —ï;nÇUDêˆÅE!âÝã=üÃ¥H—Þrîh}6ãGADv­iü[AU==sêØãq™l[’’øìåã«*‹ËÒÂz[ ߊˆÈNt±uèfáýž/%b¹·ÅÛâJz ‹}ìÖ»Øó¨j8œì?ì»÷*üÔØ×… ±cÙˆÝYõ%ecˆçü#ˆ˜zo«sÏ ¡X,;~YÜß^j7t*"Vþ€ÿ0H{h Ÿ[C­Ì"7´g€Hëåè°íib²‡©Õ…BÙ‚…C¬Mw'#RRâ #ý¿pEõàÊw·êù<›_Ÿ)qíYO€7D@gêݲÈÃH£a—~øX{ÿå³>]ô® ¹îô„® #"÷"€Ø¨Õ·¤C|‚€¢g®«š· d©Í$ Pœ¦êÖ³UÁœCOë+U“I¤MB ÔÙ " ’g—¬»…ù|DøvÇcÐd¦M êקϠ]·Ò¨5C]^+­"Þ†i–~÷_5¦ˆàm/‡þÚþSÖ®]îJ÷u‘‡²D%ñS‡Í»^>ÕƳGï¹ú1JÙeënë»*z¨ÝšÉöbè´qïžöÊ?ªQÅß 8@È·Ñn=ó:]±b¹=ÿœkàJ1€HÌy|r¾ŽOôî›òWõê3N§ï´ýÛ—¤Ä/:”VlNùÖ¥ ÍG/Ø»s“qò6¿ù7d犮b&'Ÿ¶lËùr2ääi ÎÖ&’ñÓåêÒØAyÎáÃÉ»Çm;ü)ÓÎ(;D$Ù‰Š*?e|•~WPdHÿà•\´LþƆÏxµK_X¶ÌhÌR¦®¯¹qö¥ÄLò ‡ šñ²%AÛ&‡K¸¹ú4z5ñ3g:„”¼ßÑ;lwðÌeë×­ÔI;»˜ î÷‡«.ämÚµ?f€IÔð! ×Â@PqðI _?^+c«·RdÔÙ ¢Â¶«–Lìw`jo¯~Ã×N¬‘/£óÛV_}›I§Ó@ÓÌ¥­Ž¢¤ŒB5â«Ð+‡úpÃv´œÞA‹ŽP%@iËg($í~_„¡Ón”æ·¯*€ pöì¹îNÃ|ª /:S¡Þs½:AX±àÐúÔM‘w³Ä5g¬N&ù’ó_÷t Ðí;eíÚ5a.ÄÇmd> ‹¿§=5íêÔ•;vnŽ9=µßùTšS—{»–€ô$àùóùžýÌþõÌŒ_ÔnèíŽÜ¹§§«. £[®è‘’#Ö£Wý\päáûç™j€á¶­Ã}§/tm)!¤[À—.¦¤,_IYËòuµŸ}õô«=CX`2·|Â2¨kàÌ2m‰@¬ š¿îÒÇŤ9@ó¡DgÞ” 3VBÙôòïal€@&®žrÄ}í·9îúR¬04Ïî]±|íÖeÏ>i>Íñô¬GòlS´å:qÕ‚ãé~{%–@™Zf‡Æµº+y݉rˆÐع’¼*5ÒÊ¡²%˜»÷F_K="ää-Ò¶¼Ò>¿³™Äî””çg>zù™ è:.Næt ’ßÔ´t Z+RÏÙBY‰€ÎÇ; ôðõv6Ú·*üyñÞAŠ®{÷Á•ù¿ nfa¡«Œì\vI!G(B9"kv¢Pì“U:UïÝÖOf-™|YiÝuô’¡^–JÎÑÌ{öˆ»0 ÚZ†IÊÉÎ/­àO6†HÔÅÍ1›/¦¶m«O§a±ˆAI¶/9ÕVRÊN§(hw¶`ÏÜ›zxL»-—ÞŒ Ÿ"Kðÿ”¸!ä;¸õ/•^<‘(ºÂ~,ëê&š"ŧ6'œhY—½ú3=ÈË1bŽô([¶NÃê JÄ—Nœ˜GQL†Œ±(`—ÒÕt•|~këžS&y½±õyU&""~EmD‘*~ò@%¿s繆÷é¾â”ãôþf¸å*5¾ÊkÍ_°@2ë?ëS—ßwe]h+7¸ Œù<ú\å˜ÙG¶^Ö0´X·a£¤%}CæÉÝ×&{üšVª¤o³ÊOg褃{­2ýRbÄjöÔOM“x÷ÈI–›nÎs€ï·öö^ÿ¸n󑀜¿u—3WÍ;¤iš»jÈ.®’¬·{âÓxT'–“9Äß3?\·èä«âîžÿH¼¥Tm5bQ^®’Ns:GÄPö ŒðqPè6`El€Š[,]`4—AÖìæL³R’0"!¤ìa|Õµ½¼”²æ¤.Šëîå½3Ø %;±€W—&ÖèÖ,¿pÞD÷™³FŸSIÊÔþdc„¼Ú½dãÕOnJ¤–?«{Å{ÆÎÜ2z¶hôòWŸÕ§8·ú÷…Í/ŸÝ|-®he,ÝÊJ®ÈãѪ1˜|GmM|ö"_:çßÞ¾ÍáÖ©ß×w´aÖ©m^Jf©D>‰?ºt²|Æý™ÑȽO~"™¸Ò—§9 K=¥?f ó»OT5·Ü2®É¤aý÷Çï.¬Ý“Ýæä]¤L‰Wè ÔÁaÓžŸ¾~êÜ1ϨɀÕúkÞÅç`||||ü±Ó@ÝÇ~Pè,ÃÀån^\7#X±æj$Gù½—Y5üÒ¬lJ«EÃóÒ¼OœóÕòã/ªœ ìÜ3ýâækËÁoQìó»o¿ûz·û™Ym”J„€¶ýèi¬Â°)ÇIÃÂå'(ž]Ì3lg(•Ñ÷W|ç7°~Q«“&õõʆ™Ú£'ü²æ×Ïn<}lg Z9~Ñüþð“q´a««{WÌ×›èYÕìöYý}Ãú^tée ʺþ8yÊ¡«æ5Ôz½.rℨˆˆ13×Y·”«Ñ¾²eàl—#¾½ìº™½~üÀ,jC7%¸Ðøñ„ˆ‘ö¼÷𮦌 WîŒ\JUæÇv!ûL{¹¹ži¦&<‰8—ûYÉa²‰ €|HØ0ìænêÇt‹ûFǤœu~Eâ-‚ˆH›Á ‚L‹œy+~i(È)Q‹FU–b<ªõ¾cq54'%ëàÙ—gŒ™qaÿ²~×Ñ[µ÷û 0àð¹Óvö#2ÒB¯çp‹™Îk^Qaº@g°Ã†‘‚Pb“!ëæ÷mNá~ºâ©Õ<#4|¤e…ÜŒaC‡ÈÒQ½uÏmq£5Í"ÂÍ‚'÷—ïïûüòIïñ%g·/Ü~xJçzd°n¿Þ†ë~éò¨ ½Á–¶øÈ-EeE‘ª¶¤¦aJ¶-ç56ðŒ±QYyÑØá¾I©ù«Ž\øÖ€ŽAchœ;µÙ×?Üe«’š¶””°+,CÖÍóh[ K¯–¢8¾ßÔ652I¾°cØÃ#?˜Ž#9™6®à ‰]µÅe4]SÊrŠ¸,d¨ªŒtæ‰[ì9¾J³±¦zùÚμ&RE¬ž÷ðs»É­š_ß· ùdϺ ÎÐX9Ê`ôžÔÕG¬~·ò«~¥¤¼ '·˜ÃTT3j©Ç)øúµ°¢¹¡Á×ì‚öí i{¡8ï[atM]uEøš™ª ÑJ[M^r\ž›™Æ@ #c%¦”£ÄììÏEJ&†ZˆHæeg•UäU4[耲ïéÅbC}øž•!RÖ6ÐR€²¬O%ª†­5ä¦;èö‰mÇ(((¨j·Ò×’1Å€ÅËùšcÇÂO&ŒsmÙR_ò3ÓË5.eQS¿5ƒ“_(`·Ò¯rP"bΧÔ\ݶí5¤§Tfê'Õ–&š •+¹i©_©ê „¢˜Æ&†‚Òüo%BcÃU;Å+ýœ]ت±"–J-66iE¯Ä³"ÿË×Ra«¶í¾§¥Èéµo¦B“Ý ‹rRÙD¯•õ%㻬ûªœ–a+m¹:—qAv†XYGOS¹êŒ #-•RÖi£§Áçfå×(Og¨¶1Ò“®„’üì2q»Öµ–0¹™éå<‘ªN }-Åü¬´2¡œ±=5_®}⊔´Ü6íŒ%3|`áÈÇ ƒ7Åz7Â[?Á~Û7ò€‚½V"¾mð¶h½—›6yå%Ë>SÇZh׸nùÏS¿#Tѽñ_þ¯Z(ÿWxþïHù†íߦ,3ü>²þRˆ&âŸ9Sÿµ¶eÂsë çÅ…d|íLyí(៹¨?€kLj}ÿi8öëq§ý‹Z-âáÏÞ•ý , c›ÿ•[»ºHT; þOõøÏmÕ€õN1ipPX73ãßÁXé6µã?-nád?¶sö.Rûˆ)ln}ª€<˜êÒ{ÍSID‰ $#.fŒ3‹Åb9G/N-àˆ@P8ÑÕ™åP În37œ#B’ÜL­¯“zJ»w|t@o{ËÙÝwÑ΋’Š]XšâÈbÙ;yÅÄ(YŽ'„ÌíÆ:‹R%òvÅŒ¶pþüˆ½Nßå:m‡ì¬BŽ,o[‰¯£»ï¢=7D IÚÖÞiõÏóêÝÅÃü²4ÄKWKSS«yøšÓSm2_½‘hªHÈÑ…Ìê×ãÌÊÝ?ÂQè=t,ûÆö£$¯¢3åÕ44ÔÕ5›µYfùéÞ[1°ÓÇM˜Æ+}9yü˜×Ù<ýôLldhxø¤}—ÞV©ÜÉ7NŽ Š¿ú±êãÛsÛLJ‡ÍX±Ÿ̪ž¯X?>"<"jÆÅ×9U%Ïï]:{U|Yå—ï//ÎŒŠ \ä–d-!ŠgMH-b^5#dLØêø+5­ªxG"gÚ®8£fšjêjêz¦+üÎÑ»]!K®|¼96$jÞ:6À×ûGLJŽ]¼KG}iAøÊGR‚å=¹P PöhMøúgONo³`ÿ¹Ecò3N.ž°â®L¥;n–MݱÜXOKM]M]¯ý²ƒg¦E:" '}ÂØЈ‰;þxT…êã›&„…ŽŸ8íÜó|©Œøz}dÌà§Í‰ ›|ñC À÷§ÁQËsM :)áÙZ]Ú·6"n\ø²í§*… {aÄÈk©‚JcŒÜ\:RÐk‘«¶Ô)–æM‰ M+ýשŠãÛ®öŠž åþä¤yÓ—·õ‹ˆê´iΨða‘–‘1#,Žý^DDìLW·àf6¾ãÆ1g¾qó B8ÉNÜfï?bKkʨ°Rh„Á£ÑcÉÍûÚÝáÓúûûRT<&¸üÐWMX^Nf†X—EMèÊ@ˆˆjÔå“îÝylUÜý¤\„Ðäuí»[2 )¾tà¼SŒŸaUˆ8dÊòï.(1´€üeÒ@w;GϾI/.pªLy|¹vk–Ú&ÉbQ/éÌ*Ûúð¥¤n½léüçOEŒÛÝ+`XK-…g'˜~ÐcȘ1£ú=Y2nûCBȳã³/8×{hpðð>W–Š»ðŽòéæÊÑË.ö ãß]}ÒŠÓJr4pki¿5OÉ°Qc‚ú:ì‰ô^{#ÁšQ^‡ÓƒFšòï¹ûNRš|È5(ÎÚgðØ!yWâF,8AÐÞ¿:SÇeäœicS÷M›z¡ ÚÎLSíi"Ú5{ÞË/Eê)jÚYv†8çÕõ­Û¹1sfw*»ì38zOªFÌÌ™Yg',<Üoï_$IÛá?yùèÂŒ—×v^ü¢:Ò·‡ÃÈè6”°C@DìHK™Uz™R{æ.x‘V(éQA£•½• Ô'?×AcçQCûf›´<ÙÛá¹ìÀà±Cýº¯ës.“C–¼¼w&rƉÁfLi·lˆçó|  üùƒ«ã"vø‹2ÎcKHïk!¼ÃÝw%+ŒÚÛ\nˆG¯'Å„€ðùó§ãC¶¹ÞRYeëý›†V“έ¶W•Ì)“Á¨±1Ÿ_6ÿtÚȱãšÞ™, ¬á¦\q\hé=dlÈHÝìcÎÁ[ (ëÍ»´Rk5*$dôèÑ!ã"º5+}÷¹\€ˆÓú8ú·rŠÑývÅ1pº€Ð™òÒHBHAbìUúŠ±®Qåý,CŽöû¨:¿x^p­K×¾ß*ÿÑßiý…·ˆbéPK›Y¤^-S\Úoù€å_ŸØ:x~)“..(A¤ŽèÞgã{‰‡Bê•­Nlo…n ÷ãB{„¬­r*xvëÚ•+W®\¹réê="R ®Î³³*‹ó÷NµqR&DÄ$7Së+E äqâ­_ía×µc—!QsO^¼ÃADÄgë'Ú-k€e·fuu›ÅCD.ñî:ù¢4­ÓΘ é[®"rgùô˜t<¿ìŽrÝQ£ú‘Eã{8°\œ-:˜: œò]ˆHQÈN±´fÊ—Ò`²W‡¥— ¤ž*Ùû¬:ùe#–}ÏüZ D¤D"ÑëeæDÄ5~BåJ•´;¶£[4"®÷11¦}B Ç Q¢†£Äúöêõ_¦ˆj3—nœ¹J2ß>y<~í´åXwÎ,¹ý–ÓÑYÊNrêÇí¨Â£‚†ÑU4—¡b)µ)PY¿uå &F‹Å€òêmiRÖ£ÓEå|ËT‡„„HjçŠL?Ýh K Z·O2yÈd¾~Mÿ®àcªŒ€¥»1•„`äØëÀ7ë.¦þ#†²¬;Õ¼È楋X¶%Ñ\ñÚK>~`LHP<^Må:tW—ê0„¼<09ßyµ·¡’d 4º$bEŠåo¢ßü¢¸ Å4:½:­±¾ cfĦÃ_^\_µfáòÕú.n£Ó@bì ŠñÍ3÷4ì8›LM3%„>{ÓV@„ò6Ž«ªzôŒ;½Ø­õŸr}@D‘PÀ`Ê€’¾Éð™CÇF8»û>Ï)sv1­?òZ]™Rï Â/ίPÔÒT`ÙÉo¸b¹˃HŒ-q…¸”¹ò”? :Ý–xj–pØ–^·¼UŠ3¢<`Úö;÷,ËŽv Kg0é”@T™Ž…eX2h0˜pg\gx¿rdØ7 4‚"‘tÜBž@2t5£ž {7÷è®õa+=fœ ëÀ!A@é 6µ”Ïý6q÷ïx@þ>›_־Эëš E &€hšžlüÞÊ{b :Ô¬@8ܤ,O½¡ƒ}ir ÑÚlT´YpHJ·ž¡É\JQŽð$IH$–.!e"býV&Ž´Ó€«¡v[êãÏzº¤ÓršmvïÞ]ý!ûOžÄÓh„‹¥“(àò+«1ïÀÙyo–-‰ž©æýäàd™ãdb±e”D  *Êa‡¡s¶÷ï5Å TÁÛQ›Þ±ºÓÆ?Iè𙯙<+4ÇNlÿ–ÿ GÅÊúbvIÅÏ*Wä¿O¸•m¬<6Üc˜ù:‘KgµƒÇ7Ó%“ýêé yº,Tg$Cû[”Ìž´N²ÁIO Þ¾ç2èu¬ÞŸöðWd{{¹ßÏâHz PB"ªË3À$xg~äÒÊ€`Ƙ>³Ö^€×§rÛE^¾rYbÓ]¾|eªyÅÔUÏjôî4?A3yÝåÔâóïInrJ¾ Tk¸Üt5e¼¸þI"ÊÏOæ3l:É•$ç*:ùw–œ m{šÇ¤!€jvøäj2 ;×?1™4âۗΊ@É`ðÄå3‡{~xtQ·™‰@Pþ](‚J‚m»ÿF=Ïbº³—tyíámÅŸÛƒ8<}¿ð¡Šzy)÷®¿(Ä.®ŽœÝ¬úòÌG™:»Cý3;GÎj+mŠ~î:Žß­l\øèÖ l¨D»ó“»××®^³fÍš 6v–/é;g[”_óü•þCÚ ‚a“²÷Øà¡Ú¨ „P‹¢.yôêÖVûý£kùÝ•€·hñ²~“bpP‹Š·‹”P „ú:È{XÌžë6-Õ'„ù;ŽOàÔóFë–­4œÜÜü”\ÑÒûõgÊÞ“ÎËIßß7¼rK ¥–"ÝFx·éØÑÔP¯ôÛ—OÉŸÚô]l®§„³·™8¸¿“×ÃVúz X‘þQ×uò¾¾ÀË‹9ËžyÜGvàî3欜Q0ãf5)IS<²¸oϨ?4=lk‹áü÷·gLÏ¢åŸS’y]ÆuÕ‚òÙB‘Óc¼ÆŒ 2¦çœ}{XèÔ_µ’W% šˆ@ϽºÞ{Ça/WgFÙçSܹeh«Çùë ñàéj—ùìjžYà }FûÆ‘SGjõ}~éHWOÿÂS§6;7aoÃKKÅÈvõ0ÓAîžmMMMZj}Ïþœ’”â4n[³ŸØš¹DÐVÆl8¤Ñ>ž»ó–!Q3*µ°Z3Âl¨§g[SS“VÚ_ÓR’Rlƒ77gÒÈèõö§<|ƒÒM5o_¿é8í8“Ñʸ ciì,ß®Z§/=š7®õäk–ÐýY&—kë²Ô{‹oïOnêãÓ·³7]¹l¯ÒÐÎújǬØ7zW7M”ýyZƃ6]íuhÏïߨڙ秾~ŸY(§n`ßYãúÃ\7W+:@Ê›gÙ¥H“oÓ±«±žªdh_Þ?OÿV"¯aÐͺ‘xûä~^ßÀĪskÍ䧷sù*.,«‡÷o™Û¨Ë@YÖ“WyŽÝZ‘êš|Qvjò—ì !ÅSnݾ£‘žBéÇ«¯ÁÓ©#à³³¾Èsr²¦¨øšü(WäÚ­3䥾~Ÿ‘OWjfß­Íí»ï]ÜìHáëÄJî¬ö@üîö-¦…«©:­†íPüõsrZ6W(fÈ)·n×ÁH_]ê”)f¿|öªˆ+nfhjÞÖ“÷ðù{>Êwêf¯¯È½{±¥¥.çʃw7ɆöäÁ-“î­T9W狀¸ÙI_?½­Ôܪ}s äˇ_r‹iò*,­›)ÓAÌ»yçIwGGFb•ùbBÜå}›gÖ`ÜŒwOSóتzmº ¯½FSÀÉO{•”ΡªN+ë®&t€o)÷¾:Zh¤=Jå X\©,‘vö®†Š¨ò×Ï^~g ”4õ»Yw–<¾yËÀʽµF5õðÍ+êÝz*Š9ƒ|\×_7×ý=¢#ùmnÚ­v¾%¿zì]öþà„ÉÅ’{ŒKû†a4ÁøâC—žþòˆ¸¾N#‹Ä¿ËÍÔ_ Ñ|{$:ü¦éÍí¡öf9“ÇŽx”Æm¡"È­PZsd ¹Âÿ±•Mð?•1›øÛ$—©Ô¾—¨å¿ nd“Çþù›¶šøÿ3Ž» šàÿ'øßI@Ñ¿ç†ÖMP´_eêjÿþsçJ5þõGñ×’›ØX›ÿ!ÒðHe·Z€¢í?.kêÊ=ñg¶ ~ž~¿Dõÿª¸!$y¯VÇ¢˜§ !y'¶êµ³FöîíI&½ÖV çÅ(W;OûnƒÆÆR@ ž×ig é4y{ÒeïGDü¥£w³dõrµuòô¿þEÔ—yùÀÀÊgaÞî‡@ þv'ƒÍAŽ!@è`ÜDâuOBûæxSŸ){‚° %rú¡ÿ‹%‡Àyq,îè—Äm!#†¸w·ŽÞr“‚9wŒºz@ Ù_¡E&@ì~~t p7( zO‘D+ìQÒh€vŽð2€€°F‡©§øN#C˜àPô`Î` ‚ÒšÞTþ󨡽ìX,[Çž;ν”ýM\üyNè@;–ÝàÈE¹ €¦Ü öwqq÷p°µ°(ž„@Åáå“YNîÎN>Ã.¿Ë+q¦OøZÞ·3½{¸³z˜i¿’‰&„<_âÙuÌ1Ñóå-§žß1cð öÝgl¼ &€d„Â2gG‡Aë!"²w7ïÚþMDDüèafýœ˜ÿ¨«¥Í°Íï$-MÐmvüëúúÉ?bxWŒ÷=ÿ„äãpwÇ®þ±yß<»öˆWˆ¢ÇÍ-ú¤#fžÍêÁÊ!"Æ/´vÀFDÄõCz…y‚ˆ'–ø:xHÜ…¾&Lïà:…WæÜü7vÎ’ørüvÏoH ±ðñÊNƒ‹13q›g€±àÒ$+»1’€ùÛ[ÆÙ9õü&¢ùoä²Åˆ%Ã-lâ3Ä• ó¢LW@±°üvâír¾¸fÇÍäÚ#"~¹ƒHk…É©ˆ\Tl邈H QMAùˆ£ôµ,ñÞ}´m8i?"â®>€+."/;©¢ª"bE`‹™ˆˆQ]iFxóZk"] ”""vÀŽì£%êÄZ~é3"bÁ3kç—Ⱦ9ÑÌo3"^Ø>k¤ìêá>Á»q±—ÉÜ{Bé|E ;vÿ[ÞƒÃÝ}GHƒ¬ßô ^K!&_šé°Z2~Væ—²)DQY_;ÖÕÌ2|·Á¼ëê’§ʽm®|,Ä¢;vìÏeHJîÕ£óT."òJsï<Sfõõ ÎEDÄÒ·ñ,ûÞ"âÞ¹ƒ£V^FÄŠël§K0IX6Òwœ4sÀ¹9CY‘{ñÚægÏ’1#{wí9Q2I3]{ÌyPˆˆsC=ÅH ¼Ý4Ô¬Ïj!"Š?:˜¹g "ŠÇº;NÙÿD,¾, Çà­IˆÈ¶ÚÌ¢ÿDD̾8ËÁÞöiVy×úû8{†n•üra–ƒ÷X""¾>2ߦ߬{Á²}ºÛ-¿ž-ida«ÀeO÷éåì}PÒÔ±±6>‹^Qˆˆ¢g·¯g MlÐþ¢%vtõE³)ó™ˆwþèš¡€€ûw@P1Ô2ƒ"] Ž·°@L4æ‡w–¨f¶¶’î5ÖUÙëGYÎAMbéP#Ix§²®¡‹½¿LŒ r•ž“4ºŠÅ¨alîlÕ®.ʼnVœþš£¥ØAh&ß¼<+y[iÑôtÛš÷P@VFFvˆZ˜ô“¼Ú¼ÿè–ßn=*©c:SY…Çn§p¸b]Ö™Ã+äAtpñ “ñ +¸\.×À¶w«œÌ«%p*þµID¤* Øùå %àr¶.nú*4!—¢©)Vm'Le9¨(ÒÊN.NÊrõÏ`k#P€¶ma¸;dß‚¯ü\àð¡ßv“xExùXöðð<ÀÍë|=àÖÒJ ÀØïà9€BK@„ì%€ íaý$ ÒÁÏžÃð¹`£ˆ„€J2é ªHÍáñ:jY?yvËBᚽǮY;3 ûsòÛ·oÛé3¾¤€®ÆÓƒ;ŠÙå|¡xÖÚƒƒìõäUÔÅE9Þ}ãpy¤ã°ó{¢_(FSÍÝœL®$œœ¼÷ߺöªPÁ4vÓ@Eõ‹Iß^œ¸$çèé£_Áår¹üVömÚ$> òjú.Ž¶4Ð"ðÌù-ŒÜ¬÷ïÞ¥k#ÃQ #%O óÊ/Ÿ~ä:‰Ëår¹\ï˜HríÐg@±V‡¡ö6TR·ëã)™$'cêsº$Kàèì+)`2I3ótF_€|ä§~f—÷4ãr¹\®`P̸œc«WN¼l5 À ܦ0kF³Jn$Å#Fô@Á‘5çºL\Ìçr¹\®y¿!ÚïŸ>Ö±`¹EJd4«¹ÄÆí;6¨àñJ4~„›Äl2u6æ¥%#ÝÚɽµÆ/ú(ÿ%×f¢O…ôºòP+i€]¡Oiªò’£K“)¯-Q{4TäK Ë몤«¤«. bÖl£]Ó‚QÐbÐÊyB9 ¡ÊŒ†¢‹IEE!¦F#k¤öTP#Ô aÐä«l©¹ŠH×6ªt3RU‘çq4êPå4Œ¯Û1~ÇÌ *ŒY¾;ØI/µˆ–¶~”ÛúJ;B Þ~–bsm% A™JJµ,gy †¸ œ]‰]Ï+áÒôµþ|ÌŒQ°íL:‘×@ 0Ë«ò5h%!Èä–pA ÝdD Ö-˜l{b d5¬þQÆPtt‡@iœŽ«ÁüRbòE”šÔq¼sesÔü“‡ŒÝ^O-Ÿ-’¼ð=nO¢úª™½{öd0hÆN¡»W7ï}ýzôÄK‹(µ…û¹›hÊDŒô0‹º²j’oòéåúCV(3PåGRO}5ò±ŒŸWÆã½»ãàz­ê,ϸ ´Ú±TÞ9/¿m<ƒüL× MK DÊ <ª*ÏÏa µJYŠLfå'M_(VÔГ²]É(ã ª¦TX@1Çðøq4ÉÐS],Ôm¡"¡-¡1%‡ô×6N_qñ (MÓ!פT•?½„™²¨_Õ ›BeQrn VÌ/DPcÒ‰d—SQÑâ‹ %=+0˜’‰$„ö·$hýKâaª-~ñ•6ÎÑCÄ/FÐ$@ Ë*4U« ª®È-dÑ ðýã7 mª/ÉNZ*…9yb£–t ÀɾG1¬”äÂ]QQGL•QˆIË ¾;qQ&€(.ã)k+×}QI˜š×¹&T”¤\ñ:ÆöÍ5Š’°»Os™²Ôfur¿¨BR_Î!5]´U=ÌÄ—îçiÓAô²Ô ¢ýŸŸ«ÖÃÁ&ž-éošC—ªW19P  Y 0PP:€€ƒPß³PïüÚ @Çh/>×K39=½¬‚D®JâTñnñÞ×CŽ¿cpáêÎJU)0v]`Œˆ]V6sìÀ¥‡Œç³×0bí={WÀã¼Øë3hÌ…W 2 ™ãüäÌ÷¾Î¿²¿dÅ]é÷òïå’¬0Ù%Ts59}ž¢R×Þ7eÚd_G!°9f»îȸãÝ€“óxÙ¦z¶Z ]F¹ÇžçÕ_î½Þ8Ñy¥ßL "u%9’0›Ñ„ûn¾h_}Y4Sc²¹âQ”Äöæìí/ €4†Ju¾Q0֪Ͻ»ÖIQvá•×Z°tyml¡€@yy¡]þøKÆ0Ñ#iÃ,rxÞ@ß±›~fáÒ©Ò¹žI’¸Ü}öЬ“cc54Í-›Ý9xP³g3h*Š²> Jž&úëv¥s¦Ÿp›7S ,óã£wéuYi¶6S,*Ýù´¬Ëœ_‹FÜ0r’NpÀÇøí¹-\mÕë>ä.x{`Èè•ÀSÔé`¢ ð)<ÅçÝêió 󞎌.Ú€ÀvÉÛ·•[Ç7)HŸj¾xx?ŸC€ûäÉ)»'!¬Ý¦jïÙ €q?|Ämà?šäà,xôÊESfAÆx 0íä½D`72²À/Àà @6xLXéÉàÖ4:@ÖÐg€…À€Áðè D   ›9@ )XX@OVÐÑŒõåö^} Hùóî7J«¸D^‰.â–SE÷§|”‹rFöö²€0TÕµ Ô•øBx}fEØ̃ § Ü¼“ ÏJA9M¢;Íopß3#‹ô¬å¤w(ŠÂ·;®æïÏ8¥>š[öu+¿uùr¶¹Ø°á7’Š !vþÃ'/)u&²Ë$×Ü‚õ±sS^’Ø–& ¤z L@ÙÝ×úò:iÒ¥ü[Fíù¹e'wçF‚DfÝÛ°¦Ì¨¿‘ ùD¾]+UåÝg¤ùLîíˆ _ýzú˜|9}& |¹'#(ké¶lÑ¢E‹–z5tlfÀx§qS$üÁK¹2_ŒÚ VI«£ºP|èé7 NØq°…kDý¨‹ß>¾ÿµTü«ÝPv9 <‡¾ˆuµ±eÒ„~[6G–•³ÙUѬ6»ÊCËfK P z£uÎô]ð-#ÓÈmÜÒáæõéF”Ëæ`âŒ%ã'δqÚ «©=o–ýà…¥@Öý„ å7SïŸÄÈÝñœIQÖ«ƒÙsääE®:ð6~iØÇNoM—m“Çe bP48uxVÄߣ†¦½qKW:d¹ìÊ$~B>S!Mp"æqÊù" Bú]‡G êŸËaçóÔÖ¬ß"WW"hwУÅd–ƒ£ªŠbŸ0o‘ Àqî”þ³û°X*ªJ¡bðÔ%*€*›‡< v¶±ÕTSõ8œ/8$Ùö§õ IÈÖE¾Y×!ó}ö³´äeÔÝoóÚéˆ ®ÈŒväÚ3íê{F™@’€¼9LaÁêûàÐÞƒ¹:ô °¦YËDžhÀÒ.`dà+‡"„Ÿ‡·ƒ`[4ì‰ÝŽ°ç Є|xñ2¾-…¤¯°öØ àûçÊn5S“[\êãØQ ’G„m|÷üîð¸YW†E9ßÚ¬©¡=qɑ̨>½=Ÿ?ææè²-fžÇ‹«WÆêÐûõèá°îdâ Øu™³¦w·wÖV&b Óù+ã@(àp*¤\ϯàpùÒ,‚Bn¹t{óì¬-Fôó/à–•ÊíÙJ…ƒìZØ9ÇÙwtíä蹬BEäjvî¹nƒ=Tq™;Ío\K+ Ý.^c€™_+o‡ÃŠ¥Þü—þ8ƒeï ¡*_AÓ™0g°ŽË€„cK#'õ\ª(*çvé½oRWDŠSÎVfû¦Üréºà-7Ø}KR8KåWäƯ„W¦H­þà³ìßõ£\µü­ùÌzHBÉyßšª·ŸZXÔnDÚ=RÌêúÚ¬ÕUêÕ»>±¸ç°ë@â'í¦êê´fÉÒ=<óD2¸ÔªEU¢·ˆÛ—2ªNšÈAæMí·€NXul€ ‚âZ-ÔÆSöKW}@™4ºu£¾Y¨/Y5UP5û@üv×–À­úònƒ‰ó”ZýRuÌ”lZ_ªÎ·¾ëÎûÛI˜²NüçŽuXt8¥fæj8ÔA¾:—Iõi¡ªÏacÌVIŠj M”]…ÖGÇüÅó_ÓnêNÊZãƒì«ÿY‡é!ä••ó¨ÚÙ_Õ5ÔI}Ékk`Q£ !Pxc£‰³¯l )ùÜ«;17B JX\Z^£"2ÔTé5Í}RÇmBµºˆ5P¨]KRžâ]Ö1T•ÔI“Z aÞ4Ø¿àúõš64Öj¡6ž¤®^jw})´ 5O²I­É©{êKV]÷;p²¥ÄÜ¢âÒ51sì-P¬®oR2Gõ½'õ Ž4ø¿¹Hz=RO¿¤6Ñëçº*¢úA ªÖ[ý-7Ц̈ !Ò5f˜’ÿ[cê/]hÑäåjžâ>;8næ¡š·SãâÕÓÊ¡+m÷)+ît:“Yƒ yúÎTUªFI [ôÛ}(ÚôNÓäåå~®œÖ¡M#ÿDÃÛ×GŽÞkÆõÈ”ºàoKœ¬™ùoˆ~?? ßzûEkÆ8Éì-t9¹ß#­TUÇ£Óiðß„…kæþúÒÿ?‘û‘+EmC¯¦ÿN/ªWá"›{ão}—þGkó‚ÅêYÎköð'.ç~GS¿T~ûÍ‚ãëâ¢ÿ_ )E4Aü_©uc[wN¬ø¢6ddÏV²ß\^{—ã3~€I2þÄŽußZ;Nèe €·7ο[*có#£wôt+€’Ô=ñ Å‚6–.£üÿ9uG²ÛÜ<ÿèC¦œzó~ÂÚj1e”[ª;G{uTiJ%ÓMð ðw 9y9fÍu˜ýîzâ‹Ú®™Há¾Ý»q÷ÑÄw’OZmÚUB;}æçr@±ß:º ÍS6vqè–qq먥„4’è@ª®ýY­ ‘ gI󺫩-Û)°ßôwó¾›÷£/DðïÕcqب¼Ÿâm‚&h‚†,É_¸GD^é·7/Ÿ={ö,ùKŽäkÎç—É™’Fñ篟>}–Y,º¼ª÷€™w$y£ß<{\À©|UXìÝÝéXL Ïò„ÚœZ2rÌÒ ˆ˜²¹¯Õ¨ÓÒ»¢æݼÒňøÿÚ»÷h(Ó8à¿gæmkJåÒZJÛ*­"C›Eè(Z]T»Õ[©-[é(ªQ Y“Õ"]œ¬­NÝζ*ºà("Õ¤]Iº¹Dša™÷Ù?Þ)µçì9»v÷ôûü5æã¼ï×ï}Ÿßó<ò›¥ÅÜ[uUUQZûLVy£¤¬ª…e)UH+%å%%W½WG)e•me¥%29KYJYÊv´^--kU°MU·®Ý©£”Jk®Îò_ªGƒÆ-çSÊÖW”–×4s‡8›0×wÕ‘?Gý­S4 <ÉsÿÔ燙ù¹gV-ô >\gRVÅ» ÀYî>?hóÅ+E"¿ŒÚÎC4G‡•xã­ºZ¿Øs^D÷úV¼¯½ÿÕ7žÝ°·÷¨VÐüõ“ÝDª}ݳDn>ŠØn-XŠúŒéÞžNBWññânÇb)}`g—Zƒµ B=Ôæ£ý¦ñ¶ûûL/óø|Ö‚ù¾Ã¿*|Ú_Þ¡¬–‘.×ܯéäj|W5+€pûß‚üAÀ‚„rz½¥´¢Ð–úŠîñ]#¸-II«äFƒÌ/x·¡^kÃ…£;À+è;ºïØ+ [  <’õ´ßÐ;I JJù¼#ž®V­[-wÜrÓ$sz/.C](ìÞäÄëë¶=e¤$g”8tˆÍ…©CH×þ?ýÏ,Ú‹®?ûÚ¼/þ¯B¨'F¦¨žmFažäæüsÎ6ÑKâS–ã.Hªì À¢êäà1<è²´!äTÒ:¹ÙèÒô´€ÉS)ÜTï«@\ï0Çߘ»´Aùã¢e:©ÞÃ`iô÷vž{j¢~ø®{@Êôp3?Û•`b=Úq´7{ËAèÒoz;Òœw¹Þæ·[Z;h½¥ …0ÚM´Î]O[ž'Å‹§î {ã:Ù³VŒ„zddêå“êúV;ç¥ëÄå[$ÉQµê ^ÐÛŒ–ß;XnüFRT¯¾iSý„…ýäy¾Ÿð†a€0|þ«æk€}×ê|†©ûêiÓ –¯©©þ}§ìóV¶K-ôÎ`Ûë^­î¡£P(ttš›ZÖ#`¡óÈ“EÅÅÙû‡{­äVîí*«-;á5Õ¿sT‹%,eÛ»Þur/šå¦úxê ÔCÕMñ‘„ˆºU´PW@+³Óù6ý;ãFßÒZ—]—xh¥·MuÞ±‹ü¾:ÜJؤ9&tã„qv.³†«ßçö“œl…Ã\?wUxùÓ–– P7¹2¢iîK¿9iiÕO³2ïÐ-ý“­iLXøÄåb[“w­2E\7Š#]í²Ot±2¼Wt† B7¡ÿ.þ B7!Œ„¸AaÜ „0nBã!„qƒB7!Œ„Æ BaÜ „0nBã!„qƒ¸A!Œ„Æ BaÜ „0nBïµ?¡¼ç¹ï²¡õIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/ip_proto.png0000644000000000000000000005243413051004444021553 00000000000000‰PNG  IHDRz^¢ˆHSsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ;0UÚ– IDATxÚì}uX•Ëóøì 8t (‚-Ò݇.)‘P±®Ý×î¼ÖÕkaw'v`w‹…‚€ŠÒ§ãßïÁ«Ÿ{?q¿¿3Ï#ï{vgwgggggfç%ˆJP‚”ðJP‚”âF JP‚RÜ(A JP‚RÜ(A JPŠ%(A Jq£%(A Jq£%(A)n” %(A)n” %(Å” ¥¸Q‚” ¥¸Q‚” 7JP‚” 7JP‚”âF JP‚RÜ(A JPÂXÊår L&ƒüHaD „"R÷­\.g0˜ŒB¢„ÿ ”Ëä„ÉdÓÔ L&g0Y„’ÉÁb2hDŠ¢èÜo„ƒQÃ5)JNQu0“Aw‘’Ë)&“ÕTgé„Q—]ä29a²˜’É)“Å @)Š¢èt„0 !t’Á`0 ’z#EÉ)d2„Š’STlvu’º J&¯›òŽ.Ðñ÷Ö½Äè¥öçÅ¢\.'L&SQ(ÆN½2éÔŽ‚0 ã›ÿ›µ›¡Ý¼Vüðc¬E! FO/iÐ?¹ ÌÇfûµ¼ÿKKQÁÊÿ\ •7sŸSNýû¶Ün¶WùðrITðÂóôò";uH÷@®›“‡§³£‡OP÷a³ÊjÏË ¿s}¼Ã#""""ÃCœ\½ºÄ }_  +¹èmï÷BÐdcy/öøz{w_s½žL-}êåêáá6 €Úë·ù nß=Ðǽs×î ±‘.î>]ãÇ)d Ò…£‚}<\¼Üœœ½ƒ:Ÿ¶‘–Au[Ì:¿Ñ#"ADÜÞ»ÀË×'"""""2,ØÏÉ•ÓmtŽêW)ïïêîÜ922"2""€ëâ>cÇ_Ò„mSÇå“5Ê– ëÂåú®|TðU’¼ev /·K|¼'×ðo‡iòWÜßìïáîï±ýZ!?Á匟ZA¾`2YLòu£øvÍÕã_Ƚÿà“j½_‘°4®>HÒ²ÑL¦ _b#ýh¢bý¥_çù»ƒj[ý?ÇVoÒ«®$?~¯Lc¿üØX¾v§nño«6‰ ë«‘Ñ ‚Œ—ÓkZÒ²ßg0ðOÙ˜’õû©¡«¡f¤ÚƺÚÍ4ÅåC;Ç}R÷ØuáÁ«§ž¼|}ãøÆNâG¡QÓDrBoªjZ.%'''_¾rãΫÇg-XŸf®:H‹Å"ß]ŠLõŽ%'6ga  I¹u•ÙÜŠÍb*–“Eë>ï¯îÞùZ–xîñµóI'Î^~qïx‹ê‡3×&„%™Ú-æauÇõÇo¼yñøù«—§gÈžo‰þõ˜¼Á*' V f ÚÍ“““““/_½yïÕ½c-…©Ó7_j ˜LvÔÊã—/'_NN¾óèÅñå ÷×üº?ãÏ××Ù®ºz5ƒÕÄÚù†8"8š ub~UR!Ptvþæ3ß½xúô“Û{d—–-½^¿ÿ”õ®ƒÖ>½wõÊÝç Ã[¯_HÁO轌Ÿ5„¼IÞèåéåéá×eGrjýv€|z”Ô/*À“ËõIHzô‰‚¢b/듧EºÛtw=" O='ÌÓky*U3<‚2~(×jÛÕ\BÈÇ=1z컼{~dH×Íkñþ»rB°¾r)øòtrŸHwwwïq+WË€òz{¤Ý°Kç·ÍòöàÎß{Ÿ˜×¹M·?ÞÒ Bž, ²ì±ëö›œgg~‰ðóôôt÷ YvðBY9Ü©÷²‡f òô ÛyãÁÒHç6ëo”ÐÒœ²¦¿mÔ¬ÛØ$µw,ó÷\ìVn)¿QyŒ((Ø2gˆ—»‡‡«[Ü°ïËå@>_ÜÒgü§§‡úƆùz¸õžšÈ'pu’ŸMÿ-ôXHŵ%f. Õu71B$Eof‰uwóðpó6g©!y'Ì{¹stelD°»Ç”Äd!ÕoÛÙÙ§ä‹jÎ(’n~æKOfÕb#ÒÎÌ­l;4¨ƒ6ònw›!ç“gDû:{FžyWvïðﱑAžnމײ!„ÈŸŸÙÈõôôðŽÙ‘ü–¦ä‡û‡"<Ü=ü&¯;÷à@_»¸½!„ˆg¹™†þñ@£ƒu'}Úm:Z´Ð€œëR+uW.ÿµ­[!ZX-Üzöæ¹åæ×3‘@V3j¶Ñä.m_ßûc{,RhbÙ®ôä™OµzÈ•c§†Ç|+QKKs4T[´×g(Ö­ªÉ–ó÷öO튼Ô-w²páÚ%Ö-4èÂFV«woÓ誈٫/­=ª™MlþôÊËoKÉÄÂZié>ÈÇ’ºwá ÈÅ‘>V›ãÚÏ}NÉI9? ÚÏ‹ëíé¾æØ}ŠB„ýBC¾¨Wwóö™~¿‚HKw/Íuwçzxtµø]‰¨žBMß{vzï@f½5†÷²z‡š±TÚEwñxvp'!ªöŸÒÓ‰Fáb..¯äý¬Òÿ£PpÄÍÒ÷R1""–^ñ·p;YŒˆÔxÏ•Ç3QžÒÇÎíL†©Ò;áÎ6{_IP\äãÛmQ$wŸ“mÏD¬9÷""%åÇ…¹ï¹‘‡ˆù§y¸9＇ˆ”¤ ÖßqÓÕœzÝ”ÄûúÌ9õQV9Ìßwòñ§ˆ˜q¢×ÓýBj"ŠJS¹.72¥¯ÎþáÛ¹'OŠˆˆ²¼n.^GÒKëa«ºçmã¹;SŒˆ(xi㚘!AÄÄ™‘^ÁqyDÄÏ—ƒ»WËqׄ>1Ó7** ïûZ>7M.ŠBDJTº}î ®Wìà¹é¥ÒÚ!×Âî…}ºô[@ÿ}rùð°^S(ŠÂ÷ëìí¯}‚ˆˆÒa–Ãvå ði­Kr±¢âÚñ=†Î?Œˆ_1Ê„ƒ#Ço½ŠˆHI¦v ¶ñ<"–^ááê¼ëMÒÜho»ƒOª3C¸£½TTÍ=ìf—ðù+6 ±|¤›ËÊ•ôóÇS¼Ü]¯gòñÉá\O·ÍW3‘÷é$×)8]ˆå©—=|ƒ²«dˆ()zéËõ}šËÃüd[Dü|}“³«;wÐ) Qöðäžó¯ËëÒŠ†¤!ÎÃ/Övâ[xq~•op¯*iíïTêª>Ö1KQRtžkç›ÂkrNrSvzùL|¶uBà˜Š O9û,Ì9çéÒ¿ Q–ØÕ)fÓkDä¥_qóðŠµô]~R¥˜< oOô±ïµÿGMÆÙ îá=2 oî™3\"ÿ:²gó»ØôØX¿Fi?g÷ywrë,jb˜õÄQ.éãïÝuº‚ƒ‹Ïr­\v¾""bv®å˜=Ù"–]pµŽÌBDÄ%CcºŽý.~qéP—˜‰òÆéZ5ÚÃ}ÙÃüšé­è5lùڟSö-öIQ;YEÉx_†v ±<©þìý üÄa ›ÅÜzq³s3 ø"]®kËŠg/ªëüN%Í]¯Ñ÷·.T€è{Gq­ïNB°ûÐ8­µ½v“oüpIPD\b|Z "a¹š¶z’r¿^7Xzû._YØÕŽ ùbfO;fÊ+…ÑGªêo¥‡ªš&*•¢â"[¿`(É}RÌ€Ò7Ïr5 BZëÕU)QÃ-ùéíþíU$B¾H¥c”9ÿþ£BÚ‚ÙÊ:¶Á̾£¸’W"¥Lÿxáê'x³çÓ7ØE¥éƒ!HTõ/Øqåâ™9½¬õ è1ᘼ~©^S·ŸÞ3()Çw°°*­Ì“i7gœ °,ÜÍJÞ¼AŽ³›“Þå×€÷øiZPß@üjód¨n8~þ¡A ñøâ8;·ïséÓªPÕ7Þ»"ËXË@³(7@mÚÂ{¿o¯€«+¶µ>Úì«Í’@Ù»G¨ÑN­V'“hG{¶WG€fÎa(Ñâv@UCWM•’¢  äR™%R`Ú]¹vű…Æ›ëOØæ–ƒ,ÕÑ,`Ä°ö’šMŽéÛ/ÂFk¬°µûzvÜȲ¥¢”x쉣F3fÌè±ß–‹j­§Z,Åá¼àÍåYgÓcã~œ“‡ŽP¹u9E@àüæ3öÁÁêÙ·Å4̃/Û¨ý¡O¨»»O`\B¿E[¯P@¨ùÃN¦ÿ’=ŒÉf(zþùiÒì«ýûù}[Š­¦Y³@„G¾Rl9â—6(‰ÒÄ룟¶@hŸ’ui3"ÖÑ¡ Ÿ¿N:†Ö)Â~®ùîþ™¨g˜n*%r-UÕÚGM[*‘*ðÊÞúuèdç9clŒÂªü·{¦¬;áô[©³]k6#KÀ±¯kféÓTUæoá×WÒϼ²bu—,` e¬£ ?Ü)ÊØN¬Vºª·«*ë*cd—ç¯8ú £­¥®»2CÆpUtuÚ¨(X—ZkÔ²žÄ\¼å©ÿ|¿ç·5ãNÒU%õ°1ªvΞ´ãN¾“cuUV^©ºªœ¢•^¶Ž©ÂÆ`@Šhݧ›ÅÊåû²7ýÒzßí!ñ;êºØ¨§çŽ¿-—0€RÕ·‰tb€Âé@Äåi™Ÿ2†ž¡.©ç Ÿ¾8‘Ѳ…®†¬,W…¡¦°ÍpôôkÌ]L&P#£Ü¢\€ñA’‰o zîk_‡u àí½+ï¾bfi¥¯Áæ¬`¶¯ùQ»•:(ì˜ B€¢@Û}R{5ïÓ+ûÙ‰Ö=Lg¯pFÑÂ¥¤œRá©2‰ânKE‡Øˆ:ê*ôЙ@)Ô· YüKÊÊÞ.35:øùú…Åö °5Ê-­ÒÖ0€§†O+xVO¼|³å°ŒtHyNY­á£•…ƒšDÆ”—ïÙu®\DËj"|pww§ÿÖ6jØoÉä¾?n°A§„pÆ^í™`“tÿUÈÚR<Ýè«kj5ñ·mƒœŒWOÞÞ¶iVŸBÞ¡9±ÆºŒŠÜÒFüx5~¡¦Ö¿è9Ýs¢×¢}Èð"­Ö!xfTÈz£`rÚ;xo<¼Êœ…H Ü@ߘnèõ‘i‡f4m ¹~sž8½Ä9e< 3SŲ[µÖ¨z‡1Íþ|%r˜Œ ™ô+Å$r&KáÌC¶õí¬÷ ­:·az\בW“7éþá˜ôFnîÕyV…ÕURŽŽ6À´ƒ­iG»¨6_l&+›ëÔÝ &íÉǵWQ4Œ@dü’·›v&̦[Ö0r¼z2±¡#ºAבtÙxi¶‹nÓi *þÐRe%Rz<„€X*e2Øõ18l¦D(¡%!ˆ…R¦†ê‰0œÍT×–ÖöïSq±¾¦È…_rJZ™ª l­¨‰s÷ì 9ò†·ýÛ=Sï‹Áܾf»ÌÚ{«Hµ>«Ä†4{rôf­çáÍ£'ÅBlj¾¿ìü«" ¦”—Y›´ªÇ‚b‚:Æ: DqÉš—Ræw ¨aìÙƈ~Õâ×m½46žS.4jÞ‚MOhñ­½8ßïsxgiþûÛ;æszŽj__aCd X•¸{çÎ;wo\Ñ— ÕãâOU œzçæåÍ¿Mé «°¸×©T”_¡áìgFò½[ªÌïOCË^,÷/Ü}([éiß «rQ¡D¬ÕÆŒƒ(mxZÁþžG‰_¦D§^}píD¢Ý¤¹Úõ‡£ª§I¹äÇTeBÊ>>.Üvƒ¢ðmRQÆdÖ Ÿá˾9¹þ ´ô 5)ÊÞ±xkø¨˜¦¶Ü}{N=KÕñ¤e¾)$ú-t |g›—.X~ˆÖ€tÛø®c&ì–’67Ýs™Hð'…„r3¾“Б@oß?nÖ̳V!°;™š0_Ýý@"ȸ–ÊhÕé‡N2ø|9{¥€žþGwo¶ñîƒÒÏÃ{DœIDD%O¾HtÚüÙX»!ÐÍbËüË @·ôù…«Hƒ§û~¿a5«–棶:‰ì:øsW?ûü7]Ï]{áœ_³úx :è’ÌÅsW¸v<€ÛxOmmW èRôäüƒ4öέu•üf-(Iñ¢ßÖùµ‚ÓïNìk6a÷ÑÃ:y45ÍLõyÝÛ÷Út9`äþowA??Û){¶ÍÙ¸¯=õáÔ+ƸÆ›ŽýqÞk «)9¬å8#X:gï‡ÙÛÝëöª1–`MY½ß¬}UÆW÷M™nλ@E:ß={ÀÂ+¸<÷–ý'†:7¹-†öœ{p‰šÍ;h0Ž®½†º`ù‚áÖÚçNŸíÛnÒÖä}×»¦£øZöŽk½qÅeÃã“ëÁ¨“­¬üV¾¤CÇca鉓oGwué`”“z÷_å€eóæ:=–íè5pZlˆå¤k­ÃÛ§f+|hë{G¦FlÝÜ·ÁΈ,-³“;'ôz¹SûÖfÚ ~~^^êûüž³7º«ÿ9C«J7ÍŸ©ÇT¬i–‰Ûâqqñ³éÔAcwڸЦ)TÃV¬½Ðu\lÏã:ê°ÄY™)Ï2æîZÊ–îÞ­Kûöø$©£Y 5gg¾*Öö=q|&ç?Õ²ï²èÓá±'ôqûôèÊ©çª{. "@·!ä.ž±Â5¨Ï¬Qݺ-,ÊëßSš´÷€÷ åæPž+-^}YT&ƒ™¿oÍ¢KjÚmÜÆ÷`ØLíÓ­K¿O‹œ7w2Tº\Ô‡„[.sËÃÝH¥âɽû­cdžj7Àø=`Ο?ÿÇXDÃ<ÈÏ\+7§@ÝÌ}ѤxG ¾¨ÊÐÒ±•:v´vnm¤†D=¶Oœ¬ª ´J§­óÜ‹ì ˜ •¡½ƒ‹‘Ž* Û̦¶XBµ³sigÀ®E/“QÖö.-ôTyïOïzár<1!-%•ml=uÕR[=FÝeÀP3èjWZXÀC½AS8sÃtI…”ÕÌ¡½SÏÂÕÖ„.*•£ƒ³± ,µvmz={óD£†±O¨ÒÂ!Æ­enNè˜Ï˜:ÜÖÎK.-×4µì¨Ï2lã`ÝN $ éîê¨Æ$ ÓLtà’|êԜ° tY¤ÎI¬±B~!a*¢²â q@ÿ9="ƒ å…¥”³-QmîéjI/tJ.mffgkÞŒ ªi_M<Úãb;=•†*8K£Gg×ê’ÂJ©Z¯‰K=}ÃLT«xR-GK3ÔêàîЊ./“É,lœZiD$„Ÿ÷úÀrX¬wý#/Ð0á[}Yo@D'@JÆÔëäF“)dè8»ÙÑŠ¹LNìÝZ˜šêê*,+®à õÚ¸N[¶¬½‰vtßnTE~)ô˜<¿}Îዃ»t@Ae¥…‹­©zC !¢ª~Û¾ƒz·Óå0™lƒ.þQ³-±3aÐ"”\UÇÄÙѦ±JÎÐ1Ö×Ñ­Íf¦®6mëèƒcäìlÎÐoï*vý:1)`麸Y³äRYsW;SMU½6ý‡÷0Vc…*j:Ö®þ3–¯ôj£E{;TtÛôз>‡ÅQ7hÑ:4aô’ɽ4™ßFËY:Í]l˜„ \®iØÊÑÎâ»Áó(“`'—vºªh=R™¥­³i3uDd‡tëÑœðr Ë Ì=æ-œÓ^€#7‡æ"¡ÄÌÊÑÃ'4>À¢8ûSµL=|è¬q1N íD’¢ÔŒru-+‡vF:ê:úÍí-Û"¢kDw[¬RÑ‹fRB¬ü»Û‹EbŽv‹ „13‡üTTñÏ8Âÿ#f mì–¿UQ~æ׈ØßNÿMØ«»;M¼ÿ&K­ýCòF°>…Ô_CHÿ'/`·á¥¬Ñ¢Ò´ ×Gybü—ãÞ‘¸-GD?ˆµï¿ÿ*áÿW`Áÿ] „¤ÞؾnË‘*{nFÿulǶ,;vöb9Óë\gãÿüX¨üËÓçl¿™R0òÀuZÏú+7 ˆ¬rõÂß’ïÝmÆ4ÚŽÙ˜#Uõ;mãØsÖŽG;GþKÍ!¨›R¯ö÷ =èéãýå̓I§ó½Zþ‚ø¿u¯GRšþº@ÛÙºÅß‚­<ÿý§BQËŽ6FŒ¿¸>àû×U2V; Km6üul?½v…¹)o uMÚµk¡‹?¥Á6n yóâ ÅÑédÑ^…4~›6t¥¿|¢ÝΩ…ó_é3éÇŒ÷<1SE£Us]ù)/’”âF JP‚~~üÎT“b ëû5±±(˜zo±Þ¯M"–‹!- Þ}ú‡Q´‘ûŸÞ”ÃïÖýÁÓÊ¿\U ß¼Ÿ§ç_©ûŸþ×û÷£â†B¨ÑÜÀ ëúÛî«tï ‘­qýeßGB!…ý<¼ü|–P_o«BžŸZé’”]MH~g¯£äÝÊÞ“÷4y(à¿KK°Šþ¯3ÞOl*Ðí¥83б6›&.´Maï3Ex/¸¿:ª¸t\þÏÏJ*b"ü“žýåã þÃÅÖß²–)yìá™U%ùyzÂûôàSõßwTü;!äØÒ¨n3¿s©øFÜЃT‰clZ·nÝúuë~_0æó‘_#ú®r©DR“H*‘ôÝ“·¥uSa\=tŒH$"GAh‚š›¡Æn²5M øòr®ý—N™Ú1éÏÌMõ pi C·€T "©‚cB_gµ¤ÆÀÈ…þ.°ü ‡îȬ€Vúðì˜jÃýª¡§R‰DNýu¾&ÏWõ·æÊ?Ôª‚@*Ғ݃æˆÿâ’H$?°¸± Q"‘࿦¢6V ÈŸ}܇WþM³"—I¥2ê¿8M¬Ÿœ hiÑÉÆ–·6«·'†&Lz—3ÖÙ”UŸLªýÂõ6Ÿ{n® gΉ3¼Ž¶„>qÔ2=5P×e3‹ØvùXº>·««I½ÆdUt ä†0!îí†ü2Þ\„gÙ`f±þß \¶î—AüȽ 3Á¸ôD $°s`[èk;’ ç0Ôa>œ¼åBÐ4„°®Ðœ€°g,} `ÖBìphÃÀ©$øR*ZàÍ(;ô[‚& ®‡Òvpj)Ä ¨•[ *…S) ÕÉ|ÐÕ†yk`ZL<:†ð¢ÚÌ6‡%t¼úP“ ˜Ö·H#)Ï~yçiºˆ¡åìØ^_µÓêŽk™¹e„­iå`i¢Žˆ„@Ú“Ûo>R Õö¶®Îæ&ˆHˆäå½;é¹e„­aåʵ6Õ-¸s|ǃâê–’ÎÉ­Uùoµ]bÜ[+‚¥¯Ü(ìï›|ú¬[pdÞ“«éE½–Á>öŠ(ié½÷¿” uŒÛ†ø»²JZ~þôe› îm5ªOœ½•y7ù]ß ¥y°¯#£&Mߧמ§}–Õvv^ÎæFP–véf©}çvÉw^ȘZŽáô˜ :!$ûÍÃçiŸ¥ÀjÙÁŽëÐAð!e÷‰óª„wìàáÀ¸ž&àå¤ÞzòŽ'A}Só®= ÿËáäÔ„¸Àû—.d—K[´· p³ ±å§Þ¿ÿ6‡©Õ2ĉ_û¤2ûÕgé|)1lcènPùþÐÍ/=Â:={Û‚gaÂ)yÿäö« fÀíÐ(3¼hrå¡-Y¨pNœÞyÁÞ+Å´dåÌK:mÀf]–í@½8ºe÷Íì†-ˆòaÜX˜¸ àúb;ú[_˜9â`äþï¹7-‡qãa ;¸uƒY¿BB(t_ „%…éà×5ß&L„ÜjÈ8 ê&Ðw$,ZCzB xU€ðÛ@9,š ™"¨þ ˆý-†ICÀÒ¶=Pt »)´nkÓ|÷ÁÇ;à\_nV¦!:UAOÄ· HòË¡¢Ú›Т5­#Y+hÓ&s]q’›¼20nÌÅg¯¯ïOð >÷IR'.O\ IDATºkwü¢ù%oîô´@@¹½yÄàY¼Ï)þòúæ”þñKï•B¶ÿÚ{ÜŠ]_ŠJ3ž¶+MBŒ2©˜’I廥NêÜ1‹Šj®MÝÜ–¸çÆSÅOÜðÇÌ_~Ùõ¬B#ݺpĘ W !rQa\`äòÃ7ª«ŠŽ­žå‘°œGß!’•îÙ²1­X’²Õ«×,ÔëÐËêfêâµsFN?þŠB0jöV¦¾Qñ‹# ¾QYÂzZ!$'yNÏQóžfd¥ü6¹ß„#¯UTØ‚ªBI¥2B”¿¿ä3ôÌôâüÌmóGL8!'¿­Z»ø—˜{D—,ÛÅãrBÈÇ›ÃÌ|˜UøùÉá!ã—«(.Å‚'‡|âF]zžUœ—¶~ú È™)PõréêMKûö»óüu•ˆ”¼9Õ¹ÏÄ›o¾ä¿¹0¨ßÄF™1ïÉ®ß×­½ä°ªžÁ§;;ºpã³Ê^XµíèÌ[2²s ÀëÝ£ºœöðCIqö³¹ƒ#ç~Æf1Åå9”\*‘ƒ%Ê‹þãØÍÊê²Ë[—zøÈ‘BàI‾ã>NûtçØš0·èÕ!prN—‘s×dUf=:?,>,)£žâœÿøÒæÃÿ;¤ùóÀNÎ'Š¾å=Ùáíå•QA!J°ë±‹N²QÐÃÞëF™tJŸEÇè7òa!Ž'?Wqv?þ±²A "%—J¥2yÃæ*_#‚"âs@ç9ˆˆEoàwBí¶8 ZŽDD¬ÊEMàGDI5°cGÑŽ…ÀÁ4>Êdø<Õň’g€Ðéµ~z€;î¢\†%éÈ",¤óŽ²—¼ù:¢œd@ÕxÅcÖ6ÀÑéL"hÙðEMW9£º`ïµ5T©@¨ðMXž|X¤ÓoIÙô‹ýó†]z%åAžÇ¢¤âÒé¤\ž„þõ`o×n;_"ŠføÙ,y¥ meAÆ«¥ˆåÜlv®I“ù:=· g÷Ÿ±ñ*ÊØ/Ä~í•"ºÀØîî‹Od£¨¤sÏ„=·ÝÉÜìhóñɲp—~{䊼EÕ á^‰ÞÓ,"•Jå…¼^^Ü¥Wß+hs¤¿uôzD””¤ûy{]MS¤¼©¼=ÃÖi@bæÉþî®ñ¹RDDJXÜ9Àãä“¢ú³+ÝÐÕuüå/Š‡êÏÏÞå!bÊÉ)¾á èDÅwŽŸK¡{UõáŽ7—›YIaÑu;{¯íéŠt8×G»÷;Žˆ«ì{®PÌGFòVWŸÐŒJ1"æ¦Þ8uù =©ÅÏOyú‡ (Ì=acã±1M‘èhï çÎ3ïÒ¾>Ãõö¾÷¡²3¦ìêîéK×”wôYŸü?œàî–%DD”ñ ÂýÜŽ<*P$Sz¼ØÆ¡gbåËÕ.î£iŒÏ—†;ôܪ˜K¹d`¬ï‚Ýw©¢T.÷Á'zPü™1¡Ë¯½¿<îÀüÄWDo¦ìî?•xhAhô”"%—I¥²ÿõ0?–*IZ8åž ~éó'¯ã—ë Ó˜–AQCƒÝ†%™ÝmfmÆé¶ÅŒu¡~TóƒÅbü™.°¨€¡9´fÀ' îB÷ï†ÛMì e æÚð¼ .|†¡ú´zû'<ƒW2héÔ€ú(|†<˜1 3 ö–„¸a€A{0W·b8õšÁ5iý£Q‰.Wƒê*”µ'h}cà¼*¼?ãÀu€ªÍ TsçŽÈßgçÈ¢½ZÑAô}æo퀒 ¶NgßöË—LÿP\)C¬.b ËEª½|ÇŽ)  v3·€€€NuO ˆˆìâmkó)A­‹³íþä#ã‚ÇïnJ¦Ù¾¸V(.”»wl§°‡·hÎØø²Xþøbq oÞÉ£Gd@-Pñ! #!„õõ*?ñlcHH×D€Ê¢49Åno¦KIµÝ»I‡¤T@{@Ê4ؘH˜l“!–4PŸYQ#ºÄÍ4ö–Hhx?G'‹†;h³Þz×Mµ¹Z,¥$H)@¶–+:ƒÑn® ü2€’”t™ë|{zèm-,d´uÑÄÊ[åñÚñ£ÖñÅ2¹°Š (¥ä*†‘æ*PqÿµÄm”3]·YK‹Æý ˆha¤BO“†“&ûÑçâ1` r£`S€¨2/`XXÓÔà¸Æ›JÝ/„Îu´ý¤kå.£| «ËÍÀèÊ—OU%E3c DP_’tžIÒnf`ÂaÐØZ¸Æ°Wÿž/­³žLÖã#,ŒŸ´ÝPFìlmmmmmÜý»n;wwRçvMÙÆ:ö öøês)ì[t¤Ëàé_í¬¦*0¾šÏýYy …  bemöƒæ@ßÔ—pX5 šô ·a²%EêOPe†¢¼zº¦Îv¦ÕÅbÈŒj~]yJp²?<½cæ©“ôÔOA ¤r¶*€|sŽ$ +xêï;°ÔØmôäisçÏ‹1‘ѳâ=|ãÑåÌŻ—Ž´s‰8ö²ú-;¾uZw ÁÇuÓzºö¾þATÿ˜ŒÝÆÄd_¹‘ ðzëÃÞCÛÔÌ¿ [¥fœ,6S*’J«$ fenFffVVVfÖ‡ö~Á. Ñd_'¹\Œ¨ÊbÒçr†š SÄÓ3Ì®[€õö k›¶VÝ Z‡Í9·mVG-ÑéMs¬­}6_ÿØÀ“¼¼çŒý©Á½†Íœ=gÚè~uïÑ2¿NM^1_ÂÒä(^0U˜µÉߎÎê¶øTvÔ/#gΞóë XYíÝx&›£èš´JÄÔâ0Șô¬ÛÛf˜[ÙØØØ´³ Ø ÔkíODMÒSÓf*¶$!…**¬j‡ÃW×cpy•4Õjy4U‰X.!¨0õØO,•2ªÁT#D ‘ÿ÷-ú?§ÝÈ¥„›ðKœaC[¢Ì¦o$sÍúy„+<쪿ã;†?KLV>íøæv“ 3À@ éRû– ¨:‚*@~iÍ f@0A_£ŽsÌÀ  ¯Œô„ð†pk ƒœ¶*0ID6u@ÇÔî¼@ ð+œÀè ¨·¡.HK€à° ŠŠÄ à¨ÔÓ˜Øfš‚Ï_$D—„J K¥ÌVúô 2ß¿|Lµh;oL‚: í+Rô_$wðŒšâ¯OL5zZÄ­ ±Ä>¸‡}p8¶lÀÚÙ+Ω3d-ã±Z¼úXVñ™Âa‰®µ{bQE9€!ü/e"}3}ŽS+Ì·M˜1ÌŽž>©DÊb³$èY]³9!ÕU|ÊT…!Pñ¾\bÜZ¿Ñ²2«ˆ‰ik7=±XÜÜÆwœ­ðž¯èÿkôëuÊ—8”½ÿI” Šø)ù–kAÏDWôñ‹Úp º°”AK È;qæC÷¤S¡>~¹ÑؽJ­6’¬Ï<°ÖGQuÊ|‡þö~èoõ¼œù/EЃƒH@šYFµÓ×lЖš‰ ‹WZA5„@uF‘Ø°£!`em9Ž¦pì} „w@DQ.hÕN_MC ªZ@5g PžûY¨ÙÜÄ@_ |!Ed!!¢² šêqó®‘ÿ¨+òß«Q„÷K?1½Òd¨ƒ1£i3f\Oº’ÿçgÁÒ‘ ¤üûgwýçö„#÷`ãÈ«pÍoüFЇ ‚÷`Ù ®]ï0€.»¡˜jð v†2Ø3 ( ’¯Ãˆ¨’‚ÅðæôhZê°þ=/ŽÁÊU°é€ø-¬] öƒšØëÁ‡à.­ HcFÛÌå¥`Ü¢‚¡]oo…©¸¥&´­o*F0t´6?µu-Í"³Çt_±çiíÏ::R)O(BÈ«“ë_«qª yÝ=ÂŽ}TìkB>ÕÕw£Ü£oÖ$ÌŠ„LõfôÆÏ j› íÑÿéú‘¥ÖîVz5«‚¹kÓa1¸°hu¥e”b¦÷Ëß>áY B@^Ð;&pßÝ«™Y›ÊpåÑ@ð³{ôêuã}qÛ?œO«î”!¼õ3·ëÇOo^§ÁÒw_~@È<ìágLÅ]Œ;*hô7ébŸV›is`^Dkëä""…Tn¼¥e¢"vyÏ–²*¾Å»©sGß¹·¾®xm—š#îÛ‰8€­¹˜^ö½®Ò¦âß7¢ ±>ÏGD”T!:¹«qÙhd ×ìÿš©{q÷~F”ã¡åhÌB&_ŠÕRE1. Î…ˆ¸ ¢Ê×­eØ×WñfÌj¤¯XK‹ptÅKv3\°å´I¸P7¬‘Ká¼/ë¦pppvrt™´òp¥)Q™·«Õ»ù(«Ú9g€ƒ;784jéÁ{¼Œ£n¶¶ý×_*yqº_”¯'×ÛËË3~ÄüÔR"¾¾²«[ˆ——·§—×€idó3ÏþîlcéÑ_ £¢Péà2ì„Â2M‰J:zî=rld÷H®‡w×a>W"RˆÔƒ“"ü<¸>Þž>aëŽ?”"Rˆ2^ª[“#¯EXiccw-Ca®¾>ÄÔ}&m6•½™;4–ëíãÃõ>k¡@†ˆé‡âÌ;oP˜1ÅåÞnÖ»of7ô"dÞêáÉõæzvî=á~v5"òrž†»Y98x\Ê”½9ãcïíëßmØìwEs|탿»ÞÊœ›)T[߈µè¼N†()Ëš;¸‹½‹»h챋'­-\^—‰ñóã#‘žv¾~ c*-žÜÕÃÉ-<-õX ó¼ö‘ñ –éîàìêµ5é²›­íÕôò†¦âÝ<Þ¶pth ·³ƒÇ²ƒèÑeíÖ1t}­ÁV^–¾dL‚×Û‡ë=pÆú/•D” sû;YÛ8¯½[ˆN® àúúùú†ô8pKa}¤Lëáääââî·êàm …ˆX‘uwlo__.7pêÚã qÏtÿÑÉâÃåì¢ÇÿçMÅ?*n¨¯ß šøè@m’ö¯/›xO5¬+M¼ëå÷š§ÅÍõŒ-nöÞÿ6ã·=n<5ÕDùoê¾o*!}]BüiI¤Bü¸[Æ5Ökª©Gª œT#ÙØ;üfR ùzÊh´¸IzZÜ°»a«;@ª¨ïUmÀ=õë~ŸzßÉÇÑèÔÕcGê{?GRûYêÏ[LÙÙÍ£ßñoÚ€¡"õr±@P¹rÞìæžÃL8ÌúÙC±awÃõótÕ!ù^ÕÜS¿î÷©Gš¾ÒèÔÕcGÒ8ÃIM­&êþÀjjÈP£Áì5Áƒ„4Â$à{´-»¾^âÐý?ÿ•×ÿ~¾Dt·¾ŸÝZ"h«¯í ¢&¾Ïšh û°Åÿkù—^ª:ü—25È?l ˆßj×cÆÙÝënG"¡P.WÞýyzÊDB±ì‰¿P?pòªÀÿýPԥʤ™ùÙòJ¨/ýk·Á:ž‹¯tTf«ù×èù7¤(úçƒ2ß” „ìaJ.ñø"d©ëjªü¯ì0R~…€èê¨ÿ…Í¥fsúû6w“T,%D…£®Îa£âÓ0r>/•S &KCCƒ¡U ¿J,ghki*¶L _]%'*ÚšjGŸ@Ä牤25muUæÿ1v§gQ"Å4Í5ÔUYXs_T&òEbG]“Ãf(¦sÁd«jj¨‘•O$à‰%2 Žºš*«ò¢ˆB " CMCS•EÇø"¯²JVgg¨¨i««Ò)ð„a²455™(™¸Š×àË\DKG‡ùU’þ~ífe_îé,-ëèÙ[fxÿ RtwªÝ<µ´k þõ(# ²a S–Y£÷÷1å½õÑ¿Ô·tkÅ,LI/è5{ÇÈÐödÑ°^æšäå•j[v»¸{¢ "!äÖ–_gnàtþt¢ CÁÓGçõ]{%³¥[£LúhUü.&a8[¯y¯1ëz4ÿ¿·ÁV=Z×}Ê!!KOKLÝië…[éÈ?×µç’r–¡£¨’Ò[sðŒ£ Pºd`¯3i%¦fºÙ¹®ƒWoâ ©»ÇŽÞö˜¡Ó‚ÉË•©-Ü~ØÇL³Á¹]–}2¶ßÊjUc-ª€Ï4Útèd'=&€pDPD:‹£Å¡7c4Œ˜°cD¼ß?eІ›ÍÍ*sòÔ­zŸß;NðöÊ/S×±¾ÆÊò>Ê>¿lÎþ'ËûŸú6å?T¼t´ÞYÒ¸k–úÆ ÛX™¦\øN©Æ^*üœuÞ ïNí4·iò×GŠúÎçÕßû9ÿ9ej]äÔ÷]¤”\Ü/Üká!ÅåÀÌC“¬B'JóO±p) /K~è`·òL6"¦,í?nýÉK£G‰k.´^œà7lé¡MS‡ÆOXýmM{éw‡#¢4ÿ¶·GPENôÄC5á’o¤p£Ž\ªÁ(¨¦œûTý›š‹¯!^Õ9NN+O¿RPovŒ}?è‹žƒB¼fí½G¿??;ÖgôND,z¸Ü…; [Œˆ()xäî|1](ütÏÆÖù|ª"òëø¤0Ǿ»vPRÒÛÏ}ɉúʼn_Ã~=†ˆ(­ìà}ìyaƒNŠ+ÒýÝÜϾ­DDå:èÞ^ƒ±ž=aJƒ¸“Ö—~Â.{8Ë4hæ½Ýã]Ü=^勉¼êøÚ~ÞÞ~ÞžQ}'?Îæ"Ý9CMgw÷ ÀQ!¯. òõ÷÷ô ùmÿ Ú7¾›Í¸Õ{ø¹yŒK&„”¦ßÓ#Ä×ßßÓ+hÁŽK@B>6sè’~oïÞñ¼;ÿ2ã³ ‘–ï[>ÞËÝÝÅÙmؼm%rB‰¸pû‚Q\/o?®gÑ‹ÓK$„ÜІËoò*+›yçIJÎ\G[§ÑK A/ÔËbǵBÚ-*¸6ÉØ}!„€ôðŠqîÎÎÁQ«Ž?ëå´ðÀ;iѻΥª¡>þ›ßº:Ú$ÝìbÓgm!äÚÞ¥½=|||<|£·'¿Uäê#äÒ–Y\g§€À°Éë¯ÌÆí¿øNýOIùRqkS3:W[{G3Yii§S¿MÛ–¶W@µ¶Í[êUæå aÐückǘj×ÝÚкÏú-3zê©1êNUþ£#æ¶ÎŸ«dõ¼ôY‡Ìœº¾:³ÀÓÉfϽJ‚ÒkûVtö÷öóñì2èÒ«"BHÙ݃~ s)Œ ð^}:WøåÉÔ~‘Þ¾~\/¿)$¤ð~[ÏÇg~÷q²šw¼x””Ø5ÈÇ×Ï×'$á؃lB©Hµ²u¼síä˜~="Bƒ¼£‡¦ Añùmó¼ÜÝ\ݺYú‘ÈyIfû{{ûy{Eôžpÿ#@B2/n4wò.QHnÊÙþQ>žžÜ°^I³)A6׾㉔ÊJ“±!í‡oyGyvn[\ˆ¯Ÿ¯w`·ƒw²©ïìeë,\¹lH¨ ý68ÖZúùC5€¨üãž,¾³'ý>bÚHÙµÃiWÖm=`J+@¶‘ƒ«©Áí8-.;ÑÙR>øúµ–•Ôó<¨Î{ÿYÆîhO#Œ›1JxawP² ¤Ô˜¬úÇ.È»½FÐ~d”¥6€j‹µ[wxµÕøší èÅÑU/5æuw@DB¨QvÎþólÏ?!šÞ.wpðœ˜øˆ~:¹|xP÷±ô.›rx‘gçx¾ŒB,ïïd»#‡ ½hé´îQ5""~µ›Tˆˆ³G„x‡P„‹ ž…X9-»M§r(íg7øÐúsSöö.Ñ ¡Æ[{Ú‡/yˆGÖkýrõÈ€®#÷Qˆ+Çt¯ØÛÏ-Êí3F}éÄáÔB)­Ý8;9ŽÛH' (h3~ókJÊ‹ uÛ{K±ÏnÎ2ž…ˆ%ÉãÞKo.íæáæôûÉ,DÄOÛœV ¢¨0Èßǯ÷*:×õa«—cd §¢ä¼…Û•rDDÑÓ¥vÖáOˆˆå7—¸;9Œù#¥~`š|ûèqS6Š¥b¡€¿eDl·¹»ÄRÂÌhwÛ£i²Úýñ±uµŽÌñU»A<~ò,_"¯×\þi;øiŠïm¥]ZÌõëš+BD,yyÈÛÃ=µXŠˆU¯z{„æJ¥Y]íœgœùHgq˜æÚ-ñ"bù3gWÏÎ#öÒxÊ^nòt zQŠˆ(Í¿èjw)K‚Õï=<¼|Gí§Ë\ëç1î4"¾=;›ë÷K©ñââh·ÈebÄókÇÄ §‰ù&i¹gp— ‰«rÓŽŸº(’QXqËÇÂc_º+m³qé’!ÅÅÝÆ%^¨I¢qÐɺk"?}§§“ßzJK؜x+n:0Uºo_ÔÒóˆX–uŠëÚ勤ö÷‚î.GsÃÝÜV<®ÕDä'Çv\z¸…”Ïãç¿»Ì H|ð¥þܹ^ÝŠ¤µU?G»XŸÊCŠ_äç™t1yá䑃GNùòûÎÔOY3"yó1#Ý úò™›ÓÖÑõ†¶È˽V,!Jpë! ·ëX7ú¦’鈉=Þí\#[»6@€”'ø¾Ó|è›yFãçöÏؾR€Hd ƒ¥Ó|éH$ûÐU©o7Îß÷7—–÷£WÞ±¤+Á¼¯Ó{OPÜß‹œ5Iíéýû"Pë—`e¤ØFòŽ“GqÀ(È×ëÓ‹ÓMm §¶?j3bZG6 €ßôm­4Á>29€2zóê—1 5£õÀ[OÏ9¨BUEEÇ­½aUÚ{u~ç=£ný\Ôtýfú´j´…„1xÃ&»‚ó^\_ÿÿ£<óߧ ?¾ ôÝPqaïØæ#·tïÄDòˆZ³6ñ±Qêõ¾N‰5¦Í£s?KN¬9l9e·‰*€]¼ ûúÛO “É L¯_-4i³¨KК¶n\ήU¥ŠXgÑ_•[´ÓtÌ&{}Vó n+“;wï ŒéÃéés‹±ä¥§À™ÄS“Vé3B§>¿g˜ ð/¿â;=‘&¦uÌ ³ââk"Ð2éß5L•Ižî?C¹ùõ5g¢¶ÛÀ[v˜˜8ÎåΑk"<÷ûÉæqñ€::[óáxзíõ½¬ÚÝ»~õÛPZ¡xºcü/›orQ%…*_u5ùåÕUr†žz­½œè©3„Õ5Ù0*/8»†õšÞ‚;ÀÝ´ T*ªPgÕVe¨«°(!äR¡P(Ù‘ô0fÔ¬_îžÚ/~Aä–Qyۇ󇟹|cï¢.‹úG]H­¦?þ„ä^L¼Äñšá¢N+ˆ¤×(Óœ[ùç•5#}WÌt m ]N£KÚPKKÁƒÂ·“L|ÁoîéÐV……ùÚ»D¥È[ÚèBM0¨–¡¦¨íEãbÂ9QKì bƒìù¡9ñ]G&_ݤ€•׆žeÑwù¼þž?²ÑXD¯¢M EºÑÊ´bö‡•q¿+~©®¨â}*ãûµfaY9ð Bj¦†’‹««DE|0ËD^I—9$wÇ°ÀÝŠ¦øåe-¾ä³%Ñ¥“eÐÓ‡r€ÊÔ<¶e-ºc„¥ÖÌ@ àc._ýÅ´àÛŠüBX!ãÝþ ˆ3ûú1ßÌBžžNzá`ê"ñžì*ö9˜¶j`GñÔ/Ýg_|Â+6Q~Ey³–_“5Ò3ú­atüæáÖê´{Hƒ‘T^» DbQÓRW'ÈÕ‹b•R5dÓH@7êQZ”\PrrÕèžÂ›G&Z¿&GΔ[ù&تhˆäµQ$•À0ËÕ„IDATU5`j·¾q瞊Š*@»–— ðÎúôã 'éß5Tˆ@"­ñjT iPŸâ½yý—÷ b! a9õÛzièÑO0¼ T¥ŸOè¿0tæžÉÑkxX-"U¶,hÃõ6Ð]±¿«ª¨è·¿~zO驨›p‡¥¯F¹Ì=±Ö¿~æ^Fc¨ª¯&+ãÉêM¨qä⾯7i4î@›ÃIi=FñU  ëh}ûÀé_Fs>—šz›ˆ›©£Ýø}›"ÌšB…„HV ¿Ê ¿qJ-Ëp´Ú²™eÕÐR€ˆÞçóZX˜jVµ–ßͪg#@ÀçybK;cä¿Ë®ìdÙA€¡Þ¬ÛÔ™›<‡¤ðÆçe}Îese†¥UZ[’_%„f´ÃŠ—V"lÙÑ!´¬Q$Õ1s3ä”çV@'‡f¤Hµv†Zi±Þ E5|–qç>üJ»ÿ!«ÿ’kÀÄÙQóúŽû Ž’W$_¸'«¯Úù{·É~ò¦²æ1'íÉ»"q<níòßf”ÔÔ+úðüM¾°iª;Új<–Kè»I•©WxØ\£:îõ+W®\¹jMŸP+ÍæÚLêÁÛ/4ÁžnX'ñìkÆŠOW<œÝ^–PtÝòÛ;³ÑÆÍ,z Á;kÿ_{çå±õñ3»ô¥Š° Rq‘Þ¥7…Ø•hH¬¯°\‰5¢D/±E4ŠúŒR%(†®"U@éMv¶Ìý° ‚ɽ޼y“Ìï ì>mvöyþ{ÎÌœsª˜€0»/õu¡ª ºñÀã˜r&&Rûó¸—÷§“›ÿh™Âhã—;­—ù5;›Î¢=J¾S'be±xÑð.‘µÛø““«³·“«&?áauèõ¤¹ #Î#eòÙöEÉžŽžö6¼Æ¢Äìò ´Æ)ØËðùÂrU¨_‹Í,áשå+¢“)@ÙÿŧŽ[×Ôýâª?2’î`-k €·EÓü %x\RÓ¿àThéÆ,O‹ËfŸÊð Ïkºô‰S‡&`ïÞ¢øjiI*‡æ{‰8†¬ .1˜Ê¾}¿Cf² ՖФ¹2Ôó;ƒw»®>Õ±n¦SDØþ·~Ôº¬|š¡¶\ö¹Ú*û-¾ˆ˜aî幪ÎHcbzB©¬úDþYákÃ:¥ŸÞDSó·y(À푃Ñ®‰ *K‚ËBÊ—Ÿ¾âL«¸{,$ž?ñ¦ºû,<ù?{ëX¸ëõKvc[h—-t(ô‡=aT¡†ÊšvÎë/B_±¹²;쥖'ù펾tý–²ä¸ëô¬CNm¿ÆË?×VoJiƽÜÆiI¶V’Ãf½Äæ:í~mµ‡‡µ½=­§ê~úc·ˆÛóUeFGgËwSm=\W>u Ï©Ê½ÿ BâV†ÕÄq¾>›Ð“ÿpÜ°d}Žž"733Ï>ìº2Àš/÷Æ, õíp4S—ÉK¹óŒM›Ô?üÁÿøÝØWemCã<—ZéTå?hÑôÚ:›€¥M}æï´ßÕ,vu.ÿsÏωwqö+u4Ö¬}œ’RB½šn©¼æ•‹]]Žeº+U„g¾¡QÂ86[2øXøt™ 'Ö;­[ûsìYN]nAñøó0ÙbŸÙ1{wg?I¿J9ôЕpZ=çäjoM afCYéK—ýßÏU‹DLéûã+]7ú@׀Ƭz\ÔzæÞRf¶B[4ÐÛyž®Žh÷Ë¢Jÿ£·T`ºû§zQ«\<ŒéÕEy/(Æ‘.z|c¬:»’¦²p¤K t¾®úè©KÎ(è@ªs jNåw ·«&5« ‹É•SžmaªËObØÓP‘\Påìì$J„ØYéÕÍÝ4yU +CñAW¹&/þirtq¥B§3'ýaCSLFÑÄÊ\^ À}gÖzЂ~òÞ~75wÈæ.›j¹Ôc#„:_•=Ì/ HÍ7·U“¥bÀ#/-½¶¥ ¢aa8W°ìAÙãôç¯Ú0ULUcþl¥1W·Õÿüô9GHFßÒNEjÐ(ÏËxV׊…$fë›jM“òü‹s’Ÿ5vÓ&Nµ±¢‹ âÔpó£¤ìþ©K̇û½øEÒÅm*q»­ÿºá˜µ)ÿ ˜rì-w2Ôùßì?møÓÍß<Åsª®~v4î÷ý }Uî«{9˜G¾NÁÄ1g«Ç²Æ_§C:žœ Ozñ§k6 Ñ|oTŠÛéçæñOÔŸ­˜ó¨h’Ýöø¯\>þÌû7šµhœŠü\FŽtÿ? CÉŸIìöˆ±â¿J‡üy?‘›1žU^ÿÛ7-\,".©¤ Oÿ·Úö¦ž+ª ('Fú˜ð·…È @ø?â£*1 IÕHÍ6ȉG{*£M‰wH>çÐx¼6ü®¶ëûã]cýKn'áw“„Pû½õsœN¡Q¹d™Í–f ŠÛGå{Åœ¾Ë¶XÓM­œÝ|ÂÁ| „pÏ?[7ÿýCËLBM¹×–;ZÐé&Ë??ÔÄÂü̬\fÛ7Û×™Óm=×gÔ0ùûi B¨ôÞwkcúB“µ;O·qu²  7ÈËèñÕ‚l8á?Ý»«¦äEóèwo¬ÍŠÚFÆä·‡Ú›Øm®zÕX[–î<ß ¦BÏ–uÖÖ`Á ßån†x™ùÑB‡'/[[[soGY8Õts1»ÚÏÄpé¸úƦ’”s:zV©­¿efâCõ~øSL¬}‹*kꣶùšº­erxC”<ÆÝOœtͳގ]¦‚@ ü{!š|Ÿ¡õeÞåè¨ÓgÎÜLÈa`€7OSs«øû´”fFŸ=sîâ­&¶èÐz¿ÞWÑßž©ïÆýõUmSub"ÖOÿd²Š†Å·»4ó.Þâ¯2~žZv >×Ï`òðe’Åñ×%,à f(ËËËÓ|…ØÝe © Ïhj1»Ý¦NVÒ² 8ã+ñÕÞDèz™uþ ë½ÄÝ%Î_Ëj~’píxÌCþpoÅÏ÷ÿùmô÷…µoàMajTLœÀŒÁ€­gÏž«éèo.ΊºËųú¤6¿¨=SEYyʦ`ÿ®¦†Z'1úx\ñ[„¤ ¶mÖÙÁÁˆØ7ÂÇ:S³èœ“϶çHZ‚šzy¯çg‘€Y•}+:+ï9®ÞUÙM‘¨ ö]3iÄaµ''%¶1x¢Ó\Š>=ID0úÒÑÒ#8³$&HLÃá²AÆd.SY»i¹ u=.£¤ºµ¿61¹WMËJnÄl»`,QTÕÕuéÖG/Gö?I¾ð‚ñþÂ?é ¢}m}ä–"Æã߈ïïëFÒjž+6x®Øp¨ë¾‘áÁGγ%g)°Ë«»A_ c`³ºyÜ¡œ5ƒöBÍ…1'R¿‰[¨,¿’¨·ú EYm NQ”„¡¦½0«©©ÃÌÙÇc@èÞ®õ’Ö‡¥F¨Ë¹Ûø'Ê)q€ç³Ú’(?Q‡Í¥ S1ˆ©/WÄ×KZUsRµíw‘tüf7nq ´8ï5…ßÚ §¾“=JF §³Ÿf@#·ðÑCÅ€¯÷ûüD<ÿ%ûuK|¢â;±BŽ+ ªOlÝAZÔÎÁ$b3š¯Ç\}ó–=e>£Ãcn.T¦ ãÍäȹ»}’¾{wB=52™à­; X•«=ç´Buçöf‰Gn3€ÞúÒ+±ñÜñslbPУOïëÙ“!ÀIa^ô•0 áÕû\Ó.^KØ·j30„Ú+ócn'r1ød¦J_ô– ^. „òbN‰)­Ñ–àfݼ”ö¢oP4{2«„ækOŠ@øxëQöFy`ñÂC˜BWÖþúZ”@»¯»·æyŸ\[ä²H_\fʺ{„âÖ28ÐßUqpŸ²é²þ—š™]Û\ÞŒ °ä*NŽëmç;· Sy<ÐÓ»5À¼Q”½xû ¶Üa7: °˜¼zÈÑË6³'LøáÆÁà­®ó[Xrªôc¾Ÿ-AÅ­¥™_›ìêá"2²ä׫·—Á+ÔÉ—’bŽìÙI§×# jÚ®Jøn5?•¿„f€t•iõ¼Uƃ9—^åÞ ÿgáRÏÅT ›_Ÿxz¿¾Î+h˜}îâ *+öÈv½•: 0ðšJòLÐ,iR'˜@WE~kÀ{Ù8adýã1}£ßør¼ Ö1d YÚî'¸œæÓ1DÚÉëÚÁe€(E‚gëf«ßë êoíüŒÉâ1+ç$,Ís×.Ž v}[ #€ „Áa3)Ïqkf…XþÅš„TÐXg‰”skÇ.:ÀÒÑ.*¡)™ÄcøÒEÑŽÎ|ð˵£k+K¾<µªÿ®ç÷o—?õúÜšÉëN}üœÇãq„»uëNË·nh®A€†šºgë]¾~Q“E€ ‚ð³ƒS°:Þ|¼SR½Mʵ« Ç4üÚÆ1u(éæv—[Îß67ycîw^bºîXßNg׌Ÿ¹ï÷B»á~§[ç©T†@8l& ­f`{éärù_Q7¬_iÊT"D „ÁVð(«¹ª+’w¯Þ~eW¥¼ŒQè‘ÌÐZ*—ßUzœœŠWl=üvBà`ÿ¾›ÎíÛÃrøÁW»{3i {ñÕ;®¼šÏvô×ï¤gÏ)§Ž/èA–NŠo9#²-Ún¹qfuÏýîXQe 2-œz[2ê›Æ—±XìÈ͗ƶgÊÿËrŸû^ødH‚¹&ƒA:µm²nÚä^Ç—ÈF˜LvÅø'Ù‡&—ÚÎtMÿíàƒÒ~ÖZò–2Y,ÖÏŠ!!j ÛS÷ÇÎXÑBþ &‹-šÉb‡¬9?ÕB§󶟺!ÿµÈ§cö¸G«¼y5¹Z³Ç¾é2% Rù òãµ)’÷öáSQ#o³Æu!Pºdζ{ñ®Åœjw$⋳Cô-Ï7j„Éb1«•d0äW¡ðÆŠÞ 'â×nŽv1åï]4²GPì© {šq€ÉÑìª_~"³¼wkM9ò^^Âfì‚ «DÊúíòº¬:˜,–cGnÂÜ—VÇUô)›Å$r!ibÙãÔÚ„šÏXž¸pgvì4q·ëó{Ö``- AÄZ^ƒõÓ_ÿê)Bî^êã`ëæîfã¸ófFõ–Rüfú€`'WgçøehB!¡¶lÝæjÑyȼ3Ý'ÑMoßÔrRñ ùz¼gë€í@ýv_«^·Îéêmo5rÁ!1!Ê–YN UÏÀ@"ï£)®îîÝQ.¿Ñ·ÄDÖG©¿N.~}pú¡Bë­ ~ÊŠ¥2@ºfS²º@‰«^êߥgñÝëm:ªÜŒßóšÔ0·OÚðjD?çgN‚?%/R!sز%·V Ì£äòW'aUƒºâ&„’•9SY„ÿörÿîŽ.nvNc—ìB!‘^7î>1¼oLH¯cÐÀ7eørmL» äBž.ôé·¿®†pX²ã‹Û÷tèÂ=©õDPZÎ44`I¥2¤$ CÛóÏSœ¾/z0nÙi¯©Ë£]ŒVj13Øh§í<üb†óÝ0ó(]ñérií–€ø¢ÄimBòÙÕkúÚÆÉ«7ßþò-Ñ–}‡Z E%ý¶/|]0¶·½ƒ‹«ƒ]ð€)ï‹(BÈã¾v£®ü?$*2ÔÞÙ{÷µTQÖ=c3›¯š"ÒÇûZZw‘¿»®ù¥ÖMñ­ß6$-ºu¿  ø’“s/§w[W +jPØ`~Ëooµ æÛÅj[îØVG¿ÁÛE7¿~à;ï1E—®ÎUÖ÷ Ž†¶&jêú’·Géù·€>Ý,öÚØpo^©çÄww‰5Y4¿Ö…sNIaå~ü”^R%$:õ›êkq¿ÃŸr¡æüI}üæΊ¹¸Q½ú-™¨¬ºðZ¶hÈøñ| O/®~%èt÷ÎØßkêÆçôâé°žÌzû†Ü Ë<–¯ïsvYL#˜wåëj¿†àÒõ+.žÑjÊÃæß®nuÏ_³ç—¦ææÑ`¤©),(’U©qÚ{>M·Îb±3:aP¿)Ke7ÊB#ºÉ%’P´€SÓ$Œ&“zµÛ6ÍÚÜy•\¥n0;ô»ó»û’Y3ogù»»è˜…\=N‹ ,.Ù9!nOe•´¸gÂÎ~ž-“­Ùà–úGßó|=Z2ñG½E _ÝŒt¯ò?Ÿcuãì<<;9ú(QIV.¿±yÄD³J9Dõ¶žKVE ØucG¬r·Oåù,2äp=c,§®Úüzå “?Ñ4@·Ùû–zw¿™éêÚL[ùÖ£uS2Iå@â´zzCèZŠ„»Š…‚¬ô4!‚Esêñ³<èØPæ/ï2Sﶢíohpðpkñðßø@Aþë\†žCJÕ]û“A§EÛöÀñ¥#½ýöÜ~p@OI”zMÝãìsbÚÜÕE…ÇœócæÑ€òÞ6¼ªÉ2)Û° U$‘¢†WYp@S}.ÿ­@>L­îÍtŽaÉêT¿ÁÎlYÒÓÛo‚Éí•m¥Bœtä’·î7Ž&@ ppX@™ÃtÿŒ%V'®åûCŒ,ƒŽ/‹ÿ¶.@â=}㘎êÀâm˜ÔvÀžeýj 5çQ›n‘‰Ÿ"«Ô ÿãÌÛÒ¦f{FŽÜ@ K s®¯ƒAkÿ䇱šÁáÙ®¾½¦Üü½Z îs÷ΰ3ú¾£íÛEÀéQA—Kõöj «–+b BÐŽÂ£Í LùòÌàÎã.-|j¡~Ø"-–r¿HWô ¿Y €ÒÀKû{™TøDD›¦ Ù{óµ±C?í‰ØÄ2xårn¿Ó-ô, ŽÐ×¾ÓŠ f£®—®¬,øêÌÚA{ž0Ô¸Œ’Âr0Ô¬%Hý*ª×H@¡V†Ï ³¸Š×¬ {NôØô„†KUF«ã^ ÐÿcL€¡Óçoó™ùd¢²ºAƒŽ^§×Oý£uBžŸš;bùeßȸMô òUßµ¼ Á' ž¶q?Ó÷uN¹Y&Ý7ýO¹Š $®Ý)¶º¸jœ|Aiý¼êú†mRñ›Z¨ý/óKää–H š+»©ã›×XÆŒi¦Ž„ÉÔLX7áDÀ9€øZ—å~~òæåÔήp¯/Òñv|ÈÏ7¢5þà ¡Öº€ÍUç©k ÂÈ)3œGÙ/ª¹²E¢ÞèȪÝc¯Ò–W“þäG£ÝŒ±#ä–6‡ä Ÿtªº×û“Îz·¹vÚnK.½æ±?Ców:Ïo§çí¹v¦À»µS2ë.Îí:0a¶#¥ðÚŽÜ…×kXgÌðÉ |‘ nýfP–vcâÌu^ œ3ïø$sC5åÑXþáÑá€@'D –š‘{§Öïß¿mËù¶%•µšëî½öÐÃØ +¾¤À­×É&V#­¶cXݸÝùq~Ü_~üuóãiÖÈaÃx³I}&/hÃüž”ü”áQºö·ƒ¾ëM±V€{o.ÐuO-íse?ø¿¿é02õË\ÅBd”â÷þI£øÀ`0X•£¨µnÄãîIL–ÿMÚ;=aóü¶K$|Nز¬eÇä= ¹ŸõÞÞ¤£²L_9qlÉÖóÚL€“ë²l<h@PÓ¬ehRü·N:°¿>@ÇbÉŒ e#S„|?‡ÁbÿXFõ­WLu]7tV2‚ˆ†¶ñÎÚïWÞLc홿§ÝàyMhmì<"ªÞ¶iå0¹¼êº¯F„Õ;¦^5þ©¤êY6O£VÝô£ÑÆf¯+fßÙ}N .âSu—fE2æs½NíÕjTÎhÒÞÄØØØØؤA=W¶tŸs>hØôO¯´7ÐæÖÌϦμ”.ÒTç2ØN}ß¼u[ê»zvé²!©›&ÎÛy™Vx˲ŽIáù VÖ}Œ«öË~[ëìüí,¢¦ñgx„ˆÖQSº¼í#UÙ“ýgL.ƒ–Êâ´Íw^‚˜®»×I·ÙS?í^´ÿVnX¸9þCbw~ÕÇz ì»;z¤s`R}¶ÄsüV§/½FGõX»fP¹@„°öì™3hÔh×Mš²bFc›Õ[Í €H(R(g©v+_mŒqvv_~ð¢e#E‡¡L$*üü2½ŽV ""‹rSß4rÐ˳•’ƒ×ï[1zäl ‹™\55{«.»z[Ýà ‚‘ÖæL¥/7¼ñòÜÎÁ‘<— ¡íÔåVfa“C9uŸxôì"…_ƒ–IÂjËR©äí•íæ;”:Wæ9gÍ$w¡@ ¡«b½,£&or‰^~{_¼“T$”H)ÅrÀÂ=ó]­ yšfá;gøv±Ðì¢T$”QtUò!áÞ%jISwdRIúƒ懔…Ä"pÊ–ÙQŠ?‘PRëÒ•Æ°Ùý‡µ~ݲ=Ÿèo_ž:%vn½i­EQEy”• „ÆÕTo^jÛ~f<øÇhšVþWã"]½ÒtÕš®ù]½Nš¦1ãx{»Þ’:ßXù—Ô­§Ò;ê"·f%5‹~s½îº*ËÖV¸Zk#©ÚúLþÎÛ¿yãwIV”ú–òŸ$…¦«µ‘¦ ÚÛt/ù‰VüX”Qšs%x}ÖO0–¦ëj‚\°”­âU â¿ß¯up¦&çFH¾#N5å¹–»5Ú<¬»Óá9ÿ1ÃÿÿðË«OS¤O ©³¼üþ·a!•e*Ðu‡ETü•øÇôøqà©Y„RëÇvjû0¯¥pÕ•:j©v…Ô=)€L*­Åd&L›YƒˆŸ Q,“:‹’û5ª‚wdµrêTSÿQÚÿñ ‰âq)§i¤¹ÚO0¶Î"Õ(3¦N1R¶žäqåß~drØ5úô'*«Y¸–’5åù{—JDiÇ&>à;-µnð÷_ÿþå áÿf%K~ÂXS ŠŽø'XþAWýBÛÁÇTHSÞÿ]ˆ„Q¯aK[+S–Bà¨ßOŸ+¬P¥„ÉnÖ¾k—¶ ‘¢³‡oš÷nÄ©ý“íÎÙó¹RußnÅÖ7@xrùBF«[¨—:à‹ÄcÅíý[ñä“\öÛ§/R3E2P×1ìjooÈyÖB]š}÷QrA™ˆ­®Ó±«usõÖ\ôƒ™ÿÿglcáÙcwÃ>^:"0²iÆ­Ý/Â$@ë«TØÿ†uƒ7 qOsݹ,ªÅ_ÐG%±æÞî=àÌ÷\ÑzãÁ>mÄy/ú†÷)Ô5nÞ¤!WZ–ó9=UÔüøñm­µÉP'ÏÏl̨#BIþ§—OŸw²}E¬7ã~3* ï=:Ûýââɘ.yCîÏr¬#Nôì1hA„÷¯¤å77X&„âû*5ñ÷³nyŸ¸î@q—[Q-P$pÔx2±HF‹Ãå²"¡¢ÍUã°AZ&IhD“Åår !„’ŠÅ0X<5–@ Q×àÒBËSg2¸:<–>ÀPS»¾=..NÇkú©¡•ÛôWí9mé¶sÊ)ê=f–sù0*˸ìÛgdAä ƒŸH½ãߥþ®kINý]ä§0m· ‰‡FþÓše7ËZýäž5O‚±ipäꣷwð*K»6aïäãwz¶fËõKÉësžýã=¼/Ùj*@"KeÂᨱY D %"‘”¢ apÔÔX @D@ÄSç1©X #\‡‰2‘@Æâ2d¥¥­A%b‘TF3˜,5.W¾ï©’ÏL6GSsªT, —Pb¡„©£Ã%4%‹)LWË@JR.FMu®œ`¡PÀUSgÊR}R‹Óbá2%‰),¶—CªeT@B@"V´‘ÍQã°P£÷h©PDsX ˆ@W›].©«1B‘††&‹¥ÁPÓVÓ6PC¹<¨«3khFWo  M¿\P# a€ºy³i(EaOX%ÔÔ¥ –“jT,¹º®PVšš@„Bʀਗ €P40XÀ dŠXlàñkt2 ˆÄ@#0Ù ÎS0¦¼ hhp/--(ç²@ åbÐÖª.cR,ük ã_…ùa¦Í—G„úÚÍØoÔüóÆôvö¿:?dÚŠÍsví6NˆˆÒ¢Xg—±“â½\lÌÞ‹ˆ’²4/7§ ØC£¼'ÌL0³ ç#Òâ4‹N³¥ˆtêãGDAvò»B±èÞ‚]"²«Ed MQ´âŠhˆ£ãŒ›•Q(-þ`çàü®XŒ˜ìÚÞòzq]ÑâaÎŽ‰ÏŽÛwí] ˆg­ uØûâºs‡ÀDDÙßNqG¾ "â OSÓ凌aD•Äœ_è¹°*¼‚¦i±HLUx“8ÏÉÑ~Äø„AaÖVÏùˆˆO·v²³3yzo?ënCó©²,[{§¥Š¨£= ®±‹“±ü拾{wóè3q "¦ìáhg=`è7g»áKO!"-* swu0m '+«E'SkÄhìžá>r­kððµ/qZÿgŸ iÓüm­=ûo’" ï-në9EÁ™ÀÛÕæá'á±e#­-\&/Xr1›Fı‘þ¾Ó§Œqµ°Ž[~éjïøxs©³£Ý°øIC"}¬¬ü’J¥}œ]zôœïéb;hîDL?ã8lŸ—›_쬓˜w¡£k̪h»˜¸þyBÑ“‡)RÄì·? PÊOs´êú*OR³ãpZ#"æ?@ÔÄz”'Tô.§ÛÕCŠ‹ZÍP€ˆˆ·û"ú…(®3X¸ó%"¢ZEI,£pœkÕ_¶:>/AD\Ü à„Gˆˆ’7¨Å®(CÐ|""fa=fÕÅH!"¢£ªYáÈÖóh4b£N8!¨×lW+@í–øoÁ¯R74 “ìM<_Wˆsx Ë¤=w©/þ],bv¥"""?ÖÚø`½¿nï¨JÑç£'nPˆ·¦º» ;.¿vbñs·^Dš–J)ºF”TÒ‚~}×ÔV]ÝÈŸ,K;éàèX(¢~FÝœÊ(‹´Ûz3i”•f9:¸– Ÿ9˜|«nðæ–q&]lÂzöI˜¿öþÛ¼Jr–úwˆÝŽô÷ã¯$s‘àýe=œûï’Qþb¯©CtYu öÏê5Vþ;ïĸŽžËåŸ]ìío|æ‹ï-nç9µRÝø¸ÙÞÿP†‚û6}åºüÓA]º/Éó¾>²´qÏ”ÐJ}"]ìÓyÖSÅßç·¿/)zwÅÞ½»â¾èÓÑ“7)ÄÌ3qv~ 5òõ¢©©Íº‚Ú¢.eE…E2êÆ6ä ´AD,|¨ÞÓ±´Íµ3Y".8eexc=`}¤ DÔ³ÆÂRL»š(@äßClê†B!"Ú€^eX’…v–Ø-"âŒn€ƒï!"Fi#¾å£XŒ{¦c·!m‰ø¨Åb<¿½»c‘ÑEÐr(¾|‰29ñ€1 ñå«šíÒÞ¿FÝüª)B¥>Ï7lß¾Ò⣥ÖÆ-<]šáïÙ 4ôÔ)~ ­Ý¢]}~æÀ ³¼\Ý||\B{4_ø½Ôa‘§Ü•àëç:åäQ „©«§WÍ)" Íæ*ˆ'´8ÜÒ2E(Âæhw¸zÿ ¼>¾iÑ] ðó®%^ñŸqX—ûS{ÄP*íïe?áÜ©þβŸìà˜UW#µ†Î–> |7éÉ“¤»Sz9JÌg¯\ëÖVW,EŽ÷Gæ/Û=Ô~Ôˆ(fD€‡§·…›?||ðJM_ÏDK‘aÓ¢“ýçIÀèT;Ó$ºÎíu¾d¾äèêµÒDžù•G—„Žg4 ×N<8,FÃâÔk…¤¼ÿ“–µr—{IN{ß¡ûPu¹…gh«FN¿.rЬíµ4 ŠKêÀ·MºXÞL˜È7s1AM @ —Wƒ_XØÁÐ\av"Ì®x£§ ¼ îàbA‘8ÁÝ 6|€P'ðtßP¸8^ÉEÅ„+ëA+d„ ['k:Õø¨øä_ð1õ˶h ŠÊYšÊ aRÌf*É †F£I7»ë>8»Ã£K×ñ°HÈÐSgÈ‹puÔ‘ÆïøM:Õ/|ùZ¤0€¹Gž$¿~ýúuÊ&¶¨jÿKÇ aà 4hÙÑní黓»·ÿé$íØ!®Ÿøâ± €óÏŒžXë69¹ÇW½~+¯ÀðI¿­¸úèÍ035a#£uG½/woù&zõ4ÚC7˜ÓKú%yþÈŽƒ^æƒT*b2ÔäƒÔ¹¡Lð=9ãéÊ•®T&d08 %¤U,fRŸ’Ÿ=}úôéÓ?¸õê¡ûMzB&OGþL‰5yì =FtÕ °\Fj ö®öx‘ˆ0òÞ³Œ÷I IDAT?~úôéÓ§¿² nÀª–"Ö¼ïš# ûAÞ«ÅcÃì|ú>ù"cj69ù𦷱öý3;ÜͺNÜtQQZ£^U8 “ó°©·P«©[ò]G\à€ P)cZúÀ¹.ËjûWIé/oÁÜ ÐBF„êyU¡ÿ%˜;´Ê`Ë*´^g;+ÆCv¬…07 - ´²æz £;ܸµ„Þ+•«¸ jÚ<™@ô“…i©°T¢ÖLXñcÇΣŸ ñmc({“)€Nð%õ‹ÍüfÅ¢j=Í xx‡¾k³&ø6ÅJ_q^‘òfö¡}œ›|« ~Î\ëê.Û´úĪå4CR«ºùtçØöwÚ3úyU&ñ 6ž}-»À:¤ÿ²éÛ3ÍÔËÆD–çè|üq`#f¥‘À/-oç4Ù1Ö‹X¿õè‚ÀBQ1Eˆ|EÿS~v}ÍŽ€@>^€”~áƒÔÐcº:Eâ!D ô›'O ͬ,[PwÍã¦ôl,wÙ …Rï[—£¢†.͹§Rs+|ØÒ”b°i¢šR̯ ¡å©ôª¸Á´mÃ|Ö*pò8ù+åbu VeÕC~YYk[¿I¶~°{Fﵫ÷lŸU"Ö ï?6¼?€è¡ƒYüã>õ¡Æ¦éÚf%G÷<§ü»@0Ò2\;Ãm€€ìbÐ×È„.XÓmú+ …·P¿Ò_+ß“-¾l=šL€rÐÔ„u=aQ°… ’W8 øš SaêZ€5aÔV¸Pvåà?Æ,8<"©lèÝìŒ+~) ´4ÿ®â_eÝ »MÝÜw~â BYI[üý•‹ÄbqyF†@ðà~–) &$H­ÚºG¾ù©â›7åÓ5Ô>Bóy“bÏOØvU( …Âäk{}Âg·p²1ø1 ÑÂJˆkÏ,ìvqÏü–Îcëêå&´n­0výe‘D,‹Js’C'_uŽ ÑhéØ»OÓò(w—Ó>ŠD¢‚Œ‡±~¾…mz6b*Ôò%ÚÁsÛóB±X,‘ÉrŠJô Œ´M¬[–åO=“.‘J©²ä‡w‰Œ¶FC]M/¢dÿõ±}/ðÛÌ/zíÌ[—ŽÝ›,–H>&. ±žÉ„S†¥¯‹Í(*—J¤©ç—›û×½-Ë}Ò@8·ô|Z¹T*ûüäX‹e¢Ïlcª›óà(Jööø ¡X–ŒŸUbÎÃß7öfz‰T*ÍMI´÷ ü"SJ¼ù}=7<Ê‹Åõ¹ P¯~óÌ{›ü† Db±˜ŸñA¨Q¿áOŠ!!´¤hû–­BúGCï ÄÎ…=3aýU`¶}¸p «=ìÝÖöCNA¥!vt,:S"A`M™ÀÔÈyÛw-Û€©\¸‡v@9Ø€:Àâ^ £¡Á§´kKöÁõKpá6Ì5 ¢3´k³vÀõ+pòÌuÿØÀj¥Ú-k·,ÿÇW¦føw˜w/÷v÷²8úPîO-‰hov(GáûnßlS2…H%Ÿ]èfgccíÛsä£O刈”øàom­­ûNÿœvÑØ6R€H‹Sºtx”-­u³¯ /mþ˜X K+KÛÞ£f>ûX(_šBõ·²š|-³62Ÿ»vìl¥»1g”]Åm¬½•¯¯} ë`õ@,¿þÔ²•O6"¢l{ÛÞsŽÐ’Œe8Z[Z[[û„ö;ý8“¦+w"ËÒïŒ t³´´põïyèÖÛÊe³J ÞOìlkkkãì½èÐ]ÅNhAÞ‚‘=ílmÜü£/%+^Tžu3ØÍÎÆÖuÁá''—õˆœ}Å÷ƶuŸ/«ôÊ òf µ±¶ò‹÷®PÎ1:ûáá`O;kk«ˆas3ËkzX÷Ìòˆ™q½òoYúï‚=­mlCNûÄWðüáñ¥Î6–Ξ!§^äú;YÜH-AÄcs{w±°™r.KR¯ÆºZ[[ûGM)ÔØÍ,.Îœ20ÌÖÖÖÆÉsîžë""õâÌê7;k¿^£ž| âÇ“1¡;Rò%±eç Z½ùR~ª£­å뼚ò€z€Ð¤ÊUÌ ÄµC Ì0½Âåœ}Më#ê´Áóo~}¹«xüVìc‰h‹‚ Žn‚Èk‚eRü’„V-NèÈI(”!"Î Bñ@.½8)RQ •-&}AD¤)œ×€Ø¤ Þ¬H;.‚V-Ä }@N#ÕÊT-xql¡{Ÿ)Xcqš®5ãD-K6¢‚Œ;Ïòå¿K“öšuëÿ£|ôŸÉ«@/{]-ÁBÅ5ú›d•*å;UÕ‘á;¤Ð4]ë:[­ìú&C- ¾ÍvQ©X{ ?|um¯¨žQ£–6~3ÕÓ,ÔÖ»ôoþ™åufQ¨Žß³IÈ/ÈÕÍØÝ?™}¢öt‚Uk掺„µ–ÂÙ7‘×ødõø{€ñ ͤN!#D·–ÜÈ—ç‘Rx¸”R|?™ƒ´$ypïÀ¥Û9¶{ȌՎ±ß÷RÖzíÇyHN_å•('ÕrT¯™|§ªï§š¨Rå\¯VªVv}“Š¡–„ß¡ù|ÕʳoõC{ )|nçZTÝÛ˜õd·—···—ÞÝ'® D¿~yû¼Ïî=‡?ø$&±bWwÍêæé×½×¾›é„üó×fA”Šb ýŸÍE„¿í€}÷÷ëþBÊhJ‘ÑþB&Š(ê?i@ Ñ­„ÔAFˆS×»?sû1ó–z?2ÈÕËP‘~çgOG”ýl×k·Y¿bηçÁÐ2aÕÑ?z!dÉøÉe´LB!Â>^glnf˜td¡¯̵3{8tJ[/›øÛ'7~siu€G÷s‰'õ8?kc`¾iy“oÒ7Õ"ᢢLJÓi˲¹•Áài!xxtðšr§í›w`ξ¾^³oÝòÒÅ5ÃŽH»lÙ°YòfhŸðw«®ÎvÓý»¨D$È?¹gÏËÏ¥-ÌÜ¢ýmj¸xxÛ“Ô¶Vƒ ž±í Xò8à7wÏž½õ\ j]]ýlÛ!"¡rï<ôîK©–Q›ˆ¾Q X¢ ¦•@Ñòùó9myúVŠ”¡nåíef„¤äí¬­¿Od½lí©¾£h²’¯M¼÷†biÙövíPO®‡r_]ßúŽH­Aø€­5+æ0ào]¹&OÄqŽìÐBŠ^ÎÜ–4{|ЖåsÇ°8wc}œ9µ}çòïG¶Ü~“ÛÆ.ȣꀘÒ3{ö=ÿXÀÓkÜ·o+ê* y}pÚz1‘M–È¥æóå+Í‚—´BÄfC&/>›*¤ëß½nà7sjODlÞwæü]¯ ö4¾<¼°íqÉÔ!‘Õ«”\9²ïÁ»–†¡t?SC6²O¿Ó©s{PðòÆ®³whæq‘æUòyzç~ËI½\D%Ÿ™ž­Z¶TÖc” wõã¼gG·ÕaBó¨yCή˜¼ßkCÈg^½ s'µ¯ÏÒ|iüö1ÓnƒÞŸÙ~¬´mB´Ó÷c )äs&MÜ¡}ËÇ»Ç÷\pAé¦xA˜åÆ[Ÿ;t±0‚Œžþ!BrÎ&ô¢‘qW³¶†‡çôwì#!To€»yj–V–¼üûÝìº íØ©žX³sók£ÿeç’Õ 0ê>mYzPÇ´QÞû‡6Ï>¦ä/x¼3tÈjB!xþ·èÑ›¯¶îbÓL-?ÎÏëN!€¢Ì´wÙ%r¢˜À‰C#ãÚüñA>‰d„”Oõ³Ü÷´Ä´«¹® ¥»oL6!ÄsÃ>ç[ÙY<Û:içóZ¦µÏÏ/&å)ÚZðêð¹@Pvæô™ÑÑàsw“]ã¢×=—*m°m\Ü qãÆê¤äñéÃæìHòèÖ‚ñ¶O`/"¡³‚=iØÙY ž³õ.a{ÍË÷\—OTëVJ<¼*_àÞÕ½ÉZ‚œ»Ç÷®Zu5Ï/8„—s5¦ïTBPúöõká7‡8ܾ~aî˜Y_4Z4ÓçJ‹SœCÓ¡‘µÉý-"g`©i¹:u!”ÌÒɳuCü”Óö¾C…&VfÍN›rà!eÜ:¼sãùL¶q3Á¤`Ï]OK¬m­è´‹v¾# e¤9Ç3hŽ‰[{„î^Iy@ˆxY¬ç–û9íŒÛg^\0b!¤$ýš­G¿bí¶Ö][þ­÷èÍ7ä¦Rþ‡7ï¿ àÖ–1=glܱkÇ–ÚKt;š’G€,ïı£-nÒªµ›u~q¿KÏ5757nžãy)³Œò6q…ßàêÍL±>‡Ù»¤ä‰€Ã,Ñ8§idžÜü±~ž/ d¹'Ž7½S —…ÎôPï[_DùÇN]!§EÌ:ôÌÌÆFôüà„óE@¦Eø}-¶°²2¤>ô°tÌ,“Õ 4¼±þÉ’yý$ÅFÆݧn™â-ßu#”"‹²‰¡×¨í³Ãäi)ŸBY}u6ˆ‹¿¼NûT£ÊñÁkn昙[6×(éçl{'K城œ¾FÐù7c&CƒšÐÓÇ&Tž¤Z–“ñ63D…¹LýfYo_Ü»Ÿ”ž[.7ME%oj××d!!Т‹Oiö% j Woéh¤Ø3ú9-OÃÄ”ðs2^gæýg®‘_ÏÇ瘅MS„#IßN7'qÍ8×1kŸ#%}üLŒHS"ÎïÖnÚrDúp÷Þ[nË—‰K ÊDHeyZÙ<ÊSÄ­e̖шÙûÍ»ô)B”|¼ÝÕÞ¿sOM4]ƒˆw6†xøŽP¤‰îÙ¶sz,AIqºƒÃg¡‚¶[Ûâûo¯{õõN'3ûýŠ4¸b\ÈÐy‡½|þœª s‚[Û%¼—vŽN¹J…5ÃÇ4zö½m¿´ÀÇoÒ}ELðÓuíÜÆ!"Š ö¥–ÈYr|žOÄ”›(ù¸ÛýžÁ?¿(ÎcÈRE|ãýñ]ºFæË +zÕÅÆ3[J¿Xѵï6Eœ´ØÇÖáhz)Ò)®‚>#R%ïm]fû;ßÉ(EÄ9A׿ÂÌ3qöNƒEòz2϶·‰ä×Ù/ÜuâÞ[òßÆØ{ÏJRÜ(lÙÙ'‘¤¸X:eWõì4dÇGEœƒ¦f1…ˆwõtï6D˜øéØÌNÁÓ*+ pÙùûüšØÁÔíL¿6 ÔnëåÌ’'ÇÍ<£*º!{ÊÈIé4nïÛ¥×ÚTÅÃùg:wÿZ=êíˇ”ôœr¤iŠ’ÝëÕméMDÄü;¦NUDJ{ñ)_„4MÑÔÅÁÝ7=GÄ þ_*’ÇîŸ=q÷ã,ü|´CGç["Ela”¿í¡{9˜w½c'—ß% >êi¿úô{Ì{ÔÙÖ¯Qîdz:E §io´­uÌ!ÄÒH«Î'?(B¿|ü,–Ñ5N…šì°î÷ˆ¸È·ÝÒ×5Â…«»ÄÌ8GWª†ˆâ]ñž=ƦêŒrè°ö¹"N:ÿsŽ@BaÖ»HâåQÎ.SoÈ«Ê{zÊÜ1  zÏ_šåacmÛ#¢WŸ˜žæ¦í{ˆˆE©ìcøŠ€nüúø„­o¨òÑ]Ù÷÷v² ÉÁjç\ý—Ï™Jz•Û¢­±\ë«Ýâ¥Ó•L(–â4´™ ´TÛY$P_:kwp‚Í^à^qq½ 5¹MB­› °n`ê>dÈ@·.­”6d7³ï£ÿifbÁ_ý5‡_ ˆ‰@šÕÜ ÀmÛB=ÿY6´!§N`3€”å— Kîô«ôKÍÕó0RøÚ×oz1/\ar7»Á&‹ Åš!bJXúI´ÔÙ $@L¬ÞRʼnŽ uõïä$tØr–px\(‘ïí&ovY–È~pw\e"Qª•®œ0‹ Jh¸ü¤¼‹O;ù„,u[-úz?´eGûv™—^>WoÕÏíÒš”lû¦’ËYƧM ì=@¶¼.‡Ð2©2)5=Rã†M@x>IJŒ÷Mœp ©³øêGè_¿²hþý7 ‘ÎÚ /˜ ¡6ú¬ ´f5q“×|/9O[š›0q‚| gQ9<øÛhž¡1Sñj&‹IQtƧL}ýz ¯4œ·z!@ñìd,ãnš0€ÉiÃÇù¨´ùM_‹1wHÇÙ&ƒ€†ÂƤ¹z6I` 5e#âüR ÄòDz&R€Ï¯3˜N]tå}×sÆ"€Ï(æ]¹Š„L“’É€V«×­à“Í¢”™‡é%j›ñäõØùµ\ZÑáÎ zÙoha=hð`?;“TB)¸3ïœF¿ßš)3¿âH¢’„žþ™ ûìŸí'— P¾°Ÿß=ð?µ#\9Ãlõå nìؘQÃ<š 88ÄÃ\é0x¼õšî:¾…\Âõ5–)NÑ®zÜnø®SciÀ7û;‡N‹ºÜ‚ÁT>À i¬LÅHy{viØœ.ž5R¢éOg¿ýuÇÚ1­p\×ÈÆKÄyÉÁÖ¯<|Á¬¾:‹ÅZhR(·,uN^¾&,Î9µgC€ËâNƒvnl2dí¡8‰øÓk«–›W¢}îüQ¥Œ+Œð#z%Ì }{üF¼Ú½=(ë€ h$̘­Åª8Žžñíg#aV7S¥n„Œß¹7ñzKM‹ÅšìmüíŠMÑÀ"Ò»¾ñrIëÛÏÔ\ÒùA¸*këëÞí®O[v~Õ8ߺj„ÐÕk•·ÍÒÒö÷ë÷:0÷YößÝԬ᭡J4 ØŽ6ºe°Ë˜†À戕4…£ëÛ´âCrp5à09•5蛺̟'”UÐÏáBá•ZZ/Ï5¯ä¨ „§a³‡µÆÊú«§Ÿë¡ÙkÏ­hSBàáÿéX%v,Ò«¯ÉÈCÚƒÜíº åR‰*¿KAD­y5Èw×é”ñSôLà„ÕÝFKrÞÞß°jòÊ™ü'/µÒ•'¸ (ü<邵ƒË¬3“¼*Ó–­›nÇ…4̈víÞ,nÓþX[¹öADB¾ôôa.?5Æã;~wD4M¸_˜ù|ûÚ¥Þ¿eÎÙ}Å£‚W­¬×è BDMƒÆš€ò½ûÄØßR}ÎÐV³‰ Ô9Åey9ÿ‘-O|úô–bi4»ðèúÁéÇWÑ‚œë¾r8jímýÖ<Ù.?óôg™|íCžº»qÇRžüâÈLY÷‰­9 “f\’¯1Birš¨eSàéSP.fr5ÔÕÕ54ˆ´LÊæÕ˜`HŠï•€·¹Y­ Z|ÍÍài5l£Ãe2™PzãÎTÓjNc™PFDéÓ{yÈÖwº—ô0))éå³õ8jL—Ékþ˜ü™Áü.WQºdÞ¨•«–¼Û3uëSi]¥¼,5Ÿ_{­u™àn9÷½6x»w}ñ&ñâɼþöê åX?óø–‹oì-Üÿ@ÌOMðüm9IçSyêrnq²?qªµ@ß¾<»‘©¡®.gg~‰´Æ4e×¹þû—Ÿ\E‰/9,Vm3R-š6ÏÿšODBŠã#à uܺ2_N×ÐÀÌ-²ÊzþÓÛ,¶gH&“Éd²6?“ÔÆàŒ_8.ÞÆ &“ÉmzŽ hdÜ_üþ‰ G§ ›}ñÍŸyFK}-áç,A ¯œÊBÝJJgs¸Í:¹,ØzÊŽM~—W5Â9z›·nÜ7¦gϞѽcÚª ;úõ°6À!¡ã,ˆµU¬6BƒêÇnÝ4Æ£êDF¥Ð™*ÅHñï?xÁæpÚXO^y8¼}ƒËžCas8´!OïdÊûúkVKaøT̸D´°OÄúW _ü†¢Ç)eF–M€§×žI$iÅbH’÷×ë‡&L¿opùÌƆlTèâÚHú¯X7Ø(x¤×vï¨ñ‹ÂlšÝ?±©´Ã¤f,…q¦e`*ä¬?pÚT³xÿ…wÞnúOî~a>øÍžE£ NÄöðÔ‚Ò³v·\Ì€Ò©b½âÛ¶mðåÝg ½ù Y nªN§mß±ÏÑ=̪yƒ™j#–=˜½gN嬌‹£æn ´ize×J#¯ðÎ í¦ ^MûÄÀ)ý°cÓv¹gǸ]ž7êX½ÈC€p¹gÅ”÷îÍúúøÐ¥œyç àqÑ×Íë^hI²÷^ýjk©—|rOæäÞÎ:åƒÇýãc–|átVóƬoxÝÂ:(ïèÚ+÷õ5KR=~Ϧ?` ÓuíÒ~a£{÷¸uH«¶2Ç.kã4f1#мQÒÙ}ü¦®ÞM5QÃÚG{tÏ›†­¦3€Ó¾äø”#»Ô­Ü¾¿lW;ƒ:ûÚyêúÙn}§7íضޓ {Ne¶º{b¡òT1qÖŽØØ¥œ±¦õ™7­}i{f©òŽ6lØ#Þw§O丅}¼ºä¾º³|ç½ýWÏ×–‚µºt‹m¾²ûà}¼:½¼´ó¥~ ÚL^´&4n¡V|—ÆjwŽm|À ¸´a!ô‰„þ7M'®Œ1élÂÚµ`-qkqíä^_ÃÅ—ÎÞ 3q®–j¤]«æ°}Ùf¾µÑ…SG‚ —]9z'°ÕÀaýÃçô¯W§YúzõÙäÝc[€äåou_›6ËfŒ-öÍO¹ñ¬yÈE`Š—Š<Òß½S‹’¬ä›ù’m­õ¤3#}Ž:1ÄAËØظòy]¦”Ù²}û&˜¼¶÷£’Ž–Ŷo—ð@Ì{ôÖ<;æ⧖Ão¶oO–—7õ´n¨ññòΩó÷.¯4^©]Sãv8FX™ˆ ÞŸLÉJ˜Ôè$¹Rñž9eŽßÄ…GµÕ,¾|ö"›–[«äÁ¦Y›ŠL·'„‡wŽèãSÚ/²‡îàþ±“­¹ »q´kLt\\”$ëÞþ{õOݶGªhèú;Þ~ѧwo—Ûr ®Qï^þ/6ÏXYÐe×ä?§&˜³fÍú%ßRˆ\ߨ(Fö«·óÚ{ôŸ3Ð ÊK ôš[u6iÑÓ¹õä'_„Z Óâí:›e~x¥ÓÉ1(<¦zéóäWÙ‡°Ñ»Ë „sæëoÒ3i¶3—/nÄAà4oQOœž‘ÛÚ±±6£© oëá¼I㣹@¬GîQq³º‘+÷’õ;û/œÚ›…@Œ]úÖ=yú"ỎMXfnESù&vÆF(æ Õ—®ïÜÙŒRވ˛ª±´GØ5ºwÿI!m8kú0[“¶ïÓÞ˜»õCJy›žk;)¤=tÛ[(©ºÍ,ºˆoÝ}˜Ïl=cxà×B–³C'‚t~a‰µ½— ¢òBŽAg ®Ööú¬z­l[•§\Îj`׆“O7s±iM€–å‰íÔÚ½»—¼yòìmfC‹€u3°ûu 9õM|¬º¶ã„,UIDATE€¦l¡¨ž]oßÎ,JT\ÎiçhÞ„%Î-eº8Y²Qrcç†ýhV›Ö‹ óÛu²mjÀ@&¯A\Œgæó‡o>d70^5g PVP(¶qrPg¢†‘I¿î)¤Î7ñ2˜È„…2­¶ ˆïžÑùïž¾zOé´^²qik-ÐâÜR¶«“…\Ïæ·6µmn¨m[¯üý«´¬¡K&EDž~ëáv¯=HÍÌmã·8> ü÷ï$M»Ú´ÖõôñÊ{÷45«ØwèïntÞËn“®­ôr‹ÑÅÉš€Hº9g½zš–]2j»g7Á—‘n+77ßÛÆO½(a4˜±vI=Т¯ej®N]åTä›Ù5Öeä–0\œ¬äÙ KŠó›[·2âæ–PÎN6lÄ®>‘dŸ“ß}ll>¡[ÓBª¡ƒE‡^=ŠÞ§¼JÍ°Œ&-[ס Þ];^hêÔ²ÚyXü‚Üæî­µ óu¦z#}AiYyyyyy9Ÿ_ndfËÊþÌ6ª',--¯@=ËÖº\Ié—S—E„ú*ÉšZ@tOêÓ›”wéÅ2ÍasW;µÒJü•Ïru´`iµñ·iþêåË"ºþø™ùe6Ž¶jJ³3 x;µ0hïbÛèÝ›Ô|>ñì›ÐËAn§vôðh¯žòêÓ°ËüsŒ?¯PȦÅ|E|íìÍE¹iÇ_zu³ø/¯LýÕ¨p†K·ÆÚ>“UyýΆ>£.ÿ+vçÿE|“ö÷ Í£ŠEÿ?Ø5}ÈÅ¢_Äí’G1ƒþ½š—sfÔšÄ?ýô?i‹fò¥5óVÌÇŽçÎmæ*N‚»zÌ~3üÂ*/ÕÖñ:£†Auäÿs€ó¯àvå*×ߧëþc’þIêF&‰e4WÇbÊ•J"ÓžK5˜TPáoU TPáÿ Œ¿)µnƒ¯ù[¥UPA¥n~ÅG/&n›ïbÞÅܬ“Gøo‹ª” !²ìûžŽ®ŠTæ˜ *ü¯«›äª‘ãçÛ5kçÑ€6êÊÛp ¨iÔ§i±˜¦y§55TPágðKsWîëgjXº÷îÝ&Õ )ûaÑ…«ó熮ÞùiÌU¯Ûã !©–÷Yñpë™Ó]êsàßr,² *¨ð«}7UŠ€ÓÞ°óÊíò __]N|ò€†³¿iæÆÍgß{ëÈ—³èÒâ"‘ ÑפÞó®œ8{ K}n…ªADº¸¨HF# Qy.ƒÁå2ª¥)Tø߶n*R[!2w,Œõ~¾ÓÿµsÇ MÄQ‡ßår—´(¸Twqé`ë ‹…ŠTq±àà^ÑÅŽ7tÑAtuSŠh)dEtsÑÁ1 ŽjÓ69s (‚¤ß77äàÇ»ð¿wbÿÎÛOßn¤ì0qKø´õ›£ ->¶,ÊÙuÕºý§Û³ P ÎK¿Y §p6äùºÕ_IJFД„â˜ì^7‡RêûôŒ9µPG …âýËfo ò PE9‚ø£'Z¨I*J³µu™Ó¶µ+`¼<´|ÖcÞÑ…£Ê$4ƒ¥ö»Ý‰‚8D¢ô }ó Y0ÐãS§9‹cZ.}ãнh§ï§ó'ç±*ÌÌ8z¼¯ìM3{w2¼]Êq 6’7~@ŒçÜS ΦM›iW4¶g ÿÒÓî b¤&Þ\*pž<´1§B®„£!¸Œeœ¼iâœgcÇø¦OØ4¹¯-Š¬§›Îä…ù*ú¹2a©”.g Ë¢–>u4%Ëo}^Ø¥B%R‰°Lüsb¡„BqâÈhþ­r Ñ”@(’{—â|*éàN=Ö÷—B]_[S¶l³·€\_8n‹vß]ãݤ2d«i«SuÅÁ×öÇNˆœ01öð­OÕƒ Éç{sã&FFƼù^~õàšè÷>&ÍŒœ¿ãÎøèÙ,Ù“ˆÑ…Òï=¿¼åеÏòÇñ˃ùñÑÑ3®½)(x>jÊR¥ÇEŽš¶0G¹OEEŒ¶h»žš>ïÀÇÉËÆ?wÍAªrhZ”ó˜¡ÞÁ½Eu&èY­^˜`c¥§|T{sàÓ¤ˆ…ÝfîŸ?¯¹¹…e“ñËOpÔ$åd¨æñ¾ÊEAÖ{Цeë ÿB3óï°°ÐàÔÚœn9À*nÊúêo1"™ÖSªÈÜX›ÍÔ0477777­§­uÃz¦æææ¦õ ª(èÖ‘ “"#&M™uíU±<¸?Û4~Åío©g£#ÆÆL_òN¥YO'ÆͪöPéã7Q5 …Ü\<»_xò•—µŒœ²®ÜgGDxèj²5ëõˆÝ6r˜ M# ]¨m7>Â5fÆBÈùåQy­ÍèlŒ„ajfnnn^ÏÈ”…”ž±\Žf\"­zfÊr5«§W.pv}SSSSSS“†m½úw>xö²¢õ%ËCB†Héª="ørçÖŸº`ø¥™ …µýêŠoNþ­Šgo¾^“úˆ‰™©2ãúê Ž¶±œv}5&C]ϸ¾™¹¹¹±võܶlbdDÌô…i_%€e¹“¦".5n|ô‰'_¨¤èðã/¥rÝ!-™ô¦@ü?çnI;;¿ÏÔÞý„ôòÜ61pOj®òí¼—']&µìÖ¿û™é}f|Ÿ2Ÿ%Í]¤aàãdæm̆#ÇŽÑT o¾fÜö¶€ÈòSœºEZñ}ƒ|;.õÚ{ç `IÊ呉†MœìÊ{àÚ~¿¥’6A“S7Ç!ˆ«÷ò]ùMÕ+<!ŒZsÕ½·¸Ø?r6ûںϥUJ!‚šÆÏ×ô]AûL;”Ñ{@h/ÏæñAÝRJ !È’dÞ9µ|ã áØè)ŽŸ ž¢ij™yþÜ¡/€ÀεyÍ1kécø“7lž5ìó¹Evü ×îÏ£ªPcÚ®•pÙ‚}…`²¹@x!>\†Â5©©×0öÄAK¶Õ{¸|þÒ%Ó”nÞ‰ˆ¤NÎØjܟɈå ÄêZå%iJ§ãp/õñÇ2«Äeà⢦ýçr†š«ß{ð¶˜ü ‡#*œºfÁ˵17³«ç'ˆ:û¯*€y\w¼d ëÞA#ÌÇ?&Ò[7¯‡ Yè1p\D¸ç²Ðn·¾2MÍØû¶o—ëNVpãƵ mî¿3ôSVöƒÏžœb¬Kd2*ÖEî…Œþ­ +îœo;ùR §l>ÓÞkq´ß&Âd4èÄóu ùÅúÀb·jݼ&ËÆó3bŒÃ7…toŽKæa:ƒPbvļ1±Ä+qüà5úñt »ñ  0@g5ÔÛ¢WÆì¸øót_3EíÈ5hy|ÉÈY+£Ÿ~?˜Ó3 °# €Å%3[Ç—; DÐà²ÀÇì<½FŒÊœ¶&ÚeÙÙbÐ4lä _ŸZ­yäÒü5îQ3µR×Vä>±³³û¿hy>¾´]»<% ·`ÑèàèуÎlR¶®&Tª܃ׯ[rÈÔeä? &MÛÑ[çm»˜ë`HCR 1ª—&BÃàqÉD 3oL£±S÷öÚBÎ=}5f¢K•œÚw ˜µp˜¼Àq²({[ÒÚÁ^K›.^áJÊ¥—¸n׌YóÃÇ?V7=³R4 ¯1«E÷Wâ¼Ã7¯7`Ɉګ‡ñG'ùO9hRc»•HÀm}í¶}ûŠ£÷L i ”¤èÒÅ òXª8;uIòèñʾ(1y-ß%ô]—+V] >ÌOaíù£9Œéd¹`ß—¸.'Àm1c¸Óô\Ú]É9ònJŒKÙ×Rÿ̨)|Ñ.c³@SÐѶÇú•Çï•E·#H“a«æ·×D€F-[ÍMOû8-xk Ó¸·j¾ÙUÌÿÅÜ %ÌŽôNª£­Æ–Š žr^’’ÎÌÞÑÿ(ƒHHÙ»ÏZV¯~ó:†0™– O©va¦òΧ¥»K(¸ƒ<­úò‡Y<ëqX@8,-Ï!r8BÔ›é𲿕‚™NE† \C·¸†®éçÅéÔð䪘ã÷"÷Ìp‘‰1áAjïo‰_G@Ðàp$Biõ^L,]¢sæ©·òÑñ˜ö«S>$D¶zùL)L2jwáHR¹Z=¸kx¿µ[Gn~¾.Ôä»—’=/î6…¿T€ðóãÁAAM#u.S˜£a.Q(ˆ6l­.w,AJФwbÙÖ°ivÖ®t^'Ke¯Hg<ºŸ/#hÕ²‘Fyú‰g`çâ‘úäáÛ7Ùåi X†Íç¯Ù‘ÿüа½eYwŽw[µçêíÃÚ,—0ö¾¸Ý¸zf²<ép»¶¶v/ŠZÏ®“5D2äð½1 jˆn(IÉÉS§@–Ÿ~3C÷•ÛÍuˆre¨Þa†¯Ù°Y/, ªˆm2î$ó ŒË^¦¦"Xvͼà]T+îßy#\FÍoÝÕnéùþ£›|¿(-Ó¸ñà<÷/)É{~>¨÷fzõ¸lfQ‘¦·<ÕÄ`5â)æ˜L&EɈ•÷@ÓÉ‹ÿ,HðdÍ9#Zs­é÷y˜ÿ!wC- QtêÂà&p+¦[Båaš:“ò_¾{¬y¥«gkbÔÔ‡iñ ´LVU7øƒ™W”–•ËZLQ,–RSâ’B!GWKÄÕÙØð¶IÂ] ¬@ÉÝÈ+lbÛL4ë\-X>–úå¡LI³6VŒŠ¦›†ÌÉó(þY3¨¥!¼T&†¦jŒê43æ˜ëÜ{E~êPù!@ã/Õ‚˜qS‚VÞÐQö„´½Tûàƒ£ÓÀKÞöRP?i߀˜å•{GêðK#’°Æ«‰DXôàÂÞøÄM†­ìc涳àV舖ó…´¡®¦@ Òkê¹ ±ÿ;7×ûßž¦Be9ƒ¢cò|ÇÄÃצnë6ëtò¬îu3&ˆ¸UDÀÑ4_ºt)P;wºšÕœoN*Cï„Ý[;Û|ãÃPHP¼u^²v½Ö sæÊ‹è×+;sõÕè®ÍþV>“3kîÏ)qwD*_.‘B¥É´*À¬ñ³’VžºÛÆ€ Ýš×aù=GˆÚñ‡Ä¦k‰NKã_êlþÙº›ÒŒ\5;¯&€TÙ’‡e@+OHiøvÖ»°¶ÜÂ…oo=Ï®!‹t-n„Õ««ÑÍMgi äȬá½wó‡Jbˆ2ËE-{v2—Ù¦Ö÷›÷×è7ù @!ø%[ªm¨µN¢Ëîc„±ƒéòq0M‹B''w‰1Q~Qµ¶g¯Š_5xf0ã§,òfÆ3n».´^ÿAë”l öùãÑyn^±ºu3mÀ¢ô¤t.MÓµK·$pÏœ]ÛÒòl›VÖ{ò®ý»wïÞ½g¯WƒÔmSø^~{_é¿ÿÀö5-¸Êïøñç€ÉŠaLXŠ¨ËeÖú–!€ànÄŠkI«§âÐë?{$ þÙÒ+‚ÈZ×kÉøIŸé*5D榽§ŽNiª@é«ë'eM$ïJNNNNNÞ“¼'iH§u›OÕª¾y }»þS¿›vŒ¡Ü.ùëÚ“|‘J´Œµ@:w*‹GÓµÙ*¶põ¼~rzÛþ´9 ò/õ5ÿ0ºÑé?°Ù¢ð9;šñ¾ÝMm¸¼¨;?z•ibhíÒ}ˆßôܹ‹ýço×Qºé±ãÖÃÝm£ÈŒé•ùîó؇êÊáJ:™ÝßÏÝíåG#tK»NÓ†ëÒJïÔƒ¢å'm˜t ÃæÞ¤æFÕZÓøÖµ¨Ul#­ºbñ&A‰wÃØ BË*W£ÖiTŒC—³§…¥Þ·’³nÞ³Únk¨u:v@5†Ò HÛaßÖÉ¡Á“»ÍÛÙÉ€h5ßµfð€!=ÏaÖ2â Æßà~ç^,ÓßttC•2:^ÓúÙùÅÎOÞRå–¦[|ÀŽžçŸP]YpåÄÚæ­ºs”¼‘Uèd«å]Î}ŠÒ(x›Ò·O¹hµtÛ+]ÖÕûÇZ×!3Å’W4,¨ëûˆŽ®×"píœA?з½‘>=b\ŒƒaÑ¥ÂÖãú˜ï]å°,¡æIT^ãøž²ÄóŒóqZÿæ‰ð¿¿Ì©Â‚ :úêÌËÍgªë2%E„««©Æ ´´¬°¨„Bà¨iêhª@iQ.ÍÖÑVgË程òs¥4Cß@ŸYî¤D%¹e ­§Å (++(,¡¡¡£«Îa-ù–Wjh¤ÏZœ“'00Ôg D%ùb0ÒÕº½>pÞ›Èý3Û—ˆ$L¶šž®&|_‚(IAQIÒÐÞž‹ö¶2×ÓRçPy_óÔ ë)½ÌT^Nž–~=Sþ –‰ÄR žš†–¯|É •÷­@§ž!Pš›+44Ò€²’B áéhòdbAA±°ŠÐxÚZê5f¤9ߊõë0ËI•ç‰ÑÀÐAd¹9…Õ”Ä14Ò‘3&Jˆ‘®V ¢Äù…Å40´uõ9Dš›_ÄÓ1ЄҜ†‘&Zü5O`d¤/z¹m<áÝH§îœBm‹nÊ“1XRTòöîÞ¥üåÁ–ººZ@–›[ Â1Ôãäæ•ê1 yÍ@çää«ëj(^P:?'G]¯Oñ/ääʪ6Ê0¨g€Aa‰ÄÐ@¯‚Rº¬$·DjXOŸ tþ·<-##6©¸UœWR¦m`$)ø††:<†²k+ÊÏaªéq@TTZ¦ÜŽ®¾»ÆÅ9¹BC#=R®>aaŽbè-ÎÍ+®Â8“¥¦¯§)ÿ]V”/`¨hñª ¥Âü"0XºzzD&Ì+hêé ô åTä²Ôu5¸,H?Ÿ¹ÇôÌÖa?“Ôû¯ÿ‡pk]@èË?,vláÔOŲÿ …ôߺõŸ¡êÛåEø£…Ò¿‚”œôË«/çý/Y]»\hšþ/S%Ìðvp¾^„4ý¯–! þ‡ —–Ô0—TÕ¿öŒ™ ÿ¥Ü=É:í²TW%[–°éŒ½•ú-Ä•ævwòÉÑk¹ãÄ5ƯéÄ ›ºm ÿÚœåß‘!£öÈÌ‘TaUÃuÑ¡øvÿEªþ>wOjøÌõÎÿú5É¿~ÏÔ1L«˜?ú·“u‘ö_|3•›þ_r¿ÉÀþ¢bÿsTýûu÷¿ãnTPáÿWGøÝÌÊQ±þ9™E^|ãY5­÷‹7¢¬8íev‹ÖÍ2ž?1nb£Í!@ˆ¤$÷}Ö7±”frÔê›[é©3åÞ½èÛÇ9ÅŠÙEB´ôê[š "!â´Ç¯Í[Ûh×̨øåÓW,ã&–ÆJ‰^¤fh›443Ðç¼Î.iݬ‘¼iiþ‡Ï_…“Í36k` Å•Ÿn@qIæ‡,XÊ⨙XXꨱ”4ˆ/ÓÒd4ÊCßò}\Ä´Y‹ìôMš·ä2ÿ©ª¿d¦å hEýå èY46Ó©K)yŸ3ói¦õ”/¦¿H­oÕ\[íïFvæë<¡¤Ò/a´hÙ‚ù;{þOoŸ3t›êó~XRœÿæM~ËÆúß©‘>NÏmÛºIÝô‰¾¾ÊÈ‘–‹W!_®¦AS+“_cê‚ì'¨v-Ì+L¥Å/^}iÑÚúÍó§&Ml´¸5x#\öâS0¹ûßl8k˜ƒõxµþ§Bs(ƒ'ÏADy°0øNêŸF7’ÜTÿ)7ožRûÕñ¤¬äž{—e—nï óh™üÄ¡>ytx~ؼ“ Ìô4òsó¾|þµùLP{S¸¸yú¬;X[Ñ¢Â/ïÞh²lãh'€7›O¿sß½æÉ–÷¾íú7±»~pm…¦‹ÎNî6ûºÿ¤q}ì?^ÛÕwÙ•ÛG6@Ù»îÁ Œ·²idô>=5ýÕ·è½û6W€âÌó]úMÓ«WÏÀ@GŸ÷écáÄ-ÇØU(jʸ‘¹e4ƒPi/5-ZÔÓdÐ43|ñ²Eáý×ì>h®ñO3h‡—FœJÀ¬W/DúMqi÷ѳv´¨ã©óÇ*k»wö0å‹Ãø…'&;6ú;ó©+F÷?üYb]O·â`j¬IZÁeüFw“8ÊU½ë¶I½ý°ä‡Ã¡ýOõ¾¾Ùÿ;5ÙW]Gº||eÝK >žœ9ûègÈÿðöÑkÑ@iÚ¤­obDïŠÀàŸÄôó n‰%×÷N*}v¬ï²¯g¶ŒÝñðYu9e×@÷¶ÑûÛ×Twî-8ôÜý¡ÙßõzÙGÀ´tœ÷–ýD``ă\ ° ¥aK iñwÆ~;'Ž([êßvúÕR¤iš’IeMQR©T&£hDŠ’)~ÓHÓ4Ò´L&¿"S\Ašþ^†’JeòKR™ e‚|Ç‘RÄþ^íâ—KI­;xß.úž=KâwpyS‚ˆxaS¼ÿ¸yߧY¤Ï=;µ{öUŠøÚ³™íåÂÚxx×µƒß¤>»?#Ò´üÑ þC}|縈®î´GD¤¥£\]S¾"¢¼Üä¹]‡Æ#¢´ä££“óÚù„}º²¾MG¿ôš+æÔlû3IÅœ‚T*•?"“I©rùPMÓ´\TM+ªý.=Š®u"‹ZݳýЃ_ʵ£PT&£(ºú#ûç š±±ÊE™LJ—kó»ªåÊE¤+“Qedù¨àáëÏV'K&“R”¢(EÉdòšiš’U¶DºœbyyZÁ%­(‡ ‰ÈÉ Fº,9”H+U(“[Ò4bùEßÄz´ÉVGÉd2ºÜbetuÞñB|ˆ×¬#ö/•Êhš’JÅ”RCt–Ë­ÂÈË«¥«””Ûªcÿµ ™ÜÕæ«ð"y‚› lÄXwwׄcÏ!ðõNG§À11£ƒÝ»vÿ,ED–¶»³£}xÔôQÁ=݆‹€ÀK ½œ¼¦Íšáå’)–džäÁŽ‰nîîÓfÏòsvõ‰Ú@¬«›ÝFO=¬·÷ÁOÕ¨ý|¡µë` óÈ`q»ºOÚ¹k‹o7÷™ûîü8T/|ÖÁ½÷Ú0—!#Ç”ÈðÅ–H'G÷q1Søt‰–Ç:_ÏŽp³Ë78rçîm¾îS6]Bœåæé?=<ÀÍÃ}p‰ è'Ë[y'ˆ>?ÜxôZaæ•eI;Y —®œÄ˜ºh}# x¹w~ÇàøªÜ ¬½@`fwàr€Ã6Œ¼@€‚«Àc› p¸Ðu‘™&°9ÀfCèâ 󔀎¢0‹ Ûx| ¸jÐëÀœ«®mú{AÑÑ™jÈýTt÷OfÑïŒ ¼Tþ[z/®ƒßW"âÑåã\L”»¾M}íÇ]ÌCÌñ±íðZ$ïì Ož¼"C¼çÑ9êŒüñ£úÙt›†ˆ”T\\"¨C!"5Þ½ÙŠKH×°ÆVŠn7%÷Ýmm^äS?Œn<›{}(NoÇ”""Òo7 Úülã¸ªÑ bÙ—ÛŽÛwõ :>öصÔò–é=!¶~óŸþœÀ*G7’">ßù]‰LJzF­û‘Êò¶i;ñä7DDüÜÙÎöKo®jå1¶TþTq†½ƒÛ{IŽRtƒ8ØÇnÛµòߧŽÜZå‘£›^Ý쯼*D”Œqm¾å‰i¤J³Ý>Kè/ƶ X$§^’yÖÆ¡O1V‰nB<û Šž¥ÀĉÓVß”k$²‡û†ëŸ®o˜Ü{â:D”dØ;x~(CDÄ¢nN½?#.ÎZwO^UÚÎ!΃¶#â`ŸN;n(¸8œàÛúJô•ïÄU(EDÄ}Z-9”!ûp³C,E^èeáU>"ÎèÓ~ö^y )™ÙµcÕèæã¹fNƒdˆïŽqq #"bÉå„æ>sjÔŸRtCcQj›¶«ž å·ÎØöèc‘ܾcÜš/"CÄœ?G:Ù–RˆˆÂ[Ëšu‰CÄX×Vß)*¼têtžPJ=^jí5¯lÛ?bûwÕ–›ºL,*.V¥æv8àªóø`# Ýx ñb<à†gˆˆ-¸š˜QŒÂRi…øT„ñ6€«ÿD‰§ö.nÇY >ý‚ˆØÝ¡"âd@—#ˆˆš€rç‡!ÞGDD@üXúÛ×Ýd¥Ý×hºè{omáiÀÐP×53•ŸÈGèâÕ|€YÇFšbønP IDATaC»tõéÛ·—¯¯€äLJ©ë27y*<¨ÝÚ9`°8Zšå (L6Sž®+x¶Â9h=hhð&®<Úß±dÜŽŠ¢h©èùÝ.“w4×û©Ø©ÕtœÕÇy·ÄÓØS÷fÄïk–ò †S9Æö)·®½H{ùìþÍ}ó‡ÏœÌë?aÑä`[± Yjœš ¤­›Z 0Ôµ(Ng#D DŸÅ¢d2¸t饑%çìþ½ „2£%'2Åc­¹uÎþý”-íÐÖ\~«?  å*ÀàŸ&ˆÝ5ÀãØ‘}CÚ øöê0W·“ ‹¬:˜aڤё}{)ÙL‘‰ðÃÅ\0¬$'ã–öAÝ;HË7÷04,åÒ[¾g¹oï‘{ˆÁîS‹ àës¶¶Ž|k'hó¯ÜääÝzPdÞþmròkBKÑé‡d蜕+ÍI¿™üÂÈa4Î{q’pÁ³ÐdóæÖZŒŒWÏÕõY7î•Ò@ô™š^îlM=O—„¹Ë×ÿ°CúZ^¸Uk4È°ôc ¦™–¾“°ëŒí€féô¶Q“玻t^–0gMV…ðU¦¦™'дôScªÕ×EÁ)@· —ÉC{ðñîÕ»Gw¨ØÈ+?:*Ò@åJerxZµ™aéËfO <¡ Øê©ðB #@ž†›° Ö´+ð$ÀÇXlÞæ’§ÑaõG€q!À$ðþ @ܧ¡S0`p9q|0 §žâÏOoý#w#Ìò¬•r° VÅѼŒŠmßåkö_~tý|Ê­a]˜x Ý5D±˜ñˆ\ªêˆuŒ}Øfu?>} ÎNˆ gù<-¢‚¼*JðôÍzúùJh$ öè) ›™kËO7øñ›Ð}Ò¸‰‰3¶¾£l­ Ù7k8–fsÛm:ö™qnMàÜÅã‚÷µuª¿ùÒ):²Yï‡0ÿ•ì!2ŒŠò¬JKêA(¥xl6!„Á ŒàÉQ:Ì„®v{>–” JØ?µ_õ}XbÅf³ ‹Å‘ÑeTî%—± b8¦=ßR7A¾~ݦ< 0àøÂmN1—R jª±ädP¨1,>ºIµw@Ó¬IG{ÇòŒšºÔ·BÝVúLZ&f¶Â<r’–ÉX\&ƒÀаž8©% Ëd4‡ÃfÈÍÛ¸)T{CJVF€Kä§39L"£$,·\Dà=l”ASc‰HÊRc+J²4êìXìr{ýé)“§°qpçÀ¡ ÓF´ÓÔæ­ vRêÍØ•^·1Iûo^»u{ñ8¿Ív{¶­ÖÿGKYzj@€€®.è”Oر4r @µŠ‰Ëòþ¡gp@PЗVÚvoÄ€1€@i€ieQý„Ôþ‘»Ñ4Ô(Ë/ø¹Þ[˜ù•nïâÝÞÅ{lÌøî­z\›5¶•±ìþËRhÁC€WÞ°X:5.^’+©‡è¦u‘£ø&ŒïwK$²Šm²jzf®žkð?“ÞtÖΟ:Æn¨qG%Ήž»,É€¥HW4nÝB*º h1`†dÿÄëǹYpä„aÞãΞ£ß¾eû‹Ö´o¬ûÇGÃ^}ƒäõç}-00f:üyoF]Ñ¥¾Žèë7IsK6’ŸõD“ׄiè™öâÅÏ.‘hêë3’Ÿgnú`pÙ] ÜZqÏc³¾ý¼å~¼ ¯TOûç\*!›' ÒMò{5wŠóë"»hêX‰ÊŠd,D âCÛ“=†X›”é7í䬉„”Q`”i« Ú»ðÍY„– )¶:½@(’!ò€À—wÅM€6©g^J±z÷ BD ¤0§@×H@b®/zÿAJôX@Èà ï×ô˜4ís1wY¨O}’õø+³]íRÉúœeÕ†oÕ†:rR¤ÇÞçÙãØu.ƒ©û|hZÍ›¾>~ M¯áÐsLêZWË»ÎÇûFºÀV\xŸæõ!åa¹Ÿà‚ À3€°±`È„Ô;ðMæ\–Á×\P7=Œnï@zÁÕ?Ýä÷yY ¢ÁÄ ~b+ú?Z²nÚʾäõ¥Ÿ›0O öò9–ò4ãmÆã‹g¿i™¶äB¯‰=Syüê훧7ÞOg@Þ딋×U;ÞÛô‹ÓZàÇï¶ÿÏ?ºyéx¸wûÌ&üVæ?àoŸ¦>,ÇóO‚ ñêÏô¨ƒ±õjpq ô_ºŒ½pëÁóÔÔ·.†žîàÛC€gÔi~¯Ö»Ûý±óÔƒ‡¯œØÖ¥û‡‘3•¯DëÐÑ _ìJÜ{=33óΙ-®¾ÁyTÕ®Ô{yØ-XôÇëwï_?½2sÎ9ÿ˜©ÕOOd?òH!šG+×Êô÷Þ2}¡ao äOK`ž²íüƒÌÌ·ç·Îrî;QZ;J¿¼K}üèáw<*’aÉ“™Î µ IXüyÇŒï¤f­<µE¡ ¿xõêØ‚KOçéô Ý7oô£WoÓSÿêÙ/á"/ȳӌ™sž¿ÉÌxõhRoçèÍÏ9š qeS·œ{ýæõ±Å^P´^{*cØŠSoÞf>¿{ÖÛÛûþ'ÇÃÏþà’™¯ÞdÜ»°w[¡&ü¦E­ìFšê«)©ïß¾šó‡IKÝO÷ïçÕtÖŠ¢zú.>~ûMÆÛO洛µ«¯SA‡«Uð-íuúk¬¬Ýì;'¦¯>PK÷ICXhl „ISÀ \»Á­80e ”¥@ oˆ}7ƒQ;5‡í‹Ü`ÊXš€Îì°v‚Ä8hçàñ1°°€Þç€L8\¾94ІkB£hßË ,, [øÛ£›m»}Zµ”`žQCsÅ„Ž†®¡‰‘®âw}+S-¨ÙÝ8¿|öü廿•è6h·ïüDâ6óQsÍŒ5éÐgíÔ€–c?€¤$ÿÕÛw5®±ôpï´ó‹Ön=š/Ò6nÜoÁiïö&òuC꺆fÆ5î9â4lÞðbÒ¼ åÿkyÌ\?¼âä$vƒ† Ø`9ß:+ÅÃ@]cSÐR¶º¶¥™‰|¢'nËßó{6o^þµTª®gÑ{f²¯m¹õzFo¸rÞ²MKOi›4[v4¥‰ZMý>©oÙHçû’-†¥¥%›AÀØÔRGqž-ì¡•º¢ – ÙL@´ØwíÏe3gM9”cÔÄþÊýsµhDÏÜÊDq”HØÒøðšÄ¸É¨e•|ÕµiÕ¸MË ¾zjÚÜ…/*–ä­ß±ËÌÂJ£Ø—îàÑ[ãÐbŸ¸@ „ §Íù+ûgO[0%«Ä²½ÏÝK³Y•Ã*ýúføêÚ¼EW•½ýÄ [7,½´dÇ:@d6þcñ¨YËæöX1kÁñ+[NI˜µÏ¼­Ïå}ƒˆv}ãö[J˜WLóÜû-;`‡ˆÁ³779¾nÑŒ)¶nŸØƒ½"NÍŽˆŽ?/ë¿r8Ä Õ€ÖòsW·/š6mêõzÖ»®Ý±Ö@ ŽÝÊX;=~ZK¯°ýÓ½G$W6x¶F#K`k™40)ßqÄÑkh)¨ñÝÑ04µ`—¯HbpZY0±¸Îþõ³#Ì9©f1sÑROgGÏ^)ÈÝK£¾¥iyµlÆ–ÆRÐÙ{ëÒò9³§îÎfk›MÝ}ÉÙ\.ÕkÔ€ |ÿ1Ög£–îعnŽr»eÙ7n¿‡q}+Q£f‚ž:€  ad0œ<NáèNàBüNðî cçÀùÏ0i,‰°çÊ j5<ÀÛ4°é Zfýà›9EÀ΃0v9¬ˆP׃&MÁZ>:Óa&øC¦6,‡áå^  <~£Èæüæe~˜Ô13üü¢®zul(©5õóéþ¡{œm@Ú†ÈO[ÝX=TPA…ªk&ÒÃ'ؼbÒ¿’¶B`ëA)]þIßèn@ZøÚÉoì…êüõu•2Á;×®[tjÆ;z'múΛÝ[hªLKª§iIÅ' ÿ]8»¾uƒÐÖÿ‰è€”çŠXºzꬿ*B „ ‹…4ž¦Ž–û_}2 *¨PÓ[\éÇonTPA~fJé›í¿ÇoVÿYéÓïøï!õ÷tXåÇomM¹»ª’_"¾uQ§‚«[„’ bõËñw*¦fáüß4³ÿ3î†rxš­wô B çÆî÷Ù¯µ~"ù4+ܧ¥µÛ7Yù®§’¦¶iÙnë'ò—òÒ„ó‹;ûF_ùû#5zûö³²ÿ”b!ùÇ‚Œ;¯#¿yxùðøîB X–×°±õ{¡¬¦/Ù‘·Û}ìGBJŸž¼÷6ïòUa6Êcµ_pàM _¼òéÏå-6Ü÷Iy!Dèbç·ú!€¼¼¸9ÀÓÁÁÉÁÙ/ìÒ{ño!§7ÌpíÔÁ®c‡È…¥mc„í1þ#×\T%~KtÓk΃sKœ`ÏâµÙ4«rß‚uöoXCŸñ½s ²Ò,§Ž‡ ××TL BVõ:Wla«Áå0êêøª,®†:U½ãA¬!|ÀêÄx¿q㟬ÊmÔzÈÂêý\Ì‚ˆ¨ï¿ïëÅQ€5vÝXÃÕ;Xù¿XCÏLoœ·± €ð 23Ò-ËpU¸kvæíÑ~àüÖmϲJëVt¾2_r³©r‹§¦Ée3”#YTœž5nù%kSm6ù~‡ìŸÔ[[[KÍ̾2aÇÈ-7o§Ü>kØ«XZ£mTÖ(µÚ”‹@>Ÿž7ëxቻïÝØ•‘23ùQª.lÑ^Üwð•XáüúèæX‚sàô;çÇñ÷æ1&ûºNø3µ—Õѧ%òo‚H¿>ibã”G‰mÛÙÜO92ÐßÛÙÞ~ü’ƒ2BˆèkZôÀîN|¾³WßsO³åßRLÝ7ߺÛpBX‡ž^äb©Ô Ý}ÒÆ•SB‰Ò×v)õiar$UT¹;!tÉûéÃì;utë9ôλbå[Â÷Göòrpttpé¾ëJ:!@uu×w¾ƒ“£CÁSÞIoÏ/ êáîàèèÜÙßÍLZ’ëîÒஓÿèÊIÍg+>ÈFÈ­¹£ŽçÜ4h÷î%QÞ^î|ÏÀ /ò ¼sx¥—‹““½}ø´õB^_nÝy!¥ÅmÚ´M»{x 7[[þêsiÏÎlìÞÙɩˉ%„‚“a|7!_žý9ÀÏÝÁÑÑÙ+àÀ­w€<8¾Ê‹oßÁÖaêÚB*M@š“5À×ÁÁÑÞÉkÍñ‡òS½Á”ýKÜ;u°uLØz™ßÛî KÖ‡ï¼äIA+›v„TÊÌžm†ï¬ànÇð¶‰wßï l|øÙü> î~Ù70tÕþé]¬âgÉ´À¾}ˇ_Ê®Ïi>hÕ÷p ‘¤ý¹¹»ßÉÑÞ«×°ÛïŠäf0õ!¤(ãjo7;'÷ØWdŠ]/äÛÓcÍìÜå›ë !«† ñŒ_Þœ+ª`Ž"z{tõ ›HS ÒRè88ûX1±>”©Nñï%„ˆü[ïz(¬EÑÎv­RÎowéÐâÀý‚âãkâ]œœcV“I™Ñ£íˆ]ìoÞ&0ñŽ´ð‰M«–9"š¬ÞaTT´|ýûeÇþi€ûûwì8å"!AmBdðº% USµw£§vëŸpQ֛ϿY@!âþ¸Á}’ßM=5½û€¥H‰ÜݜݣŽÉ/Æöj?s÷ ”dù´²]q§Qò¬‹]ëûÙD,üðüøÅ»J;¨ïóÛwË‘*·Y:¤CÇ]Ÿ+þ•^‰±àîÎV®¡"Ä×9wé/ßÕ{8~ GôND,þüêø…[ˆˆÒRg>¿×²ûˆˆïwÙµµ™sà9"f?Øæî; ÎŽn×o'"=ȹùùâ’מ]û! SW98Ë7ÎÏsºþzÕŒéë·ø¢œw>-Úù†ˆ˜{g!ß}ˆü›ñ}ù‹>F*Ý©U—ψ(Îwtrù(”¡ì‘[k~º‘F¼t°ñxŽøþÀ@Ç¡Ç1&¤ë–koñáÅ^Câäm Ó78¸E•!椦œ¼õªÒI7¢|¾S‘â ¢==§Óf#)v³ço}!DDéómŽÚ.=’ˆ¢ÂOÇN_”ïŠ.y°Ì¾ß DŒrozèSù|iQ·N.¯Ke©óB“® búñ•üAÑåÉz¸.¼•…(»râÈûi•ONtïâê5|“⛌ô9Wþ{I?×>kŸ!õÈ­µókû/Z{<§‘’œ8~ªLF#b˜kËwî ìÜ¡£Cìš“2D¤é·Ï{òEÑDÙÇ–^¯Q…_{ÞÍ÷°CŠ2©ûÆgîØž@Y~¬çì‰ò˜xf”§wfH3^ÖÇ÷sô›š23%l6WV˜›òIDѴ׬kÛB@MCíæ¥ë4ªY^8{@@&¥h €q›³»Ž¢ÏŠ -5ˆ¸;˜q@×λIγsy°{Ξ±IHSEΚ$=±ý‚–©uÎäNk €Ð “F™¦¯_KDÐÒo.’*ïD#jj7.§Ð¨Ñøâ¹}Ú@''îm6y¡:"ÎÞvuîç*™×5ûOD¹5øòéÇl¦mQZš€Jž{À&v Wî¿Ý»-H¤@Pª<øb¶³iͼq+¼¾qU½mû–JC'’I°½Ÿ¯èî­T賶zÍã¶rôu°®h²YÎ>̦išÙ"äÖ±„ŠN_\üZÆfômÂVË0ç† %òtÌzúxaŸ {v­«Ì¸:·¯Ù„M4˜$7õrg=º´üÚWD|ié{)U*¦˜n~ *}…Nqº@Ĥž — @Š¿I4¶u”[¡{@b™$³L ž6[OÉÙßÖÑobe¾¸lJ€êãÆåÜXQ½ 45bæ|(V9—¢ƒ_>¡:´{·çOu¦¾4w «°­"©ü|1RX"Ðá©©é1 Ý8º³Ê°î—ÌÂŽ1“Q,•!a¬´I•H î=*Æ?¯%i1@rhv´üF½æž{ÏÝ Šß]ù#È{ÜÕ[ë4ÔLâÖŒ•‰s?<éÕw„K—ëí¿¿jÈnÜ›7wû³oÇö×ÜU$˜HÁ)@˜SÊ5Öæ4Ö“éÍJYìÄ©,¡¿Ì#CÝ,>épœ´,ïãÀ¾Ã½®Yàõl¡"OC˜µñY½œOC“!K»šþußµcVê@]ž/_üÎjªO§e‰ ­zÝ_ ±>že36+Ñ~sŠá¡µæµ)ڣτ%ñIÂÞnØ`¨‡Q1 @xF6k^‘– ržîóí~úÉSlÄ"Q®$a¾@é(‚”0éi.3Â/ØãÝÛ^:ðóÜÂQ§N€09,˜Ôúd@ê±XMóö;N]@i—e’Á¦Zu‰ZqYÛU¸çUhÃJT뎈`ÙŒÍN´ÛrËðP’YåZX:¦Z€&0˜5Ÿh!S,.Kå\~[tƒ ”ýØ$h¨Î½ƒó“nŽŠéªÑ I\qA®µË×.¶jéªßÌ–ùúõ®4ÅžÙèáýo¾-&„¾½OyøR©/Q$•×`"r4*þ¥Þº‘+ ”)a¨52Ɔk€ùpÚ¦yç7fÆà¡ØL€óËcß5JÆyqvéÈ©;€«¡ÝÌÆš ØeûúŽÊ ,®Q£æZ@‰iƒˆK¸ k%ƒƒ’§Œ)kähZ1·Rzæ~6ywNg´ô6„~ÞwæGÉïæÝ\ßküF"Ìû˜ò í/ÈV|¿ß˜<›gÔ¸…&RbúMô~µ2^„,ë3rÑ ®†ž••¥¥¥•¥…!0xL%ß4÷0yÁCÐ €Ù/²Kê²)ò/BLõŒÙz(©€pˆÒ»hínO¯œ¶ÝÈÕÓ¤ÚÔL01‚«MÞóÉqÛ#’GhEïžßNû¨œ˜fì7h.°y¦­[°$¢ò•ÈÕ¶¦dÔپؓ’IÉ-D"Ƚyç!ai^Ý&ìž:7A°±ïÜQšŽN]<]û¯x79ˆ|¸q04z®\.Å%Å”âqª¤¨DñfвâÒR@™ X nÇÑ! ‚Äôñ˜8ÓI tœ¦OîkåÑÑÞ¾c‡gÝD÷P^ ŒFÃû:õòtõõíqžÝmñØ.‡&{m &]G{ëÙÙÚw²íc<=Ì8MC\x=ÛØO9ôµ¸¤„FÅqr¡>®ûìqï3TÎ-”¤0È×a}DoßI› !ZQS<Ÿhõ³`É‹=Þ”8jÙiå 25«ïV¹Î|¾——§SÏE‘ëWX”› áêïN¸¦o{7Ïá»d|[mH …7™På]--)–U5?‘ ¤D Ðj·b¦OŒgG{»Å NKä(›5jà•Œ*½„Ò’b¥˜çŽ]éÂ}ØÉÑÅËÝ9þ"sNŒD€0—}G’=z‘ó%+}3,|p¡±ÝˆeÑNeÎÚÛu´Ëlº?Á .Í9qÛSED÷1姵_}Õ×éÌTÅ™Áʇ˯ŸÐuæ¾7ŠÃèe"wW§´«¸"Ï¢œpùöù]úµíëžY§,k\iЋTÅÙ¯5&h”/þ|‡xÀáG›ÖQY¥k©˜Ôý¼ÖÑÑáÿÓ¿Ÿ]º M‹Áù÷lý›Ä—<›¥çv…þžlõèÞ¢1§_fð_µ*Ò¦lS?¡zœéЇ_8™ÁG–ÖfïÖÓr,ãâ3+½¦í½#”ào¡{M¬'ÖaŒI\÷á’ÁP§äZA*y† |PóÂLÛºHXÃ/ûÎòØ~åç#vŽ÷HËE'C0ÆéÑ'-lGë,ç|’+“žú³ ß® u^qÐKß7¢º¹M—}g¹o>÷{ŒÏrÑ1ë`±?®²™Ëëœþ„1fù›îýÈî@T«¬úïyÛB(¹+L^‚åùÿü®#yŸ>VqÚ(Æ—¦<Ñ6±ã£m¿²ð™UÇ,:Œq§žÑþ,‚õk¬†,{YËÿqjáh §é‘ß*ù?coî6××<…1N ;li3ÎlÄfnc»IŒëVØŒ2· *ãaŒ-ôð9òø×úÜia‡-lG›Ž©â6 ´<þ¶ñø™c\j¦;¬¼}QU§<6vvZ‰0v“¿ênd[¹ý¥Ó&b®í¶77120v_¼§˜Ýz`¨ËO]>ÅÅØÄdؘosªB(ãVoó™_Ãöè™X†­²÷[zy½çøÍç~4ÑaÈõWE¡G›ÍGnŒ=²jš•¥¹íøŸK9¨…/šW^-§Ý—Îbóx uª+¾ ìF ¸l¡kد˜Ó·pìšg€ØÞËOÎ=pB[ 7µPCÑrpƒº6ÈøŸ<ÎOÜ •%6^'|æ¿“7›Ò¿~ÁÙ@¨ÕØŽœ>ñÄÊy¸‹‡güÑ­€Ðð¯¹\ ß“›ï­šTÃÃm¿ç°j…S À%qêëGïæÿX…º9™›ÛŽ¹ûúB±ò´t ³¾ÇÍqu454žµý* tÎu°ó¾Tþ‡¡c³õ¦íŽkÏIJ»¹ÍÙLÃé§å5õB§•…²’ª\×Vrgl>yÁÑ/&y×Ï¿(Þý¢e_)¾dM&­97×zßÚ½uX¢Û`FuXN Æ€ê>†ÅÉ Råq›Ü!ŽLûÊ.ÝÃÊM­jÁŤ¶„ëØí~Y[ߘl[ Æ€€|}s¯ƒ…‰‘¡ñ¤~El@U<>xúÃÈk~Ãm-̬œï¾-áÕfèùVÞØnî+ ›øS½Ò¿ßd !¨M9¸æhÒݨ¸„Äx/œ™‹··Ôú㼯¼v~Úª ¶)%ˆ‹É°ÒŽ$½‹‹¶ßfª,:}û¥û[g ΂ÅÄÄéTb²Ý+_íðØs%*úÕ1êDo?ÜB%jkãÞk¾”°c ”^rÌ&õ Hâ'ü)ÆÈëøCüÊoá„ᵦ¾3lÔ1üRh˜$@!tÂŽB?Uô Ø¨€\Þ¢«×*®Ï‹Íªo© "4&eĘáýLª²“¾rþ€Þ\Ù¾ö û׺ûǵý“$nÓúß°a¥ÇÌÕÚx'.>þÕãõǽݪ(tIQ†Ï‘‚Ów‚_¿‰“å·éaÙÄÝþ5ÖÖñø_¥ÜŽé¶vI;Ñ,°Ûr3æÍ[géTWG»ácç½/hhß‚>ƒMªó_ûì¼VC`ŒIŠ˜|7ѦV’Ds;~vÚÄ <ƒF²M}!„`àÌejÕáa¹ˆ!ékHßœ€@xð-]»Å^«ˆL'xDr‰¥×®]žý6¯¡m?'È_kHÛîSÿñðŠñ7"ãÞÄÏÕ.õ™ã L™O;¸† C^Äî÷Þ½nUB}´Šü±WßùmIŠ{6H{¤Âÿ~ˆÖÙ$†,‹‰£"^CYi]_õA…/Sß&]»Ý`9~æP  È[›«tMú¢­ƒ8„Ìò6c¾®4G„É„Uq‘GcÐœ1OqßôØš­æ’?Ý«ÃÏ^Ü<ìê6 BFÈúž¿c¡H ¤?>nðàH3ÆZ©Ñ©áia‘»°°¿ÛáûÚB ]Œ;ÙÚð§hõRh”¦4å%>Y¼ð0/ûGfN±ä탓bŠGgèMXz$éÁ5G¹×}¿©ÏrT€­Ø«ö¼ Ü ÷¤EL:zï„ÄÄ¡Jb‚]üÉ¢›û&æ)m~vbì¯ÝUšÜ£Ø(•R]QN2ê«T}H«· €¨~¾Îõ7VIøòYf¤µ Ï?¦ Æ±—ä§;Eí£öƒycs÷µa®+ʲSw,uþ*æõô¢WSXSä4£ÃÏíÛt­”æ1BVÝèô¹ÝJT„ïúØ܈ìÓâfYB(ô•kS™²¼$®,â&‘í¦­›·UM¸"J¯]+ô{«·ûÜÏ‘õËÝý7÷4S]'3!%t-­ãP!½çÑišîKN¼½»¼…†ˆ²]­~jFŒë/¢ú‹SÉp‘A‹_%,ãwU5Í’§¯øiw´ì/…1(h¨7TÖ”eÝÞ±¦ÓÖŒ:) äó³½ÿÕý§™Nþs7¯ír:#ôû+³³>ÒZ6?»¤–“ojú´±p=«V) EXT¦;üž/ˆ1MipSY9‘êÂÉŸã¦Ð‡MY¥,˶<þÜÅ[îçÄe1½}¥Dé,2 ŠB]=7Kq2Ѓ“ŸFk€%”h|OQø37ú …*R&±iUŽ’qIƒ¤Aÿ„œ•ÎšÞ[d¦_;?u䆞½ùåàk9 ¦”ñø+Z|Tøà÷Í2"«‹šT¹¶–-"-òó]MæÛÈÅ‘:*A0Äå†:ÌÔÚu5µ¸Š€I²í0‹1F¸fÅäV›îXºôvyb¿úDø©ùv¿tzy<acSJ^cà`Œ :£qÃædhúºá­tîˆÿ"óÉlÎ.i|TþíÌ›é$< ÀÀ´è½÷³YSúˆÿ±uµñ‡ôÎZ‰ÊdÒ~ª IpÛ¶â—Î}Éç/Š‰W×ø3Ò—÷u0ÍೇiáYRÛ?$YõþÙî-¬,ˆZw©§P1Ð$À§¨»§/^›Ë˜³tÁí]Vr"-ºcFlP¡ÆsLb,#¯d»}íyÍeyÀ’à4›n³P¦;ÃÈ ÉµÞÚâ!c@¥OO§‹Z S…üo-Ú<^}U`šS^°Óè‹­&˜$ Ó<ÂSNúÏ5÷Zo~ÌGÐ`ò¸ÌN"ÞÁ™›Å§œ¿ä£Q7R^t0²Ì7R¿öNB,DÏzâ¿s!s Š¸ ­;wý½å”ÕÌɸøÅ‹äšÆ¶mN+dµ]Ìæ!J»ÙˆR•q§‡\Ï•12î&`Ë^¬Ÿ·&½D4*Cª¾f±Y½eÄI .Ô¯?ºüƒ¼Ë6—ÞãÍçöü8·æŽp0Qæ/ìãò1ï«æ¥–ãV¯ýÝ–Ûºã~¸ÞŸ>jÍdG—.cý¼UŽ®»Ê×ý¶dã_™BŒñÉ“Ëî¬[ý~ΧhL1a]å—1*’‚èü¶~ºï—X/Ê㶧ÑÕM{2¯XßgŠ{·ÖfIÌvä(gggçá2ˆ¼ém±ë~ªó‚1a·¦Ž´ê&Òº;þˆØ´ÚŸ‡ !1F^ä‹šª=Û­j^nf"kæ¬ýZRÏÇ–ó>ØÃïé¼Ë¥Ø3pÞVÎóÃßÉy:)·Öu£½eûÓ<€9xê{Êö½×è§D˜Æ\’•Ö…+Wéæ ÷]œï⹇‰“ç;ÿ3n0è¬wC_¼Û{Òž÷ Ê‹Ë|w툜±`Êò]‡í8l”>cO¬L^ál"¯Ö¿4ý³¢Á´ùJbP@²Ùœæd)û!êÖø¼°™rgïÜŸó‡àd˜ï7z’óxùîô´ŒÒå;NJ 8í¢†+×]éck€%$1÷žînª÷QÝîô8./åö^“»ûâ‘<÷M§t{³  ðYâ9Œ!„Åõv¯çµtžmèÕ¦0æ°Ùn!¡U26ìt\ªAlìq‚Ëá`¢¹+3†ÌšlñxÙ†C¡'—‘$Ó–ÄØÃwÛmKWRaðÊv'–ûß6nžz`€~^;©gÇ}.MpyƒŽš<>ÞÈ÷ì“8e†Påã°ÙÍ ; 6ažíýYæ€Ën¸ácu‚4Ÿq$2ÚD´i`³y¤ÐDw ‹Á²§ÌG{ö«·]»ÂíÓ¾uãû\ºÌfsÈ&»Çãr8T‚Íë¬çÜ޺¡ƒ™ÆÈýbŒ»€µCm¬ ÝÂc!3çkë‹J‰=p6äJô\ïw€Ãi`óZpyl6ßÃÁ¯:(æ»dÁ8«üZ`õÝÔ´ÆúÞ\d?šøõÕW.ÏÒ™§ØÔp¾py\Þ»€í&×v jÈ´W8h “µ¨÷Öí,ÝÉžºü—˜Z5¢¥†tãW1G˜Mn›ÍÚÝùûLœ;fÊ#ƒÊâÒU~»#fÏž¼xë9W.ûg]ͨ…†ßKp±ïÿèdÖ ÙAJ &ÉŽònš²lÚds´H==8rìšÈö+iü•|dɃšßÌF(ð3áDè Ú& É^i7ˆüuªGG¯›YնƎ(&…µY8g„WÚ*ã†û匾ã6îÿ;ÿ¢í‘ 6ŸªZ³¾m^Oë–´ä–`yA‚Û"ü•FÿŠ€ßÑJþºûàVÔïœåtàÁç_êÌÿ tÒ»i9 µÞ„ w‚)­†:¼›ß®²és‰^ºv¼6Ut´TÒ ú»#Téªm!hµŸßÚ]D’„·!*…Ò^í“ܼdÜnÅ¿ÁúŸó»r¼Ëköß¡ý¿¹Æz1:Î] Ô–Bj#V-iÉÌ–å…ˆ fbÀ˜¶Ž($”€ßÑJþF÷A?Ý+²(|×­jQgà?”8ñOX™ú³à6°¹Ä/]2ÅA–£Z.üï€Ùîvi¹­ýðú>3’®Îøï—µeªàÉÛ\u•ñhE#d1eü×äˆ ýÜÐIç$D©-Óu“w„-vTø¯N:8î6¶Òš÷Ÿž†Šÿ­nÑHÌô¯Ûh‚ù¦Ž9óß•Ë’ÿp³ÚײÿîH&Xû?iLý{™›.ø³:Ô¿Ò~wÁß ¨[¶lùC]õ§ˆ»I•Ú}•ÿãUä$†¥j R¹uíª’†¶ ¡º‚Ï!¡á oߧ}ËBRÊÝ¥˜ü1–[óíæÝ äää””””””ÌüÊžjLÀ€PÜÓëE5”d„×’›t÷Ñ 1 -9:jCêŠ?Þz&Ñwp7¥ 1<0µT[£'¿"VÁ—ÐÐðØ„·Ÿ¾þÀâ Š2bü1 ¢&6"4òU|êç 6Uº§‚dËñŸï³Ô½|ò(òõ» BL½G·–}¿iÅŠŸ“Ø4’å¼»úI|ºLBàt$¯TóåZÔÝ꿶/ÍQ~5ÊV†-kÛ˜!6\¿OàˆƒÕ;k>ÆÜz[ ßOEâÌ“­Ë?+DKg0õϬ¤©ic„ cÏ=ËÖ×RR®6ûÜ­ˆ!:ƒ(|ü †„N§*b@ºÎÚÚˆü žQu~êù€PÞ…SÇÊ9[bä<çYôÛï?2£žÎmºôd_S¹UO8›SXR\\\˜û#äÆ¡a–®%$€ÈÛ÷ߤ·WKyVüÉS§–H œD]röԩϵä¼z|òa „ò#›^’”Éf7¤§¼\:Ñn[`:ßÖT} nj±ïÊã_3R"·Ìrž¼1€#à3b@5Ì6ìÔ“w5Ug6NŸ}4!“\Õ~ 3vÙ`@é'§oºš?^_¹ô4’^ŽÍ,áå&ž¼Ò®çMr!¸”Bào "ºº+- ÝV† « SæÀ?˜hN»;»k4)ôܽÈÜÿ—_PäR“ç9µiãV¿y÷‘ü³§ ]ó4xÇA®ÉNHÉ^ŽSõæ] €P­‘Þ Ö¿Àý¤uÖn#€€Y“Õ5R¦•UX£ÚC&?¯ˆ¤Ð»+)Ñy¬‚â2Le*öP¤@õ5åUµ$FâÒݺI‰aŒ‚òâÂÚž„¬‚¥¦°V¤§¢$«´°‹©(H1é¢IP1F J¿»cÕÕ¬[ ‘Zô&ó_þrÜÄ=¡ãì”0!>oÙrYH!· 7˜w:ýî|_6DDJ¿úÙÆÊ5!24 €€¾?Œ:ˆÑFqݪ•·|.‡-,† ãï,?~9ˆ vƼõ&KÎm›bØ4 Õ¹:ºc6òo³+}ºò­¨kâ©UÃw;ý1¾e‹¬åšT‹¬¯KLN”çåääÊ‹Ñî$TQ,Ê‹*êšuOAsEL &•A€ê‚œZ‘î=d’Ìx ð1 @E>ä—*‚í/AÊÒ¿F¿ŸÅHê€Ê„,„äJ˜Ž»ÁXq\߀º$ð¸Àæ]èÔæ€Æ!\^\\Çæ2ĤºËI·ê¥…µõ\D¥w“ï.FG€ ÅÅe \‚Ηï.GŒª­(­¬­Çˆ")+/#ά+J¿ö–f_”W,« •Å"òªRLþÊ.ÈË•’ïÉ©Êq% «´ªžÇ“T’—á3™×PS\ZI`Šd7qß+,ËÍ&eTäÅ)ù¹òŠÊU%…õ<êÖ]FŒZTÏ&(rŠJâ H¨­_1‹Á÷©0·¤¸´žÃ£1Då»+Ð@ˆl(*.có°„Œ\7IÑqŒ!NmeIE HLJNNZ”OÉ®-*©àUVAQ‚I­-úð蓈bn^‰’¢¼êpßùÀeUV±{)wç[{²¾<»œì­Üoà :æå| ¡2©¹¹yŠbÕ D/%y~1ÜP–U†ÕTäËò²H©ž ’´—¹ÁaNñ¥/¬Óû4c(wñ8>EÕkÌÌè Ç¿ ôÒ- 1=.>`Ï¥åA'ÜðëÃ'l3B C¢?ú\›9€ùr×”U…ö#‡}‹Œ±ž øà½kø)—胫w7Ø¿Ü?M~ý‰ƒVÌ㮩ˆÁ¶gA#&oÑ¢cÄ®±¬ÍƒŒ[GÐBT c™—¾bÐøe[èL)-f}Ä÷òñý»À×è0É´ÏÏÚ UT1ùiá = BÐCÏõæù‰¸*xÃ×* S qÓª'ÆbwžE´Œ§’w®¤Î^LáÛžîLÈ¢[Äü¾î<§ô{Pä^•Ä“§á£Š¼-©’H~ÖK¡o“½qXw¸Aº®pi€|°Üõɹ‡K´~R˜ÿ ÆX5ž¯‡ômPP÷4‡@¥À‘ žÎh0ºñpé €ÀÖõè I¹ >®¯¯}à 7ìdŽîm™x$ºÖÄP+1îµÞœ£{'ë7¿ ß4jc×ÚÁªôc\*K)êÉY:Ñ0ÝÖ¾ ‡–­NÏwQÁ<Õ1N¯*s`ôÒÆÙei¡¯ó¶‡DªÇ>û†A:<ˆ)6íë©Y¥ý7ø/´àåM?öXÄÛGÛ§½)ÓáuWq×?u6ÀiëÕ¶½¹?­Ǯíeá·Ðò"—À— 5uÅ#ñƒ…£½.½n<µªøkrf9Æ c­‡}¬Âc²tºáPÛ¹ÏHŒ .—ÃåµIucÏ´x,²ª½Ä¹ºœæÆÎåÜæ/ªf]ð¬ c¼{Ú¸ÙgCÛkEzô ‡q;Ê#VL¿Îr|šááÔš¹F&O ÙãøCKÌæîç¿j(}oablmk7fò¬K^ñ+'#–»˜.ºû«„6î"[믳›Oó:4R{aXµ`Cï¬pñ8Äÿíë5bß½·ã¨c£]–‡·NÄ$ËáðˆÖI©~_MÄ$9)+Y`cŒˆaè1Æïb¬€1Æ6šgaŒ1ξ‰ðÁxŒ1¾¸ `×AüuÉ÷´m¦Ô7Š?Îi˜{Æ›ìgø¿Á'ôѽìjþÉ^ÄF»;8ìÊTKSÛr~. Qûê=‰‰SãWG7žH•Ÿžò5¿ójÆ›™‡åÕbŒ ƒökZÁ[x–Ï-ŒñÞ¥“–hÔƒôõ¼ª1Þ=ÍhùÙþʈµ:÷ññârØ\‚$Ib”£åÞOcLd;ké¬ åŸÅU5Áhð‹"Œ‹^kšŒ®Á“9Fßø'y‘õ¯£8$þ~ÆSÚE>òÏÇÇÎØÞJ˜%_#ï¥òÿ{`¾íªÓãgk¬GmzÅ°iæÒSÏ1/ËN×*™ƒ1ÆÜ„¶bŒ÷ŽÖ\ú¨œ//oƒk±E8ÿå`“ ,Œ9é§ Œòi9ä¡»àâw>67'£§©Í­û÷¥ù½%úOmöÐÅô¥ IEÌSRW¢` ¦I’°óRÏ=n+¦Äïæîh¬­ÀýPYÍì£&…’›åªè› @¡ÑÃHÍS Œ1…‚ø!^ÖE}çý$1™ ËÉ{®°@ˆV»ÈÇ‹Šc²²ðGeÿ #~/僬í&9_‡O“AôÅl­7Z"ó„™c¦œNtô‹¼ü‚O‰Qw®l:¸­ÁdôÊSÇ$FÔ_¿Hª@  î&EÂc1mÃÍŸÓèÔ¶/ødP(€(ÀOÔ–ñP1­ÏlnLe£ðIš~¦h±úŠàcÚ·îj=DøAoqãçá7Bt{+5+fg”תYâÆõt -‘jWws;—iS=LÍt`üjÏK'N74™0iÊ(‹!ˆºæ+:úèûš_þ¾ÏK³óXÚ†Sþ$Wm€9Ã0\_/ç–%~¨ï®•pæÌk b1±Âˆ,öF &¢Ñay’ÐVé€".J0¬õùq+I:ÉnhÞî‹TŒUEæ¸N4³uòœ:ÅÄÒ0y/¨@o²>ÏÛùl[«‚|?3öã“/¤³¹QW‰û ¨ò¢Òô¼1ÿ+Ï­g=€“ÝVŽÎó½–žÝ £ü <ðC~?ÓîPðIPüâÎ^³gõ‡é'¡2ì{ÅP -Œßº_ì€UÖ2a IDATÊbÊJ ÎaÏ)àŸU€Z×é}]ÂŒß$¾‰xvLkÕJ¯}wVÙ° ’IkŠ ˆÊŠuX›ˆ’ºlvÊ{°°Àh½½“?z@ÀöÉo›E2¼ç. b$ÑMY³_/ü»~ŒAjd_Ùûñ_†e=Ö6„mlœÑD{ôRï©ÚÇ~üô’¤#Ë_?VײWÕžðZ'ÞÔ71ÆPÐÏÉ¢hHÃ÷Šæ“Ø%Ô>½ÄÿËbW¨èP ")Ô¼—àQ(ThÜÚ"-œ`å9Ÿé¶ùØRƒ>b’ÌãêUäDÄëÔ7¯ßÄFz;Ë[xÞÚ·TÁxaØá‰ïƒ/®Û´¢~õÉ»“u(•ÉLò¶¾pèÂÔ¶ïX’ÛÕdùܤ0D›ê£P— ¹µ§ºzoI¾¤Ô¶ì1–ocð)HÀ”Rš«@­„¿ý^Äç¤øÄø˜•®ÖÔŽ÷NocqA§€@¾/Y;Ôȇ‹(u¼~I_Ö8[érjï¢nâ"9×6Îÿ d=1é~µ#|¡KÅ–eåü.ôŸ³F¡•ìg3‚¶êF"ö0Ys@ þQ™¬^™’ê!É.-ûÍÂåùHº—µÓ„­‡BN»=ݵ Ó{ˆ3+*«ùû÷pÔ³­\‰VÃüÄáßÝ?•ÅEH`9§¬¼šä5e“ =##ccccc#Í~½:sÂ"†…¾c¯¾x3Ú{¼Ð"ìòô…óæUòwx`õØäÇoT£Åœzòý<0Œ\9Æx׳O4P&Nè{-ªq «È|Eȹ   Ž}B½ ô‹ejDFØ\ŽÚdfsëáG³¦èÜ8s@¯'« ~ü€r¶àÈܧ‡RqQIÓ*[]À‰ãù¸QCyjM~²£‘’‚œ´HÙ›* D6T|Ë#†Zù,ÙXóìFDådȨô·í±÷|à™ÚwOâ÷"ÔÔ{×ôÔ°ïчeÆn—æ·ƒB+Ëû€”&×r{I3•ú+7Ðdõ‡îèèèhkf=L†þ‡îFàÖ|Ë©8ÔÌsîêÇ‘aô„G%Èv0ãý«ïü‘ÚÂOçnS$Í’?}NKKËúØ *ÃJݶ-í§ª,'×íÍ :ÄÍúáÄ—ßùüɈyv-"Zn8idV·3{UK¬>T¸ÀI[ø°†0Ô6N‘Úu(~wdùB›¾‚7?ࡹQ0°§} ªû­Æ£«øl9ýñÓׯ_Ò?‰Ós¤¶õJT+Këzn]¨Û0ÖÜ>àñ‹„ÄĘˆ'K&XÜù,3ÁÍê×kêyïß¾i‚D!Œäþsµ+/†€óáH˜²*ÝksìF/ ŠŽOI~ŸºdöÜ>öê4À¸ç¾•ž÷7Nœ·ó|l||Ì‹g³õ¾H9.p$°*žGúdÚu%85åíÎu«úÙxôDü%¾F`ˆÈ°ÊÓ>~øÀÅ F¡ú”òå{!…"tŽ:ê»?(§µI•é 0× ÖU (/ÁÃyÓ‚A] †ß{T(°ÕõÃ9Ðw ô•¸µÔÕaV¤àzŒ’íh#VÊì#OÓ>~¸¹eúÙW<¥ÆYfHjDYdbZæ×[–é5D6/!.++ÆuÄèøäoß¾&< ,’QÕ'ÎòXtâaÚç¯_>¥†Æ¾ï­m ˆ"F1qIiYå­·í4ùo>;’w/Ök6Ÿ_^?ŒOËøúqÓÜC=Ü—ËLò™úÀvü‡/éŸSO.t¹ò6BˆwkǪ+oj:±VÍJñpt¾ôíÛ·wO³èÒúÝÀbãff˜ï™§qŸÓÞù¯˜_ ÔRÍe-µéÁçîgff¼¼±-‡Ç­ÎøžU^5fÃêŒ Þañï?¾Y¹qk– SŒ`½ˆNIË­à$eüïà][ ¸FÚ½%ñRÅåhìÌÄ÷©¥uèOÞ˜û`I¹ìuY:F!ò®ßÊ+ Uÿ/§Ó“)fïq´Y%œÁ t Š©«öh²X"ªê*|tˆ.Ò[¥'¼äbЀK{ü·nh@"&. îyÚaŒÜz´gŲÕkBGÎÛºÃ)~A ªr~|e÷l«ãYûîMü¾çĵg%ubÝz9/½xز_£7A—TíÝShÊV7%øéÿùesO=z>@¾iw ]T¦WÏ&ÊÖV§¯3_!U{‹ÓˆÈvWU” ÌMOF>¸téXQGTª‡ËÂÓ®Vƒø3¶cWÆw?¶ïбCaTqù‘ëï¹[k¦ù!ÀK݈ Ý¿fÓ¶§uã×]s³láÂ`ж›­wÑvÿÓgÎY·mÙ¬ÕÇö_¥- Ò³JÈ6¥ßR£qÍ §–>òD˜ëaPÕ ±§`ê~Hø @½Ôu•~0°¦BN)xN‚„ü}­C훧?ïÐ{„ êó«R6ñ'ÛŒDß92ÜD»¿þ.Sï¿JÿÍN‹ʾ>JÕùJ+žzh¸œkOú¡ë¾fã7¼jñQöCeÍ1ì¶çÛ"ô#d͵<!ôaŸÛù˜2!ÇŸV½tu!ÄcåÏ îlïìḃŸMO8×>òL}qľµyÄø70ç>n3ðÛÔ ,®±$: ˆKH3锎¨ [¼vèÄíð wÌLôØÏ7æGeËWX8'(3^™zmúo… «ÍCá<å?¹±÷¦áá—ooÌzwóôÅ'ÉmpvU{ ÂM»+îÜMž<ªÕ&“aPÛá$qýÀ½×R^Ÿ‹1n·x+".%ƤÀÕµ+?ב» üÍmÛÔaOÁ͈BeQ›W Úùàí×o_¯®²ö_2;–¨eX˜bcŒ±ªÇãìgÓ % ) iÉŽn)bˆJIˆÒõ(tii ¡Ô~NÙ“ I¤þP¹–ɨ%ñoÕ,Æ»0vä ÓÎ:†½#åÝó4^òâÌwÉGB¼šüóÝMMMÆÏJίAímO‘ ô65ùbåÄÏŸädllê:o[)Bœ×¾'Žº²FgøL„ÉeÞ8ÛÂÌÔÚqÒ³ä„!TòxºþÜàø;{ì­L­ì'„|«ã ¤4ù¡›“•¡©õ–ó!!˜à·ØÊÜÄÒ~Üí×YBøêTëM!!"ãI_£I$Bü;¥½F½]‚ ^0›T”zÙÄÄ8«NHwFžœÚhkijjnµÔÿ*BÈÍqèÝø2>yïOŽ4™Žšæ¢{;òï‘&&æÓÖžââÄïéë´5+ñš£•‰™åˆ»É¥|RYùï¸011ur›—RÌBÁ§óÃ×|Øo`í¶Üòð'ÖñE'í½+xL8çÕšnçSƒŽ33²5#³Gßhmi:Ü}e!„Þže1'#„q{ÿ2KC›‘Ó_å6 „X/–iN½þìø"—e!^C™ßb33SkljÞd!„B…I÷\¬LLŒÇù¬ýVA „à{ä¥Q¶f&Æf>ëOU!ôÐkè½ JÒ摦&¦‹/Ǽ½¿ÕÁcaËÁ ±K¿¬˜:ÒÄÔÔsÅ¡*æ£zuc·¹±™™ÕªÃ0B^a±ì܇#KÝÍÌL§nàáJ¿yŒŒÌ– DMÙÕ/Ò>šë@Uv¼ÛpsS3ûS‘y¨iGQ_¾ùT33Óa£¦Åf”#„N» ㊿Xh6Ôã6B(ïÝãÉ#lMLLÇL_WG „^û«Ù¬ã sk,L R ê›z,í¾·ÞõRÚš‘Ö3n§}OÔåo˜5ÁÌÄÄÊaÂÃ7y‡—cοÅV榦Ã6Ÿ{¨aZFÒÜñöÆÆæË=DU½?l ;¶Œ‹ªN2`ô¤˜<NÔ×:ñŽƒ1®z¹ÐÌÔ$øc1Gü?g0 cÌ˹i6Ôásiä˜mé¹6“ÜåN¶^Gù<.Q—éi4dgtÆäÇ'W¯E}Çó2ž2÷hÞ@=c¬Ñõèb\öJGÏlÊêÛ ã…îf§ƒ³Û˜¼šÕÒóÉåò8Ïwµ]Œ1žâbt?¡¬±Àéq– "0Æ3'ÙßP‹1A°f™Ú­ #1&SÕÓ÷ Hæq¹¬²ÏVæf)Eõ¸.ÖFS? ¹šÃáTg‡[™™¤³qö5=‹Ã8l6Áeû8YÄe‚¾1‰“·èë]+"HsÊÃÂÚ!*¿†ÇÃçVxN÷¿‰1~wvœíüã^£½ýï?x®SÆ‹¦PcÖ-oˆ9^GBPO¨Ï÷Ô¦P©¢²}‡2é÷?¿»x›kåá©-I£Ñ$Ul´ÄEï¥f…ÂæH/\jG£Ó•†P©4 µåÞx„X óÑÆÝ‚Þ†zw3% ¬*eæ ”+}ý9cÖ´q UFÃ2èöyÀ( =' D¥Ó˾½Í•Ý1¦F‘¾ÆXÆߤa.‡„uLƒ®hµ$5d?ˆ»þWû/9'/ΤÑ(Î+ˆ$EÖ¢Ò(•F¡¢PU0i }zð¨F˜×I:ƒi¸èBàÙ™ `‡Üp^¼•†¨ †Èâã«XÏŽdæ Ð/NA4ºˆ&ƒi=ßKŽ @SqèÃz÷…¹×N)ºÈNzK¨öõ$A§Ñ{9oÑQÀ”¢Ä—é }üÇi0ètª¬¡›“~xàc@4„0…J£Ñ(XÖéÕÇK*§¡^\c"sj~u€•T*x5 Eü拨µ6j—Ý ­k£Zÿ®Xµ¬º¬/T*†h³_Z¥ÈUë&Š Àtñž’sÅçâÃÊëK¯Øy%Gÿô*k…D¨ì½û°‰½çíuUh‹Ð€[›™ZÇZ1VJ¥)™N »u@ôg j“⾌òö M´›únûÆýÆsw%%Ä Â‡¨½üäˆJ‰ò÷¸Át»³y$RÄåIo>8N§3$5Íúö}—¨¨®Ý¯»„²Ó C##=¥"=CYºÀdJLÕP_“'©é0TÇ@·_§¿©‰Q?9±NE‹ÿÈù`¸»ä•”ã¼$++«¦^ZÝ£O.€^sÉ÷Y¼ª¸­VO¶ñ¿«m¨}‘ÁÕ HÙ>2 ¾¶œaM¸ ,šºyc-R½èüd …?¹|›…5и븯¬hBy-椎r 9‚M= ;)øü£*ŠÔPߥ£ÞS5´êÊë†xðGŤ'—“²©@ʪÛ-šjù'˜›¦~,)**ÖÏ<â¢Ë÷?×V”$AÝåÀ5/ÃïÓ ©Õ@cH"ºdÔ‹çÂB‡­»_Iü¾’ݲãO£iR˜ ÇD‰µŽÿ£Ö1Á;Ì:¼ñCròŠ=“WìÉþôæÆé^”—g –áÖ7ÍŠ…îçDrk1ˆñGGÔPÃþ Þ¸¬dŨ²b´êºúfrJê°œ80üÖMö òÙß1?¡üñóü>Wu?Snè¥Ö]‘ÄwWäd|/a€¾…vÉ›¤/ ñ²jjX怜‰±rôÍ`~¯ž®QÛïE!2ïaE7Wu €Þj}ÊóŠ²x€@É‹ÏÙl²÷ †ììøÒÆEëG—Ž½N¯DQˆnŠ²üÿCŽoÄT…)/C©Ì­ìü‚À­ ¼Æ<ÈÜô/%u˜ä5PSÄœ ¯åq€{~çƤ"ECÇÜ}´MMv*ßó¼ü‘¯ ÉQe•m þˆ×…{Ž\2(º²åAFóéó½Æ-?8ËŽ_-"Û"L¡KCäËÏ%âeÚk ¼[òsØí£.ò&" !`¸•Ïg¯áŒíobcá]¨0!×ßAMÏkƒ¨û‚ãþñM 9ªùÄä©éÌÚºCUAmû¶~~~ I}¿];ö­#ßÇp¦···§µÃ‚µê ž¾{üüvN3—]·w‡ß®Ý=¥¨ƒlGÎðñööžá6ÆàO˜L‘A| Q{Û[±ÄÙ¤÷à¡¥ŸÞq”nÍ`‘¼Æ{å%m·Î|î=ÒÚ~Èà>™Éï•çHP`’ÇkÄ@ïqï ë”évû% >Ó_~40IðˆæÙ*æñxÐcÒI» Wk«áªRÜ–¼ÿÝ;@…{G½]—Žº©ª-Rù=T=è €ï-œpJ}c¬Ÿ(X-ÐÛæêä=Ö®_äëj©’\‚hFØ8 !x$‰ð….ïÝÃnÌêí ×mü\çc½´èÕÉßkg¹OXèh8gゼ1ÊÓRŒ| ^Åpö †#ÆMS•¨MÉ'wÝ^Ág(¡b•¾oülõ¼·1Ì>®¶}dhÎæ ï'Û ¢=ðÃë”^ã¶Ùô‘Ìã5ž‹Y¨+ì_4=ÄÑ;`³ëaÏ ^]œ¢ ˜øI,Æ<¢±›a’䳓Äàäž…ãøóûÑÉw·‰ÕTÙþ·¶ Ÿ9ÖDm¨qAj ÒšøpÆPTÛ=5ÌÇ*èÔà^R?¥ëÌ^¦Ï?ÓÇ}ªí¸xMynê×’5þ—%Ñ$V­>ƒÎœÛí‘}ýÔ®»‹Ý¯ë~ákF8aŸ÷ËYÃŒ{¨öÊ̯^p»Àâ­{&LY9"ùž*­$½ _º|˜@’Ñdg Ñ<%$  øÕ‘sÆóÎSù.ÿ€ákMŽºõ×ê—]¢Øg° ‚îõm¶óÆ™*Ô¯ÉH®‘1»>] €Ý¬u‹Ç_‰W¦d IDATôØ5)3šVòY{ιÏy³Ÿ¾|p|ß+®n‹ìt¤_¥b„I.ÆMêŒ*f¥*º|Ìè¡®k/.1Ø4ÉAÕÿÃcuÂÉu†¦DeYÏÓ4wíð¸Õïá]ªç8Sy = naZ>^uá1Æ,À¤^úÉ ž%ê~|«ë~ú©g}Á«%7³ï{†{w˜NY0Ù1h€À£ Þ{IûøC³ùËÒm ÝÜ3Ém‘s€bŸê‚,m/߉ G|eY:{š×vïøÀ”² ò_¼ŒÏÈÈÈ€Ü]µósBì›ÏE}úôhžÇW¥½Š/g¨É·Lãä‡%vï§Îü9p¢BCDûŠ3øaÞ§÷‰ïS?fdþ¨`‘Ý»5^‹“ŸœËU’ãUåÅ~ã©*Š¶g0/6"®‡º*AB܇ž*¿sñ Æ€»",,†Ò³¯ ýç³ÚÂô×ñ‰ß2³9t…¦Zë‹3c_ÇIÏæ2d¤Eo’­Ê}ÿ%=«*Õ]F ó>G¨¡8óÕëÄŒœ"¥ž¢4>Vô59þmòÇì¢JyåLÊ1@CevTT\V´š’øßX‹%Å{J‹ýESøâ¯Q‰9¢½…q†S’ÜÐOU¶SK¾E'f‹ôV–è€Õ)/ó‰žôâׯ3j=$º|AètÞ Q•´uÓ¶ÀgAÏ þ; žŸ;²uÝŒƒA¹Íù¹ï}–ÚE]ÒÆ•~E-œªºý›×¤•€ gXé¬ö;“ÿòñŽ•Þ.Óýøé€ëÕäÜZÈŒ |VÂl³ aVñÚ#ñ@ñÉÀ7¿éâUýxí>bøŽ­Ûb*šŸ¡¬'L]|½ 0gü°³¯sBÅo®;y%ýÈú³ÔÕæDä„PÍ·`S‹qg®? º±`’ݱˆ ~ºâká¯\>je=ù!D^[é´pû‰yùa‡Ìm=s¸èWig¸Ñüµ¥ð~§£Wÿ}¯úcþÂéÀ‰ý›â¾Uýeµæ$Þ¹‘#ôû{ðùûÉEø9dßÞ«;.s|ÙÊBIzQò½ë!ß»ì‹D§€]øÄÌpx GÈ«3ÇoY³HÛzzuÓy×v¹ºi]®ü‰Ñ@ûoD‹G£M‡¼øÎÁ§íµ=÷ç66\8ÍÔôÂçÆÒæ;Åår0ÆÎKà ¬Ýxptõh·³ß1Æ8ûü–ÿkïºÃ¢Hš~õì’3&0gETrÎ’Á,¢ˆ˜Å;sŽ§¹“3¢w¨`Π€0&ŒA`™ÍaúûcvaÅÓ{Ãó=¯[ì=3»ºººêWÝmí—ÂX"²I’$Ù" Å&I:êüÀÀ"’anñgESV ÛžÁ¢ñß«NF òÞ†1ŽŸi;wïs:‘“±ÐÔm­ã}³gÄåÐEÕ_œ?Ðm•cŒÙóíÌã_Èj~ü`AYƒ¸üž™})ƒ•_é°áX!ÆŸÝÀá‹[ô“XÀaóD.§¶ŽC7•Ïå$ÉæpiGB‰ðS´µù¾—<’+¢0Æ”˜Ëa“$Éáñ¥q…E\’# xõõ$Ý —$I6›#–P˜¢0%!I6EI¸l’$Iž@Ôˆx/}“Ë“PÒ>¤$"›$I’ËÊ^£’ÍaŒy\’'6V"ä6pô_ l.%$K‚ñ¤`Ûä{•ržŠb’dK+"6ìƀȒ$Hýˆ’$)KèGÒ_EÑö¤ÛGGçEyU?}£G®;L 9}ôIØò!Ug^“´NÝ»‘¦®_r™ÎŸ–ô`[O^þÝO}†Ì˜Ñ=4.™ò›E¼:!1Žs?`²„Sû Á¦NÚ- ñ¸ìQy]Ò«ÝT(òÆõGBESœågV½á5À.lŠ\|íÔVçõ—^ÿr<Ý­Ÿù³³=X}mþž~øÄqÒ ù3$ÁT­3ýçÌ`*Îý%-$Á)ÙÍ·E©Ž¯Ë™ F3]œö }Û¦M™ís!áûÅ#À„vìáÌð’—o^=O¿q5ÀfCWËà#‰›Ú!SPl<ÂIxÿÑݳù6ÀË*BLò{Ï5D yÏYªú;Û€AËÈâï lf@Ø»ê· gÿÊ.õé[YV¢jÜÕÂÜĘÁêØáÙƒ7UŽ=uew¡µ³ÆÖ÷];dzŠD¼î¸s7;©àÅaî;ßÙ0ÕúIa…~×á&ýúv—g¼xWƒô@US[UáI×ÈG— —S¤o¤rûT²ˆÐcèÜy]<ÖÊ` SÉgŠ;÷5¹’,Á@ A çJ‰h ¡¾ã@=€ªòg âñ•3ù³ëÛ—Ù@Œ¤â?PnV;m§¡¡º”PÓê¡£‚1sà•ÜTÞ¢ ü…)ÉÉ Âàvlx•YþHUCëë^PbUã@…¼†Æõèð˃Ò`3Ãìtþ‚d×È)Ç»P6×Ä]0ü·”Lç M>¼eÃÞ‰•xÜ‹¼|³ANz™ ª~HfÝý3ÛÅ}cCATŽ|ÊmO=u¢¥ù0³«Y{˜=%ÚÃÓ{ô˜‘Þ~® ïF,›ösŽ?HM.À¨z׿¼<#.—ѧ«`¤ãçc¼çk«YOòqؾöÍW‹ÈÚÔ„îÞv= ©Ÿ›Uï»9ÿGáÃÊή½J›ÏMübì~sYv©b’TjøÜøk†& •C÷90˜Äb 02Óz±„¢ ¢ÑÌÚ¨§‰q/gŸ1ë$5‹Æù,Ûé·_‘ÅÙu{Üu~ya »×Ö]Õó"úZ;Í–`àbóó'¦§ÞÌÊoÄÅmQÉoØ·Ù!8|w ÓSBŠO{ÄáK4T™ôôúº·‡t 5kg''_—6®³Ã}nîXºÆa{A¸¥*x8ëÛÚÌ.Hí¥Âꂈ1ÃçX2Á–¾«ÒÑÒ­vÎTFÈ}iBÙk² *¡Pøàú7WÁ§ÉÛ=ž¸jb› V =º–|‘X•`ðx|ÚÅÕ1$ÂpP³0ä4>ŸO»`™?§§66€º6=Æb‰!U¾€OgØÇÖ{ˆq_º+ˆFaHÄ|©A·ÌŸ‰Z ŸOT§,šÝúLÐä„!ß· Õ¶C· ³¨°W¡é0–[ØiXßN êŸóu÷síF“†únÔò |`%WªOÖÖÐŽõªçeZÌÚÀ0tr>àôÓò°Ù}ëû^¼Y7æÝá~‘™ †’Ø}5;7íòÝœœHïÍœ"’â~R4«ù«‰…ÒÔíj1-Â$< «1 Ñ˜šªÐ6»ÁÏ?˜…ôoU²Ã3^ؘ7 ¦€êœù*½›Rºù58im<ºÓ% Ì{,íLÔîÂë2¹,ºèW=,d™XèÑ+³!÷ØG~ï^Æ @øÊŽØ¢Á‹yIýh퇘è¥}©óZ<–õˆÝÔÓ@+iãÜéë—Új‰4 ôŸ½(’^™ñ¸zdå#Õ›¨:S×}Æ ¾LMÔWMEg«{_C/d‰¨î+8øUO”˜`Œ!Ð1P#TCu=²h¯*5=Öê Á¨eñxo'Gºnº6Û­K£U²^¿¾*5Õ¯(@(¯gu4¨o¨£!hA-5ízn½¼Ú¾-«·ö,,‹˜LHÖ5hè°«ëd¢’¥>4<‹Τþ ©ßŽI}jÊÁÀ ‡S'O¦k/àp˜ZZÀ«h½j´t{ˆ$ ÀjI2Ïëê;Ρ?¾fè:yro:HnCƒ@W·Y}Qb1½}|zùùk̼1ž2 èʼn;}j`8ÉTõþqعo`ШžïþÌyCé;ª!³5Î~vóþ£ß-UT繪œ*zWVÓ{pg ³K:w4%¿î§›Æ \£ÄÜu„çHÏ‘ V. puÅOŽ­vB£ƒàz ï«‹0 J̧˜ê *SUiàp1R@èeÎGè"=#‚DD(pàüþ[£ÖüýáLs_¾ù1¥›@UVRòNŽŠK›Ýk#Àj–9h/½\¦B´öl?=4`GLØÅûÏKJŠÞ<æ>÷츸]]™€ú ëzvͨ£©JËÞ—••Ü8¼bç ‹ñ×ÐÕ¹ú\³o·N†úÚXž]µ ô›i”44kkʼB- ë³Ó¼†™èjªÉû‚óÔ@áõƒ)ÞW~,M\6‡6Ž §¬¤¤¢ü½¡Úe¥¥%5@{[ƒ³g¿,}_ò®hé¸E ‡9= Ý€‘’—¯þð±òÓÇò£?-™G ÓÄ-óVó{ KKKËÊÊŠKÞ 1€¶éÖPýÉ#—¿+}ÿ&ïdRÆ› ßnƒmU¯ãÓŸUVU},}|"-g„“/Î>°ùPöç¶w¸×È“ò[‹“r+«ªÊ_ßðv»ù¢N¾ËÝ×®BŸ¼ûêsUUaêa{ß _(ùu‡uûwRãLÝyµ¢²ª²üytýֳŠå:u£Ž:xÆŽËå?æXŸn¤k–½?0é~QiUUeæKmÇÄŠ!„sw$¤–@¯ý_=¼Èb5T–=]w—ÃøÊõ>¢N¬œ±7³` Ðþ÷“æÎà<Ù9aÓ¶îS¦Ðz,«`¤m»ºŽŒ"X„¸v$žcçN[RYDOIÛ¶^äf`d1¼2ÿL®†‘™:ª_3óñ§&ª.;Ø=ðNQYeeeÉãûUjúƒôšêòþΙ˜ û†š±Oo£Ÿ·þPõ¹êãÛÕ¡Óv=@*ÝútÔÙqôbeUeþ•ýÉ_t说†ºè—^Ω`5°jÎÜ¢BÄ©7•nCLßZRên¾Î Tô ™+çÏnfî°¼xy£š–AUa Á»RNŽÃPg¶ÖÏxÇl³ô¹½nóÚ„JvÇ~–‰7²2h×Ùþî?ݾä¶a+)Pâ–»©=c!·¼[€>ó:›*Ô”¿+ €©«YÜ€‰z CG>‚¬N$:-ýõ$ ó`çΌ܄ÕUQ‡k«g\p[q`‰S÷)ëO™$o_6g:«ÛZ“>Ýc¶ölŸ“Ûc¢"¸XÅ&xnæìáÛìzaJôÌ©MGý`Æù>LìºøôÎΛæÍš®Ú®ÏžË·ÌÔ06Íȼ´eÉ¢Èmª=æï¿é1 õúö•›Ô„iN›÷´–ŽT1‚0îòWVêα“~ÐìÔ÷å{Ã;ªp5uuÕÀXÓ>-íhìÂå|h0ä–žsÕ0ÕuµsÐÚqíö±-‹¦MÙMètž³ë†ßNÀ«ÔÑÑaÈ漚†¶†:Æö+×ÇLŒo7ÀõÆ}škõ›žl³tNI­°¿ÃøÜÔhÆ€pñŒÛC\f{õœ°lwÅOsÆŒgâqr‹·û bêê6…ÖÒÖUe"øðìQñ`! “b:Ú~¤Ö=X{ÜÔ 3Ÿöø©q0 z[ô¤žGSM[[ƒItô¹}š±dÃü7Ÿ9ú݇î»r­'–Š¦®¶pj>½« Ä’?/™X7kJ¸XÕ $æÏMž¦àÀ…skgÎ Ûç½vßÜ¢5÷D€· ümý»µSGƒþ€_~Ýcp{ %zKrî¥FKW 5mM&hjë¨2¥›:¡ª©ó7š®ÿqú§mj;Ñš^mÓ™]QŠ¢"ä° äüßÛtGM0 ¨íúc!ËÅÃ?álêà [ -ýbåÁþ¶K¼ÜhjÜúûšçÇ£WWWï7`} ¸þ>‡¦1‚&,ŽÖˆÐ é£yÂ4w*ùW^\Û•ÚççùýåG ËãÖÉC|•ÚFŸhÕ_›l2̇–  ÝÒÛF_ÂM´,ºÖÇìXõ}ÒÍ×®rZK(Q€oHùïzÔ:ûæOP3˜†ï¨ÿß¿‰ ¿me©àå¯À)h»-3P—çß‚õѼ¡¨íç›CK¨ýß*Ú@¥P« ºY…Îmßb”šéç Ô棭@m•þõɆзŽ×ß>QXt³:ÿÀNœ?®‹&¦Dy™³ÒQýqÍ®”¤$%»Q’’”ô?HÄÿ¿*)Xû-çÛˆÕÛ2'E:šÖ‘kÿ£,+hªâĶZ¡8 o[QzôÌjäp5ÿïÕAI?*»Á ¬.®&ùßù^õð!Ã?ó(ù³û‡;¿Û 6·œœ¢èÜŒ@D–¯Žpuô)•L\Š7ícv¼ª)§ªçiSü͇sŠÌ|- §[óòVT ‹ù°aN/«¥è²¼1–½,ÿ T[eñkáwI”¾ÕÐwŠIyUÆbÛAi/ë[*+‘ðÖ¡Åý{ Íâ4éM)öDZÃ̇[:¬>pELcÛŠêl˜m5Ô|¸…ýŠ„KbY\!«tÑ'÷ñ±è?©5ÀÅ¿¼o¥‹µ]ôê5|ª‘E"„«R7 »Ž«¨•ìæn_²µ®0Ú= ¸¶>æÒ“Omí{Xá>Ž ¡ê‘Vç C ùº‰Ž¬ûÃißý‡GÇ+8ˆûä„›K¸ØÄMK[³‘Cmœ°-󳙞¦jcN¬Œq!‹=×_(,È?³Âvåÿ ¶Èì±c8¬<[˜Ÿq½ËšHß–XÞ>óŠ£gì7o±\ù‚u³?·)D)ˆ`ê ^9öÖ‘†ttt™Œ&K^ŒB¢H¯Ó¬Î}t5™rjÍ)!K{D<Ê/|œw®4qMøþw€ÐêIaçXC>~xùÓñ áß òÁ!7©*ý4µ4ZHÍkÖB2j-+)–¤pÓ–é‡c²!ó~îý¼û^œÔ Å5éG1tôZµ¨{ÑÂßS‘ðNÉn¾i_F¨òb”ˬÇgwŒpsô Œ¸÷Q‚0FÈ—7&{9:ºD.ÙÄÊ]ê—Ï:²,bÂ/ÇBå÷OŒóquvö\ô–]Vœ ðpvvž¼`[5!ŒàÍù½ýgÌe-±Š>uëÈÛ'¦9Üä«ç.÷± ;×<_ìäâþÓÖãÀPSÓáT^f¸U¹%"ö^|û$jräd½§Æ,ßna€1t°Seª¼­ã²Ë%£—í˜jÓc00ÓTS[C6¶XPýÒÉ; ¨\W+»—å÷¹Þa#ŒÆÔ̯ͯ—Žt~‚{‡mEQ•~N–*„Mé!ç~[áåæââî³ùX:BK¾žNyel„Põó›c}\ܼÆ\yÃk¼czwóý¨(„@8'ñÒÞ…£°<.Ï_²fÃtOÀˆŽKæõ«¾s5ÈÍ#nq$d¸r‰ù§+%Õ5ÏçfŒb(Û·s®ýô=-0Äñ‹CFm|—õ«×1„Ð…ßVx¹9yúM8ÿèBøt”SЮǠå×ÖzƦ!q™ƒe~¥Šór»9O£1MÆGÛ°òò8UÏÙùN B&îÜúaÿŠû  ”o~Pú^ÄŠ/i3íÝ.=.ãryOÎl· œ‰1¾OvnŸW\Íb5Ü>¼Ê6xÆXÄcG¸íO}ÂP·:y‡|üRW_W»%tÄ„×1Ƭ¢Tk·ÀòšÚúúºgɱ|ÖÑ5Ó¬žð°øñ +Gß_ÏäÖÕ7ˆù_–»Y®¹[ErXðÈËÌúD~e]Ý—³Ë}\Ã÷7âÄ<¿¹×kìÏ2i}' ¶8õY‡FÒÁ"ò£½ÕR,Ÿ(ᕹØY׋äaP>ån³qœ_MrÄ?LZë6yƸêò‚¡›ùKªÒ­ûñD|1Æ’†}»w~`É#×P¹ë‚=—¦Ô±X¬†ÚøÙ.![ò°˜?ÂÍ.§”Ä_ÒíÙ¦Õ²XuÙ¿Nq°·¾õºc\ó:g÷¡d¹V”z´¹ËÁò?ô¯¤¦ÀÏÚúÀs^ Ü–£“,ÇxÓ˜˜›²ÕoʪÆßgÝ“œÕrhK›[¹-Þ~±®¶Ž¢$ëÇûŽÛpª¾¡Uù4Ärȶ¾àý [˱_$˜Â—Œ0³K­ÇXRûûî ŒqNÒJÏÐåtfgó_{cL–?ÝõûÑFˆ—­óüVÈn %ýPôýì&}–•û2½*ÓM¬F³0>9Å!0>_:×%e^¦6çj0ÆxVÛ‘;ï0­ð2YwW†{$ζ6 þˆqõ£sÃÜF¾åH“ù!…±°â¡µçhŒ±äñj³¡k¤ëG°ÆÃrc>cüp÷ÇPüT³yIDATù 2ø¨ú‚Â"¥€Ý4ÖWŽÝà&N$øák¿îÒ›ÆuKQ‹j#ýV+ÂÍWùt·ÓB¾ì¥“cÝõ°¶yÅcLaö}›A¾ï›ã&É}N]›åäsPúD$K()»á<Þ¿Ä~úf[iðv¦Ù[Ä­ØM#qïXöîk2pèܸ”ÆÂéßû‡X»NãÊU¤»¡(ÜŒqɨ4Ñd1ÆÆbn‰‹åGˆÚ«›½ÇnÀ”ÀÏÝæö›zŒñûÛGíFFË·”¢(ŒEŽjmïhoí2~A­H®Š¢0¦0ÎÞ³Ðwq¼rá)áµ¾Y 2èͤ• „) ¯Š4’êP»:œ‚rjd»Æ“ZíëÊUÞÙR×c1›_õº\†ûo}>ÍÙ„06w°uŠž7³›*¼{~«]¯1ôgTûz­lªž¾gwëbH+;€©g>Dï{¯…8å÷#§þl5=~q@_iø4ÞÇQ‘óÌ"w-iÒ¦ñ4B3çm·ñ›f6ÿl]nÃàL.Úò‰O~¶l™™y‚É0[W÷À9¾˜>Þ!¢¤Š4êØ›V|`¬Á”*™¾bñ(× ‡ïÞˆÈO¿/‹Ë870Fˆ:¶*"áY— i5ÚjFÛ•”nc»ŒW† Õp_/ÚãM,àpÆ€Tf j¿?ý¹K_ûÌIC\6µ°K¼¸qâ‘WöýhmBr÷…þÖÝ:³FM¾0 ½u¿£¦¼VH] ¼“R£ŒZ,|Ÿè>Ñ+>¿+H9ö›ÿèEÒv?8{ÚiF6´½à 4™$O » iË]¡M^C¾M¾rÒöSŽÝd¡Sš964vü/)S]{~5ÐFeÜkdîöbÿr2,I‡ø%ÓxQ\â¢8êÙÝë ñÛƾ§×{ÐõWWe 8B™Æ•Â’oSiHêssÞ˜Û[©!`êOZ¸àTän¡d´:ïŽöÍÔ}ïÜLô‚6 3u°¿“ªÓ\[´:j½ßÁŒž'.óÖ?²lÞïu)§ŠÆ]KÑB@8D-ÔÛã¿v«a‹”Š¥ªø_¸ï†ñcû<<”"¦u«Å¹…ªÇ÷—*J%€t=<ŒoÆ_’ªp??Lºü•ç_Ø›ü:ö:wÝÃ…ŸDU嶋¶PùJq^&Å7³¿B¬W§ö¬“Ý#1D+¾ÃD fãT¯ž½,j_j„c7h2]ÿ2gÚ¢‰¿¦Muí)Ç⨚OÒÛ@‰iÉŒõôôϧùço_n]?%.Cæ2$Säbª®¶V$Ç5–œNØöâ3€ìà7'2ˆ|sWVGÊʬsé£". à—§rùÒl$B^m}C³]7µÞÊS¯~¡#^¼Ê>ê&LÒ6M¼¦vnÇLBÞ¿ˆî!Ô4Ö".YÛÀýʈ2´ê¨IÒ é 7x›s1íY-BíG™·œŸHÚøX¨Ðaƒ%uµµb èöî‚ 2‹éN—Ü©Æ]»ê%ÔÖ±J?‘†ô” O)Ý|‡n¹Å5oŸ¨#î]`ÛGë^f¾ßÜß;Æ€†éï]sß3äК½Ç}§¹Œ:kÙ•È+xºö02î~jþœ §û™uÕÌ{ôÄt抎…iÜehh˜¢ä ¢¤Åj;/šãèìfÒ«ãów_b’Î0áàê +E|’Ë‹©Ž§ŽLœ±]¢UÚ*ñáA‰Lä¿>qèµØ×Ý“kÃNÈ®qמ±âOµiÒY¢ßÊ}3¬ôbƒœn/\좭ÞÅV ˜8nüòøßƬ‰Üœ£†aÔ®Ó‰îÎçý®ŒÒÏÔ°f’ï÷Ùñký%cFŒØzþ±UW™ã/bØUO rìiî /þ”ó¼zæÁ›´Zwð[4昫·ó3£çïõÕ5™ÆPœž8~ÏÝüë‰ÊNŽŸwƒˆ¥VŽ VÇÄÔçFu6Þ>Ó{Þÿ=:F*‚*>£Ã¦”‹LT£´ÏŸ•.mվɧv&,ŒÌx[+à6p’‘ÁùÑåäé„ÂøsŠL]¨xd †Fr\Hð¬€äÁvÚ¬wϪÕ÷^ ¢=eCm‡.9–2zé9©P)y?ÒÓçåB‹Î*1[7™39ðªY_]îç%!¿$ôeBeÞEŸ%Io§·‚{o_ 7 üvTIÿKôÝ6WS#DHmé(Œi¤_ÜĆ"`ŒÑšh ¸Ù ѹD@ˆ ÙŒ1…q#Œ0¦( Ò»òfY!Eµ¾³oÙ4IÑÕ[¦( ÓaÄe­f€0F2ã"‚@tUéê]™ãg´ú’E'FãÉžËr–¶š®zc ™q@c"A¸9soÌ@Êå» 9w–¾LXAÏqcb÷ÅÇ-P0´ÒѤÕIT£S´L\ ¦‡Bz2¢'„TPlÖTDc&JâÃGÇüu| ´øÖCG}åÒSJ7ßt¸'ä]‰f‘Ò[ûí¶¥Þ2X|ëD9gZBÞ趽\föÑlo$BQUÑ7$µ©’m*±y+ZW¢©ª˜¿ýµé•NM*dé‹DËF*ì–Ö‰¨ôÐ"Ï6Þ)ê™Ú¿h›úehe­$Zû#hÙ˜fãÔêAiöð‹À€Î.í0eƒ’×(¥%ýëJ¬&ô”ÿ× ÿÍ ærêüêÛÛ½÷ÔežÙ¬°Ò°XÉn”¤¤ÿÛÁ ä5Jv£$%)IIÿQ"”] $%)IÉn”¤$%)Ù’”¤$%)Ù’”¤$%»Q’’”¤d7JR’’”ô_¡ÿÖ"~jE‘jIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/fragbits.png0000644000000000000000000012341413051004444021516 00000000000000‰PNG  IHDRz–_3ÔŠsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ'OCɵ IDATxÚì]u@UÛÒÿ­t#ba+*¥`Ð*b Ø]¨Ø­×ìîîîîÀîîV®Ógïùþ8Ôƒ—w¯¾w¿÷˜àì½bÖ¬Y³fÍ͈̚EPEP¿E$(‚"(‚"qSEPE⦊ Š HÜAA‘¸)‚"(‚"qSEPEP$nŠ Š HÜAA‰›"(‚"(7EPEP$nŠ Š þ ú÷u•òjè̃3æO³±?-KÆ´þÑ<t<-<cìíÕƒ;ÏÞW mÛ…Ž®]JÄÎ:/Ý@¬}ŒFN[ ~}tò÷óM° cDPK¾L™±¬óØ…‡¦ÜŠà0Æ4àT–S—NŒ ß½ãÂ3¦u êõ›ÙÎþíÍ›N<ÏgÊ{±‘³w‹nuˆˆ1ÉâS¿[ú,œ,È*¢O._•XmN¯¦9¤I}?|ƆbFM *ýpï‚™ñŽÃë‚ 1aCæ°&òAV/¯6ýq²ü€ñþ"[³ÿ6´oÒ‰]:Íñ“™ÌPO9ÞÌ»väÖqH§Úåÿ ¬LCòΕkž~M0fçÔpX"b,mþÐéUFÏmSÞ »ìÕÕ³¯XןÑɇˆÀKܽûà³1;z6éÖÒKÅc¶.?ó,¾ßÂY✎øô§SÂvº´ì×ѧš$öæÌ%'8mŠ±r> †´,ÓĹCg¤ÙÎ×”eÑÿóî;[LkíšøùÒüuòÜdTi6¿ƒíÐéÛ Ä,‹ß4EøjMz„4v)Ònò"éú­ûŠ?¿JèÅü¶“¶ÝÉ-UL÷Ò¥îHù_’5šyz¾kD·y窹Vyù:¹ªEbÿ@Ï{±R@zÿÊõôÕªÙçGClê¶vH¾ØeäNž1"bL±nH÷·ðt*..Y¾†¦ûòìÎW™£C5{{ûjNÕô£Þ=xñY«1ûjŽ¥M¤Ä|¸ÿô½“³‹‹‹‹‹‹s¥’F'ôk3n/Ç |vóæ­SaGžÅ3dJòåùÝ·‘¹ÇðäÊáG/¿Ÿ™71‰Ï ôþñƒç_â GÉ÷Oížö"Ïî%ùõGQiÒã>ß}øªRU-Ôì,ahã\½š½½}e_Ý O3«¬T ã‹,¡ì £À"’èÎ^ ïÇ›ZȾÿЫøõüÂ&ƒ¶ªO®ßüœÎå.ûýÅÃ{¢0†×'—×õlþ>Í®RÕr¶¦7·OtoÖëa,§éôÛ›ç÷î]\¸îEvÇ x¼zÒõÛw>F'PKcnÝxP¢ru-ŠU(Yð`änܺ|dÚÍïÒlú§¾¿ÿsyjÔÛíªhq¢cùâ›;W····wp¨øáÖ¥½Šú—+nñ¿­Ý1Nžó#IÉñbCÓÒ%m”wâäiÑ?UŒ-ll­Lp1_Rʘ«¾ÅKl ¸dhÿí{¬]éšj¼,ãųë&Æ|Ä爲e+‹À+Ò£c”¼Àܺ¸µ™!€˜oŸ ¬ì›$Qéš•*UL@ÄrÄSÚšå·Ç¿Ó±TÌÉãßûŒœQ)©íƳëõ6å9ÔiÒ§¬ŽÑ Y´öD‹Þ»Ÿ4í^«øËãËwÅ–»ºµƒ€¨^óõ€Î½={_P»g¯ž¹+ꛕ aº$£Ø¨x×nÝE‚LR„†Ô÷«ßïÆ·Ž í@Lolˆ[ØèM.-4ÓŸ]¨¼]£[@v,ÕÁ˜Ïj„çô;ôêc§_XúsÌr|¯rÃ,»}r¢a¾Œ»ô)&Î[«_h?€ôþ¦å%›öìëc¤“þòÔ„Ii1#ób%¬M5ZÚï"s;=y\|ªL¨o\²T ¡J_¦\9±F7ù5ÒÒÖÎÌð7žx~½vCŒ—оe`è˜[7¯ iÓ*àSÚ+‚qß®4òj:uÕîM :4«?}ÿkʧ‹ÚÛ4®Kû…k¶Æ<ºð4Uúõù­s7ždWS%Fž<{)£N9§‚:ù]c¿€>ãf-™>" QàÞÀ¬±=F„Žè9sçÝçúvk5v]¸ö\ê—±Tž»ü%{‰ú†ÚØË (pÏd ¥ý‘ý×÷ï{Ä„##7ì2d °_A-F/²3Ð)dJÄóVm—7+ùxÖÊKŒ±¼{91îÕÖ=In4.3ÞÃdѾ»øKh<Ã)tMܾ=w¿2Æ~áÔG]Xáݤí”e6­˜Þ®©Ïò QŒÀ¦Œì1mÔØ^Ów>¸}1¤{›‰;nŠåŸ:¶ïõ4U FÄöõn÷½’U2dó™«œ“Î4ñë<îm’‚1–GÓÑ3° D$ddž³™ÐfÇã.Å…?Çù厩 Ó žÞe YöD ž4LòúÑá,e±˜sm»Ÿï¤p`Œ~¼»›jèRÂÌà/§n!•Â®ç:·æس_Kÿ„‡û½›¶¿pí–Õs:4«?iÿGÆÀŠi½ÆŽÝ~ì†û÷® i?láa!ߣ[÷ë_S5ôW¦¼ëݹéðÿ™vÃEìk¿6cû h©ð©/ü›ôyž䜫̲S+´›·uBC#Ûoò2kxÇ=&úbű„qa¦>Å&ÎZÛ®‰#€ûˆŽ;º}x“I˜H/µ´Û±É]46{í½þê‚ž“ÇÕ’NY÷üôx7¼½¸Zä<¶”1£$(‘^«á‹ƒBÓ>¾¸5³½wŒ¡]³.ÃÇt©Ï²hcU¹ÁŸ5mš”4VY¤ž‹kÒ¹¸D&ÀÕÅc#ÍDÙêûçTQÜíkÑ¥‚ZëkŽUÙv8«:Þ–©nÅ· ¶ –?°ôˆ7Ãç5`ÀýËœÇ0ÚÙG‘­Š$ §L4føx•_ç±MjÚþ”XÂm‹{{u˜Ü,ð¤£8SçLž¨Ÿ}"àÕA!¼ªZ†þñ ÁðqK»·©àÍÞÙýŽ.CÇUbý ±é¹µ£•Œª=ëýÑvJ=ÑìMÍög@Ô…E’ª#¬ ¤ÿ?TÜ‘~iß·sëÎKÊqj9' ©L««˜O’ì²ððpúbó’©Ÿ.Æ#P˜¹»Ûf6B ">›4Dà‰â ýìŘz«›j ×ë8ã|GÍÜ(k¸kÔJaµ¦e¹Õ·£Q¶TrfÞ½þö•“³æX<4øc§eW×+"VÚÞÑÑ‚r†afÁr«!úf Y¤R-),eõLYŽ¨fÊ&‰Z§NL  ¨jf»NM(–[òk9µ÷ñ©g_Ú>IKØàÇ¥«oÚïÙ f¾õjàÔ‘Gµº¹â/í³¦®ÃÛ8ž [||ë¸VZ¯ÐÐÁÁ1[ ‚ÈTOX¸™G&m3Žì[0û¨D©–F|ã˜eÖšQ¹8¸jÖ‹Qz²h2nÜò.Ó¢G*¥—¸iË—Q'›3­Ætˆt¾©}€]á7·M¸pAç.õËdk¡¤×iÎ1ï·v­^þôp#§Ù>',™ÖÕ Bi§º%Å|¡žÆ¼¥9 +™I¾S!ôLô)I¢ÌÄ…SÙ·¯hùG”´AÁËe׌÷,(¾uåBV\ÍÁÉ\”uº"u1mæ;SÛ÷m|jêÄMGöÕÞUô«;8 ³Y‘³4réU÷j“trß¹ç3ä*yô{(Ͳ%`ÅêÞšÕÄΊ$_3€F“&ÏòŸýv²5ÃôU«_ Û²œÿß´Æ¢ÎNî8óiŸÃÛ:–aŠ„ÛWµùF*%ƒ¯×k¦‡Ù7¨+Pšë¶E’\TÖH½-å̼¡i–€Ö3+3Ú €žgÓ&&;¢ìžzhB‹Ða»žhÊsäÔ¢Kײ:UT–ürßü‹ O¬é×zÄÎæþÝ«ýé& gjÛµK]JÛÔ¼tt-(ßx÷®:ÎÅF_»Aj>dâæ]Ö>Ò„åì]Ñûg|Péo°‰çÈ2”Ü…“Sº¹á¯É¢ñK'4¬?ùt÷Væ¹—´Ø¼c—®¿0óXܯõéôªãw+[Ì$öDÜÍW9 ¢,Çbæ_ó²þÅŒ–Üz(¼þ´X ÅÙ¯À£7~Îm“z<Œ6߸QÇT0¦–¼ztkåœéïø²† )©ísPºš›[ùbŠ– §¹¿oÔûlP“`7€P¥IûÎNÙ _q-{½ãן¡gåúE=Õó®U"G³²±¯i*»ü:ÚýË)}G[ð¹GÎsz-:u.¼í&ë“ú Þó±g -n2îÜ¥˜ø¯,½:¬m=nDŸJ%,’oì½z66{L(Î&. °jPÉnÆ¥+ï+Õˆ½%(1³œ ~«nó{áòU ¯xLÜ6(¨ yÂ=>ïZ(QÒ0£Jÿ%cÜD0Ž#¡ª˜\äs~ç˜J5`QÃVõö]2ªÛ¯”¥dÈ­¬,!¦'~ª0ꘙyYËœéPD¿˜ºtϬùsÄ€8-÷XØöŠÍ ö“1–ö¡mvœ.WÖbÉŒŽ¡Ã»¶:sÄL„¿<3Dœš‡HèU[=¿]ÁçÏ–0bZz±~¥U«ú¶Ü¥fg»ÌQóÊ);Þ¶²~rëšYÅ>9´ß5½K鿸3À¢Á”ÁžsGŽ«(þSÿ1üNôàð³M‹c,êØŸ8Åf3Š8ùÂØêbuß ¹âˆˆU¿üüu®%­¸¾gþÄågLJ9ÏXîag”›Ycw„¯0t’%µR “jÕL̤$?;†Ô öYø,®•KqQ¦ÌbìÑ}_lw9ä’¸ÌhúPÇVûž¦¨Îxõ<‡_“q—ÁØuÁŒVC÷ZèóKVbÔÑ“zž>ܲÜ¿Ëìçó/˜Xµ×Å;ž’ç6õ†‹·ró[áâŠܧW±š6µÏŽ1NÍr­MãM=..Ÿ Æc ·6z·$Ñ1‰R0ÊedB“' @Ô¼_ów«†¦ 88³s‡A;_>}P ¸µte|¥Fr9 õmÌ>^8?lÃÀPÀ„·xÌjÓÀv"¨@è>oÓ›ÕÞµº9¶Ú»TT›‡ Œþd- ÿÔ¾C„Š ø¤ôžžGxQI·-Š'Í8ûV_ÊäŸâÒ¼\r ÝÊ­[Û\°-K+ëˆ)ø3õÛ¯ÿ‡˜«³Ÿ©²Y“1Õ¦P9­­¬Œ‘ŸåŒ1Ä]Þsç/Uý¼‚Ó¨9áó—ï>².ÓV•´àÜä~§2\O_½|þÄ;#Ê{eYÊàÌÔ®oÒ /ˆô¤Ï>MHp¨TáO0®Þ¥uyáÀöN¾ˆÓôyw÷ô^³÷¶=ÇT»d±a%žÌÛõÚi¸¯Qþv ôÿ ňȹÅoþÍŒ;ÉâœµÈ Åþ%LŸß¦@êýõ‡®@ÉýœI+‡N)ñ`ÓôÕ/ÆMöûíÂæ÷h7Â^k–ßê9Ôã´‰m9‡ kŽZMk3 e£;g¥¤¦óu¿D½t¦G½zúzB=[§™óg*µ45-g‘‡´óé:³ÿõSÍ®ì[”½xŠ×h[Œµ«[Ë}öþëÁ3FÄ„5©]‡#¾ªo—Û‡ pòfMMèÒúEt‚Ü°âêc„¹õ#q¹g6Ìœ2³Ö†(CC}W×SÞÝø$“§Íkä´@{$ì/{kÎÒwen^ë 1‚¨×òÝ[}[-¿ì:¯b¦ËLšž&PhY[²o¯/999iÿÔ.ÞìR+dié’lõ0ž¹w±wý>›ý/†øšHRÓT²ÀrÊê) :Ï(«à¨Uòøïó`.•W½ûá°Mãg¤¦(ÔºÖ³5yШî§M‹—u^½}E÷æÝwQžß³X’ž&We±>'KM•fVUó¨jzÓØ×íÏNÑÍçîh®Qzt‰#"ªÔhäÌ¢MÝH_¬ö8oScÔ²ã>åõJOM•©µ–«B’ž®q2½ÑûÂkØ´nLðèÈ„5¼Ã6ŸnTÓN#ÐÒ ‰¡ 0›:¥ô«70ÈÒÓ•J5â”ùw?mŠÉd%.|¼XQ÷Pøô”TuýM&o]ì4Ü\®Ò(qiiŸÜóÐ_jwíÓ™2Y?%i)2µÎ–MFÌ?x¼o£ÅKÕ X¶kóðÖí|ûœ9µE&IS˳êpò”T eNY¹¦Þe÷E—ªoú×£gÿ5Ëî/ž×þ©ã=Ÿ§ ñ9Ox>O¹ßå©“ÿçàNžó|,6Ií:NÏßAÁcÒ¯jv‘Ÿ5—óŠÏ ŸçY®†ò÷¢ŒîùŸ =$ž/ˆ¤:ª4ºˆ{ÍÔóÚ4ÝÞkÙ™/ á_á»Ì®/6õ’2Wù'Hû‰ŽQóù«äC¼ðs­óñ_¢nä OÒª›§ÿýüÆoó÷é_ø ÚMÉt¾gù­ŒZ¯u«Õ¬€:Z?™Ö¢ lD=»7*Ho×m͇ÓF5Ÿ´—¿Æò¿dL'Uò7Î ¤2 ”e(ÔùMad`l*²Üè|‚ɇyA“¡‹Øù±×žz>-%õÝ‘ WS|¯”ûû6ÊlÔÊzµhbÅâ‚)/1uŒšéª¢c~B1•R*Wò:üùF&ú"A.ë¿BÿÜÈžþЪ›mKKNŽqãµ gÓÿ<~Šˆ¶ ;±j ™ù+ïA•«í_ø÷¬ŸŸÀõ ]§ìÍw­D-í5?¼CëÀRIèÖ¬ez)·GW˜ÿ»údÿEŸµË Õø7Bÿù´ø‰$ý/Å<8üð)¢‘¸)‚"(‚ÿøM‡)"b\ú×ßÓªWþ=‚SõáÙ[ójŽ¦ >©,Ë[}xþF‘'Ì€¸ÒU\(þutjÞóÏ «8W7Ì).ûü½Z7, R5Azô›ïǪâ¬ÄIß¼ýXºR Cþýó·ÊìZL`^¬”­1¦zÿìi‡’F»J|ô×øätž˜‰…]¹ÒúL£‘Ñw/R,*ÛÛÅ~y•‘w' ^dïTM/m.âå ‘“¹ðïO؇w¯,KVµ1ד'|xŸlé\¥˜öÙ'éé‡GǪ¿ñøMDŒI“¢#¾'ˆÌ+Ø—5ýg¨<¹=…ÉBß½2+QÅÖBÿ"‘õ&‘/]µ¬+$¶ÿH ÿ7j7“ºz ƒw…µ+ÿ{,$©¡uü›yàr°gŸÈÆWçvskú­Téâ9ËWª†¯>Æë·æZ iJbŠRPÊÖ…ÊzåáuåréçV.íÒËW´Ö˨xÉævf)ƒ}¦vÝ·k@ †|caëñk\¸0ÇßÛ¹´L³¯QÒPPr\TršÂcÔ¶m«±íƒ<÷ÝYà //pI³z´> ‘¡©¹˜KɨÕæ›Oªfepë‚ë^ Øu¸õszx"a@zb|:é—¶1#‚Š/µáàòâ9L:ØÇÕ&ìáô†&{¥«:µð s¸GƒRŸtïrºåÝííµJD¯Ñq×;ó9_=¬yÝ"ï¶'ô¬ž;ù?u!@òüh«Ù‘÷ °ÂP’ëÞÚ»Á}ÛýB4öÏlº_:éð\_ögتâßÖï°ãê•9úøÇÁïÒnž¬½cÙùr» Èoø×b@yï!h$`þì ¹ ê[ ‹ÃØÚØ0Å ¶¯e–·³!€G«F}d|pk˜N<ÔJôX}¨W™üc±ž·u©o·!÷Û©[ÌàÇ£ƒcŽK÷œÍ´nòj´š³}påLûâ@û¾=žûÞt¶)@ºëµ¹œZçèéÙ6fx•ôòòÞ=‚Úí¼xÊ>—É´ÃÄmW§v›šæu`ÙÀŸ´umeÙæÍ?9Ö„|…µ³€QÅ;ïvÐÌÂÏQ:ÍD¤Ëó¨c–‘÷^”f\’˜hnÈ­ÍsÓ 1°¼CÖ¹…ÿ\0i0Ì{#+ïhµÆø-2ÂÈÐX KèiÈM ×Vòc”¦˜õÁX¾òÚ &×<æÅ™ˆ1¦L'ééÿ#mb¿#ß Šy'Ÿô›5 RI5ðn׺ó£OÑHù¥.³x`½¥{‹U±oRͶï\_ÞT/âö®±Ó×(ŒKrÉÑ‚’ž‹¶-®®ï—7„NÛ$³°3a‚ñÃ*uÊÞßž+ýzÕ+`ÀÞ«/‹ë5íѽ‚>Ìk6ï\¢BÖYƒÓµÀ³”"í…•w&x^7{šVn´cØ©¾ÝÆ\97mÒ¨ùÍÿ8TÉT˜É Äóšàl"ØTnhh¸ä{lŠnqCàßïZs[´æöbÓL^`"#ÿ1;7_ö;xêþäŽnù+ñíð`] Ä÷`rå©â~q׿‹R>>L2÷Û¶{æÍ‘u—¨¦ßXÕ\³ Ž†º/¶ »9·ÉùÕ£ì¼eRªdü÷Äšm¯×1Wà6û°3¸Õ±v¯w•~{0hè„Ï*óú*ïFµódadŒI® ª¹ÚqœÓ‹)z oï+JµÚ´y¼%wwËà)$&v,5N¿ŠÏê5³J Á¾­ØfÇæ~¼P«¼{+¯°þàºú¹mÉèþýã ×…t;ë>fë6çååG”ºx0ÂôÔñ½ªÇûL]ÏÌŒUÉdScÞÒŽÅõxeüûÞü$+e®W£aÇK;—->zÕ‹NWèxdm×âg?‹Þ?zdã2ºêû÷¤ ¯îI«u9ºr¨`±7›õ:ÃÈ’RÈÖiÑÒEU¬ô¬ü,Ô—N© ô??XÆsÀÊ°‰ç׎\uR.7èÞýÑâm>^4{íýâe~Düpí4jŨVD`Œ_:¦û[ßËÙ–j  AÞ3DôUûÀéó»;Ÿ|«f)_>(Ë­Ú½ÖÙï/ ¿ð«Tßi2£²“®«_ÉŒm™;bÛéF†b‰A¹)«Ö6)g”‹ì‰#š¦ûOß4*€ÅÞ4tæ«t#+–ÂÙ8.\º¸Ô÷«Ý'¯„”uîØc¦ÿd^)ûËAý㔇KÐŽx"RI›ø¶ ;JDD’–¾>®]–kÂŒf4qqî ‘zrêSnsšº§ÖŒ™¾íÏ+;6õ Û÷„ˆˆ’ƒ}¼œgóD*yʽ{÷%Êœ«¬>ºÖª3|gøƒ{w³áΓ.V÷WŒôè9¹”?Ö¨5ýÄý»¹àþ‹è\Ñvê‰]ý›ûz¶½&WUT°ƒëÊwªì˜)uòó†n·¿ÈˆbÚ9¹-y%ËÓͳµ£]ێͤÅó›BZûOÚAįmíÚfýëÜUÂ'wõ¾º´%ƒ¼í§]N'"z9·¦ƒËŠ›)š}›:-:—øö¸—GÓO”ñ¹A]ïËQé”r«së>3ãà>;:nŽ žWvtß~å;}ÜÛÙ­Ë>"Ú4Æ¿õ€ šr;&u­Ý°cŠv÷Ê{ãÜœjx©¦,¸¡Ë¾{I”òÖÇÙ}ÃÃ̲›úûx‡áˆ(öŒ³síþÛ?hž¯ê^³ý‚—|ÞȺÄv..§R‰ˆ¸Ç“\]êm¼• y½à ößÕü¿²GóNKŽÑÓ5í<&*ˆˆèìü®^ÞÞ¾ePô1'G· 瓈ˆ’ÎÖstì4ÿÅ´svÜE<§èÛØ{Ô¦ëšÖNLjë1`3=ÛÓÕÛÝ7BJD¤ŠºS×»adš’ˆ.oÔ²ç"¢ˆ½µü¯üÐÔûÑ«¡ÃìÓ1D”pz˜³{ŸX""J°Ü·n­"µ(õãVM×zWjø™ŽOjâÕm›šh碑—×<<0¡GÐèeD”|}š›wˆ¦“ÏGÆ8{M%ÚÖ$xüu"åœ.õ»Í9LD<¯êßÔgÄú«™ gJ{÷þˆ(êú /ÿ©? þüÂo9L¥<>‘Q¶Ifš6¤nç_ @PžÁµ§&í.s/G¢Òa‰2Ç7¯Œ«ÖËÔÈ(pàÂ@€o“$~þš»ˆóÛ–iuDúæuëÖѽÕ3¼Ø½dF®-XjÒäüÞ¡…¼&±›ëÂæd]àQ¦Çñu³9&üG IDATšlëÔfÖÕæuêçQRåiIÉI"2~¼™5t_)´v9ƒ‚zI”¨ÌLòê( e­…’$éßT}eÆõzz™k°3-a‘mÕÈÃT´àQDB`õbß^ßU›ØÖ¶5ÈsÏáÚI ±¯ÄñzÂ2Źˆi(g˜¯½Œ{׿ÕÝ¢ÑËÚ¶n2ÿÊ©ü‡™¹ ƒ@Dzú¦Æ©)ißß<ál,;9›iÈ44tkÿm‰ª`@-*>±{e †v5ËÈ#>¹¦’91¨ä€LèØÖÓZsl;o$-%âÝë4¹ªŒµ0ú[2 :uäSÍq«õ"øõš8ëD¨FTëÛ ib ,í­”úºJT,¦øÃq"RÒ'7®‘‘°Æ#Í÷žû}@þ2°zƒG×o¾ÆTH·ñVÙ¯O«º¦&â µÀ\7_¦Æ¥xZ 4M3ãy]ã20ÓË `Ò‘Ð\$`šÛMz†6Œ%È5W5…b– CÆ}èÙ~t:DŒìÝi¯mÞ$³ÆФÁâ|TtíÚ¾¬•ñ÷45Ì("SDŠi2–AÏ8—½\(2ÈÄJˆLõµ¶'R&ðbã f!åL™[†–‚æ½ä™¬–<ßïYoöáÝÜÅ ¯I| MÎfH¤¯kY ÅVYqÎzú&D©°',t啯m:w­lk–”$0ꉬ¤µA^3ÇÝž¹P)¯7Ô>7U'6žÜI{ɨò¿æé‰ÔŠ‚¯¢æ¿Ö gÑu⪮U?¢¾mš3¤û°bæÕ 2¤JÀ’Þÿ`¬.‘ü^¶Å%¦ÃG§±°òÉÃ;†ºŽÝÓ°qõ!Çt}eÿb1^ˬP8K%¡RËFFó&nþ€*™åˆÀ˜âFLLÓN®À¯÷z›ÖxMâ»5Eóï:8·bk²CÀ•Í34bö✱T527T$¤gb.OÊ1تùtŽ'&``P)’ˆÌôDP\PbèØ jÆÂ’¢˜…Ê×缟uüqã2péÆv"bkc.!ƒ×´ÄÉå?ñ×äþÅÄÖL)[wõ±‹v8óó?\s¡eó³BòlU6&ì&¯ŒS+t] äÔé\榔§3fj$Š:pôVèžg½ª <ü|‰Ob€¨¢]MåÛ,9³J­wÏ©Û¾õ ÕÎt¨e ±µ@![}õ‰«¶[òsA¾ü–/1Ø:T·ŠB–æ?O<鋀ضLEšÕ¥IQÌ ²™%{üèé´_ôDLãÇùô鳂ӽ,EúF…"°¤ž¡N#, _õÇscŸ™mªQãÁS«'^¾óeÖup*µniJä}cå?©WÕ !¯¿ŽÑ”ãÓ¾®Õ!Ú´A—€ª¿%ÒÁº±}ɯ[æïUØ»ÖÒϴ։ę÷¯_ì {(7T)uúS,Ý\-l?¦Áüøékú…ᾌ½3S¿È4”¸²m‹È±§M¾‰™Ööðpww÷p¯cöóà!^ ¯!gÊë ¯II€~c/³û[Žk¶•Çg6n•‘ШJIsƒã§i~'?Ý7}Í…Ÿ{—‰S €€ÎÑgO?ÏÈrN¯šuôþ@ؤä»ÃgÒ0¤?Û›Âå_ðŒ—,=øZ³>:µ—•lnÈ@¼ÀÀP“^äÛ†›¯„‚{¹½ß¶)ŽÆâï­®^- ñ%\ÍK¸/â?oì¨oAåRVF'N<È´`<;0mõùÌ-V-ÓÓ!gÿµŒkv²Jô6=ÌÅ8NÝéÕÙ:9qjŽ'*zUúÑÓ§NÙê®,íËÇýÑ›ƒ±qÁ^£Æv¸Q·¶:ò]ßµn¯ådÄ<ìÐvÈŽ‹lòbÎqêýæö ª‡-ßÁ=[õå8®@¬…ÜòÖÞëµ7ðáëû¥²=jï½zŒFBÛEÛ4 îzÕëfƒŠP«ÔxRoïî½?«A&29pêT #A‹ñÛ¤ŠÐÙƒÛ NQšê‘B`T¥ŠÇ¹ƒóÍ@xN­Ö>³§æ ¾Æ©U™²—xU®ÑñÚÖ£nµ÷7v  èÑjE§©ÍzĔ循='Žh÷nÅÜÎ[*ì'NÍ ^­æ@çÁNZØ(ø µ*Ê¡¾·2ýeÞ]›¸Ì¢Ù“Kk§ýsCz78ìPWõ.Å´â= ©Õ\.5ˆãtÎÔê,’RΠWÃË£â¤.Aµ«–x!Ù;#¸Eß #V/¿Ú¶ãÀ¦m®”3JãKûƒîiœ…ªœŽH­VSNÚ_5G`ým«†¶8Ôå Æ’7ÑòÁó7hPRç"µZyõ|·„­›Úµ»7oëÝÞ ð¬PÃ%é퉵׶!¶D¨²®áÅÖ¾+Û™ÇÈí­Š¨óqé›»¿šÞ±g1ƒÔÏ$V‹‡líºº—ß=gû§¯£6ÌéÞweè ëõÓ–µ8Û¹¥OÃr¶F_1vïî2Æà85»Í}Ô¬_¯E§wŒÙºrX›#¬TÑDò&Z6pîz–å<ŪÉ-‚ZŒXzÈ¿Ê?,øæw$ ày~@pƒ¥Ç^h¥HÐNð“t |d?I9;¬Z‹e?I­ðç÷šâ¯&  ‚‡@f„Ѐî\…D›×έçW¢ý<݆Všþ§„àùòèÎç;}CuuåxЕ#‚×q©Ÿ½¼¼ŸÇHI«£œ–s»3ÿ<Ja’BäLÜŸ1Õ[ÎõšFɹ>·ñfä³»•3?°ãIêÔ9 ª7(üŒ§¼>çÞdFA›0¡@6`ÛÉ?(µjðœYÓ¼4n1,Ø?AÁùõq7Ò¤ˆð[MƒüÄŸñãä•0xuþ¨¤VJ)Wq¤N‹;rl;‰ÒO>êåY€HÌž^?‘¤(VÎѧV¥Ü§ð„ûg/¿K0Õ+þéýÇŠU«Ü¹x¼´sý¸gW̽ZÔ³á2ânßy˜ QY”ðñq7hì>ÜÃk—"åå\¼\L#N=3nÕ¸“Æ Þº…ç3—Ub{W;£;—ÎE§S•ZÎå­55Ó£ßÝ~üF¦•wö¨YÑ@FÄÕð˜ª+K.ß~Î M]ê7.oÆžœß|)Z_tâXz†¾å͵7å“Û7¿Æ¥‰M¬ëxz7~»zäN¬Ú¬²âÓÛ§Oãß  ß?ý(]ÙÖRÿÓÛo"ãx~%ÇÚNl4OywçÑ©ZTÞÉ£f%kujìá£;˜(õÄá£>­Zîo[Ÿo9"80 J ãì8f\Ü:ۦɂn>D¨5wJ iŸ­ôUb¡¾@$R(8‘üƒÓ‡öÞ•sEE†oÇ»4H|óx.DÀ§¢/â«úB–€Óç‘,ƒy ´ „^–R”ø§®™¡uœß‰x`p÷Ì6õôñä|†mU´j"¨3p)|q h…ý+1ö&`ŽMëØå ðé!n=ƒœG骬Ÿ9®Øïà…(i›y1#[35ë\qÁ¥+âûf$­ƒ¥1” :+Ž&)R5¬KÀ@”ÝΫ‹^J LÅ©o#’ÄiŒ=Mãî¼SWmïW œôÁ­[ß“2ÄFVµ=½m@síæý •~Ý&Í’ŸK7usw(°oo>{É *8Õs®`-ùòüÄ•GzBýèˆòÔk·_ŠDß>}°«èHÉïîxëS¬ HèÞ¢Ùò½¿G}=´j†O§9 ÆSmîã3jÎæˆØïëÇöYºõÌ@ö%lÎÂi]º~Rÿxp¢wŸžÛFßcê¯Wztèó™c,þæê†A½O>üýñθÎ~‹N½þvלU;OXE&–ßîíhçÛêUzb2 “ÉóÄå1ÆÍîÝô%Û¾'$Þ:°Æ¿Q‡Wr€Ôr©ò¤¨˜T¥PJ¥RˆôlÜë¯"¢?=ò,]kâÌÆ‹d8ºóvãÓ ŒaýФ B—1(nƒ}6[ÀÆ/Ó#ËE®*zÀØÁ°0Ç ÁòGN››»Á-c†¡uC ÜÆ ûŽÐþ8æŒE€tL‹*\[„Êu0bfLCPzBó…î*ePÚjÊ«+™€U.‰é^FwÏA`ˆÊ¹„Q«’°³Ãž/¹ÛáÔ*¥ 2©LM¢;§VÎ]°~ò†óo¿¥Ší½§,ß}yÿêÀÖ½“cŒ‹ëߪÙê}á1ßžõnÖ}ẅ‡oÆx²©Û~îŠûúêÚˆÎM6ÜŽ3’Ê”€B*“x™LE¤Éd܇Mz¼÷>æÛ‡Õ3tŸyˆ1ÆI¿ú.:p#)áë¦iC|úmR20°Ôä¨29'¨N®[|â•$¼âH[»„)ƒ;¹†^)SiQuäXTN¾YZ¦À§˜åµwÜݱ|ÛÍØÿ´ ó×—ÚÃÓë̇":³(xô±£ž!G‰HòâdÆm<ß«µûêÓ‘D”þbYízCÒˆ(剫›ç‚‰š®ÌkæÓ÷Dž8«³³µ½43»Bdž½çîÉì-ùÝ‘c×Yñ€Ü«üÈË¢Ÿyyy¿ø¡IŒ2Ô»®kÇDDI÷\jyü&'"â>:º 9«éT5µQµÉTD|¿@×Ç>g&Xx²¸†{ÿT¢çû×qm¥""â$1 |=¯¾O!éS_§Oåy±èDZ)5ü‡È³ð_:: çØ]DܦžÍ{m¸DD©_/{»7Ž’‘|šŸó̧™É ’c>¾J%¢Ð ×¹G>eâðti ÷~)D)Ï×ñ–ž+z‹ãø/ŽµmPÛ·~Ã5gßE4¯V÷xbN"eN}OÅçù®Ïqj.ï¸8jW‘Úüx¢Ëm Vž’‰”*Ú2‚j»Ò›ÄsÔÙŽZþ‘ˆ¨_ihð&"¢èJm«M¹%"JýL@±D)Ï Ô%"R"€P’4”ª bŒ’9≮m¡>C)QNDd bÖ¤äò²ÙÉÑкh"¢ëàÞG æÛˆˆZè“I ,Fi²>4´õƒvìœlªŸÛ”;‰D´-¬E@Ç‘™D‘Æœ>~.-‹¡'ùÙO¼!%¢O;OÉ|,èæ4vý .#Æß·Þ¹WI™0»2¶fþID‘w÷x7j—¡""zsfMý–½U<]œÖ³Õ´-™-¨ž< ¢ÛaÝûÊ Â”Dùy{]üDDök9G¥™S–ý™,>=úé V>cV"’ ðñ^píSv¹³Ã[4}DÓ Çý'Cÿ~ÃMÙ FÆ«ïET6 ?“r²þ“!1|ëÈ—‹Û5tÙ›jôgË2ô<…„ù][™¥U5*:j­‹ªÕÍïïÕ=E®"P,§'—piŠÆLl- `0йԭëÙÇG#·bb€ 01äõê×Ò(–" CŠJS€ŒúÁY~½±uëUboþüv\®´Ÿ­ „b&×¾*•; ðÚ½èòµœô³¼žŽ\N?|tÖ5nýVýš… jñÍÓ«Up»æžÕ-ðo#c8³o7·n½@,PKq;žù<Œ¡\íV‡®nœØséÌ› ä‰åºÅÁP–ê•;LQ ìIäìÿúÁ !z/…Á\¬…ƒ„¨DHLìp<ÚvJ4G =äÞ;‡µ3;Tà#ñðÑÙ# ¸6ž>„CTªŠ.¡Ø¼"Ó†’D9¶ŠÜŒ`¦Ñnré/FeÐXgÆCí‹“ t\EÏk땼íäå+^mn× Ó¤jX³ڋ©}{ÿÈx Ifä, o¿L®R«v¦?[ßÕÙÞP ,õB.ªTÎR3ÝuÛ[¨HCI]ºƒÞíf¶šÞ5ú‰_“ ŽíšÔt²¤G.$÷‰Þ¹m+G`L] ìÊçxÿÊ–¹‰¥sʲ`RÒeõ±ë—7M¾f냛ña®Ñe³+Ô-Ûÿo¦b×.oö…#ãîÃJÕL*ýøƒ—·/8vêò“ÈIQN0'û“à@"‘X_Cïï'&wœp̿Ϩù‹/[¹¨”¾ Œñœ0d5c\Ü$—‹‚\ ó€*^O,à4 SYôRFSF *Àþ™Ïz¥äô4Ÿëf @_,Rqò‚TËZæŸX7Ù£¢áñ#\êìz˜R¨y=½\8ôRF¨ÃJ˜úíù†ùãÖ­ûLTgýÆa€I)#ÙלOKɾ& Ë•þq2·ÉÌù9Ä ]&ÎèÞÕÍsÐÐh÷¦ú™¶#‘ö’04Ð$9‚1¹êgŽí)·°h<*™ãÆ9 +‹x¹öWé´«·ƒMiØå'ÀÊi@,Æ΄XÒ¤#Š¢à $¾‰&07ýé>ÿ³k´î;{þ¢kWz˜g^7•(y}‘^v{b#=Ä)z"aæt3¾P W¨ ØUË]¸r¨]}ÇO×÷yTw»ñ @3уZÍq§V³f!!žv–ÿ‚kT}pý‚VÞ.ë g-ŸQ |yS|KÍf9ú’À•°ùGäõû-W4Ev­Š'Ÿ<¢(S¥. êæfñâÍÕûw '¯0Ío\gÝ íÙó¬f¯Ám}k€ìqŠŒ¤oXŒ¨PDÄ{|1âϬûY ,oeQ½A×®b0ð29gh€¸…¤Ž×ÁÎdÍ“xšTºßâc¬í ¨Í§¥¦—qòîåäÝkà˜‡ûÆý1iZ—óaVFöõ»vwÀipHÍA–Ž»·fqXx„ȧi‡c÷ç™g:S˜o=ƒóG_ åD–òö¶ÜjcuÃ|Én €™=?çž '7 8:#k‹P•á ðø=j;ñH–iUö®€ ïªØ‰ùvŒÃ×(Çè¹°n®Å‰o©‚´f¦Z›öý×ÄkõT ³‰X¶ %ê ”v?’4¨8›C$ûßó+mêúô ò""ƾJ`Åå­õ$¦dÍ·2îkªiÒ3.#¦'§råõ`Œ‹‘®*[J·Ë‘)2’ɸ\p×þÁ]ûÏI:åîöºß•zq¢d£>}3sïKÒ¥F¦Fy\á:§LòãÃÞõ ÖŸùäæÓlɹg•L2Ù Uc뾧Ÿ!¨:Ô×ãÓV­˜“dþ? ùëµ3·/­·fïUûú-æÛ½þ™=«¾UsÏ“ø‡‰ ò)ª¿‘UŠ1§2zž|H%KÝe.gªŸ—d^¢šøý÷>2¢ø—§—~.$u °ðq«¹sÅ<H­R=Ú4Ô­õä©B±˜SD¦ä¾ €j÷ëbúðĪ©jŽ£ô'‡ŽÝuï4 çø×n^M7ô0î?vý;SŒ1ô¬kñömJ@³â˜CgïÒt­Ù•%qb<LŽ×|‰D/ô †o#ÜâÔ3¸Z€ ©®ˆE¶œ d0±  Ò´œ>åYf í Fž‘!ç€J.‘j8€àÐmÔH7µG=¯¦mBœ-œ=¤óƒ5gÞOº Ý<­ñDßÆí"½g7u6&0 V;ä•|ÔÛÝÃÛ/˜‚Ãk€W«$)e²´2C"ѸuÛýÄ·|==¼½½».Üzb-`åÐ{×ò!ó{5ñôôh3lãìmÇëÙ™ààÕÕ\rÕÇÃïeŠìðâ°½Óóì[?íà IDAT-läœõE–Í$®°g߆§+B\ë¸O 7ÙqWº¶nþ¶ë?þ»mâ;Í®ŠÍûןkµ¹rR"Ä_ÛØiÊN»ª6|ìÇXŨå‡Z9™%÷íÐ!BnåPJü9¥„Z×)èt˜ÿÒ”™áK½ ú†sðì+7ÏÚ|\^mdÔLjoŽ¹á—ß[lº´ÛA+òV½¬w«pÛÎGæw»¹²eØ»Ö áîU]:ÊJ·ÞµnŒ€aïÜ~ëμ©Q«vÔㇲòíš~¦O3-mk[P/ r;œ\ýÜ}–B|¼¶¶×¬÷á—–MñN*Ö)*ú‹¿k±“§Ï{tž2»Ÿ?©"Õi4bïËV5 ŠVEü.øÁ<ßvk>%CóÿÕùn^ý‰vMmÜ~ò žhûò™;/¾Ö”Ü= Eëy‡‰H÷ÄÇÝ+J­y,Y±pqD²òåöi¾=Æg6šütö¢ "ŠÜäêÚ7ƒ(õýEwïF1ñD©/½j7x‘ª¤—+ÜßÕtNóCýzO=ADi×f8{õùªÒ<Žïä_s]xŸõ92AšÿÍ“tL!"¢Œg;k7ÿ &":²iîºÃ÷2óLìÖlÜ"z½¦[ÐlMŒ„G›}=ëž}ž§ÁSaþGßÊ ¸Šºîâ¯àèÃ*§ÿcï-ªZºÇá5§èîP[TBúi±@Åîîöڭ׸zínÁ.lALlQD”>ä!Oïõ~Ø ¤ú<¿ëó¿÷¾Ì§söž½fÍš5kfͬèd»=¹ºõÖ3÷§!bå)}W ⥕ƒ\†¬ª”#"Þý3ÒÕµg …ˆ(ýoÍõã‹å¤ ¶½SªC]ȦEÚß”T´Ô®ç"–%»{øä9¿â‹ñÂÏÈmqþhŸÀ˜…ô7Eæwô™Šˆ”\ò9-­\,ÇæÒ\þIy¦@zbß3‹A}UÑØmÆ“û;´k‰·fÚé–_>{âä‰B™´„_le¶dýïG_¾ûX*T?mŠ™&Û¤c[áÛÄÝIù”)Ö°œ35Š “ÊP ÞÖ® ©<ñ†>>N`uí¨ÊF@‰bû*´R×­“mNvub×oFæÇÔÔÔÔ¥ŒZ''? Z&­[è4HÖ‹2ý¶¡€ Ò­G'Qöù† îÝŽ\9wòÄÉÌrayI%€üü…¬®ƒ#8€ Õ9DýÓ$E«vékE»P‚º¡¦¨¸ÚÀœ0Ùc—þö@3~÷ e:¨3ÊÙfáꥥAId\K6ñtë @÷•élíø)%^×¢ ÿL†ò’“M½Ù+>øÌ(½p¥rø€6”¤³­jw0¤Jå„Ánen®Êa4/ÀÍåŸuT,Ë,c誱¡QÛQs#ƒ†-Ü.`¨š˜˜ê(0iÿA¦ŠQìís†Y—§Œáçνî’AÃ>êfìê”ÓkÇ ‹v¶æþqí}]P‹§Yî^v /è³Å@E¯Žç*Šl‘´ sʱìî¡a£ÆŽ7nÜØ1 „b¹¤iA@±´[ÖÅ(é¨HóËådݨˆ³6È•ŒLMt•9 Ë)#zêºk„Á$ „•»Î‘çâââbç5µò{º,§:PEÝsÕÂS6ÞP¡Ê(ª–Ý/GjU&ür™†2m&K@SE±R\ ª&ª¢´LñÓç ­zôçîq&>ò’Ô:xªWK|[±&ZóIMsùgs:ëQ—²ËkN¡–Ñ4!â—I©EË®_uÕ,8Ưsˆa8}Ý©r©°äKdÈàãÞÖQ–Fª¦ö›ž—IÅÂÔXÏ>㜞_¯LÓÐw‘ñªÀç®{ NnЩž–UE%† ¸¬RUA€tÐc^\+’"0”555555µ4U@ÃÔDž~«IñçØ?7”²°Æm?"ºýÛ®ÇMºðú ò\?·„×E×nݵp ^#îŸ=xWlé¡Àji¢þfÛå„þ}¿c¬„”èiRRQÕ<%šË?ëf µ]é9y€«£²2[¬ÒfSìvm©¤J(—!»]d¨ó‚H—=&úÍNû7ñ _5p1u`AK£ñž.®::Úå‚âö܈Þ]ô” #/L[èì¾Å@““'ΚÛзƒÁv/{—þ«/Luט8;ĹÏö3†TߦHõœr×FF~JU·ŠØ1Å 9c—Œ)šÝÓIIǨ4'§ƒ÷ðÎF²“¢sÿLúÍ­vD¥…ZÝfŽ ë%aÉ3sÊc&®Ô0è»a ã¹–-ª[îÙ4#<|~Ÿ©Œãëvø%òràék«¶°íÍÆx‘L^÷ˆlü&ÇN øÉHYjÖͺ²8YŒ(­¬}Q•X"”‹+«ÄÀÒìxf}_×Aý»ÜºAI…Õá©Êª* ÚDmŸ³4Ìi“¾iAF¡uäoËú´A–Å@å'Ák?tévèQþŸƒy÷9-ÐwÜñ'À`0 žïäegÙÕðü9!„Œ é2wSlsw¯9!i '£Ý<¼¼œ¸›Ï>%€²w×F„y;»¸ñœ¸#î(“"!dß0—›2Ö¼pßQûÊÞßæáâîÁut6÷"$µfAq±Cw‹¸¸Óã÷ ôuŒyšWE %ŠÝºÀÃÅÅÃç×{ìÝe„Ï{§ÙŸõdG@PŸR))ºyYÒµ íùÂ`3/ìœãíÁ³îj;}Ó9 !Pô¼½…íû1!dÿLÇÀ¹·–LÂuñÞzî%@ E·.KºtÕ©H³µìt'­’µXæk×fKK]œ†_EBˆ˜¿}þ¨jÆ»$µX^ðêl7kï A ÅÏ϶ïduòK%!@HÅëvÞ‰Àã„g®}]i¾àFx¦Ü¸VQp‰äß»øŸ“>EÕäKËÛ8k×™çÆuò—ðE„HÌ5°O1ʪ<;"¢\4ÊËuøæëô«­½{,¸€ˆ/ãxîatð…;»'»÷A‡x}f¥ƒo„ß®²²r\pø ýáúQ½Â&m¢Ÿ]0;d6!"È;p ýüÁü ›¡ûñݹÙ<Ïa•ˆˆxjA[ïM2Ä £{…NÚX aá îåˆHIK¯œ?—[.GÄ—ÛÃlcÎW‡‰(ûÌåò’³*1÷l7K‡KnÒÏ.îÑköÝ:)Œäâ¾þ®³< Cg„{¸t ZˆïÎNçº÷¥£X½<åÈuMHñÊæ=zϦ¿^7Æ3rÒÑÚ¤ã?\ïäôYˆˆXö>–ëhÿ¾HJ pqñÌ—""^ØÐßÑÙý­1aßüý&!"æÅ9[8ÿLg|zÝÓ¾Óî'•(Ìsuáy û“ž;ÒÎq`>MyA\gÇïJ0ã’…ch1…ˆ¸b’?70†N@õéà¬n=§!bÑÕIÖÝ#¿Pˆˆ7—÷rv´=þ © _k^R9""æß´´¶÷³Žƒ±À¿KØš·ˆ8m¨·KÏÉô(`áeng‡“©rDDê}¸CÇßÊQV10(`ÕÕ÷ˆˆ(ãÆvé""•hË»[ AĹÞíçܨ†±}f¯‰[’ë°šDÐÃÓÕeDuoNñpw™áê?Hˆˆˆ©—7:zWÈ(D<¾jà€IéÊ{gGMÚ”ˆˆ·'ÙÙX-=ý‘úÜÓÕêÏøL,~iëä‘Z"FÄ“«CyEt_oí°òîOÇÙ7'zâÆDÉ‚ Ï G’h°U/×ÚØ /F¼²Æ¿ÇĈ¸qLxèÄ ôÛs‹sc–¡,ÓÅÙå5_ˆˆ ‡¦÷œ<9të+Dļ;VÎ=r E ÎöÃ*‘’ÎöÞzûíÆÞÝæÝ¡É{æOØór¼³ó×|D¼xrHŸjŽº¿{†gè(Š¢$–´÷˜A!¢LêïÆ\@ÂÛG)Á 'îý̲ZÙÙ(D|»Ö9x”¢úg  éêo§‡â²ï+*ÆEyÓ¯ÆlžYqzG€D&@© „çö_vœ¹…Þ’Z„ 6Éμ^ˆDDµÙ¿3ä'>}Û{üHÏÅSÙ÷¯<£múQÕ¿ÚñÒ:°£ðÓ'ˆÝzÁbÚJe[{õà(&ä'>yÛ{|u¤ž‹¦rî_}*ÂR÷ 6Te|GᗡƬÙMu•§ }@yE„‰TŽpfÛÕö7hÐ^]=Û‰%'ß—¯ž¸ã0y½¡¸éÊUáµ5îcË·™¼­•"€Z{ÿn,Nü‡lúèÓ²¿6 @¯e7½NíÌLʪxaÍ!•ð±A­€eàlóèêyÚdxÔ„`xìÞä“çé €ßÔD› $Ýœz³¡µsQ^A9@잧mFOmI\§nפM*¥R$ “TmȉÆêuƒ€Éõk]õ1ÊÜ}èQ¸¶ñˆB`LD[iÒƒûô `*ï={a†OûŠ’B~A©o{|ýŠ_¥R (*s>ܸH·2bÅÉ c,ŠŽæOÿ´ îTõñ€<îÏóÝgn§Ý1Úú hY-_r9"UíÀñìÙkÇP§ê7°Ñ«"´´oÑ*éõ¨­^Q2Ý}´A¯cK‰ ¼i¯œÂœØ3fÚßØy^ ;°$ÎrÒX­o$>}­kÜ^Ìc‡5ý\T¾²…¼£¢nZ)Gø{I61曫²sßµqǖ˪Êø|¾Ž^ë Q‰ê¤SG” Žþ6GªÒ>JÄü/©,åzjt J:˜cé£Ý^œ»c/“_¡M±~Íž (s åQ,ÅQÜ#¹@XöYm¿Õ-É(WÊšîέ¡O…¼â~º(H (5C-špT^QÛÍÝR^ /IÎkSDeÅêqa2Xr€Š>«³© И,&Å/µ-ÑÜ­u!toù@UfÓoÅù"©º¦jµÃQ'<ïùÌŽ­5 ÚW¹­õž/~.R 0æи1Y캀…oóiúr7TÖWT})ã@TõªS ƒATèà R}¤—’+-û¼¿þR"¬Ôâv&‚®2=ïÄ©…Œ6ÆÕda+jfCyƒlm mŽL¦@kC5ú+S•­ÐÏ09Z5n# & ¢ÇZYˈþ0•/©|s€Ë=Pž¨JÍÊ@öû„a‡_ûù¹ê©)få“ÚlA—)»Nmúm…õšÖæm¬xK'‡7L¾¢¢PmUÎd²å¥é¥Š_æx}å¨JYåýta˜Q­P‰7’Ê\VÖŒ>¥ÛA‡)ÄVšœÄòòºÇ ÈPѯÎOÇ`@@€Ê›I¥¼-Tx³,D.Ó–„êeÍ¡6x´¯õ-¿Õ¶än«ÅxO² |¸m¯3o¦;U]Ìi×Út—ìÞçrxýê–)wØ{=­GäÄo';(³pëQ¹tZŽ”"§7K<‚Íák iH½»kÒâ½-l};™j‹sRXøË Š¢Ò7Y﯒ÑZ 5Z›j^À;z÷@CÑ`‰«^í«^—Šß (¨Èø)€â7{?†:KRµ þµŸz½#3ÒèIþô½.a*3B±¬XY¶€cŽž²¼ TVÓŠ´°’訲Tt”%¥X£†×õ“¶¡Š\qñÍ.ª[4}@j JL"fž\穈ÿ†ÀÔPÄRU}*)—ýÜ=3QW„ ±¬æp—B9ÕÄ>¯2~Í ©§Ê0ð{v^ÿÚï+rO?û¸ïR‚…&ÀùçÇ_b}xÊzfo>>ª^&Þݲvéà •}óý~tM¡¤ÍwÝólN‡&+~:rÐ8¸ç×”šDT* …Vi•\]Q±áÉ{½ÿéG)Ót!Ž6mï]ºÅuú U´ï`T;`›:[R5ÿúkº×äÚ#‹Ö~Ir–¶ïÄE_=VjV^òõÏ¡Ç»¨JÎ(žæÔ¾N›–Síª–]Î×>ÿ,dèZdÐTÜ2{}»é·6õ2þ§_^úá 2ž?í6&ž Õá~wMrQxüò©ŽZLøOÒuþ.Â8ê5•ÉÍ»Ÿ«—ïÌû'n¼«[IÓÓËøæÆ53${ßÞXIýû‡VÚ«ÇIª^ Š_<}¯©ÐP2`ùûµx´ã¨ y}~µ•so!´êØ^=þȃzå‚’ZýQÕÕ Eir P’ùüû‘§ÄeÅü¢2 JmÕÔÈ›Wy„€tçÉ “p‚Líƒ{Lœúj׺GÁ^Ƶ—cÖQŸb§/Ä*düHX0 {’ú'Uÿœ‡'͹~n[G-Ö×V…0ëJú‡£±IhÐÔÈ+6næ E÷ž¥Xq¨Þš9}ýî Qî×Ý:j<¾{G¹ëÐÁ1uÖMDX¾x’Wô„€ÇîÆÔý„'öƒV6µòP®·ªô¾c¡Uùì}éÄ}W•–ý6É+jâWvW%üØÛ/ræ‘ÇÞm8FîÕ7™º”e­É?s“ÏD”7Mñ'›§MúÐþñþY –ú$ïá*ß¹ IDATv3§FÜvp¥=rŠè†ÇeoâÍÀþžº´S¹s鎱ß;}eDè?cÅ®°)î½.¶cçž×¯½(;0³kä¢ë¬U¦t´P‘.2ìbÏ!–gƒÜØ9ò°èÝýg9£÷Ý€+ó†®c†ÞßÓ„¸à)¿ÿ8Ľ×Mw 'wn³Ú8„ €©žÙÇ+GFºý"«¬·uõvš’ʱcàÙÑÞ×,Ýò^ySÖqy/k¼jš³ ÊË_”…×@*n£¬¸­b´:»Q¯ö®–.žì5Ñ?ÑÑÖÙF­BØþf†[Ožº £ßxÍ4ñÅx¾{w‡˜åœíj™¹kVlT°Ô´ÎcÝ>Q]VéQáã‘tíbÿis«n­š²xÝ‚ß“8…Ï™µbлHjïÒ5ÊÐfdß¾Õ¡˜ý×ï 5åüõ*ϯaT?£˜ÝÊT›Ôh UeEE‚r *:ºš* •ç”™˜š0 ”TäæIeÀQVÓ××f Iq:_Öª¥>£Fë‘V ø…¥rEU-}uZÈÍÎTÑ6ÒPfŠ >³º%¹üb)ETµtuÔ•h4@@IVfŽ¶Q+6!•%ùEeUÀT44ÒÏÏÎÒ12U"UéÙ¥-Z™Ð“¾¬0³uŒõ”å•fÜöû\ @ósËE2MCuùg>ÕŠÆAZ™Ç/ËPQUÓPWƒ¾' rQYn~‰:š*¬ÈÏ)F•–šr!?¯P(¥X ÊFzl@R%È.i˜ªQyqA™ÌÔXŸU ²ÂV&FˆH@^ÈçWŠe„¥ g ¯Ä"@É3²rt M”9Lšòª’ì‚RÂR6Ôaùù-ÚyÕÅŒ¤ç”¶liÂ$PÄÏ”stõµ”¤¥é9U-[1(Qi6¿™Š†FZ‘þnƒ–] ³Ó–VåU°Tu5HzVq‹–¦ô©AeIv‰XÝÄP­07ƒ(èj(ÔÜñË‹òó+DRÂäè(³ ‘ 9¥aé«°eÙY¹DEËX[MVUœSXÎRÑ1ÖV,ÌϯI0Õµõ´T°œŸSBT[êkÊ3³²µôUXõ¯†øe5}mZkJœ“Í—"rLÍŒôñb?³L±….37·PNغFF*lÈÅ_²òLM9LR^”U&×2ÖW! «LϘ¶ÐÉÍ(613fÔÚ‚ø™å2V #ZK®,Î*–i›ê+iU)¿PP›u ‰ /»DnlfÊ!@@–“‘ÅQ××ÕT*ÎÊdêi(²éÕ¸ ;‹¥©¯¥Ê€âìL¦¶‘†€âgd)«+°’òsóÄRJEÛ@W]¡$/«LÌ0ÑWÌ,¤ÌZèR9ÙYj:FêJl@aÁçB†¡&)®#mš{ 23„Ȩ% ˆ†Q MÎ/Чš£Ãÿw¥"iݨUçÿY8—¾Ü9xÈâòê߇m\ÓÊü•èÃAçÒÉ%$ŸÎò,’‹›Ç¿¹ü7å×)Sÿꂨâ0凒ç9"¨Yô3ä éáâeªËI/$K›«þø+…výÚj 溙ª¥åÉB°Òjæ€æò·Q¦šËßVâ4ˆ²øâ²áÍssxæÒ,nšKsi.çòK.ÂJ°jçĦª5â*Ù¸_~ø]G¾ÿæ<ë¯õ¿Ý»4J¹Ûí;lögÔ¿÷ãȓΰ—¸ADBàqÜŽ`W[;[nàÀs¯Š "Ê{:%ÊßÖûÒ½— ©q&äQÜ'kËÉ'Ÿ| -L乧înicgc3rÁ–b AD²sÛs·µ¶±¶tòëwðögÚ£2ûiÜà`W[»n¶®³·ÄQäÿä>Oy²j÷ŽÝœ"ÿµû»„Vò¯ÖtÊ….6f{oçþgÝD¦ÞM|HIýݺîŠÿò— Aô)ñnrÆ_.ZQ.Ž‹½'­aËÜ£Ñ.ó.þôRü¢¥yç7…¢¿ KüŠógIþ ;ç_$ˆXòøO'Kî["Žtè:fO2"¢8µ}÷Å ¥tý#ÓCƒ¢ÆóvŸû¬Úï‘¢6ÇøOÜBWXéÓýEDüt}±£Kà‡ DÄO×6:s>—JQpߥƒõòˈˆ•Ï#ì;O<™‹HQ_]Ï°–KeB!Uߢ(DÑL^·Ù)¬ ¥V…z«ÓÈÚšTƒº £!4¿6äúM¤éèÔ¿¼àjàT£ø¶ÂtÛT}JÖG£}~Ž?Eؾ¥šnýÊœ~ó÷$T{ö8ï¿•ñh¡êµngo.2uóF*Ôígã87Î"ÊË_ó¸…ÕÄ‹]Ž>Él¤Ó?¦Õ¿6G8$­þ¸Ä³%4mv1bßxø®üñ§jíÖ²@à´;Ï÷æo«%T{ï)ç®Ób×lI–Ýø˜=fÔPzó¼xSÌû=ûr¤ÒÃíl§ˆÐš ˜ŸUÂBVïsgûµ@P¶ìÜ&ïÞmBHåH×ÎK¯ HíµQÈ÷tã=s¿¿—íäÙ@ˆ$óÁÄþA\®KŸ1‹óÅ!dY¨S¨Ý›ìj¹—‚¢âͳ†¹¹ºø„ ºúº€Ž1<ÜiÿµgãCxÁK_B¨’ GFò\\‚£&¾Í¯" !Å—GÙ;“ùøhˆ7ÏÕ-`ç½lB"¡¤e›f uwáGO# ±„ßTCïíïæ³ä!„*|åÈóú$Э¿ø3ÜiÄBȶ©ãw¼üm?wÂEP`Ö[ÛŠR/»ºDÉ"eÈEáþÎ'äB>éï:õÞëK[ü=¸îÞaÇ_è¥_D¹óx¾{s.nê×{öõG³{,ºykÏL¿è‰ôRÏfK/Œáò\Bbæó«òhG/Ÿùö΋¶í»†‚”äðÊ)^n¸fÑåw•uÍH <\y~a³_~É*(“IóãÝ­»KLåçóŸ^ÜàìV†¢òŒ \ëùw²Š•ˆÙCyv£wÞËÉãg§\¶±Þ’,AÄ}Ý=ƒ&<ø”•S$Bé‹`ËUç_åñùi»Ù9_ÏDD¬¸;Þžç¹öhB‰ 4çÃmw;»„ Rü‘ΓößÏÎÉIŽ[ÛÅ),K†(}ÑÓÆrå¹—y|~Úã#nvÎ×2Qþ`ïÚß/¥ ¢¼à¥³{Z ùŸouv wÌówóvõuzV~~ª·»Aª<ƒÇs~™+BÄ”ë¼ ˆ>ø±â³WºH>,ÔîÏÛEˆ(Í;ï:o?"¢¬ª·7÷Ä®ù]ü§ÐV u÷öÚôB†ˆøq«…Ûli-Š>8²„ëþæs6?/wçôþ>#— ¢ìéœî¼•Ç JK_îàá¿`ë9AiÙç¤?ìmÃ2¤ˆX<Å—7`ÝÅ>?7íA_;ËÅ·KqÕ$·€‘7S¾dTbáu—®v›ï¤ååfŸZãâá8|õ” Ã|'ò1ýì`gßý×_ JË>&trrOȰ䧕íªk)yy¹ÖLpõrŽ˜{O\^2¥ŸÏì-%¥(—D¹yøÄÜLÉÌÉJ_ÙÛÕkæDL>Ô—ç3àà䬼bIJ™n}VœÉáós?=Ž²·š{=O­ì<öKVNnnö²á!æîFDIE霘€É«N JK“–„¸OÜ•———›ufQ°ý°õ¦Çö¹<ÿ s¥‚›¿Orè5±ê¡ŸµÕÖkoù|~Êý=R2YÚ¥vŽ£? Dr,Nsê±PˆˆTÆ ®ãÌã³²³YÐ…7 QžºÛ¡3÷ôó¬¼Ü/ÛGúóxvÛ¯d`É;'÷”"ÑßÄîæWìndù"b öÕû–ªA‰°JXÆfªÓ®›€ÃQAJ,•a#I©¨ªB ¥®ª¤ÚjSM…#++­µHT~š:fwä¶ê,ü¶rãK¢î«÷[nˆˆˆœ¨i ý:*cƒ‚§ìÚÒXWqqþ…~Ûû8µÕ×Ó· ˜ÔY¡òÚÓTU‚Jš:ÚÊéq‡’um· ãèwðž9Ñíâêß) `àïØÚØH›“´bY!oÒŒ .úúævýƒíô/ž¼ @"I똾Îêê†æjZ¬Ì¬¢Â‡·ž2õVFs ­BÆošÒ¿¬’z¸rywâÌà®úúæ¶ýzÚ\¶êêê]Cû± ‹ƒ¢‚ÕÕÔL­BµXŸ²‹¡àÉ»R­ýSŒôõ Í׬¼ºd•€hÙ©»G‡ƺÊÉÇ.J¬ýǹš…/ÚÜ* ~/"£,"¼»ª«©µéêH²œRáûËñmgôè` o8mµ)¶ª¦“¡ ¬®¡©NÇæõ5Σƒ‰‘‰Ù„±ÖÙO^Ë„RpO+c­’· 7+8»g…é붶ݴ5*~ɪ*ßa«/œØÒÒÄPGG¿Ÿ»õ‡¯€­¢®Äbp”Õ5ÔU3RóT5Ô MÂÆÞÞÚ`ô¨í<œÛª«ixÛ ²r·-ªô[<¦G'}}ýÜ7sÅËW“©£¡„­£¥¡À€Ô³šŠQȼvþµfû•‘¶&FFvýf¯ŸZR…W6WŽ˜ÑËÒDß°åÈíjƒôox‚÷+Ìü‡€HúÕc…R`s˜L&›Âªo$—Ë€Âhœ&„¥À©Œúz–-•QÀbW›|Td?3®UÐü5Ñ–X“«—P¥;§DËí~üø|f]÷yÒ`G×VK€ï¼¥D¹k¾dS §LH}É&_ë¦|)攦FGGÑI=…¥ü y!”Ì@¯¤RDŒâØÑñ)Î.d«|¬î¦võïx!BvA®ª²&„Ç3"ZŸ"bÅŒ¾Q¡€­ô±–LiÚ# eÊFVÐxv=À‰éo>(þã(å¸$Åu«;^®˜ü±j:ÿõ=ÝÎýØ éÙuÃÞ—=öÇòC{ÛÊ g\Ëwþ…*Óƃ<ù‰eö®ïòT}´?4ó€Û¡'…sºÕr ÊN+Pîµ€ÁK˜‚[é`I€Òj©AWb)P”¶Ž*½Ô°!B.?—-+EçדŠJdå’ €’©[ÐzŸSibÔ¦Za•v]´ß5ÜëY(V/b„@Qä3¿TW[·æ+…®öúéÐMnª]íÉVQ"”„™FŽPXͦDã¢è=rI©¼¢¼D ü·Ó§Íÿ,QUWâPÂrEzñw½·n¿1tN7›u\Ÿˆ°`‡.¤~NUJA§]µÓ5›MP.¸ûVŠ¸o`ô :AAF©Fv·dÁžÓ‚±—LàSv¾–†VM{ôŽÏ :9éÕp»±ºV½äË’”ä—B` i; =U…¸Q°6‚¤ÜÊêû7B½È–upÑÐÕЯ’¼§³î²²&ÃX±‰ö‰²™ªB~~´¡ÞÈ3 *tÍ ‘äÝ œºäø/szyG"/šàõªÓÔ«'¢™?ªƒQ=Uˆ2,Ç®ÛäS×ë ¾ysØD­µÝÁÝËBªe¡ZŒ80>°ñ ÛºlÎb2)J¤š@”ØÐÂÄ A îøïõ5>0¾·E5 -ô9R]ùÑÈ\ÁvÐf¤¤—g]½ï¾hPvë£;yJvUÑ-‘Ò$u–u—Žw¯¤j½9í<ú°tñ¿p.6_r¿UÄ(Ž™±nƾRyå'tt7ÓZ‘;X ™¬Ï†ƒƒëbøìÁüY,&[Íôð¡CŒ~M˜ [·€ª›|½)J3„ªš„’Êó“wët”&‹ÉPÐÛè»NUÑ„Ñ£Ôœ¾5´3džX~ªAPyU«íÇ/¼âÆɽkfŽ^l5õîÆÐâ¬Ì¶¡3÷F;4UIö%ù©’þF5&°YLy}ªs*T'g®×„`ͤI™ Ê€ÔˆUû"lLÿ5v7¬°a6Éž”о³ÒŠ‡g—ö-,»Væä}” /c÷+ÙWa61üœÖú†JÉIèÊY‡·t µWi駞‘3Ço¿8ÆËü«…Ø96ä½ýò £YP+?6~æ€bOWÕ'ÔØ2à«G¯$uùØX´ÈIÏ’ÔÔ(ÉM/××gü¹Ú¯n¾úÚæ§×ïÊeM„¯@ªuK³²R sá‚ ¯ o¥\íW·jAxó®\µBƒÉDD¡œ¢{óê^æÏL D[SåÇ;Ž=5ïàÀàgüðɉëŸÛ îHW1÷´ÊßqåS?DKÜœ:~´ïÐ}j« ÖÝ»çg^:ºÿ}¤]K£PKÁég·‹tûvR«Ý;›ÎÌqïjp¾zñég®x[µjSVZ\ «Žü..Ïέ¬/M:›¨feäAÈ~òìg’vPm 5 ò j¾Ê¿}·¨Î†ïçRš· Ks«ä4z²ªÜœr@nZž’[Hgš·Î>~U½Dé‹û—KE0T½úŽ?{buwO¶üÇÍ»h<»øô+¼O~S%¯ÎÐHoÝ^={¤gڃà йm‹‚ÜüÊjª˜îç±#éКñ:9§º’×……õØT÷û×®]»v=>ÂÆôÿ•Î_¿»A=ŸÜõFJ¼mŒ^Ý9˲ŸÔ£‹&€Óæaí£Cõ 抾$Å&ꜺåJA’¹ó8)›¤ˆäx;vGN"[»í¾¾ëfEõœ2¦àu¨6•uäHò²£+àâ’aå V‰§·Þ£¥±ìÝîÝŸ[žªDÏÚ±u+ª^Y·CLŸ„ £#Gé¬Ö¶¶Ó·ëº÷1?+Юuúãë;Ïgœ¾y¦£ö· ZnC†™Ÿ ÃF9©Q­ÜºWòUll:êÈ*³Ë½\mYâ’¬kO²ú†zB[-qe68ÚEQn%ÊÍ´uïÝ¥­.}&d ©”SÊ:È×€ÀÒS-ÍÔ³êëboFP1SÊ“é¹ûö°f¨¨êäʆDôÐQdI*JrÊ)ž³‹ꦖƒ,ß?{œ–UhÆë¿aa $‚\‘‘'·#PœÇ—:y8©¤ ø…6\mFWŸþ•/^½-szO\6˜×ÊŠùÚ­l»µÕÈ6èÕË=ýå“O|ÉÈ+Å÷ð5ƒ‚ôóóù]lx&Ú ²ª¢Rf;WûVPž—/°sæé¨ôêëŸùúIjNeôÂUêo÷¿ŸÞ&ή Ò?•Pš<{‹‚|~g+§–ºÊ€’’<±±'¯“¬¢ J±¯»)‚H:{õéªQùâåëÂ*fè˜%Ã=ÍÑÝǧìóë”t¾sôâ~aA¦TfÊç*g'kGžEÑ—ôB‰ÆØEkÛ*•½yó6§¨²[˜å#½@RQ’[.ÎöLB*|5ãîÕC&¯Ìp<Üì8 Fe½{õþ êtX±m}& °4:h`AVN¡ša·áƒÝ5ô¦å­/Êx—–©Ñ¾Çš5“”A¥MO×vï^<Ï­R›½iIâé]­úvo­˜[XÅå9«r˜ðw(ÿn‡÷ݳ†Ÿ-@ ÿÿWÊb&ÿÞˆõØ?¬i{wÔÄüïÙyÙ­²U™yp÷¡ByµáÃ?‹é‹þõ.˶}×Åêoqf°“åùâ¿’ÿrM©DÊâ°ÿ轌r© ™løçöäK¸Ý,Ðrq¶INºWfàqgÿüA—7u;õY™çâ˜òä~r·['60ÿýc^íï—¯hæԵŽ»‰,ÇIWW†ãßlø›=›ËßXÞ J”–šV.’²•ÔÛ´1Wdþ8ø"”¤üXZ%a)¨µnÛF……ÿjW2D‚bAjZ¦P*WTÓiߦãï(¤YÜ4—æÒ\þGå毗Îùg|áñ»¹M~å"úõë/8 « ´éáÉñ}l¿cú‡ ÇâÔÇïÇ7h,I9þgøÿCûÓhãÿíïyyÓ÷/œ,µA~?âÄ÷[ÇÚ)ÇÕ~™’¸!„^Ú¹çu7¯„äÞ¶°óåK©ïìï!»fyO:‘ÿ¿Ýòñ`[ûþ•AèBi¿üx Š²v¬Û‚ Å ]5äÏV™ó&ÈÿÓ&‘¢Ç¶Îþå2²~x¤½Sâhß=æP!Uƒ}­gþ™@ªc|!Uó|;뉄ì=ôÛWŽaCf=Ï—Bȱ%£G-!õc÷!¨Èz¾p\”³£“£“û蹿©¾†G $õì&Û€þr”Døqê¿ð" !9—­<P„šÓÓסÚ¶VÓΣ¬0Ä£ûº³¯iÓMD ¤l¼GǨ5‘UƒzÕF»ÏèÅ)Åöï£ûD.ØÕèà Ògèãäèèäì5qÉÎÜJ$ô”&äÙŽYv}&BòO µµw¬‡·]w—ØÂÆ‚joo;ÿ þv9»ÂÇòzlóõmæ™ènáûš@ƒ”^žbm[s{Þ¡L)! 2×Íáêììàì6dꪴ2 !„\Þ6³61ƒLLÌ!¿:.ί‰UL˜¬†özvgÿ1±õE IDAT©Ãúþ îÞMY¦ÿ¿>â"„ÅúËç­?ÆVûjµYø0‰óÛí†=bvzõ ì?m ¤=®mì¤Ìƒaæµ}b¸¸VR$u}æŽßgpÃç\îuÇ_—À•-s﫺__êI †Q÷ } ‡Ñ/Ï­´áêUM «ž2"ryåØùǓæ-;9§#d÷. öpéµèä¢`Â`1™@ØÛ÷Ÿ–RÈdS‡††ÞóX¿³;©l% <»ù¤MG' “Éì9eýQ-´•45 ‹qxýP÷Á“=âÕ94obJë>ק;“Éhã;äq=År@Ĥƒ úø‡î¼sÞ^L&“Ùm<>+zÕ•ŒA‹V^ÜäâkÎ ðسúì7B &“ :kÎsÅ@c¦®Ù¸÷¸© A M‡df0YLÆ_á„Áb2Ög›¯ŒÙØTª)jî .!ÁûÁC¦ÏÛg¡Mˆº Þžß8|é1ë¾ÓöŸX¤Ä”'[îíµéÌ4'-ƒhšÙÚ4—/ŸîîÛ;`щó=[ªüÅ S÷|ß¾ó"Ž^È‘4 Tf>~eòŒñêLˆ?ºº¤õð.•WN%|PÖiÓX”! |wâ­ÏŠž‚åé‡Ŧ—H;Úûôö¶N?zô‹òœ¡!ônœÊ{ºhoÒ´9cÕe¹'÷ŸLÉ)UÒnÑ3zp{õÒ?mæÍœ×E¸KËôý†Ù Œ›'ÎðÕ'÷óƒŠôCÎ|*™váéå^³½' (ÙûûŽìJ¶C@Ÿ–¦ &¼»wö½—¨Ö"rØ`3%@ìß¹/³½Ž5ÌNä ¦‚¾~5ôž1órÜÊõznôþ‡)StQ”¿œ6k»¦Y{VÁÓ®~)„ª¼3ç® )€”ç7öl\¶ë ò¯|urЈ¥„ píD¢½“= 0ÍÏ»oR>17Ö¸´qÌ°m‰­»ªœØ´ó=Ðy¿áþÅ3Þ~VǪ(Ï+iÒ.ݺª”¾Š´ç¾©Ð¦ŸÙ_L|:|ôòÉs'i+Ê3qdz ”¥…/ÜxáOJUm¬Ú¥Ä­çE¯!›¦‡*Wki¤(X20t×Ka­c$„º½aèð•'TŒÍ•Jž…:x¿-”Èàyù½¨K×ÖGgŒXy<öÚ“"xóü‹ôr:gíù v xçÁíû®R½[7 qê¥^D™ ±èåÉ‹I@÷Nðÿíè#3 ‹Â»ÌܶïLü;&Àƒmƒ¦ï¹kÔ¶s[}öžÙ¦ŸÍ$„”_»$aüuÙ˜zNÑmäR/Ƴa[o·®ÇŒUÞ¦¤á=½Koaª$),jjýjÇê"ƒ¨({=¤uE€hÕk ^eÑ®×e?¹'(JL„¾:ÕlÇb7D›†6o½eþÅq»ïùGÔêßíu^¯Të8††JâÂ’¦š|¶c­¤åpÿjøõD÷¡C5ò>ìþ û«ø<çÃíc{6®¿Uâ¤wkPÄ(ŠNVœ#«¶f 8wðØ+¾@¤Äð{bÒÁÂDµ|Þïkéߨ÷mP´>ÊõøÏ­-sâ·Ì¾^úߨlHJÎo~.wœ;È «IˆØ9tá¶å1Šñ@«–J’Ââ_­EüªÝ •ùnúÉøö$‘aÉÏ}ÎÝ{ÙѾ¶²ÅTÓ4Z7¥/"ØL ës³@àüÛ¶S<àéê1¥ó¶, F€Þ=-GM-³ºo»¹¿ÍÙÒϘܾq¹k@œ\˜™'b­š>µ»@HH`ït]E°rñN¸x‚‡Š“ßÞzWï–¨¾{—ê9Åõúrg¦ï†³Ý È—çåÑ'1s¤'–:žLŒ2ÐÄÏWovhö·sQáŠØ—¿í¾ãÙV H$ä ¿ý>Ç@t%‘eõxó|&bX¨ûPG¯:¼@¨ØÔ¬ÁNüôËÝ3'ŽÐV ‰xŸ©TKÎS²¢3Éy3wœì¤áÁ"ý‘É€Ûg_¸Ì¿9ˆ§ ¡½ûK•€¤Å=ÒµßQm&MÒ®î ¼è«Æ-㘋ûS€ ªÍÛ³Ó;dX…AÄ“¾vµµ9R[±«x·ç†»Ù© ¦–'%—»Ù2êr(0 ½Œ¤÷åBwÍŸá~êõm}º1hÎx~`ià©Õ_Ñ–(vŠ;³NAÔYúǯ3±ÍÈ£^më(¡¤–ü*}z:Qâºß¾ ´¥žW˜;“zh³Ûp DOæBûÍrÍdr„² ³c¶zƒwEl*”ƒù“u{//ô×€øÇ]F/ œG¯Šèl¯§Â¦ýôÂÖ«}FÙÔ›û"þû3Ÿ™;cWtÒeCpÀîHçgÿ…ÒFàݳ<õNÖZ Ä 4BL@aÆ–KåÎ þ©âFjèc®¦­ºâ£ì`pjÏ0uS[$@U ä€ ~NMÕæ¨ >ŸPi3¶½èq´öìvÈÈù§6`ß5¤ôÒ…7-mÉ@™»¹òøÿ¯½ë ˆêjÚs¶Ñ¤(AQŠ Š(ª"*XÄ{ï"¶¨Ø1Q±aCQÔØ0v±`°—¨X°ÀÒ—»Ë²åÎ÷ã.°ÀbÉ—òæ}ïóö–sgÎ9w93¼Ú:õ3fl/k@èæÜuÑ™³ŒM<úÔÅw½Yöé3Ù0Ü0ùyi÷-V²ù)UÚ]o¬[›‚„È›¼þ¡¤·QhYø›ÑßabiîPúÛUvä¢7••fftzî´íû y_¾Q³ftw€fþÞÆêUå®JË̶pqÔ0‘¹;ÈWx;öì7v쨎í¬@Q;Ø*D:--µ;"¼õÈÑC xln;$|äð wS@¸~úAÇN5û†ÑÊ3ìà‚ЪÚM€,m•—« íšBÎÓäÿrO0Ë¥YšÀÊ{xÖÏï"ݽUâRÝžVyè76”\(W³?‹¢€°Y_ö­…3‡î{ö¬©±‹vƒgÆŒö”(j„KG…ì/“Ù¨ §•±Ñ«%ûÃ…]~×öÑdK„Å!‘ œÛëM8PF©õ+}!Ù_¦GP\‹„M¡ä € žÞÞ±çöBÀ<È?z7«CTp°$“F L+#"*ØM:HŠ/ai:mCº22Ï~­¶%þó-›EjÓ¨ëŸòŒ~~~4ÒÊ Ê&do€¹j¹á“¸Ažv”ÇVn¯g"«÷ÝÞÚQîf€U `³ ÔÝKÖ­×·Å[VæË1mÛI“¾­€p¢Ž^Šxóòù“”}QCVPÛb¶ïÔý›œ]™r8—–>·MsY¯eG^úXÔë×W$2Xvñðl«¥@ ½<}ô¬›A9"›Ã£•6‹M¡¢î¤’Ó[Í‘Ô®±ä ‹Ô. xZ\¨+nŠon—ùŒ6@n³˜[¿½}ñâéÝK"|–n ±›kuZ”RÈ­y4›hоJË^3.è÷êÕóK§v^º0xÅ‘åý-®={ä8feÍ´`qx\­&\u/æݘytùñëò؈yó6$˜W=•Ð ÛÆ¡2 €¦ßX›c£!al÷F›OÝ–.êÍUÝ¢®È½žÇóq5û’…!pþõï0÷ê¾C6Wƒ£Õ¤‰šu Q|¸0aÕõM¿^ËX09rßµm£kÈþ¦{`ôß*aé™Y™4ž£ƒãænxðÂ5ùG¶*ÙòwÉùÚÃÜLÿÄ™ʤMDUiè;ÀkqD|À­µñmFL0–¾ 0s@ä¶Unm449ɳý~V' (… Í"ÊÌ„CþQvn-…¿<Ê0­&©n_¡¶I»M˦ÒYœ´õ›µniòWËš¿ÐvÃÎyP\íüQ"kobÔ§µ?8s/$¨ýÆyÚ²žý–N¯èQVpxÿB)o\F™Æ<.?ú(5È·/PUeï³%–íC'ì?“ì(Ï;y?HË.¢£Ï?ä”up2‡Víz_Û»ÿ—ôAöº=l!»Ä„vĺ¹¹¶±lÛ¾™6°Ä‚7rúK y…zª¯.GÛZCS,(DBðñ©#‰/óÍ õËEEÕ ò'wrëò$ßñ0,Äd‚ô|–½óqsÎÞøUçEÊé, «zì ÏT‹WRT¢ |¸yî›Í"¹Y|}Sk—Þý—m?¹®oÒßSóûKݾ½ôñ3qüHˆ,zþ\Ë~‹}ÌyK÷t*8:{Ïýê,]ÈÓ5²µspppp°··67V£i« íèe&¿ì½žIj"Qyvú`¡®ÉHÛÏ;2ÈÒ>æ´pï¤ói²!âys¾wó½«+tËÓW[£O½ª![ÛÀ̦ƒ½ƒƒƒƒ½•©Á§É¶¥YxøÔ“"¢Œ6 äæÞX‘y‡V,ø‹A¬CtßÆ<-‹}ž?ÂÛ„…/Å`âßÕØ°©žûâ; j¨@­&¦åb Eg8~|•ÿGDÁ&ßÎpÑ{±bó5Rëë ÏO.·ë1µ 8zööô$hÝÒ¤þúêß$n4´²öºQTTôþI⋉»O‹ŠÈ©êeÛŠžZ>K ‹ßIäg%,½ûŠ¸)XÁó‡\ݼ)5Ûª—)HICý\•)²Þ?{#”Úš6§Ðà‹ëWS=‡èYµå•Ý=Ÿ-t²k }Í+Š{ùÙÇÂÂÂÔÛGzH-”—+^?cGV~aaî³øC×í‚'â£ëçþ|Žàh›õ¶6‹Þ¼=[ øø”P\\ôáéÅ}¹6A€Â¹ý|öI^¾@ È¿{ï‘nWÉÝ]ùBÚ©˜^¤¢ÒÜÌ ¤gf!!·¶L9-t‹ DDÝè•soî^òðóébˆ¼J˜Í¯n+=]P.GíNKGx;ñ]zFFÆ»„ “"Ö\[}È€Ëú¬¢OJon“xŒ²¨ÎDRV˜§Jvzzv^ H\‘¢3pówD4Ú5êèÚÈW’ϾDµÒÓ? šÍ{Döë¸vDŸÕqW>fd¤|»yÄÌØG“×ìàý¡ôœþ“ûœ]»!Olçê`€ZºV,Rúä%¿¸¨ 1fµ–M“’WiåT=’Ò5mgÊÃñW¯“OìÌÑøC2€ 4_¾tÚëã ‡.Šy™öžŸñîÈÚIï-Ý¿IÿŸÛØð—,¦ª„iÛ©ƒ,?D„,óZ,:tÞÍR r?Õ;ââ—BI»¶æ@Ù&}Î'hL;y[±¬³ßèKGpˆI‡PnnXóQÑ-QÓ¢ÿÅ8²`ñ¸×ùBM£V·ü2ÈÉLÛúÉ2Ï šÑ@Ó| ‰|_©w‡æÚ‡^8l0}þ¸å‰‰­GÂõ¶z,yžT¦çp`u÷ áƒß•q‚gí™7ÈóSŸ¤”kgÑÁ³6[æ M­—üÕ»­.€û¹„•ã&Ž8$ן´nï\Ñ“m¹5â›U’ý\v-Œ¸ˆhë;ç{Oä”ð¬2™¾EÇècçuÙ”JÐÏΣçžØ‡kȬýÓ:u]MŒܾ¸añ¼¡Þ+ØÚƒ&[:àи¾+Tû-;ùøäã*‚^¡mèûën§%±—œzHª· é9ûaìå¹Áã~½²÷ÓÓ´ømrhx²²1Y¥ã”3Û"Zô˜²éÖ Ô ÑëFXK¦³ïЫ¿íhÎÃ/Û”#‹y6s†êSÒÎl|f» ÙrÓva‡®;Ÿµ)ñÐj?ãÞ3¢¤Ì Ÿû뉟&;7åÔ”SÊWV*òº¼,ÐÈñÞž׬Ù±#“°u\#®ßÞ”ó·lŸBèÐ5¸jÍôöÓc iµÅÄqÿ’af†Ë5Mg¬‹‰–4pâ¬]–¡õ"¯xÆÇãfÜ¿¸ûÙÇ¢ºùlS_¯«oÇ_s Ú¾fÅ”±‡¥ÀsöMº³Ã€ÿ þü=Sj—Ó¨²E®æz²ÖY/VÏ_5Õ¬éL:µËp$„¨+zMçZ¯½ TLgUl5«–àšƒt›õ®B"«xö<­£³Ò¹°kd§[î§ãÆ[5ð«yh-‡ˆ˜‘ú@ü‹©>^o‘6àÁŽáj¼ÉD•÷ÏçHE5ëvå±/ì%©Ð0#S-5µŒ(½äuÔÿù*ûŸB6ÝïŸ%»vfª\üi"p\=µêŽÏgçªZ.Ô³ó¹›ÕS®ŽýêÁ$ðÉì´ÿí¦±€ë†ÿÒ`½X÷T·]ýFÔ\FH£?•·?Fp}7"Aà·Ï)ræiŸ÷üRÌ‹c{¬Ô}fÔ=¢æ‚peçòCÙ–ÓdzKßn‰K›±ÓKý«=ŸŸ(D ;¤1®mPýqÒ€‘šú§êû¨~þz²ÕÏdB²IA.¾ÿwªaè°¦±K§6jïmŒÑÆæªZ.Ô±ƒ ÉKyœN„³ô­»µoUPÇ~½Mÿzíæˆ@¨ò}[·<ýX¨Ó¬ÍÈISÛ‘? ©Ó¡› ÛÏÜ~…š†~3ü ÿó’üA”>aîF^Ç´©óΕ£þnb²/Œ]‘¨­Q!$³ ™ãþ/êTFÜ0`Àào‹é ü[m7£ì‡yÑE<Žª6%1òÛ4»çÌâI#†ê¯FñóÙÏ/_µ@¯Þâ?çúôm¯7®žÌS]™iÖÁ˜ƒ©9¢æÖŽÇÕ®6qß?w0ñî+nS«°ñZë)–gÜß}àl¡T³çàï:š ³"˺»ì‡s}—¬îÑ´N˱Ûö¿É¯²uë3:ȵÚx.»·ûvj¶¦ùàQcl›iЬg<<w6YŒ:Î~Â{´þ‹M‰[ç¯Îç²”ê5¥hºdb§Úп¢;»Ö?mµnŠþ› 2ø§´›ª{W®eðš[˜× E Õ7Ê„TÿØÂ’{ =·]Oû^1ÂÖÑÖRÓ¹ÂôK7Rux&”ø]?À¤ °µmUð$ÁõÛIùRBù5zøŒ½)æmíô«^ óíóJB!‚»|ƒçVêYÚ¶ÔÚ:Þý¹„uÿôÏAã–Þ¿u3SRÛ²´ì] kŸÇÅÚZÞ?/BˆhU¸ÏÆ‹­ll´*~õ º) ðîîÙgíä5³neŠ™5(êøÓ/5ÿ!S”]»v‹gÚªM›Ö­[·nÝÆÆJŸ£"úÁÈ}<7iÙÊS©˜ÿ þÆ4ìùC»lø]ØðDEQvnIU‰ ç=¿‘’æçfòùYÙy¢*REQˆX^˜Ççgæ–¡¬<#3_HQTNv¦¨JVœŸÍçg JDˆXV›Áçç•Sˆô”T”—“Åçg Š”yü)IqFN*$¹Y|>?«X(ADQþû¾ž[NÝÉ+(AD”Wæçfóùüì\D™ÖŸ*ÌÊ”ËTh§Uy9|>?+'O,£e"~fŽœ¢è „Å‚L>?'¿˜zkã6º)YNfF¹„BÄÔŸ‡¸GìCDŠB”•ûy¹ž¸Ÿƒ™Wºúg(”¸°ÜçÛéq^„{äî‡4g’Ûkm=§J²¢¡ÃæT`Ñ`;ç#¹µÄÝÛì¶B¤(¤ŠR]Ýz>/¨¬¸õSÿI’jâžÚ#|ÑEJQÞ¿WüoyôÁ²³“m=Ð×Täee Yžê!UV$È̬2¤„‚ì¬ÂŠšNRˆŠÒ3biNfvq%"¢èu¯®^©Òz-W•ñsHsøá˜C÷¡yÈà¿œÿ‘wm÷w1™ƒD¯Îµóþn÷¢€#3ý¶?$Ý{vË{ñϲ¸|fÀË#Q#·Üpðð$on8õï§x|óG.ʧŽÚÚ̾Ä© /õpâƒÉÁÝOóMýÛˆ÷OŠ>t¶§¥>–½ ì3ª²…ƒ§ 7éRŠuØÖ=³\ɇ³3F˜¾âºg¥?x©tçÝ Mnœ|Y%޾ЄEík7úÛšZöìhñæ^R1ét6q»6[¾>Ü»l­˜aÕ¹Z ( xG¤Õ³Kû¬'7Þ™OŠ7+Lé3xKRòYc6á_ù)8*ÁÁÃË°è1ûFCéÎÌ?Ð?|ïãPGMÛIñ7')}§HQ@€Ãá¾~’ÚÔÜÔ¢º,«O˜té!t|÷²éæåWüü··rÓÄÄ}¬§}Vqß\¯ €.GÏÜXéruÓÄÓ‚Ϻn½¸À¤¢rW_%«½hJ;ýÓˆã¹ÎÆÐjÈD‡ ·¿lì§í櫵›ß©9qnË@/¿áBº$’8kçÖ˜te…œªÅ^æß"⤾—}M]5<ÈÑw¶ ‘RHöš±ã2}ño/ïÈcô÷t_¨{DüsD<³ÄÏgr<ݶäãegŸ• |»Õ¾½ëñ e¦…ú.ˆ}ƒ”d„wÏýw>"bÉû$÷>%ôyJøËÑ_Š%rDª¢¸°¼ZÕQÖ÷§}Û¥Ûs±ò×ù'2Š%˜uÕÞ%°@N!bÔ`ç)?=¤OŸ^ñcïq•ˆHÉKŠ %2•2P…ˆi ³;yL)¢ðÆ¥þCÒÚ" ~Otóô ïyØöz(©­¨4ÙÝfýÓšFrëj7ùCºH¯)6$ÜmXüÛšÇQJ_Ä9wö$¬­GEQˆX92ÀuÍ™çJE°¼¸¸BRoÈÎlØ;`„ˆî÷·‰NÝ^”*»åp¤_¿9¿"înÿJ"R£ûuÿéüDJ\ZT*’"¢<+Ù©»Gø ·î]]zx…MZ(BD e•Â¢’ÚbRwâ—ûš¯ Í€Ñn¾ÖPÄÂ!Ž»µA™þ:µ3P í¾Z´•V«Åw#½ãì8ZX¢ „9B€üŒ,E`ïv´UtòЇ6U—@¦dmÛÑŸFc®íhÛI+#(+”_¸”Õr¼Éí[·€Ã–YV•_äK&²ˆT¯ƒ_Kz7Ñ6Ô)©(4Z¿ÐmÖÚDQ8/r}`owW—CÒ…&Fõ™â™µ1‚ïç,Ü×ËÅŵOH€¸Ö8üúmeß Î´•ÃÏÏaÁ•§´q§©¡Q=+õoqË'oM?p9Á€B!g‘ÚÑa6Rr)…ln­BÀá°@!S4bòWÈ€¥Q9ÂÒà€B*¯y\þýョ욾u¿“ÖVÏg-šÁê6}v=}™†®†šÏ”B§…½©ý÷‡/4›7)~–| €…ßt®Hw>Ô¶”\y“iéÛ ´ô éj²×xÐÀþ¼ƒœ[ÉJ>¬ž>*p|Üå]Ã9š:†*  ¬Í¬ËEçˆ,& ‰ñL}(ŠŒ<õûtku’¨‰!7Lå¥x};µÃ°É£úômª¯yüöa>@¡D¦ÝDƒ}sC¤rjîe³jsYpë¥ÚI™”'¼wOù»yw'"CÐ`ѯ--ùÄkêZœüíÚÞõëNÄn^·ðc»þsv,ÓdCC' akÇ\LJøyÃùø˜m«æ¹ŒÞ»nªŠ\$”jèi)ó hèiAƒ\@ˆ"aùÈšžL9Ùš  «£_%Ϫ6Æ‚¤ª‚E´¸:Íu8Å"@}šŽŠb·c3N#¾o4d9¥rhA'¨e–Ú(þúʶð•VÄ l§ÕÞ¸*Á“qƒGéõY» è3n)D¢2UU¨ìP\\µÅå`gŠ ÔÝkû ˜×ïî–-º!sÚÔ™kÈmÞnÑ‚v4ƒëI g]øsqÕðæue›–ŽŽ\¦p™—•7_ ©ˆÎÛ׈àÞÕ$Ž}·˜¨±ˆHˆ°¤œÞãa¨«Y^P ‹HHÆ>‹Ãû²¶1’”ElüÑGÞúDQH´°«¾PIDATwŸsu ¥À¦cç¯ ª²úôzzXŸÐ¶õ\æ€HQ”æ©Ë†L@Ép_¿Ø$ÏÙŽ5 5å iHˆàm‹ÃªûÚêÈÌ;ÊÝSÎ-dÑ~jk«Ò’-@’óž‡cÓºEå³'ežžzˆ„ÜJ•¶YeÙ˜ŸXÏ·+{ÿ•³ììH7J¸3Û7€7·ŽÜxíìÕs-è?tNùû‘Gt\p:2ȺaL€ºm_Ê¿f†¨÷ÍÎ]»ˆrwEÇÇkúŽ³_˜/ÜT>gOç:{Œ€€BVTPhdb €„…TLˆfM˜~ÍV&YU‹ÍbÂÃGø_‚¦ÚZb‘þ_úqåk­&sKÃÇ.!ÄËN=ÕüÒ œ¾cú<ÙáԺő¡=–#J«ì}GíXÖ‹"ÏÞç‡-µzÒH9Ñg—N;Þsßݺú&D,›å½®D é?bÞ–éàãå¸ù§K{w§ÛN}pÑ°ý|BË ã™úPµ¾ªîñ:N‘zgk ,-¬q±”^ˆl¸´^ãªí×4¢ú?ªžW÷DÕ+’Aß–~u×ü›bµ|Õ¹RaêxÆFØE5t7Ò{õ˜šS_Üè Qˆ˜3vÛ­O Y­[«þõû³ÎPÓÃÊУ%£¾Sþ®|êÛ©ç Æ¥ó_‚?1¥UŠÔA¦ ªM‰äˆh4¯À¶¨Ñ!ã×T+ÊËŠ"wÞýÖ¯kÝFê$:PÝÎOÔ• !Ꞩ6KF½Û.^z2§§–jéYµI0ˆ:ÂÔñ g}h@w#½×h††§È×j „x³{ñP»º,×KÚÐXRˆF“0¢¶ !ew÷•Ú‡ÓÛ2E­k1hJ¯&ÀDÿwàÏßþpï é{sê ™hÀ’Ë ‚Lþ¨ „T‰žóó©GGÛwÜ’¥c{sþö JS§j®°ÿå÷OÛGöÅ#Mÿ›w>²ï”„Å<&#n>=;±*þñ½võ¦ÜߟˆŒÁ?"怑5Œ¸aÀ€ƒ¯ÐÀ€FÜ0`À€7 0`Àˆ 0↌¸aº€Œ¸aÀ€#n0`À€7 0`Ä  qÀŒ¸aÀ€#n0`À€7 0`Ä  qÀŒ¸aÀ€Áþ^ùà);(±IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/sameip.png0000644000000000000000000006505513051004444021201 00000000000000‰PNG  IHDRzn¦òOþsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 4m\§O IDATxÚì=u\UMÓ³7èAT,TDA:¥¤0°E±Åî»»» »;°°°@E‘ÉKÝ{¹uÎ|œ ‚‚Ïó>>ß÷>ï÷ÞùƒgïžÙÙÝÙÙ™ÙÙ9A P€þ÷¥(@ q£(@!n (@!n (Ä …¸Q€ …¸Q€ 7 P€ 7 P€âF P€BÜ(@ P€BÜ(@ Pˆ(@ Pˆ(@ q£(à¿8?ʪü„ä[[‹?‡ !ßKéò´çiè`ÝŠ(¦è@r><ç7êÔÎPå§ qÒ³wúVvšùIŸÄº6m›!"BhqVZZq¹T5õZ´4SçÈð²?¥Ö¤mâ(k´hk®«L%ůßd™ÛtÑ`ÿ‚ù0/#µ ¤œBPVÓ6iÝZ[‰`5G”d}M+.Є­­gØÊÔˆ…ˆ„0,‹„||Ÿ(âêwigRƒST‘—üå›Y‡Nz*œžN{“ÀjåÐB“ü—ó3ùûÓk}=Ú>ìʳ§Ç´þœ áÝZ3ò’áéMᵓ$Ät‰¡ß__ôÿfzêr)ùOìRþd«{ì»ç7v*WOßß %ÃlzÞ|nq2bXº×ƒÕCø÷žU¥¤¤¡«FUVˆ$Nã½NwÐ`ÀÇ;›GÄÄ™šµd³%Âì¼AgÓ•ŽFIáOßÕ;žÜ·Tk€ÿèŠØ>Ýn+·éh ,z÷ñ« B}ÇÍ+6ú@”:¬OÄ—J.WUK™ ÄU*.çãV©±äGñç n‘ùãÓ 'L«Ç#óùž°)UºN¿µ4¸fÐNmYò,kö¹¸áü6þ´¦ê[cߟªKäå¯?äih˜ÕÕtPÉ1&éz= ÔÛìÏŒ/ßøpÕd}¯6ÆŸ°×¦ùâ£òúÚ&„¾´$¦ñÐ9ŽÍUªÓИþª/Õ[ôŸïËÏØjw‘Aô}âªQ !DÓæíµìÑÊšzÛi ñz¨¢­Ên¬zêª%*@KËÃúŽPwŸxcz_5%6P’ª3«‡…û¸sï”Å5Úqð€ƒ®Z;´ï‚5n®úƒ íé‰[%F'®3f^¦«÷ï±`Ý+Ë"EQý†Š;F^‹ª¡Â©àÛ²ˆ€€¾«oœ™Á¨v·Ïx.T»foê–á­ªÇQÞûtéÇŽC×ËÁõ²-"ù8ÿ1ûÕ·êȯé?[Ü ‚¬,mÞÌY?—ê(Så”Þ°˜m‘®µkAzìŒy×?ð T%UÊ-&-ZØIOòd†ùRͶo·<ªŒíÞ~ÉåDB>Š¸µ}ïm.³2‰øÑt³itNÂZB‰‚¼ìýG}J~©Ê•¾ÏNZ´n€³iíÕD¼iÞøÓ÷R´tÔŠx2uõœÐNPñ¥³û€Å^xø™HKßå“%;v;äŸè2ñâóW"QîK§Ã÷_}fm¤RƒMœûrÚìÅorÅÚìª*eãè¥[{vÖÆ7K[L.Ù?ˆ—XQ™ý¡HÃq÷ñU…+†¼øpf ôãýOqS®®o`’YíZ/ã3_­SÿþýÃ{{(ÿ$ŽܳxÜ‘kï4ô´ ‹$ÑKc ªÀÑÍwü¨wŸ¼eÿM–hÞú>o=dë§wŒUXDZšêî¼ôÔsïÖ5ؤEgÍš÷<¯­$áƒÁ¨ÅÛÙ7‚[M†'ip4¡TðísÇrçñm•$ÞL‡_\4¨ !„¬éÛ.Á%.n’eÍæPpvú A»µ@üpR»•MVy}»ÿYøæy²Ãø•!xýÄ«’Üw/4<¦]2ˆ u~cÌæsTµtøÅ…æîCW-­Mà}ÜÒI+ã؆&šzm§FllÿéF4 ¤«º¶;çqði¬‹w¿P.hYúôÒm …ñK¿žž1@•#WÃY\•¾³öšËâÖb5Šªæe–j˜¿ñ®½_©?ÁÃQ!êmƒ¥:ÿÔFx—?[ñ.KóÐÉêÊÕfšºÑÌ}Tª+! H çÄŽÛicþ> úôF¾™Ô©òâaž#—-ïwe½Z½¢¹³åê×ÙºÂâ|»«×O1`Á·{»&,=Ìãh³«ÊtÛ»¯_½¨™&'qw¨—#B´o”–¾JÌë·ê ûΚ”²ª¯¯ßtŠÜºf¤=”¼=3eîÆ|¢'+ã»ôܺbŠú?PâàoÀ³¸¹ƒ#—0ÿ§ÞXëêÞ³\Š˜z¤ãÀrDDÜ<¡WÏñë™ o.° "FÄ÷‹­:Ù/9ŸÆ”ï›? rÖ)DD¤k0‹žÌkë5›B¤e¢~Aî‘«˜ò¬“Û¹¯¬K?ikH÷1ÌCÑU·ŽöÏÊùiÎÎ.þ³Ï3ÅçøØŒŒCNsï4åf Søîüt× å¢Ú #žÞ4aÔŒÌÿñ;§{õCÓ4¦lèܱó¬³9LùžGìLCñG¿.VײäïÏä;oÏ#¬‹í;Ð4SžÿöÚ„°¾ö–NË^É,(û¡–4uoT&óPyߣC—Û%ˆ¢"o7ŸI‡˜âÄ%Á#ö Jøts!›)̼·Ð¡ÛAÝÖïœ>dÌùøÇ-v÷T%CLßß©£õØC©Lùºþú­ù€ˆ·VŽ÷ŠZ(ŸÞm{ËÀ”ï¸h¤Åsƒ¼gžxÂõìÝm£´3=BÆÖRN«a®î4Tdefd–芲³ÄŒ‘0r§¼/Þm$Ù™àŽXØëõª²së.úÆLP«5ˆˆè±jÿ–Iü’‚ŒŒ P6S|1E€X©åœðV ¶]š Ó¿Ð>£{W=yøR @àù‘KºvmKj:AP&z]%´6iñýH@«kßÎ\€–N*Ý> e3=Q^>²ØªÊJì›·_Ð4²Öí>ÚúqÖ—O\Íî­Õ€e`·Ä[™®ÆojënßJ§–¡Ãõ‡ºÆº5DÄ ééåãããããÓÍïQNe 1ES-“V½¿½wáí´ÈAì¶$ÀÖk{úƽy=Lö­˜5dP`·®ƒ§ï,£ WJéšè5ìv„û;×júĪht™îK/Zú v )À´ù3^\üUÜ€o”¨¨i(ß»ú¦ço8<¼› ruw:eoX”—‘•ig _?3sI7hª ffOØfV-Ô£Ö’Åá ª åA|•©é{mš¦iä ž3šwz#ïŸ÷у¿nLB>ÞÜ4qÙñ¶.ÁÌ dEi¬ÅEQ9jŽr:„òÙ@å³,*€¨i¨ý/6JKKäz¡Ž¶*ÿ[@ãïdHr. ˆXÂnãímÛŠ"EjÆYËax—EX —´u“ŠG§ä ­¥÷ΈÛÆ[«Õr»!äþ˜Øýwl|zšéT}Í`W dTRW«^ ,Bi@˜6ØÖyÃUãýy7WÛMrÕ­3@eÙf/;‚Rb¸|{¬Áwë©|wììóñš[öÑ®;¤Pt«ß€ùb÷§¶Ê\ŠOÕ4ªJrÁHXlF˜Y Ufõ}™Rá¥ýþh©áUÝÚBÈ«s«gn<×±kO ãFâÜ”ïÄQQ¯î ©Ðòæ3åš—qsmÏ$ZÊ*òá`#*k(33Ä"iŽz³Ã{×-š;µÓJ±Ió掽'Ï wä Ê8,=[Ž£¥£)düzîÙ-špŠ¾|«y»>LF±e…c"gJdÌÞF(iîÀî,¤‘±Åœ­§=;™àŸâaàtš×=jž°²¬¤0kᘠ}ÆKïlßÂH©äKn}ÞDRtCiïmñ¢kHXü*Qââl‡±ú÷Új–}×ö=="|í­SÓês·hîØ¿kż¹–;g7oÞÅÔ’1>„ĉ¸”}B¼ ´T²‹‘4©~CM—-Ÿ06‚*‡„3%åtY®§«K5zJÈ'¥U §öÿÇU\¹mÁ¶v3îmêmeI×ßxQ·‚¶ŠT0éê‡þë¿ø×lJ–X,¨ö} beÕ:É–Q±tຳÓÜ ø¾¿@ÎÑ72Á]3Ã+ï™Z…¨3B¦f¿ƒ¢=[Nø¬y>×C ²¯ŠŽ¼Oøeº~S\bܤ.IÛôjü’™?üÊUmìää 2J] ²ßÝ;vìĹ[ý""—XÑÉD«®£T¶}L¬À}ÎÕ…Á ¸±{ÓÚQíµ¨a4¢ú¡ø$Cý{º­Cô”Xuýe;—﵉y´2PŠN~”úë“BŸÞÃ,]'<5!µÕIƒÚØ ð¯œc’F­]6ž¼‹U%Ï݉·Ãè´Ÿ’ ÂåY%xºe;$˜;jÇG~ŸvêHijjˆ@©q¿‚l®ñ¥ë'”þe?)e¥–ê´i« ¦¡­¦Ùiß_ó¡ …0Þ*;ôë×­êü ©¦ÊÕoþ௽Ñÿvø0?Q…Hɸ>³ù]=³ŸC€Åª°¹¥¥Þí}wª¥S꾃—dõÛeTýë©Ú7øèÕsFT>9“¥ÜÁ½iíŸ)žˆÛ¬¥\¤½=²°DÆF 3'bIä«ýGNÞ|:@Ÿã1tîvVÇÏ.š4ÌÒXS®„|GOóDl£ò¾|>½0KÌ¡é_ð {ð’aNž9qáFÐÌQ¬;-ª+5oÙˆ¥óN*d±Y¿ˆ‰0uñÒ¯Ì9¶rqó°ð&u›eq”•9\^y?!q»*ïñòÍ·h¢ÚÈ¡[?g#ýŒüÜfFÆ¢ªŠœJÙ·5qE5flUyi¹Pú³GUÇf‚e ÉÜyKy¡¬*9þV>€2§¦/t•ìGCéû|sê95cj]‰µ¶D\­~ƒôΕª-Z¨wŠ¶iCbg/ͯÉG“—5èz|¶2¡¯]¼Þ±oÌ!C†:tèЈ!#õÖß¹îò4°Ô-ó]7na¾ŠÆ–ÍK\¾þ‚”tº¸yµ5ËËË@JD@U]@VòaK Ýຨí;[óò^ÊIÍýBBÎ?MÖü¦vÓ¸_˜ÅÊñ~"Ÿ×w/w³Tzmþü…‹ç…µ®©1gÁtï³ýÞÙ;™)=dà=ì'ñÛ¢Qó=Ÿðrþòu†êõÅcÑRýŒxŸ> ªwî= ³¼YŸUÆNr ]9õ}OÁÇ»2Ÿµ-?Y2EÑÔ†6q®Yx¥n à»±åÏ›‰¿ÙQÝó½ï_½æ²Ú·mÊBBÖŽëÙjÔ¦)~?Xˆ”8+3K(¡µ Mšê©g})@+S½/™æí̘­¦,?µX¢ßÊD‡yµ4i›ïøÌ»÷WjüdŸ.rœÃqo•2 ó>ä`‡¶Í 0åCŽq‡¶j03僚I‡ÆªÅY9ùB Åâª6o¡£ÂØztÖ×T¾õ›·®ºr¡ç›c}°ðkJ…ºqë&ê åÈ óòÊ*„4u-Ã&MT¹„®ªŠÂ¬|~ë6-¡£¥å©_¿amí@Y·™a9AI~n^9_„@”TÔ ›5SçÄjOJ róÊ"–¦nãf:€X‘—ž+UoojXGÀÌHMQmdª§ÄOϵiÛœU=¥ÒÒìÔüJ=Óö†ju¹V"ÈÊɈe„£lÐÔDO²Ê¢´¼špLZj+ËÒR¿¢ZãæjéeÚæfz@ZÅKË,oenÆ!@K«¾¤eš´2Wa!¤ä[Vq¹ GÏ°™ŽÚ?1 ÿÙ@ËDý÷ÜÊþ{°!"¢àÓY'[ÿ÷•HÓ¿ªúåûÛ'zô›C/ø¿DD”¤_s·ñJ(Ãßl]N=U8)Ànõ“ÂzéÉÁöKΧâ_îlUîì “n¦ ™‡…AÃ}@ü×þñ “Éè¿é¦&E…Í~õ­*jÃŽ¿‡ŠiúÑðÑ[ÒEÍWŸ#ðm)QÚ舩ϲÊ/Ùî ýÛØ9´jÊ‹ñ†}V;6þyc$aõšÙ÷õŒk«Åþ+ͨ4 µLíï²£M§ªo_¸†–z›ÿ3ã_ðÏ2¦þÏ”¯†=¿®úøo£íÿ~Íü­}ù¡; iȯ.þåéøþ~-1§6 q£(@3ü^¾›úDc¤ýá õÕ©ý#þ©F à_×þMÀO˜Å°ìØߦðü‰ñû÷j«¿œºÿ½wšqÅ.û&n@þ§GÓ#{ÛÛÙÚØØt tðÎ{ "Ì9mciie-‡Î––ÝO~RLª×Ê*ÆmìåãÔѲ£•½ç´U‡rʤÕú6!„, ³Ž½ž9Тc'+ë.ÖÖVVVNÞ!±ÛÏå–‹¿«åÓ_^3 ÐÎÖÖƺK·ÞQ瞧#éûC­Í-;ÿ–6ïÜÆ|Wš,uÝ@‹°åÿ~¿½ Ö¬ƒÍçÿ.]•$­oÒiPùíž!ÐâʯE÷¢$(­ôvîxðAÞ¿N!A™Ðß­ãîÛ9¹w„Ûk¼lÃÏ£Â~ûw9GþòÉHÉû+.]>Í¢iŠ¢hÞçë>Ï&"¢0ç¼³µge2™L&£hêöæ VvþùÌÛ%Óü­]Ýú=úRBQTUiÆ¢pw[ç…5‡ÙAÖÝ3Q2ÌÁiöÍT¤e2%,ùºxˆ¯M¯ Yòj—Övv¸ò¹Œ¢(ŠÆô‡û\ÜN¾ËG¤™vËF8›/~PYýX9ÙÙîZ ýíø÷É[ÿo4RRÔ߆0yk[çá¿ãØ+;þwèéßÞcie°¯ã±GßþÒ1¥°O€ã{9¿CÀ½MA]G]¦§DÿYW4 @ê§'jê–סn¿+WûvùÇÍb›Íf³Yˆ÷ø5!Ú™[OdÀõõ‹ã9–çïti­GQÑi1ÿЭîΖyYYŒRôxo¡­¯ ˆ€°X@Ø,QÕk9ïÀ Æë¦Mfª=z“ܦ£W`mB4u²gI¬ecuÂf³Ùl6‹]ý¨¬NÄÚ*DM‹, ¬hÖ˜¡wRÅ?©íR˜?Ü\À+vßþ®~?>^àâ“W/Ü n®-…µcÀÕ¶=¸° œ\`üzÀêje¯!"œ]`Ì"y3¼‡`ïSrï€ôÚi÷!ؼB ENUUñ§è±£>É~² ðâžÕcGEM‹Ýš-­Çôxq~ç„Q#FŽŒÞy!±Æ”Hº{lêøQ#GY½÷¢¸ºðÁ©mÑcFŽ3a癇PxcûÄu§¤%÷GqíÈÖ‘1Ûå(€÷aøè‰izÇ¢Q‡â nî^5|ø´E; ¨j;ZZxpÍ‚#FNݘ# €¾¿væ¸MWkˆSR’^Þ;bÔè˜M§„Õ4”}¸3-zĈQó×ìå3ƒ†¹ g§Ž5vrÌÛRN½:IÞõ˜¡±·åݦŠ¦ºþ¦ø™£ÇF‹*­œ9lD즓ҟTµÜç‡FEM*–‰õã¶Ü(xufÓȨag®øXXÝzÑÛ«³£GFE^µÿ€¢Ï"'¥K$±SGºž €€øzß’Ùo¥^œ3ywJÖӸ葑c¢ç<Ì‘GÌ òÞ76½T¦0¦þ"5o_^ùîØ—¢êPüVŽ®Z4j ºˆ'$êÔàÁóG]œ†4bO„ 4ã¦D OzÙÍÝ€ª­3 &bxÏÒ”äD@{S“ÔÏ.>ù@†ÒÁóýO¡bµ€;÷úC;UÐò]vuQ$S$“ý”ER”`É)hÜØ%0²„íBàâtp ‡L š)Æ`¨H‚GaDGXq?€qî;z­„·O`ëXz”3 Ûîæ‚e[Ø¿Ôí¡@R¯àa©€— pm;¸DŸ÷.B;øT&'RJÿŒ‰áúHŸI¿>æœÁ]CóEµ¯ã“3‹Ûñ¤kH¿¾=»>Ü2v¶{„ÜsÓ‡­¾eï: ´»äå6ÿñû !/¶„Í?ŸéÓs@¿ ®_NÏ ]ûDÏ>ØÛJGIݾ¸›š^ÖT•™ñåÐê9I:®S¦LhλÕwÐ|BoC}ãM‡î¬õ­—oŸ×ò´Wtõío œ£±3ß°Ú÷ ñ-º¹aàœã„aÖeϾ³Õ-½èÓ˜wß#hn!@ˆ0óbèè5Mƒú÷°91¥_‘°óNT˜òúSu–¤?&¿),—HÞ¾y3eèT»þ3&)¼ºfÔþ7µßâ%]»«Ç¬Uú\ÈÏK½°{ÉM~ÛÉÓ¦uà|„!ï/®òµ¾µGž•¶zG,E•…¹ž% ,‘ð!óÒ£§¿¯­Ö‚_–öâÚæOÅ£¦ÎênÅìŸÅghF™”¢0¦þ²!€ôÝMã}Ü;Ytì>xܾóñ9…åŒ*.Ì9ïÒÅ#þkannnnnnNNÖÁya]<çЈÈr5¹\RþiYU__ûKÉUˆeÃœæÜN«SAöÉ¿ƒÝžtÆ¡O,Šô÷t±´° švòæó|ëD¡UŽp6_òPØp°ž\*Ÿï!F–?.œ‰[N!".†#Fb‰ ± ~(GD\ÝÐo#"â @°BDL¿†¨…ˆh€_„ˆˆïv#}ŽùgÁ1ï£=`…ˆ¸³àŒ¸ŸCû({yÊÚ#¸\F#M#òWq&M€¶ÕS™ŸSsùHÓE}Ü1ÙqÈ\DúÔpïþ®Ô¤ÊËç!J7ô°Ž¾øU^Fñ™1¼»w¬__¹1u Ú%dÞC¦õ½ã¶¥"â¬ážá3w Ò4McÕ—v.·+0y]ß΃‘¨>’ IDAT7×¹zBà¨EWj7-­ öw›°ïž¼(瀵¹ï; E%©O³‘¢(‰0Çß©ÓÝ, /rt›uGnwŠ3\m~6¦¾ÐiÀ±ƒ+Ôßþàý¬üâèè²çm3lßÎ í´…1¦Ø¶Š`ú_ºqiÓ’©º%/ì—_}«Èk篙5Dôþ´s'§ñûÞþ0è&N%Åwòiq§UœÜk¾AØÜê>A ¢~[ëþ£gÆÄF÷ÿ™x›ò«ål6¡‘ w„¬|¬»ýÄ™K—._<{P›ÃŒŠdÀenCÕt“p¾ÞßÙÞÂÂÂÂÂÔ<8¯§"ÔµÁë.p¦>¬·ébv|ëæouFž%7¿s$MÑ„ÍfF˜°8,ÉèƽúS_òiÞÅbV;}Í6m®^ÌN?s Ù€^êµ-P~ý}â†úÌâ1óO§BjbmÌ[ëʪD²êy—Jä7dëVÝÄMKΧ‚ìîñòɱ7e„ÔdÌÑœPçÉûHOìzjQoÄ!Òõ;ãL;;š°ˆdÇ쨭÷‹© ö!í[kÉBú_ª³^˳áE2 ™ ŸL2ŽÀóx¨cV­ ™ r €q ·³//pîR€ÆšõDÐA_®¸·®?òÀØ° Ÿ_& ˆ„à£ãîf ¿ëk²OŸ³!tTwƒFºZZZ¯2J˜E[ò-ƒViliç>vîšÄ‡‹¾X÷^¹™»¸øÍX±çéɯ6ÅÔ^6„×8fX“M»=Hp‰”“Íâ”å%Ë$_ùZ]š+¹µWÎ-VêÔÅÖÖÖÖÖή]›Öæ- va±sŠ är²âC~•aGCêìí"¿©£Ú6m¬­­¥*HJ™"ª›Ñ“‹åïb©H(”µòõ199999#åbS6—€L Õ‰«eâ_æ)F·Ãü™‹„·Í9qçw·§Pó–F’‰% ƒ(3I éf¦ JNn†IG–¨ºj€£•U΃CGÏ‹ðhõ§‚†â毽ÛÆÚøÞÚ;¯¾*(,,,,ü’x#$æ©_d/Í·DÒjÖèÐ3›çåË´º`ˆYùH—C7¿åçg|z>±‡ó¾åä0W(O?[ªæÕB¯fZDe%¼Â‚‚‚‚ÌÏ/¢»{\úª¿ló,DPjÚDãÐüq?1¼¿´ÏڴЃ•ÿ¼=H•ïZ¿úí7i(ëtëºÃñ8ؾ2Àì;@6ìŒghÖàÄ1¨üsm\àî ö‚¥ø{C¿Ö#t€=K!`3À”çlZ¿!§‚ª}ßÛÐÅ»“´pìֻżÒÔø#ã7žh¢«ô™9-šè‰——}¹¿õe^‰¨¸´LÈ[5$zÓÙRÇ+ùø ^lhÑ’S>£WŸùg_ñx<^)ïÕã§l[mŽ’š´2£ °P,Ch7(–ÜŸuá½É°Ãê ö‡§WŸf•”••]\³Chnß½8Íš®ódóšëŸJKËJ¾}ŒêÕuáÑBðýÙ=[Î=¯^Û¬K{~,*/å홾‘íÞÏŠÍv6ç>½ø°¼²¢0ý娱§Y*Ü‚¬\1²‚¢‹öÏŽÿZ\ZZp66º‚ª‡cY¹©|9û¶¸J(¬x¶v±èÔ äp`âÚUødß®¨Ð+ðÉ®©Ùż²²²¸µÛÐÂ&¸ ¬Ý¬OmÜ®8T ©C—Š/×ï 8M ~Áj¢’ô 6ð©ÿjç·<ň¥é¦ ïãì`ooïýQZ9]Ç\igß`$ -ÉtèxâðÇŽ}¾ŒM`¯ÉX&ADüp5ƒ¯cE:j‚*~F\ÞðÆGDÄWGŸDDä}D„nrÌ/a35À–n˜^Žˆ˜{º~w³üðì2d²ã,yî÷Üç®Nö/r$?æQ.Ÿ0ÀÉÞΫgÔÃL!ˆI›Lí†0Év¢‡‡£³«÷ò¸7ˆ…ƒ»ö)’ö-çálïèä<`ü’Œ2 "JøùË'…»:98:»œ¿½LL!¢´è}¨{;ŸÄ|Òˆ´hJ€Ïm7jZŸé2sGÂþy‘.N>}¢ßó¨jÿsâ԰nþýâ7?u2ÊÏ~ìnD¤%åþîÖçž~Z9º·ƒ£S¯QËò„4"Ê„ùÓûÙÚ9„MÛT)£Î. ³ìèr6iZvï‚®NvnÞ}ν+äç°óFúîsš–]X7ÉÕÑÞÃoÀ¥äâÁö»nå`åç.¶ŽO²*˜j¼Û#Ûy/“!ÞYïï<ü"Ãß^²upI,Âu“Ü#bîW'=¿Ô¦³VuÄÑÛK›ºwurpp{ ‚’óGÁí­í-Nå2]®šïÑÞÞ'V„ˆˆ/ô±ïH>‚,G{û›K±ìë'gç¤BÉsÜÍo% ¨7 “ýg7|­2ºþwië¾X–ƒÚÇI P‹”_Ð4"îÖóú·›øƒÂpÓ ÿ_okÿ/?™ò®oL¤Ëº{1‡` œSÕín)ø%í !þôº´$ÈÍúÖ—ïßz˜é2cWÒOÔGý«¶êÌSÃ\ó‹îпœš®Ã 1ÛO éŸ³ŠÈéz{÷CWëÒ@#Jù{¥ñ (þºû†üQ!©çHî ¿8'úÕ%çÚÇI¿& ÖϤ!cŠ‰ì†y7ù%¿,ü7ùÿÿù Õå” „4¯­Ö¯|¢ uühoh k#—–$¾L¾{d)±ŸãÕZ­áü·õûGÉÍW}äþá?”’_ÎJO¾Ò³ýÔRÏ·âê~‘ñGÒëvµ. DVQ Üka õÿjW1þ»°TÆúGÂVƒf Ö¤ž_Ô gŒ2ü·VõqÙ•MÝŸ µòàèêÑš\ÅiËŸ]iZÍgŒlþß¾Ü (þî´T˜ÚêÌÏ_&Vd«Q€BÜ(@ øÇ;&&æy£¦?%Üòò5WÏLWýa»!Òñ·/ •š5ÖVú $øwoï@@ZüôA|â»ßJE&ÆMXÕ¹ó¤%éâŸ$¥¤ÉTh«¢ü¶&={ðìÕÛ¼2©IsC “O^ž[*51–—ÿYÂ⯷o?úP¨Ò®…ÎÿCe’õæþ£Wé-Z›qHõ¤JKŸ=|øêÝÇbšé#¢Ü¡(-}þèáËwŠù`ÒT¿:"Œd|õ8áÅçÌͦ¦šÜ]ž÷>ýýÃÇÏ>}ÍUÒ7ÑQeɹˆ.vÿÁ«wŸx"–q=ù·â™ìé…Ÿ.ßHPmÙV‡ó]ó•§?xð8és:¥ªßX[埘ýS»a2Ú׿ìxï¯øŽ\áêé98rš]­?\¿ÿ_âB”Eôtsub\`‹ßÁóržGRðá¡öÆ?ŒÃ_ž|YEz°O™a‹Vš)É ´ƒâ㦫ä>óê=ÕÄ¢³!«ôMrÖ¬ã7z˜ªHöŽñ=š®iÕÑìKâKa‹Á7öã‘îë{8MÓº£Ù—ÄW|“·öçÀ¯†U>u N\ÜÃòÇÅ=häÜá6lþ‡ÙWˆ2É¥ _LQ%Fïc>¨’¢~þÁ<ÍV6mô’^'6êsxŠ ¤x@@p±†™MÛFI‰‰z ŽLóÀçÛ‡GÍìhmÍ*Lz›*=|ûº¹.÷‡5Røx}ÏiçÛt¶Ñ§¿z—·áâ=‡fjtÕ·pÏàBƒöVm5ß½z£Ûcùñ©îLLsáûóá×WVY·âCª? ÌÏ~â:£EG+Â{“œ=ïäµÿ$Ùþ·œ‚Ó W~{qÂÕ«¨þsÐliŠÂzêüâÀ›®ï„”®ç„½N“Ò°`Ç-W2:Dþᤳ¡¦gy»Æ½/üùü•®÷# ªýô`©¯mŸmbæ ¼T7§«ï‹«ùÚL­¦6íç“iÄ”kÛ]WHhD¤yÉsc6•J(Dü|c§«ßÀr1SþanÌFž„ÂzŽ¢ëR$£èúcQ0ÒÖr[V}£AÓ?â¡ÂC7pV]Ï þ\¹ö±u}óŽ?D<ÔsòÝàÑ:ýny¿°Ø³_¸º,•ÉK—vî½Q"oÊ r±:“T…ˆ¯—wïÜ{S.f»XŽ¯ç¿suq¹û™Ç Á… žÞó¯ÿØUa®¯›ËÉ—òû¥o×÷²zßîÔ}9*%.HruqyšÁGDaîGáù•Ÿz´·;_òý[1Ýl¦]“#I½³qÛ…ôÅü¿ÈwCÈÅe>ž“/öôòð½“T¼9ÒßÏ¥{èàž¾ž=‡MÎcɃ#Vžiá˜á‘·Þ—IÉ‚QaÎ^=Âöruñ[—B!iÇZ;÷¿êéÕõò;HKŽwöê>¨—«‹ß’SŸBÈÝ þ.ã/Œ>bÖœY}üœ#¢7‹ä‹+Ýl»9»zÌÝx9ʼ³/ÆÏÃy`xxW·È…‡‚x~\ƒ–Uk¤ðE\oÿ>½ºúo¿šDÉ>Ò¿Uðnæ– ¢l€_çM—s !ïÍò´íÔoPHð ‡7&µõ^A¹³dÈ#1[6mîþ[ow9Ž¿8¤»—÷Ðå ýÜÒ@7çÀ>ýƒ}=‚N+“1:Íó²³ Ñ·wß‹gÆ·ñˆ•ÕÕºDí=·{¸ rÕ´Ù,–H"ƒÜ§ç+›Ìò“LÎÌ3zlHðôÁéž34¹ˆn‡% £u¸,H¸gì5SK‰)o¿dá]. ˆ8º‹á }9µc!úÛFÏßíæè¼è)xsnuOÇ~aá>.nƒgl¤ !„^=et*[íÊœ‘QKîþ»qýz¸øöêïå÷¢˜ùÓôÁv£æíswtï±à!Hº´.ÈÓ±ïàðn®îƒ¦®“B™=Ä>jÞ‘þƒGÏž5Õ˳뼭טɊÛ0ÕÓÅ!88ÐÑ+hÇ­OØ:oœ»‡wXØ;Ï)Û„ÈÖz›;/Œg&¨$aW//‡n݃ÜGÏÜA˜ÒË2zë[æ(!dMpû>Û>!7÷,ôópÞÕÞmXìù5ÑZÐ2rËÁ½XuÔ?郄Ò.¼¹€ÈV5ngløöÙs¦ÜºŸSÎR1nßÂðí³^&esc]D`NXzéxqÕey)Bšã`ÞŒi¾Ó°hÕ—G¿Ü8üÜ*z„**´´SaÝú˜ JÍïÜÛc¨QÇÞÇìGMgûÉ?ìØÊk˜àvàëåMmºUÊhòÿU»AÄ[ú¸u ÎbD}Åçn6Çç1?‰öõ˜~©Z» e´›{[‡¹÷žÅ„kV|¼àèèü™'ÆÜ3–ìGí~˼¿#Ê­× %?岓£ãÇb1">ÚÓÏÕÙ;[ŒˆHå¿rrqM.aîM»Ž7™ ½o÷¬ÜâK‘ú´·Kgÿ‡EòhÒ±~¦KG¤KÒ?$~ÊFDš–†õòt0‹Ñ#RŽNiïUŠ˜}<Ü"t_õ(²ßz5.Muqt9ð²±*ÃßαsÈ&†º~n®§ß!â›cƒ\œ|Þ2{›¤tJTÔÑÄÏÒ ÷ȃ ˆHUdº;9ïMÈgÞèêÜ)hí/‚sïrpé™ÉÇÂøÃŽþ=¯ïYÔݧkë.ƒ§®+ "Æú·›rîé˜ÁnÎ6^}ǧ2o/öo?ùÜÓ±ƒ‚Ýœmì=û{À”S_ß<ÿ\(úa#œÕÍ«ßtylÖy»Ž—åZ”p~o›°­É4ʵ›ÙˆˆK#ýÍ=$OxbaÿáÌÎãëÕg’<7犽…ûù4«(6ÔvÀÆwˆ;ÞÏ+4Z>+·ÖYxGŠʼnë¬lú¥H…/7[vîý1ïÖ\Û®Cst‚$'Ë3oÊéÜäWï³Ê+¾xY9H,EDg89Oâ=Ü6Ã;l†¼gy×»X|’¢ìãî.V‹å9$GûZÎ8™Q¯žp°–vCŸŽtö]v¯FQšØÏwøê8DúÌ0—nKïÔ”Oà7lÕ)Qz¼³«Kj™\7½]kgéùºn({vâA—þŲu2«‡Å‚’l÷|­™Ù‘p÷Þ»×z/­¶v“o¿c`Ÿë»c»ûtíbm6mC¡±Š—÷âu’Œþ§'·øÍÔè´rc/#.@vÒKžVˆ…&ŸÏçó…~FŠoîÎAKd̽^Á¥cO­FO•ø|>Ÿkb×Æ[é< „"z“‡u@ÁÅ#;ž&ðù|>»¹M$·Ó‹išcÒ¯‰ K] iR*’½¾ùD¹cûnMаë“×ñn:x~Çu=¿`'MŸÏç T=½=So z¦í­Í«Pâߣ— ´4ܘ÷êfa½=dñò?6Û«½>€J‹Á:2æ¨LŒ2‰jy˜ëWgíîAfìÔIoß½35„¬4”}¡ vµ0õ…ý›ÊèzÜ)Œß²01.(úÄÌ£'LÔAPU%++ºÀ ¹|ëþ«Ä'²O†Œ? ­”)¿Ú±iå± ñ_Ÿí±nÎØ @\A)½Ú¾aùÑ ñ_žœç¹aî˜4¾ €Õ²³]›ÆÊu6\@ig;o Ü;~[ÕÁ©[cfÜH·¾=¿]Ù)EÓÀ\ÌM|—éÑ?”Ïçóù|óà¾MÒ“î”3tË:Xûpàáé;ʶvþM„|>Ÿ/@ß¡W¶‹’t° aRúèšQå•eçwÞmÖ;´-QÅfü»7gZ‚äø†›­‡M4`˜€nnÛ¤YBâ+Ò´C—ŽÆZ—òF¤£Ñ½½ ×äê“„º®½½x’R)ñçï7²²2çà¹m×ôrÐ`:¥æáÑõË­ãÂ=HºÏ&85ýÔ«<€Ÿ|iÑû\¾”–2å¸'_æ ü—¿Ëª”QeÓŽm•Y³6© Kó’#&\!ê‡Ëü”D¨òýJ/K™ÃB±@ ¢ÙšÊßK5•AÌ—4D–@X%-É¿¨Üûò­û¯[dë9þ<¨èÙZY°ÿñ.³ß<*B–ž 3T|A9J„}}j$‘HJò¡Vj¿Š<¡Jæ‚^Õº¬L&åæ   ’š‹Y•¹•Œ…A5u(©Œ•Ë[@PÕa1ë¤ú‚A…@]Y°& !“GU~9ìÒõ S@S25S»Ÿ§4µ ˜tõT…ß*ê·Å¢2=åêƒc»ð¬¾oHè™p‡ ]1¹gßǃ¡šh«äñå÷%"¢¶ WNªnËÆ?;é/ó“]SÇø¼îâÏfÊ Ì墪þ²AˆrÔÒÙöæAo5"2ë¹XÍ|ÙÎßw0™¿Ð^[ˆLC–j ¢©× Û¹{%WÄ8èÕ?4­¬Õ˜Y~yeñÇîžw«'b©7“QÕy5€.°4÷ðÜ[M¯˜+z“‹ÚhJIÛ€Áó­L,ùòº«§O ¢l E@¶²¦|©“"Gë[ªAˆ\I•¹}ŒÛ6ùøP2i‹¢’º«®”M´8ìZó†~#ÚÌ\q¶`O_ûo[‡œÄ ]ñr¿Ëݽ5Ì ÞÊéϨª´vx#'zJïu”zHôÊ€Öo²Õ4@¹eä‘MÜ詽×SêÁãWt7“®ª  »çbÜŠ©c<]W¶pÚrb~ŸUFÒØA}’¤Ê€2ðE¡¦Ú@2ªzÍQ‰Œ­®£­É–ñãW¦‹ù ©Ûà×æU”¸ n¸|…œϼš·Ûñ• îo“yåÚ‘¼Ö­cÛ.¾,$„¥…yEåÕ‹Léá³x†Qy÷Ofhtô6Í&ú¬¢Ï" €…Šxb@Z§QK E)ùBTñâ¸6«æ»ò c±²/e”T”$ß^îJ§h €V£V„Ðo¿ò€Ê5§¿1x(©ðsÊç*)!¥)¦žÊ‹;³Ý¢±2ãÊœ–.ÝUó—yÇ(Oì”õ0b³wïÌ{k ¥@)÷â%š}Úk€“Ohö½5 ‚Ï÷ˆ5ú´×@Þ·œbì3Ø5°KÑÓçoªGèÅ¥ÝÇâs°ŽÝaÜ¡½þÍ×åšBÑ«UK0L\ü¬K^¾~U*_‰W÷¹ŸÕP³=B;g\¾–! „ܲ1µº#PîÞ9qëö²j¯íž ëßåŠÂÜür4iÙð÷SŠ BxCì,ÜË$m­ý±òé…5{ô‚z· Al2.^ùZòÆÑ­—‹~~æ笢ڔ()qˆ[îE/{±±{øZ!³!>Ûó>Oßϧ)±©{øj¦üÛó½ïrùû¶QÁÈÐkJ¤³–&ô›Ô€Øùúùøøøøtëت‘zÓ¶­•¤'î¼e²‰Ý©:¢)€÷辟w..¢á%ßÿTÅöî`Z+’Aä*ÉwNk·@•Üeg“ª™a·¬i&* «ªÌÉ+ ÿñ‚çw)yºk,ýNÇ{EŒ 8iáÜHœý:S0u׉j_4Í,΀èõûzG¹>ré`”ð”ÓjÀ8U”}ÿ"øŽ_¿§÷p÷€'.I OÙfýƪqjÜ5<ÍŒ,»]ŸõÃoÌq6ng‘ŸúÁÀgÄèVh5kr·ðHß®Vvö¼ä„ti«½×ÇâÅccK^îŸ(µgztêÔAíqÂÛ¾ãW3 IDAT€ë´Ê¡CÇÅx¶S:sõ›–¡&ESJM,&XkÎìèèëøíÍ›È  Gݶ±ÒºI£î{÷›Ò®:| ¡±©ƒ¡ÆÆ!#šÂãTÙ‰yŽAÓÖÄX(Ç òšëi°px@œµ íC÷°öñgh¨Ê9$zóÙ']š²ÍœÇ“IzÖtµëøSºµŸxKßð >G UÅ…¬Æ{OOP´~! §³³YKý¯Eí{.´ÒQBÄÝÇFœ èåâlÚ²qZFa»àÖºJ’e}»òF=ÜÞ´®p¨|ÜNÃV„?›Ðݹƒ­KUzbJ…þæ+#HÍy,^2#`ð"gq¶Æì—¯Þwî9—ûýÀAÎ \‹ð5‘O¦¹˜Û8K2ß~*×ÙpixÝJL¬%€¶ßÒ¡Wûöôh×ÖäcJº÷¼ Þꀶº\èàädÝ6íùÃRMžÕd#{œwÞ|g®+[¿ã¡9.‘£Žµ´”伧Œ¼·¸µ@–~»ÁM¤Ë¯¥ŒY³ŽQbÔÝæNð ÒÍÃÚή8éi†¬ÍþãðÙú)3 ]^ퟂH/‘Ë—I*iªªH%Vžyò”»M”aU¯n^·Zè²3K¤“÷5WвjRÕ³›×íºœÌÉÄ=GÚ©€á$ƒ‘Ývšµ)ÿš¦lÞk]·ÖuÃpt÷‹é5`ŒçUIžX¹ÅÁÕ~€ØÒsrÀÎÐîNÍ”sŠ$‹Ž·×ç@ÖãMVÝ! )Òᬲ“ .ãWÎèÖnÁ¡M¡CÆû1T©*¨äî;­~ÿHïU×Þ:¯ñϾù[a~bA©@¦ª«­BªT‘ B(’"e5 U% %Ue|‘®®.‹ A™¸¼’OQÀâ*kik°—Ué6ÒeW+±H‰+*ø²Úu€H„¥|©¼- e%¥åš:ºJ,‚Êr‘”b±•4µ59LF7 ù••b),¶††–2—‚˜_Χ¹´Õ±¼Œ§¬®âJ¡„bsU´´Ô ÄYÅç EHØšÚº¢Ê¶ŠŽº *Ëxb U4tª®ô8äœ|f8ÐRaYEáªi*‰ËEÊz:ªL”"%–ó«°ÔµtTØtYirUu5ÕèÊòr‰”æ¨j„©ŽëÌ>\™ (>á×qík– ´DT÷(SI]KS… R‘ R BÂRU×RSfË#a‘ª(/—RÈQRÕÒTcZgF°¢¼BJѵË?߸Âwô¬ãÄ©,çWSS+71ü ‘„ÂRÓÐTUb3®å%<®¶>#ö)‰°‚_E#0È°²œ‡M-õj<•"‰¬øå<š£¡¥®@U•‰ôé²e•RŠ®=@K+**¥6WSK‹ËB–òD\M= %†ÙªøB±”°8šÚÚÜêÐi™°´\Hiêé+9w ùÿÓÞuD‘4íêÙ@d@AÀ„˜A‚ˆ x$' '*Éæ€zzêyzŠè¡"& 1aT ¨ ’aÉ°¤ew§¿³„]@ïÞÓ÷îÞož_0ÓÝÓÝÓS[Õ]õT —'Á“Wb"ÀME~+böï Æs«*ù¤XŠN¹nÝ¥ ù5Ü:!FR2]äd¥Z¼ŠI~c ·^ˆ¡å:åá]WSÝÈL¶‚‚<£]šuªÏÔ{Ä袠(ÅD˜Ú}‚šê¾³¤»(ty xÜjñ=ボ‚,›Ôîôò\}I–ñÏÞ-¦Sm}¼²ŸÙÑϨlþj“Ù‡“þz«U·µÙ1ÔäN0YXI~w­ˆ Ï„ZúuŠÎ¹+ï® Ü{ûft؈Iξ1·^’H¤ãc@¡—1ÃÆÙW£ö±œ­bciÆZFO)´ÅðâêïŽ µuu&¹/JÊã6çPCÉ×"'jëêZ¸/z’[ƒªÎy £Ý ]A} ^ñ$›qõ‡Ÿƒ¼tGÒ­;gM8§A#Üt‹¥é8“ñÆæv³.¿ø$ÑQTv¿ß`£¬:Aûy*KOªh"ÿÐœ½ýµ×Èiõè[Ûúß›€"ïñ ã‰65ä" è(cÁ·' èœÖ mÁLGÃÝ—?v@q A¸O’’iHH12…N©:Jðg$. cfO&„#„ò™õkZÚõˆiÎvnž nåòB#ÖFn^âêä8géöü&*¡'³¿“““·ßª·%<a|o«¿ËÊC!Œù>Ž'J„0ïÅns¯m¡ò;¡v+âßÞØmë±°±ƒ<ܵŽv§òø!„Ð.®Þ»›Âq?=wws¶·™žÎ£¼FøÁ³~9õ!Œz¶wù‚]¶ºÙŸÈi¤êÞßäê2}!ŒP]ÑKwÏÂÆ:åo6øÏvtv[±ët•!Ìy±ÆÏÛÞÞÉCD5'gý¦n}yçðjÛ·Þ^ewð=ÿì¶ÀYö·þ$Q½ÉKX6×ÓÁÁiþŠÅ@Pi²­ëìÊ’§sܬÃïT ×x¹9zø†fÕòÎp»úª„j£úæ~ž…ƒ*Üð .ŽŽî^óÏ<ùLeˆ„€_0ÓÞÞuÛé§R @é±Û†!„ÀHXüÚÞÅ3³†Üâºùä{„pÓ6ù:88zÌ ¾—[/zçö®swvp6ûÐ4QrЪ GWÏ¢¢äS­·]­(ºl³0B5å',ŸëaoＬÍ")}·h¦»££ã‚ШßR$̸õZYsŒ4ÿåÖý×6œZ5Õbj9ÿòá ¾õ…u”‚ñï[.±±t÷qIÚ´¾¾²(Oî÷û›·± /ní1c›õ@iŒa°û=­ò+W2¨ëÝgüd£%1 rÛ¡?¸òò¥ô¶&˜ òôM÷÷†yJw'{¯ùkó„ J=²Ñ~ÑÖo¢èü%cJ(¨É¼µ¿PÍrÍs€Æ½slv¿bø¯Ú°lÞ”sS¶Ý+T1õe ,ùÕ[v˜ ï^ô꬙ÓòN~›ÂV äÞ3u â ˜ü¢œ×þAW|BtúÊqRcM—søqSتÁu'8Ô$7ûÎöøJÍ­»ÃÚõ[=Õîs‰Pé{Ë$–ö’Г{²ÿaF9FÌž<%UÑdí†õ³Í{.˜buó3yUõþªT4 .-)â6ˆ¢)pcU§XŒZÎ똓O™+ƒ|Ù,4y³±ÇÏdçøÍ‚ŠìKEu€ŠÞÆ ä™™O^r¨IÊ(ã'$'QAž¾Vïmj¢Çk®[zìú§ÊœKµ€8ïÎåƒi/éf™ÖðÒj²/Û`êŠå*ï#­æ„“qóïšZÍïe>kÓ¦µ†r™fV¾EÄ-xù¸vèÊyúó6ue! /ÿu>Îb2òãUSÇà6óÂÂÖY÷«žbæ”Y!,ú”ãïwÌÉo…Õ(¥²W¼Wž²ž²l®Å™öoó š„ŽE½qœ8HÎ<³q/¤õB×® ô6‰ðs:ŸÃE x¾M®ê7­ÅKô‹)Eµǹ7±^”qû]òÍ®L¢¢¬¨‚Ë'yeNV3`´Ëú ëç;i‡ÚŽ‹K«Aˆ»ÙË<:G)xMØŠÅn÷Ã<N¤!@E…Ÿ–,ÚŽdÃó´Â:ÔÁÎ ìî5T ‘dÛ[ÂÊZR©§< „º\÷œÜ4²²–TRn¹jòÝ?æ¾k›j&~—w×}:ªRâñ"˜)×sɪuý»²(ó-ía–ôHí.š'6¼:S€"k>6ÔñôVn÷U7¬ñòWŸì»j©O饭¾'r`jp0ðÐŒUaÁ“Fr¸¯.ÿÄÑtÚ³÷ Îy»©çk†îس׼WÎlÏ0ø e{¨ôWëõ7Sß¹•Ä$ÆÕi7õL&qš5µºäÍÚFÁ5ç>:>ÞÜ¥Š1ÆûbüÅ ‘Úá5ÊewV³ZDZ64¾’UŽ1NøÝÍtrp#¥SWeŽ3yú©¶øú®ÑÖ³š5mnøªU÷8‚ôßfŽöü¹¥“Ñܧ7CxžSô#nR49dCÂz-‹Œ1÷¡ÿ˜QS²Ee$)ŒqÁ‹(có¥u ².˜8ù„YßάÄŸ©t»â ŸË’½71ÆŸOÏô½2ÕlVÆsÝÆk_+ÄE)ÇÇ™Õb,ÈŽ3¶óÞ4eüµwå㟱þ7[)Ÿ¬²4 8לÖ/wóšŸrI|vžžå¦ä>7÷‰ã$ä`ŒßÇÎ44œVF©¿‚šé&‡¼—xGgçèN\(R‘…õÓ&MØ—‚«žiëÉ®§žsÂSÇjûkê¡¥'ë_x^‚1&+¬L åñ1¿>+#]ˆ1&…ãØ:ŽßbŒK“/Œ5µ,kñ¼œ˜n 35c|ÀGwê¯ï¨ì®=ý`6ÆxµÏ¸àˆ´¦ªwõˆÈlpyQIŸ¬zws¬‰EA­€j§&y³îbŒqMš¾qxjÕÏüs3F»FaŒÃ=G¹îi)Ylm`÷¡êíѵãÝ׉È{È’¢2ŠXp³ï¸·j0&ï­pÓŸ½ë ë¹ôö2mÓ.Æó#=LÜ÷ÉŸ3ÿÅñ¶ÆTÖi£­WURÏææ:YÏØ1~Ðc”ÕJŠ ‰¬Ís±2žÕ²yñº†v¥d§‰) ¦ìÝ5ݱærª0&1æÿæç¨7ÁÚg–‡ÁÝŸn|–4YËFk?ñI@]N=äV%eEÒR Ò ‚"‚Ðû¡¾ŠÀdêì“;·×/:"˽ªrÊi>”­Ü·),£IÑt¤¿iè­N͉SÈTVédÿ^Â}CaÂ0H¾ûA4p’ÿ¢ºIO½'ˆí;t¡ÊO}[EÕ4ä7ñ(©Ñp"*{ŽË ÈËÏ‘VR3ÒR•‘‘f•±Y"ôèÚ“×TÃ'1žÆ狤҈ECxž—Ý|–`h9«M—ÙPö&§N©{/3§]ÇâÍ{0¯%>Qï¥ÑÈçÖò…Ô¦1/÷!—Ò§Ó3Ý “íR5';·œÑSµ¯•‡ß•{§d_'^)Á±ÑÉ“&èPCëb¶ÄXùý†±md ʼ°~˜Žw@òÅ_ª^ÉÉÉ/DHÞ`>èôÕë2;’RSSRRRÓ.ôíX5F¨>ÿùùÄ"5uuu5E™òÔìÂÑF†Ð˜ÿü|B‘JoêzEÊûO£ŒÇ5‹ó‹‰u#\†ˆ^Æ]£Þ¾OIIIIMÛîo€ olYv¹êè¹S:=[²»ë„|’Ù¼’‘O üãÞd^Gù–.8ßJÜ`ÅáFÖÝÉ7ÉÊÍÏËy÷‹Ï$‡å% ÙúäGû\žö)?ÿÉ¥}“=3Êye¦ó½öìݧüü¤Ëû';{¤•5vöÐÞ¶ncÓgÿ—•““xrËÆKoÆj°F,ÑÌ:¹ôȃܼüì´Çs'®9–N=±éH3+jošš@—}£ÎÅ>±sáOÑ`²jµRÒÏ;.<Ëùyvïñ×ìl° ]U{îǘ©ùùù/ïž´qtNÈnG>ˆ²Þ¦¥Ì/n¬Ìð÷óË,€õÊІ ç“2 >%ÄîÉ(:1ß †­ŸMÞþ¥Ór >¾Ù°‚O ¦äíM~7SPWíS[]øô]vA^öÁM[ûé(V¼~]\Û 2ZO•W¶6êÖǼܤKNÕÉ£f ÛÐÙÉ;3{{»ömÙE@4'δs¸ü4-7//ëMÒËÒêáýûÈ34Wï:÷± àcÆSÿŧ —®Véü•Øú|Šö¹þŒZHá“=Ò+„Nü2Ã705óC^îÇ”ø¸‚.*:J¸<Ž¾®P& t[·nIáÍ-þÛŸ¿|“úòضÅnÛž„Ú©Jfí:šïºanÛ§X-ñh¼söa­„e ²3ߥe~Èãð²Ò3޽ͨ‹ø´}±Wôý7ÒS¶Íp¬ÓYæ:L XŒ‚þ^Gï§~ÈHÙ6ë½Ô}¸åäóùa2Ùg  ¥Ó¶BnÞô W}æ29Yiiééééoße5@—™‹LŸ®ž÷ õ}~~Þ³ÇÔÓ ‡@}ÉÛÅ~‹²+;=,Yaã“äôý‰ïåÝ>¹~ß™or2õ—Œ)‚ÁdŠô„±ÂÆØ[1;CùFñò?xmº=k"@ˆ`±(µ÷7žsýˆJ઀ìržêpóK‰w4eŠZ îkès#ºWàÊÀ­e<Õa/&Ü(K=‹Åb2Úœó±„4Þ¸¶}eоùŠýN_;£ ÃÎÞ¾¸yåÊÙG?³”4ü¶_qÒë~ùèVUÓêÙ“B«\=w±“ÓÉÆnë] ç¾b²X­60“Åf—f¤¼R±¤=CÕFüUYg%öm‡jÜçy°0`4NwlÃÉ£Þ.šr#l”ùqؾb³áÙsŠü¢8Æ“ªk3¬ïí«ÜÙFRP™÷áMv#`… q—#–, óÙS?ØØ->æGÆ]9ߊí^Tß]SÿØÝ„]€&«ÅÒ d·o1uù¶ ·n§×§¿Kåò0VÔr?£´"x§¡¿žõ•›—z°ª‹Õ¦ˆ5&‡ý”½*Ìo[Mÿ—}g\-1sÞ¦ví®« ÅÀ€{è:E¦ø2¬Ø±w¦BÆ+Ï%ëOõ‰˜kvæÚ±àùÁÞÇx&Þ+Ž/Õ³ýGäú»õä¹0ý4[¤“Å È.ýoŸb®Ø¼lgq­T·¾sv^p×SÁ¶^ŒÞº|¾÷>,«2mýßRd†,«E÷C“Å" ß8ßëGUWR i⥄»š²0,xŸJÿ_7Î-k {h¼|Q£émY¥¦Á,2Ð@ÃÄûÖ)·‡…­XÚH²FNp¸÷ø·îdž;RÚoô‚aì6á›Ýí¶Û“0a¥IÛe¿wýò'5‹…Vø/hª'V\¿c«î|ù°!øH#ÃÄuíµ­( †šÓå(2`ÃÒ¨z4ÞuÍõÖ"=A9§NIY¥3S¦®¼€aŸÙ¹êLó^­LDâµQ¿éutõJ¿nSO­q‡®ß¡ÄÀB^MzZJmÁf±Z-Ó–EÂè»=ÌvÁæ€T§-.Rìæ/‚ÁjÙB‹ÉD€ˆ–]ª²Ìäë™ëº÷ÙÿPEjÝZhÎfÖnÚZ™ED6í"Û暦þê¸LËNÅ¿Òj{·+LÒÐÉSZ|ÀÛ‹j±0áÖ%€Pý“…çû¼õÅÝæ'©™~¦µ–ˆ¥mË_¨ÛvZÙ<[*Ù“Ž¢=q³ë¤UˆÄ6/ËržæÊšê©ÙðÙj²ýʨD3Mé/¼8èdþ;˜@Œ‘(éaÇIG©’‹GòE7ŸHŒ½Ã éìÍBÇ1àâ/¦MÑ?‘½ƒaµ¤S¿#y½ã(ýÎS ¶Ÿr±åÔæ;l;iâ+RÜEºõ ³„ÐÄ ‰IDAT_ö­µ>ý8ÿ÷ˆaçVqk×›37u°ÿ„Äö¢ÚÏjÛFP'àâÃb ³ƒÂõ¤m±NUBÉá´6Xò¦p‰íê´ëoÛÐúüµºõ ¡Ž î椣quRWòïÆòþ³~ñ ^ª£&•xù÷ú¾c5¥q›ÉìlÒ:¾.1â#@èO4‚:ú¯ã‘~Atð.¾²;^à_þ:Û|•¼#yýÌᗊڭئ°“Yël·¸mçêÞt·à›°[Ðáÿï1 TõöæöÈ+%õÂÚ! \‰ÿ&ÿ,Ð↠ÿ%ôРA㿃oOÜ~çÂFUÇ)†bAÂO·vÇã@ßÉmÅ› 63êø½7ORÀ³š0@ ”Þ¸p=§´^Qu€£Óä.uÅ™G/Ü#Ú(ø¤@Ú}Á¬ŒïkeÔ}z}ñæãÊF¢ßèñ¶&#Ä ðO>0ÌrÎ5)š•¿A»ÉI{‘U ɺ"üüðÀÉf¯øITôå‚’R‡ÃápŠ‹*ùÙøÙÕÌfßù'åEñ§vL ä“MN1G„’ÂŒ‡OÞmüú'ŽE‚ãÏ @èsb¤‘ýâ” ¤(ËÙ4ßÆÿÆm~Yêµ~‹C:áF¡Aƒ†ÄOøÌwÓLßÒŒv”.­·xI«™¯´¹ˆ1®|¦cù¯]Ëow;Œ¶ÿ•O…J ê\&ëG\Ïgæ¨Yb>îÀóÏmŸÑ« I’$ÙÄk"Å;C•n­FbLJÜ5·c®‘÷OÏ)^2ûòý)yTUaK™}A“¼6't@ÔCƒoÇwi7w[›yúÌ›á8ÉxÒÔøR€µ>†ûÞàÌS«L Œ¦Î]äíb•RÚ¡snž¥öœ½ ¨ú,WeKª" åuçø¦(…Åb3‚ÖÈ:ðþNø#™¼uU1@ù»ëctǶw¦LÜg?!à‚ó¤I.Á@틃 ¼ç{;[Y:{eV4ñÞœb`_BRPó1ÁÈÈ0«ÞœØ4ÂÜ•Oõ‡À &›r@R,Œ©Ø¢Æyz‹Î–RöpŸ‘vwoƒÈy„ ßA»Á¸iµÙà5ÏDÿ¼¹¶wÛñTŒñº9ÆûÞ’MÕv w]±¬v™4Òj5¥ÝTdgæ—bŒ³£§é;…†øy˜M0uðœèfºX(=¥=ÿ}ìX»4nó ’Ädþt#ƒKŸEù 5éY<¤j‘tdêxcëì:Œ1&k>ZêF<ü$âÍØèl8' ã†e&#CšIÛ’zŸz€qCeqúû\ª¹üÇ1Ö-OÄÝ}œpg½¯Ûœ-'I’ÄX˜Ÿ™VXÅ‘Å‘9ö£ c ›èß.4¾—vÀÒªroǺÔ÷¹åÕõ#¬.÷Ù¢‚ê>Ôry†)ŪV_䶨¨6`Fà5)öcWØ…ß{p«fÔ*דÏËZ}úüò’Åü“ËŽF•£U1 ”r"òóÀ‰öª¢è¦´üÁZlF¾­D7 Y€’Ü”Z–:³¨¨¨¨˜3|ªñäÔöZl’°ë÷&€Š¨Èw.ëf1¤•z Ø—¢ Pjhc zñxdxÄ¡×urv†õœÆ ¡½™"/8Ô×B½6>µšþé¢Aã;žLÍÚw½ÛÞ þ¾ÓË«‹ÙÑCA…H~%_(/'%bVWëÚÞÁgˆÏþ‘»£®c°ý¹„Kî{Žu¥ü´_œX3/ü厫ñæ*L‘_hOP~ejöµ$ù!»†²Ûø˜#„àçyŽÅ“OÞ2Pe’±…O÷ûwŒ%d4¡Ú‹WЃ^O4h|qƒ’±_¼Õ~±°²¬ìâ^ÿiî[oœ ¥4 ÄT`1¸õ<Y•JÑK\ùE‰D Br,B@’€z´7 ðZ]LÜ…A]™­Q"€÷ôÁkÅ_Ž©ü)‡jé®@°.ܹ§ÌÒ}–ðæû2õ„»ZçH·•aò^¦ ]v±:t®Íª¸”Vol$'Ѿ QÀ’fÒ‹‰/ã/l7}X>Y&]{ôÒÓÑT]ܼa‹Y]´dåÙO’¨Ä)äÎs9l¦(V¬æsî‡Âr„„‘SG™/<Ø„–¤Ä}üd>Jx×—ÇDŸ‰Ô• mÃjÄ~V3Íh•5ÂFnÖûì&!þ‚\Tî7B¦¡1öq>u¡èÑ¡Õá÷@—ÿQgÎ'$ÞN±Z40 €Æê’¬ì|  ®Õ}B —,|ñ’¯8i  Yø!£¨¦…ѵ>å8ŒVmhÐø~Æ{ Å°êùfzjCtXõEhîÞóRB¡@HbÄVÜèn°~ÚícÃy.>zq{…à›ëço!m_E.ö=z9É{Á8ÃhÕn2…Mƒ'….°Ò c‚Bùd@—ÉÍæ©=mÅ6 œ÷"OVÕ ­Œ¬ü0Í'ììÍÍ®bcÁ¤P $E»+òýÎþæ9=ÄíŠêðžPö¾œXúÛaJ­êi»Jþg»[=¬ÖUÌŠ;èyèõË»çX˜±tíŸU+-î©ku'Ó3òµ~œ¬ÌhØà1Y:$y·«2`€ªÔ‡µ="†wùçgh¦AãïÅ_! Œ› éBA)bD0±3"’˜Á` À¤Ä€ BT¿¹‚ÙL¤”ìB ‚h..ªÛ¢ßD{Mš°ÿN?BBÜ¢~ˆ‚öIRØB>0F€0`’$Zۤب Q$Iâ–T3b¶ê¾èçäàUÌÖ¥±…·Ïì!è“p4¾“v#â`H-W"ÚÜmæÆ»(^¤] íŸÙî¿äMxñ87BBµh[’cÁè`€âM¢–rTÉjgn¦ÌŒ”C€*÷í‰õ8@Ç0Рñµ›Ä8±Ðë™m>$ ÷³z¦µdJgT4hÐø_7¯¨“ 3¤Aƒ-nhРñOÍwCƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡§€ ´¸¡Aƒ-nhРAƒ74hРŠ4hqCƒ ´¸¡Aƒ-nhРAƒ74hРŠ4hqCƒ ´¸¡AƒÆÿþïJŸè'‹åIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/Wireshark_ack.png0000644000000000000000000040725513051004444022502 00000000000000‰PNG  IHDRçÕÝ?¤sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ,}¤ƒf IDATxÚìýw|TEûÿ_3çœí›Í¦l i$!¡7A¤*v±`D@ô{”&ˆ(EAQnÞ!„šÞÛfÛégæûdž1Y‚÷ýù½õwŸ§>xlvwæÌN}Í5×Ì Jé}CƒŽŽŽŽŽŽŽÎߘuë7² ªªž:::::::W !T–eŸÏO)JRBB€PJ „!D)PJQ € €FB,‹ÉdÂ5ú¸f©BBÁ\5ŠB0ƒŒþŸfÂÍK¥ªJ‹™+|›ª ±ë5RGGGGG§‰A• /IjZZj«Vév{XaaáñãÇy^À¥¬Vë5×t‰‰ñù|§Ne!L€š0z´CbÿähËì+¬úàh¾[àÃÂÂUˆRzËÍ74• MÓª*«€5[,Ž0ûUýš€=eîØm³¦ ¡¿) /k“Ùjbý†â÷û5Îá0ÕëU}¢j4%Nxö®-Ë–©\3Ò5ù­1»æÌ8Äs!D˜ª2ÃgMa¾ýàãÃ%FéõRGGGGGçÏH’¤iÚ 7Ü`6 !€0Â=rSe¨èTR„LF–ªš¤Ì`#ÇPEVUB1Â*fœ‘á,ÕüÍhd1UQ"„ #*KšF)EV{xa±*K²FŒF#]»èèèèèèüÁÐ"IRûöí0¦‚Àk¡”bŒ1FmÚd–W”‹‚h6›ÓÒS^ „×m³,“––ráBƒàµŽN‹§ \PF!T-(‘fîÍÎŽ±û*¥ÆÄI(ÕÂóÃ0O=16Üag†¨ê¿l5¶RPB’ï|æµ¾1¯¯›õÁ‚-ïNõ$ß5nPØ„W¿»ôÃØWç¼Ó:ÊPšýÛó¿è4xäc·v3³èÂÞïÞ[ñcr×ÛÚ„—?5ö­§æÌz¸÷/‹­¼ì”’’½»Ä»îlaCL¿ûï¸9öØÎ_]1©~ß…3:µ=±Š»uüKwwLÂþ ¯¾ôÁ5Ž»§gº'ïàÂ…+ yûc/½Ð7=¼&oçK³˜F¾½t¤\½dμ½¹µ=ÇNÛ=Jõ—|úþûJÃ_›3!-Úš½k €;ß2rü ˜©ß.•©®[ttttttªJi¸3œçZgk©'´ˆ?þbJJ¢$Šµµž‚‚ÂàÈ.B÷î×ÄÆÆœ?ÑÀ 8Í­JÂi7Tx¼F¶T5 Id9YheãŽùšP-š¦5eka&6&ZEMS#"#8–Õ4­ÕBéùí{Ä»îjåâØ -òZµñžúȯիߌ^ˆˆËœôÎS}£×âø(÷ñ?ùéÑÅ ^îüë65E+Ý …ù¾¶­RÕme!U%„ 0²¢ûkø!I­2{ÙÎ Zû¤SF|õÑO%jŠ ­;&]6sþ®üôžCîg{fÔ“}ÇÌ?¢ëK_Çôjg?5á¸"®%€¸òåç•q‹¿¿Ëž7Þ½äõcNçÝ£Ÿtsßý_%º`Ö¸1Y‚õ•Þ÷ÅööLKfÑ “‹]²èèèèèè\>ôGxYVr¤ð‘!·ö©Ý¿3­G÷Èüý¤³iL™Cß{±ó¾íYVŠ¬â@SÜŠBFVðËÐ" âLœæöQñcs>¼9+'—z{?0@‰¿Ìíë|óCN÷Å©›ÙÙ·Þ"&Jß,(DЪaBXlÑ-lŒ­@î‘\ •ÿ¼jcÌÓï.¬:¿æ»{‚O>sºÆÔÅÌ83ßšùTõÑ=l”+gƒùYÌ"@ÑI.âÏ­Hc+b:::::::àó8ŽéÖí†Á!BˆªªŠªz½~ðz½Çhšvúô™ ÉCÓ4EQA Ê2§‰‡ª ïöuÖ¹{“XÄp>EmT¢„Ú#ÃqœËS\Rú΂…Ÿ®þÜl2GDD6îÄŠÆò©cÙi×wÙðÍÆ2Gç5vWQLA1vìÕÅ“d‘jòóKy­¡@ÁòNíçâÝsÿÃ][Ò¿ž GV¾:ú¡a£†ÏÙ Ú¶3•­R[”ÞQ½w­?¡ƒ£â¾júgU•w˜R‹·²('¿èôolj=Õì»øËî3)é]ÃÌL] ˆ³„ÅÚp^Aq_¼\…=ùõ²—ØŸñQ½^êèèèèèüiðG••U’$óŸ÷ôéÓ^¯§É¤ctôàþs©Új/wäp±ï˜Êb)ùzí¶>ñqU}ßú‰þƒzúO;íQÃËK ¡ˆ’Ÿ—çÔ‚s›nˆ¸½KÚÎO—lÊ‘XË2—Ù¢ŽmÞ™ªþòã)È¡§ìUÇ%!ósò}ŠZš›'ù%@¸<û—iË-öë’ x9ÌaêhßíZ;£nXùn¹_-ÌÉ÷(Tq],rKÅGæ|ÞêÁÞý1ñ>~T%7§@Ð(€Vš›Gk*Ö¯ZÛjÌÍÝ"{«d¬\ttttttZ>0.--39ƒÁ I! ”JËJËEÅI’\R\!ŠbÝ-E©¨¨ÐÜÛ”X_¬R Q @ÃÄêZd›YnÆ·Á JiŸë{þWR_·ÄÕ@‚ýùÍÆOÐöÑ TÈøëòåÒ—ÿð„ß?»â“ûûR—GtÇ? Ê„JÀn·9#†x¾²²’¨;¯(%À²8Úm2š4¢Õºk½^@‡[†’[Ì5·[+XDvò‘ky—¡FÖ‚víÞ÷ßT-:::::::ÿkÚ¥îÄÛ ïÏÁm`î6jhhxt- už¼Â(mÜX°k÷>VÏq¿Æ%ùšú®´^<ÑÿÒË`¨&¿¬ŸX¯££££££óÏ ÎÖ¢ªšž:::::::S½Â2ôÆõy=}¸t‡S¿%cÇŽ³‡9êTËí·Ý¬ŸI¢££££££ó7ü°y‹=Ì¡ûµèèèèèèèü3h®jÑ4Íï4çð•Ȳ"¢žéÿQ¥ÿÿþªªú|þÐõPÓÏóÿa]ýküWšÉ¥_ªù|ÿ“_¡£££óOR-„Ð@€¯ûŸç[Üõé&•ÚGÂ4/Ò?ÄàëßOì>hè5vI3wmGU ¢$D<_µ$ËooÕ±÷Ÿtå”RI’¼ âUù SJ%¹YUbÎøß*!BH ÀïÒ M§ûÆÞÞÁþŸ?NEžDIR5ëŸËˆJ6†j 1á×f†CƒäiÅP ÆÈänɆ«-/YVÖYV~ÿÌØ╇;‡ÖÚ„Z‡=|óßk$ ZvkÔöè¸aÍ|´(J¢XÏ Š¢ü¡ÑðñÝ ÛButttÒÈy-Œcæ¿ßW€Úc[î¨j@»b"0€FiðŽhŒ1ÆwªŒã¼ßUÿé_Þ\½K!„jŠM8q1Qa{GÏxíÛ×_.çUŽküؘëŸy׺áõ]•*2·üÉèí_UGDC1€L!„ÏÖÓ4² ¥”²¬ªª Ã4µ;œšb†>1¬WªS Ô~ûÙûóDB!c¼Ž²É±sÞóØðþ™.™¯ÙôÉ‚Ýù¥!†Ò4-x*Ã`‚œO¾üè¢ió5 ¦*˜$BêB5󹪩åüÆ­ÿÜÍ4$PJƒ1BHÓ4 €Æ9\®°|¬(*Ã`Œ±¢üáŽïú,@Á;®}•ù⿆ÆX¸š³[ß^¶ç±™Ó¾ýù¿Ê0XÓH𹀌Móô¼§”¨“9>!äV5Š"(ü©ÉO¯|}º_‡-<.¼@"„h„ †a‚?!˜W&#ẛŸ¿·?æ2I5~Éýé”'E Ã`ÆaFäR=d˜ºßE)Ôe&6$'Åhªª¡º¼m˜Õ„PBê «¾òmMÕÃQÓçvàb£-ååž ‡ZúÕ®úØ‚gWB †Á€8WL$P Ñ4,覲:mðX·/ø6š0¥è‹™‡ùß`CL”QªÔeW¨§£££ó¿kkàó¦O|mÒëÓç¬ÛÃØÂ:·ø½7÷òÌÈ—ßX2oZÏh-Ô:p1ì/vKÓuÈÓK—.}S{ µi Œ%bö»‹ÞÚ§©8Îü°é¾ûÚ!BTj|èñî[Ï–›£[¤G³Õñ¦¹‹Ïœp7K™'_y"\STS«WîH§Z ›¸4HQ`äóãk\òÊäiSf/:Z(I}~ïýE¯<:Piz­ªpÛÏq¿.›ôÚÔ©³*K÷Ç—,]üÖ‹eAQM£^ž±üÃEoL¸—Ód0ƵýðÃÅSoNk{ãO\k€{Ÿzá:'nÏ“K—,š1¢¯¦¡ÌÛÆ,Y²xÜmêíIÒ®ïu?þð⿮ńÂöxôù—.Z2ç•vá0–ñSæ,_2ç¡Þ —¾Ît}bZº}y¶C»¡~¸xù‡‹ç¾:¢;ß2wÑâÿŒI“¶¢ëo¼£`ÅÔW'½>oõN…a±É1sþ¢ÙÃû3ŽäÙ‹/ÿÍþ­Áo>=ýÝyÏ Å¬±C’MQ Ó]ã–°èåÁ逋HzoÉâww2†GµeÀ–Úkö‚…KÞzÎäÆ‘/._º`|ï&ÍB‡¶Oœ=1dÄà ½õú¸çDÞ8Œ ¥ŒHñ¾Ó·µSHX‡DíÂùož~æ•Ÿ³ önùŽ'‰c»’)Ï=»ê„cx¦¹©'fgë4ú¹[zfhOˆè=eâ¬u{UoñŒŸ}òåeÝo¹ ËæLžºìÀŒÅÄBD§;£Mxþ£mù!Å]4ù•Wçü”Íp‹‘HÌø»[}2gú乫j#^g>7þÙW¿8Ê7}Z"%„ ”I5?>ñÙ¯çL|áÝ÷ŽZ—-Ô1zü#K&?ûòÒ£÷=|‡ÑêL(ýúÕI3öiÓïOJ•Ò#³&¿>û't´V}ï¹Ë²òäi…-?Ò;†5…ÅWmž8qÚoë‡bý8­C c¶Å©G~…ЩJIìvë#G¦¼6í\ôÀÑã$œòtî½™Ó>? oŽl‡ƒRƒ±<7ªÏª7^š±t y @Ê5÷>1fÔcFõl®Qãcsæžø|Î3³¾ºëå—­AbÓº´ùxÞŒ™ü4ðéWMšª÷Y:::ÿË4q¢¿TõݺoÌð~!é÷·g½6Ñüp7 Ÿ*"CS“v±üۯ׋ #ú} ×µ<öÓ¦j¹ªÖwÙp ‰¢¤6)}¨â]ñ›Ðµm"¶v9°òKžÖ 8¦kLJƘ§R r—a_VùÝ=Û;%î¬uf¦µnÍ\¤”6zº0˜h*–q^?zhÜñï ÛÙ¶¶²Vqg{âÉžÜÆuJ£MÑ€c@¥Æ¾ê颜3ÖpÂT!2ïõzjNî· ¹ÓŠó€Qµº°ð»¢Äçóû%Ò".Úž6~ü@9Ëb‚êF„ ¥Àµº©¥•Ë蘙›%öj“xv_%PâóùJ*²”{nSŒIÿ{Ö >Œc.=ÁSx ÕË·: ŠÂjÏËDíþ@|Ù¯KNÕà˜¾Ñ)©cŸJ€ÊF¥q;GÖöivësÔW{.žûy}Yã;?óP¯€Hãœ|p<•%QR4Æ ÀúÏnÎê:þ‰~ùf×9üùò¥º¢:jyçòª<€ÑÁáOŒ¸ÿ·Í_/S¯xJ²ÄtMrDŽx\£PQS÷¦-¡cr´mìPSp 4Ñëõ¸Ë=®·q+‘…Z¯×{h_Ô­æDK±mk<>ãoG‹Ÿj›YeDòy½î¼óûº¸å»KﺦM¾ÿšw­hNƒ‰m‘|dË7µ^Óþã×÷lËä¸Êï+­ñ 3'\÷3¯þ0¾øfÿíCG¥Ýõý®SÐô `Iööõ[ à¦Ç ƒ½W¢©Õ½Ãzi¨$»~·RŸÏWY}z_á½q,ÍÓ;-]µüY/TWU ,†à8”b–Êþ‹~-{Ãê½yñ‘AÊŽ©\ãGvÿ²´© Œò…Ûý½â7í)S £ÑÀ*µùקÁ™¬¨è(ÿù“j jÁ!ÂM)柋$bj =ÈùÂØ7,=ïå N‰ ”Ö…ÊÏËÊ!MUTÕËK)Étw6þc̼·˜œzÍ™R À°ºûþn‡^VRIŠJ–÷¬—y÷úúü[ÆàòkÖó>0ùEÐ( †‘=¥? ݇ ‹+Úö¡ÂFõ§eKî6a~+—*Ôþüå‡ó6ÔLžý6Ë¡¬o· sBÏ)³ûY¥¢… ?"Hùuwé»ï¾“»såüÍÿ>Õå_ï.°R½L†ˆKùUxüßßg>þöü8±ìØ[ï¬4öPl0\k=3ûd¡2pF}äúT£F/õºøçŸ^8‚Ó…ßdï>2xðmß]»qɺ¦t™~*}ý3®ˆè‰o½Í›òÞÊ/Îvœ1w+–-˜9¿Tn<Ã;ÝøððÛ¯±pÚ™_¿]W.š¿ÜñÚÔÙ5'X¸eË}¯.ÌQ©d?mÛŠo§M˜~Gá¾™+OPÆÙæ•Wu™pöÏ+½Hü÷Yo¾óvѾ5«.pʹÕÚL›;ß,—¿ùÁÆ(ÛV,Bn¼.¶`ê^>Íø×ÞŠ5){¾[öõžŠ¢øÇû§¿ùɲ­/Ιïd¤­k–l-[æí3ߦ•Ÿùþ/ «eö¯›â‡>¾`~lÞï(¥ÆdÚ b3´â`!’ðëZ…6%vë…8\Ø¿eçƒÏ›_|dóG_a­ø‹ü‡fÍ+—ž˜±ô ÀpªÐôôIÕmïÒÂZynßhr7€ß÷gQü'¯Ï{b¤NöÜÎU|wþ"t¼¯Ç‰1 vj¸Qݹþc~q˜ŽŽÎÿ6úÙ¸ÿdâœöT—9K·iÿ×·"h³9>ãÆA±9«·žþÉcT›Y·É/}z^eþ+ 1Û7 âÿåÓß*ÿŽ-@£†»Þx'kÁó¹ný¦0ÿa±¢Ÿû_ÍMù\ÞßcÐÃƾ÷º»­ÿ»§ÿwò_“|§ %ÿYç°Ç†£³;þž’HIöÉ€¬Ï)ttttt[‹ŽŽŽŽŽŽÎßÞ:Pgk©ók‘dEÏ¿µ| ÚZôŒÐÑÑÑÑÑÑù;ó»­EGGGçŠMóûý‚€f¯(#Œmö0‹ÅÁÛ%½^QšÿDŒ™°p‡ÑhÒ3_GG@?þAGG§yPJ++Ë òÓZe²,['\š:+€ÒàG²,ggè~moMSs.œ—e)1)a´îÆÁ)IN;Ú£goJ‰^:::ºjÑÑÑiª¢”–”tèØÙ`05F—4ºô’Bƒco.Qm4šŽ9”Ѻªª­229ƒ žÁÃìvŒ˜‚üÜĤd½tttQ-¿þúëÅœœ?¿ß±C‡nݺý/dŠ f³ùo’ŸÏï÷û %D# NR FcB‹¡oÖÑù¯@ʲŒ†eY„1Àï–’ú3²ëîwDè’b!”P»Íî®uS œÃ ñÔiž&‚×}€€JiTTô™3•zþÿÿ’OV\á‚ –a}tøÿÓ4BôKÎuš¥Z^xñ¥äädBH}?ìJ,x÷ä‰ã0zÌX–e>Xº´Ñ ®íÙ«´¤Ø¹éûï{÷¾îÓ5UmÛ®ýÔ)¯6¬Ñà›7ož8irý£%I:tð€Ý^w?° Šéé­öü¶;9¹É‰—¦iÛ¶mÓÉt]ïÞõU_UÕíÛ·÷ë×ÏÐÄ ËòÞ½{øçü~ÿÞ½{ Àþé8|¯§6"2êÏ·7˲̽ sêC‰¢h±XŒF y0¥47//**ŠúÕá·Jý'ƒï+ }òºå ÃTTTJ¢”‘Ñêo[ÃöìûíÏÒ¹c—¦ÄVÀïwF(Š¢Œ##cýú¯ƒ¤¾šSB5JÊJËn¸áƦ*?BˆR:|øðW^y‰R ôÇúý>›ÍÞT{©©©¹˜“#ËrrRRll,ÇqÍÏaMÓªªªrrrAjË–QQQW5P¥´´´  3péii¨ÙÇ:ÂñññÁ>*ØQhš|zpð&„|µvM§N. XUUérÅÔw×õ ¾ëîüüüFŸUëõç]p„;Ct’JΗ6®.p‹Ar¤ùžk"Ó¢-V—GÿdÕ2yòd³Ù…TÀ¦½ùÇ•––ÆÅÅùý¾Ði(..þñ§-z¬aºjÕê´hÑ¢y“ºçbíÎl·_!INÓ€6N#‹×¬u}ltØÆ]ƒÁpM×A­Ç1 ãñÔþå*›uúô_|Ù¡Cû¸¸¸ýûĸ\#FøÀb± †ŠŠŠGGŒøìÓO@VdY–CŒµˆr:œQÑ>‡3`gd4-):tèPPmBX–mªR¥¢¢¼E|,¡$**J„}{÷ºbbê…Ž¦iÇ…ÖLž5bÏiÐ$U¯Ÿ°Š¢xøð!JiYYi\\|˔䦺6çB‘‘‘f³™a™R)˜‘ÇEFF"„E ‘“'NœØòóÏf‹ùý%KGzÌb6‹¢ø駟 ’¸úó/nºiP—ÎC—ÅÉ"ÿî ^»Ù”N(PBw^d{Ú¶püœU3¬W¨¢<{î\}µ),,€„„„à(òÅš/†»j sYYÙŸñÒK/ÅÄÆ…Þ°yóæ>üpì˜1Í(¥ÞÚZjµ˜KŠ‹þo Q8‡ª©ªŒŒv…N€{ÚhàAS‰J–Eš`³áò¯¦Ç=2»™‹ºs¢?ï„ÿô“E KŠ$|•¦+O\ »î~&ÕnïØ·™ñ¨î*m"b@©,»ú!š¦QJ†9»q#Õ´ Ú€ òVûØ8Ž£„ k@„M#”ÆøܹsÁPõ’¥^¸´lÙ’eYB5J ™öŠƒV×T¿ø EÅE;wí|ðccbß[¸èÕW^nNðu뿉v¹FŽL)}ôÑG7nüþÛ |àæiæÍ_Я_¿A7 úì³Ïúõí7~üø•+V:|¸G÷îÍ_¡—hhä®qUlünÃÔ³ÇLxÉd`XŒUD¥°Ò·yӆѷt¯×ÛTpŒñ Ï=óê3O,üà³ÁF)%”ÖúÅ/–-¼ýÚÔž={^¡¹QJx¾®¾E£³å~*»ú¯“^T‘™ááágω‹×(eY&hv’ªr”’ßüÞcü…‹Š€QiW•!²ªÍÞx>ÂîÈ­dQT?°f›ÑdrÚ¬³7ž{ã¾6 £[\þ™ª…R3`À€`k ¶%‡ÃA)=xh¤¨Á©@StìÖñåW_þfÝ7C† Y»nõ¡cû¡äRÃeõŠ£>¥t̘1=¯íöïo=wöü–Ÿž6}ÊC{€RGDØzdU ö§I-SB·cì÷yÜn78#œ>o“–‰¬¬¬ÔÔQƒ2 nÝ&ãĉ¬ˆg°ÓpŸ®6UUE@-,дº«dêͼǎ5™Lš¦5Õø–eQöœþ¡Ê],Ê1²*Åß™²}cH2t›>!P„/Ö|S㮉ŒŒZýùê{îº{Ó¦$EöúÜR¥Ñ4‚1æ0êœì”U*«WèL/^¼íŠ æmii)TVVvìؾþúë¿ Z>[µú‘GqŸ€Š04èƧŸ~†çy›ÍÖÉÂFHUU»=ì?i< ËJÑh2r®¢¬Ô¢+×x?k…å½^Ð[8Gùª4ÞÇXìÍyœ1&E­­´F™l.›RQ@5°Ý.©öôžØG¦3&ksGGQÐD‰(ê_²0Õ£!ë#…5>ü0X!„hPÏ ”P„PYYYC¥ÒPý$&&"„¨F % ƒ‡(Ùµ_}=uê”â’’;wíܹ355µ{îkÖ®mŽ{¥tÏžß–¼¿äØñ㊢P£Áxç·?ûÜóÜÿŸ®ªj^^Þ”)SÊËËøasëÖ­¾súôÝ»ukÎ:¥ÔçóU{±Qá•••`6›÷ÍjŸž„1öù|<ÏG8Û_LçsÏÝ9ø†îøÝÆmv›EQ5AV·nÛÖÎYeßsà·hWtèéVË–-Ÿ{ú_>x÷—_o €|¼üÝú5O½±k×®V«µ¹“„K/®o‰Ëþ¢>£qó$Ã0 Æ*Ñròr;vì,ŠBuMu8#©¥ûŸ_¶áh­G@.‡é½³Ÿ»½-ú¿¾KN篨BÈˋ׳ ,Þ_í[†ê _lþ¬¢²œýMEwøðá]9?—(ŠÂ‹Ï¿ûXðn 9.²¦6À2,Å¡ é³Þ|3¸˜2øÎ[«ªÊûõ¹®´´tóæÍ…¥}ùÑ E|JˆZµgÏŒ€RU^îŒ „TWVPB1BÅÅŪª8¡š}eee­§6#=•Rì”Ífs\œ«¸¸!$Ë’Ãö«Ë_Y–eYökõª¥á§Á÷›Z}÷ùüaaars·|<âÆ>>Þ')¸±s§ã9ÿ¶H$I Æß(f³9³Uæ©ì,“ÉXRR㊙6}zFfFEe¥´Ö];°ÿÀ’EÓÈâ­EmÕ~¹¨Æ7²wúè#¯× .—kî;飯*ŠâטEacãŠ1 „P À²\uMªªÍñ­ÁwêÜeܬO–Mðûà@vaV©0ìþ®&ÕÕÕE…Í_Ãûà«… ‚îý2:´IÊ:WL)üºï˜V¶±26jõ÷+ªÝ5²,†V-ÑÑÑ.—kÕ§+:¶n¹ëðÙÏ?]þæÓ¤¥¥aŒ† ÝâDÄä³u¿Ú€ùšƒ«¸ë-BéI¼›–þ†0 .ŒGdÑxp>ÀÇÆÅ:ç/œQjÝEŸâFôçý‡=gÏRÕÓ{¤«÷°«ª·UáB™ÏhF² ñ.Û éc–2±tÉ=¶Ÿ;VìÊ=ªðÔø¥H»~2Ð?ÓÖb3›b"pÉ¥ÿBa¹ÑÀÈq×Å »…´yº‹kžõ¤ªª“^ŒYlµZvíûUðóŒ‚c#¢Î¾kð“á oݦÍæŸ~¡”Æ„;=•Ì¤D^úöíRS!4%­eeyg0Ä'%ÏÎ6šŒ”–å(¥Vk¨)iJrJyE•ÅlaX¶´¤$--ÙnSUâ÷ûƒsÁ«Ý­£išTSÂÿ‘•eÕ) ÐÂçájy1ò©JôÏü¹ €ÇãÉLk—’²pãá™Ý3¬Š`°áÄÅ“áÌÀŒ¸n¹¹¹Áνф!„FŽ±iÓ¦_¶m5[Ìeåe-[”•—Bx^¸ùÆ›î¸ãö‰Ï©£l^ñ Ò«·¥ØMìÇ¿§ÇØ)€(E%v“¡ùYÑ»wïà,í?©¯­Ò[?~<)1±~„öx¼ÕUUÍY¶“$)àó²\ªcY¦ª¼”Â¥jN)¡â›0%z=Q0 S×*(@AÓ4UU&£»¦&2*ªñaÉî´t¾ÉB(¶ØˆÈûKá±ijàÔ!hžj¡’d 7«þ@ÉÎ#-zfIª¾PšLδh­Ö5•¨(QI¤ò_ºGšRrIÖ;glQ©+¨ÁVÔ ö¡”R€†&”P Á¥Ïà€Ýpu)ø:X „Ð0x“v/†ImÙr×ÎcFéСÚ5kß{ïÝÊÊÊÊÊÊæT9–e#œÎƒ¾¿x1Æ"D+ÈÏgÆdºò0f0(¥9sÒÒÒ¬Vk°1^̹˜ÐÌeBiAY5”W×ÚŒ ÔxýŠ¢æ—Tf¦Äÿ…Rª.®º¡ÏíQŽè>o3âá›ïzqǧ±)ö(K¸Ùj»˜“{}Ÿ>¡cðûýªªbŒwîÜùÝw þüˆˆˆÚÚZŒ±Éd íî“ÓñŽ¤KŽº¹Å[ZËÛˆvK›Ä°ìò qFÜ>2îDÓÁ¯éÚÍëõ ¡ ?¿vöò®÷pz¬6ç¹ÈF÷zèjs£¤&à ³UzeŠPn…÷¥UGEUI‰`ý’ZådUQTêrØ*jy]µüSU˸;»ÿý÷Áׄ%¯>[PP°}ûv£ j|J´"ÆS—­^½zñâÅ6›mùˇðñ^Á)‚Å`à}<‚+T‹¼¼¼[n¹é‡ÍÅÅ%ƒ :ôïåê«õFÅÉ8”Æ7™ÌŸÿâù³A>J‰Ûë‹ŠŠ’e@¥Ô|¥Î‹‰+((HNNŽ‹/+¯ŒŽŽÆ€)%Ê_ºªIUU™D¦¥#͇0&DE!ŠJe™È²ƒµ >@«**b£ìO)¥&ÖÞ/mÜγï·NdKÜRê×!~ ¦i‚ „……ùGXXSs¸;ï¼SQÔÝ{vS–ºkÜÁ÷{ö¸ööÛo»ÂÅ/GÚŒ•^©u¬Ùnb`Hw×Þ‹ž ÅÁÐ;=”í*ûÌÙ¶mÛ¿ñæŒo¿ýŽçA(!AÁF™ý朳çγ,“v%ÿ膌=zúŒFƒñú>×›Í朜œõë¿qŸþäòÙX/ìõ²«È2m¸éö’ï@Р¨M–r­»Æn·QBh]àKyˆ‰,óM©„c¶i¼¯ú§OqxŒRËS§ËšXœçÞ÷‹Rš1èAÖæU·3jr; 둬‰‡ˆ(RI‰|ôÿ‰ñ£n½¢¡Ey÷ŽuØæ$¢’¢LUâ9²KÌÍŠô æl–­¡B)Á_7'†*ä’×JУ¥îýŠŒµ”B(B¤N‘P „"B€ƸE‹ —‡`Ø°a:t(--5jTëÖ­_zá9 !Ò+Ò# {û¹,ËöпgÏžÙÙgÖ®]k±XšiótÓ +WJ’Ô³gOÌà#GŽ®X±"3#£9ÁY–íÔ©ÓŠ•+ï2äýÅ‹UMýõ×_—/ÿ¸9«Kuª ãôĘ)OÜ—\Î1¸l”ó¯IÐ1̲¨ø<~>à«©®¶…ÙÊ«ªZ¨œ‰bŸÛ/‡Ë¡m-555<Ï5%¡TÅ’’’`a9Îо‰´pVÞôà„šÂ£®¤ÖKøÚŠ@DÒ•Lz(h¾qàM[Næ¥;vØ~­Ö¤ñGÿ…Üa$j*¤’_© ªõï1é‹#µ¼D!@)°ò_Z3Õù¿W-‡ÊÌ̼ýöÛ·µ\¸¹¨€ÊËËCÄŸûñǧ¦'¯X±Âá;zâð¹ÜìŽ]ÒªUÌ3¡4¯‰ýx í›~øqðàÁ-’7~¿¹²²²J‡ÁšgŠå(-)) 9éá$Iª¬ª1›Œ„’/²Ë°,‘$Œ1Ú°YYYÅr¬Éd*++E1Üa?sö\Zjš¢¨€¡äÏ; ¯h:VeŒŒ áݘÁTQ©$ª‚Ÿð¼æ÷AÀüäˆ^¥QÕ‚1v8A;y¤%±{âÈ­ç%8®éœvKг8&&FÓ4¯ÇÓ”j ®|>r8>>¾´¬4X 1®˜ÓÙÙeeeWr‹YÑ•°¸®ž„[¸[;DQ „ÒঀDFF:Ž@@Ì4ÜtqJLL4§NºªüŒ9rÄúõßlùùgBˆÁ`ÈÏÏ·ÛíçÏŸÏÈȽÖn³Ûª++–¥Áãn‚¦•:ÅB¡3MÎŒáN>à«·µÔùH^òð ”jæ+MëËÖ-µásHˆ+*qœ TU.¯7¿cµq…yy-ŸB|`–‹ø Tþø9xE%*+Ö´öÖ´öÍš|oûÚèÞÅÑD1ï, ¢LU-°î ›Ó˜;ç@ÆÌ›µÀ„ Þ× ÚßÓC#¾´€‰‹ÏJÑ0f. ÞAïþ:[KPµ4ôÆý駟F}òäÉ•+WîÞ½[#`Ì f¸äfddŒzlä†ï6þ²u«¦i,ËúýþÂÂÂï¾7úñQ6›-´€¸åæ›EAüvÆõß|ôSeûŽáNç}CîeY6DpŒñSOŽûð£V­^½båÊàFe–aVþ¹ÁhìÛçz†a®(_BmR[4\ð½ùºN¹ggXöû-LØ*KJAa¾ )'Nk×1©˜Í¼F®Ô‘U‹ÛíÍÞCÇežº¦[YBBBóc´Ç8ãÛ˜,a‰éÜGKJˮܑRJ=O‹®•%þÜ性†2ÎÈ=Ïq©­®ÖûÄÀ OQ( „FZÇZå{rÊ=”¡€Öø–Õ5Á?RµTHEKÖ¼#Uû$QRU (-®t·iˆM,øˆÉʇˆqø3䟹PS›Û¥G ¥ ¨U‘6ÀÔéB¢\l4±Ùg²C÷z½gÎœ€·ß~›Rzá·Û-o׌$Uªdؘ‹!EÁh°Q«j2jalvŽãXQ9Ž ΰC©F“QUMS ¥¡¢â’§Óç÷!„0ƒƒNÅWkkQ%J5ŸRV@4‘*"‘Mð^AD‚ˆy ó²â¡Š†à4‚¤­Ök’¢—° g2šX–u»Ý6›-x<Þ¦<¤EQœ7¾Ùb.** ª¨à–é°°°Åï¿ÿÚäÉ!Öì¶ÌPTzº”¿£ËïïË*)¬–â# C¨õ²àDÍ]ë|¾ËÕÃø|>Y–Uåª-X½zöìÞ­›ªªÁ¡EÅÑcƾ5çí‘#Fôïß/T×i2‡GDUW–3,TUMHNùÚ]H§–0‡Ãþ'iÈûýîê*–c)¥áȨè+Œ%6§t®Âl­nyËu$' 5¡U¸ÊR•Äµ‰lö AB¢ÒUL ±Ù.+ÅUe)7õ$yYHV2£ HQÜ*Õ®ÙÑ  @(µB×ï^n°ÿ™Ããà~!ôûÙq(hn Ž‹ÁMpøAñ·~ýú¢¢¢˜˜˜ãÇ¢!„Q³]=ÚµkÇ󼢨Ã0ûöí[¶üãâââ—_z1"""´z¸í¶[ûõë+Šb}ðÕŸ¾víÚìììžÎf³…^ 9b„ßï—$IU5Œ!ä™3?ú補‹yäƒÁZUÿ…B!°8¬D‘„ªrI’TMXüÖkm»µ4™ „sûÕl5äçä‡V-@ ¶¶6¨&vMå¸Ì (8• ­|~×þ£u}àõÙþš|ƒ\*Kå@ˆÝá$Å%¯<°ß×j@h(øESxAŠÅ™ÊùÂòX73gJâ¤7¹”ԫʸ[yY1£iu­ütQíé¢Zå’w9Ë êòòGg]üSWˆ:%%W9MQ¨&«oŠ²ÅÆGz9ÝÕ‘“sM±ì²å§¥¥0 1ˤ’ìŒà-• ƒß[mR¤ä„¨jŸì²%†±â L Þ}oРÛ·k¤¯ì{÷5‹æMÂœ‘á8ÌŠJ Dë7°#6Ú ª-Ò¥¤™³Þ;ftð0ƒË­èF“¦†aƒ&kI–B,˲,+‰ÆŒ¢(999-[¶l¤ÕQ°Y­‹ú@ˆ€@LüÔ4höä•RgœùïÝ’Úø¤ù¶N™„!”Šð%Ç—àÌw>———_¶‡hܸq™™™GŽÉÊÊêÝ»7!#¨BH°QÛŽ(Éšªµoß~ì˜1«V¯~÷½÷FŽ‘žžÞT©ª*Ë2!„R D“d™häî»î¶Ùì?ÿüóûK–Žxtx|||£Á)¥ÁàAå¡i*/ȔЗ^|iÕêU¿lÝ&JòðG†………]ñTÉÿVÏN4-3&ÖmujMm™, ¾Þçtû夸6¬T˜¡-ýàÃŽ:\vh}mw¹\F£ñ2+Z0ýÑÑÑ¡X›A)öBÉç¶ìÙÿ~×Ì{"b“à­Î×Ò»ôì¾ûP(;kMMuMmm€÷!@½¯»®»þ‡g4ë¾_K‡39rèXkŸÍÏ —ÓÖ%É~¼" Q!Œ˜ÎËêêÝy(¥«ZÔðÈ0‹® þ‘ªE‘Õs¹¹¼ÏϱlÛE&E¨„° ‹óó r]Q®ÒÒRch¬ÚH¢R’[(Š’3Üê®õ³,㌠÷ -(Êjee ¨¨¨€ÆT‹Éjà‰¦ð^g¸5ðÆ'DÙ£l€€hr~ÁEBH~Añ5ÝzøýÆD ˆ’Äóàù’”‚Ñh`Y–PªiÏóf³Ùï÷ןöÖ˜ºy'—¶H˜L&–e5M“…çy‹ÕÂ{ù°°«Ø.«ªª*ø±×Í”×7`¡ ªH%HV¤bIAŠªøp£aÏž=+I¥Ôn·[­V£ÑXç¥Hˆ¦Õð/Ëruuuïë®kttOKM=rôBHSµ &tìÐ!³uëyóækTóËþ6mÚXš¶µ˜ ̨>ñ_î¯ð ªÓÊýt²vÓ w˜…eÆÆaÊEéâÅ‹v»Ýqé\ãËzäóçÏsø?¯Äaaa ß{wÊ”©›üÉç÷?ôàƒME‹²Úì’(ù} àq»›¯Z) E ® ÄÄ'$6g/(bؘûÆU0FïîÏ Tâ ôy4~蓨Ù'üRB/"Añ*l-þ3Ç(Á^1‚–F9U4?•¼-:©µgßvG¯˜½òVT·ÀG‚®È·ÅX!ØBÉNKŽ»ŒRJ(A”4<³ŸPÜù\ZZzÙÖ¡‰'~öÙg¥¥¥kÖ¬Ù´i¥”A” æÚRo¶Á Ã2,Æ#Ü­{7†aÖ¬]»bå§?üPÇšª—ÂÖ§ e0sçwÆmÛ¶­üô³aC‡¦¤$‡Ž0ÞZ@² óÄر«?ÿbß¾½š¦:4ª ·§ÿ:Š¬œËÍü¼Õj¬ªò!„"œ’¬1 ‹óò mV{­Ûû¬Ñ讹æšU>ÍìRSë‹‹+w{ 6ÙJ/ûD.8Ž=ºmë/ŸÞ`§¢ÊZ›‰e•—äØ{iç·Çl‹Š!Õhðë®».ëtVxx¸¢¨c¬ªªÑh”d©¦ÚòûýN§³©Ûú÷ïîü9›Õªª †àz Ô¸Ý@Áï󧧧7º‹aÜèéq@4 ˆÄnaLJw™¸¦eR%;;ëÔ©Ó³fÍš4iÒeŸ¦§§xÿ²?jt¸ÚI'˲3g¾1múŒŸ~Ú2pÀ€Æ0„Pdt4Ã0µžÚä”–ÿ‘Þj5Lš¦Å6½á¹Ñª3äñj§«zõ›@¨ù—¢o»ÿªž‹M¥†7 qW±!˽jflzTx{'hõÌ D¨³MÛŒ¡ðçšsä” SbJs*6%”µÛíÛ·ooÙ²eÐÚwÙÙ¸àóù~ûí·ûî½›ŠQ݈4œÒؘ˜ýû÷'$$Ô¯—;/¿üòÈ‘#€!aŒèe%Ø”d1™L!†ašªiuX–0`€Ëýî{ .\¸|Ù²Æï&œeY“Ѩª`Œ†yðÂìöuë×#“&Nl´R_BÇ©F£¦‘`p–e'ŒÿײeË÷ìÙ›–šzÇw45½Ù¾};Ã0Ç{˜'þ°É&++k@c  ¸±ž!Ô!½‹;p!à’¢ÖJ·Ãb”‰ÆKrI^©»B•%õâùœu_}Õhbn½õ–N»„®N&“qÿ¾}ÿ{gÅñ6ðgåü.rq#B HÐ@p-´H¡¸»»—âÅ¡@qwww‡àqw¿ÈùÎÌûÇ&!h¡?J)ï~?|ÂÝÞÊìì̳Ï<óÌó|Ü6Éÿ32––îMòäeÒKD,ëWÖ’¦à#]F"‘ªÕê{wÔkXô¸±¨Åªi»ÚŒŒ Šö­ï›~ã–û;ZˇDÇq&£an·:S¶\H5‹)F|òn/d)dT‹Í³z77ô -rº}ûP„¼wæ&LéáéáàWÚíQX\w§çщVJÙÅëÏvn9 +U~þ,ð#'ݱe²–3û—q¿ãlma0›3rò½sóò£¨èèjÕªgef|èØç/Ÿq™·‚£½m24áÖ¡q©Ûv]ðìä©SëÖ­?wö̇‹•K¥Z–aX†¦&“…J•“›k0Ë•+⬧çßUÏííì0BfŽS(Z­V©Tæåå)J‡ÀÀÀi-âÊÑÃÊusÄœŠ»ñ¾Ó¯µ~(½hӻϠÁC333Y–åÃf®Ô EQ4ywŒ%‹”+WîC6óü|mVv–T")r%¦(Ê`4ZZXXXXH¥Ò¿ì¨y¦½)¯’tÀM-iäcUÍÓâ#sC¼Ê•››{ùÊåS§O½w±H4ó·YNNN_0‹ÉdÊÖhìlmÿ™‰ÌÙ™@ˆHýÙƒodÐÇ­˜¡ ¼ã6~±eõzŸxTÌ’‰š+'øFæ#½ñÁò‰ØÃÇgÍAV©ú«ê5=ôô*I0`‚ãbã0/÷^' *°£Ð ‘ˆišf6$äeÅÊUããbmmm1"H\l&ðÁí¬,-­,iŠf6#3Ý«ä'%Û*O¶¸FF*•~<øJÑá|g)~xff¦……ÅÇWü¾{8ß !jµúC ¡£££ÿòÖœ%’ÏH\5gÞ[;Ëšå<ｊòq±JNgæܥLJö]A•)[.<,ôŸhØ„«×¯¿ä¿>“nc ³ü„ßè)±À²Ì€öµÚ4ªôÞÏýùùù^ž%]]]‹/ÌÏψ:4j®‡JÒqërÅ'‡ý$„˜L&ƒÁ›—ÿ"*içÅGIàãj×û§êe=œ,” ™L&‰sË7ŽÊÂòýZKxxøÍ[·ÞÚX±bÅêÕª@RRŸ[çC\½z-:æíNزE GGGÞôãa—vìØÉ¡·Mß¼}%44Ô§0½Å‡ˆ‹{O,&~ð™™ù‘é¡¿<<##ãoxM&ÓG\€)Š‹Å’ef³Y§Ó}ÜðÀgüËN[˜)Šdqñÿ|F>¢ †â`FÈæúŸÃd2¾|þÌÝÓŒù A¤@‘&s8xŸ0~4ïžËÐtxxh…J•bcÕ¶6˜÷æ-š3|÷pšWÏ)š¢€¢šÎÖdyzy à³xþüùÃGÞÚXÿ†¯oyŒqVVÖW›®úl…Þlæ8Ž·<—Q¼ò1þÜÌ*oI¢$ _S ü³Z‹€€€ÀÛï“)4$ØÙÅø´†P$û‹ #Î 4EE!³Y“íîéekgG õµå‡üBQ½žaG'gáZ‹0Þø$X‘ÈÁÑ1!.ž3s¿¶•¼žá§, þ €`b2SSSÊ”¯ –HÄizZ.ˆŽKà=‡CÑá#l4²³2œ]…ú€ùµ¼3Ç™M¦Ï1%‘HŠ&yòO?œ¦(‰T*ð@eaÉ µ ðéˆXVÄþ}¹!‹?îÐ* 𱑌Pÿ ^™øµ_ðÔ‚o¶Àšâ«®¾MøøôÅ}‘~ñ{ÿÉÒ>¦µBÒÓÓ“’’í¾ˆžÊHO/Uª”\!×kµ1Ñ‘z½N¨n ¥R¥Ói?a7‹î©”ã¸WÁÁ–Ÿ!ãkjTééi®®®6jµÑh|lggϲÿÓ„¯&;[*“z¸»#„^¾|eemýE¦r8ŽËÊÌ,_¾òÂF@@àñ޸ǽ|åééÉ'¥{k‰ü'§ÞŠKHQTLL´oùr‘áá^Þ¥ %BKà_âúå M›·*jÓU®•ÏHT¸]£É yå[±rl\ÆÄÒÒòÝS}Ù,wŸn®x«±,åë[þÙ³çîü¯o 9>RÔw' ÃÄÇÅ•-[&""R¡TîõY÷þnQFcfFº¯¯¯`yø_xíËË;>ûEQÅÑ}¢Œ..1ù£†ÉÌÌ z[;{¡ºþEø„A|K-þÞ.Z»[Ô%Jù”1™MšlM©Ò¥µZí7Rþwû!ÄÌqãÔ´4O//Žã>·ç³è„VÖÖãôôtgƒÁðEŠ r¹üejª¯¯¯ÐþG^k-E³ãÅeßß¾…@„Zø÷¡¨â¦ª(ø:ßP‹½qe2…Á 'ðF4á×~~Ž¤Âîo†®ç‹Z¤||nQß>!¢˜ôÿã½ógæS™ |1­x•…Uü_B †Ç7ThÐ úì®ô2k— ÖVÉP%ªxW\Aiøf” s6'ïü-f$ @½‘áï©ŸB~JøT»+YQŸy/|ÿ*ŠM^Ôs‹¾Ò4ÍR9»O„wjåG €a„Pq5ÞIèóñ{g(ݹ½§èÚ‰ysôRTNa†H@@àKj-<©Wvox˜åd# štî-“+(]NŽÎ„téÁ;ƒ=F5x#¤nñ„ÅÓÖ¿¶É |ZKAzþ¥Îûµ¼a€!y=eTðæ¦)ãÅ ²¬\E©Fëy~Áh¬X¢IÂÔ‡µûõ¯¢ÑEQÏ%˜K 8wã¹Q2µ[ïN5sóô!ò)jÅÕ À¸àÞy&øÊîáŽ7‘ÐYÉ\Ž&aL•—‚(ø’ZKñ"¤¤ûî]!Ñž|ô°DåŠÁa’yiÙœkt㡳ý%Ñ{·îN4[ÿܽOeG´wã†ÐTƒ÷±ÜÉ%î]&Uv•®ÆŒ-ß‚ÖBóš‚€`ƒÑ…I´E"EѤÀ§¨×ö ¥Wß!}%Q<;·5¦t×fŽY»÷?ì> MôÑuûž$R2»Ÿ:õ©â*Í~y}ûé»FÖvø¨AÆÈ[{Ž_7[•Ч$óŶ½'³8U¿cÔº;¦sªnCÆØkânG*ª¹SšÈ»Ÿ×*¼zöîâfÏŽm=ñ"•’ÛµîÑÏ×^T|ʵx¾·"_TSzø²í§/˜lI›$‰QO€p‘üĽÛvÅ-îÞ¯¢#{lËŠ $sÙF]Ú×õÔßÜ~ò¦¶9n„¿uBBeN}–(þIþ8^S×Â5eFlØzP£Ç%kýܱI«=°~ÃË”|k¿Þš«eˆPX»jÕù^#Û)rbç¬}ýúÕFB¤pžßºá° lY*çØê?öŸèHÅlÜ{ºrÿ†–õ'¬*IðàqH&G±,KY%ðÍPà±0qÜÉS§sssù_zõìY¸l¸p ƒ@Aw 1É‹\·bEHµ;Ö¬ûÓýÕ«Èé í†mnrdl§ÁSKªònÚê9hpV\\éfÃ[TP‰pÂö`zèÝmú`'4›E0Å%¸<`ÂL¹9~Ý‘ûý»úe$ç 7ÅÆøró™Ke»þT¤µðEãç^ùù|ã‹šeßr€È˜£ÅX§ÓID—{zëÞúNp¡c6ì>^¾û¶ýǵCù'7îÐT’çõãÈ6U-€Â¿v‹áO)÷®IË6­Z2iÓ£Ô>õ y9ú²ý§6WGÜ9³ï¦K¿†¢l¥ÿä©5Íi/7Ÿ ÙÁŒí&ŽHã¼ )êzùY'¡ù |Y­åµ_ ÆÄ£J‹öõ\)Z,Áz(ry!cB1"3g¦LáÙööU >•J#Œi‘clÒk)‘„Æ&Rdä•À7MÑc„ALQÔmÞ²•¦éÎ:Çq@Q4U:§c„AîÖ­OWÁ¬XbàŒ?ú‰×ܳkbÅ`læ3#Æ¢’+Î! &(BHªÉH¹yÕ ž¥-+y4ºqëÈ>¤lüC£2U¦Ü8²“ÕkØX‰1``´ `ëÈ"“™±“åÜÔBuBј‘•ƒØ† ¡ çtx[ ¿@¯@©"¯gˆ(–5éL¢)~7šbÊ Ï2°w®¼b(ŸÊe@½÷ÔµE²P„Å°‡hš`Š*~BBÆÜ—‰æO/¥éÒE'ûQaL‹dƒ»‹ÍÅ;á—¥X1&D¬rân›À·g5®é|>8ÂFÖÔ¯!Fa†H@@à k-P¸bcL€0"9`d4ƒ™ÿ‰¢ÀhÐQV¬!5Y«uÄ•§…Ƚ\UkF9#D”™œ$³sSÉØk³PÇß1d*ò‘Ëå={ôÈÌÌ°³³å]1h`ø<¯æ`4Ç™ f3LT~ô¡P×^þ9·E5¯æ„äåiµ”öU24”A »’ÒC.ÓøV«¡b -b9£u㿤__œXÙßMÕ Yëì€íO"SjXBT%Hƽô¼2 S‚Á²„” þú@¦¼älâl+ÉLÉT;9ê2S°ÂA­†aŠ¯÷Á[Ú–4ïÜåÝÝQÉ"³™QÓؤ3QJ/KQ‰²~žj‘4ç„Ò§fÃrÖ±¡V·‘7ÀÅÖUÁÄ·~µÈG÷Xkò9§Wþ±þa’¬ëèA®_²tÕ•çéENŽ@LÇ÷Dgsod®ø÷ÕÀñC‚ÿÏÊÒÂËË“`D*ø•àâkˆxòBV-\¸lÙ²eëNܾó¨í ÎÞ ;£‰&Š`róèÆåëÚÿØO†M„8Çæ™m:׵߷fé’›âó¸˜G'çÍ›¿#Ô¡¼‡CÊ‹óóçÏß(¯XÖƒBò–{\¿|ÍÁÇmÛÔ¥Ífþº„` A‰'nÆ°ŒþÊÉ3Fš ¹uöq¬þuÿâVî8ov·‡Ç·®XñÇîÓ·µØª$r9„é2fèÓãë—,]uåY:vm‹ŸY°`Y€Á’¥ è¯—û}öŒO–aVT¥yÈ°D@}yíÊ·s]º5t&LéÏw­[±å\dŸ6‘‰­ZAµëŽ.ß(¯àH'XÔ œé &(ˆ«×ë=~âììÌqo|.Š8'‘H MÓ"‘Èh4ŠÅbŠ¢8ŽCI$þ3ÆX,FBˆT*EQ%‰ž?Þ´Iã°àúšu-ð/rýÊÅ*~ÕÍ&S‘“8!Å×ÑÐ4MQ¬X„zò䩳³‹^¯'„ˆÅââÁKøv.‘H€˜î­[äÜmª»Ã÷±XL1›ÍÀ0 ï+c6›†)êV"‘¨è3˲,Ëõ/0 •JF#EQ|·‰D&“I*• ‰DÂk,ËÆÆÆúW¯vþÂE???Sá­±,Ë;êò×â PÔU9Žã @)Ú!DÓ4˲:ÎËÓãî½{>>e ]>^6Ã0"‘HõpkDé1?Z„Ìf³T¤Ýv,ªW‡êT¡Ä‰D,Cge¦>¾qÛ£E7VÇ0ŒD"yöìY«Ÿ[ò¾87bã‡xéS´"cÌËS“ÉTô¿(Š2 üê£ÑÈgJ+²7 üûê9¿â¦0DK¡%±À ÛiB€¢Ì&3Ã0@^ïd0Š‡-á·FšÂžþõ•â½!T”ŽcÌ«2¼Qô™W#Š÷¯âŽ¿4E>€õ[I‹\hù¿f³¹hmsÑ…ŠŸÜl6ó-®`A1kkѽóú¯Û!„0Æ2+§Z¥-ŒCaì[iU_w“ÑXäyƒ¢I~Ø«×ZÍe$R‰V«å%Å—ð¼Ù#ÛÊuøÿ\É?Ô¿x³ P”R¡à­›o…ü/ºë÷žð­íüW£Á%—Ëõz=¯Ê¼uï ´¯¦âŠî׌˜r%Åo¯VÝâue4-T*¡ |aÎÏ!„‚ƒC2³²\\\Þµâ~ŠÖòÇÅÅÅ•ññqvvÒët!ÁAz^Èž(ð¯©ç¬H*•ý¥† Tª¼¼KÓ4•››p?ÀÍ­?%úY=âŸÐZÞ!”àìääí]255íUð«%Üß›óùCZË»ÓÒÒÀ¿zµœÜÜÇ»¹•‰DŸuïï=³ÉdŠ÷«ZÕÊÊR˜!ø_PYXh-`6›SÓÒ²²²áKøÍÑ4mkgkgkûzÄ&ZþEù¤X,`‰V«MHH,šdù¶F4¥V«ííìE"!”™••––^eär(•*N—•™akgÿZk!˜`ôõb*|Ík Á˜Ï#%TÅ'W™ÐJÿ3Õ%<)ï “ÉäàèÌ«,|¹\n4è ÆH…2ð׈ó½„qÿWëä«>âïâ-,T×ç¶1ò/>,Až|GÃlbieF£ñÎÝ»õëÕcYV"‘¼¡µŒÑ×*Ÿæ)ƒ2¼ß¦K ‰0CýÅ«œ Bð×{ÄßE¿ù;ÕE¸”ä gG ìæ‰PY­VÕí?²sZrš³3}ÿücT©}-§ÿ¬{Æg }nz²r¶}Ö^û©SÏ:¶o(Lï•'E¿SvmÜ›.r>¸½L-ÿhšÖëõ÷ïÆ{þÕ«¿í[l†(æè™ †Ni\Æ–2GÎZóxú˜N_:ð'ÁBLùš­[·e§ÅFeKÊz;Õø¥½»»3%Lcüã`LŠ±.=dùʽ¬…ŠQ8Ö]%Èñ÷ëyEóº?'NÔ9•¤’X—hݾ»•øCGQ(uÛÆCãfŒXع8‹¥™¼ PúŽ5ÛFÍ™"PÚ8¹b9Áø¿k1àïTv{è’sþ¾¶F½Ù»Vëv Ê|È<èâ¡[ꎣØ|V4jµ:3z«Vyy€-–ÙtîO•‹kŠÜÓ?§ªªÿ©Œ“X-ÿd2YãF 2Ñë¸7µ–×C%¬ôƾM¥'Žweù4°Èœ¶úÍqZ¶nûÁík¹ÿï QÁcV®2jLæ½Ý>u7ì@‹ܯTÍçñÖßw>Ë¢DJÿ*®O‡ˆ\ªOÕ݆åœÚ~øú ©K•‰cz+YáeûyaþQ@ZØEöÇÁ“ê;Ó…2åÄn]»1(ÍT±ùÀ^MJ‡žß~^Úz|#õþå³m»L’Ÿ]¼ÿy–m•Ÿ§õ¨u{ÿÚœj´ß±æíƒN>Œ¶.Ý`Üàv²ïqeRñ¤îÃÆŽQÄ\Ù¼qëñ¹cÚsšèÍë6‡¤sþGu®®8´f彘<ïÖãGÕ}Ü“_Gvm7þ§´Û·-*8æý>}Aª)œ*NПŽ¼0oãy¨úü:ÙÏ’C~=Ú¹å°_Ì®"k?OÙó »÷œHÙøŒ=ÐMÉZ<çF¢ž«ûŒçW⛊ϯQD'rk>rt&ï帻~®5~ÝÜyä×kv÷R›VoÍÄUZèÞ¸!äéž™£2#g/a#.¯ß}F/vè1tx5w+}Ú«Õ«·Æk¥íÆÏ®+þóM1ùt­¶ƒ:Õñä“$½e×Á|~l@„!8=äæœU0]«¶Ó«Qlœö|ÄÚ»Þµæo}ÿІ£‘–^5Gíª 2D@à=¾gWÌÖR0! *5¤»×ìÙ›–üö!f͆)óNû³‚iç¬ùÉ:ÉÙÿ]Àñ—+øŽã(Œ&(5"ºÛè?Êá§SÖ/Z´äþ®'Ÿdu-zFWaÎâÞ±û6<×­,žègT8ÁEuîP¾uîÔ¹óž5èÑí7 8¸|¥K»©}}ÄǦ ô^%%J% „KO=}™»ZÿôäqhµpqI–¡ÓB/^Tµš¿¸ÄãÓ›v‡ú—z^±ÀqˆR¢NSæü=§?¸teÙ~sû;äÍ:§ŽÍÏ!l…¥KZÍ”,u«´pÊpż< „lÖç9ÿ¼dxý¨[›v‡è‡–k2wa]ê³™'C*p;ø,œ9^DÑaço Dû|°åo‹–™’žÌX{{ù¯U3ô —Ï£“.,¿|³JŸæß°’W µ`LszmNØÍ»f©EtuMo!¦ñÞß–•ê>k`Iöð´q¯|þ •ºLQOM›bçŸ ¼p¹Üœ8wÙñ2“~Ù:ç–Ó——V‹)Z¿qÔ¼:W w4ï™5'Îw!EQÞÕZ0BÑi²ÿÑKººØ¸ðrb=0püÜŠ®òŒðˇóë.X2,)àäÜ-ϬÈz‹€À·Š&;;",Ød2Iåò2eËSoi-cÄq@G(KTÛô宫a˜§Ï Ë—·¶P´¨¼›bàìÿç—â¸"¹C&#Ž£ G€`Ž#4P2 %õ€‰­J’£7e„h“ðÅs©V~.4Ââ}–ÖÂ' æ8 ¥³W,Iˆ 9µá÷Š=ÇEçBsG  ˆeËW¹¹.„`3BG€„€Ï¾‡QnfB¹ê- !mV”)!ç¹—À¸úª¨ïòYðm²°GÌ!ë5F†%fcLžÉðàJŽœ®Ýñg¥sÃV>—V/_âX»{ÇjM€ Ì[Í!*—tñÊÞÍÏ´6® ­.Ï#ð;L.ý•ÚËG„Q9âÄSZ®2P4…±ÔÖë‚¿éz&€Çë»(íÑ©3Ö¶¾&T¢q&E³!Ę™CW±WEü*¨bó´ÖS@a„ˆ&†³²•±JÉÖi"õŠ 1½&4OÖÌJJÑb_/qªÎ ˜@¡°z-OG0æ‚1Bcšf+…2%Ϭâ'Çé2£½«Tg ±u°Ó|aäÊ .tß&q1Ñ4Ë”¯TE,åååÆDGÊå W·â¶Œ æ8âV³#^8=Ųf•5\ÍA!±¬½þnÝEIáA:•‡§]µã—6m]\\Ö®ùó3´ôÚÕa#„ !D „opFˆB0fm+acp¹ªþJ†(­(„ÇÒÏ6nñ•fÊKÎ4Jev®j&TCWv¿ q*+=ý ¿v]¥ež"%àQF%?Ñl Ÿ ¢¬ì=žž½öS—Ê–QØ–ÉÏÓV¨VC Ä—‚`RÔ#2i4ÙZ½æáé£N•›Ò„©à(ÏW{Ö¨ìh2²r¢w*_§‡§Û„EÇšUé"1å$edKY&˜`¾c„"@ŠHõëÑÅbožÿ% IDAT0q˜•ambF¶Œ•"‚ A”m•ì—÷bª8šâ©ÊùI Çw„0òm·y‚"„ „‡š­®F@æÁ! DU]ÙÏÃl½™óOô~QQvltviG…ÂK™ó 4)ÃR–£t·[T°Ñ…ÆVtQ°RyM7-u2Ý'í$t: ù9Ù©ÞRÊ1ÆÖD0QBDx¥]i_&ôø­$Çj AÁUëÓX"ßæ ˆäææøù×@#„$"±«›{DhðZ ƘêOQH*•`Žã€0¦Ïâ ‰»Ì^¸~Ñ‚3ÙÒ6ƒ&XÒènÀåd÷ŽnÖ"þØ#‡Áçä âŠ$aDR ËqCD&A³2E!Œ)…L‚G³ Xê=¸VØÚ…³L²gŒVS‚_Ýç· L-èRC7l>•e J×i=Ä‹• ›t`í²Ù§ôMû-*m+bí~hôçì™'ej?9èd BÇ]éúcw.™{ÌÊ·ÙäÞ‡–?°bþLʺÜäÉTä;þ˜ö 6é÷3X•ÃÏ]ú ,ïÈq\«±S÷þ¹lÆ‹÷±MÍ«–Ô iÛ‘SÅDÒ¤q‰E³g{6ñ“H*ecJ.!Ž£(VÆ@—¶õÿX5k¯ < EHþc ßųgº5ÔÆZ"Á”¸ l`µfñƵæÄa•i$Râ8„)™Dü-§Ý 8Ž#„šVÊhÎlæ dRâ8ªÅØi{V-}Œk6`ž§ÃÔj`½|ÕŒ{ÒS§öêÖpåŠ9¹ŠR#G ¢0ôœñÛÚ%‹gP?˜ÞqæÂM‹œËµ8ÅF„ÕukžÙykÔ·øÕ9aŒ#Q04¦(‘\L!ŽcÅ1"™’ÌqœÜ±Êàò—ÍŸãP¥åÄžžØl„ˆ€À·Iß …²#B0BvöŽü–‚쉚ìlºpYÍ0*EÑÍEøHº˜ „¢é¢Ô¸ƒ¬¬L;;û¢#EÑÅOŠ\š¦L0ðWçãÐŒ)ŠŸ®a)Àçb6›,,­õ:íë/HoL€¢iªðá~¥øß)úõˆ´xý÷ÏaÌ&@ i( )ª¢¢J#@HAU𽃢(Š"¯_焦iŒ¿RÔÑŠª‘ß™z_ÅtFŠ¢©ozu]NŽÆÊÊšÜ>]Ü[öµ+ÿ ­Eàá¾…Ûæ‘ÞÖò¯Üâ8aÊX@ໂ¢(Àò&o{ãb‚hšùz¢ˆà÷U[&h¡Î?Œ¿nøC€‚-…!BÛø¾d "©B×#¢­%6*òk†ÄÎHOŠ€À÷DZJò¿uiAž|°"ÑÛã¡wT“­ÅRí/«…*øWÈÏ ,ú\07ôÚ‚ûfDÿüü¢-ß=„Ëy~îòU ·Æ ü+}Ëå º»ûe"פm_6æÊ¥ãùlùV-›¾Ô”púW·ÇäZ5kÛÕòoÍêr¢o&H›–wzo'À†äë¤sÞ¿´ùYJmʽó·î{Vn[µ”Ç?qÛØvãÒÞ4“g붿ÈhbHpöÆ]·ò­ª—õþÜ3ݽ}µjí&RZhó€*Ëv°’°oµžˆËë¬j ±UŠpÞ­§uüª|Á:ˈ½s%àgÍ®þî‹ tq—_jËV/ëòîÎœ6ñÄÝŒ_šTúÌèß8ýÅ^äÞÞÑB¿)ð†*fW)øHŠæŠ ø ò ?;;ªW‹W¼óòÔžXÑ¢[§Ò vzÇº:¿GGïS¦¥é8lHÝ1ÿk'ŸMgo ¦Œkãú—ë=¸mP†‘¾{`x÷N¥F/X‘oÂ\~Ī U»v*sìa0’º¯·ÒýFˆÌ1 ¢¨Þï-i͹µ¨Q¹ì›ÛI^Ôáq|{ô¬²3 vsIŽ¥Nžœ¢û¨C%¿|RÍNK]ôG®Å=Ø4°WÉN]*¸ˆdEÔݧï¨>áÓ[ÇécT¦u§æùÂ=:1¶{WŸÞCÛ½HÎãåðæ á?4ë`Å„˜`ªÞ¬qÝw¥¹6õѪû’›µVý]GCVȇqš"½¹þxšoËfÅ4Ö_ZÜųz_lLÛõ[n|ÖŸºJ°áÚ¦n=»yõÞñEºþ£³­$þÎÔmfìÜÿÞŸïoß_¶Eó¦®þÞʱR‡ŠÞè…cªvïê3ký›lïÙ«›W¯Á­$k?p9|þì!9±'†öôé3¢Gh¶‰tys÷îJO]½Å„Hè…9ýzzwéQã\PÜ™!Î|u¬KgÆMlº –G“ÖÎnÔ¥s™i«¶$œúé籓ŒÄüp¹{§‡BNŒmÚ²D×.îÓÖnÑ¢7.N0÷äØØ>ݽNaþäÔL±“u©1“k»{N0½»ƒÙ˽gÜüòÐää¼Âý‰æÌÍ[_v²ÜÖ½N«z–÷Âã^?s¾Îøþ>E°97ßÀ“ûµkšúÑuäÏ®OtÅz¡AcÆBâkïéUU¸`“zCù Z Uî‡ùK§wy÷…’›rý°©ç–ÝÝãWGß’$1ûO=]»çåøò7Oßzóh÷eçåÛw?Ⱥ±<Á¨ÝýkË6“®/ÚtþïrÆà/,6ì~Ö]µ) :éÉÉ…i5¶îÜ}÷ò¶EéÆôÝK~ûmÍÓÙ­›vÚÉß;ªÄïw6Ïk¸hÃ> èùñ1Ý;¸ÎÜ° ÎnYXmØ¥Í+¶\2'Ç»÷ȵ{‚&U~|üJbÎÊÎ.ZªaÔfæêôŒÃ ß.íÞõø—üy"“\ªô\½ùÕî—oÜkÎÜ=ì„?Îkç°n3ÿ’ær²3y-qm9sæJ‹¡süâ«-»‚w¿r-+üt‡ö¾/î­Ø·y¤Á|cn•ñ;ÜÞÙ~À˜ßôP~vª™ˆ½¾¤ûÐ6Éw&õë×9Ѧ¼©ƒJwÔ6(Ë`Ú8»~»¶žs·ä0ѼÚ;²oɫ߉Iç_ ºì$½™/ 1§žÒÃ}Áî#ou›‡k[Z±ìÕ±=ŒÉ5g­ìµ.0iÖ˜ª;/Þ‰ÜÖ~é¶Ýòï.çÄþ×lÚ<¿{í9‹wqP^vZÑ« ™u™Ù¹¼vî\}ʲك%ÅÞ8EuòtKça‹æFžîÕ«ÿðlsöÚ¡^«3Œ÷ß|òJrØ™àêÛ·ï tM;if+w^·y{ðÒ¡íæ.Üc&oÔ 1Ä­™X±ó°I:8{÷Ì#ßÿ½‹×ªµ»ÀøüPRµM»ŸÖ7® ÊÖ–l4aÝ–—[VnÞ¾fSþ—X2¥.ûËŽ­7œËŒÝºj•L·~¯f÷ê]»ŸMï߉pMz?>lk`u €o»Ã;w…Ú…¬>óä긑Côˆí£ùs~5å=ÛíûçÖWkf-ý“SZyðIxz¡ IY=Ù¿cZwRp`Uq+6æ™8 Ɣ͓+wÜcòìÑ™€K›;uèÙøq&(;`ʯó—ê8BL §ÕhÛ®ÜõðÈO¸;pù®éƒËö›<æ-¥ƒÂ®Ô¾S™}aˆy¸¶{[×askÌokº‡Ý{Žö<*µàkâÕ)ƒ|:t«ó"9Û”°·S¯Ú'ocœ÷dpçÊÑ™7ut^¸ç.2e¯œV³mÛ’K÷$„¬žR{óÉã¿usn;n“‘ÀÅ­‡-Z•™o‚rO/kÜ¡mÉm—î1]ŸYyîì¶º× ÈFnß_CkITRÑ{„.í~)¿'R{8?}³G¡Ü¹rûWG•«”–Z©†ý®#W­-¹ôŒ» *SØîiQÒ5}Æ]¹«óÝ£«l«×MËŒNJswÎ[}ä…5‰ŠK ÎS§^™ qÓ'?6¥ì¶*f`9‡ik"fŽìŸrnOZÕÕ[ŸÕSÞ;—ÎýØk\ðA WÍn7z²Rû*[lztö®žšØðrÈ‘šBµåîÆî‹wœ ÄJ…Š%y‘bg[kF$Ž½õÛÂ9]ÊþÐQiLzž­Î¸µ(Šr4%?àâf i›ÊЬ\.“èѬ{ËFåfÿÞoÑis“FõÕ¥~>|ènµv+¾]Z*j0ãéŒmÚÍ Ú»q‰œ@«†Öˆ6bpo8aÇêÝeúœ;zð´+•¾þ׶¦ÞøcB—í‹#„nÞçÎ]üòW…fë$ö5'/¹¿uÕÆ +Væ!¬Ý?ÔårP ÿÒI1Ì^àœ¸í~N±·7EUvjáàa &Ý»ÑJ¤½!´s©ëwÅ hÙ0#5¤Jm—=G.«ÕœÖR±$55¶l½z  ÔeCëŶ댰£‡ÌÕc ±J*.6ÍÅÅMÒŽ¯“*ý,õk_îÛf#²¶.¬«—íÊí±ÃÛ7sônæý`ä‚ß{¦Ú´òSb™ìÔÞ±Ë÷<¨­ˆ@é+‡ÖŒ5Ü?¹8½îæ3úqÙùØò$Ã:;`E˜Ù%p×ì}\/Ýj[¾Âót+–<=?eñÒ1-ºtR| a@Q4ËŠ(šaY8Íñ€œÒ>¥E"‰L¡¤(ðkXñôêÕž}‡Ii (še /-ßli_©¶Å½´|CÂ=f÷VÆÔKyÁöìš=sj,î“í]¶ÇògO¯ ¦ý³Ú¹vܽiéëµÉ0âΣn­/å/®®¯¶vÓÜ‘91±€ƒ[ãù‹6Ü°á8"“`´  ›ëÅKa w÷NM«¾bç¦C{VÌL7ÁƘ»§,|¸jÚÌ7k‹Äžú•©¹|×–›uå`ŽÜ~àÒâmÏú»Ÿ?|5à­bÊ«ïÙ0¢•^Ï· Óª•+ž|eûš}.R±k·}ëjóô@«ªn8èiS㡤ÉÝkSŒ¬Í°ƒ»vÞsO^o"#Üк͜½IÇ–”Pðc¿+³Rp˜@Bàžý’q›·]ɸþ{´Œ¹ Þ?Ì_?}Øò%{Í‚-Fà¿ûo€QÈ•t.¼c¸%´DnÅÒ9…ÒU(ùTÁo¬DI‰Eüz(J*·,\ùHhZ¬RPÙ;R"™%Ã2B}º„s¯âÖ¬¼ÀV6pÎîp¨;©E‰ÔI붵™Ó€Ë-Y¦ÀÆÈ*<°»èØFcÏ7*zZ(ïêyª7ÊØ)ÀÝtO»Û+\ÈoÔ DR F$*x¬×ª7ßc2'ÝxÑ}Ԧ̋#n=xR¥m㶇©ûcÞ3#¢O¸™•¾c¼˜Wo?àÒöo“K五´öJ =¾þô-•‚ÍH TŒªßþ¢VAÙ×jë vòörL5Ö°üDç£P(ô…ß“žm=®ž6¡,M0γö‡íêP¾ÇÕ=>Ð ½V¸ñ—ËŠ½îÜk^×Ê{ÖÍŽÓ÷–3MZMr¶\³ù̵ŸÊu1ŽÓöGó{&§¥Ôé\ÕÒŽ¸:î)9H-1[Ø_h™\U#®Ð`œ•Ý™Åç.t¨WAñbdî­Ê&mø±ŠíÂà,»4jJ¨mÉ_þh\Â6å—Ÿ/F¦2ö¯ 9·ÅÕF ðó“ï¤;¹}ª¯mY¾¿8Ê[bãÃèTúäì JWó oš‘ÒR£ë·ð·´'nV@ÑR¯RÎF³&¬ÊÔñ´³·®Ñìz’¦DrN•¦Õ”Ö”£9"E<€RVèíf­|×rì\¸aõš• ÎuÛÏu²Ñ+J»XÙØÕÿéâ­X€ZnA9Y¢rÕ½\ÿ2·ÒÇïZ7ÞÄ*4‰)>J|xÏìŒðÚ?öµ²’–t’†å"‘‹³‹RÃe=ÆDð_l-ŸÆB#½¶Knïñ4®Ió™±I•íD ÍŠIJÇ‹ *]J©æ¿š^Ýq´÷´w(ýìAZûæ5³r˜2v6µ]rY¶•­tf§F2»ÚúĤjÍûd>ºYÊNíéd›$ëÛ¼t6íYÂΣŒ*öÎXG}¬ÔÑOxØï"±ó·ö6iÊŽÉ×5s•<Ï(U¡š«§Ÿ(öbŽ¤¬µ)­dóI$ü¾cIÀX]4\ËK OL×ð:Ëí]Cï‰:®ç@Ì&-µuõi.Êxš%r©`•eí?ÜK9V ƸèPàSÚ!ŽÌqÒ†ÇìJ;»U­]-9>䯴srô Ã;Qàh©—¥´ÏˆS§lÒc(JÙ-õ3gæÖ=Åpáâõv“N»ÀBLóÅN~¬Ñø3f¿4˜MY™)¥l>5;¨C™À{‰m›×Îʆ2ÖŒ!ãúÂÁ#FOa1"€˜“¢ƒŒ…ÕeÖg†F'ðþ#¾KÄF+V'ÓZRž•¬×ÜÙ¹‚§­)XÃéõZ¹…SùJµ’îŸ2bþr/ ˜€•…:>]GP~~žž–:V±ÉRUà ©ŒcMÖ®azxBÝæ2^ùÚËHnï^®©>äjî—ˆÓÆ?MB‡°V­«©ÂÃ#8ÎdÐë Õ}Ûk_8V*ÝtÕÂ…ÇýÒTD]É.— Aej9ŠÅ¶µ}®™3é :…è³dÕ®ºøÔ•PŠ¹«¤?ö\5uêö_Ç-±yÓ!Yei÷2:“3gg¥çŒ‰Šýšo2çÄ?vW+lTâ˜øtÄé2‰µ•„F,z¿"m]o⬃Ã;þòûªsDîFéSŒœ9;ê±Ri4-3 ¿ãxB©$ºèqF½;EG1ÀqBòãöÛý4göo[¸‰ r”ÑŒÞX!·p M4s†LM¾³‚ôAkùlê;lþþ k».ܱ«øv ÇFméízVqæ-½´pîºc"Ï.-* éYañ‹º­êû¹WëÑ(~T¿žþêzã\%ÊKNYØxüºóS¦Ž`%e;”Ó êYe§¦_m/—ª­'©ïöëݳVãÞ“ì$v=ÆÍš=Üï·“¹{·ö»X¸vl¬Ý=¸¯ïÐ }“Õwøè³sk÷Þ©Ñønž]ÚÖÒ³âÂÇ•Û6®Ä6yòŒÜBÑúhïÈu‡¯èn®ÞsüÅ©!½{W¼ûüÊ‚Á}Ëõì]£|û™îR›S–.ã?ípòÐ]PâÒÉÓ€9açà‘½“Òoí×½n•ºü”<¶oϲšcJК…ZE‡ÙÏwÔo+M€Ó7NiŸXèþunè䕼›e½ƒ¦¯»sxüÔ%¿óu²dò ô¿R¼ý‡Â¾–}zW|Á6kjg<òG§~}ÊŸ¿vÂâ• gn›Ò:¨Ýbp↦£&ôOåh ­{Î\¿zb­©ûÃGë ’JíìïìYõ;¨¢µâÖá_õ)ßoX‡v¿.wø†×ì“}6J þcÀ˜1Z5˜ñ ùü𞽪Ìß|àã!r%–î•–Û–«%[ÕmNÐÓ÷X\µìEŸU§ú#˛’ š»1`M³Þ}ýæ®ßo2Ç-á÷ç…ÀßFÕÜpñZ•FƒM;õ3,S¤xAH>wTåE—lšû”hÜuRÖÞŸûô©U§÷l—j³i÷–\eÔœycF4cÅå;Ôwì߫┓ֿ4®bõO¦K£úŒ‡t‡§T¿þÈÍÃ}FO¡ç$C{ÿ¸ltµ¾š[Ÿ—kíY§b ÓŒ…Ë ÄxóϦi65O¯:TP‚“˜4áÙÚ¤»6›0JÝ8o¨wÝ.âg¿í<À4‘a×~m~îdͼäW·¯žs¬?´y“z,ÅŸÄ̯ù4楿¸œSºK›ŸQÑ€‘!16(*6BÏaœžñ"9#‹Âé³âb^DFçù_s&\°p”³&6úyrfö›ÕE´iî\PÔÖªy Í¥Æ<¸rùAÓ–ƒÊ{¸åD¼â\E_ÇõLÖaýõ ×J×1o»ù&……|}&ÌqëóS_ˆàÑ•Çß_û[¸V¯ZíØå???pæ½.‡Uñ«­y”ójÓæUËâu»—ÌÞûyúË“7SKÕ®æ·}fëû)šø¸XLAÚä¤xdJ›2k ëV³¤½êÓû­&ñòIµ=÷-î“ÌÁ†ä¸—Q1aD€pi) ÊÎÎ×ågÇl¼þäNDL,"@°1)6(*&\Ça0fÇ&¥&GG+&êYL|¼’Ÿü2+-:*âEz®6.òùñý+ßŦhÔ¤°’ ÇX𑨰9#)$"âYZn>`Ný":6ÊÀs~tBLPbJLlt° 挤ȨW¹F—ž–ÿ2*6Ú„‰>7.ìɦË÷®EÄD!Aì |wüóZ‹È½çÐi¾>~?WóÊË~ã•“tѳó¬*ZüT]y7ûMµ…±ªÙ¸C)Ïòv CS‘a·kŒZåãÛ©¢Eìó\Æ©D92qñÑý{Õ§s¯˜Jw¨_¡Îà Å%ܹàSY9sjçD¢r®Ÿ°˜T³¤ð¤‹tY©¥½Œ¡”ö*…̬‹3uBRvêÁ•ã8°¶µR¨ì¬­í”Žn¬îéKCÙ+ôÜ6øÅmÀ† ÁCF…ô¿»©Û¢ç$ºwì[±IûJ2­ÁèPº~½ª5qöaˆXje©”É-lÕV–˜_l¨}ô~p£µ—îEâÎL9sœA,ŽK{ó¥Ï…^Û‘¥7ÞÝÕkÓå0}ÖÓ¡Óæ'G;|%¾¾ºëµ-Ê 6~ëw.îü<%'ð`§C·žp–V›ºí(¡ô±ÉyÖb‘ØÂÊÁR)…ÊúξÑ´qâ’Íå=ŽŽb¼¾ºéÕðäˆë3ï<›ù`ıÀû‹&õ|ôdןAù±gG,Ýw&7ùöÀñ òQî–‰r¤Ï·µ;õ(ž[Z[ÈeJµÚÒZ0/ ZËßĬy¸=®JÛÞÈ0ÌiSÔŠœy³Æ¥–iùoGs0e¿ÚµkÁC}iW{ £>GÍÆŒ™µŒˆEÙz8ïÞ‹,—ª– Ò&ʤÆͳ:ä*\st†|]LŽ¸å–g/¯›•±}Ö‘ͪ2Bß}-Øi¹¥ƒBĨ¬T yNä-•wýüÎMö±½º¤ê“­ûO)_Î „¥OÏ®¢S Z D.½{uWV¦wýÁ-jW(:qò‹};¨ÉU<ìHÜã »önp+U†6çkAñpMãS/44— @Û´í5Âò=íNììb{dÏ ´›ƒÍJÕj[±ÌR­¶e)J¢²SÉd2•½µ•%EPª&=§Û‰(`%JkKk‘ÜF­¶]ØÚáq‡î„&¤½: VCÜ©S{3Ìy±Z£µ—¯&èèéë·S/æ"JR£çòò.S VM—5ªÕîÇšÎçâ‹åÄ¢(±ÂÆB¡(íÕÖV4E+­ìe,keí JŒz4iܬÅX,ÎÒ!À†˜çnÏ׆¡(‹ŸzN±) þ¢rôÚ«Õÿ«+’u"¹âõ,Œ_‡´3kú¶­ÀG²Žº9cÞì¶¨Ú }J·háñ"]sïr€o³Î\nDP¬ÍŒåWËj6ÝÍþäì9Ç\_»nù@}¹”áðå„Ÿ;jÐb°þÌôì7CûˆeVV*¹ÂÂNme†¸eƒ_¸ù2"ûÕ."à×pLÙÞõª”|³²Ž¥½¯žø34331ô±&ê`í~Së6ÞÎ߆¢™æí뽺w=-6À»÷T•æüõ ÄçW7åJž†< %};õ.YÒ¿š£•ÚA"’Zª­”RŠ¥ÊN..h%´DÅe‡¾ˆL©îí…òžï¸°ó~tfü«“@‹*ù6ö(ç_³¬_DbÞÁów´YOÎ\½Â…nŠËã¤ÎUšûz5jZ>-)V$µ´¶ËU6jkkZ}ßßÐè+\#?íÑ’y3Î8ì¢xãrbK¯ä(ÉŠYK.®oénÉ2Í„–ˆE€Øº\ï~¿·öê°ûþ½ú*»DóƭŸyÅQÉÀ«SXUËRºÜþ³%œmi侮ٺV¨cammÇf¥g&¦`ýÒÙí#Bž%î\â?z²Ð…ß©ÞaþèF•)BðÒÕ§~œ~§urv¿¤4ß(2[.z˜w°BY(ÆÒß¿Z‘oŠwmkª XFرMG.Ÿ½ZE”ð2ØoÐäa-;¬µerª½¯LX{#À €VTò¯ÿn¼S”p9T¶rÕ c=çÜ©}‡}TÙ–øøÿľO$‹åÞ£'í°“2€³œ‰³>qjèþ¦&€Ãë¦ÐMVN©lÕȯ(ÖÝ¿-%’ÿmE^¡rˆKW/Ÿ5aËÜ–N*†pYÛVLòj½¸‚Z @KËú7e O'±p«çïòÿJ¦E9[” êc'-+?fÞkKf¸T6¸«¿ZmËÒ”¢æàWž8¤Z ¨`˦z;Upr²uñ*é”c®«þ´hÅíÑpØÈÚWLï™jî\¬¦ &@L:‘¼ÞZP*ÆuÄÄ.ò¢è‚´Ìò=Á«ˆþÕòÅ«G¯¾ªŠ˜½èŠ± P+b(«*Ãt—WëÂúuîA_¹”o3múï…e0S´H.‘?yßÜʧ×Ú%~÷n옼"yͨšrëJ¦ìTŠhH¹Þ–¦hšaiŠÆeÓmô¶Zöbœu…Ñ4Ë‚äæ†[Ëß„Kùsz×Ê~ÕDß‹JJ/þ‹¥óÙÇ&^º²ñì3q +ž3|î6BiîlÞ²üέ‹6Üuuõ.U®qÈšÞ·¯,ÉUôUÑ@ð¾ÛM›ÖJÕHäèåƒË·¾ªîîV£fÝGÛ&¾x¸-Š­QÖ«Á‚',8Y«L¥N½&*Ë»X–ìýlËØK÷¯_8üû«ÿcï+㣺¶·×Ñ93“‰» !†G H°`@p (N‘RœBÒâÅ]Cp—@ x @܈»ŒÏÙ6 \zûo[nï<¿|ÈÌÙ{m{ÖZ{­­ÃšÕ—ݽp02â¸Ò¦«¹™W+ËÌcwooÙ}×Ó§Ú¸±Áõ=üeàªWØ´«7´ê˜ðòN‘B¶ýÒ wÏÏË¢ZZKë ÷·=uóò±ãg›øà2çûçs‚:+æU”Z[ýò©NÔÈB{3êñ™c¡¶§Ü|ñÆqMSuu3 R× ÝøCçN¿z~òØñÃ@c­.xrìBˆÅ /ðïcö–iåñq²›oª÷ZU„Í{ðüBXd¿“èß”^nI;G=¼·%VíÑBª½¸¤I©mwk}Ò«„ð«Çyeþê!J8Ó'x©ZДÄƼM-ÊŽ}›œøëQzE^TôueòËׯYÜèë•ßÛ»äñÓ‹Ç÷mÑ#À휽e"#;+K«*ö)³òÒ^›TæÐÖ–Ʋ—6lí'.ߌ÷søƒfIë.šm¸3¨«Ãµ³û"nìazýh.26Á Þ够¹ðªj5gÌ›D=Ì-*¦Þ·ƒÄGBÇF9¸÷çÎjÄE1tç.„!³†Ã¢.ÍJ»õ¼€rn@½: .Rš´ìå¬ ?v7ìÅýí·"£>~’µDõâÕë¢ 5BleYJ«-/+PéÙÒ·Wo¾Îq¬ßˆ&HBÖb°WÙËcž=}.´Î†öt?¹sEÜ›;¿¬[VþQVeÊÒûmìËœ¢BÁÀ] øç©Czn\A“•‘R5uËÌë[›™ÔÔ7Te™…*™e+#ÐTä”hÅŽ6€4…¹™*=KKm쬭IL§+t¶L¥b@\N^¡}µæª•çç—0&N¶¦peij½¹­«ÙÓtq~ºÔª¡ÄCT-v¡2/‘´òÒ8 ¤®Ì),-Çh™ƒc‚SæçeiyÌÒÞ͘!9MYN^)µ³·±"0@‚&+»Ø¡^½*A*‹3”¸¹­… ðŠÌÌŒª™ÓÒÞfË JŠDZÚ72‹N•“Žh3{G@ºÜ¬ëz( ]qfN> ¸#uA^Q1N›ØÙ9‰H.¿Leka^ÕlªÒ,­ØÞBB ¶(+ÕÄÉC„cÀëåjÒÞT‚¼&?'MËã&æõ,L¤%yIJŽIq±I†¯ÌÍÏJ†ÌÁ© |YÖ;ÒÚÝX,âõòÜ %R•ŠŒm-êf.ÒVæW–ÖFTÕ>à²Ü™;E`€yqZ±BgnÓÈLJåe$hBd]ÏÁ¶0+Ý´ž{•WˆÕ–gjÖ³Ã1Ð)2sŠä@‹-œìþI‹Ó”¿ÏË MÔ«O`¨¬0µ\©›8ZÑåJÜÎÌHŒxM^…΂T—ñfvæBgP’¦õ,Bêò¬ÂòJÆØÁÎÒû÷bˆôêÂrÁÔÆHÄiʲK¹úö²‚œt­@Ù;¹2¦®ÌÉ/•›šP¸ÈÑÌHŒx]nvŠ3nP¯Žtù9©dfNV¦ÆúŠ,9aceü1yEꊬ‚r¥‘‘XÀÌl,L*‹ÒÊ5H$"¬lQ(˲˴”“-†«)ËËÏá0Úʶ¡±˜VæÇ–bŠøÀíòs‹ŠqiýzÖ¢œÌä*ÿ•‰«©Í-ÈayÜÊÞÅX,8U^NºN L-ëãÅzÊ^-/5•I õbVšŸ^©Ñ32{;+“²Â Ûú‚:§‚5³01BˆËÏNÒ’õüãüW1’ßÏkÈèo€`€üw°–ê&FF@R‰`€`€TŠß¿¦šµ˜ƒDj˜`€ð÷€Õýþ5¸AL`ÀÿÞÞÛ;l¸ÿ¾¨Ì_ âˆ5‡oþvF³;6o—ó‰`À_‡??ò™¯8²rVd_R¨¹æP'—ßvãªKâ¦ÎZjf)eZl_½¨VQøÒ=?Ì~]ÁrK¶ñq48ÕšÉmëÏ8þø;§_ÌÔ(Ë•gì×8y銃j$ä>¿j‚í®›“™´ÓœÝCÖÚ·scçÎ [nÕiÁªàV»æN|Ã2•¥š1?ìaþ|éš3zàS"ýp+¹YÍ…'! öœ¾Ð`ò¹U}¼+2}=w}={)f×yã’iÄß&/¤xwlÁº19vÃΈ bÇâ ¬¹¼P5wÓAó‚+vž&‘Jì6|ó¢ñµÇ’pbËôË÷úŸTŸÒ—Æ-_0·”±rô¸4È7bÇ×'“DXežOðö©=\kÞ¦HçðnÖmÊ.{´ý½ê×o¤Î~­X«ß}¾ ÊìØjÂù7÷l«·ïèËüÑ#mŽ¿‡»?L G/ÞÝÍÙ¨ÎÝOŽ¯è³¿9i˜« 0ào²µ¦ã~<¶kÇñ…í÷ž&Õü¥øíqÛ±ë·m?áKÜ}­ª¢GXLýùĮǿkšòìu >ýî —ÀD=çÜýËÉŸ¾î|ôè}0í´vÛÑ-kdx§6Îv·®^Xuró/gãÎìÎá-fo»°שÕ},Îœ}lhlÒjö¶ ûvZÝÇ4ôücEÁƒgÓöì ñ—„¿P ß þùئÕ+,þ©¬v hAÚ‹ ÿõë6pR¿Èf€è>hÚ7ß.Рn¨…wÀŒCÎî?z1áRH)f>sÛ…ý»N­ètâäÆ.`ãö£[~šgeÕÜ˸NÜwÄÆ-óý«fëÔ—!Mߺãd½¢+ñê¿1|“5 Þ±~iUÂu®èþ£’»¶ìß4\wùöóú^C<¿ÿÐy<æ|aÝ,‰øè9{f ó©úðüìÞÊÎ+f}³hz`[œ«¸qùé’Ÿvý4©õý[un;»}Kó)‡¶nÜrzåªâÚ¹Ñ,œ;þ²;d÷®#ÆéwJfäÊ£öœÙ|óö£óF´¬¹$óåa)Æ]wí<úËŽ#.Ö’ýKƒ.æè e£üïäq.þ?ï\>ìÿ+ â¢lÒ¿Ù­ïqç'6í7²_@ßÎGcŠ.j¿–_÷í5d\r©¶Î}•'õpú~ZÕÇŒG{÷já׫Ç˼ʒèÓCû´ìÔÉ{×7\Eô¨~}rQ#z{­9+h‹Ç o?ê»­J€*ëîø@Ï.ÝÚŸySŒø’¹ƒ}æëܾkï7EÚú”É‚uÇ×Mè°hö Û:·W§N͆Mû¾DÍ…nùzÞÖ++‡´ê>~ƒJà"÷ŽïÒ¥i¯!##sT†©Ëþ*Ö ÉyÔ¼¹Íä'ͦñ©ù½Äªéó›•©÷bc‹ëÎúÊä ÍZØÍN8¼›‡2#|ÊyÿN¿Z & høóí}ë‡TÅõåFßMï¶ÍÞˆp°>¥/~œ“•ýáp£«O3:v04vM\y’Ù1ÐWSð­©è»)ßÒ ëGp.¦lÌ«Ô¢Œçêü§åÚZ+a£ö#»ßíѲ¥ƒ¢å4w³íú­ƒ¨ôàòÓN§rÅÔ¥7iïgñ¡Ýz–Üep—ªÿo†èý–~ö|A0¶r;÷@YÿâIÌ»2î aÒË/Ôj¯]y“Uœ[õ¥>ûz±µ—ÍgÍAÉÙI¯/ì+Ë{:tÜ÷¸ÕÜ­? ósìºüõ²¥cë\™XÌcïO­yh¥Ž+ÒÔ=+7¤gó–ð.sl?¨âobö5œþ¯˜kÌ{½ÚÜyàÓÓxþ¾MN~BY’±_G»ÿ@,Ò—o¼aÔÖÔŠ§§ªhR÷1›/ß¹exP ‹8Òeó©G¡ ÌO߬«À˜tØrAÀ‡Ô|¿õÑÆs/î^ki#3k1èøÅ—áawöï-3ò9y庣쫛¯ôÄ«ãgu÷U5Íž…ó»üx÷ÆÉíËÇ|SÂÛ-=:ÿÉÒš7t¥ #´5íçKáá¯~lûøIJÁ°9‡6~Ûoù¹—wÏ—â„wðΰ»oNÍóصçªaÊ2À€¿Žµ0öíž<Žßâ—±;ôa-ÝÑ}øºÞÌ…«Ï=ºùš~tV¯´Qß'ãV{…Ÿ {uïÂZ†»»hmh̽Ã!ñ äöã/OÌ÷›=/+vuå¼.$†õ±qˆYÜé»ÅõJh Ú[‡³¾çip}˜ÜíÍõÿec[˜á"™š57y‚˜ÓÊbÚ¶Æò‡S‘•‘]{NxpàuŸ‹ÄJßì}VMÆ,0xéâ…‘vjë&{ƒÒÔÛ#~L[9môa[ÇTø|7É»*´ž»‘8s|ëÏäëÒnò:ߊó×߸¶kmÌ|)»¯0I‹ ëæÝ:uÈÑ¿›#VþvÚ‹¾_ôùd@$!êøíæŽÝ§´€˜ØüŒŸæ®;pùíÅï}~ZùK+i™¸ûÏæÍ"šª›j·t>âî!r[ª æÜò+Åí×t³ù¯HÜŽá&[ÏÅžX·ˆ»3öXdš£o ,æyìú–];üGŽ;V%Åë”›ÖîNH|Q*inmFŠM¬u)J½ ±´¸Ô©EQíÓÐ> ÎÜÍÞˆ&)EàÏO/Ÿ¶|í¥«JKJØmÐBHx_)ªooÂ[Y«“•zĘ˜JIÜÈ\²úaÒ³˜×'Ï™5ñhè©GIj®6;çJ·ÍØqøÐíÈD½Va˜¸ 0 z:ý³_ èKß%ÙÙšq¼^©TÖùÕ¦Ig']Æš+ÊÑä¼{Vh=¸GKÐ&¤UX[Iy–U©5=§œn£bµÉ;–^3ëÝkëdÇs\ei)àÊ"ï$¶&!­m÷Ò§¡õ:¹H¸ç!ËO©û®óo®QkeRÆÐÞ èžþᴮߺžÍ4j­‘}—ÔÍ·-ºŽºñKnÐ×’“^‹_Ÿ¦ü&[‹p´OBöÙ÷žÐÐLªUWpt ¹N÷66ÕÒÞ:9:Ú¬q+eXÈŸáÌ (M½·`ñ¶Ÿ¶–Ž°˜ó+ŽWø­í]ÕlQX"Öt‘y5'*Lz|'‰ØŠÀ@¯‘WÈ5e…B­•˜½ggubÄ f–ñ7 qšò 9ËiËË+­ÌÅæõ{8‡,ÜÑdü|eáë9ÁãGn8çÀ°<ƒÔ‡gÓEž=Û¸€ZY®TkU•¥j½eS7·QÏå-›°ÆÖ"]q¹pÇA-/*.…Üò1Â?OëëqE=Û©îýíÅ8ºg!»-{Lpµ’É‹SŠuR)´ ¹Nà3"vnŒý¸4P©P™Ê¤Ø—J\Tòò²2)†“&RÝ›ÄR'§†NQ*-nÜ4 yÉæå~[§S”Wªtjy¥Rebô hÌ»8bã‘É-­ïŸX’¬µ..:º@ʾ·ò3áò´·±9ÅÄsõì—!2ËÏÎSi]$Lm¯fj^ý$)×DZb«Ø7©þSš&mÙ|#ÄPQ©ÒYÓx ªˆa¸Oô2:Á­~f±}SŸiÄËË „]³ñ›(’G.=Æ é,lIµ=¿Ï«äLÌpuîÓ$ú𮯎<üLq+ûyÑ?¯RŠï×– ÿÖ|yÈúq×ã²´›º{SŸÚ„¦rýŒ®Qeæó7³&ò^ß;÷¦Ùà-+=´r̽ä"7¿owÏó‹0± ´ [Sc’}vrááˆ8£Ý9"Â!ñöy‹ŽSªj¢+Œš<µHêsäØi›½mÃñD€Þ¶´q÷²‘†ö}ö¶'’z_XÐ~ð¦]ßý±Ýþ¡½{öž{Ä™†ŠÌã¿ùœû]9<[ŒðÚg§wz·ÙÐLêÕk¶çŒþÝvû³£—¿kÕÌÃOS¬<ƒ.îIáœêîéà †L0'àñÍsÑ©±£úx´ãµÛë·¬>py©wÀêC?ÇÚßÒoù¯4¤(éÉÉ«¦Ã[÷/Ü p§"ë§í:.ë—Š®Ø~Öâï$- MÛ×'h W¾çß;5wÅ™7=¿9úsg—·7~QXðbl`š½Ç•´GçÃd²*Ö²cYàéépÒG±æÚÒáßw™;°s×Ì©›o4±òغgÁÈ!^¬u›ÍûNð•—O…ú a‚C·yûžN xLrðÂMc€×EžÞîî9ÜÕJV™ó|Ú7 ‹ô¦c¿?ÐŒV}÷ÓÞØ’Š~ûŒêO»°Bü±ÜĄ̂ê?ÊØfç’€”™Ó• ¡g7M¸þ:§Aû‰‡F{ÞA?‡GÍn` ia3G,»ƒ&f¿?»sÕÿá­qa‘Öýdk.îضó¤SQãÊz¾#ðDѾÛOÌ©bc;zÿ¤V)V£BöµÇ^Vá¾¾ç|ï_Ûp0ÐãD!„GÞê{%d例ӧLï²@i{èüÑÇŒ›Ôâ°mO ';ÛmœÛdL׆ݿ¹´ Geà `][Ýõݘǿ;x`±ùÑó·ÍµÌÄ0ÚLÊÔq~áæÖ¢iƒÚzõ[xvÍ`ƺôîÜçHЀÖfM|Ç®ÔbŸÝ„Ç—ÿ0Ý- [‹.Ý›[™Hþ§f)éε’#»™ñ?©R˜J¦X²Æ° ýÿJ²*7nq/‘rã`€ÿ îü$oý̇A-Møü93WmصË™óßÂZd«#3AfòϨ®¨Ä*ËU3XËç‘—ëêöïåÆ5À øo1l>oÿÁ)ŒÉúlHNõßÁÔL=zò?£.âÓ‡ÈÊrC›þGPÍZŒÕI&¼Á`€ÿX´õˆyõÇÁ­Aþ –ÿÊ©ÍÜÆ”ÓõR£ˆËb}>mè„ŸE1«þwY‹îÎuI¦Ad`€+0À0@Â_r× QtÀd¨/ýýŠÃÁ^ein À¾y¨=œÿß[‹¿B«¡ÐÔóó×+V¬Ðëtºè0Z]ñ'–…²™*$ýb)ªóDqÁ„LǽÏú‚”$7¦ÏÚÃ…K~ÛV’3 S—‘¤)8—éàeIBeÝø8Üs¸¸ï(Šæ2R1é É´wB(ä ŠjAsQÿï˜v]AŸ-—ãº3è&|j,"Å㊼{ÐÞ=0TÄÖ6&´cL$í$\z Þ#%}Fâ2.»ào5d¸}Ú»í݃äpY¥TçéâýpQŸ£`Fý$jÓƒ¬oÃ¥½ƒÿx`ŒQ=ɨÅt«¤—·&Mº5äcQô°ÕL»´w'>>qÞ|¸¸ïhB¬äòTÌ„•UB&œ$\RÒ¿û:i×úlêo‹å;ò㪙Ó€Ћ‹ûÇûÛ`±›Œ+)N ¨¡K !G()°ôaN§[4åÞEQß@^4¤¢ (+ ¦TÛïH<…¯¨ÛiÄ ù–ön•qB…öÆ#éèÍ%¾ÅÝz1}¿¦›5ãÓc˃´3t¡ÈË›Ï|tsí/é?Ž° ¹Œt¼Ù@¦÷XÊÅKz ââàïªd IXƒ@IßÑ´wÚ«9ÿæ9"m˜ …”³—ò¤í%cgÐÞ=hïN(-O+&ß— &b¶¹CUè1«ðÊøGöÕJ‘mŸ_ö‰Ò3¶¢ÞSE|ù¸§H Ÿ‘â^#I'S.5àî}ÅÁ-´Ò IDATÇâd!Ÿ[Œ9µgúM¥=½ùÌ×H‡‘¾ãÿa„9Æe¤ÎP]'3Ýzò Qudº”ºŒÈ*hyÜ5@Àª§¨¥9Ÿ“‡5™DŠß •šßkŽAâþc $N«HÂwšØ¿/T$ å ÀMECÐM¹ÄX@Rʦ¸KN•ð¹EužAt[ˆ¿Dú?š‹ÀÛN÷êŠT¡L^뉾3%þƒ«†<ÝHÌ&Q½f2ûâT¯6•ômÅƧfD˜Â'FÕº±Qw&p"ÝÒ“ÏxtlÕ—öMÍ5eY½HÄà†ç9xž“HD¢¿&nDšLØ×ÃjçŸÀìzPx¬úìÂg2Ô€øø«šs;…“iW[cOÊÄš°´TøB{y+[l* ôÜ‘ñ´Ô„làMF¶æ®eìÓÜ}&8({ñˆÚ kYUSÆ·‰¯TC“¯."LL¬ºQ¢õÙý˜çTÀ#*õ·wiß–JGôøè6–O¹‹Éì1À‰^ëðŠGšËx9¸ã㨠YÏKGPŽÖu´&jÐ .b7«rwn^牨›2Þ4 Ú3ëÕ¡[YÆYP–ñï.«C׫ÏGʧ©áø¨Cl©¤»¨¢5gÖ«Ïîâ)^ûQ†™“ȼˆòpÿðÑ…öB·ò­¡ÙÒ_ùÔ­‚ ç“`UëáÚ«ÛXuCIo/ÀÌ_í¥½Ðl.n*Áp5¾Gû Z2¨?`¨´ç¶ð&þL[WAxÿ ¦ø‡ŒL„gE18Mn%òë  ù™å:ÓÍ\1±Ojn…ÑãAPhÏmR‡®×½KÅ _Õn^%nïÆõèÖ1§f¥Æì»ÑV•‚J@šP}¨vƒ¨ÆŸ Hž®«$¤b»¶’&eÚ‹'ÉNãÃÉPêy] +ä ¸e…k.ÂÚ®"íLêÎg¶Mqê·.Ù{Ó‡Rîn€9ûRMÛÒáÆâºï¶ò’6×h/ž }'Ö‘³ðò¨:t ‡[hÎoT߸Gx%•áš3[¹ÂRPV`C0“¦”mÝq„*Su7wh¼” øc„⯠-ݱ—[ûÑ€2 ³‘¢€×›u4è…ü<02'• Pi.6\û®JJ(ó F˜L*ä‚P*hIÜ—©¥ZÈ~Íçf ©ˆå€`˜RPȹ‚b¢¾®T÷•¢X¾¤òC˜ E9HQÈk¤¤øÄç|aŽP”…ñ5+ç’ß"–À¥"s¢a dÄ7¸Œ¡TP㸅#n¬µ•!ÊŠvby5Á'½Æ´ý¨$iˆgpS>79÷æ¹PQ (”Ø—dèæŸó…¹BQ&p jDBž€$ì³(®02>ç=’ç ¢Da.” j·pÄU‚R…X Þò餟H'››Ç¥& %Ù¼†>9Š/È ßÏ⢩u´,UŸùÑšTþ–Ïû èÓf ,Bª2.»’°´ù;å¥*CŠ2àTH^Šô”¨›§>úª,àSÞ:¤,å30‰øO0.sÈa¸tâjQK@¹‰¤„©÷>!±«tÒ:IÏ®@`¤£_l*ýÕÄ @@ŠR$/'lLu/2ërV+/ÉÄ¢v1“ƒY0¬iw”“@vš€¸èk|^6û(T“ºlýÓp¤ÎÒE„ò% ܲ Ó§£>ò.Õ5Ãë¼gSÙ”Tœþé3óàŸžŒ\1ÀØ .ñ¹¹BA²ÀNuŸM©/êã³ÇÂq ’€¾”Ë*ÌT0˜OzŒlÇÒ í±¦ƒŒË‹z`–ÞFßí¯ú“ÏÀ¨>A|ÌíZCÕÌ–Ï˺>é`DwÿN[*òñàù×…¢<¡$x‹¥‰˜¾Xz%’—¢¸äh Íiœ¯äø´7˜s'@:¤(Eↄ>é>:ÃÆ»}Ù{ci&™¾HÈ{É•é°ªu±¦û~ÿ{Îc~­‚¤wЗq)ñÀWM&zîÅ=¡¤€/+ÁŒ¼ ûB<•@™ ïcù¼l¡ ± ûD¨(**€çAÐó©oªI$H=H+.¥*Í’œ/Uá¸)/”– Òd>+S(Ê@:¢ÉËq;{í³ôÚ³ž 4a×^ä?†°3ŠòQÞ==÷icR5E}¹×áxëIàâà¿Öˆ°`P^¬P^}¶aíÁ†_(åËRfD7–ðùå(?s À „KˆÊòx÷;MÒZÒ×OxŠ5GÈh½'åbªM” ð‡Þ¿õ‡ÁA¸eSîÑ €r¾QFµ¢“#y)â8$/E*5 1…øì,`‹´Inl„7l*$߀ßÿÖ@¾®¨$±4fæ æý¡þçïÀ•6µ4ׄ(?N8€²¯ãÓwÈ9þ}G|Rˆ12L*„pÏÂåPc9ãF&P‚HŒ1Æ .1Ƣʴ#š¶Y:´ Í“BÙ’P>;qé¾ò ä]Ãûÿ"브L¾ª Hfà(呹Ÿå¡N™kÃgr:7ÙÄ™ŠMÛ0±0b\jdmBMˆ0àÈ6“±ü >•åa2sø•½›¶¥Épõ»Ü/KJ¤ 3`„òð\µ¤ß !ö5´p“šu„&*„¢B$øZ˜ÀÄ2`$¸Ô#páÝyÅ»ó€Ë¤'²é?va¾ã‰Äú*¯iÅ ›¤>ömõo–Ý…·àóD®2‚£7È– äbãŠúRä†S8%WC,v²e=«To›õŸ]ešrû4ÀÄ¢Q+±Èh$P ™a  Óœ#úì¦Ý¢‘.?¡Ú¹›ù#ñò¯µÁQ†ð‘Õœ{y”‹9 R'éÔ=úÉl¶¢–Q$î,—½Waøç·”èù`+…r Í6#†4ž^Ô=ÿS¦qw}ÌJ̆¦œMô 3PÕpbbŒÔáîíáþçPíÞ©¸{W&h–¾SëJº¶!ë{FrrkÁØž½¿E(â„‚–P£Ü6ýCÍ°ê§^Еת 3 Œ\­8´ƒÅí:ëòÌIîžb÷ºïrRz‹SÐN¢.m•G~øà’îÀ]ã°Ò8À«g²©wkç'äШµîÞ5¢±é$c+‰ÌÃ\F&@&`¢Þ‹ù×;õ*ÒN*·…üj¬ÿ„0D®L3SÕÉ7`6x íĽUEàÆÌ”5ÚÓS>oZˆ,ÒÕáéuí¢C‡²g×@“&Ƹ10 .1ᩪC50zèþé†.KoB”ó‘+F@Z ·´Õ¤XQö%Ü3yÝe1á.RWð9jŒ4Ççü–®°Ž&II€3fºúòZQÆûSB&`âªÙsëKç¯VÊ?×;¬qg?É´NëßI8ø¤(Ðw†¼½Êmw?”‰Ç›MµTÔµ/ç0ê£Åº¦š÷ò¨ÆÖ“ö›MÉÒ•Gñ®ˆl¬GK."äk”ïˆZÕ©žÿÿØ–€?Ÿµ 5Ÿ#u„Y’®Íù75l°ú2õÖ1@Pô U\Õqï$8z¶J¹çSŸ©owcê»ë ³q@‘¬9æ¨!Ìîòåz!÷­.â¶lä@HMÁòžqI‘¼à+²³æ+Š©>³…+3¹B9Ï6(^ИÇX±s†¢|œ\½c,"jÀ*^În*êÌ]þá7uG,­¢î*Ëky ‹t:Ðk!“¶XÑK.é¯ÙÛóÅI€QÀà Ñ¾œg¸°YÈv0¥Ê©VþÄÐTk ¨8‰}ZÆÌ™…Ý‹›v’îMÕgŽ|YûÒpSQÿ±ÜååHσ+PØsó¡ùb¤ŒEšòçÁ€SÌè%œŠ¯žJ@,&í°Â\RϾÙÙñ%)‚a" „D2àTÀ Ñv…¿Òö~0åá”O?\ZŇ>ê{žîÉËU¼ZÂÇÖ£2Ÿ4ÄÖxã*¨®ÄüΈÑr·Ô<­.° úÍd`êF·¬Þ‹Ê’YE6Ξ¡ÿÄ+ùÏŽBå¿Ô £&¤_úðm‡aJ­\»î"wËê‘óþ›Q‚J’¹g¹ÌìEØíÇÿ¾…ýÏg-ê4ý£4ÀH«-—W›-‹º Ťö˜>ªŠ’í&2õÒ•'oãÆôî‰Ô:ÂÕ\> åGë2l|¥H4øPVà¶.ìÓƒ ¯D¶³DÝ­ñFõõgKˆ™†¤^Ó[Ô Gqo9Ž²¥HG{í…cŠRÝ!íºÐmšáfv”\þKu ÂŒl1Ír@ YFšB³~„kšîÑSÀ¤ÌŒcÜÑq\Q%¦¢.ýpckºóíýsÚëw˜Δz* ÅlQwSÜÅUþ0`¾² WùÆý ”ëîG3½‚Á´¡>|a#1O³yžÀÕi.Å1™}a6âQ3ø¸[t§ .ùŸ•÷…ˆ‹¼œ”åA³~„kªîÑs6KŒÁêëBãÁ¨Ó¥'HêcÙáUÛÌ©>K)íUõ­g ˆAV³DÝÍp—FúóE¤ç`ÒÞd.ÂÛ‹H’Þƒ½X©{• Òæ¿Æú— QW}Äy2peQÎ5 $\ÓuŸ€E‘ñ EŇh@ÂÉhÆhÕ¦ÕH0öùvÀ­ÌèN=õîR¾Á¸© éª~˜÷Åô5½þÔ&IŸ©Da¥ºÛ±H§þ³:¶MGQk7 l06FÏ‘t¯‰è0ó†ú{§åÂôé…´é,×{/Ï° y´Õ{œOÔ)€ˆvRioå~ÂD³ºKk¥îß"iÅåt÷!üûHý»lÐñjGºm.ñ>` ‡ÓÝÚ’T–ZX›É´¤,Løø¢Ï=Φ©¸¥|xpñ×SA}S¯Áô³@AgÚâ¥74®á(5Ït㙉 Ó³BiŠõNM^¦Úö£îAtM÷´¨K .±¢º Ü¢§îÃrn’­ã¥1ì«xžÂØàN•šç•¤ß\‘¡W ³uOÞ0ã— ‰×éöÃ…¬GlJå;°±Ç;î‡pÑW8¢µ ™u •Q<ê+ê„7ðâî‡aî/‰Žo#²h¤‹¸ ˆ¤ë ÚðOøïøJ5mŸ‹rÞ‚º«ÀQD ?ÂÉŒ0÷%õ¯¸¼š{zûâB-ʹ'ååJà$w“Ë‚^ D¦ïq]¬^§Õ]½Ît›ˆÀL}' $|l„¨Ûh6æ²P^›mc4Ùa¡Ñ#Ež>ê.r^$’4Úˆ ?T벊D݃¶@&|'’eáðN¯ÿ¬–×8€nd‹X!dèÔP¹`Ý{ ÿ®®FÙn4aJƒÄO¸ó‡6TçÆ•ï[`dˆ|6À ø[ë\ûˆ-_ªžþ[» ‘/4I¹6dü›ê'C4™NÈOë3óÿ%”ÏӜ؈ø/Eb¢çLD WÏLÔúŸÑ¤¡1dF‰®mCmgWÈø 2[ uî9ôó¹q é" 0À¾™aºb þè)Þ8‰òÏês‹ 4àjÕ¶/œA`€ÿqðàÄôý‚©R©RÔ{ê—S¢âD¤àæöLß©ÿŒ€?X%¤‹Ów´a8|NPÂïZÍZ”¶¾‚áôD 0ÀþnH-’d_Îï»ý1d—€ÖÔMÑh ¡}?67¶æG•B^\Rljfö Öògñ,[ÑIQ8ö›å!$𜠂¢pAàyAÀH’Ä°ZR„ŽãAPŽU}À’Ä@àªI8ñ<‹p’À€c¹ªŸpœ pà¸ê+ë”ä  <Ç N’Žª?!œ IÀóü¿hÄó€ H«2Ç#DŽcˆçx^' â“mNd‘ °y¯?z_ʵµA§µs{IBÎD,Û¿i¾¯ßïÆÜ»ÞeÑ…QöWƒOKOÎôöÜÈÇîÛ¦ÍZE¾|úèQ|û®í©v©X²Æ@Dþ ÝðÚ:á_22¶¬¬¤^S;I­×bË¥Ë7­ÌîY¥—}4÷+@¹/-»oyËNoUS±lÜ!xSPÆ .ãØ´Ä´NÁ#¼Ä™ýi‚¸ç°Ñî\E\ÿ­MçÔ·Auõøî•Kz†æF[Žš €Ö<¾>xTWÆ‚ í¥Ï»q¥­3õ?Û 0€U –,~ O»ÜdÔì1ýZH2º<•CТ­ ÈêØjÒ=ÍÔ¯Œj4mî¾qíÆ oºâçïo¼Fí=Ì0>C.s28È5y]‰ªV\+Òçî:½2ì”qŠ0nï‘ÕüÕsÀtO@%I7Oÿ¯'»­øåj[zér\Ú—ÂZ0|äâm xßÞ{ò]Íòv²ñÑUÓÊ>Ûñ˜¢öþ~GP3:uJ¯8%ò6ª1¿ò• ãÆC5JZ_¢ÔØ°šÊ2¥]»º|BdÑiýêNZ"¶M¾^úÝPÄ´wU3£ãÀÑ“NýÍéà^uJfúÕÜll‚–¿àåbç!ƒƒSWgÈkñ œä©Í?tƒ9z²HPnì9;xSZ`K¡ˆ2o6täôíé¡ÉS;¸ýyë)249ÅG¦ö3Úô©Ë¨öœ^iL¤ß 7v  öÕ¼‹¸þ¶¢M'‹š|só‚Qï3‰ÄlÁ÷?a™·–m:!5¥åfÝ6,öt×”4ZRɵ\?»Á¶­ÏÌŠÞ—Û˜R–…ö(9õãÁp1#¨ožî½°_g›®ƒRÝ»éºcùc§"+}ÕiöôѵÌH»uáØ$´mâ¯þøKx.©+o°b”hñÜ‹FòÜ'£¦3»÷ÀÜ¢KZó×[fÔÔøtéKæ/ÂLe*°^½öç’+‹W]Ë2§Ê8èýñp2wë3"¸mÙ‹;wâmÒä·Ã›á#Öm¹µQ]ž·mÃt¿®ï=oB‚ÿ³Ðétåå¥R#£¿˜µþÓ7¶Ö;ç(‚G3º5øŒqtûÂn!Ï+·z úÈîˆûô¾¹¿5)¹qßÈi*0Ûö^¬bâi‘w„ mV"ùÖö§ÆÁ}¤G»Q“ð–lý]½êô‹‘ÎZõŸ‡ýº‡ê¨žßëݧ›g\ Oÿj ×Å„B¼6:ìИÅË¥ÿ:¼ qʘ‚’œMo&jàÄ_ŸÚϹ°wwOdÞãÒÜZÖAS’Íš=\Ú¶Âg(T¾ÿèIüÑ•=÷†å,þå¾à4E»žÑãwµü²ø>¯}vtÜ÷+å ½X|4¸±kðŠ²b‡v^×·ïê:Ê.*&µ‰œ÷®aGª~`ÃÜ€îžÈ²çÅù6"é U žrrü¢í7÷-$ÛÒÄëwuíÆ3 A{gÏй ªX£¶,&»ÙëÏÚ©zý›¨º{²²®—¿­÷¥ÈUF¤c]ìÛ0'¨ ^Ç<ŒÚ¿¹Í€Óåäå rã&mI«¨Ê{ñåÁsŒk_«-žùãm:~¬¢JͳЅIZä)©ó;"Ä_-Y>•Æ úòbeÙ_7‡ŸÚpá=;6àÛ‰îÙʼ'“·ž]½}; IDATÙsa\:;zñÜFvŽ¢èÕ»£˧¶³³4iK—‡ÌØsÌ”O\·uë¨IxŸ¯WÄØ6qJà·qe3@ðêµhí0»z§Œ÷oZ#ÍuÚ‹c¥¾¾õ4rakHJIäºËÓ.¿qÉ»pmÉǧx"uqü«¨’éÚ©ŒÂÀ´^#(?† ‘a66à+”‘‘©™YEe¹Nó[F¢¿ ò™jÑ}`Ófíú®WbtäçùÍŒ5áwNí™1dfÙGñLšÂð)ÇøÕ 'bú¢‰ýfþ|úUØá?=EÅ#öþ­ë¦y§Î±·×ˆC'–ô?W dœ˜îå×óƒƒX)²hæ 7g©‚Ô¾û¥ísì}heoB@Ô™ö \ÔÉñs"ÂI Púvè=Ô(ñœ¼àêUåWÃã.~S~àA­D‚%aÆoåý±í¬òãÍáĘewî]¾²aúÜB[ºyT›¡kŽµ³c¾()Ež^z tÐÂc‚8|Ìî^¦:š¹tœz{Ípg¿í›ZÖfy|ÉÕ߈ð¸³SJF¼5sõéÚºU—‘í ç|”£IPÅÍ_suëÁ_( €WWmÈ컨[# €?2cìðNŸ7ò¥7/ä7~wgzßí_ŠàÚZÄjÔ¿e"VÏSý|º¸G‹¿² ¸Ø S«j¦#áyKÚm?îo[G´ÌÎÍßÅ^Xí×Ù'[®/Sò-›¹7lè¶áÌ6ÒJ-eIà`joA†“8N14IœV_¨‘4uwoèÒútd¤‹NKÄ$%¦xþsYPxU®ÌÄÌÈÞµTñ¹\vª¼ë_o¸dlÛÀÖœÖ"³0fÚØ«ê€?UyA+Ï& ¸|½dïHGýª~^ó±õì‘^Àü¼~Eâõ-Z5ˆ+ÔX·Ÿ|ø[—c«‡ þá §­(Å5runÒoÿ¡m@â$ÅPNr:€4µ1ÇHÚ’TÉuµɨËs½š7iÐÀeÔw;ƒ°RÞÌLBŠ?m"á8=G:î9îg]ý;¯­d cÀ~e”7ÌÎü:@A¥R µÑŸÎZmöõëwÒRßl=ðÐ¥y-+7¸‚œŒJ•ª('SÎrw¯_~“”ý$Œµr¦1A~lÞˆ×EJ(J¸6pìö%3* óYŒr(ãR’ß¼ÒKí }îÍû…šI0X´óuìËÌGG [vjD™ -Y¼·°K‡jÝ]›v¤Ì±s#ñÿô°Ð) ³òÊeùÅeˆÓƦæʳÂÝSú™`±¡ wG1+F4ÎÍ+ဠ<9oèËÜ @¼>'+]©Sädip“‰Ö÷<‰{vWÙ ‡TbQž›’›q'ÚDÂ@iÚƒñsªÀ™zAíøÛo2n¹êØyWðóÜ…À£»Wc“Þ<¿¡0r¡Ê=‹ƒ¹‡]Åêr…úKB¯ÎÌß-]>Ü#7¯d>M‰„û‡·^nÞò+VY•^VúîôóÊz­d8YÅ_íÇšwÝ·r[±R•Q̲Y寳ã^pØø”ÿÑó'º*ËäZEVBæ>cÉ¢ _0vê‘yïu¦²4íÙ“èêÚýv¼/uítvʳw2?Ã%.Æ…™¹=W¯I¯ãë)P¨’¢²~IéoŸ³Ÿ*¤±gkoOK™à ú¼÷owo?æ5|iܼ"úÁÛÔwá÷]ÍÄ`€ŸÑ†V¬X¡×éÔ*DÑN_4Ï®¹öà±£ÿ÷“}Èš[Ê9ÅÞí«”´YaÜ ™¿$ëþ…+S+Ͷn]bˀشè維»[IèüŒØ¬â‚„Øg‘1™^]ýûé~;ä@L¡dÉê•2²ðõSðìíj $%‰ É5’æÍœ¬tòüì«!~$€„̇·l¿ rs0ù_nò¼W‡~¹’Ïhò2+ðv-\ïžÞþ®bô¼ÍîV’ç‹+ó¢£EÆ©;tö¦16#ú™•Ow#‘ ÉÝ°nµÔÎî}ì+ë6½:÷ñîúþ'9ôk—Ø™6t3)tóñ;÷Ö~¶¤9vhbþ)ê$¼¸¹?äÊ]Ǿ+z´jT¯eÓ¼°£ç¯°-Ûz{·n×äÐî&fl¹¤K÷2ÚÚ‹`õ.N±Ã¨áÔ±gÏܼÏ8whÕÄAU¡ôðôm©Ö¨…‹ƒ9eÖ,íæžóÞwèø]ó­„isõ‰ã!ÒNK†ý?ö®3 ©e[ÏNO ”„ ½(ˆÒDÁ Š"Š€Š¢‚X°Wì½w컂Š¢¨Ø@A^C/ÒBž½÷û§€çxî¹ïž{|ïäûÙef¯5³æ›5³Ö¸ Áa X*ìÅ3œØJêFPÜùþB\Z­ÓĦƒœÔqý®ÃA7Žáb¡ Â°p&݈¹ß kŽtržèª{3ú2_ÙÐ@ÏÜÕypÉ»›7ã^¨ºïžî:›Ý9›˜Z²fµ‘¦¦­»wzlTbV‰Þ7SM«£@2cSSFÝFUŠ¨à^¿I_»g¯0dGWãëW.‰Ul‡ µA­¸y/¦^¬>ÊÉÑÙc|Òí“•BUSÛ1NÆ¿Ð’‰ºE}g ŠÊZ›ê²>g븆†ÏÅk›ªîÜ¢æ²n†ó`,¡â/×®'ÏY@RdBý'¡§§…NW—ɤD" A(Š"ÃrF`XNQR&I_3ú··ÁE¾Pàÿ4©ÇÌtóp¨ë_AǪ?^ç©:¼<¶Šµòa ªBÞÎ]>voã^\QQìÆýGMª›òLÍ ¿ŸÑ_ÁZP@þ%Ö"æ77¶÷”5™Út¬bû… ü¬å+%’…¢˜ ( Àï¢P˜4…Pà¯æ_XüÊZ$b€Å*$¦€ üÿ·±8§¤šiãf©ÝöŒŠš?×É -ØêòMHa~‘¹µ5AáwQ@ÿá¤óÿÂN'”W›2y8…=ØâEeϯ/ÀbîÖE#ŒôtÛäE2.,±6# rrÍåJDöµ'x §²ÍØ^ (*®‰c£6ÈÁñU½HÞm­Odëõ˜„‹•·×é²l}¢ßÙ§E*_ïlBv™¹ºYŒ¢ˆüÕQ?3}ÕÕgý§¶ ´ìy¸ƒ)!ôüc"ëÙ¿ÐÎÀ¾ñÂ+E?Ý°·¤X8¹æµ‹HÚU:cˆ>Ó0“€¢òÎM³,ئŒ=ïÚP}r|®‰>e䬵íÂqžhOcÊèÁTGï%Mâ2Ͻ6Ô‚d:tXJ}*ïŒZ9Š­Oš´üWúÃhE²îl²·¤X8»åsÅ(@«>œÂ&]t¨S†J»«Wyêé1N&ä ¬1Š>>6ÇDŸ2*`}‡æÄFô5Ë'¸QÖ[4‘Å6Ö »ø AÐœûÛ­”Ìì>}é‘sß:ëÙúD–f屘tçŸvNŸ0c_qÏÏ™è“g¬hÀ£ÀöŒ%²õ :L[Ÿ8%ìiújÆÝ´ºŸ…™p:Ø\Ÿd7arU‡hÀçp^F8™“Šý_©«ûƒ©]ðÚ]ÏÒŽÕó¹áç_D͹eu]lRµ.ƒÆµü*”» ¯@ögZ+*nt7À³ô)>k÷öÊà ¥Ý zÖ©8ÈVþFÖóÎìÚu8¾®0=Õ•Ýo ƒWY´ížß ¥ÏŽä¬–ÄÓ+üƒ/‰ú.eæ°‹ Õi¯ÒÏïl“õìŸ57ìNYRTÐÖ•‡`ÆÜ%%e~Z£ŒY`LJ§wÜ™÷„mOHÌî¸âl?þTÄÍ©¾ÝP%†™Žó¿«Oºº9dñI‘šÛÛ’Ž’â–5#­]ÆMð ÙpÚ¥ó;¨_‹+¾ù‰ò©´ý¢kòÓ¬²¿Q^Ÿq s‹¶äwÜßíõ³/6™eµ¿¾¥£Bˆ;¿=›nìYó¡Uδ_syùÿ.QRuo—ÓPåGIõ•¿?8ãæЀùsrxrsm Ù¼Ô3hÓI®dàl®;cMðÞmü¯i¬„ ÂMô œ_ÎtW¼^½Ð}ú ïäŠV˜Ÿ·x¶soÎB?×ã  wið¤ûªûÎ]BDuVOóŸ7¿¨K à®s;C¯êº¥Yø-‰¤?J¯wL[}CŽÊî™>}ܦÓq"9úè슭ç_œ?fÚòSB.‰ßå?Ã-$lo³ ( À‡µ ÝE©ù—Om[³dîë¢/ý,žÍbSˆ8€ ª¦vÁ»«ïÞŸâ1 7®²šŽ>C“ŠïÁÑô”qJó6­|yëpTLšè<¯¤D•Ô礲 èD¢†!¶øôª÷ƒ>¢‡Ê– ‘H+3„Í©&®¶ÉYfvúïZþ±³ˆBÓ×VÿW‰Á’D½ô´Öì@t L4,Â7f=àø žbÈf‘pX*ãßNëI{r2rCðÉ„„`ê¢Ù~2êÀÅ,ã~Ëþˆ¨1¥A*ŽëÕ6ë­HPeº&çãõ W/yÏr'ã(†&&ªÊÔ/<”Ébü0Ò‚t Ltæ·Áv~Á3¹É7u\GÕÖ”a±¸Þ1 ÷Ôvõœ¦#è­'£\Î6´7bé¤ò3«yìI0þ`ê,]"Ì“©Ñpƒm¬£AÇ#<–í"GQ¢¡ž×ˆûË‹^…¥«©þ5"š`<ŠÕ{"êà©T–“Åß™—HVVVRÆâHJÊT2±_ø†b„Ô§ß~ô¤A¬BÂcTD—âÊPTÈÁ¢ãÉ4mu¥ÿMÎjTÖ}ævG@ø†7÷•™“Ùçv-œ7u_.)L+ñß·ÁâÍ­—¹Tq:ÀnhíóË"6îu\rú̾p%<‘tF^¹|rçÁ§{”m/ÞÕUvå~ÊZß!"ýüÕgz E@‘¸-s$#6\éá°·‘—|Ì™°ùÞ:ƒ7ñ)ߤW0d%µ¡®nÝÙwDrÔÆcÅÅK7í·|à´O_µ{é¤ðëÉϬ¢`€ kÔ‰ –Z×í8“¤«Pà¿ÄZPX*Qe:xîìVׄøøïWÆÚiª›Ñ›”ßpºÂ’Ž=k6MY±™‚Š?ÄÅšŽ˜6Þ–ñòY*Œ¢ éÉO‚w.&c }eÑçnDß{›sãL+iðÞíÓ–Îp8—Û¥ŠA¹EêëêP N"WÌ]€flÍ9=ÕÛ¯JÝJ† ~CÚîÃO®…ÿÎR=Š"y÷ìUÇïY›x(¢GØœ×OœìkC).iêìw'ÃÛÛTÊ úí¤c1ÜkŒƒUZF¾("«J9‘iºiîHÖ%%~Ç=Çžß‹ƒ¥uÖ‹ÃCÝCÕ,˜âÄSÑ—#ýš,*mÎoF'Möµ&•6óXãB®»qõ»g›¤ßöÁíã»4B¢ix, §9sÛ®;çÂ' Ú‘}røÜYtôÝ»åshâdßá*%Eu?(_& ºzé¢9¹uo õ«òV«qî Q’¦û:£ÆÓÿÑ­b^mä,G´AÓ{ À ¶±TÑ6Õ«{Ä#*&C«“,&úUÔÕ|×`ñ¾P§ 7Õb ÖS¡t·åï]7cîâÅU%Eä;=N)•»vзtѨŒçŠQ%=3K ²…«·û·ž ‹ÊXøâÆÖ¹s§Kmp†@d•Ùwƒçxl¹’Èo©Q+ø/± ÕДúu4“¢3LF{ήt±[€y­ b rÞ™ùÇo¸1ÍZ H;o¦HGté>Qøéž@Z—ð¾#ØŒÔÏŒ@X À˜ylMHÌYm«Jd;St* º–®YÖSY=B¯Ð=C n:ó*ñE Þ&7U…G¿§EêF®Öz‘| Û€ðÊv8Š€;’e#œ,m熌ͨjÈ¥‚ÆV†¢3„Ún<ë£R'F«/‰»¼½µõgO—š–‘‹Çü®ä»\9¨N½° Fýøïjo#*â„EžÜtõ‡U¬"ຮ9«Z“«ÍÐ'¨™»Ÿ•øü ¥cB^k'_€Û“äF.Ž–¶ Ç|¬jêß,hOG#_(éðm™Üh±H‹,jåI`qO;–IÁƒ?´u•¥2æBËÝÖœ/ÒLÑüùU}õBº‹ŽÝj‰}š>  [¥€_ñ—gðˆ†‹|¦O€aå¾kýæ’ÎðUó’3³ß/ž&={¿óêò„¼j©Z}öÜudšÍ¸{UcõÕsŸ?ôë¸sþ5’ÙÑË'îØ2 ¨÷¦£TóälÙlonDž‰K—JÅSVŸgà‘¼ÛK÷Ä• û½&Q¨Ò)â™~ÓOÓûûþƒ“úW&m‰8r§²+!¬§mÿJ߈•³ÊÚƒ<"ŒqàÔ’™ÕpxðD@pùB¸*Ä?>ÍÊé:g’™–¼‡²pɧªÂ¦…¾›.Ä®¿pzEøÔs(fÎÁ ê,º­ h†ÿc¹”¸û¬% ­8Þ%4·0ýˆ NkÍþð5Áž0^sý‘0Õ/ñ^p45Åb¯¸ŸV$‘ þ;N1à’Ë"U,Ü?gÏo§ƒ³ '–úgV° ‰€:áÊ…Á>¦3¦M€È†‡£œÅ-ù‹V¬ì’Àc‚êá!Àëƒ *Ë.ENÃéúÙt/ðõ(—‘wŸôîζ“±)R™xÒ²3ºPéÝÅN]qa¾â–„-+M9‘3ªï¸x7%lnJ• 5x"P{éb$\öî±ÒÊH­Ÿ6„I+|¼wÅ}ˆaà€¸Ro`í±=xò#«™gvù¸¡Öiàê±X3ÅX¥€_I…"Ëœ (ðÿ ¨üá";éÊ”Ù6jY»r÷á³gyVPàGÆŸÈ2§€ (ðÿ º.ÿó 8–F§+d¢€ÿðÕ×"‘Âjj _‹ ( € (ð÷ ´8ÏÀð_óµtw¹L!1P@Pàïì_à!Ø;vH%¡ÅÈE%Pi{Êë×eœ2§¬¡0è¿”ŠÂÒ²üŸóË”YFÊXÐY›ŸžYÝØ®ÁdûM&æIOK*åÔb©šê|kyÆÇÜÜúÖ-]]}z—[TÒRµhTA'=#µœS¯¤¡K%áîMON&1)X¤¶(-ës>OŠ×ÕPƒ ä†\TÖXšù17§…h34qi¯ú”–õY„S×R£À¶̴we5ÍšLÛ/¾ …ÅeÙÉ9…Å"¬Š¶ºR{î‹Ôüb§BJ7Ö$÷»SÀ­ËÌH)åÔ+kè*¡¦òÌŒœÜæ.9ƒ¡…öV&%§VrÊ8œ*%=c*îע܆‚ŒŒL‘2CS™„Â’ŠÜw9EH™ASùå%ïiÌÊL¯lèb³t1àÖ¤~Ìlàt´iòÞÖ¬ôäbN Žª¥¦Dð`}yÖ§œ<Œ®‰(ÜÂÉúð)›‡ªèÒ©’®ÚÔ”÷ÕÍê &y@H3".ÎJÊ+«¥ë²Iý䤽íéÞ–VV£ º2±£6ïcvVmK·6“‰Çü(í«,õqvi‡SÆᔵ‰Õô4)U…©YŸ xR²Ž)+9¡¨¼¬¾µ[[‡Çþ‡+Íã¼ñºØ4w¤þÏ­,ÈÂЙ}Í·edU0õtþSý–ðß''–W–5tôê1‘H쥪öwoÞ”sÊ8œ2 ^MKM hSá» ÐÕPmËNH-(åp*dÆš¤B(~{Àký~3›ñšÊ•—|HìÀ¨iª*€Jùõé驵-ZlýÊO)­I>½×4è.~¶h±W‡ñ¤áz]戤=ãûRNµœ¢KWÆÿ‹_¼Œ¤üÒr1V]SU ‚@¥åiÏ:•ôè|gcÁÇ™"%mM*YÖÓööÝëJNYs·TŸ¡É­ËÏø”Yó¥K›©‡’²Ü”ì¢N™’¶† uçg$å•rˆê:ª¼´«&%5µ®]ÀÐÕÁA€[——–ñ‰ªjÓ”{js’3³8œrQ‹©úÍÀ$ç¾›E30 žlÏŠw?êïµ,D˜ýî Ð1¦â@MiFvn^×DU¤f}þÌá”qªZ†@Ôšúîm}§œ¡£%ã•&¿O«ä”q85*ú¦JyUAjV~¡PIO‹Jõ¶f|H*©jPg°)xÌW-w] Õ¶òé?RHÔYû1ý}y}›“…ÿÕèÖ^[P%§iS°€Æò2U+Ûa5zù»ýCÒÛšžú¶”S(êJ˜¬¤Ä¢Š§¬¶±—Ŧ•ç¼Ï),æÉ•tL?•#_>¿–©²Éø?y‚ )Kÿ˜S“5è*¿ÒŠrKÞ§äæõuyN³TŸI-Ï~—SXÄ“S4‰Â¤¬z}¶f| 3õ1¿ê~°°%;3­¤¢YOŸÃ @OO ®.“I‰D‚PE†åŒÀ°œ¢¤L$’þrkaÉ:,6“Éê~½ïÙg~?ùI»ÞeEŸÞñ™€ÖäåHˆêŸ¯¸nz3 _ ¿­¶ALQ‘-Ú Då%Ò°Tzñ£­³çÀ₇¯>S='[ä7÷¶V—w¢TªèƒÏª(1 P.‹Yµ¾¨q?û­¿Ê0Ô¹¶Þ«æëX’·^¿²«EÅbÙÚ­»Õ0KʼnD$~Ó2A/·¡NLQA*—,\&Xm==&“MäælŽi‚ÄűÏ2•HÒˆIìôþ²uvQy»à—#—Š~ê2°LÒWÜ·I„ÍÙ#}·)¼õË—ö³u Ñt™LFÚéu$M&K‡VøxðùL==íŒÔlXÞº-d~‡–ó³7ï86à¢ÆÌ䌷VDtËø3Áýýn\¬²™¥ ‹”kmØ6¨ß²ÆƵw¿3lúB’‡V {ÙüÍ#îv1ó{@î÷A¿ MTQ^ßQ7ož¿w˜árêஹ›¢0F™F36`“ ™äÖFùîã|Ÿ°ÃÎg›Æ;1Þi‘—Q¿´O¢–\Oë ÞxÜÛÁèN€Š‹®oÝõaæŠ#FÈš/½jÙdÍàTÌ­ì`Ñ—M%¦'œ ,ˆ ›µ|á”+©_GŽ[QŸì§Þõ1êü/…ª§5 ï¶ÈRÛ’›G¸ìçÑg»bÈ‹ßu½Îøî~÷ïY3XœY pmg¬j7 T¸{Í| g/þû“¶«žÚö¼˜4cádú¾¨â˜˜õ×mé{ˆ¬gwûÌ©mëÆ ¼sªK†hã[£ïgœY5, 0Þ›M?.;ÑþUÂÜsÛv'm8f¦O^wê2 Þ~l_±œ´c÷PäiMݼæFÿe{ÌLñ¬ã Ûü>v¯n«¢ê½ë"ìáL˜°ÒÛm kéÅ·õ<{ç>Ú·½hȾ£§¾ñ—HâŽ%¬Š˜õ.îMp¤·¼5qþºhÏéSJ{WD.ˆ¹¥þÁ›#/^­Yý¾­ï!÷qˆ÷DÕ8-WÛ×=ç…„Çr³úqÐÐ5ÕÐEÛÞ.ô \®$©ŒÍ¤\Ù;èÎ^rí>~Ò«! aå­¥1š²÷ìG«ÁÖ§¢.¯=| r?5(3ºÏE×zîA° 6læ²>-CÄÑ 7S*-j…h÷»nMKôÕéX‹€=®ýÆ\=ÝÖØüí×É‹¯:±LÌ)Ì9røòÑë×éXðn礳‚q¡®äù–ק×m¿Ñ÷”Ú°€èmËõQq©’.‡pæ¶ 1ÏFlÝŠ¥vl€,bµ³«Õßkˆœ²ÔÙÓ£2)&ðP|ûéGš†­›¢qü£^ô¬î›/õݦbí1V<|çUWWýÊÄ»)<ăö3ᆔt̆èˆSU”[Ùi±Ï_·÷ lile*\j]_ß&—%c†.ä&†,ºPþõÃ}OŸ ôÞ°P/îJZŸF~$ÖÒçÎj{%1Є,ÁñW7Å¿Í ¹ö@¾¤ì;pëmÈ2€/[›œQ6+Ü¢ÏýÕ”wN¼à¦> äó“W'9¸î$HÏ>µõÀ¨¬ƒEÇFš´5²°¶Y‚ÿd Âê³ÐÒ½.²š·:tÖÊEËÇ:iÖuÁ~“¬.î\“AbEÍB ~ÅZT˜ƒ,ë×lŽ|,Ô²£b0Öën¨hÅï÷‹ŒO<è=@_(,zs2xä¼MªX@DµR{Wít뻚Ÿ`¼‡ùQÖ6µn]¾9òE·ÚP•FY8M×Á˜K;mï­lê1ïé›ÀeÞŒ$»Î§—5pyÕ —sÇ}—. ·Ž½m;ÁýÂ50·Õ}¥é€;;E9ûüŒët*ÚÑ+@…^Æ¡ÑÉ8³©PIËí/¼öc²pT.*éÀù©+ýâékùxòÈ–š”‡¾[žýUV±>x¾'¾Ê§Y†5³vdjh >ÒžC‡Z)+Û;Œ$`@z^‘£FÚ~~xã}»Ü\Ð+K5Ì'Ž0pÆíUwÿÂøû'}Ö®=tÛÍ@ùþ¯jtýv³êØûï4ûZ'ô0¬Áêê'|.|IqÚÏŽøôi IÇá¹{}ÓE÷uJQùîò[µùs•ðÏNo£{Dªuoû¶ŠÞ°G÷ãH½E;v¯p‰y¦…¨´õn죣G¯õù’¸•oöµø_µÑJG¯Ø¼¸gˆzy·Ò[ì©zd¤rO1FB“ó*ÕÕt6/š;ÑK¯‰/áµ%vAÄIX´îô‹k›”eä‚ÖèÆ‘w¼¤¯=† ^9çvÚù_™ãmÙ·B„9‘!¾sO¤ cª›qœõÕ±AQ†N/_¸ëYFTÌïíd8´ùéÜGQˆ8·"¿\k-=~uT$Þ{j3ç8@Ñ&~½ +rßTç´ïc&Õv-ºsO|öí,fq†ý‰©º‰?g—Ž¯MþX6;,åÅ~.\¾x–sÅçaîÈyF¿ø&Y,´oû558Žª 3{â…µ ’´£«fÎýðG…a½ƒOòÊäºvnAœ•K¥<A`t\·œtܶhR‘0È–‚]¼îÔÜŠ˜ÑË÷ø½<%ª{»ïtâÍk×h8:u×é©;ü=§Vº­zYÆy9Í¡¹¾*w[¸U(£×sÏ…YöÉýnÕËB ÿLÊ"ímܽ0`ʶøaZD.Ý’¯t÷Ò™ǼôÕñ®Ë.9 ø‚Þ¦Ï7S ¨\*…ð,¦Üdl}qÔQ)*ÌóE˺VNh¹{lYòVŠzã T&•âD‘æ$¹Ž,¹âå€@&j9°8Ðu]Œ£6~âç®õËX}] åràñMwEÆMÕ NŒ¢EoŸò´Y6KïÇÈeŒ×Þ~áy'ÊnŠª§¡¨¼!óÒùª¡g·y÷ÙUX.EHa¨J4K·é =U#R{mkɉÓ×>dQ¿ÜòÛr|2© G @ÐH¨Êð¥}»\ßÜR&`¾ªGÀb 0êN›N:…[=1O°|8I½{5³ÃSŸüc¶4G¶ É»x ©öõusoß…ÌÕ»© Ï‚”4Ô°ƒÃC?/™õ[‡DùƒÃB(€ T,¦!og>¾|lÞ]Ï{gæ˜þjˆDy-ÕÙIIïRM\B-´úqQÙÒ̃уöÕˆd)µueaž^ˆâ6âÁG[-rùðÊõ°Ô–¿-¾ÉëbkÒsÖ*‡šh¸Oسæ½ý]ւʹñ—¿¿ZÉyz¸7‹M;92ü$9µ°Ëñ¥›Ç'W»O0¡ý¾41tk¿Çü$-)®“–{ÅN1uòY·naßýw÷_¥±`qx¬¸)-héú¯¾–C|ô%^yü‘‡uçŽ&bAfuyz‚÷Õîz>6×1&Ë•ýK“#(ц˜Ð`gžlMHxcßZ‰Ëv/ €ß˜¾cç…k·0HX0zé³=r¨¹|CUÕýXêT^‡¨!>û@NݘLJÏ]º•{Í›iDPa±T€ufa÷,é’å_™ê®¦¼8+pƾX™#AÅ ‘HúÕ|‰è¹|ÙñSÇ_ðüÜü o[ú~÷Xqìu]ÏÓù®_ª©UsÆߺKí¿<×Y™öD;b·6#V§¢"ã øðÓ4@ºžWvGèHN#* 骯׮ն½È2ìd¢/™<áѳ†ºÞ7Å÷/z]lmäáOxÎZí ¾hí©9Sî».Ýí3ÞÀ~¤­‘‘Þ”Ñ'[x¿.— aLkz‹Ÿs”îëÄ™~3AÃ)D#ƒ)¿èzpÄW燚CÐýýki#"OŽØtxåÄ|aèp ¨xr±žÓ'ª®ú”]ïÆÜ»Gûî ‹Hºí½­ósék)IX"…aP‘v—Þ[¸ñôWj5tÖžÉ:u­*w/í¾9Eï»Þ²Öà »/€nšçñÑ×ËièÒ”“f\ÜÊÁÊíÏÍ=UÒw›îì«7B†ÿ›³Çÿ‚ñ’u–lxDOØ­óÍš«¬º²¤½««®¬°CÕòÉå(–­cgæeÄÊ] ܹÇÃfôõÂÑlõ¢×JÅF:¢OIUÔ• }ÿŽË#'¹æ?Œ&[.ÆÁu‹–íÚq ¹,2œóòªPÝRû¦˜éêOxõ*1o‚ûŽýdÙÛO7.æXI=Êø§&ªy§f]ÖE›k›qL椆èù¯¯¼úœwc-Ôù9.¯V“°ÕjýyM<`ÞA ÜMµh¬'-Üåú>›·*8yà²ÝÇ÷W šs• o]ïá±ìe¾ÅïZ#;©UYÁ13Ѽâ¬æwÑßZÓD0djŠÏòô\™?‘ÂÇ{—Ç©'ÝZE€¿SVÝÖ.(¯ma«i>;px±ºû›´Ö°ð¿SYˆ¨­´œ#q‹KË-™¼½‹P”Ã7>‹xt²)çö¸°ì›§–W——›X˜“0àÅÎ/TŸÙèh©/­ûÂm)Ïû¢f9ÊÙþøá­ Ô'äŠÌ"uƸêYäqZ“@V;×}é¡×/õñ`Ö´!«Ïž0'ÀM^Ï"Aæõ0tºpª•.'ûf6—Å‚ ŸäAs ’GëK Âæ³Å¥œfsc]ÌènÁP7Ÿ]î·o—êjŸÂäÜ9«fa‰4CÒ«|U’<=¯ÑÆA—ˆÇ@d:®»ŒÛ+ÐV¦€V\^ž?nkrµÒelÉõçy®¶æ1]â½åúÅCƒ§o¹t%‡°¿³æé˲Ž$ã|!‰Jt¼’ šyknŽý9-¢´õÝñzϵU?¿—\£ºÂ=¶ç°“»ãë‹'ÜøÎá’¦´7¸y/ŸŸ&Iòç&k_ÐN±>§áLl$ºÍ8Zè¡óNÓB^¦>Ðû½­›pÏÞ•aÃæ-Å÷ZC• $'Æ~t°¦·1&8ÙZÌÙwØ=T9»¤‹¬?þõ«Ï?Ñ?ˆÊü—GGØÖP^ˆ1³Üq" ´êyÐ#Õm£X$~;§¬º­W^óÅ×™šñ…Nã¾|X­¹Œ,}>ò³öÊ…FÒ’Ê&stmhØÔÈãœÛ‚Ü]_ÈSª8ËÑgIF“ÏÕ’-n<æºþ–¦,}3ñ©‹Ê %}ÔŸÅ^Æ2Í{3N€3ý&,hÍÇ+a×R|ÕÓîFOåX¶|ÿÆ]n&ÏS¼—a©¬qãæj¾´ºöÊaŦ¾á?}³Ñ;p.r*cåMe<ÔTSÒØÖ))ÏoQ³bPIYÉ·Ö½Cˆlêç ¼”+¹cðЛoãÎÀÅNµØ}ÙØMÖh6OWÛa(fý­ô<þùó&~ñ㧌[„ŠË®ŒQ]i-?¸s¿ËDׂ¸«d«m<µÈ#>Ë©`ï çƒáýˆ6a£Òl0Œ!üÄ­ÒôÿžÑnùëWË~VPUæÏÝz²Ï …¸¸ô´Üÿøx5,Ý:sÛÑæ²ÏˆÁ eÒ:\S^@í¡b‰*ffK3—¼4‰¢Ô&]ö›hY/|ý*øçâÄÍYÙ«ÐYð´Dùžú÷¼ßŸ/€ÍF1x9u˜ÅJ<ƈT5Ô—ƒÀÔ;¯§ ?½$ܲÒ2±¼»¬´Liˆå_Þ ð—Çd¹©«¯µm aEdŹlë*Ò^–¹ ÓÞÖBb:îX㣂Ç«i0ÈÀtK"+u6Õ 0ÚÁË–±ÔT´U¶v®–Õä Á(@DÓÐE|>Ÿ¯®c¨GSâ¶4ŠðúkWk) A–‘±¾šªÑx+•úF®ƒïZG=ú?5†H+QŸßt6“åå6¨ù‹pJð=u%,ÛTß ií·r’-«a0ÈÀl°2GgÛŽ5×µ =¬±f¨ÓHâÖž¡sÀj/<€ešë! Ã(›°Uzº»ø=ˆ¾!(S°R>¿ ƪ±´Õ{y¨Ó­ŸâH*šƒ,Œôè:› kÅ&¦j8”¨fiã:Þªo陸Ɩ¡ý¬¥!¯J<ÒÕ¡—/Ò36ÆI»jÚ$¾Ë÷ºÑ`€³2¥‹zºø=R=##"(k±ÍYêhPu•Ÿš.Ò§ë[r3#V6K‚–.f©ÑÝ||;kË †ã–Ì÷¦à1"è˜ê  f1ÞŠ.í&Ç+á1}*04·¢’ðD•×\Ó èKW¨‘…M5ŸßÕ+&èkÿ8¬‚pƺz"1Ç;ëë¿ð ‡aiÓØl–Sû/ZñÔM˜Zúu-mMÛ ×|æp)F,5,QËÕÑ(¿¨˜¨Æ†›ss ý­ð=Ó,6PW"«)Ur*I†ãB§Û‘úÉãäæe¬­ŠÅb¾5X¼RgcÏ ^¶^[… Aa”ÔÙzÚl+Â棦›é©A軄!i±YæºZ4’¨…Ë7q \î9äÛà¯öš…Äaã˜D©ká4ÎDWC ›ëëÐX¦S}¦! "¼öPSCCC#šºîèAT¼:[‚ï©{Q‰w²cÒø»LMµÚ[ÍfㆠueÌX×®º2Ä°³´bZ8;3¥uã–†’ >>j8ÌW@€ÅLM™ÏïîÕ60QÆc!CTa1†ïKQµÐØLT ˜ºíõÕ²ñâ%Ë5• B<[KÇçwõˆHFl5Uwóù]TM6]•Âk¨DµG-Ÿ3C™ˆÅ⧮Ý~êÊ™öú?ÁÕ¦­±süÂ-:jT"ÜÚü¯ç¶q®¥_´ "‡5­Ì‘ñ8M†‘*Š71å6D‹SUÏ°u5ÔVe0õutô-ÆúÉEr¦®ö—‚úÆ †¡!“­‚ÇÔTävÚp7IË@“‚E!†›¥ šŒ˜.­+f»Ït5Ç´› ìÆÒ©$At›)Æ”ž6X+rÃ\:‘h7j¯ºLsä’é£m XLŸ–Y,s]m-† ÒÚÎÕ²òܸЂ#¸Ž²o«­5öÜ8ÆÚû분!±³4³´0dig¯IéMzýZÏÌ´±ª«cÊbëѨ3<æ—ï!‘©Õ½@c^è*}5 @¥ªzCÌõ°ˆX®‹ˆø|~—š¶å×›ç ]3^O/ŸßÕ+CL OkÛZÑSìL i:T²±±¾±~¿âT_7ÆVÔ/h™Î·Q]¢±Í5õŒqH®)ë¨këÅÎZºÊŒ®ŒÁà†˜:»ŒgÐU úÕ+!DÜú¹¼cì¤1’¡®¡ û¯Æ)2ú+ €ÿ,TG0¬† (ðÿœ¬‡—â’ænža¥ åå\K™êbð'ß$¿wë¾WÀl¥ÿ+³?iÕÁíGÛ)ò0».n˜æíã:uÖܵ½Âú{¾c}}G°Ö}Ï• °ƒiw×L­³åY.@ÔQ2cÔ,ÿ±!EÈß(/´·äÆ‚CíÇúK` ½7vÏöñw÷ZÁ•4<ží;ÒkêˆÍç}Ãù‘›G‚Æس.ÕÉòîê#«'yû¸m¼úAeŸn­öõuŸá3ñ^VÓ€ÇD ÉKýG͘>6úcýp«ÞÎtóöµáøm9"‰Û·ÀÇÇÕË×ëQqד\_3v†‹‘…‘ïØðsié«wÓê~‰àìÖÙ3|ÆÎZ0›Ó. gÎËH?wÖâS±ÿ›Òå-1¦–©Ü?˜™8ÌØ8H~ã/1¨8]-µ?ŽmBµ.ƒÆµü’¬bèèü©ü~¨¸ÑÝ€<ÉÛmNè²Üñ·ŠK»ô¬óO(DÈñ1S;ô®üî#‡m )~›üË`‰ÆlÚ¿™pïàœ÷½¿üK¤)ÿ\p߃#>ž£}ý'^{ó™‘¥Uç—oŽR É ü¬EÖ÷º6&æùÅPÆóÄÔ__Á’è;N<òa Æ)èPìƒw7FìÜrcà@…¢m9‡ÔG:}Ý»Œ"Ä7€Õð¼v?)ööm#‚–³1ì°€³×¯?Ýîí °´¥GãããRŽzÏ_}ƒ!P#?ðkþV8–zìI|\Ê‘I¸ ×Þô¶¥Æ“ƒ>Ir•Ä䉓§î‡œ~yëÜáý+÷ðú瓯/zÓì}ýnÌ+VÇËJ)·|ç­7Ÿ,4¸Ÿ|ȄИ‡©OŸ¾J‹¾ÐÔy—r|:íÔùö¬;’boœ·Ðä¨6 _Æeö‰«{¦õíl.OªpáNÌ«Á¢¤rÉß(/Hyð¼ËgôE1É[_%ÔèÄž<3½%æy†žõ´»><}òZ|©yà@ƒ ÜäÒ÷ϧ˜UNÇoß|¶oÞxŒ¼ãú…'ǯ>»6òÁÍG{xh›ñ¢{w¯œ;¹a·ÿÁtc·›1ï?zIοۂ}"¯ÅÅ¥\ ÷‹–ü0´eþ‰¤Ø;XCß}t0Ô êG˜Ÿ~&{ð0éÞµ»&š”3›üÛä(@wÏÿ´Afâ±ïæ± Òÿf, Gœ2Î0!± ò‡!–“g¸Ù ò¼A„Ê¿,›aççÆ´÷^Ö(¨ªÎWž6¦<ɨÿúoñ}/g-ó¡Ã²›ùÜÜ;îŽƦ¬Û™ÕrîWËþûƒ¨ëÎ}DD-cœs#. QPTÖ•4žm1Ô&¹Q€Âg:.›l`>ÒbaÊ IDAT»’ÿÍú‘ëo ^zBŠH/s26Vó^}´[Š\Úì1wë­åjÆÂzyæù9¦ÊN^e]pªEgYV£ë‘¤øL) 3¯Û-Z<ÂVsÍ™G("¹é£å=ÍÉÖÉám“xÀ)’šXskƒ '“ûúºLØ0ÄÈTgëµî blL Ú-E ìÃÏÆη¥O>*DAüQg{Ÿ’/=DÆ¿¸ÒÑÔˆ¶éÒs‘?žo8ÑÂÊä~õ·œŒä{èŃ˜Ø7'¶ÕKå%7B† R±wŸQÈ“É*Ú¹¯‰¿¹ÞØʤ¨]Оum¼ƒ†‰…ñýÏ( Pà¿ËZðú‹'NqñLüþLéÂ/¿‘§O…Pú×KИ¶ø¼Òd»>ÿ-R·ÀØw©1å ×’÷ºÈù(S«làhƒÏ¸°Ó;ðàƒŸSRnƒÃ'…²·9ã…Í™æ¶*¶ïW25Ho–ëS奥uù¢¦÷ýmŽ±£Ÿ]ÂÔ)S¹&ó! §yÜâø!c"~ÓªHëã©ÃFþœ÷9%·ÖÉsdßßœWw{FD|ß#Ͷæœ4kòÇ*Æl+Ò"4¬2 j¯êHÞ½«¬mmøJË¿¼ë¤Ñþ´žSàÙ£3–îéÆh¯Û»vÉ쑾ûrWo˜?à΢9™÷rýåÏš½Ÿ[’w¤õùÂÉžB»…:?ÍrËK? žö"a"F} .÷Üœ«rêaxŒtóÆ'€ð‹(£Æ0ÿ_€ÊxGãñ>ë—p?Üî£InsÏd>Þä9—+G%RÆÉ—uOWÊo&¤ xæþ<åðÌŸ(Y¿ýþ®¸ŠÏ)¯,4(TS;/kŠr²î;Õ¥:2%¿ØPÕ-½´çX¨3†ÌHþØ4ͦ/rymˆÃö÷éO.ó]Õ)R©Ê–• …/Þ—þfm5Máš^‰ä¸à]O‹Š7›ÜO)oY´÷å­ÝsÏduU½>DÅ`ûÈ.踿Zïà©„ï{~þ§Åa>¬’[e|9€/py“ÝhXw7½žºúVúƒ}Û–÷ö?°Šhè_œžFÿz<ãøt³Ð{Eù嫧XAò†Sê¦âoó%;®}:¸Ìÿz^OÕ³õx¯ÿød…qŸý­Ï}hp · Rµàt¾ w™s23îøöµ—%¿é%…TØ´ŽÜVDâ¶ôœÖøíN[wÜÅ™„ç¾:áx´ªˆc¥©¤b1åÞëšüô7wŸà)¶.(Ðyþ.D\}ó~FÔŸÎÄ 7¾±Y>õ;•™³öŠÓ§¸Ý×ÆÜ\¯ü«a 9î ÓöÒ­ôòÊË|‡-‘©Tg—S(g&­Y©L@SÞ< ¸G€ ]ßõ.€EÓ&4¯÷cá¤7×7Z„nÁP(û'G•4ãƺ/–+¶:3xyLtá$­-&ⱋŽ¿zãÒ ¬²Ee@~×êì¸"ǃ—暜؞ßí?lÉakº4]×Dm›|p@Ž+~CZhØ«m§Ïã!€"²OwÃ9¬y;Fõ¥”Ç'å/Þ¼ó]¯tcþ“\›—Xžß½!—è öC³Q‡oß0ãÜ­CU8€\Pµ~[ìÒÈS„ï: ìBû×üðht^kгC—"&‹¢ŽŸ»;êÀâ~ă’µ,ƨƒ’[ØoD„Ñ{ø¢iù¡G¥Óõ  ìÍɘrý{ 1ÿrA8í3w’JòÓŸ]žÚï?Ê{íTï¤ÁcÜ”ÿ³'A;'GF‰ô¾‘“ß…pºl¢Š€ÁÏî– J:zš$ÆrDヶïv¾@Ýj°ŽZ_Ž‹¼ç½nb¨ÑÒÔô‡Š"¥­X3=5*F“›Ó-EÉtmM2Ž¢§&á §Ê‘5ìÝ®Ì2Gª;-FHûOâø±GB+(CÔE9bØè»FVùú…°]çÈn˜J…tíI8¢6\Ô&§œ.C“¤.Wåç‹ä¨òŠìZçC …B¡¹ lËæÝz†ÆÅ>ß]°êæV9Žò¡*Ó õÔJ;åd€gèh‘•›‘®–ß[Ú•# ž_ò g­—‰ø£ˆ¶01**µÝ’¥Òþ¥Q¢ðµ(ð_öµ âÖ¦‚¶š*ÛH·£µi@W {¥r¹X(!HKs£ 4쎒 *)JŽoJcæŸß½(Ø×ÃŽeæä`jñèuÒ¢9AvfzÃÇO#á ¸;?1šÊĺ¸-\>ŸÛ\"&kS0ò’×'Ù®Ke(ŠŠ…½RY_qÿÔ®€Ê‹_ž8Pj·jöX*SÒU™’gëd]™×àÊÀb• f.Ž˜>B>W‹ˆ¨´8ùqK¯ÀçÖk›¨©i«ã{zeMõ ün~}u EÏ @E¹É‰=ô~ÉÙ¼6rËé“,%AåïÏìÿlºfþDX*À¼ô|±éí¯t¹«±èMFEß P. ER©X(–ÊzxuêFÆêjÚt²¸®÷oÝØK…B ËB!‚–µÇêÕ±Ÿ3MÌlÄ]œÿISVï¶ÑÂ÷5¨æ”œ²¯\*Š%2‰°W"‡Í Œ[9U"·KFVÅð+Zmºº®¾.ÿ §oÔIO~'@ÀÙ\µú ÑÍXÖÅÏ c*-M~ÔÄD=­B •Î¢"\9Ò^»ûAsDøX,ù‘½è‘@ è…ˆ¼»±]``é2yüz.«>ÔÓ¬áÊ®S£ì¬°\,IdR‘Hüo®6—%xmÛ8kùì1ê¤(W•VtµV×S‡Q ˜žºªšÎžÚŒDMMOíäò$2ù@ÉAªJ]…ÅÍ8‰¹óy®óœÈAi [±­í²Ö¶<~lßHÝ kž¬ß¹ àÖCÛÛaðŒ¸ ¹ççì½"êB¤Dô02 «Žh)}<Å…am? 7:r(¡'"péûç'\l4¦lýÀ¶}ëB;K+Í¡£ì¾ô´^9ÆÊJgùCõ.ƒ ØMœzø³³µ‘: üÉœa~GŸœX4=4òß+(ã΃k6ÛÐÕÑù|T*pŸŸ„Ù{-:’xG)ÓDÛ¦èú\Q]à5 ÊšˆÜô·p[À“ñ÷ŽTµáÞµ]n#&ÍÄc;ü·ú˜Ø8»•s󦟚¦7:`‡”@@$½ Õ'Z«®?—Á«}ak¦þ8ñÒ03íèdññË;G:O_uöá)Ú¸°¹3\XûÒIq§æõæhµéZªÝÍ,œfž¨m2!L l6GÍÅ}1§æëûà–ý[t}Ãá9Ïcɶ³ÙlC#ÇE=…èÿ{çE²5üÓ=== 9GÉQPTpÍ¢˜ÅœŠŠºæ€ Ìq˜Å¢(*Š(`EÅ(ˆ’Drf€™a¦ã÷Ç +èz÷Þ»{¯÷{û÷àó83Ý]U§êT:U}ª¸Ÿ»q‰í4/ K:5Ósüú­CTy&öÅÚ:hǦ—>9³ÄÑó&m¹“­]b5t]t=çÈXÇvV¿Ýx«d9K|q†[ïÁu ©xõòÙØCËvð)YìßImÈ,ÿ¡V“ƒ›¹Œ‘¿Âµ½U]û.ÿ ¾ºìÈ(ÓÞ“WlÝk¨nµ;°½§Ù®„T…zóÛ 7/?mÛÎ6£J:}æÐCÛ ðÛFã\ä;Žo¼¶\l\Žÿÿ|ŠQ³ÜˆIãûNè²Å 6í:|øúø1ù‡ßÖĘìZ:öÇëÅ)ç'§yÞó·F€•Ÿi¡¿#»¿­×(8~~þLl\ŒÇÿó1«žc)Ï›|e¯îÝÿ×Ø/Ùý'Þ€TÑ·æ¨þùj7`ªšç±àøÿH·¾9Akjr¾ŽÿY™i–Î×Ò Šä$ÆÁÁÁÁÁÁñßüv/((ˆË¥– ÿžl°Ÿ^GmÛ»?½íÐÞîë( )¹þÛ¹ð]zëãÿ(lß±#÷S²ì;uUÿöw–yyqÓíÄÍÞ€® ݶ–qîkÐô$xÖ؄˜„„ÛJÖ”²cƒHHˆÉÃÌ:[ê$œw0*&!ᎊ³·1¯fGð’wbž½ûÔ½KgAþO¶ ¶üíÕýûamœ- YZ¶íø…¨¡¥£©Î§—×=ÿ,ËÁÍ] oñ²1ÝTqr×…ËñÖž½´pXÙµ“Á¡Wn’¦ž¶º‚Œû¡ûŽ{U sqvÀy-+¯ÏÛ·eÝÃ,Q‡ŽÎ‚–µZøìʾ£â§Ytp×Æå.í;|îüûjA{GkþO"e 2IyïÐÉ]Vç=Þ±}ëë k;kT^såð†³Wï`FŽ–ú­C›§ß;µÿèñW…r×ö¢ÔëAûö%$Ää ÆîVÆ-+¯¡\èbcœqtî®È˜„„Û”C?[?›+qÉÓáÞënó¥©>ˆ:ÎZwÔÂèÆœ}®wôpûg«"óÞι^ºÙ9ê¨ €‘]Û½2‡gfßF€•=Ù¿oçíGiŽžÝîßNZ{èóo]«âÐ ¯Ë:±gBš²W§6­]ætCVÈîÍ×ÈuÝl ”ÿ©ì<»rù™gWª:íøá½13»xuá5eo[»æFBLBBL%¥ëlm˜~cïþЋ„¶ƒ tÛʈ˜« 1ytïÜTòòàÞM×¼rì襎³œÜsôx¶L»£½TÕÑ-A¸k_~Ù½kïÇT‚‘“¥ dJôý¡gK…öÎf:­ó,ËÙtÔª[wõÖuEnž?ÁÆ{´Ú·½CfÆŸ8pêä³ìšö®.Š5¥oní<Ûµ[e…ù-òÆÓÎ=~QâQ‰æ…DÅ$$ÜQïà­Ï–…ºx3^®nmo¬•ÿ(|ßñÃ÷RÞÙuì¢ÎG«r“vnß–Z¡äÒΪ©üí‘}£â’”ÌôÔ躴ßvl‰}œfìì¡‹‹#­?wõÆ'™n{[cÞWCÏûÇïɬÚéðàù­R³.:²k‡}×_”~ØŠ«²Žì Šº“È7p°ÔתúÔîµÑ?tèÒEÈc_ÇÛwüt¶XÏÅÞ¤e ¤Óί‘´ñÔVþ' 2ýæÞý§.Z¶ÆZ_÷9W·m?¦Pù„×’nnÚY ÓvШÙx䉗G[Œ©<´ÇºS7ì« %¯oî Ùûð…i»Îº*|Ëut´H’”PaY–aš¦š¡iJYEU Púûß|–d®]µoê¢ Ã·[ŽÞ~ßÒ¡i »ªÜ'Å2¾á óûX5x/¸úí;ú²ê—aOï=zݲéÑé=Ê—²<µ~+æhe^bÂúÜ…Ú#VøºÙ09Éw}§,ž°ÌY‹Ç÷*íüVL3úÿ²1K“Tg'IJVˆò/ïMU›7gêÓ#þÕ4ääÕz™ÕÇ¢và¢Ë­ª€¡HF·ý»§ • ,•zhÈ£Fë™S§+!@ä‡ÄO]¸Ú0eþí7E-«¿éjà ÍÞ~Ö5‘«CŸ·V¾®Ï˜€¡n‚Ñ‹ÃdT}i£Î4¿QÔÜcqÙ?‘—“[ã9tVo³ª¿^–Óõ7®î2y ž˜Ÿ‘pðTƒç‚Ù#ÎíY/jõ>*‘»ñðÝ© Wë?'£¸!ÿU®Æð€€£:;´®Y©Àª÷ÔÑ}¯®[NÐyù5]Ïô±—_N(YL X0o™ƒ(E„궺‘’6ØXã¦ù›÷GO^hñz~ô‹üÿ¢¼ºMZ5×oú£ µY+Æö±üxeRx¦p–ÿ\3¶Šfd3™9 –¶“Fl¸þò/í‰WÞ©í<'`ÅÔ¡ƒߤÝ ùü½˜EUìg¬˜·È,?†äi€¤ôéùIÉéÙLÑýó]Ï°ÜS¿Õ>?&ïÛZé†+aÉêÇw¯%§g³,óêÑ­+—Ï\¹ó(j*Š¿y1â™›·®ä–5H*óî½z™pçÚÛ‚ `ɺä»Ñ±q±ß  †ðìûO·5TJ\v >÷Òû -«š2u…Yïãûwn¤Øg ×?‰D7CæXµÕWÖ0uÙÇñ[ ‰¥ÅÛG÷Ṏ÷7TZ%fÊ?$Ä^¹û4]N³,Ý”ùäVìýljÉ)Òo^Mb¤y‘GïÜR¤.Ñ7Õ»s5–`U2›:EÀ¼åNâ×5¨èãÃq‡ò&LviçâZ ¾p~ÀŠáMÓŽ8Ò¸cã:ÃÓý|{ yPñú‚ß¡´1ÓyØËR !«/ÞXØÄKÙtá7yä³£²ëdïlÞW7cö¢vßn"f«nJyp!*µFñ±ðÝ㘘«ÉEŸCè1ÕY÷³ŠkZÞ$KÍh:!À´òúŒ]I LSáų¿ÝŒŠ% åM&&·.\•Ò@g?}4~æÒùËÛiñäÒ2Õ¶§Žì¶nZ-Ã2¸áñóûÙH,ˆ’Óõû7®õ˜¼bý/>þ(ª­0ñš8uH»m«WÕÓ’£ã=Õ½üF:ɦÎ;J2´¹Ë ¿©ã?ìõy^ j!äÊì+ >>½™[VýêÞm%“îß2wí©™+3’ž¼x]Pß:@ƒ¨Â°ëÄ©C]÷.1dbpŸOzýz~Gˆ’¶ž{é·`‘ì ÄìªVµú)éB¥˜øbsÔ¤ÆÅF%§}`X¶*ëIòËg±·®ç׶2$*H0o”a‘»·80ÓÞSç,ÒøpœßÒ“û¦^Ùq®Ú) `±˜Šàå鵕RŠ¨|z.þ=ÖÒSÀ`ÚÞ£çëi0méIéwƒ7(®G€oÓÿíV #.–¨Ù8x÷kûöeR ?@Ýw˜omeµñèÛÎÊTY€héµR?–¬=4g®ÿø>|…&6¾¾Iõ×ÕS35·6àU^ªæ`¢(úüĘ^ƒ†¤׳ «˜8¬£ß¦Ð&Xù³`ïþÝOÜÍþ?1qÛÝÙT1K‘W¿k×£»¹…³»UÓƒZ¶ï¸™½ÝÝܺzS¢ÆV_ÍdÒÈaº*`IÑΟSŽŸýkLÛ@g0T*åë«·ˆbÅ4}ºðèb=pÜÐ⇗ZeÅ¢c¶fjJˆ†¾7ž8k¦£­S_g#¹TþÓH í7Þ¯wg7·®ýˆ:1Ýð:“vèkmä·hØ›ôQMñ/Cúµ±ìjξ{UßR`˜Ž¾:Îbh“×SSI ÛkÐà—u­Ú®á2~è'—]ŒQŠ…^£¦õuïèÒÕ‡mldyBskS#Ý«Ÿìu³h•3U»a<ù MÁ´õ5•XŒ'cZêÿEiYš›™ TtÍÍ­ Ô‰­®Í˜5ËÖº]ÿCqx¸ºqÛ¾ã&´Tþ"ä‰Kûèþø# ,#ɼü^u·9O¥¹µ‰z¶¨G7gC–¨Y²rÑ„îüæJFVLï6qùN ­b˜¼¿ W·¶û¢Ÿ54É™Ö+[tu§X¨ºfz= ÔÖÜÔsÀ¨Á¿XcBÓ~ýzª«šù ec¤^™ç7}³³—û‘õK+):÷h„%Cü]Õ?ð†×•¾6±É ôÕ'9+©¸Ûä8ú7'÷~¶BXöÞ‰…çäS7ïŒýÀÂRå"ÊÐÐØØÆ}Tos„­\¼LÚVFzù± ~ﬗ–ü”ùsƒ?½¿nm£ªøkï=bèË–Ú Ÿ#@„¦Ý†õõl¥Èš˜Y›™FXëaYœ—ä±|µ•W϶TR è[˜›Y½OÙº¢ZŸ\Ü„\];löŽ$‚<–ââNOÝ7.³XVZþäŽÖäÁtx:ž]ÜtµT(À…z#ö­¡Æ{ßßVIZEla馰æ¬ø&ú+Ë?5{ýIS{»ì;1M Ë6& S×Q?±ÄáK‰ã&-]áÞ¾½gGWi€ým½ö¥B@ɨãÈ=¿Šd$…£ºúo='c@M¿óøA}Üz¹ê… 6]û´³2UÆ-#=´ñå{Ä©·µñ¬¥ÃÞ¤¿4sê;º·§S—AÊàí:˜"ÀÒ4¶uDyZ]=Üõ´Ôå_¹åáMfÆU©i¿­œ}þ^R]=f€ó»÷”ªˆQõ6bþ¨tw[ÌwiTùãà/ÅqŸ¹ÎÀ¶çؾžNîlTŠl8zµÂ»¯gÇ>Ãêoîm¨ÎR·u±nc5j¨åóÜ‚Í`‰Š)¿îP3·yz|ê‹YVÔÖ]çŸz9kL\Q‘²óKr&/ù”›ØuÙÚϵÜÂlQÒ217·ÔVV25·63Öm’ŠU ¬tôÌ|úyÔ¬ç{Ö}ªh,z–¤ì1»üB÷/Ïìµû‘‰³§›½¹ºÔtµ1ä˜"ìWªù÷ÇkÑë>ª]UÿAžË¯• ´ìÇH{ø,£­µV«ï_Þ<À[k®ÉFVñëè%3FøZU_%Ýê»y“*±øêuÑ«„ðßÖlª¡ðÑ'sÓÓK×uÈ ÜËW3Nü”šüˆ·(ŸÐiç_ylúŸ^WòTª%40²âýÁB÷OTúQ”,B$+ê;?"îHÀÊ sÅ¢‚Ö?LˆM¯SÅ[ö ,)•!Â';GD¾¬C©ï Ís÷î£çVæÍN`Yùý=>3;ýTRbdEû7n:{p.!\YéÙ($dò=§$ùwôñéó¢œ/’µ´ZXD©˜ûF¤‚cˆùÀå¯^½Jˆ8\õ½©û“ð ·n›qYéÁÀ%vOUTøãEãÑsÚ~èÚgULü0áÖëûi ¦‰ _ø•/ZžsÁw°û ±»wÿ˱TLÜî?+LMº[µ¼@&Û<Í É3¾^Cøô&ªãŠõº|$9jŸò²«ÆjŠñë~('-­dŸ¯ÚŒa-ƒ¨!ƒæžxžôÔÛ¸lÜ —¨·¢V) ÝØß«ß/íÒÔŸXÍØ¢§fâfN'SvîOoœ¼—K÷¶üñYLîƒÓÓ»™õm#¹ò¢š—ªék|UµõŸ>ÖÕe=ûqÀLÓØy+™N;¿pZߧ^Ê?]xžõnoàÌóoÈ»Yù)iYãÖ,wøeQ'GM«i¯KR_—¤¾.yrõ2ñéì{—…ƒlþ0”nSQ„îЙfJ%é k¬ØIð…µhÑóØ uu„—çÔë†Ä~8>ì]hÜó&qa±Ò„ä'o /o~Uñqù¬m¿÷øÒ ÈªÌ¸¸Ø2^% K •Û¯|žx/bõ‚¼–çZP%—È‘]zNÔ*»C±LÊ‘Á³Öu°m7}Ù\UÐõ/'ž´ñô>!ê–©Í%*]ßÏhqÆÞèüuÞté¥!㜾{`5>ñtÞ›ôÒ©'4¯ý_Y~¤Þ:Xk1Mu(‘+}²¤*2¹X†Š\7Éjì2-zæ^Þ{”–k …Y—SÀ¶Qiiµ¨›˜ósop\ÏÔ¥U!º‚oÆÏ.}‡hèÛCþKAçU_*èÞÁ5(˲׶ÌоB(1¨ä^^½=*K`<βäÒ€Ý6¿Öòöhú IDATm’ÿ¨i6å„—§o^áû¶âÒ»z^§£T´íxÅo0×_¿$÷àØF*ÒS®Y°b7×òÑsâ&ã7ÛV»x—”á{Ì›“˜ýéQZáðñÇÞù\#%7x E÷âï?nÓFçOôYȇËßÿæ3ªªßÿäÛÔ¸ˆ]÷èD.ëôGûhXyYdD*V¸“Š ££•–ºU¼ÈMëöY94gî¸Ðptø锩þž¦¬0ˆP×vôŒ5ÇôêÑ/PÜw²Û°åÇ‚×_Ù&•Ñ4EÒDuæ–CÇ9èÙ/íDÖõà—KK³O¼¨˜×¥å‰(Œäê†ucÖ¼ETu,3s°èCkŽ,è¨Ã€×Q¡Â_æðXMë6&Yúê¶võ™-M}Ó¶ªj::BªºQ®íb{lç²ÔWï2C X¹H`ÔiÂŒŽ–ÒËê ÔuøVVªj˜&S×H° ü{ÊÕ…Ï4M«÷lÙSÜXñZ J*¹LöÕÄßjë±Å›–uÛ™½ýVZ­âû.¶³“¬Zº}IJ½Öj˜¬¤ž)Î Þ^ZÝšœ·¸§Í×íHUÇìÛˆŸT° •µ.Nê¹}Q_äË eïàØmhd¿I:îÔ£Ú[µµ¼Xº)ñÔ¯ïí–¬êò’!ov¼Šu “zÙ"ñU×k?nj»Ž“˜Sd¯k÷»OVËJ¯2Q8w5ïÙªZAço´åñ1A––Ä:}[QAjöÞS|ž]˜n<+pT„i°U«7¾s ’äqÑA€k¬;þP*‘äŸî¢§ó#•hõœ²wjoE{HJBy† ,´ôÓƒ]§¢É©X÷×ÖêÝ,úÐڣ˶ÕùÑžLYÇkà,¯~k§xZ»¤»ÝÄ÷D„êj A}ÊŽíÑÍ'ÀëöZ²´¿­u'_ÿö½®ô™X0ÈâOÈÿx-tJÔŽw ØåKù+Nôm¹UBw3ò]a‘ìê9ó “m”i6|x`?j–:@×mö¶ís1¯·¹–›O ›Ȳ¶-ˆÔîb?Üåœ*P½Z Gk_žËöPĈ¿{yïÛSpG½×Lcúã–Ì¢’¼×.o,ºùAùxó£í åÿ»–Junü­ØÔÜ<Ñí$cow»c¡'©ºŒ„JçëÊpyõˆ„šŽc?ݽPa;rD%¶~»·y׳¹>vúŒ¬æjÔ•O5eñWÂõ&LX¶là¶#;Þ óŒ‡-Ö4tàe ¼¿ø°÷Ö`¨x{Åcîë·Ov«ã&s§¹ì>zDð.¶÷ô0òÓ”~Óöïû÷Ûxõñ%C ¨ªg‘ÑÊŠŠ.EÅ ÔU˜ë,\+ûb¼ç†ÀŸ¥©¡* Ží™¼iyeßÎUÅÌ¢ãP¾Šž®ÞßtfyVä™øUiF¼Øu®šŠëòÝðàDEnÿ=¦êXÃû;×j½æ¨  ëµ]‡€,3hÉ-Ëf’M‹W8Û¾Š¿<È?²ÕÖÅÔÌÜÁssió§ÝÌŒ5"Ã.S]<º¹´AUŒ­ð¬ø{q\º@ÍÕáC’«Œ¢YgVøM^Í× ë)Y»vÔA q±TÅwé¡~Þ»Åŵ×ûƒw)hñ®…‚Ž^ð)Q«ÛhUÓ‘&%¾;O)·!rô~™Õí—_Nl]l9H÷m¡T`àº}û‘¯oÝâ dÙ­á³:ТÌËQ7ê$E—/^9v”RÕëíé]-uÀÔÁ»iµÿ ²Çãz§Yê°äŇESx¢æÞ‘·yçÉãU×oöÙ²¢3_²c‰ÿ¥º®ïÀu©U[ŸÍ`Ï¢û ¡òúÖ³Yúj²›×è=UÕF˜spYd?cq»q¶-öÜÒîžþuÃUsÍ—Që‹):;wÃ%ÁáäвÉœ3P%v.ý÷u?p$2qÃÔ-ÝÇ}¹¯~×`‡&Ï5寢o–tÔÛËf ª“ÞžáeM7ä^¹|ELW]‹Œ9´ÓÉmGMMïD>ºqCCQÂäÏ.°Žºt±ÿ¨QÑû74©4ä$ÚúÎÒTëÐÇ¢zãÑcQYSB#‡/Y9lý‘í/!«Ïò=*}nO¹¨æôeµ “­¿uß>—¯£ŒkšøzOo\5.-ÔäºNYóõUÊV¶oÿý´cyU¦lõÜT÷G"'?õM9žÇŽù o«Ñ˜!1 ÐÀ0ÄD?#¤´³Ÿ6Š€Çª_•éÚé-ŸäjHÅs¥N# ¾k±lóù¬â_ó4à?—¥)‚¤Ãù¼¯wO˲!gYÁpB“$M‚â8Ž"°,IÈQ\ðå–¡(øüfK‹" ãó„¡ x8Æš"IŠÅù8‚EÊi†Ey|>†Єœ`Áø8Eÿ¾BÀÐAÒ€ ÎÇHBÎ`Ž¡I4£8o…'ÀqX’£|EX–!䊺_ @% ‚„ãŽa AÈY@ù|œ‡"@“ƒðø€ýZ& M)šeó•,K‘ràáeYJ.'›{0€! ê«ä€¥ pþç}l,#'(ÇX†””b_†ÇºEüWeÆ$7/²IP´BQ’¤ø8ÿoÊËÐѬàØgï M,!CS$ƒàØï]˃`<ž¢—@P¬¹‰þÙb2$Íò1”¡H„‡£° E$‹ò| Qô{4ƒñEIÇòú\dÊÃp>†24I’4 <>Îÿ¶ʼ¿'\mÖÖÎê,MŠ K’ÆÇ¥ ’bÁqœ& ”£!Gø EJÄ õs·i•Kš&¿hŠ",M‘$ÙüQÑC²è|?¿ ¡çLùß–‘&ÇùÀÒrâ÷VŠ°ŒœbŠfÉ*JÊ6‹e ’äóqEÉš"IP çcŠê h†Ç|qß*ºq’ P¦Ð}Š”Ó `8Ž¡h‹}:òqA>Ëe(’¤E£)’‡á4I±|þWËÕ,KÈ›q”¯P(–e‚Âq>°Œœ >—§ ‚f?,õuÁYªÅ Å0¿÷,C¤bõÅ8Â2I²€ðù8Š°$A|)]KõdiBŽð,M2€a<–ŠnV1&²(Ÿ‡²ŠZøú>†þ:9 A, 8Ž#H³Òñø8Öz¤ciB®XUDÇqöKׄã@“ Âç¡@Tk]hUËß´Š x|QÈ„¤Xx|>Æã!,K‘‹bßvé4ERÅÂǼÏ﵊K14MQ„\NÄ—x-\DŽ¿‘ŽÎÿè3ÃêÏXDU9OS³œ:õ5Ñþ'Â’ªüÇ©™ö{[h©ü 9œ=eêºSgM¹ºÿm~·ZÔ4xFÓ4MQ2yI2Y“žþWVKC­¦ÆY-ÿòóÒ¬m,%1Í0º:z4MÓIr’¤jjªÍÌ-~«¬êœÄ8888888þ;ðù YoßxxuGPAP†ejª*ÍÌ-à?ðæ3ÇŸÇÙ¥ã«ÏE¢:ÕÕåçæØ·mŽˆÁY-?JJJÜÜHB^^VŠñù\;áxóî'ŽŸ @ÉÀð÷SÛ(’଎Ÿ–e)ª9”8†ýn«pV ÇÏÃ0YïßWUU™™™Y[YqV ÇÏIQ¸@àضm¡ªª……Š Ó|"·—ƒƒƒƒƒƒãgå¡Uåe,Ëbfei‰"˲R©”³Z8888888~.p\Ð$kª«­ýòHTÇ°-Ï!ÊÏËáó¹xÎÿœ€e˜êê*©D‚¢(†aªjêªjj‚üÑŸÇ_˲ —Ë”UTëjj4´´àó$‰ƒƒƒãßAM]ƒ[!âààøë­–&©Ãøµ5U(Êu2\‡ÂÁÁÁÁÁÁñ¿Aó QQa' ŽŸS³¯Î|621ÕÒÒnuEeeå—Ètÿ„B%Å~Ò"Z.i"˜â–•5ˆ(ægÙôÇÒ¤¨QþŸÙƒHɤ‚ùßÜîÈʤbšV"mâ¶lrppppü˜ß­‰DòÝ+¤Å©š–+ûë “Æ“þCΦ—}÷ÇÃ+—?«$ئü y8¥Ž¨ýè?vЀQþ¹µDËá¯éÌøîÙÕÄ¥ö0b× éN¬²Ê¬•ûRþ-?KeEï>ØgÁÞ«4°Òý+§ 2æLj}«Á=ýüÖ5±åô¢àÒ¡ˆ‡£ÝA6.™±¦Œü×îfŽ/)¥€=¼þiÍ)$Çàr9òþþs±··ÿ²ç_"‘0 #¯ÎÝpV¹c¬ï°†ê|yí~áë¸kw_9º8¿¾}><*.§w´5N‰¸{'¡†¬¾›áàÒ–'-?ìè½×ŸLÛ:jà­:©·ÏÅ—aÖ}²ëÀõÛ U •Õd›¶m â~^;k½O/‰u4øô½+—+rR®>гsˆóN9žü¾ÚÚÑ^‘?Š<ùð}YiAŸa(bB¼ ¹ ö0ãt’ƒƒƒƒ£|>†¢¨@ ôûX…aØýû÷çÎ[\\üQ——“““_†ðòÒî Jsÿ }ø(ͪXLš:–¾>;ñ}Íó{·U­ç­ËÀÞEßÌ©=»h‚°ãÐÞmJWooõYÿõâÂÃ3ÃÞˆªJK qÕù' J†Žõ<•¥¸J.*Þ¸ÊÌ{²oogqÙë¹'Þ ;¦ôÎþg ?ZûùÊÚ´|͹!—‘¤èÐåÚwOÎ[øôSý7+)ô§”wÓ&õß²lGª!~t´¤‘¨}u)æ­LÕ¬÷ÒY=;ö¸t–Š$í['²7ÐyÞ¸àJ‚ˆØ³ÕuìŒáî&Tk+z¶óÀÝÚ1Gª×Ò, *“¦Že¢g'¾¯®È|•?Ñôc›öU óV,n£e5wEà¸>–,Uýq6 P”z³LFPNl¿ÏvY0{¸&ZwpÍš¶ƒ§ºóýz¿ìMìÒxÞ`WÏ«IvêÜÏi&Çh1Ã&B(jiiµ6XL¨¬¬¬ÒlãFŒõ²Ô0´U>%ŸéîÑ}ÓÝšRQ=ªbÔÁÚLÛ¡“‹±RuaÆ‘ÛÙËÇõ°?;ïY«îÞê0çöÔU9jJ -&ªüvåØÒƒ3×4ÔV(9¸6ŸŠxÞê.D :ºwG¡¾üÜxàÛ•?H.þtîz}W#Õ#|õËów^Íà9fUxzÞLU˲úÚª C‚ÖŽºöeƒQW/;Ë™«Ç¿ËÎ@,†NPS1ÔŠ[,e ¼N“º|½fÒ¬wÕùö>®JßØb*Ý–yX뙘šÕfF¾¿{¸÷^{#£³´ÜF4UU›ÎŠ¼~]/ÿZRµ¬‘¬ž´:$òÀŒÃ‹74µÞÄ‚¸Œ™edêÖIécjµÀgÖðŒšëWR»OÚꙑß\Ú6ë—S ³cŠÀÌL¸hîò{åºÆj¼–F õè@øÈI¬Í¬úûöÁQ¬àÉ™îÝ7&T—ˆP‡cp\¯-¿èeå?XÃŒ:.ÖNU×Z‡L½xçÙÔþãÖ^~û®$;yúÊ mÝôÒivú©è²òZN!98888~4¬|å~á8;;Š'4èàêªúùk¾Gº,:™òz—ªè¨÷APE5s#§Ø¤ÛʼoSõÚ3ïvÄÓ7¹é*Ñ…NsÌ4Z&€›¸T=—ðöšJ¸€b8ÎÊ@ÓÎD3—‡"<¡ù­€¡šäµ$¦€Ìž`¹aíöZÏ%jxshê8¸ö¿pó$i6.®§¦¼ß·eEdz§Õ¾6è„Z´LÌÈ+ …BwEQim4¨´û>hŸVÇ^G¯Æ¼ì£¨©á–CöÆåøåJ&“¨†ªiy›¶®¥’\AP>† â¤òùÊÇQ†øÆ×Â6”ט5<-!ÚÆÉ'ÎÿŒ…Uˆ­PQöó ÚBÃC³R|nËÎxNü·Ó?TxÆ¿ï×Fªo®žÙРÛ\˄׻üSÅǼ³ÀÔV³¬©HÆh mâs (Æ’4 Œ¤F¢Hƒ‡c(¢¦®S×ááQ‡7¼¹µ­ZLÂ45Ê›kGTÊFœBrppppü)«åðáÃJJJÿœ£F³½P~öTf¢¨ƒkËZÙbÝb÷õkÖ›j"Ê&^Kü|¾þµ×À1sëh ke²O¿oCÖy ã­ÂS X7eõεÉ*b÷…ku´œ{ëžXÔ‘á÷ÛÊÖ¹¡‰ãwiŠ »N]bÚo–$hÜŒí!<ÀÂÆnKÐŽl÷>³Æv˜=H{þªÆB™q‡¡»oÙFE@ÉuZQuí®}zù†Í•©Eóö;Ǭ?’¢âTú¢hæ±å»}§:LßøñŽ[w㉊†S'`Ä”±Â¯®ÔwZµîÛDNÚÔV Ò#¶¯L2 õkeÜ9téûýœeù‰uže¨åºÃoݶ × Êsö¯B^+»ÉO<ºS¬.qᦅ Xó1td®Ën ßȳ&õðÁ“²3ÆÎ[ä»fó²,;Ãòj­ í³…lz#W/¬Ðo®Ùòy¼NË~;³jgñS3ž²ã²Ùí…õ!ágOe>¬sîHñãÃÛåZµ6:jñ€Uêç$?¼{_÷^#ºëÅ…e§ÖMmU§š®“{DÎ_l$h2wéë:è]à¶c]õçÓ ?ù…A7_N!98888~@s”9Š¦ªx-kªÏÜ1ÈRø¯>€%ó–-=¶ûø®ŸüLÈ°•¶.v×@þšç±4!99±·Yp‚£Æß‘áÔó[Ž«Î8<Âù+ŸÊìZ4dM°ƒ2Âé$G+„B%ŒÇû=ÊÜÏƘõÛå,þ¯ßOøöç³õâÏŒõðE[•Ô4þ²±šnØ=¬ÇÓΛ"ìÕÿ·¬çyk•9“…ƒƒƒƒãÇ£ÅÏékáàààààààPðÅמÈÁÁÁÁÁÁñ¿Á¿gµ°L£XÊÅao…LÒXSS+¥þbÁ°4!ª­©«—üAä{¶¡Aòû³¬\Ò@ÿ½ÁóYBÚð·®À²´\T[#jøþ ,ˈê¥ß$ÎRMõr’áç×’’5Ôû7<˜iÈÙÿ!9Ô×’ô¿Ÿ_V*‘p§Rppü笖?Šè_•yß»™qŠÀh{×5GögjV¬;ôï‡a§ó&\ÛHg ~¶i¢"íá«’¬8¸ù“÷ÝŒª?3!4xˆwÿ)Kvˆdÿê"+Ù6¹9¹˜WåßlTе…ß;B@Z_¶ãhÞw¢Ü3¤äÔºYý ¹ù†eÈó>'à³²¶åådCá–%3}¼§¼klk3CW®=q÷caõŒ½ôì¹;ê7Îá=t­âïd@’³dÚê&Š€²ŒøÑÞýgoŠl¤Ù½ý zKÌùV·Ooô0,ª”R”4k”·Ï˜{ï*þHp÷ú½“ÙÂ'ûú ?ÿ]uSë¼6Õ\2±ÿß3÷>°dcà„‘ 1 Ôªµ‚Nà=#_Â(ƘÔý³w„%–~?¸ #«=}_ ÒÊì_' ô6åáG)E×ö]Nþ‡uþèÒooïQ3–§5~û+YzgӞˢé0ïÏõööž²lÇ·¿Quoýgîhú'-¨ü˜#ÍMeæñ¿h¢@^›ÑëA¾ä_æKŸFL>`LÀ–&ê;Å\ IÈ`䉇—òz÷=Yä7ÆwÊŠÒo´¦4=~Š¯÷à ·ÒŠ€lÌ3dÂü]Ußè¬ôÙÊÙ†ø.®#X(|~i¨·÷ÿMù ÿ²šË.ŒqO/ûçÏ*a™Â‡¡c‡ ˜¼r? À^9°õ~5·¤ÎÁñ÷Ò"¢?|Ñ¿áSÚþ¯èà Fl¡ÂœÛ·ïê­Ûåeï+t;;ªÄÄÜ#JßÜzUÓÁÙGäÏož?sù6­cm©¯FŠ«NÝz“›t%þUQ'g£°è{¯ã¯?/¦]ÌPFz/2ôbL¢Ð²½!Rt`gHtü#‘¸œQ·³ú:(‚è¹ö´¥fÎ>²ÜKEIɵgïêØ‹KNF8›éb¼?t1¢믉÷î\ëa««¥g„ó臗/Tä½8wùž¦›.&Ž>{4*î)O×ÊLO€‹eÎo½Á:ôèÓ{ÎïP„»­A}OÞ?¾v±7²ÕeìØ}'¡¤º¬¨ÑÐÅN§ô탓§/¼)ƒöfjšÒÒ´"ý®º­cÕ”§Ÿ)q;4ùÑñ`Û£»ýÒcèð6x<¿çÌî&(ÂÈÄbÀø(‚M¦EJìm¯ñŒtê™.Ý­ÆÔxŒZ'+a¤b Šã(#¯¹qæhôóÒìÜr_ß®ÑS Çmùu¢±Ž–šRë dLJÅëŽã®0µÛ–ùí;¡ó8(‘èhÞ”2!Rùâiá»÷v:DR&•SÀÇx@óT•åoÅŽC;j¢7åv\¼~Ï›Ï÷ÜSˆ²„TBŠñP–eRo‡½ù´¡6×ò—QŒHÚuÈxï¶0mãˉ¾q„‘‹YŸ‡"=Ç;8üú¡íìÕ§ï°#:èIi žÜÕE˜&±åóQa)Ónw1Ögæ$=>•rjÛÁÈû"%Mœ§ãÖÎ A©XÚ,YÅÚGO IDAT•“ÇâRKßd×Oã¶f¾ëœÝsFõ2ÔÑVðøÚöç†y è)ü¡{1#1Š½s©‡`ã–ó½‡õS’—„:ÿ$MÕÞMOš²{Ï©;I饥EíÜ4„Mb)…ãØ·»ˆ5ì» øÅ(êJÚ¸±>@‹cÃO\‰¦iï¢KfïßuäæÝ'µ¢bŽqêƒDûvm€ªË:=˲Žœ½ü4½È²½“R}JÌë{3=¢þý•´Æ®žž6{RÚÅ­©É祦¿ŠN|gÖÞYo‘¾øãó“§Ãî%g9¶×VBÞÞ½tòÂÌÒÁÁRÀCX––HäÎG€Î¸|ü)H~òÊ°«¶­xÿääÉsÏ?ÊÛ9Zâ<„¡ÉF)ÅÇ1˜Ò7Žœ»ú2»ÚÆÉ^@•ûÇ,ÝäÛ£½¦¦&Ú*Ð#‹Z4£ãÄem4ðª÷'œ£Ãú]ûmG‡!ƒWùÖöX7«cÓø]S‡8a_×2‚;÷2Æ»í–Ma†{^ñ÷± 8Þ‡ÿdÓmÄ·»U‹Z&äjúš—Ï%Mô§ÌVÍY³6,ªcÃåÏT|<¬¿Òe¶!ûññ3‰Ï³Í;tPç3/cÃO_º•UmíÍpaJ,‘óq>ÂR©a!¹¬RâÓŒ6í5q´äB—ÙöæŠ|UËÌÇä«GÏ_MÏo´q´º¬I;žoÛ0ÈÃACCÄò6EÔêi…pÛÊ98þj¾ÑÿÁƒsæÌ)**j=©h(ÊþðáCN!ÅW›±l¥«½ßʵ‹Æ:òDo_a.ý…wW>Í©ywóÈŽg‚ÓG…oË•2TSí±àµ^ã'rg¨úS{£<'Í”ßÙQ,£žY]i6y¤çòéÁ¸õÂ¥~šB›¥kûº¶2ê:ÚjBª¶Ž†TCGOUÀ×ÕÓWâó~P<„§$U•Vkš9)óyô£Ó»n“]Î¥‹³Ig×Ýe\§ŽóæIjˆÃú”gŽ„ªëèª 0]=!Î}L;zâٌӮ9ÕÈ×™¸ÚÞÄfΪµ~Cì²xõ¾Ø^£'i8zëýœ@T“H§‰¶Ž¾Z™\êiéèëiå?öwÁº~³w×GEÀSÖéîá¢&Àö“ëôÕ¾n–½§.[0³/†P•¿zÎ%žÛ}±Üz´s]q©”m*¼üP”ºyÞâMéeßñ¤eäõìk…"@׿ˡۘ4zî‘›õ¶0?½Ç¼ÑÕõ*N&²”â·øÏß™ §ƒs'3=åæ™´Œ043ÖÔ5a?&ç42ÀRaÓûü•TÃÛ5ó÷k{?®œºzu°³hcj¢®©ÎCÉoÞÎÑée@ÊÄm4u Õe¯D ¡£«¯§™õ:u£_;@Õz÷ÊЀ©uso'Tœ9…ò»øq0ì·Üo|7 Ký¼Ç÷¬¿'sêo]S]+gŹñ/êní œ·t{V¥ÉòÒjÿáTQÖÔ±ë<Ä^REdî#µé;i°A2<]%ó·ué³võR3-%(xÞaÐÁïyM¾ª¦ž®À²Ì½ís’åmÇõo;mĆ:嶿.žb Û~EàZGãüG7¤ UPRWýæÁí\¬¡TÔwäd/Ý‚)ëùµˆR†É»Ìòù|%U]mMD ¡«­Š™~LÒaT_ÕôgÓZ¥-©ntñ=²›ÞØ—e C椙3ôÒwŸ‰Ëg÷ë·ì³G€*¥ú;Ðfk’—ï ÷9Ù¡êÄ¥§ùPùî¶K¿íbXI 1lÒôöDâÊCÏÉŠû|Aíþ5¿®Ý!ýÆ×ÂÈÊÏ>S5ÖU€ò¯ºÎôÕ ;Ø O*$—“mT#'úQX=ÉUû¥–Õ Ú£Yé/´,m„Då¥ÄAUlèÚ±îÅmX Kgy) pë®.vÍ3 žFWwó”W©ÏÞí]ìº<¼ß¼2 @RÙÐuÐøíÀÛÿ¦œaXáä™ST“V^V Òò¯~A®YV^¦Ü¶§q…ÿâ0J^¸/¶×èI:ÙÇb²* àq¸ó@E-³MtìŒYÖU—·ŸK¯+z¤£]»sÕ‚Í!ÑŠóéuÛ¶§^^£n•ˆƒão¤Å›ÏA(++ëèè´î‰0eU55Oå[KAÓµÏàÎŽ5cí4H ž'=;÷¢ó9`Yå!¤‰*(»Ïéídˆ#@I?êõl££Uæ¢Q)g®%¥F=¹vu'°¬úGÑ6}Á_\*D­kÄvƒ‹¡GæONŠLN²ÕL¿ýbßöª¨²âó÷?î¸ØCEL-&œuBò©?1=B,†ŒÿÑ_ý+Y¹Oâ"îÇG >N5¾Núô#×)²UÝ-V î}; ”1(-zsî1~1@57=~ f¦Æ38öø¾âÂïË'.deÀÚµ fɦ:Ž…„i‡OÙsjÀ‰­îk‹ÛhbÀà!ONm5Ú$IZ.ÑÂ…Æ9«`2€7pãYøNN†Mš0ÔÛeŸÔÀÞÊ´‰d°éOynʹê1jx»vÎ3†7·œ¦’ Y‡/Ý  ºêq¾âJ‡_&—ôèaá¯îæål­CMJ\¾ît€§ûÛã”?%Ì$ìñMÅ…IYcvöuPéh¬sŒ%Ä5ˆê¥s‘TÆÁ€Wzl÷uœ.k AïO½í/Äy¢&Ö£{Ÿã‹ëgÎ_6ËíÛk¬zNË{ð²ÉR¾‹Ëšr€e5Ëě臭52«2çO [1JÉmðT æݘÁÝK c7>öid'|*‹9ôiíÃÖåVÓíi­­F›‹£>´È›Š†lóÄoÊĬÖ 3ATpwÄ´Y°ÓlJl@àœ|ðsžÑý{v°¨6 ô¯ÎFîݹ~#.€í\6£»A»!¹ÉCP>V8¸gW‘œê4¬-©+Ñô¾wtÄóÓ3¢ ¥ÓmÔZW.®œ‡-k©‰†Æ¹êâ RJÆâåO¯&‘–Bh¢\çëZæ+k yTU]=CrPʹq¤ÆÜcdŠZ>ÿ¹–[ÍÊ Ûô×æ5U•TÖ+t9>9Tq¥Š–t帾ÙÕM¬î9;¤ì͵ÑS§SÀ.îS `ªbä™–ì‰ ,‚èÓµ³Ž¡ê‘MâìÊ丈{ ]n[3²UiùÙDiIFÿ. ›¦ßŒ!”}e±Žïý½Ýc›z£ŠcÀã)kòÉZÎfáàø[A¿r¿ð,X°wï^eeåVáÚ6....ím®àËtEy ‚€ºJ›¥7³ŠŠ‹KJ²ÇX \Yð¥¯ùmeý²‹‹‹KJÞyðæ_ØÈÆÐDM]ã÷æ6®m5eÙÎó[~¹•'¿9´<_CjZ$ĈDÌŸ°Z¾‰èÏ*’Æ´,{.>XX\\\\tbD[@ô»û1e½Ð¤Œüüç}T»òàÕêÃó«r+Õ’f®†0"‘"ϪJQE¢¬g¯ÉCQÅ•€þÎÆ-ÍœJxšVª²Æa{¯Y5äëèié[—N,ªûSû¥¦AT¯ƒš«—±,CRƒ¨šØhñPAq!Ë4;jd< -ì³ÓK,jüã­ ¬¬¸ZÐÁ×ô~Ú•}2yû+FÑö¿j¦4)«I¿5íšdY`)ò%ƒɹÅÅÅ%%í`™f;ØÜáìåóóºÔ…¥IX4L›xæDbFæí} ÈømÃwfy­7Vmmi!Š ÍÚÔŠíëÏÌHÉM»§£Ì£kŸIäg~üôlOÿ/¹®I>·vF"–3r±ÑRÒ2õšTX\\\\6ó`hyHÂ"Àˆs–¬NŒMÍI‹XŽ°À×ï ­!@ÕdßlpF„š¦h™”`@]ßæu*²7 ©ª±½‘J{©N¯…뇛Vkº¨ð‘–µŒ¨èÛt±È¼öyh;©Õ:ùïÄ#µí‘–µü5t}惲6#»¶›±È7;åÁ׺ÌRM«=»þÆëì'—èÊ„ùæY žlêüYuÉZ‘˜m~&-•‘ŒT$ãiòµ-{.:Ь˾Ž_×2SŸ¾ùpnʇ¯NÍD”õœ4Ô‚ðpAÉÕX!S2A¹å!ŽÿŒÕrøðáïBÒ7§ƒ7lØ°a[J5]ÚªÞºëtLN««ÿ(ߌ ·nÛ²lÅ®âG©Î ·eÉÖ­›-;PKªl0À¶ìàÞýÉ™-—WX&;rԬÇ·Ï YÙÅß6ßͯع1(½°ê ŸuóúÎøÖ”¾ü×ÅÖ¯Ù}±ÜÛR½Õ¢Sÿ™“–ú/ݼicÄT…Wyô EÔw†®¨}›ïä×ì߶ée^Ý7ã%Òɲ}Ï¥{QÃÁv%·W®Û¸>pUrQ˜Û:Ý߸+4±Õ«”´z㺵+Í{£?ØQ VóècÀç枎®ß1¸Grq#Ð’’Á›r*>ܱ+½þ›RUËû*Vˆ|†ö¾¿gëÉ]…u4‚Í™íµfíÆå£{Œû­ä;¹:<ŠNcX@”¬F÷И¿'<øÚÞÐÐíq!»V°ÉÈx_ZùÙ­£ËV®Y± X`æbÂRYºiÊÞMVG=ö_ä Hkæ¹ûwDˆ¤ /·ï<Ê”íÚYM6w³’-Û°}ù¦${ÇQϲߘEµ2”2r¨vò…ÓÇã/ ¨¢…&”%Ä<ô ¶£uÏÆlþôêÀñ¸#{Ölˆ0s!CÛݼ&ieئ°ÏÏrYÆy;Ï#B ¦®©ôü™„èo@É`˜Ñ³¨u¡k.½æxh“ òÕ[%‡ $bU Áÿ%o•¹ÒŒ¨]åÎ'Z²3¿\R³9$lIÌ1õ_Ugxû›ÈøŠasÆ~ ¦_"ñÙ;×ö¯¬ ŒKùekçmÞKý[Õµ¸!}{ %Ü·ÿ¿lôÆNìÜÔo^xO6aµü÷ù¢2÷÷¶Z¤¢VŒÌ¦‘ £åŒ…Âv…þ»f„¸LÈÇ(,êç®Âok¥³Èå:–OêÙ{Í™5ž–³ºÆñv¡”ŤþËFo\(Ñ Âf! ¬–¿1ÜšÒ²Ú/Ñ%Š±õ_5õÁßt†/ù“Ûö%J…r¬mL)„O@@@X-ÿC«åß>)“K… -1Ñ'~2¥—I¸íÒ¿Ñ®N\.á¶I…õv+wjs™ Y$•íH@ðæçŠþܼÇ&„¶vyŸIëÒV…Æþ§¦Cë‡)^k[¿£è/K]?ÉÑÑÑe¬oBV#ö“7–peÈšJɶZê?\ ?yïç/tQ}ôª©ÎŽ£W¼õ§P˜¤õðÆcœ&¤s常úé܉îc'.,m—¼5nÓ×gÿ2Õk´ÛäEÕmRyÛÇ­s&8:Ž9^ÒuèÎ:½ÉÝÑ}÷¥WÇo¬íTØ GGç¹[/´Hq^ù«yÝÇø]ìzȾsäÜG HÞ…Í pr ªbxýÛKÞn£ý—D6IA.®Ý8g‚£‹WDâ«®™€ÞÞŽôít õ}GÁJ’¢¼Üœfl)yzýÆã|Û~½°¦÷qÇc“¿ëfc£@#Ëeb¾@ÞUëÇ0œ­Wõ6Õp´¯ C¾uzˆåâCs‡Ò¼Ã^Ž3#ºSgLjŒŸŸ§4ÊÖXù›ÁU,2ÐǼ’Œwò¦eëO…n tµSQVMÝz_czü¦‰áK#Fú¹q¾’¿ñò¦G:°ôEôZc÷‰J$äë™­iá7e¢ì—µÈ^ºd[÷w›Ã›#í}4o(c|ØËÏ^_gŽ(|˜°­zø•ˆ K»wXŒõ¨OØb½âܲY“ûé(PIßô.—oãè;ÙÉ`qØ5Oïþ<ÝVýUÌÉ=/§á.îã¼=†½˜2Éßúí:k9Pº«—Pû3V;sð"ÛÿÄj÷ó‘ûz»a§•Î šDE ¹¹Íj„÷dgãÕë/º{ÛíÓwʼnÁÒ佩 ƒ;ŸkÇ옛¿Ju˜í«V–V‡/ܱéÌÅ^ ñ§ß© Ñ—.±M<°pŒ½ƒþíF(y›ˆfóÓ¼ ;¾¯èŸššÚUÑ¥ÐÔÕÕ(T¶šª" XáÍØBrÉÁaqå~Ëú› µÔáäÝ<²;‹äwjÓŽ"&rc6¯W¶Ÿ8v&k=yeh@ˆôÞ®J‘,ýðê›Ý¦ù]´¡ŽjºxÅL%F÷¡aN}µ»–•ÅQÖÐÕg£|©oyÿôPôÙ ‹W:Xé%ŸØ˜F›:qÈÎõ{¹dëVk˜Î[6ÝÍ‘U®8æ:Á³ðÄ¢œ&!¿ðʲ÷|ƒft'·Še͇W.ëë7Cã}ìžso~•Ñ茦ҒŠºVSs#2àâ„¡·OˆßpÁ6,^+6wñwï+Jàãã3½ÆìªäRú÷Uew¼Áñfª®©¦¦¡ÙœvŽ+W:rž¶¶:›Á wR Fzýzu×îÈ°¦'<~ÓñMË…kÈÌz÷Âß?{ñ<]§ï•oÕ‹Û«Ÿ»9Š›±!CµÔ}ëÀAéFÆš…ù¹¯êL UUt,÷4Ñ3ÐS氨ߑóÊ{Õ¨Þ¡[KQÐlkEûTI+ÆTWQÒÑU){ñˆD×ÒßFWOG…E§wÛBtÌú™é*tüµúC¦‰~ãæåóvŸL’Ù~ÌàÊœ¬ÌìâÁ^Ž´oǛܼÂÁF–òÔŒÐÒœNº5(ËXÏ÷º3TgÍmô67ÒÕ×QTV$#Éb¼÷«e?mY2©ehµx¹}ú›¼–Üäùq­A3ƒ Uh(Mu^X¨…n÷9kÃfy˜£€¬v®³gIW× ‰c?z¤Ž¶¦’‹Íl©xjáíÒÞ ýmURêä-"T]SMUS“÷ø\Ó·¾Ín–œ’gYÏŸ":=´(@SÓ?¾eAàœuÙµÂN^ŒnÖ¶¶–Ýô õ””8”mïê`¨«£©¬Èb3Q SM]Ê2Êu=Y]’ié›÷ë®Ãéø¥"–‘ž’ª&³íýëfì­l`ѧŸ•±žž¢"‡,ª¹ñ–Úܨ߯_ãË{˜ˆ§ ¡¡¬¢¦ÍjO¯û6´JRéßGçé‹é…˜)B¦© ˜ì¿ïâÓΣ¨Ö_OGKA£Ó(ºÝ{öïa¬g §¬È&£de5uu5…Ì"ÑÏÎ9}¨*Æzuï°üp™PDâ¨)rôõ‹ržw<(:¢â×\b5Á¿ B„ã¸D"a±Xjjj?~Éèm®mh(*ÎíäQOÏJ{zj¹mÿ‘Òï¾®“ ¬þ³zhiè‘4FŒ5UU¶é­T/Æ®=~}yGð€>…¹w>6ÿøƒ¯žÐ×Äƽ۪c% já<[‡M33ÑÌ-(ö]hÐ}h_vuö·Js²Ú{Æ®ž½ÍzL œRÞ–û¡Ùø%æºÚ#=œÙ‚÷¯ùÝÌ´½C|jÞeþþš²õZrf–Õø#ýÖµÊq`ööw·ÕSÑ6¦¡Í%Lû.½ ,û›©²ÀtdÐÇÔeÌNø”¾yÂF'ËÞë5ÈR)8Ž×å$žÒ\í7D÷GA AS§ÿñs‰‘“š/¼,ik¨jÒ5”e%åâoý阰…E9uIBa4 :(™®©ª h¬jËð˜Eó,¦­ìºØIÎoS¿Ó{8Ýw­í;ÜÊhÚÑ— ˆ¤£Ý?º­Ò-B—ñ£½RA}…Ö´3—¯ÙJÞm”5|,”P)Ò¼Â*ù·¡,©TBVì:õAA î ÑT9t^me‡ °\X6iîŽpߎí§dÕnµÍ‚ßëudªDR–¶¡bnôêm±4Žú÷´uNeÜëþ=ùÇe)Gjl×L°ÀD­ª(þÔU)…Ö""­ßx{c:‹¬¤În©þ´*¥rhòV @­AéìŽÑ[.ÿõå+ò›Û„ß- [¿ïŠÝ§}õk21 . Zëø_½*ea=·ýgRûäÆ IDAT«¥¾Ó3ß—>IÜÊÕ¦BE>¦ŸYtœwvs‡·ǤMÜÖ®ë2Èj=4¨€P˜R9ž–Y0vAPþÞÆ­O³y.à5¶‹¥@×êUR$Ù±V\Va§M‰ßÔòiRÙV½l]=èUæK\.¸æ‹Û2k„Þwk%=¦ô»Y!Q ï…Jb§õEuzá8öøØŠ4²s¤¿åçÉ}{S³ k=pÔ͘l d²XÄ?~§Õc¼ë(O/Yòa®·r›d8Z%õ:—#¼[E e.láò…ŸÜ$¶f{Ï•³êÛqI}Äšõ££“m4?¥¤Te¨+üêJàuX›ßµåÅÓÍôµ)ê}foœ3zOø^Açò.÷»C"·8ÕkÉãˆÍÁt˜Z= ó%;"Vˆ+ëlµÈ­œ~eWk˜ ÀÚ¸99™î¡Kmû» Öá¦|v†Qhd‰;]—r¬]:ðpÚ0%h­xæ·ôáö­ó>ɃH*25}?¹è¾nåoÝoä•,ÍèÅA{©’º´²>SÚøé–¥¼ãëæ[oÿÅÙRaª™1›û,>>ÎH*Ý”¶çFÖǯ=hÕýµh_·2Öü6«ÕØ«¿õÌeÞy/¾¬/A©T¤c†#noý’H!?)zë]ÚUƒÈಖ¸u³ŒÖ\ðè¥ÞÑWw³spýRíÍÜïfx@‡Í:ò±¸xÏ%¶N÷Ž?5‰ÈÆ*„ºÁ?–_×µxxxêêê~m[t¬ki«x·eïÁçYYumØ AÖï/£;‘«NüR4y …B~v%.¯¦A臉âé­;Þ¾»q+Ózø†¸éìãFs&mNL¯õiQþü ÕÆc¤))fïÑ·¹/oä 9€IA«Ì¬à‘•L 4¾ÖÇÞ߈•õŸfküi ÈË{’*°ð´SCÔɧ·lÏÏIájŽ tìIB ùõ•[/Kù keÑãÅ©Ý÷2³î¿Ïö÷Ôµ0yyaÿý×ùR?ô1BµéqÔ­W¿ÜÊv±ÀR›…n?üº¬µ]O*Y1k–œkš<¦W§šz—rnÓÓÏRnIŒ‚¼‡1@tñn¡¯ko TNÃÃȳrž§³Íúhsh%i Ãæ<™9u0å[“ò£#v%§=ýX^¯a;„õ6~ã¡ó×nÞ›¶u“Jå̉Ë5-uÞ¤§J»™h+IxoFŒ‰ò™îÂDA\zuëþË™oÞ7µ`vCœêï¿ð0óVÒÇiÓ§š°ùÇ£Ne?¨eÛM7’؉C³‡4×$34râ¶ÜMú†×m®÷p‚¼:¿czTy W¼5gýÊm÷§$ܪŒ¿¿4)â»ùIF¾Å`;η#BQ¬ÏL4qöf ãlß~ óuvO`2`@ãíûÎܹœ^7/t‘.öÜwÞ=-ôé“,ƒ~T¨¤w×¢|¶äO÷ëGB 7åÄ¡ø;Ïß|”ÓÕ†ô±IÙ¹òyîówêó&8éˆß¼’š•–Æ:ÝgDw²¼iµ“«îÄ -*ª®Î¾±gÃë—ÀÊc¢½9Šcæ¸ßhµÙG_VoUèá÷oÝ~Ë ž2îþ®E1¯$T^aJfí`k"y¼cµÖè&ÙªeÕ^Ž‹†ŽWúöÖpþûÃ?¼Hü ³pÎ$´âyxT‡ü·˜¦µ›½ ÐòöÆõgEÍ2mkceD^;ÛiŠM@`ç_R½tÜ–•iÑóô¡Šm/ëW1<ËÈZÌöÂËŒßxðܵëÉÓ¶m´Óa"òæÍNö$gÿnJt:Ù´§(/½ Y+ÄÛ6jñÒ[Ó.%½š´ju]"«_èäk0M÷Ž¬ÛyŸÇá§>«ìÝO3tœ©»iÉ«ŒòV…ÞæÚ¥WÂò]Æ 0é(Îëó;§E–Mõîƒ"ðúþñèÓI/³Kq¦¦…bûÊ°IWÏ }&ø ¶èÃûª•ÓNm¿Q¯,.K{ZÖkè`Íúm±÷<.ô\´ÌJömYåÊ¥·Tû™c‘QäÝõO­L¡)4<¿~>=÷—«ƒ½ƒT[RÃvÇ%_;W¯í4Õ© ðhïÂÍ÷ÀÇÑ„yÓ6j™ª¾xœBѶ¬¾dÅ…J5¬*íi‰Íà¾4)wåÁ—‹WLVîx~¤Õ3œƒúLQ!´áå¶Ç2³syBËvù—¶½”tñ¥lþò6°æ )•žCi„ÖÁ?‹/ëZ½–ÎĬ ‘ùîÓWè%_ó>åôúØЊ—á@ÖZìî{êÜ­M#Ÿ¼úòÌò˜Ð Ä2͵rêé ´¿S+wò˜ñßDž®>{l¢) þa*s¿I;ŸOc±ÉÄ\­Ó€ —ñ%Àfüm*—ËÚ¥‹þi+.å 1“F!šòŸÔÊ‹/jÇ(L ‰0M þ±V î ‹Í&*¡+‰ÌaüÍ Ìþ*ŽƒPØL¢ÿq­Ü¹øt6‰hE‚4Ĥ„€€€€€€€°Z~&66‹~àº\Ìonûß+îKmuuu­âÿEÈ ÇZêëêêÄrB ÇÛÚøÿÅŠÀ$_úwÒþDZv^“ÃÿžJqÿ*úãím­Ñ1P«2q=W@$— øÿbµàÂãA_˜±#ã¿õzT½Þ÷æ÷è*´å'Åß.ú£çoýðp¦ï—qÓßq…?þ¥¸èøñÛ/~zB©XPü"~OÊ÷ï1îO‡ ó·5 ~bÖHŠãŽ\ù£¢ã8¿™·}öœÇ?¯°ÆÂ;~.Nc|¦ÿ’Ãûýhx÷ £‰—î»"ýÙóîî~P÷s”¸0‡Qkï•Ö~:|†ƒÃ¨™xR¼µäùhG‡€Ð(\pt]ƒóب§‡ÖbÿÉ»CÎ?âý´0ÁÅM3f„žh’â_Z9`ía9à“f:8Ùó„‹Ë[Ž¯Ÿåàè¼d’@i¶|êaŽSs›kg|îo³£¤8¼»uÐÝaôêciR ÎìXüé;§9å?k—´¸Ó–ÄtY´|2<ðâïÉ5"©{³fÖd‡ j!˜ éÀJgG‡ékq¥Ÿ²s¸9¸í¼øÇ!ÿcÇLZPÔ,yë™­óçí¼Ò&Y[õÖ%AΣ&½ù¢[#mØ8Éã—:<>·ÓÅÁÑùž«|“ä=Úa̤Gùõ˜àã´Ïõ0gíÉ3aÝÂ&ì?¤m%³Ç™0gGƒ~?ŸÖµˆD¢   -E8@£Ñú¤½ÇIZ&Ì<—p|‹®ˆ â³—(´½©Eç.œõ.)îQN­¶S Ç^öƒkÅ͹/úx¹ôÒñ>ÄDŸo%+{Ï2¬»xöNYÓ°­¼ÚcþBÝ–Ç{ãҴͼ;ý5•¾<wKÎÑ2Ý€%{~#þnvµ¾ÝèinÅʼn‘×s»þ´) âíƒÓWÓ,GÜš÷8±HЖ›eí0ƶ۷cHÛìeñÓ·êÁá4&åÝŠ?õ¦2«‡:ù~|L»Lò®M=h¶?ZzçÐá«/3«r³—-›ÁF%W/þÂ’V=ýÐ>cñR¤2#þrª‚Ùˆé~ö,eÍîÝ4“+¿ÿ­e:œ9œ“¸qí­‚h?‹ÇçNÑYøÝ×c‚™RJŽÅ\!éôž莗%GE%>«V­/Ê]¶b&SÖxéø©b>sÊÜ™†l²´­úRüé".êÔKŸ‘‘xòA~óP¯‡žúºfªlúÏgu¢òu³w¯Œ=« -( +¿ûRª]øæµ–óœÀA*y)‰WR tz Û÷k]z™°­ÊxÕ“mV1a‹"_;/µâÇ9UZSgjÓÑúwnU2³SìÆ÷F^ÅŸ¾Óv¿ù‰þàUóÇÐQ\,àãÒy”¨±¶ßÔ½+Üôheù`ߥ£æ(§î Ž¾ÖoŽ°ÁrùíõvTpYÚÖÀúîsæ™‰È ’ʘ ä˜àØd×nú]ÔöpyÊþƒÝ\Ž X“æØÓ1þT…MATÍì·v"qsüW$$Ÿ nÐO?É@HeJ[Õ‹ „Ö‡ãÈŠÒ—ïž/Ãʲ.­)Ê&YÅÆÛlˇq•Ö°”§â¼ÕÇ,j©YôÝ~šØí„S/Ê[l½ƒÝŒ%û·|ñ6u×惜‚¼ìõ¿´jËGÍŠœÞ§ÍÏÙ}à‹Lͦ¬“çï³M‡MŸ0‚MÆòÎì©ãd¼.éãPzóTrÚú-M{úÍ÷±DLÀÐØß[«IÒ/Î粦Ξ®Òô`ïþ‹OJÙÍ•KVÎ}xòÀÙëÉÊUr]ýÑkƒ­“âãx|~=ÝbÆÔ±J$IæÕ“÷rë pî×¥7ß¿™9/zQÇSYõæV¶ª¢€×¸\tbýž2¡ˆ/eN_±ˆ.>º|Aé¸;&lÊ=ü¶Ý9ŽòÛ‹xq¹`Ó”ùv¡'×’Š›È@ýûg —]ˆ¿ Ü?{<“«ª¡Äðñ÷Q!ãA;F¦Ó©ßYx÷îÁ¥m5¾€ÜÏká™Yj‘óöï·j¤8(¡%êpœ"ApyÆžb€„8kÊL`é8#~¦ú•%ž‰¶V~ã]p˜…‹K–o{`¢ ¾çâ//àJ’UmÌËw¸UÎùCÙ˜bY9ÏcÎk%&ä·SYlR'•/¬ýô\ß‘ËÎë¾?¹pû½3aN(±‚àùZètú”)SH$„„„|2Y–²šºº…ÆRSWWæP&îßÖlæ±pº+„‘UÌg„’oÏI-hl,xvîzÉÒ•Á± m˜üéþ™Êö¾îvr.*Kjéf›~îšU_•íMdÝ‘‹¼¬/%ã²ÄˆMýýgOi&Ç@P3yO™ÿ¬žz, ™ŒŸ=„v?³ @V·ekÜÈÉS°kso¾¬â}xwþÝüåÁçœê¤Å†·ã¯ _8†Žà²3Ó÷%fw- EAýÍù°)3ïæ6à(ÍÐD;?÷ÝË:¦¹‰:B¡«82uŠÄù ¹\pê—úò¬³ó¬¸WЈ#4Uuu¶¬á¼Ü¯‘B—؈41SbeÞ!ߌ¨4$ÏXµÿºH†«ÓeÙ¯Ÿ[ö³¤¡À¦ŠæM Z±¯´YZÿ1CG£~ûª…ÛŽÞ”àGYU]Mñ}VúŽÙ6d¡˜ èy¿œÿÓê¥29zÝû…L7O.j¨}x,ú¹Â‚¹AÊ Ê2Z¼f‘ ÃxiXx'“¥[IMKG‘,‹ö„GØOžÆx¼áôƒ"¼äÖÑ3Eìy‹‚M”•ç„­·éf>g]øB_KÕ/vvÿ ùî<µ©Bþ,cç©×l§ÕsíƇ¯ž§€"ž3º²žº&<|Ö@ ˆ’OœÕ¿h¤üêÑ+¯ùeÏ}#jg…Xé|gi²¼%ÿ‹¢¿„[p$&k‘‹1 ¯yu¥Á~ŽP2»›²$7ûE%j¤BA@©›5ó\»ìdzoDY™VY\Ü$¦öï©ÒÚ­;OÚOê+8{úaþûäS;^¨LqPL8|¥À±‹óÆn=ýü;žÑºWS¹ Fh¡J5ì®_—û²šli¦ÕPš¡£Þ°cÕÂmÑ7ÄrÉÙ»µµoçÏ[–”׈‘U‡ 믫­¥Â¤3éTƒ£®¦ÊO?i6d$%u$xQдØÇo|Âìe‡r[œüú>«à19Jêj*wö÷Hýá°Šñsë©–Þκéìâ¾°<•a!þΈ˜8&Nܹ¸ˆj¦Ï@àÖú©Ë£}ç‘QÔÐÇ‚Ò1À“ØC]Fêj«+qØ– :½›‹ƒ+2TçA­ÜzÐ`kSMEU%Yy¨Ã`]-MU6“ɤ“Jö{+|§Æ“²YÜ­•(ÚVj²ôÌgéÅJ溪úæ½l-»éè(*}I¤ÀIÿˆ»ý7máóM~Óü £ž·É‹ïžÎ›L¥°¶ct ƒQútëF­uU]ïŽfâ4ÍÁ”©nÆgóµîÞmúªIyE~\'¦Fã–¦nñ¶BȪ«}zrT µéÕ ÝFYê›æݘóäÛÐüæs±»×ȃœU_­µæ‘ÖM¨Ó­Wosýâ¹~«CŒM 6”d6þ^³¡jï¾þ‹N{Ár¿Qkμë¨^Ww/5Žb åìKwúùÎ6ÕÓs?ºËüo½ægd`r¢Ð`Í@ôLÅÕÑ®¿“+5ë|» @{:k²¨æ¦C(A2×L´íZ«mÉwnÝ8½kÇÒH® ][CE­jÉMúß½sónòuJÚÑBŒ/itŸq)zÅ‘%M /x~kÜ®%J]wàâX“Œ®ø)9ûè•;w’nºòNdÕñ¶¢‹,«áµá8}Ú‰·nÝÞmßp8.U*h¨Ò˜œpñÊHfÆíȸ/³l?§í¡)j7üÞtád¦"O W1·n|¶ÿ‚Ž²ÂÏÞ¸øÞYƒŒ{8(/ŒëEË«W¶ÚÝ0`©ßûÂ|@ÈÌ`ïJJšæ†œÎwKÖ:–‘bþ½)>EQsâpëN=Û«Ê|m–±ÅpzooŸ…9 Um“ÊØU›‹©øw/¿*ú_Ž91 t ÃdÍù‹V§Ît0Ç0 „DWRU`4×Vuè#4k”þ0z‰KÎÞ×MµbʨÐG‚²Ûwïþ2~äàÀ©K*s ‹½çMìÖslŸŽÁ!ùŸ|´9hP×óØvbÔ€á†á8Ž¨Úª’æšf¡LÚÞP¥9)áâ•‘¬§·ë¤|qã¨à]—bך:»^Œá8^þü“íãúi&l9\äàÔñ®ÃeµÉE+K‚ ›iÙ­øx!…ÃÉ@.¨Xº¯~ˆµþ[«{«`:ب§cÄå9Ööö=²nÒ@n={›@[ö¦×žŸ^­^»/^éôóÀ0ŽK.2Ù8Õ¶°(âóñ‰b*£E€€\P¶qñž„íî4pçÝ<Å ™æ`ø­qÐ8#0n’ÏHÀp “㘨¼–§¤ª†7—4µ‰“´lòš8uI0»#‘BÕõæô?à÷(Ϲñ1i×È!Ã]{tÿ£€lÛÏZ]Ï@üá­ «íËxÞ›ÓEq@.­äNì£üV&"Fb‚?cµÀ¦M›6nÜøó·ög%{yÍõgøðÂ¥VuÿürúÒÝc·é×£{ò®/~tüÓõy@œæK;»S3kãáÛe$Žá¼¼½+|.î ë4ùEª~¸°º„àÃ÷ÎõÉRÔò2ç‹Ä¾¯çŠq¹¬c±(]2úu6òg§4ÊP‘ [1À…µ¥,”$ýõ°´>ó߾ϛdªL”üI&¡²™x‹Ã%¼Z uxüó¤T™&æµJä!U¥“i ²÷Ù>a0Y¥ÕðVD•Šàò¯Ü²|Oö½² dÆP¯φ—?ºþé”O–†ª6§¹®î·†¶{\Þû¢´ ›X$Š:¥­M “ ZÛ(ªdò7Þl䫸°¹‘/üÍÐ4Š¢&ÁP*ÓÒÆ6|…ýë'¿º¨hˆœDµT¦‘)$@Idâ kºz:kI/öwG?=Z{}›ü·:‹ÜQÊ:fŽ~‹E.Ö|.EÁä2¶º%‹ó)€Hðìâõ±ó¾œBÐPÚS—þ9–!åòÚ~[û_Z”öf€ÍÐ5åUÚâ ¶³WîXð€Ào-AD>(**HXПÊPÆ…­ࢺr:ƒÙñȾrŽ#ðõY~3úm÷G:-öÄ>7¸µ]„ƒ¤©”Æ`’M~(صÄ+~ûæö®Ïµ’þ—¼ 6ÃìùiW®$¿~RÐÂ<âîÕKùå5ÏÓž™£Õwøø¹c™< `‚&Å€öYGÔÜ$’|·Ôˆ•½×ÁØÃÒĈVºÞ@¿eçæŽf1è•B$‚ѧNõUÞ†¯âáXý0ñfZIþã{e-2”°èÑ;téÈ×RX–l Hd²'›+3È2 $ H1ŠžX{Izi͈Ž0– !§¼OH_527#Nôtò²f_n¥pñÞÝòü+-”¿zÜ>1B—Õñáâ®°Ë’|°ÓçŠÙ‡”첺ØýR ó«gXK¯-¥n‰ºþ)xÚÆkiÿùƒÖŠg~ËíØ:]«WÉ{ñƽk%¥vÚd\R³yåŸÃ—õÙ¨x~yFDÅÉ0Î!”æ·È3ë—ËÏò*_ݽÝRù@Ü}Äèþý—oôHÍ+Å¥¼˜µó¬·ßr¶Téˆõ\Üpd¨Ã¨/ݯ•×üÓ tE#ÏYåÖôd È7=SÞÊm”uYŠŒÐUl¸V!û'Z‘d*Dtˆà¯ké@EEå™<ʽÜÈ“Ç~HoµéÛ9ÊûòØú ì–ÂÁ³µáÛ…¡¯ýòð^ËGôÈ!þÄ¿G7fòÙµÊ>f*‚Ú¢ ‘ñ 4)¦mÅÀe/®$Üü²¤¢1úX}@ÐØAÌøek××½å®8jY¿½¦•jÜ»vÑ¢åZLòØe¡ÞSÜ—ï^V«C2™8Ë°Ë4‚ª?êÃÞmu³gú1‘¯‡ñÞ#ÔO-]Þø®zATO`kØo‰ÜöqôâÙ2#¢$*‹Åì„GèF3¼–…nÆ*ŠÜ–ìŠÞðÊô£2îìYCx„íXÉ9……©QÞ†,›³ÌJ—Õ×-pøÀÑÜyóÂS4ë‡.U@ÀÕÑ8rëú2Ç€`OKã­óð N~lÓi%†´aÇ¢uͪZ­å…ýÇ­éTsÿeÈŠÝëªqÄhͺ€N²ý(™Áb2H€pVmðÚºyÝeà[Ê"u®1MÓþ[¶ï*ï?bîTÈÎÍSçu¸«»åRÔæ§åmí ¥>+7+ òÃBÈØŒ’Üò)–•¿¾¼;.‹$ªé1gÒç®Z½sM*³}Ȳ0*ÚuóËE…Š~76ÅEíYvåHín/mEø5ÚËCc4X׎íH+âÊ[j,|§iIKÂí‘+³ ‹„‹vÚk¨µl[¶¦B¿¾Ik¿pñõgõ3£¬¾Ø]Ù)£F±?[0Ù#ÇÅßKÒè2?,~pquÙ*™K”©ZíÓ«û~Éæ@KÏÞ„¦èÑ«%j瞣'¶ÓéÜÇèL À²q1‰]²v/¿4xWÿ®78´íà–†Œt5Eå +Ü'.Kù¾»å׋ÎÞ«¨ˆ#m3gù³QÄÒÜ0*|ëË~nóýô¡õÃúuëùEy¡‡ù•¹áÏ+Ó¤d=Ë®KxP¶ùP#~ª(Ø k3„o s_Ù[Y@qÊþ#†‰«’BwßCQY½á¡ùT¨ËÏgº1;c˜ðÄø>Ê;žLG?B IDAT²3èˆ]¿6OÆ@ZjzL_ ¢3b„Ò­Å«×+"ü~ ‡Ž}bå É:ùnEK\<¾Ð~[WwË ÏA5Ÿ7c£õI×/8 å°JóKǯ™¥aÛ–¬©0¨kÔŠÔfHVM_¹gÕKEÉ •[4 ÈgÕ}G—×;øÍr°ÑÎ>³30àPGÎ{ kOÈSßµÁVŸÁxô’euUÝ¢f¨.}üË­-+Î~Z²ƒK. lsu¾koMÙöGm±Ó§h“Ú+Oõ}W&óš`ßñ,÷q ®$†jOŸ¹ú çœÍ>©—òM!÷Ôguu·È¸ï¶í<Ö,¯‰Ø´wÁjÿý¦+ö÷ˆÝ»Å´Ÿg€Û`›³W,Kâ zS@ã–Ì}X¦(;¹ç«÷êÅ}WÍߪíà¾oë†c¦¹öbïØvð]ÅÇØí;¨kW{ùLJÅ}‰ëX%M®~ÝŠ¡e9yÓ÷§%ìŽÊyÒ¼¹c²dõtŽ öx‰U\_íÏ¥iœ76(ìÁ/f´.}EP½3,”Ç|ÈB7oéÜåëһ˄HȦu)ã…»»N½›ÑÉÝ‚PT–n Ü°!ŒÊo Xñ㬟ðíÐÆýû!çføϹrúž¡¦.ÈÛ|(+tÅ´ÿÖ®}IuƬMÙGϦ¢Ô½>²1gàÁÀ>ÿ-#yãÚu›Nýj’ïÓÎœ§º‡ý1EüÊáM†ëm9`‚rÏ~“#2™*ýâ%! :`Dý‹V'&nœd7nÕ½G}5iÿü—LýÝé›sOXJ÷ü ýÿæ#·\Ô.BØ,Ú¿óîÅ" •þ_K‡É$bŒD§~ò)É%|9ʤ’ÿŒÐjÁ1Y»Xô?¤è‹Eb*ý“Çd-mE柛<ÿÅ­“·´‰Xÿ† /¸L(’X *V ÁµZ~4ÓÐÐ jŠ€€€€€€à Çíø‘‡è?“Ky|ÉOm— š…9Q±ø“VKqÖÕ™3—nx[Ýþ?¿‡øÈÈŸ‹ ƒìÉæÀ€€€€€é×K%€5ï]=7`jÈák/å8^zãP@@@@@ÀîG% h,Þ°`Z@ÈÒÌJaÅ«³‡.xû=•ôŠ——o–ð áMrÇCãï.É:µuÆÔ€ÅÖKpÁƹ3¬nc€KŸÙq;OÞþaiÀ'öœHyãã“73‰®I@@@@@Ð òŸ8?ó"4"ŠÂ¯: —‹ß$_N/jéíè1ÔR+ïJ,}äT´*!¹)À×®9çQJ-ƒ[Åéå:a¸i}ÁãÄä7 †v¾c¡Âº+ç[ÈÚc}Çé0¿Y¨^’r=“‡5×5ô™b¡ÆàUä\¼úˆ¦ßÇgìP6/½SÁÔÏÉýhâàÓúì꣧OKäˆv·ÑÁžæ$µ )L&©Ëj@—· 쨩ƒ©@ zÏ^@“^ÚV:ò„¼¥ÉbÜê9£´©,ÀÚEŽš»i®JQ (hxítY}ä®3fŒ®uÑžz-uÌz_@.ä#ýí 0¦ÐY¨Þ@ï-njeO…Î<´È¦UuØÞ-ã)(YŠ%¿É³Þ³o†§¡ FxT¤‡Ôè<‹^Mß©ñd4Ïs°2±vŸ€€€€€à?ôµ (•ÂÒ² 9[_S™^Ÿ÷hý=¹‡‡ý͘#õ2¬4åFM« k¯þåaÐZüòÂõTïÙº©Š«ž­ÛvÓÉg²µ*’ñ¯lY¡ÒÏm¸!oÔÍN—¨~òª‚1Õ×~cX\‹¤9>â@ *ïÎ܀צ_¾QˆO™>ÙD‰å<»—‰ÉĹ gy™“yóž iÅâïDlèŠÊ±{7¬Þr¨ˆ+ÁQ¦®‚´0/§ ×W¦’Élå’äËV¬M)h·—eäµ<8µoãö#E•¡¢¢"-JÁŒGtUŒÄøå™ÕJ, P ͉]±lùå´B !k››5Tç–µöìe€ ˆBKÖºU+·Ç&‹dø³7åhë«­Âo<û GÈŠÊ**Ȩ̂š.v]«Ím&‚Dÿ¹ÕB7Ü°+ª^­žê}åyuUù{·Ùõ ml ›÷I’ÿU µ:^A56P©zýFaÔ¬î:j}† àJ/<)ݶhÚì ñåÕ¹].B²`ÇPÔ5hÌ(¯-*CLûjºN]ó!¿ãÛ±£†(r”MõØ ’Jè…Kfô®÷E¶!þèÑc=4¾ 8h ª ̶¦)Ž{-ˆ‰>¹>~OgŸcQ¡žOX-ÿ±Õ(Mq˜ÇÔبÀüœ·4:«¢NˆÞ.”(ÓQärL&–|Ñ|ÿ¢‘ÏR`ñ«*:ì„ÊÖÓ4MLz’’r>ª‹¢"È[ù¸\Ê•3X,TÊÇ—pkÉôŽ¬o‰ôkÉÀ¿Aç77wþÕx¡R@.KÍÊÎqª3û-ïs „„‚ ah²IJ¦.T¼§ö´×úŽjÊVWÀ¸Ø7iãP2 0AtÌ&Lr,¼}ëKih,ŠǵU(4BFp9€‰/o=1ÂÖúË)šE` Dć¾ÄÿÌA’ªÛcÄŠŠ¼짭1Ö5„mÜŸ¥Æ¥õšÌ!µy;ºÿ‘Ý„C·NÇiöw¶KÙ»7*LR:ËwÞô>û÷ìUc# z§ûØwrè¼}™‹éxÎÐW6véMټ砨ü£Û‚)]‹ÓÓDáôÁè='9£XËþY³üâ.˜}ÎÁ%‡¶D 8ìšj®ïœP97}ï‘T@¥Õ Z¡~ô{碳J[DÍÕ#¦ÎWaéxŒÒ_¿=m(â¿pìãõ}Vƒƒß3ðP†þH I“X®K&ç>¾œ˜V‚¦‡6Þthãv&³©ºÎqÂ"h}¹#2 GEÕü¾›5б.i‡vxÂdô2a¡ÂÆ C¾ä7ÆZ›èÝ,9„ÕB@@@@@ð­qð•¹ÿ!Oö-ÿ0,tš­Ò_¿ëòï_lµ™?@󿤖‰ N_)ïíïlCôNàñ¸?W™#ø=h˜;Ëðÿâ éƾ»ÓˆŠ% èÄ_Ô×B@@@@@@@ÐÁ_ ¡K@@@@@@ð÷àÿ·Õ‚Ë¥õ\þ‡#*¸”ß$–bÿãÚÂqQs“ðÿ¢8ÖÒ&øƒµ‚Kø\‰#:1aµü&òæWó§Lñ ŽMÎÿéŠiCæΈ‹¿~l«>Ÿ-ýWyxþà;á¯#tÍÓÓ%‚ÿ»Šxrõp¶ð§¿Â2ö,~XÄÿòYÆ{~âK%Ô¾Œ}ø±éÏTiÃý³Þ}ù˜}%jͮӟ¯Ñ»|Æ/ÕbÀøgw.Ÿâ¸>:©]†@[ÙK¯Ê‰NL@@@@ð/´aÉXŒá8ƒÁø½s|AIÒ+ÑÎó?œÝPIJµÖe½|íܵû<²š©Ž .®¿ÿàY6͸§º$'ú蹌¹ÕÕ¥êÆÖ â‡ânÑTº°ÑBAòâblvÞ»»é:–VlTrÿÊé›ÉO劦úª¯ÄßHN)üX‘SB¶µÑ)L?së­¤Gï¾ÊL ŽIÞÞ½pñVª©e¤Á.¸~òIAÉý‡Ï”Ì{ªÒ¾1Âêr3.gæ<½wWªd ¯Ê–ð+ÎÄ&dÖw³0eÚôk)un^/A _^¿vçaAqÅ»b¤oO=‚‹ÛÛ1™„vÚ„|tí½„’ù$CÑ¢—²¨àXô™ô9uuelmK^AòéËw^å•·÷îmøæÌ‘Œwùi/Št,,9¤äEòÙ‹7sÊ[¬ÌMÈN‹IîmY¥ïb LYóëk3Êê©îÎ óæ¹—-\…žŽÖ $E‹±n²{Û Yƒ{è+R9:GŽÜéЛŠ=™€€€€à‹H$DQ”F£ÿɉBSÕ4ðõ·ËÉÍ­Ë}¸áæ=Á+÷F\^»ì㹕<ÍÇ9NRê5+hŒ¡IÿÅ‹šh°È*Vs&¾›V,çݽ"±ruÒ¬Š¾ðpŒmd;yâØÊÛµ"ù¨ñSGõ3÷ž»x±? VC'f?¯k·(=4Iìá5âþÉCu2¼<ýfbê3X}Ížté·ŽŸæ²ÜÛ÷ª§Íœrëø©Z±àÚúŠv®VèÛ-1Oq¸¹i‰i…g†ôÑd óðwdá9wñâ€T&¹Ý}[ó½[—Õ ™Öì%[Ò0«™Á^ÚZ=.Zlc¨h1pÜ´q6£&ÏX<Ã…ŽÈß'_ÛC¾eÏ9.9pê‰ÃDÿá–ßYòŒI[.¿¢ëh°“òï¼l?zU?{ÎSw·Q@i:ZœÂüÜ7\emE QÙª5Ye|"HD@@@@ð¯à?Z×B¢+H$ÒÒ´ê´#þ“§Þzòüeµ\³¿}Ò©Ès)E¦ªä‡HLE[esma}d_‹œ4yúù§uµ’WW•ï<ÓÏÐк¿ýe@îae¢¢¥%)/’w>1rt£S•Ü·Uµ÷Þ+±î6Ði¤8ï €öæ¦Ìdš)u®”|!mlÝï]Ÿ<`Èó=de…ÒÞB¢õ5ÕÖ±êC.I“ãdJÉ·ߋµ)]«\&æb:€ê7çÙ¾s9†É¥2Éží×FŒsÄd˜\*Åp%34Õ”e¼š6±AÙ$A‹ˆ°Z«åÇàXåól-[Çy×õ>|x' ;e5ãô‰½ÃTªæí{ý%)Ñ÷Çu€/‰™…å7øv³“îß §ù«â{Ã1•Î©¬à€·· U ð[œWÙ„ãÐ*’+³Šh›X†ÉøÍRªÂ'»‚òþìW—ÃÍM"©ìûÅî”Múët€`Ÿ?ᘬ](‘ xdñžØ=«ê/®üÈw>#…©GnâKp`kôP«Ïy”žËk¬xS'sðU™•ò2¿¶èij³CiìîV}–Íì‘—÷“s1u±Œ€€€€à_ÁŸT™ã–¼Ù»k{U‹Þü½tä*‚Má†RyÊ’9ò;‡Ë@Æ­áâ…M5$‰1'N9ó£Ô½MJ}"i¨?»ø¹}3p«õj~ûË…¶w¹…B_èfl»ïà;ëaãŒÓ._~•Íµ^äno1D¾n[Ä+užÜÊ›ƒ¤þ¸œ9î¿ÁÓj£¦Á pdÿ~2¿aÔ¤¥ÐÅÐ102>q0Ïzh Wo .:;ËKsõ¹ßp·|å.â˜1ŠÇÆŽtõ³Ðå(Ø=:×d3ÀßwàøåøèdqÓ€ÉsIˆäô‘C<9Z‹[Œet®s”¢èL¯¨lîn¥ªd8ÈŤÕHÒë÷vº,Ðu€W¢gïû:*J #ö$ʨ¤òbÑÔµæ 5 ÍFê3«…€€€€à_Á?Ye®ðvì)Ä}›«æÿ`­*.:äÑk× +õߥr‹·çºË›ë=ä x}Öá7gKM¢üƒ!ýÿbÆ#ËræXùµ®T{;R¨Díü[†KBÑŸ€€€€€€à¯ ¡èO@@@@@@ð7ãÏZ-¸¼©¶¦¦¡ Ãÿÿ”—´5Š¤òßú“‰êšÚñÿRaäAMMM›HJô‚¿¿Õ"kÜ6{eƒ@ ˜¤åÂîåþ“¦l8úKÇ^á£Û÷–JþËVKí³³¥¿)¹/®y¼îΟ·2dÍ [ûO]ô®Ž8Žó O\}^Bô‚¿~5.J¦êj)¡d\ËÔŸlØÔ؆KÛÎ=ùøEfuÔ>½îcfŒ3ã¾}ð°†Ù”ÿŒÓ{Ìäá†o’Sóëû™8ÄL£æÕÝËit óñ>.Ôò×U‘5ôÚªê]¦é1¾QRÉ{|ún.âÑ~mÑÅ· Pô\¥§“§½&¨<{úªŒŒh@cñË+·Ò@«×dï9)yt[W+öíÄ[ýÜÇjÒ‰P€“h4jç»~uþÀ{]߈ɤ%;/Ý=Mcéir&¢{ü…ø/¬k¡2™M%E¥UMºº gÊü…ÖF&þ –„x˜¡´–¼¾|ë±ßìyCLÕÞßK8]¤èïuýPL©—Š)“z"¯"Îd‹ª3$¦}³ï¤YÚ¨}ÝÒ)ÔceïïÂyQ×*QsÕ™SO=¦%o–‰/‡.Å»;t£¶ÊpiÝ‘·{Mê-»}3«D·›^Æ¡­9ŽÈÔÔi(àØíð™Ç~Éíz /òê­zë–µkrªžÕ ©Y‚–¯å Æý}Ž]:¿-=³QÔi/j>ÄS•AUÕW9ñÕëÛçü®ó}£ÌT\¼8pg»TjåÐLIFZ†|#-í†ü'_F´Ç)³•uÔ0ž¨ý^‰âÚ–õ<Ò“ZYMÚÓô””giÐoVã¤!Î>yUæ¹ËƒP@Hž»Î|÷Œ ¤uùç iIä8Ñ-þ™V BS3ó_¸™¼wݳ&¹³¹“Ê=ùsD†ÍÔ ˆÚ=½ Àø% Ž¼;~õ69'><àWÿŸ«–üª©’•È"¡— %r[ÛÆuÆöUþŸ¥úèE]W,ÝSËk–§1qmŤÜæ³&û×­²‡vý{®Ü¶vÃ-F³¡#­84 àô­Yæ Å3úMë»zcSo[æÿ»«¼^-MˆÚofà:jyûätРAA“¼ÊWý°ç–uÿÔÚ¨Ò¤¨çÇBæoŠ@˜JˆÜ>jØàQSWæê0BHšùtæØ!ƒFÍH+×!L&\Ü2lÈ EnÑX÷ìÄúƒ'/Ù]n@Té Aoe‰Ïl[üî§!ó ôHž;!`ð”•Ge$*N<P±hðØX´OàwÌ%K–èu:c>Ÿÿ'·¡Õ©ë7_Ÿ²ªccw##s#.~sïì‘37$l«êæ´¶èè¾ý¯³²Ÿ¼”Õ­e~ùúójÕUIouNÖFèŵˆãnÓnÎœgÇwÇ%Æ_}ìàãcÂFÚ’ä£áǼÌô¬]“4÷"DÞxÌwñ¶q>Þ»²(5<:%öÚÙl­ÈÛÙ")ro¹…)™·3"ÑÇ2ýȱ›1IY¯£®"ûœÒ”¨,iÆÃË:W+©)8°ïnl–½—· ‡Qøð줢[ç#Ó 'mЫu›ý™;¢HqÌ…èçb£.í0ø–mºû7´”N +ÐÞrÇæƒ=&Îܹ©¹‰IÙ««+V-˜ÐØËAÄg—ɸ݇ q’>Úr—Ñ­móv:uëÒªèÞ6½ÖoÔ´Sç®Z»Ç(ìú4³9²li›=‹ÏEfX¶oÙ²}ÇNÝ:7ÉŒKéݽ îÂð?O«Õ0 .—÷-}-“ÇAªÔ´LßÞÚ”W”x{Ù=Æ€€~)—ÂÚkK'`O?WCö•{oh¬‹y™‚Òä>È«ßÜò-wÊ\çÅk—D߸°xÕœn ö;ç>(|ðløÃq­ò¤â8ÓçÕp’‰™Qo?l‚1F½Lˆ»1è„Q‘‚²¶øø8 ¿fB3;KZJU=6w'­½‹»Aó›î]ÚÙ;Ö6W¼ÌÊ:þ(_;–@ÈÂó„BŒÆ­:› øf.|„Pußa—|?s²™1',GLµã>¤(ƒžÂl&ani+b‘¹å*J¯” Ü·¬ùM÷2d×£„:z é5iÓ,û-ó¦ÆÉÚ76a$qGž‘KVú0„~öèilj3¹ !D©ó×S®ìoôÅ4Á̼}Œ¬×QO­Æ¯%µ=Z'ðw£„ƒkÒªÇÐ&5‰µwã½Ú¯:;·‰ˆ@“ò7l•JKiå* !„˜Eb„Uå*lD›¡[ÞeôGXsì] „"<ª4_M!c&B™ò,fìÝßÕõóƒVÄG)b8L¤')R§«`*?Ë %;*tØÛTdoê°ýÄa{!ó÷>#öïéXHZ®%ÌLøU:8ÌêY¦¾Š.O“”È’Êôum¸Vî{õÞ04\; ÈÖ( !Ä`qhš67µçpÙ!&A4"UóÖÝ8k» %43¹Åæ%Äè{̶æ3,[†¢ÁäݺgÛo™{"„>/‰ò°ç@ëþvÔ¢/ضz—Zh$ÍÍn7rž§£§vÙâõÑŽ=7pZðø©·o[gƨ"ŒÜع;÷ÁÉrÚ¨M×n!Û–ov²QkŒÇÌR) â˜k$_»*ÄÂȨ÷¸qƒzlܹ2ÕÎ\¡µþõ·¡&_LöƬãßqÓ™æj„l> o$‰'·l:/qhÙÀÆÑvJ›°u!f"¦È¾é˜Am«ö©DŸ™vÙ5Œ[9l1wmÖÑésu7“‹êZ¢[×f(Iµ¤¼Ç¯ÁFB·vÎÊ¥+×jósÎéÍ3f.[¹áµ…Ô¼i=‘rÓбZ÷Ö§÷n³tm5¼_³âèS:çVF#rØð,êÁÔ`Ǻ¿zËVm %ÿ©£¦³.mwk<ž†T½®cnÜ? l £‡,N=¶3ˆW_ü rãBL€ŸÃõµ`Œ¦Mƒjú_·y3Ô€ÿJÕç•*dÒO×3Ù¼ÅdËVÄ‚‡òü¯ÂQ”\¯“Κ •à?¡Ñhìчٸ\.—Ï|º‹ÅFš4Ñû¶û“ES:ÉäsYmì cR¡P392Ÿ®÷éRU^b »vîÝô¶®f „U¹Ï\x´ð< Æ´,7þä#Y`Ÿº×/ß6ˆ ÙÕG ôåêçO½ÈQûöl!K~cÖØÏJ}~MP·³ƒµ“½Û­¾átlž¦]ÿ¡um„¥éÏŽ]zân,Æ–4EªŸœ?#6v²æùuënŒ—#"2œ.ƒ\”^I'ùf,qN½Þõ¯nŸ‹J,nЩ_ëV±û Y 1«wÀ@mÌö½—csµ$sØÈ@KþGÖ=<¡!u)jËCz‹T9§ßp†þbûêþeǦ~7N]R©U.îÆiåöcúzÒÚÒsû·—ðjôk'b¢Îߎ/¬ãçß®–¦Ô'¯¿É35&£‡÷ã2‘F­á ŸôAaS—†ÓF\hišÆ»Ç˜¹£š=ëBKZlH [Ž›Œ^ìT8qþ¹ã«ý¼Ú Ú4Äüަ闟yø¹™ÌXaÅ*_»i£uóü@ji IDAT&ÕF¶8ø@YQ´2ýÒͧòb%IÓO#•Ô·{¦åŒ9Ùü«¹wÇuÝF%œÚ°í¤×Üþ·lk‹ e»Vïòæ~¦ |©ß?jyw Å4MÓÔ§/Œé÷­JÿŸ–øæ— þèéÍB-©¿ ž²¯Aç¾­kXi(ŠÆH]’²ïàÅ3±úîÅ»5z ñÊÚû*G’zëøÉlë€>Íwo=¢R–ž»™¡,Ê+T¯<2bP4Mcüî0žÙøÌà9¨Gó­ Ê•…û¶íпÎëbŠ¦Š’î…&ZônmwýÔm¥»¹a–ئi¯ŽKÛ)-KÈ',¨ØKý[\~’ôöÁ™ƒ©¦CzG…LWëßÞ½¤wo×ÅM¾ýø+lÖhü°Ö5ê·™<ÜœKT:;Jwó†QÛ€Öœçgî¼Õʋ倫S4•™#Õi¢î¼v6*»ú’I]Þ˜§$Y9¢¦Ý=ËN]|ü6ëÉů…ƒù?ŽOU‘©¹~ô€ A÷¡=~!0Më‹—›‘«û´’i‘­‡£…Ñ4MSl•·»½¹¹1ŸËgcýýD…»#§Œ°a%\ø5k{Z˜smléXÃÙÚÜ\$42bbŠeáájgJ¼«@Ã¥c—=»öbˆ¦)7o*õɳ§Ñ¶uꊟ†µ¬ÌL®‘H€ –HddÈŽ)µkÇÁ¡À ^ð‚¼àõÝ^¸Êé¿Ò×B'¿Iïü ?Ù<õU†¼¾>SÝbB]+²BˆVb| tc“^¿U šÆ¢êµÝMx&lãªâŒ¢¶½‡˜Û³Ýˆã‹fšw/¥DkZI¥<#LÓ˜Fïwt÷ÕÛ»©1w#„Œòsê— jxZ[˜v®vNƒ‹²^÷:ÁÞ‘Ù¤ÖMJ+?S˜õpABlR[ËÚÒÉÑÝÖÁÊÅ ~•›r--è:Bˆß¸LØ‚ZNf6BkÍÓ<šªEWt }zÖ4æ˜ÛÔ·di½mo$–Ò4³"¦£1¦1f™ºx8±Ìˆêž¹¤FgzÔnUÝŽaÑ{ÍÍ>|}ï^ÇqšÖÓ eÖË™é MÓ¨(ñÚ ‡1ë}ÌišÆ”þÈŠñ1McDÓ¸â"ó/dšÔn†iLjô¤ª¨@Æ4w°5Í»®¥héËžE–T[è\±Çw[˜û—:Û€ï†ÆUçµ ¯L\¨²”Ö¤'f,cž³|ÜÞ¼NlZ¯Ê|«§kp‰ŠuÑ𙫩çÇoæ7io‹ß_ù0ÂXÀe¦‰µ´#Sa`[:yk¶=ªP;?J*¨1F˜AÓTÅŽŒyf“6oíàÌCQòx¥Æ+ËÕ´³ÆÙeZìÀQJ4ˆÁ4çmÝQ×’Ò$縉€Q1MG ´îµ|ÁHºHDT,|?‹‡ ?;›côaM„bz’Æ”V¡Cï/áÊÑÊU:³ÄyB¾·€eÓuÙìqµ„“sifq˜í€RÈ”“ϧùÅŠ¥ ÑV»÷ji‡énJ1ÝÚ[ö¿ìiÄBÙ1¶ßÇ+~mÀÀ˜¦ÔW·.6ï=£“ù‡Øâ]1<šæ¥Ož'j Š”YIBv ÿ!®n;ydªŒôP½^¸'qÞÌvÅf†‚x…õ|;ÖŸoÀ÷!B•¢„iŒé/$á—–¾¸CxvlÓ¦2¸Þ_‡Û£ï—K›6g yfFÄñxFíúõš·b]ýucBÓ—½†-[ÞÞµ>ôW×ÏU(jìMkð£. j×ŘFÔÀ4¸Q¿Ga!Ûím´z£áú¿?’ŠK;Í4¯‰rì;¬öï×ËŒ÷ñ¼#üî˜æ›Y[%†9î“š§m„éŠð ¡ŠqšP¦ï Û.ÎÌë;µ—'[µ5d›ƒN/61Ð Ó;zWÕdÙºi+GïÜìÄ®Zɹ¯.œ¾›,ˉ`ê:ÔÐn¸QÚ¼Ùm)ÏŽ ì>¼×†£[“Øt¿iÁF†¬¥[N™Öo¼;t{ãö}-Å÷ÂbÈvDdê#ë¡cß ÊÈ$wâÚ­M›”ìÍ¡ð¸ÚŽÆŠ_nß³®È†Cy´ªÆ/ß:uµ¨F³ã{w¸ÖòëÕ®FÞ­pëZí¹ˆþlXòÙ|ß°åÝ5è]–¹ü¼÷éj¦[¶™nÝ&?N2sÆÓODJÕ”G»oëÀߦòá½ü7ýˆ Àÿ­Vëàèü{–¹/ßùŒB¼èGæZí´”‰wH ¬~õ›Ø/_IÀ›ùoâÆÅ}h PþUï|¦)Š$ÉÏ„4˜LNr2'9ùÇ9ú®ݾoä÷ÀdÒ4ýÙæ|4EUüãO<ó9$êëÝìÙPþ+žCô'¢–6(Š K÷Ïf‘•—Ë4S[ûÛ‡€ô*™ -XÿØ(ƪò"dl#äÀ³²€ïµ|ËÕ—’>_²z/BHŸ¹éø?³IÁÕùÓÅ~ &ëù•ÃWŠþò¨Y³xéÁŠñ¯Ü‡‘ko—ü™­Òïž=tÀ  iqE D«.….êß¿ÿ¬‘òªû§mšy/Cõ¥r cvÝÌ(ƒæü˜K–,Ñët4Æ|þŸ½«3ÏßÎìÒ¡9%~q+…Õ¶¾[JÔ©C§®JXÖžŽfÒ¤;{œ}ŸãâSÓˆE¤=¹|àÔMÊÃvíènÁŒ¹rìè¹”…»‹¥È ,9x=1ãáÙÛq ë{@qø‚â´X•sãZ&L„¢èÍÝû§”{xW§JS>L~qåt¶Î¸¦«5­Î=´{ß«ôܯ´õœJöy—˜“fæZ›Uš|7_v7R)tò°5AëÕjf°˜Uc5&Ïì—N½:5´Y°ùI·ÞÛnÐÐ!¬˜]QÒêM½,?>õŒ;çâeú'ŸZùÔ7Õ$œ¿Ÿííá€tÙg¢sQ~ô¡“×bã3S z1 âˆ}»o={k[ÃÇ”ËxûôÊÁc‘qYÒZ5«³0‡ø³´Z ƒÁàryß8Ò¡.Ë‹ŠŠº÷,¨(áöŠhîáƒÓ®NPbŠèÔoX{íŒuHmæÎÓq½ú´r##”rãȉlÛQA/ïÜ“©Á”N~aßnÇvCº7ûÊe“âC[w4íÔÖ:5üìc¬ðÔÑçýFeÞ8)%ugýÆòéìÁȹò0“0­;)¸³KãY³fù8#D•¼Ní׿ËùðH%¦¯,»çr⧻0±µ§ËScž?«ÙЋÃÖiXÇÒÜœÏ≌…ŸöæȱK‡É÷hN)o+i\x+T‹¸5[ôÓ§^§áÁ³‚{ð°úÜ‚qüzÝz6ä­]y”¢õ¡‡Ÿv>ªS=[X€oó+fò„ŽŽŽÂÉPvêƒÂ‡/‚¢w!ĵ.6t`/²±L¥ã:ôÕäZÔjRÝ¥zPoÇl„â_¾ºq:àBH.&íx„ Î€Fî_?ªüÕÍG¯/ÅCUëâŒow3¡™%-Ѫn¦›ÌkRúTÂŒ*üô0Ýüülxç•42b1{¯=ú…Æ–ÖÆœ¼4 FXç"ò[ÛÆéÓkÚ²¹[u­Sþ~±al]|5Sœt {Àn÷J‘–¦øØãÅëIB&ÎõIÌr䄬 í=`˜3L‰¾gÔÂ52«^½ºžeÉLC|#ßå³ç51&ºòÉS¯.-­>Šl˜Fƒ[…m\cÁ–1ˆæ!¦±‡óXèÎ{«úÄL_[9)·ù¬Éþu«,¹y|Çã·e•Ä§÷ +º`þü öõ[íÞ²Þçÿ­½*¯ËxxiÆ UƒI³-¸ †g ÙÎj³&TÄ7Æ.Í¢Âöø49Äw΂;Ö­2±…6Ƕ>¶¹L‡Ê°O! šð ¾ÏÏÿLidZB(OºþÛ ÛðÙ˜ßuÚ6¨ ·ÍZ:jS˜ ‡ ø7|¸óù§ÿÞ¯I=5dÖq–ý/;w/ÿÞ·æ%s‡Œ´*bÁ\à_÷³÷µàÿ¹¿•eàûû¢Zš]¦Ôþˆç‡±NR¨ÒQi#Ú É/ÓÀCŽ€Ÿ&j‹¿”ƒŸ<µ*¨oß¾}ûö½ï ƒÁb©Ÿ¼ŸúO)Ù½`üÀa¿¾W †(uɶ%Óö÷ZF!„¡dõä À K‹ôŸ ZHÅêékŠ+aÃṶŸyZ±H‘ñ`Ƙ!ƒ§¼‘iÃCÞ)ÔÓõÚÉãïgÈ1)]=vn™Ž†öü8¾6wÚ´ižžžAAAöööU©tÂE;7¹°‹Ëgó¸Ö–&Œ¬wýÒ¤;áWc±Ðiàˆ¶ö4KâÓiPú®aZ…Ø<.»êa<=°®ÌgÔÖáºÉKOî ér;ò~÷Á}TIWJ«uiäØvàļ¼õŒ6\_9ÍÞáî«I‹.[Õ£Êc Åi9œ˜!J§ˆÖº[¾'QS­\°öÚ°y›Üx:Ìe)eRµVzlÍ ×Á³[º3pr×ò×e~5­¡‰?ˆ¯õµ`ŒU*ÕÌ™3/\¸@Q•Y(MRì‹/^‰5U¶Ò«™]Žèè©›±îA›¹ûìkÿþïî9^ ÕJ^]Þk2~ühW AEOÈ…9ÃÃo}¦“æI²ØÓË4Si)È~PJY¸mºò:d×c7/wGXÛ»šËBaRs#NëbfP ñ«kJ²ê Ž87¶A3—Š‡>«ËâœÚwvEEÉJËŸê´kàfcaçlÉc!LÞÞòÈ~Tßæn !‚éêë—˜Síø9¢„^¯g2™M›6e2+ç#a°mÍDÜÊ‘BDá²)£g¬=¦ÌLÖD›û4®îìØË‘@ÈÈ©:+%bãî“,#„vÿ­gÆt©ùé~ 4Ò¥\yVÀAêvbØ9¥Þðñ5-ª¤µÅ:Ä–½y,å ýÉL½¢Èʈ…B˜Ê¹u¬‰“qMæ…Ç%´NÎp?ºQZOpò®QÞ 1MíË:hÀϵ0™ÌöíÛïÚµËÆÆæ“í¸®Õ«W¯naÌG!‚EQ4Bë%Ë–\[°÷TĶY!†ÈV©T"D—fI1Bë†{N™à»}ÛiBaT¬Ò’ŸîÚÝœ©·h±pˆ—˜çnÁ#Š%×sûÔ5i•u™SµqÃÁ#Z˜ÉL}øŸŒw ¬<2Jõ!l(?zA¢*LS™˜ä߸Ä0o KVÿ>qEà¼*o¿–RùŠ’œ,Œ }?GÔÚ¹sg>Ÿÿ‡¥0ëJDlØ}NÃ2êÖÖêÂÑð£î2bš·ð?_²ùr!"’$?X³qûáÃnu½Ø!L^Z4æXÔgFˆ: í—±&díÖNÁÃM4‡O=Ù°`ÐÄF%"ŸPÚ²-!«rsŽmÙ'cùmÄõ½kÖ„]>'HðIf\ ‡I7ãt4Ræ$%˜÷èÜÁ¯CþΪZ¦ýÐúÒe‹—­\¶ú•XƒDLïÎÓU§7Ü{+E´þù©{µÝ }?Ž;ËV(”<ëþêa¦ûºçÓÔöø‚9ug¬õ±äüù­HyÖÄÙ×Öo'bÐD€ÿÖ‡,sÿzÔrpùèƒwr› ^²btsãûÓÄï‰þSÛ`#ƒ€˜ø߉Zþ™¨2úàçðÏD-Ó…Eú‹)ð±^V Ô‘g:I¾ZOÁ@Ôò\Ú²älú»är»C–§k¢ —®Çê¾üàžÂë Ÿ¦‹ÿNÔR™S®ù;%”¿:0pÅá›?Ç_ ì?pí‰çFˆ”ì_4¾ß ñ¯‹”ˆV]Ü6ßßßÆú3rZð3G-Î"*÷mѽÝÒË¥Å2®™!uȆR b „0ùúÈæ“ÇÃ×nÜùFN!„R]Y¿íU¹!„IÅã;V­Úð"«<;îîÕœwiÜ’Ï©ü!l\8°muȺ;2„Pü}‡c4L&ÒIrBÖ¬ZµjÕªM‡å4B¤üÜmë6ï~#«1hRI~îɇ|»Ó&¶Ö©´!Dæo€×íÞd¿ýDûüØÖìj#v®²æ„‚Bn-ï޷׺yðr24à'ŽZ¼l¤ §.Ç<Ë+ EfÆ"‡¹³§å¦e’!„óž^•Z4ÚÊjٖǤ6cWdBßcnæa„ÞÜ8rªÐeL ß®Í‡4ZÉù™Ê´r…:!ú±IåqE·w=Vx0ã1Bµ}Gù[%”)ô!Ž©ãŒßfïÛD-Wq‘þÚê©rçvƒ;T[2e›’Ĉ’n”ñ™nB`íéjûn"Yc^¯¶4¯´nK·Øbõ‹”²>V)bSã˜B¿VýZ–fæÇØÍ? Ö7lcìæ¡;sWÓhdRJ2ßÜ‚…På]³º³%§\—Ÿ©+Ȳði\͹Úð^ŽÙ¥dûõmåÈ®F’Y¶Ö=»s!ù¶Ý±TPeZ°YÍù{†b„>¾™ L†~Óöëý–­æŠÈ˜‚œ'sNˆÅ·S鱑À|AÄ©?<¬SrY¢g÷Ö©ÉSëi åé—ßrYˆ4PcZ•{û2£CHk'h"ÀOÜ×Â2÷Ô¤§4èQOu÷ºÐô3OEþç„ad«ÓjÂòbFHÈc–i0ÂrÓÌÆÍG{ï¡ã(*ÿ¦Ô¨N•xÎ÷Þ=Ô×}úê;†*Ëh}TȸúC'Õ5c!Ë’k¼rÿÙK—.;µÇFÀ@ˆRH$Œÿà¬êgk†O¯Ï̬aÍsµà¨„ VŒð‘pœ¬øŒÒ”¨ ¡ 'tá@Âà‡ñ-}-×ÚÎÜØ×ËTÄ”ÐâœøˆKw‹r“öídv6äã5™–-\Õ›¶ïÌ/zchÛ5õkkó²µW¸ÂÆÝÝŒL›Õ!ŒZÕä_?cT¿Q•]?:»÷~S¯lí;‚E)®†~ñ¼\Wr°¼u‡6ŽÚ•QtgÁ…í¯íGŒì3uNÿ­[VÜ0áa^Íi“{ó°lËøqExòªFÒ7g·¸“XÀ ãÁ]Ž/^££k-± þ«6¯^}Ñjø8KT0{þ»z-vl ©Ý²oÏ65 •?È2€d™ÀO¢@ÔðCE-"W¢ÇbMJ#Ë/Qbü³U­ÎÎÈ(«¿¾–Z^–‘‘Qªú/Åå2ÝG«`$_cøÃçàââ2ê›j‰Ö)r‹ä#„°´´ˆü£BhR—/V½[ cqa^FF–Ìð•ÍpyI‰#„ yY%Røø!¢–òòò/-Ò•§¯˜4´·ÿóÏ2ËßDÏ»Tøg.²ŠÔKv>ý‡ƒCÉʉãé?{YÖ_Y2|cä“O¯¾§Bòv§”D¥GŸз_à´„Õg Ñ$ì¿/àýÁýV,Ÿ,‹>Wôá”oïż)ûx§©W&•ª? Š Ç^(þýéÔý¨'Úoª&MNô¼Íh„¢ÝQÿQ!zyæÊS¯>¬ÅÅ^9z»ø+2 OíÝ)¦B žúEèžËððÝ|íJ<}úôjÕª5ÊÞÞ¾ò•Ksx˶¦ÖL²a©i.ÊG”2}ûúcöMzõk]‘²SögªŒüGU7féÅ'ŽÍUñzw“­:räjÇA}DªŒûN)Xæ=GŒòÈŽÝ/ èP3ãÑ ^ýþOÏ/.“¸×¶OMÙQÈDZ¥‚Á7â0+‡YØpmùT§~‹s_M\xáè’篥öóo+‹ OunUöøÍíG[­V]ôüòá[ñ ¯!þV\¢Qç@©,LG#„צÖܵ;Øòäé+NØ<\øI,LjD&µG÷žé4Ä’©8¼ñ`·)2n»—géÕzXïžÐÜTH¼R”ÉGîd7îÔ²âÇø;'/Ç–8³H/„TyñGÏ\-Uszéc"Ù¶~wVaÂæÕ+û ïÖÈ844LÎòîö.è*;}àp–J8xÜH'¾þrÄI­RüÖàâÎg#+bËÓcÞÐv¤§1Ñ)pøœþFgÃîWòá,ß@ßíã\m3ü¦ átzLäìE¯hRÕ¿‰ !»/mgÈ»ëÖ´¹»«wÿŽ¶B—ï_¶(S¢SàZ*ñ¿5Ò÷“¨®A Üù¦Éó¤úN'Kž¦¡}²BŽÃGµ ¹–i»µ–»PØ$<£j9ÆîÞtâº{Š Š1’—¼\¼l­žÔzù6BÈݺMoWÔ²Ö,]mÞ‡­¨²—QOâîÄDyõð)Ä)}‡Ïq²C|¢àcà‡ëka±X;vܱc‡µu¥´ý #W{]‰ä£I¥ã}9L®ÇhÍ3/^<¾ÕŒËgéÄò¦Ix´üuçàò}W^"D8µœ¾}YcêéƈT„X´Þ€­–jÞ•ùîŠ ‚V‰Ë´ŸÎcerk™©ë ln&3õá³PÊí‹š6­ŠTS¨VK_“ü¤ÄÔqAvQYöš-±[Žœ _ø™øÀPºs]hU;ÝÍx_¯/®[/UÆëØgIýùdYô3©çéóçvŒ¨Vñ(&‚`(úÓ­˜Æöj­!ZYªÂE¿Ö}ÅÁsg»[pÞŸ,ýÙIÊf\Da õ)ËœÃBñ…ŠÅ5g(u$­Wi?ë˱i²ûø¡‰CÛoÜr^«|»óDîþS‘æõ®8fy~9‰‘F^îdÆBª¨f†Ðºzƒç/^¼xñâú±Ý¹BÓb9‰¥Uhácà‡ëkÙ¾}»@ øÜFæZ.Ÿ;ß\À®Ûq`“V!ØƳܺqÅ%—eZwʸîý::†,^jiÄm?d¬B,ŽÈ£ÇBzæ¼Ûµ<¬bö\ÊEš2UË‘ö Û¹øÎö]ùÒtu¿O÷HkðXz¢CJñÁàùmäª=«otÐܹÙ«ˆçú¥óÆ¥…Ï<ó¨þÐVMœ½öMâs¦«µMç¦ü‡°ä) Ô!trßæ›ÏÞ°J×òÆMVZ•©•íÛt‰_cÊÔ~"æWÂ4[G „Õo/O1xʲ}!DI÷,Ô³wß{îk«Ä'XwmùÔ|ÅsÕß=±ñ…úÏ왈:²÷‰˜‚¦|gÌ%K–èu:c>¿j¶³àààøøøjÕªWZ /Ørì·= \+´¯Î-Úsçùã‹gÊXvÕlX{×o¼ÿüyÚÛÔÄb«&>V—Ol}˜A4û¥!—@˜TÜ>¶çèù(¡K {Vô-Ï_½w¿/Yxâ9ÄׇI ŒØÕ« ÇÉ»uh‚°N`SgÈà^Šˆ¥.=¬>ŠZÈø‹'ÞŠ%7¥8ת#”Þ»ž†ªÛšJób#3Ø…wŸ¹ö !!åù¢yCMiê®­a“J<|¼…LÃˡD\LW°ëy:!DXo÷ßÒvhì­ø´Z ƒÁàryÑ_«ÕΞ=ûìÙ³gô7”'” œÝ¬ÌëûµÈÉÊÔˆsÏGfŽøubÚ•ðlJ4föÜz^cæ.œ:°&ƒ@ÝO®Í|—Z>åú‘³eヺìÙ|HLRéoòšôïç)Ûñš6(6œx;püÄNõ+”Ô[‡ƒæžûìÐYtßÊÍM „Ž¹››ƒEEÎ~Ä4ñ®YÍÂÔ˜"YFüªùâh½†ªæ×ÕK²ñÓÜçê…h M%ß8ênÇï8h\ﶵ‡Ì^¸p|k6%ß´µe@pW’ÇîêÊ3FH'Lháý.UŒ™gMý›hhCÀwöóZt:‡ÃiÙ²e¥Œþ¤1Ø!‚Í#I!†CçžÆ<ãjvœç_{\0z“YìÛ§½•c"/CI3ÆuM«ÙhK Lž'iÝúÉÒw]>5»Ž9½u ûswª²|#>ç ‘•rÿÔÓæ뚸WÍ­Â൫_ݧe[VþsÄ´¬.{“›u1š¬e^)“%I¾ù$eÉäQs¶Ý(”²,¼ ÷6lÞ—§äáw嘤šð}íÎg‹Õ¹sçV­Zñx•ú-Øæî,å aUV¢¥å/)ËßÑØE¡T9U„Aø³óU…æL„PÓš¢½!ëjÔïÔÕâä¾£Oâ³ÓBC›tîÛ¬}‡Û›–®¹È5íáÆ#žR”»¶l•h¯¶“@¥Ý9¶èšññ-Ÿéna˜5W§žUÑ-„ ¤Ï»¾6ô\vª|õ:Á¤ñ¿¬ ½lÓ Áš•ÏÛ×¼zåôÿ´!bïV¤·2 !ªÙzÛŒ‹jUŒ.¹yT߸rÍ3Ÿvtq˜»h¹ˆC×hîߣùæ‡0¢ôÖµ*b·œ Ö¿t‚¦|gÿ@nÜ‚ØË Òëíëïð=ÓŽÝ [Íî>µ­3ÿ[ À:IêšMWæ/›öíÑGÂvµ9Þ•YÖ€ïáÎûý/à&Ìý[ÛrG œÞõ¿~þŒ¡‚¡ß<‡?´}-Ñ?‡oZ°!7555«ŒúsÛ+%Å©©i%ê?•øŸÒ)2òäøÓÓÁX–›žšš¥¥¡µ?jÔò•Œþˆo™³’eÄg Dë¥áË‚{uï9kK$‰É¨yºwïÞ½{÷!#–«(}oÿl¼¤þ=À!—.SѺݓw\xQ(ÒnMÖ·_À¯jrÇ‚™÷Š ´N¶8høã,Å·—/¢J£O&KþÌÊzqNäŒÏ&êç™YžÜš¥ƒÖü—¾6uúôéîîî£Gvppøt)Á`™ˆøR¢#ëL:4ÅA*UTò±‹v·­aJ0ØCæ¾[â÷¦üõfBý^uÂÊø} šš1‘AQþˆÙÐîM‰º²kLZµÓ­c°•R§.?ºªÑ¯«šºˆ>Þ¯AYrâÐÁŒ2ªi·A:¿>¾-›eæJ{Oò1ÁÑçÃoÇå[ûø÷ÿ…Ï‹ø‰B´¦hWè•aSƒŒøTøÕ¾Ao› rk8. *~¸vÏ¡‡Å´bInÜžýç)‘ý 1#ÝDL®‘ —Í„¶ü¸}-cN7{öìÓ§OœÑ¿ ±iÁËgñ©9" +&BáÔ×Ï>|ó:OWø„ëVÃÉÒªI—–qYe!¬—ï¹Û¦y-!yÑ+¯ÝuYo´^ü‚Õ¬cm'+ [G36aÃ¥°•IžãºÖs`T¾C ÓŒjmúO ô2r9…‹^Þ•˜4ÓµÚµ÷ ™¹4ž4ÎíÍÆèäÒJçÉ5u(¿žQª–&E=,4!~ë‰ä&÷hêBˆcßjF@ëG±…!„È»‡w¶óëˆ^͸pw3ðSD-!NÇår[·nýqFÿ*\öÞ;¥uaìÅIS—K(Œaëäîåååáb‰ êŠ l¾Ž¤B’ìWq ó¶æ!LeDE6³ez›é®Å”`½Š-ø8I¿^dáž{㬚¬:Óê«a Fv7.WL"„X^^®¦ÖÖ†ü Š¦RDŒ96,ZR¦PV>Q^ë‘®Çç=|üË öÁ©!Ì\·.ìU)÷“*`ºÔt]³hÕ¥8©ˆa ð3D-,«K—.aaaÖÖÖ_-„àš{ 7¯wM*¦œBÙ:ºyxx¸8˜qmk+JË)„e©qÕl2<»xzaPmBX_|æ–R_–Ët¶Ë¹smQ¯üi¼ú÷EÐ6pü¼^ú-73ªLM~É9xë™ÈÓ}¼{Òñ>_ Uz?ž®òì™­ƒ? i± ïÀ(rj›zñBt™¨»!â×kçŒT\^U¨ª2]—¨ßkÖáó|JιMøA|KFÿ*òo‡»ËeQZŽë ÖS„Ïì[mÂኜ&OÖRxeþ‚…¹™ÜÕaNšœ'—òkn2f#„dé¯3l{.kÝŠCyEßXM ‚ê—-]°HÀæ œ9 A°|ºL>:jæ£[[|ô(D÷zñû÷î‰%“íª„`fµåa»÷ˆu9:‡j!df_;}ùÆ5±m¦ŒíÊã˜ô0}ýÜ9HÈ@é÷lY_¦¡”캽¹Ì7w/\zðP™C…n+4vpZĦ»…XU"èÝÕ šðƒøÖ,s†âé}§t^âÛÐ…õG£(Yöâ™ëƒ×mÌ¿y «fÀÀšÂÿbÜSzMÄü‰£·vòý•íè’äص›Þº¥ ð½}È2÷?“—VíÚ-®Ùâ-“Û±a² Q À¿µ@Fü jD-µ¢ˆZ jD-µ@ÔˆZ j€¨µ@ÔQ j€¨µ@ÔQ j€¨¢@Ôðý±*þR*äJ…ª? SS³ß£–Šào¢iš ©Dlcçð&)ÞóMQP-€Œàç@`ŒrTà1FÑ4Íd± :›Ã:ü#DÆ&ïFˆJJŠÔàŸ¥Óë “Z­¶¶¶A浘[Xš™™ÿO~1¤‹âcX -…¬ŸðØ /òj×vcÿJñâ¼7‰™åžõÙq?]lg¤ËMk¸šÃÇ À¿J"Wüãüüöቾ탖ž’0&§—ŽlïÛãÄÃtŒ0¥JŸØ¿[Ÿ‘‹ò44FøåÙÍÝ|;MßvKGã¯_SïíšÓÅ·ËÚ1aZW°blÿ®þc’¥ú*›•¥=Ú«ƒo§>‡£’1´&kê ½‡ÏÍUWÝ®(vöè­Z Ë×ÐジS}:uè5ì·W¥ßü}Žz±ouRÉ_ÞÓtæÝCºµï3n±š¤«,,J¸ÑÛ×o謽b=Æ”öÆÆI|»…]|ýI}Ñ7-íáÛ!ÜùòËüœÇÇÏ>«§+­Iiåy¯z·–§¦°¡|U@ÿŒRUþýíS×\¬²wiòíE3<}q|©cÃÓ3Û‚ƒƒo=#ÖU.‘Ö_úµ×ŠÕ«&Ï\/5`Œóâ®Ïš^*+Šßrð¦–"%E®:JÿúÁéÈg maâOJbÖ«[ÓÑQjYzRškžðêÙšE©!ŸúÊçCæ&ÝÙ³y'6H.ö4©5Të<}jûÄó‹nåkyˆ>>sL0”EYl;š¦0M²ta±Ø„`¾Ú'߬k¿KWŒ0å Íiüµ5S t-|lN–¦Ù!Œ©¢¸3ÏÍ»ÍÿÅ®Rµ2¹“æ _²~æU‘µ aŒÂÙ±—Ú.b~ã\Z‘›IºzؘYµô|õQµ¡fŸ£= Ÿ»„êeËüè "ƒeó,hš–æ§æš5çë±oçÙRCG.ñÑš‰‹ m-Ø$)L3HuV1Å 0U¹©Hâ÷k½êê‹ 5jI†ÄàÑ{üÒÞH[þ¶ß„cþMg™²>n$‡AåK„a h 1 ²R9Ô(ü­—kšF´V–[Êa"úÛKùoD½&­ë: 93~ÿ~6ïúZ&îl¹¼yàdfÚk;+++»¤Tæ¯ÍeJV5kÓ†R‹f[9ÐËš\«ZòFašbV>H†‘£%«8ÇFšmbéhbåÿRØAQ¢ªiþµ9¿\ójó7ïÚ³s¡€cî!úZ*³\EaÚ Ó“¡â„“N²gêÀ©Z¯„УýÚ°ÝKÆu-slgÂ&)>ñÒßëÛ“ ^#FÕ(ÌÌÊ%6F5&ÐWQ®÷¶Ö³Ró¼»v÷æ*Ìëð˜éŒ)qiyE™‡[ÁòžÔÃUÌs·â3¢¥Åý‡s!KK¥~Ð*¤b™æC!²ÒRÃû@‡&u%¥ò÷ñVKÊä*ýg÷mЪJÊ”ïÛ,­,-Vë>tבe¥’»Ó)eåR͇5e¥¥ú÷_hZ_Z*ûþYÛ;º¸¸ØYBˆ’”–‘ð‹ð“`.Y²D¯Óa†‘™ºzûÑÅî#º:;Ú¾=±êĹ«ö­·¯ã^»ýæõa7_–ÍïbaS.lÝ:‘j<´G î—¿²sø–²¨°ý'.*íÛ÷ýÅÛÃûÿڻπ(®ýoàgf¶zoÒ«‚`ר±]1ŠXb¢±`×ØŠ ±½%j¬Ø±7ìŠJWšô ,°»lï;ó¼°„]”$÷æùßxs>/’‡™Ù9ÃÌwϜ󻫇öÝy–5aå²NÖôÖ?V–ž°)æà­›·i~!!=|ü»8Ú}ðAfÃôðù®¦z7b ?kõÚ= ÕïrË=Žð¥”í=žð ©|Ȥ™ÞöFz7-¼òÌù[¹ùÅbܤ¢ì;מeTñ³.=;:´N#¥‰Wž”TÜúí¼UÝ<<È5Ï÷ÿz!ñÑS#÷ÎNf­b‰Nç½:Ÿ˜ZZ[-Ô9ÒOòêÔ±ó×s3B¾¡µºc#ÓŠÞ´aש¤*ãi3¾w´¶i¾½ãÌÕ{˜ÏˆnîÇë~ü¶×Sߥ¥+M]=Iœ5k7'ÜzØoÒœ®Îæí|î`G¹|èhJfvŸ>6Ø~ÓœŒ.Mz”ب±îìÕº»…¼9·6ú—oj×mžïÀ&ñ²Ï–{ŒÖéÃS¶V%gVm¿UTTXT)êÓ;ÉÏÓ{ üÖ`9„ldK®ˆ‹¿WPQNXtÒ·3ÿþÁ“ ·*µ^Ó‡uk=› ÁØÆšÒ­ûÏ&ÕÙO2²ƒµé½=[î=H”š÷˜8¨3¥UAH¦hÕ£}Ç.gÊÃF÷sv¶Í8½#áÖÝÎcgôñ°j½ÕÄ”*|øš7iL¿{G·8qáγ7aá‹ü¬­—d™Xr¯n>wã#`Ôw]<|;Ûß›˜V5}õb3ÊŸèfÐ6FÌÜ0z„ ÝmÛ}ãÁ«asvq4Bpùé£~Ã<¬Ù ©™3#¶ÿ˜ALÒÏÄ|E ëãö>´ì1ËrØXK ×eLZ|kä˜^4‚HÜ2ï‰Øµ—ŸmÛW§\¹ãݸ‘I¸òÜìPŽë{cÐpæÏØÛ{ô÷¹.ëÒÞ‰òý=8nFsÀh[& àåN™é»1ßÐ]éíÓg^½{úøÁ«·ÕßôéBÂy›f†{Že‚Á‹!A_J¥EQ*•ö¡ÊœV§û‡Î|† ‚ èï­¥E@Â0¶‘1¬èAAÐצ‚ ‚`jþ¦qî¥ÌRÞ×üð¢¤+| þOj5ÝÛ«±Ï>”jà„e‚þ¹>MiÁS®Æy\L0œ×mXd4ÆFm©R žƒÂæí!É>½é`¢ÖsÔþðñàwŽl½—ÓHµê¼qít#Ês®‘Ý™Q§´ð¹0TU—½ãŒHG2/r„¯Þ¬K^Y궸x…wûæ‡Å?}‹ ä¾]>óˆÃ ìÚ%HÔ½¹ókA1Ÿ±*ІÖúï6ï»XØlu>>šŽ©Î[ÄtCeÖ†˜Žm&ò¨šrÂçE9x-ÄyzvOBr5Îòؼq¾%£õÖ‰¦œ›[Ž>Õ‘L§­ZÝņ”°/êy©íÜ{㊠mF%¢’{aóã·\;çCÛ´>_„Ûw ]9c¨þñÂ_^:páy9ÎpÛ°q*8¿gj¡׸Uû·“(³ïŸ9u/M¥}'­ßÇ>~ÎÈtª'†P&®énõ[-B§:µ}Kv£X«½kô¹}u• ”5¯Ëºwõ°h'ÜýeëÝìFŠUçMk¦Q¿¸/ZowÔV®Š ˜{G­›«7Êàon=v¯¡;®Š\â@âÇEEUÈ—~?-ßWošº]vUU$óÎQ«g°”å{¶ìå*‰€1‹Âû~vÛu)ôc·ì»PÐly.>†¡ßÂâW£VôïÀ²î‹¶ýàFý·a4⚘sm›ÝÅþË'&!å¼=»V¬f;}³læ0F«QÊjQ}™Óy b’‘Ûì…Ó™_8à õù¸ùÍبÅáÝÌI`C§çÏ)èߧ»ó¯‰~-Ã/kvÏÆy¾á©Ñ¬)Að‚AÐßþ{7AˆEB>÷møÒ-j¯¹<÷ÄÃü‚‡¿ÎŽ¯Ä õÖå+«”8Aªª„U;/+‹æEÕº·G¦>.mn§’°6)lÏ+-¡½ºm^B{9"ìBOÙX0d쑦mUN×É£W¬iÔ®‹Ý¼oßΕ÷ ë ‹žÏüaøàA#Ò+q ?fÒ¸‰ºùõ‘¥mjã¡á½™S×ݱÿЈ[\-®*[§!t•§'&dTé׎mÙ1>¤R â§Ÿú9êªFš;3掖Ð>Ý7;ƒ'7Ü´¸jþÔís'ÍÍëêónO8”§#4¿nX\¢ÀõK•V, ߥ!t5ç¦K*-¸ÿ버r™L®Öü¡Â«w´=B­*>|f“DªPª¿Pí/~yfõËÇ3®ïÝmÒc˜ h[ŠÉV¬Û±;IAݪ›„z»¨äJË®íLæS¯LÓœkçÎ8û+ͽCžákŒ´I×/ÏÙ½EB¢æ ÿ ÆÞטÖÌ|ýÚ¸:a)bƾ»èÄiæ×6TrŸžyú(aÙº#bÝï'Nç•CßLqóJyrùÜÙ÷‹>W­W¤ÜO]ÒÓˆ½»’®½z5ÞS,kûF¤Êø´þ‹nݺôów^8ÿ±ûrl¥£_I³Áü‡-¸vûîž ¬ÓÓYÖ]zTŸœ=gÎKu__ý. ¸JÎ`?Ý tðjæ5ò›ë°˜÷Y¦hIËg>.o¾Ku¶6®mÙׇH1AyýÁò†g6㮞Š1mþN/"Ûf¸SíÍÛm:®ÀÔÿ_òªäÝëï|Úøo?bd'ä¨;u2þyÓ*—:¡4!îØíg·_Ôª4­>,.ã I^—1gî=z™+Ê¿¸ÔøÇà.–½Ù£˜ sß×'4w5­nàáðËAÿTR ‚‘u ìi„ê0 EQ Çؽ‚\Qœ ¡z×h#ã8É'0ŠkHíÖWE1²§tò#:2†bδríêa¡jØéX÷]´i}xKöC®°nñ¾œêœÇÉy5¯o^•é×þ¯Ê¼³çPü…„.O PàÖ~=ͨm€¥ÿ¤Ù£ÆLˆúÑ6#ýÞUÞ¼*î-§ðERVUòµK †$÷ÀîtšdX<Cnåݽƒ@0#kqrÇ@ ®%ë/©æ<=ñ°2ýZ<‡ßø4)AIœÚ5È‹Dàdƒƒ‰’qu ìÎ 4†"qûaÑðÐÉhYnËï”þâ•'o:V¹|\7Bî9éç‘¡ßGNôJ}žÑvIiÅË4U'K Ñ +I¦öl«sw{ÃãEhKRʼݜè4†™¹ ‚‘qûÐÊÇV+¹s|×áã§î¤–+eb)73ËEÍpõ#»jíG ÷aâ8îÑÁ²èhpOvrbé-I±ô­åðµYu¹Ð°•õKì«äBX*æ×óåd6¦klh’H¥ œzšÃŸ+¨F(²SßÊ ˜±yú˜áýíݺõ³aa€ÐT¤>o*>%’´ÔwJ(F5u"subRÚí;E8¡*JMkq€²H@jäÒëÉËŒ§OÞª^Ÿ—QRÛÒ6Rt4fÒ°ŽW’©*_T@”\¿2qNwã÷›ËHÍS~üЂê¢7 Ž¡.N}Ý¢Ò~ö‘0·àMQÿý)­µˆe²Æƒ¯†}5©¬ÃFùÌ u˜÷Ýðž®.=C†‹Ž áfC²ÜßÿüKúýaó¶¨Q‡©]USBxÈ ëêhÜnj ˜n›:!t"Ï7Ì™‚ ^Ùx%brøÉ]»& @¬/|<ëÇ‘¡ßϲæI#[ÛÚÚÚÚš°éÆ–˜~çÄ¿¾ëyÁè «)€±'®Y=c\d"X2£ŸÁÖÕU 㦬©©Kû>tV•°aÿ²é!¡c¯ê†Oâ£ßÛA²²±µµµ55b[Z‘(vaM§…Ž=¥ú­A­RŒ9qÓÆ &¬¾!]õó@”ê:Í«ê§ÐñyöS|Œô®ø(™ickkkkC§PMMŒ,ÜúÌ`Ü:…ÔsŠ£Á­d3e˜ÓôÐ1G%? rôø}²}¡!cMLìÈj/µÜúõä³Ì”°Q!!?nå)y¿¬ž2òls—9ãÛÜ¥¤¯ ‰ =ÌPfÇÐÝèQ“Tm*ãÔeRœ*é@Èð±±wŠq’ÃÔnê)¡?$¶ie„í9yöýè±7Êù(^¡žÇCCF?‘w µÕæL²œ2¾ÇìБjûŽùÖË1hèxÍ©1¡Ó†N±Õ{"e¸òâVì²Q ¹þ#¦zî =rÖdsýU2lûw,?=ö§%¥ú§V®®K:«Jÿ©WcñÓ)£GŽšî=îgkTuoĘ‘#×\,?¼5”ü§fÎé„'÷{ÿS k[[[+sÛŠNB¡~¼7*«öã³*]sìž PMl)wÙ…ÌÓ»ó¤­—‚œ.¿¾wG©(ÃÙ ¼DûÌ é5hjäú)Þ€7ãî¦T¶Ý2‰DÂŒC˜7fî.r:ù´ó:þ¡=ñŸžß–']?zåíÇü¤¸½w[¥øóo ȺzôzRÐý‡™ÿ2êpQз®ðjAÐ߬ A9BÅ/½pþZqm‹qд?z·î1ÔÊy.¤Öa¶=W/Eû£f´¯Olüõ…<*v»“ b‚þQ>ÕÆ…©‚ ‚ ¯#µÀ/mhŠ3å'×þ wŒÒ;”>rl ¢ˆ¡ÿÆO‘<º0gDãAÐ×ë+­«Û²õä™Ü ÑRp5l¸£7ßü›ÛÄ7ÖÍ­˜9‚«6NÒ} K#(X;kü¸)û%áá}¿hÿþ'eàªìùWœHåÃãAôÛ·¯O9àÖ¡¨\µUs~Éì-ÛÜ@ÅêuG<;Z7’ý×Íx~óÖf3Û–š*¯q«'õ09¶y­ÐÈ®®¤yíŽ(+æë­!ˆ¼;ñO«Ä*G8kÕH×ÖqI#¬Üw!#¹pãÅÓغ”33¥”–Ú*ëaËfõ·ùl°ji〨J:~ñaŠÒ{rÔ¤†WüÄ KùZa½ÊorÄ W>Œ;³rO¼—•A]Q‚Ÿvb×=ž)"2º|F/Óçâž¼Êì²îÄ{ƒFÈøͺßF|êå—Nnâ/·Ÿ§Ð‡D,äÛ~üJ8°±·nÈ+Y¸}‡ Z½ñÛÃÛÔµ{ØwÝÚI”ÊúŒ­»/Y¹»™øþkR_ûÛ{Ö•›¨J2\BWüØÇÉ`áâ'¨¡1ç†:’Q±H(ngo‡`ÆäÕghTn”~}Aý‚5ñ³´Í_þ)šcò4]E-æ`-?½]ÿ勤9±De2jõó À²ÅÏŒäë.?°šøòôc„f„⟟裑s×®ÞïàR•_½|ÛfRÉí­§Þ:Yà*ÿiK‡éŸTbÎî¸ø·)ù«ãO£ú­lþ—§u­„»÷—KlŠ¢°¹#f!õ¯X§Z*«¾p˜È&´‰ ©˜Ð)T/‚V‘É?îDR¢Ô52úÔUÊ3ÛXà‚ ÿ±ÔB(Ë“*ÛvþÌ¿~ãm±ŽH#"æ†ZíZµ¦B5bJT4€û*~åÌ lòÈ]ö-þ¾0~AF­`¸·Õû&Ô’ q{³êZhV>«Ãgw ™Ü üÒW“bs–Žp¥¡­¯À.kV¬œ¾r¯°%½QýòÜÚgE3úÙ´žE$®JÛºãnjWÝBqî7k©-²+í3[÷ žàL«2¦îÍS‡vHÜ·ùN¥4}ÿ¶þçŒìëõ[Ñ)Îì¿6|ëå 4küêS»/6q‘ecÅç?‘ôèŽH¡H9töšá^@VôpCÄ}êµÄ˜Òú.‹úÿìb«8ÉUKÍÎÝq-2­…Wßð9£[Ì$¥)\‹Ñ?7ßZœ˜W©&){O`‹;z{µ[}™pÛ¤ï3àÑÙÑI‹ª¤³÷L”<çœ)­­S ç_‰ûånj“»)«ËšˆÁjî»èµáõdA䆎¶úaкšêŠk@Uª~T ¨Ž ÿŽZ¡Ä T`ß,¢º[D¦º³_§µB¸ÏUOSÉ¡[P à½O©®¾”à—jÔ%«ê’ñ7(MØæ>ŠQF„“,Y@Õ_9 ‚Nct±ÄË®áú]C:e£Ð©oXØÀû—7iˆœ ÷~Úöƒ«ä‡ÇÃo´hU8Ÿlä±&"rîü­|àúð-—‚°ìñ§&v_ÆÀþâú$$¶MøŠÅ:EýŽõ±*PÿšXD<>µôj™Í€yá£P½|9­8)O*þLæJ(–δñ‘š#sMŒ,ý/ùXW\C°içç6Ûxð-üž«-ÊŠó4&^-ÑB—ò¶hð„oA±‰ y_øJÜÕ³‚/ogÕ‚ÊÇå^c¢6nî­M¨Q ;²nÂOËíÚðÝï]Óu«fž{(cëò~7—'·îø.Ù³sË3ôwÎèNmœøã‚‘«‡Ó0Æè¥ëÙ³­ŽjYÞßKÄ,Nâ®]÷ëŒ$¥ªv×J ¤ ×ï];2ñ×x€’°.fïŒow«Û;‡k£6nÞä¨È¬ÑŸ‹ªU¢ÆÔSá³¥®~\°¡©¢(ñ‰…‰vóº½|m{\Ë›ê Rs¬‚á'Ũù„iCÇ ž¯ž2®‡~À@ý~X4}h·n“"6¯ÿ É~Ù–û–¸Þ™mp&`¢Õ©÷‰V)uëŠäý _×Gè’É/ÄÈ“©]»‚–<5ó'£ díCÃÈ´šÌÛ¸TK›v”dÏþpw4VWü¢mc©÷ÊÏG+ŠÈ–f xýmù‰pÄk¦_"™bâûòÚˆàš`OR-ÚÒ?Ǿ1SU·)¸Üzõª““¸kçÝßoåÿ cÇ7mv·Èè/ëÉÁ:Þ½kgÉÃ$ƒç¡¨M¶´xM1Úr•j£7¯â 6]0UÙÊà7ÃkAÿƒ©¡0tZ4dé&’œB!“É%Ùa˲T‹3ÈA¯Nn©s5ɇ…R”êä¥KÔb&µ½z]*A%]ͯ©©1öð/+ØŒÈSç÷-]½øäwnØæØ‹¿®üvÍÚxƒ×úJZgs @èLöïÅÂ&­>qáк˜ˆÃ¢v†r  ¨\†Ìœñ/% ¡í~GIT&„±­ÈZÀÄÑ‚Œ†™}­PÝÎO5=^¸+¡¨¢ªE¢4(§ŠPYZ-iÔÒH+˜J!‘0zÐœÅ>þßv±å Ú;FdŒÚwò¯Îƒ\åYUMe‡Ž½¼týæé…ö¿¿ÓþA¡›Q@±pËô“Ó…9Љ6v#¥“uÌr€P’Wòyi›£`F›±“ì⎳‰ l“8GÅ[~Òhú’؇O§Ë}†W¥Éîå`n€2¨¶\MY›×M“œéãì1 (Á-‚ÒôÎ19çqŠSØõ›×GY¼~ؤ¥¢¸i§ïÖOî¬$¨ävNF}ßÊ3‡þ~+ÿûtÜãoènû×­3²2Šµa‰R„P1PrNžøÜ°®-¿tèN¼y€úu#$Bxƒ è0µ l+yU-N}z)ÅÃÅÙÅÕ#ãò#*ΩRXúáù·ö>Qøþ¦ƒH,GM»j ³ZpÝ“Ûùv&í¬ÚÈ©OQv%ËÒ–hP2x—•SßÜÒÔÀQ$Ã÷#ã§Ò¨…R£H{ý¶IÐRÏiÐ"†ƒfÜÌ3²8ZQq#O Ð(Åü™R&n¾© '—ÓÔÒÜÀ‘ë0äËw)„ÄÙ‹‘_.h){Gí1’ABdâ‘T)ð¤†è”’´ÂÚ²ÌÂÖ ÈH*©ãf¿ÎêãÄ0Llr_(—‹…"©B"àø ÚÙ…ÝX)lsSò3”6à¤çS¼;8º¹º—=}Áo®®SÙí%®ÞöÅÉ™‚¦Ê&ÌÞ‚Žjd’¹ª™ËÓýÞ+vdUÅ™UMoïÝs¶·Óÿ‹Jqô4ùÉHuQ±êÞ€À $5éÚv`LPºDS’‡˜›}Œ16•‰³ƒe1SÌÙ1u¤vÀ[À*Ï}D´Íc4'ÀË×V×b®ïoù(êÓaÚad¾Vb9…u\©LÚÜ(B¤_ eNz «ýþe©ßƒGàZ¯Y©V ùÂÙ›ù®\ÐRžGí>’Aú3±E'J8yéÓ{“‹R^ÊüІ«^ŸÜŸ_'úBû÷ôù‰*^ßMx\ø±Döðä1îÇbµŠ–ÊC'ž*ð;šwûì³·µ_8A[í*®N=µ?§ZÐU'’AMͦuÿ–è ò*ÄÄD“_Ix Â%< ÚRöÿÔ!TxñaZÕÇO'¹u2ž¯ƒWB‚¾ªÔ0ÓiS¿;»mk±Ç‚¡ööÃx—oÝvú»©SÍ€üᣠ^ᓘMcO½Ða– Çxþ²m·ò›ˆN¶ìvVͶ벢r`óú#ד1Divl=v·$îàƒ;2.«‹Ù›Ò/íÚ™+Ôò ïŠÞšvm¯_úô;Å2óÈÚ½O<:¹`psÎGŸ)mÉ{t8þ¾ÁÖÅÕ™q;·¾ž³cï\c €Z{øRÛŽf@ÈVÆ*RÏžIQì_5Œ€‡Wân½‘äü²åfVµÁ±²õ ½<ùË3Ù’%¡¡tì}=6¦ÜbTOKšÁZ “NîºÂå<9únJ‡€èÝíëöÜìз«á!1³“žÚ¶­¼cøÀŽÖνGO²Îݸqwω3ÝèíÝYýÇÍ R<Ý°í×éëØ™¸.]1æà¦ugsLæLÑva¦¥ƒÃ‡ºd$ïžßžŠIhè1¦¿þR8‹¹ç–áR)uõÒåÝý̶ÕªçÅô)PE½Žß¸OÔ2/úOËAÝuÔ ¶PH=&3¾Ÿî×”4€aêü’ϬSúJ§ó¡O˜ƒç$áJ5!æà\”>q‰úÁiB?´0íµ­‰ÞÍu;ÄŠ4i¥+ïÁÞøÌkCú§ ®lŠ‰Ú(gP¯îÙñV„ ? L={&Y±?b ùOõµÚú*Χ§d*‰ ŠÓòñO8¿ª\¬ü¸‹„²¢æ·n$¹ ±¾Iò)C5UU+?†FVYýÛÈn1·¦ùÓkZXk'{c2@P÷÷#à AM™P®A–ì5::œD-Uq5„e‰š°çió^jDMa)ÎkŒŽZYþö«ÑXÛÔ"ÿôéªjÔ¼Bôu€Uæ `½–¯ ¬×AÐ?ʧ*s(<A}`_ AAkŸúZ°¨¨(µJ… he”I§"—ð¹?ºþðíBƒOÇ}´;æ䃷÷]r±¦ÝzcxMÂò£÷Þ<:µ}ǃhbÖ¬K.ÈßüólŽHmE2<(­¬:µyÙÉ$®VÞ¼`^TvAú†• ÏMã¶Uë˸M'#æ¼(k¯&/ÐÊë9§úáö¹¹©Š›wþÊ•Ù“V5µ™Á„kåë.»—QPŸ÷'Î"\uyåŒk©e·Ž®»QûWÕ]Ã5JNmõîUoÿÝ×$ÜÇ»cN&þV† úº}¬++ÌW»îö­ˆõì\^1dzÏYÓo éÛ+‹¤¤>“g€çŠsŽp¸¸Qè:d\ð°@ÅãôZ£±Í—V-nHg˜;<¸#¥*9MDô Ó õ9Ês—šuh=›GÎ-ذ㊯¿}U½véªÙ¢{G›™š¦JÉ궡·/rzƦºiÔ½›¿Ÿ°ÖúŽJeÐÃpéJNðêãýkbÇÇ Çm}sé8GǬËζ8¦‹óoSÀððñwaçw9KY³¢/ª{õº ¤|”VËw4iUƒe˜N)¸Â‹J™ÃgîD©JNâ}M~)¥ŠÍývïÒYær2+ßÓ¯¿³ÿW©sY¶nÝ\V«!Uͪ{o+¨ôhƒç(#­Û¢™¶¯nd}&Œò2‘À¾8§Hl2üÅÅ#êT´é=·_ëgJ^Ùº­g}ýjê•‹–N|VŠ.‹êßAB;¶äŒ"d “ôt™f½z÷~vúô÷wø}+8þ­qMìø¸–q;Ì[Í’’T¿Y“е«Ý“§ÛOí~ŸánŽiñ=å[/AàE‚ ¯ÈÇÚ¸²F„Nº´fvË^$‘ˆ%"VÃÌÕ—H4À•ã¡=³zbÍÄ‘Þ:q5ÛÄ­Y£²vª)ÛYµZTgg­Ù°z/nbR%Ò€ß<µùÐÍYƒ n…ð€œ\Y’âgõZ»~!Ü<Ý,_Ý|jð¶èÙ•J§±vŒ÷3§1×þßy8ÙûºÑ2’ÞþîGÕHêÎYôïå¢ÔõJFõ½={ïÕ²”õ a•ž\³DfçÎëÕa#4’F-óÍ¡…×ó娼Y+ª6·Àw¬Ùª1·®jô;# õÁš²d,¥´½2_¸´c ñkæ·X: $²?Þl|™Ô=›ý’E…*z¯£V…ï~¬îßËývÛ³ mIDATÍà†ÆUy¯ODž+4UqZÌ¿O?gGÇ@Õ»2ŽÞ‚ZE­Ê¸è\ä‰×|ª¢Q-¬f›qkÖ(­Ä*ÞIýÚU+~Í¥ã¤×ÙÚh¢VïÅML«DzÝ$3kEÙã6ˆdRÍoÂÔéó˜5/?Ó9Q“Îü~‘­½B5ê–’üLNïï¾ã>ˆ}'Õ‚Oš>s–øÁ©¹^/CYÖ/çn&êêÇÔﺱî]¿yóîs’ªAó?6Ñ÷C+ŸŒä`ô@·”+) ££ä<¹½n†©@ÎÚ³Œ¦’Y20ÐÐYl[·r¯Pÿž¥”+z2`àÀ𘽣lUÛÃfˆÍ|úõê´†Ï^¤<¾»pÔâÛ·öF\Í­ˆžaâÝ­_wB«iÿsjMW„O\ámª¿Ï(‰*ÜG…¯å&GÙ¦™ZEš½ÏLÖȦë•ßEH4&¡ì¾0n\W3‰‰1,ÅrúªèuL…ÐBÿ’•…iñàèËÝ­qµ½!(ÝT«Á&G´Qó˜4Êo6¡{üëìÚoU•®-;q½êðþ݇V]9wKo9aa»³·Lõ— Fué¶]=»õíÛÙR‡ëÝãŒb„H;MÝ2k  c‘™–r%uat´±œgB7?DbÛmݾ'v¶Süé$ºi‹Œ½1fM%µdè²MÄÎßvéö}GS&À²6A S)"e›Ç;„:ýyÊòï]ÛŸÕF¢›¹ ÑÑݳO_·4®„nD(‰…(•úaD¥ö2xÀÀK6îúÁ…ºáèìчŽJ¢˜“þÜÌ9ÇñO«&Ç ‚ >þëKK¾_°õŸƒ•´ý+Ãm··äÇÍ!( ÓØ œµej' bDÆÖKªT*s ùþ•ŽˆEŸá²âTɇr1zû Aôu¤„å×AYø4¿üXìËŽÞžÞSþRžÿ¬PéèG_<{« ¤äÁýW4Gw̤;Èy’’ÿîôÙ‚nŽíM;2²í^}ålv~ƃTyo3âñÝûÙÅ©Ï>4ýÛ†»OЩ¨uõ¯îÝ«Sk%Z†“inrjÛ 3"NܺuëòÎaÃléNV‘MÌèÏî½iû,W‹9®Z-­®iPkEÇ·l¶™¸ÖHňúwkæ¤VOž$§ÍJzÄ™eŒ(¨æ¶ÖTå™SykGȦ3G™=LÊzvç©Õ ±³î ïIJþ»Sg º9šëXEýµ„¥å¥×o½aZ;Ûv¯Ixßʲކ¯RÖg¥7rË×ï|ØÅPwýpYuaZ™¦¯½aDS7$§ˆœ)€k圚: ®¬«­Wê—û¥Yõlyx=·¬øÙÓ’oìÉà™îUgTX pbëmÝÙ«ÇÉõ{Jëê“Þ«Q‚祜ºgÎøNÎøS#gµ¼«¢?õ U§Þ\}_KMCÊñ«/8Õ¥b–=›Úúµ+~ª¢›síÈÎS)„ø×UË+Ö"mÌ¿ò¬T÷!Š¼ˆ‹ŒXôÙsÞ&ÎßpûC=\usõŒ'ùÜ;ÆÝ°r¿@ „4vˆÝ³»O²“±Cf™’ “ž^µ¸¨E puqK;ì;S¦iP7´¤d…E—ñc0É­×XøõA¸ùÕ*«Sû1èÖtá“Ô¢ à>öv6¦ÌÖÇÁ¶ëP~~šÄ¤Óœ1]©%ÐÃ,+£à3­Œ ⺒ÜÂr¶÷ ‰#»1Æ=\ÑÌìšÞcÂܬ f¦ -5ù©ùu½\Ð×ËE0ËŽuy9݇ÿàkcdð‰Du ¦Þ}]íØ\^—øø­W 'ÓhëíÃn5J%³º9c™™Îýìîl`dS[ãârÞŒŸ´Õïñb˜;ôuT¥¥ç(¶ÜIêæשylïA³†úþÉ1-„\®qññ " ÓªtS_w+ŒB—ÖæsO ó·e#—É Oç÷í¦U)H&vnŽïQJ¹ÒÎÛ—‰¡×*5?‡÷{¢QÊvn–Ÿ™×ƒkÕZ’qG/k*™Ì̽£›>l÷ðq¡ ˆ…_ôS+cÈûÍÙzù±(ËÆÙ­zSKƵ¼.ß0&“è6>ž~~t^©»' ¹ÆÉÛ‹+7Aô7öi¬×Aÿû7GYåHG‚ ¯Ï§z-0µ@Ð?‚N§CQ À… è«N-$x, èŸÃ0x úÚýö4[ÜPzãJÂôr ¡)O”påFiÃÇâ`:ÙË;·ÞO.åUd_¿r5)‡£kwî¬1oßÆÉÚ´ÇW®¥×¾¸.ãÖŒK½ÿ©“¿¾s³J+fAAdZʼn={¨ž³/z^$>_—éïÅس礂ßý%îܵbYÌŽSæž®w,,ç+Ú_;¡•×ÕTs@à /âÝ-õíè­S}fÆ®–ÔTW*‘RúàDìÅ…R8%‚ ‚ ýÔBHò«¨¾Á^ó÷}WTR\˜×káÿ!~ÔêwbœPÕ^Žèj À…é `H߀Î3Ã|38‚öC ÷öÑìÊŠC‘«›tÄåkeÖ¬†èíG0cZ›gëDõŽÕu¥["wµèPsn4»íi›‚ ‚ ÃÔ‚+…$l˜Ï¦r…R©”ƒÚyˆù#vŒÖóý;ôt²&]sxÃ)ËR ûÚnFý¦÷0|°ó­JU‹Œkìûýžu?müy¿MuRËà%}z îí¬y^+8²fÇðà~d8n‚ ‚ ¶©eZJíØmä Fl›eÔ(³9´q¬V ¬H²2ãè¶ÈÛ¯ ÐФ"dîÆ´fŽµýµ#òáŸbN£»øxXØv0–TÈÚ¤B-­!ÑNîÚpõyþÕý»>SD‚þOá*¥êÓ+\«Qª´ðÉ%AÐŇ9DÓ×½táYÚ»Co†o_î”9«¶¥ÀÔk¾­óÎ;÷¬4Ÿ¼ˆaŽ3Šß|Æ~_»ü¸yûk>=þ¤5åaÅü4u°×̃p‰o¨%Ý°¦Uãí=é=§$W"ÝœÆlÛ¸q0‚:n…1 N|€þ«´+Ã6…Ÿ;ì@€Ògñ«®Q/ú‰»!‚þÏýV¯…AFjêšÈFVŽ6¦À[¸5Mb•½“)ëC‡Š ‘C2³7"#raS]£nfkoÁnç1ŽN£¨å‰q™ˆbdå`eBànmD l:¸é×ÆUË„±—´°,>l6Õ!¦vÆdxs€þ«Mmeƒµ‹Óû˜¢óꄨ‹£ OL‚ ÿ+°ÊAA_Yjo ‚ èëS AA0µ@AÁÔAAL-AA0µ@AÁÔAAL-AA0µ@AÁÔAAL-AA0µ@AÁÔAAL-AA0µ@AÁÔAAL-AA0µ@AS AAL-AA0µ@AS AAL-AA0µ@AS AAL-AA0µ@AS AAL-AA0µ@AôõøÔ€!†ÕWjTIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/id.png0000644000000000000000000015346613051004444020323 00000000000000‰PNG  IHDRz¶XŸÑ¼sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 5nBs IDATxÚì}e\œ»òðdw·”Å‹ÓB)¥…–nŠU¨»Pê-u÷Sw£îF‹w[VŸ¼vYvñž{ï{νÿüØçy’™L&“Éd2Ac‚¤ …ÿ<¤,‚¤ U7R‚¤êF R‚¤êF R‚TÝHA Rª)HA Rª)HA Ru#)HA Ru#)HAªn¤ )HÕ¤ )HÕ¤ ©º‘‚¤ ©º‘‚¤ U7R‚¤êF R‚¤êF R‚TÝHA R‚TÝHA RøŸT7X”êøïMyŒ[¥ w†|Üiêq;Õ´]}Ó;1^µù8ÑËÎtC‹ÿqGÔµ_ó?"ƒu«}ˆÅº ‹ý'ñ¤µr¸9;p» ìlGw²‹ÿ5qþô¯§FŸ=Ú™ìñDz˜^a#;÷ùøßv­"!1Þ"H7gⶪU×ð+žFDÌ.%äX5õt¢ZNßfßá?Ô9C͇)+0š"1Ž]¾¦‡ÿôw ³_û0Å[ €›#gžU¾}wó¢ˆOsØÀáð0èt`,«á|éÌêmcC¾Ï‘£PšÄ‹Çuš}iÍ0õ•Q#Ïf•©È20Àü²²JUíž³ÿ8æ¥ ¿ö²‰CÖCnXB°?Øìe³­^Š¢šÎú¢"fáщþ¦‚¿xuIxò>X«c&<:²hʦ«N3Ïn¥+x«/ÐßoËõ·Ê…#-å)Ið´çꃫs}μg  ÑhdÀ4Ó+7w+üÇ _ €ùÑúà„Î.·öâ{5ùªzàq¹cÓÖDÚÔŽ¶ëo¸>}I_=Ñç§&m—xgE@8oJìäWŸ³j:™U/«©×Çoìú©þtkbŽ¾ý9zï‹I6ThÄþéX\ܦOñ[N±ÓÿpumÜâSt Uœ5ÿ´ôέ“Êyâé8îzmÇ Ñ³ÍÃ{æL¿Æ±1©±qžsywÞ¨uŸH$D|‚Àd p82«ïÜè+÷¿©n(¿5×4 Á™L"‰iŽf³+ƒ ,ïÏ_…L},¨³ðɳìY­•.^£.¼.@V*7·œdÔM€Eeþ‘kGâúŒR«u£Î°oâ¾88q' æ‚yi“Óì•0Æ¢&\ ˜ÇnVàqÛbø+ T¿Þ5µ%`3i—Í»».¾„ƒQ S!È{˜IwõÁeÑ ¼.¿yï­Û#Šî/ÿR§»vÙx=²  ºæž»RbŸØÿSX;aÝß©àÍJZTõöî'¥îº€ÄZ›h9Ú·œzÆ””‰—V«Æв‹Û`±9€¡¡ ’tEƒ.U0è0B_wè:Æ~{°'2ÐßËÅ!|æö„ÎÄÛ8N¾* !ô~µiðùMuÃÎŽ·Þsýµ'={¶ÿã¦ù[2xâ}ÁÍ>œ4{ÿìc>xx{_ìš±~/ y #«B®]øÐòÙ›I R6Ž·W0u÷ÞuáRšDU9wt«Ö0ýáý±ÝýmÇÄE×6\{öâÅóùVA£–²äÕtŠžíœ½ãð¥+×ÏÌp™;mnD×Ë$Ou<=ÞÏ•ç|&“åÕ…CaN}]­809X0sb¾ø°fÎáÑ~¾Ýc–EYãöÄI$7l³©²šÚz ­ ÀÛ?ß+))Ó„:•­má7Õ¼.|Ñíf `XtØyîFƒ†œÙ|N0~w]Lpùa[É<\tôEy K8õuŒ¨gãNM1€³v/Úòbëƒg=¾¿gÄêØÐï,U ù÷ Í£–»påúá%éÛg2eÂûܽq 2^yåi®ÅäØ^m!Rééyø̵;onKõqq›»ór][Ì1HÎÖ¸;‘5íMnæ²ùTäi"ÄeÖ1kkDÀâ‚V?ÚSÆsºµ±;BTûXó2ö=çy¥Ûolœ¥7+¤Þ½yÂØ{ºd·’rSË#ÚeÁêêšdT¶äq‹.nWlÚVV̸ ý݇Mó·fðÈ*h°Þ®ùÓñЩ ·Ÿ¼Ð|¿yÙ™¿¥èO–gÔ ü •ËÏÖ/Iñ_»˜¢]|x‹LFµ•\Š’WÖËW%`,škø'îÑŒOë£@Õà ¦v÷Ýç>Ž@`™9)C…s,ó $„šÆ(óø§—ÓIH3‘ `?îÀƒh €g`2Tc¬3( Û”£éù¡×d^ßx±×Ý…)+² Yýû0t‰Ø³$††€LE‡¢=÷5õ-Aé1éñ±(€šòöñþËŸ'Î mÚÉ£/ûæ>×+»›„ÒýÁÓã*‚W÷OLȼK`àæeå‹Î]ÕȵúÈ6ß°[vŒUÄl`ÔðíÎ9¶á~ª<ÈgÛ’‹<AAÅň±êºqž¾ V\OŸIHd88ð¸˜?”¯ÿ2=‘Ü™Zbï¿Œ'¿¼¬’Ïè£(—VXÂ31¤`ŒùjÃ-µiƒ¬†ŸË/e±GL¶Ìcë÷µSL0~°ñAX¨Qûº c²–Íæ繬ڻ‡×ù Ú¸5ý‚*C0U  ì>~éö± kwŸ®Ã7–IX}(ÐJS 8w„_ç75‰L£«{7³œ¤å£Ù›j5\–UNÚÀc׸ñûR³¬§£¢ã'*¾²Ù{VÌZ©Ë4 ¿øbuó¹ÛNzòíð‰¾ú]Ã’žÇ]uÔ•ëœØtô.¢AÇ£(õïÁzýªX0è8ä® Çö¬*ô͵fþ` w4T&Ý}•aìa\“÷%Ÿ¢àÙMýµ˜¢t^’ª—ÇÅŸËÄCöQ–£}®¡KZ¾üù¸äÈT·#Âß µ5=rÊÀ™†© mz'Ñð>`#=E¡"Qåå©‚©†¦eÒhÍ*i)4d–cÐCbR ê¦ý·ž´‰6{ÙÚøu’F-Ò¿˜jÊçàÄk/£uZñ1`Œxµß"V<Ÿ‘0hùüÙƒì×î¸_p!ãÏhÍc5z:F¸q `¾ß7å…ú™ÇGéXÜ›EQ0Ú3Î&,y•ëµ•âCîεãŠ2ä£Û·ªTÊ?­zɞׇþ×zÔ(dÃÈË}gl¸·!ÁDlv…Ès/ÇuíÀ׺R¨{:½PÁÒîØ,Bl­  K˜B·€ºo¸Sêšßv&ï}™²d€¤G¹wajŸ˜ï’< ·h®Bo®;~û —¡­J#‹Ùˆ‘iÞ‘³ºé*Íÿd7Õìãô˜Á¤ý÷GY`¼ñjŠ“ºˆÎôa[  vQ!n|/0–lGm~%Ò5R­Óô­¼Põ¬jŽêã½¥öÌGb˜+ôxòèü&Ãhêf{âMÆ$­ypaa‡bÓ±5-tcâÎeØ k|I•Slœ°I$2`ÈŒ%a]Gî½àaüýöVÅ)êthijý7,¦Êy|áRçáýÓ‹çÍš:yŠµl3¿I[›NýãQ#¼~ÿáDRàchÞGí´Ÿ¬#ËjØ-ö2Á¬lti°j(*²M•ðÙu¯Ÿ=áÀÁ†aû ¦^:Å*âqZi Æ¡ÚcFw³' ~y‚ué¸éûêxÛ’àó[™£@N«‹½£³““³WÒ./ƒœM»o7k8Æ`ºÅ…þ`å™÷tŠèMÞÑÃí|A›Pöð4½½bï¯nb sçM}zxÕÛš8z>—ÛåíßØYù6S¯ß6{Æôé3$Üþ–­ïȨï×6Bí³Œ*ë¶*X¢»‘¼²–d¨$ ªsÏì]çãÐgóí_#“W¿¼qÐHž*ê„šÜ/¯ ê€ËåÑuúxÇúØé½ù¦Q‡Jt­h±ãåÁ¼µ©Œß´)Ž1°?^~»F:2š Èv™ãF^u½àà¥G7k Üšï¦cæ›Go7g_Ýt+ƒNFí‹M'Œi”óèü¥_<Ñ ³’aµ¿wÞ5z‰þŸ{ŸVÕíÞ›½`šó?mgê7|7,6‹N•8#˜ß/Í—ásÅ{ˆhüzÏñúF÷í©G k¹­u „$E³˜2|X·‡/0¡ªo§-Íúå$JéË|@Àϸÿ•bàÓC¬Æº¼ É3îþ(  @ùü56èEB°Žh­ÑýKnómv&ÚbŒ“–-eÞݱím B¬a‰Ô±³êÔ1v­¸[&!Ãu¶nYü…µ+~Ê* fÜóIË}ÍÔq“&Mœ4iÒĉÉs&Ž«+¹Ÿ[Ç­ƒšMŠ¸#dL‡/Wž³–/6Ô™ÒúôÙÑ*©§ë4î/ªá!ÜÞ„{ða~?¾n¹åäd•æs‹Lð”iÉÉÉÉ'»šj<>dë-“vøÉËÛ—ø9›4Õ•VÇ&¬­ “"‘`þª¨PÑÐiŸb½þó äsæ¯Ogr Au Õ“SwÙê%ÉLs2m¹÷§LÐð®-¼è¨•MÁŽø…`LÙ±"âpêÒ9¥ŽÄ¦cî7°Y š<]8è.+áñˆvc ú9ë_úYËÂYþÁÓùŘX;ûƒÆÏ·füzXk±fl·Ù{§ì³ýƒBîƒè‡ïê›îë3h”§“yÆ£›Ùàè f¨kõª*8‘˜ø}Æòí=Ô( --k=¹µc‚¢=ÖNÙÝç‚ï@ŸÖ]äß|ʉØqÒ€@ðhŠzý|"¹<ºuËÖw¢‰˜eKVëuzÙÀ°Øa›µuªËjC‡{þ*çm8œ PA¦á þç©ìøMú×^¿éí¶'7IQ°Ù±!.bÊÈQW¯kÉ›¬Ýâ”yûÀð§Å} *Ýü÷mHh&s4«Ø9a·W$Mèwz IBã ²EÌtß»[/sìƒv_èå1#†‘µŸLí‹ه•[Fûl4…Hš6çv§v¦³$­Xs,´¶Qy’(ød²ÿMª¸ÐãÑKwŒì­Û¡„Œì6pÆ䉙ùßïñ½×èj}ܹx†âºuŠmŒ8 Ï’^¹{\–±â éúþq¤h·€ÃÐݧü9{êè)”7CECY* ~’¦Š€(ÉÍ£iê*3¨ìºŠ¢òÚæÔ4ƒ®:­;×qCNv…^W=Š¨‹*sKªå4 5eImŠ®š é¡¶"Óµš®&­!3¿Î¨‹®€žŠ’\Y][M0Î3ç>+}8oôÓ6¢@û6ì™Ó?rɳN|X¾hî:ü¿ D;¯âï'O@;'ÒÃáÀ÷†cÍÙÏN-½TühÝïwÍÿgòöL¾ðè?S€)ðß<›C%:¡:US–MéŒËÿ¿Pí÷Øä4 ­¹#€§;èÔ‘?yíX˜xàêkû¡“¢Œ¸S±šæµÔûÿ©u{Ó&=ûÑ€Z,Þ–­ß¨!CþÛ™_ù~KÄøÝ\-Ï]ÇBÿ^^ýë‹©¿Óþj7þÿ´Àèï/qð?jößÓ¸öf±¿½½¸…{áŸ8_þóÕ¤ …ÿ øÍc¿¸å‰ÿóôÝÎÏN»´Û­¡Ý”ÍŽì´ü·LÑj‰ß!½1Æã¶?n;õB{„áŽXßfBŒÛhnú§ Â:Í1ÜVwµ#$¸Öµ*+Ê¿&óÍÒe4Ë+Òfÿ¬7wH=Ùü9Á…>àöcécRü¦ºAˆ—uɱïÈweüÿ„±†g¦«Í›•WטúÄ Ä›àîlnei%½M{¬yÌ~µÎGðÓÒÒʺñ•I÷w\$.LÌ¢÷‹&F8:8º¹¹ÚØ؇OHýPP£eüæòq>½L{õ25s´ñÀUÁ^Icqô}w|ãîÓö~aB(p7c[øzBø%Bèéd'ïM$Ž¾#tk÷, IÊ-mÝòYxEÔPKûF¼ôl³‚¯¦YZ[ ÞZZXx Øuå ÀýzxÈÂÙ«ž‡‘àXLmöÆÅ“=z›[Xô2µðôî7Ôò¼B•ßoYÙØýª#BÏN.êÝX¿­•¹•‹ÏÒíé„„‹¡ûÇVvïÓÇ¡•óÀÔ½·!„jÃ,z[ÚØÙÛÛÛX[Z;zŽ»úU~ƒ€lfÞi;K‹IˆW¼sÕ¬ÎÖ¦½Ìz™Û…[pÿG Tìߣ§•­ EæfþQSïeKxXBûfG[X[ ¾±émêÐÄæ“Q§&„jZXÚ¾-bþ®Ì *Ïs1Ø»WÀôÆÓ…~]LÓ+Ñ‹™n.)×Û^õðÉ„–ñ˜€‡÷àù“Ž¨®$_@É?Èñ;®oLpªF9;ýTÒŠ'^ÂoO`L´ôä;¹Ô›r·Œrßõ"—ùt·SðDŒ¹ÓyM9û¾ªr.lt•ØÆAÃl¯^! Ï5þäí˜ägç’XÇÇãGæÙ: Üré­à]î³SÃ<ƒ×Þk ?vˆÛÒé“]B¦ˆ50”•ÃðAî³Ó¿Š=Ÿå5|û“f„ÝÝ¿`   $,Œ¼âÄÇv¶<>ÝØÐo`¤èçÛÓK\]Tp0Æ¿žw0´ŽK`ãúŒ0³€1©yLá—·÷§ºÙ[WÔieÆ]÷¾ùµ|Œñ‹³+úû'ˆ^13o{»8/˜/þ}ÝãeæÖ~OJ0ÆÝԧ׮GU׎qr^ô¬¬±¯ÊvÎmkæxýGƸþWº»»¯‹uß»EMÝ<Ñ«ç®/‚ó‡8Û¬<÷¹Cá¸á.¡3öµÊ„w›&¹&¬”èSvѸ¾æ¾AS?•r={hQŒ}o›{Yu—YÚoúÙôõ¹eáv–~y, Y8œš8rêzÑϧû\lœödpšIr+BK`\›éäâþ¾˜Ùb+ŠhoäóÄ4÷þ!KS¦ûFÍk|V×ÇùÛ4jøŽg­£–ø¿ÙO6V£a0jqÝ €•ô1a°möÍ߸‰IúÓò¬ø¥äïk®€nö8ÿåÅSû¹8 ›YD G¤xº»x$g0…§h®ìJñîçââÖ7qÁöF±Ï¯žàêâ24z~QÁ#k[¿„* °7ÙþŒ @ÒR"+1¨4:]ðÂc7´C“ÍE„ø ¦È9ߟ(ÇNÞ¨WÉq«Ï>z´CŽÀý0éßgÆûY f7Ç€ÇVèJã46–_vëkžJªijž^©hŠuå2óö­|¶4êu)î J‹à·4Þ«¸L•Þ‘‹—`ñ…V°…g0FÔªɳÎl[WÔÕóÔž…ú áb¥ÿè”Sû´ÔêxÆÆ|QlªL×þ‹<§v>–xo´ÿäg À åÙÝX­4'[Øü¦ð²jŠýãûwY´r‡ßD¯q+¯j%Fñ“’jíÿ^3œöºW¦E‹V\âLhàò1!‘ ãEú¶2Ƨ®1Wä” G,Ø“®@æ$à0D놡SÖ©*—~ùYÕÌyKˆeØÐvŠNvàÛöM uXsúu²¿ë€¯B ùo'…qvqõ9æÁO±³õ¬ìY‘¾Nn‰‹p A×#>³dÝ´Ñn®.ýý¯¾/j™ˆIé{íö1·.rb ‘QQ”U"ƒ¼¦¢Š€¿Ä«gØÞ 1@žÅB0|¢?/§ M î‰A+‡ƒàÂÇæöKÙ° UÙ B¯óñһȣù·S Û–Ü”’(+t…†§)šCg_»û0Øèsàà€·ñ—o܉±b͘±Þ­[ùNëäÅ«W.ž U»ß7f?Üß;iýuæ‰ó—¯Y1i.]Q– ;4bŒ­Üu3ÀB‹lzkï2Áª€L¥wÂ?ÑÐ,‡Z³WE…Ý|—/g2•Ê@€1”Þ¸š«a?×C@¨20Æt-¸.´FWÃ…y+ÔbfiôFkmO9Ý”Œ„àŠK²»ÆÌ•G~w± ,–•{|ÇÚ%+×Ýû^ƒZËM@b…R÷úâ.al¬Ù<¿ÛÇ'Œ0n\¼`Œ´ÍÍ©~×x&8<•&Î^y½öÆúŠ³ïl|öŽ6ÐתÅôƒ0†Ø©ëßú*xÄ­œ·ªÛŸ^)ožóEËÇP»lFÒœOL„B@WT¤F“ýw—/*[NbnÌ)iÌìi¶úJ­OŒ“;:nBpø‚VÓä/íÛ7f×Å“3-¡þ¡¿ï“ÄmW¯\>¶6lièÀo™‚©cüØÝqkܸrDíÉúá‹k™_±^~96“.^¾rfÇرƒ6¿áJúŒéHÙ昩+®]3Рܽ;È 9‡Äù[µÒFd2 àÇZ2 hÝ`÷ÛÊçžò0:&m>«Œ‚·Û€h;¢ï:8Ò×ño\KýNÜM]ö¦ü.sÁ® (xÙuÓ$XغҾd6Öî½{mþ3JòÊÈd¬ ¨Dð˜|ô‡À½uô¾ÍŒú T'G _õËžq–ͳ—Áñ‹“·×qG* dŒ\·÷TßÁÛîyóh+µ'bUçnÚ´©I…Г’¢jk8û7-Š‹ î)ó+%¤¯E†mIÍ rê888—Åä34çî8­Hi6|™Å%-SCaR=nîÖuÇX ð&SÇ¥v ÷È¢A¿Þ\X|Ÿ“´ËUb¸ÀÓãÓã–\ŠöŒ½Çì•[× g®LìÌ®C`ƒüœE‡§ŽŸá{\^‡¡ðÇ={vîŒhÅS4èmiíàî—îEêÔ–-//¿AÛÛµnÄÐäd ®TB IDATŸ×ž\3­„ßÛ²GóL¢4©Ô/7wm}+7窃 îžÖÚ*Г¥;k]ÆŒïkˆ1FÊ^ýmîܸÜÓÅ­žo¬©  2eeüðÄõå)®5—O~Ö¶{a  ì6e‚çÚ[&ìŸ,b`[-#S($2c4 ~F»»×Ä,ØxF›A¤Èêà|´j7Ø÷ÈÛ4ŸÕZ=(ˆ±‘gÐä¿u›ü7Ô ·ªŠK£ëÐIC#î$AžD2…JQÅ$ ™„ €ëvÞKšigµ×ÒmÐ0?_¿AîÅßK>f qéjÑǽ/.;­ñ»ÍÛ¿nxï护3™e4"’S#’Sk 3îÞºqåòaÏô‡·oìR£²ëk8HüAÝ9¯r‘»àÛ‹b‚Š)jõ»ßWO³OQ¢µpR`Īùѻ۞@ùMôÐX|>Ú{œð¬@³¬ÿ¢×1v¦É÷xrí àGîëËcÇ`n»k§-ö C^Õ–×RDúWVÖð4¢öÛÅEÉã‡rʳŸÈB|’r¿~ÍÅ‘YöÁÎÎNàVÖ2r‹]g¥ÞL 1ÆÎ!kþ Y“ý*=qœoÍ•¸¾J­hôÚB&ȨËÔ {а_|b×#QËîžçÙdÈëõž²dë”%ÿíÍíWÎíwëÕÏsë:²BQ’#e”TcÐEÍDc@@"áCvû1Æ$šlwKçCWÓÔ)Íê%ýzrÔÖî  Ÿ§ºqpÊÆ!Ú€à©jv(‡×™¬næÚBÛ ÀDMå^e1ê­Ê@€®Ö‹D>ZÏù”ÊïéaU—UÓ«~{DœI­<øÀ°6À€ÕA&T7ró»˜þÆÅÔo¨LZä mmÛ­±înË÷œ^¼çWŽ®ÝšºúLäó½þf7z%6·3ZƒÇb¶ÙEí[Ë|.‹Ã—•a` Š:ÆþÆÃF qñ‰|_XÓÏÕ–m½U T(g2¬œ’z-52°-?¦ ÞmÓª¥‚ì™ Åã vL¸:GL-`ÓQs"Ï;ŒI{:¥ó¾ •®©©©ÐÌO#'/â2l(»ögØé5ç5‹‚õ”¡ßªá[ÂVߊ=.ž0…Ôݾû‡g |` ´óW.NÆÖKϳ $ãù¦Í'HLnûæê˪÷~z~W³- ïI] LW¡`#ûá1žNܼ×7¼Ù&BèÓñ« Ýœm©ÀjzNŠ^½ã˜ÿ˜WIw“¨a>—ÃÆdYôLl"Ml£<µL£oB‚N':ÓÔÃìæÝ}Ä”4²àØ!Æ¡ÊÌo„v75Y qêåÄHr¹Ý¬^BÏ9äìÚ)­}Ó¤ge©ˆÍã bq *Uh)ð ,xˆ .`* ƒJ–ïÚçÔ¾UÿáAŠ@`–5pS0ð‰VôþCìoønh rWÍÅ Ÿ$ÞÞ=—WÁLqô:qbíõÉ|Pµ4à¼z/àá³'ï‚x|ü[q…_—6º‰¤‡Ä€€Ã¬Êt*&¹ñÒ¢Çóº¸0wÄÈ•LõŸnœaî?söܹôôôôôsçNÞ®P{þ}nC3s>iѪ/é‹òôNN/ˆÿÝßÙñN! ŒÿãÉL¶±­^û;©Ä‹÷5²Í3á!_^œÙù¾A°y/`ݧ[/y€1@W§àô³gÏž={íbšrkS‡dƒæÞÕ”ø!³öC#g~TV¨É*4»)!ÌóN¾Šˆ&IðÓÕÌvÆtOJØÌW:.ž.岎߃”äU 9EåÎueÿ¡I%EOWÞ-F* ìÜȸÑGïg «Ã óy~ãí¬ñåágÛ^åöÖï| ˜¸—W#èôªï·øKXYt)ÌÌ«oT]ÅY_ ë;Ä¥•KlZŒ<ð’¸|@ÅM¨ll« .\€{Í+‰V€ZY3ü‘½·n0¨Yòkï²»w¦ªyv|üª#Æ Öf°î]?§6bŠÀ¤¨ÈecV³#ä‹Ÿ|)ecaF’ŠqÃÝ]³né“Aß®ìKùtA,K$¿‹Ýðø‘Nv£á°äñB½=ýílzw×Q,ËÏúôæµ±ÿbsMŒ!qí±œè€¾ÞÃ-Œ»(1ð¯Ì?¿Ô½°Bàìµ]œµÈË Œ© úîª2;n¿uˆOŒ‚é]=wFšzð»Nê lÜWnø°~ýœårïÝz´ôp–»xåò¥—™“ùýõ7س¡³ºì"N­¬ w½mkÛE_›_W–›•ñ¹Z{ïÁyÿê­!F.]tx`ÈðÑzéÿÊxÿèUîÅ,ðþäÖåäù|NA^Οoßô‰_?=ÈKcŒ¡gÜÓ3ƒ^”ò{ ·Åûýü }cÕÛLW‰œ›õãõ³·qËŽËtjbƲ=¼Î®Í9að+së.ºê¼š²ÏïßØÆm;Ø  ôßb6ðÜ QIìOËÏw/Ý)2¾ë œ,@(ouâ|—aÆŒ’£‡î®¿*NQSlO ˆ òëÏÉ{wòâ³ñ®…ô’oàgߺµ¿XDaƧ†RþÒ¥Ky|… ó&©SĹÅßé“9ôÀú ¶§}·à„ ¬ ‡3s £äiPÇ(ýÆáBÈI•PøÇT` Œðôõ¬ß>¾Þ;{ÑÏ®Öý»Ô YÂÚï`WEƈ{=í¢|´Ÿ©à‘¢¶™uO o4 ¬Ì» 䆮n`knÒÅ=ÐÍDµ²¼œƒiNƒG§Œî‹1Öìéîe¦\\R®Ükð´@ãMÇß$ÆÑ€`Ö³{XöÑUléâBúÚÊ* ¥Ýµg·&­¬†­EÏ–¦Æd;Ÿ/+}*"ÈT†NóÐq³ÇùÛ Á†UÉ;8Þ¡‡!£¢¡çî¹6%Q…Nàå|-ì<®‡&M°ˆì`¡TT@q´é@µèc£@l®¥'…B·¶±1×mî›TÖîben,1ïcléÒ·§*›Å•Wï6ei¨[×®;$«¬¥(/'//¯ ¤jîà5Õ2%ª`HÓ5m­,ÈaŒ5zôå«H§Òè²ZÆ>cÒæ%ê«È´ê ¡È(ÛÚØRÌ)hZ÷îÙæ G€)ê!a£”H‚DëÖÛ%eÕ¢^*7Ù@WUN^^AQ©k/»¸éK#½z¡FúÉtu[;² 4PX¨S4íìûèÊbŒä†FŽ¶ÒW"A“‘ïnî8qáJ?+­¶t¢¾±mOQšc„1V1²IŠðS–¡ÉÈ)êO[Ùß ÷å¨f}ì ä:8$©ÕÅÄ¢‡a«¯ºõ´îª#€0¦Ò j Ëjõmú¯ZgøÒ+sªÿ¯–‚~ÃwÓ¸bÿOoO‹Rþ}neô›‡ !\^R$£¢-KE­Á܆šÊšCNQYžñ>­„¤ð¤ (¤ )ü‚¿xï|»y(þÕû-V`m nŽ«ãÔ ÿVÂ:Gn[ØZ˽€ÿ 8þ–õ@³Æ‹oî¶Ñ¨æmk%ãEë¿;.ØjEÍÈÀ¸}¹åÏømt­ÖÖit¿_P”¤C~¶Ö]›ôÿGÔ Bèþo‡è ¸•…BïMÌíTsþÅU’Àù_ñíNü0OÑ÷¾•ˆßÍ‚ù·m»™LzÊmká‹be_ñu²·4ñr{[ý•L¿¡kø̇ÇÖ÷v·³··wp—º³°Žßòöx@¨2ïÍ g»qÜmºIžhHß2ÛÍÎÚÎÖiâªã5<øÞÜ_WVQÓð´iia1_’Å?ì´w å æ`¸ë !nÚ@ëÕsBጇGýû9ÚØôI\üGO Õÿz=9d½OȤ…u-zñë ×O ïcoçêtîUž0†«äóÜ衶vöýG&<˪lY`Uì˜7ÆÑÞÎÙsØá?"žÙ0ÀÉÎÖÎeÎŽ+,Œši|„ ÿÍù`oWkûˆéëKXÑFìÒ¯ócýmíí=‡Ç?ùYÑ :våî”xG{['¡îe1BÄ‹s›½ìmíœgm»Ô*º‚·CºYÛ؇M][Ü€÷!„?ÝüÃ×ÕÁÆÖ!9íX¿•‚e_nGñ°¶±™´(¯†+ “W»rB½½½ûàðk[Eˆ`_=ÅÅÞÖÁuà–Ëø ˆ–ÄŸoï÷ss°±q¿òHkèPù·»±C=¬míG$,Ì©æ4Ò YOOŽðt¶¶é»`G·s.‘¿|–üá¶ažIWZ?ÊNðêêêùÿ–sî×<­-wÞÏåóyO¶¸ÛÛÞËá6žû'0Æ‹#Ý<f=ç´]oO„wÀ¦›ÂLEÌÿÜû³cÝìýfÔqy\.—]³%ÎÃÖm|E‹TwNrsóI4`òÁû¢¶¤EðŒI­%0‡U•<ÈsPjú4ËúƒÅó÷>úýÜìÕΣš¥)Ï{y¢Ÿ÷D.Æ >½ÿÄs7 wÝð,cœù`¿³‡wF‹ñy~£ç 3Œr4O»ò“Ïã=Zçdåù¡N<‰qÝœþÖ+osx|VÎMsǃ9‚WÅQÎf3~âq¹Uov;›»=¬lV°a™¯Ãél>Á.z1ÐÒqëÆøÞæNÃâÊyÇš<8zå±æ‚ö㺻«ó³¼ã›ÇyúƲùã’g³©‡>p¹Üêw8›»Þ­h†Žµrˆ“ïÜ3l‚à”¼ö±rÜô‰‰1~´s®ÓÐè2.Áãs„ûE.9Ø ]Uöí¾.N²« ŒïlŸàáÕÀÃãç78yÏcrù˜¿19`drZ³ôœª×^N6éJ ‚xwr¶›ÛˆRƸzRßÞQ›s¸ý¶˜ ˆOg湺 +fcŒñ¯×']úz|*eŸZã4¹µ”3Íá÷òÝ`^ùê¹"#ãöÝËzµ«QÝðŠ÷¬œ=zôèø‰sïeÖbŒqõÑcÆýªãb\4=4$Z1qc¢6§g ZóâüžqcFIœrþU‘€¿žŸIžÅ–$¹ðÆö™›o5&é B‡¸m¿òE”´ãÑÆñÁ)÷š5ªÀ5·ÊÅ«x¸0dˆ§û€aÁI« n®PݘW“»>ejLtô„™Ë¾”°1Aê,ýxcJR̘±sþ¬Ã+g&¦?ËÇs Ÿ§NM=:júâ-9,A *çÅú y߯x„ó¡ucBðQýêÕÛÚÊðÎö•lbeààIBuƒ1ælZ4íaF½`Ps_.0sœPƒ1Æüë)cÆízÕrà¾:7%!&:qÚ/e¢<&7oHˆ‰“8ùÄa˜s›’ÒÎç¿8±.:*rüô?ë0ÆøÓÆ„Áý=ùŒ—†1ÆU_ÖÌMŽŒŒ^°þ0¿Qâ˜8û`Ö‡‹ÛcGG$MJýX‰ù¼š‰c‚Üœ=BÃ#faÌ/šz7“[üölÙ<Œ£½ÌÓ %ÔÍîÛÈ­_…UV¿t±òúÄÆ?·GÙÞ"’ì)A^+Ž¾o^Íë“ÖžÌÆ–ÞÙ9fPøV>óM³X(*¸rœß”µ7Ä 2>ìãî]Ìâ ~:3ÉÍo%ãÉCz¯¼\$dÒ¯“6–ù’ ½4ÙyȲš²Ø»?*i(:5Ûjä\ºµ‡NXqE¼TCÎ3·þùõ<ºo¦º^ÆÃx†ïÅ …è ÎØXŽü%‰îÚ4×Á‹Ÿ5¢ËØÇí^A=Æ8-ÄjÂ,aÁò;}zÊ,ølá™×„ÝÍ­áîzöcqõýíVcxì:½*,`ÜñRÜš\WÇ×ùÂ$@OÛ¹Ïda¼>Ü:qïO!-}¾ñ%н\<°ï´KBt¼Ú€~®'ÞäcŒ$Ú®ûؘ裻µÇ›:âߘï#¢lü`ï?elÇ'ÇÓ^íZ|³ÀÌÿç„YBRR §Éüa®g>T¿áÏÏ_Ø|  >a|||||||Ò°žï_dj÷ÐDœž6óÄ—aÑcGpÜ?Ögãã"@¢P É[n±¶wÒª ^Xx¼¥¾¾¶FKWG¸Fªy6óTñòÔHŽØ·tY9†ä–™Eä,[ª¦ë𔉣§qÀÏìç“«éïmÒæšA @•ß>GË-(.´ßîÿ/ßU2›ÿÂÃw’žËð±I‰vŠ™~Á HtY±»w€¬2 ;oÿ²•¯– /ŽBŠvvÖr”æ)M=“•©’ù159e[YÁÓ/³è¦æ ˆ*#'KoÆ>^Xí?y¿Ëððp?ëÕÑ>»îæ!ÄÝ1Þoõ½òà¸ñÑ£\OϹàbT–ç^Ý·äÙnþÂV”O± )`4|Š‘ÕÔihrT¿ú—g(ÛØ;99A¿úË°ÉÕ<õ5yOά¼QÝ}NJj_’Äð$D–áÐÀTŠ›=o€è Y*kôrçò"À¶óÏý$NÈ—?|Ëwóë ‚3ŠfŽr¥éß8WŸ”[»™Bãùg}ÍWÙßÅWlß~d©ièÈ`@À°§[}ÅC>†»/‹{Zw´5êþ-ïh͉ ~ÈÈh(RH‚‚šfqÍ=‘ý=›jí¬%<¦çÙ“üõN¾øJµöÚS¶»o! wå†ó_ë½)2é݄κ«Éü·âèŠ 3ètue:Y€NÝÌÕÜk r¿dRí\µ…ètú™‘¿ÝÌGWwåIƒ»¿E#:­¾*ì ßjŠ^}'ï.‚ªö¶Œ_—2Äùɺð°ÎÅOPE®Ÿ:ùú÷òO_ót Èì2îa_VúDœÎ†êo<ž²¶:]ð¼ùPù†‡E¼Šç±Ë nB2T¬íù¾‹Ë*ûƒZgßFtd™~ԛߋªî¼ä¹û› ÊwwQ¨JÿÚñ¼ó‡Pŧg/¹Ú·çD+À±CéëóU9 ÃF¹˜Òœú¸øÒU NTŠaíâ†Qí5ÝoáÖsYnuæ¦û™[Ó÷V'8öÑÊt™°6îÑjÛÁÛlƒØm1w Bˆ{j^pƒIòP+%Œ1ÂìYÉcÖ]è&q.’°vH†(wï­#K*ÒífÖ«+Ôe5ª%‡/š›uÇ\\î19û’=ˉöhÍŽç´Yáƒ0€“³áà~á¨DBªê&É£Ü1FÝÇø¬‰¸Q ohªÊ Óuº÷21º95œðÝ47Úúô±¼ìîsïGé°^!RŸî0ôˆ¶ôìÖ2 ÷ì¥ †……©&Æi,߶GÀyY¹f'(ªKM'£ºJü¬‚ú†:ž–¼(eè*Q**›„ÔÔU3(*ÐÈ[9y.¯ž‡¡¸–­¦//úLS‘V“Q/ú 0ëÊÉ$Iø„NW`rëŠk¸ŠšM§ äÕä8Å%ÒM·Ì&ŵ)Õ@™¸]ØPRÇRC§¡@«­“@×P_NBªäÆÄ$4š"“S[\Í‘×TC'Ï-.á#QýÌÂzª£ŠhôQ ”ñŸõœr–¬ž’¨ Œ¶"¯ °ŒEw+ròë“’(¿ÉPî–0+jåh]D„)ÉɲØõXŒNn}1U”Æ'TE*¹YUZÆ’Õk:ç/«£Ä+(lSQŠn~²Q%î@†*èFI=@mqÍPY$t}eþ»&ØÉþ»Ô ””åË0é òOX¹ëŸÏ Êa£ÜÓbûíÕ³Š?ÌÓZFâfXa¨Í¾8ߧ9ûGÙ`€†ê ÀäËgË’1¼ zÃÏ1–¶r“ ÔoNz¾Øéâ™8Áý™?./|j0eEá÷Í®éÐmEWfßë}’G§!‚-ïËæPžþàööÓÖG1QV¦Ú}¼Ýi[üûõ1vãÔSŒ0nÌä'™0I}ͶPöóõ‰£‡—ÏM.åšÝ¼·]uÌ(P(ÅïÏNÜ0y÷ù=•q› r?g“ƒíÕ}á˜èPöý<ÂrªòTiŒ®žt4»” @ðet¬…0èˆàJfd^}É£v;9kæBìŠa½4]aº.|ÑRC¶Òeâ{$„Åòí<È ‡hšEyÈ’ý$†¦b˜ ‰¸HñŲFñL’¼‘È€ ‘ `‚’ŠÂ¥¯#—:‚úËUÉÐ%‰¡“7Uå~-áBWÁ™dÖçB’©¡<ÕP±öG9ôZFU™e2>†âcƒa¦F|/çýY€uåuJ”«ÊDì*­ª’g¨#1:irúdTÌ䂪 ù*§˜ÍUUTÑ5R¨Ë(ƒÂÓ~Õ?Kž†2âÓ²¹:þ^&BÇÿ³€è1T@¥‡JÃ×>h ìµúoÅÔ^F þpum«š‹1¿¼Wˆ[õúS¾Œœb7kÏEÛӃ͵o?¸/V+*xq4aã—C—¶*Q„Â+£hB"3y$95UUU5555IN™Bj=:!´ d8á—vrñHŠ0€¼ÑÒKõuqvvqus3”ãh÷v¶7UëtÄ éÍ·¢®6Ö†ò •Fª{ðºDp;3ÉJôõ[c·ÙÕU@¤†²Ì·™c ¶$lÿ¸÷Ì9; ºøe~­4ìeÄ÷à— Ãûs{í9«ªÖ #fUWÝ‚ùó6 zkÒÛ×o ãcGùð¤HIUØ!uåL¥½½pѯýàyÝÇ{® Bd>{C7èAØëSúC~c‚‹§¿²-ìDÕ ¦6f•¹ùÅ0ø|y…†˜ý¸óšÓXðÅ×·fž¢ °ƒ^÷^¬šÊ_,(˜qõ©W´L-_]~c ¬GÇh¸ T×¥Œ!£º<Ù~Q@'.ûù Ë2‘ë7Øì烷ìFt¯>¿ìiá-ŽN»‹)§¾:¯ ûye2 — sk¥—Þ Ð±ŸžÊPs¤!nh@—Ç;„è 2ç)ÁÙS @ÙÑ]ãé¡û‚yƒ÷éÆG…ž#ôÅLfü|ïaAvõc&ׯ—–¥³YÑçŸUìúð쪦ÅHq:eT{R(œùµ‚òÒ·3{„耬‹§ÖÓwµñ¿Üy/×c¤¡$ºPã"tœÚÇu¬Áf²ÞCôï¼,dׯw/)šÆŒã6:}"ƒœºâýý»îT(jÑÙm¹RZÃa8LŠò -V1bpjs¿¿=xú‚GÐ[-Îî£W#"U¸Æ„Oî±´£²°°°°° ²këè¢7Ò.~즧Zž÷mûŒ¨ÝߌB<9‡ x IDATz½¿±`ËI/O7²XîÅìãã]Wš혛ñ#;;;++«ÉkkhtëÚ¥k×®]»víbhôóÌ&vÀª„>J¼}sƽ’u³5w9ãWg™ôj©œª½‡Ó‡†Ds¿l>ûÂÌÒ¬<ëmÊÊ»jJ…L]k[[+òÎÔÐÕŒR“µyÆ’œ†zë~a*EC’Vèv7l¨.ûxïÜ™73&„)’jVMTÛÅÛX”McºŠZöµc³¶Ý“§U•füùæàªIr­çÌS çfEî*é=ÈR ø5ï<ü™“ýüáÃJ†ŠÔåÖ(Å%ΰô 7 Tffegggÿü™¯fdÈ á‡ëfîÊÖñê-áƒU¥×lÙ¼M»‹Qyæ›E+6X Iv´ìÚðüâ–‡ƺJߟϞºÃcÙïî ïîÉבž]jþÜrâ˘ø€çO~¬£©É;ó<¼pb¹b7Y~í뛇£§­õ Ö¥d¾8ñ¬Ì&Ì·'fö¶#O#ãÃQÉ¡]zöBt mùªÔ©3æ ”šy²‰ç'öƒ[€“¾’~—®ûWϬWÔc•ý\µd…¾÷„`מôîý2OÏ?ò «Qkoï›w·Äzéü†È˜C˜¤Ü]ýÇÉ)¾ª’?ÞصütåÖ#ó4ɘbàR}sÕú‡uÚ²¬ÇÇ—žúb°vM´œXA$§Ý¥èFòöô¯ŽÎÙ›±ùør]ôTE+ÓÖÉjë–g¿›–²ÛZJ?S-ñ9CÃÄöܺ‰¹$m¨ýµ3-•èïgKÑw¬»»fͽ9öÓ“Ë~ÐY·~Œ¼8:YÍn¥·'l{f ÉøöèøÌ_6_¥O5Êê´4†–~eÎûé);O\ài¦#ŽNÝÄþÂú‰™X ÕýÚ³:…Ó#<Ñß!覧¹}u ¡ª_[ø55u½uðô¡ö]Df.Pîå~gÛ¤—ÕJ nÉÉs)ûO‰êGU7g¼ß7çtž¾~siÓ¦x˾©* F'EÖŒõnÒÆkºÚŠY¯¯NH»¿tZ%š‘¾Î®´yîá.å<ñt©äŽïØÔ˜ÞaŒq}^phøײŒñ“ÃË㦧Urqöƒ##F†ìËàbŒ3‰?;£‡uÚ·c\üê̤ØÐÀ€€Ä+¾T · §ùyËlymÈ»ë‡'ÇG‡»ýä½Æçüãc}ý×Àã†/‘þ#CBBBÃÂBCCCB‚cÆ-&¸…c#$Ú:rhÔg6ƘizÀÀÅ÷[n„ç==‘xþ]¡ûõýiA£Âb&¤¿ÇœÝ7sSã#…WL©lÔç݉=u5ÆW¼O3* iöê_\aýOX|[ÈÌògC‹øc|z픀€]Ïk1¿ )pèÍìÂÒ´N`̯ú4wlT@HôÎËï„!qÍK§‡ÎZµŸÕâ6ÁÏ[ûV†‡%N[þ£¶1‚ 0f_3;88dÊ¢U¼Ö >>¾1*4hLò‚GƸâÇÝI1¡Á‰§_¶¸´…Àcvæ’Éc‚#×»ßx%qÃÉusƒƒC&§n«ä¶Žîé©Í£Cƒb'¤¼/ÔE`Œ«2LŽ O8ù"¿utœìeSâ‚#×¹# õ 0f¿ž‘»ÿÎ·Ö …ëf%…/Ýu¡‘LcÞå‹ÃB‚ÇÍZ“×Ð:¯ï‹ ŠJ˜ù8Ÿ/ŠÕà”¾•ûÇ­Ï­£ÃEæŒ  _¼=]D'Æ×}M™Ï÷}˜¿àffΙ3çÎ9çÌçhº”[dT™1E[côåIDª”i©¯žî¦ùj>Î/>AöüË [b£Å'‘o$ÿä¾µ¡Š·ûOøÔ®0•ÜŸ5Ô® ­7Â5|o„ äÁãç5B™E‡Þþ^tV€Œ¿RˆÔ¸‹àdßÁ¤U­¥u¹i-­¥µüÛå›n„ÿ½WûÿÂåwüÕwíµÔø'¯ök­ñ͘XŸZ!>þ*ŸZ%ð5ýŸ_"¾M ÿoäàÏëAKúòm Ó’<1VAÏÀX3Úã/lÁ¿Q¡]Fÿ%› Ê·Œð­ƒë†Ž?ÿY¡&ÃCŠS®N2úðÃͲÐb„Q“¶tÒ(¿€°5n"/ `„çÃýi£Ã‚Fü|ýÖ† øðýŒ1~!ËvœUfcÅ€°èÔO‹‚ƒÇÎZ“Ë%4òÃ’§Ÿ„³;F„†ž~÷C™-!ÄýøhÆè°€ á»¯¼ÖN®.燙Ñ~!K¶ÂJ,s@¸þÌ–%ÁAÑ3VgsZÉ=»°{dhà°Èi·ß ”y81 _ùù»°àÀÈIKRËdH]CȨ¢´[‡¢††Ÿp)µ5ð)-{9üpÿ€a?þþ°Y¾mŒ1€¤hë‰þÁ³øµ7ð Škû¾ 5qqr©vrwD ûº 5ð ÷mŠ >vNüçzò]C2Ÿž6æDBA#ŸÀÍZ9u´_@誽—¦Uýh*¯Þ¿jF@`Д¥Ûª%¸‘¥G¿ÿ=ûq®´MDþ‹Ø˜áÁAaQÇãóšÈñß­šåºbwl3r€1 Eͯ«gMZ¼¥RŒÕ ê?o˜3Î/ dÁ¦cr- Áñóƒ‚ÇÍY—Ï'PCâ­WW÷G††œ|=“«UaªßÝæÌô¾õ,%#íåÌP÷Ù»¯©9’0–ò³mw_xœ™™vxÍŸ¨Õ"ÆX²i#tÙ±ÔôŒ„ ƒSD~-ÅõU‘.Q«_¤e&ÿqÁÍÆù|nƸ ᤠÃãÆÓ×i¯æ†{ÌØ~IƒœL˜âl³ýìÃÌÌ´cëÆzZ)T`Œ¥[F³‚—IMÏxzq““}P²P“ÜÍÕQΑ+“Ò2_Ç_dÛ8ŸÉæ‘Þ™“½¼fí}žùXïí·ðŽR•¸Y ºÇ[¾ c¼e’ó¼_Ò• ?žì4ºZ½aêîש±J¯[}™7“õ´€_ÿâ×î% *}p‰ßÄuÔ&ƒ›Çd²RË•wí .NsÛ«ÀxçTç™?§*É}¾hã8ªR\ÆÞ0æä³Jr’*_óñ'n}òáìñârÇVŒ]}W¿È•ÅxY,"+_™i¼[Š±$û† 3ŒÓÐðÎÖð€™±ª—û ™ ØÓ).] †Ã¸t°÷:Æ—³ÃWÇ+ÅUñÌÑÑ?O¿¢ðÄ8»Q{œ‘òÑ~ŒSO e¹÷l™ÁÕ äîá;õ¼9…(ÌÛéòëj²BÝãƒ<׈1–•§92<>Õ)2ŽgD–«Kfr¨ã¾;…J¯ü«Ÿ²æ‹0~¶Åßsöu%‚OnÎn)UªpDuÜâAAß7¡LŒvÝt6CQ•åÄ`góddoïOMpqP¦NnÆ0Ç]qùdÅëís„¿ÜÈžyEINXàáâú²L¨Xskù €•ä–G»­;ñcœ}p}Üñ~0›q3SmæOwðœ!kÝ®9Þ3·>!꫼ܜä“«nͳõߢ#òãúÂß2•ósj°S4ãÜã£+É)„aŒ«oÊU—›?ωùîÑœ E˜“óú\ÜCõ$éJlr‰ò5*y~éüå$ᢞS{éš°èÙÉ«¯0ÆUoo]~VQ›—záìé —o • ¶Œ_vûjìÙóW>òñÆärCÆâêøÛWÏœ=÷ Qˆ1ÆÂÛ§Ï}+©>¿}îQR.)¿²”Ç×ÓeÜ‚Ø‹—ÅßµÜ|ía æe›˜YµÑQ^rïÂI]“Bѧ2;Ï^Ê+ó¶Ãû “U©îV…wîU»NôTzTÍz²t—³ë*ß¼ÑÃm• {ûÚJßß(V¥)¾~³œ9ÁCéfÓ·dã¸NòËO]÷Öm¸k?x«ôóP¹kϫΦ £NÊ»ömÜÆ”]¯Ú”¡óp;%¹^CåÙq…ªä$×n”3Æ7Ó5c›PneW¿yý©ó€žz äÚ°+òî©’«ãdaÔ¥’;Ƹ"®XÞ~´êØÁ¢¡aO§QÁ 9ÑÔP!Ê©ãÓz÷² +˜¸M°®¾÷Q.~_ë:ž­W[[gJÅ¥>åWãŠG°¼ÈÍÚ">'¯àcŽEÛv–äá =L\x]ªh"‡ësøµ:}ú[‘ŒÜ&´çÜϨƒòâl}ó¶zJĆŽ¬(JÉU®¬©!àÜÒBÂÆ¥ Yê4¦;?ñeqãv%K9­Œ;ºH®fóT5æöüÁ>öЀÞàܵWÚÇ7üŠ==³ö†T²·ö®Ñ´Òk© 9ø\˜¯°uíFV 8Dö¬{þœãnU²&43lçf$¿–]«ªŸwïåô´k$GïÑ7óã+Ù•¸Rç±lh€P`›ëÝÍ.Qmø4áSOû~Ô†™2À©às¼¢.G&ÑïÑÉ„|hÁžhQy+W¤ªØåééõôÐÁJêão#ͺ]W®—:G¹)ÉQôØ–†²ÕôÌ~Ò†ˆa‡k×ã:êCÍû¤co«¿m:Ž¯>õ¿|ÿÓ¾­?”‰ä'ŸúåÔG¢àƦ÷ :ëÌÎ_ÍÛvÍ¢c礣ýƉ€Põœÿ£7’%¢ŠÕ£F¤q<×DMd`ðþëÏ¥²úøãÛès9`øñî–ý¹ øç-»>z‚Ô»Ó¿í{õ–__“âä)ÿÛ¶ àWëêX#äÝfsså‚ÒZ±EǦ+ómMDEªnA>_¯uc€^ï6ħ"@e¥È¤›EÓ¹Îæ’¼™êró‰Kíݦñò;µ5Î+Uðë, -I–@[3#A=O5ú@RWŽ¡-y×èèYQux"ny¹Ð¤»e#9“Îæ’Ï%ªW£Å¹\Š 9¾m!¯LTɘë7‘kcj,«‘“ Ëlm@SV èZÒ¨<¾8|Ž!­McCS#3™œ«h¸HŽ¢©ÂÚÔ@YhVFzüÚêªB¾Aï6ò3èi%ÿT¤’%+rkqwËÆ{t¨—µNIe¿Žc@³n$gld&WpåD9BT"QX›ë7£Zë ªy TêP¬©ås]} ¼z©J4G})_jI¢7 K#ayymÖǺ A·5þ\T§úç×Ê:š™4êOW+Ý*®@,ª¤ &r4=K„x"Urâ2¾Ä¢½I¹6FÂÒòÚÏ\ª 9Zk"¯X ³"¿VÚÁ´‰\K½*.@ö©õ²j¼9FéÓ– T–p…mŒ,E×ÞÜ'ä+êË䄵‘žò!¢Yééò¹u*Š+«D¦]U¸£™¸ X[‹zZ5&ƒE}¬IrMíh&–Öæ@ÑéЩ½àÞasïŸÜ©a—4qjíµËuÀÉŽ‡ö 3qn±2¯ÇõŸ2‰Ö°èQ(Tøœµÿz¶û’«¥DY™PVxv{’aÀ¥£Û&Lšyáî!ƒÒ²ò»=S³­'\<¸mÂøÉ;NÆ2Ì8{ÿ£ƒoÀ§«—ƒ"í¬Ì{„éÇl1~÷9w¨Ó¤'ûfܵÆ:ø?a*&ÔãÈÈ „Öxˆ4ìà«“AÒ`ˆ1 ŠšY«YC¬Þ`ÀX#LiZ÷1¡å„›øü"9À(jqtJË–*9ÔÜ™€5Â)*]¤¾CÄ )ÑaDš|1 Š*ÀÖØiªŠ…‚H߇¹f¶Ar¦ ŸJyªý!m ACtcBíaã´ªW]ž¤eš€æÓ‡›ñ |6Ó"¤…҃Ęä^• ÒâQRŸbrˆæà"Íå©¡QäªAQ (ý¢ I%H©Ì¯N;¿: ™ÕPô>˨søäv?”Å>ןão¥†&ÜÕÛ˜a¤§‹¢^Éï8Ýv„Àª{oòº·üú®}¨# „…æbfœô¹ÀÙQ^òˆ¸s6ÙÅ.Ì·où­*€ú¤\ºw_ nQ™þá嘘Xˈy×Y,æR)͸£¹·¢®q*¸Õ|ƒNm‘Š€MºKój±1$Ÿ«(=:X[ë Šù ù¥µº];èªÐ4èa*ϯmÜïÈs+Q׆mMŒyb®ò€PÍ뛩žnôŒÛ#¨&Ï€s Cóöí êŠyä%µºÝ:ª^—ÖëaJä×6îw¹•Ðµ½‘µ± _RÛH®F 4ÔS#§kÔž‚ª%òr²™ÜÄÄ,L,ëåœÆ†u"¾.ÕL‡‚êvÔÕ©H”@Á‰Í­¬;Õç7DùÕÔU®ö#¦¨ˆ×ˆ €?W):Z™YŠå5ä„"•bJU!G1줯SÃ7’«Š­ÌÀи­‚¨V4L«TR `ªOS9Ýt4¦ÕV‹Bm­Ð°];‹îƲ¼Zy²O•¨{'cÕU¤«©n¹ ®QŠj$mÌõ Û¸ZA({“I9›è©’ë`ªË­6‘ãÔ¶kgÑÝD®A®[GcUýìjªW)l"W\#±27ÐíiŠ ¸§Q"·wio¢Ú°£™§ž×(º žÈÔÈ”jÐJ©®—6°!¯KMÌŒT–J»6úü.ãêuéd¢NªÂÛ›|“¿d4°½åû·Roõ5`ô¨øé÷*¿SO]7˜ŠÔ$’*t©ÔÆg%\É@OW§qE5 !‘TJdߦ¢²T×ß—ÚØöäçr!6·òæqãÐË ÛäW¦0téÑWȯªU(/¹&_§vÒ¥tëÝÞ$+?%ïârôí¼Ú©2jài–pþ•òsÎÏK` ÐÞΖöòÎGåêŸÿGµoH7Õ½ƒ~˜¿UblCCqMB `áàØ£ðýgEÃ]ûÌ÷/:u÷P½koÚ¦?¯¬VJV¨J:/¶´BVCt“ne+É>I£ôí®F.ܿͳ‹ÉJrî>ÜßÊξGñÇ|Y¹·oŸu覆x`dÕŸB”ÔˆÉ ÕIçëÛtÖ‡~zsÊK sßÜ3î@møÎ" £þ&&õŸóød~ÒÙs¯>º^®ÆOc_+Ù¨Îz!·Þ_O…Ojx`û䛩 ¡ Š„*žG¿nÝz÷áV•ó"{ûœzÛ S ®N9dØÏÌLœ›Ë#+Ô½8Wiæací:÷“Š9Õbù¼ôåeÜ.È\·©!PúvîDd¥Täi—òœMuB|-ž6N«°ô©H/|€YŸ}:g%dAzË¢|»Þ¶fmûɤµ•"9Ù[ù‹KŠvA–ªä w·®DÆËr²‚"ãÊgC'¦9%ÔÏ2ñB9QE‚6l€…*f…¿Wç·‰oɽ,ȵíe@‹h›t¥AžrѮԿ'Õ†®ŒîyqÃL¥å¤vïÎÒ1鯧',(‘9IgùV¾½ŒT»ÃA´W÷>)5êóÃLjÿÀN(<°í‹« äâ'œzßþ]¾]Ò,È!“<:=Ï~ùúNqŒŸ´ ´z{ãJâû½¼ÿtcЫ­Ay%§A³ÕE|Rm½©2J•ûn ™ÉàöV]&;/¾/(æôpè=û{TÞ=v*öÓ¯_ ÄúWá²_Ç0½ž¬á *3ã¶nW+0ÆøõÑÕŽ1y\[>%ØcÉ¡Íxù l¦ËÃw¥uBÁ‰5£#WË L`üáÆ^º×°U<€³lŒßÔg5<¾î[_¦ý…—yuBÁÍ=ýçÖ)0Æâï‡Dm¾Ëåñ Ÿìs´ñ}ÞÌ~vº/kÊž*°úÓ3w{ÖïÙŒñÇ;èž!ï*¸Aíªñþ“~8¡é|ðgÚyö©®NpwÏdwßYÆX¼&hè¨osyü¢§¿:Úø$6s„ŸŸÀœ´³J ¬É{áéÀ:úŽôxËv w \q‘Ô½>Kì~·VÓ3}såhúè5å!§ô]  k÷Ó|ŒqEú –+;)¯²NÈß»0Ÿ÷þê÷Nö92Œ±üøDö̃ՂºªìG®CYg 4áIû—8O-äÕq9%ãüÜW~Š1®¯zãÍt¸šR  ®lï¼°^ÓŸÍŸî9xááç|>/;n­“Ý°÷¤#\œÂräqN]à3Ü<¦r4Š–ùÙÆìxÈãñòît´ HcŒW†¹ŒÛTY'¬)|ããÄü5µ\C ï®îròŽÈ®æñù5‹GûÎøéÆË ÂX¶|¨«ã?=4Ë•=©ZÝ®Qª3ö¸ªå‡Ú[^A#|Cg‘ÿ-Šöõî³)±c\ÿtE?¿ãì‹ãcN*ýFü÷ŽÎ™1.¼à8y*‹+ð_™çââ t„W^gÛ:Ž¯ Ee™±l#¹D†1.HÜê5~†Çâ›c,Ìug0Ù,—´JÆXTûëÃ<±â?àÇ2á™Ís™tGàñ÷?Ô6^ }ûðX «““‹÷®ë©š“ cÌË{ĶsdÎßzVL4=Ï{æîì@wÿñt‚B[CQé«á^vŽ.S×üV'k¸L\_¹wÉ8:Ý)`ô¼7¥Z²¸ éý«Üœ\}F^~SÑÈRAò¥pg:{ýÉ?´’«/{=k¸·£Ëäï~H•R&ÄÕû—ÅÐéNþ£æ¤”µÊåÖÕlg–÷ˆØ”òFr„”wì‡é.tG¯aS>óµÝ¸%âOÿäéâàâr"1¿±aõ‡ûQ~,{GÖ²½W¥Úø”qÞ-dïèÛoPäÜŸ•™Vëm^Hf›ˆ_ÜÍ}-ÆøýùHûÇ–›wƒ‡¸dÔˆ1ƹOϺ::»xïT°eŽ×¼Ÿ•Y.j³NæMwv Yò¡J¨L”SùÖÉÑqÇ“Ïd¸Ë6¿Á6Œ¥d>ê÷wœè…|ùßµÜ|cŽpõ㜚PT§9äeó  - ûŸ6lÊÞ®/SlŠLýzr*Ø‹üc|¶8•O-;ü?›Áæ|jíîOYúÈ5êÛ—$ó7)vËó.Zêæκ’aÝ|ì¼Ñ+~>û[ó» MùA A±éyÃC@M@¨ÚF­Šö‡*}7œòúÒÄ}{¡~Sí¿åj¿dÄ×7üL€¿÷®ý_"÷ÏñÙâDüU>[r—|Ÿ-‹ü Kÿ¹–¦õTì¯uC›úÏYô‰K›½ÑH;$¾zrU¢/+ ÒˆÆÃæ¨#_5„n¹i-­¥µü5ŸLç~̵½m=]Çöü_‘B+Eki-­åßZt[EÐZZKkùwÊWgbh0A½¾{úÒõç¯ßé·ïÛÑ\—4h Šß;râAÂk¢Mßîm 4lÕï®í;7Ä™¥GÁ€¸(åÈ‘ßo?L,Úôîˆÿ¾]­ÄÜšÅï9°ÛÿLœ’hs+â¿X0!ûuÏVjû¡,ôþYB vŒªxþýþ‡n®v:Új&]Ýyçcû¾J܆V$ÃÖòÚÝ`„—¾1ÿŠ‘ÁÉœ—/CÕ¤žõ ›[,6´ÔãoëùËãO*Š1€ðÓܘ57oݪW Tñ&Ö%l!פûÐÁ]žþ¶,hÞÁf¸%RRo&«ÜÍû‹gH„Ö2³úϾMuu™â?Ì"„ŽD:¾#„)_ j©¦T,Šåd“ ,ÿ’Öµ¦µü­år„K “w%IÏß>ÖU]ßýš‹¡§Ænß{ÐkÖÏ›¦9`ŒÆÛŽ››áµ #„Nl^Aó^ˆŸŸ${yxzo÷]+¦Óã0'ËAÖà™Q[UE3µ6ÖS]þÈ”¾.O #@ßÐÄÔHs ä׊$2@:†&æFz:c¸ŽÏ«—ÊQ MÌŒô¨„”ËåKå…ªkjn®Kqí›W%Õ<ž‰‘‚_c`ÞÖ !œÇ©BúæúŸ¯01¥‰yubС™YXèRH—$ð¸b™éÐÌÍͨˆS#¢·1ÕWcN!©ä­Û˜ÖÖÔÊ12257ÒE\Gª@FffFzT@Ôi³˜!sy¹Siú¦æ¦:dî8,ãrùR¡«odnbØÌí <.W*'…jbf¦§ƒHO¦D$ë1…fjn¡§îû{ zWWs­ÌÍÛÒW/¢CȪj¸æVmhJÇ-Á©©14³r žkƒL"„UÏ ê ¸\M*Ö12·2RÞTÔ×Öˆhm­ŒùÕ„asCÖW¨µüË Ðº8?¹{…JU^&Ôµ0* AÅÇÌÚq›BØÈ;¦ç‚¨Ç\ð3ÇP̓­óûÅï¡{W.7z&ú¸¾ž\¿@®ªÁì7掔yn*—Y0Âr^ô°å:V,©¹³~¿5±o㊃“wŸw¾ÐÖ• åï²+e'¯Åu3¦=>´tí™×.,qþë”ÏÔ]n»™ˆ„K%Ì]‡öüœ_C ‰»ðöñãÕzò+G0GϾ±dD¿¨_—Ž²Á€ðg†°CO¼ïûÇÔ…ÏÜ-$ÙÃü_Ä/£y]¿°ŠÐ™u1âKÝÜYïþˆ¯íüøä *(.Ì?Ñ÷ûø jòâ¼ô ß6½¿¬ž]žp5z,ïû9Åj%ëÚå¼n ÷öâÉÑ¡1o ·­‹ò[Ýi £¯EjR¢ùàÑçö-€•“"ž—`›žmRßDl<¹Ü³«úžNÎ8œ‚] Ó’k,ìß®ƒŸ´/pÁ©vô*ÒK„½/>9™~æX1 nž:^:)Rï{b|úÓ]‘#ÃWýç×ß’×e »ó^jæöÑwt:·vè¹C'ëi‚óG~邏|ü‘mâÍ¥4|qfðEæ/—gØláÊ™‘p(ºCë+ÔZ¾í`ÿ­… 0.ááĺ]*Dzd·þìqVÑTFßýïÈ¿«F8¹>,’‹ŠÓX®ìŠzL`,*MåÆX±ý· §M ô]}ŠL·¦àTU ›¡ødþɘ|š}›[Ð"Æk§¹®8œ…åâSö½(P¢¡AŸp!ãúyÌ¿4ä™Jy|-!«Z\“Îvv-RFÞÖ_<}¡R(âg.ƒüÉŠéû¦;MØ®üùùºAþëå§ÅbVH•ñšl'×øŠzѳ]ƒYJ”1–²E‘.?œÌ˜q«kâfÑéOm‡0f 1ÆXòÆsÐà™ •"rî òúa~.—_U<:Ê  l%.9sæ†ãŠKó†¯%#¦ë²O3XãŠ5b;EùûvþR —p>«ÿ¦)Æòñþô}w”¢ ‚Ù›o¿Å²÷¶îéäX>üÞ9Q‚ñùÉá»”©ò>ïy˜ÀøÄj¯¨u/ ãškƒGV`,çô`:§”H0± ŸÍpM-aLðk*yõ[°ikù)Ôo]›!aÞ³‰ÓVø.ÚØA$SiM{j*• )€ŽÏî¶`wgú&0#) ÷À.H"¨ªA4ëv–ˆOnd,ÚX7£&¹tù“ÃÊŸ)ã¾¾Ë|UmÜzãfDݼpuwl¥” J%:œR€¾³kŸ_Î2™F§;Û{B‚:ë׿jËp7:ÝyäØH€:+°íìùm†LºÇYêo¡8¸7qäÌm:äY¥c˜y†0éjGßÉñng¶СôÕ³Ï HÇÚªgFf<À 3+­âÒ5 êg€A×ÚXnäK^Õ3¶6Vð82è®¬Õ¡ß ½’_–o;èÃtrqqˆŽî ¸réÀ°ï 0ÆF}Ç>O«‰`ÐmÖd¿‹'ÅV×J•Ž.­LÒÒ²J©ƒsŒmÏÍ'â·@(hM£~˜°møÑÊEì¶Àß~(gòþ=jvB)ãnÖúçžgÚt(ÍIT éom€1˜XZ·~ª[Ë?g*V:8ª³®_å¹üèwcèôÚSœ&”3A­ˆÖ¦ …—{8µÝ$vÇÂÂÂ¢Ò ()*”>8/†ã¶kÓê%sæ/>ttõ-ëî׶ä’U‰(æF: 5¿¤f¤Kà‰¤2{7ï°Ð¡fFÆn½¾}üà§7ÏÌè±0—)z–gâÿðjÇ¿xd×HozÌ'ëÕ¬³(ƒÂ‚ÚžßÿËx·‹ë†±†*-G&í¤£cb€kë‰Z±BQòþ·£Ç?~üØ‘<…Q—Ž¦_6xQ›7)º:M4UÅJëäüèÙµuïŽïYïigÿÝ‘ÇP)SšÚØQU´]{{{{»¡çRŠQY‚;stBÍÍ' 4"´‹ž ¹@JèëÓ´ iN|·˜Am2î' DùY©Èlt?óF@[¹ÚçöÞX À«s¿ ™·Î€Òê­j-ÿ¸í#„øGÌܶùÜ}×®†@ >½:ק¿á¹»›b@¨<>GÞߣ”½ª§W1/&ºÁAE,š¹â×ÓŸ)tz'åâEmßGOð,_êg¡Ûdn¢h0¤~˜[ Lk +d‚ºzS3òõ¦ðË“+(&緮쨇’Ýå)ß-…‚`šÃ5®µ~ío§vOWÆ1K7ÅYU˜{ĥȀñ=ÔL®£‚ÂŽí¾,ÈÍáv™9Ô)M#oeAÃ!Q~­Î6´¾íô)ò!‡÷.&wy˜ ¢4:‹¿Õ£ß´ô`B¡Ûyáú½pž³Ø+¢†tÔI,$qv`…€/00±>ûæCc»ø#‡ Ý]= cŒ'ÀÆ€A·“‰^]‡@FHêRªA !”`›ž=±íxÛ´WŒ…¾öÐsZá@³¿ýfì¾'¦··Q¿¬ƒQëÚÓZþþÝ ¨Ï½á»ó¸v5R.  Ì“{àG °nÅ";ôŸrþ†r÷Ü>Ê¥Ç/mz{¹›Þß¼Bœä¯(ÆÙèÈžÞ‰ûX-S×\ð%EŠ<Ù7Ñ/rw#ÖU×!q½ ByM9:‚5ùZ3fÜrÿšrPyÜĵ6†´<Ñ2-Cki>¾4X•I#TÙRk¨!,{{ÂÑ{¶LåIÁG—'ˆZߟÖò$~iÙ<ˆþìž>RýC BáëÖ£ûExE‹–Zhjˆc¼ÅÕ D﹓ǎõÑÓn7ižM@c8M•àËÙ ”i‚99W¤}¦uЃ ®¨í@Æϛր@\ë±nÓT§xhþP%ñ±Æ ¤ÁŒ¶œªòÑ „ 7[WO_WÛ‡lŽ]{žá`÷¨$Nhè UÝ\ømç§ñ‡,×Lòôø%)|Ãêö½GÐBš „PaN)ÅPÕÜ TTŠF’}¾Ìí:©—}LÚƒ‰-™Ï5µiŸuQ¨5j>Í‚¯<—F­1„?Kœ ž»qùoØæ¾þÎB5©Üoü4ÁÝu:‰rÁ†9˜^ÁcG‡±ÝCöß+DH²zîœr}Ãcs&/ÞŸ]Ú³ÒËÝ=z\ËÉcñ„ª~=ÀÁãæO1îlÖÙ—|ó×ωQvâòëý"ÒA»y¦ËÄïÏ7sÅò…n^Û/$!„ðÏ«g¸º±ƒý=Ý‚c”Ê`$ü´xüp¦oxôˆï È›µÉ>±úu¹úN‚Ê:2xì5R1÷£ý}•}<Þ‹=ùêšo?ß·Õ͇Jì °8ž‹BˆXë×ß-`¾ ”xô{+ÈÉÙ‹#A¨ôÙ™6Ž§ ¤BUc¹˜—Ëêðž ð¹½ÝžÅB‚9ŽCŽ}¬#=ӷ׎Ä£¦ì]³ìP$<]3]uP›{¤øtkl°;Û/Ø“á4yÁn!FèmÜÖ`w§‘ÑãÜÜFÎÙ"@!ˆ °Û¸~ç„YKæMŽðûêÞÑ Sæ-œÍû‘+%•8éèåà¹>eW¶¯=ûT\”“QÖÕÙÆR¹XYÑ]fÞ» ’j¦³}|Çõ¢¿¿wöÜÅËæŒ t žö^†¯š6O`X3wÒ´Ó9øÚ°d?>±Ñ߃5n¬«{öŽ!Îû›6ö^ŸxrÀ¨.÷1ÝÞùMµDc- \øiJØð᮶ƒCÇ®©E(nÍØd ìš7yã4Tù¨cÐí3-[áí1zù¾´SK,[Ä œ±S¡¦YÄ6÷®^ÛÞþK~€oØÞò2cw%’ÿ¿<:Ý-b%4[ýúŒ£«_µŒÀ¸6r¨íõZŒ1¥ì²£ü@Æ‚Érƒ™6WÒ¸˜›fïÀ·ûÙIÒ‘iìá«È=eUòiG·€91Þ¹4ÈkølåÆóÚ—`Œ+ï¯pôšG†æ¾]lï¾Xˆñá¥á 5ßž_cÜXèsA1æ=õ Šˆt÷áHã}ó\Köuq{S!ÂßÙ?5júàécEÎ%ï–Œöq½–R1þpkEÔ–->ßÝÃåÉ®~5Ecݶ@—• cEÑ“¡ ß#{ˆò >~ïù‡„zÞL‚MôemˆM'ƒ´#=>ÍÃ%í³o)kmŒr½6žÀ8f¤gÄÊcdË1¾žÑ;É [‚soåbŒ±,?ÀÑ«P¬À¿9½Éwâ*ežÆ1¬™«öL‰ ó ]¶å`!O†1þtaÃÑ%ƒÌÿY—Ëf2 ù¸è¬ÓŠX%ÒÇÞy£–%ÿν¼n°û$Æ–Fú1~ºú–úe®³{P©D¡ÈþÝ~hÐKù¸<ÚcðÞGåãÄã¼çœÀX±acéÙÍÓ\ú{û=ȹç÷ò{BÆUÁŽ®‰ÆW=2„¾ìv%Æ ƒmFm%‘^*Gt²Hõ0E”¾K}ÿuG°1Ì`¤»`’yêÊïÏl¦Îås8G¯·so÷^© @‚É%@Äþ|·ãð讲Z‡Ãá›;têúüM PFz '“ˆ®þþÜfê\‡Ãápôû¸ôâqî•Êi_‡2I¼µMg9‡#¸ðË“Óg›`ŒûÚ™¿Ójâß3ÆDq8‡Ó# ¢mnJ¼éÙØÙ[|aÁF2J‡9£zi TƌƟÎqåPôøi›ÁÁ#º‰^q¤5/ž‘ã'õQ\{_¯ïdOŸͽù» %1£Wß¡ Mlúàm.¼8ó4fò$Ê“s€üì,S S+ƒè¤ ™dRÜÁʤ¢mÀ•[÷Ž¯ýpßò¨]iXå‚%¹Åµu~^¶€cà _ÌpížÿÊpЀàÎÊx‡GTgÆ(¤Þ,Pt¥PüGy’Ý8u’’:à¾ÍXwî@C@*W(q8ŒMÚÊeò­g®ß¿|eÞ1ó'Ò*·Q^7êhOÁ7³9€HéõÀ5/ŸvŸ2™Üû÷>®KEúÍrÉ'Ní:0è¬ÓMN´äE·NÄ· îGŒ±}AFê¹N™°B @íÒ³MÂ/ÛòK+"Iд‹FöÀiGÎɦ˜w¡›ÓDÉyÕ€ /=Yvb®7dJ´yúå5—Ò«««²캙T®ÀrÕ3†\·Ý²Èî¤ø: l/.)ÈaIƒ1?z„?˜ÔwÆâ6¤v˜ô¶Ó7ºõ®ÕäTYw5ÖU! õ÷&»èÅê!/+P<¸Y`7&Ù«¸DŠÐ#÷-}mtjÉ7€a3$íÙ}`-9ѽèàÊ93ž˜‡lÓG™ÙN¥ˆ §øsofbi\Ç«™#,“ˆ•¶yšål_k Æ=¬dzc¦8€uw+iy¹\UøØõï`ø_é™B:J¼L–õò6E†4JXŸ’U&&À9"¿87vøÄíhØFÝ8< ´ŠŽ™Ù‰¨D¤›ÿ㨦N (YeèBÀ:zAF@|®¥´³ÐS·¸ðx„ñõÅÁ×uÈPž]Þ_‘¸ë™i±*Ñ`ܶ—1T•sñ«×é}˜¿° ³–Þ/ög'duòp¡Bÿ™?ŸL]Ç®|$ô}çv¦ò—åBx‘õ¼¿ç ä7Íë»õi0¾Ó…|«ËÖÖ±fÙePŸ×Áo+UÛ¨Ûƒ}+ŽMÊzp𶠅Ӷü(^pÉ Ñ7%­–ÈõIEeáD†z¦¤LL%òLÒrE£é*c¸4b)ó;BFÚ}+ÛÉ:ÍÝóúƒ—•¢¥vÚzjk€Í˜Ë•k†`«JèPÐikŠßóe€ë›*;­­´·$yCfÖ†¢"€1G"711PòlÖÍRKÄEE\¹¥µ!´*=ýÐ}ËÝ?Œ5QõÀ°Ó¿-7ÄŠC‰¡kmt-¿w7^s%#tµ×Ë‹‡;‡Ð×0d\‰;²pþ’ðÝ2ß™;¦¾Á7Sû¸P¨z L  ÂÍwþÆú@ž_‹:[40­ÓÅ ½àÔÀ§Ì›ƒ§kº¹0¦ÑôTzQ Ÿfg©Kv kbˆ Š¹Šºwç}Ï5¾#m]9$•½‹}™ó®/¼ð›vW“¾©n#óHû«ªG!+ #]ÐPƒÿ[Žpã.F’[_lcÐ4–ÝÆÉìiíý¼2ÇSíw^†F'¶½ÜêBû #¥%ñ¤B¤n:´0§Ôžx=³wK&iò ÝèÿU|ÕèYÅt'J+r_—D|geY]¸ëâ“ê":ËLì&.Z™uÛÙbð`£á)9åéÏÄ36wÄ”»~ŽNyÝEܾŸ@X¯6ïßf”Ä•L¸Ú§n(–* IDAT«¹ ¨4’M]}#Œåj/'­­>µŽ/dØ´âX™Š$Õ „§§cþ5ƒ{q%1d÷>¤Í:Ž•¦C ÈX)äâÈtä¥\ÔÑŒ¦®®m ëËkµ%YáV‰ :[PÍt©uub@†jr*ê®f«Ä —ÊÉéènN»Æ­kÉb‰Åhä’#—Èk«k­Ÿ2uqÛ3[?V£…ƒÚ’»,YUïõsõÒŽŸØÕ‡ldÔÅñðÕ‡d'¦.îȘÄ_{Ó¨=,ð˪úvE<ÜÉ\žŸ}¶aúó7XßÚXVÁ•Ѓ˜[‡t`èf¡cî5õΆ‰ÍæB8ù‡ëÓ&„í]¾xÂ=èkóÿHêËÿˆ©XS|¡ãœ^ìX¯Ü–ñÞ/XôC­\íÛ1b¦ç瓇>6lî~Zµ8!›«ÑIH´SÒŽ ÊÝ<÷Ý‚Ek¹-\ "¦1?ÙS‰ú|gãÀ¡Qµ`Átëóà—Cdɧ{sWí—B ýð6‹'Æ`Ú¥*z¥Eon|qÖpÕûäçoIðAJÈl¯[—NgPݘ† oÖÇHøè·ÄLOÀ@ÑëÚÞ¼lϹäAŽ~:ác^¹v(§³“ù´Ð_¾÷ÄÃNô(54þÁá$ê`3¿zú¤L P‹úyz¬/#0µ #ü3ˆÑ§çsV⛀ô{v°0Ž»ˆ'ºÛ¯¿óÞ΃^ÿöýà R­ä÷®^ëàóçó&yq­b@tOÍOBµaŽ}7^Ì"÷“ìÝò¹­Gp{@ÔÚ¸Ìj P››(´¿•zS+:£ÇÓ'ÉíÇK§‹;Ù‡wÐëmf¡Ÿ˜˜ $?^,¥RL;´ÃEÉäÛšp_FÀ~ÑÌÊÛ×SùIߟÔÛó­–‰tß?ÌÙ¹§´ñžøaÍô!Ó¶*M-¶ýf{²ìÞÏ ïÅ=²ï @Õê™ãcÎäŒJ‘K%¤9£³ÛÄíáÏ—„ØiÛºÚÚžÎ!÷§¼9µsAV‡¬‹›¢Þ»hìüe¬SæzÂÒv‡-ò:~ßðrÙHçß{ªÎýdê0úÌ I¥V™T*'”b$d©ŠãnØ2jð° ¹D* »7/[¼c–ýnš©¼Z·ãÀ]¿üj P˜0åðÜûLòÒ3{±gÑ;C¡B"‘6î$ç­ÝòfÚJÏ°»ÝŒêŠ8”~:h€1 ½MÓBfÿ4öÁñžzbþ´…N‰{ê €> -Ï-Œ™[ÑE·Yõð…2 ´¡sÖNÈ]@7ok]ÆÅ󤵽=uËï^;š°?ËGÂû à3hÚæ韖…0ÚuïËùôÞ°ÿ°£ôvÅIÇ·§Ðî?ðÃ&¯Ù~&xÚÑŒÐ>hû¬±z»-Ø™XÒd‘I¥ šuࣥA¾¿‡/>7×TetX*–4~ÄåR ùbI%RøÄ´Ð?BoÞ^<ð_Xn¾áƒÊ•" SÂ!Í`ˆÆÓ7nøè´wóÅN@5>RÙ‹¶ˆ-q7€ƒZ肶]¥jŸa:BüéïZ3Z³ÔùVÙÛª“S>o`À ¥5 ÀfçoŒÉMSÄÐ×ÅÝ€êXšGú´;Û±¢Ü}Šu=$ùL”–Ilø 7}"ãn¾´óÅÇ –OÚ±fPU³ñ¨EBiS­JÖ ¨Íb¾´†t©Ì±ZXKñ8Íä¡q_Oe¤ ÙSƒœUØ@̓iÔ@íÍR]}ù«™ñNŽéò/,7ßp˜BªOÚ€&Tñ!´¾æH ãà ¨¡L æUXÒ‚wÔ©ÐÆ¢‰Ã…'çÛ8Û:k¨ßjˆÍ¥†¹´÷ƒ´áS¨…–© C´€ò¡¥•êXÔéj Q#ͧ¢%K“ÆŒ4Ç iaºZ4kQƒ/Z´~hÙh®,_V­\«‹J Ïjs¡®½êsÿ5 Ѫ0H]ÎÍ»úðxzpÓÜàNÿå¦âÿŒqטßçAk®ZU—n¯NÒ*‡ÿë¼ÿúëðoé|ëðÖò%]l¾Qo-­¥u¹i-­¥µü·ÊßÛÚâõd!kä¹%~U*üÑ_ž‚?•ÉýTbm?5¨}”ÍåײHñzÐdãþÛþ7/7¡1® ïy»ßàÿ#Ûo„ЮùnÓw¤´ˆŒPîù(û¨sèÿΈ®­c0g<ø¶)À Îy4ë» ¤ëcË<÷¹»^üm#ÆPû`ç®óÉ÷âÜø™+Ï5º]NN£¯})AX5•EwöôJw¾ä âf õfz†º2GÏ]ßp£½¹²ÍÛÍ% l˜“‹ëÔ­Iw¼<½ÖÃÕ9(ze“ÿ ¡gûf¸;Û{ÓìÕG^Ž +[¹º0‚‚íž‹O¦’Î,PˆæáèÌòc»x„Ï’üŸHÿ EãB´<¨{›Q½âyV¨áŸP|áÁ¿@Ñ°èêèèPZ õX‡JÕfÅP÷%·Ô\[+hîZR&ºÍä£éÒÖâÞ ˆðuIá-]´{DAQnVY¥1ùƒŽõË2Ñ‚w¡% V/áq¯Ÿh³JªLG tÐñ@Ö,ýœUZ¡§Œ?ÀŸÏ§µ=î¬Ç‹_³ï¾àrüË&ܬ ±WSF®›0iOÈÞk3êÖExN?3ñÐØnÀK\¸þÆòkOBzè¼(Æ;d7ÃoÛìí9ŽÓ"ýÎ$+Ø@œô¸JÎîä2éÍ¥UNNi•ZÖV„PMÖ­HOº‹«çøÅ;*åJA!÷ÔÖ…,“íÊ ›¸<¥H@^ªG¢KÆÒèNÎîÛÎ$ÈÐ ”o©œ{fÛbW&‹ÍdD/Ü–Ï“¬{3ž¾7wü(_Öð9Ûª ^,åëé2mO†cD¯î_íÎb±™Œ3Ö}¨–"„xw§ôŒ&B!Tûîn”7Ît¿xg΃9½}÷]ÝýclMö oï*!©Þ6;Ò•åìà6,.µ!Tzitÿ‰—÷/a0!„y¹›çŽf¹º¹2Ù‹w^¨Ç°°ìç“.L–‹sÄÔ5jä¡´Ã7'äÅ_6i)åo˜5‚Ére1#goÌHmg†¦‡ Z4~õÌñÁAþ.¾£g× Àð³‹{ƒ<]Ý\Y¾3žäpB¥—~½î\mî)o¯à â={ÀïÓ¿ê¾ïÈŽ&c³–¦5UœšŒä ‹Né€ñ˜y‘9ÇwJ0¼½&wð é¡€Ú%8À9ùÊYlÆ\qõÀÒ®f4•ž=8у½´Ÿ)€ùБgn Žÿù¤Ù°é€ÁÒŽÙ»}|â éÝ+Ùöó™ƽÝGYàÚÔ B²yC­Çý^Šÿ­ïß @4ÿ‚íáæzWïH1ÆÙ·w»ø„ åÆÕ‘C‡\«Ác\z‰iË|TLæ­{æãhóà³sÓìÁ bÉN2o¬sõÍ'þ?ö¾3 ªdi»zò 3Ì3¨€‚œs¬"bŜ֜֜sZsNkŽ˜P׈ŠY0+$g˜ÝÕÕU]OaŒñÇÄ !=%D …WÄuöµÏ¦Û÷š‹1½Ýêî)Ããä }\–Ë1>½rdhܯjj×׎ó4cŒ‰ê+ gs*‰PØÙ{ŒXs¯y cIA§÷†û¹c,|ïçìæ:è$ÆøÄŠ!áj?Þ5Ã1jœ‚cvß°‘k/ªº{¼—Ñ0±ÓþÙq‘£–©¸°0ÞgÄJŒ1I(b"‚'íÃc•0Ô×Ç.r±cŒÅ½Ü–>)Á'nÜwR VÛ¶i^}'aŒeOg¸ºøì¹1&UÒØß¹ÇS0ƪŠ÷>^1;0ÆWÖ„GL»KbŒ¿î±·³Ÿx cŒ116Øveb –•…úú¬¼öc,Ë}äîâáÜï0Æøú®11#v«Ù­áØç‹ cŒ“×±ï5c\~gœ‡»ÿÙ%c¬ªæã5nßcŒ1ÆòåÑž1[R1Æ—¶é¿TMäÔ’ÝÇ.Wÿ½dDÔÂ}Éã‹#Ü£·¤¨LÙ;"hÜÅ&XyÓ†…xÅLQÿørmœcÜ&ŒqáÓM^ÞQÙRŒ1.|~ØËǯ@¬ÂßÚ;.zèuÅÓ+GY•Ô0ÇÆX)|ÛÕÝùa>~•ø[P÷ñÊÚ‡Eo.{†V*ð‘¹#ÌÝSÇýÅÁE~CgÔý{ÿÐ’ˆ¸9uÿ®ïa;óFÎú©ƒ<\"‡Ìù,Tb¬ZÒ3tú‰Çuï$Îì¹ü8ƪm=ŸÎ¬Á=T•Æzx­y”‡1ñìÊ™GbüÏ+€è¿.ˆŹÍgìgïW÷b^\|³D Â„ÈsK÷óã©/ ¼|-Íï=zÔHÂæ3³÷ó@‡¨x³¢Â[ê+;»÷aƬ}­¥y…b€³+O˜_Ú† À{ʱ¤³SP}ãrrĬÕê&†ÎœÊ~þà‰€ÂŒ‰5ÕüAï‚Ôš9˯¥¾V}’S ¯“1` üŽË"¸ ½{å©ï„Åj!í1z„nzÊ…2÷mVnŸ=cÍ3oôó4k0l¤¤ç1Ó竈^2ƒ–|ý¥Z=ÇÊA1¨ÌuŸÔŸÀ ±&Ò¾VH®¹üëfuEÿ_&h¾Ny HJ¶ 2Ä4£¢RÜ;Ì0¦ :®àß™#e´s‡Ù` CkýŠoÙÒŠ/R•ªŸ·`Ì4ñ\æE#1‚À€k J»€8+*` >Ýí¤ù…"HŽº„:êbqñût’œ=Ð3·Ï(ø}C@ÔØíç- ¥Õ¥¥¥-LŠÊJjNx“$4:*~z[ Î#öÜÜÖý»=P«Îùån#Îú¦8µâ°õô½f,—Þʛٕ@j¡úø¹gßÀuGf„EÙ={Ž ZrÒËä2•Â©Ó(èt& ƒD!gÓëC4Xt¥¼¥Ð$e¹Œñ|ãÄžóvÞ¹ÿhª›|à€1r@UJ’ǪW‚lŠT$ öœñuÓ¸¯"@½½°5J©–«(®‘½=Ûrþ†ã¿xÍB3¬É]_ý¹Œž±8Üg±ZÆÕªêäLYt=–6ù.¨x»ÌçⲚI/ª6u(Š&PèµDª¾”32…ù,ª'r?SÖÝ€ ˜¤sukLT*‰€|“mLy5K˜BçréÅrî‡q>gkq\A–?ËËŸPë؃–ŸÊ$%6©#°lõ!”äV°üÍ™µaÙú¦\ѧ"^HÆÓá×ØŒXÜÆÄŠ*ÞÁ>‡jI–å©yà` €1‡©†8@mNÍ”¥R€$1@i¾Tãå$Ÿ+µ½’復ݖ€Hy±B¥Åרamëo‰?|×SWw;–BÁ+¥%$ÖÑ`ÕÔ²ño§¾ ’©iêŠTàÚØ+]+u\¤\Rˆ:0ħö}UU•¬D yI»f®=ÖÖµ«¥_’‘NCzMGl¾T°f‰¯ƒƒžEû.v>Ë–Mb75 ’,Ž ÆžC¡!LR@þ¾€òeCŸ 5¯H$"FFõ`íßìá½b—ùíêÍ=eï. ™¸:böÞ‰aV€Áàdaƒ@99BT 6!SÉêȈe*:£%ˆ ä&¡+,ux㮿Lß»§ûK¥ˆH¨J)ÉÖd€‰ÿâ¹ñKø:ÑxZ‘#¦zPnh2ž[ÅÍO¦CiµçÁ¢¦]uÈ€íbÖæÑèyå›6R–6]i½÷ÁBÛ¼þ¡rñ‡*Ec—MJÆ%¤ÄéÿÀ$]@IÜÜ]ïf •ÊB !È3fuA%ÐÐd*ÊE5f\I•Œ¦¥@ÕdR¥"· ¢a•ÇPJfÜx£Õ¸‘䟲†–=:ʸѯŠgõSQX$UÔF˜WçUüîFT&I] ¬(¯â/9¾j¦‡IêåG÷u ªF-ÙâºøÑòÈ<µòʹâ&5CoÄ‚m#àô—ÉÇö®H¿|½9 ¾>C_ƒð\u{½³¥fåœ=¡âË­ú’ÔSý&î½áÌOõ·0Ô7Ë’µñX¥Ÿè4+& ì,{_×™¬¿ :·Ôw3­4×`>ƒ¦KY!Á>Vôeu33%_ÜÉÆÑ¢F/‹½ @‘ßu7u€1÷Ï „[MÅÍnT¤YÒ†Ã53VQ|äP‚¼˜µWlû×Ç.TÕ*;È*W4!iš´áH-‘¢#‡ÎË[@$Á=£Û¼ü=A •¼9f×%¸ôÝ\tní¹U»Ú>=„! «„B@C—Ê3Õ¥Ùo~ @!«,+©”OÛ ƒâk‘!¼ ^3:n.ÚONÞT;¹D©W?j´i @·22d=½ÿ!@@,Šòq0!T]V\!QÛwÜú=¹†‡ðÃñó~nÂéx{éÝÚqµV*d9q³‰Œ¢pÚ±9òôŒ*¸zí±<êŸçÁlÍvª4«PŠ€(]²¨&ü&‰ŸÚt1pulYå½×5Ò¤2ãÞå'Ù’J)«m5æ±âȇÌzØ*Db@~zÇƯJdåè7qÒ`”õPB‚RR]\&l‰› P¯˜¶É›öרDÕѧªdb…º–îæ¦ö_"UÎèi¿ß™8ÀÓ¤N0´sÔ¬(¼öµ(®î=nÞg* }ŸPù³{Ï„j§¨0éÎLjõ#LilåÚ'ïÖHöåö#¥QtZ× ½ Ïþ*@ˆe=Í*ô÷ð€¼¤õýgžS·2-éŒTÃÂVW$UB±‚üŠ›ÿ¡vƒ1OÞñ[D\`¯»õSïÝ˃â½ ßkkôŨÈОŽOn}‘Û]î?DÞ ™²}Sø ^w:ë¦ÜK¢X Š‹oizƒÕ¨}].uH±7c¥¾Ëº7Á`Ò‚%A½æ„~8ïÙ†ñ(ù¡u÷ùq ÊîÖcÂáÔ¨ À)¼ßÆÎXAwà\¼WHÁ˜h¹_w YŽ>Ú<ˆ©×~²sZß'o×¼×oãŸÞ!0ÀøyKƒ{Ïí•ÇA»òέ§½§4À˜ºiî€ð©Ã\tÒ,óµÔèd?_Åæþ]ßõ»prd»¹‹fõ›žâánÉž: \9°%®I5wÕÉèi]Ó},Yî?0 ž1¸ñ¨P™º#]Œ— ïu¿[@Þ“¤^£;%ŸüS‹¦ ÚŒ°åLëÔÝ7ý᣾㻼º`¨oÿ5aüø÷óÖïüS‡¢axtaHì˜î ®A†D9÷\ôˆ±Þ;:¢8ØóÎÕ«3çM˜sà×û–Oi¥¥³ùäÆêo‡Y|éÛÅ#HJî@^–Q¨jca@BZXP"S‘4×ÐP—¦>&ce~n¾‚D€é¦m©pUan…¼¡ú€Y|=ˆ+JʪĈÆÖ72`¢t„ ²´H(–Ó˜†ºÀp~N®²ÁêÀ$2ncNG€°ª¨ @ª Y\¡.¿߃,/*ª’*™š†zZP ý@H+ J„PøÚú.S=hïÎlØÁ¾#Z«Õþ.¥×ç,9óâoÔ`’P,:vÏ­/êÇø;”òçÕ”¢ÙãF{Vˆ1ÆXök„Çø„ôÖ¯ÿo+ûgÆ%‹þ‰o ÑlæÖìßë¶gQÒŽ‘K~—pÍhÕ¹L L*üÛH*ø«Ý¦ž#$Îêbçø4_üÿq ²’NæËÿÿß@©L=ÿ*»#Œåî’² ôÓóáì<'—7pëéòÿNÜ|Ôìe7®½sïõ™%î¨9ˆ£Ÿ!Òìù7·ÙàæŒþÔo©ÅŽÉær˜Ôﻪ6§7¤Ü„yc¶ð3Ok âŸëâ÷o³ƒ†[Ô1ëV…q/5kx QóÃû‘ºrióÖ×ùÕj<ú=¨ÈYcÜÚÆäÑ•› HÊ÷ÃѸF -n¿ c¸¼uûËÜ*Pg_>2"ÜÌ©ß7µÙ>cŒ{¯x‘²?µj7ÿwâ¡ÒT{‚ôÄ0/û½÷„¡’WEz¸{›³½BÒ>A‘¹\í-=ÜB§%c„ä/¦îááéÕ}ð´ô B•<·÷-L¿æe¿?Yˆ*~y^MdøÜ¢ìx´z¬×¯‡?ŸZ1Î×Ç»kÏÑ/‹TH4ôáj|`w/ÿIkŽ+H¬ÎQðñ澞Á>ž~S7$(Ôõ•™a.?)‰×`ì IDATBï÷ôtŒ¿T@Q™îæáý±D†>ì4¾èí!oO÷×ÅßwU<ÕÓaû'¹¼~ÏP§ÐÞë„¡´„NîžÞ¾}« €Doí\üUªÊçøu^ùð‘·ShŽ yñOÏóK„T¿E:Ì{T^~€ Ùá“|<ý‚£÷ßúŒÕ½É<ÛÁwHuу~¡~n>!ûï¤K _íèá¸ófZMV 6ÿìëé¹ùâ!„Ðṃ7¾\2$ÌmlB¨,ý^¿PoO¯óN®è9pAʘP׋Bi‡{{OK~~n}¨¿—_`ôé×BuO ß\íìéåqòeÙ–ᓶ¥^ë¶;C±gZ¿žóv —¯íæî9`ê&‰BëÆ{MÛ÷rvß@ïiwBDå·åãû{yy‡ÄŒxôµ¢&‘„ªbãŒ!>ž¾þ‘νR·yCo§?d´I]½GœzDé‹Æôñôòòí½÷VRgü©Ÿ{)v!eŸ¦Œðp÷±pQ›¡"õüæ¨@//¯€9»n(B]ç¾3]¶æ€èÙ[@VÂ6ãÁ5B_níîèíæ¶1áYMjeÑ‚aÝÝÜ}&¬=#J]Ô9l-F(qUHØÔ»­ÚÍ¿Ärñ³EøÚÙÕ»{ܺœ’R±{²×Û3ðUV‘PXy}çL¿˜J’TH¿Ä:ØM—VK”Xü(ÔÁar–P(ü–rÔ×Ã÷yÆÂWN®Þ=¯Ï))+pÖ£=ÞžA¯¿ …•×¶Ïðë5JE’ã Ó#¼#†¼/ŠE¢Û«Gy Z†1Væ&øØûÝùXT^QrtzpÀà=JŒïìë5$§¤¼¢¢|÷侓6`Œ±ª|×Æui%ª(²Û9ûv°¨¤Dù=ÆOwÆt÷cŒÉ/=}ýãÄJc|xIÏøÙG=¼ý2*ãGÇ8"!cŒË’ÜbË IDûO"Œqö“!ññýö¤`Œ±è£—[p†HY KQ==ÜàºÄr¡°¢àý0‡™×Š0Æ8ÿ’£[üšÛ•"qéÃMNn>ƒ'ïV‹$y×|;ù=cLÊdžõZp¤¼RXQ”þ‹ŸóøSŸ1ƧVw÷ ‹¿›^P*”âò¾vn[æTT”ßÜ8ÁËÏ}Èò'˜PĆ»Ÿ|Xˆ1þz>ÞÛ?8áÉW±X’ñø”‡oh‘D… ¯yuvß—RXQ^vyi¼—Û”í¯•ÕŃývß|#‘È°ø›§§wP·) Ê…eY³ºÚÇlz‡1Þ<+Ü/bÔ“ì’ÒJ&?Å:;.<ÿ¡¼¢¢4ý0'§ŸH¬’ ö¿ëJaEyþ‡ÏÍ©EcUÙ«`Gß;y ¬úµ›ÝÜÓÊË+ÊJrâB×\Èl~"|åäâ6zOI•X&-]Ñ9þ@ÆøÌòqAý§–WT”•¬ÞsÑ1Œ±¢º$.Äoç¯$Æ’éþ^×¾–cŒ_œ_æ40« ¤¢<J¬Û/ë’0!0j}Be¥0ãEbHD ¾#quXäô»dë¡ÿ; „0F£ÖN2ÕÕæ0ðù5[¬§ž±·Ðçó5CÇÎäe|¼_NÐY< ›Ëⲩw¯Pt[:ÜÇ‚Ïç›;ò6ãܸû Â$eÔºI¦ºÚ:™°vK‡igìÌõù|Íðñ3y_?ܪOòD§ÈŽúšlŽFPO§²¯ß¤‰K6ò†¬ ì /èö[~táð.Pž?q.bîS]-@kô¦9U7®¾#SµÆLa£Km¹/¥œ6~íP}]fã8ÚÄKc?½¥į̀ø*Q/“2#&öÐPÜÍ­€7·“úO›˜v8A™üB§ƒµ…©Ï{òå+¤]<ÛsæÌ‚3—¥Ÿ?"¡ › PezÊ e׌(->_`ØqýŽ¡É«VK!%©=gV¦[Ç+B·R6sŒ¦†Û8¤£vá»o +ÿr» bÝœ8-M¾@ßrëá ÏÖ¯«@€´ôlü- µù¬×’6î½L|Aש<˜âïûOÐ\#ÜÛ±Ùì¶ ¥¼H¢zqæ:vál hu[°£3C4—†€Åá²ÙêØH4vã↾¶Å°a6ù_¨ƒÍÚ;»›éhk2ßîÝ•Ó9fIO[-@Ç2lptçë•ùÛ™«ÛÇ„iò¸\}ëÑŽä͇9@ÕÐ@.ªŠJ%NÓÒhëšî¿øhZ7ó†­@èsV Óå±™,®ÑVÙRį' ž¿Ñ@K ÐÖy`Nþéã_è. “Ãe³™DEîc‚áh( /ï9î8u»…¡._Ëhîº}ýƒ YvFQå踞š<ͶŽ‘cL1Ñz~úW–¿ @Á°æª#ÖÊ^|£åÓç´ú®6Y’Û_¥A:u¯’?)•òÝ}ûV£D—åVèåäÕ¨Œöj"å/³é¹‡G÷9UC¤ Kn•ºpl-‹šØ: aòágÒ6VW=ûh,ÃÀC€Ìl!çãºþ©4µ¬³üú'£Ãí/(VLxð*µ½ãdJÜÀŽÝî¦Í‰2;y­\f“DÜy_½XòþŽN—ÁôÚøIaE.•TíÝG­°“ŠjEµ¬J`rõkÖ‘lsmõ…*•$rÑ7@´iq}h@˜¨Ä¥ L0ŒÔ·g¾WéjéB ˆ*£ƒ½né÷J­® £&&0úR(66°ª­Å1·”6·å´åÑÔƒFg3V` U†ÕÄÞdŠ(9ïúö飶]‰J ÉvàãÍC¿n<+05Õ`R%4°mbfNY8ká†a]ÖñºuïåkoÞô&…n¬ù^4‘ €ì2©Æ©ù}iê‡J%™R– à 3"A¤6½Ë¡u¨Ièµí¢×¥÷ä -m~ ̈k¼¯‘¼É}Ÿò©¸š˜Â6õõhOiÿVqP»^hl ²îìœMž×P— V±  qoì3xÓ„Hèú³³Ûÿ‰ S͙˄9Qc:¬™‰ ªR9|ï™þºM­ˆÍP`Ü0Å`‹³…§ïÏFoJªSß¼ñ\ÕÉ”tá½ìÂç®,“㪻ŸFu)·éÄ¥rÝ9²oå’wOÒö»aAÔhÚÒµ%F´L ©OCw˪/Ý\×&N¡ N=Ck®Ëø£@e`cß¹3ºÛ C4*"Èú@TUƒ|Ò-:©”õR€T?ö,74¤Ö±f3®[ÏÓ«Æ7¬!+{óëæS«ÏÝ÷4aÀ1ž›¿£jÛuè™®CqÕ·cû¶-Ý-jÁå™Ý,þ̻͹rú‘3]¹Ÿ5eï/é4ê$€Î¦b94š?*BDF£Éšl?ÏÏŸ8ø"“˜Ê ôj7ÿwŽp~¨7'i_R­‹@ö$ùuc3?5:H'õâ£:/ëG©¢¦Óž⏻ïní;Ò§M‰4PFºûòž~¬Þ~Eù÷»úG‚‰C'úƒ3ïký5•©/¿ªSåÖUdñ˜ )'0QE!ú‰cŒ˜#ãÛ$fŠj|>²Ü/EMÏJÖÆÚÅ…Å€0ÈI~"ü‰>“Í5s2 kk¥¿zW]ÿÁO^[ñw3ùš’FÔ~Ì÷oJå ”*¾¹cyÁoMP@€¼ðÒÕ'€4-⦭èòáåý;ÚÀÒ²-åɵÌZne¯?ä6Ãâß/«&„©ñ½t¼XN>Æ¡gÇVE˜Ãà´a3« åcž#Y”ÆÓ#fþ†K çÏü>‰Þê¨ú÷k7u%|ÖæuáãFÑûùÛ꾸yîaI‡{W6°|ëvcwº]ÐÓ¯KNêSI¥Çï\èÒØœ1kÓ†ˆñ£hýluRož{Tjs7q=«ùó 8ÎØc;pÒﶬ;W»ŒÙg0fúŒð#§” r1¥Ý¿|"ߨ_â¶ñH•ßkäÐM‰íè¾Ã©–l?iÐ…WxäÈuÊ`­ðíyƒ6B¯++z€Y±y=1¼ó€%°bVÜy£\»¶=`Œ(,#„ÛGÚúö»·Ó0t4³¦¥È§c§­§ÎFm¸ €Lzôz±„cÆ(Ú7v󭞶v«cL‡ ˆëÕ3Š'κxáJàÒó3þ3ÞxÎÙ} ¢DÕ†Åë‚‚Þì˜rü²Oˆ»½¢8íÄÍ—#w­ ŽŽìq©ó‚ÓSغ6NkñV¨lg'.K/¦o¤¼¢°ŠàMZ9/ÿö>±aL˜«Ap„3)‘pôÛÚY›b:9:ðjï(±umœ:€i;ûöæ|„1Å7f ¥†ª¨¬JäӬåË\è:o`¸seI±iš¾ÀÉ#TUÑ´ÍmML»†vRˆ¥:mgL!À’ò*1•o>jîê0[>¨är­öööµ ­6š†lôùíÜû‡;TçKTtï^~€1FˆáLJ¤ ¾¯Wdg[3Œfëuã).+#¹&Ã~]Ú­³6FÏ^CÌY¢â ©sÏ Ý9ö½°ßÏ tÌíºX ZÌÿ#üPéGfJþÛwC”±eýö<µÏWüÐqùýŸÀ;¨LûmÝîâ÷oñPïNÛžKÿ»?7I(Ïîßœô¾XýﱑþÑ“[WÁ¿®ÐZnCÉK·Œ[gù÷ŽÖhËùv¡_ÀIg×/ž#«Û|5þ¼–¦ ùyBlÀIW‡—ÏSXÎã~qaýwqD¡ÚiÇvkïêK+~Q‚¬uÿ'c ÿ˼5"ü¿QnÂ*aE…\ER¨ –€NùsÓÆX),*’Bcji hè¿•B½¯ˆ+ËERPh\¾–“Ú ÅÑ*nZKki-ûòWSò²K7S‚ÂC¸´FÞÂÔä+#G+þª*‹SndE¹™ü[;W•pÿ[÷(úÿ~$7nÞ´ó10Ôö®{·®Z»…›ð› (óþlÓþíþ* ¢4õZº^7s¨Êûü*-£Rª¤3¹mlílÌtÔVdµ–Ÿñ>åKv± Súf..˜uÚ?Æ€Ðý;ˆ9m"<ê}UùŸ_¤¦—EvըݸIEõõ›÷¼C»iÒd…O“ò,"œ  ";íõ§,‘œ ³x–¬Œø Yyóìk^))ÚFm\mh XcLÞ¾uC©máÒ¦Žuæë'o󤡑¬ZÖ*Qéõä”àÐ0µ‚(¾~õ™ªa> Lè·÷wmÏ}výf‰Š¨Û ¹¶¾–-Ì:¢èúµç*¤Ä8»¹hÒÔmÞN¼nåÛÂO©¹ ¥½yñ2·¤ #Š–¡…³SGfóŽâþ•D}÷h]xòÇ2‚¬A)¦PtM:¸Ù[€Í$IoKiuÚ •nbmgoeøSXhÊ‚§‰ï4bB:ÿ“Ä8{ñŠõöAÁMÄÍKiž,n’WÍ|u êßܹ²çó–Ÿýÿ!n€;|€gåk$``@XUºjáÆmIݾ?å ?œßw3è n®™}7`k7€7ç—ů¹Ó¾³]Gs­ü¯ïÓÒ¾/9³(€¬ha|ôR-C}=(-ÎϯÐ:uý¤•€€ÈÞ­\²F(Óiÿôl»Ú%ó!9aåþ[ûßi^˜å¦^G*Iéš•Ë÷ûÕˆ›;Kg<‹;¼ú¤}¯lºØۘ𲿼KKËéµñòt €%ÙÓĦHô ôô4(Ê’âÜ2y›sךp¨jÖŠòç+Wl¬–êwyv̤–õ³Äc¿%>9“uàðø.€!P”g®X½Ö=(ŒÕR„‰*}íâezNÎZ´Z½›»Ä:»Z1÷­]]ÕÆÖDÀV SM§Å2}Í¢¥æÞ~Út’‹s2Ó?Uš\¹{¸ ª¶.Ÿÿ{”…&BIr“cûMQ LõôôŠÊÒÒâ<²Íé ­5¾—Ò½Ëçym‹²Ñ…ãkÖ|2¶¶3Ô$1– 33¾r½§œ]1 e«pûÂÅJw?+Œ+Jr3Ó³ºŒ?°ep—Ú*µ˜¢ÍQ:1o“ù¸ù+ž©²Ž]³ÄªzÃ>I’$Y÷w3–’ĘÄʲXoŸ—ù’úäÍ h×ÿE6ó >×sSŽ“¸eî$‰qæi¢¦íÁ?ø¡1ýfª~(z¿ÅyÀ‘æºKþ˜n¦$Æ$VUöóõ~œUqfŽN»¾ÔröÓ^aÅRŒ1Þ=Æ»kÔT‰’¨¥¢85ÉßÙg²°öåÔeQak®ç;mZ]«oîÝo–§·ß«¢šO ¯Èð÷rO¯Â“XQÐÝÃïs…ã´0çc9õm{{e£Wpoulêª!žÝ.VDoÿ(OàÙu™®ïÍì±ýÍôž«ÏgÖ±>¹lL\üTWïÐL±Jý£øÛ3O¿ÀYËñ²‡¾¶«¾‡s¯îèséMѾ_]‘>ðíèñ¸ž11Òî×}0ÆF»wJø¨À²â¨ Ï9‡6¬ºeJ¯ðá šQŽó°Ù‘"ÃX61ÀoúÅ· <šï»9w<"Å-v+/¦“ÓÖÏÊúÅôù²—ç§2U׿›‘ãê¤É¶‘ë›™6ßO®®Ç¿Uˆ&BøÁºø¨žýz…ùû„ x,B¡YƒÝæú„ªNßeО…ãã–¬^=®·odÌ,! HR”YzmôØèÞþ^®ýú÷õò \z8Jß8ºy¿/“©Õ^qaª§»Ëg!Üܳ Èß7~ä¨^]=B¢Æd#ØÓiò5N‚rvp§ î“ Œ¡[ÛgFÚ€^2.Î;8jܘxW¿ ÛŸÖ\R§Ãùù±ÑýEùºûGŽL#š`˜ ª'Û#ýÜ"cûuõq‹»V !´sJOOWŸQ#‡„õ]:kRȤ-/BèãzëƒPM6yÇ™¨Ñ~ HäÕÔð8/¿ åÇ"„2Oö·ë{\mpqQ/G×á#‡…GOÞµ¹oĤ¡ÃK&ú 5*:Э[ì´a@²òœ<•¶•±:¤ª¤HY·˜¹ {üð=À·sÛÐçÛÈ®Õ.1ÐûnLüãò Mu„’¼tîuáÔžºû†<½¹O}H]ZívÅ·;f³šŽ@õ·Oe,cc(ÊJÉ:Ö#¦>¼u†CCøÓ¾ã)ó÷-¢"TBºýzbÂvMpTÆ‚$b^Ÿö<]®];Õ RØ›bùCGîTÂÿ@&„˜Ôdk4Ü)æ$‚(4P±µMåý± Hb;c°WC\¤ ëN]Ý¿ÿ´QczG Svî§ìŸôha |* Å}¾ƒOÿ“ÓÂ#ºE>Ï–ãÒ·º‡ùu8vdÿ¿à5g^««ÐYä¢a}ââ‚œ»õ[P‰ʹµ!ÒßmÐȱÑÁÝGÌS „¯a3û?uý/:•âDþ˜+|àìüðÙ#w%K¥ÒÕ™é,ëíþà?žø#À㻦|¬ ±ÕÌ}ŸÀtŧùåì”ퟎ<|Þ™ sÙ­ÛŠØ¸ëƒ U[îäîîc…2ol¥XŒj/®>pvøé´8s€3»×~x) yúàU2h ¥ü~ ßΠü£ˆ ù4Ê«WÉ»]͹0-1Óðöí£šdé‹€îc_ôºç@­üüÄöèÅå6°v”ßÒ9çO®‹©ŸÀòÒÓŽÜ’çªDaOŸè„/czîÛö”síùsÑ›ƒñÅn¶t Óéê4  *Ý‘ŠW/1|µî×6]ïïœ Pø`áá\Qht䟮,¼&üýÁs roGÎÔ c (9wåÞ²ëoüµvoXù-§J¿­fч³»Qºth³p^ÔÐ1®9}Ü:9ºx8u0Q¯™¬GïÁ¼cêl¨\ÝÚETüéj5iäÖ–¯Õ&VcÕ¨?* ¼6‘I¨ìFí²<°ëF¯É¡BÔÒß\ÒtÅ¡€í¬É;êÖÛÙ¾“³«‡¥¡Ú ôñÖ+°öpgC  :O§ö˜šž’ˆyíì´™¬‘ƒ‘ËŒûâ_}9êW©RyMØÉ÷8‘;ÄÅèçD °›:îI( Œ®í[¼áEJÖp [0{"ŸÒ¢‰B'^I,d©H•,ýÉÅR›_÷2jrTI¹ð’å³Z[½‘ª;…Ðhõräg1æó D]Ú™ÀOWQ‰3I•RG“*³*ó¥ß©kÛÀÁ³dmûßß2 J’wýº|xß³lÆ×ß[bǨˆé~öΰ‘]Êûϸ07á~T;lí;hå“3s=F-»8ð?4ºë¯5 #ÖÌáê Ã5z .¾&i4KL7ÌÓ` T:£Z,€äƒ7ºF®?×r±ëÌŒ›vöúz' ŒXÐ=eÛ^1€pçηý–Ä°ÛYêœ^µþõ‡/eU²>cfE8 L»ÄY§«”ðõz²I—±íDÊT…OSXzhßõȲwLuvVVVV®XÖƼ^TT£™ƒlÔ öð.ËKj0ATš&B¿Nú¦^xü´{þýä¯f^Îjø®Ý0?+jã]‰rÓËúf|†©­eUêÝÃ7Ÿeäª }–ÎêßÐñ9-]`fì @5 æ¥V&úœƒö¾ÿ”Q!VŽ™>×µ­&ÜßwµÛ/Áê¹è2hå«[Gm4*^?3sD´½{ÔÙ§ß@$S2ØôÚÅþý Å—×n1_£E wœÒG°eqbã–³÷®ì·oá’oC/¿Û}\ :M]ÐØÍ)Wv›SKî'Ÿáì{åU!TJT,³eá@^Úz ÃЕ,*ËuX}×Ú$„0§ë^¹nʢŸSX\r´»«[mqîÒe÷kÆÐÁÆ–oráFÒ­“ë•/ÎGN8ñ, •òæþ[·n%Ý}ð¹S‰Š‚yã·‰rpu5jåYÕwG{'GîßPÓTMÄ_巴ש)©©©î^]n;f¸‡F?8@чÔÔ””ÔÔÔ{×N Šg0¯ƒ. Tݱ=Û`€Šûw¿y°žo´uå× ß¤lßv<ÌwÕÒ}˜žõíU*ë٢¬¬¬¬¬œŽÁ‘ew(H`ë··0üû›Š€BÓ¢©ÁG€Éàa,"š 14(5ëA=òdg$Ø0 T,×`ðkŸ×ÔàÙÿbˆ»¦d)\%Ÿ°-ÖÛ0ãùÇnœ\;oÚÄ1 ™DÏ9îð– <#+.+¬ÆI)omB§»SSg\ÍŽðºžnÕÕÉ÷VSò/Œ?Yóµ)l6G¨ ÀL®¶ÚßÀesäªìFFIE‰¹tj£ö”Šš¬ú½•£Ç•6îâ··ç™ã¸4àŒ»y¼ãœ¹ K«+ÑŒ]Gû»›Õ»¨$b&­Þ©ÕVJ}Gâ»Κ8î¸B&m2eï’þ,Ù—ƒŸ'lÙ5ØT»)‹6¨§{ꉓ§²»xÇØX .ÎpQ½;¨6ò‘¹÷·}d´!ÆÝÇB‚DU[+‘FýŽÂö˜6Ü+zÑü£f{×:L^œÊisÍÕ±f™¹Î\æ¦&zgçôùS3\¾onIDATâ]ÿ¸faίºR(`ÔŠºÚÔ‘_.üžÅ¶¼:+î‰I«è¥x—ZèùA‹» _ùÛÕ}õÿÜ*¢ìxùÔµ©|Óݱk¯zÝÓtlÖïY6ûƒh@'n gŒ[³Åƒ[£þÜÙ4mÔ´÷¬mð ÕÆ’Søú3€Šæ‰§/)žn 1{Ž¨¼=7;2Ñϸwq×{ …®á:qÿ®(ûîRÏî+æP0£;dÓµnfêaÄt&¯fUT—I˜Z€ @ºò¼ X`V+Á€Gy*QHdb²ºtô¨‘µâ ±5ôÉÿìk-QÜ`•P‰0$“UP6íOÔ#Jñ³§3+`*ЦUªW?®5ÇSèü`½›©iPqÙ´C, Ôà#œþ³~ë?ƒÊ¤ G÷Z´¹í†É‘ÃÛ©’òŠ>¼*ºJS§¼oÞºägùúô vÐ%+ãöîÓØ”õäb!0T)±éÒ¤2XT%UbÔIGÐá2«Êê3™‹Šª¡Kc/Ûï·bW®Pû´­üwŸöW*dUo‡ çü6±nq9¹Jµ®âÒ/ÅPÃ\0féžÑ¤J\]>¶_Ÿí—;Ž0ø@¶Õ£gÜNÉèÙUm9À;÷Ûî~«·o3í÷Å—Ë×w×®‘7ø}ìø»,{ó¼™×Þ­sÔó†*'„ W@áÝHK2`¢©gˆ&ª¸rþ‘Çð)-m5kž¶íŒQÇ~Ý¥jÂZ+pþXçM³RÿË!yùWoÿ£O bûÌeÒŽ#;pdŽeqëj+vœ¹kÚÖ”ÝxarÚõéÙ‘5eĈ;ŸÊkv—ü·Ëg­Uh tÑkº¤£MG͘`¾—kfµirø¾Š¦x—Ç»6¨7“O 'rL:ö3`KîžY€ÊžWùÛX;»Ò²¾íK©AùcËÄ©ÛS0 êœOOßfüíµ¬RŠU´1Ú×b{m“U( \÷‰Er™«a™™XR?½%R ¢UÝ9›qÎU 1 &ûVœﲓ­U%gŒÛ¸É‰€á<Å*Ý)Q3x…`Ðpya”G×TY]Ämã½rl4à9 “üe¿KÓ%>öUo½‹&ÆØ pɘGÓûøûêék—VxÆNï`ÀÆeÕ,Ë>²]½ûVæf°l»ï›ï€ï\± ÅF¸Y!†ÖɃ³FÏíµ‰R‘gô”A6ªíôYCb»¸µíØVêgˆ·n5`,‘Heß½K·` ±{ßš¾Ôûì:}>­@ˆû¬Xf©’JdJ`Út[›8ÆÉɬ³5ËÐû—!mOäbÐ sMìí㥩k «,6躠‡íJßGQ'÷×DÓ[õ¸t@¼tÓ¢.+‹|Ž¨Zܦ³×ìýWÍyTŒ±ËÀÛ)¶íŸ½ý×ñM;DÆ.š7&°ð겫2»WáZu÷60@»žó)¿Å<ÉšN*åR™²nÊ»ôŸêt 衘¤Ñ÷ßu¿j¯®Ãî2ôÔf¼zçôÎóË´ùìªj™µƒÏ’ý´Œqð/[×sWïÞ;}¸u»*è=]´ì§Ò_T ™L^Ï:ä—Ù'Ά¿‘r~èõ!$bñw ž˜©mûûœþ çEo‘0Ldíuqë°–#‚R=ÊÓFÀD•;x­[¿c@K%bYƒ 8ý÷Ûú¿-þm\äøb9 É9V‘ç×ã5—TW&) À2©«ˆ¿t.Š%J²ùu%Kq­0cûé³|CºpUXoÉÚ,€ Qµ°ÝðªSú¬’¥§[‡Mîéi `|æЄIó#ÏÒ PU1Ç:hÓnðæ÷U£_™¾?»ü?PÜü|C3JZƒ|¯¤ú“6z»áTDMUä&ˆš¿¾›Cã:WL-ßÚ© f×LÚf”Û†Õ4›¼…1VÉ•ˆU‹±°xˆ»,ôÌê8óï‰ÿ€)Æ)“,V͉ÿÔlÿSÜmçæwAßm¨±¦ùn1{ùw£×Â÷ª«ú]³ëßüžuCê?fÝ>ñ'X7«ô7èÂwÏ:ÑpKÙ·1Æà;ÍŽ÷úúƒ‘ü‘ªÕR•&v8üÝŒl0×[\ ;ˆ˜=iéê-KÿÖ‡)Ôœ†[o¾¯‘þ?ÔÌÁAÍé¥j“dc¾h æ«4ÛàF4›¼… òþNþg3IP~>öG =¼‡y³ÄÀ!’÷¡Û_TÞÝž(ï3¢ jÞ¶Ðxšmw‹ûw£×Â÷jÜñæ¿ì©ÿ˜5üÖ5 £Š¸Ù¶|×nÜâÁ ¡æžÖ$BMZ‰ ÅÒl_[Iü§·š3é?#[šÉÍ3„J¯-UÚ„ýg¦ZC4›)™OfÎ]—+&iË9+×F9™þÏè”~¾7cÚ‚´9…m8vÁêø`[h 7®-óÇ„Þû mº(©ì3W¯q~öŒ?wthrÚ÷D8g¯]5dSÿÝ]*IvŠøUã;¾2Ë‘ÏÅÿ›ÚP¯-ÿ'N´VqÓ²âû':û¿‹Îå7ÜùKΕÿ/Dþ•óæÏŽöÿÀÒ*nZKki-ÿ¦ò¿EóÃ*I•ñy<Œ@U"‰Û Ÿ4Æ`©D¢$HD¡q4ê`g`B"‘¨L¥35ØÌZóÈ¥¹’@‡Ã¡" µxr‰HA"®†FCÛ´L"Q¨ ®Áa×™I•B"•‘1XƒZ³É*‰Dª"1Áä°˜ÿâ×·™@\®F9“J‰DF˜JgrØ̆ÁÀ“¢j[ƒG£´"r·–Ví¦¶HïMk?_#'yY£_…ïÃ'œºqÝJ“ÑPÑÜõkÜáû™z&¹Eœö±×Oc`Œ€\>¤÷¥ÏÂ6æ¼Ì¡ÏÔƒ¿õ³€w—Vý²î²–±EYÞ7=—Þ ›¦©‰<=<Ú®ÛÇk—vÐj—gNÓ75)È.j9ï÷EÝ1`$ý00|tÁ7Tå ©ó\jÏ ×/æEž¬ë[‘4fåéÙþºÿj ûù±…S¶ßdkÙ]»¼›NŒIóDN¯$Í (¹¥².=—훤¾I €É[‹¢wrÆ›Ù:G[ËÕ1úgq¤›Oh½ Ù~çâø¥R^#O’UI‹¬û}VÈóûÛoû#c\þ|³÷ÈÆ‹³î{zx§•È±ð‘½ßõl™šÜŒn³ÎæaL¦mŽ‹ž°õÆ© AÝÇ)kA+Ê?Ýv÷ìú±œÀ˾%œ° š 1Æ{æÆö›ºOÍÿåÞI.}aŒ?îà¹@ØPüö¢—[ÀW!Ñ°Íâc4×ÉFhd3ï× |Üßcüæ›g7FQÔâ7Ü\ÕÍ£×*5òxñÓãŽÞá… ²~´0ÆXâ~àa &[sU·–ZŽpŒHO¯›åçëäµ#áBHzwŠ‘×<@++VOîïæЭ{ÌÆÓ©uÒçÖYyD(¢¶tôèzkÆÀ0Ò5àW•–à?6Ÿ³9Í ˜cîâÀB×?dÜH"lC͘€@3¼gè‡ û@§ë‚„­ ¸õg@ðöÖ.-ÏÙ´(À4÷Ù»u)—‚¤Ïï½÷Zíæ0|„æëÛO•pýJ¦ÃÈx>`¬gdÌV¥d"DÌuÕï¶5£‰CWõdžyøÒ «»„—ÉI$Î\=9ÎË/($À§ß„%™•„ðåY+§À2VŸóD_ïutpÍ· ±î1]MM'xÞùí“ ¹Î­]z.Þµe*KÝŒí±LY®Ä€Äý;êüz©ÆÀžÞËëÐÁ}­‡©Öò_S~ZÜ TúòƆ럒’ï߸yçáéùWŽî«@4¶ÚpóîääÄ÷†ÜM¼|ÞI~Ÿ^LeîÝkçšETŽ±µ[GÓCKå«ô/7GIòWŠ['íÑ&èIfõׂr-£q`f`V!É@z›Iœú))­m€ùêɃ<]ü£G?ʬ€¬Œ2­Ní(êûà@±l¯]ò4 ´yHXT©>ƒBt„Þ (ƒ7YÔà‰ˆ¥ñù:…W?tXüôî:Lê’qÞj…?ºçæÝ}5Þ™·_à¨ÞûZ¤6±¼}xÒتŸ)—j7uç¼áêNéÚZS¾ó’Ø8Û›0Õ£ñþî]Ž‘™5°fl;6̃ €`‡!ÑŠ‡wÞ·šò[Ë?NÜЙ,R&ºö¡°®Ç•„= âqâÑ7§ÍeÏ£µ·Ð¹†–!þ”VS•(/*z¢ÿ¢ÃÁ¦ H³þªEÀI•\¦”1¨õYGX :¡"ZXwªR õ݆‰Vüþøù«í짌ˆ/#0(«$ƒ[æÇà0°HHöœÝ§pߤG¹2„ЇËës”¤D¡@¶¾a®M"À’AÛ1–÷âcV¿áqjµ0vÙt¸}& x“§Ù_ZuL >³ûað‚É4]kÇ®î~Fˆ—?Ù7xѵEÒ º…Ûè3j¸sÜ\´³¯§µÎÒÖòO7ó;…Ý<õø”PW/ÿè^ƒO<Îoh2Î(£YqÔË„ÉÕ€f#á*ÿp92ªOôÒCs¢l1Æ4WJê¢ùÈ2pùL6¥ ê¯oIe Þ¡‚¦AQj‡¯µàÒ0Æ{Ž´åH“]“I‘WËê^“‰d®&…ÛyÊö…}çÅz»û'Ê‚¼ØTMöúÍ3¨A‘Pɨš«úzxzzzzzzøM*Wå},‚6SiDz+±âíåÛL»iöôŸI§­¶ÐßÝ:)`êµíW.…ê6› ›m¨C-ζNÓÖòßQ~ÖŽ çnÇot“–ç?O:3}â`û‡·kèZ¢LD¨_UJe@i&à¥ðÙÉSvNÝžíX‡AÏ ì€O¾-7CÀ@þ ûXòÛ³õ Ô1þV˜¡­aÝRÛ, ®WK¡ÆeÌäÓ ‰‚hg¥/|—Nø;P0Ó* FµäØcRRIDeäÕtÝ^ «µÐ´¨rñêûoýy[vaAÒ—bý{w;:…0ÕQ9jCèþ¶ 3oÓÏÿqÊ’O…¢.0AR©”ÖiÚZþYÚ B(óé©•»’€­mìÛ¿J”^]·°è!ÞüÔC—ÕÚÍû'×éµ—j”Òê‚¢RŒúíÝ}LUeðßsνçåž+/Ýa^^¢I4B™µÖ–‘oi:Ì7l2m5³ ]8 ¤tk)I.MsM„¢@Ñ¢™XPÒlà†7‡È‹H—{¹çåžsžþ¸\ÖZýQnøûüyÿ¹Ï9÷œïÎóÜßï9úÀö[?j^•rÏ­»‹Iß‘ë:¾P ÄÝßù«Ì¦'DFg¤ÙúørÀÀk¬mKÙ?3­³°@Kðö\šw³cÿ Äw¹½C ÏI¸ÇV¤´8ز³ò¸þHÆÃV˜8he^e o½ï›ã·ô¾ppOé·qñ±!ÍŸŸ›~Xú­íð©vD,.| ª©ë»³]Ïä½€:ysø†{ÎTÔÂ0VfúlŽôT¿Q7ÑzæýøPˬ¤£ãÃCnåVãð¤k”qÞ‚«7h~ø§u7”‚>Ò“¹áu‹^wW_oóDÝÇeJgQr‰Ôÿu±r£wõúíFH´“W쉽?žlù*!”ëk¬X_Ñq¡õ‹ÎÝkv¶O.Š¦¿‰ÙÛÞ-Èj,\wú§‘E÷Jƒ£JvIÍž´» ¿õƒ‚’ê £&†¯Å¤n©*/ Ô,-̽02å—'=²ßîÐTû¡†ªAÿôÕg?<÷{lüÂ+®±äœÒco>M)%†+?3÷¢WŠ´»Ç”ÐòšæÔ(†šÞÍ9«¯x¸(ÑÍÇ—ÖÔ?a0Þ^‘pickM~ìœÃ¾t`qÁPoçA€R0/×fny8““j×/®µ»Ž¼–õ  tpåò箆¥w7•òäì;…;.FtW—QJ÷mÍ=Ýë—=Ys„;4Uªl9]—Ôàq_SešÌæÃ5ÏÇ/=š½·{oVP€±ÆeiŸœù¹Þ‰×)º£â&ðŠ©k²ªQ „aAd PCñª°@@×EÓ°¢ÈË>Ÿ(I,!†_•5C’lº<¥Î]íe¬œç¨©È²nRÖ‰Ü×4EÑtƒ0Q @ñùŒY¦lv;C€PS–eäŒÅ* üLU±áWÕ¤Ä*ˆ¼… ÌàL]“±r<ÏY}_»ûjêÉ?mmi¨Ù´ÛgÊ” ¿ª¨~ ÀZy·ÞæÑ7å¥,'·›ÐUY1ˆÝ&PJÿrÌ~ŸGŸÛ͉Ç’ž£»š÷/(–}/q?Ôp`^¦è‹›ù®ö­u‘EŸ=n¿ÍÃ(Ú´éÅSU‹ ¸¾jÙšWê¿Íp²Xzƒ0næàºõmnÜ ¾H‘RS.Ûø¤œs¬|íüuÆ úcgV¯&>Ù Œ„ú—°¦!„qƒ¸A!Œ„Æ BãOBã!„qƒB7!Œ„Æ Bý/þÔBz£q!(IEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/Wireshark_seq.png0000644000000000000000000040722113051004444022525 00000000000000‰PNG  IHDRçÊ/¿rêsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ., yˆ IDATxÚìw|TEÛ÷¯™sÎöÍfS6…4’Л€ R»X°‚ÒDo°7@i‚ˆRTPPPAEQEAÞ!„šÞÛfÛégæýcCŒ˜,Áû~ÞGŸû|õÃg³»3gvêo®¹fQJG::::::::c>øp5 @@Ï ¿9,¨ªªg„ŽŽŽŽŽŽŽ®ZtttttttþoB•eÙçóSJ€R ”P„ ”R!@Q ”R@( „€ „€‹Åb2™0F]µB &àŠQ‚Ä`ô?še7/q”ª*E,f.ómª*Äb¬×H&U*¼$©ii©­Z¥Ûía………ÇŽãyc@”R°Z­W]Õ5&&Æçó<™UXX„0E jÂèá‰ý“£ ,³·°êÝ#ùn kTu JéM7^×T‚4M«ª¬ Ôl±8ÂìWôkRôÔyã¶Îž~T0„þ¦$¼¬Lf«‰môŠßï×8‡ÃT¯#TIô‰ªÑ”8ñ©;6/_^¤rÍHOÔ”×Çîœ;ó Ï…aªÊ Ÿ=•ùúÝ•¤×K?#I’¦i×]wÙl$„Âc|äð±¼¼|Œ!´U«´víÛR4ÁÆ8¶ný…A€¢ŒìâþéN¬P ‰ˆ{vgn¾ ™L¦K÷ãæ­¡l-„·»6&ÖuÓ ƒÊÊ+¶lÝê®Õì6+ÀŸrJU"Èld$Qa "š¤a;DUIRŒ£U“UB–5°ˆ±µxzÒãíÂJOí\ðög^Ä\òJ4×]³?¸ÙýÌ„·”èö7ôtýðý¶ô¾÷=}{æ/¬(ËPÑ'¨¥™Œ,U5I%˜ÁFŽ Š¬ª„b„UÌ8#ÃYªùšÑÈbª¢*E ,FT–4RŠ¬öð0ÂbU–dFºvÑÑÑÑÑÑùƒ¡E’¤öíÛaL×4B)ÅcŒÚ´É,¯(Ñl6§¥§ ¼@ ®Û0 fY&--åüùÁËOA¹ 8Œ B¨ZP"ÍÜkãöVJ‰“Pª…ç†at\¸ÃÎ0 QÕ~Þb2ÿl¥ „$ßþäË=|c_ùrö» 7¿5Í“|ÇøAa_úæâc_šûfë(Ciöo¯.ø´Óà‘ÜÜÍÌ¢ó{¾y{åÉ]oi^þø¸×Ÿ;ûÁÞ?/ùµò’GPJJöì︽… 1ýî½íÆØ£;~uŤú}ç<ÎèÔöøjîæ ÏßÙ1 ûÏ¿ôü»W=<þ®žéž¼‹­*äí<ÿlßôðš¼ÏÏ9`ùƲ‘rõÒ¹ó÷äÖö7c\÷(Õ_òÑ;ïì/ yîÄ´hköÎ/eÜù¦‘ÅL›ôF©LuÝ¢£££££ÓPµPJÃáûlD\æä7ï½ÇG¹ýòØGG–,|¡ó¯»ÙÔ­tƒ TæûÚ¶JU·–!„T• €ÀÈ"@ˆVì«á‡$e´Êìe;'hí“RLñÕG>’¨ (2´î˜|dù¬;óÓ{}°ŸíÉQõ;{ˆ®ÏÓ«5žóøÄc>Š¸–⪞QÆ/}o—ݯý´ké+GÎ;Ç<>èƾû>-JtÁìñc³닽ï‰í=ìÉ–Ìâg§ ºdÑÑÑÑÑѹtèŽð²¬8pˆ|¿K—NDz, ƒQEEQ22Ò†€cÇNH’üQ‚E¦©WÙÙÍlÂñj︤I°@x£Ú„ ‘ ‹Å¬(ʇ¯ydøC…Å%[·o7wOAÈ}øpáCCnîS»oGZî‘ ø»ÉgÒ(˜2‡¾ý\ç½Û²¬Y9Ä€¦¸…¬à—¡EÄ™8Íí¢âGæ¾wcVN,õÆ>`€™Û×ùÆœî Ó6±sn¾IL”¾ZXˆ UÄ° Ø¢[Ø;FÜù*ÿiõ·1O¼µ¨êܾYoí>ùô©S3ãÌ|}ÖãÕGv³Qv®œ æ7f1‹E'¹ˆ?·J ­ˆéèèèèèè€Ïà8¦[·«#„!ªª*ªêõúÀëõr£iÚ©S§ƒ&MÓE €(Ëœ&¬&4<¼sLØYgïNbÃùµQ‰j Çq.WLqIé› }´æ³ÉÙ¸+BË'f§]ÛeÃWß–9:·¨9¿«Šb"Š±c¯.æ˜$‹T“Ÿ_Êk % þ“wr?è®{ìÚ’îÿõ `8²ê¥1 5|î^` жž®l•Ú¢ìÔöê=ëü ç÷VÓ? ¨ª¼C”Z¼•E9ùE§~;Fì©fß…ŸwNIïffêP@œ%,Ö†ó Šküâ¥* è‰/–ÿRb湇XDõz©£££££ó§ÁUVVI’Ìó¼ð;¢À‹¡’’RQ’ C«Vé™™­Z·Î”$©´´!$S”Ç#¢JéQöA\qW倴¢:Ë7½ó¹)dYöxj“SR2Zeú|ÞS§Ny½ž&“ŽÑ‘ûΦjû«½ÜáCž£*‹ ¤ä‹u[ûÄÇU}»ø»ÖöÔÓêè)^^Z5@”ü¼< œÝ´hCÄ­]Òv|´tcŽÄ2X–¹ÄutÓŽìTõçN2@î?i¯:&1˜Ÿ“ïSÔÒÜ<É/ÂåÙ?O_a¹¿_—Åûó!SGûnWÛuê·ÊýjaN¾G¡Š»èB‘[*><÷“V÷÷î‰ïб3 *¹9‚F´ÒÜèz¨i„çù³®þ5þ#Íäâ/Õ|¾ÀÿʯÐÑÑÑù'©Bh À×ýÏóŒ-îÚt“Jí£Æašébðõï'v4ô*»¤™»¶£*ƒQ"ž@€¯¿Z’å@€·Æ·êØ‚ûwºrJ©$É^ñŠ|)¥’ܬ€ªF1güO•!$àƒwi†¦Ó=ãní`ÿ÷'ˆ"Ï ¢$©ƒõÏeD¥FC5Иð«3áAò4bƒ (cdr·dÕ–—,+ ë,+¿flñâƒCkmB­Ã¼ùÏ5’†‰ -»5j{xü°f>Z%Q¬‹çEQþP‹hø„G®Óm¡:::: iä¼ Ʊ Þ錫 @íÑÍ‹¶Wµˆ „]1@£4xG4ÆãÆ;U Æñ ß逪 €ÿÔϯ­Ù©BµGÅ& ƒ¸˜¨0Š½cf¾üõ+/”ó*Ç5~l̵O¾eÝðÊÎJ™Û~,zÛçÕÑP B!Á³õ4°,C)%„°,«ª*Ã0Mí§¦˜¡ë•ê”µ_üÎ<‘Bů£lr,äœw=2¼¦Kæk6~¸pW¾F)E‚¡4M žŠÃ0˜ çc/<¼xú @ƒ© &‰ºPÍ|®jj¹àÝñ«&<}^3 ”R@À`ŒÒ4`„1F—+,+ŠÊ0c¬(¸ã»>‹PðŽ«FÇEe>÷¯¡1®æÌ–7–ï~dÖôï^y¦Ä¯2 Ö4|. ã3^;5ÿ‰Ã%ªÁdŽD¹UM#„"„ |Ê«^™á×Àa ¯!!€a˜àOæU£ÉH¸æÆgîîφ¹LR_r4uæ Ã0˜1ÅF˜¹X¦îwQ u™‰ ÉI1šªj¨.of5!”ºÂª¯¶àÙÕ„ˆa0 ΉTB4 º©¬Nüè}Öm ¿Î€&N-útÖ!þ÷ÆØå@”*uÙªÅéèèèü÷ÚZø¼“^žüÊŒ¹_îfla[üÞ›{yfä ¯.?½g´j¸Œaö§»$é:ä‰e˹¡=ŠÚ´ŒÆ1ç­Å¯ íÓT§¿ßxÏ=í!*5>0ºû–3åæèéÑ,Du¼aÞâ%³&ÞÉRæ± ×ÕÔêÅÛÒ)…Vƒ&à&. RùÌ„Ú–¾8eúÔ9‹J„@Rßß~gñ‹TšžF«*ÜòèÓܯË'¿Ð;áâ×™®NO· B ïCOuh7ô½÷–¬xoɼ—Æ@tç›æ-^2ó_ƒ1iÒVtíõ·¬œöÒäWæ¯Ù¡0,69f-Xå÷ÄÚƒ3'¿²tÝžƒ]¶lñø[;ª’ 1]n™¿hñÌ w‚,]4˵ý-ó/~󅇮HexxfìäÙKç½Ò=Jƒº%™÷NXºtÑâ×_ìEô#]µ4†)nä¸1cFèžÎjd‚*@£Ü°Wçœ_?ÿÉ™kOyÙÁ6݇š[Œ;zô#÷HŠm?`¸sÏôW¦{°a³É€4Þ=ëåI¯}½¯©8„ª¬ÚŒ{RmÔàJ»öVËŒÁh6`ž$ŽíŽ§=ýÔ‡‡lÃÛ«„ðNÑ`k=¨ýu½ *îÒ%¼IñanÓJ8´½PÔ4âóz}~ÁÛõéås§Oÿ¹ªÅôûR¡‰QA5¶ìQ´1WP5¢©ŠJÀ䳉žZwÚ<þz0–$õðäIÓ>> ¼2²ÖˆTvú¹ç^š·½€1M£ÙÌ1\ë®­Ï™¶àË1í7íxrâÓÅñýoŽirõG–¹^-Ѫj9"5æZ¶Š]0kÚÌŽñ hÂû¯¿2þ™…‘×ã‚G)#R¼÷Ô-íÃÖ!Q;î«'ž|ñ§¬‚=›¿áI⸮dêÓO­>îžinê‰ÙYG;yú¦žšÀS"zçL4ûË=ª·xæsO=öÂòî7Ý„€ås§L[þ`Æbb!¢ÓýÑ¿&>óþÖ|Šâ.šòâKsÌf8ƒÅÀH$f­>œ;cʼյ¯1ŸðÔKŸá›>-‘BJ‰¤šGOzꋹ“ž}kÇÝc†Öe uŒ™ðÐÒ)O½°ìÈ=Þf´:J¿xiòÌÝBÚŒ{S€R¥ôðì)¯ÌùÝÛ#­Uß»î°ì›2ezaËÁõŽaMañU›&Mš¾ÝÛúXNëØmqêá_!tj€B»ÝüPÄá©/O?=pÌÀ8 §<ч{{ÖôOŽÀk#Ûá Ô`,Oê³úÕçg.Û@C(rÕÝŽõèØQ=[‡kÔøÈÜyÇ?™ûäìÏïxákЇش.m>˜?sÖ»?|â%“¦ê}–ŽŽÎ3Mœè/U}óåWfx¿ÇôûÛˆ³^h ~°›†ŠOŒ¡©I»XþõëE†ý¾„kZýqcµÇ\Uë»d8DQR›”>Tñ®üMèÚ6[»ì_õOëÓ5&%cìã)P¹Ó°7«üΞíwÔ:3ÓZ·f.PJ=]aL4•Ë8¯34îØ7…íNo]WY«¸³Î>úXOîÛ/•F"š¢Ç€J}ÕÓE9g¬á¸¨BdÞëõÔœØgr»ç%¢(juaáw1D‰Ïç÷K¤E\†5=m„r–ÅÕJkuCK+—Ñ137KìÕ&ñÌÞJ Äçó•Td)wÝ¢“þ5î¬A|Ç\|‚§p«nv…Õž“‰Ûý¾ø²_—ž¬Á1}£SRÇ=ž •;ŒJãvŽ¬mÓ/éÖ纩/õ\2ï“ú2²Æw~ò^‘Æ9ùàx*K¢¤hŒ€õŸÙ”Õu£#öÿüÕγ$øóå‹uEuÔòÎæUy£‡Cqïo›¾8V¦^ö” d‰éšäˆ1Z£PQS÷¦-¡cr´mÜ£PSp4Ñëõ¸Í3¾÷í" µ^¯÷àÞ¨›Í‰–„£[×z|Æߎ?Þ6²ÊˆäózÝyç.ôuq+v•ÞqU›|ÿU?ì\ÙœÛ"ùðæ¯j½¦}Ç ®íÙ–Éq•Ú[ZãA§»ìg^ó`"|úÕ¾[‡ŽJ=²ó»'¡éÀ’ìmë7À ÷E{¯DS«»‡õÒPIv1ün/¤>Ÿ¯²úÔÞ»ãXš§wZ:::ºjù³^¨®ªX Áq(Å,•ýüZö†5{òxB$†569]¦š§ÆíÇ PâwwêÛvÍgç^;ñIUe™5±€žß°fØ„A1&çʹj½Ážs|…ðî’$ÊѨmŸ}ÒCƒ”íÓ6¸&ŒìþyYS"åó9¶{{ÅoÜ]¦ F£Ujó3®MƒÓYQÑQþs'Ô&Ô‚ƒþ„RÌ?IÅÔ>fóÙq¯ZzÞ3Êœ(%¬9 •Ÿ“1”Cšª¨ª——"R’é®lüǘyo1)8ùÎÚó2¥€a-tç½Ýý´¼¤’•¬èÿH/ó®õõù ¶ŒÁåÛ×®;ê½oÊs Q@ #{JºW´õ=…xf°íÍ©ûT aÏY¾Âûî’ŸDÊ ª5ñDdÍ@jvo^ŸÞî•®q¬WB U–S;õßûÁÂ'<ñð”eYU‘‚jI‘ùÝë?Ø…í³æŒ>ýÒò€Æ JTY Þ¨|ù¶äv¬¦JÀÈŠçÇ5ﱑïÏ=ñ_Ëx¸Œë*’Üù¾ÀÚï•@‰Œ-˜5">·ÈSóá’w|ÀRM±ÆuBœ‰ˆˆäó²Ô‹D0¸=Õ×tN&?–f¤FxK~½X£Q *v}g~â®~¦¨ï÷7Ë5ÛW[Ѷ{Kú]IjR¤·ð®uǵMÁ» ,a.ñü1Å,Qä ;¿Z´Ëpãã“Óv¹Ðôo”ywUU5øE )ü¹9ðåG‡‹$ÈÇÃR¢F !kÛô4è‡éèèèªåO %ÁW,öž®Š~t õýWŽð‘\îîOuª); ±¥¿öÖ< @§gÌøä‹VcÞœ—Ä"eÛZ0N ü–/w¿üêë•G¿³fwSéã´Â#b\‡’ï%@õ‰1ÈÙŸœê8sÞ|Nªxkö‚"ñü¾-~ûfa0#¿Ù]MŒ¤Ï–¬¼{ø³÷';‰¦lÿj‹·(km`äÜùxÎï™ýṦìùÔ—/½}ØÄ­\ªPûÓgïÍßP3eÎ,‡²¾Þ€Ì =§Îég•Š-zŸ å×]¥o½õfîŽU 6ýr²Ë¿ÞZh¥z¹ ó«ðØ/ßeŽ~cAœXvôõ7×{(6®¶žžs¢ÐG8­>tmªQ£¿—‹zþËøgžX4‚Ó…ßdï:=Óqæ¼ù¬X¶pÖ‚R¹ñ ïtýƒÃo½ÊÂi§ýúËrÑüÙö—§Í©9ñý¢Í›ïyiá`ŽJ%ûh[W~=}âŒÛ ÷ÎZuœ0Î6/¾ø°Ë„³ZåEâ/?d½öæE{×®¾À)g×ìo3}Þ³\þÚ»»|p£l]¹D¹ñ>¸Ø‚©{Å‚µ^~=Ö¤ìþfù»+ŠâG÷OíÃå[ž›»ÀÉH[Ö.ÝR¶Ì[g½9L+;6ëŸ)8VËì_7ƽpAlÞþo?Ø^JÉ´AÅfhÅB4$á×u mJìÖ q8¿oóŽûGÏŸ_|xÓûŸa­øÓüfÏ›'—Ÿ¹ìSÀp²ÐôÄíIÕmFwia­<»w;4¹›ŒÀïû³(þÃWæ?:qò'{vÇêw¿9w:ÞÓc·Ä†?5-ܨîXÿG¿8LGGç¿ýlÜÿ2qN¼ËÜe[µÿí[4‚ÙŸqý Øœ5[Ný—ä¿1ªÍì[äç?:O¯0ÿ…˜mŽë† ñÿüÑo•Ç Qï¾™µð™\·~S˜ŽŽÎ±XÑÏÆýæ¦|6ïï1èacß{GÝÙÖÿÍöSÿ=ù¯I¾“…¿’ÿ¬sØ#ÃÑ™íOɤ$ûD@Öç::::º­EGGGGGGçoo¨³µÔùµH²¢gŠŽŽŽŽŽŽÎßZ¾m-zFèèèèèèèüùÝÖ¢£££sYˆ¦ùý~A@³W”Æ6{˜Åbàí’^¯( Í"ÆLX¸Ãh4陯££ ÿ ££Ó<(¥••å…ùi­2Y–­.M@ið#Y–³³Žw¿º·¦©9çÏɲ”˜”‚0Zwcˆà”‚$ Çéѳ7¥D/]µèèè4 UQJKJ:tìl0ƒ‡£‹]|I¡Á±7Ϩ6MÇÌhÝFUÕV™œÁ OÈàav;FLA~nbR²^:::¨–_ýõBNΟßïØ¡C·nÝþ2E³Ùü7IŒÏç÷ûý„¢‘†'©£1¡E‹Ð·FëèüG @eYÆ Ã²,ÂàwKIýÙu÷;"tQ±J¨Ýfw׺)PÎÀa†áXê4OÁë>@@ ¥4**úôéJ=ÿÿòáÊË\pÁ2ìÃÿM!D¿ä\§YªåÙçžONN&„Ô÷#Á®dá·N?cÆŽcYæÝe˱  àêž½JKŠ‘¿û®wïkþ0]SÕ¶íÚO›úÊ°aà ¾iÓ¦I“§Ô?Z’¤ƒöÛíu÷ ¢˜žÞj÷o»’“›œxiš¶uëVŒP0™L×ôî]_õUUݶm[¿~ý MÜ!²,ïÙ³gàÀþÈï÷ïÙ³gÀ€쟎Ã÷zj#"£þ|{³,ËÁÜ;!§>”(Š‹%1!Áh4 £QJsóò¢¢¢¡Ÿz½Ô"ø¾¢ÐÇ®YÁ0LEE¥$J­þ¶5l÷Þßþ, !;viJlüþpg„¢È!Ê(Àó”£Ñh6›ÿ)]%š"pò'J‰­Ýu¦¤Ž˜36?xÍîuž=Ÿ!J(Pl™@(E¶È¸fšbRš&øʾ|MõÕÄ=0ÝúË—Tl„€ªQêu×ôêÕ;tÎgdd¬_ÿEPƒÔWsJ¨FIYiÙu×]ßTåGQJ‡þâ‹ÏSJþáø@¿ßg³Ù›j/555rrdYNNJŠå8®ù9¬iZUUUNN. HmÙ2**êŠæŠ¢”––r.=--""5ûØCG¸3>>>ØG; MÓ‚OÞ„Ï×­íÔ©Ó%«ª*]®˜úÁwÜ™ŸŸßè³j½þ¼ gïrO›6m^›=ëÏ_øá‡o»íö ¹ùú÷c0U#ªF(¥*¡çKj§==zîܹ{÷îíÙ³g£¥°oæÌ _|ü³Èæú.ãÖàëi×­Ä f i]ŸOÊ| Dž|õÍW­2Úd¶iXˆŠ·¢bëllŠp |Ž1Z/ ÂŽpgˆ®CRɹ²À†CÕn!HŽ4ßuUdZ´ÅÀêò蟬Z¦L™b6›'MšT?ïÙ¿ÿ:ü3;;{ýú/›Š±wïko¹å–Î]ºÆÇÇO˜8ñÈáC ?-**V¥QMdñ’wŽ;VWÃ$ c¢h6›KJJRRRÓï»G!°qO>Çq¥¥¥qqq~¿/tŠ‹‹øqóèQ4ìCW¯^3pà€-Z4oÒCw_¨Ý‘íö+$ÉiÐÆidñº£®»Ì¸k0®êÚ#¨Õ€ã8†a<žÚ¿\e³NúôÓÏ:th·oßþ—kĈ‡¯Ü‚å øý.W þ7ÌT”ÒêÊ JID”ë²ÃQåÒÏçXÍÕ#ƒ€Ò3ŸWì[ëºg664×Ï”Ïڒп'"%„jh„D£š&T¹…œãÍT-e_- ¥(ÆQ°ì‰ô)_ü¥ßM—-{÷ðá „0Æ¡úõîÞ½;ýpÿœ<øàƒûöíSåÏ¡0ÆA14}útJ( ®5oj¾fÍ'••÷Þ{¯ÝfÛ»oïê5kž~ê©fÚMeY^¶ì]‹ÕzÛm·bÌlݺ¥²²ò±ñãCÌp"Šâ¼yó[·i3`@AÖ®[çs ú`3%µÅbY»v-ÇqEEE‰‰‰PQQár¹Àãñ8I’®ìP­¯ÞÛ"Òá0W{øÂJ_•Gð j•7ðÝwßB –-}§©°‘‘‘—öE‹È0‹‘É-óTø*jùòÚÀ§Ëßqë ˆˆˆ’⢦êGí®ß®Ë̬>ñö¡÷2@ÛðÝñ)ˆ‰þñë9M©–»wö¹¦O¯½¬vû±Ç»u½ª®Œªó…3ßbcX]µ+<æº'¯(C<¼þè#Y–åcíýû£œgT´Ïãá ØMKŠ<T„–e›ê†E©¨(oK(‰ŠŠaïž=®˜˜z¡£iÇq¡5ÓŸgØs 4IUãë'¬¢(:tRZVVß2%¹©®Mày„Pdd¤ÙlfX@¦T f$Çq‘‘‘!EQBääñãÇ7ÿô“Ùb~gé²Q£±˜Í¢(~ôÑÇ‚$®ùäÓnÔ¥sçÐeq¢È¿ë¼×n6¥Æ‡ ”ÐçÙÅž¶-?eÕ ëª(Ïœ=[_m  !!!8Š|ºöÓáîØÂ\VVöé'Ÿ>ÿüó1±1@áº×mÚ´éÝ÷Þ7vl3‡J©·¶€Z-æ’⢄Ã[BÎÀ!„jª*#£]¡ äž2xÐT¢†e‘&Øl¸üóqÍiæã¢nŸäÏ;î?µÛdQÃ’" _¥iÆÊ㮹—IµÛ;ömf<ª» G›ˆP*Ë®üG#Bˆ¦i”R†aÎ|û-Õ´ Ú€ òVûØ8Ž£„ k@„M#”ÆøìÙ³ÁPõ’¥^¸´lÙ’eYB5J ™öŠT×T?÷ì³EÅE;vî¸ÿ¾ûccbß^´ø¥_hNð/×ír13˜RúðÃûíw_oØpÿ}÷5ÇH3ÁÂ~ýú ºaÐÇܯo¿ &¬Z¹êà¡C=ºwoþ‚½HC#wý‹+âÛo6L›9gìÄçM†ÅXÕh@T +}›6nsSðz½±±±MÇ?ûô“/=ùè¢w?4l”RBi­_ütù¢[¯NíÙ³çeš¥„çëê›Q48[îG²«Ñø:éEå™~æìéø¸xR–e‚f'©*G)ùÍï=ÊŸ¿ Ø•vE"«ÚœoÏEع‚,ŠªàÖl3šLN›uηg_½§ Ãè—¦j¡”ÆÄÄ 0 ØZ‚mÉápPJÜ-)jp*лu|᥾úò«!C†¬ûrÍÁ£û¡äbÃeõ²£>¥tìر=¯îöË/[Ξ9·ù§Ÿ¦Ï˜ºÿàn Ôv™YU‚ýiRËT„ÇíÆû}·Û ΧÏÛ¤e"+++55E”ÄàŸ ƒ[·É8~<+"Âì4\1®+Í_UUQDP 4­î*™z3ïÑcGL&“¦iMuþ@€eY`”ݧ¾¯r‹rŒ¬JAñwºl/Ç’ ä¦OáÓµŸÅÄÆÔ¸k"#£Ö|²æ®;îܸñ{I‘½>Õb]³æ“Ô–-GS1”ÔJ¿œñƇ[j² šF0ÆF“²Jeõ2é… ç£]QÁ¼---€ÊÊÊŽ;À_|ñTËÇ«×<ôÐC®P @Fƒ]ÿÄOòŸçùgxó‹é\îÙÛ_wß]¿ùv«ÝfQTMÕ-[·¶sÖFFÙwïÿ-ÚzºÕ²e˧Ÿø×Ã÷ßùÙ( /³~íC¯ïÚµ«Õjmî$áâ‹k[âß²¿‚¨†ÏhÜ<É0 ƒ±J´œ¼ÜŽ;‹¢P]SÎHjé^OÙnwv6(ÆèÞ„wº­ù¹A(]°ñ”Ýl-¬0½£sx|\ºÅˆÏå—m8RëËazû‡ì§om‹þ·ï’Óù+ª…òÂ’õl‹÷ç{—#„zħ›>®¨,çESÑ:thgÎOÅ劢ðbà“o>¼ÛHŽ‹¬© ° Kq(Cúì×^ .¦ ¾ý檪ò~}®)--Ý´iSaiÁûŸ½M4hŸ¢VíÞ½# „T•—‡;#!Õ•”PŒPqq±ª*G¨f_YYYë©ÍHO¥”;e³Ùç*..Aɲäp„ƒýÊòW–eY–ƒýZ½jiøiðý¦Vß}>XXØùÜÜ­Œ¸¾÷IJ®ïÜéXÎ/i€$IÁøÅl6g¶Ê<™e2KJŠc\1ÓgÌÈĘ̀¨¬ ”ÖºköB²hY²¥¨m¢³Ú/ÕøFöŽ ‹¶†™9›Àq Ž´6·…·k×®²²²  `È!V«õ/¯8q|Ø°¡”P@@'aáNgƒÓ%¶+Qàk„‚ß⇀ú³©ÙðËÚÃÃ}žZ–eM&ciqQ\‹„¦zsk˶<_!U [Ï{Ù°Hß÷¯p¬Ê2´zÇ×MÍRobiŽ|üsKœSõÔÃQQÆ HtÄŠW¾’<ámh^‡KU¢‰2Eª\ñ^b„€RB5-8 YÿÊdYúãC/î ºî°‡ï×4-XX¿ï¢„hP¸Dµ\‚ªª¡º&Ó`»Rˆ¢©¨¨à8ÃÏ?½mÛvUU/^²òÃ-Ks­¦iÏ°Ìûï¿ïõzÀårÍ{óMUUEQ¼ì“¢( Ã`Œb\1ƒJX–«®©QUµ9¾5ãN»ŒŸýáò©c~ìÏ.Ì*†ÝÛÕdà ººº¨° ùkxï~¾ˆAн_F‡6IYg‹)…_÷Õʾ­ŒZóÝÊjw,‹¡UKtt´ËåZýÑÊŽ­[î%ZãÂiË׬Y³dɛͶâÝÇøx¯à‰Áb0ð>ÁeªE^^ÞM7ŠŽŽÜøý¦ââ’Aƒü幺Æj`½Qq2¥ñM&³Çç¿pîLЇRâöú¢¢¢dYP)5_®óbbcã ’““ãâãËÊ+£££1`J‰ò—®jRUUæ‘iéHó!Œ Ñ@Qˆ¢RY&²ì`-ˆЪŠŠ€ØhAûSJ©‰µ÷K¿ãÌ;­Ù·†úuˆ¨iš aaaþ@ÀÖÔîöÛoWu×î]”¥îwðýž=®¾õÖ[.3AñË‘6c¥Wjk¶›XÒݵç‚'hq`0ôNe»Ê>}¦mÛö¯¾6ó믿áyAJHP°Bæ¼6÷ÌÙs,ˤ]Î?º!cÆŒ™1s¦Ñ`¼¶Ïµf³9''gýú¯\1®?¹|6Ö {½,Ç*²Lnº½è;4$(j“¥\ë®±Ûm”ZøâF¢Gg"Ë|Sª!Ęmï«þñ#£ÔòÔiÀ²&ç¹÷þ¬”æF ºŸµ9BÕíÄŒšÜÈ€Ãz$kâA"ŠTR"~Ó|Gü¨›/khÑDÞ½ýKlsQIQ¦*ñÞ)æfE ºŸ s6ËÖˆPŠ¡”`Œ¯™CrÑk%èÑR÷G‹~aEÆZJ!!R§H(B!@cÜ¢E‹†ËC0lØ°:”––Ž5ªuëÖÏ?û4„iŽ顇†½ñæ<–eûèß³gÏììÓëÖ­³X,Í´ùºaÐÊU«$IêÙ³'fðáÃGV®\™™‘Ñœà,ËvêÔiåªU÷ òÎ’%ª¦þúë¯+V|Мե:Õ…qzbÌÔGïIŒ .gÜ?6Êù×$ h„˜ fYT|?ðÕTWÛÂlåUU-TÎD±Ïí—Ãåж–ššžçƒš’P*ŠbIII°°œNghßÄ?Z8+o¸bMáWRkŽ%|mE "ér&=´_?ð†Í' óÒ;÷o»ZkÒÀøcþBnHŠ‚05ÒɯTÕúwȘüéáZ^"„ Xù/­™êüï«–CGfffÞzë­¿ÛZΟ€Ü‚ Œ T@ååå!bŒO‰ýàƒRÓ“W®\ép„9~èlnvÇ.iÕ*fˆ™Pš×Ä~¼†ö‰ßÿ0xðà Éß~·©²²²J‡ÁšgŠå(-)) 9éá$Iª¬ª1›Œ„’/²Ë°,‘$Œ1Ú°YYYÅr¬Éd*++E1Üa?}ælZjš¢¨€¡äÏ; /k:VeŒŒ áݘÁTQ©$ª‚Ÿð¼æ÷AÀüäˆ^¥QÕ‚1v8A;y¤%±{âÈ-g'8®êœvSг8&&FÓ4¯ÇÓ”j ®|:|(>>¾´¬4X 1®˜SÙÙeee—s‹YÑ•°¸®ž„[¸›;DQ „ÒঀDFF:Ž@@Ì4ÜtqJLL4'Ož¼¢üŒ9rÄúõ_mþé'BˆÁ`ÈÏÏ·ÛíçÎËÈȽÖn³Ûª++–¥Áãn‚¦•:ÅB¡3MÎŒáN>à«·µÔùH^ôð ”jæËMë˾\fÃg‘%VTâ8¨ª\^%nzÓjã óòZ>5;„øÀ,5ð~¨üáðŠ JTV¬ií­ií›5ùÞú…ѽ“£‰bÞ…E™ªZàËWmNcîÜý³>hÖ‚z_7hW[ øÒBL$.>]H(!Dع8x½ûël-AÕÒÐ÷Ç3f̉'V­Zµk×.€1ƒšá’›‘‘1ê‘‘¾ùöç-[4McYÖï÷.|ëí1£GÙl¶Ðâ¦oñë ÖõUÐ7NQ”mÛ·‡;÷ ¹›eÙÁ1Æ?6þ½÷ß_½fÍÊU«‚•Y†YóÉ'£±oŸk†¹¬|AµImÑpÁ÷Æk:ýåžaÙï6o0a«,)…ù‚¤?u´]ǤBb6ó¹\GT-n·;X4{“y>èšle ÍOŒÑãŒoc²„%¦wr))-¸|GJ)õx<-®»Z–ø³›žÊœ?-÷<Ë¥¶ºRïƒj<>E¡€F!hk=šïÉ)÷P „ZãSX6V×ÿHÕR!-]û¦Tí“DIU5 ´¸Òݦu"6±à#&+[\\"ÆáOÞ—ú|Mmn—)”‚¢VEDÚS§ ‰r±ÑÄfŸÎÜëõž>}Þxã JéùóçÝn·@¼]3’T©’ac.„=£ÁF­ªÉ¨i„°Ù9ŽcEIä868Ã¥ZMFUQ4M%”"„ŠŠK"œNŸß‡ :_©­E•(Õ|JYÑDªˆD4ÁOx "æ%ÌËŠ‡6*‚Ó8n¶Z¯JŠ^Ê2œÉhbYÖívÛl¶@ àñx›òEqþ‚f‹¹¨¨(¨¢‚[¦Ã–¼óÎËS¦„X³wZØ2O@Qé©Rþ¶.¿¿/«¤°ZŠ0X ¡ÖË‚5w­Gðù.Uc ãóùdYV•+¶`õêÙ³{·nªª‡QÇŒ÷úÜ7FŽÑ¿¿P]§ÉU]Yΰ PPU5!9åkv!ZÂûŸ¤!ï÷»««XŽ¥”R„#£¢/3–ØœÒÙ ³µºåMל,PÔ„Vá*KU×&²ÙK4 ‰ HW05Äf»p´W•¥ÜГäe!YIÈŒ6 Eq«\T»fGƒ€¡ÔjL_«¡m4¢àMá)g*ç ËcÝÌÜ©‰“_ãRR¯(7â"låeÅLXŒ¦ÕµòSEµ§Šj•‹Þå,ƒªËËcuMðO]!ê””\å4E¡š¬J¼)ÊéätWGNÎ5ŲËW|––:pÀ€Æ,“J²3‚·8T‚ ~oµI‘’¢ª}²Ë–ÆŠƒ®3-|ëíAƒ®oß®‘¾²ïW-ž?sF†ã0k(*- ­ßÀŽØh3¨¶HK”’BfÍ~mÜØ1Áà .µ¢MšJ† š¬%YB±,˲¬$J3Š¢äää´lÙ²‘VGÁfµò¼Àq¥€2šŒ,ÃP‹Ùð ÃÔÔÔÔÔÔ$%%53eYÅ€(æˆçÂ@hTÉ*e$)X”± hÔXA†aü~¿Ùl.--5 ÇqŒR[[+IRp*BÈÓÄ­Ý‚ L›1ƒP­ªªŠ•Eù®;ïüzÃÎÈÕ¸kLFÓ+S§Nš4)2"¢Ñà)Ñæ o©…3Yvá…}3m[X jÄÓ%<Ë`49ÒhäšìÇ=¥tô#\¢ÃêåT%äËÊ_q­èEëšaÅò÷_š4ùÕ+«««† " ÙbqFFÕÖÔ­,îššËꌆýø%uF’¤ÊŠ2ŽãTEE ß"á²SÀ˜;)_¯øŽ|V{x4bDÈï'Z×»ã‡?ÑLwZÐ("%z%«–‘ýî¨yÏöÂù,ê !F^1m@òãÓ¡Ù“W H!pÖ/»$µñIó-2B(!á‹Ž/Á™- î|.//¿dÑøñã333>œ••Õ»woBFP<4„`£¶Q’5Ukß¾ý¸±cW¯YóÖÛo1"==½©2RUU–eB¥@ˆ&É2ÑÈwÜi³Ùúé§w–.ñððøøøFƒSJƒÁƒÊCÓT^)¡Ï?÷üê5«Þ²U”äá »ì©’ÿ©žhZfL¬ÛêÔ4šÚ2Y|%¼?.ÎéöËIqmX©05B[öî{;t¸ä ÐúÚîr¹ŒFã%V´`ú£££C+°6ƒR ì„’OÏn޽ﮙwEÄ&Á[¯¥wéÙ}×ÁPvÖššêšÚÚïC€z_s-\sí÷OjÖ½¿– ;wJäÐqÖ>šŸ.§­K’ýXE@¢ B10—Õ5»ò(PJ Vµ©á‘a]ü#U‹"«gssyŸŸcÙ·(ŠLŠP açç亢\¥¥¥ ÆÐXµ‘D¥$·P%g¸Õ]ëgYÆî$ZP”'ÔÊÊPQQ©“ÕÀMá½Îpk àOˆ²GÙÑäü‚ „ü‚⫺õðû‰%‰çÁó%)£ÑÀ²,¡TÓ4žçÍf³ßï¯?í­1u/òO.n‘0™L,Ëjš&+ Ïó«…÷òaaW°]VUUUðc¯›)¯ nÀBAU‘J¬ IÅ’‚UñáFÞ9sF’$J©Ýn·Z­F£±ÎK‘M«;á_–åêêêÞ×\Óèèž–šzøÈa„¦j'NìØ¡CfëÖóç/Шæ—ýmÚ´±4mk1˜Q}â?ÛWáT§•ûñDíÆãî0 Ë8,Œ+ŒÃ8”‹Ò… ìv»ãâ¹Æ—ôÈçÎ æð¿_‰Ã½ýÖÔ©Ó6ýð£Ïïàþû›Š!dµÙ%Qòû<@Áãv7_µ4R@Š\ @ˆ‰OHlÎ^PÄ°1÷Œ¯`ŒÞ]; ¨ÄèópüÐÇP³Oø¥„"^D‚âØZü§R‚½b),r ªh~*y[tRkÏÞmŽ^0{ù­.¨n]‘o‰±Bþ<°!„’–w¥”P‚(ixf?¡4¸ó¹´´ô’­C“&MúøãKKK×®]»qãFJ)‚(AÍ;´¥Þlƒ†eXŒ1F¸[÷n ì]·nåª|ðŽ:4U7.†­ NÊ`æöÛo3[·n]õÑÇÆMIIa¼µ€eæÑqãÖ|òéÞ½{4M6thTnOÿqY9››'øy«ÕXUåCE$8%Yc0çåÚ¬öZ·;xŠR#÷ŠŠîÝ»×­÷5ÈØà;š¦8q¢y¦9#ÝÛyÿFÚ²ú!Ä`<ÊÞÐ!d¨¼ü<–å©ŠÚµóUÁÊsó¼¿{\Œ<¶W2ËE ßH4›,Ýz5×ЈÐä¡žûy@3kˆ@çJký¢" ~ÊPÍjŸ¿ÿ~}Ûó?Uµ êsSNéA£Ý”^\厴[xEVT­¨¤º²¤XäcÇÊVüq£Ñ]uÕU«7|”Ù!¥¦ÖVîöl0²•_öñ\"p,69rdë–Ÿ >eòäG_Ý`§¢ÊZ›‰e•—äØ{iç·íGm‹Š!£Gj4ø5×\“u*+<<\QTŠ1VUÕh4J²TSíFùý~§ÓÙÔmýû÷?{î¬ÍjUU Cp=jÜn à÷ùÓÓÓÝE‰0ntž$˲ìvCe„J!å IDAT[Q êÎ_×4¤Q¤¨@( ”"bhtâµeËÖ’’b„Pllltt´Ãá°X,”RžçAnœöûý]ºtmÊ&1zÔ(õ}õرcURRb1›'üë_‹/ÎÌÈxbâÄÐ µu¼µë°ŸNxÜ$"±[‡Ò]&®éC™EÉÎÎ:yòÔìÙ³'Ož|ɧéééÅÅÅÞ¿ü½÷®tÒɲì¬Y¯NŸ1óÇ70 „1 !Í0L­§69¥å¿e„·Z “¦i±Moxn´ªÄ ]ítU¯y 5ß÷|ô-÷^Ñs±É¢Ôð¤!î 6d¹WÏŠM oïÍ¡ž>Žu¶i1þTóCŽœ’aJLiNŦ„ v»}Û¶m-[¶ Zû.9|>ßo¿ývÏÝwB1ª»‘ƒS³oß¾„„„úàõrç…^9r$ð!!Œ½¤›’,&“ !Ä0¬QS5­n£Ë2 p¹¢ßz{Ñ¢E‹V,_Þøâó,k2UUŒÃ0÷ßw_˜ÝþåúõÁäI“­TAÇ„ÇqªÑ¨i$œeÙ‰þµ|ùŠÝ»÷¤¥¦ÞvÛmMMo¶mÛÆ0 ÇqÁæøñ?l²ÉÊÊÐØ(n¬çAuHïâœø„¤h§µÒí°e¢ñ’\’Wê®Pÿ{gÅñ6ðgåü.rq#B HÐ@p-P¼¸»;”â…âÅ¡@qwww‡àqw¿ÈùÎÌûÇ&!h¡?J)ï~?|ÂÝÞÊìì̳Ï<óÌó˜Œ\dxÔáƒß[˜-šWª\åãÍI*•Üø¸m’ÿ+fd,-Ý›äÉ!ʤ—ˆXÖ¯¬%MÁGºŒD"U«Õ÷î4¨×°èq3bQËU¿îj7:2(Ú·¾oú[îïh-Ç™Œ†¹=êLÝr!Õ,¦ñÉ»A¼¥Q-6ÏêÛÂhÐ3´\ÈéöíCBòÞ™_˜8µ—§‡ƒ_i·GaqÜžG'Z)e¯?Û¹å,T¬Tùù³ÀœtÇ–)ZÎì_Æý~HŒ³µ…ÁlÎÈÉ?tôÎÍË¢¢£«U«ž•™ñ¡cŸ¿|ÆeÞ Žöv¶MÈÐ`„K8X‡Æ¥nÛuýIÀ³“§N­[·þÜÙ3:<6.V.•juZ†aš6šL*UNn®Á`,W®\xx8˲žž|W> ´·³Ã™9N¡PhµZ¥R™——§P(?¤µ|ˆ+G+×Ísz(îÆûN¿RÔú¡ô¢MïjõÞÄ"ÑÌßf999}Á,B&“)[£±³µýOd&2gg!"õg¾‘A·b†6ðŽÛ„Å–Õë}âQ1K&i®œàsQ˜ôÆË'bŸ5Y¥ê¯ª×ô<ÐÓ«$Á€ Ž‹Ã¼Üx(¨ÀŽB€D"vtt¤išeØ—+W‹µµµÅˆ q±q˜À·²²´´²¤)šeØŒÌt¯’Ÿ”l«x<Ùâh4©Túñà+E‡ó¥øá™™™_ñûîá|S$„ddd¨Õê-„ŽŽŽþË[svv–H>#qÕœyƒlí,k–ó¼÷*ÊÇÅ>*9e˜s—Úw!T¦l¹ð°Ð¢aB®^¿ü’ÿúLº)Ìò~£·HÄË2ƒ:ÖjרÒ{<÷äçç{y–tuu-¾<0???6"êИ¹*Iç­ËŸö“b2™ Cn^þ‹¨¤E$e€«]ß«—õp²P*d2™H$Ì-ß8* Ë÷k-ááá7oÝzkcÅŠ«W«III|nqõêµè˜·;a«–-yÒ‡]Ú±c'‡Þ6}óö•ÐÐPŸÂô".î=±˜øÁwffæG¦‡þòðŒŒŒ¿aà5™Lq¦(J,H–™ÍfN÷qßAð/;ma¦h(’ÅÅ#düsð!øˆ&PŠƒa!›ë“Éøòù3wOOL0æ3‘EšÌáà}Âøuм{.CÓáá¡*UNˆUÛÚ`Þ›·hÎðÝÃi^=§hŠŠfh:[“åéå-<‚Ïâùóç=zkc ÿ¾¾å1ÆYYY_mºê³z³™ã8ÞòT\FñÊÆøs3«¼% ‹’$|MI(ðÏj-o¿KL¦Ð`ggàÓB‘ì/nl(Œ8G€Ð …ÌfMv¶»§WlL”­)Ôw Ô–^ð Eôz†aœ…G h-ÂxW@@à“`E"GÇ„¸xÎÌüÚVòz>†Ÿ²,øC(‚‰ÉdLMM)S¾‚X"K¤éii¸ :.÷E‡Œ°ÑhÈÎÊtrvê_@@>ä×" ð^Ìg6™>CÄP”D")šä]È?ýpš¢$R©`À•…%+Ô‚€€À§#bYû÷å†X,þ¸C«€€€ÀÇF2Bü'x=fâ×z|ÁS ¾ÙÿiŠ¯ºú6áãÓO ôENøÅïýo$Kø˜ÖBIOOOJJ¶wpø"zB(#=½T©Rr…\¯ÕÆDGêõ:¡ºþ-”J•N§ý„Ý,J¸{H¤RŽã^[XX~V„Œ¯©Q¥§§¹ººÚ¨ÕF£ñUp°=ËþO¾šìl©LêáîŽzùò••µõ™Êá8.+3³|ùr Ë #ÿuÄ{ãrôò•§§'Ÿ”î­%òŸ8œz+.!EQ11ѾåËE†‡{y—R(” -‰ë—/4mѦ¨MSTa¸V>#Qáv&;,ä•oÅʱqqKKËwOõe³Ü}º¹â­þŲltT”¯oùgÏž»{xð¿¾5äøHQßœ0 W¶l™ˆˆH…RY<º×gÝû»E5™é¾¾¾‚åU@@àáµ7./ïøì_EGö‰2º¸Ääb&33 #l0èmíì…êøáñ-µø{»hínQ—(åSÆd6i²5¥J—ÖjµßHùßí_„3ÇaŒSÓÒ<½¼8ŽûÜž[t΢ZY[cŒÓÓÓ]\ Ã)*Èåò—©©¾¾¾B;øy­µÍŽ—}{\øZjYà߇¢Š› ¨¢àë|C-öƕɃžÀÑ„_øù9’þ » ¼ºž/j‘òñ¹E}û„@ŠbÒÿ÷Ο™Oe* ðÅ´àU^Tñ !4ß|P¡Aƒè³»ÒËt­]‚dX[%Cý•¨â]q¥Eà›QZ(\ÌÙœ¼ó·˜‘€õF„¿§ | ù)áwRíšU²¢>ó^øþU›¼¨ç}¥iš¥rvŸïÒÆþ„Ã0¡âj¼“Ðçã÷ÎPºs{Oÿн óæ襨œÂ ‘€€À—ÔZxR¯ìÞð0ËÉF@5éÚW&WPºœ éÒƒw{ŒiðFHÝâ Š§­m“ø´–‚ôüK÷kyÃC(òzʨàÍMSÆ‹dY¹0ŠR:×óü‚ÑX±D!“"„©k÷ê_E£‹¢žK0—pîÆs-¢dj·¾]jææéBä',RÔŠ«€qÁ½ó Lð•Ý‡C'm"¡ÿ²’¹M.˜(**/Q ð%µ–â,DHIÿŽ=»B(¢=ùèa‰Ê1‚1Â$óÒ²9×èÆÃgûK¢÷nÝh¶nݳ_eG´wã†ÐTƒÏŸ¹“KÜ»M®ì*/\)[¾­…æ5 Á£ “h‹D"Š¢HO+P¯í &J¯þÃúK¢(xvnkLéîͳvïØsP»è£ëö=I¤dv?véWÅUšýòúöÓw¬íÈ1CŒ‘·ö¿n¶*7¨_Iæ‹m{Ofqª£Æ©u!;vLçT=†³×ÄÝŽTTs§4‘v>¯UxõîÛÍÍžÛzâE*%·kÛk€¯½¨ø”kñ|oE6 ¾¨¦ôðeÛN_0Å’6I$£.žá"ù‰{·íŠ7Z¶î9 ¢#{lËŠ $sÙFÝ:ÖõÔßÜ~ò¦¶=~”¿uBBeN}–(þQþ8^S×Â5eFlØzP£Ç%kµîܤŠŒÕX¿áeJ¾µ‡_ß.-Ô2D(¬]µê|ŸÑ9±sÖ>žûkÇ/µ0[@@@àm­…™…ÝÝ·ò…¤>ÔFB¤pžßºáˆQ lY*çØêÍNr¤b6î=]y`à ËúSW‹$xèx$“#„X–%‚¬øf(ðØÀˆ˜8îä©Ó¹¹¹ü/}z÷.\6\8…A  ;ИäE®[±‚"¤Z³Î5ëþxõªrºB‡D››Ûeè´’ª¼ƒ›¶zšWºùÈ–T"œ°=˜4ƒÎ¸uøUªgò㊽§ÕµÇ„†—z÷˜>Ô MçfLqI'n'š8SnŽ_wäþÀî~ÉyCÇOµ1¾Ü|æRÙî?i-|Ñø¹W>F>ßÃø¢f§EÙ·$2æh1ÖétÀåžÞº÷‡þ]è˜ »—رýÀñPþÉ;4Õ†eÇÇy5Ý®ªPã×n1ü  åÞ5iÙ¦UK&mz”Ú¯¾£!/G_và´êˆ;göÝtÐP”­ôŸ2­¦9íåæS¡£;¹€‘£Ýıiœ—!E]¯1?ë$4?/«µ¼ökÁ˜xTiÙ±ž+E‹%XE./cL(FdæÌ”)#<ÛÀÞ¾*aÀ§Ri„1-’bŒMz-%’ÐØDŠÌ‚¼ø )cŒ0"c‚)Šú¡q£Í[¶Ò4ݵKà8(Š¦ â"âBçtŒ0ÈÝzôë.#˜K œ±™ŸxÍ=»&V Æf>C1b,*¹âÂ`B€!„¤Ú˜ŒÔ˜›WÍàYÚ²’G£·ŽìCÊÆ?4*SµaÊ#û8Y½†•F›¶Ž,2™;YÎM-T' Y9ˆÍa˜ªpN‡·µð ô ”*òz†ˆbY“ÎÄ!šâw£ !¦œð,{çÊ+†ò©\ôÑ{O=QÛX$ëEP Ëqˆ¦ ¦¨â'$„`ÌÝy™h.ñôRš.íQt²ÿ0Æ´H†0¸»Ø\¼ŽpYŠcBÄ*'.ᶠÜy{VãšÎçƒ#lDaMýêbfˆ¾°Ö…+&0Æ#’FF3˜ùŸ( ŒeÅR“µZG,QyZˆÜËUõ°a”@0BA™ÉI2;7•Œ-°6 u,ð PC¡"_¹\Þ»W¯ÌÌ ;;[Þ€†Ïó÷za&@sœÙ`6ƒÁDåG uíãŸsëQT‹jŽ@H^žVKi_%CC@¤°+)=ä2oµ*–Ð"–3Z7nùSúõuÁ‰•ýÝT š·ÍØþ$2¥†% DU‚dÜKÏ+£0%,KH â¯0dÊKÎ&ζ’Ì”Lµ“£.3+ÔJ`¦øzŒ±¥mIóÎ-QÞ=•,2›5M:¥ô²•(ëç©aIsN(}j6,gZ`yË“Hѽ³ú<çêV vÖE¾ Kó· œ6S«³NŽI±(Q—`„ ùyùZ’ͺx3˜lÖ}…Æ潞ôÍý ¼—Œ ¾Ì´èy\l]%L|ëW‹|tµö(Ÿszåë&ɺòøèú%KW]yž^ääÄp|Ot6÷Fæz_mŒo1$ñÿ¬,-¼¼< F¡‚_ .¾†ˆ× /dÕÂ…Ë–-[¶îÄí;ÚéêÝ°+ ¹‘h¢&7n\¾î }³2l"¤À96ÏlÓµ®ý¾5K—¬ØŸÇÅ<:9oÞü¡å=R^œŸ?þÖ@yŲ„’o´ìÜØóàúåk>nß®.m6ó×% JªS…C$± •™úøÆm–=D&Ƙ—§&“©è'~ Pe0øÕ F£‘Ï”Vdoø÷Õs~ÅMaˆ–BKb†7 Ò„E™Mf†a€¼ÞÉ`0[Âo74…=ýë3,69þ*Å{B¨()ƘWex¢è3¯Fï_Å;iþþŠ|ë·’&¹ÐòÍfsÑÚæ¢ ?¹Ùlæ/Z\Á‚bÖÖ¢{çõ3^·CaŒeVNµJ[ †ÂØ·Òª¾î&£±Èó!D“ü°W!®µš{Šô¼w³àÔ" ð¥`_ õÂu ÅÃIçð!ø=ßEÑ4RÈå@S"‘˜7á1¦þE­…¢(š¢ MHÁÄ(w2caBâcc¼}ÊH¤­VËKŠ/áy³G0¶•ëðþ¹’¨ñf (¥BÁ[7ß ù_t×ï=á[Ûù¯Fƒ(J.—ëõz^•yëÞAi_MÅݯ1åJŠß:3…_­ºÅëÊh4Z¨TB#øÂœŸ!B‡dfe¹¸¸¼kÅý­å-8Ž‹‹‹+ãããìì¤×éB‚ƒô:½=Qà_SÏY‘T*ûK A©Tyy—¦i*77/à~€›[ ~Jô³zÄ?¡µ¼B(!!ÁÙÉÉÛ»djjÚ«àW%J¸¿7çó‡´–w7¦¥¥€õj9¹¹?vs+!‰>ëÞß{f“ÉïWµª••¥0C$ ð¿ ²°,ÐZÀl6§¦¥eee×ð›£iÚÖÎÖÎÖöõˆM0´ü‹òI-°XÀ­V›X4Éòm6hJ­VÛÛÙ‹D,B(3++--½xÊ‚¿……ÊÙÙ™wâÉÍÍMJJæ'’þg}‘qtt´²²T/©µ|ËZKIù‹ ªþ6E3Ý…Ia @A“‚øÿôzÊÂòë”)*<ÔË»´0aô5Ñiµ2™ŒLôŸŒ&+ËJ­êቊp÷,ù¯têÈ°à’¥ÊòD@à; èÙSߊ•q\tt„½\¡0èõ½ÎÎÁ‘Ÿe.ÐZd2™\.ÿjš”\¡Ï×#¤T©„H_ŸŽA¯ûj=â{‰DÿV§fAž|'ÆYàÂB‚½}ÊÈå P*U:.+3ÃÖÎþµÖB0ÁèëÅTøš×‚1ŸGJ¨ŠO®2¡•þgªKxRß&“ÉÁÑ™WYø r¹ÜhÐŒ‘ eà¯5ç#z ãþ¯*ÖÉW}ÄßÅ[X¨®Ïmcä_|X‚<øŽ†ÙÄÒÊ ŒFã»wë׫Dz¬D"yCk £¯U">#Ì;Re8x¿]·–a†ú‹W9A„à¯÷ˆ¿‹~ówª‹p)ÉÎŽ@ØÍ¡²ZmªÛdç´ä4;gg úþùǨRÇZNÿY÷ŒÏ úÜô,dål-ú¬;<¼ö…S—ÞulßP˜Þ+OŠ~5¦ìÚ¸7]ä>rhG™ [þ Ð4­×ëîß7÷ü«WÛ·Ø Qþ̱3 ŸÚ¸Œ-eŽœµæñôq]¾tàO‚&„˜ò5[·nËN‹Ê–”õvªñSGwwgJ˜Æø'ÆÁ˜=b]zÈò•{Y £p6¢§Jãï×óŠætNš¤s*I#$±.Ѷc;w+ñ‡Ž¢P궇ÆÏ#°°sqK?2yA¡ôk¶™3U ´qrÅr‚ñ×bÀß©&ìöð%çü}mz³w­¶”ùxÐÅC·ÔÇ6°ù¬hÔjufôV­òò=Z2"³éÜ+×¹§NSUŸðc'± [þ;Èd²Æ d¢×qoj-¯‡JXé}›JOšàÊòi`‘9;lõ›ã´lÝŽC;Örÿߢ‚1Ƭ\5l̸Ì{»ÿ|ê4~Ä€2¸_©šÏã­¿ï|–E‰”þU\Ÿ>¹TŸ8¦§ Ë=8µýðõR—*“ÆõU²ÂËöóÂü£€´°‹l³¡“ë;Ó…2åÄn]»1(ÍT±Åà>MJ‡žß~^ÚvB#õþå³m»M–Ÿ]¼ÿy–m•Ö¿öªu{ÿÚœj´›Ð¹æíƒN>Œ¶.Ý`üвïqeRñ¤î#~§ˆ¹²yãÖãsÇuä4Ñ›×mIçü;éZ]qhÍÊ{1yÞm'Œ©ú¸'¿ŒëÚaÂi·o[:UpÌû}ú‚TR8Uœ6q yaÞÆó:PõûeŠŸ1$‡ü2v¬s«?™\EÖ~ž²çvï9ÿ²ñ5v°›’;´xÎD=%V÷3Þ¯Ä7Ÿ_£ˆ8NäÖbôØ:LÞËñ3vµ®5aÝÜyä×gvÏR›VoÍÄUZ êÙ¸!äéž™c2£g/a#.¯ß}F/vè5|d5w+}Ú«Õ«·Æk¥&Ì®+þóM1ùt­öCºÔñä“$½e×Á|~l@„!8=äæœU0]«¶קQlœö|ÄÚ»ÞµæŽl{ÿІ£‘–^5Gï® 2D@à=¾gWÌÖR0! *5¬§×ìÙ›–üö!f͆©óþúg;ÓÎYó“+,t’³ÿ»€ã/Wð!ÇQLPjDt±”ÃO§® ^´hÉý]+N>Éê^2ôŒ®ÂœÅ}cömx®û¹²Lx¢ŸQáÕ¹Cù¶¹ÓæÎ{Ö WŸÜ,ààò•.¦õ÷ûut ÷*))P*!\BxòØéËÜÕ’ø§'C›…‹K² zñ¢ªÍüÅ%ŸÞ´;Ä0°Œø{ÔóŠõŽCuš2çè9ýÁ¥+˘;Ð!oÆð9ulZ‡°–.i 4KP²Ô­Ò©#Eóò(B°YŸçÜzÉÈúQ·6íÑ/×dîÂ&ºÔg3O†Tä*vðY8s‚ˆ¢ÃÎß"@ˆöùþ`Ëß-3%=™±ööò_ªfè-.ŸG']X~ùf•~-¾a%¯@kÁ˜æôÚœ°›wÍRŠè2,ê,šÞRL㽿-+ÕsÖà’ìá_Ç¿òùƒTê6}T=5mŠ2tÊÂårsâÜeÇËLþiëœ?ZM_^Z-¦hýÆ1óêLZ5ÒѼgÖœ8ßE„EqxWkÁ!D§ÉfüÇ.éîvbãÂˉõÀà s+ºÊ3Â/ί»`Ɉ¤€“s·<[<¸"#è-ß*šì숰`“É$•ËË”-O½¥µ ŒÇ! ,Qíç¦/w] Ã8}NX¾¼­…„¢Eå=Øgÿ?¿¤ÇÉ‚0!qM8s ’Y(i¬LlUÒ½)#D›„/žK°òs¡‘ï³´>1Ç-u˜½bIBdÈ© ¿Wì=>:Z8ZEü+[¾ÊÍu!›â8„ |ö=Œr3ÊUoÅ!i³¢L 9νÆÕWE}—Ï‚o“…=‚`!ÀX¯12,1còL†Wrätíέ•Î Ûø\Z½|‰cíž«Q4A*0oa4„¨l\Ò5Æ+{7?ÓÚ¸*´º<_ŒPÀïL0L¸ôWj/ FåˆOi¹Ê@ÑÆR[¬ þ¦ë™B¯ï¢´G§ÎdXÛúNœX‰Æ™ÍR„c~d]Å^ñ« ŠÍÓZcL…"šÎÊVÄvV(%[§‰Ô+:)Ä@ôšÐ ‚IQ ȤÑdkõš‡§:UnJ¦‚£<_íY£²£ÉÈʉީ|^žnk^¥›Ä”“”‘-ee˜`‡¡3„ IDAT‚ùfŒBˆ!8("Õ¯W7ˆ½yÂÄaV†µ‰Ù2VŠ&Q¶U²_Þ‹©âhŠ{¤*ç'%ßÂÈ·Ýæ Fˆ‚fj¶m]&€ Ì‚Bˆªº²/ž‡Ùz3çŸèý £$¢ìØèìÒŽ …—2çAhR†¥>,Gén%¶¨`£ ­è¢`¥òšn((8ZêdºN:Hètòs²R½¥”cŒ ¬=ˆ`þ¢„&ˆðJ»Ò¾Lèñ[IŽÕ‚‚ªÖ§± D¾ÍAÉÍÍñó¯FIDbW7÷ˆÐà7´Œ1ÔŸ¢T*ÁÇ;h\¿Åw›½pý¢g²¥í†L´¤ÑÝ€ËÉîݬEü±G‚ÏÉ @8ÄI ˆ¤–ã8†‰L‚fe ŠBS ™!Žf%°Ô{h­°µ g™d%&Í«¦¿ºÏ1n˜Z8Ð¥†nØ|*Ë@•®Óv˜+1ùÀÚe³Oé›XTÚVÄÚýÐ$èÏÙ3OÊÔ~rÐÉ„ Ž»ÒõÇî\2÷˜•oó)}/`Åü™”u¹)S©Èw(ü1)ì@lÒï3f°*‡ÖÝú .ïÈq\›Ÿ§íýsÙŒ#ÿž?75¯ZvPƒ¤íGOI“Æ%ÍžíÙtÔ"©”Œ)¹D„8Ž¢XÝÚ×ÿcÕ¬½&ðh4!y³–¾‹gÏtk0¤µD‚)qÜÀjÍâ9ŒkÍI#*ÒH¤2ÄqS2‰ø[N»ApG!4­”ÑœÙÌ;;1Ȥ"ÄqTËŸݳjéìc\óAó<­¦Vëå«fÜ“Žš6­O†+WÌÉU”=f…¡÷ŒßÖ.Y|8ƒj6hzç™ 7-^p.SÔnðTV×­yfç®QÿâWç8„1 ŒDÁИ¢Dr1…8ŽKĈdJ 0ÇqrÇ*CË\6ŽC•V“z{b³Y"ß&e|+ÊŒÁÙÙ;ò[ ²'j²³éÂeE4èES4oá#ébB€Š¦‹Rãþ ²²2íìì‹ŽES?)^pišf0ÁÀ_CO0¦(~º„¥Ÿ‹Ùl²°´Öë´¯k¼ ½1Š¦©Â‡[ø•â§è×#ÒâõÿÝ? „1S˜¦i ( ¤¨ŠŠ*!UÁ÷Š¢(Š¼~š¦1BüvLHQG+ªF~gê}[Ð)Š¦¾éÕu99++kRpûtqoÙ×òä–V Uø;-ö¹è+ßD‹ þ§âU‘••akçÀ_‚¦é‚&MQc^tðŸ¡p;_áD!ßññ±å+TÒjó-,¬†Æ›9³Éhä8³N¯³³sx=cü:HÔ?>¤#‡zßU .-ø¬üƒ¶O„û^lÿ™GFx[Ë¿r ˆã„)cï Š ?È#˜¼í‹ ¢iæëˆ ‚#ÜWm˜  …:ÿT0þº=â? þµ†m[@àû’)Š¤ !^ˆ ´–بȯ;#=Mx(ßi)ÉÿÖ¥y" ð}ÀŠDo‡ÞQM ´Kµ¿H¬ªL@@@@@@à_!?7°èsÁÜÐk î›ýóó‹¶|÷.çù¹ËW-Ü7ð¯ô-—3èîî—‰\“öýmX@Ú˜+—Žç³åÛ´júVPSÂé\Ý“kÕ¼}wË¿5«cȉ¾™ mZÞé½’¯_<ÎyÿÔ®µ”&Ú”{çoÝ÷¬Ü¾j)ⶱ!íÆ¥½i&϶í’ÑÄþàì»nåÛT/ëý¹gº{ûjÕÚM¤´Ðæ'T–íd%aßj=—×YÕf«à¼[O#êøUù‚u–{çJÀÏšÝýÝ Aèâ.¿Ô–­^ÖåÝ9m≻?5©ô™Ñ¿qú‹½È½££…~Sà? UÌ®Rð‘Íðä~vvLŸv+®ýÇô טÞ:NshÂ2m»´ÈçîщŸ{v÷é;¼Ã‹ä<^o¾þCóNV,@؉Y¦êÍ×}WškS­º/iÖ¼­êï:¢²B<ŒûÐiìÍõÇÓ|[5o,¦°þÒânžÕ»ùz¸`cÚ®ßjôèâ³þÔU‚ ×6õèÝëïÈÎ/Òõm%ñw¦ êl3cçþ÷þœxûþø²-[4•ÐØpõ÷6Ž•:Uôv7åE/WµgwŸYë7pØü`{ï>=¼ú mó YûËáógèɉ=1¼·O¿Q½B³M„ Ë›{öìRzÚê-&DB/ÌÐÛ»[¯ç‚â¾È qæ«cݺz4nbÓmĈ<ؘ´vv£n]ËüºjK©[ÿ<ÙHÌ—»wYq(äÄÏM[•èÞÍý×µ[´è‹Ì=9ös¿ž^ƒ§2rj¦Ø€ÉºŒÖ˜ÉµÝ½'˜ÞÝÁlÈåÞ3n~yhJr^áþDsææ­/;Ynë^§M=Ë{áq¯Œ9_g|Ÿ"Øœ›oà €É:4Mý€è:òg÷'ºb½Ð 1c!ñµÀ÷ôª*\°I½¡Æ|­…*÷Ãü¥Ó»½ûBÉM¹~ØÔ{ËîÇîñ«£ŒoI’˜ý§ž®ÝórBù›§o=Žy´û²óòí»dÝXž`Ôîþ¥U»É×—o:ÿ÷?9cðv?ë©Úôää´[wî¾{yÛ¢tcúî%¿ý¶æéì6ŠM;Žm€äïSâ÷» ›ç5\´aôüø¸ž\gnØg·,¬6âÒæÛ.™“cŠÝ{äÆÚ=A“+?>~%1geg-Õ0j3suzÆaÈo—vïzüSþ¼‘I.Uz¯Þüj÷ŽË·nÈ5gîžÿóÄ?Îëà°n3ÿ’ær²3y-qm5sæJ‹¡süâ«-»‚w’¿r-+üt§Ž¾/î­Ü¿E¤Á|cn• ;ÜÞÙqиßôP~vª™ˆ½¾¤çðvÉw&Ð5Ѧ¼iCJ÷Ò>(Ë`Ú8»~‡öžs·ä0ѼÚ;ºÉN]«ß‰Iç_ ºì$½™/ 1§žÖË}Áî#ou›‡kÛŒY±ìÕ±^½Ë5g­êµ.0iÖ¸ª;/Þ‰ÜÖ~é¶Ýòï.çÄþ]×lÚ<¿gí9‹wqP^vZÑ« ™u™Ù¹¼vî\}ê²ÙC%ÅÞ8EuòtK׋æFžîÓgàÈlsöÚá^«3Lðß|òJrØ™àêÛ·ï tM;if+w]·y{ðÒáæ.Üc&oÔ 1Ä­™T±ëˆAI:8{÷ÌÁ£ßÿ½›×ªµ»ÀøüPRµM»ŸÖ7® ÊÖ–l4qÝ–—[VnÞ¾fSþ—X2¥.ûÓŽ­7œËü¼uÕ*%˜ný^Íî‡U»v?›>° àšþô~|ØÖÀê"߇wî µ Y}æÉÕñ£‡é!ÚGóçübÊ{¶%Ú÷Ï­¯ÖÌZú9&¦´òà“ðôB’²zŠç^µî¤àÀª:ãWlÌ3q@Œ)›§Tî2´×”Ùc3!—6wéÔ»ñãLPvÀÔA^£æ/Õq„˜6þZ£}‡r×à ?áîà廦-;`ʸ·”b_4¶RÇ.eö…i æáÚží]GÌ]¬1¿­Ièöì=aÄó¨Ô‚¯‰W§ñéԣ΋älSÂÞ.}jŸ¼ŒpÞ“¡]+GgÞÒÙyុȔ½òךíÛ—\ºï$!dõÔÚ›Oÿ­‡sûñ›Œ.nmù±ð°(eU1ƒË9üº&bæè¾ù)çö¤U]½õY=å½sé\³>ムY¸jv‡±S”ÚWÙbûУ¿bïê©)€ /‡ ­)T[înì¹xÇyJ¬T¨X’)v¶µfDâØ[¿-œÓ­ì•Æ¤çÙêŒ[‹¢(GSòC.nÆ°ö©ÍÊå2Yͺ·jTnöï67iT_]ªõáCw«uXyäðíÒRQƒOgtj×aVÐÞKä4ÊX5¼F´€{É;Vï.ÓïÜу§]©ôõ¿´ï4íÆ»m_ü!t‹;wîzà—¿*4['±¯9eÉý­«6nX±2`íþá.—ƒbø—NzˆaöªçÄm÷sŠ½½)ªúˆS ‡Žh0)ðèÞV"õØ ¡]K•X¿+nP«†©!Uj»ì9rY­†àl¬°°–Š%©©±eëÕc¥.^/®°]g„íÙ~@Ñe{-öô bÚ?«ƒkçÝ›–þ±~H» #î:æöÏõ¥¼1âÅÕÕáÕÖnš;:'&–bpk<ñà†6GrŒCôp½x),áîÞiiÕWìÜthÏŠ™éf Øs÷Ô …Wý:óÍÚ"±§~aj.ßµåf]G9˜#·¸´xÛ³îç_ x«˜òê{6Œj£×ó-ôjåÊÖS®l_³ÏÅB*ví±oÝAmžhUÕ =mêo<”4¥gmŠ‘µqp×Î{îÉ«âMdô‚»ƒÚ¶›³7éØòÁ š ¸2ûG‡ $îÙ/¿yÛ•Œë¿GÁ˜›àýÃüõÓG,_²×,Øbþû°ÿv…\IçÂ;†[@KäV,S( Y…B‘OüÆJ””XÀ¯‡¢¤rË•„¦Å*•]°#%’Y2, ô×÷ K8—ñ*nÍÊ le÷à쇺“[–H¼n[»9 (±Ü’e ì`Œ¬òÁ»‹ŽmôóùFEO å]=0O5øF;%¸ûímw{Å ùz€HjÁˆD€õZuàæ{l@æ¤Û/zŽÙ”yqÔ­Oª´oüÑVã0mÌ{fDô w"³ÒwLÓàêí\ÚþÍãr‰\—’Ö‘CI¡Çן¾¥R° ´‘€ŠQ Ø_Ô*(ûZíÔNÞ^î©Æ–Ÿè@€b …¾ð{Ò³­gÂÕ¿N,KSŒó¬ý¡E»:”ïuõ@¯ôB¯ÕnüåŲbo†;÷™×½òžu³ãô#½åL“6“-×l>síÇr]DŒã¯û£ù=“ÓRêt­jiG\÷Œ¤Œ˜-ì/´L®*Œ‘GWh0ÞÊîÌâs:Õ« ø‡G12÷6e“64«b»08 Â.™j[ò§?—°Mù©õÅÈTæaBõ!綸ژÁƒZ?9ÜõJŠ±‹Û§újЖõèû‹£l°%6>ŒN¥OÎb¡t5ò¦)-5º~KK{âáf-õñ*ålô0kÀªLO;{ëͯ'iJ$çTiZMiM9š#RôÈ(e…¾nÖÊw-ÇÎõGV¯Y™à\·ã\'ë½¢´‹•]ý/ÞŠ¨õᔓ%*WÝËõ/s»!}ü®uL¬B“˜âƒ¡Ä‡÷Ìίݬ¿••´¤“4,ˆ\œ]”Ò.ë1&‚ÿ¢€`kù0æÂqèÍ°]r{ÿˆ§qMZ´ÌŒMªl'mVlLR:&ÀXTPéRJµøÅôꎣ½§½CégÒ:¶¨™•Ã”±³©í’Ëz´¯l¥3;5’ÙÕÖ'&UkÑ/óÑÍRvjO'ûØ$Yÿ¥³iÏveT¶u~vÔÇJý„‡ý.;k¿“§î˜2i]sWÉóðŒRª¹zú‰b/æHÊZ›ÒJ¶˜LÂïÛ9–ŒuQÑÑEõ¼ÔðÄt ¯³ÜÞ5üž¨óÐzÄlÒÑR[WŸ¢Œ§Y"— VYÖþ#ݸ‘cubŒ‹5>¥âÁÇ!mxœÁ®´³[ÕÚÕ’ãCþJ[0'G¿0¼Ž–ÚyYJûÚ8mêÖa½†£”ÝRÿqsfnmæ)€ ¯w˜|pÊÏ ,Ä4_ìôèÇ?cfðKƒÙ”•™RÊæS³ƒÚ8” ¼—ؾEí¬l(cÍ2®/<KFQª‹O] ¥h‘»JÚ¬÷ªiÓ¶ÿ2~‰Í›É*K»—Ñ™œ9;+=·`LTì×ܸè|“9'þ±»Za£Çħ#N—I¬­$ 0bÑûiëz“fÙù§ßW#r7JŸbäÌÙQ•J i™Á`@øÇJ%ÑE§èŒˆ3rèÝ):ŠŽC˜’·ßîÇ9³ÛÒÀM\8£ŒfônÄ ¹…cPh¢™3djòŒ §ZËgóèTÿó÷_XÛ}áŽ]Å·[86jOoÔ»zŒóo @襅s×yvkYiXï ‹_ÔmSßϽZ¯FñcôöW×ï*QöZròÈÂÆÖŸ:m+)Û©œfHï*;5j{¹Tm;Y}w@ßÞµ÷l'±ë5~Öì‘~¿ÌÜ·£ð°ßŵscíî¡ý}‡O쟌¨þ#Çž[{àÈ.&ìt³ðìÖ¾î°Þ>®Ü¾q- Æ°)SfäŠÖG{G¯;| @wsõžã/N ëÛ·âÕØçW í_®wßå;Ît—ÚôšºtÑ8ÿ_'Ô%.28˜vÝ7)ýöð-DuºÖ³ì߷¨•:ýÔõ¯á¬mSÛĽóž§DΓ–®\3µfßAµ7Ÿ¼N; Ì¿þë¨_ºr*hÓªÑÎ)u~]4ÏH1Dwjjµ[¡ o2éý Ã*ÖWªO¯[¥n?&ÿÜ¿w YÍq%hÍÂAm¢Cà;æ·•&Àé§vL,tÈŠ:7|ÊJÞÍ2áÞ¨!Ó×Ý9Uæo>ðñ¹K÷J ËmËÕ’ˆ­ê¶  êí{,®Úö¢Ï*€SýÑåMá@I†ÌÝ°¦yßþ~s×ï7™ãŽòûóBàocjn¸x­J£¡¦Ž‘)R¼Ç $Ÿ;¦ò¢K6-|J4î>9koë~ýjÕé;Ûå£ÚlÚ½e£‡V3gÞ¸QÍYqùNõö©8õ¤õOë€Xý£éÒ˜~ãÆæ!Ýá©Õ'¬?róp¿±“Fé9Éð¾Í–­ÖP“çÉYÏOÏ6±¿1ú÷a[ç!J¤îÛT6ep¥?=R¹÷N<#2ƒsU$-Xwxú´ß%‚1B@à[ÑH+Uö,ÈCDÓcŽ3³Él4êm‹ç!ø1¥ßøKŠÁ²Û°‚Ê" ðߢ@k)ï ÖÖBmü \ÃVç„ZøÖxù⓵–—A‚Ï–€€€€€€À¿EÀý¯öafÍše2SRPÿŒã1„Ü?tùöÅÄ\‘›‹Ëa[J|qâüµ‹z±‹³å›Géoîºp-)_ìêìÄ‚9êÁÞ‹·o2V^¶r|ñП‚îÝŒËóööΊ¾qº„£- \Üóã箟Éw{5(ëÂñ Ϫ*VÐË ª=îôÀEûNä˜mÊ–|£…`Cµó;<*w.o-姽8}jwLŽÈÝÕ…ùHåaí£ë»o>¸™É©]lòS/\Üó4è…Ò¡”•\jÖ%]8¹98)ßͽä[ËA¸Ü°k—†Æ•,U–¡¨¬ø»§ÏOÌv*á-e( ºE3:ß{æå×@Å@Æ£US—¯ˆŠ7W®\á­Â5a'õ Oòñ«-ÿ[þåšès#Odµ©ìúÞ»ÔïÿeÞ¬°¨¼Š~UÅ”9pOçg®UI«è‡û.ÞºAYzÚ[H“_»týTXb–›GiñÇŠAòo_¼p$¬KØÛ~gK—öòÈ©AAwƒ"ÓKù”a)üòÞÞ«w®f•6ú›gƒ²}ÜÝ2Ÿm¾’ ´Õ½8yñHPÐÝ\ÚÑÅÎúš'$7áÞùKC’4¥<½éOK%›r÷øéAAó)k׿ªØü¤K±&[¹ô¾ctú϶Šª=,>§áÝ»zLåV¶pawaÛhu¥V²/'Ÿ¸Œ+!Ùr; ¥ íþcZ ¤8:Z›Í&‰DJS!cŒ‡Fˆ“+”ÉWÈPÂ¥>|å[¥AàŽ.ûïD½ñ²É ·d‡wyïƒ+ú¾— È¢JÕZšŸLÔ„Ÿ¹úR%_ûµL×ÓÒŠµZÔ¬ÙÒM:)¦HβåslËW¿µ¼^pj^VЦéëUðkªd)@°ééžAw¯‹Ó ñZ T–¬¸§çOœñk:´f¥r@ˆNù<)=¹±ºÛ={ /vøÏ ó‘vßÊÁ’rM#÷u9˜„Ž{óëõRvsTh’Ù·léã3*=‹ÏÖçåZ{Ö©XÂ4cár1Þü³išMMãÓūΔ ð$&Mx¶6éÀ®Í& €R7Îî]·›øÙo;ÏpMdص…_»Ö]¬’—üêöÕsŽõ‡·hR¥ø“˜ù5ŸÆ¼”à—sJwk×ú' cƒ¢b#ôÀéI¡‘/’3²!œ>+.æEdTp¾‘ðE0g G 1kb£Ÿ'gf¿Y]D›ñàÎEímZ4‘Ð\j̃+—4m5¤¼‡[NÔ¹¡+ÎUôu\ÿÇÖ_¿pÍ¡tsðÆŸ7ßÁ¤°¯Ï„9® p}~ê <ºò8ðûk_b ×êU«»œàççÇμ7jÃå°*~µõ1r^mÚ¼jY¼.c÷’Ùûo?Oyòfj©ÚÕü¶Ïl{?E‹ !H›œLiSgMeÝj–´W}z¿Õ$^~"©V£¢ç¾Åý’9 Ø÷2*&Ì€.-%AùÑÙùºü옠€×ŸÜ‰ˆ‰E6&ÅEÅ„ë8 ÆìؤÔäèˆç ™yo^è²c##ŸÅ&Ä›1!kRÃ"cÂu&''D1!„KŠ6"bÖgÅD=‹‰7c@ò“_f¥EGE¼HÏÕÆE>?¾e`ø³Ø !šV²á8 >6g$…DDz`ŸútîSéNõ+Ô:¸Á£¸„;7|*+gNëšh@4@nÂõ“k–´žt‘.+µ´—1”ÒÂ^¥™u1ã¦MLÊN=¸²kÖ¶V •µµÒÑÕ=}i(Û²b…CÛ¿¸ Ø4tØè¢þw7õX´ã€¤BÏžC}+6éXI¦5JׯWµ†G‰’21 ÆØã¨u ÿ6»ÄßÚÀÅNÖ>…—hÕ¾IS1UP.kµÚÆÁJ®«,iVjmmÃJ-­­mY ÄJ;…T"UÙY[ª(@髆׈2b`ÄJKK+FncmeÍ€ùáÚzg#cï.™¹ö!Æ;îjµ Ûg5MÑš2ƒÎ>‰NÊ¿4fé>3ÀÚ}Ã].ñ‘ÙHÒáñÉ«guÏxs²Ha­’ÉÅJ[kkKh…¥½”¡-­äRqlÄ-ÿ±–ñíäg›˜'ï>~iÊ5ëÕn¦‰OÄP7¶06nzè‘ÎÃæê0PNUG4ªRê»ô„g¥–î¥ÅrwWWP¯Õý IDATç®]¸µW¿ >¥ü[tì+¢ q8|ìÌËš¿[‰(Z¸¹y7ªæ.‰NIÚ;ó§lÖElZ¾ý¤!ý¼}ÕŠ§× 8ñ(þs$%·)áVÂÇZNS€C÷vX{òjtÀê~\ãHööõs€öɨ³CÄR+K¥Lna«¶²¤ÀübCí£÷ƒ­´t/"wfÒè™ã byt\Ú›/}.ôÚŽ,½ñî®>›.‡é³žÿu~rÔ¹ÃWâàë«»_‹Ñ¢ÜÐh±~çâ®ÏSrv9të9÷hiµiÛŽJ›œgaí ‰-¬,•RP¨¬ïì«!¹A'-ÙŒQÞãè8 Æë«›^ OŽ¸>cñγ™F ¼¿hrïGOvý”{vÔÒ}gr“ož° ån™Ô8 Gú|[‡SâY±¥µ…\¦T«-­ó²€ µüMÌš‡Û㪴ÿá Ãœ6E­È™7k‚Qj™–ÿv4Sö«]»<Ô—vµ·0êsÔl̸YˈX”­G€óî½Èr©jÉ m¢LjÜ<«S®Â5GgÈ×Åäˆ[mÙxöòº‰QÙÛ7lݼ*#ôÝׂ–[:(DŒÊÊA¥çDnÑRy×ÏïLÐd‹Ð«Kú§>Ùºÿä‘òåÜÁAXúôìê!:¥Ñ JäÒ·OOEaez×Ú²v…¢'¿Ø·ƒšRÅÀÄ=Þ°kï·Rehs¾×4>õBCs¹´Mû>£,ßÓîÄÎ.¶Gö,¼A»9XЬT­¶Ë,Õj[–¢$*;•L&SÙ[[YR¥jÒ{ºˆV¢´¶´ÉmÔjÐ…­=xèNhBÚ«ƒb5Ä:µ7Ãœ«5Z{ùj‚Žž¾~;5ðb. $5z//ïR0•`ÕtY£ZšÕt>_,'E‰6 …Di¯¶¶¢)Zie/cY+k…TbÔkì¤Iãg-Æbq–6Ä8w{Æøv @YüØ{ªMað•£ßð>mþ_­X!Ȭɯgaìü:¥YÓ¿}>’uÔÍóf·DÕnèSºeKéš{—|›wår#‚bmf,¿ZV³énö'gÏ!8æúÚuËëË r  ‡/'´î<¤AË¡ú3Ó³ß í#–YY©ä ;µ•â– N|uâæˈìW»Lˆ€_ÃqeKx׫RòÍvÊ:–ö¾zâÏÐÌÌÄÐÇš¨ƒµL«ÛhdŠfZt¬÷êÞõ´Øï¾ÓTšó׃Ÿ_Ý”+yò€–ôïÒ·dIÿj>ŽVj‰Hj©v´RJ) ”*;¹¸ •Ð—ú"2¥º·Ê{¾ãbDTÀÎûÑ™ñ¯N-ªäÛØ£œͲ~‰yÏßÑf=9sõ º).“:WiáëÕ¨iù´¤X‘ÔÒÚB.WÙ¨­­iAô |C£¯pü´GKæÍ<ã°‹âˉ-½’£$+f-¹¸¾•»% Èl4Z"Qbër}üÞÖ«Óîû÷ê«ì5Ì¿~æG%¯NýaUi @,JérCÎ:”p¶•½£ÂBfëZ¡Ž…µµ›•ž™˜‚õKgwŒy–¸s‰ÿØ)B~¦z§ùcU¦ÁKWŸj6ýNëä^~Ji±Qd2¶Zô0ïþP…² PŒ¥¿µ"ß;ïÚÖTA°Œ°c›Ž>\>{µŠ(á7l¨ß)#Z%vZkËäT~_™°öF€­¨ä_ÿÝx§(/àr¨låªÆzιSÍ|G|TÙ–øøÿȾO$‹åÞc'ï°“2€³œ‰³>iZèþ¦&€Ãë¦ÒMVN­l5pØ/(ÖÝ¿=%’ÿmE^¡rˆKW/Ÿ5qËÜVN*†pYÛVLöj»¸‚Z @KËú7e O'±p«çïòÿJ¦E9[” êc'-+?nÞkKf¸T1´»¿ZmËÒ”¢æÐWž8¤Z ª`˦z;Upr²uñ*é”c®«þ´hÅíÑpÄèÚ“VLïjîZ¬¦ &@L:‘¼ÞZP*ÆuÔ¤.ò¢è‚´Ìò=Á«ˆþÕòÅ«Ç®¾ªŠ˜½èŠ± P+b(«*#t—WëÂtíE_¹”o÷ëôß Ë`¦h‘\")~2ò¾¹•OŸµKüîÝØ1eEòš15åÖ•&NÝ©Ñr½=MÑ4ÃÒ1ʦÇØmµìÅ8ë +¢h–!É ("Ì ¶–¿ —òçôî•»ü¢‰¾•”^üKçfÙÇ&]º²ñì3q +ž7rî6BiîlÞ²üέ‹6Üuuõ.U®qÈš¾·¯,ÉUôUÑ@ð¾ÛM›ÖJÕHäèåƒË·¾ªîîV£fÝGÛ&½x¸-Š­QÖ«Á‚'ü{ßÕѽnÝ»»,½E¤)ŠÆ‚ ±aoØÐØ£Ñ-5&{½Wì½¢(6QTz‘ÞËöÝ[æ÷˜úšäû{“˜7û|øƒ»·Í=gæÌ3çÌœYu©gËac¿1P–÷aÒ8ôžÙáÑ÷nžYùF‡5k(»}n_tä¥MWs3ŸV–Y‡oßܸ㶷_'´ cC'þ!ºÿóÀ{/°éËV®mœøìV±B¾å­s·ÏÎͦZZK ²=~ýâá#§›ಾ *àuvÜóµ¶8öÙc¨±…*þzÌÓ‡OÙ:4ùró%ëÆy¥éêg@'¤nºñûÏœxþäØá#€2ÆZ]øèð¹D‹^àßÆí**×Ê#ãd×_Ö̵ª Ÿ{ïɹðè 'Ñ³g·äm£îßÙ¯öl!Õž_Դ̶»µ>ùyb*ø•ã|²~‰%žìºX-hJãã^¥çÄ¿JIú«QzE~Lì=uUʳ/XÜèóåßÞµèáãóGvoÔ#Àí\|a"#;+K«jö)³òÑ^™TîÐÖ–Ʋ§6ü§[Î]¼þ&ÀáN˜%­»th¶öfî ®WN¶“éù½¹ÈØ+|›qòÜóêÞœ1oó$:¯¸˜_  ;srßžÛ«IÄ4ÒUž9ŽÌ ‹¹p:;#üÆ“bÊÅ™z~0\¥4iÙÓEqøvøÓ»[nDǼÿ$k‰êéóÅ•j„تòB•V[Q^¨Ò³e¯._‘ëØ°1M„¬Å`Ÿò½ÏÇ=:tâÌ©zOÚÃãضe /oý¼zIÅ{Y•)KßWñÏr‹‹w1ào8ô§çÆ4Ù™©Õ¦[fÞÐṲ́öxCUžUT©’Y:[™€¦2·T+v´±¤)ÊËRéYZjcgmMb‚¼$£D¡³°ml*âró‹ììkF®ZyA~I)câdkaŠW^˜^©Ö›Ûº™½sM—dH­I kˆjÄ.Tå'‘VžR„ÔU¹Ee-spt&8eA~¶–Ç,íÝ’Ó”çæç’R;{+$h²sJ4¨¤²$S‰›ÛZ˜¯ÈÊʬ¶œ–ö4[^XZ" ÒÒ¾±‰X$pªÜœ D›9Ø;’ÒåeçZ7hLa èJ²r íèìÔ…ùÅ%8mbgç$"q@º‚r•­…yµÚTeÙZ±½…„@lqvš‰“§Ç€×Ë Õ¤½©xMAnº–ÇMÌX˜HKó“•!“âbg†¯Ê+ÈJ†ÌÁ© |yökÒÚÃX,âõò¼J%R•‰Œm-êg.ÒVT–ÖFTõ<àò¼T™E`€yIz‰BgnÓØLJåg&jBdÝÀÁ¶(;ôGuTˆÕVdi5°Ã1Ð)²r‹å@‹-œìþ—*§©x›Ÿ@š87hH`¨¼(­B©›8ZÑJÜÎÌHŒxM~¥Î‚T—ófvæï–Î ¡4' LX!„ÔÙEUŒ±ƒ¥9öûÖéÕE‚©‘ˆÓ”ç”q íe…¹Z²wrcL]•[P&75¡p‘£™‘ñº¼œTfìÜ Žt¹idfNV¦ÆúÊl9aceü>yEêÊì ¥‘‘XÀÌl,LªŠÓ+4H$"¬lS(Ësʵ”“-†«)Ï/Èå0Úʶ‘±˜V¼!,=ÅñŽÛä—àÒ† ¬E¹Y)Õñ+73R›W˜Ëò¸•½«±X$pªüÜ @˜Z64ÆKô”½Z^f*“éÅ2¬¬ £J£gdövV&åE¹¶ un%kfab„W“¬$Î âãü£ÉoçÆ5dô7À 0Àþ¬¥f¢‰‘”Ab`€`Àß•â·¯©a-&Æ ‘$f€`€ü=`u¿} n“ð¯Â«;»† Ú“õîT¹êÀõÿÃÌhvë†-rÞ Q øëðç¯|æ+.Ÿ]Ηi¿\µ¿“믳qÕ¥ Sg.6³”²F-¶¬\P§(|ÙÎïf½¨äŠ‹¸E›ú9 œjÕä¶I gùnÜ­u_œÏÒ(+”gì×$eñ²}j$ä=¹8bÏkßÊk w…;š ¦þ³óÚ:gò+–©,ÓŽ_¶¯wÃþ\Éæ9S^³Ly©nÂò}A±Ó‡çbFœ´ùž ß½:½xíõ sšu¶vV·Fµ)­üíãq3¾oäfY n›×}3Áv+×ÍÉLÚiöŽ!êÌ[Œ»¶mÛ¹H‚­°ê4oEh«ís&¾d™ª2͘ïöš?Y¼ê¤øÔèßÝHigVûFáQؼ'Î9O>³¢oeÖƒÏç¬i`/Åì:¯[4øÛä…¯Ï[½7.×î~øITn]8!‘5—©æ¬ßg^xmÙ¶$R‰Ý‡oX0¾n[Žnü"ìâþ‡ÞLjHéË–ΛSÆX9úO\â¹õócÉ"¬*ß/tËÔ@·Ú·)’ÎÎZ¾‘à†®ŸÓÓ£¶ Ê2|·ögŽSã=¶|7ñôò)EZ­\ÙqÆþÉím>‘9—V†ÞÎWߺŸØ¥E£ö³ÚGõ~;,:Ä¿aµ)Xõͤ·: c³—lwµ®½æ¥Ý\üÓÞ³DÇïwÍö¨eï÷ï¶fåÄî6 x7ë6e»=ÚòVõË/R—€V¬Õo>_Peul5áìË;¶5ÇÛwôgþˆè‘67ÈÓÃ.¨&£îèæbTïîGGÆWöÙÓÇœ4Ø* ø›|-„é¸ïoßzd~;ÅÇɵϔ¼:b;vÍæ-Gý‰Û/Tu—èS<º}둯½R£^dâ3n/s ìÀ&êñ;?ûáó·ÝÓN?m>´ñ§ïÞ©‹ÝËW{¯8¶áçÓ 'wäò³6ŸÛ³ýøÊ>'O?4(€´šµùÜîíÇWö1=uö¡¢ð^”ô»Ã‚$O•Â¾#wB<¼~åò½ (¯»´0ýieКÕk÷:©Ÿæ°@t4múWK8×_jáÛ{Æþ½§÷:Ÿx!¬ 3ÿró¹=Û¯ètôØ=Æ®÷º-‡6þ0×ʪ¹q½$¸ÿˆu¿ ª¶ÖiϼÙ´õXƒâKoÔãòMLæºuÍâê„ë\ñÝ¥ÎÛ7îY?\wñ擆>Cì;»gÿY<îlQý,‰øèÙ;g ó«>xrzWUçe3§/ø"¸-ÎU^»øxÑÛ˜ÔúîÈz·Þ²±ù”ý›Öm<±|EIÝÜh.Þ¶cûAãŒ[¥3rù¡½;On˜=bãO'uŸÌ׋m^·ÅÎcø†-‡æŽhY»Kæ+ÂS»nßvèç­]­%{‡œÏÕ!@KFÝÊç\ƒ~ܶtØÿW>ÄÅîÝ<¤³×^âÎNôê7²_ï¾Å•\ÁÔ~-?îßsȸ”2m½ûªNê5¨÷‰»éÕ‡™v îÙ" gà³üªÒØCû´ìÔÉwû­—\eì¨~}r1#zù¬:/hKÆ o?êëMJ€*ûöø`ï.ÝÚŸ|Y‚øÒ9ƒýæŽëܾk¯—ÅÚ÷ê”ɼÕGVOè°`ÖZ Û4§g§N͆Mû¶TÍÚøùÜM—–iÕ}üZ•ÀEïߥ‹WÏ!#£sUÓe€kÐä>hÞÜfò£fS‡øÕþ]båõäúCEUZäøø’úV_™r®Y »Y)‡wóTfFL9ëÔÂéÁ„ƒ¼¹{Íêu}y±·3ºm¶7",¤#žëKæ&Åä¼ÛÜèòãÌŽÁ Ê®K²:ûk Ÿº{‰¾žòݨat!çjÊÆ=O+Î|¢.x\¡­Ó6n?²ûíÀ–--§yИmׯDeû–œv"ãƒ=¦.ýˆIû‹wõëFTJ—Á]ªÿOº¦XüÑýÁØÊ%üÌ=eÅ›§â^—sŸˆÐ“ÆXÁ›"­öÊ¥—Ù%yÕ?ês®–XûØ|Ô”’“üâÜîòüÇCÇ}[‰[ÍÙôðǮK_,Y<¶Þ•I%<ööXȪûVê„bMýݹòÂz4oÙï2ÛöÝPüeüý¾3‡Óÿ[cÞÃèù†Î‡œx˜Î#òozâ@åÉÆíþ k¾bÝ5£þ3§V>>^M“ºÙpñȶÃCJYÄ‘®Ž?85ÏüÄõú“{ŽÍëýNšo7=XwæYøå+-mdf-9ÿ,"<òÖž]åF~Ç.]u”}výù‘Þ8cuääƒîž²jÕìœÿM—ïo_;¶eé˜é¥ð¸Ý⽧¦àÞ|°´æÜè¢H-GMûñBDÄóïÛ>|”Z8löþu_õ[zæÙíßHqÂ7t[øí—ÇçznßyÙ`² 0 fèý¼ƒ±o÷èá›ø£“wœºÿý¸€_ÇŽÃW÷:{îòÏnþ¦ïíÕ+mÜ÷Ñý„˜½Ã‡;'ÿÄpÖ ~JŒ{Ë„ 9¼©lË‘gévÍúfו3hœ‹ ¿¼|î9ÃúÎXÇܼv⶙CÃFC‚öæ†P¶Ó·ã¼ á¡wÆ]ÐÞX7VX2¶…YùK™š5š>yBáÓU2†³9ìú͈û ÂÊÈ‚®Û 'ÞÛû¢Ïùû6/™UÙÓ̦]¹3¶iGl×Õ^YÚ͉+Ò7m^I`€ýí-*ý¾žï[½´ž»™ôå­?¾‘¯k»É««Îž½úÒ­]kcæS™}…IZ¬]=÷ÆñýŽAÝÌŠDÀÊ_Mû>rÁ÷k>ž ˆ$D¿Úб‹y‹]â 2ÏÌY½÷â+IÊ®ï–ÿ¶iví+i™xÍöb¿»ASõSmàvƒÎFvÊY»|QÚ¨7ÄYz©¤ýú‰6ÿˆÄín²éL|NFâýcc“‡Cýƒe»”Ç»´ìü_ÙîXQœüF§\ÿӎĤò2Hsk3RL[ëR•zAbi!%pÜ©EqtÅG›‡‚3w·7¢«-ã£cK÷&Jûø5(+-eÿ³C !ám•ÈÏÞ„‘YY«S”zĘ˜JIÌ%l…þ?8†ô,&Æõ)³¿þÁ¯K \iÔ¬.;çÊ6ÏŒ·m§NÒkíþ¨4d?.ø§[*Å·?̵kôe¯SŠílÍ8^¯T*ëµiÚÙI—¹ê’r´¹/£Š¬¶}Qbz¥µ•”gY•ZÓcʉ6*V›²uñ³^ð±ñ¶Nv<ÇU••!®<úV’Ñk"ÜÛöñ({|ªA'W ÷$léqußÕAÍ5j­LÊô ‚.êÄw'týV÷h¦Qk커m¸iÑuÔµŸóB>'œôé\òâ0ÙZ„ƒ }¶Û¾×„FfR­ºR@€ã¸ SÈuºWñi–öÖ)±±fMZ‘ (ÃÃNú Ÿ`N@YÚy 7ÿ°ù€ t¼€Å]v¤2à§Ñ¾Õ*`‹Ã“0¯æ5œ¨(ùá­dfdp+½F^)×h”• µVB`öÞ.ê¤ÈkÌL3âoâ4•r–ÓVTTY™‹Íöêí6kÓñß(‹^Ì?rí†å¤Ý?!òîÑÆ ÔÊ ¥Z«ª*Së-½ÜݯÅ<‘·lVÈ[‹t%À µ¼@¨¼v#`ļ­¯&÷h§Rxô·ã è¢ÂvXNp³’ÉKRKtR)´ ¹Nà3#·myˆ}¿8X©P™Ê¤Ø§J\TòŠòr)†“&RÝˤ2'§FN1*-nìÕ»y醥‘§STT©tjy•RebôYИ—p~ĺƒ“[Zß=º(,Ek\Bll¡”}k`*Âåé¯âsKˆ[gØ/BdV“¯ÒºJ˜ºQ)ÌÔ¼*öQržŸ%bÅVñ/Ó‚¦ 6MÞ¸á"Fˆ¡²J¥³6¦ñZTÃp?gô,6ѽaV‰}SÑâå…÷¯ØLÉc×ÀqCú_TãÏ£Åoó«83\÷8™>°ýóă÷ÿhŠ[ãùS™kçkÛ®¡ÂËJˆÌÔʽg 6Û€¿Ü×ÂW„­w5!ǹÝÔëûÔ%4Ukft)7ÿfýk ÿÅ3/› l \Ùþåc|µc®¿X„‰e U8ØÚ˜“lÔ±ù"Œœ»:xP„CÒͳ§T‰®(fFèÔb©ßÁÃ'dlÎæµG’zŸßnкKFô úœÍëŽ&ô:7¯ýàõÛ¿ú}»=C{õè5ç  •Y×ÆOÿ\ú]:0KŒðÚ¨Û|ÛŒld&õé9Ë{Fÿn;J‚¦oíiÅo_ñåÇ©VÞ!ç÷Œ¤pNuûÄç!Ì xxýLlZü¨>> íxåæš+¾è}q±oï•ûM8¾§eÀÒ_hHqò£c—M‡·"î ¿+àVeö[&t\<6 5Z¶å´ÅßIZ@›¾»OÈj=@ÏÀ¾gÞM8>gÙÉ—=¦ú±³ë«ë?>-*|:¶0ÍNß½åÆ@úƒ³á2Y5kÙº$øĽ 8æ§Xueñðo»ÌعkÖÔ ×šZynÚ9oäֺ͆ÝGøª‹ÇOù a‚C·¹»O xX²ïÜuc€×EŸØâá=ÜÍJV•ûdÚôùÅzÓ±ßîmF«¾þaW|ie¿ÈÝF '‡Ÿ[&þ„X nafTýel³mQïm”™Ó¥s§N¯ŸpõE®sû‰ûG{¾½C~Œˆ™ål éá_ŽXr LÌy{zÛŠÿÃ[£‡-ùÁÖ\ܱmçIÇcÆ•ýdkðÑâÝ7™S%ÆvôžI­R­F…ín &Ž=­"üýÏøß½²v_°çÑ"ˆˆ¾Ñ÷RØ®õ?}1å‹.ó”¶ûÏ^=q̸I-Øö°p²Ãp±Ýº9MÇtmÔ}ú…yUÁƒBC´6£hê?vÙ »í&<<¿ô»/Ü{wkÑ¥{s+ÉS€¼/+ÁUûG®ÅN‡W” ¶¨Õ¹qKŠy‰Ô× øŸâÎNòÕy?¤¥)_0ûËk·oÿ—¬Ì16‚¹x’mæ£í?üŸX~QÄu:*Rß®KùÙ»†ºü¯B~^¼›ûïËk€ð?¼Å°oxûwAaLÖðà[r*ÞÃK5}þ?RyUtT¤¡ðAÔ°cu² o`0`Àÿ,Úz$€¼æppkc?ý—|;Á–Í–Yü3?™ÐÅË-þ5*3 %¬ú÷²Ý­ƒêÒ,ƒÈ 0ÀþV`€a€„ÿŸ»$™ 8Ÿ¯>°øŸ(&!UÀfþŽòcèAéÿ _ñ_€Ðj(xyÿ©]¶l™^§ÓņÓêÊ?±,”½xÌT!ñ1ªýQ3Å]z&K(­÷v† š%&dZ.;§¦¬gÑ6ˆÏ+ÀÛ|.î1Œt¶áSî"î;’° ¹¬t̾ ÓošÈ¯ÿöÒê1‡.’¡SH;1—–b¨5í£a/ñ Ïq¾/.Œ¢º)èé³ù’ Ü-ˆé;nâÊ¥<¾n+¢,D½¦‰:wâ_U+‘¢z}-î%O‹·&EX‹¸ŒÔú­OâÄ„Ì£s©õ3¦ã½™¾ãéf^|ÆsÄRTç‰âÀÁ„LǽÍþtÄ…»1}&О®\Êsض’Œø’0Õq™Ù@šÒÁs˜Pž,TÕ_‡{÷EXÑ\fæ$4™ö $„"®°¸n4õÿši×ô9BIÞ¸;#±Ð\ÜËË9À?GmØ^:‚r´®{—ˆ´Œ‹ÜÁª<Ä›×{"ªHÖ]Ý¢N‘í8*â5g6 NcèæNŸÉëô7Ö¾©†tÌH4Twao9šötÄ›ö'+/«Ï%;Œ®_qÆ×N¶†7A:Xa2[x{\}jîÍ{›Ýà ÿê¬æêi²Ë\ŒÀ0B®¿µCŸ/ÞtYÚ“kÔ§ÖéµFP•÷Þ¨DÁ&¤vbQS3uØF¾á7¤Ãß™šˆ½¾Z}v7F&©O­Ñ=ÍÄÛ/'Édõ韹R€ÄE9ê°µú’Fb_Ï?1IU¸úÔmä5@e/µ—6é’”F£:„H®>µF}j£ À©³Ä—Ò^بOJ¾JwrúÔ]JVü²¾©nØýç5l„Õv0å~}©–éÎÃD¾AäDwìGyvuFXÊÀ¬1Õ´5Ýa0ao€›RmÒþ}qÉÍ/Bù HË0"K5åæ@šIC°÷vjïÜÂ0 ÜqÆ„ê9Ū´ .å Ê>è¶`¦,çŸî×\= ÀÒƒî8”jé Æ-ƒé6)ï6ðþ4‘3Õô3ÂÉ0@•©º«[´Q‰Ò¡A€1tïi\Ôn͵SH+€¹—´³­öÊf}|<ŽeºëÛô9”Ñðö IÔž\£>µ‰e\e9ÿú¢úÔõÙ#HY*ð45|-³Ÿ-³“t÷U¬æäõéíD‚)þ.#áÝ›¢œ&·tІýÈréfnŽØGû47ÂéÞãAPhϬWŸZ£{†=¯«^%nï Æ èÖM0§f¥Æì»ÑVU‚J@šPMü¨vƒ¨&h Hž¡¥$¤b»¶’¦åÚóÇÈNãÃÉkQÚY]*+ä¸eGh.ìÇÚ® íLêÛ3[/œúµJcö¾tÇ¡”‡;`.þ”W[ºÓ ÜX\ÿÝV>Òæíù£¤ÿÄzržRŸÚÈáš³ëÔ×î¾CIe„æä&®¨ ”•˜çŒÆÀÄ‹²­ßŽPUšîúVí½g’A½ÿ¡ø+H‹gwìÙ&Ažנ̄¢¤(äõ&dý z¡ ŒÌ F%(T@š‹† ×Å¿®–Êz ¤&“ yE ” Z·pÄe*A©r^ðyÙBab9 $¦r®°„hèg +5u¥8ž/­z§s¡8)Šx””Ÿô„/ÊŠ³1þ=e±r.åby\*ò3'KFLÇe e‚Ç-qcµ ¨;¢¬h'–W|ò ܹí{%IG<ƒ›Úðyy ȹ—O„ÊBA¡Äþ°{üOŸô„/ÊŠ³1Qcò$a£b»ÆÀÈøÜ·Hž'ˆœ‰zÍ\(Ônራ¥ ±¼åté¤H'›÷›Ï¥% ¥9¼†>%†/ÌŠÞÏ⢠©u´,MŸõ^ŸTñŠÏ7ЧÍ@YŒTå\NaiówÊKUŽåÀ©¼ é)Q7o}ìTUȧ¾tHYÆg%bñŸà\æÃpéÄ•¢–ž€ò’H S3îm.Bb7é¤Õ’]ÀHGO¾ÄT<ú;ª©;€€eH^AؘêžfÕç¬V>’‰ëDí:b&&ïZÌ«;ÊM$;M@\ì>?‡}pJ—ºýã¤ÎÖEžâK¸eS¦OG}ômªk(†Öù'œMcSÓpú7Ì/fæÉ?>)¹a$€±$^àóò„Âœê>‹RŸ×¿ÉùÐÇHú2.»0SqïÁ|òCd;–ndy f<1._,êÙ³ô5úzOõŸ4tFõ áãnÖiªf¶|~>Ð I#ºû×â#p†Â­Zòù”xØb‘ŸÏ¿¸/ç ¥Às€X¤(CÈHÄDò%*Ð+‘¼ 9àRb4§]q¾ŠãÓ_b.é¢ ‰úH¤{ow îæ~d™ä‹Bþ3®\‡U÷ƒŒ5Ýw:ÿú9¸Œùå$½A_Î¥¾¾Ú˜è¹§w„ÒB¾¼x0òœçñlL"en,¼çós„ÂtÄr€T\ü#¡²H¨¬žAϧ½¬!‘ õ$­tºÔê4Kr¾L…[8়PVŠÊRøì,¡8éXŠ2$¯ÀíìµQu­ž 4a×^4†°3Š Pþ=÷icRÝE}ƒ¹xëIàâЭ¿|aÁ üx¡¢foÂÚ“¸PÆW0¤Ìˆn"á *PÁ̽7¥\b¼PžÏ«¸ßðh’Ö’@>ñ1Öd!£ ”«©>>I2 zýZ‡à–^܃k|1¢Œê>D'Gò2ÄqH^†Tj@&b0 ñ9ÙÀk“)ÜØoä%¤\ƒßþª 7Tš…X3sŠòÿPCÿógàJ›‹Zšk”ï'@9Wñ/¶Ê‚9þm6G|=Rˆ12L*„pïÂÅeP«;ãF&PŠHŒ1Æ .1Æ¢Úµ#š¶Aj hšGE²E§øœÄeøÊïÿ³¬â2³øj6ÌÀQʃs>ÊC)œ2×F|ÉéÜe¿T¬ßŒ‰€ãR ëjB„G¶™ŒÄñ¡,¤“™Ã/ìÝ´-MF¨_ç}ZR"m˜#”怨 fñ/€¤…ÄëỖ4Q) $ÁשÀ&–#Á¥& ¯Ï*^Ÿ\&8‘ÍX÷~›ðO$mÓWGåH+fØ$õá¯jÎYvžÞ€¹ªHŽ^+[2‹O@*êS‘Ná”\-±ØË–ô¬J½yæÿuUéÊ-Ó‹F-Ç¢c‘@1`d†)€N»o Œè³ƒvD¸ü¨jÛfä÷ij(^ kƒ£Lá=¯9÷ìw ¤NÒ©;õa“ÙE§HÂi.÷ öV…ៈ" ''­*€4#ØÌ8jÐ8x|^÷ä7v™Æ=‚ôqË1šr1Ñ+Ì@U+Dˆ‰1R‡{´‡»Bi´»¦â]™™XÆ6u¼éÖ†lèÉÉ­c{öîF¡˜ [Byœróï¾L«þxÚ9]¹qí¦ 2sʈÀÕŠý Á1TÜ®³.ßœäî(vì¤û.%¥78í$êÒVyð»w!éÜùÃ5u“Š»7ÔïHÂá7+K¼Æ2^~ÜmCãÖº;Wˆ&V¤“Œ­r$²p™YY€ˆz-ä_lÓ«H?¦Üö‹³þ¹1ÍLUÇ^‚Ù à5t@÷J  €3SViOLyç¼i!²ÈPGdÔ÷‹Êž^M›¾kãÆÀ0¸Ä„§ª7ÕÀè¡‹øÇkß…,} Qî{¡i)ÜÒV“jEÙ—rQòúÝbâm¤®äsÕ)hŽÌþ5]a½‘$%ΘéêÏk9LDaK4éO Y€‰«­)æÞ—.X©*’¬vXã.’i0׿–p ðÉ1 0î ù»”›o¿+7› j©¨k;^ÎaÔ{uíaÞ³C[o:`%ËPÜÏ?¸$²±-¹È4¯R¾&ê|NýÿcSþ|Ö‚Ô|®\ÔandIº5ç_ÖòÁêËÕ›ÆAуVpÕÛ½“ à<èÙêÁ=Ÿ¥¾Ùiè¡+ÊÁ=ƒE²æ˜£†0»ÍWè…¼WºÈ›²‘!-Ëâ’£yÁ_dgÍW–P}f —¾äŠä D­U<¥1ϱb—LEù8¹zëX DÔ€¼œÜTÔ?”»øݯñ ´Šú½,¯å5,Òé@¯E„LÚbÅϸ䧼>ZdoÏ—$FƒƒFú ž5âÂg"ÛÁ”*·fð'–€¦fÄ€J’ÙÇåÌì™Ø8°i'éî¥>yðÓš—†›Šúå..Ez„<êÄžùš/DÊ7 HWþ8pŠ½ˆSñ5¦ôÀr`Ò+zÊ%Çðì3‘_š (&Â0@@$N¼€m§QøsMTJõëè~㹋‹µ¾&¢ßoˆþôÄ_‡Îb4ïÇ¿yý©9z’ƶòŠOÆO¥b‹fj ÊwE*¼¡<~éÕŽŠð<€éP5@…oؼø›ñØÃ¥ˆç@¨R“$…”…[‡x„‘"» ’·~ äÑ‹nÝ•%kO.äóï½P¨qº`€Bu:§Ús3€< EH/@ÖnÕ[¢å I¯2õõÄÿ~²¢|ìÐ@ šwÒßHÄ»CÔëw¯Vé¯mÂZ-yØè’‹>ÚƵÂëkšÌt£Yã°§×ùè}ê+—j¬·®C  )8ˆü:¾{v¡>£™4µq¤N”[¨D%ÉÜãföl,r7§Ö/€V‰‘(sy%b9ŒÀ0g e/¯­áÙ˜ŒþÌ[{èà»a‰ñö$¯ä—óZcþþO‚Y­ÎÀÌ)G‘&B÷^eG¹[ ê! Qáž­ØÇy`RÇ›¨¿±R°ìKšÝáð–¢æ5;¨ EÏÙĺS”H[ñàÞúË»AP¤€‰‹îÌz¼Ó:!M ˜ŒžÁ]˜É—*ÌšKúuÔœÞó^-E\ Òwæä„[öÅb² ÈÔ%Çsòûâ&žlzÙs¼Þ©O­ñ€’‚…¤}à°j,Ö<|É„ØëÜûÂw®<œòë‡K«ùÒÇœEj®V´(wÔ§ÏÒýy¹ŠWKø„zÔBæ—ŽxÀš bÜÕ¥¸ßh1Ú"îæ÷šÇñ5vE¿º LÝé–5³bQy «ÈÁ1Õé“ôàx%ÿÑVÈ¡‚gº³Ï`ô„ãËîþí0L©• `×]äaYÓrÞÞa3KQi •ÇÌZ€Ý|øû=ì>kQ§ë¤F>m¹Ô„ºlÑXÔm(&µÇô1Õ„”l7‘i¡b-a#1W³a®ÀÕi.Å1™{a6âQ3ø„t§.åŸÿ‰ˆ‹¼””åC³~„[šîÁ6[÷ƒ50ÖzF ˜.=@Òˉ¨žfNõYLi/«oD"YÍu7Ã]ëÏ“ÞƒI{¹ ¯Î#H:t'öt¹îy H›KšèŸ)D]mô‘gÉà”EçL¸eèî?‹¦"㧊Êw« '££UëW"ÀØOäß·2£;õÐ?¸Mù‡â¦&¤Cšú~þ'S×ôúãë%}¦Eù@”én>Ä"úϪØ6E­Ý²ÁØ8=GÒ='b ÃÌéïG”+Ó§'Ò ¤‹\sø­@Fa!si«·8Ÿ¤S"í¤ÒÞÈû@ ˆfuV JÝï"i%t÷!üÛhýëÐójGºm.é.`†ÓÝÚ’T¶ZX›É´¤,Lø7Å{œM RqCyÿ à6âϧ‚úº^=‚égxàní«îÈ؇;¥3±;ç Uÿiš­ˆ<S€±3ÿâ*ªŠæ¨yL a¦|ü).ñ)Ýç+Qf9nL‚:Ow/¬Žò·¦šˆØ"%Õ17"ÀÈ‘¿ŠtylŠBÜk$²ña® Ôk–H–Š›—i8=n-Á¾@-êDýãgàÐDÏt5Sû1Âw„îÁOB•öÚ=&hHõ÷6æ1JŸ~€Î:´ÅË®i\ÂQYẠþè.Þ8‰ NëóJ 4à5"ªm_8ƒ8 0ÀþëàÁ‰éû×½¶ w¦ïÔßE•Ê”¢^S?q‘¹GáI&nnÿ;ËoÀÿ pá·7 ­a-J[Á°{¢`À?¦F' ám)ýìºó NlUÑx A›ÿ*°yñµU yIi‰©™ÙXËŸ ijlÍŠNŠÂ±_=Ÿ!ç…Ï F’$†Õq"$p‡‚"p¬ú#H«y<$Eà Äó,ÂIŽåªOá8AàÀq5WÖ+É¿  <Ç N’ŽjŽN$Ž Hàyþ?¨ñ<‡ (Ǫ…Ìñ…ãâ9žÇI‚ø îÃI‚¬'rçª5N$Àó/ 'H‚øT”ƒP=™ ç8p‚$Ä󬀀 H¯ljÉÀr<àIx}Ár¬@à$ŽãñÕ¯#Hôk®#B‚Àñ<`8E’õ^‡ý}âãY=ÿëB’$°wŒ pœçXV}âÏ(¤2Ü»I¯VÓ¯î™ßƒãØ_Öô$…aˆç8IRü¢‚ ˆ¿@XHà ˆß÷á”Y“‚šß.ýìþË;Dÿ_/%2Ó$û¶üWÊ/pz§Èšò zN@¸ˆaÿÙêkYÄÐäÿY^ý4ÁšÃ¿ÿfHŒd"‘N¯ãXî¯d-Ú !¾fS@u0¦¡Ñ¯o´e«Ö¬z|çÎÌ3ÏzZáÏNmŽª"Ô™_:-8:£Uí¼IŽìxë"z{'»Qضywçµ»cꬎ~L‡œÕðüùHð¯Ž.î²ñM¯&6Ú’„cƒÝÇ^=ÈëÆés•Š~ã´hûd»óןrÀFݹàÒKWú_Z’o,?q·Äu4%ÑC¾ÜÒ×ëέ—»:»fNm‡ç?LrYrð‹Ïj«€­HYøÓŽ'·"6Ü}ÞÆ ¯ˆYñÅžœ€6MMýÆm)ÌêÝoè«#?Øô¤‹»eí^,vψCeíEÉל??2£“mí’¼¼¼û^¾Ž/Šy*›xt¦Ë³—Ûøxß=utÄšƒ¼-?Ú¶úëtÆË}˜âºôÀ4ïcK&Ûöʽ´ô–;îUGmŒ›d~+Û½~I4)|ÉŒQ¡¾ý‡&]5xócû¸o‘º8Ø´ìÞ£¹Kí õå–¬¿êlÍ_½›uòì©ë[¼KQñã×ösLv¹ræªPöõu|ï£ßjSûƪg›ÖŸ¾WìyõÐZàKçŒÝ´ïˆ7‡—öZÓÃëoK4ãЫÒÊõ{ÍžÖÛÖ­g€eøè命üŠó±ÙóGŒé?¦ßèþñç6¸~umZ÷?£¾>¼ev§«¸|îtÆã° Å­¦»vê9êÕ©™Ç2{¹“ÆÍú7WDôß]² XvæÔGn´1'þl±”GÍ< 3&ÿŽ Ý%)Ñ™Ã"Ó§· þ?l³`l*˜YVÿ­ò«Ksµ[sIM™ÄfæÚØ7 ÿC¬2·Pïì`^›šê•¥rd&Årµ…uñÛlc ­Z)1w0&• ÜÎL¦“çihS†ÄË‹ÔŸNæ!þ.û+€aXÝ1á_Âc¶¼¼´W¤Îë±åâ¥ë—çô¨—}2ç3@yÏ,»o|Å~ѪöÀ²I‡Ðõ@ùfXh9Ǧ'¥w á« NîIÄ=†öà*úoòšÝÐÕå#;–/êqª0Ú2xÔd´êáÕÁ£º2LÈh}AøµKm]þ½Íóì½b¾Ó¢…ä雎š5¦_ If—ÇrY° Ù[Mº£™ú™Q-Ðæë~Z7áe@œbÝ7{Ú†.D„Q{O3ŒÏ”Ë<† qKY]ªª³®éó¶ï‹]~Ü8U·ëàŒN jŸõð…7 Òäë'¾£'»-ûù j[vábBú§ÂZ0|äÂÍ xÛÞwòmÍòfŠñ¡ÓÊEmˆ|HÑ÷{}»5¤6¥g‚ùÕ²Ð|•Â¸ÉÁ!“×”*5ö¬¦ª\i×Á®>ŸYtZ³²€–ˆoS †~½Ô…qmÆ]ÖÌè8pôdSO?èS¯d¦ŸÍùÎÆ&dé ^^)v28$)me¦\𷱿àIÞÚ‚ý×ø‘£'‹åº³Bק·´Š)ófCG~1°==âTÊÔîž“ƒ™ ™œŠÞD§õ3ÚôiKî©vžXnLdÜŠ0víê¯yyõUe›Nµùæ†y£Þ f‰Ù¼oÀ²n,YTjJËͺ­7ìñö)aé´¤4šk¹f–óæMQfÅo+lL©KN–ÿ~_„˜ÔB7|á;¿_g›®ƒRÜ»þªcŵÃÇ£“€+{ÞiÖ£ëäñGÚMóÇ&ë¤yòU{Ž‰Ò÷9^^â°Žõ™úÕ$óZö’Ó–­þaa¥ŽWèL7nZ'®K îëöÓ£a­,q¿¯‡¶œY\2ع‘3éÔ]ýúæã Ò©›öéänüìΙ-Ebx‡À`±:ëü•û&–Æâ†~<ŠïD¥ËqNcîÙ݇¸qõ5­•«Mi›öC-NÞ-Û‰YÖ¼u°¿!T]Ù¸¯ÿàq&4ÆkÊo\»Ž‰Ez0 ê¤N¼q'±RLóIæÞ³‡w k³ôÍÝKy'6H¾¸[Û´gZþÉaã¿" |¤™lqã=¢C³Â—Dz¬úµµ“!MÞô£W ýö¿:®¢¢Ljdô³2苵„­õ¶oÃÝœ?âÝ2¿[Ø“ªÍûï‰Þ[Û„÷øg¾y5)¹n÷Èi*1Ûïv§0€ôè[BÈf+ ‘rcËcãÐ>ÒC¿Þ¨I|E¶þºAMúÅès§­úÏÅþ¥á¡ú0jðblj‡æ™W"2>Ãu1¡¯ ß?fáRé^^†8e\ai Φ3pâÏLíçRÔ«»72¼0§Ž7EДæ°f÷·­ô Uoß{hy]á¹ ¾+Æ8Mñö(züö–ŸßçµOÃûv£|ª‹…6q RY^âÐÎçê–í]GÙÅÄ¥5•ó¾µüˆ@5 n”×»»7²ìqþ‘tЊFO=6~Á–뻊ߓmYÒÕÛºvã ‹¿µsèœyÕ¬Q[—Ól‚ŸõG}ƒTƒþMU½»{³²®¿jð©ÈUFf`]ì0'¨ _ÄÝÙ³¡Í€e äå‰rãZ.miâó˜ª;o*Bg×½Vÿ"Güå÷s]ìMi|Ͼ]V}ç;‘ÛÌ~:Ì}Ç…‚c7od³±g†ÎXsaÃÖ/Gx.zQž°[³[Û˜)ú2kÌ}ÜÔó«¹ß+Ýy‘ÒepÈ,ýƒúZüþ3ºãá53²Ïõ¿þ:kZ‡à¡¸% IDATé }Õná8—zò!hÓñfWi¢NÍOÖ"oI½óˆ¶héTƒØ‹ •³LšŠ#Ž¯Íé3{ì„ÏmÒs”ù&n,ÚôÕîg/C~ZÑØΗ19~ÞÖtÏòÁvvv 6}ŒÿÁ;›òI«6Ýß>ÉM5zMÂÑͧ•à1ƒˆyî²fø0»zÙíÚãÅäùùb›)óH þ&|ÙA˵_y›?:·)-ðóèc§\|éšnò¢ÂϧÅÔ*fÎ%nÛ ;÷ÖÖ«®ZO9mßµ['ϳ­¼ºïåá¡ãû„…O”u*ö¡Çôæ-íøŠ88úÁDÿÛ{(##S3³Êª æ׌DÁÊgªE÷^ÍÚÿðuϤØO #g¬Š¸u|çŒ!_–¿·žIS1å0¿rþDL_<±ß—?žx~`ÞŸOQñ€½{ãÚêiÞÀñÓ{.­ëå3bÿÑEý'T™G¿ð èñ.@¬¿]üå wg©†Ô¾û…-³íýheoB@ÌÉïv\ÐÉñc"ÂI Púwè5Ô(錼ðòeåg÷#ÎO¯Ø{¯N"AŒ’0H°üîØvVùþäpbÌ’[w.^ZûÅœ"[¶aT›¡«·³c>))EŸX¼·lÐüc‚8|ÌŽ§>¦:š¹vœzsÕp—€í½,ë²<¾ôò5dDÂé)eû"_™¹ùumݪËÈuöEsßËÑ$¨¾YuyÓ¾Ÿ) €ççW¬Íê» [c €spÆØá>îäË®Ÿ+hr?"áÖ<õî›O?Á´µˆÕ¨ÍD.¬ž§úÿxa`‹¿² ¸Ø S«j§#áyKÚm9d[O´Ì¶ _ÇŸ[ÐÙ/G®/Wò-›y4jä¾öäµ6Ò*-eIà`joA†“8N14IœV_¤‘xyx4rm}":ÚÕ§%b€S<ÿ±,(¼*Ofb‚fdïV¦øX.;UþÕÏ×^0¶u¶5§õÈ,Œ™6ñ©vl¨* [y7uvvý|Ñ®‘Žúý|`Î ì‘^Àü¸fYÒÕZ9'i¬ÛO>ð•ëá•C·ÓV–aŽ»¹4í·gÿf q’b('9@šÚ˜c$mIªäº:‰dÔy>Í›:;»Žúz[¨VÆ›™IH±ñ‡§£pœž#wžŒ°®9Ïk«X°_% ÖÙ€_ˆ ¨TJ¡n#úÓY‹ Í¹zõVzÚËM{ï»6¯ãåFW˜›Y¥RçfÉYîöÕ‹/““c…³V.4 ÈÏñ¢X ʼnWŽÝ²hÆ@EQ‹QeBbjÊËçz©= Ï»~·¨q3  ¶½ˆ–õ`ߨaKŽh*´¥ wuéP3vצ,wìÜXü¯n:eQv~¹¢¼° ¤qÚø´)ùå“k #'ªÚ¹0”qÀM¬®P¨?a!ôüä7»b¥K‡{æå—‚ÌÏ‹H¼›Yx`ÓÅæ-?c•E1åe¯O<©jÐJ†À“ƒ‹·œŠŒ6/OŠKÍ˹þÜD¼‰xúúMì%–­íiÄÞø1ôÌ£d`U™ãFÍë3i&Wš«PÂùÅï «Æ4+È/áp•I‹òíÜìÞYý·s笮à]yN^‘Z]‘[€(3yÆË”¼œ»×cŒÿŒ ÿOÀ“…ßÜ·/5ãMøÅˬ¤‘SëÖíX™’mׄ‰½Û›¦m¸ððmJÔó”,Úxæëce,yÏëʾÊRö·p¨£\¡aZ58¾ïœžUE…ßR›4÷½ˆÍÊ?{)ºÚˆb5ÛÄ`Ķ¢sïiÕeá®kƒºÏ%Œí“ÓòµlýÑiPw#>#ùØÏgüœ?×ãTy®Ÿur—ݼšúÁOüÅܸy×ÝË7—(U‰1‘%,›]!ñiÑ$'á)‡€}“Z4ú›‰nÊr¹V‘˜‰yÌX´–(,ŒÝ‡zfÝy‘¥,Kz[óu¿nïËÅ\9‘“õZàjBb¸ÄÕ¸(+¯P£ç4íydÍÏ… UrìýBÖÏ£*>¹0ãÕöC…4¶óníëm)c AŸÿöÕŽ-‡}†Ï ›WÆÞ{•ö:âN’›™ 0à#£¡eË–éu:µ QôŸSWMÔåƒWî=t úvr°_í0'⻶¬PÒfE Oe~A’ì»ç.O«2Û´i‘-CbÓcŸØ¶în%¡ 2ã³K 㣢ã²|ºõÒýfØÞ¸"É¢•ËddÑ‹Çà9Ø×ÍHJ$1’k$Í›9Yéä‰ØgC÷üÚƒO-L îÅÛv!ÞV•GŽ…U6=mh Cþ­Ù#_Z¡oßÚÀpó惘¼;'/ÝÆ´óõ´¯(×úúyý‰s_õ×ãÔ½ÚÕ$„åÔ•Zc÷Ö怑­Ú¶}}sÿõ‡¯=ZØþ?ö®3 ©e[ÏNO ”„ Q¥YÀ Š"Š€Š"‚X°wv±ì»bAQTl  Hï%ô"-„éÙ{¿x xŽçžûî¹Ç÷N¾_]föZ3k¾Y3k í%êBû-ê„|~yéÞÓ·zÓ"&0f[Uk~sýÑSÝÚÑÖÖÎiÈÕs§UÕe<Ê؉VT‚Ö0¬Ljn‘™ófûöæ=ˆy™D2=bSÐÕknc Ä\±²• “†W·¬zyþQJÝè1ö„_—ŠUª-¼uóž’s¸¯ËP‚¥Â^<Ñ­4 nµ!.ĦÖ:Ni:ØQ×ï:,tã£ÌÕ!TæNä¢1šaÍÑŽN“uoF_æ+è rvRòþæÍØ—ª®{f:¦ÇwÎ&¤”¯]c¤©iãê™v?*!³Do¨‹©&€U‡S ™±©©£n­*ETpoÞ¦­Û»ÏœF²ƒ³ñõ+—Ä*6Ç٤VܼS/Vãèàä61ñöÉJ¡ª©‰Í8Gã_hÉDÝ"Š¾“9 Ee­Mu™¹Y:Î!¡³GbñÚƒUwÿ£&ÕMy¦f†ßÏè¯`- ( €ÿkó›Û{ÊšLm:V±ýBþÖò•ÇI€BQHLPà÷Q(LšŽB (ðWó/,~e-1ÀbS@þÿƒÛXœ]RÍ´v±Ðî {FE͹urCs¶úŸ|R˜_4ÈÊŠ ð»( ÀÈ¿pÒùa§Ê«Mž:‚Âbþ²²ç×`1wûâ‘Fzº mr€"é–Z™‘;:çp%"ûZŠãÝFPÙfì o P×Üg­6ØÞáu½HÞm¥Odëõ˜„‹é•·×ë²l}¢ÏÙgE*ßìbB5{M³Eùë£>fúªkÎ$ (úOmhÙ‹P{SBÈù'DÖs`‘­!}Ó…×(Š~¾fgA1wtÎk ´«2dÖP}¦aEå[昳M{ß·¡(úôø|}Êè9ëÚ…â<ÑžÆä±C¨žK›Äežskó0s’é°áÉõ]¨¼3jÕ¶>iÊŠC\é£ɼ³Å΂bîä’Ï£­úx~(›4~ñ¡N*í®^í®§oÄ8Ÿ=°Æ(úäØ<}Ê¿ "˜s?¬¯YÎ:ùhÀ²ÞŠÀÉ,¶±æ拯Í~°ÓÁRÉÌÎñó—9÷“>‘­OdéaV‹P@wþi×ôI›úŠ{q&ÐDŸì0ke‹þ¶w<‘­OÐaâØúÄi›Ÿ¥­aÜM­ûY˜ñ§ƒé“l'M­ê øΫ0ÇA¤Å§îÿ¯ÔÕýÞÞÔ¶@ø퇮gaËjŠÉmøùQsNY]×›TAí¨ÁZ~Ê]W û3­7ºàYú¯uûzå¿a†Ro>ïTd«€#kygvï>WW˜–âÌî· …Á«,ÞqÏgœ9ÈÂ+")³%áôJß K¢þ„K™9üb|uAêë´ó»Úd=æÌß|§,1*pûªC0cþ§’Ž’‚2­1Æ,°CS‹‹;nO{ 6ïŒOÈê¸â‹ì<þLÄÍ8Xᔚ_fX´»BòÏU9Ûqùƒ+!} l:ŠÎr–WäHžÓ¢g_Y57è´°¿ pJÌMGŸŽÌDâ`¾äaaVÉr;u )¼U¬ý¹´í˜Ý›—ù5ýµßµ|ÁþgU—æ68`›MÙðæSKò݃«×œÒÔ5Ñ…_VQcÏ>Ìúa¤±F?KnL8½|öÂÓBi󉨧ñ­»Œã®<ÍÎz~Yñ¡$?¯éYäÀ,,’ÂÛ¥ºŸKÛÛ¾N(¨ë¼!¥¸¸ãVˆç€°Í—2 >V}·±J 3j2K/js3JG…{~gÜØ»öc«œi·4æòŠÿ]¢¤êÞnÇaÊë*ÿ°ikˆ_À¼lžÀÜc;‚·.sÜr’+8›ëN_´ïFÿk+aÃÇÍ‹'ûø”sÝoÖ,r9Ë3©¢æç-™ëÛÜ›½ÈÇùøÃBDÂ]4åÁÇê¾s—QÝÁ53|uIÜunWÈáuÓ}C¶5 ¿%‘ôÇiõ¡‚knÈQÙÃÁ3gNØr:V$GŸ]¹ýüËÈ€q3Vœ"pIÜnßY.Á›÷5‹ € üwX Ò]”’ßxùÔŽµKç¿)úÒo@ÀâÙ,6…ˆ¢jj¼¿zñ`·¹q•ÕtôšT|Ž¦§ŒSZ°eÕ«[‡£bR}Cæá1x%%ª¤>;…µÙ€N$jb‹O¯v|ø …p8T°‰DÒX™.lN1q¶IOÊ4³ÕßòÍ@š¾¶ú׸J –$ê•àp §µþS¢c`ÂРa¾Áp+|§7O1d³H8,•ño§ö¤>=¾1èd| B0¥Ù~2êàÅL{ã~Ëþˆ¨1¹A*ŽíÕ6ë­HPeº&çÓõ W/yÎq%ã(†&&ªÊÔ/<”Ébü0Ò‚t Lt掰Æv~Á3¹I7uœÇÔÖ”a±¸Þ1 ÷Ôvõœ¦#é­'£^Î2´3bé¤ò3k»ˆI0þ`ê,]"Ì“©Ñpƒm¬£AÇ#<–ÍP"GQ¢¡ž7ˆë$‹‹^…¥«©þ5"š`<†Õ{"*òT ËÑüïÌK$+++)cq$%e*™Ø/üC1BêÓn?~Ú V!á±F*¢K±e(*Hà`Óñdš¶ºÒÿ&g5*ë>s»Ã/tQÃÛ€ŽÊ ‚ÉÜs»-˜¾‘/—¦–øˆÝhþöÖ«œª8žˆòc7´öy‚ea›ö9,=}f¨‚Hº‹Â¯\>¹+r×ée›‹wïë*¿ò y÷P ‘~þês=Ð" Hì¶y’‘›"W¹ùúíëFä%Ÿ²'m½·Þàm\ò7éU YIm˜³KwÖ‘µv[yñÒM»Æm9í3—GíY6%ôzÒ“3«) ÂsâÂãeVugc• ü—X K%ª¬C‘çÎnwŽ‹û~e¬§»X½Mþ §+,éØ»vË´•[)¨øcì}Ó‘3&Ú0^=OQ$-éiЮ%d ¤ï¶<úÜè{ï²oœi% Ù·sƲYöçrºT1("ã±H}]ŠÁI䊹 Ð̃¬8§§{úT©[ÊÀoHÝsøéµÐ‰ßYªGQD"ïž»úøñ½ë…õ›óšàÉS½­)Å%MýîD``{›J¹B¿tbÌGxŒ³·LMÏ—"EdUÉ'2L·ÌÍú¡¤Äoø¸÷Ø‹¡ãq°` Îºb‚C`x˜kˆúÃ…Ó¼y*úr¤_“E¥ÍùÍ蔩ÞVä¢ÒfkBðµs7®Þ}[t÷l“ôÛ>"¸}|·Fp4 ô4gìØ}ç\è@;²NŽ˜?‡Žƒ¾;`·äÖ‰&Oõ¡RRT×ñƒòeÒà«—."·îó·z]Þj9Áµ3>JÒô@gÌDú"ºUÌ«M„œäˆ6hú B¸!Ö*Ú¦zu¹bDÅdèu’ùdŸŠºšï,ÞªÓ´¦Z¬!z*”î¶ü}ëgÍ_²¤ª¤H€|§GÀÉ¥r—±öú£4*ã¸bTIÏÌBƒlnËêíþí…'ƒÃ¢2¾¼±}þüçRÚœáYeÖÝ ynÛ®$ð[jÆJþK¬C54¥~ÀÀÍ¤è “±îsë_ì–`^kƒF¨œw&`Ĉ7fXiiçÍdéØÑN£]' ?ßÃHëâ?t™‘ú™‹3·íñ ÙklT‰l'Š®ceAײµË{*«Gê*Ní›èS·œyð2~po“ ‡ŠªBÃŽ‡^Õ"õ #HWk½H>m@xe[ ŠEÀÀI2ƒ‘Ž6óƒÇ§W5äRAc+CÑJm7žsÈA©£Õ—Ä]ÞÞÚú³§KMËh”[@WÒ]®T§\X£~|­çµ·q6‡ŸÜrõ¡‡U¢"à:¯=«Z“£ÍÐ'¨™{™ðâ¡ £cB^k'_€ÛåF£,lüûTÕÔ¿YОŽF¾PÒ7à=Þ6µÑ|Åæ)ÆPqMئý›¯Çë)@ÞµõªÝ ŸÞ kiíø–ýÁÉ]' ë€å“³8µ?l{Ã*1&ù¬»pdNzUNkÔF~ÂÁ­ãFØþG^ÞRh?ß‚Ub„yÇEw¶ò`qW#Ð%ã žÖ1 ÄÙjTå>ç¡ þM¢ :kº~j ÷oÅ.8—ÿô­íçs ßÚÇi‘E­< ,îiÇ2)xð‡¶®£²TÆœDh¹Ûš÷òeÚÁi?ŸÏ õÕ é.:v«åþ³ŒèÐÙUØ*øŠ¿<ƒD4\âïè5s«ö_ë7—t†®^”‘õaÉ éÙWWÄçUK¥Ðš³è8à®#3¬'Ü«¯¯žóüø¡\¬Ã®€k$³£—O=à·3x2@QÏ-G)8¨æéÙ³¹}Çt½½~&6M*O[sžGòn/Û[ 4ìöœB¡J§‰gûÌåd·ðm†& íUŸS3sE8u-5 ,lËH}_VÓ¬Éd±ýâËPX\–•”]X,ªh«+µç¼LÉ/æp*¤tcMr¿;ܺŒôäRN½²†®2j*ÏHÏÎiî’3ZhoebRJ%§ŒÃ©RÒ3¦â~ý Êm(HOÏ)34•I(,©ÈyŸ]P$€”4•¿Q^òžÆÌŒ´Ê†.6Kn}AʧŒVNG›&ïmÍLK*æÔà¨ZjJÄÖ—g~ÎÎÃ蚨á!€Â-œÌŸ³x¨Š.*éªMIþPÝÜ©Î`’„4#ââÌļ²Zº.›ÔO>@ÚÛžöñ]ie5JÑ +;jó>eeÖ¶tk3™xÌÒ¾ÊRžd•–q8eNY›XMO“RU˜’™[À“’u4H™IñEåeõ­ÝÚ: <ö?\iç­ÇŦù£õheA&†Îìkžˆ¸-=³‚©§óŸê÷°„ÿ!)¡¼²¬¡£ÇP ˆ¤øcB/ÍP ´¿û¶œSÆá”IðjZjÊE› ßWð€®†j[V|JA)‡S!Ó0Ö$ Bñ»ƒ˜YO4ÐT¨¼äcBFMSU TʯOKK©¨mÑbëW~NFhl%Hòùü¦AwñóÅK<:Œ§ŒÐè2G$íéß—rªå]º2þ_üzæ¥'æ—–‹±êšªJ*-O}Þ©¤G§à; >}Ê)ikRɲž¶wïßTrÊš»¥ú Mn]~ú猚/]ÚL=<”å$guÊ”´5T€¬;?=1¯”CT×Q¥à¥]5É))u톮ܺ¼ÔôÏ|TU›¦ÜS›”‘Éá”óˆZLÕo&9÷ûLšq ðd{Wú™¸úP¯e!¬÷oŽ1jJÓ³r ðº&ªx¨ª %37—Ã)ãTµ0 €¨5åý»úN9CGKÆ+MúZÉ)ãpjTôM•0òª‚”ÌüB¡’ž• ëmMÿ˜XRÕ Î`Sð˜¯ZmåŸÒ~¤0¨³öSÚ‡òú6& ÿ«Ñ­½¶ JNÓ¦`åŸdª, V¶?<Ìrì$òwû‡¤·5-å])§P4Ô•0™‰ E%NYmc/‹M+Ïþ]XÌ“+3è*˜~*G¾ä¾‘©²Éø?y‚ )Kû”]“5è*¿ÒŠrK>$çäõuyN³TŸI-ÏzŸ]XÄ“S4‰ÂÄÌz}¶¦¤3õ1¿ê~°°%+#µ¤¢YOŸÃ @OO ®.“I‰D‚PE†åŒÀ°œ¢¤L$’þrkaÉ:,6“Éê~³ÿy.¿Ÿü¤Ýñï3£OGäòК¼l Q½3÷Šó–·òµðÛjÄyqàâBT^ò1K¥?Þ>÷x6,.xô:—BèÙ4Õ<¿¹·µº¼¥RE½VG‰Q€¢pY´_ðê E=ˆˆ›ë³á*ÃPçÚš¬cIÞzñä5¼ªÆ£=^»sd‚¦ó7"ñöE3Dzc­Çýr Ì}ëqàƒ¼¿ 3ïNÞ‘hl¤º+$¨Y†ž¬¨0™lõo,GæÛ‡9í€ÜùbæêyûùÕöüðÜ-1åX‚ª.“ÍdjgDo•ÌfŽVfÇWÉ®´ƹ†½40R\áßø·*KX“˜öùÅ·å@%Uk-U54ýlYŽ IDAT{>îav[uaBR”,Èô_´VôMJÿŒ´¤¤ø#oÚa@wÉ]Ï€­d ·³ …»£üF4SŒùï¬<ôrÀcuOÖn‰N£ð^Oß÷z€ zy µB’ Ê Z*@DWŸêJ¥O·y΂˜ÈXU†&eDZ·šL6ƒFéÍÙºìÈ#º–JÞ‹ÇR˜ììc]¶nþÅûòÿŠ*£(, %RŠ¢±ðþùýÅ|¡H,G¹ %3"âTP(‡–‰%‘H(“Ã??%‰äƒšQ™L #¿]S)¿~û “­£¥Õ÷K[fôÂm¡/›E–¢«Çf2õ¸±S+¹¤uËÁµ§î%€Ÿ_/Qc2Ùê„ß2¿~Bø]—ÁÚXÔºzSøîÛOQYïâiΟ:¤^N™½¹9³CZ’°mo:¤®„×6ýØF·osú ˆèòÜ!/ªåÄîG U(,‰„b‰EQE¤‘H,K$¾îÉx–^CM+gmËÜÂ'aËZ@9Ùñµ%çï~æÍï·2˜lPÉõcQí¨RÅË]“dÂ’’{O>*Q‰å™1»×>l0¢·-;,‘wîp³l"êÕ=Û±þ^ŠŠ‚ƒVÈà€ÿèÆiýËÓ÷ “ÉÒ8 ½y{ÂVû?¬|WÈÄ"‘P"ýù|–‰eßäk@Q¤úɦ ›2xhJjrƒÈ÷\ ªÁ`2Ù:ÚÊ‘Ñ)Èžírý,×I>9ÿÈ«:I]—Éf2µÞGïX¤ýCøŠÈ;*ê*u_z*¿²ÓûI ¢†åñ2,iûI˲’Ô4,•^òdÇìcY0*Ûâ“ÚŽ£"­Bi¿Š5g><ø¢A&Ê`é‹+»;QT,–­Û¾G °T,‘HD"á7-ôrêĤré¢å"€ÕÖÓc2ÙDnöÖ˜&H\|ÿy†I6…VÃ@¶3Ï..oüÒaäRÑO]–IúŠû6)€°9k´÷v"…·aŲ~¶$š.“ÉH=½ž¤ÉdéÐ Ÿ:Ÿ¡§§ž’Ë[wtˆa9?kkıï5f$¥¿Û¸2¬[ÀŸ îÿëwãb•Í,lQX|¤\kãŽÁý®56­Û´«ø @˜á3€p<´bà9"Ú¦NóLQQ»ªÎ­b"Ž ÞL®ô²^ÈÎ;·Ù ]缎×+²ušjPa >ù„À¯O=.Zéj À@85¶¹>ÛÈMÃÿcŸñz»/\èx8«®ïnªÒ Üçæ<žÐä|ÁÎðtN0jÛ±¦uË8&ñ1añu#+&Ë”©«Š…ðÝsá9#¦Ù;0ÎvÜì ãÀ™q›£³çJ4À ÆyWe†8Èb¨–¨öI–Ü%œ8€ìcgl5ùr†žfh¥Ç2ÕcªbÿNeA*V«µ/_\ÀÜ\{”ã s“åŽ2Óæ.Ø:àjЋr¿Âøn¡ŠòúŽºyûâƒý¬Q§"wÏß…0Ê4š±›lÈ$·4ÊwŸä{m>ìdÀƒ÷6„O1üUˆ>eëÏâM–J²£´ùl4 U¥ñìñbŒøA?Õ1±Ñ!«æXµ%ÂüÐ'¶Üúbg¦fgë6,IÃlˆ½Ñî}³ï5Ûÿ8iiyqSwÚ‡ø¬K÷o7U¶uuUçè¦ÃM ²2ŽPÔQT˜cb>œŸvzFdÖÙ}~÷îg:¾¯3ÆëlÓDG&À;.ö0ê—öéqÔÒë©A›Ž{Ú}à PqÑõí»?Î^yÄÜYó¥×-û­8œÊ K[XôeK‰é ' îož³bÑ´+)_GŽ[QaŸífÞý1êü/…ªþ§5 ï¶ÈQÛ’šG¼ìãÖg»bÈ‹Û}½Îøî×ïY3XœQñskk¬j;T¸gm€†“ÿÃI›ÕÏlz^M_4•¾?ª8&fæõÛú"ëÙÞ>sjÇúqˆýïœê’!ÚøÖèégVOŒ½çVÓOËO´•ƒ0çÜŽ= ™é“ןº h£·Û_,'Fì€-Cı‹6S*Íãk…h÷ûnM ôõéûæ~{û¹:zº­÷ów^s /¹NèÄ2q0§0ûÈáËG¯_§cÁû]SÎ &„8“Oä[\ŸY¸óFßSjÃý¢w,÷×GÅt¦JšÂ ²‰y¶};–BˆØ9YØ$jgW/ª¿×:9?$x™“»[ebŒÿ¡¸öÓ³Ž4 _?Mãø'½è9Ý ·^ê»MÅÊ+l¼xÄ®«ÎÎú• w“yˆíg )é˜ Õ§¨( ±´Õ"b_¼iá:ÄÂØÒT¸Ìª¾¾M /K [ÄM^|¡üë‡{Ÿ>çï¹q‘^ì•Ô>üH¬¥ÏÕöZ62`ð„,ÁqW·Ä½Ë ¾ö@¾$ï?xë=mè<2€/[—”^6'Ô¼ÏýÕ”{N¼ð¦> $÷iÄÕ'‰öλ’Æ3‡Om?x'*3€£èXK·‡vÂÖK1àŸ DX}6Z¶o”¬æµjñŠñŽšu]°ÏË‹»Ö¦Ó„XQ³P†‚_±æ`‹úµ[ßµl©ŒÕ†ø*ZEq|Âã"=è …EoO^°E ˆ¨öBJïê].}W“ãâ-ƒvâ0ß##ÊÚ¦V­+¶†¿ìV¦òÃ( §é<siס½•M=ƒzú&p7ÃÉÎôï².¯º3êÜqïeËB­î߶™äzáàZ˜ÛêºÊtÀ"ˆœu~Öu:íè• B/ýPDtÎl:TÒrûáËÑ×~LŽÊE%8u¥_<}-ŸNÙV“üÈ{Ûó¿¢Ê*#7¸ã«¼šeX3+¦†Æ£í(0l˜¥²R±ýhð¤ç>f´Mî£Ú僽R±TcÐ䑆ÎAÂø®»êê[÷à¤÷ÑÚu‡n»(ÿÂÿU®ßŽ#I8û·Mù!yÿFs#ª%QzÕkeŸP#elÅûkv'=uûüjë-¯¯«2òbwÏÝñìÙ>ßOzŒÖ¥ßZàvBÔÔþ¬ˆï¯ ™:þ¢h´ëÍ“ŒÑ[ß%õ^õШÃgV?;ß³)uB7ì®~|n¹àKʸ°Ó>¶ÄgÏüI:öÎÝë›.B¸¯SŠÊ÷—ß©ÌWÂ??½ƒî®Ö½ãÛ"(zÃ?ˆ%õEìY9*æ¹ ÒÖ»÷=z­Ï—Ä­|»¿Å÷ªµžP:våÖ%=CÕ˸ÞwÕ#•{Š1šœW©®¦³uñüÉzM|é,m÷§DœøÅëO¿¼¶EùW@.hn}ÇsaÚºcê‘}n—­ï•yž}+Dˆì=ÿDêp¦ú À3s¾:6(ÊÐé ýw?OŠù½ ‡¶>›ÿ8 çô@äW묤c篎Š„{Ϭç(ÚįWa…ïŸ.pŸ±òCÌä¢Ú®Åwî â‚Î>´™Ã,N·;1]7áçáìÒñuIŸÊænCy÷sË—/žå\ñz”3z½Ñ/¾I -Ïc­Ñ™Çê$ ÎÒÚQ‹zýçhï¶ÀÅI²ùÌELèö çÜû„%Q1éL;¸ëú{ò ™}S¤·(©wJ÷k’ζ’;n›ïtqí•Z”4¨©%€[Å|7€±¼p´ ~[Ô1të® ç&ô‡!*}IÙa Ýí¿xûC¥F¾ü’tq Æy¯-9}pÕ›-›9a‹=]Wø<¨n`ds&ù­Õ0q:oó558Žª 3{â…µ ’Ô£«gÏÿøG…a=ƒOñÈì¼n~A¬•K¥<A`tœ·tß±xJ‘0І‚]²þÔüŠ˜±+öú¼:%ª{·ÿtÂÍk×h86}÷éé¾îÓ+]V¿*㼚aß\_•³#Ô2„Ñë¾÷»¤‹>·êe!†„&e‘ö6îYä7mGÜp-"—ÇnÉWº{éÌËcúêxçå—|AoÓÃ[©T.•Bx‚ “o2¶¿<ê µÙýeËúY–Žh¹ºm[úNŠzâ T&•âD‘fǹŽ,½âa@&j9¸Äßy}Œƒ6~Bn׆嬾®…Àr9ðø¦»"ý¦êÆÇ'ÆТwN{Ö,›£÷cä2Ækï¼ð¢‹Çe5EÕÓPTÞqé|Õ°³;<ûì*,—"‹Ç ¤0T%š…ËL†žª©½¶µäÄéôk3©_nùl;>ä P™T†# h$TeIJGÞ]Îoo)0_U€#`1uÇ-'7[39O°bI½g á®Oþ1[„#›Óä]<ÐTûú‹ú OïEÌ5{¨ Ï‚”4Ô°ƒÃC?/™õ[‡DùƒÃB(€ T,¦Áo—d<¹|lÁ]÷{gæ™þjˆDy-ÕY鉉ïSLF…˜kõã48¢²…™ cï¯É’këÊ6» xu"ŠËȇŸl´@òåë6|ÄP[þ®øÁ%‹­M<üI÷9«íGj á:iïÚrôwY *çÆ]~òáj$çéáÞú-1íä4ÊPð“äÔ6_Ž+Ý:1©Úu’ í÷¥‰¡[ù<æ#iIvž²Âãþ4SG¯õëõÝ÷ÀU  ‡ÇŠ›R—møêkaÙÇE_â•ÇyTwîøa"dT—§Å{^í®çcsb2Ù¿49‚m¨ öæÉ Є„7ö¯“ŒÚéa@ðÓ"v]¸vë!ƒ„c—=éß#‡šËç0TU]¥Lçuˆâ²ÖáÔy|øÜ¥[9×<™FKXgvïÒ.9Pþ•©îjÊë3ýgÍã‹•9T,‰¤_Í—ˆî+–?õhâñ…/Î\x×Ò÷»ÛÊcoêzž8w|©¦VÍ›xë.µÿò\geêSí°=ÚŒXŠŠÜŽ€âÃÏ>ÒézQAئ 9¨4t´³¾^»VÛÎnœ?Ëtˆ£‰¾dê¤ÇÏêzß?¸èq±µ‘‡?á>g½úâu§æM{à¼lwÌD»Ñ6FFzÓÆžláýº\‚†1­é~ÞPº¿gúÍ K¤!Œ B¤ü¢ëAa_jö¬£ ?9rËáU“ó…!#( âéÄj^Ÿ¨ºê“wGÞ¹wöÝA‘tÛy,^ï3ª¯=$'b‰„A!DÚ]zoѦÓ_©Õ°9{§êÔµªÜ½´çJø4½ïzÈZC6eÛ'oÇaË’O˜qq«†(·?_<ÿTIßmºs¯ÞñoÎÿ ÆKÖY²ñ1=~Î7k®²êÊ’ö®®º²ÂU‹§—£X6—KW%,pç^7ë±× DzՋ>^+éˆ>'VQWö—GOqÎM¶X‚ƒë/?q°¹,2’ýêªPÝBû¶˜éêOzý:¶`’kIJìÝç³-¥çûùýSÕÀ¼SKƲ/ë¢ÍµÍ8&sJCtÀ›!«®¾àÝXuæƦñÕjâ·[n8¯‰‡Ì;è6Øþb«©Mƒõ4òТÝβx;©‚“/ÛŽsøpõÈàyWIòÖ nnË_å›@QÜîõ1²SáZ•3Í ÁNj>ð­5MC¦† ø,OÏ™ù )|²oE¬zâ­ÕðÛ8eÕmí‚òÚ¶š†á󃇗¨»¾MmÝúw* µ•–s"nqi¹Å`Ó‚wwŠrè¦çaO6eßž°9ëæ©Õåå&æƒHðr׬—*KÎlò´Ô—Ö}ᶔç}Q³ãdwüðö…ê“rDfá: c\õËÌòÇG8­© «ïºìЛWúx0gÆÐ5gO˜Mà¦n`‘ óº >]8ÝR—“u3‹ËbÁ…Oó ùÉã %›ØâRNó c]ÌènÁP·ž]á³·ê¯Â¤œy«ç`‰4CÒ«|U’<-¯ÑÚ^—ˆÇ@d:®»ŒÛ+ÐV¦€V\^‘?a{RµÒelÉõ]§Î6ƒbºÄzËõ‹‡†ÌÜvéÁ*<3`ÿ~gͳW%dIúùtB"•èp%4ãÖül»sÖZDiëûãŸô^h«&-y8q1*.‹\£ºÒ=¶÷°£«Ã›‹'‡øÝøÎá’¦Ô·¸¯^œ&Iò‚“µ/h'[ŒÕp"6]-äÐyÇÁ¯RêýÞÖM¸gߪÍÃ,ÅZÔ ý$Ÿ&ßÿdo.LkcLr´1Ÿ·ÿ°kˆrVIYâ›×¹?Ñ?ˆÊ|WD‡ÜÑP^ˆ1³ˆ8‘Zõ"ð±êŽ1,¿SVÝÖÎ+¯ùbˆëLIÿB§q_=ªÖ\N–> «½j‘‘´¤²iº.dóôðãœÛœÜ]WÈSª8ËÑ`AF“ÎÕ’ÍoGsÞðKS–¾ül”Ê %‘^êÏï_Æ2õ¦Ÿ#g3úMXКOW6_Kö6VO½v<…wbùŠ›v»˜„¼Hö\ˆ¥²&L˜¯ùÊòÚkû•[^z‡þôAÌ&ÏlÀ¹ðéŒU7•ñPSMIc[§¤<¿EÍ’A%e&ÝZ{ô  ²©½ðBbŽäVŒ…ßc@oþ!¼µ+ ã?Ý|WôecY£Ù]mûa˜ ·ÒòøçÏ›øÄMœæ7a1*.‹\£ºÊJ¹ëÀ¨ÉαWÉ–ÁÚDj‘[\¦cÁ¾N‘¡ýˆ6a­Òl0œ!üÌ­ÒôýžÑvÅ›×ËVPUÆÜn=Yn|!n!.=+÷=>d +B¶ÏÞq´¹,1¬¡L@‡kÊ ¨=T,QÅÌlYÆ ¿W&Q”Ú$¢ó¢~-«Eo^ý\œ¸93kõ’: Ÿ•(ßSÿž÷ûÓóó°Ù/»³D ƒÇÒ«†y3p˜~çÍ4ô§Wb€„[VZ&–w—•–) 5§üË[þò"€L"7uö¶2  4¬ˆ¬¸ ‡m5REÚ«ÂdBô·µ˜k½Tða5 ˜VÂcId¥Î¦ZF;hùr–šŠ¶ ÒÖÎÕ²œº1hˆh:°ˆÏçóÕu õhJÜ–F^Ýê -%a £Ã22Ö7PS5šh©Rßȵ÷^ç Gÿ§ÆÉa%c"*âó»Îf²<\7N Ú¨§®„%`›ê4­|VM±Ác a5 ˜ Q&âèl›ñòºV¡ûµV uIÜÚÁ3tò[ãaÇ° ÃAú†ÆDÈ0Ê&l•žî.~¢oÈJƬ”Ïj,mõ^jí8I맸’Š¦ù`s#=:ÎæÂZ±‰©%ªYX;O4†ê[z&ù¯µa¨A'kiÈ«v¶ïå‹ôŒqÒ®š6‰÷Š}£Œh0ÀYšÒE=]ü©ž‘”µØfƒ-t4¨€ºÊ\„f­‹tãézÆ–c\̈•Í’ÀeKXjt/ïÎÚr‚á„¥ž<@=CC}ÔÌ'ZÒ¥Àd£ÿD%<¦O†ƒ,©$<‘Då5×ôºÿ²Õjd!Á@S ÇçwõŠIúÚ?k œ±®ž‚H̉NúÄú/<ÃáãXÚ46›¥ÇÔþ‹Vü°e¦–¾E]Ë@[“EÄ€!ÖÃÅ5¹.ň¥†%j9;åÕØpsNŽ¡¯%¾gæÂ%êJd5¥JN%ÉpBÈL[R?9b]<ŒµU±XÌ·æ‹Wêl¬âYAË7h«!‚ Œ’:[O›M#b%BxИ™fzjú.aHZlÖ ]- IÔÂ囌ò_á>ôÛà¯öšO…Äá˜D©kî8ÁDWC Òס±L§{Í@:Dxía¦††&&†F4uݱƒ©xu¶ßS÷²ïhˤ ðw™šjµ·4šõ¦ê$ʸñÎ]ue<ˆakaÉ4wrbJë$Æ- %“¼¼Ôp˜¯€ ‹™:š2!ŸßÝ«m`¢ŒÇB†¨Âb2 5(Þ—¢j¡±™:%¨0uÛë«%dã%KWh*„x¶–:ŽÏïê‘ŒØjª4&"îæ󻨚lº*…×P‰jY1o–2‹ÅN]»ÝôU³íô1~’³u[cçÄEÛÌuÔ¨D¸µù ^ÏeÓ|7J¿hDkZš &ãqš #Uo2hŒËP-NU=ÃÆÙP[•ÁÔ×ÑÑ7ï#É™ºZØ_>ê 4††L¶ SS‘M`ØjÃÝ$-M ….&xk2r¦´®˜í4Ûy Ý\`k?žN%¢[O3¦ô´ÁZáçÓ‰DÛ1xÕeš£—ÎkCÀbú´Ìb ÒÕÖb¨ ­í\-K÷M‹\)8‚ó»¶ÚZc÷M㬠±¿nK‚áP[ 3 s³Á¶vš”ÞÄ7oôÌL«*°:¦,¶±¾J13101ÐÁc~ù™ÚÙXÝ 4„¬ÖW£Tªª7Ìq«ÑuŸÏïRÓ6P£üzó¤¢kÆëéåó»zeˆ‰áiãmZk8rª‘­©!MÇÀÀÀ@ƒJ66Ö7ÖïWªãíbØЊú.×ù6ª @4ö M=cR§kÊ:êÚz±s–­6£+c0¸¡¦†N£&2è*ýê•"nÍ-ï?eœ¤G¨khBÆþ«1DŠŒþ ( À? /Ž†sg=ð7ø'._ÊND?ñ^ºÏÎèO$óm/M\ïA³îx±Ðg¼·÷ØqC•îäÔUÜ^o1Ò~–÷øÓÜy~ƒ§§—óô¹ Òê{iÏþMÞvFÏZäÿ\…ÃÜsë§{z9OŸð©^€ÈzO¯›:cºóÒí§aå¼9ê;k¼¯¯û­¬æ‘ô‚/y =GÏö¿tÇ 1"O ¤<ÆÛÛõr¹h@ …oÎÍž5ÆÃÃéÈ£4q†§—óô9ó?Öö ëïùy÷ö;ÒJ÷W2À¦Þ];}¬Î¶ç9QGið¬1s|LJEŠ¿Q^hoÉ…³†Ù÷•À(@zoì™ëåëêRÁ•4<™ë=ÚcúÈ­çÃù‘›GÇÙ±.ÕÉòîê#k¦xz¹lºú AeŸo­ñövå5ù^fÓ€ÇD IË|ÇÌš9>úSýp«>øÏvñô³ñøm9"‰Ý¿ÐËËÙÃÛãqqד\_;~–×(#s#/ïñ¡çRÓÖ0î¦Öý$ÁÙísgyŸ³p.§]8@ÎœWá>®¬%§îÿoJ—·ÄØ›Z¤pÿ`fb?kSÀÐüÆ_bPq*ºZjÛ„jG žÐòK²fˆ¡£ó§òû¡âFWòO—y!ËsZÄß*.õfàóÎ?m !ÇËLíÐûò?¸`¼y[pñ»¤_>K4fÓþ•È„{‘ó>ôþò/‘n¤LüsÁ}xÙ»õö|ííodF–V_±5J1$+ð°Ycì›Ú˜˜C/R~}K¢Gœxì9Ò Œcà¡ûßß<¶kÛŠ¶eRíøuï2Š<7tÂ0VÃýÚƒÄû·o´œŒ™`‡û½~ýÙNO'€¥-;›|Ôxþê[ ~ø¡ïøAÿh…cé!ÇžÆÅ&™‚»pímo[J9èÑÓDgILž9yêAðéW·Î>°j/¯>ùú¢·Íž×ïƼfu¼ª”p+vݺqóé"³ûɇN ‰y”òìÙëÔè í@mÉ‘'q±ÉÇgÒNIaϹó0ñþóæzƒÔäËÁŒš{âêÞ};›Ëk']¸ózˆ(±\ò7Ê R²àò™ƒ}QLòÖ×ñ5:±÷_™Ùó"]ÏjÆ݇Ÿ=}#HºÔ¿¼yôÛ<öèÐãÅ÷î^9wrc·ÿÁtc—›1ž<~Eοۂ½Â¯ÅÆ&_ õ Û-ùahKÀ‰Äûw²†.¹û012ÄêG˜Ÿå’&<|”xïÚ]MÊ™-¾ mr {æO|Ö 3qÛóX é³?…‹£#§M0ŒO¨¨üQ°ÅÔY.Ö#†„« IDAT¾h¡ò/ËgÙú¸0í<—7 ªªóµ»õ¤iOÓë¿þ[üÀÃIkаáYÍ|nÎW cSÖíŒj9÷£³µE ÿÃÈÁÔõç>!¢–qNŒùa…((*ëÊœÈ6fÔ(@áŽM³–O54Ú³’ÿÍú‘ëïû YrBŠH/w46Vó\s´[Š\Úê6û­öjÆ“6÷ òŒóóÌM•=ü˺þàT‹Î²ÌFç#‰qR4f\·]¼d¤æÚ3QDrÓKËs†££ý»&ñ€S4$5÷Yl<™Ô××eÂÖp¿¡F¦:Û¯%#po¨ßPccZàîh)‚D,´ ={?À†j<õ¨qG켂K¾ôÿâ*S#Ú–K/PDþ$ÀØϲ¹¥Éƒêo9ÉûÐˇ1÷ßžØQ/•—Ü:XÅÎuV!O&«Œ´u]wsƒ±¥IQ» =óÚD{ sã¹( Pà¿ËZðúKü&Oå%ô›üý™Ò…Ÿ•á§OSú×KИºä¼ÒTÛ>ÿ-R»ÐØ{™1å ×’÷¦Èé(S«là`O¿°ËÓ?òáÏÆ)1§Á~’£BÙ¿Æ»ìFû‰ÂæŒA6*wP25Hk–ëS奥uù¢¦ýmŽ±ƒmüôiÓ¸& ! ÇÜâ¸MÁãÂã~ÓªHëã¨ÃGÿœ÷99§ÖÑ}tßßœ×w{F†}ß#Ͷ™á”8gê4‡*Æ\KÒ"4¬2 j¯êHÞ¿¯¬mmøJË¿¼ï¤Õþ´žSwðùã³–ííÆh¯ß·néÜÑÞûsÖl pgQ‹œÌ{µár®fonë@òŽ´¾X4ÕÝ^h»Hç§YnyéçqA3þO$LĨÃ圛·rM|v=Œ·‘ƒoÞø ~eÌ8æà PïhÞkÃRîÇÛ}4Éeþ™ŒÑ[Üçså¨DÊ8ùªîÙ*ùÍøÔÒ\_$žý“%v>Ø[‘›üÚ\ƒB5u»óª¦(;óÞ±S]ª£“ó‹ U]ÒJ{Ž…8aÈŒ¤OM3¬ûè!—×ÛïüöèärïÕr •ªl{X¿HøòCéoÖVÓt0®éµHŽ Úý¬¨¨q«Éƒäò–Åû^ÝÚ3ÿLfWÕ›CT vˆ×Á¬‚Žkô"OÅÿÛóó?/ÙìÅ*¹UÆ—ø‚Qo³ ëî¦u#ÀÓ×ÜJ{¸§ßŠÞþV }‹ÓRé_O£“§Ÿir¯(¿|Í4KCÞxê}QQÝtüíb¾$âÚçÈå¾×ózªžo @Àsç§+ûìo}ÎýGs *U Nç‹òQóNfÄß¹î²ä7½¤ ›Ö‘ÓŠèOÞ‘–Ý·Óq{Ä]œIhÎëžþG«Š8–šJ*æÓÉO{{qÏ žbë‚ýñ—çïBÄÕ7¤G]ŒíLØxóÑ[ëÓ¿S™yë®8~Ž ÞsmÜÍ Ê¿’b#Õ˜6—n¥•—P^åÛo O™¼Ð :«œB93eí*ešüöYhØ=éŽòÞ0 °xÆ¿æ >,œ4ýæ†Fó# eÿ䨒¦ßXÿÅbåv'/ ƒ‰#¥µÅDì;Qóãã±y­Ï] ?O.Š:~îKú# JÖ2§Jna¿Fsüዦå‡i”ÎÔ'€²·'cÊõOì5Äü_È=á´ÏÜI,ÉO{~yzOpœïwìµS½S†˜sQþOÌžíœl%îñ‡FN~Àé²uˆ*?«[‚(éèi’p‹‘Û¾Û=øuË!:j}9.ò^\<ö¦a¨¡FKSÓwZ(Š”¶b½ÌôÔ¨Mnv·%Óµ5É8Šžš„'ün(G RÚÇ¿$¤‚2T]”-†¾kdo^ Û•aqþǬ†éTHÇÁŽ„#jÓÉEmr Àé24IêrU~¾HŽ*ÿ>é«Èªu 6¤P( ʶmÝ£ghÜQÜáõÝ«nn•Ã/ª2ÝPO­´SNx†ŽY¹éjù½¥]9ðàéñ¥ŸqVZp™ˆ?f€h ¢¢RÚ-X*í_% _‹ÿe_ *nmê!h«©²t;Z›tu‘°W*—‹…‚´47ÊI“Áî(É–  ’¢¤¸6¡0.àüžÅAÞn¶,3G{SóÇoÏ ´5Ó1q ÁÝù yÐt&ÐÅmáòùÜæ1Y›‚‘—¼9y°ÈfßX*CQT,ì•ÊúŠû§vT^üêÄÁRÛÕsÇÁR™’î˜Êä<G«Ê¼g«l0{IØÌ‘úðˆùZD @¥ÅIOZzÅ>·^ÃØDMM[ßÛÐ+kªoàwóë«k(zÆX*ÊIJèA ÷KöÖuáÛNŸd)A*¯øpæ@®éڀɰT€yiùbÓqÚ_érWcÑÛôŠ¾ \*Š¤R±P,•õðêÔŒÕÕ´édq]ïߺ±– …"– „B,+·5k6as3L̬Å]œ0ß)ÓÖì±ÖÂ÷5¨æÂä첯\*Š%2‰°W"‡Í Œ[9U"·KFVÅð+Zmºº®¾.ÿ §oÔIKz/@Àijõ¢‹±¬‹5‘AÆTZšô¸‰/ˆzZ;„*EE:¹r¤½øþž‡Ía¡Ka±äGö¢KD W "òîÆvŨ©‡ÖsùXõaîf WvŸck€åb¡H"“ŠDâsE°¹,ÞcÇ~ÿ9+æŽÓx\'E¼ª´¢«µºž:œJÀôÔUÕtöÔ¦'èhj0xj'—'‘ÉJRUê*,næ {;{¥òää왡ÇÖ,ñW‚€0 JdH‰CÆ\[^ZÞØÕRÝF³U!@à;¤ED~~J2uø\Bç;™Éôí›B‡‘¿R ŽÐÎÁŠjž¥Ã[Ã÷M³2øj®PqæûÄžo|²Ž”bhÌ’9AÛ¬*ùœ„´!ñuWOWm3ÏB€œSUÛÙXÞ®bMÆA–„GzDR)2ÀBøAvåÕBa·£SÚü\cܲ­Ö&}]œÂb1Ü.ñ·'`«he¤ä÷ôrkxæê8 ðû'+ÉÄ‚ŽÆ¬:‰Ñpjû§›Âö{9 ùúJI*î•#Š¢‰Iy>›­ œK‚œEÿ:kÁª9m ²p´¤{ì­X³|a¿&,i÷gpýí‡Õc£k%¯/¬5\{ÂÂ]ÑÏ/Ñp ½wËÚ%5&›mÈÒ¡QT4Ô)d=¶!›mHSQ¢1˜8 Töè,jÜ7 f=Þ;ÒZÛÖÕÓ¾tyõ†E¡¹VŒ°Ò\q È{æ¹›ž‹O\?ÞðBôªpIÕ†Å[rc–°Ò\ºûEÓq“ÁûQÖæ5C· "‚žÂ«® ß]Ïžž_LÆ€î‡/Èmîغ­Ñ¸å>ÔR¿Áx‘‡¶äv¸»­µö’«œØóÁx p×ÅðÕrxqýHlzš»½®…ƒw£ ~ÿúì‡ëì¬4l¹ P4ûüN£QÞ?»øjÒîm9ßg‡_žõ|ýúú Á/»’ë3Ô’U¤åçÅü;³_‰ËÛ÷-«|jkåX%??ákekœd|0h’yaÒ•[y5K<YدÀçÛ{ÏÇ~î{pÿj‡ÕÇžDNaîz‘ã4/|pê¢!–lËÅ»­´-Ž[è3ZwÒÚ§ví¸õPØÎvÜÃ.Hîù8y®Œº®†= ÷ˬãZJŸLÅ°²Ž>ŒÐæ¿ìË£¬5§mýÀ¶}û"[ KÍacl¿ô´^5ÎÒRgÅ#õ…£@°<ýp®“•‘: üé¼á>GŸžX<3$üß+(ýÎC¿QVl¶¡³ƒÓù¨àrŸn¶óX|$áŽR¦‰vLÓõº¢ºÐc4@•5¹ékî²'ãï­e:[ÃÛQmù‘Ô†¢;N67îžèj£wº„ž»÷djHO÷Q‹GÐü.ìºÑžÆ[Ÿ*\;0×a²NÖ§ž½rôäo3ÛøÃÞzVEÊ'«{ºšõ±õyTå¶õÛßØðùqQ|§‰&&æ=æ4¿y&0°,èjXf=ÃS À’OÍö˜¸aë¥0e<»É°Žvšq™åOÏ,³w÷¨ËXé`m“T nKnäoßÉâ·›oÌç/Íré7ô£–ž<Ͼ>›zkXÝ#&Jý»© ;ã?ÜbjÈa§q£ ;[4t^äôâ«KŽŒ1î7uuÀÖ½úª»ƒ:ûx˜ìJL—«7·ÃHÓÊÓÖ¬³jÄ3gß9¼ƒ·ß6 g#ß±|ãµecã²°°üÿçSŒžã"[”}kãìªBän]·îVblbblèw¶4ú:g’ÒGìO-º;Û@vÒÙ½‡>/uq´çqþkmûÖ.ÿ“1±‰‰±‰‰±9³öÚ÷/í²H¤éd£vlÓ⨸ØgYeŽN]øÜ¿ømvI]Á¦Íkâb_ÕýÒÕ €jŒÚXoïeLdl^››˜+U³¶5Ò†z±!±’ïde˜utþ®¨ØÄÄ;¤Ý@kµ?›+aÙ³‘ÞMèeõ¥©>Œ>ÎXvÕÀ¨æ¼}ntuwùg«"ûþÎù_ºØØk)ó€–\ß½*cbÛA€•<Ý¿oçÇö=ïßNXºëršo]§d×oÈ9±gR†¢g·í]æTSNØî-7Jµ]¬õÿ©ì¥^»’êÑÙ¬Í8~xoì£ìž=8-¹ÛÖ­½™›˜[Mj;ZêgÞÜ»?ü’LÓÎJ¾mUdìµÄÄØGOJÜ{uo){ypïæë_ÙwõTÅ™Oî9zjѳ—jûº"¶,œdå5VåÛÞƒ&²N8u25·®³³“½éÒãÇ…b†£ÒÅ/ 0`~€Föu>ÆoÌQ¬9* Ð×Å €ÎK¹ç;m逎ZÖ|¿ÚÆ? p渱ÿ—YŠ »;ˆÒrŠ@PxeoºÊ‚yÓŸñ¯¥ ¯ ÞcØœþfõƒ—\iW4IÐÚß=K¬–1À釆=n¶œ=}º¡²‚°„é‹×è§-¼ó¦¤mõ·\ ¢ÞÏϲ.jMøóöŠÀÕö0Ü…7vi„„l,oÖšá ˆž,>÷ç1òòòë<†ÏégR3ø×+Rªñà¦5=¦.Cã.$f%<Õä±hî¨s{6Ú½*ËßtøÞôÅktŸ-¼›UÚTø*_md@@à˜îví«CRγè7}ì€kÆWʨ‚ºCgûØŠG.¹ S0›°`… M€j·»‘7YYâ¥È ·ì™º8Èìõ˜…ÿEyõœ²z¾ßÌÇY*sÇ÷7ÿxuÊ…lþÿù&L EKeÓó-ï$ŽÜxãå_þÚ!¬¾[ß}^@àôáCäßdÜ »ðòù{!ƒ*ÙÎ  X°Ä¤0–਀¨üÙùÉ)™¹tɃó=†Î_°ÒC·Ý>?ºàÛzñ†+aˆÚ'÷®§dæ2 ýêñí«WÎ܈½û¸€l)I¸u)òâ™[·¯æW4‰ª î¿z™x÷úÛ¢*`ˆ†”{1qñqEÍß  †plÍ´ÖWRXq !ÿòÝ4%©™6=Ф߬‰ƒº7“LjâOÁ­°…E–ã­uÕŒG÷·ÿÖBb(áö±ý9Îý& ×€¦Ê‰qWï=Ë”R Cµd?½÷àIRJšø›W“hqAdÔÑ»·å©‹tuî^‹“Ñ€*˜L_°`¥ƒðuª'øøh¡‚IÓF\Þ¹´xÃg.^8²»ñÊGšwlZ¯ß{¦Ÿo_>ª^_ô;”1næwkC`21lÍ¥Š[`H«£ü¦ŽNÝ9&·Aòñî–íñ ³æ.é¤÷í&b¦æÑæ´‡£Óëä‹ß=‰½–’Uò9„]›ó §´®íM’ô¬¦á“Œ«oÌÚ•L3@·_:ûÛ­è8 ”´EÍÈèöÅkb ¨Üg'Î^¾0`e' ŽT\¡Üqðôѽ"ÖϨ§×6qá@+‘÷¢h)Õ¸Ó:÷©K!ÎÿÒ“‚ú*#ÏÉÓ‡uÚ¶fu#%::ÑCÕÓo´ƒdú‚£M™: ñ›>ñÃ^ŸçE‚6B®Î½ú°èã³[ùµ¯îßÁQ"ùÁmSç>ò‘¹:+ùé‹gqq1EíÃ4 ªôÝ&Oî¼7h™€&’BúÒØGÿãØàx™ yë¹—~‹–H.IÊ­iW«Ÿ’/V e_lŽº¢ôø¸è”Œ4ÃÔäÜô0cSK=Nõå†vF*€¢ÏOŒë;dXFi#’ªÉ#ºúmoa€‘¦†x êuâ^îÿá ˆ‘Ëø^ŽÆòYŠ´ö]§Þ½LÍ]-ZÖ3&ÌîçêââæE šÛub\£)£Gh+ñ€!;O|jN?:qî¯  0M=UœÆP±˜««Ú&ŠÝòéâSt°“åà ÃK]n—³®½»X›¨( jºZÜpòœÙöÖ ¤béO#-tàD¿~Ý]\ÜÊ„TÓëlÊn€¥ß’o2Óu¥¿ ØÁÜÍ”y÷ª±­À0-]UœÁÐ1®£¢ (’>¾ï¡/‹Úµ=\Íiâpo§Þ= Q’¾cf píêäæÃ473¾‘©¥±öµO¶CzšµË™²ÍoG®\S0M]u㈄˜ž†êQ`æ¦&¦<%mSSK=UÙÖ×gÍ™cmÙiШá8 \Õ°ƒõ€ SŠÚ *Ò¤å¼û]xò‘†e_y¯¼ÈË€£ÔÁÔÒH =[Ò»§£>#« [¶jɤ^ÜÖJFgöœ¼r§ˆ†v1LÞ?8зgÇ}1©M-Rº}ÇÊ”\Û)ä+†¯Ùh×_†t45öð3ôKŒoýE$'zë®óÏ<Õ&¯Œ¬JÛù%¹nS—}ÊOr[±îs-·1[4ŒLMÍ5ŒM-M µ[ÄBe= -Ÿî<Ë… ŸªšKR“ÝçV^ìõå™}w?6rôp±5U僊¶&†üS„ùJ5ÿþx-:½Ætª4Äcåõ2„’üøâéñR³:Zj´ûþå­œ•q¦ê\ %U¿Ž]6k¬÷תú*ùö€-›•9ˆùð W¯K^%^ømíæ:{2?3³|}—ü ½q\Ó˜¤Oé)¹ñK eÀZü«Íôöé{µ@©VD-)ݲ1|ÿd…EÉ’ $%FÆ X5i¾D”ÐÆG‰q™ ÊxÛ”!Ä„ÿt稨— (ù ¡…oîÝ{üÜÂ´Õ ,©|°§ÊgöP‡ŸJJ´¤dÿ¦ÍgNÂ¥ƒ««¼²›ù2‰´KŸiÉþ]}|ú¿¨ä $m­QB%ƽ(áb:xå«×%¯#‡Ô|oêþôBð[—-†8 ´¤ü`в»§Ë«@øñ’áØyx?tí3ˆ2&|”xûuŽý4S²* —ÿ•/ZšwÑw¨ëñ»tý˱”Œ\¤§'ß«‹^Y$‘lY¸vÈÔY_¯!|zÝ5pƒ6I‰Þ§¸âš¡Š|üÀzÊËÈ(Ûç«2+0¢m5dÈüÏ“ŸyVLâýVÐ.Eƒá›yôöÔ,ÿGý‰Å¬P#S*±”T³q}vóäý|ªŸùϪ óžžÙÓd@ÑÕµ¤°\EWí«ªmüô±¡!'õÇ3Lmçí*ãüâz)ýtñyλ½A³Ï¿!îå¦eäLX»Òî—%ÝìÕ•,g¼.K]–þºìéµ+²Ogß;-bõ‡¡t[J"µ‡Ï6Q@H±@—_·(p§ŒË¯Q@ žÇe©º«"´°2¯Q;,îÃñïÂ㟷‹K&¥<}S|eË«ª+çlûu¤û—f@ÔdÇÇÇUp:(`¨P\¬ØyÕó¤û‘k´=ׂl.»LŒîÑg²FÅ]’¡ÓŽ„ ³¾‹u§™+æ+s€j|9eì”M§÷ñ¹ÓC_¤·–¨|Ã@ „Y{c ÃÖ{Qå—Ó´†MpøîÕøäÓo2ËíÒ7Nl]û;¾ªÒ3Xý2H½µ³Ô [P ¢Vù䈕$R)04µãß(Z IDAT~ŠÅøðtL?¼¼ÿ8#_O¢!/!!¶ˆé ÔÖjQ52åæßù`¿nȨA´yߌŸ= SÓµ…—¼î«¿TÐýƒkQ†a®‡ÎÒ¨ ¤”ò¯¬ÙÇf0œ`^vÙ{pÏ-¯µ[¤?jš-ya¥•™[ýãÞV]~×Àéæ=FIÓ†SúsþõKr…ÒbŽbÝ¢À2¼µ–ÿˆ>“7û¾Ù¶zÜø¥»Ä4×}Á¼¤ÜO3ŠGNìn8þîç)»µÈ(ɺŸðàI‡Z¢ÏB¾8\þþ7ŸQÅIÁ·F67W&þVjöãluñ×ÑÆÆ®çú†É7u¸tKs¦¤ÊEQ¯ ÝTÿ"+Ÿó}­îŽç÷¾K}«Hmó^¿V­¿›˜xJà*©i€š=_Z#¦mm}°±5&T"(WSC@Ù¯'x¬Ñ\Ós·_Š¥’è6ºCÔ…m^g:ç\weDî+inÂU¹´mWÈ7Wâèkðx¢2iÅÍ #¯Sý,žïNÏu7w£H™°…RQá£|mc¼¡ÇšTÕ¼ƒ±j¦ò¡LØ,櫨pŽ=F[ÛwsïPå׋÷éÞ’»ÑQ@1Dí¡ÍëÍýÏvÓS‚3¼E<îÌÓ†;ÓÔ5{¨›õŠú¶E&Ý0ÉVƒ²–fá)*àdÕÍ*ïÝSýkÍÒöeä¹tÕµŽŠD˜À©¨‰á*)àÃÐY7·\/µÙ¿j0†¨?¶u­®ßc5(áµÐÐ)Á™Ÿ%B57K”T”Ú ˆ¬Ž+Òì:u®ØîEÈˬ>6}~ GW¹§]YÑ:º­íÍlÄñ°Í:Ú ÃÎãi©ó;h2‚V··º}4¨4ëUcÖrïÍ»•Ä±'/-=° À”*bBCêR3‹ÔïøŽñ±2sK3qt»s¶™Üç1Q1±Õ-ØäG¼ìÔÚ—¯€‚r~Ÿ¶5!~ÿ ªk¢ʤš\TwÐÉ3Öéñ‘»&ïÑŠZÑíöÑ0ÒŠ¨Èt¬x=&ÇÄ(,w©z‘%™Ñó³r¨ÏÞq±éèÈÓiÓý=ŒÿXa¾¶õØYkGëÛ{`pÀT—+…ȯ¿º+B,¡(’ dµÙ¡‡ŽËsÌÓ±]>d97B^~,/Ï=ñ¢jA¶'¢Ð¢k×[ûPÖ2ÏÎÃb­=²b°½^G‡ó™Ç`Ô-;å誩ªYÛ4f‹4Ôt;*«hiñÉÚf©¦“õ±+Ò_½Ë?à½j Ï Û¤Y]ÍŽŸT4ê©jq-,”U0uº¡YÆ€âï)קª×î ÝSÚ\õZ J<©DòÕÄßbë±¥›—w‰Ø™³ývF½üû“¶Ž°­^¾}ÔŠ½–*˜¤¬‘.ÍÙ^^Û”žR°´Õ×íHYKìl;ŸV14™½>^ì±}ÉäË ekgßs­`t0·E<áÔãúÛ“55<ª%éÔ¯ïm–­îÒ²Maov¼Š³#’û ùÇ©êtž0½SWˆMÊ+±Õ¶ùÝ'«a¡SÄŸ¿†“ººž×ý­@9\ A„¡DEñ‡Nß‘WŠ­WÐ4ŸÔ³‹3 çéÐMÖ*Æ#wŽC’Ý/ÙñpµõljE¢ÂÓýÒt´~¤2<> ÂöNï'oÉÉ(ÄA€z¸ëTŒ<9%ËÞ:Z¼û€ÅZwtÅàŽZ?Úƒ)jyžã9ØoÝLïgõËzÙL~y_ S^cÆkLÛ±=¦õxí¾Ë–²¶ìæëß¹ïÕþ“K†˜ýéù?¯…J‹Þñ® »r¹0ðÄ€¶[%Äñ·¢Þ—H®349åØ&‰º~Ó‡‡¶cæ¨bTÃ/ëþ— ú™j¸ø¹ø€$gÛ¢(Í‘N¶#Àéà"å¹kTp´þå¹~oyŒø{Wö¾­ãÐEwUûÎ6¤>†4t0MŒNöZ·²¹äfXÔUúã­Ö7ÿïZ*µù ·ãÒó w’ ½\mŽ…Ÿ$²«o(•5£뺎ÿtïb•õèQ½˜Æí^¦ngó}ltiIݵ諟ê*®^Й4iÅŠÁÛŽìxË/0±T]ߎ“pìïý¥Gý¶†@ÕÛ«îó_¿}º[7š?Ãi÷Ñ#¼wqýfFŸ¦ œ±çq²9.©Å4dÅ):}'i1%¿úûu™ºîÙ µÎ^®ö&?‡ÍBG¼ßè:î㽋Ö£GyzY BŽž(¹ž=逧¤úÝž wj’>uÔ‘Àѱª NÄ´{¢oŽ_ÀÞ]J¸mó£kû_W#Pœ à1ŘÀÈÎNuLº8ÆUVÿtFè=¿…Ó®]¾Ðßwâ³Ð 7‹í¦”<ˆ¼öÉwT_¦ìž·‡ÆŸ½²÷ƒnºöä²>dMjTÌÊ’’ËѱǸñóý]ÐȽ”à±1ègij¨Ò¢c{¦n^Y= {M)½$pÊUÒÑÖù›Nì̉:“P¦,ÎJ:ÏWQr^¹ž¨Ê´ÇXkz÷z½çÝ“}𛺆«ÑG´nݱOäöPŦ¥åW¯\ó=rÙªŽl 9ýWîQ¨˜s{*u§¯¨\œjù­ëø^̹B-E\ÝÈ×kfóê ah1¯.ßyÚÚ¯¯R´ðÞ¾ý÷ÓŽ¥5Ù’5óO½ üT4åxw8öƒ´£Zs–È8@ Ã#ݬ°òî~š(î«w|U¦ë§C?IUªç ÝFé}×b˜Öó!ù¿ÖiÀ 6.C‘2‚¤Q çr¾Þ= ÃÈdR†a ç!AP (Žã(‚Ã2)Šó¾ÜÃÐ$I—Ûji‘„ Á¸¡I ãEI‚â\A€$¤Í .Ã(™TÆ‚qqŠþ}…€¦d2‚Åp.FȤ4†áŠ„Œ¢åç­px8ŽCȤ(—ÇA†¡eRù]„Ëã¡À2 Ç9ˆ\ì”ü‚04%%hÎE`Z&“ÂÁ¹\`h™ŒÀpŠEÊH’b”ËÅ9#m}>p0œ‹q~«…i'†! .Ža´L&eårqŠEÈh„ÃÅ8Ì×2¡)RÞ,[¯d’Ç8(ÃR)ÑÚƒñx4!#¿JRFÎý¼¡¥2Çq†&¤2R¾/ƒ‡ã4Õ¦ þ«2cd…·.2$!#)¹¢Arqîß”9†¦d²VÇ>{)RÆp¸‚ÐIÐŽýÞ14AÒÆáÈ{ ÅZ›èŸ-&MP Ci’@88ŠC“2Á \CäýEc\^Iò±€‚þצs0œ‹¡4E‡‹s¿í†²ì¹ 2gkwU†"eò C2Œ‹CÉ’ÇqŠ¡\ eR„ËÃP¤(MEËE  ’ár¿Z®f™´uA¹r…bZ&#qœ -•É>—§d2Šù²¬œæDȆg «,,,,,?€,“Ji†ñ÷Ÿ‡ ˆ­­í—=ÿ"‘ˆ¦iimþƳ¢è¨ã}GtÑWårdQ׿Ž¿~“ãë;ç/DÇçÕãöÖ†i ‘÷î&Öµ7ã²ìœ:rÄ•ç½ÿú“qG{5¼½S'ýι„Š̲¿‡±Ú7ރʰ‡M£]1 ŸlŸòÆhjð’)&šªš|aðºßF-ß:s¨«–¦6C¿<_^8ú‰âÉHº}‹Ò¶4VÙuàÆÄš¦êZ¢CÇù  “¥ÎÇg—…Zvj\êþÕ+Uyi×êظð„§ŽOy_kio«ˆHGzô¾¢¼¨‡Ï51’½ {€ u7au’…………¥\.†¢(§ðûX…a؃æÏŸ_ZZúÑP——WXpâòîàjSÿIý¹(Å(™M™>žº17é}Ýóûw”ì-¬ÏÂÞÅÜÊ«?»d¿ëð~Ê×l¼ÐîyÒª—1/¥ ú ßËY~WÛÖ‚‡C‰ÃcªJ_D.Xù¨ jxQTÝp>tÙ‚U‡+„íÝ*´LT®î䦖¿xíTÃ<üÌ] M¿¹¶GUï?vöÈÞÆ/ šó —Y½Ìzð4w¥;ÇKkò¦m;jÆ C…oòQ³-ä`1ãÉ[K®>ý$ø˜~øØÓÓ®>ÙøõâÂÁ³#Þ jÊËešóO›ô»/ïq*:G~•TPº7hµ‰×Tß~ŽÂŠ×óO¼<~\ùÝý©M?ZûýÊÒ¸ríâùaW„àЕú÷N.XôìSã7+)Ô§´w3¦ ]±£U>>ZÖ,«u9ö­DÙ¤ßò9}ºö´|Ž Š$ï[/0Ÿ0ØqÁ„j™,rÏVçñ³Fº‘í}Œ uç{õã&V­/¦ ”̦LOÇÌMz_[•ý$"ºpá’™Ç6ï«Bõ.í a1?0hBs†l¼ñ$—(I¿U!¡È‡'¶?`z,š;Rm8¸vmÇ¡Ó]¹ Pñ&nyg¨»Ú«çµò$õ»uoJO`5“…………å´™aËd2>Ÿ¯¡¡ÑÞ `0¾¢¢¢R«Ã³5ÞÓ\MßZ™Çû”r¦—{¯Í÷êʨ’AKM»nN† µÅYGî䮜0pDÀþÜ‚Ôvܽ1Ü+`Þí©!jòÔThJ(«ðÛÕcËÎ^Z×T_¥`w4òzÄB2òaf»»žòØ~]݇ûró€chSù0¥ôÓ¹nÊmFøÚ—çﾚåí1nõ…Ì‚7˜²†yíõÕÁ‡šyí-TýË&7OóÙk&¾ËÍ@̆ORQÒ×å Û,e œnSz•~|½vÊœwµ…¶>Î ßØbJ=W¸[ê›ÔgG½¿wxP¯¾{£’br´Ü&k©©5žuã†NáõäZI3Q;eMXÔY‡—nli¿‰q7ÇÀØ¥›ÂÇôZžÏœa²ên\Mï5ux»gF=zsyÛœ_¼§çÆ–4‰ Éü•÷+µ U8mòñ £§L²4±äÛG±¢§gz¹÷Ú”X[&h@íFÃqŽÜ’—Õÿ` 3èºdD'emK-"ýÒÝÔéƒÜ'¬»ò:ÿ]YnÊÌU“:º ì©ÕêôSÒf¤õ¬B²°°°°ühXùÊý pttü6*‡¯×ÅÙYùó×\>Ž TEL éù®ðTÉQ¯§‚ ŠÈÿx*¦qÉwô9ߦê1¼OÁÈgoò3•bŠ晨µ9L7rªy.àðlÕpÅpœ‘€º‘z>E8|â[ÿM¶HIê L ™;É|ãºíõËTðÖ P4ÊײstñÖIÒj\ÜHO/.z¿/4°ëÙÓ*_t| J"d¤ÕÅ|¾+‚¢(‚´7”:¼O£kߣ×â]ñÑ‚ð”xòÔp5óa{㎱ÿr ) TM™´½MSÛ\Aªˆ (Ce ä †r¹ÊÅQZö¯…iªl0i"8|´ƒƒO¼ÿ3=‹0k¾¼Ìç4ùú‡=a!ÿ\Vœñ˜ü)~§8ÿŒÿ€¯6T×T5»© @»µ–ežï O•ózÂ]_\Ë0Æ ­Á—·‰Ï) CP Т:‘< Ž¡ˆ\˜Ún#/D’ßðæö¶Z!ÝÒ,m­A(° ÉÂÂÂÂò§¬–Ç+((üsŽõÎ|AØ…³§²“]œÛÔŠfë—ºnX»ÁXQ4ò\æçóõ¯}€¼Û¯@cD;“8ºšr΋h/%ŽBÀúikv®KQº.^§¥áØOûIJ à¦¬,¿ßVµÏ %;~p—º°ØmúãsDÁfmã fV6¡Á;r]ûÏßeîÍ…«7ò%†]†OîeºÿŒ”jÙµ+<¢ìÜKóôÊ[ªÓKìw„9$DÉ¡üEÉìc+wûN·›¹éã‹û·ï%ȪšN€QÓÆó¿ºR×~vhõúw6L 1ecpGȌܾ*Ù4>ܯqg×cî÷kHŽù'ÆqŽ¾†ó¿õÛ6^‡¹¿ò9íì"¤0éèN¡ªÈq”‹ÆcLÇQQùN»Õ8\ºôÃOJfÍ¿`‰ïÚ-+rlô+k5‚·Ï}¶ùTµ¸Jw¢©zÛçqº­øíÌê¥ÏL8Šö+ævæ7†]8{*ûQƒc@JŸÞ.Õ¨·òîªÁFa ƒôðî}½úŽìªeXv\›Þ0½]ª;Oíµpuˆ¯ÅÔu´¯ówAÛŽ¹é<)”̀”z=}Y…daaaaù­QæHŠú©âµD®[¬:{Çsþ¿ú†h.X±üØîã»~ò3!#6T{o]ꪆü5Ïc(™èää~&!‰>öjG†ÓχWžux”òW>•Þµ6xØÚ;E„ÕI–vðù ‡ó{”¹Ÿq¶Kü_¿Ÿ(òí;Ág륟ÿë‘K¶*¨¨ýec5Õ´{DïgÝ7GÚªþoYÏ Ö)²& ËG‹ŸÓ×ÂÂÂÂÂÂÂÂ"狯…==‘………………åƒÏjaèf¡˜ÃÞ‰¨¹®®^LþÅ‚a(™ ¾®¡Qô‘&Ñ?ìÏ0RQõ÷Ïgd⦿ít†¡¤‚ú:AÓ÷O`ZÐ(þ&q†li”4Û8¿–”¤©AF2Ãé&‘”ù’Cc=AýûùeÄ"{* ËÎjù£ˆþ5Ù¼Z™ Œ¶w]pkdº.pý¡? ;Õ\0uôºfê;uêæÉò´G®~D0ÂÖO^÷²j~üÌÄða^ƒ¦-Û!ü«‹\ŒhÛÔÖäb_U~c°‘Á‹×ïqc}BÄŽ£߉rO¢Sëç òvë C;|NÀgU}Ûˉ¦âÐe³}¼¦½knk³ÃW­;qïcq팽ÔÜù;h6•Íå5|ÒíÂïd@”·lÆš’€Š¬„±^ƒænŽj&hÉýý‹{ŠHÊûVwNoòõ]N!(ž3ÆËgÜýwU$¸ýÞ ‰Ü‡¦úú ›¸ð]mKû¼¶Ô\6y·ï™û¢9hÒh¹†n× ˆúÁ‹gx{Í*Ñò1&}ÿÜIÅåßîBKêÇÎÜ×Ä€¸:÷×Iƒ½FL{ôQ ²’ëû®¤üÃ:|9ÔËËk̬•%ÍßþJ”ßݼçÊŸh:ôûãó½¼¼¦­ØñíodÃ[ÿÙ;ZþI ª0öHkS™}ü/š(×gõ}X(ú†ùòg‘“Gz m!¿S qÑÕ°Ä,Zštxù¯‘á÷ÞÕÁ~ã|§–£5å™ Ó|}¼†NºQ DsaÀ¸a“îªùF‡$å©«æNæ»´AÆ@ñóËý¼Æùo.lú—Õ\rqœkfÅ?V C? ?Ì{êªýsõÀÖµì’: ËßK›ˆþðmDÿ¦Oûó¬ÌåDðÔÇÇC¬½Çöü¥÷ð‘£Ü­ðnŸÙ½ŒP„–…€qQŠu³´¸;ž'ò¨ô3;\¾W‹©ph•nN(B‹…"ÇQZZwóÌјçå¹ù•¾¾n1AÓô'„þ:ÙÇPKCE¡}r"´'ŽsÕEèúm+‚ýöÐzœ$ëjÚ’6)JñÒvïí6|˜2 „D,%‹q€â(+Jß í‡wUGo ÎïºtÿÂ>›¶œï?´edb (ÆA†N¿qöÖ³JY IDAT¦ú|ó_Æб۰‰^aƦ—“}»â-63.E><:zŽq*häC;;Ý·ÿ€£FuÑ?Ö:ÕMEè¡årQaHÓì)Îgö.™vjÛÁ¨uœ£åÒÉAh±PÜ*IÕÕ“ÇâÓËßä6Nç±v¡ó¼ÝóÆôÕ×ÒTâq¸š¶çFxz÷áÿн˜•Mݹܷ)ô|¿¤eᇎ&<ÍP¶uѧíÞsênrfyy‰Y'5>F‘2¡˜ÄqìÛ]Äj¶=½1ˆ¾š1a¼P¸ '®&¤ªÛ:i¹ûw¹uïi½ ”§e˜þ0ɶSG rÎßÈ1…œ#g¯<Ë,1ïì Ð˜ûºÉÖDGÖøþjF³›‡»‡•Úž´Nq‡Çª+@ʹC陯b’Þ™tvTÃÛ¤/üøüäéˆû)Yö5·÷.Ÿ¼x3»Œ°³3çq†¡D")†s ²®GðRž¾Òïä¬ÉC«Þ?=yòÜóÒNöæ8¡)¢YLrq ºüÅÍ#箽̭µr°å‘•~!±Ë7ûö®Ž¶ 4DK¢—Ìê:yE5¼æÃI稈ƒ~×ÛÑeØФվõ½×ÏéÚ2qWÑôaØ×µŒàŽ}‡óêº9Â{¤ÇUó€ãý¹O7ßA|{Y´©e™TEWýʹäÉþ™êàyk×EDwmºr"UÉÇÝò+]fšrŸ?™ô<×´KU.ý2îÂéË·sª £­ Ž"4M ER.ÎE2=",ŸQHz–Õ¡³£:Ž–½‘ë2ÓÙÎC‘¯j™þ˜ríèùk™…ÍVöVÐ3eGjȶCÜíÔÔÔ@ô `sdã˜>»­œ…å¯æûý>|8oÞ¼’’’ö“Š¦’Ü>ä“\•Y+V9[Ùú­Z·d¼=@ðöæ4ˆoÕ³¼ºw·ŽìHåÍš9&»þí<}‚GT û8b`@åwæH¨ª–¶ ÓÒÖáãÁÇŒ£'Rg-šqýÈ©f®Ö‚ 5¶FVóV¯ófƒ¥köÅõ;EóÃÑÛïä"[ZŒ4µtµÐê”:FECKWG£ðYBˆ¿†P[¼Ü—4GQ«—»“ “ÛOÎ3×øº˜÷›¾bÑì @Vÿê54_zn÷¥J˱Ž ¥åb¦¥øÊ#ARø–K7gV|Ç[‘UÐg€ŠÕø.ê`Ô\ì9¶w~ÎÛâÂÌÞ ÆÖ6*9IÒê(Hõ_¸3Q.N;Çn&:Š­3i‰LßÄP]Ûˆù˜’×LCFÌìÿ[t&Mo×^*:°ãƒø2ppóìbcÖÁØHU]•ƒÐ¢ß¼c2+€õÌ:¨ké«JŠ^ @MK[WG=çuú&¿N€¬ òê›%¢S1èéÚ‰/?s åöð f§?Ôo¥ßÄž@”ûy+"Øp_â0Ȳ®¶^Êó^4ÜÞ´`ùöœjÂ7dÔÿé0¢¨®eÓ}˜-/7­F–½œØjÀ”¡î2‚æh»/[0´£Sÿuk–›h(@Ñã ]†üž×á*«ëhk` Cßß>/EÚq Ž3FmlPìøëÒizÚƒÖ¹Û>¾)¦É¢²†Ú7ïäcMå‚£§zjMÛðÔL¯GÞÓtÁõ†Ëå*(kkª#<5mMeˆ´ ÇD]Æ PÎÜy6£]Ú¢Úf'¯±£{êŒ_tEBÓ$¨O™=K's÷™øiîÀ+>{ÈrÊ`5iÖ±iyÈ® ž£§ÚÕœ¸ü¬ªßÝq¸]H#ª“˜2³³,iÕ¡çDÕ.¯~ÿÚ_×íŽãk¡%•gS• µ òã+·Ù¾‚F~+äi•èJr³£•2bà@=Žh$h ë¿Ô²ª^C´*'󅆹_V}9 ±Sê;wmxq‡ˆò9^ãŠd¸–¥›“Më ƒ£ææjšö*=õ½¬³“­\—G\PAˆª›Ü†LÜ ¼üoIišáéO=M9yÕÔRW¦yÜ(rÍ0Ò ÅŽ} «ü—FÒÒ }q}ÇNÑÊ=›S EO.8–×2Ó"BÇÏšcYseû¹Ì†’ÇZšõ;W/Ú#?Ÿ^»cgòåu’fW‰XXþFÚ¼ù,“ɵ´´Ú÷D˜¢²Š ‡£ô­¥ îÜhwûºñ6›DEÏ“SϽè~FqXa¤ Š®óú9èãâ:}†ZiiT8©UKéëÉéÑO¯_Û £úQ°M—÷— Qq‹Ü®w)üÈ©ÉQ)ÉÖê€év^êÛYeFxþÁÇ—z+£ˆ±¹Ü„³LL9õ'¦GˆÙ°‰_"ú«~% Y~äÓøÈ ‘ˆC¯ƒî=ÂÀyšdu/³@Ôu@·Á¥oÎ=Á/a¨úæ'oáÏÌÔ8zÇž<_øâ}åä•C,ô›! ÑÒ@ñ°µÒ Óöœò>Øî¾&¡°ƒ:ŒLäé©­Ã{AIExÓ¡ðxG%¬YBpo:ëßÉɈ)“†{9íëÙZ· 63ò™<Ï-y×ÜÇŒìÔÉqÖpÃÖ–ÓR<'èðå{<”W?)”_i÷ËÔ²Þ½ÍüU]<-år¨K‹/Ôž©„p´{’ö§ä€E<¹%¿09§yÜÎvJ] µŽ12a¢|ù\™u0àÄÕÞÛý@§*š(ÐùSoûóqŽ …qïÕÿøÒ ÆÙ WÌqùö‹>3 þ£l2äÅGïâs¦`õ á–ß#ú!| {µìšì…“#Ç(¸ ®F¿7´WY³ÌÐ…K¡ý;#¹‰Ÿ*b}Z÷P¿}¹U´ûXjªP¦ÂèOmò¦¤&Ù2yð› !£1JDOÝ5c Ì «2+àÙ¥¤üœgtð >]Ìjõƒüks‘ûwoÜŒ`ú„TÌêe¥×iX~Ê0”‹íã&’ÝFt¡D eê^÷Žz~zVt±x¦•J›âJ…5 …s ¤B áÑðxgm¼ILJ¼òÙµdÂœ- €k}]Ë\Eu>‡¬ih¤)™òn©3uÅh‰¼–Ï®åv³€Šââƒ49-5eÕr]NH —_©¤!^5a@nm £=IÊ «xs}ìô™$0Kû×+xd¤x €à£ú»u×ÒW>²Y˜[y_®ËëFwÒ³è=£ð‘<›(%ÊÔcq Mœ5Œ´­.Õò}°·WÜoÓoÖPãô8Eu.QÏÚ,,,+èWîî¢E‹öîÝ«¨¨Øî"\ÓÊÉÉÉ©³µÜ5ƒ|™N (APUê°üVNIiiYYî8s‚+ò¾ô5ŸÃá# ©¨¿÷aniiiYÙ;=. @ÿ ÙhJV×Ðü½¹ ‚kZL[±ó|è/· Àᶆ–઩A]›ƒ„h ™þVË7ýyÒ˜†yŸ¥‹KKKKKNŒê‚~wŸ#¦¨žœUXø¼¿R³›>^ݼ©:b)W¾*‡0BA=ñgæjÝ,Èó¬¬À´Ð€„ŒDulÕ9(Š ¸PßÙX£¥¡žWMGÝBYÒsÏ¥ þÔ~)„n4Êå ÂÃ% C$I#ÊFVAPœÏЭŽ…: ÇLûìô šÿx+#)­åuÑÃÕÝCžÄ†»1O§nEËÛþWÍ”"$uñ·¦M ´LL¡\DKAïDJ~iiiYYVgyºÕ6µ;{åü‚ bo³¦“ÏœHÊʾ³a™8ªcDÐÎÏ †Êí--A¤U›Ú±}Ù…‘iù÷µ9Tý“3IÜìŸR÷ ú’ëèsk§EB)-   cÏÁÅ¥¥¥¥e³š’Ö D ´0oÙš¤¸ô¼ŒÈ•\Ý.šj<A0\AòÍg„¯nŒVˆe4¨êZ½N§Âö´Ô4w6Pê¬%Öê»xÃHãZu'%.Ò¶–%]«ž£–˜Ö?/M•zÿƒ8„¦-Ò¶–¿†jÌ~XÑa´[§YK|sÓ~­Ë Ù²æ׳n¾Î}za€ªN¼Yhšó±èéæîŸU—¨™ÖgRb A‹Ž:WӼϒ­ºìkÿu-Ó™[ç§}øøêÔl@QÇAM•‡ çµ ÍU#”]baùÏX-‡þî!D ~s:dãÆ·¥Õ’У£Òá­»NÇæµë±ñÍÚ¹xë¶Ð»Êd?JuvÀ˜øÐe[·n^²â@=¨¢ž·uÅÁ½ûS²Û.¯0tnÔÞ#ñé9o;ŸE1’K¿m¹WXµsSpfq4§öô þÎøÖ’¹ò×¥7¬Ý}©ÒË\µÝ¢Ó ÙS–û/ß²ySäÝt¹Wyì%Uäw†®è}[îÖí߶ùeAÃ7ã%ÒÛ¶}ÏåûQý¡6ewV­ß´!huJI˜Z;< ÚžÔîU R\»iýºUK¼Ñj¯€#}ü1`’ckOG5îÚ;¥´(QÙŽÍyUŸNîØ•ÙøM ÉšC}å+D>Ãû=سõdØ®â Á æÍõ\»nÓÊM1½ÇŽÿVòÝœíÇdÐ c{«-\¼ü¬p˜·›…³—^ÌÒuKJtúwVBàþŽEK÷Ü—ßùÐ…;oïîßt3³DXð$puÐ2¿é'O3Â`ÈHÿÁn¼ž‰/‘v$ìZ¶.mü5®@’rqÈ®«Í-:0´{ìÛJ5­Z¸Ð¿¶ã(iôs጑vŸKW¿a¨w¶ˆª©`û–]åÍe‡·íÉùvÃ6Q±`èù Ñøñ½ã÷î8uüPˆFL¦ ·Z°j˲͉ý†úЂµNŽê­.²—§ƒ§®Šú^Û$RNl[¾Ð_ÛgVGE:'|ío'ÎÇgÔôöè€`:N UOö>YÞ(€O)—\Gùv…¨ìÉîe«Ö¯^wÒ¶ÿ0Á–Ž‰Þ´"44dñŠÃM$ Ê&=t ì?˜^Ð`bfzûp~?¿Au5UÕaýµoEFœ¸tGÞô=Ç+$-\ÑŸ‹@ÕË»;Ž\ ÿ{çE²ýýÓ=9‘s– ‚ ÁˆAQ‚€ PÌ9sň0+æUDEDAÁˆHÉ9͆ÉÓý¼@]Ww÷Þÿs7ô÷…™îêªêªSçTýNñÅM“~¼qtƒAò¥3'OJp”eb¢Ðp6îtô½’O“©¸Ðcôª¦O½¹zzOøúC}„©è¸8 o—®Ý±vÙýÜ*hÈKê7z_]}¸5á\ܱkéYy`÷â‹«×®9œ(÷2buPh³G“*êÚ@ßÚIï~Øš‹sŽ½9ôÙ!×÷„…m‹ ݹœMF@ÆûÒÊÏo]ºbõòù!s7–Ê’“÷l\¿jÿ“€…‚€´f®G@G„HÚðjÛŽ£\AÙÎÍQÕd‹QÖ²¥ë·-Û˜èè<¢ã]ö½°V€R†ÖNºxæDÜEU´Ô„²øØS‡ÖvÔƒ î…ÓèMŸ†=²{õú˜~30´=,jW„o ÿü.—¥_°÷:"ÄaêÚ›J/œ¾ù” †=ß¿6lõå7Om2T¾~§ä4žDìj! ø¿äï­2Wš¾g¹ëÁ –„ìÌï—Ôl _|ü‡ú¯ª3¼ýmT\ÅÙc>SN¬•øî™c÷WVÆ¥ü²5s7m‰¡þ­êZܶ-…áçð/›½±“;6öуMX-ÿ}¾¨Ìý½­©¨#³idÂhù#s¡°Dg¡ÿ®!.ò1 ‹ú¹«ðÛZélò_¹¤åã{õZ}vµ—Õ߬®q¼](e1©ÿ²Ù Etƒ°Y«åo ·¦´¬öKt‰blkóWMýDð7]áK>fç´}‰R¡ aÆV ÁÿÐjù·/ÊäRacCC‹@Lô‰Ÿ,éen»ôotª—K¸mBaýŸÝÊÚ\&hIåD;üƒù¹¢?77Źƒña­]Æ3i]êÊ°˜ÿÔthý8Ù{Mëwýe×MtvvvãŸÙˆýdÄ®]])ùÃVKýÇ«§îÿ|@ÕG¯œâêþøýVNüÔÊUoïM÷uwö˜œ’_Bn^ˆ÷¨I ÷6JÇdç·ÍwuñØv>³ë!ýOã<œýgm)m“·–¾rwuvvvZw°óçdÍÑkC]G-?”,”CmNr¨Ÿ»³Ç¤¤ìLX9ýÓˆãºôh§[ˆªž/™èὈ'ÁðÂÇ1nÎÎÁa§›e’ª¿'oÁß—oý1 ³´´ì¤èOSÒvwr1±-îøUåÝ™½)Ùn&>U·±S¼Þ½ëhbÊëÚšb ³Þê,<ãfì©Ëwäª&Ý4¤ü†ã·³>>¾”ø²Â¾‡vüõ‡¯’®g–Ë{[¢˜àÁÅçn¥0»õÐBÊ÷í8xëÁS^k ¦`n¢ýµh–}f—~ȉ%Þ¦«üg9O"ËO9ÿ¼:åJlV‹Bo…Ô‹Çã¯?¢j›é²·EÞLzXÝXS-ÔíeªòáéµãqWËEŠÝ5Q/|~óÈ©+ùÔî–züª¬QÇ_•¶[v7aÑ™j¬ú‡9¸«½ùkêÙå}·8¾‡×*s4µTA.ˆ½ö´øÙ›OòìúöÄš>ÄžˆI|ò¾›­­,—‰ùyW­wÃp¶^ջdž#ýLò-ÓB­š3˜æþ:h¬‰Ñ2}bcܼ\¥vÆÊßL®b‘>öðµdœ{7-]w28lK»½Š²jZÌ–Óâ6NˆX9Üç+ù;/wZTÁ¡K^F¯1ö˜ DB¾žÙš–þ“'È~Y“Ž ê©KÖ±óô°=¼)ÊÑדÕÉ'o‰ß{lFð*˜\JW×¾{Ç{V ’´l–ÏŠ•q—ìD÷v&ÓÆ8(Ru¦ø {°}±ÉØÉ*ÔoT å8¹»^Å;y¯áš¼â4ßý¥Q{ֹؙ)r¨Ç§ŒÓšulá0†ïœ{Áƒ¾>Þô!éø†,Ë3;}·oŠ>Ö…ùMÁ0móþãÇxs`¡Úˆ‰¨@l?jÂؾìÐõý}úÑ©ìîûrGY~Ó£ºØ%­Ù YÔ£;æ§o ¨3rï®MyrùDüµÄZTÍJ‹txëî›I÷+ëkÊZµúX¨}--ßÙ¤mcÍœ¦í»Xa:@§vꑪc>9´Î|´Ïé¡V‹ÍÌþ*Ыç×™# ’ã·V½|y×vË1žõñ›m–Ÿ_:sR_*雾Ãåòmý&¹, ¿îåãÀãÑf†Ò_?•¯çí2ÔÍc¬çÉ)ü©ßî³–ÅL½4Ÿê0ÄX5ëîÁK쀓«<.Díí5j4û;­|tFðD*ÍÍmÖÃ|&¹¯ZwÉÃÇþÜ,ß>ËO”&íyÌp3x¹ã…öñísòâVªñU£}ÕÊÒêˆÛ7ž½Ô³!îÌ{µAú²ÃÅv Œv´gп=%oÑŒ§LWºR£ù8]˜9zOv3ˆ83j¼§«ÇhŸq¾z‚‚Jˉn6*_?&“(j*w(úÓïÎ?¾ÿâ9½GÏï©MQ±ˆ>ûÓ¼ ;¾¯èÿøñ㮊þ(…¦®®F¡²ÕTQÀ nÅ»OêÏ OÆ•û.]àgl>(<<ÌJ‡“{ëÈ®Lfh°ÿéÛ ˜LÈ=¾i²ãä 1ý0Yëɨ«ƒC¥÷wVŠdi‡WÝjì6ÕoðŠàõuTÓEËg(1Ì–‡…»ôÑîZVGYCWŸò¥r¼åóCÑçÆ/Zád­S˜trC*mÊ„A;Öíá’5æ¯]e¬a:wMø´Q¦ˆ¬rùT÷ñ^'f7 ùW—î¸ï<ÝŒÜ*–5^±´ÿt1»Ï¿ýýUF£3šJ‹+êZM-ŒÈ€‹ãwl€^¾¡þCQ[¿hØÂ-À£@*€’'g{Ž>ØUÉ¥0ú9ôQewŒàx³U×TSÓÐlN=Ï•+>@O[[Í`Ð;©# ½¾=Í´;&2¬é)ßtbãÒ…áÇ2ó^=ñÏ_¾HÓéÓOå[õâöê§Æ£œÅÍØ ÁÚë¾uà t#cÍ‚¼œ×õ ¦†ª*:–{˜èè)sXÔïÈyå¾nTïЭ¥(è´³¦}*Š¤cª«(é誔½|D¢ë r°ÕÕÓQaÑéŶó¾æº ¿­þ˜a¢ß¸iÙÜ]§¥@v=°2;3#«h ·3íÛù&'·`àøá¥<5#´4»“n Ê2VÇóÞ¿)Å Õd »~½,Œtõu•ÉB²çóúcÙO[–LcjZ/Zæ˜ö6·%'i^lkðŒ`CJSf©k6{MøLO ÕÎqõ*îêz!qG7ÐÑÖTR`±™-Ï,}ÜÚ›ÁÁN%¥NÞ"BÕ5ÕT55yOÎ7}ëûÑìfÅ)~žùâ¢Ó]‹45ý›çÍ^›U+ìäÅèfcggÕMÏPOI‰CAÙŽîN†º:šÊŠ,6¥0ÕÔÕ¡,½\׋Õ%™–¾E_3NÇÄ/ ´Œô”T5™mÞ4c?heËÞ}­õ ô9dQÍÍwT3r£~ß¾¯îc"ž‚††²Šš6«=­îÛÐ*IÅ¡·Î³—/Ó 0[[S„LS-<8)`ï¥goFQ<ÄAOGKA£Ó(ºf=ºëè)+²É(YYM]]M!£P4Û«sNªŠq¿žf–.ŠH5EŽ¾¾baö‹ŽEGTô†KìÆ# øDˆp—H$,KMMíǃ|¿^Ú††¢¢œNõ´ÌÔg§—Ù9 ˜vïMa9Ìrꮥ¡kDÐ6ÆTUÙ¶—R½»þäÍ•í!ý†ùäÜ-iþñƒ¯ßÇÄÖ£ÛÊxc% jé:K‡M37ÑÌÉ/ò[d`6¸»:ë[¥9Yí}cw¯^æÝ' L)oË»“l>n±…®öpOW¶àþ™“¹¶O¨oÍûŒß_SvÞ‹ÏδNŽÝ0Üm«f¯;=mcÚ\ÌtœîÖÓÀÊÁ\• ¦ÃƒK/eþpÁ‡ ”ˆMã7¸Xõ÷Y§A–JqÀq¼.;á´æ*ÿAº? jšê8'Î'DMl¾øª¸­¡ªAJ×Pf”—‹¿õ§cÂEtöôe …Ñ,è­ãQ*Ûºg¿-«¼Îx…Ë7Âý°±›gÓûÎd­¤Ç”~7+$jé³½àcqÌÔ>¨NOÇž[žJv °ú¼¸oojt­Žº9“M”L‹ø'î¶zŽsáå-K:ÌãòVn“ Ç@KC£¸^çJ¤O«ˆa¢LÀ…-\¾ð“»ƒÄÖìíèµ|‚rf};.©\½ndt’­æ§”’ª,u…_] ¼k󻶱¼(9Í\_›¢ÞûQAÖ†Ù#wGìtîà oár¿;%r‹{/~¹)„ŽS«{Ažd{ärqe¹£•Ó®nåj Q¡!X·Q"Ç ?;Ã#l‰Ã¨:Ü”ÏÎ0 2q§ÛáRî‘5KúNb¢­Ïý—$oÛ2÷“<ˆ¤"£QÓÏø“‹îëVþÖQav3·¼¤4½'í©JêÒÊúLiã§G–òN¬g³íW+„©fÎlî½èÄX#¨˜!(m÷ÍÌ’’7ž´j-Ú×­Œ5¿Ël5öv°™±Ô'÷å—ý%(•Št¬pÄí­_)ä%Fo¹G»¹r\Ö»v¦Ñê‹ž=Õ;šãÚöcöNî_ª½™ûÝ è™GJŠŠvSbë˜uüªID6V!Ôþ±üº¯ÅÓÓKWW÷kÛ¢c_K[ÅûÍ{¾È̬kà °ùpåÝ)؈\uò—úàIý)òó«±¹5 FÝmMÏlÙþ®àýÍÛ6C1ÄMçž4¸Y0isBZ­ïpËòW©¶žÃMIÇ÷}—ó*áfv¿áý˜´úÑ©Œ YÉÄ@ãkpìÃÍ™ÃT;ãOK@^îÓÇK/{5@]‘|fó¶¼ì®æð ç$šß\½ýª”ºÖ–Ý_žÞu?#óÁKù¬/]K“W÷=x“÷èñÇ>Æ©6=Ùûõ/·³Ü§Ï·Òf!d…;'¿)kím߃Š@æñÕ‹Ï7MݳSM½O9¿ñÀ™ç)w %FÁ>C ºt¯ÀϽ *§!9êÜÃìilóÞÚZqjüÙOgLHùÖÀäüèÈI©ÏJÊë5ì±ÞÅm8táú­ûS·l´W©œ1a™¦•ÎÛ´ÇRÅn&ÚJÞÛa£÷ûNsc¢ .½¶eß•Œ·šZ0ûA.õN\LθX2uÚ6ÿÄþÓ…YkÙöÓÆö§ƒ$fÂàLÅ¡ý-4É ìØÍ÷Òž½åu›ã3”„ ¯/lŸ¶¿<È»7Þš½nÅÖORâoWŽ Á?\žùÞ€Ýü4=Ïr =çÛ ¡(Ög$˜¸ú0ñò·m;ñ&«'0éׯñgï^I«›¶P{á7÷¬žúìi¦Aß~*TÒûëû}7çMóïKB 'å䡸»/Þ–ÈéjƒzÛ¦ìXñ"çÅûFõ¹ã]tÄïO]}œ™šÊ<Íw˜YÞ´ÊÅ]wB°UWgßܽþÍ«G`í9ÁÑű‹³=n¶Zï­/«¿¿2ìð÷ï¼c†Lû`çÂã¯%T^AJFÝ@"y²}•ÖÈù&ÙªeÕÞÎ ‡SúöÑpþ‡Ã>æ¿Lø¨³`öD´âEÄþøyï0M›QŽ¶(@Ë»›7ž6Ë´mŒ•yí,—ɶAg|Iõ’±ãYÖ¦…/Òj„*v=m^_ÿðyz®Ðr–× ^F܆ƒç¯ßHšºuƒ½‘7orq$¹tS¢ÓÉøñ» sÓò›µB}ìö/ZrûIêåÄ×W®ê­Ë@dõ \ü,§ª‘àþ‘µ;ð8ü¢ÇÏ+{õÕ ëM23-~^ÞªÐËB»ôjx®¢Ûè~&ÅysaÇÔ¨²)>½QÞ<8}&ñUV)ÎÔ´Tl_¾#ñÚY¤÷xÿ–cx_µrêéM7ë•Åe©ÏÊzh«Y¿5æþÃ'^ —Z«ÃÞÍë®^½üŽê8cô2Š¼¿ñ©•)4…†7.¤åür-} O°jËãð]±I×Ï×k»Lqé<Ú³`Ó}ðu¶aîÔÀ Z¦ª/Ÿ¤P´­ªY~±R «J}Vl;°MÊ]qðբ哔;Þiõt×àÞ“UH mxµuDZŒ¬œFžÐª¿}Þå-G/'^z%›·,T‡M¬ùbJe ×`¡õF@ðÏâ˾B¯¥3ÇW‡ÊüöÌî£@ô’¯ùræ"}LXÅ¿Ët k-òð;}þöÆŽ™O^}eÆIùñ°ñÄ6͵òã3i§Vîä1ã¿:S1tÖ˜ÞDSüà Tæ~“v>ŸÆb“‰µZ§ A.ãK€ÍøÛT .—µKýÓQ\Êb4&B4å?©•;_ÔŽQ˜ašüc­"Ü›MTBW™Ãø›˜ýU¡°™D+þãZ¹sñélÑŠÿhˆE aµüL*llýÁu¹˜ßÜö¿WÜ—ÚêêêZÅÿ‹ŽµÔ×ÕÕ5ˆå„@=Ž·µñÿ‹I<¾ôï¤ýcí¼&9†ÿ¼•â&þUôÇÛÛZ1¢cþ Veâz®€H.A@ðÿÅjÁ…'‚¾0}{úkxT½Ùûö÷è*´å%ÆÝ)ü£×oý˜<Ão´ÛØiï¹ÂR\xâÄ—?½ T,(z·;å{‚÷w¶—“““Óøy[›?1k$E±G®þQÑqœßÌÛ6kö“ÆŸWXcÁ]7—ѾÓ~Éæýþ4¼ØÑÄKö^•þìù÷v=¬û¹JAl¸““““Óˆ5÷‹k?1ÝÉiÄŒõñ<)ÞZüb¤³“““S`Ø~\ptm°“ë˜ýÏx²ÆdŸÏýíä£Ü®—•5%o¾´Ïòrrrr3qV«ûpÿ´ßhgWÏi™-âø#œœœœœÜïWJ——Ü?ìí>"hÍ™\1ůãú#\W6Ë@Ö–¿8dƒäg=[VsmŒ““»×¤³Ïª»~Ôz.k”~ÇÆz¶{–“““‹»çÑÔjìg•¶eÉÚ⟚è¸0&t\½à×Î )9uæá—¯ÙüFðgÞÊ·÷¢/–}ÑÃÄ ‹Çì¸öüó P9ÏÇ/+—KêVNórr³ýÜóq‡göÞ©û¹5/ã¾]8ÑÓu´ï¡äZì?;äüS¡®ÑÏŠ\Ú8ÃÉÉizØÉ&)þ¥•×–.<µ~†“ëèÝO¹¸¼åĺ™Nή‹÷% äzqó§æ<%§¹vúçþ8k¿‡÷·z8\u,UŠÁÙí‹>ýÍevùÏÚ%5vûÔÅÇ»®,ÚKž ºô{rHêÞ®ž9ÉÉ)¸Zˆ&H<°ÂÕÙiÚšc\é§ì£œFí¸ôÇ!ïÞÉ c\GOœ_Ø,yëÙ-󜜜çî¸Ú&Y[õ–ÅÁ®#&¾ý¢[#mØ0Ñó—:<9¿ÃÍÉ9`Ùž«|›ì3ÒiôÄGyõ˜ dêçz˜½æÔ‹¿vAöŸNÒ¶âYãFŸ½½A ¿ŸOûZD"Qppp‡–?Š¢ Ñh}âžKc%-ãgœ?1“EWDñ¹ËÚ ßÖ¢sÌ|Ÿû(»VÛÖ%ȳ/ëáõqsÎËÞžÁn=õE¼Ç£/´’•½BfÖ]:w·‚¬iØV^í9onË“=±©Úæ>›þšJ_ˆ½-çèNfÀ’½¸w/«Zß~äÔQýÅE Q7rÌ~:Pñîá™ki V#‚Ç lÍ}’P(hËÉ´8Ú®Û·sHÛ¬¥qÓ6êÎá4&åÝŽ;ý¶:³»:ùAÜñv™ä}›zð¬´ôî¡Ã×^5fTåd-]:J®]ú…%­zö±}ú¢%HezÜ•Ç ææù;²”5ͺi&U~­e:=’°aÍíühË'çOÓYø½7£ƒšRŠ¿JÒé55È/KÚ¿?áyµj}aÎÒå3˜²ÆË'Nñ™“çÌ0d“¥mÕ—ãÎrQÏÀàžúŒô„Sóš{:õÐ×5·TeÓ¾ª•¯µkEÌ9mhlAIXù˜WRí‚·o´\g PÉMI¸ú8_§×è 1}¾Ö¥— ÛªŒW>Ýj}<|aÔ×%ÖüØ#§ë@kʬ m:ZÿòîíJfcVŠ‚ý¸^Èë¸3wÛ4?Õ¸rÞh:Š‹|œÂ S:ï‘5Öö²gù(=G@>ÐoɈÙÊw†D_ï;ÛVØ`µìÎ:{*¸,uKP½Ùœø¹æ"2ƒ¤2èøÅ‹rLpl’{7ý.j{¸bfÔ´Þmþ®ý_fh6ežºð€m:dÚøal2–{vwÇ ýMqoÏÀÒ[§“R“ë6o0íá?Ï× E0_@co¯&I»|8Ëš2kšJÓÃ=û.=-e7Wæ/^1'ùÔs7’”«äºú#ׄØ$ÆÅòøüzºåô)c”H’Œk§îçÔ èÚ·K/n~p+cnôÂŽ·²êíí,UE¯p¹èäºÝeB_Êœ¶:r!]|tÙüÒ±wMØ”Aý»ûo½32j,å·7ñârÁÆÉóìÃN­1$5‘€úÏã/ßmûÐ7*xpîDWUC‰áà«BÆ%‚vŒL§S¿³ñîýÃËùÚj | ¹¯÷‚³3ÕÒ£æî½Ðwåpqp|ËþñŠdÁåé»C‹tãcm(0•óô¸êW{%ØYû]xÑi&..^¶õ¡‰‚úîKe8¼º´çš‚;IVµá|é®Ø£÷Ã2Gþâ=w½ët©¬-{îñz-êO¬²§ïŠÕ^µKƒ¨¤/ïòØÀ`ÓOM&¼~>ÁnÜ$}*¶K“Þùéºê˜ÉwvKqc›¹]üâØŠ°èž‘¬ÕwÑc±Qñk—”yÝ+X†í=•=ò›}.=ÎËpÀ¤¸iwÃ'ÅÜí>ßYÓÑ~ö»uÂÏFË­èè" ÉL þxèv݉+—r÷ŒºýÊm˜ªöÜ-ÑP:cÝÁÞç×í½tQ†Ã“cë2­†ýØjnª*—åJ*H¹”ðô£Ùo¿¡ÖÙeaŠeå<ÏÙóm”H˜ßNe±IT¾°ö3sü†/½ ûáÔ‚m÷φ» Ä‚?äk¡Óé“'O&‘HúÉd@XÊjêêjKM]]™CE@š°ok³¹ç‚iî4FV±˜D¾3ûq~ccþóó7Š—¬‰‰ŒoÃäÏöÍPvô ô°—ËpQYbK7»´ó×­û¨lKo"ë_èms9©%Dnt˜5a¸¹Auö¤Ýe3C{è±€f2nÖ ÚƒŒ*YÝæ-±Ã'MƮϹõªŠ÷ñUì…÷ó–…œ?pº“Þò¤½Ï˜¶F:Ý,uYÔÌã 5†Aæ3m•Kžœ¥ºÎ^Í×´½fæ`DZ˧³QÝ>¼½XÛmùo64lß|dè¤@RÒ²Ëi¥?©G CYEM¿›~K›@žqnß-I¿Eó'iRÛŽ-™kí=Õ êâæS/TLÝVÏ6À}BÄÊl{¸eæK´ç;Úèéñ9v12,WeHh€ ˆÛ+ž_[p ˜<"fËֺߕBP ‡ Å‹„T- C¨M»ròaIÈ’=•Iüw±1o&MŸf(ktY¢4Ž²š†¦:‡×*¸¾À«QoØPZ¿Å×%4ç=>ucʲÕÃÍ5ì݃B¼z[´:bÁh: €ËÎNsÞ›Õµ0õ·Â'͸—Ó€£4Cí¼œ÷¯ê˜&ê…®þñȔɑÒårÁé_êË3ÏÍ›¿ü~~#ŽÐTÕÕÙ²† rÿÞF ]b#Ò„ ‰µE‡|3¢Ò4=0på¾"®jhL”e½yaÕ׊†›*š<5xùÞÒfi}IºŽFý¶• ¶½%ÁŽ²ªºšâ‡Ì´í³lÉB1é×ãA9ÿ§ÕKerôÌú†N³H*l¨M>ýBaþœ`e e-Z½P…a¼$<¢“ÉÒƒ­¤¦¥£HˆE »#"'MeÍÄeª“)SÝœ#Îâk÷hÖmÚʉ¹…\'—‘¦Fc—<ÞìcU-Wùöà¨jÓ«Óº°Ò;Õ§1ûé·¡ù­bïáݸª¾>W/jÍ.$­Ø_§[Ï^úEsüW…›öh(Éhü½f BÕÞuãöüeþ#VŸ}ßQ½îÞjÅÞ–ÊY—ïöõ›eª§ç2nd—õ;ÞzÝßÈÀädÁêþèÙtŠ»³½ƒ‹;5óB» @{¸†h²¨¦¿‡P‚/f¬ž`×µ0Ö¡[“îÞ¾yfçö%Q\ $º¶†Š„[Õ,’)š8Ü»{ë^Ò JêÑBŒ/iô˜y9zù‘ÐÅM Ïq{ìÎÅJ]OàâX“Œ®ø)9ûèÕ»wo¹óNfÖñ¶¢‹,«áµá8}êɇ·oßÙåØp8ö±TÐP¥1)þÒÕáÌô; 2q_%d)Ø}NÛCSÔ(jø½éÂÉLEž@®baÓø02|ßEe…Ÿ¸øž™Œ»;)/ˆíIË­W¶lf¸ÄÿCA dfˆÏ0%%M CNç§%kKO±øÞŸ¢¨9a¨Í0—íUå?¾7ËØr¨½—oIA6CUÛ¤2fåÆÃbªþÀ˯ŠþWŽŸì¶‘†Ža²æ¼…«Ïp2Ç0 „DWRU`4×Vuè#4k”þ0z‰‹Ï=ÛM¸ùäaewîÝûeÜðA;?)®Ì)(ò™;¡[1½;&W„pêѦà]¯s`ëÉ æ†c†ã8B¢jk¨Jškš…2i{C•æÄøKW‡³žÝ©“òÅ#Bv^ŽYwhʬz1†ãxù‹‹gM¶í«˜L°ùp¡“KÇX‡Ëj“ )ÖV 6Ó(²ÛqqB ‡/’€\P±doý ý¶0V—£`:Ш‡sä•b9Ööî²vbn=zY@[ÖÆå7^Ÿ†Vï]W¯pùy`Ç¥Ošl˜bƒ [Xñ…¸1•Ñ"À@.(Û°hwü68Žó of…Nu2üÖ8hœ;Ñw8`8†ÉqLT^ËSRUÛ‹›ÚD€IZ6zO˜²8„Ý‘H¡êF‹aSúð{”gß,IÜ9|ÐÐc×=(íúÚ¨ëˆ?¾“âdµ½é/zqº(È%b ßy”×JÂDÄLLðg¬ظqㆠ~>jV²—×ÜxŽ-()}¸Òìóàô¥»#Æ£¶§ÝˆîÁ»±$ú= ÐñO×÷q™{,õÜÍÌ ‡ï”‘8†wss÷,÷½´#¼Óâe¨JømàÂêbƒß»Ö';H}@Ë«ì/û t¼ž+Æ岌ŢtÉHè×ÙÈŸÒ(CE&lÅÖ–² @P’ô7öÃÒzÏ{Wð!ï]¢©2Pò'™„Êfâ-r —ðjÖá9@ðÏ‹Reš˜×*‘K„YªÚœæººßšVر¹ S/nd‘(ꔶ6L&hm£¨’Q@Èßx³‘¯R àÂæF¾ð7CÓ(Š"˜@©L+[»ˆåŽož¦ÿꢢ!rÕJ™F¦%‘AŠ€¬éÚ™ÌÅ=ÙßýôhíõmòoÜê,rGU(ë˜;û/=ºTó¹8t“ËØêV,Χ"ÀóKWÕÇÌýr ACi]úçX†”ËkûmíiaêÛ~ 4C÷”ש‹ÆÛÍZy¦cÿµ5™õ°°0?~¾•¡Œ [1ÀEuåt³ã•!}åGàë«üfôÛîtÚì‰}n qk»IS)Á$+š&Ìß¹Ø;nÛ¦ö®ïµ’þ—¼ ¶Cù©W¯&½yšßÂ2ìÞµËyå5/RŸ™£Õgè¸9c< `‚&Å€öYGÔÜ$’|·Ôˆµ£÷Á˜ÃÒ„ÈVº^ÿåeççŒd1è•B$‚ѧNõUÞ†¯äé\œp+µ8ïÉý²JaXvï¶dø›G), +6‡$2YŒ“-”d ¤…É'×\–^^=¬#Œ%hÈ.ïÚG €Ã­È“=\¼€¬Ù‡[)\´g—£‚†öÉ;7"E³NqðÜ£¶¬+s ñ²B1ÞZO¯¤'¶vbH¶/\Û¬ªÕZ^à0vu§ÂX,E–ïZ[mŒ#F«×v’íGÉ “A„³r½÷–Mk¯oìê0©siš:lÞ¶³ÜaØœ)N4Ÿ9ºÎûpWwËåý›ž•·µ7”ú®Ø¤,È ;"c3ŠsÊ'¯_ZþæÊ®ØL’¨V¤?Ú‚IŸ³.xՎՙ탖†«PцÌ[/Yn*Tô»!°Énjϳ*‡kwÃx©Ë#®#Ð^.|\ƒuýØöÔB®¼¥ÆÒoª–´8|án¹2» P¸p‡£†Z‹ÁÖ¥«+ôë›´öi‘ßx^?c¿õ»++%Äög &køظûiû5º¬‹^ZUv·Jæ¶ßT­öÙµ½¿dq ¥G? BSôìÙ²Çîa#'´×éÜÇèL À²u3‰Y¼f=/¯4d§C×ÜvpóŽ~ƒÆ¹›¢ò†å–¦|ßÝòëEgïõþÈ#m3f°QÄÊÂ;¨ IDATpÄ–W}GÍóׇÖëÖ®ãæz†æWæD¼ L“’õ¬ºnáAÙƒøM¨¢`;`Œí¾-ÈyíhchdchE)7† W%†íº"¢²zÃCó¨P——Çt fv8Æ0áÉq½•·?hoÐ)$³nM®Œ´ÔtŸ6_EgØ0¥Û‹V­SDøýý 1òäŠë“tò:ÜŠ8–°h\ãÖ®î–N^j’_4c#õI%ëærX¥y¥ãVÏÔ0ƒ­‹WWÔ5jEi3$+§­Ø½ò•¢dÀŠÍPè»òˆ¾³Ûö ëœüg:ÙjgÝx¨#ç=†µÇçªï\o«÷@õ¿uj_R>scÖÑó¨(uoŽlÈî0¨÷?AËHÞ¸&tíÆ“G§šä‡Ô³¨áLÑ¿zx£aà:;˜ Ü«ï¤ÈôG¦JF†xqèü…‡Qÿ¢Õ‰‰'Ú]yÿQMÚ?©¿7mSΩKá>‚¿„¢ÿß|æ–‹ÚE›Eûw>½X$¡Òÿk ò0™DŒ‘èÔO>%¹„/G™Tò?B€ñZ-8&k—‹þ‡ýq±HL¥òa☬¥M¢¨Àüs‹ç¿¸Õ‚cò–6‘‚ëßpà— R‹AÂj! ø£VËÖ`DMüoáñ¸ÿ!òý§`r)/ùï© à2A³P"'*–€€€€€ Òj)ʼ6#0pÆ’õïªÛÿçÏõst=Ý8íF©°æ=«æN =|ý•ÇKo Üõ¨EëçO ]’Q)¬x}®ãkAóß}O%½âÕ•[Å|hx›ÔñÁ°¸{€K2Oo™>%pц£õ@°aN```àôù«šÅà’'gwEÞÉ•·\ø‰Ý'“@ÞøäÔ­ ¢kt‚ü'¾ƒ Oœ}¹ŸÂ¯: —‹ß&]I+léåì9ØJ+÷j }ø´*>©)ÐϾ9ûQJ-ƒ›ŸÉéé>~¨i}þ“„¤· †ö~c Âº«ZÈÚcüÆê0¿Ù¨^œr#ƒ‡5×5 ÷l©ÆàUd_ºöˆ¦ßÛwÌ`6/½u¼‚©ŸSbâäÛúüÚ£gÏŠåˆv·‘!^$µ )L&©Ën@—7?ü¨©ƒ©@ úÌZH“^Þ^:ü¤¼¥ÉrìªÙ#´©,ÀÚE˜³qŽJQ (hxï‹rY}Ôγ挮uÑþøúãÑëü¹ô]¸7ИBg zý}6R+K>q8ãÐBÛVÕ!{6£ d*R˜xâÏf÷Þ霆2û£ä8<ŽÞÀ³ì €Ðô]OEó¼*{÷ þC_ ‚R) ,-«³õ5•éõ¹ÖÝ—{z:Þ:~¤^†•¦Ü¬i•aíÕ¿$çc­E¯.Þxì:«_7UqÕóµ[o¹øN²QCE2þÕÍËUúŽjÈÛ·ÿV§[T¿Iy]Á˜âç¸!<¶EÒy ·çx•ñg|ÀkÓ®Ü,À'O›d¢Äò ™ÕÓÄdÂœ3½-H€¼ywðÔ"ñw"6tEå˜=ëWm>TÈ•à(SWAZ›]…ë+SÉd¶rqÒ¥Ëפä7ÈÛËÒs[žÞ»aÛ‘ÂF‰ÊPQQ‘¦`Æú*FbüòŒj%…(…fÇ,_ºìJj†µ-Ì*‹rÊZ{ô4@D¡%síÊÛb’D2üùÛr´õõ–õ7Ÿ”#dEeeæ³FM7{ „®‰Õæ4A"‚ÿÜj¡®ßU¯WMñ¹ú¢ºªüèYô mí ‹÷I’ÿU µµ.nwW,h%±ÃvìÝ=×üZBRÇÓ\¹•çè5ä;n'Q³ewƒÔè3òô‰#'O.º}¶F¨ªŠ *ikäKpœ±ÿøñãÑnÂ+¯kZÅb®æàÙQQ‘—µc¸´êË~ˆÎçìs,*Ôó «…€€€€€à?¶Z¥)ñœ³?(/ûΪ¨‷ %Êt”F¹“‰%_4ß¿hä³XüªŠ{¡²õ4M¦¤¤\ØßEQä­|\.åÊ,–*åc€K¸µdzGÖ7„Dúµäà_‹ ó››» Hÿj¼P) —‰¥fmï<Å•ýŽ÷9 BBA†04 Ù$%S—H*>P{8j}G5 e«+`\ì›´q(™‚ ºFæã':ܹý¥44EŽãÚŠ* !#¸ÀÄW¶œfgóåÍ"0P"âCßNâæK’ªÛŽ‹y%§®6Ö5„oØ—©Æ¥õœÄ!µù¸ºWÂn¡[§ïi:¸Ú§ìÙ³?—LR2Óoî´ÞûvïQc# zý§ù:vrè¼{•ƒéxM×W6vëEÙ´û ¨¼dÔüÉ]‹ÓÃDáÌÁèî=\'º£X˾™3ýc/šÎÁ%‡6G 8ìšj®ßì097mÏ‘Ç€J«´Âüé÷ÏGg–¶ˆš«‡M™§ÂÒñ¡¿n[ÚP<(`àXɽÖƒß3ðP†þpKI“X®K&ç<¹’Z ‚¦½§6ÞthÃv&³©ºÎyüBh}µ=*GEÕü>›4Ð1n©‡vxÊdö÷6a¡ÂÆ’ø†Añ_òc­MônVÂj! øÖ8øÊÜÿ§{—}6ÕNé¯_ƒuy.µÚÎë§ù_RËÄùg®–÷ pµ%z'ðxÜŸ«Ìü4,œBdøñ‚tc¿ f4¢b :ñõµtðÅ×Bhãü=øÿmµàri=W€ÿሠ.å7‰¥Øÿ¸¶p\ÔÜ$ü¿(Žµ´ þ`­à>W"LjNL@@@@@X-¿‰¼ùõ¼É“‚Bb’ò~º£CÚ±#òÒ¯?¶ÕF_È’þŽ»$_8ø^øë ]óìLq£àÿ®"ž^;œ%ü駰ôÝ‹’ ù_~–ñÞEDœüR µ¯b’KšþL•6<8÷èý—³®î_½óÌç{´Ä,›þKµ0þ¹Ë&­‹Nl—áÐVv÷òër¢üK ­_¿^"c8Î`0~ï_PœøZ´cüçÖ²ìltYž\?ý¬fª£‚‹ë/ÇÆ=|žE3î¡.ÉŽ>z>ýeNuu©º±‚øã¡ØÛ4³~¶Z(H^^ŠÉÊ}/-_ÇÊšJ\=s+éi£\ÑT_5ùjÜͤ”‚’Šìb²­NAÚÙÛï$Ý{õQfRpLòîÞÅK· ™ZFìü§žæ?H~®dÑC•öV—“~%#ûÙý{R%}U¶„_q6&>£ ¾›¥)ƒ„Ô¦]Oɯ{xëF1bØøêÆõ»ÉùEï‹>=ôH.noÇHdÚé`^òèú %ãiº¢eOeQþ±è³i/³ëêÊØÚV¼ü¤3Wî¾Î-/(jïÕËðíÙ#éïóR_êXZq(Hñˤs—ne—·X[˜;]“Üß¼Rß=Ô@™²æ7דÓËê©®ý ãÖùW-\…Î6 $EË1ž£d÷·°v×W¤rtŽ¹?Ü©!z2Á?‘Hˆ¢(Fÿ“"…¦ªià`Ÿ“S—“¼þ!æ3Þ;çfln»¬äü žfÿ c†‚')õœ<ÚÐÄaÑÂ&,²ŠõìI#ï¥Éä¹÷®J¬Ý]4«¢/¾cÙMš0¦òNd­H>bÜ”}-|æ,ZЗ‚€õàI#Ù/êZÄÀ-L K{z{pêP /O»U†˜úT_½;Mú­ã§¹,çÎýê©3&ß>qºV,¸¾n¾¢½»5únóñg8ܜԄԂ 3B{k2†x¸ °ôš³hQ`?*€ ãƒGÝ{Wó½G—Õ ™N6ìÅ›S1ë!ÞÚZ=,\dk¨hÙìÔ±¶#&M_4ÝŽÈ?$]Ó]¾y÷]9.9pú©Ó„€¡VßÙòŒI[®¼¦ëh°“òOì¸â8rU?ÁS÷°U@i:Zœ‚¼œ·\emE QÙª5™e|"HD@@@@ð¯à?Ú×B¢+H$ÒÒ‚ÔêÔ#“¦Ü~úâUµ\ÓÁ1ñtÔù”BSUòÃG$¦¢²…¶°¾ ²®GMœ4í³ºZɾWW•ç:ÃßÐÐÆÁœþª  w·6QÑÒ’”Ê;1rE§*3¸ïªjïPdÓ­¿ËpqîSu2J™É47Rê\ (3äbê˜Þºß»?¹ß AÝ»ËÊ ¤?|<„Dëcª­cÝ›\œ*ÇÉ”âÛkSºV¹LÌÅ8t2Õo/°ýæs “Ke’ÝÛ®ëŒÉ0¹TŠá8Jfhª)Ëx5mb9‚²I‚aµVËÁ±ÊY:Z: ¶ŽëΓ“““ïšÑXÖÓÏœÜ3D¥jîÞ7_’}^ø’˜YX~“o?+ñÁý°±š¿:!¾7SéœÊZx{»P•¿ Áy•M8­"¹2›¡ˆ¶‰e˜Œß,¥*|²+(ßèÏ~u;LÐÜ$’ʾ_ìNÙ¤¿N'öù'“µ %2O@â €,Ú³{e`ý¥%2¿aÄÄ%ÐÅÐ102>y0×fpw/ .:7Ó[sÕùßp·|å.â˜3ŠNÄÄ w÷·Ôå(Ø?:ÛdÛ/À¯àø•¸è$qS¿IsHˆäÌ‘C<9Z‹[Žat®s”¢äJ¯¨l6³VU2àfÒj$ñÍ{]èºÀkÑó}œ¥‘»dTRy‘hÊ ‰š„æÃõ„ÕB@@@@ð¯àŸ¬2Wp'æ4â±Õ]ó°Wöì¹ó¦µúïR¹ÅÛsÝãÍñôG ¼>óð[Ž¯«•&Ñ þÁŠþ1ã‘e5cŒüZWª½Bœ)T¢öþ-Ó%¡èO@@@@@@ðW†Pô' ø›ñg­\ÞT[SÓІáÿʉKÚERùoý“‰êšÚñÿRaäAMMM›HJô‚¿¿Õ"kÜ:kEƒ@ ˜¤åâ®e'¯?úKÇYá£Ûö”JþËVKíós¥¿)¹/®y²ö2dÍñ›LYø¾Ž8Žó N^{QLô‚¿~7.J¦êj)¡ä§_ÏПbØÔ؆KÛÎ=õäeFõþ½zf£§5ç¾{˜\ÃlÊ{Îé5zÒP÷I óêFOd®QóúÞ•Ô|º†Å8_7jùͪÈzmUõnÓ‚õß(©ä>9s/ñì…¿¶ðÒ»(|¡ÒÃÅËÑTž;sMFF4 ±èÕÕÛ© Õs’Ï°Æì”\º»5ûNÂí¾c4iˆD(ÀI4µóS¿¾pàƒ®_ä$Òâ—îšÆ¦±ô49HÑ=þBüöµP™Ì¦âÂÒª& ]] …3yÞ#“€ù‹C=ÍQZ‹ß\¹ýÄÖÜA¦jîÇŸ)T ð¾qèx©—Š)ž{ ¯#Ïf‰ªÓ%¦}²î¦ZÙª}ÓÒ)ÔcíàÆyY×*QsÕÙÓÏ<§&^h–‰¯„-ÁÍœºQ[e¸´îÈÉÛ½'ö’ݹ•Y¬ÛM/ýЖì‡Gòejê4pìNÄŒc¿ät}„—¹õÖ½tËÚ59UÏk„„Ô,Á?Ë×òcßcÆ…—ÏÅmDOß @êt€µä¥Ê ªê«\¸ôúÍóþ×€ù¡Qf*.Z´£]*µvê¦$#-C¾‰‘‰–vCÞ“/#ZÎc•ÙÊ:jOÔ~¿XqM?+zéi­¬&õYZJÊóTè;³qâ þ æ ´2ãü•( $¯g¿{E Òº¼ 4 È$rœèÿL«¡©™,ØDÞ³öy“ÜUƒÜIåžü9"Ãfjîß5­; ÀøÅó¼?qí9;." àWÿŸ«–üª©’•È"¡— %r[ÛÖ}ú¶•Ÿ T~y‚ÿ¿­ÃaÙ»°B};Þ¥–¢‚|y™¬üÏæ[¶š]½ |¶âÿ(J¡PW²n-6B¡V£qrvù=µðù|¡‰°üÏ\.—¢€vsÓõèþ]¿IÚ ×ׄKáôÚ?…ûð!÷Ùs6›ý¾K „Bÿ"¼+¥ö.µBÈoOñ!€€ÑÏO5~üçÖO}µbSØxý4}F §oôÜ–ruÿ.c»eþzjy~tíÙ"÷E{½9·}ÃéG”•ÿ¼¥3\øTYƳå«Â³i‡EËùX²â/m_}ì±{аùƒ›¿8±uËÅçfÞ­æÍa^v#tÊ> wÄÒ5ò ›O‹ÜWÂâ§Èø=öqRºâÄÈ3·lÛƒzY°u÷Î|™«ù¡÷Àšö&™¨ S#c‹ å¥UÀnM}Ïðâí>—7¸µ.òRªÑÄŠ#ͪÙm)ÔeGoÚ˜^»mŸæ~FmiÔ‘Èʦkß^."VÁ£³ÏT–9ñ¯¬÷éÛÐ1´"4ùÄ}ÏF鋧Œ2©%Cˆ]¶ õ–'Ü»àúÉ% ví»ÐwÚW!-Ry//‡Å8,^µ–E± Ãpœ/\Þ?ëæþ[­×lõ†:„–ï»ÐÇÌÄnð¤VÁFƒ"aÙ¥5U¶Öá‹Ã47Ö툪:¹{çõ‚ˆ±8bõ~_þçþþ‘Îñù€Bý«©…a†þí5÷ó.¨’RÒ¼<¼\Ì8on,½K‡w?¹s¯‹ïÏÙk&3sÜ‹®n¸§ØÛëÙË„¶AõTÙ2š°ßœ<’î2£ãu«w9-œ˜pó¼ÅÄmm3Žî87¯¿ÏÒ…[œÔÊT¥6“Ž®}ÂÔY4g^ÄòMSm>( §–ä;s`cÈþ5[dfd=¾Îöïé&.¸|çmŸšêlâlóül£)ãN?ŠïgNŤü2§cØš]îK~z²ìgÓÞókkŸ®_wråì^’·Ïeû-ÿyXi‰aè´ûÇgD²ŽlìW)¶0º²­«N· ©—%eÆÒÕ-9îiLBz£¦}@ö&£ T¾{ƒD#7sjQR¢%Þ°æmõvC«7ª‘À”6%À›‰å)Ï_ŠÛ±¹” W@¿=¨]ë٠Ή)µ“&2µŠ.½–¿ØŒ[}VéÒ’Gh†ü+ƒB¾ØB¡ðÄTé C˜ÇZ*¾|Zœf-šùøæ…Å«¶Ÿ¾Ù%çQþƒgcîà[çHž¼âŽŸìí¢¨ÇºÎ0å'?†aÃ01o^½¾~jèy&K ,¸–“™e¯ŽÏ3è, ƒkº–ÐÁ˜”[‰OnqžÜ`eùûÈ û–ÍföVL©ž!ï"!„0 ±³uuÑ98ÛºÔ¯h1x¶éakçäo©|•žqâI¾<æ'Š+ŸF„0 CÕmdÆç›9ó Ãx6ïÙ€0•‚Bú³V!cøOh£Agd¸,°°¶±õ9%J£N!3ñXµ`¼.vÃîGq:í3zÅOö[Ïy%kY׌eʼn6Ιï[¾ÕèÇÑA£'rà š¼õÇU zØ0ú"šb§ßˆ¤k×'Fcy›_¸ö¶Å¾ÿÖPGù`Á±„B߆Tž×òÑ$òÅi \ÓÆíƒëø±Ößããdßzþ¾©uL)0*’x*•Î¨•«l 4aT¥*°'B¡mðòE!UM( ÚH !àÑ%ùjšˆYf|ˉ7¶uT*ÿúíÄ xlÐi£V_>@Tþ y7O‡‘HÆQ©#~æ¦ö«wnq²ßŸ˜Ylêý–zBKY˜ *]!2w®a÷P’"+‘¿-ÑÕ°åYÙ¹µîØqãè£êží„ !ÀâÒ4maîÀå±BXhÆ Ì\¸áþ蟆óÊ÷a,~¯Ì-ÿ)ûÍ }‡‰6<ÊÚŽRÔ¦¾ë¦…7!ô9o}Øÿò´‚óZB}c-¿Ž8ï_©8ÖäýßTf,ܱnŸJhZ–“ÝbÐ$'Ï3«WlzälÐóúÿ8läØ mÛ7[rdT% pçäî>xœ$)<«‘æmÚlؾj‹³J+öc/@S3X\qpí²õk7Z›Š:Òk@ûðÝaÉöJ­íØ ½Åì #å„!”çVgç[jØþž„iâ™­—¤ kÚÚÛŽiºcÓFK[äXwhϦ„Àïï:óñÙÙ'©ëúTºBdáR§µ rµ7‹¬˜Èí›2U´ZZÚ!t˜ÈĽ…«jùÚMúüìž“øòMY«×nzc)³¨SÃT>fªÎ£ñéýÛ­Ýš èV·äÉ­KCŠ)0Ïï?7¼# àÚôè°*,œ–ʺŒH}e·Gî|`þ­ÌðŸ;B!ôž™ÞÞÕÆÍÍÉÞ l˜oÝf¾u»&(°xíê¯Þ¾¡0zÌÊ´mkƒñ©>ß¿¥ „B­Vëìâö{mÜï|.'xøÈ~øȯÞ£+[™®q~•…©å{ÃÉΦ †»B!ô¯¨|CÓF£±üÏ4Í0bS0¹oþÊ>ê@‚ Ûú{D‹Å´‰à}—@!„þE ýîžÖÏ<=qåJl£ÿu3gb „úüåg>1(Šu\KS÷Ï­FkòóK¹¦æ¶âÏ.¢–*‘…)ÿ[iEBK¤ K+ ¼†Bý©…õ•0HV ¹šRòñ™<ÿÜ/Wc ¾b“”&vóž‹_X@öxÓ¡kÉWès/oÞwõ/m‚‘mݼç/b#éöqõheé‹'è2êàÍDcɦ™c‡Œù%GÃ-?¶vV¿àó·ßPÓ Éx6#4¤ß ±—crˆ:éôÔQCæGD½ßnvô™!#Ê „Vf®Ÿگߠ“ϳ€ÑÜܵd@p¿i+ËŒ M>Ò¯_¿~ýúŒVáç!„Ð7½páB½NÇbbbòÇWSf=ÛüÀ˜g0k_Ï…D•õtçÞãÏS¤UþS¬á IDAT|4oÎåYþà ™{/$Õô·>æ|ìÃë7beÕ«{sÕÝû"/Þºú2Ÿ=Ñ;z›³ ñÉy}€“‰ôÞKY«ÆÕhÕíSN^y(ôðwóŠ’mÝs\¡ÊSˆê7ð5{pr÷É{Iy9©ÎUª ˆüÜÁÝïÅÚøÕ—ÞÞ{èJt|ú«[Á©š£ëå•c‡¢®é-Ü=lMž ñN¬c@ ±üÑÆ-‘O^&¦gdûÖª%â~pk5£½slBÌ£s3¼ªWcÉ2½P×tÇÜ:Ãqt?yàÄÇOJ¤)—žÈjûÛ<¸~½(-îÖ[yµjž|ÊðúÚñƒQW5"/s†V¾ð4óé…ËORj×à°ˆZ¥fñxçDŠ-¨é-{-wkVÕ™6jm«¶è×¹áõí«µïð|ÓÌš¡?YŒ[Û«­7KäѯÕ¹EÉâ¦Þ¶&Þ:ôi[}ߦCÚÿÀ'”—;ëI"ݾE- ÉGŸO(ëÞ¿ã«ã/]…Më±iÙžF›2ŒeïA!f‰'N¦Ú·kÑ´MûŽ]:6ÎzÓ³[GŽ!„úöhµ‹Åç ¾r¬%ùMBËÐAðør¡Žè%)£Æm«ß¹`uG- )|»c×éV]šò(ý­¨[=‡ûgl{•)KºvðH–ãÐà–[ÂöiTŧ®¦« Ò$Jõë»÷Í8¶ÿdÿª'Æjƒ{µX7{c¡*Çú†d¿.d âonzcÛ;ÐõâÑkÆpuÅäRÇf}Z¹Í›¼Y^›Ç²gžiÜ·õùGñ©wŽïN´:¬ï=;S5Æ”›gu¾í»ù(6ˆaY78²M@ý¶Ó§ŒµVº˜eŒ¹rIÜvDk“èÈk©zEÑí)¤¿y*7êoÝŒñ_xÁ¥Ï­ÊUÑŠ´ ó潪–=ó0-ãñéðצƒ‡ô{xdw’Š!Œîò¾¦ zëÕ’ ‹Ž˜˜cøÄ“…sUw;qù“©ù¦Ž5|Ýml,L& ïÄ*¼ÝLJØΜפ´iÍ:¶ÖV6O$ä[:xx9ÛÚ˜‹ÄbEñíªú¸Xÿ¾˜óûÏVíÞ—Kx׬A'=|üø¾Síz“Zê:ØX‹±¹)‹#°°°0fD;µ`dA!ômã|ÍJ„~û6µk Q¬uâË4yCººå”ú>N,p`²vlXѤ÷\?10«ZÛ×JdÓØñ¹J[”ZЦßH;7®µ_fÛBûôæÙø;šÀP‰Lh΂ï²½õ"ézâã›{À47³a±ÈßßÉÞª³ßI-e¾î=r²›+·i­ËÄ <ù$7íÎô#pL•úÚvöž®Z'wGOƒæåë7Ññ]A“#‹/ªíaã$vÔ<Ê)¿ÃésøÖŽ íùºNWbKÞ»ò»®8>¾ìÇl¿jYzûÖ ªæʲ ^x1ÛV÷$åjÜàkÀ¯Qbôv“j]šWµû-Ù¯:¶ûµ.¡/mÝ(ì4YÌÃRe<»*µáƒÎÈ!LþëóW\'l¨eŒQ»wÁ¢!«Dç>;*ݺî+`­5Њ‚ì2–›“UÖ•d!<ú¢‡'Š|—ò.ßá•k¯C~ÅB¡ÿ‡©…ѤÄf좟òjùÄÇÄ6¯/T¥%˜üßΣæm Ÿì½’ݬƒ3õûWx!Ÿ“Xª%n¹maç ^sÏodÜke¦ (öûb¬&ÖS·ïîäatÙK­U©ŠOd‘Q¬WJ!Q›cóÝy ®4±©w;¤ÀÔÔ¡ïše¡5MË pü£AøL=’(ŠmÔ ÐZ¥öƒWß-¡-Sêp$YfÂêB®c·• ª#.6›ÿá(-—*„–_nqÂîlù¥ JHh +£¯%Íñé2Å!·ó1ÊxrrýM²zz.Ĩ:»êgë~ ºÖ²©|ü&UªÛ=ŠŽÕêËâsË b3ZåãÍsVO*cª¨_Lß·hÞp~ùês_+ºððÀBèÿaj)zz•Uµs›6 ÷¹¹ø² ÏÀ1^‹V¬J3X‡Œ B‹¶ƒ§Ì[T?|ò‡+6 ¼¾añº+“z¼ÄMjQ‹Á•SÂ: €úX•[·Å0|THð°na[–$8X*u“~îÛ¶Úåð]ûd¯òÌ[ƒGõÀ¼y WWqN”QýÙ¦“fôÜ´aÙ-+¡Selë ÇÙ¸Mç{ë…¹8jt¦£§ ©ô.¸65IÖ–-;ÕýBúY›|öŽ'¡µ“}ìÚ]ûj&eiœoÉ›ÂÖHR3ûÏ ®Ê3¿¾rÑÚ[Ž:½hÄ´±v•5–,;{üÁÝîí*óùñÃ'žÆ•e`é;h—_,hÞâÊšøǃ íÚÙ®•q|fàìiæÆŒ_V°jÐtsØêÆBìJ®oxlhË:špÏaäÄ¡fÖí¸’’jØ´C8fD¯6m(Z¿sÇóºV²–MÖm^TàÀcªù‰JW‡Î5h¹?|WíŽ}ÛUϼ´Ý¾fg! ? !„¾uûÏÿu„6HUF1_¾"bôü¹"œBý¿ö—ï|þ÷Ðê‚9#{vè2Òö‡þBŒ,!„ÐÿŒïo¬!„BÿS¾ã±„BýoúgR 1( Ôº?ñ(>yIavvŽÂð—ž9¬W•+çc‹ Q•ä«ô ö„BèûH-´ìÙÂå;@ŸµîÈÍ?²JÞ¥9R%â°Øœg\,øÓÏ6–D/X´·üŽæìûQ«ný‘µRo5¨_ÿáSb À¨Î‡Ïï۷(yåý3×M¿“öÙÒ÷ùÑÛ®¥•`¯B!„þ¾¦¢?Q§Ÿ¹‘Þ±mZòüzç‡:ž ·"÷E^’rì|],eñ7w<õ86Ë=Àß”C%?¾°'òmÈâz´ó²fG_<|èôUÚÚËÝFlPí½ò&íþ©1yõêTû0@ñL„…É/Tn ª›³@Q¸gûîG ¥ÞÕªÐÅI{ï¿}~ñD¦ÎÌßÃŽQgïÛ¾ëUjö½WÚڮś>Žy“•™léQƒSüöv®:ùv”Räêí`@ôjµ°8ìÊY-°lÚ¾{ûzös×?îܶÍuì?h 'zÛ-Y•F~VC!i7OÇ–éßbPÇBwænf5ogÐež| ¹ö¿ü"6íM’¢n=?¶Arl×öëOSªXðY)O.î=“!«î_…ËÂYÄ!„ÐõW+ú«Krnݺuçi*M  îÆ’üC$_<§$:Õ¾Ïà6ÞÚi«ïµé[OÄtïÕæñÕpõàÑL‡‘Ã/lÝ‘®!´N~v×v—ÖCº4þÂiœ%û6niÔ{øvIûO=Ò•åGzÖgÔðô«ÇeFÝÉù?s:x³².ÞO§,jM×ËͽÁŒ3\Ìè¢×I}úv<³?JÉæâÂ1;.¼ùxæNLiRô³§þõüxQÍz5m¬¬L8±™èãÑ9±ïÙÜyâøZ¡kÂýJ†ä_×ß¿Y¯Ñ½j·:nƸ®¢>=7Ô¤vçnõ«–¢}ø'‡Žl_Û B!ôu8_·[ rqq1PæP™I÷òï?þ`ß®ÐЖ]¸hRX‰JÇwî­Í˶®Þ°Š{•á=\2bÞ¼|uõDÈY¦JŒŽJX³_}/ë/]úêÚÃ×ç_ ŸŽnöö],E–Ž6ŒT«º–jþKêvÅRö­üÓ3¨§‹›³½àŒ’S»ÇªCŸÙ efãlgÆËI–2uîÍs´ª•ëÇ-Ö¨yÏ*Z×ÜÝØZÎäRº$~Of¿í^’–¦ðð£"Åë €¹[#áx ³V®ïÑo°N€F!„þÉÔÂ7µ¬R¥ŠžcÃNSçÀÅ3ihF]éÄÉ—æí;áTzÐò–©½^§ ŠB% í¬]5¢ú»ÊpÚRà>[”–0 °„6Þ5X³q~ùé¾$áõ¾ä>›cÁRȵ´™RMÿ~Ÿ€K±>ÌD[&3òMM?µS ;÷ÆíF\RblÇI½5}OÖº…ƒyŸ1*åjF¯•%Ÿ ÍšWŸ¸z§&`ÌlËò–¤†p…&–kŽŸðøí±–o“I /¬™Qe·{B!ô¥–ù6ìhøuáÊ»ŽF£pØ”QZÙž;zP¬É` Ûº¹›jÝ–9 ºÖ] Uç.«6þºÖÉV£³>Êì‹›õó÷;¼iyI½NãÖéÓìƼÅ+̸F¿f½šÛ~lئãǵˆ[aÍ-cQM€mæíÉ>¾uK»ƒÙ•¶H˜ËK'd7™1±g­J¯\;²åQJ‰A% èÑß–É›3g­SÛ7¬ hÚ³kK¿ŠË²îŸßvUUwÂLk>‹åÛ, l«ÏŒËó™{ã[»òŽ8kn×-«—™‹¹"ûc‡´<±¾D%$ £ˆƒÝ!„ú ß{•9BkÊ´”Håç«ûgÖgÿ£ÓFˆA•¿iÆ¢‘ë"ÌylìL!„ÐÃû*sßý÷~MRäÀG8NM·n_üOßšc,š=p„ýèp1çª „BÿuXÑ!„Bß4¬èB¡ïÌßZtjYfff‰Rû-¾?BtÒ|•ŽþS+1Mn‰†ì!„Ðw’Z$’ÏÕà7F.Þ»wïÞ½{ÏÜu‘ÅâpÔ÷ÞMú;Ë(Ý>wlðàŸ%•Ã­.Ú´pJpïÐ×e4€¡hùÄáC~\T ÿTh1*–O]QXþ1˜ýãæ“OÊ_R¤Ý›6z`ÿ!“Ë´ûWλ™¯g êUÇÞM“£lù˜Ù%:|ÞB!ô ùÒlÜ)S¦øúú>ÜÉÉ©ÒK*hþÖuî\àðM¸¾9+ãÝ8…,þæþK/ˆÈ5xX°ƒ€•üø|ÔƒŒ†5vÕûU³£nŸ8ü$Cо×:D§VWÀçV>Œ'{V—ŒÜ8T7qÑñ]+;ÞˆºÛe@/UüÅû2ŸŽõ]~Ÿ“³Æ@ˆáÊÒ)N=çõã¿š0ÿÜáe]yc˜¢09«~ˆ›)hâÖË&%Ö8ŒrîªËƒYç)Ð>GY&Ske‡W,ñ0³¹§ D;•¾N+ ò·Ã.‚B}#¾4ÖBQ©TÓ§O?{ö,MW¼ÈBkâ_<þüyDSi-½šÝ1xX;_Ý´Õ÷ Úôí§^÷ìÛáöŽ#y2­ôÕ…Ý/ÌÇŽåa-, 9;kèþ럤yüVâëg‘®´fÞ+¦­ÝM Ö]|½rÛ#O?/OT£šˆÏbÔ\Ѻ[”"òêòÇx–d¿¨ÛØC¨Kb\Ûtð€‚·J†ÈŸj¶®ëioíèf#à1Þصò¡ÓÈÞMR èõz6›Ý¨Q#6»b=×ÁÍÍÍÍÍR̯˜t¨ü_'š¶ê°2ý­.ïU@ƒ*n^Cº»P¦®U8 Ƕçp(nß'Gwôÿx¿t ŸæñÀ`` V‡†­“jëo]©¬-Ñ·,ññƒ·2è˜f¢è¶¦Bg]?ÜÐÕÌßž}öQ£“s…ün”ÖS<çœË'†wW…ØN% ö„BèûH-l6»M›6Û¶m³··ÿh=¾‡w•*UªX›™Pšf€è¥¿.¼nYÙ|9¡<ù â]­M± „BßGj ïСƒ‰‰ÉÜ Û¬–ôÞ±µÛOk8¦°={hÿ¡³·Yl«fÞòg¿®\!(éÛ{+Â68p̳–ˆñüüчo}â QûA}’Ž­X¹jcûqCÍ5i"¯Û|ý¢=QimɆ•Ëã²³oØSÆøó°+;W¬ˆ8;tÖpáG•q­ëÆ_‹Ñ1 ÌŠ³êÚ¡mPÛ®}ÝTϵl§Aud¿.øué¯Ë_I4@E±«u˜ª:±öNŠ ý³È;5¼œ± „Bߎÿv•9¢P(ÎÝåƒ-†ì®çaö¿=BkÌUkÚªÞ_Ë(Ï?óòšÍ¡b6…]!„úw½¯2÷_O-{Ú{3»á€…KF5á±þù@C€¢~LôZ‡0X, 3 B!ô¿“ZB!„þžÔ‚ýB!ô}ø{R !L~”ùl |¢/ËSêŒe:i®ZOã?B!„©åO8¿aá©ÔwÅ嶯\œª` 篼Ð}þÁ=ùWæ=I•ü•ÔRô"*«TóW¶Púêè¸à%®•ÿ{.|@ÏàUGŸÑÀ(Ý=lŸþc_(QÛ4§gÏžÓÖœ”±‡ „BßsjqÓÙ)w¶¯M-•–ñ- ¹ËW®-Ö ˆñõÁõÇì_¶5QN@Òó+×lzUjbTÜ<²eÙ²µÏ3J3cn_ÊzWÆííÃ3YŸ"D Ò³{6-_¹úfZÄÞÜu ZÃfS “f­\±lÙ²eËÖ3Fùé=›V¯ßžXV1RiüÔ“MëNßR§Òs7ß#«·¯sˆÝœ(Õ>;¼1ÓgØÖ£V®8ª Á³ù€í»vÑ×ö^x‹]!„úŽS‹³Ÿ½,-.òBôÓœzHжõû4Z陫éÊüäR…:îÁ#óŠâ nl{¤ð7*ÄRÀ€#{ÚÆ•(ôÀ³p™ö󌱽ªå*>è//Ÿ,wk= ­ÏÂI›”F´líÈáiŸö¡„v¾ï&òK£­j×å×jîù¢Pý<¡¤j€m‚ÄÂ,?:_gR½NuK+‹gf…æB¡oç+Ö1óôÖ¼­©?">á­‰•5 bFàúWq³á•êrÓuyÖ |Ü|†vwÉHH+ ê3ÊÖ…ëCí+³i©{zóìÛ{ÚÖ£%2a¥iÁ–þuswî ÚL>¼™¢Xl–~Ýæ+}~]Î3*¢¢ó²Ï:NÇÄQ¥'¦B«¹Ç"ÿã[ :%Ÿ#~zç~MZÏ0”¦^HásÀh  !Œ*ûÆVÛ•-]±‹ „BßñX ÇÊW“šP·kmÕí+"‹O<ù}–©ƒN« òB 8ù%Dn`[Ú{hïÜwIç^“™Ö¬´[»¶ ôšºü¦¡ÒkŒþÖÊÐ:ƒ&Ô²ä‹cÃ7[ºûÔùóçOGî°²h…Tj ä?¼Ûš…™š¡“ÇêÓÓ«Ú <¬y*QÝ%ä9u¤°DêUÃ)6Uüãˆv"6h• –‰)]1fÃåÅ“]û,À5~ÞÙC ëž¹œÔ§çeÑû߈;´¨êP˜x#ËÅA«Õ0Ï.¸˳ö8¤§-Ÿªßaˆ¬,BÇðí«Ï^µ…+;uɉ=뇊>Êr<¡X,ä£öÐΓ퇴a+„íí<éǴ뇯ÆäØøµÜ£™P ²²Q¿¥åÛC3´o^þcìÍã^¹qŒ~ªœØC'/«y݆Ž0—nZ³=#?nýò¥ ‚†v®o!çTëü.t•œØs C%:ÂÕDáØq­R’bp=²—¿ÂQ2ÊÔ­Û"ù"  :œ>¸ùM¡¸Vy#å׎ˆÎ”Õê:´KM§ÌG§Üz+rª2°³€.KÞvW\­Í Žõ…fb!ÿ}p“åÄ8tÆhS}È ®VlÍÍ#;£e–j @±Í-LY”?B!„¾‰±BˆF£™1cFTTMÿ~]ƒhÒ^É,‚ü],¬œl-HÁƒ§úöˆ9{¼Ì¨;·àGÚ¯cÿ@×%3¶ihzçºÍÜ:ÝBµeŒéÁ¥³-j6²ã3/÷ýêÑnаž-yZõ4¡€”¤=/3’Ño|¼Å»/óçûãKÀ¨÷Žìq'¹¤ò5×^ë\Í´2¼¾¢f;™•<ÞyþîÏ›’½]mõÒ”Gâû6veQ 1 ÚÊ6sÅ®ç„PžÞÞ–"^ùv\|ü<í,ÌæöÖœÏW–£ØëüëORdêü¤c)6B.˜:Œå™~óuA¥…M«…Œ¬kHΖÑ$m¿–߯OëW÷ó m`7ì2&䇵a§4&î§ÿhÁ÷˜4{Nצ.,žÙÄ)ÓŒ…i ôÝóòìš÷jf7fæI5cxvå®wÏq?Îßz‘_¡hÕžŸÆ»´êëÊR—“ô4Þ›I.¿:Uu<ÑaâøPwKBqm׈ÿ"üx,)zúºY¯šÇ{cU¤b ,Þ±¯ÕÀ1m쎜Î~qyg®oH;·¬”2üØ „úæÆZ@¯×s¹ÜfÍš±ÙìÎgZšÍýàäN9µ ör÷ð°#2ìDtQÉëé‡L,=µy¶ÑkT3_€ €,REd9t91Ë€r©_?,lufÇn{ùñ÷¨l±‹«½…›³_Qki`‰Æ»ùÉd¥®<5:‘qäž!Tû!CgõýqäÞ“N"öÅ£'|‡ŒÔKèÔJÑ*“f]§Öiê84¨´!ƒ"{ÝÜͳÖîà¡.Å ¸ùQŒ‡CZФ&“5sþ+ƨêÛ° Àñsërn{6jâåQ­o; €ÒÝ¿ÎO—ꤺŠ“ϦFæn<Ýix]/g‹·¿Èôí…®Þ6M=§· 9€ó­ ½œî°±º—HÔpZåí˜yUcÞ¬ÛQØÐ B@^ôrÁ¯«ôF­_`}/»V=<Ü¡yõ«º‚÷kÑ%/o=Ž¹;üºä“„ÞCg¹:Bý€[ø±A!ô͵p8œvíÚmÙ²ÅήBÙ~–©‡“®HúÁ¤RŠõÛvØ|[žéŠ='Ï;w|ÿFK¾ G'‘0M»ùO[”îºø€rm>qÿæ_ÐOÂŽ%p½€QË4ï¶ùî?å!‚QIJ´Ïceó«[ªÍêibYf`„ç4uÛ¯[¥¦¡zó@óÜø7IE’¼Ì‚’Ì^l8xrÿâ!ŸÈ†â­«Ã».Ûêe)ør{ñ=»«Ò^¿x?´š‰±äÁS™ï‰3§· ó)Eq 4óñZl3'µVÀ(‹U êÈå.Köž>uÄËš÷Û›e>9IÙ’¯“* Œ^#ãXñ8@QŸ‰T¾K©32z•öã¹¾<û†Ûì?¨M؆3ZeÊÖ£Ù»#£öüÒ£ü˜å¹¥Fy©«%( Ê›™%²«R·í™sçÎ;·fL¾È¢Pn µ -~lB}sc-›7o …ŸZÉ*8¤ùâÙs¬„ÜZí‚~°Å5›± xcØ’ób>Ç¢Ö¤Ð.}Ú¹¬\°ÈÆ”ßfàoOìÝu3ý—Õ½m£wœÏM‰ªù'ëVxsó¶\YªºÏÇ{d4Æõó^t´mÕ ù‰bñþ“”)..eö„Bè[J-_¨èŸõâÜ€nÝC”~ê™5,Mûýñ;L⓪¿û4¿wMx¦Ž ê” “‡ ˜ôë.Z¶cÑ„n=zÏÝqW[)ŸÝåÅ“sŸ­UûhØsõÙ3uëàÎÇ»B!ôc/\¸P¯Ó1„˜˜T®v6nܸØØX33³ /èóÖ®<üsX˜oþÁËùNUø;n>{tîd ÇÑÇž³sMØÝgÏ’S’ÞÚ6 °½ptãý4ªqÓz| ˆQqãðŽCgn‰Ü«:™sìÙðìÕËÓ7cÝjÖ2ç’ø['v<—¯­ëïÍ¢(£^«ÒÒ<Þ§î÷5æ}eÀ¦€·ŠèQŒ¼sÛ†@tBûštW›VìÞÎÛÎôƒÔbŒ=w4E"½ú0Á­zM‘ìΕd¨â`!Ëy•ÆÍ¿}àäå{qq Ï©&õÜ5ÅIÛ6FÜ/ò¨&b^^8°çعT·¶¯+eG¥ì¾®mÛÀ{B!ôÐj5,‹Ïü‡ŠþZ­væÌ™§Nú°¢¿¡4®TèæikU'¨YVFºF’}&*}ØOã“/îϤţgήíí7zö¼ÉÁþ, º ˜Xƒý®´|•ƒ§J¼Çï¸cý>‰‘N½Mаoß²íÇ^3ÅÚ£)ÁcÇ·¯ãRS’®>ûô'/- îÚz:s) xVžžÎÖå5ûm^ÍßÇÚÂŒ6rLM*׋côÚ'¨“ŸfeØY¶UÀ¥³4 ýöê!/G“výC{üPcàÌyóƶäÒ’ýë66×É»hÏáÛºÒôyÇdC~ü±Yµw¥b,}ýõ‰°!„Bÿ°ÿ0¯E§Óñx¼æÍ›W¨èoÔ‹ W`4Xκ™ Ì|yϾô¸`HL/ ìÕÆÖ¥¦7•“¦dØB³š..>öÚâ|[àÇ‹_½fË[Ù»!ÿN£Ol æ~êNcY®© ï3I‹N¸ù¤Éê†^•k«°¦­ëT hþ'÷°mª”=ÎÎ8÷ÀXݪB%=ZúöÚã„…GÎÚt5_–Ï5µ®f¸³vý®¥€¼ÛŽ9e”c×A!„þa_ºó™ÃátèСE‹A…q ®•Gùœ¢ÊxccÓ@YšRÀw…RålZƒÈ'ç«Šœ·%âÆ‘Øf|Šxû,ÅæÏØ°«LV|rͯ’:6<¶A«’ë(+sáǹ…çX£8öÓ“PÞ^Ýs É9l|µ/,1FƒZg éRÇ ‚»{¬Û¦m0Âä·E€ebåéÛpͶeïÝêCGe’ÂÝaá j-7 åù´À»B!ô ¥–ððð'»%ôëV7cî"½D3â—Pt›Ê?·jÙy ? —ù‹w®\]µNá¬ï:ô8639<¼a‡ÞÛ´½±nÑŠs1ܲl¢N:¥bš‰X Ï¹²*ütf’|ùjᄱMW‡_°¯[wÅÒgmú‡6©R±ü?c8¶s#($ÍN l÷c6M ž_½üê’§w•°¥+ž´þ1¤^HGçÙó‹yLÕ&=»ÖµZ¿eZoW½<»e=³kÚ»B!ôûjã潸07µö®¾ÎÿdÙ±k˹]&ÿàfòµ :iÒŠuçü:åOÚcFlk>b¬‡«¬!„Bÿ„¿¹6î?oûãì¿´¾!{XðÔ¾Ë÷üù÷Ïôã8ì@!„Ð?ŸC„B¡oÚû±¬èB¡ïÃצbÈNJJÊ(¡¿áÚöJiaRRr‘úþ§uŠ´9ùøíR–š””¡e°· „BßjjùBE0J6ÌZÊ15a0zÙþ_ÇuïÒmƆ(#1Þú¥_—.]ºté2pØbMb¯ììÛ¥û¤°óêߎqÑ‚p Àè¶O²åìóòt H¾>~pï>!?¥©[æN¿Sh`te †}”¡øº÷Æ7ÓÅŽ¿•þ‘…õ’¬¨›iŸ,Ô/°´9¾%¬è_‰ÐÌ"ïåÓؤ,±µ-€$½~zÿþýè×9ºüÇ|Ϫ®6¶ ;6É(¢—oYy»U“ꀼà•_×..ºŒD£—<ç4nWÃÕÖÚÁÅ’Ëb8±4Þ7´SmgVÅ;”ÃòiÕw¸þ/£v—Ò¤àåm©yÝÑ|æ­ºk `é^wÜ„PÏÄ°o‹+¼O¾…sé•´bµ,þÖý|s ô¾ þqb×Fî<§ÓBZ>|‘OŒ·lm=ú§aÝóñîf„Bè»H- Óéø|~Ë–-?¬è_‰{½;'µÌqnÂäÅRšP®^~~~Þî6`P—¯ÈâšèŒ4H3_ÅÔû¹šv+ª±»š¥îrtÑ«¸Â‹ôëÅÖ^ÙWO©•§“F})bîÈ1SnÇdKŒÀñóó°°³3ä¦Ñ pïؘc"HKÊŠoTÐrD¿+±9÷ï½mÚ¿ EñªŠÒW¯ŽxUÌÿ¨ Øîþ+æ/;#ó0¶ „BßCjáp8;vŒˆˆ°³³ûâF(¾•w¿Ð_zøÓÑ¥48¸xz{{»;[òj(ŠKi eI1>f†§çNÌ^ƒ@ô…'¯+õ%Ùl7Ǭ›W¸ÖµKŸÄª(†Œý¥»~õ´JdSŸw·ñdÔ‰Þuß=iˆú­^ ]|7–©süÔÉÞ_Òâ~{£Øõ‡¤sg”ˆ»xšP?­ÜºjÖÅ…eùªJÓu©:Ýgû% èäÁYØEB¡oÄ×Tô¯$ç͈÷ùZËó˜eÍyää®5Ìy|±ëĉƒ›‹.Ι;/;¿<ÂU“õø|®ÿ:3.”¥¾NsèökË<ÚïÁÕåFaÈð:%‹æÎrÁÓgEQ' ãÄC#§?¬º±ÙB´÷ª»{çŽâ¸BcëJ̲†™;ñöÙó÷î+³èðM…ýÇ H>¶îv>Q {t²Å.‚B}#¾¶Êœ¡pjïIæ¯ ¬çÎùOWQ e™ ¦¯·:,÷Úž ÿ`Ñ¿qÝ…Ðzͱ9ã­Gmlï'þ3ë1Eo_¬Zw`ÔÆ UM°Ã „Bÿ´÷Uæþgjã2ªíƒ:Ç4^°abk.NVA!„0µ „Bý—R VôG!„Ð÷S B!„0µ „BajA!„¦„B!L-!„B˜ZB!„©!„BS B!„¦„BajA!„ÂÔ‚B!„©!„B˜ZB!„0µ „BajA!„¦„B!L-!„ÂÔ‚B!„©!„BS B!„0µ „BajA!„ÂÔ‚B!L-!„Bÿ´q›gõšVBî'÷®JºtìZ2aèä+½:¶é?u-óÑf>=Õ-°Í°y‡Ë „V„M nÔaÅÑ{¤òÛ#±ç#º¶›°öŠ–&Ä Ý5kpP`·+qùŸjòüèŠcW0„¼Ù6­UëÀ  6ónçT^ˆV_\Ú.°óŽËoF“5}Pî!?g¨òµ}…èŠÖMìß®SHtŽ‚|Ÿ{¢¿0ºEëÀÀ   #—ë‚¿ BßÛï1Bäe2IÑ›¹SææËO6 =|7%õî¡Áë(äó¦ÍËשŒlsãMAú½Ãœ3ê2'ÌÚ\,—]\ò CJ>O‘²à¤D^²kÞé:úÊòЭW’Š“t¹Si¬°¤^£,‘ʲÜySæ•ÔGÆu¸ð27ëÑ‘3Oé™ KÒZyNÚ«­ç¨ib(]Ò7­X•{wóäç*í]ööÆüé?Mœº ¶XMˆáÉÉMãÆ[°ñ¤DWq‹ŒþüOÝ—,_6qú¢X™’seÆ„q¿¬=^¦£+n’θµgò„g-Û‘§¡šì ‹÷æIäryÍTܦ¡dåÄq¹rÕ«Ó×E¾,J¼Þû×+2yÑúÙS³t•“‘–Ü=:ª’rcßÒõò5Ê’93—¾Ð´„Vål]4mÚ¢ˆ¾cÂË ÚœŒl¹Rù bÊÊ#1¶nÔ,6äFª´$ù^ÛûÕF£Z­R)J7ëù CYéH òüܘ}3V&„Zº|ê¨n:÷ÓÃLI¥½—¦Ü4~\ÄÚI ·?VÆ\z¢@*—ËåL¥å …‹&OÏ“+Ÿm Ý}õmòÝCCw¿ÑhÊVÍœ–ª­¸¤>kòÌ°"¹ìÆŠà E1'¦í~®’çûieÉGí`(~¾vÞˆÐå4ÃÄmýyÓ¥4•J¥5VúÇ"y¯.t_|«L^´jæô6rJÏSO²ržEõœtLK“¯s7bæʨ7²ÜØ~¡›ËŒäûÃèÎnqûMJ¥Rkt CBè» ‘”ÊËd„wc-Œ,°)Š¥7’y¼Âyl&퉮$Fäí–ôè±w³€¸Â/•xQÅy7©òìá[W?«gņèT­½¨ôq[”y_ª¯ðµœ+²rnÞ¿‡ëSOL«n&q„²¸t£%•öPOWø:Èâ‹í¬ØÀ6ëØ»Iä±û®¶oTióÐÉóæŒë0ÿ×Ój†rôo½dùòÎfw£n¥|t¤FQ• é!õNݦVgì<7nÞ’jÉgŸ¦UZÎÄ®æ¬EˆÔQ¯ÛõÄXòD[{pgø’%$º 7vÒª¬,£¥âÑ“jÕŠsR$ù‰µÚT{ð0ÍÙ…÷Zb¬t˜Ööf¿ f°Y,JÏaTÙo3”ÌÚöÆîE¡Szºk”z`ñÝ]Ä"Q©Œvtµ«´$—ÅŒ´N“tKn¤LL„”¦è®°[ —JÓ˜(ŽØÁÆBôîZËbÖª-ê4ØÐÄͲâ×õ­+v…ÎYâ 5ÐÊ¢TÉóý;6/_½]UñiEj)϶ôÑeÛµrs³}ëØÅÜ¿¯Þ¹¡sÅá£4Žëâ’öèOë: Òä¬b_Ó3ˬ Y™Ê mËÕá~èÜŠE콋£,œ3ãðã¼JãÅ)õ;Ü}˜ádOÅ«î&X“œ¨2ã¦ÞÓÐ_9Æð:Cáj§¿O›—Äj˜ïôkÊËQÇŽ»x'GZBßÎoÃéFŠE•d[Øqiša€æ}va‡EiÆl¤@cjMš¡ ,¯´ ÀÊ‹küâo†6pYLa~‰=‡m š°h•´X.dÍTþ…O™º7ý¡™É¶c1j¦ lƒ¬PÉ·b“/í€Ðêž×´óòà­çI]kÛ~øjYA솽״´QZà¡£õ¯ïˆzšÇÒæWí*ùhKìÚµü]\d6ÅÇeÙVq¯ž®˜Ÿýôß1;þæŽõ[‰AÆrwbŒZƒO‡©“Û¼93ÿz®¦¿·øÃwN(–² ƒkîÈ04aŒ\“_(1§X†/ŽÉ7îÔçÞ¢%cYðEV ùÒ’ yºæ!BW‹L „.ˆ9ù̪󜦎š•ÍŸðËÐ…k¦_ÛÙr€ ™/η5TÌþʹ0Œ";ÝèámoiÛÜ÷U"еÁ¿×´QõïïŸs£ˆîîÀþàÈ,J^)°1eF–›”mY74Ð{×ÖSņ¾.|êƒ% ,H ò¬¹F†Ð„aÕ…4‹"tÅ®"Ý­õ«¥/Ìר¥iRƒw±‹z€¶4¥Ï‡{6šaÁù°{y,:·P*¢(ÍÐÀ6”ËY, Éמ®mYv1 Ì×oåßEQµ¶¬å*â -)üý‡úÞ¼ka™{qåò&C&²“_;ÚÚÚÛ:Æ'±Ò¤LÉñ±³¨g-³nÜ™1Øøóm«Ësä‡ ÖÄ¿ñµ}aÓBÛª©oT†tUæײãU³e Ö†´²+5¯aίü “+¶ó­ÛÖ““›ÍˆêÚÈŵ{µñd©­«s?_P†hòfù{7oÛ°$!ºÒ«‡?º,|ÓŠ¹¦<Š‘ÆÜM·Ù¾}Ëü^UáçZ!W3Ú2e-´ñtoØ%bëÖ­[·N ô¯pÆRgm9’³bÓÖ¥¡€×:@È"@š]ñ Y¦.¶tYÍ!³ìe™æ6.æ¶^±/•Ã‡´U©ü­¾4ç—oå3gý¶[ç yVÞâ/•Ò1°KU4a :½ ã®N8Î1²-¯r»R"ï6«"¶/ íTâÒÚœKQrúØËž~__TXˆˆœ! ”(¡µÂTj¶™‡H]Ö`ÈaV‚­}NFBÝÞ]¼}êøY+_K*Œ p¬ªiòåm‡ ×¼zåekæjkž-±5¤¦Œ±q1­°Q±w×nµÝ8,ŠpÞ/B€U9…YÚº¿ˆV¨(ÕW³Õ¶U ªuêR¯°ª)`ÿ©wLKŠKˇȼm¹ Nµ ]=$/[£(.Ôèß¿cq±ìýZ…LR¦y¿‘²âbÃoA‡1ꊊå¿å1¢––ÈUúOîÛ U•(볌²¸P­{?\g,)–¾ßNYV*Ó¼_²¬¸XÿÛ—†Ñ—½vN.îîfÿ×Þ}D‘¤¯îžÈiH’£€`Îk:"†ÕÕ5`Î9bBL`ŽÖpM˜0gÅ€€¨$É00ÌÀÌ0yzºß†eÅÛûï{·ÞÕïÃîº6Õ¡š®§««žB€¾¾V„Ã!A?,::Z«Ñ(ÇÿwæYµÛøÑœí ÏÅœ»zÛ¾Û¨Þn!ö»¶í¿Ÿ!ž°hz K2/qϱ„l}Û1aéß~e§1­¤÷;w]nß{X'_w_ûKûwÝxœ1jéÂ[fã+LMX»/ñÚu†XX{ßÀÖŽû·ï»ûZ0qÉ,7sƒ†X'ÎX¾rG± ìýÛ"¯žýh…;$ÜM*ê3f²ƒ‰A£E”œú=ñmv~1Ÿ>f 4óÆåÇi¥"bѺCKÇÆÑHÁ‹?ß¾û꧙ËÚzzRËŸì>zöÎýG&­œ-…e&Sôü÷;¯ *Ê$zç}º5ŒnfeeeN—Ü{!3´Û­C›÷;{ãqzÄ’¹þ¶¬Æ[r̬…—ÖŸ¹z—4x@kO¿VöGví½“R:qù¾¦ ãÏš´³Ó>㺌ó;·ÞQìî… èeq“"Ø=†ðØT€Jôvܬó†va ú‚ë'O=ÿèÁÝçoʺtnM!Dë&/ñ<Ø ƒC‚þ¾ÔjŠ¢t:ãS–9\¯ÿù AAÐß[}}ø&¦0£?AA?µ@A£èoŠ”½=ÿº@ô#Ÿ‘—tQ¬#þ—jMÿæÒÞ}§ïÉupÂ2Aÿ»¾Li!’/ÅzO²\V­™k‹TïÞPªB¼zEÌÖ¾!óäº}wp¯Á»—Œ€¸qpã­¬jºM«µ+'šÐ¾÷:ÅéÍQi•j+¿>QsÂ5•©1[NIõ´>3£ú̺¾Ú¯Òî]FÌûõ' µðÍ¢YëHèoÓÌ(A²2ýRìÑ$’f99rY°£ñß©Šï¯ßu.·Öæ÷ø&¦Ý7yXÛ´)kb[6™È£©ÉZ23ªÏ¾Ëa¶È£Ó;^–ÏõkgY³ï¬Éº¶áÐ#=Å|²å­í( »¢ŸH¸.Ö.ÕdT2)ýp+bVü†Ëg|)ÒÃëVgK ‡ÖáK'õ5¼^ijó{Î>)"XîkÖζAë~ß½õU¥Ê±ãðe£»7QfÞ>uâVŠ]Ç,ÙÙ!~Ú Tº†ÐF¯ŒmgóG.R¯9±yCfµ WIßWû^¿´Ì„êòE&íÚxZ5ÜümãÍÌjšM«u+&šÐ¿y,¸J´=z£PCÒ,}¢WM7e ˆôë‡ßÊA˜NË¢æ;RÄqÑÑÅJĵۯóFv5(QW¹mͶb‰†bÙ*zù$ŽºhdžB54tnDo¿¯î»2'™Ù~«øÁ†]gsj­ÏÄDz «@’ÿ|ð²ã-8¶­z®œ–ºzÈ^ƒ›Þyî¦îôùF'+=ÝnÞá©­¾}c’rþ›ñ×+dZ®s—…“û³RÖJ«N|'QLܧΙàÄþÆNjÛ’]‹ ž·¤­%¬UøÄìIa9Ý;·sfÿ5¡_ýƒ%tÛ§õç?YóÈdʸGø@„ èoÿÞM’2©D,|³dÁ-I”_˜~ì^vν£SãKR»qÑÒR5A’¤¦4aÙÖ³$I꼙ѧu¤þÍÁñ j›Éd'©HŠØñ'ñK›fæ¨ð ‘gÓDêêœ>öHuM³r„^³xEµŽ$ ýÞõ»vm]z«Ú8ÿ¨$ïÉ䡽{ JH-!tâØ1à ÚÚ4ÉK’¤N”>vT¤'HR}pé"±B¡Òè¾’”ÐÚ²{ÿžÈD!Nh çGÆéH}ÉÉÑ i¥†¹cë·Œ +©ÓˆSÖ¾¤“¿{'ñG»¦¦‰”Æ»–•Î¿yú˜éïdúªw×Gí§'uG×Ìû " S•/\²MGêËÏL8“Tsûè„"…B©ÕýS‰Wu ᨠ;$¸&~Éäß mž IDATš¹J­ýF¶S"ÿÙ©åÏê ‚H»²³O¿A;6üzöi±q¾]\õÛꩽû Üpê®ÎÿXËÇß7®eÝëÓQýúôþeÆÆ™NRþdÊáT=ßØ='Ke”ˆµïYXLšL¡Ôâz’Ô§¬’øºJ©RÿŸÂúçö߸¾þðk~s™‹5Ò%S֔˵*¥"ïÌÔÌò†ÆEÜ9µó…X§Q)/Ä&”|»”ú}G/æ$%lyÓ QJÔ8IâÉKû>/þU¹&õu÷¼E’dÅ㨓é0ù&A?Nn\i1nʽ¿w½Ú3@P[[]+ðõÒ®ÝsŸËÅ‹¤©5pñ{S'î…½q4ÿüZE3ñ²6Ï£%ëàž3,'ëÌmn- OöÜ®°”¾“-—Ȫû§M™Êl;ЊBîÇ:öwf~ev*Ë)dóá 7®Ÿ~qþ²H^[¨2Íû}Cº‚£7›!>^Iw®Î™8éY‰Üè…Søh»Yûþ®,€×çSm8×÷n¥„´-«‘¢Zœ+7-¼¼õ¥˜D…ºÚ·ö¬“{2ýg_¾~sÇ(ÎÉs©ÛÖíËŽO6홶«Ÿa†^VªdqŸì]#qô®U‹k+ƒ‚°Ø=·9æè‡ú¯œ¡¬½þ–îbkZQ+µ7­Z²'Ù ñ s+Óì†_:k^-ùN/"×.Ô¹âÚ±Ms×Á0ü‡²ôåöÕó¶>ªþ—?±Ôe&diL¿3oZ#²ÃG$ľþøúÓ ®ÑÉ ¡„â-y{êÖýgoåå7KAMé×ZÇq°¸{öÁÛù -ÝÌË"¾lAô¿êSÔ‚`’@Ý‚;˜ z CQ#0nÇ7” )¨Á3Á¨Añ ¦:J³ùUQŒª#h­Bü©¤žŠ¡B°mÜÚxZé†wú#¶]ç®[½¤>óžPR9oWVYÖƒ—ïÊ_\»¤0Ìý_úúvìŽýñgB‘ ( lý;8YÐÚüZ÷1Sý /-õ½A˪¬]÷†Ÿû4)£ôååó :Œ )Áí˜z-Å8y†ÂƧ] +&‰`FÅ jËà@S ·Ôò»W’z9ž/®~””Š AoâM! ªÑÅD©º·c‘: C€¸˜>Ö-|[ÿÔ_¢¢—ë—,Þ–‚P;Œ™1(üç¨ÑÞ¯ž¤5ÝR^ü,E`!zI ÅÜËâ´jç`|½HüCr¡»3“Á²°4C0*A`ŸjÙèÚâ 7Žl;päÄWEj…L.|aÙoÝúhomr¦Œ0¼U(€@]‚;šÓEQ ó}ˆ;FMïB'½rìXÈŠý®f4 A1–U·'@"F• ­Íóövbs-}ü­š¿>{i£‡Œ™½*Ï)V£žÃ§ÿ2lØüé#Ÿ¿ þW›ýCg¨dy—dÞN(‘è¾ùÕL'·³fçﱂ ø5ˆÒø\ …ŽdIK^üÞoø°nŒfãŸüwiorÊì ÚÁ͵CX¨ìÐàðI~ávT x»õç¿¥Þ>1sƒußF3.|Ä=ND'Óf£– ‰¼W£ÂG‹ü"\hHïùQÕ#Ç.9¾mÛX£ˆU¹¦ü2(üç)V½"¼T[Çã™q™¦VÖ˜açÄ?t¿0{Ȩ9´4À¸£W,Š™4<ê˜?©›ÑÞµ¥ ÃÇ­(¯Lù9|J©D°{áÄ°ða—ô¡£ûøövPlìx<ÏÜ„ejmC¡ÙGô4Ÿ>ì>þ'£\¥{ôºµ{fZ~U¾lFO”î6Á»ô×ð‘ïÆùš<ñQ*ÛŽÇãñì˜4º¹™‰•{çI¬kÃÃÇQ:Œs2j(vãú;O z¨aDß'Ÿž?·/Ü6̼Ç薜梖ģÇ¿NŽöËF‘ZôÛò)aaƒN׶ž6<¸I+%žKŽjo‰€²[†é‡ ¤i’ ®câ4I{ÂB‡í½‘OPÇ·ÕŽ q§I-#\¯±½°Ÿ‡ »Z$F°ò÷Ê96䡲m8Ïp˜3ÅzÜÈöSÃí©è:ô'o§¾#u'††Opì;Žg¸z"Pd»ø4qï°°Áws…Çûäî Ÿ:hÊXKÃ"Y¼î-‹Nûu~ù¥–Ë*S‡‡O)5üêUÿhÜAƒÇ.ñ>ÃÕÜÚ9tРçŠl §þ©™szÉñ‡?®@`neËãñl,Y\+&¤öÁÎ茊Ïߪôµ{wœm ÝŒG»yØ>lÊÐN­Æl<âbå•Ûøj=@Y.6àÚyzXÇ^ã£V󤟋»™\ÒtÏ 3u c_¼='(Ä @êIäËÁëÅûwÄù~[”tåÐÅ7Ÿã'Õõ›Jd__% ãÒ¡+I…À ìo‘?"lð¼ŸÜ¬àÓ‚ ¿?˜‚þr¤F\pö÷Ëùõ¦!ÿâÓ¸ÇWŠî&œMέÄx–ÏÌøg?Íà/Ž­=úT½w³³ ^b‚þ§|É £‚ ‚~Œ¨¾´ýõT×öi“ÿþÇiºé.¬¬?id_XwAÿš47®~ÃÆãÿÌÜàFÈúœK£†º–þ/î“P]]5½Röi桬;™¤ÿ!®Û‹9ówÞt€réÇÿý÷Ãí㻟‰` X´ÓTš—|HA}ñ¥¯EŸ¸?ú­Ö¦6ûÃÔ ›ÜAñòU½ZÚVSWMëùûúµ¼úòRïáËÇ´7;¼~¥ÄľòCíÊ-Ñ6ì®·†$ß݈T*ÓÔñõÁS– rk.é$%ÛâΦ½Ì]{îdWŸ|jßk9­¾¢Ô¶ÿÂ)Ýí¾XÕ×Ë@–&9w/Yí36zL£ rW Æ%Uÿ±‘C}1B}/îÔÒñÞ6FyEIqʱm·DæˆÔ¼ï¢IÍ{øüuëUÇF9©×êÿhKõu êo.<Ö²=™µSý6¿Ùë‚ÐB#1¤qñTŸŒ"æÈDU>Y®}“ÙÜÏ™µbF Š‰ŠÇÚ5|%¦Èö!Dênm^•qãÔ‹LYÓY H”ÓÌ´/Rš}}ÖªøˆCg{1 NŸMÒ¢4ézÿõñ]]Í¿õ3YYäÊßüƒ[å —m^cfP[ê]3'Ó[uÃmÀè± ìÅ­çyàÉÏ>¬?ºËñÛsVtÊ)…øÆ_ W.ßíäZš]¶hÓzʇëO¼q¶"4ô7¼©düíqño’³—ÇŸ6E kÙò/ÖñáÎßÎsiª\{Kìú_Q&Â4Ei_Ÿð„+ÅÛ£Ö¡.>,Œõó”ÛF·êõu³äCbG˜ _½xýô˜h8=‚ ÿ²¨…T%•°6m!¾½äê›|=™ FN·Ù¶lE±fà¸è€ðyüÒ¯Gؽ£¶Þ5ïçÜøÙiu¡>6ßì›Ð6œÛ™QYÏ°ñ]¾dj@ØØ@Š žÙ›µ` £Q»A5s\±xéÄy€P;FÌïȲggV>ΛÔÍ®ñ,"YiÊÆ-'sû²z&ˆK·) xȶ”¯ìݯß(¿~¤¤4müÎwÚðwv­¿Q"Oݽ©{è¸A]½ÿh¨õªS»/‡n¼‚fŒ\~bt»…ýGϵ ­-þúÉm‰’HÕ}§®õŠ¼{k"o+PÇèèù¦†­‹>㸺žMÿ!°áSQ…¨|¡¾{Ë Dª;ÅL¬<†ùu›ê×U+|—›7iGµ¿ïÚ˜^!GèvKV̀̿spÉíëÖ#þÚ­Q6| WWKœ»FDô¼»{QŽÌ:{+è×M#ÜFL:Ñ{­U£M©&Ž‘+"£¦ÏúTË{®„n8‚eŽŒ<1ºÝBöç'¡pí–,ž§WUmY½WCú_!XÀ(VGwýÛÚ”œÆQw“Òþæ4¶m«~õ'Bû L¦ p7n ±®aÃìL°ý‹Æ>Èý˜^…L>qγ}Ï&'G>#ríÚµ3Ú•e–‰ ,=‡lݧNNxoø!fæ7@}y`¿°»º~^ ¤L ð‚«3ö¦[hÊš$\n\ËšR6ÿζ­7¿_Ëÿ:’<²n½óð¹&YOª/¿©<¶šÜÅ( œ´äu—¶¼ºç‡{õìw¤Ð 5³}€“¤0µ”Ù&­´‚foƒ‚þ £„ÆÒãhØ‚uŽ%F¥Rijªã†…a(N°¨I’Ïo¨t<Æ—ƒÒMÔ:úØ L´26½¹|]šº¦V\^^nêÙã6°IQ'~ßµ`ù¼ý ßi6°õ{Ï]úÓŠ•ñFËúÊU¸‹% L6÷»OclÌòcg÷¯Š< Å›{›ekŸÉ“þ᪠´ÙX¥Ð٠Ƶ¡âR€™“, ‡ ‰¶¹÷e‡ŸØƒÃ1;g„Å0Î@ª“T¯KÜL  Ã®ÔßÝG”¿Ä¥¦X³ùZ¡ÁŸž!Jž´@ÔÔ•Ù·“ðkez\[_|'ÝwöÕkWzÒ?Õ+5¸WŸ€Îg…äçH½ò\¯g›&ýsê¢ÕÑ;2ó‹R­– À̬ÌédÒ0£?ÿA²sÄ•kW[½¸WƒÓQÂ<`Àê±­Ô$ÚÌ͈ kyrßï×ò¿N/ü`úÓˆv¼¿°D •@„ftÈËT¬À­:NX=µ§Q°Æp hÈN±é? ûÙ+ +s¸ª;Aÿ…Q ÊõµQ–VôGç“=]]\Ý<Ó.ܧüR•µ¯ ‘¸ó¡*pH—R™5o£Ëͨ'ô¯gÛ77TÐĹs^f ÇšÇBt(¼ÏȪª­¯ðÕ$Åx}dBW'itZI]Z§Jyñ¦¦®¾Š/ÀãA3i|\š_-Rtj™¸^¡VÈêeÆ+"åd½å×Ô× øJ=ÖL¿Ba êÈÊ.ª«/|Oo?ˆEA²z©\-¯ÉÕÆ)Ûõꆔ܊Â×É$/P—–ô¡R˜ù"£³3˸\a1¦ B§#\{}Ö}½°µn’”O™CrÜQ€S»wÀk*qa1Ðá:b, ÑlÚy]Eꂘº ú*BK B§£æ–|o «'fm‰µîƒ‹ >$a¦î¯œß±uKhŸa3ç°(ˆ®6=½Î6kÜêÚúŠ“î탕b@‚ºJ\!×6E„V”™•'¨*»v¯„goP”\·êÙŸG7®½¼ŒáС¥sQºàãÿ(yþPZWQ¤¶ò47¾$•B¹B^[-E¤[°uVê É×úÿÃÚ°$ð:Q­Z«•ˆë4kP'öû¢ºú¢wôvƒX”?¶è¥ ÇÏY7©:ïÕ¡ó¯qòSìøâøîìÊÏùõz÷¾_.Bñ‹› r?_ Ž㇅_’Õ²é=»þqñÛŒ ¸Ú7{ ¥`=¦cV¦»€°§'ÎÄÒúO+O•¥Þ;w;›$f⦩®ëÚÕõꮹ¹5@#¯øíØýOáIæÜ9w/¥ôóÙ5$ëá“‚ *j˜ù„ñNoÚ˜ï9»o°ƒCpÿÙ>E70~¼PÞ»_,Ê}»níÞOõ˜õœ¡^¿mÚ®îÀã6S4×¾õâÎÈžõ«^y‰ -NÙ³eãá›âöMãåsWTÆ®‹!Ì™ç·m}+ÁÅ9¶ÅlLÈÛ6Ž4Lý: gýúàÊ=\1„Y¿Çœ*¨wÿ@üm£½ËÊ^ÇmÝxàJÖ–ÓM1jëéGo:š¡öXºWõêô©dÕîe=©¸w1.1½!ë· ×2ÊŒ®Ï?Xúìøoó燄֦·Ï•½±EVƒ;X3ŒûyüG3»Ú¡­~¡·iGßm2$r3HãU#¥êÇIôá )e»ðr™wS+mÉ5r’Ð5ÛÕòò°žÞùó8õÅÃ@U¦¹rƒ>r5ÍUªyx¯éƤ´’Pâ@âúüJ¯Et‹tíû|ÃΊ™™™™™Y w/{ .‚ UY9~?…7í¿@Ùî3Æø­Š\^Êqtw0·pën–·am¬ÌkDO+ƒÍR›|åØƘ]šÎKµs$þáÑ›a]|›¾ýcVÝC(ï#×ÆYþ£‡‹Æ²ròõ VEmî7m²³a6¶Cïa¼ò˜µ1Bça}l(!c–º‰îueË°\B]½VÉ¢_Ú±åé±dúÕéS/U»#{RÿT_ ‰W•òuŸ+NÓPWʯÿü'B\Z$SŽEHuq¹èˆ´®ºª¦áK USZ¦þPX˜Í¹hsG”ÍüÊžë+…z}U%IÔÆ ¡Ó¦­··9ºm}ºÊg¤+ ¬¯©Ê€jÕ¦G6¶¦ƒ:{{8ñ$®*)«ù2\V]QS¯ürv‚Òr-œ¯AÐf™ûëÁ|-P3`¾‚ ?ëK–9øÕ‚ ‚ ìk ‚ èoíK_ ­Õh’¤@P­Ð¡l&DƒXX-’ 4‚*ëk„µur•ŽÉbb¢‘× „µ‚ÊbP›› K’*©HXS§GéL¦n¨ÖÔJå*&›ý_fq„¬ºBè,Zs ºFÒ ápX ¤âšQ GXLºñ1“x ª¾AÍâ°QhÒ*aJOa1hF[z°ªJ¦ÄYl HuC Z¬4&Ýø:àEU•P®,!ñºÚj‘XFãp©MN\«” Õ c3i€ÐŠjªÅu L.k~ê3©¯¯ÖŠe4›Š¡:•¬JPÝ Ô2X,ãkKâ"a•X¦dqØÍ—Iºêª*‰BÇâ°P|³–I¢A\]-ªSh&‹ðG-Óóò©êÕµJÂfÒ«^__ðœ=¨¥IÓƒ qy%_(‘J¥R)BgÑ€®¶ºZ\/g5½$©SI…š•ŽËf¾Ü¹ð ­}=óû7N)¥rÍÇZþKèµJ~¥@*•QÙ&Ôÿ_“þÉ_Š²–‰’£Ó°.î¶ø„ è¢V«P¥ÓÿÈõ†ŸÚ´â~vÑÎY)¥ryYÊøYÛJr¯ØtZt7³ ‹¯X¿îJ) t±ËW½Ìy¿~ÆT¾¬¹¿:eͬ™k2sR×,]§ àå“79/N;˜õ™² .XµôØ“œæ7S•$%\:½pÑ €®êÄþø¼ÂüØÙ“o¿¯7zÞó¯Gí¾ôzY×Ä­X¡±u®’ª›)Z+­´·Õ­Y¾“03+•ê ®Ž^¿ÿÚ”Ñ!FMFnÚ]"¨} g7NCþã*ܾ[X€‡³—»õókŒÞaó_,qfÏú8Ãsë>ÀÓÙÁÏ‘–ô滧ªk¨ïÚÔ'É‹~vk~V…iáÚ`K¯Î]ÝS„8Ó„ P Q« ƒJÞ©Oï={Î_»m„+;|Í¡©CzöØ—B³¤ü¹™s$A_Š&I’ H’$?ÿë[[~Ü°ñŸH£Bšþ•ñ¾›Ûòóéì{NÙ0> 1¡bHã-5¥ ŒÁþ¸FbÕ9T‘ÿªáSþƒc† ú1¢„ãßBû(»èðÞg-}<½|Z&ïû­(ûq®ÚÉŸ);w:1çÇ»·Ÿ3œ<0³v ëaröû“§sÚ:57íȄ׮ìâéÌì´»¯”,È7ogæä¿z|—tôe6¾!'¢÷WV=¿u«R‹7à,g;ó·/_5¸0)òXbbâ…­ýCg¯äAÕPÍ-˜o¥7ý–Ohe|¾P«•—• ´¸ôȆõv£WšhÄu2•akÍ3Ðæá×É÷š÷˶6­JMÊ΋Ûñ¢•›£a,bûsÊÔÜÛ—ÙwíO±ì({r--;ãÒͪ6k¢,·¶65·²ùg=õlÕ†$t•åer•RÈçË ßƒQn m]Öãìv=ôr#queY…WWUT*ñæš’îÜ“Î^*}{GîÝÇ™kf¢æ§— ŸßOe˜Ú-Ôa}ìß|”‘tŸ6ÅQÑ-y¶tõ©ïŒJG¨æ“[ÜKÊx|ã‘M¯a4‹vàÝÃäì÷'Nå´u²4¸°ªªË w Š ®$¦³mMyíÊ>Ö²¢“ñRÊúüŒÔjaÑê­Ïƒ[*¯(,ËM)Ôumº|¢àe²ÔÅ…®ä—WêueE•Zop¤ ›õ÷®¼-ÌüèC*Äëû·ÊòÓŠmz8¦ñuñn|õŽ‚ʪ—÷n•kIIΓ~åÕS§üÆOdý©‘³¸h벘/}Ce¯®-ˆ¹“@'H>ré)¿,§@ÆqàR¯Z¹tß—,ºY—n=‘üùJÈŽ.[T¬úTŠ¼úí¬¥§åúO¡ÈÓ¸¨ø{y_Ý9ÿÍYk®k?Þß„æÚòI³…ŸL¸féî: eXûÇ7f&Ýç†M1§"@/?¹l^^½àæê~çÐŲœGéïë>þœ¿w牽-—ï~ˆ“àu{—EUáðIAÐáó"@ ñ{û2նDŽÞ!N\ë­­êSr$ƒÎ3eàuÅïr »VÓÇõdSéÁ^æi¹>aS[»[5óü§ÐM;¸!¯3Ë; çfÍ%¤ü·ïs¤(oáœÁæ†)o96-:ò”Éiou\Çoî]=^<}‰Úzú¸»ûzòïÅ0 …BÁ(T“ÎvöÁþæ÷Ÿ¤Øø¹»¸»6®zYÁí¤"o‡ÊòZWoqR)–••!ž£u£EŒÔ¶UOUqF Õmί™-ÀÛ>óUf‹Ð™]ý –›æÒŸþwìDí=XoÒ ƒOôw07èkG(ï“žš„ ïêIÁ÷îÜ7utV &~VÏ#T?_ç·ÉoìûLé䀨knß{éâï.©¬¶ñò5¥}óâš¹Úáåoʈ©ÌÙæ!m=S’^ª¬ZÚƒMm\>båßf—ilïÆbÚ:2%_å…ôëì`ïigÎn|xmúŠ³Ș mCÇhÁži9_©e‘U~x›[Äõé5zP[Ë´½ú:³¼ÓÐw£™)H}yö«ìÊN¿Ìîêm…"˜uKÏÊwYíBGøÙ­# ¤•sŸ®nö\¡¬¼óàw°—ˆ_Íóñå6¥R9m]°×¯s\ºÿÒÎÅ Á¨æ<Óü"Ѥ¿ð {¼X–Ž]4)©Yj/ÀÉ¢­}ñêקה¾~rL ©Tê\}=?®C Ç5zš¹Ÿ‡ FcÊËs³òù½GGò¸€$JÒË×åc½áÅÌÞÝéã *R­TÛûø±1@¸ZGó÷uüx$:µ’eïîhý•y=®Å)¦-½mQ@j –V\ø´;ÂÓו†"VþÑ/µŒ!wÇóöçÐ0Ž‹Zš^A%pQëŸz˜R)L;_/¦¨ÀΈ•RçìãÍ€™› úû2‡æk ÿ »×G]í×€† èô%_ ŒZ è‚^¯GQ À… 臎Z(ðZ@Ðÿ ÃàE€ èG÷Ç×l™ àêÅ„{)E:RW”z?áâÕÁçä`zų‰'—ŠŠ3¯\¼””Å×7;÷@Qýnúá´?ÆÉ’xnʃ‹ —SËåF?W™–8é<ßàê•/n\+UÂŒYAE-¤êØŽt¯–™æ>É««Ë}2/îu 7kÇŽã*$‘ó·¸3—ó$ ±[NXz¹ÝÛ2§H¬j¾tWV–— ëIžÆí¿Yà×ÒG¯ùÊŒBÛP^Vö%EJÁÝc{Ï]Í•Ã)™AF-dCv)ݯ_÷Ìy]ßç}ÈÏ}×qÎlÏÀ>þô²÷2‚ÔT\‘lc $© ¨O× V“#üÒøuÍ-Âë‡2KŠ÷G-¯Ñ“.Úr1›b¦Œ&ßÖɲs;Ë* 6Dm«× å_­õÖÁVAAÆQ ¡–`4°f˜+UjµZi *f®I4´N&Þ¹eXÿ×ÐÓ+jXLÝ5käë:Åwr»™t›Ø¯[ÐÞ.‰%šz…ÐÔïç«~];c“¸IvRë~ó;wìÝÉE÷¤¢îàŠ-¡ýºQá¸A‚ ‚šF-(Û†TãÃÖî³S L¸.ǤZa·í0\ l(Šr*ëЦ¨ë/röíÑ1åRdúÚµŒZ¾ ½ùÒùôO±d0]}=­x-LŠM¢R+/§0Žo[séIö¥ÝÛ¾’D‚þ­Zóe€ëÔ~¹„ úø4‡aûù çÏ>Ny¿?=tó"o ÎZ¶)@½gñ\¶nÝ 8·c©åع,K‚•7ïÚcî“øŠEG,›/]òèÈÃnôä{ų2´ý¼·Ÿ;oB4ø…[3sZU_ß‘ÚaÜËbJ”»óÐM[W÷EÒ‡/6eÀ‰Ð^½4bÝ’3)Pð8~Ùeú…ý¿Ò`W AпÝùZXT¤¼²†jbãdgŽ¢^X^#ÓÙ88›s>u¨ÔUó)&TD)©©¬–0-xVÜf>ãèuª ‘ŒPHi&6Ž6f$¡V”7h] WÃܸZ…„/Ó õkÇ/ [%5•ˆ¹½)6Щ«(غ: SÔ2Q¥uu²@á Aôï³ÌAAôƒE-põ‚ ‚~ 0j ‚ F-AA0j ‚ F-AA0j ‚ ‚Q AA0j ‚ ‚Q AAŒZ ‚ ‚Q AAŒZ ‚ ‚`ÔAAŒZ ‚ ‚`ÔAA£‚ ‚`ÔAAôWúDûI+-¸qIEND®B`‚suricata-3.2.1/doc/userguide/rules/header-keywords/ack.png0000644000000000000000000006133113051004444020452 00000000000000‰PNG  IHDRznxžÀsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ<‰9Ô IDATxÚì]u@TM×?s7€]:D@DºSPBETì.°»ë±»;ÀîNlQAE$¥»vÙ¼óý± ,° ïó½úÄ»¿?”½1qæÌ™3ç"Œ1È ƒ 2üz2È ƒ 2q#ƒ 2ÈÄ 2È ƒLÜÈ ƒ 2q#ƒ 2ÈÄ 2È ƒLÜÈ ƒ 2q#ƒ 2È 72È ƒLÜÈ ƒ 2q#ƒ 2È 72È ƒLÜÈ ƒ 2ÈÄ 2È 72È ƒLÜÈ ƒ 2ÈÄ 2È 72È ƒ 2q#ƒ 2ÈÄ 2È 72È ƒ 2q#ƒ 2ÈÄ 2È Ã?@ÜH|Ùêoó•+©íhý#\¸y/~®;­?Õò]Œ7©þoÉ?°´ÆãV»ùs©/7¯÷¿D￈º*1¼Íÿÿ)•„jNÆÆ×DJüÃ’VV«¥âß?@è/ù¬°G÷í¬è¿ï‰¶è'ŸË¥ÈÉM¯c—GmrýO@ȹwtÆÃ×JØ r.ác×Æ bRPÚÓƒ§&B %¹5½6$ÌõŒ ñ+³^pjm ` !H½±uÀ’³ëÎÜ©ØÓmÍm6B CŽvè2öȪQ[Æ:ò&Š÷^NépüusòN!I ¥î&"ä¬;÷77ÚH™/ãVMŠ½4bÕ±(3Qµ¼ª÷èlç„]s$Ë»µ:xþ¹‚YžDÚ2ÄÏaÁ†ÑýîRm¯îZˆÐÏО5³k÷ëÚqONZЮîŠè0ìÑážmsÞî·[HMèû<ºlB×µŸèD=Û#„H@íÏ?=®CüN1‚êþmyÖ"‚ʸ­+vÄ?­á ¢4rÎâÑT€¼6aÚ+ŽlêÑI¢“é½í,÷¦¬p¥a„…ÅŸlؼçáûL!¦ÙùŒŸ5³s{ „EŒQ0Ä>ô=Osïë›® ’íÊh×+‰oz19Î ÿ7àØû¬&\äUž¿b¦Fm¡é¹lB?ªøÝ}¼I»Žx|,4×]êB½¹sö‚Ch4ÚXÀ[xæ­æùàI§Ë(DŠX´M‡Ðs‡—ÐÑ$¨ÕJB¥Ñ(”Ÿâ¸:²ÆDÌx|ÓBòÃü†­|vÉäÿמkƼ¶Ø³këèi]—ƾÞ?'|p^üÉ„(¤4kë3yAC½$©eÂÀˆ²nÍÌ€¡›OŒ bÁ|X´x¿ûä~ô²±ÛL#¨&÷Ý‚å[#æïñÑ§Æ j:€B¥h´w[3kErPÕ@…€¨tz§>“æ[óHÀ|vÙù ú„'ž¾³Ï”DPhTbï’UþþÚ׋$*F£4¢ÿíÖ œÎ†ÌkwoGÚ†×M7D¡ÒhÔÿ`Ü)4RgEm=·½ŽŸ *J1(…æ”-;,ø’ôÑ0VÐ,:l^CˆJ­Ž…îœå­Lb SýÎÅMÜñV’²ì"84=b_eðžƒëWß0yõÔKfýœxÃP *F%š¼Šht: à5bãõÌÐI³¶D™Ð0ãÅ¥©}ƒmûL?¼ ?ÂX4¦*ô²¸cï]ƈ—XŒ ÿöµ¯rŠrˆ&ºB¡R5Í=×ÌÞ¨*‚ÖN‰ÒJÿhtº÷ÑÊM×·LëVßC*.š^…ÂPÖ_¶v‰•”ä]  Ü´/€‹!`e.œ¾ÐyÚþ `Lcjü"¹ð‹Å Æ€Pe^ZjvWLuíN–&ÔÆúÆ!Tñ%« Ttmc Ó¶Jª2Ÿ|©ñ°×}ÿ&+›Aé­o5èÃÓ—<K%±FÂ*{ý">—ƒ^±Í:uÒR€‚Ì/Yy¥$ibi¥­H€Ô [=";%»S˜¦l´)׺¢ãñ9QG÷;˜SÎRA{GÿÅ«¦®;–] SÌ:u´aHéž²íà“9ÑíöÁö ÞŽè™E¶ƒOê«tT7¨T,G˜lgnccF©ŸŽ@c¨ÙØXSZàŶ†í-­ê§‹ÝÉ#iN]c/•î×"Õn¾šÌ?µ20n¦§`ŒPÒ‘ÓeúV bt=§\/œ®Z]Þ[ÕEƒƒ{<½qúâ‡þ‘6ZRî“S+KÅæwLí4DT(">6èØÉZ½¥å¤8+%#·” •6í:µo'º*,ýü,SÎÛQ'ùÍû²ZRYS¯“¹!¿2?ñK–¹«šu¨&çÝ»|Og¢QÂ.z5fÎ飇ºÙYk0HÛjF´´ËwXsfvT)P ÒÍm¼×Ίš}1­†KªÉý€B_¯îØœP0÷ÔµHk5KÛÙ;9ë…ŽZ1סËê6"±êaxóáIr´ ¥N“¸zï^ðª/ë‹¢3Õll¬ „þqJŸ2Æg˾/‡wsQ“FBÁÒºSZ³:¶:¼* ´L­­mè¿t!øµ-F(ëòš€ˆá«÷žºzáèôáƒBfÅ7Y`B¯LŒ4|÷ÙŽnÞ+`Õ4€r¯DÏ^³{t¯Eë¶ßy[ðâÁc6…—˜ðìK1»AŸ­­Lxð„KÔ¾}úôk)>ŽîÝoèƃ§v.›Øݯ÷b€SÛçÄ,Þ<(fgrZú¥³ºû~W‹ =¦¾ïΣ ‘DÀ #·ÝÛ·YiüÈp¾ÆW%kÑg*ßï=ö’\²f¦hý7 ^-m%Ä­¨ë;‡½`Þ¨¯×w?*æJ±‰0B <ö(¡ƒã@U—ÉþŠ×^.‡?ß$„ŒwL¶X3aeá/ð¶!„?îŽ î;zÓ±ø+çöNØ«÷ª§"&¤Œ^¼{˘gž|J}yyܨ¡ko|‘ÇEsfÍ<Ÿ.& Oµéui+¬ÌÐrŒàszõÄð`ÿ˜­—j!ÔÜ ÒV¥òú½‚ºIAjyÙ¿~‰ÚO˜é·®W3ìn­&*!„10Çö 1·om )– &½(~xõ² B@ν[cGvòÿ¹¦“r^3bB‰˜‘±¬¿‘;ô·k7à})eÐØ%SGú/çnp˜Ë¹aÚ ’YðåÄ„mŸž¼ÝÝ\ RNNܼvTØU:•(MM‰>z%²@‘ÿÁÓ¥£gN5©Sˆ0]ÓxÚXŸcçoFÍœÚ@˜qcÜÖO3ÞŒ°V€Ø¨°+öøm‹hr¼ÜÏç.Q#†ö׫ëþ­7·Åt•7Qëb"F ïóÚ› ¿Xµµ¦Ö¹Ë ÷⡃/h ÆÉ49Ї&šÁTµÇWöëÓï Ü|Â[¤,œÒhÃ*ú¶ß¾†±PÑÀ¯_7swSèò’d|{bÅý’v+»ë×?-g>0vàÕycV]¾°T½ÝÉâ/Þó·x@çï]GbY¡«èOŠ’Ï5ëp8lÕ¶»›'vi"¹(TÞ•ÃßÑè#T05Øö“¥ Ø/jÚMZ:~X° ä>Úßoö‚ãïÛ¨…F%ÒïÝ]ê¢ödØЃç›bMß|%a¤Ÿ)`€¢‡³ÕÖ†Z´âÁ@è9ö8r¹{úû'×/žîê¸ÒÚ?$¼ß°nŽF*–fô‚QCbº¿×¹XÀy•”éoo‚ÄÌ íÎÙ™÷¸~¨( T¦~,ÒÕ“^g”‰þÇö¦ÖGß¾¯ª%™\EÏá!ÛVïN¼ã€J.Æf;ô TÄJHˆš‚¯ûs…’a—È®Z—yB>¯Ô‚½!Ž<êícÔìné‰û™D½TĺóˆÞöÄ¿KÜ`ŒQá3+Šò>%¾.«æðkÊhò²b.h7LŒ'×_ÑôlT8ÅŤЫíÒ˜{Å€ÐfVç(`~ƒCK4 AÈ_OzñPWq5SÃAÌ®+u á«vSSWÎNKïZn"@WÉ–¶±øä©Ûþ­ÛO¥ð,·isÆÆ}Ý äûÇw¿ <ÁRà èC«7uÔm-Œäî¦Q¬ T৵~uñƒÄœfš›öëf.*áåŽY¡è!Ä®($™Ú³—Kh[BÿÑK·_²ë\ïy}lšø*îÅnäu¨ Ð3¬Ëš‹RŠØmþlÀM}ó‚žî3·%ó·Sj,Ü(øã“»©’ô‘cûYqƒÊ=cni~nÒ›l>;«Qø55P¥ž’Í`%Q§ôltÉëµ=Œ‰ <übå`Wyx{ó ]§ƒ®RƒcK1/E-5±õž`ë=aAÙ¶™ã¦F-ôj›ñ€;…Î|ë¸yËŽ‹ì’“ÄÐVlÝÞ­£¦ˆ×ª3“Ÿ•ÈIÐÏëAl)µa4_k•t¡ „â—„\¾{ÏQ›¦­ÎœzÖˆV³aï‡îÃÆù’/ñ«Š>x !éyJ–f‘];ü˜ŒmœöÍrè6]÷GÛÛ5¶HçùÃ{ ^B,äkª û·‰ Á±¥ãwßûìÜÛÚP ×–qS6(¬â Óú…w¯­±Þç "”Ó”)??¡¬¦†BQ¢Qš,㤢¡_G\¤®De±jš*ô#¦É¨9KÒî„õØs¿Ø6cæ0C·Œ„|…ÅYË7r"!|yöû” M£¿N9/þÁ6½’ÞW3u?¾g ’âÉ `ÝFl„#GˆqÖõà¨C³vØI³É<"TÍöÎó ˜³&¢Ï $é?¯LZóœ«eüxîœdÕ*‘U¯;6Âæÿ3žLïÙ³ºöœ92öêÙ˜FÚ WnÞþcŽ iôA?fÀì5cG\H«éÙÓL[…WTÖè>M^·´ DˆÆ•ÐíãnóǾÝï]§ØÞO¸c~D…ÚØ>ç§L±¨ h€…Íb]ï2®ÉHX¾|í˯ùöT›ó€–íÔåË>O^r|×óÝ1‹'·Š?n  ƒý˜e±¡–/döwê€4۪§¤VkÒ³¼²:*O¯wô uíÜÕ©»^çê¼,E«­ÉòŒF\ÑÁóøÎ…-…KZG»¾ƒ.„,\xöàŠžHÈÐÛvô¨&åÏ”ùÏñÝ ¼¯q—u[|aÍœIƒôïHGM—WuU^ßîy^¼ÿœ´Ô–ú' Ze!ÉpãU˜UZW®` h„¿"ÿÅó¢0FHÁt0Ö„¦de‹ÖLJéB'ž\y§|^Ìçþë\˜o¬¾(ün}¢‘ͫ㺢ªŠfmí6m]†o쯽aÆÊ&Ô X5ȶpöŒ£ EÜgŸžßæ•=]Ûéèé[††ÚÙ½9ëÿ««Bÿ¨¹”¬øãï ä¨7$´DŸŸ`’ªï/o}L›ºí¢©ãèß3Àé'^£Exx~{r@ÀI¼ûJmæpãfÅ*9¸yyzzzzz™´QT<½z|Æ°îÁã6ª:÷Ýÿääê¡t‰M0œÂ´ç‰ŸêíSI¥×ì)%ŸÊÙõ.’ÆfýØÑ,¾sÿØ߉½††‘Ùß®ïXCt·"šUEÕ>qRtttôø þNFÜòO!¡‹w_³ùÇã[gçF2×¢6‘‰ÜwFN\ÅÖñ¹™•tyMù…={ àU$Æž|ÙÐ,øzfÚ©0ru4½ñÞS§±ï_9vôå˜iþ-®ÓÒâw?Ã*Š#—F2gÚTÃdHŽŽTÙòûÊ¿8®Ð©ƒíÈœ©d¨KÒý¸býþjjïÞÒ~æøz9§ä=a¶÷Ýqƒ‡†wmK)»5¾Òt¸û¦Ei˜i œUsb=»OîÞ ÓR4ÌÔЮ•óÖ9x÷žÜgAÀɹQ#;Ë—|¸t=uìÁ­T …$•1zÜìЛ¬§—>ÑÖoé-áYÄòvCÖDÜœ2d§[Ç .ytÓœ¬¯*{»h—= µvÇ¢yjTÉÍÐB»Ñý½¶Ì™gÜýbc±íÐ~ÄŠqïGñŽ;m¨Øº²Š*¾'Ο;·Ñæ+ tžáiÐÔΣ(éoŸæ4gýù~Ýzé4½Kµè½mÄÕi‡R”\@Ö±oU–Þó‘dCšªž¾Î½{禅L@åé¯çÎ[_3EÏmÅÄž?§á€a¿?|χǽãu ©{ÎÙ³x~”¤NÇà‰CüˆŸXAUÚØ(+q¶-\œïiòäÊ)5Çž0íü¡=J“Æ[µ"«UºLñY¶ölÑeëZrÖÔq9CoËÁ3†Fz´ºÍ7MÇ*Ý–L¹Þ¿g_wÓïìòK¦½yòTÝgŠµ ²õ.(Ùô:±¾zð¤¨ÐxKƒv:JnANfbRŬ=GûêˆÍú¼¿[»µwË §(Jኬ·ó$†FÄ='Ìto§ú31>ŒQÀØÕ\ÈêÖ/úœ‚UóçÊÔQç£"<:üfqCY²dÉ/t­›ŸkÅ÷o©ù–!“Žð³W#S² ´]|•k¾ëvð´5SŒlZ(±R¾¤W œ{M^9µ'ñÊ¿Ñý»¸3)0š¾¹™ŸW¬bêàb¦ÑPƒ¼±‘zm~a©†…«“‘ª…_ÿŽªì´Ô ÓxòÚ?ztT€GWö³Œ§¬ŒPzôä _¹Ã¬Í›¼t$÷Ý Œ¡½WoWZ~~~NÆwù6fÞ½ÆlŸß_]^\¨"­”5ÌìµÓ¯<*´|…ŠxÄ›ÚvÊMÍ,W2°7Ô¨sö±r‹ª½ô”œueyˆ¡H h\*ÅÌÁÍ@•–—ž§çèæ`¨Yß<¥ö]´Xß¿çxzšó«‹+øê}mhuwu¬<ÊŠŠÚ™ÛøØuH¾ù°ÚØe\Qoœ#@µÑç¼Iºû»²òs¦" Uc¦®¿«EKƒX˜Ó¶“s'“6"†Dw7¤g±¬Ü|uåœò ÌhFEeCÓºi&ÌÏÈjëä Ko^>!§ÚÛ×ò{ê×ôÜ ¡KÇ÷õ³Q¨ø”^lìÝÅ Ó*´‚ºØ‹ !+ï{­APg+ PTª9}£fæòQj­nTyu5e±¯TÚ£0Æ„sH?KennAANV¾šžyÀ°Ù«£©€ rÓò ݼluU$Õ²ïéy¦^Ý¬Ô Œ±ªÝÈA! BV5‹CP-=B×ìXëi¤ZçÁä¦çwðð2Ò`` 40Ÿ®×Ù×Õ üêœ|Ò»«; ¬ 1 BˆŠ™£›ŠBKDNz¾…wgU‘NF(hù¶)+@Ú¶ÞVêDMyËщ¦¤cbÓQÌ`€…ÜœïE–žAfjÄ/5±~ï!†æ‘JñÔÜMPïgÄX$¶ÓFÎÓæ ÑŒ[퓤µúä2O-=Yß²ª¹=ú»mÛ–ÖZˆ£yN²±’%r ÚT«FTý ÅJö^âvÓ?»ÿ$k‘,ª]]ºc·ÕÚ~H,žÈ€šö¨e—¥‚a—HRB‡F8Ýô>zr¤åouUP06xêúK'”iD]ÕÒF¤1 J¥kýS’ÔkèˆÈÅØ i~±+m€°´™Òò»¿Ñgü{1 ŸôW5"Bͯ žD?éködýOæ”}T5©-ø£ÒšµL¢Ôº££YHÊ_n7ïd#jHm¡4‘œÂO’q󅪛zØ3[¨í‡ôA­V c$…`u¤¬ó´Uߺ|ãõãø‹VwšÿHzÿG¡ ±Ý¾xW,“Šš·Xêˆ „Zâ4$± G’™%|*?EJ\•zïE6¢4—g¤©¡]:Ûüh€úÝ>ã¿ìÌÔï„®¡[Mñ'­Ë¶F&ð¿•_vî?¨@oz0 j»[ˆÄÍßdÍ­K×kÔ:¸¸@Gþ¿&l$Ã^z†¯.ç?عï!S¾Ù ¹Ý';‰ÄÍ?ƒÕðßyÏóEC–Påÿ’àß?€DкÑ߉nÒÄ5·ÞÇ_ pˆê‘ú·t}ýÀ²ú¹zꇶ¥ ±èbKÍÁ"4òNµÆ@Ògk]ÆRŸ•¼Ñ¨ú†ä5 >ˆF­•b”ý(·Š´l0-‘KğȤƒàç­¹…òù£>þƒH@üCG€_ù¥»§Ã®—ÕøW2B9‘:n|_Q~mƒ•g×ìj¡È%(äVÞ=Û;ÈËÁÞÁÑÉ}ð¤% _‹1ŒPá@k[{GG''''''G{»ÎaÃN=K'„ùº³¾Å¦Ak<Dò’ïݧ›³‹‹“£KpdTÜ«LŒXd!¨­Ì?ºnf —³ƒƒ½g@øê×ËÙÂúÉ!àpuèÒ§ˆ#DPŸp§`@'›Îc2q½F §zëÏ|Êmbó£ª[^ÂÆí窓¨üÅi;g×å òûº:MÛ·‘;ÕÎòÐØ“ú|g£½µo»¹7­d˜½ýèšxÝZäâ5¨¡MaÆá{Ó‘Lý7â(n0\0³ÿ8çé¢\”Я5™:šŠz*TºŠ’"“I§€Y“4¶OÈ’c)ãVî?æøÞ®m¿Oê6u×[ )0.ãV\½x>>>þüÅKkÇ:m™1h屧€¢ÀdÒˆ,VO× ê¿ðr÷9[ÏŸ?ñbüâÁV›&ˆ=õ!å¿;ß7"âôæ’'âââw/“~znxø×åbí²O&VØø2³w¾«”ôMÊ3*D⊥§$U 9¦´cÏT†¢jAâñ‹™¬§-…Êd0$.JŽÖÄ÷‡äŠ 4•Îd2¤…U‘<ƒÙìEPRRf04éJmÔµt”e3ó_‰ß‘ï¦4ýÛÏÙ!¨hz¸ZÓ0ÆX˜ðàÃÌ_·6éeJ.Д­Ü;«Rµ¥÷ï>6rïÑ^]|:†ûýÙ•Ô¡.4‰?œ?ðŠg×Ýxyϯ~UéåÝæÞ­gÕ$ÝÐÒÅÎT=ãíÃ÷ß+5Œ¼¼lDÎDaMîóKY<C­“‹»¾2Udñæ$%¼Ï,¡(¶õòqJ¼w]ÉÄÝÖD €÷êúU–i€oy%Š@EžBgÐx|’JAµ;Gú,téÜr­:»Útþ~#ã 7³žUó”i jm´õôEFÁ¤ùîÌ¿|wÑ`ÏŸ"™»íB^Ä¢]=Ú‹l ½v“dÔ|Ä€ lãÜÅBÓñöDˉ`l¼÷ŠÃØÁãï^{æ4ÈCt:âÜÒz=Ö¥ ]¹Ö•Y õ"Q'F…íݱÿNTŸŒ~-²žÅXµÔëz¬6úµ^q… ªÁP“ ?Þ¾TÐÖ;ÐZC6Keâæg­‘oqKû®½céìa¡Îz7ã8ùÁÖ@ Žì^[¥šXÂbŠpøxyݲÛ?³ Б=ô²Ô×LðÁ#Dž_8÷°ñøÞ¡.â=!À׎ž0r]‡ È8³xýÓ¡dÍ®#JÎÄnØ8É¿]\QÇ~®Œ­,9¸~ï¼.DyBO¿É< G›vÙoï-œA_:N<3r׋NuÙŸ7oÖ£p^{8dk¢À9»vá÷Á¶¾L&8ÁÔ£©†ŸØå«JaæãÃYrÓ¶ŽÓªÛ*‚ÞgxKó8ˆ°±Qç¼+güTŒ‡`´eÀ«Ÿ ̺Þrï6en7ÀÀy¶ãJÁ¡¸h9‰ò1MgÏéóPçÇ…o·%§·6ÒRPÙ2ùΗÉ=,èõ{XÛ1‹%/¾ÔéærÕÖ3j²Êln0=Õ}ÛÁÇ+FyÿÂüÂŒü†°Ât€swUcoü±è¡ßa™¸‘‰›ÿé­èékÆö÷^ôãÐS.~®‹½†Ï¿~l ²‹Íë^Cž<Í·ôo;ÑÃpâ“[x‚•©ÓƒG{ÕïRGP}ïúÍŇę_(T ¤>ípëI_}€H«çnC÷q&ÜÙÒÚä&-úpI@vùtþj…‘õÝS»äæ_?sòJ°cOü}ç~[vO÷€Ï×VE-ã"$2*çž¾M*j@Ûö€ij–æj›žK¡ÑÍu´Ä’@rÓEó¬z¢œ•7jtèøÓñdµ%Ûgö¹È÷Ýy; c+'¯.þþ¦Z¢s~øó“4¹v¦¶ÌF¥&Û~Þ=»Š‘‰›ƒ"礢xýîÝ!õ yµ#m=1b÷Õþ³C­~ Ê©î[ÚË?z]Øo7Ư[–0]¹¥2ÆêíD;ëѸC7‡ËËdÌwó󦆠~QÝ]ԞݿsåÊ•kS W–rH¾‘¥!ÚdIW ¨ÔÚšjä:yŒê‡ûe×'Ë IDAT 1 ÈN~Å‚v^.z’‡NŸŸ¨™Ú6X÷ˆ§î¨¨êš$ê Ê_Û©És¸\cs2ÿë¦ã·¿¦gW²…Á‘C}­5—‘“Ãuîå!2ÑÚ{Rc¢úŒZjÚ:Lª¤?E.Ÿ‡ Õ‡FœW––vöövöÎno§—‹®Wç¤&%¾}ûöÝ›WϬ™¼'•;nPäÏSMŪ×íÇw&õpÔÝ8¾¥Ÿ¿Sè¨% jp ‡¤É‹ÓKÓïÆáxƒ¡‹u©HyÞx»ÇçnUŠÎÔwFÅrÿ’ÎGW¬ýÂûq{TܦõãÏ¿ó ½dÍ£‡HYKGK‰.›¢2íæ'ç Bï›3êàóï½Úka²Qì“ 3êY ‰uFç~Áôí«o‡ÿôîöõˆMÆY®"·‚ª¨¨û ¨r´–E õ¹êXWÝsäåãf‹ç.´•ËPP°¿m^…_QÃSÔR39•.O¡ÿ˜jª*BYQÍm*9‡K¯ß`rì·]»-¨·¥¾Þ:±D†7ݵŒ›ùêYPI†ß/n÷ËåÛ¯znyã©üòO{·lý¡o¹K×þ—o+d›ž¸BοÛôD A#HáŽÒ0óÙvöž ¦øý›§k–¯šÁPß~m„åçcWZ8:)MVPu㶨ª´„¬Kþb/éþɃ—S€ª¨åعG3Ã’¼$o¤£%|w/]¤Ýä}ºQÁjHæÊaÕÔò¥ÍAFÇM“¬žÇN9üºˆ_—™PÀ«M¾ó°”J­Ïi$äñšuLâo‚"Åì¬CMʽac&œ|‚ë´`Þã[©r::Ð&|rDÛ³"Ÿ¤—×Q’ÌûxmæÎéÙÕdmá½äoνgEöë/B¿È¾3–ä$¤sš¸°å:ôŽÛnéèÕe ÌxV0¶Š\i§üaÓŽuýP‰îkðñø©We<ñ¡!aí½µ+STì'º7ä%ˆ5¸V( ºÀe×°yBÙ•i7? kKKÆáé£k»¹¾¿Ïwš¬©‘|g×*Ãù1-jÜ\‡E}Ô¢N¼õŽ>I fß+éØÕŒuúA ÒýY¥]MX´~Ñð‡÷üÛk—|{u=!}̾þ@(‡ûÚ/Ù5a~aÍÊÄûÉtyåz³­fu¿ Ü~'÷ 1j®}µºseù”czÄë·iÓjK‹‹K3‹Éè5»½TŠ@q:\[>þ3“%mþÍÀ5Ѿ )5ÔìÂ÷L}6föˆ+¦Æ¦Æ†4~ù·´ìÌôâ{6*` ‘‹÷Ÿ<¨—a;M5fuIÑ÷œ‚.S·Ïè\x{FJyÇ•} $Nb5ŸîÂ]›dìÔhÒ·¡« Ïy["ìòû€¦¼uQÿÎ#È«ˆ­ÂöãöŒOÕ#ÔØ –"¦«š¾ÿ¬¥î%Jͪ)ër#šbÌÒU†ªŸÎpBX·[Ñu\ìp»Æu ö ïúÄ{çéI6²Yú¯Á¯ÎwCíêï…j+‹Ëj"¦ÍêçꢧXRÃÕ³wÓ&X†æN–Fª`²šÅëdçb¤Íù4 )gÍÙ6I—Mó ¡6¬/GÏ%™ ìb `W>n’UÉiïêj¬Æ!‡ÍW5p··R5uБSQZQÃaêZ_º>ÔR #dîÓËQ›,.)S0ò]ºdøµSGÚ9öóì¨ €+‹Kµ:yØë3šO<Œ(fnaÃÂ\èty†¢v;ÓΡý–¯\èe¦ŽÂ5USGçŽ:*Rõ½ê*Ð×ÓTSSACM¥mW+=y õtlƒz90éDPÊm½»Íõ1©ËþMaºõ`¯O§Ë)«j´·õŒš³b€—1ᇻ‰Z¡£C-Ú4ŠV†‚ïÙtoSVe­¹‹K;U†¨*DWíb‚j•ŒíÝ<ÍÕ«"˜_YCwñqdŠ é¸˜+U«Y9»¸*Ñ0šKHÿ.Vm(ª¢j[[Ïn Ö¯ñ17RÈ穪m5êú©®®®¡nëè¤$‡XUµººª $PWÑëäfÞ4Ušúö%Í©¿›¶l–þ{€ÿN Åÿ /Nôê{Sò’ä3¹OyzwùX"Ę$É?[)üøøâ•G™¢Øïƒ=í¿ecþørkÓâ'Å2:ü›ð7;Nòî\<ûäáµ++ݼÐI“*ÅÁŠ1 á¥ù=ö 1WVôú³ç¼1Æðtç„qSÂûõí Ì¾{ýR†ÖÀÛ{ÆÊý£Î¼ý‹Qðõ½¢‰µ"Éä_ƒ¿™¸Ön_¹<“§ÜêGÍOÖc Õn˜3ÍpІÞÖÌ?ÇŒ¢ÂSœ<|åuµ0µ÷?4„*KR!ƒ ÿ#âægS™4N`ù'„´|™2i#ƒ ÿ3Ú ?‘ÿ9+ƒ ˆ_>=@P”“™–ö­œ-äT|ÿ–]ö+Å[ë ¨êµšúÌR-?%¨MOO¯ªüÍV¯ÆB€üZÏÀø™ I!% DZ§ Už‘žöí{yMiVZNå¯#AiANzZZfv‹‡áwóH4ô²ÂÜô´´Œ¬Üê¿  ÿ£ëå¯EvüJWW¯ˆÁC¯%²’ôí¾›üu•‘XÀ.Sü£è×Á©C>Ô¶ZTÉk¸—…;çþ›IË…µuÃã>ΘŠ0;à*þAO¸aˆ§»“ÿ…W¯oíî:4î— IbL]4ÖËÃ=¬w_O·þãŠj…˜$ Eá̸5“¼=ÜC#úúy»v‹–]-ømøßñ«Wô´"F{—¸£‡ƒm€‚@Ò—‘Fé&qã…ZJ&Jiš ~zzf…|Kψ?ãQñðIU¾AÚJÕ~I|¤yk¥/%±h“‹¸…¬ñ RßÊ»’w‚wKáÜ+hã§ÎB¸ d¼…y7ZVˆDïV%'—÷:sçȲà Ô2q‹_Ýüa÷BœoG·_NŸ}ôþåsg>¹ìÊKŒÞýZû> –Úbiuµ¬Ú6nƒ ûô†“'ï¿s%î̽G7|i©·?”lƒÌÉð3¦BO&{͈{ÍËxîáæ¼ÿa…äV×’¤Q}ƒÜÜݽü{l8óœ‡Ñ³½ó݇— "y¥ü: ™u c•¥Üt³qO¨Bì—~6í·%°;çÅì=ÝÜÜÜ<}'¯>RÁÅ%÷ö:LÒ’ý¼á „*2_NÒÝÝÕÅÝÃ?fÛuFv~_¿À¯ò¼QƒvÝEɽ¶{a·›«‹ÇИ­ù²Ù;ïý’±}<ÜÝ<}C×yÉ€€¬½¼s~››«Kpÿ ·¿VŠ>–ûúÌ°]\\]=ýÂ6Ľ B¥œYcãáŸZ&@ML²DB€XÀ—ñ‘U„!~5hQ!0t‡—ÙR&$Yz‚e/!8¼ví…rÀôå³OA¿>°{>À¶ÅìÛûÎ6ž”ˆW‘Ñ£s×õ ƒÜmúì'iõ£ˆ9…»æòvuqqv8u}KœUP™:Xˆ£‹{ÏÑK³2ï;Ùº?H«@å¿îïâêêáºîÌ3Q÷“Ï®³sïü¹DO·ì£Ž 3‘ š£cúfÞ•À¯J ¶3]u§7AÕ·{S†¸º¹¹yÌÙzž-Ģϸ2®w«›»_èøY€0 \{cëLw/ßî;ïß57(`Üy!Bßnîrpv{•Ç€„­{Qç!},€@uìüù'öeܬp{ã¹—ËdÙKÿyÆ·¢øô±]úÿž_Èâä£ýl"ö`ŒÙ™ç|mÖ_MÊÍËÏM}<ÌÍzèÎ8#ÎÎ+8¥˜‹1æä\8…/$1ÆÉç':Dì`Ì­ÊÚ´réã ž_:Òßnú¡çÙ9¹¹9黧vq{–ÄøÓ­ÅŽŽÃ“Ë*+¹$®~бÓÜs/rss³Sß ÷÷ŽþãÆÂê¯Çܬïd•×p0®Y?4,`䢯ٹy¹ß/ë6,§ã’×^^žñ¯ 1Ƙý*ÂÉnêÁ§9yù9_Ÿò°{àÆøÕª÷¡Ë¿}ÏÉËÍI¼¼ÁÊÖ/± ¶2ñ‚§›gÜÓ/¹yy™©ï†ÚÚöĸðÝí붱MiÔÝàÁ‹ðöÙƒ2þŽ1Iâ( €Ûúá•ó°<`|àmScj° ÀóEV«þXŽqfÀoEu|iŒ¸cV6¦¦w‚F†)T•}äh³ìi^Yµðú†P÷aqc,(ŸæÑsòƬï9¹9ß,ê6µX€1'gD7Ïóö~ÏËËúútb__ïÀ„ÌêêäkÞnî§}ÎÍËËüö~T7»¡›Þ‘ç'ÞYûGAãª9]<&}"²kIŒ+³tqrºYŒµ…ÛV-¹ÂnbÒpËÓzyÙ¯Š{›“››“ºj„‡ßŒ[ã¼wÇ|ìöÝMÎËÏKs6ÄÁaͳŒñËÓ3\»ßýô=?/ûö¦1^>®aÓï’~²jÍúì !ƬÅÁGï¼QßvñË ûø|LòËv­^|9™%3|~~¹ïææê‰þ§Õ 0Æ âær´›Ë„Óõ^†/Wcœáòq®nÇ?`Œ¿îë;ùì¥èÎa™\!Æøð`Çñ—²$‹°ÓÂ]춾,¯s;p*jj1ÆE/×8:Žy\HNù·ÔLÑd’ÂW ÂÝÆ®Áã’KîVAoØc\þØÇÓåJ ¿®Ü/Ýœ½Ž¿ÎÁ¥ âæùâPû¡ë«®}kk?ªãƒ=B©—¥%|!θµÇÍ'øuø2«²¢†Ã—ÜûÜx.ñð+ñæ½â_€ðêdÌÍÁ*€©ú˜ƒ1Æø[vsÓbÄ|w¼6àëê âQa¸ÿœÍÂ8_,_RDå抦bÌ)ÁC"ð,lî§Èæ`½þ“c|}}ˆHÜBÞ÷ŒÔr6Ƙ„EOO¹{û$‘eI7¼=Üî¤óDŽ¤së\¼2krró JÈÓ“]UYÃá“:]4ÊÃsQü«úß5y¯ƒ\mϦµÈB5y/\\NÔ‰—UÉæbŒ ± \ÑPÎÍ£¼ÃVñ1Ž ³ì±åKsÕN êÔ}æ½Æ½-‹öõ‰9|¿þ7§üS˜k§ƒŸ›úwdøïâ/ù¬ûA¶Ž2{”Û¹ÈRÙªƒº2þx–3°“J\|®ï:/®í¦ ߸S:fÆ%)ÏÝ %YEÞ(¼sÇSCãÛZF4 ÜO¥Ù©f$§ŠòãÃÇ*á‹ÓsÉ[65ÈK‹³S®ì_þBAð ù*»t i½.͹ûŽ«H}·dñ"Ñ l!·˜A~y]}×Î;Þw™ï£Ãν†hg¨ù…y¬?0©—WÛŽ>ƒ‡ ó±¢×yŒê II3!Î0`4LÓp™ÏòP `¬@`Ò žõjÔnÎe˜ @´…½“Ä_^û.×Ý®iìÜ©;ÚNÓ€#qÿELдiÓ†NLÌg‰hH!¨B•—瓤rÛ64Ñ— -l;7H=¯nÞŠ{¦÷öncé5xðÐî¾Ö €1F’ HÉ´$ -Ÿ¦v§+­Í£Ø 4¤o¨»2 ž}F„Üé%‹/‘Pé÷*Äz[‰ ’rh6®ºuÌ%¯ß^í[³nQšµc<¨/3¦~þqƒ$P(¨~: ‚@HÀã€UïÈï³ïÃè7*éÝuÔ¸Ý÷ŸIšÐãM¾Žž¥jã&"bXì1ÿ”Ĥä÷¯oñ\¶(xöŽuƒ$SÌà¼këú,¾3kÝVߎzòtʧõ#fæ7÷8’$I·÷êl$'Šy#oï@åöú@¦7´c•ví;{»ñE|Ÿ„¹PÕCÏ]±K|ÿáM£鑊Vþ»·®Òaêl¸yÿóÛ·Iï__ß2~ÍB¥±kŽŽöP“:—ý ,ƒ)ÁŽС ,èϵbY,"’TÖ÷í>ç4HÝÑð©éº mŠJ0˜#QŽAüç‰h¸ÅÉ‘‘ÓLú.<Ö×UI^õîò ¥€ÄZ½Œ Ô“¢{ýÞ—wo“>¼¾µ}ÒÚ…ŒQ«FyK¿dšªà”*výèóye\ž’–ZË›È …i.öJ~—””x÷Üò‹k#X® ‘ž­[g eñ¸Þ½)rêˆÇ µêŸ”7QAojXõmòËØ\EÒ'âdâæ'Át4„C_ AtСšâ¯<Ò@O T üµÊÇ^¸g(d8é« ½{íÖçUÝvÞLºèkGu±"!·‚…Û™Û·3·ï1l⽕}¦.ɧ(!Hî>HicíÙÙ–Œà}ŸBk¥PQÖ¥lÃN>AFÑœe×p ´5]Lh·„ê~u;<>¢SIvuUI×ÍWÏÍ7x¬¡Ý]G^ü\e£RÁS°tð°tðè;bòžÙ.mÝ<Ô} IxžëË~µ „f5† ÄʈšP Ë@€€ Pü¦®=oˆ ~Q®'Ü¿|Þ GÆÁP[ ÕU€0•€Â„¾º°=.$€§||  *˜„ꔘ¾QÝÊò“˸ óG÷0db„P^M1f2ÔTVQ XB©9…@BnM_ÁÂÞÝÂ޽ϰI‡>ýÇÆá^+å*RñS?÷ð3Œè,Êõ\”x¥Z¥³J‹mÁüÚ ÅÈÊÉÈÊ)¬ßè7§b&¯^<%üˆ­¾àÕÂ/ÀJ´?\ÈçUA±&/õ[8(b¼¢Œ °h*nBü4Ž>K‰a¢6”¾»P®äå¬þ¿õ}ÎUdªtŸÑ¿öZ®hM.Ú½ê”Jøôö4 +µ5jK:rEÕg2€º¡™‚ð͑ljzö¥BNÉÕø¸”RàdÇ÷òô¼J\`uE©€ÑV Qhˆ[΄ Ôèååe|¡¼'ªX|Qò> rÊ„j¦Öf4ù‡NŠ‚JUÉBÂ#ž¤WIê ]gE÷oy^)Ò°¬â5d Êi={/=õªÎ|©d!ª¦"óñ‰‘fWÔ½\]Ë¢2µ UYIñ—nTsÉF,lèÿÞ§ÁÔ¯ xxíÁÑX)à w.‚¯œ8 |  Ž zŠXHY«‚¾|­Xu`s( AÓìÀÉ3M0 ò§Öqy ­67G€‚²§[v^ ©cÔ ·¼E!àî>|‚N h/έ‰ŒœQZ'ΫjYTEm ‚Šì¤ó—®Wr1XE­Ðù¼sÉ…tO¦­~ÝsÑ%’Wuãü¹¤^‹·èã‘^]G}ªËVUYN2t)ÝÆõ)8<íiè}­“C{ξ èÝÝ2cÛâ\@Æ阻¹â5µ:/åü…+¥µ$˜G­0I;sê ‚Òד–&„Ì© €…¬;νËåÊdÍ?r›ß•Å#]ãD®âûÃŒƒ¶‘c,¼qpU˜ŸGphˆ·‡ßøû*$&IŒÉ{sÃŒ­·9êXËýŒÛ½ªóä²ò\Mu6>®ÁXpa÷¢nÞ.]»úwö è;þê—JŒ1·âË+[×èY˜•<{H°½OP°°qËÔf] t´ ŠœX&`­æoaãÚsaÆX˜—0t/gwŸ®¾>½þ8•ÀÇ¿°µµ=P rþ½²«_»o@W?/÷ž#ç¾Ê­ÆW%_ŠŠ r÷òíäïîÛmÑö¸Z&«²7ÌãíéÔµ³·Ç€ ËÞ—aŒñ§cË:z~-å7Þp(À£½Å~\¿ ¸è“8¢´ò fÂ}|Ä·äÚâ©ÛÅo½0øŠ‚6ØO à  10~_.öGŸXµéêxÆV,ĘĘ•‰0Ó®Id cŒñ÷¾íV&ñ1Æ—VvîÔ÷Æó«÷/çêêÚ½{XÄ蹟¾§ uwrív©¾°!ØÕÁ»kXxïÁ—¯ptó–Y…kr7-çãéÔÕ×Û£_ô’w¥cüáÄŠö6ÎIE|‘ÿöóÝcƒ‚½]\ݺ,ÚyžGbcnå'“Õ·+ÈÆ;I>ëèÆY^®þ]ý|­Nræ‘-ÿlÒU©&1Ƹp'¦Ûcacj5Ÿ–º#ñKÈãò…)ñïrÙ¸Åî74M*ÅE/>˜7`ã+)mpóÍáRIÝœr›§ù6‰L‘RB„ mHX5fÙSŽL4üÃvמê<ý’“FRŸDŸoúv£XKu½¢&û ß•ò'’Ò˜&5ƒ4«I ]H+M|‘ýþØQv€Ž2¥Ó§ÒI\iü]íÆ?›tU:… aäzpò‚&idOKÝiøÅÉÙgѱѯWn1å4u5 …îK6M*Å!’[ºéro'š”»R¤’ºu¢J’Jj°°fë3á 9™ÝóKäl³öï1Yëfû_}Œ[È…Û×Á¶;èPþŸ%åÝÛ>y͉þ§¨D›dù:dâFdøßÁ_opX&ë~eT–áWÜ „r/s꽕DÿÝ[b^ýÓ¹.À÷‹Ûð3™ÃšÒ9ao?Ÿ‘geNþwÅ `!·–Ãÿ/ʯ=}œ¯gWýÎi…!(ïíÚ#‰bèØ@§sŸŠQ0 üÛÛ\».çü'ÜZ®à‡"L¦üÈð{@ýå³ ¶ª¸¬J€CIU£ñIJ €ùµ¥¥å¾Qh*jšJ T±óËKJk8|@SYM]™!ºÎ®,-¯f“hòŠšj4DV¼º“.Q˜—‹*1AÑn«#þx.vy^)‡ÙNƒø^T£§«UQ\Èâ’4y¦––:°8È-ä”—Õò…š¼º¦¦<0 Amuai¥†¶ž°è™’2_ˆª’š– ƒŠyœœôûE\Za^SM]¡*ñzª\`I~A1µ­–ü²’R—OPè*šŠrQ¶ÊÂü<ó{\?¿VàÊ–aÛsús¬œí‹_^|–¯¿ùú‘vÏΖ,¬TÜ»mOßyËœT`ÛìÑgŸgZ9:''–+î:¸ÇL‰&äL6øS±¼£qÒ§êšÔqy°oÌêì2vVëØíÚ¶N£úíàÁs³(š®Tß=ù ä3îÂÆaAúµ^cb+äµ å«SKˆ!«öLôl‡1Å”!·?Z;8•}y—GÕ]pŸ³¦ðÙ3¢ú2ÛGfådû˜|¼—ͱ?xy³?X<<¦Øjª“Ô IDAT5éÌ2Ù|“9aæ`Œ ùõ‹9!ºðùÜ,—QÙ??¬cÈ!ÆÜ´£‡Íý*~¡2¦³Ã˜³Éc>+­§s§Ãéâßno™±áÆxwO›‡“ÄWóN‹Y[ÌbÞ«.¶>÷ ¹ ·D8÷Üø¸.K¼³]pb§´µwí·9At¹âþªNν¾p0ÆøÉ®®Ý¦æ‰³Ó”ÍéåÐ'ö5Ƙ[]üáCR5—Ä ³ãF•$~†½8Èuègcœµ×Áz@¾è2ÿcW{¯kéUã¼³íݽ«g´Ù9ÆÇwÆŒ1æUŽð »RœtøÔg»3ï+1Æg °³Z÷™ÄŸ^æåÑ%±ný’a^='Ÿ%1¾øÇÈÀÞëE‹ï.°wí÷JœíGp`¼Ÿ÷ä8ŒqòžHÛÎSÅMªHèé`ë<ðDóQ¹¹­·§{à£ñ‰ŠSÇ­ïæ|íçk=ÿLÆäòáþ½§]N½0ÇÆyx&Æ9'Ùº þP÷µÑ£“ý#wñ0Ƽªa}ºž+Ú­+,xãçíròy)ÆdEVʇÔÙžZ~¥ïð2?¥ä»  ’k½c߿ا/ñÝdÀžËt«ÊÓ¿¥~Ë*1m‹¿§•AURU•»sølu-‡/šLZ?Ýtõ•SÎJ.®åòø¤¶ÏƵ1š4¸< ÀçqˆóûåÞ‘?9q[ÅÖÞŠI’PŒîm%r´ªøöi_“q%P}õÄ ‹1Su€ÇåryrÇ¡¶MËüÉXBP[. `‡G%ä‰F”£j2Á´ïúc#Ü¿YuCJ„¢Ø¥"u ó¹@P„1ÉácI5(L9~mÿó¯'ë7.Œ÷‰AãVÔ4;š®åÕIÀg“¤œ]6•dø1~q \ÎÌPŸúæò; €ªÊ¾àâ}¿!™ ïk¹œ…ƒ‰ˆŸ¡ôñî¯tÑz((ÿzæêBÅ-xÐ’…ãäR®gs¸¯Æ—°€±‘­Ï¬5Ë,jòŸð¶£ôŸšó&ñÉñXùÞ#êÓ*!AÍŒJ±v“õ0åÿÚûî°(’æÿêÙÙÙDL ¢(Š0"A$EQL`¸õÌŠ‰CŬè‰Êa@_wég}¹BËÃVçÏó!Œ>gœ®Ö°2kö÷¬„üÇK7ßÎ HcJ€Wк™‘‚à.:5—háµtHSø Æ 5<øëþVX·2óÈÕS|›o¾zì²»}ÛêÝËBRÓÇ8[˜5ùí×se"Æg“7¬9tÝÏþ¥÷üî‰L½.ëÛŠ@ÔBŸ-Küõ@qóÑîVÐ.pl§‹s¶õ¯Û—%z¾êÇh/ÿÞ-™Óñqúýh´kk°å?°Þë5_9o¥§ë€²©)çsƒöM§´5ôªŠÓöïÝk>dl¿¶Zœñó —ø;Y²…™Çtü¶Å† &„x{ëæŸr>fíé ¢ýÌZbyLtà@séþ˜VŸ®ïO>Mš&þº€Àëtt¼z9¾cí³¤‰W_Õ,Üsz±[;YW$»O†¡kÈÞu½®Ú{"­`Ϊ ¾Ó·:v*?uêjî6É.çÎÅÌb @ûM;¦‹sÒ®fd‘š]R.Ò¬àhRâÙ´ì‘Ën ¶Ä"ŒÚ›´n&7 ‰´ôMLŒêò9µ665hB`VÐÊs·sI{.d”ÏÞs$ÔR cì0Õ¡‹fê…Å4 qÇ„sÇ\[–OI<}ûÍÐ…ûcCbŒ›tôÙ3—{sëè±ÔÞ36®ðîkb(f,Œvóö&FºH±FÆCBo&ßÝLH8˜Q¢éÒ8 ÀØÌgñÅݳ˞\;~9½‹ïÊ”eÃ0Æ‚&Ý;›ÒŸzŸ¸ÿµ×ÌâýC´’®]ûN­õF/‚êØÑDO›’èó§<þcãñͯh6zs¸î’î—âÁ6ú¤ñêXîJF†­–÷$Ëë¼Mî56!ùô‘îÍÅõ?„¾DÔMQmþ‹•v¹|ŒP]uŒÕ]oVéBmŠÔòCª]’þÒ5(W%\µ}•Ñ¡ú¹Áˆ}2/u׆Yü÷Æ+SߘŸ}!RãÏàkO¯®\ʔ޽™þäÊžƒÎÃ×âê#ô—äýª»Ô_5Võ !»þ:"TcDÂ×»øJmåùÿú5«Ñ>PÃÑ© ¯øÁËQãÆŸæ€g7ÿU£‘¾ß°2šëÐoß¡UzÊ[³@¤«ÛT@üßx×Eš::M„ÿMË¢×´3ÿ©ñø/‹w£¼{ª(:uzË÷b©>Ÿx„ÏnxðàÁãÿº2¥ÄöþGvuùˆÿþhS¤þ‹/•­%@è_üN½ÏFÍùRHucC䧆êR1Ò7RþÍW!øZ×õt¡/›Ëx4 â;¡ãMÒ|Ëþ.#ƒ^JþG¦>uû0 Ÿxîïÿ û„‘Iïk¯+Ô˳’M-Ÿä×þ¡r'»YÙxV³ÿ†ø“Ëûw‘Ò°>ÇÑÝÁÑ~ÔÄJºAB°¯çxâÔR†©Ú8Ð{>M¿_:ÊÁÑ%0|͇*[EP‘½qþWg߉óïÈ\K!”~|ÛØá®ÎΞs6¢B€bLr÷Œø !„0F2ŽlòîáììþsVÂ+§¹ÎÝû|×üñvAëBqçv.õvsqvò˜±bwRØ|郎åéì4t̶“”Ž¢‰üg炽]]]†F¸)ï¹à¾«»gzv~âÊ©.ÎÎ#ƆÝøÈ!„àã•!.#îeW"„€+Ú8;ÐÉÉ5hÎæüZå.øÊþh¿á®.®®Š~Q©^¸Àʹ›¼îFËyþÖ®n©¸ë+':Lþ™SÑ0BŠ®ø!ÀÙÅÅ}ÄØm'îËGý¾ÍÏeÆY@!üüôv¿a®nCý“•‰ÈºÃuæÐ4/÷y{ø˜pø±áúÍ“dÏüÖ¦œ\5 pmLûL™»ªc ÏN[|Îx€1öYù£Ì1J¯‡‡^K‚·oð½MáãçId¾QJï™4}Õ¨¥Ïû¹ÙFË„ òÝ–!n®.ÃFMLº•}º•ìæ9ìIƒZìí¾vÁ áØ1C¼×^“¹Ŧ¤öq›êØN€1Ú&ž¸èg®ßY;Í!x1¸yw¯’OB¼ñóûQ¦Í2Žï*6õ^6Õ€=¿6tBô©‹WG-4.¹ì0<샜m¢/Òëç³neG}w7ö8Ž\dèfÜÄa¾s°Àf]©m³<ÌOøVÜBß9ûìç¬YÑWôÔÍ}â³J®Î}c÷Ëj£§B# „›9q¸ß3ÝAsEŒ¶„¸:]}]†}xñ¸ð_3F…/[µrŽî˃cÑ5ïhjÚF_öb^ˆ™´6Õkڼȕ‹‡´ÎöþÃ[Œ”c2Ní*4ñZ6Í@êy6Êü¥+WÌm[xÎÕwE BI’ŽYüz\ø¢E3¼ÓbB'o¾%ã5DÅèf-ýiŠÛÍuÓ—\)E€Dåe«æ¬ëØØm^ÊçO(ªÅÀÑ,‡ÍŸïíyµÖtiTÔDÇ–+×ÆkP²uDc–œÌšµ4rù’Áú™#]ÇäÖ²ê^7L沈!ñq]4•59¤Ó¶c׆HmùJ2½†N)ï~™°ý е•Õ4|º¿3xI²uà¼Èˆ%I³w¦ÕétH¿cgÓv-àÝé˨w_ãš7){vlÛ±ûBúEÆCC Ò“ùR®,-,iÞµ;T?GO3}¹ïÏÛ{'?æ}lz@ƒö¦Æíê0”W}~SNˆH€¶¡±©q[…—”泭/@ˆç7ß…2…1Æ Cœ¼&,£9Ìa,-y3ÌÞrË¥|ù³êLw[ë—^a,‰çâ·*QV¼Î¿×ÐÈu-Dÿè>êÇdã_y8 ›^ÎbŽÃ,]äÒkþÁ÷òJÒB7Û{Ó0ÆøùÆnÝíOË¥æÒ Ó» ž_ƒñË­c{úD(¤çÊMSƒ·\~Æ|H³·’^ªˆðupÛ#>« ê^¦ß{’‹1fYNZýa”U·­¥㈩Î×H9ÌqÇÒ/Ýyñ¾ sËrEOÎÙZ¼ñ‘«ýüÄÙ¶oBZ™¬­ç©{CfFb|5v”Õ ¿lF.o ³u¿ÈaŒKî²²^söyç¯{pÿ£ çœë3ÐáöÛŠ’Œãƒll¯½®–=šeiëù$¯cÉö}ƒ÷ÜVÐ.y—ù^ʪf:昽a#Æ.܇1~—°ØÊW]™RÓCŠ3¯Ø÷·ù=Wþoeiþçâ*ŒñùuîƒcŒÆ›ÛÍOUh(Õ œz¨)Ss©s½ƒÆ°vžñó‚ƒí­ú.ÿía}vayôùÈa}‡­,¯O \<ËÛµo_‹¶>ÇŸ—©eãU×ažFwïn¨X·‡Qî=Go¬{øñ¬^ÖsË1Nko&×㊮lîmï›SAc%½•|ô·±;ïG÷1ÓWEEø¹:ô4éU VS¦8Œ1óçP³>>òÒ?À·?™âÃPU’YUCdeÛ‘É€€6Áèñû€J?x—ñ‹;ÝÞ›Æa@‹Åì=)ŒŽØi€ØªWyÅ„èÝÙ;8@ˆ0äë¯ú`NËÀ\GÞœ†®bjh€KieÆÝ eæ@ÀZ3w쀜ûI‹]K.ºÇ)¨ÕEìÝìŸÞ­•ŽPp“W¢WmX‘UC³€¹b†¢kh!`º©¡•@v¿‘¦¦-6.›·äuž”á0#å0bh(«|S[CuèÜTv[¡«}ÐN{YÛ,6t7È‚Â ‘¶Ur@¨s‹æ Û9µÄˆã$l$BäæBH£Uk @º˜·g蛲=Þgîø„ð¹#S{ vò5rx{“v _ùXªŸïÙò¤ÝÉ+ ôÞÆ€šõî£ÏDŒnfiíí3Òµ'•XÓPšö ÌL@~BìO‹;%* àZç¾Â›.^èÙÀ§+K<Šö™Ü¢Kfûì‘û¶J>±P»Îe iÏÙR–wñà¶_fNlØΠޛª¡€ÃjÙ´ PsæfUóVïãvÆÒ ¤­Êû*Á*<ŒpÛ•.õïKÁ±Ô{ím[j‘X)BÆ4&8’°?äCÀ¬Oã}Æ쎻¸öõ wЯxú² µx©åû9™Â„HSáe'á0ÅTËPPXÕgØ0Kã–ªõ%µ¬@()“W*.jmÖßuˆ…@fJiÉ)Æ qu‰¼RQyg×Afêl"õwWÒXH’Šb¹Ìr4JR!o'¿ ÆÊÇËÌ@G͵nò踇<+bãæ-ׯhE1uÂ!iʪ±5¹<ÇÞ¨ì¾øçM›·¬žD „XV‚ d‰ÅUNA@ $”é¬Ë!‹NUï«XOMÓ(’Œ(².FëAa§×;›·}™šäÑ×"$ê@ «ãªæõ´);=ƒÝŠÞ¿ÿþïK@Rý0ý^né#ñ`JýÙ««¦ûyqË-m|?)UzNWJ¦¨~qà Œ0Ð Û™öl"×a ¬Ç´ç·ßˇ…«ßGŒ²>Q6àhêîN:$Æ r‘ÀÀ¨}×^ÂÖì±Ð)ß}à/|4”X~2ÍUÑ d%EòW¨°ŠÑ6ÒEÕÚ­gǂߎd”ß»õG¿ S(µL뤶˜`Úö,Í4ZÚ·ÖyþùmcýQbM²ª¸†g"ß™ß\5JÂJ›€ù£M ‡"¤Jµ ŒšÖÐ3ºéÊ÷eŽkäöÕF[Piæ;7Ì\– ®)õϳ§y:¿Dæéj+ËhRK»IKj<'/p0ÄÊ$Õg‹@ìók÷òýNlpë --‘Heeþ£¬bX¸bµ> 9yw`NS«5EVærHa„8º¶²FªÝ´é¿žLm­¦—UÖcŒPñ»|Ba å8V¿ó€ÐYò.Ø:ÿ|6`„oû&²§LîÛ7D“÷{×Éd!̱‡#æÍšu2ÈFÍŽ9Sv#‚íFœÞ#h7ÑydFЊm³–”¤´F© È&B’)+„Øw¿lØÍ&tÚ™¶iœøí„ì3>Ø;g̼à bDÐàÏ™7žî3Ú½™üðËθþ¦!@ˆ ´³¼w~Û³*@Õf]KÍùÔÇb0.}ûÇ­‡/d¼Îy_¬Ñ¹‹6ÏD¾#醡%´,Ð.êîØ1gBØ–Ž‡»ˆ²ß~êh3iP=)+•JN¶yxÿ°âÖ‹C;w6nûê…FgϘ 3À0R)ÍÊšBH¹~ÑäÑý‡üÞ­öûÌ,ƒ>¶†aV"•*$=fDNÏÚ4iÀý¶U¹í{ûNõì$$Ä…MøiÕ¹¸.-ˆ¬ìžNÓ{¶k@ŸX²ËhÖ£Ú{sÜ6ß&Ø̼$/×~ö¯N)“O.Ù´ÅaÄÒ´Œ$ MZY ¶2Ý2qÈeSãì%ÓWþò."de¨_iü¡ø˜©s7÷=»»9ίÕ6[“´^€c¥ºÞÇŽ¥¥RZŸO"•°õ©9‰DÊf%R)‡hc½Á¿ç¢¥£Ïï4ѬÉâm_sû1Fs¦˜OŸ?ü€NCmô&§ çˆ±m4Ø‹Ñó Üåni ¢µJ$R©DÂI¾³hvN?Ž®%”¤…¶½¼:6 ó±µkÛ¾Sò>—i5mÛ>mŽ‘?`‹{a^ƒìÛ·Ñ+…î#ü;~.ÁسKglÑ x²'ƒîÂ5Ëg.[5èÜ:Š.µî¶uýt  àôÉ´rœmoºnµŒøï[3muÄì°è}=Íã[ꢂ*²G_ÿùSmðã=QSÓµž‰70ÖJ躴¦M,çÌÿiëx«}íL¹Âw%bãE›] ™Èeâ辰.&ƒZ:ÃZáÖG'Í :6hkÚjwŒyȺ™oƒ¦ØX6i¡SPŠÍ‡. Ú€{¸kùO ŸŠ IÆá7”¥‡ð7ÝÿÁAõ·¾3EKk1 …‚ºà2ËÐ4ƒ! …ÂÀH¤,! IyÜŽ¥išÃ€A …#•°@R”¬)@8–¡c@!Ê’Ù!àè)'‰ä2+­¥A,¦Ž¦i–Ã$%(Bº° Í0l’$ "ʼn1–ÓCHJH²Œ”f8%F¢ŒlFJ3ƒ€¤„$b¤R†Ã$%& Pt$)$À2šˆž* -a±€¢H„¹Z‰TH‰äWØ1S+a)E`®VJË˱b „€ C‰(!ÌÐ4ËrJc(Ͼ=õ:f¥ú…ÒR‹(J!U/˜¾fÍ/kÕœt0ÇÒ4Ãa ÊÄÓ“bJ€9†¡") qRšˆ(f¤H1EÊâä° C3,B!IÈŽ¾¨zÞ5IDAT¥µ5¿jD(!‰âš–/ŠÒâBùòÉsíÞI©©×]#Åb1UHI±Ö2²IRË¢±´„f±P$( y´DÂB‘P ×ß1GKicD„BRÑuiDHÄò]1ÀtìXkæS“æä™Èw$Ý)±²Ñ)(÷‹€‰H¥! DuZ©º:r»@ƒ¦d ¢PCiïCJCP×0!¤DBU;0H¡€6 InöD©Ð# )y·õ£“‘­4U‚tj´“BEeDˆÅÊ Å2B@¬Y He õå€H!E6_ñòüûA‘êóD • »å7v|nf¡²Y£/®…@(ª'…Šêº$êËIJÑ|c“,;|¢Äâ/êùÊÍ*Pu/þOª°¡D¡²èòMm­ëŒI¡H ú@(«œ;!‚©e*ïÄejZ 0 Ê¬› /¹Uk†ÿAþ·¤ÿßQgÜüʧñwê|©²øÖ_”æ#\òóh§’±Ç7xñoÏnxðø†œ‡«-ÿ\"iݺ¥xцg7 greater than < less than = equal != not equal >= greater than or equal <= less than or equal Format :: stream_size:, , ; Example of the stream-size keyword in a rule: suricata-3.2.1/doc/userguide/rules/intro/0000755000000000000000000000000013051004444015320 500000000000000suricata-3.2.1/doc/userguide/rules/intro/Source.png0000644000000000000000000011615013051004444017212 00000000000000‰PNG  IHDRz‘B6ä2sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ·àY IDATxÚì}g\T;óðdûÒi¢‚iV@)RD@zQ‘VDÅÞ{ï^{ï¨X/**6ì½b…¥wX`ûž¼v,ÿ{Ÿç¹ïÝùña9'ÉI&“ÉÌ$3ƒ0Æ (@?(P€ `7 P€ìF P€ìF P€‚Ý(@ P°(@ P°(@ v£(@ »©»ø?t!Pe9½’ünx‚¥}oÞqŒ›>mZ·ÕñÊÕ¼îÿ cÿ—‡9ü³ÝþqÿqËmà–žcÙùmü£þUó¿ÐÙv›Îc‹µñ¯ñ¯¢¿œLê‘÷ÛCk M?Ãn~½¶«ÃŒÐ_2B$ÿ6†D\˜èˆ ZÊÐÅX|@–w„àI!Hzˆh"@J F í2GBÐc <΄|O„!ØžÝPw˜: Jm!8ë.- ûç| ä£ÁËU€ M x8 ‚U/¡ô™œ¦”¡ê¹œçÁ6üEo…V~8HX²~F„••µµµM`Ì’rž!t<1¦¿u#°ê×ër¦ ìÙ)³þ_$%7„žî›ÛËm"¯æS_ «Æ5¬û[Ø]¬DDÅÕš¼²ºý3Bhݸ¬­mlllll¬­m\üG^~WŒBÝ9œÐ×Ú=S„ê€ RVX[‚ê0†åog=vB×-€9žÎqÉ/ÐO` 8ôë½æìëºÂãç½2Ù¡ïîf}šŒe`ôv”ŸÖ³ß€&Ï-ú8Üåþ=“ˆä¶±~_*úËÉ¡ïΆýŸhé„äb„ñO—¦ógm],D£ý6{lµ4õ]KH¦üÜ÷ÉT YüÉcÕ—^¢¯úuÁB ^„ÂÛxs:þdª”SÔ €LxÀ´2tkŸ3ÀJìÄn;=&^€l8W@•´IÐïú: ¬|€^ˈ’4X=§Á»õ€€L)Ù“Áƪa[hÓ¨j`cPñ>V€–ôè @'Æß.· @cÜòœ9ÜM)dÿñ¡Ï>ØOAk<¿–±—D&ur =•Å7°+ƒJ!=,6íü6À¸f¯»¶üò†2ʸ{ ¨ÔÊöCÆ|8HŸ4&@%±ÊñëWt©â†=Ê2™l<{ïD¾€ýõfp´_ñš£­;!™A®Ž œŸzv¹„ ©1‰æù °5üv(µ(Î]$»™B!“~’b•¦|ré|oßKÆd)eQ(TÉŽbÊŒÓ÷½4ù²ë¨¤Ç÷ÓDy¾nÁk’ïi Dÿ;¦cÀüqîÁÑû¯˜jQ~s!¶ªªJ*$PÑVS×U2…l=mÓ:¿Þ¢aÆ™Øqâ:J'–»[—Nº¾Êµ PhŒ_T¦0€g§Ö‡‡…NY²›É€ž4ëàç}ñ1¡+2!¨e­ž:uñ–ªº sÇ¢°c÷ Ž­˜:crÉêvüˆÝßð¶éãæ]x ™7FE„Œš¸à-@ðj¯_Ü¡ªïicCGDŒ™ö¬¼‰hS¯˜~p$\f©`¬¯D­Ó ôXw°¾ä·tpw1y)•}z9ÿO¨¸¸@º5n#f ÜÏ€Œº¿N? Thð~+ÖËV²Ð2î74õçPê.ý½+Àc:ÜÏ€à­ÓD+ùœvpBDXhèè-gŸI?=:iÖÁïO® Š™¹ª„ùÏ„NI¨g(¢·û½G®¶°…•¾»ÜßÉkΦÓ- Àß^~RÒ‡B¥ÈŒþã¶%-GÈ©$ÂÛŒ\cÅ»7nO&Bhæ¸y6³¶út&cD’”¡R™0!­H©“ELºlS ª”,I‰Æd2™ C·§×K­}g_`‘¡ep‡ükëŸqš­4Œ1lsÌqüh³‹Sà·–"÷Þqá¢]rW2I–í0“N’ô “ÉÀt¦dŒL2j´ª¸y/M‰ ›µl§P¢îgòŸzˆ[ð0&2(|dìl!¼Ü³(rÅ™úŠe7â&'dæ®äŶ”CÚÀ®ÄÈã…G–N Xsü)€xë‚èÁ#¤gJ7¶ò—ñqãBBB¦/ÙV"’Nô»K;FF„NJØ%¬z:báù13ç/š÷nßôE'€Wüèt|V{·õ7XÃÓÐyÚ[¨L¿z¡LªÉØ•Úɺµ…EËÌënòv{­Üæ¶c&Ç?üÎnf èjj\½rÉþ2>¨tÊA6L²”4o!„‘Ò’“Çßî³oÙ˜ ðˆe‹1F?’³”i?eø\"Vo§*AˆˆPÚ|xáɸ¶72šBPqá[a¸m÷#†¤_¾(ø½ žW¶`)=}ÛÞ¼æV>ºòïØÙçóà‘>1 íÔß:ùÎá Ruö“£‰G¾Ï_µyî8»#ÜÊxDß÷oG¶¼âKXƒpõʶÎ2kU¸{þñÁ ó%âVEEѾ+ ƒf¯MÙ<|’õè…›âwNÿ„‡DµyNîãû ‹^¼8ÁC?wÐX@¨äÉæÑ ÆL[íÓiRô‚梁T×ïd É`žx|EÀ;éÖ|³ºÅÇ`þßm‹-ñ!|ióñ¾SwXš™öu˜i×Cˆ ‰IÑ9ĺW7—Û6ô7w„awCçà©E…g¿TJôÜÞŽžNfõô»ÍÞ0£àÄêÒ1”u h:úÚ©¡ÇÎGÌ_kÑËÌÊ%póÜ Õ|"!^5sÒÜàŽzíz;˜Ò¸g2ËeÖ¶d¦Es’`µ7t6‡=7š6¤7> ꪙ èoÞˆEôðx•T2€J LÞpõ)¸ ÚÆÈX ºº 9Õ?Ø05Àü¾Pqnæ7Cð£†v´Û¸C?¹÷v²Šº~íŒU³îF=§¸š¤?z#YuÊ*=í{êê¶9ÚŽõä­ôgî°;á B@œöæÓ0gùdÐÛx‡OÏx~w¬›á‘ù®‘‹¹2{Æ°vçA}ö½è¸5_L\ºiW–3¤o×w[È€Éàx‰ ¦¨›o°ó›õ«¦Ð[SÔê˜9“ã$Ó”yûl´JÙ—ç—/œ?þüù”³¬™µ÷ƒ 1Ħž=+úF׌ß|W‡ àü‚ íHS*­gˆýñºÛÕ¿gMåƒVRRÔÎù“›ðK*Ú™7ô¸¯ÙΫß~FÁÔž§ïÜ‹r5ïÞÝpHèT¨¸WÍ'!~Ê”Y!Ûéö´ò¤Ð„ùµPè5%}†VÜåPFöÖj·àR¹jDÕ:¾Lôµõ¶2ì¨olÞ‹L5ˆ·ìÞ±½©×`½‚;™ â•óhª&½-ŒŒ]Ǭx”²¾¸ú@÷©»ÍÍÌ,Ýb=m»&9MIœãÝcLgБD¢©4Ó‡ËL’ù€ į«p-ÙnدsiV}µ0`Ø__|²\Š±$“úôsM³³Ù¢ <̪kÖ‘V;c 9c5#:5¿šZÊÍ?‘“UÄèB—|Â. p ˆ5Mô¥m’LÔáeúÉl]]ý@ˆáâJˆ;ìåZeÒ—ÞÁ Í @8|$:© @1»Ñ—Å¥m•¤I æõ€ÄEðNJ"£áÊ”Få;›IdžéäÙ³Et–kƒ«ÜõmüNì¤Ë‹ ‡îϚȫsÄÿ.jÛV™.¬*¥[Hš èô”b‹NEX(°ôŸQ8&‰Ãi_ö}VtêL‘ÝŽ¾¿|”S#D˜ÐÔ73í¢U/suìfldhðüI‰¸1G¢ê˜Ä¯ÛûöÌØ“"œsc¨Í™”Wˆ®®ãO$ŽmnËðdÊÎ/n ­>zuKú‘eAÈUJž¡ÚÜ°ˆW”õðŸT•õðUEŸëOÒ´I²Œƒ4n÷‘S6ž÷Fd6Ø÷xsÖ½² xûü9¨ÝYß»ãts™²ÏnÜö{'Êt–½~îFÿEK&ƈ*NY?ùÐÝ}M!B@’tŠPë¤%Y0‘Ä€0¯aÇ’“ÆX=ÙE7›¤ÁhظD5l>Þ‘ Y<„X¥m{ Æh†:RY‘FF„PÈÐ4êÖs‚«)£«mÀ°¡ÞCT€ûŒE¶°Ð’,ä^V†Ây…éæ#!-9ºÚ£ÇÿÑzÛ»!ÑÈ_(z~5¯¡Y$]lJ4O(ª#\+&MjJ#D|i_ÆT’|ŠN§¹,Eš´y_T§rÔòI“!¹ðþ0ÍÀÇ Ò»Áºv€`Ãð€„`Y·z/€ɯ¾  ðq?”oƒ¶0B°~€‡%ðER¬ÍÙ‰v¹ X7S>Bf‚á¿bÙ kÁ¿Ç^7!`8}ú×­ ¢ £B…ÃÎ]1€[bÆ}nQïPéÒÏ‘(ÛŸÉSY>skÜß9z0­¸¨ë$Ó.Z ¬ýüúÞüiñÕ]B¦,yd,KCb^u騫ÔÖrÚtqZ4&(×Û)ãc!U:ÅÍÎJ0F›1œâ¹"1Ñ%Ú»ÿú‹v3}L~ˆ®¨Òšëª¸ÃÀaI“¼11'ÛÕ5èS!G»½R#®„ô¶D ž±å€j Ÿ|ÃtâÊþµW0HDù租1tÿM›,)fý6§aÓ¿¾$³W @o.,þà¼çNRÜ‚>O2®Í¶wo>‰õæ:ŸÈî =¯W­x´òÚŒ£KdçD3u^ΡuÝorТMA‹ ðãÃm[7{í=óøúnøBéѤˆ'ø¦!ârä ȉ2¥:ÐŒüèÂK‰||éR&…Jj2º!Òž‰$êŸ}— ÃÍÚJ8Uff†¤/•ÏÏq¨æZ̦‹‘À gfÄ|zýB€@ï2`ÖÍ<„€ZñôQ…„¹Ô>‛Q›†š5ß ï°|!ˆ…ðú%@GÓÜlëÀ£^PÈR—Ãìâ¡Þʬd ê4x΂±òö_>ð8À©ÿãþø.Æv4é°ãFãbàpešâüܵŒÚ¯¥L+7éºÝù ‹‚Z©Æœ¹Üó𒃇¾°ý, µÐȵ;:tèб¶U_nYØ»ÏØõxsÚãÔ '#šÐçþF‡€®tãLÙBa&£%A!ôåæö_ôÎ&ºÆlqbNìÓšŸ¸{‚Z_§@Qî´w¼Ñ”€™lÜ´šÑØVøÂîk™Qáþú4«‡>räÈ‘#G:mV¼pÍ+$÷C?º„ƒ0ÚõÛ5º}xØ1‰ô“aZ‚¯ebc ©”ôéÚ†aD'b\σó7\&:xj“eQHUV¡ \€~ˆX·èž”OÐÎØ:ië†Nï È&(ãÊɯüùŒ.رX$‰‰ŸŸ£_[<÷™›´mÌ䈜jeÏ´úuGqã‰ÆZ~KƒS<܇†¹4½wá Ù<Æ®½2€XD+ü4$8ÎÙ„zåzÆØ­ç)Rdª!'MŽKó›”0Ã.bÌÛtµ²—j;_µo?êdyb´ËM[7Ö Õ”ÞÎúju¢5žpbï¥TÀ›P2…£!°*¡5;䊛€]aUè©Hš Ã×bÐø^_ ƒ:\(/9m, ‡DÙ&»ñåÇëÜš½7~ñTeðiPÁõNS›ˆH£%ã=9žŽWSÎ%Îö¹Ÿ¼þBG’ünóXÄÆé7¿«ªwòÐ:Ù>º[r~,ï4«:/ÆßÙÞµS§6…ì´Á¿ º„¹šªŸ=GÊ}œ”Þp*ŠE®QK¢zUÍH^y3#@ƒã#ïÍœ’¾oIk$HçN ¤ÊÚ_TÝ7³É ºŽÜkxÂ%þä³ÁM^ý±v²íˆ *V€÷}ám´ñ†“ìHœbf윿˜˜}=ÙtBÊ.]ãðá´Ÿ¸0ÐkÔŽ¶<Ë…¸®Ã°m|àQ™¥Ã·Ûwf³Öš ´Ù:nÅŒš¯‚i0h1&ž&­X»4Xµ¥ïñ ]p`¡QÐnÈjTô¬IÕ—³ÑÝi?Üö¨ÊÚ{V¥œëgÕCçåÃt¾­ï@Ô&®]3"n|¥›Fq³»±˜/‘Uñ¡H×s–ë.L·hNв¨“À¤ÍûÚ©üÚùüc@ˆSYRVÍ#Ó•õÚRY…<ƒŽÚ|vA9_­½¶²”@ATZTŠi ]m -qû=qnj!]©®¦ZR&xUù¥lŠ²f; %~MEiE &SµtÛ1È€ßl0Ž+ysqan!FT-==©™®XZUÏ é , Ýö@%AE6” @¿ 0êHà{&ˆ)Э ºZU¥PZ †2´od ªoù Öô˜P[¹lèjT€¬LS¡[W¨É‡‚Úæ?0ì,ó+ «Úví:QûÛgcÐêj_YÍvWݺKUGn1äT‚š6´Ó3XT\TÄaUM]u%rq~¾˜¦Ú–Æ)«›Te :j#ŒóÃ\FKu5Pim7–ª?¨å"!¢¼¤ìËãS?[¯ í¢«£I¨./©äðWÃÊm´éâê th§ÝPà²rË4;è+KgF\“Û¦RwÁbN^Ay³…ÆèÐQ»ª¸OSÕUW®·æð+ kHõuÕeUÜ\ßAÕåE5|šR›vZmjJ Ê9D{]•¼AGm˜ÈÍË×ÖkO'“c ²ÍÇnq£jª¸|=7qL²å­£cH%y]KS€KróhÚzmèd(ÏÏFm 4ˆà×—V L¡)iéhR#„„5eE2CU·âŠITFæí­˜]˜WC×j¯ÁhBåQ ¡Û^Yªôàò<–X½£¶2ù‡ìï/†¤hûÄ#™¿W—x½¾‡Ó<âÇ9˜U†ÿ‹0Ú ÛÚ6ý›–ŒÿÛ A]öÕ–Ž¹bLM³Å¯¯¹ZŒÿÿ¢Uìÿó˜ºq¼×¸òzŽÅü27 «ç‚ßëiჵ!ñ’ß)+¢¼&­ýÏŒ‹5ð8ÕX þÍÊb»†û嘠τÿ` û.µ"2À÷£»CxyÛž»Ï`þ²ñj¹Ì4jM/û'Bˆ}AÄêwÍf m?rº½ å¿Ù·ÒËN®s(&^ûÆ5—@Dk{öÈLÛaã®\Úß^ ý*ýêô¶Ð›ÜßÚA…ÌSén¿zÝ4üWþ‚qýµ™ê;ý[뮎žÿÛ‹öŸ á?C>ÿh\µ®HþWyký×[ì¤Ìù®6Yaÿ1bù‹Ù üÚÉ *ÙM½Q0uu2ÁgWËê;ˆÎTbÒ©u§G€q-§V("ÁTbÐdy)!¬e× €ÂTQ¡S¤Æ< ªªØˆ¦ÜF©þÎ Á®¨"ÈŒ6jÌú38»BÌTW–=⪼ŠÞFƒ!k¢"ålž†ºTWñ¨êjŒòmâçJâFc§Ð*JŒî YM hMºçeøŒ]N¥“ ËËÙªêm©d$2’Ξì–wÊ{äæõIpY«†O»3ul/:@âì‘~_+ ŠrRm¥€D6‘¸sŠÔ-¹ÒÛÆ.¾VQQÖ/nó¦áæQWòÌuhŸj÷Ö º”¹°Ã-\²”èÉ×ÒÛ1H’ÊBzeN~ºÂVö~U±¿™‡_ê³Ñú2Ï ÒM†nyñðLmê×}¶ÏNüáb/û¹’•_ÆÎ.)ªärL|÷ÌÒŸù¾=ü®ÅŠH+)@-I7˜ÜÁöJê% ãq±óYøžqÝál%BZŽgÖY"__Y;;ltêˆÇ Q<7}ª…LNeîPÿ YzÛÖŽè+QµúÅž?›àçQQÏðžlžÓ.ìNò¸Yµ6•¤ Ñ‚mU‚gŸOß2ìW´SŒõ}x8 ÁóIÆ¢ÔT‘=dµå†’…Ù±Ü;ì¾`/wÎf Êð™ôR;¦Â¢H@îé…Œ“A›¹×ßï ­ž€}cáãÂKføI£Š`¬¤Þ1yéëË–Jô¬ú 2õ9¬ùWÅKG›Mì­µ.åYƒ­“Àb¾Z}åcú…håßênáÏkô¨"Ö¥ÿÌÃÏBÜׇü[Žçåè·NÆ9•ßJìá8Mêjˆàú´A.Ëî6W„ˆº°mÚ´Ád’ä¢÷ÕA_'+ÿ°1#<Ýæ•!ôaÏìËÅœÓëæ/?}OÁk øÝXŨþ:H9°…¡Ú›øîù×Κõl!PµÓ‘òþ‹¿à|{šBÓ15f ïÅSò¬f‰bŠ‘êáÅ>‹bâ+ÉôŽHtU–w.÷ƒa«ÖF˜c~…ÔŽˆÍ©§î¹|û¶eÕ™¸Ýoë’¶Nsíñµ£’€ÂêµE«Æ[6¹€¡&ùÄñãÇص5fÙésÈÄáSÿðM<“rtßé+7";¼=9ÙdÜj#Êð©‰óGØ)ìñ PÀo²Œ‹lmmmmmÚ9X °¾Qi²/y`¨ä"å¶Íy©Ð¨HÀ¶Ð˜èäš}¦¬h3ÄÚˆ}9íK]¼G@Zƒxwø¸üàƒß4MQ(ûç û`4}ÛÄÁ€Sþ¶–FÑ©ýúìÙ³gÏ_vèi“õ Y¦8ÍÇËþzò@PSø¨†fÔS“Ù¼F$²Q÷®2’ øGú-ò9X±lÜ›½«zM9J'5—ÆTâfÎR&IL5ÄB—>±]¶{T‹ %*E:,MYD°´¥üì׊A™  l¹r†ãܘñ.gwa &1“Û‰Mý2ν{ÃñðŸ‹WÕöŽ2Wƒô}‹ž*žÔª%Äm˜4H½tÂÄfÔÉ­Ñu-³<{ú]+ž:D§acÁóF¥,Y¸!\…ö«åèŒ;—;k¨å¬=VkÆYÑ”ô‹VlÚ®IŒ‹€ÔzcŒço½œyï >¯Ûâ*©-™dÖ]éøÓà×™N­®®% BÕåßéÔŽR% üÿvW øÚnøŽMØó²‡a›^P²Ÿ1Ì|a°ç¾ôO ÖIIJ/:¸q ÐéÔäýs Eˆ—ëyY…§Y€¼ÃûŸ¹N‰–1 q7¸¸?Ev}"ÀÞÓ—ë¿<¼íEžñ0D4¶’0T0Àš]kîm˜š’Œ¶†&d4÷Ð#@€@°l”ýÄ-Ï›fÀ3lŸˣ³& °61 ‚À€²îì[ý„:"Ö(=µ4×¼Q²qñ“È…@F¤âj®‚È €úÕÓª«˜ {`oã7¥âú'城š›©5”)ÿð§Y¿Ï« Œ Œ‰âw§„ûôígn9`ÐÜõ'*9Â:w8ñ½#I¶ýúZ:ú]y[„1~x¡‘ÛdYw8ãò[;õbî0£¾÷ªeœÊî02í9í·‰¯™§¡‰¹lèÉ°õ¸,½soÆ¥—Fùî‘4þ.eµ™C`-Æb>{ë¼Ñ6V¬í]7Ÿ{$yÛP’ÀXÄò6ë·þ­¨¹ƒcù§£æææ––––––ýÌ}Âã2¾WI߉j÷,ŽhÕ “÷Þkï Œ ‚(JßdeÞ×{ö!¬(ãVšùeÈÜ‘ãß$ ‚äøÝC³»'-Ü…©o¶q¥úßgÒ{Žq‹˜oeHÿ›–‹ÝæÒ¼³­ÒIëÈûÍŠ øße7¡Ïw¶YÚ8>e‹ëÍ'OXúE•\Ý+à°\{BhÉxÛŇ3忬ÌìeéT*þ±)!b«wïàC¬VRÓKlÝ€SºiA´ÍǘEÛŠ¸òØBU_oöäÇÃx‚»ãòkïeŒG89ÒÚmõ„ TúùÞäkk[§)I{+2IiÊ9Ùß¼Ïó|úm†ƒPÕÝ Ã‰ŒÎr°^󤘵k‘-ZˆÄì¤Ñ^666®Líá¶ö?d € ‘P$nQ4æWX[[(ç7¶¡²?Çõ¾!´x¬õ’£_šw!”±{˜Gì…_GK&üçŸÊn‰F&¦ûMâ×oùˆD¡P@ÓmÓí½#ZªG&·œø]­ÛíëçÚþÜ]…B!#¨KMÿöÍ›7oÞºuóèÒÀµÑ~ûf#„BÅoÏ rõÿÞÞëÒõ´Û7/Vzéaïxâ F7\f…ŽHÚré<™BmÒCD–~+ûâÚÁ£Ö/?œž~ëfÚ¥¾egc+%Ì cs¦íø6¬§æ¶´—­'ÂhmïŸý´xË’¨Äã€I¯-¥½UIKMEC¹¥J…oo¦æÓnܺչ ƒJ!ýgˆ#xxñô ×Z& P¨òv2•L€Yÿœ9¼‹üªdŠ$lÀ¯‚<ãt *ý»±Gªý½Zÿ>vD›ŽÞ}àÅò›ùMv’ª‡ë£—ÝJ¶‚ÒÍñSCÃ"–îºÔLÒ/™xI&GJmnôä9’TAK¦…ÝùRqlå´¡ 7žl]Ah15=”γ¸×„}c}ÔU” µóv¯›æÉþð²ÉTÚÕÊvÖ*?Âo>ycí8P_•Î 3•”Çl8|̾ko›ŒõȆ©Goæ?/cÎÄQ¡¡!óVí«&êw4Ræåíáaf®*‘æÃ^ÖÝY"CBFnKy!éÆÂ’Äiã‚CF§¼¯¥5ög ÉÁ1#Îä>º1><4dìäù/ 8-­tÉ·.î^>fRÊÓœú‡çÿX5uñ×J` ÕYA‘1Üò‡cÃŽ$εòlÃpaÎð©ÉŠ·&L µ|·¸™;G¿ûuåä°²@\<>"(³T¤`7-3f!±ñ䪴ùYìFYßEìÜ/¬J@(?b°g…‰ÿü¹3´ÞnrŸtTvnÍzªíºÐ»{!ø_¾~—ˆæ…EKç,6ð›ºeC"¾¶j‰œŸWêSÓsÞÜJé¾2²‡TüB€1v ›;Þ§_cæUsjÏ]¯¸1?Tø­M»>º~ìൗuY}={™1ÉÒjW—/n?j9]×·wç¬Ô»yrõ)L`L?Ôu Ô;´öOv4ÃS_UÙ)áò‚@Ð2èÚ^½Ñ‰¡Š±Ã‚(oÄÔ\¾|y»º*•Eô\Í1~ñ’h¯NÎNKÚôè˜{öJ!Båw?Wrßþ€€óqï3¡WgR]Ây@¨t¼óà7m–$.Ö[àìPÀCå÷vw&2n~üüYí¿ïrœvQÏ;ÎÉL­Ç€€%S£€àźX=bôŸŸ0iX‰Þ~/…ÒXS‚ç[N^8-øòÂà•WKd{^œ÷µ¸J (x9hØ<—‘Sâ d>¶.a^¤ªÌW¸&sçÏ5¬º2wB¨ðõi§ Eîãf-‰Ÿ‘wdÆØ-W$.‹põd÷ ILœKººàÊ{AtΚêÏ­UŸ·a“›víl?Ç«‚Þ 'Æ÷›æítá£ägHGéK|v|n?{A¼)a§fyo¼žoY óñ’.ó–Äøvíê|¯É|7~Òùès‚Æ;½?¼ç‹$%æ'n¼gæ@‚œ`G·òþII‹·Ë±ó]+FP^Q¸ÍF“Йã]t¨õ;3ÿõçÀ”Ö5w²ŽãTÕI«Î^Z&'kí÷äƒ;¹„zn<Òöô#I”2zWÜÎËÛû#ZŠ‰184ÒÎÄmqá>Üó+ûòüò±&D…_îý Ø¿ÆJ‹Ë”Úª©7YÉ”Ü{ 0^Y—uª0 NØBÚòǦÉË&W˜YÚÚÛ9 k¯T}^óŒ~|“LÔofò•û(Yy>ýÚ-AÎ{“USPs5•†úrÑdPZ²²šõvþãÄu2MâFO¥“cð›¿ßf$3U :h!½K—.üéã‚»>¦™<õĨ‡¡k¯3g.ßpðù3-'}?³sÐÌy7ãÏ cìË_¼dvo à4%Ñ |OÞõ¼½ÇÓ îÐÃp–ÅÁ©/Y6ßX4}z›ÒŒ—_ÁSÔ¶ÊÔ’6Ú;èbL$¹¬Ó®b06öÖ[yé·@Àú NFj½b&¸l;¹Ü6™êÚÊ"±²FϾ}õè`düÇ 1ÇÌTí6-À cl6Åiwì{ œ”Ôwömçþ°üh‚¥ù¦‚ÉnŒ¯/?‘uŒr&cÜcÚÆ´k}š S[_j'ýöâÏé·ªUÌ ` = ÃÝÜÚmZB¬ÝFSR•Â ‘~+Ò€ÜÔô€A§ ù¢ÆSØ4¹þ7;W¤Õ¡mkâFCu‡ÀÉ“_v;íÚ•Kç†ØžL¾sÑX ÞÝ?Îh«]ùöùse+þÎݪ£¬Tê¿Ã}~«(Õ…ùÜŠªÛwj ›SKìaÐÓÒf³_´Ô“eNa–¦4«<0ÓÒ8ZXÐÓu@Öîâ=§óÃ̿P¦½­†ÂWw Í#ëq‚Þ}/§¾  ”x˜•”Ö𾎜îóp¢mŸ^ƶžCý<‡Ø66ãÀç[‡ýÖŸ×í¤Ç ’˪TìEb‰s¿…M‚w]í®üÌæ3­a2(ÚêL€µ‰fO§€¡C½=KÚ¤¶³n L:"„¸¿‘óL< @"‰ñ××å`\•Ï «“$Ĥ­¯ÖN*ÊYÊ u Fºêt<õ-¯vOŠücף؅f;¾Cý||íûvÎ/cQEìÀÀ@É T—æ“û|²)&ÓzªH& |YvóÌ,Ÿ©¹·6P»ŽÕd ”Ìò—”à ë„ €ÇKûÂöꬄH[×ÉÎå¿ü2×Ù ÆmÖO÷ó^°Ân©mM˜I£ð…©A¬a¡óE'u‹ñšqëÏuäŸ ÞJù©é€Ž©!¹pÇ¥"ðÑ©óvÄ+ÍͪôÐS—ál’1.*“HEUüS"¾–z;UÌaW‘”Õé$@tMG¯G¯Ê¶iwÞ{w>¸æLÛŽ}×­_/Qt;QN¸e5Ù©®UyËWÀ‡‹›–>è²|¹ïL&aâ÷mˆ4 UDëqÇ4* :Xö+KxÏ©Mç(ÍS" ì¢óú}qþÕÇ.ü!Ë€™4r[Kß«&5isîöãsÞÜNY¿eÉÊ“a÷FÖ5¸e/gm»˜|ÿ^@¢»q}-1! ψ„"™D•×Yú˜»Æ¬€ì—é›·lÙ°ÿÆÓ‹+åZ•HbßM§¦4îÌB Âú­DÄRZ´"Ó,ÀÆ€€/QÉ-æudèXí=}Ä•WŽì^ëo7ýìØÎtŠJ‡S§Ž7*Wû $1Æ6!ÞEkKaÊæuOÆÛDP¡£ŽžOÄyÉÛÆH €Ÿ´ÝÔï·úCôž$íºßdê˜wÍ~ö‘#Qج{ÛæßÞ#ÒcÌÚâ{a[_I,£I_›¦¦ÇÚX쯺.<Œ-Ië1{ñx¿•ÛnÈVTn¯IT•sê–N´wÇ´õ»K i£µÅïRÊÐ}˜3Ânñþ'2챦º’§®¡YýâÏT0=~ä $Ñýá#‡vMõ¿öçyy‡M†‹|¾˜m|¾@ò#(¯¨TRmžœ‹…BÑO°!#£¥YyUuÿ>È϶74P ¦²ýâ²~2†z?¸àVyßáz€dÎÛXuÿöè§î‹·.§U áÓƒ”[/Ë —£ÿþƒK¨/Ï–Kå0D¼jÓ† @°.]ÎgÔñJ|)³B"–}ùô@O³Oó#ÎÊï÷¤f@§¾ƒÖí]§óíþ{yÖ-!Ð<k¤mK“þ/Ƚýø3hjwáÖ°+Ä‘%ç}fä»"_ "êfºL8ìª|Ô“ÿÙç—½:[È·éÜ+'ÕÈêž#gMêôåõö&œÊ²\¾´soÜÍe‹›’ ªíȾ9›OÞÏ ¶ Ö§÷Áß\¾+¬³w^;ƒ/–sÉK(*®Ôþ”ñ ,Z¶ÐÖc>³G_ÙçªvÑS,|Ü]½ôîúôÉs·UG;ê*3éÌ)𫾺¨üUÝm’šø$žÍŠöñpq¡Ñ••IB6‡ÝiðôÉÃy“ê4­Yq§ÜÔ!Ômü¾1Ï}}Õ54I¼òª¡ó¬t•`ÍŽu·íÞ½‹ œÅ*¬jç¼ | î±¤ƒ½ú£7¨BX×=²Ïû-¯Å“{‘e%3#ÏI=d%µê¨Á6›žŽµdòJ_¸LON½¥ÍDàã—'úº6͇¸ÎßòkèŸ;ÃÚ·Ž ¦©×rÏ#>Ξƒß¦¥~j3dƒo/0q¹(n•uâE@Û!þ%ÄhºŽ–dØ©O8¯l=~¶ÍU7Wo§Ù¯½ªè‘ææ¢ ¥c½{tê¡!¾‘~ßlÊM€êz{®ü1‹ýnÍ¢qTqùèi æÊé5æ±Ã;ß<#µóJDÞ52ê¼½N͇ԧÕ;ÒG7g¿J ¥ ‹‚Ï%Û˜wV}x÷¶²_T/4ÏHxÎݵÎ%Ò#ò’}7Æí›7ûZï8ÀP¹³å¨Ž¥~.^v{=¸õ­kïc¼?ÔîÚࣧ'ö £öôo#'xŮݡäêâæå‘•qã5îssÇ ùöS)ëœûàýœÉ•™×ïfÎ;¹ ´i»£º»¶sR›ùàÞê±;öÐìÖ‘óðQ£VÌÕ±YLÀkx&†Ÿórö>ÄÞ<óNêñ€[>ÎÍÆVà3ØuòýÞºÔ5¿iÉUœÏ©ÈÍ/“ÍY\QÈÊ-(‹j ³ ØÒ°„¨¤0Åb•IC1”å”±ù’*ìœ쪆8"~6+WD`ŒqQANe­@òXPS˜SPÕ8ÜQ™Ÿ]À`Œ+Š +jd{Â+/Èb‰êò%cŒ«ÊŠsrrX9¹¥•5rÓ?Oô—”&©NÆDUYqN+'7¯¢š[ÿc,Ôä±X,VNni…$Qœ“UZÝ4$Ee1«°´öG>÷âVV%WŒ1 ¹999B±äCœh›^û>ËIñüíÖáqgJ›<òªsò 0Ƨ$+¯¼¾ÃåÅ,+¯°DH`L˜Àb!—ÅÊ©‘`‹ s²K+8’Ø U9yåõƒ—å³X¬Üü"¾XŠX.»<7‡Åb±ŠJ+¥ÅDܼVnA ÆXX[‘Ãbåä ÄXÈegg³*x¢œœ!*ÎÏÉfåTÔð¤8¬)Ê.¨ª#ÆXÈ©ÊÏe±X¬‚¢2I׸UùyÅuÓʯÌÊ)–ô˜à×HJ•±%q<Œ1!(ÌËa±rª¸âÊ’¼Ò*Ƹø]Zð,IìÒ‹%Ásei‘t\"¢¥4é’FËK Y,+'¯²–_O6UeE,+'· –/˜ÀbA6+W($…Ôfg³J¹R*#ÂÒÂ<‹•WP"¬£Òòâ\I?1Æ!<6Öåe±è_€þ ƒ$,,x`eáU‚1Aüôã×']Ƭ”ûölBÐC&°~6‡^+ÿhê‰ßxõ7P w°c ÿÛ§õ_ä¢ùéÊŠ°}5ÉËþëâ,ÿû5—1Û÷\Hé¡Ò<ïF)2oþŒT.„ô£PBOŽLX–\ÔT¹Q28l3úOõµ¥pKÿ6ø×°™)ÿo‡º’™L3Wj•$ð_?™ÂÍ~þ¶ó.Èñ/ÿŸæ¿Æ X&Úúk[þõ®4íÒß:ðÿF߈¢šS–1#6;nÁ¿I“rˆªîG}ÄÈÖHâï·6q³'2oqÊnàÿPvƒ„• Ã\XY}¯E£|ûí½‘ûλe—GûíÅ#þŸ7ò?ˆ"œŽàgÚY4Ò|Ñ¡ÏÿGòà×T‰šµœ¶ÆÙ%.ýo'< X,¬ds~‘^½÷5óYû»ªšøõZÂÚ*!n4ŒïöÙ¸ŒE¸f…Éëttñx ßoÕûþ~Ý5pî~„BÄ&w“€Ù! €Å¼«û—¹9XYXZzMHÿX(‘Ç*rïb²+»>¾,$Žâ3y’ÙTvNµõ çñq3×°ÿ¨8‹q’Ï 9çß”_Þ+`ŽÄ‘¸,5Ú1á>BoŒ&­½&`¨e—[…!q‚}×ñçÊ4†-”dÞ‹‹ð5ïgnië²`s2›GBß LΔH®vB¢_‡àÄ“ÿ”p‘-²›Âw·ÒKÕž%V³NÄÁ?Zº©|š:{â–ùûùeÕÊ Z\³yÑ$__ßÐ s>T*'¹yÞ©–¸ óGù]x] )·)ÄuÏ7 )‘?Þ:èï:~þW.`€ŠôEC§_b[0å@Æ›ÔÁ± €(~CÀÖ±CnÔ iÞ>Ë_4Z EǬ}PõvAL¸··÷è¸Ä¯œ¥Ó¢KÓ¼çß{uiËPo 1s¾p”¥ÍöKȸ²}Îè?¡fXöóóqëxEW||jD€K^Ïêíí;1~kM«’ð¢)A矔@ñC—q5¹©þ~~5"pÿäú@?ïਹk%Ô_=ÞÏùæ~óµÑ¤$Ær¾Î¼ÜmjJÑëó!þžÃ‚ÆßÉ#0® ZMÊtuK+¨ùœ61l˜Ïðµ'JZ¸wtÌÎ/÷&ùúx‡Ç$pNƺž*!/ ò™Ÿ^ð`ãÌ¡ •Jãa ŸT*: b¾8¾ý¸•±ï˜43ÏläùƒK;ªR"ë÷–v*¡Cun“L:Û¢‡_e¸¦¬›ÐÄÓ–.¤RèU$B€Å…¡þïK„?˜Íºþ\Ù³4ÀÏ;bÒ’l@ó)nB`×9Ï¿T št¾2JW¡bDÌ«ºTAXëªGÔuþŒAIç·&Žp¬?÷lÉÑK£{…¡5{ïõ¡ƒ¬‹+Ø2"#±,Øã½YÔÉ>ÿ$#”ü»"<Îók{íÝóóó…asðV& G:ôŸºÿn6‹õéÉ{K›{ùxÏtûéGs1ÆâÒÔ!A[Ó1Ƹ浥…OÆ¥Ž·ìµâ`ê÷¬¬‹[gõ÷ˆ"0.¾8¶_П³fÚðØÄc%%å¢j–£•Õõ§XÙYO.1r˜ ƘÏÎJJZÆæ‹1Ɖã&ûÂË}jmãôèÝçììï·÷L1õJÀ›h²:õ[Vö×ÌÞ6½Ž?.Á¸|’³UÌ7²Y¬ww´rzUŽksîÚõt7¿´‚×èèôÖF/ŸÙw¢ÚÛÖüäí7,Vö³ËÛ,‡r[8É+½2ÞfÐ=Wž–”–f_ná6V„1ûö$×ígnÉ.Ƹ)–îd Ä~Ú)C†-ÉÏ/ÄÕ÷úö;œþ.'''í`¢•{„·x@5ÜúPz>.½ßÛrÐèè5™Ÿ? Äøð‚‘¾“VþöíEÚáÞÜscΦį MªË)Y}¯ù׉ñýí]×¹URVþúÚÞŽþ|,.~¹Ý¢_XfQ)GŒsŸ¶±q~üþ++ëkbèðµ0Æ{í݃R_|---9=/ØiòŒ1§à•‹¥]ê×ürŽèý…½ËßÂb/ÂæóøÆ'–FÇ­¹\øè •KˆäÆÏױ΋$éqÄÛüú…aaŒ#ÜÌ÷Ý`É¢†h¸3Sägj~ Ÿž20bU¸Ù‹…|¡HŒ 1/À¢ŠUKrªD?œM‚À¢ü‚ã÷}ùöýáÙ =–7⊦V†1]½àð6Æ„XÀ‰ ,ñBŒ1;ûO[÷%BŒ1~cgìSŠqN=ãSË1A`LÛ™Þ.Ä‹–ºšNºP†1ñm[¨©û*±|¢øîfÔïRÞ3ÉgpÌü¿q³ã§Aþ­b©«Õ‘¨zzõ’<*¸›úFÕìÙ(; €ôõ]zLI½=ÆÞçrj2„Æ};¹ËyæÂëóNbË_¼R14T(ÖhÄFº©`Ü9fÒ¦í#ΗÁ@‰šEcª1Éteu-- ^Y¬¤ÛÙH_éÄ?÷â"šj§… çËÚ¸Õå"ºJ».Ý ˜`0vÓ“>ÎùVª1@·K'ƒä´‡d†RÁÝC”{>0@?Ò»×™‹W-¦¤­§©._¨®!¨ÚÝõõúú1ÏìGÒ[rÝ%€gìa¡„±VðHÝ$ÿ ¥0‘U´ˆaÊùw6ÁÒ…wíÇ ÖVg(*zz:·æ¹/w4Åw Ÿ¸~£÷Ù›%à߶øò[Öæ•#»i n]bwP»WrAGfŠåصG½ƒ­†Î’N‰J“Ò8 àsòVãq{êↀ¨ Û–¹Dšív^YŽ |üÄÖêeÔ’ñ‚D%OŠº·8`‰+àŸuºöÓDÊ-*ÒÔÔ„:dMõÌ¢"«þÙYÏD»Îù÷íDÏxÆç¯Ò -ƒ¤&“ŽŽÊ’’¦‘*çµ]ÌÐ4]h;ÕÃÌÙ?|ýÎãÅ|’#cêÆŽ3‡†4ö³u_r5A@ãwì\šmÚðÔøµwÞQHSPD­üâï'ÿÔ·/X, µ6)ˆ¬å¿:l€GÐÊ­‡X5ÐblP D{+%鑇zW5îë|À€‰v–L[Ø KÅ%²Õ|˜õí =4!©ôQ<ÊâýX¥µéA•|4«Œ­¬£MÆ­<½ÔÈͽ$Ь¤*)£…¯êÝT$ ™DB‹ Ù¶ªžeSßý.AèЀå|Ñ×ו€ÉZÆRLШ‹yp-[1)¶íÿv$ö}¥H^ %Ä©á5ˆ\GDµØôõƒýo¶:ð°µ̵…ÄArf³ïO ªªLÂPí¼½»0M±|“? z{råTÏv²Ñ0ñ™mÉ O•»§iª‘«‹«Z²!ƒ¦ó‹ëo$\üTÐ?)Tà/ü¡SiB‘ §µ|1“J=Ëþ‹ÞÔpîq•ã™ê§ IDATȾ«î›w¹©/Üö ¨;¨àÔ¡CÌ’TrO…IÞqK½ã––~}¾w×Ö¡Ãÿ¼wë¼8š´ yë‚æ­Ë{ÿ`÷[†œzð$uzgûݧ¯¨üÊñkâüX+S­èT¥N–)‡Ö6ªÊËl}tNcæ:™ËÎ}wpïöˆ€S×î_jÛò@–ÂðIéRvŒZÄEv¸mèOTo «æ# ÆO0ýçb%YÀJB<œÌ€²+¶IÉÖ¾ŽåÖKˆD•,òÛq>®±£öƒÿ«ÙST{l4»ó¨3¥YKTÝíîuÎÓ¬ ¨w~ÇXkðü_Ý áÓËôO9™¢üèЯá7ÍÈ}ÝðãÃ9»¸:½½‘–ßÁo›—)0vùbÒÚ+þ$¨»ÏZ0NÇ=J"ß‹…"0ó‹õjn×÷EÚ%C‡(õKÑ@«ãî ['—½Ü¼xì©íRŒôÐyùøÉ)ÀŽ Üâ®Ã¦ž½vGGIr—Pm£¹{ÅèsÉ}Í;«>ÌÈÐ Š1eÐ3sι9°è ,|ýàuÙ–N KÚzrø A¶ŽƒŠ_¤¿­êzÑÝ È팔ªbüÇ؆',Pb;vÿ3/c‰¬…ÉêÝ®ö<Ÿb`mfðéÅý*;O–ñbäëïoaß÷ùõËÝŽ2CP#C_Œ°¤®×³²`ÏĉߖmÞá|ÁÝc؇Áý:Þ¾”ÖÍ'ÉŒñ 8Æ°~áH·É!i',QÞóJÝÁÛú0ªBËŽ¨Å’¤> ¾àÖìër¾º}uÇ…Ž ·ÃwÖî Cƒ.Ùucܽ›a³Ù³Ef¬jªÄ›4Ê*`¶7kÝ¢Âþ÷·E·®âœÜ2Æ!b¯šG#IÔÍ:˜$3Áw‰¤¦¦Ä®®%”{¥^\­‚q“€Uöq[&æ…ž“~xUË! |}Öž{Ô§µµÙ$uÏ\ÿ(ï“}ûW}Š,Â&všÜ†ïѺ»m =Õ”À@äÙ¿$æ溲Í?;qÂvbFƒô!s·QÇocŸ]®*ä\eÜvúÔxÿ@çAITe2¿FD¦„¬<Я=@–,î|–xé4ySÚ¶¸ðÉÆX$äUTJ¼ÙU\¾Äš¨­®*//¯¬ªÕ¹ "AyyO,uèeW”×p¤á"»œÍòj+ꪋyìò*.Æÿ½§ ˆ#Yºz—@ˆûÝÅ…·Å=ÁI°(D ±‹ÞÅÝý"—‹ÛÅýâNˆ÷„·]–]Vg¦¾³À É}wß{÷¾GýI˜®êîê©î.E¤¥¾@(BDZ)– ø|~i™˜ãeh…@  ËËåR )…T(ðù|¡HL³á¾ - ù|¾@P*UP•¡ÒQŸÏ”–)Tب”ŠHF!âÕŸ£Î§*Q.)-)‘QÊËØEJºÎø½âK£-#÷))™€Ï”–±#b"~©„© ü«=K 2´PÀJi†AZY&,åóùebIý±‚eBTN#­(á—Òjö¹TÌv@®6¢ê¡ 5ßd¬MQŠKJË+ì>Ÿ/`ƒ¶ËE¥|¾@¦d‘©`¨\ʾ© KE²Šå")ˆUع@ (“*åâ2HR{P²ò2Q¹¬Ú0K¥bÖÈHJùBi%Q)—K€åx…}Š.-áK©ª\F)ã—ð%Êz2©£|^VÉÖÀÍ ^ÈÊEꋶ6‹k-0F,()“ÕeD|¾‚©´1)%Õø¨”ù|¾‚FD¦¼´DTÑœAD†‹„@P*”È•t©Ò~%†AF!á—ðeÔ†} þ;#Sûû,®;<·žï¿äÒhˈ½ÿ2Þ~{Ôrý#j†‘¸¹OUŸ¢â-7à¿17<"œ¸´£ç(BHÆ c«]ÙP»ÑŽQ:B±âo?`‰*)¯™Ç ͧ_^åù·Œè¿ Ñ¿}kc)B¥äoçf@½êº†’[¾ÿ¯¡üv}Éùÿýáëÿ \nÓ â¦ þŸÁ·ÂËJò…2†µågg åê',Ëû’/T²;5R²¢‚¼¬¬¬ìì\¾°ªÇ)DùÙÙÙ4ƒuÙ^Õ ådggeee«Ra—deeå ÔCñÕ¡\X’•“W¨`Øê‹Êì¬/YYY•·–æeee±ci?';+;'·L¢¬Ñɲ‚/Ù9y ¬4$ в/9ù€tvv¶‚FaQ~¡°œ‘‰²r þÌvªjþ÷d€¿9'ş‰rAfNÉ¿æôQÙ+…(?»°\Sÿ‘gæ–þÍLüýLýš’¢<4'v÷%MQHK¢x¼í¯Õ“é2»XFíHCD”¼ u¶vó ?éÇ¡ü\xŽsþøT¡ig+ûZ»ºð.g–}²Ì‹Ç[¸æ—=×> âÅõcí]¼GÄqwuŽXu«z°Ã0˜yf–ƒƒSTìèPžwÿIˆÈÐ%;¶mì¹êøcD¤\·vt›»f³PÎdž]hmçäéÈs&¬fPxyfÓ`/G·‰—˜ 3ÿÑ1÷ÓPÉ÷ððø(Pž6hÊ®²§lCFü m¥œÏã9¿/‘ýE}[ˆÛPáß­ÃÓŒS“¢šz±¾—ÿüf1Þ/¬S ò{I“N—‘$Í´ÛÌþ±¸Çû}ì²eŠ)9ÿ£ƒsÿàAƒí\CŠQY¸ù%>rغS•?Hs/Ù™;|©>ZiÖ;~Ÿ³uâ«„Š©Ïù-ûqfŸ3· ÏV ¥27»ûéâ*#ƒ JÜì.¿e{E­°s8—ýqåÈ°•Ç#â‡ë«ý¢×³/DðºVʾ´Äß%îSÝT–y‰ç]Ÿç)ÕòN‰íÏóŒ ôtöŠyT-s Y1.ÔÍÝô¨X'[—q;ߤüq”'¯odܨ!ì݃ÎdSÈ®ÙñΞ~ñ ñýÜìY _4y!¥•5cÊÏ^ÞênÈg£€¼Ú”à°Š»;†n8!X]É.x|ØËÕ%tÈÈ!ýý}C" d `öí@gïИW›ðs(ž-ÖÌžös"Ÿ|80ÀqøùüSc{ö[Îc‚¿EXÇìM“Þ™Ú¥ßBÈÙå“Óu™U?Í^µ8Ú&t#£züÞ+þD~m5À?ò2…¸p ïÐ˲ýÓBWÜ,©ÿ2Eå= p2÷ :{áòó‰Ïªm°LN˜…íÙBdg‡zÍ¿ôî+„”e^<ç7ÅRD<¶tÜy»+·­?&†n¹SmË¢K|xV/ ì¶øhwœWÀˆš§›«ýÿZÕF™³iÙâ“â#ãçÈjn{¢œ›ÎΣeì3a¢µÛDdd|Ï9…/Sß'F™›“#¯îj•ud´Ý€uì%íÒæ„°ñ[PQqºá?^83{¸RÜã9º•Êñö¢Ø§Ù¶‚—÷œÿ€XhÓç…ª´Œhǯ{D4bÁa+ËáDDf]xŸ±GrÙ!OˆpÙq#óÍ{Û­xÈÖ«Á‰‘®kN½Àì;VÖ~¯U÷WɾÖîæ²þxÙ¹ù ªãÄû»£Ü}b䈈(N\Ù“7²Hå÷–åêäp?¿œ~¾º‹×lDDí’ïU~|ühëî'3ÅiVÖŽ næ³OgE[/;‘QƒË7Ol9xéûÿß"yÃO|BÄÅC]fî~ÊRæî°çM Š®X÷Š "⇑Σ. Úô¹›‡È #øhg癡@Iâô•©®æ©ˆHç{9Ú¼.P"ƒX”li\‚šyÔÿ8¿Dœ·ó*£o€KŽquµ‘Ö£Øã´°?/ùÞ•KO^¼:´nÆ”ø²/ëËȸy¡ £Cp3€%óý-&íùÙ•®š¸&!¥¨9ÅPÚœª®êjƒRAÕ8„ vì0aâô)±’´;.+Ô©nlƤ?.›Yª;¹sŒLš6§Å¿É‘µþ¡Zð¨ŽA©,%µ„êÙTëýùÛ?8iH’P7Z­ZרBG>ðÆzÜ"úÛâ€òŠ@¬Æ6ã†2'6o,,+§•åÀ¥å4cé딕°i•™ÄÍÁÞÞÜ/¶+@÷vFK¦Íâåèä42>bP  $lJ|ÜÒùµè·¯RMg¸w€¢LZ»y¬½;f«Ví/¥g¤jgê·m"~•”ħmã¶ß¼ÌkÅÕ1hÓÊ€ß œÈ¶í§@.žÛ1  );º-t¹§ß—:6®à˜vã)SbŽúí\Ÿæ‰.WP,ƒ&€\ýaÎ-X¿qóF! ƒúBñè?òöÙë×\”*èB9e•=Y·Ò €èî½õ@@ U‹ÍmÍÛÞ¼óˆi÷ùõeÖ´¡j9ÒPHZø´7=pïíÊ°>Ïoßlgån¤6àŸg™"„€¾€««]ÙFÉT7VPÀÕÕªøöôœ|Ã&ý´à÷3מŸ]ððàOwSËÀù1ç±——————÷ô‹zå—¯¼©GÏ×&T M JeU©Ì²J˜–-L¯¯Ð­—¹¹yO·ë¡«O- ïúèÖ qÛßæ8jé´©|Ÿ«§»u˜ÃÞÔ^»§XcåN«Å°„ø©sVì›Ùmþà±2¦šìÔ1í²edï¡}y/ áJò[ç ?9±L‘„42àBµâ Ú³>fÉ[ö Ñ?ÄŸýÅØ~Ô­S«Hî‹M Æ÷êãuî­Wº=ܱÉí3{¢¼lcçí¦Õ=t¾³  ‹>¾‘bꮕfC§¶e™©¥S™,ÓP—+V(eJ9‘ŠÎ¿páÂ… þ ß÷êÔºq}72cû*Rƺ]'fP,ªºJÓ¥ŸÜíž—›ú‡GŒj®EU•ÍYÁUnÖ£}Ý{™›››wµ›¤ dE\Àš?Rì<ûEDE:5%H@y¹RG_·"mGÝ01ÊöÔ©ÛpcÛ^ë1s5Ú¡Áéó‚/®Ý/¸qú¤Oüh°Vý3@«®#MeR8:6ÍÈÕ›Ÿz7Qý¨(8—©âØ @¾oõÒÞCç[¶à²ü5èÜ×Èh _\E÷$ê{—Ø©ÍáéCþq)¤WdÕÙ¦n‡6;Ëïf¬û\Ñ/r«@Ò­…w̦S«Zó óxáñ„2¹¹W•î†–Éö%w\Ü·ÿì{ç—ò€ù<,ôçYGŽuÕG D»Uw.çÅ’ŠA¢à¿›´ÿÍÇɆP¾êèç5-ë‰5®üÌÔ<ö´¾çìy•n­ˆ¬´ ½HÚ£ƒ áÞ“Ø#nbÂ/Qù.+¥"½6VÓç[ÿáê ?úÝÛ!—2}‡Lì;„6}Ï¢.¼ôÛ- Ð^°'Åølú”mVªÇò²Lz$„¤óÅ~hÔܬ™Â Ù²å+XšR&×ÒÓ­æäVôjkp £PÅ ß”‚]ƒÊO7+å´ï¶rb"’Å/¯Ã[évvÃÞ¿VñwÆíGE3î/tj„„0' YULë¶fÒÌL91ÕùßI›wú^2S¿Igú<Ìê·ýSÛ›ýLëN„Óc‚µAŸ;É׎åX=²Ð¬â þ§$kø/:Ý"Ê~1wÉZJƒàþ¸cžøø„5§ŸÊä²rþ—9ã™öæc:ë褽9ö]¾H&•JËEgWÇ•Ùvkuv÷™Öþ¾Ô>јÉA©÷§ÔM¨êmS÷‘ž’«w&+äÒ÷§f¦ Úxôn­^N€Ì5dò®[JŠJ¹ºeÙÓÖ›ÇwÁê÷žï=é¬7œ Š.Þ)U*¤ey GÏÓµk¨„(·/šq;MN”²BmNg-øxèý÷¡æÚu¯QBíݱ½°œVT^PºoüóEË6ý½þлʃO6©/>ÑHÉJ3&܈bµiâЄu§i¥\®P~Éø¢Õ¢‹®8Ñ×>ðE‘L.—K‹rË8:í¸ ­Ï•–H6†Í¸•ù¿~Wniõ½1;^.G4oÚ¹BA•Lz—êikÛÜÅ»]æËYgSå ¹RšÓÏñàÝs÷¾)z¥™*ªTňˆò¢Õ¢íìcÆ/È(MvfÑŠñ‘ö¶¶¡#ædª¥V7„ûÙV¡â•ï[2ÎÙÞÎÉÙ{ÑŽ+”Ê\*uì²í¾E9·œGËÏþ²fŠ»“½ƒ“ó˜yÛ¤ƒˆE¯. ö²··÷ zé€íå¢8?++§“ïäÈ 2ÒQ<ÞôkY*Âù‰=äçßôåÙٹ︪2j‹ –Œ‹ttttõºø&u«p¦à½íaþ g«\rž‹ô·wp0znž„BDêY…ª™‡{f:88úôÿX¢xrhQïÞŽÇ?d˜[¹~©˜‰% .³w<­æúúB »ÏÍçíLZøÊ“gŸpè)"ÞØ3ßÅΖçÝÿâ•Â¶©áVÖŽ[ËÞïëo÷kÒ?øµ{óµOlvùí)ý×±ïßÝ>ÞÆÎñÇYˆˆ²d·n–W‹*¼¾jñ¨þ1~7•Þ u„$3õ¸cÔƒ¬wŒÚ-«‹ækÞ5ü04ˆ›k«ünªr9¬íÊxzÑØÓ9¬eê†3o”ŒÑì½Â05 / öKklwõæuŒ‰a4úŒÔÀCKsÝœìóÊ)UóüÄöáå_÷»aª±¸ 'S½‡øL?[Ê›z£Õ«yÕž®¯Æ¾3š†5¸P÷û ƒ9'f;Ùø§xÔÿ&¿M5'kejøªÔõ:!ZÕ|³Bn^»õ*Gź©TþŽŒøÚ•«Ârö—¦­{ä§ÿqðìe Åh$N:&·†ŒG×ÌYÍôðÓ®6 D3-B)Ïy[¿7üšÆ]só:ÆDHí)!êx”ÅGvm‹Š²HØÝÒ€‹@ê¦K4Uüx÷†ùý][úóH•rçÛxÔÿ×À]°`Á?´k„èé‚B"ÖmÙû»&ÿ Œ$ùÁ“vÝ-¬--Ú454hÖÙù‡Fy…ü®={ër5/úæ­š€œw©ö.Kf†é~[¬0!œv­ÿ«•(yõ2ݪßð‰ÁæUz_ÂÑ7inÙ»÷ÿ†¦,ï}‰~ç)c™êqÿ±QÔŒ4÷}ÆÍ^áØÞ°’ÿ5@/¥!"¼ þ­–©oÓ1«Û‚ÿé ñoë(þŒÿÊœÿÅæÿ.ÆÕæ "Ö¶‚kÖñ´V¬íÔšÀ†}ú_(n!׶ϰéÝkÜÖÿøäD„äßú¾O@yEYÒ”ï½V’ÿ€‘¡½wßÌý=E@ZYZ&a›³Ùv9ýï(%ª ü}P… )HêéEa”âßæŽr°³qò:xû«“BZz`éxG;×¾o|(!D%ÊÒ“bÝ­¬íã—ì•![¨³“Eø:ÛÙ: š¼¦P^)­˜—ÇöìhûPB*…ÿÝ¥þ.VV¶Q–çËÕä"!äÈâh§#ÒžýŸ‰Í‚¼dçö ³Î½Ù<¶ëWû¿y3e•…\}½út›\]=íή^φ»óÔ£¡n­þ.ü”#·±êêékk‘zøügXŘ˜[þ÷ê^*q"×ÉOzöñ”óé{U'øî£'IGgÿ>)rùrjC¤ï©gÒ£'7wŽZÔ¿ß¹ „ äuØÀÉÃ7Ÿ{ö4ÙWënĈ9@ˆ2}ä¸ÝkOÝI~üpš“2$jAP&ú®¯ÓÆP¥Í#„P9'Cãæ'üvñÙ³ÇCÈ4ºÊE’;[×ÿb «Û ;þNqsgl¶[¦ ™iîêi£ƒÇÎùE€ óôoOðŸ¾ýPÙ÷'ÇF†-ÚuÅv*!fõ«ƒ‹âûN= „%Ø)[®Ús44—Í w_Gyç~ôŸtQµ&rïy†%Ð5ÊÈëq5~[W¶Î NX°›Q3tdÞý}hÿ à«~¿ *×$ZôËœq!!!“—íST;K#@ñ‹™£„ÌÜx‚ÅÈÄÅÈË^8&ª_H䮫Ÿ@‘?eXx`ÈÀ«©«†Êö½#&‰³/‡†„ä‰)Ôöyñ¡+?à?X>é Ìuöq<Ü7ö·Ô»û;?OªêÕݽ‹CC‚ãçïÂüs^á ùï. ˜´VVp1(h€´uá䪉A¡—ìcÇ0ctÐõgï¦ ì;ÿx.©ÅMmÆíýĆ/Ø~…mu}z߸6>fÒ‰g@ç¯ýiL`PPôˆ)ÉL ±•~z\ÌÊWÏO¯ ˆ>ãS™ gíe£†ó9x|ûtïÈŒBÞÉÏoçŒ-@ns‡¸˜ïS.^cD¹' pçÌ-@­63â{[qž¬œÊñ[çú]#DŸ4Uøôþ„§N¢ã”öF@´ôögåfÊú¯Ú¿w^ PUéâòßò¦ísî`Œˆ±ƒËÒs¾Tm@0nꑹs'IiÕ“Û âú/½Ò GþÄe^#ÜÛ9ÀµßÈ“ߤæ”!¦…ÛZ¬:ó$+ëKÒñ厾Ñ"%#,~laqü]Qq™R”y‘gípóyJÖ—ŒM#B~Ú†ˆég†9÷vàú“Ô,>bîPžÕ̃÷¾d}yve‹£K`–ñð² ×€¡‰¾ìíÛwÁ%D|zj©‹ìÛO©)¯’œín~¬«¹âÀÒ™çÞJ1ëðËÁª:Ì—=œ"•5ÊÈܩႈ×wŽ÷NHËü’úöaDŸÞAëñщÅ<ߘ·i™éç†9÷_~u{áê0ûȃ´´ÔÓ 8F®V¯±Âï¹[Z¾ÿ.++óàâÑ>#æ³®Áþ®ýF®J/(É~|ÜÒÎyÈð…YŹ¯ØöÈÿ¸ G IDAT¤‘¯¡²}ñ½Þ6îqñ«S>}R0¸<>0rÚæ̬/÷Ïnóóv~GõwØ;ïïŠtñºü<­¸¸èøÌh ;ñõ™™N®ÑoS3R_ßéÓÇwx}ïDßð…¹¹ù âØžÞþ±—ŸÌH}5ÉÓbèî4DŒq÷ štïݧ¾fn>ý¥wÿ'ïÓ23Òµò"J ?‡ðxGŸ~RÊAVó=ÌÌÌ|÷øªe/›O¥Õ<73ÎÆò|Bß}[\RryýDÞ ˆ¨‘P%α ± ÌÒ/³–{ÎâО?)e]qvSÈz㼿°Å}ÐDDåloÞÂ{ù•ŽŠÓœ{­|²´¶ŽÑl ±ìÄßlý‡©aýìÓÝᑤ¦Ã`É“c–¾1•ïýúcðìߟ vŠ˾ôúð†åÇž58ÔüÕôZ÷wEú…Ïe©žmã4qWåOƒx¼³Ÿ…ˆ…á×ùˆÈl³?§2W“SwïOˆ™ç†;{ŒW"2ˆŸŽ.¶R•nb çŽ{ŸñȲÀASö²þkŠäYݽ—"âl¿n‹o•³®Y¯o_}šUšvLsóªlšÄøÎ$k»a"ÖÉ«–ÿ"5Ý£ë¢Û*BÏ–Gõ \‡ˆ3}»Í½,Py£Ÿ²éÑ7“ÆÜ;ûl‚‡W¸– ¯œ¿*¬rlfþHp üåuÅŸ¹^=]Ÿ+‘a˜çÃO³ÄÂЖ[ÓØÕ¬ˆpì~;sïì³®J¸|dð’Ñ¿go·û öÍÒ0‡72iÖ½í·H[çgkˆ›¾1kTßÈÛ ]œ§ â ÿ/”²Ïî¯ÝÃw6"¾<3Ã?r-Khì@÷ÅG±CI=Ãt˜A;Ð}Á¡û,#jsó#¢R"(!"ÊåŠô#Kì‡ÎCD¤ÊûóxW³Êå±¼¿ÜVµ*ŠéêNz™çâœýf+Y^díb+GÔHH 'JŸìtº †¬9·f¤[ôB‘ŸrÐÙ9VZA'ëæ‡þ£å#y¼ío*]Ø™Õ}{L»UŽˆ—6N´´vôóq·vô¿“£îXX%nªy–¼wuØz›å ŠmvŽ^,C,¾wH%n°~gØø (P»µ €'©åøþhhèYöQ,‘\O- þ¾òú*½û‘ä–ćœ Àá0R&ÿ~.¸B+;x—)àf½ a1ðó…eŸ‹F:}Èè™udïÆZº:•ü·Y:ÑÝ Ø’Ê½Ü|à\FÍ¿¦!U•‘׬©(N-Ôꮎí1 JÞgëDõ6Utnba¦“•+N~¾™©¨.ñ||Ô5›‰ïhaÚϡ׹@ ¡ôægèÓ™&úl{.µhÊ:³q9„ SUÙžÕ- óšvþœv¨cÒEÀؤE3Û·À$Ö"·i7•‹œŽ6A @ú&W×£— ÛÄΫ u±V^a†jeÖŒŠ¶A9û°MÓ–@R››r ½næì1!ét‹VfF” @ǤFFŸÍœ·¬ÿ®¹MB862¬é´Ô¬‡å…¶A ÖH¨s˪—¯=v²‰© «$D¾cZô±ËS‡çŽ–>€¼2úRIQ\.€èr@ª¨Ô^ÓÑ3Ô)¹»nö凮ÜîÖDçŹ#£"n&oT·æ¬øÝÕ˜1‹ÌÙïÖ £<³óÒ5]¥¶Væµñ7B½ùnˆJ³ÓH´ šxlR@õŸ+«ïrMõ·Uçöªö󗧕ÆÄP—kfvfåøzÔ¢«JÇH—I«…îjl®C®V:FÍö¢Œ¼Æ±ëri©BEHÂ/g?J•I ”¢µu´@KGWAÉÕ{©Ö?ÒX¬>¸ÞÕôO™Ô5V¶þ óN´¸ªR« +•Ô;{*eœ®6#QªtSr¡ä[¼+m^us“Ú0¸Ðsßå©Vubù€³5Óuó|Ìs0#ürdÿŽéCü6_¼gÑT¯¢¨™PEqVøè±Ãêm€€È憺~ì9éÚA,ëuuDÈSP¨¯M€@nQvãö\§äjš,›"þËÃáµ~xÒcöÉnMtÐ"x¤Õ‚];R`jWMÚrBoO†Åÿ:w×y¿®Ø Ê>82—ÌÅ0@KD –E ±÷÷]ú "äo¶L!øûvzsî¦j}¡âìÑóJÝö©; ¨õÍu‡Tä9ç.%×ÀàèØ5ãþSaÅß—Nü!ÑšÍ`ij5½ä»øW†»>üÔݹ[íæ„€\*a ˜a6 Òß}ÐÖæÖiñFF,Ñ 4±ìÊ}rùÀpðx—C9Û™>8~¥^rã@±‰[7cèÒ­kÉç¬|ö"{áÐÅâU9¡•r‘X ÖîÎæêpjªäÌéÛøÕ$uT¶¯þÒ÷ÍÍäŸ> `é¦Ã¹_å ºŽ]ááù·€ØsìŽ6G%Sþ¶%¡‘›Ôgž•§êë ož:ÛÃ?€29àÍ/›D@HÑÃkŸ[u0ƒN­µÞ%§ª¦B–“¦0ìܤÚWPé}Œ²Ìþñ6¸ä×Õ¤¢?ØvÈñ§wÏ9rôر£Ž€V=Žþ¾K‘–ˤ52½5ÀÿòtS±ù™øÌ~6ÔÇ'ÈÝÉòãÝkùúþêûÕÄý½C<Ão¸÷4{p;±SðÜà¾j[<Ûs¼®xøºº:f>¼žª´ºT×*>gžðé~/{·”¼ÿ˜ßôT˜5WÏzŽ×µZÍ¥Ó¼­šÌO^àkÒØczÓ¥13–ëöÒû|/UÄU(麎t^˜¯ª4}ÌøÃgŒøÒ^'ç±EPo8E!Àȹ«™éÕ]¿àæý7«ö\4€®þ«Â ps³°èùúÅK÷E»{Bê彃¶&'ŸÛÝqÔþž§ü=‚ïyY¶{rû†±u|h˜ûWÍÉš+Û Õ;¬=Ü×zf|ø£@÷Œû÷ÂÇôúô5€à™ vŒ;*×K'íFok*…AÓV½Jóv&$|^²ñ×Ú¶‚»»&nê›h=r‚?ÓÏÿþ•?&ÏŒ?úóžù;O,ÚÓˆ,¹‚éÃM^'¶;ÙZJ~¯4ý¹[Q¼Û¦ç#mõkB„:– W›Å¹ƒÎo6Ò½D Þ¯y¬lÙfoL kJcštöÞ¼hÔ±ýSú Ú׶cyAšn÷¨sZ‚ÕO!­úúðü:µÕþ”ÎOøõDÿºooß!/ºÛv6}t;ÑÌmHpSPdžˆýéy¹)Y4t pFl=(5HÎi¼jòPvÅдVüo<Õò‘Iä @•¼:cÀ2Ý‘I«BDÉ7yÕuèWÊÊ$”®‰‘®êÚL¹X¬ WÛÈ؈KËB=“Æ: H+Db Í –Žž‘¡>0r‘H®mÒH¨0 ¤\,WÒ„«edl¬E€È%BhRå1465$´B*–ȸÆÆ:\RGs— ˆ©¡6BÒr‰L\íFFzB¡Ä´q#PŠK%\S}Œ’/”6nÜ>5¦o祗z7åY¹Xª ¸ÚzôA FS@+eâr)DWßÈ@W‹"P.))†«­kd¤ŒBZ&¥›0J‘¨œb«­kdd@Xg³2¡¾a#-SÆê™6Öá–• ôŒÍt8¤b±LIŽ–¡±‘6€¡øB‰icNÅmQ*.“)]#“̃‘£ž$ÜÝâ!*+ÕÖk¤§ÃQçÐR¾ˆnljD(™X,UrtôõßýÒkŽ<åÊ\@¦L(d€ÓÈĤ\Tª­g¬§Ãº‚Gâ²Ê‡š¸‰@Å¢2%ÍèèêqËË„h›42d”Ò²rGÇ°‘G,.WÒ áp ŒŒu¸€)”ê5ÖÓ&´ÚbZÎ/“7n܈Ô"„„F)-+— ¶ž‘¡ž6 C ˪'—çj›€BV.‘)GÛÈ؈ª¼é€´X$V2¨£gh¨§*´r±DJWò(©P,Wú&¦ .UOíˆ&¦ºj×F)+“*M"£È¶öÅY ¢ä/Âÿ¿‚ÆÒôÿXX!¢Þ$«€¨ào˜;ùÐí4]}ï±fÉŒú ¦“Ѳj€ÿåeªþëø[–u­&Ø k AÜ4@4Àü…2± ;ëK¡Pñ0PJš™•Çüÿd"2ÒâÌÜÒ?«³S…P^’™Ãÿ›¶Ú‰þ~œ"~n±ø›ÍÏ´âKVÝ°«þLjÕ|§Fx›2ÿ\Rþ××Ê¿="¼äq¿ˆñ²ÿð‹U]3)º.tüïîXKÈžªÔ!6õ‹ÝÊüìC ”(ÛÁcõ÷ÝàjãÜxC¤õ­}gF]Ú nþ U×ÖWuá§äÖðÍe/+Èc¦ÞÛãjXKA€ˆU^ªD£þ€ÝVk«TYEªƒysU=ÕkaU{³J‡AêÑp¨ŒÜê—*‹FÕÀÕ¢!Ô"*„„ÚåŒ4·š¢Ù»m]3IE£–?i}çeÏÙ*\šN1šÔ7å—žÒÎÕöj\PO0­‘}•C®±,(Ñkmm­hj®* j¨:] §äɹ«{­jâ¨k¤hÒùaâ…-Ö?÷tCHÍÒô‡–%¸¸{Ÿ0ÆÕÆyÌƇ„À†sùº:{fMß~!‹0òñQ¡N}£ÆŽquöÜw/Ÿ’z$ÆyÂI_7Ÿþ³ÿ 7·OwwuI˜0Î݆7xé6uöÁùÞÑSvüqíªENnžÛîf(yæëáìnúc)Cˆ¦æÒQ–íf^B²ê=ð¸*åRÖ®ö(BWFÛŽ>åë:yWÍ„|>¶ÄeÌRB!¸0ÏÒ2¨˜!@ÈÃC‹|¼#½B€’¸tDÏžnϦvtskvHèæDB!ô"?s€qlØ̶±fî»S)dÅO¶õsµBÈ¡¡N¶¼±ñq> ‰tÙ{7ÿå“Óu™U3fN• ZFzsãÆ s·±ŒµŠ(üÜ{ð¯ãC=BÇ.'y7×ø¹ØH˜Ð×Ù%dÒVvÈw׏ÚñâFñæ¹ôŸ±›"/J:wHžL:»Œÿ4Ê“×72nÔöîAg²)õ:\D”ÚÛÎó؜ȋVÎæè>8!¤¡j8‹$ãÒµVNV\ ËGDòüÂø9»ùû '„K £œ¬ìÇÄôùyÚßùûßaJo[ÏbºAÖü#ŽèuD„«•¦—$o4ç /`=UÄi.Žöïø2D~xŸ>·Ë_︑ý½äÁoæ#则çâxN}‹)DDÅ»£½í¤³E~˜â~nÖ7?•"â‘å!þ‘“U‘Ô‡F÷ð+"î™ì·ìûpR°ëšŸ˜›3ŹY)]WD¸(i¢½µûGj¬ˆ‚â‡6–Qeˆ¨,óuráå’üEŠˆ¿%8Ì;óÞÇÊí³qb„çÈ‘CV_)BħëB7§`Þ! ×Y D>sï6ÄÅ»œADŒëgqþ½‘AiY‰·½ã…U½¤µ£Çm~†ˆâ¤‰v}|󔈈W¶MpêÃNÚÑ1ƒö<@Ä}ÓüÎ;öJù}¼Õ€u âáåÁ¾Ù‡_öŒ°Z̦¿¸à'W¿B%‰Ó{nDD,¹onn¿á ;fŒ °úýn¡ôíù^Ž¡läuùûƒn6{oe#•êjîÁ–¡b^Ì·2·¿ùEˆTþ+žO Ì‹ùV½ï0ˆHóS­]ïç³déi‘vËN|Bí’ïUÔühëî'3‹¯pö™‡ˆ‰‹bCVœf|¸¼çü‡j¾Nâ4+kÇ7U™"fE[/;‘Áh$¤†7M Z~*_ýí·›}¸{V̈e'1ÿ¹•ƒWŠQ™uÁÃÂ|ÑÁ,ý`éàSL7x½ü“#ÂÕJÓŸ?ñ´¹U׌I)4P?p´.~v·&@E€üð7ßG¹›”:Z-Z俾#†.¤™¿)àîõ§¦ÝÚ>NÊ¢¾Ó7½ùá‹G's`”­{ôcOÝ-{´bvHnßÎq9éÉž”7œM€[¿ìÐؼI«¶õ_ú•¦^ßÕñ«¡}@«g¿@„Ñ—rCןO7>~±kgzõ¾ÞÒ-Ýzÿ!ß÷¼|-“šÛvõË÷¯oè“Åþè;tT®{-\ÚüÙ³¦]Bb¨Ý׋˜àf)iù]í»é!! )y#Õærs^%·Q«/OÎX"‚²}`3-@#“–M[µ`¯j›qø%áÍ[Yí¦7KJJí¶vzïw§ád‚tëÎÞoäZDÑ@[ŸAŠ­Ïj*Fuš ²VYÏØ ¼\’VœÚ¼c‡Ö`ÐmÐ-Ö @QP©n•›y9·Ó@®QcTÒ"Èœ¬šÈKIL ¨’>·y«n/Ÿß‚þ£¦L‰9rè·sE|šC$º\A± ÚëQ4€@_§¬„M«Ì$nööæ~±]U×½*þpõ‡9·`¹oܼ‘D(ÌOOÑD¨S%N-P<¹[4~Q{ű#)ö+v²[fÜÒCq9ÏŽ6nÒE@«m?§nóÕgæÞ¹ã"¶ìbïeÛ¹á¨ñOÑݨλ¥éK¥4|<ûG«Þoëáa¦Å¨Šñ/‘r%¯®]ÈPEÚ{h³Ö*ã¦ìâÉ”Dwö ,Sk‡Ö&ª`Z¢¥[]Q *´ô«]áEò:›åìfdVO ûÛÓ'_xZhÕ¸UÈÃ)«^OÿNžÑ…× ñ˜Ð_vÜXмPêÔ¿‡g‹ô­ÇAjsÛduc€nÏÎfoÞðMžÝìÞ÷7k“œ1Ç>yvßÅñÒ´3C‹´®_¾ JIÉ1²·ªH—¡¥[Y-‰C¸•w ‰(]úáù ºìÜ·~\%"×À” Q/‘`cm¶…–¾®?—«¦Ž!„H2nU%m} ¥­ÏQSਠLÙtªJ¥húÂ… * †m{wi¢OîNÑö£f v7n¤óù¾Ú˜Fö£n²úmïÑM ŒHU,;t*¸§IÍõW¥¬!„ÔAH²N¼ld£T‘”ÛÁ€£®RS*$\bT‰QÏT_mvðئÍI|1Ú:pzƒ¸ùlj›JèÝÞà ŽÝÒå#Ym›L"Ó5ÐSK@¡gû&ºLXÓŽÕöÉå”®.|QÃ鵩¢‰ñÒå «cÐMº¶P|ü &- ¢Ï)Bã¶]45Wß)¹\4Åj ¥eåõ¥PÓ†ÚY{løõÄý7F®[MZ'9ݹ½£ w‰ ßN»¶ XÚ$³?¤˜4w×@€A¼ŽëÞ?lu-+bŠ‘‰ ¬hÖÎƒß ¯Ê¡cÐPùó¢åMt a(pu¾a¦›uj"5í?w&O`èhÁ#µ7~hÊy’'fû_^RÈá~ͶˆØØÈD,ͨ<LjøÒ?»JLLÚÐ\%+Vh!"!”BÎÕÑÍHÞí»­œ…ˆ„dñËkêä•R‘^«éó­€ÿpuЈýìÑ­ÔîkêªFBê¯ÜÙ{Å5h(»êì:0×^@ï0+[ªÝÌÐLA•Tj 3J›U)ÃÉÆk‰šÕÖ ðO2„£ýÄQ:׶ìR¤T(…¹ÏÜ<=?äêHÂæOß4,_®P(Sέ²è;^YC÷èH³gçÖÞÊV(RaZ€ËíOBÄ(€¾ƒƒnþ2¹\©Šó†Žþ6_ÜMSsB¨‹{¶$¥+À¬NÊÉCsìÈ:Ç…´`é¼9YBš6±²ƒO÷÷~1ukÂ0ìØ¡`Û¥6þ¾€¨mܪ-§pcR±s§vÄÁ§éº_÷öŒÅ+v‰ ÿtfo’½9ÝFm äŽ|.µïÒ@¹oñŒ³ï¤zf,ô¸Sv&Ê•Jš*›?ˆ7~ËóoaG`løÕµãÅJ¥\&»³n˜Mô/5¼BãÒ·¯ý(¢iJ¼kéݯ3îhm!ùøöl–L.—ÝX62SÆàhi3²ÌZ¦üª76îbÓµ¼xÒ—2…‚VòLJ;.?‘fbÜR*áó¥r¥R±bÌBE#An ÀÑ6@IN¹ŒþeÂЄu§i¥\®P~Éø¢Õ¢ —À»³;ï»YǧΘt­Mè€ §DG^¥¹ÛØ'tÎè¬m#2ùåU>âÀÃ×2š~×Å?”*•ÊämSžˆuêñhøøÿAâiŠRô  k{áúg놹º¹Eþ¸cÛ¹[Ýë ¥T""˜õˆ=½mâO1~nn.‹nrn]úMJ©Ê E€ÛíLâ©’ƒãÝÜ=‡.Zxè†Gg`hŠªtÀbh¥’·¸Ukw tsõ =|͉óu4Wžß¶þÚG)èvN˜ݲ¿§S`äÞði²R±VV&§BTRJn^»(2´;EuäKõº²h¿N­3³[šk#!ÀÑ洛SÖò»VºÐÛÜ5íYÙ¸SdÿÆÞ½0¥C/s-ƒˆ–”€qþ¡ €J>êi–ˆî¦+×\‹z»»¹ùÆtˆÛõëxK¨Þ%dèÊÜY ­¤—!K·Žµðqñðô<&ñ}päÇê³Dôæþ2Ùb¤C¿³ú-Ú)U0ˆêhQ©¬õEÑ Bs‡‹fl‹võèMGÿfÞV@»ã¢IÖ³û¹Ì<—K©š(@JI!²}ª`ÇtOâµÎ¯Ö{y¸{ôá5ûÄì÷ðùe˜e€§GàÀû/߶ 6xÿ¬'s IÏ¡ ßú¸û…­9êýçíîæîá¹í}¯+§~ÖÈyštþá!Šª¼ Ò”’fHmBT8ýÜœî½klßÛ ‚YïÑG×Æ óå¹·Ù°h¤ÿpåÄòñþ.Þ¡YŽsƒú²`¥RÙà<ÿϵLÕ*&¯¡¦½úOµrµªÕ‡WýG#Í%ëkW§¯·XW{õ:öŒ¦Òôêy°«¿¯>¢š?ÕN ­aÐõŽÕÈ©–©5vu¤l¿è²œ[÷ÓØ'²ìÇ6nþÒº^­D¥=yø¨ã`Ï^gß”«OzµV5&õØWã—z⧫ͪÏ=SWÒ_ ܯãe†A¤¤/Ý«|:5 ç¦ÄÒ†„ áÿFñJ=|öÅÁú‡ÿÔôü£'/ºgÐ`Çï .ü]n7÷Ø_„z²"€hF€Ëçöþ¡.½^Þ>uGdwçðL€ÿw× ¯Œr¾gà<ÀÛöSòùKé­ÿXgðÿp¤ÿ©Ð¢ù'..͸xýA©ŒiÝÙÒÛ¡ÇWÃÄ€ìÖÅ‹ÙürãfßõósÑÿŸæî•?Ò …Ûúúyk5ä†h7 РР*®TèTnõ?¬³á¿n?«Aù¯ÃRÃXWz¬MøO!¯Ù¶–º†Q j¿†¶•qøWæ¤̵k˜¹Ú*šàW¦³j˜ø ŒûÖɬ‹^ÃÎûï7„›ëý|&^'Õ¢\ÈõÕ^Þ“n×s8%„,ˆµÛ|Wü¯:¿"LéÖǹð/GÄB†ôÞ}3—$ 8XÛä•Ó¤æaövî}ãCéŸ"G¹µ!(zý-kë|yU[B‚kk›”Reâ‚!¶ã¶B>ÞþÅÒÚÚV6ö.¾«Þd€°Ê¶޼ŗßVU¼!xl µ×òdBÈyumtT?[;[;çø9[ %L¥ ÝÇÃ׿ñu³³±±±±±±¶¶¶¶fÿk³é¥`m\˜¥MM×~Ñ'Ÿ|¢" „”󿬜6ÂÞÆÆÊÊaØäå)E2R¸Jf ôµ¶±éÓÓòhAE€+ÑíEÝ»uÙp‹O*Ä QÜsêÕcéÑg•‘eˆb7Ën)Â:¦“ôËÛz÷BAÄ©¾îV´±±ñ ‰½ü®HÕI`÷Ž­ôp´¶¶ö vái:Ö}x'¤,¢G/k™µG@̉{©„Ô±M" `i©¸Aýõãf¸½)8hÚÍ)…T*§êÕ=çXæü+3 S,¼ ÿŽˆ¹Lª¤TÖqn"Ïs†¢Ö@†‘J¥ýgÇ'ëÀ{Eá²^ÄÎ×ê?¼ÝÍë»X‰xgÉ—É;ñã-îýbé  „ŸÇôµŠ™¸ƒ¥>6Àkŵwê=:Ëë·æ1"¦\fîÜÿi¡‚m÷ûô>ö#JTCÍòp¸+¤š¦iQ6ÙµëÒ¤r–ƒ¸~tÔðMçUD…Ÿ®{¹:"èȽ K·ÎŸ<`è¸[€Â8Ÿà—2@ZR~/¿” ½Næ]7;4$(fÔôÅŠŠã/áÐÙ3FD…ÆìOJÓpB.K?~XPHÿ%;/Wœ±©íóâBW~À°8|Ò˜;1êìã" ç7u>Nàî±QáÁ!áQŽ±UWpìð¨GbÀK[f‡ü¸ê(dìñ¸‘¨5"@&ëÑ#³Næ\˜¼vè—m³‹iU KælN¸njmçnŽ ·Ñ÷s¦ÿ˜z÷«;Gâ‹Ž¾áVÍ´ ‡p8Ü«Ž>2߈‚ÀðÓ¯3¦vÆÂ!§¢²QѨä7p8!¤Q'¯Ÿ­›8ó€þ’¿Á{ÁÉÅÃÜu¸ã2lѱe#ήŸ&ª°ùTâ¬úÍÃg²É›fJ¯^xEW$Œùø˜Îófoù_žFIE'ZZ…Oz §W,xÓÊ÷Ê™ÍÍt‡Ó¼§ïùSë¾£ÊDõ#ãp‡Ã!`Ö3l°³AÆ£w@¨¬û?ÆFO^¾W@‰r‚ÂFÑø*ÌÛïE™PK#ÝWß(m8¾üo.S„+x±åówAë7n´–$Ùrqq‰P@ttä‚g[¾6Ù´û÷…#¦ê¯$=ò4Øݾ<Ü4~ÿÄEk7,·yŒÿá‡%vÞI‡v¨Ö§èú½G ¯Íúa~ïZؼeóòƒç†9ÞÏmÒ¡Má­¤B@”}»LWwçí‚»§³Ûµ¦f»ŸG‡ ›]4Æ!ÁßýfÂH†E­òÓÊËFŸ¶ó._])@è·îÛ„Mûeýr³g+‚'ŸDBVŒ »!5ÿõ·Mn†¯­¾S$&@PR(‘Ó ݾ7çÇÐv5ëµlýæMë–P×gG­z €%Å… Š ×~·úJÙºM›â½Œ#~:R(f¸5Ft7CLù¬ÕÓ¼1×ÉÖÕ¡sK­ŽîÜ”­¯($¸éAî”väÇõ«Ówèåè7cÉ/> ¹<|lž½| ÝsYѽ{cñ…\9\{öÜÞ®o~Q––R¢‚н7RSsR€K€«keªÚ¯Ú7i‘+*Rïè“4ñ?4e×W¯•Ÿ·3`Ž@lÒ¢  n?ÔzfÊÓ¶Á >kw8Š¯š÷±6aÖñ+OtµÔÃËKR õ»uÑEBÐ5° C#Ô‡džKn:Ô^γçèÞ\÷² @üfÍeîì¹nšòÚÑùùùùùù¹¯¯î<þ~ãõäx6uLÔ3:ØôÝ{ööÇ×wçÐ.Iäõ{Í€¢}—I‚qýŸ#ååçç¾O:rá‰þ­§Wz5×EC]=¥´vb`E±ŒšiìâÓž‚2=EþûÄÄÄt¥žQÖ›½éÕ¤e{·ÑÃÛ~Š[wÿÏ^©h‘ /??¿°èéõßïetxððT[.€ž>G\Z^ÛtX¯†KNNNN~ôäí“m>l ™¶€NJaúصS­|­æ=Å3ÕÏD\M,þšlk€¯n”Ò y­Pеó` EOöÑm-£‡h7Ò£K% T[*ЙÜwښݓéž[ÖÖ¦‹´±|~¸Ýá³Ï¬FسI9œÜR¹ÚA‚I)³Ö°¬¤ˆkÒÜ€ DÛÔÎ3ÈÎ3(+’—xï]×Îé™íº~ÿµ¥ÐÒÆoÊø@D`¤Q>^žg•{µ7$ízu£²Ü)WãŠÄ¨¤èåIó_yÆyYÍÚtÐ"—µyú®æ}®œ8„@8{·:—(€Ð²coÊØmþeú›®­{ ¼\$QÐàãþ}Ê•€ÿiïJâ8¶ö©Ùw¢ ¨q…¸àa@A@AÜ@%FÔÄ›£‰k®ý\ШnQ£ˆ F£`ô·k¢hã®‰Ê ‹ ³w÷LOw}?f ¬zãý’ç»×~ÿ§›ªê~N®SuÎ{!݃oü"Ihïîf}p߀ë7ä”Ô}Ž’gd©ÁRŒñÙ[î–ü^‰K>d¹‘_ë¶fÝÛ3WO?v*lø꟪ê?‘öù·§¯õíVc1†¹ã‚¿Î?îDnðع/ ö@Ã’Ï>8¹~á5 Æ`úðvg×l*±:zíÕcUèo[ ycÃlù¾æ ËÐÏu•Äî-/|ßÉwÈ¿ …ðe­v¾ß}ö¨Yz0xôY-Z˜ª#mŽ¶Y†\ó÷Eí‚#z ô#GŽÉ½] ±¯‹¼z6ÚX|¨R°f݆ŒŒŒM›6elܸqùüª'ÇtµŠ! ¢æݶMšáýár ÄÓ?+ÙkzüG €aúÄQ·ò³2/•9:Á,}&}ê”9Û(þK7ž?ïÞ½'WÉ„#‡´¼²ë8ãðj‹¯ò½FøB0ƒ )¥+IØìÜAù«®n°æ· è9apHës§NÇÏ^×ü%êÄO:ËÔö-3*znÖê¨Ia GÚ²n>‘ìúŸxÀ ôè/~–vB²åhG BwòæÎáÛ5š ó“k…E¶=šÎ›±lK\æ¨EÜÄ«¡i¾I‹@àî»ó½.Éýú…÷.]+uÛ> B©pýÐT÷PAÑå‹¿)÷­°gŒêyØÁýïtp^<öȈ1~ÞͯþühÊÖcRLŽødÚð+C<¾øÃðw}ï^ø]-?Ty{;¸ï:òîê« s‡ŠÓïŒXw¢¶Bš>=qAÒô;é›'ÃFöÄûX·zO´o@Ç/Ö^ë»e{m w‰˜ã·2xø}åúÒy%ê–¸h\þ‚w?>¾g%´IÞœZ˜,‘»ð­z’FÏËh.ÅÖnÛ="-$GÒ¶}[Z§-©²¶Yš¨^“~²Ï’$6ÞLÌêº;|^vAÆÄ ŒqüòožNÎ å.|Ê@Ù=|ã¿ÎJ€óûž6l—JnÔC'/jp/O1°µJˆü^ iÕm°¨rnþ³ÍQuÇÇ®÷ÜUn}µD葲ù½1‹O>^ÕVÚsü×ôÈöð@å¢0Ì6q‡ÃyÛÝ^âàØÜ —¥<\Qö” ÙÉkóÀgÆWo‹ŠN¼Þÿ-Å™ãçú§lhžþ ÞWï$%Í\±ƒjDiíó£üÄi—–á–9/Ôç¦â l„¹QEób…RÆ°‘’‘¹(„ØnÑY«‹ ftz“J­0é •«  Àˆ¥)“…bÉJ±€çP>;i0[±ÊÅ… `,f‹ÍÎ _*Wˆ<Œ3Vƒ‰”«ÕBX£Þ ”*¥b¾£Ðe1Q6;ðø2¹B$@˜eôF‹ÚEa6šì¤r¥DÈÀ„Ao©TR>Æ€0c6›i ER…Lì V"ÍFŠfÅ —'{F½suú÷¡&£^(U X+a•ÒyZDfÊFc@"±L.aŒFƒT®ñ D“&3eˆeèÒ§½7¾uûðTÀõž :£ÂUÍ«ëØf B…ìwÏ•0YX¡Z!ahÒDØÕ.Êšy…íVƒ™Rª]Ϊ@Y,m@b©L*ÖÔ0`í6 A2,@B±D.°FQ¦VóQªf½Ž'w• 2Òd´ ÄJÇI `d'ŒF+R»*yNS„…²Ù@ ’Èe¨®|@YLmç ÄJ… & z›Pé"«ó%£ ƒÅ.V+ùz=©rUñª{¡ ƒÅÊ*]\›¢ cl”‘¤]]”cÂhĹB,¨$m1˜i¾Z­pTï`hÊBP,_(WÈùèƆ5ê lÍEÄKeR‘ÀI»ÅÒ&“Å΂P,QÈ$Ž@G¨·1 P¹yl=¥€»_§ïQ¿»4LÎÙ”W17ÿÝX:k<óöÌEãƒ,I!a>ë¾›×KùG9¹uVîƒ.[W¾ FET]’9!S©WZª4É­÷ïÐîýIÍ6Šôi£‡dí÷æv‹9sÓpn+¹6û£O žP<– ÿ·åïü£ú‡1°æâÏ?ùðÈ• X»F&­^0C)ähâ^kç$üㆥžÐêsæË™ÿN³¹«·7ˆ¾£]{}·wÉÿ½¹Ä\ö9gnš0u‹Ç½Šž4h„£¿}}W78sÇÿGø#gvò‰¶”}¹c5—>Õj‹ŸV™(¨NÀƪgZ­¶ôÙs;¥M ueZ­¶¤¬ÂŽÑZ»È”ëjÂ]5~i¢ìi±V[\ipä(Õ2 v“¶¨ˆdþÄ3C–—kµÅ:s½0DUQ™þ:Fþ;V7eÿôuéüÞ:AOåÿì÷Ňdµ}ã’Ka1³Äm[©Œ‹*geåìé…û?‘Qйk'í½›RÍÌ£ËF5%<´0nýE[ÄÀþ·Îº#è}!o¹[«Ž‹>W.Œ[{(­—»s>ë ÝZµkFÝT6jqÎûƒ}ª=œ™µã—²/¾ûIó²J‡gô Aè,Uk’¹wô„{¿‡LÍ\1éíÚΊéá¿ä‡$§m8·ÿ+×Mð˜7V ãÌTÍÄŧ¿?ÙýŽoÔr;Ƹò²Ÿä}ÚIe1a°ÿþ+Ï2NuÕ ¯¡´ž2,pÛ©ÇãM#ÞÞ{½WägÌ wø-;µ`‚xxõºÂ§£·3ƒÒÑç|á5maCáÛ‘@^퀄<ÃÞ¤ç{Ö‹4÷ðôá`ܼƒCQŒãØÈV?uç¾ÓŽò5=¿õ­oP˜Õ¥ 3>èžóATLìЛeVTq%!¼_Ĩ””Ä!cGiIÖpz±Ohš#@!¼r¿¡_üˆ)¡[ëMô˜–sâË$`¬jÝŒ¥¬v²òg¿R ƒ‹}Ç'·¸¼ðp9÷mã𚣩¨b{ö’̈Ì[³»|»oGe‰©•ˆ'ÀÝŒIwøqf"€‚¯^ºæ MÏ€” S¹:= €–?{« ìy¹«¼EM[È•ë*ÜžÕ–=‡Öc— Î=sþøÈÀ⫧JUÑ am0‰B@רD©®vîÐÒ•ßÄLš/„³?ðIn;±°ÆWT{8yØ_Toç…Ï2äOá_æ¯mŸOšóæˆeéÓûÀµÌ £gî½øeZïO?\аͰù»fe7Ѧ“—dͤ R¸ˆªý¦­ë³{ÇŒQ`×ÎyyÇÝ¥Îྠ˜˜ôã;!~§p¸­âFÌPŸÈž¹¥ìÊ=~ÿ©>j̤žmœQpàè·eþɱ0ô éKYù%HææÑÂUV³ƒŠùói†.ïΎ錆æ£ßóEBd·1 X±«2Q%ÅÅÒܺ™ÄfÑf+°oø(®Pûù;ý1@Ù;×—ø/Ò¦öñEÒ–žõÈ@óÄS"w–_»Qáá%¸páÂ… ˆŽ}ázNV„êqîÈ1@`(:ixwv“`Ìs÷j¥ÕY'}µx\n‰_ÆâÑcÄyyyÖä wlå]¦û•Ó6Üê¦ñ g»ûåäœÈÏÍüŒhÞoçÖ•­«/VXÀU.pÌVTØÐ`ÆôÛŒaq¢ÁËvÍŽuÄ€«ä®]QsC‰ŽnÖ\¦”ªë ›) Ù N”]Ï۩˧ƮÊX59´)[ƒlåÅGTÌ9´f,`@¶'3R³>Øš}óæM¾ˆµàñÛm»z{ª›`?B|Ga{‚ÂÒòtBgõÈÐHDCblØú¿Ÿ´¡gÓ7tJ= á56~6zÐ/-'Ëž&l, C&—ÛápàÀ37°Ålé>(±û DX2ehfî¹Ï£x€uò€ Ðß cÐW𼺦 ]6-:Öóý¯—Œô©¸ŸŽåÅ…,€\,Òk:¶mê ût~RzÜM­ªYÏxÉ] «ž7a±†£Ò‰»v¤ø;úb*KxÞÞy«å zžü຅–ÔÌ”°æNSZßÔØK¯rsßäÅI¾Œ†fxB>†Þ‰}óŠJ×Jf´¬ÝÆ€0µ8nÀãÐ5¹†6Œ.uuY)J(æsÚÆs¦Ç%c‚ÂvÝÔSV«Õf{f"ÜÝÞ¨¹˜ð^hÑú9ôV;KnÛ¶Uê̘ÃwNäì>û!Ø·r4ÁÖ$IRE ÷Šß¿ò4E‘E§Vœ¿­ˆ‹î*i(ŒêÔ5À_w§ðð¯f›ÕJEGo܉x0KER,c¥li¥íÁ÷_¾§eêªq«û"ÁKs0gOvvvvvöž=»ÝYÃì͹)aÍÉÊß6ïØûÂ’ âȨÐìôEc·Y‰üEñ}¦dc@òø¤€¬ù^ž<À€²Ú–ñS©!xx4í4ŒÜ˜ªq €$Ix¶mÛ í,„𸤨™º%§m^w4udEUý6gòpF£ Ù˜cŒŸžñî5ŒÀ³ìÙ­óûjÃãRn?¼Ü½g´c̲ûS"ûÎýcÛ{ýºÕ §oèCÆcÚ˜9wRPPPü”yOMÕGà Íe·g¢ÑhD'ÿ¥cŒÉ;ý|ý‚‚‚ƒ‚‚zOݘ‡1½(¬N_~¾}¯Ö>ˆÆÌð^Þ?<ÇãÊ['z…ÆPõK$<ìæ߯ÈöûñvÁÁUCzkú„¤¥¢gaòn~ßžŸ3U‡ÆtØ|™Àؾ6º{`­ø÷þΈÉÊŸ5ÁÁegÕŠ¬iA3·Üÿ+ëSpàðŸS#¼A‘cÿAùEµÝ‡Æó08'êŠлb'-\½¿d˜µ®} €ÈYƒ×ø5rkTÏÓª?FçßÕý6=fΠ¨yÇO©JOö¾óLÁ>7.ƒÃë×(gŠ!u?> ƒº{þ$ØN^ºQ¡ñ,×G0nÏœèv9ÎÜpÙ<"¨'÷Ý$íÍqôsàÀ™8üEàq¯€œ¹áÀgn8pàÀ378pàÌ 8sà þ^ïwV<IEND®B`‚suricata-3.2.1/doc/userguide/rules/intro/TCP-session.png0000644000000000000000000011043013051004444020054 00000000000000‰PNG  IHDR7\»‘ýsRGB®Îé pHYsÄÄ•+tIMEÚ $”’È2 IDATxÚìÝg`Åßðßì^Ë¥÷J é¡÷†Þ‹‚lˆ‘¢¢ ¢ˆ JS@z“Þ{ !tÒïrývgžw¹\ Xþ1èïóB½½½½Íî|gfwg c B¡z‰ÃM€BS !„”B!„)…BaJ!„”B!„0¥B!L)„B˜R!„¦B!L)„BS !„”B!„)…BaJ!„”B!„0¥B!L)„B˜R!„¦B!L)„BS !„”B!„)…BaJ!„”B!„0¥B!L)„B˜R!„¦B!L)„BS !„”B!„)…BaJ!„”B!„0¥B!L)„B˜Rÿ2Œý¿úqüáæBõ™(‚(â®û7HpÔ_„à6¨=–ì· !Öƒ7ªÏ 1"#¡aCpq©e×­¶c#L©¿yyp÷.PZ¹q\õ á¸Ê×Qsb­%l­S8®ö‰Õöož¯å{y¾r6ËáÁqÖÚ¯ÏWùQ–Ø&ÚV€ã¬ ´Çó•3ØÞ’JkYg‰¤úl÷þ"ç¨*@Vr2Œ¼ø"ôèAAu½cÌ°±ù‡6l€Y³@§«,âí ëj)e_â× ³ZSêáqeÿ–-~lì“ÆÆ ö_!•Z#Á¶V<_¹@ËDÆ@*­2ƒ%Ì$’Ê”²¼àù*Ic™(‘Ô¶•±ßD¶ÏÚ6Hµt´V¢$µüÞšéøçãÍöuö©\s#ÈåµTd²*1H*×ÐöB*µ.ÐþO£PÔR­Q(€ÒêÛªæOV(ªï<_ýOlYçj[ƲÎÕâŸã@&ûS1å£uàL˜yyÖC۶Сôì M›V©´aÓ ÛRY~>ääàføo5 «½¶Oևļ%®lád{Qk½A&«Ò@·ÿl­1oŸpö¡^³zQëí²¦ø{xtÕl¦WËþjµÕí2Ñò3«-ÐÒ^·”àöˆšõšK®µÉþðF|Íú}…Ï'öõ3[]ǾŠ “Á…  ÑT.'323aÛ6hÜââ "† ¶mñàöÔßêHN†Ý»A«­<Þôzë}@©¬œ#ªþ¤!„1„X³ €X"Ê.´þÔ`÷¿ðY„ª³ð¶VÎÎNNЧ<ûl•¢  ú È~CþS=~ €è³÷nß)ìÓ£1ÌY°nÈ ïµ uø;UJYEà!„P}TZ ‚ÞÞÕ‹/l?ý‘ºÇÏ…ÌvÅSÁ‘=?º‘Tuìðá|•Ù>ÃìægÀ€ÕX–yûÄ꯶é9ŽTý„ªGwwkDÙO8²WýI)Æ,=| €TЄ—:8JyŽ­þ~´_cgV‘4•·?ÆRåd!„1Jg,º½yóï Ø㇪¯…£{Ôë”b¬â¤ )¼±gü øÖ{-þélå߇“‚áÆ°!ƒÞÑ`„ÍýÔ_Õ¦Eëç箧Œ ¥ywƳídêò#Z6k;gýQB¸¤Õ/ÇOü$)a÷ˆ™ “tØ㇪—ªMXRÕ»”"Bnþº¤Û“3XPË]c·¼Õ÷é£ÜÒ²ªKIK-×SR’qmúÓwÞS Ú?ï·÷|ÚOÌ6͉WN.üxþm>ö©!m¾ŸÜïÅÙÁ½ž}~hwïègÆŽð—áŸ!ôŸk¥1¨ýTc¬ædö “"ŒÙÏ_ÛG¡Ö¥Õͯ”ÔÁvB ,uùw;ã_Y±â•~€i# ˜°<õUR[מ¥KOÐœßø~¢ßàc›;À[CšEøê·+³â&‘ëÛ«ÿ¢#À£üÒÇß_üjû°!=N:§wóHGf½f÷[„Ч•f½Z˜FU\T\&ˆŒ—+=¼ý\8bÒ—ëŒf"‘»yxyº*™Y_\®‘ðRmY±àà Pe–’Ð?Bá@U[Ný=œy^(Î/(+×RNâèâáãá*ቶ$«„øº‰…ÅZê㤔ÕQy+©ƒí…÷S²Š§´å0ï¦ÏïØ5ÀO_&T c³Q¿o*s–~²`ÙdVºÊ}™p2õÞ»½¢Ýv±Ì&uPJ¥<3›Eƨ¬'¼ðÔBè¿U`Ê»6ÿ¹¿ßÊ"””ëMG¿·öý‘œ¡ðç ¿Û~\eæ‰hðŠëýùšOctçæ½?ï¾&¨øæ)—'·®iõuø—Ť–(ÿLïs1/\>ùþÉŸ_™µ"ÏÀD³ ÷yãýFt‰ÜûQ‡É¹oO2ÿpN¶bÝæ–Aut{ëÿ¼ÇÏC‚Q+¹‘€ã%¾~~FYõv—Xb £N«×ë óTñ¯¾õL‡H³‰ÇÔz:ÅJBˆ1FœýaõÖ›Š-g®^¼rå×%/èd\Ù³mÝ‘´7¾?võÊÅ+§7ßß÷ü»¿‚»§»:ãR}ëÇcÛæµõ¼|t£ÂO¾M€òëÇ/•)_ÝÍÑœ=}ô«Aã—\¾|åÚk“š,^›¡GŸpÙ‰åÊ! ïßÒ2ÈraÛ¿¢-EGgRRRn‰~Sñõ×Þø|âÂweUSRÊË›†81ý|4 L+æÍ÷öf´€ÑÚZ¼œ¬]¤ØBý—šQÖ1Ü<éÅç}6öé!û¿´¦»Ù…éO¥%hDÉå½?&ï5€ÄÁÉË3ëÀŠ¬Åk4¢ÿs“^éÓ< 8 Þý£Ÿ>5½°êì¥ë:6±a nl¹j”Åj3V,ûdÊœRyþåÝeï0j ~Ï~0¶Xnª«±‚¸ºØŽ.¡ÍžhìýÕü¹›~¿’rýèŒç§îÍôhîÉL‚@)`‚ PÄÁ¹ï c7Ì›·fGrjâwóÆÍø`³ÔÕ‰Qj™ÁÚ–A¤Œ‰†rMÑ=0¼p!ôß‹)ËM=ÍžziŇ¯¹”Þø`ê°{/Zñ½Žp•ÚÛÓ§A€—··—»s«AS–-}ÃÙ 5;xyʃNý•ç^¾z¯øæ­´v}Ÿõ——å ˆöôôöñpun?pÑÒ¹á~î@ê× ¬7¼¤nSÿó¶³6§”¯._iœ={ù› TâÜè·M‹$4Í?$ÚÑË8YÓ¦M=9¾Q÷ óçé>úbîŽÕ@A?]:Ø©£&ß!.®‘¯«um½ƒbšwÎ/¬¥T½fΛ –.šá€ç¥Bÿ%Öê¹P\nŽî4ôƒ®CÔjuþåm£f®lÜ©«›“Ò!¤qÏa#8^Up7=—w%eÌö<àÙ£·ë¢-Ö‚Jß©mk%€‹“å- íÀN¢*ÌIË,u–U¶š*ŸçUG?ó2Æ¥”R*šjUii©Jo2Sʨ( ‚YEJE“É$Š”V̧ӨKJJ5z£H¥¢H©ÙlDjY ˜Mf‘RJEA£*U•kÊBè?…RKÁgøbæØÏ-Î׌1¡ä|Tƒ°o¤Ûýu£˜¶G®¦Yæy®‰S·¹×™ö´±VnºZY<›5§¿}Z.÷õâ»i%fÆÓÞ‰ô¿`'cŒ1ó×ïl1bq®–íYÐʳÿ/uÿ3ëà?»&ŽDæì"³†#!Ljål’TÊÙz8H+f$aŒð\¥oaJý͆”Ù 'NÀ’%pð n„Ð#SZ nn¸0¥EP©Õpè\»pêdd~þ·Bè/—-SêÛÌb 4ÈɘÜ<!„)U_XX3B¡G GHúÛùNª¼°oW!„¶B!lK!„B˜R!„¦B!L)„BS !„¦B!„)…BaJ!„”B!„0¥BaJ!„B˜R!„¦B!L)„BS !„¦B!„)…BaJ!„”B!„0¥BaJ!„B˜R!„¦B!L)„BS !„¦B!„)…BS !„”B!„0¥BaJ!„B˜R!„0¥B!L)„BS !„¦ÔŸÆ³½`U§ØÍd÷ß¿·Ð*‹­2õÿ k¬€å•ýJVY›*+úÀßUã'?`¡?*%j=¬r¸ýá2m…Œõ¿:¤ë¦ì±ÿj»_e_dT/ÿ y` ZÇ©« ÊBHÅ´¼¬e&B0µ¾ý ù+ÿ<–OÛ-ÿ!_öˆwR¹ÖU¿´ò—?ðwÖœ¥bJ•…B*ñŸÞHý׃ŠTgµ—£ä±-é!þÿ´äaŒäAE­eÅj®†ý}ÈJV¼ÿ€Ò«Iê. ¹wãt²!$¾u¡bÆõ³ ZBE @)qõ mÛ*NNþÚ& „ÆòÄ„d…GpDˆWEàÂýì”ì"Ò¤y´ŒÕÁ!`ùcCq~ff‘.:.Vɱª»--¼—x#1Ã@eMÛFºØB€Xf1•dž½|[#ðþa1Mc‚%„UÍàʈJ»tÚàâ€1…З†Œ«GSM=»·“Z˜›~óz‚q–ãSæäÙ¤U[?'ÎzDþÙƒŠbº}ùªÄ+4¢o9N !Źiw24ÍšÅ8;ÊþÇ¿ €‰¥y©§¯¦òÍòˆŽ=c½XÅ Ì¡bÒ•sɹe®þ Û´Œµ/f @AÚó·3yÞÚ¯Æñ<È]ºwi/å 0 „˜µÅׯ^Ï+5øG6mTY1¯ËŠÆÿ¥”1ÆVŒŠ‘µÿÊhÍ:ÕG=Âx¯={÷éÕ«W÷n"ÃãÞüd³†1f™µòÿ• ©²¬ŠÚû7Ç ì3gÅÁªïj¶ýJ¯!¯Ù-ŠV[ÛWTy—ÒÌG+¦Ñê³VNÚºtJ÷±/§ ïRÆ¥¢éÎé_Ç íѹ[ž]Ûµí5iÇõ|ÛÇ-3•¤^ž=¾GçnÝ{õŒï1à›W…*›€Úæ7–Þzª±ßóK~µ_„ÐCŠžìO€cëbÊ3ïZû®§£k›n½{õêÙ«W÷↿¾äNŽÚ¾ˆ©ZÙòUŠ€Âç{¶}mÙ6½Y¬<Ü;òýGq#¯&²Z>o_äÔRâÔx³â]Z¥œ©üˆIs`Ådppk×¹[çÎ;´j:ðó³ö£Œ1VºãëúõëÛ»G÷®]:üãïúª¿ñô†…-[·éÔ©S§NºÅÇ7 pÿN%FëWè 2VΚҳ{|Ï=:wï·jóÙªë\$uU›ppñðvW DáæóÄ .?›Ç™tÀÌwŽ¬1išKÛAsº80Æ©Þ%vÝ^”Îò–L*uvqutYãÝ:¿L®pts刭Ò@¥PñÁŠºF延Uµô‚ûùª7ò)³{I:üÝw;Ü¿?hàT ±ûÍ@tEk–.T{ÿîËIî¤ló¼S'ÎâÒ—®Öú€ÍŸ½þ}zëýßÏôWšwýñç‹>‰jüC—®¢ÕM±¬¨á矜Ê*©TØÖ !ôð¢‡SºÊ¼Ì"!ÚmÔÂe [z"œ„“Ÿžò‘gè³GXOÞX:9ìJ[£„Téÿ’9»¹;+å]Ö© ¥‡‡ Ï“ªëÀ(Ž«(¬EH•bÆrþ…@•F ±vº©ì`¬ü2Q E†>OŽÿ|ÙûJ£–1ʹøTtï€e¾Ä_¿y{éÏs×nèÓ8àÚÁ§ð†oøÑ \lý~-MÙÞåBç¬ÐN:¢Ó˜÷]¤–¯ÐŸØõÍgxÕq>gÖÏðæôFÝ.wõý—öøÕ<í&S8ú¸:8@—Ñs;~üÅ¡Ígætéai‰2J ÇAÞåO×lÍ,37jÿì³#|*¦g^°j»Fî7ðÉA®2k®€vó—ËÏ&•´î50Ò͘ÎÔ+–~Öå¹9ÒŸ{7fùì~ôúÑm¶Ÿ6ýI¾ý›Ço(CÚ¿ýú8gï_-ûýV~H«¾/Žîç¬ zhá꣯/œ̾“Ö .å”Þ¾~þ„Òjç«Š³2Î\/ùýäˆwÏi-Xðì>Õ—£\mCù¶ÇÛ~óKãPOè5èÉ÷,º“PÜ%ÀÛr¨b= .ìúöÀí"oGxáB§ìaŒ¹ÒÝËÃÃÀ»Û°7Λþª#xKc”Ž~^¹ôìÝûnÁÍž~Lˆ§#£”Ž°òuK]ÍçÇM(“*ÀZ£…ăë¾Úu#¼ãÀ¦”IˆDêthÑOš1ïu,X¸êÈð©oÄúñ™W~·õ€šº }qV—0)eÀ¸sn׆m‡µ¯ÑSßl¢`„Ïîýù—ƒxïÆoÍžæI£4óö¡å¿Ü7qBó`O[Ù"ˆbæ}­Ÿw‡(»sfõ_`~ÝåÝíõQÝš€øáÓ¾p sslï3`ëg¯}û¾ºñ°Çöà-Uh}YR­ æã[ŸJ¡ÿ3ã–l<©¤ëºðò¨¾ßœQ)ä2Õ+ƒ»¼½fｬ”o—¾=ö£=.žN2P>|pÕkOxoÃõÔÃöÅ“G½ð~bvþ…ŸÅµrKOÀX¾yѸñ³Ö¤çßøaã'fäÌÔPúZŸvo¬Ú“ŸŸ¹aáÔqï®*Ö˜ (é÷ßö/¯¨øTÔuXÜ€©ïÎ~ë©-“©ÚqáÓö‡=»Ç·u³ü»ìΙbÑ'ÔÕ®5ÊŸnf};ÀÝò!MAš†Sø»V=÷º¼„o¿Û×yĸ¸ÈF1¥úûE¥–.À© u¼DÊÛŠ §z©[ôœïæßÏ?¾eyÏ¡¯^L)"GHösb?Üx";õÒë¯ÍÜrì /—J%Üöwu|îû÷Òw®žýîûssµœD"Ë»¹gë¡ßÆ|.ùžÀñ§~\Ù{•1ÆŠït óýðx9cL0êUêr“P¥ìQ—ä?×ÝÇÝ+ÀËÃÕÅÍÝ'¼Í™ì²Šé”1Æ´ Ã:u9udÃ@¯±/.ÜÀjœY²ücÛÊ7»Lø8¹Ðl;KFU©ó¦ ŠŽmÖ£cÛà€Ð÷»[ýTþÿÞ?Ö–â™y÷Ú%2©T&“I$^˯𳶚àÔÒ’$À(›ºü\é±é:µ:3%áÊÕsÙfðJ¶ìOöúrI8EDÓ.ús¦ôõ×ráç('ïÝ dÒ”ŽZ• fÓs#žvW*xŽf%]‰Ü¨OÝ·g÷þCÇü=£‹Ò·H=¼ªƒß}sþVŠ.$þZRâ“%îN½ý‹n&gx=9ëÒï›ÂÜ)c…“‹‹#Ïì/à'¼(‘1ÂYN±¡8õÛÆGõ~3ªïË»æ?É,g¶*ϸ(¼Ä÷èÑØ_zöÔ™¤Rj©ŒÒô+§>ûæê3/L’µ6á,ךâ=Sý•j¹ÔÙ£à·Å}d2™L&“˜µµÏ³3æ½>Ôz°a”B—Õ¬üŒ»¶ä~Núù·òÕÂqêÕ³ú÷ëÁˆëÙ*..8ÇÔK?æÃÀYCQ¢lÖ¦³‡”1j0ù¾2¹µ#\>}·X-š ïÚ»gÏî½i>=üË®Éã|äÇœ>¢›£¼bs‘?¼±Íò#Š¿ùêÌCwVí?ÿtû0ÆXÅ•@@ÐÞ/Ò{úx„ œüÉ@Ðå]7dô¦--ß›ÒǺ§ úß·}¬ ê×ȳ,1!Ke0ñ9©—¯ÞhÔ´©œÇr¡?˜5%>ƒßÞ¿qQ´´Z§!–óÑ'”å~¿|ÖÒïNKÜ\\8š[jä9˜A%bý¢*ÊN/W…³œã4÷3Äà'•g;+œdR9™´¥´+LYw¿^±TÎYÊ©_‡V /ß×æ-*xë÷§=SVªmÔâg¾õæ×ßšþÚäÑ›4ÖwZªa IDATú¼yS†zÈkístõž÷ͶŠµ÷}ëã~l1iWÉÒá5`©£X^ÖoÞ¶. ²ËØ'[îH¹ò›~ÄÖ˜±Ö–¯>•Q.{¦Më% ËKýòÃÜ;OYóþ$æNkÒäýåÍ×¾Õ¿.ïš’üƒû‹Ùd¬–È„³\Éo9cczëÙqw;¼µsŨ`_–u}ò´×Œ"@@Œ‡æ§‹%,È‘Á¨+ÎÎà<ü9yFv†„ï šËÒuÒvö}´„pr™{Lûþ»w¯q€’{×òݼM¹ç´Þ{.^+ËËH¼~pì˜çÜüŽÎî©,ö|áÎÌü{I7Ž®{þWš´9Ð/:¨j§ïÆ}qæ§ eø¿²ÿ}ïšWÓõ×'¬œ¶é§N®œÂÙ×ßGgR›dÖçwëüô‰G9½W¨–ìÿñ­›§¿Û²)X‰åB-¨¨Ù¨.ð®r¸Z3Š!p`þØ7öI÷<Þ<*HqÿƸñ/˜ˆc€Dž—y š€±¨D£r¡‚k@¬4ûè}xÍ—p Ö•é †Šû-×Rñî®a§«6­mh=` NËn容uKòþ·{?4—$¥$óÞ¸#¹Œ“3sÕŽß¹`,Ⱥ›xqʨ±¯êܶ}8°ÖâEWštèDfç!==-e e"(•ö…ºÜÇÕÅY`ZkÇ(€Ä®Ð]¾rBÚ$ÆÏÙþV¨r½)WEšøTÌÐÝËõ\aÔíÆuÚãg9ƒc)â-'ŸjÛ…±f€¦ ØݤIt°¯©$cÕªeÇrd¼Á.C5¦sç|~!!£0?}Ëwß<•g–ø>?¤ÝÅß¾Û¸ûôý’â‹v®^{ÚÁEfùN뀜¤aL+šñû‚¯Ž©ÔY·Žèþć¿Þ4¨R^ÖûÓ9·€˜¦Mü\df‘/Ï8údÿ'¹šæêÒ¸y7G™Y¤{iãêo¶“A)µ^aCLyë¿X~඾$÷æ¡£)MšD_Û¿{Çöí;vlÿeÛî|FÀ¤=wø×m.2eœ˜sjÞ¢õ yÅ9·n¸^$iÔ¤¥ ëòÑ/¿þ®À(ïñü×»wïùýØÑôöôò²#»7+±Ç¡?Uôˆ´âŠ#k1T½Ø±Ô-åszbžOXLÓè …P¶sÛæó‰ÙÀ€ã+£ºÛ´l÷éÛÅ%{×m¾t-ŠºðNϕboÖý¢ôGwüº«X%BÀî{ZtlënLüléšôü’ÂÌ;_Ï6êÕ/ËÊò>}sÒ+¯+aÎáa £¢B½®4/yÎè®;(:ùDÇÄy:F(H»°zýæ”ûjÛݸ @[–ùî¤Qó×Ï/*ÉI¹ùù’ež=§usmIÒ7«×_H78íÛöØKöœM()Ê?²ý‡c)¦¶ÝÈAµcÚ]çó-HYYÙù+á £Ü¤@Ô¹·¾^õŵêãíÑ"ÚûàŽ'og•œß¿fÛ²žã-±þ/ëñ³¶¥JGG™e_)” V±¹IÍ "/½6üååo>µ'HJˆ{PÃÞ—6®XÙiÁÌ·W­LzúÅéSz*¥¢Ä¹Ý°!¢^×â¹Yo\}~Áœ× ð" <6X*Pàœä×ï7{bæÔÑ˾9zW¹(CÙýU ”‚ê…I=Ížrxm¡0‹ë4i\÷hW'߉ÝÖ¿õÜØõ!îE™ÙM‡OêÔÀ‡dûæÓ¯ã' ÷¬9R!R¹ƒÒAnM~sÎWK4w—ZPn:¾õÓÓ›-©ÌLz§ÕÃú™4'÷lãÃ)/¾>ub˜Ÿ‹2(¤QT¬'ovèºúë9/Íž>nO4PÎ[æD€ñ2'G©¥á£ïüö+ÏÌX°nâé´ü^¹ï[ú8==¼Ïµ+Ÿ9ÿ›’hsKdkÖ½íãÉŸ4`Ñgo^ø%„•ßW5ñåôþÀÌùɧ–®>Ò¢S„oÅ­N„¸vY²hÚüO¦ŽÙÆiòÊš¯þê%G`yÅw>_ºjBÄSmÃd^˜w+iÊÜ™Ó|\åê²²®“Þ{¶o$h7­]În3 ­/ÐéÊòtò‘í-Û¢<ëÚgŸ,™Ñ|r󎾓Þx3kîÇoMëá¢ÈÏÎí1wõÔþ©ÃR§îÆñ %¹i…fÈ.ÀXIî=-ï൲Œ1B¨Au÷Nbn‘ÚÁÍ/*:˜+SåÐ8.ÆÅQr?ýnjV®É4ŒpupœÌËÃÙ¨.¸›”ZX¦wónìc.×{xd¦ßstôtUXúE£>ýî­¬B•ÔÑ=<¶q€«Œ1fÒ•Þ¹}·H¥“;º6ˆlêåÀÑÜϸ“–©Öš•®‘Ñ1žÎ  /NË,áB£ÂÕî`À˜XV”¯x?0 úä¤t¿(oYijz'!vc7òÁ±QŽÔ\t?GK•þ~>r‰˜œ”‘›g¤¼»oPdÃg…„h‹ò²Š5¡ #RÛ— Yé÷$.>~NoëEèO=BIvr‘ÊZ^ZXPÎüý}•ÒÚËJÇ‘¬»×R² ‰Ü5&:LÐÞI׶ëÜÜE.5ªroÞIQii@D”'/rŽnî®Î<§O¹™UP&wñ ò6™‰Ÿ¿· ÊÈÔxĆºYïôYé©éÙ÷EÞÁ?8"&ÔÌ:uzÊÝœB5Hü‚BbØQ¯Jº}§ L+uplîïÄ(Ók‹ïåkƒ]l#0³.ýÎœ"‘9†EGº1Æ̦òŒ´÷ †ÞÎ1•åÝNL-ÑšÜ|ƒ##ºÈ9&23î—à OÇÉ ËÎÎwõ õtâÀ¬-MËÌ÷ Žöt$LU˜}7)½Ü@½ü£âbܤq0©Ç(¥jmÖ6ÊCµyí‡A¬>¤,±öW«=`þŠ#Àî»ìg®9Ñ~µÎYsØÊʳiüUµ·/«¬¦ÝÐŽÕ–a»QœŽ6‹Ð_ïÉ©~ØÖ2Žje!S1ÞăZµ?új-yl=DEV²¥Z9XcâƒÉ­R8UÞ¼[9ä­e »ßR[¡We8îªCcWÿg-ëX§U‡)…BýeøD„Bÿñ”ªõ)…œü¾êO6«þd0Ví!`vŸeÿ‹•CÕ­¼ô˜¶¤`õç²*|véßPW=~|þXå`xâ4 ³Ž+lßZµsÙÖM\umlCWýµ\!„û BmN±‡=ùðÿ]ðÔº˜*åIÍ©xJ¹~¦¡7NýžšW"€å1’œgp\§vq ÛßîÁ§ãªü±k¿éÙöiÆ(-Ì»vE· r²Îk.:´ïh© lÕ¥G¸·‚2 „ã@¸~ê÷ÄœRGÏà®Ý;¸p•Ç¥@8V¼{çÍÞÞá…Þ=ær.=QB˜”‚ƒGP÷'Ú;I¹?1€Â”= €€å¥\ÊÅ#“ cÛtnÎUÔ¿A—·gÏ1³sƒn]Û{(%ÌLô§”õo+|ùùÏ÷q‘)¿<~ðä›D!²Û˜eïMôP`Ný©+Â;ýµõkRJZZZZFZò/«> oØòç#Wk>ü‘Öx-5¯œóú‚ÕÛé£ÉcÚ¼×LÕ?2*nÖ±|Ë´¯¦?Õ¸ÿ”ÛÉ©)wo-y¹¯qï3veû‚ˆÀv›Ž_MÏȸ}ùØØ. _\°Ë2†9c,yÇ'þNaÇ©q4i„{¦õõn3 5;7=--ã^æcë»ÅO\sÙ`®9²w-Á^?ë¥Ù+·èÅÚ@n)Œ²ŒòX~4á~~Îþ56oÑaÿÕ ÆÌó‡uh3hjz^AÊÕ=£{´}sãI ­ÓÑÄÿêö?&J]}ÃÂÂÂÂÂBÂ"õ~">Àp;=W „è ÒÎœ<~òÌ¥ûe:B!$;éÂÅ ­¨Ê:uütâ…3o&\»pézJ ÄxÿÚ‘#§‹iå•ýÀ2ÎùÃŽœ2#_ñLL(»¾õÒí'GMŠmÛÿ©gï'œ½’L¯ìýï;½g›f¡!Á1MÛ1ðö¥]@8€{“g¯íõê3¼Áˆ•„þ}F„“:4ô nФÛØøvá—÷ž2™bÙÕ³'ž8~¿Üò n¢¾ûû¹›Âõ‹—®'ÜJ¼{ûÖÕóÇO^6S&è Ÿ8•‘_f=ù „äîß–íÝñÕ'b}|ú ìâë OÍ.…„Ÿ®$ zî½P?ïðæý{uozhÓ±â"#žBø«þÑfYÅ9$Q`¢™PxàÝ6ã¿ÕŠa ŒèòÑò5Ï´÷Ù³fæ癞;_¼RðÎ¨Î—ï¦ ¼êÔ1=›©NÍé32aŸ!­—5g 0qCì" _hÕØH ¨3ó5jCTã@„9yºËsî^4ke;¹¿«‚cL4iJ²¤’†Ž°là“ŽO/^ÔíxëT¸ ô¯ìB¢”e@8SÞ¥öme "ÇKŒ&~Ñ·?OÜYšòÕ ’—4KíˆóÀÃ!7;é^ù&×ÀÎ[ 9ç†~ù­egìãÑ€ÞHˆ(Ë*ÒëÍnnÎÅy·ô±QËÙ«ÀÀp¸w¦\¯fà1USŠŽʳ2³$€h8º}ûáçÏ¢ÂHÙ¹®c¾éõþk_í Tûé´a«–|ÔeÓ w¿´UÏ÷ýüÀŽá­ªtZCI@—z6¾Ç——.ë"xûð³î1¢X9Q¥Ó˜G7gpR‰£#U:OÃV>`,/>·kÍ¢ooŽ_±Äàö¯}Qº÷õ!º3G«ÔxðäBw. Å…÷Mz#/áÒÎnÚu8¡Ó¢•J·úÍg4MÇÝÙ»Ø`÷Ò‰S¯‹ïÐ.Š“èSÎìèýIIÎDgVO¹=à“×GJ‰ º:°Ç3(̾lw[9¿g›^íG¿>ªåï¿íT6Ó½ECÝßÍ¢§Ÿ»5ËœeÎÀ4zAÀ¿E}N)&uñÉY7¥ÿ&¹e™ÂeôË3zv‰½±e‘Î9øíi½1àãŸznÇìõÙi%ÀÊ%A/¿;¼5˜u:­Á Œf)cR·ænUÒã'6Y•7€åAöÀ´)·ooXøúw—ÏΘûö°Sá¥Å«¿ûÕÆgÈw㕶…`D!ôø"œ)ãR·Î]€1Hå1Ï~´pX,)?nÍ™|g±' |iòŠo§ž-,‰Fb×:Ñ€š¨Ñ -×E©œç.qAå@AŒbÈ»#z…6È)>úû µz9êŒ"OpĶ @ñn©zžRĬ)öyêõ›[^Uºù5 öá ÔzJ©å.c7©ÒUjÐ "˜HH‹ŠvËu€P9”VíÃmÙ8;(¥½ZgðŠ Ô¨gœRæ ìûfñìO·„v{êû­Sžh `úþ‹/Ï”¸#¿8#ÕÝ»Béª [[¶ïÛ)Âw-„ë–”4°ñ¦ï?“P¥L¢påÀ˜”eöé\ñØ8pórÓJP8{yWÖlÁþd’uœu»Û¡6Ï™¸ênÌ•[=9MâÓñC—„7þ°­›„W©Ü´&='¹Ÿ[Z¯S ˜`–ûG7kÒÄ~ñpô ôT‰‘s—¨ÌúRA®”(T{•elEFX.øƒÛn݃|e\VF)×Ô˜4%eR™wX‹ìck_þäø ï¯|û™^¶™CZ÷Pr:-é#2Mn#ú 7“âz€ý­Â¡Ç§pnÞ(¦ú!,oÈœLƒö1 M+Rs=]%`†jƒDb<€Ô[Ö¸ûx~‹‘“<9` ˆSLÇÈMi9nCb8™v­â ¨è lêìàŒÅÈ_þÛÕi³›PÁ,Vo™´|¢³ÒœúùúãÀôÅG÷n5óÊìï§&rR„Ó&ÿ¶lÙºLÊÕÄ–\^-‡GûüðÃF=áôÎ$~mâ›K¶nØá×cØŽQi©©©©©))©9ùê®}Ÿ^¸hégËW|þùçs¦´ã$±Ÿ,~whS·Ê¦BèqDf®Zgf bF?å³æåÙ…Âî•k“œ›wðubÿ0ZF)ï(ãciÚW«¿>7¯â?Otì×wËÐ$Þ}#å‰Ø@‰_³1‘®?~÷%€&éàþK]‡vñörÀ¿Æ_oßÔëæi-"f5 UnH Œ2Æ’æíѤU»æ¢šv¸ïÖ}ÆØçÓc$]7XgÓ/Ÿ5V!óš½í¤†±ÜŸº¸ï1U½gŠRʘ¡QC£‚,yGHˆþîÉ_ÕòF[7—Ruò©ƒùù¹”sômÛª)/áóOÿ\.s£…7’o¤EFðÇCÿùœtÅ…yEÞ #J“¯D¹OÃ8…„PÆO@W”›yÏ,GÞnŒ0F8 ªÜ¤dsò ‹rq–ê&Ž0ƒ*7%Iåâæ*ç…¼¤Û:uòõôuƼ”»'·]/Žˆm×X"bC Sªž´w}òäÅÐv½|<”ª+›Olÿy؂ߢ]ïZ÷òÝyxÓ&¼6ãÔÆ•]çíéÞ*XW–}þ‡·îd²Ð¸hÍÅ-'~Ù2þÓ =ãm‰YÀ¨64Œ`D¡ÿ8Æ€#º¬3Û—­‹íÕêî‘}FÜc†zi†›Lb,¸¾ͼ¬¬bÆ;‡tð~LL$GÀ¬J>¼êÝ´ŒJ¤Q=ûN˜éY‘x„™v}|þFyÏ?òqË?ºrÞ­[ FJnamF¼Ñ¶GãÂC¿då Fã™_·lÚØ…Š‡!¦Tý®Èq2Â;Gu1·qSw}^òO¯õ=¶qMø˃=£z xú™¦­|]Á©‡óµ¤Œþ‚3î¾›ªí6ãû–Í<…¢»_zêvRn‰DB ·÷¬¿{ørüK«Úuki*I>úË/­ÜÚÓ™3Ãé•Ó7­_Ö¶Ýê ~oïÞnj< Y‡æz•¥[¡ÿrKŠ5–çgœW¦DÄOY"5æì[ûáîoǼ:æöæ G/ÅL_¸XA„„Þ>udTDï(½ñýÔK÷âF½ôšÌ¼{ñücÁ-‡Åc¼’}ç÷é&- q;ÿíø“—É ?p”CöÕ½'×Íut_ÓmRø±Cê’ðÏMr0F¦Ôc@4Zuñ t7”3Î5²sç–/¥SZ |±¼ðÞµ]Çso8§ð úâŒKòÀvaáž&5cÑC—î¦rïâ+’‚„ª¬ j1j`l(ˆ`(¹TP¢¾õÃË÷6è“òï”%&k¿på "eT0™MÖX°Ç! D樈í÷^“v.Œ»wö§]kÕFFØðÁøÈ€ )¥ ;Ñàvi9#D*Ü<½ëv¯o÷6‰‰\Ç!å† ‰'á3­8°}_‡¾j×:Šò/í;ÖôÕ£‘|€WG‡Œ‹o¥ß8×b°³“’×zù†6`F¼pSê1érà$ Â(8º;‹f­¾8ÿüª§Î]7ÆvԨ׌.×·ß P“`(ãda€¨ƒO¨D D3ïÔ°ï›+òv¼²qÙÖ™OÅ„íñê§îÚ 7˜€‹‹Œ1CEÏ„íðĈBÿy 8‰Ì;ÆE4•@XtC¶í˜^gôô :ºrì7nMZSi‘¤g;Bx1ïxÙ@f62‘€®ÏpRvH »jÑÂ5áÜѶƒ»ºhS™Ã¹:œ@te%]:ŽD`Œ£T‚5EL©Ç'á59…ær ®„’ž˜éä¢N?|'Íwü×›cü¥ÔÎ~EH•n ôIy#È%DêD¾x>=òµæâæ×¼}¸túõ÷Þ¼pyPsŸH¹ì¾÷ô ó ”¦žJJÐ4 ±j>2L)„,瓘Yà`6€ÄAzpVÌÙòø~Ó¾ŒnßUÿë-n IDAT„-™z @x&3µ^OK %åfW ;Î8Ð9øîÚWž=³£wï ]ÿÌo-=,-&ÂID´¯%Z¯Ä¿À¿Ø¿á®^^ªÌºº3#ñŒ¶¼´4uß±³×CZNqàM¥Ü V•ªJ/l;˜"!†2½QâÛ(žË8xù൮\{cý†Ÿ»¹»PQÍT0€×ñ]›7úmå<æÖʯâÒóT­©<ýØÊÉ'ï% D£^mÐSŠ} Ut-&Cö¹Ëñò…ëRçwÇÔ›g5½ç~ß­G77%)*Ô˜ŒŒP‘øV¦Ÿ½G8ààêÊÑë¿]O)e¢èÒÀÍÅ+ªCßη|_¬VŸÞt³¬Ø¬)3/útD—£û/¹õ¦ìËÀ¶Ôcƒ 4°¡ÏÙ­Ë®0:;%¨ßâAÛ’Ïè ]‡–NôôqÓ3ÿø‘½NûòxXt—î½z<7áàæ¹éG¼µÙMž™ß¶IHþE/ßHZtŸ»òÞËÏÿ~^5ú­%?}ºàÛ·ÏK ÷IÀ ‰Ó{ Œ“ÆE¹¸ñôþ€ƒHÍØÛ€€`ÔÜ8¸€–©¯ž?y¾Ù ;òШæîg×ÌséÛNqéÖÍÄ2Ê%'¤ÄµŒ‰Ÿ8fÓÒA»G¿ä¬½~êVY×Wâ ©(P@éÞ¬ÿäÛg&Ÿ8y»õ°)Û׌Ùc~%ÈGšzâ'IÄ€ØέÀr…T[rãÆÑ£1OÄË)n{L©zO4i½Z6êéÂÄ«ïf¡á.5÷ð>ooižt©œy‡7à)·:) h`6“è3ÂÚÎJNR· Rè4,¨Ã¨ ñ£ å”  ç?¿á<ÕƒAŸôEŸ¬ÛgEeÃà¨@0Hp­_Ùpã<ï)ðJt„0¹“{›“rü`bŠ6“×õè+Hü;ߙ֯=¿ã–KDŸÁ¯zóà†;—cšEG ùt°qεû͸ÏZ¶nÌsÛ>5Ýß ÌF¦hСçÔÙ×oå…Ÿ3Râpþì…„tê;<~苾`4@tŸÑ©Æ}7ïkØ+^aÄ‘Ê0¥êûñÁ“^¯.1KœB[vaôåŒp™@¤¾qü£@‚Ztaˆ"3ksò oãÇDÐi"š˜ÎDá,÷ÏkK‘5í D£õcŒŠÒ ™¢€W¢#dÅI¡tïÔO/pr&Àtñ^W£Q”9ð@À«a/à9`@AÞrÜÒ&:r¹#£Ê€þ3>1k¨@ 5²à£Ã»€A áf†õÍH•<Á,0P61„0+9g9Pí_#ô÷Cò8ܺdÛÛmu5A€ÂBز†ž‡×^AxÌòS =Êcã!—ܹo¾ A\üü3¤§CQÖ^Àž@ô8-{;¥ RAN\¹#F€Œ ;w8:Ï×ózÁêP•à®[w;ü{WEÒ´«gÖwãîÄ€ÜÝÝåpww×ÃÝõpww·!q×õ™þ~¬d7 '9¾ŽÌó&³==½IW?UÕÕU11Ÿÿ¿~µ@YY&w>†^½€ÇƒZµ qc¨^Ê—;»®`éŠÅ¯)ƒj5DDÀë×pó&ܺ‰‰…›Q¼z<ÞOú-h,-ÁÓóg§R–¥þ«˜4 ^¼øŸÌ¤§s_­†›7áæM€ N°·‡ŠÁϯô‹R‚€ÌLxð’“!2Ž…ääo6NM…Î^¢U*¡F 8x„ÂR¢J²,õ¿Åë×÷3ìäI8y4€¹sÙ¿‹_ AÀÍ›°cÈdјa~R!5àÑ# (ÖãÇâÿãÆA\Üÿzzq8pñ"„‡³AXôî >>àánn¬!Åâd)++˜:ºuƒ¯_áÚ5عó›ÍÌ`à@àü¬k£FžžÀç—ž­)–¥þ·<˜ÿyÞ1¡ÒÓ‹a)è܆kk03ûyÅ’‹ïGGpt„ÐPhÙ–.…sç`ëVxõ Ôj“f0{¶.àèçd\’.—µ¥Xü?Ì-€6õ £`N‰ƃÁƒÁή`®³'Y”1$‹A,†¾}¡woJáÑ#˜4 "" š  üÖ–¥~> Ÿ9kúó5þG€!Ý‹£#´l ]»BãÆßlÆ‚Åy‘üë)\HãpÀš7‡æÍ!!vî„Ó§!7÷¿°–"iýÏ°ШUJ¹œ@ØAÉÏ»#ønÙ”Íеÿl šµ³yñbضÍd)t@Š¥($‡Cp~V–"IÎ_ŒÍè r®®0gÌ™Réφ^*ñ`)m$>ÇQf~¸óYà¼Br¹L­Ö”ô¸;FˆÄø»í1 ““ðÑA$þéôLŒÁÖ¶pMÃñF,þ6Ô*e§w\^A:2‚ ˆO¤B³ñ;°ÊJIþB]T"0‰„õ.°,õg8;9ŽêÛ>%9‘0Úb¹sçNtÜ'²Ä1iß5±‹XìèìNÑôO”'ÆØZ2=»ÈårÃ4âñùwîܾ}ûSÒÈUãl'ßi¾‹y(ùñ Œ! €”Ù2ÂJÌ3¾ŒhEf¶8K3(8Úü2!&'+‹b [k.ƒ1a: ¬4jµRŘ› Ù¿, ,X[êWÀûË{Úw›ý:V 8¡‹Õ}}|ýüü|ý+†T©{öùW#@¸dÆ ˆø½uŸƒ¯ Ô cDy¯¶Ô ©àïèïW­óôWŸóôçµL†2b^ŒëR³R`E?¿ò¡UÿD¡ÒÄ# H™“6§SÝE›.³V,X°,õƒQȇfâ»ûÆGŹÝ@£”edæª) ˆIûÑêhfVJ|bRjôÓ¡¶òÉó×çË#(‘-…BX“–ÿìÂÚöó_*Óò؈üºQƒi†Ó3^Ý>å›ur鶃2!€B I>¿kþ}e­‹O¢32"kÚgÍêÖG !#Ï!B€ ÕvŽZz.–R«Xy`Á‚ËR?ZƒƒÒ¨r™Tš/“+ÔcLS•Z­V«eR©†ÆÚ62©4_*UªÔ4Ã`\„s ~BXCWÈã’–^¡ó»ÖÌ~ù2U¥Ñš*%DjøàÞ[X*å„ ËÈ8z,ÆÚ{ýœß8ö¾¡[tŒ}ù(;/×0¬¼Ø¤gOz h]ÞE`¹°ã„ÔIù€°n7JktéŸî_{Ó¿v(£¡Yy`ñ+h¢R‡ÿBY-Ñ~Ç7¶oq¡N‹Ù9ƺ1ýÉk *r±ûÊP*7h8¥mc@ˆÉ:²záÊ'’sTH`Ñ´ÿ¼Ýs»'<;8pÃ[ÛËvßõjL#á¢1Cö^~!£³oÝE«6 )û'¿,D`؆p¬VcŒ0”КÂ;V9}ã1,®lq…1âC q¯1q´«ƒ®´7Vª@r7ÁHç6C§ºûhLÎÌåòžžÄèv®”éËF ª1þX•äuo5lQp¿ˆ”Ës3RsÕN..„";1=S­×Àɵ¶u°±$ dª.ÖÈÒS“³¤´®ÌØ{ù[ñ°ÎGt»ÒŒ2÷k|Šñìœ-Å|Œ Û͘R«’bcå@ €kíîiË7¼$/3%53H“»‡„«ËCˆJ[.ÂÒÅRøzjç’­W—\xÓÚÏ2÷Å®¶C6œݽ¦¹Ù—«e>ŒªæëzmQ³]¯ÍÎ}H©$Î_<¨ãêõT]7ÉÞBð-ŠÊ‰‹üC() !gÕÞ‡ÿªn^‰ç6 (¤“1àT£Õ´Úéw7O¾õ(¨îH[ 3"‰AlãÔ´cgˆ|z÷CLä‚57Úv]íÌ×FXè~À™]Ï™wz7ªêâÁ2p@Æ,Éæådñ#$T'2º‹¢m OMŒuš[Á¢5O.ì³-òÜ«7¶×µ„cå(â’ Öо¡-ç.œâaƒJjH!„T±÷güÖåxŒµ£9ÐJÙ¬kñ}Ê!C ¤É‰Ù·bÑÖ Ïå˜W³Í€ÙúºZŠ±~˜ùiŸ§µnp[ À€øBUqÅûÇýµ¤DÞY4où½È8‰ëöŸ<«+{s^)¤¨ÒgKaX ±´ oŸøá]óª!Žžm"ƒ”Vç1>ÆN®îë ·bÅÃA§?V€Ù€QóËÄæ ¸ÈXŠŒû$’Çë†Ø¤9Y`å½tÁp‰X¨ØþŽ®f*†&B‚µó˜Îý¼å÷{NÝsë6yH;K!©uKbTðÚ//®Ýy¤R Íí)5žÞ’"¤ß[?õžÕ×—ñPI’ÏàZ`)ŠÅ0 2—#ƒ$èƒe‘‘lQ•îG(ÈyŽ€'”X[Yp<¾ØÖuþ†Íà¼äˆµ f›g»gÝToII²¤kÛg¥ÊÔâJ 7Ì©[ÖVC3€WWÐm ëGµ{bŸ…Ÿƒì;ižùfæÔó’5Óúˆô¶“ÄÎsî‘óy˜$\‘æýþΓ./èâ­{…,rö¸)i~vÎnOfDŒíÙo:Ù1¦)”Jš*],¥ÓölØan>uàüÝ÷OÊ ËúMZÓ‡`4غœ˜k }÷ÛLv—f°c`õ®fa0jE@‡qüi…qËV®UÉËæÿ©¤Ò¹*UôÙ!£ç‡+¼†ÏZݶI]{ žAÈÁè­ÍûkÞ\äÕõÚŽhÔ²yk/¡^˜âÇL\ÎwïôöØ–y9/?¥å%œßr©lÇÚAv6ò“ÅOmЊœ;—ÏEÄg;UhЩAÀLnJÔ…‡ŸÖ ½ýQPí:eܬ!?úÀákù„e­F-*zX2:ÝÊh×o1ˆðöñós5ðó™÷µ×Œ{ѳ¼+[—D:1‚”œ<8Õ¨VÁIhD²ú\„ îð¢“Éë^Þ­ëIx.X¤y“cMi0ðµ&âòEå‚«z:úlÓ¹[»óµÇEòÞÝ~f¹ru¿{€rKzúô¸tÆ4-åG8¥N0£óê­„4옘˜˜ûbÊŒ Aù‰õø®6‰…Z™¨¤Hó5üÒûŒºujš‹‹óø!`(µgv­kšª…Æ à÷Ó4! ª[û±ÙµÇž?ÀÍNRÀ— €è××ç.>2tæ¼Ú΃ÃVŽšEQyZ–B@gÊ,ü,³Â÷|:=)CÉ<>{ç]ãÐJvÖãÇâÇXS!iZüê™#Ž>K±·ä%oÜp¾×ª=³Zå%¿]6oÑ¥àJWžÉO©éšw¼iï¹J¡ ŸPîÝdÚ’Õmkxœi…åc†2H‡'B*CQ%]B@)KUó-8Š¼´”Rhec!ÀŒîíZÁ‰:y]éåßÖ“ÌÏJW/¨Q×Ê Åè{@zÂÓj”?kÕùV÷0ÐËßÊVĤGg*êÀ«È43+3ío¨ÚR¥KkÆ€ˆ«»×¶è1Iγ®Ú°Ã073u|L"¼V]_±tÖ^í‡îX¾ý¬\I ÙCˆ6 =ÐùÐw:1­óaB(#öýé3W³”8bמÇ*›]kGSBˆ ÔN¾ô<Ñ^ –…_¾­í áÔî/V5ÝlpüÇg§/=É”ûï;zôÄñcÇŸøcßæÖ5ÊÕk3þТ^–XŠbñcÄ0qŸÜüHÏ9|ý•›;û…ß»&C…ÐÑIÙæ¾u_ÞÞ]+@8vü4TwîÅ §O?Ø·:±vãîÄ¢¸qD¤½“…V@ä —OšeVÓ;ÀÞÈÞú‡k£Ræ§ß»¦MÝ`?ÿ àJ­§žFa¼<¼MPÚ U}[Ôöõó÷÷÷¯Ûuâý5AhÏÐëM=€ä<¸åÖÔÑíùŒvGð}:NÜhÛÄž]ú èܼΆ/·®§7äJ]˜QÚäš7qO¿P­^Ëa£Fµ¨æùJí?pj[µ4_&—kh¬mÕgÇE»—³¼CZöíÚrææ ízö²¶”`ÃâMkTR©’f€‘Ji¥³E¡‹•,O¦ÖE(½»t¬OÏ Ñ‰w^Få¥D–å#œëôú”” \ع{ÿÕ,üBGÏê½nh÷úíz èÚ¤|ÿí‡- s$4.ìé:lë»$ÚÂÒÊÆÆÆÆÆÚÊÒ(x–$Á!›Œ„Åqt ’ÃÏMüôîY¸LjL;÷᪠¡ÆÑÁ¥e“¶®vftÚÝ[/„³¶¶¶´´v(Ûqø²)¿5çk@¿Âê””PÙ>"®VL̼D¹¶^2a€¯¾a{ýAj0IóC›÷>sçMNNΩ%½^ïì9ëxB„Aä"-êmr™î‘i‘Oι§žß´}C†²`MпG—ÿ8L„ÕöwÁˆÐù,1(²s2eâÁñóò´´Ì‡c©Ó_J†Ác*ÿÖÉýK–,;|å9ctcƨôÆáÍ+7îý˜£½©oSÐclxÐèÞ÷-Æ cý’Sô]Œ±À”@&1ÆÓ Æ˜âWgÈbãV§'õ²­Ð ›Ò=su÷⪠û<‹Ë."«Y“»4±÷N>­_|0Æ?ß9×?¸Õ3ý°#wuuðke´´E¢ëwhII½ö½êÞñ]Z;­³Ž7è:´A¯xÆðàÿƒšcÜ¡‘­ö·Þ‚1Fæ®åû /oô%c#?¥6_±ï`ÁâÇ(Í´B©lR1Ú—Ó÷î½£¬\Ýì´>@J“uûòµœïÜØ×·¾É•Ê³SãîÙ%·­TÇÙ°UºÀ)…¢PtE/l= “ÏÐö[ÿË‚ÅOkIâ¹WhäÂÕ§oˆ¯}ìÓûÞ=FÖs–äeb’Ð5"œf.Ÿ5|Âð¡/j[Ò™‘1™Co èík=éš.¾“¯¬ì‡NœðiæªÑóv’D‡?/ßcòˆ^Uéq{VÌHrk½vᾸÖö½ºLq¯z‘—Ÿ/œ²¸¯£Û±bøլȗWø$€25"öƒ[-‰.œ]%Ûk@ý ¯WwëÓçÅëßgOºPI“ž¿Ë·z»¯ÑÑåÒµf³•;X°`ñ“°Œ:îã«ûOßæÊ)skÇj [•³%å9‰OÞÄU¬\ÃV‚ ‚w.?ÿU…ø¾•kT äCÁatŒéìøè· Òà*U8™ŸŸ|ˆ ­a)â¡ï5H„PÉ_Þyô&[ÎX»x6jÕĆÀ”Rõö…RèTÑ¿,ÀáG×.FÆ&Ð<‹J5jWñu%Þ>{“¦iX?ŒGRË>¼ WŠ]ʹs Œ5TÖ½kÏl+Ö t(³=~ò)> ñÍ=}ƒÕпºÔP°,õSˬ±O¢HŽ}Øê·Ç}„ 2gñÓó”>7^qI‘ôëB&©` 'j ß7ö~¯©o:HC‚&ãþªË·ã/gìrÔ‰+ "£5y•Îc"l–ÿµKŒ“%[EÐ Ãè¶d†1À2daѶ2½©}˜ÁúùŒ1£û”a–¢Xüôj™áT¢aA7Ú#Ö1ÒÞéÏ'šR64ÀX6õÿ2Èi-¨÷£c1\¸2 ̘栠4\8ã‚Çõ_J§³õ¥þY}©bkM­ËzE®ÐÝÜØa°±Tœ$Æ@DÄæ‹n¡•´¶V÷¶B5ú2U „¾¾¼Ú·Q%> vݧlÊ¡ ݤŒ‘ÿ|ùFÚ3…ìbÈâguìÅËß6ý¬ÐÿFZ›ÉÓÆ‘G€Šéö{²`[’…bq |1“Û·qþß ËR¿®$Ȉ' ¥¸49œ‹u ^‹4äƒõ c§pc„`]ºµ;,£n‹‘F“›››}¦ÓäWŽ¶º´F W6¹´ãÆGS=×Ô-ÈÿúrÖ” ©>}SdŒæ㾘=³Œ?úÌÌ {Ùæ·ߊ6‹, ÿZÑ-ra¢ªbÓòR¬bȲTIŒ)„ÖÈ¢#^=xpÿyx”œ„2?-êó×ܼÜ7ÏŸ$dÈBŒ2ûíóG=ý’š«ßÕÑ­ôiNläûììÌØÈð‡D|N1¤ðb4²Oï_=¸ÿÕûXJÛX™ÿùó‡”lé§w/cÓ¤Y^$Ë)Jžþ1ú‹ªxÖÀy_–ÏÖnšÆŒÔ; óŽÝ~fV»Ÿ°2ääÃWÊä\~E‘óú}®Û„ჭ¸@º7¿rv|ÒÞ¹/tºµaæZq>KN,X|§õC_ðÐdÏ#„M”N­B‹¿—§±4£ÔUA„@‘zfÏægîdç+i×ë9yæ¨Ù﯌[{Ö×­Ì“ §û¯¾2°lž7ûÀh†¦ìüÃÆŒ_¯¢—Ôù‡eÑÏ—.ó©Oä&Ä$%ç") göj¢ÊK?½{ýþó×3¥ˆÓzÀ”±[Ri–Í“cÝBñøPµIGj=6"U·—®wZ¹n¿˜,ÇÀÂ{æ²-‹%ÂyAV·Ln^zbR™€†|1€ãèíîw炸W¹ÎýºyxJ´ùÌ ø\­`|¼°ìè'ËmskŸ:ÆÎu,þšƒ ¢ð7ŽEê£ ±&.:*)SfíæëãjÅ`Œ!ò¼´¨¨Ï v¬\ÞSëàG¥4€œe©À—'–í¼2zÙºÆAÞñÏOt2»z—µ%V¢¤ïùžs6ï ­âqgUË…7íNì;ZVœ³xäˆE+¶WÚ4ÝÞB¨k$O€¤™á÷ù«ªº‹ïïžØ¿ï¨ á·©»‡–ì¹5döʵÊÆ?;Ñuà p{3¥ŠX,ýú<3zÒìÍuªy;µ=ÒçsÓ‹šº[ÖMãê•®¢²ˆIÄÀÓ›R*2OJYZ¸Ú?ÉuâIâs¿:tšP[ÛSâÓS£§n¬Ðkmybøœo'T IDAT÷[÷]\Öú1«Í±`ñwÖ„0M1ˆ$ˆoÑŠ–½49—¬[»ïj¶’š;uŸºfp}wHýø`ùü%c3)Öë<|ÙØNPj+ì~?”²œè€¤´<õþãðL(¸éà çö†J@ÍhòÔî=º lV;ÔZ¿b݃Á æ…ù¹Ú»U˜²xåøÞE| ®hŒ<›~¿uoSÝÏÉÙ­óô Äï×_ ÿô.Ü;¬y÷öavöUZ ëêpfÛ. Ÿ+W[7hÔ»[ó:ÎÖ"D „\’àxÚsÅF&1­ºK34$AþfDÐúÔ/83jͼQ Úç5›³m~7PgžÙ½†[¡É ÎÁÂX§°^r?³!S ¥&o´,ò .¾ù7{*®©fQ¯ž'"ÓÀ8…©pP¯ï_ºóf£ž£W¯YÛ·Žõ¢ýd“Ÿºkå’(¥ãô¥ëWMiztÖäQRý'VîX–ú»š·VÃgŒèûáÒ¶uË{•­z6šqCi«²–+é»pµUõ²6Ú™êT¾j›fuÄ|®!ë>Ƙgeáh!ÐÛ=võƒÄá/ãsdRGK ½¤yºIó"a±£™µ»A1íq¡â ¾¢¢Ä!¹B–©Õ”ö&¦¥´ZÄ@·ëÝ:tÞ|,bÖÁË»æö–àÈ—w7ž©^5$')-:: ÕŸã’âÓelø‹ŸÚÑùƘôÄ/?|ˆO—0ŒZžó9.ACiãòåÚý\Å—˜è蘯R%ƒb ¶€C«“¾ÄÊrRâ>|ø”­Ð…ìjs ¥'Ä~ø–§­š¨‘ÇÄ|VЙ˜™+WÊ>={ðàÙË— iÅf%C ‘F½x‚\«tíÒ¥FµÐ~ÃÆH¤¯.ßHÏËJ¼ý6­Aש-kW©ÕfÊ̶ô¼9õ"ÌÊËRW[ŒHaÛsÎ\¼rýæ½#kúo›ØqúÖ7b€ÐM&‘…H£ÎUªµ¢Ãd}yò<\®¢Œƒ÷Ô J­*Ha™Ÿkîh)àpdT®BO4IÙJ!)æ ­à"TÿB1üøB±eZBžR€h1òl+÷0Èû4}ÒM¥^—nŸëQ¿’•ˆ€UJYäÛ‡Ó‡´¯T¾Z‡5\ó¤Î•ƒî gí)?³1…)²WŒêàT%¬ZÕªÞ}V<@J‰ºÜ©}ۑùtºÿ& Ò/×®\­FÊ5[u¿ô2‘0ÊÉ ÈϘץєùÃÊûV¬\54 b•«SµB¶bPŠÁ!¡¡UË{ºLøã#*+¼u‹ÆÓgÎröktðò³“{ö¤4×·¯Üxìþ7Í-‚à¸R…RCÓ´†V+xâü¬X)aå]£¬ö©6Íå7äè6²`YêïIBáãkfÔj>0.—qtvªÜlP¨«$ésCmÑaý‚U«·_ÖÒ͉µ LY‘‘/7ž¦(#îÂã¨D„¤áÛÖE8 lQÞÙÍímøˈ/rš¸3ÏŸzÕê'¡TLQ¶ÔEÀ3ÿàH¼ÈÚ××ï닇©é€ ûÓÕ¯_Éf¿Gܽö2Ïðáž–\Z¥V«UjºR½^™ *'+3=#=+f¥*»LtFÚ•©a ÃfŸ`ñóS€àkô“cw’7]ý”‘“·kHËûgeià}ô׎GTìíæÕtš ê——•ÙÉ.nöƒ9úó Z—IÒçÏîj®~É•å}X[ضãB9†Øã×^ã윔››³qßC“º¾MÎÀÙ¹÷"ï½{2ºkÝ#–„ %¿­ýcɸ3F5ŒtJÒ¼A³>²ç³æ-:}öÄÀžÝmkÍžØT”““J‘6:-UbïË¡â€ÍâüoQº¢'´9Hš†=8¥÷È©}šWþ|÷ГLÑÜÁ]õ‰XÄåèfÓÈý{OÔÔ(åY#_âøÑk§ì±³²0¶ÛÅ–ÂÇ»§M ¯å…öí;^¡yïî²ÈVwõ1jD÷ƾ7oþdÞ=|fyò[‘H,à‘ OwbnnžþæÁ¥{¯ë×üUî¾™…„OjÿXút¸søÐ+‡7¶[;í÷ò“þhk¥¹*MM¿5¬UšÆz««ì‰7õ=0y´…¥0À€ ›&‰ÅOëêÄ Ð ‚—š–ž•I×¾=q. ˜ÎgG·r#Žòµ0é׿§W€‘Ø~Àü .ÏâóU`É/8þˆÌmÃúÌ+ofÖ®ß_¦ÖŽO+>¯ºÝbÄÊÆe ÙÐa«N_ŠH¨ "‰ùog„zX€”FX!Í°Gˆ(ÆY‡‹­-*¹ï>»ÿÕu¾Z‰šL #4jÓG¯ù$€Ò}7ö/̲ÔßRÖ0Æf¡]×*{úÔÙ÷‘¶!}-íUÙä9U&wõ.k¦5q,¼Z^8wðÀÉ+‰ùÄøõç:ÔFéðhš±õX4j”M~܃¨Œ‘ó¶wïݶ ¨½á•Sÿxñ)µÙ„åûuµ¬±rï?l¢ÐÁôE¯»Ožœ´ý̳'ojÕüUÒ“Öó6Wó(«“=˪K¶9zhÿÃçÉC6Ю`UÅjmÖí«Êáþ”˜ $Æ_Ú®áÆm>ŽF¿V\Xü”$…&<íxcÛô®§l=|ÛöèÑ¡neÌç Äæ6 Oxž%ª,Òæ`Œ]Ê… (À`CÔÆ3g˜‹^£ô°³ãÇ>ú çÔ°uÖS†wkx”ª‰3;WcB¦¤dJRˆ’el]0ýÄ'» áÑ^BP|½V¹ñX¸>µª5å¹r>€Z–Ac k–¢X–úgb Ë׈Ë… blÅ‹,]jVwÑ‘"c§Šõ'U¬o"BFë;¥Tñì|:÷èÖ¹ €ÍlËô3³OAψ+°ªŽÃXèUsæâšÚÔzèÛãÅàS¯¥þYŒ±ÐÞ»ïØ9} ÞÉwòªÜÒ«ØGõ•ÞD^Í[{±&‹ÿ‚„Rjµ´ùˆ•ÝÇæ^8~&üõÁm{x~ã =¦„1âˆíÊÄ$†ëˆ!ÈM{þ>> ´¦“P?Ç¢šìOùPÖ  &[š¯±t¶³%4iÒ<=õd•cG3>Æ`ö=|ËÍ!“ÊÞ~L­Ý¨ƒ—c¡GíN}N=¹"nÒ‚Oe'}”A51¤¾¾­.ÓÈC·v°4Ur”¶?C"H“ ͵uF&‘­Ú*ˆº[ÁåñÐŒ ¬¢‚€Z&õ D…µ„!åRñã5Éò…Á(C¥!EòŸ?jRH‘ï,~jñDˆ`b^Ö_Voºª›{/ßuAÁ32|Òä¤>?´:¸·cÉ;U•.¡.Ý[¹^6¿hXŽ ÖsÚ¢yÍŸŸfbn%W³µ·~T¬œþ‹5› KþçN‰ÂÕnXª`Áâ»°`šÊK‰yúäYtªÂ'¤F osZ-MN˳spñÆ€°:5éëÝ·r ëjõêù:Ùð8yˆdÙ ê‡ïh’uíI´¬ZÍ°ò~^<’À –gƽ~öøM¼¬RÕjå}%<ÓÊøÄ4+{7s!¡íA–qäì‡ ZÖô+fKI[m€¡¤YIO=ù˜S&¸fp€·¹`J•ðáõ½'á|·à°*å-…†¢!ìÁ²Ô¿àl\åó/òm/+¶JÛŸÜÿg:¥ÉEqùÅ ?ÓZk&_£È÷Á†š<µ¾Q6Ž‹$•Úÿ A`㓆zç:6T_ÓFâ °–¥jœˆ[닪a@„Þ=Ž „ξ)\tQ»½Ì`´//^ôçû1£¤¶˜›þ“2‰F;,JNiþòº¬Å˜R(4‘ˆ(ìŸ3b=;r£ÓµJù‡…Ln|"ŠÃð¸$Òoeýãé‰ ˜Q(T4cèqøB>A!>ÄŒR® 0âó\©W-õ2ŒJ­ÒPŒñ—"9\€o¨ºÆhÔJ•Áx’M9Æâ'qT`RW% a£SK:ùC‚ЕQdˆ›Ð+ß"­›ƒ ´Œf\·ZÛ3 Óh>ã6£=æ¢G¦ôœIj ê{D!ÂHf}-ÿ¥±r‡Ñ‚ô˜?B|~T‚QEЂy«”Kó¥r¦ YŠö!ôâðrÿ~¢”±µÝ­=|+T¬P¡Bù_¿À^S×G&åé*„–`€ZšÈÛ¦Q5Ï2>þþþþþ~þ¡õæ\MAF±SùÎïm]»r9¿à‰«¦ÈÔØÈR’'GNèצl9mþþîní‡/0¤Á òR÷,Z) °j½9Oä*(¬±bÁâÇ)ŽÆ¨ØÍ×bËÝ[¹ WsD‘žÿúíÚËâš™^Þ63KP¬-UBU ”wDpÅ1QdRa ág׎½Ê´8 ÈPLZ›Ë—ˆ…$€ —h8e÷„BE#YÚÇ•³fÈ”_Ý<É\Ä+‰ :5‡V“Ãç­¨æf€WèVÑJO€ ¯N®0ãè°E›æ›%N8{ºØeÓ°R7D¾µÛÀq³›÷ÎÓÖùuÖò©s+Õh¨fÈvëbË®ÝyXóqÍÒùãr5f÷±RÅâ糫þ´˜FáçŒÊõb(âöþ^ÎíB£*êç7|ðM÷ûßØ0õë—Rßa©;Õ«§(ˆÿðê}L²È¡lˆ‹È``e'E¿z£Fÿ*u<¬PVRäÙÓg³-]ý˵¨ì#às ñ‰ö_Li\BêW«©½[Ç)#¢þâ[éòQ"Þ?—ÝÙŠ´ì,©ÔªUÛV¡N…§µÖ#Hå.[º;´ï¦q]ÀjMî¦Ç”†F$GÛ’#²®^'Xÿì«=S™ÎÕ×ÉWúÍ5·’ç?Ó¦º=@“ñiæñë“z9³^t?°2´' M‹i|sýF…Ž'¡b ÔíB•hçXû´v«(Eêz¼Þè0øÕM«Cáñ#ƒ1Q*%³ÔíKi)êáÉu Öþ‘­bH¾¤b˜ØBÈãÂû‡¬Ø+eµ\àZeöµÂ„ØðȘD¥ðÁã× Ëf)£‰O«iݾŽ›¯–˵î†LS#Œed%)ÌÊZ’X¡PK” @TY_"Óó‡ui@©ÔÒvôÚRŸ„ [º™Å^´ðøâì âÌpUzV€=’åfò[N,~Q‰¯ÎÚ)ß¾a‰‹øÝ ÌÄ0˜ ³kë‘«rK—£:Ô,¦»ÂF¥Þ1e¬Yóñ]ë•-Ó TíKi—oÈxtræÂ]Õ{ŒÝ¶cצÓÓ®ÜÌ7“h2SíÞéÜaý¶]»÷íôz½cÜÞ—^¡õÚ5­Ö|`Ÿöï›Gh1#¶'u:‘,kí_=êÔòác'Θ:jð®Û©CÇñsЇìúÈâGyù Ú뼄ç‡?ÒÍK£O€a¨‡göü¾á£§(Œ1̤E¿<{ùvŽdqX&¸f“&Mš6iìk¥Xú[çŇ®ËKºe¤ ¹Ò›W¾Û·mý“d¥Žµ°þh?“2í·®KÎ'7lÖÌ×2{H—Þûï|0IÀÐ×vϳ`³[6µœògï³÷Ñ'lâ„Äz ¢¯,_´çxdl&”ÖÜê¥Ê–Òº¨Ë÷)í«öhÝ´œ³%@ÀòÉõê/OC4%UÉ3óUÖN>Ž’máiÙX€¬­ÌD ;YZ˜û8æv;j[®×Ð!²t_¼sœ•DX"×·î•”–ð,'¯_WÅÍ*íÅ݇/’™o^ÅÐ%MËU´üÁù÷Ëß*KGL5¤éXïûz‰ø¤ñæB2Ï®=+9™ÚÆ4´ñS¿~z+âs”Ù)R¡™¹„l%?’£ŠìAòÄ"~Ä@ CÜôè—·Ÿ9ŒÙ0ƒrµ\žP( Éá‰-Zuîêa#èXÎmÊÌ ÇW¯SÓ›W²ÙŽR'El[8hÙ¸@)uÅ—¾?P¦çgš9— ÅÚ©o^¹–\J8¸N7Dqm]í`ÿ²eÊYsÉÚœ¯-He¨ØYü„F@I³;ìù˜‘ø%6öóçÏ1ÑïŸõoXK"íyŒ*Ú—Õï=ýÆýK­Cý*5¾x\½§7|цkÛ‘|u˜¹³^€“kÅFcG’ß\÷.G† UA±®Îïas\†Œ¨Â+H±„Êy°¯í˜õsܾ~áì•«W©µxòÄÇQ,E±ø>-mÐéÑ«Çt-_ÎgÀ²+ ‡ÔÊ-Ï8´j\H@™JµÚ]{ŸŒâîˆj}Vžz|mséë’P‘-}0,Æ@I’É!8Ö^>UÅù_óÒ2 D!xÚÁæŽ ûN?¸ocUo+T`àèöÃ^^'ªÛÀÃÞ’ Ž™]™ZÍ”©1Ñ2Ý7„:öM„*´®nAõªv™1iº€ö‚7„€ÑnE»^< J±ƒ£ž—"ù\¾F–ÇТòRdI)°]Hç[Q]?½ztóþ½“[ÇGæ‡FÖÐ75/ÌðÍíæH`â]ÄÚz9ÿØ’B˜’ɤ„ÀŒÇ€ Žµ½'C¿‘1za™yš ±}9ÝV™•-‡È—*™‚ƒÀZC*ïñª×²‘Ãjóxò6ŠBåTsA€€#®àWÕ^qñkzbu?[öh/‹åîCå'GMø­ól~Ǿ:±Á^†äÕžÛ}ö±prVdH9ûø7w_$Û.ß?ŠùŽ¹ƒvçv}°«¿µÄrΘÁ=gžßÕ‰úzéfDïEû\%Âì¨ ­›L²ïã¸ú<xþæ¡Êº‰—©uF¤D>Ðs\»…Gwì8¸ÅåYÆþœi$9…/J*©}%ç ·StÂ¥ï1öØô2U:?ü˜]H° #T¤œ t ½!Ó}’¾Þ^ü\¦6´¥ó¿>ºyjÿ¾}{÷îÛ»oS%w×î£_¿ó0Ÿ*“¢tÙRÆeBI‚Q"Y:D†Rmñ2¤YÐ9M³“zû^ª™!o¥¶7’$L¼Ñ†Üd FW`†!C1ãD¹…²mêÍ>Œ!ÝY£Ú¾ì¶‹£1BÏ m\å½Ç ;sp‹wWv,?’ŽliŽÇ™?(&é¤~Ü”GÏß¾u¹ a†¦9ùq_TàÎG„‘MÅ04EÑ34Eip!¿âwsœaŠÒÐ:‰c>‡Ÿ;ëʘõ«#.¼Täfm]4v Æ@©)ÏjMGŒíãœ5¤ßH§n»g·«WÍsÔ¤Þcæí-Î|»fþR¿Aóø$£Q_ܱàh=ñâêõÝ«ëÞ’°yÚ‚€êÍÖ *ûR¥-½˜$—Òp2£ðÃÅ¿-6åå¿$7ÈBÃ-2:£Ï ™Ò¨ªÀŸ¾”‹ÿ=Q9ùVY¸bžeìùì~€6ŸßÕ Z9¡ÄeÒÁ£ÎÉ×Gôî4lÆfßßöì WËþp{΢iú:Daé\¶FÕ@ „öaa5Ì\€ïzX]4Á¯T½Ž•.]'ApEB!©ÉøT¬à,“ÉäZÈäJ•Z›¢] q¹ˆàZÎßy¸¢ìÅô‘ÆÎ[OÖ}`fB‡Ë †Lƒ(¢Jí:¶Щ—¨´¥—ö*ˆøïšÿˆA³µûíÝ^Öbñ«ØR:_0´†¢9\žÎÒg0º›ˆ ¹Òˆ‚Öh€ IÒä0»®j.\>êûî•èµº??Pih_pŽDŸÑ kÔL<Ç8hÓäè BDéóRÏRP±!ž&Ž=øwU ¿Î¸ïbˆGw`¢ðœ/¾.0[À†Å¯'Ž&áÅÞüF Ý‚v&Búöè»/ß`ÂBƒ5YMLkYô§+-gÒ è¾L©Î‰^ê+Êc¬V¤†¿I¨,&á›ðÝÈÀtƒ }“£B¹i ÑÑ1Ùr5WdUÖ§œ«ƒ _b>~NH£çêéãWÆ ’X²Ë ,~5”¾ÜEÔ’¬„ š¯¿œôº¼°„¢¢ß°~V·ÖM» 7¥†sšÉr2^<[·{×.[µè=oÿ”Æš )Ëx»:8{W¬àÉå’­D^ÓnüÄ ãû7iÞõò•ÅŸ/žÜ÷"áýƒó9îµÇ›Ñ´A£¹ïñžÎžx[h&P¥¥×hÐzɦ õÊ;XûW÷¶–H,Ý‚}=xzÑXEÓNbŸfÃf´-;¶Ž‡“ƒC½‰•»Ìb–”£@HÀÕFž€R¤Éiv³ø%Ťé®ß~Wœ:˜a£ß>}ù‘ùnVBˆ~}çvl–ì[]êäS›ÿ•NrælÓJ³ùnÁ“–oÜÐó›ôÎ!¹d?XÚIò3¤¾†Kˆ ¿Sk1OEË( ÀáOø-¿œq…þ:÷èž}=·ÍÒB„ Ñµ;¤ÝçÍ›<²–ª4”–îpÖg™ÐÜÓ‚,ør,Xü—Ìä%G_¾x1üSŠKHÛ ’A@ŸróòùGáÑ4ß¾qû.µ+ºÇžÚpâÑÇä´¤WwlZÝB/>jEÞ‰Í=Úu‰½pìM’< FÓöM«›óIÌàÄO/.œ»ü%]á^1¬e³îÖB&ÿóÒõ‡¶éúúêÅ€ú-8iw€QÚä˜Ñ¾o§ºEåJ+ª”BªA’íÛ«ÓÖk‡NIóŸ>ãÓ`I 0@Ï‘uGìÛø>KÉÿ’âYÖ«| #4r/;÷ÃsAƇ‡»ÎÞµ¨Òˆ#ç±,Kéí‘›…MÞ—·ù•¶ bü£;™"1/}û%¤ãðf½GÀññ•û÷;(a?Â@’R¯ç(ÔÙÙ1ÉùºY«ˆ¿öRÜÑÓ2Æüë—ØL;„àqT¬¥]ÐZ­ÍXaèÒ4’N,dr5áhÎúO® ÍHý<,©Ü)Šªebo^§\ÊøIŒ¾ ÿi-<ýóœqƒ¿£j¹¿~8t­‚OpC1¨Îmœ4egx•jLÎÃEËÜ~à.±às’$DBmu¶§QIO®™÷äž&GàhEœÙ·ñÅôÃëF6ɉ¾3¤KŸlÇÊ^6‚›‡7í½5çâºQæòÄu¿/¿þ!9æWmè"\‘H(}K®0Æ|gÿ®ãäFž;¨­Õ«R+^|ÄíítÊÔñRÎ{ž¡Ñyܹ–´(“oF}põêÏÀšÌ3GöpýÚöÉ]·å-û×gYÊ0½!¢iÓú{LY¼býo]›Ó‰á —ß³±,¯ÉKZ7cD’[ý©Ãz›kÒb·Š>€JŒû’”ká !Iý¹_D4™ûvlv3#ª{ñoïW¾Ý2Pu»JÚámë7Uê\Çëã½cGÞ(fŸH(>©” µQEh¬QgeŧæäÙXšs éPº·ÎW½mýfsªneÏøWw6¸Q¥ûú2Þu›†:m\·ÑQ<ÔVöaÊÚ‡M‡ïCi=’ÎâT#©èW—oEÛÏ]oæ-HŸP¯Âž¼êʼ쳻/µ™sú÷ÞµÔÛæMMÈ j·Ò3âÍÎçŽÝêWAD(Õ˜kÛåÊÑþàÝé¹µLïÕ¯ñ—ã⽺?9µT :\ÒíQ]Û:‘™“ýËG@…rüYÕúëdWìQ~Ó*ˆr­—h¬Ê“Þ¾žom-*![ <+k@|ÄÓ-+fßÉqü}Ü@ðêêÁçb7^Ûžvl&ŘD¥³©dJ5KiÃ@ÍÊ7]¸$wý†#WGŠ¼¦cçÛʲœ¼GN™¶e×ÑmkV HšÖ[¿vT¨RÃâþ¾ã§¯•ë×ÆL¤c)ÌÐ{·zæoyt2SFx¯Þ8ÐߌÔÔí8gD汧V=©Æ.ß9¸šD™cÛ¤Ug«ò–6©×©Ã•íW·î»8~t7‰i®mÚuT¯Û¨¹Ì® ×½ºÍQ+U¡½çÒzŽŸ-[»þЖ5´J¿™C6Ò—©fÍ)ÿ}’ÒÈR#oXWjÖÈ[˜d×o`Ãݳiž¹eýv_;m仆åܽZŒÿ½œP•L©¦h5À1®‚È`¾C…ž}µž‰ ­U4_uîIü§»YM'40$~-ë;L¿ö!¥+ÂzõÛë¥OFVHóì´9úŠõø7xÄ%±FKZ4F.”Jqa×âßw_6÷©¶bëävê¬ç«Ö]¹å`°%Üâ 9\‘•`0&XŠ*å,¥7¨ÈJ º­ ¬›”šÍ·°÷tµ£ cW¯í² Õ“Ó³1Gèäâb)æc ~Õ[.]UQIš x¤q6 š#lÔeH‡`·Ä ©•½³“­9`Ì5·o=dJh«„Œ\…™­“›ƒ`Ì7wêÔs "ùzšÄA†njAqÍ £˜‚¹®Ï¸É³té6dJý6‰¹r‘…‹£cK·À±óVÄÅ'R3wOwGoG±s›Å¯ ´F)å Ć…‰gm@E‚ ßâme._ºvýÊ©ƒ·mÞ0zÇõ!UE`ê•3$À#8¤ÐZ¿mŒ„|W–ž‹I?WßVdÍƒÏ !@$OÅõø»rÅ%%>Öš´,™þƧ$ûÛ €Rœ]Ògü±¤áç÷ëP×ÞBê7^½!í¼ŽRÉósr¤tXÅr]7<ÙØŠ¬Ç¯ º”…­³…­³N„BÀ#ÒÂÎÙÂÎÙÐHžÐÕËW÷³Á¯†1¥ÑP˜°°wµ°/è0Fˆëàêåàjìb$ù¡‰-Ï{ùøÞQHU+8KAòŒº*89È[–õ³,ôX‹_\¡µw¥´koß ¢/_eÈúùêä­Kv7ë?b^“6JJ6­[«+7 :>Eï"1M‹‰2;ïËå×à„ ÷UbÝ-,@,Q¾þº‚l¯îdA'wKL§Åf»¿í~C|‘ zC· Ï"aH <=ÓÞ¡š(ééóN}Y¸ùd¯:n†Ö‚ÀÉ7oõ'æòx·On;p5}úœa!AbÖãDz”>Ík×@‘ÙXpewú2MÚ9v!uy9X¢ “„Èú²‚Æ•ŸŒhRW*™—&]iM+&ÉÔ :W;­Yü^„„î:Ù&tþ}ÖžÙcÚå=Þ8toÏ™@JühßÚä°ld'27îSâWIý@Œi %Ë°2!)óîŸr®Îö0§ü¥ý‡dVû›;'nA·Ð+w7ªÞ©¢äùËc‘sËò® “fª(bŒ™ôÌ\ 4˜äþ}ÁB|‹€vãsúÎßx½õjÜá¿ŸªP{¨‹„8÷à¾sr’_þãƒ3´Ð¶L»faõêúiå7õÕ9¾€®V³–—-XYþ–yÁâV|g˜b«¶³`Áâ߉fŒ5OŽ­ r±rvq9ÔÝ{v§·ÿpãˆ;;-œ]Ýœìl‚»-‘a†¡ÔöÏ ,Û[oÔ4+¾{SÇe«CÝ­mý[D&çcŒ)µòȲæ–¶n.ŽžµNE¤Ñ«Súúùÿ_{wï’@ÀqüyŽ’Z*µÒ{҂戂 š¢¥%ˆæš‚úÚk ‚æ†þ‹2“Ê  ìÀìž/»—Ô‚Êïg<ïÎCÐß=÷x÷Û;±ª%ó»Kã}‰øìòÖWåçG2ǧN¾ô´¿µjvEU,:8“¹-•_Ëå™î^S™¦RJ)ï O¯¼¸öq°½96±˜½yäw¤–¦oîøÞ5CæÀO}Ä”R¼Xçù›ä@ÒYjÛÒ0„.åÎ.B‘„n«ÞÅñt+†Â±hGõîÅâC~q*=y˜[‰=f/­T\¸oú°îN Ö`*!*Í„Òyö’­µ!„­…aÈ|ö4Q±Îöê*ö©Ü{)¥(=ß]ÝÛÉDO½º§ÕÑ»×íkSI)¿èš_ G;Æ=¿áþ ]ýþW)‹÷ £#é£Ûõ¡ÀÉ¥§›ÛûfîY놥rDí­+Á6Fÿ±6á€Ï´ðø%'Í%l®eÒýZuq`Sg6Yëֶιåµd8¸ÏVþ7óÏG×" ¬úÿµçê[šX§¥¸5^S÷<.Ep€ ÜÄF Лºgñ¤¿¢!,XäwC€jgÁ™õÎ# ²¶QJ^ <Ë‚{³áôKXþ– Æô…ìžpv,ö…&ƪ‚E §ó“ª…m‘à 0T´úJ‡AÚpî2( F†êZ8ýLû¨É‚!º º Mi 3} „  Ç,[/zòíhùÀ('x~àÇeO½:«A¡¤~IPÌV0?{ß‚u5Œœ²ËÓUnM½YMGpΧ‰ì?Ñ8¼òd×9[¯Ü¸"G'/ñܸ+G^=³vš³Û¦Óãέ¿ú>™ˆ 7Ècm9ÿ(È×-4ßDt'x®[a«öÿ¥n€[‘_ÚH üžÊ „üi«að~ȯ×!d­“!Kgýœ‰J7* çí7vÎ~vkmeqaQ7–xʪ¢ü‚*ŽP×Æú»Ïß>Ðf¡÷j{rC®újè÷=ÿÀd Œ€[›W²wã}›snõ% <ôgI®L­HEQÔ(³ öê<ª¡ìe[µ «ËŠ 3¢Wîö?±v¢Páð* ¤XÀ®.«¢w=´v6¯Þ\ ¨Þ= :¯ímÆ'€/w.y=lɇA”å:)ÿóªDTb¬ÓŒÍ«T Agsáì͇ä#—é5Ð_ˆ ÎJfáÁƽ°·;¬5‡åY€óT!&þº 21@h@#Pš e=þ9&ФPúÒs Ï€I¤1@Š²2úö¨Ê‡× ÷5øÈ5™P-ÇyPñù +ŠÆ‰ƒ‹ié[½¤i@xUP ÙE?U?¼J(È‚‚,0ÜA+Ø%PX\°!ÿ;ýû7¤g2€Æ h•™PćN]¡ƒ"˜À ÿDóR¾Èq–ë‰çrtò[±íYæ°hùù¹@‡ê²"òØ]^VÜú^@a?h7sn-E§Q·WÏN2õ]oÔÛ+øuëÉ|ÿè^X¢¼²ª×‘.ÿúêDsR×ïwâdÍ|§ðε»éÅ5]úöp0&ºvúÏqvsÒ/Ç汫›O2!²hàõéM̲½Žs^lßW*.Äÿud²l·!S¦Ú*G\¸žkhÓ=î^h¼\×!ÓíÄò¤¼ÿ¢pé¶mõ³LyÙÁ^‹¯V¼Áå·©¡ `Õüõcæ]Ýç©*,ÖØq÷왽aÍf“;¾ÈWäc¹Õ.Êò€@iôÙ¬®ª¤A·*të3l¤êOËÏÊÑ#ìúþ¹vzÄ9`ʶ6ª©>Ã;÷ê«,‘ê6pdKßB~Iê»Oó«x=©MµÓ^ÚÃï{/ÐÇs7žS2ÝìfÌè+q×þ ïn?ߨ0cZÈ©çùó]F5W%¼ÊxËiûÜÜg9›Ðë­NqÔB ‚㟰^ ²=àÏÞðýÔßÉCZR36åáéQÐ]F¾ðÔÎÄAoX¬    ÎŽY1p;´Å•)>¥B§Æ”ª2`¤ÇŠžÜZ.»`ÊZHÚ CƒÊ—°ï5¬4lAKÞ½påm¸¦Î°ô§»<|N½êÞoPmüSë¥vÖë›çvœxWijaÎŽ»:i†oã>ðGïE—n|` €Æ`MaéüYò “)Î<³.WùÛ€ µžªX'Š€8Ñg¡tü ÿ"‚teæõèl | zØg¬ƒ€M5ô†T«îŒ–ê×n̵º[æ¬#„4IHh´_ %ž‘÷ÕÌØ!…ßaÄ°‰ûÍžGDzeä­«~›O†èXØvåƸÛÍ @FŒ—=»zC™È´­>¸úmìÈ>‚ÈTþè˜wUÂcÍñú[Ž\MΫjÊ\?€·áC‚ !-äÛpñ è,·? d- À‹“b9›Ý,okuBÖý4D4kbÜ^èÏ„µóZ¶ÌÎý Š*àn0eÿïòG0zv[.­æ¥àðEÓ¨æíˆév†–1UòÇ©dŸÔv”@«ù|óÚ©5¾÷4ÌlûKó´˜Ä¥ÏÁÏn|H@ ëó‹'¯?µ§‰“ãðMÓ¥«€<~ô`å¼5Œ¡j«ÏžºyþÒ?&˜RL±7]P„“òÈxò*ªó€ƒûD\^ér0ŒòäÀïã¯ú‘ÿúør¿ 7_~€Êœo±)yÐq°Ù“;ë¤^…ô’ŒßݦÞÖpÊy¤û©LD¤(üx`þP³ ˆ|ÂÉÒi"Rˆ_zŒ™~)ŠBn¡¡šöÓb"ÎtÒÛp#‘BÄœ÷{õ æñ)1ºìd½‘‰ˆ” ÌXGík1) ±úOŸ••˜uš¦–'‹ÒŒÑVÑþÀiÈJQXñå‘«½å¸1£MÝ þTÉGD<<Ïmœúø±âÐÔv:‰ˆQWwiy¬jV8ö"Á»‚ª ¾\Ò7_ÏKñm¾“‹ˆˆ›­Ôîòf©i– qŸ—“º¶Žžnô¦^´^iÖÍXsübù\Ýñ;BŠ1Þ×ÅæàKD ½²u‚¶–8©ñV¸ Y×=õìý¢[$KÕÄ|ùŽˆ¾ 2ãÃ#sEQ1[F©:!Rbéç‘êňˆèb:> ¶k“ž©šz`[6Œà¾ß{3]«9;k›¼ß㎢Ëð{5"¢Ž<àÀ!8hèߘ… -TùM”ÞújÓ¯…ø2µáÉ eÀ~* ¤†X!"V¦#B? yƒ!!xH!ú—#ÅC:ØW :Ášo€£‹¨ AÔõF¤P‡XÄG 1ñ àЩø3H8¸øztGüT„ï#þŒùa€„à :¶öÁÝ yïZ"þÐBu³Šc>§#¢@ `•¦jëh—q(L<8|„m–°«³Çi|g Jü—œ¸WØ<7—i͹˜…”X/ªx7f¤uNݯIVºgße Rˆy¶ÃFˆ¦­²™0"ºãoì2ðÚP—–S\Qƒ(˜£?äüÇZ¤(D¯†úÔ›TC/£š°}qÃummqÑÕpø‹/&ºG'Ž™~+÷‡•Ú†ï¦:"®¶­·Ð"PÕí'xT™^º@^ÇT«ê 9Š˜JêòœWÉ, My x*=z ‡™Î£øä•‘Þ|rÉJæ°åÚ+0yïý{ û˜H @€Ù§¿|iL¨÷k0“‡Y]¿o|ÆûQͽkw®ê~G{í8=׬žö³GB›—AçsÍJÇçð€)#2ˆhçäý˜µBKðì!]oKÁc1…xúëïÞÆݾ nwû`¯F®ÔìlVÇ=ÊJÂÅ &ƒ’ù‡°Ê¥i4Bñq˜óôa—ÜÔÕ'hY»ÏörÒ« @ff±œ§Š, @\¦ ¸û¤‘‡´9냬æ_YçþË¢û á%úƒÏ勘@ 4‘’bÐ ¿> €"’?‚BÓ)>iÅ „Nˆ€B‘Ð6œ+ˆõŸ"tZc[Lh®²ÙÊãÝn<ì#“‘WKP<®x:^5ÕþUÉÉ™b@(y÷©¢›ÁX©z+x†Ú€Ë!1Oî<54sh¤žtòH™eî“MW=  bŽú!ïŸ÷;¢ûÓêFAc õñe* àÀTF3»…FǘçŸE“8VI[vÒpy¡%&#MXiA Æz‹œÉ ‘‘åå”Ô @­‰ÞÅ,’ùˆE"By|·‡FŸ†e׎uÚ_×ÉM(CoKi2;Î’ë3÷pÝb€½›þêkí8Nª¡_Ym˜wýᣗ .3µÿ×>A ¶ûîÕ†lüÂúÂU>~ã¨Ûh +1#ò“Ö¦sœ1Fw<>8àÑ×X_^L'®=vûÔl+ËÖÂDÓy³õ¦³!oÞìžgÙt¼ú¸:*Ã’‹ ÍŠòdeEê£EËØÝ@â¿€æè­g=!¼~¤o@º% ¸qÀN½é[U/˜Ù²BžT>€(˜ÍVTVBeô‘‡?H¯_D£ÿÀsÔÞá È„šöò«„ .³z”þX!ÅQçÛ½m‚î†<»n0wyⲕøÕU¬Ÿ[ÍÍK û˜R DZoòœÏös_ª‚Þ½;Õ¤&³"ïüÅô&–CÜÍúuGgÍ^_ë XSHçÑøTc.°ßìCãïšNYZb3þà;7äÔ=4EÚ²4àä¢ôÏc;U^½êz&¨QX€t‡îXºmån]Ë{¦Ž]àéfmiXòùelí½!;H/•i^>v&#Bï^èc6e¸Ø;Úì0>kd>9aXAFmŽÇؼ^öãºËDb[âê}êþ2—IF6oôé%5™i_kzXÜ>´¸Q:%cõö;c;NVo!AÒ^][“öR¬ðè°|Ó„Š?he@"ÝùÖz]Çí¡Ý\EÏ*sb׬^Õ@ £-fL1þ±ïî4ÔdçÎc8­$* TÙ¶ªâƒßå;óGÖŠ¼ÔÅÀbãM[ï–¹+}ÂläÜ~Ê]$¬QõM`zÎO‡J@­‡Š"èh:Ý ääÅú€½€öÏ ° ŒvB/ˆ ãaò ÈØöŒþëº0\·æ5¸»ÛÂFkØþœ.À­©ŠºûœÕhx²òO§ #2àœ_‚€W`I.Ü­ºì\ø+fë´m¨2áÎL0?Ñè1'ääÄ惲À*™´£íˆý+ü¶çp“^&)Ù°y¯N]¸ºT§µóÇó:ç> ß'Ó8X¡×h•Ê­áÕ`¤?´1ø9±^k·Ø9Nêßž zö@Ùm£"€½ö¶5Ój='f¿}ØÙj|xï·nwæß™ÍÅ97êÙÚÕ 1Ñ5õZa:´Ç/­i2D ¤ éStz¡L‡Þ£½)¶2S+J Mª¨7¶§PF UQPÅíØs æèA¬³µÌWÞI’ÓŠÙÝŒT¬Üd‘µ"+æ]|~×ázc{Ë}ÿúékFS©»¦öXY€ìûÓýížlÿ]J±»¶ÎX)±¼ˆH÷óÇÈA÷^±&,°®=n8$F¼-k×Wsp¯zæSÂ_çu£7°c}\IJÜÇô¼R Ýû¨ŒÒ[È»üÛ›¨JÃÑ@ ;ö}™â€Qý;Þ?yÙÇļ‡Ix÷&«²¶IÕ Õ4øC©eÉJ‹yW)×wŒJú¹mðË@ÒKUH÷Âô¸¨ä¼ÆÂAuë7z´Š°Í0#üEfçqú*[R $5&,)§¼SŸ#ú|û”TLLÔ;>‹¡Ù†÷<~ida,+4á0JsÔæë_õim~ýs># !Ïáõu(Óë!`®ðüò›r¨i‰Ï ˜SÜQ×9žÝ‡ü0õei€äÇQ &öнNYG݃„¦Õ ݇‚Á¸v xØ€°DÜ"¸ö ¤àæ7¯ì(°)Êñê ätPkx| Ùàî ˉUpå>tV]E¸Ö8 †usPéÖBÙ+Rà^ ·õº%ú[—#€ñöЗ7ž5¦áÓÁÃMÊøý5„dÃ8cªÜ¼¿yÿ%³¤]ÏÁÚcfE‡~Îåk)F²lLÇÐ@Àzúâ­Ž‰‰"ƒ À3C™vÇWMlÎàÍVOå6ž]­@B^R3èÙN€ðZŲ¨àÀ'£ô­;Êòì¯QñélŠÖIyà„Q…ŸšZXÛsÈøî±Þ:Fœ·-ˆˆ©V2ŸÐ4$î[ì‡äüò&¢Û´ö nJÂr%?-ég¨ÕGöwÕÍÿf9j/¿ç¦Ýý7òfߟîôÀ6ü¢CÛ]!=ìújóµæá? @þ_¯SÍ·6¹=Rp¹´Êþï¡[œ µýà&üßCMl¾RÍ|>æm‡þ²ÿæv¬Œ³4Y°ùùÛ íš ˆÀÎ 7tÝý"<@ñ·„Îÿ̶ìÖ Ô`×$­œé7Ùõþ§ËÅø'ˆr9lõ›ZŒpØmÇíb?m·µÿ¾¾M¥\œãFo9NñWî>>°³Ô¿±ïB¨Ì«vûÙt/Þ²o!rï÷ÐYþ¯B~ìßûŸÆ!dóü©Ÿ2Ü×ÕhßbýCëÌR«9'ƒNÎùÕ¸eD0Öç±lÙóݤ«³Û©h_žØ þöØäuS/â¿Á|C÷øçKþY0ÿ!Ö ´%,Á µckõ3ÛPÚž(“_œ\ÿª $@‚Ak}†_z…­S€b*­‰v…iB]Œ6ÎÚˆ6ãJ,¶ÂQ« ¶²Å·u-ÿŸê†ò"´4t ôuµ45uõô ´´,#9¤0þŠ¦–¦…¥æêjc M^æaœ2ì¹S&j;^KGMuŒ¡ÙăϳH]·$„¼>·LO__]Cko<[4í’þÔOUm¬‹÷]R× I0Qk6{WUIØkûXÜ`óBHå+ Uý.Ÿ÷æÜrT™t•â3UóÈ£Œ‰„âl¥SÜvJBXÓÆ×26·´´´03RS›`îê]ÕZÅ­p›ö'O"eH­»Š‘ÞC=üý(2Õ0ó{ünPÝÚe!!LéÞÏžÞªOíxñže‹MoàL5sî`¹êÙ…IJRß"ç9·ïýÊk˜¼Ð0ò:däÅó£UmKܾd;kã[WùàÀM# %ݯiÀö‡žm•…K:½yÀ ¡7öÙ"¢²ódgNk|RFSFÝ^ýŒ¤?Ƙü—ÿŠáÂUðÊUV:kŽõ›?´Å™0Mô=«‚ùïwéH Á¶uÓð§€@x¼&aÎØpò€¶¦AyE”¼XŸT=hײIŠLÑÆ„þãl¯.t|Á&¶°Ï‰:%—ªïˆPòòrT¯eó'ÛÑÓ|#Øõ—WC-ß±éÞþe•Í¶V·m«äÞqæx]ü;ûΈ1ÏRª!Nm760°·³Ò3š|-¼ ~:Ä¡­œ8tóõ亳¿ªtÕGd³š(8ŠÇ«›D)õëÊ@  !prÇ2=£Iv–†æŽ7ÿó‹S'»¬#œ0§ÉnÙl‰®‘@‚ß?<”HÑ4Ó³gþ]ºÀ «ïÚY.P$uj…è¸T–û¶´[;Ãéá‰Û*ö¶flpz±}…u3/Šßy¨åz­Úiký ù aÈÊË2&†e S–.ºn1H‘wtó…„+¯‚ø?yr|ÆÁµÓkêÔ ŸžnA—…ѵ51~ì.£{Ébc=œûåûðððð°»Ç7<¬1Ú40) \y6˜û*ôõ}ÿ§·¶Xï\»ŠÓyàµ=¶”´æí{×{ÉH<Hð»q7~Ž©©)­¢´¬kÿñ‡®lTÑ:(+51“½=ž€hñÀMÞƒWï&:}'xñKÜ2ÙT?Y‘ 8¬;zÄlÚ»R[Íߊé#¼Â%Sæìzâ:BnzÚËa½0;[ E•þ•eO ÀIVŠ‚‘ÎŽÒ;g„×n×’œÝîï¼ãaó(š´g×ÏËрǪìÔy@y!»GWæÕca#ßÀ.šÖKþzÖ\¾Ð8dJfRHðÛê†ÎP~ñâ@Ž¿šÕ‰Ý—Ž f }tÆå÷)à5LÜW!¨N˜òÒt1ÏHÝ_5¡¾1U »<ïR!ÀîÊËÉwæ4„Q¥þWw¸8, :ôëŒÊ^Ú·\Ž&=¬h«bv–?;æ$*8éÝ-§„Ýêê®2×µãñ}Áš«†ß,dŒèØÔë‚ »âЪъÂÇÉÏŽMŸ3?üÁé¬ ZÏN2u V¶‹<'·\"]Hðw¨¡ïFŠ l·Öõɪ¥;žœØ–ÍgØïJ«°ÐŽVçkÅÀ;ùCu–†û~›•t½G¶p(ÉÐ`û©p›¶¹ˆvÙÕf?4sò©ðzÜ®ž5Ä^†ëFl1Ùý¾NûE3AÀvò>=c@¼ñçÐ]Fô¤Gè¯ö_¢ˆ¤‘;ISÛÙ{7^ªHC²¤ƒL«“M¡G¹wߪâ`0†wÇ Ó)û^%oÙ ["`Hð7ønêU8®ÝÚñÓuws‘¡ìä:\ÎÓÖ9(µœÀ=¿ÉsÏ'ꮟ#äÆ'm?pJbž¦)(9ôe•ø)!×ÖHCt8‚l3E©ŠÐŒRqçÐdùx¹Ê=ÓÃH¤[Ý9€22²G;óì2Å~Ø­ó,<¿!¦ !¼ü=s‡ÒÆéÛ©šhWÄÍYqoÝ.»u]ZºŽ-ÞÑ£G•{õ‘pÛèšyty „@Üí+%ƒÆØwBg»„Ñ`ÉI ĺù¨ªÊ Ø 8•UÕõª ûŽ½ M—{̶Õ†‹.<×~~cïb›…YLév®sï>së!KGÄ…‡üh[|T‡ev±ãØÕNt Z½$gðÂñ]@´ôMèÒÛLä=Vß²½«WYQEÕi5FÇ Þêô5q"tý°x…†£êŽþ¦x£–>÷mWSYÍ€ÚêJ6-¯Cc¯«9ì½³ÖéªYᤕ[CÉu¼õð á|©ºº’'Îäæ®±Ÿs0ʼ+£y¤wueÅE7õ+ÂÅuº¼™ëü« ÝQnÄâ㛤¦iWp¨^c¬n^<  *®Ê Ó1c´¯¾Þ™!‘6 þÇñ£M ba*¾ØìA“ áýB¤Ec^ZŽ…iºåª.•ø‘Æßk54OœTSÍ4HݳŸo³¹ÔÑ÷òÂáÍ·á6ÿ˜0KKq7 îõ‘ÞH Á†\±ÎLZ~ ®\ZîúõO¿n9›XâF©%iû{­‘jᇨõÏrÓb#‚n T NZ ØêWšQmŒ(‘5 $¾Iˆ#þ}+¼„ IDAT`xóÖóë ’­PHð¯žLI üÓÖ¸j²o»ù–ë3¶ü²õw­$m-m#þÚ`¾‚Mÿo´¯¼…ÛÊĶ ·ý‰ŸBÆ뫤ù7Ú(þ' -·ÀÏìÈÇ_„Q‚ÿzuCÉútÑÈÔêK-Öû@ÊÞß4œæCÉ{8G¶‹®BÈw£Ûï Z~™ñ`´ÉBê'ò!„=ßxÌ¥Ï\Bª¼´õLMD062éã›Í! •NNÔºùSMŒ-'M=ð‰æV‚a{\›Ånb-°Ù, 9ꥻý߉ ×®]Ù·Âj÷t³Ó¯’ëô-Ô¦^(—Wã¿>“Ýæñ7m ¾ˆ„.÷Š…ö³‹‘ €4“ÉçI¡±Ù¬Ö㋽3ÿèý…–ÝkYœMÇB é=×ÝncñÅf7ojäsØ>¬ÚqÊlTË{Ox\6—OýSìÆ_D ÕYt­wRHþqÍûË6ÕïåúŸT7”|w›!췇ÚPU ÷NÞ‹G¡UÌ-:w`»÷ŠÕç>4«ëêÝK—]Š®lxVø¬?€¼êÕ«×Ôbõé=ë–,]y-èkÛŒ*téÑ£gÏž={öèÑsòÊÃRñÇüK!¤æã.ÿO¾^Ì·ÕPVVî?Lãøãàò$¾œKÄ7S f[õ lÛ2ÉK¸†ÛN¯ìÕ£{·nÝú©ZÜ·wDoźâðŽø\²Ù¸fTwæÓi-î%¤ÂÝе¼Q›Ddô´¶Xrø~aÐÙ9 Œš>ƒNï]é÷´qÁöÕÊJONï¸û¶ˆ)¶.®öY¾jÃΰ”Rþåõ+Ÿd‹®¦¾¶×ûìý(á1ôÀêÓ1e±W®9óª~.óüê1oïÍ{O–ðDÔj¾¿ß½q¥·ÏŠcW 8øÒº ¯ ã¬Ù~@HóÁ¹ƒ+¼½×mýók!·¾I1«OíYï½rý£¨¬FxxãT\f5Tf„ïÚ°ÒÇgÅñë/ê0˜ôXÿãÞ>+ö¿[ÏUnLà–ÕÞ+Woyù¥TXJD¨ÉŽÙ±~åÊõ{Rj¤›T'+3jÙ–C„é½lE :óøžMË–{ï;sßꜸßOîݼ|ùò‡.êRV¥ݹ~Ù²güEÂœºã•Ôçç÷z{~týÂà ðê+¤¸×­J*f@æÇÇ›V{¯\»-$±\ȳ õîâ½O¿º»xÃ! äõ¾Ûý3%ê†öÛ•Ï?~uã]ïÙµt4;?úMt $ßÃÄ:Un¨½qÊ5oÏ}!bºÏ,›Ó^ÝsŒRCæÚ¼×oc€öv¶ûúÁÓÏ4¿¹ÂùâþO›Ãì’Z"ßARÎíªìèa8@¾~;ÒÚ»|btG)›m•¦}ü&£l£LÿÁHÃì§Ö»âèæSÙå|áâõ-CM•îÂQ”Sœz¯RfáÅ 3GŸ8êßÚ궀/øÑtŠÂ oÓû‡¯s”µÜýÏ-fû7Aí€^³ÃáiS¦;IsØ&SæéˆuT®®uÙp7ÙÒqŠ­N¿í®&çbøã{¥¾’éwžE=|ñ€€€}àN¸Z/9>Ëá €Î~O“SŸÑÑÍm\×KÃÉ©µ„ýíµ¡ã†A:6.©¨£Æ>w:¨Y© íÒg¼§“ £½úÍoRvNÎú*èa9)E4íC‡…G›Úè«ö²½U#ÎwläÛìR.;%ÐØeë`=[g[î‡C¦«ý#úᑧeÊ“'šfÜóq!usçäUÆ[9Û›ªúyŽ® 'Îaâ æpSgë+§4©uén*“´º0¤ûO÷š¡ˆÉVFö¥ÝÆOuwéûBÇn)¶|‡'!„ëh8©¼«š«›Ë`f¢‰¾EUýÙ@ÏêMbŸu›Ë¦Ë ¨L¾w,‚Û×Fk4áÝ€¯ðÅëW_»µ—}~ƒÛ–ÛZÖ.v†Cÿœjx1¾– ó³Âž_=z;m’…¸l®€’¨hãþð̈ÓÆ·RˆgNtÚõK®h¸,BÄœ{žã=î bêÅ•jÓÿ^mÏ«JúËï q¦ƒæ͈â§ûg™/<$¼$¾i·U´g ‘[¡£­ó «‘BÄ«Œ–ŽlüýZ/ÍÁgc8ˆSF_y3$,,,,,ìMhÐþeÎ¬× "Rwgè™lyóûÐãîÌ7ŸrRÄIåË ƒ ¿òÅß—XiŽúÍE kóã–Í:n„Ê8›u¾'B¢Òê/i>?ÍØã …ˆX>yÂÈü†²QT~bô‡ˆˆ˜è ‰š6¯£c"">D}ͧÚb*×zÔ˜ðrl”¦Ž`³kás­UÇ~¨D,z?|‚]"R¥¦Úcã ¸Â,o.µtÚÌ+|©©³…X¶×}ßI/}ÇDnÅ7mm“*n=e,ÿòt´‰c=és¬w^Ì~uFsÒ–è¿¢ªoúN›»é"R” += Q @Ä-fƒv‡±U¨¡©}6¥V˜çÆÞî+Ž#búí©ZÓï!âl+¡éOŽi9.d7Pf!â_«-fn¾"|TúxÖhûSˆ8ÇdØ¥(Žð!÷ËŸãõ×pãü–ŒŸyXÈ9¯*U[['¹œ#^5i/7MÜ% ðãNgõWEµÇ+0­õ¨¸•ä©k|Ì AiQ…¸T×bO´(/N}¸y:bÎãYÚº3¸ˆ…¥A´ñ¾îchûg "ßÃpøƒ¯<áÊÈ]š&›xˆ˜ô×ðáf©ˆE‰É…ÿÛø‰Èz¯£ç4 MÒo~Û`DbÙ€Á£…–3CAeñ|á !´¸+«o‡W¿ý¸´íûÊÓ„6Cš‰‚Ö/u'øðâ9„|OýÒWoÁÛGtD  $O«-¯iâ=I*6$¤0Îþq°™®#ž¸ é±oîÞ¼¶máiÕ™‡þœ©TÑöÃ_LnÉLOGšÔ°ýø?5YbSŸ5êÆ™[™,:MPE¯¾xôHõrðÛfÓúÇzôèÀÊÍã‘vLñq·Áj¬[®£Sè²è¤¬VÍ dtZ%늫á]@¬†Ñ^Åì›þ9`ZôˆÞÏSŽÙô˜—ÿ]†W2ÓËK8ðeV) HSvu²¸ðPǫaú“<Ý]´Õ†6r´©I 2pqg¶oÏdÚ ESž€Ð´»1„ÕýG—~ùi¹Í§ä}-§˜^óÔ£:Â`Ò4w­±C(~ç¢OH)ÉÓl€ï9e2Îb   ªŠªyð9³º¿J7!çtfÇ6Ú.ä k”UQí1ÚSd‡¦²­;ɶ0ÆÒzαëc;F¶¿ö4Ï©¦ºê¸Ñ|nÎ//Ðh|:­(4LQY@v0˜:ÊÛðaLìPºç-ïð‹áß «d®ìšëÏ@ð*©ª*ü#z·Âú? ÆÏY@ö/²tX·ÿåúaM^I3i\_¼—ФÞU \l¹pÑñ[GçÿTü>B[·© ˜l<±d0Ron|.‚t2ÞAë}¾”2ïHDB ,#M¦WY±Ûwø>C®®WK+2 «’(ÂU'B•qy -Ã@JÀå ¤¥¥ Ÿª®Ï(Ý¥ïvŒò¾²m¦NùÇWÙ Jœ] …÷QÓ•“ø b‰RÝv/ËÍG-*\ug:s¦ýÏLe4Šÿ»66aÒŸB @€¢x„Ѐ&£¯$W\”˜æ¾²§L¹ÑÑÛ±3o. Ÿ6Ót™NÏž;Õ¤6]òßûúή­KÖvsûp¶þòV«Nžµåܹ—რl·ÒxU >% Ó[<Ò¨ý–Ë·D¿¼µkó¢5ÊÓÞŸòlY¹üåÇÏêÈ7®%B™b[U&áˆf²@qø ÀhYÖ€Ëæc.›!?1üЇÐC_ÞcÂx¿= â‰schŒ:gT‡IS†œ~©ïÊåÊ÷"Ï`G°öôÙ±ÒÍ<Ä4º$”ü—|7õÃpßk­ðr÷å(Zcç‡ÞxåÄ7_($¤6?TWת(ö¬™Óm÷“‹ð[Pø7†ÄA.›§(G/ÛvO8V´3ØÙ½SöÆ3o„.X „]c=Õë}q#[©S¿ÎìœtÑ4^J}Ü`®ÿµ0áz9 ß½²HÑfp'’ó쨚Ŝª:G,!V zȼƒË ò+ë¾÷ù}D “B#KQÕÈñæÃCÒoå ¨€€•ƒT»n² àåãli¨[­ Ì` ‡ŠäÌÏ};iÖfôü¯Á/£ÊqŒ‰ómÿ̈ëù­,[Äøð*CÈ• &#¹ãTÚ§DgM,VÙ×Ön]½.Ñ…«P•ÎSt.ۢ熪J»ö8 ºÑÚsêÌ ¢o¯+ˆ“y‡3¢¨|÷îks=en2ùó瀸+ûÌÚÍ @ß~}iŸÞæyæV~K)æ48›Ý)"±n~äÛD€;ÖhØmS®.þ¦³ÍF§›Æf“¦êŒèn¾å®ØÈÔõÈ•Úžž–φ2þ¦-Š„ Àª­›ÆYm}0{²]w"}ï汉v³Œîvéܱ#U]–WTâ¹ÿ®AwYñy\Ѷì;6­“{Ž°µ_dзg¥¢ü¼œ\róõ&€^VK×¼u5Õ7Qî3°_™´Ô”¬ô‚C·^BñÛƒï/S·á,--}õ±\טEÅã÷O*‰1àãrLaê³­¶¼­–sŸ°ï€PœZ;\µ{ÓFX²&Sõõá™?ª ™¿¹{L²rtà¥EƱn¾œ]mçš.R²[/ƒFIݘÛch7WÛçì­ÑÜã.ÝWg¿½Ÿµ™­•…ié—ç±Ô7÷»pË|æØÞ16Þü*°‡ÇzeÛõŒ}yuËîï›WÍ¢Se‹7øª)<ÉþcÆÄîo é»)Û=yÅp›ö¥±÷ƒ*O„º4§a-›e£eb1¬+=èU`¯i[[¼ÎY°qý2ã™nIáUäÊž¾xãö×#•®²g¬yÁx’GÖøþ²oÞå¡þÖ,#-ã?ÃÜÆÈÉw\[zvã†JŸÍG5ï›ÙyeXªõzu÷~7ãe£eZÞK“ët~·Õýû´Gü‘ôéuVßq–í€Zv¥£žåÄa¦ªÝÃýünkm2î*Œ6—»kcA×k›E÷ï\7Ç|¡S´…]_FáÓWïfœz6¨ñBu}†ñƒqGo..q· veÞçøÌzß%"f'ÅÄ%¦""»8):©Häý°Ó¿DÇÄ~Ë.&MNˆ)¬à³ä&|ŠK+mp‘±Š"c“)Dðbcc«yá㼌/iÙM¼yÉ1‘ùÕD^bTtN Þ›Šˆ¹‰QñÉy ¿ùµé)_cbbââ‹*9MÝrRU™ã ¾ó…É) QÀ©Lùú%&&6!9½V ò¡ sçd|‰‰‰‰‰OL­`SˆX[œŸÚˆ; U‘щü¹ÇŠSâÒ…5#Ȉû”Z$t;b঩“÷6*&.¯\äøg%Å$#bJBLA9kKsê(ç Ë“óísznU÷8-:>GØ`µe¹Ÿc£¢cb¿T`«•[]ò%.&&.¡’K}Ž­á ©Ç=/IJ‘¢PÀKþó…ç_›úõsTTtrF^«ÞYŠ¢(¤XeIñqÑÑÑ_Ójùu)y•Éñ±QQÑIßrˆ"§$96±@œJIÆç¸ø¯un} «Kr>ÇDEÇÄeU‰>Z›û­>WnÌSÇ“Iø?øß)jôi/Ëå÷¨&+eÿPˆˆEæjZŸòy͹©~`åéP‰hþKœÜ¿ ð·ó_¹N”xyîL–¤ÉþW¶h""¾ƒ–Êò»suÿøw3ÃÝéªC¦__o9 _ÏïÞ°þ¿f•B~XMˆ‚ù^Ó*9T“§RãV_ðý/eUÒ¦ÿS;Âë»íµù# gÃKtÊ¿ªªÛÐüG¬La³?U5µxqø¯ïþ{ö±-™/å_e¤9K?_{ÿ•j¾Q]ckkpMïZØõÞäq³ æ[­ÇÔD×4ã[8‰ Õ“D´À.Š—Sø¾Ñ™ ÿÔ Ôìše£©©ñ­šÌš¬~)$÷Wˆsn²þ¼§Ø8Ø)ø¥•O(!ˆ|ž€úa]d«OÐL¯âý¾„ "—ËÇ&”kóÕÔµ³XüÁ8Ççqñk/îÜgøo„y\Þoȱ€ÇmÔ¤„„_Ùn3k)K¯¥[É'[m†kÍ+'¤.Ú€„{ëº\O!„Â] 9`o8Kx+ j/ú®0ÔÑR×Ôá³'³š¦'œ0¡ÉlÑUTu¶±šúš€ïbç7–» W½SLÞ.Ó¶>û¯³b!Õï4T-Ê ™g0èr,› !¬| zU|²i²åíb»LÛíæ7BHäQŸ ³öº`Š_s~·Ž¦º¦®×Š½Y5©å&ú+ž$Š8 ?5W×Ä•ƒHþ¨›’”ÐÇäePp? 3´ß*¡Ñ™Í´çÞ¸¾Už.·¹—÷c"ÒŸ=ýCá÷OG¼ŠD#«-M¢Äˆl×—•eèã@ÞJåû˜Zåü"Áaîöýý¿,W÷_¿,‹:`o˜Ø˜EEyy9i% 3™ ƒÁP„ØíÇŸ7„P‹‰ƒÁ¤BxŸÌMLC8#o=yôtÊàŠIF†Çb9ˆPƒID±.y®ÆÃ|®ì¶ýC̪‘îÒN¦‡"(öèСG»¿×PûAý3Ú3™í¥ddÚɲ¼Ï2uå@g00zç™×Í Nèt.ÔAÜÒæ&fa‚Ñwž¼ zê2°ÄÎÐàøg.ÐL†è°ZòþÊÚ5÷+_¼¸!ýK7Ìþgª›ª„ é«ýhÜê™Ó§eÖˆÕ7UsbÇ 77·¹+wd± dÉ$·X6 ‚€]âééQÄnžÞ9Õ.°DT«Ÿîž:ÅmñÆc@ì½uNŽÚã~(–ueëïËÁPøåÉâ™înSÜ·¿‡ðõß”5ò*/Yš_+€ØÀ ³<§¸MqìÎ[‘IY“¼sÅ\—EëögqêŒÌ’¸ÍKfº8»ï¹ð8ù .^«á6É9—-&@œÒ…‹—q(ˆzrv¦§››ÇŒã÷ßµ*p–×4÷ª¼í‹§9:{œz È­ððð,+Žš;uò›”ZñöÆ—)î3NÄ 3úÎÃå.ur>û àŽßö©n®Óç¯úYÙ†§?Ûê}8’¬\à“š¸ÊËáÄ«PùõéâînÓ¿N«vò³ív>+inç}¼3ÏÓÍ}–OD@T]ì‚뻺º-Úp@xé ¦\³[rŽ•ÿaž‡“»ç‚×ßùÔÒin…¤pæ$‡'…ܬ°Us=]]=Üû$¤þáÒ‚5—3Þ]Ýãêâ2Õþ2Àå¥vOÊiÜ\÷ÅÔ¼Ú±ÈëHÈ1i<”£¶–¢äÍÛàrãëÂ6"ßØ«&-Rš¸ÿܦi]”䤥Lçì¾²Ó™ÿ­SºÈÚ®ÝôCG¦¨4>ž^J‘Æi/ òèrí¤àëý®ëÏ4ùÆ–¥®!‰Ç×Ïsrž²óÜó† ]EÊï¹.îÓÝ{/¬¡E³¦¤|_>}òÕðrPä=kª«Û´SOâ…ñÀmá:†G…?ѧžQ‚oNc6_ INIysÿÐ8Û‚¦ž­iºzïõ¬¼ü/o®M˜`\ÎÄœQSuˆÎÊ­äaI’¿Æ8Ÿ“¿lp6žqè "†žrÔµö¸Ÿ——sf‘­ÅºÛˆX™þFo´ÞË´ìÂZAÄyßí7£‘âóØ>R‹Å¦·»Zû½N ?åc8c—ÏðSn¤Ëë ÞÎ╦Ž×ÒO«å#6ݳJQˆì0íÚÙÈßè¬ëµ÷1¶ÜÀe³ˆŸÃåSˆ˜ñâÊÚ£š¤™çj o³à}ò÷ÜïIë'Žq*BDÞ‹1ãO>yÿ9jËi;_QˆvºvvKƒ#£óÊY—54MB¢â“b½­užGÄÂøൻ…ÑR‹Å¥9lŸBÄš…šQlDÄ-N–§BÓßø-5šå+dà­·ÞÔ[ß1Òo¥Öœ½ˆÈ-J§e˜Î4/8RsãUOÓ’h»&—Sø߶糭¸›Âø]SE¡HÝäå¾>;Ævv}x;™o}vrõôWñÓ>ëƒ1±Z6òS¯o±^y c.8˜/ea‡i¨èDóEê)ÊËBÿfL"¦=<4aò‚꺿‡É©^è&“e~u/¸,.©|£ B2E[„«Ê«©‡ó´'ùZG Yk˜q2bq¤¯¶ñz^õQ§n‚ÖN6[qºîû\—ߺºÑ¾’P,”ð7WÖNœ¾yåÚZÚ72j„1„>&C|_•‹Dáûùñª“‹)Äê÷†[f!²Š¾hèè•óD²rs¯—ûŠ­nd?ç`° BtŸ¤çû$N(‚ÇF͹U(Œßùü$(>«qDO¶Z Ýô¢J´eüñÝðŒ²äËƺo5%˜b ë÷)¿2jRŽ°HœR-m¯å,~0v”k)""žrUõº^T×ߨ ³ÏC|sÚÉzê~¥˜]ƒ 6ð‘óÍ`”~‚[è-uØîjí÷2±r±É˜OsZT7UY4õŒ*y­ÄÕ°ÃôÆêÌu·¦ªÿ0©öǽ®•}öó\õ¶Þx'|]wRWד+ÀÈ=SuVÜ ¶$ùî£ ÑÎR÷ÈÛoÂBí·¾< RD¢æéØ‘®Å­ÅòPÈÏû8ÎÄIøk‹“åÉà$ÄŠ…Æ£÷浨n*3Â5ôMªùT §>æÆÓ7®Ö=|ÊÚóˆÿuÚå&BËÌ+èÚµ³pêˆ#;*ÄåjŽ‹ÿÀ9Pé2bxûŠ‡y\x§;ÞXh>Ñú‰£‘¤,[œVÜ‚ÕßÖËíjCÕá.³½o> %ÒR±ùB’îÖ?5ª_­6sùæGÁqÒL:’n«=-¶»ŒÓŸ8õ¯ów‹¸ ^PÌç?¿æ|•f2y^ï•Ôr)&  Î8žVYÁèÚF×ëBÿVXõ%*Ó}Ãà:'i½³„Ç0d˜- ßÒƒ—| |èÈÞ}·R".ÍnI*o?}{;PϮؿÜïÅÆÇ»LÍl1[°¥<3öÔñ#Nç/‡>h'ƒ6]óU—iäù.h[™öÚuæÎ.¼rõ ïÒ“¯¶úo5l­«ðÂ3Í ÏcИ¢ À¢—LY¿– ¢‹A)6… :i]+ìG„‡ÇcÒ~¦&êÀ Eiª’% ÿ(&)/%¨f e–“¢sX¼:ñÅÈIÑZ_Lf¢+0(‹ƒwVöoôîm+A??ï¢:ií¸£SÖ?]ßteÛw—ârî%ÕÌ¡(ºO¿º(±Göí <¶”§‹Æ@i=ñ‘3ìg?<-óWàó…G° ‘EiZ ›ͪµÞ—-Gã;úݞ׳Iù[þtÔ£[ê^A €ÝÔœV>>uÓóU´¦2.×±“ͺ›Ìò*__p^UaR)Œü£3Ž÷ZÒM¡ç鋇ôl—T}:w|Ç6ïvüïY™jî&:T¥0å{…HñmQ¡ÙÐ~lÌàÈЃ\ÀcRßÀ7W?3-uÚ‹¾ ýO8ð} J§©¨ulîí'Ÿ=z—Cµ¬O^Ø&óùa‰(_tºEyñäòçïÕ4u‹©‡ö,¬ýtªH$Ä ›2?*€.«Î¤•QïÏßò€ìÈ«êNMÖÙÌ :¾ô{-úUû-øS:AJÀáòš¹ês®…´›­!ÝXDpÜ|:ÿÅîéf—é~̳יi“3Ë ¾Žõß'¢¼Â6QÖ½á·ôô2·¸*^âúϺA™wZ^·5¶°0Ó ÌîíèªÓÆ8ÚrÔê¯P Ðs’ç;ãÕ£¼¶‰òðùÐÏÈÔÊÓÒ _ðÓ§‹övH®£øÿØûê°¨¶®ñµ§HÁĸÖ5)‘înAÁVìŒk·÷Ú}m¯uíÄÀîB lEAb††˜™ë÷Ç`(½÷»ï÷~¾ïý<>2ûì³öÞkï³öÚ+;èj­5íA@Ìr&4º×~×N Éõ›÷;OØÐI{–Œ¹JßûcQùþjÁ|èîcåìc*Ì¿|+)`é9¾¡Îùþ'O´u2kõöé­ÜN.€£÷7?àvÓ۲Ƀk ݦøÙê4±$ÊEcGÆN[ºµäôâ¡WùöÏ+ŸZ êmho+gï&ü¼„[ÏCVÆ×zT"j7è¢]“ÒwWž®¿> @óù¸¹‹<úŒð!¸ I»zïÕ†£ Z ×ª•vÖÈÈáÞÖïÛup°·gPˆ8ñæ ªýÕ5þë`ö‹Û¶Ô oä™ÖlJÒ{Þ¾eݘåÝ»e½º>¢±f˳Wîè5%èU·¦%¯“ÓŒN‡Xèh[Œ±ìÔ;ÀÝúþ¹‹ŒÅÏV†RS7&›j3´÷¤u}§í^æá×ï¢ûϺ7¯ß°ºÆÛ©C̓™ü¬]0¶O¬sÔìn7Æoª{eQpíW$­Ž-rœý'óªO»ŒÚ?932:ÄW ÔÖ¼¤ØÄ¢ÿ©ÍC«Ý’„Óœ½éÖsà6—ý#-jCäóßgzhò`O\e!Z'éT·»5*¾x÷í´£ùõYpÒÏ;(Ìú'ý‡IŸcw^®0tæ– ~ƒSœZñ¯ß¸ë;m§G7H½ùGÔš÷ÏìÑ4¾'Þ*03k\ãÄÚYàÔoÑÍÖÕ\),Æœâ+p/jØuЉ ƒÊKn6sˆÞ>öɘ^.èóà?#Që7ä:´ªD’ËI¿òrÄE .V&S Í‹Å9yù4çïÈ"£*ÉKJÕ:G’%/Uqr5eaN¶LY*Ï‹Å9yŒÚ×<;'_ˆ¬ªH"çÈŠQUR˜-‹Åâ<™œóPVÉĹ2DdYZ,‘P ‹ˆ%r™D,‹%ù…%j7nª4/G"‹³s¥*¦L\G+¸ÊÜüBVíXÌJs$bq6Å°HçM=Y†‹%Ë"bIa>Y&/©UæH—xº;=Ëe¹±XRP¬ädx‰DÅ°åâZªTž-‹%Ùòª\‚X*—ŠÅâ‚R‹ ¤b±X’“§¤¿¥_PåH¤¥,bnŽ¸XI—Ãg”ÅÙ±X’]\¦fûte×سùÕ]A)7’œRŠ-“Ó²¼±Xœ+-`ËBrfJʼöYF"VÏEžŸ+‹‹”,"²Tin¶X,K Š¸– yNN~¢T…™’|®^U"‹ÅùÅT±4G"«“¹ÙòRU¹ —ei‰D’[ÌÕ°RIf¡‚-5—ÈeÙ‰X"É/(ªÅ² I–D¥«€*Êg‰éoÈN©œ1ãWÕLE8.—æˆÅb©z;±,‹È¨òr²Åb‰L®ö«ÌÉ—ª4ð¯*É‘pØ(VGÎ--gçVõâ/.È•ÊËÊr*Oœ¡ÅIn1…ˆJy¾8¯@SÞ_\X>ñâ²…có³%ù%ª ±4K‹Åbi UçþC—¢Ç[†-9÷=§íšÃrxº;%eÿ+ÄkÿHþº×òþé}’Tøÿ{,ÜÚ‹üÞÚ±kj 7×3êó#Å*þï+ˆz6#·Û|ËC’Pòž¡QUȺ-”þÇ‹¿gøþâpì¬ýU£ü2zm.ü¹þ/²¨Ñ+Ž"@ÏaÍÒwœ°Á±êŠ*éº ÿ¾R—#¼6kõïÈúÿ…ÎÜßpM®óZþ_#ÔÅ…¨#7u¥®Ô•ÿÎò7áEù9r¥:vvVV¥É…b$#·˜áŒ“XUi^Ž$3+K,Î.,VBegùb™$+;÷‡N®8KmfÆ”ffffffæ3HååH2³Ä²"ÔdY^vVVVn¾œÓC* ò2233³$”Ú‡_•-ÎÊÌ-@&?7;+++;7_æ¿­ÌÈÌÊÉ/F^J ³óŠº8'+·€gdQÙ²Ò¿Á+ %ÙùŠx&Wúÿ_tÎüÕ0¨*Ìçÿ˜ 6  /KVDÕØ®¤@’#Sj"¦î«þ¡YÊïǺdqÿ¬û^S à -³wÚû±H³Íêà.±‡³XD”=ôs±w;~\Dwo'— ÔÂW–E,çnåèð†©A˲ ËRcÝœ3‹†a0û‚•uàÚÍ›Ï&±¬jœ¿»³GÏáÃlºm¼S]¶»yBˆ“»ïðØA®.ÎSŽ}@ÄÔ»g7­_doåÿ ‘=3ÆÝÁ«ÿú“Ïqù0gßAC¸¹ºØõ]¥ÔS…™+Lvvvz/S–×nîÛmg~=>ÈyÈ)Ä/ÞæÞiˆkúš/½§ø뢲kë»÷Š»ñåmŽð|ý¯– Í®.+¯IPÍ<_ÛÙoο!¾*£”:¹OåœS~ç±`ÿû[ž]³è§óvU\'ýO×LIÏO¶st ïѽWtŒ{X>*¿An~éé7þðãòivÚ:)hµjSzs›m¿Ù7W…-~\ÞÜ^ÕÃÃÇ·§‹KdP€…ÿ,¸ÒÅa0·áò®O·ñÇ©%eöšù ¯²=ó®mèì1œÛmTÑg'ûOù""ûÉ«“÷'Dd•C]].¦"â×ã‹»ô˜ªþ~R/7‡GéòÊZ)j–ËáùêÅkû º’hÕ=qËp» ï±–4‰lu‚XFnª~ÇåQÙ«ùšU¥ý»º|ªF¾©Ûbkp!ªÔ]†·y¯‚*pjÒŠ±šÎGl Ãcÿ‚r­ª_Q ”ËTzÓÑ}fuL²µŽIt°Ë|-uy,|Ÿ)¬´êáí=Lq®¨©ÓÃÇŒÕ7ZS4æKUåœS Û!î×âsÉ×àÓ'Ý]zZO̸¾¡’Ë"ºL>}nO\¶®në‘ëž_\Êrþ™9¾ù¶õ„aÚhhÐ^œ¯ÉÑxý6£e·Nº€(ÐmÙFWûaZnu]›OÀ´gÜ“£K¹ž–>FÈãWÀ=‘Ú:ˆïÝÕ77×H;ÚϦÿ €ú“—L5ðº Àaÿ³r[ø°²X—¤_\âãÔ­ot”³«ûâ?iŽäã8{Çè!±Ý½=zŒX@¤çÆ„;ù…Ž9ÌÝÕeƦóHγ=îöý‡Œ tñôò•ó+&|ÁÊi3~( ð°½ü6 Ø›ÿê²µWw.ök&D˜¶à—Ñ}¼£“)@Š·¹ÙõÓÃÓ½Çè•„B¾´±2ÏPàÆ™qrmÙ¬)q7¤äý¡H×ñ'|Ü|Ãæ\$‡—Ǻ»¹7ÚÇαïôCHûlU™„ äæªAnv΃‡÷tt˜s˜B¤O:9ôøsvøì%+ã¸ûÆJ°R4Døzf©‡£SßÁ±½¼BNæŒK÷w±íÙ·Ÿ§‹ãøŇ (kâ´5DõlÒ¤–,é4÷àçss=zN½ÄmB”ÑŽí¿…3K|"æ=DªpæøeÞO›á2oO‡¤³=ì-ßIÙ'kÇu‰XP'wÿñ/Sˆˆ û9zQ¸kbÕ·¤ß¾L•¦\rëÖ%$jؼ¥«¾Ö8öX¤žyvvI,Ade1vvûR«%MQIû8YU1QŽÎIb%f_(ãn#œœ¶$—›±©fzt\–Té¤ú|t‰UøŒò¬—·Û/—?Tçn®Wp1˜þ2~Ù’ù#¢z¯:x›®zÀR‹]}P‡t8¼,rÚî÷ˆ˜v¬¿ýÀl¥cšEd‹r2Å2…æ̦9Ûº&汈ˆ¹7­Þ—s7,³}õŠ;iÜH”œ:¯~É(ó“<Õ Š?mÚ~ WZÌy¢îíʱÝ?ä#êaáÁÝ+®ÿê5[m=te}ßð™—‘.õötÝ›¨¾v-è9é *¥>öŽ>¨˜rš¾+YF™‘žA1,]ífÆ9>=ÈÅ9˜³Ø+}ü{ûhuzJâéb;]Î>[ÝÞk6"¢*ï×EËß©GœjÝ%! Q–daaÿÛCµÅÚ `ëC÷²«,ò-¿^N–p É/žæs–"R¡îöÇŸå""–¾ó±r¾S„%¯×9¸Ïà&¿bŒëÜ}r“Ï9ù„q|²òá¯=¦Qˆg–ùG-xˆˆ˜¶ÓÆ~¬ ñãñe¶‘³¹¾r¯L±ØÎ * ó2²óëø‹ÿ»Dœ³ã2«£‹Ëñµ„À}Cº§ÕÚïæÃ;×â/%=±u^ìø,þ+§DÚ!À½ÛAC­uÀpÙ,Û¨©¿GE*lE„õÿ¼|y{.^ˆ §b*-a9/Æ RÒ‡Xm2¿U¤Sˤ˻µ5­c-ýø¡´´™¾¨¢’¯mlÒ WO˜òú©ŠqÑæiÚ­ðí-ô¶¸9=€¹ÿ1,þçjj=RÎ é5hZ)Ó,ü¬d00°4Dc÷{Iî vý&¼a‡ž:ðço9@®H¨›!´oÖd“ç­ ñrqq±=¬ ¸ô°7°Õð>NNÎÞaƒ”R¤€ Ç/3çÛMýøKp;íü}{¿Œ½é‹ db<ÚrêÝ]½r?¤dÍK…|^ú³ÛYÀ¯ßÒ2)ñ< îBx"Óf¦G €tÙ"Æàú•—-½\špµ­So¤.Êæ(4ž:9òà[Oææ³"^A¾ t€ÇØp^‹Úõt‹‹‹jn¦~#‡Ÿ?|rÕy±Š…L¾PôU–ÙÒb´mo‚ Õ>!éÈi€¥Ê M:Ø×Ï_v«Ý É–wB†O×ܾ Í жwtóù½.ä-4¡Ö­¼;vÃ<€¨ž±i½:îâ?A3E]_KÈ}K ²y«¢§%P||#ψ)¿,9váö•ÍƒOlœœ©`ÀÞ[ÏKìôööööö°.™ÉúCRÂh\¨=TNMøÍu!]V~·*Í’ ›7å·ëhnnnnÖi߃T€&»ã/;Ö˾yû±ýð¦~ûF@”ÒÏ.ý»ŽØò³¡¨\©Ó´£Gìˆ1¿m?\úèøöÇéšœ6"ñ]~PtnŽû¤ÓŸpG×Ý]ÿïa–¦ŠxDH –wÈ–ôq ˆÿÄz÷ŠìÙN‡Bx"££wo¹4VœÝ·Öòëì]×Àväösz¦$&ÌìÞ{|J[‰¤iÙZw\¼þ¾øÙå÷mœÝõÔôBG àz „£@º@påb|||||üÙ ÚØÆ⛩oôM¸ÿ K)=míò¥1Ñ%9rªÜF…Îëf–¬lÔ³wdt_cA™$á<Ü ÷Áニ:š™›››Ùø/BÂó øóY¡{@ϾýúšéS@h9ƒÚ|÷Ríª%Aƒ¹†+6<PÞ|“êa_K»ýû·?¸ú,+ÏJ(®ÖFê´U?F|ƒ¥)ßXUUyÚ6 Øø„C~¶RÛJ•¦\ÊÐf߀°òÍËWv¿°…¾úÆnjÀ2;sUØ,}Ç£¦·^üYžÐv~€ËŠkƒZ–óPµ_­…½}Œ¦žz1ÇÎHþó'ôOóZò?z[1^ª$KÆ>e¦`QIéðæ ÊŸŠŒ[?x|ÛÛÙóMï[Œµîü±ü@VË-Óû!"!Ð\Äÿ˜[¢Éͧ‡óï¿9¸câÖ©VvßäþjH)£[¯EP@´°ïŸ¿lhÎyã¶(IÌèm™5ÜD€„ä̓ÆH+ •ÚQ£gF€ò©³Å„¤^íKåÝû‡Àšña÷ůÙ4z›aßóÜÝ–m¯9Ï)?Òä Ð%@¤ùYõ´ tZ"P3.­/$„¡TD ú+„íMëe<ÍQ÷˜œÏvm®W®iN{ó€ß¦ËÒ1áˆHÈç‚ÒÚ°CÛö›ó¶_Ùð¨gra÷üñ­µâŽÕúIK$/,fLE< øùåsퟭôkò[54¯0tIa°ó£~v¦5D˜æû‡ô_2åXÖóÄzγt¤ÜÞºÎlòGån)–¼úeá ª†8ï‚É;æJÄnŒQRZ"Ïù8¡ÿ`ýnžýLxõRû žž’+/-))‘çý>o”®aóNú‚_矶;Ê@Êôe!÷æ/(øtõмmg¾±ÀrÒrsZÂ[‰ŠR¬™¿²‹/ÓÊMõ&Ò+ðЫEIáîñ½TíÇth(ªtª¡ _”]J€C·VöoÜý0³´´43éȵ|åÀnÍ ëñ¹_Ö$„0É‚`×&pþé'ßoœ„à«S»ÜËÔŒV¯y—ötÉÄ}I¥Jå§3KÂÆl- ,DÔ\((þ*)¤(úà’Å%Í ¥_$Òúyň K …üó—RýF-ø%ƒ]½6?–”* •J,+lÔ 1U¦äP¥*$…Îl›¼eå‘¢ñÛ—GÔùmö¶|%ͨ²í8ÞÞkϨmW-þ¤í·*­’Íèë·;™Â(svü¾½PÅ‚P[HÉ2‹±r€,ì:(JïÞá}Ï T*UöëS‘Õ¥Qù ÕРqIq^¾B©T*æ \ÀéÊ$ÒïóÂfúº¥)©ùE_ؼ´°™‘4%SEšÚ4i4oÛY%¥?þ³Çð…QS"|÷ØÆ0wW¯å»/Ð,‹(ñ·7»R¢©ÎdÙR_W›« l;`q #(³,"Kå=‹ õ±upŸ»3¡F«‚”{ÑAŽÎ®3ÖŸ¡Ê‡­!*âêr#]ÎéG ¾<Ž óspp Œù8Kí×ûæÐÒn}¦q¢Ñ%A.?æ#æ›y~*–v¤_·˜ãÕu°¢ì–?®Z«*\6>ÒÉÁ¾çàÙ_‹XD¼º6¨û´ëˆì§øµî.ŽAýî~.N»¿¿«µãú7Ôç›{Âü\Bb&¾(‘*Ïéääèè¸öôSì£Ý“ìì&Kã~îûehïY[ÊÖK½ÝŸ~z9±¯Ÿ­óì enÞªóGº89¸x‡ì½öš›¬ª ÙÉÎæk!ˆ;gDt³qÚòXùùd§èåêdeÎëIÑ!ŽNaÃgg•ÐˆÈ”‹Š‘½¿k†ƒ££ÄØÔúÞΙ–Η߿ìØÕ¿Ü3:¶ãöË)U”Øé7vx»:ºù…_z-Ë}sÎÖÖqé“"DzבÎöv~á£^äÒˆÈÒÅ#Bœmí<_಑Ž¿ìQçØ~»)ÔÖÚ:¥P­à?½Ø'bÞ.Á´¾žÝl\o¥RˆøöòoÁýË{MÜ8Ùvàò:aíjw£ñ1×hLÁ~Ã"£zc¶:¨¿`Q¡™ªú´†Æ,[³Swers5CŽX³Í²,bVì0î[¢æúºü¯ \cÕ,A nNº˜þM¯r¶Rpïÿ‘§8ËVB<÷÷¤`ó½O‹Õv”t©·»cbFñ÷ìn*a vdÖ`2Ã$­iï=û;6,,«iITÙ‰ýÞv«nsÄÖhÄVÞuU6ì‘cŽfjØ+¦Ÿ¶¾îƒÿQín4ÑÕ$<&ÕÅÉ•ÿ¨Ô˜TUC³ê£àÓùñ—.>NSTyZCãj#€œ·/ž»¡òˆÀ·ýëì_Ï?L…š „PùÔ¤9SÙÒüãû·]/TXšè¨%—eÉ}jì‹Jë-ðjZYÌIjÃÙ_äèkÁdEåÅcû'þØ~€®ºšÉ?4Í™!5£ºr¢Áo(Ý4‹ìiüì·üܾ…’p=Ô4ßZÞªä—TǤ&Ì294©¾Çžß>½`r̦ÏV뛪ÑBˆ*—š1yÔ ÿO þüù?°dIhb\Ÿ*-4êÐÆDø? ûòþ˜ròp6ïÒA ˆyÏHc” ±yÛ5£CÇ°¡6£”?ÿ3ɾmƒ¿([Ô2jªÅ'ÿæø_>|ljé7{L(*FihX߬K=ÿ£GUnŠ¼^ÇI#¢ µù?¬uNÆg^CË™ó&êñ*ÐÂ×5®¯¯U ãÿ¶Ôy„וºRWþÏ5SM̬© þÁ%âß(Ö’ÍþÇÈÿ,ûÁÈ4«Ì«ŠˆX}ežíX½¶:€*xÐÀ Ö¶É5›×ÑŽ7¹!„ÿu”µyçù‡¾üàFBȧCáVQG±VÙfµá\ê?‘[«½ÝÇ\ýyè0;[ÆeûÚç6bå½Õ4U…9Jæ_üíKsÊLœ‰êá<ëû !Šì7Sc‚¬»Ùxöü(MÆɤTyïã„tífÛcȬt9EgYƒ÷­ñ´ïfçèµñüK T[3ÅÕÁÖÑÉkñÞªsñ°ª¼¹<Ì) µ…„Uü¹j²£MW;G¯UGî#©ÈÚƒ@ û¾u›Ÿ¼¨»”ýKÉMeÎ¥úYÈU‰÷¾³æêëùQ­ª)ßÀN5T«TkZíõÊð5ªk>¦x=aíhëè ¤úÁ…5UF5Œ®œUy¥¦3»ò¤°†ãÞu⥫ë½j¤Xc @} Ÿ¯‘–®veÉÎw:UOjZ_öPl¯yÊšQP žkª&½¤OxZÙÈ÷ïHŠ´úmoïHþŸ&>91Ïejï÷R whPhýÈI‰·Äöõ - €rkëì©GR/=L|tûä½e£–Ü“õS*°ºýàñý{˜#q‘[Þ’‡<ì{Ê›Xkik•Só…1{Ó¾û$éÑÕ]÷WŽs\‚å&‚˧O¯ß¨¾ˆWi­êXJn!wÅ \›¼nBßÀY7§-×ß×7`ø̵J „PÑÝ£¥:†‹úy,>”B)|{iXŸ`?¿eîqª‚„u㶿Y9²w… ~˜3²Ÿ¯oÀèy[B !dlŒß­÷Ù§ ðö ˜¸l?! !ç¶Íëà1|v‡™ IDATŠ‚«6ëÑĽ}}ãÖBUÁë I CY1.`Ý™ Ny‘qr¤Ï¸K„9#üÝy5¡ÏÔ™5N’–ÝÓ/ ÷Ñ—EžúDZ¾:.6Àß?|ð¤×yJîØ#„dÜ?ÕÝ? t`Â'9—GTóË:¾þ—@ÿ^ýF=N+"\û3£zÌrs÷¼@_ŸÓ·0„œ[3ÉÛ7`üò#,ÎÂõEüï}BüƒºGî¿Æ)X&ò»ôäåèÞ^ó‹Àƒ?ú˜²Ž’\p œÆ<Þ=0fÁ}DP>Xà>æDÆ“#½ƒ|Bz¾•ÁrÎï/m öúKNÁGoŸ~y I@ð“‚\=_)ør}Kœ¿`Ì„•¥ BÖN ÚzáM\?ÿØ­)@€—£ún¨ðùÚž~=‚üü‚gm:Ç­oüx¯ÝédQLñgÞå—…ãúûúù…ž”˜Ë%ã¬ØK76EŽÞöñÊ–™þ~~‘#ææ(€[eI≡½ÖzÎÁü5ÚóŽ’õõ[þ’€øÏ™v]Ú•¤¸œ5§{D¬o5ÄØPç]¦T|jëÛ¶}gµB„f“ZjÜL•À™³gcÆ/‚ÀpǶˆsq+(€ŸÞ{x"€ÖȉÖYñçh€¬4÷ïDvk A/Ø–ökfã‚n«Ù“º|>yZMNy°cæ«Ö#¢L‹Ô³"y‘î3Tu¬Î߸Ì×Vÿèë0ðü³_³‹ßõ°¶Üxù•D"ypb…³¤‚a‹ò“­º%|––²O÷99ù¾LIge, è÷Û9DLØÔÛ-pH«Ïé9%H½èjµçæ[‰Drmß<×^C9;‰!}<ÝÃâ>Hò eY ‚,bd âêá¡ýìKÏÌ|¿ÙÌ)<‘λæfm{õyŠD"þcÞ€1Ë‘*ÉX±|e‚AÄyƒ–MU㊱|§õö ™ðäszv!“r$ÆiðÉJæÊô{Û¥—^‹ÅYw·Orv²Ùr!q´³íÔƒO²Äâ´äsî¶öw¾(ñMÂjï~S¿¦}zæílþ…¤<ô ²ªù½}"—ŸÌK2Þ^ °îvü"¢øâpg¯€«/S å3zº ºš+Ëû:ÀÉaÛ+"žZ1ΫÿŒ´,Ifê«!N]ç\ÍEÄQý<}ºONú’ž+gÓ®Îwtèý65#ãË“Aa^V¾SXÄ»»M¹Á²È&͵uöÜpüa¾¬ ùò;ï‘z÷»™çwâŒ7Ó"ÜíÜÊ3þjç8úk®”BÜ9/ÄÍ'ê̳Ïé_÷v^zìç<æþ§ô¬|“wÝÍÚöÊó‰D¼þЀÑË1ÿÅK‹€)éYYYËG…]þ'"*ò¾twt>û6½©Q~–ëÎ'g‰³>$^0·p‘P•0}}k¸‹ÄÝ™2Yþ‘)½¼§AÄä k}ÂßÍÌÊH v‰Ýý™wœÌ½çÊU,*ž88O,®jÀ%õq´x™ÍœX4ºß¢}å6•Û"=bÏ|DüØÙæN!ræFLÉw;Ç,%þ>±ÏÀ¥Ç¹¦¢œí¯tÿÐÒîÃU±@âþÚÓµÿ®ÏjŸÂÛöÎ19ˆ{t\ú’kU´nÙâÏRªÎ æ_ï†GxZ¢æA–m›5Ô{²f•ÔcòßÎ5²ÖB–v]¢Ô3ªÏC441¬§ Gþj=ë„Yëf›˜ÎÜ;÷ÃÎß³x„™´÷éÜÊ´Î%‹•ÝtëШQ#Ïþ3LRßÜ*àN &lØ€v ë6éÙáÓõ‡y—’SfŒŽnÖ¤‰Eàð=KÆ”*átÜ“‘½,Z7jÔ8fþ¼Òk_!tL§ÇM3Ðú†ö={tkeÚ°^ mrÞ<Í6j1Ó¯SãF†­î OðÄ®½3êøkT·&·èìÑ©Ñ™ÛðäÚÎqÛÚ¶hÖ¼å¶ukZšˆÊ´ªD!})[¹'®—iãF¦¼Ç¶?³}?wþ1B'7³–úúÖÍL,»¹´414nÕ…ÜL–(ŽžM˜´pY‹&š¶ì¼ußØ„‹U„ {t„ÕO¦&úxzÝÉÎÓ·uhiÚô§n}»*Ù*é‰BÕv@o;Cƒ.vŽ¥ò‚€³¿n‡Æ¦nNm›…÷·Iüþ\»ÍÞ៛7mbÚrù‘ÙO׬–hÕ7"HŒëé É×Ãk›õï¯[‰çVM‹ í<ôw³†+GµŒÍ¹ íë}œ:lB¦à§– ¨Üt‘N•äZó͘·°çæÒ~¾¾Ýû pé¨S)âÀ¸ú{ŠxXPð6[;gQ÷ûœ &¡%â¯E`,¨ç†Ã©#6·á|„€•ß?Z×gö â ”ty,R‚¶ž€/ ”’àè«D$m²zx˜Ôf콸0!#ß=3¦÷¬Ÿ-íAjá÷ a.¼ñy“S6 ‘×û&~±š¿Ü®  ´ ,W®Úñ½®ücrDÍé’潦Xùq¹@D`(¤{n‹Ÿ\ùû¿@Ê ë’¶ƒ–îëo[«¶³üO¾ž€§¤hN¥¢6èm ‹vsŽ¯rÒ«ü©­¢5ÎÕZ7Ÿ/bXe9$ZI ¶H‹b*¢—Ë•Œ®H 2Ò¦eÅj /JîÅ<¡Ý ññ5 kWïêò•Š…§ãmEµ²ÀÓa±J-©U”ÔdYW¾ž2U,÷ SªüN‰e–Ä&5 š^2Hê½çܤ®vlyŸ3UÀ;zöûÓ³-K;~h÷´ÁûoÞm«Ã«e¨_!ÒeðñUn£(?)ä qj#nPÒWQÁQvÓÆõ6ã0ߥ¹ñ®·Ù庄é¬C;C€ú­¥³Àº,|£dZ7f^yó˪0òëõ›1cWÈ,9ÕÃPX±!ÖÇ^ÕëuçÄh¢^bfìö»úõS{õÚNx(Ï1¡Æ÷xå³d÷ó:Bó¿ GìôêäE¹úgé¡=GK+©?u{7KXuLý¼àõ±KIU ôêÙáé'ÕQùÁ½'©ÚxPA{#þ“×™„!¹}:µßž&èۧͭ5»ÕTD‘qðÈU‚Ȳˆ ¥«S*碅2gO¥|Kw[\WPMš´‘Kó³  ôÙ§¯ @¶]Çβ/é GªØ»é©Þ;èy{4º³û,!„¬Œð¶÷!P˜—S¤duëwæÓ%2‹9øI×ÏòþÈÚkÒú­w ÛÉ’õž²f´³÷oã®örmÞ²qZZŽ÷¬C- €;y´w´Û•]õùÙr^‹³ñödÖøÈ!c.[;7 2¿Ï²ïœ.6ÍŒ½ò.OQ,+R²áa‰ ÕúÈÁ_Ö\ü,28Öû ;Gdd~pç|M>Z…„âN" ÷qŸw,É©¥¨Ž”ü%úN ,CÑ,O(à«­§hšb€¡@ÈÑ}•ŠE<‚Y†¦ <¾@À',­b€/ðËÌ¢iD œÌ„¢T<¾Ï#= ù€¡)†E D r²:D–¦h „' ¸mGQ´P(ä.Ð4E±„ÇðbˆHȧ)ð>¡(5pùÈY·.P“/"C©#Ò4Í"!B Ü Y†¢à ¸#¥R¾HÀ D=`õS =CS,ð8T°”ŠQWËÐ4ïg9B¸+²4E³„ðIò–.Ó³Þ%,ai¡€H«h‰UR´H("€eT4„'ȹoÞgË»Gx€4E!‚@(BFÅ‚@(à•Í„"S(¨†j¤i ‘'¡)ŠžH(P'ðæˆ@(à€*•J ñx„e(†å 9Ž‚¥•eÃ.G)·g8í8ËP4ƒÀ ù¤–4¬¨iŠf 'r&2å+EøA9&šfØJ¨¦)UeÖ„…Šª’Њ…Í;)­R‚@‹3›¸8±‡QÜI‡¦ü:RòO¹_XnÆ¡[ ¬BʼnH$*³$¢ù‚zOTpÿœ¨°š5šø!¿rKBxB‘¨ŠhI¤Q£9<®cÍRÆ”ÅUÐÄQè«;eš/TZ»ŠÙT©$ùÂ@_Tö6jîˆJœò…טkÕé—Á¼Ÿœn ×S“+Þï/ê8ª‘¨ ûe³Ò˜i9€¢ë´àªSÝ—þÓ›';Ãg½+yv¨}ÈÌÝÓ¶Îì¿ÿ±ÔŶãÃ+÷›÷YñGœó¦•ë‹…¼ý+d…ŒîiɆGæÿl×´ôAÒçé[N‡˜›\^Ó}SjXvÒI‹°…¿O°Z16òÌ…[×V÷¯>ì8pýÖq¶dp˜KÛŸº½SǦ;O>]pærH"¿·>dòM:u-üüÜÄ2fÿºq쨰d•±kÝ»·_„Ì>0½g[¥ì…»ßÐךêóçvÒ 92#¼%¤ÿz)òÉîîÓºñŒ\ï¿~2ö÷ˆjü¦‹œ)O8jdºô´˜°ie„@n_ëž»ò$a'¶7(ŒvsÓ ˜º{v @éG¯ÞgÏoèéµòü³.õ!åê®°é»fÆßíÓ ô¾“ÃúóÏs]™×7¤Ä°­C3åýÄO6œ ³nòÖ~cFY Š-CŸ<œk;Ä%ÿ¬^W¯çǶX.<¶2˜X4¢ÏÅ/Œ›Uó{W[ Û´ad7Å)®»;wÈ< }¬¾{¬ïŽ§¬£SÇG¯ôZ< {8¦mrçðÝ/î²”—G˜uË7†íðݾ‹©®Ç;éâ•ásωíúÈÁÕË>‡Š6žhõˆ€7¼¶¹ÏPFÎçέ¾\iµ½U²[úX?;3aqô‚s]œ¼2ïü˜°;Žpa~è’K²®ŽÖž<ë× Uf¼úmÛ :_¸déêéC:ö _P¿‹£ þè]É‚ÓhЛÌsfýOì VXô*zzüÆû¦g®ï6âÁñå±k/¦89Z'^¹k8çØÂÀü'ÜyUÌ/Zõ{Ñ”}¯®=1î¨Þô´Ü ­9?ë%eä~úØ >QèíŸÂ˜vn Ê×îü.ñÞ¹Wt¯O²_×ñÕé‘u_ûÀ ×^’ö÷óð‰äò®Èo,7óÏ%šg Sœ?Qˆâ`Kë'EˆˆWŽ?ªÎ}‰¹o…xes¸Oa\¥4~–¹ßL.˜óÜÖÁ3FDá9býy®Í¥~~Sn ²á^v'“ré¯=mdøi÷Û¾hDD,ysÌÜ9²‘e(©TÊ°lm(â†ûö½ƒ«¬€âñ±¸^cþDDEâÂ[¶yDoBDåÇ«Öý¥/Ö¹„n¤ñÓöÐ9 ƒƒ'#"-ûbïêQDãøžÞG§#âÑeá£Ö­ûí"›ùÇy—ÊßZÑÃgô!õÜoÿjæ=Y…ˆò]­v½S "^v1ëtäU)"|ºêäB³lîÙ©s¸t\”øq71‹Ôã6–n¯ ‹ß\²péÅ%rR}=ãikuàv&¦_îè¥Dd¥§ëÌÓ¯¸~wMp¶ú9-Ïpvr~™§BD,xâoi>qÓsd ºÛ9?(`?ýnÞÙîtŠ ±$ÝÉÙ%¥P…oW[vq¸!FD¤eŸìÝ’rUØ_8/>ô U²›¶¦©ëd}l;s™o>\þÅ·÷JD<5&xà~un¬ÌW7®<ͪ´½Äç»tv8’Ê-äewçS¡"q§™Ë uš*UŽ«ý£Œ"DÜ» ß„•ç)y€³sšœBĸ>ö+N¼ç¶ç Wǃ)¥©;†Y…­ä’d%_dïË¢üÚD³^[ê‚?üåÛá¬V³!8wöU£­î?£b€º๔â‰æ,°,”œ:›Ö$FxæÌñfœ¡‚ŒaK?Ž¹=~üuÓ.Ž7Ï¡XàU ºôÜjD[!°”³¥צAëì' Ðos Xs.A=¯ù©GwèE‡>´p÷¹pö ‹ (›¤\‘BOcAýúõ¿5Veca 5¥E€Žþ’]»úœßz#lÖÑãGú}ÆÑ/[µq3lí‹ÙCKè1Iûoº¹þRørD"-3iyêð ÖÃtñ“}lß¾\8á€Oìð0å·=Ç¿ ™Ó¥ |éñS©¦‘Ze16Î:ñ´ì @׿B½<ª‘e{mDj³H±@Žycjæ}ãÜŠ>OÙ‚’ŸKc¨ê»·­ššbÒÌÔ„Í»ÿÔxaµUcBº¶à¦lØ̈.ÈSÊó§×Ú@ˆÄ [€­n*°,°,ËÉïTÖ~­…|=@(¦YPÖ³±k Íz :‚/w.¤à õzýêDÆíçºzÙÜti!K ŸÇ/*TA3êõyôZ8vÚ¬¯=ý|ý=º¹7­ª”'´îO-¹ —€/«˜›×’[<9FÉ6ãk]ü˜kkªÇ)rhÕHWùú]ñDן@÷­{ðûì®=óÁÂ¥§ê·J¢º7wNž{˜Ât7,¤Î<àǺLèqÿË•¬H%ÿü%•fÜú÷o¥¯iwKª|Ù×Ô2©ÈQ†2ž®!÷©*Q¤Èÿü%•síô2 µÚ8y<^%rÀ”0,çeÙQ¦$yÖ—Tg&ßcä€&yŠtj´ù$€úm:f‹s÷½+ÝÐÐøM;òè5«º}ֲϞ.¿%Q¤—à±ç_zîïÜêܵBÿW{ÚØÍ#ÐePćˆ[0@øÄزCSS}é %07¥Å›Ú4-£lt¡ŠÏ“¥§¦ª{‹ÑϨL¶É¯ZÀçñ*™Å*PT*ýüEÀaÉwèÀŸ„¨cÈYĪ(…¯[þ¾@KX‹ü¿"³K—Ð%e®ñ:õukÀŸ3­NAK½Æ ­ (HKKå™tqöoÕó^ºx ë3{éh»Ÿõô…q½/Wi`?úêQ§ç­š4þ=³pï±^õ*­Ï«Ô))QÑBJ‘R¶Íì""Mj:¦ƒäþöz“´x P0B‘°L@¤Æ«¯-äDK-VV^½½eß»|@m}—±ÃBê¨ÍGnʲ[[ý=)GÎÉð ó‹ êëÈÊ·–M+úUÇ>ãÂsáBJ¬®¤j@rh§}Fa3zl˜‚¬ÈÀ¨–ÞµZëéK 蟴ø@ðÙ•K:öþ®íy»MÆŽµàYÉúõ*ñ,„GX–áNuñûÜšT³UÕU„ß$¶[Ñ¡ä´<ìÚPzØu8øøô×ÛZ‹VéÀxwïR>‹›[´EWÇcÿ(z ›p­€QpÅÒGu:YÚ˜Dÿ\r;ýE!¸57*×ôéÛµf·Ù” Ö]RJëê }SEŒàØ^ë±=6„›f¡¬ÄÀˆOgT41ªW¿¨ôE™0µ´ ¯ô»k,Ôn„Ç°ˆ< R’s¡UMjæÚ—_ßð' ØãÆi!"!ª’®nÊÝÝ¢V'Fx#"a_ç“*ö„ÅùÙz-,‡Œ±2fÚë3ó&ÏZØëôÊò+<©‰›îܲ¾ü½pÔ˜qÜ&‘ËäúFõÊ…ÛôÑM÷c÷¬€æÍŒKÓR.æZ@àíÍ+Š.í n~-äÆ-ÏÉä +)^C§m ¦9µ:‚ó#*­Ç5º³i˵÷R©ôsR¼«oPZI%Íi¯ã_®ëÿ.C"Í˽²&Ö>rEN3¦Š..Úï“T*}_ï\†ÔòÑ{vh5wõîì¼¼÷7ö ˜³Ý¸ Y<;ï°[o¾J¥ÒÄcËmCF«€Ð¥YkV¯-T±ðS‹6¯/—ç¤=ŸWIjÿ¨ßžØ8móEN‘a7¸ï‰¥‹ê ×èÔÃãþÉméìZ€ÍˆA×V-.qŒ20µµNräI½fBî$]ÍL7ï¿láæî7,]ÙjÈ0-€wñ»§­;@zÍžôvCÌë¯bi^Þõcì"ã÷÷7ºÍŽãšÌyÌ IDATŸ›óçéTúöÖGÿ>ù•Qó“e7øòvoRf¾4÷è¬abæ»jµ7âÑ[®&Ëdù×·ÎzHéðxÚȼü”‘S üÞ¸P¿¹™“–røº„ì<©TòqXÇÕgSMŒ›ÉÄ_r¤y9YÓ¯4Е¤¤*Yà‹ô)ùI¶då°~ã7ŸÏÍÍÍËËKzþÆ°MW¼µaÎü£ÉµØF³í£4O>¾ôì+©TšþϋìR ´s³¿äy~¬¨aPc ˆýÝw®Z(ÎËKM¾·\W<Ü;cïo¿Jey_7.Z$úÖ¼êhÍÆÝðZÚZ O×åüͳ§Ä…/Ê3ikòέ–Ú@´t¸JØÂnع­ÆŽê—U„¾CŸŠæ h‰Ê ˆl._;8mòÔ_d;º]¸{Ù„‡DKK[À#= `ú®SíÖÇÅD„ë6ïvôòñˆ¤QÀµSúc¦Ä¾ÏV´±ëuïæn!¥’^ˆ?5bœÍ_Ÿ9jD`ð‘®Á#Ž,qÜ¢‘–¶PPð¥l:²”×÷R8=*4lß$ñCúuhä×Q¹¬žµA‹Pƒ‚¾cÍ ¬¼ôJß· QÇÖBˆôìtäÉ ×z`lU¼lúÌ…-  õCâ[hb5ðÂÎcÆÆd²f>ƒÀ‰.t´µËv:O[G»lp8!@ø:ÚZXmmm^>Bm‘ˆÂzç.ì3¦×oÚãWíö(™ð€g°~EŸqCžÇ¬Þä%ÔÕ•§¿ÕÖÑæ"ÔÑVûß"謹tcÏ’IÑ}—ñê™NX})È¢ ÀO;Ç<ÙÇ …ÍïÛÿz|ÉØE£ÚÙ&ø: m§=`Üñø+ÖÅõZ­$:cÿœ€YÉIOKý@sÌ ¥­Íç mŽßŽ_õZ3¥‘ὶìôùàkJPÏVËH_µVJ)_9,uehl ™ìY¬’¾ö)TŽìËËT’fŸ,[5JvåGš/VFElu„h¼Æ²¬&(͉ԊFõ ªÂ[ WÊ‚qÓ‘îfß•V\•)³ŒêÉÍ 2§±Áy=:/Mȯ‚½Ši×TYËê³5nœoì¨J(­ ×Õa²lÕµ­­1Ë"Szæâ3îgñ—{6ž!ªös]ù?+ÿ?úLÑ…9¿~}=á GÔoÑ.W”ܺ=¹yá‹Iè­ßG~399°Ç&ùm|gäïùåéÕDYËÛ§× ÿ ¯ÓÃ-XÏÌÓ±­þÅsñ Ã6îkS'¤ùqJ‹æ7 „P¯Ÿ=“)µë5°²è(€ïø|sêçO¯’²¤EB]£.æú‚ÿN7qDÀ’ÜgÉŠ)¶~“VfíšÕùÃב›ºRWêÊÿå/$í­%7îw_üw‘±šSôþC8ßMPÿ7»«9¯}p°VÅ}M½kÖÔðæ?r­qTf-ù‹±JÖ°‘°úk5v‚ˆøý5/hÍòÊï,Q]ù÷’BȽ ~.±PÓ”³ |&ÞúƒJ‰òê|éã¿-“)QÞ™ÜÌmÉ?XGØg¿[Ž*÷ ”œè¹äQ°„ü³1Í|6ÿ½îÀû]zMÝ5°KÀÔµ+"÷€àl¯Vý×½TÉ’­,ÌÄ%,!/î`iÕ•+æ‘c}ÈSq^ŽWwŒòŸ¥áI^l›Ú‰«!‘|}LT°­µU×àè ·ß窓¹”'Lpœ}eZ¤­………………¹…¥…9÷§Ù¬S/-Šíbi©îÒÊÊÚÙý±;4,sWx2{d_ só.-{™~çM)ûB !£º»š[Xtjgv.”}ëäë¡~nsô©Œ3J „¨Ä§¬ÌͶÝK/?)I}ÔÙΩÍœscm§%„’íßúg‹r´˜™ö›pÿS>)‹«'KµtÒ€®æÍ,{œ|çMVm$‡B /Y›™qÀ,,¬B‡Ä%¥Ëk'õ ”|Ì)RÖÑ‹~Ý­µ<Ü0!¡e[‹N‚Eö«íš•š}§°šj¬ª&«4"åýÙû†v¤ÚHØoé)Ôªj~€sBº¼V…]-@jЭ "â嵓&¬ºœý츃o­¡¨R½=Ö±[¯,D¥ìµ«³£¸˜ALvï`óHYáð¬Þ–V‘9,"â}“{ X  ?y÷/ö"bQÆC['Ë)œÇ¾>µÜÒÒ÷™J­>[ásèizù[ë‚ÍGž/,ÿylŸ>35‹ò“C}ìy¤öA»»ÍÆÑsÅ1õÏç§V;ÙYM;ðºò”Å~í»^”V¬uŒ¿ëª1ÁóV$I–œsuñ±µLU¨•¤=±÷¢k_Ž‹Ó½æœDDÄì^­÷I*=Øgaáÿ‚BD”>ïàà2cÛîÑÓ«œìl\Í©u• ®:Yyå–ýJØ<ÁÉ;˜ªe· â‰Qû­]wV§üúÇI{€=·nŠ»«K¯¡sÄ¥„rù· >sîBŠ®M°‰=ýæòVg¯€Èë©*‚HòNoЈ®@I:µ&ÀÝÉ- 2áS!%Q.]μQ@–d»¸º¾“©ØܤñÑÝC¢Æ<–0*éCW§^r† éµM]ºõúJÂ*R<<%JÂ侚: §““kô„åEåAx ÿí½ŽÞÝ>3¤2{Oy{qs°‡³‹oø¹×R.,ƒäåÅ^>.~w2Kzy¹<ø*‡äͼ¦!€„UȮȡ[=6÷Ù„˜îÎÎÎÁ‘£‹iBHÁå1–}vsñ)rß^ííëâî~3½4ÂÏõæG!$ñôú`oWW7‰ËöÒˆÜ`n?¼mäÕÐÌ­qNööt¹åþ‰Sç­Ü½ª8d•²âFÐwÉî–º¯ß~ùN ³üÔ;ºÚ½ZépKÛ©çô[׎X  P—Å6mLËÎ{†Fª*D–®¸Uu™éÑþüÕÔ×a£~ïñÛÙéa¶'aÑsÒÑU/nž“_Æ,€B#Y ìzJ¶ÉÈÕ³åîxKWpߦ¿£ÎôMþg"\ZYqLÚ^æ×àËÙ+R`‹FE,ì8nß²Ønü]C'Ü2½Éþ¶ÜR©RÏ×#t`I _¶[N¬ŸáåêäáÓc[üKBȃé^¿½oµæ!äÓ­½¡~î®®nÃgo,¢‘òîÈJÛˆiu¡ÿç—)“?_-Š;áRL“݇®¬PZõ´É+_èùŸ¹t}û4¿¸‘à °yﻡ¾àêŽi3HŽÅ_>½wáÂþwÓyNVfWn\ã²7ç¿ÿ“ðÌÚ‘¨°Á>Ów\¾tyלžƒƒƒKë[ Ù’!pïeÓæì‘DŠ?ÛUÜvxcAR OŒÝ¤ß®\š¤N!@=é±ã©mOœ¿²q’Ëø¨°b¢áHäɱùc¶¼:xöâù?W­|áUä\éµpÀ– ÿ¯½+ ¨ikÿÏ:SçœF)dŒ2TD”ŠŠÒHD*Cæ9äÞkÊ!Ó5]×KˆÌ³ÈL¡HEE¤’T¤é4žyïõÿ°O9Õ©{Ýû¾ï‡ÿÝ¿/ö^{¯q?ëYÏzÖó»yùðÇpŸr)Áf2pƒò ¶øÖÓFM0nªãOGîÞ¹{lÏtO*e³@y¼—oèÄ}·n]=ZôëØ/uR6“YpiÓ‚ó%çnÞ¹}ëÆhµ‡y70B9O²zzš2©¿)¤çÙŸ÷ ®©ŠëŸ»Ì˜ÿ'½$N¯"­6ÜÖSé÷p©©MŸYIPbiéê`Œ®N°ÜŒµþ˛ yBÃîz ÈL+Õí²ÂVrü§ðÙyô®ùp0­¥^øÊ/;ÌãsÌ]†£óÑ© NÞHV·àÐaù¥×3Eÿؼ÷éÝ7†aw]iya‡¿Ù·³ÂãƸóßÇÞ­™Ø0¢!‚G#tô-Û MÓÇœ«ès÷~ì•é[çF}´ñ¦™6{æ–È ½ÊOûo{tìê­ØØ›ó»¿:)ôz™:Ú‰–&ŠÖ]à1_{È(“vcß°e{ú§Ê–)K#1c×Ю Ýû÷«+¿R  Ò„²šIÝ d1Ñ7Ü}£Ág‚zÏsÇŽ"mÆ  ¡–Ëóܘ@^Ü|Òüç&HE£Rêêê½]RŸg#Ö¸v¬{Ÿ=t ’Ÿ¿Ÿ5k굋±`å{(nô¢%Ï—£×Nèo}\çw =û°Œp‰çÚñ06sòírä\>1½sÉq5âÜðõ¯µ58ižŒ¸qp÷v‹Ú;v YëaiÙ'öôšýk«„&¨ìCâÖð*`yaÞ»§)ug¶z@Uµ€«I¹å*i/Цo{¢ð})X´onrŲÊ}™âý[z@‡‹×‰Ëk§hH ½ðEî~«Ã½¯lü±¹‘ öoþ¢ –§¿LTs ™f5ŸLS›‰(wc%… ZÑ8Ø|‘«• å2¤a¸fÿ PžøîãÚÍù\ ŽË6M¹e cÊA&¶ÃfŠëjeryG½ úOÿ#y ‰ôû:,ìû××ÓÚM+vf§!ŠÕ©OPTÙx¡¥m¬F=ƒ œG–Þ)ãûtÔ€²Üngcei6215Ôdsζß¾üpÕÇÈB­0vê»·¯¹»Þ{€Ë¼¥kâsj0&Ípîr&@f²|ˆŸcŸÏïoÔÿ“úé¦~’íqT`äqíý ,tc‹ßK[šùUªTÌŠ÷_ÕºuU£ÆBûî=;h«}*©1Ô×S|@L=«ñ(ÁÕûbD‹õø»v¬{°Á»ÿP—¹K×ÄeW+§+,¯6ÐS¼#]6‡@šN_¿bÏŲ·ÛØÀ°mG &!ˆ¾•îi;#À.>m$á÷¾‚ˆkñ>ã} ™I2zôíonnnnÖín|ú”±;ƒ+&j -»­aã¾+wGe¼M;ûÇîÀÆë½"’„€%{®”.p2j}·§m`iannaaL¾IÍÑKí«ÏÂê< ©XÞl«GüE€t:è¨2ÄBù‹ßd žs>**êIƒŸuç\~£4='nñà>\•Êü!ƒ;†N½-ÍÍÍ-,û§¾|a1yÇ¥31Gƒ$H ÆÍöÅZ«¯LÈ»›’’’’ò*-ý~ô¦“³\Ž¾“€¼ V¤¡§ÃÄa =)Q¨¼¥ÖaDPøx3k³‘Þ~«ÃöÕ³aåNËš¸˜,ª¬ï2±H¦¦Áý“­Æô£‡¬æù±ø:\© ¶Ÿ–úH¸#=­]Œ-ȈÕì`§t·õ9uûÅ‹›Ç<h¯šæû‰ç…䃓…÷®8 ­>½Ks¿Ö–T3 y }uÔ90ìQ=R2ÒwØhb ®®Wë‰JCOC™¿Œ§Ë“–×ÔDZ¤.qXb¹´~÷“„Æ\Š’â9üv&ŒºÙŒ9û"éÖq/+Ðé¾yJçR¹l–D.†Ý Òtþø%[^¼ÎŒØÌývÇÑÿxžùy°)`Êû—µh{Ћ­›H23>©nÜ8ëæú>)ÃFòòòôptf¯Ý¡¿‰ëÓðÕõ„Ò²ïöŸJ«µuÕ ò[á§Z…zÔ±›™Ç”+tŸž¿E ËÒe<3.´?«tåáåéá9ym”ùòò˯ahÛÓ”õµðB‘"h*U_¢àe‚¼ÃäÁÜ7)Ïe$µObÌ`"m[{ÃÂë®JPYYYRɵµérí÷ãMGè†U±ûÖ} ù? nHèéèáååéáî~ä—Ñ—¢¨ÜyºFÚ"á¡çU€P½˜A¢Ògn»×ÏJº]-uQ?±7˜šl¦H"SŒm™¬–‰x[ã6su|껨]+äÉÎc6Jh)óŸ7Àç]¤6´k_\)à÷·Òl]:‘»cªæÚ`m›öñѱ¼Ä±ÿÊûy0ÖÛ59õaü‰SËVTýz]ø9€­ÝÁcòBø¶ €ÙÃPóý®¨×N¨vbº~™gÌa€·¯åÛè Š²zÿÞ#B·üA s¢2/´ÆôäÈ?çå‰d@ÃÉ©ãÓÈ‹T¼ÜÕž6‹/¥ îkø1õ!(M’Ê}ñŸ3oë™F¨:­¾xF“昢·Uß“õëe”Ÿž-@i'„¬§~¿Ÿƽ/ ™Ÿɪ{°«•~C`^à™ÎlËz}ióv†Çbs~+6S„1î;ëPwQܯ·>P±~-­«ß¿º”QLͥ’7Çcy8{@ܶ@ÿé[’ú­oñ·g ßÚZªüxƒÙ9PþŠÝ!à s`μ|`Ð2Û9³ÛÎ ~ïŠ*©H* V­\kî>Ñ *æÏ >šôªzy狦‰¥Ô¤Å“ºÛ–/ ^´(88xÑ¢…aÁ“3žÇÖ5Î…kâ±Ñ_û§Åûœï!íFüЯtõ¦spô¯°¹<:.³ˆ*¡°$kEЄûÏ‹[•^ðDSZrþYM×Á½õ0Ôç>KùD…JºrJÓd< À€Ä@oFE\~†=,¬˜Å-H®&A.ªùVVIK“d»‘KÄÌžÜGúš÷ÑKNÉœvP “I阤—©®#R&*þ@ðzhs©jN趘€ev ÇÚÔå:v»b ì>cJ7ï.1K°áb H˲.wýpçýL»dgðºxèðéÑnë“\ÿ}ÀtÄèu!'‚¯„ u‡•ó†yÑ¿_ϜԗzV30H*•šMˆžïqªcœçOMíæ›qàÛ4× ×ßíÄö[¾÷ô„ù6®gÛI?‰xVg½-tئc¹8Ù{YõÓÏ[²9”õ„”“$<=vÞiU2 - áÇuÃ÷3íZÁ0ÂS*1Iqë;Ïö;êâ<Ô}PìZs.Ÿ$1ÐÔÀ}¾ß±½5¤ÉïŠ'ì8ÿþÈ‚^“²}Ϭåöm—^K[wdç÷À+Qߘ„’~Î:}hºÍ˜wëçÚ²Øl® šâ·±\¬Î”`u}{ÿ=Áž=0Æ£·ßzèèi?€¯ß‘#”Ô1ú:Ì>6©ËyLJ/yÐdb! ¹²J‡Éｉ1Ö°_éná¶lû™‹ëü1ÆCGýT5#8Àý[ÖdH 5mK§QaSàòîqËÇ"°s§‡îÕxpfCc_u„(C BÀëãêÆX±æfùÖ˜h úÆØmaøsc‘fÛV5‚¨Wÿ”~ÆxÅÖUövÁÇÇzõãuñݵ­xqø‰ÁB. 1øZVn«®ôhùÀfpjF¹±Òº’j¹I_çóÓº` Gv,ðžç÷¸ïÖ·¬¯œÎ—ÏG6Æú;—̸ï:ýĬKüç]ŒîÖSŸñòM¾ëÆCmyy¯ß…òŒ«»iò'EËÞšÍí^ 4¥Jw)Ö„FÚˆ  É .*~4;ÓÒ@t ø¯çAÓ`þÊEjZÐîh^RA @ˆF8;ývþQïv\P"õ¥¸šO¹üÊ/Á27gûÍQtà5~DEk(ýVA!ܨ«¨² žh¡Ë=Û8‹:¥q PÕMõÅkÞMk¦b,}¯´R‘TÊ¥” T Õ‚Š ‚T<«rl«4´(ªÔt´4àÍ™Š'·vî² ‡öÐåo.¦TuRaðG¨™éRõ¦€2Ç÷ÍrAÊ;   ©È T³_#¥ËHeI* µt|XPñ‰VÏH—«T¡†‚ –š!ÕÏì,‡ßùP| ²²M'ƒæK#­”+ÕøoÓ4®¢Ê&hx¢….UhµS§PÙõ¥@-ŽÕõmRi¤<¨…Ôt¨Ô¡-Ô¢ù@¨·ã¨ªyÓTŽÛ&™ª5/Žur£¥Éß×nþß#?éÊâåÛ¿ I.ƒ÷ìÛnÖŽû7^R³øçÍEµ¤–ñÀÝûvômϧ‡Ôßöv^QG4QBC¶Æï´ÿûo•TØ:z5kX黾Úï?G»§‚9Œ-nZÓ´ÿÎXù¼„F«+ÿÀ™¥ÕÞ »Š74hÐø æúõë ¹°øÆÃ×&=ŒGÜ/¸þè­INM¬Åµßrž%$}È- yúzšjõ‹p"óeBrzf¹wl¯Wo”¿Iz–’þ^ ath×FaÊ“W½LxöúMV¹wj¯G1`@„ ï΃$ín=Ôßó*É{“˜”’›ÿU­M{-Sy±ÿ61åSE·íÿK-HM¿y/“^eä)Ó3ìÀe([.ˆûwnëtìÎc=Òø—ƒñcÉë>Ÿ8{«é9™òÔ_6üÑø"ú–xÔÁ-èü­'q±'§y;ÝÌ«£Fî›ï³pKdÊ«¤=kf¿C"„ Ÿâ²ýdê«Äí¿MÚõB¨ÊÏÕuß•'¥Ÿ#×Ïwœñ;uèkÚuOß Mk7g}?Áˆ>\\å1yÙÍGÏo_ŠíâžR­pGÃ@˜¦Ä/þC¶žyƒ1)¬ª¨Q$Ãx©¿ýþ;¹tütŠŒ:eÝÜ0ÒÍcó¯{VÏogí•-(~bë>[@J \]]ç¬ ß¾jÚœWÕê×5§gyúx ›O=]:¦å5¯¦§Ž8xp=­—‡=!ŒÔ´ì¹páCÍí i}|Gr vvLÑÙl!_W¤B…Š@À`ò™À>%BäM´‹7ãM´¨¼8Ú<ÄaSž6ŸÏ.M4œºÐ­Kƒ3âõ…^¾»“›*gB<–öñ™zø1\Ùäâí»wÿo£\G,ˆÆ€¶…ŒÞy. Æäµ™^nnôlïÏî?V»>‰oèP`rYLGø;Ì‹.¤´¦5“>OÏm4hí¦%H7:›ïx§øçõ³ø‚ 1.¼of3QŠqâÚ‘vó¯Q·¬éç8ƒÒn¤b¡H*o©JTì4Ôön‘c|`qàÂý1õ7‰Ó“†žÏß9}ì/§ž4\Œ?húõbŒÉ³¼¼§Ü¿ÓÏÙiEôk¥¨Y…µ›ïyÉ ŸZ tNSð ä°ù±½µÏ¾^»‘‰…"‰¼Éƒå÷çÙX*•`Œ±0õT‡©UŠ7Š¼mîf 2¯:suí}ÄxÛÙWIŒåR±P,mè«æÙž>ƒ‹©¦ *!&1þ0¢·m²žÞhÐÚj°½f¹™í¹dÝ®§oŠ,lí;¶Qpz#€Ø„ë ¶”ÅcàÐ~R)eºAl5—Íl°…oÆxs[9Òˆ$ÆLô=G&H‚$0f*yF°˜@$@qa•ÈbÃÀCêRœʇ=UÙ]ªßÆ8[r(Úœ‹ tÂäÀÃ'º6òƒA,5—£âŒa0ª  ))«M[¸y*****êäyÄ}ø¡Èlr'áV:@Ö†/\¾n`²Õxõdi”iûċù±‘W@l.OMÁ¨‡Lzé—½ûDÒÓ ÚT¬Zë±ðÛsx½]wî‰õv®ÓŠeõ7Éj1h¨)8ì™fs9€Ê2bFyÏšvò'·^T0êZüoµ5 /É)®ÔµÔ¾T7ß#²¿¡®5î._ÓÙ†yãZÛ.ݲWòìúñ|¢%ÿ uk¿Ë¼Ck£®X ò„mJºi~yyõêµ;É9¤ èVìýÖ µ\MÅáC¹\M¯©¡©¡¡¡¡¡á³p±›™0úŒѧ²…Åï?±uGµçnº3õà÷q¿çžycmÄWŠ«ÎÕˆéGƒ7ªl7@|-*04è;eþë*‹Ž}B%ÇÀ°ìˆ32¨0Pð®Åf(ïê` òÂ'çìø9òÞDÛ. pg§îo§)R¢Gq}x¾†IDAT5Ø··–«k·W·“%‚8‘š_oõÏ%r6 ň(ª”· ¡.ýtÐö‡‘W¯9õl£¸Ê4˜8ÆüSNvnnNAY’Ôfåä·ÀÐ¦Û ¤|Ï1>>>>>cÇ:Ø8Øw×Ç®n~©ONçßÛ­g¿œÍ@Ê´ ¡ìWÞ'ŸÞ9ÔK‡ Šs7Mò"ëjåê:=`”mä£\\tßÌf¢ãªW»­-GÆ¿~Ÿý>yé—ŽÓ¥cLÄܸ;6c¼rÒ°¥Û.df¤gddddd¤g|“cÙÏ^Vs½œ™ùæd˜¿«ÿF‰1–,ÕÙï7233¯ôõš¾ƒ$±øÕ+óד2óò>Æ]ØÓßÞ§c,)ÍHOÏ~÷`d?ë“IYé饌±tŒ“í¾«ñoy¥¿Íú¤\eÛMÒ‘ÍÛ¯g7·ÝX?J(Œ,_§Ù[-ùã~îǼŒç7­ú['ÔbLbyÎ(—Îö uŠ§Þß<¾áØ=Œ±¬<Óª¿ÃÍôw ¤ç•aLÞÙµ*"¾¬Þvóv¸™}š„^¼ÓøWƒÕ²5D÷X“}C—Ÿþ |ýÀMÇZ·¯ŒÚ"-Ë%¡h릕j†V{wn ˜%`g¦g°j„¹vÁ˳k’êNr½¨ËêÀÜ~=îHتU¡gú Ÿpû´/`Œ1{_ìãkV® -à:åz¸`̱œwÅb]ø¦£eB£>ÃîÄ_nƒÊãÂÖFc&SÇ´óµm«®ÈÿÀßvåZú†q§ö>®W8øºý¢¯ÿn!âié+–¥ïS–:ÿìÕ£‘‚ÇÓ3jGòAD>zx`Ãêe!EFf§ã_ôÔÀ˜Ým{2[߆¯88\™Ÿ“þ@uYI§î‘a¡ ‹D“Ó¶Ìõ,HK|ÚF8Û^*¾]ÕŒ9‡žÝhü«ñï:Ä@~‹ Í° Ññ×çĈ :³–™1`Áx»A Ï 3¢éªiÐâæßBR‡Ù|þŸ½L\Çäª# YGçg»»ÍŸ>Hƒ7´kýW£ÊËýh`ÜÏB´°¡A‹ZÜРAãÝ4hРŠ4hqCƒ ´¸¡Aƒ-nhРA‹4hРŠ4hqCƒ ?Œÿ˜;—þo—ÔXIEND®B`‚suricata-3.2.1/doc/userguide/rules/intro/action.png0000644000000000000000000011761213051004444017233 00000000000000‰PNG  IHDRz”ûusRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 1… Jd IDATxÚì}u@•Íòðì 84Š` JˆÒÝ(HˆŠ‰ŠÝÝØ…‰ŠÝ  ba"bKw÷©ç<ϳßç8ˆ¾ï{ïýÝï2=±9³;;;3»ƒ0ÆÐ-Ð-ð¯F Z Z …Ý´@ ´@ »ihø÷±›…O ´@ ükÙÍ«© ¬—^ú?ÑúLc,¥ùƵ_kÿJ¿Jçªû+²ÞGÜ”N]æwYñ/Òÿš…ÿgÕùXÆšonˆÿ¿_o-šp}ü6@/n‚ˆø·ñ)ÕöÆ…ýß Æÿ¢Âk{üÏRM ¬?+Œä—õö.ëìœïfkz´ú ¼æÚúi;n}RUc Jœƒ‘þØ¢¢(K×½÷ãï©Š;‡Ð÷èÃãO$¼¼t Qr ÿ¼)YÀQrm:j†l?é¡£‚"‹ïX»¯ë:áð…Éú ÉŠžñŸw"cû£§ÖŠ°h¨ã£ ¾"‹YÛ¦šfì­ÓÛ†J~vÐoÁËå·wº·Ë:»Ôÿ£Ö“mS>Ý°æ’[®6=-¬¿òêÛ®¡ï¸°P  GŽ@{®;5׺習›BšZ@0Fˆ às>±\™#b!âtØ}>Ò |¼³sâ†+Šõ{±áÂ3뙞ÆÃmÆÏ6SÆ¡±ÃÌu¦…-ìüÔjúY99M‘$…åäØ@‚æÓ˜ÙvÆSDJJ,TWiߩ玎íºÔÍéQ5ÕŠÃÆ” ²„Ï0Ä#|ÿB@O­¬æ·õ^u‰³½üÌ·VAkßÄÜ®!hcü4|ñì¸@˜œjnÕy×ÍU&m„’t}ÀÈçþ±5ôäÙ›ŒýÐM .m Ùù^™Í®ã_¾·1Ð!)_€…Bb°åØM?st7¹|@M÷6µZzuÌNÿláe9ô÷=úõÙumѼãU.xL9È‘“—¦òŒã/®z@B!«˜²Ù±n”I3Moh©çgþŸyQÿ+ƘÆtý/4Ý(M£‚ic¼ËÛ.:KPûÚà/nT¨¤Û²Iæá‡;BÂÞ?îîÕ³÷Ã…QæÆ®¢ºtߣ[Œ ÆSD™»¥Ñòð'õ„‰¯r%¢v5Ú:ÏcÅâM¢FèE6…?ïmãnïvçêI@¼ù'¹ÔœÍ®n›SÙ˜v˜¦š&‰Q$!“|‘{çÚ˜š{zº›˜:ïŽÎFQo–÷ö9°cIð¬9³\íÌW¸‹+SçX<3/­ÐöY]× K®|Ý6ËPêMÛÙç6OŸ;+ØÄÀjçÃŒ‰SgÏœdi?ìEZúñø´›½¹‡÷;sãËÂh@¡] üŒÍm½ÜÝv…è?б!ŠûE·Ÿœj @Åg¢¯ €¡{q»:‘¤ <ÑL‰~c:üÎf ,°‚¯Ep0†wíu¿Ô[*€ù_a÷àРj „"Üy Ýxàbž@”ƒ À? Þw`»Ø9C°'Œ«Ž¤zsÃzG[ûl=2TKuË$GUǵÏ'›]älâþh¢Ï`eUåïa3ž¾ê¥äÏ›~[ü¼.kÔµ ·Cg¯¡cL;5ºü¤L äA²)@ á­«WäÅ<1 ¿~càGÞ´q?ÇGñ.bè]ÛùÍê@ݱ§ãܶ@®‡™œHYìS[eNB\õƒªÙ8«ub=¨)iaŠtX¾ËÔ>6{˜}é¯(êö-ªvÖrºw2h^‘Fœ‰«Ü÷JO±Óøéñ®·2(¨µIûöö~Äx¿yجuŸíÝÕó°M|îl“ŽL¨J:þU3ò\/Ù[& úç^>5éÉõð}3תN˜8nÄP9†øo«®Fm·ØŽš¡YEöLÉêo܃Qƒg¢ºèNä-’®íE·áNú „0Æ.óöÝrwõð>tè~£éÝ“M?¹s细³ ¶ƒ›«"`J‰ñDnü™¥éû´jêõv_6ì¼å†ó k} êu‰HxóE4ݼ‡c±yz‚h‘>ëõ˜Tïe¿Ænï„%W®lÑ€²•9?îFÞÑú!Õ~n6}š/¿úãDö™—Ï»Ðù-½‚‚p•U¿Ÿ´8ðÖ¤=ˆÒb ƒŽ¬Ÿqqnæò˧Æj"€“ÞL…œ:ÿn¥°—V@ò */|ß„jBáÓµ^‹Æ\{ßàÆbÿýw_šMw8ºj“Ï©ïã{l\¹ªP@rb—Ÿ~×6þy„ÀÕªmTY …®Ül§ÀÀ†ÆFÓ  hªêöíÛu †ÝÞÝÕ˜ù—vjÍênª!,”:Â4[ÀGÁ÷žIDðþ t¨Ž`øqp5˜óŽÂîT˜©,æ 0ÅÃ-àÔˆ,Ÿ¶bFˆ1¦1Púö]öäf ¶÷^Ç@%`¢µ›¦«·E_þʘ<Õ±N@˜±í’ëÛû{B÷Å\tiÙžS~V½ý))‘]Cÿª‚B„Tp ¡ÞQ¹;UW‰êVé®>kT6 ûÎÑW.9ìò­Mg,®K_•ö9žŸYÃm(ÊîM³q*[Ým?Ù[oQVÇ¿z]»dðåøîNÍïÙåÚ‡î[þôIôùÂbšYŠTU5 Ê, E:C†‹G¤–Iwò@: ƒz\‹}iâoñ%.¶ƒ‘uû†úš†¥´öÚníEç¼8S ìÜGŒ ÌTÚyáÑ›{Cw~>¸|ÜJQ»}'Â,{¶@”°òe¼t/îNú5,DÅb ÆÁ§åº*43Õ}yû2‹))‰Fò–n®Šèñú ë0€äB+·É«Gv”’AÖnYnè½rìˆÈ®uÌ=^¿Qaäj-hO÷T<úôÈ"‹?5§Òž‹öî³ó{Rìcݦ>Û/Ë}ùêU ·R3¬yvƒ±²îž]3ŸÞ|ZRN•ˆEiÌ$hídØ0»•:Åå—øo{bÔR¾ïyFNü;bïAmi’•¼¹-ê妈$X%Tu]5°;ë2ÒÚ`Àý:pŠŠ¸ÌþºÝ.nX×g†WŸ>}—¯_çî¤ ðŸ­€1¸ùMZsg7 G[§=ù°N3%|õúuí»€ÙÓÍÕþ5ì† Ç¯ÖУ[ý¿ªÐ*“´«|TÒrúÈkK,`m8…UuuUU„‚Õ´±Z§>ÊVáˆÊùR+B 5Øi¨ÞM]‡ÞŒ‹3ç{>½ÉÀ”²5ëUk:÷ãÞ‘‰§>0õ‘»ý$ ê,=ŠŠÓU”UêF¨ÛiÜ}ô•ED¶¶wU¡t+ûyO[?´ß­’êÖ+í4ìvÜþ:EJzá´ÒZ¿aßjñ 2ÙÆt”¶ßÌñ®ƒ”!¢NÅ‹‹#‘ìÂ0{î0í Ëü-b¯GØ?)¡4ƒá¥ˆ-„®Þß“­ª8'îæ‰5Çô6ts¢)­•€ÁΣ‡=ìqæiå•Åþ3¶%EoÀ =eõ#„’î?ð£ËýCŽ¶ž±/Î+3ð/v4¤M[µ¾Ÿ‚ ìÙ®9³ÙAîï›xä«þêé. ¥n.k¯.wðÒr“4Ñ»^ŠÛ܆íÄ€DBOå$€å_™ÊÝOo:fôŒ¸˜íÒ­j3ÀfݺÉJ>:'ÆÒy™CðoK=†°¨n²9 ÉÚ'¦ ÈuöP•Û“XÈëñ2”r›Õ›]¯ ²ŒrùvêÀ`³$9¶„WH ƒIûh†ï8¼k}fjJû™'Ö/ª¦4”åÅÉäU•0EÿºÝL¹6Ö¯Gè°F7+¿«‚W ¡ãµxÙûU @7^H^¦8 ”¼ _ƒx«›\  ÝQVEí;«óròH„1B¸$;£X@*HJ¬k¥9ÕÊZ­ëªÎ{xhÞ…b,“ÂêVz¶+ʳ~Ù£ÙsÈëó¹4ª³Ø×îi1]:Ùœ©öç®=¿sËÕ/èo»!Àx×Ùͱ+'|æ²þfi)‰qŒ~†— 1ÐÓé­ "™ºÏ${õG÷Þ¼<û]gÖ9é9Š±ÖĤ÷ïß~³àêÂäµS܆™ôŒÞ¼Œ‹Ø¿F³•\íV<áÌê qâÜBžHßÏW5ûGɯÔ}ˆ.zç;ïêÎó‡”ôfúõ( } ²4 ¿¥CásÅ-v Ù€âOlyZŽàc·Yë™/ŽùB‰ÑK|Ù—_Ú#:::2****òþÃH­ô÷G“ÿ¢¨‹õ|Cüaõ£"Äø»óíÁ•ûÜ6„Œ¤7°O×_­ôˆ!·Ý½íúˆï».}˜9ªÁ°Ql­ ¬àþf¡Cà‚ðs—¿|KÄ¿–^Ý]ƒ]T-ÖÐUæ2ÙÌß²çÿ[ünäa½Å '6À®$ÙL¾?h*ו0{ì †Í7 £x«Õ$ȇÉÛ b5ÜxÌ!`Soc!FnÇÆÁ4|ßN@ÀÍKpö™PÆb ïc`”qº¸·™£z]¥t>ìwçK™X‘õúüÁr-­¾¿ìŒR7oÿÞr^6Ã}+¤(JP–6Û×õ™²ÝÑYzõšd0{pî‘Ó)FãuY4cPd-ˆH²ùY„–7^<¼÷ê31&ªÕ÷I—C’"Š¦›¥–ªJ[nU)˜¢ˆE£–“òln5ÿZþQÎŽ;æÎ2l8£a‹êÍèCs—:,»÷ðNtÖí½Òóg…ÐN-ݦààÔ¦ÖÉ‚nÐ Œ€Ú0u¢Qp¨ c@sÎ_D.ˆþ^ú«ÕEY(ܠŨcè¡×ÖñìÌÂÐaǾ9§WÍá0½~ÁõÁ+VJQNqú\£È5ÛÅùhŠ”j2Õ<퀳ãúÁ'+ýªEÒ\ˆ\¯¹ôopÓ®ª¹é9@ò‹æŒÛ ÕíÌ ^Ÿ›ÚÍJO×ïr;CSæÏáo±†7Û{9$EQ"AE •˜n~ƒSíKÁá[˜b=XYø©Ó\F2õX$UÊý×ØMs›) 07~Úá³æ6€Î ¨ˆ„ Ùh @)å°e*,[0u'žW‡ ¦eÂØÐÕÞ>n mYáí1Óû‘׆‹kO¶;²ÌÂȈ¡Ñk×ÅÛ½YP Àï:Cíc˜í´Û ½ˆ3‡ëeUµºsãÈܹc²«ÑUÇxß»×׈yA 섈ŒÁ'c†¿Z±ÜqV¹bëîæ‡îvX£Ì B"08™êÉ·rdHŒ&„»¤HôdÃc©ÝEÉ{§/“D˜$jÂxèúã—œMs(JÜž²Œ×ÆfæÒsÞkþÁ%£$[bŠ Hº±9Úé»mõ~lalÖ¶—Éñ3ßîžâ=ìì«')"kF¦%õ" –ÓÇ3Å›è ð ÏÖ‚s—‘D¡ƒûI´Ów}ë1ŽYUôÅ¡6cÞã ˜¦KÓâMëõÂgéÉiGb•]O7À`ŒT.nö°á7à]tyq i‚IópÄNp¨§`+XÅ=ÞNŠDµxÀw5öÔqÇðÀÃÃpm!ãnæ“úì=™%ÂDfLqU„]wé!<ÈnRòÞå%°€‘s=¢jus|}Yæ–B®)œ­¦»ÖZqaT–J¹Âøþ é.,:=¢ÄŒABóƒŽÿ’ÙÉ“™ô0ò8}ë\ˆû0[¯‡‡L‰:¦C„ ÀÔ4l¥P0[­ÑŒ”ëí§D;VQ]•™€iB$ªèµ“"‚¤zÝŒ9´h¾Çê´R¶zç™»/YµW@íX°Áßzˆ’¦ùá»ÃG®,*'šö»‘¼Eožzð·Ö© aEt='Y®+tç)G•z¿ Æ®.ÒÅ7íˆÔLÊ&òÒ2|phš¦qaôv“ ÍøïAm™;†›-¡á¹™\Rø¡eãÞYS6&F£_²¨Bÿb$Ëìˆä› %úÈ÷ëºh™ëwf¡÷¥XÔ0)Mc‡O°™vù[ÚK»Û4=„0Uûì‡ø•ûý¡£o“~;c¬Ê„ßð*F²…Ì&d¾6Qœtª¦tQõTœ²Š²š¾ÉLžÓ¨ˆ†™Pñ[¦ãŒ´s‚_>60Ýe>ýPÚð+§Íp'³&ð„š–Ü›IÙD^$•½&AåÇ#G.=ÿpíÕÇ¿m~ËÍT’wò±+ j¨yçŠF¨«÷Ѐ¿hY㔧‘5ÎP#ƒ àÖxÄb4XÏ[»unÅ–*ü·ÜJ’ïW8iô[šx˜¸xòÄý;—:í¯ÁÂæ »tÊÒç³mŒNk¦ÄÙMVѲ†F ä¶ù£/Øú˜h*ܾrÁxÄþ¦æçß«Í2õ÷€­'Oó/úY+ôXÒºùdª­á?4Å`0ÙPÿÓ‡ÊØÊ]µÍŽD.Öé¬ð·˜´æ¨møÿ `šf0Ù uÀ4õ>ÌÐh×ÍÁ^;Óµ–Á†ÖÔöFø¶—éÙ:šÚkŒºD>¸óüUb¥^¶çò`ínú· XÔr›_ ´@ ü›øhsŠâ?û…›>¨Zïȵ¬¢dáÅMœê†z‡ø•Y&üfOÿ–Z ZàwÙ ¢2õ죣[úô0O¦Q̱Å:zºúúzæÎ{¯<£‰ÍÒ¿èâ¾6Fz4uq"ò¥H|D\.‘iÜ«Ÿ®î@]=[U·ýÞào¨cˆÂ5_æ;XöÒ÷+¢$RBèüÈÁ1\\o?jÒ¡WTi½]§àÑ̶[BÛ‚ ýÜœ¬ˆ0Q6` ~:üuJ„ß÷í§§o``` ««çæ?;>¥ü<ª:óS%ÙÂZ ~Cºav³MùñùãÇ飼(ÇüøñãÇ©Ï{1€-¯ÐË|LBBBBB‡‰ ww?:¼pgôg„føÙØßø¢|ëubRRÒÓˆÕ1ÇVÚM=@Öøza¹n¯’¿%ÆíQSU©“)ò£¯çùµÿš ªõ SPQéÑ&{mØÃZ$§¬¦ÄnÀªêjõ¿aŽí¾¢gK€£¨ª(Ï”æ %/É+RUUeÔ“XdÞØÂ’g¨_ùðñc⪡*ó'Ž$¡FÅŠ_ÃgOþ&-îµ@ ´°›zkyíÉãOPÏ€¦ëÜZ±jÿÅæÝnF€Ë{×ó>h‰˜—°ÚÄÅÅËTlè©ó¯Ôô›³ÂæÇdÑè¶-HðtQo—ÝõúB”ú^u/!Tút‚§ƒ±‘iвC<)y†Á,u¢ó!Æ%3÷ì^ÕÈ &àI¸¡k€rZÜòÔÆKSc ;·“¿ „nN4#: !Ô2ÚZ …Ýü€1 €‡?xÝu:Àû‡ÏMœ&`)C"Ç®w¯Ë¯>6]?òNœëˆáÚ–n9_žçJÍíj²ûúÎËWlÿ3 ƒ%''í°Ä_ááÔnö¹µÎ¡âÁÐ gŽ|ÿrRŸœ¡þ ¤h×¾=Ââ’ÄŽvOßÈY¥qÙLI·žœß¦ª1¤`Ѩáq*ß¾|ùìáÉ—kG.½šçq8VƒÄ;¢ïsîÒ2ÔZ þŽ!•§½ž?w…0™™–œ’«uÜ *¯ ›÷lÓ€;ôïÄ9›YÖ·*¹³-¡ýØp-0`‘Qù’ýßÃgô‘È8˜Ö¸Í6zȦ+žË|úþ•NÊ1N‡ MµÞv>°/ÜX¾[#ø€A˜Ÿ­°Õó ƒ$M¡ç­÷4òPÕèc*€ïŠt9Ôർ2²ŒašfpÔgl: € 3swù;FÀh;a樑GÀ{@ &£E´iø{ì+wè;mêD‚†’§Û|èýüÍ>e„TÚ©Bqf9 huWAz‘H½«ªl¾…`Çåøž­{nÛ²™Â¨J¾wfÔ*¹(fÕ†eÆþË&ú\ýsNîù©ÙWŠ¨õwíÄ^ ³©‚÷3MO‰uϸ W¾Î‚AkÒkMÐáPì‡2×·zC¾)¬F§ßj³å™3†zç†>Zj˜Ëª¨*2Ä]«V+ï¡…É´@ üS›)–‚Z¯~Úýûk[N ëN½;ò,W<3õ¬¿ypP9Ħ¦x  Ë³oDÆIòS$`&BÄ«ø÷V:™ÓæÍ4T Žëß"šàò „!™Ùënä.N‹<Ò-ðØLýÏ€ô–矺·¡Z ZØM ´@ ü[¡yËTæûKþAÁy’õ ?jïä½×àÙ©éK~’­ü“wÀ\ae¾8=cÉáO¿Ó¾§Ûç‹€ÇçvŒXÓ®ûX†kÛ„€®>ºfü¸qã'Ïw^Ä'à>ë55OêQ‘:.h—Äbï½3{¦úŒ[¶ép-‰þyyôÈ‘×? ÿŽ[ÍË°åç“kš˜>qÄ„\€C!žçe_uŽ²Þ_ï7fù‘~“KéÇ"!i]Ó ÒçkóBv¼nøµà©GàJ ùæ‚)[^ÉÌüóîÒ›ÿqƒª’}üCxh Í_0Òÿ%ì†à•¤|Oç¿ @rN[TžŸ’W ½Ìü¼,;ËÎFò¿ÿ„;ƒa IDATÌhê¾öž¦¾ÞV¿uÅ_UnZja5Tå–+t[<îܹsçÌ™í5D}’£YLZ¹øV‹üwWmM¬_ »Mž6}J€ûû£Ó¼§—“¨þ%;H˜t¢b£ïU%O“¾?SÂääc@0ÇËôR²ÂÔ9 —,œ;H=s¨…{]wÕå‘ÃWX"êâ…s²÷Z¿qÃÆ`´>u—_\B€ؙɹ,€²Â4‹#[ ÁÖYË´F,žäÐîGrÊ¿çN „Ðv7“ŸM+°x%éyÕ ¿Šª¾§da€vú>.Z23 Ê3Ss*þ¸A”ðGr:U٠䈳÷<üW*Ùd\§ô»¹Zöõá7TŘÖÐòTJ¹ñs†_oyé?¥YŸ¾“ÝŒú« (ÿyúüB¡¼Ý?Ǫwî¹?~þ ŽdP”eþFt5ÒnÍý|!쇑o¯´³ÑoåÕ5ý‚F·b6© •Wk§£g Ñ° 2,~pgó¹û¶J—Î^e:ëü&]±òÅÌÊi~PàËä¡ýÛÕNq‚yc×Î ¦ðë¡YyÿåwÕ[ק´Ãèê©È…åäš]ä0@ÉÝG)® rߘ»~BGYV´ÄK›Oä™ï™mÕô4`µ:äâ·èYÔ6R"I±°¢âþ8|ùÉÜ“¥K¾uhK¥Š?ÇÄÐÒî_ŸGÝÿ‚9­ì=Ç ì,}÷Þ.ãç QGpöðζþf}ÛÀ½ƒ[G-;“µƒÌÚbŒ]~3âÒ÷¼ên-Ƹ‹ñöáÑÍGïb9Uk1†ÝT…­zP(W¹}§‰ïœ¡]˜¼Œ÷·ž”  —‘“—µNmg~>»qûUJkÍA#lQMŒÀÍÿú1»µ…^[ .Ÿ½–^ÌÕèª3jÌPeI>Fþû»¾(¶ë3Áß !T‘þöÂÍÇ\¬hîîoÜSUÀ(=!æöã’dën«×]œ2!æú£)òê]|Æ´fc¨JÛrúå<ÿ{OÅškàOZc&[JB¤½¸º'WÃËǦ]ò=üâbÃÀq”½^GŒ•}Ú|ñÇ,¯®.¼]0gÚLj½/ÛzLsìÞÂkà÷Üü¦™§ŽÏØ=~<ª·hg¼»ýºaîgs›€"ù}:0{Û]NŠzFŽ²§î¤ÁAµY3Þß¼ûªè’çOïÜó ßÅÍúv}ìœ}¿o â‹€£(Ü—_Š/ó×­õáÁï<>´»º=BÕ¹‰ ÐÞ·»™uJU·µj~øùÇ<!„ó¤)fÙâµ4ý܆œASv7gR°ï\²Ì;1hŠ¢š `„AM'@±òEr•@íÖË‹*sÞê” òãçï ’4·TÝ[k·ª¥KôŽISC#5îÕš˜én3ÕIpoÛ…TúKÄèCwß R×yÒ¯ äÿø”R$„JýlŸÈ øíú·9GB?ÎÏ {Þs€~ŸöÌÅžV׿rûèëqE =Kmu.}j>l:¡¡¥?°GÔŽ©‹N<óŒê”+žä÷ïßóÍéþ;êI%_ï\œ‰écíö‰«6h>ÿë;¯¥âÆósc6ÜNíß¿WÒ•ãvÇ"„2âNØû­àt×Õé®´~ŒÕÅo\„Ÿ<=‚Ê”{ Ô”[7{žbýk”z¶QÅú˜é(ÿiâ>uÔ¤«yyùè…šºI¾4vËèeg;ô¨£¥q|áˆuÑùá+ËF.>÷¦¿þàVü/Îv>idQÄùs‹fî×ìÑc€ytÙf¾8@äl[{Zi@·ªÌ8ûqÕê½ t:Ÿ9lÛ½ŸÙç#άXvºWOM(Kýú-·º…ÑÔíÏ ?ã ³ czËhÛ©§?`Œ3Ï.µ]r c|g«‹ßº×ÓØ8oy/Ž‘pç̱»¯qÉkmc/>.tÕ]}#­AÀ•èí®cÖ¼ÂWÅÍb:™/þ›ÑÛlª¨~íQs†;n|€1¾:Ï-xÅçÄ„„„„„÷ï^ldý6·cü9|Í`ß5Ív$ùÎ\û‘û$Í(»kÔß1ªû+(ùbfaUIP4s^Dø Яƒ÷øgnýÌ)¯ Æ1ÅÓ*üY:Æ8ùÞaó1së× úö))éÓ—«;ç_zê˧¤¤O_„¿Š‡Anj¾òyQSuêg­o8ðJ>ÆÜCÛ’Ƙïn©Ÿ)g‰;5Í+hGUÊ5Kç¥ËïÌ™s-ÊÅq!‰qÉÛ+£gKGöø¼wüiç$ïT¶¹žíwŒO6 ¾ðIü­º¬ŒGXðÓr m²¸­•¹Ÿ“K1Æ$Ie\Ùj2qÆøuØ÷™’Æ_6ìï’CaœÕ×l‰qÒIû˜Ê¶16ûR*‰¥R\XFcü1b¬Ãðù⌢+û9nÄ/s×Þ[)!GâV#»•"Œßo2ž.FLÙ·úî•õ‘xhɨe‡b0ÆÇüt§H‚ÒdŸ2Ðñ*lï÷—øxm¹&¡™ ºJ "Ê“,¬ù5 Bçz¬>ù—½ÖhË#˜ïli˜T ÀçEï6µc>Þ`ܱLIžüsºƒ&WaŒ îkëXÅ‹êEÇù͸(ÿßÃïûÝ ÅçO9˜x$¹¾nÕhK}÷ÈpC7±­ïê¯Åo òØl§·ªSb=4áS‹;‘ï/äå%"›Üà¡ŠÔ÷[wd`ayV©wóÙãNlŒ8ò,‘€×X`n`ËÎOúÊîå׬q!èh2&ü²/ý6öæ…óáþ¡›–\óÔdCÅÃÏiÔ„NòÙÙÙªý2?ž~PŽjµ•Tغ± ³Eedꦬ‡4âì8ֱɪ˜½»“ŠÀ¬MýVâ¤EÆÏŠ*N»6òâ3èí»*å¾QîHqC4œ=÷yèúHiËûj¨J|Ú_Ï« 6¡ŠSzsêäG4B4“Qu?¦ ˜©·O~ÔØñc<œzª3¥Ã£39 ‘»'NJ(QV’!¯e+Ƴœ¦³¤±C4ä×æUBftž`ÛŠ“^+m»ImŒõÄ>ä¬.–âŒ,U%É(ùš-‡OÍÿSUPY̧àm*¯ŸAg1bÔÚv DMé«â¾0ŒÖõÀt¶jÃÞ•W mUe,°Ž6^1Cß(ÔÅ' `ÔpM¥Ê‚Ÿl B&M;g–dU±[ÿ¦6–×ÐçŒãѽÍéW©ÛÝû_zðp¸ë*€êÇIP Z79€rÂï\Р;ë°ÄÁ—˜-º›ÆúÍn;ýNXxêêÐg²‘‚® (IªÌ2…ÚÏc¿ß{î{àؾ*Û·Ów9½u& ù™vŽ£Kª„ZË#€&ÚÔÚý‰è±1 $vž©ÊJc´ï¦,u|œ’,NMlwŽ ñ¸BÀ,¾–”•!„XÑ”HD3äÙLÆ`[ÏÁv^Ÿ¿ì¤GÄ”+‹w²Û«® ™ s¨ØY.líÇPŸšZí ? ç7Ï5ß?߶Ù.±X"ùW¹l¢(   i!È·²`QIÕdt×½ƒb‰¶Ö›w‚»OmBwKãŸ#‡zxÏ;h\ŸA›]ŽŠaÑ¥°Ý<7ùmžjV÷÷êÔaQj‹^<ó€Ü›;¼®ñj·Ž5ŒŒ¢1‹%ë¸~Àæc›!ûSÜöíëÖoïô*ò ,],‹A’A{«5’$D,š$›C ‹ˆÄØÀ"3dõƈÙçøÜ{gÏëÖ3ðÔN76bª;V/iÙ@Hr“ÆÓÖxêOŠ÷Ù1ŠWoÀ“gÐ.ëÃfkÕ/ž 5¹Zà¯ènê´Þìð~%§®$ä3êiÜ™Þv­ŸŸz$>Iyç\ïÕǤ\§}ËFݾ¼úHc.—ú§Ø;`*t;¨9Á{_Làn^Af¢UÓÖÕÄÚDæ ô½™˜'±M϶‚œTÉØæ˜ëh £î$JbÚ¾»i)³ýHyú°=p°×‘”¬‘ñ£ŒÑ¾á‰o%[Ž]ŽªKûV&'^ šµYÔH’µµJžŸYDÇÞ²“7Oº~mZã”ô2ñ üùáAÇöf¬i5O<Š+Wpë¤.v:|«=² ©‚Ýí:½½W£ÖâÇž ŸÞ>Ï%io;*dãìá /€ ßg3­|$ìéê³xSœ›!L”ð±Ÿ÷Š@§[£«qUò™ÈïÐe€ÕžÓa]ÒÞ½"d벌ô9Ïo|•¬ Õ©ß x`Þ_õÓób²æ¤~ßЈqc$)¹˜+?x&à„¯/É›j©ÈÇb¯¤ ”œýçï]”ýì’rkŠ¬ÎäK4n_Þ¼.à†BoÏàÞùàÔbËqƒ8 èf«{ìI)67ága£%õw‰Ù"ÝÈ^NïœláDÝÉDúû€ùgÕ­]‡ú=ÖV*yò*σ]@¾ÿ’ëà:ò¨—Ϻ¸»kåþ¡èY ïä3]/Úoˆú¹qXo 0ïÐõ¼1î–6OTTÔØ·¬ªtè²3c‡t‘Þĵ4‚8y ÀSl<9pxëPï‰÷ŽvhßZ¡ °ˆOv»;xÐ’³®#\ìlb:iön#/üžœÎÇ¢:TÆ-."Œt»*‰8„±J_sþ¼µ/øëL¤‡™îˆÛ¥w©8ÛÕÚgïÍç}Z³’"¶Ìx |zj š¸™S îM+’Ÿ¸ÏÚÿäî•fQµw¡·gÐð'^#È”WS·@÷Y߆/ê9í( @ÝfhÖ¢ 5»6}x”õs—Óg'öl?jãe{ïÏ.¦}ßÇDVtaeg(÷óºë®ã–vìòwc>®½ lž&«dNàlk¿e!3ô½û©Žô|{÷â¨I¥¯ìºöØ“¸}_[Ï`«.woÞµñT«Æ\Q¹}ø6—«W Ì´»|Œå›¸›ÊARã­!ÀÌÕ¬GŒËx碣VuÿÑ«IaÑýÚC¿M½/;{$é´#¾åÐ qU§`¥J òÒÓÓÓ3³J«2B2ó -†X¥uA”IaunvfzzzN~‘¨&63MÓS¥…yééééé¹ùE1¦+rÒ3‹x Ã-ÊÈÌ«l.È6‘™ž&$iŒ1¿¼(=§PÜaÙsSG®ˆnš¬Ú>Ƶ‘j‘ÊMK­aL‰ÒÒ3D´¤ ÕeEéii™9\!%ŽMÓTFFz¹@Œm:/#µ ¤ZÜåÒ¬´ì2¡3´0?'3---;¯¸†L¸´0/=---#³Œ+”¨l+ ÓÓÓ «Dã¢Ü¬´´´Âr>ÆtavFf^1¿4+»XP]’Ÿ–––“_J‹Ë!ªRÒsiŒåÙ™ùÕ4Æ´°:'+#---+· ÅÅæÔáMPœšQ$î/Á-ÏLOKKO/.çÖË&¸å™i™¹BR”ž–IbLÓÄé@ÛÔrÓ4ñ²ÒÓ2s‹0Æ” 2+#--=£¤RФ‚–¦1Æ•¥éiiéµaŒ+ŠóÓÓÒÒ3³¹…1I^jZ)5„¨ê´ÔT®¨.¢7-¬ÊÎHKKK+(©””#ªNIÏ©ÆtUîû‘ûÞ·(‰%RÞÿTo\™í09œ®o&ûMcLðµZq?¯ñOQñ'+÷M2cÚ·@ þxVV3yt3(¢ÿÒ¯RÏL¸ü£¼…dbø:3…1FˆÞäo†ý"–íùŸmLâÅ¥3c:ÆÕÐfW£kÿ·…mþo$$4¸b©)H¿h?é$G¾¾Þ–…ž¹Ý§­üÿ©–þÀÿÖM)òÿ'/—¾ô«eþë©Ý„}ªCÿ-SXÿT;Ô(c“!-QÊ_ª½¡y¡ÎÌÖ 7ÿF¶+ûÒ¯¦qÿ_¼$4E6©˜¦R:D©O2ì9¸>*pƒáÙ(,¼„¡à&ì›ÿ öVo@AÃ>6ußðAæÍØÒE6èòÛÀø C8¿p†‡¥¡‰e …mMuâR*ÿpAF!{3ÇÉÒ7ðáêL­¾E4B~|K§£”csl~ÿ×Å ˜&¿~Ënhá,zÓ±5ï_-f` Ës²‹ÿÈŸñcg´·ÚþÄ0PÕEi9eÜÇŠ¼¬ÂÊzd¼ÒímSß.׿ãØcKúèZ½©®«Ñçž6[ï!„"gî´ôa5Â*ÏùºqN€þÀÚôGNYþ.­T\^UúE=={%qã,ˆ?1 ¿Itº¨î~Iá½^Våu¹ô…ø·á¡4“.º_ÚâÜuÙƒ*„&yCôô ùhÍçžz#s¥BÝßì7.ª!âb¼ô&Bc e~6'p¸ŽÎÝ!“—îI)Béf{Ý,–tórœé-¹üé¿Î{ÑìêZøãùGºÛ»ø§L¤¬¢Êb¢F †4—bäR¬WYE•Å¨wE1Rî–ö=¡- ¦NØBÈâíõV<Œ'…¾?³tPãk%°¬Œ ‰1  ¸?&‡Æ ÚÜvHÞ'ŠSÙKþÅÞTFŒ1 x}bÓÉ{_ É å2 V°;P·°~‚†Ým(ü¢a“4å‚à[Ô±íáϛꖉ çv¾™X¯g, 5µŽrªm4TÕKžÓ¾5{eà‚Ú ïLŽ²Jû¥¢ŠšBÜŒ»®#§õÆHJúòéÃi„‰©©»ÿýŸU€BEC÷Ë!„Î,· MD}¼1ÒÕÚÌÌÔoæÆB>F€pUÆŠÉ#LLMíÜÆÞûY Aöë`gc³ ¥ø ‹¿›9MF‚ÇfƒÍò…¨nb¿ï?Ħ‰ãk§[š›™Û¸{Ê '½ÛÓgØÆ´W᎖ÆVö#eBUgš±>ÈÀw7Bˆ(M8ÜÔÌl˜ßÌ"„PòþIs®$Þ;8wøü¡/wºX™š™Y/Þ%jR´Gü¸…ý†í„¶M3Û~åÝ$g£ ‡ÒA^|„‡½…±¥ËÉ'É!„¨6½Ü(F Uèî‘6fFvÃ'¼) ÅKoŽr±251›°ìP%F¡øƒîÞ›¯oŸeaaî:fN—ι´& 4òcÔf§€9!šä\6ÙÂÜÌÁ3è}v%BåÆôµ ªÎîãdanfö4!”2ýÌ«'§— ÙXý5j°Ýp„˜Êl¥6L9% ú[ŒÕ.Ž]W‰šâ´4oêÈuæE¬ ²ÿ7»âÈöù]™õ¥­’Çî¾ë×\~h×Qo_ÊTf+µaÈ)ª(+ z½}ß ¤oº&Þììã¶5åÅIKc+Ÿ'Yš«÷éÓC,M]}çþ¨„Їc^ÃÖ¾]èl>/!$Ì{2ÚÕÄÄ,`A(!@ˆü´02Ì®¢””TÔZ©µRH½¼»ï´``rÜšÕ¥çWßL¥›H¨”…Ë"Æî¹ìÐOüaôÊ“ó'2)©+ÈÊ©.j“ÃvŽì‰ñ¡ú©Y‹mæ›KÖîãiRDcìæhò<­W¿°Ò1¼ñ­š DÙoÏ›ØåÑ"'“¯…ŒñÉeã݇NaŒSnM³›yc<ÜÅÊÈuA±€¤ÉÂi¶Ú O'ãêlC»bŠ&ÓN™ZAaŒñŠa:Ûc ‚à•¦˜™g HŒyçÂgUPã³+í§ïþ((H2±r(á ‚ÈŒ\ÑØVŒñªa:ÛæÁ+M352Ëà“¸ú‰µÞàgéU"vÕèŒqÑÛífvKù„¨ž!¼ø½ŽÉp>ÆçØx†ÆAÒÄÜ‘&{¢2d#åËaƒA†›.!EdYê³!–Î¥4&^/21wºö6“ DXøÕa€á‘7åATf>´0·È©Ñoá±!üMã÷×WÚºO!ìkg¿ô^SøçÅ-Ö¾c¼g±‹åÐ\M¸âs˜¹©W W@RÜ@7ãÃw¿cL?>{(ö'·Aö°Åþ¾ËNД¨,9NÏØ)ƒÆ¢ôp³ÁÖ©¥|BD=Ø3ÇØw5Æøý_s[× .!‘1˽-ç]ßÙè²ñ:M’˜æN²0›uþ3Adé+gC½G™.ŽÓÕ.!aOH‘(ïù m“1e½ìoa7âC OHP˜ÿÒV×ðAr¥HD%\ßjé5cL‹JO;^)¤1¦Å}¤iq½ü©¦æ¹ÆxKÀð¿}»°ÎhÌ qýw§ ¾WŠ1Ž^8Â~mƸ4îD›I””‘^ª×N}Ý+£– €ZWnŠ,&“iã£[’ø™`Š[ËdVç%}f)î£Íf³™­Œ¼­tÄÄB"h¿z®9ƒÉb+vcË3ó«À@ˆÁ`"&RlÛkRÀHŒ1Ä` À¨;Ä•4­×š =Da$K~–3˜H…‰7 ø!Ùø”¹8Œ+)¨)sãúa6¤kD€1²ðêØW 7$b¯ ϾˆÁhÕkpÿê’ )@ÁÛ¬¼Y#­˜Lf³qO®‡r ye=ÝÖ l6#fã>9¿ =UX,†¾ç´Ö?¿<çbµ š8AEa@â>"Ä@dEÁG9íÚÛ•0ÝwôJwFô’Ó²ï±,.­Tn£ÊRcK÷š%‡Nt¹“TTTüWJ6ð—¢h2’ó«»tj#A’ï«N%壧™^½œð!‘cëé¬ûåÓ# ó/´öÕbÐTw5eñ¹µz» AIcta€UáW䟯`h>ÂwÂÉG2ïFâtЋØ4uÃ]s[çÀ óÓ«hX~UñåƆæ#|ƒNĦ#‰Y¢’K‹ÍÌÌÌÌÌÌ͇eâŠͨ©†î¿ë×>A×`ðP¯Ñkßg Ô”R…Vë¦! ìîêÔBè6}å@nqY›Ö­kðƒúµb|Ê•¾´ê{>»wO%,ÞÆ«öTdçW še7”ŠF JÈB½µTÄ3KI]£µ2§ ƒKAa¥RÛÖ€@­;tPbâY¸oŸZÚµë¢\‘R ©uc0Yõ.ëró@Ä7«°ÇŸ“²r€ ˜­ Væ§á¶¨ŽM45-œVGpŸnŒ/m|˜³äT1ùX|üT¦Q†¹ýâ“Kk\CFIå7ãÌQgŽl@Dõî­ëˆHþ($€ÈæªJ1Æm:tà`Ô^[lçú”MTÜZ/A„¹sU—Þ„µ AIJ”œæ8FýÏ 6lº»oiŽ¬vª«*ñʸ2JâÓv”ÈdÂþ7O%z4Q({£ÿþBàÜVI®œË«AYPz¨1LcÏ]r«w3P3ì¹=#7“ݦŸäܧc  IDAT bðE"±^'à+°•dbK©}ÿ'"7Šª>½{2kìÀ!OMZ±Ÿ>–#oĬ.Î~u`Ä°™ÏžVi×oÃñÛDUŸÞ½˜9{ìÀ!Ϻª¡îÎùëKç,Oü¥(Çn5qÕÁ‰«ÈŒïŸ·.Ÿ¹N­Í*£&t*Eª¨ŠÑU… DÝb¤¦¨P-àÕCó«p{5ij*òüJ.€2àšY×Y'• khÇ-ãËk(57DäÔòjÏb¢êëMžýÍMö\Ȝó…ºokbÜ*çà‰/xBIÝЇs¡)ýGú Šbé™õaµ‚;g8 5Ž‰ÑS…ÿ:ç¡¿ ÝPö^&Ù·ogÑ€¨¢O ùqý9»jdo?óÁÎÀ@ÉÉŠ ½t­³ëôz±Â®Å‹±Ùµ—=ÐR´ñÙˆL5iY°U˜¸hÉ1r¹4™üí+—¨ŽˆYüéòÜ5—@¹MûQnœ²,B”3{âÒBIFg-9f.—ò™lõåðÉ­‚•ßç/Ý)GÄOíʬï¯>gJ5‚Þ2sú«" ÀêÞWϤŸfIIQS(àðß]ûȨÊxÏPÙŸ#=ü ,‡”Æ¿ú$dæ+×`ñè!ܼµŸ>"ˆ/öïãkûwáüÁ 1râw¡ÛÄ ÷– §àC‚¼ä¯y• ¶du:DÝx„ (r0àJsì“ûw“('æjFG#çÖMÎGš¦@µ½»¬ôÚɶeÙ“ïåMr„HÀ âW~û™ú‹ÉŽ1îè°Úˆñ*,±°á(d*Û9òÑrψGŸÄó)71zJð"‚Õº;ŠÏš{ΫqKN£¦EQœŸò5§BÔˆ¼77?ñÊSXJ#ûÉC«½*çÆ‹d„ñ’L{é?å×c,ã-œ8’/º¼ôK¶aZøýÛwUßzH|­4E_¾>'Ec§é›qü©[UH®0pý,“#Ó½c?Kn2Hº|úöójJŠuf>Œ[ ydšîx÷€ý×ÝßüªJÓ_ ‘õ|>Mc¦vÀŽé)ãí¬Ûuh›“Íõ]v¬c@c´ÛÌ»•9S¯=h›:®Y|aÿ«mbæϯ.©øÆÛ;œ(Ï&;Z…/±ÅÜ,>Ÿ ³ƒ¦ú ›-3Æ£ÌÕ;vã–äišyyv–(š0Ü~ͽt;-9’à Q›ÞŽ(gŠ™í±Î­2KÿÝ¡ìÎÃLa´¹±z‡nÜÒ¼î&žž]ä™],òZìaaÕ±£FA~¥çŒlE-EÑX;;§×£óÎn›öC÷ÃÉÙ€i>O€1q´î„‘F´Z7† ·Ö ]<¬)¿TQgÇÒsSÇleûi>ze/6Áç‹0 @]íO®IXàl¦Þ¹kNj‰ÃÌ£:­å1€¡Á¤³Þ½ð¹¹ÿpÌÄ`+×{íÙÕBÕÞWÃ&3šª‰ò" ùI‹Uû=Fîu~>ÙÀÄFUjôvh²#µÓÏ^’¸Ë»´`펭‚—šœßÄTZ®ôi0t‡ÿóivC;©3ŠyJ;ödÐ"@Xêh‘¸#ƒô̶/_ïþíéíð7OÍžâpB¹‹ ?³£ÑX¿¾êPLñøu;@>ŸOc ƒm[ôÆ#|Î@q{¾¿Žm¸X‰AÖ*&öžÝ`î´@u dñ!ø<&€q[«y'VËmÙ=gÝ´<‚v½týV†Orí€I_ðÿØûÊ€¨º­áµg†.QA°[¥»•PD1±ÅîîÆ% T ìnE lĤ[‰a†É³¾g@R}î}ž÷zïÇúÃpÎŽµ×Þgí½W0"®?vØ×ÑcFH‡³›b7!cÏ}wpT›:“ØÞõÛ ÿQù¢Ü/i¶£Öve!"œ[9~öx»Êèú}6 $H‰C@¶ßìµc |mm4µ5Š Êܧl” ™#¼=n¼þÒQ•ùC¥›WÚ¢CKz^…¾HBIG-§}0x¢‹ÿ!#_‰€Ï—Óóe?cÿFæú ùç疳t3´Z>j@/5.ŸÇ#x'íÿÆcàØuÏlPýïJLù΄R!9EQMDB¤êz½Qµ#`քݬÛjmé;õ“Þ†_üikµÑnˆd=†hÎÊP¬¥üøu³4$ìi¿¤ñ’Õ¨`qã-7IÔ$µ Ö«NÏLAÌÙu/ø?Õ·:ÓŠR£Q‚7J´Ÿ•¬?‰ÌïßM´UoåüraÔÔ+ùtcYt]oþ„ОËYÄõñ¥šXä –zÝ ®RÃQ7Fªñ•@ÕVC5Bõÿ.Õ¯x#iD5@ϱ]Ë’…Ô©ÞpÛ®ÕÂOoÜ•k:ûxcâÁ&y¤äa ž7€4Údƒ*HPÌá6’õIQRÿÊÞ Qz£9Λ& 8•dåRVQaB£vó ’‘ˆºýlþÆ‘?§ iˆ[ בñþ„¼$†ÿ½©©ï½ÑÄ:h*É|½¿\5õ_¹½d­ÇïÆH½dò¤©EÞ`©×àÚõŽšZÕM¬äY‡Pý¿KxóÿoŽðVNKü¾ü 9 PQ¨#ÒC1oÝ’Ñ ò²+.ÒŽ¹L>§ ˨§:výA'U™ßiÂoc(4Cà³ö`¡%ëïžÄfø…ÞÙ°É[æÏ=(ÿNoîfßåÿÌäþg4³›fh†fh† þ²"üȪ9ñEbqÞô“ß×±O㯘226_Dëç¢N/™=uÒ¤ÉKÖîL,ÿ‘Ï€“1vÜÄwKš²Ub§ÝXw§þ½sÍÜI'LÚ’k¶Lš4yÍž“µ=ó«÷,€Ë¦Lž´j× ÚÎ'õ^øèq&Mž—C# L_4}ªß–G¼¼Àu 'Nš².0B\ׯôÉÑ‘c'GD§ÔVd.=)‹ {×N¹ñ¦4áþñ¥;"°4}âŒù’ß'_ÁãáS¨cÂðï˜ñ× \;ùæÛïÿôéjá¼~ʵ˜¢FËí\5ùÞ‡’æLáÿƒìËã3¹P‘•.£Âzûî 0„_>%që|:Tzâ'S‹Ýg†Å{Œ6wÎÌŠœ,¦—Õ¼^œÍ/•y¸oÔ7@³£c2”Éw9µâ¤UÈN‹7õœµ~Š;µo¼Ó‰Ì63gÏìÏŠ±÷\ÈÃÚÖH€·ÄËöTŽÖ´™³ôøQö+*:ZÙ¾nFΛx>Éï±#ßM“M ò‹§ §Û¬™þí9ì†LƒZ¦šªF^ëg8.XTDºü1ÿõ›ÊV*`ã2\·ƒ’„W–WNP””œòŽã²ø¤¬ç£ .ø™ÆVâßu @ Y/­=¶Õ‹)MDŠ±uñíÓ^ùf6DÂÏ7¶Z$"¬×ëÔxön¾½Ú)â·—Ü'…5_ŒþwØ 77ëغ÷ò9ë¦N‹z“¤éº’´#7ʶŸÛncfdÐÏp Ï¬} ý¹R-Nn¿8fû6¹âä÷< ¤ŽUUùþQø¤…÷ùïº[*@l¥Ý¡£v+~Êý#Ùí.ï˜bÔßhèÜým*_¿Ì(«-æçf}|ÂQ½²u’‰¡á¨Õ§tȃÈwÅrª­:tíÈ¢èˆÊà²FyZwÖR)x›j1g×ò1ŒŒL¦.ÝRU˜–#ù!&a)·êm5H‡*ù†4‡ÎÓ –Û€‚ÜôÒ ‘’ C‚ Àdòª$ ^øþ}_9’z[´ä{âÉ°ÐàC'’Kë»E•|yq$4$8øࣸ‚êc ÿñõ3AAAa'/åWë©2Þ?:ràÈË/vÇ©4Ùƒ¯§ ,¨@iØʼ=!ÇyÿC`Ÿ=¼7èлNu|qûBPPð‰K÷$Õì$ÿMTè…‡Tqê®C'eD_‚ƒJ"Ž†–DÜó:G8Yoî 9ÿUz>ËM/« ŽPö8(èà¡01UM“ÂØ¡WàÑÑ=7â›3çþ7±TѲÈϬ³£»|ýåÓ‡€¸i·B¦¶®6÷ØÞ«%<ŠÅYŒžèÕO›Þ¸¸Ÿ#ïÊö›¢Ûr³¯êÊ-Oê9›åv ÌÆb]qÁ¼å Ú)üx•šœÒ¶[gHO!m”¯'Ö¹ËñÙrrò¤:[WÍöqi©u%­Õ‘cµíF®Ÿà„¬O²êm™%ªôbú¸¾ðèÖ©OÙœ®§…o÷µnOï^Ñû×1\aÖÉ+xaêì_*ÓJƒU<ÞÁúeNe EŸÎÚŽZËÐèÐ¥rà ÷±y„Їž}íÑ«—\Yœ›‘c¹‹ïo½æ”ZûnZ1wûÞû¼´Mï~•] ú÷l©}çÌËd Rcnßy¯Hñ""N󚧮keÚ5ßÃùqŽ˜Qऻï§öêÓ›Ýlð Š · =ös&SM³GŠÅjÙßЈ\¿r~Åäår­UdrcNÚXŽÝztT á¾ýA.<¼yêSNIC"áÅ=x,”?;v䚪 3êFDbn¥l«Ž[Iä5LŒ ï8q«@H»~ì›O3?¼J.6íÿyøKV:˦N(äã¥m ï%qQ˜j§c]'æAåp‹>Qi¤°2ÿÝ„Q>F}{[¸ ß~èÂçŒÂ[¦ó›†NYeqV–\!UϺéóãÄ’ÂÈ9añˆ8k„í…˜D|vzÏô5ÅîÎqõ:ô¶¶Á“¨ø‹±©Ã‡"¢¸t¸»ÕôÃQˆˆÔW]»dDDñXë…?¾s`®¾¾®‰­ï{N#i¹ýú™¼Ò‰¬+í¬­ŠyD\0Æâèƒü&Ík=¾ìoâ»?ƒ~udOÄËT̾ÒÓjª‘Wœ™”É¡Sn¿ß8ÂiÓ-DátË>Ç?K­ÑŠò ÅÞœ3hdpTu—/BQ™»‰Õ› ÙwWè  ML3]vµù%æVçò„4"¡KFÎÝw³âý%}׉5Xù¹Ø^M(úa3†øåî*Wß]ô¿ÃÛn{”B¿ÝæÝgéù|iV/Ɔ~•ˆóG[„?ÌGDNazZ^%"%‹Ÿ-0(ø "n˜å¼ä@$]=᤯ÃÔëõìÐJ¿¦f«B¤$ñýi–>áɈ’Ñöz‘)t²óªÐ•+bØÈùhá°\ˆˆˆKü,Eæqã® O£ür«Ë¦Dœ5ÂüÔ“D|rbÎÈYG1õðHˉçèNgîñc%Rÿ•qÿŸçÜv }–íDøIÌ Úý¹_b£Îœ<>3|›ÇÆó‹v*=ülæ¸+Öß¾}#¨®E„g“˧굨݋®Ç]@€ASëžÄL ÜV„b‘aòÙEE\”Sj¥Ùª×ѺsÜÍÚtëUðµÄ¦6O¦ŽÑÊ«›¿«·ÓWW Õˈè6}ŸÛtÑÝ°µÓ]]=¿W×]QÅwlïísöm›­)z+’±QU`4%P©o|Põ2ž/MîóúŸÞ:dÄx?ßÁÝÛªÔ&»šëº>›û?Î^⤙|ôMÛ»5PP „aª. cÐ¥•æíҒܼ2%QþÌÓé eq¥øqz‰WÓäëkª€’·)Ì¡Ömé ŒÎNŠÌ³µ/‹²LɾÙCÞIäYLJ(Ph' Äm4:Ñ­Ê*Éq  /¯ȵo¯)Gª–OsKd9ƒ’b€Œo%rÚmåù™[€›[-e}'³Òõgóa”SwË­þNEW¿]ÌcC‹xÃÛTÝaÛ(B#SÓ ÿøK즖a%!À’“QI B‡à(ç A^Q)J$‘ÈÊÈ@oç ¦*#ç[l92gà¶ä³gØ­ÔOÌq‚nKI>liØÄ;K™XÏt²‘µÑ¦•Vie’ô6Dȇ|±¾oË{û6…¾Le‚¸Ãü=ËëO~2AZ~å8×>í´j$ž”°*ê~t9ô”a  $„)'Ã`¹ùoxpÒjï'á*ý:¦_šm;–·k¤F­.äY߈|ÒE+®½ý@µê¡J¤¢ "KX Âd1”:ôß`[½Smã&'Lés† …ir@Ô©Aí3Dèuñùt=ˆYê²± 8&Ϙ²DDOØíþ£Ðõc†·œrëÙ¨îðx¶u‹Éˆ%@°ÆÄ»QPž0×t÷®kC—·â0Ûé©5j¤‡ Ym» gŠûÞ<ë2{v³%ß•ì¦V¤øúˉtnAÎœ“:ãº:[a ¡6ùöøˆÑ€ÉÕb@›Z‚-ÛË\º~uðì°Èj¸{÷r î¥ôâ±<¢µéflXžð% ä½ds¼t4½ÖGEÞ»ù`ÏòÁXU¼fñb¾íôwŸ¿›÷ªá\ Y…µûNw.{ú¡¸ žì^à4?LZVÌM¬’éÒ’UWß\q`Wäæ ‡È(Z8¸íOo¤ ñ—l£üìø@BÎ,=ñÈc`ÒȈ>æÉ9Ž0£k…ij”]» Jmõ–î ·`áÝ<ᇇ— ÊEÀT2yÕÒ_\¥g¬&ʸÅÞO/>¼|ïªë”iÕP·2ªèQ.ÈìÛ¶C—®= Ò³ÕhÆÑAgØ1ç*lÕ¬NâWy[O=D@”ì~'hjêPVÿfdä½{÷ž> •‡ïi… –»#ˆ+w}¤ѹ}[’”P ðf[ô?ÑøZèo;17ùü§c[:NÞ.Çhˆ=-Õg¬ÝéqzçÕ£o’}Ík‹ª›µäüé†ï ÷|–†?½}¡áÚœ¸÷|¤³—³kD[­V¥…ß¾æ‹#îßQPtò_óô©³­£V‡n]4dSSÒ¾}åDÜ ƒ¬sW“:ÞõíVcÔ DÍUKuËÝä“~Ý&ÚZº„¼©/ߤzTÝèð’þÃì] z¦'|l;2H¯|­s…V†ä£›Ë ý®cb7Eè·¨k•KŠDpZ±%bà@§At»¶þ’˜Äog?ª=­¹Æ< ð D5E—ÆÉ*é)’&-| !Pêí8hý™§Z?Î@¶+¯v9tòÝ®[vz=”_ d&ï¾bºzÚß½|qíL‹iÛû÷Ì¿¼îÐÉöFßS^½ª¬ï$—÷ô¡÷úývήêâü[÷^Ž } ™.ŒªUÓXyÍZ7¬´ñvÓÞ{1Ï,V‡Õc,Ùè±Dˆ|^Ì­WÔÙ,EØä>ÀÕÓ}€}nìý9ÚÑO-ä˜ðñäæÏYÖ+kô*+8¹jUɪMµ‡5aíN[ï)Ó¿ ïÎÌ»qïùžKѵ -†ë2mdù@“Woî˜Ñkòž=N™ŒŸ_Y4Ü\µƒýÇçÙ÷¹~óñ®9ÝüC·œµÚ¾dŒÛ<Ÿ§¶ö‚Œ—¹ÚN!]Aø]!¸²bñÂù÷Ô,ùNýªR–ÜmqâA§zíª·ê’•xy͆‚ ëVËô™ß†í¦=ÝH!ÔOÓ¢ wvyk6ðº¨XTUž’žÙ¤·¸DŸ“™ššš‘ÇKŸÒ‚Sö÷‚ôÔ””””Ìì<ž±²(/%§¨^#¢Òœ/i…ˆ’씤Rž¤a75¢bºÙÒ‚Ü””:'tßhD”|ÍÎHIIÉ/b×r´­S¢I6ÖÏ¿UJ ‹ªr3ÓSRR²r DÕ…yʼn#7Þ@DÄò1ý,>R(pÒÒò©ê±ùÙ©%a4Ågý]Þ×ó1–T±3RSRR3ÊùDD;)5—BDJœ›™–œ’ú+Dg§§f•£DŸ‘œœ’–‘]QÝCYQ~jJJJjZa™TÂ-ª(JMMÉ-•ú_;véþhi—üsKÛ<>?7#59%­´RX-ǦŠò³SRRÒ2sùÕîé•%)Ùß%¢ìô””ÔL …Y©œ*Q þŠÒôÔä”ÔôbŽ4kxµ¨˜B±0;#5%%­¤RŒ(ÊHKÍ-«*ÌK+*«’æþfg§å”Õq_¦(JT••žš’’VÆ“ %HOKÍ/ç#"·¤ 5%9=+O@IÃäe¦&§¤ $˜ŸZ\MðŠÂô´ôŒ¯è¼¬”R®‘B‰ +-%5=‡îmþ§SoòjúýrçÐìeÍ’ÚæῆY#l®¼/ûYDˆ_Ð(qÕµ¥ÙÍ kë#)U?iíû¥{¤""bº­Ž}òïö$qs˜Zþ¨þâŸÿв¿K² :|¿ÄÜÒ6·JüÏõ8ÇÛèDtáš;œÖ~8jh2¦LüCáyaõˆ·‚fÍT3»ù ˜8ÄÜÎÉuèÒCÿZõ¤ë!.ƒ\ûô¶HBDÄ‚ÇAFºÆƒVÜýy|Ÿâ¨PÓþ†~ëNþî‡Hýzý²yâ¨Ç±n&&Îã²xêZs}l­ l}^äñêóeª™ÛüçáOwѬ­@ùWüwk«„h¹õoµöCHóÇ: סLµýb-´ÿþìã?züSs›×–­5{ÒÿÐìÞ ÍÐ ˆ"üwŽ€¥Ù©©)|1õ‡VXž“–[ŽMïÞéiU¢?~윴\Î_Ù%ê8Lgf¤U %"¿¶tóÃê4/ü¢ÔürËËJMMËÉ/Âjý€èkNfjjÚ·RÚèBZS\–šš™óUŒ5Y‰©¢üì”ÔÔ¬ÜJŠ9" +R“Óªmé‚ü¼¬ŒÔÔ´ü¢2h¥÷kvfV1·™küƒš©¦Â¬Ö€°<ÍÌÂjîŠÕ¹lÁ/[øO] éÞs®Œ³œxµÉÈÀ¡³½EÜ·?B2ñ‚g_6hþýߧ$…ÈËxf볇þw³å³ÌòŸHŸ©ßn–_gî¶åïø‰ñÖ_ªÛÿ0lîÕOˆ¸}ª›ó™³ý8X;ø‡Óh.ö°·w1ÖDkÃ=Õn%OwZØ8úÏ]è=ÈÑyf=–ã‹\Û¸ÇÏ͹¿×&>…ˆ((þ4ÊÉÄÒÄæö”ƒ¥£ëðYÓÆÚ[Í yR‡2oXšßÿ Yó:1 R„ òù9™Iì ¡³h‹ª YÌÛ6ngø±óT¿Çš;?%‹Ñ ‘æ³'ðã9HƒÎ×*Iiǃšî¥ŠÂêa4€Á HQtÓÁÏ.Ô½ê×<¬F‡ø@©Z8ÖHO°zu(C?!„ÔŒ¢fÃ$„AWǺô$Mœ.LŒžûo ù1Æt«Ùçiò"a0rs>«)ËR?üø‘¢°ºODJŠ§˜B&“AêÏQíÉø)|ÿ§¢$‹ÝlÝɪ-FÁ_ÏoµP­ìÎGbŽ€€„ýÏ 'ŽêRñdϱ”qÑûd(N–¹Û¤|ñÄ–¯×DUØÄ>Ú(ƒ H¼b4gÍ<§£DP:|Ùƒ‘õUdñ‘GÃ'uù¼=Fíãós2dþ<7'ëج¹6]TçŽ^ºþê½Uk&=ûØ”$µQo¯Îf ?Ÿï7íHÕ,[éˆq¼÷‚aýÚÜ£ê|ÍÁÿV3?€}¶%y–Ä_3¾)tVßå㼞—(Øh<{ðÚqñÉÕnª;‚/”ïÞ0qî2í‚ëÎ~Ûµ•K“x-ïÞ8¡H }{«E•)¯ÜqÂDîíïÅ*zÖ1ëc¾èâÝš Àø€þ[ä,Xïûøîöñò–ƒÏZŒÈ÷u\,§Õ™QôUõø£«½áÅá¹Ë#â­l­>DE³ì–ÜÚáM b¬‰ËáÏã žì´‡½ñÆà=ZfÒ-ñê´à%Ο…Î Io]§O`5"[ æp1EÅÆ¢ûÓX.³úì0Óû~&Ú˜ôz­î´ììD({²Ýsù¥.úÆßR>vqžwhõÈê¥Gù#<ÞUªÙéµxöèÍ Ug–zvA©™ƒ÷x]%±ïçëg¾Œ7)¹ÝÖÂ9æl(±Ùu|5eˆ[*CÛ¶§ÜÓ§ý¶]šêÐ!&lئϲø«ý‡mÜgÔ°Ð IDAT?»ÇX—…îÝ‹A[ïYt꫘‹ß.Œû`ÌóÃàÓÖþ›e-eß8»|¸sœÝbÐù°%”¨`ÛHÙöúm¸ =ìMŽ_Ä^q—W ¼#¹dátH>>o[CC”—ð•úøŽ •k<`òôÞ‚ÇâN»CµùzyÀ¸]mMœ¾NækÜ»~L0vÏØr ­ÍsãÞp» zxx±°050쪨Dfû®Ð…#Ú¸ÚÕÑÈN¡ìË›TIȃ;¦Ê?øäÝj“½Ú’XK‡—7ŽS]FžÜ=żQnßT»Yv?•´àÀ ï~Ñ·eËâ‘m;íýº·/O/VêÙ^I©Ãܸ( - ™2rH!"\:òÆpf ,”×µ×+Þr§„É(«¤£Ä ½!¬ôox>UGƒ¢jpa@ÀÐ;·˜ÌÚ ³°ƒ_øk?&@N]™’PÕaÈ—C~å.Ûlðà]iaj­c¯Š9¯}4š™Èßy™z>Âiðdú÷·Ks <·ÓW¬û}Í}Êùßc¬¬ (DÄéCLÃHmïl÷ôYz%;ëe·Rè‡ã-WÿHÿþîg?ñŒ¶ô±KªDDç¿Ô³ôæ#&… ³™~‘.ylå¸ù‡îcæC}‹¡…Ò[F¥»ƒùóìrDª‚S.Sˆøx‡ëU±R{°KúxBÄЕîCçì Ö¿LQÈyQÏξ> ‹_ÙY™Å}ã•ÞY×Çy)m¬F•%Û'‰QìagÎAD¥º›8¾©¥lÍ?ãßß'6¤^׳Uˆ‚33«£I\DÄŠÇÖz}n¦ ±ðýU+O?DL;2ÆtÌaÚ´‘B×z*1öøH'÷ 4’©¡ã G ûxxx¹¡Ã(bƹÑVSnQˆ˜°Ã ]¢”n¯hº½^7ÐvöuºÊ‘Åãô.BÄW–xN•^¦ÚÎ=ó†þèo¾(,y¹†FÛb¥—Š©ƒMã³éß7†ø®ˆDJ|9âXZ9=>þ$óÞ—2Sï¯q¾ ÏNtœy+‹®’úþI|VËõa]=ÇÌ*DDQF¤Žõh1⇽޶SÏÐÃäÄê9."¢0Ó¶¯=mõ$ˆ °œy³Þõ2öÐ$Ÿ­R‹]w½Ì®±E]iß{ÇG,M9gc?Q\=ÁïB;.=ˆˆCçôvôðœ‘^~›¯Š~\RK†éÝ.kä{`ûäÍ×è;¸â“•±7G„ ;ü¼BèËUÅåð„’æûÑß|™¤T:ºÐ<þÂå4ín®œ=#¦P†Y¥ÍË}P nH0³²¾ :eÆœ>ýƒÝØI×8¢·q;(~÷‰ÓÝìËéÓŸ‘ «8å’ˆ% Ô´î®ÈTRD¡pîZžùzgš!NØrâo)·f=9F(AÒš!™úݪ£ª’ŠêÏð§ÄÝ{Y5®%š–¥Õ££ °Ô Y,ƽ‡} —æ‡nÑÙ„Á¹öE²¼GRy%£W[Df÷Û±k+ Ï\LoÛSçÒ™3DO«"ýq) V`0:+ (i±¦NgD—W‰ÅÔé ™Úf6çÏœ¡eY<²ø˜JPJ±ƒ+í1qÿU‰‰—-µqtä;Z_l¬iÝ£.Ýî¼àØl²¥«Œj¼ãmPˆ?$º(jÞƒF¾eÛYl`Èû¶@€¬œoÂîi/Oç=Â(Å®eI× :ÔbóºEÅå@>ÊV” äPÚ,ºÍ¾kæä9/<½†9›ØÖÜŽk@¤åØ^¥¦„|~À¹+9m Ξ9²,V‹ÂWŸx`Ȫ 2‹÷Dù-˜Z[k÷´-÷äîF.D1‚ÌL&RDJLàGÔ"&ƒP HH,Ðèl§Ó«·\Ùç{Ÿ¢y"/VãŠrº£=󽞉\ϯòDD‚yæ­¹òH¥Î·Bä•Uš+ÿe ˆ¼ =7BTUQ”—W (ÎØ°¢§,ÀpÅB±DVYYQAV Š=mæ¨Ò" 9I(˨ª(*(ˆ@QÁ`ÉRéê`°êeAâ AY¶Nš*‘X$ËR—W`RCçÌoÙ­U“L²–ä€%«Ø”_(”eÉH{–ä$çåqlü»§ W®2Zª›ºÙŠ¦^MJN~óø’³«GÂw>!ü •óŸe‰ ¡c黣é¹™I¯v¼-e‘& B>†o˜¾ïèbgß"õiÀ剟ßÏòA ôg-Ô~¿ßõ˜´´” Á"s×–D}XÿÎsÖì}ÿéóÝ°Õë/%õTnþûÉ3I±Y·•Ü\~çUJò—ëÁKìǬ’üÆ:tÞ´£âüÔscS’“.lŸî8qk=* š7¼èøº;±‰ÉqOv:'ó« 0t±oòžY/â’ßÞ {ÇBY…ÜâÏŸâãæHv¬»ÍúÕ«ß%|IŠµ`¨õÒc‰,¥”¤ôaìçä„÷ógÓ誒þæu™X êU세ÃNžºãd|BRâç÷_Åuïk 9³x|Àý¢Fc¸#€ûÆ€¯á~7ž½Kþ’±vÌÀûÈÈ+‰¹QO>Ýß­1l¾„»{”Ìœ±±±oÞ¼‰-¨Bí‘ûºçìÛvâ·w¯.Üèè7E€©¨¹ÑµíÐ ›_½y'lIdv±ž=t¬X)Ïw_{ö%99æÁÙ;ÂéæA\ú&&æã»÷U,Fúû¯cc ø˜}afT™¹W_º£˜˜·ebèh3aÆŒY³gÏž={öpÝVJý]æw .n^pê-§™×üͧåÖÝ»wT£72dõ‰|veǦ=—¹ ¼y8–‰ a)ëèô¤•¼ƒ—„t~±ï6SuðŠKÞ]’ôÖÑQdÑ| ÍF­>ßýêÎàí¨`?îðZ—¾ˆ Ú}{WŸ‘˜Š}u{²XŽÏn­ 8|C¨à|ÛUO÷Þ{z:pÓŽm7”µz]ý²£T•~ûÊP€ØÅvÁÊa›6­^®¥ïv4`üè]"Ðlß‹hH£ôɪwÕéÒP"JË+Tèuí~Äú {÷DªNßr5w¿,“é~ýÉÍ=[vmºÂéiáñä¬7}š›|¹kÄî»U;›>Œœ)‹ D @(gðàéÅ­ÎWv6t‹½7’„ÕGGGNº$åuô{ËÑCTPíÓ³0TÍž>:¹qSðÝbAwsÏØ«Þ Ôº{šà¡Û¸sAŒ·Éw´Þ´ÉpÐ. ײ= PÐêÛ»ª6ݘj&‹-—9°o[+ÝAAkFëLúHô§YÞ\¼/ìâÁ`ƒž½tTªOI­Ûõꨤ YÝ>½«g çò]ïŸØ¸MÈR²úŠ§Y'r+tñŠ»ê=7íª|}nÕÁãñÞ6væSzÎ:xöÀùèÈð]Á»·‹Y*ýŽ²ë ‘ˆ$"z;Rl§×«š ,徺ݙ ÚN/ïX³åÀ•r±ŽÍøWÝ‘0´ƒƒ&œÜûŽ¡¸t{ºFV†À¤¿Ú‰}ûj.~^› =OG? ^·9è)ßarÐøz´ÔgàÚ³*—ö;ªÞÅìáÃiJˆØB/êÙÝ ­[·_+VmÛû“èNòq‡B¢,«­i¿ø3!)2h“‘òÒ¿ïðþýR…š1û±q­ODA«kwyéö{ú猯â±Í,äŸ0óû_ƒ²‡óßþùhJJ>…@;\~}zÜÔkú/«Tå½;ýŠV¼$_néجù'àåéu§¿6{™ÿo¹hþC,¤wðÇ[i Çz (”éدãéëÄaw—8·ú‰¸PTìâ2”¥ÝGG©äåÇŒeáO¼õ”š% û&]0·™°š]4ÿtÆ( Å“Å’•aýb…#!”D$I)##Ëb6ÍÐÌnš¡šáÿ/`üûM`½Ýø>ÿ`ù¯žþåq!þ%Ø®©ÿmhÍìæ÷€âp³µè’üÿ'Ú !9GŽ¾„ÿkW B²¯«u,ù‹ã:½7¤€òó´kU®„ìãü*ã®]~– €„bgô7s–üžg$!dƒ_ï…aIÍwÉÿvSo©¿© S’—_¡}?²—†ü/Ê7ȃÚàaƒ –¬cš_g+k|$,9yVý²v˵Ûüé«Ú^ãuÞaM¸–F°ÅŸž ãÏI €<ËÓn1}…ØÄQ òÜÉG4-2òò²¬¿:ïÍ-΄G1þOÁMŽ@ÌÝÈ”‚J@…[õ™À„FÖQ#æÓH­‹ø²Ç_§ùtóßÁn!w: Zõ`˜™ãÊׄ×׸9Ø8ÚÛ¸úÎz—W%(Lrô\ ÀquqN,ª"UùÛ籶µ·±´]r…‚¾Q?½ç—¶Yõ}Ä#¢ÒÐUþVÖvvÖÖs¶$’×+;{†\ Y9r¸·­µmðµ¼~p­µ…¹©‘ÉÜ-•@HqbÔ{''K;¯ó/sB¸Cz´‹­"„<Ødí¸ðÝ "rv»A„íþ†K¯»˜ö›°?“Ôo¬n—K€ËÓôtû^έ"ùæÚ·Ÿy_Ý›…€ð¿Ö飳PL’oÛµÿñàuŽ³wÓ‘.ŒÓ70Ÿ!„\^4||ðÝê­—Tf½œáãäàädaåõ…Ž²pt±Ùä­‘ó&ûy¸ØzOßRüùÆôñ#-Lfí¹I e)'{:889YÚ9ý,“‰û;8¯º´u\ÿã !YO;ëÛ; \ºÿát_Ó‘Y$ç–v_ !((éÓ·ÜÃðIc|ÝìÌÇ,9XE!äõ@›þúNÎn›#^0×QP9×Û¥Dáû çëE4/àÌðµ³µ0vö"»œ²Ãßpñžë.¦ýƇ¤Bî†ØÛØ:ÚZùø¯Éd‹âÌcaikka1aÙÞ 1B–súªPîé4à\\ Zemmíhoã8tjl>·NªðÊœzf O3ÜÕÆtâªcBHAܱƒìœ­|®¼ùJÉ _´ú֧ȃ‹Æ¬ %ï"N8Îõ Ô÷¸ù£\,,-, »ù.Püïëü½Œ¬ì›’òr}'« „0¦ô[žÜ|ºùƒ$¿ò÷µq^AGžN 71’/BDÌ~¸ßØ}<"Rì·VÖƒéÂkG»Ì ¡sZS¼ŒýOfÒáC–_£ ]æ;rå1úwÈ8»¡{ã¶éÜK "?5ÊÀÁ—B,~¶ÁÒy]rÍx‡5Ç^bE¢ŽÙ•tÚ_8ÁÁT?©Xˆ(~ûäa^¹ä'ávÞ ÷G<³eè‚ýñˆXøz»ÏÚµ{ãQü!PÔ›½WKDÄœ'›}Ö¬ö MBDá›­ú£ö#ç‘žåT "ŠJÜÍm|¬­Ø "Îð1»ö¡‘B ‘ÿÕYÏähíXž=ؼÏãt"žÝêé8Œ—ÄÅÊÊdÂq:,Ô`]ƒglÄÊT»>¦çR$ˆˆâdgÓ¾¿ 0û¤¾iè£D”psMŒ¬oCD̽µÞܨ߉è|̽×ËÒOŒˆ¶……¥ÏÎWôèf¸è†?+¥òŸé8ÅV!"Æfenú:‡‹UÑFzÃèi}j´µÍÀ, ñéæQãO âþUîvÞ èvŠ^X:O Í^X`6~;"Æ^Z5uÑ~ºÀú!ón§"" _ëz²¹ÉL]†KMÞôœQÇD¥ê«±±ù¨`il€qNzWÞ—cù{K‹;¹ˆˆÈ}ocf˜Ã!bà|ïmçÞ""J Ý K)”Œ´¶ zV€ˆ’´kzCò£÷x¹¥SÈ ½í¬ <÷!âî96ë#Rš ^þø Ù BËŽ•àìÖ‹íÇ/Pã±Ùlvk“Ú™IÑ<à „(@áûä\o736›Ífs=gϼD{4.œã€œGã\Gù°Ùl6»ÜkÙŒ¢ ;…P¥êlßMå44D\àôÎ;úKÖÓ qãñG'X¤<{‚ýÝ4Ùl6›ÍkkÔRã^JÓÈÖ±jÓA‰±µkSW6KãÉq·àåá“gÍ,»zTp÷â{·Áöú6Ÿ>FÀËð;þ³g|¿tDpóì{/_SP±uf¾}PUEÙ•­,&è2^— ¾¥g´0ÖWE @ 0å ¯}»áøl6›ÍV·ìÑóчO”¨—Ñ0 ºŒ[äZ[U•@fì qï>C´8l6›Ímc¢¥}?1á“n£´ ¼(Y¶…š›&@ûAëôÉÔÆÜ0ݘoËN­Ë‹‹Ó?%´ê«k"ˆ ?)H™6mˆPjÊ”jÑ ‡Ž(7K(1²¤é&>¹åŠÎ¬ul6›Íî?ÆOáÕÍD ˜ølÞ³zXÊç±±±ÝµHJÂwn–©¨F8E—ßd–•WÈN»2–Ô»ÿ0ä7M3 ñTÑjÁ.+ÿ|ïËÌÚ±E9›Íf‹:((ßÉ`€„B±HÜôDn‡®-@^ úkéêùéãõ¶ ¸s%Íjé"@”Ù3²k­H¶DÌç|£¡¨¬ùbõ„ßqÑD†z{ÚN,« ¿_Ø0ä2‘F¿ÓPÌ(³IßËL•-S¼èHv„yõδÿ´š €p8¨|l®×‰êrŠJPv"Uí–¦fèW7Ór'ÎêÀ´öèñàVN·v7µÝü,”&ÜÊ`z•m6¾]5ß«ªbS%^ÞCéåÍ`®å<é ¶ÚC(×dŸ%\GR”>ØëÇuJ«€*µ¤1D‚2&C½f -Ž‹v€p*¹Jr-ª)Éb°ñó$JÕÖƒ„D,¥›*M7If3uß$ï iYlM¾q}}Ñ¢“É“§OïÑF•/‚z¶=òíŸÞ Y0{FðW^e…\ÐÕËUë]eëáYZÁ¦¿v÷ô–Ž)£ð½Ž/å—÷×Ú›L}Sª2LÀÞù‚|ŽlŸ–ÒmûuÀÛÕ|…0SŸž´ñ*Q7úù!™æïþf7? óýÀmW¦›Õ~XUTóSK9KÏÆX¶©Å«¨ÚnÑ­Z³¸£¿Ù­)iéè«E=É‱* AJ,BFkµ–ÌöúφԻ Ö¨)¨ÀVQR)å0M{„Péï¥p;%£¦+ dLw…„¢´ÌŒ6†½ÌÝYsî%fñ[÷esLWfBiF^^{½® `n4àôõ«ß¸VQaÜ·%‡/%|=Ì»¦ie%M¢¬ñðîå¿DauÕVŒ6=^ª×&'¾æ§Œ¬š„*ƒj_d^ï—»…Š¢r¥ ¤6€BJôWã¢ËèjQÂIçÂ×>J•ûFM¼?¥`öQFÊ‚l+½Ð³÷(ŠªŠ?`ç15*î¼úO·…6êj2Ý­†4UâñÉ'ÃŽím+Ãäð…HXˆE–Œ¬¶ª(¿±„Üw9„T¯Bë8Ïê0Wª-hþèÿXQq½»ÇÐU~‡—§TðRïZºOæ×)ѸO÷ýá—è.¬ö»åEÝC…‚ƒ‹Ù¹ @úŸèÝcÜÞiÊ#|øJßô}3+€ÀÊ Î›O¿îbc+öþÀ*|;¿Ë¯$DòäÖÕÌ2 ´ìÖCr^ìkN$±šÎW}éÈOôú³e~`Ï!MÇ©dðóðC»DÆkkÃÐÀ£m')f‡öï„ASZB;sóÒO÷OgkPé¨B=?÷ÕF·+€èZؾØJ0D•|€ŒÇ»½ÆÐ4%%91C ð->úÐÅGM±›^®ÎŒW÷#èM©‡Û€¤RÝ&O$QâŽÎPMéÔINaûµx Lºh`âûä݆t|±c „·èF&«öÒf0e¤ÀjÿÑìF,¨¨à ¥V»§‚g,õ´077óZq}ïþ=òH‰¹\.ccõá“öÂæf¦ææV±-GYe…\.‡ŽúŠˆ~kŽíòÕÂÔÄÂÜü\…ãùî$ürnU¨¥œSªý.tr35îohʲ^ºz¼Èu¿vÿpüVOs KKûQ¾Ë¶S¨ \<ýAštÝÖš(ÇXÛ;˜ºtõ:ö÷2àó¸Àk–¡¾³gšY€ª@ÅÞÇJâ¤gtø½X"¨¨¨¬æ<Õs!¨âòbzÖÔûÏ ]æêemjan:íTaDØr²$lßûõ¶6¶Žk£NÙ*¾¿`Æéw d1ÆYÖMÏèsüD3®­…©¥…™ËšøwBUòb"Oß¡™`9‡S,ŒWÁˆ(Pлv'ôù7s K+§Iׇõn)‡ãFzÞœed:R«›žôêEHø­3êOÖ9-ºvéX[û9ÇÍe›[ùNÛy`X‚ôìW ©æïü¿C3U“H»æoýä?2“PØ ñví«S§6R vT½4¸uJR$Ë¥~tOýÿZE)Äüi·êŽˆªÝim\¤¯šUwµðiÛÚø4ö¼ÑZµq’ˆ²RkÞNqí{õ#·!¹k—U¥&§Ö„õu±5J*4L)S'ëKÝyoOªWjlÆ›ž‹ÚC¯ó¼±*®(ªaÿ¼’Ü/9B© òÈãêgÑi†?©¿Ž 8å¶Ï¬K+Ö.nIí>ø~iøöF©Ýã!1ZÚIDAT ÿAhvÑü¯;!Ôõˆ°„ÜR5ížÇ SdüÂãÅ=wìxFQ…Fƒ©£Üÿ#' !…qQ§î¼E+Ïñv:êÍ®ðÍ즚¡šEÅMHvj6Ÿ?l°×Ô)ùÏom¿@è7ÅXµ`-—ª_Òä÷¯O–­5Ñ,í„MwEú×'âGƺmÜ+­±FX¯ÌOF\#^ü«óŽ¿3ð šáÿ–ÝBïu¼$ºž¬aËT“õ§Òš<©"!%ïôl|ÿ¯Rš’ÙÙÐWôïuGáDNë9äHuRYr~ý€å×KJ‘6M1Ùx:í/õFY8ÂtÏæ=짩 ÚŽ@ȇí#{yî&„ò7é´÷5Ÿîð>}ML¥`bd2ræƬr  „d>Ùlåàÿã›!$áøê~£×Óyo+ —Nñ53331µš¼4° ’ªuÄáofjjRúX>á‰}uõk÷8búú ¶˜T¸ÄiOÎŒñp411¶sõ=ù ¾ÆG“ÂKØmjbbbb<ãÜibb ’’„>}û ú‚Õƒ%䋃Nïù{ÖÈ_¹VF} xM’3\ì7EBÉÐ[ï†&æþ+CËø5ùž[ðeõô‘ÆFÆ&–N«ö]¬bS,‡²~¸»‘‰´!›CÃ#?KMKYÉ€HUTò›ùÑßu0ø< 2tEý°¾BA•P$ùI²ú䨃>3ý߉¼ó£zYŒþûíˆU|Qõ??cû´Æ^?~ðu@Ÿ äùõÞûV m”BDôduâE¢`–u¯X>"wT?“‘D"‘H$âÝ]Óô†ÒI*³žnsp™Y[1“xr½Ùø͈ÈÉzaléx7C׺0^ßdl‘´þ"‹·¤ÛDä 3Ó‰ÌQÒ+Æô7Ù÷E@U÷x?p¦¾‘W¦TuÄ_?ØÜÒÊ÷C^EQ¼ÂÄ ^öö£—Õ(¤(Š’P¸yøàÙÞÖ`õáÒü£·XÙIj´mÉ.ýMMœ^UÖ(¼8Ž–Æ_yM’ìÖ\i]“K/ÛߥøK$Âó] Í&ÓÉ:?^Þjdb·ûÆ{Š¢ÄBöÿf&öÙ\ª)ÔæÑž³Ï¼D¤$U™ëÐßhÖåÂFÃSˆÜ¼;€fÝÖÿ•Ï!TäþîîîSWîP× ¹™q&}‰>²ÖÍÕeôŒ eB@DðþÁYƒQcéœvG6Ïäîê¿2¤!ízëŒm5-çžõwšzžêáææá|%@¸ÁcÀÙ<©¹ÄÌ‘OD§ €dÇPÛÙgv.äîæ;yq>}fð8ñ†º :>:WÐðh]ðúìè!nî>“žäòéGEñwGy¹yš›Áavñ.¤€û|ëÌKt IêÃ/ÝŒ»pS#'ðpss›¿ù=ük†ï¿•C‡§x¾ÞÝÝÍ]8fŸ´¶K¢ï;—Lqqu6~Þ›"é9 êé¡Ëp%P5Ééé±½?,ž‹.åä( 0éÔè ƒÁ`¢ë¢¥„[Ï~F¦ -ºek#×n*tÝÁ+ŽÜ¾¼½*N}"«e$ a05Š,ºšmŸT÷8`~½rÒõèrBHÁÛC*Ô£žœï×N 4uŽ]½cXrkÑÁ5Þ*Œ:Š<(ß»åù¬ÀÅ*KnŠkÞðÄV-v\?wÝ¿v % ƒA ™)Ágµo’ó„€é+×GŒÛ{c¡G`ʨ-89ÂÙú;§â'‚bÚm‚ ØÎd…‡Zö³´S”óbæ/÷Û"„UY¯[%aßwsR)à&­˜6ÊÅÅÅoöºL ‚ ìË O®¨Ù´çï¸LfáëÀ*Kÿðð#zù—\]€ªŠò*,QÚ­²3Ï_¸0Tñƒïú„€â‹÷e'Ú(ð¸9$uy$ü¸_ûÏ6ƒ×t÷t«z|ûP¸öPâØEnéGf®|Ì ?yâh0ïöâiÓ|¼ÔNÿ„Põ"S¬výE<ŠÄóy­};QËÙ?Pt ?q2p¡íD'»wÅäD3W=ؽŸ=~mbè,Ì8yïòÝa'ŽÖú•ÙØ#Àã²y I¹³j剴ƒG¯¯;|ÁI¶€06Œp©4›qòäîeæ°ü&¢“§?Œ`.C|’cž}šx|ÙmÿMÚ¿pãùš]JZµUýy¡¶Ýí ^.½."„Àjß¡-‹ ÈúòJ«Ë úšó{ £ ³„´j¯Ï÷Ÿha³N øCÿ¬à5Æ'þÍùÆóÞ)zó ©ƒÞMÙ€eº»–œúñ-ŠxÖ#—ëd^Þņóz"I«¬B%eÙÒ¨é-gYªÖ ‡ˆ 6µUiZb…LYy)ãgî»Í;Ï€Ò{Žž G¬ >uú¤ ‰q¿Q±³YÐ3Y5ÛÓgN(±D¾ƒGOܱڧ£«ãh ¦¬š½½ £Yö[ð[.šj&^ýº â¼åç,v|…¡µ_+¶²µìÖ‘øø¯]'!¢OÑ} ÛT}OŽá1žŒ1—Ôž¹÷ˆÑgôðsgœ 7™®/ªÈN3÷uSût¦ˆ½´44ÀÒ°h10ù_gr&†Q«B /†›O_ðaóñªU>eãZêô‘ùöî O.f–#€Æ‹ˆÛQ¯Œ@$_4Ohyè*ô}‰yÛj©+»Y.‹éÜV IÛ‚)ÙØ·äܧzöÕF€ù[·^½®Þ°_=}`¶z+¯òˆ%'ÛZ[S4§y=©¶Ã‘äFÈ-£U/:j)#i³ ŸÆ´7JËø2 ššš ©ó걋@tzöRý€Èhï0­ç Ç2LèÀ;^ºk›A=9!øúTXâ*ö»§÷e.ªëhÖ(w²Š<°/p¯ÎJíÎ=zõЛ¾jµA9øxí¤ñÄðÅ0ØÓÁûZ2éß?‹b8ÍÛD ¹’Ã{Ô«×^³myY|-Áýs!ýì¶@ûÁ`ïwÞ¸6 š5‰€±&(Àq¦ÿÒdþ ÇaÈà½Ã!i p _DÞÕÚ§|úÊVëІYW:SïGÃÆ^îð7ÞJ`UEU?ïù#:3ðæÚ]Êc‚ìút@Ä¡‹çîÓøœ¿¶£Š0dZ¶T¨¨1˜Ê­55Õ45'Ç=Ë JÚK/€ætšÛé)ÙŽÒÉSé©"[TV×QŠÙ²ý’ÈÈJ„Ï^¼0ìç ‚ÊSI'…yC3cçAãÞ?= ¹7ä ©È€ÕÆþ­ûé÷6~Fèé(&QÖè‡üOU½‘åÜÛ´—ö—ØbøøñAoóQlv.C\é\ g_e|ÈÎ&PJš= BAW‘PPÛw‘û1G¦W/eÚ›³‹Q·–ò)ßx]:´¢?%õ¶q½€u)‘_zxõ†½í·1›`Ý{€çÈ ÛV’Ú »*¡@F¯— ݬÉÀž”„€•ûCsNNÕ3sš¹xýã/lB𞥠ôi-58ó˜5;ñÚV À‰ÙQ&;P§B½C"i¡¡­¥¥¥Ý®}ôÃû½G︲{ŠT_ö³SjëÚn;r%)é}ØÎÕÖ]«&8x–+(<­8ÍRîgBMÏßïîpmï4D`µUÅ’L6þ¿öÎ<žêì}àϹ÷º×.Z(©aJZ¥PDD)ETJÓ^ãÛ¢‰4íûªi™QÚLÛ”ÈT$$‘-‰Já&DÖër—Ïùýñ¹—k­™ïÌïoçýϽ¯ÏröÏsžóœsžÓzhZËãs;QÉê2NE×÷Õ( ý3¡ù?*‘•sÝ ~[ç±9¢«Í³í¡P­>½zõꥩ~3<Áåè“+,0†n*^U}GÓR]Mó LOOOOú*+͵×Ë s6Àã·â¡#zKš:³·žRõ«²*ÞµþÊkÓ‰Žë>U.”u©AdÍ?$na~´òøB±<‡ÕÖx/[ÍL€”ûñ–.€ÉRÁ˜/ùJ0]+Xw‚ ûUF¦öþúú§S`õwŸ~þâÙn/—ü{‡‡-¯ à>Ç0óìe!ª{“«jèH iJ€ Úg[ö\§ä{ô›µìGÞ§<>`±°´´Œ"óäÿ”íFÄo`œncë2xrF·­§®rÄb½É(‘¸y2¦„bü.ü¶Ú¤qò€€¡¨¼Çqëx5½Ür·cAF €ƺ¬Ý²pCÿ§€1FÖ#ºÍ\d«ÒÏH*³?ˆ7ÝÁ='zN\0zG€cêX³Ä©ÓZ`(õ =ãüìÅBÝògIìAîýTjVϘäv9×ÝHÞ~}@ÐìŦ6!‚"ÔÃü;}æf‡`‡‰Ö3 ûsDZ"‹Eb RRrù Á´t‡'û-ÖÓ@‹“ùšë°çמ”XD{³Û|"ÐÃÛù#Åòœy‹GEœ£úôc>±7·Ð2¤ª(隺ê4ž*oòÕQ—Õõ‡»oåN[ÒÍbŸ²\Ë÷& Å`±PDÉ,ŠÛth³ÅøUL³c¨ÄTÑŽ¼¶ÑcõRn’œ”µ¬ç÷rˆ1vóHžëigvQI£/â}ªUswÿùcTv튱:íßæ{‹D² E¢V1úØb9nÅåéöFÊ ¨{u¾çOVǼŠª¼ÆÞÚƒÏÞº=”‰ÁýˆN¨Ç¨¡£Ä,Fÿa.3Fk7¤Ÿº]1<ÝNƒ¶e ˜žC´¶]LŠÝ6P$5/ÌÓ¶ßittBV“¨KF$)hÀ"‘ËXd.®3Õ}šéã,Ý×y~‹–:O*¯£X”°GÿAÞAQ¶ß©vfO¡ÄTò‰ŸìÎÈa€ºªOœîý—¾ÂÀ¸—ËÉ)Qn6Ž®Ãtä_d}X³û‚ ¥k.¨Üèâš}öÚõ¦Â]–“‚† Ò~ŸÿZÇiÁxh¬ÌqpZ—”¬&G4¯ë+º^•ÓÎÞ†1n™@2§ßÊÖ®ôV›oû ý¯ÍÞ‰©§ùÜ2%‚1½D})‘­ß¢‡2ÏÐ~ÿŔԳ]MÁ(‡•’¢eR)‰¬]à-¹Àb0%žUê¢}ÌÎêg/igmŒ‰X6w¨õ Â2Úߨ}þ[ÒÛae5'µ}¡]ùwc;³ôzÛRmÓ0d3+[ªÐªÒ;ÙÛÔòdˤ“´,›Û dáE»:5ÝvÖZ:h®êÊ,C¿uyžÕŒß(³ˆ¸ù¯SÙöQ{Ë«ÍÄ­nuµë¸ù_›Hè ZÅ'»)ÐW$²õ[ìDTy×ÌÈ"ù`€§¿vS×S”Ž7L²ºØ¦ŒòïùM²[*Ælü5ÃižI‡35íŠu4íþ ¯ @]TV¦L„:.ÿNcD‡Û™€Ö×´+ÕÖa¢Ž›vP•¨]¤')PÇ «P;,&Ô®\Q×_‡˜WrF8K‘ÈšD»ùߦ$3ÜkÃu¢fΧû¨2ÿÚbŒ!Qüù›OE ¼ãªÝ?{Z¹ÿ+çZ=ßÔ¦pf‡ýÍÿ~ Y‡†È³m‚ ‰}ÔGñò Ú^#%qó…¶Ò¥FÿÃÀˆ4»¿\†ÚQž]U'Y#CÄ @ø‡¹}ûö¿Üq”Äo=“am6XöZSÞ½ÁŸ'Èìý¡»¦ä;W®†ÝÍÌ)Òa¤€$¶·ÆòWg/Ä&?WÒÙ[…^ˆÊrÏ]IÊÈï5x¤:[b ||)8,íEö÷Fjlˆ^Ûtâ]¿zjìæðÉÙs—â’ž U ÐR–ísÿ¸x?Ël¤Ñ¿Ô= h,¾xîîýÄMJ†z½dbÇåÉN?‘7¬A:UÂ7ão½ÄVRà´¹&ú˜“#û"$ \å°98«ßÀA¨4aÂx×b>@Õ¹ÑVS–‹ºéРþc?6®¤!T}Üqùm-Öw«I9„_Z?}×­œQã,õ”+\­mS+ªÌ¾ïf16úö—•MÒϽta‚«¨÷ï§v-˜þ¹y†*3V¯Þ—ô5ú·ÌÏ× „r­Ç9æ6¨|§§áïõÃÁ[¨eÒiŽ[ôê„GD~5¢H¾ù‘ó—\£So^¤ÅDGÇƧ”5PcªúMäÃôeù™1Ñ1ÉÏòù ÞÃœi¢ôØȼOBAùkGO¾ÔÏÂ"g³K ï1ƧW›{dÒ+îühì€1^:Ãôjr)}1åø,ÇÕ·)Q¥…Ù»íFàøzkß“Éã¯9™Ÿ±¯•¹fes:Ïüät0ôýzY¨çhÇ_DRØ;=lö<9~}N.UôøA|Ne›lVä'&¿®ÉI‹Jûˆ1ÆâúÌ”ø¨¨˜ôì÷caCelÜC1EÑî׏±™ãçq‘Ï?4aŒsÏ.é%)®×—ôG{ÖcÜTSzÿa"E_Ì?7ÌruñÑM (º2í ôè·%‹·pKžÞ ²3žPXO7fÍŽ+ÀM»h;oCÆû’´ÐÃ#¹ I—. >¶ïÑ{œ†Aø yéä£@ TQV¨M|T=Öy„zØ,Sâó ¤øhˆ‘}±ÿ„yõoCƒ£‚ð»ª&ÚäWYZ§®­ f¸:B]Lµ–˜KÝÚ0S—Ž¨¦¦‰ÓW‡eÿá—Òw¾·mïf½âŵ“±Em²Y˜xl˾SÛÏÇä~à4.´³Ù5¶¢¬àØ:y{ÂY,رqKF=Aø¯‡Ï§äˆÂOÏáÆú‹C÷O¦—‡ðøL55€†Oyþ¿£Ë-2VMͬhñ«E í¦½'©­ÖFþ/%Ž«¸oÞñ…b*+@ßÊc|ÂuèÊ "ºË[a7|f ì!2¤ð‹sËL¦ílÂã÷6úcS¥Ïˆ¸VcG}®y2n°M¡Ô_UUÞƒ±“§cŒ©â;G_¶vƒë$sŸó2Œˆ6´Önšá—gk•U'ÄcAÎäÑ…b\ù8dÜœ[¥­µš‘yy®ã :ü7ž#^ܨË2aÇÅ8ÆÛrÚ‰B·Ìqĵ'U˜jwæ ÆóW:;róe›l(ŒÏýè¶2(žôo¢ÝtÜÂm+BVL´vYvýþs Ý~œ–Ó ùOòÆuè%Àa‰7I©fDQ1½×}éE*ææ9zy¨¬y„Â1’ñ!+]ULô>¨1eÝ‘CŽùûÔDŸ ˢ΅&B¨º ~ü´•¯Þ3Tf€ï|¯ùÇÏô“É"’ÆÜnz•bëØÐi¾“XÕMºyÓ&??¿Íû‚Ô™ÕÑÅ`á»ísÈv>Pv#­t”ÃènX6›tÆ©J7ûIê3{;Å2‡™ „ÁLOñu~9éÞß2¬/ê>,W&Ä-©âf9¶Çz7à惡қbªyª‹ÅTG"@|d®õmå¹ñVp´o§žÔj *`¬6”Ešåþêò•< ­çñÊäå´0/+¼ݹâ©ÌåaÓ|—¥œüÍùКÎ}ïθm »ûÀ@‰14$l‰-é!°97Upqŧm;nÝêÃìlØÈbKæêx€Í‚îÆ1@h309ÀÂãUX[óª‡nŽñZ©Ò.vh|é`ãéá{®©v«EÈ+³\ip23Õ¹í†jLIHdʱ{0öû%xjÕˆl®ôSR4Öe&~D È›o[&ƒ¤áýíΑ½¼œYÁa`L+ZLÑMº‡#€ü‹‡E#—*@ϪiôÅ—7ÕMSÀBH€1ÐÆŸú&›ÁìlF©öå-—mQaQw ”$‹îåMÖÞ¾vtÕŠ•«V­Z4Ýuë»z…'CFv–eÇñÝ3br˜lyyyy曼9 &{§š÷fV®‡Õh¥‹ÏÉþ‡ugcZdì)𡔯þ%w|Â7­ÝS.åìÆC¿;Zš6~Ìú3¯âìP,ÌðþÏ,_Ͻ•.Œ?ÐBô`©Ño¦ƒÁÏ®šÏ7FÖÚM»o÷núÓû~ò<S=7¯=¿Û.ZU>­óãèâ?M€}Û×MžÿCnüd¹êì/zÜ‹7e`ñ,Ö\Å3­ 3ÿKßqó ˆk~Ù}”Çdf‹àýïGÂÙöó]Fëݵ·oo³ C»i‹B¾~ËûHùÉsÕ€Åî¡©€ïþ4ûšÞæ‹«†w¦Ïé-?iê|7>’ꇕ9}¸mò¾mÈ’ïX¶97ñçO;è^†Þu˜q—Š>¬™OÁéÂNJù¡®uÒvç­÷<ÿ¹Ï$«‘¤Ø’mUxôP¥Í®yÔ†-ÝúãlOÜú#°ßÜðº«vßÙ©üjóšKr}Ê܈/ÞººµÓ¿cÖrŸ-kö(¯tÌ)Kû׶|àþ€ÝÜÄÇ­ÝÅ×WÓÔ´n§Eê•0íBãÎ1Ô뙃ÏëôºÐЂ} à¸Úß²$‚„Ô\£jž4|Xç=GD°þ±Þ¿z/¹&‘ Ræ3lŽ© _gü´÷!ù¯ÿŽGˆHžyø¦HU[ðÉÙëh¾Ÿˆˆ4}Ì¿l7îrºL÷F{b›°! ˆˆÉ|'®$"Žˆˆ#Ò̲\×B°ak„”ˆ¾{û°×ìëbpxªv[cÝÁJâ*i°¡DÉ‘6aÝÃÆ)“x8Nì¡>U8ÎékqúÕ™ŽÊâb¿ˆ¢F‹pÜw½¶t^GTéÞ5¨ØË?Ô§ÄÛðvH¥Ái]3à—i·uO>Ë»úeο±Ïô­5ÿfߺɓ|o5y;|¹2®öÿÜëQÀ—GžÉRîB²Øø¸P«Ã»ðÚ=¸ýR3©z„Œq[½%TQ50N3Þ ,ý _ì€]]¿šù[I kvá¯8•NDtçä%³Gš`„Þë[o/ªG“†\þBFç™}Ž#µ*Ip‰Zzá*kØ×Èz­y3~ÈßµeþlO¤ìç‹…e³½¢Ù\‘7µ ^j»$0†u3À,±ÿFÕãÓƒà½á>Œ!â(lÄbðlq4Œ1ôbx÷:zÂÖ# ÕÔèZŒ±­Ý¿ ¯·ù×o+P;©óÆÖ1“Ý?].dŒÝXù5ë÷pÖŸ]œ¶3‹Î>ª`ú{©ªœ r1…BK•¥ÊÉk§—dÍoZc+ ô»]nyaL 3ÝÁŠ½±fê±é¢)½/q˜¢Ý¤€LY\|ªÌ¬½¤VyáÔŠb#Ýi`rloïEÓÏ‚±zˆ1P¹¬Q<ËåZp\È -)š;øÆ60¶¾ï›!Z€»Ì„Ç~8ߺÅN1[?{ccr>ûÔ?V©HÅ“8ƶ”6¦ÀhTÛß=Âœüì“&#ÊLuêa¨ˆÓ61ÒÍ»ûUñªBUŸŒa[ø§¦þç¾¾ZöäÀ¹ï“ÜnÿÚS¿ÉJ5‘Z­_DjÎ0vª mÍo—Á}gšW^ ¬¦Ùœe7`NT} 1†7>NülmçE¯w8ø]D£Ê[ã ÿÇsOÏÿ©Œ58 Ç5ΤЂS¨ê °úWÁíÇl71Þ&ƶ.ÛŸÊcE¹Œm¼wîZçÖ»ÍÙ—½Þ çÆš/›ö}¡núˆ”Œ­JQê5ƒI-\xñƼØƤ}}¯zŠÎ²>÷·§?ßÑåŠÿ ›Æcn¼;e|?æ:ù‰šc@Y™‡ÆΊ»E}~<¾µÉõÃŒqë.2vÇ—–Ý{[zñ„®ƒìUQC+kœíË8 B£mbA^FÚ0D~Ž-QUǸ¯‡ÇGG$®†O9:š¡(ç#žà Ì Ý‹Ñɮָx¹ið;zlDêæõj탕[Ùwåkº]Lõ:ðÍuDb ó><”V™9YàVÀ^Zïd>Û¢¯ŸB1W\£¨š{ôõкµ?ñº™¢EQ%‰l¬«ÔW\LtžUÕYJz¹î×™µ1’7æZóª)£Öãz_ÔÐX(7½Û¡ëþ;ß-˜À€Ä“ógŠýþ¬¡„¢´"5>¿²FæˆM;¶1oœ‘ÕC–Lœ³kí¤íƒV5«7U©qEV¦Úšÿ½Ú;H^¤3†?vfºv#`¢ÅÆÙ~ÝügØÂBÍã0·/S2'£¼YìÛ½zý–þn+K›òm;\õ¿Ûrð`«ZúÔ‰½STÜ åMŸè÷ÁŒÜ¹¦mZÜ®¥³¤¦×=¿÷°³Û2k¼B­–kÉÌÊ”ˆt •dÆÅ*µUKÌl­=›‰‘0åÎ8Öã—­LöGìFq§µ*fÐÆ>ÉçW!¾°c{Hã j·FMv¢o¹ÉÞ1ÕÖ¼{òƒ]’/¾ íôépË:”Rå†å(wŽ°ï0¨çt‡€x ÷&¼¤Èá¬[µ:2 “•t­WW«V%Äæ׈Hˆ;¶³zñ®U~=dAèš•]…Àsö]ï×¾™cÆ4sozƧ ÐÞäó7z­Ý6zÔá«øø TܽQ¯Á­ÅÕóG@ɲؤõ“é°²“˜|_(-™m4óéÚG},t6%<Õ)Ó?ÚPáMÓÂ$fÎsïÏŒ~sG¼Ö«cT¬G_¥ìŒäâ·ÍÜm6¯—__a_Ü7ï¸Ñ§'H  ¸2!®¬X‹ªíÈ\äáabñ×Iù2â†{C1÷Óª‘.؃/úU¿†Žfpñ"Z€·®Dk¸Ùàf : §Â¸÷«Î±[÷âç7¡Ü qµÈWª(4òÊSSA 6ˆ:x4ëip_8Èâï.aŠ]uÏDQikÎÿxeñÉϧ¿•o~)qÙXOÕŒ Ôð‡F©ZÚ”TÈšw2¯72±©9´PDï9Ã=çn»R>a´¹bá’,¹Ç¿Úâ9×cúM¨ÙH+z•Æ mÂî¤ùÍ”t=•¾jys½ç"à“‰G„¬º!Æ¿–þI{SöBƒÕü­ófH+ã<-¬Ðj‹ï"Ê0ÃŒ-׿f€å*¹5g‡|á|)ëÛvîÐüôeüÒô·k—¼ÁÅoç|&êü²ìw—ÈBZbWÝ«ù¨qTØuÞLß‚ø"SÁ ¦Þ>Ü—OXØ—¾ÃDÕà m§é¯…üÔ¶ªÁî{º]¿‡ŽÓÚ±ñÔèÐTå£G­Õï„®…9o™ ´wÄîÓÐÈÊóelÜòï·ÐÓ}À‹ü£¿í¨³ ´óõÛ»²ð¸zÂë,x¯èsbùúœK›\_Ö¦ÊóN/{ßdÇ¥¬öãÝEúŒ£Ì/2ìhM{e&­J3§‰_Ø"_øèéÇEÏ+îFå©E¬H÷D>$¾ßºë–‰­»Y~^Ù Åݵ Qb„˜ûæ͈·üWšè³­*5–g5«æÉ—·x ð][rXÞuëf+@±n'”ø^*Ë`jÙ¦ÅéŒR2+hŸk_b‹»±˜—ÃT¯FÔö«±3‡1^õxUÝ›ÿy¹Ë„¸¯@g«*LLjÏÖ­«íÇE0³«EÒ^ˆç2 Âѳê¡Ð¨„Öàº,SÂD"1)¼z¤Íœ«‰­¡Ì—v5–b`ÒÒÑÙa©Šåï N¸Ü»ÓAuÅIÂÓ•5¦âX¿—Ŭ¿ÛR€/œõwùÊ’bø’êÿ+ ùp¡Ó·_$ö[Œ6.ý$utôV“û¦œþR”wéòÇʨA=/g‡öÖCWÒV´x¹I`ŒùøȃEk· íÔܤH½ [$©"~õþçÔ£_Ëó¿û¯öÌrò¾Ü²NC‡ÿþá±l!¸3Æß8Ú` bœbù„ƒßvyc´­Þ9š°sþ=dε.áYÑ#FYmènÞ<ú{€¦[|¼Ù•Œ±ïGíÊ5å㜠1‹ïÝø¥'¡)å‚'¶ÊÉûXÈ3pŒ_üéžî<“:oNŸvv½w½¦l¦Ož×oÇ[«žœšX]K«v¦Ò±åÍîÝ" ¬ä¹iî©«Øôö«|Á•˜eïìÔâJZ¨—i³fϳ¾tsZu7áÖÏÖ{¾èäâ RhYµffÕJ7cb×ïçH–.JŒý¥ù–4^Þ3}ÝT©–/±×g3ž¤fö­yºÝ„éÌãîn»ÓL:ºášª&ÆZÇOLl+x.ãXµú–¶N(â3{=þÝÉõ•mÏ/)nì%(.­âãò2œcã€ò'µù\,uû6òSþCe`a¸g± äå•`bc Žc<xšÇ|¨(€‰«UíÂKõ ÿ^Òù‡ –8­¦×»lÝ ´o|†N¾YÜL Lw.f§?¾ î>Y wY²¸çÊnYå÷^;ïïc$Â[[g­ïÚß÷o1mþ!~{üŽÏ½P—/ІöÎóð{b›v ƒÞTïÕÜݳ¦o'|`%ѱ=û§—ñ¿¿8_à òª5 Fœú³¹¾ŸzÃÑD7¹&¾ï?ãû80—&}ª»!Ÿ\e™ŠNî‚8- lZŠWƒ‡ý‚”‰ ÔœòIÖ ï€QôÚOfŒdZ È*~Ñÿ*¿›ÅðûÎ*ùº}>x¼úK'NBj$â0hîâ©#»O¿ÝU$yû]t^Wg`Œ1p% ص5‘|òs:Xr,ã} L“{7I ¯*¬;Žµ©­êì¡ùqâÞ{R˜ ™‰¥øááÈKÛîM¤ã w<È«ùÏ¡`Úuoüüé-“´=õ§LÒ»ç4Ù“É;ÕgVØÔ§šPð—ÝCj×D6‘Ac6 üYÓ6·xɆ@ämn–@ÅÃû‡K©4OÝÄJé¾q’͹¾ÉÛ¶£u½¶Åfbkk‰µµÄÂ\P’”ØæÃdß{KÔ´jÙ8'‘€Uã]uÐ ?“0î³h@Ìãñ妷[Íî©[Ø"3‘QP¥kß°£ßwB§à߇}9ò’1jò[„÷"2:vøuQ«Ùãϲºb‹1ÀÒóôš¶ï¾uA(À-y½óÎ7Ül«Æ(¶tÞ±Äaç›×ul(2ÿu§ÆÆÂ2ßò}íÀCEí¹™ñxxù ä‰L-ÀÏ OÄóÄ•2®yAöýÚ -È86⧀~¼ºRE v„FK£jÄ{ ý!OÜLâðÕhãj†yÑ PÈN}RPÕcBþ™s%Ï sßâåÙõµÂðï±&<5ö7 .‡T\¥Â[õÁ}_ ¢ vCPZ›€VŽKÑÁqÏÐv<î-‡¾R(²þaŽÃÁÚž[—=È^<}Ôïlm)Äv¯.Ýô·kÜþcמ«L/ß]ȯ®KDf݇^û³][HBœ^mשKø£E:ES/”(uÄ?”¶nüasÛmz¦T¦ÞžR8ЕGDŒA (8à/ú¢Ó…Ÿ…n:¢T.×y…*Ù'Ô?ÝoººzÝ»FþŠ?3ÏÑý—¶ü1U7G¡¢·|+½§[… R•A%ðÐùi=Æ|ù“Ørä‡c“¢¦JZ6ð£°Qj@©'û+5¤›Ûw&Ûì-÷ØÔÞE6mÚD´Eõ)¶ÁbæÝ*\¶xÆ ÆNÆî½³í­ƒŸÙ‚´¥œüèˆ Gë²åMíæoí·IÞ~c^WS"0Pǹc×ÙâØóRé½qÕr^í7>N£á9¬A´íÇNŠ½Ô§•šZo½…füÈÖú¤ÃÍ=mI«§¬y7uÛ´!?|VfŽâg‡ U‰ïÛ×p“çŸßë| —¢òÈÐõGjµro*^`,RÈ55Ûzþ<ËtÁ©çJ­Î¨®ÈŒ¯‡ðØOç^ÚÝE÷\ZY"§†ëÓÄÑ}ïâÖlƒ©å– Ž»_œ6ms«»òš]eR¹\¥Ã\¼ûh¤¿×’WßÜÆ÷úÌR½&»èŠ»€RäœÎHÁIU¨a%Ô}ÒùhÒIÌwì-'Ü(ÂœèÖuï}“¡îNµwÿ´ ýyoæ{êýz=ÄËTøõªå¯u¹;b6õ¯X‰^§Ú_ÑïÆð+ΰÂ1}Õ´ë!ŽˆîïøAØ÷Á ‘øeêÞÝ·k} êü¯~Rõª¡BMªßH槀Á7œÁÞ›ðÓ©)l¨JÓ³ ßW=„g·[÷ùi}þµÉ×U/wjPëSõWk5øQ÷ß¿BØF›j’\\ÃŸÜ ˜°S7tYâ^ˆpãN6MºÈpÇՠϢÝ^eÄ;§h;Î÷©KÒãå&|}ˆˆrËcjeö…Ãûq45Rþ…ÓÃq/*Iô’¶›&NÝU¯Xãî(Ô„¦gðw½Ê¬I$Æ®Ÿ¨mÁ¼ºMÔ¯Tõ²A5•X<GOOj—Ko=–±zß° ]z63²ú½7駃ºè±˜ÞÛš÷n¦‡ 9®ì®™nõ×øxÑ4‰NèýBv0@ØF¦@÷/cì…L×hSM’Ë34ôUPܺSÀø¬žµÈÍÛµ¹-¬!ë±.…†hÿ•eTCÝÙ OCÎ=ZxQ ÓGäjûÉ;’/ßÏÉø¹YK]z,Öv?z@3âXûwËe—–äˆ"úv&VÕK}õöEÓÃØ‹J¾´©ø•¡çxX¿ZUKÏcûY¾°˜{·øïˈ[±*IRψÈq‡üæyÚðÿ‹ˆý¹ïvº¤eaâ(^õW¼¿ ¡ñÿ J —­ ±0©KzÖ†Ù‹‡›þñº%úÔͽ’Ol NcD¢C£ò'„OÍsqæ¿$§};¨°gòŠ}I_‹Å^+úóþæ–ô¢eb¼#ÜF0Â^N»‘©¥ ÝeÄ|KÆ•ªËõ\¸˜'1ã‹u~10ÒVj+UœŒ‰x&¦|‘¾ÑK­-¯à4D|+S^µÃ”%êJ‘ÀÊŒñª.©¥êr±À„ǯ6s¥š2KOOðk9¹L«±Ö1¡Ë5RŽ™›ñX‰ºÜJhõâX6Rk46B󸥑²T#78jƒf2VåMÁŒœg„ ¼Ü‡ðù]¼ƒ½Û·µ°±¿ÔÆ;ØÛ;Ø{™ˆtñ·ñíÝ+¬W¯°^­/Z›Ÿ7}7'›1FDŒ2ú_˜·´¿ìé|ÞÚì¼dà“Ò o¹“ýa›à¶66K‹«"2ˆ!*u™m€mï¨ïj?òÑ ×ó¶¶_Ö,W6Ë&À¦¤nØÊãgë]®Žª‡ùW·íg$<€&É6ÀåÙ_Ò®¿µ»0å…ŠŸ¬ü°M€M°^½Âzy^´7÷—LŽ»ÔØ™…1¶ÿ¦Õ=2Ê#µ›ôÈwh¦N˜á/`=ÓN»V‡”œ‘4¨º½ü’N¡î›§r.|6ö²‡Ò~»º×Jã(W¥:¶žjñÀ¿E7]³ZþžßRÑûŒ‰¾]j_ê%ì{²Y5ìr~ïnÛ—g-Üíîõ×u"Ú1@êøÚgµ®üu•=µ‹gP+©ïûïôxT²€¤¬OÚ>Ü i?NÐ@…!"Æ4òʆ0CÁFí¦Þæ\ý“#€ˆk°ªk„l-§ñ*´ÚÊç•yùõþœ_}"2µÊé;ëüíyªmVÏ͉Ùʺn÷šÿ®0mvŽ¬ö£–²ôd¯ßÝ›VðBǦº˜¯ gcboë?ûñNOÓëKÊ Lý¸ý3ÑÅN=‚íÍ/¶NÒjk‚Õò@vÆ.Ÿé¼6Xð}o¹»áw®:c—­Ð|‰XzöB‹³¬óµN~Ì&t‚±ß ŒæaaÄÄíR¹QÖÁ(nþ˜ ku“#Ñ“´¬Ÿ‹P”}.o¹×ŠF€­Ë ^j‚\ÛØÝmq¿ôi½È XÚmé…Ç3Pù¯±·ûl£KÉè{?¾Ôzåó„B½~=aâÇRÏœÁû̶Þ"tþQ5>æþ¨ÂÀfmol¯>îÄdÂÇÅ3R3AÄ€åy‰ÚÎjðE_º)þË/ã¾üøÑÜÑþÚ÷7ZM–çí#ÇÆ( þ Ðþö^RØünÇEÁ/.¬²61Zè`7¯&BôðaL÷çË~¬ètb¤C©–“Åu… s!ƒŠÓ6ÒXѯOc—{} ³ë窊Ї\­ÀÑë{œML[v\þj˜²§yë†&>yÚžÊ)õ´²õÉññÉñ)²œˆÂϪõ6ø°Ûº[ 3Á4aOäž“m›5H` ”ðÄbžØNܬˆ~Ë< @*‚Àrœ©&Ú». 4¨©žªh#m7/ rΦ®PÚæ¬õ˜¶û» A„6ŠÄ‡T+hªkŸJD5‡'Vý@FÚ‚4-f_½EÄŽ4£ÃžvV[]Ô'¤÷ìÁaãfù奥ʾwÎ@¯R8JÄ€\Ê!»ÈÏOªsUçÍó˜¢ï½ÐÆnW¹-J Ä.èÐá'RÂìó¶ë,1´ß6ÁŸ?Ýþý6e f U‘¾Ö‰TUnä6#ÅÍ¿ÊÔ€«Èáß9„º®˜ªpæQë6ßØ>ê¹1ï» Î®5öÑmQïó\öt`çÃ¥¶¿nnѤ)ZŠ„$/éûp¯{×*£ò$?hš¼k±©ž•¨_ËŸ†F[½–•õòxJr¦$ñ}R“ÏÚ 03é5€ÏO¼Z¨..,÷ÿ!;ö]Ï‘)inË óÕj#çÁ¨ÝüUÕOZÂ3áóª}çAðõˆ´Ÿ½N”½ñ–¥í6ÇÔ-V¿swŽW\œ€ç0¯Í>Í YDЬŽç¬%‹†5š |8±È–‡?n}(pû¥—PO|ñ¬.zµìuûûOGðÅÕ¡Ydm>ñds«ùyŠz€Ç„œ:ÁóJUB2â”G†“ˆ'1À_ç©N§Gĵ÷wÚæ4ü ¯?£Í¶ô¿â\À‰§´Ú§í;@¾H'œÌ$={íû®| ¿¼sp+D¬£Ãì„©•mD0 Ÿ¬X{w¸Û¥(+Ó~ãË™ Ï‹½¦ s î{®¥§‘ùŒðOƒW b¨9OèÛ\ê<Ð;qèr:48CÔfÐ3šU'Ó^󻦖©ÁÄ°?Km ‚¯T•5¨B¨Ê_õN­Šv*ž¢±á±:Q£yCgØ®çwÀÀ Œ`ãaªIÕ ô³þƒú!ÔÌÀ‘«ö­~YC‘Ó bµ ”iPØpwz¥”Õ‹ª¥œOîMwºØqN¯t¯Þ7)ÖTd¶ à¿Yn#µ›*Pùµ‚ÛfÏ^–F}ÄF0Š#ÁÿS†nJ®µw ‘„¯ÔÔ-Ñ/qƒtà ›yoè6ë¦únPFÿVi wôÊb»}jHÛD³†øßW NeC1Pó•Æ@/b#üß7ŒE°?Xç{ûj"+e'Y¼šQá‡ìd_ƒÇ ÆزlÈ㛆_–ÿÎþ°Pü…s c…–'ØÑR5ci&Ç;ÅØiÆN3v‚Ù\ê_š_k·¦üÝ1³$>Œ`ì¬ù‚ØýÅT_#"¦ydïÇN—ÓÕ”ÑìÂýÔp×c†³+sc`ñt{»@!óaì³ z¶$WßTtý¡;΂ÊeìUcÌ'¦—MävÆt&ä[ìw–ÌØøsìürÖH•€øqì8sŽ:ÁN±Û ùâœG¨(»#—6:ŽâUìt®~’cÖ9­šÂdÙ¶*ƒL `šSz–… IDAT¼äc¡O¬YèázÞ ÑÏýeÆ•ýÿ@Ü3±0)ó£_˹ê-…™‰À˜ý~zãˆìÇÀT ¶à éóy4G&iR-ªÁÖZÀ·àcÿkD3‰f½I4O½Øö1—ßßßyw¾:v*Ñ›D£rs?w } –Áë×úÍëñ`¦9ð-lêæÇð- 4WrlàÝ¿ŒTÓt¢Yàéòú¥¶÷¹ª=•8ÙäôÂoZØ¿“Ò˜ŸTž’§–7½MOï>¾dõ‡ùÅŒ1ÀÑTìd8šÂÅļ!-ˆP¼j2åõ›ÊAÀ K_ÕW  étt%jP Ç¿í+}Ö¨zÅ3È’5˜A+!$<,Ñœb‘aÅS± ïXQí äÛ˜ë…È ú0bV!½°q»ê©™Õ˨֯ß.5¦ÅÍ‹¡Bëö{Ïå‹#Ç î T´œùŽÐ]¡P%M qf>¬YØìô:×i3hó[žaSÓckô#Tœd§š)#®Œae×Y²3lÈ£}hâ’V“ &´ì$) )*CdÖò;"¯§#ζâ;Š^á2PV×{JÖœ-´Å½[ÓãÍ©¸f&î9X\ÅLý[P½YÞƒG0©ì—2Öëó>æÄÍKá Ÿ|Î<š¸#7®émš þqðéŸ";©‰GÓVÀÆÄÚEˆ|é æ+QÕÍŒù»ì|ž¤cãYP¿Ë̇¹†NKÓjcÒ§ƒXÈ[ïv`Áo¿À¦g>«º¥Œ)M}Ù™Ò"Æ4¿Ç½!ôeì¬É’´b1ų©,è«_¢û±ÀñŒa±?óŒ§æg‡—ÌÆ Çž½ˆa‰qDDTjæ‹DqE«qn‘6Ëñ$>Ë—QLÒpœWI´*B<áI$q²içÑ7þ^tíågà㥠"m¹à,׿刈´£ý±8+¯nïEn>8^ª"Êp8Ž]zoÔ‚ð«$"ÚŒw®6히> m>"é¢îÿ°´i6—§è—ŒÐ÷ˆ¨¢â|à¹2M¥ÐrZ½k8"õŠ‹’ù”ˆú_nxúØ`®ýƒQí–gÜ{Q~Ž´6g T×+Y©Hú:ù'mý;d}°IF¤-åÅ=E%-½éáõ•®Ò›Ðüa¸4wB¾#"ÒÞ´ p² BD¤-û"V©Š{vdOÎ}""m¢Ã ,yöœˆ8ù9ÑÜ“kc’f!d®Ç '×sD#/›mÈ}LD¤ŽÂ ª "R”nÇ)˧Z¢’¯p £büˆ¨TvgùÉj5 ÂÖœ4’ý ßv¢ý¡ðŽ»¯kyT[•HŠK8…–áßišû TVIš›&DZ«XFDE%ûq–W¤ÑÑÔ«ÁÑ¿‘ZŽÓ0¿ñGk'Ô7pÂ2‘ˆ¸Ò>˜’®ãÒÔÖ¾X•“×Ø5s/`^v>Wdé‡ðÊrR_œÀ±29¥æm‚¿ŠH•?>⟠²ˆè\ÂLç°yUÜ'ýgzH‰ÖGvp _ADDeãýÑ7%•ˆ¨h>Îð7?ÕaÂ…¥}ýgqñߺãÿ,¼Šß øqà™°'Ãó ª%Áùfî;¬@ÔÑëJéÄ“:g\÷õM뮧#½{ ñ»¢O÷XÄ@¯³ƒiNé“Fu ;o ì½ÿëý»»ÏOÝõüTšd9ܬ[7í@ âéT«v/´ðšš‘OÎ~wÓóœ„Ndr¾Ù¡¢lÆ@Ä”Š˜]r“Ón®~ó¸!îwý}V«I™9aBäÄ]…Y¾ÉMŒœ0æÖ¢ÒF±bàÙ,6Ç®‚¢št»‰Økuë÷yzjzu®/tç:(¾˜—¾¶ýz&ßöÝœ›±ÈÂy—¨hËS¹OµlöéHET2 W?Q£¥PØÎyþÇ®Ý ˆÍù£Àvà^gGL2e’™åïÅO„ TĤj`tûÇŠAóu½ê!~oõ,zÇyŠœBÑsAÙs•¨ù/§‘¥ÙØœv§´Ìàh3ó}u?.Romî`8`×ÕZŒl•,4a§ÆmÙrs¶Öï÷&îh… x~¯¸tI«·A$ ø­¯žvSC™ün&Oð»»7ˆÏEn}/älìÀËž\f[^_t]U0|m½WÅêlßU.´|K¡îÒ^É•äQþ í7ãf4å°ç t<Ác<€k¬˜–ðvÇ#oKT7 ´óçýc·:·'"Æ­Lp£4p¯á­ª”Éu»Uhà$´AÕ=MÌ=I„Íwõ¹µ«¦X™Ÿ”¿§_°{Ñé*«ûO?àñËî¾ @Å;OW|;Ó´ª[ßõëŽ;žïã‰iËW»´Wë¬A¿§9ŽKsÐÌ©Î:Ð[IMBv®nžN›ˆÛpHW£­‡IQl¥öþ³ëƒšmíÎÛÿM¾vz“™ë=×ÌÕs”‡3ßêGZ´—=û¾íñK‚Õíý˜Fhám12jøY½Û0ˆQz¿@ï‡Âþ+݇™òÔªú‰Ú¸U!+è$F´¼¾ÑŠ),~ð;ÍÌL7ßt±ë{À3sª¹ °8E©:ÿæûCUM LeeŸZhà$ªrÐnaÓ…†É¡Ô¦ƒÙ‹XUP¾§Ä!C–׈F&.½=ŽžgmÞbš×Ñ_½†<”W–,gYËk ù—Éç1@ÒÙTç5n:ù#ó)äÈNºh·•«ï7o $ .³5ír|  ngYoÿ‘‡©W7Dx½}È{¾îû*ÖÔ#›ßAÅ•`„š;kM§Í§<Þ!-?˜šaÙ¸Äù‹2Ÿgs¯¦DÄRû-±óîÔì–<Újú¦Ø'Urˆ1ÕûQo,éå×IPGÃáª{³yɸ‹µ‚ ¸UñÜÉ´#€”âÐ\³ƒD`L`+réë¶ãf?ÜɃCß·Þþ°ïå1B]¼¥PS‘¶?ý·™çW³“iË¢âR‰§·e‡J­…€÷Ê1úö6|iÀ„ ö9ƒVZ;\%$$®éaïÄ{g]ÊO-˃¾ê O};µÀr¤zdp½Çz|«ôø¶@ž|&i¦õÅ…ªñ‡Qí3}3c÷É0í¨+€gÛc·U‹ª¢ À ¸lZ‰ \ÜÉãÙ­íycmOUº,vnD¯·“<Ž¸³‡Ü…&V®«¥}¿®§[›ó Óê1 d&žò)G¤Kò\-sà7z}XÔæÀ ÔT'6t€c‘—PèìùË3(¬™ ü9Á¼ÝaÉèøOäfÍTüémDbÀÑœÃÁ)ôº¸!G=D_ÉT\+šùnO†~þQpßʺ¢¥Õ@”§ý\¦ƒZºýi™€4ÍÍûµu\} 9s ]ªK×ð¯ÀŸ1;§½³-¥ã¢èT˜Aî»Û¨cÛD.M×% ÔfxÓóLèUw!Û YÊ<0¡›Ãaé“9ÉAºý'%ÿÇu·?óX "í­!¡cÒ¹ªÞ¤e~þϕ݇gø¤H<t3ÑiÂD牜ÆüÚaöõ¤}¥ $¦RS*×K$¦ÕúäœSÈ+ ÷+Œ©aæËeèi×¼¾ Ò…Ýû Äj6ÀÖä·ô³``ÀÁèϬœ¶ vxëômá¼Cð¶”Y´uO¹d±™@aù£Û²gz8цž¬¨jèˆa‘•Ê1¯/K½ÀÁÄkV³±¤LÑE})˜ºK}«÷ªÝ·W¢ZPj¢·?/mz°ÌƪÃ)^ éqE @äaÑm€E‹µAýD3ÙãµÒÌŸ®WÝ[2úæ¨Lhåe³9Q —úAFUlýÓâËç‹3«¸JX™ö—¨¿”V‚AþgîµqNs ngŒ‹<43oo3ª€=Ó*æ{ÏÌKÚ­ûÁe ½1±¨^ ¡§ã‚Ùù}¶Ìî½_ÎÃì-ö$T]_|+mÁkq¡ ’±Q†4WÿÂÜ­£OÖ<‘•zÕ Ç?!ì°%û~UË\ùªÛ£D>€p¼€V+ÓBˆèóxÞú³®íWÕÇ 2Ò›¾Ò´¼2'«ÑÑÉ;]ü^Bê¾»¯ÖÔ3g惯™²þD”v;/ʈÓJq ·å•Äq$¿98ÈFàbë/j¾°¼ª×"ûÓè}€ˆˆ¤=OçGë:ÜÍ×6ëš‹ÍÙàrv®¼3qo§’H]Ôã²ÎY;^0C@û#¥ "ò…“pŽØHÚ¤—LqÞÍíb³uyÏÆ_1Źæ÷Ÿ­Â¹1ßÜëév©NcüúQw ÄWÙ)$û 'ÝTDi¹ký`uÁÉêÜC'%¨‰ä8nYP=6?,Ì&¢+©K-ýàèÌ|ðzôŽˆã(3o—ýY0ûK½$vAÈOÑ/¡|DèÆX9'ˆS˜šžSR´¯õy8^røG=ú©‰ûd/$Í3ó…] ³©zG¾_ÁJX(9 Ç@Gø çÇ&"UÞøÍWëUüê p…º{v9Ž”·G;✕¿À>xlŒ†ˆ8*œ Ÿ)ªªš…gÑúIü?ÓTürZGà1ý˜lÔ É6ÿ­ç­§VVU6ßM€cŒW· ½Hôê:zÖ™:áÝ ã› „}«N±sŸ§ÍÈj‰êË°ø™0á۵ÏôkÕF®7a›ª+_;ô¬üu-îÞÒŽf¬NÔ9û$Èæ»1%Ì@3u( q^SF¿—ëX w4¼7¢¾½ˆˆ F´7zs–~;õú ó‡ÞÜ56‰ÈKVÜ3&ô^§M„¶5y‚oØQ£lÜDN‚z½×Þ³V;:TTL,îæf÷<^ý£c¦6Üje¾9¨ãÌÿîEsD`ô¬ÓY×U“hŽ¸ÉS~»Ïã˜G}Þ1&l’RÇGÛ™aåØ4•š¢2mƒ ÙLâ(²ü¡zêÑ€~]#Üÿ‘·þ“Å lJÚ«ìS[‹ÿ.*xœ4=Ò¶—1êüß Çc¼ÞK¯o]®0y“F4Ç(nþýjkò0ðŸ2Ÿ½øf„_ê•ŒâÆF0Âÿ=xÉÀí§›»_m»"3ónÚÄᮼ‚°*xövÇÛÇêÕ»Ÿ>qð£à—ˆ_S>l:ºâï¦ ô%/\î±ç?r”ûk#ÕUÑ-ÿù/<_]½<%z‹B»üT®ŒŽ3(þ 44¸ÍŠ´p½OÔÊá¡ÞIjHÌÙÕõÖÒš†Ta‹nîÚ}hä›þÒÜ*´HóÞµÞk skð¼œ<§Oø¼:gÕèY‹Ò.–ýÖ1ò½ÿ$Õ´ê=BÆUo\ku±\4ñ¯´ï†õêxs³Fo؇nµ^U¤èäÝþ£’oëÑ»tûãy=C{ô¼>rSFP552‡^nNYKåyáý§%]ù%n¤ón­Üzÿ{Ž®eŠÇË‹_¡Kµ*>¶ìy½‡ÍmßYâÚÀù(ëmùÉ/VlÍÖ´^,ú[ ˆÝz2`FâÅz} Í&Ñrð¿r•Ž$fÁ÷Z.Ͼ÷R*<ßtüZá¨'”ÿýú)q\6ó®xt Œ±bæÓKV7E¬Lö˜Çð´™ÉZ-Pñ¨$y÷£7ãQãÖÏ=’&ꜹ*•YÑeÉߊÏ7µ~ý«v:yÍ»ÚlÀýíº£p‚ô~šZçŸÃÂRŒ‹»õ{ßßõÉ¢U$æ«|*-OýžÄñ¼R”d0 ¡,­’‰–Q’­²´ Òû±yë(Ê­É[’[–šª&Ïe¢+Ëtgî7ñ±öS5_å½~M«·BãÆJ. Ìá xX_HUÇÀÏnxœ£ÇÛŒþ_~Xy9q³'nE.! ¼Q&Õ_Q·ž]³|MüŽ‡òr@yèÉÊjï,üðÙei¶Î£û\ü'窜ÚùY%kž¬Øœò{@@…29¡²41cõg•W2¾Ùñì.iÅÍ­qŸ¯|²êHn¸®§˜œŸÖd\ªŒ)KÔ}c¸“wlÍ“•ŸÅn©–bZeôÎø5+cVî˾\æ#-¿±%vågO¾ºRV 'w÷²§ ñù¿nÊðÕ#§ÎŽ)×y»Wú¤ï\³b]â>]èÁ™,)úáóôØÔ¢Ó+üUÒa)@@VÁ·[žf¦oû$í—ÿkò¦å1+w¦ûj"JÏÚ°<¯ òé÷Ûž†(*»º1vÅgOÖž-LEã©Hûô±ì€«YëNåK^½ñiA÷]ÂÚ±BÊtqlt9qù®çy e_YùµÍ±+WÅïLPWoŒ\ño)[–Ǭܑ~Zç3§–ýñijDiÅ/b>^¿+E­¦`ùãÁËXýIŽòËB6Å®ü<&øÖØ”¶ü:f0¾J“ˆù"Ýj´9_Ä®)ãê„È&{yìV ïëØåŸÆ¬¨¬Ð9¥Š“i;V>Yu0'\Wò×äUwÊŸîMøôPA! z²;~õŠ˜5§ StT.(»öyâÀ³gÎTL‘»£‹Ç6Vv¤Ï’×Gåp4ò_ _2ªcÈ­žÛ¦»L~½ù‚kãi¤¸È¯8©¶ c{ïuÛ£X0è[Éÿz Ôˉ›^ö}…/›¡]Ì-j†{ø~»AqµèîL)Ý,NTˆíå{¥ÆÝÝ”´wEÆE€Kžùø`GûO=áfæy7ó·k1 «pïΧñvVC•ŒZZtïmæ¢.;jsqt© e{3çã±C;Å^gÀó²ÈK:Zk²¾Oü^$¤Žìó考Yû–ÂòiWœ·”h÷约À¡£…çµÔ7oÿÄKÉÛfsy¬LÔ¶D;ûŠý®âBk‹b¾Öɤ]?˶u”¯Š3?¤†øäšÃªÜÄö–ŠÐÖ§EϵœÁ™TVœø6nþO&º¾V\°Õ%d!ŠJ|÷Ùž"©»ÈÈmàt¤TÖúSBÎ:᥉ʵåŽÇ57ïÜ×Â3%o£ý•É ‘wSóå7Z/ÌNhŒi4çö¦\pçù¾¥÷ùÉ%Í„"¦æŸëpW-vÈ^»â´õy@‰…ço”×»·“e4NÊwµÔ}}×±õÍ¥Dw!ÊTrç‚Îe62ë›%I'ꦪ¨…Oƒ029K×Ñ÷gí)ÌŠOœŒË «q+1?ƒƒ *| '[æêè\Œ3NEDåÅËqvœœˆˆF`unŽ%ÏßÂù9j¢îA‚wÒ¯ëwÏ=vr ?NDÚ²¯pf LÏ©º ïóÿ´M'Jx¶þ9"¢J_aƒà ¦'4á:Ü0H’Êû8CʪÇsC_Kô/Ìý Cª]ÕL¿ýaÑØ“ѱêž} ѪZ¨ü§:4B|âˆd'p¡?§p¿——evgËÕD´1¯?Sq{BÄ®QdÜt\y«‘a$XÇì˜wpšÿsYå‹Gý7EÝ ÷ž\ÃœEbbŒ€ÖC³Õì-^Ó¨üäÀöäÈ…öoô]QávÑYoÛ¥Uµ,šé.BtõÐM&_êÕêËþ•ì ~ç“HY½Ð¬æp_ëg ¬|>;~ó³'no‰¬ø|W»é3„ÏÌ}XÏÈW¤év"+ ó– WSg¾1xðÁÃb¢ ¾PÌ5=0Ñ–Î Ö…™ò/õø:ó¢Hì$l"×—Ù¬ªx_žWg!®UàxfUÞƒç‹ Ú:uDUë1Bœ”ê8'´C\–¥Ùš»U=âw;Ó{ŸRv6k0 ìx¤˪øêÞQp1wU‰0\Í»ÜÁvjìXßíÇM¿óALMyhU†lö@ÀCXþõ¿t€Ó„†yÐ=l‚Pû§oÒBít¬²ß[.¬OÊ™¤†&kWÜGm.,}·gÒÁ–^§Ç”¸ötÏœ›sÌ?§a2_ô½¶Øä%F6Úë°Úëpqù•ÞuºŸœ2YÝJй´ÕãÑ*9TÝÊD:lÅŒ©‰«5©¢:Ãà‹T„j_wõ_cb¬ Jt! uƒšÅ ®&RŸLÄãiH[‹Àcõ&¨!:|â°­ßµ™â­5ZôÃð;¦—zdzIb?ʳËç1_ªzÜ¡&ÊŸUfÛ˜¸é ÏêuÓäeÊõV¡­»NÖÎ0}EW*-U±²‚#!ã _Mò†´åƒ¯³Eˆ¦w¿yÀ¦žD0Üõ¥œ£#ÚÉQ'×MêtqÜEönæš– *uqé…_ÝâЗÕ¤TÈ3ybwSTZ|ÓïO ¢ÚkïߺpZºÿË=•ÿ¶v#èe.@ªBF•œõ2 Hvx·Ü˜Ï›ÓZˆ9®ýnäm¬ŽÇJ‹–Wø^[gqÌ `k>øðÀ'xøMVÞ(Êr "(£9ÓIu]”g9µHˉ¬B[óì²–·´Ž³ó8;gÞÕ°4ÿ;-odó—Ø‹]íB“Ïë$ÐåÄùÍ£–»×˜ F Xâ42ãÞ,GÏìgwªpÓûkØR[«}÷ìo«9ñU•4ÉO”Š¦?gêOYc”™Hz…·vk²®¡‘¬½»q7d§Tå`ìiþNû‹ÖÅÌÒqcP××gwxöW7Èf,;Z^…ñ Eæs÷îVÞ²’ @ŒAi~ÎâY:æ‹\™O‚_5©ó£Ñqú IDATÂ¥YúY–궞|8Ïq¥£¤nf9àDïo}8µÂ¤Á°-—Ïw,Ÿ~ó]°ê$¥(ìÜrcî£ü‰Ð×ûÞ'–™öÁKUøßž´Kð·7%‹Ð£{]iöNë¥e%gŠù‰“?ÐÎã»ÈË3½Ûߎ®sR¢Z9Í×IŽ8Xíp¥÷ÛnƒýÓvy{~ݸV£T3ÁÛL÷sFð¶aG5týÝ®¿4Ÿ;ÐÜìüÓßœ[íi|Ûó í•î}¤ïô•ÍòYÐ7í;ýúäÏÔŠØß;-_Ä®´H¸ç]c6¶÷ŸüeR÷YNCsK/ªE¿ZZ6ºqYŽìÜ}^óáé»<Ü×öôŽäÑúܘT—Ьwœºú¦þhå¼u„¼x¦ßļŸ!]òsïcæ—zR|Ò‘¥îM 8:ªÀìe¦``·XK?§f¡Aƒ$%§²ï'¸ Á€æ1÷Ûµ×/¹¢‡ï¦K#:•Ïh¡¹X OÜÍIxìõd3Ç«ßsís.u¯Ø~ý8‘a–›ô·gVÔ”MÝ|öÜáÚ>¾à½®‚ü#Yç>”×Q,1¼›™ôæÓÆé‘“7v?úU°mû^¥»-;ã¡Çh»dË¢ç\¡°uÑÈ“vA^1.n&N劧Ò_Fæö¨{„ ¢ÑÞ§wȼZ]V9:Ìðl1¦T=r7®ÈEÀ¯‡îýá[.Ë9©ïÅÁã!£Ì#WÙm5¿Øf¦c×K9g†w¹ïR·Å™ÝÎ=×µfÖdK³S™‡Û´ò ±vOz¶»kŒoåèýuR’÷k©óD7CkÈÂ~åîæ–gÒë­ë ÆÃCÓ†yòÏŸm!i&æJS+²Çu ü¦y7 ±æhH|7ªâÂyó.Çwù¿:ë%m=Š¨çW ´DDÅåQáÒç:{XNyLXþÕë…wŠ4Zâ8âˆãT× ®eªt‰´ ‚•UeŠ­¬¼&-V&„å_(~¢+QRuSúœ#ŽSgÝȽU–CDÒʤ›!!ùaË2tÆ°ü²פiDDÚ’àüH]*€´²‡aù!!7SåeU&UeFdAhH~È]i’¶Úh'Wf†„„æ_‹¯(¨²äiòà BÂK’ˆ(:ûëIiD¤QĦq‹#CòC®Þ-ÐPcÖ¸ç™ýôT‘r-ÿêꢂ M°òîâl®ÆdÈUD‡_ͽWšZý„#uÎÍüÈÒ Âáù!¡ù7S嬌ՠUÆ^)L"¢Ì²ð‡²¢Z‹¤¦àváµü›iŠª¬OrvµMHn˜¡Y¡Ì¸™Vp«jDGœ<¦8âj~è]irU1U\pau†mIp~„nP‹n„äß(ÕrDT®H»™š=±B‡Ý+º–¥¬²¬UÜŠ”æêzŒ+É¿V¢U?Ì¿’¨øö¾:>ªky|f-J[r+ª>:]VÎU¼Ó[¤V´Éš u‰Ñ×ë¯gÈ*¸GJMYTcr‡AëåwÒåUÆ&,“ÞSkз ¯ ºÚÈú¨l-CÄV6ݸ)o2‘k ›Scê£cn©›[°¡Œ¯»^Í´Mڠɾ^w­ÉÀþï ø.AwÇ)‡fn2ë–(w§­l(Ÿé’·œ]òÚŸx¤Üç€úƒgWxö„úÁé[Ì{¶‹Â2u ªUÑ"ÓXº4 ~¤~­Ô¹A_QñÿD!¢c2ïCUQÕðìÈÔ(^GuƒuÄP½æÏ…›ßíw뼯=«Oúàù÷F™›ý‘é,•ÞãxØzxüÞÌêh ö¤›Ð7³=èù+KwóGéÑ>Ü?ÓÈê¾ñ¹zÂÞüE+Ü2 zht¹é)=¥§üÃˤgYEƒÁ›Z¦kh2˜fù •®®^¯£ºN'Ñ6Ôhjj5õRƒÚ« ÕúúZm—yVO£¦–å곊MM¦º™a€HÛ¨­­ÑÔÉt‘f€´bm]¦®ÙÀ™ª‘LS]£©­Ñ4qiYuŒ¬VSÝd0Ë*4µµšÚÎjuµ5š: ±mvV¤¯ÑÔ°µšZ=‘\× 1hYF^£•< åUÉFïé/pÔ|ou"#þjîL`jÖÕ6·l¼E¦«•ômÞ«=‡éßíšðð…%–eX’41ºà± =ç¾èî¦u¾‹Ù¥…±9ÃülfÆÎ~Õ |a[ya‹XŸ%R¯ ðµºÅtiqΫšê‹Í ð,Éßïþï<Ь&Cí0À€þÂlÁ ‚åŠÎFÿžAè;.̼àó& ”÷üÁÔ¹à»PED¤›î×ý­±I£NÀ ÷‘a½À^«¼kÚQAùÑIÁ¸þ~«E*ñ‚«Ó‰• ü1S£{/Öcma¸¤ú ¸¶æ!)~üÿOt ,‘RèÿˆòÏS°DEùóvßèh÷ß•¾Œeš…þ˜¦Qÿ¥ –ˆe›Ñ)7̳±üÜé²æóñ¢µ¹©Dô{¼yŒzÊߪü{ä†ôÊkàCbfÛEÏ6ó¯fùþîÉÍɤiƒßjËy ÿ.A™Þ¸›ÎÀÕY‘w]B:oçßR̃ì\ý`H%\ÙMŠÀÿ Ž.ÝÈŸhq„û» `D¼Ða‹&f €ð×8ecNùa]ÔüWàûˆŠˆØX¸èVIDDŸ\·ô8€²â•¸ÎÐÁù…‰…Kîõ-à —Inó·úá–çž’šú zS'rе ˶‘›Žr[jàŽd¾‹Å0D€ïâö#²Ý; ±Ôåpí½ucЋe)íëtV±²¦urb»Tç³÷óaj«ÒE[ýð{¼sl—£“aº7$t¬ÆvJÁö€¿¿Ï ,Ñ“²±òx©¸´f³ÎÆú>"}=Q³^ÑÊKY[o§ 4@Àe€ïKÞ™ÒûÅiî?6ÖlÕu°ÚzzbCÙœ“µ»é“rèño€ -<¾î\^Ú²±ïòhÈfŸ%µ zM>µ53†>-¢}7 äF t¸±ð,Dtpžú޸ٜ՘­À øÖ|µZšzMù„¹”X)úb†V»dè©gGšÙ®¾0âÈU‘è–5ÉÓ Ët 6^õ숎W7›ÀªRÝ°2wŠ˜8)ÂÙ,Ø!Q£"d³Æ ,BÇÌŒŽþ¶'¥R|7i6Úκ1Ë.ÇÆV¼òæ. ¤Ç¶¸‡â¡’ÎþT¥ND?”ô Âm7&L¼ùÔÓñc0`P ËYâÃ×Ý1Ø}AìHô¯)Ä&yú Œ¥{%Ï!)÷/<°·(äÇ4[÷›ï Ÿí”»É°<Úƒû.Œ›"òÅuya@¬ ý0M£FÄ Ñ.¢ —Ñ£Ñ×å ¢¢z^?>éúø½™ûÜCpnÊÉÎ9¿0óçõœ62ÔÖ&t¨˜ ÐI>·õGçˆÖþ8ùÖ«ÀÔ.»µØÛÞZSNøL >S”ÿe‚À3Ñ‹‹ƒØäâƒA*8‡kò3‚î,I@xáÖê‰[žk¬àÐR'þƒúâÇáÈOºÚ#þG\¦ˆˆ’ŠŸðÌŒ,«Xçžú€Ë”&i°?ˆ® yôÖ†3á&ÇKlªÕE¸¢#be“}áM©ªÓÑ]êì 5¬¶÷eÈÑêHþ>ø/35 º_µU— ö†ßÛ]§X¿›–ü[Œc©C ¥¾Î”»¹äYßÖBÿNÚ¶e7q‹˜%w<‰Ù$¼<°Þh ¾Ã"–‘ d´\%Zï £)SV0íÏÏo÷‘lt×^Â{±¦€šŒÜMvÝ©#¹^Ü«¯b]<²‚ˆ(ùÞ‹cÒ{•<ðÃÒD¢Æ¾^Ë1l¬øÝœO”D¬ìuð]¬#JÉ[×÷î '™Åœa‰†ð'Üõ6²`éƒÄ'¢‚Â麋Ë|$®ü'¨‰FÕ óºHûˈè|¦›uè®yIálÞÄMUÝüx9•±L3ÏÒÔ*Ò\ÛžòggY/þ‚‘¦v\æ艈´’oÁotçûMHÉ›§ÊŒ>ýG®Â¬ÒR"šoTæ1E.^pQCZéËà÷8×ü_1¸­ «¼þ+Áá]R¾Bv0D‡âøkrRˆ­±¹Œñ,ÑÕ”¡ü›_rýÿš1`h’/+×TTiÕ=ìÆÿqù·“öÒà\,,v{€„DSî­ÒÆÖøĈo|›½þ¹¸æÇF|<~; ¶à$Óç¹Ç…ÐëÊ´'zß<|ìñ¯ùmº^þÀº͈¢²U23‘Úüc Z˶ÃI(@0´— ®žÁøÏ^Q°Äš÷]ùEWa;Y² ¹ø,ØN41ëB›‰|3û»ß@qîëYí•xC,øeáRÉf;ûÜÚ°ÞŽóyDÛhä†Ñl€e¼H«/_²‘kµŒh‰†8Òå¥YÊ÷¶%¯oftMJYƒ…Ƹ,V§¬]™æ¸¡ïÚM®+^µ˜c+Øp㱃î›7ºmxsÄ‹ cYV0i؇.#|µgךɞ¿“úÝã)ÄìuÊ)zÇ9oª­ xãü„ýÖùTüƘó¬­Ôéþ:Ø$²h…™`YØ> @@ðé½ÔñÃ?1 s›Ç‡±Ïœ—Ã;­f‹Þpoz%us^¡7ÔéX%–Ï ‰Ì‘KÛmv™ûë ï>tZɪ¨W6¨s”ð‘ó0T·Ž@©f¸i¶pLÇåªýÁzX.„Ù‘»Çßæµ.ÁÀð鱉? ½f%é÷OÖ¼“_þÅÚ5`mæfÝÃküS4S*0ùÆxÀÓS»ËŒ’_Fá\×MÇF“±TªXæ}½øÙ(… >-¿¤i8Ãóçñüy®I! 9sO¯3ñ3C@ ˜‰:äf±ö@^õi`…´ÏÄ‹ˆ1žEâÏÒ/»=Š×˜«Áð9~ ob›G8æ.Ÿš|éû©_c¶òžtàõ‘Ÿ–-þôó› RÙú»°1ë·D8ü*eCjœávä!q¦3`ˇΠ8ø.¹ÿºÂä G>ub ¢^kô«s§ŠTßälá]À£ÕÅti‰æ¬ÇœŒºsÄc_o?Äð}î_å^Ò*âC¶¶˜[òÌ8L P¤'Õ1€ªôññâøȆÜm#ö:u«Á!߉k^Ç€“PÔ²Èuú¶ QW½pô¡!½·¾7êÄqÏí&[̼%©¶1N¦\u[#¼4Q…¼ÝQGëÄ;<ßühôG›,9äȵ,˜uôMï¼yüèé°çN@ÃU¥j¿óè.·*àÌeN6?UÞ–Ö_(´[þ(¿Çpé¿VŽ»é.S ̵êÿUã-€g[,ât_4ë6Œ`8ž²lØÿ¶–ÜƱ²YkÁ‡FF²sAâuË\Zúy.”¿­,;ÑsBë7ÞýíÚúY7Á±{ÑM\@ ý¦Q0wß®æ©6çn®$ÝàùÞØ/  ±þ#…ÍÌ™& Ì8åßغmU8”O‡»÷\}ÒQHD(`úZ°e¾ˆ5Kïxe­¡QåÔ²Ú“ÓÑÔQ.³­!A\‡V.€˜SXc9{¡ñìTQåË+³$D<«4ðl4úzo裿y€dïòBY—Û¬Ó®òx}•Çë Η]~ÿÁƺL/Úw,ùç„^Êá2‚£kpAÀFMž=¥-/­×®³cç"5ë5¶ÂNöƒØ^ ð˜­h_c1 ODH)z8ÔÆ!ðO„Mõå nK Pyé>ßt/˧hÓS-¿ ½ë4g×~;_Hˆú# @Wî*‚rµvº@H·ª.š9?5¼=L\™3ô§êë;úŒUÙ¾7JÄëÀV·æU=;tµË½€Qv~«µO‡Ùcvý7æn•{nÎò•i±ã Bë&|;ºù‡¡ Çò•÷òdÉÏ\·®ûÀy €ÀŽ§Þ=Ü[|·DYR$Ï:žà!GÏE½\^¿snØðÃ.&ý|6ã…¤ô b‚Ô²·¿sæ>[VŒ¾RZúH°$¿T•="?lÏÿ PeúÕÞW¥E•ÊÄÅ ¯nö©éQI<ûÅ +i°Úçîy*Æí–¬ TUô\ôRµÓže"@d¿Nž÷rUUiØ.ÙÉV«áuÿA!ju÷öf¼¨&Ó`¸{ÌÎà;ÓrÔÅò›cãWÉ©›¶XV§­¹]¾¯HÀ*d¹M,øç?íót¹º²Z]Q{g»È†¢øÙ^–W««‹$±<«If àÛƒ!¿@Y®"ÖÚéÐrCØ‚Ì;—ÆÍ$#öø¤¾”©ª¯Wg¾‘yqºû |vú/õùsý$µšš°‚§ì®.ÖªµÙ{3_Ò€%ŠråyµZÉþÀmS¾Ñ­õ–×ië¿»û<º¬ÚЛž]hç^Q«k(–<™ö ´%Ú†?`õ2`´%„V&Õkk| ¶ém,k$ib¦×æÞÃwe<_¦©Î¨ùtVÂK."ðÀW¨,Әܵí­f`J6§žœ¼«}\¡Qœ´¤B«Eçþg&È>Þ_¬?í9‚éFá¡×*ózhÍß\T,™§•ÝhXÕŸg®q ¶¶q?Pà×&&º×ðÓœÈÖA½ìB#% ¡zEØœWó@›ÇÒOsúû6Q1Ññ¤©f RO1oÅõ· ™(«Ûa/ÅÃê ÓÔI ®…Žºjkâ~¶¡Q¯Kv ¶Y_Y@D¿çlr4ï{mI²–ÓªëW]s6 pMÕÒ¾x»½÷²¸’³‡ÙÙ6ŒF¯ÞvÜœŸND9å;m‚l–í§N%Oœx´Õ'üLŒ}ÚµÙíßÚî¦ûˆ³][±Ý[7tÕU¦Ý“›Îf,ìýj­ÐN3u±u÷ÖD”Yux¿„Û¢ñpi`}»ÞØ®‡bYb•3œ´÷…°Í.…e»´Lù#v7l»Z,í…5òÖnÃqÝìnˆmÁ—í‘lÆAŒ”çéjõývW³ËwÝX¾tÄU{&k!¶½)`5Üßó‚à“&mk[FýóŠŠâžïÿomwsÿˆ³9S4µ[ypW¢»vÉërßÉ7B¡íð¶‹Ê]T`#‹Þy¯(Ä8,ÎœiY±$ns ¤¹SkãïÁNG>³ƒ’šO^{ œ÷:·ë » ‘@èûh‰ð¾bëoÄ.e&ØL]•JêX>¢ídûa ÖUf+*l,' 3¿_l˜fEr¾ž?Âv|/Ä¿mzRyF##i;ÚÚ$ w¤ÉnÖã¿bD–U&IslÌ=GZÚÿm]Õs¥©*´c3\=‚árÓSzJOéÑLý{‚çvúà¿·Œü¾`ýÃfAþvZn&Kv‹½%] =h©ï7PçýÝsfÿwÈ "^É]ŠÐåv0ý½WDœŠ‡Ëò»•ÈÏ⥺¿ý,ªŠÝ1èèC\ ?—GñÙX|<+êÏšeTåeåŸIaÀ +¾X“ÀÙ>¡³/^Sê‘­>’8/!^Æ©‰‡› ¡æЭqè…èÏ\D#Àزcv~ˆ^Ø'zM¦ˆÁðé5B?4óǾQËo«åF;Cáö;¼h-a‘¶mx3y.7ÐøÛYSÚ„Õuü©ÕöÜÑþ rCÝ22mO ŸæD¼¸‚êg,ÇNgHÇó§‹ ÝuÛ©i—gTW§ŸiÍ]÷€%×-Hh"ÛîCêšêfjb ¨„<ç@ÔoP)­x·Ë–:õ€€lî3©§9 gK¡…5_Øý(Ôåô;ú\5åî„ýÊ ‡ºa²ºZw„Rñ…W CŒÍ˜ÈFÞ’ÙVÂWfüª›D‰6Ð@ñ'éQ€x8fB` ­'ZW“šõÔöZ"‚Ö{~ò‡×–­§ï\ ScŸ@ÄÒê§^,mÒ¯!íjúÍ•™¿µêÛè;ÂaÀ« ²3úä"žJ›ûµb7ÐXÙwRƒ[cþ!jvß\4Ô¬y ³MOyXrƒlÃn Ùá•»' ¢^_ö¯žè‹äq¡©w^^G8Žæq>„XÜðí `úà°øçªYBÄÔ¼¾x3pí5+Œ9‹ˆ²ÐéaÖèƒN×ÍÒi9]Ã`<[scUT_ôÅAñûÔˆHlíθ¡èƒæ¡3c• Î$>¡âM{Dœ›ö‰Œ3Ë_Á aˆH¬ ½1Y£âûcpavê²ñ2æ7¼…Þ˜¢…ÎÞɈt1{ú ÅÕñ‘ yËçIñeGzù!úàè[ÏW2\-Tª3–\³Gì½±Hg0qþ&J­zÇ)Ñg¦| %BÔD¢—C©äÛ¾A<ô±üQRUü¼m bçuµ1—QvÍÉ>ˆÞ8!ñõFDôË´rJºúÈUÄ›þˆZ¸}P22\‹yÕˆÕ%£ñê{€ˆ’W0põݺ.Aˆ¾Â×*s¯lG†ŒŽ”\Ç‹Â C%ú çya*à ð$Gâ=Ñm#WÖ3,"ŽÆ/ËuòÁÅt³ü5[D\þ¹¤ï¥ÌBD\•ý«g[ßã5ööÆ·å˜Xñ†}¢öZ•£5µ EbšÐ ïʦ‡Û 7ÎIÿ’E@­®ð©Øè‹üà¡þÒ*D¬©:6äæÑŠÆc‚àˆPPøÂàa¯ZÌë·ß{âgÜ—ýù¸y’/­·¤þË‘Ï€ë÷SŸñMß@©Ï:xM-þ>OGPPnáò·RôŸ Íw›tÐûÞFÃûý†šn‰ .;.OþžèËq¨k}t-ŒVxþ–Ä^ï²le3­/áïRUŸó  ñr$}.ÃÁâ4""¶q°¬-+$"b’½à©–HµÀÞ’Ÿ—0[GDž·"Q^ÉxðsLÐ2DDú«‚ ð£LGD5§ÁßBɲD49Ü"v]„Ã`LV±ú þ¼ %DÔX{ ¼=«‰²«öò‚<9·æãõJø„ˆÄòÄÓ%—‰ˆedf~ª6úŒ¿t—çd’¾¼¡_¼Ñ?xQ-/hgÅX³¼<êY"¢Cq.0AKT\ý/ôÀuôk긶›ˆÈpÏö"«‰(+>ø-3uG/©{Ü8kÈÏFYÞG³‹ˆ"ò‡°ÆpÑñ®ˆèPü{‹‰jJ§AøÇDD²÷áü«8›ˆ´š$ð40Œ®a/\rÊ1í»Îÿ¾"ôð[Ê¡nÿMQØ‚m«ÄkD4=Âœú4g¼˜^ñ,?xg°xü†›mÒ×Dômæ”Á±û9Ÿýiþ¸¥¦”ˆHûVI› ЕkRS¹®>×Ί†iF?0‹ûŠûµ0TÔSåv ¶TTéãl½À_®#¢Àüƒcqæ3 .KëÛ[ðè_ ƒñyD7yE9-þæ•â!¸?³&Øl[U~k¸µÇýà¹&j–ýÄóu¨Ô©u ûEâ„Iï·‚¦Ñø‚O?I¶A†ã×`XnŠÑìGå¾c”DŸDÀò:.w‘ú\áÉ{Z}qÍŸ^Kú*\ò¬áR>I½!оõÍÑ›£Íú•H>ßÞ”s"R48¯5ÛN‰ýïÎP~É Þ¤'b‰üÓæXÞ>ÞºÆyÃ¥–ˆ&‡áÑŠ îéÕœ½ãÎ1ú ¾”鹕gÕ5‘î™ XZÕúÇÂï6y¦vvÝ’þõ–-щÜ0Ç#Cò[ª©îCðo ÚSK*cl<ÿw¸¦§âº/àÊÐÖÁÔ5Ó¶Gu{ƒa^…¤åçmüÝâ.Gn¼™C²e IDATl ¹ýÊ„Ã%ó†X¢ªê!l6óJ(L,©hiuÇì7~"ѵåD’æ ð³QhŒ¦×Œö˜fôƒ+*9÷k¼ùڜتÆs<°µÊh÷õÁDä—7PìQ"bÙfs_(×·DÊbY"òÉà \ cYÒûÃEÇ’–a$ÞäJÄ̾\_Ôº/¶Á¦5ë•ýøø€yø#yÚ6kÃÎä†("k øMU´Øv® ƒ·ë%dBnîoÛSþÝ"P2` O[¬ˆÞÂwº¥¢¢¬)x×x!„h%ü Í'ð K­TÕCŸcÆ& Ë”{-EdÃ7Æ5à!ˆeÙ†¬ÌyFà s¾9€4Mwn[#^!A¾†™qœí}$%‚ÝÞ ÙT5´²ãú³·pbx ORÃG0 ì+€bØé«-øÎFÆÐœoj¶£NÖ@J¢=&´ÁvW£y(²5âHdmŽ€<äBYèo« -µ?¦´a,I Éå›ãÜÕè†÷vàþ¶3ï í]ðøö½Z­êð®F7ÂÒ¾eFýºhŒ¥°±5 KgNŒ³È ZȾeцgîé §tóŠ¿­ƒ^in›«í(Þ±³yâÞܯGš?Á ͆/HœfaÞÁ.Çù-KÌ#©¾ temÛ‰…þv•¦õuŠ¯4–oõ´\WQ·çºí´U±ü;!œêã-«€=b}[Tcm£<Ì̯¥»mQ¼¦ZdÁiÓ û ‘ÕOæôé†÷G4¼ãpZ»\¶ò‚ßYXÖû¼³ˆ:'Ýc„éëq[ƒDfŽN6N>üô/ýø¨Ô±\ŠRîs2*„á³è²s+šÂI-ÏôÌáa$è´\OrO &‚{j €94ˆ à*[¾³š‘ÑèµutóáBè3]Ô[Ð6ÝÖb”x$ÑýìLŸFšàÜUÀ6h81“V/ä?pJ®|A¼Akl¢k|X]¤åŒŸK¿µ‹RÓ02ãâÑEúwðyÅë¡09ØqkñÊ­ ]MZÕáéWf7<™êtß;½5ßÌŠz—ŠI¿×Ĉ^½0$u×»´ñô¸[oÓƒ=þËãVƤ-çð¡’þ86þ…4r[ÏÜÂo´ˆðcÁóÀ{`Ÿì¿ ÎÎÿZ€ç <`š-þÐJ›ï1Ý7u÷£¾îø„„SfBÀ(ƒÞW1JƒÁHâY PR÷Ö¬„`-ê3·ïc ¯QH”é¿WGwç»ù(¿÷™Ä˜Ìcû­ÞnÍx,«€ƒµº·{ žÏœ•h{úÎÄí¼6‹õŽN‡óÏ@íž”_×O8 €«'žk,|2C’÷&9>1 `kßÝ8€% ßV€Û’Zc&°àÙ¶xßøä, 2;ZÑœUú[ Q†ž¼x"wCÐ+Ç­`@Í’s³oÙ@NjmãŒþÇ?tî WêAC@Dv®?~:øI'?tõ’0VïO 0¬œår° €Í¡«SŠ»‚|¡ƒD«Ø1òbжÐ#—t€fÅ‹~›7 “–GçÄÍC‚!aû$KÑOè((yC›Žµ_<’îG«JEác¶L ³=í0Qh6}õë"ƒ@zmëŽP@òìÇ··ÕŽwÓsàðaI›jG |±—ÐæȈP꥘0(âEñ" °qèY³)7æ]D"M*šÿÁœ(Áó(ÐóÜ~ì΄芓›‹ž^3qЕÃâ¥è'p‰dèþãÌp2€^ÖBA  —q°¬ Jpïï¬þ1‘ÏId!%ׯ§…"€•Ë _D‡ï®fî+èkÙo«çKÀ¼,«¥¤½¢õË ôŒÜQ3ÔÌWØײï¿<_€²À¼×ö>üЇ½ŒÑÔ*Æ`lC 0hL—€ˆ ß)]Š~BG!_%qqV€ÍéI»GáÏV}¬{-/™sÜ:lñŽI!îKV84»{áîéYnú'Ñÿ˜£ÐLÌØ~° º?@B͙͹ÉO÷Í Òƒ¡õæɨTŒ„#«5÷¦åQpVj滟xÂÞ…&;m.ÍÜ.ðÿ„18ˆAyª %R°üÅ^Ê]¾¶äÔÜ´†óÐë lùí¹Þ¶@Dæ‚ÇÅOD-£ý¢¸y׈à©iÕá·¢ÿGŽBÀ³ ® ¸QüļÔ+ÜAÈóF0ò7é?ʉª¤(ô>Þ²ÿ{7·Ä4éÃ]Ó¨íé+®Ñ¯1ÚŽ0Þéþ¼%™öXS»mFNêm¬Mé1GÑóÝÿ£È u·ƒ´ûb¶¸ºûÝàqÿ^ÿ'ŸcËy zÝ?víÈ”N´+ü>§Gµ|¨K5âÑ0Œc€©ª“WÓŸ±px%ÑõÍš¬?1B"ös¬2öÈœJÿe³û˜?ÚXàþÙ¨×Í{¾û¹a>ÛsýÊ%—þuç'ß¿VñÅÞô݇s?m`.doK`¡Iêõ]M SòYîK;Óö~YÇõPQÿîËe÷‹Ž>[pš,<º3}ÏûÅÞ­»ù£œçîh”— _ûWÚž/*cZ·wTÅWû3v½Yø³²5N’6íÝ»ûw¥øµ¡ÐÈ[I®>—sˆ4/ÞÙ_¡7šü®®˜ÚÝ™/ë ™‡2w”:ñú¬™ok ˆ@!¹ôLú;2Ðé‹÷gîÝ—qTE@ÊfÿgÒIÀ`¨8˜ùÒ¯¹/ÿ"5ZÜì9QÅŽˆ+xñ³¦j gð.þ`Wúî7 ¾7´Ìê⽃±Oá«;Ò÷¯Ë`¾Ì9¸#ý…X…¤5øC`éÉÝé»_Ë?«âZ©£žÉ:/Q„îÈ|EDПÉ;²3ýÀu¥:²ìÍsµ…À*"⸙Ëz®D¯ú¹àÈö´=g«Z†Õ}•wdgúÁh•6¬ôŸêËBs7|¥„S{¾læÎ~žRr8s÷¡¬wò @Mâg_/ûà™¼@P_(zgWúî·ïýjœNs÷ýìv¥ï=QÀM:¿øùçë¥á%ÇVD¨/½»+}÷ó9åL8H«zíÃêê´ª/v¦í|½à{mK(’&yäk™{öf‘6r5?¾³&—ÕNÛª0T}ªn±îÌyqWÆ ¾â¢–ij¾È}igú¡8µ!°äÕßêKmŽhˆ7ô|÷ÿrÃ3$ýXøÎά˓m‡0'nö]_7Ãy‘£.Î%pp>“\×:°àá´j³R¾­ß ÛŒëR—©Wsžò(”Þ§òŽœ—á$kGɬ`»o›õK\æ–ÕçEne À»âÜšØGŠÌæír›÷Yâ‚]u :“8øÉÂðávS¥ X‡o ÄfE0/`’ØlìBÇaÝúTq<¨õ•7%Y¤?SôuC‹[|õW!MÀʾ»÷é¢ÈÍý­ÇXñ:Ä|~Ÿ3ÅÇk Dø¥èËŸKÞùUP#ùðë<_ò^©^Þ%g~.=qNÐ$ýèËjšÉÚ– •¯f{ªè}bvæ|æ.²àH¢zë5‹Wk+qyDßü³ðÊ")!Ä×ý´+y]ù¢N;ãF¬º>ÆÆaÝj[Ùü«Jµ‡¢­Ÿ«Ì™ç¼P¨ô· šVCLÎÏ÷Þß|j¼íÃSa¢“Mó§}™0yGþÉp‰؆óEßpö¹¿”}óxÔ<±å’ýf¼wsÆ‘F-‚nC¨Ù§bé|ç©ŸÞ¿+ÿä5©x”Ó9‹³\WÏ6`öòÔ÷‡ÚÍÐʼ‡‡ÏBƒ:è‹ÂW?ihšbÝ@±2ÔòƒÆ¦E. šÅ_aØJ5 ²É½ÇæÛ|Ç)ie»ãß@Ç5| ·Ÿ¿Ìaôë±NoÕ×ÏuZàF¹#½±Ü`0åx*¤ß¾³õ3y¯KöNÌ @ļê·#ÖXôš5ÓÖáÙHçÅ ðˆ£'˘/í·q”q<³åÖ€ùCR§É½œÇyî*ËEЬ¹jñ¥DµÀyò‡ñ£žË?#k¦ê‡¢óºžïþ¿Æ‘?¬Gø‹T–X–Šð³iM¤´#Öyk~¸‰G8{5ÑFpÛÇøÚp.Úåå—LDÿ "–(+ÿq¸¶¿5¥‹7„kõD49\°£$–ó­ ºëê÷ÃTñ}¡PÇ¥Uj:°)Õ@EÁð¬ìò/àòØÓœ*Ýy„{Áç*£ãn{p–XýŠ@<ÓÜ@D‹Bû26/¾KDgc`yµx}ˆð“¦ "Z.x.kÏŒŒ"úé,­¬%C$xj Ò5vŒ[?ßß¾‰È`¨âû`Áè#\Yý6„ÌiEäÈ Þqí»ÙkQÚy"–H1Öž¨sÀLð…órjhü‚F´¶šj~¼*‹gà‚ ’!–%­.|¡ÖÀˉÇúÂÚÜ$Ò¦ ‡ +¼—ªîp@|Ÿf?,Ñ_«Í?hd¸& £|aS^ 1Å–—yñÜr6> —z—sÎЪkàÝ»‘¨±jø –±Ä•îÐÕ­P¹ùÁ¹„ôU·›ŠˆÈÀÄÒ`táÞλjñ^M6‘z¶/¼Ù åV+*tl»l.ÙNÛ¸1µ5k h­¹»ÊnäM{Á¥šˆ´àbÿ*""ºv·ßøüb"ŠI7ÏsëZØðËs9ßé4Ià'±\N›ºa¾ðla&©cÁÇ¥¹Ç5ûãn6c$4j3”3c¦sê*¹ÌÂúÀ¬2ÆþP§æ‹Þ™s’øh”ú+a Z¯ãì·‚Åu ½;+&™@` ¿4+—8Û†™õã¬CD $%kHcXs>Ÿ쿘v yw#Ô2Û§7ðQ ìt,%ÝŠÐl©tez‚€‚“C‡Ï+ËÙ;¦÷-í¹}Ó~~¬^?×A0dÔ”ò»/Úë¢TÓ+ÎsI<0ùZ^øLà/f–¬Mõõ™Žo¬…–Á+tž±~Źʼn2µ¹˜»³b¦s"Ø=ë#«Ýëàdp² €v*òZÌî¹&HµÄc ÖýdZçN¸6Z† Ø}çм‡Ç_—Ó•Ãde·áûB›`×™‡Gö^të Ø´P0xŸx†Ž~>ë€Cк¡½­¸rBÑÐç,À#tô Yì‚6 v±àÙ@vEô£ÛŠó•CŸ‡r,®zî½spV„Ýò”wÔ¯ }$%kÓæ;¯-Œt/‹åí¦4.Dj¦$©AoDm£2㮼±¥Iòmqª˜¥Ý±°¹ ‡ˆÔÚ⤦¤<µŠôE·$Å-É´e·ÄéZ"½67QZi’ô]_,ËL'¤IóÔ-TɳÄ 9ŠZ"ª’¥%5e2,K†ÚÔ¦Ä y ±š‚æŒqB²ä®ØTX—Ùt«NÏ‘D•™)o‘õë‹oIŠ¸±4ºê´¦„Ħ¤"US뮫Ud%6%&6¥ÊØÖ<ôDŒ,K’’ДRªinA ›-INhJmbiK4ì.* Fv»)ÝÐ#³ýgÄ*þ-Ÿ% 7ü3£Ì²ªù‘£¿h’qê/Á·ò6QÌýµDIDÄ$Ø_‚ÿ‹‹Ê4ϼ6úÛf‘!Îæ"ü®ìÙéÿåÒã¢Ùµ¤›0*ÿRUjÆí#µh©×³ÏŽ½|~ÈŠ6©¨ûxæíWêy–:=íçóçãÿ“+[ZûÁÌ„7šx–ZîçfðâžÛÌ·ô›ÿ bÙN½ƒŒIÑ1ºÔÿ¢øâÿ“iö›žÒSzJOé\Òî†ßÓ2ƒ-]L ÖP[¢3liŸvm™ïæ,ø?2§Òê+k»æÖÿáa&Ó–)À¥¯爀•ªóòüP¹ªÔ©‹ç÷;y°JUbÁ3“°ÂÁ–Φ'°N_Ya°ð´t¨Q™™ràC•²Tg¢Xñm\ÍyDˆÈ0Måõ@Ë~­QÒõ†æ re_@ &m­Ì aÌù6½[Z1 ¥z jTw2¼±5ïOºZÛɞϳp1w5G“ °dhÔÖÉ ¿—ÀÁIdÝÆ<¶TUE€‚–ý[ ‰¦LJ"‹63½FuE3+ô°rm Û§Ô”4óû÷v·- åÊ2g‹ARÖ$Kf7õY¶•Üt5”ifÄvo»„¾Ýÿòw!üíÎdïT§GÆßò!ì "Zrb,±¥½|á†RM¤n%7Ã/Ã!‰ÖDç’ér^3÷'7jåyð±¯kÕú²Å/ÂKê‰A.ouÒ?ËÊ›Z;Ù=hjöï¦Ê¬ùþ0¡(—ûõX(LJ<Ù:=Óè€ó cL'X×|[È ËReùˆÚñcŠÍ¸ôØÖ†Û¯õÞrs ¯`Z= ¹Ùà½ÑôÝ¡è.)_Q³ä7ðâ’(™–|›‘ÙóÁkH÷ýæÛýߨ[JœýÁ«©¡óFáÀ»:ÂbTÌT+µ eU‹ñê+ˆˆŠo1pú‹q}¶ß9¼,Ò¢WÈB f–þ:¤ßR C©[°¹ðê0÷`4š\‹°á:n)¸Å©…tú4ôÅJ^ˆ‹AÎ âçÛป/±Ú4ô3S²€~i3ð’ –E@,n|O²‚–\ë‡!ð]ç IDATƒ—ÆC_|µŠË‹†¦ÈÊÏfzÌhôÃÝ%7:7oªÝo¯3óÇ…ég@£M± 8_Ÿ="„÷nÁJ X ˆŸ'[ŽO‹æ.¾wNn¹ôanþØ;rú¬(ôwü^ˆäˆWeRD(­y}Ñ3fÁ€ ‹³Åó1â$!¾zk"9.ˆŸï€£âös÷€¬“OŽ|^pß|¹ü‹ÖØéùùË-Í°¼oHÞØP¡x 1H9CN"ô(ÝH§ùP{Wk;ÎÒ¦Õðº¾5´öd¹ÑŠ¥U ¬;*0õp‹ÐøèX6sGLê¦2j—¦ ­5Â[ÅçŸê·ýÑeVíã2|rÅÍý×íÖák³ƒþ#"ø’¥1´;À‘áâ•©ýØ…jk °X£ºbãŽ×fÏ$v‰ÑêËËß:-.ˆ,=ú\Á/5“‚Ìù¡£Þ˜Œþ•w1­h^™‡=­?ç2u¾iÖé²Á#t¬¬r)\}•ˆHù=\€/eÜ™Ò,ôƒ$µ’ˆvß°;R^JD—’]oýÀõ´)ÂfkIBrþSüèqO2sGÀõOˆj¼ •;“Ùú“ùßjIÑÏné´D´(Ü|fô¸ƒå•Dä•d>>¿8¿` „íÓq6ƒßQBž'ÏÏNÌ5×=—‡×˜œO,«vôƒKÒ&""}¢åeQC¿Þä;Þü‘«²ùZo~šˆ>O¶ž˜EIJ¬a@$¨4©SÝÒÎÝš%¾çjò‰XÇ@¸Ú,!¢a°.?‘ˆˆmépí3¢z/¸Í™Ü±â“ùgUD,Ë„ Kl–ãE8«4= €wÅÕœ“»)wóŠ‰5MZé^¸l—È<ð2¥{å†øZšõ|î×Å:¶õÔU4l‡Øó&몪w33׿íµòŠ…/|Õ,%¢ ´Yûr§qÏÞBúÖßuÒ3-Ü K†P¸`–l ¢Úa^ð±¢õ2Õûpy)}à¢eóÐÜKÌVŽ/oxl)Š&¢-Á°8ÿ=‘ïxf&ïß“¾ggê¦ a6; ù[ÙÁh˜“ÀUJÍŸÁÛtDÏƺî(Œ$¢²†³pe¼±Mü©Òh–Hgh®Òˆ{™?‰»ÎzÚÆ @è±Gç$í#1 ‡mé…D â!H€2ªNº¶ß@Å·eâ'†=CDtaqóÏîÓ&ÞÇÖ\L"’oÍÉý|ê>×9½à‰ØEÇîýTbp8ícv¼®@’¦vfðüè:/é‰2ÍéÁ'ò“ÝœúþVúýùÒóÁJ°ÒÞõÕ ­Ù!€Ë;6/^Óvä“,a`¦µ=ªr½vOùk-³røfî|ûlèlh—ω-¬Ðfn¶È}Seás+SŸ¿T—ÔÇnÍס&ÕªnIáÑþS Ðþç¡}Àyž eì#G (Òۺǂ©¨T×o¤¥Ž:6dðW™§Q£ +Ö[íµíÓÁY> EôFôFôÅŹ—¦MåQw,MË_ÂsÄÅ Ã XVÚðÝ ^ÿ˜ ˆìÙ;?uóÞ­¬Õ­# ¯:2áÚ>[P²¬/ìTßRˆ g™®˜¼˜ñ–‹ç©É|è}qÒœwo¿ÞŽ•±\ë5zÊò{r#òêÅ¿!ôA ˜3oȯçÍ`Õ ˜ ,*ß ¶2ÉnÒTû¹Kœç…•Mרj¯ÔÁÊÁ+¹ÌZãÝßÍï ,°D, _¯¶ŠŒ9 [ÏT\Õ˜Ízià| òmúšõ¸|v³f™rl‰JÉsàCÓa‡qÊ'“•nþ¤Ðfÿ4èÅ ØðÛ'úáÏ|ÝMóNa–RžÉsÜc%"¢€Gõß~¼L|aX `\â›°lÔËá9¿‚ü´ºïžqn+³ê£@—™&ò\Àg0Ó—åÊsóäyÍõûF¿ìÆmraÿ–A,,T¦Ôƒä,ùí® L£8Å"ØY8v¸^4Ô½,ìÿ…‚¥Ãó²'RfX0g²ÖàeóLo4j9 ¶|ãä­œ¹Þ½–jð\^)ñ$ð ˆëŽ`¿Ï8¼ÕãÕìºo ~éëù;ò¡³ÁÈ+­#ZGo÷éï`·zƒ£“. ô­Ó kl[w›YÛ¿æ?'ƒ6ÕOÐ\žŸ ¬ü¸”}ÎÖþ¾Þ˜ìÌÑþ܈ùÓö ßù¸Ç" B‚Yö}ôiŒic"Ð_¯×ƒ»¥´† 4fþø°.¹¾üú!úáÄô8¹â3qû}ݨßÜš¾}¥á¡‚³.Ž[9éÑ3@ð²çÓfD¼ÑP\H®…ÝΗ%˜å¶uÇÀgwxì911èt/ñä”otrløF7}äõâƒAoÒÏlœt]ÍÓna¥oX\ÀmEñ=w¨?›Üh3*Œ®ÀêD,´¾oH\äÿžwi¥Ç£`¿ÄnÔ#æÖùùKK`£û±•ïåWtê}Fˆˆ¤*V«—|ñ§iº'++JÞ¿¨ó^ûùòÎeÿº·ÿtÀ1Q?5$¸Úlà­¶È,6~<æÔÉÑ'OùèÕ¡oÍ’2üÿµwßqMmÀ¯+‹°A@q¬uïU­«¢­h]j]u<­ÚVëªÖjk[[­¶¶.œ Cp€.ˆ "(²‘½BYçzÿ#"úˆÔ´ÕF'mÀ²Ôx¬¼P2âšK eÎßt,ù­EðLtš{ö"MîÑÊnªIDîDîD“hªXå‘šöHáýlÝrÉU${†o*ß'd1ï{ìqí+Ãô¡Z~“µ&V•1Z¥²º¥ÿoY€å§¡9Ëå HhÖÕ" ‘t¥gõÔÖÚðsŠZ]NªÆþýv›|ܤI{þ ›DUm.5n$éK¢~IQ¥…¦}"u\d)}Ê~¡ÉŽüØÉöƒ ß ¹ÝV]îrQ_|¡ÏåIùz1ujâ‹boýêö€>¸µ·gÞDeRt¶Äöe)ˆÐîei鲌äWm^€áÎÍÇlÑ~9¾Ýû@~üÐ}¹Q)¥É'î¾Ñ àjô¡¿dßLU¥l¼2OÜde/1d|e6" 6ó°´qss\郠„Ùã"m"½ßqعˆ¡wJ’.ËŽ~䛨ÏÛª½cn__ÚåêÊûÊÄDe‚ofñéÿ–㜛þ5/M•v=sççS@}Hk/ë}y1‰Ê¤Û9'sEV/K”[Kám‹ÊfZ0YÙmö—‡‘|Hw±èi)€HÐþp×wÖ]DrY¿%6NíNö È»]|ëûÈ!ó’¿ë½›û:÷ô‹t[pÿØmEl¬"æpü;sTŸt{ÿ~Ú²Æ-¾7Áÿ­²H`¶XHÔ½‘aejD$hïóò²í—]&Æü|³(*¢ lNˆÍ¦bË»½>Z“îzë÷;…!¯…nëÒöW)¬ûúwÝlÜô½­×{goL(3n‰jî°l•EÒ¤ Õ3„hã ›f™Ë7e&"PWç ŸÚj:}›Yt+0yI€ûÌÇ»ˆŸ²H/¹S£¸žµ§oBÌû®Ó`žËä_¢^W¥$–ܼ~@×c6æ(-¾•Tšs;s]³À^QŠ{‰Ê„ói^`9¤!BZî¡·b¶s1§šŠUÙbÐʇ{Zù[69=貆ˆ¨ø¡‡$ès"¢Òà;°¤¼#°¬ÙɆWTQ-¼]3ŒººÓ³¿kïoßàd§? DD´çF‹¦gûV´ã’²ØwDPK[_Ûvç&\T•÷S‡ßêdáí–-@²ÖÄ×5©rT¹òô°³Î6¾6ƒÂ?5œÂq!Öµ]ÄÅ£1~¶]/~o¸äeÖÛ3ý+û¦¿‹ßÈצCèÌD]y‡ýo‘£ü ¼¶E·|Þ$¢_n¶u©XÐø¤»V ÃðãƒwßmîoÛÀ¯ÉôÛ†ÖVá¥@» E¡á Ë/u³ñm83Ö;#©;œÝ!•*^ neëkÛ&x\¨ŠJJÏ4ò¯6¾r¦@¤‰¶M~IðÁ|»ùͺ ÀÕÛ}{Œ¦«Ÿu%wr݇~ãíhïñ «K®½yßÖæ¯ãóÎ8üØزÿé_Ï%¶Ç¹õ7†äƒUC)’ãÆ ¤ôœåÉ¡í¹»â½ÃÑ{FäͲ}æþ…ø´ÿ¸\ÞÖÇyºuYh`~JÒkºæb¾ î3'ƒ¾Ôû³Ä¢ê ú¨ý+Ñó_2,}ë©¢âê¹"´¡ÕðZÜzA(S’ÈR,å©Ø9nžøÛˆjmf¢*O";y G™é3ÿb±:5M]D(klÚÚN"&þÐ=ÇÑÐ¥ÜV?^àp±ì(ý ÅìÒØl]õ®zAdïjј÷9Ç cì…òç¯ +zä4ŒÇ>Ö5X9)õc•óê ‰ªþóø‹½Úc7iã[u•³Ox§OÜ_ŒqÜüO…#D=ñDQQ!Q—‚ž¯ÓW.$"¤ÂÕׇ¢'¢'¶ –¨×Fò$çýÙÞñ(¢_Ç}…@€é_9z#Ay`ß“Jaš’Ÿï¼iê%²8!µ p;Tð°"šÒ]pƽ[uavÌ/:Ü3À 5}/Þ+² Iwaû¤uÔUIDÊ£ ï´Ùy÷;ue¸ btÊ»xf¦¹\Éêc«Å³\·úHjãñÐFÿÒ¥Â1É=θóqß­îòÓc ·ÿlvé£ì6ÐýÑ!¿BµQãDD;@tr aÁšÐ¦²©ÚùõÁæ#"¸[”ñ˜©§EbÙ7‘¯à1Äcè¾¼QEÿâBD KZ.>Š¢¿Ì¼_YÐøãR+<¿ÚÚ½{¨çC‰äK× ˆMú.ÏþÍvÖda3¯«T¿_‘w)f95ûj²…€\š¬tÒ¤VÃÌ3`·Ð €ˆZÛõUv*Iô´¥¹U ´d¾½×Ï;[Èw¶‘$”$"Æf¬Ú¡gmÅvˆªöž¸8£-°µõÁíI»mŽâ›R„³‰KÍ#Å[Š#ïMAÿQ†Â"^Œ´ÅÓ_ æ58€_ç© ±ÕtÏ>'‘ˆÖv ¹ÁJ€Èóѧ"àêAƒotOÖpù†qéæI.Eõ‡­6ÜöŽîÔøÒaô¶Þpª¸Š¶Âó0QPL8.½§ÓQBÎÑŸ2®?Z8¶ž3mHD¿D¾Ò>ü³ÊQ½ëO‹»'Ư8ßjØÝã 5ïûÂè‡ Òž5= aÊ¢RúXŒ{ƒóÓŒJÐS^Uºy¤”’Øð(ø–艈ÔWáˆ}6ÑÑpKN4ÃŽ>Øv­T]ím¾|J.œe”~5y†Ä¯‹aùÆ°¦–á?ÅÛ€ý†ù_¥ó1ø¹¸€Hµ7aÛ2]µbÐΰF#öQ~ñåíÉ>•%&WɶÜdþ¹c\ºy"¹ØD_pö¾`BǨŒÞ“+Êbï³–Kú‹´ÙW9Ol+ûIs{Ú)ˆ.Ç ú(¯íŽ¯@‰¾ÄBT9ê I¡@­,4 Äcœ@ÒH ê óïñî k³&Iq'^ÞóôÖVBD(mã×ú•—Æš‹`ÕåžS{Ývx$jÅ“Z.u3•=¶"í²—Þh¶ÝÜ;¦ÇeÃÒOúý®HXõÚ.mm·ëŽ7 ¨Ôái`öº¹ |z«¥/™ˆ©²!òþ¨ù­¯u™@¶–½5gh„B€¹Vf?å%ó¯ã¦â'~…»u8s¶ó@WDoyó  %U­­¢xµ²©‰ €Dd^QOÀÊ ! «B¬ûÞ·+˜i'°Y( C(Cv&¶"Yž¾ò‚º‡Z°3±ŒŠqšä¬t'r'ÅÀ üßyr[/ ö’·ù¤î‘¶èCበöà²M€ A,’÷aU_éí%†ùvQ8qÑ "E<>¨0A³š. ËÚ×ã¦Z5=j#ªšÛ+²æ‹ »ÅR–{¬³Èh?ÔÕÜ<µ8“?ŒãæIÕ. k±¹Ô F?øÄ!ÅéÔœŠrÐXb’£U¾Â:AUý+L„¨_qÎü'Ùš²1^6/Ûߺyœ"¡ü›OºÃ¥ÂL[Û ¶v!y‰ óŽ—»væÛ’ãG´}CŽ@&CºAþ/…OÌuY¨¥O¿]ƒÓ¿têl'ýkâÎô¬m†ÔŸ ááŽxö›§vNþeÞNo"šL4™hÑ4!#gÇYÍ‹ÎêʦÞÏ:Öõ•G‹QXjû9| wª¡¡¦3ýÔzT,áÏ㶛'Z>`Ib¸áöÝÔ·$¾*Ûn?€#­ïFHƬl»É**x@DÁ÷Ým‚?¨~åW!¶ñ!Ø”“GD9Ù›àE¶N ]˜üRhˆ(2é}ðrˆBo:C@ùÕÛÊŠöÂ!Ë›UA·DM3ª†fvö†…š'½ ßPè•ših- Ï:™ ÖVo» „/ÓïnŸ‰í'?U~yæôŒ.¿0¼ì¾È­¯lïvzÁ0”O–y2M£'¢ˆ”·LN½Um%ª{97*Ûu>¹6Ž¢µ\|¢éæÔËDô0û½òµyÖ >JÍÙU~·âopŒ§ñ9.‰ DDTêâ fTŸD¡½¬O»[Þܬ/^>Ž¢õ ±E@ï@Ež¡87/ì‡Ö·#+B/Ëb/lÉUi'{ôî—Eë)âþð«õNzGo8^œKÄÐf<"üÉE¡G* DTÑQã°ÚÊ…knc©6ª¨j&£j+©>¯Ñk?¶Î§l¹ñ <ë~Ùéا6XÓ#±†Y*«o  VM²TóôC wz|h(hߘ,špÕyD«Gž­ù ú×Ûè~í • EøÄö¬©É_Iõõ?©áŸ¾åÕnœ(uØlƒOxd/óØâ#—C}ÒVì·u^@¥ƒÏ.ûa¸Â yü&«_øTú¿Û…¸Ë4k¯vÊaÃ8nc¬Nˆx0Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ cŒã†1Æ8nc7Œ1ŽÆã¸aŒqÜ0ÆÇ cŒã†1ÆqÃc7Œ1ŽÆã¸aŒqÜ0Æ8ncŒã†1ÆqÃc7Œ1ŽÆÇ cŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆÇ cŒqÜ0Æ8nc7Œ1ÆqÃã¸aŒ1ŽÆÇ cŒã†1Æ8nc7Œ1ÆqÃã¸aŒqÜ0ÆÇ c¬žÇ Ñ߱ϫ0ÆêžäùŸªÕBÿþ •ÖáÖi4àé ­[óqb¬~ÇMq1\»Vç òqb¬~W¦cŒã†1ÆqÃã¸ùG"@äƒÄØ‹AòOÞ8HNJʺzÕx¡™™Y§NøÈ1ÆqSËŠ‹‹³²²ªÊ;DNNN|Ø㸩‹¢Q}Šø¬?Æþµ¸©ø¿È½é\ÈCKRÍÊCRbBnÄò~cŒãæY”¬{ÑÖµŸàSJ`4ÄíÍDˆ½àx-›wcÿÂÊÔÿk=®àfP¸}ÏiÚ·VzÙõ jË” eˆ$–6ÖR$EVˆe…E2+ëonꃆ”*ŠTŠ$VV21€ Ë-TÚÛZê M-­ÍdbÞ͌㆜òÞÙ±Ï綺íï)´ã­¤€ÊèCƒßÚÖ¶gIÚÕTudz§¿?´ç²=÷ì÷X8ÿÂÖ×Ï[õÓ²®Ñ¿Ïž·;vШ±9!W ›ž þÙ¾øÎÐq«ßqQŠÏÁ»Þø—ø\÷u’<­ÜÄÇM½¨JAÙíŽivFö”J´ƒM´ßF~Ö«lÚ°Õc×Æ6(]4rì‘$zoFÿ„Î_2ß¼¢\¤W¤Íý5~ÿéó-Í%+?Ÿ7òÛŸÎ>ÕJòšl¼øº#L¹|«×Í;yN]ìx_³z‚Ûnž6x列å Q®®ûîõ€åÕ£ïj\{7%"³ïO{´•?è¦Ì‹ËÌMņÅÝZuŒN½ b$™ÍÇòKdÒ2µ†w5ãÒM}‡>^~Ù‰7·#†4‘ÈÄqÙ*׆: ’ˆði}U‚  !€L,Vë´€hx®>1.Ý0C´ènÿéâr3òz¹K:Z¯9p  i+'ͽ˜"$B¤€ï¾ðJ,3Œ¶0^™Uk^¡F@"ˆËLj×°9èù¤!Æqêm~Þs²Ïã-Œzlœ—¹gÍCLŸñúî C/<¸ýã}¡ýšÉÁ²‘‰öÁé³çÓ•åq#³o3µ­|Ö'?^‹¼uÎkçÂÓǧ ã¸a)S V3ÜÇW]º”º×!)© ÷ŒuWO<ç}8$Nð h(°±ô½þç|üóÊÀ©mÏN-­$KvÌí$üã÷ »ÂÑà3/;H,ôu«¼ú¡kÞmLx_³zôCþüÃrsÁÁ¡®·/zîÜä±cÚD'''777>rŒqé†1Æ8nc7Œ1Ž›ÿ†/µÇûŸý…Óüll C‡Gæ™BT ‚PkY¨Õfs«0c7 ÃíÛÕ–…_º¤,)©­#DIY$Æê}ÜÔT“••‰5µ:ˆëkŒ½(¸©˜1ÆqÃãÊÔÓñÕËcGÜ ¢T*­ÓÄÑëõ|Øû7ÂZŒ""¢gí'"|–ö`‘H„ÎëwqÃcO++ð.`ŒqÜ0Æ8ncŒã†1ÆqÃã¸aŒ1ŽÆØ‹ä/U_(U/·P Å¢ÊÿTìh±T,ÂêO‡êcŒã†UåΕcÛG0~ü˜þƒ&üšŽDPí3mô࡯¼:¨_ÿy~EDLÞ5²g÷Ñã&zÌÿ2¯¼™ KâügŽðêø ýz Yó{"âÃs-zN>õõÌ~CG*ô>ì…%á]P#±„®ŸË—ë wujùß/ØxæÀÅ0SÐe„õŸ›³brŸÃƧ·oÇgó¯ï¾õ6x{~¹ir}¿Œj3wlCe© Ä6CN˜üO¯Þ½û šÐoñîw‡8éKJJ¹GŠ½ðžÍÜÜR‡-†•ÔÙæÑܹÍÆŽmXy_'''77·:Ý)D€U}D÷ §×à#ï—ˆ ¦øïcz|†b"2\:ÈèU{1qÛMM\þ­Çj÷k •§MVŽðß]µ„³†qeŠ1Æ8nc7Œ1ö˜Zi»áNÆXÇL&17—/Ñjuµ8ÂY«D"n@e¬Þǽ½YQÑJãî±XTZª¬­#™Œ«{Œqé@.¯þt©¥RÆX 8c7Œ1Ž›ÿ_Ègß2öïT˃ÌÌÌ´ZmÝm.U\3˜1öo++Ôb¿õããc¬Nâ†1Æž‚›Šc7Œ1ŽÆã¸aŒqÜ0Æ8nx0Æþéqó÷ô s?=c/Œç?«§_Ÿ.ÉënãÔ‚ú·î¿I‘O#f¬~ÇM®:wÊþ:.Û@/Û^ [/äãÄX½Ž¬i.¥ZÆØ ƒ›Šc7Œ1ŽÆ{ÿôI{ EVV–ñ™LÆWº`Œã¦V!$%%…§„W. ¢FõîÝ›c7µ8ˆ"QUO‰äïØæÜô¤ETœd(11kÒ¼¹™ø‰qTú0&:µsª­ (¿V –å%$•Ø»4·æã¸yùÿ¸é·[y]š7ÖzujrÊÇ"ß‹þNæâ/Äý1y…öîéÕµ˜³ÿýÊG§¤ûråÕ©^[†ðqa7/$jÚ×}ûÇoV4à³q×xF~·› èE"D ˆ°ÚTŸDT>ö ²¡‰¨üÿ•™‚ˆD$‰‰žIÑiRZOÚuܽ|$TñT@"A ¡aµ†Å@BµW©Ë¤㸩µ‚õk.ºRëßíg>îÈGîMàþŸ³®Ì¹ôãðªGçÇŒ3Ú¼ÜÙ2;üNÖ®ãÈ*¿éˆp{ïÂù?^w<2ãjh’Eß³Þ_Xd†vycû”æE&}§]=’Ô"àü/'·~Ud¢üaÓ–±ó—7ð›:ûÂÛ!»F†m÷áÁ¶}FȲ¢oå[9µß $äƒavo¦¼4jtŸ ãXvŸýóÚ/?uùÁN=–%]‹I·9r¼¥Œó†qÜüS‰$²ª;yßD)fïèhô½­ÞC¶gý‚&7ï^>R½¹ÏþùʱEå0]Á½wvÞ=pöJs€¥oÜuô懋2œ×^|»æÏžùê ¯«)3Lýê-K>Yî€0w½çâ~“ÝÀ‰/&,]ðç‘3ÅR)FÙÐP ³zZºÎ;kgÜðûð«\®; Ø›ò1e7ÿÐ2Mܱ­Ý~"©\lÞâƒÕ?{tnøßž¥ ¾gõV¦§§'ˆôͤ|r´‹™"ä=Œ1±²ncŽD€½Z¸OˆƒÁMô&^k#p³µ<?gf'á‘ö¡»9ùB×—žÛ¡ï¸Üía3@×d´HjgE*¥`Ìì1SLPŒñÚÄI}†Œ4 ­ç“ØÿóO8ï‚'µÝ¸LúðfDDDDDðîbÒ»pÅÊÖªPªö,­J+67)ß«‚¤Ù’sÌŒ£×©E(3<‘Ìdb¥F –V¥äRTiõ5l‘ Ö R±¸ü¹‰‰^PUüjHñÑ­q™ø¹ÿ/«»9Á¯«§õ5-:K‡È#ÐÇÍ?• ÓYuò˜â”9mmÚfÅ(èu†ñ£i·³}’M禹ó0)S¦xxxLq;i’•¤ê{neÓ\¥.Ò Äfg¿ÔÈ@UÞ]ˆbòË:;YÁãú‘´´0/Í+О›—e)o[‘Õ›•žâØþe·í>vþÖš}'øå†qÜüó+UH ^üÇÞ¢Ó«Ï$( m‹v×¼²srã¯~/­ö]ŸüÁ¼Ó[ß¾zçÞƒø;?.5n¹—Ñ÷œ,š¹µRÍùÎ?!)éö…ý~×óÞ?’ÈtÛæ}ÿ )æòá륯um2KS]ÎÅ›ñ)…BE¤XMìÕqí—?ÜKJŽ Z¿9hÂG+jÜd1hÖMøÉþà¸{ ñ±QW<|©UK_ϸíæÊÆÁ±‰™uE…‰@ÒlûŒ^Ÿ~¶cÀþ•SWí(\ýÑüy »Ž™s`ÍÈ9ÇÅ€rûÖÍtÐaä"_Ç–ŸmY¯‘ôž°.È£¿Ñä¢H`ºùÄùƒß¬^õñŸVήƒÏ9›dƒVâôóöIŸ¾ÿq–ÖúKŸà2€®k>úÓæuêÕ¿÷¶vnáhï}}ÀåÐö Ÿ,G«¦+‡ökm"³Æ-›ÚVO‹Ö-› Ûzå×ÍŸ­õK¹Ç¦cº5æŽpöÿÿÛýÜWçÌUç:œt¨ëëÝÌÏ+[UÁ'''77·ê d…vx퇈ˇåüyd\™bŒ1®L½ì{‡ú¹šð~`7¬Î‰eöv2Þ Œ+SŒ1Æqë'•)’ ÄRji¼P«ÓÖâéÔèAω±ú7&ûÜö‰±êú/"‘(*:ª¬¬ìIOA@z–4@%U ¥|œ«×qSœ§T[bkS*ªÍtà¬aì…Ám7Œ1ŽÆÇ cŒ=‡Z>ÍO¯×ëõuØ—DDZ­–cÿFÏ?D³Æ,Ðëõ*•ê^ŸyLMMÅb1OkÇX½ŽÆ{ n»aŒqÜ0Æ8ncŒã†1ÆqÃã¸á]Àã¸aŒqÜ0Æسû?é*Ȥ¬†KIEND®B`‚suricata-3.2.1/doc/userguide/rules/intro/Source-port.png0000644000000000000000000011626013051004444020176 00000000000000‰PNG  IHDRzŸx<…BsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ :9®i† IDATxÚì=e@ÔÍÓ³”€ˆv‹M*Ý%" ŠX¨`w+vw·ØÝØbcc €€t\ÁÕoÞG¨Ïó÷yß›/p¿Í™ÝÙ!ˆ*P Tð*P TìF*PŠÝ¨@*PŠÝ¨@*P±¨@*v£¨@*v£¨@ÅnT ¨@ÅnT üßb7U†Èÿu‹d™æk{TóŸÌ_ù>K¾È”®¿L&È×JÛÿS,ÿבZ!=kÿù5ÂÊi‹J?Ë—,Åe»ñ{£)›A¾e}úOÊwð_Uño-ð¿Œ,ùk,ƒÿ`R§¹Í²nOþû³˜Ÿ™ò ¸™»e›¿°Þ]Þ=}Ù®ž@$5ëé¶rãÚî8Á{»\y?¾S '-êcl:îvŽoK@ŠõmåÒg¯ÜãŠi4-C¿Èé“ãté$Ó¥ƒ'áÿÍý‰5´§ÒwX†n²é짎GŒXx*…Q‡xŒ{Ïž5d*dÙ¼¾]z¥Ú<¿·‡†H€8›}Žå„µ)ìÓÞ>G[ƒNHMn¿åw‚^÷ˆ=¨®FC!tžÏRÒÉ¿—“ B€Ô“þüĆYk•T Å"QÛ^¾kÖ/k§SìÓÞöG]D´½=\°b°Ûó–Ã/Œ’TZüd³sÜ…»/¯D;Yþ䈀†ˆ„€HÄ\“òܶè¨cÈRé¹JñySŽ¼‰1çôioŸßH—A„<¶Q7§)‹WzvÖøêÔÁÇ hêé5늈Jz[:Ý|ö¶‘ZU¦ö¼PfùöÞ>º7éÕ»Ù†+‹í~I”ƒ‚v¿äž~x³›NÕðêo|}ÈËíÚ 6wYnó(ŸÅ.¶½Ê¥P”üŠ¡”%½ ¤Ç¢x~VV¯JJ´¶zªþ/rãOw²z"ÄW+|ã®!â‚È€É>(G¶ÂÛºç÷Ê_­†j ý”%æl˜eië1âS _Âîf0Y¶ë‚·U I9E·Ïu°µu´³ž¸*¿’ âw;›;Œ»|i€§ƒ­óîi¤VF#YgŒ=”’¼gjؔՄðO¬lÓ»w/+§MgŸ#!ÉSÚø¯?±qšŸ·§½“ïÙç¹DzÄ|>_·¹.ðEXÉæyÆ­8·q}âäC‹Å&AfÐ|Ñh6{Ó™‚;‡n~¡P;$ªÕú ¯ dŸÌ"õukj¤DEµ*£mìÞÝÏ—GgrÄD®W•\¥ÝäUòÅ Z@€¢àÞB`ê. Ä@èN„Ý !9Þ$€„1¢¬³‚Ý‹lý]zðš'V$E óA¬gÀ…<¿ßôM'ÖŒ‘š/‡!I«-›fnŸ_p`rÿa‹‚Z¬%_ ¤’+ª[ŽRJDi^íÿ‘óÚèåýÈ㿲Áìå¶LO@BdúKìÞ}ÎÓßÛ/,2yÏZåˆ×b¯ñ‰†Ï7î}Z*7|D(7~µ ˆx„Ë¥dRļ½‹l­mí¬¬‡ÌÚÊ!dnŒéÒý÷¦ôtsö0­áòhk‡iÉ‘Š2Þßxå…Œ ¼KSÊ;2iÄB†vß}üê¨þ¡¶¶ãןÏ}v¬¨Ÿ}/›íw2 !Ë6Ldggogc7w!$ûÙI/+SG'SûyšK-$„޹ɆG<F7óî† hÜÙ´gsÍ*„*+”ÏyáÉ!« ¿I{B õਠß_<>C|\ém@Ç°Å•kï<}ig'­¹,xðø1\™á7*éù¾Át-mCöÝç7/\™œ¯Ö^Ã}Ü“›Wq9l=`éðyÇÏdûh_Âþ7­Rž=ùº8v¶¼á®«g˜³GÛûÉ¥1•Ÿ¯ô2ÞãÁ íÚ>u³ìIˆžâ¥ÏÑç°P­©.TÊr22èUm¨«•‰ª©ðäÜãAw«§!àÙ¥ËÁgïFzöBQ¥­ç­c7À¸½ üÁRºSb£Œ5í ¸åù9?øâªÉGSoÔÂHG9QÄè¸2¬]ÿ)Gïo¦Õ%fiîÏ,¡°æ‹A³ZÌ_ÉÜ Àžx›gâaîp0 †(] ¨8ûúÀìXœn}_ÁêàóßÂîð3 i¿òšõ78Y‰“ç.›Ö'aΨ0gC=íZ6§eÙ©'tè|~eC6›¨hV#’›%ªahд¥–0°_Õÿz¸S ßÝì‰ð«%¢ìY5ÇF¤i¶nÙDò‹&E;ΗS?9 ›6QB Úôb´fèÆ—{ÆX`svá•ï'Nqê¦eP4wÜ„Ž¿\ òç žÖ’…c<çΈ¾ºMM&©(/ç]\­6ÒÔ5j¢§ñË”õhíå?y Ë"}gž·ÛfªÓ¤Å…+Wï= 'â¬âV8¹bÇR·1¥—FL¬[~X\ h[}ÖE@ÑÒ/cv¯”PEנʼnÇ?®> ­múOd­9zúp:º ðèÆ»ÅñWzôÈέ²|Ÿý¢pÝà‘\yíkiÆžeѵÔêS¶$vU¤ \·!pÉèêžW”üÌþ!¤ª¬ÖÀ ic­¿vTcüvNáÙ¤·–KvIýâÆžG%Š@‘K_Ýx³Wb AŸyS–XLÌân PIï:ØÍ@»¥¹ˆ{ô“pbWf /S( gw';oùH—ï<QòÔ]:i€†±m·²™çs¡óZùaíËOÎïX¶ùiñ¬¾;[ŽíÕÁÛËÇ?¦× 3U’æ*óX4Ã6¤çhcÀdç³êµ³³-w±üõE‰óî-:™xoTÍ4&ù/® ™\û»åÀs[ûÕO5ëiG›÷±¹ðÎ+¨G“ÚÓ/ÎÎq…V£îNßx̾]Ã_K˜)%À)v¸œ‚Ãw *@Ä…ÛIÀx~®¾6€S0@l R a€OW¨ÑÏ ÖYý’5[ÏݼoÀµ­ÓÜ<“>;Ö°&aï™›ÉG7¬ÞŹ=&h±VÛ½‡÷uk „æ¼.…ÈäµGœ;5’¬x;¿¬]“»ùMßXêˆecG'Ô®g5ók§0èLÜ6$ä€Ïúɦ ßq¼­fµ$0tùŽí“2⯷–Â'ýÀŠ,ÓÐmŠ—pÉê—{'›ÿ¹Ò œ†>sdôÊÛ;¦¸I'¼Þ³päZ Öf‹Æõú¥†¬µÓ¬ƒ½X?¾¦•pù›3n(€0Jàå €¤‡G'î­4¢b¬C.}-ÐÍàÞö“݇h,­lU<3&¶T«Ñr…ù¸ h6m.d ㊨ޕÆàD ßLÿçñ3Ÿ†Ø´ÒÓ š¼' øË5&¾†]nh±ßR¢}²r÷©Ã¥~¤X?â<£Z{,nã0}Ót§;»É*£[¨!ШM5(JS§1d”2z5ÕD0šh2K9|lÐX§Z§f¤Ke—‰äJ¼¬rõžú€jV@½VÕ»†ZcmA  yõFXÆ I}Ê Þfž¹.*fÔ«ëÛI膳£:Ôì‰Å¡–’³S‡¦´o²À¶ÎV÷>·²i§Æ’£ n–çŒ9Ç|VZ?.ÓcÞ“’ö[9E™?ôOI|t]ŒUôx×—‡jÅt! Þu>ªÙVDôhïy ßtd–ŽYEÕõ²€&°ÞÆ¿1ç8Ðt<0¥«J˜;{“ f«°‹ûF€bÎö¹ñ{“Ó{ùŽÔ•ârÁÞ%rì{É­§Ñ¼=½ÌôÔKó(Äì9 [#iµ6½IÏý“» O¼~|lM©5—_5©ø;è Truò>­†É‡þÚ :oåv§É¯&Ôa7vS7/rkû‡£G¾ß\½ðVÿá Ý[ê³*©ÖÏPÓ’ DM2±WO1w™{jÀÉG?‹Z¹¤F±iȨùL¦ZUq¤i«!P}nÅNÃ7iŸ4ePp)W ÕÂñıå‚Ê2&½QM¯˜Zj¿ä¹æq‹×öµø_„3[5ÿ(à@øù6Gnҳ8¡2›+h¬£@8…åÕ»Qf)½Cc…A (‘@(¦€”dTy¹,Öµ„",¹žNªµ*]¢ s2³ >͸mThÚ•Dêr\x'íC?[Ë¥OgÛ˜ìG³®&¶ˆ]©ö/Ðú#½k|ßì¹'Ÿk0ÿ^uëà=/‡âplù¯/ Ã×r`÷c ÎΔIlo}ûúµk×®ŸÝ5 Td=Žòõ´vì§øøÑÃ}‰15êB0ûÖž• %[%â[ÇÓûþ¡ÔêaŒÇ—%”ZŸàÑõäž‘‹"Å §_ùm ÄÉÙ}#· ΫR×РGè¢&Y—7}¬>4—\xöZ}ûñS;wíÚµk×±£{›e~Úÿã¯^êYlë4kØL-MÆß› +g Ütmô€PW—¤¾Úô¼–6ËÛ‘“}ó Û׳£Ö‘6h Ñíý9»ºÇœ¿š|ïÁ£8ËŸ vj©ë Å¥5¥\ÁÿN»fð€î/–Î@`êÉïtš ¿aDL~µz¬„Ï&M^ÉðßJ @?o8þ ø¹/?jéDuªËǯ` ÷¹¿f2¨ðuwNÎå€â”³Ï  ïÑ¥Œ¦]‚¤n0 ;é\ž=ði>¥F§15µ^ßWÞ±Ckà×3sz‡Nê^ôÈ?|ÂÏJ,ûìSl:¡ŸUÓÚKMýΣšþ¶)sEL{ÙUDgü¶mHSƒû7¤¯÷¤¼v}25þ¸"0hp÷d¾ßïÏ[¨ÛffÐ ÞÀÌ@fzYt"ú>`ÉõeI§?ºaÛ^N¢&†´ÎNë÷‰L¨i©ßݶonÑøÀTWÐòÏÛ[^cn[‡ˆ†¦Q£;ù?‡„Ô‹!©—D ·‰ï¤>0ñ¢´œD€¦»ýÔ¢# ‘b €½³“ZÆMh­ô€a0m’Éñik%̈¡¦®ØÄFùðYöÒ9ãòê/ŒÚ-DMý‡˜­uEß>ä\;›[Æ-ªPÂ4@³¯qÓ±CDNèK¯{¥14õ)*GùU‹„,Œ ]|î½D:UW£ºFÃf]¹Åŷ˼Ù÷“'©[|ï©/ÅbÅ<‚©öçÈþ½Ã"˜ Üö!μ—UÓN6»—yÛO(E~bÉ°u𜻌µÎÍÞ†'¦Û„»Û}:gPh󪣦Ž®®Œé©¡£­%#­¹ñ K­¡n¨~m¡&Uš7Iΰ míjƒ®ª§ª³IrI†#N¤$´à¦òï¬vàEPwM™:%z“[«¦þè³d¸K¹T¨@%ÝÈm絫GP@*xu®ÚQ\ëÝK3ê5µ§æ¡“`ÉäùÂgo[0T²|uóºxî`Ñõ…Ÿ¸"Bjëå ŵ‡+Ìšv+>1ÖÁ¨á‘™5ë›/Ô_¸.~]|왧B†YO)þòåêB;×!"AÑþE£ìlœûô»õ¡ VÍNÃCÑæA>ÖxåŽ ³Øz-CæòGÄ—øh`ƒ.a=Û5(Î+Bàé‰UîöVvvγ·_!y·$lÞÝœ}³†¯<¡â5*P±› " \üDu²l @¥¥} ÷ô¨2Â&ˆ íVv Ѻû%Š‹¨,þð†¡Ú’9{¾ÇÁ¹;jM¬)~ÛÞ‘}Õ^ÛþGk–©¦.mýóåáØÕ/““1 ™äïýÐ(úÁ£”»–lŽq=žVÅ4‘¢…­ZQ|b2_ ˆ÷Ÿ}jÚ§­Üa©êî3ÿÑÖ‡é-=]ZÀ½ý“çœþyëáÓ‡o5º‘°èI™§\Úi^´ïÄ”¾ª §Õaêo)üœÿ•B@Jðýû÷¢ÊöwüÚ±8ØÈPGʃÐL[ÀÉÏ…àc¨Pˆzºa²®Ó&ÓÉ轟}›eß¾ê|$±9É&8¾pèµ&©Ÿ¬œûÁ“]ºyND™/KY'bmÔ:ÆDº]?w¦_—p ÃÑ0rjL%>(¬poª™²a_»£Œ@Æ–Å:F@DŠ·aó[Ñ@p~Ïe÷U¯‘ÆØÍÓN-ãÎ>S»J´QŠÝüm™F¿½Õü9Cùɸ8mf¦UʽeL‚úº HyšëH-4êÃO0ìd ¸¦Š¼W¸\.Ïžu ¢7\w>Å~¼{MººaÏ=q-¢£Ö\?2êO{©!H šdØÎË@"Òñ"]ÍßѦŠ—‰¥ŒJhêkãÚ H¼á¾5p÷£·ÃWo”1¸B ‘IÆ3€ ÷N‹ _Ê91Ãã{‘ºu«*Ÿ:ºN:ù)«¦™ Tð¯;LÑ54iÖ¢EóæööêÝÝúJò| ݸS§“7ï©y­PPzOëؘ›þdç™÷Uˆ1²ßœPÓë:y`¿ˆˆˆˆ~áË–ÌÞ»2K,}Xó뵿?”)þS=ˆo<{µgÑ…±»ß0 @$ºú(EÏž¿¼ºv¢tþöÑ«ÔR—³Ë¦–»ÚwÔB9Ù©ªž:3Ì£Û››©ºMuøy% yºùEÕ¡Šv¡üËu7„¡kNu$!¼D€€0kñ”œƒsçl½ É *x;j@xcçñݵ ˜_w.ˆS›7ovìì Ü=wwÏÑË{ôìibbbbbÒÙ¼_¯Îœ«·¿H7t‡&l[©È1ŒÐ”Z!‹Õ Œõõçï?ðdÓÈ;ejš2éÛn|“¤nŸ;,éNŽ43F3w#æ¬øùÓbÕåBLMõê^‰×LébÓ€áf‘¼m³$÷©«™cЀðÿ bW¨@ÿ,vC±Ù,éE#äó8<~µôÚÝbú¶+»GDŒìÏœÝEK;aÞ£kÏ=œ¢ç™Ï:·¤/„ÖÑ Æxtêѹ{oŽI¼¡fì/w÷ç7^Ôk.ªFzš¯Üx€Î)g׸ÿ6èÕ*·¤ŒEÕ]¼b!?ëÍU“jèÙ­ë7ð8,”³y f`rreH‚gp¹ŽœÞ”·”“›‡£­Ý{uçp— ªäp+Dg,‹zžVeÛYΆylÖ¶`KKKKKK‹fv%-½vÍŽADÿq›5_:8{xº:_Õð¼°Êô÷±Ù6&ÌÊ>ÕÍ” þ?Ã:1HYžH4R6)rÆ)ˆ e´"_WUˆ\=Òyªê¬®ZºR­)l¨ö‚ZóB¥v7’÷w«º„”\Ÿt²ëƒý•“dPíJaŠ[T þ_ÁªŠåÔsÙÍ4)Í®òí6æt‘$üÌû«»£üÝíìì<ü"ÞM«©  €eggç³ü!ä¯Í|Bȧ¤áÞ3.#!€HÈ.6YÜuñ6QRäÙ©eö½,¦®9ÛÃÊŸ÷Ð! ~òQ£ IDAT¢XL¡2é¸"ßÒÚ¥ª£•"„ì˜æ:uç{Rþ©‡•WáèÞ6îUñ‡(B¢¬¯¼-–¾NôPµ˜ÿï°›ªÜ„ë/ÆêõKF xê™5£º+›!tšÒVVì¾ncø[MÓhÕ^´ˆ]7oß¾}ûöí;÷nû4xáá]PµïUζºàê¬ígnݺ½y¢÷ì¾ñ{ƒÌUÅ‹ñ˜xæ†>³ƒ: Ñà­iÞ±›¾l:véÎ;—-¸º(zæÖÛ5¯<–¾ÝJkÀ=7¹L èIü_Éc’”η[¿Y¶õUРº–.€–ž–Ncm%…Ø—%9üté „öŸ0D"îWgïyT½C£`Ô%dÔíøðæq%!åHÿ›“°n1$ÀÎ|Ø'bí¿]ˆûcꯕR±›jò50òéE^%Þ-’Ù“®o¹èàg }9iW†G„¹þ…%S>7ekHøp鉻tÚÀ˯ŠàÜê¨eçrέ™äë0w[ý‡:SM]]]]]É`†'î5c¾¼“Ê#„¼¿ºå†¨ÃíäC=[èj¨«·² ¼uf‰aIfeÝý1çñš\C_wÃú"R%Úûˆ;ió¼Æ 4˜jL5=ã-IgGGZUO#ÁÒ‰gb—N쮉¾ƒ¢Wœ+‹ž9‡o¦êˆ—Э8<2¶TZ4ÂРkеu 'çE`DŒŒÿì¨Luý}ãýçíÿJ¤¸Ù‘µ3ƒú û"‡ Àíåû˜ ˆ âæ÷}ã€3ÔÏ;C,œärôu¥d°ØŸ®ÇEöÛvåcÍùÙK& ñ÷÷=÷ „eýÆ@åÃ@ï€R!À±µ3BüûöqçSyÍZ¢‰³'ƆFŸWT§ÇœÌð ’Hag·&†G >ó2·fú +3FF…ôxõ› ªåi³FFûùÍÞr^‚   oòÐ~‘—¾ dxïÛã¸üÂ+AÁQb „YGìëï4sÃJé,Bxyq{TX``hĦ3)5óíøºÙÁFÎÌáQ€YWÜ.Éy‘ä5ò`‚ÏÄ35ÕMâáe|I>0 , $|ÐÙçùUKàÁ¼€Ùw/lœÒgÌ Ø×eû#¶Š×T†òÞ&¹$ŠJ_ØÙºVˆ‘ÂÌÓÜgïGÄã‰#פ"";ý¸moï÷éYÙ™|œ¬.¤æcúacÇ1bÉÇ‹öžÙuÞwi{è~"ž\äè;èuvQyiáÆë¨mŸê6.œäÔyå#"§¿YïM_DR/ŧ{÷ìrõ"âÞ!–<ªó½‚éù3-V½H~ŒõZ~ó£ôó«ýº=]ˆH]™èâäÛïú«l™÷ó)D^þkkgbÉõ‰–ÁëÄŠÈUQøÄ!t£ø7‚D{;^üXˆH  Q$ˆ)¬(þ¶dÕ&™î+Ùéá榧¾”³rR{Xp‘O õˆY{97?ÿç×»^½Ì/ŽSgÏAÄâÝ££ã.ä!"fìêá¹Q¼ùüG™DÌ}yÀÎÑ'-+÷gNædo»ÑÇ>"bBÓ-×Þçåå}zx´‹e@%búEönSò ‹Åˆ‹†ô¸ø`^^^ÎÇÝp‘âåõ¶¶÷žž•“ýåŽGoó;_9ˆ¸cºÛ´ï°,ÍÄÆ—‹ø81Àwî™ìŸy¹9é‘n¦çcÁmKÇa×gçæ~|tÄÖÖ•-#ÿ¥»™ùùgéùùù‡‡ùŽ[ƒˆ(, ±·^tå}^ÞÏ»[âìz]ySTKB‘èé©©^¡ ‹ŠJ°ð²½¹õƒ™ùùyû§t‹ß¤Œð™GgÚÆ,ÊÎËËûùcå0‡a›Þ ÅŸà:hýõܼüÌÔÓNVïJs/˜X¹O^t8'7ÿç³õÎ}ÆPE!…ì›6=|rÅx{çL—ˆñYyù?3Þ ´6[þ˜K!òŸNµq ÛsåYv^¢øøêù·>W  þ(ƒ„;Ñõ,æ{h÷Ÿ}þúª`y‘àôœ•§œïÖ¾)ìܾ“§¯@ •%¯ÂF¬Ùröz uTl|B¨Žf¾&-ôHä`“ƒ{S¨Æ4%BÁ“ëzD¥Ïî\k’ا%PY¼fÆ ‰+,É\+HTCEÁu®Þ™žL¨?:ïÕ×ÕOîZà3±R«Sç®vþ3F‡Ñ !©ûgé[Nf6òL4HtI+ŒïfÀ¨nE|+iGz%]Ä͆òì;v%öíÐXS2€~­tO¿ÉõëbÀd2€Î`¢†~»“dìÕµÓuôuuª}5Äü¬‡yœsñÞúLCÃ0î.^œà|éÆOøpt_Ôìõ{¦¥üÇ=Ú{ÓiðDZÌÔy’Á:š¸Âvî³Î­Ô`å©9VKøý’ʹb†f#####£ˆW÷ƒÔëi­ÒÀ@Ÿ0~ý‰Ú:  ]‚ÚŽ¾õ”ko ˆdâî¥íõ ¹K÷6Ÿ¾qî`+ƒh^F>½%Õ¢©$]~BcªA1… f¬Û ülÎ`æ‚Dæ€Í½Ú@ÿ¹ówtð &4ÏýðS]–w7@4µ©éÉ^uÏêôF:ê„¡Ù¸±ÞÙ‘+õb·Úwmˆ1 &nï1&U`¦(ØgQN¶FFF €IÛ“EH¯,~{›E{<ÖÀ($ÀìÀ¥{¯ºÛÐ\ƨYQÍ°a¿ Vd!†trgÅ®&ƒ&5£‰œµ'­•nÜ9"xÚâ)—ÑÏÖðˆHÂ'Ε9ü5»ÏG×;:ßøæÞU6Eø$ºvÓ—¬ó]L8 !ÎŒ‰fdgÒXyX¤4ôZIF„®Æ$(¬ç@lв]»&„ÐèÛÖ/s»mr9"B3У¿É)З²â•„C«e8".G¬®ÑTrè¯/f50\ûŽrí;ª¢,ÿý»×{Ö.üœwiCðÎ>R`Wrðà! ´FÚº›n¼ÛÒß¼¦¨¶^ã&”šˆÃ5–¡¡! X®üH…`ÒNcÏç"¹ƒVµj´Þ± *²u5èDâƒÞΠəâ¼NѽÓ7í¨ØuK¼!±Ó¡â„ ñ¸C©¹ý¢¥¦=7õãÛb·%tE\vY^%,Y¿rÎÜ°-Óµílí"†wê\'hßÃÃëæíK¶´íÝH[í3K³«DƒLcHÂÕ!@GýG‹Êå‡,xÛ™´iS»™-3µ´v ˆÜ( ýf !’§_…¬Ç3Ý.I &±Dœÿ$úprÕÔ€„óªk+ ŒOÒÅ=£šU‘Ù¦•VQz!˜µP Ò[L\·dNoS“6Ý{;ºLŠ ær²hâJ7·ªXà¼òÒ–]sÀŽFi7m@-ÑmùKo•¬õj¼ýé÷I›{äårµ7sÛF(1ŸUY¥t£ MÔ뎞Š×ü5vƒˆZû„zÅÍ>8´¡ŒR¥©6UP&P“^â_0|ãîýã†l¸2Ö±‰ò(¿§TCèàÜ‘Ž¶šï¼lˆõßÛ˜`æï|áÒHX]ã²@ˆ`ÒÅÐè0z¢¦%}3½€W«¼%œwùôNmõP,HOKëÐÍ4õŒ,í½zµåv8R œW—DÛu¥³y<¯ÇÍkW—ö?¨W…1Ý:°T=Ýp†Lû ‚þekcB×!À£(V…@G] zÙ³¦¤|Öj­ tŸFÂŒŠÒŒ\f·v ¥öX5u¡ÙîÛdB[xï»è-fçߺ|tÒ€¾gžÝÔ‘’QÖî<¹þÒk+C€Å)'kb6VR4 ¬ q#-uUk>}íÁé x›rgɼ„ µ¤±Vò#ŽF:йÿö=¡Æu$®&Eñ ZB "eÔ0Ô†,aõ\â±ùj:ŠçØ™ëbg··w®•Eß=ª!a6¼}ûR]©ìrM)ÒoÁÈ£VÇ÷Ò.tÄbÞø ÏÝ´]¡©¸Ëß¼™ª!dc×>Mßm¾ñ¡.»b„èþdý&I®…‘.c?µ:zZ˜mÙ»ìÀÔ¨o¢™a!!`è9#¨]Î¬× !ˆ`<žqkì–Ë\‰Šµ¢pcBPÒí,u)¡Š¡¥ÍäWæIä „±#ퟬZüòg…¤Æ‡G6¾nÐyœ9ƒ–ì»+ùCM°¹Ûé¶ï pbŦn1+†7xDb÷&Ÿ“_äË^ˆ£¸¢R:Þ»8ýýÛ’ „¼²÷i_k.VR¿óÛv–}ˆVfþÈù%¥è ºj¢èn— @ÝyùÄÑÌ@=°_‹u{Î5±@0 SÒ™]ló8# ò²2X|Pì~}Ùöª¯ç×~ü´©S7VÐuŒ¼"·rÒyUg6:_$bê6(|~ôR©–H@ „.fH–åãì —Îí䌛gO{W†j=m¼ü•åz6—9Ýs²ŸúG'¦>ºU÷ü‰‚J>ˆ|>]ãô–‘ý‡ºjÛ½èËצîcÆøuB€îÏ/uö4ó~×1>rëEI7ÆyÛ8ïùo­i?j›ñà!Vn—:7!™åÌÄû@]»ƒÖjGç6mZädv 䬶îêü!¾¾þ»O]ôóê1$Ø¿[SÊ!«G÷ž0/´Gë$¾˜8}œušÆúúšaÜ7Ì¡-ˆ…¡«ûIÂ\›Äú÷ÒjÑ•ÆÉ樵ß4×*oñù5Gfäó í&l«NëFtÖ¶öœ=ÇA În3Èy[³Îœ¬OÚ]ÃÂÆjÁO±¤c®Iš£»3ç\ûqljÉ]ÖÄ¥kcc':]ÙÒœÉ.¤µÚ|,–Jz‹ç„8´]ö~ºGC»ùÝ›)J>*°¢hÜrq¾1®)AÉÅîS¥<2´âþPõ„—†ÜGËÖQŠ)…¿•DÕ-ëé9…ˆXvÏÎ:¤T$œBÄ­}¨úC3S”’ÈìRª¥£VSu‚:Ë!HÉ£@ýnô纃.Ü[%)…Ý•ï’Ò0ÞøéøòmoDõŧ®/ú8%÷ó”)E)­§îHP˜~~ýú—BÕµ"þU±œSA’¼µtšLe ½É‰|¿jTú‹²àÒüµ™õ˜våׯæTJ ‚‰RL üV’‚+¶²‘-K¨Ù3íØ¥G—‰ñM„%Ÿo • ]¥(î¹Bt©&êÄM¯ÔYA"ùs'!Rî„2¤îø)wëWú¨!pêAntOz}JX€b®" P~dÑIP¤ú­çQêàlò—Áæ*_hÉÅÈÿ?«G@~Ž§÷ ×®ë«ý7ŸöürhÔäÏag=T7ÿ.(zlé7UG³î‘T\±4)Ù¶–Š<*vóŸ8@Ê<öß:ÆVm†ÿÁ˜ðÿGZñý” þ·ÞL¡Ü¿ìÍ[«.’ýøÛ\O®ä_»Ó’=ý\ëAùŸ»1(óc¯7*<‚rÿþºç¨hŠU¥Ùògàžµeüüå#Ù£L!Eï Y®Êÿ[ìFXòÅÍÉ!d@l‘zZ=øÆúco^^¶io×R7Š÷Ç]MÌâ!‚ÜÔ‘3ýZ«,êÜÝ지ú;Á»-qïx2j²e¬Eü†·ÿ^9¡òÛý KÎÿÝx·â[ºoø¯Xr¤¬öåÏ×,=¡¬mÅsÜmvá~Yé¹,™Ï¦æ>cj0""n®C¥ !·f÷wžuZ¢V+ùx1À×ËÂÌÔÖÖÊÒÚ!,r¢$ϳ~tìdñŒ#ñÛ'Y·WÙÚzærERJ–\Ï®ö鄬 ë¶*…ÿ"!•E÷mmû‹ åkgò©„"HX÷·¹YCHIpS'ÿAÒê¿PÛ®¯J!»Ž›žñ«á}ˆõ·²0µ±³6·´ö òC!ON,òŽYý:-L ÷î»ø‚ÿaíwW CT Ôhqæà>&Ðé;YT"zHYÒ!JmF„Á ËnV]‡¦î€²Ÿo J*íiu¸;Ñ0øô>µ™M&›ô&PGM#— GÓ"2»Mü†—[ÆöTXI}¢ž|/•#ˆr¿½).À<^ƒZî[²o•«^}…“Ëø{¯I¾9ùA2bò½E¥o±’ïg6¨ÓÒ¬£™CǨ¡ž¡6P›gÞp3¿kzõÄ 4:ƒN@ðõº_ä¢ÀÛž¥¾~üøéÓäsî:/œƒ %Æ” †D›“²7böµƒ×¯7×¢Ku¨¶†¶€V£ Ô¥ßCªoŒÖOö:ÓÆÐ¥3 1˜L5u¸|÷±«­7f#çfC·¾«!eõ"A#÷gØ.ýï=òèÉ«'Éq6T°ß°2B£Óét ŸZ5$è}‡˜ã³èÿ0áæ·c„W澋»*2´¨Öª“œß:ÃÅÉ1**ÜÙÞcűTaÙËÞ.1 ‡ £;uöüy}v¥ÏॄðhÓhÿ  3Óˆ‘«*O{[Y'p³›·¯ôó‰cfÛgÄÛ¹ô‰èbçâ½;ù3!äó¥Æ !È/6µ°ÎR„óbH ³wP߿ȉÙbBµpX„»_¿°»>á×~ð )~6,ÄÃ+¨Ÿ‹sÌô „û‹ÞÒæ²îE©ôn³}¢í¸-ï ò–Œ¶uóèhëzáK™Â‡‰Qȶ´ìu|yB\¸Ø@§ÀA‰å„œ«íœè „”½ØâfÑßÝÖ~ðìýbBÊ_]³æTÎˤø)‹ÎcçîÕ×Ï#0úÑ–2©Ÿ—<®ƒÏfBÈ̘^ó®··¶Yx*ˆXS‡õ³qéãfc;v5!•¡Ý’^ðd®ªxo„ºYyûùÚ¸øì»÷Ö·QQN>¡}<ýŽÍ!$ÈÝìÀúEÃF‹è0*›«ó"ŸúŒÁC·~¨ „ìZ8ÁÁÅ+*ÜßµOßË !÷7úøN>=pĤ ñ½]ü¯|gB–ŽX¦Yܱ½dŽÒ´Çï8wdk<³–‰AAê©~n9wµƒ¶Ìµvä¨AºV!#­ j½{[ß _¥Þ]"Ô»ííÝÆo˜>xì„q®6“—"€ˆ(øt&ÜÓÖË××ÖÉsë•w„s‹ÝúÍ8ádí0`M!dã¬;WŸÈ0_ÿÈG\ $óî^c§PB€®Õ2fhè7p¤¾@ÊÝw.¾Ý€R‘«“Þìý Q8Ð>]Y(jdØ×R]b2J× ž¹åÔÞù:RüðàÔÈËêž—õ§ýŸÙÿM[ DäþHvôŒüîcó ½\º³G﨟—íŸ-¬=ò(¡¯Ã®ãƒÝbÂüϼå bÒ$Ç™g ›mÙÛvÈÎWˆˆ(îïcuèñüœdì<SOOé· Eßìmªœ¾ ŸÌYušB䳋?ÏFDª²ØÚÎ)O@ås¤ÊqüöÑuçŸäå??e6¢Ê!ûÓÙ…;#âø§Å§^K>®jŸ°ý"?ÀÊþ•@ÖPb÷t×ÉÛ?–¦]·õ®òCO¿”¸õ®Bã JÀ¶··v Ê›|J”Ãê3o±ðvϽ×?,ADŠ_îÒËöbz¥$ûpËí7¾!â½}£M9‚ˆ÷Å:†/‘O?>µ‡çLêsïNéã¿Zò1es¿Q{%ÿ÷±Ûù,‘Êü’VV!®c6#ªð²²¹ú½ñÇEsÓ \Ä}S¼Í?]Eº¥!ööRˆ‘A.Ñ«®V*ÖrZÒ7Ä2OsG ‰ËïηðÇCDÄŸw6›z¦ŸìtíÓ_Räë¶þƒ#"VܳìÑ—ˆHýLÿô³\$gÑ’æÐÅ¿ñà4ÿA Ï#¢“cçèT!¢ñÖœnsN#âtÏ.KÏç+±ùàÜÅúúóÛÎæ6W³DŠìzêüA¤Š3?g•ðëdú¼ß¤»ÅñOBDD^¦MoçOBD;ØœzW†ˆXÜËÄûâµManÃ%… ®N³ò›.™œ—–šÎDD·ôsz–|óX~ÛÒm*""vwHC|½{¸ó€µ’ä¾öÝ_#¢`´CçÍÏ*1)Â4tù{…(?9¹8`øì[kâ}~iäõO·»! ˆêl¿„~ýÜ‹vAMÑ´§© äÄ7ÆKúþT7½ ÕÄ)/_”]¹ ÑM‰úÌ!fÁÓ¶y«[Ÿ2¡úý¡XŒ(³‰!;cõž/ÞWX-˜ˆjÚúÚJ;Û¡E«×›f8{ýó"׈qVFz-ÚÓ¾¿Z¾çäów_Õƒf³Èù”UÚN_üüùóç/^µìå’qÿ „|6¨Ý¤zþ§Å;=}ó™ÖÞwîH'åÇ2.¨ƒDúîÕ¾ÛÓô4 !³Å»FPYþ^¨©éÙFMNƱ›éý÷o@(¦ìk=~œ¤ÑöáC›ä^Oãþj(¡£½ ðO~k7j" âŽË‡õjŽ­;vn¨A“7÷#¡æØR°…ßËԳ̀uûV†[Lˆ-»a£áÛq>RÂþ},$ClСIeqˆ ±$?°ù~Û>.i/ž?þ¼P¯£AƳ>RzÃ%EZ[¶çg‹« €4moÜT—®PÁ ˆž¹:óÌòû¥ŠQåñQKWS™JW­5æ& ‹&»¶¹ë†î D¿u§Vd|;‘¯eêgÌÐ4´$œÓŸD ø\"@§Ž  \ž½¾ÒPÜÜبý›´óu}ýâùóçÏÙÍMô>'§ò©¥×©}+™æÈ»ãWLí¥k&±2ùÈQˆryjè(A™Vøöêú´ÆjÏÎ|äÁ_}Cò£*–_le<¡nêe4Öç•‹]Æ„ßÚy ²Ž‰\¢LƒÝ&¿„ÜÇŸÚYw«>§6¤Uñ/}-Fy¯¢>¦}úÁÌœ¤õ ¬»Z¬>ŸªPhl´èÒ¦¸¯)—fÄ…ØzýTJ1›šÝpªAÞ‹M 'õèjâeGH´îŸ?zìرcG?ý.ìmÞº~¬úÆÉ/è—¼ÙºtZÏ.6SrêYЫÌÃhÐ9|‚LMÉK(âÐ$„HœBõ´˜¥¼ é¹UÀ¥è2ª©§­ÉäV¬OUÓÐ ÂB£Q¢È4¯n  A³®¿¼R­¡v•·*aè" ˆt­Ê²NnÆrÿî摣ǎ;–t𦥿á¦FUeg„z@×xÛ"¯¹±S yhÍÛêd¿ûPóT¢ÌCÑBžpõñSk¶îPOY?åàë¿v¨@ ÝjNš®&UÊ£@Ì¢(Íj2Ô6HÓn,±,àÞËËG;vìØþCw¬üì¯t‹>òÒÝÆ¡Î&MS?¸o̺A±ŠvZמò>¢PĺÆnç¶/9½'~é@ÏÏlü'ÞâÿcGªkK­Ÿó«4¸ÈùÀÒÞŠ®®ÅH‹¹¶…º´èðmã…»üÞŽÕ›š0£ 4‘ùRÌëlØ0[Š´PÄ/«Ðˆ;'¸÷¬Í'†Þn+§Æ«`—53õL4ó€K‡¬ZwhçìP6=s)À÷}6!£ƒR“t™ìèIKì›Ó ®§f’?ÿR[h8jÚâQsĪOBÀÛ³ •Œí7.ÕN Ìâò6Æz e¬ÊÐjE!K€ÈDB¾•t2•öÃdön‹·Só¡G+D$Ü´bA‹¦º¿o РWkñÛÔBÒÎ Éûøº¼qÇ.† jrÔô—®Ñ†V¥5i„zûìy‡Þ½; Ò¿ðˆ&",|KA[ù…Ù€MGæó¶WŒ·–ÜŒTT 55ài½òpÑ‹R ÄÎ>“MWºÎ¹1HžS¹xÅÝJ*”< IDATÅI°Ö®ªŠp3®Ø <õàÎ.: 2 @FÓÝGwyŒ0ñð+†\ôxó˜‰eÃ×eñ"[kUÕFXoœ\§ìM¹ †èö´mð½(ÏA·$é1þaÆCCºAÊbD¬ÖÝíÇ^å³Ùì§gv±:t n@Óë¨Å^w?ß¡]Sš‰%ÙxüšU T°Í»¥¸ŒUžÿêá·Ü‹®Pí˜IWkPQžY^ZÊϽèéÒï{^qYYYNê;a“J¾ˆª—=ãÑßøÂ’’²²ÒϯÞÑZôÔT: ¸xÌÚ‚R»øýµ”wžvöPë÷‹jº,Ч|VÎf•eݽüä[h`0µØ¥Y¬2vß…ã26Î,(a±ÊW^Ý,zB›?`þ$xƈ7g•”ä§_P!Þ¸òÍO¡ôËÌtÍVVzšc¶Ü,)+{}döÀ'è@ Ú÷òºievYqîŒá[LÇ,Uü„ ¡«Q‚¥¥\‘÷Âiœ¤„{Ÿ~²X¬—'YøORêãÌÔT+äTŠE׶¯ºøWÏû©Z‹n¸±h¨ü³ÅÖÑÓBt>{¹ß}›QP÷ìÂf—¨e ëWèÐë°B5#³Ó»Çlô…£T¾"Ÿ$­;ü´DFÔPË_·ñ:›ÍþüàLV£æýZ Ù·h2iãù’òòg—EMÙ¯Uç*•.™Q¸cÈóïù¬rVʾé!sHyfêº]GëFO|¿ÿ‡It[ºlDD˜xðÀm#3¸2«õýG›¨÷u²=ýðcAAÁ§G§Ü}†9Ž›ÛYGÙj‘°»_‡Â>C6 üÃÞBþ}5OÙ÷ä>Aƒ$ÿG…¸?þÎB ±ìËÔÁ}]Ý<âçïV»º½^Þ×Éa‹B 1uÿBk×!¥å0û‡£gPEÅ—!Á^n^¡>!"~9bî3)ö_ï°bá‹SƒB¼ÝÝÜŽ[”WˆøíÖ>×è ˆHU–¸zøä Ĉ¸oÙ$oOwwŸà gŸW©¯lëëëîîá9zþvaµFíî¡å~^®ž¾¡ûo}À*eçZ/O‰Ç¾ r"Lî~ã#bÒ<¿Ù{Óñë­Ý~îî#goª+VËQ¶½½Ãòô1‘¾®n~g""ݳt“Rî^8ÖÓÝ-tÐøÏÅ|‰Ã#Uö¥¿·³_ÔDd}¸8 ÐËÍÝgÙ¡ÇÊ|‘÷`–uÿ=ˆ¸|¢ß¦óŸk”÷?S…ôñððºö•-y\t˜sc¯yòJÓ‰ñžînÆ-/Vµ’vcgHWOß°½·¾IrÆöó¼ù±Xòÿ±åaÓ6?AÄôKK<<{õêW(u qkŽ¯Wo‰ªøî¢aþ‹Î×Pã˃Ã|==½†M^Z(ªñüäcéü’S[Û=ü¼Bùbe Tñî(Û¨ßë$Þgì2%÷Ë•Ð>.>ÁƒSËj5,ïåî¿ €ˆxk[Ôˆ%÷j|0…ÙâÂ}ÜÜÜws)Äì”®ýFÈ4y~ÎUS«GZy}’“´#\ì^— ¢`²—ÅΗ•5(—¾¿:j@°§§GdÜÔ…U¯Ž>;»ªoüé1 öŽßûôŸ¥*þmv#å«ÔgºÚV‡±"[i§[yWÚ_ºbË5N)ðáVä³+óeeLß÷lÅ^¿u=¾°› ®P¹±ÂëJ©«ºÒ»J¡¼B_体‡Ü/ý•ó³"Çk…Nùu©ý[EPÉ((¿6RÜJýþýrçTýƒ…ˆÅ-yS÷êïó>c§ ò®ýõzé^fv.‡'®ÿ]::%pL\2"ž\>aU|ÓVŽE¹{S8ÙÕí9 ‘®gÌEDäO°´Ü÷±n‹TjÚïVaŸ®#Ã̇Ï•´UzÅt€Í[."búÅe!÷"bõçÖ^«E?ž¨Êxýúî™-Nî£2…?ǧ‡­JH§§œ˜=fU2"æœf3îjGêýã{YÅüú_vQÆnóálDDÜã5nÅ%dKv7ÕïvÓˆa<1'"lãDœçôÛ®7’tæc"FðÅw¦{ì’ø1ž\;n[Â'ÄG=ûψˆÔΡ‘§%;²ÍÓü—Kâ$]=ãÙç¿Ñüq²1YÆÃÏÇMŒ½¿¿ÜÛmâ5Z²=KO~þ¥£ƒœO¿(DD,¸¬§k¶îêDD~¹£¾ùÁ7tØAvƒ.¾(ÅOgúÚNBDä õ¹GûÖ$ÛèZ|ã!æ6¤$ƒˆ¢‚g†öƒg!(¿ãë6’N½þ5i‡ýà1ˆXž²ÌÒe }öpûUgÒ‘Ê´èA{~<j?á:òžÛÙñ)ÄÂëzúCJ¯¯÷¾ü "Š>î°tœˆgg ²Eâ|˜¸=2rÑED*ïYÝͶòÊ.Ñ _v\ª“ºÛÉcòÊ‚ÖêFo»äûèÂú½»N³ K gîX.Kcš_}^kÁCVŒ»$œë'Õ0šgðüÃLNÇNÊ©Tþ¸QCòܳŒ¬4x RK'ì6ü¹ùénJ°:úSY²¿½|,­iùãK'ü´jÑòüfê©Y«8ª»Ù¹ƒüåO_ŒàÑÙ[n;×6ÕfH6+ý-Þ‚3›¯ô™¸DÇo¸ÀΤo*èL8¼¿$ëõóRWNŽù5¯ºhu¼·×/6PUM=îÈa¨ø­ëç ^»wÖÖP½@ø  $“6·ð]\|¼a%?ü¾h•p’EÌÎ1]PÞTFæì{Nöé ]†MT©*+£ª³fΡ$.ØÉm#mzOˆ ÐpCÂgt‹ôìœâ·|u•Q¥ˆ²}ÿ×_¾õ¯í"Êhœº|$?7;õuÅ äÛñ*«Ä]€p̆µ@¦’š¸FP QR¨9]H0ÎË|÷¨¬‚[$Ërðغ«ú³.Ñã¾öØ}îëÚýl탲†Z¨´Ï¥>ý;Ü<~m@°_ý¤u<¾@,²tì‹­Q.IÍ¥cé!× ‚–±­VÛæâÿºü ↲º€¢f‡ÚÕ†JÖ(ÒHcü‘g¤§eÀn«@1k¤“—?ö¿ºÈ„}cA_~ÝÌ DƒR«ÉÞ˜Tk§XßwKF£3(h¨7lŸÑQ‹*E4ЧªŠ'Õ±}õ»¥É×zö¿]frô8ªÃ€¸ËýŒ§·W¬}šÉ¼e±ôMÿ[÷Âu :YÝ£ÏÀÝÝ£#' Ïí›Z_b:΋K ÷2–•~ÜûláÀÇÿ¿ò*( U9h΃«üéïé—BÇG™ôî”Äalò¡š[æŽVUYi0tÉöhþïsxQô˜RV…L7ç3ÇWªÖרwí¤ºíåŽ~ÎÎ"›Iú @YE•Zy§¡L2*EùëÊ–¡·è#&-µüR€î-|&äèd™ ä—3Ê@5Udî°«ø°ñ ¼Ì¼Ã&Y)ÊýP÷£´¼T­ü¥ÿ[îk{£E3÷%øwxeï>ß,l’¿MÿZ¨:õ™Åè¬.? ܼØ[û÷cé>+ܯ߿ï¿tUó•Ú¹˜ë.½‘”?¬}JzOï½jmËü'nZÕ€Œ¦–|EÚ;•± } îW TT™åÙOã?ÂOS‰=‹©¶,¦ßÈÃLfm{±õÔ É|vnÕâ#ëbí–5°L5OŠ´¿¥ì†›Ÿ£t"){˜#ÒíÓNñÈÃôzÆ3lovöò0¨¾¿¢LǽnY¡Xìº+Uu£Ÿ÷¬wÖÛêËÔQ«bìé*@H—ß,Xß5è7!;'ÜÓ–¾!<ÿæMS#Ư0©ñº¥æ–ÓªJÈç ±]í"\7ûŒãú«Ó,UàÖ½?èg(Š½6(@\ãcëv5ÌÉ»“ô—‘ç\GÀ‹Ãb—ŸØ3ß¾n÷„+=ºÏ9ÿÞ.3uâ¨ÈZAPYБæ”cŸÒ:¥ïÄ^žáLCºiR›Í1YÿYùN"qÀ ¹å5=õ”%áòßÞ«é©{uë,ÌÅ–ÍB /%/¬ý}jþ¹®±›b‚ àE`tY`¢‚@Ä|.™íš{Ïo“—ƒñå“ÅwJ¬W*´`dƒ«ˆ+)ª7¼¼g7ÌymÉ»ÿ †pBxŸ7lÝ#nf¸T¦ÎrjNèób!„÷í‰Û°­¦swkÈ€ºJùÁ¹ãW{A§:ã~{2zõ»èQ„÷üCqu€^wzr#€‰‹WÁ“G™Âª¯7ïR­…ó°˜·¥ôÜ„ì*ŠX0c·ÍÔßÕ’Êy½ÕÁa8€kÜêø˜è!Þ00 Dð>•†Veå»; Jw¬ÛÝM'Äü’M›¶rEH^}ªt³Õ€¤´ë†v!­¸×‚© 'ž~áÕ 8Þs#ÊǾ¯°eš÷¼Iu¢è·ö˜™žP’tâi&¿¼ ÏSß)™¶G3ˆ@UVz–¯çº›958%’‘SÂ`PÂRA³^tqNü‹vViꤡdÑú$BÖd½‹Bû+»ÅŽfý1ÿy E©xoä2’@¾½qöÖûJ`F9OÔ@È#(vÔ‰ÃY“\@@ôþîëÌÓ:໼¼:Ë¡/™.bŠÄøS÷£îª²_? ÏÙA„b^<"wû8–@t„ÛþYÀd2DÜŠÆO÷Òí#^7çˆóØ ÙFÌ—’&Ü:RÖ°ÙoÛr®lLø@Bf\?së}e›¬ùǨŠÙ¹÷uMm„-YsŸ_îmohhè0úÆ›ou8Àš’¬eS‡›™x‡N¼—YŒH%Œ³6’ØÈÂyh¬þ÷¹EOôL«EM –uªbŠBIJw†8YY-?–$j ݤĎ.µ011µõ:“šS§Ìý¡*Î9aí½Z„HQ(æ•o™5ÂÄÐÐÔÊiýñûbD QP™ijiÍâ‹iUñÊ„tĪ¡:/kûÿéX€QÄ¥&TŠfZõ\XÞèê·gÛ[šX.ØwMŒˆ¬w½9rEU_Ƕ13³œ±ý Šò‡Ø/9Æý’àbjffåì{ôaE!Å/[;=ÜÂÌÌÔÒ6vg 4LÚ5AÏÐdú…ït‹†u YÒ^aR«a9ïâ½íÍLLN¥Ðt–eÞæikjjâ13“F¨£h³›Ž÷ö,D,NÚij¨ï»à,–$tÕ ­SÅ « —Œ ²°0w‘’]JÇ:•¨ŠQtmËCs÷IŸ+'æ†è²Ë{{¨«áx ’ó±·ŽMa“8´ë'û› ›±©ZT³0ÈÒÚm$"õñÞAgK3CS›çŸÐŸ]6HßdÍ}NÖ~¦£icþ÷S“ûÿÖç^>=Pxe¥}à‚LjH +ÃŒ í¿TŠñàÜQ ÔÙ¶{ôº7§Í þC„7 Am-ö¯½éç8ì–©V3·§47îËD-U¦(DñËç‘Ÿ¼›‹‹ŸÞ¾žú.Ÿ¾#ÝÁ_qûðÙKUMòUB€ ¯=(Ï„×NŸ{ñ¾o·îµg„†HåF”´ëåðûo­u¥iæéÆliÊÊ&Ö]B¤O w“öÚ`ÒE¦¥¼CÍåÀ&-ŽEs[ýR“¶rG¢Zw5h)Wz½Ç[è)ùé´ªßdžïld ÙP÷/Ÿ™3Î/³çÔP}E”ÄBnM‡Eæòÿ´4pÿkåŸÑ”&\I¡P¤®çißç_Èî,NN8_²*ú9Z÷ yϼÈ+uôôW‘c¶rÖ¼v)^ªC«ð÷̬‹Ô­K—Å*]ÝL NÊ-¿Oíoâš`çp¡ËªÏŸ?¿¾âü¡W2kDúGÏ9ÿ2=ýôLÝñþ~ !ÛÇ¿+ãùìùóg÷wÇÏ ?þ‘A‰¯O´Ó¦ÛÉII)÷¶™ãŸö…GY?Ê3îX_YAš!âÜŒ]“V]<ôðÅË7oFh›¾éG†  ÎÆtÖPQ”&õ»×¶ÏùëÅ !äùo·…©1öÖ3“ !¥·Â½ÌLÍÃc¶°D¤:;ÅnèB¬)²²²)à‹ Å=¸t¢µ¥¹µ£ßÅ'¹„ÂzÛÇØ#ÿÉn3‹ E(nÜ’ Ö–æÖN~ñOóBÈ“]ž^Kžý±t‚­­µSय <»iº•©±{XRN% ¾¤žöw¶67µ˜´êD E€‰;yFB¨š¢Afåb¤ß9ÂS÷Ü“2’sVÛ!êeÂ=û!¤‰nˆ¨|õx#SËÈ…û…Q„(¬Ø0#ÜÒÂÜÚÑçDÒB"B=9»ÎÁÂÄÔÚãTZ>4ÈrM¸ÅY3Û™[x†FåTh†ºéÞxütÒw3ëuçž•eÞ r·µ´r½þ©Š¶•¾»9ÜËÁÌÔ!„}-Rï÷«7ö/r²·¶q }úµ†ªzßœp#S‹°èMåOæéxíz¿9bîÍìS+"ƒ–ÿL„”}yèçdablµóV"H‰íöÇÉ•£,'„ðJ?Îácnná2%›Å£í@o¯í÷²³235‹ÞÀBÈÅ1Fg*¤&9XMPÊz#ÌÛÁÜÜÌ#dÒËi "Y™éøô|b°»…©yôÖË´e‰_þyÞh?s ×  ™¥5„ÛÇ̼ôî↉þ ö€ñGÌƧ(>+zUè@@%Óƒ:ÉÉ/ºy1_Çgœ…¶7¡M*ï– ø·?|]8Á@ºWÔTÇ뻧¬RU=@›ÝÛkªç—”P>³öì_2Åu«jzÍÜôG7iÄ€1®œ·ï+é]!¥oÏíεž2 nEpƒô»ŸyÍmÛçü9-À/–÷gÃmüsig•²«ÖÖ,DÄ'GÛ ›‰ˆìœ[¶n¡tå˜Á.ãö>¤}ÜÂÌìÎEN–‘eøâkt…^Îã÷?¢QÁ¡fâ^ðñõ‰áÖönt*‡ ý¬¦'"â#—ŸBDÁ÷'úfnyˆUY‡¬­=Ù"DÄsóG¸Ìþ+¾¼=øÅ5EfV嵎‚¿˜Å?-ÂD=ˇŸ#"Å-6µt(lèI¸u¦Ï˜¥'+?Y›¹N½A!5ÂÑ.æ  §d¸õ€wKñMÂ|—€ét|WË»yìÞ‚®:†‡_s±&÷Šµµ GH!âè`'§i‡‹^q«ó.ÚØ ň¥‰V†Ö™ˆˆ©‡Ú„ÏAÄ×'‡Ù8æ‹ùOWø‰‘šlcì×!"òóm­¬MÂŽ!â’1Þ;®½CD,KÑ30¹8)ö+kËâ¾]ijj{öY!"¢ Ç]ÇðÀ‹jDäå_·¶²ªà‹ñÛq ƒÁßDˆˆ7wN󟲑ªò6µ~ÎCÄ*+ƒL…ˆ¼÷çô§Šẍ]mí§œ¢nkƒÉ IDATÿœä<àÀà æ{ 4Úñ„ƒˆ¢¢»¶fE5bD\=ÑwÓE:eJÑ`ÒÆÞ¸¸ã䑆-T¨~ö ËsD ‚R¯åî @„Ÿó¸5³÷@€~ƒ%'ˆÎm·‰] ˆ€ ×o'ÛwWªcPæÕ+< ‘ºr ¯í>ñêw Ɔ:tì׉KB§¸€´ºe"„ó‹öhNØÜOÀ|äÅ'É/vmº1.ì{Ø'z‘ÈÌÉ#kD3bóU|iÈ Bo«~ÕyùpãÌ+»9 dºnpn'Ñ¡"% Acõ?DÅ~„0Šb—êçiÜ >ÞºVmâi ²Ý\õŒ«ßj KØ£—; ª¾ûÞ¥KŸïÅ…”¸öCJúÑ›|íôâÖÖ&Ÿ}jÙ/úW÷Jò òÝe4›lÚ˜ŽF òW?³èO E‰ êÝSö€íë} ¡FûšqĶ+py5òÒòuLh¯•e5Àc‰PA¦ (/++à ä֜ߗ¾ ÈÁÁÁÞkZÄÆ“=ÛA+0$¤4iÛ„½ö¬šH£S/,f¼àX§Úb¦{ð°žjRm‡©_/Rj#ÄÐè ³H\”>Ýâ°„Õ|)î›èYWSX(–Rq²Ì2J¬f¬ R²iس ˆ’–ò£‚HÝT]2Њ€`0™@ii•¢ºŠÄƒ‚Éd3ŠHÆJ‹²¸¤&ŸÚjô·Å³4¥ ¦ÚbVI•¢†ª¤•Ž};@:€ HD©ÈIIb‰jª©,à~,•vÖ”Fh"”bV¥ ó……¤_b‘¨]7DKåehˆƒ ”Š\ÝI ³P\ð"Êâ`-3¥¹o À‘ѱ7ÍíO¥âžšH{‡^ÅMóB(vdÒ~o ¨ùÂ’5ïDh"ûÚö‚MSZA¹–€†AQjÚtÆï’ ¶0ûQýŽÈärÃTS½ÏÕru1êÉÍÎg6^®ò.™3y´Ùl¾’Bûé[âë¶oˆÀÂvÒÌÚ“X•,Ñ××õZ òªGéüˆ*‘þôf?£á?Īø“ŸÛp§¹G¦¹öCY®°.í:–Tj{yU“"5€4@ /#+ Y1ñ÷’;ÉIQbñïÎRÒGÂ͵Z2ÛÝ^ÿûŒË¢«/w—ò5íøþïÎ×|;€!DJ¦¶bÃT>må¯7õJïöŒîž;N6n°d?Õ½µCȽü¼K}]U½)/­A„¼ø¤tMÙŸ6Õ^]¡ºœ ¤$¦ã·ö”xê.ª 'ÉÓú ´þ‹ŸpæTY  ¦k¬yûôM ¯K¯UÊöÑ’>”Zª¯Þ²± í;Æ>eó":Y°£Ù±w¥„®ž9ù…-èlÏ{xûj>ýòŠá¡Ã¾ó~j"ÆàYþŸv.*>ßò‰˜'jXÃßWûÅ®ƒbB`WÜq™ŸŒš¤:&í>E8Ññ%µ{:Áš‚ÐßÞVúà²$&+'",,¿F¬"ì :Plñæ½'‰€’wÄ&ç–¿ÿ,€”¬‚æ€~Ò€[žw&þz ­PÚf–ÔËgg³iñFš]A‡ cð)êíÅ ¿N€„âõ‰ˆ<œêÒÞüÐt ì™ui_jR˜r૸ƒƒº€Œ—N×»/à~زó‘Ï”QÊû••|V „êNþW·þu!IˆrŠ’ï‘(çè’ê)Gf)1ëÄ=[ÿøyúºl6e许úòp•þð~Q•¸MˆüGv7bAUe5ò}ÆìZ(ídÁ'ÒLåóV­—@±°²²ŠþHÄ[3Ëjk9ˆÅVC¦­ðéœL6›ƒ’ù‰‡.Æ-ˆ™eµ•B±uÈ´åƒ{€˜_Å©®|,â²9fnܳ:v†‘ñZ)Y¥ köZÈXÎ[¾ÚÑÒ‚)Íïb¼jã*ÿèÂè­éÙwŽ‚´ÊeCF8XuìÖ­¿Sd¯.RÕ! €]YUg»d³+€³qͲžvAíå1K·DŸjtzy6+èÅ\â’“ñ{gO‹´_Ê ¥†D˜â¬‰ˆfá†544e2ˆÿ¤a:*¶Ìž¤¨5ÀèÂÉ1ãlÖp¥Ä”ܘØu]ä˜PÍ©J6YÈ©¨Õ®·ÊÊJ`þ6vÇ|á !CŠ¡ÒkþêuRbA§†”¨´=òÉ(s3+®}æFGœwD|§F(ªasj£Rü và?'.)2ÒÜ~Ï>&; =îïvûƤë+uÙ•œ:™SYY)F1—ÍI6UÊzN/ž9Ñv}”H,;zÎÚî ÌÐõkn‡±NTìÒßbëÁ£Ñ¾>^c—\=°8*¨ï8Sóèãã|•]m,)¦´H¦Cô¾½ŠòÒ¬Þâï•œJ1%i“W]‰1(Š¿°2&Úq[S,bFÌ\Ó[U†ú¸Î}~%hÛFÒÈ.^ÙûÔ΋¡V+%º7ÊjÂúãÝö›´ë+§ãoÖûÏK3 ŽßwR47ÚØp%CAcòú?‚{À Ë›&Îñ·*Ê 8qåpK-à$™šNËK âéf† dLŠ*³®¦LÆÄH¢ãã×È}•j,÷CFr«ØU\z\ø˧ŒŠ8ú>HW¾MŽüªþ÷ý#ëâÕE¿Âº£Ž$ÂVÃ8FˆžoZUùq£AMh$©AëÐhSB.býã63Ø|Kb_åfM5¾X’ª)åµÑ›Ió|£~Õžè~ =›{ª1·(ûs™tï® À{qÂdÁ“·W¶4ºjm7Ë.¬ÍΪwŽÎ‹z¸Þ¡9n.6ŽnÖhZ‰¶ÖÜœÁz˜R‰]¹ÙgéÐ_õ›FDÒÂ9ø›¶×x€H“Ñmülë›= M{ „Ü^1ÇìqëÒ&Fþ~7 õM3%·–ݹ) ºpC˜qcd0i._uý׶˜,AŠÅ¶œÚG¹E½Ns9Л¥üMùV¿_õ¸×l*õf¹…Œšg!®v/Ý{òøAÌÊ=n¾¾MÇ¥!rÅy¼•œš|ëÂ؃y ¢ÌZàFK›íH3œieͶ”ÙÓ±7E®“z\ƒ–ØÔðuM'L³YçYÅÛ<~vquj“5ÿ‰ÝM[ù?,ˆÀûòtÛÁøR.º†sÕÅÖáéˆ@HnÊù¸„4¡´ŠÇˆ(‡~Jø÷D´·•6qÓVÚJ[i+ÿg‡©_<ãÖÿ¾þm÷ ÿ"ÿõ~ýkßP²mü3ÙÛ’ˆÿÏŠ"®^6ÊÓÜÂêo/Ñ3²,ÿ¥T$Ô‹õÚv þ„R‘ªªæÑjÓ@w“«oKÿž  ˆÏå‹þBAZG'B&š\Íäý ¥„ÄUNC—aª„— Û|Ýœ¼C'¿®X»ßÄoõrw ™¸Š[|ÇÂ5Z pggØä-¯Úv7—“ð/–Œ3Ãm݆=ü\TVÉG^š“Ñ­wlveüú)nW"Ry¯l]ƒ9••bÄu#ü‚—Ÿa±Ùßž 6Ò?ÿ‘BN–±MxÔÒ²21âšßàgYlvÅ·4o#ƒ Ù"¾>1ÌÆÅ÷u«ººê\”§Ûâ;ˆxjŸ€i[**XyÏâY .FäO´1µÉøZRQÁÞ>ÞÈšxD,Íz¼åÐ…–á—õLf­O(/g!¯¤"œBñÛý:~Ë©â +k@úŽ¿“õ£³3ŒFCD¤²}\\½"fÒ™³mÍ EBg{‹–÷Dwrq:ÿ‰BÄ´£c†,HªK °n¤ße§YlvÅ·§ƒôÏ}¤ñݩᶮ>ŸJÙÕUlW[试5Ö3G«'5ˆX1ÖÆ|æ©×¬ŠŠïoÎÚX9|¯¦ðÓC ×µG”³*‘›çdd¾+õ{«ìØ´Á6VfOó«Ä/7÷u]‚ˆXöHÏÐü÷UW9UÕåßÒ­-mJ¹bü|Ät }ÚVeÅ×Y!¶&ŽáĬ[‹½³+9âP_{IŠX•åÙ#,¬¿SÕ¹†&Ö¡“ö””–Š7E->Îb³+¾§ûéŸÊ¢PPì®g°-õ+‹Åúþd·¹YP™Å"jglȬ͗ùBþáQf½d±*J ²­Þ•6È$Ÿ°ÑßÚcx6«ªººò`„eà–7ˆ¸kJ¨_ìV%›]ð*ÐXïÐ[EQ9÷—۹ϯ¨äPˆÛFûNÉEÄ{fx^̪`}͸§oîúE„¼×›Íô=² ÊÙå9cì \g âÕu+ž¶¡±ÿaˆpaÈÊ÷³î¡¡¦$ssÑj¹‘;\t4•••üfÎÝ»‘DIQ£’Šo|ÈÛ2'XUYY¥‹éÔH‡kÇN!Åœ±1R]ME·>æo›3DUYY¥‹Ù”Ñv׎Ÿ¡[QÒtÓÕT‘—Wô 7øžö@tõêƒÑQQ*Ê*ZÆ>‰‡×K‹ðÌì=gŸеƒŠŠò”=K¾Þ_о¯Å´Q-ü¤™¾ªªª·ÜƒäÝÈ/ç-§§³ð3ˆ Ê« ƒf¨½:^DAeÊMU‡ß^—T—å b—NLæM¹ë¹,xò¦`|mú½'ÔÝã/&Ú‚pS|3+oKlˆª²²J“¨ß¯=I7«Ðip¯öJ ŠÊzòŠ–S'tU’—V56íT’ñJß<|­Ò{ýP]U•Îƒ†X¨3¯g~ÂàU+Š°SUU*zÿ¼¦ëoÍ;+«ªßrDÙ#.Dõs=T; bJa!O|c÷厣šuWm§Ò5&j ®h§ i¥ví€xÌÒØß4T”Ôz;»uûú& bÎØ<¾Cûö (½þ6{ãÜaªÊÊ*¦Or½vèH·¿š6Õ¼«œŒ´ª~¨:3»„-f0‰¬4CJF^FJ†UÎTT¨ªªtÐì}/åqu™†tR}ô}{«*(((ùÐûšò€}õéÛUó#U•”•5õbgû^ß»ÒNAˆ„ÎäÏßÌt´„—N\ ŽY¤ª¬Òu€ýå#ÛDÔ…ñ=c¶öÕTSRë9'Ä™Oý’r ­ü×ÊŸC„35ué5ôü³õh¶íyzWŒ,qYÚWð¯«)È3ä‡:ÙÒS_įV0P¦)JÉkI~¾˜!ì(© äW+u( TµiG-¦´4A@aA…B§Ž4¸™h÷ë |ò>m ²Ý*iÍ/ͮڃ¶5D¸¢†f󀚥ó~ZyI²¶ÕHå¯ûSj)ÿ!6œ,GºöÖ*ÏÌ—%§ë¯î—Îd€gþIUËÉ$|‚™÷™wõ¿}Pòˆóï¿wy ŒP»XÑ+¥ËVˆò¡õX!¯/IÞÍPíF»1Ú+KÖ!“ HAEE!©È³³µ¥IåVV–~b6%”j5À®,QRè45)Ù&äÛÓ%@(„÷‚¾fjô#zu5•%îÔNAB’´ )«M“&ú*d*†»Ôu¤FNG€·iòÈø\Æ`'}yàRŒF«x¡KkæÍÖ1š«§gà6-Ò½_#—q•.µ-ÒÃýKÚ÷”´"p™Ú ÞXu'‡øôQ€ÒÜ9¿. ºƒÝûö¤Þ|G>*tû÷ï~^#üQ–¶Y„ @MØ?R¿sÛâÿ{‹øáVÙE™ü´÷¡:õoÖC„«‚@xé飹t«>B‡¦”*D—Ÿ>RmjÈm, ””ey•5?ᤛ%³øÎ ™†O·àJOacê›ÓP:šØÆ={ ˜qsðªE]8#R—œ¿%w=lÊDð×éõ$;»"í½_TGuiïsgoȽK߶Ú9LØùŸ/jò÷Mýö¯Näfý¦ÞWï[¥Ô@ LxúH½™ž¶Xää”d:õK:×àjÎãº.HKË Å5P ]@16קEYžÁæ‰èG„•Õ„ÁhFê63â?†Œðù知kÔ»Yðêâ•æ³»§ úþų;¢ÞgÉž K¨ê×igÆ ï1ள–r«]Wað¹Ç¾Ôf6ß“÷qû Ÿ' ÐNMžÏâ¨ÖN ªò¤€KÑ}ä³ £~—¤Âcf³vUn[ùÿC8±6¯wnaÓ–¿™³tOƒ}+£·¦’ôÉû¹ô_‰ûWÄ?-n0}˜}:µ“:•”G_¸´oE³bÒ|S*úz¯]¼O,r×t±TjØD‹”UËèYÈÿtsîÆ‹DPUþ1÷0˜2R"qžˆT¥~)àµÜዧOªA0ò°yûäbbvw¯ö ¬¡ËÏ9qðpÈoíÁs”ãë'ÓV¦ŠÐ{ Aþó¸óßÛjAèÞEåÓúco= t”í Ê6^¸Þßu$~}ûì}!½:+IŸº÷ƒŸýLkIuík ÈÎN*’,´u‹~fñë×èܵwé·ï„@QÒÆ*õ³!£Üm;½8}ƒ^™ÎœVeHĉˆ÷kjÔ]ÕäNÝʦÿ¸~på¹Ôb ÄRL‰Ð¿³iZ%E˜RL@ bDμ 1yCQÏÒ}€²â—J€èõÓ´r.ÕÂÌêÚ«‹Òé+ïè?ï[süÁ7 AÄcØ~£`”UP²²Ñ¾uü!@Ç_б¯à㨞OWßuüŽœL}ØÓ%xHPPPPÐþÛVþß]ÜPuÎ,æ̬ìec`ÓÃЂ€”˜ËåÓ㇗¦náæäio}è)Ú™jR5\^"üÄKRÖF¸ùyØ[yv&@ ù<~í&_,¨á (€…ëÖ±n¬°pp³¶ò5»$ tóÝدØÜÖ%$h°ëÄÝÎæðùîQïßçȨ¬ 8ÖÞ3zÆŒá³wì*ωE’Öéã —‹•ÑãF~*èì40ïAeïRDAÍ”ÿí Õ·½  @ßaŠO«;˜¢9@ûó+ž†¡4Ý€aýÕî½+Ø·=[Þ<õ2,D€:1%lö…ïxü¥©G¸ùy:XzŠöf€ñxµž)OP»pk„•¾çwElµðêhaž#îÓ]MPT#Á"£œ¶år>ƒÌ† ›{»‡¢¢%äÒPÌåòë\¸\.…Ð5|ËàŽi6^Cý+º[s¹"PííF•_vóða‹€ÏåÖ!¶Ež@H ·†[—zåÈ¡åéÛ"]}‚¼¬÷=9Zht訧Pb98thïKƒV};ü2ôs XšÝŒ‹õ›¸u„w‡±¶¦þAÁžÎÖ¬ÞŽ¡:TÍð0O"!_{¦C1¿†'D€=ûW½›âìèíd»õnµ«}WPîåάºæîîð0—ê×E âÄ¥[/v›ÚºÚ˜;ö šÞ1 ú1oïâçÓÇÙŠÏ€XÀã ©¶¥þw(ÿ¿#Â'ûöY‘0@Ô‡/ÿxä¬ÒÌ­&|øAC}¸qSz÷°)åÍ#ËëqQ\]Åk§D¥ÑËÑ|Ãéd ÙfY-yƒˆÏÈ(+º®÷ûÙwwãšåÐÄví%ú­ YÃó,Öçp“|¤”¼~‹Í wŒx}ºO !#–S–à?Ýc¸ô{Fâ2hÂŒ¶ò·÷»i¨ÿøß@„‹ã‰çoj¤aë½€´x« Hc¼p ô4îis”“V…€DX`c½þöÇ’’âW注Zd±VÓË”%:ZÞÏ*(-+ݳg¿‘…eKjœß½ö?KãMš*šº“ffT#~5™x¤RO ñ—£ö&Ž¯r KKK–nwl ?ÕÛµ•¿áü­ " ¿xaôôç_X]u¶¯›-O~òùFöû›Óï,àPfþ–Mðþ_ûà#"!EigbV-ã3#fÏfÕ¶©i7m¥­´•¶ÃT[i+m¥­üÇÊŸð»yfÜò·á'–ÙÕ¿¸uŽ¿œÃöñžÝ[|¬ð†Û‚77Ìüïôçù±Èí¹c-°ü·vå¼R¯à ÇΪӎŸxí¾º1¬Qµ²[1—®lóþS»õë»F'Qþé÷/]9'Uï¤ó=~eè©ä“s–Ù©ÇÞœlŠS=‚¾ÈÔ¦1BF?K¿%óF+ B^_[³ñ ó³ê^›¶~â:‘ßù¹ ,Í\½rãÓ…R²*‘ÑÃë´ªfö´ Þ½ÿ„¢,ƒVÐÛ[¿ã¥Äi¡~sùµi˜²Êîã&ø›ÑŠYú 7Žnú#!™#` °ðˆý]üÐsOô•/s;/_ìQ›`#eßèõ÷™ñ'Ôѹkú¸ yš‰–ÉÖê`£]_„]^h.×,»Ê2nXuîʱ=€Ô‚à7¡$gm}çÅK£:0ÔFM=µ}é¹»/ gî;ÞÑr`Ó¸¹“2¾Ò0SùöÚ#£zj´àzÔl¨Õ¶ò7BnEyeã¬ÁW3T4Z\·i ÷ûëÚü×ú#¬a±8‚÷„)£²aí eIøa¸wËÆ~FÓj*¦SÖ÷Vý“3—pôã´Gƒ‹Ž,^‘Ê[b.-,l¿çæ· @Ä)+– V””™m>у ˆâk[fØ;¦Ýº·G @È㔳Œ€SQ.â@éã£nÑÇ–íÞ9¶“‚˜_¹wf„ǵð+Ǧ1°“ïqÃVYB*óÒƯ8z*nRˆ Ã$Eùå«.œÓ’€¸¦hõ”Èa÷gžØ2 æõFõ\¼jS;|yy·*©í}IDAT½©Í¤-—&ڨѫpá†Í€Y!>Kŵ–s[÷Õ 3{W6Lì-Y«Õ,ö·ëÎø, 1¡—1]Z)lñDO‰øeåôïʲ²~Q›¢Œ;PTê‰5îö¡‰OuV¼òœ a¹|}„Cpqã,K›®\ÖUn^âÔ°Yjvak‡Z (¬úš9Ê'}ëí…öÊM)}~!rwù¥ýcÛäÅõ0Eyyyÿ´iÓVí¾@{2<¸tàÑû xuqÑæÄ‚§ç¶Oš‡'àæíX1wòäi{.<®OdúÅÝÓ¦M[³ï4ô@xrçê¨iÑ;NÞ­»{vÇòÉ“£/<ûöþúú'Þ€¨zïþC5tt€„×YvÙG¶,Ÿ2eʼ•;¾ðª²â÷žG‡a`e%Í‹‰š½t'‡_aß‚OíæÍ™Á|´{ľ×tôè”W]õåTNswz!§72"”w{ɉf~:7ׯ®ø«äoÞö@ϳÿµÞqÕGì:h¼£qF¥«àÞ‹5„À«´ÛÙÏŽ½¥@õû?}ýM>ºÛøKëzNš8š}s]è’ctÊ_ï ì3jä°Š«k†¬yPß1„ª™ÞŽi aâä•þs.!Û¢üN~”71’{wÛœ¸ë_x “ØEÏò) €äîšÝÄ{†®RëügWrAAù'™õûöyz÷Ìùä÷k:³½ƒµ9“8ìQ‡éŸØ*òXRôÙ «’‹«—w¡O´N?Ï°®%ög·0Wâ÷í26]Ã`§àf)Ö‚Õá«Ú,©3oÑ>òïNjJ8D©ƒ‚°4ï6WmKŒ5í|C»E.Øjó[+Iç5% ôØ]¶÷({BجÝ"{:Oœ0š}sÿ¼ãJý,ü,Ú«v6™üûH–;;EhYŒû=²'ûªõð­„aHI3¥ÚDÉ_|˜2LYaîˆhx`¶¹Õ¦¢Eî?n2ˆZGýP{==ÙØjc 5NÿèxµŸ@É“å¥óAcÓÝã_ˆ»ëÓaãó•N}•¿Ý¾ZªçêØ6¿ø¢ab¨§ {/ÅQN ûë7·RßÜÖÞÖadd°¸‘ñ!2zPËð2`HSw.]z#-&jX_íÚç>ó4€ð»XHµWùñ$!ê景Š¡OãÓ4"`þí#¹ýzu`FõåÏ<–w8B»ö€Äw‰^sÒÞá@ê±êj¾æ>¾‘P¢L! ˆ÷ôú‰Ï}†ÄI×ä–ÉÊÉhÔyG¶’ì¡Ž»Ï÷ÆZí@ª¢Œe:o‚¾,^[0Oi计®¦ˆ8pû<3ƒy™+‡w×P”VèØ»—–¨:»FFÉÈܪ2èêôªæ!€†¡Û&ÃÖà´•iwƒ(¥í,B]Ù‚r^ƒ»ÒÐÓQJN–A àÌÅôGSøZø½cûö ÿjy2†ôýãÞ H¼ïæ¿ïÛÏ97m ¹ëìÛ_äW3 ]»ÿ äzf·1ƒ 3.p÷¿„ñ&Ê÷ÞòyÉ«üýýgñ©ïi%€2Ú"Ûë·“þVYÈ¢â¯êªê2ˆFðoù¬jåj $€ijߥ‘„Ý{üÝÏR³WÌ»2ßËÄÉÅÖC¹œ öõžN? úµ]zõ ıÿ°ìE:¦ŽÓ—lJÍ.—b€/×Ò;HÓî}AËç;>GD!æÄe–ëÙévÀ&b€óåCVVVÖ‡{wïÒð_yeפ_º‹¶C¦œºöðÃó{QCí¿>=egQ-¿z_ffЕÑJRk y3³²²2Óï­ÛueæÙG‹†ê 0• "Q 塨´Š´kß®¹C7$^<¯5°ûû”ää‡)¼\²÷Ä4¨¬X=}÷¢üZÌáºýÌ·œÌ̬??¸ƒÓgdÒéåL)iy±˜AýwIôÉ­pÉhºG=zœšñæ±øºSä|AÙôÌù¾ÚòE~ ýPJ¡÷Ü!¿; ð³ûÈEC¦îŒØ&kþzÝ ªkG”/¢d¤™­èˆ ô&ËÜbÈÉÈ Düú3€úĆ¿9pL… ׫Cà  ]W˸s·Þ=<íÐC´0Ò=)·RÆ|˜zÚÕïY)\}i­å¹¥5ee²š]¤‰º š¶ûâÅ‹ñññ.\zžù&¸cC"‘/¦d¥ê)##'ñ FGšI„âÚ• ¨l¤¡’¿V˜ôÖD€~ŽÃÏßJK=¿U³ÇûÕ×H®H,Qò…´RTZM׉«O¼uäVOö9ÿ¼¸*å²ÐÆ^½V:+vqVÇÒ¤2ñŽEgçÅ(7Ùs ÓQ³bccçÌž½o¢ýÙ#8µ·dåÕø"V}vg— U5•€]RÈ"€|{5{Î)3>¿añ ÎîÓ QhuxÅ|2&fvlìœØåÛ¦šðö¼ ˜ÚÉÈ^ÿX^«lD€òÌ5‡Z)|ÉÉF¨ &JóÊΞHë¢ÆþâÅëiUí 0¹´>Ê;[˜Ò/oÒ–$i©?1 u†Lœ;{ÖÌ=sG<¸O‹…]ä8ìãYB¨ˆ@J3Ÿ¾ÌgµÚYÉX£ŒúÈè%™wª€¡*•5¢Z¦òy")9™rÔwúª{ÏÞY5™õú¢SÐýuJ³>}£á~¹¢«ëR-& æm¡ùüÄö8®CÈ@) âªC[¶U €´ºWøt§nÒ¿³:™ *Ýp(ÅÄÈ@!ÔMjïµxE‹©„@Hp¿Ç;J¬P5_Žž¹K «²/Ò+—õà$[ÑZãÿµwžM%[?s ¡¤(ˆŠŠ (("*‚JîÚ]lˆ®¬kCQ×ÅŽŠ… ¤h{[ŸØ "VDŠ$ )÷Îû„XÝ·~xëü¾(7ɽsïùÏÌ™9çh‚¤¢œÇ¯€æÖeùï dÉŠ.ÚZ»V@g#Cé«7å$yÇ.Õ¯ üóŸ´|M9€$ï"#IXú'/Xa-«º_Zû­¶úO.gÊ{õÛ×ÎkiP˜¸¨­<)ÒõôŸ3²»EÖ{Þ™Ë÷;¹Ò„jZÛft\¿íê™·eóܬšéŠ³ñ^F×Ä\—/úZÚzðs².(|òE%/Ÿäyö€õC—l¿€• ^‚ÂLFÆ´ÕÑØÃÍ™æÞíËÆc˜¾6*?mó…òÀÔ®Y}¢¦d¼+CŠ¶Z¶9,ÔÂÕ×>3ñä! TúŸSíÆšð.-6ÓdÈÞ-¶(غÁ× låY\ïxzøö§ ¿ek}u8„ µKÐ<‡’EK  a¼gnט©Þ¯?–Ë‹'úürÖ¬ ëš;‰2BðöÕ¶[à‡1ïÆœ`ðÁé\ݾôåòJ qñÝMûn€Q—ÞË6¯Ð/¸÷žZR]&¨$RòÛnh±YŒôðôwèixëþó_v%h0 £h&˜©,ƒ1ÃàW‡c;OÏê\£¦%üàìÔÙ¢ÓËÜO ãStÔüèê›4#â,µ–ê}ô³±w¬.zúV —hß<û8Îßwù·›Àj¸ÿ’¹1ó“ƒ@ëQ;¼Nvñôs²1yü £ÿÔ ÅbV§a.ž?ô³myóAö²˜š7cV…d™>8°H½CôO'»:šY˜¿Ìý8ïhJ €àÑn!SG\ðpÌ{þÉwR—{R€†€Œ]Ñös¶²€m o¹îíl­ _g0Ö½ €˜a0˜ÏÜ`Ÿ:l¨ßCK=!«ƒƒ¤šÆ@Ùé¾ëÒתWæó‹×<£Ã»oÜ‘1znϺC³É[%®¾UæóÌôjÇ`5TqvåšÚÆÈP'·—¼î6e±ÛÚ§îœ0uº÷b!£C‰­VCö²n…1Ž8td¼ÿBÇÄ•mMME%ïDHoÈÒøÚ²‡ïùÆ ÆO fêýÉ05-µê±?Ìqö” žãÕÚÜÆ ì]ZIëjà*Ìîæ0.12’#¼¦LóÜ¡¦&a4–ïKÐØœ’2Ê{CÝ;µ ÙD¹N,®…•w‡Ã1KúÎXÙÙ¿¹¹aM©0ÃÔ 8¾îè€Àƒ“ÆM·Ñèx`YñôÙã‡Ê4‘ŒÅÑóž0Ä·GSv*ŒqæÑŸ”HÀ (-f4 §üžHaÜiz¬ýYÏ1{·C÷æ,LÔhcÚ+?sß´ ¬Ñ·Nú¹§¶îÙIïÑ㧶Ááfjwá€ïž§ONï&jò%ýØ×y„×? ’=×óî­÷ÃF9§ñêy^Cs£ë¸\+ÝΡ‰ÔÚMW?†a(eGw"Ìã’QôÁ– ‹ ªl5NÌ%ŸEàÂ[ÝÇG=»ßØz*Ï_ *\¨;Ü«HÂÝàH£†Ts6KW¯ãšõÞPÍ¿¸ÎÓ–olø ä½…šŒé54Î8Þ°<ªu¡Q!AUêqÕyěޖ×Ä#RUQ„PÔ¯™9we Y ÿç&Sª,a¨±ý¿žwo½Pã…Òº>ÄM%rVír­t;oªÛ³ŸéW ß-ÿ[¼MC+ó6 Ž‰‹î_ºû®n3D¨â—‘®Çž£ÎNTþi§á³¤ `@ÏâWù‡·qtëfÀós÷É¡Bæÿ+7ßÉÅU¿ä’›_h „Š'ºÎÖì:f´f~Ú€1‹ä+ÜíKÇEÿóâµÊZ¯@qÄ÷mé§ôÊÓ¸N(“È÷¥a„ÐÉõ¡gþ¼–-ükÝPŒÄ¿Rm*ör9•Ëvvq’¼H0jamR+Œµ»ù´{¾{-7N¾ãió—À0 Æøé­ËÇââ’Ó  Ƙùœ˽)ÿBÞƒ«qqqn=矛á09‰ÁãêÓñ‡òù´èù9߀pÅId•ú;?J1ÆþCú\ÉÈ3Ûr×øÌXw•á¿îå4X Lw8²?÷aQÅõH«aaŠŸ‹ {õuÏ¥1ÆÂe›Žaœëjã’+QRü!cô”Ë÷gàƒú_Ë-“Ÿ«äáQ·ÃwŽµÞþ cŒi ?11±ª&o¯aÁaî•êÒG¸4Æãì×ãÅqO_J1ÆôµÄƒE2Ì`Ì`F&NLLäK蜫©'nçcŒ…’FÎÜ (gõ§¾ýÜr$cQrB\‰ˆÆ ƒËï:Ø{(‹G ¤½MØxº==xg¥©-*¸ç××ñu™ >Þü}×Yxu1rô‚mR λôØÅçK”“É¥“Ç?h­n^)ûWÉgE˜Ñ@¨S¹Ÿy¬Î¦ tíãõöÍ•ÊÏ/9z­9òƒ®íÛž‘¯ci©ñ)›€¢+‹KݘŒ[¬ ý@ZW9Ùmí¸‡¶)&R©Tb ÍÀøÁ‹£ß³JV­H3ÂH§N’4ÈW•·1rç²yëÄ2)¸²qêOŽ!mNáÃÓ.žS‹1UôúÜž˜4@ªy×wDÑV£òo_8ûð=´è5îÔÞÅòÛd¤•X XP}&…[^ÍB ëàR}àiÓK´¿™/ßUL_O}ä¼äÊx—V~>þst9µa“£b†ýrcª ½@—LŸ‰³=ñ4Ô® „dG—M0u^ÜFƒ‚ê¢*™[aÈh©ÃŠ„âÊbuª5(­ Õ> ¡Íð½ ïï7°·å“ÛY?í½¢­4Þ4Ä:ÚikÆQ6Áݵ nIYÀ§–pO9¢ciwˆ‹‹ƒ+Åð?ù]NȦªhEê› ééºàëSÁqèxÆœ¡£7„_ð€;;"ZùmgS0hÙÎAõPBÒ˜¥Ó» ùUaŒõ÷Ås•34èÕgð™û纓šG rÓœQ9pÛê ³Gõ¥L¦Îã5€­VÓGWd¨ûõ1”{ÿ÷a)òfW+Ñ‚M3½ïkMÚí‹1Š…Pí.}ša( !Š…¡6wµ”Æ,âá[Oωä8›Ý9¾1$tÒ´ôT¦í.‹öÏ™\êz6n `¿ˆzÙóÎzyI¥Ø¦r£mb§@ZñŠ°xö âå‰5ÌrZø·+ZŠ¾úüµWd{nö¨Ñ«šÄL +[=Í;ÇdÚ‘U^¸þC f&FżRíDnþÂ|ªoéwîŠSž¿?jã˜!¿láÞt¨M`šy#‹Ä*$@Æ›é1H}Üî¤`gEãd›q4ŠË«ÀX¯´ØÓF³E±,UùÈúPmݧõõÝû4GÎp6ÀŽãB·&E>“-±a©ÖZ°ÈËùÃÀug¢¼å#ŽÙaû;·´™;w.¢à-_^3[è½t™‡¦fò1¢X:Ñ{:ÂLêu8ê¼û4Lë[X©CC—釩î^Fû8€ª(5u-£Iµ#¹iÖvÃT_JMóð«Ö²ÓÌ»ÏF\}]ØO±*¥ÓÛ?ú³`⤎tRbÒ¯1C+ÔhÃäa-g$lžb]ç”F:èÞÍ,°ÐnJê:”«m¢KKž‰ÁFèôwoCzvÑâ±?½æ+†Lõ[1Ëž£2òF€bgáyý‘°¨(ã~àÞ¨ùÆvŸ®(lÏü.µñ'To!àα¨Ì«”™é°àÙ½»m{:è³QÉË{|8§ëÌD¹ØÔÝe¿òoó…É+ÇXÔ·Å+%ÁçÒrŽIPM rÓ<”¦$#vЮ}®®nâÂŒk/ùñ½;ã÷Šý^ä»hʬ'®ô›[–Þ6pCîÂ+øÑÙ5ðЃ®oö&è÷Lßx]~ù…ïô1Õüc÷òA¾ãÓ,mé’Wá't€ãÛÇŽñt·îÞí}vVkïε h‰µ× ác3\¬_=_fê:µ¢ Óf…D ’q¤+‚f¨IÕ—Æì1z}fg–V¼/00FÞÔ=B"&Ú7ТÜ!Þ3¸ç¯èk¨’„)¶þ¡“¼<]† «Ê¾õçKõ”ôúkY89—.Z~Ý$eµ‘|•úó¸hƒ saƒs¸gŠZÛ]ØxV~›Ô¸ß£½ŒùÞn#¶roZµb!€'9»µIªáûäË=Â!\^Z"KÅÒÕ7ÔfSX",äÓíŒõ ²¬DP%Q×âjË>–³Ú´n€ùTô±E+–TøY ªÛ¬u 8êHDB¾ Ô4 XH1L J" ‹­ehÐ0@ÀHJKùÃbkêQ@&,.© 2‚0hÓFM*úÄÔ½–^«–šµ’*à‚~[]uÀŒôàdÏѯé±ë¬ÍÑÕ…ñmG*ÈÍw#á÷÷Ú˜~%B }ë=¾2ŸÓ®îÐxtdÕêG&©‘³Hµ#¹ùnhTæ›]¨&–LuvÊÀ9'Îœ?jÄ"1´ DnßRxŬ"ˆÜ·"€@ ¹!DnÈ @ rC ˆÜ‘@ä†@ ˆÜ"7È @ ¹!DnÈ @ rC ˆÜ‘@ä†@ ˆÜ"7È @ ¹!ÿþ b¬…*ì6pIEND®B`‚suricata-3.2.1/doc/userguide/rules/intro/Dest_port.png0000644000000000000000000012102413051004444017711 00000000000000‰PNG  IHDRz•Ù§¦$sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ÏšGÐ IDATxÚì}w@Îß÷ø¹Ïª§¥’ Ù„BMm£¬D…2+D2#ÙÙY‘BV¤"#TöÊ*Ú{¯g×ýýñ4žÆ#Þï÷g}Ïù£^Ïëuï}{î¹çuι瞋0Æ )HA ÿz II )HA*n¤ )HŤ )HŤ ©¸‘‚¤ 7¿ «Wÿñe¬¶`Ü|¯éªùN«ß-k ·ó ,±»’ˆÝnE1ÉMuDóÿZjK*Üpñ¼Bü1y[¼¾‰¶mjµqùý.Knÿ¿Ú²ý?Þò¯‡ þœuÑoâ*xÐw59ïÉ–¤?±¡ÇÌ=—uú d@pï覠ˆG<!àó•zŽØv"ܤ+Çm˜áÀð¤€QÊEÙËôuäŽfì5¦aŒª?¶5 úÞ“b<`¤Éßí3F©@è ×£ _¶Ýý8½'½-›jñ0öðÇ-¨˜¬=6ONA¨ ªÎ”W$ Xå¨mZÒcÌËGçÆ!°ìÙùpÞÊ!l—¡†iT2U¬)²†Þ›˜]ú£'“0Æ$¨»Ÿ¼²ïô¯eV„þJ.Q¼Òëêó,BÈ'ܦÓNÚ*GI3ì\G—!‹ÕTv8ð(ÐâÄr‡8’]üao €xŸOr¾tåmbôr“Ÿ9°@cÚ®?¹kf7ë6eŠ-È+k¼üùQ÷77v, Š–§ÉÆÂ:¦`¸áÄ=G¶u—…‚·ažaÓ÷ßß4®³¨JEÒ«£ï?ÞiböŒ3+Üxk£ó Àx4RcÌçW=d: LEú·CwÞÞn×Ut§æíuó-±Ÿî\TÜ1²Ù$D¤&t±P0rÝýÍ|ß)‡¾#B“ `YUÃgBDúþÝ/Bà7ÃpÀò«žæ½ÿéæ9KõGëG½7¸<Í“·ìé–~ã:TÉËŠ“‚õ–d·RçctY2ÆB$Ñ ³ÙªwSz‘%ã- ¢ùZðnÛ ›m ­n`L´×Ñòší4rBmCùV‰_bùu_ ­ 8ÊÏ9>'†®4ž²cÎ|£ ÷5bY«Lt7¾äŠÞ°fªéÔ%;³k¢g/£êÔËbbŒO­žçhcçxY¬«©–VN¦z“ 0Ƹbš®þù2ÜQÇ› Êi¸Ñ’™c—]ÊhêÞ¶ ƒB¾`ŒYc ~â6$kz±“Á Ç%í=iE…Rí EˆW&$VÇcâóý»¥œ_u'åôzËEAc_ë cÇ1K®~Åø«ÅÀQïíÒ¤ÄÝbÄ®ØLŒ1Æõ†£Î¦”‰£6eøüñaÊ·8â6·¥É»[»m]W‹ÝclšgïxcœŸrf¬•Ë˜Q6åBÔ±Š'çŒ\}Å[ðšbx³ÐÖ7ªý)÷Ë)I´Ë<-šçÙ<¨æŸó˜zò%Æ?-µG&s%vHP–bda-¹«Í@úÅ×s+vyO×71Ÿì4ÿC K$Úί5œ³3aúØQ6ïB/nµ1367k=eAbz%`,0­siž“£µ¹ÉLßà:„šT(„ßÔq²uæãÏä"fþkÏé㌠Í&{<ûYŠò7tXÍB—ÉmM'ÏÿPÌBbºÁ¯$‚ øBÌa°-æïºwíüBACÀý¸/1WñøQÿ^J$QÇ §,;åÚ+`án1ÚÆ4õánƒ ˆ?oÓ]ä$Ë4µÁcµiUò' dÏ°3Ïͪ 6Z%ŸÃlƒ`01 .KØö Æ ¬ÉÚâédhdjbh¼tÇ9.„ÐÒiC‚/$¬š?{‚­¥ÅŒåù\„ËF¿ï/u"Å…W–¦=lt™·‹/+;iî¸K·‡¥f•¶«—T±55»ðŒ €m—âCg•b3Û¡ ƇŽïŒÞµ4‹·Ö:&ëæì‚qÓ» nkjrÛ6Õ@I¡˜v.?o¼~zF®è'MA×טº`Ïc­fb•Ýz“ÛoÞúÕý¾ÄÝ.ý+V)‰Ú­¥Êâ]1í´ÀâK¬Èæ AÈoß¼¨úöz€ NëA€!ÐE€†Aú   @V@êÁòH@Áj5@Þ7+¢0»Ì;,ãÄ®©¥ìn¹)ñÒ¶“íô ìb3ªCWLu°3µý¡˜ €ê S¼¬LÌÌ M6†ÄñB½»yÐtä°qãíÜH±6öèG B̙Ղ䡣‡kÑ‘Ò€a£û¨BÀ‘0LÀdq€Ólt¡?öÝ Ia^ÏkG§s_fÜ Mj£Œ@ ÷ôWbÄ—2»óè•vð9 aÀ€wÄ,?˜/ÄMt¨)ÊËm†œªzÞ/Õ\äì›ÒÃmõe¢ ÝëKòÅÚÊ)­bÿ÷#WOï­í7ëÕËgÏ_½ =>µýe9(©u¾ÿò`øåøûÖh¾_°;@n¡…áÙø$„2ß]é£ëÚ…Œp{`Ì’Ý÷^|X< ­œcn7÷á‡L&/0aÖ„¼ø#ËöF0HPÃâå;‹æ."AYA±8MØ|B„g§Áö¡KÌ7uß¹ëûf Œ;0&HPYØ¢©:¶ ­LG€ï¼ûÞVÃo!Öá+8aýãŸu-ÛÇ€ÐyÿSÃ|–ÉA'ç¹C®ºÁšò¦ï”¶56­ªþ òò›ñÍ+þÖÌ sáy>\] Q{ ð@e eÁø-¼ä‚ÂÏð¼t€{×p=¨P…á]Al:WæÐRñá®[¶¤Io’;_¹}Qõw\eñ¥Àa“ =Ý퇫O`—‚ ŸRA`ð'°¾ ?«a@˜i çc €÷ À+¨-Ú+{CéçLF"ò"Ž‚Ñô¡T 7`,Y¶¬ 0½žJ‡Ók ³¦òÝ«gjÇxÐed÷žŠ€÷?k˜’ŒAé …k€ú˜"Z_Ïkú¶`Œ‘¥ëª²w¯e^蛾þœE)Î ›ÝWÖhr®²ýLG‹ðÒÑ"‡~*0há7çä „$9:`ÀÂ~æVõë–•|Ú²ÍvÇ5€f„ Ì>¿°W;~Ö_Î"÷»¸¯¶L¹(~×nßµµzŠØ „®îXœ\¾`{/5ù 6àF{ƒJ“Ñ !ÐÉÎbäöqÙ>ú%Ñ0ø}_h+U,´Q€d… z÷f?$ò8¢ÊŒäå¾9,º—IË÷b ¨xîM6ý`ÂíîãíV ~uB‡ÇÂۯƛ*µõãc@œ@W7Ë 7ÞïŸ=Ëlf_…f5{GÄOSog‚*vy€ 0ëå®±>ßbΪ·$”šÃëËV¯¿_ÞµY„VßÛXͧÛºœ!*ûûÖÇŒãþXÞ P±Ý>íšÝÎð§þ#Äõ¹K±ñ©<„`¥Ê¢ ÝZÚw 꾪6€Ø:Î?ƒÍ÷Àì‚ ZµW™U!Óµ™)1•N1 ЉŒ6Ñ'æœJ’Þ8ÁÖ–D‚þV>§gVÖ3;Éuá…1D%w°RÄÁk.ÇÛ¨üé,øq#£©È/®¢žd¨øVŠPV%tFÑ%ŒÆ)Ì̯“™¬FB5‘315tªr»/ ÓÕùÂZ @Âb!AE€ a%‹×II¶¹Jî£ ñ*S¼F*‰VôfÌSßâúóW½@F>îÔ‰û2j§k+a„`Œzºo£Çͦ–iý78ðÏg|{ÏÚÓY\ÜHbž?gÔ¡>3‡9n¹ð¤— éï5%—¯½ZŸ:E ˆü°Ö—L¿àáýq‚|mÃß|¨î¼A €D²âþ©€ƒ‘‰ô>ã÷†ßD!µà¡¸j3ŒºˆfiYðÚ ¶qC%w=8±*µÛ¬¸iÚ¬~6nŽæjÈüõÕD"‚ɦ‰&¬¹¾Ì¶»:îo:Ö×(xY÷à¯Ú÷aæÞ3CÔ €(‰!¡0>ø¯-Þí03Z÷,4àorŸ‡Gå`êOÏ3 úuP¾—Œ˜¯@òC %jã'£qyTŽÊ/áý6e¦­Ú?ÍWÈf³Wº:»;d¬<½žSß°æø„à¯XFaT1è6}^<AÀ•¯Trk+Öy­c^ضPñ‹¸\ž®"‰„(ûÇŠÈs?2R}ˆSËw’€Ïæ(÷ªPQuøE à}:«£;¥€\’q­¼>\ÕoÊ ¹æªJÊ5~sòø CF2 ôïw®Ujuïü_Et›5k¤âbçy/r™"´cú®¹Wué´‡xç ]6| ÷åkÍïLo-éeä:ŠLa°þ䞬×Ò›¹„®ðçM€œ"_W‹€™~ë6“Ĭâýb–ô›í¥ööòö×Ë7Xµ4gHÊ;«ªªªªªP>Ëì³¼Åù›bÎn¨©H&µæ¡â¬´][÷Ð)‘ÂCe-„ж€¡êõ…µËO„oÄËõ™ê;†ì¼ê¢ÈYö ‘;Îl/8³>:ÕšÝUƯuÑÞuà Œ€Wûñ'[è:ª¿²²ŠªªªŠ²’Ñø)U™ŸÒgÚ„6! d²y‰þîí‡dŘBžúçc¨Ø '* Ál8@N"ð9e—®€Ið 8Z4ÅAs¨®ðç³ßs‚»X8>«@dºœB'Y AGŒÒ.x•ò!øtr)£›„)I²ª„íJ^YøK¬û{Ú Æ`µ,ìÙòÅÃÇĨwí³ƒÕD¿*€Ç®cð"‡Ugéá „ûxS.èzÇNŸ£Š¾2ßÏ^fŽ£Ýϲ^fóÂü[è]òÓ±íÐQn‡Gǯ\áh¸šGQérãT7€X 9jÑ÷osJ¸ ÚN/#5 vŒ±Š¾Ï^/´pìÈj=Òë<ÄêDØI³¶–#hÑyf] `@€1ö9?,êÔÁ…Vó‹T²¬É$׳wž V¦—ÉdsùX¥ÿè•9“ÎÏ!ëjê ÌbÖî?t¯¸ ÈQ{ø#±—²Õ×Ö‰AaÚ €c\wݲfÔÖžž>,\\G(\O9¤¹n Ÿh·Y¥5Û|–zè_è¤>lââË!¾&“<üFÞv=‡'lô)1êÜÆYÒmæäþaß5Lä~!”Ðü+OÄ‚ÄZ3>Æxñ[Æ ×#Ë+êë=Õ3v£@WP;Oo¨xy6WçKún—ÅÛæ'j‘1ÂÓƒož7³+n¤ÿd]Q“F-CÜ ›S·ÎpèzñuV—™ñ§žÁjö÷Éëop7ð^ºl|r8!àÔÕ³›°tðß}ó¾éWVo¸³Á‹7dSzC BʃW«ðÞð81PÈ”› Ú´Æ9b僈E=Û¡Œ[WÇjjßÊgkÔ-£wLÀ˜Ïâ*®ßa¥®Ïìj4:˜uLN;äV˜;]`c$¨õ‚³É¾ö>†%±À®hB€ˆ>ÃÑÁLùEÉ_S­U Žè²,à!‹$”çøZ:™ÆhÁä-ˆ#‚ >;¿ ´)ÊÆÖ|Ô§bŽ$ì`˜Ä©ÝGQþÌ6C¨ÕÉ°¤(ÉA+¨C,šê.XMî" ‹7‡Z£HBOD%Û–oždDë+óJkÚXp…þ½5[ÔlµIÚ~i%‹ºÒô#÷Ç×´Gáç³G>ŸÖü˜ÖF¤… wlnò6wØ ’@ȶtý š Öh±´&aÐÅWÐÛçTnM~~·wA¦ßíâð‹®·îvJþšl­Ûyà> b¢hð ÚŽ"Bdö^Üe8ÅÓùÙ…N$ÜÎÓÞTBí0?€0oÑ„iëOÚù[±:Åñý5d@v0L-âþº«ø¯Ã ÁºŠ2qó§r×ØŠë1Ôþsðñî¡ðÇ5­nò”G^ ^ÿiˆ>šÁëz;fµqÅßò0Sø?E¯Žï¼ZÒz¥ŒÞ=âøŽÿ4j$(Ȇ!Ö|4Û_þA€)Ö—–'mLÙ?GÿO¿#˜¦}çÅýý;÷?bh 6}çNÆóÛô›/–&•‚¤ðo’£Wtà5o–üZï^ý-¼­7涨†ñ/^׃ŽñŸ•û›îy)HA*nZj=¼$Óq6vvvvvvööö¢‹qcS(ûÕY;;ÛF˜€R°,WõÑíbZ}üÜ×æ¼ ¬ÿcA?NnH*ü3vÁ·Ÿ³êš5Ä^1ÙEÆj¡iwrå·;¦“|z™8º8Ù>Þé¶6ò]“,£Éhæ?{z5³NÄùôvL)ŸLoƒ®(È!(û|›ÅVí¡$€žžÝàºã–ÅTW§‰F—}¶Þ+Ò°pë®Jd`çjm(å3)HþòB¸_Ÿœœ$2eßö¾å²óÿý7nÏ…#[é"Êêz<Á}@Û}ëx†‡Ï•?žÂˆ´oãÉ+Ç?Ï¿™ÆP˜0®Ó£ÐƧ¼‚—Ÿó[S"´f÷Œ¸˜ ÏÞ:LŸØÁ–a,HN©í¤¥Ðuð™O3E-?‰$:YÉ“E©Ö1ü÷%ñ—‚þ—´±é‰MW,µNZëìK‘ïþàÆ~›©Î±4Ye55nMyM oÎþ«î½ _kí°Ò妦Z]EÉŸÁy šYešhcÂXAÛÐœ·* ™±gd ‹ÌaÕ‘f.då¶û«êû¬Y³D?×ë`t+kHƒNmmµÈÛäeÄ„ §÷[ΙTdbÒ—–øð±ñòP£a=Ä £>‹yŠÌìÝÛÙ­B£{¼(Q0rsó Y,ÊÓf°9Àwü|—¬”i¬ï o¾Ÿ¼sŒÐKQùdØž’̉ûÖÌ•²š¤Ðñ&Lð‹ŠJÕ»u§6wÁg×–Õp»wUo´W€àÔV0»öèJÁ!„œÊÊj_H"S•TTd©"—0bÔTÔ28dyõ.*$ÀµÅ,ºFWåiHØÕEU|¥îjä‚¢únZê¤F9À¬(¬á¢nݺŠõñصeU ±X:¬¬®…ÅRç.(E%]»QIå…ù$%ÍΊ4Ìg––W •WVSQÀÁÉ+®ÑÒÒ$a mv› 17x©ÍÀ6Äà”ãÆ562UFE­‹,¹!'—YSY]O J'Õ.Št Æ ÙE¥Uˆ¦Ðµ‹²”Õ¤ éž©zঞ7öˆ}URÿ‹¤ð_dLýŸ½B–³•Ý7AçÃ×Ïk¥ô‚¤ÚÍ¿X»i{-)Hᒔ͢Wµ¤ …¹¸á2«²srù {£*§¨¸59ÅŒvõ"Œq^n6‹×~nwÌ®ø™[þ{ʆ 7;‹#À¼¼¬¬ìfÈ)©¨–kÌ—QT—WPÄä ¡* ²Ê™B»2'§H\«ã³j³ó ›~ÖT”äädggç•Tija` Üš¬Ì¬JC)2+²´0/Ó IDAT *‘Ä%9ÙU\‚[Y˜SZ'@XZ›•[À­+Ì)ªÿ÷h¤MGýH*À©)ÈmËBnVv®@È,É̯–À[•?sÊþB/ê+ò ËY„¤þ›,É‘bdlät4µé¨âÒ»GLlÆg\žg·"¡ýü¯ ¹ŠëÚmSðá ¾ãîßÊ”+,²6žZ.À8Ë~؈)s-\¸páÂ…®ÓìÌM zØ”‡µìK´þhÃñVÖÓ¦ÙXŽ××3N«iÛ^mJ„ÞŒqÉÛƒcÍ<¸bØ=¿=+¿Ç¿\w5[÷·Rÿ lv°)ü45bæ8ÏøÖÈÔ|Ó3°©Ä¸>i¡ë¹ök¦ïdáÏÿs|bwÛ»n}Ùê¦ÿdÛÂ-ˆŽó KÎõüo¬ÿ~øµ«˜PÔ´(¸²4ÇãQy²¸…¡=ëÜÝYÐxHb‹Ó¬[~”Öv]!˜<Ü÷Ý-À·Í¡Š%'»pѲఠM‡öqÞXÎOž™fÞ±ó^Ù»\vþѼAtQbÌÛ{§Ì›;ô]L˳|xëVí^úù×—¨¼3]6úÅ}õ†¥ù*÷‘ãw¾åø–avíþCŸu[¶ïÀôvh‡P]Á‹•¡eg¶Oùu†×=û7è-Yã–t’ $uEPW +¨ÉËóåÚs$aT\Áìal¿ßßëûå§üKM?q³9(REdmhEêÆ#éPëá(y›EòjwpĶ’¡vï(˜ï}iÞÎXc±cÃ[bÛmì~4Œ1BÅï³Iäön’9 ·×Y\5Ö%ºÙôÿŠ’! 0&µ[RjLµ M5Â{à—ý|hq6{z„ÓØÅw1B(h¹“©¥‡ËTƒ±o—¶˜X¯/n1ŸæÍK—-H Ò¶ÚŠB5Ÿ†O>ï;q[ðñmÞƦ®Åú]…XV¯‹®«fÀó›{5ûÙ»–kd}ܲ߫ÄË}Z¶U|k×Ûs]u°à„Hd©žO4iéªçR>l-‹0 Dê±G,ÛY“§¹(¼Û™Äjמrê³³Ê:Ô))ôx·åF1ÉqcÐ(eªòXÏ€‰Ã¾Æ½7ÄU‰G:W>¿~úÁgFæËí{N¨MC†v.›af=iíÚ•Ö®›¢¨o8*—èKÔþaÃMîÖ"ŒT?2åÎGŒéÃû\üÈA#^Õl+³© ü–ºš5ÿR €>ßÚinfê½r•«½ñ8K„.m­”eïÜþ¨ aA唉Vö3=|»˜™œ{QÑ  yVcm<½ÜMML¶E¾ŸOõ—™z !ì;vœ¥Ï*ßÖ†}ùEAf‹»Ýtê)Œ9îctîT4ÓÑW¢j¸Bœ¾¸®ÁãÆXPþYßت’Àe·VêMÜ*gn^ÒpÉUc̶7“ð]d›—Ï7Ô7¦‚À¬£u'•`,¬Í140ûP)=Úän¶éÔs ¦ o“…ΑŸ ?nEåVr¸©—‡¹”ˆŠ ªlÌƼ̯ÇÙáCu bs…cVé{cÓñõ<˜—rb°…ã‡;'Ùû\µSš°u˜Ý&>ƸæÃ0=Ãýoj^ƨ­¬cI-©)Ñ—€±ÒÄeÑ„¤Ø6ÇBlì7I‹hãA6klc!0?Eºîuéî•.‰' TåéCè"XF^–ÅfIB*ëMF€@N†Ôs„ý¥øý€0—‡i 2.%å” é©Ýq_Écß­‰Ù_>|þüâÉ£™c5FM>unŸ&`€¢äOÅÀ0{gfàü 5ˆÂ\<Öø3Ÿ€($lh ˜¿!,ÞQOCÒ»úkõ+®zÕE•ÎmWÌ„ne©ÆÝù¡;u¡FʽÆX7¾±—Y¨~›g«­øú%l8c¾4ð",ò?U´ôô@¤¬*j™}#:§ëlÙØØX ‘Õ• nàÃxÇ1›–¸ÖO›`o?Áfêt Œ±\o+ÃëÖÔqx¼ò\!mxƒšÖ}†"Y¤qNêÍI){Z«É÷Û·pA¦ƒ½ý„ Sœ§7Ä*¦&Ýɘ,× †b.í>lòãÛ±(dŽ§âN¸uþÁd¡AZŠ€šÝ¸.1-µÑ¡Ú@uIE^q¨²(2 tFžÎú`Ü.CYN3Zë9›=m¢ý+Çét%U¹·âÇøX®p7 ýþ2þˆ'§;®' 0¦« ê‹9÷‹XÓ{ÉŸ¿úÔÆi.Xѱ¹šn´J’º)åûÂ=‚ÒiÖh%oSå•T¥zÍo/„cjß™îú ! 4jëòµ\‚.CV‡Ñh«'v¦å>ùXð+9€D›Â;V2ù,Øóâ}JJJJJÊX šº‘“ž¦<@ÒÖS+y–(nêáVÿE-°ùt¹†TYˆLÁ M)×B!‰ÔŒF—Þ:¶Ž³·{“öÞ÷bþÚ‡£ŒþeBb‘­‰‰‰‰‰¹ Wûxß”¢cù°§Ÿ^½zõ$z­¯×«W¯^½NqÔÓøÅ‚ ]ŽÎcÿõ,uB^–Ú(ÈJ2¸š)¾Ø%5òT?úÞÛd@ÿ8ÿ#Ƭ§ld¬!/FA=L®/.,,,,,ÌÊå¹,uSâƒõª³¶Í•­ÿ±m‰½•³Oƒ?2êSØ‚¥ÇßZ;Ï_½fíbk½æįŠêMéÉd©|v{ç'/ Ž=´Â‘WôÞw–™ãâ@¦è˜QŠL«Ñ¯å€ §:?¿°°°0'·r’çü^“À²d4$÷§I\ïp’¥FÃr4*‹Ç–¤Ñ[,?¹ÓCŽ™¹Ók¢¥ÓÒ¼z`óùT!?/_D•"ÃY.#40–‘£‰ø›D߶¨ïáàdAÒ‹´‰“lõ< ©‰’y|Wo×N"Ê(ti@E[çÌoÅ£`ìrgÔ´øNsZMcƒ¾r‘©…"ç#¯¾(ñu†•¼Ðˆ3:EW,–/5z3Pîo;Ép˜2€vE¶;ï¥Ås#-YdàäµÓïlF½Ë@ÅFo\õ'«q^{^¼Ð;²–J§rX‘pQè:F@\­€&­¡Ê‡× ]:À/í¹ “‚\‡ˆ–W’gÔ99¥¸™åñÐeˆèœR`çÄ[Íß*\}K$k›úÇdróp•NÜS(ÒˆØ,6N‘äÃì0ÎpT?ú•/E -cæ§:Ú¼Þ² æØ£f\ôÅ Ck€î3º–=ÊI%l”dIb‡…+ŽéG¼ëëè5»Æ!‚ÉÊË ÊËj´ mµ m—¯Ù²nºÍ…ßÖ5Ÿ.Å=sþ‹ã‰D³atH«®¡Dt@¸ð5À$Œ1ä³Ôúª´žã‚’2¦ž…ƒž…ƒßÆ]óÆšÞÈökwǪé ZÝp‰—µÈq[WÃTRt§Q똌he¾/½ö½ÎòJ=x‚Z> YŒ¡¬ò¢^ª#%p“°¢¬ºÿ›ecl–­Ü4ËþBÒ§9=Õê^Syz‰Fª®ªNQU rÄÎéè={; ™_òîgš²³uO 4º ­ÿT/'uŒ!‚Å!äd1ðÄ>w¸…YªÝüÎlGzïZjðÌU9J ’ö[¡˜´ÿÌãôââÜ“ëÜ"7žU,àwã¾Ó­ûòÅþH¢Çî/ˆŒé£ÖOÔõZÌ„1î>ÊÙWŸîjfpáþ›Ì¬¬÷¯ØL˜?ÜÃ_¿åñؽºtÏ-øc9Mý}Tì–¾Mûžy3xŦkÅËwo€†Žüæ°ëîK²sóòrsŸEõ¯ñœC”ÄÖÐÆPi<„ÓµŒT˜å7òy­ä YFq@o51ÊñŽù-ŠJe#„„ìüU+|+Ù„¨BfA¶¦j¯6”&no½ó•Õ!c­^)ŸxàÒˬòòò'WCj´LïN èõU¹ñRßÀLgëÞ¬»d1!ÎéÝ[SŠ0eãêô£n3óJKŠã÷-4vݨj±•Í±¤oEÅ%¹?¿W3jvŠœŒ úãÏÒrÉLWæé•{¥åeߟ½û1Ÿ]RQÉá çSì»ååe‘›’Æ: oGùÈt1·¾ò6«¸¤$ï{J.t:Ë´Û#‹ÀM³öÚ‹Œ²ÒÒ÷wŽL˜ÇŠV? ¥ço—”¼‹>[#:¾??¼6àj:Bhr2‚êO™¥l¥Á†tÏ©ä’²²ÂôûWïeL™9CBxT…§µíáÇéEÅ%…y™•uÚ]ÕzNÝ?ëÞ¦«ïJJK³Ò’,­­?•°[ñ¢öÒíLlÝçâ9YtsʆU©‡Ý>g”–ÇÍ3žs¨íѲY÷"ö^y!•5ˆ2•ÞI©yÅGÏcçT]•NŠò@–URV¤¦éß{xñKÄæù‹|˜†#ƒ&a€NÊÊTÀ–¶à'¯8õ¹ù@UŠœª²¼èJU¥SÓë•”e[Yjˆ¤¬¢BA@VVU¡5ÍŠí¶ž7%=>—†Â¹Œy¹#åê•>>¯ÜwãÉþ“Z±Ù,‹!÷߈V…1&ûEÄ]Z5*dÛšeËü^pôž¼¹o­Ž`r7ÇGÏïÈ|»å»ÌËË{Åõ¸—Of÷Á±ÛOjÎÒ”;ž•¢²Û½÷¹·ˆ–/RêatrçT1Ö"ò3¾Õ  Ù™?¿ñ„ [Êß$Ü4Þ­­¦ÿéaÌë\^kgƒ¬\'9‘8k¢üƒÄÈ´pÿ9sÝ£~j&Åž-ŸÍ·Ä'º!‡´ôfð‹‰UÔ0ïmÒƒ¼j!ÖÔs{p~ý± ^ ’Iöooúc¬~óõݺ¸ý æ{x­Ùå~(vÊ0M é¬08¼lÁõ4ÎŒÐ{ÆÕ×æ¹¹G뉈tì–·|à ¦u³Ú¡üùÒ|÷y÷9£âÂ|0 ‘UU”Iˆª ÒI`àƒg©á›=< ·pÔ‹:¢ã%B!·¤´êïÍT|{·Û¦›­ßÅg—×þ“S´½ ŠqÊR‡›o"ðO¸¼¬”'Ķÿ/6èljù["ßþÑê-Tõò‚ý‚S-kñcÎF2Hð#éâ³2fg]ºpÁeY(¿1{þM¹Hܠ̇ÇÜן׷w×Ósžß~‘^DTýˆˆIøÇh‚GóãÎEÖ“!ëÉ¥ä†ýƒÌÓG®Ë¨’³>&_8{ÐkÿSÔ˜3£æÃý+Ͼ³$ãüµQãñøLž¶|ß÷Â*6³öÅ­ãcFؽ*á@ʃØ;)?D½æ–¼?y¢ù%ú’7½üºŠwiJŠªÃô¥ÄI.Ìýù£šÉ¥ÊuÒÖîCNÚûï}‡£#À|æçô¬C‡Ê“0‘ññS×á#E’«º03·œAWê¢Ý·Ð5ràÊ©Vf¼¸’&3)í£ú þª²Œª¢œ‚2&©jôè©©‚ª2¿Q4‡öR¹îÎS-E<\Q˜]X^ $j×ÞýÕ•d€àVÿ‘ÏòÊêý{wmw0*¾gð²zþÝTéÜÒÜ›/~RJ_¾ýÔÔ¿¹Ÿ*:³&÷õ­$÷gI5QdzôÓV¥“Ûu¬`fÉûÞˆJ_¾f Iô¾:ƒ•(€ ȃ4„éy }½APœû³¬šA¢Éõîß_‘†výóç”åØ?~ª7œJ°~þȪçä:uÑîÛ$€‘&Nžª&GÁÌâyBî¤/Ù5#õt@iÞÏ’*M¡³vÿ$ BNÍ—Ÿ…C‡ê’ZLŒd}¯¨cË+kè­)Š4ãÔ”üÌ-E­[­. û㓬†TfÖp”Õµûtcå»ø²Š7:'=»Ûà>Ý 4÷gq5ƒ"«¨­Ý†0ðëÞg”ŽÚ3=õGHîÖ°†…_U|çùy’fjZúPÞ©©tõd)t U €Þ‰¦ØEør–ƒê¯Ÿyìè9¾$ö+{wÍ;ôíé—/£7}¦†9úM¶‰?"¬âÃ…¹þ7E?ÒWmX©BÇò4*$2`!'íK†¶Î0±¨1Fñ×\^¯n”’œ²:š¼ê í^¤†ØNT”ý½¼–%ÛI]»O7Pž›ÊíGªþYEî5|@'$dgýȬe Õºõï¡Ž€à¤¥~믣G§Òe)d%º²Œby@| /Óß‹ ß0è(‡oQ[¾.}¤C—øOÞæñ¥{Bb¨Jc„à«Ãs¶zÅÜ lž›•iŽ6žS$Ì¡„ñÿRFm‰Ú Áªþú£ êSÓÒøMòA°—Ý¢õ;Ÿ¿z²ÁKßvdmpIÈ å ^Ë}N|á `¿œ;ï€*Òo;/ÝpïÆJ©›n¦@tÈòãq¹U™©e~IË«ãCö5kk§ðè‡o_ö˜118¥¼ Ýáñ â«çV!@Iâ67ïØGOn_84ÉdÜ£b Ì}˧o>K~°ÞÛyññÇ!vN’±±ýÁÈ„'ñ.vÆ÷ÔkŠ¿3+ò¾þhiÙåĸø„À» +f,^û ùÙÍ“Û­ôǧ׵ïÄEw=|6.u[”^Pš±e¼ñìz ¼ó×Z»Ð;úÁSH:àì¼peÂóW—[¸æñÁe|úðsËSS3€Ä7ÙzõÞS¯_'ïðše½ð8B¨} Vùx~¯à ¢;î«÷oðX}/¼=îî´`ÅÍ;w¶ûºÎ^!`¥®Ú°¥¥±‰B7¦Ìóñ¿}'võ¢iËÂ_"„ª>^37õdtÒ“{‘s,®¦UÀ¹ƒ¾ë}ÖøŸ{V–ûÙÛmÚÁ÷õ¼Òœïµõ•ù?3òÊ 1x®Ó¿¤—¯ŽúMÛÄDêRçy­ß6wúÛ¬’Ï÷ŽÙØås@PWžš™Í­)øò-óŠÖ¯^UÊ$äÅ\аZ{Õg fTŸ<àyrÕÚ|¡DãòÑÍP]}7cEÜtؼªñâgI=›+ nÁ]'¯ ëwMº¡sƒ©Ï¾¥“FûZGo!·xÝj¿ v‹©ìû^ë÷κV\œ»wÛ¢=1!„àþ.'×¥kcããü½œ~I—ÖùúöÞq:áSÞ\;ë{Âß¼HXãæ0wÏC‚¿•E €¾ÿVd7s¿+«tÜ>zgÆ\ƒY¢ªsÚO×{f !ѪÆžùíÙ¨"ÁcÃîÞ ¤5Í@nÖ;—1ÛbVY¨þoÉš†o $(xwÝlÒ<ÑõìI†q*ª“Cu¬c¼Õzï•b ÑGŒ¹ú{ž>µkö,«ã¼WDûȤF8››Ã'0A¸ê®þ@Û,Œ9ùoGŽÈj¨•á<É-S€oì›âà¾IÔÀçss†U}¡oWÐ: —øbŠ¥áçb.ÆøÞ‰5 ü/aaíì1†G>ÕcŒ3C½¬·\Æ¿½a`ïŒ1ƸÂÖxÄ»N»?ºÔeñ‘ÓË­‡¹ùžù+Ù¾þ àOÂ;ù×¼Þº½B2é$û0£t–õGRx1QUžV¦Ä§S\ ²ÍGÕ¾v 9ž´mUÉß ÛsYù.®ŠÜfåà|,ò¡ Ù[C¾Iþ#±4S®;–&­u´Ÿµäòý^ýÔ(º¦ý*?·¶Ý|®„£8°¯&@å‹TAuÖ­      Cr5OŠøtÎeýœ+ -æ­Œyö­÷ AdÉ’ŒtA§Áúr€E_%gÖ¾òH: µé2²Šª$í)Ösð·âŸb4„;Ï«ô'ŒÑÎù®2õñß:v ”t‡ËBÀ®M'“ä;ÑÈãñ×GÈá&U\üS—“óSU]"Z¤ ¹v+\JS¾ GYõá&§7]^ð±’@zöÔ\AM8µâ]/ÈË£rŠ¨´»ªNöCÖ !«6ZAt|)d._œÄ¨«–àypOýõíW¿KHHƒ€ ð/Tcü6†„®¾è3#9‡‹~í€G’Á¤^ÉB 2¢‡L~j)”e(tRí®Ä }%îB_2!Píi€ĪÎÔ´=AAAAA{NƨAÍÝ\h·}Œxß+êôÖÛÙAR:ucÛÕ¥Ž5Æü—Ê úpþä¨õ!uŽlˆ)Fÿƒ Sÿ,… 0"‘É‚)x¢ÝT" ˆÍ6Fï±OVAUññ‡üâuÃ\$$šl#É¢]%«“Qü“ÇÅÙ÷®Ÿ3¾ÕlõÅCnýÚSÒ™óøîÄ¢ÜôëgŒÈ[rÛu´ÚÙg¯KŠ _%ÜœafÔÅnMôöq>˜N›;±KÃΚ ݨtm€õêÄÑóò~ºtjíž Œýî÷–môId’' DƒN¦‘´EÔ°ƒ™DB¢Å¶[…íC IDATo@ˆ‚0WÐ1Û`2•ÒØ~õQ³@– · çPÓŽOL`D"7à† !>ÑœðOb;4yuW—Ù >k—ÙT Ò¥Û_Öæ{lóŸåî¿~z¨KÛgÚZ7“ã`ö¢¶{]ESÙ1ìî@¹°µoœ]¢žÞèGýK )2bB qãðµ ‰*Jr‚…÷4¶wµê+ fÍrWД(8Êï’Ÿ±¼åÁ¯X^ËÒ[wûÜ}ÏŽh¶ýØ«Ré©y%úÝ{6 X ¿Ö™³qîxÓ©7˜8Ï2“ìÐõÿÌBx;|'Ôí§™û£°a¹¡—µÜqý; ×'ãä­÷ÝúÛГKøú(ìu;7LNFÎó†ü⥯ªù}ºÑ[~z@É”jž¼Vÿa‹6|paéÇð &Ñ-.価+©öj²þ`d€ÓÈ„Û1ª¬Ù„f÷>S<üž½ «Œ:–ª£yY¸w¯^½z÷îÝ[]¡K7Zƒ;Äìk™øò飼r—A£¬¶ŸŒ5H%öå{I‰\óý+cÀ8¥›ôQmŸiˆªýÙ¼zŽh7@záÏýš…Ëá “¾7àÁ­|ÃR°(óûƒ@W ÀLÆc„Ø»<>¯3ŒÅJjuíUQ^c„ª6xzåƒæ>DÚ«n‚÷ëñ°Î4ÉSèÚµoM=£{¯Þ"zÊY½³’d}B4=0t¸ò±Îô Ž´¤•'>µ]\±œêùåãÕ{…¨éœõš÷—FèÙýhØß d2À@ç½k-ióÜ6 ± KB9ÈVŸšÇ]ºô­«¯æ7­.ÀsñWN ŠL#÷å}­VO1zbµ³Œ¤öaÇS½gl­˜É%$Š¿úmy[ ­7ïqÄs !âT@½ ófê+ÂB”&E±¿å­=Ó·;M.üYhÅÿ–vƒ5íÜíNعw7(ãit&EwÚ°î`0ÖtÇɳ¶[ïÀH÷~ût܃ؘÀu5yÇ®Ž¬týàÑËviž¸4+âÌ•"cKù¤od¼ç8*SØ®žï=!!H>°æš¼cˆ§i÷ßßçÐÅÖÅÊ€Â)‹¸÷ÊbÃÚŠœgn‹Îù®ñê­JKMº„ µ\W¯w\æŠWõSÜ=»¯ÂpG„ßx™Nß>=Š»+;ÙÞòöšY1Ú›O-Òm+áåM‹ŠGºL7*¬Í‹ýœ³jå`II ¨* '­œê:¥üã,–²C?Èk&‘¬Æ ¯á²ÎÞÛ|œÌªÒ“/>矉wšR7NíÝè›×'.ßÓkÜ” GÉvCº<‹:CÓŸl®øûçZaªr¯¥£•g-Üà9Õ(çIäýúaT >?Åg×ÅS'‚)âúâ°ñ.Ýö:.ßåa5øc\èWÕù=ÜWxÏÚ² ÉW(;±ó¢{ð] oR&Ëœá< ›JMÁ×+±oV»8€ÔÚóè²ëlº‹Ý¬µaQ{·OE„„œBïe›·Óo !O¬Þ>itû§öhM7ôåÑŸ3ÅkëB;½/÷N¿£LÙ. bÛ+ÑðuÇԌ֬µÕëöåñÕsïèoî#ó ½—øû ï¡Dn<q¿<5Z .ŒIê§|Lg?טdÙj|7\œW<ÝÞbÒ´É6JÔœOOb?—n_–mÙë¾V>oÞLwô|*OúŸImAÞ²e‹DÓIÀ值Ñh=¨«­Ña¨¡¨`3ûÿ±÷ÕqUeÛãkß¾  €cw+ÝÝ "`wwvw·bw·(*6 bS"(ˆ„ôÍsÎúýq.ê¼ß¼÷fÞ—ýù8s9gçZg¯½öÊ0AÖ›ço’ÕÛØn]6AÌAÒD§N®Lk@¨&®V났‚Ð@¯?êðˆ¤ §¥ë'¤»±)ÜÏíkK¤%º-Í;µÐötk›ò6QØD¯[ï0Ë&ð"þåçìbS¿‘3BÌ @ÁçÔ’zí¬:4FñM*p°1¶ T_þùåÛ„¯EL¯ KzY4ªÓH¯¯[›—±±©Ÿ¿Ö×óY=+„ƒ¨ÕÔ Ì[?þé“Yæ=§Ì¶@ÄÎ&†¥™²êV&‹2Þ]-nßǪ!P²o”¶“•žKÈ@aNâ«÷Éy2áðùëÚjV/õÿ¿î‚ìÂñ‰·/\-à6]°uM#-ý¦Ôu´îÄ‚È1ñ m ™OãÞ(4Ú.[³´•:€Fƒ."é—´¥‰•k¿ßÞ>{™ô¹…]ïÕS‚Á»° ÐÔÂF‹¯ü&¯çhÓ…‘z…´á}}ýþƒfGÏ5óqeɵƒ‡|C¸OQäÙuï¯]’ô6ås3ëÐåc}Q§EOûVO<úôê=mm/Ó?@RRؤ­Y›ÆÀ(J$‚¶6&ͬ r>$ñXèµ1÷ëÛ3b_½/åý¾~a0Ô·RŽ½­){I-*,èldÕPKТ£¡2'íK ßÚ¬CJJ†‰¥­¿ÊeHQX*¶¶Ñã‚üº­,tŠEM:[[˜ei1·IG«Ž±…‰ÛÐv¹_2ò‹Jµš.]¿Æºu])ÅùEí­lZkp !ˆ\w»äøçÒf–mëÕ@Úù­=[,{ Ô~'WÙ/O^/ ]äÇ¿õèå&K'÷ä"p-»õo(ÿø&)½¡Y•Sz¹¤P½¡‘A;mD¢Ú?àÛûØ7Ééu;ylZ>–‡¨HIùlda«.øî=®”fIš:Ùë@!-é´6èЀ‚ÚzžEaËÎ&æí3J¹„ˆmÍMX¦Êʧ·q£ÌÌ/ÅRª­•ÿÖSŠ H‹‹tZw6hÙ€ÍÞÁ¡‡<7)™nlÜ⟓þÿ¦gê·§ë×Å~ûU¦êJÒþööcèÿ˜ßóoª¤™nCksŒÔFJäлˆª¢™ª.kMmù/Ç*þŸ+ˆXÏ|ü„ÓTdÀ³£§¯¾Âp+ÛÁȃÜÛÐ4óχ¡–-XPJc•T$FCfôjõ[殢FgoîüçYaü§ðM¸¢ãwVI,CÓL­Ãà´ÔºhÖ´ƒºsÿÊý3±MmÄÉß‘£l-‘®%7µ¥¶Ô–ÿ½ò»Šp¬ |X!ûÖܶr¬é¬‡²´ÜXC'54ÇdR5þ]µuåª?ŒRqõÕÔû=‚]óèÿ(¦à?¾ü%ÆkÌÿrS–“€lê6‰&„ÊñÐ3=‘Å”óù„03[ϼR@ˆ,axˆ¿™µC×®þ–f¦ÞÝ?)øÎCB t1г$!«òzØú°© ÈûUF¦ÞcFŒLV,šÖÝÄØÎÝÞÄ»{ßO%•ò.!"Y:q ¹¹›£•ƒW𽯄æÊ’ñãFöÖ7XB!dç/+[ÿ•2¡& 66³q±7·qñÞv=©9 Ù7·vu´ó¹¡Œß&„(Ü,ÍÒäd\÷KN¤%Dnuë5ƒÈ¾ZY˜ç”…:ÿ5#IKílÌ_dIþuæ–溟þK·sɳ£[N?ÿ­5æÑnûõÏÿûǃMSÓHéÍáد¬îRIè§áõL&³¯žl’J×îè¿ýyõËRpkf؈©cƒºN[¶ºGŸqJ,ô5¶:•UQ?CÏqí8ûj>¢r¡·å mwË_œZ>ÈÒgL¹óJÑíÅ惶,h¾üFî^{æ…L_º¬—‹Çú9}FŸÆ„µ]¼V±¯žä¼@•ãqa°ËÔ“UÚfžeì6±cŽ.°ë>¡ÌÃ榅ÉàbDÄ—ŽN¬'Õ³e^}7³ù“/¬ÑwLWÕJ¥¸vtN*_Þ×sæ¾ë¨²??Þ?ಠe¹ö¶6ùò ¹4kÖn1 ÃPg›ø,É$†aª*¡†ùA-Å "æEÛ{.®¢ºúYPÞjæÅTñ¸¹³nü¬]«©Çü8O¦¼ê^2¿Ôñ1Õ94ý¸vDmi›Vƒª®j}šAÄñÖ6~–Z=ÔßÝg µ\–îZÔ'57ë«T÷ø‘ ÖkØÎÑÁ ¸j®®>B." 쨻íaI•”×#–:ÛZÙÛX ™—¦¬ø’\Þ1ÇÙÆÆÝÝÅÖ¹Çñ˜}²±ê+£|¿FÏk9ƒˆ˜ØÙìâwC™oæ¢s*[G¹ú¬y :Ó¤ïíô,Ž³Ù­ó¯ª¸&ÉI_•ñZåýü*öAôÍ‘!ËÜýaÅ9zïÙiÓ²[Û7ßdˆ8k Íºs+• "ýòɃÌ"ªâ1ª|¹ÉÄ2ŒM}mM¨gÿMXÎÝäFöê:ì“Êoû¸­­œÆ;3ýVE²­ŸŸ3uËsZžnoe¥ZtîÓ¡ •ˆßž¯°÷ZÈÎ0ÐLïF:ƒ ¢<ËÅÄþ¥¥÷¦šEgЈHg<0¶ôÊD,|²Â±/›dûãM¦ÞƒØ)f¾~÷±·Ïè5gÇ=DDé ›•÷Ø1W ÷¼ô ûûäD›a§qTÕþ¨LDŒ¿´hä”­ìÛ­ƒºößuO,ïæè7}øzUÓ!U™PÉ»]!!³XÐEï˜æ5b1"¦^˜dï?“­°`ë´w3 SXݙҥëfÄÜ^g3d(‰·­ííÏÅtìÊönál†nWC‡DDd>¸˜›%0È Ç[x¥!2JÉãGOdÊZææ`wƒˆÐoáNýŠ½§Ú V·yà’§¾+–¯ß´âÒ×/Ÿå⎛"¶›7UG O–Í£=ætT½‰~œÕ+œm]¾¹l=qL¬QÿʉUBNÅ£H.cxu¾» ù\PVⱈ_ø˜åžc/:œ0o*>³i·¯bF\ H}[ Q·¢ñý…{žeäË4½;·þa%êºZE/RÚ”’¯i ÕR³ªgÓwR ú6UÞÜ|£Íàé:ˆè9é'Òe¾ð:®GŽ™|x/·@YÌ W*g°iûféû<òkÛ¾‘®IÐ"†*Ô0»OD‡9uÒÑ5?¼Óä ¦¸ ëîÔåò¹«îc}r’žR ;ê‹@JP¦înÞ˜œÆúú²¯gR\v¡Í Šœìl„º¦. SF•‚³:iÔÅœuñ£h¤i•?7î´Q6ÿ,&5dv «©÷Ÿ1i}× EУÓ¾s–š~ó8_"×Ô€ôÔo€Hµ5 bµûíÛ*"?P=eŇìÚœõ..&§HR(!…ÌÑMQ¦sڼ=‘ŠT3¥‹:]{µ¿¾ÿZÀ,/Yî“"Ð6oX³Ë^*ä  x­Ìš×=ÿäýTNo#oéX;4žØÒÊ¢–·ø¯—ßJÚKðë7±¶Vù«ìÙ —ËQ‘Žz§-ßÆ2´‘[&Ž8àÁÍS< Eçª×ÙÒç‘K¹ÌFòÝð„€X»>h5kPeó×ã+rŠÕتÅR_§^q?{çT#ïºu£Sý€+‡ø£fÛÁo¸píÂ[ç‚ÚTHfùåÌ‚nó£Vœ¸¨Æz—€ñ+6BàÛC3‡þ-_ÞÒçT$›âõ«ýMïM¹¾ ãaŽÁX1÷ÏA6½€©¯)¨Îª#몳×\£^#z8vâñTý¶°át›cs¦ËÊ/fÄ^ØÝD¨u)êüâñúnÿZ˜/°lïh¯ŽE¼#{vzY9ÖçÙÉõzƒ³Òn¦nÓ2§KžN*«H)+ f„.›G­ô\õš°ÍÑä²Þá…Rq=2×v‡äSß‘Nžœ-£ˆ4»ø:ë ¨·tZY}wkÆÝÃï7næ0a¦ßµÍ¨ýs§òÄvÐ@ÐîÔ—ýôè·¨HbaÑØñ›£Ç;Ô=z¶Oø¤?ûÅviÈ»û¹€ei¹’²À&ÜëO4 ¾ij/(þ|¿¼I[ûàcv½ûF ™åô|à4œ³éØlD’má2ÊÑëvŠ¤ãÀ­5‡Ÿ¥º,:=_—%7œ¼)€€ôS¡ÀGGÀm ™¾[‡´ƒï(~g êü¡!ùš‹D‹ª$Æ?ß)ráÖµ‘!Çㇴ8s¢Æ‰Ý£÷—éA•³¦·Yrfšsxññ.^:îCè‹ C+ UûXùë§oˆÌ+^yM±énÇšl‘õ\#¹Ñã$¯£¯:ݵW«¥6ÿ Exéׄ-»Ug±/ž¹nPÜòàk ELÞôÁãx–¾}‡Ë;¸uOðŒ=´*¢ îZµZ§IÓVÀ¬šp¨ãÔõ¸Àáp8i“ NM]…o/Üw+áçõ9ñéî±%€Ic÷:NST]q8B€ù°ËÖ²G6® 7ríWeÔ³°×Éüø€gÙ$cóБy ¸#^ièõløú쮃Ñ›øYÛÓ¡ȳw¤j„´üÔ¼†¾wéLJU‘õð›ôíà—Î-îÕcÄ~RÆ85Òà~ùÄFz/ž;,œ ryd~HÀ’soØó]Àç0¼:òÇ\]GÈY6A$DÂdyÜ2f0 GÓFh¸j•¬¦¼w%>òâ"S´›öjN‚Âû§n“¡(y}ÆÊ{¨ŒLŽ¾rëMW*ÿ1虦áé½{ØͺyÂÚºs*¸‹›h(>&æd\?›–#ý&«ñ#++Üšô‡·ÙÒ7›Ž\C‰€ôœÖ#aýH˜5ÐcÑÁ'Àá†ú!f½V¿áz›Â÷É5Ú·VªEa¨6ÂCOk£Å£¦švõ°œ¸²øÒ…K%S»áÿ¾¢â/ÏOu0w¢jPF¦Æ^ࢯ¯gbã¾2âZ±Bõœ.þ²géD[3#ccK§ÙŽæ”2ò‚÷úúúÉ…Šr+ƒ(ËŠï oöIÎéë`2éL53(3 "ýâêNg3CC#‹ùûn(*kŽÙŸ÷-±6516³™¿ëª¢\×[.*¦“œô}³TÏ•·,µ75220ðø<½•øFè»/}ªÄê;¼GÌ}wÙØfp¹Žwb/½e'>ü0QI/ã–ûž–Tyšpç—¹±‰Ù 9Û )d¨R3c½ç™¥¨Ì àiln8xÆÇBÉ‚Þv¦–þ¹yŸ ²²°°´² ›²&KŠˆtô±Uîv–VVö>}.Æ~BDeɧnÖzƦ )d¥¯];nyM#à 2’è)ú[ÎoŸílginã}áE ð7·öû8ZZYš{ŽI+`»ÍWßfÁDÌ9f¡ßɱ÷T¤²:t6N–P*,+‹.kceimã0kë%9ƒEŹï#ýllí'n8OŹšé‡¬½~j¡CÈÜ(U®ÚGã[Ø̯„Uùí]O K+Û³·—J3ú9º…Î@¤_ikfjdl1gûe9""^^Ö·“¾Éð饷F5q^Ã~3¥‰7[·í0èäÔÓ… ,§©Ì#V è¬o2ä@2"bA”}'ƒKŸÊ]’hfn–V¨¬Öþw ü:ÂkuÖÕX4ü^>fægLä¦ÓŒšBÒVªðÜ$:êù|©Þþ‚Qý£^<›Ê’›níßÕ0Cæ›kKGŸMÿ™‘ÇÄñç¦ ÕZ±0UûDÙ›3æÞÃÊH¢§tñßôPª±}©½L•fÕþŒêm½ÿvf5ay+ÊTŠ5]ŽªÇfu6Gl¦Ú?«Ôg,ˆZe²¼â0«ü³¥µûýokwS.µ«Öœó‡g?ñ$$Õ‹ý­¸òœçñ/²K˜*o«©\Müò.îÅËTU"+Nãi›÷ßLÈ”þؘý÷åዹžMåÙ)‘·¥ÔmÓ¬†VœÈÚzû5«Asõ#Ô †ïõ«YbÅÚÒÏQWOõ³¼ÿ¤Ù5_ôªïIjB/©Ò¬ê ðIô¥ôô‚ºõëBå„Yä‡QI…jÆQõØ$Õ-¾JxÓŠV¬Ï'ߺx¸û´óf U…¤$uC—ëˆj/3cÙÍ¿hvìf'>}øà›lê_»)¾ºxüÄõLoK‚úÊcûxI·¯Äæ×Ô ‘}X#1¯èå­›o©mûW«ÿvdÆn½|ÿÓ±<Ÿnß‹ Z|t´[s,ÛxÜúÆ>íÿ}7ï;QOœGnë¦'Æ¿«ôK’ï>M˜¾ÿšoír°žÚÞœÚíþß.µáµ¥¶Ô–wó3ë¿ŸDü§ó¬.ýo½ÿ_€ã?[Õ,¶šx?<¬ÚªBÍê±Õ«ÿ.~:ŸÚòŸ 7„S+FÙ˜í‰úú7QDY=Îaîþw5Ì“âÆ–®9Ìß<šAyžµÝÇb埘'+U’s«ƒyPÉ_²H„2‘í_IaXÑ.T–8ÛÚ~•Ð„[û¹Ù[;ºúïºö¦Ü%êæž…®ö6nþýî$Uâ%BåÆò¶²vœºá,¨jbnÜ™`oGkk‡1KÉÊepÈ<Û?ÉÜÐ#Sù=óAÖó=Üíllœ¦mºXÊ‘ss =ò²6æÙ¿‹Üü4{ú®SÖŸ{ÔϾþ¿ÚƵa) çç_IY ­¿ÍÁ^ÝJõ.^8ßLýOHŠÀõ‰¾Çâ2U(¯ø§n$ ÍŠuô[òWRñÛ'ÏÙÍþ–¾Q ,´Õ¸›F/¹Ï=u#êò‘efö›|9ŽŽí±8¦ÞÙ›·Ïlàq>€Pɾþüæí»sçz—œÓ½Æ®€Ò¤ÝFì^uäjTT¤'ï‘ÇàÅÀÈ¿ twÝú¥a¹» !µ±çÔ½«N\»yooî¾øBEà¼ÙúYBÕ’š ¹yr`ỗɻçï·ê9²Ïkg ½þ( S20t’T ¾rBè©G9ÿîÆ„!a!¡ƒ#n©œ±¯°;òÃê }'ìý€@ àí‰CƒƒÃ–ícóûR’ú(òWMÒ+(ló¹gåÔáØÆð¾¡!S—í“”m’ä¨ICû†„ Ü}í‹ÿôû'B',¤eCöMÉS¹Q]X7hñ‘Tç‡õX”÷|XßžÏ2«'C¹¯®:`ĬÄR¡j`È{>~Hpp謵‡”ªÑn\= 4xô¬uÙÌ1ÃY玱*¢üë\4)ô~Ò×-3‡…Ø}= hþØþÁ¡C£>”ESZ3'$$d̬Յ "|º0rM^âùàþ#•„­Ÿ5ªwïþ'že=>:}ÞÎç ,ž8iòW kf†]{ýíĪ)½‚Bæ¬?^F+è½K&öîÝwçõwŸn/µô΋}×Æ•Y4pËÞÝ>´®XŸA£gÆ‘©f òíK¦†…„ ?/1O Ò´g}F-€Òû}‚B ˆ½²gHÿÐÐ~ƒw^xZõJ“q+`Ø Fò~üÀà°aWKUS¥ò¶-˜2eé.ÒÍž~:þÙ¹µÃl&Ÿ®lhÒo€ß´åÚù“늄uè-™ÚùÕáÓ¤ãÓÖ‡Ó 5[8,™l1gx¹j‚Âq…·^C¡@4`Æ´Œ»‘© 'ðf7«§&«Â9 IDATòýûyäĽÌPJ%=7Ý;Õ½b†ª¼ôÂ>Ó÷·®§®&ÖXµÄãÃÅë:‰<ïùðôÛ:eŽéCº­¿SPKDþœP£¦½³§£ÿˆÃQÏ^§"&w53\öarrÒ©õ‚& Ò£]L,ï¼KÏ/Ť¨V~^¾O|7ÊÕbÊÉ׈¸u¦—«ÿèóã>K°8ÆÉØäØíçÉI [¦„øOØ€ˆ¨,u´·ë:ïujFÖ§øP«Î[ŸH‘ÎíîǘٺgÓx{š¯Ã¬+efµŸ\ºX_ÉG¤³]mŒóYã]ù'S%ßû‰Û0Ìzüþr»Ù@s›¨<%"Ž u\w>‘A,20]ý– ÙA[wŒÊÄÌ{ûMº /ïdjO÷­·ðË…N]\_²f¿²4'kóO%l$+å4w½ÈKøþûìê>œ ³ ;†Xào¥÷(“'½ÒßÈ{B$ƒ8ÄÛéXìgDÄìÈNú®/ÊÌðºzXßx—‡ŸŽwêâþ‘AT–¤ÚÚZå—ÍêæöQaS CeÍFD†R"â§vû_*1ýÞBGŸ…4âíî“w•»RÈ•mÑ¿\ê¨ï¢2ÿ£<]¬£S‹Þíj1t}y•`[ÛËéň¸v|`øî{ˆH}K²pô¦ÊlÙ ¿8µÐÔiP)"~»jeÜý[%ÊŽ=gåŒHp´ßöâky\”%æÙ=¢gø%Dæi¹©!¦Zmù—P #hlàá;)~ÙÝ=ð ‚yLéõd™µáw&ôM¦0o]ŸÀMl¤Q%ÉÌ0t½ÆÙ+uÔº8yvà.ÂH0çnthÐTÌeM¶¸|>0Tia†§ÅQËW÷í—ÎÏÚ¸‹½c+)Ù§ÔbÐÖP]¹±fyLg NM¶tñéòvÖõÙDÚ4p?Ai0 9+‰žŽžFé“Œwûr¹F1ëù,pïÕ³b?OJIâÑîçØËØW¥ôz’ÄÉRº®F=Àá!·ÝìÕ•Ëá†ôÌ,AAB÷À@vòù™ùY²FvF½QkÖÓGöII×S$@€gdÕðV•0”vÝ?ØÕñ„ÂÈùT(ÑÒ­ÇΓØy6Jþ«b6De1Èá†a€®Ó¬%‹'ÉpúriQ®²±g§7ÍÛs·M‡æ"÷³DlRÁ7œ—n¾3r’¾á63'ï®~]Ý-ª$8@±NCSH8„Ð y‘RÈMyÑ=ð»ü©ôfr‰O³ï^Y_Rîi4ògW‚ˆ„À¥õ£ç_ÇÓ7÷ˆ€'怂f¸E±™×…„Èåsc¤J© ¾D­Xþ@pêúíÖZÜèýs‡ô}y³ fŸ’p{_™§6œ¹lÑD $nM:ÊÜô>OPv_VY‡Ö–ß,¿’8•pGK ­CÃô·¬ASɃ²ÿÞ3}+‹ŒïU¤žMf\g¯U©}5æ{È剔C™ … c Î¡‚vœÞ¸Êðßí`+mà © ~"ØñˆLI³=1”J ¡%„U¤ J¤©GË‘Ó –Oéûèš"Ò,`Ò±Ñ ô"@½µÕ™½Ë*=ýrÊ@„G@Y.XP”Ê Nͺb•,ŽÏ%TùêåEÒŸê—+«îØÿsÕž9w¶b¼¢ôûó=ºý쮌qúÁ›4Y°ýø`žÝ8±~Ó”ƒ÷ÃÏ,pýùòë¹ Ý™\S…øSû-F^€HÙ31à¸ÄæñÕi\öRk+dKAW€@^^š¦¸Ǧ%¹ô¡Ì"ÜWÙ£Û­]Ïx¯ºÕZ‹ €ö&µZk"šTCl!o/¯°9þêƒËÍxlðl8¶9œËiDH¾–æÇÎèñ$èôšZòñïQ„#tók{ä’Êç—)9}ìJeB¡åâ ssG”J†–ÿúFÌÇÊ]pƒ»·ˆÞtXÕJñõ̹{Õ ˆZõ;Ñ’â„Š ˜äÔ¶s´DÃË­þÍÍ×UU ß]{˜ @JQ*-KÖ$_Áv_òâYîO#+),‘Ñàh¬ýæÖ ö›ÊH|Ìçq ‡_‹¸£×)ByýŒÓ W'¢êÿ!— $»GÇö22TQaƒàíÕîÕ™›Ò²õôÑ‹Š_æKCè¤×9û]bvYÅë§ÏçJ*Åo!â¶|~if‚€2åüÂß@Ukíº²”ÔbÌ×Ýgr¾“àß9†ø\Ù“OÅìƒwo¾ÉR(åù®–XÜÝ1‚ï’r¤ {§v¾üTÀ1ó^4£QüP”K•5ŒD»8wx=ºDÕ‰âìÑóRŠÕ ³ë´ƒB¯QêycÇ4^9aä6i^_-òy `n<ÜÎoé6ÉÿͦME@HVôÕ´fFîЮ ÷ÕƒDÕ±Tœü™ªÛª<Ï-‡SöB¾½»ÜwM̽«‡šñÊÎ0ÄÁkïß½qòĉÇŸXf§ÞbðªÓkBQ.)•Sµ8!wSÆ:hû­èy¶›«G€“E§×Ñ·˜ÖÁ=‚}*ªxÂælÚï;Üý±yc&úéëþ«ŽUPÆ×»Aáw4O{¸±ö__7_«˜é­ß—÷TÃGΘ›áìÝ¢|ìÅwÒùø{½ºjk§öê·upŸq:8|Ícó½{¹u´rá|yùü³8ⶻ¶–¥@±²Çˆ™]x©oê÷íåÚôì’±í¶ïÒklB/:8}¬Gãa=\:Z8þArïWu)Z.W0O ä"Êd‘ˆK(2†ð…|.* Šf‡+ØÜ+HSr¥8<¾€Ï¤”rŠ‹„@‘Ëå /$¨ /äq¤2™P$b-M”r)r„>§øóÓ‘÷š i‚H+ G(Èå2¡HÌ år%ƒÈáò> ²Æb”R®¤˜òå02™\$±‡ B¡ Ë€ÃZrÈeR_ÈçrP.•qEbû\*á Õ¸@©PP C‡/p CKä´X,,r¨ÉhXtl–ó½†ÛvŒíP¾(…\J¸B–)c(¹œæŠ\BˆR.£ä‹ÅO6ø-ý~i©90”\®._Ä'™R,fç 2™”/q¡|P•ð‚R*” „ðù—°Œ¤\IÂ…@+åJŠ/s *ä2‰H$¢)…’¢€«ÂRr9Eø"’Ⱦ÷/—Ëø—TG rªB‘É@8<‘P&•aå;¾H( „ДR©¤€pB!}rÈå <.»"†¦ìÇÃâi…\Q‰ˆÄ´\JWÞB‘¸B[¤r%G âq õÆ®Ü>Ë]ëÔÒ‘¿@þ¿Zî- |\ü˜'ÃPºù­»óQúÚ]ÏäDƯ[MÔcÞÑDDúK7S³­‰t­BäßT6ì‘\«™ú3åÿœ‹¦Jßõɾ-ýül⸩q™2äi ™µ|˜Ñ¯VTÞ»™'ÝM( \QÐø…S‚í±6Ñø¿ïCªM1þW]¦jËÿ‹® æw¾íªèÚíP[jÉMm©-µåÿZùÿpJDD€œïÞþ”+ÿû/5õíãÄÏ%ÿ“Xü–öìÙûo yß™€ä7OR2ÿȨN¯¿ô «Ògñ——q%¿;€²8úá3ªv£ÿSÈMþÜ„(зïá ‘ŸrdÿJÿ¹K À™3ÝúüO¾ZU¤•)iôžÝ>übChÉ#«É¬iãÑ­3NÞKÿ³ƒVÏ-²#Ø:á/½¿n!Åe}žž2øQûÝ$_VmØ)¯Ýèò3»J!Q‚CË¥ N]- #“Éh9\¾H$D¥ä“LÂ1}V->0´R&W ž@(äs@!+E®)™\É×Ô†–Éå4ƒ\ž@$䳑$‰XM¬Éhy|¡PÀCBP!—))†Ã剄Â2E¸R&W0eý#R ©‚QW!¢T*ŠÔ¸J™„æE|R*‘©‰R™”¯¦ñÃNb$™HMCId ±º €‰‘ˆÔÔ8€´D*©‰¹@Z*áðy4CÔD åÅQSR ™ÕÄÂ2öP ¹BI!á…"‡ š+“P<—–)(Âá‰ÅBZ!“+érBJ!S( _(ð8 “–rù"Z!U2B:|Z)—)(Âå‰\‰”RS­YË)¹DÉóQ&W"áEb.A „Q*ä %pxbO"Q¨©‰¾e>®£Î—”J4ÕÕXxÐr©Œb8\¾X$`å DJ¹”Fau>2”L¦²3 x¬ ”VÊå á;ÆAñéæ;µ„’ ¹B#“Éi9žP$$PIb-“–rbTÊ•´jÐ2¼\¡ PÄç  I¡T® Ýd檃?št˜—õì3/Lë“÷õš¾gâÙèÐ&¥Ñ{š¨¿ Ûëߊä%Ýòé¿°ßþ[£;Šs·\´cgÏÁ›Ÿ?>²€ÙÓß{w²øâ£k øpkïœCô÷/ï ˆD³ÙsìNÞœO±¯Šµ¯_Ž¨ }2ÓiG›Î¢^¶-ömŠ0è;óÅãØîõwî;½ôè5Û¦Lz¤s÷YõÍ\ÛpÒ¾ÍÚùFuÞìa^DÝ,öó—ÀQ‡YçºwÞ°‹µNî³–vÆÏÐ/﮼3xyÚ”K«¨Øöé3Ïœºz=»°;Sàr6bÐ_ý½z ›7§S¸Í;ߺùàÞ¦í;O‚L¶cËîáSÇì§G÷$˜µ?Žÿ8dßµAíÄxÖ­kðìË·^ã6 µƒ®nÒfÆv-·£b‡o¸jÕ¨äã}×>3[[6ãd=zž¸äð-‡Öw"¶eðø¶-½G\âûFÔÄÁ Iìƒ(móA–­þy£¼•bóLAC¿NÌæýWƽڒ'ßë6d[[;ï:¹¯â²y¯Ÿ¬Ê]›ö1$k׆­½ÇLÐz'lÑEDâë•-lÔ¡NqÌ{éÊk7œu˜“ãÝÖÇg7³{ws õ>7vØ4ÓCní3ãÁã˵{ýïÁ¢ÿÌ#ÜÕwkVsnªžï6ýí­¹¥K:…ˆ©®ÆVIRDÄýcíû/¿Ï6̹1ÝÈ{)…¸m¶oਥìÃä}ÌBw±žÂÊ—õ-{” XýIeÈ0Ævâö7Tþ+k§´RQïiíûŽÁSSz…ßR¥r¹nà>OH+¥YÍ(¾Y[Ûο›É>üÑ#|fçþ{ñ̲îãwnë¶ø"“¾§¿û²èS{/9ô cö÷{ôˆÓ”{ˆ˜sfšÝ¤Ä$}Ÿ¯ˆŒ²ÄÅÎa¬—óÃ%ˆ¸:ÌxõCIYv*ÐÅââËv óK»M¿‚ˆ²ÇSL ºeSˆˆ7vMqè¥ÊÙrjˆkر·ˆ¸0ÔrÎWìÔì‚vЈS»õ]r˜}xc’ÇŒÛìïÝ“ûé{LFÄèMþ~Sï"";ÇXÏíƒ ‘Îx gÝ­ñùo›‘§Ø&W6N6vé'Gü»ÊÆe6‹Ž…c<{ÏØÊVx±)ÀzðyDæ2h*ù×ÝÅ^nãΫ¢<ÛØÅa¬ 1óõ—^°oÏìé»ê*"¢<Ñ^ß9 ‘–$:X:|c ¾EÞzZ%aÙô¡nC—W º5À~øDìëe~èʸ(jCOß1g1ó‰É`6ÀÍ­}†mOFÄäíÁ–ƒ³gä®a³v3¹ï,l]2e ;K/ýeÇ“0凌Omˆ‚G80êÍ=YóÖs—>4lÖéäÁŠQ6f$S•£Ú”‚-¸ý0_ØçCDD2p±ž8ãZ:3PÙ²­0GNjd,9Á𸒆Òô[9н {{öö¡®S‡*-*ÌNå©i6DÁµ‡—ŠVGå©÷ú<¢^çËÅdÙ‚N"¾Ú/Ü08†:P]šhâÖrrÌûþöMo_/xÒ©ßÍ›öžÿ4xa[§Ô.}ÆÌ 5º|äãÈ3C·Ž—¡ýñ«I=ºõhÛ[ÿËÑ70²iªLÃst×÷ÇÞ§[·P¿ù²ñk±ÊSñ¶ ”I||%"HŽ¼Y~Òo š;ksÔÔêêê°.­ØD J ¤__¼“´¶|ñYcNêù"ŒÒ¤“ȯ?‘:l±aÁÒÝxåóOUV¥lèÔLÈQW¥RpåQ±Í4k¶‰›»í¤ãgÊ°†*‡jFa gËB©Qû?0:—FiÑEd§/géøä²Àçsií¼g±%`ÝÅn-Øo•LI+ósåfÒraa‹.ê’~!ýÝ|CB‚\]̱ŠNžQvnoÀÖÕnVïç$eåQé¯nE$1¤HÒL’t ¾ËW¤„^o@Ÿ¸a1ÎŽ5 r²Ì 7á’@¤õ‡€¨™šuW‚LiüŒðƒ4! ºîܵ³uk¿Ûe ˆHƒÝ¨ŠÑЭ§£­Í&>:nãzÅÌ”TÉmú‡®v]V  3{qm"W  Xª„zº:Ú:š €Îø%sÛ–åýá”ùñ³QFN€l¡²ÈiR%·IƒúÚÚ¬Õ¹ÎÌ%êÿ æ®&‰‡Të J[‡gx_…aš±ºz­u鼓ý(¿´« :û•.ßLQn7˜&áê-™Ô|%5ðòõgåy9_¾Õ×áVÐXèµTk™ûûé !”%2RÙ“„ëfÀ[%kíëgˆ„`^n‰ŽFµ(˜:š­dÊB!bD ŠãÛvY cÞ–J›øû5@B¨" h T< "p€REù$¹iдŠÊ·š•5'}ÞŒC'tÔ·Ðêo ¸•SÈ÷l¬IŒ]¾Úí¥N+'þkqtÊÃ%¶Ft1tÎ8zâzÒËaÛC݆ºïB"®5q´úÞ»°P 1²õ4¨ÏE ´²”æ«ÿ:šµúCªÕÌÎßZ ! —Pa¥ B½†Ê¸·ÅÐAâî%ñø¿Ö-ê7bν/›†ú:…/à–&¿P •NÝ¡^=ÿÖˆHSP¤¨ËÍ?™Óçæø¶ ²'UÊm^))#/LÉY»Y»Ÿ2È£cï‡s‡Ú®‚j£©&é`ææÐœ@€–(¸j„`9súâΣŽFÖì åÒ™·äîpnŠHr_M( 2n@Qy@""OK*hçVa-Úþqoü+à¾Ööño©gñc,êùëÄ÷¯wM ôx€dÅßœ¹r'!„pøjpàêì¯YN®»ž¯þ:s~ÎÀyç>³{͸íî— ]=À¦¿ÛÖù+; ëÏ‹ÎV7ïéÔµ7±ä»éŠ&¡½ÅP­­AýŒ—‡³êXhqøí[”DÜxfån@˜ÔùÍ­PëΓf/{ñ.ñÝËGãí¦G¼ý@÷é|`ñ¨'¯Þ%¼Ž]1À¥Ï¢È*¬KÀ„À×+G>}•ð6æÊî'ox¿a^0%èãæ‰wâÞ'¼¸½ñèe ðÔuQ’WÊüzV~ó|Øvåa\bÂÛCá}݇o¨g§Ï¿¶ëlJJâÕ½3™ú¼‚7¯>~+¾X.Š¼÷êå›{½¼ý®<ˆMHxÿðÜÙ<Ý6… Ë?løèbeõC2 u³˜77<ömÂûWO¦ö²³-‘€š®@ùñÉËÄÓ7®{õâº`uaÂÁë_¿|Ç­% %“É”ýVnvûæ •‚zÝÃÏu³hµ&Z«yõz Z6S1üêMÚ¶Ò€MXø±ö§W¬_R̈ì»o<ßÕ7o§«)dù¸¦.áëF¯ØºjQÀM³ƒ: y uê·nMÕPkÔ±M™M WܱCk.€ºÑøÝáü ëi´u]¹jºaà^ Ñ.´«Åýëv,ß¹½aÓv¼ºª›-O£Yû–Ú iËv:ª°uõÚúG_гxÑ"º³CÈã~ˆ0z÷å¼Y³,¸ä?nùÌA¢’1cwžY:ÐuÃÚ°%{Ö(¯yt^sñº­Gòeº­Í.DÖB3´R)c‚ÆÍÛéj©¸¾fóv-µ Wøî¶W÷l[µHÎÕô›t¬—};D„º^Ã{_X½„V,sÖ`}ÄQÓöîÕ³n¿VÊõŸv0ؾœ¹snæø¹á7ÔÆ­Ø™7ßx¢í[×æÏüh¦þWKÖó]«^Ëÿ¡“/úøhÿ©8V#óvßTë¡kÙDž·çÈ#Ö1üÓõ-æ=Æÿoâ•’\9y([Æ.T>ܹó8i­2¨Ö#ü¿Oa!øOŒ3«(Lvö ÛÞ´ƒèktLÂä=w{jþ¢ óÍË­§QgC]YÔÃW½W\ŸèRÿ«pcžßÂÛÅÖvob*ÚuÜ:kc ÿJ­‹æ?ŒR!´BZ\*C ±ººˆÿ ¹'+™WÊŠK¥ _¤^G,øŸ•²Æè¥ÅE Š!\žF:\R+¦©%7µ¥¶Ô–ÿ“…óÓ‡êÐøùÃyÚª¿þí7£_Ìé_è«Mpÿ[øiçUÚþÐKMÔËÌçjšVð ÕðW‘jÙ…A[SÏeâÏ öCÛ_ÿ °T[á'K®öMí±ûß$7„ÈÕ®žnWäF !»'èwŸ÷´æ4ÓAéhjRÈüg¸XBÈË=þ–.âÿÛLy»Ó­]ÓX–î~Ií±JòCµƒ: Yÿ§F#„D/vtü½…‰áí´bBÊ6 !ÅŸîšXä*ðÊ8_«é§!w#æèXXXX˜››v6´1}]E‘P9Îíõ}aÊ-fa¦Z7z)ŸêËŠiƒ­,-ŒÍÂÆ,L–©¸WBH/û.·ÎoêÐQßÈÈÈÐÐÐØØØÐÈÈÈȨC{×<’îضƒ±™9;¦Q—®/ÄçrZ ù¸bÖ([“.úzzÆ6#§/OÎg ¬gæÃ6c#ÃÞËUN‚tžµ©žAÏ-P¶ZBŠº·ïdâ0@ßgµÌ£ÙâØ>Bäß^åJBÈî©ýôMLT`13ébj?ián6¥°2?aá”!†ôô;Y:O]´=Ÿª‘s'$˳M{#Ss 3CS[ϹۮaMÙʔ٠G.ÄÖ‹¿†;¨©Dmô˜~·RðÜ YM«‰­ËzTåÝ´t_¬ø¡SéÇ÷<¬ÕõÁ¶­P§¦q_rq¥êS¬š±âÛêfÏT~ŸìjÚ» šZÌ÷Iý¤“JõÄ‚¾<;ÊÃqzÅ©âµÙNî#N2ˆ×§öt™w£,ð<¯B•oã{¹ ^u‘Êñ5¶:•U1ü0=ǵãì«ùˆÔ¦î法¿Ø6¹›CÀLTe-í&ËÊu8_c¬œ=+t’ìÖÞ$JöýïØcsŒ;»$JdŠÓº›ê³³@…à‚íó8ôJS²˜Q-yÿäakO•÷qn´ã¸“]Ÿf*ËÀRbbÕ?Ðaüñ÷å˜^Ó­ÓÊ5FS–}{mgk›+¥1bÎаeG¿¿“¤õñ°›u.±àmW“.£E¨"P¦Îài²@Q³r²k'“ãe©B•w½-:‰)¨éKÜÖ{ü¡j?ûŠOjƒÿ²üÂ"©âÕc‚m¬ÌG¼É–B"¦Y†,~FÉ>¢7øò±µÓ}<]­|Î=ÿžQï"6Œ åeþŽyC,ÍÌ,ì}ŽF§&ÇÊ }Ü9ßU’ÙÊȵ„××vû8ÛÚØX¹tp7± ýþ~3ÏA„òbi@‹öÝÙÜN阹$„¼¸²ÓÛÉÖÆʲ÷˜eŸKÊ"é£|óÔþ¶Öæv>bÒKHefžÈ²VMìcinfíÚãR\& @[>ÚÌÜ­ë€qgZvê&%äý>?ÃÐóH)ˆ< NZ@ß9¸ÔÉÖÊÖÆÊ'lÒû\)!dÝH“Ñ_±–³ †šZXz}ÿâPó.!rBäùÉÓûûYÙØZZÛ/Ü{“"ÈÓß&h7mE `ù,æú¢ÔÒ²ä-’‹.QÓWô¬r¼#CU8\ëp5Œ‹OþŹÁ(Ÿd Ü{¸—"ÃWž½{v)""ô#ÛZöëYnÓ[R*%òïÞ ÈJ¿wfÜ{^{í¯ ) pÿäÒâÖ.; Õd¡J4‡/ØÓ¯eÚÜùùn™¬(O¦‡Œdúò¸ Sü}Ú7?tói¹¼‘;nßΫÃò•äÏ߶ê{à7kª• gv­S÷Ø2§ŸÊp[£Å¢}{'õvþy²/E©jN¼Æ-ªIŠJ âê®p{+K[k«ÐIk¾Hèœ[»Ï>ñl››(!$áöW;+'ßЯ¿Bdyñ]ôô²¥t­Pú_¿L^îÓõŽ=|³ÐJÒ{ðzˆ5ÔE<ÕÕÖz=¿Ë€eW®ß:î¾”ÝökOçvlk& ŽQ÷{òìÙÓk[6M'Ñõo×êÈÓ$V[}ÊÄ¢—ZiêˆÅûÞ~ððáãÈ5ÝfN^ÚÌÊ ³KÀî%F-òbS•ðìlG¯)…/·Ž^~åxÔƒ‡ŸL4* 9]…òõj»yÅl¬7`èbº\û‰@™Ü7Çtò“˜gNš;l` Bö•Ië/JïÇ<¼°ÿäÊ ºMêó8‚:šê| '¯¿ð°rúöìü´ïïxò(º$zÝé‡Y áUTÓÎÁŽm› ¯0ÔeÕÁ›YyR¹’p'ˆl<•>СÝÏåi¤Â·@e^ýT¨Þ´™<9u·…ç¤ï>„ €“¯ÔÔ5]‹3ž¥ 4½ †Ï¸³iOÁwÉC :,íÖjàÌcÿŠ†ºÂ –0Ê/%zÍàõ½zvý|¯Ö¸{W{áOF -*ÎÏÏÏ/(ˆ?þªÀØÏ¥ yv|úšÿ×ÞuÇEu¬íw¶ÁR¤7Q Ò›( EzQE6lˆFcWQ¬ØEADQ1"QQÀ;ŠÒ¥-,˶¹,àR“ÜÜ›ïûÝœçeÎÙ™9sæ<óÎÛæfÃü‚‡yùs$Ÿ»-SpXåg f²<ûúyÌ­Y¾åб›¹åç[²>„ @•P‹”¢¾„¿ß‰—QŸö# «Ÿ‚å–½bo~clYOMYVÔRë¨}Ð ÚV÷‰’h*xò~áæi€‹i<ʻڛ-Ö¥„¹kÓ€yéøCÇóÇøè+á[Ï*½ •ÑÓ]÷àΔ®ºRs‡µl]ç)ýüù ­Û©es3´ç/|Eóy|ýBËmÆ°y‘«õþ ¢ÌHîp]F%‘öž¹)¸õqršÍ–MaØí3Î.úúJ›`{hœwfŸÔXš7wÎ ˜W^Vεä>¿£ÌÄxÜŠ„».y6†Î<ÑÊçqÅ”ŒN^88B˜¯š:GÈ â„BÁ±~s¨€Û¿Ö¶pÝ#âõ‡@û×f’â(ù^ñ¯rRÒ¬Vö@}yp`“ŒC¬(š¯¹ÊÁ«÷k}-»¯šmNQw6MÊŸì3AõO‘Í—{ç¾ËĘÏ.-«Ä":7gp¾5óT†ÉFœÁÈH\îv®S–Äã=ÖÊ°Óâ²Æ‡= €°Ë¶àp€7ìUóyˆF¥o”øNRƒa¶¹7íc‘vss&¨ä/K7˜OQÖꜢ$IZKc¯#§ÅäI¢8I°r6¥Â¨åt Ô50%d%£ï¢4ÕpýnzA9õúæi3¿€"¦zëòÑ{á>-,ml¦\{Y @™²ÄøRÂ+~õ –ñ‡Ù“²ó~ƒÖw(ÚNC¸êЇðéÍÌÌÍÍ'Nœ]Ok{W ©ètÍ4YYÑÖZáÄ»Ü&[Rœ.Ü~q=h(‰ B9 e>·ÇñfÐ’ù”ïb!Òº®¿œ>¼Äf’¥µ×›zá©ÜÏßH#•E•(Uåsù|︜¥£Š&™›ÛØÚú…^â§(±PmáhAÌ;VöÞ=¶öôR¿ü£wû í£äÆÒ#ŒOŸ<·o¾Z+{ô­I"øûm}ó¸’ „1ÐÕ&Æ&Ý̹ûë¯wï,2dÎöœ‡¸_R†.V¡ö1r;_T|\\\Ü‘˜où±ôõÎc1Æt ¨|] =Ï­kl"Ú]-Å;ð$+ά©áÊ&߸Òë–3áóöúÿÜðçæ*næyöäñã'Nnr“F"¦wï“¡`ª¢<­¶ø+ ÜËÌ4?ó8àwáž9÷îV_±= ½¤¦®*Šé ÈJCDê[…ì $™WO¿<ºÔÔÌÒÆÆõbþW‰ð?¸™Bü¦Š®ÙÝÔÆ–”¦z;Àýç:#yzÛ·@=˜¥Újº]ð*ûÎ/,¦ j¦+êIÍÉý53i߬ó• ?¿éÞ‰W§ÎN›gæÉÿõåÓwꚆèGY¾îÎŒüüüüüü¼¼ü篛;˺Za4³Ä„£ó(Štjk[; Ü=ÿ’$Ô0x‚ÙZÕ€È=ÆáíÙd}okA‘’¦í…Ì‚»™7âÖëÍw^!tL7YQW·ð•4—Õ *A±™?xœŸ{--™úêhd곆ÇhZZâßIÊÞDçjöƒ‡YWµLì¤û“8‰B£‹‹‹K¨8ELR*ßž˜×¹‘ ‹©RØy™B_UÅó*šÆh)>§5'ã*—‚ƒ"©TÑY«ZªjJÄÄ;û; .ëc1Š„„¸„”•ؙ‡–øVwéIL½]˲#}OQŽî]O9nzUAzÜõÎôÏ<Ì£‘(ð>?YRÁ`ÏúÀÀÀÀÀÀµ‡o`fœ{Ò#™5ÑóŸgÄØv2[ãNV •B£ÓµgŨ2ó#îV OßÚæÅý3ÐÍ7#ÔºfÑêÒŽß{æ.»¡Ë¤‘rßH—bWÔpÀë×1:$eÄzLqš¬fô…ìG9·/Æ,Ù·lÑG‚oþstCnüt¡ ¼;}¤v„³m𺚿_¨MÀ2zºê—Ï]×ÙݨáÀ²ûÛײ²3^{.w@Œ¢äY €**>TgÍbH*¡2^Fg5¹ý( ¥7¦fÿåÛÚ.>äÙ?¹þ¶7X0uY3¦/ å DâT&€Ò´³C-ͤ ½±ìÊ,  ª® “p½ ¶wµMs™©*£ “#gRÄ{n¼Oå–N1Ñ€×"Wl9/Ð×ü¨7XmBRÕÝM© ꘠’}ñ¿ˆÑ šýܼ5 Š”Œ‚ª´8‹KzX­5Á»{vc Ë‚¦¤¤¦^Λ¸b%!ÀÇœÙü:jÍÏlÀ@lcÈ”[<©â öèàu-š¶‹ÔøìÐÍ¡kÞèR° ô³§%FBGÌcÎ|}ù?æ…0Æ’NÃÚý÷e"„0Sàa5y>«÷ÖqU3n^p±V+r£›ù&~@À·Ü·oŒÇê°Î¿z—šºº††††††Š†ÝkZʉ{½Z Ž+9’Õò§ó#@KL ÌÜ0çS0v]¤ò9Ãgíî¿4} ö™Z2D[]t°zDÄ¿Ü÷]z¬iª @š¶À,?f—@͉<Øj8[O‘xœvÄ®H÷š½PDÄ”µÇ‰r;Ø|à³[óòsx„ßÎ_£›ö†:QCÿ ³§»8M^z©ñıµ$6«•Éâæ2[Z;ºÍ"- fÝ—ßhªr0 Œñ–èƒÊÅ †&fã'L³ópS"c Hs™fùÙGGyÀ$~ðœ<ºÊÂÜÂÞÞÖÌeÇ’èý£€&7oXãÓz1)˜8fôƒÌJoWŒ±¢åöuÃíÌÌ쬃’¯\H`5Öst×G,ðvq¶}øMtìÏT€æ’'v† dcñÑÜÌí&ÌÇ;®žk!£ýÎ8*?1µ°™êácà1£É>»Áä øöäU›¶<Æ o·`83s¢¹¥ƒÅ´íçÉt0Ì>è®iŽÿ6B˜®–ù‹‰T•Ç„qZÚZÆS'¯M‰^60•ãöö–]6FFFFFF†ÚÖm#]Žo]€16ó=à9ºÞÂÊÖÑÖòÈç¡—¯ýñ._´v™M6Õ͈aennookf<{w„6 Ø-Ÿ–¬nbó 6ùC«Ù@þ8}²/}?ÕñûUA¤ŠÐŽ ûRïwö¼Ú7xw Ã].f¸ëƒìùó¾]ê¿cŒôy‹QÇ’P–FÐñ2Épý÷™‡…º9PsBOÀoo©gQ’hÏ;lVñöÆž>Ã]·#dˆºïøÒïviЗ(Ô¡A”öí¤P›‚×Ô£½Êxõ]Õ~φ†ê§0ÀØý†¥ŸPªþŸc@ÐïÐ ÿêètŸ ¿Jшտk™êïU}/þôœ+B¯¨¯³×Õ¾ô,²5ôüù`Ý. vYŠ£G|ÌùjCH§Ä[Löëmlí¿9¡þ´|Lp˜wåèù£Êb86ú²£ÛÏ›n >D}Jú^úÝ. >ý›“èd¯=P£½Êxõ¨ç¿¡ÞÝà¶ÕÕ6±ûªj†ª(¡¿0,­ÕÍÌ>²E\UIz ±êwÒø'Bˆ×^÷N/X’àš¿"Ýü/c@¨öiÚæ¨äo$³é«ÖùXüé iŒ¡ÊG·Ä¦5q(Ö>ÓMˆ¤”ÿÊo®Ys²¼·ñHTùJÒ‘¿âÍ’µàb.£W!KÑþæ±ĘtC€ªª˜þïè¦ü–Ý̽UðŸ/ÚÎÚÕSFÂðüú±yÞž³æ-Kòµ;¸•ë–Nóô;} :KX¥! =ç¬õ9ÍÝ+ìÔí®;1|º¶ÇÃÍ·ŽÛ½§ÁøâÍ^3f,ôßTÔÄ29cšçt£è¿¹3ÃÀü¼kí"O¯Ÿ"Îp{¦>`¾¾ä²x7ü]é8ø¢9ýíAszk'8ŒŠª†ž\ƒ.lYäŸX¸}÷æ•®1‹Ý#ó™€BÞ6Näñó"#vJ½;éµ&!„p囩C—E„ooÿ5ÜwgB¨½,ÝzæÎÁa±±{eßžq<ŒN˶…3~Êiª­¬îf„Ú6N±Lªµ#t×r™9“m jÑ!TrqõãOeõmì?¢Šù·H#î+wº™oøž1m9v3ê ?ÄXLÇkåØÒ…!—A8 *Îçó1æå¤Å‡………8öº–1Æu϶îMèL²]p=bwXÌétvá™Q–|Œ1æeÜuüAÆ8$pQ~ S¿ÿ줗üÓ|>þrÆ×Ä÷tgåŒ íJ1.<èi±2­³ð[¾¡[5ÆÏv;L Êí,¬Hc0«ãöºO±éO1ï……¾C%§+ïwMá’UëØ] ‚æN:öZð»é½™¡kV Ï…7‚Ô iû·]yÙÚëI³.ìÍü­:ùОC_1ƘY–xdhèî‹Y/0Æm5öìá ŽâåcniÎæðs|Œ3ìŒ/häc\•¹(äFgW›ßéÙ—ò1æ7G‡‡–5q1ŸÙ%N昘Od( @$ è¡;<÷fW™N«À[l5>¿‚Œ’äô{Ðô!Ù}ÅUñc¥ëý#¯Ð©Îß¾U4²`kÔ)Suº`A/ûP#©¥ ®fVOp7T#Ìéu©¸—©›ämÚY(«3žòåZ ·0ï(ÌV¾-¥. *ÿÃê©FÀ6mbšâ˜‡"©;-hih–WQÀX»—,\Ÿ:„úݤêóÇšÖÞ–Ñ÷ϳ†îù,:Rs˜°>Ùš»—RFXZ<=µÁ'$YLN&+éÒƒ&,8Õójâùb¯¶ôã×f(»¬;µÕUn½£¹‰Ñp?±¸ªzÐù¨·"ÿh Î}–ûiü–ãŽÖŠ6ÖÞtY”unÀ2B÷ª/J™ãöÆ0¬±èA)0&{Gž…žS_îÜþhhN®¨`p‡Kw;–ÓFÈðJ*ZÛ` Cí**Å©¬ä(LÚ6?ÅÓÄvª–2ùmóhú­¼¶P÷ž díŸÿQÖ÷ØyxþLyñvm‘Çß“‚’Wº}œÊH²üXŸ{À½ ÈýÈ–¥ÀÒl¨‰Ñ†²mÞÛiá±O¬¶™@vn¾Ë®(Àdßès{°n7~sèúŸ&ûDÑc$s2¾{w6ÊlFýÞTâ`„î¦&ZºwKÁ.O#Û1 - BûÇÈÍû„Œ& „`Œ‰ˇž¾avx–:eóíĬ Ò!·[ьٟÍŠ¥ñUÂÙ—¼ãç’ÏžO ž¢¾aݶAœÙ0¬¤ n{ªd$’0ðjòýöL=¸‘B$ifzWÄç* Õ@¼›O8ø]Ü2????¿å1"¤ºœ¯`â¿£åVXàKâ£f‹éƸ§ó!ൕ/uwj5þyÿrSÜÃO9Õ6f#\C€nú†‡κ™=‹×Trúð¾Ù.›¶&ÜwìM™\^§r•ËâôU!„®„,ˆx©ð(7E¼K01P¥^«bt m¯ªDœGJ²TQ~ …M…uâ¾ê(Öë}ä:žµ5,Ugò¥êP/帆ÇÜ:uÒ Íà;i>‚¦ã£6K)j®ZMYåÅ+?M?²iÊ€¤K› t*®ŽŠ´éÑÏX†Òðæ[GIôMËeËÄúv õµ§Ã|Ûm—Ö8ýÐ/§ÈdÌ'vRéf Ý ¯5óÚ Kk,Ý|x–öÈû$XÌÉVš(ÿÆ[ÀîÝù@¥‘@øT„ O¯ÞõvLîå}ÐäÓ–Mz—Ô€j/~þZjÄô¡0c•Å³èÓlAžðçw>(ëºÊ€¼$”|øÖY'·ºžC—ë?r#€ËAN¿E\‹ôA]mù»Ú@døôà#›Ü„ b òõr½: :ÙŒüü÷ÈôÝSd£2Kn¾+œacÞÃÒ1¶ÇŸè[kœ~ì:†@è: hmm¤‰R‰ÙF€nYâkV”ýɳ¶V•/3žWÛ£í_ŸcHÔÏ5~-örmoØrR$ï°—õÓ)‰gæ+l9ÿäGU½ÀÕ«uÈØý»VQ ~ž©æèìäm0JòÅÓ×3v¤Ñhæ!“éÖή>ºjÔ§OÞ.‹¾‹ÆÄ»Ïñ}ag0œvÿ—*«&ÚWI!'òH¼&LoÛ¶f5™K ŠÙ¯ø%;ü124¾¶& óÆ8.ôŸbÒý½“@ðv¸™’ü³¶9É ôÐãÖžS²rœâ›g¯¯’—™Î»0u‚&èø‡Õ9¯j÷6W£b„¸‘̽rÐK9/ÄçkDîù°‡‰ø|’whŒ¥Lí4;Ϥ»ºJT(ÿüPNÚ„˜mþá$"âU”|nle!2MEýG912°~+nÔÓú0jËÊj›Été1#$_}hÔÑÖ ®*|Ó*;j”"ùÃÛ,¼› kŽ ñÊ‹‹›Ú¹ÒŠÃ†+JaÀ€Bœ/EÅ-|9•Cå$z£þsy5›ÒÂnXIDAT‡Å¥•4†+»¹¼¨¼¹[7„y ®­-Êj,,©öj—WÕPî&Üú¥°J\m”¼³A— *ØÝ Ò,Ý!% Šb!(Š€¨˜ØbcŠˆˆA‰Š˜¤€ˆtnßóýXbÅxâ}Þ÷ùöúÃ2÷ä™3gÎœ™3ƒ0Æ „Bñ÷ƒ$$B!7B!„PÜ!„BÅB!7B!„PÜ!„BÅB!7B!„Bq#„BükÄMÛ)äÿ’ÓȸKõÚ*ÈÈ÷·K½»&àk#îœG÷\«ÎYáîqÿnø„¼‚ÈÕ] ÚÂ[büœE𯓴µh,¨S;P¸Sî‚zóçí”Ûï¾ÇGgðâïÈþØÐþõÚ ?Pñ—GBß$í2ýÓ‚¢&8Bz&Èþñ,\y,™"Ff2Ùdi¥È£—L6:Ž¦YÝyã?¨-b‰ñDãÝ©ŸÆËb@̡󮥾©d“©8b¼Ç²¾4Œbgдûùî¼°P¯-åÝ=ÞËŽ~–¦Fbù¨jgS©¢$ÔV¾¸æÜû;}öÀ|}Ý'LñÄÔ»ò¢€€Pã¡ç{ ƒÜ´}nKOˆ(mÑ ëlÊóh_ýg¥l˜ÃÁ€…Œ¸\Êú»i沟4„0êþ3œY>{Oâ;¸ ±¾ccNŸ&[d6vJŒ$¡¶˜CgŸ=ã7h©­Úiß1U^¦±+¯Ö[\^©®b>OLŒŒ11  0ÙJ².œï~üE©}Ú#õš‘p¦¹ä²¡ÓFI )yªª†ŒÔÙj¯’¤Z´ë΂#é~“(!œ¬¿GçÌYç<–øx&Òió%Ï°3žyM«üpÚvîµÌ‡ñ?%H]þSí†+¯oÒ‡Rp$pf íÁj·»‡Â—½'F"ójrFŠ»‰n% ¸\„È$ÄbŠÊ| *ú×÷×ûó‹¤M¾·wúK³e×fÐÌvff·ÒœsçÍ0¹†=›%ÄÈ­ý‹ ®Fh‚šß#EÀf€€J!æêÎÙ¼u†ÑoH¦_A´ÿ~uÜÙ&ø^çïü1xÿw é ïoú> s»€1Ƽ+¾™O¦½oÄÉ[œyÃ}qnšcƮԎñG+±PŸSƒ1Æ;üÍìgG}«gñ>|z|Uy²æ…6Æ3ééyjÙ}ãb‚WüÝ•f4UKÿc‚9SS{çGn—&éµÐHù,³)+oó2Â/·u.cŒsÓcLº¦iû¤;òHŽ€ðÎ4é†Èü#:’¼ ªÏ\KÿAvýmÛŒ÷»›æ6àË®fç0þb6rrj3@ v‘±–zJa=&ð×”ƒ“ }*ù@4|ÐÑ7âO²7Àsî±]¹¤©øŠ®ž#E¢f;xl¹„1N;é0uººùÌÖ¦™!FÓ/µ÷÷2gµCûwLšº¼-¤òÃY}S_áóºüx=ó9FUì,8¶Ø|]<Æ8ùHÄÔ%;»OÊq×R& ×ˆ®d"ˆpÁŸˆ¯ûèe/µtmè?©ÝHè­Ö0vÃ[šÎ\.Æ6zªÅMãwú£5Þqº-#a¡íÞç?‚@úÅ9°¹0ÝÅLÏÔÞÅÙcÖ{€ËTSU¹³kž¾žÎ»r|{ìçhb6eª¥¡¾×’h&B¡×¬uçÄM›6sÁÜ™Z¦NŠOcCöÍÝ€0„¼„ÁÕ„`2äÔB0Q-ỺTÉårÄE€K`6“®âžqq'ÑmCrãŽeRvÄ„÷–¢ð6BÓþÌ‚Ñþ+ ÀbH+`=È*E€1 o’è4¥šYm9pÙÌÎú!êv¦1Ýp¬xXXºªÖ¸k%Ûòa€¸,V—p„¶†ÎÐ34³·61±õzRÌD]‹2òXqÕgºÿ‚9¾¦®YµøÝ^eÏc€¯z‹Ì‡ïM©ì¦šDî ]³å[~m¤c I.“ÎvŒ°YÜN½†1¦/Ÿï®gbegahíæ_XÇAEÍÑX¾9ÖwÆœ¹3Ü´­g|d#.ãÛ$Õ&Áã½¼ã¦ïi£Bp?&d´Óz1À˜ËRSUIغ00ÐHƒ¶$öÉÈÀÀ yƺz§ÒÊP凛Îæ:S§šÐ4æ…äBm öÔÔ3±·±9uaÿÐIl„â¬Ôèïqò+ILÑÕ{ ppõ‘ii‹ÙmS9Æ\ö¯ N üÒŠ Áþ¨ð!Î[âçhÔ{h€"IJJ]›™š¦‹œB‡yï;ê4¢gÑo׈YB‘–#<ûð¨¸f2có³ûëEx*¯ÿøR [î‡,û- þ>ìº ¶J0fŒ Üz•È3 w98iÁ¾%°2úðWmà4‡‘ÎΊ¬~ƒ>bµÉ"<þ"á××ÏžéÑÂ,R¼¾÷RBÝb(¹•Âç’Ž3 ,FÈ4šsì]wM_x阉wlfÚöò>Ý¿v鵕ù8umF*JuË€,‰c‘S-ç¬M»³M¢ã'VsÅÕË—¸m«eÉ‘N–~Úiøë­búØ”‡ÇIû–®‹9ysãq™^•Y‰w¯€›l¯IM‰Þ§pÚº°Îwˆ ¾Ý¼_oe /xÉ„E¼ƒ7y7&ž;½ÐZSl’…Ÿ¯¯Éä¡m£—,=Ùl4GßqÖ°ffÿÏ…cuFðF8‰™×¯ÕH´I ’…££ ‚Þú‹´ÝìumGÏØî0N¶û¥Z sU¼{rír§ÅTBÈ Ò1QïÇË“Bj»ô£÷_ê˜Xµ°;‹ë»áà!ÿ÷ Ž¡b~N=¹ý¼ÞÜÙ¢@uö1<{$vêºé¿-oŽ~è©4ÚB;ËÁ’ü_Ës¯_¾ÄnµçPzN²3~6vš>]eJ¦Ý› ñÁnËÏgœc(!§ð¨ ìæñƒpc©Þªí¯/„O ™$WpÚgØ{'',(€G? ¸2ærcX–2„$%¥ س`T]Õ1ò5¸ðlîhÉ÷Ww,Š;6M/âø¢Pµm9a¶¯_ûÎM;“= +í,àÀW¹Þ=Éä€sÉì^½IJà<ÀxVÀBž„&Sñƒ«WsE[¤'&‰Ù:ÚüùÕá/šŠë^<«¢Ùi™§ÞmܺÀm(û”_ce27Ù;¾KàEàÂcP+ßž5Éß­¢ŸJIQ½$A”wL……0x"””@Þ«ÖªIÀ‰%0ll]À…=ï;Íf>«c¯ì^,-BN9>a²þÙ”\ÞzeY¾–Ub@€ Á—í¤Q ’4jù}ÍB”žîSÀþx,CaM†k.+,(Èç¡  ¿¦õcÂ)˜.·–±õÊ›ÎÃœÃÌÏoÍ(?ÿcÞ÷_˜†1R² _`p!öØþ}û2>¯«jÀܧò¸d°Æ@NY!½†ô:õ$ÜŽMÐ÷q–è0Ûv…”…ÇÜË)O‚uÄÎ ®í f#&q"“)G×Κ¤ï˜ò¹š7¡Uç·£ Ígp?zPm«oŸžðYÀ®«Èk#EA~Qi]‹U‘(ÓÑÑÑÑѡ騨[4 ºa¶q{íåF Sã½¾c ×}˜io –®žoîܬÿƒ&-ê¹]ÞáÓ5vÔA zc^[÷ç|.¨úc…äHqgŽÙ·oßÇÚæïÅu®ÆXnˆMNvvvvöÛôMàf%ž4ÖÖ]¹ï¦Óú˯Ÿ^è¢Ç?T>‹ºô…Gaf3{Œƒ­ä·vwÆ!–»×òyûO))ªî± ^ÁíbùU Á3ÕØÌ7é1gÕñŽb a’dÌ™u±Î\‰–åíšÓÏæì½r/9ùÞ½{ÉÉ÷â¶úg\Øñ‡7í"cw?Ûä÷®ý¹MmÎÞ™;ŽØè«1üK5û²!´ÃkÐÚcÙ›.¾ qTå·t €1ûKQQÛ)š¾ý‰R~lSBƬóž|.£·µV‹ä`4|+ùÂ䶳ŠBÿä¯ÉzcEŽÆ'WöըʾðžÙÜWTϬða@Cgï$ôìŸ!­è’|:8&õRRlø–ƒaüÏͲõsMtvĹŽ•ã2ëKœQ=D4g›­vzawrhíö“ñ¢¤‘€q7fsV€«Št{9./þZ$Ön&‹H÷Wìù7{-%Ö-ž9Ó_ÕaÁÙåúa÷ PPèÝjÌþQLJŸž?Ód-½¦3”7“ãQ2ŽøÝx©¤ìyk­U›~CðvˆÏ€/÷cçÁ—á`7}„У°ifûbêÁ>0v€q†ú:¨Ó“F%¤ÝZ¿|íå×ùܧ!Ú¶>É=ûô–ì Èò}úPH€FZ<6rŽŽŠZty?E¼—ÏÎõ–“pËRN¤wŸ¼Üím¦È‹ñ4|Ô«OoÔ³·Â›½a‹ø™M ç’õ¨*(ˆµ0"ÂX$jÅ\¯õÄ)I)RÍ‚@þœ¸>ë9ŒëË‹/×»$µ+[a£¨ËoÃgûN»¨ï¹çôùÈYK·\ðëß«Ñ¢4’D{ôî)Ɔaó‰¸%Fc:Ь3+¬ ™Ñýþ¦Ê¤& [õª‚•¶Ôtúª‹®š¥}ö[9/Žx’U.ìžtö£Xüe'^/cŒC¢wZ9®Ëð1¦É UAA¿)¹^uéæ§_h'GdëóÉâ ½ZGÂXfËÒiÓ¶ns6Ø)"!ÓCV¼5Ü÷]¾èêÛSœš²í˜‚óºAâ|‚UlX„GŸs»Ó×;Kô”á-j!8fÓ7½>®eQÄdÛÄmÉÝl‡jq•”Eß2ç- ârü‚ŽO·B={÷% PøœÝÍ ˜9Ã÷Д [{xû®‰Ó™ÔC,Þ¢”‰Hôê%'ÖÒ¤ *+)º$P¬ÓœEéç§Ã<Wº×C wzT…>òä–Þ—èÝS@öÜÓ”í«Bgï(¡Èö[v2Y«·8î='v#Ž\8Cj¸éþmËU\âyƒðSúƒâ~³ºˆŠâà>1a øÛ!£`|òP`‹ö!'//õ‡TuüwâÝi7ó…I<½®,†þ¿ñÎÖ…±Ïñ?:qðˇþ&<Ûák»9ñ¯ÊmŸ—å» þWà½ööYKÑœïÆ:_›ˆNU!0®Í}¨céöÇ8‹¨ù—Æ;3Vœ¸GÃsÅ?ÒF ü €±ùÒÝ Àÿ „R¯|^HïT®ä(§YVÐ?Eo‰Kv=ù—Ò-àºÍïPxþéÛÿ…ÿ¦^»tr_q »Ó¡EõénºòÿX­öæˆÐ›éO-×_Q”@]eÉ3ˆ2Þé±ãÙ¹`µßÎ\nðS~§/UVÄ)™oý÷ÜûG:ó81ü†­Ëæ$*ù¦g1€@ &úßÌ»6‹À”r*•ô‰Ìa³ …J!¡‡€øËÁf±°€½0*•òÏ9-cÌb³‘¨ Å6›CA¿7æ²9\@$2•BþK¦¡ÿ.q#„BÑnþÉø›Ÿ~à3Ž»z]w̧[wÞ.®Õüw»$ÿךùÃx‚ý¿…[!þ"qƒØÙ§ÔÔ´i4š¶¶–¦¦F£Ñhúæó0FAÆšúF¦¦¦¦¦¦Ú“ÕuM–ï¿ÓrªÁ¹µþæZãT4TÆM00·[÷ µN„Ðóµi:“U5—´y”´ÔFy²ÊÝÜÞi„ÐÝÃá“Õ4½áðR"„Ò‚t¦_+ã×6*0:)µž?Ÿsír !dkªö¨°ágª#b¤-cƒ¡ö&›ꩨj;ÎÙÌîîd†Š›nç” ùL!Z¦ë_4™cŒ+_\Ñtôãÿln¼:ã[Û¿Œ¯i†ãT®—bŒñÝ .4ÓÙ…-F…¯ÌtÕ£î|ê¸;@w«r²¤m'‡c¡§þè Ÿvॶ<“„»¸ø¨[ú·U%=XÆõ¯+™o2J5µNð…Ö£‚z~‹~ÿuŒ1¦§/›àpà§îÔšLTÏ6·ãf‰ ýc|ÔÏöbNõoyÍ !Ä¿¿¤Ý´›nÙœ®+‚ÓnáUÔÕVlþô¾j?,»P¾ùÊ¡½ZB÷8)~Ý”sákjy6ñ%¢Ýb‡4¿ØV)a¯í¿A&cãçúö»ú¨ÚÏúiþ®Œ_?à‰*‰wŸì}•?,ûò-ËYet@ÌïË|tÍ­Œ\æ†3QkY}½6ÊrM›;u´Ë˜ÅŠ;i<-MÆP¾²$D"ƈQ±Ø×I×ÜÞÅÞÜÆ; „r-;™[»zÁªËY -¶BSÑv¢Šçgï|S4¦ÉUåRûÓ¤Ú!²†³û£—¹å„à•˜X~Ý{ã€>ºc{ŸÏÈit&×oý¾—'W¼çüÆ EQq±¶~Rùã“s¼¾x刢8\Þ2¯´¿kzÒÕ+·Ìè›35â~‹+%ÛÕ* rÔ¾ˆ-é: “+̼såò¥K—â£WÌÊ0{¶U_@(1ÚÿKûô¤kñ×’V¨V¸L?!¼ºŸ<ÂÀB®Ë^2»æ{iéׯeå ’,§*ç]Q#ýúÕ\ƒ9ÓyREsV ¹ žNËfÁïÜ "„ÿVüùc~xʞĕêrá~OÂÑUw8èÑK±±º Æõ+»¢AB¡Wë}1¼ûZl¯÷-a3êMŒcDñƪûïWYi»MwY38Æxÿ‹ I¿[G²Xઓ ø[^yÃYV=[g%&Šr!’¥µ¿0ð pÞd{¾y¾åÝø S"³ºž‡a=-@¿?/øã¥ÍÞᛳΆÖ0(rÒ->ñ@–"¡®P¡Bˆ¿T܇Þ Oß°õªºÕ)K£iªrâC&ÑPaðÑ×1~“xÛT¡óÛHA#$ vÃl’Îjo#%Àô: ö–Ìi ‰¯Ù‘‘Ek=Ówcµßá«w­Æ8¶©Q˜$µ7v­‰§Û6“ß<øG0ž=3ìÓ!“™*Oõ¡ô«È³Z¦'‰BÀfT2‚v”¢ÝÐ5×ïÞ¯Ðx:uoÓÂPO9éÆï_¤& à¼{S‹”d!NùK6 !CÛ†¾ð´Büug(Â0`CÄŒ­áËaÚ“wÂß?*6çãçOßîZd·÷5qv³' ’ï½}SÄ«Ü›‡vÖU±”…ÚÏ—X’}uDÚ,°]äV|*¦€è0¼%ZM`† ¾æ}nE‡#êc6[Á(p™ÉY rœ}sãìÏ%_ËŠ öú;EÞït ÈÓÁqgÄr#{mmøö¥ ?///ÿóÛG 7·p0çes3¢ý ¾~ûú%7hÆ^­M¢bˆòîS^Iy½Õ„â÷´Š˜ÔÅÞü!òJý$Zͱð‡%þÉv[<\3×P²ŸvRÚ£3»×¯_}‹@zvÁi; 1ÆØ`Ά£Š{·†‡HÖL¸±€HÜ}QÙw_òœ¹³Ùô‡%#dz)Ð¥Z n»ã¯N›×G²SÍ©G ¸²qÙåA pÜÒ«OÿÞÐW©¿•€½#|ô²9|ßv¶ÕâK}¯F„.¬ãŠ™xDßpPÃX¯Š2¼bÆyºI¬»á8Ó¨ëYoy¥~¯.í ½ˆ@Tº·Ç†Ëöê0Æà .Éö_¾4 Ë8­¿â®;cØ°%hFØž­u»æ ¹Mˆÿç:1t±E €OÖÌÏ”OŽ^ $ˆBüÙnþm¸630 êÑ{Æ‘ûwáñcB¡vóÿF½á½½†HHèN-„Bq#„Bü⟵û¹[vW©õCWlÜÙá»û²á‡1»ÖMÀ'ùý°i?Ìê×ßœþ)=[žÒîTßê‘Lع¿á…ÿ[-øo{™^ˆ¿QÜ „ní QUÓ<‘Ýî–ý @ËïVBÈDktF¾k„лS.& î²~ TpIa¼çÏÏÚ"”{c¯º{BèKÖa m ssssss3ãI“ÕmìçÖ²QËKõˆµ}±‡¡¶ÚÄÉÊ”MmœÏ¾iî4z1ÆP|OÃlz%/®„[{®j¯Bw-MÖ¥ „U{ZijÑœ\\ µÕŒ­ÜîW´«Õ™ÓT•MWqúc̪|Ÿ e;!À#"G{¢u#BÓ Æ¤•pRsëìÍõ§8»¾¿6ÊrûæŒòË=s>±»mÂ…µ¦óv¼ìXÄH_:ÖîBhŽý˜#É_»Vl]­õìßjBh±—Ö‰¥|ﾧ®ØoÑ áþ·‰@1f_Ø"hc$2…LBøÞã´¡Ò ¸Â‘È2‰çvÞqšÂ0Ä©âíYÓt§0D"Qxw¬!’´Â„;IIIIIIwï¿~ž>A¤péÙÇ!„PLýÃÚ1—’3ß¼xú*ûÕÁHÏí~¦Ïë;Œ^„PX@Èü»åI€¯n|_Éd Àù¡_†»=yœq)>þaæ³ ÓG†zúòF8ÆP»„k¾m4õvVQ³À7M8Í…QüøÖù1ÖQZž;žB@’¡ö ˆˆ‰Š·^éÎG ˆ\UÝ rózæl IDATâ…1}$Z¨ÑY tPMw¡«¢Dƒ3ç³ÉTAÊÆ< ñ?BÀ‹„È2 ¼ö~–©’ÀlÉ ÿ몄1ð3 Éd‰OØ à6¼-.«ÿÅ Òm» TŠ;Qõ'ü³úïÿwq+j¹Ìò.pO'·ldm¨œYØ€£ò§ÞS ,§èéÐ"÷'tæÜÏÊnæT¢¶—ú ¯TŸ¡†Ü‘ªæ·£ç,^:ÃŽæâ·™ ?Ðø5Htêx¹oʾÞ:x—¹!fUO‰–Ç¿‡i8ÆÇÆŽ“$ñ'mHß{‡lë«&÷ã¶V7³E$dÚ¸OÛcݳä¼EB°ääLj™3U‡ï¼úDྗQ™”,¼ôƒöä_^ÆÄ ×Ì…ÞTŸ ’ðöäªö¡|ú â2kfÍ\ dºŸŸïÇÊ6O2”xh¹‘¾®÷4ã¨3ÏÙ59ªZ&ÆÐÝevcÆZWbÝݵxúºó%÷2ñB ú×g¦šh¹y{ëªë/ÞŸ‚ vî|G3“)ÎNSLŒígà ‡|¤•³ü¾£#„WÌw70µqu°0¶tÎ,â½… M%ÏìL,¦˜êZ{>oâ«1ÀB×É'”!¢l‰›¥£«ƒ•žÍ´¬FÞýÿPtm½ãT#ÕIV®¡µ€PfÜFS=/o7š¶ù®„BÀ!ôùâƒÉªîÞÓì¦EÖv¸W1¾}˜Íü–8gþR °~ñ š‰·»½±•SòǪn–¤ÕdxYéÚ:»ÛkÛy.«$zvq‹™®—·;MËlû|„Pmâ,Õ¹W¦šZ/O˜n5ábÖwÞ òïYÇ›{BOÛk¹{{ÓÔ –y‚ „ÝT·¬‹¢ië¸WS–yn„ž“ÐQN€ÀÿÜÚ»$pó5\ùZSÙècŒÒf'T`Œ,´6`ŒWzéo¼˜ƒ1ÆÌ#eZ£í%†ZÚø¸•îÎ)º>R×cŒó••5£R«1ÆsMõÕ?V1ø‹Î½¹OËkƸ(눱½?ß}2ߧ™Ó6Þù€1Î[?qꚟ¶âp˜÷²Ãɼß/®DØzGvxÎa‘µù†Œ1»$ÃBsÜïùÛ÷N•ÛáÒŸÊÛ:ꌛҴ'Z•pÚ¯Âi¿Ð†ž­ëó³L0}ut.”°:ÅcÖUæ—Tt¾oˆõ^WËŒ…1'kÍX›cVιqên_ Œ1æ~6YÓ¤ ³­4t XÆØË\ß×Ú4½Ž1^ï£~8³ÕT›ÿ¥ cLÐ+ &ë<(ecŒ1®w0TIÍo|`u™WÞûû'ÎÝ/¸ÉJU7‡×+% aË[Z”¶3ÈfåqŒq|ÔcÇÙ¼J?Ùë®ãÍ%xwÄ{kǦ”¼¸Õ$p;/aÙ³ó¯}Ä\–¾žî̘ ^ ¯¥ò¥gUDþÍIjS YcÌ)ÏRÓ6©Ã˜ è†:Ú©elŒ1®j¡>áäÃR~š”¤®µpÙ1þzqž†mKW~MÜ0Î ˆÑÍ |õæÞj¹«èfìž'¹µDQÒ$U»<&Æs«^©kÖ`Ü”±H[݈WrÒºYöZ(siíÿMqýG-]Te¡;ùå·fŒñ²YfŽËŽðBÙôúü¢Rá7à¾>ôšx D%`f” o¯ßVêÅ0uðý—éj¢hô¥/YI'ñqVˆ‡ÔF‡úŒW5=x3àÓ!›Gï–$HèN¤ßNÉo3à ÄYo£®¯¯¯o6Jcõõõõõ´Ó¾Ôw3Ã!@T»áÜÄgÕmS/﯈L¯!ýä;Ä Ø`qÛgí´ä—ƒÌ`’ÂvM|%PƒtìE#@mIóøÅvCSßç|{ôª—•–EBvÈ€¾ÐPñ†-#NÉËLKKKK{3X¶ÏÝ÷…Œ´J/îÝ~4îùû/£|܇8,À¤~V³§Ùµ#***ñmiCU#Á®<Æ]ýIUwº\O RVnL½´ñÀéÇÙy}U]ýíFòV%‹=Õx´–‘—nj¢gÞ}"7ahyVZZZÚãOuƒ˜7Ë3>q²Š<0€´úèÁâhÂ怹ÄéÙjóxý§há¥T‘šÝ ˜äÚŽ7‘;¤òYZZZÚ£œª!lÆõ 8=-(›z”ž?SPv"¾Ò7Ðàû—W /ÒÒÒÒÒÒÞ •”Køô³Í h¼vQĤ‡ Tj3ð»Çü°²{äÀƒÆû_íü‰N爊ñ^=Æ­V©ùY$}”ü£Ç9Æ~°¸ ·òÀ–Ròï]=P|QÇíìâNTŒÐà}ë÷?ihÍ¥íÈLûCz¬F¦„”d«IˆŒ1—_Î0Ø@£´|1=+'}kçàåð%õøÔˆ¯)·%9u1ŸY(ÏK?‹ÁzpúÆ,ã V=‘²âVÖ `¿×óLMŸÓ¶°ïNâôî#Z÷µ Ïè¹FK²å @–çV6~6ßáÈ}•´>Ñ£2 üuøÀæjMë~ü2€Ó„0)ãÑ#Þ¿Jz&J Òb“¼RnL:we_äÉ_¨;ÏŶw*¹¾Ü9ºxÃú`Ë~=¿ßª~ÓÒ2Š´BË öd tÜe #:Ì4íþÐØSçmŠŸ•Ó´áì»Ñb@m½ €Ç%L¹±25ýχ^ËÓ¥ÆÀiÄ NB-/Ó“Eº}Ï£²õ¦´’B\œJobH 0éô·[wkHÊù›Ékl/AcNž>ÔÄd‘šªÛŠVww–°T/Þk cl4*ôÎã3æªI&Úâð•ÓŒ¸DzÆ#ž?ßP3ëþ¼gö0!*"&<ªõŠ„I2»Ž¯5óõÜbÐñ?Pêß‹^RÂT-gݾ!£o˜T^»/Æxª¾þY ÏI=ÿìÁ9ž€Àpž>þ„ÏÚ«7Ö9`Œ%µÝ4({·Ä½]ã>ž'_4ÏÕ×4;õÌiP»û¸ˆ¤£™ ‡úôŸø­ò<@âù«\üÔdâ9€³*XÅ›VÞè8YŸÍ5_{ÊŠ¦¯kÉäÝX–0âT@0„P§«Œ˜U ÑÁ3ÃýÊ3£=-·Oìúh71r€|£¸äÒe¡¼V×Õ4Êö@˜¥D&Õ±¹X‚€PÍ·¦ÓH‹Á ÚÒá'% Ý cŒšß—1ûì!˜huUeŠ O0€˜`÷C—,êß»IŒh/ººA¶'¹¹¨ƒ¾ëjj²=-…ÜpÁÔ*dd15$4”wÓACMƒtéN&â_ìD¡©øgò°ÌP« qa)ôN’ËÑÞlgT䧂Âg·ùm8קFPEÄ/Ÿ ßíc_ØÈEÉóç!ÀsÄÖ\{[…ÂÐcÓ¶¶{ÏÝxòõÛ·/2ïùšhÖŒöv$Ê¿;0Hqpañ'@+N¶¶‘®Òs‹xþæí›WYf•Šœ«Ñ€¢ ó¼=og¾úôñcΫ'áógP3TVèêtÇ-¡|õ33}ùrB'í…D•RׯÝnŠš#çÏ|þ•ƒúúüÖüȽøzŽÂ€¥M2­ž±3¡ðKñ§W÷MLLÞV0:µ¼¾ðùêG„²æŠé^}•¤[ŒÜvž6hX?)2 ¸=&Þñ@éžÃôñCõk׳p¯]󧋊i@Jšî©™UIŸ¶oÙ²7ö¶Ë–Äó‡B¡ãôâb¢–” !ŒÅVÇßÛå5øÐÎ-Ûv–·Yïú!I2ÀÎËv'ì—·ݺu;bâTýö^Ü¿œUWÈ96h¢xû>(?O‡¼'¯:M¡JÚ½v*£uÕ .ƒ^×ØÈ›—9Íß_˜Ój'R3ªËR2_u°¢C‡ &€xïƒäàËé‰ì”ƒKCÂ5ML9¿c ˆ´Ôu¬ü ã^’d ଧճ™nf}åÇü"À@]wåþTÉW+—‡mŽ[šî _'í¼éجQ€Iô1¨'(ö&'Fs¶íð²euxøŠ5ßΊßአ:T´u]qÀÐTÀ}Ϧßï‘s.44ôdz]ÆÓ›’"¿Ðû}üòð5l«(oSeiq€ÚâÏ5`Ü_ÕOgPcdT ·‡qÚí½·ö­[)ã°..tJ7;Ðhíõ4ûùêˆðˆõÑ–ËÏÍ2ŽqïSiû~Š ;~ÿ{jV¢ IRqx»‚„@d²—ž¨¢ƒûc±-·Ò, sExØÖ©ç3žNP€¾ý†öl}9›Ý\“‘š&”/pgê_ƒ…¦ãÏç0þÑÇ [6¡žïsµx  ô·~!û…»Ýáöž›•?é?â}ú+Á*õvY,ì¬Nøÿå3…1°?^Ñ\rïÉ­½"ÿhMK³L}7=¾{©³%¹}Ù/ôE<;"„~NÚì {n;Ý–HAKCÄÉè?ÁgÂNlúývð±þAoo>›±ÿÖNôM¸u$7B!„ÐTÜ:[ક~Îæ.À)6°ôhþý’O×øÄv’mwv¹.Þ—ÝõAðîðñ¼ŸkDúŸ™÷ÚÄŠ;A– þf¹ûG|šŸŸ˜î³áé?¢ñ×ùy¤kÓOmšušý9ÅÌ+¾Ü°±µÿÀh÷T*>·ÒuÇ (¼{ÌjÞZ>Jqc·GØÛN±±wÛtôvk•¾8i›>nh­!»ÖÙÌ2êA%-ãVDÄ=ª{pØ"`Ç`yöúŽßV8Ó®`4|4qœ ÀšojîèøŽ$Í·Ó}^œå¶Ú'^³Ú¨]ù:aËŸËßVµl?\·ëbU>][9Åañ/7½98 Æ\:ºèÌšÚú?22ÙM5õŒNa:ž[–º€ãnZ¯Y?ß7l¹%@åOŒxôùÂúÅ»’;ÔCgÙ¾PÝ¿L¦öñCù׶Ïßœð[«§±vëÖÍßiHÿÔQ„`¯ƒÖ{ü;¾9×0¹´‘¿¢ˆÃe“H¨onÌeÖVWúÛ/áâçV.£©®™ \£¶¡‰×:FÅSSÝGÜñ»cÞ¿eîÐÖ·+jFܺšZ6Œ1 ~æ6 ž›–Éó;ÊJ¢f*‰D…&.篜'~2Kˆ7Ö±D˜¬’¸(egÉô Àm¨­-}søVÑv¤¡¶šCn¬­apxŽxܘYæÖ³ö9-Þtèðáà©cçØè‡_|ÌæƆfž—*¸=#úelüqÒÿì’ä—ÄMEò±UgR¡äåÜmÐþ.%pŠ…Ìòõµ'>2NnÛx>•÷)iËÌ[oñþ'®š½ïMïðiÁã‹sü|Gî­%^%DÇ&—Ü‹ô8SBÙ8Ûw×›fH»ãï7ÃoÞâÛÙåÞaÛ*[;ºæmÂ"ÿ³Wæ40_í÷Ù˜š~n‹gÄy@ˆú#Ã||fDîŽã !Ì*™;Û¯–IH±¹"T.`1I€×ɧ'¸ø‘èƒó7¸{qˆn •½Œ;Y@¹ûô–±ò0%EÅI&Þ)ñ+ØoŸñOÎřǽVßK¸Ù“‚ÿ‡ßHü•í+vcÝÝáÖëÊ¿~à Ÿ'hZ7bÌüzKk²NÊ‹wùy×y˜¸DÝ!ޚ಑çÈèFÓ±tðÅc.ÓJ[7·‰CO_¦i4eÝ‘ëŸ>>16}3ÆøZ”Ŭ­/›¿æ˜©é&å•VÒ¹ïöûìÿ9÷Ó»nc3¿cÌ>µ6äú;:Æøí gó {·ÞTS-!óM^îç¤}ó&¹ìÀ¯sQ8‘’›—÷ìîé1ÊtŒÙUi´ÉÉY9ù¹Â œx‚MÑ!.AQqß¾Wó7°üúLMŸ+sõTN'?ÏËËM9µb¬yHwq´Ò7žöîKYÙ—7n´‰±OjpuÖDuãyA;Þ}øH`ÎJïÍ—>çåçdÆÓÔh¯¿±9ÍMûV¸Ï<õí{mñ“ÃZzS^¼ÿœû1;ÐTuîÉÝ”¹ßÎ!<³›i:47·å/³³é|v¥¯ãâèw?Þ?9Éd.ãƯo#6ìì¼áËÎ6UÖ8÷ðåÇ÷¯æبm¼ðµsL5ƒßËËÏv纮M5ƒ‹ßnT×·Ú÷°ü{EÒþeºÞk0Æ%/ Uô•U3¸Ñ¾6N‘§>åå¿I9EÓ4þP‡1ÆÇWÛÚÎNÿðåû·ÂVÊ—ËéÅN†ºqY¾721nŽ^òæ‡à°˜l&¸  c\—o`¾œ[õH[Ë´ŠA`[l¾.žß—Yž3IÛ¢’oÇšhwrÍ75ù ožnâµþª÷WsÙL‡‹¹“1Þg?FU׎Õi“úÉju=³è¸”oååw„j8G`Œ‹ŸÓÖwzñöýëÇ·UÕô?7°‰W«5LÜ£O'¾Ëû†ñ÷é´ÉkÎ¥äÝ8fà¶cL°ÊW¯ZUÏäbL0Lc“Á%0ÆužªFcÜì5YûouÑšwú3¯to½1¿cŒY uGÅ Œ1«ÜDYÿ=9ô"š»5Ïó§n¾òc|buÀÆk¼qñ1ÎÃtöLp= õ’Kù¥@'òÄ ñ0[›ˆ[ 7µy©&vÝ>ß|‚ú ?籓´gVýÊØûðàÚ­Äû¨ËÎZ3Aų¶……4™8Úaü²Äz^žÙ)÷>Ö0ñ›u“T<ê1&0ν¼YsæÆ6ye«¬ó„ÞÍY3?'j´ºi7˜™§£A+ld 7ÜmÖãçž)x"(nýÛiÞÆÊ£-§Gv»À¿Õ#œo¡žñ”5úÏ£@j¬¼hiq³¬®&ûá3æÛWÃ4¦YÚËŸxM4|8+ª2ŸBBÀU¢Iðâ“û¨)¬ lYí>Kk¼>v’Æ´¹KâîåPH]ÕFŒ¨JÛ¹…ÙŽ3´v‰Ü¸¿†K EìÝõz—ç$šù¢ˆÏK™8ipñqÞå6«››ßÓ¼F—ÞºjÁîZ:fË×í*iÔÝs†ÉJò”ø¾=äKª€„°˜ÜÀm.$#Y*ŒÓK6§¬†/qãóBÊ•^¼¯HAE„\Èäüœâ#%yn_j$ådI!ªŽ™Ioj›VÞVYyÍ#G)è9`ŒÖø!Õ¥r2½Zbb¬Üƒ”UÔ °ÜP1^c(„¹ü–H¢¹€ÈʼŸf”„¤\Þê†"*‚0»“駵ւ =eã9üpÕ⦮üG‘ä²¹ìî¬'˜=À08ãÂòýSWÿ|_u”¡µ…Q×R¸}TdZ(Ö³¿t}Aóy>eôXiŒŒ×7)'ÜÞ“xN¿ŸŠ«Qnb+¬¿²’ò¾ÎéÐSYS•U¬;ÜÍDºÇwôô€#  räšÒÊñùšÕÀ>‘òÜ¥zEžEþ§7’ÿð+š¨·$®ªç´rC#ƒ#*‚Á@ÃðMVú›»IæN£‡x¦»ù0æ–ë"³–þ`Ôµ‹ÕÄ‘d•#÷ >õîuƲ馉{çï¸þ^à:UË5àvfε#†Qß[Ø.¡(N0;~=íUÒi« RK½J€ÚW ënåÝý—tçνœ¼œ â?iÕD+ß«)¯’ÏîTîYîl?»¡Û52‰Áá𸢉Δ ŠòÎsð¨‰ÈR-îÑ –Αç÷T öçT7´r·ž ÄIèWD<Ò¢“ €r»±‚$¹ºÉϼ¢Tq‡Þ–¤ªzH’ÿÈúŒ(2€©w[¨˜”‘õ<~±m7{n¿µ„—<¹Úq‰d3Y¤Sj‰Þý¥k+¾fóm¡¼äø´¼*Äe“ÍìµåFN9½Âh¡£[ ú‘ÄùÁ=Öˆ^Û*áY ª”˜ˆ¼$§ª ³W{ ÕeÅEzêz´’áî³·oVŒëvìdÞJ4p7>C;Bxò¼#‹Ž_ø\CîÒÙª®¦){ÚîÉŒbž=£™Ü²î‰°g‰[WŽþŸ8PÜ`ÏéãŸì9À#fþ¥cU¦Œ” KWO¯Üù<ÈJä(×å‹}GõÖ2ØD¿ßÈo gßÉ“š¨)Ãקs(ß°üY €:AÇÊZ}\É×/¸¢¤¨†Þ6™ NyjèúË «4rzðléoïXßV„lm@’½-Üg!˜ÀËO9eÃ&^fáý­'R#D/+\ž›ó¥º}E ÏCVÆ€„Â`×þ½ª K»Ûr$Q'¼äÍâO_gN¦Üv҈Ȍ£2èéß8vJîGå1¼LˆÙ;O;t !@YG÷rGzKSöJCúKÝMÿÈ»‚Oo踇 ˆËjþRRÖYƒpVùp:®ºµcŽUÀ®£”›ò sè<ŠWf46zOìÙýX%8(2c%¸Œ[Ÿ[îè<»o[öׂàx-!ÊŠ‹šÙø;_ò¦æ½^HýÜùR‘Þ"ôbý­}úÆ—ůf†m®¥sÛEÆc"Chì)Î+[ .¥Z¿iûn—iC¬&)» €ù)õ£øHÝ^ÈÖaDjÌq^§Ì¦MÜö²†Ÿ˜šÆjÅwî~á‰(nͦ¨=LŒÙÅ_Š¹DÇkCÙ®ævÒYçÁŸÜ?‹_p éÔScÍC$«ŸÎÛ}½—?£jo€ýÑÛ¹¼CÑ<¡‰Åú¿Óáã— IDATpøþÖ¹ß6þ_ÝšúÕ (›Éæƒ`2™0ÄëQê4}kç!2¬¯Í'£` ýLG}^R¢< ²ŠãªsszêK`½¹y¬ßŽYSéââŸ?/\½_€à0Yˆ²¤ÕXIm3Ý€ƒzºÑ¨}FPée ”!{–Z0WØhõÞòq… 沘l.¥>»ÈƒfrdH_éÜâj» [{‹ôUQúbM£õ<¸ºìË`swSi—³ûÓ5 ¬F)‰VrC¢€ÊXÕ]›Vææ<½´?âØ,Û\¿ô£Ó”0—ÅdqAZU¦q'ÍðÔà~òEÅß –®Ý4æ²ôn8»Ÿà”ç6ËÓÎÌÔ‚šg &ïÚ,©«ûfy{è2¶ìCÞ0‡•Îª}1À„±ê[Ö¬úùéåÇ.{úÙ%(QkkEú_õ#us–à°Xl00y™`Œ÷îZé>gæõ==uÕ–» ¥¡*'Åj^LNêuþYYB74Àt¾™¶^/ ‚)9nÿù ‡¸õ–Z}‡*È)T÷Û5±§(|å0ÚÖr˜Ë`²¨=,GS=µÌŒƒ_=²Ðk®ù…áôÒ\©1Žö $€Ãa²[W]˜`1Y\@ÈzBŸ%v–§½6œ 7ÓL{ÁµÂ)£D:Š0.³íî4Œ7Zod¼Pd .‡Ébó8ÊuÛÖ†•[\?”ÔQP=)ðh¢íy€|&ƒAð´Œ]£Î¥Û[.Ÿ°Ùµ»ŽÊ¾uújø%KævrçŒp]ä´›"þù}¾Ï’=<ï맪w^Ž]ÞOÅs±rxÃf°x—dy˜ÝžÀç>F4ÅAƒ¿æh8…‹Ì[kû»Y9 âíþÿ%÷’$µÕÚ.=a1˜D«ìC£}¼Ç_>‘Ò2s²™ Á»¢§ÏµäË󄛨…sÉ"˜"=YÏéöÞ —Íf‘9¼ùA¬¯Úå_K_ã‰&ÊSÿ'åͯ»òLŒ]~uˆÓá{‡[5 ™òEîîªÍŽùÝ]ÇÙ¥6˜Ht0þ¸±(uqrƒ ë?âÎçh¡õ¨°Q`K¦ëD¢K#»¡:Ñ©¼€ŽÉ[ v·ÿ±7"A+Ft­"Aü¬GÚ ì¦b¾<;'éÌ ‚:˜Ÿ °M·¬ÔÑuÄ]Lż XùsïÔ)?ëS ,½cC:38!`·èŽ‰®„ø)Ïü—ã×´„:#»îü#ÄÌÿ!FCÁ™!ÔM¤™wŸÿš»s êTßôs§ÃCõ »²Xô«ó‚Š$*ÛÓ¶D …´:×æÐë›X]ZE–•‘âOÉK×19BXåo²GÎéâ„~L¢-æ¯bç~Ð#ü‰~b*F®Nï­Ûê`~6P“nSïO U³ù%þF¨;îTÿ[€º)G?¹;’HÐxêÊ0è¼ú¯ZLý+azðÇ®ïuô^]g}Pu•bÔ¿Ò±ÙÑN¡)¶á8’Ã’/íû•ô"}&]3„袹±\rʲ‹[&E¢‡Œ¸>ÿy]4…Bˆÿî)!„Bˆÿˆ¸ÁÍ3Íí[”¢òËƺžõ|ö/ÉÇŒf¬Þi æ·¨¥þffffv+w_ätt:»ÖÉbzH·¥p^;-=Éûyç Ÿ¹¹™™Ó ^ññÛ—Y˜›y/\WÇîúJ$§~[ˆŸ©™ÅÂuGyÕ¸ìjlb¦g0—÷ȧû‡Í ôVÆ—@É£3îSÌÌ-ìvÄgAÇêmôÖŸâ¾è;ß¡ª”e®»ß7¦„Ò|ÎÚhZ•¬šª—ÍøUÒ}¤f:ëÏø¶Ôð¯ÓI+Ã¥3L¯fUüÝ+ Þ_¨»¬?ó¢Àšep±ñÙ^¶â¿t}û[(}›P üõÍ0®9“ü—Åi*;Ôò/¼£á¶cÜüõ¥–¶þ…g…ÕÕ5U•{ç˜iš‡Òyæu‚Àô7º:NAÖªg‹XÙ¯\LÀ¸Ømåyvqæ“<îÍ]Îþ›Òš›0æìqÓ·]y¥²º:ÿÞVmMû vÇ-v™ƒºjpìóšêªÄ­î†Ö¡l³èMœªûê=ë0ƸlÊØÉÿÇÞWT¹<ýÏž¢ÅlQ”îîîT »±Qì±»»PQ[Qéî8Ïþþxx@àÞû¾ß¸÷ý1(çœÝÙžÏÎõ6Wˆ¿\]`nT\US]Ufnº÷£d¸núúñ—œn¾&»™Ü®ìʲFŒËíG9Uc¼ÈkÔÙÜ?Ý}å‡þWÖ}–£Q8ó_y]Ж¡øv¨½¤•eEMá¿ûiÕTÃBŒ1±È®n‡Øõ%e5Œ±ol½@ˆ»èÿ"ˆA^¥Ïí”%ùœ%ɧGöïìÎÒo·”4ýÇöQVQRQU‹Û}ißæHŠH|g”‘~®»¹ST”ý…u»·²$·~öܼûi©*{kP€Ê–•“4+¡Ÿ^ᥦ¢ÜÏ&aLÆ»ïŠ%MøåoŸ•iën¯§¤¬ê8çµñÉO¦€.-C•“§"šê©½zËHQÓG¯8|L[MEM]{ïêqŸ/Ü”Œ[–2x ‹U €æ5]¨£Y¨PÙïÎN~ /"èR˜‚eä€Ø;ÙkÓ½º¶ªVåÛ…q‚Â'_~[Ú¦?î}øîOñ®Î/Þ¸ .(8hÆâ-åb¯ZáÉ­I!!!QSç¿®$ˆiaLJQ„·ÿŻÖmáöùT|쪥×æOØüñéñuÁA3—íá5+ yÏÎLŽŸ0ýÞ—zqn~QÔøÐF,jfèû‰ 'ÖG¦=þ¹rjК‹å ñË­éQ!!!‘©—Þ¥ìÛœ˜‘Ó@êÏÏl‹ wõm5`Œ±0:j|£ nu|T@`øÑ'y¿mlÀÚ¶4>4$dÚ‚õ Dsð¦Ü•³'…E½÷ ®Í÷>]NK Ùò‘ËÊÞ›°åÙËísbR3Zø\X±>=çËÕ5›Ò¿‹XåA3)Â×aÁAaÁÅ` ¸à¶[ØRà÷Aé¢Ða +ö¦Ñð#lÕâ÷R#û©u’´[?³ÒÒŒ5Gï‚8“ÌÈáCè±Ò{îäǀБ–þ__ß`þVJÿQ¹Ÿ¹ÑŽ=Dꃵ~©Ì¬º/ÒÒZÒ°ì©zãk¹dN>ŸÇf€8 7µ'¢<)á´½%_Àx¨C€Uo À^üÚiª¤3jºFþêʤ¨93"˜¥ß ëänd“XžþÚIPw½U%oú0â¼°°Ÿf5aÞÚ¥3Î$zî¹ý³å·¢g_IX¾fõŠ¹7—ßÿ¾!ãê®b5qㆠ†T+ë ¡óñö×EfkÖ­[0ÅsŠÝ¸\¦håÿÜlÏûyI‡{D4˜Ôé_½víD °·ŒlÂ_-‚xÏ\·rîÇÝìm7{-…‡f$o‹$E0K~Ն۽߽¡ŠD…¹;~·öÑiª)(ªdSe4ÖNÕÚˆ›Szòê¾Ê#‡íú…k݆ ¡þmPºèŸ$nˆ˜\ï)¶ö“F‚NÌ }L¯ï]Z}oû!ÃÜýgÏ_SÈÒãœ÷îèMžu„ž ECoJÿâ%gË[Ÿ½0s\Wmž´d6¯•¥@È®¢ ¥YÐ]‘ZSÅ’XàÐ{ØHÖÇO× Ä˽ù•ÀåM­á~Â&&…Nkñe XÎC‡ª_1(`[¿6÷tDáˆÄü¿Üª;YRc0è€FgP`ŒÜç¬ò£ ¹¾î-[­¹Ùa쾆oJ=l4P®Å]¢ûØØ'Ï Ð[K»ïtc…K øõlB±[Ÿ^½zuŸ‘}{.έ”SPîÛ»·ÎH“'ÏŸõ•£©h(cLﮩŒ!ÁnªçŽÞÛ=Äqžø‡žF”fؽ’TU#»²„)Ÿ2Ñ6ˆ„\6E«ÃÑ%DªÝú öë<êØ1šdÀ\P)K+dJ˜¸ó3/ÎX¶·÷(£nŠR¥R4‘ؾÛ]šBö…Bž¹sáÙ7*ê-ƒœ†žX¿?£ÊÊt˜48z—ßÔ_GÜE ýÆikÚN#€ Æ#·ÞÎtå|íÖyçö½¥èzsûSǼ.XjB¹ùˆæºu URQí¢¤¸iíö‰@I›†*¹BP c„(«­VP’€Ú’¼Fåþ}d!éA#Æ ©ó©ÙÛ¼ò~£¹×nç[ƹÔ3Y@^K—Rœþ” ¦2ÐÆ“ów›ŽŒ²O¸_<¼(f»¨¸RVVAC}ÍÇßÈO®góôÈ2-‡1é>£l ´NÞyï¦ xqû^w+§Þ º‚ׂ¤-úuüXuƯIÊ«ÎËü^a*¨/Ì‘ÕìOùkèg-yô­/¶[H4† ßkÖ½-^Zpo¦#ù¬nc¯´[^üúÒ{WŽEû…ÞyyQ]}؆C—7ˆš2Þ^0ǧûÅ'&Ô–ÚaeÃóªä«eì³ûò½Ý,S«š½ÚØ<¡4ƒ!'#bϾüÚJ¾Õý@µ8ÄÑ4ä„Õ"ÀT@„"‘ ý×úe­Ÿ·6`OvŒž4öóT"ë?é²²2À @ùOŽ¾­~óŒvqÜu9Z]÷÷.jCæñÑ &Û9 ÃÎ?¤Ø>:¨z´ÑÐýwß7T^÷ ›Øµ¶ÿÁ‡)vMéûœÂv~5 †·½CN_NYö¶=§œ\#àÉŽI‘“V7ˆÄò£!ÿYU9³¯¦zöÞ]ÕcÃæÅDLŒ‰‰‰‰™3u±ÜúEW•?>~+ïpŒeTôçUxU áãÓïÕ®ºý†X¹ÇDGGGOt0¬Ñi_܆J ¢À­'\7¼3"øÜvžÃÂ[,˜sÞnóÓhQ?”ìVE>ˆ53²PapÝM÷„š‡_(~mTDœþ·!#ª¸ §6Û†ÌXn|f¨ÒGksKíšåå•ÆSF1s¹(‹qŠÚyµE*­)ÕBGm­­¹Íê£7-û2Ì]ç%OtN¾ÿ+”ÚÐÈ©^>49JN1såÎÃR€g­Û>9z–ùÕÔ&¶âðÝi±óò=Ý<î¾þ¬¡ÑÌ0í¾PÀÏvc¦ºÊ;LÜCúH5éNÚk0 <&(ôØå‹x™(ÉQ ÃSÒEè6J.ÔÀÖ2þàj>‡'$'I„ƒYÀæS û2È™C¸<>2}ìeù!.Ç.^Ñ”55ï½ê¥ê„Qò Jýwé¯"Â;.·IÝAâß!¼Ä–ru«ß”ͯpûÈ\ügÐÕ˜›a@ú݈rÌFzÖtŒ'ül]ìíBcœ}qsÈìÝ­‹j¿’«ß_Zü”Û9&»]H;Ña¯w†³©}kdìßRjéå(“¨óˆunåªÔP»]Øz\ ÑéçG¾í&NüaÝ6 ”lD»-ú=ñÂP«S/ÊZ†²½A颿¹ß j* |‰Pg‰·Þ¡?.!!§©¾¾ÚAævP€ñšêÙuMâ­–¢ª‰ î}®arEÁȯTöµê…XM oÞ>WTÑn6C´B墶bxrí~‚©T'µC@ÚQ‡½ÞJø×—¯º²deÂlËðYR­LJ·îô;Öµ OG­ gm‘àuõåõÕl9yYè4 Bíc÷;°¡غí¶H2q]ueVÚ¼Ûµæ^†Z¸y(Û”.ú›k7ÿmº{pš§§‡Ghìÿ,ûµÄp7'—ø&Œ Œ _žòprXq¾¬ó\£c–4þmŸizénë¸üðI ¡âö¯Ù7þMõä>aÉqQçºÍæ†NNjt¤FuÑŸºá]ÔE]ô7»™úc-IB]ú;«rÍtÖˆrþ]yÿ턦&_*n«Ÿ·›~s[hâ¿2â¿Xï’qƒ1äMôr4ñ_ùwŽð‡Ú2Û~óùÜꈄY«Çxïø›7aJ°åµìš?_Ç–åˆz2ÜÞ­Eûþå’K’!Â"Žƒm“@]JYä`kåâ•‘WOz¥#QÓŽù,­l&.J!Òß #„îYãhkå:ã[‘¡}9U+¦…ZZY‡Ä-¯{†aŒPáÝí&c~ðÅ~ ¡’Ìt?'k[;÷mÞ¶ͨæå½ëå]Þ‚ÿYqÓaŒj„n­[[®ùèø¼?žRÿ¥½U”Z(huAÛ6‘ˆ/ø[¸it|MÊÛa*EBS-+‚¢¿Zb{‰JŸžsâ_%™%bAÓg-G£¬tÝ?ðô¥«Ç×ø,ð²ºö“@ˆ—àhþcpìõ«—§Œ*¶sŽ&%Ô™Y+^*Ÿº|ýð"«H+»·l„ˆO×îQÛo\¿¶yÊpwk{ŽÐÒñžóïUK xÍE¯'$Ývúê…Ó»Ÿ¯Ÿ2ùLqó–ƒBóâ’„LtI‹ÿ˜¸9º*äèƒïI1>+Ε!NîÃé~~aï|€Üý ›~g>;î1i;ÁL]6ÓÇÇ/~ån €Ÿ, Xýò–9ž‰—!à•mœ7ÙÛÛoáÖSäDÇ‚F¿ÀP®œ?1ÈÛ'ää«rñ`®ˆö M½ôë=š³Û—úûùÆÌ^Y+ŽõÄNðw¼žÃ€[[ÃþAÖ¹ôÊœÀ¤g05Ê/¯øݤ ·G¹¸ÝEöáÂö@¿)‹S…w.o¯î ó÷ ›x1³˜u/÷þ´ð@ßÐÉ÷s™m˜»Õ_¿iIÛ…Í+wfŒß÷ŠÒ¥±!^·?UsKßÄ{‡DÏ+nŽKM”¿Jˆ ññ Úqñ-ÉjßÒ SO¿/šà½îrÈ8¶ÆÏÏoÞÖóøûï©i yi\Æ8¶:äèÓÊSëã=½|m;Ó\Ÿ¦åÓ#||Âîð·$†_ûT³!Úí£3ÑÃó|¢R²OoðóóŸ²0…Ä,œê—õíóôP÷3¯@éë Cü‚£/¼®h>«û×$øùFLIüQ+ ™ç"–-Ë>:5§o]ìççeAnƒ° CPtesï¨x ˆ”FéZ®,/§:ØÝÕJãÝólVöõ{ÒÆÛ&ÈÊÉëù/•«ûöš‰„G²~îZ>QYNFu˜ÏD/­ÓGr?å©Ÿ8VMFFFk¨EÀÍa‹x&36ž\;IÄ﫯äMMÚ«­(«¨ª½sþÇ£§ˆf!ødÛô&›¥f*bïÓÚ¯}¢gw Žÿ¹-àÏЮ…NÖ®q/~TÔ «¿œ11±û˜[TR”7ËÁhÖù"VÃñ„ˆäÓuµ W…›Œ]v6«¬¬ìùù f®ácÎóÙÆvÇî¾)(kÀ8Ïs¬îž;ŸÊÊÊ®¤Ì±‹\ˆ1ÆüF##SI;J«jk+>8Œý¶\€E9®£õ>Í).Ê]5ÞxÊƇóº[Em¿]\Zöýå ScÛ"&Ƙ·MRV‰c|v‰ÍÄ-ŸÄ/串˜ÄÞÁû¸X¸ø,øœ›ÏáÓ-ןù!Ù´Ú7[Œ rqQYYiþûñF#WܨÁóJ.µËÎÉ+Ìûèhnpãc•„3NÝD ýù'^––•¾¹±ÝÄ!€/"0ÆÁžVN“6—ÖÔ?Ù­gb3gÍñºú†§éKìƒaŒù•÷LÇ¿üš_ZR´<Ð.zïSŒñæG·é™? *‰o×™ÛŒÏ+.ùñ·ýØÀ£ã£Ëoª1Æ© ],Ü',©®¯+[î¢;ýL ÆÛ›ÌKË(--9¹0ÜÜBÿÔórnÑýΟjÙ~{<ÄÜÎÿäó¯E…ù+½M½6eaŒ'Y9x&¼ÏͯgãìKÉæn‘?‹K‹ó>EY›Ñ„1žâd4óÐýâ’’¼Ì£ú£]òXÄœß>1lÆžºúúë 6n•”äÿxg6F7»‚Ý*ììs× ÙEUõµåë½ôbŽoŠôð[~²¨´¬àÃUë±F/+1¬­©Ã˜?ËÜø [Ò%‹ÀÇÙ >–Å~}v£G\Kü\áfw£yÏ›°ð½ùÛ*¾8ÚFæ¡åÎów`\ì<|ìrŒ1ÆY†ú¦La˵U®õ0³^;q ®Í´tßò^ü±áÑXóILŒgY ºR†1ÆMÅVnÙ×uÇô?£?+nR9O_ccÑNÝ7›§óºþØHÆ——D‡ïº‰1ο•j¶ %cà8“õ˜÷"aœÑD.ÆÆoSg›'iþ½Áq¸i¶7f/›Ä·ºáÞ&—³«>\h6cù§¡4ûs.·2ÛÐÊ¡…ùâ§=ÏZ½mÕ¾¸q5?ü¦„äü›¸í÷×?UJz…}Ý=Üm Æ¢ fƒÏ|æ‘wà_n¯vòŸ1‘az¢ˆ¬Oñ—÷ß+½üTšqÒÀwjËÇpÓå<Œq°‡Ù™·¥Ø Ö{X 7þxjè€1q2Â8,½¼¹"úÃ}k1Þ2×qζk ×;˜{EVãÆ {½¶âÆiÎÖÛd»>tžzEÈþafjÂ’Ž|Ü`«Q§2Ê1ë•þp7²˜·Çƒ]Ã6‰ŸÕz8}ŒçnãÉÁV[o~$Kœg;d×;q8ߘÛÏ%ÜÔØ„1ò¸,˜h1øÊwÆøÞ©‘sO`Lðš|OìMÉæˆZßC§¯q›¼ü€û¹œa3X–„e»éÀ¶–&9%M²]T:aæ–`¬FE#@ ¥ª)÷»:KÓ CzUZaBØCEÔý¬•É˜a}Š åKY paó¢­·¾[[ê)ÈÒ‹y ÜÊø…ƼT8oÞÐ1‹Çê8øO ·ÜnIH+i‹£‰3舷SVVdv«Až`ùëh“wS¦w&Ã×!ÄYé–×wBÚ²0 À KóE-7r@VQ òà‰*‡'dHÉBÍ[çÐ [nfŒÓV¬/Ìv÷±ñðñ`yj»:>BèꦸE7ñ'éòÀ€2Sbt€ XJFüŠêÐe±‹þ€þ<"üVXKV¨³ïa¢NûéeeF»ÜÙ±@òKÞË_¦êrt-Ï9æx¶b.hçÚRMNª¾‘Ó|=@ÎW%Š´Êƒ»W~Ÿ+¿ß¡òÙ‚vDÏoÖ+%\Ç‘Y›Jë)È)Hñš8 €xMtŠ,E[(ªåÈþ(5¯+YiYÙÆ÷mèøÎåw#,ê¡@H­¸·A¿Õ¸÷««¨ R¢znóº*¬éôʘl4vË—B¿³‹]‰ÌÍý#£ˆ8gßø«K¤|Û{óÕÍ'4€¨[émøÑú-K=³ ³ß=œ8/D³ÿ]Ç*Ý>Ñ”A€o?}Èè ™ÚÆߌ0BÜiN&ª!)GÂÍÈîÓ½Wiõ‡æ†—R}‡Êc°¼ty«È#@SV¤ÓÝ)çU†ì0ýqÚŠX¹÷({UؓݸÙL¥{U„Î- Ý]1îÕYtŒÉ˜ŸöIåX§c@ äk¾p5Κs>Ñ»{—ÔøO^„3"õî®&ŸL€º·'Wx.9WF™èW?yüQü(USÒ¢UÌÖ1”í|¦§•×#ì‚I[…íJ,²pW|õJ‘¡ÌãóÌ|*hŽ ÖÖÜ(onÛV&åTqÂ…?ryä5Ô¹_É_SÓò:‘žï_åV h^N™»Ž“knSÚW(éé~÷Ê3rÙß9v¸»^%pÂØ×[7‘ªHR€åܳo"¾¼É¬dƒÆŒmxó&K“Š·|Ñò:Á^ePBcž®^N~àä\[²ãVëÒv¦òOÝ$_ªI<^ô‡{*UVGœ¯,@œÏ'¾” ÅÂD$øsƒ+gï¬seÇòCÞýÝ›Ï}Bˆ0M†ðáÔòo<ÆT±>F„+§Åç Y]§QjÊõáǬL‰°î­»ž1H•ŽÓ_WOl[þ$§ýbÈÞþTjÊX)R»Ù5É]fü±áfЬSô0±Rúüèj.jüv;‡PtÑ¢(ë©°çj aÉÙ /ì=\Õ5{”þÌ­‹SöK&¶é'ÛÒ·ƒ4C|u÷ýÎæ”Cî¤Îb´h.?ÌÈ~ðàþƒÜ`ĨXzãy¢ww!·é{nQ—àø÷j7>—/‘ªÄèˆ]fY“õ-ú¨Pj¡Ûº}{€Ïã D€zXYõfŽ‹‘\·ž5ÅefA åðD|6WHŽ;uHXòÔÜP+SuMÍÊò:Ï©kh€€Íù5=¹\ŽÀ”!!b¿›ÊÊ2DJÃSï:\><#:Ær—b/fIá@ëÉS5¤˜Ó]ÍüNŽ-mâ1'%z^Ô´'²‚&Ï™βHn¢f‘Çç±±Àû¦ø2ggmõÑt`X¨‘ÍE5º nšÁéML`áÆ­“&%8\Qb°ª”G»]l‰1îí—âò,zŒ‘•nè®ë³×[€•æáx$/F_/}“ÏLO#)õ^µÅÅú>óTè”ÖEc›MžB0!âp¹ÐÓs›Ï³Ifv}4¤*¹²‹·íŸÃä†ï¸pïÉ°X;ïÃ* Lœ¯7é0Ù9l¡K B.‡'Dt¥Íá&“ŒõúŒL×v:D@v˜•N““eôÖ[&.—ß|.â³¹àq9$CŒqð¯b§ÛÒ’á³ï< pÐïicï9@ ÷÷[íüem´{·Ë×t†[}NYíú:5fÀ$»qtõ¾ÂÆ2UÛ$Ý sC½ÈáB>—O5ï <O9–ç{’®%¬)GG è ·úœ²ÆÎf/Wu øp å'ÞÖÀÇX“d'£|çîžã{èÈâØëµB*!Õ}ÁÑ‹ „ãÕ'Î ›j¸)ÂTŸY»¼Ó¼7x?ñ16TíÙ«ª¨ÌÀcº›¶”ž4óÙŽ)G†ïgl"âÑ÷e>J_žÂô01¹!®'¥ß£Ç'ÂÍá°˜ Pûù®çœŸœí’ÿ®›©6ßvbo·2¡"›; ·ÜðÛÞ·#æ’(s¢38{«†T¿¿¸äwåwÀ7î<~9î<Ƴd|k¢côs[и€ÓÄä‹+:f0õf»ƒ"ÙcMõu¿PNz—³ÚA¾¿JûƒÛ>Þ.’›èdDÚ«äïæY¢u†öû¨uÄï8ûv!õ„Jo§-ó– 0Æë‚ý»Œ¾ÿFDx€ïïðÖ`wn¹5à¡ŽP×í3—D™wBoƒTθõ4ÁD :Èò;àÚ‹–-Qtgèm 6’Ä”·¦oÝÕyO6ZÛææ~ž´ëûôFíÊ/Ÿ4Åy;ÄzX\Ròñúú¬ò#q{ñÜ”ö· |¼]C<êdDÚë|Éfv4²¨u†öû¨uèwœ}»úNÛÒ~[æ-B¼²ìJý¸.@ÃÿŒº škÍúvkßÊ}·x4¥€Ykü 5;}c“ÌA¤,›õèc±J½5«ªKýSÃ×wQ—¸é¢.ê¢.úÏÝLu°¯JƒþΆª-àÿ’õíÓ¨ H¼¥™ÿ¿t—¸ù5¼ˆ÷#ÊÍÖÐgùßN½i¦õÆs?ÿ//Bwx/ù—1âäáë󆑎kDÿ‚ùýy‡%C„к8›´,ús}²?ÑvÉáo]çÈ°¸é ¾~CÑä§ýñVú_E„cüÏ=>vØ{Æ1G÷$èý éáfu±¯bGÏÿüñ!TeaÏÿ-ñßÖe<—±+÷'G/tñÙÄÀ]+ü)n.õ;x÷Û‚p·¤Ó¥€õãÞäo€½7¿ÀÝ37<Èi|tÀ.|#€¨qû¢©nnS—¤ˆHDø£E^ËŸŸÙ0Ã9á" œ’5ñ\]=6ž€fD¸‡·?_T>'ÒÇÕÍïØ‹RñKòñ[Ílxgï/È:Ÿ¸ç#TÞš¸.ûÕ© žînáq+êÅÆñ‰53\]½6žÉÌ¿µ0fåÃ' \÷äÁŠñ>‹•JÕ‡«Á>î³¾7¼8™pèÛƸ€ð­_0 ¨Ìšàææ½!-£e]ççáîíqöe9` ÓÇ#œ€wžöÎ%ȼ¸+ÐÇÃÓ7xÿwm¶¨†‡ ¼—¿|wi»—»kXì’J®˜aþ³ôp?wo¿ð ¯ÊZ3ä‚àÍÉ3O-ðýþÁ`/7ÿ¨9_˜baùùÊN?oèÄDåu[¿ÕÀ…í“w^)èZá»#ñŸC„;[¹Æ½-*«iU}J71uÈ).¯,/žëd2ýLÁa¦Í‹Ù|¶©¡ ãŠPC½Õ—>TUUe]Ýlæ*F„Ûú¥?þXZÕ„ñOw=݃¾WUUÝÚ3ß&|~ "Ü-vwemCCÍW'ƒÑoÊøXøÕYW?=3¿¢¼x}¤É¤µ÷0æÍs±ŒI}XQYU˜}ÆÌȪ  cÌ;´qÅÛÒÎáN¾‹—pˆÖMìŠq¦6$Þt¾›­±ñ÷c¼e¶KòæÍ#œâ1Ƙh66v´u#3ùؘ¾«†ºê?ýÉŸ_?ÍÊÉñðWcüñÜT„;-^›¢<ý–§—WU•çܳÓÓTŠ1Æ7·ûX¸GäV×ו}762võ[T^ÛPŸ{Áp´k…cœç¥7zÏýoUUU÷-¶ŽÇ—݈6s¹öîgi5ž4nñì{yUyÎt?K=›ÉÆ·¹.}1®¹kjã|ïSaccãÅDÛù0ÆGVûÄ%WUWeß:héhé5ÿ¿¡ÜÓÄôfnEOˆ?­Ó7µ_sônEEåõm ÆÁK0ÆÏø[8E=þQR^ÇÃõÌõ ^|+ªª¬Üãœ| c|e{ŒcÄÒÊÊŠòü÷ŽºF+1AÕÙÛ Œ§–ÕÔÿ86×4&¹¬²²²²di˜Ñ¼cß$çëéL+ûkY¹7VEYÎ8‚1~‘¾ÊÒ'¶¤²ª¢øk„ÑèµL †uBŒO.ˆØxáÆøå©evþ³JËËfßÖ5´/a·톣>–W¿ó±å´ c¼wžÕƒ_»\]þ‘‚Qö£{jªÊCúâµK/ ÒÖÔÐÔÞp.éåÚUli9y)MZ^^Q>ÿÖùŸ:N =F¨««ë¹ÎêY™û (ˆ"`©y™×R—›šÒh7'Êb ºººÃ¤…RYOߊNQRò$ EÕÁÝ´e‹+>9´Š Ô©=sû…xnÕçGl©}±–Ý4Ô{éúY÷–¹ñ.€™°dt÷Ž=¤YäWße”ÛOªWùâ­ø¹eÝƺÈÖäDe S¶¯Õc`Ÿ‡_s óهɑ>Àw¿ðžnâ8ƕ׾í^¨©®®9È&Úkä•‹·Ñg¨{?5Ee­>Ã1X%-ÖTQTêçÖ]&¿ªÞÜ[c9u’µŽºººMäÙ™¯…€ÚΣúk©ÉÜJ9¯>a¹É@M5ÍAs£ý¹DÛqÂRFVÃzÉË+x†ê—¾z z|ãMpüluU5]‡¨`åF Ë«PUTäTàò{Mo«¡¡îìgS“[È@ˆ¢Òm¸ù€îšÊôós“ºÇŸ6Ôé©®¡1kߊÜ©·Þ<¼LCUYQkPäpεǕ!%ŒªªJ eU„€¯¡¡¡¡Ñ#éð“Õ!mâ^"uœƒ^?yy'ýòìO¾ûXĪÔêÝ´ï8wkå* †ÊT€ÇïÞۓ¡{·nýuí.ìO¦ ˆóÎôŸ»kh/M í‘óìG pg{k—†ñ_¤¿€WÖèK"ÂßRsV:X¬@ jjlj”@„UTã¼GäG&—yç;×€Ð%F„1y{-,ö‘«£^T÷$Æô@M:H"¿•4ôÔM~%¥Ðm¨Ôå¾¥X-Ì9M C~VO6íß¾‘¨|/…vá€6>väôß¼£‹9Ã#ƒ&ü}úûWV¶²ë())gÅk÷ev7qëËÚó”¹Bíˆptœ|ÃLö¿_ä"õ‚g°ÖQ7uÆ- áœi* ^öL¾#£ïïßaP“ctsŠ»¼(Hò—ŠÜ_-P’¡|ä É.áÕ6! ¥sË2€” ÇnF†7×ýyƒ2ùOO%<6þÚvKEI“WÄ’íá‡ÞEŽdÀ×gž·Í+’’E9Ù»×Ï›²^6u¾c§eÉ);âB–§Úo†j(H?> ÈM @VC–WÓ ¸9•² ÔpÈàŸÐTV×Ú­QvÒÂ…: 0,ÓµÞÿQ7S¤¸ ˜ oõzòCÍ«£‹RŸ´B„›ÔÇÒ.È2ÐíJÆH=¿÷'wýõÆ–Å̧Ò;}’3$4ÎìÅÚeäy—÷ãfº³¡"§ÀöÏ»'ª¤ylB|–°§6&žÉ,€^:£ÌG7Tà¼7Ï¿VðÚ-C ûAvŠq_¯oÝpú žœdxèî·S] kí0èÎÁ“B,ÏÑ#ÒK‘‡êó=gÈ>Yô…MrVK9ø{{{{ûxõdt­÷ˆ¸ð8$àc¬–b«þMßÌÖÛÍ>píC_ äq¹ä£âZfÇÖ{&ºyx{[»Êô3W@"‹# wKŠNðÖøq‘Ö&^ÞæNûêYÑ‹Ín1Dp8l!‘Nà–x½ps[+Ó%Wù{­ºê•ãsŽO±qñô±42Ê£ ØM€=ÃÝòò˜xÎmz»#lò´)“'{Î6`3Y€Ãa·¼KËç²øœ´óq @Téñ½¸O«èÚò °ì¥òüÐXW #Õ1¦oJ40”¼ QV ÔQ“¢b„0€Ï˜2¾êiÀHc»[GžG„ô ÒãÃ/”à“'V¿Øfïêigf|³¨›ÉH5ò9\žØXÅe±[ž©à°Y4Àwç\ã[/oOs»m]+rÅxzÀÚ¡[=»¿6¶tôóòVgÅáŠ@Ägsx" SršmŸÅæ‰fÌOz¶5ÂÉ' 0vçÜ™C(´ Sí)–fá©ïøÌå ™,. 8b†«Ù­6!LM­¼=§°u3›:?pk°aP€oìÞ/'×z|Üì³ý=‡ÒËIK:ÓÜÌz„•õ¥A6NîîNÖ«®5Í_2 @thjàÊ[µ"»å!BÀbs €ˆ¤šy'­Ü­NúÅH†V6§ŸÖŽÞ ‡,LÑ(<5ÖÄÚÔÀjhÈâ hXü‘±ø¢¹£‡¯§·]°)Ÿ/>—Ít=gþ÷¢?bh9­gšÖ‡ÀÍz-ùS۳˯ôâ3n“qfÑ/º¥¸VuÄü×%íž›$žÂ’à 5.¦°]–1$JùÕ2—DÕò[+Zå¿ÞK;§µ®* _•ßSbÀ­Ñž­8BXÀ©åH©)R@ðé´îœçŸoni·ŸÅõÃÀeÖÑTÈcóÝe6ûv¥ÏÜrâhN&™¥Íãa¿n‡Õž«Õµ_IÉþý5Ö­OÉÚ›@ðÙõYU9æýÕF©òÏÌì¼J]ô÷ÕnþO"Â3¾žcÄ€6A²[WU²&A­h•«ÕŸ¨ÃبM¦_€ñ1⤌C ÷ìõ®gåäç®ÞrÈÚѺ£~náx)e¦Kä’Üü‚o¯o,¾ ˜;D#ŽÚÉÒöÿŽ†»ƒž†ÎƨýJ¶oõ]Ç!äEŧ­ -Ÿü‘Ÿ÷}Ö–[ÁaX¥.úûj7]ô÷!Œõóñ’õËYØÈkòÌ“?ØÀ1„ŸHÞ5‹ª¨=qÁ*“>Rÿ§V!Æ¡š7—“¶Ÿ©ÐíÂçF;íRjºÄMuQu¦þÄþ¿ +-G~øíËrý‡výNkó§wJ 6-˜¡¶7ôÐþ÷ŠsÛŒ¿U¼}®âàظ£Áíeü߀&;à߫Ѧ¸6Lp;±wÚ‡¸Ãáb¸ñ·¨ý¢ºèoc»Ù1ÛjùqI|-Â"ž¹™IKØɉ=çLdÈžüÿˆV‹PñÕA&1ÄÿN‡FEû^~SCÚIPõó1Ž“·UqŸ&÷LýKØw„Юû¥ëRGÚN M¤â%€Pæ2w½Ð#±} ‡>.!T謫gÚLfæ¶ ·ž%šãÌös\÷«„ /·’t« ^ŸßáçdejjêìuýS"Cjc„*éy&Ü^ïlÚ–Œ·¾,Û:1иù³‰‰©ï„y_ê IG¦ò·Wb\LML¼Â/dæ#±¥B_o,015551Ýø™×líFœŒucGºú…ƒš“ýxšj`êð]„š×7ú´ÖßkïË^×C‚Ư&fælF­ô0‘¨^À¤E?5[Ñ !sײé–f¦Ææöó“ÓØ"Ô‘dAO·¶laä4)ãgé]Ù®p"‘(]2â_|òý3´cŽÕòãßÚ<ûÚÔÔ$ê,¾•Q&ÿ‡"€]Õ1ý¯Ù°˜|¡8¬Ù‡Ë[õ“HÀndòþ"ãz_=‡JÌŸ0n؆—¼_Ñ71áhczíg=ÆL_Ãa …ØÖ»]…ù|>ŸÏç±ëWY:/cLŠÉqXn?$éV=ÆÄ™XSóÀ5,Ïçs*²œ- ö?þAòöôú˜¥§±Ïãñøînýð´Çãñ„Þ<1`Ê¡XÈçóù|àÝÅMc ß ÉƒE›ƒ¬ <^äÖòùüÆ¢ì@gs»IZÞò%DŸ=Îpã'nKŒwL ÷÷[w¶å›OSLÍìÝZ^þ¸Öß{Ï˧NÃWS3s–À¯t?ûšˆ«÷òÄŠÑ._ Œ1f•=633µë‹Ëãó›ö%øê5ÿP‹Û_™ ¦[[.}\,àóù|AiæcÝQç>ópÏßœívú]YÐé¿€™•xédGg·Å©W~HpP)GqaŽÙÅUë¦ÛÙ»¬>þ˜Üˆ†¢»H]_ çûí ~¡W?ÕãÝŒ/å“~´¢ÚKçàF~ñ“ØOg'§+öò0\Y=cÁÉgdчg:įº€ˆcQÉï¹p1%ÉÍÅÉ/rÖzAóžI©¯xâéè8ùm]=À½#k<‚§,-m†J?Ø»ØÙÙyÚÚ“¢¯Ûì"c€EÓî®yÿ¬ž?œÝK§999{…NyV*^Ö&—©i$ÓªO·ƒ½œ½Cg7–;Ø7à´äù..Înþ‘7¾Ö“»ðã¥=;  GÇ»>Ù³šo·ˆ¢ã *}Úz×Sé@§ÓétCFiÞ¾ã¦Ç,Q§^$óX&±`÷YƒF§IwÓ;~ä”ÏØÞdC2]ëé TƒÁ ÓèT„•Æ`0 •¼m¤PJ§Óé4*u”ç¬0õâ=gÊBœÜ£ç ˆ›O.öS¡Ñh =uÓ¯ßðóèÆs9bÍ…B£Ñ騕Vð%ã-?!uqéá}…¿NM„–Ž·N̓u™œÿJ¡ÒM\=ƒÅ¾Êy‡/WfO÷š£{tóY)&³ñì´@‡ÚšêN ÅF§ÓiÔîúá¶Ã¥ ¿Â÷èh »£‹›OÊÅlø°&`mfýî„ð)'^Àû›ûü=œÝ¼7ŸzLv÷ɇ ‡r»ô•ýa €"umßšáצÛÍ¿°0bÇ'¨¯¯'#™°y‚™ ©Qkö_½r¤dì®gL@Pž›¡ÞÇ„eí‚“·8ypÝ™.çßÔÕrëÖMòâúÇ›³rŠ:Š¬"›ÀEs’÷§¥¥EôÎÖÚëì©sõâk(¾øNøýãæþ/üñ#¤—û9å›MKß“ä6ÙÎôUÞÇÄ”ï)‡Nn˜aëåÎkÖùÉ•}`þøý?{JK_æÛÃÁz< ¡/—ç-?[~ôDÚâ ~n —ë¹Txx—IDATÀl¬ç 1¨¼ðP)L_êèDëw}¢ÓN¦íY?c¶«q[ˆ¬º. ê{îËÂ7?”2÷à”ÀF—pw®ýyärìxÚ‘]+wD[=ÎmB®_{é`fÆŽAùÙ/JÄî+xלgmn/²£1¿FŒÎ—)E>Â’Ç>þ\IÞ¦«öé«"K#CW3ÔýÆ00üÉ…Î|SBé>H?Ù¼OÊt…2IøÅȹ¹9¬ ‘m:³íâ\_þÿÖžWÿ¡œ¢Õ__[’MUNíß|²ŒqøÜÅÕ;9ѤdÄçµü·ßÊØÙ@ﮬŽJ~˜r4ýÄáÅ©1{s†Ï>2H™µbç&?ý’Ëë'/Þ}ìdÚ±}2Ï–FmÉ@ƒ,]¬†(tI¿D3%ë¨ßS@uÖº¸ÐÅ[Q\ŠÄ,ÆÄGh*ÈȳèùíC˜ê½Kßk8ù>·pSß9'tzvÃûŸâÊÉjÙ®»+šéAâü¦S¦K3ù‚B>¢sd4TT`läά0‚F«ë—/š©ñ!ƒ®ï>*ûJ%€B]!Û£›¨ð^YýíÙNÒ lh5èÚÝ }KàñWŽWÁXÕħ3ådÕ§Ež²o>Κ}þ¨ª2¨ÚÅ\éiEâÒΛƋ35T¤AÕ(am^q«“>ûÍ݆qFjuÕM‚¦FUPQyòâAmqÅ}涬k”³Ž˜™´ä|ÌN¨­¨Jת©ª¨\ºŸIeÐàÙ‹çÖ;vÆH]oö˜ê¤Ôob¢úÓ¥¼“>ýÛ¬?*ŸÚ¸ú)CìºâW¯½×^ë!žŠ‘OÊÍK‡VEÛÌ)õîÝgŒmز).ûÕ –±¹z§–¥Ÿ÷ÓW<a ¬oÞ”ò:6– úX$ê>°MÁýµÔkš#øµe°ãiNâ.#ˆòpq;va¶Ï°Q$ÕÃ$ÉXà³ðö•5ɤöõê¡UT ¿éË»×õzãgŽDÌâZºM  Å5uì›ÓÂêòd›sLðx"çéÉ#ä@tnÇ Ûů4”e¡e{gÙ†,#&¥Ñ) #§ +E-ª­p %eY€)[ïN?®=ŸÃ.úWh7„H­»¹-I+õã‹*Z;š*22b”3• „pMê}©©FRDf1¤°«Ö³¯¶Š uX°-¾wþ&*²O1Í3’b(<¼"z‘ûHs;×ØéIÕB >f´àÕGþ‹Ìçà ,]UŽ¿‡ª÷Ç•M§an ª™˜ößÿ”]P DÈ÷è-ŽB¢$ü\.‰7*­aÊ«(!ŒµßÁ²ÀùRÁ:@†ôyÓwj„øþ“§&úN{äjï¯Û‡é™„O>ö¨@rzåW1{i‰£†+iv DÀoï KÞÅᣠ}B&ìºò‚³•Z÷»9OOüvm ¨º·œ§Ð]†ÚFï DhŒ¥ƒ­©î­Ç9 .=ŸcÓKü†f;vUñBÇÀ0õŠ½ñüã³;—Ö-™þãÜZßUׂ›2¬ í:Õ(°ÆÀÑövvöŽ.”Ê,©ÁaN¯Œ(}UpeNu›ûªz¶œªLû–À/; ë¤3oOII¹’Ë–ùtáj‰„(ä¼útÓý¥¯ëþÒk¥Xk˜¾½½“ »8KÕ0îÖ¡ù¡ ˆx@:¥KÜ>ufßÅî©w³²²²Þ¼}ÿ&£ÿ÷ƒ!kO4})e $GbSh*C(P$qrŃ#—/s³3ÒÑ3`ả4 KÜt ‘ƒ¸AHÈi$‡S(`R)òmfo›æä}®í9PõVÂ¥Õ<‰y€0P}íöéÅÅAc\èh˜MÈ•§®ŸÜí=šãì”Àp36ëÃë·÷_Ú9i6öyqâò½}ç™MDèáS1e¾É¾¸ D ØÜæ[Í¢h)JênJr 6‹KÞ8ˆÛ®$#ªãˆ«_—[Ù¦Åwž[yŽÃRÊý’RÏ}~uwÙŒ “I¡O+¹-sL^šÎäñÈ– Ø\ •iÍYŽ|Ê~¼aáäÇ©SO½)+½xVÛÓVªyIjŽ°Ö(ùv§’V¿˜¶e*å7!‚ Ð1Ð7116µõ<8}èªéË[~Rg0¾–1%nqë>”ÓzôS"¬w¯3Éïd•Ô‡Œ2>¾Íãë•«€ç_[:ÜÙÂPì=ÄÀØÄÈ`ÜÂå«?ß8ø¬^<êVSÜo®"Z.¤1FOžß7eQòöÞ³/,ÀRT Z±ä’aDìˆ}úõë׳¿¡»Ý‹GNµÒÁ¨*gÖºLIRÿ¼f ÊýG›é[½rñ«Ó©YLiÕ̺õ˜-òút.õôëÂδtX7E ùñ^æY·_ÈkÈñ«0 ,¨ÃX¾µ‘r›´ôåÛG¶¯P¯¹0çd—ùw‹Æ‹'É­ôeÚ>Ù~>m–ú·7—ú€(A±&o·®!eÖÒëy鯀‹—Ëëç÷n»á5{4þ¸0uþQPÐèåèïD¯ÉçûZeÞ?õ¨~´¹kØÖÄ=°JH?FÇ»1Ÿ¬U|gù­ „Æ0sŽË»-Kýl$õ…s›–hM§*&"nûõÍ@á®}/4ÍÌé¼çÙVðgì6MËpËÌÑK&%’Å©ÎÎø™¸«Z@òå¦m˜z¾tð¬hÃ÷OŽ¯\³‚úœ/4šk:@飒úøð@ggWWWgÇ9“ýŸ_¾ÌlÝ¢nÖKŒ©/÷|¨¥üÅE‹Ð{Ù¬Ž¸`Ú*„hÊû6\Mp;ýôÉéÓƒ“VPRè̤B—–mávôòÓ>ÃûÐ\½G<Ü{캛¶1ÆÅ2`Œø:º¼3iÏõ¯ Õgˆ“õXve®Îýü³ŠÛ%Aþ-¶N}åÈ¡#<<ÙÜžÚèÃi~˜à²XLcà°YÂæ–ø\–à\ÞuÕ#=™ô•ÓtNÿršž¾©,°š†íÐÇP/G'þ¬cBã÷}cPèçÜCkbqXM‘QÅ•up§ h»õþ2·É*Zÿ!¥ŸrúøÓÑÎZ=iºÿI¢°®j°ÝÄÈ!Êø'·^Q¯GÆBŸ%å¥.“×÷¢˦MŠºú꫶%ygrlÜ|£ÝB,Bã×¥Ò—xàlDŒ¥ëa Y…¤ã¢pØL¡}9{±—1¨jƒ‡N·ÖÇ Z|VÝ‹ Ÿ>r‚.‰¢V²ŽŸqk¼…¾Y¯žš6>AÎ1 Ô¸ÓI^iM‚]«=Úu¡y7ÿ©E6õ”„¡u_¿Þ{PÔqÊ/˜f³š„`VSˆ›uuªÜ¡ãs½\ÃÍ_ö“¥ÊèÅîIBëãœãJšÑÆYy;™„0¦)ö}xi]âòE#‹•¤šxK¯sKƒßÓßÑ´Í®Âg³8oÞñ8l‰æÀ›F-íµß$î@àÎè1{ïÞÛ²l™ñˆz!(²>×.ÍUÇØyòºgŸ¦4”×›±¶?gm˜TÛ#º·" ‹½„€>ØÃUnöÚó%Qj<6›'nÆ[Ò6[OQ5uìŸ!b±Xäß\6‹+µTÏqúŠC†æóӼׇ Ó¶I8´\ycrÜâ ¥„Ú®<}ÇæÿµwžaQ^Y?w¤ à v#¨Á` QÖXŠØ(ìш,Å‚ˆ€!–ìêbÔhD,K DˆÅ Q$ö‚"e†aÞ³†©X6yž}âý}aæ­ç¾åpÏû?gPÔà]EÁQ?§t- ›G:º&®BÄÉKw_]hÏ?aH†fN§¶¹€éc†Ìš˜ê½6Íßc¡Pòf–V“„;x}|<sÜßýìäÓAƒ¨y‡ï¤W»D^/.“\·XòÂb…}åÅÖÒ¤JT©«Rd+Jµ5Z bj…£Él“kˆa6À£ý³¦]Ÿ_°¯ÜLPÖù)ÈÄ[ÄUuL®l`^ Ÿ¶¾øbªŠRq¥| Û_%µ=¨ê°åvl½V ¬'ê„ÛJ¦ÊÝ/g«n£üAåÞ(í¨xTõφʩAY ®æ’AGVi¸;hÀÕú um¥äª™ ‘Ü^œÝ#~r7êDþäÞ !¤ƒ%Šzq¢ø3€ºÒÚª?"¨>!òKO§Æ"µ#vDI÷L”m{\°Ó;ò×ïömЕÔï._vØò WnoÓo6 |w~ïØýãÞotC¹j®ŒÊÕ“ÿ ü½ýZi²§#S‰²=n„šî¾z½¶†gCC‘HêUÔªÜNVŸ>Ƥc«4 ÓIý£ç5ªsÁûöÑt‰Ô$9ÐüH¿–¦&=#Fƒ£ü½›¿'ˆ@ȽœCÿ:x^ÜÉÐcI”ëðnïª$F„æªßc×oøZ<ÔÑ{…ϪE~7î›yZW[!ÚC-îw{·wzïc>95}åq¶ŽbÉÒ‰ÿ.Q^pên(ʇÀ{íEuúeµ…™•Ý™Zr«þZ¼Õl¨(1~ƒ:¹£mþÔž¨Dþ k¨[§PÞÓÝBž¦Íí“Šú¦Û)å²eÒÈâÕ­SÞ|[+K»q'ÅКvO"|1ÚÒÆ/*^Üš'äΞ8ÆÒjÌ·©WiÝÖóû£l-íÇLÞ—õ»t¢:‚M/ÜmÖ]| 7ÎJ~MãÛYÚ:¸ìȸAdªkDBHß3>ç/›”E˜zis¬=|Þ5Éeƒ äuîf‹™›¤¹0éGù yoq'Ó,j5+-T¨Q‰ˆˆueíìÔ‹dV{O˜{_ͱú,.û!"^Ù¿”â××ìlmÊkňêír¸“c}§¯ŒGDl© v˜úŸµµ¿ˆï{ñìD™qÁŽ3B„ˆ-‚§Þ£F¦WJ•¾ bùþEc¬m§%ä¼¹Qm»¼Ó•ÀæûSÌÿ›QŽÈ”Ýh;ÖYÒ®˜fñX„O`üOTL¡Šð· š*bƒæ:ç9/äf @Å™`×åÙ ˆöŸ>Öiâî µÛÆ÷^g:yû@ÕâÙkŽ|l  H¾‰á?>}NPqzïís‚Ç÷CëÙaLùòc—uŸšhÊÓF„owùçnÚ!¸S\dÏ÷D`ñæ5ôÁÙ3X]ùñùËÙý8Zò½žñÚèoØ€,}£˜UæwÓÒ¥9QsoÁ¶Š·miù[Â'Ú•W¯ØÀæ)ùO.¹;Û_*"…©[Ý&Œ›ä1'ëV5“8Ó:øD¥,Hšéî”ÿPpysÈ„U‡ˆèy½ƒÿêWSDèô#Ým Un|‡‡u-€8-6öÞ®Õ×´C¡ÁÔ[„N‘S]8®1'ÓÓwGxÎï"`š¥ÕHü½Üì‚33ŽOd2Žæ·Î ÕïÑßcÂ8è?aÁb¾"‚Šº9Õ¸öû3³!ý¡µØc7‡îu¥’“…b'ÓÖ…=ì;Ý(o€á#-ss2&åÀ­ás=È°¹st;)ÌjFDþüбƒô¥ïóå´â>“&I“W¸ù„Oê®Ý.s±q›ñ¹±RÍ!V£HäV°7唹‘Þᵋb.arÚÉ”½‘û|œn¤Ù%ûcBeÚ½Ç=‡öãrð°ýôú˜‡úO—NÇ ž¡ËTܼٓyº, ÀØÙù£Ì´Âö¼Z u7š%µ5 \.·× ‡ëù™ú²w^–?­p³æp8&㌥³?‘k4$Èofûp/!µy;–yu0| Ô5 õd¿N= ðÕˆ*1éÅ“ýúÉÑÓi À#,nØÓã#-­-GzæíÈE Ú¦c]I ø¾Æ!a†yt4àÁè(SžÜÐ6Ëuñ ]ÕL›ÿÜèß³‹¡fd] ár ºµvzöÎí}Ì=k«JªÈ‰5{/[Ã%ð‰£çb×rcÀ„H^Nó\8oKª ÎâÀ .z,i2 ëAæeÅtŽ…º›7Së’R„§V˜[ØO›³(½¨²ý¥iy&êëJ•Öй7¯Õ µy© ÈÙbv5írF? ô´u%²,-¯Á 3Û€uí…íDâfÂæÂf?ç‡È«…ù…¿¸k¥Ï\yœhŽøÁø`÷ð\£sgâ#º7w[õ©5|ÐÓ&,mݶÖÈ™(·_}-PQËpCÝ[“Lú­;ñüe)è÷Ps¶†³§´&r²iûqÚfô Ÿäºð¿˜ºéèâQÝä'ß‚Ð÷#êçµô£|ȼ­fŠÛ{è·Iç65Õ—þú³_À ó_r[ep,­N Í-­³+kzŠï0!äü¿F›äçÆñÚ„ûÃú÷Ü’[!Ý°þò Î*3½ê!˜v­Úo€ ‚èúóÆõ_¯)¨]±ÅŠ KÇÆmö–ÐCSÕ:Bp‹ï¸¢Oþ™³ÕKzÞ»–Ôˆêìmm¥ë,ñãÔ¢”ÍA£ôOg‰`ç…[Ã9 ×5*$1h3lä+bgÒEW~2)¼.ûÉc~ì†ä³6&\P;Y¾…a½‹šBùPÇnÄwýf.­ ºÜ!6ã{ ¤J–I† àðtrîÔPqáBië ±àUñ­2 ¤áîшlv~R%{ ÑÔk:'/9롹!ùUAvlpŽXqg÷² ä@äŸt`J.e•àÆ™#:0JTÙÕ¢5FòΟ7Ò¸gÏê`ûA³a?‹m‡ "ÛÄ+fv©óçÃ%Ðò™Ó¬=ÁΈ½5aåªåö»P—ièö™óþƒ!Àˆ=¬lž"i’Hˆÿ„TØmÛ:wtÒžÌr,´ø)Nú®³»ŒÌÍJh{,¡4vÛðåäÁ›o/ËSœjh`˜Ö ,zçΰàPÛäX6#ì5ÂcÇ"SD ÚÜ•#šÃrërþÓ]:Ï'Gä²·öù—:VR'bÁ´X©W|>®öó™uäçâO:k€‚’«VãçQ‰ åCæíD 4ÁŠŸÔ¬ÕZQ¡(8hPåªUŠË‹¼;4PÉ4…RÔ·Ø|ÙlÙB3U®5X"'t šKV˶Ižë26áœ1 ±ÈÖní‘k™} UTQh0õ§ÔQÙï·"+‘•íÕênU•ßä­ T:»B)ê›Ï´¿4ë¨ÊµKÔëË5ÍT& ¹c¾¤·>B¶G¹FoìÇBêk(´wCù ©/JZñ#7!܃ÆQên¨»¡P(ÿ?Á…B¡PwC¡P¨»¡P(ên( u7 …º …B¡î†B¡PwC¡P(ÔÝP(ên(Êß—ÿj'£•¡UIEND®B`‚suricata-3.2.1/doc/userguide/rules/intro/Direction.png0000644000000000000000000012005113051004444017665 00000000000000‰PNG  IHDRz›ã­ÇTsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ çvñ/ IDATxÚì}u@T]óðœmBRÄÆÂ$¤»¥CB@l °QlQ»°ÅB±TD;ÀV¥6ïùþØ–eãyž÷yßï·ó˽§&ÎÜ™91c 2 dðÏIFÈ@2u#È@¦nd È@¦nd ÈÔ d ™º‘ d ™º‘ d S72 d S72 dêF2LÝüšO9üÛÇZŸ·À¸é–6\‰µ¤aƒ±Ô¾šËüll¿qó ÿ2¦ÿµ¥Óºqÿ²¤àß}%p‹uØ‚ â%~cLbü#ÙÇÿÌø§$DlýAû¿RýJ¡Êëa¶{-^ E]„æpxTý=úþüòì…ò«8ˆª³Û.)‘2vHn¤›[dÚµ8…l:=nk1‡C4 žqÄç±û¼Ý©»§º €ü{ÛÎTôL;íAÅ.÷\ø€HŸ.m;ÿãÁ±µ,ˆDC@&“ '­Þ=ÆšÝØ D§"ÀˆàÐvÜz #ÇÌcnžäåèö"ýÆz: MáÖÁ˜Ì ©F4áÀ) j’Kη§9~}˜±êb,Ú éL"SÈ¿8õ…¦´f‘·_ʲ }D¶0‡²>ý¡©KD=Òh$£‡÷"=>3|CÊÝóy<€DGÿß>g¬ßõÍ9m³vŒûSWU”oO‡zMeÕŽÊ@¦-#wÄùèr^ùÒµ[c:ƒ3ÅÚTSæ= D¥ÿ…Im˜VWw.öó ˜wZ0›ÀÆyçæ,ï»äÔÐðéfÄØ ?¿Àñ)[—¨Îó šÀã|Šàë?êìó¢­r«‚Æsá}»×ËVÑúù“ý‡ÇìKX8Åïî‡ÂÍ‘¡>¾«¥‰Yh¯²sõLì5($]^óÄŽU¶ÝUÚæOÆ‘ØçÊÆé©h*Ðétum«Ëiç5ßìÙt1,7ulçù»³š\¾|ZßÛ/ÒNeˆÜy4[/íê%GK”Ò¢) BƒÁ`ÐiT Hd@4ƒA§SÅqçø†¿ÀàÐcßWÎvã]ù‘•á>Cl:å¡Ã¼>”ó`ÀÙþãË¥ ´0 :u…øRlÿœß:¸ö&“I@¢9ÏŒ_²renʆã‹Hؙ뽣®}ºs(Ð×'tÞ&6ÀÓã±¾~þ³bOð³†W¶mi„ŸŸÿè)QÏÊ….̼8.$`Ôä¥EõeÃüÆ ÄãÆÊ©#ãÒäé$hÀP"+ªÒ¿ˆ4Mœ×t:Á`  #2MðšNþ5ÝG’6Q¯îžº9ƒµië–‰ŽFlû(ƒšºÊ]±;Ü"7LÒ¡6÷ŒãðèÈÕÛ¶nhÿæ€Û¬} ?¾¼÷Ÿzeþ†=ñ[æžæqáuM“,#ŠÒæ(G6·×–ƒõ¿ÙùPì¦l\·Jóuœ×ŒÓ ¼²jñ¼uγÖŒßÐp~Þ¤ýDU¸±ñ€¬›'gd#2¢¨ ²ïßQQÀ¹v¢8) Æ\H6t™E‚fC ½§³Í­)¾VÀòÒ3Qu<Œ•™ø²ßkѶ"UŠ÷,ØuKlÿ¼súýï|qaÇHÖ:òó/ÚÙ ¡+S*VÇm^~jnЉ<&TÕT­Y²Jì²Ã¶ÐÓÖL=U ÞxG¼€à}Öu‚¢©.m¼=GÂãT0P†©®@S‡xþ£¥ÊéÛ»gÕÊ•‡+Ø@¡ÒUÑÉlÀ$ÓåZœLÑÚµ.lÃüé+çOÓg­N·-ƒIMIQöW‚éT2§Îqìâ^ïO­Ë¨i­N.îØm4~BŸ`27óSýÂa×΋iww×Þ§ bµ1€œâ¯Œ·•L]5rUZÔê ×G¿ŽŸ›òXœš«ûË;M=°·Î3Ã7? éëô¸x6QÀAvqÚ—/ä^jr‚.0B_žÜbk 2’À˜Ja?ˆ»Ãè°1ﺫwhþ öî`ßÞ³íÞ„Ðò`·’¾#¶lÙ¼`¼Ãx{³ï |TxÁÜ:ß¹ëVGn úQ^&°¢ÛkÔï¡@ÙóàVWÛ…©ÑúBûšÂû{cRÒœ)^ê©t·µ/{v£C÷nQƒÖÍÈZSž¶ƒúÀÑ™k»†%ZéöÁ‡o˜wT?êå†IúL‰Ü6«»Æ áfÖÿFÆ_]¯FÊ“:vP wîÔá㩘¯½O{`€‰q‰=ï~$øž¡ctºj`@S–L½$&Ä7j¬l4êìFú†-‘/˜œ qÓ¬]g„8]MÒȃ&›š¤$/À«îs!¿ÿàžbn_ÿN%*H˜Ö®ï zÕÝ‚Z÷îí>5ÐÏ[…ó¥™:Œ:ËÁƒ›Ì£tÈÈLUoK¶€Cíj¹të½CsDßPåìDšâ“Õnf¥wø¹OŽón§F>‡×yºŠOÿ>¢W?¾ó𑃵: á£„§>ÂÁþK£L"–xo`Ü<”`~0n´ZÚÞ$˜8AÊ[(Ë…Äc°a uÈͳhÏá£Û6oZ¸ñ‘œÆ£E/l¦ÍŸÝ•èÞêqƒ£›ì?¬ uïØ€w´‹Ÿäpøcϧûq³~—J¬GqÓ¯mò.1­ßœG§Æ’0iDò±£Ïh|h¨.¼vê¤Ñ¤äÂ@[±}¹ËŒ‰³oŸ¦‰ÌÞç«ÇŠÜwSE€Ë-8ðêR¤Éï{,À¥U±á~Kg„]Û'ú†®ˆC "oÿõ‡Æšò?m²§õô[7U”˜Ãá†Ûv™ý0g‘‡¬5Àɦ_W:Ñ0~Ýb®yÈïØa‰UËƨÜÙ×wÆyRÓ¸ ÷ÍÕŽZBˆÄâöîn `n?äbqÿàx´¾Âú·¥s¬»—Ö÷íÔMK«hi=x`Ã`oí8©¸Ð׸˜=?5l» ƒéc*&ð'û$ÝZ2|ð‚&^*†Koü+>œ4uS–W*gß› €ÖÝ!¼í» €†Ióº ­FŸîò%ŠA_€Lë//ð4¡»ªRJe¥ÄÞçWté¬-ŒæQ5†8jÚïÚ¾£ .]©_m!€ûÙî· \èdçb$n~håöCÓÔÙuxï»wfÍbgS•Ç5ÅLÀ´&…ƒ*ë8Œvò=I°zŽ¡ß†›îÛ}¯gølÜÀÉÙÖ¬tYŠ^<“g•*®`>u«A²é¦¿©}šŸsëå2^ÖÛÖè«YuÙ×Ú?ãþ9ØzñáM¾º­c˜£Êç'Žgwvëþ5bÏ£SÌšt´PžÙÜ]Û‡›J°b××ÕqøÀª8túÖâCiþƒ:`Œ›˜Ø^oØ\½øQ+ÓN/³n¢û¥óçºöé™–Ê%€lm[»¨dÆ´?™Ýí&O8>qËÃ}ÓúŠX®èPö }¿#õů"ÂÖ)÷ÑT–cý(&ë Ì‚¡ÖKÈA:  =†÷Z¶5¥tùÒºÄÑuÝEãù¥Ÿòå´ " @¨j1‰LaP…«4 "x|ò‚ «¯®­äæêæ0Òf Â«|N7 ˆªvìÎã ùÛ@8Ä$®sÓn½Üó·/„Sé^Gh:1Kk[ ‹¬Ê ª˜üÆ°¸TyºìÆ…æ:Ož&Y£µ£SëÙ,q{!.—-xÄç5P‹¸lQîû6°yˆbét(1êõ¡Ã„€U'J¥úFÁ$ëÛ È¾~Póú¸ÿ6Ó¨Ÿp‚ah﵂þt]Ñ·«÷ê]¼{‹[ÐuÜVñºŸ¯ W¯œs4vI™!ºÈäˆ7õ 1c"—yÆ^;ppÏž=£»mXµP°•Ñ™ÔÛÙ7SûØx‰Ç´M‡€Ÿø G} 8p/†ƒjO˜·z ÇŸÜÜ"§ª(§¨X,µž&3WlêJ^Tó€Ïnhí/`Œ”L›³iZìÖèu›^˜ÿ°üçØIl ølä65""<"rY¬»âÖgq+fxì’äeÏkˆÆ^JΞÊÒê¢|=-=====³AC©áú›‚?^š´fû»“‹²ÙdÑICÄñ¶ ÜM¡aíF¿pòHüž=³Ì;ñÄëEà†ŽûèÌ.æ÷‡Üö)‹ÌmL`DB¿¸îÞÃÌïxòý—טvb.çþ¶š'GC <¾;>—+½)‡Õ é{ »ºQÜšyí BÀ‹?ù­YiÃ|»=ŒOŒ öÉ¥¼vFvˆ_äa¹€™ù¹F=´ÅG‹yÀÜr@þƒçe€Pmî==ç: ÑÒ3Ÿ êæÝ?ÏPµEïäú°»Òú… Põwí'öYcÿ¨é_ï¿ÿ­Ñ"ä½9»,é}âdW‘rª.ÝÛmœ¿Å;Ì·5-)”ßv×%Ñó˜‘KÉÍ‚€LùƒÝµ•L¹ž}”€¨ù²ù=‰Ï%ÚØÔ0tÞ¨ìóWŽ]Lñ #Þö¼õp[Â!7l½àU l»¼j¸~Lzˆ’šýlïˆèJ dBd2®-®@ I'"‘$¡Œ6Oœ@ñ^1ʬ=¹ƒþ‘ûyþc¹?#"‘¶K\¢æMxS%ª½²b÷c MÂWq ¾žÛûº³Ûîµ1k×®]»víš5k¶„ôÞ´áRSO¿Ew„€ÖA_„öÄõD““@¢ÀïoØ…µŒ&Zsë“BÄo‹ƒºî^ìw™‰{·ºE/&¡“[½gdžïýBô„ÿ}ë–ãPì01ÊXŽö´„e?Xùåì^?H¡S…4á0kkê9RD‚?Àøw) 0fú¬Àù“îé“ _»5Àgx€1Ѹ{ ¦'töòsþÈ°÷áãìùN C¬4å„àIIFœœ9LísAÆ¢ûÁg‡Ñþì&/·q~®wov”Q wõÙЇÓ'A¢AüåTï5¢ú¢×äÕšûÜN€O/¸¸\Öãñ÷œ½Ö[•*™…"í ‰ëïZب¨òÄýuÊHè¶ù ÑÒ„Ä*?éLäe‹~ c¿ pé'ÍùC¶ûâìºyÊ~ŽG+”ÛF°-òŠÿ%ÄÇÔR%Õý¹¨m<”4H©¿ÇÁÖ“¦5Ÿžžë7=I|Œ™Ÿ, r ñúÍbFHÅ Dßc~Ùk} Ïé#ÿ©üD[””¤6ìIiÅ]s)^lËbè·ÂÚHre’™§;I¼jÕƒðGë.OH0ª1„Ú(–‚(B‹S ýBˆI¬ò‹±„š«–úY¯ŽìJ%Moø/ÖC×L‹þ‹¡&$$&mR¤CÅÇÔR¥ÅÐÏ"úb)ìÚú=¶ž4b„âGë^Ål&ÎA„@¾÷Þ%áã÷6[¥-%!©¸#„Ðc6Æ^¹l€ç×ÔÕ»2¤¼-µÀø÷b9ø{5µµìÜ1ëj8<âgæuØìHÀ?[÷øgqª¬¼Ä;Æ<­€#ÇçôƒB“½žÖ¨í9w¸ã_è5Óº›¡{·¿¸ñßøÕZ³I—ÅÒ¼—îôkOû9¸{AÐÞÛeKâO ¤HvDù­ö¼h=ÿ¼Ëz¿¿ÝA×Ñ;¢ë&;˜Öp¡«¡Ç‘“kÿ­É?Ãño=ëÕ8ü_[âmMM$¬ è¿TºÛÚ¿;'EÕïÿgÚáo'UäùI÷+lƒþÁ×VLxÿi†diíd üg@²3Å/Ë>—ñžJF¨ÆÀçR]‡yV¼{œõ±°Éw¤)¨ZÛu’G‚`9BˆSþåAÖÛªz.]QÝÀª£©YbâÆåËLçfЀ‚À(ja¼‘Ô[G0 ÏORù=Y*„oe춹2ø˜j³2¤<ãàtóöàF¦Óâù|Ö]u8t @Üì&ܽtä5 ŠïÊUùi>Mš1ÐÙqíÕ¤IvSóß&+wõP!!±P¯b‡1+r `׊‰5kçõøˆŸ>uÐê,'lYª©f|*oL¡ d ƒ?T7¸“iÀù-‘€+ŸÚyÍ×îÙ a ˆ¡3XåÁÍ»`ç*:Ç^~ûÔ«‹EcUÁ‚MóFà+;w×æqŒŒŒÿ“©ÄÇEAf›ú¢hØG˜2¦lHݯûÛ†˜\É¥'LçWO|^åÝ0—Ï£ZÙ;u ñC0­Åe%6“G/4ZøyíÔë[‚bC«e%…®¦¡‰¦æò#)¡Nú‰Çö'ø$áQC„hdÄâñÈ2Ù’ þgJp‚c¤j²ÐQ%4b! à41ëÖÎwìÆ~Pvÿè™ç^#Ç•9n^‚k&˳™„šªð¿ÞÜÿ±óÕ/³™çg¸ûôõ–ÎÞzœ¸±øFý¦_R×ÎåÀÖ[Æu Y€€ÖO^¾A½k_}===}ý}º÷êקE†ágî¡Ý”i…õ!I³KPã‘8>6[«K×â¢R¡.Ȭ¨±ÐêÙ¸ dð7¨›ÆÈ Æà¾ê˜fÁ‰7>!-Ûñ1C»šØ¬Ù¾ïô™¤ýÛV›;Í°ŽŠÑ‘#©öªY¶æNÎΦæΛ/¾ D&=:½ÊÍÙÁHÇ`öú³-Œ®ºoýtLŠyq¾,ïcã0ÄÁÆrØ”•|a™Êg‰A^.fú:¾a±• ºÜô‰¾öÎnnCâ’ž ¾q|æùc½Ì\}FÜÿ^'vóù½%>g+ˆØ±>sϽDÌÏ˦ZÙ9 ±·5wC%–æ›"ÄÊ[0ÎËÖaˆƒµEд˜" Î÷áCœ\Ý,Ícn#„Påë^úÏ2·0¿´ÌwàðÝ7ê£c¡ú«3¡«Ö8ÚÙ¹±w ˜üð 0`Nµ¾¾þ£K-MôÓÞ³²¯èé&[yh©È%Á} BãWæX™Z}`ãO»&»¬JŸ[å<66c\yo…™c8cŒñŽY“b.âڃ͜Ë1.}vÔÒÉÿ[]‹TßÏŽ1{ŽÀçî÷ÜF«Ðe‚Ö*în½$c¼1bèÚÄ,Œ1föy«Zðþ•ã@ƒÌjŒ oééMÜùcŒq•·½ÑåW¥ã½ gí|‰ë¾[8s‰³Ý|·?ÔÌ88oéÁW˜Skmeå1ç¸àáL7•gà†Nº¦‡_×cŒ1. ²xúy5ÆøêZoïñÛ%§û8êyoËLbg}³…1Žè6iÝEÁ«ãᎶá—)YK®…;ìy&òø¹«Ž¾Åœ*/ÓË1ÆWw´#£ ×~004Ÿ°#cŒqÎ=“—Õ×æ˜ v|Ïǵ™MmG ¨òùúV#‰cÌ­µ±²ò¾&hŸYüùþ³÷X?Mü"ÐE$íCáýFŽÚÈ“ð–<îºîìŒqøæ佋}€@P_˜é3#áø…ÓÝä¥Üž‰Qƒ¢ù0 EÌÃå<©ƒ 0ê‚Ý=<<<<<=¬-Œc/”lHÜ‹10¹\B^žÞæ©kUohjö?×¼r:·ÞqïZ½wËÚI£üôôÎgå ì‘©'ßôp é@–›Ôkõ’ ͦ3BåÒ}‡žÊç¯è3zKz® iºu­¹ôœ%–É„®ÒÑÒDO,À"¸lÀÍù3‹ß}(ô÷wŒÀgnëÙ>ŠÎõü“øv=½—u°=)ç-NÍ;.ôÓlGQí¥cÚ¿ |yö€×§·‹zEiiii©¼Yoí[Ï^jtÖdf?MyžWZY£b=+a•;ðÌçq0¦i&œÝß«4çáý{÷W«¨pJJ¸À%i.ŸfÊf¯fmj·¾Ý>Ÿ?ù1¿²¦Þ6týÊPArq´r‘¿€~½õ4™%E¥3:izv¬+----£Xé¾ÿè>+õR®ÙŒi€0,5€ËÇ-(Cp.›PþìÙŸ>B‚,˜Í¾¯/™öÝúwË=ÿüS~emý°KF ¬+y]ÙNnh~iiiißÞÞ6+ý €@òQÓŒ0€¶á`åÛwÞ‚ܬ …>ƒú‘ˆ„Ø‹½ÆÏæ••–––ª™ ÑÌ{}»^èˆÎf+ÀN¾CKƒ~2›¦y.ÿÔúѹ³û!çc/ÇÛ‰Oü¹uT¥èaD$^Ý°Ày$.PjKPå(‚ €Úr¥x,ÅÓ÷S” ü‰ãÒ¸Äc&r‚´ìªrò´â²*ÐÒ^ؼe¦ù*{n}™Fm×<@q_šO¢4fž"+‹Œ EŠîï÷íuá¾~GFâåK*µä‘#F`À,òçM_ªƒ{*“6Õû9^8ãûCìûm:nÓ‰!tæ¥jR—Ž´—_*°Uç?²³«êØòJ ›…¨ 5Wð¡}wM^Þnöãçz¾‘ƒ”.$¤ÕÍ`íUöœÅõrêk‰ŠïÁÃG H@"‘z2Ú™ºu¼Ç¼Ó6–0ëê•ö'ŸÕÓ`ˆx^fÞdË€ð k%z#Ó0MQ½‘ÖÚ‘_ÔJZõ›²7Q;aéœ ¥UuHÕèÔ¹í€Ajä;€ÅªÆõU#FŒ„ÆQuÑn`ÖЩ’ÌVêª*}5«ºŠ%¯ÚNH2]¡ >!áX>Æ00âÐ1íCËfM(«®¥h˜ŸJÚLáTÁ?fdcˆ¤a¦ aE¹Q6g¸ú_ɘá5ðîñ½zA—ð—*(HXr\ ¹:·ûVÐ@™B’]<ògê€Ì8u|¶OÈ€ñbzš¤×’?WƒUÀˆ ¸>f$ùéiŸWy¸óñÉéá1› @Å n¹e®ñâЈ´S;‚aܹ۶7üŒF ´ Bˆ_ólÈøSWN­Sh5…‚ù˜hTAZÊÊÇò~ˆ„÷xɹXwL'Þ­SGÚ;OÐUú˜­¦¶S:ž_Q£¯ðäô î¾×©:d}{¹Ä?Ê[ëª -t-ÁÇÀe³-ŸKV—ÑŽþ§ÑP‘g–WR@À®ýNFš`‚Aû´¼œÒÌŠˆµ ºWöžcçŠ_Gì(ZSU©=RÓº~!A,¢©ÒËzß©« ü~¬—ç´ô'›^}™^Û}@ÆîEPÊç6Zuœºr€®à[%·‡º¼Ä±öw“ä8ºº}ÂÔIÏî›Òš¿Š @^5õúE1"uQáä—ðP7 ¾þ²‚´×Pd—c¤„¯öM Iò2 r =ã2!t!n\Døö#+,0‰r!庼èຜæZw>S#6èC•ãîÌŽÉ{5ÝÎè»ÛŽ#û5}Ü0ÆÀ—©”? 7‘S:ûÑ¥—^QI-\.ž¿sz AÜt9qi‚¯ƒ œV]Ô«9»ô̳¿OÉ#ŒÁjÌÂÞßîL>˜+X<˜¿c»Ç›‚g®©ä||ÊÍ;ÂnÒ4‘ÏYYM¹¡6—/´ F- ã^Þ}ü‰@úWŒ{WO‰´è@ɺ}yú´Y…\¡\><2¿¬”¯§Õáò¶Sª>AzT ¼<Ú>uùæºVÑH«'ò®-x·cÿ Áïì”cÓÞ7¾aÞϣ詋§¡ôó…k¿@ 5#Ý>ÇŽŸ¼ vv XBF`9%àÎÑÝo4Üú‘@S{`ùǤ‹Õòví)PðònÊ£ÐÅȲÝÇwq÷+–_¨ŸýÅ—5—·Ì¿ô¸ #FáSI‘™60Êl¶ð\ûÖÉ3kè4. *.^²é¡À¹{RZä¥Ó«5Ë¢ü=7¤æ 4/‚€ª ñs¢Ú×P½°`ÕÍ"Á¿Óƒígü`¸ô²! ÎäRȪrŸî8r¡1ðŽªød% ݤCG6îö9[Ôý—Ê‘%G*çx»o¹/¼Ü–‚€*O×èß…Ù°29OPfé8Çõç>‰i)€ÎNŽª›ìljÛ€=ö˶ˆïl€Ú×gÍÜÃ8­>05_ß\¸ùD¦e~*¾ºcfÐŒ"©ˆ ]Ìtì—žÀ'.6XöHøù•]öfƃ L"7Ÿi 0®þÐk€y© D[óÒnP¿ÄÌÒ¦6¿%ôH$0Æ9[5õÂ8‚§ …ýäÔ·¿|€­Ƙ¨HÑécZÄn~UööB]³7LBÐ «ªààšÙæ:::z#¦ßÏþÞ:1ù¾ Áá—*šþ¯)x³bZ¾Î =}Óé«öý¨æ «ð˜7Žor·5l`8ØÀlÒ‚M¹¥ ³†™tß“^ÔœBcŒ9.&Ú矕HLÿÜôãû£“ýÌ]¿OŽµ7œ}V).ÊláUÝ*Ãr~Æç­XQ¬­uä;&Jê έãb‚ÀœÊ}ËÃ,ÍÍ,¬bŽ¤ó„½r‡šõºóª î<Ï´—©óRAô+st&ìÆ/ ßÌáffnafãz0õcÌ©:3ÍÒÔØÜÜÌ'tÁÇ 6ƸøÁaÝŽãVbÌ=½z’¾‰ÅŸÑ¾Ô_3~Àó´Ì´®†yO{Ø[˜o»òB€Éö&aqÏpíWíAÆE\‚_ý5zÊ03SSSs‹ ‹w–³1æÔèéé½,g ³qºùŒ-1Ƭ²œc=ÍÌ-L­†ì¾”Éǘ 0ŸU¾!<@ßÈÔ5hÚ×'±ÝÍñ0þti«®×d¥ßžX¨§§ï›ŠqmBl„¥™™…¥Ý²}×8ÒCõ¼ªÏKÃüÍÌÌLÍ-&-‹¯à`Œ1·úkt˜Ÿ™¹¹©…}\â]Ƹæ]~…"+e76öèÙkýfSºô÷·<íÌÌÌL\ƒ#²¾Õ`L`N¾žÞ˲A­wÇVêúÍ‘Eˆ›~–[¾õ\"ZeCI{.òK¬.!± ‘ G´ú%žÙ^XzMÑdð‚÷Nõž~T¼:A`Ü0RZ3’óØK¢p‹ìó˜hIOÉÉê[„ø•ìôÒÚ‘ÀÓV¼ÅB„̕HU欑SÄjµé£lÝ!µ”œ0!¹‹VÂL×LŸ8O¦ešàÿÀ™)ŒñwNr-ñ=¸ÂSëßN­ DÉg¿ ’»´ %sË>]| ÃœzËm»èÍõOŠ>ÖZmR 5_²Þ—µ*‚ô häÿyYùY· 5ÝL»ÈÚšù?à0B kW® ‹ŠV£“þÝÁ$\ ÆžºJ²ËEÿQà}J\™ðžDÏZ¸T…F’ÑG¦nd ü\™Â€¨,-.(,Æ@Šî°úu¨(-¬mßÀWR\ØÀ!$œŠ‘«âGIÍ_ ‡7£%j–×–W4üÓê¶Í3ôÒ}VÅ’Úiñà·‡Û\­e­ê’âÊz.ŸYUXV @”—Õ‰ª,þQÇ øœÂÂ"¢ñä-¼ªòÒ¢¢’&»©}fUyi¥€,0»ºàG—hî”Ça—a Š þLhÿˆ²‚&XEÅçæj*‹ª.«¶°°ˆÛ8fà××–UÁc5b1pêkKŠ‹ KË+yï«*/­j ëÿù•©‚ô}ú¦3–®gLk«ìÆ¥„ß‚™#-÷¥~{âc{3»cíïöýaÞY`0lÏ_ŒQ=Xèp¯‚+ö0ë@WämâGƒW1nWò*«½ºÛó ÷‰ƒÿù`1Æ|›‰u¿_w’‹YË'ÛGº­KÏ)¿k9%ãŠaúFÖŽ.u"hD¹ô;òcŒë‹Ÿ[ÚØVsøcÌù:ÚÍÜÆÖÎÅÃÇÙÞÞÚÒbáéw‚ò‰1Ó‚—Æ ‡Ê©fežðJ”2Åï.Ø»†¸ÁÅÊèSñwRå'!sæ4Sã”*œµÂuØlÁ£ù®†WËqîý=V–A;ß6µQ”²ÅjÒ Œq]A¦¥­CWÎtl±¡©¥½£óСžöv6¦f~L.ÆøXôäèƒX×ø[XFûŸ‘‡¿$nóè¼²¦“ýÖ•ó0·Nô¹X1hÖÙ¨ùãÖ"*!vöN\l-)y’Ó$4+<7ܸ=ËÛ¬yfchyÖMÐjqø Žöµzˆï°G-¦€ÈÎcŒ±áøS—AÂö_‰ádI·ü5 ! ¸|D B œÌ`:Œ£Á/_ˆ1R°[Ÿe×\^Ð>‰B™(¡ÄZ–ô/´¦sëÁ À¯kÈÔ–JâXSß>’¨-éסª•§ÉQåéŠL v£,H¾s®¦nvéáÓ©AÃå¢îÌ*Ø=Ç®ÊqöwNïŠ?‘¼¦sª³+}øæí£iÚ…Q© )"Ѩ͉ Ex*½MûôDPÅŸÀdjí4 ;U]‘¬¡í:(*i*Ôݹɶ]§y€4l¿˜úeìÍ dÉx#Tt):lÝã=é÷ÌÕB€ Þ•…^^®sïÜÝÚ\Œ_;yˆ«Â¨íÛF „ÿÁk'%:S¨òéå­gÕçg-_µ‘Û¼=mšbãä>gîô!fæc–]¢ÜÁÌ$Ÿ‰Ð›Sëtõ­nÔ"@ˆWšjn6¾€”{u›“KÀ¸á>Þ·ªBÈßÕ4ýS݉ÕKÊ ±K¢ÓJPíû£®¶fã¦Lëë`m7<‡ƒâ.·é3úhF¨þöœÞ;B©»£lìÂgÎ bæíÉÃUßjcæ7fÊ”Ñ~f6Þ7Êb¿Øçjm:vÚì@WG×qˡ̽‹žat`å’#/JEnºA™ñCg¤c„V…Y¹øÍœîlg1uÅQi÷Îdlñtž¸ÃuĬ­›bíìí·ÞÈAˆv1;ÞÌÚcúþ`Ö_[asgOq°°\°÷BèÝ‘åX81nž{yð9ÅÙÆbè؈©cüíÜÞ³@âÁe„p]ú¬C÷ „6Í´›:g£¹­Ç“ù€¸½lÜB¼í­í‡¿m@[\ûúïÊk©\jr}†Ø;øŽ bæì>¥ŠÐ±UcmífÏåjfî7ë(FÞ¬ä¿fá„à;vNf;ll `V̼u˜ôyÉ‚eŸêªÉñw´s ‹ïïàâù¡š‹Zn;}î:ß ‹·­_fbãrö!´{Yt=½bÅ¢åYu(ÚF{T `7eá¾:Þ+F»æñ,Ÿb=Zý¨Œ-åÎ ÄÍZ{?·óòù¾>ÐUú]¹|Í[[MtÍg¹¿k±Óò£¦b©N;^ºt,uÑŠuíé€w’I÷ué5¢¹]9¢u‡.‹¼aë–±^–!“7#Œ¡áÙ~'KÿQãœmÍ'-<€*¼j~ÚÍÁ%8ú ¸²9ÂÖÎaöÜ™öÆ–£×ÞUûëk{Á ŒZÛ—]=£f«@Ιäþ®æ‚.)T•#SûŽÇ$ÍI]s*Ã7r¹EûÆ£?$Š÷Ú‹·¯¯“oV‰ KýÝ*\V™f„Ú:"ó?æLãWg6ºM^!0YÎTuêŠAö3k%ªÞ›šÚ¼mÀãmoä”cŒwFzO‰^<íÐŒqÎ.ÏÍ/1Æ3Ç8úÎß-hôñÞ‘v>kù¸™Ýx[‰›ò,ÂcÞ_£¨õÂb©çžåUaLÔ–—T5𠌙·çòÙ‰1g‚Ù€‹Âu¼3Ç+ÙÄõ¨ á{2„Þß›´äGß ~ƒ‡µyò;ᦾ­áö3vdb¢ÎÇÌêQø>Ìx_—™é˜÷ÍÁļXpFšStìD WŠ)xo—¿ƒ«pçÕv]ñ•Ÿ^7Ô-D¸•ëû±‰ƒ½cÛ9y×t=¾cŒ1?ÄÎ:õ[-ÆxÑpóe ÂãÈY{GXùnâIs¦ÒgéøîÁo[àá3eµà駣,Ç÷^žX9nš$Œ1³¢´’)>äs ‡G§ Mz‡éÙOâZŽ:;œb;+‹ûÅõøýf½–*0Ƙ¨È6´t®ÄÿH02ž"pžÌ2&溠RΉ)&Á»Œ×Ïq š½MððÍ_‹°+Ƹúš¡NPÆBÞÕó,¶e¥ÌOÇê‹o¯2w g)âÉŠã ‡¥Yã‰1ÓF­Üµwª«ûˆIŽØþ,c¢ª¬¤ŽÝb)/+FÙC-˜Ÿ­Œl²ê1ÆxøÓÓ™%cÌýâidu«—Þ˜biæZÂÁcÖËËQÅ‚†Y…öVæ¯Ê0æW”–4p ÜÊ›Ž™ì²ïV1Æ8÷þn×€XŒ9í-öeKv¦0;ÄfÐÙç’¯78=yÌš½»'»xŽ^ƒñÿ¢ÕÖ‰p|‹Ýnt%åCÿ¡C0RÖ2%±Î¾oˆ°S?™™ÀyòÍ ¶Ë»}€»?©hz°6Áq´²|nµBø5w›Ï”ð Áò1.×çŒÝ~(óC¡©³ŸAOeŒ‘¢š†2CÔ|¥ZY÷Ý6iW¹OÅ쀑Á*4däúq_ô’õ;ogåtääaÖ…`¾­ããê’““““¯bµ__¦ð1Áçƒ$GÈúªðg„Ï?z>µŒ¯92Ä,íÒR zø 쪮W'î‹L‚ß¹Ï ˜H<“k4.@àPP{šéq¾'¥>ŸPôæ]­•« ùþÞã¡äZï§!Hnÿ‚ƼÄSŸLC}‰¥‡ö/†1–Wm¯"/æ×]K-°á$Øƹîlú\‡>é·³{Ø™ª ð ªY2ÈÞUŽº…*`D—Ã<~-OĄ̀¾™Q¨Þ‰ŸœœœœœüIA‡òþ\ܺÖ:höÓÄ•E¤¢HP )ªi(Ë‘E³3‹±ƒÝKú‹u)Ÿ$¢ÛÀáSåimØã9—ö>ëâÅ}wqß“Z@bg{Q“}Øø/RV×PhµòÍVµ6xfò¨Ì+8@äWð úk` ˜¬u%óž};@„†›àîÍWj½Õ^^KNNNNN{ÚDIÉ­ ©¶×`Pqm–®úY 6VDú¤&ž±wZXäû׸|>¦Ò(R\LÒû3»Þt÷f½>w ³®ÍÍÿ‹+S’tP ‹P`P¹HRfåu|ƒ°/ß„Ê´ÜÞ6Úýûq>?¢ö—jÕ^p*š 3$‘ØÍ«Þ~±WvÎRålná2êyW¢¥ºñÂ̯֞Og·:9ºž‡ ǧ_ØÖ§]Câ湺†.g_×a¢ýÇ×ÏyyyyyŸ(š:CÚ¾êyOêý07ݼǗ‡ZL^{RºKŒ‘‚j£@P)d.‡˜,×Nð°ŠJ M$¢(Òy•-’h²X<ª  Qäbþ|yc²†¸‚$øy>`n ‡¢À@Í%™lžÖ< PÁä©$‘‰Ú²a6“Gå”~ÉPó9ÁŽ0&‘'Æ ~ܱ˜›KÃr9^ 4êT•õ¸AôVã?p—!a»Gœ:2{w¸ç³ª?Ý?ÇPjÔÐHž†kÙõ|‚F†VD.TTPtÁäð¨Ü†Ü`@e¹¯nf¾mÒŒ-S5Ðâ¾Î*Ec@ynÝÿ\1¨»Ê·/ÅÂ’˜ÿ¼ Ì{(¶õyÐ؉¥iúP(ú½”vœlljÖAƒ·¬Ýª;eRã$"§?ò2¿¤¤(/nA|¯áQÍ“‹*OçU¾Ì-)«e.ôó^vöIAaQaáWŸhiõà_Ýs2«F$ç÷瑶Î'žä}ûøüªËîDAaQQQá£'¯T´M­“kOéký(.).È™åo±8!‰AðŸeùQÞ€7nnXÚÇæ+>qå]o{ïG¾å>zP¥ÔI[êͨ¶âÉÕ×_JKŠ÷ÎÝ@2¾OË«ÁÝW.à$͹ñú[iiéÙ-[HfŽŽí0¿zÿ¥ †uNزª ´´(ÿ}äÔƒæób¿±Áy®Œª:–ñ:¯ðGî’¹“ŸæòðøØCÊÅ,²¡3'=Þ6ñ÷ù¹/&F.fñ ÿ¨1ߜٚ–SZZú2m>C-H[E²Ä2”(œï¿þ¨å ¿)¡×7Lúø£¨¸ ÿÄ|oÇi'¤ŽŽ®Hç–¼ùR\Íæ^Ûs"«Fêø!À1{Uîl¸þÜÊ2è;;äø¿Èíç>åå}xýhš»i¶¢s¨QG1•¥?aǨµîc6°0’¦Úâ'Æ­¸õ‰%69ùâ]{¯—––e&/PëÐ… ì¢§½tÞïEE¯¯ï¿êXÇv-:Ô«•}~Õ¹çÅ%%Ÿ^Þ°svÍ©â ÄÚ¿nEVOl-6)û›ƒ¾Ž8yÂÐcu¸Û¦§å©âË\žK¶»0ž¹¸O{ú./ïÓÍãëœ&틌ߤBjµaØÎ}«ÜÆnbKÇú¿¤ÞwC¡Ë+·.ô©ªªITƒk·O-ž¿äø×ê¾V¾·//B ñný3öZêÉa€îúÜÃ;g»·¬-ÊÓhóc–Ýßuñu¹™ÿºCaý@YE•FA@Ó[:Ë<.|üЉ»ï>ؽb^ØÁ‚¦±;Ô©ïý´ü.“†)!š¢š²@Ÿë÷OD/]žW&§ÞkÙÉ›ÆjãW.ǯ ŸtŒ…6þSN/uÅK¾¿bÚ„±„œÆøåýL» [FOX=óSȺM#ûæ½|¬VMENYE‘Š42Î’¢VÍÊ+«Wïmr2õœ†´°?æ«ΦÜÛzù¹Æ@×äõ£€.¯ÜS… ìxëê®Ùógo,aºO?ä1FˆºmóÄÑK|öZ²kÎ6­+»fŽÍ¢iŒXw)Ī³´¥ñF¬ANQE‘AZã¼ÓNɇ/˜ýƒE‰Lk§ @|¼{522ÔR]t ý†ÌJRИVGë°(á†S/ŒÕ.ܽ¼*jј¸R-—´´‹r€,¯¦Òx)"«©ª@Ão˜ýéy“¦EèæyVÎZϬµfÖÌÑI¡ 0²ø¥÷ˆMk#gN?Ì”é漸!„=Ý´ÿÊ# ¹ïãæ­>âb²ò²Í5ÌDZN^Œܵƒý¿tyõúÕó/ß¿¾Zó|ßÂ]·Iƒ3rÑýÕRöKºdïþXF‘– àdáü• Ÿ*T¸qg£öÜ*`0%Ô–ß¼yCQ‚¶sÒ¸×ò¾‰ï_ßú~lÙš§5M×7BÈÅ-áw º¼MzûîýÛºø?VÞþ ½ójÌš‰žRbÀ)|ð*O3>.Ö¼«ÄÒi£ 4‡¿Ozÿ.ùFÊÅAk^C“Ër#wÞ¿¶pôš- ¥Ã•ï†x{€¢Syæ ôè"§Õ‰!×U­s—Níl¯Z,Ó„!%/#ÑÊjÜ*FuëPÖpzÕºl­ùí.Ø’uÓGU›WüTÎÏ@DTð;]Ñ öx[[žVêþùAkðäg=HÊT4)ÎLTh­¿DF3çÛ' 1ÄÙû$µ¸yKðç­wýv7jŽóÝ:W½çð&•¯^ œ¶|E¯ 册ójȪ°ëÜã?fø ð0C±­~5cq°gõÓ±IðS0‰ ëg¤FNú¸ªWðÔê\D`Ǧ~Ÿ1>Xˆ´`ÕàøM›[aêãn%÷Ÿ»T8§vo ¸½ñ¨pÅæòEÈ“Èg£l/áw¾â@ä¬Â{“Âtê>} šH.`ÈkSÈk,=þ]²µ›%>ífÔŸ t­îªªR  -59ÈŽ9ÐËuXËhÈ>¿u¦¥…ËÀˉyMKxU‡–O°µ²¶±v\¸ç6€Tf<Ø×ÚÆÆÉ+èò›<„Puû—O´·³µ±u˜½õŸ­Î–Ñçz;FÜMb­uþ}0؆ æ»¡©E‡êï`7)¸Ÿ½í¸•Gy„ à”mŸ;ÊÞÎÖÞÅ7:þ+!€„°ËMMLÊ)þwÏ*ñ\·>–WKIìÖ¾>ËŸG t´›KÉM¼>¤Ÿ“­÷°éI…õ„ª;ãzxïB€ì×ׂ=mllûNH.dBðý†nýק<<àëáloçzàQfKÜwBJ¿Äòuµ±µuê?üÉ—2á2T™•0>ÀÝÊÚzHÄÆR6¦EZpãÓ­ÓÎÞBjR´œË¹y–¦†™•…_þ0¶™RÓJ¸¢oçЄ‹ë'l¸Žˆ.Œëq‡¢ïŒÝ²°_JSïÙ{ù7ÏÈ™åÔ{ë;¾Ú!/ÚÆÔ+Ÿ‡ˆøðÈü‘sŽ#"++ڮߚ~Ó” žÅ*ýöÂÍÖõB§E; ?^q÷ž+úƒûÚÖ.¢‹žØªÿɹ6/õÜG-J8´0$dÑQDÄÚ,;;§·U|΋%>[ñÂÖ±#fí2v’‹ãªgˆ‚0g½Ë©ŸÁàQEÂ-ø÷3Ǻ õ–h‹5ˆÒ½‡øº5?MÔÆ=N œ0Aº[ü“G¦²?4ëЩmSê*Jòó è“Ä7…4¦¸xbÂ[i­ØG·” 2ÅéůU BV_ùc†9„žå|2wpÆéè<êê†ÓýÖ-¥ò#Âkq9¦ôݬûò…¢–€Æè1~//žº¸RPp ƒ4qþ‚ «æØ•p+ê‚BÈ| E@DS/­ŠÒ3YM*c÷4鑃$¯° ¿LÜ‚Á(¯åP„%f9ª¯:"ˆËuæsø%üæ£$Þãᛸ5ª¸° LTä*‹Jñãõ»ÄÑc@@ã‰Ç^ÞZÄ ‘j:~dÙR›+ÏñênE'xMÕÂ@Qù 3îDî䧖ñûiÒœ†wë8LýÄøÛ¢nl€êFú£?i×– i}/ˆÏe³XÕë&ñ™q" &cåc^/§ æŸB«¥7n¶ mž—©©ÈD„î:]š*¡À¤±8<1>¯žNgvÊèqëø@8tÝã'VöŸ¼‹Ë[han©ÔËúàñµ#úmjŒa@c0/öYŸ tùÚ²Fÿdê>üð)~òé©}ýÖ<¸±ŒÙD{ ÔÛsõ ˜þ>N^¾u(ækp„Y;Ê­¦§°*-ª‘RéÂëÉtF3&ÇYºôd‚ßàáZÊ2™å"£Ù® WÖÏa¾«TYIeÀÔ3ýzÛ¬¼yl£½%CºSw£þGvÎiVJ§þ~V«N\Ê\äÆ>^¡ñÜLÊ2¢;A’Ròl~9Å)ÍÛIä‰ðdûµ3zt¡–íkWS_¡¡_Ú üÔ‚§KঠóS£ã6ÌË”‰u?lxòB–ap¥{7œð;»+€ÆÐó £ö-ªç-c2LLNqÚê3ow=­"ÁMúVj¢þ5”$Y¥U@äE=jÌ_½÷Õ‰g?ŒîM€s·öQoÅä{¬zŽÊéÍAM•Ä¡¾þ\¡ ªÆ£Em'´Z6[x½˜]_#F—%Le àá‹—ÒÍã¶m]=ï*ÏxTÎj¨Š›_Mï£È€:Q¢Ç–›º¿{> 's߇Úb„ëèé&\Ê«jy|:C±÷“‹ÂP˜U'·D ŠŒtU]mƒ:½™ ãÜ]õNr¶ú“GýúoK\24lÂ;gGÆWWìü¸öŒeÇçýQWç¥Ý‰{ÓÚÕIãlÎ-˜’#t²¥Ê–]Èè;ÍQHMúÌI³·^Oj‚Ý{îw¶¶Tþ‰ gL§¬544266666Ö5öïgK]<õŠ*%öö«lV»Ÿ³x_Ãn»Ž\eW_ë»p>Ðd ŒŒŒŒLMz2îí ³èTNZ÷tÎòÀ¦š[¦‚zàÔÑYwoó”’âOFí{@Àm›X žRL<»w3«‚•%_@ªq.s&O}D/©öGNeáë¤Ô§BKk›'ÎBª}­ÌÏç4À#”€¢€ /îTÖW @ðnDðìr”ÒÔ·P&XÍÃõ“Æ\H® Jj&úZõÕÂO’Mnd°gPh§÷·×m¿¾r°èdA˜ûNÄÛ{þ”¢nM¦—"_p0.WX÷©È){ogB(^mâ›w< à±h?Æ&º?} —Âúö#W é&A ê«ë8RKÇcà¶ãÝù]ã+ÎNœOvôùÁŽ¶ý½½]¼õB¦{)ÒfÍzsI€«G?/w§aÕæ@“ óè>ÝÕvhÔsB@×1ƒµRz¾Ê ÛŠ; jhÀ@G›ë·]‘ý€.yéâ†Ï»F¹zz»ÚÛ=®2ᣅܪԑ£B*9Š®¶Ú…Î}쎾¸¬ºzž°ó ÃÉ[fZ‡¹;ûùö0ùȼ-'štÐqô8ƒ¢;vž‚†«O=iÙYÌ¿_pI¯º–ÝÈ‚ÚÚZªùÝJG?'¹Kw߀À ÖÀíþ–šƒú¿•v;±mø¦ KWW§ÁÛ3Ý9$ àçfwiÃ$ï‰ë‰8ÔÔÔ cÞ0-f«'ïxÓmˆ“¢0ÖUS[+_ƒÜ­O.í35Š¨úÊ”§êMÛ(!ô.Þú±gYŸúol™j¼¹DçÖá·[/ŠúeE?,S?½¥ÚFònQÚËTf´çj^Ûè,…϶N¿ˆX˜rÅÝ{N iªš+CG·Ï"ª]~¶·Ý’·ðwô2ÿ™û“ùäm{ÿSeËfÿÌ™ö µ±õ‘¤(D¬¾?Í8èpË\T+ù[Åo£ïí“7ƒœoé¼9[ë úÚ:ñ@»)üpzÝÞ‚«Ðol™j] m=$„´¥#­EþLEÈ©...¦~Ò56ÛÛ´Rª¼´¼ªVW‰!× ªâ¿dpù­G}"bË» Ô†ºÊ’·¯3”uÜ(#¤iC[d«Ïˆã9Ljq¬eƒÛíf«þ¹GMU–¾»¾5ò±âê‰ÆØŒTóJ[)§iZÊÖxL»,ïé“ï’êª-s‘Vò“ÖÆ¥¾ÿŒ/aÖ¸CCÆ_x]$šˆÜè­‹† :gí>4D®¨Ïß¼0<(xÈÌÕ°E!°2û {ZÛ¤Cµ_VÏ7xðð¥;ÎÿìÞ½eö„MÇ:DÆPÜ4¬?银]Kœ¿jCNb¿,á¿w`V/øž“ËoûÛ@viV^Åo£Mƒ¶¾d9£¡3†›¿ÐyBH¹ƒmx=!P]šWRÉþ[†‰²ÞÛ>ýï F@(^¡ýL®¨LÎõÝÜ«¾Ýtòp5kÅò99V‹¼B)ýÓ7xÞ€É —/œ=ÓÇ“o„!‚õƒ]¯Õ˜®\µÂKí“›wx ‚éÎÅ]'nݲ)ÈåÚwpÈ¥-s‚®ËûÎ4Nè·^nAÊ®cV­Z¢˜y±ß¸•M@u€õæàî³ñù¥"ãß!úÊ•+[}9êc½vʽ‹´¬tå'/úÈ‘÷â 92†Ú¹åß×oߟ•]|–¶‰m')FaÊ“#'Îd›X™Ö~z¼ëЙwÕ&f½èˆ„,O;zèèÝG/j$ºèvQ€w·wÆ—heÝ?p3[ÝV¿Så—gŽžy™Rhf¢¶eóq G+NFÌ•$i3uÈ[sú«ƒ®`÷νq/S:X©H"Tg¾>pääóä\c³îÛ70±5ܾneÚ·œÂÜtG猸“åòž=j㜻ý9—ea¤WŽm®“Õ‰=½ó×À¤»Tg;tôÎÃgtµÞšŠÂž$=8râ|lü«Z Ížrp÷E§_䕳´ìz‹ç:|ôÖýÇ©¹5zƺÌæ–Ä“û7Iiõywíàék ê%Œzjï~zóÄÙK/ß}Qíi¢(A(vYdäÚoY9…¹_{Û:Ëäß]ñD°"Ä+åâÞ*‹5¦**ê>欥럌›8ðÖÚÐZ—}3TT»±ª™4ûQØX/nÒÅW+]¢¬¬ÒÓ¢ÿƒ“ä,üÔ?Foø urùpyyùî½LÞo¢!Eâß—DmšsiçQ«qu$so~¯2qÍWee{«®·œ4)D ©<ÜpÏ—•’£ûÙà‹C›nUõ´ì!Ó!AþžÝÍ×÷1DnúDÓìÝE’ð2=ü¾¢†£é«Ã BVŸ“Utµ3 N®}•dÄ“/¬óŸ±[Mßƨ»øÒ ç+ßxð0æÖ’I+xª½4:‰U|¹g×o‚ ³‘µ™Öñ™¾ëo§À/ºxîÔôÉM=]ŒÅ#¼Ý3kÊp¯‡tcƒq»'OØóyyhÞð姺Ûêu¦f t‰)¨ÌÉÈ(ª¬L?{Ô²ë IDAT-®¡á‚×.WÔ H}Ú¥óÇ#w>0Òת•ÝÙ—ÛF,=¥knÓ™÷aÒ‘@êÝý&lTÖ·²4êr(ÂwíÝï„BÊÇ÷ïW,fb õpû„ðýo~ÄÇ’ÿ:Ú9h®Xw3KCõÝã=þxžO÷ûÅèC‹"¯{ ’ú|¶ÿ¨åkoåúúç>Ø>oW !¤6'ÞÖmKIßÖ¢ç…Eƒ—ž 9ŸÚ¾5‘«®ßUšTÄû™ ô”*#F»të!Ôg=¾ô0ûË¥³¬»èäl¢R6¦Ÿ[€¤6aà p¶’ž¡:{æ°ÐK7c!ål$ÃȹzõïÄ ŒÔ‡¿ã˜k??¸dòÙ¯ðúÙÈùkŠduz¨ŠsÊÞÚ; -—íig¥wkí虇žB²Ÿíó·UUϬQ×½3ü¿ø†Væ,ݪ¯§‘l­·c@MÃÖÆŠûéœ{ðòï'n/ ŸY¨däcs}õøõÏëÀýMã'ïº×«¶lÕè~/+aÊ:HS”‚«g?9¼¸ûÌÒÆ,&Dmž` úÅߊźu“„ú‡Oë#B€f2X½.ök|ø˜ÞMOpU“»•Z kb*™—”-LÊ)àñ]¥˜€ôISFp ꈤkಃ‹Ü…aIX¥å4yeáyŠsó‡v›¾Û¥›xã4*ÏJË,ewˆåÞ*]å2{·Ð„¿¨¯Ûò§ Á’-úg!Ö>spôañ‘ ëkx!™- ñl…ƒ÷:bH€Ëš[¢KhûF˜L<‘ßßá´‰ù¸*D,}b`ìö¶áÞY@?»ûŸ+r.­1¾FxI‹Wó)róA>r¹˜Äe󅹿ܜã9tGÓ›]¼Ïg{;Oj,Áöp±ýXÈÂo Ü? gZÛ¹ä²ùM;¸ÉOúùb¡%9nq‘ßvD\䣿îV±°A¼ÏÛ¬,Bk3£—ô¹IØ$NeräÖü&fÖu†K¯—‰þÈÜkf3…ˆy—õ }²)Äú¼«vnU\¤¿ž\á<}+"ž 3Ù—%ÊUvÅÄ$´ñFT`@ØZa¯Ïõv]þPXiÆÃf.ƒYˆWÇX¼@!â·Cú†²DÛŠ­íœ3YüçË‚ç_fÉ{máìW…ÈKßoe!4þZî3rÁAQ7Æ›:D!.žä1}÷Má0] ·ˆJµªú¾©Qp1bmIVzn"òù‚ÄÕCÜWß@D¬ÿìh䞎ȫIs°sͬ±¿´¤¢… züP— ×Þ ËOØà=í6%(ww°ÌeÁGÆ~YŸvÚ8͆ŠX7Îþàëz¤où!Uùu€³ÝÅ7ˆyÞz6kk¨´1xZ„w÷Í6kWãÓ{3 Üý ß^\gÑÇzÔè6FæQ±eMnXÞ«üé–"§dz€ÝªÓI„õé}沿Ÿ[ë6{[S#;Õanÿ‹Ô¶‹&ÅWêb@·_q‰âI#Ƨ•ÄåAð¬ß «$.DMa ð9•TUo ª @ªž}¦•‘ãh„-ÎMͬS”PìùÍð)x›VÒC×D Ûú çê¦T׋ï_5å€SWʮȘްMi³mÒ–·Såûl¦»  žÚT2”|ÌbŒ·Tú¼3º»KÒÎV³áõç2½ÞÂ&‰É/œmÜT{û>‹Á¹¸hâ áU{£>³˜ Ý(¹Î…pÜL)Du&€8“&à X?@wíÄD4G\ðùs d»Š€Êž§ó-&h+í¡¯ÇåÜù©w:"÷kBxIÈàšùwfQ×Òçþ¬§Ê]L…?Ť ¿€âuW× õ1o©ºÊÍ'Ò€FãJ`æ»rp¡ó÷ÌñU(cP\6͹Yh†tÏPKn&j¦žãÂF¹X‘Ζ¿«¢pSRl`} sõ¬‰b4€ºò‚r±D€¦árã•Y ƒ"!¤:÷µÏÐ9£7ž ²è PÄ ï‡”€B Ó€FcPMÂVpÈ`Ò•´pýå©;.†9j¥Äì›0üÙc5 z[z>^õ·ÑƒGè ‰\b‚À¯ Ý}(æ¡$FN"ŒÿxÕÿ9jÏ#œÐD£")¦S·lsQiú–UÔø“‰þ¼=û-%[nœhD8<41 |×ïÖ|p[‹‘+Æ ñøüFõ aR\µOF³MY+ƒÝÂOŠÐÚÖ„:A_oŽËºPÒ™tŠ+‚B@g" ˆ1hÜMúêD§ ÷ì¦ò³~ºYu-j§¡çʃsšC;Þš¨“tðØ`¤þ”Ž|ª! Eýéý-4 ‘` ÓâCËŒš‰¨>~¥^§ŸÎ4€äõÃf°ZÎ’É;OOÈz÷pã–¥+7é$\ßþ IñèÛPhcèêžž©uöQéMHuúuï±QÛ.ß·Q%:¨°Rò¡Ÿ à÷ –šš<È+«–Ô7Óû\¾±ŸÒƒÝ;¥N sÔ@C¯qý6Øöº|£“J+›|B òõ@Ÿðá[®Ž¶IíogÆ—Ëtݱ ê s8,ÚÔùœ=›æwŽÿœ!œ>¸ŸRü‘û Öšç/>5OЭgú›§¹Bû§*#½ŒÛ‹ÑõeI€í‹‡xÜÏO›uçIÊ ´äðâÔ€Ýf__àZ^}Å–„ÍŽᤴï} Ó¨6§AÍpW—°ƒ/¼tÅÍ]xdúØ)™bù/”Ì»ÂL[¶Â5dLMæîTö˜çÛ.ÆŠˆ{/~ÎÃÓ¸½açgñ ¾ë®IÐá΢Ðm´Àûë‚–mq8.$ÍÇBw/æ¡÷ªs†šò¿dißEGÖº ªðpÒ‘xt÷–þ¨¨>úM5Ùö«¶ˆ»Ž?'±'=#£®“€óK´\²AÞiè˜é)2ÉEÒ†š‘$_0sæ¸ÅÛÙ*Ûù'Á9 `üCW=¹¸»7»ø®²2í?bX “‚9¾Ž·.]\1ÅfÒÆ£‡úö瑱I/3vŽÃÀ‘W"Ç^»loÓKíÝ‹l{[ ¨Ê|2pÒ¦˜»7Äi­úÜI˜ã1t˜¯c?_©²”;/r6ß~ÐEÄÔŒ˜üó‹ÍKŒÿ¼bž ‚çffˆkoš!ÌËåJ.Þ»ÕmÌƽN¾hÉ–¿I.:z€²ãîˆkƒ\}¬Ìzf||¯:x{Ÿ.ⱸ—§—ß°n6ú)qwÓèzû êEļcÈä—Ê2Îz…Aü—ïÛ1¤ˆÒ¼¾{éuDc·ì´‘mêÀÕ¸ÆQ§FºÞ´?x6¼w‡ùKÔ¦CYA:‹®®©*-ÚhR¬ì¬Üz%!£Ø­«*A@~mzfaOÝž4‚¤¾ª8·°\4Eµ®ª R•‘¦ ®­ Å=(vUVNW2Š»ª* "Ô}J/î­§-\¸¿¥§)wÑ‘“ ðs³³k9µ®j ÂsS]Ea^q%ºRgMe9q@¨øžQ*¦¦«.‹‚úªÌïùÓÔÑ)ÊL묥+E•§d×ôÒ$@ñR¿fjëêŠÑðÚÜ!báÑÞÚ ¤ªè{a‹)£¨­B>çôzv&œšÒœüR>0”5º)ËŠ‰ áÈËÍþ^ËÈvR뢪€Õ¹™ED¡W—NÀgUdçñ("§¤®¡"‡ˆ„_•ò­J¿wwůþšQ®ÛK‹F€[QUK륩È­ÎÊ.àPZAM³s'¨*Ψ¨j o à×–~Ë-¡I(hKelK~~+³3*åzku"œÒ”¬zƒÞÂÞñÓ¾~ëÞSW‚N¬òŒïED\N[¡ÂÜgñ«×%ò³¾V³±[Ï^¬ât6C½«ª4js¿‰÷ÖQ)øþ…!×MUABtBäÕdfçsø(%¯¢©®ˆùÙ™™õt¸hþB¶ŠžþÞ6aoœ±ïòk) *Æk¢öØv¥ÿÒrvÛÜçžJJÒ)½•Q{µ˜Ö“ÿÔ,‚ßýsSô[ˆœ¶þü»²tPuˆ›ê úߣÃ#°¦¼8?/ç~÷^R‚¼üþÿ¤`psó ©¿6tMm¹U9å_Zâäþ-Ç–fÿójòŠ«þ|ö’¢ü:Ž ã#ÿLj›v<¹Ußúù Zµ%*¯’ûËþËáœÒAÁÃÛ @ñûŸ¬ÚüŽk2‚B&×ý¥ -!±ó\_×!!™G½†oüÕJ[OMÊ¾íþßx€#„ÜžîšÄ%B7¨¬3+枊ýóÙ—LþàC‡÷o/n@B€â ZF÷Ú†ùe4šüî¨-ÚÊ-NdB-ôøÒ :}+M?GaÁµ\«±5±FZvM²ü(±i‹°JcÛlú²q5þ¹[íZ[ïø,„·×~Ψ Ÿ{U¶iGZkdsâŸç1˜?…þ¹Rá][øõÐ!"xú>OZŠÙzÿ[elÛC ¢Æs.½à !ÀÀÉ'Ÿ½­lZ)¾Étà\œ¿¥r‡¶à÷!F[«ÊÁ…îÏ8©oîÚÞ5¾çœÐÀ—eL[]™W¯Ò‚WœžjC–D¨^¹tñøÙ+zÔ=ñ YÎÔ¶TaËä(\¾zZ`è[+]“ÛŸòÆ,;9Ê‚=Ôd¡¬–™rÍû¯åO\µí*MJbõƒÌéS[¨åÅJ¾þ<[ëêý ά Ûó­gwµOÙ5³Ž]¦ÍÄŒËÞc6ÉèÙJ•¥å1ºß¸°_ñÔ(×ý=–Ưöä>«?ññ×øý€§¯«óÎó±FG Š=þ¢ètþ™-ºWw$p߇ÑQÔ‰‘.;Rä©Ì€‡û켑YJ—|vý8 ^œâ³ö¹àÆ›M&$^Z¿î¾t(çä£á1»½ª‚]T†®ÙáP3ÚÜct\‚»œÈýëøÊqãrmú辉{Û{TÔþé6ÈÄÁvjê¶%òšŠ% ¯Êå–ÛÔ>@ûê祆ƞœFˆ;8kùÉDsk‹ä¸åËίô†/ æd•~š"gwþÀƇk†,»šÓÇÑ<%n¥ÿUÊÝÜÁ"-•ïl_­¹~(žL¦‘ƒ+—ۇ̆ŒÄê±Þ™Œ®ùïåõ.XÎ~:Çþ°AÁ®áÐó['¾;³pÖÞ'&Ö¶Ÿâdûξ@öL÷=ÿžglÒ#)áƒöˆ¨ã3­KãÎœx‘*:½™Y1Ê ?dÁ)mëúÌÄ–ö™˜ŒFØBRùp²g´ƒN]œ½“iÜÍóN» +,0ø+Q±î*x“œ;k×¥@så'»}¦ÓþX¶ÒqÔ¼a½˜I)5C¬;Àã½SVœz§£«ýù[Ñب³-”³cv…,?£ÕǪ.=mä$í-×û¾8<ÊßÚÉ­ k•Žïü·Ù¦·í>`ÌÑ}Žè ƒ6 ¯Ô¥\0v^‡È)yéàè#ôß7Ø~ýùÂÄqQAžS¯Pˆ!®a;îÞ^åã?ç’ðwîõf~ëùˆXúÄÈÈöØ‹__«'éÕì7‡]& ½…KÞtìÁAçc»ïÁ7aök«.ŒA¤ê«ÊÊk8ˆmz„ØÜþ.@DêgpÎgSßRDä³¼&zº¼Êa!âæÑ;~r3õÈG¤(*ÀÍiÒÀ~w>Õ â‘©6‹ïT¾Úìît¦Ð/ÙÇÂä]%rÓ®›Øç Û(¨èïbý,»³ŽØ\Ëâ#"¯:ÇÎÎéS•±ô‰‡™ñêSiX‘bbë]…ˆˆƒý\¦‰öïü|çõ‰v©³ƒ}b±ò•—©ñÜ}PPácé˜(tO25´¾ŸÃCD~IR{ÏrDþ›E–¦NŸªyÙqfÖ¾ßDÞþ¬ «[K±6=jËÁr᳚N6ö¥l ÷.¼xï#DA¤§qäLJïk¾Ö5Z5O¦Ûôñ*ä""r>D빌GÄ·»;=,òVßfä1‹‹ˆü"Os'jKö!‹! "÷ë]S»àbá0f^°s]…8ۿϦ«éˆˆ‚²a–Vc¯"âèÛK Å·]þ áÈ×êí€Ô©“Ÿ5íîߺI!0é<õÊŒGà.€@@Ïûü­Æ‰—sófa)˜³“£y¯Ÿ°®ßú®&vóæM`Ò´¥¾Îà,ê P÷×eï³2Ęu~|ìÇnf²ˆ¨l>>þ.dä³û”}¾y3€T*šV½8à)!§(Ñ®$åJ;kÒ U&1½a½óΦÁDïµ’®Ó¤ßþ’kÕUêñ;•ýÇô;™UOæ/4,*E›õ¬“>õ×ïqó©Ô†Ý²ŠUƒøáÁÄçÇyùnN{66ER鯕5Üh¢èypûÆU}W·or) Àï†ü™ìizR àZè Ф(†o?-P’°Ùø"I®›\ʽ›ï(À.L©˜/…ö½WJß½;ê+¿Ð™2ÚÒ4 JNŽF?õžâõ³è%d¦bwE~V1¿–CQ=Å€È[õ·”ÊJ€¢p»2.%|A-ä€p;¹êȤ&%Iu–þòðf DM¢Slj¦¡å˜€Â}+––ÔÔ <¤S\>‚8ip ¥y sž1”ìÛ¯¿·ÛÀà†¸1MŽs]|•™€b*òȪ«8{.½ë á £+*æ_x˦|1ˆùãŽ÷ˆåòþ£²ž¶ "2µ‚Ÿ? (øšÉ÷sÒABS\8\uêǦ'¨ŠC[ÖÒÅi~á=%:.üf‡)áyš.!#œ‘•¬-ÊÎá"„Qk–´žK‰WegWˆbèHo Š3˜€WÃeHUäd‹<›Ièä¡Ò"œY¡×9iÐxZ._‚Á„¦‘%°žâeÙÈ €®Ã‡µª£iÙqévšÚöÜræÉ»]‡M0øvêꤪe–n]ìFùO?r?bT¢Ò ‘úÁùOf¼«¼ï½­t@V]“båqàlRþ¤éZb–*^Ö÷zm4â4|Qµ\“S›™-4Ù¹…î!%Ò‘Ñi4Qì&­Yóëy<†€×˜Ë2xXgu9@1)1‘yDš48îHÈIü¬¢§ýÀ`"@ XÒ´†,’$[›BWÎføR()/ô,á𸠕™•-@cßA*Z*õι>4wãºa½5h‚Š‘¡[0ÞrìoÇ>ÛáŸÏ4:rôZ³1bˆ‘f• ª8tzU^v¶È7}Xx¨BsËɤ¼ðp]¨çq™ 1á A‘Ìd³ùâ’b¢âäº*ÀǦY+Oî9\%'‰]/lzO‰Ž¯þ77Mæ°³ýƒŠ[ø+¡ê°¦º^V®iŠnª2uÞc{3.Äš—«Ð§;/[ðT% „bqPJágƒ R†š²c ‘€ âÞýWý¼eÅëÜMpìJG @qø4ñÆÕh4RÂ` À¥¨–A¶›é$$›ž‰WÁ™³¾½Ÿ¸c5(ªË¿ ;uK­¯m0tÕ÷­ŠÜóGÎØå3@Ö°[zð…Ç},Í\h’Ó]Å.¤~û^ÑSW T,-"ãΦÝåÍYñÃ-³¶ìO½&…‡ ¯ŸV•×È+þjŽ#èh¨ÔÒk&…OEx©¨–í$Ù?’0%Ô(ª”BáNÊùZ©fÿ‹Béâ )ã iHf|,…žMÅ3þÒªÝEM½Ž&3yÊTa­µ•52 ²7·îÒö4ÂÓ¸ùÉ?ø-*˜*+)íaÑwªEß©s–GŽó?zçåÚ‡vJÝAïv÷›:F  Á:_Z '²6~Ï-ë¢×Mº©©¿Ñ^².æf¬›¯‹²Lua  4B^ÜþÖÜÒ#î[ZSUuÇMëßÔ.œ™ÞkWÔ™|çmzQQáó3k¬ý§óšŸL}Üv­[ž]XT˜Ÿ¹mœkЊÇ-&ràü鯣F~ÌÎ+,È»¼r˜ó¸ýmDi tCB»~º¸þjR~^öé%#v^/Cö·7_½~Ë÷¢ÂüŒÕ¡Žc6'‚‰gvîºó… u×ïR‘tíkEUUYì¾y\ªmë-©_=cRbÊô4ꔟ|ì»”ƒ@¢§fùá‰6}QB­‡FmæÏh¯*@70äï»üÈÆ¿¿ð{²œ4öþÆU”ÛHy€î.viO¤u1аsgϘYZO™„OSIØ¿ývrQQÑçç—½ü ~mƒÇn>Az¹q N'e¦<ñððx›ÏjúùK)õVÄú÷’Š‹‹®ošõ ¥~½˜È訊ãÎ %%Åww.zKÉÐ’ïMJfnÙ/Ã_bg/óÊGžå|yéãéúøk¡–jfò‡üÒÒœ¯‰ã'_@B¾çåóÄùùé¥_gùxo¼“œ—_—›õ©°\·«:ï༉'kÛ70pÕ⬽¡¯Ò²Š îí˜b;l-S’â¼ùøýÓå­à1E‘ìâæ­_üfîÉ„¼Üï×׎^MK{Ýó{÷–””||r6ºN²]Ûz‡¬ùýĤ´‚¬S4Óå]cïˆÙ¹ ,lìé4ՄLJ„ÆTì$ „ƒî‰¦5oÒ˜ Sæ‰ûí¼±ÚÈ+(Š‹ ØÃ~âí½S·Î›4nü¤w*#N WK1%EùÆÁWè¤(Πѽw£þÞ¦ “#R5'ÞÞBÃ6Xé.>kbØ„i‹»9zz¾ ä¼yÿ¹PÜèô™¥Ñs†…†ÍÜ­£¦‚€.©¬(Û0ÇhŠŠh‚ô¤„’: €Mm’«¬tg[qB ÈB™ÖîÚšüt/%¦’•œ8¼-ú4 Ì®Êܲ‘Á†ò6Îrhl6€bgf¤q¤×µø5w·„…]r÷å#u1ÈÊw’Å !òJJâ ¼—WTbÒ`ç“Oi|<2nìØQ7NÄ&XhH]BYQŽAdÊÝx}rŨñ3%‚7Ð CIQAÈCyEñ†Øïb’ ò2b@—¸s¾ìʆ‘c#¸KCúH¡M~÷¶[k¦ï|”Li¥N ñ½ ]IÈ%†Œ’‚´ð°ƒ¨t06Î +zÂøq³×ŸÝs÷¥»®ŒvÐü ÞrcCG®=þêÄõ£‹-Ÿ:§˜ c#¦ò’/M]ýÄëxfü¾‰ÆOšµÒoå¹ÑÎÚ˜ÿõsn¥SVQ¡A"ÐÄ…s@^gУók¬œ>vìøûç7×W"Еwn|yù”Ç¿Mi"l%‚ú©¸ûÊïöMš<5–áÿøô‚8;ꬕàå¨1ãoçkï¡!ŒR&/ßIœÙ¤öO°Lý¯Ò–1CÞVã?1Æ,%à<½{¥œ#‚0žáe°ÿeí/²P¼ç1WŠë„¶?\ìc°%¶úrX¿¾¾÷ê³(bôõpÛ ?Ò:Ì@áÿ}õ¬‹yIDAT}ª­­—–‘üî§o-òÞðÝûº¤¾ŽË—wŽ?±Û ˆð`åÀëÝ<Ý3ßÅe3ÍŸžÝ€"Úà?Ž2®­ Zw×ѳ?³(1!µüfìcEFÇ¡é·£ÍÐ>’‚œ—.&¥®¡.Fû…Ï·0Kianu‡.&ÙYCCœö¿è&Ž„Ô”–TÖ:S©sW9 Z‡?|‡¸é ê UñO Æe£ý‡?­2Í“þçO¿jÒ¿PN[½øÉ5êÏ‚Z©¨yqÐn/°¹K¶ÂìVZ„ØZþ*CZwFjµoÐ Û°ÍÒ~1S~ÉëvZØÎð`»uuÐGÜBvÏ´žõ®év”2e ÎÚsßÚÜ£"Áòφ–}ÿWÆFBÈ” “7²þÍú!Î=ŽÅ€+Óú8óZö‚ÊÔÎ=ÌÊð¯t òk­MÍžl éá´GÃî"!ÔÑáÖvsn 0ÔˆþÄ#¤Ô»‡®‰y S=×c®&d ±¤ ^Fš[ ã!ilÎ÷˜ýz¡„ äÓƒS£ýÝ­lìl,Ìœ|†Ÿ¼ÿ¡ª‚Tܘê²æñÂaV&&&&&&Æ&¦ÆÆŸFkešbhf&¬±¹©±ûª=Wø@Džn9н—ž¡^/CÿQ3n¼Ê& Ÿ(áWºš˜èZæpH#3/DØšÙò‘ïnr#jFoc‡»»i’ºy˜ãÊKm±’^xõ±,B§àŠ™©IWú™™µ!‹ÕØBÎÕÃ8[öÖ×70±ž´pkjy›’… Nu´563u¶ã¼Í'¹¤ ‘Œ€÷òµT‡œø7­Ò…î3÷$77sPí€ e½8Øô¡¦HƒM^6椚@¶’Œ¢¨&UPØV½…ˆsFÚï½ó½i#©ÖÊlšççæ7é"bî›c!ûÚJ#üÙN!-ê®/¸cç‰Xáogp;µNø˜B°Kìíß–Ô#Ö†Øê]üÌE,dhq²äG Ÿ¯o47py]‡ˆXðj›“ËXn“JrµòŸ€ˆÜ궶N2…~PXòö¬¥uL¹¨ ‘ƒ=.¾ËkÌåm8ã>§ñÏà ǎÚrñG¡UŸÜì#fÿz°kª•Kð÷"Ôw×w9[ޜ¹IŽf.¹ìV¤XÛ 8?Çeô™¬ÆRïü1¿¯§›_Dc®/;Çö¼Ö¶ƒ;Û¹÷úø:DdÞ°·ñiâðÆß9Ý×#p¾ð5C=E$ {Ä:¼|Œ¥µ{‡jËV7·ß%s\ç²BÍB÷g´:UYܵö¶ÙTëÓü“ÔÞ­ä”l˜dmmå;nyI½€2{¨É¦ËY„g;½¼–¾<´"ÜÍÕÙÉ{Tra½p‘zé¸Mx( »xÃôa6V®ǽú^Wõùžž¿!PpñÕ…ÝÜæ!ñg6¸9ØØÙÚ‡¯Ê¯ÃK³ƒC¶ß$„BN2²ï¿‘!×f†ì¹G?æð*{;[§%ûïñnëSµ™‹FúXXX›U‡¤ùZEjrß…{XY[NZ]P' XŸ·lŒ¹•]Øâ½Ù#L!Ãû~Z$\k“.±™: ¹QsGÚÙÙÚØ:-Þ{ƒOT}éid_Ž„ð+Ó¦ºô±r˜½ýÚ“£Ã¼¦Þ"²_œ ôt´±±ö4áeV•°}©§v™M Pð07Œ¾ý°Ñ‰¡4a'¡*µ¸pŒÜ&—ûôü滨Æ¿¬lÍསa-줲ùЄ¤žðâ «Íu4¸"à!á³k›Æ¶ xMåzÏ4“½u7  êùâ=¯ž¾0À¤³ð¥©ï´sýw/ßXÓÙ8¬¥xû肪®³ÿœùé;æ²*¾ëGîóy×óÉ_?lÀZ~㞃:aZEuð³OÜI§ŽœÜi¬Ê@‰±«öG„Ž"í–Ïg³D‡(±îCäê²r…½Irz »½­Ø¢/e\nÙ·qÀ³µ°Ëª'U™Ï' ò°¶±qô8ÿò;!¤ÒÃPóîv‡Júß:LÐÄ_Þøcä¾K¯^½!þÌ{ò9’•`RT®ºlЪ½cŸìöbŽ]rŠ?”šb#Ž(ïÌöZ›ð:ñÖš¾aAcún¶‚ê£ßÂ+é{n|˜4ypiÜÑ9—r?Kxñ2a‡wí É§ƒ¦z%ÝOäŸËPVæ¼àÀÍïÅïlŠØùŠ÷<áÅËx¹ûëBö K;xfÁÉÛ‰‰o £ýgÇ 4Hc§ù{…»o~ðúÕ«yÞ¾+¸ç/ìöîõ‹sì‡,z#£ @¤¤eÅD¦Ó’ƒ÷˜Óì%cf|ª=÷Å‹— /ãÕÒö®9™ „&++#”ÆLR¾ýíëgËûR3w“‘—£¸…£æFýqãiB«Û¼§N\ÊdE]¬žá¦ Óæø¼?v¢P¤-`o\v×iõ±ö§jÝë¤B }…öGQ¢{ ¬t^@ØÒ9¥\.O@!AÆ ÁòåRƒºÉ¶kýnr¢AŠ9…k`­ YŸqz9êòãÖ?!Ð}ÈdÝÚø{Y­Ã°ÏDwŸ3GLÕM^¬ ¡ ¶Ñ/ŠÃf,>´;~ËèÊé°Ý˜…|û’ +'GÞí;Å6œ­)ÕÐBBÄFEŒVo¯ÃãÔ׳9¥i1‘Äç-q ‚ŒC¡³ŽîºõüeB–¡!#&0”z=>2œbº¼H|¡%‰óÃÆõ]{÷UBÂÓ›{ö/žXȧ¤f¯ÞjÒ™Ù!Gþ$µçnê0¬ \¼Û=²Bš¾–Ѧ€¦ýôë®fð8)oÊuzªPœÌoìúuî=QÚtxòË¡4 /˜k8uUôøã¡Šßç¯Øb…)©œÒ‚ärÊD‘Öeà¦~¤Æ°¨2g‰vf ·›ó¼ŸÌ éâœ, S±%“Ÿ9¿ÌۿرdÝä3€¼€Qc„ŸcÈÊÙ&äQ^ ww!#.–kf9¸ @¯‘ûGPt¨J~•5ìÊ`@d*™®wd,kï­.-©¸{Ο%ùñwX“M¥h0=ê@MFCªÜ‚üŠ¹^怨`8ÝxÍu:F{’R4ÔBÙkЛ{À­Èû*)¯#NDÐÓOw×™Ù³ýº³ò?=…‡Ž-ðht¸°`L¼nMá÷‚ ³ÉªÿjÑ`ÊßyððÒîUÓ†ûñ 6xþ¶M yßž>SwµëG²b£Ç¦Æ 8™Ù¹õ ão%Õõ²*?»J¨¨ÊAeQhIÿt0'Õo¯ÆHÚ%›Ð$7ªŒ|ü|_ã{‰®¶Û|ÄNŠŽ=4ü¯­Šôê©ã°4?«¤š¹æJ fq•{iüUÁõ|Ãd—H¡Q{8™Hž]{Vcò¦î’€ˆºý«Ï>q©ú €â00%ÄÞ>Ofà]<¼ˆb>AC éF¯ƒþUq#Rë)b¥„º½‚Ík¶ŒÑdTDË @ÀÛ7÷uÌB9|J^Œ)ÄB:ŽÚóëÿˆ` F°®GšN·êàze“ô¬A–¥”|§NÚ{ÏÔüígXɺÇßš@NÃ#ÁfPP ˜ `B €]•ÅÕQ0/²*QL¨ ‚®èšu$ƒ0Lžéºf€<»gï9Ï}îÖïÛt×t…®úwU½Uoiê °Ó|ü„#ªÌèì¼d\×o›Ó+züR;`±)TW‰tãç=,ß]Hñù˜KPR–aY:Õ´Ì(\ƒqËÛ¯úV§«©M'ÈÓét€Ú®®©8ï¼¹ñðVg{M]K;÷#Q~-UJRͳt5åé:¨”aššqêÙýA+=v•c=“Õ1ñ.}*ß_Öè±”Þt˜¤×ÄñkÒRÖN[Ÿ{y»n¯eZµª©.vÍîH!:#p›kpBk¿¦“FÚú9T¼Ât_á¾*\Àç×}Ìšëµè‹0-f–Qìío?,5ûþô]'×½«¦ 1-ÿšà Ǭ›Qjc@¦Ú _Û„¯©lVm•˩ɦjüc…I PNÄdž©z-Yt\›Èåš^:Ãò¯TSJª£CÇøSÚßäs¿§Ù0ºwR¯zW à¨8ÙTVíZ4F†žÜ1Ñ0E奘ìºàAê©wå¸{g}ÙÄ6€n=~A…R·mwòÕ¨àÕã×Mð šaÓ<$$Zó·Sˆ&æT`Òz±TOñ/t+ûÂý)>Ã1ˆ#–jr¬‰«³-ì€{­L™”»jéY…°:óJæóô«)aÞìÖð&ôêÕÃÜ«™³<- í¾;þëµ#<ç Ð5 5®>ÿä7Or^½yjB@4¯A–N‰¸!}Åž:KG¯QÀQ¶Žji«ñš6'V½-k•‘ìsw¦.)NN[ñ$çÉ¥s‰ WVE¦¶T+º“Î6Í&ÔVÉŠL×|ðáK²ï¥Åov ™ïó ëHŠÛ—æóÌ-öÕxxñw^Ãö£_ƒ£Ü›½I(Ök-ÛØ؈ÍbŠ]šº6¯iW£†¡ÆŸ›­ÞàKù'}=]¨Èù°T掂¦¡¡ÕÁfâ&¿.Å÷Ò)QÕG‘®%KóûÖp†º–®¡ÛÐÐÁ7ŽUû`_N-BºŒ©ÿl±ÒBòÔ£ùzÎãMªOŸ¾Ð$¾"  @š—x¾ÌoÛÎ }|||.Y?ÐHçÌÓ%Cšá…ýaÞ~4æ_™À¡±Ù&v vgmZ+»:p™ÖûýÅœfŸØ!H\³ðn©øO™ù­G¿‘œšÊ:@ÝXðµŠß¤-¼òF5s–Ò¿˜z]~>téù£{'÷ÿ|}Dz¬: YFø¿(7Ì7ORdÂýÛX^wãï.’¼¾\Ýo–9¤iɦÓO=(¨:{PÏaÏEú¦ öñ‡®¿ú,3°+Ê>»ýÇ]i ¥odç87ÖIº9¿Íºpõ«ÅDP×ëÁ¨½vôEÍ„>]tFµ¹w\]a궥ÛïÐÔ®^K•¥óaš•“¥/Üyñz: ¾|‘V€PÃãݽmg7€©u/í¬ÏˆK‚¯*{öç½J)ïíÙ€mš7ïF±€Æ22ëݽ#¯‘£[+}6óQn9Àwg B‚ÏWæúFSS¯ûP;M!W ªÏ3\Ô›Ñ䛭Ǽ™¦{ØU×ÉfœÁw–| „€ÙcþâÑÁ¡GBƒ~gg^Ýš=©2=­~}mëދ毀ú§ñkø¼ªÈmÈÏÎ~êé6µáíidë¯ÃøSß_„1ô’Nú_ôúÊ¥0èØG:ÄúxÜÌ-—…É¿Ÿè½íüšˆ =\¿5"6³ nÅÆq»N3a“ã¿ò¦º÷·´±±±±±éÓÇfûZûäˆc%K4fÙ­gø1öAó/7W„1žNÝOÜu¿0¦wòšÒ“¹Ø×ÿé.Þæ¿çqC“ïͧ04´š³|;9A[]à8öÃá¨zTñ8í£±åls„@ÔÈ@‚sg®®@LMóƒŒh˜#Éëg9ßøÄPþ·Süº «AKÌp«ás8‰'—"¯Q(Á qyMJÈi½¹qË`@ÈŽngžýu{ÀjŸaX š+ö¤ÀdܦúcÔ'ÇvÖŒaØïkAAÃFÄèkÑèfa¿ÐÓ‰}J‹z-¤SË™Y{¶¦wwS5Œ±ïæýeÁ?žh¨I1Ìíc㜀[[>al/7׺Æ:©©}â/žàñÁˆ­ê>¯â¼mwîð’Õóì¢AKªÓýpÚq=€7n^²2ÀùŒ™™™õÎMýV\àñ8" *LO׶éËšZð†Yþc¢%:tI£¾Õ¨¨ÝsAúÑÛtvoX¶då”$³.­œ6øY+ÎS‡wKwr¡«£U/¤{EF¿¿ßhÐUšoÆ0cÖœpIaéŠÇÎñ8 " 0—ÓØì¬cì³ãêàI;RGýäj júîü²%d{›Ÿ¤Ŷ¼(ô”ÏøãÞ‡C£Bæ /á ™l«9+bWM2<6ëôŒðßZ5j—÷ȜˆÏãiˆ›cÔ±Y8Óú蜵GïÅ/£cÎçN-§MN™êwµy ƒè5ÿÉöFnSÄç D2Å[Oï9Ê—iû½>¿±©ÿˆ%ÍÅŽM‹Ø˜ùÓ×¹Ï{’nJÓһÅíñYT-`¨éŒ˜æu>3ÞˆÙîhŠßȽµÖí€qo‡É1‰{1ÆÚ7ÍÝ?EOëÏúË»‡1„Îì NÎ|«fØ=0,jx7 ²ùß¡ìö˜{u4éJ¥+áù„_˜e§ÿo?•ó0Ø+ú-­U¯‡¡|ñŒ&)s"7áÿ=ĵ"@ø¿'7Ò¼„ ‹´TžE¹øŸn5ð€´#Û¼g{øø½üÊ•y¢\—ì7ßÝsá‰{ùÍ!ù¥¿­ñõöôZœü´¼ùbу$ß93=f/:uWRvý|ô ¿ X¥¸„_¢ƒüÜÝg¯ßqTÜê _îËÙ“]Î}ùÌàË“”¥s=æx/nNjóí´ ÃÎé@ÍÍòÏúÊýVùäC«k¼‡ëm]ã”öÑR¢^Ç.ß÷òÍÛ§7 éëp½˜Âó*_Œ2øJÖ‹wo_.ž4âç³1ÆUoo::Ž¼ó,7/7gæ0‡Ý÷ 1ÆY§CFO÷_XTøÇëÎö+Î~ÀKÊŸ-7ÂÃw©Ëü-qIß» ± ?uçÝ»¼“[}GL÷kÚŸKaŒwù:h°|»ï¿ðéûoîëÍ:¹yÈxÏG¯ò^?ËpdœVªôLá×Yƒ†fsÈžaË3©j~Æü›gŽDlÛw¢°cŒ¥Ÿn†î¹& ðöÎÙíÛ¶%$g³ƒšäF”¼ssjO«ZP+‘7â]«ÇÇeaŒ3B]7gËÛáÇÓ¶v¾\Œ“V9,ÞŸ+‹Pú:¶ïðu"Œ£çÜt¦DöwîÃÕÇFˆ0.<ŸpåUõû›û&·È ®ºçš"OpcÑ û1b¹p¼?æ|bÇÔ^2¹‘ +c¢"kùR¥l j·Gïr?Äì/®aŒËóì‰Ú½ïIaÆÔ«¤Ý{®·(ì»´Ý{ÏäR¢Š]QÛ«¸RŒñ±ÐÅIYÕ25©J[f?)ZŒñÇÛI;3ä'?ŒurÛ¨Òa@P „ø»œzÉwptì¢Q5ÝnX)WŠ«_žK{y7¢lIîc?ÌLôÚïÔtù3piá•]Ó(îàA]¾n¾æk­a·n‚+wêG{;€ÌÂØ}’µøéóFÑÝlþˆ¶²U´¾¸™ ³µõ—÷92CONFÛÑ‘ `1k©k?¶@¢¸‚]qb‹»l…Ž˜û Ôè& Œ‘8?`ïÓÝ;|Ä"©<(%ÎÏ/PJÃD .]¼¸zA„¹umuFÞ¥(ו{ÌlXé†yŽLÉö¢q2tG½|wRÝöÐ_tl1|ÈS0öÝrÔ{8[6X*Î+Ó²ÀàW—”ÔÈ[{CEV‘BˆŒ¨d0¥áòa}âŸË ©)«K)ñï‘=LJcŒ·¹ôZ©Zö½¾÷£k_·Š®²(_SŽ"Âã:÷~C/¶/ôÖãÊǯ“{ ½ÛrxIÃŒ¡}²Ê0ÆÕ.ŽNSçÌ™>ÎiªŸPÁsÕËk{{7-ÃiCø|§•{³dñoõpŠÏþŒ1Ÿ`_¨äPK©“Á/³2ül™TvyÙø>§ŸË=TÕçlu˜°…ÂØslÿÛï8ão¯RNœßÖ{–,mµooô·ŸT,*: “uú6þ¬|Ù„ö61¨ùmô_·fÜ m+ŸEÓÆ 3¤!‰üóÌÉý¬6ÙŽ Àv,ð{ ÊîH!ijÄ‚¨Gì«iá ŒÑ‹%Í 7¥R 1˜L¢Ä’–Éh ] Ò÷…ä²F^:i„«ÃÎ^´'+iÓwfk)^éjowº..p8®¼·åËÿްβÄÐh²ý†ªW§bسd—‹Kj5.ï Ìd` ÄõÐÐÀ—‚›m¯”‡9ã{ÉÊ8ÛÏÎKqíiórÞ‚û§Ü‚SݸÑU½åvÓâ1æpK8öº ë’o᣽6ÜÏeUºË*AÅûø};=b:q3Û²©•Ñ–HAÖ‚E\aÛÿ",‰ž3:=ïÁuš|…¸ÖÀ¢W_„ž4c@_Kë »t4êcÌË+…‰z€ªå™v5ä®;þ`ÅÍ7l`dv2fäðÀ²€‡ÔU§qßyŒŸ34øl°[/À”ÐsËm‹eYˆŸY(tY•kÈOîUzsQˆ$k$8*9xÁÞA®‘î—©¥ç~yï}oªÒBwŒB9I¡+“>eþvÍH¶ë¢M LM†X &U@hgîF\séò=P7íµz[‚³žfzqCSPÁVø÷»aÀp!å#&ßkÓÔ~ñ½—›æënô§CóîÆô¥v&P0BeWÚ¸ÙÒ`¢×€ì¸D@#Txt×~a`êkKJ> ̧DM¾ë©ÑU«"ÉâYÞ.‘7‚Ýz7¹ÜVÏÈÌ:–pèàÁƒã9èÔ¹†%l˜ÕIÉv­šN½¬9ŸdY7|̯ 0÷vbÝ?w.ùÕØIú€@èëýË’ª^?eÜœÓÖç8P%"3k#RÕ„vSLvîÅ-ñ¿qfW[øä~--µ§!õN~Óý‡µnë|—ça”<6ÒÒ) €0x¼£npfÐàÒ žµÍ­·eí­³ýŒ¾“¬§Ev3yZŽ•1ïÙ‹Ï».>gŸ¨CN.S¦ßé¦[û{nåÉôxµÀ ‹½VMÌ?¹3£úö݇3wg3àâ°[o*¹µ%Üáò€`šïÝóó«Ø%¯;1ÏE<;#ÛÝIóغ¬1­íÌ·„Wä2Í÷øå;æºôöÊbsÈš±‹gçÞŸj©^}+ãé²c·¬ÔÀmĈð}ñÎ ÉžE §LY)£«>DÅž4×èûC@€\ZP‡=q¡oö­ *蓹)'õ³ÚƒôIU#ÚÛ‹¾–”rø"SìSW]5À¼Š÷e¸·¥ÔW|©¨ç«i³ºÁûÜÓÒUšÿÍ´‡©¦°°¸Tñ±ê:†];a„Ÿ‹JRÄîØ…­ÍIJ‰ ïÓ§RE7éÔÕ@“.› áÖU”U}£€¦Çî`Æրʒ¢o<14í7`ZYwo,+.犽Æu³6Tpÿ[^øŽÙ©7[0%<:”ø s1¢Ä >u³²T£É7 ªK+j¤˜n`ÜÑ„¥…1F€(^Õ‡/µ¦= ˜€`JXX𩳥µ:.Èb…fXö°rŠüÃӎǬÄÜÒì‰Þ‘™©L„ˆÓ7‘›„–7Œ’~¯ú¾Õs²c"Þ9D-qîñõÍïRØXcRÕ„†Ü´ñ(ó߈ àñÉu??³¼·ü;X"7„¿/;mVDnH)„ÿÄ@ rC ˆÜ‘@ä†@ ¹!E@ ˆÜ"7@ä†@ ¹!DnÈ @ rC Dn‘ðç²žÉ ·”ºÙIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords.rst0000644000000000000000000003324213051004444017467 00000000000000:tocdepth: 2 HTTP Keywords ============= There are additional content modifiers that can provide protocol-specific capabilities at the application layer. More information can be found at :doc:`payload-keywords` These keywords make sure the signature checks only specific parts of the network traffic. For instance, to check specifically on the request URI, cookies, or the HTTP request or response body, etc. Types of modifiers ------------------ There are 2 types of modifiers. The older style 'content modifiers' look back in the rule. Example:: alert http any any -> any any (content:"index.php"; http_uri; sid:1;) In the above example the pattern 'index.php' is modified to inspect the HTTP uri buffer. The more recent type is called the 'sticky buffer'. It places the buffer name first and all keywords following it apply to that buffer. Example:: alert http any any -> any any (http_response_line; content:"403 Forbidden"; sid:1;) In the above example the pattern '403 Forbidden' is inspected against the HTTP response line because it follows the ``http_response_line`` keyword. The following request keywords are available: ============================== ======================== ================== Keyword Sticky or Modifier Direction ============================== ======================== ================== http_uri Modifier Request http_raw_uri Modifier Request http_method Modifier Request http_request_line Sticky Buffer Request http_client_body Modifier Request http_header Modifier Both http_raw_header Modifier Both http_cookie Modifier Both http_user_agent Modifier Request http_host Modifier Request http_raw_host Modifier Request ============================== ======================== ================== The following response keywords are available: ============================== ======================== ================== Keyword Sticky or Modifier Direction ============================== ======================== ================== http_stat_msg Modifier Response http_stat_code Modifier Response http_response_line Sticky Buffer Response http_header Modifier Both http_raw_header Modifier Both http_cookie Modifier Both http_server_body Modifier Response file_data Sticky Buffer Response ============================== ======================== ================== It is important to understand the structure of HTTP requests and responses. A simple example of a HTTP request and response follows: HTTP request ------------ :: GET /index.html HTTP/1.0\r\n GET is a request **method**. Examples of methods are: GET, POST, PUT, HEAD, etc. The URI path is ``/index.html`` and the HTTP version is ``HTTP/1.0``. Several HTTP versions have been used over the years; of the versions 0.9, 1.0 and 1.1, 1.0 and 1.1 are the most commonly used today. HTTP response ------------- :: HTTP/1.0 200 OK\r\n some page In this example, HTTP/1.0 is the HTTP version, 200 the response status code and OK the response status message. Another more detailed example: Request: .. image:: http-keywords/request.png Response: .. image:: http-keywords/response1.png Request: .. image:: http-keywords/request2.png Although cookies are sent in an HTTP header, you can not match on them with the ``http_header`` keyword. Cookies are matched with their own keyword, namely ``http_cookie``. Each part of the table belongs to a so-called *buffer*. The HTTP method belongs to the method buffer, HTTP headers to the header buffer etc. A buffer is a specific portion of the request or response that Suricata extracts in memory for inspection. All previous described keywords can be used in combination with a buffer in a signature. The keywords ``distance`` and ``within`` are relative modifiers, so they may only be used within the same buffer. You can not relate content matches against different buffers with relative modifiers. http_method ----------- With the ``http_method`` content modifier, it is possible to match specifically and only on the HTTP method buffer. The keyword can be used in combination with all previously mentioned content modifiers such as: ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. Methods are: **GET**, **POST**, **PUT**, **HEAD**, **DELETE**, **TRACE**, **OPTIONS**, **CONNECT** and **PATCH**. Example of a method in a HTTP request: .. image:: http-keywords/method2.png Example of the purpose of method: .. image:: http-keywords/method.png .. image:: http-keywords/Legenda_rules.png .. image:: http-keywords/method1.png http_uri and http_raw_uri ------------------------- With the ``http_uri`` and the ``http_raw_uri`` content modifiers, it is possible to match specifically and only on the request URI buffer. The keyword can be used in combination with all previously mentioned content modifiers like ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. To learn more about the difference between ``http_uri`` and ``http_raw_uri``, please read the information about :doc:`http-uri-normalization`. Example of the URI in a HTTP request: .. image:: http-keywords/uri1.png Example of the purpose of ``http_uri``: .. image:: http-keywords/uri.png Example of the purpose of ``http_raw_uri``: #.. image:: http-keywords/raw_uri.png uricontent ---------- The ``uricontent`` keyword has the exact same effect as the ``http_uri`` content modifier. ``uricontent`` is a deprecated (although still supported) way to match specifically and only on the request URI buffer. Example of ``uricontent``: .. image:: http-keywords/uricontent.png The difference between ``http_uri`` and ``uricontent`` is the syntax: .. image:: http-keywords/uricontent1.png .. image:: http-keywords/http_uri.png When authoring new rules, it is recommended that the ``http_uri`` content modifier be used rather than the deprecated ``uricontent`` keyword. urilen ------ The ``urilen`` keyword is used to match on the length of the request URI. It is possible to use the ``<`` and ``>`` operators, which indicate respectively *smaller than* and *larger than*. The format of ``urilen`` is:: urilen:3; Other possibilities are:: urilen:1; urilen:>1; urilen:<10; urilen:10<>20; (bigger than 10, smaller than 20) Example: .. image:: http-keywords/urilen.png Example of ``urilen`` in a signature: .. image:: http-keywords/urilen1.png You can also append ``norm`` or ``raw`` to define what sort of buffer you want to use (normalized or raw buffer). http_request_line ----------------- The ``http_request_line`` forces the whole HTTP request line to be inspected. Example:: alert http any any -> any any (http_request_line; content:"GET / HTTP/1.0"; sid:1;) http_header and http_raw_header ------------------------------- With the ``http_header`` content modifier, it is possible to match specifically and only on the HTTP header buffer. This contains all of the extracted headers in a single buffer, except for those indicated in the documentation that are not able to match by this buffer and have their own content modifier (e.g. ``http_cookie``). The modifier can be used in combination with all previously mentioned content modifiers, like ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. **Note**: the header buffer is *normalized*. Any trailing whitespace and tab characters are removed. See: http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-October/000935.html. To avoid that, use the ``http_raw_header`` keyword. Example of a header in a HTTP request: .. image:: http-keywords/header.png Example of the purpose of ``http_header``: .. image:: http-keywords/header1.png http_cookie ----------- With the ``http_cookie`` content modifier, it is possible to match specifically and only on the cookie buffer. The keyword can be used in combination with all previously mentioned content modifiers like ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. Note that cookies are passed in HTTP headers, but are extracted to a dedicated buffer and matched using their own specific content modifier. Example of a cookie in a HTTP request: .. image:: http-keywords/cookie.png Example of the purpose of ``http_cookie``: .. image:: http-keywords/cookie1.png http_user_agent --------------- The ``http_user_agent`` content modifier is part of the HTTP request header. It makes it possible to match specifically on the value of the User-Agent header. It is normalized in the sense that it does not include the _"User-Agent: "_ header name and separator, nor does it contain the trailing carriage return and line feed (CRLF). The keyword can be used in combination with all previously mentioned content modifiers like ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. Note that the ``pcre`` keyword can also inspect this buffer when using the ``/V`` modifier. An analysis into the performance of ``http_user_agent`` vs. ``http_header`` is found at: http://blog.inliniac.net/2012/07/09/suricata-http_user_agent-vs-http_header/ Normalization: leading spaces **are not** part of this buffer. So "User-Agent: \r\n" will result in an empty ``http_user_agent`` buffer. Example of the User-Agent header in a HTTP request: .. image:: http-keywords/user_agent.png Example of the purpose of ``http_user_agent``: .. image:: http-keywords/user_agent_match.png http_client_body ---------------- With the ``http_client_body`` content modifier, it is possible to match specifically and only on the HTTP request body. The keyword can be used in combination with all previously mentioned content modifiers like ``distance``, ``offset``, ``nocase``, ``within``, etc. Example of ``http_client_body`` in a HTTP request: .. image:: http-keywords/client_body.png Example of the purpose of ``http_client_body``: .. image:: http-keywords/client_body1.png Note: how much of the request/client body is inspected is controlled in the :ref:`libhtp configuration section ` via the ``request-body-limit`` setting. http_stat_code -------------- With the ``http_stat_code`` content modifier, it is possible to match specifically and only on the HTTP status code buffer. The keyword can be used in combination with all previously mentioned content modifiers like ``distance``, ``offset``, ``nocase``, ``within``, etc. Example of ``http_stat_code`` in a HTTP response: .. image:: http-keywords/stat_code.png Example of the purpose of ``http_stat_code``: .. image:: http-keywords/stat-code1.png http_stat_msg ------------- With the ``http_stat_msg`` content modifier, it is possible to match specifically and only on the HTTP status message buffer. The keyword can be used in combination with all previously mentioned content modifiers like ``depth``, ``distance``, ``offset``, ``nocase`` and ``within``. Example of ``http_stat_msg`` in a HTTP response: .. image:: http-keywords/stat_msg.png Example of the purpose of ``http_stat_msg``: .. image:: http-keywords/stat_msg_1.png http_response_line ------------------ The ``http_response_line`` forces the whole HTTP response line to be inspected. Example:: alert http any any -> any any (http_response_line; content:"HTTP/1.0 200 OK"; sid:1;) http_server_body ---------------- With the ``http_server_body`` content modifier, it is possible to match specifically and only on the HTTP response body. The keyword can be used in combination with all previously mentioned content modifiers like ``distance``, ``offset``, ``nocase``, ``within``, etc. Note: how much of the response/server body is inspected is controlled in your :ref:`libhtp configuration section ` via the ``response-body-limit`` setting. http_host and http_raw_host --------------------------- With the ``http_host`` content modifier, it is possible to match specifically and only the normalized hostname. The ``http_raw_host`` inspects the raw hostname. The keyword can be used in combination with most of the content modifiers like ``distance``, ``offset``, ``within``, etc. The ``nocase`` keyword ist not allowed anymore. Keep in mind that you need to specify a lowercase pattern. file_data --------- With ``file_data``, the HTTP response body is inspected, just like with ``http_server_body``. The ``file_data`` keyword works a bit differently from the normal content modifiers; when used in a rule, all content matches following it in the rule are affected (modified) by it. Example:: alert http any any -> any any (file_data; content:"abc"; content:"xyz";) .. image:: http-keywords/file_data.png The ``file_data`` keyword affects all following content matches, until the ``pkt_data`` keyword is encountered or it reaches the end of the rule. This makes it a useful shortcut for applying many content matches to the HTTP response body, eliminating the need to modify each content match individually. Note: how much of the response/server body is inspected is controlled in your :ref:`libhtp configuration section ` via the ``response-body-limit`` setting. pcre ---- For information about the ``pcre`` keyword, check the :doc:`pcre` page. fast_pattern ------------ For information about the ``fast_pattern`` keyword, check the :doc:`fast-pattern` page. suricata-3.2.1/doc/userguide/rules/enip-keyword.rst0000644000000000000000000000254213051004444017257 00000000000000ENIP/CIP Keywords ================= The enip_command and cip_service keywords can be used for matching on various properties of ENIP requests. There are three ways of using this keyword: * matching on ENIP command with the setting "enip_command"; * matching on CIP Service with the setting "cip_service". * matching both the ENIP command and the CIP Service with "enip_command" and "cip_service" together For the ENIP command, we are matching against the command field found in the ENIP encapsulation. For the CIP Service, we use a maximum of 3 comma seperated values representing the Service, Class and Attribute. These values are described in the CIP specification. CIP Classes are associated with their Service, and CIP Attributes are associated with their Service. If you only need to match up until the Service, then only provide the Service value. If you want to match to the CIP Attribute, then you must provide all 3 values. Syntax:: enip_command: cip_service: enip_command:, cip_service: Examples:: enip_command:99 cip_service:75 cip_service:16,246,6 enip_command:111, cip_service:5 (cf. http://read.pudn.com/downloads166/ebook/763211/EIP-CIP-V1-1.0.pdf) Information on the protocol can be found here: ``_ suricata-3.2.1/doc/userguide/rules/meta.rst0000644000000000000000000001125713051004444015573 00000000000000Meta-settings ============= Meta-settings have no effect on Suricata's inspection; they do have an effect on the way Suricata reports events. msg (message) ------------- The keyword msg gives more information about the signature and the possible alert. The first part shows the class of the signature. It is a convention that part is written in uppercase characters. The format of msg is: :: msg: "some description"; Examples: :: msg:"ATTACK-RESPONSES 403 Forbidden"; msg:"ET EXPLOIT SMB-DS DCERPC PnP bind attempt"; It is a convention that msg is always the first keyword of a signature. Another example of msg in a signature: In this example the red, bold-faced part is the msg. .. note:: The following characters must be escaped inside the msg: ``;`` ``\`` ``"`` Sid (signature id) ------------------ The keyword sid gives every signature its own id. This id is stated with a number. The format of sid is: :: sid:123; Example of sid in a signature: .. image:: meta/sid.png In this example the red, bold-faced part is the sid. Rev (Revision) -------------- The sid keyword is almost every time accompanied by rev. Rev represents the version of the signature. If a signature is modified, the number of rev will be incremented by the signature writers. The format of rev is: :: rev:123; *It is a convention that sid comes before rev, and both are the last of all keywords.* Example of rev in a signature: .. image:: meta/rev.png In this example the red, bold-faced part is the rev. Gid (group id) -------------- The gid keyword can be used to give different groups of signatures another id value (like in sid). Suricata uses by default gid 1. It is possible to modify this. It is not usual that it will be changed, and changing it has no technical implications. You can only notice it in the alert. Example of gid in a signature: .. image:: meta/gid.png This is an example from the fast.log. In the part [1:2008124:2], 1 is the gid (2008124 is the the sid and 2 the rev). Classtype --------- The classtype keyword gives information about the classification of rules and alerts. It consists of a short name, a long name and a priority. It can tell for example whether a rule is just informational or is about a hack etcetera. For each classtype, the classification.config has a priority which will be used in the rule. *It is a convention that classtype comes before sid and rev and after the rest of the keywords.* Example classtype:: config classification: web-application-attack,Web Application Attack,1 config classification: not-suspicious,Not Suspicious Traffic,3 .. image:: meta/classification.png In this example you see how classtype appears in signatures, the classification.config and the alert. Another example of classtype in a signature: .. image:: meta/classtype.png In this example the red, bold-faced part is the classtype. Reference --------- The reference keywords direct to places where information about the signature and about the problem the signature tries to address, can be found. The reference keyword can appear multiple times in a signature. This keyword is meant for signature-writers and analysts who investigate why a signature has matched. It has the following format: :: reference: url, www.info.nl In this example url is the type of reference. After that comes the actual reference (notice here you can not use http before the url). There are different types of references: type: :: system URL Prefix bugtraq http://www.securityfocus.com/bid cve http://cve.mitre.org/cgi-bin/cvename.cgi?name= nessus http://cgi.nessus.org/plugins/dump.php3?id= arachnids (No longer available but you might still encounter this in signatures.) http://www.whitehats.com/info/IDS mcafee http://vil.nai.com/vil/dispVirus.asp?virus_k= url http:// For example bugtraq will be replaced by the full url: :: reference: bugtraq, 123; http://www.securityfocus.com/bid Example of reference in a signature: .. image:: meta/reference.png In this example the red, bold-faced part is the action. Priority -------- The priority keyword comes with a mandatory numeric value which can range from 1 till 255. The numbers 1 to 4 are most often used. Signatures with a higher priority will be examined first. The highest priority is 1. Normally signatures have already a priority through class type. This can be overruled with the keyword priority. The format of priority is: :: priority:1; Metadata -------- Suricata ignores the words behind meta data. Suricata supports this keyword because it is part of the signature language. The format is: :: metadata:......; suricata-3.2.1/doc/userguide/rules/index.rst0000644000000000000000000000055413051004444015752 00000000000000Suricata Rules ============== .. toctree:: intro meta header-keywords prefilter payload-keywords http-keywords flow-keywords flowint xbits file-keywords thresholding dns-keywords tls-keywords modbus-keyword dnp3-keywords enip-keyword app-layer rule-lua-scripting normalized-buffers snort-compatibility suricata-3.2.1/doc/userguide/rules/http-uri-normalization.rst0000644000000000000000000000077213051004444021305 00000000000000HTTP-uri normalization ====================== The uri has two appearances in Suricata: the raw_uri and the normalized uri. The space for example can be indicated with the heximal notation %20. To convert this notation in a space, means normalizing it. It is possible though to match specific on the characters %20 in a uri. This means matching on the raw_uri. The raw_uri and the normalized uri are separate buffers. So, the raw_uri inspects the raw_uri buffer and can not inspect the normalized buffer. suricata-3.2.1/doc/userguide/rules/http-keywords/0000755000000000000000000000000013051004444017011 500000000000000suricata-3.2.1/doc/userguide/rules/http-keywords/cookie.png0000644000000000000000000011675013051004444020722 00000000000000‰PNG  IHDRzåÒ…«åsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ƆF IDATxÚì]uXT[×_{f:»[‘œ&H%DPAAìÂîöz¯­ØÝÝ}mEJT1PlAr¨©³¾?†˜A½÷õëw~Ï£œÙgç:k¯½v¬½" 4hüûÁ I@ƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡Aƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡Aƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡Aƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡Aƒ ZÜРAƒ74hРA‹4hÐ↠´¸¡Aƒ ZÜРAƒ74hРA‹4hüºâk=T¾úI­]Ä¿¨î±ºQ?V‡ê:×J_gŠ:ß«„Õ¨€šø5‚j}ÅSÍ)½þâ¨i~£U*”ü.)þo¨¡Täªø3ùêÛ=¢vQ?— ¿¸¸!„Œï!\uç%!¤2„šÍkºkÇÝwºC·ôÖžx–B‹›¿-ç!õÖ^'@À2cm¾˜"€„*?8Å^È·ïî})1 „„®u¶!~œ¿ÏêÔZcÙuÉÕ¯·O¯‡!H)H¿××ÉF`çv*é³7&£ˆ’ÿ2zdž-ðŒ yR „Äïè阼ÑXG{÷3¿–SÏÖ X~÷Óþ¹ƒo&¤|„Eóí÷Jkäñ³ì–­¾SÅLgoFóøòŠfQwO®qØ ó¶^‘ !òÇN<ž@ ð<›Ý'„þM8eûµÃßýKÛÜ„<þ¨?öˆ*\xpù8ô Kó,mnVáÁãgúM[šk¶_ ¬;À¢¥»&­˜§ˆ¶Wz’»ãv>¼ô]wäê^$elçÈÛ§:ÖgWvÊ!`ýÑu³@&¯Ê¥ï­-ÍrÊä?ØùjoÑñe®Œ|oðÏ¿Ð¥ß d`ó;Éæ ë-àñ'¬:…„PYIm¬z!!åeÖ\Îç29ùpβc·OåÏ·ÌÛ;<)«RÈ“½'Þ&ÊSÖ5>ÀÜ7…m^>7³í¡ °ÏЮùñ1@Ig|½÷ðïÐøÔ­x»Öš$íÌ*“¾¿©vxB•ç­Ÿ1D(8{‰›G!iûZ÷X–yÐÓÅÁαçåG¹ABP¢ð Ý€Ùþ_–ÙòìõÈNmÑiê2¼º:*‡žLý]aSüî^À¦°Ðèøøø„µÝ²½§ü‰@ òm0 6.!6bß¹i^Ç•€nƒ·¶¯M¸¶ÀkŽ…Áa÷ûôvúôy~;8@Y¶§ßoƒ'Çß k{wîW)K›ÅQTŸþóg OLJøÃIæ=rh×7ÎX2tå»1±´L°2®ëüsÝÛêMÜtæô4/1Ë7¹wÔT£²9-ÒKYù© |¾Mú»·©à«¤³¿­¼ö5*>).>¦uÂÆÞKï!Ó":11>>>>!Þµ«ÑèÉþ ¡©«:ÄUâý‘™k£/ÆÄ%&'¸1¦B²FŒá°P.•0yÉ—¦M;gùö/Å¢2~æ$§ëqÌ´F§)_"}¬J®× ÷%Îí‚Hæ8ýìØì‰Ã†¹þ~ª-AÚºwWí$Œ.\“Z b¼hI ¾Æó‰þü¥kšè}?>aiëêh€^½ÆKvÞÝtâz|bBƒØ•A¡yÀ`êéêT]]-lÖbÒæ›@à¹Ë'í>a®]M&[GG‹€NGµ÷ë~xù;¾Í€ió$Ž}ï^Û+£¤’²ÜÛR=f¡d¢ÝWÁýÜìyN½®<ü¨È§¿OàZR’νDëãâ⣮.\:Ð9%[ººÆ_.G‘Þ7ÃcBöÍ\1oÆ_ésF3ûÕ_íãp.âIIi¹LŽ,mÅð `àÖÛ$ôb8-nþnL yIѽe…-ûÝ=ПÀ—äŒs‡8QEa“¡C=c®ý©ø¶Í:¸ÖÅ‚ g~8¿îU§ Žê &ÚfC ³Ÿ1l œ}ÄP·71¶cŒEYø2x÷€@4î8DýLE©O( ‘’˼êÜoP—†j„%ÓéÓÖøÂã@àôöËCF{X1òK/î qž³V!&lù£4lƒ„ªPóOý6ìY»ñ ü­¿E—V£¢ãÏkæfddtjÑèÍ»,¥&›™ÖKÅL”HÑÚ½×·}–Ÿ‹àE®T‰&e¥r¶¾V%…YÚˆrJEŸ¼–ÕÄ¥ »ŠŒWô¯ÿ¼¬ñ²¾àLJbÂÔíç×O‹õã)4½ýúhþ¾BÉôI> qÚΦenzz]‰Ý—žh¿bë‚É)-'LîÑFm;2¿J3¶qžµó^BòÈ&Ï\‡oÁÙîºÏ»uwsu÷.ë1{†›’?¢/…Å&ÞÞr`ª×ÍÔ`ÐÖ¢¿»­2-ÅEÏÓ55y4£(Šb™ºtíú )Õäsn €Í[ˆó‹ ÿÊ2²ËÒWö,¸¾iª§‡{wg‡‘ ‹+W½øº&½}ö«ŠÖÏ›3ªN`)`€N+Þ“K§Žw›WÄ`³›>ÝB3GÊÒ ð´¯$>Õо…â‰eÜ€"ß4Ü'"å¿í=ëÔÂ`㕤æÒF“'=C E?‡l‡á[$e¹ÌúŠˆ€‹ÍÂxûU’¶ÆîòjEæRmé³,0`è+¸“Á`P?ÎS× ²{tú­…7¢Ó,2Ë<¬hcYz.»w3 “0tš’-§YäÓå«Sš'ÞXc¤ŠÏWÜüVYûŒu2oYø¹fð )¤«Í(`ê·ŒR¨ôöÃVõº–²5úÕ®~]«ʘâÂ2}JZ *êGÞ»V£¶L¥©Ëç–Dëï×ù­ K¿]µ¿¼w÷/î?"¥­¡Yñu©øžu,áí^à'bG论È[O 4]Ö¶7`!b¯…+v˜{?’λ9Ò™p!fs ðôâŒ^C¾Ü8<¶Œ hvìÏ3¿øÈÓÔYÍSž ”¬»£Cee©ÎY…`ÈÖ׬`|¢Xô)ùã?z-ƒv¿zr©E$D!ˆØÀÜëØu/Š’Sòò>>=æGmô„Æ ³‹iqó´ÖÑŒ{™ Î*ø‚|¸ÿYk\G=0jmw"8V&)ÿµÖßmÚ½˜åÒâ}ÛëÕ©MÜ~bLÅz›ÝŽ@ŽÄîkB¤À&_Ú¾‘vl9UPÅr©j×€mì»èÚOåìý+ k5ª5eû$LûwjWȬÕj]Oœ™%'͘@€*û„hÌd)¸3pqÌ¥ØHøN‡š¹»ýì#ëûw€¤Ì»}önŸÛ‘"--ÖÐÑUèyÚLB©¬N6àw*{RÚÍA¿`kÛ*g®¡­!+—Voc•½2zóâ[±¦ JÛmvúãöô5îõþ¥­Ù´1;75ÌÛ)¦ ÎIb1ô5~+)Ä "A¤ª÷íðûÑES}§Í\wÿÌ|ub‰p¼LŠO@PŸÀÐ"¢Ä'’ ;Ú((Ø̲§hÿ~¢1 ”ȱCý÷bj6†ÆÝ»Lå÷™j¦Þ x§Nž @+íèW_Áµseø”ôI3 “¾´47$$ª¯¯bð#DwÇ'ËÉ‘bðÖ‰¥,6“žL}37Žÿ¸oÖñ{Hià„É”mŸþMáuä–ã6‹­Õ¤q=™œ!ƒ¦Í‰U$Ü0¹×æ«ok0®Q4˜ŒÓË7˜Õ¥^E˜Ža‡©cÛžSeuªcŒâŠPy­koòäu5mº]Û™+ÎNêªÆî7Î=zË¿ïµÞ ÷BMFiÿ~¿¯¾q«£ã»ó•¦ºøù}€8m÷µ™H z¹”ëe @ˆ$掠³Wpºœ`æí«oÞ´œ?¸çm¾zyqÛ š:ë²ß†Ê©¾©);ã~IE%;§h7teÏF ­W÷ßYÖ?‹ªÞÞÑ`2˜l-å^ÃÔ¬\9AyihH¨X^C}i8f¤óŽYã2%ÊÞÇúÝ%œ·‡ »y³XBÕ–!š:?¾þc¤Sôõ)(ˆßRYSrpÚ`ƒa»}Ç-÷7ŠZv"ž¨Sªê{­Öy·ãÎ{1 Y¿â‹é€Î,}[ë‡C ±+»qo`h.wÐ5}?!²—SúÚZ€èCÚ͘ÇÊÕfvl\Z¶:ì“"`Â@ðuL<Ù ­g¤K¦­÷ùÀÜ£1ïHÙªI“d\ÏÍ@ƒH6.^5qËÍJÕ3âòh³¡~šHàù‡ÜV-ý²kÅøóó&~æ0/s3S+~·Õ¯‹$HQÊÊ/nûÍo+ð{˜÷*O‚Haù×-ó†óù|žÀqͱ;2DDŒØîá=;¤V®%·_"RŠß¢èeX«¥ˆ÷N:ZšÛuëu8ê]Ÿ¤ňø>ùŠ¯›Ïç¹ûML~_ˆˆ÷öqpE‘¼4zbG· 9bæ­­Væf½þ8ƒX>ؤáæ˜b•b)Ùp ‹[ÙbD Ë,Úº~‘#…xmã´€e§åâ{;øB¡ÃüíW$ˆùWF™šZ*Á1wz*ǃsl'nyŒi­LœŠߟëo1è…ˆ%úØñö‹ö–—¦÷Z 6¾S·U6³ž†ñ´çr¹ö=‡†?ý„ˆˆ…ž_zVŽ…(»{f£Ç‚Ëë¶/ôq-¢‰Ú™Å~¤1êÀ\NïÉ"UñSŽâ8M Žrµ³´²2·°0·´´²²øc¶Cç®VV–æææ–V–œ}éHI2llm²Ke*´¡(DiÂõý½œlÍÌÌ»ùŒ¼žøZñ1ÛÞÚüU®Tµ>Ÿ»·é`fnnaaaaaannî¾úIÞµ¼"âÀžæç“>+âížg7ck<"¦ÞÜ&°¶uóè·'ø±ÀÂü]‰T»¾£õÈB9RbÉS§N]®½©.åñ>Oá¸PE ÞÅ õr¬,ü§­û\"E ¥Å_¶ÍÅ·å øÂékŽ‹™ øôº)®5Ç®çÙ˜W º§žXa>`Q jJ ÒŽöæ „|{·ƒ!(D|w¸±ù‰âuÁ£æºå«ë_ß&ÎÞËÜÌÔŠç¼jÿµ"E@ç¥ÍkciÁår.>û¯ÅIå¯V¶ ºú®ŠÛ1üLqSƒB ò)þ¯­F EQU!5¢Wý¤j—#—¼yþ¤*ÔÓ‰û⫤fzTɹº\¥hꊨ~¦¨ÊÕO*®£õ*5Û¦šZõ™RC•ÂÕ°VÁW– ½óvÍlUR?øI×ôr)’Ô®¥¶©âV¥ê?¢šÔ}ê› j²ÌCÕÿœIU¸pò”ßþ²5˜•ª»‘T]UGŠ¢ðË-KÞÐÜoRìîF”,í'LkÛwP7óÇwNÞ.tŒ8:ƒõW¶]~a•H¾7Ÿ'Ú±þ•eaDipÄk/“΂ºžÚÓÅüú$_Ò4°ílüç# ËÙ7rf¼c‹_•‹ÿÁ'¦*êæ•Œ‘aãö>öð3v\~SöþþŸ©Òa^šÿ”¿;óXsTo.þºCæ¯l Aƒ_sgªR!¬õôÃ+ÖUÃríZ9Ï:Öm}£ü¦†©î7,wUÃÀ>K%¤n“x•H?d¤Cƒ-nj ’¼´}û¶‡csÈ_ì3„ÐõÝúþ¡Æ¸™™Më?ä@$¤hH×–ãv¿¬ø Ôl;‹¡gÒk¶BÎ.±¹&Iù !d²=onX†Âš’YýìF®:G¹°Ð¦ÿÒDB ÿU’ˆªŽß[hòä+Ù:±¿™¥¥ÂDÛÒÔdó „ä¿ŠÛÏ…Ãåò\ý.ƧC¥U1)yvÁ¤eëS™¤¦¨!äsj¸³å¢ðwŠ:#–d­>ci)ì1$òe>-qhÐâæ{"`ÃÉè ¾^'þüS1ýü!£íÊ -=–ºžÆrðîz4 ð÷¹ôz7 ZÜ|o"UóXÒ†E7<*SX1“°ÕÎ}—Ý[;u£ƒ}¯ÑK $!ÄÛÙ4<îî˜~î[Á¼7T/=!²â¬ÀIþ¡ÐÙkXbz>Œp7 ¿«i)Iq¶Ý¼~. ’ìH‚†mµY +Þ½`ŒP`ß½ïõ™U׌ ´`ý¤þ¶¶¶þÓ7”©ÞDz! ï³NcÏóABÈ¥åŽÃ×>üs4÷r±ÆX;û‰%„Og·¶3’ PP^¬Åb©Lx49wØ¿‹Zº:_JÅŠ“uOh6b=O¯¤6™ûßúso-%ʹqñµyàh!šõ½óç! ÔhÐâæÛºÍåÛ[N˜©M}ú6>"¦Â^¹~ïw×ÌÞqænLì‚6<&ž½zL;xév|R<;|Ñês¯ªó‘— vöf ØuiÞœ_æÉú kžy9¹ ùÖUóAãý¦ŸùðìØ.g&‹3¼}ž›L½±óÈ$Kib¢‘rsۈݒ’’_4cÂø ï½Î#„­ÓŤ ÊÅ¢¢Âˆ}ÓÅ ŽEc]"{fmrÛ¾65Bƒtðè^#ècLŠ±ùý3«œÖ®¾“Ò d´rCƒ7ßÖmðXÒói^Þ×çòÅK•/äÚû²À~ö漢K¥³&{)f<ÝÜ<= «ê¥ÙO>ÕûÝ©¾\.—³,[µ¸ù, “µ•fR쀗âý-ØÝG;]Ù(Þv©pÌÜn2ŸæÌëk!—ËåTs?/§¨°Û éeÂÔþ.{¼ŸB ñ+O-}É‘(/3I+ÿIJ¾¸kCËØ¡1çnÜ»t„õ‚®+‚+.§+|q¬Oße§Þ [0W“`ÔÄõ;.ùqÚ}-(E~ÓeJtüý#syÃ|IhyCãWÄO2ÑD"ŽL/Ö=¼nö1¤˜ i½œ”ÃOdæ,@d5ìPa1ÇªÇ ùr åõuuº:ù¥¢ªœ¤å9(.qrrª\m¡Ì>@w+þ®ä¸qÍ4DÖÖ´Íý³†òö/Øš»Z±@šM±´õ¬NÕ¬§)Íƶ~L­FùŠ÷-‡î<8’óûp¯ë:žšß·Ž“Îäµo¬ °õl$!Œ¬}·,MÿíÂFðZ‡ˆF]ÇE†E üÜ»ÕoyƒÚ7¶íä£üf,…ðb0*„ñ7䇞&‹êè;ØÊ[Ú äŠ¶I‡ñmhæ¤A‹›:fRlºÛoÅîéömä@4¢.>zboÀº)@ˆìë[âl 뱄YPZ`@ò‹DõuÚV夡՘hêÅÞ Qé÷=}y³FƇ´Òpz€~«N¬Ï3>ÞÑÔ¶ÖVS†¬ìbäƒ&Ú5*F¤ù¸%þJ ¾"¸y›°öø¹=œWµm¹p€µ:aC"ƒŽ÷q\ažŒ’2dë(´A 6)ÿ³ü@ÊšeSSh¨ž.Êyœñ.jÜ­µˆLÆáÞVñÓ®®Ñêza;Ûö¥S B$"ùuM‚iГ©}&…/S2¾´3ÓÑÕÓ×××ÓÕêÕ¿OZÈÍOŒì—ç À•e«eæcu€hl :§¸g $ø¦ǽ*+F]äæ­‰P\ (ÞÏ=þ½ˆ„ö¾BFÜþK1¼Þ΀ÆvÉ_µáD›Ñ³ Í:¬¹ø@‘Ëâ€îdÖó„SŠ¹ÉåÀuÖ*®P\ÙzGOo[=ödB®²„Š* Û–53@B ÀÇqʼnD@dŸÖ®>`á2NCÛøÚµ³Ç‰ÉO¾•]0ÈÄðLHBBB|||||BB7­/󮦬Ѫ4çÕÞ£çAi×EKa‡M€tÞK/|ù™GäcÌ©ƒÖC[ÒœIƒ7uè6wæMÎ5û­­>Qì1ÐØiXç×+w=e€¼ Úž)ƒ„Bþî|Þ]¾òòEcLÇöu³¶²&óû·Y¹¨¤LL½ ‘çDÇFó…B¡“·ç¬üVúˆ@‹kÛôif ïv Ø_²ðºŸ;ׯ™bïyϵ ­n|»î {/íÚJ¾f™ôœ¹jt?€ÿ§Fï«{€R‘¨LF)&;ÄØîä–1KFö Ïi¹¨¤\LÃÅã,'ÚXO:ö6»AS= ‚ûN_„˜5+ŽãH§?oÖžiluvCÄâÞ.—ï¿zÒƳvÍõ”÷”JE…b@ñ§ÔÍ{¡¤½¹‡sòõçSzp8–SÇÀºSWå·Zr8#¶=:ræ¤}î†Æ¯ˆŸaÄP¹µƒˆUgíªžcw÷ÝúiÞ¹@{åC¼…ã6„tïlXë"ª™(gUŽÊ?+SÔH¨œ'¨†ªTµ®‚Ug…TSU…«Øc!©u‡–: TÞõ¤8ãGÔÐUjJ[~Ñ ×nêYÕâ+…Õè±ê¦`ê"«=¬^ãgåc„ê½gÔNV½†KêHHT[©R‹º³WÊŸ|³JµÃiYCƒ7míÇŒ*iW#pÄØ™iÓÔ§AƒžLÑ AƒÆÏÇO5ÑTgK­Îùqͺž—ÕÕQ7ÔöÕ 9‡ºâÿ• ð‡Š­ÛWt]ž¹•³û7ʬEÿï»­ýÉð»þ¹ëpT‰ÿ†v~ã6‚¿M€ºZZç’Â0XÝ®Ü,á¿™OþsâIIZ7»nOráìÊq}~ßS¹¾‹'øº Y@‚ùÁæ]ì‹•|KGÍàM "ïo¶ëhjnnnnn®¸ËÖÜÜÜÔ¬¯ÉoÎÚ ß—+9ê–¾shß¡×àU„‚×'­l¼¾+5!Oõ¶L(‰©IÇ×ERIìÜ–Ý7þ%ï¨PšózË¢I¶–¦¦]Mø.>ÛÏ…W:¿ü1ERœ×Å”û…úf±„È‹?x mîçÕd"ºÝ¥)ïUM½¼Ô›]ì{BPVjnaù¾\þw–}¤_^¼üPðmzòMž}•€âOFôäù/1çïåJ¹Ø}Úå<@d¹»çô55q+•W¶Š.ŸdÃáX ]÷Ý|¨ºÛ€äqÈ‘Ž¥Õ¸¥{D2Rsð Ê­œÌåX[ ÜE¾† Wî’k[§wlÅy,®^yüšvgdg''ªŒ¤ IDAT''÷W“3•Ë#"!e'×ͲµâXó·]Šûo-2~â7›:hÜÔÝgÍ­¥«¯­ „ÀµãNf™„ŸZM€Á604Pn*KKÇ@G Zy¾}•úäÉ“”°C:MÛ?yòäÉ“'©O/kÐÖ×3mͼ•ô¶ÊQ÷ˈ`lÙYWW SÓÀ@ïGªÇÔÔ3ÐÕ;õù«ÀÒ6Ô×úÆx[kØ’ŸÜ×sàç†îIRSŸ=>¹üá±åu¦ïˆjrB 5•µšãC¯ÅÅ‹›¦ú ¢*̈†¡‘ò#L CýŠæ0jmÌU>à·5ñ'¶]NÌ€ê+„T’ "H°{uhÀ,ˆÙå9de'+Ž¶¦¢‹'y0ºïarrÔ6Ÿ9¾žùbeßÞ¤ôÙUgéÍí½ttµ«XE’2yÝ¥ ‰÷¦¤Xf‡ŒÛZc•ýeèÆÓ·ØOÛ™–ö,íÙCß–ŸFö°{–+¦–‘ùÖ¸]ûK¨ÑTSà…ˆ7þ¼†?B±Zw'!@Ññk8¿o}yY¶³µÔa@=C½ªí‹ãó'\/ç'?|xÿÞ‰°¥£<—UeN¡rïL ŒèbÑYšF-j~”·ïs[6e*ºvóf]?¤)kG!OåNü&MÔ4o¥÷æµÒùö’¬O¤‘QaôAw¿»oÄë<@Ôh× †Ë.d·0s!™ëÂ3KKK³Ó®!»¡©[‰y3_dulÃRTø©e^ÉÇ/ðOÛO(̛ҮÊù¾wê-Ân"ÐW2Qdh”ŽèW’Kµøí¾³´ŒÑÏÑæÏ[±üáÑ—®Ù{ú@Ù«Ÿ1ûc<82;è=çÞáÑð&2Llã4¸ H¥RfÇ.é/rß&Ur­¸¸”20RxÇ$ ç—ÌÛy—I:ÇîÜh^öê-àV·æR©H[Ë°„Ã’›º½üm ½—\õ@I>ÈË2Üü—‰l¢ ÷½ž·Ê €°Oz†,Ý6^²ò© óGG!²~K9vìtóÉ‹ÞjÍN «ù`# ÈíeRú[š|ä¢\VwÎâG…²…ôÕšJË‹XŒj%ùeß•ŒErR_§j¨Ób³P¢¤þ•–Š4uÙu5»„e;ʵ-¶²0-ËŽ( HŒZ¸Ô„+/´ŸuXgO30ý´l¶±fçñΆ`dÒMË[ ‚{'ææ7…àÐôÛš;£åH-$ÐIS«ãÄÁ ÑÑ©Qɧl=ˆ?wÉeõ"õV¸ò")¥­Ué]”­¡)•¨ÐY$‡z:U<¦©¥b%â‰ËEòÜÌ]¹.·cÆ`Ar÷^ž-ƒïv0d««¥îÒC†ª¥€Ó7žÑd*f⊓±Åå”–Ne:–†–\&ûg‹™Xj¤­U%Xô¬üolžug×8ßSnŸÛYõ1äR½›Q7u+)³ëeéßÕœä}ç Xáyfõp‡ë§oúž_%¿ÿÄ^Ωé°“Ÿ‹bðÌJß&:8t«x­ÁhþAìÛ¤ª#éh|Í.€ ¯ÿò¨þ@d_]þräaôv¯ºÈÛ™}‘×7h 5Îþ¡Ô¿çPJ®k¬É ¹…eº†zfúõ‹ÊžU°8»>R”Iê^QoÊ& Û÷憚хeu9ÚãÊy$È÷Õ'|ª°Í„zlõù±µ¤òU?¿A½:ß•ôõ50§¸jB\R.aj+ÃÒ7¨W^T*ÐTi+©ØœÒ©ÏVð!U;LãÖŠ¯r°Ms½J•¨‘VAžâŽ3–f¥r!Zú)ãÇv'µ§5 €ž&³Já@¼9ñºCdë:ˆÍ4Òd”–J*ZR&.ÓÒTÑëkœbYµ˜³t”ˆÇÒÐD½¦kûµEDbhÝÃXç@JÞZç&µ‡²ŒX—1[ïÝe!ÊúvsÑ;{˽i•¦f Ã,-hH$%, ÍöR1ƒAäTµ;gÃzFà:yOv¢ßÄÝÿê4Ѩg÷V ׯŸŽhèÓÍèçT¸DÇ%*& o,:r÷ÖÓhÇQ e^´1µ<|9XÑŸIÅIçŠia7¤B#«’Æ›äÚÐ@?;·°jµR.—kïˆ?Ðsò $ÀØH»¤@åhÕ¯$¡ŒU&ÖkWŸý9#»z¹2çãC}ÝjräI—7ÃÇqËzºPµâ‰ “Hd®Òª’WÜòugÓ ßu%®ß¨K¡ècÕ3쳤éw3|l5ÂÃ3+RåÅ|™·5¬~­ÓÞ´cÑëEWs•ŽJÓSûîMüü]U¯KCò.ST)¡²óËŒu|I ’¶ Š1¾K1ò%9ÁÐʲnçèíÚ4)HÏ”(ˆšñ.©eCKer{ó4##+éPÿNÒµsýjk੤¸¬´òœ¹œM–Ú³òðéã«ú›h„0yzŒkÏ‹”b4ïÚª8íe¹¢_ÞÅ60²þg‹›:zEÕ£eÅWcN?tƒ$î›°ûÉ¿˜@O·õk¶õóP» 5:Ò礛û®$}ÕX§´÷ïY´}ʨÔ2hçàÌJŠ:ž*~t÷ðÊ–+@ÁøëŒâ·½±T‘¼èÝ‚1CJôô› Zm[# ¼þZyò—Ër¬ü<$·Oßú@ÈÍu}ÆT_4ÔÓè½!¸Ù›}¢?ÙXv8rö&(=ºý4§ÏDÒ’7 Ò@CåŠùV¾. ¦ÎÊ¡d?¸8æó½~ÛTÅžs—^ %1¯_xZt†æ-µ?=ü®ï×ÑdÔ-e˜Å)0ê7ÔÍÍH™›5X·¥”55RìàTh4,&aVt1fn²—ÓŽ<Bò㶽úªïÜÒÞE_>Ríl[“Í" f%1‰ÝâMÙg&fJY2sýœi†*2Þ¶ÎÕ¾ËNÝSù}ÐÆè²>fM¾³BÈ¥ƒÞnQ@B×n“83ýáãëÌ-µ??ú’ƒ÷i³¿×;˜pÍÒi°2q@‹ Hªî†õëÆ_³q€¢ÔÀ ¤óGP1'v]{* ‚… ÎOyS @Èê¹;yS&ÔÈy~oϹ0 †·ÊþÛY_ïÞÉ2¯’Fš€P¥*µlÓõó«´Ä…Ò—sG$niPzx׎¬ úy{î Z <ã·eQƒ§ýƒÅ Œâ48úJ1BHÅeÅåâŠá‚ÝèdÈ¡»Û‡nŠ+”ŠŠDÊÚ«L\&*+­!ÊDÅÅÊ9—K䚌Á0ÀßäRqI©P.)È{nU ‹®î”¾¸¼ïÆýš“hI‰¨T"‘ˆB@YyQ‰Øúo×yÈÀù¨ÕáÚCñËzó§>s~ßr´³z—Œ@FÓS¡‘¾D^|®¥¥¥ë°Å]­ »¦…HóXØ%ƒ°@àØÃvÜVnC0\¹¸ö@€µ ïb‰Û¹ýãQ$! ëÜåmNñLÈ,Y°ç¤ àŠ€oçìÇ™jyŸÆŠ…õŒË;Øœ DÅrÇ_?´ãðn¶–£‚¢×Ÿ¼1‹§‡”HT¼o¼¾G.ÇÅnæ!ÓzP¿Çæßlüxü}†–YÊÿœ+ ¤¥¢ÒÊåyyY‘¨F ó ^7ÖcÊvг8¸Þ{´­­kÏþ †#Êr ËÄ/ßç6n¬£@!Ë<­¸ÜÙ{ƒSήår­<–h® o–¸‚cm=tWæÙÈKú,€Ág¶_}LJXq¹æìyŸxžËåØ»Lë »æMqáYqø —ÙAÃ…5ÎÝ4ç ¿}v»8"ÈÌÌÜœc—ÖÄïvâÍf: ‹‹DeU `aQ È%%ÅeREBv片Wùöw¶ð…Jmo€²BQŽÑ(—Wä +•H((-IåõܶþÎïÏã÷è3¤ÈldAVž¥¥Å%’*n,—U¨ð¥Å…„QvñÐÓ~ýÛ*ˆó%.ÃårmF‹ßr¹\ÓÎŽ_¤ÐkñÞ9œ\×Jè³höñ˽¾gãÉä"@D‹ ûÍóâ[ZñJy“¶MpE€¬”È­'+¶bïóÒ ±âÚ‡î <ÚÖ@¾œµ6·är<²Ù%ý9\3›H°›ó"Ž/Þ1°_(pì1eζs6ƚҶoøXD¢ÓäuËÜ4츖üSÆí=7°ÅçÜÍO2b@|çÊy$ún -¬ÃäºÆ<¼–)y-Ër¥‡Š>¯ô¤Æv¼YÃö,¦Ì¾•gÒ Æ‘Êû2~È[µºúº b Î&ìJÅÖ0d$2Q'¯ ð3íoW@Q¾šeʺ â+Ûˆ³BÕ†×MRT°Jí·µÍÜQ¿ñj×MM45Ÿ£fkÔ¿ê¯ 5jÄTa¨qÀ·ª¡šVµþu§6yç±*²¬Ý1”8£ò"¨y2PM1Õ·¨™T5Øì¿äëãgm„d´[=Ætúúk¤Ò×R-“k•9rÕÇ%›n•Ÿ*•/«Ÿê4°.ÿôuj-ÎIí¥ R³2ß[Ú¨¢þâìFik[#Bâ÷L«ï³ÂL»æXPÛZ¨§0Bˆ:—]ÊŸ ¶©{Ýë;¤®·D­ý7¿Qíº}³ªPWIÍo î#׈©R±:ùMM5TÓªÆ$u“®VK•³TË`ª•©ÍWêoÔÝ£ \Píjü“µ›J‰~åtg—ÍõéË/ÿ>¨òüsÁqƒ|½v7Eã×mNƒÖdªzÝ¡†¾óo1áýn±¶Õì÷¬¿g3«69ª±~ú¶õí·MuiРÅÍM¥ 2.Ÿ>Ü´k3¯Á“Cï§)yצ³]îƉ86Ðfê BŒ<¾²K;‹›…ÕKƒ÷Îms¶ær­8SW.§T­oˆÞ'ï×ccÓÝoâý,iÍöwq«‹ÀÚŠc=kÓ9ªÂ6—<:mcn±åyYÕr#ˆÒ—Oòwpt²·ëx(´–m.$_ÙëʳæZY[²»†0 ¿2ðg€¢Pö)ÌžË <|[’vÈÅÖbÃíX’naÛ#W%2EQTÕܨo—¦&NåÏ}SýE½AÄ5C]§¯ßæga{»°"JÑëó‚n¾¥ˆˆ¸yLïá{î©dI}ñ³²Ø›ˆùŽ„=eTEYŠ?9w6pÝ& "ʇ8¯ ùŠˆÑköûû$»]/ʪ2›?¤ÇÂÓ÷Q6ÇÃlñ¥ÏÊ5•|Ø{)r`æÿõבÿ€Ÿ•Ñ´Þ=߯ê â»”[±/¿`IºÏãõÛ¨¾®B+sÎê³÷†zt½|ã’ ·ËÁè<”—^Ø` Ñ?{⬳ÇaÜšÚ„ £¼=lŽZgjW6·¨ààÊAUïëk@Ž¨Ê¸¤LÂÒÖúˆ Z»ùqNƒÆ+ÅUãÞ„íx¾oV«ßÒ¨üc6*¬¢%ÅY¤Ñ÷’hw0»o ®D̽p=FiZ&vmc¨VÃ`{ó˜ÕVÈY9Èiª US¿ömÚe~¬|+‡e³ú™)‹bܲ^a~¡BXRÅdÔ%©Ó?d1Ûµ5@hÓÎ:ãËce©×—Ï_QP^L¦Ì¼ƒ-khÐâæ/loÁÒ㛩ۋG,Ü£˜$œZ9tþñþÃ|úî.¯VO§»6)ìW¶ÏÛÖ¢ÿâï]¤Êð›é¹vªâGÒÎÑÝ'_Ä—óÌ&4Ö¥gM‚À®œ!9.XŸq||62sÊKçêd&ï¹F\~Nø²Ëo777äk´è`ÑÞ; ÄL÷v^¸Z„@þöõûM]ÇTiˆ @Võ=&mZ¶Õ¸úTq}ÄÍ g:´w "l»–Z @‹6çž›”^®0†Þí0{Š!͆4þŸàg­9Sˆå¢ì}Óx 3 îˆ9ëÓóJ‹ß¶5±ÿZÍÎÖ")«Gz[ŒýP±¥M‰oìYèÀ·Øu_w*FŽHQ2[®Ej~9"">³j.Ì”#"f…ì48‘’%\ ræ[óy¼ñKIñØHçw3*ŠݵîlÊáp,--­8K î‰OˆH}xxµ—½W¸öì=…bôúÉæ#6*ê/)Ê\ÐÇ’cÝR`N™ßóºvx›/Sl3%_ÞæÀãZó¶]JBD”æ8u©(ÅÒŠÃáX-ÊDD©èóÚéƒù¶<¾Ðyíñ;RDDéba›Ç?+òù’Ú×™giÅ_~ôŽ”úîÆ? ¿~æ³ÚfÑ5ÌvÕšz«sï]mq¦lˆ[9ïQkî¬âá[ÝRH-ÛÜÚÖ·ªÜ d«Æ¦ö~×6·N#l4~5ÐGZiРñ[*¦Aƒ ZÜРAãW7jü Ö9Mû1wÙPØûÛÖmiýƒ.¹ÕÛ®Ó“M4þÇÄ "Ò³[v³ãñ|+k»Y«Pu. ‰v²´´°õ{«¤¤ßkÈì×rBÈ»S¾ÂÙQÓ|œ3ÃÅwç´tÝ„ âøåÎ:¥9El]³”ï9||²k[DV;K«yYYHyv=(¾aÀ€&eµ'`b}ç;a',š(¹ø*}¿ü&î[;€ÕîÒÐÆ:Lz:EƒÆÿÐd f å\šßù¾«¾|-)“³¢·‡®¾ñ¶y\bB|â=Ùµ ÕIyæ‹/δnb9sçÃËs (vÊ‚ ›#ãâv4›8v&h³’Öþ~9:~‹ 0µ õ5€Ü¸“à.tÂbÔÖ|psÏÈaCçîÊIf›N]4 <';;ñâº[©­ý½» *ïQÀʧƒÆJ¨Ú5hjÃÕP½}º$û3£‘aÖíÝn¶¶ŽÞ!©Ù4‹Ð ñ¿%n@Ó~kÂÎJœ=lpO7GW¿™™¥€¦½Vß9ãӻש©©Â¶ðèÁQ@É¥€öá÷.4ÌùüüÙ³<ª™¨,0†ÎÍj•’}ß¾‡yy‰ÄÊN"ŽGOœèÑ🗛ˆª´’*¾0løÂ]ÝG oÆ°e渑;Ž²¸!âr‘,÷ÃÑò^a1IIÁ+Öïý"_BŸÂ£AãI»Qœ¾­o¸ûÌ­Ûa1÷Çš‹ü†Î O¯,uöô½Ÿú%;;¿¼¦))Ltá ~Û~ñCÖ—œÜ‚*G`ܦæ¹à⻑7çú ÕÁ56:dŠGW𘸖GdëïWN” ºß¸}ëöƒÇÛˆNýsm|ñ“­5( (¤ärê;# -Ðm²²O+@}+zSri.¡AãI»!âÇ÷剎ÛO*JÏ(jóŠ+Ãö…NìãÒ½SR3að³†ý¦îœêîÒÓµÙ7ŠH»lém_!yŠŠª¼ñ0 °’WÓÇÏɉÂ/¶iëÎi_?%ņ~ˆ;bgïè`ç°%]?zf7÷ß¿='ÔoØDZRV\1A‰tØ´nCƒÆÿ’¸мqúÌ éëË*üÓÉÖ¯ÜÑÆ–cØÊ@ú6-JžŸ‹”3‹²J”“5ÒÓúò1€úºlþV"•×UÀŸ É®G(N½ÆwñÉ!äsì¡8Š5ÃJØí_¼Ž[wþ! ²÷'®‡ ;[Úq¯³ÛŠœ·Ç„¯çª`çÖmEªê€ ‹Á LVŜРÃ"›‚¡³NÈ uÉ,< IDATÏ+enLs ??éjt ¥¥×ö¯t³³áZsùŽ=7 +“Rˆ(ÊLîël-´s^}&Q–ÏãpæÝúxlŒ×¨ã‰ˆˆXºyº¯•5ÐôuE’’ù>|ÇÞs‚‡sý)öÃË¢f·vÛ‚XäÞ‘ÿN^qò‡G·üÝí¸\k¯a³_ç–*6Ê%EŸ–Œ÷µærl{yH©îÁŸöm7;AŠˆ({gcÖ9³H†ˆ‹Gôäp¹V++‡Ëµê56)YÉñ㬸Öv=‡$dä«Ù˧AƒÆ×"ÕøÏF5nGU#€’õtM¯ÐˆPíŹÒA¸’+ñ%×ö¦Lj»¾FUOÝêÝW“ºò¡AƒÆ¿´êBÒ§AƒÆ?kí† 4hqCƒ_QÜ š§?êšþ¼ybMçßÿ‘ ¨²÷ñ¿L µIPÕþâ»|£z*O‹›¿Ý?ȧK Ûwhw0:‹üÛNjô­RÕBÈx¾©¹¹…¸CWý¼%^B=\ÕÔn1!dùð. Ž¾ü¬¤Ä]:wx#’þxq„/'Óˆ—j“B^]YÁíbá63Lhkö$§¬®œ3B ÿõ²h„Õ†?ß57¹R¶\óÇybzþÿX?³l:wwú ïcç/ŽqšR5ÄÕºšT/®¢f¨2”*hÞúõ =tT]3éêëݱ€«_#AÍL*w±¾S@Å":©>M¨e¤O`éñ4PëÈJùbæšÁP#‰ÚŠÕÞÂ# Í´¯ëÐ H]¹éé°˜¤f+IznÇUßËu.L¥ë¢kPhÏüã"{ªß.üÖEËÕJ€–®–jôõ+*P'MhÐÚÍ·ÔbQT̳FãV.Ô?š\ €€ˆ¥7ö.´³µ±t?x+Uá›îÉ­Ž|®5Á®kRBHÁ»Ä ¾nB;{·¾ã~*%„d_ÒuÄ¥ÝK&õpëîà5òÑçRBÈJ_Þsro¡ýጚ¬)-+©=ºž]l7ns|à”a.ÝÝÍþ*Sp4I ÞãîÀçZ ﻩ¨À—gw†x9ÚÙÛ»xŠy€„P§WO²á {ú}š]¡¬ËYvò5ɉkÁõ{›x¢owGpãŸ"”}Lê.àñŠZ3Íyå©ç„H¦X6™w½€¨Ê¥ó¦ÙØòzøŽ›²¿%gŠœ¸S«m…v ØX˜ÙO‰BJ̱2W,-ÒÞïðɳ=ܺۻ¸÷¶HIyDBHnÚí>öÖö®+Ï$S•¾³>¦Üìé, ½Gþþ¶@J¹<†w³T+d¼“Ó¤Ð**É Þüà#øvn»®?$„a.cwtZýDF¤ï÷p¶·ãóG/Ü] EåÉ‘G[íl/° ü&.Ë*§@ù§ûÃzùBç¹;CeDÁ`äë˨a^Ž¶<Þ ™òeÄNѧ;ÇÌ|ÚÆËrú^¡ÿø‰gx.Î8lO$"î[ä7w„"0åÜìžC–!"¢ØÍQx7»œzsˆgÛ¿—î¶äp–¥9™Ø^~‡ˆ(μ%tp.G,¸=ÅÎÖúm "âÇ+˺¸/!¢,oÚók…§™jÌtíöÛÕGŸ?}úX…%D¼¶Å×Ás¸"NðT{ÏÀ‡¢ìÅ^ âÆœ?†;­>s ’l»ï|ADŒâ9¸!æ„Î:OT¤åïnÑk "MwZsî <°°°ž}Jq½Îg¡ƒC¡ŒBD¿[£?"â—Èm6« Koåî?Í’*ŠÌ¿5›g?F4®·£¥ç:¦ñxnO¥HÉÅNŽöé"©øÞB>×2þ“sïîéÒm’DÉá%ÎXÛ_ú„ˆX¿ÑžoýºóîÌS 3"vóú(¢ºÙlz…ˆèÞ]˜šS†ˆS­¾ò?ö2±ºžƒˆ¹.–Nï±øé.¡sEq×—ržsRå Ç7l½+rμöGŸÙÁˆØÏÍaG\"âÛ?í8–Û®¾CÑaû踄W±6ßìjàqJª¡cµB Pºchù¯!d1ÑѪz ø‚d¡ë¢†‚”iúôþmá7|““’/÷òïÖÝü!%±)jêc£ÇüÉ2aóK¾±â¢y@uëÃeAe½D{? \ì“3Ò­wÏ„·lãü¸ôº›/,M”•gi$<Õ†43G÷ùÕm]‡/P jŠwŠX7`£É«¦Ô/œ—7¹ÆËž\È!wï&²¨’Ò3|<½³ÔŠ’Þöûñ)IÐ8Ò¼‹ûR²æ¬W©ÉB=g5ö$‹ÝWÕ£ÞE_óQ2K¨ ªTT²Ç¾R^¬ÙAtüî£`k0Pô{#ë ­·Î”d|²vCæD¹Ì[€\%d±)–ô³Ë›E­tžþhïÆ¡~É|Ô¹_÷k·/µð¨ºö×™í"—ªæ^¢¸;·_ÛùN-ÌÇšl@1Ï,•Ù› £·èFï15Þl±üxpkU‚Õ®W)œÌh|´€,9=ÍKëäVéœ1àáÖÚ¸áæÏ)‰?™{ºûŒ5£–‘H!“]ñé‚— ¨þa¥Ö»M¢¸‚6‹Ù.WV¬|”âP;Hv‹E’ôñU”­{dõt×:S#!ânÛ%$¤dzûi³Ÿì}¤#þ¥©úVaùR³ ¢¯wbJŠ9i½›¢hZXeôçÅ—&ÀIJυ¬ÀïÔ+÷QÊ“-6P ¤Ä¦zMƾâ×D‹ã~q=V&w~r'ÖŒÛa ß3!ÅÒîÓÞñ+Æ>4S>h>}Óù²MÂÕ¿^}Å€w„5—@•yð×—g,H®Ü!PÈä2›1 B™L&“ɲ¾K™BùÙí4¹÷ó¥#žeãû5»ãr¥–MÅɈ]ˆ”Ûûzûô-%ï>¨æÍiã­&oº¨”ÿ.¬½áí¯Ýuù™GÌ8úÂÑ·Òé]›~µºbs×>•/MûÚaÿlÃ1µ\x~rí¨Í©;WMÉBµ¶èÈ[©nl^ó²lXˆéO¯~·loE)ôöŽ·Ž}i`¯?¸»qËìãÏì 1j…÷yÍ-a¾žsrªÀyŸ?öò2$› “É$[’ €¬û—Üžù^àþ¶É5ºÌ‚ñWŽÎYPqy×Wߟ !„€\H’ÊG¥|ü¼Ö|äÓKŽ=(½Ñ(TuþÈÚkfœšß§UŸ¥naÆ-ÝüëÂÍ1£ÒjM,å Ç1©@@½þÕž|ûý¹Å£>ŸfšU¿VM‹&`ÜœÍõüÕ@·Ÿ–ȶ|û…IÞeä7ã{Ø}lÃø‘ÝOö,TiÖÚ­dHÌeFÇn˜òÓqeáÚ;VuåQÝ‹v©VûýEGGÕ÷|ÅA¦Ñ´}HÓŸ]x2ŽÞ:h³3-ÎK-hË4š¬P¢÷¦yŠ÷Âߎ3Ë»9®ku‡WŒÑôë§éEª„ý´kœ h6{ì¥Qõj×ö-¼öënu> `É4X¬h7L¯NhŒƒDؼnAŸnV˜tïM]Ú)8€mããt_´¨QÌçÕÆÓ¿õ¼±—‡†Ô®]¤jËåSz5 `ÛæeŒË¬ìȦöª}p‰Ñ`@Æ⃔§ç4|/‚>U6­] ãéu;ŒØ]¨}l™Þ÷Ýz Mºw¿^]BÔdµÃ3dÏîïGn2æ…1 \ýõ›W¨AfƒA.€Ñ`°€Ïìi£úvy[xŸðýòYå‹vÓ¼\й©C« ª]»ùÔ=3Úõß8[×3,8Þ(• éq`Ý(Ä]>¾n?F÷nV­í'Cã¿ «[ÛDyé:íwï,6o\2°Wïšã¥¶ÍíTÏǘi†¦ÂžÃ?ŒÚbÞ3cÕð~›†’Ñh”²z0Ód´Ú%÷×è>™úC×Od_Cáz%EžÄ¬Ÿ¿“âø™rxXÍîësGcpm"O[¯gÌ%Ïa@’ò¯öU…®Ù\žß¿z&=ëÐèã¶U~8“öê±K6É–ú4úÜsÇÛ&×è¿ ö³þc>=1°ÝÂ\+Èô¡]ßÝëçI”\oÒpùô›-ç½|C¢$‘qGNÏ·xÞ±|Í`Þ¡q_ôá>™ú#Âxeçâjó’71ßmB~ºázâ%\›qmâ·jÈÅrUó; ñéÙuå±¼²iÚì«ž=Ú7}|ñÀÑü‹`¯Wü»dreú˜ï6ìÒ»’>cúí£çzFìµ=.`7Z†~;Ãaw“Ž<•‰<}ðš®yÞØå‘€-ÅüÉ'CòmZ¼ŽÝ×ütíB·¾øžþ{/ °Æ]Œ~àß8¸äÿ™IHBˆ{WÏ?ŠKQêüjÖ®¡“çc+ì°Ž¶¥<9{9&Ó.+Q¡z…âÞùg“”xíðmm³zeÝóÕMn¸q“›Üä¦ß'ùçŸþW.ïñç—®ÛåõFÍ­Àß –äs°íꧾo¾áýO9^½waßÑ«É•ß,öªcnìøáHzñÀb¬ ÷÷îÙ}êìµ[”þÅ êÕþ]B"ñäʉí{ܸW¦B9•p,BØnÿ´yû©sW̺b% x¸½¥þ9ô—^@!ĺYßGü¼mÉÖÈ¿iv !&6­›gvX»&êIÆ?gØîýºÛQ%nìXµù\€Ôs«‚›pé™ÁÇ×ÇwcX›K<ú·}Í„¸³íóNã–ÚUž‰7v…·’"„‹y´0>;^»é©º"¥ kç l1#ò‘kþ9¤ø+gŒ;£o|µüË67Õ9 c…5ùñÙK1…gºÁ> –¤s箤Zåå«Õ.é§!)o_:÷$!ë@ñàj˜cÏŸŠ£šÏó‹1/4>EëÖ®"nŸúé—MБ¨ÁÊzü¾&%þÁõk÷ŸS®)÷V¾J‚ÑQQ!¡!—NžH2¢LPpÙ:vcÂÙó—-2}ÝúA§Žž iÒÀòèìù¤Òª€=þZä]]³ºeHÀœzþÂ¥T“ͧpéZe+sÊã¿Þ}® (ýö›8ô«5<¤‚RŸß½tó¡¤ð¬Y§€N!ìæäè3W5j(Ë) ¤ÄÆ\¾ýHRxV­U'@+`7>~)<¬Æ験›ªbâ^bUøfÚ–®³W~Ú¨4A@4«Uiíõ_иT. ñé+wžÄ)=üê×Pƒ0<=p9½iÍÇO^´+¼‚êÖõU‚öŒ¨ç4l¤€7Ο|–l~£Z=Eü“W`¥’ù˜M `ô¢ýK~sûé©M_Ož=uìÌCb. ï<ôÂý¸›'w´ ou×,X3žÎ_¸TÊÙiÍiÚmÄÅñ×okÞö¾UÀ’4nÂgÞí'iÓïîk_¯YªõOÜWV©°öȶˆ—©&‡?BÙ]§îâÚ¦8»x`ϱ3Å%FmZðvË©HùeìgÓ?ñ¹M«¿sty‡C…€dNX°`¡…€›Ç¶ýðë5/’âçî?îëÉ»Ï&<=¹±q³-³©E›ëÀCª²”Ÿ†jÿr3‡V JÅ̧W „âþÍx]ù n¬ùÑ_x¨þa—°Õ'<¿fj³Qß;׿WcÐê'k—ec?Ü~ßpý»wê‰pØhœÚ½z/ü¼¸²¥föòîênõ‡v‚Ž}Z¹ãR’4%þrþI»Ýž|#²N›^$~¯v§ù1Žâ+?h÷V‡…$µÜv)ÃÁÆñý{Žù)Û%§Jÿ¦U÷Þpx§óТwû}ú3O‚ª‡5:íPš…Õ½gÌõj–è1z¾«-Ë–¾õ;.¼A’ÌóÁ;!uª× iþÅüõwžÄå²W²[ëÕ¯—dwþÿnø²Ãw»½Rå¦wÆ/)·ë´NÏÑ`fë ë/-”$Ò>$´ÊŒ-wóŸGëuHͪüúÚϹð)I%ëÄ.¡ ;öÚ¿spÃÎIÉmo㶻ùóJâÌ3—韜œ\¥E“´o&\>²ªÊyÑþöä⇽3ç˜u6½fŸ2Á»î;Ãë¿lžáe4zä;P!¬w̓{Éfj]åÂÚØGÉ(‘å6e·š’S „\ãçë™/S^:ù¤í®&Ú•2!ÙtŒŽ ž|Ë[îМʕ ›]ºõ$±\ÅŠ~ –xËbymh=h|ÎÏx{ð1‡¤Ú»`‹º%BÆ•rï֣✹bŸÄ«v,ùô˜’ I©‰â,Ð5[ÿ”]ãÃçɪŸæOد €ô„´8íyÈkQ¡­ªuª¿dBXììI É@(ü|ï6ÆIªYË7ˆ‹9¿vÕŠ!½æ ýhíÔw^=– 7e“GŽ âÙ )þÁ“U„Ý»LI‡ñ‹B.hÏñ”÷Ò Z_o%Ä•|_/TÊ!²8»ryk¬ø‹?Jô]»uY½aJïw†/9µ~x}÷ªïÖÝü9îî‰3à¯Õ«“#AWضv鉙Ãk¨4Û èt R³Uz¥^ —˼ËÕ3w¢k•©/éÕ—o³K2W§¥×#úŒ[ªTú´ÜóÓGùñ$MîޱȈ%KØÚ§ú×ò‡5=™+ç.Q²;w27ÖLžp@~éÜ1Qa£–;ŠÛ%:ŠKvÃrÉbÿhÎÜ Mž3µÜ$—ÌöçÌ­¬vI3>Íͧtë—!W-%ö[©Té2­&-cSàYÀ Íj“+” –«5æ›Zcí«ÜuUÊÔw²!J¦µóçÏËÁͳŸg€!‘N/P»URÙó »ÆÌݦ’e_&/Úaå7u´ŠF ôj@à~\r©‚•]ê±Î5¯Ã¢så}eÞS7ÍkTã½çOQ»¿D7Üü %1V^z:ý‡£uKy8<“O¬i2í§™ÃCZÔ÷ܸáäðÏê JÓÚ6̘¸kPXÁU£Ù±’âð÷c—¤¿µ¥kùÇ ~¶9¸¡-êй†ÍêP<Ù•a¤WO¢Ÿ²ü›¾€Éñy¡XPçÈCóH#9æ…fpXi0=ŸCY®m¾×…Û+–ð¿ò‰ã“zrç´J% Õkïι'd¥Ü}‘Q9˧ébô€¢a®=x•+ knÉde€ÂÊÊ/žyZ@ü£kf¿JŽ².°É:%ʾ!»üë‹Êu xqÿŠ½``1y¾¯Sj{äÑW?jV ¾³hÍ !l¦'[âÅ‚æEÌNá!Öj^ÑÏñFIqIÂÃÛË%ˆ Ü£Šl¥=.é'Î',Šœ%0%t}X³¶ÍÂê݉Žx¬ jVÊ5ìÜ®g³°ÊG÷înõñ÷h‹¾¡~1¤ÏvC¾}¿žëɈ8òíÐ:§S¸²Bûõ_ôlÓ¦ÄÌ÷{Ý|»ìÎè˜9#Ë~´lÜΚËòr_¼Ã  ïvèW§”íâsÉb'P0|¬4kȬUðyq4¾€¯ìº @«u?ï>gœýEÚåˆRí>N{úÅÔ¥&NŸûm»Ã“Z+î¨Ö´wÀ7_ŒiܯãÉЖÍŸ>ÿàÁâ@fÂÅæÝ'DFpu]Ÿ1uxø€GÃZúb_HX¹¿Øغêƒ:,rªKý†ÞÞ~Z¦%¥e6»¶š^(ÖÌÔ¶_›o} U(]èùûqñé/Ø+RïG·:ÿô­Bî±nlýž-7o™qóø‰>ûOlÈnl†{ámD>â¡PmTfX·6!aÁW¢n”¬Vä7Vžõ+>iÒ¥ý†òUÒŸÝTT:³a`߸¦×¤““šè-]ШS§^Q*ù˜"žê:™†4£Ù¦PëôcZ²Y’ûúèíæŒTƒE¡Ò)ÎO©³°òµ-}X3ÆL ¡õðҪ䀠dMNÍðõõ9>OaÍ4dÍ2‡—F%¥Ää4_?_Ç©aJr’‡Þ7×õŽ­™Ù˜a4[™Z«ÓiT¯ÂÛ,&ƒ1Ó.QÈäZ§F%' hžÓ«óè {[ØLCºÑl2¹§—^)ìæÄT‹ŸŸ^ =19Ý×ÏGжºWx·uGu2@ #5Õb—´>~‹F‡J VŽëRö5€ã|#!WéõžéÉI2_¥€v³)Ý`’•ÆÃS§v›ù¹¥›?Gj½oÞÝ·ÖËy–L©õu¹K@®ôöñuÕ ðÐ{籤¡R­óSë\JB¥óòÓåÑ û棼2…·¯_Ö/¥ŸŸìxyû@êÉ&-gÌ=²3Pƒ[»føqtŠÚC¯ÎbÈ?Kó¡ñÐk²uz_pö›÷¾ßõóŸ.ºÔ¬gg{¯F—“¥_n>¥ÆÃWãáªmõ÷ËÎæãÂp®Së<Õºœ Ç ª´Þ*m®f¬ 1;íÍGgåÒxx¹¶ ¹ÆßOã€É’¶$>´¯L8ônžÞ>¯”E¿±€åy#ÀË×?»)µÖG­Íõ.nrÃÍ’h5¤fXþ-y×_ôMבáu’­(X©Éªõ‹ñÛ“9¤ ø××·Ñø:µ‚AÖï9öÛv¼ø¿±7©,xlsàŸ`”©ýÎú¬ ÿwz„;ÒoýyòÒ] å¥*ÕnÕ°š#ñá/?žM}»[Ó²3ø wk)bÙ÷Þ-‡×/®€ñ·9xòbj¦ÝË¿xx‡vE×y’BˆØ§#Ï\5˜Y°T¥V­jóJ$„¸!òЙдèÐ¥”¯‚„âøžÍ—Æû-ߣS39ˆãÛ6^‹Kqr`³¼Ýcd  !Žïýéê£Ä"jwlR+FBˆŒÇP»þ IDAT‹Vîm:hH9ÍŸ ç"6{Ø{àP½RæZå³ëÇ÷F]´«üÂÚv©PHý¯¹¦“"u׆íORìÕ·©Xе‡2“.ß´OñêÎ0™¨Ò²Gƒœ.].ì{ä×8´ô¿láC@Ü¿päð/·Ô~¥ºvm­Ëãén~~õ§½Ç3lêÀÖ  »Uàyé/ö_;kÞ‘ˆ=ÿnpRãÄÞ¡ƒ§mH1K2É´{þèöß[€'—~ÞýèÏ̪ßÑ…º2³¡WÍ«Òo¼ªtäÇeçžÙ!ĹU#š œ¯"… $Ü;ѲvÈÕ“…°ÎÙ¡ã‡ß½H·+¼´yíZÍ"ïgææAˆ¨E#ÞûvkÑr…q½Â)„°LëÕpù™•ªT6ÝŠ¨Ýt ÉGvo¼“hõÖëõz½··ŸN!2¿ìÙpæÞÛ|O¯þ¸ûg?#wÔJ½±u‡>Û×ýøÀòGÇbF›à‡B@sÒõ¡_- (Q:Çšú¢Ë¸ee‹yf mÕhïcþK±ã)„±[½Ðã,}åß lµàHŒë)TŽ—Õëõz¿]›ÖÄ›ìÙjK¾÷̘rÿÜõLõËGwÿåýöµõ㻶Aí[0#fOã¶ÃSszº'ÞØZ§Õ°ÉËKeø¢_«ï¢ž¹±&ÿuã/"‰ÌèT'èêµ½uÞKwúI$͉ŽˆØy"Ñšu%mf©£#D>H0fyÙ¯Ÿ;±woÄñó×ÅLOï?÷2îîň½{Žžºlsøà[^=ìÇ}o§ç¸Xwë‡á!]¿t½òöû‘¿ZM2ziçÞŸI¸s>bß¾ãçn¼rZºséô¾ˆˆCGO¦dJ”$_î>|ÖœzÏþH‰df܉#"""Î\ºóªHÒ㛇öG8—a#ùàøÖµë¯Øsà×¥ŒCû÷­¹Ü¬cV˜sÆD)©Uå:»Ó³n&wÍø|Qô#’‘³Öi;Ú}1¯m\7¬½=Oÿöo]=âjªãõ6}ÙbØ´#öC:¼b¯I£ú¿ÄIŽê¶õ|Dzä‚šöÈêS£à§F[®k…¿9:…™]ªÔ<šÏèFGîKHwƽ~öÀ­g¦ÛQ›Wo¸vßÁ«/Ó¶oœÒ°åÞ½{3¬9ŸðNõe‘ñŽVO,îÐuäϤtïø¾èÛiÎóìÎÁýûG_°›žíÞÿ‹í5sëÙ¦÷‚{¯vòcu¥æ×äL»°°Á;³l.7[Яg»¶Í›uìùÞÈ/Òɘ¨ˆ1éŽk•ÓžÞ:¸ßáã¿JÆ'»œ·¿vnÛÂ_O¶8:mJ¿† öƸæØÿyÿéGÒc˜1¸ZË96·‹Tú+=Â_îúò~ùAUZµ/qáÇè§Gøãè:{Gßx|#jcãZ-“,’‰­B[m8våñõèÞM¼gBš7¨Åø¥;¦´s? ¸X™7×~þõWŸþpÂÛÇkׂú~»Ìéiv E¶é¼¬ ®§/øÈ!›’#¿ß:±oÇÒ“spø÷»âbcf}Ô÷³c Bˆ­·ôåÏ“R/XÓ¨Õà !`¼?áóo'úäáÓXØSÂk·Øyö^ZJÜšiß]xRñðÀìæ=ÇÜ|‘~ÿ|D›ðÖw-´'BØI…¤ÔUË–¤[^³v måBæm+¦˜ìŽ5¯í¸)C”°éØùácGë@G0U:ŒöN~¾êaî:üõú‡Ï|ìýdÿ²edž¾žÆÔ+„`ŠÕb+¨UH7›|T²G÷îÄÜìà(=-ÉÛW@‚ÊÒByüEfŽ;¡‰¾Ÿí ÓëÆwîŒ)÷ÌŽÿï^5uß…da5¦BHr™$ °:Ãc¹ôA@¡‚±Ï;x~p;Ñ·bEZºù\"aºÑ¼mŸSw^¼¸¾w蘑ŸÎØ,?mߨ¹+µhußÂÍ[6x¿©cpQ©M¹´è‹i¹å$ ¥ÛÐõ«V’#;P—¼xȲy“½•>…´¾+¾Ÿì éÂæ%[.¤†+ÍÚõ;s/îÙ•Ã>óéÌm2ØǵËÁ@³mÛ¬·Í&M1O¥Ã‘#¸bÐÉ›—\×ìæSV}æ!„"£ž¼Ñ0Øm,ý·J7Ö%lÍɇ$/¬ý¢éÈ9ŽÄuý«ZóÔá¾rü¨ ×f½Sì>Ç’qfëÂ9?ŸN?¿1°U–G8ë4¸âôÇénoÝއϓI’IkW:ö$ךjû®Uµ÷7>˽ÀxµýÛU»ôÜ9<¤ÓèÅŽô„_®^}ÐÐ! ß š²ó¡#±Wëzµë7îÑ»Ï;š×hÜã©™æ'¿T{»Í IÚÒŸÔ ùê—ÄüÆ0ùuÒMçæuÎ>pú¸;¨Þw;ž0ónýÀ&cöòTHhû|".Xî÷hÔ¶÷ m·|ïËA È“Ÿ¶n8áˆ#ñʪI•Â?~oøˆðÐÅWâ³~Yú×-¿çQ~BPĨÐ!;òFƒØ2sàupΗ»rôjÔ¸faŸp0ðë¢1•›Mz­äžr°nÍ.†¬º´ôãÆãWæÎe7õª\¹JÕãýV€·Gø_ $ÎûzÛéš…UF5®øêHCî€(¡˜°~ÏàZÔÏSG÷{Z¢ßé%i¶Ÿ¿ ²«Ÿ†-ñ£±dµÚT*€Šu¿nš±oxȤ¥|Q¬tÀ¥Ë7ÂËe…Ä…0ÇïOôø<Ô_Ê8ÿ^ÿÉ2Yãèþ[¢Ï99LC XÍIãßýtÕ÷‡T¾_8xU·ÚË5ìÛ¦èšYgãg†ö (Ȭ=MPP£Õ‘„Ž\ub¤ósíÒ°Q—ºuãíŒM´v¿¸_h¹?)Òëõ½ö»ú¶ a´Vòx£Z¸@­ˆ}û^Á¯VcIJ¶ €Ä¤XOU1¥Ò#Ó”žõñ¡Iª¢WOÂk´žy¹ªŸpárTùB=`ŒýhÂü™s¿•–„Ó/%í[zE囆—cÞü6Ú’$Éd2!„L.Ï°XÀò(&å8åŽ}©¨´kÿþ¬&½Îöâ¹Eø¨¤%¬sÛîá¡•ŽFD´?7€¦HiÍ‹A=µ6c@}ï,€`™÷×L|Þ»K³P•Zç©Ò éU:N™›/Ö”)$ÿ¤Ž_r´%¤cã"Ûf|\í‹>Ùâá7÷³®[6שYÊóXTTùa³}€™_Žhò^‡£ ›ûï½”¼4r_ …®œÚ0¼Û F½?›ÒÆÞ´Q×õûOñÌ«"¤g™+u i ó+V¶6&æ¾É€í‡ú(Úî³e)û7Ñyèü½T I©JŸjûw-Èc[ä=îÝÐQ]× o&{~åøÕ”ùgyùX»ùÚ¤uXãºwOºc+?¿š?à?îêÚ4(S±JFì­—âÍû»¨£¸Ð¸I³ªoº|ýÁØiäÂb„éÆý¿´©Ås/Õ‚!}×Éd}çüÐHs¯q«÷÷9æ©À»…Æ7z@ó½kwzV*IJP”U' é>¨ÅÀióíiíØQÝûõkr¤qS¯Ô˜c¿Æ~¹ó ­íY/"týæÁoVŸ¼Ô»QÇNý—î«Š¡õuF1T×ø´µ_xãÐvå Û¯ßIX°ë8€»û—½»&æô¦ï™n¼åWí—R™=Õ¼æ|XÙ\Õre·à£Í·¬ÿàÚŸ/Ó„víòþ¡"–;že‹ÁÎßXQ7ÿ0.¼[ëÞ¬”òô–WýqÝkû–ª—øê옆ž£W/ íÔ-ìÇ%=Óî?M¸|——Ì /y޿ĪØbHϽ.ÇþßlH³É´Z¥d3Œf ™ÖÃÓéNk†Ád§Ðhuj¥Ó#Üd4Xì’L¦ððÔÉ€ÔÈ›¬¨wzm'“É,d*OO­Ã"Κi0Yì*—F!r™œY2M™+…J£Ó¨èÌŸa–Ôž:%Z éf…—§š6s†Ñ !÷ðô€53ÃdÑyꌆL½ÞSÂÉ3 S¨ ØÍ©é&÷°ÿØLý Sýßèî¦ÿ†wœKýÇ6 ÿqÜpót.'ç¯ÝÐã&7¹á& ¶®Ä™ëä¨Ù½Zü+1ïMŒ¼‡tÂ5šKqX/0Í=`nrÓÿ]ú묊Í7P8©ä€˜…!UðäôqTž@žË+öŸ‡Ám2å&7ýߦ¿È6@T©ƒT`Ú.Ð& ý:ZŒrbͯǰjVÿˆ˜D'<‘qxV®ÄÆŸ‘œ_`Úë±t2ˆ»7pé–³ $Ü•«°7Ú±ë$<{†ƒ{8Ýä¦ÿjú‹|¯¨Õr8)>|ìtoB€ª²¤ž¸äp}ä›:¬V2BÉk’\\3ƒ¼¸’l É·<ˆ2Žè±¬îE¡a“0ÊÁr}IRŠ'ÀÒ³Ý.pnrÓ?à ÛUØ€¶—3ÓR%àÞQÌ=Š#që ¥ÂCþA03Úà®KNãÒ¯xq °¢³KŒ´¤«¨þ>jŲ9Úò%.¦ã»«8|×Ö"fžP¢n0Þ.á^<Ü䦀îF¦€TSmŽcuç|’÷-NÛoÁÏ ¬6xÖ†7ðøYVa;J¾ë&çnèâMø¨^ÅéÝøcJãÔ÷XºÉMÿ ݬ6tÀ¡YŽÛwXÓ§)®ÆÁag™žu¦ã†&™€B;HÀ+ pñ6jû”@ÅZÈ_D©€StjHŒ)­óq_óî&7ýïà dh]¸‡FC‘i‡dC¿·±þ0&,E`Søb $ 6#®eQD‰!5à§q}Œ@åšYµÉ±q2Žb°ô\ŽvÔ€9 Aâú6´ë‰g„ë×aß·UŽ›Üô_MÑ=ÅIv(ã¸fÅùWo˜óéÆA(„3ý~š3½é›ÙéúŠÎÄWªb’>ZLrU“=+f—*Ý$¥ÊÀ*óݪ87¹é¿™þj3¿L#,6Pª ÕdEy•. ÕA)-Fl„:d€°i‡ÃÐb€Ù­',ؼ=Ø%ÈðÔ9·oééiàé¶Íq“›þ{ÉÖÎMnrÓÿ1Ý›Üä&7¹áÆMnr“nþ)×Öò¿§™ÍaΕ®œÿöË9Þñÿìûþ¯Ô_§»ùd2²Œdäj´é‡foÀö‰ˆLÉÎæ€ãMøfb­9*Ñ໩8ú¶>Ï‘®­Yýòo7êü‹Ïf£F Íxó-ô¾>¸XÔ4„~ Ïì("ËgZ c±5r=úŽD"Žè 8½Ž@€‰“à-ÏÿJ*Gñ[°9 º˜<ž0ÅbÆ\ÄQ5CºäïIïHܵ/@€Ácð¦7 °¨<†Å •ÐçÌ?©3¾Þþ;psùVí†Âc&¢¨öw®Ñš÷n?Ç;#ШRŽôôg÷üàëÎ vÏDD }Ž ¢ÿŸ@Æ-|¹%MBUŸ×\õEØMx»Î?!]ųó˜·iuE÷†Î®‹Þ„-QP`Ì( @@OcÑ&dôú¥œ9nÀöãPÄØ©(œuÜqúglˆ„Æ'ÃÇÝŒÙßânêw@¯ðlÞ~ƒ±ð.Šqà+²9>¿«¢x|šÓVþdO„lÄ– èR&@årâá[ _}ú;ýtý(lÍ-9Ø­ø &V^ÕˆÙ?À ‘vcæCI _ˆÊŠÿȪðQ€‚ýàï<ð~w6IŽ)F€~ô÷§ŸóÑî’|KC€ ±`A,È‚X¦IΩL€~²Ò ²ÂÐ׶» *ÞJ'ÉBJ,XÈy‚pÚ¶?ý"å@¹ŽWîÐ’'Jƒ&5%@m€³‰-±¤ÄUýÐÛqÅ›q_ÔlY/ô)D€ðc‚ÄÇœUùëð¶¯å­g%ô.äÌ•J’Ë‚9Óòdöõõx÷AþœHäö1¨ó#@høÐþZž%‰ÑÎFçÈý4î*˜]|bÜzåÿwR%_sò¦ž}þÚœÏÏ`õI¼ý€—;KiA€g’ä×­ Pë ‰Ãç¤D^šO€ðpæ\yŠ$?kJ€º¬NŽ#)ñ‡þ9Æ÷¥DÚX^K€ÅðïHÒnfA`³–ÎâwÒH‰’D)–à[ƒr3º?þ|‘|H }}éëK,Rù÷{éÈrçÇâx ÿ‚,X>~ÜÔÎÉÃÖkΙ¼v¼3e_æä ü¯…›Y? , Â; nÙ1ùe ZgÁ_>U9àæeî©Ç¹ó¹xqößÂ¥´å…›bÎìIWX\K€g-Œý5GÁÅ‹9wƒ3ÛÍS\¶˜+Ö0>“$w, /¨Ôqé$’¸Àe‹¹h)/Æ’$/SïÅ^³Hòæ|{T6ܘÈë¹p1IrÃ|*Áb ¸xIJFn^ÃE‹¹ýPv°O=ÂIòénöìË£·IÒ–ÁM«¹h1wDæp¸}CËÆÍrÀÍó'Œ}ñ[p³íîÊÙó‹¸&«øîM\¼ˆ?þL;)I”HÃK®[É…‹¹ï´3Ï`?Š¬Éã!è7 ËÈËÌ]›¸p!w!Éôüz†Žç­¬\’>éø Êɉd «K’7°äG$é« àDêRJ¢G€¥BI2ùW|s<í™Й$o¯á»ýy)–‡?'À/¢H²£e¾$™rŽÛî"É+àwYAfë²XÙ,¸‘H2æ/æ¶Hžý n\èÉAüþªÓ¨-z/æºmÎá“Èô$>~Ä kv‘éo2²~îjO€j¶ŸéLiçMînŠeOåw 2¦eÁMªK¸V-ˆà,¸ñ}-ÜÜ7åL½K–þþÙ>…™™nŠd¯Þ'`ƒ1<3~þ9Êjë’ä¢þÜ„ ž|I¦  †4`‚ÄQo`h3Ve˜+šíåØtSŽàÞXÞÍ­;orº¼WÕrÖ©E€ÞõI2î Šã¡Ýܶ‹ æœT&Ãt~$ye%V fPq<|?GÓfààŸ³àFÆ&Þ¬Z͹vÅ[Ù6˜Ôb­æ´§Ó  s¸æ¤$QºD€«Î3:‚[wði*IÚžQʽVŸ‡9{rC/BÍsÀ'ˆ²¿ 779ªSŽž÷óå[ïS²°"0¬1¨kH;i¾E€ú¢lX“ÛN'ÍTJ­sæò&”4‘4ñ ¡fšX¼5“o3¨*~‹ußs‰™œÄRrz…’—°~’dª|(‘%¡£…$Ù2ˆcÎ`¸CI%@BL‹"À=Oyx·îdœ‰$?îDÀ¹HlM€·ÈÌø9In|‡·]!É«« ðÄ•léæñ^ÔgíJ +›n$‰4°(X"Ì ˜½+`xsú€òêt̯¯;à÷·²ß÷‹Ò„,{ÞÙž[×$ R"ù€[ŒüŸ›^½ÅkWyx9êkeI7rFœbTE²})œr,{3U®"Ë•c¹r|³ ®Í†›ýxõªóïQÂÞLÉÞ-Î`Õð×”´Ð¬8*{ †Ž$É’ Æ$íÏ(ÃÖ8Öüb«³hÆyç‡]£IÞšI€`"Y–Ó™\3Œ'$É3‹Y®šxåg΂E9g:§_iTàÉT’\ô1'Lt6§ßü*ëª-΂­>ÉÚà×Iòúg8~—ÖßL’÷ÎrôîyB’M@!§Mâ‹èú¦ x)·OpôxF’ A™†$¥”;î1us¸iĦýþ•Í”9™c?æâ $9ª2žMä‰Müh4/§‘dPS†4 ª nJû` 9».°óƒ&ø”$yh:FZI2r2E–aý;sAßYì?›¼“ 7u@Èœ"XÇ2¹¥›Åð¤÷+vÞG’¼A€/äÆ©|»6~ò;pµŠ#ž1â+BÅ}?ýÏÀ‹ƒ—?O§fënÔjÔÎGc×;‹¼¥!d¬ÈÊ•Y¹2+Wä{«³áÆõ/l)1ö)cc]þžQú éFbb$µ¥=#gÁXÆÆQ:ž»•7BH²DÜÄý˜;CødgÍæXöïËÀâ8õ8oN'ÀºóHòÁ\¹ŽƒÃ ðŒ•®¡é/E€ “äÝ™øñF磭3ر)5 æM’|ö++d7]lœ³iãuö—å àŠëÙ›©tÇgöœr0ð[R¢¬:ˆ$íŽn“]•PÐlç³¥8‰$ã6`§ ¤Ã[f甩i—XSÆ"½I2c+.ŠÌv[É¡»à„‰üÔ!Ý\ejBîž™LÉιCrtì‰ç´$²GÝìeIÒJ€*?g[¥ü0lUƒ¯Øsððôû%;å«qlR‡ƒú“äÙTÉ Ð§$}p#QºË:§¢ç¢N eç7TÊЯ4½A­7oÏ À·ç’äÃy8b-‡5'@ÇN¾!Àh;Í èóaÛÊqŸ›SQ$yŸßâ|5™‚6‰”ø˸‘ÈD,ß"kÎ|Ÿ{öZ›ÿ7˜/ÜÜ1ó ðÃ\›å;ñÂÚÿ¸)ž#•c3åWêH€“#]àÆçënnæît൛)GÓËF`5<úuž²o °ÇÂÜÔWp“ô3~™s‰¶ù,– ©¤DšPëÉÔ£øÝ5’d,¶Í-ðˆ‘i·2-™vÆ Àù1$ÉÇØi>Óãù8ÖYÿÞ¯ðÇ'ίýÕö³Ø8ÒÈØX¦I‰L&ÀR5²7SÉYª%Öù.ÜÌìF€s¯“d'¥nì p¼CTI$Àú#8½3.¹M’me”©iKΧÛßžCåœt›Uõ²{¾}Y<Ë> s—õoÏ«3 ðƒ$ùY <•ÌvA¸?Ž$ßvÀ YT¨uð$ ÓN¶­E€ç2)‘6‹³c]áæås>~æd¯_^°æرÔTËV$›W%44º&e ¾6SଫÙãÛfgõ!À“V’\Û‡3ŽŒL€'“H’/)›Í`á<èYš”)h—(‘‡ºån¶N"À‰§œbÚ¥¸$.ŸëÀÍÅ ömÈ"íX±‘Ñ«þÇt79)—îF¯"ÀéÙpc"Æì¿×én¤?¸™*D£F- @xmA’AQ"¥ç ©ËY›rH7L§Tµ¦U¢õÚðçsÌÏþóákþë€c OÏpÉìï^ÁDþôžK†7*ºùïº$Êy*$o-ÊN”×t-uªX¥¯³Ýkó\¶ Á´“¶ª]Ø.ß•$[guŽ"„• `‡üíy˜ÅùÇ?=ç.˱¸€€‚"r%x@„( F‰&*Jb4"Æ(â}âAQPD Äó‡FÄ#¨€‚ˆ€ È-"êrî5GOL5sì¢>Oô‰G}žþc¦æíêoWU¿oõe=³Õš”$Mê$‚ºè(?½X•Ê‘›·§evyËŸú©NiÛY¹µSRš?ÑÿZ¨…é_%Sþ³Áܹ›T§³ù¼wm~Uþgçoë3f¯Ì6F Éœÿ#c*j)U+˜UÔ{\S›'¶ÊäÐkdþ`j÷ü¬½ÐùHÒ¼q™”?ó;Ÿ(²ß²®ù‡Ï¹=cÙ¤·9稥~/=1“8ûsyžs3-0‘5w³7«·~Ë žYf̺EÓœ{`PÖ÷h3V{–@“×}µÜÈSjxŠô?–›oÎͯº Ï¡n÷Ÿ&ªqEaŒwVu…u‰WáÕȧ°nŒ¤GA!¯±~#áWWeü2‘ÁÀWx‘%$]pˆF @TW¡u A"Ž›ÂqˆÀxô¥p„pÈø†%ã$S8¢Qc Äcx"$5I5-qð\â „o xÄbÈ¡ ¹Ä“„¢DÄã¤að0t1–OßϼeµfÔMÔî.λ’¨"¯¥S©Æq˜0Š>¦ó¯y&88ÕÜq+›Ê(9’Û®&‚Ý«ùÛ$ö¸œðÎëç[æÖo­—6ÿ)f- Ú¥eG.ICùâaÄ=ŽdPGc?õr–î£y{n»âËÊjV)Ï@¿KùÝ1µ·¹w_äɹìKP¿)ÃFrTã¯Õ\7Làˆ‘œ?^±°ŒÑÒ3©|á0ªª˜þQ'«eÿ¸U\x)Ž˜4hÇaóLnšÃˆñ´\ÇUÿ0sÞ@¤>‡Òïhsí‡d3´ýû©ãß*«_R«ˆy»ßÓªO3±ß<¨UÕ’ti+Ñ '¨Gõè¡¿¼,I'‹ýþþa­iç2󌳤@EÝ$iïjõôclÈq…ò>7ÁÄ-Ò‹¨W˜¯B]ýœ$Ýø«œï9ŸKRÙ umbRVî¨åÒ..áL8Ü~ äøPU¥pú„8P´µR;õÿ ÷é˜äåéçåuL˜ïUs%éŒv5naó§_ryŽ›8¾áÉ_¦¾IKŪ’ö­¨NkSÂÝ»ª,&Ií£5©'Ð/¯‘¤Ê­ !ÐÀþ&çò„v¾lê«aX “®–¤Õ/ëP¿~µÅ‘k‡:54—V7b>L]fž × >Õß¡Ü„StèsÀ²J~ªÓºøîéÏÔæÝ ï)PãÃÔ½«±|ø=}™ÿ•ÏÆû>M›ç ÔþL?bû&®~U’VÿÍø—þ—Ä}ÿÉwš÷ fnÔÚ‡ªÛ@íÛë(ß—â<ßûüß+´|í÷tiôoHnR[U:^&d¶±“%é‚Fv›no›%7kê;Q’ß"ÐÈé’tZ=¶ÏÉÓ]%Я§HÒ×tãLÝ}žkqB’Îklœ÷î¬_ž­Çûåˤëú¨qËŒÜÜÛM 5qIºü"]7E*¨Ío%i×bZÿN’&·UÿóôHïŒÜxRùNmÞlbp¿Dni#ÐʸU’®ê*‚Zîšp–+½ð :‹°î§c’´õ}Ý?Q÷NÖ†=’gbµ½2=:U¥¥ú×{’´üe»GK¶É[òˆJ'jï^¢Ž@Ê¥rÓïFÿÚöÑw=Iúû}û˜ùå³5šrŸÆO41ôžgt|ÁlM˜ éO(%ÉÓ§‹t÷X­.Ó“5çÝï¿Ü¸o©Q#g¶Â#$©ºB’n>,§w³ÿ>ôÂH®Ÿ)I?C¢•¯jÆãZº.ßrÖEÝ1'ûî E"(OÚ÷…$=Û?Gn3˜êñ”Fuè_´4Wnrb¬šgοÜ4Eøog»óDÞH˜É¿ IúH ßÖºtL¯¯ˆúÞÈÓÖ­9Û–m™_kÊÍÊÿ(rÖ”Ë󤔮ù³.½)ç`ºŽï?,P´žÖWf”eþd=Xõ ÌͲfïæ®3LÎvÔrˆ”2•—$µkd‚t$}úŽ™˜˜¹)'è!On¾æÜÍa×kî6,hÖêËÍÇ[r j‹*ý%ojÊMb§Jhä³~ðêyfêªÕ±ªƒYüPRü gMñHs¶±lÝMuÐQ'ªìßv¡¦.–¤¹Ãú˵o*Ð’Ý’ô§Î­‘¶/¨í¯´p¾z6hÃ>É“’êÛ\ þ×å´Ú<¹Éš ¨ÝP?úô6é Þ¹é0QÓ ´ñEÞ©V‰/7[k”U,iŽZSnjJÒâ4ô×jÑX ÎgJÒ–Íù­Ô•Z4h»+yÚ<%#7ž'U)ˆ‚ã_m‡f¢@±Úb†#õ%×|®Ì XŸ=J §Êôìu"¤/ü¹›žOIRý h§Å×äÈMÛ3Z£Gë/g)„hfƧFnV Ô÷ “ÿ› 4d¡ÖÜŸV¿›ª w tùƒ?”¹›ä+5¢Ÿ¢µË'­K+HGÅü;†çª|ŸÊ+Íè·=" DJkþ.PáO”ð-˶kãfÎìMÞV»Ü4®†K±¥åÆ“¤~íZ›Ð®E9%ú¤F mŽÜx_[n®3×µ¯heºú%G˜\ò¶ß0;fË'¹å¦­¿ìÏå«@Çœ#IÉôØ>¢×Êj³Ü(PÏ äÅ´wÿÓ§  ŸLUŸÃ3‹¶Üýg^Šëþ_›@MI± ô›ç$©Kcn››_9r“[J-©"+}Ã#ùr£ u;Zt0¡Xú˜9µ¼mþz=Wnöך'%ʵm«Ê™ôâ ©ª– 7V«uC>NÈ“VËéÝH: s®¨C3Q¨˜_°]‡ä*kT¾Â•'UWh÷n%=©Ba4à*õ©ùO3SÅi¹yþ\þzrŽÜœ|u&Û ôúÎ,¹Ù PÏKŒÁ‚É _ªõ 4)w•ÕÇtíÿs¹ù†ünB¿DÊÝb Öá æ‹áTÓù\hÄŽ÷HTPYAuçcêÕ§e >]Å5$TIç  ˜í‹‰UPYAnÿ=m£t UUL½  ]CܱI '¸{<&0a¥·4èÄ´û¸¯/ÀkHVóþ&hÀ‘aºö€Û¶S¯‚ÊJ*«Üx&ÏDœX Ïaõ›LÂÚ}™ ¯HQQa¶ÊXV‰”pJ K_á'g%Fj”’øS/<—XŒx •$Ãó8§9)X¸žu©¨ ¢Ç%ìÐê4<ñ£þ<àÌCÀáít‹ú–I‚­‡ò}=Àù·óÂ(ŠpÙ¿¨¬dÜx0¢'·˜þ ^ŠÙ3!B¯ ð̇$’|ðO€cZpGVìdÌ\®ü¹9J ’qéúq×y½þ4Ó¦°+pÉP¨ ug¾¨¤¼œ-Ë9ñ5ü½ÚÐ¥ˆw—sÎ9Y‰ÕRV'N*I,fÞÔš.+×Ãqxn:>ŒñwiÑŠ½ÙYAU{Vñ^ŒÐPXK†­ 8µàõåî~îk´uª©ZÓ –¾NÜ=œÐ•ËîÁ 2ü€>%%Nê@Æ|â@]®éÏOð‚ËoïËÏrÀC^Iór½$±*ªª¨ÜÃUÏ”Ds ­c˜·fHüý6rËq4í pÃ’.•ïÓçd|„ó#y>0š?Yvc~J¿Ë%iÖMY·QmNêß×ç[¾IúTõ²Ršô‘¤Ûä[>ÿIVÏËŸ»‘'/•5>s¥ö<›¿oú¹ÉåÍòÓß,Ó=g 4iß»É5ÈêÝH“Ψôƒ¬ÞÍxéêü¬N¦–[ñçÒø33_»_(I‰Ïj±Ü)œùš^¥PUj}™ƒÌD߶™ÄK‘$o¯š™­¹’R‹úùGù ¶ú-Oêôf-ßåOåœ*œœ%»^‘™*î0Q’®ícnì™ÞÍø¿3ò8r©$µÏꆌ˜oóÊ6pøJÕ÷Oï¿è‚û¿¬wó‡N~ãÙ¬ Ïg-ZVW§’TH&}¼¿äó¶çͲêÙÂ{申Xö.ºL¸ÇaáDæ×eý,ZzÿÚ‹‚-Lz“>WЖŒeñ¯Ì¯‚åq[I˃oêÉ”Cé9Ž§÷x€ÃKsà.†4Ã{81…;Gœ{aŽ7Bª $ª|­7ÛY,–“ÜÀ=+!JU¥ÑÉåâûùç.FObGz@äqÉhʽ£Ía_\0¨mN>Ÿ½@<[ÎG)¨Gƒ¨­$‹å‡Á74U¬ü”S¦ñÒf¬´ï ŠNäø¡,zÔ·q „ýá´ °©-Zk¾î^N£ch1˜mÏ8ælb@+[I‹•›l¹ñð„ÈûÈ„ä÷¿iD~À·Ÿ’JÕfààøï÷p™w9[,+7‹Åòu°oÑ´X,Vn,‹•‹Åb±rc±X¬ÜX,+7¶,‹•‹ÅbåÆb±X¬ÜX,+7‹ÅÊÅb±X¹±X,Vn,‹ÅÊÅb±rc±X¬ÜX,‹•‹ÅbåÆb±X¬ÜX,+7‹ÅÊÅb±X¹±X,Vn,‹ÅÊÅb±rc±X¬ÜX,‹•‹ÅbåÆb±X¬ÜX,+7‹ÅÊÅb±X¹±X,Vn,‹ÅÊÅbù.òÿf× l‚"ÞIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/uri.png0000644000000000000000000005516613051004444020253 00000000000000‰PNG  IHDRzù'ùÅsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ rÅT IDATxÚìwxEÆßÙ½%½PB ½Cè= „ÐBh¡WéˆÒD@ê‡éMAP¤*ˆ(EŠ (½—„„@è!„HÏí;çûãÞ@@ :?òðÜ»wËìÌÎ;gÎÌÎaD@ xýH" @ äF „Ü!7@È@ ¹Bn@È@ r#„Ü@ äF „Ü‚·YnÄ"àÕQ½ÌN»÷ì7ca‰òÕE~ Þ(ˆ(áÚÑK—.Š¬ø÷ÈMbÂcŸvýuè/òKðfÉ ÇÄV…D>ü«äW®ˆì¼YpE<”oÂU,„Ü!7@ðP‰,¼Õ”+[vÖ¬Yœó'[ÜÜÜF-rFX7A#«²4™D”””$²EÈ@ r#Bn@ r#„Ü!7@ äF ¹!7@È@ ø#^Ñ|nîØCbO¿r ,&Ûg"’4L­†IëJÎZG(z(üé²–©duP;f˜ÍÄËr"HL¥$?9?žîDDj{&F½íX"RÙ1Y~²3sæƒ!7oDô먦·“ÓÔ² ÅâX¯ÞÀåKºAR³°yõ‡+*खxüŽ¡U-¶´­IÄHÖÒ±ÿÕößmh—=ñ.«ýjpÊr~•Úþóç!G÷=z”ʸâRºAåÀѵ×TÌ°Š‡¬ÅŽ‘ÕX¼ûå×’ `Œ[ôÎ…+×Ô²Š¸ÉÌí {ùWï8¾l©|!9!7omîØÙ—n·¤}«šÆp{Ǹƒ3;üâ7W (!äìM˜¾ÚµcMMG/ü~Ñ„Ä€ƒîj"°¸ßf_K­Õofw•#ž$6˜Š]\Ñ3$ÒÝÌž²åÝ<<¾þÀº~IºµÍšÕå¦+‹â\úzI[ÎœOó©êh5ad¶ßØCÞ±pÀlººãÓ#3[&¨T6?„à„ïæí…› &=Ìuð ˜íèš’“ /m·/ܨ\Ié{¦¤™Àˆì˵kVO»ëóåLFÔ±m?Ôî7_mÌ5fŽ·õâÙ‡M&~S¬¨›I“ùjõoקïõŸ¥©@D`8µíPŦ­ÊzwˆÚ»P’2NFŠÉ¤‡Y³ES®ÝŒÆ-|N}¿\Ò­¹ùWt¬È@œ«ÔjYe¸ºc[ñ®ãáØÄÙ=%òöÆ™Q²ÇZMÜÖð¨ÔóËÆRƒÉõª»>Ç¥òðà^^®WéxâÐa î>} /‡Þ$Æ£ûÆ”­^£h½ÖiwN%Pζ •oÈo1Š‚¹y›a*J µ–ÁjA·TU@aOG]È–Û*ï†UÔŒI~Þ%Nïú©Á1Gçqƒ/.ê|ÕÒ¬g/‹åyá“R,v…ÝϪkRWg®I¿ã#]© »îõTJüãÇ°\Nǘs -RÓu¢¸Âwó6ËqôŽÖí– `j'ÏúÃÞù°‹ZÂ¥S¿8;Úÿ~'’)bŽøþÅ]´ÅûçÓltì:#Ÿœž×»quV#“)«à3JIKcE ºAÑÿ~<&…ˆ3ßÏ'HFM…´³Ó©Ë6ö¬¹DD)w ÌÅÙQ”—@ÈÍÛìº)Úqa»€ÚÖámnWHe¹qú~é^“œ˜µ÷Rº°gøÓ”líωq™A­yQÆ û·À”oî'(bÿdºÐŸãd¯æ$Sô~½Á¹RŪ28É£`lØê –ŠÔÙÏ$±›¿þª*ßÈC nE&róözm,&‹ eŒ=ØùezéNÞ­:r“M8Ê8†oغ£I¿dÊõ4’J£Òdœ‡ ˜ÁŠ÷­ZcóÑEGþ¯@A©‘—|»ºLÛOÝ@!ëçi}—WkZ×æ–à»íà7Û*Lì ’J¥8!æüú‡ÏÔý 7“™¹ykµFQˆ(‹—Dƹ §«4_C¦ŒºÍàè;ºðú:/ͪçåL9Rø¿ùÎÖqb²c×¹{íˆùŒûËï™ÖDo–U\'9{o2§EçææøÐSwTíGÖÙ®BṲ̂IC’Óz§„³«×…lWÒ“=JÔ½³ºW…„ØÞhX¶Š‘#ë7lŒ_vbÕbpŽg¢D)Œ(Ir¬SÝ?VÞrMÞmªóF ä&ïx ·|è7^5‘L›‹G±(Q&ÍDtŠx"øpn„ÃÅ NÎhÛÅKÁÁ I ˨ã IÂØid4:|5^eÄÛn(\<!7yMüZªÖ|º½BT¨bÛ^´Š³mÏ_M[Ù>ÛÛ£qó§‡4n†;·¤—X!L üãüí#SEP£N^ÞÀ쉩b‘0@ÈM”(…>BžÚ#ÂÝ!ˆÎTN\<‹µ+°bƒ¬ÅÝC«ÃN3˜»•¼‚Æ•(ê`]ß7îÂ×'ý=‹$)ÆBAßVN™úDZGÈX—ӺʲÅQÓ95»Ûã¥=Ëúu8¹/¢û'ÓÙ }: I§ÇýØap öçe"—oÛ*wô¾dɲ2SÉ0_´°§„˜C#.D÷ìï“)Eé‡g Ê7hmâ¶ØQL2_˜ß+µÅWþuòŸXÑ'î1ÏÈk6p÷¢Åß’dɶˆ²ÈuÆo,FÇYò%·®_J¤-Pµnß©m !3}ÄOK–v˜ü…ÄIeÏÎ|94ÑÑ/ gž5+ˆˆIìÞÁ…ÁgÎÉn•½ûMÏïb¾0¿¯ÇÐ Å\4Ùîé榑é^Ô¬UIôrÿ¨Üp…,ŠÄ£vOè‘âè['à];5ÓEŸûmªO¡¶ËÚtõ‡Eÿ(]/û÷|žÆÄ&ûböŽæAuó§RÒ…MïR‹î}¹Â•[øÆàLµ‹‰¾®¯;¤Q-¥,,/•(Eò8í/Þ‘éQR¼*›‰E`ɇg»S-h@çV9KÚƒ”¤ôlÙ”s×Þ”YFI7Ý €£b‹%Œ “èƆUÒ°¦À5Ž®¦ÔH <þèêYÕú,qwbDr~- KO~íýþ{Y)i‘‡woÒ|Ö¾RùH¹}Þ`É/,1‡wΟlq-!N|6t“èúW]Î&ÖmÚu‚ûûÎñm–ï/SSuèÈâA35 DÄJÕ,øý‘suêW²ˆ¸W‚Rn x°ºuÏ}Ö=ɽo¯ Ù…ˆÀjøU¨[ëäþóz£Ÿ½$µk1/Ÿg*jÍb@}?ÅðâU½ ðy‡4’3w¬La+-ÕÞua)7S’Á@ÜþÇåšt‹=÷sB’ѵtÃ2•*(œd5‹:»óQ|²k¹f®ÒS[C|7ì²…ì=ªµ.\Ø™€¸ÉJÉ 5kp0Ùt#øÀÙ²­ßq³TFžqü Er.Ö ³›Œ7~½p.Ì Cè1m…Òìz|ÒùïÞ¾z]•¯R%_]Ä‘[w´ù«–¯W÷O÷f9ò—k€É¡ñ²ÿ ÌBcŒA!–¿Y£>cíT Ã$I…§2ru÷Ȫ,VxøŽ?ª6­EÏžÞõ3Ô`d¹ôËÊ?æô‹5æÏ—ZÒóìm3c,ìË C?í€ÖáÁÁ§ÂôÖã“Ï.þ~öG‰:t·Ïh|í^"#,ì~òë ±FÆ€Ó ‡ÜG笽•úñoK'¥›ñ8䇟Çu4)$9ô’lïàêaŽÝya÷ŠSÇBó/vûÇQÛ—,:ü{D~OÏðÞ?süŠ”{½c*œ‘²J“'”1Fù‹9›Çƒ,éoPÝ¿óì·´lqG%§yôI×Tw{ Ä™‘¯|€.f¿ìXMƒS©©F`¦Ès;V™;:==Õ‚’…KÅܾ¦ƒ)ú§ »Wý¾÷¸[‰*Éaßîœ3Q–D/KX7gOñ…Ó¤BÌÕNb`PL©&ƒÍ¿¢vpS©d€™_Ú<¾õÓ]]¦ëg_hrêñ nÚͳŸXÄuañæVE óäÌÎV Çâ:å “Ì¼ïm9³ïºx‡^½ï7~kÉ¢v¬E— SêÅ;ARãÄöuµ‡®U-?1T®`X¿tqÙ%3U~­{7þmÎ'ÝÞ-}-¶bIÞK Å…6˜uÐMš´¸ûqï4ƒ9ŸgÍœMÍ25êé.~K±ü¦ÏÑJà©£ÇÂzÌøÆÂQ¿Æ¦#w®6nZ-7RøÂæOÕˆ®õx%¡±9Õ¹ññ¹“ Åzø0%æ·ûNuÀÍ Ës¼[°èc+Àlai`gçd6%3•C…üŽ÷£æ¯Xœ1 úÄ£OTv¥ÊÕ¿vñ@­J“).²åÔoU„b†„ÎXc “Œ„Üü=0­0qëSÌððÄg‡~>Ê0^ÄöÊŠ¤ÉW£ç´%™¼•ŒåXˆ¨GO‡Í33ÔŠ.̬TwvQ!9‹(y¸8‚ÊÑÑi0ß4´Nùí G±¥Bà )7S“åèÓ_¤^´†OPéÂÒõpQ£P£‰åzoY`8ã ÙÃ÷F®v`f‚¬HáYÃYQ!o5qÈj{µ¶8ç`Fâ)æ\mB¥Q{”q²Åì•Ì'>n”ü—XaÇx¿'ÂEÛ¾Ó°4œ?ëQ¦^ÊÃ’Ý;e-¿ªëmý=¸–Wq¤v/žàĈ•ômphÕY¦î›¨HÒhÁÍŠ0m„ÜüMhí${5=JÓ;Û9G±¦s4»'6ÉÚËÒ ûŒIý»'Aý¤O;»Ü¾ÙD Ã3qßX– ÃÄ2*Q†©BÜÌʼWØÁfmÕhG5ˆ‘1M§¶˜)ÝLÀ3¡¸mA-r•Ïü^nôžIL’™í£ò*þܬm5m›“J ©íìœ]Tìþµß=Z|ÌéA8 P;xrŠ!²½ «×%j´ùAÐz¿•biç€I²Íš$¹d‡B¾x ‡#[A ðÝüÍÔ¬Å6íð©¤9ºdºYbŒ1""‚¬2…ÓŸ6²YfÆË{oÔñ/÷âi=êRjmº.Å̈˜D÷ÏÜÀårÎn&ƒNëRÀÓ¹@1·Bîj—Â2#ÈìÁÁ©Ý»õ™<úègƒtfFD`PY_}iƒàŸ„˜½[~GwGw{'F˜ Ñ÷¯9WªáD¹i SA¥öù+sCJŠb5Rwe—S©Îœˆ¤ânbÞÍ6®Çűd=·Ð£q¢Ž þ9ë&,Œ¶|[~Æ·óºlþøª~­4ú„Û7m°óPªTQ"L1Ä];úc¦ºÌÕ®•ËÖÈÁÍÁ;t×n˜am‚yZä]îâã¬y¡'’XþâÅ=Nmš]¯y³´[‡#‹€7³Z-‚~;LÛý}UúÍ]3“+|Ú±w3˃ƒ~ºÞ~ŵ„š¥¿=ðÃ/û·K½¾÷àŽƒ>Zœ›= V9%Fž¸\ à›9 C0oN¯˜_†…ƒˆœß£3#îa¬)Í|ýäN’ÜËÖ÷{¸}Ê…´úwW¤RÍ›WØ9k´wësÔoç¯î²ÄÇ*ëK•º{ãRo9Ëé­Üæê‰ R#QËÿ”ܤ¥°˜h“ÿÔ_½.ì ?{2ɨØ(ç7íœgQG‹…ع—)\2þþÕS™UÅ>Ÿê‰Üh –÷,íÏ:µëj·aºÍ¶I‹/Y­§ZbÄ»b%*ë L.ZÉ[«‘­uÌ®`­"æB5ž¼'dë܈c; ÖíצVñcçÜ@ðlûiçÒ»/þÑDÚ¢m¾jV¿:1Ü8u Z¯yù$"°Ú£×%/™|?¦»ÚÁ)_p(_¼¢Ä¸ÍGR´JJ‘Wçñ7®¸\ØÇ«X9O«jÝK)c²Š¡¦põ¢.E9‡Gí¢ÈŸ­\<¼|\2•Iî|4®šL\àZÞלßþ“Ê®ˆ—¯6Ó¡L.èéU_Ų[^1Q¬vcÅ渡è+ÇRŒf¦*TÀ w/arÁ2õýd‡üŽÌ âT¼óê6žÃ.þ¦r¯Ò}Áb"ÆeÚt»u,‰´ŠW©#=Z$äójâú«”¯ºgYOÛ5TùŠ{Õ–„ïæ¿ £—xŸ`ý†‡nšu”¼|ë¿Ââ5yv}‚Zîí߬2¾Ý%¡¨Ð£S•-»®¾í7òwÂeÃئ­[µä«clúôé"s„ï¨Q‹Vçå µZá„ÜäÄpÌ™š—.ˆbÒ˜@ ä&'R’y'ïĆøš/ܘx3G x øÛ]ŘͶåŠÍ€‰`Ï Ðg,Qlý¬ePYçÏ2 Íú€àLê78‘Ô¢ !7ÏÐÐu@û@˜ŒhÞ“& kg$%¢h1¬Úˆ±#ŠÂE°þ;LŸ†3'À€-ûpþæ}vâÔ1,ý Ì\€Š^ˆ‹QtEÏŸ‘Mo÷bÅ\¥Vt≹É;@QЦ#âѸ9 @‡î¸sUkÍQ° ÊT„ h{;¸€Fƒeà× Ž.P©áU-Ú@©rP©Y`PLZT¥ŸWÿ ãçMU‚x[Zð/åoòÐ$áo"Š¦@ r#„Ü@ äF ¹Y „Ü!7@ äF ¹ÿu^ö)&ILH“àk-e‘ ÿ6¹Qk4Ç~Zrëò±§Å̘Z%äç¯À˜D$¢ºåDÄ-/óÞŸàxø_²¨3Çu Ý·oŸˆô,øçL• ¶8b6ý¯h¾õ)ww÷Ì_U*•$ G ¼|çW „Ü!7@ðwÉ,‹HÁ›cL­Kå¿©¥ó—FíQð&¢ÑhĘé¿MnàïèL @ äF ¹!7@È@ ¹Bn@ r#„Ü@ äF ¹!7@È@ ¹Bn@ r#„Ü@ äF ¹!7@È@ ¹ @ PÆGÛwÛG!7 ¯` F(àÄÉ r#òغ‘IKIœ¥0Ýï ¬¼61»<9¹Jä¯@ °i F`æi»/ÆïKÕF¥Ø;f@-äF ä)IôpcôÂ8S´Ùj^4_Z*“(ºSBn‚ÿž2i$‰Y{Pp¦È¯›Îoº·‚ìÓ öŠC*¼Üë4*ÜMâ*ä…Þ0"Ù/ü‡Ä`PˆËœ,’¬âÚ,…XŽµÀ^«†¤ª„ŠMŠö.)W±¼p«þµù™YÉYVa&žŸ{™öM'c¯r`ÖØ3'´%ð/_ëúùÌ–Hb說db€¦œp#bry\Mr¸|vcÔ­FVšÈZí¦"gLÊ­Á›02Å…òô(KÚ;~Þ®°´ó›{Lÿ1€Ž EÝiˆÞ V셹Ǡ‹cxþóùòX0ÿê¿ÅòrOÃÒJ¨²”±ó*Ö:wǯrý]‰,ÇZÍ®|Z¡ÉdK¶ŸD\Q¸U‹’çF,cìî½ëöùQhÍÛ׃ý»vsô*ëWJcñ룖ie.]'”XX¨§Ú¢b¶¦:ÏøÇå†OmÕüöŸ>J×2 2wñ^º.ª{{¯ƒÇ.<£…ÕÙŽÿíÃæ(ÔwNþ‰6à¯×E ŸÙj“ÓKŸA†Ì€ò>5Ê®Ø;]kÚ©r­÷²”½‰áÖÎE&oåaSÿ1ú¼îý(Önéî%mDý}ûÌ‚“Öî‘é–õQ™æEO–¸Q§h?(;%•$¦È\a&"ùÍ‘"BçMûÞˆ±ß{ò$žÝ½vÌûÃFŒ™ø˹(ë®Ëg~ðûõä½_Í|wè{³–oµjæW÷;•Îg ¾æº À¥ýÇŽxoÔGÓŽÝH±žœßÜ:pÚ愉#‡1á÷»ËÇ÷¿¨·LúÞ·7àѤ_ŒÎb5$›cg®9"YîLí5ËÖö^ŒBoÄœFÿ pp$FìÇ© ð­‡V½“¡ú綣ec´î‹dmæ¶g·  `G¤œAå&ÐgT»÷»aáÎò6ýZ5B³vÓ@Ûê0šÑÀÁüñ†íÄ‘¯P¿.úŒ€Ÿ?‡w š™õ$®q¬Xµñaœ3@‰“F ‰1?{-Cbø”1ÃG}8éÄ@ì¾/&¬=úãð÷Þ>|<Ç‘‡èqôÛæl:¶iþ{ÆNþ|]ª­s*ZÅøñØ®>´ÉTèöÉãV†˜;õý³wæOºhOüã³kf}}Àí½ß Ÿ½VTä·ÈÙÀÒœM*Z~‚YIÓÌãJÌ-*—eŒ 1&15òÔr}E¹aLwÉ¿ù`ûj-ûtiylÑ€Ñk.cßOí=ñ‡kû y'¨Áºí>û-À­[á &OJ¯ÜaÊøÒ,¼î*€ ^AºÇÈ1­‹©~þ¤ÿØMWÚ÷y·[ËÊsz6Ý|ÝÄ$wéÈ手þè?fòà•&uly7 ]zµÑë4½GmUT˜Äd)k¦ÌøvÛ’>Þÿ޴j,Ï ¥*i¡ÅÑS`¸†Mc±-k6 ‘Œb¥A„„¨ßFctGy=m ¾ƒ†£0d2ÆõG÷ªXq. ÐÛõúƒ1„.ÆÊsx¯²Õ[ŽöñÁ$4/ŒªŽH$ŒØcé(#ÃÍâ7`ý7¸û*´ÆUO|½cȪLg1-^û¹†L½çmt²™MÙo€®Oý쇖Ýú5©¤ý°C@¼žçkÐŧ¢“G)Ÿ‘#G íPÎl)2lì¸2öHŽ‹Ø¿vÊU7ß >ò|¸³ãð/sï )Á—/¦è›‚ß ¾™ âzØÜ ó ûuk^ÕÅõ|x¼-U’˜2ú6Y7̨•@ø#eG¬ö þ^éÿ‘Êã «¿±†ˆÆôo:ùëÃDœˆíR³ãW ¥Ÿ÷öjy‹H1Å5ó­úØvÞû‡¦4j󩙈"–W®ÚþçÄ-†€¦Þ¿G$RÚÉ^w‰ˆsÎ3’òœd®l@wÝØL(MD´'€PÍvXüY‚9õ(IÍdl¼@E¥å}Ÿh;Õ½¹„šDD”Hù@{n“ t$2ûõ/Dp!"âœ,zÒ‚.ÆQò^‚«m‡ƒA„Ú¶Ï{'“CQRˆˆèÓnä;€ˆhiªº4kf?¹×¬»òiÕjíîZ3ÃШ‘ïŘt"ú~N¿Á“·‘áÚŠz G¦Ñ®yíÚöœnË8ãqïò/s)ZKz«¦ OÝJµ~=¾¸m‹±Ç‰hPwÿÉ›Y“p÷‡wêõÛžSo4œhý•Eco·»¥¿0òvÛoõÜ|w>)¤p3)/¨L¯Â+ŽL).™jŽ-fUÌü¥½GtgÓÓí Ї>3p€[<ò³úDÔvL1d6HwCáêy³“À¬ÌSMf*€»•) 0“³pžÅ]ù_ üïv×;9¿¿í0• pp D¥mí gìz ÀÜ6X€¥¡HÜÜzEË åøÏéÒumN_0H€¢dÿݽ¾íƒÚrÛ hd˜y®¾Ù\nÖ’¿FQëïŒ1ÀÂswï‘bW¢‘í\šòžŽÂãP«ØŸò¶™Ëxxæ˜ßÂgüöt§¨jéZaqGŽ_éÀÜ Â£·ç8 3© "†×UŽ¯:®U#ÁÂm.ë€3SIŒ+ëè3qK¦G“žùð¤W's³ê³/¿òTg÷¡¿šgœAŸˆxŽ Ež9å0¤pÛ/¤dÉ¢='áùL÷7t/d;\ þnžL‚Â+Üퟸ6W2FÏÍ…©^®Ä3I˜è7½íbÃ+ëX•3þ˜RI±Œ-;—@*Ò¾\¬³ IDATÑk=zÅs«‚|Ïl; €{pñ§ö=†’}%gKäýkÕy¼ v>Ò *ŠäPÅÞÁx÷AºÕuiLŠNS^\‰è©£3×zµNÝá.½¸FֶǾ«¶$=ÉØZ¥ !®™X܈âÏ"`!§£j0¦þ°LZJ¯eÀ+“S—^ê¡"¿Ov³ú7ö~ß«}{jâC¿ûñâÌŸŽäúv—ƒ‡ÅΞ²À·U¿yƒ|†ìÕ¹['wãýŸÚÓvþ/#Ìù(Ç"ñpö´…¾øZõ²bo‰\.²`fz©ê¹æØ×Gû[( lüãé/«?G˸9ž&,_‚aÛ1·3Ú6ÀÈ}p•¹4ZÇ¡±+Ê8`Ä5Œ-—ó\JIè:ýþ‡¿â—gô¨§>,ßU¿¸æ…»»;¼~lç«’‡t+¯±ü°`îçí|̲̈ÜsĬŽ>žû6ãÕkL.i%&i‚ KŸÎYLCZ^Ú½ånùòdTr»Öµ­óÇÃ/+Æ‹ºü– LA™K\R”~eÇÑS¯ðëëJò'Ÿ|òJŽfæÜç g˜™c¡.ÃÆw¯W„®غ^Ù”ÄD{rïMœU§ˆ€£“K…ÊÕ »Û`jÇ|ž•ªV(ÌàÚ´iU5“ËTöªçÔºAY}ZšÖͳ÷ˆ)í« "&Û»y”®Q¥¤€ÁÙÅ­š——«}&~•Õ’\¶JÕbn*Y¶¯èUÍÕ.G Ê‚H; j Õ‡¢A‘rhX”®:¥¬ >ò‡w=h<Ñ¿=# zaãZ*€õ¡•P¦µGJ<Ôî·ƒýsܳº‚Ìõ+!A¯Ò°s@ÃFð´‡ÊÅ«¢Ae[æÏï†p,ŠVÕ!©ÑÀEó£T-Ô)móÝ”ª„ºUÀ{'Tª ¯²°sCÅú¨V8ÛýÜùeCÁfýJ¹eš !Û»*[½rqÌÅ5_µª^N©\ͺ…UZ7O¯Z-½JºËZ·*5ª<<»é†Ë°}JD%j6ïýÑÀ–RÎs‚1V¿KÏêÔ蘤šmö¬_ª@‘2•J¹:9»Tª\µ «€¤qò(QÙ«l>YËŽ îÔBTæ·Â¸á 2¤ßãw¶*п´¦$9ÞRxÑ¥…üV¡ôoÕ÷Ó=ßyªþâ³±{^› )“·Ínô¤û“«÷ϼ›@Q{.‹Y7o(¡·ÄÀ!Fl{ÌÊN…‡$ Ó 0BnÞ¢g$ã•©Wx=jל€u)Ó~šÓøÉ–s;æl;™˜}?m¾ÏfMT½tÂrzÃKðÆëÍ¢!›çQX7‚¼Õ+–Uòʺ„Ü‚71B ¹Bn@È@ r#Þ ÈöGOÞ:¡Œ­ôšGŽ„Üÿ-AáW`‚uñâd} WÖ@ ÈCë†3›%Ù Ud².À é ²Â¹„×ø†¦ˆ3%üQ˜š30ÆU°¾È­Jf$3}sÃ…u#üÇ:S`3ߺªÈ$‘UÈ¢HÌbP›ˆ¿Î‰äBn‚ÿXgŠAŽºS¥–éÔQÊxgJs;±MG®K–”ר7Bn‚ÿšuƒäå_Ô­[ #1"ó’‘>®B… Á±z±r„à9)îîd,TRQ‘vÃ×’^§^¸Ze‘ºVU-×ê+΋5YB!ñgâ qÎsŒ@Ä9'2®çS”"ÎsŽwÃ9'2ö­Û"öénÙÓ1±[—Cÿ´pØšƒ!Dôøäòº5¯ÙsÑö³>öˉ½ÊÕëk&"ºzhiÓvƒŸs‡÷v-mØëÃ'_•˜=#æü@‰ƒ:NÏ5ÄRÄŠ ¾£LÏ$»_Ý汶 ‘Mê ±ä +çpMO.aÍãçFÖ‚,O’…+—~iÒ€Ô¾ÒUvij;ã¡C2Ú⽤W”*€]üee _ƒ:uëš²2QaŒˆÒîÏÝËÛÛÇÇÇïÃ[ `Œ±Áí½–n=6yHÏÍý›t~ÿvŠ™16µ“÷U¥‡_“™—ŒLÿpñ¸~¾¾¾>>þ3Ö £‹Ÿz¶˜~yÿŠ.íü6üß·Çcã‚|ojõ]ûÍ U»ï[Ásß SfMö(YàÚÍÈ|]ÃŽ]׿ÕoÆÚwÛÔ²MÙÖ>ç» '7x¨2äžøszU:£ü©…q𴳘›wk ÐŽ¾U‡oyÖÌajuèßú{תZkÚÚcŒ±ñA¾7´†.ýf_ˆmåßâ¾êWßg";ôYãÆ£Î;00 ™oˇ¯%°œ¦Z1Æ¢¿ëQ²ÝZÆÀèQpY/ï…LÇÇ•ê°|ûüAÕ›÷c”P£zõ+qzÆص-Ÿ–mÚW¬%xöQ2÷Qï]d•›ÖiɬV¤F T5­‹_Q® ×V6¨Ûñ™ˆè‡©mZõ_͉†¶n:|Õ«)ðy§zÓNј-}ºO±u`´ãñ‡ˆˆL—½½ZÞ#"²|вɰ¯Ž‘nb@í›îE,¯U½úç{£ˆˆ”Øæ¾u/GÈp¶Wà[Ò÷þ¼=:EÉÍÐ0§E5iÔ0,FŸ[SõÐ2ÿ6ý“2‘œ’Yâ÷-hØcTVË#ãΣÎøåìì'XQ«f¿>MD¤oêSçb”ž çxFYwˆ^_»Î=\Ù¥Q㦱 Qô¾ùUš5ä’Û· ¬Öc“-!®ÔòH°pº2»NmŸ•¿Ý#"®oÔÈ7,NOD)÷Búõ„hËϘÀœÌfQrÛ.fY2¨T:ÌkÖsE±p…,¯ñÒ¯8«˜ÿ0ëû’#VU€®3vwâÄ,wn?N˜ß¥1ˆÀ¤³Gî¶8ÞঠN­‡ÕëP9mñUÍd³€àú[WSR¿êe]C×~ÔÜ=?škîý¥Ðiê kíI«¬Õħêàb`¶ÙW­;vž®µš­=WL Äá U[£y]?¼xÌ‚ƒ ™Îø¦[ýŒÉ·Ú´nýä“\ôÀ±óåÜ0°Œþ/F žõ[zæ´Ò¦^ª2ap"@]Fc§}”¦ƒ›ífÀ¬dì0nW¨} DT$°{©;í‹GÇ‚¢±Òór=š—ÈjŸ‘s ¯N%Ä ‚g}7Ì I†)]¶Ø“JCfC¡¢ÔÕ‰C‘¤×¸fñ«í ¡EœlõO’T ‹5˜]™5h¯ÖÉ“cVâvvN6µ$YBÓ’)–«ìú¶lhûÊ39™¨²s±´7Û Ë‹ƒöBÖäcK3˜á&¬Tý¾«Vua`3GôKÓ™­ûعU<üË7ÙÇ­^¢–²’¡ÄöîNÖd[CøÐó,L©Pef;‰KG]TPðϨ¾[1ÛµžIšÐA#D’Ä.‡h÷íe‹ F;­ÉNц@o°ÜH¥ÜèÄc}–ú)»iät½ Ì`°˜9¿82¬*Læí'ÏzªrÙýëwhŸ¿“¿<|ûËÞUÐ:(éH`Ì^-eŽ&œÝ ø;k)%GgXgéI:M~Çfr…ãŸI®à-Ææ£4(Ú´w$®HŠD’ö^$“ &8Ø!Ï¢O笯v¸ÜuPý««¿LÀØ™ãë¶AÚ .vNÝ°&úК՚ƒYîU[,€ìX± ½jÛ¡Ö­a{–-ØN¹Þ7ƒbÉðh™o߈H3å.L’ݪÅ}/Ì°jÏùŒßtê—¯Cî?vwu´Õ]&=k¼ÔÔ¢´‡wo=L~i;Ĭ<±:,ÙvyÙùc ùôî[ÎUr ¤ëR¬ü0Ä€áöŃõóŠÏ”ò(âÎQÁ™[oëSnγ³užž=§Ÿ(÷y7Ï™´’}bOîÓR2Æ ž7…¥ ž÷KΙò¼d?ý|beÇ€‘^8ïæ¹i°”íü|Ö !b Fð 7(\¯{¬S1³ZsËìð|ö§l¿<¿¿™ƒÇÔzþÜcPÏó¹2ÐÝoG4mR3çLy^²Y¶)³“:÷» Ü €±ÌyÀK=¿þºgѤ ž˜ÇŠ PY$Yf&³ÙþÝÜbQõzDe)ªKW‰3¯ñµ)±¼Ö+Ú†¬ÔÀõ¥^-^­Å”ž®·dVŠ“«»Œ_“ýZ*§}‡÷¹ÊÒK¦Ì¹î€uE ]AO-1ÀÞ1¶aS2›Š•¨`&®Q¹¸¯_“³’þ¹K¿J¢sþúÊ÷B¹_BLyý·ËMÒÃû¦?TBt”9ק‰Eo¾à—ë¯é1û(c1Óéé5­fqû‹TÔ±†'`dˆ¯Y³fHÜËF¿eŒÚ:­A›†«‹¼*>Ê)ò)clË̦ÇxöœúG÷u PÒÇì\¼”9ÿ#OméÛ¹Më6—îc,õb[ﶿ§2"0Æ~ØwÜÊ_¥øûºJ]H–Rjvuc¸þ㢖ƒ?É!˜¯ÌÎmšÙ¶M›C¦=Ôƒ1¶mxÓïcåOzµkÛzÂÖs—™ße覤v js/þÞ”Á[´›±ö7ÆX.ýfº¼¦açO2nUtüãZ ‹:иóØä;;Ú´iûP)ïµ_ø!cü›¾M¯»“5aÄŒw~¿w§€v]Wì:ŸQŒØ¹rz‡6­Úwî³ù›Ö…_Gö ü-ý g‹€ /~¹œuýUMTTz`D>íç¡t#Úúnº û/9n$) ÓLÙ4ÿÖ;sn —dž7on¾êbÇ ‡W÷ÙuæÚÝ;×?y§a¿8ÑÂaÚ}¸ôÎý¨È›ßõ­>â»»D4¦sÿŽ#/Þyü(zq÷†]–^$¢ô{¿6¬ÖâtLB’Qùâ½.mÆ,½u7üd÷º5çŸN#"º¾¬fÿïŒ}”p/ì`£zÞ –ô;¿4¨p..!ÉȉΘŸ%Ô¨A—®7ZÌ]ºÞHD¤¿àí="•ˆ¢TnØMG¤;1¦A“V_l?ùèqÂå}«ë7éhàœþäíå½ýÂí¨ÈÛë&uömÔ(4^OD'7ÏômÝ'ìÖ½ÈÛ×?jã;ô›“DòÓg»}HDÆ K«5¯Ù¨7*Ä-£5üîéÝŸ¬Ø’-·~œ×Á/ ×ú#!wïÜ^6´½ÿ¨µD¤‹ ¬ï»+<2..᳑GÎÞŸ@¦”¦Mùw~ãaüãØÛ·©1d͵Ü­6œ[Z¡Ù¸'ë_w hpàJÅì¯^¯éàGܼi&Ñ£á—{#‰ø¡åÓWþ›í 昽>5ÿzáÚÝÛáw«ÿÞü#Ä•Oûµí4iÍÝûQ‘7ÎõkXmÜöh"Ô­iÓÎcƒ#cE}Þ©n¯UáŠ.mÎÈŽ#f}Ÿ@dYØ¿]ÐÇknߺv¤SšË/ˆ¨Wÿf]ƇÞKxtvPí¾koZÒS¦mÿÑ‚Ÿ=J$RŽ¯ž³dß­lëÀëÓÓô&‹É®Ó3/ü¾tBkÿ€w~8~÷öÏzøLý…ˆtÎø×ò;t/6ÑDC{6kñΔ1b"N5hаC§¯=ˆO¸{ØßË÷H*qsz ï“wRˆ,é:q%-UGDDÆÕ³§½møïÆóåœ+œ8]Òùþä[=&ßé>úV…,”K¦¿¢Üð}#›Î;m{}ï¡Ó¤Äµò©y&Êd (sf¾o£z¢1ýý§¯;nMôã_‡Öì°R!¢ôóÞ^-o)ÆÍ|jG¤ÙÎsêóÆ­¦˜9QÄòJ5º>°†p°šyŽH ´“ ¼ï>‰üð¢H Qû-=C™åæäØš ßKµÆ/H¯Y¿y¤‰žØÙoâÖ ¦ä[¾¾V¹±Œn^iñ™ 9KÝ]»ZÏ8""ÃÂ>'ýÞ£Q=ד²_?—ø ?Î ê2l™mû¥¹7‘9®m=ßãD´l\—q‹÷7¥4mâ»!$Öz®ë‡ç7mõžÂÿŒÜÄþZ¥ªÿi³- Øä&Ç |ÇPßöËB¬Ù˜ºïÈyEÙÔ§NØ#‹õ^nžå×ü=3Ñ n~ó~¾h½ß»Ôëú­B´||×í#"SÊÍF> šlç½y`F³Ž³¢^/ûõªõ¨Û?öiØk'š7¢ÃÔU¿g §Á_ê™^:¡Õàÿ}gýl<>¾r‹O-Dd¼Õ¬†ße#ÑО~ ¶_"âDéë7œzâ±uç-+|zÞ’Inr,´×‹àˆþô9çÄ­[ž&ùñþê)‘Ý&Ýì>ñ^×±·:}o1‘ò&Ä· ·Ti[Ðê1qò¨Ðº ;£Ó;æϧ¶®Ýc_¸ð‹‘\qwõ°šd*;-ãY"Ñ‘þ¶í¸¾]­‘Ú,ÆT}Ì*€;+ð4h/SøŸ ÚK å‹Íw†,-—íž¿¢50$‰ŽË‘æò- ` *KÆŽÑwíÃ?ëy\E3)ÆÈ›É(à¢õÅ·[öpm»¸MWz&$Å3 ´&G±ó¨jÛn¯edæϵ<Ë»ÙÒèèZÒDGéO.tÎíóWP!g¿u¦o¦£×xÕ>Ölt÷ô ô„9á¨Ùìäæ$[ËÑ©pu…·@J—|¶rÔjeqô›Óï0&ïÙÕºD“YŸœžîDHñpv}zTÖÒÏì~¹S\ –·~T9Ø3n“mgw€L V® Úæ;SeŠ‡˜Cž<ÿYú—ÀbĸÑBZ•Ì—WL$K«ïO‰Vî2"“ÖX‰j•ê¡ò´y³^9_^Qn˜‹n,6œµ¸˜ÄLŒ®ÔI¹/Ëvdbßüôc||ô QFƤã©4ÂÓý™Ódÿ®Q1£õY$Wžn6›Þ_¿­ƒk¶cÙÝÓ?Øy”¼ç«¸‰=Ô/+ìÏÜŽY!kÎZ,F‰©_\ÞVÙ{š½ìåœs’‹=Òg-GI˘Yáåh12¨^x}&Û‘¢Ù¼ýG‡çxlóf¼™²ÞóK}‹‘§Œö]’dK:àb,nQC³üöG´Q€ÉÁìñ^¡ÉEUÅÉÏ_«ÿït«:µ(xnóïc·­õiõÙWrsÃõ›¬ÏÀýÛ˜[s‡ç¥–8 9TqrR.†'X7¥< ½£îcDü‰Á`±ä6hÀôè?×öÙ ëj“jN¡G­‡¥Ægì_¨NM‡?¾¶íd¸w:ìÀ”ØóݧÙ°ãûqõ’ß_²Œe‘áÜ¢ü‰…_ù“aÚ'u‚Iû¯ÅXÝa‡ìkçvZ';RôV13?Ðë,ÏË7Å’ÅBu§N¯ÿÍZŽ¡{–5î4Lí\ÅÁN¹•l½æÝÓ?kó·P³çTi u©¢Qƒ#S­G_‹7>oL:£EáŠòLªžI¹ÅlQøs›íWÔR ÿ÷Ͼ!iÝ­©GSY³Í¤È*®wT”ú3rOSåie¾ðTåçPABÎxÕ8SG­/³+0°ûÙÚEpìÔµþkÚ¶î<¬Ó‰]ìbƒ^¸·zï7¹^ÆÁ³„:nLÿ1¾Ý'¬™Ðy`‡Ý-Ú0Ü9pòÚØÍ«äv”cÉâê‡cŒiÔsÒø@ÞµYШõ'›–Vç¸oè†UÕ>ج~‰{©:na™&í:õ ©QL:})Mʘl0zêÿü» éq¥UÝ"–ßö³¦¡—碑Cê¿¿­¸Œ+¶îhé·Á§F¿F…3ëãõæ½»;ùøæ9/QŽedÃôáz·ÚÀÝcó¾5SÒÃ?4DÊúуù–a÷wÿ~ëãk%–KM¯Ô£±¼lðØE=|ó­^yÚܧIÐꞾǾÛ<¤l–{ÿp}ÁfíÚôjðA^ׯå®ú wŒ©“óïš|¥TÉŽöî·#®ÞIDAT|åêõ„t[Vܼ~%6É6vcJ¼r=†‘)#ÙÖáʘ{¡!Á!¡Wc“tÖ£"¯ħmŽí„›W"b9“ï‡EÜ#ⱡW£Ržÿ°Å\¿þ •ˆ¢ï†Ýy˜jÛšy9,Òš/ú„ûW®\¹¯¿›hM¤r+äJ¬Îæéºzé~ŠÂ¹%,ôJŠÁòì%öNïÿÕ…ýÈ'NË"G¹ÙŽˆHáÆsö/èçøµ ­¾d…, ™óÖk.Ö*~]˜®ÿ0`µþ»…ýÿb3`NmÞ"pÞæ_ësz©éO/mñž^ùî£.kÚyˆ´9ða>ï¿©œôïçõåÍ©×å KKí{dŽ™9\Í´%ìª ô«"{‰ÉÖX ÝÓ7¦3%ÈM4»·ðUbæ’^o}±!ã»%ý½¡”gš‡Šƒ×Oö{yc¶á𯭳pÅ”ýg3gñÖM y¤Rëí1½Fv’f٘𹬶#³e`áÔŠ#“¬÷ÿÄO˜—Y!¬›7ù‘°Ö[,ßç|Žþ p`äw‡•- e¿ò9;£êe–h(?˜"s5½6ãî•F¦2½Ÿó¼ãüW/à ÁÏ?Û‹ßÿKG=¿xúé%¡5‚?ûxy•¨®‚úq1¢¾Æ_£YQ+±×V›_Incú3“}º}©d}Üm5(¯§Zd¹ôÙ¯{v˜p„þtMcdJnØ24Vo›CÄÓžèÛ}eÖ!éOêvYúâ÷ÇÛ½lRó€§ô^sBH€à5 ð@q ãªüÎE:"É$’H{}]ÉWöÝ(ÞôLõ3tððí©­î€!.¤iϭǪÎÃì"0†Êí¦¦+ú—nÚqþ‚E¥Ý5`ô~“V“(@1¦?s#¯kf½T%'G—®ß÷ï6²ºVÔn…ÄS-xCÕ†Aâ Œ˜‘§vtý,Ãó:•æÕ­› ­”tƒÍ™õù•)ŒK>ü˜’LŸñ{XÄ'Ÿ/Wó볧͈SðëÆ9».$œØ¶jÆŒ™«¾;¨äÞã¸upÙ‚-ÖßøÃÓSçm@Ü´xþg± ‘«æM߬‹ ?ôë™h;¿þlÓÑ̇Ûðå–“×m§Ú1ÿ³…»€€ø+Ì_³•Á´wÏžd…oX0þªÞ²bƬ=ѶÜH¾´hάÏ­ŠH”Øó? ²oÉ7‡â"~ß:sƌū¶$Y@C¹ŸÏK5q©úD·¢•K”*m¥˜»€Ägf/þJøÆoVOŠ@ g(ïT§„º4g°Å ÍäÜØ!âã¹[KW«¥Š=Û¿}/ ©×,h4Ù7jÕºB‘ +hÁò7 hå,ãÚ¥ÃËgL8i)×)(àÖŽ™}æýš[#6ìÀÞÓ±69û{çÕÑõñ3Û@PD¬±¡&bHQ¨Ø@Š 5¢ÆÞMìÑX’KÔèc}Ô¨‰ÑD;vÅeéˆ(‚Ò;Ë.l¹wÎûÇ.Š(ŠIÞOæû»—{gÎ̽ó»3çìÌ'Ÿ:Wß«¹|éÂÊO×pÍ:¶´0Ê¿rI–ªœ'ò§•õ¯‹YÒ÷Gï@Ù®m'/ŸÚ^¨ ½vìÁ“úÀi/œ?›_Ê;ôú°L+î;xˆuC#LX¾ùdûn=„Ù²¯ ”>'âÔåXÈNºõ¿=›Ž%ûúy«"MZyàue ‰IúîŒJYbbÖ(16B* ÏPP½‹ˆS%$§²ç›ñOóÜ €)XÔFÃÌ&Q¢ Ô‰ÚÔF œËÊXngâÔþذŹ¼ Wï)wt²o@l>±Æ¹__1H «^KýÝÈÖ½‹í¶¥-õ°|‹rB¯ß¿„Tí1cáÊÑ‚M<'›¬]Ÿ Óš= ´Ú(?%OÙ´uý˜ëa}7@(¤´S¯®À]ìãا@ŸùÕ¹ˆ“å±aKryhô,cÀDh¾a¦"±Yàa5'–0mÞýÐ÷éOP)øË»¦$~ÔÁÊÜ‹[°?è‡VMí†Ý9Y܈ñÏrÝ€6u9 (Ô°Èÿ¹á?èo¡ HD©ö5“Z¨®q»Þ† K£Æéi…`Ùø­ªŠïÑܼ:)z®ÞBÛÞí“o$ÀULƒü';ŸÝ—íÐRu5ÝúlW€j+åZ h¤/ˆXL(¯«<á ©¤•½!ScÂkt/ÖÝüM¿,nÔÚÌ@ucµÓ´ùî÷oYÕ0ãŸÐ¹1ü! y?®y¿róÜÖ{)€_×~•TE5k½}º÷Š½ÙZù‹ý”m»6¾5OV,É2êï`þ3É‹ŸI -D´hÑZïÂS×­$ÃR  ecöl3µê»yS{¬ôóU87-ÔЮÓïäéÚ··xuc!¨€ ™BÑ›í¬²Ì­çàîQ/]9§˜âh ]š¤þ¶÷r‚K/·—uïÝ…ü…¾ž—³ H:Ÿ£ngÙè¹aÌ[Ì`¼7¹1oSŸ&ïÝ{88EkÔ° ¯Œ8zøPV9bQJì’­‡/ž=ùé´=v³·®&6Nc÷vž»t$ðj¤_·6AÔž/&~}ªrO‰š:{šH/Hë·ÿÀ¨S3õ·ãÛ¾ … Z˜ÓŒ];œ¿ÿW6?PeG0µXCšº;4Y3~ô÷»ÿ»'pàq»}7ni#€Üè þ³–±Ñƒ¡G¸nݺwJ€+SŠÛ;÷jG¨BEûÔ“´µú€ddw°s°ê`cF‹²‹ù}í㮬ç´þ«|ÙÃŒ.'¯™<^9 B¬ßÂÖ¡­8<2º€´[¹pœ¢Tèèh+TªTÝ{946§QŠšØöéÚXS”þG¬ÒH¯ÇBšŠ -m‡ØÙ´G€v&~ÐoÜ@k@,U•÷îã`fÜ¢—µyÆÓܬí;˜éTÏ ‚¼¢ û:ÚÓr¥È²_ïöœFiÜ´[ÏÎMx‚kÜÏÑt噹ŠÞöötrñÐÑ45-C+°ð_ºy¢‹%PmIÐïç¼ÇŽarÃ`@Ï™Úþ™kZÇ?Ìîöl”QÝ‹ÿí‚9駞©·}Þ\íªGOØ}òL 0Åa0êtF8"­<›rõD ,©Ê>HMÛ­Y4±æ‰BkŸíóà7ÅL­Nž ds¯Œ¿¡wÃs:$B‘PPùÈ+–Œ$‰˜­ŒÁ`0¹a0Œ¿„€UƒÁ`rÃ`0˜Ü0 “ƒñN " èwôÖÿ(keG@&7 £¥Z-Ñ"G4HJHòµ3cœE¦ Æs( ¥ BB¸VtBVp¡˜*¶ZýV+]öóƒñ| ED„Äédg3+µ¹ ¢:¤< °66œbrÃ`üË4€TH"ê%?~'r.ëˆLwŽêSŽÃÞ'ákdù—¦^aD µ[ññ Ó´_Þ橯…wqxùö<;§Î§5

Âßb\`Dt̺AF'Í}”QWyüepéMý»UË Å¼ñ÷é‹ÓD‰DË7×|¸ºÃÎ6’æH$@H-®×ôŽrƒˆ@3C—Nïåë¿ót˜¡ píèÖ±>^~㦻!ןºvžÏŸ1ù?oœ?ÂÓ{Þ—{8øvò°P ?ßkäÖû¸óË6¿‘£'Ì8/ßøÃ}ƒfì+Ï™:ÆËÇoÒ™‡¥°nÒðhfŽ§W`<3ÕÛãî]e³ÊhÞ–Ãw„øtÃÔoõµu19ÝÞβ¥#ü«·W{®ºžö«¿ïˆÑãgg¢¾]fGþ9yœÏèOæGŠ*7׌ðߦûûøøøï>ÿ@ããê¬2,!¸cÅô•û¯ 3•½Q$VØøšŸùÑkÎ7¯jË‚è›ü|}&Íû*G ðû‚!dz…ßLíçë½â׈؋þóV_ê?Æ÷iaúúÙþ#<ý6» Õï“£=ì:~cÅ7~æ'ÞwK!ãÚàñ+KŸ\ðõõÍ*‡¯?÷ÿåN6ýiÚÐ9ÇR«ŽŸä—öûò?suZ™äùq…üë…S¼¼|}}€uÄŽ3%_šà3Üwìô;™:Xó‰g,§™íéµ#Ao¡  !(`Œ÷˜ 3oeè¯.žç=ðô È‹Ù­l8b®{{D´Ÿ¸:èȘà;,*SÇ´ .œ €EFyAùGõ/‰°ìç'?䓬z¼I7#×…í¾¢‘@g&¢@ VßøŽßî×Ýñ×[ÑâcVu˜ºéEÜ9ÏoèÜ-ñIÉò8i€£íg§ž"â¢w7ïyw=ÉÍJÛ<ÊaìÎD,I:ß·›û§ÙjþÀüÑs¶<”§$D_óëe·=B…ˆ˜°ÃÎÑ}ٖٹIQg{9Ê‹ù’Ä3ÝKÓs Ô±pÓËãr¸ÊF•)*µN[®,U©ÕÑNŽ³ˆ˜Ô¥ïè2IJ»‹\G¿ž›öÇö|4”bîY'‡ãÁS’îùÜÛÙÅ%.¯ÃNlt<6üA¢<þÞǹ?…"b̯ëú]†ˆºØݶ.S³9ÔªUj©®LÍ#"fÜ=½*ðX•Ú:µeä€!÷\”%$<ünêp÷E‡Q™ãaï|:69#3çë¹#çn8–™•‹Z…ëwß•÷S3³Óã{tŸóS­æ&¨Ã·[¹-©øÆyvº_ŒÙmíݧÏú66.N‹8olßÿ\x‚Hƒ~X¹ãZv•TØww»•œûÕ¬áý½ŠQ;¤§ÝÎ…¥¤$ݳÂÙsºš£\Ô¦Ž®Ÿo9™‘•ó(ìLß>ýã ´%‰¿ÛwóÉÈ)Ô F¶ÔþcïUÇ%&ùÆ¡ŸgO•ÛV/¹›¦EÄkŸ9;–öçþÏ/üv÷©rDJù¢kVÊóuÈxïP¤øãÓ…‹å#yš¢‰Y–5niš×‰Üÿp¨¦ˆH‘GŽG­ÕŒßQnhÐB×Á›¤ˆHK²âN»‰|ž‡“,]‹”"b¶l“³ËÔrÄEyè6"EÄ‚K3ìFîáQáh=(‘×dº9õJPÒÍ Þè2äK"&þØÅÖ7‘R¤œz°›ãõÄ"TJ¬‡¤""¥”>«ÂjÉø9`Ä!XYn¤ŸÙ9LWèôâx;{÷§Zzs•o¿e¿""¥¨-IrvÖË ¿hPçïïj+äõtÛñùˆˆåÇö[{^>Þ¥÷ñ…Uó¯0ë¹}¹ñòh0<ê[«þKµˆ¨ËÞÇ9¸@ƒˆ;–ø- ¼„ˆT«pà|ø^¶>­„k›Ý’2=°cUI“®&ú…Ñ…ÈQˆJÕuØ‘¤aʼn ê%üþ#!Ð>–+À¢ñ’½ú×Àc«WçFUƒ+vU÷"_¯EwÃqcBuôµ=ÏNæM¶×à]|˘­×¸³øÕ;±¾h˜6<•t›j({£My€›q:ÊïïH¿•z>¯¾š¤Ô¸Æ]ÚR Í…áÙÊ*ƒr¾i3ý Bä)V2KÄWÏñDDWW«»6ãþ,\çeñúûȨåÀ-QK„¦BJè±Â­"I=àùi-—KøD@ñ…ý{kó†¼ëïnêA†!ðIŒ„ã¨!¶O©@Xuk˜—} Õ öœø¹é«ÜœïP³5%·tVk‹—÷k©ò],Ç4ŠòÏët3i^õ–¥G5²h[t8kQM…à­ÃE}^”× ˆèÍ·^ÿ(=¯^R3ç A£—>^Çé‹ÒÀ:ûoÜçÛå ‹Âk9!–iÁX$xcÝVÎ˪«¹1iQ¡ÉÍ;5,“çX0¨3?1P€6 :$Óˆ3O¶§SxѪ;ÄXŸ­JÞŸä¿£«XäíÖ8ôø-ý{?Uz¤ÿ°‰X¯KÆ4)¥Pot–ì1s5ym>@`Òµ~}ÝýÄbCt­%LÞ÷h 4K œ€JÕo:¦Ù$(@ à}îßûŽ®bJ5Å÷#ÃBdaÉ™Eϼ¤éIa!ÒÐðè샓õQlXjŽRÿYW/JÓû Š3Éd²„\µá*™Tñ$·Ôº*-84ž7dÆG†‡æ+µˆXø4^&“Éó4ˆå‘²»ù*¾ yy˜,OSñßòü`Y ‡È=’F¦œ`:¥T^ÆSŠX^˜& ¿W¢¥‘¡¡%jNï*ÓgF……„„ÈÒr‘/ͼ-ÑV¸ªsäq¡R«d\^ Ÿ;uA•ƒÙ)Q±òÃejpè#½eÚ¢Ô°PÙý´"ÔE…†„ű¤Ì°R¸E#Ç—‚ꮬæÆ»¿»¥³Óäs$rL˲ü 3®þÁœyÓIcêÞ°êßع¯ø¤›þßÔ9Ó9¢ÝóÆË¿¿³éš?œü±™2BhäCד·?sßï{ðôæ¾Õý¸G6ŸtÃ׋õI@ôtH"Ô §ûûßzî¡®=;L[Ó˜dþ²ªY›}ÞÇ+«Ë$¡4#{^¸õåGžmZò£“/½È§q’ˆ(b¯,½å»É‚’€®;fÔ’Z~icù¬K¿êª< GºJ±â£¢âøÈt=¯zñ…ÿû‹r‚j}ãî﬿ë?‹kßXYL"9б5¥5×VÄûÚ6¤¦Nøô¢¹Ÿ˜»ðµ/þ¦vÒÏšê G‚½çµ7–>7ëÛ§]6ÉnkeFP“‚·êB À4ÃéZñû—ÿú½ùâótu¥Nì[û×WþöÛFNºæ+ååE@¬X{owOeãôä¾5}ý§Ö”£+·ûK'ϾéÇsMc6ˆÄàæGþïšå?{¾{ïéÿò­0!U_†Ê‚zh é8)°R`ÆËëçœrA~ §}K2pÃ}Û×äM:iò‰‹‡wnŠ H)ý“.¼©Dîܶìˆ:Æ7=û‡A1÷ä/\ÅHŽ4e¢gÃÑÀì^·ñÅ'ô)Wžý…«,Ñ­$ÙT,¸ö¬¾Áö­Ú¹a­ãH" ”Ñ=+†"yÓ–\gD»zv´ˆ\)GBØ ;V’,šóÙŸ|ìÊ%ñÏl~õ ©{SPT¯«kADé€f c(€Ìè®îÝ{Š'Ÿ6aÆ|Ûµ¯«@+žwì9çŶ-íhÙ޳毛×í›qõ·j HI-(m¸‘V¤m}´ qá™AŽ¶ã­2í$뎯¯+ëÞ½%iÚˆˆ4ÔöÚ£Tsò„Ù'W•Ë};Ö%&Ž8§÷¢ÝT´ø_&7bç–õÉ$ C=((*Ž"2®ƒ¦ƒfƇv¼µ&f–7Vâð¦¿GØÔÚÉÃõ3kª|»6m–$ˆÀW:ë’†¦â]Ïܾâ¡Gòç^3cF­eÛ_3D"—tR$ú!T*,Ctí¤îÏ©Ãe%ÉAÓ4QCkï3-» aΉE5åu3KtntÍ£ûß;ã$L(œ8M ´¦lé]_)¨j­8ÁøîU¿»Å&:±®¾®þúSolh(AgçÖ—VæÏú²ŸËdB+›)J¦”ÖMHô¦‚ÕÓý©ÚZÛkª+ö;;D$‰Ì3+(*Žß¥"2_^Ť K‰X5¥á¤IåÓB|èù»vvbÿ­o¸cEûâÝo=¿nÒ§:1BÎóʃUPslQq!AÚ+8 ‘Âù”ˆX‘~‰åÈ2Ž™ŠGýáj#ä·ZWîضm¸síË·^¦I‹D2ÚÙÒõò«óO˜£^"’ ÍlßÄ ®òé,££¢âxƒdþŠ‰g]Z昶D†œ2Cô¬]þVaÓE§}ó{ÁXŸMZ0Lïþ¯oÜÞzŽµŒBD†¨kšæº+Æ&¹qlܪ9&mÛ¾¹yÆG7Ž9Xí]íÃå³'„´¶×ž¬9û¶{k`Ø” ûýC[_ö§»7wÞ¼ Ö-%1Qßó×&ê¯ðÙ¤TµVgÂ0gH#×€i>®û¸®# óÁðú—º{zŠNüꄪP ¤>\Ví+®sâ.wo±…æšP<Õs%!2”€˜DF’ T9mê‚Y}¯Ý¹iÕjÓv'äd·m{öÃX\?ó8Íl_þ$›÷Ù©Â’ºÂòúPIù„™‹«'À†žAͽkd„ %"˜½o¾øÿþ&žÙûË-­—ÔÌI ¶®x,µóMtV¬»kÃk¢â¼Å×}½ºšÛqR~EÅñÅC/ðͶxù1‹Ñ)4¤'o\C¤†O¾ø†) ÜømJØ%s/¾8¹SƒvA™Z^ùô…vÉŽH$Ñ•}HFÀq$2æËtÀLæþ h„ÀðPI‚#ËDD͆ߵ¤‚°ÁN‚ãH’ ç3ŸÉI™cð‘>Ê‘Ó‚`a®M,¤C^¸኉Ùڶ̯<ÛúüäÆúÌo"¥dŒM›6í¬³Î***RRñƒs0‡É$DÆ2ÖO—‘©ADäÌËwðM.‹ 2Æ€ÈöV›™|(²â`Åpôº‘¥]‰N œTF#&ïMNœœ‘«=ÆІx¿gŠ÷š–!m§!8È^ ŠŠGDAMËFDæ:ü0»Ú#×Ù!Y6†ykL/ø:-eGä b®93GŒ` º9‹™.%sÌ|¥“ŸöÓ>Ó‡¥/©x¨¨8nôûôXÅLp Ž1ÞŽýŽë#öçì͇1N–‰¸Ë^pÔ‘cŸ|¿3à’ ‡j᧠ ¨¨   ¨¨  ¨¨   ¨¨  ¨¨   ¨¨  ¨8î0¢Ö7ë/â}UãCåâ ™j¼r|‡`Cp‹p(Ÿ½¢â8f£ ¡“0Æ«18è_ðõÿ[ädjs!¸]ìèÞW·¯xq`p˜E³Ï™ãº’0#â¡ò†PUMgÚ¨ûõ–ûÿo_éóO^ÀD üÕa½mת}ƒÙ'/Ò5’N¬»cÝ£o´·-ºò_*Ê‹Q¦Úw.[8‰ßHv¼tßæµoîÙ40˜o‚[þÒõ%=mßX·æž[¢Ç5Ï?ÉîzkÓÃ?6µ/8n²„Œ%‚q9%Í‘Hb2 ÂLÄ¥°íd"Ä°'|½mÑþTý‚¦kݾôw½ÖŒúæª`8ßسkÕÒÚS>7ç¸Æö?{}Ó ŸúágYʉw¼ùöcNèUáâpdÝ“»7Ÿsò5W‹hO"ÒÇ *íTl°íÙ×–UÓ¦º “ûÞÞòÂÕ§Õ–ÖäGv>öæ+úpµcL0*-™ìÝöì­íÃáê&]F÷¼ñLGëe /þ˜l_³þ¹‡b"?\ZBæpûª¿ïžô‰/½€‹xß®¶‚ú3yn@1Cϯ„p , D,Cƒ{VK; ŽÉÀ4m’¶K&£Œþ+,I‘v2]€ðÉN¦¢ZPüŠIy>ÝŠÇ$€¦É®ÕohåSËjÁ®l:ë¦â¦’ oß3–ÕÌ-o[½1¿ùªâržê'ž¨œz‚þÚC­ƒß:¦Ly´ØmÆ¿‚*…9Øí@QIUàH"d"`€CÅA+ BèÁ`÷ÒÛžßt„kã³m'XwÜEÕ U½²ù 2íÝÓ&–VÔs¶ÖqR‰ÁÖŠE_ª) :Ѷ ÿrï›Ï5Oÿ„¦mÙ€ ­Áö×îéŠUÍç+« £-{òö»[N8wÆüKÊ[68‹&Î]Üýâ?lÓÌM);%!j†µçùä)¿;aa3" ¬¿oç–½ÎüBóŒÉœÉÁ5¿yþ‰?•L˜[]Ó=`ϼô“õU%RØCÛŸîèÏ‘ìé¤ gÖûýšûˆâo¿òÓú¤-@óñ®!G yß³_yTÅÔ´Y,·2*f dœû4MÐ HDzŽ¨ÊÏCd,µkWkWxö7Š Hj¡@aRŽasC$&ûûYhRX÷Y ‚Á°Ï×××ëð2 LY”YQñC© !tœ”d>nèóÙ¯Ý÷bš ‚úÉgÞ8ãÄ5ÍêÞÒõK’ˆ`'Áð¤S«ÞÉL'ÌÔÐî]þÉÇ”p²€@ä•/¬®/ÓmЊêJ*ë:6¶ G“È4d D¢¿gû—ÖWèS®¼ì–ÓX H$’œ3©ùu0ÆF´qW~ÀÀ‘l”³~°­ÁÞ–ÍÂW®¬BéÉ ¦œ”ÿÐ }»V•5W8=ï]»ª0tR~QYÍñW—E-HôvÙ–®(ÐXF¸Åwïâdy_¦Cx3 ã”lÝ×€LõlXÿä(¼°²¡‘ؾ12hM?~&ÄÓî :€J㚀EÒ!ôsƒqw՚ƒrô£§ÙêøVPiz9)Ç´%8ÐpÌ’¯;šFÉνo½í ÆÐŽEk>yϹ‹jS–ÌŒiƒø«Ç6ûƒ%•Só R$Y~ƒîÉnø )Û–iH'O`0/Àt¦Dô êˆÀ¤w×U[:2PÒA4-S m]þÒ­«:V4nD;CÓoX|qÿÿäáço-i˜]5å¤ig_]°÷õµÚ²¤"\à1!¯ná9ÿñý"SZ€0XŠË¿pÊf:&ä'·üã™ÿ}Ú} Z ´rÖ’Åg\ZVVÄúv¿‘ÐNm®+ðN¬'¯Á€æ×…°„„ˆŽ-¤-`xÄW êøð+"÷—Té|p cOCS IV3ù¬KÀÞÙ³*egVH¶i§À±Yõ(íÌ“äX–* 7LeŽçX '™q‰I!\]NÅ|s)‘i}!È÷;9åx!ˆdÎ’(S€Šg]¼èºoçûÀ%3"C‹U.þÌ’ÅŸ‰w­ß±ì® KÙÕÙsö 7'úZXa‰?¬eâŒH’“ÛbŽôÖ‡òà|úˆ(âCÁWŸwã—:ólÀ €€$ °{6½œwü­yRÍe4—I’ëþ yYi1µ%û- |B,:d:•ee(·¯9áQ°`×3"0–W>­¬º|÷ëuìé–$„c9V,6ØÞŽqŸ‘ã–cÈ$2˜þÇ\ÂHælKÁ åU†pÓÌÞ·†â6cN<:4Àõ¢PÐÈÌÿš¯°¨4iëLF€é({·¿pOg_„3D0ÍVÄ9˜ÉþžTÔAÎF]µ`¸¬X&û’Ñ(Ó¹æÓÐê߻ôœdÿ®Þ½{-ÛÉ«µð ·]úù ‡×¿ÒÛ³;Ú5Ê« †FZ*s{cV×ÀýâŠÞ!êŒÝ ôbl$$ä âÛ¶òɳ' 'ÝÞŠIpsC PºtR‘T2‰$… Ö7%¾w×@kŠ@ѾîÝ«©ò̆°  !pãÞlC„zaý”S.‹>v×Ú‡oÛ7ef^~€„eïëÝù¶éŸÚ<}†Æ@HGJgpó [íRÛI+¨ lÓ_»èŒ‚@Ðe# DZRRd•IÉÁêy> ×Â4‘loyéÉÊêb³okëÎ=E3®/,¶Ú Û´‹kçŸÞþìËŸÕÔW olÍK;ŸvÏ×¹Æû·/ß¹nb0obcË«Ï‹I N¢£mÓš„à "HaÚ¦—ƒò‚™¤•°m;ûÄ‘„tÈ"’9±ç̃ËïÙ—7û”ŠR)€!Yí];6“Ývª¯íµçS˜ò×̪¨,l_~g‡˜9ÿôS| ‹ÿ|õÚl~êöäìcî·vµ$¦-¹<ä€ ÈÒqzŠŠn³ $Ô §œ³èÚŠÝo-íÙ¹²WHÐ ªJf_VwÌ %eÅ(X~Å1 ¢}kZyZyC@;9 {b8”¨…JKê'‡ò‚™e=à¯lªâéÈMr¬PýÅFçžU+­”ž|î”OÕ9–M©j¬ÄòÊç^3Gøwo^³}¯Íe'~ù«“&”H3V;ûÌÁWžß³öÍY§ž5ÿüþm›V´ lñçUM?‹vû M 0ÂUÍĈHÕžtìùÔòæ‹mkŸ#r˜¯lòi”A;qÂÀp×®×w1"©LœÕ¥ÁÈÚ`ÉÄò† @€ œÂ†ieõ¸„ÌÔ"mÈk˜Uœ ‘—G%èÅõMè3Øþþá`~ãœòªŠtàHÁók¦”ñjw9šcTAÆa¨K4-:9”Ò!ädÇÚ;7¼‰&WLÊXýäð (*«›CmÃN$"-3G=?Wš3.?,~ÕuøŸ</Ó€H @ò‡CÙàk ÂË %Ä€¿ €cYa¥™`O¦çùŒ< ‘õ/2–iÝ‹€ HÏ•äI ILT$Òzú|µ~ Â[þ! C®yƒ0è/lðbQ%èÁr7V›¥!?¸a®Þ7$Ðez°Ì=±t\YFÀ‚¾pПþ²Âî+ä~‘iŒ¼’@~!ó4^÷5nT]ÆøÄüÅARä„©{d 4 ê2Ç7BîWeM,Ñ×xÆ€éù¢üýòT€$è¡JÃ=‰ûJÔüåzÀ¼ž-óû ÞŒñMÅt d³¤Dîß›¬½o. IDATÂ[üŒa…ð¡t6ŽhSïž ÌÔ`WÌ—ðzÖ{ñ"éqW™r3 ²çwSG\Z¦×V"'OCRÚERd¿—÷­dæÎG$[‘€Üo”NËÙ#)HK?‡t'òÌEad$ú¨ãGdaIÊÉKÉáIz2Âœ¤“Q7™mÇ,3I'ˆ.?iÔq*ðm\ ÆQmãsõÏl˜àØ<Ìiä²däúlã‹.úñ[(™$æ 7„ܦޞk$s'éþŽÙwéýûuöÎM¥JŸ-«?Ž¼Ïœ“Œ¾JÎhöNèŪZíe蕽@úøœÆå4*ÛÐSP÷»ÿ‘7û™§)·Ÿ9"`¿ÊW?QFû1­ôø=q´ˆcÄdÞf -$Î\Á‡^äXFuqTjÓX{ƼÜ®Q¹7†é Á7<ÖŒƒû=„öù öol>‚·Þ©Æì3žÛÃü¾õ~dÃ×QQñCÃu dÄA²ì@‘ðá-gH,s« ŠŠ 6³­pÛNbLK¥Æ…I‰´d™–Lz zÆT¢J¡**ŽS0"uÍá¶'þøËŽ?ˆrüT÷Ê7¿eóí`ž—¥x¨¨8nõR à+ß¾câ³ení¤ñãeF Á¦cºgŸ(©`ÁQU­IQñ#¥š ¢–¢Î§õÌœ?N¿„0‚Ä9JéZS‚QQq²ïÎD°Ç–cmYϧ,,:/„ùéƒÕcTT|/#2" »¸ySzæ#9" sïíœç^ãÃ$B2 B$‘CF’H$”+úŸZy4Fd±d‰]}rÉ¥3Ã'„YI¥ÝTÜ Ù¹|Ôˆ'¢ÑLðŒ}ä}6»L€\ íGšôÄŒ Æ=>{jïŒRJd9oeßtï0csè´íJ‚*žuÜüÚ"fV9‚ëtô‚»¹Ÿ‡bN2’Š tžéûK«µ­@æOôÏ>«äʽ‚@"1d̉i}^ÑP)¨ÞFn÷‘× CãŒë†ž/ —\i §Ôà."®k|„.éXñÊe§~üã¿ à½Ó÷þx÷¯¸EG.©=åìÓͪee—L¸ó¶]]¢aBÅÙ—\I\óiH\g@ž#}}¦>-ÈP3ì×ufFcù寺ùsš?˜±»96¢»TæL+–ɤ)A¾Ü÷Øæäá£^ü±’kÊô™N“BDÈ]‘SÖ¥pô*¨ÿü )ì@ÍÜcŽ2ñÖŽöÄÓ·nÔÈaš¶og·ˆ¦Þ‚M …+«Âù®ÔÎ+ ƒ= lÀïÁsNh2˜6#y£8­ cz(O'"’äXNǽqäz±}Û#¯o†M6JÎôÓò¯¨óMv¤ÍPj€èšiÀËÒ ò´TÅãۂJžf”þƒ¹3»…zàN"¥ ’ÉØà`“‚X¸á”3 ó„-Ó.Äwä&cŒp gLYuž5Hd„Þ`ܲd (y£ÙŒô®ŽÀ|Íx3²ºû~áq…g8ŽÅb=(QÚTªˆŠŠ#LÈd6tËIX¶édÒçð@NKÐt_qa~ÕE7~÷ò“õÜwسÖ~Á¬rìI]"†ˆ,íøORqÊÜÀ¯¶ì„â;zw™þ¦æIW%÷㈂ü"O,ë’["ŸK+5#tÂÅUŸ"A5H, @Š€Êl³¿PL¯ZxieÆvµµÆ‰è`ÿ–ÍÛ÷vF" á)sE ðVu$Ç •”LR¹é©¥«6¶G¢ÑÈ`÷ºõ7¾ šëÑYQHÂv€HîÚ²iGk#Ñ¡þþþááHÊ´’‰ÈàPd8—'|òXóÜ#¯¶Äã±Îu+__¾¡ñ”3êBùhÆ7½õVçPŠ1–QôŽ~JHDŒP#¦KlÔŠÎ-¼$À8 zq J*Ž-°êä«Nþ‰¥ÿ«µ+¬Þî¾‚ê ¿<̳ýii‡Ìçü:ò`(û9°òÓ/º¼í®ûï¿÷kjË­¡ÎM[Zg^~&è†/ð±Lr:äç5ÙÃOüíÏbâ韹úœŸµò™û_ÝÒ+RÃÃѾ7–þn×êÒc_Á)ó>ýù%»ýãí{'WEöµUœ|ÓåLJB #=[ÿøãŸÏûò-×/žà ¥#§Ÿfòò‰@Hd$NÏ¿¼Ôh𯗮O@™0$ùý‘ÿþ÷¿ÿþ¹€èŸ|ÌŒò†¿°¤jîÂÅófMon¬«, ‡ kfÎ<¦©&LDÈ´¼ÂÒæ‰ÍµE× KŽ5£±*.¯›>mRßgø|ù%ug]ñ‰KOœBüº†‰ë«>N¨ç—7̘=mBЦk›j+Š5FÃýB VT×;oþÔ 5y¡ÒÚ Íµ>_ yÖ¼ %~‰þ Ó»øÒ gÔsvjgË6^yÌÜær8âà hŸÕñvty©Q÷±ÂkCz‘¥Unwyè¥ôÓ2Þ_ *yYr™7’¶#q3"éFeI–1…œèTpßB$/’¤#$2Ι—ºž>3ë)IÞ¡™¨s7~5$” feˆDÄ)2Žà^(Ò»û¯ø}ã…ß8wVÙ‘]'’N(‰vÄ×?Ú}çq…§ŸX|#†œ3PA4ŠŠïž‹i{Jî ÉF‡èÔž)sŒ­“Ï”k¨AßÌÒŽ2‚ýEZnö_&{Ä{%¥tÌDwGG¸¶9ìgp¤%û¤„”ŒÙ}a­ÐÏ Àt˜Š,UT|Szš1#Ó  'e#7…j=F’oŒÌŒ´-sŸÙÔÄ‘üÜŸŠ9éð#.@RfŽOG²AÁHDî÷¢ŒgÃK@ÆTñ(EÅ(\ÞŽš >RÑ“ô™?ét3¥Ÿ***~ºNל”²œ?¹3Ljý Æc ¹§Ò*›RP“P$@2ÿð'ëá‡æIÆ´¤ ‰!K|í‰Î΂»Ê‹OÅA%ŸP$¢D’uõäÈ•«hxP2óí5´ì%­§ÓiÙž-*©<üŠŠ ‡‘“ùù|ÊTÀ_Yi­Û’8ƒ/Ýð1 5¯^+eêÖ)(*¾OM,­eGÆÜ8„ª¸îÈ‹Àþk.:L·ò.4T¼<8f†€m»hùrÆù¾ï ¯x“30š|Sg(þ)*fÒòÝìC¤Ü4üC’D#9˜²&ÊZ)½6†rD:DŽdÊÉ”üÀ¤aº­œÎø‰ÇÓì9 @ÜwŸÜ½3pç}A,qÌT6sJnoEÅ1…OZþd7ÓÛž,ÂtSCá$â±X”€HVdx(’°1M‘¬<Ê=ã¯JAæšÝÿݳII„BHf2Ž˜¶ˆLJ …mÆc‘¡¡¡H4fZŽRïäé©ânáPMSè…Ñ òæI4s6°ÝÛÍßj¿¾ÎDË.«Ò–,ŸŸÜ›SdTT|7 GŽÝtª— ˆæð®Ÿ~ïkß¹í¡Á$@ìåsOšrÁ¿¾žcÃÀd;0ù³#2g&€tÜ4dô™´â;×.ûŸ/^¹à´‹îY¾ÕñÂ8™xæÏ?¹nÉgŸ}ÎÇ.¾ú¿÷XwÜf̽Ût®ÒáŽ. €ˆ‚pð’ó±¦mißñkc¸Ïᘚ1Y?ý´œê!j­øÇÁ5u# ÇŒ§Ÿ? 1 Â4mÔ ŸÉd õ f<%ŒPýÍßøžÍBá@<ÔÐ0‘WÓê¤HÆ“–#7‚yN$‰„c;„>¥’ [føƒ€$)MÓ®ùtÓ‘(èJ“ï߸~oå´©5…ÁÎ5ÏýôPQÓ¼9¬Ð¯GUܳêo¿øóò‹¿uÛõgLn]ñà¿ÿÏÏ~Q>ñGWK$Û1-Ûðù5Îà0ç$e¢Ø€3&&6‹†zìèðš49÷]ta ¸DØÂ-UÔ›¢âØ)S;F´¿zë=ëιꆅ“ÂíÞü÷'—‡§]|éqÖÝ¿¿Ç™pÙ±´|ÙýŒ]`îYÑCMçyœF „pS~„ݺfÅ««7 ÅMÒòg->ûôã§øDróê—VïJM­+Ú»«¥g_Ÿé¯>wÉ%Ç6¦"=ø˜¬™{áY‹òt%iôtîضùíÕ¯½¸6ùÅÿúVu8à8¾snúæ¬jçW·ßmÙ\‰GÖ›Ük,ºñú çåÌ8ëêK–/»ã®‡z.?¶dÛ†?·æø+?½ ©$w…{L6ä…”J$ŽœjêœÉ“´7Þä’„‰iÓK?ÿ%A$™[”Ø˧R|T êGUÿ¦‡}zgwÜUKSC­Ë–>¿zK?@ßËKÿqïÝ÷®l‰bøõe/¼´j[ÊÎmºâl\öØ/{ïîa*¯ª :]þéÞ³¼5èÚµöþ{ïzòÕ-<\ÙØXÕ¶ô®ÿò¾^ (ÈÐ@$–$I(RCÛÖ¿~ß¿ùÅ/ûÐ?^î–å×æºYÕEDX¿èœKΘ¯¥"¦C™rü„ݯ¯NMVô´ÐàÔê‰á7Ö Ùf| o e‹Ãn²‘—Ï$öõPG'b@@ÞÏ~nš¤j¥¤â?Ö´@aaا¹ÁYÈ4#¿  äç ù ŠKó"©s>ó¥é†9¼ç-˜ô3‰®ŸyFN;çK_ûxœª~ú·¿úëÕ'ÿ[ÐgäçÍ9õÌ‹O˜âC˜™zá‚;Wíîüü‚Úº+oü"éþzÏŸ i1Ýhív†w,3öïÆóKê'×Vú ª±Œ¬A+™ð–”¸gHõí|ôþGñôùæÍ_h*ðNëörc®[bdÏ3·0± lc÷Èô‡Ðä•ó2ªé¡×NÉþF×›ã^•ÄÊUôû?©¤ Àºðƒð¹g[npÏ ¦˜¨Ô± §Ù1Ž£^»GI(|‡³H!L[¦ºvmß²uÛÖM6Ä´ªSÏœg˜B"0®±ŒItd9 —êš™Ÿºùº¼ö¾pÍ’ÿþÝc{ûâÀL ­¸TwbvJ¦ÏÒRú ÃÞû$ ÜÊâ‡^6¦ë,ºµ¤¼b§©„ùÒ³lïÀž0Ñ ²àÛoŶo4t€Ò묡x¨¤âÆ”kFp§ìŒ_AZBØ"Kz'6sn„ BÕK>ùÍ+NÉÏ}ËŽ=oPËXoÉWrÁgþãc×î[µâåûïýÓ'ÿö»ãνì¦k/n®)F·qý(“%AãÂfëÕŽÁ8@>"@jÓ@·­M™YéZP¼Æ2Ýõ0¬=w+)AJ{ÇÎäÏ~^`_þ\êɧô—^š©Ü–w÷- Fnr†ÒO•TƒG™¦ná°R}Ã$…c™í»;»»£Œ§ëwŽhPšãÉ"½¸ ©¾°eùº®Ž˜ã8ÂN®{åÉgÞÜ‹åE˼ÃC‘¸×ƒˆ‡Ê}åm~äÎÝŒ›ÿ~é•_ZÖÒ@Žm9¶mÛ¶Ò±mÛ²-ÛÐ_sF÷k¯nÞ5Ö®5ëÖm¬:÷º‰ÈJÆzû“é©äp¬Ýp׌dJ’²¥%?O° .ð}êFÿ—i> àEo½_·ž3ŽÀ€T] %ǘܽšd8á¤s¦?þÊ3×ñ 'ºuãú¨áÓ ›+X²b†Ü.º ×œ|Þ[þðð]÷òy“kåPë“=:ý?Î]P…8ª¢ 2f¶ÿõ7'â²Ó |œ2}i›^ôã…ç,yzyYaÈZ¿âkw Çúvíëï}{Åóæî5EÍsÎ;inÓ©_>ë¹oÞñË_ì˜ß¸cíŠVýøïÜ<¤{Ö¾øç–Ÿõ¹ož6­âpñÝòR®ÒM(0ÑÚHTWðë¯aEEÚùg%n«ð·wŠ¶6zå˜=‹@2%?ò8¸¦nˆ3f4Z}ÝÝCQGèÓç-œ=}RC}ScMÈ´Œ‰SçÌž\ꪮ’´ê†æI :¦Lž1oÖÄpyÝÄ)CÝûz÷õGèÄ+¿ôÕk¡c;’ò‹«§MiÊh@Âr‹æÏ(Ь}=}y&5Vë³wã @«ŸÔTò°¶®yåím]àË›8ib¬þž^‘_uì´ ¡`áŒcgȾ¶–½=µÇ\ÿù›æVäEúÚÞ\½©|êÜ)µÅˆ^øê!ÖN³'$@àĶçñÇØì9ÆMŸ•e¥zIi²³=ðÚ ŽLZxÒ)Zq¥+Û(B~dqPMÝÜ-·×šmÙÈu»Mbrs¦ÛÉd까üÏí§K¨i®µDæDl§C¼GÛ‰ÜX77(fT[ª´ç<]ù>Ûñ Ýhp6ºþ½+é¯uÃãO½<õ”ËO˜QsXêq§ç/@’ [7~ù«3NóíëðqdNwÇ@Um ¿~ýëЗIEE¥ X(B¦‹½Ë5Ý02ï2æV4Ëiç”) áîÉöCôáš–¡ž7þ]‡÷aÌ6uLwžÉúí³'2 ã01¯ezøBÚ*ãã–’t_xöœõupxŠ:Q¶Ï0 ²òIMÅ¿ú¹,²€$€¾Êþéëð®{¹§ŽÖÌQýl”T|‡uOZF}ÀMÝ0—[0â|é­±ÌÙ©0·q ”ž1IrîÒó+¨é/‹€RJ@¸ýå€ É$J°§=2urž¡Ëÿø–ÿÛÿ¹¤J+ êÖ=”v(RNùŒs<ã&'¢ìÞLVT:ô+÷øtÙ¥ÌÁ”nmŠÓŠÞýlV&çrš®âhO y6Wȹ^N[c@DdŒst»o¦ô W!  €Kd€D¤ ˆœqB$Y[üòͱ”) ‰ë°¿ïVA)¨¹ ¶Ü I‰Q8b,æ¾1úøÜ-ÈUVÓ1wc¿ŠØNkªû_(£ gÅtZ{=´"Ñ ›AdÄ܇Ï%ÓÏuˆ0ûdjÉåNë>}ñIž ŠÛ(Uár1½Võb0#}Ñe*"J’„È%Ibx Ë ŠŠ ï“ŒéVQž6îÙrÒf¨¬%xôTS7µVT8”BÑkÙæ‘=Ñè.žqD1ØÏ£2ª€eØ­ü•TT8ÄtÍuY¸e{¼Äž'–rÒÿ=ºUr”ÄTTT8\"”`dZ¨¼R]•‚ªpØd#€k5G‚“©¦‡$Ò È•™j>UTT8ºJz­èÚu4N$Ñv³þM€õC«vF·’t{À©ì©Tûš#¾0L; !mVÍDM”„ ¸£¹upZÌÕvÞÙC­sü'T¾Ä°‰ŠŠ +ü2ÎûìjЋ/ÈÔ|E Ò€Û<Ñeï^ÚõÔæ¡•z¾m‚ej 3&U%ßå´û‡¨æµ¼§@çÜŒŠ‘Ѧû½óÞïvÔ¥êÙ3§í˜w%ïré@tÌ ÓË4õHør`I{µïÙeч£lØ(ðÙ,tò«dTÉEÅw¿æÉåÇŠû~oƒydåÂ\‰åw&”õ½YIFÝ¥½ðnŒmF}ʽ‡÷“~6RH·¨""tI‰À€uš»_~æþçYHèÈü‚WjM3Š›w¢Ÿ):~t¤ÃíÌ ý¢GÑ5‘$/¢POà IDATßß9Çþä~’_c‰b7È<›î8²š]î0Ö~<˜2¥éš@€y?"’$d’H#ÖníüGÿ_vØëmiéào Ljb³æZjT! Û™’ŒG¯T‘v›¢•«‡fD"I;ÑÞÞáháúš2†6llÁüÉÇL gDJ6àùÀÊߨ†TˆØ½kkk_$Ý1N ¦×6Mª..`ûÇHù5Rð¥³I΀ˆV´wûŽÝ1›—ÕO›X”R 2D‘ܽ}[×UV?eRM˜¤„±L9¹#ïIA%B‡Dg²…3Våod »áa›ÕòôàÝ;冘.õ×Ì7ÎXPpr±^c0IèVù"PU‹Z*ŽP³ÍÔFÊ«LK&D´ãýýmý…§|çKWÓŽßÝþ#6û{?ÿÊl+_ÇÐ[]šçÊpp^}ä/w¿ø– çD¶ð•|úkÿ~åâc8Ï!`Î]{Y^ªì•¼ ²uò;~yÇêݱò«&œpñ¿þë•Ó 5´ãÞ_ýæ‰×¶KKUÜüï_>I¡Ò¾Ç…c:’2õÊа¤òæ<®KFqž¾»µF8РM;/ïºÆÐ ?qâ’Däéb*ƒê¨^+zÒŽÒ•GI ‰™\?ȵԀ?Üðùýä¾p šêéîäõ6Id,wµ'¥ôj^Œ06’”4êk_÷ŽDðÔ{îù‚Ø‘H„ZAQ¡Æ²¼•Rf>"¥@AŒ3÷†¥ÌfóDº6ÿé·¿n Ìûᯯk®ù?ß}ðŽoTÏ~úº‰ÃÏÜs×s¢ŸúÎ-‹§×m}âÇßþϯ—N}úÚ‰^&aædïÑK›É±´† ×–¦)À”ÂâÚ+±§6E_Óy°ŠUŸ_ô©‰y38ãä0`®JšUª”(­0¾p0ý‘Qß–'ž|nWOgˆæ`Û«Ë^|kûÚû^~î±ezv¬|äñ綶Ǻ۷oßÝãÈMDdɶ•/?óÐ>ùŠ®ˆÍCi·¶¬[±fsoWÛëKŸzà‡ž[¾v˜cÌN ¬ZþÒ›v™¤¢fŒ…+|ÕuµµµuµÕ•ù~?CRJ`Œ9fd˪ç¾sóõÿyÇ2„¡ÿ9ÿø¯ÜþÀ¦=½6¹•‡¥t˜D‘ž^òW^yÝ5óšk ò¾ôµ³e*ºþ™7ÅpË›ë67-¾üŒyÓËŠòOúøWΛãÜ󓇠÷æç_xy{g ±÷êàKÍ¥f؆ Û!‹$1f¬|úñæÅg”^;)ïXþÿÛ»î8+Ê«}Î;3·ìÞ{·÷¾laé‚T±Ðl Ø…¨1‰&êM4¶˜5QTTT@Q‰ ¢‚ (X@z/+e Ëֻ햙yÏ÷ÇÌÜBQ±€‘÷üáo¹eîîõ}æôçAA&™ë’JDŒÌérAy#rEÃÕì]|ÇÝoßöÈÜ´XÞZ½vÖã³2†ß×û2ÿ“ÜW—~e_uÑþ¸~W¤ænYøü.ù´â’Nöˆss`ë²éSŸXߨtÊöTm¯˜‘Ü㾇ÿÙ/MÛôÕ¢§_[““•”‘nón_øéöò±7>ü— Aoõ³ŸÑ»Ž-*.°ËÁ¸’ü5Õ’Ýéq»mŠdÒpµ©þÀ¦Õ+ÞyãõµUÁò³.™|a?çÕÜÿì¬çnº~nißáç9«Wçü¸C"‚Œnƒo»€d³Ew3ÎÕ¼¿ú`ïÛ3Ûæ0¼}r×âK?^´ &Êk>zô…/ο1¯ ÝÍŽµt!vj—\í|oK°196{uó²wªŸKt%Är÷Yñ÷r÷7$‘K IF@ŠdìX‰ŠÍÉž+†.àLJŒw(†wE&Û=qñ.‡ 6GBZVõ¾/ÏšýÞ°lÔ[vox×évEË×huo¾üÒV½Ûôçï*Ž—êî¹ðì;þóæâ©Üvhkoí2æºßŽ*€qžðÑ’ WM(Oëtý_î&g¢ÛŽ;4UÛ4ç±¥‹WìVs ?gìðþiñÎÛ¾þjúeï}¸³QxÎ%s/;?ËerïçöqïŒÕ›>ž=ûåé÷./,|ÚÀ~å½ûä¦8 ‡¬˜8Ô[_œù‘#¥lÄØ.5k¿nÕbÒ\Šæ”YV¢K‡=p,•”•!!pDvl “¾’‹Uܾ¶`[@­Vö.iyIr(1šs@â¹}†Ñì@dè ~ʼn'}€öÆQ‰ð˜Üà$ÕUrá ¡Ùª‡ ÝÖX»kGU|~ÎÁ›V}ùÅš Ë»Õ,šÿµ.1’² {œÚ%Ýxi§!EZ‹ß×êÉ™WTšŸ•¢ €.tî×%æ›:gI—_Ú?^ŸùÐ ï¯æ ¾õ÷›n~à…øþ—=9û¹;®¿0Ëňs£HË9Af·Óÿú吏šzkzý²›oüÓÜvštSDˆèoÜ÷ú¼Z¡\qó=ƒÕÖ F$Ɇ ا ¤¸ô.]JÒâtÌF‹œGfrbLªÔ¬V¿ß0¯.بJz‘§Ç ÏÙ@ÈŒ¾¦¹jUŒ8<éË6ß•!×ä¸^ðÉ¢·Š{ž:êœszwJ! ¤À¦ÏÞoÉŠ­²;õ|ÁU§”e¤&q©wßú'Ÿxb‡Zxïê_–MDR’ËçðÕ4uˆûêkQÊíâpç’ñ÷ÿP&…K¼š*ëi¶¬óÒ®öHIœë’IyÈLɠȯUàð¤ÏCP“c ø’¡Êškª¼YŠ¨Ã·ò =Εêضߛ–‘‘ ÔlXüi}öø3 øÑߨƒÀ˜"ËÁªÕwÝõŸÌ‰ÿ¸é̪µ›w§&‹Qd›Ë•_VžUÐyxmåæõ_¹jÍÔ;?ìÑÍ¿_:ë÷—/ äôîÖíÒë.éZZ”g“L‚dµãàï½ÕäêsÇõW§Ç˜G¥äüÜŒeûWýgt³I-—-_“9êñ|®«šNL’%†tŒSp™"DŠ†„ž71]. óRa2 ‹ç\ O@ñˆh,ÖÏóÔsO>™­\ ×my{Ák Š]ú^uý˜œ‘£ÎXñÈs·ßÝpî ²¦m+æÍ_rÊï”Ó† µæýsž™Ãó^2n˜;«s©§ù¡;n¨]3ª0ɶsÕÒÏ*ðwwž–è²T²=65·49«Ó€ÓϬع3“Ž(õ}ßâE‰›b2öÂÄ+7~ñÁÛ‹µ¢3–¼=o™©JéEýFï>öœáÿxôÙÛZöö)°¯]úöúØ3f_7HÝýÙ»³—l|Á5#{fÈ?(Z´ÐHŒÛt¨/u èì( ²ÒAfÐØLý¢H# x”sD€w?1õ®Ûÿùçß-Î)<ùÒÉøÎ;ŸPú‡Fî3fÊ´ÔÌÇžxöÁÅóääÒËïyæš³ºsµíhø×ÕŽý;5{©¦s×5Ӕ̛úðs¯-n¡ü^Ãþ>õºÓºçÈ,¬ADLRž”²ÞÉÆDÂ)#Ï Ç”Æp3þ©·47Ôiþh××Æt'1ƺ¥‘Ã{÷:wò½q)Íxöée­Ýϼlþí×æº4jo¨Ý±£¢Ô$2´ŽÙi! ¡Î™Ô`P7Æ.»ƒÖ0‚EJ%Nì¯Ö~ð8¸E¶M„ì¥ng¹®ca1`ÎuÆ$ë)@dÑo'®2k¦†8 ÎÌ8ªL=ôYÏ5&K1œfF0úqÄ(ù";ÊIç:á¡rÆ\çLb¾ª¯.Xš2øÜ=²åcn,˜}N|këêù§•Å—pµ%` ¯ø=ï憀Óa“ÛÆYgÖt¦‰¢â û’‡-R “ 20² ôsgÉý4k!pšÌDjªFŒKG`7šX-¤µs(¶ÍG˜– ל$ 5zë¤äŒÒœxÅXÆ?¶±l“ å´rçÙ]•r8Ã׉¡ðŠÇTE=DUꕈ]ÀÀ`XŠ-a„c„? ïðF€ÊÔµ!«V‡~ð÷OÜ(êS£î*JYG¾ã@$¶#ÿÌïÝ @2&K‰ÈÂa º÷ŠÂ¾_páÌ->ÒïšNTA5B/Bw²Í ìÁãÛÄ!Fhš¥ßû¾fqš†J=d•šZ éÑaÁ±0á…ýd`6¿úÃÑ–µ‰~X@QxEa?Ë-ÐT‘â€A Òu]%€›é©ŠºÎ5Ò- ’Eá…ý,~‘7)Öú/³82¸J3þ Í€U”q„WöÓ#1œ\PX)<¿‹À˜fPò›tp`ê¤ ûµš $>QHàf·„Ùˆrˆ/gÜN#"f4}Œ‘pá…Wö'áÅ ¦··+w‘/¥)pBîï`ˆÐâ¯_›€¢°ŸŒ5¤Tß}»ùæ[[7{†p ÿìãÀ¬YàmF‰‘Ù쪀¢°Ÿ%H Æ&þò«ò‚·ô•+)àÓ¹FŒ¡ïj›6Ý·n-FL5 Pö3ј¢ Y“×I ¯üŠZ¼œ8(Ì÷éÇ°iƒ­±A¯Ü™¢€¢°Ÿˆ&ϲÛúuÛ'+ý_¬CU—üæ;€Âd”c(Ð PüIEÐL…ÓžÐ׌z íR‘õú_L¦HˆH芥®5­¶’¯üe¹ö¹é¹»«Á^PäèÒ ´·(BTÅ£‚! ]‘GÞú™ Šî¨7qƒŽGjȉ’È—ùSCs™A7ÌXàæ'†Ÿ0ü-"S¯sÀ 9pY–ûŸ Ý{Ùä h÷.yö|ÒÛ¹,ûNéÎzvFë’â¯Û~vÍ ãg=ضcûŽ ’\Vœg§ºÏ?_‰§ è–d,ÚÃ1jf“Øœ€µÕWnÞºËÛ¡ÙÝIŠŠ2’݆vÚѼkë–ª†696±Sqqv²'rõ)´Ø'jÐÚ, rÀ’R<ˆo\Ç·oñÝ{Ÿ²n‡Î(’ÁFŸ L&ƒAø&bTÅo¿·ä€ =ÖÎ4,]øFS\ÿü‚<{pãÝ·]/œ»hê@£zQaÛ%£o8tĺ­Ÿ<ýôÜUˆ¤‘”×óŒë¦\Ò%' ‚ ïÍyì¿K6ud™eƒ~ó›Ë{ä$!cùA'ªbòz3)6Ö6ò zçm¬ÜÏ_zÑ )¨v/‹>8pÉXžÌ6ŠG PÍ•]îoÜWÛž’îqÊ ûÛê½rLRŠ›WU×2ONšÝ»»ª5!9iÔ¸‹|,)Æ Ú“%ÍB–ÞXSUçí°{’ó3“ˆëz[ks·§ÆÛìßÛØÎR22S<ȹ®ëÉîJJðHÔüæ³¼¹9ëÁ©ÿ.“l^úðo¼óqç¢ËFÔù£s¿8ÿöûÆ—gµï[õèôgžžŸûßIpHj ãຘäÌ„X›¹ï{"J"hª}› :zi)³Ê*;"S»JÎË.µ»]º¦‹Â©€âw¨ˆ W~úð£_^xí-ú%ðöÚM/½ôAR¯Ë®œ=s†V|Uéç?¬Í˜tÅÕÁ]_VRç‚„›Õ¼£nùÂ×ßýt“Fº· ËGOšrÁ`;lþzÙg›s<Ò¾ƒu­¾©ÄÜK.™4²¼Ð_¿ÿ噳ô¢a“'Žòö÷×ó†ïž ÙéC{¸¤º¦_1ï¿Ðçâ«Çõ‹€¬”ÑV?²pپˆ%fÄ5Un˜vÏãå¿àâSsB¿ÇÛ%šÂŽ@!RZ†–Ÿ+KLæœ4R‡œ–pÉ$ˆ#Hhm‹U”m¾ÍÚk7nÜÖÐ4Θæk®Ø¹cmH{öî^úæìIÃ&O]”à߶yËÎ=U=Ò?_ôò¬W>Î*yñå×\5¦ËG3h7*RGÓž%ï½ùuµYépÉeÇ¥Úúõ T­ýûŒ97œ}¯¬qWbæéc†÷íž#\yaáœé»ªªõœüŒs'^Ž’bW›Ý<Òº×^œ»‡:MìßaO)q†>'ÁaSÐïm!ð¤_yÓeGL¨N{\Ñ‘ð‘±E ÚÚ}óçÃÊ•Œq]’H…ö®²2ˆËþˆb-C@ñh·õoyÎ >y 6«o-Y¢@Kû¾ý¸zÁË- 2IÚ¿¤–_·¢Ó&»²²< Ý©6©ª àpÆÄXLŠHk¯{ýé‡æ|Þv÷ô)ŽØkJ,E;=ãÁ$%Ö¥qn’bÏ\­å}D â\ÿl%Ξ#kšÊ€é< æ®»<ãÎÕ ¢d1O‰U@ñ(•Ó£zÌðOÌîúÖ‹pUU«6~ñîž FÃQ–mYù)Å "2féd ù_+ºSt­Þ~î_³>¬»ñÁí‘É SÒj³¯#äôš}AÛÝ.£`Lº‹Ï>žeÓ^³A& ¾Žà'òª*@[^'¬¯—ÚÚc·o TlQ »€Îu! RP<âÍÝ QM¾S«ƒ¡û55 …¸}¿}”F–äøÄ„³¯û¿;Æ ˆzBoûÀÇá(Ó%‘íJ­µzÁS÷ÏýÔûô#JŒ\ÆÀžöÙ;÷wÄ ø¿9¸×gË/Lp@ ·qŽ ¦}S í;}çŽà3Ú”Ûnõ¿ýŽºhqŒ®ÕÞz_HŒPB´¨¢ls´0Ô`NNqkÞŠêj ÐÑÒ°u˶ýµm¦Ø=ñCæo"æh8'“’K ’Ö¼õáŠ-ZÛÚZšjß›;mæ›ë@R#u¤€sâºoÏŽmßTÔ8">yeêc j¯¹ÿŸC³å†úúúºú¦Öv0dÒyêWï/X±»µ­åÀæ•Ë?[—;ðô|‹ƒÍ[ׯ¯ñú¢åZ›SŒÚ± ApûGk›\x¾2a¢íœÑ’q%mÞб~2 Èì©’èj¯x´SE˜9ô‚Ó¾óÖlWsy,øÖTÚ<Œt0«ô‘©ZD¥Ç(àHi#ÆÿͬWæ>=½SvR ©zû7u.en-D%¤hD¬jsÕ‚žÕ‹Î¸îÒs¤Æmó_[F®ž[ßn]s+G ¶ùÒúŽ˜|þ™Yƒ¦\=jÏ‚ÇؘŸÚÖPÓâ)¿ö¢¡§LˆÞš­OÿëÑ~7=4i@îq® ÂQ@f9‘P§@eu<@{vª4qKH°>+0}šc÷V]©~¸{ö"´*=BLñWmÒ=÷ÜóƒT Bt–v/s£®º2û>­kqAA~§Üt7“é PÍŠ/kú:r ŠÝíwߣ ì¯\w)²Œ·µìóÄ¥Û€ÜÉøø çĉ–^ˆ0Å#¨¡E‰h†úð¬èÑ.!˜ùØa…žpbÁ°ðo±Q!d‹¸FhG "çœk†ºº˜¤,·ƒYÐ8®ET“À91 Jz55p»Ì\IÈ8’ÂZÿô{Ç#3W,ÞŸ|ÓÍd­I 8Š²Íl¤s`JpÒb±p’2F?u˜ßˆzÈÒª‚Ø–¾eâgÖÇÉæLÍÌqÙ™é&#Ã]ÎKŒIxcþN©ìÎÞØ5Õ¾Ú©7_þÈ£oòꄸx·CÎé=ì²³ûÄ0XóØy“^çòIãû¤N¹íoàˆs)Râà±Wõ9~Çæu«V­Yóñ¯>[’^rêÄ ÎÌŠ‹ñ7ì|õ…× hÂÙCºÎy_ õR’òúÞûä“®ŒL+¸;X4ï ¥8G¼ê Ôà*mÉ궥Glň¿0Ý–O\7frBš&ü ~!ÑQP´ŒëœG‹pÎ ˆ´ ß“Q>´S²‘rΣØÂToöUrq÷]ëVVê~ÉcKLÙûæk_&ËñéÅ}»Å0€²Sràåf_«ÒY¹ù¡òÈÎø.å§w)?½iÿ–WžyxÚ´g;ŸÚ7;Þñå;/n¡.wþvœKÝD’ÃæPc 8Ý%¥ÑJ9ÑuT’QN°';˜²«}ÕNÚª¢ÎH–xAIL/NºE»*¸†ŠÇ‘ù¦0ÅÃäŒ éŠ'#\÷<Ì#hAµÍÏýõ{7¯ÕPW1(åŸ}n'èÐ ˜¬8d‹DŸ#3j±Öé=¤òѾꃅï/ûlo9fTQFrݦ7Ÿ}}Cß)‰÷×Uî«jòëmu5{kKsRl2ƒ_J’e„—„ˆvŒe²´Þ÷™®P«¯åÂÌÉåîát "dáµ²Z¤¡^©POn(FDE†”E¨§éágé[oÚSbŽ¤g]>np¬îÓ d›CF’íþ*E!ŽISšCЗ¿<}ÖkŸÔ©±§=ÿ†+NÉÉHMI°/Ÿ9õÕO«w4ÝúÚH× pûÔ ß]õÖü‡;§Ú1§×PµB”Há :¤@@í8=iìà¸ÑÀ΀˜kþ§#ˆôÄ>¹¡ˆæ˜$ ìrÈz #0îÑõ5M [²e<š3Œtž¶„ØÜŒ˜õÛke›˜à€ªí_×@vy±‡K@Ì90Æ´šÕ¿òÇm÷ó®øÊsSc·P:ðÖ%õ$`ŠM>¸ã±»þ¼kÀ­½hT¦GáœÐh‡à/£üHÀe’.!`ª#gˆû,88#$ Í„[d³zŠ‡ÖþÌt; ê—$óWrqËmc™™ˆdV\&è2-¯ÕµßMío|@÷¸eK® LCOßþÃìO?–Yq•Y7B"bâšwÔ¥ÚH® »àðJ™—黑H$Rn$‰lLIþI{–-D^ǘb ŒjØ£r¥0Ã`sp~bbA½n·Z5‚ÈÞ»äÛÀ6câ¢Þð̬ì߶<>¶Ï¸åØž_Ö×ì3Ö¿ô³bf)ž´Äë³32¡Øƒ«6«Ú°éŒbg'¡ðø÷‡fÔè|G€Cyß0çö,^dª  Í/".¦AÇ ?2…ô’J¤us5f«HÞûÓGÉgSòÒ“óÒO§ì_ö˳ÝÖ®O`3«Jæﳦ^ùÉáä "ÀRÉÇê'8M0³·sdˬ§Žœ5+ÝÇv/þÜe¢ŒØ‘ëØws&öÚòË)‰‡Sý¶íó;¾œ2)Ç xÝÿÌ åÿþþˇW¶ÿa…Šù¹}?}x:ùl^zrÖ©‡yçÛ[oÙ|Dÿñm9ÊU[¹U‰´n®„G¹nø”j s¦/_üD›6óU¢¼í Î5ÚÃøö«% ž½ :º¼±²oüê½zµ3Ì3Ÿî?˜Õý­{ ý¢5ÃÌ;øÃûoÕ;¯mëº¦É R,ˆŸÖgÙ[|òM¯h߈ŠCo¬ùõOKZ¶«׾Щְ§ëÃ+m΄… ÞXyqݘ ÿrÝ:–pláÂ…†a‰‹‹kÙ²¥,ÌÒº¹šÞšÌ¯\Kw@ÅÁÍ?†×Ðúiÿ³3’R˜ÀPý{,eÁC‡S={Ñ[³kû(6ðâQªH_û´aéÔ¬U]Ód""@xÐfÌC®ãÛŽe RqzË'öÊ·¶{:2{ÎÁc&q9ïsf¨=´óõÖøç™ÿí·OvVö–`ýúõ²øJ¹¹Š`fŠÜs‰šÃjW yvÙ’Ý`HWÒªTŒ ?²s½ª3SxŸêl™ûúÙ•åúuoÞ¼®)øâf¿™´å˜_«QV:ß ‚Z±m¬#óðþtšytׯ' 3,¶n½ãë¿Up¹Šc¢Bç~ÊÙ.Ïü½ºY‚¥Ü\ EWEơͧ÷nLÚ¿þè¯o/û|vÕNO¨D§ÎÐŒª Å¢´ÜîøòE…€‚ëznÁòå'{=þœ…þÈqK0 ÜŠ5Ä¿ŒÁ°;l交¬š›_¥KÃJP44ïÓãìæNDåKÙBAnSÈç&‘¾›«Qn4óÔº9iÐ+w™ú[¥è@†¹}ÿ ‹ž¶`J<nsÙ¹ËÙò:?f…z];ålV+ØQ¢{©<“ ¶¨håÄÁcÜ3ŽMŸGÌŠ‘–ž©†ÆE“†};â-yÚ§Gz­!»qtc|V×–¡åª—ût¼°Ä9¬€T‰”›«áV›Œ¿šI€H›—‘äèóÖü *ôjÒÑo:ºffëú˜D``…ÿÌìd1}FóÌ—²ò{Û}ÒÄ œ‹Òüju¯c£¬Å'ˆ.oÿ©Yά}qËòÐb:¨lcOEö†y;Cû̶Kµ‘ÈÆÔUë·)ý…Œ=jï>)&ÌÏæ sø5èÖ-s߆,¾h3˜,X‹þ,6°à€:ã*¹–¿1)%ÝeóƒÕY{¾\òùÌj½ øb¶Úú–¸GÑ…«·ê[²7Ýí»Šf‡Å‹äLXÿæíç¨Fîõ„);}%Òº¹ú0õBWiKÌœ#ÛOåv»µ™i0¼6ÁR{Xí ©«Ø?hp}„á6Ö³o¯¦y^î'Mš$eBZ7ÿb '  ”­@†îõØ”,<E§±Ý8ÄUaù—ðÆizPÂòÙ@å^ˆuè‘÷ÞÊD(Ÿ›Dún$‰”‰D"‘r#‘H¤ÜH$)7‰D"åF"‘H¹‘H$)7‰DÊD"‘r#‘H$Rn$‰”‰D"‘r#‘Hþ}\…3™@`… ;Ap`8üÀÃð#(N†•`- ¦€Ðþœ³œ%-‘üç­›BïnèÓ>Âä‡Ð»n —?|‡ÞÝpCOädãd"útGŸîx÷Mn»}ºaÄP(„/>EïnÐÙYˆ_ï öýw" ¾}{ ~-©5‰´n  û ÈÏEó6ðí»Á?Q`µ¡N}´jÍ›‘QèÔ……hÛn [?‚J±p]cœJ„¿?ìÄÕBû.0 4l 7Ðý$& 5TféO‰Dò¿r®æwü(íC¿Á¹ÉS2ØœâÍ ï¯²1õC®æ'Så±â'Ì›ís¾üEE *ÿó…Á¬„çËO@“Z#‘ÈÆè|3‡DªŠ XÀ(Zv—™,Ö ,6{9ñš èDT(ÈÚõù‰Sžú½ÇÙ´â ²f#E«÷±ÕO«6RËpV[yWtƒUh%BQ¼‘3ûæ1†j…¦ÁSp‘%Ì™¡’Õ£¦`¹¤DÊÍÿÌÀ›Ð° Ü3©"m÷âm‹><}ü4³é_¹EÃþê·j®2Ñé_Ÿ]úõeª¿ÖòÕ±}²Þ~êe«UõÖç¢äDõѳ{ôjiÖkE€¢áÄoïÏiÚà†qÅõ›ˆ¶Lv”›ž8Ù·K ‘+qÑ'/>3|æî/7?zÂS¦Y&Œ*Ãì0ïÍ9Þ+z· '@ &ý?9þ÷ª¢`³ÐÙ¬ùÈg®kT›™ ×±Yw úÖÖ@UžÝ:sܶßs†Ïþ-D»@i˜TE?µòõ¥ŸÍoñÆž&ÑRk$Rnþw¢cYDtà£Ñ›ve5¹ã½>Ík!cçË?¼wÿ¶'FÜ;˜Åb÷n9êåOT*eû¿ @Ñœ?ŒkóൟeQÈ4y*˜Lœœ˜LT«·EAÉ= T{€•K[GŠÕê§lëBptÆÀßm#ÇÞ;ÂÐ@˜¸ÿËÉ ÎÍ¿¯[“)ûjWòÙ2û¶9ÂñÐã‚BÖ¶Y?|x§9eE£ŠœçvYÃnPÍäåßL}®B¿›þK©Üv yVLéëŠmà§ÉÑTé»ù{øüŒAv ÿ—[´yøû¦Mj³Á¦Î¡n2õËNZ•èTba@˜çÿX€PüÕ`€…áû‰Aá«ÏðÍPÉLÝ›EZpËŽ=Xx£ef€Eñ¥Q⊠a_ ¼_MCZŒoSÛ³ó» ¬*2·Üón Á™N_[×¹S½‹v˜±»úè÷‡Þ;‘ Sk‰´nþ& ávCAú²÷a£ëÖñ×Q!ØQ;ƻӓo;7Õê(5†ÆpÿážJ°r T £oÍ=qª_͆QöÝ‘bµúÁ,Ú¶Î(×ôÿpJ°ÚTáÒ¨”sà·¬f¯Wfæ Æ½‚Föź™X³^ UvßK¤Üü}4m ?èH?™ëWã:aÌœyl³³P'P"ê¶rX4€ŒÜ}³Çµ)yvç'–U ù£øþPigO*¶°Ê¡ÞÁÈ¥¶lÊÞõÙ{£?,a#ª6»ßÿ 3ªf…)†óôú-»ôº“Ú’€ž¼þŒ_\/?@Ð_Q*–J#‘ró7Ó¦#Zµ‡Á ç7|;¸ø½3™¹`ÓïêüÌϱÀZ`ý1¯}¬”hýÉŽ‘…Œæ€@ö¹½–  þ ¨tG_ëÈûï+ÞPÛurÕ7¯Ný·góüøáß¡È iùPëÚ!8»o[pt{’;éJ¤Ü\1¾û›~ÃûWlU[ÿ|Yž¸ÉQûI_PŒä¯Q¢~ Ý2ÓÔA¬OAU•jsŽŸµ‡µVLÔwanË¡{þ‡ô°>CÆ?ì‹fµ g¬ ï´rçnɵÂUè*NMÁ¹³Lðkõb¨ÿîM‹ÖÙl33C<9n"fþVP+ðÜcxî1Å} -KØ¢;|™ë:“¢YìþV»¿Õîo±Z½—S‘tò€_ÃfAŒ‹Žf†jõîÜ+‘HëærYá‘$ÀˆèyÛKfM˜jøuM®×3?yçÞ_D4¿£BˆŸ×‘ÁzΉmËKºŠ‚ãZ¶Qÿ ‚ 'qU¾ ŠZ”gÛ\~ž=óòâºDY`ê¸9+Ó)œ{¡x’w­Í$ŽhØ%Èš¶â¹{ãÆ|Y£²M?uð¸ªæꪒ¹UbU¨%•H"åæ`ÔÜ2LD nóÞ =‹Þ=¼z®)”êmz½´=:Âjš @s„ûY÷ýòyɳÂÊ•[·Q½Å¬DÅÙ-%äDnUÍ9¼:¨BÃju.T{pt‡–¬ÆŠæ[RÔ,!1AÖÀò|·Z@TU«ZÂœ Š@xÙP„SûÎÕiÚŸuß׳Û:˜D  ˜¨#Ëg Öìd¦îòvqΦ]‹±ªXckfmø$ ÞaBLL”)õFò¯á*œ¢¹s3¶nÂ=ÂD¹~ ï˜]æ‹â/¢yű0ûºÍ¹ÈÌ(ã%.Šö|üç'sú({%¾{ƒ–[É;,:~‘´”¼…òûG™ )œ¢)­›òØ´×a‚WnÊ©KÞúE<³tˆóAm„I÷CUðê»xG2 YJþ¬™úEnl )u’«\n¼Ó1]&~[UEÓV°Ù°íw8Q§*UÆþ=H=‹ð(4n‚ÔTìÛ‹ÍZCQ°y= š!,;·"' 1±¨wNŸÆу°;бΪ‚Ðhî;w¬sFT”uæýNä—qöÆQ?Úšo)”ù!¹ªåfÌ]è;[ã1s:LûA½†xë%0£K/Lš„—ž„¡CÕ°äg̘ƒu¿Â0ðø ¨T3¦·ŒC×Þxý0#$_ƒYoâðè:j‹¶|S4u€ÙÏœp)˜VÜÓ8X+pÊî{ÉÕ/7þðóç*Õ°`ðÎ$X°Üçñp1¾^âs¢ä0î{÷?‚ÒÁÀß.÷E˜Ãxñ-_ÝÀ]ª±¸ \µrsQßÐe•r€³¤ü–ÉUy×DkóOŒH-,’ MuÆ¿Ô/þ` @À7"EiMQ0ŸXøþ ˆÁæþ«R(gË# g-!¹Z˜DÊÍÿöîv奜.ÕÑK™–èr‹KË í{®ù‰Ì‚k°‡`ºÎæfæÉ‚.‘©Ë+¤žÌÄ´¤S¦P‘µ"+G³Á)p¦ßïr*–À°ê×ûûQö%G’lUm´Ç]ápž=“V©n3åüÚÆÈ9¶ÅX-::Š=eÇ™Tµòõ‚ûìþͺ¡…×o맂dþͰ׌®R‘AžsÏ¥¦«–à˜:°ëlÒñ“Ñõ[Ù@Aæ¾u\µc¸¿_#<™ÇSÏ$A ‰®Û0í@|H\ ?‡ ²OîÎËÎ…æZ¥a@€ÕÛLQÈÌ8±'?/_±†UkègW™¡h”u|GnŽÓV#:R?yÔYåúëJJpKM<êÑሬU¹‚0JÚpÌLŠÈO;¾ßU¨ÛC«FÅƲ`"âÂÔs'ŽztÓT9ºFu2Dù§ÏWáxzZ–X©b­šú¹ÃçΤ(ö¨È†õd½’\£rCeY^\»g~=ã‹èf¢‚òŽÇÿÞýž»0‹•ÏJ¡˜ê 9Öœ:ªx…qæ “(÷ì±À¨ºŽ3+×}¿jÄó_)%:ÉÅÁYË“ÚÞþÀ†!Ìyj{‚³ëôߪ¹+ýð‡Š‘»­XÛ©±¿ª¦lœ9É]©Ï°G_ãÐâWNžsde'|e±U£ô]óWÏÿ¡îƒËÚT÷SÍ„_§Oí4kmñm9;çO½/¨F§HÿŒ_©ºsO‡‡Ž«ràÓ[÷ƵºA?½)11«×ËËbˆTl{§ßÁ$kÝGÖœLQL[iʼn¹7¯Þt.®u/OÂÔÐ&µwÿqgËλTÎýö唇®ë[Á<¾qy`§·o¸±c‰qEDª{ùsý3¹b¥ª•’÷m ï9½wß6žÌýóž¼Ã¿f‡*ÕÂ’âç…Ý4ú‰‡Tgâ_Üv²‹_°Ú žßæ&Z[OvÞ×¼Ëõ‡¾žd4œv·¬X’kOn»¹aÚhKÑ”‚™gúUHCüwŸVüY×> ™Ñ¼uµO_y7kP—ãTZjv—é¿Æø˜”²w£]wµf™ÿSõ®·U ± q눆cÔÒ­ªˆn#ÅCsó”;ífÁ‘Tg•ÚUOïHªÖ©röÚ9jËq5ƒí»6.AãaƱ¯Ý ú[ì× i‰»coþÑóö­…zL°õì‘U•ú=¶bkëû:ŒwVŒ«`ƒˆT$}3µŸ8±?òöÃû»Aä><ÃNeø›+U:!áÛ×MŸ>üÙG<[ßØžPñ–w>³ 6aç‡7l˜9{ð„á;vh>nyã†QŒ7<ßZtñd*²b×Wu˜>xLGÍ;·ý´ܡƒJÌ7Ï]~_õ½ý¥GIç­ùæÙ·Ó{·É\p¯R{òIƒI EÏs¿ûTÚÕ+’j¡ì3ý®* œ#ñ¿/ýÂ7 !Ìsbñæ%rh¡äšóݬ+µzÝÓ¤ï]Þ¿¦n V<q<ó¬»b󆂰µfŸP3!ñ, TŽŽ²¯{ãÎß—|–šÛ¼}@€µx1¤hšÅZ¦Gw Þp Â}ª[7m[7ýÈ/*<{6¥ÔoR³bõy)+H\µ)¦Î ¸ )dz¡xöœK«]«q\ãë̽‡25Kaò^³IëNâðìBI‡÷„Vì{—,FAâ႘-øÅö$…5íÄ1{Dt  „‰Z}ŒüM†‰¤C‰Õkø ÕÚºr¶²~¬0O ¯î$¥5ë\C”pk©HO>’kL?´~á¡õ 2õ´„³„qhÙšÞôz‹ fF`—›ß›eÉMØ]©W/E`%¨jŒ¦'$å(°©ÅtQ°Ø‚¬öêÃf·›†.÷Ì‘\ƒÖ ›Ý°}EGQ¥²ä"‰ômÃ@ »EÓÝnjWÖ$¬ú"ñÀÆÕ¯Nç¨}&¼jù³«U·î™­ûââ¾µµQ¡¹3ña8] ÷¬TÙß¿¥–1ßÅ8”x¶f¯Æ¢ù¦ßNT«8ÇlÔ?„A½Ç/\eÖJ iZ!4"€:]8wlcd—gq~òƒQèQmªïfo7†GUmÅMFU³1œÌð覦ڼ*I€¦Ù„(€p á(ÞÔÁ\jz »uÓJéÓó|~ôÊ”š¨Ên[,¼z S‡¦é] ´{§xCµY9§Ð(Z&Þr¾-K¾›—“Ó%ÿ9W±Ðbüý rR=ha€\‰¹…! ÂÀlä£j‡;ªv„ªaéÝwoŠïÚ9¶¸ÊŸ;U²" T¯Óøèö%g¯j0êaPɘz:í¨‰Ö!¡ª°Ôk“v$ù\nv… ±ÐŒÎ>Ûv v››…öʃÔ䇎¯®Q³=s@ƒªÖsçv¤ îôH„¯~2ÙBƒÌ´Œxë¹;“™æ.8Á …Ü9‰Š«( pÍ`¤3r朱ZcHÐ,Y.ÀÊ JÛ{BQjŸO‚èR›Ol}3ÁÔ Õ¢•˜ð¥FG[NœIƒ D¤çœ9n¦&¦£z%¬˜Îô|µR„ŸU#ù/6¦.*7fh¥º–¾¥XIÑhß¼™¢v÷Z¡àÌ¿™8"Ó "ÃÔMÃf‚pzHU¨0uÿÁËDéårˆÚ´‹'qÝžd{l¨¿a¨•š…mûé#ÿnã¬ÖQ©gÏCß½á©9*Xƒ_t-8×JάP³¾T{Å@{î¶ø=‘u:›‚âz·>¸üg­n*ØHÝ6Zf®Él­Õµ^ú·/94+ŽÌ{€ˆlÞÝvæঽيF¥î˜??¸Ë“•ºR¯ÜvÄM*iœ¸ÿ×å'ÂRÝ/<äxü:ÍB0’6ì:Uj C]‹ëÜ;yრ¨ä:ôåv Ê=¸tóÒ… ª5üf?ý@¢®ªÈZ3éÛWÞÖµöà¡Ù?ÝŸ¯CÑ(kÿy6[½*áBÊä?gÝ°ávæ–c£;³É`0šß5ÓþÝsŸo¢ÐÃM¼GxX‰ÚmLʪ'Û¸tbÕQ³çãMÛ464´îQÅSmöux¡G½ãë¾^\«Mo¥´óCÚÄÙÎoc·il"¢jû”æö˜^¬Ú?ÿûêÞ{ À?¶š’¾7¯MtE â׸~^ïlß0€¥Ö×›ƒbÞÆ:ØHß·tFHÛ‰aAjh—ÿõøöˆºÍG½¡À°ÕòÒû¿}2üó¬ÔøAË®qlúµòÜ´uŸöý"Ç5¤Á¨¹MÚE³@¯{^øåíÇ?^a «Õ³×¨NóæØÈw¸Á¨~Ã+°Lûæþ&[d³nß÷3(ïðÊñ™­ûåˆ7LkÞl¿±P8*wøÜsíÍŸì’÷ÎO¶ÓM¶WhÕmòÞ¶•pçyܾ5 …^à)ð=“B·Ë)땤\®Â(|~]‘ͺ‹¹Äê?À ÝdŠFš†î[t*iV(Þf‹fQH‹l@°Zà)çLkýîc³v²b‚™5;)½Á€FV+ôoσÈj‡é†a2@š*Áãb1³b%‹º‹™ÁDV‡ï~ˆÈâ€YÁ…Yùî ˆŠ*›Ðs’¾|üÆnO®­e|{„Âw·¾u)RmPoã ¦fŸÑB*ù9 d/¿ûëM×~¢°¨p2RÉâ]ýÏ„îa€ÀL²hp0D¤Ù „ ÃãÝó‹ÏòdXµ’JÐÝ €,¤iÐ 0TRý0¦IVèš¹×°\55A.@!­›‹Ë$ %ÞÁ(8ÿ+›Ð JüæýWÀ(,›ð…ô˜À [‘é†ïŠÂûz–¸ø+0 ½kc÷ëðè¾ ¾[ò†ôÝ¡ðÔ§ ^[Òýé9áA–”µSÙÞ<4Òîõ$™˜¥á½»¢ûñg€~ŸykZPßÞ#G²;kÕÒ}uÞÉ:˜á1Š$ ¯(œDl”À%3Ç—€2gy ¢(Т8Mxä,pÉÊUü7Ið.'zyñ«5iè½Á«ß¿Åé¡õ y¢ÕÛN»ƒ¯ëSK÷Îyð§g‡²R{Èû-;^/Lqòå&ž)7—HVõúînöÏ !yÌû_üz|üðÿ×úeW6÷N·é%îH¹ù«$vê;á!GfªÌŠK¶o€³Í:hn–ãý$׎Ü0 °';ù¨3ß RmAÃ*Åù÷,î¢È©Z'§j?¿ fÒˆ„™ùÉÇFÖlfÕþ†6EaÚ®Lg¥ŠÕ"¯@­%äžÞV¨ÖŠª”zl‹#ºq`Ð%ìM¬H­‘”-W­Ò0ä>¶äÉŽ?½ùÀº¹¯løü©e¯ýæ¹'|5pRȩ́Ý?§P˜´æÓgó õ¿!^雟[ýýæ+³,ž‚cËÛ¼ú ¶|ýDâ‰,Y[$ÿQë†ADƲ—n3âîuÇíª¦`=cà ݾ}!|øÓ+ÌŠFª„ S÷õêZì: úz‘ Ï6±(0L¨:LÓ7ŸI±À;^Nè¾~h.³©Ã4Y³Ð‘}îʽü4 <uǾ·Ô(„Hµ@QÀ%ã$²X¡»¡Ù@€0`¾Žm…¡{.º§‚¢‘¦Awƒ™•TKɤQq_’ ˜³w4€C@ÕßžÅe/Á Eƒ÷D¾.ð~ê —W È2 ¾Í! i t7ƒŠ’É0õ?ÜY"åæj„žƒ/Ÿ=<àé»…}8ZxëÇ–6627ÿüÁóù¶@‡Ûé hzó×] â5j|Wú©½þHJ8Ñä–w›4«±jØÂmÃj;~ñX‚r6ª•Fô}`¢EAήVÎýŒƒâ<éIõ‡ô»ïAò0emþù½©i¹ÐÜi~Õô|ìÙÔFÖ‘>ûÞ¤cºµ‹ùàî;¿±62Äž¼ê¥õ‹~´DÔv§ž´×ÜwÂÃ68ö11I IDATòÛ³rº7Ï9™ ŸÝšCÍoxvz0‰ÝÏ´Û4~ü÷åF-ÍÔþ©Uî4æF‹kïòw¦¤ä(6g!¢[ß5#.6˜%;~é»Ï§ø+Ùº=®Ó=ïVˆòK[2pÑ®AUëÙ˜sìwGí;zÝ=N-!'̹‡—ðXF¶pX=N—­á-Ÿ4iUBŒùšÕ¸ùWuuŸ}Ži#ÆwC±Ðž›î1ú¶¶É«¦mXô½ç:“Öæîn-mV¹ãÎ{F˜&R–>ñÃìk¾ý‘Å€Å/ìÔ¹‚1ÏÏdÒ¼ý»E‹š´yTsY¦×~mS¥0˜ù‰_>>"-m\%ÛÎEï~ÑüÙµkÚò¬z²ýOßv4´áúŸ¦:ÇÝÞO+žêÿ}»>c?Þµ£Wñ3êÆë9,68yá²/Wu™¶µv4TÍüerËåsZÕNµùÙ3dÖ]Õ·yY±lR£kNwîZ¹úmF)ò¶™Q,ØööÍ)QÃGÜy“ibìÉ•n¾óÅÑBàô/ûôÅj/¿AºX1ý)¥ùSwŽêaš8öÅ­Ë>™yûÔ‡UG vzVƒW6W ‡(Hž÷è‰'‡ÔªQÜÉN Ò,¤àî·L}@UpvÕë˾~¨QÃ/ÕËphV™\µçÄ]ŸÎðè]m*³wçÉ ÷5çÓß­˜»¢ók›jU€ŠìŸ&uZõK‡®cå¾æ’kÈwát™¶Ð`âr”H¡3i'’ªuávÁpsÅ·¦o?–æ}W{ª7ëi:ÙÔZ/Nd¥x`¡C"Ca Ť¹Ýîs;~ClíZážü¬ÜÜL³F÷›œ¿ÏdœMMLªÚ¥ŸÛ “»O]ÓûÆî†^È€©»M³¸’)§ããmuÛÔ ‡áA¡KkÛß•0ß; Ø°_}ó0Cg½Ž¨p=+ ÿÊ¢c"Ëkà ŸÜëê`ËĮ̀Ѳ]nz®3+7¶ß]Ú¡Å)`°ðïÓ¬4ËñÓg ¢?ÁÑmŸì>vLÖñC§÷ìtZMá*oïM3¸z{Å“žš“BúÁ JXµHëñ_±6êZÕ?Ï™››m«Ú´KÖö¯Hjäš²n „D9 Žž2K{!¼/U22 =þþÞïÄj¨ŸÃ™“ „̪æðÍ{ åüÜo[ˆâ³|].—È<2orÏ¢F‡ k”ð¤»=þ?ïÖá$tß96öò…6{$ØwO6G°a+ò;4òG²jƒÊ§ßZ¢ ¬ýªáÕª ] Üõf·]EI6-…éY¨’!Ô€¯t;ßR ²s ¸ºêËÅߟ’ ô”õo¯Y¾V!˜ÖCž{*cõó¿~ÿkÕv·FÇD›ÙYõ¼øUoS—ÿíhµ‘M’âç·úBU—¯ëGžûÈâ¢\2­[Ëz%¹¶ä†Õk”í·w'Ý_=²ÈW rŸY·aÙîÃ;Ú,.—“™SP踴 8~jd£ÛŸ›é›­€Â{W?Õ&¨êõîäÝnG³¾}*±N,)·Ú^¥ P»jŠ6ldŸ—Ø»Ê|I+uœˆ˜@E ™Q´X&Š§‡³×ßBÞ16%"÷Ž7ñþ[ò`QLìõûøNõÏy”|·ÆùM#ŠîÇ7nñ‚1Âwó¾”rñmœOE«—9N*2W^ßﶧGÂ%o¸¤X´¯(J܉×ò¥RT6¥_Š˜Ï»Ÿè*5mäÒºù3±DñHy*eùW Ž)%PéSŠRéT挲1—>Be?P™[+½T Ræ^PÞ¯E'_$i=^2£”‹Ù‰Eš… îD)“¢ /Q´J…4f$×®ïFòW @Ãé)”£î$Òº‘\n­19¢÷ú¡°@vI¤ÜH.kc“ˆ ¸ H­‘ÈÆ”D"‘r#‘H$Rn$‰”‰D"‘r#‘H¤ÜH$)7‰D"åF"‘H¹‘H$)7‰DÊD"‘r#‘H$Rn$‰”‰D"¹8—kŠô”S»×ü¬{|«‡È‚YÈÿ_ߊZr©cÉß…iî™WŸÜ0ó{¯>{âDBñ*“ªB[¶l?|äˆÌñÿUnˆÄåY^Z2 ß †aȵ®2¹!¢Æ×_ßøúëKT-VÕb•ÏRòoF–ÏËû²”Y ‘H¤ÜH$)7‰DréüsK£{7Kcéæ”H¤Ü\nÚ·o¯ªªÌñË¡ã‹Å0 ™;•+W–™ð7BÒÜHþXÍew•”‰Dr•!]ʼnDÊD"‘r#‘H$Rn$‰”‰D"åFfD"‘r#‘H¤ÜH$‰”‰D"åF"‘H¹‘H$)7‰DÊD"‘H¹‘H$Rn$‰”‰D"‘r#‘H¤ÜH$‰”‰D"åF"‘H¹‘H$)7‰DÊD"‘H¹‘H$Rn$‰”‰D"‘r#‘H¤ÜH$’«À`ðù¯%¿K¹‘H$fè`ÃÃ67òMa_^ÁÑdÖK$ÿ!»†™ˆa!b+ÑA}ûæÌ•‡óv¼\÷ °]ÊD"ù›ì"f&dˆäEióNfï0ù®À ü!åF"‘\²ƒ äûZüÑkäìumX˜ú‘Á†Ç*Â+äªÐ¼§I¹‘H$—¢6a©˜E%ˆ!ˆMè*Y—¤¿¿%7ävYZǨ~Í+ö²‹ÀR’t9l+f–ÏF"¹ÍºJÓÕÊCShB]þÎfw¼E1XX:ø÷hÖ#Z©Ê`è2ëÍÕÕ3Å>q¼d‰ä >̇¶nÞ™˜–sfÿ¦Í{ÅU­ºz>/F¾þO_×H߸v}–Ûµi݆¤Q~alÞ´álvá…ϲ̇K¬Ù×l:,þÆåŸZ³a—ymèBË2fªoI°¦*‹³·k-¬“° ¼«wä­‘JU† "Âe¶m®.¹aFt–Jt©'ænžÓ}Ô æ’'ŠoßzåÝe{7Í}æù«ºdœÅ€HrþÓ×u˜2áÑÃ9é/=òÄúô‹TR³ð¹§'o:–]Ö®&ÚòTç…ÓˆÈulM«^/tÉ…]›{ß”y§:œYuÏä·ÝþÞ+óîúBù(X•óݪ´%¾:usÖŠõy¿ØM¶¸#ŸªönËnªaQDÿÀþ£rsÁÛ‹¹äË­Œ sÁQ€Cgs,ŽÒ/ÅR‘•›ñÀ‘§‚D% ‰úÌ´A±vµq‘ª­P±ùÃ¥Œ!.{‰óŸËüZæ{Éo`”1—WnË ÿ×,»2øÂÁ[-Ú?»3ÿcËu¢ª¼8©qµPõ|Þü3Àwu??©)ÇüÚENýÓبlÌ姥¼sAB颗-Y.‰!¨¼Üú·x'6‚C‰Ì0zÓuZ?ò}þªa¸ÍÀIµ¦úq¸¢© “<‚-ךÜ03f<3¾Cûýûto×{äOGó Lù§¼í¦vÝŒ5¸S§Þ/µˆ°û•ê=ûîÕ»zlòÝ7vé:hb"“Y˜1qìdý̽cïZDfÂcúvì9hä>]ÞúÀi§ eïoØ´í¢w¾óÞI“îÕ¢ÛM«S<©Kg<;guÖÑï71C§³§Ôé2œ {¶èÃú´KMÎ÷òƒRA„cpD¸w¦×EÝ`ZQ§7ˆÂã½@„l´DØ´¤"ŸÂ¦ÏA„ß’Ae‚;²@ä5ÎðÊ!®6bâ‹.}Èç÷ÀF¨^64ê7ç6£NÆ føEá“-ƒLt¯"Ô¨Š®SPƒðú¶R¥Þ“†võa@ÍŠPBñɾ ,d”Á B…pØ"ñå`7ú4ƒÅ×Õiÿ9ˆp|(wµÂ hC·»ðFôîJv4FD™×Ýtomž.hÞÒŸ@®1¢'ýq¡•’½õ«A½ûº¡[‹Îý¾Ùu–ˆ~yþæxƒ>~êþûï»÷ñéóõôU·ß6þ¤Isoßãž/FÞ|ç£>Ô³s‡ÉÓÑVaÕÏ>çùÛ Ú¡qƒ~#ŸJäÚ?dïv}‡ŽØ£ó;Í0†;yûm7ÝйϠaƒzuì6à³ø ¯„äì[2¤gÇnCFrÿÒ|wO_¿ñh×NFÙ®Eç ï®""Ê9Ô¸Yëï^¾»C»¶o,M/m¬‰y7]ßøï‰è_!7+0ôÅ`!LÌIzUà±>Sã½%šHa@)dùçn™ÿA2V=Ù¬ã=éÌÌ|ê秵ŸÅ¼èå»~Ñ sû¼¦mzœt >üv£úM^_›é=þðÀFy’™9u^ÓF7ç0³'cpëÖ/ýtÐ`ácýÚOø–™9÷PË–mF¼ï=þëcÛNXÉÌ?¿wçÐqŸx槞ڱ÷HÑM ï¿‚™›ðË¿33oŸÄ†pQÌÌf!|Ȩê;£UwjË/cf^1ž+f>ËÊdf~½+½G|ÏÌœ¸œÄ.Ãw•Œƒ ðê3Ì̹;àjÏ03ŸÛįËðÅßÙÊMß`fîÁñüz"£ 3óGÝÍ|?¹‘~g7ça€f13?Ñœcùlx—aá<½(™Ì‚yóF%v13óoO2*13ÏèÈö¶EÏi#¼õ'Íg€gŸbfÎ]Ê€/]œÎï(™w^Ì#»¶žÌô”zêž¼>=:ö÷¶7Ôê)74ý33ç iÓné‰ûƒ÷óŒ 76éz‡‹9ËëM[ ;ìÍ%óøÀö ænÎàüc­[·½ñÅå%‹NqAJ?º{÷‰ þ— ˜™'òaÊ Â-Þ9rß3ÇG=ylD²qT˜Â:‹+pSÿdcʘÿþÚÚwŽ ˜9¶ï‹»7Í AÞ/?íkyÿ£^é mÚ½Ž3sÁ‘¹ýßÕ)ÔkӆƆ¹Î%€ÇØ ä¦ìK'ôiZ1;;;;;§ó½ãÌÕŸ' `²<4¢±÷ÄêmªI & ›‚…á}IúGÆ6iP«´õL cslúž™…û§àÔÈßÜŠ¸qüNâ 7¶˜xt4>y>Ú€~]€(4&lI€÷Wcê“øæ5ؼÑm`S}WIÞ (hQ¯ÇHxÔ¿¯ƒ8Z‡úì÷×^ÁŽW ,OÇ˯ùæ·Œ¸8…ý&fîÄ„{}ÆþóR&“óðÊ6¼øÒÓ–†z=GsÏ7xù{ ÀŒ/“€BLù ¯ä³ÂÚÀ¡á÷ÐÅèX€X^ Gp,·DÞùŒåZ›W ½À2gsìmƒ  uŸZfÊiÃÍ€î) ë‚Ùð¹ÏØ©:Ð;ÚL«Þª;í‡#äK)ðok§€ ðÀüìì´„yŽ¾uý³³³³³s»Œ¿£`Ň)í‡=ýÂ#ìÙºekVRèvz`÷¹Ö£y¿· i[à|óÖòJ7ÝRÕÌÉÎÎÎÎ mYµÆ–-ñ 0Ô{niã-]¥m ¯Ù¨Qµ°‹£“@6“]Gíg¬ÉùJA'G¿ÔdE(B]Fß?9îÆHȤèP»×MX\=ÎæÚêGY‹ª‚_¥ ãDºŽJ`‹ÃZ$*Ó–ÖÝ™PÔûnê]lf{HOÍC5 ²)Þ6úËzÊÀ}pýb Ë]ø  zjX®£à9tz&ÖÅëðêÔº=š éyˆ±k^¿ PðÚP<µc œ®*±ðߌd`ÝlŒüé|ƒÕ•D¡¸2v­ ÞÞt¨áPŠú*é(<1Š/ gÜH3T”1 Â˶ZàÖ¸RÇ\hR¢œs£NPi(@6PôTD(HÍРz8Êó—üÚf±ú%©Euáb…^­(€-2Ð8“óG~|v„”.'TXͦ~Ëà>ÅeCgä¸qøëÉO}±¥ïð± «F8s\E©ÏÊ*ð‹ ö‚ ˆf!>‘…ôï_êü]±GTª“ …@lQ¿È 9žô©¯iPtì:ÚP=*T(Þ¶ýµ,7ZP^“æò¹¨¨nº“ÓtT· ¸Îæi ÃþÜqe±†Cðüµ›b­¥5#ïÿßÖEÍ»àœ„ãgaÆ"hÛ³>F L›]ÇcØK;Ž[¦Áz=¬çw è_º<í½ð}´4Ô ÂŽmø$ÉMÏ_ d¢¸`Kb‘¾„ÁÌ‚(øéJB`€  ² ÚŠ`ù>}$Ÿ¼” ~1ÐC-ë-.]Q6dd—>hGì*Ò]™þà‚+át ‘T4¸µà\®Ö H½¤Jfw„’j_úÛÊàRïšô—f,îûÁö'[;çbÝ@` ­ 3ˆ€¼3™¤(Å…r¥ÁÓŒkWº›<áÒµöÊ© q¤=f¯çw›b72ÝCªÞÁ`MX +Lÿ|:þÉÆ”6xl‹£Ÿ”ÂQúï3êÕí{AÝûÔÙ2ëïSÌÞµú€_بºŽ‹w‹ÌBA1×±ø~íQïѳ?}fÖº?( bÓí­\…Ù©GO$•*£bðâ ´|Ы=â§ap}ehÚY¿â“´m8pO¼÷<š<¯NZê ò4^ûÝï<Ø_=ksD(À¯Ë‘-P±àÁ±\(8‚³|µ½E8Ó°/ÏwûÏ<ƒVO‘è„©/ú^ÛßÍbÑHÃàÊøä;_™_ü2Ê$!ÔÆøÛ}ßr÷aÐ-p «—á¬&ôÄ’/‘áÈG ‚Ë)-ðä#¾Nß §öõa\ª½-’Ž>—÷W0 +V_/­Qè{õ‘–sâ‡\@á¡ ûíƒê8.Å’‘Õ؜΅[¼j‚«g>ÿÙ@!&ÍfdÎ^ð£Å÷²©S7è÷oWz]ösÜâ°) Ü8®ýÑ/>Iôdâ÷^œ²îPöÖOÎM>ž’ûo†¶²EªÛ0Ç5xÖŽ¯Á _ Íü'{¦P¡ÿ[ƒæjßù¦!}ox|ùcóæƃz3&kEç7ß{ר÷ÍðÀôX+…®Ÿ/µÂ4 ¯›#¦]툓ƒºô}a%};óŽU¯Œé}Ó­· ï?ìù%­º{ý5lèçk C7Mµj4=sð«¡7?‘ÍxиÇʯI=nÆgïbê0hÜi‰P"Òa f"×DÓñ0žž ½ÎòMã°e;îéÃ&cþ2tè8ƒž}°Õ… 1¼.£]Tí™­}¾›Ší1÷4 FËÀ±FØ0 ̘³Û_A•FhZÃgaöb0ðÂj„­€V0ÕŽ:JéÎlÆ+¿@¬€½Z6BpCP=84 Ýúbat{ wUC¡FÔ™ˆéËà<¼5"¤"Ú5Ed;Üý šFÐËï”ÖrF×>=¢Ç[kÊV9ÃÐKŒå3tC€Ü%.àù17Ž~öë¸zmÝK¸=†_ž£z ¹÷Þ;{ÝörëÞcëØ.Þ3Ŧ®›%/$#0¿|pÿcÇ ísë´5z7ÂFïöó}mîàÞ=Fõ¸ŠšztÔýOe{0~üøãKŸé>dôÐ>õúµÜ¹.îüü•›»u¾}ܸ>m[®8hmX7̆®_änxéÃÃGM[ó/Q`’© %Z5à’í'ºBÚ?ê,å¸ÏE™£BQä5‚KB” |Al¢dg%b.ôüAQ®7ÿüù¥¯t>¸(¡(sª({né{:âkuøºwÊéâ(>rAΔ™cÁ/“¡e£*›ñç×*›¢â¯¢T*JŸ%˜÷ÏyîéµÎr£)óDJ=Êáç?ßsÐäuâJÍð‚rRN~–¹UQN4¥ ¡(çØ–dgny}ù¿§cÊ Òß}ôØàTN×ËKѵÝ3UŽoŠJ¹}¨Xz‰Jú•‰¨d`¢rJüz>p© çÒŒ#*W©H¨T„TæT*{nñgO**TÄ·‡¼J<}v¾ˆ/€ÊI¡÷ëÁ¡Õ€×Ͳÿ-œÄ•ÉвQ•M ýùµÊ¦¨ø«7¶r3ÌY~èÖN~厛+óDJ=Ê?4Šé¢Å©hÆß夜ü,s«%Ë•õ…Å«Ä¡rsëØìG;´¿îßã»QØV‘«Çªõ#P•¯˜As¥\ÅÿylÑøæ) ®‡‘67F?ŽÑ K9qÿŠ·ãº§ñè.ølD¾Þ¨»€ùÕ¯æ]ZŠ.ÀS˜—_ —¬ä¹žõê>U¥Ò­(Ožï~xo­OÚkÞñeMü©ÿ[SDí"ú¶‹è˾^{¾âNn9#ü-’eKâÿ£l–ÉÕÒUò—*­Ï†(Jæù#^r5 åF"‘üSí;™‰DÊD"‘r#‘H$Rn$‰”‰D"åF"‘H¤ÜH$’ÿ¥WRæ’;—9&åF"‘üO˜™ faš¦›¼ ›˜=³0ù ”Ãü$’kѺ‚‰"0‘oÁ {E)¤^½‘ÖDrÍY7 V@&™¬0Ìâf”…¡A1@$S‰äï±nŠI,ZÑ”:6ØbÓ*q…nLÊDrÍY7+PW¯Ê›3ÓШh§1Rr³ÕûÉWjV«ôÝH$לuÀ4²«×Ï?u$VwBsxgÎç¹%gÙò˜S‰lw(ÊÐiÝH$× uKNJ¬Ï>â= ¾œ“ÅîÔ+µj‡”‰äZDUàP Ç÷+=Š §>ü ¦ÁÆB(Wd“)\m«ù13ˆèÒW¥*^ªÄRTÌû~ßXU»¦õìÞ“¢}»& m¦rð`öéL!X oTß?€¼Ë8 çÙÄõ e㌪޺r¯;J,xêm,³=**)3É¿iG-qkž£RózU˽¹sÇâæUk×$¦ÜU³¼­ÝÿWª={åú=­:´´ü=ïƦ¿U¹®måp»¬ÑÿêæQA“Ö–³?ˆC»íG¨fûœyÀ©9‚è ­9¨]eYH<¬ã3~û.êOÌýý‹Áï䮚÷@‰L?¾?ýx»ûŒ^õ§ù?/ibÈöë ·?çosX WfnAznÇïçÕoÀHÛ¹jÂu«kÊù—ƒZ³mõæÁ{gÍ7R8çÀqQ5$BDdû6s}Xù%aóßÙ6 ù”òåf÷²×ß:4öç÷Ré{ÎYÿáðyÅœñîîÞÿ™•‹+]j–¹NN~⹯~]V×bý{žð¼öâS7?÷ãM(7¾Âü/YGó¿¨6ˆˆ¹Ÿe}¨!}äÈÀáƒÒ³<„ì>*Xâʬ\üÊÍÅ„²ë?™06D<—k³—Jq‰ ‚/HK©(” »?!)$È»oBBªÅ~q“ïÏšâTænËæ¹÷Á”ûxʬή\h0–óàˆqþr‰Ï+à¼ap`uà õç%–;œÏ™YŽ€Ê_Ì(d¡]¡Ç¡ýƒZÃDôö“w}·þpx=Íyä½O†Ôäü“÷ß;iç9Q3JM<•×펞¹µö¼Zã‘Ì—;¦mqÆßtÐuÝ'?Ψ¦g>zß[î„;Ç÷nÖçÂ['¼é_% 0ÅZ{ÆÌ÷ª¨”»¿Q×»žÕâçÖPNY{ÐõòW__¿ûÓç¿\ã, Ïþ—Þ}óäܧG}yôàêoön#úþ{çŸE±õñsv÷iéô¡÷Þ‹téR¤+År¯ ŠXT‹];EDz/¡÷šPBzoOÛóþñ¤xõ^ ‚çûÉGÃfvvvvç·gÎÌœi›’pøÙy/Èpqõ±}ú¾13õ%-=ûÏx¦?È¥»ct—Ö\îoêÕ¸€>­Noq3¦€X>¸ñ‚àÙ'õ+— ¼'ûõÎ1èoÆÄ7éý¯ÏÞ›¸ñ£yk˜mgžyæˆlKÈ3e¼8ñ™n3>pí…Æ =Ÿ®u5^ Î8·'ͽËÒsªÜÅŒðÆOoLÿù’ÈOI—ƒßY¾¼³¯ ¹Ñ“'½t<]Žô´Æ¥+ãßZ<²M@XøÒÈ_Ý ñ½“ÜtÔŸ>ß…ó_ÿÄþ«¶È ·|§F¶ÂýÐ0íðÒI3— ßöä8Cvß}1Çaþs­O¹þ+~Ï×G^Û8·óK̓nL8¼vb(+@e÷Hšú÷×Öÿ‚àäfÏA*}{ª(ë4Éï‹ß¶2w™IÛöJÓNÏ¥ÑÍß_oØjRÑ/sv9Ï‘ óäª&­»Ý°º¼¨AÆ öf9ŽOë×àåe7ˆˆRV4i02›ˆliý[µ|wã%G‚_f<Öö_«ˆˆr.µhÑzÄÇQŽãÛ_îØfò6"úíãñƒ&.uÌO½yê|t¹m¢Qʯ}ØvVÑ®Dìbe½þÛâˆ~'×í»²awáϯ;R®ç”JeÛÑ¨íº•éew#*Þ‰J¤Çœ=›Q.ç-nß¡gtQöÉ5Û÷N³iD´îƒqÃþõQöú¦u§‘eÿËë5úêDãÜg´|ý›cw¬ñ¬SM›µüÖÇ¿~˜ØºÝ »ˆhÉ´~ýŸÿÌqðêÆ÷wi&ñëÆz9ÁqÔz¬k½FÛSˆˆ®/Ýø‘©Ž›Lú°C«fk%QæÙŽ Z}w²ð}1¡CïYûˆè£Wz?Òw¢¥¨ÎbÏŸˆIµSù»L‘šPÉž-5Io–éwChÂ&4ÒîO¹*³3¥®þlo§>ó ¢àž³Oõ€œm/4_´Ò!}:×ÊŸ¿6Ú<Í€Vç†Oµwwí!Þ)É a`SÈ “t>±k}¿ôôtl3á)Ñwñ 14€P÷üãõ'Vm¦~M°k‚„êè8ù7ô)gš ˜óTÅ͹Èá‹çgOÛõÍY Qk<ÿ³Vk*ÚùÏ¿/Yp"lÃ|Ã]+6i±Ì%À«Z=¯ $_uŽRÕä¬Yì™*yëe¶Xí€d-ê•›M-769L©¦¡56]=Ðôνxã«“»;j£IçpmÝu€†{w_jùÑ7éééàß®WдŸ¶eÂcA¾\Ü9þÊŨôLBÕÅMMI²/®_Së©©®@àÑd¬›Ór@ùú‰#vß®Ajzz: Ü~Ôˆ^þ<ûÍvHjhÍ®†BcCë4fKã¾t¦ˆÀ†©9faqB“ž„ôïi¶0I# A¹O›NUªÜ\ËÄ*(³“X^bŽ¡®¯¾¨A:º©7Òì¤3é‹Z)ÞÖO±[3@’Ÿþhñð]VSr!\@4HXt⟰݃]l Y€Œ€uf¾W{ˆÝ† ­pÚ·°zýú¥—ñî>©?oú:{Õ"ü?Ôäæï\”ÚËE—cÉ¿ë›'™ä¢jD²²…ˆin(êªÎt!‘3ÿܳÿÜ*í‡é\ϨSµÂ‰þžFÇõI‘0· Wäg<Þ¿o‰,Œf €„âáÿðìDó ö£ž2BtYOMòVÉj\ÅGÖ ‚@¾?e«L¹Q"½hgjAÙêàj½•j‡ª:(HÈUzéþß¼to´j×ÁCÙv›ûß—Ï}Hw——¦< ¶o«Ê2J —óHßÙŠ©¬OWnJ€Ã Jͱ¹{8ÿÉ ¼<0¯Çw—ž,}PûdØnƒß\>ý1H_ü†ãNe7:“m-t*ì¹9»É®Uöüþ“|w¿4Sù– ¢A²~õ½aÃÏVB¤3f¿Såå—óIr ïÓÞd•é.R<Ù2ú›ÏbêÁk×ên]­}äóO•yrûE'¯'j™îþAµ€[`wkw]qMØ»xÆ'»îR…iV‡.˜3“/]« ‘KóNÓ›7æâþE\ûaiât“{q礂!¢?º„²nFG'æüñ7Gh¶B=S­ÅËêLæ¨ÕÇ™Øܸ\7²ÙŸ4¥Ü[·¯¶ý“¥…2sëÀ‹3Y@’@*üülš75Y($$ýc½Î¿&’£¾Ê1Þ 1$&­=›åHfýoêöK%Æ\ŒË´±T¦Ø¡8jÁ¬YE’íª6d´ «kAnÖú5&•‚xè§ùQ•G?´uô€ö‚|ã³u3V} <åƒONîÔ÷h-íâ•ô/|¬G ÍfSK¾¼šªjØ®¦ß‡ý:õêùòò5‹'=ñï1[–DúI±¹¦Ÿ ²Ûí%Ì„jS5¨Q½IÂÊo Ü·ðë5Y¿|:byÌùí+nl|y>ÁQÏ?¿5±Àà 6›Î³võV+~jÐÚ›€É9˪÷.mΨ6ïá7~ð.væØíBÜéYÒ¦©C? ›}x~ŸÒG…¦ªj±˜­¨üµª7ŽýéÛƒ÷,þ~AƒÀy;ôêôÂ×o =¼oÚW£Æ.ñO;sÄØýíÑMîÜ›#›Ý^,†$ìv»&ž~}^Ô¸é-»ýV?ÈpåjRçQoÇ¿9býS3ûŸÛà’{#lÌâ.7žþòÅ¡®ßþôØ3KZíÖ­c÷p?c¾©¹““d×x7ZóŸA'w_X×—ŒÁ –OMµÛÕâÛWê?áÀò'CX* ÇÀÄÝRâd™²ƒ<¿ýÔº~¥Î,¬ó>Á~ClÆûµój¥úËEôòc@BA¢Ô Å „¥W4vD¢Ô_K—IZrPÜÁ§_q¹+L^nê®y " £l/w»¥3Ta%¿›¼\³ë[¢Âî|3åjã¶S•?&îV!wºÁ²õ ˆ¬˜øK:Uf³išP)ý‹¯¬¨KPOœ´ZíI‘f”3(=E³XïÓÀUêØûí_`„Ûfô!b±Û¼pΖü¥TâÛrÃÒŽÄR9—IZr+ì¬Ý©ÜwñÐ –»N…y#À•%/vîP«Üí–ΡÂðÏUëm½¼rµq[ñÊû_ºâ,[°qõÏõöb‹£ÒÐ$$0gæèÈnèÚUjÜPÕÙ¼~\e'ÍðÆà!’¤CÐî_‰PTöÁÿ6’eÙ;%bºSBÔ¼’ R÷wþŽÉXÞik ê»uñÄ¿ÁI…³Ä™{Ó“ ’*Á•Ë·ê7ôüî+ðš¢ê@)hÖX\9£S%)UçêRz†8Ë s7Á*¥XwÓ.^=ðÔÍ&ÉzÕ‚‡B«6VÅ`Hv‘´p¶÷Ì·PÝ©“T¯Ñ}y-Xnæaú ’¦¢Œ š…ê„z²Hh°‘¤—“t.ž¯.ÿÖiÈÎ0ÌÿfÜ ‚L(9 "¨ˆFR- Ø ÜÞš*@oªUý~™ ?!†yh€d”H @Iç$!à˜ Ù(5ݧIÅÜ™b˜LGËá³ÜŸPD,7 ÃTšñÅ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0 å^dJD×®]KJ¼ÅõË<@´m׈‘«âDtOž\·¾ÕÛUíV®bæ@ÓTcÒ‘o¾^ÊUñ€Y7àÑqàVæAÁn³^Zu‰ëážÂ¾†aXn†áÎóÿC9)Ñ1¢È爲ÁÙ¯ª««‰"XÒÎeg©> e ,ÉWÎBx8ë Ï&’ÔÔ„˜›î‘MM˜‘|5Ϋz#}ÙO"jùÙIqæ  lôp÷õÅ¢K8P3/¦¥™½Âë@ÈK¾rY¦‘tΞ®¾¡ ö’2,7"²vqÇÂéBëÐòÒâ-¹–úS67©åDŠÞõî¨xÕµåôõ5=I6Šóï¬[R}ÄÂ÷ ¡"xv锓ù ÇÌhª¦ÙúÁ¼^ïñ5”Dه׾õ‚Œ:'OÉšm³›õ¡ýN}Yq(‘¤Ø½?*Ƭ¯7î‡Æ «9d¸¶sÁD)¬¡“Žìù)ù¹yvUßúßëjE¸þÃÇeÃ&š¦Á"ø•f¹ù[£Y¥6/|æì0( vó›»¿¦Ñ;ËdÄ‚3?^×7êÛµ`Ú5^Dvðï÷µÛÁ>GœéÔ¶F€YëOi7o™°ß¡a’9ní[ÿöëñn‡®íEÕ’±gÁÀ_Ù‡¼ðš&mq/Y}ú<üËo[7l…§ 6™üu w@¡ÚÓN,Ù°°¿Ó[üŒôO}^påÊ•o¾ù¦´Ü(Š2vìX~™Ùwó |-5›Øòr,@‚ËQ¿zEôõzäuýå é€D¨xô{nlÌ÷Óâr´üßß{7`èç‘þòÛ† ß4Cƒ6=:JHz¯Žc¦d_Ø›ˆÄŸøÞPe°o×7=n~@¥¿äD’â×úÙ֑ꮯ~!åýÏËË»Y–ŒŒ ~Yn0 %(ÈH– :½ ]½rèjP_Û§ŠÓÕ“G$ ‰H9¾Q·¨¾È8ú^²¨×®s3U¥;Ë Åï=alþ´Q‚bS U;)ÉçÏe€‚‰g7¯9rBöxìÈ7ïåZÚ9+…vä_Øœ¬„ ªí$ì‹=›Û`Êl´8.äå*]^?ê¼X¾³'Kæc«8wüØTƽÃ0,7ÂB-i׈tåÛ…Ð|JÝ&- ‡œü•óß~¶-_zÚ$àC¨èAÑ—Ø6v¹Õÿ··SÏí_}ÒyÔ$o/ä\;¼ãÛÚN÷’éÚwÚëŽhج¹°žè‘sâ½ÿäØ…·@Öf¨æ¥Ÿ]ùú5Kà ~Mé.e`–›¿+$D9O/ŠüØC1æ6ÓÚ½¨U#<!°{wb¯@$HhåÌÔlx±£T¤Rµ'G½0FEÏ~ï­ûýÝçÖ¿üLŠ–‹ÎUZ¾ÚsTµ 7êâ͆C;“­äBºˆN5¦ïÜ3äQDzèÍžÇd¶³…\üëõš÷³»Xl˜{ʽZ>hÜ”>S?üç.Ñ$!4²RºKD$H”d(=ñ—4•@BYB $ÿÝqVÙÜ%I–³Š¨DžPBIrœ¤Up!¡I’ŒB+­hˆ’„ˆÿð9~ªÍºlz÷Þ=º•žwãêêúâ‹/²L°uó7—qIRÊú!J(W0ˆrÉt—Bø#g9¤å²Ñ¡1²RQ¡ /$UøWž;ËÜcx œa–†aXn†aXn†a¹a†å†«€a–†aXn†aXn†a¹a†å†a†å†a–†a–†aþ®<(€d {/HZ™(†ùçÊsZB¯ç{ës²þzcOh—úŽ;öôl†a¹Ý»ÑûÊé{”y“¥sNŒ¿ Ãr€˜çôÝ®ø¿¼?UûçU]fçׂaXnJ ‘._" ¢ Ž°áD 4(Žá‹rEQ7 T ][œÙj.u 0'žÈÌÖüª7/JD’‚ ©E‘}‰±:5•PFévDÐT• ®(4 ¤2ñŒ·àÈœPQ@SˆA’A’A³ß!„9H(+ ì þÙ‡–›{¡:`M9}dõû×.F ·ˆvM‡Î ó D¼µkΖ5¿–¹éìÑ=²>Ÿµ@¯— H²1ôóš¥R£¢¿:­ÎËä¢öˆ'>C‡=7U+< â6®~ïíÇ?:|r~Û«7ìe³¡ z®íêW•»"Ö¼ÁåðkQGNIàØ(JunßfüÜ ?'"B@´Üøzê°¾ïí÷tU¬Ñ+ÆïÙž4è‹mÊmJCˆÙg¿ýiá'Mß=Úе†a¹ù+µFºñãä]ÛOÔ2wðèºBúÉo¶¿ÓË£Óýžèˆ(ÉÚý§/,m> Î…ô4rA7D”ÜÍ/÷®òÔΆUu Ý´-g‹SJZòõ8aÝt2”Þê½L墑˲NO*´|vC3èú·ãNêû =HU€lpÒ\0A$nxmxÝç·Wõ—@qö¾rTq‰ìÝoÂA€Ç>Ù<û±Ž³ôÒ€9å¼äÔÚÅUé‡~™=M׬·N—Q"ª‹¾îÄRðÜüÅþë‘C;÷4zvK³ÆšJÒù¥ÇÚ^¿e »Q¨]½oïR9¹@R¡8{™ÜôÅ]­’žNêÙtR¼š<"ÿÁ½% ôÎ^ŽßôŠ:'“›§ª_Ñ @˜Hçâmr“‹O“½ÉÕSQH×[ÙphmTä3!óÌwNÞÑ!d_‹­ùÌê:AÑ?㦴>aιKžYY*W(ÿo:S¤†¹Ñ'Ž„NjƒZÒþrÕNn@ÜÝÂBD V†åæ^yn¨Ô†‡ûç‹MÍBDYçôÈC¼HqŽðÚ§¥­YoúCÙË™rVqõt“á¶ùËäZkà€§ž)7”Ìñ[~ùxÁ{#Rþµ-˦ítä¬Yóä£;5ò!‚¤3Ç]ýšI„¼—.Ãrsÿ ’ü…X~ÙmÆ:DìöÎVÔ”eÏ *-JŠÁIþó+Ã$r®Ç]ëKTÁÎÙ(+:ƒ“TdMØõúÿåVŒÍ»+¢ÎÙÏÃß4.m÷j³xH›yXxp—h ׳ܥ=G·Ÿ×ëˆ4;ihÖ\Õ±ÝõÿX/Ö‹©éšÑ§-Ü«µY%r#=}ÃëúFÔó ¯ëáë €,¥ß<£ÖmíGwÒ""t€Ü‹bغ¹×Í´jç~6­›4½e‡VB^ܾCËæëÚøº9:2„-'5®Œ¦¢ÞÕÏÿÿUY5n{Ž >u[ߟž zeEšç h6kN²Õªj9é€"/- %ÕèlÓ÷.z=tТP=©9¹™ÙŠ’!-ñ¹²“·“³¿â ËÍ_Ó(};ÏÕrܱ•s›÷‘ É#²C‹©ÛCB|Šæû‚šmÃÜ'JŸc7G ÿú'µÄF¨È6Àôcg¸×õ¬@kˆ¨¼W–Êûi+HSò—2W¤Š\¼1;×JöÂ^\7õôÉ:Ø1o°°a‹wöÕõ²$]ØíÞC€H^¶~Þ2’%0é/~6ü"ˆ*=f÷~´«Æ–ó·éÞŒg 7¥ÏÔíÖ{RèZ?/iúå¬å¿Ý %(^N@¢Ô" ¥ŠÌ¡¥” D‘w¦Æ¯ßtšýä’(ét’B+ï·!"IFZ™E ’\’˜P @Óʺ]ˆQ’´Bc¥–έXeD!-ש¡¤-zÊŽ‘(<ßò?‚j³.›Þ½wnZ©ñWW×_|‘+‡­›"3€Ê;Ú"Ð*<©8V”ËmÝ¡UðÇÔ(=võ)IŒ @”NS|rÙ+"¢c„ûö”¥;.J·ßåVR†Û/È0,7ÿ’ÝæúýÕn÷›ÑüN0 ËM©~„¬³Ò›Ðá^dnuõ䘪 ÃrWúŒŽoÝ uF£jÉ+õ&Élyªö_çM6g7!ËG'Ä.CQÀfa'Ãró_v¥äß@(ØþõÄ—z,9T4OXÖå®{ª>N:×£±ËŸÉ 2ö.¤&ÿòv*œ­÷дK”1më ŸöõŸ8g¨ü¶3÷»á>ÐIgp*ÎÆàì0Mˆ%u ëA’¡h´™@R@Öƒ¬+žRôpqÃZ3é@YW”®èT@–CÛ2(zÇæ@Ž¡oI²DD(ƒ¢wäFŠÞ1Žéy’cp¬Ð ÂÒêºY4tæ(­d Tœ¾ìñ¢”DE·¦`a1”:½äˆ»½BÊC é@Ö¬8ò+sVáA""BdP.:^\Û:žuÈrѾڞW~š÷/°8l"H¹›~š=«ÆÓëG.ÜÙ<àäê7ß°ë!óô‚߬éòúÖ‘ÿÙ÷Hç°ßÞgÖ€@qõ±ž<`áˆÔ ŒþõÕÁú¯û`‹F¦=_ÎÁ2ñÈæ¡Ťm˜XçóÑu?m|SsIΉ;s´zß×Å ëŒÆ<‡—·\Ë «ªÉ6›êìn4ºzw­Z¾¨€@Ö$LÍšöZªèëŒõHÚšhRsSÜÎ_‰ IDATr š4H>~‘nü¾7¸SˈŽ¹ÖPö¡U®-ž¨’E Éùé1™}†WU2¯§[$$Ÿ>\oÀÓÛ~ÔÒÏ4FšDq§P‹^¿Í}à¾FIçÞàÉÿ8fÛ¤Û’ç]ó‘vÕA2†7:8sÏû*Aâöµæ°.Z*:ƒäT«^·Îiû?%->+)©v÷á’¢7z6lUËO”ºI§]Ù²6døîžNFW]ýaS•§ã J› tuÅçØöÅÚ®ŠÁ)xÐ’ÞOBb~\æÖ{±·§‹¬Óù5âbξ|+CBÐ >}<\œÁ+´‰ââí*ÉR@HusÞ-^ÂÎ<„)Õ,÷ûúB±«XÑÆ1u@Roæå™<MŽ÷žœ#Ý™Éiâ×fÀè¨ï;þµµæ½ª¶ì^=¨”µpÒ`™ž&…úW3_=[àtH x¼N;õÌ{ej|öš¹a¿p]ã¼ßhŽ\ èù¦{Þ²sÑÖö>Ò ÝÃ|ç.a;^kâ—Zu@õêg²gXŸ¿uí¨Gä ÅKÍQ˜SÒ%ßO @Ù€ˆrNfºÁÉ "<"…8¢ HKÍqöŠµð¸³{ˆÕvì 6›»‹;:n9°iu:/J\Z")3×dYýøÊ …rcl¡ÕŠ×²k 6V^ 9îÝ% VÓ“Rdß@€ˆ$¹øºhI©X]Ã…(˲§cf3¢Dw‡y(åÔ°½Þš=W"¡A–TU$$ «¦J: ¸ó”¡=§ØR¢ÏþþÙÞzåMÙÖ Úÿ{ ªÖêÂém¹‰?øw_d¬FºØù–Œ<Íäí縉Z˜ç¦X´›©Y-«ú˜ Ï¡-»køÿêÝn”ÎnÍ'XÞ[žSÏ_l`Ò¹éÌY¹ù©ç/…MmA¥¦!Ë2¨š(rÏ:†ñIV"8î4+‚‚:EÂ(€4Õ.I  ‚¨[4šÙX2±—×%˜[× r6Žvì@ §®ƒˆ`I;"h¾!áé©@B²®m“Û+2Eå܈µÊ…ÇÓã£Ln-Ñn4æe% 8³3Z*æGCßÀHcÜÖc63Ø Hµä]?|VÅzrd}ï”Ã'U¢$.­~ºUl¾{Õ:ÎñÛ÷Š¼øx»!2ÔS°¤0ÿ@ëæŽ.d;´0æÇ¥OaöXO}ÆåmË"ú}èE )†S?Œˆ9Ö5´ZukòÉ‹±‰ǶŠÍ™òŽþ0?¥Ñ£5=/oùuÏ€W¾PJ¹‹ÉP½‡{§7 ÞMŒÂ~šïYùmøèŸ$DàÕ|Tòâ·:Ì1 ïWóõD³¡qD¡Á#ÔÕtåÂÙæšW§¡±ó¾pn:Þ`»5æç×Ç7q[¨¿.bǪ̂9ÓvÈ#¼ ѧ’»UëkYcåºYOÖiÛÍ{àâÉ´®ï¼(¸´y±ÁÞÞ?¾õlVír/ï¼|IîóîSP­ZÐÑ%Í{›£•#¼áxIgŠlPèçÞ~v‹uX`€s⑵)ÔnDýúˆ˜¼}ÞÎYO¼òžWßOöúqNRXµÀ„ëMßuë°ÍxvËw‚b÷®’"†„ùº²Ú0ÿò¬Y³îE¾kÖo®Ñ¦—Ðîqñ%*5›äÒ–ˆìU½¹§‹l iU§qsÚM•\ª÷y­YÛúšF ¸×ïÔC¶çYÍfgíæcçû™"š7 «ÙäWË×ÇEè=ü«Ö-;…äêá.a="#Àäê‡Æ€z-[è%B“?¢¾vË.&INž.ä90¢NÈ>U ²w›êÍë+h — "šôrõpš&ùF63éQq¯Y§ª%' ݶ9î¶åámG¹9ý[<áã*åg¦ëýê·ýv7™HÈam‡»ìyYY¦àíƼæi é8ÒÃh5çå{5_¯Êµc§ô-zwÚ¡UÏš ;vPs’í6òm2²ã¨’FˆHš]v ö¯NdªýÈ=åÛ5]P«§Zwï@ÉÎAéªe'š-Ðjlç!ý°há»É·žo—£š ža~aŽJ“Ý‚ýÃk>x±¦ÙöCõÈj¥}Oƒ¡uëÖ,™÷ãA @ñðaKØz∽ÅÀGeë­½«ßyµÇüýÞ..“«;‹€>5êAôƒŽÊCF?;Ôá¹?Ÿ2ûÛòâï àÎÔ?P¼kÇyýôš*¾ú›Îv˜ÿR_°ý9µ&Íl·>’¤HŠq§ôÝÓ÷릲êÿ¸òˆbãÇË°ÜüÍ,L4„<>gC~N–Ð|´çäÇBu¹YÿÅÂt hZážÀ9÷ñ¦üέ¹aÕÕÃøù2,7+½A n®¾n $¡YÝ}>?“ªÏ{ oH¶ÁÓï¹ëŽa¹©Ô~HaàN‡@¢‚pŸ•_ Ešþ×réòAoIí~8AÁ+@Ó@V€48š™lµpÓbnçAžwC–¤ã» ]:¾Ù’‰í6|þAFžÍÑT*¹,–«i1÷ÜO¶J˵üïò€ ÄýÜû«¹ëIºŠ ý¤Íº¯!©k_lxâX<¯K`þ©rCDˆ7~ü×ÊYÏK ž>ûˆ÷×…;]üyz£W-•JJ—õŠ¾™†àRsø»ë½œ Å=ÊE‘ïÛË¡eE{ÍÜR·~·æÚ™"DÉzâЮ½õŸÞܲiªÖ·ÔÝÿè“[DÕ~²r.m>³w—US|êhСYQ[93à‘™Ú…¯¢£o9UiÔä±' äŸYt4¡GËÚ G·lŠoõ~/{É‚H’áÆÎ¥×cb$§ Ú=&ùzé u˜{qÓ™}{lŠo­ÞÏš®¯œrö˜ÖÏÍlÔ¿]ëÈ£?/m6|¦«Q‘À|qË’„› ²KPÍnOùû8 BHüyûÑmp³Ã+>˳êC:N¨];T"~ükÆNz¶­xÎ.BîåµÇ÷^n3v¦Þ€×wŸÞµÙlÓù7Y¯EMÍ ˆ æ\øýìÝ6a jód­ú¡BƒœãóO¦<Ö¸jô‰Ý»À\ïñ}Ê.4 Bs/m:}`¿ÕŽžµº7éÚ‘¬¥û‚âü¦ª´{±`×ìü¦sšÖus|§²£Þ=Û²óGd2_Ù²ôf\¼Î£ZƒGÇ»™Ø b.ë2w¼—«ïÓ¨Eª""‚f£î³»í'!$n}sÍÇ9E´ «ß0þ×)?¹J–@Jº|ðð—Ó Ný.óÏ|ùÛŠu²jÞé؃‹ì¾P½Ë¸ßœ­¯ôÌ2ƒ,ÛŽ}Ðóбk ºx9eýþz÷™„ˆÉÛÞüñ³ÅƦ¾¶­¯vºp9Û«~Oð©Û9"²†°åÄžÚcS…,eï˜Õå\LNp£®ÞN™›_ëy9AI½{tͶOù·z¢fÃà#ï÷;O`ËJÈÍɯØ,C°ÄþöëözE¯`úþù«ÞŸ« jV§VÌòQ›Ön—% ÀÄß^þiñ—NíC"ÃÎ}Ñw÷Ž“² jöÉû?ˆŠŠ«ÙeL÷¤__ìY ÊÄÖBÌ8ù銃›„Ök˜²û­5¯,륡„ó;33%×*ÖK«?ÑH‚ì¨å?ê6ÐIy;ßê~::;¸q-槗û'°Ü0—u@©—RL5†´’†ƒ$@@EœÚº®ÖÍÛ@ÍøÅ´¥Ic†ù!€„MµíÒU#ì4 ÍÒo«Ê@I’)=½í[‹ŒþAÏÝ1(;#ÛpõÇ·¼žühžl”»»®íûlqجI'¶¬«;rOÓ&ž„h°$_=^§sk€WõVA~”—å(LöþOb,&L{ÌJ7Åzùôw‹ª¿òJ²ÈʨÿÁê*¨4 Û¿ìÖÑÓµû5ª6æÓHÕNp{ dË¥M _«ýÜÎ2*âȯ?Ôµ­y«*P³¦òùÌÅÙƒººÚónÛÚbâîzµÜ  FdÁâ9Ÿ4ïþ D™YmG=çqyÏ£11×[4¨&Jeo ìØçåAUýIP€‡XûÝj†)åüšկÁHuó›æé®&Å{ø–TeXuÏŒ3®ØÛ<=ý5alÕÌý¬X7`LonZÌÃ$7€2­â¡VIÎJ“ªÖ ¿¶ÞÊ[q‰à T7ÏpG‡EqqB-CsÄÈông5”Pz3^/çD}=DZpÓš!Dî~²wÎNWªGz9º!ÕÏ© ´ôÛ '%Ħ¸É6ÐI·*­.:Ö~’K¤—ÐF@(ëu¤š¡h·,Äò©Häü2ë©àÇ—5­ç)dõJn–¬ýj_´IÊ7Ò͸¨ë|ÉjVâ|’y”@Âlƒz11<€È·›“¨!I¦*NRBj–¤”,B*½‚ÖMÙu9–ˆH6xWÔ¡#C@Ca¾ŸÑ²¦_Â…_}{uÒÅ+©FɲÉA€yI’Y>†ÀrÃÖ÷úš'×û}Ú­˜¬„ G>²cGÂ#/Ï‘„)²y§è__ËÊHÎϸµÿ‹š súSz&Ü›÷´^Ù¸v[nfr~úå=s:üºâ ¦È&í.ÿ<##5!7ñôîås Ì®²B"åæõܬÌ"­ ¿Î£¼Ò÷oßv2/+%7vÛÉ-GÃûO»ó=%lû8jïñ v¸’Õmžg¿Ü{44cõ].þ85#-1?#!zõ¤ïßyMÓH^Õk68¶jvVFr~úÍ _ ûá½…¤tqgö,ÈNK>½&S•«E„©V²™Áñ£I~þApcçŽü¬”ÌsËNî»(¬ÖÜÌ”Š¦.‘d­â¥Z¾Æ¿~W¨Jïg=6lÙ•›‘œ—zvó›vm¾À¡C™‡Ìwƒà×uö¨££–Ïݼ`©œ‚Û<9úã!Š "¨5â3Ͻn;Ø*Œ¡]¦?Þ·»jwD·,Z¢h¿p(wA£Àžïm9ñý´õoϽwÝ_unÙHª=j±ÛÎw·Ìb×ù6·º~Ý0Ðuüã?ýï”KÏ<>¢¹#7kôŸ¿þÐÒé?ÿ§óªÕjÆöðPSáüÃÒ—+Ú !óôïW\ýÚ<Ò´²ºŠvCýžÿ~ù§ÏF×®±©æð½¢>ÝñÞãUòm4fÔÜñ’¡ÑsË|v¼·eî@›Ð´œ4úÍáhÒ|ƇèŽo˜=MÓ…txm“Ÿ‡¡¬ Xn1uåÖ…“:díþfŸÙ?~¯ßoo?3à?ëÀïËazFiݵÖê‡ZLæؼA…šüzpéô_~‹—œƒš<ùKÚlÝ0wp1<Ð(¯<;o€Dá|"B©x[“ÂãD$ÉŽpw¿JF !"F€H’$ Ch¶8" AˆX:gG2‡B¡@ ¨èt ,^eI >Žüµ’ò€2 D2>ÙÞMÈú¥Qiz3Ìqâ‚•¾5*ìUp\ÂŒ#Öì3îÍᨕ¸¬ä—“@dGJrˆq©;rì'…ˆEŽír§å¯Ø¬Oµ5í|{YL¯JKàlÝüÇß·œ±ˆTj~‰csÄÂÈçE‘;I§,:Z”‹ÚmS¨\ÎÅM·8¦zÑ/%ÖËù‡ /Z®<ŽL•*”.Xé[ƒ;Üré.()Émº2åtHI±W™ÊÜQ©º*ÉýöÛä®óPÊÍÃksJª=8êb)øß\s:טÔæiìMTžGð>õbXn˜?ERƒ¶!Q[ú=Ùæ/Émlƒ½s*ù '¸?J†åæo¤Ñ¦O6;e$üa“PtoÞL“a¹ù›w¥Ì^Uü.!?K¦ì§”«€a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹aæ!â^-ÑDIÒ¹z™” È1–P¹‘íyËßú·%qUÕ®©×8ó÷Dðôt'âeì Ü¬þ~I¹#Û¶nŠŠâgþ®æ "„àšxðäæv쪪 Ál™¿)lÖÜ{ØUÌ0 Ë Ã0,7 Ã0ÿ•«˜=ÿ ÃrsÏiÔ¨»ýï:Înç­þzüýý¹þBÍ †a*öÝ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜp0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ó B@äøM " Ð*g›-–†ùi "Y… T²c6ÙÒ)4°2ô†c3Ì?CkˆQ!«ÈQ]™øÉåüÃ6Õ>·ÖºÊ)ƒÂaþ "É ;R~ÚŸ¿Å¹ ³Ðîù†Ú,7 ó°u™Kþç0lÑ!'V²|{s^,\’T ]j«ë@•ãWa¹a˜‡Km„&„$+@ˆ„ H ¨i”õùµÉvQ#«ÉVPulä 'ð®,ã†å†a:Á‘H¶¡Ð‘CB„F(Û1OÉû0æYaÔÛ”<§¯BgV‘C28 +AlxdŠa2¤x-nÅ@EhV}Þ‚¸Évƒ -¿Ž½Å«5? Ð…JhD•¢5lÝ0ÌCHªw®dÛÒ½ô¾ˆš ¥EÑS­za´cSaý|†ÛI•Ud‡[‡å¦+‘±ØõõÇO,ꘖñŸ%ߌµ»øx˹I™X’eB,dä] $ ŒRá­ép%¡|ÞF¨æ ç£+¸¨«×MÕª —²âmŠ{Ÿ·æÞ·pULŠæ¦…”_s>Ë1e«ª¹¹÷€~îi:RTÅŽ€(X‰E{ ä†Æö=ÿ÷ï}ÿä‰y'Vû$gÃדJÉ”øè…gouŸú¼ç¦éßÛ7müHO˜ ƒà”ô.`P!×’ çR¡¶'@ìhð,øù—éƒ6??Ý» €Ä0ù€»¤B¿ñÓí¨ñÙvçï^¸8xék#¸-0•Ð›2hΤd›± Žl;›~tÔÂ¥Û ±„š2È÷£íWê%o3JˆË-2an3làZl¢p)} \fš=×®ßÐëý±Ì¡üÎÇOÌÜ MzV~øEr v…¸–´ª¸Øó`A¨ãvðtäå ñ‰ »í‰‰…_g ‡ ~ŽÃó÷ÏÛé-žÞ÷ù.·Ý ÃÜëI(€š¤ÝZ—ò±^rõ4 }š4- Òü5¥‘*QkV8£SÛÖ;µï4`âž›fBKʼ©O¶éصßc=é>hÉæˈH'ç„v~iÛ’—'==qhÏ6}ÆÌJÔÌ©ãO²šnðø÷±H·öNÚ£S>=é0üù·’-0ël†-·/{oüSÆíÛº÷˜£éjâºw§|¾9ãòÊ!CǦÚðøÒ™‘'„S»úvm›|=eЫS¸¼vÀÙÝ…ZŠ3ÌØdO*y˜ö»Ü¥@-N¡]<-ú†9Ê0¬€øa@½ú“a­aîetª²ì1«’>"É”/ì/Ôx…L’@QIëFvÔ;ÍZ¼EDDÑ«'×o3%›è·…#» ~Ù‘ éÀ×MÛõL° º¼¨a½†onLt¡wÝWWÅ¥®hÒ`d6©™C[µzeÕ)G‚o&uä• DD9—Z´hýØÛ;ǛܦýÔÝDôÛ'ãM\ê8˜s+zOÔ©¢B ǽּ{¢‚¸üöœ Ã‡ ¢QR^©Vrú,žJ2-¹‘H<}àà¥db˜{† ‘gËš;`AÜä™7†¿~uP´ý4©¤ •„¨ð½®4*s \]óÁ¦ªÿ@D‘C>:s`‘äoýéXÓ)o:¤¯J›ÞÕ²ÓÖÄXÑbl8ùQŸª¾y qV€¬¹‰çÆt«k·Ûíª6ì­,¿Œ#‡ºëfŒoé8±VçjÖëW4»*H¨Žõa®‘Z6,éhzç3¬à[ÔåA„i]A¯½„eÇ‹Ò[¡{kèСð§}kXqöŽh,s ôoЦuM?þ3÷Ô¼Ñé IIpSÈj=êTM®G2 ÈpºP÷Çw£^J…@_'€Ò®™ì›™†®¦¢éênI¶AÞÙTÔVÊ.%µ™Ó@RÆön[ؘIäÙ,‰9* :ɒ㸄2üñ¥õAnŸ€€ðÊ÷ðœH@ÛÚP`+JäÙù`(ß[î1t¤Ò 6½Å¦ ©ý¯b¿©ã=½okeÊæN3-eÆN¾Î¶äL À¡ –”<¹†Çÿ_*Áƒþrð°¿T¶Ýçþœ0fƒÃ-À'¼ @'—y>Z®h†ù›€šj×M“h ÏSàh[Ek¦îïÛZ™)¥ÿ°º¿[ž ˆY羯[£ÓuðèÜ%4jÉ÷ŽzÈ¿¸ïŒÁkXm'¸KX a·*u\@Ýt Îq,ãÜúÏ~:y—š$@v‡ÄÙò³’Ó*Hä;ž¬mÂát\Ñ!3üö9Ü´€‡[‰´˜*p€ýA3· =))³€›sûR¤Î쬷I­Ý{ªƾx¬"öY§{wêQ+ÄõÂõ¬ ߬Œ›¶pÙãÏv~¸I€µÿ\‡§UÓ#eÚŽ_Z„¹8¼Ïã]&/^5ðÀ—o¨Ñ"HJ=y-sòÇ+ Ó *}ž €°à:·Ö®3æè[}›µþ£q+¯žøý»ÛÛá«sßš„0X\½aÍ%x¼fÑ£Ìgç2²f[©9~ânuðëóý? zýàûr«`î]SS„©¡S«FÞÝI€ÒßÅü®ÌðZ€ Ôü³&HÑœLÇ ¡Ú ÌA èŒN&=fÍÎ×ÜÜœõd.È%ÉädTÀRgS…ÞäjÔ¡Ýj¶Xí¨3M!ˆœÜ'EBÐlùù6ÅÕÅ€BËËÏ$¹¸º›¹À.\]œñe„‚<°Ú€˜œAW4«X³@öm¶ IàíQr~f˜<ÁX±ÙhÏ÷ùõeÓ»q›`îiS#Çh7ݯ6÷_n¸¾bÂæ°×ŸiÊUÁüýJ,7•Ø,œLü§—|1 Ë Ã0̇ãÝ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ÃÜ 'ãîÚ[êß•3õ˜å†aþ9 &PC I ‘ É®Z ÷~a¹aæ/²mI–i²U© ;ž}ö@ÚF†Ê‰¹Å;10Ì?HoTŠ&Ë’|Í~v}ââ$m×ä¾½yM†aþê/¤)û»˜wãåë(I:ò'{”ˆwÑdæÏ›0wÞ#ÓEòg±oX ©’&ÉÍ<&üuI`å¸UXnæáR$ÐÀ&¡¾hpH’ì^“ò©uv½ºVÝέ—: ‚JÙ¶—å†a6ˆL‘è/  ’eM;k>¼"e¾^qÉÖe5ÓºªþŒ“0!@å­æ‘)†y¨@À+ÖË_żd4’dÍ1ßf¼£“¨iaâˆ)FB 7íeæ¿Æi¹Fȵ§ô2ª™hÿ:î ù(öü'kþ'Œü¡¬A.Ü ²Òx°¬* —ñ§ƒfÐm¿XúúËóÖ¿²ë³_ùÐNp궀ÄR)W½W“4VVIDAT-»B¸M[”ì÷âøiÛ’ì‰Ð´eù?µn×léТ5thíÛCûöðHWXøãÿSþY}áÑ! ¨¤¤é[ ig(DPƒÍá›h zÖ…/bÊßïG£ ×›yвuù²µlgí·Îþa>@I¨nUk17¬šäêïaÍ~íâoéª}U„Tó7Bnzbbj–@O`¨«žP3_ºz3²Fµ”ØkYš³‡OX --aë‘‹®z¿K—.W«YSÍJŠË´Ö¬6¨Wോ¡Õ›o\®Î÷¿CÞ…=yPGWòD&¼uïpsã¦AsSÅ< ºøÞþ¬'ëÀÎÙÐÙýv-…Y¯A«q0â ^—ßø£õ:vÌrÜ Û¤í…4  `ødèæ_îjUÜêkÆÚÏfÕk†WÕƒÐ,Wc®„×t1”2xmÙ®§×©wõZž•\½ýCªx8¬‘—•o‘£p¨›Qrì잟™”œ)dc`X¸«‰Q$ÝŒÍʳ bð õtVˆQKŽÏ̳€¤ó ñvÑ;Þ„üÌä„” /ÿP?wƒcs¤ÌWRõ5ÝnkV`ÍNŽMÌDÅᢈø+›£s ׯ\S‚B´¸ßo™õ×¢¯IÁ~¶øË馚AÊÕë èüÃ"îf?5-r×째‚¹€K’fZ.¹‹(¢‚ Ì>÷~Ÿ?f`†ULëõtÞ¯ùcæÜsÏ=Ûýœs¾÷ÌýºÀHWv³àŽF/ÊíÚº·¶1  ®_SjŒ.ÍÝ­_L.jKoäjäÔ¸y›æn&m)¼yQpr—”Þ¼/4õjßø)¬Y0©eg5'N~”ØÙw§?Ǿ$’bÖ/0þ;»aDšá^¹‰¦=Ü]~úåbßë§Fºënܸ³"ÐS~xï~;Eòæ'²ë¥än~Þ%b¸ôòžUéw–ÍRȵٻ2õ’²ƒ™ò®4gÆ«S÷v ‹mR~!÷Lþ¼ÍŠÖNPßxcø;ƒ;;Ül׿—káÒ5û†¯Þ;Äp6÷·KºâÒ¬ìœÖ/v¸–‘ööÖ+ÇÒW_3½Óß·øÞ…å+GI­{ñ­Íž„Ì„8<¢=êYúV?drï WàÆm Q{Ø”yèoÄ8 &ãyYƒzC§!h—„äÃø:Ô,j“âÅOÐ^VϨÖaÁÚrCQÂÄÉ}ùwG¼‘ºñH»Ü¢I%y #–¾ÝQu¿û0ýÙ¥NLÜq(¡5°vòk«—…½ÜûîÉCyÅn[÷oô”¢øЂ>)ßyô p*úåìM×u‡Ó;8"}BÔ¼cLTvùÔo÷h[FzsÉÖÙï,ÞŸ¤¹úSîÍœìý/7e¥9óbÆomÓF¸z(ïÓ2¢;¸”•:rEÛé?~Zý}òzõ¾ýþíØéüÑ\¡Yøž­ŸæìÉ(—ér23ý‡ìùA#UÊÈÆ4:·xÈ"©Âöb·~ ÅÇ6}LºîèöNvuìúò«}ú}éÔñÜ‘\j¹{ógŒ1ãõ¬ˆS]º‡)žWee |ͬ$/ |øk} mÚùuk{òÀae§á‡WŒ`wNè3û‹Œ Ï?‘Ó!ج ÂÝ“½cß³é¨óDöÞÞI_~õ¾?€õ Æü¬¹uõTÏW’—Œmü䣺-ˆÑÕùƒ²™ÄÉ^tÔî]1’š'5¡9äYqù«Äžƒ–LþÂ/n v‡hí¸àØä¦Æ›ÙÞ½"N• tqqçŽéæ§&ù¦|uŽˆèö:ï®Cî å½Û1ûÛ¾¸á-ïWÌ>Âfî¿n Ï[ç7|;íXòÖk£Vš¯¢S—*Ë«ûE¢Ÿ  ƒ?’ôݯ–ƒDD¿@±SñéKïm&"¢««C14ò""ºMeßµ8 We@¿¨¦«æÛË n¤'"5bôÕÑŠð5))«Å6PsÐôSæ_Ù3MHM$Š¤ºD»MDDw ž‘k•·7–R é¢`,--5U³U´¿kWÅÒÓæk§5þ€H¤Ìù¢sÀàÛ‚9ÖŠ QÇ®É04Úç‹ SÍ © Ñm‘±è§/ߦ2×fþ+>]öæ“öÎiE@ðOjSÜi½{zZKDß~?i·Ù™üå]Ýýbò DD 'öúQ…_yñÉ}„kŒeo ˜vmÈô«‰©W•Q±( ¢ Š‚hüK}„?ËÙþûôëÝÞœ,ˆÈ奄ÀâG(ÒâLÒ'mã݃Jv^Ôôpf—N­Ì“X7Dz² €(ïý®%¨nͺ'‚1rîn{%ýŠ>¹@›X/ó⥉GÊ),ª Æ •Û»È«N+¬Ÿ†E % ¯"ä*ž«:„£¹µEÎÊ,àŠ66–Ÿî–ï_NÅN{€¡¬ißaô·è*«11p F~Øš„處ÑÐáÌŠÓ· h#Û yÝ[X¦W=ƒªØnäík`R—ši‹r×øÎΦÊtmí&ž(" ÷È¥–];´¬p‡ÓµGè–mG ëq§ÈÐÍ×`’O6ý`ÊÚÁákÒ–®/*6 trUa9ÐÂ? Ýª1£4¯÷  éâ @{ÿX©F0”\Êʺ0©}Ç›~Ó~ÜÃŽÉ­šËRj£ƒG¼³ Ù5u •@&ðÙÓ—HÌÊë—ÎUøœ¹¶º5k¹íö ¢Žú4:zÄ;J]³Æ¢ÞP. ©ôöÉ3%îƬ¬,¶2ÇVÊkY…HháûJÀþUsgß/SµDR®JŒW$2»vMìM7a@›=<<˜[ÔrŒmvVr™¡­ö~ÆMèv6 ­Ú…˜*ùi<–f2©” —iD‘:½çH®¬Âc¯äã#\¼¯aÎö2sÿ®°£)u6nN’ŠÎ/w³ï—á Hm¤•wD [¦hTƒÙÊØa+1c>ÁQñ„¥òÄ?³SòBwàwOÇãULwÃRê´Ý ù NÛNƒ Dpñ@Îu¹À¾Ùˆž ð]…º?—àç·°e 0¤FÖônÒÓ Ý1¨¦lÃ÷1k3agUðÿz§ºíæ1º®DʬVø Ê´;¹]åÑÞÖÎ ª ”[;›*n¨ÅâߢBßh?p̈W_vkd—un÷!o-ÜÕñ?+7gïÞ6Wéä³âÛeíIlg¦ÿZÑ =Cº2=`W·Èʘ9OŒáQ/l±w­tìî`+ÑtõZnÏ*»¹©5d—Ÿ»c§Ü¤`¬C„¿Ì€âÃsâSö'~0~`ä6úßìfŒôj{©Äl»·s3Yý5e‚­òøΧÍô EÓx#uhô´Ì(Œ %Aií$M|Gšs2öÌM5©ÜȽŸg®<0ÙEAÆâ›4mìÙTwé²í\ˆˆ¡ä²RÞ§¥í#Ó²uhÒ¥ÌZÒ¡ˆ1F¢HL"Á£}„WÊG¥–j¸ d\B{)|“qbÑ“¾yhüW=QS@S,!§Bç:c }_/CïÔ†^eU:\ÂqÍ ‡ zÜu¥¤6äA…G3§WJLÖ80v¯ø®£¼9ä­íUwï ÌI­ò¡FêTx2×ð|û%SGÙJˆ1Íú2ÏŒbÀk£^ `ÅG¯þÉò5Ÿ…KEõèÔ%>ÍÌ{ïEÉ£›«¡ÖÓâkÅ@"ÆX~‰¦ù ®™@‹öåÿz{~Š·ŒL~¸’J³Æîïúîô”¤`Ð_ÔƒÑC‘˜ `ìæÉ@3FjYÒœÏCˆˆ1‚(•J«<Â:zAÐ’”4]b£aDô÷ñl÷,÷ÝHâ'½~í´“Å`À…õãÂû}¦„]ŸÄˆ_—}(Œ±‹{·ÞnÖ"ÑÓ¶ÎíÓ—jÇV_€tá–Ó2(où¨Ð·Òêk1‰LЕ20Vrýì®ì£õî¦d€yG·ïî³Ü€Žu§ï`ÿ8‚U¦Ë0` ¬«¶àulYeÉÓ£ÖSΡpwDï÷Ð9¶U÷›Ø;Õ~ŠU~D½2c×î{*¡!ÝÒgp ;ñcÚ“nY»ûÅ~ã {¾cëVë¿ÝÆÝðA±«ö]pup1Ô‚Œ±ž±wTÞÕ@È‹õ?ª¬Ô:Abë$uòxÑÙåËu{Lírö›±AC—‰ctã虧o7Hk$RfP•›§¸Rf(«Ü®ä@§Vn¿Ìîûã¢w·àÇì½N¡/ûï[2 Œ1Æû:¸ß˜rÈ<\éÆå"Óþ‚C'¨llôjC³6ÿõ–SwÁŠÏLÿQÃdQ /_ôßF€1V~ngxlR‘ðòX*³±+uk+xtréE'—fÏNnˆÈ¡Ë¸¹ã>Œóñ÷÷MþÁq]úPøˆ9o‡¹„‡„‡_}Þò5ÎRAû°Ô²D«.SiÐ2.¤ãƒh/Ÿé?Òv®lqj±@PhPÀ¼ß=Ò'1HP–*…Š3}yi¹@@H܃³iþQ×Jéjö¦ä™‹jÓ&#`µÜw @Þ*,Æš_Í¡ ¬ê'½âP—‡–e›ïi=b0:º:`xG‹0 ×gp,À¹ =`„Ä*e¯I€ ÑŸ¦ãÊyLüÒj¶Bì\=oÖUî êüOR'Ÿ/2V³b<,-«t¹nÔ–+Ëuà¶eÃÔ)¡á‘‘Áoz¾½lib[Fô?_/ó*ÙÕÃÛ·W¯0ÏØIã^õjé7̧q"4ºo¿ƒò¨U3†núÁN§/æöŸ?@˜' ™5s($¶+¶®|éú:?E`hp@êñ&«”€:87eææ³Õ Ú²2•Þœ52<,UŠ\#ûùxùŒÝr MûDuWÅyùLØQÄÀÔ­õx¸&.:ÂÇ+ºuüŒwbÝëÑ š²2•Áº@ISî¨ñ÷ó H˜ÿSêìT'`ð¢ù/]èÙoÐèÀY›“‚ÚÏ~3rK©çæy£²'öñU„ œ²}ñLïÒâRè=òó1aCþa¡ý>ü>9uösR U+ÍÝû)ÝjL”'zŒ}£ÍÇDˆôuÚ[s¨6I&²ø56í»°8Ÿ$k£nÔ`•k")W‰Z¥æì¼òŸû¦ér•¿ð×½ÆhÈ¡zönÕu¨þí^b…Ÿù*ÊÂþLÞ*Ù8,ªýü}¾ÍjF!Óù¬*³ºÀ”‹j5Z­½êŠ3ïW©Þ Æn\™¿z´¢j|Kñ­ª™¬º‡å»&w¢÷§Îg~\K µä¤Ö”­ºSeöU³l‰^[[¡Ö>mߪbĈYv_þ&ŠóLw׬MV3ÔºAL/騨Ö?j¤Vå&`U œ¬Z4ÔzTn|ª¹ŠÕk©}ä¡úÖmìñÂͳҚEc2o´÷¶Iã76«5 «»2«„Õh ÖàŽÁêlP†ó+§ é½Èú¶¤Ìª5:«ûêÖ71T*m-e‘Ø8ÚËkK¹fmÖ4‰ÔßuuÖ,ÛuÎðÝpþ¦XÙcÿnÞËŸÊà¯9œÜiºëÕƒ©–îdzÅL3='­³Íà_¶Œã=‚Ë ‡óD‚e½ð¬G»žð‡Ë ‡Ãùëá¯×âp8\n8—‡ÃárÃáp¸Üp8.7¼ 8—‡Ãå†Ãáp¸Üp8.7‡Ë ‡Ãáp¹áp8\n8‡Ë ‡ÃárÃáp¸Üp8—‡Ãå†Ãáp¸Üp8.7‡Ë ‡Ãáp¹áp8\n8‡Ë ‡ÃárÃáp¸Üp8—‡Ãå†Ãáp¸Üp8.7‡Ë ‡Ãáp¹áp8\n8‡Ë ‡ÃárÃáp¸Üp8—‡Ãå†Ãáp‡ÿœøRËK Å%IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/fast_pattern.png0000644000000000000000000002704013051004444022134 00000000000000‰PNG  IHDRzeÌ5¿=sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 6 ŒŒë IDATxÚíw`Å÷öŸÙÛroz’@€PZ ´ÐÞé" ((~APE°Ð *M@Þ«´@$Ô$@Bé··-óþ±7! c}ýÉ|þHîÝ»efvγgÎìž%”R0 ÆßÇš€Á`0¹a0Ln ƒÉ ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0˜Ü0 &7 ƒÉ ƒÁ`0¹a0Ln ƒÉ ƒÁ`rÃ`0˜Ü0 “ƒÁäæÿ8åRÒËéÃkü éKíüɦøðQJ-ù§ Ã`róoׇŠu¢R†F6%B2ßõüútçW ßœ·úgBùåo¿¶dó BHÉ f½4zë;ù;jsë§çƾ0{WÞƒ#þÕÊRªâ”¢¿²oö´I&Lš÷éFðà°È=ûü¸§ÿZR˜ Áx"䆂ä^Õ²û<þw'!„LOh—BËÙ5gÕggY%ÕßL¿H©)É7³ Ênͧ$Í6JJ"+ò+@È«7¥ßÉÙ÷Ñ» ­IBõmñ‹…B~ühâiB’·Í‹þžØ elƒ{'Ö´î:)ÇN@]…9¾sëÕ´¼#‹Þ¹[\BÈ®å/ŸpBqùØîã)pýÌþCçoQ &AŒ­ÜP’à0 zƒÁbw–Ø f£A¯×Í‘R€R* § 9¬&½^o4™ T²ÛÎ^»åëÉõ^@V‹Á 7Œv§(›0¥’Ñhp’Ãj.ÙTâMç.åhm«Å)ÔjÔmÒ¯wÝf!šgºÕq÷¨öD)Ái7 z½Þd¶Š%JB©Ýj6ô£ÉÁ»„‰· VÁi³¤‡½BÓ®M›)Ù’/Þ6¸Ö €Óf1 F“U’›B”ätÚ\õµ9y7’Ó¬79¨È› z½Þ`uðò^DË壷´v£ÁÂCí¦Sݲvs››f¿öâ¨1/.Zô±§5é̵\¹0ÒîÍÛÛNžìqkßÑ»„¸C©Ñ) ì^7ï½w¦å9é†sß~÷-»D ³ÆBù÷G -¼üôˆWïQÏpíf¾bÂòoGGyK¦ŒQ#ÆßqhcTM9qŽ6òãšÉîΧûu‹íx>‰Í|wü´3¢ýøå3‡æûî›ýIŽ"ÏçÛ^˜=˺åíÉ‹öTiԚ˹v×éññꯛ¹7 Ð¥qÓ.—r]¢ýÞ±£zÜs«Þ¼jþ²"­cÝÂù1'Žnæµ GóÓý6ïþ_].´gG_\¾Øàå ]çãz¦ÏŒÿ:Q!ê_“¯Ôl9|õ‚ñ„#ŸOyw݉ZÍZYÒÍÓ„|ùí—ÕµŠ3kGLK^3õSGÍøïV¾ó°¢›Ž¾†öø416à;áã“ÛOiPJȽ£k†ÍüRÖ0È–îV»}ò±]ï­ÛÙ±®OöþžµÅ»^œ·5=µ¾µt}çºÞ†#Sâ¿ŒzÆçˆT·=}ßÏ¿ªíÝÔÆ~óñ¢l7úý’®÷W³øØoýpJ5BQëæ&ÿ$&/Ù’ßüXÏZŽø~ðóg;Œ"x (ô……kÎ&Œ×2sõŠký«ˆì¹÷/ 2þËпŸ 3{uyn•üùÚ¶ÑmÆçRz`aÿÖ}ßµÊK…ì Ñïÿp™: zvïÿú—òâÂÝï5ì8ÆB)¥tÇ’±Ý‡.¡”ÒÛ;Z6i¿í¦kÓݳû¶ý9¥”: ýº·ï;åSy¹~ÿ‚È#L”RÓî– »§ºÊ"å¤_¿o+þVüO´OîßeââmeÊ-ÜتáòSJ¥}Óú'Nÿ̵\Ÿ×óéäøÈ S»›"GMÜÎÂ’AL9ªEeíxnÌ•1³×,·úàÎu[tð¶Ü:}õÞÈù_=Ò*øFÖñÌÐ{ttßÉ‹Æ4\òLâÙÞßm{9ª\!ý»ÍšcÒœ±}ç¯V,²ðjUø7Û^U‚([†ÚzMümT\dUÍÅs¿HQíúVSªB&Îpæå^íǵWä^9›nšüŦ²Ç.ï|¿o½ú#<9B‰kš{ùaÅâ|{çg† x~ñ«Ïf´÷Í?_èK% € k¿æµ˜±ÏõØÝ>„Ë9y1µÇ”åkqˆúž†WŽŒéñboµ|9ñ|cÖÔ¯Ooõ“oí`’z'_íÿlbÝ}s§xt­ .­R Å°É˜ðá¯Eã·ˉ„æãB§l[û\mfBŒß1Šøû/P ’µ0íÎ=»H¼«Uöqù†ô[Y§äæé[3°dܺoÔÔ¹±yfÐ b• v}Nƽ|§7Ÿêá!jHW’þ êkÊF°]½™^¥fä…o_÷ùAKu…§Ôºõã×?üµãѵýØCwŒ•Ü0*Ëþõ ~)l4cb7™G>{úõ ßìÙWËëÇGv,ŸVeÜ‚Ø?äÂîûâu¯ 冼qûše–NSž©£agñ/L1*?ꌮ:gÊû‡Žl¬£+ý3Ì»ù?¦7„8­FƒÙ.­‡§ΠmfƒÂÝ[ý‡v`·8]EÛ‰i ƒÉ ƒÁø—ÂòÝTðõ7—?fäñ7É7­ðÄß_ªÕե§å+³2»F2¹ù{{æï€=³Â|77ú7m¹ð²}Þøcg­%„ohÿö]tHè6iÖÊ"I~š±r^"!W×¾þoºó²}ÉÔnC_á3¿mÛ¸ëi©äV™[Ÿ‹ü!$yÝV£6>¢x¸yÿÔ9%„Xî}ñéíÚ'L˜õ¹U¢~BÈÉïævnÛæ©×ÿžFþë«V6Ûÿ—¦cró÷Š ÉÚ¿2¾ßBá仑¦têp¥üÝö­ÛÕ'iÛ¾"Qàb»/ýäã>úèÃ÷fTÍÛõT [Æß‘ËJ/ˆ_#Ô‰ÖÚxêY³ª'G~O©x@ö¯Ìy1îQ­dÏû5.î%ã?Œ¡äÞù-ÝMm>â˶ Gºõ{5W"›-!Àý¥‹Ö·~eÉ¢—šý®`/¸Òªå‹†¿®j„Ћ;g;!  ?}Øyȱû/¹ð=±r£ü'´D4f»tÃÄsUÂëGÕ vÝwcÉ9{ñªÞ*è|ƒ›E7Òq”ŠÎÇODD·ã3’®e4M›7õTRóó%i¨çþ=û›wLðW#óÚÅÔ¬|ªÔÖjèF) 9O8^£I;š•t5Ë qhÒ¢™—ÂyîÈúKEÊsû[#cc«i¯=XT­Eë¿zÕÕAÕÕõ³%*õårêüC¢š6“ûC³šž»¾t#£°f”@x}vÒå›F»àæåß´Y%¨ü”•Ópá\R‘•†5j¥,–îüÔ)¶†-ªêÏ\ºÉmí¦-júiä*²S½qÛ.*«ÔŠŠª /´ܹ”’fqJî¾U5‹ôàÀi¸›”|ÓäµÞAQѽ¨]M'xF©|{V ¯§•¬§lÜ)"@Y¾O æ¤sç ÌbµÍ}¹R§¡øÖêÌë—R³ $(C#× uæÞÞ¹{§4Þ ²UçZîÌy“¯Yyµ»OTÓf~n„\»pÈæײ:M»˜vSy5hWEëÚ1ìù’®ZEߪµ¢Öˆæ+IÉÙz«Æ3 I³&^*PB S“/å ZGsÀÏß,òë0÷Ùžm)E£º‹~ìÖëçc£;„ež9œêV·cã’J‰Ó‰ã ’»gÌ̵Ö÷†`ýõâÅ\½U¡ö¨槦”‚ÌëÉiYùbIÕòîü¼{+Qšï?×)£â>zíüA«oËjÂËwòn¾MZ5÷SÊëgQÖÅ”›F»¨õ hÝÄ]‰¼ ¾=Sà¨rýÐácQAê廊Šý{÷·è˜à«¢w®^LÏ.€RW+*¦†¿†R@²?~²n“Ø{)góµêö$™ºÆ7H:y*Ï,ù…ÔŽ §¼9÷ä¹ËZvð×qLnþøÅÀ~çh§Óý4‹ô¶œ8ŸÖmî÷3:…:r“Ÿê3^[»içfavïºLZìÛûa`þཙukDÝq¯;¢}•ÕKæˆ5l\ö oÈIÍΖl©©wš$àÈ’gglºÕ*±‡"ûâñäÛ³ÖíLˆðh[8ofXHÓL·ðQB×.{ÏÜs˪—ï\N6qâÔ›5šªm¼~®çW­#Ô5_mäÔÀþ3_j Ê_B]ÿMú|J¹_O€æô¾ý†)ª4j’tøH¦‡ãß¿­Û»Ã:1ÔìÚµùêEŸÔi­“·O=òÉ›'jØ.ôÔ#çägÓ^±¬>½«™;)84¯ÇÔ­ízDyåî}crôø/?»?vï>׿UçáºsÇöµ­~Ú8_]p°[§iÍ;´®ëséľ,[½í»>w î¢e}ˆ#gâì7¼*~2kZÇŽGx”½ö:Žê¸ã~h×î­¯-û¤Vk/ÙºsðÃéŸûöé ßM›´ò\‹ö ¾Î¬'“ÛLý|N¬xãÊU*XSo¤‡5ïL¤¼‘zê굎¸zòXš²ÁÁm‹Ýíë朰uwØ‹žû˶g¾¼íà:­Ù{ ±øT©å{æÌùúOÏYþbg*Z' ìsYìÖ!æò½× ÷ü´Ø¸¹çÛ™‡ÍGZGsÈ?}¢0nmgWÃk¼Úx»Ÿ¼qmt‡°ÓŸ¾»"hri¹¡¢3=íO¥{i724a€ðþˆN{óª¶ëмàÚÙ‹wmë¶m¯ã­¾¸aÚKKÏ4oŸà'Ü;pâR«ÿ}ú~wãj -i7ÒÂb;=ªn_3ç¾-Ôӣѩµóßz«Ö¶ýŸ¨à4ÜèÕw´[hã «\8t$+¨Ë‰õoØó2o›-´ð^Ú­ì•[ZNŽháRS3¢°çÃQs~Êl›ØCÊ8wòJöëw¶­î Þøþœ™‘a /Ä–}B|LyçXJx¶5nl½ñÎÌ·-Ýú¿–{)³ßõÁ7ûýuêÿpÐôogíËñ=^Û%Î<½²m§ç²(Ýþz§6£Öº’±úa=[¿óåI9ßÍóý(/¶_Ø Ý(#¥”Òm‹žëþÌ"‘Rûů›µìq©À!¯“²nt³Þ œ®|7ñcæý /·ž^Ü í°"JiÑΖ‘Ý®'}±‹Œ6¡|¾É9kPÏ΃GÏ3{öìÙÓ&ïӻך#éòïæ[–ºÝ•_‡æ oQq²@)½¿ufdûѹ®¼Ö¡i̯)¥gÖiݲÏm9qŒhÚ­ùÂ-·%Ëý¾[.ÞqC^Ûø˲F­ß“è¾ú½¶Ôµogζ-»M¼tjÑ+ÆÌ(N»SôÓæ6¾t‘%‰J’hÔÙøòétò÷}Ô¨ÝàLWóg&Æ6é¿ŠRzquÿ˜¡ßSÊ¿Ý1rÆ×϶ûIÛ]•(Í:ñ^óÖ¯šäRd_¶b“ѵGãÄ6õgž²QJNyªûÓSå„7bö/q­Ûºe¢”žû°O‹á_ð®ÌE;Ú·è}ÎIo®Ö¸çœâˆsŸ>ë D)o³èf‰RJSºÖk¹%¯¤èâÖq‰]çl ”:LƒÅQ6I¥ôv¿&M7äPJ)5\Yµ|]¶ë4 ‹{5ùÃMJí³:E½ñ‹+a='iû¡+¥÷O½ß¼Õ+&Wò!©Â.ºà•Ä®'ºi¾ÑµU›¯ÎdPJiû—¯ÚQœèÞ3-¬H)¥oî>yáÏòÒïæèûì ‰RëÙÏšÄõ¹bp+é‹á1ý9)¥ö¼î‰ñ#çotí&í³È†­>Mqu¨Óuñ¥Tœz½ž¥ÿp¾›À»É;v"¯ù ²´…¶쀢y‡r›/è'§¶çÑ" ÊÑÛ)àêAb#£ä‰®š¯d·™O@¢ ðˉ+Ú wãµó§N¬§MÛð«ýµh@…f‘MämµU}©Ýfá#Q’ë¹ ¢õô)å ”ù§vs÷õõ)|¼Ü%§ùðöï;6ZÃSéÞ©W›c?ÿ4ßh¡5*•ú<…ÇésÙUÔ$òxÂoPϪκâ%4´{ˆ›<²Qª´j‡Õl-¼¥· :¥þÔ©SÜ”¡¡ÆÛ{³¤>][濲aö Ÿø˜Æ11{÷ë ²]¬}íò·×îؼitL³žý{ ø>—’äçéíó+‰¤KwýkT QSPâ9¤oÈÖý¥ƒÊ6‰Q¯O[cܠئM›ÕkÚ+$ÉÕ¼”RUÕ6ƒÎl_ýY®ÁD9’Ç©p߸Aâýkw–Oç®…Åé¬Ûvd4ÒY PJ¹ª=ÿÒ°ÏÛ˜V½Ubê™Óv‘‚(<ýëå_Ù)HUn:o9ïˆä)§yЉZIDA öðR—«\çP’ƒc^ Fæ¶ûeV^$$]Péï›M›.¦½þ|ÍÇ6kÒ¬^Ó^Aª&ºBçºêò~ቮ§àÝCši¤céù#š‡yÖêÜ3îè†ÏV曬”H&…ÂgÕQPP©tÀXŽ¾êQÕKŸræÂ9«Å©S·]w¼€Š­7Bq.AÚ»¡Vþê_ÓŸÉ¥BåííÍb7K¡]ÝØ]ÒÙÿa/°*#½”®ÎDˆŸ»Âh·ÊýJ¡P>&ßÑÎSCÞG ” ‚½,VÀ à¸âm)~glú7h=ᥡŷ¯I‹vxaqã=3{Ü=0gà›†ëÑ6ÆM#%oùRÞu¡EЪuäç-µîËj7RJÈ" fªpÛºrÞN×lq‹ÑEïv“ömŽ™;oÑÂíkïg»Nþpγí<¢‡ïß5wöüOv¯Ï¹¯oõìœ'>¥æhe2é­NÊ‹PW©tå¢Ý]ÞøÞ¯þŠÅ߯Þøi~¾ÉkÁúoêú•žÌ2œ]Ô{üƸÁ/ lßÔÝ]y{û´$›²Ê eêÀ‘cUøº+]g«Ø r-Ätr㜋*90Êq\@°éwÍÎÏGeÏ1.Íï¨O„®2§JÊÜÞù©w«÷5¦wk_/7rì›LB$L_ÿy½•‹¿[½ñ³ü|ƒçß~Ó¥¾%|…g`Éü‰·évÀí=³žžu¤ë°qOµÕ¨Å [Ö>æ ì¼T˜µ`AIÏä‚kxXl€Õh´ÚS–$*“”úùÿÞöôL êx”¯p_çí»4uå»ÉÐ;ƒ½+3 TÍÇ ߸éKeÙœ.*ßMùI\BKïUG®‰KfÿÔdêš¹ƒ"egM,Î ä­6eÈÉ}s¯æøæJ•Æ£v„7‡H¶|<ý­¥û(Tj÷êµüˆh¤‡f¸W.&Ý7•ŸzoѪvÁõôㅰݘ·ÓPvÖ<}Ò±' •Z^·x» {5¼E O¥h1»ê»ÿ“¿J:‡…>ÚBԽƴNÿbab9¿"²Nç ‚ªÿKo­]’bq­ôõ¯Ìßp‚˜îß¾x%MÞU‡Á}SÖ¾™+„dŸÞx=tlÓ ©¿þz»àq §„Ãáªxê®U»ín6³Ü™4dì‰üâªÕ«Kœ6¹jpUíÑ÷rªìëÛŠÂÝKÉ ‰õB¥§R,9õ›fNÍ„†wPp‚èZN ¡‚]Äõmçü5y}q¯o›7áýŸ+ïd 6Ã¥‹Éf§ô–› ß í7i¶jÛ%ÔÑ+ÎúaM5 Ú³ âÎLìѵOƒê>×.ݪÙgΤ§ªÃQÀóNQ¢&$ŠßsR¯NŒþ»Õ=zœœºrǺùçÿ79qSpû½lÞ÷µOÆÊïL*³-$Ï€oó¸æ‘mº5:gÍKW=×ïÔ€mû§6)²yáòæ;ï\NÑnÒóšÈFqK^LȸÙÆM5àXœÆ”YcøòáüÔ¯ÞT-tÓ„ÓÿÚ ”IDAT׶ÿ¤¶1aõên£§DÏÛè €$òÎ’Ë …Àó¢$Aå³vÕäa“fµÝ¾²Ž¿”z×ÐeäLOB†öo9dÚkí×Õ rK¿•Ñe`j*±GÛo^×nçʈ*î™wîT‰íÒ¿~`ùg”ÄûSFxjÉ¥Wâ=K··®Å„7;íŸÖ©Yµúõ,2vzó·¿´S€Š‚“—€ZC»zÍìãQ=Ò‹ê¯Þ}¸´:`oﯙܽS×>ïl?gäî oôLÞâç¸ëÛóƒ×žÖ¿ÿÉ#6+¨ SòÞ¯””Æ }­ÿ¡zÆÄyùp&ê?tɆ˜@H?O±8tƹŃÊÇWx—-öšðôêá³; º¡Î·Ô´æv¦½üfÇöð™Ò;Æ#,Ò †«÷„ ×,áíµ›»wìÚ{æS;ùTÜME§D‡g»õ¯æ}ãbrõc:4ð0~öБӆ:§4dÔµj°ãåf ®¶¹}ÃÚÓ6~0àâ–¥_¬¬Û,gë·½zyó³m«ß»4ýÅŽª5p3gߣ3–¾äê™Îr½š/}c”“oŸóÜK<ݺúvfêÊw#Ç¥‹£uD¾£ôÁBy)($J !¤øÅ"¥„p„ deù7ŠRû“wˆÇl+Q ¨NIóŠRÍ+¯ûà÷âl@ekRÜÚ(s~‹›¨ìù-ݘ¥ G*èò@‹Pg昒ּѻ¼?'=8u´¸ˆ¥KÈ•º‹üU«Ø×Xørûä ùëf´D©5sêK¥rŸI©üFÏä¸â€XIo™>˪ æÝüqE«èL“ŠO?A!(¥ åV&ågð˜müòÒT´÷‡ ZöhÖ-»]Iq®t6ß2Å®è8•\HÊkŠmù9Í‚9ê‡È/!äá)‚²å,ÛJäÁ–4oåÏ/)³kò¨º§}ÿv“æoV0œæu|”9#Uí7²¸Ó ûØoœú‡^Q×3Kò¯-¾½«ª¢R3Ì»aüs”z³Ü, D)÷á/®YÊö7>üñþÃä¢&Õ»=ñœïG?ÌnMØ erÃ`üU*V)›gü=°T³ÿo¥ÂÏŒ¿êºZaZó?vÃx,·n!57oâþ}ܾ>}0`k“ÆÛí°Za2Áfõk8sâÌ× ¥Ý™Œ &7¤‘Ù8ˆÉ 3të†_~V‹¢"8¤Ç £1Ëù}-\fÌp}v'Ð(@wJ3Eï!x~"EA«eMUY‰rGàÃÙ€5”à8P@ܲá³îî¬Á˜ÜªT©¢R©À¦Àÿõ0oó¡{w—Ü?ŽÈÈGû@.SQ*•!!!!!!<Ï󀂂Ù&•J¥<ÔÒjµ^^^›Žù«lò¯Ø ‹E¯×Ët8‚ T¸¦$I„•Jèãã£R©TÅwN–ÎÚÎ`róC)âãáç‡=û»6•-J§ÓSJM&“Édr8‹Ežë-m´²•Z,–üü|Ù85N§Ójµ*•J¡P¨T*F#þÇÛ€:NyX$Ïór-äaãcdB’$N§Óé4»»»§§g……gBÃSŒ¿~ôQÚÁ±X,EEEƒAžçEQþõ7Ï)¥TvpÇqœì2hµZwwwùë+˜$IV«Õn·;ù«$Iv»½œ2>ʳ“ ÏqœR©”'æ|}}=<ý¤÷^IH „^EÄbCÅ®×Þõ^½ö®` ÒŠôÞKè½Bz?9u—5œ}Z¼ïwß{÷¾1nÖ„}ö^{µ½æšsÍù͹¡+u¥®ôïNBg7 €B‰(ô:p”»ÓëDNDÁWQç…ùý‹Dp¥íÊ÷þj_ip#)¸Î®ª+ýKëŒ`Àù1Æü—îk·Ó–ùþ¶# ÆUø^òR#cL£ÆÓè€ýS]òW\¬ÈC*õõÕÿBrv¥®ôo"EÒf`âñ?D2 ¡Æ?cS~B Ôè/©Ó ÿéÔ±NqƼ"'bíšÃ¼„XtÐEˆ]éß͵™©1…š“ûŸ®,Ñ%ýûE@DDÜÖ|nïî\dÚ«¤RTØ5ë¶:£N¯dYV9¾[¯ÞÙI^2å®æ½›Ö8{ö-Ì3éâªZSyÎ&±ì¬t£NˆÀlÛ¦Ïí¥o:uøtÑd2éuI✋SF^7ۉݵ.½Ùd¡J²Â‰Â"’ ócvo;¨ˆçªhŒ0¼Ôªõƒ\ŽÆšzGBBr˜ÅwÕ¦g»Ǽ|Ÿ1€8 0`ÏŽmIÙ…Iq~¹ k~t¥YÒo¯¸ç|üÖ†ýUæp‹ä²Ï_wõ_S¨åG×¾5eQ^ÿžU!Š›åO‘/.ùõf²¶5Õ»ÄÅÇ‘ä)¾"±wvX[͹ï?š‘~íÝ} 󈈩Šgûºêu÷Þw³Q'1Ƥyo¿óÄ›÷üºd§òÙšÆÄ”d³Ñ` ‹Q¾zñþ‹³©ÚÆMÉq‘:FÉYý,0¾ûö¬¼Ò"ƒêikiZôǪ‡},?ÁU©Øµ~ýÑ–Ë'ß©œÞýÍœ¹kÖÿÛï?0øÙ?Œ¹šN}öÖ;»kø-w=˜Wä“Y»¦GWúw‘¢wrAX6å/s·…?ÿî³ nëï_¿ùØis¾í#zÜNSrÁM?•,7ËÄÀUXbE‹éá'þÆTyõ¢Y‡lÂõ“'Çšõ¦˜DÙ ­û\‘Åá)FŸ˜ "§ÃÞjÓ©<À™›ëjõd.5>¹ÏE®ëžþ|áøk®ïž‘Ì1*6¦è¶'.Óë~›ñþOþÍ“ÆƘ½ÉxrïbkfÑ÷=šÈí‚‘òÐ#/MÏœóì ’äÞ¬Â!v‹¬Þþê'¿^rÃ?f­q†ÈðÊ<üˆxÑÝÉ5 šínŸdÛ57ºÒ¿‘½Ú A`-K_^pîï?­©÷’gò­y;&Ê@¤‚ ÖȈԔ¨dDù_åDYÙ9ðØã¢Âà ¦§¥&D†‘¦ §µâ´.=>>;QÂcLEA}³_&Š–èL ìµÑFƒ19%-33Í[K„%›1DE…™Ý±i™ñV‘¸ûçÖˆ¨„´ØÄ챫2‡Lß…go¶Ú¦¶øÞQúäÂGŸéž˜`Ói$¦)oóê†ø-¯|*ñÑšùÜO£èP»Ò¿ýªÑÊ_׸“ó'dêAœsR…D}T¸žÁKEähj>u²Ê!·Hĸ¢$ev‹‹0ûô1òñ/%’[>{º9-Ê’oe Œ˜o«Ê[ë«O9Ð`e…, †´·fAX{ Z£™öº£cǚŠØZëZ$Sϸ|½5<Ñ ÀdªÐµ^’LÍÉhª<ºkî¢Ã®ôï#E¿¡É®˜,z`BÕé­Ÿ¼÷ÅÉš–ºêê;ÞœyÛ¨\~jûòW;*(Ä9Z[ïyãûFät"Ô‘F¼E)on4GÆ™ ^ ¸rpÃÒŽïÒi5 ’>ªÇÿ7­Í§UxDOõ¡µS·7Ý÷ÈÕo¬ª`döJÚíýí ÄC—¤.µ+ý›Õ6Ú..»gšsÞæ ˆNȽææ{ &Ï›ÉéF$–^uÛÇo=a z“˜pJ„,»Zl­æèd“A1x©‘¸*šÆÜúØ3N6ø^yfd‰³sàÁy#µbï†ï>³dÉ‘pócï^;&_ñ´ž;{HoÉÉÖƒ:65k£W`Áü¦Ð.ÕMWú7 ¨cà„°áWˆ[üÞç‹Ÿ»ý’ˆˆøÒÁñä®D½Á óÎ~É-Ù€ø wèÀ‚&¶O?Å]k³K1é¹zŒ@¾­"¸ÓÖÔì­z/{s ú0düDàU!¤C ¦ïséõS^¾ÏêÍ~´ìXü¸‰AeôMøt»* &“‘1Æ3 ¢ èõ†Žj¬®YÒ•þåª6Ý9„Œ'ž~øµ/~ÿÔu&+5ªTWq"¦[ïþÝ“@ªäi;¸mó¢E¿ÆÊ…À¹Ý–ko›h@ä²ÛüJQò’©G¶Ÿ©8“vYŽÞ x-~ p§½­ÕfàÄü¤ÖRWcòhâ"I®Æ†FYQ¼l”y¹ƒÓÞÚìrúÔ®äq·UUÚ« c¬±¾bã ×ó/¨¯8µ½ì€Ê*+ZêWÌ^슋z—Tí_w¨Y7qâ±ÆŠùó6µÙ›ö<Ùºì ÙŠû•¤EY»7]é_™Ä—^z©3b¤¨´î} ³U{sCK«BºŒÂ~WNœ— ©n2ëÈív{<Iò´µQÉ ÞFTB\jf·Ülƒ^çe@ŒÈÕj7F%18%¬©-½*±„”Œîy™Fàå’²¤v0¤[´ÁËÝÈÕ§Oïp‹Å§êa`ટ–[˜•dÒ38GdLjqaŽÉÇjÈž65iÄ€B`k¬=vâDS«\XRÃd…³”´4wzKvv¶Ihܼé *ˆyù1f®3¥feEY ¬K@íJÿ‚¶ñjG5¸ À“%,+`‚ÁhÔ‰Î9—<$F"Ì“ ÊU•DQ„iÆq骪\Ôëæ0Aœƒs…t¢Ž10ΡH¦÷&À¹¤(z½Œy1ÞÖªŠÂÁt¢àµPqU%^ç'✈+ é :\U$YæQˆ«ÄƒÞÀÀU­jÕåô€1&Ä9˜`0DŒ ]jWú7‘¢.íåŽAÚ øÔ¾ìíf(ùX]û¬!¯…Dƒáà>K µC‡{›¨<¤Œ-Œö<`ìÐî€|Ák iwP%AÖ.jWú’bljH> íAòyê…·iLU»ò«JC°×Ap2x›Ôþ~°³DpîPßíy€®´ê¼…‚îƒÊööT£ÎŠoçžÒ•ºÒÿ^:UrNDĉ´œsN„ Ï£ÀäÔ@+Ä‚b€—!Ä=‚ù?¨c¥ÁÞš—¤ÿE„øƒ1Ù³ Ði€O3ÍëJcèÞWƒ³ûxðšT}NZšËµRB½ƒ%zò òìèÂIí~‡f¢Ðb»Ò<)úd<&öU¿,)w1¯ÑŸ Âé=[6­U êÚä›É>ð¹)’Ç;“}BDÌeýè“N½?ƒ®ý|ž[Þ}!1FGÌ_xPNm}ðe÷÷ÎßÜ`!9È[QS\yu°´iÝòåmÌëÃÁ‚٬ϙ±ñûÊ÷ßЇµ †¿Õ>_®ÔEŠíSÝsw=¼®%°‡Zó݇SÛ'sjGº,€2ÕæcŒíøý÷ÃÕõ>´šÆÓ^. ³†Â>Y1 bú¼Âƒ¶ívxz-Ÿ›…¾ öÎk[°¡~GFøesÿ>³=·nW”£ú6ÚÁãÖ~ëÜyýOOºNT@ŒKL3æ·52&&Ìè%ƒ;7U5Ú™hÌè–×-3Ed‚£¡²lÏY´2QŸSP”.ÿ´`~d½C;®0Ò½ioy¿á#¢t^ã jöm­ŒÈî—•¨x\å§NȆȼœ Qj+Û}ØétäŒÂxKeùٺ洂1SÕ½åÍÆèø~½zÊ÷É£GEktvVšN¤«×¥¨I˜JõñƒG*$IéѧgåéêÞKÍŠíðÁC•vEVã²úô/Hä.»O.;]k“²‹zdÇ3A°Ÿ;°yßYcxdT„UoŽé™Ÿn8›«vî>â’}DòÐ~F½Î¯ÖbŒš*O:~ºÍé‰NÌÔ¯;qÕÖP¹kÿqIVEsìàÁ½,z½êjܶëhlLTm}1*-!Â`·5¶ÖÕ™Ò K 38‘Àº4C]\1”Ëoƒ$§ Åãpº(\&Äs»|ëݯ*Û\gíœ>}Ö¾ãuæ~ðêoGí¶¦ÚC;Ö,þ}u]]…K„,9Z]²³µzËÖvð¡ÄÅÓ??ýÁïìÍçæΟ>}ñæ67ÚN.û»­ g¼1{£LÞºü§Wßúdsy+€™Ÿ¿¿zõÒWߚƧãÌ̯>œ»h©CÜëŸzm–Á»Qe¨=µgÆwóv<ÝØP3{Ú[ï~<½Ùƒ²uËfÎú±¼ª¡åÌžwÞš²¯Ò-@:±óϾYxª®­jßÆ÷>øälC›à®ú`ÊÛ«÷ž­¯<=gú3æýâòx4Q²ý4sÚ’µ;\ŽÆ¥?|5{Õ~¢aåcmuGΛ¿®ì„­µæ½Ÿšµþ8¹[çOÿhÙºnW늿™þÓ6·¥åø³/¾öǦCöæê?LûbÖ¢çšÚZŽ½ûâ”Ó€àS3wMÇ.®ØIR%Ç÷MþMO ‡N'ÔÝqÇ­¢ˆß>ýØ0ô¥[¯îª;þþÛÓvì?X’Ÿ¸jÅÉ<9ñêgk}Uƒ+9Sg5›»÷20/Q§FÞ~kfœ> …Å_vôòkçp‡®¡Õã´ë¢Écw[¶1vÐäåeó~Yˆ×TÕÔ»ríézäbסŠÇ¾~æä-)kCNÕ ÑcgŽ&‰áÌœ„½£½ªòض¹YŒ¼sℬĨM_ìÿ½¥ÎÙÒ²cgYT÷W^uE¬É¹a餅+wôº¾hÓ’ßû¹õú«jÉ–ŸØPÞÁ7­>Ñ2í»s¨Áyvßöf‡Ï…’5×]³·ê/o5(9éÝ_—_20?)ÆJĘê>¼yã™uÒm{dD'GÇëb­5UÇ×ï­¹é¥Ç†Å¨uïü°øÚ‹úÅBmóÈù}‡^ÚCwîÀæ“¢®tPirÔ¥öÿåÍïòÉêJç'EAo¾ò…®ˆjk“YDlد>±‘ š7î¶ ùÛÌš‘™b9Ù\oSñ·Ÿã³»G͉xåÕ×_y¹'cD½Q}XjJ÷îшÀtýäTÎÚF×™j b·¬d¡Ê}réiõò S.(þö kšlã]Æ„ÒÒHæ(?spwSü¸~Yùc#,=qcX[zf‘;>²Miùzõ™‹®z@ÛFJRm}[tTl|L„É`6f€ôëÛÑær¦f&ÇXõ@dÿ„¨_NãRÁ±3¶‚Aé&szŘ6Ÿuö–ËMÉy‚€˜´¼œ}û<þ-¨Ëvj×–mÕ÷\gÑ‘½þìîrþÔÓw&ÇXÁ Èrù¹V½92%!J¯7 »èr":^¶ÖcŠÍ+ —•ç›[ŠeB˜Åš‘žÌL6£)!)2>ÒjÖ‰ú”pµ±™|[Ð.µ‹;K bdbbbRb1D…YF€ cÜ¡p@8q…I²Ò÷Ò;æ_tkÝé]S§~ôHYùÇo]/ "Z¬EŸQÁ§ùg#K~7ëëqã*¬…Ru¼lîŠ:Ï YŠ›çl=uÆœ +N쮬Úúãš¾×Ýoº_tý‚Ïfº*;¾ßÚ*¥vÏCuÒßFäû5=L`P4å(—TAóVUâÞæ:dæm‚('ÅÛMÂ…‹:ƒÊD*§€Bó Ÿòíg9\Q DL4£3éqÎ AÆ8W%€¢rJ¼ê,ïpLðÅ• ÀXW4®½b{Ŧfk¯ó$‚Ê9fPÄžÖpוWœ³eÅ%Lj ÚèT(!·ô™çï“பmEæv{$EᲧ¹¹EæšqÂ;ã.?ðäžV®rôî;(#Á³uÃ2±»ÕÄOšhýæ·m‘ž¨K ¢bL‡ç”Ù¯êË€¨¤^öúµŽYÒSæ=«7,ªŠ½j@Œ H®†¦f¦7ÄG[ìv{«ÍÍõËÌ&½ÙS}ª¾Í uG›mP^OÁ öȉ>SQ§pØ×&_T™”èv´T9¡:Z+ËÏÈ’ìC psTw£³ùHY+¡êÔ‰c• * ªÊmMun2SÂܶæ†æ6€ÍޛŸ’ÒÇêi:UÖàdÅQ!¬ ÚjÐè:h#ÞNLÔE‡]\ñ³±{ÞÉ‘=bm{–÷»øƯi2ˆ.¹<É…½sRûõ)â-gÎ4⾧^,Í´@o*0Ä"7<Õ4vÒ]——fëLgŒì]ÜÓª˜>)=#-9^'Œ±ŒâÒìƺ‚ÌýǧÎ1¨ ¯WqÒp"^c}Çp½Zì}yœsAh'úr"† xÇš¨r& …K8çäg µ#Îýn‚§ï¹c;Y¹«[÷‚¸HËÆE_žÐøø•»Ú)CˆxF$ysϹw^ý4kôÄ<‹}Ù’å‘ùƒo¼ö²H³ÞÛ &´ï°¿€v=íèüz‡8±@Ó}ûNΉ±.œk)þ)<ˆnäÐi |ï×BðûààÚmÒthB?| "e¬X¨wGpøòàfxœ-;7o8x¢BRT1<ñ²K/ψ·ø¡¾#B*‡bªºwoXµiß bºÈ„ÌQ£†g$Dú–Öñ4ÀâÔáv`Ú>ú+„­ªïŠGޕй“T±Ï$F>ÔwgNÐâm³ 31‚ôùX{.ë;µâ±ðÝœìëÐÎÇ*do Ę|tóì—_}íÈÙ&A`~~ÞI3‚ááÌ' ·ã¼ÿ©Ó>2&HçÖŽ¼øªýg[?{ïµ)ÓÿpÈ‚ °l¹ïàXÕ•þãIÑ?)ñø–¹&Lvd\<çÇŸžšÔ烯nîf‰ ®*’$I²¬rNĘ,K²ÊEòx$EåÄçŠ,«\U%É#Ë2÷z@©ª"K’$I*÷é.8—eY’$•s€9ë+¦ÝÝwËO!*ïŽ{î9°›(€1R$o '0Æ8W$Y%ùF¤*²¬¨œ‡x:ú¡Š"˲â•"E–$IQTïBÂ9 È²$I²¢zß’eIUI‘µNi%Fĸ—ër.Ë’¯Ÿ«gKä¤É·L¾´¿ 眈ç\–e•‘Ö_­v¯Û¨‹oþ‡']çB¢RýÊ£Ï{lÎs“È˺;7+í“ùeΫú ç¦õëjZÝ‚ OÉÎïSTfÒm\:·9bh¼r¼¥ÍcŒJ0hZ¹uù‰ðüðæz›Ëãr§öë_áh©Ûµ³¬Ùîr¹åĬ‚áƒz ª\~|ÿ¾ÃÇ5".sÔèÁ'·,]~Ê3ªb_cƒX]S'„ÅÇ„Ÿ:°µìà)Ò™ Fsaï~yé må›ìÓRÕìt»=…ýúvO?¶gà wÂèÒVCè6UÁ[—.ZY4jxQJ]ùÁm{Ž9%Å–0x`¿Ä˜0ÆÐxæÀ¦GÜÄLÖØ>%ý3“ÖüºÀšT¬¶žó(’Áß@ÿ¸p“ß™ËîòûˎœQ9 Q)Ãõ‹Ô‚?rU­oh°·¹÷ïj.è? ;)@kcÅÚ ûŽ½ 5ûw>åòÈЇ÷22;Á¬íºÌ‹]\±ãfͱvú6ã Ç'q"✧÷½têÔ£M†}|ñô[³Û$¥þô¾/>ýlËS~›ÿÉûŸÌ}ÿ½Å›2½©òÀÆO¦}WîPV,š5{ñ:›¬:«g¿ÿ쯻œµG¾þÕ–½']mÕ½øÊÚ£Õz£I¸ šWåO æî:\ÇëËžzì¹gjekÇŠE_ÍœWç€ýìºß{oñ¦}ÐÏí[ÿùW³Î¸ak¨>[ݬr vzu‘Ü+ç|±`Õ.kL¼³©ò›§.Þ|R iéß}µh½C"ÕVñÅ›Ï.ÛWÍeךßÌ\´œCž=cÚ;|s²^b®Æ3¿üeÕNE“\¶¦å?/Ø~¨Z ǼéŸ,Øx@ò‰ºŠÛöÇï‹7í9ºyÉ ×òpèØúïg/ÙÑÖ||öŒ¯w=ǹzèOÿþî|ŸæÙƧ+uqÅ M×Ù#M1 QíV°ºQýyúìQþ~ׄtÀ¦¾ðòž‡ÇôÏŒŽÏÖeß6ùÅÝR^Yîd}÷Ôh“GºÿñÔæÄžxç˽«¶íÜ}´Ç+Š»§ë{«U¿xç³ôûŠÜæÔþútF8Üw S/f»8õ›ß‹û Ž¯ ³X¢âc·ýô™¤Ñ?<ù€š¾ïýëñªú¼°³Ëqçã%µ™aåï{ì`ËØ‹oè{5¬‚ @i[:Ú¡zýS¯¿Õ3Arûšï|ùŠÒT½ÐpüÝtÕÚ³ô§}ž©Ó¯Ê49Xë¹E;6U7 ‹ŒŒŒ+sÿ­ zM­‡ï¯ÚÓYQUSX´Ù5pìÄæؤ”¸Ö›×©¾a,¬Ú(ŠV“{^>NzwÅvÛ%ƒâŒŽ¿¬=ùCÇž5'šu×\:0%&ªoZÛ%×¾W6õö¾¬ƒÇqWúPµ‘œÛ:ÿH+éS’šÕräœ8¦$`Š3”2À5­Çùj²Ç÷ SdÒ‹.·ÃlÕ9ZZ\¤¯:uh‹í SJ/Š ;QéÑ™Ãt‚J\ìÑ€úÊ£²ªzÜN¯‚Å`à»ö;ÒJò5g‰Ð[L5n)[u*±ýc‰pK.£Y/äWóúy¢Q¤ê3‡þ8P×câ=…ñq®xjݪZqºÌvÈæ’‡õÏ 3‹‡ÎV™" §÷¬;aoóØYa¯^“^‘ÝyYùIÖqÙèÞ¿mù¶­ûlζÞcï¾vpÔÚ?~W“Š”äÙ$âÞ`”Aé´»K.¬Îx­²Åap—m¬´|6"oÿ7‹=Ž¦ƒ{vœE½‘&]™Ý;Ê]©‹ÑQ… 5br_å²Ïl}zÒ /\²ñàÊ)sN¾òÚm¹±öÓûmH\Žf[Xª^§mÉ‚&¢v:—.T.„›½Þ4tÔåË’ 0[-Û}¿ßé •1^þËcæ„žƒÁè-FRÄÞ™êׇk´’åfîvDô¢˜DMízàKŠªš¢²žxáæßÎúbõˆûÆdˆ†øˆØØ‘—ÞP o&¦õ‚ÅlHP “nº‰š›™ t†0«(ºšæJ €‰¢K Iѧ¤ç ÂÜ’'%#¦æ춭Ǜž{ê¦^VçÙ5¢AlÈ`P%·1¡×ø ϯ'þÎ0èÎ Óó´n®º6Öb îvÃà5‚tÙ»öŠéÖ͹ϼúäÒwøëÔ/wï?°lþçw>:%¼{®Æ+î¾vÝÛí=×X¶ôçõ'œ…=z‰¡Ú~ ü „*É‘y=‹2ÅŸ-:QÛâh,Ÿòàõ_¬oí=¬¿½þÈÜŸW9²åáç_o•Ì ‚³¾îäÙ#8‡àniöä_#·Í|ÿ·] U'ÎúɆ¸î© Œ‡†Óë Gw­ûeý~»ÄýÔ¨p!<2¦W¿ _xüŠ¹Sÿ|ÖÙ, IDATº³–’’ó³uM?Ï^àáò¼ÏÞ|éËeÍN5cÄøÇ©·¿^¢(ŽEß|ðÞ—ó$’u˾¥s+;uêàÖm;Ë"Ó{ä÷½pܸË.ŸÐ· I"KkCmýÙÊM+–¯Øu®öèÁêWèù=äâ¸áž+w/üî»%Õ=1Ð.m©8þûÚ=.YÙ4ã©ÿö©IDû‘]©‹á3à¡`Ô-sæ|]µþÁ»îþreù#o~úä £Pé5Ï|òäàgo¾êy»nxø™‹v (YÕ"ªŠ¢¨œ¸*{oD\’=NÉzÓc/M9åá;o¼÷ù´‰Ï?rqfTö€Çº£bÕg“ïyõª7¾º}T7sxì­“ú}ûîë¿m9J‚ Jv5bÈok¾«\8uÒ-œ‹úäßÿ–U•%Eñž­Aœ«²"èØ᫯?àôøq/ ®ª²,{¤äA7?[Êîº÷ïa‰¹/¾óN|ãêñ—\µ_N¾çº "L‚."÷íïæ„þáÊ«nÜÕvà Ì$¹mc®½§náK·<òfƈën»ö“@¢(êt:QDV·Ò»'?wûMëËÅ)¯½’ZûÇ»Ë "I’‡ƒTUQU•+0ßS·þDréØQf¯1O=qã¶×M?ÿlöôŸÐ­®­â|b™¼;Nĵ3ÚBÖDðB¢¹ª2AhÿN À©bÇ9gÚéÛÉiœ«D!¤Jî=¨Ø[¾ÎAFüÚ†Hå$ŠRUbPW"¢àutÛµNúú©ksà#x¿‹“O‘ÚqìB6NÐÀäœs&íÄ!N¾áùÔè‹û ? € ÿo0Ô ¨ØÿtóÎWøÿñÔ®Ùïÿ‰1ÃG;uíÓI  õÅüwAÐÞñEçõ>öÒ+‰‚þP;ÖTï Ávr_”^/ˆ‚Æ:´À«^:ôWï+’ˆ8÷³ 0o`ebL5t9E?^ÇßìàÀä·Öûnzá ^/ -Nl ˆ0ùáF¾¨¬(ÞÛ:1'@uóö½ßC,@Z œ¬%ߣž{ƒ CË Ž ¼€PHîÀÏvË4uhBaƒþ@Ò~åYpóþ¹©ÜyáÔ¾kDA½ó …Kgÿ'ÛÓ~dBÃýÑ©Û5;øþ?4fhv`Ê”ù-AÞ…†> ¾õ°¢v£ì îPì‹áŒºàKé<  €å¾7üU#`ˆP| |n(¾²ÑMHÊð’4‚ ñØ ñÓЂ¯z—2øÎ.ðG<´M£<†N±àíæ‚øoáB˜æÖü"©²‚~‡oeZØíPXm¢;Ç„¾âÿy>Vê¯óßÚ‚:âŸfšDÜfÿQÈ há\‚GÉwøî¿=‡40ž~r öc²,²?P}þ‡~é Ÿ¾P5ÿM¶Ý¾¯[ä?'xø¿J ÃÞ*ØŸVJB{æà[¿¼ÈyPc¿tÔV€¨(¸Ú ¢"¡:Ðâ„)¦éQ&9¶&X"`6·ïB ûí±Gþ¯C ç ‹9¨åAå<ЩP¤ûù¥#ßY ^Ph9¬ðÝ~ðÿli€ ÄÆýO“Þ’%šíˆˆ€Éu’ý£›~—=ü÷šÔŽ@:ŠŽâ´£¥ ‘é°øÖ¾Í=_Ñ'›âô6¬Ø†&BV"CË9l^…mµÈO‡Nì\ðí¸L¶»ãgÞúí­˜÷ε!2áÆÀrÒ©¨Ýñ§ÿšén½Dèd!÷ZUl§°hNŸÁ‚èH0†š]X³#®ÂËóQà?Ü*¤ÌÏîÁÌè;‹¿Ã’Í0U¿àå`OFI¶¶:Ÿ¼ †Š“xñ9$dÂ]ƒ5ë±{/öïÇþƒh‰EV„ß… ‚€òƒX¹MHI‡A]zKðì0Gàø4«ˆƒÈ†µs°½–(Ä„Á^5k°óŠó´Ž»íXö;N7!)]û Œ—W0ËæâX="fc8¸kVÃ’„kÐJ4Ov,ÄÎsF„%@óSïŬµ¸xŒçŸûçan>§N0Ʊg|i¹ÈNƒÀ°}5Öo‡‹#)^À½«Ë–cklRS 20†š“Xµ"*FD¯Æ¼ýh¿ŽƒšÊZ«°evÖ 7zˆpæ(V­„bEB4°k#ÖnÄÁÃhq#5j>ŠŸcL)t¬“f Ý‰DäÝ;›¢iâTíæÁßit.™'ÍÙy~Ú›| ïódóþãDDkß$ÑDy¥´d›–Á{^LÇÿaáþòw¯£—ß¡6Oð_ÉœˆèÈ ²„Sf7š>[{þÚ]”’H‰‰´Q+‡Þ Ôܾ]¿¼GïFgÎÑiÐXªvЦÇÉ ºëËNFƒ8©*m™CÖZ°Œ^¾žã©{!S¯>ôÜV_7U"¢eóèâ~¤)&™›BåuAƒÃÉ]OC©ß¥´s?Ýz¥¢Š"¢ºk¡Kî£F7ÞJ×_D)q9ˆHUèÀºábŠ £wЩºæi#ãŸÁaT8‚6UiO§>A1a4ss'ŸÃû÷Á8ÊîOKö†|…yÐ;Ÿ‹Îû™ÃÂ;¹¯òùU:¾^|ƒÊ}ò$åÇåö¡/~"7QÍFzðZŠ£(¥¦. Ñ¡tíP²XÈh¥+î¢ýí?J»¾=ù³–{/Ž-§‹ò(ú2ªk!ÎI‘hÞgO¯ý@Ugè½)=žRr)=™’óéùÏ©¥•Þ|ˆ˜‰¶œj?·|éØŽ=»q¢B[Ƹª-f÷áØi¯BMU(Û¨>‚#!Ìí÷‰ç¡S`!”톴ô܃Šz@ÁÑ8S ÎÁ àà~9©ÞX‹]»á¤z”íA£ŒÁ^ùßãƒ/°r9lJ€ àªgj±ã\ÎakZkQ[ë祬µe»p¢šŒ8dŽ`»vcÏìÚŽCgÁÃ1bÌ"¸ŸQ DHö¸±g'Ê|¨àÈÄ–"½G!w8Þû3fàë¯ð—¾·  NÁÒ:,_gÀ'obÍfmܼ‹ñÞÕØT‹Ë¯E¿"\zÖãï?À=ãá²âö{`8‡wŸ„ ŒV8jðÕ‡ØU‹\ 6mðÛËó¾ä°£¹þ“QšìÔÐ OPrÛQß 5TÑ{F …°Õ`ß^8dØjQ¶ ÀÙƒS'pè<*ÂÑCØqŒãä.l;— ù l[‰j§¯:†ØtŒŒ<4ÌÃ3ïCî‡-ËQšƒÍ[@ÀG3ðùxðL #uøò=œØ€¯àÇ |1 _<…ÝÛ±uoç»íBÁ‘8tZ›íN;öîF³ÎfìÞ踯Î9Z›asø§ìBKD6üŠWßÄäçðÃÌúÃñÉ;8RIW [‡¿”Ó!¦bg¤ÿýíF½®ý<°˜JcQ›‡vÿDÐtxtÅt¦‰ˆ¨~™Í$€`¤Ëï¥-y’Ãé¹»HÐÓø¿†,EDT;Ÿ÷$ýý~+kÕž_Öƒ,f2[éÊQ4¨”}ŸÜD§fPr$iÔ_褓~ú‚Â2iÏL²Ho¢âa´d }ý Eµà«KéÀ ²FÓôCÖ¹C_å_Fyi{mÿ™r‹¨_A  DªƒÞø+@`d(÷&"¢sÇhHd0‘Ôãa²Ý“Kyýhï)º÷j|U;hããdòqÅ•s)UsÏ¢«>"›‡ÜNºtõ}ÔRI£ éê'ÉÁCÇ„í_JéšøÑm”e¦¿½GR¯xsYÓiùaíÕGo!!ŒîK {šˆÈÙBgO’}/•æzyTyŽŽ—Ñ5Ôï:QGœ¨¥†FÑÀ{©Ì2>% Ô¾´ÑÇ߸Ÿúj#Ùhd ¸vÛCæÉ= / ßö„Ì¢kò(§µmÿ„†÷¥‘·Pz"Y¬“LN¢–rºm˜DåDnVBá݈ˆ~›EqáôùrªÚI—. Ù/þÈ´|ÅÅÒª]tÏh‹oèÜn"¢Æ@?59é±”RDŸM£‚Dz|–V€ÛM™Î¢±ÃèúG¨º-ˆÃ+´k•fi3'ÿ."¢ƒ»(ßJÞM#Kˆ"{QeS;ºŒ†Ä“a4Õ¶)Í~ôzzûšþ @Ïü¢åtµQu ¹e"‰F”@"R}âù¸â?ÐÇŒÜz% F¢Š°y6êj±í ¿æTÈ(û‡cÚj¸p7^ûßÿˆgnU÷i^k,^{ QÉ(߉sUðÛ]øýr.Æ™“ˆ‰ÀÖŒ06`Ü󨉰c*âçÅp3˜êÐçU,ߎwïÇþ-(Û;Ç=!,ûŽc\ œn8°·vPa›‡Þõ8{ GC†¤H-þßñé;¸ð~T7à…I85 ÷~‰Ô<ü¼•å˜ò(¸u(¬€³­6¨ oÁß"ü œ©À+âLJq¼¼+”<( T VMG”Œ¡÷%hb²Þ›Œîi 3Â\°:Í_‹¤t/Ðêzú>Åã›H(Ć7‚1é9°†ö  RRmQèqu-hv©þ—Ôœ\E]šp)¡*ŠÎ2Û[ÐÚâçŒÚ2ÔW`ÖbŒï†¦j\þ6£ánƒË®ñR[+ÚZ`ØhŒ‰ÙS1õ+,=Š­Ÿ‡Úd7ÍÜ(s:|9Œ!2_ü øè}'áŽ\}ÞØ‚‡žDašeù±f0†!W¢P»TP4Õbê—pg£¢ë>Äééxf "Œ8ëÀÂ2<ü¹ ­û°ã8ƒªBUÿl œN Ž^ÝðÆHÌÇ wbþZX¢a= "`‘ ÐÁGU8¿yNãdà„Þ98¹Ï= )¿~k‡‡pÒ ‹[cS%LFÔo‚ìA›Œ§>ÆäËQ’‰U¿aþظ]û–KW",Qv$ +0w+¼»šø8\7q€`ÄÁp¶¡{>–ÍÁê}ˆÈÀñCp9Ðæ¢ÅÚWÞ£Šf À @`1ƒq”^òàÑÛÀyhW8R = k–`ãZô¼Q1Z†C'Q‹¯GR žy)Qøc1Ä' á ¾žKÆm—ü#üR¦ÎÁ¼gpú8jÀîAÓAÀ€Ü~`r3‘ž‹ÅU#±o)MöE¸"è ÷‰” ŽVb}ýa"Ð 0ш@9?bh,1D%àáè·þ_0µ…'àáØL Žü/å÷‰qðcFa`)f? °í;WÑE&áÑ;`/ÇÓpç'è‘ &€xh© 8ìæ~_}ŠÓ5¨# .B¤•5ÈéŽ \ Ð3,+Çsñ×ëQö|Ùؼ¿~Ô_É[êÏB±x*Í°Z°i6ô&[ïÄU—bÜH˜3- ~X€ºpÊ…Pû*œ­È…õ¿âöIÈÂ楸m<†_…½•ÐÓ>Ûéè:Cƒ3D‡©J»o“Ð"!2²Ÿn‚p-Á¸7Wˆó1Ö°5`á<ÈŃ0h(„ P€ô(8s¯=†õå˜0Ó¦áð8¡"¼Cú"êm¨\õ6H"Ä ƒÙ£Tˆ¡þ8æ,P4ÃB:ĸÀ ’‚ÏŒëA ±2·Ÿ qHKÇgß¡µ_NÁòùÞX@Ç@"€´Ýrõ1<û4lÙxêq$„ÿƒIèªÅ5ñ²—^ˆŠ`4ãà~ÃQ’Ž˜¼= qñg{QÄz ³§´yìhC´&! Ñ“‘Áàë.<ûŽ;qÿd|2 ×=ƒ•oø¾®.èJ:Œ ÐëÀ¸÷ð P÷»Ç.8[dhr@˜5Ô.¬lƒN× j €< * Ozä·”(„E–ƒÔ<ì9ˆn10‹ ò;ùVQ¢˜ò3.—áƒUpÈøûÍøi+Nr€éOàÑ{qÏ]P w¿›'ãñÎ<8N£ˆ¤P=*À@FõY,ù®ŒØž$€™€ª8ƒTƒo†ÕŒâxézDY!Wj V`kƒ¬G¤ •h3à›ùà¬Ãàõ0ó7¼s/ÂÍ µujZ¤˜àˆÅWsà®À–Ý(Œ[}æ) ­;>˜ƒ&â’‘hÆÍß">˜ƒ²„Ÿ¾ÃŽc8ÙŒ±éؼ³¦aØ•X¾•HAz!ÂD°,|?mµØ±=úaG98 øœö-I€ÇÚJÄÇBmÆÚíè]‚¬ÔöºiÑŠ’ÔWÀYŒ¼d¬òÎHò ´`Ã6 /ÁÖÙ¨iÅ•ƒ7¾›ŠõðôÈ6ã\%ÒR}ØŽÎ0 Xy7½ŽžÀ›wcÏ!ØÚ°}#"¢“Ú£xéuDãæ«ÑºârÀë0{²Æ¢´ Ó±xNŽÅÁm¨²£{6LAÀ4À¥¢ H~Žï–ãžðápÕ`ú‡˜u%n*ES#P I$4ÔAR`´ ¦.’ 5• ‰aؼ<}Š¥ Ù×`ÕBüò î™X±B$údBñ`ëj()(é‰H]UP=¨©DU\dŽ‚< dî›ñÞ¹'ÂdDõ99†Êr4µ"ØñÉk8'bB?¼ó2ct϶Ã6÷ Ǫ½øæ}äÑýˆ G¤Öp¨= #C£‚ ÝrPœ‚eßbw/¸÷@l",À–µÐE£¸FF añ°& ?‰'.ÃWÂ~60{™ï¯1+WB¯‡)=ñbÿ‚9Ë0¡/«1wâÒ0´V/»_á±·0<Gv7˜ &=Dàˆ deunúîDmãÕ|øWêžIITÔƒÒÓiÜÍtªŽˆÓcã)#Ÿ&ÝHã/¡¾#èÇuDDß¾B%ݨÏÞFŽ£måôÓÓÐ;‹Û+…+WS¸ŽÒ.ÜYü A¤WæRí;„ÌVš0‰®Eaaôà»ÄUúüE*L¥ÁÒðA4d,m9L³?"€–n'•Óñ½н/M{Ž£Þ}ic-í[F¦úxNˆîøÀçÐ#Pó*I¡“¨èž"hQëizlåäÒ¨‘Ô-…F\Jû«¨|?E‚ £A#hÌhv!ÙºÆH–dÚqœn¿”z§J;­{€ºùSrÖÑ„>—JWÝ@÷ÞH‘"¸‚ÒÊìCDÔTAÏÜI©IT\B)á4h,ýºƒÊfR2èÎ)$ý>z$QÏÞTX@×ÞGGkBLww£¸ÚÝD§7Qÿ4ÊIg‰Õï£n&ê9–6í¤×5½Ú˜ hâôÈSTÒƒ¬ X©O1]6•¤Vêg¡ÁÐŽ¶SSÕaºh%&QÏÞ”–FÝzÒ”¹¤pjª¢Aa4øAÚÙÒž[AeåSi*)¡¬\*o¥‘fÒÇS ÑÖ·)ô—©ä ’@…—Íx‡â¢(«ˆ¸ŸÂ ‘ˆhæ+d±Ð볨ú•ÄQÆ`:\PÛüüôÍD5tß•I}úPf7zö=r-ŸIƒ )³I¹itË“TÙH«fRq.÷¦ìdê{!-ßC5ghܺñqªl Ì ÉI³>¦>E4t4õíA}‡ÒÆÓtx'é@Ï~HDôóÐ[¿µŸÉ;—ÓÕ£(9‹ŠzQ·|ÊîNS¦“›hóbºb8eåRŸ*éM9Ýéê{i÷"¢Ë†@§© Q¨‰? ×1ôŒ}ƒì\;¾é1€€’ÁÈŠ… t+ÂÝ`d_ˆz–bH Tù}q×½TÆŸ†Ñ"-6óQ_ƒ¨$Üv RµÅÕ‹¤tÈŒBD7\0 ÝÍX·…1ºú Di/p†¼bÜu/†ƒ1Ä&â‚1ˆŽ€XL=y™HJEz’20r"@#‘™$ SpÑhtOCD † Gq>t:dõÁ˜ …~C‘шQ×à©ÇQINÄ° Žäd¤e`ä˜Mè5Ã!‚î½Ð¿LzDgá‚ QÔ Å%ˆ2£÷HÜy; óƒâA¸l"úÑ›Šˆ( ¸à áñ "ƒ/@n* û O1tFŒ¸ >ˆì¸Ëe 7¾ü¥Pœ†&Â]÷ 8"ƒ%%™0D¡0‚ },FÁÈHNFv2³‰ábÄ dg «7FõÀ‰#(¯ÃøÛda‹Ç¨ÈKGt†]ˆGÃÕc¡cà„ò£¨hÆ¥7"Y€ð ê1½º#+Ýr‘™Ñ ÚŠ¾£1lt¢Ò1l4òÓ! àQ¸h,ú÷Dv>ò³Ÿ†[ïD÷\ôŒÑCQ~¹à¦+ž…ŒTXô((Er„o.":#G"9ÃF!/‘‰¸îvÜx5"Èé%°ˆHÊĸI¸ï¤Æ ³ý‹`4 Ïh<üFöS°}9l:\rÂÚÀ :tï>Ð È*Á O£W6eÂȱÈJ… !£Æ =:älú¤L ‚´D$$aÀp<ô®¹&i9¸p¢“€¼ŒŸ„îD÷´îÃ{#|,^¼Dšæ&ˆ-v | ¦=Ðë›TÆ È0Fƒ¦ÈÀnÀ`4‚T²¢‚·P(*ôzB1,y š¡®GÁMHë…gÄÌW±² 3ኾHM’@þÂUH Œ†@#Et"@e¨£àðHÐàuêÐð¸:=t Š Ðé HP8Œf ¨¥*dˆ:ôN’‚@Ò &Рz/ô ²Qx<tÐë KP½;Öïà0FˆÀU( DL8$I{= 4žBA.ú=Œï>D” ¢ox‰—=8‡ÊCa1BÀöK¦ƒNÁÜ7ñK=~Ò5ïäPeȪÖ<¯¥81÷M,iƼOF9NP=šµÐ—3¡È À`©ˆ:ˆ"‡[†(j›UU¬Âd„$Aå0 y@" :0ª Y†h„^¨p%z½O›%CQ¡3@'¦ŸG'è¼ãæÝ sH À`\õxæi{âÙûn [ß3}Ý¢Ü;“}US(¬ÔÛÁÛ¯ ¤—÷>:æ¾ÇŒM¸u8AÀA@å¡•Ž‹N1íÞÕ®)€¡é˜Gå¡x™V~Oq^™§/Í_Cr´Mp3ÚÞió¼ÖN@+Ú5µÝ?.ˆw,1ø.ï¤ íîø-wê: Ö¶¨ŽàW8'U¦…  ÞK8/Z$ô{© 5ÕPuC ïdÀýùkÏ;V!ƒsž‰Äƒ>D²Ê7¤oÑYÎàŸ¼³Qm?!}Ÿž|¯(ÕÔPck`âñó\œïæŸPDÇW‚ïï_B9VJ»‹êíqMýC]rÚA:ÿ[ÜôO<ðs)™b óCý…ÚIš69°ßi~Í­É nô] ,×ësMuR‚~ç­ú¼nv¢#(±=XT%,ø`¡Ö‹ÎyîVnUÇÿ<H?Œ³34r»õ²vÀhÿþˆýy }:?i°ÿùÇ9¸à9ÙygýÇ)Pg°rv”õyî‡T„;¸æÊà·’÷ÇÝ‚Ú&Xcé›ë>³¡KÝÎ7L²¡º a1ˆ‹„àu3ä` Š‚ºjèLˆmoê`¾o¬™F„P_¤ 2ó¤·k\Õæ™D„^ÿÆBÚöϹ¶ºÆ4P}ljò?åÛú?•ÿÿ  /ð/myðÚ2EÛ/•¡j›öÐVl\ŠÕ;¡ê§mCºÄ :µOÞÔ¯ÏÇý÷Cï[ ý9«á‡¥ÍHŽCÍ)¬\-ÛQ «ˆ–Z¬XŒ 'Rµý•ßÂ[6WÞˆÚxŒ,AÔhDrbË:ì=‚”˜M +aÃ.mkqÝÝhÇÞÐI8y±1C}îºGZgÁŠõع{÷b÷>”·!)hÁÊåؼûB1!)^[€˜Ë–bó´²mp6cÉ/عç€îÉÚêÞpËV`Û;‡„T„ƒxÂ?G‡Ð˜¹ÿ[þ7½‚]ÿ7òÿ_ VÔì1d· ÖÒéBÖq'¡ â*§ÃÛ(ÐÕP£O‹írËMD${HõIʇÚì$s ïçO#¢),…¾Ÿ.'¹$ízË<è¡W‰ˆ~F&@³ömþ•¬ +Ÿ f™ˆÈé §·Lmx›ÒDzô#rzÈáÐÜTNW¡ÌB:t’ˆh曤å–ÒoÛÈvœf|Aö“B´çs3ŽZ‰ˆÓñMÔ»7½þý|7Û  ’RºáUÚ}„¦ÜOV+¥eU¤žÐµ6ïû™’ Ë_r4!:²•žº"A®¶& IDAT<«e®9F_Eá”O0Òãomo¨+u¥vI× dICÇ)8»@Z2ªPÑŠ˜00†eà°=rQ¶–L\s5rиo/GáDŸÅæ3}1FY„Á½ 7cÅXµ º(\x-Æ!³?€ ;\€MBt<ªë±vn,Fs3Æ€èÁ¢ÙغÜŠË'`ô@ü¿öÞ;>ªj ûÿž)ÉLzB*z ½ƒTé(ˆX@Qˆ×‚‚ج Øô*6(”^¤wÒ{¦Ïœõû#3™™d‚÷Þßûy_¯ŸYÁÉ™söÙ{¯]Ö~žg)B"¸teoq±„ný˜t -Q1$ ÕñÍ›L}‚!SyëÚ¥pi/f+¡üò5/=Çï<û n$t?:=:Qù#Zxu=““°º ãâì>Ë ¹}'¿`Âs|ü5#Ÿ£ê/,¥SG wë·Ü?q˜|OŽâñŸiï®ÈMkøp3¯½ÏŽl[KU$&W‚’RA Œ˜ :Áfâ½Wé6–9Or~»÷¹ñ»[ßfþ ,_ÉÅL^šyïRªbÚÇk¯òÒB~ÙÍ®ï¸w›÷x)Ï•¯–0ë%¬!\ÜÁ]÷p¢€è(&¤³w/§2):B§a„G²vÙ›Ð6¢a _ÎcÎXõXN0õ.6œ$6™;8ËÖyè^–mà ÖRV¼ÅCÏ2ùA>Z@»°“µ×žfÝ0sÒîþF§“PµdD‘S‰ ÇaÑ[|ù —‹hÙ7–òèhŠs8— ‘\ÝàŸ‹Èá®1„i¼¸ÖjŸêo,bxkw4pTpú Ó¨ºÀ7k0GÒcáÕŽ íÏ]ÑœÐ(gÍe®ŸÄŒId„óë.Š-âÀ®aä½ÊuÝùîkr QìÄ+¼ò³ÔÉ/{½«ó‚V‹&•»ïãžÉïeÕfÂâ6…Ò“œø]û2Šáiäÿ‹X¿ŽÃPõ,ýŠÄnÜz'ÌäÂ1þùú8œºdðØV-¢0—Å/¡'DÏ‘?˜»ˆœJB;“ÚÀ 'e%Œ¸ƒÆ AÓOÐ5ÓE‰ çtÌeåW

g$›†*Ó“WEE.•Cë1æ`·ãªD(Ã.„*„(8\tlÊЬy›´XîÎéú‚i`*¥¼Œ¤¦„êÐé±(tlC£tR;á²pt?/½Ç¹ :wá±W1å²ñg6^dÕb"Œ×P¦²èfºtC£EJ ÝÇBŒÄ$ &)¨hZ5Çn£¢ªs!hA«Çk¬YrÆLæò.\ä__“ɼ-n2DE;·sá×Ѽ9Ñ¢jÖYödsìŠ é™ây¶O‡æœÚDæy6¯ O?¾ÝƒFC\ ›rò2MciÉt1’õ’H³tÒcèÙ˜UË8t„‹[HMç­ÕÄÆ¡NáRËïCÒûê@TpÚ‰éë7a¬äªt¬!è5Þy^§€‹}ed¥"‹ô ŒzfÍ`@Oþ‹cÛYý ­›ofé“_—fÉ+‰‰# ›ÉG߈8壗$-QP¤eyzY`”VЂøV=+þü-ÂͼØ߃û9°—qÓx)‘O±ò3”sD·£K €‹o>“qO±ê!¾ßÆ«‰øõ;ŠµŒ‹* ؼ G7ŒpÃtT§Ž°{/m»Ñ­z='ö°÷4 1t°[ϳ(‹ÍÛQÃ7ƒpé»ÏÒ¹%'¹PÁ˜q„ v {v‘ocØ¢ÂP4U,ùŠ±´jÅù¤t¤K ô:~ú‹–”4rÏqÕP’«¡6&ÖþL•J‡žd¤»ëáø^ŽœAÅàÑÄj¼(³ŠLÖï¤Izµ¢0“]»HïC¨‰C‡±Wç¾SQôtíAë¦'ör8‹¶]éØ—ËÝ f­îÎ)€+J­Ôyìt=ËÙ°“Ái^×Í|…æOÐg;Þ­÷9u|~RP}4pQ}4žk®Im9Zi¥ú–Öïº [u &µ•)|‰°¾bÍÍ•ªVU}ƒuqøÿÉ–YçÓþE^ùÉúÞXÍ@?ùEÉý?2]€*®¥˜à««¯( œFH ýE¢ºrû]d ðF¨t­ö¨îÄnžˆfW£ñ¶+JР& ¢Úÿá¾hìZþ¦øèÏŠïñøã¼}ƒÉ¾‚îŒ?â¬Ô®øü°ļ í'S]'íScŠò_ʱÆèûx@%rßO®%Gj꤈€ž§þg³¢'C¡Ê†ÁàvØê;m& ufVÂ"=jÖÿF_©o¦ºÜ3O}˜w<ÇèÕ“’KEÑ¢ÿyøÏ@÷5ÉOjÍlªZfY—: øÁåUÐ*^W¬¡Gøbµ-&ŒÕƒ—êÌ÷™c]*ŠOÖU@E´ÚÿxA+þã‹â›.¿¨þ“SE©æ¦(~ÌCÅ_Ž¾¦frtjþê»ô¨iÊÿvŒ º›³*—öMxñ5ýʨkùb.U0¹qãïeÓV?Ì}sÈ)B %&’#[5˜_vóó·Ü<±c?žñã7– ·°ð ^{„ÁÝùú¨;„µ”_¥oÞû'j 3ïgðD4ÚÚ~X˯Ìgx~,æ’k&çs"x`Š…Ù“¸ç~.•øA~×=KD†ŠLž}„ñã¸m:;Ϻ ;'⟠¦;* ¦RfMcâòK<”+ŠRM}–"²! ?ðvMQP4œØÄÕײä´4JOðÐTFÎFãbɺL`ËIÏCjÒ<ù'3ÿ\@Þ¢*¸\Þeˆ(~‘[÷ f>»§s2Ï­‡?q ÷=ÊÉr4 Š*xënºƒµ{Ü ™‰çêÕc_1ô¾úÙË_ÑÀ«3þfÖnG£ ÆŠÿÛªouåLÑÆÊW›dçûƒ,|Oì‘»zˆ&\^Z!–³2©½4ë/'³Ý:ó?¯BeÉײô ‰£QDQ$4T¢’嶩rs EBn«]D•¬ãrMw¹ç1qåH§–BøŸ‡+É­¥á9W æùþG9|N*reâ@4NÎæý9q¶†¥úÅ«Ò(ªF1J ‘òÈ+bªÃ¿Uëp—åËí×Jßár1ן·ZçN{•<ØLâºÊ†S""ªKª¡ô¿$ ÿxÍ}ÛåíÒ¥‘ÐKÄ)ó›Ix;ùî@ù€têœi‘ù½¤÷°z¥ò«JåÉ2b‚äUÈ¡¥A˜€´ì.ÛóED ËØ>nùic¬<·ÒSrÕ Ír‚€¢dî{5ñeé–! áF —EŸúçhÚ•Lhé¨ücm»0|¦Jw D§ã– –dâã<1™*‹WbØ;‰¸°¨Üý0…å˜Í ˆ#¦1VÊsyïQ úì_iÈËäÀ>o¬¥fì¯Eº ¸«üu1ôèJZ¢Gd4ÌådgSP BU9Ùde‘“‡Ã‰¸Üª„ŠÂ¦ï˜õ 9vö^Bs½#ùr)ÿú @µ’ŸKVÙ—()Ã%ˆ‹ªRrrÈÊâÒe*­>S®KÙYU (¨6J ÈÊ"+‹Ëy8œèŒÜù1%8µÓ½MÍ—ø©}zrKº«Åf¢¼˜‹—0ÛP¬&.fQfBQ¨ªäb6+ŠBQ6—s)+#;‹¬ª, Rq™gv£5"PVÂ¥*- à('+›¢2œNŠK‰Š#&;¦ï,I¡ÌánÌ7²f'¿G’JùìMN€¢qãvÌàÝM<³©tƒ“Ï^ààQÞØBU ¬¼ó#ûʃÅÿj*žDOùË)€&‰« ‡CøòÓæñù3ÞÅꤢœ²RÊÊ0™¼k¿js ¢R­Ðmw`³ÓvhX½TN$·‰­Áhûg­§ #ûC5dÂ#ÄDhtèàÙHk³_`+eöZ·¥wW7ç³m(mW'v’Sʧ¿Ð½ªŠ®?žæçU ïðã´I§ÿp®êNÿë8”KUÿ¸‘ôôîAj#xm­ExòÒÒY°`ÿz†t%½íZÑ(~FÑGëeSU½™ü³•›¢`.äÕ9´oAz*O~‚Søc%éM˜µà‹÷HOcãï÷¤Ñ(©Ѷ Móì‡(6ôøc çðÊ“¤6æÝu¨½ˆ&i {€pe„EbbÅÖCµ³v)׌ s3l®zC;à—®Õï},@B²ûä@[ÅÛ³y}¯~Íâük5˾cÆkœ8È ¦ÞG•'~`us]g¢Q æÎãƒر—çÈÝŬùØ:²mß,åìV¾ü'«¾ãÓß™ó>gÏðì]˜Oq¼c(®JÞyˆÅûyq &S”Å¢9Ã÷Û8¾›® yè²T¢ ¤6ä`y&of;ÁMQëßfÆÝ̦MŒêÌ[“[AhhHŒˆ‰F!!M’ „„¦¬ZIŸT֮㤅ƒ«úfå+tŒ!$•ˆpi܈ª*mÄw"$‘ŒFîéÝmÌ¥DhÝWÂZ"&l•î2‹Jj?¢ ¯Ò§´.Ä á=úTTª%ÀgíÏ]±¦ÂÎW¢èh›.P+!M™y;Z3×ÝO¡Ó{»ËFq……PRîs à].¤÷ àôZ¶^fS>};'0œÔÉ8ølJ¼‹ê°üÎëÿ„H¸ÕBi-§·óîçĵ#C¥ÐÀÔ€>)A[Mà0±âS>ZÂÌùæg¶¦ÜN˦,žÏŠ ˆªãÐAâ:rí¢˜»ŒeKh†öíâÍ•Xãyh$⢤œßŽÑo,½»“Ö‰v¡Š5—‰ %1œò"LæÚåת~!¢š#“ˆFtëKë®ô òÌîûU¥vÛ¹\Ä4bÊ}ŒÉUíPKpY=ZÀ*€K܇–‚ìäÒ,eôÈÀ ÔÑóנѢÖ4 oD­fqá× ZT €Z¿wzGœ ýç®(5µ àôä°8™|#óÞâñ[ÙôO¾ƒ 4 v'ñíXðË—³|9=ˆÕ|¥¥ˆ¢PXÌôg‰¶ðø<Zй?“Õ‰è:­”•bsôA?s¹Ð7ç±ÛÑV0ý%4FD¡ôíϘÑÌ~š%ËðÐz1FФ9j6k×£m#¶ýÆG i‹ÙŽ´*Ú4n¸‘ÛngÁ›Ü=Ž0¨(w÷ïªlví¥° ­BTsnž@ø%ž^†¢EF°”át‚G;ÞˆKÜç.¾£Uƒ8€Â<÷³s(('¡­û-âôøž DƒPÑY«gv¿ü9 ¨!(ZÀî­Q½Jw¡…#Ü.z²ˆr=­¢¨IÜnÔ Ñ áD7¤¸ˆ¨h€›06 ª @IV›»ÉbcBBÝeH(Ö¢8¿}"!Iu`Aû·Žø=*R“;ƒ¡îFŠ EÃS¯“{™å/Ò¯ ·u@#èBˆ‰u‹5EF¸éH5ûN­â="¯>¼QtkÁ¯_1àz5æu;QžÐ?V>\ŽÕ„¸ÀÀñØ7³ð3®™ÅäAÞ©[ZÅÛªA-6'mZñØkœÜÂç z ½zeæSôkÁŠw9×’õ=ˆ=£¯áêÏx÷9L™4k†­˜ƒ»9UÌõ ŒìG|¾%sq—yåCî™I÷^8>ã¹ 糿„oÖ UiÝŒßÂršwg3j 1r ï¯â‹>´UÙü;á}Ó€²br«HN":Ü[?©]É€o>'ThÅúo¹lâÝÛ'-¦‹¬]…ë8k~„ ’Âq6Øð5 •¬ùÊ­ Oš_·h€‚Kœ¼LTc¢|ù)êI>^ÄLI1ÆæDÇí»°Á9+ÖR~ý‰È~4oŽ¾„GŸ¡k"oî!y4#[ph-O}Ä´GéËKž8y{iÙ‰›F±àS½›‘-Xø½ï¤W× Úæ¿=̨=Ûá“EDVÍy ÄfÉ>,‘è&òÞ2¢¹h[Éás¢ªârÉwŸ ȼeÞÈu ’S­õ²SúÅHëéR òùy~«”dK·6rííb;' Þs4òÌjùøv Aæ|ꉤ‹”í’k…ÖrºTÎ.¡wŠ³X†v”öƒäl±TÈf’Y*+JjiÞK¾Þá§8*.¹pL¿ÃûÆÞcä³µ’[*"r|— n'è$,L&<"¹¥b-—wžƒA´Hlù~«çËu%£§dHÞ6 IÉ:(“G‰N~dëIUN‘f:ùDZúä4v9åÀz¹¶·»I­eÑr)·ˆµBîFˆ‘«oFF‰j&Ÿm»Sl2wš€tè%7LUëEDnBˆ•_.Šš+S»‰.UöŸqÉ-dà49š/OÝ* I½ä§—¤a¹g¬ ¾KJTqž”ME«óÖ|ÿ»äd®¬\$‘éu½½,b“UOȲïeé0Ñi½UÒR^þUlªüð¶«+óz9™DÀÿÿ€ƒ×À û)\îņm´T)­ÄFh¨[7Ñ\Œœvœ ah5¸Tš wkx+ 奨ƒT'æ*ÔPˆ… QèÀT…FG¸òJÿäu †0 tkÌK™3Ê=—¨,& Qîܺ¡¡„…aªBÂÂÐj)+-‘ÑàÀlÆáDo ܈FãAŸxðqf«‹§Åê¹GÅdÂjGÑ`4bpØ1[p¹Ð…ŽF0›Q…ðp4PV q±ˆ ›‹  FB haï×ôšÌÒÜ=Ñ3) *(* Vú ô:Tk96-!:6áaè4¨à²SeB‚V‹ÍJDzæ2ì£Рfv!"‹ ‹ ](áa8­˜­hôD†PV…V‡^‹ª†â¢¢Ê­fí^-…NL&œB¨ðê,HVLfÂ"ÀŠÉé·Q4†aУ:¨2á‚ÐÂŒ^¸EpbüÏ€o¾ð·Í2ä,ú‚G&Ô«µJ@_ÒD]iÆZèÄÚµŠQuœ6ýÙ’G ›Z Æ@gÖG˜ZºÆŠ¿@­/[¼¸P|.Šâ#:êóR¿¤ÆmºBeŒ‰åµ¬ü”ž1PiÒ®ýI_ü?³FÞ·N%×ÙÖ…ÖRC®W¤¸:°$àPµR·žý›•ú|½-òŸÍÿ÷]]øAúNdl+ŽŸàR ™Ó–W~Û£·­øjoûŠóú+ùúþ* žËýÒDŽåÓBTï }$%Åן}Q×uúx´ÃÅssmi?Ôr]m鉃€'Öþ´V×?³‰ì><~·Ûýúâ¢kJ%þ07_ùã„>µç»+*9`©¨%Ñ)µÇ/ªoÆZl’Z`T?¿ªG[üÕÖïPâ®sϘRÝdµî¯UÏþú·™Ýߦ¢hô·ºóçÿ©ï¯™åDñ“»®K€ ÌÙ QU¨=Ìh~F °í›ÖSê~¬Ô)'~ùžÖgµyy^Rïìú¡Â¯ÐµpNJýuø'5)~Uw…&¸ò+jUB½-õ?é ˜ÔMñ®*³Î‘•ƒÙIl”{ä;¶ýÙÄ%âC´ãJ+¿UG=ͯ8X÷;ѹ] ”žx©R äR.žcç>R’ …Ìcä›1½)œr.‡! CH” Ùäbˆð‘$¯¡\(ç‘yma!Þ>—u–¢J"#¼gn–bNgRn"*Ê£§î“„Ënáü9l ‘a~KS<4®òB.dQP„¢'܈¢{žõ¿Ñ žˆ0ŸI¿©¬î¹k€­D=Ù4jµ—ÍÄáý䔓€NCA²°…mô|‚‰ÌóTÚ‰‰ôÏ€ …ª2ΟÇìôʬÔ|cuÿ9}œ’*wåT_¬Èåt6…èp×ÔÁÅódå Z"ÃýJ,žv¼\€Ñ¿¥”ÿq_¬'-”ˆ=WÞ}]u“¦Í¤÷pY°TÌ.‘çÚIÛþ²#Ë/•R-¨qÝœ;ê±Ë""Uòð43¥^Üs€'ÔÉø³øEi7T2sÅ\*+—J·ö2ú.Ùç)ê–µ2¼·´ÎÏÉ¥‚Úiƒ¶®–ñC¤MG™ù’død,RÅ¥Êþ-2i”4k!§Ë©"QU±TÉ—ïÈà®rÏ£’[ì~ŹíòèíÒ¦•t( >‘‹O$‘‚yáaÉh-ÃnïwˆÓé“âJÄZ%;6È]×Iû¶Ò¦ŒŸ*¿UdÍÇ’œ,›¶ù¬8µ–Ê«¥ÖÁµ×MTÔÍ9#SÆÊì7Äê“»äúáÒµ³Ì\í¾#ÿ¼¼8S:¶‘þ×Êê-ÞĸÕϹ|Nž.íÛHß¡²f‡XüSk9ËäýÒ¾…té'ï|.UV‘ã{dêhéÒ[f}ì.FI®|ºPú÷•Î2òÙqÀ«Â^Bÿuµ\ÓOÚt™ó%«Ð“‡ê>H[Öá[†ID¸ô%ï,’ñÃÄhAŠ]äÁh‰l%;ó}~åúó÷¸þô§äçI¶?¯Buú<áOßQ" “S¥Ô)OŽ–ƒd$Kr/ùõ´ˆÈ…¤ucé8Bžž%I‘2õ5)ñé¦åG%5NÚö”ggKãÆòøkRaóvÖœƒrciÝWš,Z¤ï".Yz£DÅIl¢ #=µ1²•4H‘gÉ]Ã%®¡¼ÿƒØî‡ØËåÃÇ%6^þñ° í%ñíä\s¸dÃg’‘* {Ȭ'å©9Ò·¹4l#ßn”ÕŠ‚ü¼5ñâÊäŒ+×¹ËàW.UŽï^ åÕòÛ:éÜU$ ȵˆˆ˜ËeÞ?¤U;yâEi+ Íd‡Íçí%òÌ$!Lž~N¦\#iòã>¿rÙÃ)7?"ã{Jx’¬<$>—ÖI2¸‹€ŒÉ]†/ß•Ä™>[Þ]$ôÒy¤üQàýæªÒ4Qâ2dÞliÓRf¼$e¿W¬©Ö¯ Hû¾RlÕ%eeîlyl‘¸DfÆK|[yê%éßEz ;ED.~.WKäÉdéÉ:/OL“ž]¥c¹iªü|ZDd× =]VüSÆ’!Cä™×åâvi×\FÞ"?©’iSdÈ‘}¿ÊØÞòåf‘ÝKeL?ùd«¨òá}2f–<7_†÷•1÷‰ä˨ÞÒo°<øœ\)Þ'ƒÉCï‹Cdñ³²æ{y¤«$õ’-gDDž™" «3Å”/ ’”βý¤·¿›'„È+ëÄ”+7ô‘ãäl®¨".U\NYý‘DÇʧDDΓ­‡Åå”5OÊŠäÆÑÒ´dy\¤mW‘ÃË%™ù¼;Û‡ªJîÕVºß&Ùùr¡hU»¼^)Ht3ùr³˜Ìb1ËÞ_dÆýòûòÍ¢3È?ÉèAÒoÜû¨äX¥*[æÝ!ÏÏ•)¥Ë0‘¬_¤é!Ý{ÉߊÉ&"òÚ™x,zGº´–;çËþÝ2q¬ $÷>!"bwÊŸËÐ^Òª 'yQUÙ¶A…É—?ÉÁ?äÛßå››DƒLøPD$，è-×Ü"…ÙùŒ€\÷º÷Ž­“6QÒûY1[åøo2÷-?'i)Í;ˆˆ8ÊeßnÉ3É®/ä‹oe˹i»_™%è%3GDä¢I‘Ïó¾eîpYpDÌùrû5Ò}¨œ¿ìå¾ý­HRÕ¶â_Ê ‰ …è‹k`£êIDATTf=ÏÜih…¢³üòi-8¶‘?!׉ä³mŸ,`k!ñ.>šËËËr+³'²ê#žø§Ê±•qèKf.¤MsvþÊÂg˜4ÖÙñ«>…Jvoã×í¥ÅlÝÇÅ\€²ólÚNV¨äîç§Åì>Œ¸øå3Ò‘<Žòñb~ý™+'*ȈFQ™òƒ{¢¸¼ç+çʺ7ÅAÛžTåP™çÐ=!ŠN­ £QcŠË(÷>ÅFéy\°éŸ´iÌ Ñ< Œ|š1½UüFÏáôY^]Æk±u`ÀxB=Ùm«¬œ/¦ms $4&\ËÑ\ï ‹9z‘Þ#¹ª+aB tĂ׸ª NQFúÝLÆ@8ÏGKYò5¡pù$/ÎcëAŒIØòIFŽƒ;gÐÒÈôIì? µ›¯Vðí/$$òåË »žô¶œÝÏgKY‘MÁž{˜è>,sÛô0ŠBÅeŠ#K¤SÆ_E\„7ve/¤ªˆØHB4ôCˆ†K½Û×se\21¢¡!D$¢ƒË¥xOpÑ„+„iã‰mÅúƒD…Ðíz&Ž'1ÂÊع3Ñæ/gó·Ì9BÿÁ ïïýëÆ€1h DÅSZI‘­v”îï|«ÙçšÐêèÜÜ»³7¼›{c OÎcl#¦Ÿçç½TU Wº·fóOÚÁcëñ(O'ÉHX1Þc×VZGb.ãÑWyê^ O±lW½ÃüvL(&·‹ÍgwîÃZÿPDd³gáÊæÀ­Èã|ôGGÑaùÅT™±´$<BB}:A5“Ý`¬:GàRqø„ÚMh4CP4B±;q8Ýg=NŽbªJÙw†æíؼž&Sp~‡ÞˆRî¹xðM~êÉœ{ÐG2ãI¶@ã $ª‚ÝŽQ‹Btè5”Y}>Ö„ËFB½;<«ÕaÔ¹o0•2= o ûRvíPN"ZðÃOthÆ÷¯@(÷Ìá‘ üÇúí¼u˜¾]Q <…§_$Ý̵ch>‰§^¡{7|ÈP+9´k¹j½ðÅr“÷ q}Ií ³¨\64zˆ .f†Ã…KˆÒƒ Ñ fèpžC ëRè™ÊÓO¡6`ÖxêæOq=¯çµøÄIB:³ž#ÞGÄÈ¢D Z-6—ûÊß‘™!M£q9ØsÀsYCÁe JÜÿ5„—Œb :ÅM™qc¬[X˱YhšD¨ ® â ÄŒFPuÄâ#Ñ빪-N:-.—;Õi]¬·þFÐF¢‰Á¨àrqMTEà¨ââIZ'Ð,ÑPõœ×hCL ¨¨hµîôŒÕSVT .&6+½;4'€­‘Ð$æ¿ÏOÿâÚ‘¸¾çpM`ÝgìP,¤¶$·1ÙU¬YÀ²§yömL »Vƒ!“'Ø8TâÃ|ÈQ„È-Âls?Òaåò%löjò ]BB£\Nœ.Ò› Px­‘äX€hÑ!ì:댪uÊ]\:š%¢‡´xP±” v9<{+))¶Ó¥#‡ËظŽ>­Éõ'Ö XšptT(P*ÚXo†êÐk(±ƒ‚¸°@„£çu ´íÂîµ|þ.½´œÜ€ÕìBö´×Ü™Ì]ÁŠTscCÆõ᛽Þã( @ (‚ˉAK¸æo銻óF4v6ÏãB1v…YÌœÊÔ§qxúŸ‚÷¬Ü«‰ C”c'©¨Äaçè&0禪¾¾ªÿa‘§1ô´NJJ± \Æê{ƒÆ+¯âåV)ØœœºL| QhÀaÃát?°š!Ñ¥1ÀŽ“”—r`1͈MæÒIþ8Ž ztÁVÆÞC”—’y‘„ÄGrü0{¢ 'ª:9ÙàrSœt.T;v§Û—œv\ nÀ ñI4§iWš¦P\JAûvs¡˜HÚ6æðqrÊÉ>O¥‹N¼žO·VìYdž픔QQÆεLº/qgÅsJmPKõYÝ‚)­q•sá@aE&ú·@WÃR’gqºPÂô„7æÃõäæ²yk6ÑÛÄ÷e´NFïÝ9³T}"Q‰•a²±ñ[ì*mÇûɯ }#šÇðÓF**)ÉF…Æ `fç^òJ¡Izª*°A~•´áˆŠÓŸŒªfSq–FtlŠ>œ›'⪠ð …Ùœ<pC;€ïvc© 8¸<«'ù-PÝÙ¹…S˜½‰åëw ƒºsh/N3¤#Ö ,F*¨XMTVáT€Ù Т“ÆòÆ,ˆ%ÑÎ'ß2ä:†tçÄ,vœ‹ ‡»Š€Ý†Õ†¨TUA%@J2­øâ}ÔLŽeTYPÀnÂjÃéDìXXªYH.*J)ºHh"Œ °üeΕ²ån¼™/óؽ\:JãtM÷¢jbS¹ã>Ž?Åó³øµ;zGwSM”‹ ‡¿KX¬ b¶Qeq_ï6–æo²j ºËìÙHD3ì…,åXÂpª¸\X­Ø8- ˜\ôïE…ççh/¾ÿ”¡¼{+fh ph7›öqp7.8°š7¬tíÇu#xíSæ<ÆÖÏIëÈ“S8¶…»¦2~OÝÎm7ñø)¥à8íúÒÿ*v®æög™»ˆÉ×3ó6^ýž‰S°£XÏà1œÞ̦#do8ø#ï„Ó0±ƒ§çÑ¡!?}D—4IeÁÎ…°hÓçóáv^¿•œÞìÉ䆈‹ tZú79âQ¸zÍ›’{†“0¦0ãQ^xœßMH{FŒ$9”‹P3C1*éÙa=Ñ…Ó¹Ñ#ó}îdþLÒS(¹DN9ƒFЦçO ‰cøxëÈÌ$¥Czrâñ¹m"±$&sþ$út®ï‡Kè9„né\:=1C18É˧Û(z§a­âØYú÷C££y;®ê^ÇòW8VHX#Z6"/‹°X†\Ï€Žœùƒì2®¿—Ùw`,eï #¹y1IôÉ è"™EÜ|wM"ÊÀºõC¹í6¢“i߉¢sœÈeà^šGbß¼Ìï$$œÈ¥sØ›3´?ºà2³}öpny€©7Q¾›Ce4éÉÐN4nIœÂ‡HïÉü¹tHwÓ»ª7BÉéôíÅœ>OY-ûñÒ‹ íEq9…ŒGÃœf¶dÈzfpî,Q-ÖŸ(#‘ñôìHÙ%~ßCƒæ̙ˀŽè´dî!¤=#G©’y.WÑ3óN«tÄø‘´oIîö í`¦O!²ŠÓ%ÜxéIÚË·ßPFÛÖD;¸XHóŽL¾ÅÄžÝ4¹Š—_¡GCrsØ»v}èÒŒ.ĺØ}˜ˆTæ/ [.ãðú¡Es:õ#=žÛÐ$1cwŒáÈ:ÖþJž‹6mˆtq1Ÿ–=1Š´0ö&'›˜ŽÌ‰Žiü±âèß‹˜ÆôÊ ø ™åL˜Âwæ™üÿ·]1:¸ï¢±(³#I nTay.f-q U¨(Å¢Ò ÅBn9Æâ=Xg»…Â"œB\‘FDÅf¢¨‚è"ªÉìvb“0@I¢¥A EÅØ]4nà´QPHX,Z ‹ ‹!Ê@E1•B|8()ÆOt(.ùùDFc³£Ó…FCnÜJŠN'aÄÆ¢ÓR\€ÅA\†Š"Ê͈â›VˆŽ#* §•‚"*áQÄÇ :)-BÕ‹VƒF¡¸«“ ô~(Åÿeo¬G’8à·ùmTêê"ÑS/Ä>ð[ð4¼XÛ Ìµž2üo´n}PÉÀ¯ ÞÇÖþk@ÎJ-l ¯¶º§ž•z¼ÔQ®õ:”?)R}¼€¨Æ"¨¾)ê'åÔÛ »„Ôî„õ!TÿnÌ |Tw½B¸â…bÖð‡@VŠÏv\ñ¹¹TßKüñgoÔ„ÅyX‹² Ôd{ð¨§z_²…¢Ö`T“¡ æN?V9z?$­Oì ×Dñ—‹?‡Ë/€->¥ªy¯‡‚…û•Ð§ÂÅŸ]áûi½Ž:úëøê ûW¸û9>´©¡nù°pðaœø5k &¨Uù5¯ó­„Z•V‹ñwcf@€„5‡u+Ô¯ê«][ó'ûgU½Z¿¾I¬õ/âwú¨‚Æ×Q©›^ý–jŠpÆ´ÿjµ8í\¦¸è8’“Ðë¥@QPªøðþ¸D‘Ü}m½K‹j;þËÖ0ö!†d`*ᛯqÄ2´f«GÙVCl*£p9ÈÏ¥¤ô¤5!Âà™‘T rÉ/¦iK  bõ<à$+‹ò*’š’龿¬ˆ¼|\Zš¤nð´A Ú_Ê33Ä,KIÏfîµQ“ Yò½T˜ë ¿U‘¯oÔ~2ïýzžæc»?•±ƒä»=""™dXO¹ã.¹±•€èCÅh”ð8™¶VDdó7Ò·Uµ\ <4_²lî'ä–Ñä‡âryÕå…òëWÒº€ÌúÖýöóå®1¢G@îFŠŒPK%h-ÓÞ+^øš{f’Ö“õ‹1e³| ‹—1¸+-S)¾ÈÅ|Lv’Ó,k9KvÜü ÷wAìœ;MnÆ0š´#!—“Ü3é WÐêh1œ×ºŸ By UE´lÉÑ}tžÈÜ©ÄP¡Q{ŠÎòæÛ¨MYú ¿/à­g(oÇÇ×£V±b¿_0è}p*×óü R8UL\8€¥”÷^åûý<÷¶?øb7Mc`Ãà5hùj•ŸHH¤}GôcàPÎOù&ßJŽ–öÈ31óyÂòÈ©ØýŸœ¦]O¿Ej:ùY¤aé3„šøþ –Ú‰×2hí¬,üŒûßåö–r±‚øHJm$7ÇhDi­h‡Iå‘gHjJ›f8WòÉ·è®ürˆ^ÃÙ¸Ú\á$¥o|ȹ×ØqÒ½ -ÉãØ9z¡wléw'í"þ›t…A Úÿ›ª@Æ]Ü:–ý?2`7ÞÎËË0ÄaÄRF×1Ìzš'ÅšÅgŸÒ¶m’†MçúáΤûyãmº¤±rGŠPT OrøW¤0r4®"ö%¯\”ÂÞ}"Ef6¾Íí¹fwÎàçã„Ç3ðjʳ¹c<Ïîáî§yëV*rùø}’º0iž*‚ª£eWº6A§ñº¨©”ª|öíà‰‡™ò¯@‰ød# ZÐþâaUEÛ˜w–2j4™ÙìÛÉ/òÍ~þ„61åóù"Þ7qìI]iè^ 6éHzO±s-ëWqþ8@^9Ú$t¡„%pã­ôhI~(:Ðë3G~¢Eº`ò …Ž°âÎù„4`ÈbBÁFËölþ•ÓûØxˆäýœˆdÅKä¬CTZ7G£q'¸÷æÜô=™pb1ŸÁœg8ÿ³Þæ«Xü@p´¿¼+*±m§[ïÃb;ËßæÏQifÆc|´…û3­=÷NÇéD­ÉÊà¤à(OÏÂÔ†O–²j./|ìAN‚.’°¿éÈdáÇýôNçD2žp'iÐLàÞù\ºÀYhUEÓv<Ò™Y#ˆL~­mlÏd`K•Ø¡WK&=Ï;zPãï`!„%Ñ(ƒ«®b@ /Ìa7¥‚`ž± ý¥¨5‡Ñ÷Œ"*)oc ÃhD©0†pê(:3'^Œí½_®*"ÿ,ýÓ!â­ÇÕ¥N&kG…ÔÛE󦿋UCÖJÐ( Ý^z§0ãI=G7¡ºpº{/·ÞʸQtl‡{Ò¯+¿½Å¼·8[äöC½ ÔÐ ™´ÆdÃlcûw”WÒ,ͳ< úaÐþbXPòOZÄ‹·ûÐ)RæùwHˆ^R:ËÕƒ%)EââäÛÝ2¹·€|\&e§elWi$m{É°&mzÊ2YÐI"ÛÊEDÖ<%äurn›„ä“õâ,§n‘0E ziÞIVž[©Mz 7·Éžo¤e¼û!Æd9n fí¯iþÌŒÝN}#œM‚‚6‚V™ý ¯ÏƨaÀu4(ÇÂc¯ðÒtNœ u/„Å0üfÚ&Ó½ ¹™ Ì’×Ñ™(11nÎL*šrÍ@Rb©È£ÄÌÀq$¨d›?žÆ© ¹ŽÔT=½G²ükú% 50|MЄÐu ŸÿÌÕ)î客P\H^1C†“Ò€¢LB;1fsø±itÈ Q<q´ÀØ«¹f(*tÂæ ¤èÜ$Çà^1h1« |£¶º¾¯£ µ÷c¾Vw·VË\.´Ú:¿RÝ\!¿+Jí¨5ÁOA£ñ;®ôFÕ­·é»ÿhfíïïŠ\91Æ•÷Yõ$À¨— néÅtê—|ƒ̾’ê.>Pë@i¨›@"è‰Aû«»¢_b„:ùa”ú£>YG$éßÑ«v§ˆ©?3Ià‹¾ÙWêà_á!A Ú_zV ZЂöÝ4Á*ZЂ®´ -èŠA ZЃ´ ]1hA ºbЂ´ +-hAW ZЂtÅ -èŠA ZÐþMûÿ§U ”§æFQIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/Legenda_rules.png0000644000000000000000000003235013051004444022213 00000000000000‰PNG  IHDRz®·QJsRGB®Îé pHYsÄÄ•+tIMEÛ %uq2ß IDATxÚíg@G×ÇÏìÞ{¹tPQ±cATº;Š{ïÝÄc‰i&QSÍ“¨Ñ$O|-1jÔ5Ö{‰½6Aªtn¿»sÞM¢D}äü>(»;ewîÌÏœ)Ë‚ þ}*‚ Hn‚ ¹!‚ ¹!‚ä† ’â1 `áXx¦ðçÉM¹Á!˜9ãŒ3䀈 Œ eD† g$8ñÛÍ»y¼uÃd‚3QF& B!KÈ6C¾ ¯#*AÜ<»Ö 2ÆL ©$ ÀȆÔÃiÛã´—uæüOÝ×0P“ÜÄ?BAEP¶ 3†œ L 9WÎ8óàhøƒ#f›&•`˜ž™lPM¥D$7åÕ™‡hÍÅß³6äB¦dË%ÁÞ^lu² œL‚ ¹ùG¦B[0D† ,ÃQ1 ¯KXfí,s ­ؘ%ªûÔ™f';‚@¾‚ ¹ùÛ&DIQdœhq×ã\†²À~Mùæªù¬•µR’‘ ’£¡Vp­q>6~ D@@†Œô† Hnþf_ ë˜äÀ qTˆ‚I–…mißEHÚ¢½ÞNo—W­·ËH¯:JY‰È1FZCOñ†¯¸#S·ò¢Žd¯îéòfM7À.²_R¿Œ6_`¨”SîßÇulUeUj@ÙË®2XØɳ ®Q'^*ð4?„DSÜ1&VY0…˜É ÂñœÍºKGÁ$z›ºL¬óAUE-ÎU¢ "˜_¤6½ð / fÊš6È3ìýpÒ‚äæå1ì@‰² W1‹¹ 2¸¡9½?{‹­ ˜D…¿mçõß”d` @L2(_ädbÆ ™N™#±'J S[ÛZ[Ñ|q‚äæe²nÔèb¾r%IbR0u[Ú÷Œ+¸(ûjû»NDà Q ˜À¦<õpTÙöÈ£'±¬“EѹéÁé£grZ8¥B>Þê¡ÙœÄ‹§L1P1;9]Ÿ#Ú‰ZEîÏ÷æªd•Ymn¢h7¸ñXàÈ,t…0Ëÿø´zÃ˽òßyGݾáµúëÿ‹Î4ÕôíõÖˆNÙ±ÇW¬Ûžf°òôZŸ– ,0¦Îíúqï™(­Ä*×ñ6v„›£"ýÈOó·–ìu+ÞšukàÄQ›€)éÜò5;r¤êÛ™Ð×¥ÀêAA³b,_»;èjÔ¶×k;ªºWÉÍ‹¢’M%fPæ›rP€=©«HyJ•ìh®>°Î$%·CÆEÆJ(̳´WSæÕ g¯¾ñÇ'jû8êîŸ;òÇñè©Öë52¯ÿôÅ1Ézã¡îÆ_§wþê¢Xϵš­’Ç\9³awøÃß;VªY³ºãU™;׬ãâh €N/ë>qy¥z ª: ×/Ýþëëw®l`À”¹7·ŸqÔ¦®dß:ÿå‘;¦å ‡·¢êN¼è.EFËsÞOøEìkQš³3îô™swØÇ ãrådä(¡™se^ŽÙ¥™è٨ŢSɈˆhXüf¯6mÛüv%ï½ÕÉgØ·»o­voØtáŽë–Xù÷Nð«ÿéUŽˆ†´ƒ爈’6ezO¯ÞïoÓX’‹ßÖÔóãáhΚ=¶S‡ÎÝŽÇëQÞ5'°éåH/š =«Ø l¢isÜBkg5çÐÃn´½ä*«L"  …GŒ›gÍÑX½Ó„v®(ºVvQY»z;!ƒÚÍ«ñß$XltÌQË&³Ùj¥‚ÍÀÌfJfhROGÞ²oC[°ªÛ당÷n×p`ÀNîÛÖU# ¡i W9J¢7+A©ê¼a¢RVêT'{4m*÷náØ‘#Š\ ËÊ{¥‚B%öÉuÑ>XðL9·tùÖ˜ûiYÙY’ïçëÕ J¥¤K ϱoêãÈXó¡o6S6 ,TóP<̈“›˜ ¹yш (¸¨A6 vÊ*½† hñ ÿûÍ´Œ#óÍÍû}fÕ´ÍÀ¾[øø4sw|+ȿ쨲$y¢A6éM ´&w0ñ²RqÂ-›‚"3‰² ·Êêì8˜Iª£§Ðàx-WÞ¿å(T÷^þóª)#ú¶ôtSsƒI.#œm€*úÈc÷€Y4k×Ûƒgn8"é Aróòu¥€Éœ …^mpjë,+Å—`GP¦¶Vr®ÉÌ6H’Ù¨Ï;þã{WrU&½Þ"’ d½s»êZú¨ÖÍZŸ£3´éç–}u"ݧ®+ÈÔu"Hn^Ê®² “ÆÔ_\ú·g £Y›“§{˜‡I¯É+vhÔäæëMB𘱾,vÖÈ~cÆŒèÖc³.ÔÇÝáäÇcv^JV©«;9&1zÐ÷® êÊ|ö¹[ƺÁ½{ 6°çëKÜúLѱ1 j5¹}‘E$›49ùªëÄ‹—VèÍC%¸"¾‘‘0¨Ú@P8fdª«'R´`‹wØÐò]‡â9òØÞ;¹¢_`H}g¥6áêKñ-:…Ö©¤Î¸uáø•ûm‚šÕ´ iñk§ÜJ75hÙŧ¶]ñu™–?ž(L™ Hn^„÷ÆÒ-NaDðrL»-9ý·øQñ²ÒwL‚BÜAÐw¦‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹yU@@´|Õ€ûÊð‚¯hÒ”$‚ ¹)r¸ &&J äÈ€s2Õ‚(×6W_áÈe` € L,X-€`bFQ)3‘¾ÍKdÝ<{gŠ È$¹È9ð‚mc(9S€À™ '­!’›gV‚YÐ+A‰È$Y1(¡JFD`2÷† HnÊżQ0uZ¢)ê‚YD X(. d¥Ù ”øóÙ@” Hn^q0&éïuÞ{ˆ ÏA¡`3t&ý²!{О“!˜EêLÉͳÛ6` ¿îwÝ1á?ù'20"&›ts?VîÛŸµg·,R !’›ò€›%Él°I›ü†€€\b樫Š{ñ˜…”xRoŠ HnÊ¡3*Y+A_-E£9vJi6*Hê9P©•Ä™]Md ÞAÜ<{wJp©¤kØ Dà’V޺Ť°ÎÞ¼¦Nz®’‰)í¬¨Ÿ50¤]‹ŠÕi¢#ArS.bŒ£\yåJ»¶ªŒf«_¶2ÉÈexа™Â·)pÅ«fÛ`ѼÎ'Íð¼ÿë ‘Ó®%é©…$7åÓ™bÀmÚb#ÆAHNÅ•+u{þ4¡>—CíŸW™@V4:þª<6cìîðõ¿:xýIÛ¨3Q©TÐ>ëÉM¹a–›âkc@TˆJ•îÝÙvÌ ‹  Áž YPú÷—0Xl ,Ëþúë3P껿›¥,Ãå¡aãàààà`ïð72a1Œ‚äæ¢f¥°éf5Ê\a6+E˜ ôéÉ@! Êõ¸(çŽñìñ͵³›> hÚؽq±sÂïk3eÅ­œÿzk¯úÜwõÖ‘¨4Vª¿ÃÌy35é·äâÖ¯'µönìîé?cÉÎô¤+ &„ù{6hæ×aÁÖ‹Œ1@4Fìù¿a-›y4hêÑlП]HÔ3ÆŒ1#;]V+×ÍìÖov&0]ʵE³ùy¸¹7ó{ýƒnef§M:ÿéد†Í|Ú~ôãY;D9ôå+&Qâ²,›u8ôÓ5ã~?Ù¯eóö-ƒ—¼ž”œ¸ûëÍšvþ# 1-ü»öžMf­þóöÝ»7¯œÒ»}—o¥š‘ËfmÖ¥Ñ~¾ ¶ŸÌÊÌEcø¸öþaS¿ºvûîÝè#3B=Z Z¤Eĸï}}›·mÙcõɘÄû GÖ}ÔÞ«éüÙHÏTä‡7Ëe½”žšdok¬¸`Ò¾ýD³„&Y’y¹ê›dX0=¨Cа8#"爘²cxƒ ùzÄ;›çú· Ü{CƒÈ9Gä¹ï ô šø›TJn>˜Ð!¤ÿgùˆyD?oï1Ë""ç¨ÏˆèçÛèëhDÄ[;g ˜µña¼»+ÞhÖ;&Ïr?Þ×wé‘hDùâ¢q̓Ädd›ss[€.¿g"ÞþÞÛ«ùܽ±h¹¢»?®·ï¨EÑÔ`ˆgAQ±{’ ¸ ýì?•z@QÁ £cÃœ8+ùåÊg‡› †¸© RD øÙ¨D;kwŸÆ¶ˆÀÙ´ðô;z_²4 ö#?‘lVÖ´+è\Ù¨QáW·Šå«¿J¥‚  aŸo~ë“z'6úÊú#1V¢])ËV{èFª«k—ZN€ÈÁ¡~¯Ÿ÷tP;dWU nT -ÏDA )HijQAåÆòÒ˜(¿¤û~)¨DµB6 Ü7±þÉ£ZdjQ,ß o™ÚQ(ôÂbc5¨ò°+ȉUímež¢5•õ1uçìÔócfôŸÏ[ð¦sjΕ*;ÊróÊæ£Fé\[õ0¾¨¬TÅ¥PŒE+Q…_§¦BÜ<%Œ1AƒÔþƒ«Š K‚ÑÆšét6³¿xóR¶Õ˜À$åÿJ/Ýt™ÊN6¥äq°€ð´\Èìm­žrÌí—™£6óÞ›ü_5[kk[Û”5ÓoM,eÝ)lÖRV¢@ÀqIw-<Üƽ}#Vx£dÐ42õL­½`ƒbÌÛ³³jv¶À9Ž“çâjBp”åôïVYq@ÒóùÚzÖÑêb.\Ï-°n ég¢"mÝ{º>åÑ”SפàÁ}Ü«»8ÚÛ©¼™œ' ûµAÁ®£{ÔôS·28Ù±¿O5îPm`HÜ”Ú0@.!˜ARùÓlf À¶.¶ŸÏW§@Q©Þ¸Î…çâÛB€úƒ'öpÈX8s²m‡ÎÛöΘчïÖ}ÿ³O›}í ùÀòå¯ÞIŽúyÁøù»¯&C\\šeKféÚµë ‰©§Ïðʉš9iú–C'Žï^þæô…æNïL¨À©i$7åÒ“Ad“1·T¢”&aµƒ¿‚£‹óÌIAD &ZºtAÑÄʵÙ1¡®»¿o#ç‡'TNî­}ë Àj~²ëÞ~êÃ?}õñW+“í-\¿²c¥Rë˜èæáïÝÀ±ðئi«µ*Ùü–JÛfÍjÛ´tcXŒog¿6vÊÛ§³}wýòi[ørî÷Ùõ† öNùãûÙóVeÛú.Û½& Êƒõ‹?þrÅ[Ÿ¿.~] Ö5[5÷vTVÁÊó…Gmj0Ä3µ€Š6S”œKœ‰‚)»k§Ã´mlNìãÌ™A?~†zíàÝ&ë_á¢^`Öå/yˆŒ1Ë¿ÇŒ1@Y§ÕJœYÙÚ[‰P ˜V2xÃâƒ*0WXÁàTÁEÆÊ&V¢ÊÎÖš˜uùzTÚÛª¤ÉׂBmkcÅ@6i´zÎ6v¶ V¿XŽÅó¥¹~Y7ÿHc1@•¾Í5LÝ{ Ü^˜J6v¸ töBÍÛ7óöü!páßcK‹-j·ŒüÍD;{+J(ºñâ1Š'ÀJ\&ªìím­-”6ö¶ê‚€LaçàhgÑUvŽö¶ V,~±YÉ;'ˆ§£ÂL1Ë·ì0`7iœÞFa=i´Aɬ€1¦tìíhW?;_d(^8=»Só"²nžÑ¾Aº¹)>ž#W®¢€¸¯^Ã%DbjÐËœ HnžÞobùä €ŠgÈL ©d†2ÑdÒcpo“g3³d–Im‚äæ f™™Ë¥ 0À@  PªÀJTŽnàJæã# 4Ÿ– ÊŠç»,YE`(2 "† ™°Ñ¯ËÕ«[÷î.Q!ˆrl}´eR©îVÁ8° àˆùo‚äæ_R›b3MÐ2’EzC$7Aü!PArCÉ AÉ A$7AÜAÜArCArCÉ A$7Ä3C Aâoðjm@ñÑG°k×óÞ‚Ïl†ãÇ¡jUªLñd^­%šMšÀÑ£`eõür´³ƒÐP?FŽ¤ÊDɺpvµú¹fªTR5"ˆ¿Õ@©‚ ¹!‚ä†xéyè{¢o®è£ÀøT>¼â±^ þ½§þOWFÒÉME,«±? 3eNîçòÞ¥'~÷’1ÆNÿ' vßåìo³xþŒ1óE-Ηu/Á«Œ¥ŸjëßའåòµOÆ&ÿܬN§ˆ|™6¬&¹©0¦I>Ü«Uß‹æ'K„`kç`gý×C5[˜Ü×ûŸäoX;kĈ)K´–ÜkG{ÅKR…ƒƒ£µªüîFP98Ú‹¤5å„‚Šàùš&X†F –œ+„¬ÔÉ¢èÖV,?'_Tü¤‰ˆì±¦Iñ ˆõ‚¦Xôù‰²:Eç-GjY¯ÕÌÖ%U¨t,(f©lÊ.‡7Zæm=|ˆÒÙà3{˜ÝãËö‘û!!ëæÚ4aÇgvš²JÊ¿Ò£kPÞC¿ß} c%%1ñÅÐÁ3—h’NðZß°àNcßù澞3†X(ç7=²OHHpPÿQSw^¼Œí]Ò¿ãÈŸ$Ƴd“4;ÈÿCI d%E‰ÝúsõkƒC^{û«èÌAA`欸oçŒïÚ)4$lêüå©f‹n!c,íìúIƒ»……t™¹h‡ ¤8$7ÿËŽ¤Ó'ÙïCkß°ž>ñ{>îñúÛï~û‡gØЮ­ªý¹vÞw»®0ÆKÿzxû/÷ÞõiÚ54¨Šæüˆ“"õàÒºÿäÑ!L«ì9õ­î¾uø•­óƒ†|,×jÙ5´£"nËà!‘©Á*+bùœU'ýºéÚ©ñ• ŸÏ\ùgiSB2jò´&nÌÏIýv νûðrÕ5¼ÏQ¦G¢´÷®_5{›*M¦¼7­@Á³¿9ø÷ÜZ}û÷m\%wÁÐÞoqƘáÁÕñ]BÖGa»à®m½\¶Ï0xîzDp@6hÓctë÷Q®«PP'»5¬ëkçX„T÷ë;Ý_ÿfoMŸŽÝº†6±O™7aäî;šf¾ax}õá ‹¢‚öÄäÕÝÂ$,&d¦£‹ÇõŸ±ÂÞ= kX'Ûû{†õx6ÝÄc†¨©zîŽWµ îÒ©uÞ¥ŸÂz˜ Œ1veǧa¿ÌwñîÒ‰G, žöZÓ¼ªr5ï_š6E½þygŒë×ÿýàé‡'4mÔak¢ Q6.{gpÛÀÎÇ͈ˆ˜õyˆ÷ ¥»‘G¯hêÝb݉DK,Cæ‘­ÜæEʈ˜o {Ð"¢)ïî„àÆÖ„sK8Ý…ž^s¶žGsÖ[c;ur#»àÊ™oB=,+}?á+zøŒ^‹ˆxû¿>^>£~8l9/çÜÝÃ{Ä® Ë9çˆúåz÷µ@c9»Ø«™ÏÄuç-GÒƒkƒC½'ýp ,ìæ;pI^aäìãŸxùtÞ—…È‹ßÀ…zyù´þêhœåИ|¡O—ãÞß`DÄŒð°öM'/¹(„Íÿ<ØmÜîx̺ؽ³ß;«®qDDíÃ:wŸò™VB|p6,ÐoþæDDÔÞØÒÎ÷ÝUÍ‘K™Ÿö÷h;u"æ˜PÛoplŽÑ’hÒ‘;´òÛ‘Œˆ‰ÓÚ×w¸ ;žöyÏV.çKH”dݼÌ5Úv­¥@`‚£µ­RéçYKNn•PæÐdbÔ•‹£;ÔnÊÉH½™+1Ë(ö¯&éøõÄš“§ø3˘‘u˯—ÿ§‡O]@ntpáîĪÔqF‰?ùƸÂih'oD@Amgcm…2¤óeÉ‹u±¸ªêÈŽ-±D[¥JD2÷o‹kÚðþ•ðȈðÈȈäÊm¼Yú±ÛY¥]"B á-ê"ª\›÷¬6߀PÙÿɨÿ›ÙB9?ûÁÝè‹ ‘#€³gŸŽÑ—vêeà)WÿHÊòo;ÈZ,‘æ͘k]¥ÞÃ[(,E#V Ð[>·!†ƒCèÊ„ˆÍîŽ*4ë2R¢nßåˆÈ€Çm;õ Þœ™‹OŒUùv€d”©Æ’«øº + …ŽHdL!6Á‡˜ä\ß>çã•1ù’Ù,™9JeXõúÔ¨|G÷†V€ ‘¹µëî¦l@Yp®U”Ñß™:"ªì”V–ÊߟHƒ µ½BY"c‰qUÒªycV%$I2äK§`ëdk­zX™·g%M¬Î`–A­àɧæÍ[|..Ý$If“,ÈÖîêãý¿ù0:Y+›/ŸÍέޣãG4,/7YR4t³yx?PÙ¹¶‚KÊg¸¾÷»Ï¿Ýžj0If3—,â†ä[çº ¬Æ›F-å;TaIn^q²N/ ›ôÞ}^{FûFõÔ­.L ô-Ã÷¬T †dC‘ùÆœÔl´¯n÷|‡VÊÈÇJ!‹£~<2ÍÛ¹Ì1 æžÉ,ó¢¯#kr ¢R- ‚!ñÌ “™ï€©7soè^ÏuE·s…ê4¥¶÷o·²ëùUüik›GõQP¨™”¢-Ì€MFŽ*[¸õóÄaKcz~ívþõÝê;&ì1å3mlECº # >ÓȨ@®âWùØáH×–ó>žÖ¡eýš•¸.[o.£…ÛÕíà*G쎆Œ˜Ö¼ÖõÍ_΀øb=‚À½C#íΑE6[æöà–¡{og•vWëî§ÜÎ.‘ƒÌM§2kTwµU ñ7#3 5Þ]üIÿÐë¹20eëŠJÃîjî^üņcâ䉥o¡v wµ"æøÉ’?¸uÌäàmeܸ)Ê3løÇ3Ævhé]³Š6?€ƒ•G·úºk#ó &"\þu¯^E¯d’›WV£²µÖyí¾N§M»¹lîäëunJzaÿKŸœ¤1š$»j-]6ÏžvìJ\jr©õŸüxתo ÿM-á`6åfeiÌOì˜u6.Ë;Ÿneìv*fÔcç·×~Ð× j¶ì5.`ÍwóFí¶VHFh>añG#¿X´zÒ̼E‹ßjäíom«t÷ tV‹…îsn2%l~¿qÅ›#ÆÏžxR)2“^ÛjÊây¡5؈¥ßí7vâÐs ÆÊï~2ëÚg_~7u|óýëÇ~üߘ‘þz{¼µRÐIN³V,Ø9ásZ0U~µŸŸã@8ç¼ø˜2/v¡`”¹Ø€3"ÆG]:w!2ÀˆhÊL8þR†Æ„ˆš´ÛçÎOÌÒ"„LŒ<þbBŽ¹d6>ˆÜÖ¹¥ïÊHSÉ[{˜{Aþw£"Î]¸t/[*q_\qîBdŒµ ×ÎEÜ0H $ÅFž;)U#a餉gàÕÚͯY3ÞÛk…„À˜1å¿›_ɉöÅŠ[ëJ„,{9B9¾ŸJ-k`+,”¹x.Îí=ënÝÝ?}_IU°àK%P8ÊŒÁú÷ƒ¿¹ÔáØáùN¿Ù†ÔÃÔžP¶¥VYÐJòÝTï {Ü+qž• ùï®^.™>ûËç¦Âþ£Q¯ÕJ¾õØã°ü—¾Õ·QÍoN[ÏXø¦Ó“v‡`eßÎÊöÑç!­!ß ñ Ñê‹=g‘Yý“¥ÎþýÏ_남R*Ê6™’‚(ÃÀVZýÓÞ/D+µHu¦‚ Hn‚ ¹)×Þásï’〠þfŒ”hinIDATë|¥žÆǼ¼žkûÈÈ__ªIñׯæWgÞ " ‚ü"¶  /ÛDÅ’‚ ^nÈULÉ A$7A$7AÜArCE@É A$7A$7AÜArCArCÉÍËȓך>rõþ£¤‚x¯ÔŠð«kwšuzQ©ô~­7KÑ¿î7iu ¥¢a¯Nv®.76ï×efcÞcû)­­®oØcÈÍ¢[h;'·š·vË»Ÿ î}‚ìkV‹ÙvH“ò€ Ì-¸s£ºñGÎeÝŒ„šm|ªû7½³ÿTöíD`¬v{¿ªÞ©Äßá•Ú^ëÌ—«AÍ’ç¨ÞÚÔŒ‹ßþ,éŒ1Ûj•õ :ûõjIg ¦F=•u\/,YgÖêcJ;'·š¿Ý IN—Mfµ“C³á=Î/\cÈÉcŒ)m­Õ½ºz{Úå.ËY±w«û7=¿x]^B 7I.^îÀhO?‚¨ Ö "2ÆR#¢sï%«ìlëu @Äû§#uéY*{ÛÚíý”¶6É®å'¥)¬¬ÜBÛ EÒù+ù‰iJkuÍv~j'ûô+1Ù·ï *EÝÀ–*{Ûô+±Yq ‚(Öjïg]Ù)3önfô¦k´ô´suɌψŽ·¶«<û´Ÿ;ÅçõþT™¢¢t¦.¯ÞvýçÝî­TÏ3ß康™3Þç5’‚ø ^Wñݧ³o'"ÞêiÌÓÈ&3Õ$‚øK^ß &óý0Ƙ=¤¥ÿ—›Â+òæ«#7±ÛíŸò —¤ç߉ûþH5cÚ×–-üñ>>ILÄ¿¡ã‚c]ß&l”Â?Éßtâ—Uvœ63ÀA„—¨pDAÊOQ¬àó%^¹¹±õÀí½'Qâ/¤b>…u?_ÆÅR§ðo)""– Îê³b7­þ- ËÌäIs¦KÏ®¶ò¼éǯë9+Ÿüt%Ìá¿oýýH¸üÄNVÙÏ[êÔãîót á‰EÿØ’ÁÇdYp…\5¯°ïFT(¿­éüÕ¬ª>Oa]CÞ•ïÖžì1fªâÆ{/Þ”EÇ]´®ï\à¹À¼3{ÿ¸|'Ž>{µ÷py¤ÓσœKK×_¡ãÖZ‡vkÕY‚kÏþ±+âN:S9ùõmÓȉa 7cìîîÿ;ÎüÆv®¶sûþÄC¥ú­õl§*tž˜R®í9t&)G/¨ì=B»øÕf÷þp:«ÍÌ‘þ¬ ˆs¶.ùAì1£¿cÉÒÖßûcס;é+‡í{ lê"@áÃÜ>¿ïÏðXìªÔ êÖÝ­’ª Ðõéÿ=69צZãA=ëÓLÐWGn|& PWrâsηQ¯ÎOé0ÒÜüeÓ&mêÍÇÃÝêTKILZ½ü×yõ«Î¸)ëÓ CÜÊ·µ·‘uºŸW,n;g÷’! õÁæGmüeã ‡Ãrk;CbZÖŽÈØŽ‰›êë×TdƧ¬Úvú³Kú)ÞþíÃþ_p°¶±wPëòòÖ¬ùiîŠ-=›UAÉ”•“Ç™1';Û(!hîM9êòÉÑÞJ«Ñ._òã§{öõªÅ˜æît\ß°†2'!%kÛï7¬›ëT²°yꙵ¿^ï9hh5;d_ܸõœíÍm«/åzÔ¶O^õÃÖïNíjo_¢Ñuš|3Êb~–FÏ‘ˆ÷N®¾ö k½üôûùë6ÞY±ýÕ€éß2ìÏ ÉÞÉóóÖ¯Z<{Ó'ü„’e’t|ëÎw/ŒIc k Æußmw`ã '€¬«ÛûMY 3+G[c^žþ§ïNÌÚøñ0OSVê楟u²ÃKÉ€9jå«O¯÷Š sâŸý¿%(ím yy?-[4kÕ¡ÁÞŽŒÁɽÞÜžâ`ck«´:íÞ¿ó÷åuU M)ïŽîs:Y°V+%“yóîÚV4÷_ 8ç/*ë½û]ÛðûÓÄLÚÒª¹àè ˆˆ˜=¡[“®sÃ1fíÏ}w]Ï@DDÝö/F7oÓåø]=bÉÇLXëïã?dî:K×~™ÔªYÃQ‹ÿDDDyõ[;vr[‡hHŸØË+pä·y–X¦»5¾ú¤å(ïÎÎö»^EDÄ_÷ò {#"ÝŒˆ˜;½W@ð°/ó/ÿ2´¹g“Ùë¯X¢\Y5Ù«CïËIúGÈt~^Óöý£Ó ˆˆ1_y7ó ¹2Ûò qzvh:uåí’?G”¾2dÚˆˆùѺ·íØ}èÅ3""f.åÛ|ÊKèãË_ó|î¾ó÷þg¤WÛ~ײ ”ÉÉ·‚<½ü&~·ßR&·-ëÐìýU8â†:z¾u×h ˜»lX»7eÔÇìîØÖgÉÁ4Žˆ(mß¡ÓÄF™còÁŽm›/Ù“Š(¯œÔ²ûÌ+"¢öîF´n=|¾V昺¿y÷iKY5&ŸæWÿ½óZD<úah³À!ûod "JËf hݦÕW›.aæñÝ0Ænî<²sÈìç?ãά3ÈFÓSj=S 2´¶" ØÔ«]×YÖr7¬‰ðýzïf•ÀºßŒñUõ9®F—v¡ÂvHï0+@¨Ñ¼ƒ`¬;uZ ¥HüëV1ƒ,s@U奛Nï]=ÍsÊšnŽ\g.ð–Mf4qˆûic|Ïé“ü\ˆvf¼19¤Cm€ëí»¾7ÒÛâ‘ðîÐ@2rù¯fTJB•YoôwD@k׆ŽÖ²ÞøÈp €Aæ€(,.0nòåW]€•¼[V—4–²Í;ôˉÀÙïÔPJ’$I6ÝÞþÀ+ÿæÞ[¹e”Iõó_ïb€ ƒÇ ®[ùRä>£ ƒ>øãÒ¯ë©9°kPI0Ê"ª´¶±¹rzG€ìKkcôB”çp1L7ŽK ÷‰weÀ¦ÞÛŸ•/þy.—ƒKÐñ —O낈œ£X¹‘‹¤3ràQËgæQ@¬ßÅ«Qù> 0àÈáÑùrì¯#ÄaÅFИùá¸!GïK-;÷ éÛ= sÛ3cšü\Z–e³Ì, ‚YÒ@Î9BÁø‹u;pn4XMXµoŒ»CioÀ#.Ž¼x³æL°ŒiïørÌ×»ïÖkѵoè IíÚä|ÕsV~A˜zCÞ¨ýÕ;‡RLòùߥfS»T+™çÀPFVô‹XìdyºW÷éìkvëÕ§OØ°æ­Ü…5É/ð-—üi¤êU’¿Iƒªz5”ÏÕUŒœ7ìX¾Ràæeo8+¥@DƒÜËçr­ºV«üTä&_¼p5kܯç'yL}6šyùVóª9áIÙüjXòÛòõ¢ýÇŸòÔÓúžÕsŽ\HãîP0Ȥ¿ôŸG{½5½™³ú‘°yñ©Y2Ú),¡Ý&³ªkK;ˆÙº12hÑ¡/ºÖ±;gæGfס{GóO+~®~èÁ°•ÝŒ† ,Tñv³NÙ™×¥‹³%Q9þð-£ë”šªð=3—Å›w·+øqôfËį*õÝ8‰p·D1ÅE§TxWñ+â»Aĺ[µýp’ x¾‹á‡z¡—Wo/×TFMñ‹]÷ýö#C.›u›®Ñ89·öiö”oH†ŒÉ²( çr^øÊïcÔÈEo\ƹM_Puׂï¢ô€œKy KÛ“–foÿ//Ï@äü¯æ0TÞîÆ×oìK8çŒk6¿óÞÖ+ñ•­”¥ËD‘1뿧çüα ;’5-ýº)d"“• K!O.¸dT X8’.øöÔYqÝ%pdS[€b‰‘ƒ²i§nõNÏy58ç`L˜7}ƒMû 6΢ÄfIÎ9ÜÝ5÷hº—%€ÆÓ{T:±~í¡dC.™ô«Ön¥©WĺaŒÅ>›|áZëw^{Î˦DåÓNES^^¾éá¼DDƒ6/ŸIÐ`à·o^3'´ÍæV^b^üÕûâ¤O—·­£|t-7æåå›%,l¦¼Üü‡n$Ù¨ÍË×p®­{´«²lTØõöž“”(z ®´nã¢ÏPœ3%P©®dm}ïÓño {óÝa³V º9j`»Ž-}êå%F¥Xù-\:Ë@2ir5ż¼²!/OS†«XÒçåi ¼g„AY“Ÿ'J;¹Tu«àÚðÓƧ¼¿h‚V“«3 dÌÏÓš,š8â³AW&ÌîÑÚ¯y3ùAÜ•ÌJ-z·šXz}–­[“êÇÞh{¸‘»³9êrLã¾ïÏ|Ý=&`ö¬é[:ÈY·Ó½:WývÏ™ó=–~1X Ð2 @±r¿o@€³B(˜NÃÍùù¹3G€o.¸qsÊÈ.üšÕɺ}ù¾uóEïN±bÐ"¬§Ïú­ïèàY+'þf~½àV^Žá ßÜ*~6hÎOcãG¿ÜÑË¿1fÄÊ Â¼¤h­I®Èróêìw³cð줳—'ßÜ«°¶zžù.oÔ­Íœ ÿt¿›ÒköŠ/P´\ʽ}fßéàT/$4¨²Y ùH ]’oF1gKAÛ¹svω\›u h(ë3þضKݤkhóš xü¥ƒG¯¦·èÚÇ»†#$„<~5Ñ¡ž_·NþªŸXÑÍâ÷Q¼©—X¢ùħ+ñ òþüm[‚\«×àgVæ‘¥¡€À¤ß8yøÂMeU]ÛÙ°2žšÝåÃü¶‡V~wb×…;ù[‡´ñ¨n©äŒ±ôëÇ^¼e]Û¿G°¿L§¶oLqj; ¨±ù·žS ýúØ”öŽÅË­øóÄß{æFŠsýVÝ;z‰–ÉÃŒ10]Ü¿ãzªäÕ±k‹ú•5‰W·‰ô êç]Ç.øóêýJ;tkgqWè%š¯ŽÜìúv⩈)·ö=g¹¹±e5ß&•Üë–wïðqy†:Z*±"•(Ùú±H[Jý·zÁÅ2üË5ç]&§fwù0¿Í¾eŸÛ(}ˆ’áu1oÿrØ‚?*í8õCíÇæ^²d,©•:ý°À-ÌŠ,3¯ž«Øc`˜l2?ÿáî}»0±ÜýÓ6ºgª¨¥{Ü¥ÒMýßn•ÿÓ”I©÷'++|QjiþÔ÷í¥*;}¾§öc%ö1¹?¾lËõ'$ëæeâî²)x¼ÿÔ¡ûSezH=»ç‚¹Z÷ö-û½c̸{àt¤uµ¦!­=žl_dݼI’ÎDÆí9ÑáÓ7žóàTî½dCNÕ¤—„êmzöþ‡Q¬ª¸õîãöwì+âyu6 _¶ùêºÜü¼=ÿ²Ùüü§2ÉÍ‹„Ëò#;]=Ë·1Ÿ|µø¡çÈžU½Ý©&DEéL€Ç P•­MâɈ”K×À-¸µkK¯´ÈwœFÄÚíýkwhž}÷ðYä¼F+ïºA­²nÆßÜq9ViÚÀ½oPv\BìŽÃ\’]<Ýö옗rcËÙdv¬SÝsToc¾öòŠ-²Yrª_«énš”Œ›÷™´º*Mº¶ò¢šDEnÑ£ˆGÿíýg¤GÅ1ÆAtméu{ß©k?ïÎÓ"¢kwh±rK± L²oÆ×íÜ2ùüµ«kw‚‹³{ß ˜ß^Y½‰¢sýZ {vL:}ùÊOÛ£ÒÎÆsTïì[÷—ý*ª”j'û¦Cº%»¹r+Ê\i£®`W½ U&‚x2¯Ô7 3ænöD@¬Ò´“[­Ü„”×o@¥†u+¹×ͽ—œuêתìá¦MËLˆDûU«ù5Ѧg¥FD£ÌíkU­êÝØ•›rñ:—dueÇZm|%ƒ1áøE.qç­¼Œ¹ùÉ®ËF“•£}­¶¾Ïž Hn‚ ʆÞÉAÜArCArCÉ A$7TAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜQ±ùKÇ.b ÙIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/response1.png0000644000000000000000000023506113051004444021365 00000000000000‰PNG  IHDRzÈÏãXsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ ¹‡uÌ IDATxÚìwxEÛƳ{jzB С‡ªTú* RT *Š QPD,X°7lXTDQ‘ÞK ôB !¤çÔÝïœ@AßOátïËË‹³ÙóìœÙ™{îç™yf„”&L˜¸ø°ü¼'ßå3ÌŠ0ñסa˜£—‰óCdæû÷Ÿô˜aâ¯Bbµðéæèeâ<êæƒ5Y÷u̬™ndt˜Å"ĉ|ͬ åë_³ L˜0aÒ &þYÎÔ¹—„‰”!Š}rEÁRˆâÏg)hʹ †” QæN‰„b›R(âôS”R"ʆQR€”BJHŠ€!R ”½ó¬ß\ÎsOö¯» `œ§²þ¹îUñË=óî$B¡¸(å7›r®K‰”(ÊÙwþÊlâ¢ÒÍêדvÌÜ:j_‰î³ì{¿éÔ‡ÖGõoòpC‹„È‹¢i§<OÍÜqó]âÂD‡ZÜÍ¥aWÞ÷oM¯Suï=q³}Birág{ú//Dxå¼WZ.zjÃG¹ÖÓšö‹fâC›žÏ>§(ºÑ½gí¥¢öìÈH˜}´lç—hÊÖYšFÈ´£j¨ïù÷>¸¦–ÌÕÏ÷lgwdèž½FÔ¸/]öùOuê›,ßV%ÌýÒŸ_U»Lcz= Æ阃¢ðF2)þ VÍ5*s¿ƒÛ÷cÿWµ`9ü?u¦TòÔz% 5péµç’Z|¹½¬¶k`¨! vªNEfvl>þ²ýVk«„ˆ‹E׳Üxõ”){¬¯'f{‹$»%.D=ž–]ùñƒX.|}Æwix }†˜še²Ãÿ‚nÊwºTå…·“_`ˆÙ/%5ú2ùªUZ±.xéámHðª;?lþì3Û>8&„RWâ.pÕ~0$jD¤kfB‹M›6@Xø ÁÊ9sš-y5¹ÆäFåŽ3õ{Ôy©Zá€ò¹:到+G\Û4{”¸o8‚*­ŸMòêÄåoöì7¶Òá;ĬQ ÿ3ºÃŽ~{jÏOˆl;¦Å&!·¿X„Œm>ûø¨§ï[>WsøÊØ›Ì>­ŒÞ)ñ±Øª @ÓÑ•k~°+øôbˆ!QÖ’X3Ð$Bð/ž–å}ÎXs Âj€žCæ‡æV|ùj±–ÌXð)HñÄŒ¤¾Ëv5ûÉ[¢=­vèüØö >«mûkM¾l›zýFýŒeŸŽP°Š3‹Àø $XTàÕ±*ø$)ñ 6—íß ì €ß@—°*Ýå× R¢KU˜"èÂÓMÀËðyDÕ+(¹Z¢’¥ |/ê§rŽ{©®nÎ×^µg]Aʽnö¸ÄØòÇÁ_7ôh×õŒ/·¯™»ÈŠb€È. F t×í}7,œ9E"ùfÞä/Ÿ}ȶ`AþÖéѬEBGÈÇã°l”å=.PÔÓð m@§`Q7„Õ‡y?‹ksEOd¡@bMîŒ:À„V('©èà´âÞ­xºÊÌf(>ü6vºæ|ÍY#˜@JqºòO7'Æé–Ãi/,àæ7B¯wÎ.&6fC~@óJY¹kƒcýÜʸTixXþ^ë /m™tÀ²yFÃÆ~o²ßV×®×´ã¸_|­õç{‹îkäúìVWÚ zG®;ìª[3$mωf/¤Å_Ýø@û ñdVHƒ*ÇÆÇe¦:+EfåUzx‘ ›Z<—Q)ì“}Úè6aƒ'o›—c˜Œó—è¦÷õñ‹ MA3”jÝ–` ±s$OÇ0F5ŽøjÕ.áñþN€Dø}ÆùÿˆaX½R½£ÿÔAuöÖ ±u™> gV ³à ouÉQ«"}þàS~Oð³7¿²ò— ºÍw¶AŽ«ÔPéT©C+wlD‡°žO`nRb”¨‹C>h ïEÛZ0,œ7 è—€q’û"a\#´)ÝT‹üzœÓRRaIA¤þõædXF4$ùí¢3ÍCˆô峆4myt}TëÅt¡°ûfÿÐ1‰{Ó¬/g"D§ëSˆ±N;î÷½NfXn?…®®œ\aĤõïRPÕ{¯Ž²ìƒNòq>¿cö.ºøì©–oõ¸é›\ŸO Ÿ˜‚*Þ)h¼á¶ðy³rLùKt³cÛ©wŽºº×¯¶múç¬Ûƒì ¬VµCÃÐ¥ ömÊ“ø-×&Zn|ŃPÿºTß”ÒÙuªÚ=>ÝjÝ/_7µB¡&Jš¥­TXâ¶>÷@—ÁJŸZ @='.óhRÙiÌž4EPèA¬8¯î;˜UAJŽø¸Â ´¶³$ U `u! –g Ë9å~ã·SÅ® KðÈ?eÇ3GÕÉ5„PDÝañiY-×h(·xciº6¬~Ðúu…£;DþöÛ)Íby…íäÏÊÝÝcá.²ÔªäÇ¥P^ÞR„UAÑ¿Úèyû‘Æ­Ëzåç“/,ÉÄVòŠ-A±6–ñbQPöä=Œ‘‹ÇfaU@<ä#)Hc®¤þKtsx_Þ‚}Z@"z-…Öºî×?X{Ê"0t9ùã[34Tˆ¯TÿDæ‚í¯Å¼AX<÷\±qw‡¹«Zúæ kõí†}P?TÇ Ô,A¸&H¼ž¯fµª¼çêïÝlX|åHªi›Ø£—(s° ,¿^&.ΉC”\Ñd™;8À[rÑkðo•Û…yžo7ç‚&’îCøst£ÂÒ §öú…”d-Nûu¯ «¯T1÷©šäÛFí½0·``Ô]? iòÆ”Ý(–(8æ$VH¯kÌ'EÅï¸P3,Ê ¯%ÿ˜9 IøÏ3ZîÍŠŸy¸dQ, ”¬(Ò‡Zür’«ò‚Í]š±› ͯ-Ü”sÆ-WRÞÔ=â«U'°žÿk~!þ`ÒA*÷?Ô­òô+¾kŒªc ±¶ˆ×G ïöËôÛZ§Óó¿Ùk€fÿàéVöµÏ·[Ы¯ü6bSq”šû”’ íø%EH5—ØJ*­¶Ãw&âpe@‚ ^€æÒþ¿~Ü’³ÞW†·)@^ÆI14#ð‚Tÿú£©c›_ÙÆ߶0§]ªDѾϤ™+ÿ•Ÿ½H‰TC-†¿´J“ê–í»rvìÎyâÓ£ÇÞm~cè¡u¶ë.”Ä)Gò$ºÑ°BÐÖœs™Ú%M7å11¼nÈÜeùPûµ St -šD ,`箜.9`x½ñ…ä7ªÞ0BiUÅnéÛ2Jz|‹vA³>¾õÙ©·Ì®=tc¯™Úá¾),t~ýÌìi£'’nM¯_z·{o•P½Ã„aqõnJÓ¶ýPuù¦«3 ãââk3Ò”¡1luseŽçR)™ÜZ:ù¨v9‘¾óŠ¯·Žðl=@·‘„(4[ÛEˆ7+•â«öÙnïÇ·Ç~òý¡b·èåRÜßptÎÁ½nî\'!y_ÓOrKµFeþ”Æ¿Ì?üéa_…˜ÐÊø—°¬?±ÙµlLÍAóOņ?’dí1)ÓÔ2žn~Ùš“ZTjPäÒä‚#Þ31Úm;òs²Ï髪üq[Á‘RÉž…ž¯“•sÔÙOž<õíQEAQ‡^YAõÉ [r‚DÝ$ø:5w§KúÓŠ$R¶mÑ»ºÕþ•§¸µmTA®kQra‰Aad °M®ùÜuó†Ö°lüõá?ôÂæqŸlm÷åŒï61MïÚ¸Ýç*-Ü7èŠomÒªìÙrm¦QŠ)¶æPtŽ®hŒÝLÿ*\Æ®LÞ8…C!÷oYéY…ô<^=Â`ªàp…edå³× ‚ÜS¼ èTS¼pˆ¡!å¯lû'C¤¦--ô•n[“sóK5žG ¾vzÎ]u™²3/ädé6¦-Ü“›ó‡QÎÏhÚ/|öʼâa)uo†õ>×Ó½+öŠP¾ýbç ­nË’sº$€ê¯s×ö‡úÄÝÛ="#ÃçÖ !b² îñ/¼š¼©]ìØ®1ùY®wmNó „LOÏû±(Ðr|y…‹všéÍÿŸ1séq3EÓÄ€™¢i⇳ L˜0aÒ &Lº1a„‰ÿ?,f˜¸hH$¢ÔC>ž»6îw® 0D9ÿu(¢8YǤ&Î×SlÃo;¥b­Z¯Œd„K}Î m’¾ü®7Ó÷Ú,¥p:ŠlŠ%×eB߶iìKÚçï¶ÎT$ gžGýå×ç=º;«è­ÛÜy•ÜvGvE§väH¯šS§bùÇ/èÄ,’O~¡Ÿg8|&ݘ0ñ;ŒsŽ‘HDÆêÃW Pz ¾ ´säì[°H07ÍÿX 'f´ì»ìóf?UdÙ¡ÓÃË7z½ °¥í|µÏg­ï¼9´Œiw(67>;Î"݆Ï›U‚Ä°à³#Š›ÞT7ºC ú$Ó |Nta`s£H(¾Ó…á@WÎÜy¶Aòœç–ýý†Ÿ)±z°èRÁçÄ»!Ï^è”$;ƒÄ°â³#ÁêÆ¢_vzǤ“ HdqìP¢.]ìy†(faœI+Eß&ñT%…û’¶³éÊ3=Ns¦¼š°xo‹ûZl»}Ö²·ÓNlvk]oµt˱(wª}è¶ê¯Mî;¦Š{ýñðÖÕ?÷î{÷¯Jš=¹AKãºø°Ìßòr®¯]Ðýþï—¹µŠÍfî3ïDj£˜Éþ7V>ɇmêøÆ]¸¹n¥]K3ôaS»ÞûÓrŸÿlƒëœ²}ÚÈZîꙶ´ð•~Ïg-µ2Àô¸~ã›J+”1j|« ·ùýWt¿÷§?ï9Ô¨~­äÔ-æÜ(ýrñÔÎÝ*ØR ¼û7BKöoO ºR ßéÏ®a oðЂcúe–FaÒ‰‹ë T©ù˧cÒK2Âe['Çÿz,Ã(Þ€ï6*Ó×^¯­OQOqëñØľëþ°BÙõà=ßƽÙ`t­TÛÈí~)‰ØüpR.RñyBê‹J½J÷ëûÌ»ïå¨iÃSÇλåñ_æ¥E`ø7¾Øjrë¾SÖ7ñyCëT<;ù9ÿö¶_ _SáÝJgô==aLÆÊiM>íŽ0FŽî²oì÷5Þìz:9&¸Åäñ âœ#xt1rØà÷oy§ùW W \Ûúž-ŠÖLÏœî×DöÛÑøÁ^ZYI1lȈëýª¡[Üp[íôáÊs·¡ÈÎ×ÿçèý«Ó‡ÈËj²Ç¤WÅäçU_°µ£=¡iD%.ÿsÛ øaêðI§ CQ| k¯j˜Þö* Eà~ìá{ms lü×7*8ümѨ®ó@„f·ˆLúý­õ~¶>pçëzÍYqÝ´Ÿ|¨¿ê@Gì^Pvl¾1´ó§8ZÙaqf0 iý>=þê*¦È&móÁ«±y‘–ƒ‡*[¯ØÞälƒ"½oBÑ®ý¹ÅÏ<Õ"ºãgpuIe(·vÙ|àÇqáÁ.ßþø£·¥¨ßì™]uC‘ŽE"#ò©ƒ*Æ·<°ÿ§ÉšêEáóMW|Ðå(ÓùرŸœ£ºÎd~3QëÓ`uháeu°—I7&.. râ?_Óët¨øÊžhñ§ì(°.åÊýš†TßÿyÔÒ‰Ø|á•–ä>õ8-­#>DPèw€o8hJaT°à«ÿЖH[Û;Ööi?¿o³/ó‡>¸èëû.¸ax=Å.‰!­Šp ¥lF`»'™ã·Öv»3š?¨øNY¼ÍÀ¹ç× C-y®;ñáoÂJÿŠ(›QàS¢LõƒjSÝ>Ý^²Ÿ˜Ìò‹aþt§‘í $1k>Т!WTpñ.qÌ¿Q»Ü¶‰4éÆÄå–¬ï³ÞW2;c÷ÌËè+† vãL˜GƬ/$#µç3›¢ár,¬¹+Y­¸hÕÍ#‚–Ë—¬õuo¤¥zô.ds„µÙ£Õ’¾:_˜"Ý:èö–ῦÄ⬹xkÞY«Îß´¥ˆÃ‡®{f[R ¸28ú0~8òD£ý|Ý«Qµúꕵ·Ž×°‡-ÁoAõc(úœcÁ;3­÷ÅŸÀQ¿ÚQ4úmò:=³´:R`xC¬6Oñþí>;VïeÃ1—ù™¸ŒC(Áä.ó›˜ùÅ;o:0qcû„ß<ÓqYŸ­Šc׶§®™´º]ýõ·ôúŒìNGuD³f‹îoµ¡]‹î\¼ä‹©øãž?½éŽW:ÔÚÙ窧×Ðf­kWngçÌT匃îqËõ 7¶oðë÷3:.éµãŒríçgÕyuNïoº&þ´xÂÝÕÕ¸‚#ízNl¼mn»šÉÃûÜWÇÌxú¥óÚ&ôyöÍ¥c>·(ZÚþÁêÄú/ýç£aQEß.ù𶠉ÅkÿQG+\&ýØÌ7qp9f„kAÏÝÛ4fÏ{C—&\®KvuëWÓzM™ºd‡æ¿ô kªÿj(Š®ˆËyi²êûÏßãp_ pLº1ñ/†¥hÂsÛP|ç¬ý½Œ px.—Å~&ݘø7C`õšµð¿Ó’f˜¸h茿µR Y8ßú© ©üÓ9•ôKQï˜tcâ¢A žuoÒÇ=Rþ¾î,Ý!ßéì;Ϲ?•ï µyìe¾£œ˜6µ8…«z—q4:ôË_Ú`9ÐÕáwôI”ö ö£ [·þÝŽÝýÓ%È¢&ݘ¸˜ã¬TŒÀ\AQ(zñØ«âÆ‚ß¿½DbH|!¸¸‚@‚ÄL‘3ðo¿¯-`ÍŒ+)A¢9ñXð¡)Uå Á„,9OZ*¸BÏé„”\¡¸‚1@*RMŽ õ®P¼á·µÚßß‚'M <Ôg=¿ *)[Q(nçÙ‹¼A¸BqaqW‹t·+ ýüjÅoÇŠÛÉé”ÝŠ+WH™Âxƒ(*.ž(9[ ¼Î’ïštcâ_KlíÏäGÍêëH>ž<@¾ÑyÇóm\¯tkå k6]¾?ÔêµhÊÔg¶ýR~تx[©¶–µ‹V¤uÔˆ›>¿½W¯ î÷ì˜ÖÛÿA⪡ßny‹|âý½o5Ìžð1.Ûsã®ÓßOÚ:£óªÓŠ=t“œ[?ìÜ°/è±ñÝ¿ØYÎm°jì;ØN®x` ö5Ë‘Ôóûª=pÒœŽ[çHüåŽw0$Rÿiʵòí+·>×Á3§ËõUr‘Tˆÿ:÷݆ÇfõJŸÝ­“5 •‚kÎM{+1ezoÿ‡‰[o™ö7÷w3Tlâ"û3BÇü’:é…6×ìu‹z]ÆÜÒ\Üõ8RiÔýÎ_ã&¯4±qî3{ƒÛýhLX…yWïí6%A»5å‘Z…달£ 2ŽUèVgÛ×s_Q«~·¸ïÖfwnß斄앳oHú¼Ç6O5_üϸÍ; EX«&6ŠˆñCž4®¼úá•õUÞ¢ÄZ“¿)8·GÛÖþ´šùNû>·<ûþNKa9ýA3GÞµoŬºŸ]…#-ãõ}CÆìüŸ«BZŠ±Ó¢þÕcw?4ÅvÛ;³n~òûEo þºÖ»ÞìÎVP O~é®ÇVÌK G¤¼Òþ¶úßÝ_áÌÙ¦º1ñƒ–¼ʤY±¾Ð'õÛpdo­aí ëðUCW]¢—Ô zõ—v#;ÏES×_z2µ[6ö {x"¡Ò««mîù­Ö G»¯©0/%ºUÝmþÔÆÛ<~¬>Q_ÝÊùk·ô]»å?w½›ùNçÁ-=mPIiLÓ/FìöûáP[)%1¤8º©´ÍE“Z'Ø!ût››»vØüÃ<Ùb7»Z‚¤Òº0¢ŽÄì3¨])Ÿ†Ö±I>©øÝuAfá]yH%*,''?â了1q‘c7™Ó*qΠùOöwè¶Þ|!ªËí£[¬Iª±cʸë²Æ¿‡®bõ¼þã¨Ñ'¯ß8 ›¤îÚdä<]ËÿmN0–ÍÇói‘ü]r3„qt[ŸUŽíßþºyÕ=·ôy$2·Á›§,¥’@õKoòÔþä™.«ÚÖýíÍ[f€aqùbÌNå§g|…U°méTo“C5Nê¶~×´ªrB—J»6Ÿn’Ü¢Îòyw|ûý‚Ç)7õAÏYþTç:®lYkG×6_W$tµKž6¨Êø ƒ[®Nªµiþ„çv§Ó¼éŠp%è$ú˜¶k’¢Ê;ÿ×®¼¼¤çýÃ︶ÞÖ>^ûzàç;ò¬ï¿1£bÇÑ77ÚҢ涥=·jñc™Šå£_=<ôÁ+k%ßØó¹a8R÷V})5j߸—:ÔLéÐhñÉç®î_5ÿïŸ2éÆÄEt¥o²7׉ðïÞtÿ¸¶¯¬Õò:8Æ~^¿Éü×nš²k²uúX,:ÂØ¿±G><óÉ „´Þñ]«äƒ×eùïÌ ]RŽ\ÿc¦"²ý˜5?Ú6Ì:#‰Öqó 0\µ¶ª"‹=,R¥ÇæÄ'}ðÌ5?M˜±p}j=U‘BøãÂ3Ïþè½êÊbâ0Û7ö Ã9xÖ¦:O÷?Øâ»uöÔìÊËîkž¢á{ë«iZýOߺჅ½:hMdù~[ížÅZüׯyúî&é w¯LS|§ F8¬5ÝäŠ×ŸëùÝ„W_¿qîS‘u>»ÊÛñå±ÍºÌîë.­ý?|ÿlÃwûÝßïùÛëøªú9Çâ÷çtUïù C»÷^î÷Ñ·ï/h¿ #V÷||džŠ3ÏjìêÒêÓ^O:Êø©¿ŽÚa}là³Ov^×ìÞõóÓBÿÞl3#ÜğΗ`X®ºö¡EÍ-!Ó§\Šg¹øƒæLj¬lùèŽåuKº«D*å+…?y Ô7x)Œݘø»´qÇô{]=î7,—h¶¡F™éc©T¬ûæ¬GÏ¢ %·Í/ú`ùÿ'n\pƒ—¦gmª·ºhŠç›/Ña\¢[Z©ØƒÄ°ž}°'€þgºàMucÂD9CžÄZ¼5Ô%Û©ªvöE;OäSüÉG\`ƒ&ݘø·A3`UÎŒá>‰Z|Ôä¹A ²œ r‹@o©5z,âo\k¤—š b0¸•<¼|Uü¦WZòåvD n -a"‰_‚`ã1´J´µ@Ùë¯&³ËÊû ¸4¤ÄnÅ{2y6‹É8&ݘ0`ÉYç® aå>~•ÃšÃK'°«›¼/‘‚™-ùEábþ IDATa?zTV€û7ãU’à f'Ò"íe5’KîâÑ ² @3ðH°«XJ¤“GG‚*°+[â¢ëè`Q°+æ1Ð%BàPP€GCUÑ t‰ªàPÊ7ȹÏ-ŠÑñ ¬à5PN¯Ž&K=šÀ•Ò>mЪ`+~®Äc”}®Ägà—°«%ü.qëHp¨øtl%ק„&ݘøÇÅkÀ¢ %„À"Î4zEü)E –xL²ÔE.R M0ÛòK®óz¶çÑ.œY[9beZ=l:' xbV߀z6² *Zxkë y¬ îL*:qÙˆ5˜´/4¬Â]qd¹‰u’|œŽÁÄÖøŽS%”\…x ¶£‰³ nqá âñz¨6ù<±[)_²~mnÓ8‚_Ò8ˆwÑ+†• ÷¥ Båh¬I®›X«òv&6Ï6Ä¡ãU±ûyd'.ÁĆԶ’ePQåµ=$»©Åý5)òdçpÏÄ"èÏ Qdxñæ\‰¹ÛÙåÇé< Mº1qY£jCjœ!Ç…PLºJøÐuÖḠDÃö  Æ5$åoŸD»š3&’÷Ü$1bRÎvd!.0•ûS°nnÂÄ8žÉd|Onå ©òr Zf³±·Fœ“I)¨‚;“Æûþ³ ®+d\]¶åƒ,ß‚Q‘¼—WRNO§B S7g0¼b¸{•7’¨-8"x¬&ÏncT^nAÓ\*Är*‡'aƒF±4t°MàäÖ A¥ZÛÙæ">ˆ÷ñk¨¼›DíCS¹!Š6qÒ ¡2“ÀÍ`Ôï”Ф—5|:'KñøWV ¨†.PF‘™Ã/>TðB`!X›CůÒÌƃöçq],ú4ÁÝñ¬ÏaCß(¨ ûrqª Y›Áq¤ëؤNš›ªN6!ûNáP‘’}^Ú¡Ÿ<Û °‘he·<óÜ«c ·Ìì’žCØ ¼¤úp(HÉ)ˆ±pÂŽ•B©R’í£vkóR‡‘›sØz‡ŠEÅÜφl6ä°DÁ¢ðS:WÇpG4V5-d;‘ù`SHIÇUÀ°þq Mº1q¹"³ˆ¥'JB pMÕ?o*LJ&’ä}lÌÇ®P©OÕ Ÿ»À¨LX±ìÑXž‹4¸}3=béX™Qu™·—ïrà*™ä6 „Š¢‚ dœã“„¨oÎg”!Ís ~ëˆ &¢ø¹~~9'5AÓOï\ˆ!O»Y QTÔ Æ{r8ê#£ñÉ\S‰Áu˜há™íÔ¹™qtªÂõød?äóx ¼ÙÌÏ @§v,*²äY ï/Ô?.¡I7&Lðs%{,àP2²¸93 nJ»iÒ ¶g«Ž”t,¢ ~Lgé1B£x±6K7 %ÑNd"ƒÑ<ø<  tР­ìñ•{Fx9¿ÝŒ¶'YGJ©Ÿ3a~áõ€àË44’` E!6 / R™w˜6ñŒ‹gâA" –ãû4£y¾Ë’©¥2ñ…*†JT±5¢¤ƒV‹ÿá+¯„ .ÌM—3… !‚Õ2×mó3¹%Nª‡ðds†Â3M©Lõ`:DQ8® EEQ#Œ»+òõaü^Ò5†Çç uUjªl8Ohã\ƒªdQ·Õ§†“!<Õœÿ„þ?’° /‡|ÜU…ªêDðB3êXè\‡ëP=ˆøPZ‡±;‡ÐPf4¥^05‚éI^~…Ð>ŠÊAŒ¬Í^¦n4Á5Tvò`ýÀB'»Q^ ÃëÓ=èìiDSݘ¸œëE”ݧ¢Rm:ǃ÷œÓf¤»)(Ýô ²ÝÔoé.¼@(ür„ÃQ ¨N|¹“-nL9Ä j„+ìÉfâ‰ÀZÁE‡iK‚ƒÏ÷ó«ÙLŸŒŒçh>c6cœr“§ŠWè&C#?÷lƒV•e‡8XþÕ †Ow²ÝSfL÷ù8Z2_žï%«ä·÷P¼c×S[é^áµpû˜´™ÉîýœˆcHMƒU©ü˜‹ Sa`5Â)9Ü‚`…ÇS]&~ÞÚ !Ü]¨,îØÊõh¦1;™G[¡KPÊ)¡§•hõb73gÊÄÂeyF¸Î½-Ù³›¥nþ‘ »Å²ân VÞjʃ›È)ÿÝQ-Ž,Rüu­¶©nLü»!ÿÔ•ÉB"™]…=Ô á·Cœ”å/êp8ýÌ*'“nL˜¸Í_å¥MÒù2)ÌßÅW¥>žw±ø߬-6éÆÄ¿^ݘÚísfÊÄÅ„OGû[wç“Ïy§Ä0«M˜tcâò†¦s+® úû¶ã–„†ðAó3ËóÎB¥>hX–q$ŠÂÃÕg_Y“û_+iƒåA— K@þ+XϤFÉþ5RR¨”Ž!qijðé¸K ¯†K§H;ó±P?£•Š©AJÜ…Z ݹ˜ÚÜ¿Ð Š4\ú¦(.@9}^bHŠ4Š4 ‰LŒ…"Æ¡>·†¿ä¡^ãôTñm.ýlƒÅK‡=ú™¿n¸2˜B ý<|TúÑ~‰”¸JJ{ºZŠËï?sŽÌ™_TúοfìÆÄÿDeTæ‘Ü·™|—@];écz µj1ÊÁm»q(h’émØŸJÇ*ŒÚ0)‰’ÑÛ0$#bdó~×ÄsCNzˆ±³ô óshÕ€¹ÄTãÈQž:Á=‰´t¥q$?P„ÐPެϘMg'mù Æ4¢‘•0+«ŽòYÇc<ÝÍ~jZR—Ri_ŸÜLbƒÐlDh<¸³üó¶¥A‡j Ž!ÇGE;«Ž2¯”Á§÷Ç]UÈóicõ1Þ8ÎøÆ ™Ö˜÷’.ËQˆµÁuœÈ`‚((d³ >$†³b?åb â™T?VE<º¿`@]z†“åãx+sßfòå¥Ä1éÆÄE†€ aÝGåHE0nùÌK ùfnÕ¿‘Á;YÜgcÊ´MâólvÑR'\á]¨p[3ÆÅò\f9Ø«0$–Éë9!°Y¹1·ïŒAíÌÚÎNÒƇÍX|œ·÷Òª1SwbUË[»4B-LÙÓÎMÙ¿›ç °†ðFó61,ž ™›€nÕ¨k'ÃNÏÆ®Ç-hOc¸dζ0)ÁN¦ÖåÉ-ä‚"ÙžOËHZGq¼ØhBt~ΧK º¤^Gs‘’ý‚º¤K«;J Œˆçöªk ¤)Y•óΑ)‚}98T àÇB,é*X—C÷šÜG]'?¤²ÛG\Y^| 6ÁºT.¥ I7&.jìÆàšB]8 b(M#hA3;«s°*|ŸI«h|:½â˜wEòe"‰¯Ì¯Çùþ$ChP‘}'Ñ6Ÿqæ¼'?D*E¾À§‚WÜ ñG[+”=ç@œ_¤N× Äy:ŽUaæ6¾/ E%^Lbl•2½]“¼ÐœZ «2Yr?ÿ­ðð—Šmï×wú{Éi*„á—Õ`…cÑ¥x![§ž ·dˆ”tʹîÞïÆ_¯àD! "Í{žo *YXu‚UÇ‘VÞiÆG¥2„” Ban>iÇ^êÙòÏÆVBíœ,`n>n[qcßûpX,ªÚ.)EaªR’•ÇÛ§˜–ˆ!yãÝP?˜w$2©2ºÄ*Xvœ›ë°)»ßa¥¶B¶ŽEã„•!ì,D¶ž"<”ÞDÛéZƒ7Y¥Fp!ø!“z1´ ¦J0ëô…ÃÁ­5[ÿþ>Ü~lÁT BÝ n0ÑV¤äŠâTeL4‹”ïûVf4%)„8'ÂAÃ]Ê áEBÃbœÜ[ƒ HA hL¨ø3u;*ÛâˆuP+”ÚNR‹H- ÌI»`bƒ˜\ÿÒ}Ìî`â¢Aã¥H"ÖህÁaääpW ]«rOmŽã‰c´ìu§>É,ÙœØàg'sñI…mùäds¼xã>?·o&.šñu¨àáîd$x}d–xÞ|¦î§G nŽeÖNrý( (ćœ­ tŒ’½l I–àD)£ªcUx5•&qt…/Ѿ*wÖà‹ý¬ð§?yŸL›*Œ«C×0ÆoEQÎtL9@ŸZ ‹ã=|t„ÖÕöñÆ Õ&^-· ÉõžÉ¡ÏóŽ¾áÁ3Û8balFÕàû½,ÌÃïeÜ.zÄ3¼ OoÃàÒ ß˜á&.˜Šù³§hJ$t­I…'b½ô² ü:“Z±eË=gë|ËöþtVÄ…2¨ªt­ÀÒ »“—¹k~3vcÂà á‰:D&l.uÞ%ï!ÖŽ¥­ýìëù…,<õgÒ/ AŸFÍXÞ¨JJ! Cø&Ÿ¼DRÃLucâïV7Å®,—ŠK”\YÛ-.j¹…5þÔ¯¸€Ï2eÎL™0Q¶‡ü57ä¢Ê¢¤„eyᜩ hðwLýÝ0CÅ&L˜0éÆ„ &ݘ0a„I7&L˜0éÆ„ &ݘU`„ “nL˜0ñ‚I` &þ„”ÒlN&~‡nª×ªØ½W¤Y&þ:òÜF­5Û+ͪ0Q>Ýì+RHSÍŠ0ñ×as°ÃËeÖ„‰óÐ]›Y&þ2$a6,—ÙœLœf¨Ø„ &ݘ0aâO7K†ò\¥ šQª¬Ù*£_ú_³&ÈJ‚åœúϨúÿÇfB ™C±Il»‘ûåóêt¦\Å«‰êMIbâÉî]òÝHr{üå÷RÞSµ`CçR»ÉIfÜÀwñÄÖ'kCÉʉ¡üÜ‘ëÛŸ¹xúú´Ê 9x CÉJæ06õ¤Þ¹ñFƒŸpÓiº’ý7‘äüS¦B‘CQþÆí¬ :5eKçK1)¼œ (¢œ„©²ÍÝ5Ãß²Øï$­¼Šª’óœrûY7–þsHW‰ŽfÿUD|Îï5- "BÁ‡rÔ{9!vÂþì"ŠJ¤=P ·%ñÅÁ‹¢tV*” å„9ˆRÉo¸³sk–]]¼Y½®àµgZž-„¯¯ãçîÄ*¬éOdI oÎê~,ëF‚õôÎ/LïÄÆþ|Ò«?ОªWgE_>oNv\‡ÐË´6ÅɇÝXÛ›Q•Ïië!ìêÅÎâÞ¬¸†æÖ³ÃQ±,8þ¿€}Èç@é>¤Fz>òIsSäá@>óÉ6ðz8Ç|Né^œ^ÀáðåFfðV»r,{üÜyúóH|‰ªÒÞ’Uýù¢=JÉÎ_Aa|Úƒ }˜Þ°øp˜^îºÞtv–ìä)@gjÖ÷ç…&àƒ6 ™Ûˆ:ñc«ß¥I¥J¬îh3=ù¹/ßu%VIBmÖt*y´¤Q}VugEï@‡¬Ríýp ©[“ïÚF\ Kz³¦/wW4¶=‰æ«Þôª~ú5au¦7 è´œ´òöÕ¬ïÏëI($I ¬îx”셤ɑÄesû V üÃÅ=ˆ‡Ây`5»ÂðÝ#:²¸1÷­äÑ|?ˆ®VÖlÁϯdZªÄJ ØŽíxr6ó|?^¬Ð6–½yk=7¯eîõ´ÁÉ"òÊÛnñM¬ÚÍý›yw#xr*ܽŒ/NðØ^rŠþ®Œá輶–!«yçzz†ƒ «ˆœ›S[rw2žn˽É|™Î£Í)>!dlM†Õ¬¼Xƒi<Ó¢xȦs8Ójƒ„PFÄðr*7Ô Ï5£M€ñgë±$·”×v{÷qß6>LÛhtà­ÁLæÞ•ÃÚóa}Æ­`Â’†B¥èV~Ûÿ±#½/¸½¤¹/%gê\®iÒ„øjo+[Ö2³1,4¸»‘óÉ•¬\ÆñÂ,|¾‰¹«ðI, S ˜XƒžðBji>ì%šh|üŽ_³Ààú|ÓŽñŸ<ø =`°§ˆa¬w3iiñÙ@gêùE|]› HŒ`ÅI€=Ùd«,¯±/7À¥-f}À‡'U‹oóx쇀MÕI7î( q2©ˆ¼\¼]‰U(ªNÎ>ò릣†c¸X”Âga%uóÅ †\u=8¼W6»\icƒ^^5h¨°Ë –1›7"<“û“ÁÂ?Ù?àÑŒŒ"f>™d2· £j‘®S?„õ`cK6³š2ÐIÔUÙÌücSkóU2òänü´’…©‰Ÿ!s×øJ+mÿ{Uö„ND—꥛BÞEkauâ‘ãÊ\YÿgMå{Á j3+šKÊi_®äí#`ðúÚT#Rg”±ll:Nr+„ñaU>$=«“))ìI¨J4Óh¾T¶,áÞ;:u"þ(6ƒ…­K?šúà@cÚ~çåhkrÃ<6zQTfVÁù é¼ÝÛã¹;™'3±%?­!8”6m³iêcP(s²éÁSGéP‘ÕéÏœ¹Ü;ˆ…«ù>$’ßË.¤äÓå|•~nkÄô%l8™ÌnÌPU‚`G&[ Ù’Á{6PØu€@½déZ…“vª¤ˆ: G$ßäxKFÈOö‚$1†_»‘Cš—A¶•¯¨TöfÞ¬|"J†©mþÀE]b/Þ¿ö<õ²ÊSr§íw%Úº’pLŠ›^Á¥lJjU ;jv¹H¶¹hNÕx–¥‘ÄÈŠ¬‹aÿ1|T+Nxº3çÑع­ í…·2¶6'ܤ¥ñj&Óªq}Î2´ë5å@.¨ È* 4SÕ PP¢Û·ºBcɉì’7£³zFÉoë·}wj–/]ÃHlMN«ÓÜBˆBvÙ‘ÿjàÏNqƘޘÇãâWà u¾9#£_I»?eÇ )cJ¤M÷.e›‰‰HÏlÁ¶’E†~?ªB\0X956ðü•ë#ù0——zÐ+”9X¤‹(>ß™±­X{^[¢È(ñÌ®e‡ÀSð¥]3˜œtæ€@µ"áøˆÀŸÂíìÊ…×w2µ ¬ y<û‚£ëY߈9ëˆÉgúvÇ3ã8]Wçó´“ÓKÆ<$X6º}ªžÊ+¹ö°1¡h>ú®gÅp„‹ðð:\â"¾è F7Ù‘Ág 1°QCêÅ!—’ñSÉg×òÒbžLƒ™#h!Ë—Kùn€MÅNÈí¿­“ÿB™•Øª`夿Œ(¸º) Ö´Obùt@ὓt­@­*¼¶—'¨Ï«‹@ãM=ôq0Êǧ9´çŠ*Œ] ?bL]’ü¼»‰Ã>ú÷â?¼·úÌ/ÉÓ)QÎÖ•F©:„h+…¹᥂8±°K£ÈO­’w|v%d¯ ¢ÔEûW‰:½#xþÔEl…Šö’)ùÓL'$¾Á®’ k@Ö Áky‡PJpëèTx·¤ع½7}ÝØ> u°· €W/s Dñ†¿Ç}ìßJÝU§wD;ÿ‹†÷ÁJÆugzu&§! €È·JK‚¬œ<ª FFrK[ny u/•n¡N!ßmÁŸF•ž4>Åž} ’I©è¯Š(9'F“gúTHÉ8¸qÑ&BÖQ9†ûZqr¶÷ðÿ­å M4ÐÀ`ñA‚kPSG8 0+ MÃ+€ÁȱTS †ýyqÜç$ȨÞpÊœ­õë)ú×?è h‘Œó6÷¸B•ÿ–wì$TåL0ìÅßÒ#‚ÅY ˆ !B Ó«òÐQÌiÀ½‡íø- ©MG?±6æÕÂ˹ÓÖòdcl9ä¼’̈z4/d­ÛÒ©Í„š¼…ב<]gO4ˆ"DeM15pê Ñ­n 64?.:èôŽæãüšŠ³*uTб…Òff1ï0×$~^k\ö 2Á›;¹¹¨`¥bu¦4 °RÃ?ê!ÄøØ{™ÌÇ…XÁ¶× ðx¸c%cV2rUื³pèj£À Vfv#ÚJE+{N„Ì”DP@'³D¢ ‘•3\oï NK*:À a¼Òéì#â"CI*§’gï¥Õ—<Ô“:ÍOŒ¨ Pߤˆ€Êž¾–GzÒºU:¤F¾àåf¼p`­—Wë3?>:Àu-]¦w+üYgGÁ6åpm]ÐÀÂôšHp†òy'PI?Å„åà ¢ŠÝJ çß6G^NW¶Â˜~ȱÿüýð§1d+)·±éòóÒ¯WÀ Ú’ÿcï¼ã«*Òÿÿ>ç¶ôF „Þ{'ô*½)Ò«tÔŸe×ýº–]uuí**U”¥ˆÒ;PzOBBzHH½åÌܛÜ¢X–=Ÿ¯—ד9Sž™yÎ3ÏÌgÞJúÄ8þ¹ƒÁá|7†“c ïHËýthÏËA,Mâ»'8Ñ0€‘IÛ©ß”„ DMeº‘;Š5&Y;ÇñB¥Òêm–1HËþ<®Ïæ5ˆN¡R1ãÔͲ•ÜGúÓ4Pøô:ØÙ1Ž·«XŽÀl’dŒ&A¤]-^Ä’S›¤+(쩤bKAb¯Ó¨! ý*¡ÍØ|^3ï²Éƒ–9¤Ë…‚ºÑVpp|ø’x•/SÈ~š3c™ã_ø±­²‰÷‡9’ŒÙdEó^J#O>“#ÉÇç¹%qàg.z“=™kSÙ¡¾n”U‹úûõ f1ž¸þü| `dwÎwsAQIý;vÇofÚä¢K]£Áňe,î>'F³k­ ÷a™òƒV´I†,îæ‡ D!{ýIuðö^BÚpi w§±ìJ‡{“—Îä‹DÌàúD.õ O`–ÈŽæùK$>Éù18&cÊI*lÔý9Ýν„S’éyŠ+“0*Tþׇ7ž´§ùKu.ÝUý>[¯P#g ôûéô÷ < lM¦k%ÖEƒ/DÆDNä‹`BÖ«+µ½&^ú™m¹;…ŒI|z™œLª„ fpn4b Ÿî!N¡G¢‡üa;SÒ{gÄ‹G]Ík1É™µ³sù¦¿ÉåÀ‹éݨE ²jJ+ÿ¯? ƒ]£h9Ô­Œ k/šµ1eÕžçÉU+–”Ò0¤ÕÁûtš/#2 „S>yZ­ìZÓœ3ÌO`ÐôHžS“óS:çctò.åjÖ~ Ô•Cžš¹—ì,‘pŒCúB+"_†’VyŠI[ Éx@N.ÈThBb3¤ÕÚi £¶L°kž©ü©iÓ:"¿Ú§&XT{J]O?³*‚òž%â7>ìšäq’­³ÐŠ'(¦ÁÕs—{+D«Sslšp„j¤»H8_æù½lÕþT vØ´!áÜùƒ¼ Îœ ¥Å)\â:H[qÊÇ® ÜT¸´Äñ> É2¹N(çW,…ËÕåV ™"³£ Q’º£ªV×Ê+MÒèF-»]^K%TÑTêë–b?ÌN_+CÉ/š‹½xÏ”F§ÖXŠURrW+s M¶”ð[*ùO¸ÊÇ\,™‰¬)Ì\Ϫ;ŒiÍí4§æ›î-mÏ ²†SïlüÊWÇ‹}î‹SmMîª]ðÛ¿áXÌ IDATð»lO÷ ZîÏyX|°yÜGqæšo*uܚ݉ÝRòÈwªs‡.<{¶äñ);ý6m¬¯…úvž,c +òJñ.¶”Ü(C± ”Á[ûÇž»ù¯E®ãOŽÝ†ï*&ö"uc „¬.‹wV";™ú;Ø6‚ÔIœ>Óÿà-ùýräûr~Q_˜HœŒß-züêÊb‹©‡ ¢¬]¿W}~A•D±OèŸOÚnS:þ[糘z¸>>O}t[FœÿýÝë]“[qn4—G² ¥ ©äÞP×–u¡eßl`czÂGsyŸ4ÿEþsÛýVrHvvü¥;‚ ;ç±reyÝQF1>PøKW>mZLJv§'Ö2æéIîx<ß:ÜÑe¹<ÀuÞħºT¬iÖ¶cûC…/¨\“ëÄž·B×æéö²’ÝÌy™3x%˜Â±KuÄ,ڙʩ…J–²ë#±Oòb9ž cÄ>üj#fã–;«gPßQê2Dƒ·…Ê¿ø̙ċù)½ ­kÝšÿ¤â»àAsч3F0Ì[ýº$ÍÁßQ¶kñ~@–‹OÙ—±‚½‹- ¬\˜CE;Bª;ü—v÷$F#Õ½LVfªz>€jËÅ'ÒÒñxܤîVvÆs.…ëyã +«›¬ÿêFØ`†:)o;²c0_…bÖ†ŽC¡CCö fQ›Bbn§ºlȆžÔr§DVŽ‡(lgw<çR˜²Žw¢è¬6ãåNìÂòX4†ôš~„x½+2-l<×ÇÌ|û8OûR»6kZ0£=»ó¹Úfæ?Âþ!¼ß¬èggÆ#,®ç*,/waTæuäç!¼ROÝìß=‹‰ ƒ¨fbvsZX4˜~¾šä<82(¼Ð½ƒYÑPµ?4§C]Öwo¾îÅžþŒ­øð+ ›>M ÌÇÍA¡k'Þ©À?úðQ–?JyØ9œvF¦µã™jLmÇOCx»1¥{øe3Ëû²½­…]Ö­>òCª ]ÿîNØ >m«uº B%Ö `M§_–õfW†•W{Ä»2{Ú3¨)?u/Ñʶ:øwOvb¨?ØX0„ú°y8ck°·+lï»b€Å}Ù?¾%ô¸ ZMÖ·dj;öv‡Kú6W€:•XÓE½i y vöQÞ]Z²¨^É£HP«;±¦ &¡6¶jE¾ëËŽ¾ôòwò»•gÍö`N5Mø65a×^kàD1wп1[±¶AùZß—£½¨^‘ýïm¿U7²É^ô;àD?3òú>º1ÓIåoǹj!w¼Zѱ´œ"“¼ j‘mê2ÆÀk§iÝš]A0©»›ðñIÅr} ]\÷5 &Æ{Ðǵܗw²0àø4z8øëQ~VÈŽ$ºWæØH]dÚ1Þ̸ò|s ¼y€uYÍ oFƒ»¼u dM&=–—ŽâU“¤G]Pž¬bbjÄŠ$E3íCºñM=€^U9>’eçH¶Ñ9„êžd fÕSAë*Ô÷!Sfÿt)¼zœmYäLÅn²/•“1üåÁ'I¼và…ýDX©À{@,Ó~¦](Ûš”–ë¶A|ÁÚ$NNÓû±¥àëÛÜœJ; @üT‚’ùÛ b¼È£žsI|”m‘|EXuÔ«IÆH6Fòæy>ÆëÁ °x¤{ðÆ…÷o7ãØ5>¼Ä£iæÿΠÃ_÷³ó6_Ü$!ƒçN€D¯ªÄŒáëü¿3lK{ïuèЦ4ËæÍ«`"g×øÛIš7eOW®e2²¾zTíãPºÔÂSÁk 9Yòôöæ­`Þ>…¡»€Bû¦ÄôãÛs¼{™ïG3;^$ ãû^=ÃÓ}x§6(ŒïÌÚ¦üã—=ØÐPÍðùGYYwŽóm2)3¨o‰vµù¼ož½÷F·±Èà0@åpueTçӷĤ {q6'`›àÿjÐu9áyìŒ!½9Á&€˜ž‰q‡¹Ô"ù¢. ¿æFÜäõê<Û”ŸŽžj3A­+WP«ms‘‚™Ã‰¼Ý’‰^¬È˜¿‡‰ °5ö•ùî @d 2¾ #/œÐ Ïþ ŽngÖZ99YÆ ©¨¤„`ßEVÅÌÜÇÞvpà‹ ü©ªIæõÒ»ÃQ˜ÒžGAbÜjbSÀé6‡R׃SÙÄY±äpå_<ʺ0ÖDÔþe(//þ£yþˆ¼Áß"fždC#î^'¢Òˆ¶Â€sÉdƒœ½Å’[wÝ"Kô§¾°™c@"_·¥’D¼Ä絩ú% 6ˆáßµ˜Ûˆ‰g Õ†kx&ïŽA‚ѽH»ÀÒ(™s-ÁÎ?º³hëo€ Ñ&Òðúr xðÜqî–Lküxë²Aáj'ù²& <™W³É³rA;]õÚFg¬Kcv5Žº;Ç ( Ï…ƒ25VróF^çrS8À1#}=Ø-ÑSâÃ,š›8l£™Ï$•XCadÜ øù'lÀ>ìÀ3›Ù ‚nfvöâ³uäeQu±w1Y˜y•Í5øëE¦7ãÍ­L€8š4f2̼_ãB@ «2½:/%‚Ä+Û9-•UÝH*ÌS"]¸®Ê$p0±=oÕåT’j™ÀfÀîh‡—W¿Õ)éªrsQd0!ÃÉ (ÀÏ“økø0µAzßÅx@v±Õ`c?ÒÒµš + RÕM¸Fö±Û y…ý§]þðhŽiÿÉ!Úù8]¹`pï¹®}42rðÓ¸Ôr]Re\#¢?cYåài|/‚‘^ÍXÞœðd2Qvɶ«µ;Øòy€LŽ‡ÕÀ‘¸•¡„ÿ„:ºü=‰É;S:ðF—áÚ7£š;¯šÒ¡žTîÊ°.²ŒlÑ,ì\²Ei[Hœ®%°”êOúY¨çr™èSÂ5€ 2ÔcÌ(¼Ý›‘œMÇ`A±¼É_p,Ž¬8>¸ÆÒêô‹'8‹È¼Ol m”ÛsA™ÚFÞìÏ+Àd$@"ñÍ£´2r)/_äÛ*Åü3b~4†É¾˜Ì ¸=UÍ3È“³pÉîî,å=Ô Ø$Kü³ 3nšÕ+ÓÌJTo… }f° &«KA+˜ (‘ö4œ‚Õ—­]_†Æµh_;¤ÞeÅ îH¼Y…Ù· Ë­Bƒ\Òmx;]¤,~Ÿ[<Ú‚3ÞFE­%ü!ç>ÿ™ …?¬Úø°‰¢îÆå—ט›w‰Ž%Óˆ¯/Ë›â½lì$ÍuÕž‚4xg=o$;=·<ÔÛ¢R‘ÿ–æÚT…*«Šãþ—l/Æá(ÜvhÝŒ7‚ÕájðÂ> vk³Â×KMœó×2?͵Gå-s½´å®×kˆS1ÆŽñK0R·WšƒÌ±k|Ö‰f,;F\}GÒ'ŽMÇKµ)¤¢ùçÁôïØ’Y¸/„™·FRï&û@¦÷#l6 ¼4²…¿ Ú"¿Ö&c>“#P÷¿hgJ¡mÓ0ª’v‚8ò(‚ð1’•¥*¨ñùw‚쌨¤RQÅlº»=Êã ÞÁ“ÕÁFƵ£K9"o1v÷ñÌ P=À¬A «¨rC*rl¡ü‡¹" Œà@ö$þXj׊¢ê†S«%Þ€ƒàš ÖeþÝÏ“ îî…{¬šJZéZ—„;%vçü ®Îð¦|s Àh…lÛSÞ‰å!ƒÂ7Wy¢‹zA¥ê<×€ÿ5ðsÚB–Uwª¬ ¼cC²Ëtß—dÁ“UÕÑ5¹=íñ5‘‘©~öŸh¯Æ¦^}ömÔ]ê—ó¯ X{ƒÉÔ©Q‹9õŠV·¦?þ÷Mø0å_K 0:]KðaCPÀA¾¿ë>BÌœWy*¯6V9ë7R(ïÇ« y;ldùða-•;~ÿš_2Ó[ªôˆV ™T Š…S·T^ÕGU1˜@áÔúÖ;x³&òòÈ•¬Êy^û”­ëÝp¦n\¢¿Ë°Ú `µòÑþï XHïLêx²žgÎÒæg®8ˆ{’É?€Ì…lîN纕æz®¼_‹O$ª¯çúcü=ÙÏ»Ô:Cê%²Ú“<žv°üqR/ó\¸Ó+B#¸a¢ãĽ."%£öÛ¬%“4žnµW~XVRnI ýâ<õ›‰¡ÄüÆ@š¥0ìˆk¹5Š³Û)at9Á †«âÔ;6­kŠ“­•Â íJ…ß)VÒ¯%ȈéÔøŠ›y÷ùÎ3WºÕµf§¥p»3T\/cp¸6V¸^'`Õʵk÷=PÌ…–-Z3…“ËlÝ”þC Kï@’þwǪѽ²´1>”gêâ¡°ë*ÏŸ.»^²–Ý=asõ•þÕǃ ÃnH I¼³™¥™TÊEœŽ÷ƒü›O5·â¨P:¥ò™ƒé¾ßµnÎ)KƒƒÙ}š·ue§ãá„{FøÕ¼U…·Žðä!Ê×A̤M™ÙKgÐØQ¶ ?w ý,E<~q‚ û½››>ܺĄ}ŒßËæ{“1£(Ã+}{óf­¶æ´aMÞÔõ)šò‘|ÐྈQÕ} 2écRÇÿŽº‘ørþ±ÔÜĆ[I`ÒZÞŠâ‘õ,Ö3íØÒŸE¡XìꓯzRÍÈ ÙÞ—É!`cÆ#Œ¶ðÅ`fû©»×owfs_žÊ'›*<ÓŽ¡AŒmÅŽþüµ8x¤#¯—ã½y³’Ër÷ÆN$q&‘dAJ'9“Æ¢^…áâ AèÙ‡}=ðòfMÖõ –Th2ô¨Ïš~|Ó™r’úä­¾L*ï$ÛlL VaEoÖô ¹'šÖ`Ygµ±x²i­šóu-F¶bQ#P ˆ®Ù²( j²±‹BAP· KëòXs¾jžìí‰Éƒ5ýø¶3F;õj°eï5+ÊGµ7Ó*êƒSÇînd3¼éætÄÄ+»x/ l #L¼–sr§cÌÿÎW㧑\â…3¼?˜I؉',<ÆÆ, fì3HMäƒH¦õauPh^‘%ðKæÙãŒî΂œ¾ˆ +Ï°4íËT»†µx>Pÿÿב¼d¬&zÔgK'Þ:Êw¸>Y ³÷Ô6Ôgñ9¶f<ƒ†&³ìÒlEáí˯#C¡o{.tåû ¬ŒãÔDõ!"†vMx:àäàÂ5bóØw•b@¢g-ŽßR—K+ðZyDÒ¨)G[r3Š¨^çƒ Ó³ëÛó£Äpw¯Iå ì¸Éª,K`Vmyq K“\2<™ DZÛø²%ý6³!šáŒ?Í«ÁAÇ5,IÛfÔHà_ñäf’bçV:3ÁÁàZl¿¨f•icÜqvÞ䱃´kŒ5“$;±\ÔŸÏï%"ÏNbôàÉp.¤ð·X¦8ÛtF^ÙÊ× úàÔñ°Á=#Ü£8#ø’‘QÈÌþÙÁ@–Þ‰sOÚnWÃ`d%*[4wouHÄd© ò¬H—ÕD›ê´ð8ÇÉ 7{7. t¥Š‰˜ êä²'Ê\´«ÇFOAO?þ“€«“Ôð¦å¼¹_ZÜñ|Å(óíP¬ùw,Yi HOet4Ç;áñ…ËIcO ¦þ-ÕÌÕ¨ð99`ps‚ô†2ŠC U,‘îPÃJÛ L½º»ƒT‰W+ó´3»JEظëÀËI/T4¥”n…ÄÛغ“Ç£žÞkǪe5†x¡HØïr2Ã}š3x· á-xç`¡‰fVÃŽSNXU-²¤hlæÒ+- ë7\ÌÓ^ÑB\T›ƒ¼W“y7\Þ¬Ž×mùáN,÷÷T‡Ž‡Úw“ÏÌž=ˆG+ )à È—ÃCéWãñËSß FáëÿN(M×x‚Î2´‡×Ù\ž—š•8µøH Xü3Cw1l'+âJ˜´‚ç·0¶ æk§4S‚Á^´‚åw°[ɆQUë´4öA 'Þr±É.cW@p>›©õÕWz6¥_0(<õ)趆Ùý©mÒ(ÂuX}³´K RÞ?=ñ‘õÁ©ãa·n¸~!¾,” #€ÝÆ‚0þr O>c ´«Ì¶Sœ³C>7Z›ðr> ÕƦAZZžàÚ(,ß±)•EýèžÛ5Y¶FåªIR!^­§ÄÖ–ö¢o šrù‹3i>ÿ·AVR&±‹ÙQúøÔñP¡dCïSvef;\CSãz<¯àH[3[vå›Êe\r" ç/sœ‰ÂÅQe\[zœ™ÂËëÙ–ï+ DŒ@Z %p>.èp" 's´Ëî”ÆáÄJ—jˆ/¼ ±Î—S*9X8µ×™‚ìpÍÇ µQ"´ #Sy)þ¿j(éaít”Ùº)4'ÜM{ÉÝn©áί—ÂƦÒ*¥•b4н5-ììJwµƒÜÇ‹7Äì®]¦’_)Â,wKÏ-žRÖ4šsææbu–†IU¬ó0o­Î0Ññ¿£nþĸ>[>ߺ^YøÐœT11q½®ktèêæÏa´W_TLŤ"-zˆ.‘ÑùéÐÕÍŸw*êóS‡Ž‡AÝ(¼Ú¼XÞ½öÛÌêÒ/<Þœ1ÞŒ>\xhLožH`Ba­q•Ì”ï ‰Näñü8–ê6§ÊÊÌÚΑL—FU æ«öT3ñÙ1¾¼¥+,:þ êFPÃœ”²+é¾’•'¦Þ«Kr\ò mÀÑŽtÜBžo‡Òsc¯êG‡Žß_Ý8Ú”‘!\‰çõpõ™ÕN¯FÊ-ÞbpcFU!/‡OŽaU÷˜ç¶£KÇoðþ¼ËñCdO¾íÉø}E£wCi‡€í9ÈG-#Çnn I•Ä’¢µ8ЀMÁ€ýD‡2îª~²W‡Žßnή¾1”Oj°áµH¬ž@ÊãVE3§'ŸVøa2³ýXy™k29SðË“]‰/úás‡°TïÎâÚ¬½Ì¾;„O¡† \™E¨`ñeÚ· ¼7Y™¬‰çn.ŸœÇ`FÌqý7ûoÒè ñ4®y`gt}.éºF‡ŽßÛºM¼Z Ÿ/É’Xsøvø@pñsNˆ`>jÌÜXžû‘èdð€hþÚ‚¦^ÊDQ¸Íÿ…ƒ`~-NŸdÓ50²õ:wítéFÝXê#;o!fPs§ï`µq,@ú´XÑf“€uxJ ,É|wt¥Pݬ=Ê QˆY¤DßWÈQ:t<ÈŔɌk¾ÃÀ¿Nª^˜Kê9ýÜ\ðA“ÚDåFY*¡…è–¸vW=¼ÿÊ‚èÌÚH¾ˆdoWBø5¥ð2Ð>\v.ÞàNsü"T.Ok¡ºY‘µñ¬½ÂŽ TXF²¯†p²mé¾:~_u£(Z;Æfô÷å“ÞîÏY2 /7à_g Ë à°R~Q1µaaó Ú0,€õw@¢FEÆ[hZVú¢Ìð-…ÙFfÓ®„ƒDÕ`$E÷ÝèÐñ»[7ÂA­=\GJ:Uýød—íÈ’d‰¬,®;ÈÃU#‘ìMcÕ z¬E–4ç³Âq+·Ÿät^¾„8žLv<6àî“J$´ߟ™[w¨DäHš¬Cx¸©bN"m÷²ßl6þ¾…ó¶ÂµK,dmM&—Úè—wpó1’›sZy2f¡/¦tèøm᎞¿†ZTvI‹©,«zDåv+N´iE È­8¥,È•è¬>tè--ưíês…CËJ.¦KÅü>ÅcȇâDy×/—ùõÐá:ÊjݨŠ ˆË¶Ñ™b³´€Bm(5Jˆ1|?T CYþt?ÛLº–Ñ¡ã÷…>átèС«:tèêF‡:º²¸‡cKozú–zÖÎVò¥ßžjÍž!ìèÇœšC÷þÀÅA¸†1rú1¼½×tèx8Ô c(©# »ÊKGYÃαü¿ê%hÁÈǘV®Ø_þþ¤<Ŭ –D°è “z4ï2í4›iìš³ÂäéÛÕ:t<$êFbqk^YÍ7ÑüÏú‹tØEšCížÞü£=_væ4mÆû!LjËß«ºêÁšá\ §Åv¾½Îúk„.æ¼à_µÌçÚ²´;iàDw0¬_wãýÖŠ¢¹Õ¯Âgí@Ð+£PÃõ>ךÅÝx¢ŠºG^+„/[—݆ҡCÇhݬH楞´ó+(œ¼ÎÒX€ªUÈOZ*{Sø~4Oqë(ºÁFWJ¥}<~P;ü"‘«Ø”‚›Óé$³>š† H¦*‹ù#™_‹í7¸i"u&Uv²ËWà ¾9 &&7Â,À@ÖLjÚÙx‹gú²¦9<,4ñÓ;T‡Ž?/ÜÄ™zg5ûph Øq•åWX o?Â’½|t;3I̤ Î'r6ËéL ’/äX$gÚu Z2Õ›b™<•NÎx37ËXÅÄz\ÊðÕÎ+d‡è‹ý2Ïœ‰ qˆ'<Ç…kt¾ª‡»Õ¡ã¿HÝ2Oíâ©-T®Ä“ù´?³ÎÑí':zS.”nm dOžTÍr4óF@\:7íî2+p)FS yDBO¢L(6¬§ü•>þ¼š‚s£9p†ï¸_KW&ä¯ðê[8ª3,uèøoR7$*z‘˜ ܾÇxãâ1ØO6|ò œi֖Ÿê27„]å•«`bJK³ s®WGivüœJ~`8”BNhÀ.Tƒè³C|Ú¡ø1«0AŠ}a ¸êTmñ¤CÇ—ïFB60±A¥HЯÜXËøP0™Š! «ªÎtO@ðÝQ:n¤ËF^‰„&]ä«QÔ¶¨ùTðçÒ š{±ü •ã#@Á«"Uai*)Y`¦I-±¿ŸçG·± ‚ûùa'ð6¨> IDAT‡áôï†Á f¤žj ƒL€ Ù­CÇÍbJ±ã½ž¸¡|g$:“š>Xz®ÞØÍɩΉ\ºøÓç€-,ÁÔ:r¡P­£¦'‘O`‘l6žYÏiÌü†¤Maw }ª0?ŒDäÒäg¦r0†6ÕHºÎª$¨¤,GÏórM"¥ÎN5ûÈSìh„}:{“èQ™·w‚Dû¦üÜi¥N‡Ž?)J`„;oEË.n`ÕYR„ö-¹;0èœOé™8'–´ÂéJ­üßr±'8¥/ ªëøC 3Âu”Õº)œÀîµS±ù,•<Ã¥’CÐî#±äe¼ã¼x&:C‡Žÿ&ß:tèêF‡ººÑ¡C‡Žû‚ßÍÇi„zÆšÇüãìH‰ux³!B»4*ŽqÉðlWºD.ývÈêÎ.Nß\:îràE6²µ#¶‘©¨Jv'“øæ<—òÊx²F€‰µ}ðO£ïawï*ø—çÓÖYÎ×a­ôiÂÓu‰I`î±’÷¹¬ hÊSuˆŽç™ãêÅ©î3ÄMÑ>A,hCˆ™ïÃY‚/z³ö{Ò\|êÞ>¬îAV£O—•—ÛÒ+ˆ•gY{/ jVá³Æ ÜåšR°ažNT{“B¯Íxð}W—Ãœ~ytØ©ûãu<8uÓ¾*™Çø8 ü}Ø2š·vñÚu*øÐÖ‹Gñ$êTââ4:/çP.M*Q%™¿Ff§ØAÂl¢We†ï-Û²­D‹J’è[“Ф!‰<…‰:å¸8™µgu¤lÖØ߇Ó"ŽWÝO¼u8Ó‡©»I—Y>ˆ¶;x*ïa¼‰ÙçÐŒ;°ÑÝìRøx(Ca^¶$9˜ò›iQÏ]†’›¢ÖäB¦í! – ¤Ý.¦]¥Se~2-å£^à­%´ÐDò6aþ%æ¦Õž‰-U"ÂcÎqÁ½¯íU?€$2&#}ª0bBÛ¦”íúqJTÝQ l‰Sw£oùÊk—²óØ}C›óQT¯ÃºV„ˆOaÓuWu (‚£\ǨÖbE‹–™ÆŽü²®òÁy²'ðâUÞKqGÜ å‚˜]?øöþ…kº•»Y™ÒRà€^5©¦}$v~¼¡®p‡×*üÖdg°-Y_Oéx êföãÌÖ~Ÿ¡½æjõöæ¥æÈþ¾´4àÿÚÈÛqþ§œ¢AÍ[–yªQaÎé7ÙžtY\ái&/ÿ`±»wX¨×•) €‡™ ÉÅ‚ÃÌù H €.ެɅ ó±°q(—ºÑà'$ò¡ÜR0òÞ9Ä º™XŽý{U[ïË£ å|(¿ Œ¼Ž˜NaŠ› ±1®-§kr;Ɉ=³p¶Wž)€ãZê„Ä.ø~=“šA.M°;x±;ãÊŸ‡ÑŒ ;¯2é À7·‰ÂûKpØy® “‚¹‹Á ·ÁÁGýY¾›+ &Eõ atñI9à±dh%Úsø1ZU7O:ußÝ[lKÒÕŽªn¬gnÁ6‡IýI©ôÛ 2#Ö©4ñàpžæµ4‚Åuq&ÔyÒw‹ëUØ=‘FNc]Vh»’øRªé`Tsb®âíÃõÇ]î/öÌ#è[0cÛ²œüNΠ4çNÑú¤S5,Tó'ã.éäåÐo-Ê4|q&µd6" ‘'‰‚@“Ö"§nƒOáNÖE¨ëÉ5ƒ› õáE/¤`¤fC¢ZTõ#ó.w<°å0h Ê …±@-2Ù®«Ë‡óè ‹@¦cWø‚DLö<ÕÅ–•‰Y<;ŒQ™È_€Lh'ŽAež­ÌY ‘m `"b ¡kÉ‘\Ü_óv¸úndE¡ßVÝw£ã·T7˜Kûˆ9l´8FøX¾Æ*4Ý"\¯I—J,³÷r7îÞ"‹©Â <ÞŽ"Ë@ð7K­iŒn¶3µƒ©žGXzáß?‹äïíñˆ WOÕâ‹HÞ|œšçè~ vu$° bÎcíD;/Žå`©HSØrkÿh ›AbÛLâ·0%{Zyr:J4„©¼÷¤› yqôºj‘=_!W‡Ò<’ǪÕ@‚<‚ÉUXx :™á"ÀæÞì:ªv×ÕQÒÁÀÖhÖá©H€vu¹“¥¦Ü}Rµ\Þ­’ñHŸj¹ù#FÒt%x`2`dë×­êøÕM‰|)ÉéOg¸Ù†õõ|  W;ÒÚ&0I„.&µ¤ÜŠíCå@÷jËÍfxX¨`žG«å¤KxÆo'a,É ¹(èìGÇ¥.‰`y#r¦³+ž®UÙr‚/ŒÌý‘ôQˆP’씓˜¼JóŸåè$â²ñfÑAn™Xv€ù“Ó¹ åmÄ`D§&›Eo> #Ñì>Ã×òÊpÂBh]Ù»˜Ó—»2|=ö±ˆÖ$Ù)/1c59YætEn&Ú@/,©ðÌ˳{HÀÆhÕ$t;'û³¤)S3n"b&q6*ê-xn)ƒØ|ƒþ5è²ÃýYÞ‚IªUâm*4ý^Á‹±,µÓõ)¢ãÁ¡#\”<ÐD±çOD CU”eÌŠb/–ià‹b‰E±ßn/B”üäþ“/E*YbR©ïJÅ*PÒsJ.±¤.“JèÜÒƒ;ùëŒpe´nJXRÉOÈÇQúu_U©ìJ¿(«_“Lú¥ïJe‘|) ¿g†ºm£ã7ƒî÷Ó¡C‡®ntèÐñ/¦J¢LÅÔTž;o‹XÁâj–[A{—WxxGõ#Ø´;ýLš÷!ÏUsšKHYPùüëþœOîØÀá®2rn\/ÈÓ¨çÈ? )¹ $¿Vfwš<¿æbOŸŸó=EdÕJ/ÈÊÍ\¼æÅ…)¹nA*ÅúKhŒ£ÎÌÔñ;Z7ËGÌEÌåç¾®žDÌ+úo˜™JóØZ×I9øÏhÄ<ê–ÂZpУ1Ö¹ìo¯í¬+4®MÂ,Ä\ÄÖ¶Vç­˜‡˜‹2e.‰ƒÁ õjp[KùC[u~Ø11Ç ž Q'’Å—ËÓsÝnÞñ Ïø©¥wmAúlÄ<Ò'Ò z{r|’Zsý5Eìà™îˆy¼í.ñ´nÜ~Ìõ¬€ÄEúœ+XYG3@ì` Ñ×H ‘>æÌ]‹´i!ë­bg@w§¸.2ÈstEЪ‹ªóe<ö‚DÞœïÃì5HŸáñ#B©f/°#-@þ ù3*nxr¹?Ï­Cú ÓJkCõÚò\>_ - óI>lø’;–—ðÙÝHå@ÂØÚÓv)ÒB¿ÄGÍÀÁÑ‘\:‡´és+³¢8xv]³ø©Ô¦v…w‡\„ƒÖðw2çÖ!¹TÕlÊÏ¡¼s{A†&Ò†òþ¤Ï–Ò¶=ýñ¬Æ—Íi²i#Ïsl80ZˆéÇ”5HŸ!-¡~#ú‚°éܺ@Ú)JAP9þUËgH xï.BK­“e[L dSê¹|˜ ¾:ÏŒf|µQ]½¾ŸÈÞÅ»OòB†ý…ö¼ÌFí@ž»45rÎб=ÇÏÐ6 À—QU´Rùß×<–Gw•‰ü}§ç 6ºýÈÁt0‘—P^æ–äi SVM}ƒƒ®ø) Lس± Ê8A¥²$0q$Ú# lÙø~†g…bÛ/vŽdÁöU[ѵ®q%öe¯ 23w• fp°/†N~ ³ö§ÖÆE¤Se‰éûû@’ Ï¥w ߧÔoHnÖ:f&ÖÆá$"ÙÎâ«dÄÎÈŽ… .I¡óF%‚ òHË¥‚‰¡ ˆäŠ ÌìŒÀØžzpÅJ¥•$d ²¹“‡Ÿ ŒYE|&O÷.¬ù¬Þ9‚ÕFìãÓ)%AŸ4:”ïF–éPÑEÝx ¾º@k™´€vw³ñ”æobµõÞe gs[ª…êó· l ðõ¤SEõP²Zz+¢HH)ju9ìLT¹•«€ƒA~ ðŸGéSã·˜û3WòpØù)AMY>œ³b$ÚT¡¥?sšó{&ò¬äܸGê6d‚ÿ+lÐÔMhn_àäxZp3Λ¸åàLÁ´óäÿÕeÆ· ›æfóxãÏt”Kµ#%FŸádk¾ß Ï5æË£<_Àl¢cEìé`ÉRÓÁàÒMBáP¼êÒ²”§†?¥S;‡JÀZº{s%—„,d3ãjÑ¡6I·Ù’ 2ñ¹EwЇú³»€Z’K:T1“`ÕgŽ¢n$ìvft“ÊR´E‡]QÇel*±ÜûtƱcT›†ÏQ2-t4–¢¾“ÈäD7s¯_uª\D·%ØžðS&`L„ËÃ1®À¡¹'j†5„G–‘£Õ¶CU”ÃîÚJ[6žéAèr·h%3›áõ5ÈÌ@ÌãÖ¡£ácùöë3K<º’’Aʽ¤tá¶ÙÔ ãŠà©ŠHQ¼@FS”e,¨PŽÄŒZEœ¸Ã$Î䫶,K`f²À¢µË`fD-jøq=¦ÄºyÃ-›‹ïÞ¨»ot<ÀÅ”$Ó4Ðå³)+œK"ª›9” àaD)ÓÞÁA+ù":òíÂÙb1ÓÀÇÕsjç|z £_¡S#~îL˯9«€Ä­Ët½¤æöÏ<ý4“ýYœ‚ÐúëJÛÅœ´k!¨$c¡ b2¿äŒ»¹úÙH~8„Õ‹:f|$*ûQ1›Ûy\ˆ, ã³iHuàãGÜX>ØÉ×퉳Ìú&TeO0‡Îv‹Á@W"šƒð;%ˆHP¯—ûÓg»µ{ˆ‚—±¨ïTaÖ>†Nàl–ÊD³e1t;ØØ3‰·nó|”›<£¡¹§C _ÈÔ±ëx€‹)“‰õ}\ÔŸB••ìL£G þsµªr'³Ð;s?ô‚¡‰kORƒÂ 7hk‡°¹¹Î‹©lêmtLj4¯ÏÏ¡˜¾À®ív—÷£šƒÓYêf°?$ÛAШ6Ç:`Y„UÛ/ŸÛ‹N±Œ½2ä-¼8“íF£Õ³Q£;š! ²L³dæk5#ƒ]€…¸±LZÍwî¥kî'Ž°ÄŒÃØÚÒƃOwŠ4À—}]Ö›>vª¯ÅîŽbR!˜Ë})ÿ%)A»dª™¹ À¿"¾V~²áÈñ4X£Êíšö>î+õéeV4gænc<×óôípn1eµRou±Tފ⮇;0v@÷¦´K罘{kœÔ+äô¤êÎå–u!šêÑnûš1IxɘŒx{`PÈ9û–à§Ý>—cÅ\…SÝè´Š ¹¼=ØžDö¡ëR|| S~u‰ùƒY•ÌL¦t¡\+Ò1zàg$È è©yôÙ UÂʆ§Ø¹‘…w1yQ½-Ó˳>‹õc‰Š Ãξ±,ÜÍÞ\‚< é6-êÁ/3AäZÉVhZ›QF^½¤Z+žxiHSr<Ô78Û—AV§Ê3å5ÿãF7y™ðñ5¨Zwn eð7O‚ò×>6²d¢'0n[³Ø<˜MgÁHF•ÙÒŠ'.àȤ@FÆ‚D…l2øY’ÈÊc÷!'ÑןyDäýíäê‹)к) Ñש‘Åæáø[鹂0+@§F<Ã{1…ɬ—m סÎ%wˆÙ¯š¹¥~ò7 §“B *’Üœˆ« ½öN*LóïyíUÓÙ8ˆæÞ|Ï#` fEp°ë‰Â”mäo±ÿÈŽþ4±MÀ „‘® ØÞl‚¸ d¾&[¸´%ßGk˼œ½C™oá«Cô¸PËB‡ž<«%¾t“–»¹6 OÂN«ÁÌ%Ûx:–Æ5yÎÈ«p(T®Lê„Â5¦ïR웢vÅâ[4Š(ä–²é,x¯Ó+£¤N$!…{°8X7®0Õʽ̸N¹µìȧ ¯ìæË› ÿ¯øº?1mˆN¥ÿ·ìË ·&!9v óÌ·|ž…q)ÛêÉ_6òu¢Î¢Òñ«à.Føý, J¢—Ä?.þ[úu«JàC‹ûHI©,vJ®ü= *¥è’hî¿¿ˆ(‹4D ÂqW%®ãÁX7îGÛ=ŸH÷ñû~ ú5U*kÊû¬ð/¨d™ØÛ¿ˆ~¥Ütèø¥Ð×â:tèÐÕ:þ‡SE8Ùh ãù‹ còæØZú,>ÌôsEý¯µ«²¦3mÔ{®ÒwŠ $ŽÏ£-T\LRóÐñ$goÐr{É~Ÿ?ÊSU°„ív7óù?C]…»v|\I⑸õ«Bñ sÙ Ýš²¿3ÍV‘ç¦ôýYkBÚâ>2:ˆ™…’2˜»‡Õ‰à‰˜IÀBÒ®ËðªMV?WEš„a ú±ÀgɈy.)—ž`êq×:Ræä*Õ—Öð^*‰ÏPÁµ¦w/ã·›#Søþ'Þ»¡ûtt<@u#xg8™Ôr½-aç öæ’§m lKÄa:F€7©SØx‹ý¬zŒ³ghuS9Âûa<‹°ª–ŽW0×ñÊÚ^“?_õÃ6ÃjÈÎå©rü3AÝÝ‚Ly¥Æä<=‹Õ{I®ât+F¾9cÁ»£ M@Z¨NÂχq¸Õ¶•`‰8½ .÷É¿GFÑl1©°ZÕggZ,#ÂVìãŸ&ì§ã*B3v\f™>Ã.@0¥ÿéÍêê–@3RL “…TЃ„鼸 Ø- Bþõ4š‰ò· ð©@Âh"£x?¬`˜)·°PeOêÅ[¼— 2y0oŸf¸ÚG¹vlÂÉz2ëËq¿Òw#ðáÿYøG¬Ó·ÐÁ¤n¤œgMMc00ÄÂóWÁ VVÆ1«2܇)§@–FÃÿ`—‘Lˆ¹T5ºžì:Æ[WÀl¹LހǪÂ9<ÿÿè,T kV#Ö\ÄÚ×dl]—UL``Ð7¼sÙ©%‚rås‘”ÿÏÞyÇGU¥ÿÿ}ïÔô@è=ô*Ez¯J‘@]W×uu]»»–]QšRTD©‚ô¢ôÞ!HïÉÌÜóû#wÈL2 u_]Ïç5¯¼2wÎ}N™{>ó<Ï9Ïyb}ø9T&­ r(´ª\TZˆÊ«¸Ò`ç³ÇÙÔ4ÂBùe,i“y>ªpmXT©ÄÁ´ú‚Ã6Ðxq(:8ÓQiˆ©´ösYJÖèZ‡ô)dM$<£ÊöÚ×&0³êºÛO@³Ú¤NDLeYKç×eÖ‰{åP¶îfabÑŸŒ©¼©¿óqŠÍLâßIô®ÄTº4FL%Øà”f"ºókÑ|MaíV“óÓ‚—ûSxbdÎ_‰Õnâ{Q}åZN•À0æWF™Å«ÕDeÈsª?û³x7€Ð0ÄMž}”ç£ ?2û*ÂN‡UÜ´ƒƒª~¼|ÕÉr}+›BÀž@‚7õ¼ù5%ŒvY¼I}€&•hénœçZ>ñyNEÀ‰´t:þ€P@aÈ&nua[E>9ÇÁ[œJh4¯Dcw²=|™W–ÓÃp ˜1 ÊðæD?þ¼„y‰àƒÍןqÙÊöntýŠ]9ú¸ÍÙÊ›½a3(XÊA>{3èáâùg=ZÏâp>e*’Ø›óôO:F’©áeæ&<·­ðkyÁŸÀOÁ1–}Ür66®#2ñ=¨÷åöoÇ/ãøxï\+–_Pи ñGõ¯[Pf¸hjf~éÌàï mLu#èí²ƒfçU’œÚ£ÕŸÓ}èù³ä ’xº<Ó“•¹`'ÌEµù±;ƒ—¹9#UƒÛ$O°áe"ÈŒJÖvB7àFÖ VÍ"6ÇëÒK%˦ϙǛóeCýöŸrJÕžvW£èsœ—3ã0f/ýÞ[™á‰‹_±;Øt]ÿ(ñ"Êg¼Õ’gÓ(Cm–³#ƒ÷·xu—#ºpÁÌ#_ƒ‘êå Ìf3Ô8(xÜŸwRȃ]¸ÇØ*¬ÿU·5n%sÚÌ?feñfG¦¯Ç¦¸Ù} ¾¥C%ÆûâmFuŸSëbUÁ¨ák.Ö‘»Á¢ÛqáªîÒ ­ÀÜTë~ ªÂÂ!œÞÁ NÇŠm"ˆÖ0y¬>]³±/€q»]¾J[GðÃv¾M,$)Íb(o/~5¤|›ŽfòRVgÊé#ñ t# æƒ0ªl£²?áf̽éÙí;ý(£àC„•›6Õ¹ñ´º7×ÓIɇ,>¹²“Ø /‡2éVa ©yTö…TPùj7_m¹q…ùÛ€™ùx†ÃŒŠbÀ*7Я—óÃß}#\|YŽ;í¾`ãÅm¼¨A>S»²½Êç„ãç.íj:9$°]£v[²@Åß –wÖg¢=‰0‹îK‰ù‚3F²Fñb"o]ÓMƒw²§ ³–ñ´?aEŽ×ð&k›ñŸ h7ƒ¶ïRM=;…”>Ìg0¶·*œèÉÐ¥œsw«EWÆ’ËÅÕΠÒšàØi”C…“$ ×ÔF=J« ŒGݼÈ*ÌÝÌ»ÆóßÉõNûž%$î¨ÝT¬À¥¶÷0›)#8Äü|ÂCØ àgÅЖè³ÄîÆa*í ÑÕŸeçHHTÒ…pØèzjº… |ËôË…Î ÅVl²ù5‡±D\äÊNÇÇËÝécp›{ã`]Z ,㜜¯µfÆnÚA ÓñQ ¾‚7{ð¨ê&mè2vf3°•®òM0³ëðäq®gCõ¿#,Fò 8Ó¦çQm-×z²w?傱3X[ŠrƒD÷e²>µÈ»Jm %hjÇr¨ZœiôAØ2šÝ;XrËÝ\R8‰èŸ°¥Ýy¶fƒ‚ ¦m欣Д+>Jþa̦¼»^ÛVøóZ«\ëËw³KMë.!qºQ8|˜¨Ãú»íø2ƒ*@åOºg…WG¾ñ·@0â2úPf%aUèDÜ9°óŸvt¥ñfšÆP=Ÿ·RÀÈ«±¼{€LÁ»?0h,iCiµš‹6Ê—aEOÒ38­¹<ñ*ΰ·9ÓV»L*•)K˜âiøšÈTQÁË„¯B® £•—ë𷱕Iˆ¤ê÷Ü°c0±®+ÇÏ‘ibÜמÆÛok5‡K&ÄhæŸaW<§½YÖ€a'°XIF­Ï9áÂ#ñ—鵟øi ö<>Èá\}QTöÙL«cV±ø°±'6ätÌÜ)–Þ^´9íyþ÷z„vÊœÂÏE9Ê(p]9ÀFØ*Gà?Ç3Yed…ë½òi*~Îq¶;ÈÑ,&üLnwd8t¥)þ“Žs°áËå‰tß~ …‡ äã眇 IDAT‹ KÖ"šp~®2—DÀÈ3ËyörDz÷Öy ¢¨¼Ð€O!Ó&š. SM– Ú±›üiëõ§¶ ÄØ·‹œz,¹ B •‘h%e$ŠeÃ1(Œ^ÈJ+/Öã¥ý•î‹èQ‡õƒ©l!5“ì`ú¥–oœÈ”¸¤A=°±'ÞßQ}6ïv&±%Ù©4˜Ï‰|P]FFaÕ^ áÜ`Ê.•W×ðÌ@VæèæÕíö;ÎÈ2'ðËyêÌã•Þ\…y1ù‚‹£T—™K¢VtHx§ ‰c ¯"f „ˆŸtIìŽeÍO17…`¯¸]\}”>;±Á?ðÜ*òž‰V Ó)|ºãXKƒÒ¤’¸[”^JÞè{Jž}¹´qq ”~ˆ—(Mó/­º;vùnòy{ʽýÊ`z§éÑRS•+wjy) ÎK)|ÇÜêw#ö.“¾{dD¸Äýk7wL|eî鮾¿øé{Êç­€ bË;ÑÈãÑ;ɼ§~Ý}ðú†¹ßñ£Ìã.!éFâaáf2ÿÀÕtr*JHHºùo¦äæsJæE‘(ªçE®{01”z’¥„„„ÄýÑ¡iˆ©øÜ6òÙ5'Ëȱ’x¸tÙ°5•í±…ËÙ·ã€óÀ!MBBâ!Ñ ðö j4¤¹·û‚¨µSÙTOš„„ÄýÀ³«ØK¥Õ~öÂô5…h <· Rä IHH<<íøe?û,¼årIáh p‡3=¹knr;8JNjžëbWôîU<Í™¢Óèâ™÷˜X½ Ye‘¤é·Kšäï…ÄV»±óíp¾iüP÷æ8øs2ãÈ›‚˜Æ¥ÁÄ–L7f_þSjíF¾€˜Š˜ÊÎŽzþ\¯2ƒ˜†˜Ê†ŎÚÐHš†˜¦HÍìÆv‡ÂÇÝõ6녷п‡ïéU¼_Ë)ßÁ˜fˆiü=Àåv ëÓK®oã¤- ‰ß+ÝüÚçC¾sêÚ( r8¯ßþ›_¨z ZÀàN5GƒüÞ–“_jˆ¹ sÞ |–™(3xù:ûÇ:…hN v]`õò ®Pò t0¯'Ñ)(ÓQf’ÉÖf` y0¶¡Ì@™Oï¦<X”°²aêB”(Ó©¹†˜Úœé¬gÖ5¯|—ñ)rQ%¯Çš1Ìe:Ê 6úpµ>ìOÐU”é(ó܆!ààÅþ 6rgRv@cïPò΢LG™EH ¦×”/%~¿t#0x³|(9“q¼\Œï@öÝâבä`@L¡C 'Gc›ÂªÖ˜ØY4ŒEÀ1…îSPÅj x¥3"ÛNõ&\AUéZ..¯ná(‚š>œH$Ý¡çº^¸ eº~0ðŸZ!¦ Åqº/Q&ÊEsøVáÒà´…O0pX@eÎ ÂB@0`=½fÈåz6^nõ*H˜m!!…ö ‹¦µ?hԫȹqäÇ‘2œGüõô`ï(ÄÒ‡Ñܧèéñ.Òu=XÀÄ›?S& 4F1õ0XÀÆ'™Ü–ì¤Ûv÷®(üe3£ë©5×]&\žC$ñ;öÝ(ìÁžõx#7&r4‰9?Ñ},ïVåõ æF£~V€/ËS~88=‰Çϲà:Y6pè ËeX8XLàÉHþáƒò!¨<Úœ1ô(Ï×w›Z¾¯ðé1ÞÈ…¾<õ+'Ò8“f¨LŽBù<׋•M¨·•¡e™æO«Kðï¨ì¿ÛÀß²`)Ö8³Ü*¾T÷f{ò-?‘Mï2lwp¨Íç³7“èjœí‡2Ì\ÊëËhOX ®ÇgÙ.÷ž¹Áç»™­Y´LøC²M/p,“WCAp.±ØÏ–˷MGFVæÏ‹åZ¡Äï”n+ %S1ë“èWžå)ô[èO Ï.G8ó1Þ¥ûnW§1"”ñ.ÖÄí³O§Cy†E³9…æG:¬.Ö:$c™Å_[óNk¢üñRøK“ÐR¨¿Œ&¨äC¾Fí2Vƒr§DkT¾HòqÞJ,ÌaâãCÚp¦,ål¾KhX 3ù¦ ÜÌ fä^⼑ŠAd&’l¡»…^øÛyqå˜] Fƒ³ ëJl:Qõü–yN®M´áeºC??Æú]|.éFâw«ÝŒ›z;Ý‚£&ÊÛ7yÊ—^· çs¼s†Üȧ·µ¨!I”(0ùe¿å‡N|ê¯ f!gì”s·bQ˜±èí¼­ƒÆõ80¿Ù¨åHëÇÌýüp‹Ì»?`P€‰££8ý ®L‘8ˆ¡‹Y’0©#3«¬>LÏ]„Ô1ð~Õ¼°„ñK?}¾ggQ݇}—$|ŠÎ5‰“  ÜLnÀÀ÷è‘@Ô2PÁ†¼U’5€H+Éy¥åÕ2Z¹1’Ï7ñܹ2%ñ{¦› æ+² * õkòg3““ØÛšfÎc䜠¦•CYžgˆGªÔZ~:Ų} ‘+8?TOY? ã<Å’zžuéú‚ñϧ¡ 1F¦ue×âNŒ©êÉ[êQ=Q81†oÖóÊ¥B®ñ q•çpQÓ˲‘O68oWŠÊ4SÉʪdª¥“g§Â:08»¦á틪b(Phå}¹•EÙ™.ã-X9ó¯ÔøÅÙ·4¢¼¹š­ƒØVŠAgäæ(&}Ë’dÉ5¿kW±‚-Ÿ=°9P8=šqåÀÀövt_ÃÜm4¬Kog‚êï{aRÀHï æÄ{€ð 0”Imùµ#0`!?[6>Ÿã?¿ð¥,Äa ¬ kûÓÌT/=B¾ƒvödP'À+ˆIå1øëöHˆUç…^MøG%w…Kã£ÜÇ+—Qç~• C鹈KÂí¢¾ÁÇ©Ç) *¨*ë’;ˆ·VqÁÆ{•P!û8,v²³8e`KCThÚˆøA¨šSš4ú6¦ÆMºþªW§*Ožg{7¬ÉŸ+ñÞÏ ÜŽZÓkWŸ†ðï5,Iqi­\™’ø XÒ^*/µã…¬y<¶ŠoøbÆ‹ =P½'AY€x’èE,@}o^XÃ?¯€ÆÜþˆ³Œ?‡IàǤ™< LÁ¨f|R/…Gé· Q²íP¿_¶¡¶Ø™÷+ꞥýèÂâý<þ3ûÇp‰˜=\A`:^_òæ(œ¢Æ~´q*ŽÙÉi”_EÞ0· —laè)—»4â'RÞùníYâvp!Ï™ÁÖÂòîô åRíWsÑ ˜×Ñá¾BÛõ¤9\¤ÙY1ÞîÞ%Ëlò}²° ÉIôXÅñ<0âçök0ã{¦^'}~._ öú߆š#“öJÜ3ÝPrJl×ÌÐÄTšÃeÍ¥wJ~Ç’%9\(U¬§œÖAÌ°2<Þƒ5t£Rjî©kw#­x”»+v7£'éFâ7ë»ñüø*ðé=]ä^J*¥Mi-Ÿ1ÉifÞk.må»s÷Å$$~ßts7Ðh³’„߬×@!=KÎL ‰ÿ º7ä­„„ăÓMA0”Ñ}Ë\A”¹4ëÝ-|ùvÜsIËqUpÝÕV°/ÙPBàõíèmŠ•É-&êv{4OTj©}¹Ÿyú6뻂 Ô;íE”ø_„'pЦ:b*KªC†sêIn .-ºJ4b“üôI8¥µ÷¼¡=ª(:E£ËsöIÄ4RFÐÞW¿X.œccÓHASñÔäðh=>;g4oTw¶GÃ1ä.ûwAˆiL  l-gH·Ëëæ ìö/Ç# À1 kþÝÝæàù¾,¬"< ©Ý‚6mù¬ «rÉqÎÆ(:òæIF—ü+-ØÙš+jWæÃÊ(Ê#XÍ sN.0lïÅ‹ß1?žšµ9>å3#7z2øk¾½I»,jJõŸ\äk´¨Ë¦V [ÁW—jE³»^ù<{ ì¡ÔW9ä¼ã£Î\ÒÈ$G9 Ф»Ëa\ ç>µ˜êatFr\jw¸4^;ÃãˆÍI·[çÔþL¥˜*Š Þ 0€í!©W¿_íæú%ª­ Ù%2@ÉÄ:‡m.óH0c"mœ ˆƒ÷úòÅ9ô·“Z³|/XÁĘu ì„Eaê DopP·åo2ÿ&X9qžD3}Ì„U‘·)``ë~ªot·8LlkÅ?¾ã«°‚•ã×(÷ÏžÓ§·>;Î[±zÄ“ÑÂ03'§É`3¾§ e¦B"ÎýàIq®Àk]ù¹¥àÞ¶“Sx§:*•¥mùÂW»òT²‚À¿!ÉÜT DLAÕä(ñGÖnÎ^-ÊB7“ÁPÔ²™±–¥Yúÿ¡Q»ÈÈ­¬ˆ`÷Nþy@a¢~c %w /ž G#Fx¹I^ø3Ÿ\¢[E6]•Ì,¬G“Žv‰?4ÝÜ%NÆs²`–kœìBƒE.ÂT|áR~¡¤AáÊ-® Þ*‰.¾ÛËyÔ°PÙ›±´ÅÈ|F>ÊÅ~(‹ éÀÛä<1PØÿ$±ÙñšC®pãÛýæË—¹|Ñš^sx«F‰íÏËcée†Ï3ûugÙyÞ‡Ã8C‡k4Œ¤‚•=é<—1‚ÉPÈË€…¼,0®0óGfzrÜô¨É×KAÁngÙ%¹®'ñ‡7¦î ‚wñÝfÎkx™1*x›P jX +1€ÍÅpH²ᲄTÇ›ø,âóÈ:Ï-ÀÂÂMdÒÔZÈ©¹`!ÀYi“OQf ,c᜵xc/µÃËúyü¢Ý&8y0ÕFˆ 4ZÖ&u}C° P¯uALdCK"#“È‚þÍùgçôrž c1`nÞ$r›F7Œg—óJ"@›z̨ yty•“ ^ Bò€!“¨sË*÷Ö)$%cýœýÞäMDLäÃj´øŠê[ôbfçÙŸï$;‹ä‚ö¨]ÈHU18Aex'¶Ý(ôßÈÒ¡ˆ‰üº§Ï‚Ê”o(Û1ž)Vš® 7‚b½Am¹ÚY—P4~K)öŒ¨Ìg§õ¢^^ü³i±íHÿÓðtÅÝD9« ;} ÷‹®Gp*ž,¡£Y4ÀZx’\¤…nãªU÷OK’ïÜô|`± \HMãÌ(^XÃÒ[Åš]$&¾ø?ªKÉ’b{-æýÙS2"\âž}7Ê]G9«wÒ–”;E9—TàŽØJ©U+wÕÕĘD‰â7*%DŸ+wQc ƒ£¨LZ*?‰?8Ýüa 98’^”GÆlätúÿU@ðkštKHºùãZ–ì¸~'õJBBâ~q§}7ù– ¶8ò¶Às7'Ÿ ‰ßÝ88>ž©‘o½ÖÁ•)<]ñ7³lAL%È! ‰ÿ+cJ€C_vÉÈw&¨v¹¨‡S=ctF9en4—³iT0ù˜õäJn÷Þ¥ýâp®ï¨àpnós85&ƒÛ2“^µkØúíPo—.QDxIíÑ\‚Âo/HÙÆ—Ñ)—õ)ƒK2I‹„ÔnŠsMp0gÆ!&ómS' jTàüxD™£èSVŸN"Ž–•86 Ç«•éÛ+ãp·&Ôe!(dMfæ öÙåó&!éÆåGÞlÁWðA˜H»Àá<tªMþUVe€™ä.¨Œöcf6À˜_ÀIh°ü˜8™NxU€#çh|êå‰ôbKÏDÀy·Ú^?&òsÁ@y…÷Wó~ñºìÐÛˆUkÀ‚ŽgØ ±þ > V|ø ÿ‰„ƒ<Õ‚Ÿ6ƒàßëù`,¾ õ~,¤\ã½TšºVb ½‘Ú— öøæ}*² ±°ê§Z±vƒ~Bhø§``l7’ŽsÔfŽž$µ=}¼I[Iú烂«ÛÁ6Î"¼Üã8%$¤1e4"pf¹VÉ·DY¹–SøSÚøëåS5ý¢‚ž«ÛîÙiCÖHÆFàmÄKõàÎtk2àct{™·dRµœÊÖߺª{p!ÕZ•”G¸ Ž‘“é…þš|ð6)v½_WÝë6ÂÅǹø8ãBˆp·ãê˜8ŸíBÑ µ¼9—Y¨y]‚ƾŽüBWÏÕ¼Âÿ¹¸.!µ›"ïí60*Øhx[NfáŒP©ÿ̼“`Áô|¾’¿ÜhÓâŽÅykòqÓk^ÙÀç ݺGlÔðt€zõC¶’ Ī+彸ž°7—ÁP` Y1CŽ$*pNkT+®ÝF@å…$Ú]T*µq¶f[’L&Ì2x2ÐYÀH58”%' ‰»×nòm¤)¼ 5¢– vF+ϘpP#Šòù|˜vgº9–GL(h” §£FX°K‘'›é¹/1ÌvyÍâó ñt+z‚ÂçéÑ`䇊zó7$óï†úŠØkMXs |¸6-õ†?éCÒI24Ž$3µ&؉Šæ©÷Æjìs°¦±¾ü´g8ÏG‚ƒ©­è óvÒ¶%ª qÝýøz~1´ñ]âÎÒlù8IHÜ‹1…FØBšµDLâ±,vd⣂ ß/x¼b‹j´P¿Ï¨ *…|Q KUõóßù†Àˆ ü=€FËÉ gmML·m·v(ž^#ëÐ%6â£TÄ$öµ'z‹^ë¨ï˜ã k©Ãxw%q@áÔEêýÄ…±hã°'l趜€ZˆÉ<ïKÜÉBÍE­>gµ9“X´…]aut¦;uV»È™Œc Ï­æÛTÈÁÿkþÕ1‘ðY *¾ÎEw/#fgO½•â'óHHüáPBŽp× jÅ%ºÚ•£ŠÄ[kî%Õ©ï5Šú¶dð÷¥•/k¯têÄRÛÜÛ¦ 7§°UÕBÉÏàR6Ø™>’2û~Ö½êârîàîñŠZòàüCF„KÜ«ï¦è¤-=ºZñ¤').qÛÅ©ï5ŠÚ…ÝÌÖôaÙq®™Z•Æ J•PìbÕ(ÖÔeæQBChÅëT±í|ÅåÜ1À½¤+% Ž„„Ôn~/¿Ÿ¾¾´ Á ‡op&çõ•C¨€fgG¼[f ©ÝHüi7¿]n$3‹ÕYÅô£»„ É\H–_º„Äo„n„3äm‹Àø°3vDZ9,±d‘\—·«»¸Tœ]ójg5gUA”âl•Ýyœ»â>Îf÷ê<–¤X×»nga/Yép«Hs‰SóhâÙœ‰Ûžúe”†¡ÄýÃÃYÅǦ깽ÅnŽâÝz˜K àö¡®×=y{WrÊw}M"¤:b Ê}‹+¼Uër ?¶uòŽÆ¤¦8¦ ¦ruõ¼ŠNÅx—Î^Á«µ ðç6zö<Š·³Uõ@LELæÅhg䔃®µSy³ŒÛ>ƺë%ÿ^µXŒ•x¿'b*‘ªÞµÀŽ#©ÔÄí•S™ä¯ ÞÛÄ–µ(ÖSADYELåúP{rÍ_Ûêw-l,ƒ¿$"Ý@:ÌX†2å#bVQ¿6W{¹Ä:ÛÁæÔã[ÒÊÇùü Ú]J672ʾ„2e:ë åß(ÓQf¢jîò…K^]áI-rN‰¿t`ŒÊG(3Ѫr¸ªÖcfm|>Aùfp¨‹{–^H‡W¾Ò;ÛøGº4æTGgãowÖá>íí.Ísi@·†¼©wíd(—ÛƒàåÞtÊAùe>êÄ@?p0©;ïT`äˆB±Ï÷ § åC”ϙܑaþEÉ4ûIrÎÞN JPER³õ<™®cbwo­ÆÎö$@žA(ÕÄôÊ LÑÌrö¦/¥íèÏìõ(Ñõ0ûëùˆ[6ç¯a˜f |BõZô*#gÄãÀb3XIMçÑE¤‡óR%ÄDpáID©#iå ‚6y¯÷ã@,ÀSmȈ˜ÌôzúÃjñBÄ º×i3þ&ƒE[0=žiˆCŒ§©Œå“u“G±"âð*!ÐqÛyzo+xé"nž#f1¹*X™~‚1S^¬&°€•É4ŸO™ª , ‚Ð v@Ä‘ô±>:)±5+öé‰Û¬edÌ Ø±ÅÑ7šõˆJäãx°rè éz˜@au:¯Ôã<šÍç™–OâáÒ |‘Ö‘``WOâ¡Ì r#;†¡(lÿ‘mÙL^Nì~þÚ…©¬3PfR«)ËjØò¾‰¬»´P‚9seC/±·³NXú:·çT ç¢ï¾À~§ù¥&,? é9œÉ#ÌjÁïÄ{[pï0{’é FÎâ£U(Soû‡€ƒàÖ7Çü1ÊtÚ5âùŠn{‘Ž]as*¾Ý’õûÀH0$ä:­Ô ø€àX|±7Râsô’§2¨í]Ôlqoåú-²‹%nŸ½¡'têñà%¦ÇâÔzú°%Þé¢Éз£2d3{²hÄɤÂÄí?9Šªâ¢V«¾²³a(¨ZD (,»Â»-õu¥×z²·%T•¸Z÷ èH•XØy¤8ô”¸´Ä_u›®SÚa<Ë_œ›S Xv“×ûQ^“ÅÏÆæ,OµƒÚ•ÉÁâíìÌaÇ!´âÂ@Ã⇿Æì-ÔiŽ¿G†óT„Û oW‡Ž4Úæl€ ƒ›’‘Å~ÝNqp ŠVâ"˜}Iª6O»ñI}™ÀáëŒúž@åÄž*˜Ê¥›4_Ä_z‘5¯9ŒÜÎÕ®t?MÅÕœˆ%eæî¡Å!“™­Yt[1GŒAuÛŸ¦¸¾UœÖJ-·°gù9ŒÝ°B®Â3uxé·i팫Eµ Íe.çŽòˆƒÓãñ…_¯õ6CÑξ<”—Ø•^ß±%°øK»1#˜ôtZ}Cº 4Üĉxi¼²‰w\ÜC8x¦5‘ â\„ÏféFF4!?ŽŒtÚ}Ŷ|0 &èZ?ÎÛ0÷Ædzr3Å’GN³)ÏMoò!«¿Ó4`Ë5Ú;ùNÄaËÁ¼€am~’oÝBÒ| ˜P¸~ƒêk98ŽŠ Ï®åƒÝË3³C¯r5Ÿ XØÑŽM§ ýJòÓVkŠ6‰¬lF.gÙMI7÷ O9Â57ï£[´¡æ´íUçÿÎ-gúÅÛ·«.AÒšËÛ"ÎŽâÙªË]÷&©Î‹‚cµÀy– sÂ÷¿ºÝ®x ªt”ÜYáØ­kL)¢p)#\"•b#\|¬<¶³ø]ŠûJùí/¥¸Îêp¯¢xô¼kׯ¸HíJ©ñ´2fJâžµÅ“Ô£í¥›Øo/E`)©¸•dô+3×’ê¾@^Z-¥ô¨”J 47Ü£¨"·(÷ÕÔÒ{Qºql¸S§ w’p—µKH܇ïæ·õr-VBBÒ„„„ÄÝS·awqy¸ÆI¸0ÍÍ)ÉæIé0Ëq–(!io•0þÓœ^åò³yi7ïžh¤MÅ?å3ÅÈñ8³61%[O†ÿ,iøHHHx:ï&¨çúðÎzÑUØÑ“Vþô= ©*­ìp†M¿Ð‰Dl û”@!¤27Û¢ÌsŠ·Èq–ð´2õs_–oà¯çuš8wÊ‹°gëëÜFxu/‹Ûù“ž)á…P¶¦:S)XAp;ÔÛ(GXBBÂ#Ý &¢-.ºmÓÈuÏ tôšé»3,¸Îy£´–$$$+S ÇÉ>ŸöALÀ1ñÎZ²²Y O€`~'†o“® ‰{¥‡ʪºò2qÊl óÁXXT…iëùW7PàÅêt¹œ.!!qïÚÃÁOkGÍåú ÌDÇtÄ=’@BBBâ.éA×/ˆiȶ6`‡|"Êrx(YI¸fLvžNæP[z”c(!!qt£`ÏÁg!;ˆÉˆ)ìnËk\ª»•œîåYëñQù5ÀËŒ—‹$U•[û$$$Š±K‰Y45÷¤à·M*»“o\C½îe\ã¹%þ áw‚ñîõž¢wÔÆÓG¥’Š„„„„¤ ‰ÿcJ`ö¢Wå,dç³å2óäF> ‰‡®Ý"+‘7’1)çM÷ª\MŸ2w‘ü>Rk 9þdºQø¡+,¥ç&^9Àà5 ý•Q•õà)ƒ‘Æ¡´.çLH$h^³J“rÄ”¥e`abïÐê[“ë—¥M•­ÎOM´/‹¯•aà z9j{SºÌ´(G³`Ph†¿…&Az´ Ñÿ/¨ç¥ô±Ð¬­ËQÙK²˜„ÄïG»9˜Ãà:”1é§a/ÙKÿƒ àˆ},ï×ax]®¦©`}æý†˜½Ù9˜€‚Æß aƒ™ìñ,Š¥_ 'F2ª,ðcs7ÖôgRpðlGþ^¡h+’G3½›°±+›{¢XÙ×M?{|F¶ôŤÌíF‡ð#s/ÕdPMNàé`É8¿ExðÝŒý‚ËÃI®Ž#—wòŸÓ$äƒvfù^úÿ ‚÷kq¼?¦Å}m/6†‡óñ |Bic£í5†ô"ó<õ6Ê+*ì³S¬hÃÚCº‰´b ³Æp¡??$òXu–lbJ¦û-æ"pN¶aã²Ç³·'§mº(G;|”ËH Tht´ðx&@¶G{±þ,ç5ÆÅðÞ*ùµJHüá)DSàçEEo,*6;—3H³ë>ƒ‘¼T2¹– P¯,çSȼÐÒHl.'sÓá4…Tªào$9‹ Ùz8UÓ@ö%ê2£ÊbÈä\ž[õ±åsÚL~O”Ù`¢l åUŽ$„RÑÈωúyÉ>Dy£Â­,®æHßÍÿdˆ¦ÄýÐÍÿ9|¹Ü—º H³1éQžµRu ·t#ñ?fLýFÎk'Iœ„.%Ðiä I7ÿ%¨ÌÝÇÜ]úÿ2{Œ„„¤›ÿ.ãÈó%$þÇ z4±S5˜ÁÑ<^…VAúRô½Á~_·RƒJטҜÍSƒ×ݬš PéV‰UhìçÒNbfT "\O24Ò£2£«ÑÄ_.ÉKH”N7 s‡pº'q5^¯ûp£~÷HŽ¢Î=‘”`H_º[ŠÍOÁœ¶4}ˆšŽ ¬ §»ƒóÚSæ.‚Ý-Þˆ'x©ª°÷1¦–ÓcD£Ã¹9œÏÛÒÀy ªÕ1–QD²v(oV’Œ#!QÝFuc´7êg´[E÷µD~Ê^+ÔÓ'X¥—¥vŠ¦_©„U¡r ±e‰°€FhY†úP#”ŠF}²ÅÒ¸,‘ÖB!¡&Êû[–*> *Ã_éL5ËÝvQ5Æe©è”áO„™r~Ä–¥ªOalºÙBƒ²Ôö•&Á˜-ŒŽ$S¡N™Ba1ehL°AU«,e nÕ=RŸ“çiµŠ1‰ØÁGÝ0°1³UçrË¥dóº¤^fðÞÜOä^l"ãHHxôÝ(æGÒc¡Kؤ…>‹õ=2¯÷æOÌ;Gëæ¡.Ah¬éÅ®L”kì‚ÿÔ£å\Lá„B› $fqE#ñ ÒâYÉøžYÁ'ñ¼Ò–š& ©ÌIfvSÆ,bO05!6œø,Îä݉k®>‰vƒå©~ržnõɵ“ë ×NŒ×o™ú5Ê,”Y<{ÊóÄþø]ê“ç”YÓ·Dïò†:EëDðd hn•ØGQ&+YÑp~©\@ªF¤¿SC3¡È…) ‰’´6lå ?RŸäB9‘œ<É£?#¯Ä“2’ÏÑ­IWY_’O×Î ø¡/‹óúVRÇq¦/ßßbH víeè!ÏzÁ!XÜ“oO0é„›gƒ7»0ÙÉ'O1q;—Æs¡Kè_ƒ¿Ò#ÉsC¾þ‘Å£Y·¼ÉOצ+9´‹a^>ãöxnüÏOðÎ ¾M)¤à§º’oãõGôv™U­%ÝÄòN Q^ïDœà½M¼·–°¥‡òx,†o¶sÕ!) ()"A9¢|P5²8ŸéTƒU‚ˆ°’ÃÑdýbl9.$“d¨RC>g²ðõ¦a×S8› u‚)c"1“UƒÐr9Ÿ èK´‰ŸS0˜iDzG²Üè¦Y8FQx!'‹ŸÓj•%ØDrÇÒ*•ÁjãT&€¯µ­ìM0yÑ4ì\ŽûÛe˜iŠÙÎî$Ú…±û:ù š–ãL)v—çr"·ì…mˆ.G˜‚âl„ª°û:6…Öa EA37¹áÀj¥^ …[™œÌøÃp Ñ”¸ºùš– u¦Æ—ààþtM&v—\*’t#ñ1¦þ§¸”¼d¾ºŽˆ8OÇý’k$$$Ýü×çµ-¼¶ÑÙWƒüÆ%$$Ýü÷`,#!ñ›@ѣхAQn™A<^Q_B¾],:œÞá.k¼:GSÁÒA°/]+2 2Âðv žV´ §ezERÉS4&*}£è_™þ•éÅ#¡¨w¿cå^cÐEá-ý¢ð~(KÖaAô©ø_^ý¶ðX‘oä.~V‹rÞ˜¼Tá^šjeè½Ö+!Q"Ý(èºÜìî| lïKmcÑå•ËɬèI]“¾ŒÕ,–Ûr5ÃZ“8”iÕèÉ{íÈš€? ð Æ1–7¤}8Spq£Ë{ÖM,}”!Qô­Ä°ÌíJò‡;Gx„-¨`¿®ñ/KÞ0=ëùú<øú‘ÂÀÆ\ïÃ’Žÿå/-¯:Üã´÷â«GQÝÇÇ'ŒoZßݨeXüˆ¤‰‡E7€Â;+Hã¹0Иڈëüí´;Ý(Ør¨½‡Ã#1)`dsZ/%Û sëÒ{>Ý"n ³(7¾ëÅ’i¼Ši;鲂λ˜\×ó«Â„-ŒÜ€uDÏåF¯T…Ú¨*5ËèìM@ªùaÁA45P5ˆ Ug(jPÖTîg¥z U|P#]ÂI´Q-£·¨é{ó*ùS3ÈÛ¹ÆjT  F¾ŠÞ€ªx»3TP0¯•Åú»é&ˆÄGu»âk¥’•2ÞÔ $ ü¨€¯Z8ù#|©Heç L&ªíëÎü‚Pju»¤Vì唩¨DPÍs1½ÒÏBõ@ªàg(1Å@tÕüñ*Bô?+1~r £Äƒûn"¾DÅòå|EÔ\O¥ŽfE~¬ËWÙ™©ïǽ ]£X{» #ÑŒ§s÷e² °ñ¹“WEá—tÂ!™£ƒø2‹ˆ[tü‘6ÍØR/NIk/ÊÌå‘h¼ OU2Ž’f"{—¯±Ãƨ(ù‚­YT¨Ê•Žl¾D…PÄMªoc@$^Þô¯Ä?rrUæqÁÆÅ'0§±ì&Cj²û½ dž0?‰ø3øF0-ëlòü4á‹ÙžUØØä[Ôú‘²Aî]p°º?Ï,emZá\m[‡/#IÈdv*ï7ä©ó4J#5„§Êaž‹ >Àpo^¤S Ê'á÷=Š‰ü1ì¿Ì#^9…ºç_ºñf(³ÎÓ»&†K„o`rwþè6†söðÏ[ ñípü’/OMP‰ªÆ…¬9-€>å¨=—ãLVòGqþ—T ¦ì\R\¬¹Ë#yî[NËí‹N7äÑù8gú1b—JÞÛwYãñÎ䑳N=É@‡U\îÉä\ºÅËûX¯óÎSKè1Š¬'ÈÏåýƒ¼sœtG©Ž¼éçÏ„+P[ê†g¢šØÒêó8míó×jüå4åÝ}Ä+LîÅù“ÔÜúÿØ»îø¨Š®ýÌ-[S7½‡$:¡÷ÐKhÒ‘ŽØi"Š   Aé‚é¡÷z „é•ÒÛ–{ï|ìB ¯ú~/¸Ï/lvï;÷Ì™3gÎÌs¦ù"gÈF„´Çà`?("Æ •k“Ñ‚ÃÂÈ'&¯Qx•ì|xt<¯#pî6i;ø`<Ü9Ä^kŸaWýáPû~¹(B/Cí“ÁðŒËB@$  ÿh­BŒ &jÀ­†(®ƒŽE uGˆi&jûøîèKÀÚß»ƒ¬x|p tj3Xy+ŸmPk€Áù£XV0Æc !1¯Ãí0éÖd¦vÅÆÎhyƒ‘ ßX=“ì1¿¢i"Gaá¬Ï7w3þº¹@1Íyfø`kv%‚öcõ5º÷¶P0€|äˆ3˜~JMY –Å:ø¾'63è¶ §uà· hê­PØÇ"ÐëZÕ'‹@îxÓ£‚à0l*°£`!—‰F#ÈàB9ºZ?ÕÏG¸C™Ží]+ªªÏÂU†E¦nßxt~æ¥Ç{!2ªâíáÐR GJÎtN±ƒxú2ûw˜j zIéc>p)Ã$ÏRÀ‚GGf@4A=®oØBåŒ jûî8¬s(Ú;lî ž€R䃬0¿à¹ÃÃÖ\€DœúÙT˜Þ2ÜÎ3É32Ó}Š‘5pr¿©¨IÁÀ¸"NÇ…P|Ÿfff˜ñ·˜ŠMÑòI0& ¿e"’Þ‡ þjÜe‚Â7Ñu+ÍÛd—)-ŽÑ1l¿ƒíwй-Nô¿çI(äF*z¤ÂÚýÀ\DÄÇhh·—pß„B  ÚJ¾U­Þ2ÚpO™8ŽYcï¤ 0ÐÇGÿáÔ<åH€kZ½ÿvÁWz’>S úÔ…<$BEœ‹až˜ýü<Œ¹KèE k‡1ÖO™¶Ý·°¾ÐO¯x5Z5hVùLvVgQU¸—„ÚaÉ]$˜{5TL9"šÁoÀ à6ö‡Þ«AVƒm ÅšaH¼³¥8vwTøÉ põ VW1} °Tƒ“ŠÔ±è¬~rô8Ã*Š½\ѧK (P"@+Uc$ô:€À•˜|¡@öå>õÛ¢£? u(Ô¡P;r ð·2vn\‡ T-|C Õ­¸ÚÁ8YôÜ Ò³¬ñçB|¹êùlظVX8-µÙ8öj›h˜¯)ÑåØ:A*E¡…:8¢\±L¸Péï<‚+ˆû=Õ¦6ïDp°àIõR ¦p8$4p@L)@p Ý™ž8·?~õ‚D=> Á{÷Ñ·’õ2ÃŒÿл!ˆG¯ Rð}.u†×©J×RøÖÂ5ø0Ó!¼ ÷BŽ][p9 ë@˜„ÐL$ÐÈu­P{@Ðó¢Fà^6n¡†5Ú8`á)\Õ$^æ@Ðû6âGbñ]ÔóB;ýYÀžÞXµ!X8a*œ)ĘºØ}Ÿ$aÀ5܈ýqpt„ß#ì+C£2Ô°ÃÊ6xÿŠ©ì›—;·{c_&à÷P¤2ϵ wÇâÝ`„–>©||[29»»¡vz7Æbæœ*zÑ&Ɏú&È| «’1 .RqIs ;Æà\7dðPWäZÌK”ŒÆÚxÔ÷F7%ØM((EÁ³Žœ0f ÚÄÃ×¼ûµ°©PA—q·?Z݂£ÜP{#À`Û9ü:}ðâ·t0Ž¦½Q«CÐg$v¶ÀЛæ)•/§)š¼p²òÌœE/w\MA^%sÐɹYˆÔ>‰ã4r‚\‡k…—¾jðÅZDä ¼â+ØÀ‚…AÀ½½q$Íô^µPC­—2!2ÏVú8áp:º1àJ&Ê 8%ºYãØCS•YC‘cšÉ‚‚‘¡½#8 72Q rô±Çát€@¥Dg Ž¤‚2OÞËLÑ4ãeÌ;ÄG›Èzí½³¹1ã? ›ñ· Øw­ùDP3Ì0ÎRÌø§a¶5f˜a67f˜aÆÕ×÷²D‡Yfü °–!È×™%aÆsÌŸ=5f9˜ñw¸ÊJ¥æý8f<ÏÜ0 s¼ØŒ¿ J¡ä@D3MÜŒç Hf˜a†fsc†f¼^“©ó“)aC Š”bôœ¤'Z‰1XÙ¯–D°ˆ‚é`YP ’TµÀ—wÝ)˪\%‘J”0Ü3{ëéãgQ€0ÆjPãÛ°O* *Qÿ­y I4iõŠL¯^Zm¨ñ|ú*ßK$“:=nMIz!ÚíÿšHŒºW¹S¼ª³ÄøÊ„¼î憄¸}Ó"y¿9áÑxš%¯Ìl“÷ÆáNtѾ=„Q§ÁÈä2@´i0¶ßè~;Çu*ÕÔùCðã|t4vá†åÁuF¬mÕ: öé+¶þÿ¹ Q€PJ93£3hM§¦>ÆX'+=øn·Ïï7ö(ÞûNÇ"K[û„Ž%o:{аŽT)¸¾zïÆõ.-çöÝ‹‚B¤¢ã›gÏSXÙC*--(á•jßKÛ6E€¼€VS Bþí§1ìùzÁÀ¯ç0òiëÇíºÍ q°RT¾Ýr4ä’Ðsx?¡$qÿªcƒ¦½ÿ¿£[/«6¶ëpÁ¡áù5”—SF.“³€Tû--üs7½;–±scˆåùåZÑƯߛŸÍÄW«»)î»5뙉?ÎxñÔÚ„#‘¿vÍÒ,íÚ¯ÁëëÝP †ð´ðÂæÍÇMÄ3Ö˜B@”­~ÞÒv¼®¸ýÈIÃD i!µ›:óî#ÔÕ˜èס»ÏÙ¨5ôñýUZBŸxýRZ›žíE}uV‡RÂòH8±ÔºÃ§6,y¦ˆÇ##e~º‘ãÓã¡H ! gÖ×ðeä‰TÖzÓ­l~{g‰ê cÎJ7µéTçæÆ¥µFÍT"­ÆšPJY);“ iÚ¹9¯€¾¼ Zœ `Ð$eXÂÉ@Ô›Æ|1¥…å¼ bCx$À f$ œ QA „#éÑ’ä/SAŸuW¯5ȔЗWÁ 'C*®üÿ_Rm(†z¿ÜšÓ<µãÞ¾ŒÞ Ež¨çz|}À^T›¶rŸ³¶o¨®Ü2%ôàd0h)(Èci F 'Ã@!è)¥àÀ‚e‹”N†($‰àä"( Ž…$šÚ´j ¨ÚÊx¦ áÀñO)aMM/ Æ/ÁÉÁ²$i%¼ºò '%2úrú ù<\õþž E1C#Ö IDAT'/íYû0mÆ~ÇI4>“³PJJ%PÓ8*Ÿ!o_Y»¶ÞÌw°)錧ŸÍó|¹ht[×MüʱA¯Žã¦YËMýÄ4o*OÝðe|t”Oïyî/qz\“§4ŸY§#Sj÷†áÔWïZÕâׇJFR:á¬ëv6rGð¦–]—z4©}ì³Ô¾iÀà/k×u5˜L!ˆL‰»»¿¹uþãùF—‘£$zÅûÓÛ5³Ìaj¦††8Û »´ÐÚÝ6%òfàÔý.–Œ6öðü YG¹þ¡dÛhàKmɱesˆP~ôûÏ:~²øúŠ·‹¬meÊ[|¼¿¶·¢Š&]úâÌå$Z@mÛ˜ÿ{òâñ:áúÑ%ôùÑb>{tY^—‰_ÿ6¡E½†õj]‘–ohÐÿ›eÊÿ5|ŽÚ˜&³(¥b•|r™Ò½N}eôÍH4l]Ù Ø3¥™GíöQá×[}tÔßãÑ‘ùïç3öJC¦hUwÀìå¬×—¾›œoç`•Ÿù°þèÕÍš×¼òC›<¾I~šÆ"/5MèñÍg9t1¿ìZ·IæÔ@›~_æ?|À'ï1@ø/²ÙE™‘Nv†„Øœ ï‚¹ª6 ¨‰g[Ùð”Ê3ræÌWAùzYÉ£<ß~ »·…ÜÃóÆä—Ë­Uº½ºû¬­ö*¾4ríÁ_SºÖÒ—rn>rbAäš™Ÿ\wJ)€‚¤­í}A1møˆŽ¯PÆhî™^jˆ;±4êÂ!êÚ³åƒüjPј†”¥^¹¸µ€šR?ÑìrVñg=^]c„.c @&pŠÏÎæ»ÌQ§/yî.0FQ³×—þ=>͈ˆŠƒ$ÂÖZQš_ÌqE)Qɶ¾úû—ŽDtn¦½°“ ½(Š€$ `­š5lWþÛ×åeeBqšAçN™§ÓR©Y‡&’@%J¶Vú²B5¥ ’$BMŒïÛ¨™Ÿ(P*×÷2îq²†„5þ½î¿ééü'jSý`Ä#*øG9+AÔçÇÏu8¼µ $È&[£×TðoÒTÔS–/Iº•hÙO2J[pn¦?½ƒ°+lùÒ£¿ÌñmÚÕ¯eûæ]!Š}Ú‹:*Ø6fÝMu"Ãx9©EDº¹úgf$0Mk€ì}ºŠ:JA¬k¸Š×ã[·J@aµ­\ÙÖ ²öî2A rïvšò¯3òïúÑxQ8uŸÄ™+ ãJòJ]|ÜDîí[Û" ©5bFÔªY¤óo´ìr™P×ÁFE_¥¹TsCÁ(ët<,rU§;N]öS³Q-ÉÝ€Lãçß®EdW,8¶(ï|æšc¦‡/šƒï&>*÷wÐÈþñ¸Å€c´±g6ß:¼AÝ?EÊ™¶/‹<¾båÄ5ûŽ¯ß© _±¢PKÿÎþML¡b–/ý}NEYÄ®iǪå]^•­ç/Îm{‰R"ÕžßÙo@Õ‘ŸR¢K /SÕÔ¨=Xr"OÜ9±!!ƒ <ßAÍÙ[®;µió„@ߎcöé`Ë ””0ñ ©4îHZƒÈ ¥EcÁ³~—ú•Ÿ[vséî —'}åè`¯»¿'ý\ú³b«fc®,y–5š@–cõ¢”zô«}¿ïa!Z×™òÖô‰ÿMOç?Q›j!IVnµ-8„qoö¦W}Qý£ãk¦M!€¨è>qí2P‰çä!T«y±4£H0JÛµA7YÿŸÂâÎïJغfrÍ·WuìÙX…)0Æp”–C*¡Ã%d<_RVjìÒ„WšT1ΧåU ìÚËû[”ö ŒªÁËxƒNg(׳–*ÆÔ°¬%CòDC‘(ÊYÖô£0Ò|©Ê­;[¸"KCð|—aë¸Wm¡Š«â`Èjt˜à×}B^Ô©[Çç]Ú¨ 8³a›¦ÿù4ÝeÚEiRœÞü‘ÿcéÐ’¨}?\;yÁ»ÍNónØ[Á` a[»g§A âoì_½câ ¯žS[õ}‹yA7/œ¬;|cçž ŒÊ_lÛ²oÉ ]UBW¼L<»w§{Ç J×~ ^øun´°koƒ š:‡-l1Bs|Íùo:Pž­ÞüØÕú; 㨱Õ[×Ô¸ž%´\‚²²äï‡\qì7Í¿^C‘ 9o9S –‡$¼2{žMJˆ:Xùuí8¹£Íººï„Øö?77„Qtlc{<$uàîUbZ†’‡é1a¦†dxg­MÇw+é Q*¦•'BµO³?´zqÇÑJàÿä€*Z-#÷Éó$¨=}Kï–öü ¶Ô¸æNyÇÖŠ¢¹19¨ÅÄõàËP}QÆíóK,; :P‚!')¯Û·W¬jÐULú…AùvùÈ¿ÏG…w&&$»5VþQoÑ£nïq'·¼ï<ás9)Ü4I×â· Þ •+ÑïÏ|pËÅÏ!"ôpvMYâ±û÷rõ9ÚœœÃ›^®)ʺž“ P»JÎg'Þ±¯Ñ1kfÚŽûTi¸wïƽÖ_wôR©…_  }ÙãéÖÓÒî;ñøï]-¾R0ڨ͓J¯êT¾wÆìNS~´²PÇ"^­U’yèn£:ª¢ÐµÛ\Þ>K8ÛÚîvG·lìЭ½>#$1Y4¡¥TCHËïV)P!UßÊ•œ…>B€RÖίñg§Kœ³OX(8 X¸ú j M ˤȈc¿=Ž•8¼¤YGQWíú©éAïN}k¯zD­¨Ù`m}šªåX»š¥aoWº]Ô¹2ÍTö=¾p¶€$˜J¤œMçÁmnž©õ†“Ÿßãë@©BãWgô–ÚMj :*Q¾þ)€q9“T«ð¢jŸ ¾„êRœ}êšÎáf¬}ý7pv¾öj ¥pî0õMïsáÇ×—Q¿aûj×ñ$Jlú5lyþÖáß:}ôK ¿(lû.mßëýùG7×MŽ8v¸ûÛcG²j4äYã‘ °vk ¶P€R¯Ž&Åλr¼çèwü|#oÝÝダØý‹ïâw“•'µšuÊו•èÿyYµy µg€ÆJVÉ°ªk6äÿdo4ž  ÞøcÛO†x5 ?òkQ™èûæž:õ¼%ŠÑ \9°)¦Hgí×iļ!¬HúA³ù„Wcº ^Û¬•(¡ÅçN®¾±k‘Ê­ñe§ä„DåX×ÚÒ´îÎZÖtp³g,[W)1ÐjZ¹ÒÛ‰Œ“]ÀûÍš²—v/”»¶òùƒžªk ñM+{Ö–HÖu> ©éc%‰´Õgû,v/¸ü‹wЬö6ƒp¥¬ÒÛž÷?0Æ:uÙ÷ôÂ+³4En=¤aé0ã5Ý>µm×/Ï8X+ÿ«O­ h– ¯Ž¨X„ÿÒI[sM».µ^våé'wþø˨÷wýœžýf‹9»-¹Wt2eÆë`p̤ì—Ö+".FÈ;±hBFVAËY'M¤ =ît¯ÌZ¸Ù»yý:a¹ÿvÕ«èݼZt$å°bü«¨fïæ5!ÆÝ7Ä|Ô ëñ&øW ¶xܲ¯jÓþ½ ((X/êR bbú²<@_£95‰”²¼‰{ú¯t´À0ÿs»'­ð2í–Ëå+< ®êIÊ/Q–3OoÿsCHÆö%ãÞ!Jò‚—çE¬Ý¾à?XÿQ˜¿`´)ôq»Î<ûr%¤n‘÷ÌqÙå7—ܸz‡ü5I0â ï¼a‘àë¥çIÿBWƒpäÚÏΟ¼ÿÿ7RrwÕ„>yáHÚ¶Þ <°9tëûõÓ²Š GB¾ksózêð„¼·7ýx”V{3…!ã܉-ûÉ¿ÜÜ02È”)ŒÛSŒìpðJÈ” 2•ÉZË”¦„RÊ)À0€û°¿ÿ =dJÓ@A)%%éÉöŸ "„D¬y;ÝÆÑZæÔ"õúÉ‘ëCäú²µã: ^|ÅBÁ#§5öyûtm›3‹ç‡Lœ÷Öª¯VLXÌê@î-lÛkE§)Ù%•ÚDÔÔêåÒ¼A'äÍúL¤„!—Œ‹MSò¥¬]—>_|§d‘p`FèéK–NÞEi齿ëØ«uùÕq/÷Õ”¶qÒ¤DG4¿Þ^¿|ö¢ÈÜ;!&u:¦0ê×£ë•;ø¦¦ºöú¡kŸæ4vþŠß­j[ß,]²c.¹wž×¾O§ø ïd‚=¿ð#ïA‹ºwyâ‹¿ÜŒŠc“æëJǨîÌÊ«±²k¿&D*K\ýÁ°+B·¾Û¼a³¦iÖRÞõbÒ¢ÿœEJ‚ìËKB‚÷«ìÝ Ò³}ß\Õ.°&%ŽM‡ŒaDÔë;ÝRþ/?J›è’l^ôS¿E§lÔÌ•åã¤å[+´e¢e·©[¬ÒW¯\7qå ¢ш¹’üçç]øyìOÇ)·,($‚¹öˆ’ÁƒÍïÇqÝû ëŸzò«sOªœj§&;w™Óm`ÃÍ=ÝÆ>sy©÷ä‘S‡\ÿyäݨL+; ¥sS£Ólxrè‡Ù°ôòî³N½ûN›£T–lZ³öìÄú¾¦Ý[„!i[ßO*áè¶÷øŒ- ›ÔvÚy7WËÇCsö¥g[¹ªßB)„ì«{ÏUîœX^·­å㮲xhzF™¥J,ÕÊ:~¶Û¡äBȾý:ƒõÑ5©ÝÆLΙurÏi¥‹oQÆC·þ˺uxýf`U9ST*Ý·èÇ&³N×rWZüY»¸­¼ ®ÝbG­<£&ȼð}f´š!ËËßÊòr†€ayNæÙ¡6ÿá(¡…G¥òëI´×û ˜øGYå$ý’ÚBÆÙºÕÒ€RÔïØeW>Tìª-‹ zݸÑÎ;ñô‘Ø¡?_ÖÈaxtó·ÙŸ5éuV!·`cWôø9DÅ¡øâ¬m{Ž4˜ÿAƒ;GÒ¹·» é.'í_±¹óÂPw[@Ÿ½õÓ^9—d*>eK­%×Ül¡ß»aå®öotª1lé•ó}Ú}ºÂN‚DMiD,Ú~P#ü4i2­u»†ì ÞÌ j*Prk±Üw ÏV®NÒLðN3ÂâôÜÀÈKQ-ëÝòƲ *ùw7Íß$ð‚Š*ëvê‘ú{µh»»­rÂ/îùÝy[5)ú ßoôâY,AöÉé~^9þ»Okl¨]^ÏWI‹ãn¦¹ û¢Ûþ3‹Š$X1ˆL,usà ò´*ÅÄkžC2ÎÙy}Àò«Njˆ% ›¦ÌëÛÙF©fã~n¿$ÔÁÚ[kÃoËG¯<¥bqf~z4 ‚{«¦YíÑXwö¯*+ÕÉXUТ0Þæ‰S‰º ]éy£µ4dyûZüÎò§ŒIÎåjZùþáqwÏ,Ëfsûï(‰e>„ÐGg9M×SßåY$lûäÊñoÙ¼ýþÈ”vÝÇ åñ©ª®?^s±cˆÛ4qhAà kùëmnIJèr†'éWã3ÂZX¹¥§&¨‹b­µ´¤0`W§ \úãB%‘ÔôÆ¥C«ZMùH÷èˆÄ×µ‘³LÝ®6¤ú° 1ùŽRô±p§~{ À` íf%’í·hØÞ^ƒ@YÛÚöBiRjTÓ_N ‰ÔÒÓUÊO$cŠQQú0B´´âÏ$H`-³HÎ,pR@°èà¨$P™­†–è™h   d*€P¢×R Q$jÓ°·æç¥Ñ9¨e£»¾ëzËo~&  b@+Ñ@©¸¸5¼—q?I¬³kiLH‘HAk*&å‰uíXc&DPü‹m hñý ~l;뤓%1êàEˀϓ®ÀÚÔa¶–|êß¾ÇíK;Öû(.D]££ŠÈ›Ö¦·”u¨SV*5mת !5ÕËY•žìÒ¤–êÑåH¥_ …ÂÑЄ,]QÙÉZ Q@æÝÖÍÚ©%8Ô v_àÖ¡ûµ #¯ ñ èÚ¨ÿ{¨µƒg•P E PÑ ŠüÓ]ƒÍ¾{µúV~,Ñ>ŒÉpÔQo!ªfíÎd±ëÜ°¾íûò²2!;M«ð£T’ŒJ FÙzظȣ?=(È“@)/éµ"äìë>™KöQR”Ѭ[×ï¡rÐh³t¼Ln¡ Ëýy˜Â±ÞÂà¯ÙGñ¿ÿä4h/CPw)¯H÷¤ßQIíÚÌÁÙö©­–ÈåB @¯×ñr95õXVÉ ù"*·2HRuÙGJ ³¢Œß:µ{Óʸ±W3Æ[žÍX~eå¸w( °m'l\÷XÅDØ5îßâæÎ]~æ±ݬŒ¯NeùÖ<«7è #–e'Ü1nW÷èö¶‚J 3EÜÙeš[ù>-Õ1¤4.'ÉÔ™ëöîKøu2åÇ’‰c“O¬÷tE’àùÆ°°=Ç òE»Ñ®]SNl¼ÝÒ2ÓÐð E-Ç+*T‚(yš_`€P;#dåå:™LnÒŽ3æ@ÖtønˆûÙ{×Î]Xü£Ö²õÓ«e䥆½^ûB­LMϯ x« Å¡s÷îzÐáéöšÒ«ËÓŸz´¤ËÜ9¹ŸÇÀyušÕ•)Ifø×R¸gÔ×Bø‰ ”¢/)’YXå¦Y'çT}ñCÆÈÜ @$¥ Gô%Ú§l¼}ýºŠ”Û±yw¹7§8(ºw9%·¼’Œ;ÔxÊÜâáÉ^ŒCC;JIу‹òöŽöÅQ™”ÕR"–=Ò+[º°Hø£WRXz 7ú‰¤§„mQ¡ÜÊ©¦ð[uÄ'eëvDõWWnú ˆ[³q§Ï®Èµió55f¾ 죋­ŠåØ8k¬5e:’Óâ­O-%„”)­¹W+É?æÛèjö[Õ¶iÙ–Ï?ðirÁÝšõöbnÙöh>°¥”aE2žJª6j?Œ&ÃolmVÒw$¥¼¿¿$`ø$ɦ¾"vx¤¥m­€÷DVçÒÜD“J@ÌÑ1 ]È}]µÕX?È *AW”iT×ò¼ KßNÍ};µ;÷äç=ïFǵl\ ,¨øbtj*ÙÚ;ëÈ£?meÊØØÚè ja#!Yw2 €È#݇oò«çF¤0ŒWåx°¾à¦ÞÒ½m·^§½ ŒÑe0<¨éuq«¬LQFîæïdsp݆G ¹qçvO^äÜa oûµÐˆü”ˆ«›æ3ŽÂ9ÉÅÛ×"J 2ƒgxZ9‚ÈÖ}{ØÝß06”ÜûÌýuû'ßÖmâW¥ß{šg¸4)6òf^R؉ÕSuoÛæmûì£N„f%=8¼@òhêgUý›ð¼U~Æͼ‡) ·f>²¼¿ç=LÌŠ>üûô^ù¥úç¼=/£eqÑyùZ]ôeЕ€ŒSe%Däee‚çÒ¢¾úþ±mw;ªoZΤ$jõ쌔„ü¸c÷ã}›v¶èïZzb÷ñü‡‰á[¶|>DK‰ÙÖ˜§ Ķñûùf¸ÈŸ±ßéNKˆ¹]ð0öκ¡;Vü–HÔê4>zÇTÇ€aЃÊp[&7"Qëf­–DÎΩ(2òŽkÝF”R«ú½\Jož:x®0+)éôw:Ûšµ4\å':wÌFm¼v;?åæµm‹Y€†-rütnZ|öýˆÜ‚"{;Âénl˜‘ñHx±†¢V_¨•%ñíÞ;vçÔÜô¸ôë[¢Ë-Ý»¶Mæ¹ýùY‰éçÈ*(զŔórMÉ£ˆ¼Œ^í+”祧$ä%…ï[²UÊs“ïQ^¸¼dTb†îµQ¥*æ†P0­fjæ« ÿ}^؉3A?\«áfià ™¿® lÍ•ýÁ ßßh0H(a{.:L¢=½ök©Ù7ušðrÞÖÞÍ@aåû–¥<¯Îè™ /h›)ÔíG,X›vî—°ƒ{ZO?íïç$P—+Ω½¸éÛM‘}>üâ†$šF°Žš'¹²„_ÌM9ùãÅàÍgžôsãIÓgÙ%WñFèo_ݽ›?jõq9ÌÛº •}Mµ¥”Ú4ù¬™Ÿpfß Æ:pÔOÛs®m¹¸éÛÒš6ž ”PªiÒCYÎÔÒW2Î’ߪsµ[7¹Œ¡ê4jeáØÛÕ D¤š>Ë.Ø»øÛ܇åµF/ü@îjçâ`¾É›óV憮¼zøPã·iÝ%‰tZtÕ¥üê•­s¯ÜÑjú)_;©83V§¯šÉFíZK-g@aãZ‹çN5U*^|ÁV–¨wÐâvm=¯ný6¥À½ÿð^¶v<(ÜFíiì‘qaÃ7¹êþݦmjX£äú©“^íÞwRd_9´‡³öëãooÿ:ââõ>³—vîûæýƒ?• Lyöý²ò×G—^ž3U·~ú'£V‘ ¯{g¡”BHéé)-,ß»ÝÜ—3Òâþ_øÖ¯„óŸq¦(@d…Ì?AGOýªœåBés=Ø?øé%{'nü<Öå.Š×d2ÅýGzõ¯º C^þáìï;•5Çt«Å=ÉçfÞþ·‚-¿uðÛé9…lEÇᕉxB );Â/'UíuÛ è'ýƒ1•hóO6J†×gÅËz7” bÒë5QO-|QJ aLç–˜£3›wcÜQN_¥ˆ×õ¨ÎL˜Cw‹wCÈyݽS`ø™ïècA˜ñ·Ì‹”¼âêñôOf<æ¼~Ƴ (#ËüÕYœ‘’Ã/²èy…p²?¡™AœìtæE†'ÿg§†F.µ1EËkâí¾¼Ú \ožƒÿíæ†Bÿ`{è©Pò2·ˆ91|‹ IDATÑG×n{Þï¼,oÇðæ™ s„Ü,£å™ZûRU*<õqÊ£bÓÛÊÉ™±y¸¿­÷á­—Ÿ„(ŠB¦$=Ìÿóa%Û'·HÍ,þƒ1Œ"F¶zÆJÊÂZho­ˆ¸v÷åŠfqÓ»ÅÆdÇúGÛ&nûâíârÃ?7Ž„¯îräv•Gä{ïa±áqfñçæÕè*„#Ñ¿u;²3â¥$F)¾4fý·{©Ùå©ÎÜPT¦½šá”á SA¦|Â6Ò£ye%b´ Ù±‘zäŠJ¬\Õã| äFZ¶ 2%(Xè ¢J‹ËäªêÓÝP¢T(” dÖV º»ÅyÅÆG›ØÃ*OÝø//7’})XÈT Ü»^Ís ”²eÉÅíj¸‚–bbËJ‰÷/GQ^%ãAÈ• d*—ÝDð5ö†1næxB)6æv1^_¡V ÃR!·'Ôz¾’$bSÓ5xLW˜¢F& µ2U…ZŽÔÈH²‰ÔÏŽ¨21‘õY2%\yÀY€cÀ³ÙzÑrÄ¢mVJþtŸ’³ ”RFŽèóQËy yÖÃ؇¼$VŽ«P<Ùss™äl”_‰G.«~Å[ ä•`YÈžh¹Ò”ØÆ$j™‘UnbœsŠ æz5A¦'¯ÃÉ?Ý”~ Rƒ*¤p†aVÙ“[(§0’×ÿí±bˆß²gÕÏ‚L£3ÈZ¾¿®N ZxãÀâ™E’LŸKœÛô›1Ÿ×®Ý£kÏf1iJ1ëZ¹²[ÿY³ á›/_¸Jùø£eqÝö;³è½ä\½ °©ÛwÆ 9…tï«å»Üj[‡ rÛìá>½6«ËÛ°NWª8¸8¹Ç»G ®,Ê{5éTgÀ$•§vXsI‡~úA*$¤÷ød1É;{`ñ\­ÂU—“¡iõAï±Cò®þ¼{gô„e+©±«zÞd>èâx&¶È¾z|FÙ­ûä]ƒ|=5ÎLûԣɨzwNæÚ¼Ûe@‡ø]£³UÝÆ}1ŽJˆßôfðê£Ã&õbåj>ù×ÚK®¹Ø@wï÷¿îhÓkY‡>ÍÏ^ðêõÑDA—§²yêàK‘XP¾Ý߆j½  ÛÐû·³½§N—DZ8ÛkÜž& \ 1™ÑêæµvM[|ØææÇw„viWvé®fôÏ}ôµ¹Ô¡þ;?û8¨$‚˜;á>m'@¸ü¤ CŸ3ˆ]Ù-dë•á“Û]îTkôO5ݬÈÃ0>ó˜ëŒ0O{¤ýøôŽ¯GþÌ Ñ:,®<Ð_eªž^Ö}A¨\#Gb¶~¨÷˜øî·}%]éÎ;'í 0©ë-ºìbGòÏÎݱw“–3sÂ<:ÏnHÉÍ/>øº½ŸŒ“[Þã‡]³Ä°ï›¾‹ñ²Õf^Þ\äjZBi½±K§Š´àñû~ù}ôç“}nž'Mf¶nß°4#JeëXÙG¥r9–W<X2œ‚Hbýq?\wl§Y«­ô¨ûÑ´-ŸÕkÚzˆÿð‰hŒ<3ùÞÐeÇewžß~{ð¨U–Û7{­§ÃNûéî^_®ã¤©l ³SGÎ_# HÝ3äÌòMæ~v,Ì Ýšf8aþ4½‘Ûãï$:5sÝÿÝ·õ?;^×ך¡eÁŸµ½×¸…-;N­ÉK{0vóub/^ÿüê­ÒõÕ„Áõ{:Nk'Æmº’¹aÝk\Âõ‹ `j ¿mi/-:ÛÛ@©ÜÞ–äé$ˆ¢*J«ño?°j%“SnŒ‹¢J$DŠ+*7(Jãnă°–Îu²â®¢ñÀú£W?˜5ôÔMtøò(¡€$$ VfÈŒÉm7Á¨ ©9ˆ¨âÔÈ[:OÅÖ”RIÔKX@T7sv€¨o㧴×ð:ˆŽv4:«æ”X:ù`™ò¤°ûž_ôÕkª~k]˜¤ƒ!¢U_{+"èaãëI o$¸¶š(…í½¼íG½N_Ʋú¤ø¹ˆ›ˆ:JXÞÑËíêšY¥‚<´o?lŒ(î¾hÝ~QRøE°^­qhW¹~”‰³.BáT¿ŽSýiiI0T@)$A¨$P"«Ø®h(ÿÖö©Áµ~VOBê{ˆ· Ö£ôU@* Fš£ÁÁ§³XN%»Vc„K›€gÍ ¬|¤-³Nowö®ßƣѰÆzˆe·ÊÀÈòn'ÖZã‘SÇ¿¡‚ƒ_WZN%° F;¸c1|EJÏ”–¹99XÆ®;£¬÷â# ,£Rå'¤—@ÊÛõä TyÎê’ ñ`¼À¥Û{] ¡“V§óõu1èB<ü[Å¥ßæY¿ô[)nÓûêõ à[vp:IÒø¸ØߎŽëÔÒÿÁéãÞÝËHÀ¿Ø»¨XJ xìì´à¸2½ “ÉMƒ ÃY b.@Œ7“'Ë™OJÑ—xò0,­À¸E”©ØÒ´ª$³4ѲŸYÚ¡bIZÌ­Ê‹O”µõ¨WT;¿•Š(dY÷.³ @ì:»;€Ü¹†§ìv²eG#´Ri){rÞtPUä—–YšÈÆ4U£d+ÌdˆœV=T{>Õët¼¬â6á1YUak$ î¬|'¯NûAÃ-,UÉI{“+ò¼)æ’@Û}~:ñü¦øðíaë?rê<«×°7Ju¬˜žVnòju $•”ÔP˜ü0%õ©:)<=ü=«Œ"Ïm~½öíAÂhƒñ›wÈÿöâT"25­ä/á°j{£Á#D”Vï-9w±x{ä‰m··z4EÛiöþ¶Å—J ón£¶·1©RCA(……ÏhCá[:|•ùûbÛ¾‹å Êu")OJ½£—(ˆw·þŒ vù#yQʨLjê)Š!Sª Œé&™LQZTÄ@Wªå+¢xœµ…ñî–c­_¸60pqÜíëõf¬–¤]b’gáro ¥"!<¥ §K=ëÞ¶§µP”YB|Õ`ˆ.û–Læ÷üHžqÔ·rvŠkiÓÚBˆAyîÏògR)?îÊ¡§†âçÖ°+Td œC´ L·VJˆ -ej È¿öSTY»¾}òö,þuø”w*W3áÔ)Ÿö`øÃå8ò2YÌ) *A"ÖNB^|.Ñh@q‚Ô즩T[S¬‡”Ü¿z?à‡`WÊ0†+9ÏœJõ9:¶£=Ú–I7Œ”:xˆ‡MðÖ¦‡¥`XÑ g8î‰ÑfÇ<¸r–­TUwt÷÷ÃHÊ°D›[¢~¦2& £îÄ1ÆÂt¥ÿå‹´Ê‚_yî=–4)Ä»„ñ¬>Tž+²žg5‘¡ðÚ‚C?áûíT ¡éЙ †RB e%¼Ê¢ò‘Þ„J‡†mDBiRtA÷á¾”ÂÕÍâvfó¶#F JèJËåjä>GJ•+©Ï‹bIK‘Zâ Y –×éu¢ŠeÀ’‚4[Û@[}azì” $;2Ít»ç»ò&™7ÏTëåjø·¯LQFîZÃF¶Óî¼ÌÄÛ&\8}ñìs{×Ü‚GI¡ç·žð{sVµG&ƒ‚ç-ó3"ó3³ý‡NÉØ36+#±83îÆâ.Á›N?§É*ìõE· ²’ïÑéÝ…•ÿº÷i[Fá(–EÖmË»¸eÒ¶£Ë&绌iÖ®±\‘qé:qTâ®™qiZ0 k'÷ÿ‚û"·ñP©M)0Y•‹•­ÛýÓ)gÞŽJ•m›ukqý·ÙyÅÕ{uûB¸¹êôºùÖ=–ur©ÆüQêÑ{~÷îµ®üöyȯóÊ<>üþ` ÒêËCÍj…®Ÿ~qÏž.óÃjzÛ[¹?~4(xç·­ØßÑ_²D ~ÃV–bw‡¬š›ã>nÙZèÀ*]¬l-þh. ×Ô|ãGéöºÓëæYu]ÔÑ•RÚbFpSïÒ‹k¦„_Šé»äŠ§= Q׎ßuèà{qÝÌ{ñÌÀ1½­¬M'|×2‰j-|ü¥å¦?ó)šEx¸¾l”ÇÄÍN ˜·pý¥S4YÜZÛ¥ÀmEÇžu_dFþÙùG¨ÞFæ󵃣ìÞspgQú7*‰ùÍ¿¥-¦l¦Â¿9íù?É¡’áúžeU&àTÒ{´ÿÄÍMýÏ"„éÁ7.'V­ ªf›þoüÇTo’{tÿ÷ß”Ù^ÖYÿ¥_³wcÆÿ€wP*¡Òò3¥´ºØ …éàªú]¤ê¹— óW ¥Æ| „ük(³wcÆÿƸ÷ô29!ÿŸ‡o2¿= OŒé¿Ö®ž3ÅðààåÆS4)ÃãÆÄH2÷ 3Ì0ãoñnˆöÎ’ý¿îPy4,N¼'¯7nЇãb·O¾GÛ÷hBÝr~âü‚9Za†füusCŲà5Áç‡zh8ÂöNi‘ÿ¦R¥PjF.qJCÄؽ¿¸ üØ‚$šSÚ™a†ÿ±wCÃØZq’@Áó2µR¯-uñïRCªÉØŠÚð‚ÈÚzÚÿ¬)çÕ­A¯jÖuô0{;f˜aÆŸ¢ÊÊ|`êµdëfÊ“NGňoÌX gL¿1’D !,ì;'£Ž¯KÉ‘×í:ªa`7ž5œ5þâÊ”ÿJï;ú³·Â3î_3ä$عw 9«É“Äè ÐÔîÞ¹Qw!õ⮓­|×ôr0KÓ 3ÌxqsC$]ê±íÛFþrŽAd¸¸ ÷õ«-Úµ ¨ÌÓá85òÁ™õá±5Ú|àîª1O¨Ì0ÃŒ—ón$}ËpŒ JõD%·J/ÌcÄJö¦8áÜ•ßçæSïÚÝ?šðNAg>2Ò 3ÌxYsCÁªê(¹ò˯Ô÷Byƒ¸øýDúÄu!Œ˜xú@“Égl Št€Ù­1à 3^UI ”‚å…ðßf$>ˆgm|[ïb+¯L]1ϙ̨æP±/mnÌ0ÃlnÌø‡À˜E`†f˜Íf˜a67f˜a†/J@!¦ïÛ¸›ã„J)@¶Fß ’6¿sßmJPP½óËFäHÆ Œ´q*1M?ÛÿÃ[ö¶6pá+w蛨;1•×Ï ¯î7c]µ‡.PJYZ¾mNJb†¥OÇc&²z @Æ\ÚðmVŽÖ¯÷Ìõ<‘†”§†\ÞZ.Ùø÷]ËÏö/d_3à 3þ«æ†R™Ô©cÇ1uAHyÒ™¡ýÞŸ#ŠaTôy©ÅVZˆð¥^X^ ]ø–Í›Ûk{pÄJn¸•l!Tµ"ú¢LÉ¡y§  ±"e+!(X9$½‰'ñ¸¬!~çgÃœ,ì蜶tÛÔ‘#¾ÛÂ2¥Û?îä?|M;g«+«†÷^Þªm@öµŸï8Ùý£册“‹zäN>Óª®•¹Í0ãÛÜPJ8B‹’Âvý}—½l‰½—€’²(p {/±Êê…•«?Ffà!¨œýí<‰íuÏ}°…£½gí§3¶Òˆ¯Z'[6<ÛÛÛJÐ×܉6·Èû9­º hÞXzn`©ñÈ{eî³´hIEôù`ÒÚïW5í¼¦ 5¾éˆunÞŽ µz ¯}8xG«:þ½óŽ¢úþþ9S¶¤7’„ÒH€Z¡„.Q)âEQEAz¤ H‘¡BèÒC*iÛfæžçÝ4ŠŠå÷XæýÊK—Ù)wïÎ|öÜsï9G·WQù[Ê  òZ¸szë¹Ý«²Šô-ú=ÿÌÈ6¼ôç'š@^£Ñ\%7 ,fŒž~ÂçÜÏçW=\îÙåÙèNñ(ƒ¦n³ŸfŒ@kÙ‡WWמ£Äé~O´E€Àvs1~”[aOÌŒrPx5Sß°ª5**W¹AdæŒß|RðïѨßÇÝ" üˆ°àðÜ/÷Ï®]ø´a¯`¸GtëÒ¤›1ûâŽ+V¾<³ÕØåaá>{èÍo]Zôœó=GTfu$Fè¤×™L "ä±$ùë—¼Ÿþ"ÕŒ<**ßÁI&£R×ÓÏÎÉüe«ˆÉ£ýä!£U[7 ˜MVe b(Ú¹9Õññ¤ÅlbT·Ã‡ã;|˜qü»¯tòÅ~ž³E©<™I–‘mZ“¹÷ýÛoúd¨jŠÊ߉ûªhêê_x<Àµäø¯™55ýæMàþ‚üĤ˜Í[ G‹,ÖØ+*r.œ\4fÕ;Ï町 œw0ªI ¹$³07›ddòŽé¯5œM³øûqy™ÅVuBSZ©Ù×Í€Ç[[&ì?aùår^”RQù[Ë €l"ÿ/õŸµ¿ßð>×~œ¶dòLüCÏ-ò"ǃí¯ê‚ÈñUyàx@¤+sÚïXü±}ó)£¾ØÖ~Àp€˜Swmùôm3Ç#UdæJ‚·»6rbñ³Œ 8 ¦oÿ£†¸k¡ôÌ7“µÏ~øF^@ŽW¿_•¿ó`ÊêÂA`h}Zw}=NàA’*GTDŒ)µŒ¦°Ú¶1¹æbò…â¯VÖ÷å#'×$~±ää×5–Þ]æî Ÿt8’@QH6WyŒÈ9fLÌéŸx±…èäf,7ºG>쌽cZløáÅ–¼À]xŸéc Ù©• xæ¿z|wÛÇІžþ©j㨨üMx”M"àPA2WŽSˆPƒ<I¶m!Ad…¬Ec@¸§ -ÉB¼øÓC1{ðˆ9 Šds'€ "0…PÐÖöÕÈõ+þ?B ÑTù}ÖÍä ­pµ$ ’2ToA¥FœªÞc;1Tüôa†ˆ-]iÍZÿWµÑ–ÒT•ŽïFEEEE•UnTTTT~ ÷/óSŽÎSDþ='ÏàÐê&!»³sæ«ÑÏÆõ|ìO[S|dâƒßš†–‡*á™Ï9…ö¸°ïGAàmÊѯ×ë¯ìšór» +µé‹vl:Æs¶Ò4@ç¦ÝŸñÐGc\G|ÝÈGWuJ3vÌœ*‰5ÃÓ™c»9ñ­½­ñ _=>déÝ#äØÇuèÚÙjŠò™ù#,½–´ Ñøtl,×Êïݾߨ‘Š @@RáÖy¯9·ÿ¨CÛ¥yº¾ý£‰ÈÎ3¼nÃÎÛ·’¼zˆŒ‰;¾ø†ˆ€ sñ}6:.Z‘ @àä‹[çß¾r™iœücžŒn«Hˆ×6N¿‘šFDœ`çV¿ypüÓÞn"# Rö4Æeà§ÍC«¾—«›'çRëÎ?®¨9ñUþÜ•f^/¡«w o¹Û‹H„EGWfe¥Õ ¸‹ðç]K 2ÓkÏZò A¨H=z»ë]cÝ‚ãLYGî<ÐsìÛŒ =‚\œy•1|{ÆŠäJÏ­=~¹¢çS£…qW¬4ãºÖBµUÂR˜r5êõu´•"G z¸€ _,JȉÀ$ ^(L?_Ò|—[”Q*ce¿ PyÖU‹‘@iÖ mw›ºVµµŠbkGyêªÒ §ÒͯRÜj´J) S®ÇNZâ$X¤ŠÂ[û>Z´NÛcæ/-!¢ ‚,ýRóPЀb!`e…ié]^ýTàˆYJN®x9åÚ¸AÏ>)+`ÎÞ¿vö.±/D÷{ ”òk[¦¬øÉgÀ»«õ" Òd¯VíÚ·•%Syö™}S›ºÆLì5z”|ü3}WøDä'»õ ¥m8ºýRÿ/æÈL]H©ò' ¦°i|½C{¯Zg•Q„‹Çvx†ÇÚVÓ Hy‰‰«ß=¼bVÊÕtDÈÛ;ïøñ«¶ƒÛ{Þ¿t& ¨üÚ鳬š›ž^b')÷Ô©ïß?¾eµÚZ € ÅŒ#_oÚ!£ ”«ËžpµwômêÜÄÃןx­WH¯àh¯ú¡U·9Úûy…D{G¹Õñ­«wH”WptzÓEbàémû ‰vsÑ’”²|Ò“'÷ìD T¦ë©ù ƒ bêÞ›ßèThaˆ ]øŠ5k÷kËõu#=«.íéç„œåÌ¢ ÇÎÒÓ³Œ•i~ˆ¡[`„gP”oãNí'mŠoç¾oöG¥ââ²7žJÚ¿‡Ó>¤yÝÜ=oä®%dµGyÀFžA½ÂÚvâñ;g’ex¼»ö¯~K{éÚ´nDûNï uÊß´h ð@¢³ŸgP#ÏÁž{rÁö’ąǯH¨ûx³PضrðÈë`ÿ·s"Gέ£UkTþßS×÷*~žj–ˆóù›·CCÂœ *Rׯœ1Õ¥AçúMš]üºÿ¡ãÞM¼®¬øÐD@@¥'®Ýê`ÊÜ»|òXûÀ6‘ NÎŽ?“RŠ‚rî‡w_üÛÔ r<°äSÑš¯K0¦ûáå#›¦ä ±~ªçá@×ö%„·ŠaÁ"Ab? B1xèØ’–j·oÅ…wÍ‚Dĉ ”\K^9y阖Yåní'ít×ppaÛ±&ñÑÀPÐjô¶Siôµjs;M ñ¼UsÑrçÜMðoVß¾cßCËvÐ=&‹mRŸêw~É”{)ŸoßhèëïjJ–Œl¿õÂâ2ElÍ“Š.%-mÉØ6yŸNSv8[•‹PР­=Ü8sÚ3ª™ ƒéÖÑL®Q|ÏF²bS f¡Ö/¾ª$Ï-3Õ¾8ämu IDATè;>š²ökë¿›¼ò;÷ÎíCÖæ׳íĶTÔGGåÏLYÃ<]Ê3ïû¸fü´´ÎcCuÊ>@®­|¿nŸ-áÍ‚±î«WV~ôN›ï–º9}r'»ÌßDZ(q‹1´o}8>¢ßýb= žçíeógGÍû0gÝlÖì­æ:)8Z2o¯=<\úê©S7Xd§aC¾{OÃ@aD(@ê­+ú4¦?;D”×ÁO/´¨! C¾:hOÀ;5ê?­éoÝØ»øÄü&ƒ&Oš7àò§†G _4‡—Áê AnÜ)ìêãM˜÷óôÛ§Vµ‘×;T>¹×>étµÊaæÈaëZÇGÙG渄ŽÜ»}¤¼þ´$÷ÔÜg(!"Ú»;Ê¥ùwÁÍxçШ3š™vm÷w s:Ê>Ï xủúÞ(ölÔeĈ1ó8 *S•'–®z¡-"˜K ´þŸö¤"ƒ¡$_ëæªQ@©q rŠÑj+̆Œuqìð @Eqí3bÀúÏ'kKÎvq%5öUåÏ“ ¥Cÿ˜6y}Àù¤cãç+'÷GåYYX7ª¾Õfçë¶çq£d„ÈçÏž h{-iGXì<²”ådñåûÆýp€ €Q)3) rsÌîMý@DpòñaÊY@0äç:xÇÕñ8¨ Aºœ_ÔÔÛ›‡?ûgT1AïåI~úê-– ëÃ@À€sökèîãw3çñPQXàèÓÒ£^ UaªÄ™+”ŽŽœudäÙí½'žêe mG¼ÐÔXÙ‰ ^;Ô¡±]ÕÈG±€,oÉ>¾óVàÿêe_I`ö%§dž»Ý;ú#BÙhFÑήR .õ¹×õ»UÖ¿ÚD7W€Fƒ²,[²Ñˆˆ$CÌ;{¥<üÃûûÄŒz/8ª•^‹%Gé;Öü7¶dË}ž”Ks.íKXü!Öm5pVû(?KuøððÝ‹?%¬co¶¥õèéA ›i,Úó™[ïiB¥×œd£ÙÖ'Qª9Y£˜ËÌ»{l–ÂK;$¿òË.€spЕïæ¶üxÖ½‰Î+2’%g?  \’}qO¢ÙB@«&ƒ>íáe© .sŠÎl9ºæÕ=ù\ܨw#›Ø¬$$‹€®ÞcS‚÷5¾z2»U£pÊý:­|µT™OÉKŒ\¬£ý=×&Ž§ëÛ÷èš.«öN3ЉÎÅž©Z£ò§Ë “í‚ëÕI\øqƒþsrÕ¨‰ñKÞµŽyäíû–<ú‰0·Þ>.ï^Y÷ kñ”§ èƒcê߸¡Å ƒˆÀ”s(£$,8¬®_¸÷ñ#‡ä­nžI«´~ñÝ&uxÓ©%·¬×aÆÉ”„kQƒ'3ö‡‡RÏq5ìà8ÀZ?òÈ,éË^{Ö£Qï^ NÙó ($™38„ôìñf/ŽÝ=±èµK/öœ›˜x(«ùú Ã<䎯½ƒƒ[¿ôK×@kP eÍ«íŠKLÞNTÕ64çŸÿyþ[~£ãõåo¼àݯßW§õŠB’Q1Sƒ~=ßîRþñE“N-¾Ùo~‚½UÖx@J®åP¸» ¹ø´oïzè½ñÞžkç @sáÍ K÷D¿´Ic“BŽã1Ù’¶gÎ¥’ÀaC‘¬&DTù+åƺd€Z>ÝoÉ´¯û4nl­«D¤@Ðe¦ [3cŸ“XXtW~|ÆË“°aTìÏ»7··[QˆB†.½úΰå“×Õq…¼üŠoÿˆ®=?ñ=Þ{õkG´en Z)¦[:bk4–¬ñUóÑ@¤$ää5ô«ûàvUÿ“Ý»ÕN}LÊåùÝnð\¥?êŧ_lÆiØž©ùÊu \»ykʘ¯öËcµæ\0pŽ³8VÅR–o`îNöÕmº'PU+»ñõÀ4«z[–ë xgBrf½3‚l1¦a]çûÎ  ã´–ÓzñŠrx;·º>yl@+…§ »p¯,1`ø€æïûü²8±2jŒ»»ñÍ^  -Lïÿnt„,Sø³ßßôf'“QâQἂŸü¾EƒºÖIüƒóVŸøR±”Š{pŸÙ4R­©nbŒˆþÌÅ*ÿ1î«À‹@•~GÛRä™9äx@¦1²Mf ò0‰Ø–ÛÙvC lv ðÈóŠ ¼ŠåNG¢Êëbµ(‡¼²¥r €(ˆ T-E±ž™¹ò ±~ÚËz@–@Ð< dËos}V_—ˆ8@©ÏkdP辫[‡W2TŠªfqÖ–×j)À=!!"/ÖT?` Užˆ¬†5ëPÕ÷bý U©ˆˆ¬oÕº8ñ"EyHؾ®ò¨r£¢òûPåFå×}j¨¨¨¨r£¢¢¢ÊŠŠŠŠ*7***ÿ¹±†JŠêd§ŠŠÊ_+7ˆJÅ…åSGž9rðÁÇ****¢uÃÛ7üÊdÊÞ½xd‡Ãë—–”Û‚ÕžRQQùƒ<`Ý  ¢(]ÞþÅ¥ ð¹¾/<Ë©T~uÝÊ#Z7•w0ë„·ñ *ËÉ 5lFEEå#ÜgØ *åyWþæ=ðnÒdðÜöêZLj~•?Wnãõåo<_§aïÞŸ'Ù!(Ì|¬ö”ŠŠÊä¾Mb‚È)2jШ< ªïFåW¹×wƒÈ)²õ…Ú9***¥Ü¨¨¨¨¨r£¢¢¢ÊŠŠŠŠ*7***ÿ<¹É>¶èè®m\µÿ˜]]6áÔµ "AÉ«¦$Ÿ>Çý¢ƒ™8KfòïþüåÄÓ‡¡ÈšaÜœvrÍ»ûW|œSbÝ€‡Â ›};ñЪOŠÊXíôâÀ I{¾z» ¢úÌwN,ÝýÙÔRü3ûæöž©gNÜú…Ä•&ì^ýƒ(Þ=ôñ‹Ù5ª5‘”¶ï« ’BÖ°WKæžÝŸ¼vW²QQåæõD-€!ÿz^fzÍ<Ù%7 J$`ùG7Ž‹¹uå|aAqÕa¼îË¡MœáøÊ—ú*ž±‘ñýJŽÍÚøÕ"^@¥èŠ׆8†ti²gR\Æ] "¦®¿uÝžz±ëùâ–‰ñéw±Ö¹äÂœkç/û±j¹3¯+»¿É½’,ý‰}ƒPžT˜_~OŸ€µOˆ0ëÐVtrAfʽtÜPSMXEöÕDFˆ76OÝ´|EþÕSö £¢òŸ•"äM9·|°hÂDYü¥SäÙÙ|JBX€gÕóËҾWco^Zf°VªµG+¹x!`ø²V]zø6Œï©ß8®~·W›Çh®ï?rÏÄ<‰ÍøÌ/Ê ˆ€€elË[:23ز²Cúñµ§6~zîÀv‰(>¹*ùÔ•ªBæw¿ºr6 Ð’qéçoOmù6+ÓZÈœ8 dZjãçé¥çA²©ˆF¢D-ˆºêÒ)uàç©a¬:²J‘ÄŽªëX¾wFÜ–/>HO¹m­1à;¶]|p ÑÁí¤ÃõµÌ|31Û¯KkHº¦Ïq9ë,fè0a¹·‡Ž8 ùÅv~a÷–W‘”§ ×38¸¶wKH\OŬ‡–ã³:žJ¾í^?ïì_1ái³LîAü™Eˆ‡¼„E߉RQÒ²š5>îžNÇgµ?{³9¼´è©C{Nº×ÌÝýÖ¥[J¥€BÑÕ=‡>ºbÖ»äÿìÜ·8FWâìloU#^[Ù9Zu:›•cbŽ¬Úêb²ÿQ‚‹qÿûq›?{?íF ¯©ê{•3÷10KÎOÓ›šE>6yÌK ds•ÍwO÷ùð/«…Jïd-E÷‹#‘&¤ËKá½^ÊOþ1yëÔƒKµýß^ä¬ !qþÀ3§/:Õï7àÝ)Š¹¸Ì¨ u¨¬‘¹"W¦(Äd"NÄŒmS®™º?Ý΋,÷ÔQaMG?³töâVóÞEéúÉËqŸ´I_`Î9})ÏeÔ´)`&lÖ!59þfNQã'½Ý>ÊL- t*»°»Ä·Sƒºpæ½±îoiÙÅŸB Í™µpöÕ3çÚMY\ÏSÛ©ü•(P.º¸yÎóœwÛF½ætnè/Y€d@Ó…–¨'œxœ÷ÚWÝFÔèt•]q_ç0!¸óø°ã ÏnOÚ>íàR®ï[K\í5êí¨ò_’RÊKË ¸CŸ&ÛÆÖw\[!Y÷Ä Ðü€ÚFäõ¤¶ÈË«NáwÅõGù8ØÎb,»¥up$P‰ ŽN̺SÞÈß=<¢å•³GÃC{¤&m lö™ ·¡Üø榳ˆ&¨(RÌ™¦ ÑÎY Š îõÝódSA…EߨeO¯ºÞŠ\íÙ¹r(©Aó·™LÌBsª|ל¶øÅ!¿Ò928ÔkÒ,-wËF“$¨r£òß’âõ¡#¹¼þÝÌü{·{b¤»·—ÕÂ!Ùlª€ÊrôŠòpãŸ#Ã7M¿šR÷̈…ûÈ ¦’\¦q³C  ]Óggß|ºýâOêzš ódpæ )  gô¹"w}zîË`~p5¡ETøéä+ÞW÷5é°€I¶–qœ†˜Ð:>AI xhòiHë« ¹mÆ20‰œ4vU» ›| €bÉFN&f­£²Ñ@:ŸÏ~Öîìê7~Ú<Õ¾áˆ6}žp­ã¤ÝºÖlHd¥c dX*»“Ì¿Ø9`Ì»qqó{W®û·~zÄWûÉ ¸>±ŠÊ?Ëw²™BûÌüIB÷ÞÍ-¹ä­·Ù/ºŠ+´É'²cï¶Üöåt÷®óGÏßÖ¡ÿ@f¸³ù• ß®&Ñ’\Ln:4$sÓàR¿Ÿ£{Mä wÓ¨ Jÿa“_F ³¨|€¼>9éî¾e·R”à&þUoÛ{DZŠ‹Š$D$cŽ¹"<È€×îu’/n^aŒxÜOºÐV>ië×K&°˜À“|ýÒ}ìœÄ‚Ì|Ž”2n]­°~2Yæ ùøÉOµ©sàÓáKg~‰¦¤c{/_ ² "‚­h7'°Äé-·~>͵ÃG£>ÝÞqà`kç¨Z£òŸLUÊ úÀ.}§wåéA;Ùž¥#ó†ß)1šË Yê¬uGç»D?Ûm@¿ÖÓ“âˆ@–¡2=·êâ›Ý—[âà¢+/3ø÷~§®ÔìU¯í-¿Eƒff×dȇ-9¡âÈá‹»âuS²ºiœ"wrXáÖkƒ,F{9])oùŠ3Wi9p® û<½õµ¶>ÛäŸ=ªo9ÅÏÝH‚ͺþ¼}YÄðM²LD0xåù)V¾¹ÙÛS̾Þúm$Al×®;ô¹Ô°4³8 M˜ÙV‰€ÉàÔpà€q¤íïÒu¨¨«Ö•{z‡€+ݳqîÄ){Ø÷ÞNÚ½½®å»§b-V½ Uþü¦¢½ÖÊÓµ_rÖgŠðžµ}T½Ûƒ~ì±Òdû§mg¬>‘ƒ‡³zfݵÊöAä‚-yFåâ–Êd•W'Û†{.]Ù@„š c‹£êŒDˆXÙ•ã!ë»hSÅûoT5…Êï³ndíÜûÂö4"âýëÕžŽ kX½3Õ>–~­ Të257VÛ Õç¼çꈾV¿G5/ý€©yÝÊÞÀZïRåéA ¢òŸ÷ݨ¨¨¨¨r£¢¢¢ÊŠŠŠÊoá^ßMiÒìÓgK – –¹7Ö4v¬>ÔeÜËüïu]1%òñ®ŽÚÿˆ=*Æ{=ÀÇVLmÐï7gý?âgâÊÖ·ÅЗCÂ=Õ›XåŸjÝh}ÚDwˆî¨ÉMÊ1û6íÝÑÓÇ,y·ÏþýÆBÖÅCfËßbÒ‚×ྗۖ‰xo /6šÿ!Ó*…7Ô;XålÝh}âêû(ÇdÖm^¿E+ëzº HrÅ•Ÿ×XÈ¡~—¡ È•\;²£´ÄèÑ=0ÔG‘«-"à8éfÂÆÒR¹~§§ª¶r¬øzÂŽÒ2££_óЖÍÈBÀñ˜uzk^vžƒ\hT$!ÜÜÿk£§Ü=ô€Ÿ¼¼Ô®Wp}!yïOÍzöº´c­,Ö‰ì<ò’/:©©Ó,¢u („*%7¯ŸJ0Ëßê¸kàÂîÅ º=“qdíÝròiÞÏ××ùÖ®9Ùe‚nËwþñÏù8ÖV_­q|mA‘Á«Y?W…!REJ–Ò2£½gdƒ¸8f!à°äæá´k×HpômÙ·Ž›£êÙ&CÊú[†uñÄíÛ9Îõ»†FÝ:¸º°D ˆäîª'Ž“oßRTP¬ó oÛ“ÊÎï\Ñí9‘G ¢¤¤“ù-z÷à2¼“}G_7*2.V1qZL?¶9?·Ø·Í³œ:Á¥ò/öÝð|éÁ_’µî–¬›^Žr¿jlû¬BæäêpvaÿCÏÖÈØ@š¾ÝæÒå\gw‡“sZ£x.ãk]ogW¸xùdî~gݧ_ "*ç>ïuìÈ­“cÚÖÿmÛpy¸yhQaÑÚÆü3ËS®"+?ûÓw?Ï{×98V¾ºüû¹ïïß•èÑ"ý§‰Çžå·¶­xã9ï¦çKö¼Õ&%_ÀK{–ïý`´Ù!Ì«ŽòóÔ.™wÁÙÛWRx×úÑ÷F)q¾|6³ˆ´·çÍniÅÈãݯ·º‘Qæèá™wâãUóV ñôû[–­\üt\ñ®©íR²LXcªÛœ³õ̦¯åŠ>A>Ç¿°oæˆ21¸Ž>{ÓÔÑyÞxpF‡3çR¼Ê.¬X>ùBÇÔý«RóJ®ïú.§¤\óãt*³@ !Wù‡[7¿+/løò&ož06ö™&€‚eÔV_uÔ†D4Ò5i~LÇåZÛp-ùR Þ£_|…Y ¤u»Õ/õÀü­Ó‹¼G |æyÅL!¿øR®ò?×’I7ÙÈ/ÞE 5lwtÍO’ÒñÁC…5|yõ|Ç_šôNûWOèDhÞ²Õ¾ô+¢.úÌò7Þ9Т!ø{goøìÓúï¿Ž¾OéïLB«€ƒ‹r¯f¶ˆŠ&úDµt¼gä„è2`A«Þ$@ÑÕm¹—oÕkå;q»GH bP5Jy{4ƒ™‡:ÇÌhÔ¾-1jý$§ÕÔ\IƒÈsûÖ]#@çÏ*bÞìšV¾›#r  î­× ‘c'¼ÁŒܼCʄηJ•vm}vüx4ü…^¼©ç‡ÿïÓÒ3«Î•DŸ9Y6@XL×´qîX&{iË/ß¼ÓcÖt=ß }·­/4Uo_•­Ü>°Ž y$&¤^5£~á–™ßr'¥–T€g¥/ØbÈu(0æΉ< Ÿ‘VêިʀˆèPÏU(Ì-sª¨uä$ DFõZýßCÓ~q:74ÎÄüx@yÅdáàn^® ퟴå@RJY)@ÌÓQc]k̉&: !Å×ÝÞºº˜×é˜lâmé¥åÛ>Ø©sõ@`"…¿ôÍõ™/~³K ëøtdÛÞu8bµœÎX'ƺÔðòr´VBæy’-p· ËÁË‹·!òž¢’™k é7Ç®°ôrÈ]“eŒï®¿³3K+]ß4íY"F–ô;’·Oº"i4¢²$8z;ª·¯Ê¿VnÀ¶¶úÁEðôMï–öP¹ W2P•9@Êq`@¢€²-ßÈŠ‚@€¼‘ˆY+ÿÊQ S”Z ¯«vžc–Fã—6ñªÞ×b|ðgx¸¦Ö|%ÉK÷H½âo¥"mÅÔ‘ÀøÞïíæåÒ+»¾Ü3³Sñ?7‰ò~è5¸Z[y^PKeDI2ˆDŒ q¯ƒÙ9ÅÒîýÆj$àyA?dÊkº@PLÀdÐÖŸ‚b‘ÔÛWå_뻹Ÿˆ6þY–šL`1‚t÷ÖÕ¤ëTãW^cï/•—V +9"I ˆÕoTtì€-™É…ÚÀú> q R eÅ@Θ¸dd;ƒ‚Vo6•#†œ+¿>ÖÇz ÝÒw‘L`1BYfRÚíò‡ê&Ùiü’ÿ9£¡ÌÁË_4c—0“C@Ä´C‹JJ-2:…öœÚ¤eë¼Ûg~«×–ÀÍ?Üv«”É\t„ˆ { h×12ùÔ…[)DÇ1õ”];Wh‹,óÅ]»%Ĉº[b@4ßÈË4©·¯Ê¿ÈºùÅŒ6àÒc¥oB·Õ“úyf_Iº(˜ªÜÆ„Êë'Ä{ÞI×k´"éÛ¼×ø耦 ö ª›™|¼ñ°åöC`Ÿ~‘Û^sñoPœq£Ñëëì¢7Û¾d‚å±Þ9'¸4‹00å¾6ÕjIýì×Þ½æJCGSVz~Ç÷wCUèe̓ìêy8þôÆðÐÁ_´lâúâÕÁ²êù ,pç¸sׯ@óó’âÂK·LiçÖN4Þ̾UÖ}NÆ~c  þÝ»ÄoÞðjW¿FÍsOvo÷ž‡ˆàÔmŽïë<¢§2}ºtܽnB'¯ˆ¥—)ÞCÃÚ?F¤‹m°gz—:! R˽"|˜z«üƒxhD81ˆXcZ›!W™{†8Éö«Ôš)³êë›Põ®Õ‡h;¬ùq°2±E=ˆUm±_Ú®[ÕäˆUåÚ¡W´m©ñAª^1[gÍâ¿´'"XÛá5{õG¨¡6D m9zjPÊØùÊ€VæÕªµ3ÖÌùYcO«û¤ª?ÿ¨á*¿ßºA®ö8 ‘ÃêˆgÛ]n‹è®51SË5<1÷^k3Ö^ã‹P#µÅ½!é5OR3]â=ç©õAª^#r÷Û#¿¾'Wã³àƒÝA5÷¯}B¾V#ï;ºÖΈß ïïj•¿ïFEEEE•UnTTTT¹ùuˆÀ˜~pÉ;¯ÔŠ³***®Ü¨šëÉ;·:ëFÊ…ÞçT«HEEåÏ‘kpKÁͽ_,›øš,"q‚tiýÚ¨ççJY‰…¤Ú7***Dn¬µJ(Ï>—´ôÅ¥SžÍ)uŠè;ÅÁ|ì𞼶C`õž€=˜ €H("Ê ü¦Å†„%‡ÒÇu‹ŠË {®·{¼?SþßÉåÇ7~×bÈ«šßõkr}÷Çú°Ñõ\¡ø¢\¡¿rf‘[Ÿ)úäOn¹ kvo ëW w/~w»¸mtÛõ QùK­ÊHøñNiuQä,·Ž¬-5Æ”ëÍ®n¾¡n¾¡z¸¼lÄÆï6Z÷‚‹û2 Œ.ÞÎ^þ¶¿:õˆ€oÝ8¶ÇÉÓ¿j»›—ǃíXÙõ„c„\ê± 2C4\¹|,‘j4åÒ+_ŸnMeœùu×Ë·óË"CLÛºH²×"AÁÉ‹ÊŒøÊ)ÎL׶þÎÙ„œs?ä—òìâÊoìê{äŸÚdB0gìÉ,–95óò½ß‡!cÏ­+êã¡ò[7¿üÜ2¨ÛªO˜³ÍÐhÒµõò # ¦ÇíuÙÆ5ìÐE¹¿VÚ5è0„«‘ýH3aEIDAT=8MírQ o¯(ö¨È g›^G2¤$Vx—€VDSÁ¥«5|þÕÛýÜñÌ5Ù¹ÎO:®G Sþåë,¼ãÍ3§Pç/TpãԱи>"rpézJãnጃ[—øůJ9¸Á½Í @©¸vbo@\?=G€–”„í’¬­ß¾·Àî^¿váVX‡ÇxÌ”—r6Ù š&ý<ìxààÖ±MÎá]Ý\£ô#ë›qÑYKj¡);)-%MëÙ8ÈÏrù¢Ò ¶ 0â©"ýìá²r£]ð€ÆH"D$CÆ­sIc}ü½#NÄ‚‹ûòòJÝÂ;:JgóÊCëk«{“Ãò´39i© óˆŽ×ðµbÖÌY{3*šÕÕßÌHMÓ¸†E5­%Åw/ÞT":8AŽ`Ñë@ã¤í/Íî™4´Qü@O/{ÅR;ŽãŒ™§Òneh]Bê7ŽbDÈ£!ëBVê ]ê5é¨×¨+ÊUþ ß Z^럠Ñ<ìžbÄÔÈÎ UGñ"püCbÆsvÍ\þr—•¯TþMè´þ³Mœ&dÈGs€Aÿ8ˆ‚P¼wÁäÒò²Ì#Ÿoü`š ÑŠ¬‰×:¸óvf`¼ÎQ«ÕÀÝ£Ç×ÍÙ½è+½›Oñ¹o×MC€Yò¯Þhøâ1·¨Ð×ÃKÇóe”àhÏ»§gŸ;_Š–‚Ã'·-Lºa@¼»ýÈ–ä+»ÞÉË—!'qõɳnæ”ß\’|(KÈX|p_*ðìzâ¦/'žãyóÅ}ËÖëœlÍ’÷óª÷_»[bÌ?ñÉÁÛq8àùòíov:›tQ¹±yòÚ¿àyTÊÎ.{e@fNY ŽÍëyôÄ ŽÃô'n[¶D’L—V¼”°}þù¤Œš6ZþžIÎ3Êp÷Ò¦U“†—)µÂòMé«N¬ŸøЧ:^×Ößwð|Í´DE7ãÈ -ÞÙçŃk÷•97šº#Ð¥$a^µ¾•‘r“j|™æÜý?oÙ!Wä$/sèL"'Ì\÷ÉŒr3+»¹kí¤þwe5)€ÊŸ`ÝÐåÙq—j:>@_e†TäÜ.*“ˆYÊ“¾£|ÓNk½©¹ÜÓïâª\®Í?è=¢ƒõuaúåêru}z¿=ªÿÛµ¥ ÌF°s°½“›m[á˜Yû]8À–aß¼»@¶s¬æwö Ô¬=èy¬_×Ó2e·š½Ê£À×ÿ÷dº |"N[®È@¦³ŸC˱vH77–Ôïã`ˆ˜xr3×â™â“ß?õfêÖ]m' ÈÛ±Öí±÷ê]¾ž“~Ãß72óÒ‘ÝOK81 iÎîÍ>}¸{û>øŽõžcNþƽÿëyÛ(½Û–;,6iã € ¤,Ó½ÛšV½BŸJšÕÃZÃæîÞÙYºþÏ¿4U1QdËf‹_ËÆ—-g· ý€8"Š3-~ïÝ–ñß_<¸;öù“ ‚íøÇún!ZÕ,YaÚ³í`¿Y']í…øyŸ³ûÛwkEÕæˆ%…=žzŸ<·[ºá8=UùK9çÖyÅmb wÑI ˜Á¿Ãø n/UÜ:’°æÍý9em^Xê ˆÈ”/¿«0v8½fÇáøVƒ÷oÜØmj¢Ÿ§„Aö8ø䦟ÒM•?(7Øð­SmCm7º ‘¾Ö¨ò®Å›ëÞLã@)Éϵ¦Gt8³¥¡`u{Ïêß¿­ÂªœÎ`±”]5³êìb£‘}t•~CÉYæÔÂY(§Ñ¢b–~k3ûHg „ u÷ËròÁ×Ùú”¹íÉуÇ3) '‚£ŸQ$¨Wôójžvñ`alï©‹† 8s.¿éD?O—†ëÏ_jÛÆ+#3 ßȦo(àÜ ‡>4œ¥='½')pqÏÅ°ÑH0«È0-÷jR`ƒ‰ŠBˆdÉ΢ºCƒ­Õ¶"ÛžÝ €•^àÙ”“€!‚·;W’ÇònÊ^/µDäý»hq¥ÅXPV":ùØ‚BöÁMÝ®ÖüV¤kÄ„£ Çq€hÊ7 N)¶ª½¡g"@ÁÑÌ…U*î^;Á:v„9È™:ï1ÇY6#75#4̈i¼;Y¿JÁÕ-Å(§XÌâéÎ!¢¥¸\ñ¾Ìqݵ²žÊôÝ0s¹Åh«x¯ÈUe¿I¦è ߇9ÜXØõÄsQMÂkܵ&‹júnÐj¡kß7¿¯YÙ6÷Ð ‡Ž×Ø´ÏvþØýîêÓüŠWI&kámR$ÆÕ ·à 5¿°[]o!ízRýÎ ‰@ôiêž?£ ¼ Sðväµu¹"3˜‡«£÷3¸dzIª"GÆ:z5Òd|Qq7ÃìèÈ@átþ:>Ï$§ä—‡9ë|}½ó3ïÞ¹t¾~ߨª:šSlýÉæáå9ŽÉr¥7‹1Ä@äI‘d€€,Œˆ³é³õ§5§£P$™º¾þµX¹EI¢–£ºËíC%þ1îµ\ÎD€È$cÆ‘ÏlùÑ>(¾óÔý.vU³ˆXˇIrü+ ÝôÕ©d!TÝ7*‘«¸êž&‚çLœøØ;=üíh¢:íÆŒ_{#(Êoó·Ø@£‡;9¥õ¼œ ïêQû ÖöZdŠ ÏýBß¡˜qá˜oX7E¦Zz„˜¾rȤ¬à^3G|õ(DÖ„Ž:ãíÝ„ÜÔ;N!^P|ë„àÕÒÑŽW!•¿Zn‘íŸx®ëÚ÷|ºK+—pÞú“ «²é:¿÷½ýƒ‚û—½üºÖh<šKe³v‘×é…ÏëØkO|ñrz»»5åȻ݅¹]®Å^Øëñ”€¥ìì÷Ó_>ooñŽÏ=ú~ ”Y­oßG§€ ê4‘°p~è„#àÖiÔŽsBÇnB!(¸iB¡øó™ ž-»í\³>fÆËÖ⺱¯Oç:`)OàØb@áøç\;M$(º°jó¦c£?øºþ3 ŽÏxyûݘ}0¨cÔÃúVS¢÷_;eh@XPzâÞúý¾r–Áqðí«½7ÎM¬ãX–~1¹Û´ýœštî½óË'î´h[xåbH×ÐLS­'¾Ïè§7ÌìîÑ/8—]àüÄü6œ(íŸ-?Ö®¹óC§D.;égßç?º_JêYõôS"‚Lð‹† ÉÐcÌËëæ÷»Þ^[~#+û}²I}~TM7î'’L¨±ªÙd,ç´Ž<Ç$ƒÓ;Xß!D²+x­=Ï¡b6(ìÞq¼ w@&If‹¨³d£›Y,f&êu¤XL&QoD’¹‚E$™-(èÄÜ%_/¸ýü§Je值¨µšûŠd2Š:f.ÏqŠÅ@œÆ×N@$Kf“ s@ &™ ‚ΞCBRL’Eõö€Š$Y,¢ÞÞ:VÛG¶ã9ÎÚ3(Ú OŠE’N$›$IF^+Ÿš°öT·Qû3…H¶˜cœ D !"‘,›ÍÈ :Aàˆ­=©0^ﺬãM%=zXLQï`­&Î$“,Ë€œ Ñ['ždc9hI6HŠ(jDDf²X@Ôés9 zf1 z‡{ÇZÖ¯0 b’A!QÔˆ@ŠQ’8Q§E&›I"@^«ç9¬y>5"\åÑ­DQïp¯-®w´ýLÚ9Ô6FPS¹3¯}ˆa͉½ø{šÆi4Unä5z{[ót•m@F_íÛ@4µZÎ[ÿÉWîÏkìjº8…êý‘«ñPÐUG»ó5Ú_û#×è@^£áÊ.ÎÞ¹!wجO`û®«a&³Ú (híjôžµ ¸ ꪿äñô·O¹ëýdw¹ôÖ©c¦˜¹A€UŸ €uñM¯lƒ`WÝlN§ÑZàõ´QlÓp¢WÝ*½¦ò«å-'hÕÇFåÿt0õ÷‚™Í#ü \–DàÐpbtꌥc[I ÔãíØè@F¿ÕŸJ 4{úãÄE¯~3æÜšþoq¨ :Õ¬ò¯Lýó ¥¿Å,  À`ìÑZEÖQS€ýsÒÏ«ƒ)•ÿ‚uƒ Èð7™‘E `r­AÓ#N ª³¨³Ì*ÿ&þÄ„† '÷ìçx›Ÿ¡ôòŠÓ?-C5Å…ŠŠÊ/Ë Õøï/H T'À;‡¾/¬0" â¨ôð×_eúîj±Íû@¼ ú"TTT¹±é“SOífJÁí“ÛLLù×o'íL=sÔh¦*­ 䀌y·}³tÒŒCäáÆ•DÿÈv #B,O=TäÚ´ÓàVIß,C$àùÜõï½”rñè£a˜³nèñv>Ö7ì§9Ï” ‘ýÞ;¦dR¥«+*‡¸ K€¥ÏØ|1Œ#%ÂÑx(¹°K3wDÜÅ_ÒUÃήžúÓ»Ó4á£ú‹Šú-¨¨ü'åƪ9îp,Õd/ü0ù*Oh¹k°8_”Ë„"£s«1Óƒ%KµJ]ÛŸØ f“²’6Ù‡FÛ•D {âǯ'±¦K8°…/X,\h¯);]žc2?V£ÊŠÊXn@°MÀòd‘ÚŒÿÜ£ju/,ÃÓÇüöùu_§zµ›Ø¾OV‹ܺu9êñFDĉ–+Û6)¼÷†÷‡Z¥Ño’½ô"•Ý>¼`\V¡Úoæè/ã3©“½**ÿi¹±Â¸ñNJ®k¸7”d&sîÑŽzŽÐ®åó«ZœZ´aJæ÷쳯Åä—Äxyq ƒñò–hùܧߡÙ&QßvÝ÷ý±ác£xµ§Ù>ò± ›;»Ù‘bk̨y TTþÓrCtýʺOú߈ì¨7¦¦§ú|¼ÍÑ:v–c†µ¥˜Œw÷Muè£Fä'/Ø^ó„• ªŠÊŸ"7DÀ¡ÀÉigÏyG5ç ²/'øE RdtN±jê€PqsÇúÇ5MòtÑRÁõï¼<À d¼“Z,1bRÞñyè9¸Ž‡'*E·®×ïÑQ–m~D§¿`<}¾¸{K×{WYÒ‡ÄÇ^>¿…k;Ži½ûë»aÆï—ã®ùëÕœ1B&ľ¸ºT$­ž¾eÝ×–£c»÷wõð`¦ÂÜ Û.ZhÜ:fäÖ®¾:ÙB€pûÂÑzãe€dC~Úef“®Âüës³\ØkÚ¥íË Ãu»ý}¶ã“Ý‹.<ÄòStñ¯®í,žX6còWëvz¥E§îή®êý¤¢òrà 6|8>fÜ#'øÈÉjíàÝótc´(ÈAÚ¦·ryÅdpoÚ!•[, q´«5´@ÞÕnç<àQu²R@dßèõûNkæ]íðþA‘« H`5lnóQ½ÿÓÍï üíÞKÓ;¥û>3lÙINÆH–9²’’ê¿m+‰­Td$¬¬.l..ÿu•¢‰¬çyþZzÛ¦g·moÔu:Ë_·n€Ì¹7õYëñúãŒuoþðÔâ-z‹zG©¨üÆÁ§ tO^Ø÷À–ŸÍfK¥«Ò.ðè+3bØ`Üš~o­éÿöÚA³¶:§.ݺírÎvŽBùüê€D@RvºÖ÷~à•Ëó.éí˜mZKhóâhž«ïï"VÖ¶Mj)¦¢sK_ؾf³Gt;‚Aã”Ìí+&»“_HÖJ½x7á¶èQ)¢Îá¿ý}¿·l‘¾.¿¡+(z̨kË¿!œz1-¸YØ/ŽŽ*ÛfÌOülÄÞmüÚ Ò©A**`Ý çÔîµ-í9HÛûÑÆ)ï >7ÍÕ]Ì8u³ÉA5Ý¢ˆ@¤`@}§Óg.ÉÛø†·ºpt}Ófã™b‹Š’Š¯äñŽCØÝ3^CDÎpñìÌ&3Ÿ¨žíaŠÍsTy©èüžO'”‰QO}<橆L&PÀ­Å¸¡-ÇAùÕ]sŸ¼“_5êÛè ïÛS§ekÞä‘gîƒ\5s²÷ÚUDMðÐCÉ/îlÎ=¾sþÔR‹S˱Ÿ~>@‘IMÜ£¢òhƒ)ë 1SÀ¿ÓOvœ,$ÿ4zßW:e9tïé¬F‚k7Vzyïñ´°'Ú£Q£?JØuýœ‚.ÏMrq±/¹´~ó—ó}­Ñ×89"p–]ß´íÓÙ.ñoDù‚BžÙá5¥»/Ž›´ÃÙADDE¦ÊRp@èРûŒÝtsË+WÞ.»z¬^üË ý±i"ZE‡î]ûcÌK;™|×Ê“Áñ{Öíê:}N¨Ù6•G‘›*ÃÄ:ÍûOkžùãk>MÚƒTi…Ȧäé1É w ‰ya]P1bèÞgnbú¾OwMïj0+.!Ýz}¸ßÃIgÕE²ÜþnH*‘èÑ®í¤­~ÞJÍ2L$+Õ »@1;vŸ´*s©×|ž+_"†öÿŒï®™cèö¢{¥•Rë<Àd³¬T&EV$©–ÎH&kúözCÞd{Þ «¤HL–­Çïœ\ô¿˜ÊÓY|’Ôûål›ŠŠÊÃø !š•K†+ËZr5VƒµÞ¶M5l/Ðö–ÍÜ°V¿¾ï¨j“Áz`eÊôG{z­MV]ñ±F=9"à°º‘DP{‡ªEVíà8 fS@ f;á=WT—ÛÜÿ-¨!š*¿Ãº¹xUýn{2hU½¨Þ¡Æöu都ëæ·K&ViFõyª¨¶ÍV{›ä@UF–Q͆Ý;¼RQQy$ÔM•ÿ×N ò·žÃî‚tè`Ô F¯šFmnIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/stat_msg.png0000644000000000000000000000373113051004444021264 00000000000000‰PNG  IHDR—2Þ,ÞssRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ +Ú?.:YIDATxÚí›}TÔUÇ¿w€f_VÃj5D‡—yC–LD+EÒÌ0)å¥RXô@Ï–B¥$#53ÅvÃŽZ–,*WPÌLATˆ— t†yû=û0Œ0©GÙöxÎýþ5÷¹÷wïýý>ϽÏsg~È\·¹DüpŠ\œ"§ÈÅ)rŠ\œ"§ÈÅ)rŠ\œ"§ÈÅ)rŠ\œ"§ÈÅ)Þ _èo 13.!8G̈î²`8ûtÊÚw ’ž`Œu½3`Òß‘—ê“ñÎœE Œ1t™Ŭ”Ôï”øôbg6V»âïÏx€cªŠ3Kd/¤GyÂÔ°hż[§yô½c"Ƙ5=)Iù|~¼{ŸJ0VZ´ñƒÏŽ¸ÈïN{i¥§ »RðêËeÕºàؤ”ÙZ"Ęéýu«žj­ˆx%c!¨{`î@à¸Ø97YQvî. Ïp 2o ‹CãGE¡öô³Ý} Õ5ÕD¢åÏ¿hœDm‹-Íy{›\Â{Ü)Í\É«Ú¶¶À¼yq¸Å*¸ótgŽŸ~vçžñR3 üôå–ÈG?-ÿØ`°|”pNÉÚ3Ÿ½™²î¹ÑØfq0ö»ç&®â&m2XûÖ1–Ÿ>§ŒMÉÍÊ6^,]öÖåêæ¥QS<ß°&Þûãõ‹~âŒG€ß“#¦9Å®Îξ·â“×#ãŽÜ•³“UƒÏ½½–ÿ‘\œnM__ú8…²ðBoÙrù‡ÐP³ ôš#µMzkŸË¾^—<íåb;Cmĸ ŠËDD‚ Qn¬ßK»/é~ zpý;ïõ«%!P¹§©ÿ4„#y9u—);:"ïxkÿÚ¢‚7ôD‚@DÙ‰a›?¯i/}[ñÈêîáÚ+3[ˆ:ëx.kC·QAøÀ¯öÝ[ qh¿î¢6ZöEEQR&Yˆˆè‹Š¼Ÿ*ˆˆê‹)<‚v•­œE3Ò‰~£y14óqÒ  D¦fš;fÄÓÅFhÔ| Ý`\d·Þ‚“›ì]§k“»;Y &çünì„LMÍ$²ü·1UjÖH7Ç¡„ˆ=–¸t¸`ÌT_^ö½Q4öûªZ?íøîáîð ×n„ä/ßÌI#"€ÿM4X6ÂÑöÓ/|Õ@$Ç0Ákáì†:êŽã«R´Àð Äù&8ý5>ÿîƒÚsØû!þªcš1h(Š¾ÄÄ{ >°«ú†5ÑkarˆÙ8zz¾¹`.ëñ†³ež¿·y €cŸnUÇ—€v ð×v €¾4Ð?ñŠ“o^¹ïÜsϹçÜï9wB(¥QˆBô¿&&$‚…(dŠ! QˆB¦¢…L1D! QÈC¢)†(D! ™bˆB2Å…(D!S QˆB¦¢…è73E¹2ο@ŽÖŸ ”¿ãWm|©Ü\¨2ïê…F†¤Ùñl¿+rãå@-¸ÆGȯ³Íë)møK¯Zë…ðÚ¹üƒ²µIn—G¢`y%ÏN·¤P(YBÁå‘8µ‚aù„GE—ÛC ¯V°¤i³  ´ášÏáµ`¾¼QJñ«x ìã%;I©@<e<#xÜ`x–eBLÆT’—[R(,C®„CJ)u;\a Îãrƒå” ¿›è½¬7t;hO®L†”RÉåx^É2Íõ•RIr»Ý”Q(yæʇŒ (õxÜ"Q¨xæW‹ƒ¹¼; yN~7oÌ·õÞ·¥¥‡>è5ð¡NV±nÝì}þö±ÅM}æ’þô2>—BHÕÞÇÆ õü.}öyÄ;0 ÄY|òÈÉ|Ocçï¤A¿;„q\®Ñ&=£²ÒR›óËéõ—fÞÑT@ íÄm.Ïxç³fG¨¹ÈŒ€RB@Ê}6füäŸ2k!¡‚üqWž˜þÐÇÞùÙG ¸„@ê]@bÊ|mÂ-¬ÈjhÿWxÈK˜¢,dBˆà¨ùnÙw¿¿ýîÜnŠŽjsǜקvKÕ‚åx%Ï6xh¿)¡±f9¢÷ÈÏxÿò¼‚ç˜úPËž©œXüâ s¾q¡aö ¼“Іqjô ¾wÑ&4>'5Áõq|¾×äwØüÚäy«™ßæ„´™úv(!G7½ûÏ -BÃÃSW]Åé ~ÀHí™ RrÏ®iŒìQšŽ)0 «Tð„!õç}…ØT ^öbïÓ/Bâ´Q-úöé å8®þá&B$õÑ2 ®UõÏ[%⣠³OÐj¸dëgl OîéB}d«Œ–a@ D" Ï+ã#\J òàQ€V”],ˆ¸ç¶¢lúÌ刻LüJˆ`1••d–×ññi­Z'ÆjUœZݲ{·øÈ0àHCß!Ôã¨1ÕÚn†WGFÇ„)H^ek¢õ–G)*8Æ»SPè¢xž‘ý¡›Øk¦:›F©ÒFÅè• ‘Ün§#÷ÇlI£tV£ôžˆ.kµÑä$†Sé"õ: ‰‚!»¥ºÆDÂ"M”^žìæêš:;eẨÈ0e½Z0TpšŒ5V§Œ",R¯W¡’ÅTeriSu6cyU“Qh¢bb•¬h³Õšî(P)Û™ ª1á‘á „ˆn»ÉTksx8•F­æH”PWuu•›MÒsÆŠ²:§¤P…Å$D+ (•œÆ‚Ãç.ÄPœ­LKÔ’êò Q©!¾B•${Yæ¡ÓËW_?^›{è§õ[½t$¡ÖXUgwS†Ó†GFGje³!ωÎÚŠª:‰U„Gè#µ PI’@’ÓXUcw ¬2,:F¯d„ßÒ]ýÑÎÈô(½±ULI D‡µÊXCÃâ#•4@Ãwm¹ÁÎÇÇéÝæÊ‹ƒpª¨ØØp%'Qê ‹§Åh2»BËS*QJ„ò¼ÝqýoŒÒ€JvsM]ŠŽ‰QóäªÜ%cGBÌûW½ôáúÇ|»àÑÃŽÿp\ËÕƒ§ÿòÎÒ%wwUúÞo)?÷å§K¿ÜwÞé\¶m¿OLy¸wZ„<õ7ö)(aà2—nüä½e±UT‹Œ1wuw6Ü)XŽo_¿déšÓeNÁHLä€1L?*Ùxöý7_ÙVaå°õé ‡n{yþÌþ©¦ü_V,Z¸ižÈ±"åZv¾eòô'¶Ó lך ϼÂOÙÿÓ3m‰”BE÷ÙíŸÏ_ºöt±™áØ„C&OüÖ.É<…½:÷ë‹VmþÅ")ˆà‰Híþ÷ÇžøÛÀv¬§rãG_<2lãSê«.«1U×X“{Þ÷ê+O¤dÿìÜ…™,§Øùé¹ûŸœ=÷ÎÖáæâãÿ^¼tãá Ç-©:Ý2zúä¿_—ŽÚ¬·¦;ùÏnËY¸î˜©Îh°«n¹oÚ?¦‹$®ï>3goµšåf=1±ÓsŸÎ,θuPÅýK¿~eT¸ÒwœÀòº7ô¨M‹W©57ôê•É[åO«|º~W¥„@qß3' ê  À)•µç¶Îžÿõ®s%iÕuÈ3§ êËPSöçK®þþ Ñ…6¦Ï=9itë(þèAËÍãpW„”[oëI€Š_6Mš2Ý1~×Ï/t"MæÙ¬Uão[ýÂÃCKNm¿`0VU™SúÞÿÂ?&uŽÓHÕ¹‡V.ZôíþaTQiwŽ}lâßê%ó¶¥SžÞÛýxëkï|#u{tùÜ'’5ƽ›V}ºzsq­Ûãri“º>8å‰Ñ:ª9Ôœq÷Ȭá_™3Ô/z‘£ Ø E…¹¥m'§«xB©½ó‹ù‹×,¶ðJ†rQýG?òÔCÃÂËŠÖ¢¯>üfù׿,Nmüuc¦ÌxdDW„Úƒ?[´ò›,ƒåøä.wL™:qàuI ¨äödî:’vÓÔ0B{—¼8í+ãü•Ë‡uŒ¼ºE#½I”RÁn)ÉÙûøM=ÇÏÿº¨¤Ìdqåíx¯ï ñ?œ¨¤nÓê7†õ¸ï#³SðÔ•,žyÿ-÷LY·ãpî…¼“{¾yjdÿ[&Í9kò¶$IÁß QI<¶á¥¾Ý¿óïmYyy'ön|ãÉ{oêßëΙÛ)¥†ÌÍㆠœ8{ù‘³9y9™?¯Ÿ;°S÷™Ëv;)*vL¼ó–cßÎ2ÖÔ:*V}ñÆø¡w?¶a×ÑœœÜS6ÏüÛÛ{·ÀM)¥¦ì#ŸÎ›óÙê@f$‰RZyòó‘½ûL~sÙ¡“çNÝõîä!7 ™v¼ÜFÝÕ_Î}äÆ[F/þvWfî…¬Sû>˜vO×_w¢ŽÒê ¿ñ–;šòÖŽSùÆšÊS›ÞÝ­ýäEûlnjÎ\9¤g¿©ÿ\U\[góH‚ù⻇Ýrÿ3ßì=qáBîá-«¹£ÿÈW–;(µf¾9õö¾ƒÇ<ûÖŠã+jśޞأsßÔQJ]5y+f?xë°©?ŸÊ«²z<Žò/翽rûy§ ùöB’$IÝ.§Ëí‘DÁåtz‘Rzaï‚a7Þ:kÅ÷g³s³ÏYúÏ ]{Ý·¹ÔA%wη 8dØC¬Ûqú|æñŸ×Mzý€qoŸ5RJ+–?{O×^£—|èlæ¹}Œ¾©ûÄÙL.·Åê”(=.‡Ëã}u]þé•ÌY¾·"è(g¯y°m—cóÇÃÙCù™ŸW?0àúÑonvJ’£ú܆ß>þåv9wîĦ%/öîÚïµ5')µlY>­ß»Ç>ðü·ûŽeçW ¢çøúÙ·ö¼é•¥ÏääeŸ>¼bÖã7 ºwíÑ2J%»±øËæ.Ù–À@ÃAÞî…#ŽÛg¤” 5»' êûÀ óžÉÎÍ9ÿÓªÝÚó¦·~8+IÔUq|Ƹ}o¹g欥ûNdfÚ?oòmz_~ØB©pfãÜ]nœ9ñÓçNý²ýí‰zæH‘…Rêª;þÈÀÛæÚC©$zrö|;oñêœJû¥Ô>q—5TVŸ¨aA£âZ$òÔS%Õ/Óë­ž!Lå©[N™î{ñ1·¶€Öé¯(ÊGLÞ¸çÐ=×Ýž†h!À-B%óÁ ›Ãn||ì¨ÁÉZ ==Â^yìÔB  í8mö‚¶=;EHo›0úóÏ7g)s H‹Ñp„UE$룴”}î™Þóá6íZê m›2÷Îøæäé2±U+6¢Í 㞸ž°œÿšÍ5 ‡>û¤¬åÀW&=Ü#‘Sbê/O‹ ì¥Ù»vžè4âí‡Fܬa´n9½zûø÷voÙyo×[ÎJçOfÞš® 0¨O/¶ŸÎw _t‹(ŽB®oN€ü«¼HžóÒ¨>1Z·n£òN|}óÑq#îLe(•)ü¾nPÀ#{/Ø–™s,}¯WD%ÅF(V“”œ£å(5e&e8ŽAà:„ax…ì(JÖ;vúÖß\8¬[—ÖÞPÆìúéÙ­§-Ã’"Aˆ»ÆÜîñGž3Сýäê#Ï:pîbYZþÏߺÐéÁ• ï í[s¬î”Yë™H-JÁ*Tœ J„¥\7vJ»&‚mŒÿE¿áw î™Áq±w¾íýï¿Ízþö˜“{•’û^yüŽ-tl›äfZØÂ].€0ÄU^Ù{îò‘Ý"ˆ'¾]ó•úÖ_xô.-¤g¤é33§ý¼åÐÈîw«£’F>þ ˜@ê£0wÁ/›m퇴ŒÕ \ʤ·µîÚ%V mZêOmüzÇéÂç‡u ¹ÜÚÄvÍx´‹ÚýãÁïï]x|Ƕ±{îüv“³Ûߟš4º¥@ÇV±lø·¹ Ü`;ùc^Xì}mÚp ”°é7²e9îjqý˨$É#PQ%ðAÁ‚âÂb³ÝUprÛª25%`qÕ4b]ie™ê ¶H à2äy’oŒS)á]×µLMŽŒàk¼¦ݪõ—/^›q¼¨Êé(•êj5¼ x\€B”Qy/¤Å†§·OÙ¾fÙÇ{ϘlA‚ËTîàRœ6` Ãò 6ÆFT9Q—Ø;!*šxÓá)}§<݋Ḓ£ÅÅ&¶ÿu-9"ó¦iÑ.ME*LEU`É튺¡o²R†9V®–Œ"$I¹³%*äùaõŽ c‘Qe/Í©4£5ù„^U•(aH¤†0¬ä4S€ÀãmÉ#€„áxES,Ö Üù9òÂ<2éºè’oßxê‚«[$—½BRjM ŠPÁÉ·èÓ!…¯o!¶m÷XÏžr»)»¢Êê@×~P‰‚¨zÛ‚eï 9€‚ax…¢y°²ª˜V1qœü>>!MéÙŸ] ©´Ì£ŠjÕ2BoùØQ?NÁ°¢…J§¦}ÿ6a^4ºÚPšWâ&­.lX½–£@¨`1Ùi]uQµˆd–áyEÌ7%  Î²Ý[*ºÜ›¯¥žÚ5íøò¹ÏÍ78]‚$ 5Egº[! QÄ'wÎÐT’äöLg„[iIuÆ…‹–”{3"5rÏu©§LëO–n9¥o“‘¦örË°Ãþšü"wIÈƸ$+9ÜnÁbÞÿíg|¦kA)šl šòBšBmE"Q«äXy¦çÂœRf¬ôÄÆW_x7“o{÷¨áRbTıkÞ«¿HM›"ð”/uæ’]=‡ß=ò†6Q®p×ú'ðØ ü´ÖÛŒh3XØ0•JÉ„xÕá8n·Ý!¨uZžzèÕÆhi¦£Îì"„PÊ«D†s}?r×ÚÉjÚõ岟}úîæl%fÀ”(Ô<Ð$AÒóòJAào{¾—/EÉÚú¯)ϯÖõºí®;‡§Ä„¹ O._þY}ÊB’”:µª¡už W8Í{Íå”úpN¾B(CX¦Þbekôâ]²U/Ž¦˜!¥D©Q«Âê=$£R(Yb3Z<ÉN%J•‚4¸OÂr ’DÕúpVfÌåvZE¥ñèæeǜΨ–6‹“3þ J(±îØiiñpûî„ñ”o}ôÞ—ó"Û9¼sj¬Òmúqé¿ŽP©^n¬"™ˆÒ%lHNªI 0×wJ¢¦Š#‡.6\·.>™guMñ4e9Þ{( ‚(JWd¹‚±¸.¬U›$•Ú{ÖuøÈöb;+‰ @À°*wñá¼2ZuÎáJe|’6²mš^£å²·ô,çÀ—‹f¿¿²È"ÈA©¿-¬ :*sËË€’»´(Ë©IïèÄxÖjÌÉ«ôf‰Xµö_oÌ]ö} Ë3þ"‰‰OÊHWŸÙºßàjhב}æd~…Åë¤AeB ”mÞmLKí}C¤÷¤¹ÀÄécbSäEuqöÞ£%fÀ(BXê6”œ½èªO.ºH¹èˆ–-ôá­Ò" 6X¼YT˜/îšýüëûòË~9–môt½µ£®>3L%IA’®ºúíJMÑ;÷¿o1™D¥èëoÜ)öûå®Ùv0ëÂÅì“û¿>ã©YËÎTxê'Ð`Q%¥„‰ê{ïÐÚý_~þÕÖÌ쬣?õïMÛ­¼‚ ¢HO©>{xÇÞÓ…¹XþÖò3º„UäåçæUDjEZk<¿ûdna3¹erŒ¦nßÖŸÏ_Ì?wbÿ§}oW3nsÞ‰cµ±.ïاïÏYyÐè_JáU,¦çøÇ“+ö,^²lÿÉóçNì[úîìYΔ0…"±Ã !}²XöÅ÷{ó ²OìYðÁuц ꡾rð Âbµ.[aÑ™ƒY³˜0è¾ÁiìúÅó¾ùùHÎ…‹çlŸ÷ê3Ïý߆«(ÇÌþ‘­O)¯T„9Œ>r¦°VpUl˜?gåŽL·xÉ’EyŽKéÑ‘9³ÿð±“ysÏnZöÎÇͺh…áèþJ«Å-2êݹuË—ýp0/¿àܯ-ÙÝs@§6 ŠnƒïìÑ6oÓ[ï®ßw>;ëà÷ŸÎ_üY±;2BÅøŒ#¥„ká™Ï>˜³l¯-å <‡6}³ñçã/æüaÕW?œO6º-O¢º è—FÖ~òñ7»gž?óãŠùmØ-„¥è!ù –$¾ýíw’­øàÓ¯Ndå]È>»ù³ž™ùêÆc¥qšJ6,˜»dû_äZ—ücG­ž´þCÕ2'7v‹0äçîßq¢°ð¡-_,[»ÖÙ²OŸ*(6»‰B©¨+ÍübÁª9……9G濳ªZßç¶Û9eÂÀ»FFä¬}÷ãUGÎdž=ºkñœY[.¸cˆåLöI¦ÏmÃä´>¨˜·gã¼ÅkòªäRµ-¿"@•k $‡ÕêðˆÞò IpYmA¢ Tp:¬(åÃ[Mx៚OÿûÝW– <®˜v_~õ±­UÍÖaÖ/6:Ý6}zÞÜ•K^ûn±B—>nÜ=ÅÕ‹J,v@uãý“F¾³ðå©Ÿ‡kµñíÆÏx¡‡uÝ©©ŸÌý?eÂGo<4æ¦ 6¾8iÒmO-ø×Cƒ&=zfÞòùOþ¤U©tÝF<üÒƒ‰¾ðÜÚ=+Å}:ç7®ýL>ö‘~1*¢;ßÿÖlÛû ×=5i%Ï1qí½õ¯)µ„Òaÿáá­Y:û+(ebÚôzmÖã··á!H‚Ûa­°¼Âí´Ùín*Q¨{=2æú×Ö¯šzîôS³>˜pc»§Þš¹xéâÙ/¸E* bBçÁo¼üp;=«ätÚmN·OÄì±Ûm—@u—Þƒ;lœýîÓ¥?°`ÝS1[–-ªsý˜›;*Ù¦’¬?—,ú{_zåÌë _›z0L£Mì2ôÿ|óäòWß_7÷™°ê‡z¹«ñìC7øzÞ†ª-VwÒ ÷¾üô„ €øG^}/Y;oúz‘U¨õ½oêÉ)#õJoó~Ë~KaÖ¦5+%~ôc‚ ¨øÈ67ߺwåÛŸ”ªª=× yü…‡{q„òÑ“_|…_¸pΌɌF© K5ýŸŽí±ÖãvXm ©QU}ÆL“ütÍ'36 uˆª”ž?¸ @µå[>_œ}Gï'okëÐ3ûU™Â§ Šõ†)éóäË殞õä·ºpmlÆCÓfŒ4nyuÖŠéO^|zöÓ‡˜Ñÿþîd÷kÓVš->¶ã”—gÜ×™Ðyø¤Y.vÑŠÅS¾r*86¡ó°9ïLié9hOUÿ·Û«blI(8º}õu7 ¹+#N}UꕃK’«¢°„F&$Fi ¨Ûf,©rÅ&ÄëTLmUqµ3<-YÏ„!’Ça¬®6[à”QqIÑa<¥äJE4S‡K !Ôc7*-v:2.9N[Q\ìd£S“tÜÖšrCKd"ã[ÄE(©èª,)®£êĉaœ³¬°Ü&]lRœNE¨«ª¼Üdu+´QIɱ H–ª²ŠgXBrb„ó³Éîº|Ù=qð¯-n˜)¬Æò*“Uâ”ú¸w¡Þ°ÊXi0ÕÙ‰2L›¥a©D ÍÆ CŸš§ „É]m(µˆºä$=Çâ©-,ªr3ªØ„ÄH BD·­ºÚh±8 ÐÄ&$F¨9J%"¹++ÊlTŸš)KSAI",!1V ÑTYVmv*õ-’õlE~±¨KHŠc¹>þe® Šè]ªØjÊ+ª-”SÇ%·Ô)à±K*MP†G븪grj RWYl0Q^£Ž×‡+(•@†!’½¢´Òêxµ..1NÍz[¡àTݺüØ{ÞÊû“Ѥh;wí#‡-\ü^ïkI¥…Qhb"TÕ6{me•Ñî:\ŸÅR  SEy-Ó*5AIHãLn1VT›,J´‘±‰±ÞÊ>Éã0”–¹µ‰­b5ð饺²ºNJnÄy‹z% †ÃTTftJ$2&)>JM]ö C…ÕÅÄ$Ç;«ÊIDJB¸§´°Ä&²aº˜¤8¨7Öd‘ÌUåF³ ¼&R§W¸íæ²’š¨”ä_^¡&gïÜOvŽzâÙ~ia¸ª*ö˧¥Æ<¥$Iþéqß Aó™’xINQ”š}sÀã~_¾HMžöùV¹ÜÐû×—ŠI’_ÝÜ¥À2@¹ø?¤#MO×7+]æ)ȱ$Q·›.YB?þ¸†š½Ê^K¾©s™ŒÇ§Üõ·_tŽ¥”Òœ5c; xtÛIsSæƒõNjNÁšéM“:‡&¤@­ ÞÊe•ó’ Ž$I’¹mÅô—æ]0»®.ÁO)¹üNµzP Yeo©U´ øf´¨oøÉS–ûË“%B°÷PÑ£m=䮾 Áòÿò|ßؤßMþ_|pö ûd$Gm‘ÁÙ"5ñÏ9MËù·ãóÝ¿œùÀê¾1£ŸÜ‚<ì]~ù좠úPsçä ];°,úöÅŠhÓÆ—“€°²ùyºþíÍä)0¥”:ëŠ*l ­”„išÌÉY;väBíG½7¸KDPÙ­¬` ÂMÜ¡¡¯þ§õ£]gúŠW/Ÿ¡«wksµÙÃÇÅD0Áò¬ý’VÄïd}º_Ú1M¦ îÂ3?}þÅaA QE9 ã]}šðšê$>Ì4­7'„°š¨ÔÔzñ ±‚¦åHsVÿþræË!Mïjæaß‘,Œ4ÃLPŽûôQÄÁƒèØï½G{ J%‘$ïÒQÞ.0XA3/õœä)›É‚%êˆV©º†”Z@ë¼Z«VÊ›l¼¼Ë‹ÖG«|H3IïFûE€ã:Þ¤u_DQõ ÆIDAT±éÓU Äo7ߪŽŒÕøLWn‹äwÞ‚í­¹\.D¢¿ÑÆã¿y|üxlÛƒ·†ÇÌ™¸ñF(•Wè~k¾¨¯ªJ’WQÏWÚíxûm¨TxðA´jß­‰åb_ýõßq4aˆO4QSƒ ç‹1x1r•›»BÔ¨d’„{îAFjkqá$ rsñÃ(*Br2õò¿$ãúŠœúÀл¥ñê7â_ ­XçŸÇ®]س RR V7vù¿5ýú‘ü}½bÃð X¿›7ãüyÜq ½÷âCô«…l4âË/1w. ¯¶l‰!CЯ&Nü“ ™ã Šr@®Ñ ¼öúöýïÎAÿ™ëú½È‹Y­ôå—iFõþ8•÷£RÑ>}èÇS—Ë ÷5_WnýÅÉ!¤’DEQ>SSCÿö7?i{?ÇÓÂÂ?³`·n¥:Pž§Üå˜:sf£ˆ|5íÚ#üîêb4Ò¾}eѨJ%8‘ž=KKJü71J!k¼¼úÛlôüyúñÇ´E ÊqröJ^¯§GŽü9â•Ce%6êt~}Œ¤3fÐÓ§©Ív-›âï Û”"?ß}‡ °³·ué‚¡Cѳ'î»/HôõljøGlÆ/ƒïC‡cëVdfbÝ:y¡Ø”xcÇbÐ Ü}7ÂÂþäRÚµ ‹᫯¥1jV®DDÄ5ªEÿ½)¼¢‚îßO'L  U*ƒDPÕjiçÎtèPºw/µÛ© ™ùþ"Þ2 ³]v¹hi)}úiÚ£MHâ yQàõ‡/¾Ø(Ì?“ô‚ªÄž=´}ûà æ ÑÿŠ^‘R?ìÎûÕéÄœ9øé'Á`€(‚a‚Oçâ™gТÚ´Addp˜çÏç'};H)˜ú|¬(âüy˜Lغÿ÷p¹‚¸>…¢ˆ–-¡R¡¬ F#T*¤§cölŒõ§’UÓHÁfÃÞ½˜5 È(ÏÃáhÔÀÖ­qô(¢¢þ’jSñùêÖöí8z;wâÌX,°ÛÑ3C‡¢[7DEaà@¤¦‚e.gÌPÄ?‰ðÙ”áÚZ¸Ýp:±s' PZŠU«àpøe284(ày¤¦¢}{tîŒÇÃàÁ8z ƒ¡CñÁh×îÏáû·Í†ÒR|÷öíÃƲFD€t耛nÂÛoËOýã˜5 <m á¿kŠM§4ee()Áɓؽ¹¹8sN'(ðx39-Z@£AïÞèÑ ââЩ“ŸY´-[fS® pñ"l6TT`Ë”—ÃlFNÁﶨ(¸Ý°Ù V#, Ý»£m[ôï¶mÑ®4PŠˆX,P(p×]øì3ùäŸ)‚ðªÍ¦MسYY“ QQèÓC‡bÄ”•¡_?9^X²*?AׯoÌ:þq§^Ú°¶më—®èÜ™êõ S§ÒÚZ9SÝðxÇŽiÕ²²kµú¨—ˆÓ‚âõ,ÀÖ­¨¬„ÅA€É› „ÈÏ•ô"6:`Ð ½ÞÏ5ñ<”ÊÆ—wÅϲ—jM’d¯%r¬èrÁãiÄŸÛÝ»ñý÷8}Fãå9dy%ãñ@«E«VEy)˜–†±cqÿý—Z5ùŠqÔ(l܆Aj*¾ú ]»þñÜ`UVÂ`À—_bÖ¬ÆÂŽCR8,‹ÀË/i!77ߌ²2DGcôh¼ÿ>4šk64à® .šÆl¦Vã¹çðÜspö,~ùªª™‰âb”—Ãb‘1 Q”롽{£DokUU¨ªÂž=Áyˆ‹CË–ˆEx8t:DD ,¬Y ÷âu%%òAu5 `04›Öó}З%aaàyxÑÑHJB›6ˆˆ@Z @‹—Z7ãñã8zt: Ž¨¨k7:õÅØäÈùæœ;‡;qøpã"Y V£CtïŽ^½ü¦§¬~Û6TV‚ã^½Àó×òÄ]£|Õ6ïq§NèÔIþj0Àd‚ÛÚZ:„³gQT„ÚZÔÔÀé„$ÁãŤq–…$ùYNe%*+3þY<ž—×6n·ìB)…N…BæA£^½-[¢sgôì µ ¢£Üõù.A›³.0P[‹˜$%]sÀ•ïZÚ—1£NœÀ'ŸÀdBNœN“‹Œ„R‰„të†ñã‘’‚´4?ù4HQ ƒš¤¦B¡¸–1d×8õT3!ññòÉ›nj\ÙâèQää ªJ†aÍfÔÔ ¦F#ÌfÔÕb’ ¯P© TÊ‘*¥Å a$¥0áñ4˶R‰ððÆå¨(„…!!©©Ðh‰äd´k‡®]¡Õ6ìä ÜB×\¶ã²šÔ»7>ÿ;v 7]ºÈÞàÚ´C/ceeع••X·‡ËWu:„…ÁåBx8:uB·n0#GB£i̇5ˆ®é8ÖÔàØ19î¸î:ÄÄ7׿z2ã÷FeƒŠÛå‚ÙŒêjÔÔÈK;I‚Å"[¦ÙŒÚZTWÃdBm-ìvyáçÝ„ÚtvðN·”BP]-›eÀ¿ïëÑ<€ØXÄÇ#%ÉÉÐhš]ìýV³uS øl þß G?n7L&x<(*ºu(*Bv623ÔøxØlÐhв%n¾ýú¡sçFüó ·òœ:…¾}áp * S§búôFk ¨¿»ó :H ÇJ%ââwK6ÕïúÄ›HE òO©^z£\‹kÖàÜ9>Œ‚TðºÜÌL|ø!""п?úõùs¸á¤¦WÙßʃŠâ¿`‡Mû`™™ÈÌ„ÝŽsç°e *+QW« …¼±ç‰”tê„Žq×]Ðë-ãg ^Áö{y|óÍÈÏGV8N¶Ãk8£ógñŠW ]Ú{ü'oq»‘’ìØeË`6Ë¡‘ÕÚÖªTHKCZt: ‚ .#7=þjôÛî *ÌKÀHrr°brr`·ãâE””Àn—/EG#"……Eh4<cÇ"6éé24T¿òŽHjjP\ŒÒR´k‡¶m¯ñÌêŸÝ¯\Yÿóǽ’ôÆ´f3^y6Àh”«gkkq–àMŒ‡iÓ R]EÌù[ñµSØe_G)֮ŢE8}Z.Ì„Æ0•eѺ5xEE°Z‘”„#ðÊ+ˆ‹ÃÈ+@†ù z×4BþÚ»øÿš&í{l·cñbìØ£uu°ÙPV&ßÐ7bôë‡ ä‚!…aaˆ‹“ÙÛ&ÃÈÙÔÿZ¿(•cõ†¹¦ª ÕÕ°Ûåó‘#X»GŽÀ$ ‚ §g(•AãÔTŒ…Ñ£ƒÏ5¿áärÙ*ß)þ%l²©+;pYY0›‘•…Ü\””Àl†ÍA²ÍÂKqq¸þzddÈ.T©DL RRžÞ¸ˆj0c–ÇA¡€B!;™æìVepØëý‹dQô[!{açŠ ”—£¸XZ¼èשS8{6[`³ÞUŸ·ãz½_ŽT§Cj*z÷ö+®ý„JÈÿÇ‹U«ÕÕp:ápààAdg£²V+òóåd`ƒÃT(dßb·ËYPï®*• á6xKŽCx8bbŽ“‹‡ŠÀJQW'§:N80™PS‹¥Ñ½ärÁá€Ý.¯xY6Hj',L.y‰ŠBÛ¶ˆGB:vÄõ×Ë–©×C§k6ØYcÈÿ7ÖØ4Žõ:(oX\Œ‚TWË¥<û÷#+ eeA ÀkJ%‚ UÀŠèHcãÿœ¤•JhµÐh䔺Ë› Vkcú”ÄÅ!9rnF©„(‚ã‹6m–ž—ýp€+ýCÈÿÞ2¨jÖÕÁbÃ!× PŠª*”–"?99r©ÕÚ˜ù”$Ù°<Û% ñ¼±«÷ã~2”B¥Bd$bc‘œŒÖ­Ñ³'RRÀqP*åmY ÅU#L! ™â/ˆ½*§Ñ`?,8r4ë kƒ¶Ã²P*eÓb„…É>öjÁÆK$6B2Å?çòòîmš2ðgýA“)†èJϯ¾çW·úÙè)†(DbB"QˆB¦¢…(dŠ! QÈC¢…L1D! ™bˆB¢)†(D!S QˆB2Å…(dŠ! QˆB¦¢ý‘èÿ «J`:IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/method1.png0000644000000000000000000005740613051004444021014 00000000000000‰PNG  IHDRzj›\sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ "(·µÄH IDATxÚìw|TE×ÇϹ÷îÝÝìnz%!¡ ½÷*Ø,¨¯ý±—G,ˆb}¬¨ "½÷Ž„z %½ž-÷ÎyÿØMHB(>hÄóýì²wwïÌ9ó»gÎÌÜA"†a˜kÄEÀ0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 ÃrsYˆˆk…a®ËÖ„u°yoÙ¾kë¶íl+ óß =ýøÃD„ˆu$WJ]+&§ÓùâÄ7BãÖ2b˜¿²¬ìß° "Øï–[o«;¹ªsrˆÁõ"{ŽÏjÃ0ÿ}Ã6€^–¯(rÝÊUÝtI q›aþK„¨‹aPnÒ Ã°Ü0 ÃrÃ0 ó_ p0Ìu !ªsùþ%#¿,7 s‚º¦­ß°Á©‰1㈈ˆ=z°wÃ0̆.DfFÆñãÇ«»;TTTôWÉ Çn†a¹a†å†a†å†a–†aXn¸†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a˜8ü¼›ë½¡aê² ë—ííóþÆÖ‹´†%,=¾pëÂï3(.Ó‰zùÖoÕý¡¤~í…£RT pî«»~]wH»wܻϫÎÊÄ©%6­Z³ŒHZ™ÃIÖàÆþMzw¸õ±` ê¬7,7L]eƒÑÖ¤ûÈgÞðªØË,sõ„¥?ÍÝ:¯á€[o”P‚œ”YeþwÄÚŸ¼'¦éÒIöŽOqï²9“wlìÙ±C!¢–¿çú¶˜§âƒK ¢*ªébƒPBWæ¯Kßy¶ÜÒ¶ýã+š7¯'I åÚùí3)ßß–]0kè íA÷o±pßÎ9a±·–§~¿çð3Ë•µ”dE6„÷™º<ÊZé©Õl[ôÕ’—vxå›`o$`‡c7LÝR¡»@×@×H× lÀ„ĆÊÙƒ»ºÓŽ,ÞZ¯×è˜~}óWý˜£»[0†õß"Òrø×)%.€’R<›éìÔóá;Uír©!‚綾ÿRIÈ€Á“fÅÆÔ# 4¡oóŽÌi——»úÙ“'‹Éýî¼”ÅERó[î÷ð9»è['ÕȽ thNÒÉÒ ßóÃyJ-Ù¿uÉbDDâÚe¹aê(º~‘>¢¤ÈE„”ízilL¸¥ñ­!ÆM;ÖgI2€Ní™â›¹hõŠýŠ¿½±nkqÛ;ž QáŠm¼üà‚EÆèηú© ën B dn=úfÅQxêÐN$BD:›<ÛqotÓˆøØÈÂs‹òó´ZEÄ©˜šÞÖ¥›_ú¦%¬7,7LurÜßWd{úá<5(È(¡Dù¿-ÞåÕ2 ÐfðmÒ¨YÞª÷ 5 "K—Ä›‡ç/x|Oòþu?,´ÄŒˆmÕT\y×WqþÔY”eŸq5º: …õŒôrd¦¥ DÀ²G·åÆŒ¢: ÞàÛÌù©'O“.‘~mûª…û2 €£Å,7L]óidYÙ€ŠÁ•³ÿ«G÷fQã„þª$ÙOo;{> ÕX/ì—ÐÚY¸#íx"! ˆèþHd ¶û³ûÏd…tºï)/®"ZBv» T«ébçŠÀf³’V\Nh€ìESòü»Å5ò×t~ƒÛÆCʪMºr·@2‡(h/³ ›ë_WbS–ºäÛ{¸ý”U¯ÀÆ=^Jܤ\a·[ýÙGwI†€f^Îå'S¶4‹ˆ Ô¨^÷ ùòYõnÿ,Úœ®«~F£ÉÎR;«{7¥¥¥ D™@*KÙ¶)Û¯A«Ò³ûÊ‘ J“nÒÿIÉß*ÕîÜ€„ZÉ9X¬^w¥Xn˜ºÕ‡2‡wï;þE³¢»]WÙh5Z¼Pâù3WéB$O¿%¹" C„%[V—Ždq‹ÒԨ˾]‡«’ü£Â…®9MÚ^ñvÿq~û¹cpD¸D”ÿÛÊ|¡».Xzha¥ Ifqhî’ØG¡³¶‹”Èß±Êé×>ÔU==ÃrÃüåîbòò òªR«$dpþèð¹ÀnﮊRtòè+cÍ?¸sß˽ã}t« ]eË6Ç‹4}lûÏ­º´õ6‚ ϬæíG©'ö2hÚ«£V”™vèP¥5*î3{¡É Ù;f,yŠÃ»ubŸþD<Ͻ¦îÈ  AµDAÈ™ºâ@vix·~fUª2ÃÐ`mØ,éøò9'O<Ú<Êèñ+DÍ-¥=aÌ]ñ¯$¹ÒÁ ]Žù×­Ü.26¸}àÃŽ•³¿ß0©û*¡è´»T[hÄÐ/úÜÐäm|#]´•%´ ëˆ@m~GŒÏ§)»6µMlFÙ«Ÿí£Hº³´0_6ù˜BzxrJ˜ð¬b–¦!È»Å-/72¨9¬š¡Y·±ox7îyÑ'r½î㻇õ±Ë ŒH@æö]šl ©.8ÒþÎ$Þ1 ƒ{`É·Í=74š{æXIq Ê&_Ÿz1~AÞä”u ½«ÿã BLU™ŒšæÛöჳ}4!…%ŽíÞpP¥Ò¡l24Šl è‚×L±Ü0u cH«^µú=Æà ƒ[ÔÞ—öŽnÔ.úÂ{CýëTŸÝ‡h‹hc‹¨=Uw”‡t@SpPÓà ªê$d¿VƒüjóÇ@€9²Wt¤;嶶úµ§ÀZñ†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†a®êîónÀXt>àh2 ñ×gF’Î7Ž+÷ ªö䢀#¿™ ò®qÚ$Œæô„nÀO´cXn®šÆÜÔÍÿÄ:¢}çû.ùhEã7ÜÞîOIw<:9yìÓÀ»Ÿ0,7פ!x夗ù‡äÄvú+ÛÉrøö•–Ü ÙijÍýÛÎv äkXŒ–¬³ÇöúžL!Þ·–a¹¹†dµJZòÑ<ÔÿR?Ëãz6€Z÷+XþÞ§ÅxíRYð]Ï—ï~€&Ãrs­A¡ËNþR¹! àÒÝÙéP ×Jn@Ò\l¦ÌõL1 ÃrÃ0 Ë Ã0ÌÁßcŸ)”ki‰€UlBäþSD¨8@@U7²wo«æþšçˆ"Ïyª¯&É Ô$öDs$ Ý›±!"¸O~!‡@äÙ(‰ˆPBéòN:B­Ÿ¢$×(¡QåîKD€HN‚à IH !½¢LˆPrŸST?¨èúe¯ë¢ýŸ@’ ?"¶íÎ J’û’/¤ç©m@€¨ºéHè. ÂK½£ºBu¸Í‰.Ê‚®{vXG”HÐ%6B&ôjea""Ê@zmåZQ#5/–åæZ("vͺid¡Å*£»þu]ߦýZ y¨y«fî¦.IXzfË‘ ?ݱ.ÿ|)©~"Û éy{TC?á" Dpž=´ôÓ”Í+ ‹]’¦o“^±ï‹iÙœŠRL““¯U¤‹ <óêì²ßÐœL¯úª¸`î’S#onE‘¾ý§”õ?Ÿ>¸Ï¡#iº9´UƒŽ£âzô·¸m(÷·w~™ú‰K–ñ"ÛoõÔÁ6Å}þÑZƒ*W¤ïQ±¡ç‹º(Š¶õ»[FŸ·¶é?eQt Çî©l×GßO7áÕSm"!gçä…ÎpI'!Ú<»7|ûðyÛÔQ¯ÿ䀀hÓ—Þßí¨©ÿØ)Zô¤ä9·v üô¶Û‡83wþ°oÕœ³§ÎÊÂY&ûÅ4îrgü༠5ëJ.Þøõ³wûtú|èÝ«Ù€ ö+rDLDãÈ«n.ˆÈYÔÿ»-˜1Õ,ª~€ŠØþ͘Ñ>÷ÏÖ7Q§ d¯káçµ~ýlëŒg|°üâòBo8dòۛ߸¥°D¿¸ºu§©Ã¤Í‘iï-œù­.«’û“Ùñ–„Q„úʺ Dœøì'’gOÞ»y³“@²4l>ø±v½úBÞÆŸžz¤í‡É±¾PsãeDE-ÞðPë²!³ú÷î¤Ãßx¶çß»Q &Ÿ7MïÕ¹µ@àÊÜÿŽ›>zLš8·E˜U'(M¿lÚ«EZãÄñ?6ˆ Aû™µ›¾{kÍî9q÷.Hh²J)Þ¼áh½nþܨž‘+kß÷lþì˜úâ·ÑaÍOÜ$J¢üÈꉷèƒé®¹Èe¶ØFÅÔ#t€6]¢PØS>»e÷q¿ø»¿ù™Í,“îÌÛûÕºYSS÷ïùâÛ>ª€’lTÿ¶¯¬n Õ˜)­x© M½ç'¢$2>¿nçñNω ’[,û¦<ŠH€Šjõ3«ç~›1)ü¹Màq P6ª^>nãFŤÈ V7÷wÕLÂb1øßh]?ã\Vvýà†î]·õ³ëÓÐÇX”rö¼+6Ø(@‚òý rÍ;¶Š#¢‚­ï/›5'0éÙ1ÿ×[‘e q~ïç«|5?­dðÃc 5ÇëÕËÇ Ö4*B‘úó˧ê½þ;ä€@2X^æÚ>‘U‹Á _䊚T‹¯  &L¹ç“×Qd.›°vÓÞÏk" ¢Z,#ßØ,%íüo+ßo¹¬ç@]#T,¶¼ £¢%N\ÕÔÇév&«×|úÊòCLJN™ê‹H dœØíjyé 2V,~÷Õ²àVo0/!Ÿ(Jw¿yמ’误ó·Ç?Ÿ?õ9Ý'¢G›˜Ðf†#RãF6­¦#¯ë¶¦ƒÚÿš|Xôë„ÚßXoþ6±Ùh3[ýL6?£ÕÏèß"ñÙÙQ¦£;—$£d)s÷§Ï™z{nËø^6“Õ߯åèáÿþ*ت§Ìýwq™rÙ¶ý»K›Œz²e³HÕË[µúýšu~æ»æ‘>Ù™…’¬­þfo³Í×dõ‘@H&_³ÍÏìío¶QªáßJà<þ=DؤóæìL>ÔéÅa=l²ú{ù†Eö}þ¶‰ÏaúÑSrÅωÐ`ñ6ÛüÍÞÕ^Ñ`3{˜½ýM6U5 jñ7{ûL– > ´ØÇ~fÑÁä“’TÛìG"0Xl¦‹’Pd"F5ô/8öÛ±Š~eïÛ J³úq”²ëŒ,»›„~nË~Å7((¬> gêý$7N¼yŒÕÛßhñ6Z|#ºÿ+±ó@³9³¼ìR> j%éYG¶¦Úžsî¬NäÊ?¸èøYrHKÙRì(=qîp²Óå(>—œ–²9ýØþ²rJT|noÚÁ-éÇRÊ]þ·9Ô¨X+ËÓ¨@µø›¼ýÍÞf›,)F[eu{cÕêööóˆ¡Áb1YýL6_£Åǧé ]ß$ÊÖß[àö‡ôS?Ÿƒúa!õ@AòFˆ¹÷†ç߱ȗ›”ê:úóÞsåÍû?¤š½}Ú=Ñs`pÊÜŸË-Aáa1Å;,%Ïe‹¢CçŽÒ\…ùÇ·ž9’i½Åpdi¶³¢“êÌÍ8²­ Ðá<2ãÐæs·ç¦§ ªÝ$Ø»ùÌ‘„ó°={RSº¸¶O;”Òá±GƒdÐ4BwïV'á×ë–^ß¼»æø¹ì„¦a$›Y+ÌÌ$9Eƒ.ÏÎBMÿ=½bIs«V€å´ß~´k-Ûß6JÖ@x¢*$ …Ý4ð¥Ñ²,ÿ¾“_Ý¡´~²[É¡•ßNkÜvšþŽ‰‚#›Ù¸¨àî~6 Ž³gaØm ›lÞ¼a^Ɉg¡#ãxF¾Å»‹¯¿ $Å”^r‚‚a¡€²#/›ÀW’!}Ã5¨±·Ÿˆ|º?;Èl5aÖeÛ»È9r $5°ESwG˜œè7Ò¼ô›ÔÜ7Šo¶eïêìœç"ýdÐO}°ðË’.1¥»÷çÚÚ<=úÎ6~/¦, kí¥ À’Ý+?|& înGNr`“¦Ú¹u'ÏBë±S;$´uØûùÛL¹ƒ—€p¾4·ÄR߀õ[Šä&D•0"é`Ž»5DÎ:y"K’@Wã; ˆ)Xóô·“^9ž²·07Ã^^žˆÝï–©üà# –ž?x£Ç„yy{€J2¢²AéBõ#’=?£(ûl•×™¢ü«U Â%"‡¼†ËW~»A—±¶Ð2Ùó3‹k&QD¤ƒ_óæòõGO„(\çóRwïU?€®ÌC‡rl‘ƒ¼T@Ùl•áŠ‹mDQQBˆ·wŨ^õŒjVN.ØZö¶¹ŠsO¦H&³R¼?Å5zÜ×nù¿¡ ø„G¥¯^¥Éž¦b0çž;Ðû¹/{Ýñ|ÿ‰Ë“êg$/_¯+uº§õ·ñn$£Åh] 8Χ˜ýÔ±¼úI´§³¨˜d“Á`Tk”4ìíMiÙ$9!ü†o5žŸ²ò»5“¿¯Pïà>ÁM£<Ø$:LüN¤üØæó ˆÂ²R2µ”D”´Û¿ù¬”dÒÀÖ¥ómà  lÒ’'÷ü­ZÕ!‚¿÷ýÇÇÕ¿âӡ߀_N<žôSÓF~”¾ç­»«'A!OÜ3õŶÐÖ_íÜ¦Ý w$èÅûr2ë%µ´ºZ¨JqƳ»Ö/ÉÚWZ`jÓ-N ˜šöDÌ‘õ³Î~`—Ãd Šò nÒjTÛÁ½UW­}9Ý?fddˆÑQN¨t‰Þ2/Ý.Àèr —î HòKê JIÊõ{]KŽ¾QµƒK€ÑÚÐh,.ÈÕ ìrö‰düò䬟\Uë/UùÃZœb£ˆ[³cå|—šÔ$>\ÙÇr‹ ë'u—éª}L"]³˜•*—%ÉFI"g©CøtlQßyòtrÛv Ü—"„wü¨r 9 P¶6jÔäðÚóJ‡¨î¯Ò|ˆÍ. AP|mñi™åæ?óõM~Iv¦(fŸ&£_kî« ÍhDÒuMתi»;îét‚b6V óšCÛÞV¯Ãm •gî_urÛ‚Ô£kÖ¾½±ø‰Û6 W놀H;|”$€í  *è¥å=Ãœ(ò2Rv–Ðíùƒ5ñöá·ö”’¦í‰†q\Í^ÛÀò%V úrì†>ÛÏjôÈ#5û[å†ÎnTk 4ôó Ë>ús9%8ÿXR¯W¸PiiUó®Ó»ÝQpìW»ïÀÆ œ„ˆ$È+¢cÛ;:¶»ëÃÒ³{Oí\||Dzà 6œÜ{ψ'7ãE%FÂàÓHª§£…& –‚%ÙdRÍžsÙäåãmp¡{Ô]×/oŸ¤CÔÝ? îÝR¯r¥9›?úõ?Ÿü1Fgrlx´åúŠ¬KŠYòiÙâ´t‚‚´}eŽ6Íb ô;ž‚€ €¦‹ ý :ÈI¸0²OâÖE)®F¸ýÈàmV©¢+ܾ-ý,çtQ`´·Û Özˆžü¡ªé¢n/âý{È ðïòP›ØÆîÒ” kX\`¨U¸ˆ@ iäïÜŸUZT¾þUç{ lÏ.ò o AQPh¤»ÑÒzhX»¡‰yG6M½yçwsâÞzTq^en„#óôNc‡é°i*ŸoT ýÐúRìkF "Mí0júZ÷wͺ}ãöêþ´4G-ƒ¿çŽLºË¿ý#ξòâ†Í£ºøÖœ"œàr\äØ»V iÖ0øTòáâBGÖºäÖÃUüš·Z’¢iiÛùv~Ñ[€Fî‚]'¡£)´uìˆÖqß>5{üòu‹Î¥ÞÝ(¨öFuµ‘+5Î+!4‡æ½Ê•ê.×».¹ÙÓ#,š»+e°4Œ3@€œ?¶â T@8®z’¢ÅËJpÌîð´<Ð\….—Õæo ÌÑ·ÙÒ&¤—¾ÐÐÛ½*Y–«Ìåðþ Õw²OïoݹztG¦þèˆWDBÃ6½´éÝ MïȸŽþVá|»Þáo?½{ë.IF÷´=”éÔO3Ký[6o"ˆÊÏlÞóëççËÐ=CЀ¶f¡1!PxÖqõ÷(áLÏ=ZÔ¬G ƒãGšÊ~Þ¹)ÝSú\РÙIׯE´A!d@\—vg¼ït¡á굊†wé ŠÎœ^vì¬Ùœ€Hÿ¤x.µ0cÕ™lÿæ­¢„€(´ó'–´ÿD©,»/ té™Дœ.‡½ /p\?éJ@\÷«ëgR*gŠ¤ï8Ù¤Kº€.[úÕKE(Ê?S“NË26ÙåÖQ!@²%6¤~Æþ=ÙS;©jÐ1(&)äôÑß‚–þþFº­w×1ÝŠ–½°rÞ¯EåB5£ê…’–{rÑËk¶Ÿê~g ŸRæÊí?~°}ɼr T3Œ ¡,uÙÑ­©^­{[ñª•Á•ùk–Ô%:Äíóê!moŠŒð;>뮽»’5ÕŒª ÈžufÓGwìSêüZ6‚Ácµ—¬Àï{¦" ÚrÄ~Ò¹}+æ Âj½#¨—H‚”F£ª¹'7Î*2[#›!`èàÓñ#«g—5 îÌèö“kgnÿì¹ÓiEŠûãGÌžö V™à+»':tQAíè<¸¿ KщA«·7Úº†Ê€„!ámüwì<å5ÔjuÝI2†u{àµ_&ý{ÕýT[¸o¿(>w>/ßUª5?¯^ˆ „ÈÛ:såê-[Õ¼¡ñry5GøàäÎO—æ,©×ÿƒV^ã™ø¨@ÞºyÕÄÛjñ¬Ie¾ùø‰LDg´ÿ»ù¯® ]itóä¶ÍÓ—¿µá`QŸ§æFKºÛç‰'ç½þöýêf)L?)¼: Ü]è@„ˆJDÃØ;~NÏ¿/¼½C@¿0ãÔ”ÓŽžÈrsmâ6™4Äâ/.qŸG’,Ñw|Y¿ûÎc;7äçɦÀèÈöC"Â}\.÷(7 ê ž6&nÛÉ=[ rótB[½6M»6nŸ  ÷|™J÷À;¼ÃâUËS’P/)V»ÆÇuªý9ªë ší[|:%¹¤´$£5¬Exü€ð‹æð¯ã µ IDATÄ©Uߦ /òcÈÛfÃ*ÓÙ¡±=Âjƪ tF& ôµyUÕY¯–/v¬e€¯€ÀèÓ°ã`ÂÚ“ðœHànD;¶*õo·ÈºGoBÛÝÛ˜’mMn0*žùDdˆzÓÇOn^œ‘zÂáàÞ)®A§áÁ¾’ËE€`oØÖËÛ*‚¢Ú4GU^ˆعi{‹ ‰ànϾiZºÒ.¬>¾*(±ÑÐZñX2TÂvèk’ÜÙ–,aQí‡ûùJ$@ íÖ4!L¦‹e? 2iˆ98 Fƒbuìo©ª¶hŽHhÜÎßf®½‰¢ê_¿Ã%ØXµÐ̱::¼ µÄFP8 !>.±›I­\‘‡ï0ŸPø†Æ¸ÝH¡jPH µa§†j¹—I `Œ;òµæ‡7,+(ÑBZÞÔ¬çHT,2Cß–}Ÿ°‹< ½Û6MŒ4U™¢` iÜt~f¶Ö°Ý@Ÿˆ€Š8ƒ»6m¨ÔíŽÖµ.·Óåºã§{=ðžË*ÝÛ1 3¾Ë²i¿H½@îÒcÕ•K!+õT[Íc}§Ú™=½sOŠ€¨™àŽþ4“eÞ·»„Au¯ º¯½ôåúB—Å.^õ“W¬¹ó$—\·Wiqžôѳ¾´ÙÂ/»¿zÏÑ¡c×NüRªXwZ‘ÙŠõ~pa¡é“ð,ĉÖrðBÉà…È­ûºÜ‰AÕ¬zÖ¹z®ºZBÕóæ¾.Éó+¨8KeW"UÉ•¨e‰&âEVQqüBŠÕ˳ö¢êƪ¥Aµ¬™t/‹­ÌTŽGÖ¶Š—<_®¼j¬zߪR˜Y%@t—Œ»ÇLµU7'ÅZŠº¢ ,žù&¦moÙºM†üàƒ²wsÙžÃåGoðBЇ:.úNµ3{V”_"E]\z¥ÆÉ+NQ±rýÒÙ«HëŠöK–CõD©zf¯”De#¬žh-«f»ÆE{ŽWÉjÕo^”Pͼá…_]¸ŠjNÕsU½&ðRutqŠ5ʳ¶ ½øTXÛyªý‚ªU:^ºØ«]uµHÖEæW­ªQµê®L±–¢®Û Æùy7 ðÜ0 ÃrÃ0 ó_P÷¯…„õÌÉËö† ¯ñîO¼å Ãróçà}îxëoßÿk÷íU-)ÔL–ZCÄñ_M†k¸ÏTÀ‘=žá(†a¹¹¦7vÿ)Iïþ«.ä¥8¬PÔ‹·ùϤkí[!€Ý7·ÐdXn®YÎì°lÚ’kçÕ…ÌJg:²$Uoók'|åsæØ5N[8m¾ÉãžAÁæÊ°Ü\$²â:dÅu¨CYª¾Á!2öOòó Çq–›kՓº—¥ê½œ¿2u†ùÛÁá ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7\ ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 Ã\OÔÉ%š(K¼ ‘aþ{?BD©®="©îÉ Q~VÚžåß×X-„Ðu?Ó®nÔH²"t ø–PW‘éÛ£|Xn.‹ªªŸÿ×Æ ë«¹;ˆY9™)º\.¶ð: 6 È²¦ë\u¹ŽüPêØ×n·×G¹Ô9¹!¢¤¤¤¤¤¤Ç;¶pá²²2ä^Vݨ&®ˆºOÒšº(7—*—˥뺮ëlå ó?¶¦¿ ™b†å†a–†a–†aê.Êß%£>>>Š¢Øl6®³:}û’$!xC¬:M``à_•4Òßaæœ{ص¤¤„m¥Žƒø÷°¨2F£QQ”¿dЊƒa˜?Ëùå"`†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a¦vt HÍý1Ë Ã0 KvÍKÖP*ÇBM—€ðï‰DÄÍ0uº¤Éº,d‚rÉ‘ê8²9cEFù¡¾` ¿äFá:f˜¿¾#EJª¬K(–íÛ‘»"UÛéT]%Vs!d@øup™,7 SWPT¤ÿ|îÓ£Î}º$Ŭ «;u®ƒþË Ãü Î zÔ‚€¡ò b¶zæ?ß-¶f ŒF4á,uØÛ˜ºÖ76àØ Ã0W‹&@†2U’A„ !h¸6ë×5%³I& \q5%\k2ºñÿùKõd2²wÃ0Ì•‘Ñ º—¬hQ舲F¨¨› –¬)ÿ H¨—; •Ú.Ö'©•wÉD„Hð÷×önæOéL éÒ©gvSC"I€t$%mIúÛõ%NÙ)¹Ð!SóM݆K`PˆÑ­L×G9°wóÇöÏk!¡\üÙ3¬þÇï·c¸è§ÒeêÈ]dø|ÿ$ƒ‰žŒn§’ @ˆ{Kw¯×"•K‹lã|Œö‰×ÉŽ`Ð$€ë©*¥˜"Ð…¿è¿>UêK5“¢iÝ:춇Òó¶ÝÜ£ç _®¬¦5‡—Â=!8üü A,<ñ`ÅY0 bƒ¿?øùÕ|u{Á­áàãë9âïþžOÑÏŸzùé!ýoyáC{æ¼Á‰=>Ø|’µ¦.º7.Siž’«C‰g˜ D†œ9/}Š¬+Šæc±û<õ~#[ ABÒÍ’@Ù_¾Žøgy7ˆxú»G†}jY·é-¿ÿÒlo¹¡ã'“ïéR£{âã8Sª£%8PµÛ]©–Ás7ÀäåТtV ²Òà›'aêTX±úF €Â@+ ïrukØ¡ë`.DPìðÅwžýZ€ „­BŠŸ()'ÙÛÏ&95Á­»Nº7`pHe.(7‘•ˆ’™§_.3J´› äžègh& $! .ƒ²Üü™þH{5‘»É×ÒýpûµÞÛ+?Ú{¢ÄϯžíR"·Ëq)òWPCz×ì0åözþ¼u£êßòÙ{›ÍÌ°z~3¡LÞ ®†{»‚ÉÒÀDè—Šžƒ‘íáó™ צrÿ7µâïR˜û$…÷UvÂo›™2MÇ >÷Œžf5ÕÚ]cþêà ØDhräŒãpœ ÎN{ߎE’—÷ž”# …„’;,Œ¤^5'Õu­!çŸÔ±]Û– {¼ì«MoŸØ x ¼¾ºÝ ô£rAµê5‡åÇ€2 ´²W†à^‹w)•ó ^åÚþ㦘Þ#M·ç€Ò!*@lt{t«„)vÖšºãÝøxI@Çò²a]ÑœcZ²IÌèuoÃçüåPÝ=Ácƒ×]¯˜ê.‚ˆŽ¬z¯sl¤;ŽŸ8±Ë‚1=ZÞðÌ'‘ÈY22¡Å-oÍ=–zúÌé“k¾›Ø¹MÛW–æQÖ²q­Úu~Ï”½§3ss³wί{|Ük« ‰¨,ëè+÷õï>à™CY¹çíbÏü7;·j9qöÖ“§OŸ:¼ý•»uýG ˆˆ(m^RÇv]‡Ü³`Û¡ìܼìs»žì=`ÂR"½øØœ¾ íþýÉ¢ô´Ì2ˆò˜ôô{KŽQYI‰]'ÎââRH åSHzikmçþÃýW:…ûR—( QåMÝüq•#ZIQ±Séö’ÒrAD$N­øú•×'ïËpSgÌysÉ/OžúåñIÇJ?rä³'o~âÔ­%‹I#nªZÆuˆR·ïÚÚ¯fè}Þ~ax{ ‚F‘÷ÝšüÓÁ™0<ýýɇ{¯}lD¨Q"€ú£ïë°dõ¶™ ˜ˆŽ"ÃØ7žj DÐ¥k`ð·Ç¶ ÞIæ€P›QAÙàK¥Kg}½?|ùÆŽ9áí»– Ÿ¹a÷±¦½¢Ý÷•¸.ý†tˆ‘ý‡ k¸héÞ2` ñW¼|Âê…‘ßÍ/Lq ·ÉbqwÒ­VƒÇ…NËЪé…˲@Nñ…û–O ØLOsÏ\ðö…ªáA”`Êj¸¯íe J¶Ø¬h´x¹o!Ø ïúrgª.õ¦ë©õ ¨Ð™»®è;MVeA‰^:Z „š$D$¸žãüuÍ/ª]¼eßüÍ"!jË&?Ô­×ÐÝï~ýÎ8•íp!BiNrnšÕ¯S„z5^-›´ieÙöÕRòx”»ií®íê«œªN¬}æ Ox.6~ÿÙ •³þܬÛTííþ¿L_Žù‹"7uB u[€Á»³Ï`¸0)Üsºî{¾J®#À^w?úõƒï>0Ù2¶[#{Úžé 76úA#H¿š´lüã?}ꦮ6,ß³ôË]§-ͼßPz9u•-ŠÙQ´oÅêQ ⇌?ÿ‰ N¥ÛºF+®óÛf¿óÑVã§ßÛ½±írù2û{ëŽý{¶l‰t†7ïå_ðùÓÏœM|jâè浚¼ºR“`|<̽†w› 3aÙ°hô¿Æ÷¹ðõüÓðý÷`¨îõ/3Ìòï‰Ýб_>ž¾)íÎÇ&$\…3×¼+H’$ärcA/Ë8+yi2(ÿ´H~:D¤§ïœsÿˆ®íÚĵï:`ÊO[íºçÓÒ´äÉÞØ¥}«v mGqÛÉ<÷ñÌÅ·Ôk56ÕQ1 XðÛО-Æ<³T#"¢âsGuŠ‰mýà©D”±{îÃczth׺}‡ö·=þöÞìrϯÒ~jÓ:ö¥ÿ$W¤F›?í•øœ;ƒ?>™ÔºiBbŸù‡\DgjÜuâúËaëÚ2‹ºÅ¸;$ûШ‡i×)rŠŠï¤‘¯ÑóiÍ—…ΕW7˜vÙ’Ó·¾9.¾KÏŇÊyºŽ  ­L+zùÐÝößì"Ây½z×B]_þ;gÀ…ï»×*]øU?ªm)cEyT?KÕÅ–.|r©ÕJÿûM÷ˆ*b‰tÉ1S"@t~8ª_óÖö‰à±©:N„.}YÑ÷QjB¬¥©K– šôO["Í ¸>9¿ú•Aï—,~Á—ÇÂëÌ}€Ð=ê¾}Ñõ=ɆåæŸcÚ—ððÜ0 sÃÛÚ1 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜp0 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜ0 ðÜ0ÌuUþãþª¾ñ¼#¸&Ïud¹a˜H 5 :ºÈUùÀ"Ð5t’Ž‚è°v_ak`˜këÝ   D„ð<ñ¦bÿ! @€øOx0{7 s½@BÐ]’âP…¢²3EèÔdMqI.„ÂcìYnæZ»7î~“¤h¨ÔA`Å ɪŽ`rì†a˜? 3¥£SDtD!_xz¶®8$ÉI` ü'ì:ÆrÃ0×Þ½A0d—ÌŸ­ËvI—.ŒM Põ2£æ@ ÿ Oye¹a˜k ¹²Ÿ|¥àÖqå¿.²{c^"@¹03ØMe?ÍE@p¨˜a˜ÿÕ·*(±mÙ觸äeK’F D€â^U–/Ézù5’Ä?a œå†a®½â¡ÙËÀéS🯔R€ 'håveÅRÉ(I'"èÿ„3XnæZw¦­6)"Ì€…N(ú‰@dp¬øÅ‘wÎT. æ@Àëdê5Íïž•µlŸy•§¸ôNº«¼¤Ôi´y“½Ä¥£Åf•À³¯¦î´ÛNMH’l0šMª\eÿMWqa©¨%C$m6ƒ^TRN—¸ “··ä,+sè^6«³¤XHªÅb–.}i.{q©Sññ6㥠‡ˆ/lFúWïTU£ÀåEvMõ¶™þÇ<9Ë‹Ê4Õç>ÏU^šŽ˜–ÒÎm àù)“BŸ A/{k²·]—üÇÜ@Ò?aS°ÐÅ‚ôò¼ï¦ž¦ÿO§)=°ð½—”]tOuÆ|´$ùèá£Þ8{Jpá¡/^?sMªçf†ŠªXF}´*yßÁ½U^û¤Îÿ¿hŠ¾y÷÷‘µ?¼SßàôÁN÷Û#Ç·ß.us[œ_ ÁõÊ„›}e£Œ52\Ý›U½,^j­…“qhÛOsÖ•xŽ‰½KY¸ì7ç%ªá¢«¯­6®â7îoÕúÝŠú×.¿h‡ —Êÿ¥­âRå`õRÿ_€Hm_— k@”ÏϾï)U1 í±-±][Ú?aƒR·/DtÞ¾.ùÈY;z5ŒëеM#÷¾Ÿˆ{bç¦)çíÂäÚºC—Þ€yÉß,IéØÿ¯´Íë÷žt‚¹A«N=Ú6FÄó»—~»zyŽV²äë/6KÕ¹¢ëÈŽ ÉGN—irp£¸^ÝÌɹ}å©æ~£ÛØ—-Y›YB¾!ºôíjÄ#¿~üÍÖÓd/›õÅ1îì.\<{—+xä Þ^DY†ÆIõ@Þ—ZÖ G(•ìýàÃïÌñÏ}ýñxß £÷îñááS_úœy ðJ/nÃTM/Mö¼tkû–>P”–"7¸Û‚à,J[úËb%þæÁ-½k=¥®mKçÎ*3Ù‚;ôÔÈÓWóÅâ š(þù«¯¢;izøÇow¤‹2˜õÅçÍÝÕÃëÄ‹¶6é4*¤pdžäNôjزc÷„&—Ùå){çWËOô<Ôž²zÛÑL´µïÚ·y=ë±-¿n9œ%[B:õë×ØO­è.Ùnݸïø»niÒºw—Ö* [ôÉ×›N€Ãïû/¾ˆp§ArIɺ… Oå;½|Óúõ­ï…Pay'vnôXEHë][Dx»?pî]·tïé<ÉÔiÐPUþ“M5Moðó×EÍb­$9çÌöri ëeHx×ݪÍÇ%\„×»â(uXl~}뎷~>èÝ.È~⣦÷|àÍ)ãºÀ™yÿºiÒZ¯F I1~G7Íx‚žzæ˜Ö¡P¸gÚôû¶mÿ-nŸ¿û‡i̼û“ïM Ž’´3§œäÌÉÌ ¨g¤9¯ýpÑÁ V=š[ó¾þpêÛ ãÏ|ÈDº¾aÑg ìúo3çÚÚÓNLÿæ³Ù¿Œü|æsŽ‚œô’bpª™Ùõ5@»˜>µ4¾wŸ^’0?þÖó@?0`ú;I€ôeïn+l:ýå;|«Ä ˆ Ñ¿ñHÒ°)=AÔè­OúBùÙ†÷¼6¦— PVúÍû¯›X‹Ü(6åû'úÍ?ÙÄϹoï¡Ï>YðÙʦҴìL¡CVFVˆ]³dg”•’£03='RPtèÓ?ŒXžœã°ëÓ¶hÏÓ?ž9æ•Ÿ{™+ÀóÛÞÿpÎÁõ+ŽlcZ8íó/o{1.uZJã1=B×}ù»ßî^µhB ç—ÿ¾óË5ÇÂâ{61f}9íÝ·;>¶ä“»MŽÂ¼Œâ"rÊY9N€²E|üÀà ¥Ñ†ó{úú›3f¿® bU«ð?ºiÆûøÔÔ™câÃhÉsƒ^ZQݱkC%óã~èÞÃø'¶lBI"-¼ž¡yK:¼íè%i² ™$5xø~Ò„Œ Ètý;8u¹§W¶cRÛ˜.ŸïÈq¿=0ëq÷¥-íÓ¶Íݯϭ §|4.!nØ›EDtú«v mûŒŸ\Ù-ÿôÎmîžãþ;gû«ñ-F!"¢‚ͯ¶mÞùÓm¹ž´N,Þ©ñÝ3ieï<Ñ;©]â÷ûqÒŸ¼Ñ…¦— ­ì±'Ë IJ¹l*p}þ¥NšÐu—®“~݇n¨.w¦´_®6´n=(6Àí4¿ñ½u½Š½L"å×]eªÔcÄðŠ—W¿q·|sÿü•¹ÏBTúôî¥V ªÔoáZ‘Z `°;5rhŠsÑ'‹L]‡ÝàNÌܨW—æÍW.û&wü¤@ ØÒì²iØ¡¡>cGQy9èMf0HÁ1mƒ« íT¹Õ;³ŠÈË×l¨(BQ0s kOäK@àT›N™ñj€¬âžÿ¯WíOQ‰±óê-3£”+Å<—Šÿ‰d“OËvk#ÝnJú×½ îüFÆ7$¥y!N—vOÙÛ+/Sõ$#âzù¢çœqÃn üáÓUçàŽˆËÞÌ$Ó€nœ–OÞ=Ð%Ùu§Q—P ZÇÓ ue MFåú¯Ó±›’ýg5ß0_£ÝZTÌA¡f =-¯È¦xb¿H›šs$ À%‹Å·ÒÉ—dI\.Ø{–teí]·¨PÊNÍ*³œÈ-ƒ@# ð‰´T´hTd ‚jÆ'.dÕߊö<‡‹*Îãe³¹$”\E©ûœ,¯È–f§!ÿÙür{ßË _ud/‘AÏ …OT`e~HÐÕ4«”\qNÕd5ž?‘' â²£ ([LOž$A õ6T”©„¤ €‚}çÀ•¿èŽÛ·xƒ"ãl¾3äT| 5³O~ý.د‚D$@¤çÙÂêUµŠ(›šs4K3ä—É’w€oeñHAü!ïÏ2dD@(N/›7O ¡.P¦1èìDT„n(¤ë\žw#I@$ˆªO ñÄÓèrƒÕ®T{¸Á/ºÓ¿£^xÊŠ)Òx5ÎÄU ©!´îUþö¡£eZ'Õ@ ùÞûò;÷@aò¤îãT›SVà[[ÈõîÃË—Í¥¯Þ]@B¡„WY—¨‹À–=Ÿ7Pª¼j %Õ+Äp¥ü_89ÖfÂ3.U­ …þ'ùD$„Q–Q>>ôÆz™i:I²JÂŽí»Œ9çU??§Œ‚èú×i¹ñŽ¯¯ÌÏ<_îh@B$­ổ³¦ÈèúA¾ˆ¥ii.ð7¸ïþ%yÅõ nIDAT'Š\¡±a¥W6#Dðk…ëRÓØ–6܃N‡KVU ô«Üt WZqµ@†{4~ê¸W?ܸè¥ÞrŸ’ûeÅåâšxe˺”kDWº°ZK­87U@+$BD{QZ‘3 :蹶„íCó–­Uð 09íNÙh¼PÕ/£Öü…ù"–¤s‚¿ZÕ*âêB}̺(Ì+ðv+ãpöŸÖ¶%I¥o¾~l ¢Hz™†f õäqÈ9m$’þ]©º½ˆAêuW_q`÷7›RÝÖvtþ‹ý_r¹Ó#ÑæÐ×ý2¿Âó~ùl¶+aÌÿ+Ý®QW©]¥ÿýƒ[W~¹5ì©“ž÷âÉte3”ÀY,¹ÓF‘uh÷ö}G:UÿäÓåáûfÏ}æáWgœ,r§ƒ@…f¿ûÜ[Ë¢ª ÇÌ–KóŸë®Ù ÷îØr8Óñû\#”ÀY¬]pâ$r–ȼEi϶%i.wÓ†o¿+¨ß»oØsÏëwßÀ²µ ¾ÜuÞSE‡_zü®×g¥TÔ‚³øJW‚Í»%z;Äú_TZÅ‚Oç¸ÚŽîï­:5q”:7­Ýá¾Ùm}ÿÇýBºÖSxéÂH”‰Ÿç‚¤"DŸÁ9€Ìç&Ê ¨u¤Âoêò@8˜ž{õ®½o½¦¯Æº!fðŸ>Ô¡EHØâËo™ÒüÖ&w“D#ïq†¶éÐ<Ëýï¼Ò"ªÑ­¥ª×G•ïƒº¿üȈ;¾z¤×’f›ú9÷oßYhíúé´XwÑ4 tm]ëð‘Ínz¯‹Š5ë·òÚûËIƒo|é~WvhhÙ¿q[žµñ;Óï4@ûžë8÷íH^YûN¾=vÎfíÚ¶o¤ÿ{ç^U‘þñïœsû½é Bh$¤JS@ÊRE@EDTta]TVA)V\;»þWÛ¢‚HG) J ½„HOnn;gÞß÷¦„4ºßÏÃó{æœ9sfæ|çwÊ Aò@šþýN³¢¸¥×׿·åÞ1rÃr£Ûh\¾\þ´G´Lш,Pj}gJе»eañ4¿í›ö9ãÖ¸¦©oHôï±(„È9±kËÎý9.iˆ½¡]§„"ÿ¢å?%·ëÝ*!ÔÿœØõÙ7ÇëÝ>øFRÛ»eåÞôñV¥½bãê·Ø5ÉvpÕ§?ø¢ÜÒÕaR*>€¿¡ueÚ¾ûÀù¬B ÅÓ°Y«æq¥ý/ßé/¯wÕ %!…ˆí?¢{‰ÙãÊ<¶êë‘Fuj`ª"ã|…gçOºû»îÿyodyó#ý§/Ö®;bHÛÀõ…i.û!©õ-©M"„/oËêU'r|Í»õN¹Γ+W|“éRâ:ìlY×uø3ÝXø@jΖ]‡Ýd©ß¼]§”xQµ;÷Ç÷¿JKíÒ§Y½ ÐÎ|öŸ I‡´Œ°ðd¬^¾ÜÞáή ü÷m›÷;ãÑ•:IºÞa,ά^±!£õÚ ¨—·zÛÙ†·hh'sw¿¿üP뮽“ëùOÎ9±{ËÎ}—ÔŠ@)¸~X¿:í\žb‰¼±WÛ©¯VŠ1(ÕøkZ7Ò-„ªçõyêÄGŒªÈ¿!5|õ*ÓçLN *,!kÈÐèO>&Í' ÆÚ¿`úÚ_èt¹)+UÍråW¬T˜ë"+L‘•Ý¸’ÔÈË'óÊI“t1Èò)¯Öͤ$YøÆ}C_Ú_ÉKŸý2xzi—Ž©û÷>yu…!«‘§²Â5²’eIöU+C¤¼B…új®®{tI$O?ü(°˜Îýk®té:i٣&Ob’÷ä)ݧkRãy7ÿsóëêF„PòMK"»9½ÇÕ„UT˼ÆUÄ PùX…¸‚ïF/,p´¿ãîfåý×—s›Wç+ÜžáÉ>zèt!* RÌñ “‚,ê•.ª5WvL²R…Éõ›õWþÍÏGÝ:èÆ°˜£¤¢xÈ2﵌ÿ~bðˆãGôÅÛ¦NQHcß óû³WUG1c—8ûEHÝãvû4*÷ÚžYûÄèÙ‡¬æJ:º%vîü»$Ùÿ°å ŠÅ[#éèÛëèܘàÁ‚"c4 3LÂa ùë£Î¹Ï… %sÎÛÔ)€Zûó„ˆø eªîn—ªV©g¸ZbF„eÎUúnt(VO‘øq7µj¤¢T¡ Rá£ÂmëÑ·Õ­z¤Ûžs‘B#k}^ñn~Ì•Z$qÉ<åJÿÏ{.צڀ 2¤ÉèJM…)T’>°wîZ×\ƒ®îCi¼y(Ã0?WnH %H(F©‚ŒºR1àsª:lÓ§èÒçLá¶?Âw¦¸3Å0¿šuR !•À$>R ¤¡î³Mo4†Z¢6oÔöZï¼a¹a˜_Qrü“ÍýKtkuQº–Òpü4lä‰3Vw Ë Ã0W-FY’Ú¿5:Ë Ã0¿ì*f†å†a–†a–†aXn†©’ÀV@TüGéVATÆrÃ0Ì/GðJ!…$A$Ü /HHáòï®ÎrÃ0LMX7‚ݨO*>Mhºåœ7÷°ç{¯ÏXñ»—TžwÃ0×Ò̺yÈøòìéÞ´l_ö¤zÏÖµ4« ^y¿†¹L"* 0è¹ú…mY›vd¬ñY/jr¬…Âã?ë÷¾Æžå†a®Å‘¨{ò¶­ÈYœƒLÝ&uÕn'C¨;_‘&ˆ2K­Xn†©Ò|ÅŠ˜‘üðf¨{äƧçYÃ5øȬ@Ñ iúÍ!w%X“Qæ[¬,7 ÃT Uú|Šj$~‘ ‘Ò+|§¿¾GûÖl3é¤â³¸#:DîÞà H`ë†a˜ê ’Wƒ™à‚°Âÿåa¡K¨Ò –œ}åG¹Ù*l«Ûçè6ªMý®v,¤J‚„¨Ÿôå‘)†ùmºSØœû¥ º†Ý¡„$©èŠ[u-Lñ~ ¥¥Äõ¿«±­¥ƒ ‚ªþž[7 Ã\Ú²cå¹Å0j›ÉìïOA¥ ¹Ÿ¥É}føH3ÇQó{â'™U‡&IAh€ZÍm¡ð4?†ù­^6ƒîRÝnÿÎ~ŠÛÜ›×f~`&ERp’ÒòÁ¤éFa„J* ¨V½¡,75d)WÒ'¥ª ë2WV~b¹é2ñPÕö{¥)¥+>Âï´‡]úôó¿^>X=A€tâ‚”ºvÂõËê–îȱóz9KYˆkžoÛpÞÑÂçÆvKmÇ)pþ]qé?†?Ž¥uY'wãÑÁ°ŸÓ  æ-E®/ þÓ NaÎxD›‹ã ÆÈi8‘ì|£Â]ÿ„P¼Û?I¾nêwùÿyWÓø.]—µÌ…rçäºn^w$·’SÒwäHºÏÿKsŸŽ¿¾ŒO¦@污«Öà–Øb›¨=~ŠBâH¬ÉBÿ:è\'p/õ$wDÇã/ '$DÅ^gŠQEd“8rfgº Žˆ`ëešwøœyù.„b¶9,F¾üì=‡“‚Ü<§Uó?¾+׫ægæçY!6‹3?Ë-‚Ãl2/¯P'¨FsPpáJo ùœYùž é*pz|P vG°Õ¤¸ ó Ý>¡íÁÁƒ|®“t—³ÐåñI‚Ál vؽș~|GF‘¡ +'ÏavØJz‘¹YÕh1«Ï’æ.(,òjRÅd±;ìfQ¼A¹·¨ Ðå‘$,!¿J#,‘{ýÎôµ…Þ#[sÖ6R5³®è#ëO¦HR$HÔú¯Ž®a±øié˳^ÿð¤7ØæÍÖ"SÆ?>ãÎN‰ v¿?eö¿Ê úÑŽŒç"So™6ã‰ÔºûO—¡ÿ5zÜá=;‚#lÙiÛ¡ÅSo½Ö'1$cåëSÿ½B³x_7<ó@Ýeß_´ˆ‚3;Žô:iÆÄþß¾:é£]§5_ÆããwþÞCÍÕE÷Üü\aêú%ï†åe¥Ü~UþxÈØ°÷¸çGuxë/ݹ§Œo°ö‡L«Ztn÷)÷-Ã&>ùðm–*?. ÒÞî0òÓûG Þsìx˜©pÛ扃&<Ý.köâƒa¡t`ÇÎnO,|n¤`ó‡/¼>I†!&RÍ?Ÿoë|÷SÏëtñë7›¿Ügõ¾6å¡ø.#^¼Åj\ñúƒï~}ÜçÌÉp:÷{hæÓ#Cµgö¬×l?R§ž{Þ?pì h©äî^ò×Ùoý˜îi¥¯ÓÏc¬aÉ!@„# ,_ÞÆÜÅŠb‚® ‰_Ÿ’¥ªR!ƒß¸©Í‚C×2gÞïÚ8eÚçü¿ÖÌêÓäƱ‡4"çŽaíÛ |d®SúCŽMíÞ¤íý $|¯M›Ömýõ¼æ*x®_ÃŽ“WâÛ<=%yÈ^IDä=ñ~·&É~ˆ<}ë;=oHšº"›ˆH+zyríSÿ¾â¤?të3jÕcø®3nÒ ^z¸o·þ3óIÔ­þtÑ— ½¤È²ÿŸ_H­½è?¸"}Ù@wn""jª7ŒÜZI`)Ç@ú¯uÑM*tïK”žC^/i:]z¿›ß%€>Ì­*Ëüçݵlá'Ó*æ·¾ëÉ-¯o×wêˆÈñíín{î'èêwîMm;á,YýDJ‹þ(¤î~mr·›ÚÝ0û³cþ3|óîë;ôY¹?û å{äÍ”””.ã_óø‹jÃä”–É7Ü6+Ó_X;þ¯sÓÔ§‰ˆ ÓæwiÒ|êÇý×^ýj·š<³.ŸˆÎo}&%yðž@qÓ³z·o›:áÅ>""}õ³£Ûtéµr!éÞÓGÜtÓ­_ŸöŸèZ<±_냶*"OÖôûºwé~_š›ˆH;µ®—v­»Žøᜳë²®S†~lÊÑŸºíoÇGÍL5ÿâlM×t©“.I#M–/ÌÚÇ5í»ùæõyÍÚ=س±´ ËÄ·f=ÜÓ딧V¯Kõ1Þ&ü! ÷<6È·aáz§¿iPû ê£úmGË. ¹û¸üö,©ÀÚ—ßÊm=äùáMý÷Šm?²SËøÝïý+? Ãl]GônàÞ¹±o²;'?³À ’D HµÚ¨ç;nëj7–¾7æeuGpi'<ÿf>„¢<ÕÈÇ .ŠRI‹fO€=ç€,ø|7þ<KC½0Å¢ÏÌš‡ wÀع¼Û³œ @SúÚ¥q¥£7štŒ›9©¡ "2‡5oÒ"*ÿÀ~¿³KJ¼xøF–½ÎzÇŸüÂëÇ©—svKÚ‰j8_,Ct3p´îíÒ{N}}ଽ'<Ö¼ü¶³Ã˜çÄû¯Jêygë„:»ý§’’¥I‘>¥ù#õ6€¥çÀV§'+;O÷œÛ¾ñ»ˆas{Õó§Ñ2â©1Ž3'7<¥åŸ:º÷XÜ=Ï46DjýnOtwi5죕BÈ" êBÕ éÂ82òUQ„€¥ØüåÎÔÿ„ü­iÞ¨Èp‹ß®%2:†Þ•èkÏd ²Å5r”¼PAuZ…?ß•Žîv¡F†Æ,SÕdP¤W+yææšÅºoÖŒ§ý.!ôC|>ãþ nÒ}}‰ÿE5›I]§òcÕñéut Äé(5h¼³ÀàÖ.›òÕÓ vSÀn×cîB\8„Oáí7±úÌúÎ|ˆ«±¾Ë¤¹ÒÁ2‡&…Zò*F\^¸Â÷dI§ºícK~šîC™Õ«0„9BKrY­qŒ)àuªªéÕ€ÜÍusÄ÷ÏÌx:*¡ÎÓŠŒs´ ƒR—Ñ76(ùi3 ")!]'Nf¯ï_ZV)M¬Î½ç 4÷… yæ›[E—5ëP__SÃošT( Ø4‹Kê£ÿbñZ`‚‚@þŠ\Û]7×´Üè.E©¸^DÓt‚Á¨7Ø€¢Tá+òvTÏ«¯{|09 %ûÀ©M;vk制•^­ÔÌÐÀˆ‰H²C ^}‡£Q06´µã³£Ð¦25Íï‹Éøº4(5R„ƒ±-0i&ÍÁ–yè>Ãbí5šíB¸ê§&‚ɦ–f—bPȧëÕÓ? žKëŸ0«jÉž½:ZÜÜËÞÀ,à«LÔ GÒçÓU‹Ñ¿8Òl´d¶W‡îÓtcIT“¡æ­ ‚®ø¤¢yÉgŽ®Æd4ˆ€ÐˆZ8 õ{“{“He•3ßë#°@öwTˆ]ˆ‚‹9@X †¸‹.8½añ@u¹ƒGÒŽëRžœþ„E©X/jô9Æ>Žnå_NÿÃLŒgâ£tÜWÆã+àñ§a쉶V@bçj¤¹pûŸ ï\ íhtœŒ}ßwþïËJQy´ ¼°9ç Œu.3òuõ„6Ž”ûv|zƃ;ÿ窧†Š)*Êá:yƉl¬ž‘^`Š³ cˆÃ\x&Û XüAœSTS 7žª®JUÕMäȹ9d²‰T¯€©V,¼¼Šjr §ÍÔ½Óü‡¿;–qnû?Z×oòö1Ѻm3£.¿_³µøåÔøê¿ù±=z_wÅy RÓUÖ>ÃZ\غsëéÂâêóé»ÿøò‡ Õhct­Äqåf^ÈÊÕ%UÕòWt©øMç”i¸%cS±|ôâ(]0wVøðÜ£0P0Y<Ðé+•eaT²W­;¦ùs/wÓ’4SXûøº5Tl½‡&ŸÝðͶóžÀï…Eÿœ÷õž¬KË´ª—Ý`KlÑ2fßÂŹÅz~zÙ¢Ãö˜îëìñ±±¶}­ÔϘ>åy³±†e€…†Ê˜ër““­)ºAšjÃfçµÇºAôàçî_Ùÿ¹Gî\ß©síä–-;ïž~_C ›3úË ó&Ö6Áv`Óêõ?MüûƒQWŠÐ‘fX2{âôv©'ŽzñîUƒ§Ñ©{¯&árϦkö`ÚÇW²TS´%Ø™»iÆ´§o~ðá^Q+¦ß÷Ž3ù½×ž­cW¯¾š±xz·E¿–hÔ uëBËCú œÊÄß–`R߀ÉóÆvMÅÀöhÞMÃèÆá4ìÙ¤‘xû–@LWQqÝ‹'Yš0eÙÌAW•ÜàX­œþØŒä#îlØ(Ä°âÙI3Ú´é:yTG!5Äuüê±Áºõ‹ÒάZúEpƒ^ÝRâjÊ‘xûKCV {lÌí]ºõH öîÞøÕúæY=ï`‰hnødöÄéíSÛ?rwŸË×tû˜î_zÿ«cï;ѧcKç‰Ý+–¯lrë³7'G©Jèàí¦|ðü}“v¤&ÿ¸iKd‡,÷Õtî¨Â|WüD» © Eá¦6×´uCD¡ž·|Úð¶ùi;wðt¹÷……³Fˆˆ”¼ÿñ+O·tÙêì°Vs®×)ŽCƒJ-aGx\øH¿·9¢Ñ ïºÙxqÿ‰ÌB¡FMýײ'‡µËÚ³aÕšo´„Þ‹Ö}yGSJDøøØÒÚ`ŽJJŒs˜UÀr÷côhqê`Z‘¢0ÙƒC‚lJ¥ÓK !ˆŒÇådÈ?¨ÞÛ]Xö:’B‘q9ºß‹c…˜9 ˆj ¾>…ç ¾û¾Ç®ƒnŒ·Wbߺtn˜-ê"¤êb&³±°ÈUI€%:)±ÝT|¹P£ê&$øó¨]¿{†vmRxr_–ËÓrè¸á”óûN縀H—¶v/¾9Õ¹wݪ-êv~pÁ§/Õ³^Éa o˜b/nó[\Rb˜9]ŠÑ›Ð(Æ®P,±3~1¹«s»×}½î[µÉŸþ»éËA ÍDÚpà„1ÝM™û_t $*®aƒðÒ»š"6Œ±Ó~ìÆ/ßjV°ö«e;Où†>»äÓÙ·;Œ=§ü󓪙¿Ùº¿Õ=sæŒìÞ06F5X•¡!T¥ž±q˜JŠªHþ`»¿\ãûÝTl³C+Ù„Š§—¹¶ô<"ºÌXL¹8DÙ©VØà±äÊr7.;î|Z/ »üt7¿GTvüÊ+v.½guîHDBäþ|êrã;“n«øì—äò%ùpI1IÏSº}pqÒ¶÷‡_.ÂJR&W!Pz¶:ù¥7¯¤ìÊvIº*+¸J")9í2U£Z…ÀÔŽÎTemc`FT"*\[z¬zKöD¹ú¸J\î&e‰JSZñï*N«Îñ*ò§:wBÛ>\Ô³÷ßË©UÙG»Âc_Æh)'¸‚4—[»œÚ(K‰ÄŸëâ²™,ª(¬ÊÓ%®ø•Ÿös ©-rÃü =T ÷S×lÓí)ÊÏwzË=¶ ÿøÅ&s%=;ÒÜÍF.|åžx.îL1ÌÏêð–é •í+UÝuåd¹a†©ax7?†aXn†a¹a†a¹a†å†a–ΆaXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†©ü?0˜ÜÎ×›UIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/uricontent.png0000644000000000000000000015003413051004444021634 00000000000000‰PNG  IHDRz®·QJsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ */‰ IDATxÚì=e@•KÓ³§‹îPPPD‘”2@óªØ݉ØXØ Š(Øbw\•î8}žý~œœ‡ðê{ß{ßù¡œçÙgvvvvvvvvaŒ¡š¡šá?¤f4C34C³ºi†fh†ÿ) üå/ÅÜ‚Ürª¡žjê` 5áùÏÆ!Ä//)©àa ˆ¥¢®Îa`!·´¨”¯­§G­Ñ®˜[\X*FzÚš$„0ƀ’òÒÒJ¾c Qh*jê,YFÁËÉ)FT–®¶: )¹€æçf…©£«AIAvž¨.edšžŽ&©þ¦IDùùe4Ž¦¦*½š^y^)W[WJ’fç •ÌT=]­²Âž’*ÆRÕRcÿÓ¤MÚG"~Eqi¹„ 19šê*ÒçæãZ\˜ÄÑÑS¥–çg•lC=5À€´OˆÂœ,1][‡ÁÍ.æ×e/&HZ†ztÌËÉQ†–­­§F“ˆ*ò Êå½ ˆL娪sŒ1BDavhúZäj)(Ïû!àèi³jÆŽ„[["`ªh°j$L Dê¢(7GPô ´)rÕUægU2µu94,æææ•Ôm YEG‡ÆË*¬PƤa ÏüÇè/ûn~œä³ÅêMÊLr“µMùÝÝSϱ¶¬ˆ¢(>¯xtxÂaÉöõƒ¨¿&ÈÒwM‰Ýϧ¨òKJ¨’KÓZ™8Î…ýäüª1KÓ÷¦'µcÖtí…ùÑËÞѯ&la’@»rì¸+/¾çUˆUè$®éè‡Mß8ÆÇ ²T¿Î3DFíO<¨M¯Ò7Ü;1žã’tZ:Ë‚üh—îO)d6E¾}˜bä|ñÐj©^uSø6¡ç 8†M”]óªun~궥§ž¿l¦R4ªS÷‡j¡%ëÚœ;¶yëØÀó¯ù@"K‚L¡’I0aßgfܸn£„¤Ê¤‘ GRx;zðœ÷ÅTÁÅĶ÷¸õ«"­$…É]ºÌ«d³åEˆE¦CŒ6ÿ˜¾yàŒ£Óö_íÕŽ&­¤ôêωwb/%û~ˆõy…Á ¾#2ƒNÀ|öüT¿Î3*8¹-‹ì<2º}áÛ„ž×#u-&Yª÷¹ùÅ|-Öc·éÕ êÔýO±þÚ¬Î5º{G¸å­©ÂŒªñæµìi™MÐÒ}±ÝP•žP&u CÅ´ÀдÂòÀØ”eêÕOìp"à؉íùÙ為-æ³Xty‰„æ#춻â>b?½6€ÏW]uõ¼çßcÝ(±9¤™B!ÉÏZµ†?(öd¯T$æQçߺѕ¥¤£Í¼G qK[¼8ðH,ƒ¸äõà¹É!³6v7¦€ñ‚ŒŒÒ’kƒ¬2ú]<>È´æc>’ð)³nÞè©¢¤G!‰€µ6ù’kõ8ç-7týðžÉ;u¨@&“[·P½;1Úe§6 ¤­"‘Éd9¾BÞý­oˆ±aÞ;î/„hÒ´˜R©kĵA&è¦-ùÅãˆ)I¹È²L¿ ¶ôö FÝO‡ßË.ýko¸Ã ÍI“Ýä{ýºáïóÝ`Ä—› ƒC»xx¸ûGî¾òž¨C:BèÛÝ#ƒzøººzô4õÑ÷2„BhÄNa±öÏäØcìÕi>“î¾Ýçâàz9Uøhnà¨]×Ë¿q±w>›‹Âܯw¦õpw Žštû‡!DäÞïäîzöÞ› “úzvr÷í>ôÊg.BHÑ2Ëù”¯âçgPA`\É“t{øÔ>#F£d?ÜžöQ8mËŽ`[CJºÞ Y[f;–ÏÞÉ•ÚÆ"­^ýM6o½+e $Ê~s.GdÓÑŠ_ yõTÒ„†ãg º±bÈóBŒ¤B\kÁ%ä7Œµ’' ¼JB¾Sä{ˆ_øañؾžnnþSÖŸãI{èóq× w?>­›éáááú‰Péx¯6C|—bÀ€„OwZ9=ÎåÖ/´èåá˜^~#cñDÒ± ÕÿÕ@ù³W×v<^9ÏÄglBjR¾¬5‚ åÚmø†] Î Zyœ]39W?bÞWEF D€!·.“”£•!~¥¼-ªÛ¿[ Pü-·Hº~Å~#&9qÏ:ñ jËHWvÒSÄT‹È9ãL¾ÿyêCüÒÀ&\"¢}h_æ¼£\C(R«ÔÉ!$ñù÷Ð5«Püjw¯è8—q«öìÝ·aFÐÁiƒ¾*¬Uìî¡Å}¦ì›¶.áðþé¡{‡ü@ã¨ßÛYj9`ÿêi®3…9êhšv;|ò„§fÍ·VSöEy¨:sÊO$…é½{Nâ„LÛ±k÷ÔÕ1={ÜùZF¢PÈêúØ-†/?‘˜87ÌhNÿˆGY|„äû¿§3ÄOõô{‰„èt2YUÏ°zR#±lZ“B®þøá“B«Ñ=ZB=€Í¯‘uúbT¶öC½³æN)ÆàÏÇgyzx˜R5Ìzôvƒ ¬´ ¢S²hëE¥º‰Lc(·<›üçÂ~XDîÜ`×ÖeÂëqCfí‘`BTL¶ÛuÌšS'´ÇŒW,Ró ørbE±0ÆàBÒ#c[ mV}bLßš~þØ._wÝ<¼úFO=œúª,X¹‚Áš'ãV}ð Pi4D¡·m©Se;S}1형1™‰Óâ_s“±ëÀà&£úÐ*µ—² ©dÄdʺµRd?ýí¦ñIĵ­|’”£'Z ž£J6=Pg÷Š3į H®P+f×ü¬=3^ •Í`+5ôÿW\Å,£€Ý'Cì­‚ µm;Ôb]âÌÁVZrEx‰G[½Ø«³ ´6›ÖíZÚñ aú!‰Š)ƒû¨F©3)®š‰i ùÊÐ2Ð`SÉ45cÀÍU‹ œÇ.ˆôŒ­ÚÏûná×¢rwUúGùZ™b ú n±ãZ곆Öò¢2vÅö3b'ôÀgh,X²©WX°£9SfØ„98ÊcL¡i˜ÛK»øåg‘AW‹ºãœ¦n­Îf~â êF¶mô%—Î>ud IÙs±ûìkœÛ‹j”±yŠ×V9%.á»ö_1ʱ‘@´9;c»øÌÙê7¬CmõxwŒ×>´¶½ã6Lvkê´…Z,ÞÜܺ= ÆcýÛÿ‘~_ „%¤Þ³'º[è ˆ¾ “/äU C‚|—%nyñµ¬skUÁ­‡÷Ûõ¹À®ßK'5ƒtM­"Ç,‰3ûüŽµ ñ37¯Q›¶p]/C$§8:Í=ÑgÆ„ø©ÃJÄä—Pú÷òp´Ö “€Î!b½VɵRDm™pq¿)€`­Ž}7‡{æ¶û°½VªdܘÍ(ëD^â'‡VL5ØwæP‰Èúôõ=GfË”¿·tëióÀ¦ªÕëG¡†M¯ˆ ñë7ÇOAŠ“1ñf{âçÖ‡ú›€]±ôÄEW¾ 4†¿nã`³UÐÀÎ÷®X~h)Mñ%]E2¿‹×¹¶if‰—ö‘ÿ'Ô Æ˜®Ñ"ÿÔâî“nr1Æ$BŽ*_¬h¾}ø”M¡~8ºj¥lÆø˜‹Ê™ODа˜jàÉF€ ‰Ü¯Hy,´Œ0®rcsF¬XP” €ÛèÉÖd=+Žäyv‰¢ÀcºžMüÞà ù6²ËPFÁÝéчtÛô8|x.Æ„ÆŽK‰ætaUiœ²brÜg™¥C#D Q6—Cµk“ÓƒM]OZ<Ⱦ=\h‘l£’qCá»Áó6õsçKj¦ ÕÔÞÐôÓëhÜ’i‘‡ãk½±Žœºe¨Ÿ@-™Êlº]ÀtsTØ´¯åŒ1–ˆ:íe &ÓÛ¨U™NL:"$BSÛwÔ\¶#íMçÖ.87ùî—öGú6äÑ“ºÔOÀê>"ÆÍåì˜é+®¦¿îåb(7>1kÚÊí“D%+z÷þLÊ_6~R³ß›ºÃ @È%;~¹»¶°f®F$6MÎmDdîJ)S¥0ÞgŽ°¡¢&ja%yôR¸žˆG[¥;)LÉÆ‘„´{É4Än3iÕÑpOK²‚V¡Oܲü®[TLZôRUyÜ;Ö§¶ôñ²¦hY¸šiÒÓ.\ íÿk£’×1°…ù +8–íèÕæ·yô­GW®–BÒîS;oMjm*)t&­¢*,¥©SB=çͲȻsê=Fªµ˜¢+¢e3©Mž@QÉý}ÁýV´é5a뮽‡^Ù£=OR3šHJœKŒsz½Ü±/ cëƒðÞ¦ŠË„¸1¾öm,-Û[ZšZ˯^ƒ ò’næÕmÎ)³g ÷¬íêD¢ÐX º¿sý)ýÙž=Ϥ …Áf¨È·R…CF¨Z›_=÷…†Ç™”½FŸ/O9ø)®¥›ÉQ†„Ô¸;÷ïß¿ÿþƒË#HÜBƒÖmȵ—©hÖS§õ¸²`ÄWq ¯DeY)_ssnv“‚{ðÓœŠ´kׄ¿¼Ñ¤6³– ¼½døËÊÚëJ‡® *lúר›FS…‡Ž½w›¾»—gŒ¡¢ùuOTc}—c>Ä#ÝˋĤª]+ ?µ¬ät4†_ ¤¶ (Îú.TÑÑ…%†c„Ê>– VšlyµXpûà¢Ô² ÆJ«ò%:œ E› ¹<ýÆjµ­6hý¾‡ÑÑŽ¹áÉe;…öÃ5ʪëÖ…¿ã¡ÎË·î3woOc ”61+GE~u֠߈8ýê–¹õ¸~A2F?,‘Ih+-»èöœ€cW_ßL-ë³Ö£FYÈ(e-¹öd‰éü²¼ »—¯>”¡nl5z~Ân£:Fâg>ŒY¹gIJø6jb8&æêZÅÅY -Œ0F•ß_· !õ̓ª*°pÕ”~ã‡sIïÑŽÙèî{cø•j·ð꣟¼|õ¦Î&#¹E€±SÔ·½–¾íÖ­³ìÊÌ39ù$Á¤¦äóÖƒ¶¼^<©=åº Æ킆ûnJZ¹ë|$› ÿ+ШåÁj¡"ÊüP(í˜+–?§±*‹j©owÛ‡[æ–ÊvC¸ Çôž¹ó™5ƒH„°‚ZÇQ‡‰”ÑÈ!ã»—ŸÛzê3Bu£ghø¹—y€8rN(Õ,©ïiŸv¦ò¸µÍÔ^ß;ïø+ ‹I~~"á“ÒÎ@[‚™K´-û„Ûéì˜2p륗²õ7sÍ´ÁÛÞÑÖÅFÕf¿ÞÙç?¬è2Ì…Môé6Ñ«‹Ƹ…ó€0sˆßsL><ì—Ðè°¨<^¥„!Ñ—K‰OÞƒPB¥4°ÆÅd–VµÅùU3@ÛÎNºXÑÚ¬3ÂEû‡ö¾Oó:váBÒÙ]aFc\§C›óùîý%ñ§˜Tt6“ûþʃ¯™¦Nî²5ŸòÈD$*ý=ûˆÿÄE~j€16vŽœà¦ºxîj> Ôè|V/Ú:Š©.Ý9›rc藍ßj«?„ô–í÷ug̱l©G¥l×òd“è & }adp)v» ê3ógw ª«ÓXºoQñ±U{¾ÊM Ê]Å?³ið϶n˜CcGßš2Ùïž•*5œ±m£÷ÔÉ£ôæ/4p¥­Ÿ»ðËôÅ|[jæg~3tŠ\;ˆ…|~•O¸Ûu$0½ÓõÛ«÷MüC'bç0Yø7PÃãö_ò è·ÐñØ‚®Õ³¿Çã‹ûK2w‘C¬"Z1ÙõZÆLˆy¼še%Æiyî9kíà^ @Àã‹Ä’‹®ePÿNû×\|Å–ïþ‘ã…ìÝÚWÇ%I5_€Wàö¥G_匉ˆ/øêàX½ØAdV|âçôú¸(äóATSYÇ+:Ôb~ÂCs1!k ¥bš‡ƒââ\Bæø¦¦¯­Þ‚ñy|‘䟩n*n¤@•XÕ*& Ù>TV)XæXÁå‹ëÔPôØ+l¨e'¢:éW¿U"вUP1‹N×adaj7PgõÓº-•““ ŠSh–܆XÕ€Å_‹KŠ´ „š„VþƒFûQ9“qÍ,)CRœÔÉwÛÎÛg,Y¿ÍYÅHþŠîf±—#:0p£¬‡‡uºµAF*µ ”†<'¡B%èê¡ê/H‚úZä4qçîeÝ45QyPBMAU§Ø_%Gö’ÖÖ¶=•T3Ã*ûFɳ†P׊™SþC9‚Æcû¡¥I=Ðh¡Æ™,›¡«E\²nÎf]¯ÐvLôk§Ù”’A2±±Õå죟mrû¹QSdýO†Fæ•Å70dšÆ"¹HûábꟋD"7©$I+—@ÃçþN!ÞË]sv¿©>ó!¿Žê1|±§Å?ë,%BèòÞ˜øIå4Ûµ'Gþ'BR1¦GÅnúçôÑßÆXøqiÒÊ*½vœ –ÚÍ û?ÎG@"!*,.c©¨3iä#— Aia¹Hé¸b«j2iÿ¸À ^E W@0TÔØÕgâ›á·€¸2¿˜§ô •©¡Æ¦üo·5gók†fh†¿ŸWq}K–š?qõŸ ~Ô$+»Þçõ«Åú5¦Ü eeªIo@å6Å•®´H}O¤è7®VÒ¶7MÂŽëéP"LuºH¾˜RvVýÿ£y.ý7Y7R7ç×ûçw»TÀÂÔνûäA *¼=iâþñÛ=ÔjÊgfœ]~ eòòxsÈœ6o9W(ÛÏA–î|PÜ\5oÝÎ¥P  aBê”ñTfîYmV‘1uênI"2¥•­ôˆžZ¨¡u~ifê¼ØDQUkHz[烃XX–Ž !•?ŽL¸ýâ“@BÒmÕ!|ð[}zÕJA¸á‚;¹%@UËlŠ‘¥Ûc´ ‚¤àÕ¸˜MÕÿê¶HÄäÐ…kº3PéûÛû]|•Y@ ªqÛŽ}G ³P©K0ÆU~¼>eÕÑ©Ë7YhýG-çÒµ#¦© 7Ø wÒŠ=Cc6;ŠwΉyX\Që\3b¨Î_±êÉî ç^H鉄0–6‘зì²`B¸ÔýX~'nÜî7Ò`æF;¢«êûöæf&•"é¿oï9šô:³È, GïCBµ‘âr-÷¨™g€A•HC7Ä»©V)¶OMz!ž¼h]Mrg…û.HÏ£ÇÆ/4”ÛŠÉX3üŒÙ„å=;4ð“uƒúriiÄä­ mZñæ[Sûñ±EÁSÄ„°èÅ“Ŋǧø%9/^¼¬¢0ÌLZ™šššššR ¾>û”ÓBú£•©¾¡¹y+SSSS33ãü—ßó4ÍZ·255meaÆqñó‡O¡…•¥¥¥¥e;}µ—Öv õ]€ðˆyùÏ?g™ZK¿2Öaf$,éSŒŒ|¼¶Ó§sÈ¡›ï™š- µË>Ýâç;Þ7@eÁÛ›Îi%r„/#,GËÁ—¼¾äåé1s÷uŒe4„$7m­½­ËÜ´<Œ1Æü%Q=zO‹S@JdŽpsê½å¦|[.N õˆ^ªXùç(;§YIïä>,_êÛuæö:dJ®Íëí3r¹”‚Æ8O`LuŠ2PöÂsÞÚn.»3¾™7==:Ý/ÂWÎë³£žºdPô«Ã©?Åu‘ÿ|Çá§çVurw¿“ƒ1ÆOãv°:õ™/_ m]¤SGϤ, Õ-(ÿqÑÓÚí¢œ ½Û<ÈeèòOGX÷Þ@ÔÐÌ_Ò·ë°aÝ<<Ï<ɯfë¥QΡ[nãfø‡A£¾ ‹s „4©nâ9½õ¬{ôózí/-û1˜z;q2o¿ø¹º¨Vö–¬/w_Às;„T»)C:ãš\$]ï)‹#ô.Ï_šW¯}пµ$ûCac•‰„æWåµÂcÄ™wúê…#jù$¥™o (5t®¬íb?üäúyc&Oëãì1pÁž÷ç–Œ5~ôážAáçž $üsáÐpwïÀÞá=}<Ü_›M „ ?#!*ÄË#0´g·®SWîä8}û3„B3 =c0<#Ø©!u“¾Q9=Ží¥iÿõõ0¶D—ó€›½,é‹gÔ¨ž¦t9ß xÝda€Ïî9)=-^“ +v§°peÒog¯–!ÓL?ï;ð§Í8í|–wÓ‹]²¥²)gšáì*V5Ã÷Ѫ?¦Ä.”`nE…‘XTY—".ÌÊýV?rŠÊ~¯å…ˆ³¾UpZ7Ý\C* ò¸*ÆF’i¯Ôü†ë¢i–J¥µ_8StïEVÍR@Tòøè[ª½›ic«–6ӛ߉¶p×Ó÷_ò K"BšWJ!‚ü¯·óKt½}Œ0 `¨j²ž­²ŠÞ¼>.>íèàw§7 ½`¾cÛ¦­ûŽ…ª”¾€Å-»Äou'ýòÉÄÓi7/°‹o&&} ñú`1ðö峧/\ôã'f“! gZ»{yDp0ÎÞH «´3v„!C6E¼òœ¬rð=·û(RLÜðôqº4Œ™•E?Ê*Ê;¸xƒ\"K„hê ôÞ~} &W-úrÿSžÈ7ÔÌiog§—ºû!·y ^3wØWœœ¶ã9†æ=û.4šïLº­<Ó:mýÚM×¹ðxzÔýãWÅû´`…7 \/'­$*Ídü²š»jF•”|4»å†=v’Ê`WM¼sÆ\.¶:8¶@ANI·­vÝ ÍÒ$‘ ²„†å½NŸ6-SúVP–óñã§bm—M];4|GÆà2ùÀ ï+që6ŽØÂVUSWÓ² ¶pl0U1ž¸àÕåJ¿vôêÄ¿±NïN¦$ €Z»j ·w›dO3ÊùÂ2D¡xyY÷s±³’Ö¦½‰ˆBW¾ùñ9ßwÞ0©à?aÅδ~Uª–lí r¡ÌŠ!¦èû­c!WÕPOtÝ–^ÜÚó·„3Q’c ¦ßf`À„0ûÛ—ŸŠlJ´æ@q^‰H ú*u´¹µ.…û/’ÏQVX]i3!@(#l»íN)GjRœ[L#flïàÕK>õ?bö¿½ò?«n¤»:úV~+÷ø­ ñ¤÷/|~~j×ؘ͖Œ IDAT³×| ('­xòÔ_îÄÙ÷ûúÎÛû‹4ÑUˆEÞŽ‹ƈÂhÙÎ~Úê8O-jçèáxWG)Å$»•µÓ²SlÀÑbã¯ßJŒj™úA%&0ƒC©fld„@XvúÞÛîÓÖÍìEm,Ê !À˜Ò²cȺC!@T¼yò8ãÖÕ„ý1²‹/í'¿;Uð)‡d`®p>OÕ€!{OE˜¦WuŒ“B’m~ÙN]5¾dÁôK‰®··O@w?{c± ¯”§jj(Ó&T¦ƒC«µâ©‡QØ,dLBÌ`%*ówòa‚¬c؈)A$JÑë‹o³ô·$pÕ£c*U…B†ò".`Ž¢Æ!rJ$tNá›Ê3Ö^(wM»™vM„¡iª‘“¶ãqé, ùrÆ=æN¸à7jn╸¾ÍûßiÝ‘XB¥ÒâŠ0X;tíÛù㛞7/ßö @À¯@\žà×iTæݾªQk…ÔÈ™A%mýÝ»XŠ£ †µG˔䣥“«Va‘Ž¯Ì7©BÜ®±ì©š©Ý¤É¥nûÊg®ß¬˜ÙK£±ˆ BBd²4%Dz£§¥Cç0³|×Å—¿/íg,÷1!’©äzZ¸oŠNô’-ÑKàÛóô}»¶-¹ãeì¥1$"¤‡~1©Ó´‰¼%DBå*ów€X>Ñzé—¿é~êÒ{—ÁÖ€¥nÈRe½˜®~ÕÓƀĕ7rŠÚZµ!‹DQ©¤Hz˜p¦ˆÃz{b˪•d-ÚéØ}“ÎMf(°’Üoþª“QcwÝíÒ²9 úßè»á¿:Ø=âe¡\¢;…€HÔÿ¨GN"ªã¨lôh€¸ÎW€0tê6L\‘ºëâ;Tu@!€ï—c7=´Ÿ:¿em È{ñN_Êõ‘ÓOŠ‹Çû‘º«gÔÐwe„Ô$-Ë/J¨ÌZþY5#5a~îÏð ÿøóÁÛ"haã³ñP×ÖÏî]¡0Œ59å¾åK›-,_Z"¬ÒÊ5úù¿(UcªŠÙœ(·äÝKÞ !LR1㬗||ÇÝRÙáf©Æÿ’ºñÅû²€þ}1/:~é%™æÊyVIh·ÐâìÍ›&î3SSS¯Ê õÔ–ÙŒ‚Wß :c¶±Óâ^m·®Y'Òæ4íºÁÌ>ê£ÆÇÜ{ñ¦Xٟߜ޲ðI1Ó7Øå_°‰c=ÇÞ‹º[›ÝÌŠýw<~þüiê‰x¯Þ1ª^ý7D˜×U'0­ ㆽ½!éUQC©%06ö h+ú9òtúƒW¯_¿~õ"51¾×ú—]†j)Z-:–îô¯×¿ÿD̵$ióŠãg> dÿÅ{ú™—Œîì³ñØå'Ïž?}œ±Ù¨®³R|æí‹´ ! xYZÝ¿²öpê½/OtÌ8b´5IÖéëO$½&†Èó\ͼc+%åjZíJ1rž¼ÝO|uIÒ|õ¿m1…4f:g¹cÙ‚qã+$äÛ Æ˜8w=|ö¤™&ð³ ¡PX+Ÿ&$B¡°v ºX$‰ë1¿¢:(DáÏfÂX" ‰zEŸ4k»käƒ ë7M¿EL ,œgn;lgŒdI1±D$Š%ò §uÀȉÇ÷νÔåÆ:½ªÑKÔj B@6]}â|úñm;ÖÌü\ÀÅ¥e×…ûÎu±Ò•Ï=tÌ4é ן ØÐ! kEr̬ª…2|ã‘Ö{–-?$Ÿ'ahµ¸ðàPs˜¿içªIã‡ê«aæ»jÿëQ¡UË/ñ£ ‰HáZ*á¶Hô=ãü°Œó Ë+‚:m_b¤•~'¥ÝŠ[75Öqb™?'iäòI.B,1¨ÏÚ}1üúÑU[Öü\„HLï°Ä«ÚiËb»ý&®ÞÝbÍœ“ò1£sï&gbÖ•Úö2R4Z©úsÃtƒ’–Ž ˆD"1QÝmœI§Lß#ŸÊºþ)“ÎÂÈÆËRWç]¦2[]>gVuÚ)¨~X÷¯ZÙ¾«^Ì+CÛ¸®‘Ô¨¾Bu= NT •Üß²<˜H¾˜BÎ%eµÖvlc ˆû£ÛƒÖC/è'°bæ.¹Ä]HÙå—¸$ç«€ÕJ_z|„—Ñ=ÄiÊ•ÁZuYÚDw°ì­\¡zYÙôŽ“Ç&wŽ¡FÕíqÅPLrUõ¢ÎýòŠ•jöâü{|7r"'ö3Á\U\íKQâVAø«–ø"%Û(ÊÑVyRùÜŠrePÁ(­¡Qo¨âvµPÜæA¨V1õ´ ” ªr$1&m˜‘{ö@jž¸æ„j±BžÊònÂ’Í Æö6õ[^QiYÙÍ#±™åæAþÚ5´3ÕX†¯Ú…ºb¸‰W‡™ æ`C ¤ËªÍð:)¤” jÖ5ÿ6ë¦öÜø_̇´hL@Ê3%W–ò º=JœýÏçµtN~Ÿ¼6<öÆÑs'-5ÿzxæåî_³ýüS1€ž•Ï¢%sZª6Ks3ü¨›ÀPm<-#ú7´£ñÕÊ_bFs¬fhV7ÍÐ ÍÐ MóÝ4)sÕ¯š-J’!)b¯ïy#da¬üÅ/®$‡S…ÿ*oÿZuWƒ¹ól…¿)+ØÚ¶„ÿn3”§bÃgõµ%¡É¾”ßBtãùnÊ>q²lokg/›Ð!³Òßä£ßK†B1Ú{OG¡ÜÖlOdäÕNG_ðÀÞÎf_zVòàãÏGf¶² xY$”»Óc„^í›ÙÆÁÿM‘à!´u²³óóMXº!BPÔÇ¿£My°{öIS0 „ŽÏq²Oüë+E„.æe67 Ës!„ þpiÙsù£&,îÈôvnsðýO‚A\òãÕŸÙÄOÉ`ïÕËO"@XÌØvÀ²ÇøWž$¥Ù/ßf?3Ö!^á×ã›æ{:´·²²¶sûcêÊ{ïóÿòt"Ìûðá[ÑOI凌ÞízB½ÜÓÍÄnê=+Å£í¬¦œx$þ˜îØÁòÌ;á_c_.~!ÓTÍùÓ}Õ€ÅܳˇO8tmêõßã-˜s R@U5U¥ZYUU•NiÒÅ­¢&Ưºôõ@¿6rc ï>´¶‹0Ó¤ÿ¢›ƒÎRU6éUDÓØwö†4»ÝóK¦^ø|xÿn]& ©às©Ÿ¦s.ûŠY¿æ-RëݵÛò[»ŠøÞÚtÙÍ™ ìÚòû×3š` Ä6:}é.•©þÓõ#xsr㬛¦gö&5ìÑúýþ'ÙŽyEöÓ±£Ÿ¼µY“ÌŒ?zhj¿ŠÁŸwN9§záè$Z“»¸ôÉ°~£ó¨6‹v]´3V‘ðò.?¦_RßMçg¸þO?qg㬣¬ÁÛæto:'© 5 ÈtŽš ½É<¤·4P¥©3It‰ªšªŠ þCêFÚ:‹ÂfS0vÿG^:Æmyæ?Ç ôÓ¹‹é™Å<¦ºg—යL)oî^¾óü£@‚tLmƒ=T€¸øýù¤?ŠytU=÷ÀnVzLx|ýÔ7F@ÿéõ§ˆJ#^\M¼õ.©eÔ+DŸZ[ô‹?=LN{PÄ Ç^]œPíØ£a£œGoYŸÕo‹ìö$€²ë÷î†$ ‡Éqé’qÑݤX¹oÏn»Ëž<Ä»¶ñ oÒPï”ãGßäðµŒÛuïá§JÆÒýÛ¼éî¾€ªWŸ ÷&ÔÓöêÙ„Å–EÓ3©ŒHl6›Ã"‘}gÃÅìÑýO:C´êï¥ ˜7%éùÇ,‚̶pòóíØRÚ¬ÏÎÝ(tÙ«ð~¼¼x-#·LÀTÓïЭ­. òž9ñÅ~tãØ‘‹ù<²©­GÎjÈ@0„Dù/IX“úµ¤¯…F›*ÖoxØ.t¸øÙo’®ÞÍ)ãÓUtÝ»t·Ô§c @ðOÙ«iA{ñ~EëÉýí’Î%¶pìÓÙZ¾=½v5ã]…tL­B»uf`Œ¸tb§Ä<ª#ùá…[¯Äd5§ÞN-9™¶m½úNXQ·)8z¼…üé‚¢›Ÿ ˆò¿–xªÐ lx1¼¾}é΋B`YºúØ‘ó0þÜ»aC{Ü;}âUWÍвG/?u$/o%ß{ñQ€i&6ºu’ÝiYøìØ‘OÖƒœ+Î=°mÕúÚ‹"œµ{S¼]ÏhÑí“’¡ÝÝõ¡èåæ |“’xÿS1[Ó$°ww#†t¨ò®ž:ñ&«B×­§ÚÖ=7Bö3”c?’wn¹ôLR®·1`Ø+aÁÕ¤”w?ŠÉLu»N.mµƒŒ0‚ÊÃFÑêzþHŒ¶t³MÇm:o¸zÔ¥S‰•®CÙPöå|Rzfa%]MÏÃ/ØÒ€ YŸÍvî…ŽO.äSÌ:vîêÑ^ŸX¿çQI¥nZ||vx‡c—> ïï~>á4¯uŸÁ¾úÂŒ+Ÿ¾ÿAYm|ýMRæDÙ­äK/¾æ“™Z.þÝm[°€ûîÌÎ'ú£ƒ8Ž\ëïñ¥ÃD†¿)"@ˆ’ÎÞ¾nó’Cwò‹ËA\‘xtÿÝ7%øÉÎ !ÃßûR(âæ_?×{Èv!B(ýÒÑ›ãGo¼®gÖV’yydP´R ©h > #ŽŠFíë•*?ìÞwhýˆ‘ 7Þ– àÒÊ~Ãç®}W(áæ<‹2qû=ŒTöz÷ÞýsÂ{ŸùLne¨zyß‚þ,!tiY¯á³×¼)”ˆË¿l›=0tò!FPù9y߉ K'Ìûð퇘ªB“”HÄÀTQW¡ˆ/ÞwùAïÃî}×FGîyÄ7o¥wóÔº¡ƒæð$€oË€Î1óøÂŒ³gÆ®Þs(±¯èNUѾ¿°÷Øé©ãcDÚ­õÐç¥ã†®}XtŽZHÈ$ GEƒQùb×þ„µC†žÎøP\. vLê>måΕP™ýbå„^ã6¥Ö'˜XR>-²ç¼m'+$ð9ãÂØÈÀó¯ @’}uÏѳˢÇ=ÿ˜YZN°ýl×V m}ìäi'5Àßï]:–|ÿ¬¹Ù0”}Iô°ö¸\$ŸAòM_{‹è“¹ãS3|\¢¶óª ïÔ¹çZ .òµžt­*±hÅÇS§¯VHˆ‡ÛfzöŒæV¾{åÂÝ·…ãå£;…;…1ƹ·ÝÜ=¢Vž’åÚÌLvwö<üð;.|ÔÙÓ#áf¶¤ôK¸¯KÌ'²„•¹»xºìHù,ŸþÆåóCýú,Ú/ûÉýÐÓËcá‘{ã’KSÚzO¨&¸ðüȶ]b$ãW«¬Ú»nxR*}ž{b¤…ßT)©»G8{>%«€ÿr K{¿1Éõµ[ï˜ã™S)‘ýþ¸ÝºƒËÜ”Lé¯ü3Ó­Üû¿«½ÌMžnåÐWš›óLl€ÛÐsãü7I›·¯”©\à×~Ø™oã§ÿpèà{-_öâò"ÇAÇëõho'‡Îé…²›÷ƺxŒÌ¸øÏË›¶œ-¯J9`=øÄGŒ1•GGúv^ 2µâ{X ëŠã1!¾vzß±¤gÒ9AŽ¶‡?`‚Ìîß5rz¥”S¢A]§ïz‹1ŽŸÞsØ6±b–RŒ œuÖ¾£Û„#eMº»ÙÞ¥ëÝï²&¦Çvpü" ð‡ƒ6v®ÓÏÿYźCN6~i¹|þ£ý.þ)ïd)c¹O¶Û9t¹•ËÅ¿8¬£M§S_dÜþ|m£Ëø"Œ±˜;¦ë˜¸gÆÒÚgŸy)ûüNœµ{¯Oe²»ûÝýÒ>”I‰Ü=c°³WyÜZyT÷.ˆêÚƒHšØtK«.3ó«S¦îhÓiR¾b{¤îvõô½û…§$o,1ÆÉóü#6WWstaWî+*1~yt€“m—ÛE²çgæù¸ =ƒ1ÆDåäÿ‰+/`Œñ—ýl\f\¥s-ºcíñ²D–¶ u®•Cø[1ƧÆusp cüúPd‡°­ã{ZÌÌ­"êÁ¶(û+ùsoO¶±rÝñŠ¯,Ë,1!¬,+.­ ~kòP¿HOKII¹råÊùÄýÃúÿ°ˆ\ÝK àÚõ\ûÁaŒ*_µµ“Qþ• :yš§/™–|ãÕÇoBvëža¾l2·³Ä™/—ÆÍxò*¯LàêßÕÕB³®ìn'ÅFjáh‹ø·>Yº. •æ½-ª´`¾zõêÕ«Wï ±9•ñìý+…„8Ó&8¿¸põ+ ôíñÝ|!5À˹áfŠY&¡T¥Uk™iãʲ €¼ûO*ìûú"iéV®Õ@±Ò¶ÿà5yåMÑ wÑÀâË)ŸôíÚµeË<þº]úµä¾½ôI¡¼v»àˆ.-nž;uðÀþƒ § ÉÔâì éŒ!ÒóqÕ–‘¡i¢‰Kò„uÜ/úFZâ+gîB%'·§[m Þ& op«ÛçN:°ÿ`Bb>© -`‘Ik÷ÚgÿÙ',ÊV·ì쉣û÷ï?tú¶„åE|À„HËÜ—!å¢QYtQy1–îk`鵃±1‰ÑÝÉTjrݸöš¥¯F)ü,íÜb={ã’Ï×~¦¨„u4í´ö²€üÔ¼ß3´ÔmZªI™Æ´ j/*H~_.E-ä¸ø˜¤c¹pö‚É å$„L<†îX9„]‡õ»ª]t]6ñ†+ªÊII Ë óð¼a‡å¾hQQQ—fß™]Ø.Ëó¶…ëÞKÞKXŒv1hŒ3$*µª!¨æÞ‡òB.Õ^•RÍlºÊêm;OÀlš]I¡³É¹å¶«¦?ɪj ^v‰ fùñ)uŘ3f>Q==-Ù Õ©LrÍÇP‰F€Øú£tgݸ¼t¨3ïÎÎóBËó¡FðýÖÚÓŽ·ìÜ7ÜNJáþIªA ˜ °ëø† ÑšÑýN¾çõŒ`cj•RuÍ#*£Š!j|ÔDfQÈÒò…•bIÁ×IcFÖTÅ!}̙ʡ’«N(ÐÕX’‚JI)O@%sd_°uØ¢ìÙévÌÑbÖVpJÜ·„jø€0”qùd¤F£È¼~*ÆšXÒp+ÙåHS…Q]™ªÆ ”–hÕÒÐT'$Dai%Q娪ö¬Ì«¤šª×ˆ“ÎF¨´R, ±ªû)í_ P«Ä çWHØt¶œD¨ª3yYÅ âTM|V9©ôÚ¾Á×öÕh š8«l0KÕ(»ºò¨1»ø°êî%¨èq„Ù…ÂjÆUòÊVaÒ­S¿úÍ(Îùò"mïäãìÓ.8©’9ÆÎk&Kx%ïß<[±`θùê»÷¬5óüªnäUôTh€¥Š™ ÒÕ‘P0?åa€†²Åí¿~qV »Gí?W9úl(IN=W‹°BØØnK)*(—TË7¿èÐPÛ>ÁP•\Ϋ¬á«¸¸„Ç0P“ŽŠm  ;°'Ú^Zã},þI9@Þ3Æ0=–\(Œùqü¾…­kK& lëÜz·ë&-ôt¹¸á}JQùó«ÞØulG:ˆŠ_o^ù{"GôT¨4ã׎n­=&>HD•bI{* +(mUÈê,†H\!¦Hû°<¯’ÚZíW3‡²t .IS0p³Š©a>ÓU‰›¥¼êî“‹ø"N­”;jlôø¼ƒW_´ï Uןa„ ^^Ùœ^:g\}Ž(»HP-N<~Æ*lú_ˆpAú*äŠb9qÂÅÅ<†ƒºR—.£¥:ñ-(6qŒo­¼¿?&¡©®b‘ ö´ ]søú>Ý’_5ŸÜ¹BiÑ­5={wܦ/eÐÐ7íÕÏDXô¡”xviïö“¯€ÌTo×Ñ«³¹iiÞǺD©Od‹#âÛ£gÀðl­Òéj:m5Õ(7Î<ªZÿ”Ý“ð±@P÷<$ÆìÏ-z’´aG®¹[SšÔgi©’*‹ ª´Íù Ÿ(ì¯8Z1ŸKÃÒ&–ß¿ñŒ êJÛÞ’ùW”~@P›¼§oÞUÊTß÷‹‡2ÕmCÍz BHÑ3”Ù…w·œ-`JD?Ë‚1€z—Ho¼cÓ•»o?¹FŽ¤ Z*´%w%æ5†–ˆ%4m]ÙjÆñµEbA4¬´ÆrÃáa<|,Ë>eÞû.;G¿8pY@`@@’”¿ûUjÝž_~KÕ hÃêàÐVPXüü[‰´ê²û_ÑõÂÚ©Õ³Å!ÆMJ[H˜›èñ¹å_óx!œ˜ü˜®ôw‹IÌ=Z¸˜–_…ÿÍ…Ã¥z¾´›Ë°\;Éî펩qW?ò$²MÊÜ §Oü²Z£gNs«ÄééÍddÜÍŒÖX<®ÛYdß.m _}x].‹ªÉIJø¬Ú>¬­RuC ëÕæíɤœ*J‹?¤L{ÛqËKÊ*JþÂT€0 ¿<¾ç¸>¼ t6žš‘¯±çL4‰D¢=;¨×EçN¾†,AÆíôâv=Œ(å–m^:<-µ“s[ƒÂRo¾´]q*ÃR¹w û£A5ï$&iyøY@Y¶Ì¿¯ÚrÃÔ Ð9cß? p7c>I»ü¬ÐüDß~Jãý¨íBè,]wö±kïuT@Rãžâ݉ÞedôÒQ½íž_JDÎæ¤ bIƒz7xø¸=SW÷q£ƒ)-õk›N­ŠPÚö¿ ÙmÉØ”Ðá={‘s_¦¤Ýš±Oñê þýÛLY>báŸá”ï·ï¢ÀYQ†«—í¶[Ø¥iS†ôj9¿>û—Çf²‚7zK'_­ƒÚŽY3.æK+;ã¦ÐsÁ Ã…‰«vt˜>§­2#(*6ff¬]“þ(ôw|œzšæ3×PïÏkñóMtSê±ôU´²\œ9ýs@ôÒ.õécÄt»$ìÆŒaŽ»´¤_¿vj=¬_”Ô€P¥Ü/Íý)õâ…ö}œÔ©4Í+Óæ ¿Ú5T_œyé•=—Ûi)ÉÌÏÖ±`¡+SÇLµé6LF gSÒô ﮲iƃC¼Jžc˜·‘ó•Ùbz…?RfNËò²4dèfŸäžQ=û‡øy¼º{ãif̶85¨ZPVéYó~—L˜6½²¾¶ººš¤¼¤°0GÓeôÑ5ÃhÞãVë…è3è]k»w7¯fd3¶žÑP` ™Ö’Á8žv ¦2cpÖòoÔçM¹6ºWÿ`Fá›Ë©·Â&ì2EÊCªLl ¸Ö·{„Ÿ·‘õ2ýþk¿™»š¢nî®ó¡ÅÕKš®DÈ .l|Z¤hÚ»8hQë:¸0EÅh`_Ž„_Â#Z9úΞ7«­cdÔÏÚH]"ä!*ÛÁ'|ά‘ªdÄií: Ж" ¤Ñªã¨yËz´W‰DllÞÑÆLK$ŠÊ é1®¥ß‹EíÜ{Î_6F‹ €±vôÕhªm|»ؒùeL·ò ]=Ѫô´# ´ëh@0MBG0¡*/‹ªO°7—›•[fÓ5z¨g+ÅÀ©£9"º‘«£]¶Ü"ÄÌ–®Ž–4Àj-íƒ;¶À4U“Q‹»ê 5ý¶ö–ºTCemWž¿¦®‰£5MêöÆ„ˆ—O 8 IDAT¢çêdÃ"KóIN!áíõ8åee ó~“–ô÷l%µ„ßÝ:t»ÈyX¨EKçm´¨å\=뀅ã{˜Y¸P©"Ž¶I‡$ ;YTLˆ™:ílŒIʦc-c Áðá`¤!Í´cäÖN—^QV©ÝÎwÁÄÞfíÜé4Kݸƒ™¾D‚ÛXulc¬*m“­lLõÕBü;1ARÉ>S&õìèÒJ‡dã-Y¸e[ûö­4¤Îb !û¼½£ B4U;'m–<]„˜¤îèh¯Î Hk-:G¸˜k‹x$¦–oÄØ9£B(Añó-'ß®8~Äš\SI±÷í;gV?BãÖáîít¹%ňmÐcøÜi}I LˆIj.ö¦$À˜£Ý¶…•ÁV³tp4U§˜Y:X´à …Ú€Qtœm9T¶Wÿz4!O@´9¦3}óÉ‘ýûè°(òƒ¢­}5¢©èÙ:9ê©°BÂ{´`“KÊyZ­íGÎXêÓV£–$ ŒÈæ®Ý†8kjhèèµ±qî3rÖôA>4„1 [¯ß@5”pÅ&öÞ3æÎm¯I•2‰®eélÛBÖ¿1GÏʱƒ Èn>¶ t5ãŽhL]g'•$•rûÀC•òÒ2šV«¾ã— ñk#[ÀbÃNVz˜Ó´Û»Ø!#0¼gkUj%OÀÖoÓw䬞f ÁiíêЦ^mBp3žeöêHú»þ™ Ûa<½Èß=úÂÿkN|8ØÁ¥«üVôx¹I‰ æÊöãßYàÐ'«BÜ,‘ubdÒ‡Œ^^+º¡ah¾‘ç ˆUœMØ~ðJ¾þ@‹fvü]€Áüp6nÙÞ³ÝBºpÊߟ9“Ô¡ß=6ù¿˜ééŸ ®áÜycVŒÿAßM3ü§Ÿ¿ÿ˜mÝmÂôæÿ¯óÙ°Œ}:»¨ÒÉKec•ñn›ÜzýéëŠJôò‘ÞÍù„”lÈéµ1ûyæ6ç»ù§N³ ™ÿßJ»ò¼×K…r‡æ¤Ç¿I—7«›fh†fø; ±ÅÆ€ ²8/¿„‹˜º&ZâO?ÊŒŒèÿ[|ê^œ ´L~öW1MÏ@›Yk†ÊÏÎRtŒtX%y_Ëí–úlå(D¥Ÿ¾—µ4¢“ÿb¹Åßs¹*­ŒÔ~–øÿ§ÆKõͦø§-ˆú¹Š‹³³*ÃH_#7ó Ò4Ñc ¿}É‘È¢2Ttô´hÒ2¸¬(¿´‚'!0™JWÕÐRcѪQcDia~YO‚D¦rÔ44UY ,ùñ£DT“ f§™Q«÷ÂÅ•™™Ú¦&äÂÌ ÇT_³©ÍäåÊ“˜šè“aÈàÜìL ëèi±`3!*ÿö£P>UÃÐHþÛz»aU|Ò½SgÏÀËîà/‡Ú;ý}{uàÚ’i™¥ mç¢)\ÇfÔ=3̽OÌmŒqüGç¡Éõ¢ø²¯]ÇEü¿Lä­øîvþñÿo÷ßvOòò¯ò;çÄÌY¯ÔÛ½ã"zOØ@`Þ¸.íf¥VbqFµ­‡pHHHHH°¯‡ƒƒ«gøà¹Å‚êƒÇEÆ÷öëìn×ÑÑÓÓݾ£“·Å'ßÊÎüÆ¥ñ£ºwvsêîáêÔÙ¯ûº´¯ãÌ£Ã;uòòöööñîìêêæêîåíííííåÕeÄw¹-AÑmïö>wEøùÒ®nã¶4½‚»³ÍÜF”üÚ!ÄüqQî#–ßjx#©äí¾NNÁ]C¤œ sêýïêmJ£î Îûñ­rÖ›ÁL€È$r]Ï‚¢&U¸,Iúj]=„1Vrø£*èºî&Æ€àÒåÙÊm„ªG$¹ö­1D"‘H€Ælx0˜M™LRJ˜’/dÏï·!‘Iäº÷%É/ÏŸ:ìkÌ#צ:Ï1–Þªô:'é^ó‰r'(cžR k×.½ Y“”´·ŠYPtýf¦ô ^}œQú±”žôôw•¦~uè!ir( €DcÒU´Y ’ÿØŸm(+QúæÜÀ!KçŸé»±5€h݈~'>iÏ^}¨‡s+¢ô®Ջc£X¬ÃSƒ,ЋSÛ÷½/Ý- 4B_Þ4zRô`—Çiî‘;nFJ±òÇu²¡,|çO¯Ë%DæШl PµU˜\F}_ç‰,³µ•ô8†ØS#uRɬ34jóVT–]Éò»–´œZ=Å ­nFÞ¼”mŽþc+9¬¥>N®Ã’€Q­žDXºÙxwg7×NƒglüÆ„¾°±ŽÿS$½,éõê^æÖ¡/$Ò¤1¢½‘n}ãÎ#$IÒ±ß|„$®ÈÞ:w¸·‡«{'ÿY[/ñªt Á/سx¬¯§››»{ÄÈOsEñƹÝrLO¯36 D|¾ydp?77·Î]zÅ_x%‘ë„y7Íðõpvû?ö®:0Šdéÿzw³ñ Üâž@ˆÁÝÝww=ôÃ9ÜÝ .ÁœB”¸ûfm¦¾?v7º ܽ»÷î½/ýG²;;Ý]]SUÓ%]զ˞{_‹ä~Ù3˵õø[`Œ$ »—üäîêääìÒoÂÏ’òj×2¦ˆÛ4©—ƒƒcÛn?=Š”Ô²&3øî´œÚvtüq¯>5§ 8½®Ckg×öë.;bÊÏã_žYߥ­³ƒƒSç!ÓŸKW•ÍÓ.jÀÉWLèçâìääâþÓ’] ÕR&Kü´jbWg'׶]ÖöW0¦Ê¹y’S—Ÿý÷/dÓyÌÑQÎvcw1ÆT‚ˆWdŽð±øé×bZº3ÆrîMmè³$áãaO‡VKÎ&2>n]½‰§ åÐQ‰…œ¨WóFtwv´÷ì1öÖ×L¦š²ë»µsuptpî3~ùç4™ŠäOæÖ÷œ‘•úfú@GGçNƒç&+iaÝÝ}Bõ¤£œí¼ÍcàYÝÙÝÙÁÞyðŒ±%cŒåDwnk½åê×S«'´usvuï²ûacìòh›Ío’^_Xêâê˜Í’o¸Ú´:ù^  ¢‰®¾¡) Ò52­`¤æSEn~È¿iÓ®S\Å÷ÏúÈý¼çÌÓ¤±;Žtµ¯«©ÿeÒyìÊ5^•ö¯Ý“ˆNˆ2ЭmÓÀHƒÖnâö·Á÷M UÈá PJsŠTõ'‘‘¡iy#À°’©©¡@wçö²è1CQ\Š3–ôùΰNmìì]G/ÙŸ!ÏÏçTœecŠ×[;öüå?{³³K‡sÞ&qE©N z+ï_äåæàäìµáJ cŒ=^?Ѫý€)¯7 £ŠÅeŸ2'¤»mÃÅ×Óþ%›y雥$ûëÛ+žÖö‡Þ'Ä$åä\ñq³»µé<}kPhxDXð¾yC:Žˆ‘Ò¡Ù­;®VeBÉZÐųµ§ç¿""IHgW—ƒ÷#‰¸€£›—íº ÊC2ÑӡÁá‘¡A¯çvkÓm¶z‡yzŠ»×ŒßƒBÃÃCƒïìßØiH’’Ë ¹ènåvìy`bš$+hŸuCÛ÷>††…=;éiá¸ãUŒJ™š5ÜÃͻﶋCBÃ^úîu·±Ù|'‰ˆ_2ƵÿÒ'D´on[ÏI·‰èÈx·ösŽ…†‡‡~ñÝ:ª±Ûè4ž(â…­[·îã}‚B‚?ý:¶‹S¯™RŽ'¢” óm­¬Ö_xôüLWk«å÷‰(îù‡­úED„>ø}±G»Ö6ýÑ2ó€OÉ ^yté—öŸ¾ÿáw~““}ë“ïrKŽ—Ê™ÑÙzø&ßàÐð°ÏGæw´ì¿'"I@{Ëñ;o‡DD†¼0ÒÅzô®ª;æwhÝiôŽs÷ƒÃbdaíšux¢ÑVr#Ž;7÷zœ]bw…ÿ 'Ÿá£×¼þ›*'.}÷ÏsùS3w±¶[xâIðׯOÏo¶²s¿ò6ø¬u#»x šó.84""ìòö9önŸEɉˆÞ-oeצ߄-AQ ɉÛ‡´vŸ¸‹ˆKþ°Ï¡¥·ohLR†„H²sB¯6ý¦|=½~²“wÿOiD¹q=;¶vï:Þ÷mhRrrÀµÎ¶.¾¡ I|ðO=<Zt(::NÆQV쇕K—¼ŒVñœB&“+y"¹Lªä‰/¼[ïá ®àÎt§–ýÑÙ­[öÜHT,f-õFÛf-·!"Šº¿ÇÂÞyÒêáiŠÂú{Á.Éã\O¼’¢Umäy^*•óD¼R.“+‰øÏç~[¼í$Wüæ”[í­læ÷‹ˆŒ|ïw©_ŸvVžÒKa™À=­l]¼û¯xÿ->1>êä‚>¶]¦fpX&%ƒ”ÒÉC<ÝÛÚvéIHhØó«;ÛXYï÷—Ïû]²~w¶œ'¢ÐSƒZ>™õü÷Ý;÷»ž©FŠRš¸eÙ¼‹²ÿeêû¶IÂSoKûˉã;s“ýÙ¹µ}%%žçyž²ž¶±tÙ÷:áí¹U®ÞóÒ‰¸´/^®ž6ÿì=éG”ññ¦«s›WÉŸ&zpZ«#sòµðãÖ-:½É%¢Ü•Þ-Æ—'ôã’•ƒ¦ïൈéæãÏ~Ο%>EÉEjaáú{°.î՚ƢämÓzÞ½QR÷("îõ¢fMݯejXD;_Ñ‹%>ÖÃ6kò™å]±èÈÓYÔ OWÛCÏÓÕ„! ïææºüÄS"¢÷+š6÷~ Qã)ëÞ”†nÓ³ˆ(ñœCó¯s‰ˆr¾½ðpµ=öZcT~ëáæúëå$ïÙÉmê¦Kj(Ò=Ýwߌ eÖ´Þ^SÖ^Ñ€Q$ TAcÎ ïFÖ»#ó/d„Ýîje7óÒg"Ù¶ΞKÎjÅü`§&3.©Ž<²¬_·ö–ÍÛ{vŸ·fçÃWŸ²”Ef+YÜh±3–€YâßliÕm’LsÓÃ…}šµNVËíiaáv84[ ŒänëÆN§¢d”Ou¼R:yˆG¿É[Tò¹É:;.Ø÷¾h¸¬,m<» œ0qâð~,­]N¿K*Y¼þ•¶›’t,AXTœ®È¨R]¨Îþ5²2È}‘:ª¥5Ÿ»6,Õãƒ$FžC½^¸v6•ëâÏWèܬbÕ“èÙÇtCJÝ°r•ÊÐ!d™&ÂärË&zýæ ¾d‚ç±jž{ Ô«fÕŠ…Ï“Žiõ„sË玻/QWY*ól릵]˜Z¡4+_. 'F›š¢Ûwú ±kÆxªÞ®Kï!{V«RA3z9[3¡jW+01`¼RÁ:‰ßóz–¾¿¬~ª$,3!KœÅe½ c-úÔ„úÔ*ZºT#ÿÒ 8Ihb²N'GsµIK¨cQÎä\ú·;któ±Þ8³ëÝêMzôé?°·GÅòb ÷¶¿ÌXÿãÚÕ«8ÀH‘`Ì}}‘ˆš•RŠª¹¨±­çjï²÷ÖÉðµŠÏ›îËFot(©ûó$ô”Æõ­5Š`°L¹wßH뻚kÂ)ô-Z æ¿\ª[·¡©š0t+Ù±÷ñê#ŽœQõ¼šº†zŒËQ^hZrÇ ýÎÿ~ ` "|Œ‰† xάR]õ°"!8¥¢ˆÎªE)ÐtôÙñá^§êM½Rš%¶¸´c@¡'/מ}Šç!Ô©ôG»ÁKõWÈs3_?ö=êø¬‹G„ÝÎ_[[õO—„Y€{‘[¹jM©ÙźmåÃ,%²Œ€‘ØÔª¼H­‹é7©o˜ùò›´oÅ"†E¹jVê“ñ@($®h"¶ý6éV¾qÝJ"Àƒ=g]àô|O’€ý+á% Šã9Æ„*€™B±’6¯Ãs¡‘éø|¹j·é•š‹*fïˆËD°ŸoýÇ Š,'±¾I½zõ4vU6nžuí €xͼTÏëÉ«€€ç·»9­kÙsÜžå£ øâ˜ÿ–Á3/è¬Xó›Um3#Ýëã=¨ò"ç»úÄBÇk?ܼóü‹M:<õíÿìZGû5Öý¦ìY2L€©lZEÐÊÉ9V±zíúõË©24°úõm\„Ur‰‚Šò{t¾çA'%GQk0±ˆ)9E) o¿ezø½xóîÅÍíŽKuž½qÝK9GFªÔ¯WO©^{½ÉóœšêiL :úªÄWDèÚÕqÕ³Q £·Ï’uM][Ôr´w׊Ä%²­Z¨K9¤Jý¯’ûæž&¬X£‘uU*?{[“Í·ßKÐ× ˆ-6ùyDºQgKÓ<é Šô+ºtèÒq`FðÁcçüvxðÊ¡-þÚè©œWùdTò(ªD–I'„:‚üTaBÉ9mÕ¡Ô®žÕ Sšqõ&Í ”¤jÕý'ãóßÄ£FÕCÜM TQµB%—™‘Í3]Fããƒ3ÅU š#mÙõðO™—?õ]]0îUWú)òõc?Œ^P­Ÿƒ šV3Fò=ûõ7¨J³ðr9/‹@œT*¯P×¢k=‹®ýF.O¾ææ¶ææ„áÝŒóß‚GÏ„8LÜÚÕ©1–Ö*ߊ/KüÊÃI@ÄÀG¦åV0©¤•‹¥¹R³VÝXuë?jEÂç6›|'íT"=›µª®|PÙ±w?+•=Ÿx%A(dÒúfÜó˜Œ<·AÔ»x-Ž­‚öy½jårÃÃ¥¨ªGD Š¯i¹UêV.YЯӧÿ·€S(™FŠ4¤ÄtZõôo;”ÞüÅu£¦#˜Ð/©»ªR óCvIèÛÔÞ‹JVímÀò-LbTÕĤŠŽ(;>AÉLT‡Œ2ƒÒQϬü–±q5ËiâÖ³{}ê%,—*ttÅÅ碜T ŸÖóM<Çê;{{Ö÷5>ÉüÄÜ ·¦,iW¹ÀJ§—í’´èÙÇ€üÖm‘ÍFŽq(O"6­cmbj KKþ³fÓ’|~‚ÚfâŒo< "cÑ‘)€Y& gGI”Mu”±ÑÙ]+‹ V„ÔJŠÅ6\”‘¡W¹ž™¡ >yV‚‚7)§ÿƒ.ÔÉ3U"žê¸8—ËÈ>|ë-cŒ½=u*ÖÔ¤[³jFt~wùÄÕ”j.U Ö¦Oó‹§÷Vnnk*ˆ1Šyûøö³OsÖUïSÀ†;ѪýYÔµ5íúÏNáù‡a^=jÌûœR)›ˆ`ð\éåêš(#‚“T[»{¿­û «Ÿ“ªÉÆÄß/EÊÀƒ,Ò?"¤®E-éa•o{ö>ýU³™T*9¡®©¸<êøŒëwpÑ㨼‰ç~ØuÖ@¿CïÆß~ߤ¤ïü vpÒ”Sö¾ü&#Æ ¡~ífõkùúU¿"î¹D„µG’ø‰O¸ÚË{èÓ¬<|(”:Æ@Çýd·ï{—«Bà›}“½Gl•—Àȃ&9Üc»´º´lèš“Oy•¾ HعpÔ¦W™‹€8)âå…#/½OQ=}Ü=¸2,\bÝÞåÏñc”ôñ™¯ßÛbì+hÛµEÚÛ·çU Å”q+¯Ó1ö%± Bæš5WUÒóõÞý1Uw­« äQ])‚’¿¾ö}ð\Î x±ypŸ~³>çŒAúuõüœÃ7SðÊìÇ·n&ÈÿfeŠø\‰D½ßæ9’\žÆ­N˜>uñ c*³Ò9³‘ w55`ؼŸé穵¼+ꉘÙõŽY2­š÷T}U~'p7/^šiÿåÂ:˜uØ¿#rÑ/ýÝ7W,'¤ * ´¨¢€ k¹tžÇÂÉûÅUÊë*c3Ðnò4÷  U[Ãe½¼ºö;¼aÚ£ KZû®ª“[£ýŒ½ ŒºŒŸ7ÂtÊùr3’ªZY5¸w¶â¾†Õt;od3’K%R@!“äÊ”Y/šåºt¬ë½ª¦bEL†°ãÌY®Æ@²jùQ–9•û”µ›7öÍ¢e½ +U“$D6öøeKgÍlîôrâû*æ•…fS§4]~!‡”¹qû·®k[³¯]-]ª?âÜóÒö™+6,›5o›wsÄ%(]Gí˜é]Yë;™Bóî#ûú-ó±V¨!Vf&*ÍÆm]U@ÃÑkç%mžÞö¬Q5aN²¢BÓyËŠASÈss Ô*! Žó(ñÚ¡«uØPG¨Š·ÐÑÞV«¢Nb²Ô¡Ë$ÛÊÆIs%r%Ÿ7}n®DÎñêwql:óèo¿£k~¿P;õÕœ©S§ŸbU<É—›#Ñš§P­ÕwÅ¡rµ×:¾¸ÕŠ8]±ú-¬]ØÖµ¥©*$wЂ­™+×î™â³8“•7ÒÉÈ’Ölb;fë…M å[’Ir„Ü º×{WLhòÎÕ²p ôìç¬ðuc÷V{ÌëèŠ §Nw¿0Z”È2§_}B#ÿ^ÝO ó-M0bâ²êbÄ©n²L*‘磀¤¹™‚ðáÔo“}SžÞ>o&`VŸý°`ÞHWK#“¬lE+÷ngWöÀËbWÏo³úÍÊNâ?-nðG¬ç%›ÒÕ¿«ìÁóEHó.ð<Ïkq ðE\ …Çÿ¾Iœ§ïtÍû¤u´ÂkÔòUë„|‰¨ãïÏï·î¹”/<¯m-¥-N+¨Ú—ËZZðµ­‘/ ª<ϽÞ>c†oæw‘ß¡ø|A¼óTx–ïb¦ÐS(8qI$Á—6ÿãHþ Ï—€¼£ÕìEã¦+p.í,ÀíiæÐýk†¼èÝ… +ô‰×¶n^+x#ó~ˇ-ü/(|wÃW`W]²)]ý;ŠVö`E }ä]P…ùi 2Õ¾ïcìGvq ßéZ°Ä¥ö; ,½øW­²PÇKS¶t³×e…§cZ×ÂJÝvS¹™ö>¬ÐÒ €¯m¬4¨uÆ ?ð a »ñw‘ס8±‚xg(<Ëw0Sä)œ¸$’`¥À¾Gê%ýξÓM™•N«©·×„—sÓ¢Ù`V‚‰±¢¸-ô‰i[7ÓŠÆÀ¯ÈÜù½õñ/´²á[+|^ãûä—ùeÖâJA±³¼Rßbš‘MÿS«È?AY–„á¯Fí_vj7hW£AW¯Ý;ßÐTü æ2qóOo¼23[R‚…ÍÀÄ ,ZY+ÅÉ/ËÈQ ÿÙ/„¿TÜ”Òÿ#© ºW ¹ZÿD.‰¿Ãÿƒ¬¬ýsÛ_š¶†1 7c8ðä¯'ÜâíÒtÄÆ"9Š,ÄÆ!1 PEY1´c` ñ ŒppºJ•Å…wÿ¼5Œ¡¯1ù7¥b˜þÀ€[‚1ôß FjI2‘¸8$¥@®©çÇ+‘ø!)ñIàÿšɳ’R2x”’¤”4%ÿoßn«VÍ+³2ÒR’“SRÓ%2N­7¨’áp²Œ´Ôää”ôÌU­Þ2•à n´›€1cТú_¿Ë` ó£Ë$pìÏóê«ßШ rµðb2ªW‡ÏY„nDõjpÚ¨ÞöxÀUø÷øéW@¢~ÅÿÌÓ3Ð’ÞŒ@„É}ÑwþP܉ØôÄj=Ü€úµPÕÕª¡ju´ðB6À’(42Gî`r¸Ô@uH¸¿dAŠ—?7m=& @È×öCó©yäû—Àå¯óGvíÜeÎÂE£ûõè>päóè,Õ zȃg÷íééÙu辺NÛûH“Ç£¬ýáö#Ùü˜6Í¢Ubà ÌÛ™kÉÒRâ~]ûýù¢àpúÕeŽµåj)ÅM¤žyå4|5Q×ð.2‚Y ¨V ¦ÙP]sFDòÙ€ýPà³Á {aûÊïá Úõ¯’nÖ|ÉݵŽÆrqñ *ôý³/†”pŸ ý&Àª NmÇ›h:Q[!CWúå Œad +E,œ!@~2¤"]Ä®ë“?©¸^ Ò”4¥²æh¯áUb6Æ(ûýû˜&Å%‡Ã2†ô'+Þ–þþÔÏZýÔfÒò‹þ{‡0†c+W¼BÃ[¯­ÈB/wé=u§í³ñÖz?@ÓeíînÃèò` Óo©5‹­–` ÷1øMch¸——ƒ‰Šñ5ÀŽ>#ƒ$C< #€® ¦ìÇ@"ði˜Õz"0!¬:â]‚`+óC IDATúþoWÁÊ Ÿ` .ÑÅãá>0ÂÐë` ’Á^À«9ƒI ìñc ^KèÔ@j.ætc¨î€ )X2Œ.+T0†É` Wâø1Ää€i5¨Y†fPKwïw{âè8Tw|=&À…ϘjÆp2kµcP¤`pk0¦ƒþKÕ‹»ƒI(â`i¦‡9gÀŽÏ„¡ª-BjàI‰µc`"cè1JV¢¬ë`ÛÊ7“0†ë›Á  ¼? ÆpOŽMMÁæ>À‘ÉÐa¨î„Ød}9ÃØ-Å´!Â/[Àë0Nþ†¹Kà÷;DÿŽt@¨¡&z £}µRyë8ŽÁ—Œ"ï{ƘäñŠ¦n#Ò8Ry¾³ïÎnÜvª”1þý–m‡'†ßèÓÖfÈöPå«å]G§Q¡+Œ1Eœÿ’1}ÜÜ\½::ò(œcŒÅ\n1øPvÌ£‘Ý=œÜ†ÍÙ–&#Æ/ éëØlÑÍôbB*kËìÁÞ^]Ü Ö¸´lL¢žPÏ<âݳ‰üó»4È~ú,ÀfÈ"Õá]ݺ>mìj==r‚#|>¾ÚÁ«[Xš²LÖü±íæwÚ¨rÐ4_u`Ð hÂ^"¢÷ó ŠíI 2(O¯Si\uèÈ3""å{*Ç ^£©½Ôl´*Í ÕÒ%€œ»Ó˜>´õ=Q‚/¤gE­ŒÉÉôA9¯¤„4Þ‹2­M3gR Œ¢Ïé›Ñº_©c3hÑ]""^IvÆ$0%Ç TÓŠª1¨¼=)²iQ_bš:—®DUt*’ˆHN{öÒ»tâbhï~òOPÇ=·!ˆ(HJo.Ѩ¾Ä@åÓ‚ùô9ƒÖ%€5 €`Eò24nv#€j·')Q² @º-Éʈ›«ì4¬ ¡UdÒ’2y¢$²ªDõŸOkg‘dfG©Ê¢qWCªÔª*™4¥ºº«HQ9üŒÆ´%€ÌÒ¬YFô» TË–ªXP9¨œ9×$gg€Úõ…ˆh§4l;O Édù±_'@°!Žˆ—ÒÙ“tõ1G7ÎÓ¹ëÄñDD@­|§%IÏ£Ÿ›¸OUªáϺ3«‘û”\"úº£•½ç€>3|Ÿ¾ ŒÊ•?_ÖÈeT*¯‰UK—QnüCË9{o~üü9àþñn6VË}#‰(ñÖX›6]&/Üý9<:&âõìö–½7?#"^·nΔ“or´DËÉ3Þ<¾¶xl{—N³–n}“[<¼-ûÓ.[Ë®O5)}ŒvóZx™ˆHúºC Ûcqy7rW—Žö6SÆQôãs³—¬‰/+w÷×æ»)MÜ|˜¯fžAê›* nÆÖ"€lVªhZÔ§Jåé¹’æ6'€jŽRwy2‘*×rˆn©\þ’ˆèÙV•‰#Šþªç£îåhU * A¨F "^IöÆ÷NUþª$ ˆ)TFôœByÊK‹ëSŸ,ZÒíx¢¼g¾P¸%/#»z$l@Žˆ(ü AúªoXX2sWýò˜&L¢Å'Õ_k€„F˜A)~jöþ5Œˆh²  ""J$À”‚ÒéÖ¯PãêîktæmÑÇ1¤*d=Gýµ¹ $ß`"¢°ÍP‹Þ¦±%€j¶&"J¿¤FìôSDDSÚ@õV7…â¡éî‚`L·S GòŽgíÓˆZ6¡_ÿ€¸ Ýݼ…Ëþ0õci7¾ÓíÆŸÎ*ôÚ4K×9iDI·ÇµlÙý½föÀÃ}[tÞ¦üN<®úŠ$öõŠI½]¬»NÜ,ãŠt¹¼a‚ÝÈqzy¹ºw›+ቈÒ|]»ßÍO)Å¿Ü0Ω߉’/=½¬ý}U4£_ñº_Y¸˜£G ð:ˆ¤èŸSªotž ß IC²êÝl,²+õP™€ú¼ Æà1`]lÉ NŽÅKœTê¡.6÷ÞU« )i pÓ¦\)¦³Bá–ò\¤Æ£–=T•Ã•*7Máƒ7?V›$¹bp&-Äž©! ‚"ÏðY“ë@cG }'*¡….^*!çô "ö ÊQÈÍxÜûŠÞZŒ,³{«?ZYàÓ¤ËòÁS£Hso«¶ ÀÔ "@ ôèícëCd|+Ñ*¿{2Æm‡Ø¡QÛ°ÐÃ-˜U†§¿ü ¯[ÑÁLPrŸ4ßWrÓ¦þ[7G)x¹i2}ɇϹhpf­òª©éé3…DY`¹%ÅÝ‘¾¹Õ¢mÇnï™·`ï½h锊bA¾…'+àô û!‹æôµÏ{´tÞŽ ßm`©*í]POä©XÈr™Šô—™ŠµPcqD5mfN%T VMÔ9¯¡£Šw”CÎ@…¼ì7úÐä<¸<66A *Á­«ááΣP[C4J)Ê)±z]šÐpUŠ•bQâ?D2Òd$H`]·4š21U³èõ_ÐiʵĴѨ ‹å3Vð>Cµ¡L•p¤¼fùêD9 )4vE7kpk³:Úmººj^|ï êªêÛÕâÆXÄÂ’ýå à°d;>Fm½Ò‹ŠÀ×o3ê JI^ÃI•ÌÈÀ@OOOD ¯ßrè(‹Jª')°?Àæj‰–öæÚ勧N_4lÕiÚÏKšŠ €ÅŸž6%Öaö‘©]À¼ï¡}Ùî=ç½ìqÓ^¿j9qfL& ÉP›&7Ô¯$d¬ÌBü÷ˆ}H‹Qc÷þ×ÙõDx Üú€mÀ¶ÏŧtôûÍô \x†Ý ã$€‰Lõ¡,6RÊÓ¬„*@à0“ë„ìl0 ô®@è ûNLŠjë!•Pæ85Ù@-—Ҁɛèö!˜¿s:)X8£Äy‹s:q0¯ º¶øyÈ¥PpÐÕSKRôÅBEXiŽÝ)EˆúQ9¢T€«^!`§vE³Œ¸L&Ð+ …[9‹êü·:îcÇ·Ñ”wàybB’¿~a÷QFÔëM+–Ý ÊªcÕqË­÷ 5e@ò[ÎûHTw¨MŒ>Lëë$„§À¾zÃú5/Ä XŒ”¯ãbªWi/€•y¦þzÏ€íàò<ù€MÃqIþƒáØ5NÀ?YŽÉë°ëZVÁ¾Ÿàê0콎§—a?_ ‰ÏyùðÞ—$eQeŠÿ6iÒšz½–œ¾týèÖ9 5‡~ Ýeܳ]¹·'ΆiNY¾8´#Nßͽ:=o7§€ãKb”` ©¯Ü‘á3®¯ÈŽùúÀï…DÁ—Éš¿0îðÚ—'x×VhÐ'G£ÿ^H$À«ÈQš¿<8 حšX¬?‰žnP£¶žDEBÅQ8¹¿al'00Cÿå81Dš½IÞ€¼ú+U»¢‰>‚¢áÝ;¿`ÜQŒIÃñ›ph qa¿ú•)͸übi.@à °A·¸iÑá"ntç$é%3ÕÁ‹ÐN£Ñð8 W“ F‘[À  ‹Cx´6£õ,2°eèa…}WÀX”Rreðà åñl3ú¯Æ¢žXèWÂÀ¥h]r+A\ªÃO¹ õ×ê=Ð`BBÑÖ '¡”€L¡~ÒUe¨•ÈÕ[§‚ð@.Þ‡Qÿ€ ü‹ U¦E‡©5hZ» 3¼»´nÓR–’Øn¤Íõ5é @WJ¥2*QH*“^)•ÊxDÕÚ,×mÆê¾Î;jÔ•ÅGÈÍ,–níÈpr©TQ@JË¥2’G/ýiPÓu›ºÊH‚ÚG.Ÿ-èÿÖV ÖsŽM˜8ÂɱrúÒÄoÒr×þ¾´ ˆæ­ø2azO[;=cQ®°RïµûúÖá·MÜïéÊÕåeräGße߉ÇVí:y } EjZ ‚8(x0†¼Œ•œ< B  ¼ä4œ/B(PfÇ©ã>ƒP¨2É%Ä:êÙUinutÀN©î"AÀ@N©ž¥àઋ"˜æÐ1ðœz!„ 9ÀÔ£i×äà™zv•‘XÉšõª›7uþ¢DBõZ…à ,Jƒª—ZQA €ãÀój““ -x%8ЪïσY©‘!_EàÀ‘f‚BRa’ç äÁЪgˆ„ù²B¡˜‡¥·ÜD40ÇÒpŒ­UŒrÏq<Æ)9ˆDBF¼‚ãEB¡:†ç”ÅIþíû(îëÉ‘Ó~I稤à,îá¸)ó¿&KY~º2ª.kÿS⥽|埒ý×dB"0yêWWë¡ gc9œ;…Šï¢Â¢N ßóü@×dŒ½]æ=uë]¦¡ôûyM<ÁÃiŽ®~*3¡”µlûþ!†â± …#Àµå¹"¦*UR¬#AKœ10yV/2¼S3•ªï¨khƒ0.@þ)>Û@·0_ço%ŠÁɨŠÓ®mNО|¾Ä\OÚóB•x©è‰ˆ1îê[*ßÝ€°Ñ€ƒ[‹îYAˆÌÛìÙÞså­¨Q÷B•çT8¤b™­þ•º«e­¬ý]»"bPžØ<×ÛÕ¾]{/Ç6V캡,Ì´ñöìäÑÚ»Sçvî­½û츫 Ób’‹†wwjÓ®{·În®­§,ù=ŒA~qË⮺uo×Ú±}¿)~ Š ¿cƒ&þ aÐØAÃ~éÕ¬ó NÅ'`ÊœènŽ –\ILΆ]ÿœÌ@DÄ$¿ÌåÚÆ«gÎÎŽÞóvÝVÕ;zwxyc+ljœ$ôÙ ‹¤†‰ÓúZý,õàlg·éקôörí66]A,=hÙä!.m<{öìêæè>aõ)©ªÄ…&­œ…d2ÆbîìèßÁ½M»N½Û¸wè·çacŒ¥:Û[¬ÿuÿÈac&NÛÎÝuÜ¢C9Œ«¥µ»ZbÝ;²ªs;¯vÞÎ.mf­:–ËØÕy}|SeOO¯:fz¬ßÊ–}”xsmÛvA©2u=Æ6÷lê¾ä¾jتõë$é‘©ýž)qaóì1sW¿ÞÖ¯žû¤ ËëQ侯ŒeŽieÖikh™¬)kÿ™öÝñWÚYu}–ND”û]Û›aéw×Þ©ïÇ’EëÒiþª›__äâÔùk.Ñý™í]ÆoV’اk§3/$ÑþÞŽV§ƒÕ—ïnÞnÂ"J|±ÚÆv|åt´°Ø­ÉŸ“°ÉÆvTQšïxk‹Vã÷Q]°¤C³N«US.Ô¶ûø4UÞ‘Œ=ì›,º‘BDé‘Ÿ®Þ¸›!剈"÷Z·èEDD‡WtqmÝù^¸:ÓÎÙ½={LQ׈”îïÖlüž/<E\¶vôô Í$iø@ŸŽKN¼PÝòxß×Ö=#¥DY_¼Úº¹ Z¡žùígW—;A9E1˜[Bw"yÐ.ûf£ˆˆøØ'î.λn¥êÐfùÁ§D¤ô_ÓØyH‚‚'ú6ÂÆfñ½oš§rÑ¡¥ç½D)…ž¶plM|DOg—½÷Cˆˆøྖ-V¨ÊÈÃöÙ´êû…ˆHþÊ÷ғЬ²Ä+eí?Ò¾k»Q^Ùz±òЙŽ¦‘^«þWϲ77Ìÿ]Ç|÷™ó«‡·"733«²yf$§päD‡çLš;s¡§]eb€Pô·Ç¤}׶v Pð`¼ } {ó;ªNOÝÞzªñØÑ50ä²f3F6R[ÇM¨~ýA:€„Güfn-§za›ØwlmûéìAÁ´V³N^½oŸF‘Žm»®ÎõŒÊ¢ÊÚ?Óv“ñ6ŠÕ©UêÜÖÂ*5k²¯2å‹Ó›Wk^«¼˜—dSå#j½f÷À™‹‡¹45ªgïééÕÖ»£C£ŠÕ,æè±}÷ÈæLÛzxxyxvò²+¬y†z;ôÜ=U: RzË—6SÛDËÕ©¦±¹ôÍÅißÒÃØ$™aø/}zlT™¯¬b¤àòrÛÑñ¬J3=Õ@ŠØØ4=»F¦j£Q­ò¦YÑñ\AqÃOŽoXµïºaµZå Ä|Nº!ÏÕed`ª¶â¨õÉÒ#<ä `‚æ­k•”Ð]úög[fV½&(³´BݸÃ$“ý‹î'Œó4“Ÿý©•ý=a iÉN>;œ IšÐÜ bg€tÀ—üää(«†YÖþ¡âF¨¯Ci šB j©Æô“xoÉî ù4Ü¥ €´Wç:ÏÐØ6…µgÿzx6ø §×÷îÝ;óØŽY;¯w·(ßvÔü¶£æç&=´{㉿Ý[}{µWAæ®ÓgHÓÕχfy}yÄWlÞ¢¶‰Æ“wøšÉ9èdŠž[.LªWœéJÌÃXÞqD§9cLJ^ (¸écɯ¯-Ý}ò–K}mÍ$?:Üeñ¡R0–ñdýÚíJ0‚Δ-FáOKè.ÐC®TÆm‰¥$L«·¬YUèwó{WEàgnÚç’ËVPå6mä{¯¼¬bìŸÆê¸Ú›—¥e)kÿtS1Pν¥èÝý/n”š3eg@‚:Y#¦¤Æ(¦66UT¬ò)ðÓbþä“ÊMœ;oòkhŽRzxñœq 7‡GDGG¿¼÷&‡kV·^bÈ }ûœ|þå[TtÔ·ð{·ïê5r7gé•ɾ|‰ŠJ•há3Y÷íʃO«ÌP3]Ùî™Û‚#cc#߯šs¸œÏ0k½ÎÝ»}9:þfÀ—Øؘà7·Göë¸ðÀ'‹ ð]ù˯ñÙ<¡Ay]Eü‹Q‘)+X9 »u 91íᇰ¸¸Ø÷÷öÜ~•Ò~üO:ùÜÎU­R |ŠßãÀø¸˜××6^xœ¨”+#BÂ$ŠÚ.˜WÖÞ=KûYsë„žœ´ïQXä·××÷­¾á߸Z5@hÀØ·Èào‘‘²Â^@»‰C¹W÷62ÀE"†DºúÄGGŨ QÖò™[#|Ûšó´pHcµŤ§Ö/Þ÷$¹L™*kÿDÏÏŸôáÚ¨nmííí½ûNzžÅQÌ­–V×ߧqέñt±sri;ï}Ž²Û®Es—£ßˆ™§6Îðr±w°·sï2äè“Žˆˆ |lx7{{)k¤J•D¤”$ÎêÓº•¥ý´sÑDD\ÚtÏ^Köå‘vk|cïeQ¡¾C;µ¶±±ï7}K¼„Ó¤Ñç¿ÜÝ×ÛÛÙÎÞ¾M§A§ž†ª€|•…“û§D…*áÿ¯;[ZÛÛ÷ùøÏž.CN*óÈ}º±£§—«½cÇSý¾&«Ÿç™"åÛ“+Ú:Û;»z.:ð˜§Ì-#=[¶p;âæh½íŠ¦AÊskkÛc~QŪhï~&šˆ(3üÙ´ìlÛtzùC’ªSƒ_ÛØ´röê|{Ymë¾ñr>/ãÿúáövŽnRxõ…¯Ç[´y•MDáW–;ÛX¶é1)MÆOÄI× ëá3v©’ç5UN2&;׸7¼ÌERÖþ¡…_ŠWÒà \*òkoZ*pð<¯­.GÁb+š‚+Yá½Ümö>ŒÏ««‘vk|#E2Ò2›V ¢½_ò‰ˆ(òŠµ£§_HQIk,t…/á†RQÄÿ(Šøbˆ/<˜–Y¸Ìqì–œ /¸Îg×O»—YF÷eíZø¥øÆ»à•"¿–üKi‘‚†â¤™üʺiq¦ý´®BE @Ël¥C¨Ÿi·s”ÐœL+ tu@…ºk[ [ŠVyøKPÄŠ!¾ð`…:r2‰TþlÏO¯äÞ·{×Qg3Æ€[O"fl4.Ëç]Öþ¡¶›sËý¼½­Ãá›G¦à RH22sÿm`„ìî5ñ·FîÛTÓÿïcÌè#¶+ŸU;|lqy ÀñTš¾i{MFDe²¦¬ýÚ?+ßM‘³L1iY»À?¸|èm²y“ZFˆWø^8*©Ù šÁӇߤWW†Ý½àfѲþÝ‹sÍ:ts«Î ›ŽeI!W¯\}òâ]®Q­Êi¾_Vš0Ø…ŸõôλŸ¼û"Ó­TÃÌP• `ʤ «Woøù¿OÌÖ­U™2âÀ »wýú=¿—_"*T¯k¢Ëˆ“§:uŠ™5Lô¿våî“/1Y ס¤¯çÏ]xþ:媙—×WT¬;À¢^¾ôÙÄœûxòÊCózÍŒu…IO.ݸð!¼|ƒ¦Iço¾c-™E¿½v÷‹ec3RJ.9–i؈ {páƽ·áâj*T"èÉõkwFfÔnTóÖ™c)ÂʗǶ]~•’+“¤ÅV±°â‚/ž|m>z`“›§Oû½zŸ+nX³Ò’êÁɃ}oøú=­_©NEC€«»·]y&“g§Æš·´ÔÏ »qõúãg¯u#Ð IDAT>…DëU®mf(*âUÈùzíÐ#‰M#ÑÕÓ§<{›Iõë˜3õɘœW÷nÞ~ðäýçpV®VS1€¸»G·]|Ÿ–#ÏŠ7jbSQÌسÞÐgYÇæF÷Ïý.v];±S±X\¡®Sô›oƒ+ôñiv|ý並k–¶‹Åê»I‚ŽŸ½§×·SsEèý©î-ýe‹u c±ØÀÁ²òÞ½§êºu5‹{¶åâÃ…ëwµªª/Ö5riYe÷‘ÃMÜzÖ«¨÷îÀïu¦ìœåŽ#GŸµ=´†0POOOOOOWWO__ïáÞ¹Ot®ç"BnßIlè³fD[=±Xߤj»¯×Š0º““ß?¶ï¢^Ójúÿ#ÊTÖ׋;_^1qÖÛÀÏÙRžËŠСçòý—Ó²2ýÎìîß«Ïû4…H(äyžH¡àHGGàöÆ!#g­ðLOñ[2ÂgƾWD`Y·ïúý×Q#øúK’¸²zÐè¹kÞFeÄ=\8¬ý‚£oU$ûþôŽ#¦O^šmTU/ãõüQC~û(aŒ)Òƒ»wî¿áèÕð° C›fö´LÂcìåî1ƒ&-òûššùråO]Gn|È1p/Oï?ú(LÅÞ·Ïî>ý0^½*^qùøΫ/’<¹ypǾ“óןüú-V»ƒ˜1¦øöÓÀþ»NÞÏÈNÚ={øÖ2U LÆ$ ‡w[°é÷¨´œ0ÿ›³GtÝ|3ˆ1°¬Oç]ÚßãEDà‹ ÇŽ]…©óªe"ùSžkŽÞÉÌI¿{xk÷žÃBrÁ Ì<|pï¦ùó~¹Ÿ\ÅT~fõôîK.MŸ½ZbR5ûý™aƒ¦„ñŒ1íÝľ;½óÄÕ¥³W~ ‘*q¯Nv5çò“ÏIφ¶±çÂÁ×ÂâwhçÙO'=}|߶•+Çï|^®jը燇zöx—Æø‡ë‡÷Ÿ±þyH—»»öœ´sÿ®ÇŸ2BQºR ¥’ £:‘®c [1¬ßw‘O®­˜6æ—g‰?H6Œ1iһî>û !9éáÙ=Cúõû’! Ó•r(•€ŽNÂÃŽn}v^}•–‘pu÷À¶>—¢‹f#”G]Û~øìòÃB¦³~ÁÄ¥—?1Ƥˆõœ¹~tZÖ§‡g'ôó¾ð.€@Gœ-ËfJ…j¤ˆú,ìÑ¥*€Q«oלԇìx™R)®P™!æÍël‡.jÍ hÞÈ&'Ú7S‰ˆP‘аNmSõˤª¥ƒ8÷nH‚4'ƒ‘žY%11F¢Új*¹ßb8.ÞÞß¾J®Œ+A×¢O/9‘óÛæÁbô™¹nJRÿF_Þ%Öª]÷Žì<÷:íG™Š¾6ʺ•Ë™Pµêà·¾»uuéš_O-îà:ü¨’('摇•Óít""É‹VöËVÝ“xgEK—þßdJ¢éûøúùG“Š< Œ“,š¹œ W-”^ÿÚ¥E¯]Du|t‹¶S¢4(`÷ ‹Î«Tôs`Ù€Nƒ¶¨àË~½Òºç¦BÚ'ÏQòíŸ-­»?Ï$R¾ònäx:>ÆGW8uè#¡g§Wº¶“¯Z+v÷°é±ë¹ìóuç럳ÕÑàÉÏ\œgœ~•w_Zèe×V^ÏrŠ8ÙêQ†/»Ì¶7äÆÞ_<{Ú¨¡{^¥ÂŸ™šœ.QüϤ×ä†^õ„W/‡Ö÷²Î +߬5ÿñ\¸Çç¢Gw>T+o”£º)·¶CÍÔ°»±rÀ Œz:×àïÝühT»’az¤ê6Y}—êI_îŪ’LðJóö–åÕvûò5ËSZ< ¹~=²e¿öz*)iäpå•ß ú†Ïü>Š*–S¦¨ÆɬҲNVÂý耔«XÞH÷;+äFæî•J»Kzûar}S58w¯Æq$]ºVÇñ–Hí^¨ßiH¥ ÿñ¾¼I²Ð^e×éýèÕµÖÆ×rË7²a;›$5&Ã+7t~8§NÚÅ5iÜJe Ô7­AÝF5ÅD*T1âÒ’$%uRš¶±­¢‚<áåÛl»Áítjtñ±kñ¤ðŠM]ˆéê D"iNŽ<',9™³ißRåi`ß«œ¡@O„ü”í$¯àÕ¡¾®jØM+Qz‚â‡É¦|£ŽÃ{µx}ëƙӧNŸ¿–¡#JÍVÍB"žõZ6¢èÀ_ö^|ó)8%KîêÓí¹+f'••·o_G £rÃJ”‘¤;TÍ¡ ¯&±P]‹vF¡w^I€ç"¾î»m×Å€* ·jñåΞvsLÚ´ÑÁPÈ”êÂ× UÇ€8¥šžJcÐÕ!¥\!nâèQ]ï—U+ž¾ûôñí³åË·›ê2î»æ]ÆrSî¿Ë8© +¡N¼\Á ôÅʬ¤oq©ªçb\¾¢©¾è¿esóC€’±™¾šKrâ%:1Ç–ô?šŸd›ƒ(5U ÜŸœ£P&EL3"o¥>œ @-¡ÈH(ˆOÌæ±!cGåߦÐç‚•¨!±¡PÚš¿9qÙ:ULtP8f?=GÆg§Î7Þ°o¹#›¨:ctkݘ¹—Wœ»Ü¹®!L¯¼‘P–’M¨¨ž8K" Å"!ôõŒAÙ2% Î­(OÎf&åõòË]:¸rúìŸÆÔl¹líÒ„!ÃÌM ¾ËnAGVe9Nñ®ˆ‚AšD¤_½Ýší¤=ZÖvôŒú¯Ïµþ—yFÿ¨\427PèÌ»²§cµ¢&žÌüÏ•ttk´ºrGQŽ¦„U5é×w¼hÃÏ^ÝX•*ÕD#¨¹·‚‘ž¨\kWOšÓ ²zjVˆçxác©¢!¾æÊò,¼)` Щn‚7Ù¹ªëŒ”i¹~%c@P¡¢¾4.Uú:…c¢ó 2©¬+«´öñ7âì+ùJêÿBßôMt)Uƒ$1â³ê ÄÂœL5²ÁËœ’û³dVÙd-ž·¿Â€Ç¦¸¨¾Ú ÔúJ0­í´ùø-N’øÞýÏK',7Ý¿¤«à{¼F×4%óÎ ÎOïT,À*¿sæç1̨Y£J*Â` ¾ëÆ,zøí}u@UËöÿšÓ‡–RBBEº»% »ëÚÝݨحؠ¢¨„ˆ(Hw×é³ç÷Ç> ©Ü÷Þ÷½ß½÷¬¿ÎÙ{öÄš™5kÖ¬ù,ú¡óçteúL¿·fÝ»äêqºJ$+¿ç˲ å ÕY“À%¥UXGcyoKîzÑäƯ>6ž<Œ){½èý5Õ üPtäjé  c DŸžÜ/dëû;™#¸“ÛH}<ðq:˜öü›ûÝ(øùw?v©®ávBôã„¢#ÄÙ½guVîû‚z «S/^y*h/‰âîmXž–ñ©Œ'Ñè«>_ºþBˆ1zØ}úh%EFÕ‘Š‚8mˆ‘áêwU=yeåqß*VôŒ îsDBÀ¯¯­“@õQl¶¨*D®V§–”üæ–ˆÏ)¯¨€ím#Ÿþ*¹^¢#”ž¾SJ£( ¿^Ö³wE ã"ãîÙe§¾ÐÕÌ\9>⦗>séf|&!DÔT”×ðÄÊÞÞšoF6VâëÛûÏRÊ;|å S;Ÿ· MË”ø›ñ¤†‚ËŸ>úб{g˜ Ëê)+‰“b²Éos’ïÕÔM” ú÷‡°Z@×$žµ §.± ÑdÁ#‰Îž¸•TeSÏ^Õ…i€W_^Y%n?— (Ø íö“¢†$u¹on½ø*a2ŒÅàsr]{ ¼d‚¿³}Ùýê3ç:èÊ7ÑHÙö~6)G÷T‘‡]‚â˜ï»N’EÐÙÜR øOc ”óè~»“Gm¨Í\8qÄõwÅdÑÏ®ß&仚÷PkÔß(T P¨M dÅ¿ÃrvÚj 3 ü»'–m?U!À”¿½‘MhZiæÖÕÔóÅqó§w}SwéÝ;hXŠ¯«euZÜ“÷Y#÷^íÛ\ÞÈ8ÍZãÿbÞ¨!Žž>:ŒÊçщžãñl¹ä¹/\ÖgPXè`Ͼ”²çOÓ-¦äþ‹Ñã8c»fðÄ!þ¸˜j§Ä=«4¸ÀJÑFnzé¤aw<}»Ë׿Š¾_©â <5)ðÙò›K¼ÀËÔôÖÅ{ω ¨9'O¿…ÎJ˜øU?e?:9ñà“Cg/©Ò­líé3jØ°WƒÏ/ßô†ÇÐuìž‚F1 ŸG}Ƈǯö\V€‰³g_·-dâkk-jÜë7:cWÑ€ÊUCûr&Þ>2\«oØæýAÓLìçd\šý¡hÆ©[ïˆßŽô›4éÌòS…~]ø×î[yuýØ!ƒ©²ƒlô·îš.Ê Tö>&Cž%Ï l5Ùò÷¯­\ù5`ú•kØ(Ù=lûœµ¹CÙ…qÏêl—ÒXwsçIóù<µ˜2Ïâ.­^ýÙ^_v×î ÏŸxØv©Èˆð4uÄÁ}TÉ×ö;øétäy]ŶõT@gÔ¾wC‡ùx¹RJ¿>‰·™¾?H¢ƒ«—<^µº"åÉcÓåé’ gýñ£—äFG×.hp£#d»X-_86xÒâë—G…¥[ôTNOIä茊« ÛëèŽQCfÍüpÓR‹Uþþãw·…ç;3t|»Öý1oä#GJ~êûôê…çni³D•»VnÈæ"N–áî_0_…FN™äiÊ2‹i º²» uÀæ=wdÔ³;Ôä|MÍ°¿ÆC¸[GôÉ ¾1¡Û_BÜüÞï†rì.¶Ý(ä(d«á߉à”UÕËjOZ°"ØL `BÄÒ-Tcèå1ÌZG®¦¢\@‘s¶2,€Ž‚¡œƒƒµ"“JJsïašìêÊrMÁsèìeS})#„Ä‚z¤ØËÑJ‡Ô¾„üz¦ª±ƒ…6]F}dˆ7[Èáˆh&nCW­™ª@Ac}§ÁN=”ë*ËøÀr˜ºnÑ06 ¾²RÞÐÊ®‡`¬kßÇB egeUá›ViQ8ZÝ-zë)ð¹uêºVFjä~‡Ë©ïjhcÚM‹9‰OŸÙTc#`¨ûöq‡'bö¼h¼•rh8Úv§`¦÷Àà®,¢¸´‚ÕÙpÜÂÍÁV¤ß »‹É¸ [qM Ÿ®è4ié$„!¢¶²VÛÜÙL‹E“Ó=ÒGNP[VÍUÔµ[¶Ê·‡"Æ®ã M,ìô:Ë€XȦšƒ ðêj4-\Õèm~?Y‡0Æ b`ßÇX¥ªªR(£·dÇN̉¡×X?}¿Ž¡næhÖ0®çð Ml »*zMWdbn«¯¡`â3Ì\M\QQ#oØwõòáw.žÓ¶êb¬lådBåñ0SÍÊÞF‘R/’5t¶Ñ'{J,¨§(ör´Ò…Ž Œµí‚ Ä¥¥ nkç‡vïeâš‚–e®vn¦ˆË–š×Ø9ÓýŒ…µU5¬–é´[š*€ˆW/–Uµµ±’¡#,ârú®v†ÔŸƒ¶»‹­˜}‡ ÒeãòÊjš¢ö É‹'ûô&oÄZš°h %ÌPämû„®Y0‚%ÙBc9m»þn½E|CµÇð9«¦zéÆ”nžÃm´Y®PÍÐzîŠÕ^zrc‚o_3™ò *jÚÆf&ä•4º÷6ÒRNHFÅÁÞVŽñÓ¶ˆ©J† Õ` šªV¯À±óÇ9b á¢Ä˜äNÞ!VJ3¯â‰2Æy‡äóþr®›Í¨ðËóÈI↓æåþ½ÇžÉéß­XðñéõGoóÈ¿õù|­">p¤ãâÿ+z~bùæ$Þß^ëK¢ZÆŒÝ{4˜] €ß·®>ñæÓ`{¥„WwŸ ìo5þÅ·QŠß^[udð°!ÝdkŸÜ»U×{êP+¶Ñâÿ+Òµ±ëÍü«H(þÖ„1 Tžxÿà…èâ:¡ªžù¸Éô #˜AäIVòƒˆÈûêÄ´î6}gó§ýÕФ$7Rú/ œßgÕ›^ÌÖ_5¬­òj++hýœtÅo«>ÐÒ,1é»ùOšÞ#€¦WQZ”E¡Ò¨Mfš+¯ …®™Íµi) ï›_±kY4 hšy‹-Ú‚[ó¤yRÜpQã_â<9ÛÌæä§Îi?D»hãDdø˜×ào‡h4j‹ZvÆ jÂhÁ\Š83!1ŸÖ§Zð»-CÙ mÕ…|R“@ö0TõêS¥ÍrJëÒôŸ¶¢÷0”®D§¶_©vÓ®Ö‚Òχš¿ü5z»³“ãíÄ:„PýóG:99{Œ¹ü&‡TµÃ~Àž,s…‡­ëôÇ!‚[~jm˜·«£‹kßÅðB¡´Ó&NAi†{ZlüŒsJŽ­œîåêèâê³üh´!Ú2vÿ»°èÜø‹!ý\í]glLEœ©ƒlfìÿŠÚ8Õ1tëÇ£„ZöŸÃo ¡ôçÇ‚¾ó%uÛjé>`=‘‘› Æ»Z:98­ŠÎ@!„‹n¬6¶ê]P D<^>ÒoÆ’-œ§yD]ÉÆÞåTì²­ §W;û.  Õ&ë!ôñX°õÔ{™o"<œì\|¶]ýÂâm³Bœƒ&mÈæKdM9_ù#vb§½ëôçyßÛ /#H9ÔË.(£Z€úqq¸Ù˜ Gðp°wûÇj&¾Ü?àéèèì³û^jÎÃÙ¦¾;ʾÜut™PÇÎ ¶w˜]H†§¡šÓËÆ8;;yôwÿ!„ò£mÜ^x9Ù×ÞýX„Úî8@HX›»-|´›££““gئ‹u!„*b#í=¦ñXìì翬@µé[ÃG»¹8;¹zN[y¸ˆÓx›»¡çÊ?¸89Üþ±b‚›«³G¿ÐK U’ñüÌÆ/gG×ñK– !ÄÍýàã6¸€]5ÊÉiÂ… 'ê$ÝÛC ÊR×Íæêdï4ñ^ZÉW„Ë-éèäì?rQraÞ`oÇí×Ò@P=6Èvþá/X*kþìfŠ¥ Ã̽qì™Ì#G]zÈW~¿8$\5`Ñ鳧w-ô=6pË«².>“OïžËàŠg¾u~3@Áâ!Q|«='"OÚˆžl ßK` 2Lº¨ú¥&nØ>¦@î‚A‘Ó¾‘'®ãÝYºø(Y(S^Ž–vðd{GÄÕë—wŠlœ~>ʾ\ ¹ÉtÜšãÇŒí™?2xLG Pº640²PoDZ³Çv¨$ž´–+ÂT#o¿¾æZ’¦Rh”&j •B%µ†œBQÌ1‘í”Èá Ü ƒ~OS½ô[z=€ þ]±"³.&·€H¿ö‰âµvœæ£;äjã²U»Ê]z[ æßÏ(êi2zt÷¸WÕ:ñóg]ÍG3É¿qiI*=‡)3Õ†vXÀ”—¥§ºªuäÒ“áŽçw„±Þ!l×ÍË' Êž.ß €:Êùª£‡Î’ï¿øÜùS£Í¹“ÖÜbÉË2(ˆB£RÉ9”—aåœÛp±tÍ‘‹·®îüé蔣 Pûù褅§û,:p&b¯FÒñ°“i4¹N½ýNoðçÕjì¸vk…“ˆaÁÎykYýæ8~t¤‰xmØ”bL: áÍ뮯=vh†)@YÛ'ø>¡_ÿd5Ÿ#§OÛ)Ÿ1|ÚnE›Á'×øðê»î¾µÔ½rÜðOjƒˆˆ8¶ÇItÇoün¢™ê…F§Ñèû6îÕY~åêµ!=vÎþ¹T À9<=dõýòå{OFž=êÆü<ñG05ÌNmåW+­;uó€Þõg.fûÙ›ðÆŒ-³œpøD剶«G 8›âú5GÜÌÓ:püÔ®?ü#çŒ+`ƒ €¨T…"/mÇ~Iùw'™›úÅ7 ø\šbí²0ºñí‡ Óm¼VÖ`\“óÌËÊña9Ƙȹ´Ì¬ÏˆòWV\|ÙÚÔ/¾VŒó.™Y8ïO$ƒp™gÂMû¯k̫ଥé€D. ¯jk?.¯^(j“¯ÃÈ‹ãK“¬=–¿hA*Ý1oþlNÙ£]î~4‚WU>p0÷~^Xß¹}x­ù¾ýÍ«#0A´ ¯E`\9ßÛeËõãšGóÿØ°¢óä2ŒñûÕ|—Ÿ«K¿ìh3!c‚à‡ tß|ûšÃГbŒ…u¹ƒ],Ï|ǸꙻiðŒ1Æûgz­yåé·Ž1ÆÜpÓõïÑÛgÆŸ/Ž²²™\ i{r@o³¹O$œŒ[3ÜeòJŒq9ÿyÿL«“ëÅdhcñ…Ù!¦ž“ÊŒS; ̨æ“ýnfòµqêãñAfA‡1Æ7'Ú;Í»ÖÀÖš•}¬Í&0æ¤î³2‘-)÷‘µ­ó¶—™’T©¦öþ Å\öÒÞÞy݃2Ó¢ítœ :õsrcB,‰3"WÙù -®cŒ«“vZYŒÉÃã±ö&^W6|Ì+)­·»ÕIî®.뮼“@&<±st¿—T^ŸþÂÍÙþzRƒ‡4ÿ›¿“ó‘'ß0Æ8ïŒqà2£Òî.ÎÑé|ŒqòöPóå ­æŸ_·äàƒOÂò/ÎfûbêÈìK¿Üòt²Ý•‰ùÕã:,8’BH½žÿ¼W1«Úö¤‘zjéóDBÖòéŽmñ"PMQ÷>“úM•w)å²”êƒ[¶Ð)4J­"µâYÏZaš¬µ‹DrŠMª’C{6o!Q;¨¨Z‘Rú,K`Ö‹]ìÔˆ.äˆ8U/’ÄæCt¶Îªóvl€Ç·ŠÙ^ľ-2¤O­W Ö¿Èªsï"Ó Uÿº}B¦†3 ‘X'm™%@i¼¯ò¼Äo‹šß¾úÅØqý åבiÙýM¨çbj¼¦™°Õ”:Ëlz‘¡Zée½»˜>ÞzNw½N4À…AA$¼–PL0²êjj [õ±s »)5è ’OÓÎñĈM“Ø€EƒˆS©luuu6ER܈ÙÓ´ºüǨ H9b°=Œ†«Ï]í/³Êw¶Uꀷ»¾€3‰'ôµ2¦Èñ{ª«¤Ä¤Ö]âÛ{h)©é³+>}R^_è0[€ilÚ+úf Vüò£«iw&Û°+=úy¥)ïvrÓm2,Ûe¤Î$ïH¶ føOpž'Ó(tôs¿Ìjû`¹.s…ˆAû¹O`)²Úc¡6ÍÊt_­ÝŽ“å}¹Ùoä&iËæöµP`Ó‹ïî›v-£µZ>hÙ K¿ç1ñŸâïî³_±,pѶÍã]ZÛtQËj ‹3Ô:wVc'Ühà”)LuZÓÅß–í÷‡:æ‰1¹;ÂMq“°€À U2šÚÊ8n¬´èB,!®X+*å±é?ûÖПm½ª©¦èUWÏÑãÌ%g„˜ •µMõÐ~æ=N‰N¨B!A§Ó ¯iGPzjÊðsñˆqãe(É$Èê튙†øÉ×2ðÖÁ€"Êòò°Š–žº’ˆB ×U–Ì …bí§Ã=¹ä!@ˆÉ¿ \!»é!Æ/=(ZþfÄþ¨”¼âZ]'c`rú)^›®ÀÇ6ÖúTöp[õ i/ââŸyz(1‘Ix\p«hغîd}-.^z™cd @ég¦³ëŵky?¼ý'4Ñí²®cÔ1Î#M%fmq%1ª =.‹Jï Ö[O…ˆ)«odë·×9­Öëö¢½µ$]µ¶:ŽN{~쥳îÌñé!”VÏoŽ­Cþ!x|BßÊCßÊcô”p^â—aë?Œ~`MkræØvwŠ ]plýGùtE$|P ¢ÑéÍKàÆÜÎ=nJJHs-úâ R·5Åõ %¦2‹^Y\  €1BÜêr±hQØÀ•Ç®”j7ÿ¢ß ÝoJÿ¼S+Þ”9ol3xñ]Ü|5±æËüöeÏ“lre)~º·ÿˆùÅ-³ãèþôÏv?+$“<Øæ?òr¢}—@ý&úG®~[@ð9Ò×ÔûJ¡‘¿§|~Áþ{ŸÉ|*ãN ›žY'DˆHû$&µ! ((©rÄ’ QMüáoE¿ñݪÊøxæüÕr.0(õ¶T;ì,Ï|h7*SCG«ð襛ŠAãUùpßâ„'I„MîÈ}¨uüóȧ\y= Œ0èõq! “Ž¾*1²t@6¾V¹©7oåóÌ­¬pæ«Û‘·_e]» [Ç>§¸z”}ýþ²B Ì[wÿ;›Ö¡I Š€Î÷s糡ڄóÛ>Š%*…Šµ¼vÊÛ”â½Ûì¸Z‘Š K(âòÅ€‚âg‘Ñï)bLcP!*Ôð æqHß115?U1UF–œçO>ùVßþ´&” Í´ýüùä*$Ê=<4ôQJ¢"!·TÜ} 0Ð%¡)}§ ¿¾ð#næØaƒößJ”U2PP‘½ñ˜¬ÿý#ëë…­wâ­4-©vó "Ä|®0Æ=ý–‹ÿcé@g% íú‚l†¾ë†þc‚ÇáŠ1`Œ‘j߈ƒé‹7ðØÛY•Á)åÉ™²¬3q¹<ScŒ:÷?¾'sùÖÁ^»4”)u¥"Åá3—«P0"D¼ÆB@,äqù" ÐkÀÊáï.`/ßI©¢÷Ÿ¶ÈOƒÈ1òÄôykf¸WÖÕÑüG/Ò—§ð¯.šrÕnWüö@ 0rpHìúC'¦u•VPMõõe¸<>¸<ÜèÿŠ|.O(€¢ø‡Û<±ê¤Â¦`w“^'öÞ°{: ÝNSmÓíÔewzIvB]ƒ,k׿âë÷è¦,Û¡´I!µÚþ:jtrý7ÙÙçr§:iùêäìJfZ[÷fˆ.Ú×=4À•Òë1ó“'Ë5(e„Çå :Ây×+|“—yX27¢ `öLש‹0B—G:7íw {„0·/èí¤+—F:BÓ ó{Ͼ€€ÙµYד!vž–÷D Å\.÷'ÎY:Àb.—'7`È*µÙq4ls7vh@@Ouv9Vß»cÍœñ‹F ³.âŒn#³ƒìÂßyÿ#eJÓ¯ÛH؆ßW^`í'hö¦c`Ðè€Å·¦÷UÇRmæ_ÛLIÜ™Z?ùIMþ*MËDí%kUh[y4KÒN>¿©SƒOY[™¾Ý>Sn§Ý‰‚›¿j•°EöÐvS•ý¢íð¤Ývþ–ó!(2ñnA>9u!Y¯§¶L«d ¿šQ“txø°y_Ed¾œ#óŒ[”ÛÞhøÓ y5ɵә͙Ñ^5ÚH­ž·;ìDuçOYuð!ù  ñau­·Eghãk)uL»ùÇú#5µ3ÿýZv{Ó˜7?wênŽÊ¿U#•Y;.1ÛRŒˆšÓÇ>ÿ\Ò­g÷Üô ¥n–‡îé"ƒþ™Þú¶Û|“¯ «Ë¬ø’/t›¹çH#éì‘Š)5ÝÔ!q}M _(DeÉÊ˲:†œ…1 Dˆøµµõ"1¨t9yòϼD¶šÏ©­ç  t&[A^IïIIÅ”¤$¥ÿßm7?…Qs„‘öž·Î ¹"þ?YÊqË:ÿÛy¶hT3n´µÿø7Ðò£fÿÛÊñ¥`É-ö6Ò¢?Ṳ̂  þôGûuÅÐ;qÛÙ´‘_ýÞ^µÿíAÞÑ”®ì¿×n ž­ýã¾Ñé­!-$SÉóuáw{Dn ýâ(æn[9WmÀ¶±Ž ÿ+3æÜ‚ÈìÀÃKÝþc2LÌß¹f6˜.šb iTΕq{ ŽmŸCoº:mæ’ݧoècªü¯ÆÉœ³`‹“™ñÔ¢ ×hÈS›BXTÇ_ ?ùzáÚªyÏV»¶vŸ±*ïà‚e‰õ< $.LˆB×5q?}h `„Åg¶­øN1]=x“ ¯øÙúéW•ëKn²ÞÜ<ûEfi=…&chå1fr°ZÝĨ••#­ËöÇ| DA¨!n8îá1*ÌS¼pÅåç¡[Y»ßÐq~–Ú¾nä‘×˧î¿üTÉÉ(wõ 6ÀÁ ©½L”{5lÕC`Ð!}æÞ½æ² Aä®ð×9Ì•ë6v‘¥4°„spÁ²wõí—¨6q/~¶aüsÛUk|ôÚãñ«MSŽóýN¯ØÂ)ùë‰yk>Þ5™ñï ^éÒeË{÷_1ÊK[ªÝü†øeß>¥¶ñ%CVQŽõ[5@È)xý­›™Âÿp;[™÷%é{ùVLËÈ)Èþ¼ ƒãÎÞ¬¡0èmžÓ"ª¼‚|SÇÿ?¥G•}KþTæ:Ì)?&:"¡¸Yhs·îÞÎ)äkvbñªK““?× 0‘•š’YC÷622222ꥯ!Ÿúè` Çˆôj! €ó2R¿fä·¨jÙ÷ää¬2Rv\Y3"hþñ2z[{{}Ť»{ú{ŒùQ#l8ˆ&»×ÍN[³K7=====}º )9™­®«§§§§§§ÙYEÄ+OúÄÔ5!+ѳ‡>‹›½a\ÿy €©.Ôe¿žÒÏjÙ±‡<¦’ŽŽ&ƒ“»wÞ€Ù» ¸MŽ—Y º©+ “’k½£7þÚµ„¤׷R‹šÈ"+5%5þÒ´uO @+iÙ÷„´Ò_Eó³h‘vi×Ý2hÊ^残xßÉHŸño*&„àkJR^þñÔQïxÔJÿTušwЩ¨TSE”<7M»ž¯â& mAóÐÙM°·‹œÔÚû¤ŒV+H§¶Ívm¢„u? ¨Œé‹¶5 ®¿ô±Ðd°O›Œ…î›7omÜxµ‘][<$Q  ´äÇ`2A³“õÂÙEÛ®ÎwC®´!%1OÞLy¤Dƒšæ9ª›¸Íž3²ÉˆOk²*êÛ¹ÑÆ¿ïlî«#¿‡Ý‰›lÐ "qæÛ[þ8Ò@UtT™þ=–¶Q¸©Û=?óâSzèŒ?ìºH>©ÍN ¨ý§Íòéô3ã+–^ø5ø±‘¨_>7[!èö¹UŠtÒKø¥ŸŸ1o‹âÅ5ã ˜ªæºp™kQÊ¥§Ó›Ö1ißÆRëQG,ŒÚóhj並š§“­SìÃM±£l\õå;dþ`Ž³5:uåÀS¿U^”ö%¼ÍÅâÑîÎ ñýi†Ëõ+²¶çDÛã®%*Ûß:®NG–\DeâÈõãûxÚÛxšú²€‹ʹ4T×k F!´~ŠïüÛó§O>g„Ÿƒÿˆå? ߟru"ó¹}d¹¯«m??_'gyëÎòœœbé0åFƒjJß]¶´¶ŠÎ”~¾9.ÀÍÓ7hpŸ“×€-g^ ¢`¨E]_$·ŸÎ´îÑÓçôÅ(aeºùe•ìX4ÕÝÃ;dè`g;é›.?].8Æöàlaî?jqª¡f– €â¯m ò°õîçëâè8yþ¾!„Šb"†úº:û÷÷_²#r€—õê³_˜;1È|ÒöŒ$¨-úVÀwég *âãìÝÈ 7¯ùÎq¡Ò÷¶6V‘/‹„àâ†É΃:-.z¾íÌZ„/uŸAŽýöpqš¾»#òÒχۯ}'»€ÕèJ…‘Q_Å.€Êû›cyv‹Gw n¥»»®¸à[i‡…˜/ÆŸóÓn‘þÉø„Ã!=IÃNÖí‡4u&þÌš uº‰ÅD]ªŸ®{®¾üäj%jŒÙÍR7‰˜oÿùæõ8.jÇKcà欿_àfoÐoŽZê¡›ÙÍ´ÊNC×x±/?Áƒf½ÜþRŠbØÛ|ÿx¡N€cÀ€Þ?8#PvïÉŽÙêm8ø\£Ð5n&£¢B©g<}nÓŒ°9s&…ôuô÷¼€G&*}sf˜¯»[ÿAÃ…mº&È„ bçŽèäå74$ÈÍÑ+lËM!BḭS œ‚J¸â¿÷™V‡4|VVD²öœ»Q·ŸÅ½¦4{ÎYÑX²l‰¥BFQ­þãá)[ìÙµçüýÇZ¥7wÍ 2N¾¦ ´ÐnÒîµûãç]{ÿðþƒØËk>Ü?|ñu¾÷˜´„£‰u@vð»¸{ò]‚] —–.å :þìÁ­k·î¿Ø=8úúµbBÃÒY/þz<Á÷«?dLôEbk²cãØÚ½u]s#sæÁ“+—¯ÅÆåÝ[?í\…ŽR÷iŽÚw7êNlBŒY탰ywhæÙ9çg-¿3ôXÜ“‡bž^(O:àôÖ,ßyŠm95öÁÍ›wïÙU^®äPXL°X2L:…œöUÙOJ¼Uàîâù_{ψ}r÷êõÛ1—×f¼JÊ©D‘‘‘¡Qpc׬¿”»ìqÂíë׮låk%:ÀÛ­k¢ÁäÍó‡×®Ý|þì¥èùí'¹ð^ßÊÐi*ʺvzr/ï܉ËoÍŽý͇ôo3:t‹‰J”Å\OgÚ¸êuhPÈõÔ·óÙ‰ëŽE}Ë.(¯ªm¸@Þ£_‹É04õ§SÐob µé¬&Þ||Oc(««0àíµwts/WyIד•Æjþ“zÁ÷+ï8íJ-„ò’bŠxtO–º¹a7¹èK÷  B€€‡}—Ò-ˆX{ñ[ÇtùŒóÇÙirk!@┳Wsý—MgPlÖO£Á–eÑ€)¯¨˜º»ÌaÍþ={Ž_y͵·£¾|öôéÓ§ÅÚ& ™¯|æ7g2¹u¼ö·ÉËîtÌ4‰Àu ʛ¯+ÄÜþZÙ÷U¤ _K),§)×`:¤PiÄ â×ñå´:SÉ ÓY²4€Bð ªêeõu™õÑ :±JêJa$ý'Ún€ a<0ÀX„1AkkGÝlÐàS|lïCTY&ð„B@ xÀmøBÿô»ÏK.íéê (tuÜrüz⧘…CìÞD3~f™SMú˜×•¥Vó¿|ŠµéN7óQÉË*óÓ>¥»Žö ÑÅ"ï­·¢(úEì»—Qš‰þÕxKPDˆЩ”æ'M $7¯B "DbIm1A@«L‚¤ŸeUL»(°{,Ùù.1ykX`nÜÕ¹ãÇå6ÛЩ &~.¸"Ž a’t™¶áÈË_ϬŸŒ²Ÿ¬˜pìe1Ô¾ÍÎ3÷óþ¬jÍìÏ÷ „ZÃ|¨·’ä‡[± ý{”=M}•Pa9¢èYõ‚¸[ Ðà–UURX#Ak£Bî³Ò†Ã¦Â¢oTJ÷NÍÐþè®&ò¹ß ’êw7þ±"â>KVKQ¦&ý»€lP}å÷úú–(9±/“”;»¨ÉS€à¥'½­¨'0¦šº<yÒDPÿô[.ü\!fšÔüü2 ·% ºyíF€¼¯ïÒ …€AÏÒ{ͳ}4”?¼-¬JÌ)ï=ÀªAŸBøxâÝúôàøc0^ä©þ;a@~[NYó¢f­»OHÎL¨}MÔ³¾§äˆn~#$Ê{UŠ|¬  ~ç4ÿI[„ 1´’ðkøB¦xg/äv7쀴iZ ,£a¹, ×¹=³ĆꀕNª_VÎ;I@l+B@TÎ_~«KŸ ¹Ú¹—ˆ! áæ‹Õ4‹y—Þ%›÷_ý¤‘¢ÏoœF\ü˜+h¦a¬dÔoµoçÍëjò©%Èt]äªö î}þÃÝ%†SGH¤ IA}£hÉN*ùÍ|‘ÑQ’å~ÿRKr‰W[À㈪¬AgUñçØ|‰„ >UVé©ô€_K¯”¸Á€™Šü£«N¤ýÈÎþöfÛÚ:ÃguûmßQ(u/"òz¹Y1$,t\´Lç{ÄìcOÓÒÓ__ݳýyš­¾&uñ²y´k{Vù>jPѶ©ÂÞùžþ#óGúÛ+²tìÔé`0(ùÈî4-«Þ43_³‹»2ÜÕÀoüäÊ›3OGÌÊÎNKx63ÔwÖ¾xÉi5«âı;Y9¹éI"Ͻí=vN'€ÊôØYÓg¼Í@¯éáU¯&l»õ5=ãã“ ›¢bt´zRduzõèòøІԌ¬ìoq;—måS©-TßwÉoõúdª;¶hîŒ G¿~ÏÈÌÌHx|3Y̲ÒVm¢÷!É(þÎÎ 9¹91׎ŠÞ<°m»ëþ3j?B(N ô“M˜<ç²ÆS4–.™Sÿépð´µbã“âžÞ˜>È?Y¤µfIPe¼»u}xuëõ—ñIïn/[¥?j®'ózâwjà$÷¦zLg-$¸ýúSËB1òX~²âúŽ×‚¬«æÍ‘{eéÉì±3|Qƒ»³¹;+ýòƒ´â²²Â¸‹ëoT)üZ,0ä´ÌŒºF^ú=ãÛ§Ãk×rSjî1‹Þ¤¤çæd?¿²'©:`ä À8ûÉ…•ÛŽÔ ‰¿ùm«ß‚§9Ô+ôlaÊ!}œll]fnºP+$0Æ9—B»õÝJbÍo™åêv[, { ž?ÆqÔŠ»ÇF{NÛ~«I,¢6ëõÜ~övÞ'?ú^M>'0®‹;fbn5ðÐÛ†”˜Wñcsøh7G;GÇà ‹ßdטÀs‹’}\¬&­9'‰ÝÕÉÎzÓ…÷}¸26ÐÃÎÞÞÍwè©h þå¥.³_$ÞÝëëjgkï¹öì ²ª…®9Z[ÜJå‘Á x%©«¦ r´³uõ ½ü¡@Ò~Næú‰öýÇ,MÊÏèë°éR:q&´š²#‹3‚z;=oˆ&!æWžZæílç`oßoè´ÛÉeƸô½ƒ½mä«B2MÚÓ“~ζ6ŽÞ+N<«|>ÇÐccŒy÷,÷ww°··ó02âåŒ9ë¼,w<ûÞºG²®Œ7íe´û£ ÙÃ''mí^ç‰0® ïã>tíé&(Œ…GFZ˜y/-—üÅ„°öÙÙÍûºÚÚÙyŽ<õŽ/"cq}Á¹m‹ú{:ÙÙÙÙ9xL˜¿ùS‡À8ùÚ6×iå­" ¥¿)ø ¡:ó²­¡íýŠ¦uÀyÏŽZÙ:žy“Óð„àÕÚ4ÏÇÍÁÎÎÎÃ?tÏÅ—Ac&¢˜Èµ}쬼–¼Ç‹Î„ZY3ë>@TIDATNˆhÍ“Äm~Ý=–ò1?¼ë‡7 Á‘y}­‰¹Õ3)¿êd³vÏíëàÞ7½š cçú¶Y®¶Îîý÷?ʈ=5Â"ôÆ8ýꈞ}¶ð>wr©ÿI¯ðówϱ··÷ šôäKö°¾v«Ï$“c$þúÎ@O';;ÇÁSV¦“C‡x¿{–•ßèR®øï‰á7—Ú ·Ø4˜dӕЖ¿B¨=?º–Þ}ä“6óú~¦„Ÿðæ’Ø‹m¸ùahÏ ±)B’Ä€€Z£ˆŠÂl±¼¾º<®É â³üq˜·rs§¬æî†íøuaÌ«Î.æéë’˜þyxXàS«äËüÚ¯±iý›þýù» ÇÚü°I(Pɯ6ÜÉ~ÑUíײtÉÎ7EFk«’íwôÏ<Ú ºÙâ]“ýѲ½Ð! àf·Ø´ n4¯\Û^~m¾Á‚š¥Ãf,Ž<«@ÿ;ë7´ßiÁè7›ý:i;¯PË'mŠÐ/*Öˆ¦Ô±ú·ú¼íêa v.žú^lszÏ-þü–¾¡—›rãøC¿)§9{PùÝPŸí\™n«"¬ü™ç3~ ¹ÃGí4µßð¦ÀQ¿þ°iµ{ò‹®j¿¸–¥ÿb| Žutë<Ú(¿ž vÛ €×ÖrÛjF496­EÆŠíVîw£‘þÏN”›•£ÿÍ÷RRŠßÁ)<±iù‰ûÉbM³¾k×-1×’ûW÷­€d¿¿¹bõί¥þ§‡ù_Lê?c7’TÜHIJRú Ò¿æbÔbP»HB­…ZûXM¸² ·Uj[ÏÛ(7äò‹ÅìHXÿ­©=†´n‰t”Jé-nʽgÐÓônREK›]ñKSó+q%Í.0„{G†xÚ›[ZÚzî¹öFLÆè„D•Wv.tµ¶´°°6gË×2!é‚ÄÕ7ö-q·±´0·2sCJ Ÿ4Éáú‚3›ç8[[š[X˜¿ãG•¨1؇¸>?bÉ`Cë¨ÊÆpÄ‹¡½Ì,’••QwËSy!TúõÅ‚1¬-Ì--lÆ-Þ›VÎûoÍn„DÕ÷­ö²µ073w =.“¼`Ñø^õÌÇÞúÒÇâ&ñK¤$¥¿¾uâ_!¯´´Œ'hå&Pëèìr3¾¤…7CbÔfGû q9œúú’^¦f³o‘iø''ø:†.ίãr¸õÖuï3*‡‡1œè0$<§–ÃáqnlèêšÎÅXT½0ÄÏkԢšz¯æøÂþΞa¤‡L]Òy‡‰›¶z˜ºÝ«üYºÇ©­­“P=§*f£™×Ô2ŒqÁM7 ûygßÕs8µ9óƒ}ÜÇ­7z_üÞ?£ Ûûœ åìú¹°’Ãå~º¾ÚÙÆæL’àgŽ1®H½äfô‡¥$¥¿u«8óÓóˆc8xáÖ³2ò&H}Þ•k7r+ù€€xwÿÒN_}R‹™M¾®»qxפ:ÈII3²?Ô®+‹ÍV³;6°KÒù›BaAÒ™oUa³çiÊ2YL™Ð°p'óùû¢ôÛ™/Eg,ê*Çb1ØÁÓÈ‹rž¼Ìà}KÌ/5gUy6ƒ!?añfñ»/ pÆ‹ÔÁÛÏŸëŠÄâ¦zÉ–““••••‘‘•¡Ô.X}-tÖ<À_j\GMÚ:ÊV†Å’ëÔuÛRçÂÏßsÅHüêôžˆy­¹‘ÿîÜ¡;e1É* àæ?¸rfÿþ§.DåT‹pÞë;‡Î^ã‰p£ÿÊ£ã/&ˆŸŸÚwúe."ÄÜ™ºÍ¸‹‹É´0W_“‘ôì- œÿöÞÁÓWêE0îÔs`_SÞΗ0–n©¤ôØL!„r¯1}UÜj¿êÎÉ5CÂ*j3#NGf•ñ o.ð¾."C¾?3%|姛çé•È§ß80`ñÉÃólH—@àrùt5M@q~†XÈìn¬&9R2p”Á±9µe|.£§eÉsyGyjÜ BP)04ue0Fa¤ÔEÎþþ=™…­à®OÄí·¾Üßœ,;"<Øc¤é=zýüI’K»@¤&ä³;k¨S€øuþÖ‡6îÅ”§Ý>}åΚ…›³ b–$õ÷¼ûÆL¿»q|ðÀQiõ ­^yd÷±„J ²­ÅVîJWí Œ¿u>êcPhrËvGÎ Ô&‚E<¡HÌVR€Ò¤W—¢ñÄ¢ÏiŸðòA¹#$•7RúËÓoÁC·öÝé~úÐ0€™ãnÞIÄMî4 r?í‹«ºþê/-Hº±}ÆΨ†—ª›®G#–âÏ ê_ï>úœ½ý¡?¨«+c5™FÅ6T‡ø’z>§DH¨ªÉ5>göPG1¥Õ2 FL–ðÇ—r䮌1 nmAບY·¹où°âÜ*4ñܪz³låÙüʪZšÎÁ}‹Ù´)§Ž§·á\CeЉä›A÷žõép{ÅŠîžFNaÀŒÙÇö9ïZô‘á#ºlÝ{'Ça|Oà¾:ñ’fñÐMfœ¹?¥y¶$CR®®ûRa²a¸1`l2fù­a„SR?¹¾!áïä Æé3¥ƒUJ{S1ÃÎËèþu§n?KJËâÒ5ƒû)³¯)RK‹2…"ÔÛ\‹Ü;YX5Qû)rŠd™”Ÿû2„²bÏû̹9rÅ&OUB$À@o‚NaÒA$‹ÅhþœE‘P*Ýû›ëœÙ¾ðAl|B|ìöµ+‹ño1”0 ôêdd]Ww=Ŧl§ÎªJâšâ¯ß²I¹ÄVPR`·)ˆ±HÁÕ¡ ù»ìqtž§qÞ×””””””¯Šº6ü/×óÖªï÷ˆãå€Eg/~4´±Õ¤ÆH¦y¶äûسËFìÍÙzn—B4–¬’¢|À„ž¶šÕ±)ÕÒ‘*¥‚vvsNŸ28ºaÿŠõ 2‚í^4،Ұ?áñë,'Ë”è t&nÇ„zsbѬ“ óN\a¦*™êlE Ôq’˜Â’PP`1˜J¨«ç°ž×byE6+lÿUݽlYNUë>oÍÚÒO¹ßÁ `HtûÅ«Þ·ä¨Í_)9®Øè€&°õ‡¡Óù_ùzaµ5£®ŒÏÌ9õÇøSM´Š|m=t³ÞI<õIŠ`H·ê—ßØ„ní¾Ž1Fˆwfö ‰ªGGÙ· èAWQ¦'äU¨K«”þæâ Dµ ˜~5`zMiî—Ø+s×Ͳ´Žê'‰€™  ªã$7(ù5œ6ñç‚WûÂæGUí8}ɽ{§FN]­4¯éw5KÞ” ë®*²ŠL&£4»›w#ŸW¼.ÆZäÍFZÀì³É)Ÿ~@ÈèÚã7öpÕËø/ «Î4úÁDJ̃”jù!ý]ÉhºY°1:ôðÏÅšÕ1Ö)vfñU7¼Øë.ß’g2=¬•åãb^ûSÓÓ*-6ø©¢6¸*:5wè‘2‡k·–vWjËyY’Ä‚ƤIGª”þþ›)$*=·ogR>Ôº:í Ü•ü†©-VU×£Òð—„|„$Æ¿k2kˆºêÊz>ÄE.¸œ¹ãÄI÷îàç]5¬Ô­—¶ õéÀ*|ý4`¸˜õdiöÐUb=¿óˆ|^ÿê›9YY¿bÍŒáû¢$1@ž\¯vvqÑkD_¡Ð¨€Bû©D?Ê_](èâlÇ–lb¡ª¸Ûöʬ&ÝÚ„¨T±šCWæÖTÕpE¿ÃÐÉ»vÜÁ3õ ÏR^E=H(@€äÃGõ|ý1þÍ©È®£'4Ö`NC¶¯÷Î8”e}~Uw%:‰ïOÖVÄ«¯ª®%$1b *³ºöP–ŽT)ý6S45Õò§S‡ß³qõî¦ oŸg(wßÔS€«YzÖz3÷®œðù™»ôc>_a $“¼lÉ ?˜~oß•Èm»éôî·Ï¿$‰³HPe{¬Ù®ÄÔ>¼wZÐèEÁÑfº 5Ÿ’³¬gE¸è±Xö„†.|uY_¹>19ÓdÊѾ†lf@oÖøõÞ=r¯üñ)£lê‘k&²÷è†Õ Å$,çË'æϺM'ô\‡.&Áaú›)§kņÆË×ÈyÁúà·¾ãC‚ºô` Ó¾eõèæ¯Nßï¹ó¡ó¬ÚÃõ¹å@дÃ|MJ’^=O®œéM¾WY`°wÄFšüÒ#Æ eòŽñ{ã±÷Ú\[1?ÿÀíÄNl£ÅaaÚ––UÀ’‰¾ŸÏ¬Ÿó°ìú¹#*,„ êu\e—õÆrÒ‘*¥¿QW¯^ý«UCwÏö=ÔSYÆN‹W-Ò`SUÁÚÚRY–e0ÂX)"@ÓÌoAø8&¦™ZZª+20Ÿ+Ò·°7êL©«#ôŒº««©©“ÔY½³jg3+c`¦šy°¯“‚e»ô ™öÇLŸ¤JBW1àÄ¢²ê†ƒ&/˜ío„1 hÚ÷5íŒÅ¨³¡åäùËüŒT0ƈÂüB–’rg = +Ký.jêêêšz=zëI캜z¾rok›žšð†EÆsؘjrl¶Lg£þ#g-šÐaŒª+øú™‡:j´d!bªÙ™w¥À49Q#}U¨¢:žXÍÐ.lÉrïnòcrgUÔÅЪ¯›“"¹(àò»ÛXè*b±@ bôèªÞHÕ5uôMºkæzýÁgÐ @Âñ]QõÚ+FùÒôþ ”þâ$½¢Ù¥=Þu5rµëÿÂ:Ëû4fäÉ#—÷±¨€ù㇠Р9±aŒ‘TÔHI*nþžTúã [§— ý×ãp`aENz|/=eðnÏÈ?ÒÜœÂü›‡r•’Ôvó&µn½ÿWÒŸ®¬k¤ ȉÌ58½eS Ä"%©v#¥ÿS5§ *³êOJRq#%)IIJ†(RHIJR’Š)IIJRq#%)IIJRq#%)II*n¤$%)ýÓéÿ€íáÌÆ¥ÿ[IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/uri1.png0000644000000000000000000001163413051004444020324 00000000000000‰PNG  IHDR +äêºsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 3Š°Ó¬IDATxÚí›ytUöÇ?¯ªzI'!@bB6 !d‘EH A¶ÁAAÄŸ€Š:€ûƈ ê8ŠŽ(.ƒˆ:è ƒ²¹""‹& 5@ „%@ötwÕûýÑݤ ?™qÎùÕ7çpª«Þ{õê¾û½÷¾{BJ‰ &ÎbŠÀ„ “&L˜Ü0aÂä† &7L˜0¹aÂ„É &Ln˜0arã×ÂW‹”Òw-}?ž76Œ<û_$¿¦ÎÙÀ€pI §gMò’kâ?À _ñ¼‘"úyŸ^Ôz ¤D‚ @‚ÏOÒó« äôöò\KÑÔ¾My“i|dÃ;2i E à=¢•ç¬È%8Õp–׿Äoù§t¾5o`~~×RúÌTÀœõºß¢Ñ‰H)ÂÛNºnRB(ŠªªŠï  —Ko˜‚š¦b¸ÜÆù¦¡Y4BøÈà®äoÏ°ÎÍCÏb[Ã+ŸPË´ûˆnv†,M0ÆNVÎæ½B²úñÀMðëèá!ÆÖù¼ý ¤ðüB¬“ñHÒ«âgèÝä‘ þÌëÛ°g2k~ãzÄkèn] MS}R) )u·Õb†Ó­Ÿ_¶ªáv²af¨‹¢HÝuv¡¨š¦zæ&Õݺ¢jŠ  u—[W¸å«Ë¿X¹¶ø”·;("!»ï€«ûÈJ ó,nMé·wÞüÒé`M״­Ý8õí‘êüqÓWêR*»]µµµ¤ÔQ’f,š™ªú™²Š½d%q¤5…?S>OQÓ†¯–Ó!òb´¹’úòx>Ýoeý{—F`‹oãº÷°g°ïG¢‚PñÚb>ÛÈ€«in㢈8ÿ FåÕÈïýõK•ÏxfÅñØ'ž›ÒF­pr߆§î¬ÅäŸNüqä}sªÝ†¡Øív½¶Êiª£õƒ/>°}æä…Û„EEµÙì¸jnAåIeÜì9·dh/ßùÀÚã§tÝðÈßív†·ívíˆázg8¤ô¨i]ñšG_ú¨Ï/_“f×Ë‹?ÿày‹ ¯zòÕ‰=Û¨g³B€Bœ>°ñý·ç|³©Xj–ØÌ>ã&ŒíV[V4ãÞ©-o{⎼T„—žo•…Ÿ¼òô§'^üûó Hñ+]ý¯ƒÖˆv !¤B-XòôÓ̯ˆ»iìØ‘ñ-Té>¶'î_Ÿ_úŪ?Íøcvë„îêÃÅG3îŸ:ªCËj£žZb’Ã&úO¾¿½K*šM)\0{ÞæScï¹/5Š”Rm£øh!Brz?Å q³s Ë í$¶¼Ýõ<þfH` °ásmõqQýëÎs.üÆÔ‚°ƒ-$ õ4ótY<‘›¾d]Ù1ïjp¶þK  F[ž6FEÙ±#Ç.ðÀpÕ–*vWºˆì6åþ0—qrÏú×ÿúI»[^›iqº ´öQ17?œ|Z*ªR]¼å½YoYN™”›,0\.µ]|(T”)©M¹ÿö‘¡é®>õÓ’¹O=´¾äÉwN @Ñ–ŸKŠö)ÖÓ;¿›þØs[µˆê’Ò“5®s•Æ£ïFíWîýý͇>þøÿ„º.ÿ`öãš9÷Ùö¡!­cO|ôí¶Q½R›[¬á­Š@ݳw´çΉðʷߙӹ_N÷úf‘s=¢¯Þ¥-µÁí¯ÈÍÍô°dPËØ+{÷ öÝíÓ3­ê†.þbTߎ-ìqªpë½ÍÐöª²jù ™s׬á±qŸÑP,â±÷–½¸¨$ñ­×ȉ·qAãï™>ÿŸ;ŸÕ!­S/÷›+K+··áªØ±m;áiÑÊ‘OuLïÑÍúúÖ ùzfŽ"¥@ß¿i¿3¾KJèÎM›J+õ­RR“‚)ù÷:íÂÛ4)@P²uùòMÆèWŸ“îQaÏN*¬ý×æ^©†„ÖXHWÞ(Í]º”uuN ´) 0 3Ž È_ÀP̆ŸÐ?â†iTŽ`YoÆ=ÁáJT éƒYýEðÝ_¸íYǤôa`m€Umfüd–¬§Ê IY¼ô>×¥s` ÃE‹ãËŸèÍÚy\; W8 W“Qïõý¾(˜wáÉ7©6°„pí=Ì{ŽŠ"zFUŒ¿‰Ë²Ù¼”×n`LzŽº™³E£÷$>¸±×òÝnPH¾‰óú5®€%s: —¬çvpº\Âp:]ÖÀDŒ4t§K[=a¶ŽÄþÝ›ú㱚:W‹ «~ìðÖÕÛ2îxP ºÜüPvX¸³,_žIÌɳ–U+?-ˆì:¬]¤Ý³eµµÎÌŠ‹øyóêã£Ò²23Z;Vü¸¿<5<’š½yvJYâ]a»þ¶ËòèŸ?ºùêænͯsç©áÞ¼xÚ´ü¼)©[–G´ÒŽnÜv¨Ë5“§NÖLþ{é¡\ØR )ÜðsET×) ª7©"<á ³©ŠŸc“Õ§,ÚW½{ö>áÖ&ù?o„ãdÓq°‘à !q »äF=ÇÕÕ£†‚…<±!(ßýOStœË¯cÉ\Á›üF/eâ|O·[Ù°•ÙwQTÀ]“)­fÀ½ŒÌ¡¼˜Çgâ,ãéé”;3IþY£zTlá••Üñ0y)¸N³à-~ØKó6,yE€W?æó7 ‡ TðîóÇr}o„“oÞ¡o.JÆôB:Ùþ>/4ÅkèΚÒÃû÷ì®ÇâSîÿ[NG4…h®’ƒåöfÁVU£´ø_«·ë™/¡ávËy³’B y²à€Œ ·[½·„šxYPÉé#¥µX:dµ¿lûúÐÍѬ(ÿ˼g-ýäÃ~ÉöŽ×_S¾që‰Z—„fÓNo_¶9îî·ßxéO3ç<3ºëÊ%‹Öìp"„¿ßðñ؉jGd¼ÃaóJUœZòîû›W(ŠÒp[ïypL„7=S»hêï?Ñý<­Qœ<êã9ǵ°4N…v—qøZùß®ädž%ñÎ [óíË\ý=«Šé07&"ΓڲT0{CÛsô*º å@{Šè×–¾=,ôÈåŠHŒ ÁMj>X@Ë"®À7»¨ÄÜ9Äh‰eE)+Vò‡N^'Õb9YøÕÝ?×ý3Išf—D_"UP­Ž0ë™äž¿ðµ·7Ëîcº„†ªèuû×|U“‘‘.¤¼ðÙ«5®šr·d±«žÆ)µ»ê¬uÖÕ=17%nöžõGݽ¢„@ê±iýº§8,H‰ÚvXw1gÉÁÚ»:„z,¦£eú„[®° ZrçeÞ®ã¥ÇIù·UMŠtmÕ]çÒuÃçgªÿµvÝ÷E'EHwõ±Úcðqƒ ›^›ÿPNl}`%AQ,í"üÆ©#ú…èl:Ƨ]s®»ª¤T(F¯ABÙnÜÐ"„´¤$¨yíê¹qì5àÚCn¤×¾¹Ý_ïcXZ<_ÎåƒXµGËf¡¿VhoÇñˆJ 4 ª¨vyý›÷CËvi Ä»ÈË#ÜÅŠRjÊ]Ýéjyù¹³¦§ªu¾¹Z±õ=cîºD¦S”þ´°_ßÅgL¿nÈðžãŸ˜<ØnçÉoWŸêÔõòø$B4%”ª*¥nøg†¥[—Š¢( @f^Æáé[ö®‹ŠÃ™âP}yµUV¯ð…Ÿn¿kj7OGµY\+ÅË;a±¤¡»Ó<•/Óº}«ºÏw—”̈ —€Œžö׿{š]ÿìÀIEÒ¯‹fQÐl6­áêa“p¤˜_ #äóµp`g¬§Ÿr(‚3©AÍo}mÍ”GHp K„Àp“”äónï’[ *J.Õf0ªg×¥øJ“³Ý¤lõUñZ„¦„¿BµØP›Íw§RX.]šF†$dÞsëu!*„j m›ž§!%¢îèöü:µ_÷>6ÿ Å´„%4>ÔØZWá2Š§ÞSwì´;48$Ô`mÓ·ý©Å÷ÌŽVA Õ¢Rxþ2;öš;gþÁ©Ýâ‚Àÿè1ŽÆc* QÝfX¦¼óY~N»«CU)=@—[6©8î­^p)ÏX£’mÔAL÷‹‹ %„ÄTÖ±ÿ4Ia8kÉßSß$´Š@âÊëéàr"ÏðçýGäö`ÕZ~w û> — )ÐT¥ aûEÔ¢¹ÈÝ‚4ÔãÒí-ãró®jn |¡ŠàPᡆ÷Èm„¾l‹ˆèÛ9hÙÞÒêJ£yˆ@FMÉŽc§Ú¤§¶V‘RÙ£r²\ ÖíšØ½M½$…',Ó²:ZÜ3–o㎴߬¾¡4¾c“ò²ÖÙ·ŽÎÝÿÑ“Ï¿½è`%¾Òlõæï>~yæWjlTX½°„Åta}hÄààfç×`£K¿‹V¸„LâU‡xçEöígÑlæ¬ÿŒL:GPµ—™³Ø]ÂÏ‹èœBB›“IƒÙ }â»äESô ßÁ¾/¸*´žü°» 1»†T±t%¥¸ÿ;E‰ ô• @ÕÖ_þ¥Æçu²Ùá°) ÚìªÑݵ§ Ö­Ùv¤DçqãB ¿^°n'Š~ùꟛ‹eöà\/ûlA)Ýz”-_y¤Ü¯æu÷‘’•jÕ¶~¹ö7<ò§5¦nB Õ1hò«vëcO}øÒ½bk,ªÊÊÒ]gOò·7‹8cóeõ?¦NXe·ø§½Ý.yù S'±5Êzß®B c@j“È%ý pL·bÚ2ü‘…/bdt7Þ_‡'6 íÀœ—è3ŽÏ_dùŸ‘:ºÁˆ‰tŒdí;¼µG+ž{ÂsÓÈ»‡yÓ¸u0—•S´‡Ç)¯9Ïdü®íi¤ì€é7ðVo~œß˜gM´i4p|KJ£4®”†¼@Ú×0dǧä9 '§þ²¾ eìƒÞ}ºkß̧ÿ´vo¥0ªŠ­qá[Vgmè¤×gõŽ²TÛöÂ}wOþêÝÑ1!É#»{ãSOŽÿrV| ëɽŕWŽ{jdzs_€jÉLÎjk¼°¶è:áG:!AH,mGu±OßñÝ Ùãÿ*ÿ3g1µF Œ÷€¡õ8㊡[¾øfÍžÃen©¶ˆNìÔ£_vûˆ35GëA#†×…ØÎZDÝ-cÃ…_Ô™Ùów–ÓQÁZ¥MÝ ÍuÜžJºêípY&7Ž¥:žæVÔ,ÆÜÊáB­ÞvÄø8:ôBVžXJú«,ÙDP ãïÆøžªD.ÏñF$Æ°;›ÙsÙy5˜«F3"`ýzFßJÒ5ôGJ²ÇóÔ&¶8ùv#“:2|,¥a´n ß“1†Ý˜‡0|4O BÙ¸…Ç_¥\Ò!ˆPrnæÈIútôζÏê.£W²×vÎmé´éÐf(cqt /½;kû®¹+Z6ó¢ÄwíˆÖžÂ§·‡#"aà5×·jÐÜJkóèÞÃFÚ’#”€sö®ýE·H±) ,H«6¼ãC»FùžY[%¦t´×(Š’ÙIÁÐ )]5ZˆEH°Gõ6ÜÞÖH,WÝùrL‡Ï¾\»µJ »ùáA»·S}/’ôNÃn¹ÖVcíÞghy³µ¾†t?!gI­Q£·êИh§Jé ¹l-’‡ íŸrî6ð»×&ǬÞ3‡ ßFÊF†ÉúckgZž=èÙ:êí×yóñBÆäý9Gâ6:ˆwOéIœg> LàüýGl)Dë'0¿.õçAE}Ïsµ¼AÉŽv¯³»p¡en¼±÷Ì”¯~|îSŸ†4ð_¯ÀWˆÿn˜0ñÿ æÿû3aÂä† &7L˜0¹aÂ„É &Ln˜0arÄ “&L˜Ü0aÂä† &7L˜0¹a„ “&L˜Ü0aÂä† &7L˜0¹aÂÄoÿ…·§-(b –IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/client_body1.png0000644000000000000000000011441713051004444022023 00000000000000‰PNG  IHDRzAöó©sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ$&?TÎ IDATxÚìg|EÛƯÙÝSÒBI 5R@Bï½H¯* UEEQ( *V¤‰4é½wBï½… ¤÷Svwî÷ÃIHBñ±À#¼ÏüçÃ9{vgfï¹öž{vgA ž<’0@ r#„Ü@ äF ¹!7@È@ ¹Bn@ r#„Ü@ äF ¹‚ÿÊ?Obÿ¾½’$dKð”¹ޠaca‡§ögó›7göâ}1¥ÊV¦<ܾq¥a%Ÿqo¿&LñÌ{7ƒR½aû ¡‘”‚§“ëçŽ2N;< ˆN@ r#DgJà@Ï>slãV"NFÏàŠÍ{º@#‚íNÔªÎU×¬æ †;GæßJu«Û¦«Æ‰1FD²–µd¾‡w‚Ýb.^Y¥÷;n†"鑤0{ÂéKGöådçÊξ¥ë<ࡪ`,oXb£V/u ^£Š§ã(†ÜS ¿¶(2€ìR¢bPx;/7YçÄò„wó¬Ám±Wö­“œ‹™]½ÌÎÎÙ×7-}­ib–`,õâŠèÇÎÌ«ˆ“_…ª—W~y&ÞîhóLf×7NŒŽI ö–O¸º{µ…ã>±‘º¶ü͹ã^½{7U6šìÉg¶}Üpýâ•’8üŒÝ=ù{ôÉ£gç}¨Ó½m¶˜½+“57'W/£‘¥^Þ°ê­°}[÷94îñ:1–“s§()))bÉ#áÝòéÅ ˜#}J æìåZµ*Aq¯Þ¼IÙ-[4»[Ñ»%Î9˜,öÀX^_ý‹…² ²O/·b¯Þ¬^9ðá‰1 ÄÅõ¹y–áRPx{³Ä ÌäX½*ìHÛñu²nÈø´Þ"º]Mض±Vdìà×´3ÛâèAÀtn8Ü<ýœ3ÏŸB庲Ä`M=)3/E’R7MIårÔøzQù¹$oØT=t´‡¸°Y§7éîõŒ2 £!7Ïl'ÊÞÆ%ߊd“q4êPÅ?´î®“ÃÄ·ç½Ðöjܨò%Œëá)dGPxÇí»gZºG81cL¦ôKy4X(+8uªÊK šµ¬ìÈEÖoÌð|l°2Å‹vò$FYvlºSiÔP™„ÚDìæÿMߊåî¿}=³lD¸%ö\Øs‘kñ/]½Lô®’ôh…adIKÍI»›÷ɱj7¶‚KÜÒ×;ÇDGç¦'fÆZûA‡”b-;u«Š¬I·­ejTÎË%‡,ö ÿŠþ×¢¶È ´ìäÜôÄœô¤”s+~§©B·º!\ˆ@x7Ï´ÂÜç”\›;Y¯úFtµ _T£~ƒùó¶Ø^ìf°ç©Ò}ÈfÚ;©sÁÏÐ ý7ÖTSýöT9»xß‚WÒÓrr¡½fW©B:]ùå ãï®åëGxÃð_—l°÷hÀ$DÏê €¸¹dÚom*WÞßበ&ø7[Ë?|Øiá‚ù§ÔŠÿƒ¯h:Z/c *ÂI`/ò/å dsr|+|=8„—BžF0Ü{ŠØqàæ‰/;ŽÂÿ¬ÔÄ^8vaÝŒšU*¾v~~~Æ í_x7ÏJ¿É!EÆÊo÷E= *´µðQ…ÒyHúyGŠ¹Þòˆ\Šì_P0@Än@ r#„Ü@ äF ¹!7@È@ ¹Bn@ r#„Ü@ äF ¹‚ÇÆÓ?›ŸveÃÜâŽIN™lô*×°\å šFŒ1ñÇ7Þ½ÏIv+Z¶Vm9ý&`KŒ9º#=5²É#(¼lh5Æ‘zrîøB“ç­­íÚ®{ÑI< QÇÏ8ÕnR‹ò„»±ç7[ɺ!ÏU¸7ÿ^ò±å·¥²¡•¼nÝ$;æ%gÌ‘&óo:0%j®]¥ÂÛriSB‰½zá xÞòON>•ËG6Ròæ%–súèÁ”ðÖ͹ňóëg+e›U(_æ¾iúˆH’Yâé ñ±7÷àŠ Úš$“÷ „wó÷ЯoÿõúÍÝnÑì–ÜÄKÇ~ìµjÑ60F€ž~nõ¨{Ö.KKLÈIŠ¾¼fÜü7zÝM×@¿»mÑm.=ÙÀ³nœY0xù·³H©¹–¬TkVZâ±Ug´å¤Y³R­VÛ}Xüª¯SUU*´\|Ôòèk1…U)õÔÚó§ÏȌ۲R­Y©¶ì;·ü’p'Åš•jÍN'‚š“nÉJµå$ÇlÿåêÕ;Ö¬TkVª¦!óÆþóû6iv‹f³Ø³î^ß6qÑØWì#€Àwο”$´”s›Þªuró¯±17˜Ò˜˜Ìb~yã’åvŽÔ³ –ŒÍ*1±à‚@x7Ÿâ‘/Õ æDF9ÇžÚ¦‰OqÚ;µŸ^öÍ~¯Ô5A6ãò¼þÛ&¿ÐoÒœø}®GÓ÷:÷éiçbõú XþöðØ„!eÂ_­7æ_H²6lÐoöàRpÆèô•„JÍ*ëü?û Ì¥LýþãHrÚíý¿—k7¦b€ìø˯ë»$ƒ¶ïÄ¢ìÈ×##Šå)WÜ‚ëvEœ¬‡×ÚµãN›f~`¸té\@‹±œ!zÎÈ Wx.î•ña”|`û®Û½Øäʉ™Fü¼Þþug[t¨&j¶@x7ÿ33Ù`µZígç^J­Øòõºê˜wº »Œ§´›ç5F£)3!V— ]î8ysï?›øÝŒtwŸ÷ÿBß„1¦ëN%ËzäÞ¸@’³“bí¥«– BFï¬h¢G¬¹™{ÞìãïÆbdCɦi×7È¢/%ÞÍ?„ˆ˜ÄxöQ®ª.nnÉÇnš+ºzþŠ `®Áe=r¯Ÿ½Sµy`è Ooï:ïÍn^¾u{TkÞÁI†®ÿÙå–ÔèŸÔaîFÜ Ü82I9øóÚKKï­u›tKªôOÏ `$Å^ÈôV¿17Ý¿¯3¸ú kÉN2(¾÷Vvpss·ä&1 ÐEݹù[$휱ó„d˸}v¹þK=]p‹s&+4\YQÀíR;L:˜s:åÆ™Øc¿Î_ô¡OØKíßxÓ ã?ë ã—Vì¬ÜuØí–\Ë6 ­ªó<·äÎŽobÿ®O£f\Û5{,@júµ([ÈàŽµ]¡ÑÕ5ÛË5þè!«}?(T\“ yIH„nBnþÆ’Ï•,åMDLq®ÖcŠo WP̯¸eç› Y+XVNR“ãS •üH H—=ƒÂ¼ÊÔ i1§_\ýQŸ£»:ÔoTþ?{jƹ;ZÛoz`E8“o¥ Môüø±íè옿ÛÀ™Á¥dù0"“Ë5\¥œn#¿‘öüsü?ÅŒ09ykú8Š“››k4» Á¹ùûxTnS9,øÞלÀ@nµ{–˜ÓfÏ–«-›UàZ6v矚ÝzLrw’‰ŽZÃ^|àûÞ©©Ù`N~uzõœñ•‹¹pàCçúCbª’d;¿æd؇Õð@¶¤kœóû¢'œÙÂCeÀu•’:⺮?žaÚÙQ¡/sÄŒ˜~gå›m&…¸õñÂÍdöoÖgÜÄ´³Û®ûÕjؤº®)u>Üå´ðí¥c&™JFtœº®¸AÔjÁÓê#Ð?ëè/\0ÿ”Z±Bhä“Ò‚$œ6¢DÆËï:¨Ðˆ11ƘTê Â‘"HŒ1ðƪ™ÏK¡Ðv’dçùÛ‰ 3vo å[´?“w"ù{:FÙÌý¾¬ yG•­¼ÎT^RcùH?¯ ö± ëfÔ¬R¡ðuôóó6l˜0ŽðnŠÊ!qÇöð¿/!P¡ŽPÁŸŽîÈ$§W2SÆØýÛƒ£…3vï¼}þ0MöˆÜïß …†á%À˜…À9Áƈv€ˆ™$@ìƒ è€`dP,™9’‚`€Ã㳜àÄàHJL€¨€Z4)ƒà€• 0ó“à”ŸÀ ‹÷*ÏHgJ§^k–cÝrÈ~Y„„D¼ÿ&ˆðò«x®*^Kú FÛVxe(²2P- oÁÄqåX´Ìÿ…_aú_Î]RXꉅ×/Ë̲š}ª„õ~?¸T1þRD–À˜,CSÿsSeŒi—?ûm‰ë€‰£`Ïߪ>™êHéß¹/I,çøkvÔéón¿¿ðʹ݆„[ÈÍùåFðôð´?wC€Œ[kÞmpðèÝZý¾h1|rH0V½ÕàÀñëíEDn±[¬y̆È`²ìÐ|ͼ5;ÔbÄ´Zõ«ìû¼åÆ%K Ò_›Ìcß/ýjná$nåÃ[.·Ú,Ö¢÷†éŸcóÚóZh¹v«ý¯ªT’˜ÅMð x7Ä ™Ø7û_ßwGHˆàS¦ªŸ¿óŽ+-µF›ed^Þ~åôi‹WëX¾J0×d`·¯Œ¹®xUªÜ¼½1_[Õ”‹çvlÔe¯²-y»€ˆdä\Û³,11Õ©DåjÍÛJZ‘ž1vuÁè«9!}¾þÞÉ18\¹wßÚÙ[Sõ^î ȉ>·{cvŽêX§Jã°“Ø¥ÍÓ=ÆñkËnÜLrõ«YµQsÛåuwíѲ<¯²Õî2ü†é~uûÜ=°€—XµZq–}6/‘ð*¢P‹¶%9}ðp펃%…áòy+€¸íÄÚ*·~gÿ¼»I9žåW ¯­s’ ,ýÒŽk§NjÌÉ·ÆóeÊ Øç œ¬'_Úµ2-ÃâU¡és5«ë:I–zvcôù‹:̾aÝÊ”/Éu$),.jÉíø[&ŸêUš´Ì/K²Ý9r.jŒ%*´zÁÝHžzi׊”Ô,—€°êMš’½ Ý=°t³–< Þ 1nMºÌ½Ð_ÒŽqgœ«¿Õeôhtpê’é_1 o§“?t=¸ÿ‚ÄÀ¿ôs×=[w™Š•²\þmɸ‘\YŠÝ1÷G£wz{÷º÷º©œd9{Óû-Ï^Nôª˜saɼ±clœŽeI ®\:ÒøegîÈ ùµíñétwž}ö×·{%[\Š•IÞ7å·'€10Ä\{ðÇ·c³K– ­}c㸭».}*»ºpÅì[²|MÄ]õ݇ɪ»³³çœûõí^I¹ÎŃÊ$à£O @·$ݾrÊñÔ"<‹ÁÅ ¿²ùÎÉÃ2Í•ƒ+W¸ðëÐ}g³c·6¼³ò‡™²wEO/åèŒöŽÆJEæã"YJ^ý^‡èøL7O·kˆ­_}ˆÉ,nÝ[+žmð.ãîÁNmsöâ-‰A’ÔS3Ú) é¶/]éT<0çÚšµŸ g“²|t›«q–âAåÒŽü0ïãÏ5*dCÕŽ­ëaµˆ–&xê½nKfDÎNȃÈq»v<Žëܦó¸A%¼ˆS±ô£[Nîiа²-5úЙ¤®“–¹™$¹U;}Òèø4”Ýð³u.«]ãò{CsT=gÛ˜8çnÃß­å¢bDÇÄ1®]‹«Ha”kj¶_`z‰š÷Û+,trÓ^͹F!5ªÌùòÍÜ‚\Á$ɽÆó [µÒ‰5ïRcáú=Rë>¾î)T!¨Z]b`’ìѯië&:Ã:¢úÍz·äU¬QmÞëoæŒ/•_ç æ]ßkÎ5Øôo¡ÀÀJvÿ,¬R —X½VóvlÙU¿fûcÛ·„¿¼§j%O0V>(eþ—Õ Ÿ_è!j–²î½ä/ >B³á¹z5¶Ï]gÕ"Eᤴj¹}Ò‡w2áPêV-1¬ªß¬¾´0d/–VêÍ¡#úi6To~{TÛø”‘Á>nyyæäàן†’¢± žúP1“ñZ„† IÌîÅŽÍ´9.Ù±¯\¾:1س¯Hp5dbÐ5÷†£ Ü»‰³L“ Œ¸ÎYÜ¥4“~vçÌ÷9 Meñwª…èy¯0 2cŒkz¡ÜóV&ëµKªÿË¡ÐÁ#ç?SvL¼5è93¸êæìxqIqu†–ÃïͨÞŃ8Áví’ê? Œ18ûù™r®ÇYJŠúpÍa†ïf¢ruD6âÞnn €ââÄ´lI½’nð òr£ØÖÈVgçÂhÒó£(rÌåôâ!¥™ 0ç°V¯† —Ã3zÝJÌtìf¨¡!;åºÑÉSæDŒiZñ&£C6@Å[$0‚d41®éWÏe›Lûw~ \bog”-á–oBI±ÁÓ/7ÙìÆî¤fz¹£üc ŠBû>nŸZaJŸ‘ %IJ[ÿúÆ›T(Ä\T™òêþý¸ThQ·C›¼Ù$º’ÌÞ×W¿·mÓ6 çö¿èäë}DªÚ‚¤Âˆë² wVˆ ^‰ú£7’$ß°ûžt~ø£ pâ0ŒÆ<¹ÁCã!…_Íd ºÁ¸bH£LÅ 0¶™~ì^d:/sɨoÛƒÕÿ±o«ŒI‰ {ìäxÀ†…òz@8È£F÷º ªçÛð-ÉÉ«À îøn\ÝDK<õ±FÌè]¯²Ó¡™ãrÀ˜ã•"…%ï3kÈKVžrû&UèÐR1šd³ñJÌ]If .å9rlšÎˆ“vìÛ!“.fAå=Sc]|}œ<Š;{ú¨™¹F£T¦ë”ásNsjè·% 5kG^Û>3>‡ågëÕEs‡·NÐÍe+(·]€ "BîíÛ6·²N `¸o$Š˜©låÖá @D°Ü¹ms-’ƒc1"à§ÎâJy-->Ã8Ñã7ÛPͤ”èõ륡sNs8ÀY.]Ö-éÜ5˜@ÄH‹ÙþÍ6[\ò]©\³Ù`’MÆs×szââl³¤k2cD³åàŒÁ×Óžo¹—¤Ëw}|œ<Š;{ùØ3rM¥ ˜º†½Û¡©¢¥ žþÎ#b冭º5©Ë’wºWiØÎÕÙ³çÜÉ;-Æ/63÷RL—–þàÑ ÚÝãóÅÝ­gNÝŒ‰)X.´œÇúo?oÒ(÷êê37éÅ’ÀC‡¼;|\rgûu³½ªT¯˜w`ßÊM&oò-fÖ ÝáK´›yëÅ o7¨Ô¢¿——›%ñô™Ý{C_žå+ÁûÅiQ£_9\öÓ_—;¿3TläòH­QŒžÙ ¯/YºV«‚ÍA/NÛÿöðÃÛ> ðu¹¹ë¹|›`Wvï=qKü¾Ýk6´ñ…¬2|: ÎÎT3ÍP£Q‹Ý¿¾iî9Ä`¿}|þ’ç¯qbà-|ŸÿÄ{wçó<*”ó¾±ý«ìRãŒæ`Ÿvq實° øCóJTôŠ;¿/>¾N© zU}'®úzRXdXæ™WÒJÕõAîå‡äëÛ{šÛ]·.¦ŠKg^ÛµùxïékÜòëUN6ÎAíH”ôMð´wª¸K“ñÛ:öïkO¾œ}V)ÕvÐÏÊú»k6Ôµ2À{a÷Z÷z“ë¾üsX ÏècÇ 5G­ +yóÈú ¹Vï)¿È:˜k¥À2Ž9ïHr*U%Â(1Î};¹-Ð|ëòžåwÓÝzÿ°«d1Ó}ùs;ª ^ÐÜDÅr3áêI›1¤û×Ã#ªéD’[¿œø=çw¯1UÑïý±D‚w¹ÏbyÂÃ\+†”e:ʵ|#¨”ñúéÓ ”¨éænvôD$×ð§.@üÞó»×ª íÿÁû0—Š¥CÊL6˜Ìyê”$¤§9z4~•"L‡½kø—óÔuZ§>ã,¹zêLQÛê×âE¦öa•î6eCq~ýÚÑ=õ>ëúb+nE³wyÚϜ߻¥D«™5_œ]91ç/œ"Æî¬QÞ{d£Å«mïO¾`vÈžÕJ•Ï +‘âX5\ˆ÷š¶Þ[½|qÏòT­Lÿ7¸;ÉE:[âu)A!÷áx‰A0¨"ãÅ¡ÏR±uûw¡~c(ÿÚ4<â%Ñ™üE•gïy9YF“¿<)AvàÓièÚç+vF:úvÄÝ;â „ÜŒAÓ`4"6Š‚â>èÖW\=12%øŽ™±@ äF „Ü!7@ äF ¹Bn@È@ r#BnÁÓÂÿú;S†Ü,§ä±îÚ“…(Û¯47˜„%„ÜüOSûûª-ù†„Ü× ééB!Ià4í±õA 0v+þüjë$ah¸‰ñG'L1A·ƒŠ,¡Î˜ÑÕBúžDÄdf0Àn-²*±à)çˆÝdìûôvJÖ“©è‡Yg OL±Hüõ·?ŒƒeŸÝüÙó³^n°ðÍv¿ [üÁàÉ8d g›dg6©œ¨ÏããSîý´ñëk]·Nmñ[㒠飴ÖÄïz†$$åÊ.-ž`$ëÞ~S‡}%þÚY?Üæ ®®ø$GbÄm¿¼TîZLjQÙ`ìÆ÷Ó_ÆÍQƘýäÈoÞ˜ÊLBk„Ü<¶.?I&\ÞºÕ£Al†,#q;’M0 HÌ0˜À@”·* f(FèJ^7ïí^Å¿ß_¹ÓÛwLem )mk\B•îížK;:i÷Æ“}¦G™¸µé“õÓ_0ñ'Ž˜ùæ·žï®QÞSÓP·i©í_6²w›R­Nm£ÉÙ`2êV"’ºŒÿäç‘?õ^¸ÂÙ 5væ‘7ºÍ<èª qÿ›¾Ö÷‹ù²«§sÊŠŒÒ ‡õ)£ktnt㊯-«\ÆGÕ‰IæÐ&%wþ6^¿¶¿d‹Ï[6+çˆ).ž.i¿eúíè=åcÝv{á讕¶™®ü|BÝÏU „¤ßX4²½ÁuoµjÅÎÝËÚxë %™‚#_w‰ÚÖ´EI“‹ìÔᣯ~1¹ëÂu®6X’\ÌÎ&&áêºQg.{šu8¢ Y5}òàÏ?2¸û(W? þ2ª–3²Nþ²dÑ„jµæ0-kÚù‹ö\Ø“ox=|Ä‚Öã¿›5ìƒÎ¿mv·Úo9{Hc ¢WŽ¼‘^eÈ˘ŒíŸ´Q !`°\™vêHfŸïšÜXûÞŽïÆôýpºhºBn·wÃé*\W9G©Èvü·‘ñvø»j¡W«¯Ï”É´Õ\Zôû¡%ãjÆ$’«:9gf§iej·áóVÇ[`BìšÅÍ{{ËÚ}{ï52è*[vú­ûøAÒXhpYOÕNŒ1ÿžËzFîÜ=ûóå«­’,)n•Û|ø“—\×â*ˆ —~½ßtÆ­Y™YÌ9DÓ£t‚ IãåªÖ/£Ú‰‘ €k*ç`K;>}Óήßh3ᯧbK8±}ëÅV}ûƒ*…W +®Ù‰)>%óÕØ»ÊÝ-rµvÕ¡ªÄXP`éçn^9ÚA1ÒŽ¯²7!«¨9d%RS€k@ºV°b°¤Øcvï/5ìŒf%*ô¹àй¡XOt n¥µ¬M‚I ” ƈ^ï”hÕ»°åuëº žŸ®$[c÷õ¶@·ƒê6mxyÉ]œBÞë3…é9éÙ9f26K!7OÝ¥ZDùÀ¢CÝDœ¾|¥ò暀X±JÌ¡M’«‹³53Ëž“J«Ì^•Wun‰O°Vò5HÒ£"ˆKžòÔMöt2egçùr£¨çVŒžëU繰ꊬk$ çJõ£Fõ\ÿì¥ •|­k¹©JʼÖsç:)©È¹?€<ÊÊ@Þ Á)°y»O›ëv‹-'ýÆæñkÇvè9i­káB¥¬_þù§ Ëò̘{E&W#+±\]½nñ¾®“w[w Û4oá‹c^Jºº6#³NÞ‚änA&Ç!Ü]Ùíl{VfŽ“[x^y<Üœnde0•FmÕ—~8ox¸“WIïJÝ[~‰½®·ÄÓ3²Ì~%ŒÄÀ2ø:›Ò3³à À©s¬}Ê$V(`&LJ¡ÇntûCöY™YÆ2ÅŒ``€¹„7Ñ0Øã—®ž>Ý£r¿@?=ñŠ‰róßé[¡TÓw|;…ç¼™’Û ¸œ+£ì¼eŒY,Vƒ¿“Qv!{Ç]û;Vû–h\œÑ5êü­")s«Z0F9w#²àÙ6»Ù|¯a0ùòï3s‚º¾ôÎÛšLʸ¸î¤Ã¿ÙXËW“yΘĬˆ݉ÙÜ̚ˈc-«²ü{54+lõ®f&^;ïû\$é'³»¹R×Ïïï™’ks»·Î-ÓŽL›`lùÓójè:,1[O=^àíÝß@‘x}¯[Ùþ®fÅ­ÓlÿqömpÏܸ§á¤»2KŠ8÷ÍÉ%g'ÅÉl´§æ8´ˆÀr-ª“·™Š³wè€ïk¾¨¦Å_:öÛ¨s¼Ú÷ªÿÈ Á\œÍ¶œlÀ`ÄôL›ÝÉìôUåª}çOïìX>)›Öð½-!>îj2™T‹0‚=51I’èðŒÉnV¶oQ†sdžZpæÒ6ÑnÅÈÔ“ôk˜AQ"çÒÅԄó?/Ýcˆ™çßk“—[²–+ÛSÌeÊù£rûº +¾Ê´<çöŽï§X4ªôÖÊásSðyõûÏdU”œ[«t“ È:þ{†sÒ…Z‚Î!$IFÌ’·¬\drò¯]œ'þeB©®ƒœ887…´¬·ä •ƒZò™m³~T‹ÊÏŽÞ8uäÉçd# &–tvAò2 \%d šÎ .®ŒA‘Ôóë¿‘ÙðÀƒ'`º¤( \<ƒsnïÒ&I¬í»ŸÄþþ‰¥Lû`wÈ (–ýׯÛ$=åŽj+X< V­œ³lfP2oÞ¾Rº|m®¥ìýztr ¼ÊV+]±²-=®ˆªqÈùš¨“KPXÙø¿L ,qÏüìâ ƒ‹?B›ä`É`l1ü«B–?^¡tq@W Èy•P‡{`eÏÛ›WŒPœpvÿqYaéœ\݃ÂrÏn_(þ½€ÿ¿½Éà¹ob×K‘¯ty© ×=u]óû©/•çœ 3€³ÀžÆuq-á‘týrÅÖŸºkÄëM9öâ’7[yøeܼâö†Ifºïó“fòm°ì­n¾Î‰7âjôî¬Béš ÒCÚw?õÙ¿Ž?ëd¿éÑê'ÿÀ—£¾î§¼·(ÀýQÏ°•‹Žµë_YçD@ÉÖ3ýN˜ÿF‡â¾i·â‚Z~l ظÆuÝáÞ(Åjöywäæožø%ÛÕÓËšq×èU>tÄ*“ çÚ%¼ï.Þ¶|ß…uõ[þm÷Ç"­I±U_˜füiÐê)£;töÖï=À')Á¥ŠúªÏµÚƒz Tfgÿ_Õó*ퟑ”äÑ6ëÊڟ߈*Vc|»0Æý;ß]Òóªâ›uõˆ©LÿÒ^LéÛ¢ãÉ-£xWN»zÑ5ü½ÐÚAœ£Âsló;µ\ª#7.ËêÕpÌ7œ’¹¦Ü«ûù¤­Þ6¸ÇÜH“¦ëœTTé=ýúä×çÝîiÎJOך¼2×`q•ë÷Æô¸®ôÇT»Å^ôAJÙµR@‰ìÕ#Ú•~~&×U"»M¾8ýýyï.uÒÊ4i _IÔ¹> ×šY-Öì‹Ìºà§1ߌ\ùÕG­êë…ò<<í ¿“˜¬šFŒ±œ‹“V,uïÿÉ+n¯ïºûÚÐ~£ÚH@Ð5"0ƒ”ÿð®®úøi½É¯ù­ú®ÇÈÃ}^¬S(00Ù]I »÷“™$«D`–+_þþ›ù… #%^´¨(”©Ädº½àÑX&AÊwH׉C~.¤S^ɉC×  1èî¥ó M$ƒ£{]ËOŸÃ~þÃ_暇}ý¾¬;ºràäx[ƒ² îÙKÊ_‚œtè:1v¿HdšÜ;Ù¼³˜Ìd ºJ`ŒÅÝN\fCêšv}2ÿzÑPqA²:˜ ®@ä[²!ï” D6€åD³ÿ秊ÅÂ/»ù ƒS ¼JÏ$†Ük«ØØøÓmRQ‘ä:H/à`Àµ"Éü]Ó¡ëEB$ºzot¬à/Ò¡iÄ$kìªïÖ6¿Eâ÷µH¦Ž-…²'Ž"weGÑŠäRPrÆ@ô{åÉÛ· #ÇѼPX÷þôyA‘îY¡e ìUt#{„ «aï‚“Í+t^â}'þà•-H–çG¸îËË‘BaƒÜû^P›Ç¬;2»´t@ÔÎË¡ƒæyšˆ(¿¥eÛ¬ê?s `·©©$WW¾¼w˹j/Í)ãí|¯$O]d]·Ø,áå&àÅh¾j'SÅCÎ œ÷._^„r}·V” þ]Á‘Å¥˜ÿ€qõ‘ñŽªôÂ쪠«àOmƒ6Ö™ún}Øm€Ó¿zŸ@1˜ 槓“xÕáÿ‰Ü„Tª¼è‹©7÷xßÛ’›››’œÂé¿ÆcxøË3yÏÀÿÁ‘ϧÞU>§üõ–ü„š‡Á¤ª¶Ç•šùß®a0Õ¾kþÄ[çý+ÈÍʬU£ªhêÿä¦V­ÚV,,¼%::zÅŠªª>á*üÀozˆŸAp<‰öÈcsJyç¬]Û6'MT…'Gª·wñVÛ+öׯìãÙùÉÖFÁMn [ØívMÓ´Ç8íÊŸ­u¬}<°Ëõ  ïFŽü»È˜×ÃKB­¿EÜ%"öæ›yPqÿ\Ñèq÷‹ŸP•øåÿ'ró¯ãx•ðGñZöo¹·ökò#KÂW^«éüaCd¿O BKžžù©Ñ™ãîÍþí¹Ožž’BnžT?Š= ·ã§§$ÁÿNgÊÃÃÃÉÉÉÙÙY÷ñöþáó߂˜Ífa„£ð¸+ñSûØ›@ øÿ&7@ðPÄ*š@È@ r#Bn@ äF˜@ ¹Bn@È@ r#„Ü@ äF „Ü!7@È@ ¹Bn@È@ r#„Ü@ äF „Ü!7@È@ ¹Bn@È@ r#„Ü@ äF „Ü!7@È@ ¹Bn@È@ r#„Ü@ðø!ÒaqqÀ Á @ðXaLæFbšU')USw$-äºÄž\žŠ0»@ð¿çÙ4 ]ÎAÊÞ”ûÒWYÜêÉ-¨„@ð=Æ9W€(uóú¸ßÈÀ%c 9Ë Åé :7Bn‚ÿÏn Àîy3 cDÄ$öÃ¥Ïîz\$Ån`à:±7òàž`ŽC„Ü‚¿¤6Œ3*c‰Ît ’ªÙ ú”KÃ-æE•%hÕÍ-Zè%»‚@ŒØÓ›ÿorCÆŠôQcÚå¾sÞxqãOž‘¶bùn5ÿ'ã¶Ç¿ÜþùZ¶ž¼ìàã(3cWËVŽÎR˳=°‘èâ³[–­ÜyED„‡†¸[ç¯8R´>“¾ìï¡Lûª¯ÙôPY“ÝÝܤüûߣP1è¾íEŠ}_m¼±wÄä¥C¾ßräÐCGOlû~ðï_¾³8ÖÊŽ¬\°ñPÌCM@TtÓcgL_™/6ȼµsÁÑ2V/[¿í×}Ÿ~÷,ù0ë=ì â®_(çf ,Ð{ííC‡àO\9"˜}ÛÖò+ͽ۾е–»é‘µÁÅÕÍ(K÷]»Ó›~_½û²ã×ú3NÜÊz„Šÿ¡Ûpß®’ÉÃÍ@õ»¢Wõ`á\ÀÒ/¾¼–ÅrqóÊì¨6¬èQß÷¾­.®nFE*lœ{"»Èd±_v¤o‚}nìÔ$Š–UjJíž^¯IŒ›qü_¿Ç%7Ìž÷á®uëtxiltºÎÆp}ϼNÍêÕ­Ñ{ä¤[bŒelZù…ßÏlú®M“zõ¶Ypø.‹þ~ØY»Ïmú¢éó/1ÆRÎoz±cÓ:u"z½öE’clT¯°k/}óv¿zõêµéûöílýÎʉ]Þÿ5éüœÛæêlËûýÃMØÕG»N,ßW§JE~me¹ˆ>ɱ[º´hP7¼ÁäåGîSpF9¿M|µA:Çþ°Õvmåäªm‡äy¿`¹¦G ¶1¦[Ó¾~w@ýȈ†-»­Áæ‹SzZ~êÀÂq-û½Îã¹w>Ñ#²nÝúÛý¸ñ²wDDDD£VÓVaŒ!3ºzXdl¶ýCžå›uxwU¿J]æƒ1€Y“¯¾óR§ˆÈÈÆm{o8Ïc—«Öjx÷îéWz´ª1lâ"0pÝ’\¥_ Åž •«dß:\«vø­lýÁ»¤Lé3Fv¯];¼ÓàO2Uº6sðð9ûN¯›Ð¼ûËûߨ÷í•ÜßèÑ}Òï?jØåÓ£³ÞÔ°~dó®¯^HÑØõmÔåÓÞjX·vý–=7^L+Ü 8?§s­Öã\/½7 s݈Ȗ]‡žº•Éc {+„wÌH<: s³ºá‘oÍÜÀ[9(la¢4¾G³þ³vÿÁ}^M=5äù¦µj×{gæ:‡­Àsg2¢ADz [~þÛ^c,öàïí֩ߨÝüCwÀ˜ÑIÓ´Ì[+î2ã~Ð/ìíŸNçÄ ¯›£³'ãÞ8ÙݹdÀ8׎^0ÖÀk* ú–~KR $‚üw4­~½Öq黪˜?¾NÇÁœÈzð­ºuÃFÝÔ4-ùÒŽˆF-R¬:'úéý^#>YÎ5Í¿²a­zÇoeÛUýôš) Úö°sNDc‡¶Šì42“¦Ú×¾Ö¼ñ»‰hã÷C»ùASUN³oíÜõGˆH×t"®kçDqª× ïñÑ6»ªrJØ¢úWëoRæµÚMcsT"úaln¯ÏàªÝfÍ~¥uÓ±kNÝîQ½ÆìؼsûnTïק­%JñÚogìª]ϺгvÕ©‡,¤YZ7oØ´çiª¦jÜšx¾NDýîoM‹ËTóíBDÄ9Mùü»ßlæšJº¥w“úï¯:¥«v-ãb»juçÝäD4¼o³†ÞMPu»Ê³Î}ñZºN:'ÎIËIhÔ á#zÔ¬Û)*ÞvÏèº5­Óõýl"M³-Ù¸þ««ˆè÷ÉC[÷c×ì6›õç!í¼:Ÿˆ~è]cÈ‚«6›MÕ­£zD|²ô*e^l›¥Ò=ËëúÕjöúˆÈz¾UõZ“÷$Úìv=ûl§ºUgÈ ìèÚá‘-F.±jQîØV•ßú=8×9'Îu‘=óö/³çeÙôûêGŸç›F¶“£«öÌIj·žp”ˆ¾¯çkVqUÕUë 6çî»JDë§tªß¬}L¶MUµÓsFWïðT•#š<¸KÿrMͼ}ºn½†‡rèü·½©]˜ß£ÞËë8©gÛU«ñÍþD»Ýž¿µYx­¨[œR…Ö¬Óù½õ6U%ÊÞ¤Ò”midMéR¯þ†kɺ®?<ÏÌkáuë5è6!ÝjçjÂkͪ þöqíõŽ-_üj£®«º=eL‹ݦ%"º½ºvåëãU»ÝviÑkõêÖZ| ùðâ -ûŽ""Î9YÔ¯Ôê'[Æ­_fÏ϶ëôdXysÖ¨˜6*Qºž>6®ûWzϽ;ÙNÙœëu´è·'ÇcñnØ­C{nû—y§¡¯Ñ`(×eü†yïA+&ýüÊÏ¥<ÌŠÌ"ûð¼vfeÉ¢Ôë\/P’dïRåu»šhÓ KŒI2“ÙòqS}_›æïbP¤êF”¼¿3…©ÍÚw÷d$+†½«§œ>«²,ɲ¢0¢à´'"I–&É2c˜Æ=ÇÔ ȀG“:µÞZØ¥ôѯ˿~ƒÛUê[Ãéð‰8ÀoØðê«?"ÀvàÈ…6=:¦œ?tÁ¹Ø·ýªƒäZéõ7:ìÿù{0Æ@/îç©HŠ“Oåm+çÔ3žïX/4²Qóî½ÎÚxc$If²BÌ4gÓŽ χrMµ;w{.gÏ zË|fP˜¢HfÀ@Œ²'¿ùJfvî©RZS/ÀxbéÔS¿[íÖ·‹ H’?MN…º}Ýž6#?6HŠÁ`2í-mÇÜK€%Ç–uóšÑhT$Ó— ÷¾ß½\¿Ãay©À(—7nJ‰x·‘QQ$—ª­„îÛ¹À Ÿ}ÚÍ$K€SÆ¥NŸcc`L’ˆ n~/zÉÕ(=ÐOÐú¼52Ø™)·^®’zò4d L’™¢H²ÂYVÓ‹ù·v1ʲT}ààWwoKÄ])Î]~iP&Én~ÕV-˜SÖÍøà~'~™—Q¿ïÈú>ƒÁ) eóçü·ï= Ætæ6ñ³öFE\Ë×(™pñ*…²¢H’ôè{³<î»Ñ&S|û é·o.ÙnžKJýbk‰É’¡Ø¨/‡%¬ü"‡ãÐï»ÌM:µPÅÒgªŸ+@j¶í2Ο¹¨ƒ1vê§yî]û…0Ýý_ô¢‹AzBïÈVcJ.¿‰ Õ˜mËîëýšÂ¡°SóßpoÏÈTbj¢‹“Wž Cp…r@Ö©8¹rÕ¿̧¼[Ι[Ô ÷@3~(c ^¤«¡;7†6û•`ŒÒԬіÖÅ]AÜÙÕÛaÙ €t*:¹—»¿Š˜=ƒXÞ%=Ýï¤A*ØçôÆYc§/ ­[ÒÃ)ãR® ‘­½½dJ†˜Ï|ÁïŶ¥}#A²e4kÖ,¯”Öl½x50€¸¿› O4€Üý*Žúâ—Q_ðÛ1WÎÝ1ñ½ÑöÕ“Ÿ/U0. ¾bʘ¯7_ˆ¨WÓÓÙ›b–9×½½|ï»äŒ±…£º^(ÿƉk4¯×÷äÀæá~S¿ZÿY÷ÑŽCJóÍ;s§ƒœhµ%Ä¥˜Û—1çdºVð6'ÆÜÅÐYK“?_©æ'5kÕiܦװîõþ¸fÇÝMóöòv\MÁż֤%AbÄ$c^½”d¤áa—à!5—to7¼kg2Ý`‘=¹âš?”S¼„KVL àù°=õ¸ô·â^yö~eË?4þqùV¶vþHóf›ÿ䦧ùW½)²©¸Rp.DúŸ‹=È!®²#Ÿbž~9êAØâ쪛‡«äxôß\¬£Å6 ×ïæ”ô)–o“ÉÉ5G7µ~øõÙåoUûeÏù¾£'Î{Í€ÒÞe‘‰Mwæ¥Ê³Fï?÷½ÂÌ$éŒþ…QéÇ“¥“ÉIÕ-y¡©<+ÞNzj¶–Ö¶ «\Þ™ÁúÇA1©„ …YùM¯ÇvŠºÝ ¸,Û¢:…òO›öÅ÷=¾=:¬®+€ýïvOà\6âyãÝ™§r¼¾ÙòâéŒFgÙÅoçæeE‘­P-¡Ìä„L'¿R.$ÿàÿ2ÏUÔööŸµH{þÝ{ÍЖvúÇÍG—l‹*ç?wY}¾½èWgï~;Û Ý÷â IDAT„ŸÞn8`äÇ3ù'Um[NÎkÞv»5oHLÏåd– N.F{f®£mSÎF¸xU›8kÕDdÚ²~ÚÔ×ãrgMèâùs5›¬jÖ½¡íl«ýžÑˆþIÍÿ3!QF¹iùß­¹6ÅÍü¨šâfR,¹öÂUî!I{:)Åö_?qh‘­©Gþn”–ìÜ~f6ÍfÌ\%É¢êy¶âjÁ,Ip6ÊV»ýž u-OΚ óõˆOõWÇŸ¹Uö“HzòNEp±rÈ`Çí‡]¹ÒØ­«·ã —H"†ÿî`™ôX$´lH¥ì[w.åc`Ú…&e+mÊtz¾C©C?/'G3»uÆØ£âÖ3‡gÏrQß̳;¶ii æ®°qúÃØSÞ…T-Ù9Ö‡8“¶„E§ròäK•JUAA‚YYs`W°&Í8Åt0 û¬ûš ß/ÎiY ÿà*jZòÉä¼QÒsû֊κ/è¼åÃ.Ý}iÏ¿ÕSîÎñ.UÃ8ât@W39;¼~ë]óã̺JÖwÆ5@öôSRÿ½« ¬âèÚgöJ\!¸, Ä AàîîÅi±R ¥H[Z(…BqwŠ»‡„ÄõºïÎù~Ü’pC¡X?Þ}þ$»wäÌ™™gfÎÙÝsí¹ž¨×õë˜*O†ÏÜ6zÙô¢®_¸}ËØ®ôóÛ5–-ì™òÞ®î»liÚ²Keo/ýM4Ȫw:å­ðar§Æ?ïýÍâ?üõ1•R®céIÕ(°­yõï%Æ·ÿ]­R¥eKvGR»nDâÒ=Á4ž¶w~‹òd\òŸ‘£¶››•<Úp:÷^¿,êYíßKȉŸÇÌùéRHß=ؾJ†(°«sõïÅ7¦aQ£-ˆÆ§ ?Ǫ¤¹¿`²yùξõ!Å»?w÷”}þœoý}¼V½á}Ú·KÿáÆÌ?÷iÝÇ‘üÿ¾lºáÁƒÇü·ŠyðàÁÓ äÀD;ÿ$4H8(ÆOuHKÉßò #ø sÿ?A7…ö£w´"™Ì¥‘ç&¿HG]AbÂsösY¥ôñIogˆ£i‰‰Ùj.'ýyf¢ŒvrÉIIjWz§\¨„WQJÞß GÕYÏRrXmBb ûn%"ü“ªüç)™J|çáaÔåéã]aÖ¸‰€²‚»OñQ‚ˆÕ DÕ3"Ž ÂÏ29þtCÛ¶Sö;~N‘²¼{dJÉ\OÎo2~!mOïnò?ݤí‰ê³HÿVIÕóúöûñ®|ã‚ñËþºh: «4 ß½,uÉ™MÒ~¾hû-B€rcN«Séª÷ÿ¥áîêŽ#7ÈŸõ8F½ÙCABó°Ù†²åˆÝ9~ø’«ï.–rÐÀ¾Jj€ÇÛô‰yx˜RæBAΨ‘¬È<}òH+¹ )8´í ÃÿWº)åÞBÄ×#št£A¤=I#ÅWH(¾Rb5\yBÍK.¨^áíX;qA•+Ö´bÊZ‚ÿY6-z-QÑî Mf$ÿ¬°^¹6º¡3kZ¤½™ÍuEŠÿJŽ]Ë·¶²0ÞÙyAcaaaRSe{ßä“DG÷; ‰I͘¬…èåO„B±àÍq)II¼^C)áS"š”‚÷°šZXªÃˆŽpv÷®ˆ5z‡Ÿw2(̳//jÛ¸ÿŸA{‘È'Úé2ƒ6l_YM‰GY²×Á¹±<)ŽÔøó—9Öy@PØÈg3Ì*BÆ©GšUûwùÛÒÅã&*- &ŽÛqΚ°œßûLZÏTqѧ'Š¶Ú¹nŽ wg®Ë"ëáuæÛÖÍŠ=Y`±cë¼ß¦ŽÊ²ÐÎ=>lòw½ëä„5j6jwb˜¥´ÿ¯¨&­ïÂéÖ?N ¼!ªL»áél}âü­>_­Þ€dœY1tÁëÚžÚÔ®fàÖM_Ûû"6"§š8tÀµçªòD¦¶tû~çϸsîˆïOÙÕ®§ÉznQ?p熯ˆ4éH·‘K%â Œ$µªg÷k§ˆ滿é·ë¾^ÿÈ¢nÛ­»–9Ä]1~Ù®òuÝÒÇWi5të×ý¸ÇÏÊwìlw÷¸}¯NþtE˺§Ú;1©a)%§YÜþÈ6/ª¬ØûWŽ³ÿŠÏ±*X&ÉŒj«ñÜ¿+Éöå7¹[×¹züýç>ƒ—¯Ñ ’·98ÿuKÍ®®:îüS綫lRnœ¹T8rÄøÙ«VW-#Ø.§ËŒ o-*o•’œÛvعƒB€àìÑýÎ=•4¬iŸð4ݯߢ¥# E#£O<Ö6¬å(6¤ŒX0!Æ˱Ӗ¹}\!šNÍ=ûýz¿iÞΰé>¼zœbõuZ'‘Õ¢ôè\§îƒj0`¾pŽX3ò9öAÂÇìœÕeÊãÿóû‡Oþù,æÝõmt*­0X×¾~C—Gƒ¼ep`ÿµ7Lˆœu•"¢â¸·k—DÔd…ûøýy7ߘ`õ€^ßÞ¢ñáâÆ.>‡’XDD® 4°éí4ên4smSiÉ÷T¦-Eç§9í#º7þŸ±}ŒKô·ˆÈI[xùLÐï?Ä¿ÇWÇKºÿkÿ žßÿß±¨w̸_Ó.ž9ýD¢u“<æÜP#âÈ(ÿÅ»÷u húç“LúÙÃÕûû¿3Œ7;„49tW‚}=C/dFRÕ¾ÉÒ)%ÃQDš—÷<_[¢ zYHP@×EûW›‡ûEκ†ˆ³ú´^¹ÿ¾1PZ´Ÿÿù\="âóýîî> þ–Oí0ç·k&ãQƒªƒ¿ß–ëÙˆˆÚ¤po¿“¹T{yF£Èeˆˆù÷ûEä¨æÆwžÍû¾0ÆTÅ…4÷¾™®Â´n.>«®)Œ…õl¼é|"f^þ:°õ‚7Ddº¸¾s`Px‹ˆ(½±ÑÕ§s&âóÃ}"§;C›ò·w³Ð$æîŸà<Þ¨ëÜý›ßHUÝûmVó~óŒEéb—y„ÍÑ"êU’¸„”ÿj4°Ï ªÕ²± z#PP¤P’ê)K Ÿ^ r˜Rœ>ö¬ÅàîÆǼÍ'W Iz|O\¥bXÕÂè6¡©O!t@¤›qG\Õ³Š!뀞‚zIú}µ…¸0/....>±~PDÎùÍÆ´­j ¨˜eZ=è Xd"Ö©ßÀÖìµEœj{v0F­ìQËÏÖä<¿Oìm#j™ÊÖ.:7î`ÉÓn÷w}F 1Òq÷Ù[w¯‚ŒÙÌÅsœ²b÷íÞù×îýÄ–IK¤$¥ÉƒC]Ñf×Åë=:‚ÎÂ}phe°1·¶Pªµ._×­QMŸáÒ¨ñÃë'J/)W³~ G³×ׄÑ}CŒJkäWËyÇêX=°úBMDU‡‡Ú^µ=J¾orá3¨žJY v«€(®}òÖÕðò&¶@»7^¬Ü*„>‹‹‹Oå™[ŸŽÏB –Îý›YE²°·VÉ¥ g9@ÎPú(Y¼!Ô¼JLE€o»úê„i°}Ó]‘£ÍЬ¦·‡A¾3^{ìHRƒ.mmÁѽ«€@êÑ¿íígå@]v¼ÓÔÞf"Kûúuk~3cBÛÄL€:˱#AÀ™ -BÅoW‚¹¢àÿéa @•«1ó·.uX«UŠ„ÖÁöÜÆÂR­O5FÙ1Œq8 ¥ùƒΞ^8ÿÆ©BQ 1¡… Ø8&o{RGFdþr> ×)ÆšÂìVæÖ:NŠëAáã @´Pûܵ?2”º¶‚Â<…&[EÏÀVr×Èq}[×t°HÐ|†'Õ²––b(Õ™‹Š¤%D¡ÑÒüÔÉS§S1¦\ãwP±¸„ÒÞœÔò¥ÈÖB¨PhLëŠ娕HPú¬Œb³”T•²{âÃCFÓˆ œ“ƒ†Àˆ„%øÖ3 |­¢ôú|•!CÁT´7+"\qEk.Cb`äÔÁÚÜx0‚Ân`õïZ~ãŠÓ!s|w§i×7­÷Ÿö9Mé #ƒ:'ׂŠ€e3ÞÏ@ ƒŸAs„nê:jŸkIUs±:= ílÊéôRJ€A¹Ò|;s'ø'Ž0·¨„Ù´c¯ƒy_ìC-­œXNÆR$²l+‘±iváêµ¢n¢®¹ûIrð°$”3èX¤7ÒÀjÏÚÌ@¿OAUl-”y$VtZN`fnjU¯è`OœêîÝõsa‹ŠÂí}øðfZy@-)U;ÙÙ™ö˜U äJ-1B Z5Y¼ž¬Q%Ñ×{gECñ né÷þ]§šó ¡5f)-Û—YWÄ3Ïe@•(…V;: .ä+ŒOΠ~ùsd»~ß/تJJTVáìÀðlóÓ›0x7–[±ˆÀ  gpk€€øúŠ¦Y«nÁW~˜ €ÀÄÞá‹·]¯Ú¤™ejÚšÛ ¿ëÏÃní†BYON0¢WêlkºURk—Ž7îE¶ÎŒî·ø2–¥†!¬VU4Éþ>z(]þVf”wnlW ]sMdÛ6ìrŽ€¤‚N:į£¦v0s—HlO€ÜúsÅ]skEž ‚K­j¿oÙ €ÍnÓ²åéT¥)y¹ºa¡f.76mΠÖËö<{=hdü…#—äo·t1j–{é„¡¨psƒYsW\åùØ;^žA&"«:ÕÄæ«÷Þàß:VcBîvSzHv|w!«*:GEÞHU–)#DmÊtMÂh3ö¤²I¶¿¨Ö¸}9è>3æùº©9HÆÕCÏíûÖ3kßÓãùÖ_9÷·}U|"›ËŽ˜´}Ò¢NÆýž&÷ù‘“x·”i›,€²w_  Ã[Jõ w)Jó9cb>HÃZø¶¿z7ññöòµh1~æ€`VkßáÕqK:‡„øövûËâNUP.—ŠV*V§T¨ôö-Ûûj[»û,<…ÛmdOiîØ¢¹ÿu›Îkgù‚Ài¤òW](Œ…Xúö ³ˆq÷·; `þ¸¡W^”~”@§–«4E1§9T®BWÚ{dmÆ=ƒ‚Cü»V¼fMŸšXÒÓ\3löÌ^®á>¾Þ^Þ±ÖÑëWô—óßÉ»Cˆxë¨K–m7Ìíût]§¹s—þö“Kön//_߀îQV¶­e œN*W½’V!׳,\ö\ùdy´P°_ó ¡ß„ 1õ^÷˜;zű¬Rú•Ëe,WBi0¸k辯…õŸB‡É=ÝfGúE/:"Æ`Ýh¬ÇèÈP÷€ríŒíPÛ´WoÞû“Í…E>>¾M£g\²ÎÏUK‡/ÊÊd •»l^3ruŸAAþ¡ÚŽ\æSÝh‰*•r­ž€ ®]ìôg½¼îf›~B^ŸƒÞ_mÐ',4 ÷·¾ýþ ÷”å‚û† ^ukå¯;¬ X.œß¯VÏ È36@­Ð°€ØŒ˜Öî¹Ê²}Mkã¶7ïÑÙiKVq<Á”XM€‚úÌQÁã'f(TW¨,#æœ@œ;y†X ËpŸßÓNék—ôµ4¯nQZ, ¥¥²¿^2}™ ‹B‹Ž¯yD^&0þ-vaB¶lQY2šHY\ÚWWôÍ9Ô™GË/éD2­4Óå<ßßÀ¯—æµ”õKqQ雄|«Ò¬ïegPaRlãÍ ßw^p¹˜ ì˜N¼ª”¦ô”ê¨>Ï­‘D Õ]™m:± @÷ྞc‘ã>½\Æ:]êP`ÒQü)na|£õ‚OZ"[‰|/ÿ%¦Ä0þ%¯ËaJ¶·oÑ?¤4JûJòæŒÆ÷™=8 ¸„”¡´²(iš¥ÚôÌRúSJ(´tª`/Óê"oòˆ:iFžªtFDkÇJ¶Š'¦î™R¸$'=åÎá1Ûu'®· F¢}qS4x£qÉí K@H8‹Ü<eט í»˜×uáN² ŒvË«eßꀚ}zã5ÿ4æ…´cþÞ9ºþ•¹:ûl@÷%6¥æ9r¶¡+ÿšîö1Dàî|1ý‚XXòœÎª£¦í^þ}JþiîàÃOÉœ7ú:!|xû—„hÐT¯I2²Äb¡žGÔ95VÈÍ°X1_ŽBsžnx¼ÇɸÈãU´ÉAÓO£?øœ}s™ï³)^2¿“yóÖ9Dš?|Œ&öv­[7 ˆbDîÁ‰Ÿ¯ƒr'M­ôíR`>õ+“<ÝðàñÅÙ‰9¤ªÆR£5 T ®L‹À€€ÑT®hž#á:¶í=Ä«˜ï·ƒà Ì9‰EŒY* H juß,5h”ÊÏò9žnxðø)‡ÃPÃ`ˆ ÄNKçJ„Œ_³Ïòè˜âÁã‹;L½&ÛðïLñàñ¿º¹aD!<Ô\<’±5—É_\ëg18~¼w7ù8î]\ éƒöÁ?¨åÃèçÍ…¿³š?ª^jFÉ.¬Ža˜«ù§Ž+78ͨ’ª ËŠ–õÓÿÛMâ£ÇúwÏ•öô¡¶øÉk;çø„÷ÒÇ}ß°NX&5©5Bäñõ]}’Uì‡äªËÛ±rZKÿ¦>¾>^Mƒ¦|ûG¡°†¸O o]”êŃ-KÙ·bd@¯i’ Ü\;Êé?ËJY<ÌkÄ÷±ïÐ.Vš—’H¹°n{ng¿Mv#“¦Þ?ìí9yßÝWÓèÙ?–„4óöôj6í‡},!e™IÚŽJ £¯U&Mº¯(Šá÷üñ#ÝûÛ 9³¢eÀ°c„¨@ç_ÿÎx×~øÄPvášscª~ýîË !‰Û*¹Åè>&Û"A¤Z%„ (!,5 ¡ûó9,ßÈq½™Ö-×Óqô¤zÌÀ?&ùº)eBÄ×™I#Qa`QP~5d¦´pÚ–^LŽWDÐ-:>ûU2€Æa]ëŠm„5º»×ª&fL.)D`gk˲ª{%ÇK™K _$÷«±ô§¾a¿>©yæò[7oݹqÄæîO=z~ÒiCç)Lêàµrð¯©#næh ¢WŸšB3‡F½k•s7¨ú,,m-Í…eÈ‹&ȆÀÃý¾ÛrÙØ[;±€˜,¿t{ ¹ôÃþÓ7¹•+o.Ý„”¿FÎÚ’yàúí{wN3'¾³5ýexÒÒ0b{;kRº.nã˜áñzãmÍ‚!“óà  ,æ/})4·±±!À¡‹ ƒ[V)òż¹#^ŽÙô!óäeˆDdiocþºl¯W¥âÝ Äö¶Ö%åÆ·næÛNMĪ܌¥:!':œóëÝQd #ìf=~RÕÞÖAŶ@ÿiºABHò¹ßbZ‡†DvÛu;ƒ‚H€Sÿ0kXXËÐÈÎýÝÏ"P/‹ MÊÍX4<&0¨å˜oþ „ÂökÛ&]PÐÅ?`]"€]+g´ ‰ìØ÷è½\B‘n,òé»1?îHLdHXxôöX !drtè}Ô÷ þú¾ì®A>Gâ ºŒd•["¤rÎåÖN ûjë³Ís‡††v½¤ÀPÊðN$ñç‡w mÙcÄì%D7>ÂsÕ%ÁÂI5­èw{â!’‡‡ûGG„‡Ïøñ°1œxê¾!­f^Þ¹tDó¾+²Ç[NX:šo€Í¬_Žíüc!ê.­;3:6÷ÿý!NýÚ­mxHp«Q 7±„BTç§û ß}eû¼€n“ÜœA–ô‹´é"—pOìÞQ¯WëýûY¸¿qvà€E¥WQBtO‡wmÚvãål¡àU𾽫gE†…´îÐç`l6!@éß)ðä½äÅ#b‚BÂF,ØÌ!Iúÿ矞^Ù¦ÛPcN‘Øðóô¾AÁ-ÍÚ@!Wœ2té3Ý IDATëáÌ-*G>º­¢Sl§$¿æñ·¿/¶°Y|ðúºžUàüܾ¡ÿ ¦‚ê5)CcÂCC[¯>ö”òSßå‚ÉmC'žMß±Õ3FÕ+0hÅ’whTóáŸZÕÿrWæ jrïÛ²eËÓ‹Lw ùëJ6!HQÄÔ928¸Õ”ï÷;4ïب  §ãÿÞؾUpD»^'’ô„h»EFå 3£[øoz^ö<$‚”»{¢#‚#:ô=›ª'„"!ä鉟:E„„†FÌ\{Ä`Ê„^Ü8'<,´óàÙ™€¨ î¶l‘§¡ÐÜ{~!íSõxvv¯ÐɾgdÌÑìߎæn1^è¨H̙햭¿¤?D´ÎzZµï|ì|Ì(!Ÿ"r׉Åygß7á}_¤¥¿xÝÒ÷§ãÏæ i>rã¥ÌìœìäËÑ>ߟ•¡^Ökñó<©Bž97Ò}èÖ4DT%n÷v~"SjXÍœè°î‹÷ffçd&^îìÝxõm"âƒo¼ý‚þzV"“§?ý; Y‹ «K=ÖÌ-"V¢Tè)¢|íÒE²XV¯ÓsH9ž£ˆøãÔÖþ­ûĦåJ%ùûfuö¸Qžà㚢2 ä¸³×λiYYY÷/jÐ'âc¢Ç}[xVw5Ð¥ÕS&_ÙØÂ?ü^RZvvÖúñÝÚO^ƒˆÙ'†¶hÕmÓñ[éYDüm€OËŽ}NßK/?Uþt“—g·x™RÍa~ì*O÷ˆ;IéYÙÙ[ˆ² ·fúuX¾éTFV®N’Ò±…ÿî»É2µÎ Ó(r¬NOÓ.í[òë¡Òª×$´ñõ]|òIvvö­?çúûûN\wQ7?&¼ë¢Ù9™I׺x{~wCƒˆ½:·è8%1O*“d¯íë×fîYΠ[=­ë°¯þJ¤HÙŽ‘A-#‡^KHÏJŸÖ¸Çú8DL<»{ù棦ÃSnA‡V³Ý/ÔV~B‹€@IÎãyã÷8rç¥DcÂøƒ¿~ûוҒ§ïñðì;jù‹ôŒôø¿#¼=ö?Òêrî…yžy‘'×±Úçû}ÝÚÞ—*•”ÝÌ?øÇý·¤RÙ³+;}ý[gjX“‘‘>ïѬé¢ÃÓÓÓO×Ï«ílâ¹5"ÇŸBÄ>šm»˜…ˆ™w·¶h|+>5';{ÓÌ~‘£– ¢ìÜh¿ V¿¿+•ÉŸÙÔ4¤£šãq›½=ºÆË”jÖôà×\šêë:cõÞ̬¬ç÷kš$Õ#âÙM3‚ÚHÉÈÊÎLÿ®ëˆ)[ñÉѯZøw{–š™ù|ú HïÐzÔ h¾ôz¶±´‡Ç¿mÕa ¥wà—ow^{ÿ¹¹)gáô„î…ºAÅßéûf$ÇÌNê½üɵ^B)G 9Dú)bø~ºáæE6šqRaŒáœtçÊõ¸ôüØý>­:ŠæþÕ#:[Ž¬"4Ø×ã\ã@¹¾±sؽó{»Åd!*Óoú)‹Ê}xpND×Å”">XìÒ¤wŽ1N¶AÙ2¸ÅùD)*.7sL.ÔºÔ\;-¼ßä_ Sè.ù7ˆÕ£½2O¢ED½N§Qg…7or?‡ÅÔcž^3)â½ïz·ž·Wttu@^Têÿ†­ž æœÞ´ùeQqjn_·¨US—&~ÝŒ\¾î/µ1yöN/žyˆˆÈj¤JDDN—ui»oÛ^ˆÈÞþÊݳk–16+ëÜÂÿxŠËc^*xvÚÅ­MÛt™`z”ÇÄu49w›ûûKŠÒÄŸX½CìÕ1`Ùþ;Ƥš;š{wÌ£¸qNQ‹ö!"¥lÇÈ€µçŒZŒÿ³Gó^Û¸7Ç/N7ˆÊô›þþm,øûêÍ˧wuðq_p4«Ìpãé{¹G<( |>ªG‹>CÝóð&7•QvÆ×µ}*""ÊNöôîWPXˆ¼·¯ß¤&Çbò¡U>1£‹¢øûø™tC×Æx Üù2{|P£ûåçÇzùU³Ê7n–¢å0g·—{ܲG¿æÒTwÏÎiFÙ¨¦·ÀŠkéˆìÄ° NI ‡ìxÓ-Ÿ ®hç:hW¶QºŒc«\‚j³Ž÷Ž\¬CDÄ5=šÌ8%£Hÿ)Äû[ Ç]9+'?‹FD䨔˜•ÙwzJ§É“Ô¨0RG9õÜÿŸá¹SEQ¬Ÿ\®Ý¤ym€Ç§3¬-í…ˆHTuª•¯N3Æ+[ˆ¦o¡X T_Ü®–¿×+º“1¤µ^-“så_•§¶5ì_Fû&@)–0$Û0—e­«x¦×*g‘ÿB_ž—êÍóÇì¼%«_§"C8 e(T‹Ô`æ¢éëzTùþTʨ¥±/D?÷ë´ÉX§Á¬+i@+û˜ÕÛ#g÷9[‘tá왃û6†½váàwÅUL5é Fv~ °«ZÞ–ª¥fŒ•±\y7Ç7GK/#Öx®$×ÚÊ¡ð@ àTÓ>ˆVþBпH\©µ¥@¹jå*Ëb¬ëˆ„™ÊRöy¤Õíl {ÇÒœP½)¿AFYýÃ,gkŸeßÄ^9wväOE½öZçX8Õ,20Ò7#¡•½í 1«oOdhÀÍîõdIyNå‹bÚº¥©Âä7S)›uúÓœSAþ…¨@Ë50/TC¹·³œ°}*Ê&t·‡‡j€Ìg™f}Ý쌓l]+™g&穦‹ÜÝÊû³²s%Ž½Ns¿iu/}²¯åí-Éu϶²}yæßÞšj€%Ü· B,מlN­€‚Æ3ói¾•þAèFl%棫ÐÍ&˜qToüâ;! 7è…ŒðŸ¬zÀÍ c{`ÿ¾×@B š"Ujõ¬ÐLô꧿çûKÒôÆ¥É ‰ðoeü¡Í°‘û¿û;ŽN”Ôô÷, ·pÖî›P³$Ë> Æ ”3(*;{{D°©X§m÷:í"[4‰§×W9¸zÆ{ÿxfn Hnìj=‘,Ì¿ëj#¤hxéò4hôF5XîÙ¿OøÚàcYƒÑƒ„TKQ$ø€ AlYÄEæ}+ûºzrß8Ž‰©±`:µAM mT©#–bÓfGs±HÏ-£…!L{k!Xµf½w©Åäx-auE²¡ÚÖæ €ØBȪuEqX@§ç„b¡@,D­ž0€ WëŒlB‡µ+í¸ôÐœ;YË?Âêå,ú ÖY˜aZÐì“þ™!¢vh¹¹ö´ D(^ͧˆËðALÅ>ÖW¶_$€?'÷Žùz[=çÊI¦¡°=÷_©Qµ¼)rE»ò(§|§1ÞÊN¼—«Ç7 ÕW®$–eéëf|F”™pƘ”>9žAz”•?16ôr6^džþVŽ¶XÏ/ržúyníq_•°mlzíéÂÒÙœ³”vßÞ?Ô¦G‚š{¹ÿ’fe0b±“¸¸ËKÿ4Ï̯­»ñÖ™³Ìe褊r,Wzý¯^¥º,_¢,7é÷*¨µc#êûYêBZL‰}š£3:ƒ®>}jL+¹{@/òr—tÈ™¤SõâëC”€Ð¶‚—þy/˸('Ü9jcëáÇroµ‘›O^s‚(ëd¢q\hòoèD­Ú˜¤<·:YñÏe„Á„V.畯§³jæpfÍÑB™¸ü3ÇþÓ32o¢ QιÇFeë•×Tتž=@_O«ëîùD{kOª¹·½Y€ sýà]W.>I“1ßÄœýýÈ®S'"‡ ðJ{ãóåÍ+ÀµÜ½74—ƒ•¦T·jHàg³þaóë=sɆÎS:½ð¯É&^¼-[÷w/p"+cÊu‹lÛ.ªMƳWò*9¬Òt~Çú•D)㇌oÙÁÆQžƒ;µõocžûèÔÔùûO×/«V«šÕE™Nðï6cZÒ³e»¿\i×@\ê0E´ÚðnãÚ7s:~èpĤ••‹ýÖ»ŸÏº1ËgèÓ áL†ëk› V,›:÷«:ÖµňgìÊÞx ®1iÔôµ+#w|"¸¾õÅ“Gí&…¹ŽM¢× 8Ó;"Ì¡bõÕ2Ÿ'dd䵞ò‡àäâ$Z6aظÖC—Œæ2xr7Ë.Q÷NínÖ}´,ýÇ…k7OoV|»bVGÈ.›2ýbëž‹‡oʃßæ¾dvqóœâ£É¾Id»y"c‚ý]®œz\ë: 26Õ~ëÓ¿KÛ­ÚZJžœºžòÕžS €²Ì…߻޽èWEwðÄ•?¶¨d[éö‰ß¿ZøtáÜi&Õ|}ÝÌ÷Ïý2£-Ò§ Ÿ£‰’d:òû²‘‡-Ë»F,Ûeåî­:ö¸×°‰…&íá Ão'§˜/8û}ßI"ûZŬ¡ãüÚ[Ô˹ª(mü  A½f"„qœ×½³w« §§÷²ÖMB*X˜Øÿ´öé3ÃgTDû€¦n÷®]¬5dY°5œ­ž°©¿, ëÕaàéP‡+'=†…µlbZ¤ò*ˆžM6>|Т~¶&Ö–’úA«{w¨–|~ŸTàѪ¶#Œœ5/´ÇÈÁ™],s>=öÛ½vmg.Z=`â ü`'Õ#µ]y¢çŒÏŒƒ},ƒŽKCo4 ÆVŸ×w¡¦ýÙïz½'áÔ­âL’§U‡ì©¸­^_Ô€2œ >ÃCwä) Ev\R¦ˆª;7(oi4ÚÌ”gÙ¥À̺¶³³µèƒkÔwµ3€2ûi²¬œ[}'û".-_ãTÇ­š0/=)=W†Œ¸Jͺį̀Ón%rÞµ ÷àÁÃêõ\í-„²ÌÄäl…} —ZŽðøõ›”³,¡ÃuS[>©±rA´Õó<¥™SCçjpšØ‡Ï¹»› Hî‹ø´<•…}ņuªHSã“r4õ<=m„{÷ÇŽ3rÏ_ B j%qÏžkX´v¬ì\³°’g³l7ªDŠ*•å¤¥gçë9ˆÌ+T­QѾðͬä'™R]%g÷Ê6LJÜc‰Jo_¥níJ¶Ï䨅îu,î¦0^î5ŒS‡Sf>JÌ;ÖhXݱx[t’ĉ3]·aqée—jâŸ>Së¡J=W’§V¯[Õ€äg$§åH‘U®Q·¢½ôîÐ<ú«½å%™r½M¹ªõj8!"a•'„Ö®ÎOÞ¯X«Q9k1hóããrí<VT¤'%©„ë×(9É4÷ï>¥ yùL­Ø¦¼KÝj •d>KͦD\­v½rÖB¢Ê¸7bÍ­K–(A—wëI~“Æ Œ;¼Ä§÷ÌêU-g©“¤>}‘oQѹ~%ë‚ôg/rUŽµÜìoOð_ã~kGLÜÓ(´rvi`Å”éi%„¾Hˆ/Pê,l+Ô«S…eøoóàÁƒ§>#O7o ¹Dʽ{.•TR<!äÆžÍÛôÓǯqoÐ:‹šŒNJˆü™«§_Šš%äƒNª>»eiT˜¿¯¯oó 6‹7×ca 2‰”¾uQ¥DÇQBÈÁUãBûÍÞ\ܤqg…鶑ܨë’‰¤T[X•DÇÖ©‘°ï= !I;ººwÝN™Ù§ñÌßâÞU{Ê’Uªx¼¿¢ZÓ1ô»„Üku=ZæB?yºy+hFµïŸ÷ι _EwM-yËÅ¿]uÆLX¥]ýÊN²Æa,--?,Õ€-CBç¡ÛŽž»zõê¥ã Ìé2`5"(¶.yÛžîu6M;U¡]½Um혲Ûbe¢-t×Èg^È€[Ö¥cÂ+BsK !Ìßxy~ßzï˜[?½c÷ô7•.¶²4ûWDÈXYZð3ù‡nrc÷ê߳ǀ±§žI‹¶ÜÜÖ•³{õè>`äÔ+I2Dƒb`¿Þé 鳆Çté¹ð§CÆù0i@ç(ٹ˖ç§~_ѯW÷þÃ&_NT7Éì½;NÞ©J½8¼Oמ}FOÐÀ7C;Çêõ“ºvûበoLŽg“ É–Õé@Ì-¥õÛ•'ðÇ×}¾?”vàûiݺu7ÿg–Ü­#hÒbgÒ½GÏñsW+t ú¶Ý|G÷rw¿|Zï_Ž&€6åâÔá}»uë³âÏKÆŸ2OÌèûí“¿Ìž° sÇmfƆY¶f"PÀXVýzóÁå b€hFöí›Kr†vê¼; óÆÞ±ûtïÖ{þºýFÝ©¯/‹™}üþ±51£™ßå·X7iÈ”7ÄÙψs‹Œ¢q7KOw®ì>mÉÕ≃zôè³öð=8=«ó¯É°~êÐénn}N ³ºw_«˜>²ûÕ„ì _ ïÒµçܵÞpCDºmåìÞ=»Ÿ¿AR,ظxø¯ÇSý~ü·å}{u0b굕Q¹úØUÑÓöÉSÎ ëÝ¥Wß‘'“t0H—í„®ÝÖÆqe#Rzoì€î½Ž9÷\](Uÿ²dZÏ=›}?[PØ… §~اǠq‹Rµf€†Ì!½º<ÍãP'é×·ÏýlÍ“íßvŸ¾ŽŸç&û˜R@) ÔeÛ?Ø™üýñôÔÍ¢ÿ¾zë楣Í}¶^JC”MëÐû›m÷=¾s~g«&Þ›ï¨Q/ èÐ}êµ'Éé)÷Ç„ºO<˜ƒH3ïlôöˆºšü¢@§_3¸]ûI?Ä>||ûÜ®Ö^>ÛâXDÄ_{¶›¹|krZúý Ûü¼R4ïᮦîáç_dk(¢äë©ãn¦ô…šCjP©YŠˆ?NjÓoßõÇ©/’ÖnÛrÜ&DDy‚_hŠÊ€ÊËþ <Ö¾úàÁýC&ú¶+EܹdH×I?"""Eö^K×À»j̸»³™Oà¡ ·?Œ]пm·¹¿#bÖñ!-Ú ]þÛþ[SÙU]G˜~+1¿¤n¸Ôk½=cn$½èQúx“›KðáK·>¸ûí¸ÎÑãÖ#¢þæ ŸV½ç.ÛtûþSEê½öþþ›ÏǦ(µ*¹–"«Sj("bòÉ-S¾û³´ê%7=}‚úõyöúÛ÷´mìºá–Fþü^T@Àogo§K”’¸£þž!'âS²Ô\¯ŽA¡íG{˜˜šüx^gß«n–ÑŸQ>»SÐàݎݵ|˜W›‰ZÄä]}šö݉ˆó†øÏû#Q·j@d‡©kc>¾uvG„—ï_ "Ò»ó½ƒÛÏþn{JZÆÝ¿·4óNSÑÜÛ›º·¾ô"Çؘ׫|°ºq‹ÖCF-¸{ïÂ៚7i~=U‹˜=2¼éЕ{<~|ãôï^ÍÅéQñt“¯gèá+wݽ:gh»fíó(оå¼C÷ µ’°×¿y79‹IÇ7OY¹y˜‡”²,gÐs˜­Ïß—ú#ËR¤±ÂC7ßtp™| )¥ˆwŽîÜwõ©ìÁa¯–ôˆH)"îùnP—+Ñ  Øö0‘"ⵟ;µºŸ"bþao·˜,Dufl³€ iQ±±»'µî±’RÄ‹]<ºf RŠT¯hÜâB’—›¹F&#"¥”¾š(űvZxï‰ë S¨ÏøÕy E7T+I~‘ˆ,Ëêu9áÍ›ÜÏåØgûÜ›v)@¤ˆñ? š²×ts¼5»°Pýu_—6‰ˆ9'‡7õë#7–N‘Óf}3sL W#7Ÿ áSì:zIgLŸ½ÓË£gž1«";%Sƒˆ¬Í¹¼Ã·]ODdoåáÑ! ‘RŠ¬¬s ÿã)Òצ#-úKKÑGãÀ²Â«•ã‚Ư¾…¬¼K@ÀÑ$ "¢ú~ {Ë'±WÇÀE{nËÒ$oöóŠÉçLw¨äÑqï–Q†Âz[ܯ-E7ÏÔ©7š†ªŠ²\ß6¾]ßï-tõìžeì,48ÐÿZªå盺¶}^ö¢V»¸†Ýa 8&:|Îî[¹ÿÔ¸ÍÀ—Í_3µëÐÛéŽ~MÛ}ßx;ÿîÁÆíóe'§»µš£GDÄcS‚zn|VLy”ç–’£‰R¤z¤ÈqÙ†Ô¿Ò¿›>6µ«³>*Ý?Ä)'6Iض‰ MÚtmðäôY[+{¢ÑZZ½R½¼»Ï@ZÓÊ €€ÈÜŒpZ4^Z“…@Ç( @´Šµ2  up.@!„Ça 3f±­~I#kWÕ«0…E}'‹œä|p³*Jl&¾øûÄn•s²%€jÊPŠçèÞ•ç,:œ¿²½ãŠIcÜHdž>ð4ð&ëR´ •ý-_Ö/®0kñšY‹!?ùþþ½;ÿ\3kõÆs»ç ŠŸ] »iN×Sq*;k duæfÍ`¼*”h‡ “èkm-ÚŸŠ¬Ým ÿš‹‘Ó•Yek;U6–Åعˆ…ëZp´4Õ£9/¬-ìˆHëÞ£‡@JÉc¸¬ YˆìÈD#ËVd…õ8Ö/÷²³Xî­ å¬ƒ‹«ðp°8‘-KÑdW¨èÆQT¯BÕCééúIÄsX£V+Uà lÃç»-ô>ôtvçÚY+Î2¿.v(\¼ùuÃ?¥THð´zï©Œ=`† ®d r-ˆ,>¦ª>ÝÌ„Tk‚€Æ‰!`„94Ž,å]^ú”È„„±Ý¸y“øÃ))[4ì e„¯¬Uäê×ÃWÞo{ó'*‰leü!jÔÐñk¿Æˆ1ñ¹Ž ½*ÈD@#¿Þ4±n‰¢s0Rx&¥,ˉD"D(WÛcÐ$Áýï6i79^ŠM÷­ƒÛ_¬öÍå m@rcWÄüýE²Þ§—Ii³u™é(¥…Ú zAYh@DÑ€ ‚q1aö‘ýo›7 Jú¥ÿ}CbQs ÅBF(p”(E–2 †)¢0Že‹ØÄ<ÒÏëÄ‘£Á!zZͧ†þ×i]RÄ·X¨Êp?>™W`Ÿbƒ‘¡ÒÆžsà£i탘ŠË5÷]Û ‘ƒ Fõùö¯zµåR‰ ˆ±ÉqÏnT-ï ôÍN°-׈åi ƒÑV)ËNÌT½ÅÂX왋×L˜t€ "ÿHmÖãkÌu:·"vá~æþ¸VdCUÄÞK.UOAì¡€Öݲ)œò:•Š…ö%ø\{ó¹(¬¿ñâʵãæÂ7ìe°T‹qßÖËU8Þ^iCt'%Ñ8šTñ'tÄÕ¡ —N•ªu•r© ö÷û+«ôNɱBC½^‘®æŒ2I2²Ôø>ó[$yp[[ØÀ[EÓêåë9×Ì~‘¥/jÈÝÔ§ª¸˜7$7OÆx‘ðL$.Æý'DÝ8zñäáÍ&ÌBÈ;*íK%X4N"$H( 1p¢™ÿ¨oŽE°Œ˜bS«¶ÓjoéVca’¨«²»^ÓæÿÜkähYçê\òžCw—^IjŠf¯îÜy@ïÎÙ±g÷Ün?ÑPi:¿CmG’¼pÎÒ è‘+ºÕéÛµg§ŽíÌ$q{^¼ñD7ÓcغJÈ\8sY‹6ƒ†ÁÀöÝ{­:î,.µ`ê ²zŽû¦½w¹C[75ñub=Ñ­³Ëº¹kVY«hÌ®HŒ_IDATâ¹›‚6fGvlú¥ÜØÕ¬êÏmÍMû-eݾ†Æ½@ÔÌU+ÛŽnèÑ¢®Õ¥Ã;rª÷:°zxq.(çÕ~V«½mƒÚxzº×«bŸ“žøàÎ=ÿ?T8Öµ' ‹æ-mÙuüÀž5ÆÍQµ_ÔÃ3;="%é»Öÿu`pñM“@\õk—¬x5¡‹oqz´uñÔ«â£k§¼ÅvS\õë—}Ö~B×Z•0ïëéËZ´îGüitÒƒ¦•µýq,zéë2ÈÊ¢N‹ÙA¢˜è>í[ú&];’Þ0¦{¥R‡):5ZS­WLÎÛ óžì9tyø¦“½\¬LiSÕ ÒÎZæßvÈÀ€r¦v6”©RgÇ€.÷Ûv’Ä»óÜn^°›•eñn[£z ï”|õħ•~ ­,]5u‚°sm³ì;SlÑѺj·èª«W_¬ý÷<„<ü}Ñô[VGÖLúŸÝàHùƒ¬2S c T iV=›d°ÓR+mÅQuØ Ê—IqG(˜?þûoÙ,*4Ø9Ñëm«¹Ž›¿È«²"q ëáSËN®ÔVnä7kδê„Ø9”swuµ1€ÐܶJ-—†µËR¡¹o]3±e7·¦­bBÝ«j5ZëJuOúªe]@ "KÇÊÎ «bçàèîêjk^>8ØÅ\hæìêVÍ^$[5puw°(±_»yr3ç1sNûòY hÚ¶ÿ¸nþCùŠî® íë…¶j\U©P×ðj7½_P˜{-=+¬ëÚÈJöNšmgÌ'h/BŠm«é)6¨8ƯÝàC"€[;UoäêìDA$ ƒ:Eù»:ÚZÛÚ;ÖmèÝ쌾¡õ `ªøzÖ03³nàêêÙ²»k%s•–óë4¦gûÐÀúöZ½y#wÏòUë»7¨B„š[ ˜Êµë;W±/±ø›3.>èÔ!¬ä>HèP¾²‡K°°²¯[ß­f%ûð-¬LåZõ«T ‹hl!Öqq½}ü÷èY¿µ®®“pÖ­{îÛ¢V¡qæõ(—°^^µl9ºÆÌßU 0³­T³‘KGKûz ݪ–3¯Õ¼sk­VgS¹Þ°©_…Ô¶ °t¨\Ͻa5£ÕÄÞ¡œ»«‹™SP`#3‘™³«k5;‘‰UÄ5|§Lî‘•’jWËgú’ÙÕ-‘ñiÛ˽²¥\¥¯á<Îø "¡M­N¡  }µ&ã& ¯àP®‘K1¿¸“nÐ#¢‰±eB Áù‹:G…þÚh€ìÊ\sKvÉÏ.„Œ`åóéRñ Þ&À®õÊ3̈@ %Dð ¼ï_2ÖN ½*ö,öˆˆ¨ø*Ê{ù ÅË›ðâà€é›Þ§„^Q~Û/g–òxcÙÎðáÁZ£&¡k ŸCi¯Ê¢Ï÷újËÿ° ·æ}3åY—Bõ²úŸR¾™™Òyzr÷½é¨ž¥Èq,å8öÓøî„_6»SŽåè;œE !G›³jó1ÇF1;|­ËXü?ÏCY¤zÔ¦¥ð>öOŽãJ1HÚ‘)ߟŠJšð8ƒGÇY½LyÞß!RpkÝòÝ/^w™ šòMý fdòȃW\ܾj1¥Õèøë×ð¿k4&`¦·å-Š·ô§Ÿ b ˈÛw¨<°È¢G?™vÈlE{Io?ÚþCüòᕯiãMŠÁà x³z?TÀû½_êb_ÚƋܞ嵎ɸü™Ã…Q#ûfÝœ† ÐŒó‰5õ%€‚¼zVå³|‰Êx]oj-ù˜=òQk书¸.„ZsB„JÈXõb"c0Sk5=ÊPs‚?¹¦¾üP”ºùA6sÅïX¼®w­ñÍò—YïÇù Ä¿UÆ»5¢¬IéÂL¶Ñ”æߢز®¿üÍ Ô,ïLgnR 9˜Ýh=¢àS þ‹tstëvå»çº¼k‹¤äâyõ¯ÙM#ûêâVº8‡gQD—7{D×.}Fµ _uìáQ2!äìÒæ}Ž !ª‡ÿ¾›@P™Z§nýGùÚwÙL)¢ë6œr¡`Z—àá«þãÞŠr~UxÀ°c„(ÿZëO¤••#ç–¸Í'áwrí¯5‘þMýš7kѦ÷¾‡Ê¥aÂÝ\`í2 ¡ZéO¿â!¦ö[p¾xÅ5ÿ6Åžü}Ix _¿æMƒ: <•¬ýÜøÔt¨‹÷õw,Xm”c{Ae†0„ ðã>aSöˆùàJéë~“^ Zøº“¬“OG‰)復]”RDíÀ¦a%Þ(BNþ¤k›T'é6Èø®ä³³ë[÷߈ˆˆIÁ^ÿ×ÞyÇEulüœ[v)6ÐX@㈥슀"±‚%XcbŒ…ĨÄhT^ŠF£!Ñ5êOc4&1–${{ÆØ vÁˆR¤³»·œ÷ÇÝ…¥˜_ó÷ñ½8ßØ]æÎ93{î™9sÎŽzH¬P­¿j–×ød×ìál;geÝžªõu^û,óزOΔ§¯žýyZ½²ªué‘ÏDMÙSHWｈ(5.hOV…½dìú¨Æ¨õ®;"5Šî îzß?Zÿ,ú³éd½·éÌŸîÑ'ó‰ˆ2~ùп[ÿ&¢§)|JUI¦Ê7nE'g {/#QU•êAQŸ€$¸Ç¢°䣛Rzýºz-ûñ4! ©ðvòø¸@£1¨gÌê_."YŠ|»žM?ýƨþãЩ‹+å„ðÞ¹úü>~þŸÞDµ²`ùÌ1A† Ð~«Ó.!JÇg·‰ýäÚáµ±!AÆÐ¥»® âÔèÀk¢iÁ8x?¢ã³ß]¶gÜp ¨X×+ÑU朚@ÑÙ=-=jäRI—c§Ž¼:¤O !pÔ¬&ÒÎcÁõÃãã ÆÀžýGí»’‹ˆˆtòû¥Q¡F£!`À˜Y×ò͈xxiDÐÄ´³scÞ;ôÇÎ%“b&ÏGó½.>¾W ͈XxãÈ„½ ÆÀž1#÷¦ç "Þû¥ïÀüÌý£bÃý Ó—í$DººóàÏÆgwžô P?îÝ6zé5;3‡Ñ”wqBl¨ŸiK¶ËÕy;lD”˲S&ÇFCPØÜ5i„øãßMy8ohïQ_ìC(ݘ298 Àà4ùƒ-å*!–Þöîj¸“qbÒ°¾†ÄäU"‚TôùÛãŒþ¾ÁQ ¿¤hQO…×O`0ööúåÜrD@¬˜èã>m{!_ô±Ã€äÀ@M}‡zêÌûî!š'twKÞõÐ~›èü¶z žŽˆxså„çÚÇf!¢RvÙßÛ˜ùÅnSK3cg@ůÝ ×´Ø/ªüzÞx£Á?¸ßØ 9•U’'D:“òlÔ{™¿oŽ‹ þà»s€ˆhžîë1ns.!ü¼îˆÇˆÉþMˆÚDLuk\ô{FþSµµƒ*!Hª<µÍr ®zo Ÿ„$‹Ò:ôÕ›‘ƒ’T""óèX㢭çÉr7¦[À»išñqot°Wò¶l²”ô é1þK™ˆHMÒ%þÓDD;µˆpRJÇMZw†ˆHÎØiöž"•ˆ.¦øvï¶d÷m"2_ 6¤?°TE„«*•oÛ°öV¡lµFl9U%KÖgŽ÷ K¼UlÓìRYD¯ãè ‘ºv\@äÌ}*í îè·õª™T’žŒ0v;p³òþ¾/ýcÇ)Dªªæþ:¿cŸ¹Dt,56bÊ^•(ù¥¾~s’HUËï…\+4Qñþý6_1“JJÑ©H£ÏÞkå”w°«ßùUU%ª|¹§×²ý«Œ§ªöžÝ¾~çùµ”Ä„öX¸ç&UÞÞkðõš²‡ˆFÇ7Ì&¢u#|×ÝОUŸÐ3iÕE’K÷èñÓ­B"Úºhô€q)Ú3mΰ~¯­ÞKDTþG€!0|ê· ‘2?¦ãk²HU¦õïýú—‡‰¨<óHwCøår•Jö‡uöÛy£’ˆŠ¯ÿ˜Q¬I{7¯9ša"U™÷bÄì/ØÚ*14hüŽÛDʯ›×œÈ¬¬q¨&÷Pçà!&""š72¶otäªó"*8ä—¸U¹ôIûž3ˆèî‘ÁïhÝkæƆ Ýæ}s•ˆsVTp÷wLDò¡-k÷ߨP‰v$ Šùp»õöŠiLxè½7ž²c7d¡²7nÆ~’õ&É’LOظ{,{7–ÝëwÏø‰t©ëwŽíÛ>ç܉ügÜÞjDnÃFô½œ¶8Pg½5À€~íóÏWíœ ¥÷.\áÄE£»ðî3æ¾tfÅb-©‚÷Ûïy"ÜxPZa§Â‰ÈiðKcÛºð„ÕJY3¦Ì’J‹³Â—ÿvp}ÛF¸cÅ߯Z/U§' à€°Ï”×L¿­2©pdåV."qè :â›øwoÕü§S’Íe¥7Ê›G¼s~ל?õ‡pÇW} á#:èˆkìëçÞêçSç€C›¾ÿN"8xx5p+Ss!j€}$öïâb¿ÝZYt³X–ǵ"‡ç{¿a¨}ôS–å‚˧´gÕ¬•{÷[4 œ¶jûšd°T÷ïÜøbzUF=aá»±×%¬MÞ¥tÕrçR^Á+ƒB€Èé¹ _·oô!máçúasú{:@£vq]u{®Þz'Œ n£ "‹êâTuJ˜kæ Å•\DÂ8ÃsÕÝ@‚æþјñs>¨2¥‰qAçÒ¨»Wý6øµ0®Þ¨q’Ûã»6ˆÙ­ôæ-©¦Ì+yï×ã_ Zêõ¹…Å|è°±½<‘ fRTΦ%‡ïæÿ¾þºY)6IOÛÞΤ¦#š¿%óODOÔ¸{,Çü oæéxè´Ðá.ͤå9:¸ð¶-\[Ud¹èEíëÀ KÚ{y‡Í~9ì*¾”¶ê­Å›=ý{y¸:_~È»Û䆜‹h þåxHó=³Ü¨¡"º¶lîZJî. ݳXûö——f<œàQU¿3Ï•™«Q-ªçFúú|ÒàøbB›å[oǽ”‘ã1p`l‹e³uߘÁ¯ôrQ3êµ½U}“ÖVɈbÍQRš6´…ÅrXó×î•Ô¹¦Y/úXô _ u\êŸ*]ƒD0·ÃZ"-tø /%‹ºqru´ä—ØÂ@¯s”• k@8B¹É¤þ넲¢®!ð·¥=¡˜Oì¾Ö6mD7à«W;$¾ºxf@v‹¸áM­Q¬”eí¨›,•#8rMø’J“͇ˆ…åjcG@ž6<)?óò®-Ÿ 8ýø¡?ËGéâ(”ÚWR¡4vÿ×>XŽwD¬Ply#ÊrKjÐ5z~æÒM3ÁtñøÁe-˜\æøÙT_Û?K–ÍOZ|ò­ÐFðû‚ËÇ‹êõ ßXà*Í€ȦûZ4ÀçF-üæ•°Ú»uVÅÏ…z ©7 lži˱l i×øQNYÏÐQ¹o¯Ëp¸åÿ7håîvkÃýÂûå¢{«â#LÅÿ±«»æ¿Ð8hÚ¡AÓ´Ùðâ®Ô$wקí þ+%üy,‹©Fa¡nÇÖnÓÒ)¥Nì?4å›ÿèÐÙ”›w¾Nücßóú<2¨2¸´òÌå{oY³4]9òíOgóyÀ¨ÊW óòLµ~p@ïÞ‚2ËV Ó˜åÝÍûÞ^uzÊô!Ö¹ˆüÖÃéÚp\?°sí¥ç!2Ú;sïÑ|ë0•ËËíÛÅëÊÿ\õÃehÖÆ{ÌÌI®yWïÖrâÖ˜ùJD_ï;ŽçY+)=–›åýü·2LQùü‡5,>‡Fíå«9ˆjö×i5“¬+W¼ÿÑ} :õÒÛç Œ<€¹Ô¤skÓ@*H=•Í)’&¡c»&Îü±s âÑ];,¾T9pXçK›¿+´­š¿ú|õƒrŠ ”šUŒš><{ãŠL3béí“é²®_[*ÎÏ+3×è3´hÓU~xxÅ·wã:·p‰ô-Y¹{—sðd}­i¨ZþÁ‚TRWbR P¾±e@âûÚq€»'6>Ý»>Ûä /'žnƒuCÃg-Þ0dJpÌ÷­•Œ¬2÷5KÀÖ%ù¼Ø-¤Wö™ßòž úyvoJ툪޸tõtÉ3¬oÒ[Sú&$Fnè¬Ï¿v9ß9õ§¡ÚÉ{Õþ˜fS;·÷v-HŒŽyyÉûƒ¸QQ¡¿¾çeo-{ÌœÑgÖÐÕ/tÂœK9–f^¦ÇDvê°bùÛ@ŠçÙÔ‰[<øœ“·+S~xSh:#)läàÞ}‚ ]Ïì;ÊMêßRºÙrâ;/ÿMGïVú“§/z½ò7/€c¶g[µXôÙœ[g"W/©5Ò¹GÒŒ^£†„G}Îí?ŠÆׂ< ÿ6©*Ôí{MY®z ßÛ§´¯úDhà–Ö|æàp/¿n÷®Ý‹Ýuwº¤Iwéä|yX¨ÁË/˜/ºyæfyò¦“ýžÑÍ›¸3nJüHŸÔ±QW ]=·.¥ß°)_ÍYßrA‚·Jj-rëæ0sÈöç½åìK¢÷à7;9`§cwÆ÷ïÕÇàÛéöÉÃÍc& •ÉÑFÇ9§÷om§FŒ qwk”•[1 åÛVÎ<€yv¬¡ù»§ß‹v©ñxhغŸsÅŽÝ4·&àÝ£×ç‹vNÞ6KËø¤@ÃÖ¼eîÈ„„ÙŸZs Û·´ÜèdÕïöBT‰€À2?6°dÚñ/â› íâ;pÑ=÷=ëªû£nûÑUd_ù'jj=Ž˜)@RIV€DžC"@ Y–U"DC‹$ ¢¨eöSIV9Qä@‘%E%Nµ×ÀóÏsD„¤˜eÐé-æÇ"I‚ r¶’/ HYh߶kC@B`E;Xš\¹å˜ à¿øUè<kû*'¬ ²¾!s¾|j#EHYt„_éÀy«:–g{´cîâ7¼«ÆzõD3„²UÏ6ï6*DçÄŒs…eéŠHJt>Þ7ש×7m y‡‰š–›ÿ舞ˆ(ÏùíÖÔßž^Œ°C¶(±_Àû¹»§»XT? Ò/­Ž÷ÞÅ#¹iÄÀÿ㌠ÎÌÿ¥”èÉàÉE°1ß-pv,€´JJÀ¼è¨Wª£Ú꘠(¾IAKêši«ÒO}– Óvr%@”S¥"‘DÆ*§0´D$áÀpݺõ ‚š€Ù6ä›ÿ¶ÙiXÇŒê°Á] @%]ù}Å£‚½Ë§2 ²¨ÖH„ÅBÇùÛXð@&ÊÙ3‚Çõ—gGhßÕÕ\xtpÑ‚=·k!#aØj‡"çÅááã6èÖk&47‡8pø¥ì„Á)P<8õü,2ž@#¸2>CsMEÎ?îB×F•‹'¸3º†nÓàüü ²å‚̗lj2ÊÑÝM•Û|¯å-[·™!OVR§yëÖµÊþeÔ¦6ûÊtË–­ËÒ3Á¸QËÍùˆÐrõÁƒ]}BâÒ¦Z×Õ€â”SÙ‚uu 1‰ùãÆÝ =]jªûý…GsN?ù¶ÂáBn qàðkÙ !°}@›™àg©P&ÌíA(JC%§Œ®^ó1 “ª-רw4¥ëæV«*·¡x*äSÔ¯0–@ž!Eñ„)€Ffâ¢gc¤ÅC„á H°fÞë¶hœdp3ˆ‡_¯LÅ._ª T44@]M‘mR`…–„2Øp :Õÿ«Ð£÷Y<Ý®&ÊüIÁžlžÚu{‹¡e´Fsç_Ào|‹‹¤µú¦zu¸¶÷Jù¡‚8pø+Ù|‘±e«~nX}Añ{þqX¨ø£R*½è‡ €Øo): ¬LË•™‘õð9«ûZKVêÉž…+ãþdo)>9?Ñ÷:/¿xüîK: <$uäå&Ü„àÀ῀ݴ28²æ®˜¶†,ƒÜkÐyª ¸‘ÝšT¯L}²¬/9 ¬êW›¯¥«mPaXÖÑPûÓ½e´½  (¾zm‹¦fzD i÷îi6_£÷£ÍåÀßùÞÿX6„Q£>n€óѦ  ]KHˆ`˜J¢Šªìò–Ù›/9tƒúþbk‚YK++«:t°l×ÚLO oòËÛO-šw¢°^ÃyÙpàð“nh9ÀéYà¿|;€@jkÀ—,ÃÚàã^‘1¸;è*Ŧpç_ò4YÌ¥lš­ß¡= ùÏËàá‹{­{œùF+üò%‹Pt)ÉNOÿB¡ºn]3ƒ{ç^5èµ|˜= “þ%•^^©„¥M¡Yµz êð8©ˆ‡_£LBße ÁáìCø*ën0oôé øôS<àñ =E¥“£´¬y¼ª¼ß\~ƒT­íµ«rŠâQªI„¢(Šú~ENBñT«£xÕæÌ~ò˜š½ÞDQ{ÉÓa³Ym[f?ÙÂÖ¶ê}|ãÔô7/Ÿ›Û0yãÎåË)'|•eLÎÞ=mÂç¦ßý´ÿ„v ì&SÉ6Sý¿jÈ šY驲ݤü¹Üñ·<7"–yCÙÊò¨Òý—9Ë3Êk«Öx£\Hµ]åŒ>8üBvÃÿ¸á8pàØ 8vÃ)»IŸÐwÀùLåÙÁ‰Cg^ùüSõ)…•ùÇeƾCg”rsŠ‡›ÝH?}ˆÏ•ª°Ž¬O )ù’Ÿªrdíý\é?ðä]—ÌrsŠ‡Àÿuk-íõ»$! †u[6¯'—bˆãß¼Ë,òÔuš·ï`ªE¥<¿p&A½û“Úí¬[ªå¾üRìb×A‰ó°ñQ¡Y‡&Ú÷èm®‘“S+ @VšûäÕ{–ttµ×$Œøñ“çÚu¬£¯__~ÔÄÊÎDI„ǽy›Y Ò20µ¶jů¼÷„`Òûè´Üb }s+Ëæjˆ„Ð…obbóJ¥š¦¬Z H~ò³8q‹Zio“¾ Ìí:´f||ŸÆ×1µ±m#@îÈ(‡(»QÙOÅ ×ÝúÍmÓÅÛ¾¹1ªºsøñ¥°x¨ÿ/W›¬wwo>):øô’ð¢ÒS>g5l«—pyÞ‘wNlW–¶D·–Í|8ãj¸€dˤIWò Þ¿n¡©¯þ˜½ô«ŽèÎŒCÏÝëóŠ3ŸFÌ™g=~ã:+À¼™cfÙ»Ÿ ¾½4€þ=|Ú±ÞîwÛkCaÒé©scoßs‘/tpy^ßùwÄž}zdo^Úª§Åïç[Ç\j.J{æÖk|'çfšwÎN¶ÜLÉyº·[Ø.[_K“Ò˳'µºný(7Yq¬·op]ë.í —-¡…Eï—ì¿â\>–„™àý–²èãnùìÒ¥8ýž÷MÓ¬ðËABÈÉ9¾[Ÿ³®N¶ñOoŠë÷=¿c20EAÞ^¥µ-{:4}ùâ Y§û——ëSðùþÚé·íK¹›oš3ºÍ~z3n íéÕÓ·X/8²Ø›søáð·þ(>÷noÝÙ§¯üÜœþ€ˆÛƒ;ö[ð€•güiiÙý­ 3}m¬næÊSÙ·ÏžeJP’ìaíü0WŠˆ,#“Òt¥jdé'm&• bA¬“[IÝ]¯(DÄ‹S‡O›éß}ËåXDŒ?1büÙs.ýw"¢$핽k—‚ÌË­C Q˜áîì6ÅßkÿÃlD|<¿kÀž¸rú ßËÕúìë|DDV4Ãõ}Ÿˆx|œƒÇÔëŠ.|{dcíþ´q–¿õ”]oe?ìjÛÞ7ñÁŒÎcÏÊ3c¹89d»Kó©ܹîÕ×?îÒ½vÆÙ ¤~z¦nØC׬g{ƒwR¡(;QªÛctŸ†Ob^í¿&ãÝ ¢ QbQ‰zÓ¦Dcü` †€ÒQ%Nƒ;+º`ÚÆ–*ŒŒ|yÿQÒѳ" Õ²gS6é~{ã…Ⱦw¹ÚT«qgJõdÄé+éµëOúãàÁƒÓD­WIñ"·ïêšé˵.h|ìÞµnô™›¹ÖþΔ\üQÓrÔÕ|”®PÍwÑ$€êZA#EAWSƒ¦eÜ÷’Ã?S™Bk·²ìP±ré|H E2ž–fÙb5-5¦PÈi{®t»{éþÓç+ÇzçêXoÛ¹¹¥Þw•5@íÖõŒßÇd⧋Í׶v1½7ç tüWËÂF Èà~™½oãLë …úct´ZÖ¥Ÿ½—™Ü:Ù|èQ Hû¶_ßûØZç¸Eд¦¾±oCc`Y´ºþ#Š3¬ˆa5|Å“Ž™.ÐB)¥­I•u¯-` E,€DÂð5Õåe €@ƒO‹eE¢«ÎS蓼ÊcX"EMŠŠD2°ó 2l­PU,“ñ)¾¢ª²º hkðÊÚê¤DB+˜0Ň²æBy½œÅáï†_âwS«…¹4öMž\5:5¾D·c>0Òܱ•{¯ 3¼ö´ÿóÁȇJ‹¤â¢¥=q‚C]ê?{üâbâpo0õ6¼õ¡¾Egú=m¨‡'î¼çײ𳵈}~ñò5É8ŸZàëØê]ì¨#/FôªºÝZf>¸ñ6NǤ«–šâè'5S µü‚bÅ–ü‹kI„"íêËÞ½þ¦è“[¬Õ©:@zÆ’¤B‚ˆˆ Lø"2i_GÐÜ”MøR"'(fWÚÔ·oªV¬o:244täÈ‘ƒø9´RîeCS“ü‚< ˆ„0ï?H©ujÌûð6SÑdßåÓmjr”Çn*‹HÞÃ|c¶O(Ih{eË.i[[ßZEw{9ú<ÌH$R±¨8S(ªmd „ÏG&%WHÓ˜µûÈ¢zâ‘6yäÓÒAtš5)Øvêjûþý€²êÔh϶Ãõ<†ðtèëòìòïoM[´ 6ðñ*Œº|"·¶³! ÖÖ†Ú¼ïx«¡#xq‘ûîº@ˆFãZfz§/ÜFVøõéª"yàˆÞã&îË(Ó2öÑ¡}EMú5àhwíá|}Ç CÓ´lÿœ-jn½5Á/¸S¦EŸK–)=žf)cZ{ÎÜá=²wg'ço Ïœ8 †ÌÙ>«‡¾—›‹‹kçWµû^Ü: ̼ÖÎ 2àÞ©‡ÿäÖS÷ó( ÀÊJ…"ƒgÏl¼·¤¿³‹‹Gÿ9c6_âdŽ2QÖ¥ó§r„jÍŽÝ<Æ¿0ÅÕÅ)dק?Îî3 êžùcîþqÞÎÎÎÁËo?w³Cm>°´X$¦ËÌgR‘H³eR‘HÌÍ`#üè‰ð*áTc2Tü¡JTŠjrBÕÈ ˆH@%ô„rPŠ be*QRmŸÒw˜ñ)V»^[}u€¸õ~C=ßðøUÓé¢Ì÷V- K¿º÷ì·åä½vµÕ+U§Ò#¥@•û(š_9þʹ()(£€å&žšbpàð·5—Í芩­ôƒTŸ»Jzõë¢J*©ZY5Rm±² «æWI•óÀ#Ë&]g;EŒôÅüćR&þîTM+ªmCYº,÷Á¿Õ£–,³®£þèô¨ïÛ´¶º‚[T×ÉJiU‚ˆ)š_Ý(VnÕœ«áð”nþ1 ‘¿/;yç=hÕò=§µ þ”o."Rðþú’ÍÇ3K˜fvžóÇrî½8pì†ÿàPpàÀá¿ÝÈ¥ 'WO¬Z¾tñ’å{Ž_)QJÿjC¨øƒÀ¦\ž±üè¯i€0}Áâå™Âÿ?ÝÔ‡[ÿþ.\zèF*7/9üO³æÆ…yÛFì¾Zʪi©“˜«»í­Á2IQæ×RM3s}A'ü–QªQß\Ÿ[˜›S,’R|±I-uwc9‡ »!lüáý±¦‡_Î’¯ ù$wyòþ ÒÔÇ]ü§é·²³·€û×6ô]´{†', (ÒqùBk v5Û¿ÿv¯ qO½>è²{½âÇÞ~]ß]Ùû*½iäµíš9½tØú©î];'Ü¿óÕÐáö‰¥™—çõ]pµ±µƒ,åy¦¤õÅÛ¿ß>qR<¾‚C!© ÇWWö£%Åb)ÌŽ¼rAJÍÔªI=VV¢:Ÿ§¨¡Z0y"b Ã/#Fj—Riy]eéäGÎk+ ]xÉÓ£“ò¬LL _ŒX’xéJ±¼U¼z-ZX˜0¹"ŠNŒºœ¯É"3GSm ¾ºfY¿j|+ÒgöÁB ¤XëâÛ[z7õx>e`Ûú[øòÞ­,ø‚ˆAM|>šØ­åíûZŽ<§M X,#Å9‘W®ÉmÉÏȦ½7ƒ9üãØ A]çÞÖ²íá;cŒj]f*&¥©·º ;~åÖ¶&µ¤ Å`¡‹ˆ³>k¯Ã¯Aª^£kf®Ã˜ÖZµf‘œ±2áñe…ÔøÅÅlCu 3Ó¥ºµjUS^Ͳ.\ú˜ îu‘€4®Z×Öù.ªÚ>"8tá¤îíe>á“zÜ;\‡@ûz‚ ÒΫVË&1´ŒÇç°6 à«Cèê‘VˆHÐR_M ¾FIQ< y9Újµ@»Ó“7ïÊ* ¬¿k;eõè¼Õ¼VoÈ<Ó5c2í¶½5>½§4©­'3nºzÍjÅ12Bñ9gf#üàF8¨·dí„÷ûG…­9- >\Ûî=`^ÉáFÀ÷Øíå–p€µo_~Ó¶Au~ªl‡¡þ‚'‘£ €ÌÜa§í~#ÐkÔDSgý¡@'õ |–Q <>ňò”* 10ó÷© ¥@)ˆ¿–ÀÐý,ë×\äú©£±Y²ª‡”(³ð›Ñ4 ºLJ_Þ~4VL!P:*ÀmSägÊonpæîIѹHa‹¼=»=N)>äΊˆá¥ãçkÛ V­€×Âߦ`ÑôAse|J*©i#ߢ£î¦¹ ›ÚÔ¥Ú÷ï£õòÖêy@vqp—q[^q¼†Ã?og ±‘[è¥ýí·nXg×v¼ÆÖ]ço=ܹ}CDì²RJVvur”²X·ƒ÷Á=Ûˆüƒ’B Ic`DEB`¥¥E%’²àZlaa‘ ´íOœ[?w–¿C¦˜EußQ  k;Ïî_1{šõlJÓ(4b›gC B}ŒGXÙ:N=ú{;±œ¦¾åø­óSz9çIPǼý²ý‘ÍÔ€——–ÝVÃÒ…EE,@ÑÆÙÝv÷jmª$!SXXÄ Bÿ™î¹9­ö9îyô6bzMù R:ƒ§¬ ói„ˆ:-Û¹ŒÑÏ1K |íºãþîØP¾­Õd™_~?O÷Ïé…Öýfl›l¥*}Pý·ìŒbc¿º~ »%ûÎ6]8޷ˆûkIJŠJ¤ .-,3rÉk”·•ã´;^Ü­@ÓæÄ…Íóf:̱¨æó[Äú`kNºáð7ÂÏœ™ªfj+âT¥A)ŽT·Q'QMÐU«„°¨0#UóT¢7TÔUQ•’2UÑ7ÕHÕÄШ¦¿òŒ_ϵ:ò4ê„®jæ*£UU—«lS›òŒU#T w"œÃ?PºQZ‚ªIU#?”åTŠ#ÕRPI­&!¤jU"9ÔP¸ºJ«¤¨.\E¥H5µŠÔ06ä;­­¡õÕôCul šöÖØoþö¶?ÂŽùZšÜ0pàð+”)?¢jrñõ8pàØ þfÊýõÞ±#‡ãs˜¿8ðV 8pøŸc7ˆ²íSæïݽ}÷±[éÑ@RæÛB†SK8pø_d7„ÐÅéç2Ä«fúEž½L—ß¿‹€ˆ,#+€ò4–eª&*äd†a‘U¤—EÏ‚ä/q†zò†‘±,'æpàð¿¤L}½±´Èl¸•Ç„ìõõQR梹!ÌÝÕiDÈpW÷Îsöß%„ +=À×­§ïðþ½;÷9•"# ó¡_·îAa“Ãú»wîzüÙ7H==Ônèæà!ÃÖmÞÖ×ŧߜRŠßÞXwàª,ïéü9K‹ˆhdÇÆá— ¸·ÅÃß?|vœE6{¸}Çíï ñÊ– >!Ëäá(¤1ûÚwê÷™FDÄôËö–12Œß?Ì>`­<-ö‡S„ˆK†»‡®¸"'—ra~{‰RÄ´ó#ì:8Æä#"¢4«§³Ã™wßñå©©Ýû®FDDæÛ×äÜR†;¿ÏÃß?<”d½¾ÿA»^H=èéï—ñæÑWû×¢M;¶oÈD@sϨè«íy’“‡ÞY…ôç b«^ó_[« i¯ß|kÒÁâíÛ·oß¾7±3I~úP 5öj)¡¦o£Á¿ù1d À2”i= #-ÎEˆ‡¿7~øZ;€;gvñÅ¢ ¾}€P¨ ßfü|hx£\¡T«<î‚ÂÏ^–^Ê3Ö僊_n±ˆhßÛ>÷¥¸Ò ¥y~ ꛫ•Õc¨ IBš{18üϲáó-gJæ>~ØM— ¼Ï¶Ï›Q<äD#cíÜ/ %C€–ˆùêêíÌØ»Ÿ ÁÉ °R)­®^ÛWÜyÙ©V*¤ÓìbM&9q¾¹8üšŠ<8p¬í< €GQ<"ÐÔÊÅOÒŠ:u—=¾y(Ž¢—;­lú%ßo’OòŽi4¨¿9y.€ƒCÛ ÛÖʉfÝÝÜuÀ|¹£!¼q3®0?î #õnUWÎÑPRÈ`^ݹûy8pøçK7„€ìà©“¶Ag ì„6!º Ã;Ðá‹"£ppGæÌ1ö;h«UoÉÞ-MÁmδþó:!…†-º8ŠÉ‚– IDAT»Lpìò Òó:98ëk0l5kÑb¹%i66åðTŸ—Ÿ³Òó=G¯°o¨‹Í;ø0+ÇØ;<>xíÌÚÑ —%lékĽ0þ¾øC J‡€”# (Åq¨¥ª‹Q5œ I¿0Âû·×'‡WÊ[õ4r·pàð—n”8©6¹²ãoÍ‘#ªä¬†nÍq8^ÃÃßÿ»Ë -ùº»’ÿeÊÔ_ ¥øu\`:8vÃ;e*åcô§ôR`é˜è×BÙO‰Aåâ¿={Çþ©”|‹{÷Uø'u¾‚Äço¿þúAf>{ÏÐy_¼KÿYÙ°ü÷·Ï1±ÉE?ÿé@`į_GK˜êŠÊJ_¾ŠÊØjßÅ~§r¿¾}—Tð‹¿i2Ñ«×Ñ¥4[ÍhüÜç«–JMŒIΕIrã_½ÏÀjìM—¼|#fþ|׿¥||ýêÕ»¸$1S¹wòv䦎yý*æ]|­¼TþÌ˪¡‚4çÅ›„_£ÎüÇ°p¤Køη(ÎóîÙå~BádÅÑÝ#$ˆ˜p¤C×Qâ?Õ€ƒC;®~/ýs/¹;©•çê_?(ñ{›;‹ó®ïôûÏ–~4Óírr!"[ä=tɳŸ½Á—E,ùôбs@ ]Ýí¿…ï¬í:ÇI+ɺ°`èœÓ?XÅ…•ž>So+ˆ—ßøÌþ{w ~ìäàö>GT)yœG¯ÔŸì>"ìÜ/K)qB7ëó9˜bë¿KV¥ÈšÀ®ñ?H=÷uû®É%ôŸí$‹ˆwvL°wí2f¼‡{—aó•‘cñÝ1ö΂Gy¹:¹öÍ“0•HdG.8ãÄÏVœ~tÒ¸µ×ÊSÏ,ñ³ÿí+¢©gKßù´ªæÃQ\ÝðÒ•[.MõªPP„¨¨Æ¾Pš¯¡¡!€¦^ÝÜ¡ŽXé¢ï¬é+Ò¸ýq¦#Z©)óÙÊÒSõýÅ•šPCzE†=6=;R5§¢ŸÕW„§ÒZZZ4÷ÒˆŽDÞÓê¿àÕ|ÂÀ§·‘šmCµøå—=TÍ­âÐ@¢ÞfêéhUÿÑDøÞ¸’ÿùÁø%—˜ò8«9¿ó2¾?Ë)}‰KçiÖ09«­‹|LÍãk–SÁåG².>ÆÕÿˆûèhþl#Q¹bü± ôÈÉ;÷\»ùûÖM¯Þv•\š²?‰”ß‹„.øgÖæßýZ›`î›ö=F‡÷n}/KWG˜ò,S{ñƒvúe¤$¹Îî=í»Ý¥¥þûó˧®>¥fR7'·Ô'dNÄðÎ@èã‡Þ~“[·¶ÞçÏùnã7®Ò®øÝÍÑó÷`1 =k¼c·Ð+q/Žh Ê>_:aU&ef.(úFÌZ³¹k3ã˜}¾#Ÿ ·‘Fê›×Šv×°ýð]«GR9O£˜ÍŒ ^_0ï“û“ýãàÑŠþ“ßÙÞ?4íñ†ž C›Éî›ëïÜO \°ñÅá­ ,´ž<|Ñgúþ >Mª%’ôW¡"RÅšfaF‘ tÙþÁvFÅ7ÆÚn2nÿMP';æ^ií^{öGÄîí3䞯ÿ¾N­Z Ïï[‡ìXZ~Ùhî¥v[m¯ŒaƤ1㞦”`ÌÈzõ¡m–ZøíÖÖß–c ëjˆ¾Ñú7mßÑØPíê¢!OY’6=ìa¿)M:Ž+Ï,s$g6MÝr2ªNãféq µÝ‚÷­úM½$Åڽ߬®W“À¿Ý­zÝwá""IîÝÙ·×Êë¡Î¦„ä÷upôXq}”5B’OÏ ?Çgæ ­>q¤þ•Å[ï~~ö„ÜëWÍæcÓÈz@JN–‰ìSôWjñØ;μ­­Uðä“hç[W>"-Ή‰É(›S¤èÓm—€…G®_oc¬^úåa·¾“¶^~hS°§IØû¥E1óW·î›L÷'Wïå¦=¹&²štvÝàjf'‘Ì ›X¬™?94¬Çì탑#«§í¾ô¢^úŸbSm†.Ú4Þ-õÑÞS/#"~¾5Ï¥ç"DÄø-‡É•©Ñ½]&o¿#¯åÅÖà¶ÄØCœìÜSDˆˆ²¯m»¦ iD<³vĈOQ6Ù§ã’sItöóN¶Ý>äIñÁî@W×Þ¥ˆˆ¹é7{·žòv=Þ1³ûo5)SOÎ.Ÿ¾ð üwÔî™NFDáƒpëvŽ¾—È£g êi·92?äØÑñƒ¼oÅ ®Ž÷S‹ñ£B™Ê½<²MŸíˆxcmÿîÃ6Êi]äýÛdÙÕ“öÜRHñë܇î‹BDļÞvNw2%ˆøÇœ®óž°ˆ’ëÛYû½Êóõ°Z~ò ¿::8 Üð@žzs¦›óÄ[ˆˆâ׎} ‘Å´[›ìº…”"ž ÷ò_xY®LÙØÚ.½,/õ{°]×qkxÀ„ŠÄ .}§ï–ÿêÙÅvÐùïµ½ÂÎ}¨¬L!æÇ]r Ú¥<†Ï·ýæ² ‘Yè0õÈGDÄO{Ú¶²ÙúšFDÌ8âжåœÓŸ1ÁÃÒê^^UeŠeYÄ¢K6müsäšïÓ•ì$Êg ýÉÛ©ýÙè|D¼¼Ðß{Æ9Ä’°îvënf "æ·n?¨°L7™ÐeÏí¯ˆ˜ù›£­ã½¯Dd¾=wprŽË£ä©}d…¼±]+›ý± "â—½íZ®ºš†ˆ({×ÕÊæE¡²2Å|~ý%ŸFÄÜKSÛ8†Êu7Ñû½î¬¶_ùRôåõêµë*ác®ôäÒ±ý&m(¨¸3ëœú…*]iÆ+''‡ÄF®beߟgoëõU¢¢°îœ8fñyÊd?·ñ›oÈ?X7Üvð:D¤ ºÙtŒJ—$]ZÙÑk‚\[6ªWÄÎ{ "9glºÎþ%ñ_~ôˆ&êvر»ibâ»Y9,Ÿ20ÂÔOÅ`!¤<å‚[C¿P“ãc‹Áˆ`r`kyzk¯A¼ÈE8Z•&/æÞSÍÖÍ nÏg1=÷ß´6ëSôˬü"™¤ˆ¯A•È@‡/¡@"”`?%§æMêã.gº6£ÆšlUºÄêÖÑäéé±4›/eÍ5áùõèîû:! µvC„Ó˜Y¼“_ð ½27AëR¤§\ŠFJcöØ®òR–® þ¸•Ì‚£ŒE–);ÂÆJ]œ€­GñÌ}]äÉ6õà~z‰’>–9*0,‡á3’6Ÿö÷¿¬Ä>pqøKÛÑ»-'†E¿Óñ¼5 ™¼^Z§õ@+>ÚíÔi#/φˆ@H}miA€qUé@"‚öøæ›u}ÃLŠ¿eæ#€¦•YÝGÑѾ–îž³öîõê±häþo¶w­ ‘ D~ï"ƧŠ‡tª'½t­>õHé˜!’ êR,»••Hô¬û¶¢€ÔµäÓµº¹×AÂk ­)-*Vœ9–ëd ÛXÊi^>ÿ±‰_p-@Ðh=´žñ6Ô­o5mŠUÕ öLF«QoVÀç3Œ²uµL›Û©OY±oË/:ûý„ˆ'„`yØK¹c Ã"²´|½ÄÉêf•™™ m‚kî\ü†žÜ^¯éñåÞ3Ö4ËŠœµý‘üþ[†EVFËE¤è='[ùù%›JüU¥Šž÷tÅïä7²¯½¾®Ùòë/Ym-Å¥-à—Kø„ÒW£äé|5-ÄâÊû„ä•”jªé(t‰2µQ·×cØNË^Á>öÍxß·§Ëò„´Ž¾6 üj=ž‘®zQN1˜‚†.¥ [æÌSxãz©ÝBó2a°IŸñv»v½¨{ÕÍ°BÃh+´S !JM«N‚¿½kòœ#ïú ÙÎÂD9¼)ê™k•ý6Öáå EŠ*Œ–8¯–.~,–V‘NKÓKΪ±;™àý@R;,¸_=CM†¬ÙG)­Pf\O!M#€©žz~i1P@UÖ? Àg›Ù„ þÁ–ùÎtZxÁX]n¥ Dƒ"ŠR„ªF–FäóedAƒÏ«jð„Ú;Oœ€ìwçgœ:¦t{*¬˜èe?úÄèC[ËK"O  PMƒ¯ì‘þ/wYؔȻ´¡wä,{SE%jzÛÆÛxμôü€ª*:éXšùKíòÕlX6‹€ÈG³òêQ/ë9 PçCµ‡o”Ç*­5ÖÕ*£Êã©óåé [y¯•âñt54…9¥å.‰u¨8ÍCÒÞpáêæ£úïkÚyÈ¡ã½zý¡-¨q½Hùº[ÇúoUÐ#2]iZ´¯FÝ4ÞÒ­À&įQÙ{Wú¦îy”î9Óú—"úQÛͽ'd6žWwÍñ1ºÌ˜P%Âb3è<1­§¯ @¦@ÊÊç±TœOÀ@WyèMõôJÄYòeQÖGéÚ)ûݶy¨ ÐE–aÍïo¢-(É/¢+Ÿ,ߊ$z¦ºÕNHòñÄE 7[µ2 ZÚµõ[b-fØ$ô_þèìç?;zÙ{·ßè»ïõd+5xŸõ £ßsR˜^ oKF]«•–bJç|¢¢Z@êé ª4U¯¡49]Mµ*.ëF?KÎÛt㪭`öÁ¥ßi“…!?2¿¸ÌØH2 EƆºÀVïñüöÏcV€Šè!k¦‡Û/z¾|`œã…Ð÷«Á"  Ä–JC"Ž…²#|Lȵ]j¿àŠª¹ ¼ñXxv\çJ¶6¦4yЊ'#œ#¦-ñ81·R±[u Þþ—º¹™ëñ Ë õ -”áe¾:å9r%OÕv³úäM›ff‹Ÿ§CYh—„ÔøÚ6JëAþ‘P¿rÿxøthÝÆ׸šåBøfê²âéçßu7«¼aðxYP®å¸vñk–]è1»W]å‡LnB&Žµ4û%GTDÒàQt™›Ãͳߣ¦D„@ÔŽœ¼&oÈÓ›òëzµÑQˆ¢Ëw>”§ß?¸èUqdiãÞI{â# Hú ›æö„]SZ*çeÌîÓ¥@x<žB4¤KPnR£6­orùÜMù(ÜY»¥°­Ÿ‹vµbÿXÔGÇŽÇIÉ—ÉóŽ™·ÊgÖ¾Ò Ó.}ü¹(ÈÒâ¬k×o e Ðä1B!0_vžºÂgÜQKüøøÓRô,+Í¡U[ùKçç_x“Àfˆ¡x}ZUaü¶/7-–·ûø¢û/'”:E²“$ùÖ‘ ©T1D€bžº2‹õÑ9ëâÉ×ByC¾Ý}coߣZv‘XS ~¼+ü ¯×ö±^{ÃZ„ŽZ-üž“7‘12+“‹Ëý:aŒ Bï5£Ç†Ï´Í~Ò¹\˜|õÖ™üœ0-–‡ì;Þ#åÀæØR…LÄ„‘7cóoÞlô¿ ›ýµïŒÛx§l^ÉUࢭÏé@«zß“ž†–þ|§£Ÿ'çÑ@ˆwïÆŸÎœKÙwV}ÉG@¦¶M¿×/_¨âyçFúu{5Hº½á^&€ÂWyÕml¦¾ºëu2º`°G÷=Q™ùo&lMš5ß J3“®Þ~Ì*¦‘1Rª~ ÓS‡.*>•¶›yRúõæ”Ó…ÛÃýæÍ™tfé¸ÏòMCBh–ÉÇ#y ‡´Ôú5GŒÝ º Ø8?ÊÑ'(È¿×-Óàý­oÌïµý-MPêeQä×Û¿ŸoÏI×qÝ–± QŽ§1Hçr@@`ïnÎ;>7Û¾c •ˆ$4 €"‘ˆaÌÜ®ñ?jß½§‡]ÐÊþóW»hÁ¨5$GFy ôó ÔÞkYWgBÿ¾Oò vóîj›îî]& …"‰|Ë|Ö%â;«»øôê¾îöþ€•I„’rBV(•óüU–c—ÆP¶vð@žßüAíu(­z‡—ô 2>Y ,-••bdR±XZ¶Û Ùj%>7{×} P$•ëˆ -‰ip±±}vv©WÀ‚D,¢z2JÅ"i™ÎÌHD"ŒT$’0åɼCàëË“ù¨ˆªÿõáîõÑêÆõ@„ éëJî®8ð" @¦xŬH(*ç–b‘Ü뉄rÙÑק-^M#€±³C“Ü^ÜÃÏfjZOÚrlOǾýú¹Û»dëØ;µ6z~xñ±ÂV‡´E„é‹æ½Ú7+2Y æ]¬ê§yعÏÜ•,Òil¦ƒrmN&‰ËgŠ„B´­º·¡ƒlÝC÷%¡•ɈJˉb‘a°¼åÒÁ¾›ï‚q¯5!ö"_›N½}¼ÆžÑ¯[Oë{ËŽ×x˾…QË]]m=Ãm&® m+€‡›æOÙq@Í`Ý,ß³3¼œÜÝízN´¼°oc]È|viÚÒõòAw²îøòâJ¯¾CKeìÚíËx϶9tñèí¸êAà`J’6qÀ¯UGéRºí‚–ùk,‘°ÐÍÖòÆÞY½‡Œ½´îˆ{H·_&Þý¨çOõ~Yb_ûO¾©d”ïLÙwN(¤UÊ—Q`k¤©”©RÖªîE,˲U((`ÙÊÅXV…"«’»" M¶RSå?ö÷ïœQÊTòU+=oÙciÕÑûxt@§AǪtB¥0[u ªÓw^Šj+ú¤ü»*ýJƒVÍ›B¶z=¶ê°)d¿ë×W¥Þjˆ*µ¥êÛR$mÐ[¢:nUGF)Eµ®êF·¦YIJlµ=WjW•7ŠÈ²˜pfÍÜ¢ªÕ ÷sØ~%å_:"*?ª´¼º ϱvPƒUW@MS©š‰÷Ëÿ/só«öü$2 Sžª¸Y!Cª”/û©‘¦R¦ÊæFRMƒH ʪZíQ¡HTrWäQ¡I*5•"ÍŒÞ-õ5Ñ¢*‰ýåO(7èW;z•‹TÐUnUõyªŒE5/Eµ}Rþ]•~¥A«æMÕÔRuØ” Ö¥¤šÿV~òZ+ÚRõm!Døáb¤V€¨¼¸ª#S)ŒŠrk«ŽnM³H93©nhTfŠÒèº3ÚYá§o¯Ú8•–W·€Ò7'îèûSXyÔ4•ª™xÿrùÿ•n~5ÈF%ÅÅRYU×R¦¨¸øŸy¢ ¶ÕÃÓVU‚Š)o ‹« ·ÌHK‹J¤Àá—¾­V½®þÿÍÁ×qÁÞƒÕN˜Ò’" Íþòú´Û^Üú½úÿ…çDxÅ VíXÅÓa‡ÿs«Ú ‡\¨ Uf ”M‰ÿ•eòWœ¯Ð**¸Î¯~UU^]u/³æÿýÕm«Yo‚rüåÓVePÊnCV:ƒ¿¨Šyün*‡ïhÒ»ù¾dÄH<Ý,>ά)Ú'³¾ŽM°ì×'a%»æ†Úw²uîxæE!*Œ+:±vŠ›}G{÷™[#…¬Ê¢#„‰pê9õ>þÇ^5æ»u²z•N“_Êh!›Fùl~&*ãí„$Ÿní>L®¯Ò}O´˜üë ÁG'Övs°íhç¾üXDy´ !±7Öu°±±-ƒƒg?–á8üjÛ hhj©ñjœWT›°w·þ¯^¸’å}{<±sûáVÌ|ÜËÛ¿àü£àƼŠ•MÈ‚ý›Þy´RFK6ëí—Å^[ØK™ŠÄeÔúω΄yïsó:j¿ÊÌ@¥DFCW#]}ÊTãiä1k¯ 5B]iݱ›ðÓÅ÷êƺúF&ê.´÷éÇû3#!äêÒÑ £5#ï?Ѥ‹'ûûOÎÙÜE9“´4Û¸éÐóFñàíƒÍá/n˜äkÃ&¯úÓ¼I#9áÄãOUµ›¬W‘“Æ9fÅîóò4üruÂ¼Ý @AÔê‘k£ò?Þš2:dô¸™wSäSöÈôá‹.eÈåqÖ‡EáãG…Mº– Žü}æúcokZeÂøgŠkœ×[K ¦ÝÀ}ÕÌ„oVŠÖE$±i½zö¢(¾@CgÊ ‡Ôë·JT©D\´úH<° G‡ÍþƒÎ=5,$lòÜwYbiÖûˆ ¡aãg½Ê—Iâ?6.3jÔ„i &—u¸±oå¨QaKv]†œÃÇ®WØ‹>n\0-44lɶ“å!5@êõÆýGkÅ6c¿¬èÍŒ±¿…†M¹üNq «äÙºßVÝ/ú|Ú˜°±Óo}É‹¢8cUÄÄБ®Ä¾½´töæ(e!…å×O¸¸þdÌç“ó¦}dëÒððùý6>}YAý÷§WŸO?÷ès#Ííîäਠ{Û=·SR¿$éê›ê@ P§u7Yþ±LÙB!¨§«ó&.^NýÉõCÕe§¼yŸ\›ýàÄìuB¦Îô0I2nîšÓcgô·Ãá^a߀ȟصãõ¼Zýéi­èó¤ˆBN-¶èt‚ï€Á–šïÃæmŸNÐÑ]Üú×w dvÕÑoZ1#·Ç‹íK hBI3cž›q&pLxX Íš!^G߀¢¿ÄÜþ}ÙáØ“gîQ¶_÷Ø|$Ljpž ÚVÆÄlž²äĽ÷_%Ê\^»n{O+Ý:Ž½Mèß^.Z¤G½Òë禭SϪg{-‹.þú2‰¯·“AB•«Áâù].¥é ^'÷Öðµ‘/‹x çÞAe´:y:ìÇ´Lõ6–Fòц¦^ Ù×QÙ*ö Q~ߤÁ§7O®]»”õ—Øë8üð£:IG[·u½Qªp :»q”ﰥȈ}=ìO>ÉDDaÎç˜øDddL~ìM{÷îù–y»¥¹Ë±èÞøÖ³ä^Qâ¼®nŽ7bsQÉ;*~ÿÌþÓËÜ£¤cº´¿)º¦¶<;½´{ï)²²â¹±×Ü»æŠU½¼„Ñý],» ÐÓ¾ëÀ¯%•=ÍN,ìæ7û‹ˆñ›Z¶é•(ï˜ø¡kkËÈ dYD&ÇÇ®íÝLDZ÷þ=ƒˆ ƒˆ»üZ8ý QìÖrÓƒ9Ù3Ó·éÎ"^›äèñ <꜓ÓÅøDd³^ttñ*¦öÍúV­»<•)\§¶„˜½…&[ZeȇHZܳ«ÃÅ×9·÷Øx (óK+ëܶwø7;F<$®_]µàìWQµ¤Sð&Dde¥“† ù\‚QG–,»”®ìõ'Îýàêd÷>‹–7þðë 5:r•ÜqhÕ=®"°]ÑP‡{?¨d93Ó­SG»€A#F…Žèê`9`Ñé_²Ã??aWaµÌmµäÒ5Ô1¶È—|Q6¨ëÞY6:ìq2Ï5«z¶”©mk$—e(Š Vùš©w)…u-š(L V¯™AÆwl…J>„Ȳ*O„Àî¯ÂŽ%UIDAT©sòZøØ8Ï„þ2k؈i[.›áUc× ,çÒÚÈ[˜ÈÝåÔ)Š°2¾¦NI´·óoEÀ£ £ÛXD|IËÑîßF[~Nγw‹™Ï È®<—©5=1cú‘D€{Ÿò}š'¾}©oâ¨É£€1hÞŽrç»FF¦çÓ}eÌ:˜(<õ(ŠšÅ¯™Y&D1,zn͉+…`Õžƒ¾áàÄ¡WnS(­õû`Ãö*fr'³Œ¶¾._ÞxÏFx®f«á@¶âT%Ë°ÀS=pÛmÊ!ÇYuÍô@ÆCkïÙ—G÷ñ2áqŸsÖT\¶ €­r^þX˜Çiµq×îôS§¨’„û^ãVýT;*ÑCˆ¬äó‚%;h•8Œ²Cg5Ö7“ÈÞ°ˆ!PRšÃ£L<‚åÁ¤ 'Ÿe,º6ß\ ,ÖœXÓÅfLÔ/Ýš;§bUùWþ»Ë}§ìÝ~ür›ZZjÁþÀ¶wX¹Û„ÇJ#©î³ÊÅ¡Èyðy--T^äëÔ¨_¿‘æëû }›¢«{RëtwÖW »BJ7Mœf8~Ǧ ýõY¡Öo 5¸ÕÅáϳžï`èdµ ƒÕ‹âö~å¹i½ÒâÐ÷rÒÞºqk×1]2ß\¹øP(I¢ž¿vÿŸ7öÄÜÑŸÎð¨Ýf@ÙÖà»|Û==²ã«¶~ J`àìêZw²[êm4`ƜВä{ËÏ“½½ ñÊ#öOvmájUkUļ)Á½´ØâK›çéxLpÔöÊœLÜ>ÒúÇ;^¯~ÓÂœ#çî>m¬YzüX¤“«Ñ»Wã{wumsbÕ̶áƒ$_Ÿ\É/¤XSÀ=bíò£Wµ]Òµ•é×××#¶Þ?wûb“ôËïêZY«)ø‰@_m×èÙH6ëÕ¹ÛÉaûÕ4>õ]:›ÍÙ1cç…þÌÝŸQ¿–ü1û­þTÿÐâ•´o‘›ÞÃLªß0zïÒýB› ã<5ŒÛ“ù+6Opøs릖ˆ€Xºt©Æ¸0ó·ÀÀ¥“ÍÈxÈZµøÖ¤õÇù€@ðÒÜ‘—êïsìÔž?f`o2{´¹sãð6´ô¬Çÿ_t*çðKv¦@JÕÝq`Ò­ƒ›·¼;xã© Îú¤Q“æúZ|@ð_ÙË8iÝÊ5q÷;×Ì÷kdÛÞ|¾Y«¦õ¥S¯EãZ匫IÓfz<(JO~“&Ô¶9qq/¾>»mûÁ&öx6ÿŽÚOÑsÞѵõÎý_{÷ÒTÇüwÖt9M4gZäýV’>LL±Œ ¡± )ÁFJ)=¹47Í jP¦¹Pбœ¦¦ /Á ]¤]ÄÌÈe؃œ—ý{P{1c¢‰Ä÷óx^Îÿp8ßsùÿï_VÜôIX¦©ñÌ·'ŽˆˆÝxÐj]š'Ï)|b{XßUÜ–•Û×סé˜ð{qÒžˆf§w¦]óYáQ°™Y×; ⟴‹½¶näÇBâ¸o=:]÷àOàäàíhiÌ ûù^©?vDÌ3v'3ºWmC£ã¦6þA6›O$^3_Û4}ö‘!.¸`cÄ Àº}*@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@ÜÑ/=Ýi9.ÐÝIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/http_uri.png0000644000000000000000000015312713051004444021306 00000000000000‰PNG  IHDRöJx>‘ pHYsÄÄ•+tIMEÝ 5± IDATxû€üüüà˜£ IDATÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþüêÜÕâêóþýôëÙÔÚñûþÿô™RBvµü±T I¡öþ¸v1£Èéÿì¡CmÛä®%4¸÷Ê!ºßþÿúêÛÒÔáøÿÿïßÔÝäïýæ¾O(wê±èC& IDATÿýöá~=/s›Äú绑:0H¼ëùòƯÍgvNú¼Œ·ƒ¢b üþÿÿ  #M1""QO. ÿÉ|E20nÞÿð–I0Y|®õÿÿÿ !WjqgwD ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÜÇë ÿÿÿÿÿÿÿÿÿÿÿäèêô ÿþÿÿÿÿÿüîÖÔåܧ™ªïåßæð©g}Úþÿÿÿÿÿÿÿÿÿÿÿÿÿþýþ ' 8V}Áèÿÿÿÿÿýó¿—n8!*Dc¥ÈãýïÓuJ 3ŽïóÔŒ^9 6WŸÏöÆb!MÕü™l<W½öð×›vV*  $Qw£åúÿÿÿÿõ²QTŒÓÖ·ŠB& !V«é÷ô’3 h®ðÿûøõ÷ÚÙÞöúúûýóÖÉÒóô½‘i7" "6Q‘¶Üþå£wP! 2R›ÊìÿÿÿÿÿùÉ¢xA*%TwžÜö８µ8P÷¨‚¯ Ql)ú¥L \¡êÿûÑd+9}°ÜñίNƒÌèÿñ¥%d„­n@<ŸVH¬äúèU #uÜãÊ…X5 !9_©Úøÿÿþúîš\]Æáöö³` ,cÂí§Dh“àtE "jÎôÇ`<$‚êüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüüüÿÿùÎN".P_f]M7 4ŸÓôÿÿÿþûéœY!:Moy~wlX1x²ØûüüþïÕvO T\*+Qw¦¨˜~Z 0¤âÿÿÿÿ廣}f55Kbƒ‡µà÷ùãÃ`/  0K_uzx_J7)mÍòÿÿýüýÿÿø»S.S73;s‹§¢—iJ$FÁùü÷Ï¢€J9]}†‘•¢Ñïÿÿÿð˜H$p²îÿÿþüüüüüüüüüüüüüüýûôãÊÃÃÎÚå÷ôèÎÆÄÈÍÙòüÿÿÿìœP 1EepuqgV/ p£Òøþþüüú¹{+B"4WfmdUD! Éôÿÿýüüþÿÿï¬g%4B^eeT>& >rÏêúýøçÌÆÌæöÿÿøçËÅÊâ÷ÿþüýÿÿ÷©U+d¦èÿÿþüüüüüüüüüüüüüüüüýÿÊ*+U;..SdlfXH% pÅôÿîß³Ža*rŒ’Ÿ·ÉÛÁ²Šr>&7T€ˆ¯Øðÿõç‘\:A'Mp‘›Ÿ“|^&&’Õúÿÿýüüûüüüüüüüüüüüüüüüüüüüüüüüüüüüúõê—W XÄÞñüüüüüüþÿÿò°[&_Àÿÿÿþÿÿñ±G %-O.")LSTrœÚÿìÃ[6~èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüüþÿüן2 `Æôÿÿÿÿÿÿÿé²g7b˜êÿÿë«U-WŽåþÿÿÿÿÿÿÿôÖªEkÙøýÿðÖxT5ƒÈÿÿÿÿÿÿÿÿÿËq$ UŒÖÿÿÿþÿÿñÈn g“¿þÿÿÿý÷µ{3h¡ÏÿÿÿÿÿÿÿÿýʼnO*oÁþÿÿýÿÿû¿V >ªÙúÿÿÿÿÿÿûäÂY"*‚çøûÿÿðžs5.µìýÿÿÿÿýüýþùåÓÈÁÃÇÜìùýýüüüüüüüüüüüüüûûûüüþÿÿÿÿÿþüüýÿÿÿÿÿÿýþÿÿè³\HADOzÖÿÿÿÿÿÿÿÿÿè­9UÛñýüüú¹| A{ÚùÿÿÿÿÿÿÿÝ£d 1†éÿÿÿÿÿò¹g(QŽåÿÿÿÿÿÿÿÿ»…@r«ÐùûýÿÿÿþüûûüýÿÿÿÿýûûûüýþúéÖËÁÂÆÙé÷ýýüüüüüüüüüüüüüüüüüýÿÊ‘+=sÐóÿÿÿÿÿÿÿØ™`Q¶ÿÿÿÿ÷¿G! ZÝÿÿÿÿÿÿÿÿÿÙ~ Ko¦ùÿÿÿÿýûôç“a"oµÿÿÿÿÿÿÿÿÿå¡V%N™ïÿÿýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüúõê—W XÄÞñüüüüüüþÿÿò°[&_Àÿÿÿýÿÿõ·K $L®Ù÷ÿÿÿÿÿÿüä¿[6~èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûϸÃáð*n}9 ÿýüüüýþJ†Ä½¼‘sH÷±•ºA^bÿýüüýýý $9BA3䧯àûÿû8h2ýüüüýþ(B$ýôçäùþÿ÷øûüúùöÿû÷೜Í=[nS0:vq5 â­˜Óÿÿ*6S@&þýüýýý (ãßíýÿù÷ùüþþù÷÷ýýýþÿþý+7><8"þþÿÿþýýýýýþÿýýýýýýÿþýü@’¥¬®ª…)úöñññï.;èæïôöüÿhlU!ýüüüýþ"U[. ûÝ­Äîù¶—¶ú;cfÿýüüýýý:k¢Å»®`9þýýýþÿýýýýÿÿþý(4>=9%þþÿÿÿÿflZ* þüüüý'8% ûãÛòøùýÿÿÿüøýýýøøûÿýüúöýýÿÿý"wd6ýüüüüüþV`-îܸÓó07B:&ýýüýýýöÛäíòF/þÿþý0?@ÜÆÛü%(ý ÍÊáùþþ $ÿÿÿÿÿþüÿÿ÷ßÌé½xd_ÿñâùþüø×Ôê.  ÿþûýþÿþýýÿÿÿ ê¸w^xŸ¹Ôóÿÿÿýý ÿÿÿÿÿþ!'ÿÿ +ÀêçÝìêÈÚù$& ý 7Aÿÿþýýÿþûýÿý($þÿÿ'Ñúèåñ ÿ&þøûüý ÿÿÿúôùÿ ÿÿðöýÿÿøöÿìãÉÂðþúþÛŸ5*bÐA^|\F0 ýï¤_X¥þ ÿÿ ù÷ûûóúþÿÿÿ þþûûý æíù ÿÿ üìóíóÿÿüñõ÷úÿÿíQuÐ¥|þüýÿõ®‹Óü9„¾¾w*ýã¸ÿô÷úúÿöëôÿ  ÿÿôëñÿÿþýþþøïôüýÿôêò ÿüùüÿÿ ,&È©Íÿÿá‚J>Ty’àÿH6 õôÕÄàÿõëÚåÕý)J( ýÿ 'B/éÄÕÚáöýýýüüüüýþõÕÌ×íúÿÿÿÿÿÿÿÿÿÿÿÿÿõÞíûý>O*ýüüüþõϘ£ëÛÎèîÿÿÿïÐÎóø&/B3 ûöϺØÿðß½f>7i¨ÌüþÿÿÿÿÿÿÿÿÿÿÌÃéúÿÿÿåÅÎû #$ÿÿ ú÷úýþÿÿÚÊáÿÿþþ#ON/ð«^{¿óÒŽb·ÈñóC}lýñ¹¡„ÊîÚ¿¦«¯âRvLÿ÷ëôóDmYâ¨q“µùמm>@-4^®úçâõúÓ°ž‘•œÂàú ' ù¿´Üá©SL˜ üëõüþÿÿ÷˜}—Ôöü¾ŽžÛñûHn9þ=vjûÄŸr³ßþöµ‡d›Ãçýܶ¢‘”š½Ú÷õáçþþðôîûñ…hßö§w”çA_+þ%-ùÂÂæôâ°{¬Ôÿÿüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûûüþÿÿð¹x! "+# /[½ëÿÿýüýÿÿÎ’N ?HK@2  /]½àðüüüþðÖwP \Ñòùþüüüüüýÿÿö¹LFpµ÷ÿÿüüÿôã³> HŒÕÿÁx º IDATùáŒ_5 (>CC2! !Y¼ðÿÿýüýÿÿú¿U;g²÷ÿÿüüüüüüþïÒrL [Ðóúÿþõ¿“k-5>ˆ»ðÿÿð‹1 ^¨ìÿÿþüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüýÿÿüÓ–0$fB/ :FI<,O·ðÿÿýüûûüþÿÿÖ—P  #,,@h•âõþüüüüüüüüüüüüüüüüüüüüýÿÿöž?RœæÿÿþüüüüüüüüüüüüüüüüýÿÉ(*’¹Ýúüüüüüüÿÿÿ׉0Šîÿÿÿÿå„B' /S{ÍåûþòÃL =Çÿúé“_Qm> #@IH4!YÁõÿÿýüûûüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüúãÅ B"QfpriY* 1s|E#Zºþÿÿýÿÿõ·JKw»øÿÿüüüüüüüä¿Y4}èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüü~~~ÿþþþ %FjV9  ':Sew˜{2ýüýÿÿþÿ9Z[H* þøúþ )Qfz—w3þÿþûîîíú7RK2ÿöé×î>AD9.þü "83ü '>KM:%:NUA/üû$2Sgœžz0 üüþöéÙï;>E<1ÿÿþûîïîý7QK3 (' /DIB%òèéþ .@EJ2ÿÿÿÿþþ7[C( þý 5pŽ§ŒV%1 þùÿ/GI(ýåã<~–Ž[-çåê%@Ri“¢‰>ÿüþÿþþÿ6Y_H)   2Fez…‡uRþþÿÿ÷íâÍËÓNtT. ÿÿÿúòãÝý(KJ>" ûðáí(0CKB% =ùü&:IK>!Ë´’·Ð,›Ç¬W#ýäæî,EWp“¢„5 ýüýÿÿ,?<. öîëìô^uHæê/8CC6þöè×ï?AE7,ÿÿýùëîñ"@SG)üüüÿÿÿÿþýýþÿÿþýýþÿÿþýýþÿÿÿÿÿýüýÿþüüþÿþýýþÿÿÿÿýüüÿÿþýýþÿÿÿýüýýüüÿÿÿÿÿýüþÿýÿÿþþÿýüýÿÿþýüþÿÿÿÿÓW9»óŒ4ÿýýÿÿÿÿÿþýýþÿÿÿýüüÿþýýþÿÿüõé˜k'm«HÆÚž9 þýüþÿÿÿÿÿýþüüüÿýüýÿÿýüüÿÿþýýþýýÿýýýþýýýýýÿýýýþýýÿýýýÿþýýýýýÿýýýÿþýýýýýþýýׇ`ª^Ú4ýþÿþýýÿýýýþýýþýýþýýýÿÿÿþüüþýýýýýþýýþýýÿÿüüü'yÍÿyþüüüÿÿÿþÿÿ÷檜‡±ÊñýûBd'ýýýÿýýý$5PBü0ÿþûòòííðóþúþïúüüüÿÿÿüüÿÿþýýþÿÿÿÿüüýÿÿÿÿ®®,,°°ÿÿÿÿýýýýýýþÿÿýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýþüüüÿÿÿÿÿûû¼¼XXööÿþZZÿ„„ÿ ÿÿüüüÿÿÿ××ÉÉ„„ÝÝÿþ$$--ÿýýÿÿüüüÿÿÿ×׳³ÚÚÿÿÿ99ÿ--HHþQQýýÿÿšVe©üüüÍδ> IDATÿÿÿüüPPÅÅððÿÿ''þþöößßÿZZÿ„„ÿÿÿÿýýÿ÷÷YY´´ÿþ''ýýööÿööùùõõÿÙÙÿ ÿÿììÚÚÿóóÿÿÿùùÿ þåå ûûRRÊÊÿ** þÿ%%ÿ22ýööþþþþÿîî??ÿ ÿÿBBüüüÿÿÿÄÄÿÿþŸŸþ``üüÿÿÿððKKÈÈÿ þ¯¯ÿüüüÿÿÿÿÿÿÿÿÿÿ¨¨[[ÿýààüüÿÿÿõõ((ääÿþÆÆÿþþþþþþÿÿþþ;;ÿýýçç’’ÿÿÿÿÿ¹¹ ääÿÿýÜÜýýÿýúú‡‡ÀÀÿÿÿÿÿàà``HHÿ ÿÿ??ýââþþMMÿ77ÿèèccÀÀÿÿÿÿÿÿÿííxxBB¡¡ÿÿÿªªýýÿÿüüüÿÿÿññ66ÚÚÿÿþŽŽÿbbÿÿýýÿÿÿþþvv¯¯ÞÞÿååþ}}ÿhhÿýýÿÿüüüÿÿÿ55ÌÌÿÿÿÿþ±±ÿ..ÿÿÿÿÿÿÿÿÿÿ„„ÿ66ÇÇÿ;;þ««ÿÿÿüüüÿÿÿbb··èèÿÿÿþ‘‘ÿ@@ÿ,,ýýÿÿÿÿÿÿÿØØë럟  ÿ úúþÿDDþþþþüüü¶»n¦ IDATÿÔÔ””™™ÿþþ þkkÿDDÿGGüüÿÿÿââ³³ààïïûûÿÿ@@UUþDDüüüüüÿÿÿ÷÷ÒÒ¨¨ ÷÷ÿÿÿþƒƒÿ00üüÿÿÿ´´——ççííââÿßßÿ ÿrrÿGG ÿ''üüüüüÿÿÿÿÿßß__ÅÅÿúúÿÿÿýŸŸÿCCþþÿÿÿÿÿÿÿêꪪÓÓÿýýÿÿ((ÚÚççÿ**ÿ~~þQQÿÿÿüüüÿÿÿ¶¶ÙÙþþëëúúÿÿ66þuu## ÿ øøöö÷÷öö÷÷üü¸¸’’èèÿ ýý ÿGGþ‰‰ýýÿÿüüüÿÿÿÔÔ²²ííééËËßßûûÿùùÿ ÿ ÿÿÿÿýýèèääææââììÿþþÿ$$ÿ$$ÿGGÿ))þþþþüüüÿÿÿööààëëüüÍͦ¦ÑÑÿøøüüýýÿÿÿÿÿää÷÷ÿ 55ÿGGÿ'' ÿÿÿþþÿÿüüüÿþþýýÿÿýýççßßááââÃÃËËööþCCLL++ÿÿÿÿüüüÿÿÿþþþþüüü¯w´»®IDAT4¼¶S<.IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/method.png0000644000000000000000000003652513051004444020732 00000000000000‰PNG  IHDRzYús_sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ ªS , IDATxÚíÝwxåÚðû™™­é! „z'ôÞ¤ˆØ±ë±ëg¯ˆ˱¡Ä‚õ(Rí‚ ‘Þ[HHÝl¶My¾?6Pìžßµ×•ìììô¹ç}ß™Ù!f†BüõYB‰!„ÄBHÜ!$n„7B!q#„¸B‰!„ÄBâF!$n„7B!q#„¸BHÜ!„ÄBâF!$n„7B‰!„¸BHÜ!„ÄBâF!q#„7B‰!„¸BHÜ!$n„BâF!q#„7B‰!„ÄBHÜ!$n„BâF!q#„¸B‰!„ÄBHÜ!$n„7B!q#„¸B‰!„ÄBâF!$n„7f0³¬ !N¶§TïÝD;M#}ñõMS’­Jˆc÷‘¸¸øÞ=ºUëy Ó$/_{cÒäÏæ6iÛUŠ9BKÕl‡~ùáëéÔ«W_J7xi*Jac{¼’6BÃæÀw¯û«û\h§Ï¤X¦aê²] QU5DeYÕ}.äÌ”BâF!q#„¿ƒ&‹@ˆjÙòù¼^o¥î‘‘‘ÌLT ® ‘¸¢ ‚×ë6mZ\||ùî¡PhäÈ‘Íš5“ÒâOcšV~~~¥ E,Ëòû«Í r‰!ªQ!Õ¢Òt<ÒT,„¸BHÜ!„ÄBâF!q#‹@!q#„¸B‰!„ÄBâF!$n„7Bñ›ÉáÕNÈ›•i¡ä™¤Ølî8§ËÁÌ "f Òu1ul`…r½yEŽõ%+<üƒL†/ËWr%Öµ‘¿0ë¨-®ŽÓ®;Jˆ`½¢BÃ0Rí.Gdœ¦˜Qz23,a^.´ˆ¨Ø8pÉC؃ž¬`H/™fR4‡ÍãpÚÁe} ‰qš­0Ú9ïþ ó£âšÊ X_Q0ªV›VW¿Ù¹u Ã`&"ÊYúÌ€®ŸÞ¹[S€¬¢}ß?{…Öþ•‘7œOˆ"Õž·ô‘»¢o½òá[•Ðš¯îº>åÉ5ýZÆšðŸ™I¡œÕo.ûî›Üô½!Ë®ŠHŒ«Ý6õÊ—›¤D2—¤ ‘wóÔ™o¾¬Û»^öÚG1Ji’[>¹kýæm6{f O·\ÑÉjwûwßáƒaU“Ÿ¢7g"ÅÑèšOÏï×Ä°ù3š8vÝ W$Nš_×MPüõåƒÜ£í†_Ö/êÜ£LÖâ:ö2rî¼öíëݤ~´Å éÓïØVØdă×9€¢ÚìŠRy¯g©T´õíïÞ™Ñòâá/}[§– À³íûE?¿äÕK\ãfÕw[ HÁþ _hMï«ŸûÒŠ•™ÃûÔ4Í’‰V5g|§1Ï¿mFAúÆiã~ùú¯5yؽaJGÚnÄéÊ ùCè„|BÍö£ïuEÞ·ú *¬›º(1µOË ¯ ­úü /üƒLTgÔ¸öÉKþ÷á$éÙk–-^WoÐÃÉ1N>Q¶A3¶.š4ÉÖåîQ÷KŒVƒE,‚3eÈù¿ßж{Á»3-ˆ˜ Šþ뮟´¼ðòú©Ý²>ÁßQÈ–^2Íl¯“zí{ç\62ë›»6îÐ%k$nDµ(ê3T»›H±‚>½‹vzôúm(u.K©{põ7¡`Óˆj{ó‘é“~øv—âÀÎ÷F_Öÿ’nt²ç–zù6ÓŠIí3Tµ˜"",f[J« FòÎwöç EE΂g³j h“âjЮ–ØQPåÀÃ5'Ë@r§Ë#c(}Åw–¬H‰qÚcHCáá F Ó´17ÎÚ5L­IQ?uPÑÊ Ù>0˜mñ½º÷íqhÞÃ;fݽr³½ÿ­wE„p²g²s^z–j·G%$˵°1#"©›ÍžwôP€Ú¿ü‡ýõSû8‰Ü­Ï«cãÝ¿.R@Ç>«‘IQöHÁNKòFâFœ®%2~9´é§C›–¥mZ´íÛ§ç¾ý¦»ãm[؈röÿ´(fèãIn(6jÚkÒ¶$b1ÔFcŸmdß÷ã· kv½½~X‹OúÛ·¬Š¦Vªñ ("˜Á€‚í?åúÍú=.Tm€=¹çèö‡—~—gR5"‹MY§g i*®ŽyÃÙ«>Zö‹Ì€boœzóÍR[©‚¿þg_^dݯÍ}…PàÓ`nÿå§ÇZ&lpÝö—ŒÚ÷Ú­.º@=¥öYŠŠt±a½>ÄF”ïŸÝŸmp%DCÁ¡_fYÐÎðÈ| è~GÑÏ+ÖæíkšU—Ì8Tà1.g¢œ—’¸§k Ê¢ú—¾u~ÿ&†Y¼ß›:,“xÖÏ\âªÝ*>*¢$+"ë¶kµkÅìô+ÇÖÖ¤ÚÀªªžj¶Å·í ÌøþàÞmMt6ÌâsÖÌPÈÙ4;hëRŠ¾i×O»âRGE:KjOŽ”„º™G¾xÕÛõIWUQ"_úŸ'¿n‹!ŠÄÄ8mY!ÈòÈ0(x`ùîüPÊ…ã{÷oZÖ=”^´£ßÊov\xQsü®Z Õ»¨W‡O}ª^ê×MâÉ4©úåÕ¥ ÓÞ01ACö7Ï¥Û;_~Ý3qµ´îäYþü¬isÒ÷Üß$ÅQ)lˆH£ƒ?Ny¢È9ªsÿz$m77¢úx˜Jß4G7’uoZ¡»­VíÖ6­x¾`øQNPm![ìÎw[%A) [·2u4¹aÆ‘WÿµàÞž‡†]—\»–‚gß’õ ÕpW¿nM-_ÚŠ¥j¶¹<Ê®Zå®1Žïv~ÜÔ»7¯hÖhKÏOÛðƒK5ÙÒÙ;¶}÷nADÏóy"ÊbS®ó“¸§i´˜W:ßCDJîž_k§Ö‹†*ë¨-:u]³fVú-k‡¿o™W‘XæáùÏ)ß©î¥)m[)&Ãޠσ [®ûpõ·Ÿ-[˜¶Ç68ø©E ê%ðì\–]Û´Ã¥j¹óÞ ˜®¶ÝzÅ~±ð;ߨÁ°,½èÀªï×mqMzsä 6‚YzU²8ÓŸìDèßã¿“&¯ÉŽì5ü*Y%'LÈB7Ê ˜dsƒL„‚Î613©dwÀÂ4°¢’Í ÃÇfIá–»•O"Y˜‰Â[‰¢‘ªAQ‰#Ëb ’Í+£ü$™¡Øɦ!äƒê@ùÖ"fXLR®9%6>{æ¶ÖɶØظòÝMÓ3fLjjª”nÄŸ}p  ûÊþ/ÿá?¦{ø­…¿¤¬b !_…˶êQÀ& ³ŠaA¯bÔDÖÒ‚ªªáH¢æ,#×Ý!$n„7B!q#„¸BHÜÈ"BHÜ!$n„BâF!q#„¸B‰!„ÄBüfgøá XXýkÇ¢èPL†ÜÞ,ÄÙ7ÄÜeòSçMûë²€Uíçÿ{éPÏ!Šü¦guÜXfç·Çÿ¥? FÀù·Ÿûú.vÈæ$ÄY7a¿\ûðÚ?¥êÁ?}ȆÃuÞÝç×_1,Û’7€¥Ù —ÆÚŸ?³†¬¨² q*äÌ”BâF!q#„¿ÃYô$fÕVöË€¡ƒDÇø À0kd³¡R“°ê„¢jUÈᄂ怀iêÔ˜™4rØôý¡ç¢03r¸`aüJHs‚,èÁ 1Ãæ.é^2— (6Ø4èf&͉ªŸÌK°Ìâ‡Éû‘ágÓ"{Då•b0ôÒq13T©(~è Š6L? «Ê'æ13H%›¤€M!°Åd#› !_—P1Cu@U ûå+‰›S@0ýi+ÖùÖÞ­[uÓRܵêv»¼ëù—EE:&"E_úÑE7øÝîÊ[“êè?nUäÏç~9ç°¦*¥û€ BÍwì­TÎ&%gÎ;>ÖýÊÛ~úxr;¾mÓ6ùT§S#ÿÊkÞxßqÝäw"þÈü)Ù³ß|xB—[>OíRE~A“Õf;µ½‡8”õÕ¸Aþú“ÆÜÔ·ücvU%gî­ÃsŽ¾èÖT¥´o>ôùƒóç/òôªº¹ßŽ’qÄ(Ÿ\á,³nƒöC›rŽùFÀÙûÕ•ívO¿lD®ÝA%ÙBΤ”þ·ö6Êi'f&©ØôvßöW¯þW'CÈ¿oê¿¿ÿê×n¯lèP“,®rÙpî/-úVN^0²AŸîW?Y¿nl֢羙¶çâÉS¢ŽyБ¹ó­+VlsñøÇmÇðIÜœjîo\ºpuR¯k»\u¥ÃFzaÚÞß™¾|z—Þkß®v¸j©­Îˆ'[ÕŽ(·2È– ­ëøÁõ¼D¤hÁí=˜Õ຾ýRƒŠ-á•°iUå=™½em“;œ× 5ëÄü¦b‘MµiÂ6MŠªÙ«. )8üÙ˜eÙ£Çüßõê©N³+ªRUw›ªªÇvU5; Ev¸ä?-@zÁÖ53'Çžób«†03EEFM{ø"äoøàÑP§ñÝ;$Y&[––fR4G|÷ºtlc2À¦Q¸{óçÍܸqô“ã#-b@¥ì´õ…miÉ&Bió¿5!'¶•Óa§ã-_…sßÜoWµ»ä±ÎIQ…;¦.|jLßgæ4kÑѦ|ž±_oQßV1QPöì¼dóòBY#J•¼‘¸9‘œE–,ßÖò†Ïúõkkášµè{áÂç¯Þ½ðÍ­žqjá£-¢›õoØ<Æ<öáÚ=ÖÕîϘªg'¶kØiPP…+&¡xƒ¬8¼w¥ÖòžØ˜ZŽöý5§L¿ßr¸£¬×ÐM¢9£4Maf"²tŸ 2“ꎭT…1C>#di›Ó¥ ²BÞPдEƨÄÁ ¼~5"Ævl„{逢:"m6€Y”¶w_Ðo óîHÃ_¨:¢˧‡t¦¹"5º¿Ð4,¨v»+B¡?zöš­†ÿf:Ö³Ùd@ÃTwé\‹‹Ÿ™Û? rÝž ;50²ùàLnÓ µ¿É`f¢AÉõk~ùüë~¾³_·x"X‡f¦)í{%8XEÆìg¸Ó3c‡Ù?½qõq‹iÞ½+—-­ÕëùNÏ¥}ßPFן>ü¦åƒkÛ(kÇú º1fÝŸÏJ”FPHw7™à}4ûhBt-Ì`¾nºN ù½–EµÛþØR’¸9SX¡ÍkV9c»·ïÙV×Tü¬ZK‰pßL8]ôçÞ@ 3·ìjrkWåÐôǽÔãÎïÚ¶M¦Œ>|êÓîƒîÛs$61"wçOFÌ!>¯‘³aÑ;¥*Œ«S/¤Gµíi(d•B;?ž÷Þ;9¡˜¸(3ÿˆ7©ßî‰ióg>ÿd“kçôêYTdL¿ñ›%ÞQÏL¯m¯ôüðàî™_|ò­årzíqÔ>ø±WjF`ïG÷îËõçËE“V·»òΟ^¸¼F»; ÏæÈýÐÚuÑ}ïîUoãÊu·Ó›±s{­A¯¾°ëiQ#&b†#¦©#Âé;°»Ç+*2~øÖݸ¯KU-ƒ“¯œ]?©¦UøÓ ®» äìöçùê÷9‡ ¶tJl;\ùì“Ãþ‹S{Ôø~ïZ l–Oì—ód‘—s¬ZƒîŸÞºƒµyûþ6MkÀÁ¯G¿ûÚµf%¨þ´ñDA}@Rô9»ãÆ2…éí­ž‹´ *.Û„ŸFëpËM†7Û—2ÊjSLZ´+ÒE¿)nr¤yÚNqZ‡UÍîT@v§|¿fÔ¾fÂÓJúÑ5³Ç_µáÇÛ ©³oáø´´¤‘ÿ_Ó+{å´GoW=¨Þµ_=ÿ²ãœ§n¼f[únö·/¬ß}p¯¤ˆ&£ ørÑ׶mÿ¡»àÇ~ÜÞú’O“¢íV¥–Ö7¯;0úÅʼn®ùâÑËWνmä›\óöÞ}£|ÉW¸ý ¥`ãJGLö‘—ŽŸäR¡ÿúÈÿyzNóG®yâ_ªŽŸÜüóOÿÉ:+ö„ólé>_~¦R®Q7àüéÍýáýš<3¨Ûâk@zæ¦MyI½û+ Àä¨QæI®ñùÒC¡ÄI% ¸£“å`^.šô»$ðôràƒ-¢†¹sJ“û¾Ñ8Ú0ßsÄÑ©K‚£»«:W¬}ß žþóÏïS—lØ?iðw‹¿ì4°·C’ÏöÒ BÓU»&1 …|¾ZõÝL K‰iÙý‰Q.Šv½9|»Y®©Ð Ø>yÍS×qÊi£"géÇJë~1Ty»g¸:œ7Tñ±É¤ºl‘Á#ûH‰L[¹)zØœdôSb÷Þã¾ÞȲV}çuG÷bc%e줖ÎY8gIÓ¬ñ¶wÐŒ >¦Si9ìºx `ÅÕ(")Îwd·…ÆŠbØ0uƒaÔj9ÌfÂ0¡48Ç©Ýä²+´ LæÄÄÓÚð®ÍtᶙŸÞóQ…Û#îè?%d›ÛÓ"ü‡·®ýô‰<£Ó€þuÁгvfûým;v¥S>p¨á²ÛÊ5íiveø¡ÔUW{ekºÑ­®f€©Ew¨× :|ÎË]wh´ç¶=GlÀ4Û÷©k ‹juia¬Í ˜ì ÕÙ7¤i…ÞÒßfy²ÒXUÉÌÏ9b5uw8n¬·™°y@+Õ0Ë—Ž œúéOV8óŠŒz}:TÕ@ks9ÜVøô¶BD ³Eæ‘ü[\½x6"6׬¯·äçZýÖµ¿¨áiç¢ÃÙ!×Π»M3ºýÕÏí}þÎծΗ<}¾ªsg}IqGÆYáRˆ…-³Šƒ?[š+©¸"¨Ø˜]ÑÑ6.éd7…Y±n¼äÎ;Ôr£?ôÕs¿[ôg¬>NŸqÃkSÍpX(¶wb‹Aãþ[Sc”wh}{5L!§^PÝ0Ë66M0)€ø¤6µ¶/XßõÆ®06”¸T›²€-º~tï]¾·ÙˆFsdc§R¼Ì`·‘eÉHÜ€—»V¬_ç„.j¦°8ºÙ£Ÿ¼5gÆ»÷L.ß³ô}Ç4Ÿz ™ÉÌ\ÀgthÑõÔ¶ýâ«@¨´¶pùªœÝú‚ãìzéÌæt«Å½êÞtSgæœ|¿cWLþý'i+Ï"— ëÔî>e3ò¡¬šÙÐõ?k&z¸_Ÿ.á•¢hNgL-‡S5-†ÜmßØ{Nˆ!˜|J‡l®šššSX8Š»øýlÅED@rJ¯_ç¼_ w,>Bh%D†=¾qr½ ›féç?P¼v$B~‹³âªbR)ÍzrfíÝ•§* "¶Ø4ÁB^õçV¶ ¹»~5Ѽv#÷)櫉1QÁÜŒ|( fEEΖ¤*ââã,ö;âš&¦´IHi“Ø°m\r£ø:U…A¤{W¼=!ñ²¯õVæ¿òrˆ¨8%ˆN\}nc×¢kÅ%7Ž«Ý8®v㘤:‡®]*”spuf«ÞÍa€O°™ÀpÆ6vFꙿ¤¢ààOfô ¤€‘Ô2úº#i:UÑ&§5ê•ê=ºÚç“ö`‰›ãÏfã h•·âõ+V.ÿ…ì°»Èa³2VLþjÒûˆMŒŽpr¹»¶Š/UŸÒ¾É Ù¿Ti~m 穇,®Q§SÏœç2ƒÐdþqÙÆBM% ]»‹ ]ôµæ&›ƒ3mÑKÃçÍ^Í ù׿yOVôð¾=§ {*6ÖO³æ2 ¨æÑåm\±âdG^"RLÝ«9 ªÕsß!pÚôhÓ(1Âd¬æ€Í ›ÃI€ê ›6@dúÓ·|;y†ŸZ\Ó&uk\<¡ ‡æžÖ|¿»éU7¹M€Ø^¯{²†£»­rõ:ÛŽ‰+HÏÊóIÜHeêøM jbŸ§ÙßlßÌÖ¿SdwÚô îNh×øÂQWÝWÃ>Ð[Œà¦g;m­ÜÚ§¶ûVÏÞ]JÇÒ¦iQÕ5OƪMnë©0°iè¡’Ê‘iêA.Í-fÓ©¦ ‡Œß³÷ñ¯në“T;¨ÇtÛ}áÿŠ,Gwuÿ­sßÿÏ;«ßŽw¦ïw6ºh𘮠#ï—÷7l9ÜéÁ™.àl7ìŠ!ŸNyaW÷ž­»ÍùÏçEmzô¬8vlAË4@‹MiØh銷>½sv«Kž´ŒYV´ÌPÐ*÷C2ݬâ’$¶ôiÇT¯ SUŽi¶L=pœF¶ôÀ1-Kl†‚V#)H›7Ç^·ƒ»¤ÕWÕ·~ïu¹:BºK_ùh÷uŠ¥F¦Žxê]§o߆éãâ#/N©ë²,W§ÿ›äyáÿfßœªE9B†«þ‡z·M2L&"SMnÛ)bÁ¶µ½úµµŒ  ³|IÆ´·nÑ¢è×_öw'Ý(ßÂg醒@9Y+Ÿ%êÿNš¼&;²×ð«þäÙ3»ÙÖÝ8nõíOª:ÀFÈWh„B €TÍᶻܾM‰ôååUY&×\±§£tæ1ìqn§áÀù· o°lÎë;Ùé ¨ûòrí±IZ8³LŸ×SèˆL°ÙT˜EÞ‚"Gt ›¦~O´g„“3Pôû-&›;ήù‹ Mwl¼‘ðý>‹¡h{D¬¦ £(+ ;"bc¨ø®/ߛŮD·[ dép¹££ÉòÚ"jØíÅW1 ZJÉy}Óçóx,V‘1º/_qÄ9\vÀÁ¢Ü|{\’M _}âñ‚Îè$…Ì€'›µXW„£â2²ùÙ–ærED•-<‚~O®QÓa?¶dmò2-W’ÛYþ(høs³áŽu9-.rÈsÔTÜΈÈâ«]X÷åçr¹›$€l®˜ÄAA®âNr:Ôðêf3ðzL‹Í匌V¨ìkV(×ç×"b¢B…Y&¢\Qî²;Á†?;hF:5¯?興‰*“ž_ä5ݱñÊ_s"ÜæÀgÏÜÖ:ÙWa‘™æ˜1cRSS¥ts¦«fˆ³GTQ¯r¸ãkÊP±ÉŽã~hsÇ×,W0rGÆ•4⨑ñå'ÆSÖ§êŒq;Kïu°GÆ•¶@uF»•Ï(kI‘y5W|íâÍèšöâš¡;"Î]¾<àŒ®0mî’Omöšåç/¢FÍr߉‰(ÞÓÕò\¾®êŒM:v™j®XÍUE;š;îx·©Î¸ÚUDýqW Ù£“*/ü¸šÇ[i¥ã-¾äJuºbœ•ÚfJ*Ôñ‘vpDÕÄ1}h® œ‘ÎòcŽŒ“â‹´Ý!$n„7B!q#„¨¶ÎŠ¦b&:ùUø¿sȲ !qSN‡÷ŸKýäeü%CjÐÈï» qÖW¦XQö¸Ð²ÙÀ Æ_ðbÓîüù®m>Ù–„8»K7Lʼ×g[ñƒçTjH~1[ˆ³;nЂϘ$k„8»+SB‰!„ÄBHÜ!$n„BâF!q#„¸B‰!„ÄBHÜ!$n„g™ÓèMRTECõy²£U)Õ¾ppºÄMÇŽ>êùÓÖ–ï …²³š†)?^õwch6»¡‡dÉŸ>ã‚#:6P½çâtx¬]ø1c†Qù1Œ3fÌðx<$?ï  SÀ‘ÇÚýöÌ# i•'FUUEQE‘¸âLˆKYB‰!„ÄBHÜ!N[§õO£+Šb†ªªÒT,Äñ¨ªZ]&õ´8~GŽ‘íét;X–%Ëá4ÁÌÉÉÉáKI$n„¢äX%‹@!q#„¸B‰!„ÄBâF!$n„7B!q#„¸BHÜ!„ÄBâF!$n„7B‰!„¸BHÜ!„ÄBâF!q#„7B‰!„¸BHÜ!$n„BâF!q#„7B‰!„ÄBHÜ!$n„BâF!q#„¸B‰!„ÄBHÜ!$n„7B!q#„¸B‰!„ÄBâF!$n„7B!q#„¸BHÜ!„ÄBâF!$n„7B‰!„¸BHÜ!„ÄBâF!q#„7B‰!„¸BHÜ!Àà’?\Òþƒ²?7Bˆ?Š˜,„,b²ˆÌ±˜-#&‰!ÄŸTº!(¦Má€I†ƒYÑ-çVߺŒP™ÐXº!f–/Ä?"ĆÝР2Zí¿"÷»Lëp@Ì}-Þ=#çW“U.Ä?P´a&@cmæ6ßÚ¹‡gçÙé×íŽ"=î8ÓêS7Bü3LËRT¼·í¹Cî!M7…(&&èM1Û0LbõŒK‰!þªò “¡@Dá.XÄ€¥z$pðÊ:7©†Ýr„8I‹mæ0´áµdŠ”n„§8°ÈT W‹˜“,˜ª 5ÍÜÿQæ„B­À ÍTÍ8¿³Cô°î‰—Ä‘ Ó™Wº‘¦b!þªâ =Ã8\WKÙ‰ÁdZ¬ª0öíš™;1K9j3Õ€-ÔÙ8gTýE –Ť„‹Bg$9þçn`dž7—¬Wà.íëw@ý*Ë!ä´Øˆ–ž?õÀc,ƒÀ¬¨&g9ä?›M™vÃn鸅î¡ÉIDAT9ö±Kêßè CQ‰p¯¾³7nŠ63õ«µÆïÞË­ß}°õhQ…²"|Û)>ùѵEŸ•šzÁnƒ€ ¼ûÚ×Qñ+¦n{>.¾¸”Ž@£²OË¿ÆmÇòGªþˆˆ:Þ@þ»ÕHþ¿%Ù‹&mÕ|ȯ:Á‡Çê8¹”ží*Ì6öÈðk¡™‡Ÿ†ÍÐl¨›“ŸjæèLlWŒhÍ‚Æ!Iéæt);Ty¯ªHÁÇ;Ä—|b­žþñÌïÖ[Ç-ð‰Š hÖ+“¶gU.œDö¼þºsk8•W\S;:Ö®lâÎ!¸éy4¿… fX~³ðÃŒ‰{b¯Û:ý³YßçlõÛö3¬§R˜ñÉû¯þ”§ùߤôf­®¿êÒÐÁµŸ|±°ý…÷ôN‰ñêç¦8Œ‡ Ÿ[@Æ·xãGÜ4o_\\"'n}ûbÆnd ¥óhÁ:ñ!À‚ÅÃ,îPt 7»OJ¤q4??ePCØ3ëõW=o½®O¢ìöÿ\ÞÀ͉¦=?ÛLƒ ¨4?gÆ>þUÑI…ûº$«™, ¨€Zr$;cU—Ò dúÜyاßútÿÑÜs'í7dÖ>ƒˆkF¿äÕÏæùXÍÙ¾ôéÛGÝýæ"‹ÁCÓ§O{çÑ;îúhKƒæ-ùм».5ó08£b}l¨P¢c#ìÈY¯Ïv¨cfrÇk%û3ýƳÖÔög—V áhé3aSaäàÖ›Q,Û>Ï» _¿TEe g~)ûŒä 7,ÅëÌ]ÿc´j7m΋ÿm™ÖL‚B ÆÙ³r«QÜØcœ| Bø’K”vÓ°ÂÝA†áTN14Ínø¡%«GÆ[Ñ,I‰?âßýqÍtd½‰$[m\r˜¡§ã~{…>M½Š¦b9«]Ë7ªÃ°ûÝ¡8FයÏD(ÑÌŇK¥äZã³gW£á ýÚi[—ï ¯H"kɤ'ï÷/vk©lø~Ki0ðÎù»Œºç4qÁ:ùì˜ÔÐÚ°ø0JN‰{²ç†Nš1ÌÎ._ÅsÏ NFl.ι®\i B(E~„ô?¿5®ê‰w€…˜Ý†Í„Ò;aT]³~¸€ÌÄL ÂÙT²©NqÃúÞs_ÒæIw}¼*#3sï/ß¿4ó+ÝÝÉ ¼éFíÇÇ^ÿaWVvvÖÁ ÷ß5£Öàj¨'*•(ªSѼ¹»¤¥›ÉíÎmÞpÁ”û×ì:˜}4cïê®pÉÃßdKpD¹LßÖ]ûfeLùûÖ¼ò³Ë„*^£E#²^¿;>@³sñÃZìØÍðßûÝz}ÜwEYïÞ\lß^áµmvgüÆœÈ*˜öÊï/;*×ûý“a°Ýb·Fž.®s¡já-™JŠ¬gÝê©6Íü–Å–¹wù´kÏïÖ±}ëŽÝúMøßâB“™-6ƒ[¾wìÐîݺuìÖ£ÏÝ/~–îÑ™™ݪeóW¿ØQ<ˆçö‹[¸v†ÎÌl¥/|­oÛ”6m:¼¶¢ˆY_þ÷þÝÛuéœÚµ×À§Þ›W ‡Çi<}c»NÿÏ(™ŒŸ¨Õþ®Öú=°¡°ÆÊYÝè_~€âØݸ¸Ë±»w¥* U,¸3 “W:ˆ*ôVù t²AÑ {òRõ)öV6¿Ùpã[’5ÿ4—7¹]7U…u ZøŠ¾³º‚)­‰gàQµôçœXZoþé6G¦âÛ3‹KÈ8›#GâFñ7‘ß»BHÜ!$n„BâF!q#„¸‘E „¸BHÜ!„ÄBâF!q#„7B‰!ÄUüü0FéƒÄŠŸÜZöNâFñg Å!‹L˜°˜™-²|`à fž‘?T!q#Ä?UºÂšbÂT Xlyž¶ÿ­µy‹‰gdéF“µ.Ä?5Ì ;,EcÊ6¯Èýfµg^ÀA»2—uxF–n$n„øÇjS]1mÖìôÉ[õÃC6§¦Z¦î ÿúß™—87Büuµ%*ûå"$üÖBž–5iããþ¸Ëd8)h©Q^£oüHTñxÃ3"`åÇC…økªK`ZdWÀ )á.˜d¦ ÛâÃ_,Î)4ó4…üNÃU 4‰n^Ò•‰Z#qF>ÍWJ7BüU£°Í$"X%EË (ŶƻhkY° tá.­ë lÕCc øIFÒv#Nv@;öWÅŽ}$3ÂÂ:ök¿§¼^nŒU ­âC²ªÓÊ?Äëw-¨r3ü7Î;Õ·Ù»ªcdo@%ƒUK%Íü>cúró+8†eØÔËbniÝÛÁ6…u†ÎÜÇŸ•'ÂVÐóã‚åÞ?0ŒÀþU‹ÞiVÚÂèðUíZ ¾÷u}×+Mâ›}”fˆ°÷gÜ~ì„ð[ŠÆÕ`sVø¡¾ ›W—|TñÕö°)Tõ§ä"_è¶>úüëÑàwšÇ7ž¼Ý{¼‰ˆvN‘Üé^Ó À¶å ³‚á²~Y²(Çü'W³±vñâ< H/¼ã’VoøÂü»!Ñæ÷×ê1.@_Î2Ñ´¯¿Ê|}¿÷@¸bdˆ±Åÿëæ¬ {Tâ:&MìÝÏié ˜gúszÎƸaBQæ¦ MÎùýðÖ|ôòkühTî^ãÞnª­(Jò¨KGvŒq(9ízaò6Ì߆B¼…X4_¾ŠÞ}°Ïbp¸ì7Pè§ÜkÕD [ áñ °[¿€ÓPTžl¸•;žº©žªqâ°®ìë<Ñ Uí‘1Qnªjyï<<~‡×+ó‡'ÐÿÉÄzÆć_8dÇ…;":2ÂöGvEÕåú{wfÖ5OÐåð #|\QÈÌT³g¤=£š6͈Œ Ô½·Ñ+1öDféV*«|FçMu©L‚mùyýÖ}~¸RZuîÞº^ɳsÍë~Ú²;=d©5´êÛ³ `ãÒYûìý‡6+X¸hU~PIjغov‚góŸÎûÊkæÏ™6½i§s7­=gͲ•{3 {T³NýRD‡Kþ} fo‰»rx«UßÏÛ}ÔÝmà€Ú.ìš÷þ§ë³ƒ¶MÓÿ÷Iç ®lå_6{f^£óFtHªÜSóB5²6lQâ ÈEós æB W €×!£9F?‡ÝGÑ0ºl.#UDFU1÷îÈâ"\àŠ,ëÔÔwk‰ÝîÚ8µ† àÝ f­CÊŃ»T•=¤ÀXõý7{sƒqu{è`‡ž½Î÷Ÿmôpâ—ÓGجÀî]>cÑÌ©Í; ïÒäç³sã‡ôJ:°hÅæ;ëµêÜ;µ!Nüļ½3ç­í<`¸±{ɺ=ÙZtrïýkE꫾Ÿ»;;“Übà€Žî’uêËܱ|ÕÆl¯™X¯[Ï^IJàà¦ÏÌ>.œñYZ‹ÎÃÚ' Rü9»—,YS¨«IÛ÷ëÜŒŠ×¾¾mͲ­{3tÖ´îÛ£½¤ÒutûÏË7í²³Í€QοýÀJ ‡a'CÑ©ˆ-ØÇú{ÆùìŠM Ö0šÞÜò!²dÚ €M=£Ÿ{§U“°!"lúà†þ»&±e×Úú¾ ûüCyû© ÚøfÂÅÏ}¹7¥ë¹Í¢óV¼ú츔±ßÎx°°ì›7>Ë/˜ëý®Å9¸/øÚkCî™8á²î–ßspÿ^ÃòNKOliÀ»çúK¯Ûæ³õîÓ£pçÚ‰/>uÑãÓîÚ˜=ÓŸ}3ÚóåšMu.îÝÀüøõ×ß~·×'_¾âË9œî˜znzzfk€÷‹—ÇmÓzD‡øì„ËîÔŸýiÜùPXûöÞ~¤8kJõÙó¿B¤á gF÷P_ éuÍ#-"m€¹áã_°F\XUÜØ¢ÕÿÝ5hnnó†Î‚u[v×úüÒß|@3C黶’•‘ãögmó‘‘•žžP³9,ã»i—éû> lê{Þ`}ÛÌ—_™xés>pNÓM¸wûË/¿Ôuî¢C‘)wÐ>}úÕI‹n¹Ë5k±{d‡è#¯¿ùܬ!¯¼7n°J(Z=qè¿?PštÐ*fÍ'$už5sRïÐîí~Ò³ÒÒj· ï¼Aïžë¯xÞݼ£±gí¶£|ñ‹Sè×ÀŒ'.ž8÷@ãnç6rç¬xeÂø&ÿúvê=±àó^½ìÉi Úunýî éPÿöÄqs ËæÍ";`£OýÕb~ó‘Á=»ö]œf…?Z6®OË ^4˜™ùÐ’ÇÚ§^“ÁÌÌ?¼zI‡7o-*ÑÏ_ÔîÜÕ-fÎ_|S›æ­ïû*-üQîü§S{ X¼ÃÃ\ôÈØ—Þú^ÉÔ釶oÚY2¶JþXüÆ LN^–_Òí–ÅÌ<åf†Æ/LáI“Ê^o¾É;s*ô|àxz~¥o—ýe‹ÙÊÛ¿}ëÞŒcG¸ûó+:´nóÐÌíá·[Þº¶UŸ‹v䘙³>îÒ|ÀÊBff>øVÇæC ßÆcø¿±Oï¾CÖedéKÃ[öº;óÄk+sn÷n/~äƒð»üU㻵L¹âõ á·Ÿßwqß17d˜ vŽíßiì㟕~íÑ1m?´€™Í=oth1b[x–B…\߯w¿¡?¥‡Âý½}û¶W|ÌÌÞ¥ãÚ´î?msxº¹à—©}ºµ{ñóm–åâÊίœä/þ`å¥Zµú\àïÝh×d-¹ïàù“öM`È™zßž Æí¾ìé½×癇-Ó°,=¼œ=ªKÛµvá+!¦_—Æ`0s›K^ýuÃŒvª1újwËæ経 ßKÑ¢g[gÔÖí?3K§Út­nEýÎõÍì#@H·+9ßÏ^ÛôÚÛ[ºÃÉ‹~·Þ’°kÝ’£ÅÍ2Awû›‡× !®i²2<>Ì ÉÌlK ‰u›·iœäFÅ#1à @¢%óáÅ°¶ˆˆDd$"\¨wu¹‚‡nÄí·—½n»Ë¬´Òy/(¶Aó– “«<;åw÷¼ã¢æáÙiÕ³¡Qäó„  è¡=d€X–5A¸j mY£¸XÖlÈeñ¹Ë–fž¼2Ñ»k—píQMno3.¸¤}øƒæµœþ?dàÈž_3 ‹ú^~YÉÖ˜4`èPï¢÷÷ÁpH/™7+Ûpt—Ú¶ð”·îQÏ:šæ~¶:*µÝЦáµÚ¯µæüuû„ìÚz´íõW;ÃÝí–óâ ëï½ÄŒ‘R£¡e)þPZå-ð|®‘˧ú/­ws,ׂB€Š³ì‘áZu)ƒ¥åijl„+üˆ÷ÒU¤ïÍÖ£"b•tH‰U¶xóÁ[YÓQ²ÿ“¢ Š‹ô8M¹ùœ•²ê ç¬<“lÀŽè(¥$AˆˆË­sÄFÂbäù@€cïÀ€(v¬œŒÙyåNE"P{[ퟷE2G$E•¢ªãä—yZ¦’ØÜY2Cš3ÖeËO/jžä{v‡»8‰˜±%i®Aðzs,ÍýÉ­ýf”,û`‘§°P9X€Z•'Ü¢˜d[éªTU0ŒÝG˜±šZºö£Æâ‡BBG³½îŽ5]¥óšÐ$«ÿæ´A4Ń)ÀÆŒýL4¦ócÿÕ”:[ª X k :«§šÄ ‘Ó¦2 3|&§´Ù€\šbšºÅá‹0°lªZ¼O¾3Ùí0»<:íµ!uŽ¿ÙüæÂ~©à Ö­AßsÁ ÅŽ±7·×LY€ÙGTÔ¨*³þÜà·/| Å­ –2-›CûíIwìÙ"Õfpï·K.H¨ü‘ÿðɧœ¡¸52,ËÖ¾ÐÃk_ÓT3dpi^ ƒÿn­‘L^ב©G†TwdÍ>1ç[`ÅRÀª©@9» 7ÕæD8µnï x³²üá†ã@îÖ}hIž³g«ˆ¬#9E!3|ö Œõ½atòÝN!HéÚ~ØRÒŽ p$3ÿ—•} ÿ-Ñò_è®àÑG …¯l/ÎÊ-{ÀþÙæ²)øÍ÷§P¹;|ÊwR4=mi~Éðü™ ôºíjÿ Á—ÐÀålY“]ºè|9…FÙä( -(½Z¹Ž¤õ[VñÔù®ór³Ä:pÔ­ؼ.³äûæšÅiŠò7ïÚLP†ÃTÓ2‚ÀmÉãU²…‹{g %nNøi0zL+Ãóò»ŸüÁ çë—îüt%ZÇ¡Ý-76<òË“Ÿ­ éÁ@ °lúÇ:úž?âÄ[–bskÁÃûrMHxÃuÖüûÿ»$­( æ>5¦ß¥÷ÖO¸bW4¿çP¾×0@ä›7åÕ©+sN,Ø€˜õ¨é?£ øõ{tŽÅÄ]¸÷ßzÎ /¯â«¿93¬­_¾3yÖë7]3fsÛ Ïž#¡E¶»‘·û°7·ß¨~Ï/_,Ü tÿ¾)Ï}fïuO'þð²pTÓö½êÕ]ðÞ£{²=@À_°wÜ5ý†ÝùŠÝmÓsvñúñãî¼¥þ¡ŸÇM[Òƒ¿ÑGe“­ßAÐ’Ûõjs`ʽ2}~¿wç—Ï~xÄ©þ½i¾l:u'ÛøÂz7;®pŠ‚Š?†”nNÏÓg°¥¾5íµÔ¬ÏûtëÞ£kÏOöx÷£ÇDš2õÅÈEOôëßïÜA}&Ìɽâ¬ËÚ:|žo°tŸ°BÞ|/ü¶V«Ñ¹±wû+_ÿ©Åàÿ{áñk—>3zð9ú÷øî¡ï½ó\²°^”_Pd•màÁüOÈ´ D_uá€ìîÕç­U¾ð‰ðÿ.8XÅ&ÇŒÈvX¿^ˆ{".qqèpZÞ„Ÿ6á¥ÑÅ¥‘ 𡉠ññ_µ,7=¦üíU%AÈãñCfIËîÉ÷”¸ðZ Püï¾yU*]s~ßÁçôë?ä*îýè쉣 °×»`hgëÁ!ÝF?þTòy ‹B¥Sn ý æ¼)ÿ{^›ó@¿þýÏ=§ïËK‚½6cT ;‘zÃÿ=s^kïuCº >gØ‹›¼zo˼£¹屢 X†jÕ®‡Zj]ØaÎê;¢«ÑáUÝT\¥ª*e·¨âCn›©ê&£â¥RþF›pƒUõ•²ëiª¾#‡‹ïT¨b*Oåž)7Wèíø_aQÖ=w¿ýÒÄÇ•Š³t‚Ùª¾•ˆMÿ7õ[9aÞkƒYò'_UÌ ²†¶ŠKµäWz«o…uZéž©¬Êòk¿êúï™ OçøWyÝG¯H|¶£½}HQìgÙ©¨êÙT\u©ó¸¥Ñðé oÊÎWÞتÚú*v£Ê#ªô•ã»´X}¦’“lþ%_/ßÛñ¿B„½ŸÜ¬7V©¸×³è„KàDí´'¿2±¤ +â˜ñÐñ–LÅ®Ti½žtqÓñë(óMI&ÚÄt>â-èhogÛu°ílN¹#üŒÃÌ®üß$üáË•K+F–iš\iŸÝµð?Sæg‘rliHw¥Þ:þªæ²"bÂ…µn4€UV¡2Õi#?¯%N^VÚÞ-^µ^Ë”ØòÝ lÛ›ªª¶bQtã¶åo;»—_¸"ÌÅÍxgÙe67BˆŠ<øE!q#„¸B‰!„ÄBâFBâF!q#„7B‰!„ÄBHÜ!$n„BâF!q#„¸B‰!„ÄBHÜ!$n„7B!q#„¸B‰!„ÄBâF!$n„7B!q#„¸BHÜ!„ÄBâF!$n„7B‰!„¸BHÜ!„ÄBâF!q#„7B‰!„¸BHÜ!$n„BâF!q#„7B‰!„ÄBHÜ!$n„BâF!q#„¸B‰!„ÄBHÜ!$n„g§ÿrÅJ\3‚\JIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/stat_msg_1.png0000644000000000000000000006073713051004444021515 00000000000000‰PNG  IHDRz:—š«sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 5`ô/ IDATxÚìwxÅ×ÇÏÙÝ[Ó B BIBè]¤ƒô¢‚Š`CAD@Á†¨ ¢?E¥HA¤÷Þ!ÔBBzîÝÝ9ï÷&„4P!/âù<UÃ+Eö­×¢1ŠüÈ0,7 ²$¹Ôyå·æuÜ42Noš1tÛ;O¹òS€AÄ~}*¹výàä“'~¶µ7˦ ¨ÇÇý2çÃí›[6‰.ç0pì—7mÛy¬ró©å=Ý”MƒÁT„9E AÚî÷úŒU«¶}¹Ý¤G­{ÆÙ•ã·nøàRœÖç…þ²–«K9qûžó«3H¿üÓ¡3¯4¬"å­FÙhv­Ô²ÛëZeíæ¹ýs_?¶x̬÷éC‚Ÿ,þ›²CEºªk tÐUæš‘½FšLgÏîŽI²[´ÊX?´O?õÔ¾¸›Yˆ@D^u{Ö­pvõ´4»Ž€’‘N,{;Ëåј¾mJ|¨„)Ç~<~þzµÇ>mÕýQ3’®’\«÷žÙå‰täÝ-.:t 2¯íIŽË©Ýï_¯Ë¿ü æöne<7Û’kµ¨—¶î·tìóÛ6 ËÍß·B$ƒÕC’-#…´„ýÇ®Ýôêd¬2 N…+»6“ ˆ‚\ž}×ïæ×M¹mÜî#¦¦ÃGzP„Âj£@üŽlÖ.Qmk‘Nèè÷y‡=æàc÷w9: *¿kNfÙAµ«û†…V¹yy]jª†E%ïHAËrMžóõW/¬Y¡±Ü0,7º™ )™«Ûm.*#BÂɶ¬2Õ›×&ÕX¡E·œ­3®d‘PêFœ¾n̾mÛ6,þ£L“§ýÝu¢’Z:bZÒ™DKh+È,"˜|+zyff]±åPröÚÔ©­bÿöƒ]oœ=sñŠŒHTœV’lõv÷(£&ï³kü4–›Ò¤!ͦÛmšÝ¦ÛÒ’ý¸éûYšßàДÕË›–"FVò ðjk1]8µù9ÔA_äÀ²æƒsGÝ°…Ç è.!ÜÑE‹”•mC£§ ÞfÊC±ºHBB A¯_Ýp ªXQ ÜšFDš¯þ]3”0ì„€ŠA2Êì»a Á®â@ò pæ‹gM îÊ7y­U§¾fÄ•ïOœWÊÅ_¿PIn”­ G~T[Ž7Jˆ}š íqn—U_˜ €ªÝyDˆÐÃÕJ×ão’PPqÔô4]6É’"£-~ÿþ‹V‹_܉(•lkmùü×G/ (Þ8ÓmYZ–,{*\³–›a‡ 1¿6«í®9,Ž$íô¢%º‹ËónܲÀ~ñpbzVO« @tõWHvqUHÜÙ´A¿ÊÇv­LÖZ{à-¥ @ÌN¸ššâêi1cÖ¥ýÉÉiBV¬ù"ïlÙª_½*ø™Î²(,5„ˆjÚ•Œ¤ëÆ°¶F € †åæAtÙèšÐ!ÿà1RâÁÃWÒË7›Öa@3)w2DIkF4ß½õlåѺSÇ@CÿÈ'Í;§ïúysû^ÍIs*…l‚Äó¯%×>Ôd„ØÝ_¥b‹Ÿ½ã!œÎg”àÔg·œ[––ÖÑË• ÜJh0ÚO¬œ’˜ضk#I”è±fØwÃ<0úˆpbsN6VlÖLÏÕª Ôl²Ù}«µŽº¹î“D î8w—@MÓ5{Þ?!€Üjv­Zýê†ñ«¿›Ÿš‘#tMÏI<µàÙsW¸µþ0¦¡·d?vxãù²ûºÛ@Ív^Ýž Õ:¶ƒ„s/_‘œ—BÓuMÕuÝžtä÷I]wî¿òôôªî@,6 [7š=+]·'! œuvýÿìe_ ª`˵b‰À¿vWyå«?×¢U5²Û3Ó5Q }“–yóêÒÏ/Í·)§ú?[6+#È<|žû–yG·,þyäÛ* ÏÍêœÒ¸‘Ð!qÕ{—¨l×à@M¿5?˜ Bÿ Ów-ÿ5,l–“™vyÓ¢‘‘ˆ@ZŽ.{„´éܯfݺ àYÅL¶õ½~ -]²øû?Îw~j¬Ð¹xï؉"@”dn›÷OD€’ì°O 4]@”.r QN¤"¾] aÞ—Q˜ÏB" ¢ÜHp% Œ€Ðå"¬)ÄJó×Z Âü7û·¨WC’nëj!ºuëÁÖ s¯ªé·~çßápåj»¹»òöNÁ!%\Ô)3T ×sË’qlǧ P\ú,5 ûn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†)^ï†ù‘„ºá/¯˜|Ÿs²xÙ–æáR =cO×Zþ•’•ù ´o¢LÿŠÇ{°»z/õÅrÃܹƒ»z9¨6 ¿hÕÖ¬…ô4@„ò¡a#8qN0›¡kWؼ®_”ÀÚ¶†Äxع@ôî ê}Ì)ê¢ý+=/ž~àÊñÀqÈ˳³Ü0w~&_Í«+hD7…-`ãZ¸pP‚FÍ ²œ8 ‹æT€Þ]aÏøs#È Ö€Æ-áÚøé;@E÷Wn$M%INª¾dáÙþ@¬Mã!¿P •ìL®G,7Ìݼ™22áµ)ж)ØR f|âôéë9½û€¾'¤ 5ÆŽ9 #aåZ@ œK ßOG $ËFÿŽ+Ë s÷ØÖíI‚4g¿rnë&€ ·l”À`Ïw€pýLzêE°—8¾ÃróÀá&i°€ÈMÜDE1ƒD Ú@6TÌûS·@.~¯.À`)èQ%4•ò¢¥*—.AÙòd0lY-‡JˆÝD’Š„ 42Ò +ÒRˆ3˜Œ²ˆº BwØ>D€²’èÌRžUä ö¢ Ÿu{M2å,&Psîk(@Ù€ÝF‚åæßÓ‰Aé¿Í:¾Æ›[¢*›ô\£@1fí~£ãé€}Ÿ±ë£GNžS‹RC½‰+Åò®GNÙ‹Üñúò•2׎pÍ®b®½²‹_X¯¨Çžô0;#:¡Œ¶“o_Ý&^› 7nŠ”¹ïÓ'Ž±·ú`Esq" ’Œ‰›&­ùá÷ ‘‹bjè + I Ky¦ ¢ ñÛfí\½<5C3ùÖîòjÐ@G„¤Ì³+?ØÿǦlÕT¦aÿ¦ ²‘eH?þãÖ…ßßHÉ1zU¯ÓulHD È'Ç€’§—<9(Ãb) ¥v¯OL}V²ßLJFZêÆ»&ºNìõ\+и³Üü›¤ëT¸I „ ÑCM5ìtóÌšoÕ ÇC‚¼…N$ e] "rˆTÕ€©§ùÆ^spÝZ>B'"CYw£ L¡ë¿¨&ˆ€$ÔÌëWw~±ôÍ'Îöw1I¢ØßvÕ‘%=)1õôê?¿˜”j©BB/¾?„"õؾŸ¦J)_$Ír`ÀP¨X9Ï´‘ ãÈ×OíÚŸQ«ÍÀž¦ÌË[vÚ?åéÍ£« É~ô³»/øÔm=ÜÕ˜uu÷?¿{¾ËoyH€ ^Z1ö·_vVi>¸~9Ïì«ÛöÍtsè÷Íc‚n[HBÓ­µ;U)›/D.¡xÿ%€„&÷Yn:( ~ߧ.]‹[;;;¨[hûÊz^‹Šè[Æùν·vVfÍ.aí5íV—€Œ~µk·è›×ç kßfÕËý¶þvªO¯²fŸ?q)'ÂËíè¼)eú/‹T—­ýv}±R ~ÙØóö.}Æ5Z9üÉ[mÎd†vú ˆ€˜syß±'«õýµq“ @¥Ÿkv‹?W­mÔìy<>kç{ËñïU+ïC5Â"VNzÇš~t©¥'ŸÙ·m«oÌ»-ú·’Péëak½iåÊ覯DÁnGð£¡Mêê¶ëDˆˆR¾rŽ@ž"‚ж9sDï”$gt=ç‰D@@„ˆˆÀ3ùXn˜¿ä-´„V´8~L“B1çꉌlºúÌø2Áa5»—õÛVÒ{›tòlõQ÷ê5Ìê±ÛvÜH„÷'Aýhè=ÈaàËÅt~kâàlÃ2˜ÝÍ€WþØ©T.ãã-ÉàXÆ»lÜÉ嶎¯]*5ò©äßP"""t«T¥¨†»î£Bê‘ÝK>9}ä¤bq±gd{…vé3ÌÇÝ,ñÊ­~Þõè‹ŸŒ; 8ùî¬n?nUµŠÚš·[Þ,?#Èú˵«I¶ä‹™†ZŸšZ½Š?0iÛ§›-HO«ÕêÞO™ëËÍ¿Ö†‘I‘û––$åþ¹ 5{fŽäé-€—jæv]›@6¸ZAèwx‡“@kå }º™qWáR¬ÓUL„²ÑêU–P àƶ·üžú\“šu=ÑnqñW H’ÕÏËz!ñ’ª‚Éèê[3rÙ+rVì‡Ü>éFpwÓlDúŽ¯ß¼ìÙaòF/Y¦K_ï±fnÀà‘}@2¸š,æ[¹—L&««$! lr+«žžé:üÛŽU}%£ýà”&®øµÚ¨ÁRŠußÿäßiz÷MA’¯­z|Ã…ts]®¶,7ÿBd3~+üÑ­†N Y=\ȃÙ9€¥gg]ûãÓ—Üëô­‡*€IÇ×»·ùέK[Û«S02ÄM‡¢‘$âVðÜã$‘ðÛø^ç¯Åø=öVTD%M»™£j²Á"Iy7,[L’®Ùsû8@䩬ãß>}4³A§Ž1ºFT0€8dœÛzZºçE!"CÙ¨Jž×ã/Ÿöíü›Ÿ—Q×ˆäª õˆýhþ¥Ì¾•]K¾9ÍäÕºr2 ‘¹R£ «ÏÚÒvü©Z=k5h‚ ‘€²m'ûmé’Ηåæ߈ž!on¬dÊóAȆ¬=“:Ÿ¹7¾HL;¼`Þ ?æµH]ÍökûFýê>º c/¦:}+igAB8 ž¿G¹ŠÐ÷I¨T B¿V“64Ϲ·ëË­‹ßXƒ^]»Ô@@‘O`I8ý#˜+V(ÉYgõÚsĵ唹þž2P:”àæžy[wQþžž¹Ù{å›edg˜*Õ.K(>õ,ÊÏq‰PÅ­Ä[ºäl@@$”LFv"H¹‘!ÜÌnŠ3¿’‡ÙË…å†åæ_Û™’²b̳ðeƒzûRÆ2!! K€WÏÀ˜ ¾ÂN ¡vú§x×æ^ŠÈÎF“ù]Æl‚>ÝAÈ!@"P6€°ÊŠÁ5 J‡‰V«XõõÄ mV»[ W´4!€œŽ–ž®+WIvNF¢ŒS[g>y^4ëðöäŠÞrþIIù´* žß±E5M¿mãÍ3?ÉŠ|ËÊBÉ€¨jEXÔ0¼µ–¦¦ E’në<Ša¹a ´J“_:­ûËùˆ°J2\Þð‡{Õfðýr(ðf‘ÜH‚Qã¡~ô1#ö×Ë6{¿œH·£Á«ºQY“’ÝöíM°åè€@M¹žzÓêÙÞd"T¤ëLïëóLßW†›ŠÔçسlYP`dJ1û™©Ivô7!êY×ìš·§GnW„È]xIÍÈ*ÙYEV“qv; Ñ¡h9jz¸sÕúÀ_˜ü¿hNA "aNìÑsY¾UšËT±˜ŒŠ#ÈŠ€¹¿'SvÜñøKçuA @1‚ÁhI1+&PŒ€ÉI”W/ç5^!áÜo‡×n&(F4H™Wv-Ë6D”÷߶]“Ž9pL¶€bÁ´“¿&\»Y¶Eo€DY‡æ<kîÒë•á®Ž ™P1ÑÝÜ©Ñ£†»¯WüÆùv d&ýÒï?ªeÛWó!Àäí'¥žÉeeqfïY¹C ¨QAÍÌŒ¿pÕ`Å ™g%ÝйN±uÃܽ¡íʉT»Z5"]ÚÑÈ«ÿܦÉ5ó:Ò¶¿7Ô$ë.švïc0ª¿¶+­z¯W?pQ¶}>)1Ã&QF¦Õxþ‡ç’,F]÷Šìübâ-O2¥rë&MênØøú‚=å½ý\Ò®_ÌÉ‚°aù"·¶-ï\¿pø뫺ZnÞˆ»áÙæÝèp7ÒÁv}ïÉ“×e£yÃ{Cnõ4¯†/Ï(w7½=$´”kÖ»ï¢Oç,v¸R`Ùä£[S©ñóO›5 —ÚOxI/­}ç­ÐF!)G—«nn ¥P .+—¨akïÿßà+Û™³Ç_ww­â—ßõÄ°Üü;¼6†J5Z÷*ã*ç¯ïB7ø5ìNî¡·êR±Iµ‚‰"…µbãþ¶Šî"ß^–Š1ÝrüCŠè‹ ØÈZ­ÑsUË@v&dxU %DÄ`@!Èìëƒ $ÏA9~Š Šk¹Z`SÀ70Úqi&¥|YèÒ *Uu¶\!”ªƒçõn°áÜáÃ9vQ&¨uÙ°ö*ù9&Qû7ÐÙ/úüу9º¥F§5ÃC„F€ˆ&¿ÀF©ùLªÉx› B|[ö²x²xYŸ05æäÎ-i6¿Èõv ð·Àä×´ýKœÞ·;ùâ9ϯבMÊf77#HX>¢›§©’Ó`ôoÜØM!ÐU׆¯ÿæõûÂĤTÙm@ƒ=’wÎNÿ¿ïVgJ­}Ý•IüWXºdñ÷œïüÔXño³pŸhõ»Ðxs¾ÝTø ÄböæK§Ð›øÖ>"#B›xù ìб(÷Mþ¬A ¯t’)wVq¡áö §CXÒâD²jïÙ?B7š/> «Å]£ˆºõh1ùÏ7JF€x+YrÎQ.2G€˜ã/ÖÄýCÞØóÜÔÅòZˆ0ÿÍþ-êÕnÿöWÑ­[·ˆˆöÝ<¤Ò›¯ßþ»¤C±pÝ/foþ$‹¨ty¿tÀLJa½¨b\Å·]¯ØîCÚMühlX yb°È%ÍnÄ¢“+º°Š½ßâ.P ôó}ŠÅ~öÍŸƒ³Ü0`Àãàã ÿÄðLL€ý»àà^ög0ì»aŠÇˆ0¤?ŒžµjF`ÉŒ0æ¾úí::–à2åî5@Ð}îN ‚9õF%ß þ@¬þ Y\ØÒa¹aî¾ \¿ SÇÁÇß@/Ø Á`‚÷?‡¬,x{d¤Œšá!0|(d¦|ð%˜-ðÚhHJ x´4ˆ‚ð†÷u)?Ý`ŠÉ5þDó)C¨"Ìöòã5 Yn˜»@4i)) ë@Þ¾ ª`2;WÓóò0Ë4xx:Ö—Iàå 9Y ÀËú÷ @½¿k/ÿn»ÿ‘’=çAÑj¢wŸÄà†x¿ifXn4€QAPÞùÄ9º¤(`±ÂÓ@çŸv€ ïÞúrODEqv¯îg“C"Íd¹Ú åƒi#2,7Ì] É å®á¢Ü¾°Œ¢ü…?ï{›fûù+õš‹€a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aþ÷>,‘"5).>öŒ~{ÐhH•an%)'3åæoÒã±^[¶íÈÜ;/ÿF]×O:•’’ÂqЦ•ý|þ#íâÞË "~òñÌÂÛ.\xæÌ–†)Ü!ÐuåæoÊMá6›Ín·«ª*Iì-b˜»j5Üø†a¹a†å†a†å†a˜¥t.#I’¢(îîî<2Å0w¹¹¹=d7…D¥4õÎn·kšÆÕˆaî«ÕJDÓºôä†a˜ÿ8ì»a†å†a–†a–†aXn†a¹á"`†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†aþÛåþ¾íç½BáRf˜ÿ´Ê Ð($@R’L€x/%‚­†ùOƒ€’0 ]RI€Šòe5yÑ¥Ob3Î )lÝ0 s¯LH(¡¤Ë²ŒItyYì——ÄÑ £¬ÝȨî2Yn†¹7r#"bÆý·èXöÂl’ŠlªBt‡å†ab5D§^:¥ƒQ2ÅÎ82Îà«hh× ‘Ñ=-³¶[}qoý-HDüTæaM Œvdd@"T‰PBeMÜw»27Û¤TÒMdJ‘ƒËD×wiSÓ% ï¥uÃrsçVRqç¾%î×¥ é¾aQ—&"ÈÝqsÇü; •„$»F‡Ü IGZz}æ^ÛŸŠ¤èªf´(lUÚUR^2Þûê£ü;K0·¥ýݹuÞí)Ѿµß/ß~uè˜'—¾÷™[T§§;Eãüé°|QP ž íËßÏE@€YƒàdœõÈÜwÞ¿:º›ß[oýÒtÔ¸ö•ÜŠ>..yé³Ø—ƽèi*¡èàc‰È™xÉiÿóGÉÜáU)0¯¹£d¥$ ”@†å׾أn6L6)ÛEòëá24¸|´"H'ð><å@8"&®žÜ°õ¤´¿[ ˆ”¼qfýfãR ¥pãÊé­›w¤Ú³îÙqèÌ5€#;`ér8w .^¼õ/6ì¥bî] ¿žçíÝyðŒ°%ìÞ²-6Í^Ò)©'ÖoÚ•’£Ytg?éÝåÙo툈xnVßNÏ|c¿×õŠqñÓ1_o-9mD¼ºàŦÝ>Èb­¹/ï+²òåñ×~>¿H"$Òòø/þ«0¾7*«8#ijžD6QG á¾<ŽR“*Ük#¢"·ÓÇËÛsì\Š››«û­t Y/P\Î÷úÙ‹I..® èÖãiß¿»/xX|ª}81Æ*Y@”½û`ÿþ[ÿ„΀Š¼zþDù¶´’òPlßÖeÂ{=½T™ºà¢x‰Ý±˜Wt[e{zº`Ë¡,/O7cqi”Pˆ%í'HÙr=<Ü‹Ë`^~öžHóðp³–tµb·ú³èüP‘•$±W‘þýæ-ÍœzRÛí¬ß(ˆàˆºugöf«æ¥hö ÑxdðT³pa”t‹L “ û#þ¥&7ˆ`?°ü£ÇÚ6iõH¿—7œ¾ ˆŽí‡V~Ú»}Ó¨èF[u~ó«ßnj€ˆxò«:—o?öÍħ[7‰‰n>ú³_ïä #¢Fý¸Ûž´¬aX½É‡4Dqn˼!][GEG7nÕuÚÛ³oظ¥ý«´+9nç¸'º4nܸI›^ÿÛr·Žlž¢ÊúÕÎ~t.oýKH$•ˆ2¨2PûÅŽs‰ˆ¶jÄŒ}‚ˆìWŸïÞzðèù6"²_{±gëA¯Ìu4suÏäÐÆïo¿ä,5aTßö=‡¼Ÿ^RíÓÖجǰ οÕì¯ÞЉ(ù—VaÍæïºHD"ãêÎ?·_O³‘º.2ãõ‰©5vS‘–:åéN~’y§*»âÉà:ÝvÚo¯œ9¯>Ñ´}·ƒÉŽróúÖ{dÚ2"±sÖ¨ÆmzîÏ}âBK½p1^#º¸hrdÓ6¿ÏtQJ#S9iç®^‡V­ªçv‘&Ìû2®ýqù5îÎ_p­Õ®,ŒÙ ]€$C5ÿ²„€²b6€-]¿}8MË<{áŠðl»zÅU ¬gzûälÝrEÔ¨,îY#Â3×—ábFMµË)ê÷m·D¨Vh$h/Aða¸0³Eîa øŽd@µ’-ój` @‹À–p9 y¹\÷Kh­À‰¢{§ùóWaòoZÁÅYt&£¤ÈžyÇÂèYÖ€· 7·3íàj*î ¹IŸæAï~qd£¨¨&M›EÕ._©\!WŽK¹A‰_>ýtÜUjV¢f,—apùK†¸^¦v ƒã†%³¬äò~îÎð4ƒš­`½­ý¾}m #š4jÔ¤IÓ&aUªTrÐO^ºi4º–¯`% Ý#j×°ì„b+ÂÃD%ïª)©qYzº„E{Ò7)F«-O•+ë.$ ç—˜¥rë¥$7º–eÓLng;ÉsÉ‘žmÓLž.ÊV³!'9C€+€$ɹm¤èÆBz– Í7×}ý™”ç9DK€kj†sB$IŠ\t“¼{@¨qE”Vf€»rë Š+ÀMõN” ä r²,`Χ"–¿ÓG–dÙá3‚¿ró²Á¬ä¸d5KjšM%õÄÍ!ýWmùö{ë—|³rîLÕP}ÊœOZ×ô¹í¾®®êøÈ›jÝCúuªâ㦧]žyd÷ßòDä”(cþÑZP;,Û4ëi¿¬š·î§ÙYšÿØYŸõ¬a³Kèb2䕺dr3ÿ†Â‰ÐÏÒ7V nHÐÑó Oô’ÐQJMfKIn£—›)+î†U”üã ’ÁÃÕ”u=Yƒj ! PS2lÖ²Ò].·o«È¨ÿÞžÉa÷ÙÅŸàYh³ÁàzÎ-=´%øA&ÊÖî|‹ @6dä;ëbzéUNÍ–©j¹Ön¤kfÅE‘Kô}BÆ̘;F˸tþü¯óß5tÒò­ŸV¹uºìÓEi•ë|ûÅŒ w[¢E¹oc@.Ï¿ýÕó"ûjì…?—¼7ù¹×ëlýÞÃb”ž£™Ó'õœ”,ðû/è ˜Ð•€NÓAAºdÃV¾=ÃÝš °£@E à}÷þÿ™"°¸W­XѺÿ§ šsœáò QuÏùÝųz•Ê.ûmÔs«ÊåÍKâÝê=R @ÜÙ¸&ƒK`PûŽÿ­Ìkʶ¤#¶w•1qË̲ÛlªFñ¾Àaüpë¥ûóGU  Ìf@€Ôxç.í4l» 3£J5@€5'œgeo‡­ÅEºj·ÙÕ¿3|K"7I$ºUT’zcÝÑkÎëe&I½áãâ3/²m Ûžµón¼ì0ë*Õ íÜ»§ÇÍSç2œiJ³ÙäjÍí‘[?çrŽ"òÏ>ý E‹c›»ê,€d)X§ËàeÒcO¥BÊ^ª=óâ…tÇhhæ•ß³å]TµÙTý¡œ^ª¤…E—ÑfÒ šKHSÏ.„€`tŒ —šÖ”–uƒ$»úíÓáÉw'½2õl£@·Ó.߆5f? fóÐ]Ÿœ:鵯¶ ˆ?¾ý‡w{õ«jwHPò0ºe§îýß—ß6è6tè€ß^™üÜ›iPÍzÝÏ?¦„<߬q-c‰i¸›=µÌý_Íù®Z½Î=º¯xãée®m¾}s°òWî À“ß„®£`ÀUh '6ûá¹oÀKïðøj"„¾ “fBu ;É`“N0®3$? æD˜õ#Ô÷„Ô¢gìœ9êÓ«åfOãc‘ï6Ï«JGÎlúþ[µv“¾’|èìߣ×l6° ZÝ⾚8î\×fAÇ7-ÙGNXR—C’2ÿ1ùÇùÇõŽ¨ZFK½²aõ"cóAM\ôrÞzꪅ?/× ‹¬’¸yÓç_.hYÝeÿïKNI1•+¼°òÛÍÁƒ›Wsõ’-)×w|ó?÷À¨^Öuû§^ÂØ}ïÏøìÔÉ>‘5ËCfüÖ_Ûë?ÚÚÜ:ö¬÷é¢ÏÞ™Þ·5åÈÒeGܪ{ç8$*çêÔgŸ³uýlzòŸÞuE MdÌÒ3[ùõ65w·ó£(z¨¬@"9¼ßäu_Ž´ýí»¹ Ï¢¾]»´QE+‘T÷±ñë¿«ZýÑGŸ¬<úäÌSûÔ'Œîî&%/‡h±º¹¹}ø~ߪç—ýËÂ%Ç“õªm^Ü´ô¯«~1ëÓ¹¿ì 8cáûˆ .žîV)_×ËÝÝÍl¥®O ‰,¯ÿºxÑ‘$2o$&¦d}«xzUT@Ðeúή„^€E‡áû½0ëI@( çBà5Ð Æü?샎ÕÁ¤\ÁÕãÖ– àí @*'®Ag_øx |¹Vœ€®A`Ñ‹nZ)I—¯\S +˜lñtwÍWr²««»‹Ù!¤ž¯¿3¬’~ñ§WÏö÷ö°Êtiá«.f""hà1êó‚S·ÍúxÖæ –I‹– 6•`qZŒúzÙ´^ »V~6{ÖWK6´|yÙÇCLD ‡¿=­·ýĆ–oóê:eÁ¸GOþ:ïÃYó¨áËß¼;bÔcí3/nXµ÷€åÙמ©í’¼ì§egÒJ²/$ƒ«‡»%¯ÌŒVwW—¼[4¸¸»YŒRýǧ¯ÿü©¬#¿ÍùlÖœ×C_òÕX7"2ÕžµrQcÏkó>ÿdÉiâß…z  Ú+.§hð0‚UR…nnSÕR;ÿ@ƒÃ“UzòRŽ+<Ê(„(r; qûØôíc½¢à)E_ŠÛ·;¦L³ˆAå¢r™oö ’G¤ó¶*vúB #Ø%Lzp¤YpFÅÅ—!Ù&Š+è;]~Ô=“ëDõØs9óí.v‹’ÏÅ>»âκµ½àÌÛª(þ…-ýÒ¹SéöÜ¿õ´±ÝC»¼wÜñ×ï3FŽÚœA#š®îKßðjlï7¯L‰ºFÿ£ý¥ö‰f#mè\qãÇ:gÛŸRQƒxxûvç¥ ¤YÄŸ…ÓÊ?òQÌ”×b¶`q%Q`0ª¤¤Šß…ç½c éënÄâJãŽEWÌ0Ü­—Ùíö⾑d£AÁ¢¬¾ߘXTn…f³ëÅ¥Œ2y ·U¡î³÷>ÓgŒ÷ÑŸ½ÒY’”ØuÓ?ã;zvmö”uÇáù—\àž.%õ ¸ŠÜu?«æ‚n䲎$ÿÝ%/@ñïq¸ÇßRk»^¯ü侟×ý]ÉõÖÖÌ‹#†¿x!±¨/BµìÚ¾ŸñDå{s?g¿kõÌ&SQ½{ƒÇ¸¿nVÃå” BüþeSÞýlÇ…l«lžAOŒûtû|ëx·¤Ç¿HÓ3gî®að=€\šÎa–¦$ñºM¾î¬d÷¤æ_£§Øcþ¡áQÔ­<ô‹^ä[hÅiéàÿ« ÇrÃ0L)Á_†a¹aæŸô¤òþ““nÛq¢d²Ü0ÌÒ5"]h˜Mvg$²ª˜M*•¦‡}7 óðZ7B‚DD„$£”ë#VIC@‰ "üT˜­†aþ²)á\˜8e»¤K ò:Nh: ÐBQšãT,7 óÐö¦@€F²U“†z¾pFÍ€(J5G,7 ó°v¦…¤A6Ø3J2ɹîaR t{–A' KÕWÌrÃ0«qƒ¨@öGŸ%>7\ÍIÍ'+¨$ĉÅKQÏ1©4çü±Ü0ÌÃjÝÅÅÁ´èûyòÙÓšc‘"È™ðfÒà'S^¥B©ö¦XnæaµnÀ—`ÉIv‘Í)“&(9dGP¿ùÖ[ÂŒ +I*ÍÞË Ã<´È>>²Q6ÐŠß >Ù ÙÀ #_T@@“T…ò-hÍrÃ0ÌßîM‘\¡ÂM7!çxƒ”8ý=!)êÕ‹ÆŸ–Œ¸Ö‘@çÎÃ0ÿXmQFÓ€!6ÀHžnг5Ûše¦øk²)`rÒôRõÝð¬â»}QÜÕR·-Ç[´—V(v¹…üKØÐCõˆ)µJ :êpÍhõ•ì*€u×ÔþýÜÎËÑÕœa/z|ñ±¬*Ü™ºcI ]ý« 4í¢R ¢3G6jÔþ@©žÑÑÃ>XâÐ Êعâ›–¼¶¤&"D°%lîÓ÷³*ƒ®d¡“ôßZW™°;}Ó—Ã#ë÷<¤ q黆wýÂ^øÐUUä^]×ný¾Çu”ÄË–œyп®T¡dï·'!JŠS{õ ³ç줦¹{z¼ñ’ ­”W¾ù—Ê Å.œÐè‘)ÿ$Ó•ÕïGµšp³à‚Àº>Š‰ >-ZÖ2¥Ç|cââ—~4”±xË•®¯˜ÿSX¿ØWYÉwœ¡|XX5“D•j†x˜Lr‰X’dƒ"•<ئtj¾þJ&ØÞîÔ|Ýå{‚Š2ÎmiÝhè¥;@_öŽY°ï*·ë×¼(t;ÅDk H(_¸à&«¨HrÓ(([ΠÉ:>Œ¾Çk˜„®išªªšæ|)ænŽíª¦éyñ‡HWUM ]SUUU5]8û™¤ÙöœMvw5êºÃú ü)P¾”5UÓ‰Hw^WsXBS‹wu1êº Ò5UÕtB¬Y[R*øyùjçíîê €×îÝ,wÛô…¯Šµ'²L_ôÝÒ6OÔ½íÎÍu¢#+†ª…„ÉJØmÖo/( €ìÃâ,i¤ È9¼ïšY:é:ˆÜ¢Ê+ƒ;Ù=ÎøðBÏ-ÜÜ’×ãN«hÎ’É÷tTMÏ3f@?¾å‚Ù€‚t­¤Ëišªé$œÒñs«¦ çóÊÍ–›Ÿ¼í@$roMDBUU!€„î¼s––"ß ²$$Ù ÇDey——@7ɲJ° ïѯ˒’EÞTãÒ ”–FGH:øöÔ¿î9g²3t—Gzõ\g7J<8mÚÇ¿î=ïáã‘äÚrôk£¢+{ÀÙoë>öõKÞܿ{·l‘N²WèðþœIµÍ°sÚŸý~Mhg‡v;Øž­xiöÔ–m;êâå•Ÿ\®aÛ±cG‡•5`üªÇ£fWýa0~³)^ÆœSg.…´|zú¤§?òáúKd7<ݽWË©ó_ †Ù†Ïöêtá„Äã Í^x¥"ä¬=èÝ©g ˜bºÞæc‚”;t.ÐØxù·VKGé¶;É6÷˜¯ìOéôʳ¾I/4¨}°ÇÚío6,¢¬LÊÚ/FóˉôäÄ4C@¿á¯ì}fëKã§Ä»Ø?}噹&£ÈIŒwQg¶´NÓ™“_X3©ÅijCÇGìÛpÊ&2N&ú=3öù^‘Rq'DŒ?ºjò[L’}\¥›)5¢{O|ÿXðú ów B¯ôêúôÔ·šºÌžöæ²ß¼ý´ôKÅð¡cÞîæaO8ùÚ+¯ÄZ`þÔ—×W™þÞ[þÅÅϾ6´÷£7êL‰„õñiÙÇœô‰ìøV¿š³¾úLÚùCG:¼þ¿‰= ˆéŸ4îƒíWU?cêä ÝÆ¿?¶¶uÛ¯¦Œž»z¿[…Ê“׈§CG^<îËeýbü÷Î|nÀ¼C³ÿÑ®†‰å¥¨·¼„ ¡Á*ùºP<H—4)¥cgßÍt" !!–ê´âR úB¤eÌѳUÇç3‰ˆ6ͨÝòÛ?Γž9ã…Çš?2ðXŠãЄ·»4Œ|r¶JD—4hØ(ºßÛ©ŽøçŸnY»Ï§gˆˆ„ý³±½Zuy'ˆ„}î„'›¶ê¾#N#"—'>Ýú•9ŽèɇG„…w™¸Ñ‘ú…åïÇ4i¶p_:‘˜;e@Óö“RsÃc]·ð§ßö룳ä$’¼6´ÓâqKJ…BD¿úè‹j_É,²$ßÿ²·.™»rBás—}Ð=¦QãWfmDD¶†?R¯Ë‹×35"¢kó·Ýx-“ˆ(nALpÛß®8c•¬z¿K£¨ú¯Í?éøsÏê¶x$1»ÄlªŸöytúÎû¿ql`ÇÆÏ|´ˆŽ¬[¿Á°ËDDtxÅ«QáÖßpKI™2 Ó#ý_Mt„OI^Õ"´ù¢ƒ×Š a“ìë#´iÚ®ûž«9DD'ÿ×°~dX›Ñ—ˆˆ(éØ‚Á\#"Z00¢åk ¥”7²OÓîol!¢³KGD·_r‰ˆÈžr|H§Æ1ÍÚ-ÝO$l]°pÙ•T˜"£¾šÍ¶íÏO«&™t²õãdzH¨:éšfTš`J¥3…`»yqߑ㵇N©jðk1lÆ«Ãk”sÑÒ.8t¬Ú€éu<f³ßˆÉýÅöe¿¥:,"¥÷€Îî@D ™üËÕðM>r\äõ”@˾¶õÏÕžšàW_aÒ§CR×­Ù“í¼v6¾ñz+‡o³J½êBPR\‚£3Ž –DDrpûÞ}ÚDH·F“ò¼·øí:Ì×ÝÇX ™›ôÔ9Šp; Uyþ¹`ìÑ?8#þF’MÈíÚ8#ä‹·+ì:d@£hŒR6îô†ó%šc`KËÐ{²#’¤ì]çËýäùð[ýP¨Ùjìò KÚz隆n]C½o¤ÅÝÌ·òãÌC‰¥Dªo¥!åLA1UU=ê‰^ÀÅ/¼¬{ÊñX@MMW--Õ‘œ9`ú×ë~x3@ý}ÁvnÏô¬@dð¬=üÑèÜH~èÒ¤ïnåÝeîM6#„²Lzöycf¶@MW€SæÿhÔH"…¨4›RêLåd^NH1GÕõέ˜Öf=z@ú•CñÉÆG–w4L0úG”1}½ÿ2uð’d?7ϼ&+) Ømâv‡“žuézª¶Î˜xLÒ P¨I&åúŽËZdM€„[ùŠÆÜËB+F 4FŸ±¤¨V tò‹(—çe¶ZPhâÎáÒ…¨_)O'-•\3Åg—de£Kï1ÏþñÖ­7Ì kúh¯^½š„TT ù±FyËc¾X²Û®8ã[|ÿ²¯„tƒ_ Ñù Œ É•¼-ŽG‚¨Èèª`yì­WW?ÿù£MçE·ïõXïV ª™dH8rU©ÑÉÇ鎋 Ôæ*ÂuƪhB‚Ì_ó>zP“40‚œúé§ðöd@¦Ò)*­°v¤ @YÎSÞ¼Ø>º IÉŸ ”eÔsÔ\ѽsó×4]*_µf2¨;Ƭ¡F­ÚÑÕ=1¿ãè_VMþÆËLq†h"”ì% Q#QõÖ/þØ|뮽Gzï¹î“ýê½òöÌÎun ç´zÊãÓ¶ù½6}vd5‹I9ÿ娑;ÿ®‰[ЙW¿°Á?-ŒÜ²mçÑ#GæŒë7Å4âíÙëëvYÎKÂ`1°””ìF¤Ü`/úëÚÜïM štÌ®\EMIsOKvK¿™üÓ\Ï^Q“„¡£Ü•’ÜÌe½­Yç/d@UWD$[V¦®X æ2Þ.Ù.d@5WÇL:5ýRŠÍ«Vé.Wn–Lå|Í™–ðƒÚz8&Ç9:¡ÍæŸS÷WÂ&åŸú÷b÷ä»Ü=›Í‡’”x& Œ#öø¸ soSÉ­Ÿˆ¼ª„v­Öµ/@ö•ç>1ÿãÿµžóR¾£Î/ûåbôøwú´&DuWšP*ÒOþW›D‘ãZ6¨c¯Z{hi“‡÷_0õƒžË^+硺™•Wâq'®J…¬0b'ߣE"€Päü²NIËP2…JÏ=•µáO·_טrf}]{é&³"ˆJÑW,•ŽÜZ<«T 8üÝg7Õ"qËcMX²ÇìU­Fõ²Gæ~‘æ|á龜›V£M§òPò—ñZ– `p«ZùÐW3¯ §£åÒï³_žúCæÝ<-[rúgDÒ…“'cã kM>ïŠEB@ƒoùuDÚþ}—ö]D˜¯¡˜dT¬Å´-DDíÊécç²þšg„f—MNóDÏý 3ÿøi[²ãsKæǺWlèYRj™{_òÒ†óY¹7ç]Æl°;ŸAÍÒ\]--ÅæØ–qzãâ×"ÅѱB v48)ýÃ&¢Ÿðôs?ïKÈ-Dw?W»6piãuæ—߯8m¢Ô/WïÍàKÙIWŽŸ<“a¬5·I¯ŽB:pвF¤öìï>j\™1lš¤wÿ qW‘HG¶p4y¿1zP‡ÿëÜqox çé£GD…æÏw^3´Ó3³ë}¢Yxås»vœIãÞæq‡å*>å²Ó6?9àñ:}¦O|ý…ßûO{¬ãÑ& ƒ3ÏØñf«g¦ß)Â+Vô­$l[žì÷xí^S§öX>fèמ=¶|5ÊP¨gsvö»{WCÐSm€«ü´k•n7Ôýò£Ðêxvüä]ÆæOýü²$#]Z³äñźÉh¿™ Jöú¶ÏdáÙ²[»1J[ÃÍO†õ<Úñ§5£ÃÿB1ú‡×pM™óõOÿ`oëïÏôÜù¥ÃŽœ3bÈ™.m'þ8+Ï~¡í q릎?hÜÔ–Áµ]2>óâîðZ/¿6¾ª—òšˆ¡NÛ Ä1#ºüP·QHy׸Ó{Éè=ëkO€ÏN®½uäÀV½šµ ¹¸cSx»ê ‡ï†N.šùìâcï~½¼E „ç%÷2Í IDAT"J @êÅk^”•dV|?}ƒìÂÔ2ÌV7Â|ú´Ù–“òÑ ïO?³i9Šb.µ¼É“&M*?¹©\½]¢Ë¸¹¹û”oÔ®Ïè ÃË›€ˆŒ¡z4õµH±ÖhØò™‘o´ªåMˆ(YÊÖ¯æïaÊCÕša¡5ý¥u˸¹—)_%"²~ÕÀà½[Wðt‘ÖòA ú>5òñ¶Á¹½"ÉäS³axuc®E"™ýêE„—÷µV­àîP¾Jxd½@#ÊJùàzá5+¶÷ÔÌ ƒ·¿wPµòÑ¡å"‚¼kVñ®^Ù¯a°‡‹’ìV·lp ô¬œlŸ:UË„—õ ªäTŧvõ2Õý µÿ=zÌ­qߨ2…{E~•êÖ .›› IñlX¯¶‹A*èãã]!°NHpØèj>ÞÞƒÃêT¹°}þ†+1?ü4FNN’<+µè<ø¥]°Ø~!`p«Ç¢jWñ´­n^A ÛŽxcRÛ@yÔ¨ZÖ+ \¹:¡¡­;õ ©èk’%ßj^zuLPp£úåÌŠÉ«fD¸¿Ù+¦Y-oO¯€ÊuÂCj˜‹ÿôFRÌ5ëDÔ©êp§¡$¹ÔiQÉÛ%×t­Þ ª§\¥qïæáÕ¼¬«›GÕ°–ÃÆLììJDF·JZEyzZï^’þŲc-;öªUΪ˜¤s;¶Õê0 ª§ÌB“Ï–&"”$Ô7m±îÛƒÍÚ™ž|FUtQÆ-ÔM"{×S׾Ʋž¥úÑÏMøá¯ÇßšD÷hÒê÷:„÷úVÏ?ÕIÜ9á{ré;^HÜMVJ$ãÊ%+væä¦wnÁë‘-Ýk#"ÒmÓóhziÎyÐD$tMv]ÏZ½ö¤Êœ9vMØ„º.2Ó“Ê–IuAáÚSÃþñÃùk(ü6øÿ@—}Ã^ˆôÊ _F·(ãâþ‰ •¾b­S'Èbøçž;BÄŒë'N]Í*:®êùÿ³W5ÚRÍ|ã½ßŽ¿Ø3ºº–tæÛ¯×Ô{1¢²2ÏÆ5yþÍÚ®ì'Îoº ™T@kë¦A›V‹Úµ4DƒÐ %Éêúíw|ÅÚdz»§Ÿ“ÞhA¡BHè]ʽ@.WEÅ«ˆ¢‚zÁÒPQ,A#(‚Ò$: -„„^OÛ³;óþqÎI¸\0÷UçûG>»g7³Sžýí<ÏìÎ8‡ßmyo9‘pñ Pgqv>ÅŸ s½²ÿ¾_=xÅIiÿî8~‹ÅP‹—¡˜›­H^ÖSÇ•þ À(#L…(RÅ —™è¢@• 0 A•sõþA¹2¶£ï悱îb7\nþøÖUÛ¸ú2 'o>”ûƒýµ Ÿèú¸ßø(IeIP*0Œ9¨*Š:ùÙ‰ÒÂ÷m}zZ6þ ‘êî=&>›ß¾ï\ã3‰+6oþŸwöêÿõ7¿ÆïèŸØ Ü!"DD# ‚@B½¨ÕèF¹à`s?¥º\gŠ÷n8œ?_—×ób1asoÔˆªŠBòóiX •ê°ËÁå†ÃùKúßî9ÒÜß¼p¹áp82xì†Ãáp¹áp8\n8‡Ë ‡ÃárÃápþ_â]é£ÆÒ(Õ?wôµ.7Î_J¡Àý¥˜ &€2 ¨Þ™¹Üp8œÛ†PPâPˆ¢@¥TtQÍoû+á½ÃóŠò÷n8œ¿ªÅ!„‚‚B DÕÅœû+¶-ûõ¼óT‚¡÷Ðî¬Üð (8œ¿j¿†J©û›4—d=QyøÇœµ)ש±:L¦ZxÇg€ærÃáüyû/ÞO¦®ù®¾ZIFJYþ†œäc•¿½ æg±…è"@(îèÌéÜ™âpþÌzà ĽS=:%€ÊÈeåì™ïˆ™Z‰©ŒhA£:õïë7ZáNöo¸Üp8fTªJ©È$hAÜ#ÞŒŒQIö–oMÉ[ !Úk°ÒÑÜ·s`Á¿z}Í;'8Ü™ºÕÇÅïú -«¹ˆ ¹êÂ×™Qªz&->éç{¡ØDQƒ €„FEU<\ùËwÅï)Â$ÅæPû¨gz *ÂÝüQÂåìCë¾K“o£!\¹Ç¿þ6ÕyÍ­ûÕÌG£Ú'ÈKï۪탳V1ü¶ µ ýVƒü®Ÿë\L!dê>bßÜxò/E»>×:²ÿ>ùº3JB6ÎëÛ´÷|ǵ§08µ-%³Ì½8~Ûžr¾Ôñ{Ø5µ—üðÍÏå75àâîoO\*çZP€Ý—_ßYô“û)É PJ&¦9·¬(˜¯Á|åàMê8L-ˆÉcIwÜÒÿ rÃNmþjѲͷsßœÝñí‚¥?دižÞ÷ßßÊ'€˜ZLŸ>ÔOÒÀÆo‘Ã.cÃ=¿{É ô€ž@óÈ„AzÓçþæõBô7\×D£3ûšõ×#*¾˜5/½Ð]Њ/gÎ=^`»óíAPyùøÂ9+‹nvàX7{vêù"®u%jº3m[á7^¹§9g;žR’¬“ z•…)mžlüjSwʈäÒ L\„ü.a–:r¦Ü~WÑ™©Ç‹lª%¸I\bG?âù]):·3õhA¥¬1úEFŶ ÷c)9¹fÛéø>è¹_S3r™hŠì”ÝØ@ÖÏ_~¾ë dÿõ«¾jÑûž¸`Öœ={e—Ø4FÿV1ÝZÖ3ºñÖs[SNŒÔòÀÏ?.°éÍ!’z66#ç—¯’·§C1¬_½¦Eñ¡äÄßžÔFŒèíCËó,1MÍÒÅâ3wÁºøù( Ãú%ˆè‡Q­ }v†ƒ"4ýú#HG¿Â ÷$á%XµÝÆ Ê?¼u’\Xµå Û`Xh¼Ã9Hùy6ÜÕµžn€ Qg×FFÉŽŠz›Šœ©ß~ß°÷Ý1¡µõƒm÷›sÊ££ø¤.¸Jr¶üôUj6§ØƒŒ"ÍÙ[$`K =Ñ¿obþÁ”½åíï×nýqW¡¾¡M»%uô!7èA{¼µœSi‡OeZeª÷ Š‹¿ËOSvtÛ—[¾¯PË6­Y׬]·¾-C]%Y©iG/—Ú Ã[wŠmê(ùåÇä­—…»7­+nÒkÀ¿ëÌ“Ëû·‡öîäw~{ê)Y27mß)2ðrú®ÝéÙLçß±{bD€ÞŸ‚óG;SîPµæÀ6ºF†Ývå,Êܵ÷Pa¥Ù±G[Ý7)ûZÆõiÙÐ\tjÿö“¹z n|ÕR|e§×nMïÔc &{ßÞS9ª`lÚ1>&"ˆ1÷ºg`evî=’Wæõ>m;GG2ï Ñgî?z®R•Âš´éYÕ¶Žî9r:Ç¡sPƒÎ]º›wÞÊsOí;p²Øæ’ ~ÍÛwjཊëÌÁÔôó—œTÖ´]÷ŽÍˆ§ÖÙùíߥÉÁC{ÇéÄ[èvHLKc#„0ÁJŠ?/^âRË)$?¡Ù˜F|I=UR%¦¡ „é@Øïá–בÜBìGVyâÕ¿^›F>¿8© Jxÿ‹9tÄz$yèÄh`£øèf¹‡S«š±ä‘Ä”˜=÷ãÁ?ÿ°§ÄoÔ€–™;>}kæ¯|¿ax(ì…9Y¥¥ÌI2ÏgÕs· óF¡1$1¶Uö¡Ôw¬óž˜õÙÈØP€ØN¯~ó½ÀŠïÒöùNl&}ûù’w®ùhóRZ”{¡¨²ù¹ ¡ñ Pw-›ó‘ß߇öŒ.F“9ïðEeFˉõl÷–!»°âÄ1ºÀÒÁ˜ø=Z%¢Ö>s Î¥"PÄ/oáY<4¢yixò_XÐQ~XùιýÆ£ò žŸŒûg"ù(A|C×aØ0,Ÿm$(ZÒzÈ“ÑaƲ¬zó$˜ÀžòÎôÔ¾µÊdbK¾×Ù<„å=“Û¸ÓÈeóŸ]Ž¬SéeËÏκh÷AʼnRåçde›ý(AÆ/ËæîK8´l›ØéoáÈþðý…+ÚŽüpÁ“&á:k0B26½ùøŒo ‘±íÎÜ=³8lÆëºTŸ;{N¥¶‹ç3}›ÄªEé><ñ|™±}ç(%ïÔ±9¯ÅLX±àÁ–LUr2NR|9û¢Å¬^ÿñITûºäéƆêñøî§$/©\>a`ëå»]cîn~0ùí™öß¼áõ ‚‚ýï>0q":unê“ux×Ì|ÿçÖ¥Ü×HP¬ç&ûÇ‘c§Ä˜‚îî×uãÚ}ÏîÒ²¡ùÒž”ÙïšÞªÿÕrS~tî¼…=ÞžV¤5¨mÎîoÍzjÊÆ{€926Ž?ÏnìÚ¹mñÉ´ô|Ç°I ¦ o kýó£fm75‰ŠÐ=W=ì™ÅS† „ü:ûþ§¿Î Šiæë:°ç¨«i¯õŸ½ê/ùÌŠ‘£Þu„·ïÒ*8ïøžc9úG?]ûX €µo>úî÷§D÷l¢½´tÎLS¯—SfÁv$ù™e±}{t¹%¹!ÕâÐT–"Û¤4T„Êå^-×ä‹”…±&N×DˆŒU ÀÿN+ÕÍB[ÔY ¤{^¾¤¸¸Ö<7(æ¾×*cŒo}¼}ëO®:ç>V¾çîÝ>ÝQÀûâÍ1ݼfó$®æe=r:‡V/ÆVcѶwe`îSÏ®a{j¥÷Ä\Öa.cŒ-êÀ´½™Ã“vês&‚-ú1Æ cÛã)={ª ³$²JcŒ-M`¨ÏÎ{פ{¾'ØŒTzåÚs”2Æ\Ž<‘]~mÿ¸øž¸˜.³6xŠ™6LÛ^c3ŠœŒ1VüuBÛÞ›/Zc¬d]BÛÞ›.¸ë†m]4<6:fîŽ2÷ná¦W¢;Ü|¦ø†mi›Û¿Õ}òî–/ycÊÜU'c¶MïØá‘Æc™»=4vÚ oÖ<ÿ@÷ÁcϹKoÝÚ':ñóý97YYÏYüÜÃ}{ô½ÿTcŒ±Òͽ:vŽõ–1ƘR°cHT»ù§c®G´üÖFï¿©_,˜úʲƒŒ±cKÿÞ6þáƒvO>güsP|÷^É;.1F­ùY‡Ž/±©W_4g}\\ü §{÷­ÓþÕwꯌ1ªÊï<Ñ¿ûðiU&²yÆ°6½&f»Ëù©_LÜ Ëuÿ^°íè¨?(ÌzbʄǬIõÖ\ê½Qm^ØUÂýúÁøžO/ªºìÖÏ^üöNÊXùž7c¢ú®<êiâüÔÏzÄuxgs.eŒ1Z|.ýÐÉLE¥·z÷Íþí‰ÏÞs¸ø cÊ×9ï½tzä+£^??¾˜f3•RêòÚûÕæÇ©“Ø ½älÆÙÜè‡ÆÝþcøà ¿l{z@[{ÙٌӗÚ=ô¤¿»§ôzôAÿ ¿lÊ@´w÷ëæ>­o}ùÒ•ÊÀT'ણҽk™0õ­É÷µàt© Ôtx׉Ë?{³AYQA~A~xÞ©Ø+­*È2Sx`½»™ÌŒHP¨§.Á¢£ÚøV‹O*öí™è19ªño(çd*“3Ìlñð¤úÄc¨=&Œ ÎIÛ˜å:³ç€Õ %õsJzñ×½_'0´œµdÉÓ÷Ä*Ö²üüüüÊ»B”Ìߊ +L?¸ý‚'öØó/ÏÔ@Nùà'SB¯‘í,î߃c¶7ùœHݦ20Fü›´ŽnÙX»Å»/ØÜ@ ¤ÂY°³xëe“ª¡LTið‚¿Ò€&‚y×o¨êý>JPGΔˑWb5…××{Ë$è öüb«!±±Å}k3@ciè¯+ÉÈ£#Ĩ7V­bBŠzµM:óJsöüÑ#Þuß°Ô^Æò÷]tõ÷Ó`:_±ê²ÀèÕž^­Ûµ’_ø ¾PÝ(Aõ (¾±ÜPø7®¾Á$    ¨DŽŠŽA½}×€ÚÛ¤FÆjÉ#ç¡¥:ܬ!ŒÝ<ÔÇ Š ª¾D@˜EÎ*qÜ8wï[‹Ï½±ðn­ýšvîÞ=)!©O¯ŽáWhË;8÷߯~wÔY_¯å‚l­àË‘GF‰9HòT™(‚ø´î$J)€Ás>Leν[kvHLLJHìÕ/.(?[$Ôòñº€¨ß²ûü«F®­g£Áì‰Ô0"  `μ¼2}b¿*C-‚ eyr›Ò Ÿ_Ï…@D½ÁÆ@lÛ–¿=Å$¨Q°š[iðô˜¹ì¡ioLÿ[G@뤤‰Ý“ú'E °žÈe²ë§{†ïõäE`…¥–‚ÊPs½rkµˆpŸ»N¾h?’î8¬½ªªC Q‚¨„jêlnôºzï†H¢ :•šcwãŠ"¡²zE2ˆbÕ<ì¦)3§Òûµ•/¶5‚’þ÷)š( jfXURË»ú^­ýÑ#”VŸìRÿë FÈM®U{H–z3K ¸"Ý .@ó Oxmi——ìåé{6‘¼âåÕt›´zîÈ»jœ§¬~nBŠ2jóžgü%¢pfé“ÿø®ð¿)OuAØõjW=mÑgÏ:l§Ó~^üÉô5­~dÅÇãE•²ªja*ýÏã µÞ)¢@åšÑ&¦ª”ˆ$Qo×Éh'${ËŠ×?Ý4ä¹Ož!ÖécO»ÏÒ5›4ç£ÇegÖ±k?_þú³+>¾çÝu/¶ÕIŠüÙôǤÏA4ÿ½0 b€`§”òVÖ¸„¤Áq¦ÁT°‹T"Q„Õ‘àÔÑ@¸Þâ/ß—O|\Ù·~õ¦cõæF¡þrúþÎÜCyrÃØFÂﺪƒ¢á®†ÁÎŒc%’Þh4F“ɤ¡LÒ‰ÿQ;ª9örC×l8YYm—ÙÇ(„:ŠË“;\.ÂÍ-Üw ¸”Æ<©efÕî—ÕÈ$»¥!Jv¥ÕŒA¸|(³j„Úzú¬ÕØ&Ì|£ £Ž¼ÜK”h –ÀÎýG½³òÛ¡mÂN~³¼Ôs!w…fí8A»î$ ¢(ŠDÙy¦äÊu¨I—o¹ðr¶C• Fߨ¤o~˜2¡o«ók!¨y°rñRYU“þv(S…?nTpC£Æ!®ã{/Vª’›vÑÖ%\ Â–e'ž#å›W%ï¹ì:—uY…ob¿Z$I¢Xšz¼Àýý‘Zœw±Ì!è ¦æ±¦-\3ë±î—×.8s| éò¥Édò˜²Q¶ÊZ½öªQé[©8¢ª…žbÕV D Â{šG€0éA®ò¢þ ràó jÕâôÓN•Tìûä©·–fæ;$Ÿðè¨Öç¾|ù´Õí#\^ôÊ*mÏ¿÷÷»I¥ ‚Äì…2 ëÅvét>yò¾|F!ÛçŒMýFñͪìNw瘨§¶~³~ûQzSgjÄpX8Ç£Ve[°0@‡XÐ4äyo§ÿv!á…ÞH߀ÝÅ  ˜3£öÿ"„yÿ†Õßοµ%$E :‹dï¶âÝ¢'Ç/Ýï6·Ÿßù¤0¬q¯ˆà¥æH?hÔÛ?ñd@-Ï·Yu–:€ˆÁY\¡Í]'Ò.¸s}qÇÇ»Îç2—ª* I J©SÅíK!PO>5lô«÷y[[Î+/,áZ}þÞ*÷»¯¶•ƒùâûßnõvXIFÚÚõß],Sÿój$š°ØîsW½x Äm¨Å _ü\Œë;¨žX¯GR#—úÕÉîWº3’_|fNŠÎ,…úX*2ÏËœ9uÜ"9ÀXv©È6êŸ/,ú¦*ñ‚ÂËÔîô˜ô éÐÆßœ!„òß5löÚÓîð¬]×nN•Õ[›ðJC‰È$Á@ ŒÒ~¡c ć acVwëLÕ‰3EÑ4eÆ ÅÓü³_¼ŸŸ¡Ô&&ldH˜<}ZÙô·Ò'$4 (;?¨}ÿÅ/=@PÅf³+5º¯²Ãfw)n“ï³jëŠAq‰ñÏ­zç•—ó_šýÜߺû…†9 /±Ðö¯üû±÷ÚªÓf¯‘Uì6›Ka ¤st짖 é’ûôÊ%£ëm™3m©ÿ¨!=¢j`ÙX=w†9©‹1òeX>@ˆÌ<ð*'‚gbÀ4öGR8òÔÈ€Ý+¬5:-ªð¾k7b5FwEÏ øŒ{›ÂVk¥rÕk“ Y;(:䪪ËnµË5Š)[íêÞî>°ý»³FY•ðé{“F/š=æî¯Úv]¶laª3b\\éû÷Þ7O©,¸d7ÝûÏ)íêkY“ÛëdS÷™¯ ž>lÂ\¿PmiqQ@ÓøgÞ˜`B"{5MÛ)©õÈ×¾ùÄþ)ÿN²²¡ÞNv_4ï¹G|õ©1÷?±üëQwÅ‹±¼÷̘MÍÚÌ^òA»ëY s:ìg•×Ê6»\å±0ê´Y ƒØ~άû¦ÌŸÒíc¨Ÿ¡²¤@ß fÊÂç-€é¾9c÷NœÒµSö‘…Œy`ø¯ó6¸ÿ=së—¯~ºoV˾|Å«ßö±Ù\ÕöÂ\N»Ýár{ýcŸ™–]>gʈža!e—ò,-âæ¼ð„ž1£?ZöÔäW—wˆûüú¸PëóSë7ôoÃCÌ·ÿˆb)<þÍú=µM§ÂHP̸áo3}WyÆø‘cÏ«Á±Ýº’ËGvî;ñÐÊ•£F]N«Lª;ƒTG¥zƒ^º¥l+Œ1j?jß×ÂÔÉDM”@$ÿ«Î Ÿ€âÄ•ý»Û&¬eÏ¡ˆ¼Úðl—O_È2hk‘ª³Ú]wäáD8J/œÏ*”j“Ùq»é3¦ñi¾,9yíÚ 9³s´;IDAT%hÐåùE3‡Å7uû¼‚FoÑüñš_Ô›·ÄhŒ1÷pÏF! ÿ3gŠ÷nþ¢¥ê©q®Ü¼é¨×˜åæóÜþÔ=µ¼ù|@ÿó&—‡S7ðu¦8—‡Ãå†Ãáp¸Üp8.7‡Ë ¯‡Ãå†Ãáp¹áp8.7‡Ë ‡ÃárÃáp8\n8—‡ÃárÃáp¸Üp8.7‡Ãå†Ãáp¹áp8.7‡Ë ‡ÃárÃáp8\n8—‡ÃárÃáp¸Üp8.7‡Ãå†Ãáp¹áp8.7‡Ë ‡ÃárÃáp8\n8—‡ÃárÃáp¸Üp8.7‡Ãå†Ãáp¹áp8.7‡Ë ‡ÃárÃáp8\n8—‡Ã¹þ4}_>oIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/stat-code1.png0000644000000000000000000006137013051004444021412 00000000000000‰PNG  IHDRz?ÇWŸsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ3-:õ:P˜t$áØ»V]#„Ðò¬™ÚeãO_%;Qp11ëÌÆÃß?²äµçóŠ—´BYÎ?úÃw)gvûí+{9ÛEP^òuiiéöâ|[aVNÜ®Ó+ßùå¹¾ÇC·äž³ [7·ÊJñì8ùÓ:žîŸJþ‰oN:°jIý‰€9 bΈúH:öÜá Ö# æN¯w;=bïço†¼ÿY€ÉºóÀŠ•ÕFüÔ¤‘œ•Ñ ´¢ ë?|¦ÀÜgàÓS«‡È¤QQꑽ_?¹zæ3ƒ_û<@ï6pl'~¹`÷ëÒ/rצ-3­Y͸ՈTQóö}ÚUw™`ö‚Œøïïš?ŽîŸ×±SS* Ç0lÝüÓGSPöOöoÝ®oî…X»$8ÒW¦¥Õh?´GZMóöÌ)qBiN„ }ÝOØ»d½! ËáO_.ª=ª_ÿUh !#çØ—YÙúöͬ^=€T¨ 4!º~J;·ó¨ H9·w·Á;¢ÁЇBYÑçÎÊ’(ïœ!Õ©*Ш dêMG½Õ¢º|róRB°‡a¹ù—xt 9!ë$É€Ø_¿’;©íæ½;•dŸÎÎ̇€$¶í5´{úÎÏSòÕ¼£?žJr´¿óIªp$=2woÖ<Ü$ e>$W“¨`œžt€ДÌäÓú?iÒ×j?¸aì«mz@PeN(Uój;²«³?­‚†åæ+0B†$C’!93÷8l©Þº¹^¥­9£kA Œ-îoì‘yäÈ,@ }Þï–¿õ«Ù‡W|íùQ›æ¾—¤!”›{Qõ k SòÂ$é‚B…%'_ Ázú³´’ððÈÕÿÎOøäÿvø´CT©e†ÐŽf-'·@ag1þ›ªØèmg?&i€ ÍiÍŽ-öìzûmwiñÛ7çf½VtF@öms÷À_çsqhWA¤:DóÑožûðµ4ÿî#îì¦9.M+UÑÍÒ*› ‡KPd9ïèÏÛƒú¾ê M…>8"´QhÊÊoÏ?ª¯´F°ë¾>A5=jöîÐÙëüªµv[K$Y¯ÓAÒAÖC³¤\4-±X׺÷h ¼ð†aëæ_äÍ(}ÝXÑôή²RÎX øD>Tó§‡ÅÖØFQªŠCS2¶}8A/•¾| 8‚û}Ñ1HxÖë÷üœ-ïOÜðÁh³·ŸÙÇG)̲æˆàæ¾æc@É‘“r ÒJ9óÅ!‚ûLöx÷íãÑÏt®+„LÉË_YµÅDDö¢LkANq‰±ãã [5 % ì*fXnþ‰˜ƒšÕP<®, *H³Öë4¨QË6TÞÿKPäFßu*9Ñ.ÚÈ$Ì¡mû(Õ^q½OÝõ—ÙªÍd”]áÝfÀÛ»S.O¾pÎîP¤Úª5ïÖ¾¹pB½klž0x`E)oCR@@À“O>ÉÖ s$¿üJ—-‚¹l`õ'®¸, ¸æ+V‹Ëc¬"~QÅ(a*€]ŠðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7œ ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0,7 Ã0,7 ðÜ0 ðÜ0 óO…?@ñŸ€’oHÌBåïM0,7Ì%±!’E‹%_ s¯oÄN¯ScžÂŸÙi†aXnþ 8=ÄЉCêì^{#"[·è—oöNríIƒFMáíƒÃû ÉPU„wFqΟ…›A’qö$h*ÚE€4=Y€6íQXˆ„÷ç7‡Ñ„c‡ IPtê‚ìÄÇ@H$4k ‡1ç@€¦¡}'ŽBë0¹ÐYn˜¿MFõ“û|·½@_R|½¢uxú<ØÝ;èÜŠ9÷_‡Õ MÃ{sм^zlVlÚ‡Œ4L{z=ô|ð FÌx š k Öî…Ó‰Wž„‡'d­F\4f¼"ÏCHML{¬Vì؇è³xk* ˜=ðÙ÷ÈÎÂô¡ipرf¬V¼1O½„Á·Aábg¹aþV,Á>‹ÏõŠÍîUî‡Í†½[Q ”*aÛn·…RDk‚m»Üß«¶¬Û(Lfì>à>kÂ;aýwœV@¶—‹ªk¤û'€ Z5¬Û쎪ˆä "äf³3‰å†¹u(,¥?‹ËÒ€+,*Ëå?ËŸU+?+ÔËS¹ÀB@ Ed/6mXnþMAg‚PátRù}$=d Šƒ„NÈ•Lôh@©¢P중Л®¸4šZîþÙ $‚ÓI€2tzE©|C"HBg©P«ho²BR¡:ɵÉ/„,t:@T'4·ÿ—ˆ $!ë!@Ðhêå¾á.Mióf©rE>Í U½q®d"½¤@U¯½  °ëšåæ_”)ræº'ÇÚ;N¸íî1åºp5~ñó»O¤ zíç’߆oÝU ¹÷3(íiÍ©oûÒï´êŽ“ç—4¦ô¬bóˆ|uS¯sËz°Èl*݇dÏš û>Ö1ª àÚÏE#ó†ÄÌ5ª±ªÀræÇU_~S}ø»}zuÖ¨Â6GBGÚ¶ß>™nl=~ð=÷V¦JjÖþK>KNLοVää®Ãúé4· äŸ\²{é‚ÜB§oÃ>]Ç>ä§#.±³'®Ù±p^fv±Á·~ÓaS[µo ­Üî.iv±qMJPâö_W]™:IßáÁ›6«v-«¢cK^z*¤ÏWÝ4ãÇcò4oqõ†Â ËÍ?׾ч¦]YgIUTÅI*|[ŒkëU,„²-nõEuïjÛª¦¦‘>ÄÛ€ð¥úvAjîù5ߣåÄf ½H#M3hªÓáÙñ®¦ jhhN[^LÌÒ‰‰§žúÄ8£ e¥Ï {­YÒÏ®úèØÑs29¯NÏ¥1…R·yΡÍ¡hzU­ì©l©›WO{Á«ÃØ6CGhÅqç7¼¼,îôˆÉO "sýÔ5¿ ë?®Q)ïìòUo=0púÂPOÑÅ®ùaIhÔƒ"ƒmé{ν7ÿ=#›]Š7._ͦ×ïP¨?èa?}9ãJÈÁÁ^7º¬TÅ©i ˆ½€#ûЊå†åæ–Aƒw“­š¸:ï¢Üu³ìõû·îßîÒÆdíîrõæäLLZ3W´Ùª{µ²±’kÿoŸ¦}[tk©–¶Šz B×~ûÙéSw¶oæ!ÔÔßÒu{U“òw,8x\ùúW;žA•ì‰»önIì7mù™wFVšn9añÛÎÏßþèr ý2~\²;¯ø‘Ý…w×í÷N·áÝ€È43rë¢ícëIÖâSÛ–š[Më;þvI…Ðßàì¿aåŠ.=š]2Ÿ$ @DÆú=ÇÔô¨Øøºê˜Ë8)¿IÞµ÷Ã#TùˆRÐxE–¦J÷ƒoæ:ƒ\”œDÍšJ:dmYáÝb”‰ µwÏo)½ê&¨«9ræmÞú‚3U…SÃÛÔتD$daôñ$h€Tœm·:‚û»÷å„!¸YTÌÖòì=}esûû¾V}›K*@Dšð¬B‡ à’óÊì¡•µs"Pcÿx÷ÈæÕŠ¡º¤’WãÃ^hÙ®‘°í}ìëïrÆ}´ÐÇSÊXóݯ´·¦cçê»?îgœÞÂgmfŽÍ‘S Õí6ñý°zÁЋ”µÓv®\ãô®íaj´íã¾± <0»³«˜åæß8 R5—+Õí$ÐnÀÇäêà[1©šÞÀ¤¤8Z\shG€ !P¡UÝå è<ýt¸v¿.›%ƒf RIƒ=íÀ†Å»ª7àkÌÉP•`ÿ Ò||CGŠŠáë£ó­ÛÆT!$©(fã1ÿ.xJÊâmUs¿Ç–—|UåS'‹’³ŸìZöG‹©Û"ššAê¹oÆí^üZz ‚ B6LæKW ½Áä)Ë’€dðª.νïùدCÂ%#Ž½Ùq÷ŠÍaSÆPÂ7–ni:yYTx= 8ýݨ»ê²:1bL™§Œa¹ù7‘»û“ù[f–WÉämò ½.‘ ƒ§ÑŠ&@°fÅ_3Ï¢5k^CŽä£U4hÒ $®ÿ‚3›µÀN†j­G÷~ø1ƒÕQDðÐë/…Òëõ MµãÒÖå’ì81âYkøÐÁ]U¥ÜÀ'¥+–¢‘IH¶˜uó³ôåœG’9lÀ½‰¿ÿ,Ú=Õ©¥Yµ„Übôøƒ¿Ÿ–Y=°v•R¬HÞ}ê7 Ô5#ïYãÈܶ Õ¶hRGqA4è1ñØ‘×@Þž†cЬ9ûnXnþeö˜zǽw—ï)ã=µíhòuˆZBÒ÷cæ~ëŽ[HzÉ£V¯W¾ 1A#\Œ=¥Éᡵ¤ÑfH#¿6/?¼ð墄Ý;¿~sí;)Ã_þ’PÊG.·´ËùJ´¼c³ï:|¡F¿ßTó¾ÚÜÌÇÛX˜vª…ש&\¶KÁ¹¬‹Æ°úB´’ü”›Ý)›ƒBCòÎèýÂ|C¼Ä€nûîÎG=ËLŠY÷ñ„Áû+—‰‚ˆž|òI¶nþ#µ»ZšÍÁaæà+š’ίa„Ë—R–K¦À°ˆ«Ÿgµ&*±…dŸzmË]/¼j4¯ìÙàúÛð纽¯ßr†ÊVöJ¦ÀÀúåà ²GP£ŠSk/P–¾!a’Ì>5›û\bwôÆ€ —. .ÍyŸšm|piηi¨/ÜþaÙÿnë²Kª5lW^Ù¸ú²Ü0·.z¼¼þþd¨ÀøIèÞ—]Å,7Ìß쌠 :®_ë6”FÞËW @sØâo“Â}÷Á¨ü –æol‰z€ûû4Úus¢’$Ðt:Dçà‡Ïñö4äÁ£t1´PSéü§ P ž¥Bàú²Ÿ¹tÕŒëlÙµ‚({ÛÓhå[­\T%€¼~ž@«Öì*þgÂáÿ.ņ½ÏÌʯÓXRUAt½þIªš_'lïsŸè’b±wÂ;!=²ÀÐþè…~=°sœNÜ{úF¡{g9þ½Ð' }{ 5¹95 }¢Ð'{v@/0l úF!*’@I úõ@Ÿ( ì3§PX€;nsG•˜/^]Ñ7 }{ ¨‰ Ð qHŠãJÍÖ ó·!;)fà˜„^ï£iã6p„PLrqFŽAA|ý`ìCˆ¿/_„5ƒ,cø݈†—ê5‚ xàQ$ÄÀË~þÐé1ê^Ä_€_šCÆŒGR¼¼A€É„û&"%~­³w܃”ø ¸:ìÀ¸IHO…_L&UÃ]÷@ß!ì»ùÇÂáÌõ@ÀA/ 8tpÿ¼â¬£´¿«ð¬ ô€T.°ë§æŠ™`—~ºÎÿ–)p<Î0²FîúDyyû¢üÏ?ÖåëuVrW€*Î2ì»a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†aæ†rc7~’Œ+wPåí›ÆÕÛË2ËÍu£A¨ßιO£Ü¾vBˆììì‚‚â½î˜ÿû±0¸Aƒ@ÏŠ{!œ +?Xx²Ux “TEâÉøF4²L®:æÿ¹,þ\—(„ÈÚ÷Ñ7kë6 òÖ³ŒüY$||ú™sEÇ¢‚†‚Ür­ò]Ú»1º“fUON}/Ãí÷TBHz½Bn\÷ï[w#„H_üt¿{æØþ_™BBˆå“{þx(åÊ”´ íËt¤œÚºdÉyØSѲ}›÷â×Ïp{ú¾èùn‹·Äáxé4D‘€À…åðj‚?ÅÞ½˜ûÂCñÓqíôž¿.ßPbK]þÓχ’òªH¤’¶í»Å›,Tuâ…â›ñ½WÇå_÷ê!„84­Ï´ûªŽY;çî{^øY¹Ñ&GÞÉ…?-Ḵ±†ü5ûÆhÏÑehpB@šÀnûú픇ÃG§RoÑ}«" :ÍMH¾Áx“L’ :F*í¢¯:Qñ¯ìÌÁSyžž¦KÑ\}³JLj ·uzy{»›pæȉEÕò½GÞí¥ð–É-ß)œ8ˆÄB¼5 ›§ãh.œqÇ3h7–$ì>„Ü3pîÆ [Ýñ<~|‡ 7û÷#'½<ñÂG€~”Ñþv‚ºÏ˜hÖ_®#•¦õ2SâÊÄ_ÜwZuÿ]Yž]ÓÒ«ø˜ºa¿ÍÛÇ«²Ô••Å¶CEÞÞ^ºÊÊâ²Ò®°ü+HªZaVY‰_ö¬ì pa´Iƒ$Žämý=c¾¤:HVûNîSZŒ¶F IDATcˆ$@4¢ np¯!Ý­‚òcvL?¬KDÇ.}F~¹þ”&„„ Ì£+'ß= K—Î]£ú=õÁÒL„"ucDx‡yëÎ-~ç±¾=ºvíÜs꼊Bˆ•u˜¾5&ûì7ám:|• „PŽ¬˜}gÿ¨ˆˆÎ}npéÞx$„ YuŠš²çì–¯ïؽSxçL¿«8óâîëÛû Núà}ï~4Ë!Ò/‹jÓtæ6 Prú¬m@„ƒ'¼¯à…Í8¾Õ%wU¾½= ¡Ð‚Ôs8]Œçßs×mS¼8 _¾ì1œŠŸ¿†—«xâñ¤ž»n‹y0ì{Ö'u¨ h›¦ oÑÿþ”"µ‚R–dg~ôŒ‡‡EtŠèÖoÌO/ !—?¨[×®]» ;cR_¾=ràÄ×J„øþ¹Î&m<»mÞˆ¾Ý:EtùØ̘ûGox:…ÔÅ0°›O/"!IBA2ô2déF 5Ýp4"²glÚ!üé¯Ö;qrïúvíøäœ}*Qêáï{´mÿÒ÷›OŸ;æÈÖgwê3ñ‹S£‹Û»GEö>ù—'SÓ3Îî_6¬CËçWgQQÊ©çî8ôž·ÏÄ%:mK§=ع×ðeÛGGŸÛ³ò³~í#fîÌvÝø‹—E=ý‹å±Éii‰G^Ò~Ð+ˈ”‹'~èÑ.êó5{““ÓåÅxãÅ)kÎÚH³•‘ÕRhÓˆ4íòÉ¥¡ ÉÐŽrˆ}I%—;¹üm(©üskäŠ`˜™Z=ND–«J¤Úò Š5""íô’Y/¼ûe®U½"ËJv?Ó¦ó€±wO^±ëÈ©‡¿xîžNQæ95Å™UšøÄ„ÄäCóº¶éµ`çñ”´,hñ›ƒ»ö½}ÊûK.$¦¤Ä{wtç¨ ³¥EP!Ö”ƒÃ»µbÎÚgΞ9yxÑ´áÍû>•­¨ùÑknëÚíå9Ëã㓨ääý][Ý1eö‘“§Ïž>±øƒ‰ºÞwÄFDT˜°oÜàžãžù":6¡ÈYyÐœk>~¢S—¡K68yüÈÏÓǶîv×á´b¢Â/žÕeàØ?ö‹Ž>·ÝWÚ·{~YYc~è٪Ë?n;}hÛòI÷ê5pý©"ûò·'uŠòóæƒÑÑçö­ùb@ûŽ3¶¤¹î”ulã+/¿²;ÁF -ŒûhJüÐ5)ËÒ>Š™ôrÜÝ/]¹ìâ<""•4Rª¨7ÜœÛì|±gÛû>s7Br®œõÊo|YD´hBûŽý\zœèܬ¶Íû¬M·QÎŽQ‘Ï|¶šHÓ4Ò”’×&tøÄzˆ”¢72âÁ¹V"kêáá½ÚMY”Xv£Õ³F‡÷»À%7¯ ŠêùHriÜ1‹Æ4éó¦…ˆòÖõnÓ}É‘”K÷uëC%Yü× ³Ô|¹¤lë_**fÃlèÈ2«Ñ¯ÏÌôûé«ËµüÝ´«ä¦yóî?¤¸ª§¾mß¹÷²ƒ™tEâ³–E¶ìýG|¾+Ø’éƒ;wºë”â¾Êqanxã>òª*—Œ£Ë{‡wY_vÀ’ŸîT5*96¢k·wï'"²^<¼oz¾4MUµâÔ£wtiþÖn+‘#õÑa½&N[ꬲôÅ©h5þ˸Ò'M~í¾û¾9œîˆß5¸{û×~N*Ëü_fÞÝ%ê‰,¢MOEµ½çÕMÚ¡ÏŸë9hý©\ÇÅ3w÷ióø·qe‘oùâÞö½ßÈ»<5V"Ré¨cãóq·/‰ÿðǤÙS’G¼8êÓ´gšES4•R¯îSo,7gUqþ†%aC븜 ÝЧg €Ô]'”6/´r;A„õk,»#®dPsPÍú„ ‚¬7à(V/_{1¾È"¬9{/Þí²´“³|ôù{Ï• ÂÐTQ³[u¸—Wšü<„³Äx\næ—·ø+N~Ý‘XÕq‡ñÎ3¿Ò®Z%.ó¸fj>¹Ï,Á¼]ÞDW\QþnWßXñëâŠQH¾ž‚HQœ×²TU­FF²ûörðƹû’œýü*Í nÔ¶u5úlÒ݇ºvéÙ«wÿ¨Öuëy\éI1µo”:{ÖkgRsìNMSl9ªÞYâL²ø–ØÔtôíY¿Ô5Të­~°o“Å"·èZ»,7êÔn+«›¬¶=çÔú=jJ¥yÓ2¼®ºð„\”›W ùX²x€HÏð5ì;UŒH/QE~þ×"!%YóÍÙza7Ü:E"2 we½©YusäÆžoûé. m…v)ØÃ}œ!™= Î<‹âÊ!É¥ÙáªZWæªØH2Æoÿ=KvG*$©N=Å/«²â¯ænÙ¢JŸ0ÜÖ†QQó^,ÍB€^¥K  èÒ#cÊ`|t?˜¶ÿŸybI§»"½tí1<ô—®2tÎb{•—yÕµfýª/gý²mçœíË^É’xç³'nkUn~BPÚÆÁ§¢Ã€‡ÇŒ«ä­æÅ¿óÚë­â+%vÕàit‹l™/IQìªfrFƒ(±Ùìy%ð0è÷Ê'ƒ§ˆ¡*6U2&íüý÷²RÝŠ½\Y0 4À ™É9^ñ²f6Ù£Nò—BH¨B•I•I¢›ºŒéæÈwCm]žÅU§Êy¿}kù8²­îº&göE‹©s€nñ¡Éä/;K†°ä¡ú•IÅÿR^ù˜6mFbdW÷‘Ð^›Š-žbŒòrKIâ> \TŒmUÀñ³h|ó–¦ Ü$+à äÌ+´z„úÈU¸í„€ÏÐI¯¤ääÄl™õðk¯„GýÞí’á¢müimaõº_Ìz·µXҜЪœB» Ùäk*I½èD=}ù’1›| ºâ¬| š[X -…D~¾^!>]b-+É”÷ËêœÒ›¼ú§xŸ°¡a^P¯Ñ°ˆT ¨V3,8дgñ¦²újÇò•ûS®Ñ„H-ýz¦Øóóò¬Î«ÎŒß?ÆÔOa)þèhŒ¦há‰ßt¯÷s¦âÃUx`†»íýð –daË´ .7j¢«4”œ–¼‚"í¯-ì.—xò¡“s6ìNs7è”íKSÍMú4+Ï‘qjí{s6Ú@çX½ÃmÃk8r’Š4Wþi @R4’%“Éà6(÷þ:'Ë)« •Ín©r¥ÓêÁà]¿^=ß#?.w¸îj;~g³ÆÏ®½P³^c?oÑ5»JŸË~ôàQ{pS½¾g¸OâÞÓ™ª+ó”Õ[Ït¤ùTkT³†çÞ…(¥ÑŸß³rùžD×b@ÕaËËË·+<É®šA0)f½S?¶îsBƒ€{JâorÞxëF ÿ°çºÑGíÞ¥=áÀ¦Ç³ õÈô[wÚm½Â­‰ÇÖ®ÝÚsü'-¼uÈ­¢¯Ô‡=3În˜þFv›ÛŸñøÀ‘¯¾r_Öîž-k¤Û¹qâ/¹F’|놢`Á¬Ò›ÝÿÀC"~ëä)ô}cÕ#®p[ñÇ:ÔˆFGб-lñØ~ÕcXGè}€¶“Ñx7ÚUÃÞM°Fàã>€<¼:Æfxœ¥ªéðÂÂxe•80{Ê›g¼~øòýÏ?½¼Ê¯,ñ-×¾²?ŸþöÙŽ­&M RQ¿Ë/OÝu¼Ï`Ü3«ÿØq÷«-õUÙz&ãº_=xxydÇ6&çÅ]Û·”´ë3$T9¸&96ü:_Ÿ²£G‹fÅ‹÷ÎxãÝþ-v­]¦‹x´n­¸S ß]Qç¹Û›{×ÔÉüííç:ß9¥os…@2ú?=qÔ°)Üû衈úž'÷nɨßoVðÓŒûáÔGóFu©o>¶iÃö$ÿYK&€öONo6ä¡ÇæöêÚ2çô.«ŸY(*„wíi 1õõûò÷õj]+ýä®Mûb‡¾³Èu«´Ý¿<öÑ/¼·tDKó}(A*œš¬kÊР{Lª‰ä¿Ù«%ÝŒÉæÚŸ/ùyBï&¹‰±%~í>\±î±N~Dd®Ññ·Õ?Œlxòà¾x‹Ï¤OVÍ™ÜK_»öíkW+mÿBª×¸]›ÆÕ\*0ñõ燴©y1£@o2ÔúƦŸßiå‘{øÐÑ"¿Vo/øõ™¨PW7[³aÛvÍ‚ËÒalÚ©}C4™ùå³­|miÙI:“w½† ÞÔ£(³@‘@ªjlÿÑœ챇O$Û{=8㳩·»\•¦|õÙôÛœ~MbÏ;›ÝnÈ¿|?ÝG@™ß¾Ü9TNJ·úudíܧk8Rö<ß呹sž1í¡±5¼‹Rò¬€÷˳_êÓØ/5½XoÒUnŠŠÚýŸÛ±ôݶ¾Ž¸ÄìF½'ý²òóZž2‘h>öõ߽Z·{ßIÏ6ƒ-[Ò=ÔDD:ÿðy æFÖ÷ˆ9íße‡S oÓÊ×,¨3èåm¿½ßΧàÈ¡#ù^M§}½ô…>u]%nðñ÷¶çÛTR€*i˜õN³ŸAßÞ»·&Ô¿Ýê»I¯hVøÒ¢Ëm(*:+¿ÎQþìe#Î _~t=Wù×yÊÿ¼<†K­ñϽ™FîTE„ ÚW\xÙÏNýÙ»?Ìõ7 ¢'r-$.ÿ‚â¥÷¤®vQýüÖ€/LØ¿ð®*3¾B÷ÍÕnʇõåîyÅå•g`Ž"*ÍEñçýnWå@¹Kˆ r_ì7ºïOûVcµJšæp|’òb¸×ÀžAýéIþ{_[ºIŸ×ºººkL¥'*¹P\ó€Û¥!ʽ|yÅOQ‰›óÏùÍJÕ¤¢”ÿ© ËÝøâ–aÃ&ú*{"ןU¤P\Ëm&TKfÊEëÕFD’)°NˆwÅNª­Õ«’-;1½XH]§÷®PY9Wt§*o^qÒÜuÉ{Šú>ÛƒµH‚$ŒS~È ÒA*‘¹Õ冩°£®ÖûÉçpÝ^§v:¬%6åŠF˜½õůŸ1¯ô ‘¦8ZN=<äuyçÑ÷‡>ºÍÛCwõCZkßyø—gÅMÉPsÃ3§òW*\™QÚW‘ ÀõëoÏþÞÍ-£]å?LqéϪ-•ë2{|íA(·‡a¹aæfÂûL1 ÃrÃ0 Ë Ã0 Ë Ã0,7 ðÜp0 ÃrÃ0 Ë Ã0ÿ`¨ì¿Ò}-è²å±Ü0 ó? ¡€TR…ƒœe/< @!¡;)¥û±Ü0 ó¿X7ÐHd×þR¥vŒT$iréÖ\,7 ÃüoÖ Aª]–mMGڥᓰÙ%UvÈtùw|o–ÙÅïL1Ì-‡F©5‰dE•¡+ýöi Iƒ IB¾É©bë†an¹Á 4á” 2@’¬•É 95Ù©: åïHË ÃÜŠƒ) ºÓ's_{Éa˪(:»Uwþ¬ì´ëþŽQ Ë ÃÜŠ¨JñË3´÷f:ÿØ èH@¸v‚U¿š—Õ§xÓ6Uû>@ÄrÃ0·"ÕpѤ-ùQÂFªP €¢×ß **ÈY²@ÒI<3Å0Ìÿ %áí©wȶßþ.Ȥj@þw_ë‹ò%¨º"Ûß’0–†¹ÕD¤×94Ò¤â H™=I{±ãÓ/ôFH <šw” ÞüϤ³Ü0Ì­§7’$÷¨æ»g£’Sä<±ß|ü„NAà÷øƒP5~‰a˜ÿ}4%@š×Ä 9²";C·ŸýÕ·=%É© eð-4$ß|_1/ó+-  ö$¸|Sž¹ç}[Tvª|rx§“+²3„HÓ„¤-_®Ž¡zKãúJl¢‡j/6{úìÞ.ڶѫ2䛽Qø¿Òº±Åí]µéÔÿs@Òî•ÑYŗ鮢dc§ju§î-\ýá=­Z ?«ÒìGžžô™¹}ç(âî]"„p®ŸúnÈÃyúcΓ­ZEÊ<Ý»I‹‰³WUvW!„85½fÓþÒ-É=²úàùL×ßVHÊ»)/>³iÓÞíZÁì‰W¬?~ƒ—– ‘º¾]ÛÖ,‹ãm¦@Bµ;Dd'§_ UDÇø»¤jó0¹y3½SV…*Øwó'ÐŽþúͼE;ÿu—ÛÒwß;œRpå9SÇ ˜Ðcø˜ºþþF°&^X~ªñÏ«&oš|£×{ ½Ùèë! uvg ¿ áÙô­7n÷×é«,=“¯—®â¶¥þññ{ë'œ+ßgW©ô\ß²Ø5ÿÓEkŽ]Kn´“+˜ûý6ç ¯Îz£]BÒëtNÿ@­S7MÒÌ’PH'N}]Ö›H‡rKo7gM”ü}[·G§äÏàÎ}ú‡ÜÃkÆö-»â³ …Þ³A›È¨V5 (áÇå;Úõ½Ë;mç¶ã ªäÝ<²o§FAίœ·`ºC=ùý¼ùáw=ÔÁÖ̳[vÎ(tzU«Ù³WMÙµ-ø¡‹bŒý†7Ï_³nW®M®Ñ°u¿žíu¶¼?–}µ%KjòÇR5.lÄð!”½jýνïëTÛ_sØ¢ê˜äKaîÁIg-Û`•<{VHnØaBPÒ/Äl½äèôs!(ëøŽ?N¥÷¾íÎÚ¾T½Iº°{õî u¦€Žý‡6 çΟgÿžŸC뿵ÔK…kRäšÛWþpñÔÐÑ£JÿòGFë ¼W-ÛiA`íæýtò¾fñ¡øȶí§²HAµ›EõŠð“pì·9?¶Uß÷ÝWQ÷Lhê…¸Ã[÷ŸJ°ªÂ7¤^^=‚L€1«¿þnw¢Rìøþ«ùF=På â6l9šoó nÐk`÷ Ù=2rdžÝ°ýpf±ÃèÜ®sµ¼]ø‘íâÖ ›²­~µZ ju¹:%mÞ²'1§ÄèÜ>²o³&WT¶ÜÄ•«6Öˆ¼7ª¡éÖu H€"I²Z 2‘P¤ÜN]ª®4©â-–ÿõÖ BS ¦=ôø3;¶gëd Hßpöüg½Q,:M}`P€ŒC¿˜¿ 1O­¨;—ö½wßÃÓ:îèÏ_¾ûÀ {ŽY{ANà°Z,‡-/#WÀ^Rl±*BBƱ%_,X+ñëõýÖ·kR3Ó6ý8硱#ÖËu‚¶œ¸æ}¶å‚õ6n@Pô9™Î­uª 0ã-;$$‚*‰¿áûZt£Ñˆˆ~™ÔºÛCÇ-®C–7è?pÜGÅDÛ?Õ¶÷“çíî°'æ?Ü¢ëè3…NÊÞÑ#*rØ“Ÿjî3EÏÝÑvè´ƒDDdŸ1ñ¶;úJ#¢â„ »yy±ê–÷îý{=³ÚõãËW‡Dv°#Ý}nÏ[ý[Üñ±BD–Í}Útÿõd–ë¸ÓZmQµò)vŸ»°(´çîh""Í^ðGÿ¡ßßù£4Øчï˜Ýe¶ÈºbÚÇMŸÈ+pŸÑb·|ÕtÈÞß3HSwLýU³{’3Ý×Ä=}Ç'}¿uÝàü³w~1³È}&{]·á³Û<“W¬¸#ÑÊ£Ys3¢/ÄYìê•y{úýV­ÂGÏ\ëÎÖÓ+zEE|°"EÓˆœ§ïèÚíý_ŽÙ÷îùõÖW°#ßÞÙ±uÇYûŠÝY¶iZëö·íÊ°TQ†¶ÜSw†7Ÿy¢ôwÆ®·f̎˵]|lXïIoüNDdKœùê‹ó–r‡±º³móW÷—‘úñ“ÇŒýLq=™¦UVO¾}~PÔÝ幎äîÑ%bÚ’ä(xáî¨Aϵ–]ô\Ÿ¶·½WD”õû“ÍÃGlKwgÚÆ9OGvëúéÊxÒOêßãž™9¥ùË :ŽíªhŠ­86::³H¡[MÓTU%•ˆ(yÀàb vIvQ" Ù“&‘MÑÍ©©ÚÍOÛ·nëêEGjê×Ú yLûvýß?뉼«Ï63®±Áݳ¶;¾vÎ…5q%P—Α©zŸê¾ÎÌd€êP5"M±ÙIg’s ;ß}'©Š¢(Šâ5p°}×¢h HSDÍ¡CÜývív5Õì¬B'ŠÓáOš|†…z”Ù–—lL²;! 9TjABîùœ“GëK»âºco7ÄoM,¨Òá¦9¥ºB‚Ýi𠡬,ä'nÈ?ØË}&°ÓÝ5•ïŸJ#LþÕÃÕ÷¨È%¡êªMº' €][‚«×R²fp “Ö¦J —Ê'Šþ¢•oVåþºÌƒ§ËüÎÙGcl~k{Ta™+ÅGϤ€Þ?røC ÿ¸nvÊ–¸,H(k½ÙU§wx·P×­µø)¡^» IDAT'²å²›ÒŸYx'×k^‡Žl8€„p,ŸñòG«™½ëר¦žØW–y û ´&íCu­ké²/æ95ˆÒâS‰Є±aƒZêÁµgË*´¢ìB[Úsk™6ÐȬÛwyª€sÀà Oæ<øh±Eæ¸ÓÚùó‚Hƒ¯øæÌL!ê™ÉA'¾{þ—Ó…–⋉G>Z° >¿ŽÐ{Òxݶés÷d[,–¼„éÏ-ñéÚ³_ SUù „AÖÛ “/æIÕ›ôhÜhç÷/ŸLͱX,E¹±Ó' üôïTµjë= äˆO»XR\¬’(N?óÕg³÷$:«îôd¯ºQms¾•Wà,.q¤ØùÊÎÀÇ ô­ÚyåÇGŸÌRmgqþÉÅ«ÿD9ê?ÔÕñ㬓' ì…–‚½ëž)ÑITÑãRæá Ÿ}ùmb¾òú"Ùh ÊÈÊ(*,€0HIÎȲºDÆè‘5÷_³‹,%ÅLûÖÞ¨M¿Z^U¨YqÊÆÇî¸û›ÃEEEEEEé{6'èý›UótFI.ÈMÉÏ/ôó«®“ íM*.¶ä%ìœøøßšž9çíš ƒlp%eæÛµÊë‰GC-kŸ[r(½°  nÓWo¯Ùè ˜©“%Rí7ÿMÜW9‘vfëÂqCºuèرCD÷gÿ~ÑID©¶ƒ+¿30*ª{÷nÝz>}³Ø…¡Ê¼óé'ÛÚ÷ÚЮÏúöQ'VPëD¤ˆHŸnøtcóÀÍ.Q»BæßÿíÀºú~gHB*žŠ øªûž—RÖ7Ö7^dôÖ¨²ãfǬwò]עϮak³N-û´îЬB}e+®­žâìÝíÜmÅ”[‹ë·îv%ÕècÂœ‹îçnºN)"Ò‹_Mxǹ‡_ŸËiš“ŸèèììÕ}àÝ<ŒÛÒaÀšË¿­Šèõ¾§›‹OßÑ¿Ä¥ÒR_XåâCJõ×® òñðôòööôë=dó‘:é½ÝythÛù]ßï¯eˆæãúN—.]Ã>Xt%Euâë)Îí: [{‘&ŸÞÔµsÛ]—Ï«ªžèòmû¤‡·‹›»«Çû!ë\Ó¬R§ï[;/°‹·¯Ÿ¯—_¯E›~Ë7æ<^Û»²—ÇÛï¸zu0ì·“?yvì°lw"¢.ïø·Ëzû{xùø¸»ûŒœ¿î~ŽÚp—9÷ŽtéÔæÃC¹¯Ÿ[J¤¢ŽRDT~·[ [·1*Š´:ªUêqjK ¥5—G@súŠššwMAM9çLÔ-jT" ÔÜ´¢Õ”W•–ÛN+þ,5{*Z!‰š´ÖŒ O]ɆªïJ?Å ÓÄÊXöj:±| bÜ–ö½c4w²—*¾âŒ¤/ý¾©ºÈÌ&ýÍœ7m-9ðèÔK/i_G/¸¨§T/Rš–þ¨“KÖò¥zD-¥T©N—éÒ)ßσÃ^²ìþ×áJG˜´#„”ñ^UL'ݨ¦ÚäÜvRñgùCˆÙS‘ IĤµfl¨xêJ6˜ʨl…òê×ßú½õf¹¾VYk ÿÓ‰`ªÍLhùᡪ»L rò²_‘ýqÅ#%UU)éoæ¼iÛŒþ;!ûnìmÇPwÙkè–¢„#TÏt°o~t­˜qD) @*1ÜR À‘ºY)D/Öüj~ì‹ðÿ÷u¨º?sŽÛ<`àÏ~wO+ëRîóU¼ÔÔX5uôý|fßêéå??2}ÅqÞäUl[4o¤­„«¹ }TˆH „' è*ç%€‚H€C$2>µî›õ 3œk½Â[É™Ü0^-ªœ'I6m›—›C) É ÞÔg4Tj߶ùÕóTj2ï=É5}ÞªU󆎭£ñ_5oDByŠ€¼ÈS(ÏñG9ä8ÔH$DB7¯±S‹Þ÷¯u䈌—2¹a0ÿEÊ0!ƒ@$Æ©±hˆÄ”§É‘C/˜*öè/Ú^‚‚É ƒñZiM±¾KI¹¯Hpoø¯fa+ƒ0¯ @$H(%”ˆEQDŠ¡""  EQDüõÇlB Ãõ Öüá¬uÃ`ü[:S„€^Q¤;tHÞÕSïØØ‚u¦ Æ+S#£3NP¨ùo¦˜Ü0ÿ¦¶OÙÁÖºa0¯'l¨˜Á`0¹a0Ln ƒÉ ƒÁøË a©ç2¿ Ë1¹a0Õ¤2H)êD HõHÕˆ -Aú*¼VLnŒ)‡RAäDˆä‰&ãPÚæó]/&'ñY¾Sã&¶–Õñ‚µIIÏxÛ† ää¿®¨JKHÑ5oÑØ‚¯údš§‰Ïô\Ù•õh&mêY¾Âl[~{œµ¥õäVŸæî! Pr {Ã9ý¯rÑ €«¯l1®ÝŽC‚ #^í¢ÿ‹ÁtòNÆN\øãߌDϯ÷Û½ŒŠIʾÚ,¸\xèË¡®® zDÔ`HG@K[@K;œ¶Ï¸sÁ)t²G¬k‹ÀaÏq¨§†p˜} ßj‚h_ °A[ü=©võøp32Žy6ï´ôDB6ªÎOnæ:*Ex±ñ‡–N8ŸRø*2ùÁ–IÞ~áné{,X}\xÕEþç×íß}ïÈíœê9[áð.c>¿þ·#-eþºdÖg‡ Åks›wŽ¼_¤Á1úk½Û¿íÝ¥k·bºúúoðê"N!"ÎKŒˆyØ—¢Þ’Š7u—æ<œ÷xЇ}w?ݤŠ(‘¢QD¤âëgªrÊuM'˜nq•¤\;#éyž¤ô4•/f¾ÑF@yìà …PÒê,Fî3aB ƒ5E q×’KVùÀÏipUêB@„ж°f$(‹ ` HÞ Bv!¤ì†ßÖú›`3 Šp_yù€AL„)Ÿ‘š7ÒI´ët[¾ð={™¤BÓ·¼‘¼TÂWh.FúÊŸwâðMò¦³ØüÖrç4½M8ú뵥ΤueËâìѸ´lo®,Ê•¶ÉòGSý€ÊÂI$’òáª*ÝeÙpïUß&!‰DÂ0S«¸Ãö 'âžgJJ K¤rþ”?R‘£’Õ]¸å—ãÅœ:w:ºeùýª±«A¤:@ŠzÐ  É’¶<^Á£Fä5­äáM†K@@8BD‰NäúŠ—/®¹ABŠmøxFTxÈ 1³&äÃↄ`FüÊy"ÂB#YµçªhˆH–yiPTä/7r.n_6 ,räÆã †”súüçô“‚Ç{ôê»3…B2oü:çƒÁÁ!a£g,½úL „N¼}Ù «îå$ž<4¬ÿ€ˆY+¾ÏÓ¾àŸsZnÛü1ƒ'/ÌÑ‘ì{'†‡÷ßvM „{˜˜ÐDž~/AùNpch5öWkc=˜ÕÒ²!-nfÀô­`€ Ba‘L›oh©Ã›ÎðåoÐJ-à oˆ»¹WNçµèS_‚ž½Û±áôÊ—ÓB>X¡Mµ_9žS~¿trhXÄÐñ ϧ"!¤ŒñcÃÂBÃÆÇQˆ=|þB|=pY\ÎýÃã£CúGÎþâÇ|Jª¬ÁHEâúÅS#ÃÃÂY´zw¦@Ñ|1¦ÏÞ,îô7‹ÂŽ¸« €ÊŸ×.2pÆÒMéjjˆ5·{JÐÆ?‹]Ü8 oÈñl³Qî !$÷æÙc‡†œöÉ–gzB1t ŸûaòðÈ°‘ÓŸ{kèà€¼Ä³sÇ Ž˜û³B””Ñ ’{çðüñC‚CÂFM[ráq‚@HÊﻢFüSC*ÊAmúº…BCÃFÏü"¡HÆ•‰09·V/˜6høäïÏ>-®?$ùÀ´ž·‹š„%£„„{_„ýÓ{®Ï}ÿmÿ>eÝÊ2™vßÊáááƒÇÌ>‘¤'„‚·v® 2*>MPfI¤Rª¯  „ô? Ž ÛsK…ÕØ!E;ZyHÑ'Ä"!{ÒgV2©–Ðvàõæh@Žç9CI¥ð¯z±­ ¢âþÈÐèß’À·GŸÎŽ†}q:RøätPÿÑW ëôÔË«ÙÙرçïÐQNŸ’’²óÓ…?$7?k^”¿Ã7S¢coh ]ÿÑMëɬk·1a’g]¸·k^ÐðOµ½G‡6£'E„~¢2ÔEQöƒK;?Z>hôÌ£Œºî¸Ô¶^D¨¯ å\{†ïo- ¨fð’UoÙJäúí[€Ðs8ôó4Ô -ì:üЬdÞ-@ßæ%¯èÐè1H@–ï„ JŸó¸§àØdîãvÅöQÑcÑ6Ïf6Æþ»9ÉŠÖˆŠÃÖý{ù[g]Ž ˜P¼¼Äø°±cÆ ë¬Uó¾!ƒ†õ ¨•9I|3ïóA£fLÖ=åðç£îBÌÏF'4?1ºçÃ)ò¸dž_1b™ŠJ{„öãZ¹Ž1¬™<÷Ó0ß/%»‡õ÷×ßù9(⣠BÀ-dˆ½œslâ6òƒqímª5š°ÿ“÷‡~¦iйw /þ¹3¼×O BÄókÇ ˜±Å¦C·èè°·¤É3"C¿»U@r/>åiÙDy>fÍAK‰qÞHâÏ‹-)ròÖ’|à~!!Ɖ"Æ¢¬øD§.ÚsO èß\ùŸIÓUÆÄ‚‡'‡Ÿ/¨åßÞöû˜~³¿½lŒJ*æ¦%½Ø)`ä¬ICmSž¢ÎÁÃlùÚNïŽ7¾£ €TªÚrt˜}®‹¯Ï¨¥;Œ ‚bn´{Ϙ3ˆˆ¢bɨÞF¬× ê³îE¸~{¥¸ÇI¿[ä¾Qƒˆˆëç÷ôõxOeL»ýuð[AË4ˆ˜ô½·ývÇ?7#êU*•N "j—QNÜ‚í[¡£¶ëñYˆˆg?F°Å‚2·ytàÍJµã6"®=[ñìH© Õ¨ÔšÊÑšU¦9·s_ñGžá§âÊúw=ßß—…ŒÏÚëãüÞ‘§F;v}ÜÓÓ-èB^ñ×å%Ú÷½¢¬rä%~ß{®{‹G±¨âÉ©3qj‘¢úÆ/ïÿ켊ˆ¨xºwçŽø§¹Fcž]ìëæ¼âºQŸ:®o×±îª4NQTgOîçþÉ%c²&~·ßªKɘz½_W×iëãJòdó¼žÞ="^]èÜ{añ­G–~àêtôN®˜ÿxhë°O/”Œ1ü´¤·[ðZµaEЩT*½XÑŒ´‹;ûÿÓ˜Qiq{=ßÿe"þ0ÕÏuðVuñž)¿Llï=:I@DLÙ?¬C;¯MŠ¦’ôéä÷Í•$²¦…uóƒqìæú‚öíÜŸ5V'õÝ^Þ>›O>G¤‚N«R©‘"¢êü:¹ùö ðöpsus÷õ/zé!Ñh¶^¥Ré…êŽÚMñ’êטÇýö$­9”¶sæÓ¾³ž†-MY f¡€”ŠHk:Pø«w„(:t,µE·¡µŒSË1+qê|®óÄ®ÖÆ6Ôòm¡=xü‘Ò«`›–ÎÅ=y©¥œåDÃ÷ò“v?;O×®m­Ä{÷("^þæÛäÈáDÝèŽ2HÃ÷[Èg¯ÝÈ•J IJvÂIärIÅ÷BÙøÓRkhÑœ²áÏgpô$tˆA -7‹€“èŠgF<5WvB·1¼&ø‘’Ùœe®ÂË,Ì…MÕY· {ÇÞ`¹µSm¤T£Õ–tï±ÌhEiçE±^@'{ãåíÚwwÂ=gžŠníxs…cÿf3';qËüO¬woѬYóFM»viZÒ7æ³u“a¶q—â÷]É(ÒèE¦Ž#E9j©ÑcCÎL_Š€¶èáÓ$•ç'ƹf²Nߟ? ÉW/‰ß!Å­à6oyÂé‹tú3W ›z´¶7næ}ýZé>ÂdÝOÏÔ¸:×¹„—9uæ÷½£àb/•Ë+G†oÜÉ´²³iÒÐÎp_kÙI@Êﳚh–šxO- žkàõFöšsibtCt6{¶äÅÙг-·üò³¼¡®VÆŒ/¾€ oÚÙÑk–ö€ U«/••˜£—8y¹»¶ë<2ÄÛ4¿ïøráªÙó6^6Ä™ã+ÔÀjêU yCÒSUI¹ä:V ‡ñ¶¤å( TRÃ1‹kfÞ*µˆ«eea¨|enP‘©”:Ú[bqáíêXiÓòõ†'““ÈŠO4̨9:‚J­4ôPɇT¯çÓ ¡c=DYóÅÏ6²Oû_ån"€ péSð‰†öÁ±€V%^N%@í2Zóí±æüŸ„wÇþRÉXÊJµc@™jßÀ²x$r+ m¶BàÍíoñæÛ[~Úþõ²?œyPfi)·tšðil¿NŽåº"ê›#{Nº-mÚ³™ƒE÷o‡êózy]ÛŠš¤Õ*ô¢u›â96r+B ‹”ª´"RKnY\ð ¯kƒ8AW$J­O~<ìx™× Zàh6_r•: oc!1ž—I9)@ sõ–)ßÌÚVºÚ‹–W'dè¡!`]צ´ð,j[‹I*‰:Äˤ¥•Ët5³u‹^ã:ˆã Ö¾Qöÿ~áò^Í g+þUbXrÖ¹tù 2 -ß½ÑÀ6ôDä‘®fG¯¹‘¿aƒÏ”š’7fq•³ª#rúâw-*ÔHÛØð/ùí»Tf íäã×#ëš0ú¯ÍVÃÉ3P¿=´kll¿xXñ º €îŠàÈÅ%í@ h „ÀÖq0r¬þ&ù†*k"› e¶ÀUªu²:V\Uƒj²Úm&öýdP'þqáן¶~8qZ›£ÛÛ–D/nþî±[óÝ÷7 è²nïÚ°ÎÄ8A„;k©&»H™™C “YI8uºÔµV(·²”Õ²„'Z]‰•ªláJ¤6D£s$~Øfg$UÎk ‰H ÑØju:ª7 [ØÖâ´õWœ‰õµ3mº¶P `g,cu¾Š··”þ… ¶‘’V €e}‰F¯yeóÞˆH¨åH8=O ¥N-Ýä(%®¦1ÔgÊ®›§Ýý³wU„ !ÂEc»GŽÏ„ú~.V·~ù Ûtq¿$ò{´¶ñ¥ ¡ŽC‹ÚuÈ¥Ÿï•8H³’åh^:±œ÷´bÉ‹0´'Œ[[ê¡Ì¿ð† ÔoM%ðņ҇më7Ðe>H€ÀÉ/`ä×°ýLò1ªÏ‹|Ô¿Ê‘rîs.ýÄ]µñm¬N<žBû6—˜W'RðìúÇ^ m\»Å,Õ,ïáÕ,}™z™ ½¥Ì¾ž=1üäâ7i¾¼É/0_fÓ¼aiÜÞ+FgIŸîç6íÐƒÆ ›ÛØÂ3Ї >üƒZ{¶’˽[óOn§Æ'“^ºôD*áEÛº-¹‹»o•”xîóû3Uš[å ✛ÖR)•YjC¨·ÜŒ……häù®õ¥o—ˆ>-þvRÉáÒü›'ÓŠ[7©Wî6nMjÃ_Ö%DØÿÑØn¡£’U@ (ŸŸÊ,lR»¥Œùy ±)A98‚`%XP0°ñT •ë#!H€`MÇÑ¬Ö Γ–8÷?l^½Qí´©ñkŽÄ»Œßâà?aΆè%“båQÞÍ…œ‡›—ïoÓg²Gm)äU¡¼-o‘—výèÑcÍœ=Fº|øíôuöSßmZ» ùö¦Õ_Y…¬ûv²gUY׳‹N8Y_ÕúW!ùâ²/¿óü 6عÂOرº| !ôêštX¹ä¡‡ XZÁ‚‘0jÄ(àm8 —ÀÓC· æÍ»î ¹[/ —D ë Uo~³lÃCùÇó§Ô•¿t{ºÔø¶žÎvBþáCǬ:7w÷|¸º¶Û,/ í&W?ûvù§À žVUµõ So¯˜¾éîÔéï¿Õ@JUwNm}îôŽ}Èìj‰úœ;ó¦¢Qó†…{ãöì9жփË{ß²ªë`ùäÔow;öiïhiÜÍG—O·kúv×6ŽR“€—׋ì0mӬϚŸ5²üóØ–ÓÐj»{#¨×p¨_»Ï¶Íþ¡Þ”·-“oÙôKNÔÚiv>SÇÕ ^1å‹Fî ž^?t?‰G €’:M‡÷ôž»cÚjÇîÍë¦ÞÛ¶z5é¹ê‡? $ãÚ¡eß0e…‹²3¶I‹Ðv›¯X;>Ô—W=;òÃ…Ì00zÚwc>™´RîÕ’(Ólýô4×ïÈöÙ¶†y+õìOŸh9zP#KÕ‘[èmº¶iœÂŽðw“®?æЬS÷6f_m˜xpëšÓÆÏù¸ƒ¤÷àÞß ùpÆÜ¥Ý]¬±èò¡*ê/û`ˆ”@öíK7œøY`Ëêmnˆ §œ¨A ¯ZAuÐË8ŸHÅ‘š™óê¡©æùµ…cB|==ºEn;û°t*ïãÓ³‡õ÷õöòï>`ù—s…³Ïùùx­ÜcœzKÍâqþ=Æ< ¨IÜÚÅÕͽëÚK DL8¾1ªWOO¯÷úDo9z»Ä/±~n€ïà%^Slã7Ëà_¹¹sŽ¿·{·ðiÏ‹0=n_7÷N+Ï™6ýÖ¯èÒÈ1d6–Ýëò6llƒ@Ð=kŠ·>A™qé×22|Vùì⩹.}F§ •sP§—O¯Ás¯e³Rqóû~¾.îžÛo‹bÜ‚Önƒî+ŠggõòòþêàDñʺÙîþžéŒ¹œ+¦îâåééÙuäœ5ÉEÆíÉg¾ëâå¶åŠ¢zÝDr„ç3†”ž-¤‰‚(â?L }ÄP¹Æ|pÔL5w ­è»3åÊ£å¶ÓŠ?ËB«<•©‡´ø0q“eM7w`¹ gÏ42KmîŽ(¥åœ•Ô¼ñˆ¸kqw·èÝ/Êx|Qî™Èd*eêpóG™8aqùÓª.`Ú43‡PŠ¨]ÝÏÿÀ³—»M³wJKä¦õ{ /e@i^›¬ºÔLQòQ·.ä½]«Üð²TIDATù¡¨ Ñ*?¾?nÏÓ(¢@¤ÿ°ÜÔÐᕇ/ŒãffÌH^¸¡¸XÚj¬ø“˜ü /åm!eœE/ºI“–¹pêîRšÛ—oA—1ƒRµ…ä…ÝX@*šk ÏÓƒ:/7ZT²£á‰6WöÇ™+gSWªòâæœí@ˆòö½Ò½ô ™N({‡G7ªÈc6UÌÞ*¢J8¶zíoÕº¨rÀË$ò˜VËy°¤ðÿ@˜ÞÂ3Å0ÝuŠX³=¢Ú>§Ö©‹ _9•VòìS3­H°Uò  (¶øÛç=«å^„øå=f]°25¥sêsxÃR#jÝ!ìôOÕ–Ÿ¨S©ñÕ›mÕ¶×É=½ªò­ý³ð%Ö*™O€@È?ZçÙòZ¯v•]˜¢ôߪëoµÔðÒþþÿó³zUà_“ƒQC°8S ƒÉ ƒÁ`rÃ`0Ln “ƒÁä†eƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 “ƒÁä†Á`0¹a0 &7 ƒÉ ƒÁ`0¹a0Ln “ƒÁ`rÃ`0˜Ü0 ÆËó×\Ïæν+IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/urilen1.png0000644000000000000000000014101013051004444021013 00000000000000‰PNG  IHDRzÃpMÎsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ %!c.¸Õ IDATxÚì=w\TÉï™·½"»b”Þ‘®REÀ†ØŠåìíì½÷Š »ØV{EA鶾7¿?v¥ÊéÝýî{·ùƒ»ûÞL&Éd’L&ƒ0Æ ¨@=*¨@*P©¨@*u£¨@*u£¨@¥nT ¨Ô T ¨Ô T •ºQ T •ºQ T R7*P TêF*P TêF*PJݨ@*PJݨ@*P©¨@*u£¨@*u£¨àßô?½ÅovEî9ؤ!cŒB€1 Tù5‚ßþ!ÀŠbŽÿVL¨qëî!þ΀ íñ®# Ã"ÆjU]½z5­ïô€ö¬Š¾ßÜ¿÷ìC©k4iåÚÇ·µ!Çåþ™¨{‰ù~;0•;Jß¾â C¯GX° @ÚÖeQB&­J•DJÖ',²ƒv]Ô_·5‰h;mRºbä üþzóé¸qcÇpéy;–î.e1(¥1)v¥ýnë™B@!„0EaJFs›aÂû§H&GŸ¸Y,£0Ѿ‡«¯CWxqýä×߀¢”¦µsð5yµì¦Ðfz¸=`@cŒ²Ÿ]Þu÷û¤ICoßTXF"„±œ&˜l4júˆ¼çWNÝ~‡(J™ð¨…ùÔ Gªôݦm—då?õ»ô t×€”—×Oľë?jœVN~8»yßw®‹^¹tJ¶îÁ­'÷5®hüû›'n¥Ž7ŒÝ U»ôÀŠ-™üî‘ãzåÝÞÝÞ~ïûÔ‘!DbÓwäÌâ»n%J+¸LQÈ$t¿ÈÉ™ÿyë&çý•S7“&‡€ºi½÷aŠ²VÁ€¤Å_ÍÌF ~V×*Kbmû9ëã“»‹nZä>~P–ÿñÌ© %¤ò³’¸ÓGï¥Ëä8‘‚”£î|•”^”ŸýìÖ kÓå§丼{póìÙà w¨ì û̪§Î^»õòbŽF?Ï,(AqqY½5ZewÏž95gÃ¥Šj®’ܯ§Î_SP|ùhô£´Â’j Â2©@ JÒ_œ:w1·H ŠKK1õ·è\¹fÔ÷XZ¬·K`Üû¼WWÎ¥ddì]0lȆG@òó{ç¯Ý­B&@"!ÀÈÓíúžIDz ¡¢¹óæåÑÚ«–””‚’’â—Ïœ}˜XVZ"ŠÅ2Èüœp6æjAq•Åb`Ñ·3ÇO}/£¤R©T*-+ʈ=¶ÆÝv@†€œ/ÏNŸ::#šT1”‡ç<Ï+ÿ€P^rìÉs·Žÿ¾ä3®xnÊ˳ç¯IJmQì‰SgDF?ÍAåzOøíõ©+·ê $9—¿¾xpêblq‰œËBø¬úKÿ•U aLR”\ÚA£¨ºå@Q”| "A  H4(‰”d³Ä'hæQÑ´ û9“Í!( Œ)Š¤0BAÉ!ÅŠFTÕMÉÏo|a›^ܽ2aKä¹f×ùOìïàròÃp‡ú•À®ñý•9^½²ŠO`Œ!Tp£ë˜Ñœö&1Ë šwN=»¸däa>Mn ÉVF½m«×,g¿LÞS5ûcä ò4ß³féH¯ê5t,I"Çq Ƕ­±64Ÿ¼Ð %v߃ggÌ߈IÔfåaŠTpAS$I! H’*gP2’BF(HQ$4:­V­ufƘ"ïÈ¡ví䄨°U•áÔ¶#:n#·/¾.à®á¨Å‡Þ“æg†_Àü¦† .¬I –¶ÙÞ‰žã~³{´§P§#‚_ë?œèˆÆNŸ'_÷„Þ:Ôµÿ¼®Êo2¸ÍgÏ_È¡Õ¦ÑÅôà)ÓÍù6uÞHK÷éç¿Ð0ÅÑqa¾ßç0Ä®E­’~{ÊC7¿68êاAíq…ô‡xŒ#û¶]6oߥ¥ì–{bÓoZ~¯,y>}Á‚…ÿ»ŸÇ<Ý:ÚÙÚ6$|l°¯‡W@Ðç|IUqDßcWû8Y…Œšêçé8ì[© b7öq‰8íçæ>hö¾‡;æ&ÈàâîUË_«ôm¾<³t?¢>Ì‹˜þ¨0ÿ6r ½«Çà k—Þ;¥@üv_Û°ÝC‡­X³*Ü׮πyJËÐi,ŠÊ’rk5>rëÅ€N?ÙûcÛ^k.?¶ŠOÈ×UkÚLŒð×»²d± 4ébÔ$ÿÛ³ìR@€¢”_Y¶Öúý'û-iøyÔôSàO,W§Æ¬pupð2jDp—^ž§ž€èþT£ëÖMZ¼fݬÞv.CßQèþ ó¾keåï¾X?Ò2ì÷º‡…Ü"¦äŸcfç6scšB¸†©Ã¥Ó²ósè€ÒìâqëÚÕæÜúPÆômÒ5;â·ÝdêéÕ7–OøEW‘L€Æ6údNr^ù4`oh¿vÎÒüšÄÇrî­xª6×¿Õ “›×ú9a¬7l›W£¸éko‚ÿॿ»gžý¤6'úf/¬êk³äÒëý!f•dÇEž›u#°«:œå<ó\ܦ&_ì[õFk7=ìí7~^£&åk#æ¶1_:ÞÖmBæêu+™)'§Ä~o{{©:@ÞýÕ.gú<9DgsèϺ~§“@dx×Þgïæк‚¯úÝÝìõöxù 6o\ZbôV@9ªÓB‚qÌñ£h #˜A¥S }øø4‘Õ¢eO €Šµ! `ÜÝqëã;"€ŒÝzΠF3ö<³Ÿk‡RÏ,!|§uå_º[¡ÂéðâÒYf#²ÒëPïìçÖ¹~Õ.“£§Í9ê?ÿ^v_»&UøBøýµÓ§›T 9ÅiíïeJkXt,æuñ ÙÛFxv€³³BwÚ×Ï4‚Îf³?m¾øÁC&À´©~&û}Y>èwÝ=A±É“Ý[Ó1à=’üûM¬3„†«ÛqÊÚããs£žncÚغwPÿþž6]hcì=qTTÿ‘n!™ÍŠe¬OŸeº2x#QQÚ©S§”q5wò6Ðæ ãé–…ôåûˆê·þTÏ&´†¤¤àìéSƤ¡…G—–êr­ÁVÒq‚ÄË’8æµW¬œ˜4è»Ò/Ú~ÆÊ«»¦»Ué Á½‹—Ôõ»väÓèá!´ž3b‹ç¹¨ÿ¤K “¡ù3ÇÚ_õrŒ³1§êÊÿSbóQ7³š.Yÿ{jrÊ£{™" óÕ!ãk¡òïãŸPM÷Ôfe ãÁäß 0EÓvÑã(,H “JÊ×9óA,%P&HNîïvXc¬mùâ @`ªqï6jò£º—wÿó×Juƒf6^ûäâþ-{Ž$_Xä°bàÜÓ-ìAì5FùäEˆ,*§ƒ@$e°éT“7às¸¤ Ë­JJv5OÔkÞçé—Û1 –nMœe*;S)74ôñæÙLz…rÀâF2_·Î?$)ÝÀi˨½Ã†/»wan•Õ˜@_ïÆœSŠ –qm}¤n0BÄØY‹³RSÞ+IEYTP¢ˆ%4²ïmÈ”; êÍ4ss2h\ óV¯_¿é>Ê „?~Ea}Œ+•M5µƒ¡W†vû ³C&̾³wîäÉ“ÛÞ»nÈ®4$°¦ÙÑØ1{7îŠz½jôÎEÌ™›öl‰$ÅYçÏŸWB–jÜÍÙ@»|ò:ÛvS‹Jôl§ s^(‰àÒ…ó•ó“’Rº–ruÃäI&zxÈ5Hy&î£Ã»jT0‰˜3w‚ÅàuÏƸ›ªU1y/Œé6$–Ž8Vaî´Kc—»ü´©Å1 Zpbìð·ŽN¬¢n~Rlþ ê#$MìÜ?©±ñ¨] ¶X Õ–À¢Òª$7¸¿…‚’!œ' š-h íIüµˆ¦«ÁTÒG墯ՊQ±Ñ Žž—‰«Ìõð:ôË›sMg,µz8ZC;6  `’·lç>}V%¦¬­äÿµhÌ/+L°•S ŸÇb1X„|~Q ͮ훖ݎû¢Ûâó;z3s=þÃ*a-Pƒ¬ÞÃ#>_¼Ôié¶);†Fë~öBX½¥éýËjF `„нM‡sŒÍ” 0éüýݺðãá2øú;÷î«5v#)c¬¹zÅŒ'ÁnT÷‰[fô­>:õ_5ìÂÔ y×.,ª$þóÍ—Óù†×çºA A>¿°xC‘Ĺóç};qËWº…E¿ òBŽØüÛÕ ‚äG×’ÎFoÕaäXXÍmÄS£i4¿s1º÷ïü±žXm‘Or„ÕI¤ÊTfÖᱪØV×j߯O+º[N G»Žß>¾&šÔ×YK;µY'7&H¦›1 c„ÐÃkçÔô#X#!8sÛ¹ú¤kÇsMúÌ×l$4±G­ r1³ç¶‰?ØzhHƒ¨’—wߧ->ÿ´W €ÏOQõ½Áwœé0Ïrß›9¯v%MÝÒ£úʬÙmÁ¢Å€Ât]øòðäª-Çž¾/9ûøŒž-uÔª2Š¼qd–çHSMEt¹ƒ[ÁÜc Jhõ AFÌo»fÆÜlÝ’tÜæ>sýåýž¿(ë4Ðé4ŒÑÚÅ#mýÖœîë¯W}j;Y´iÏ€]¯&° å¾~ÇC§€ƒ¥rS.9ïøçâQ5~~—E½Ã‘•^}ÇDtšãôgˆÍ TŒ#Dg2J“nîOC2q•-ÁŽf&Tzæù÷Eò©÷ö­ˆzRë—Œ É£ XÙP—‰h̾Á&öîÌ„Š_íëÜÎá ˆÈ9÷Q³„%¶í[+7ûýå™Ó/`Ò ƒ¢Ôwiiº­Ûÿ`×RÝzéxãèÑþ—¾*ø,+:·a쾺‹×*«ÕÐYš G7ŸÌ5¶[Í!1صúŸ?Vc¾ÉØ ÙªåèH©AñS `L°åª¸ìËîøÏ4×û4ßÃÇ*fÑÜg2]«v:Õº s´MÍÌÌÌÌz˜óua²×¸mw-‚"ãŸÝœè¢×˜_cŽÐ®Ÿ‹Ú°ñ8ŽƒÍ.ûü<u.€ZíÑ&YaxÈ‹éë¼ @°W\vp…?ØrŒÁ¡ý8LÌh?pVˆþ†Ñ“DT©Í5Ø»©ÿ¾ ‘ÉÀ@ˆL{“Ô+p¤±©™¹¹¹¹¹¹±™ëoƒïYpŒ¬XyèÕÑo—›ÚÏplñ}cÔu&úu±ù÷;SÐÖÄ®1íÐHSmáó<#ó¬}¦,™×…ÛŸÀòÔ-ÔÌ:j‘ãÈð^Ç:öP+ýö>ÍÜÕOî¢W¦bÑÕ¬šqÖNkï³ÿ÷1•"¯g¥Á<ÐÛ¯ßìƒÃn´½4ÐÇ¡Wûj‰©‚°û»Òà)ƸÓÀÅ!½›vj—üðŽLÇ£m«ŠEcÜkܺèÛan¦Ö9R*ÐlIqs›q=[ä¼Â$U]çP$)g*ÆØnÜŽ9ák§†ÌH4ÔX‚R™¶f«ÍÇ¢MÙò­ùŽ2hgo‚¯ä™³BQ1(‹Zãë´Uyû“ýgmÓ«kAR‘Ä'ß ‹X:ã’kÒБ¿LÐÉ=ÁNG«4(³Y° Ì*:§¨ZÙDðLº5›3ØÏÊ°ùƒg_ö,8hÌq¿ë¬v©òJy¾ ~þ^K-Õ´W‡ùSÌsý%ŸòŒ‡êÞnùÜ[±~~À E=c6ó8pi„SŽ@fÒy7ú' r>ÞrvvV~¾LÖúÂÝ=/V{Çp¼b.w¬°–ÓÜѽ"çŽõ¿pD“Vç¡Hªú`Ë Þ;99+c!”6=wD°<‘¢«¾fí8=dúéûuÄÊ?b¬iáªçsãÔ¡o'g'a— õ ßt Í9>úAÚ(5ÀâÒä^NÎ \Û¹×E¯*\´bó'ïÅ„A׊ Ƶˆîÿ Ÿ½# R**Il—AP%¥eˆÎb#i™Œ¡ÆcbŒ‰H(–’ˆÁb³™t‰K„2&Ÿ§PëX&.JÉç²* 'À¢²) lŸIC˜’ ËD$Æ4:“Ãa!€§»&Þ ŽÛ×[X"ĈÆærU²~0”L(”ÞÙñÛeÝÉËüt9€"%¥eŸ¯ô8.€­Æe (Ï*–ˆ…‰  ‚Îæ°é’ë2±°”—Ã@RQ™Óy&‰„b ñ¹l²¤¸טx 6‡Í¨K¹ã2A ÃeÑiÈ‹KŒx<¨Z¤3Ù£<$*.Kù<^ –IJ…b ˆÉá²èHXZ"Ã4> „ ¦ÆQ$1— 0Áá²é€1H_9÷ŒÜøðzWÎ$ Ž\›jOQ2‰HT¶y°_‡¹'Ü:©É9(•‰¥d õDðÕ9eÅ%‡Ï-wg0ÆË%"&ÏRÌF,)-‘ÐØ|ve H& ÅÒ "ž:Ÿ ¤%%"ŽšZ¹Áˆ¤L "éjjR"I0ÏA‚-.+˘<5BT"Fl5.£ŠUTiI)“ãaI™¨jt¶‡QךRZ\ÊäóDe½°T ŸÇE R,,“b>Ÿ‹þsÖ  1Øj•öÏ—ô™j¬ÊµŽÉæ2«šˆt_M)Ì‚è,55Vµ¶ OS¹5CçòùµxãˆÁWcÔ…"è\½Y›Ž†Úš\®b^4¦šZµUqÕÔ«¼ Àdq˜¬Zœh‡§$ 1D v…”ÑøêêµN»º7ù€£¦VuËX¼ ¢ÔÞ`—˜ÁRc°ê¤ÉW2‡§ØwQWÚápÕpùʽr5ÛÔ£+çaʺ,ššOt&—OkclÒBGËQ`RS0*ãGUÇ‹ÄPSWf4bòªs‘Îd«ÕÕ"Qýu`r-Йl>³ª`³¸êrrÖè øjrÚ)Ëÿ=)‚«^Ée9Ù*xÑ.ÓX5ÖÓ™úÿJ&ŠÉaØÄwŒÉ? ÂÒ/‡Î8ÁfW-È´-ö-ñ0t¼Ù6pôŽRMËMǧþÈlùƒÆ0¦õ›¿*Ãý;!tzKÄ¥%ÕL™ÈvÈú¡ŽÚð߆Ÿv¦þ?Aé`çŸ9%þZ”ëÖvŠ³ÿªþOöŸ&˜õqòß­jÿµêF*PÁÿ"üÂFxmzJéK¬¼²7À³­gI¨½wüG«ò}-(¾ª·U\?5j§G=ßá¿FÕ×f=Ýàñ·^À‚ºI]ï‹•¤Á¸ÖàCS­šÿjëc@8ñnôœÅ›sJHŒš´·Z¼r™uÔ'Û½†½ôìNËÊ°VÁÎ]x›?ouæN 4¿úA¢hÆ¥DÖÜÆBø$¡ š×!,á|ÿÀ8礭û’Ád–j^Áã¦Ò©;l¶ÿ·¡+/>cÑh@ÉÄLNáSf ÷6§ÉÏ]‚0þâ±-;ÅÊF˜ÖÑÊmô¸1îfmä}¿]; b?A(ÎýIËîn‘³f8unšu,Ä~á ƒ(?¯ÈI Þ3ÃF_V–yrûºÝ§oŠ)ŠDí|§ÏœdÔŒWÓay´'bÒUÖ½è匿†©ÂÌk6‹Ï&Å]ëkp­oÜéáúgVŸ}轪-ϲŸöd®~G‡q,&Q±M»ø_;ºXþØß'ϯÆ©˜±ø~B¿F¬: +åsåûE”TÂmÞeÄä™CÿíáI¦F¾ŸHüýÙ^+ïïbåg ÆXvšz·Tù«¿ °›¸©f³×Ž·2[ù›²´sÖ&ŽoEŸ¿Œó³ì´ˆ¤(LÕŽÛ‘…£}F.¨ø˜ý⤭ÍÊ1Ƙ®ìoßÃÂûØ£ù¯qûçö07 ÝôLÞØÇÛ›míýóÉÊÖ.,fdê/ªüFZøÎÕ²ûïÊ}R›Mì‚V+^ˆð22ùV¹´èž&’qm¸SÕ>ȳaª|YLj1¥ô¬(ï‰iÿlŒŽµ{­c³qªû )õv(›çl8òl®rƒåð-v¯e¯¾™ÒûÒÇŽÍ/äW~‘úà­ÍÖ»IrR¯ tèaá}äáWù¯÷ÎëÑÃT|&·˜{LŸåÛ}¡ÝÅY-ízvw½^X‰üɡ݇žMÃ*ø_€Ÿw¦Ò3’8ì.Fº ”Œê‹o,1S¨DT¯@ö×LXœV<-.ÄïÝ &[¶¨Bj;ï6¤pBz]»4´èû¹´B[c#›>‚œ;_ %åï@Tè?y¦îçK+îæ©öÎþçàç Phtt;89nÖš‰ù%;,¾ =ÔÞÌPI DËwïÙ³R0…oÿK2 ô LIñ¹+··h¡E«WÚP¥&•}Yu¡Ðvtñ‹¢–ƒÍª,ìh9´ ϽÌwùÁ+YZê÷2:)>·*âµ–óUWµz¶21æΊ:>nÞ˜~‡K Mgoÿþ~^Ý:¶æ1²)QüîdÓ¶[@rã…ÀÆ.¾öFȶ]»Xµ638`€¡Ž&£ž¾èýµžýwG°µ·ïŸ!€[ËW#÷y3B½1€­}›>6Ëm ­ÛÊÍ5>ìŠÈQ”ò Ê‰LN^ݧ»î¯.ä¥e~+UXqI÷Íf,ó3½ø(jR©›Sg^f‚gÛÚøvwCÇÓ¢-‡=h•­¸š¼g`§ŠĨيõcÆ…ݺ¨ÏSiœÿ„ºAC× Eg ØM‘[>rÖO _mŽÆE±cJóäí˜æL…¯A§µ²û,\Éè^ŽŠóPU‚šî8¿›ŽêId òÞÝpt¼)Ÿ†%“éº]h aÑ@&ªia© E¶8Âdþ˜@ù4‚èî1òê†ÁÚ?HÄ,í.ŽžÀ{}ôÈÔQÇ$l“³±[š+!™ýêÕz`¥™D‘uôä ‚E ft井Ë$H)€|Eîô™épû€£OЈá[6ÓÅ%R¦cõna¨×‚£dÆUs‘*{RoÙãÂÁUÊ?´?ÁèdpÐÎÑþ;ä "Poå´?ærg-&€„EY©e$Ðõt·zé}÷5W¸Ì°ÅÜG,ÍxPù$ó¡¾ÍDî¾=ÉA5‡ÿýê¦|_!%íà1eåæi£¼ŽŸx3¬Žè• ~­Ž3)¦Oß²»[ 4&§…¾QJVoe¶aöHyH€Í×lݲ)`ö°Ð<{éº,¼CeÑ}ŒÌŽÍ¤Ûôh®pzhºWîR 7Ù]/S×f®'a¿|—„Z;N7vŒ,MØwÛ¾çK†u¯xPT,fªq«˜m€*OP£Š½¡òŸµÏ^¿”øñÃìlZûŒ?¾d€„†¼ è ôˆV‹?õ‹ )Åsn=ðTx¼ï·É§sÛh1c@Ìž–š§/]—ìX…ÔTÎõ š•‚ÔJ’$?óøz–±:ëR‰ÉE Pá9¹™eQí öw)Uôo1lºƒìéÐå·°¼âjÈTZÖÁ˜×UHýáÊÑL/ؤ™,éZÿ ÑÙòhY‡ú˜pýÒѦ]ž&TÀ$“f‡.ÆV9©™Lñ3^·lC‹«šÆÿþPq'û—›^y•Z*–JË ïì¼ó)ßÂÑ‚ü'c­ö^“mô ò^}ò~vNNNNFÌÆIçŸö˜e F¯GÀ˜c25ÀzûŠÅEõÙR¸‰QûÜ—]‡.Oüž•Ÿ——›•vbièã/|ï@KåÙßØÄš™|'¯¡AºfÔðq«¦<| Ðjk@‡>£Óö-”.åŸ62b”/‚ƒWÝO‘¢Z_R’›“›£ÙÙù&³ 9cÓ²´˜ßb?!Àší<'Ûé/ ö^uâžœÔ6M0÷”ûœ¨Öê z[#íÔ'!‡2ò b6n)lÖ¶·È7GN¥xÍ WnxÐ,ÿ¬3‡_Ȫ.w€Ýf¬7M?³ì * ç_ïLupsbK³é³C?æJéTð§öÖ›Î\3jßd"‘¸š! ‰èUE›’ŠE’Z6—H™D$©ºŽI‘Pô‡Vl™´F#•S‚¸ê„ã°;ËW­òZö!vw×~§o¬l«Å’Çf0%‰ÄXIá¸ÎXëvÛ4xÌs[‡”×? D"QåŽ0BÀìt8öòé«'ûæ ICÝÚ{ÐùØЦj \*…×Ö_›±ÿY²¬Wk:‹E²òª-2‰D"U„’ID`,9uîÀŠ™}=׊(¢YçCç¶7‡Å+Ç̉ìëH4î4wóÁîéå=”œÞ³ÅÚxŒ£†"ÍI~ìíí¥üeY‰ÞÕ÷g*Òã¤"¡DVoæ4)‰EX9b†É*tÀX³ë4³%Ãæß¿»¾Ðú¯ŒvzwÅÊ5^ËSb›¸ô;}cE9©›n¼prqää¾në´:¹ì=z@ƒŽâ׬OÖwÛ¡ÂÍ €ô‡Ù·_³u}ü–PRTi-"ÞôY£]Ço©müsàçÏLU¤uÞ^7!¦íÒ5}Ô ÊÑ>¬ì°WT½ªvgfõLe²©âûZl buž3¬%ä[Q)´>üËomªö Nüª]Š¨#<GìèYå!¨8*϶V¸5••d¿O§wë ¿Fxužr{Š«f)«aRßyËJ‚WçQ=C©¨tS³ÃêuÔë&umhªÊ}¨MF”qÕ™Òÿˆº©€¬Oϳ¸ZüÝ¥8¨²¬¯¥5§8ÁmÒª)ÿêÌ Ñ3‡™‘g®¸6C?7EÄ_[{®¹v‹]+nÒ­í Ž—º³Ï©\ üÔÍÿ”ÄEúÌÁ¤W¿Ÿ@Úmú­µ½þ¹Ñ#Œ2ïì¼ýÍÅc›˜?Õ ”ûòÂo¿ïúZ(nÑÙ~é’Íy¨Öv¨ÔÍ_8këÉù'›Ö?ö[`"ýÐ;T TêF*PÁ~¥x¨ôýÓ—eåW#„xšMÛ·iAüµéÊ2ß¼ÍÓéÑE¤‚'/?ó™UòP‹Ó_'êšwnò£–¨Ägñ¸©q‡æ¤d H²“ž§IÌM züTQR|2²èÞæ‡#¤¾ü˜%«FLAK#S]Öé”ü>A¦Ö±ƒÞÏE£pö»§)„ANM”M!,¾|ýV¯½‘ŽÚü9QÞã7ßMLXÄ`©ÂnûÛË*Û‹¢ìw¯²5{vmöë­5ÐxT KR““s K) Ôµš´mÝ‚öÇëøýá®IÉ‹—¯[¶ïÖ˜%|ò*¹³±1ñã—â씤L‘±Q‡Äçñ¼Öæ-Ñþý,äëiáÔ7pðàÐÐÐÐ~½]íl­¦lÿSª<<¨gÈ1Œ1Î{ÞÃÊñefYµžìò·rê­Pc¼õ·¾þÃVQÕ*(Œ1Þ>)ØsÂò5þˆîÏìà<[Ö€'ßàÐÇÛÝÆÖ®¯_@@@€¯oЕlJ¹D]ˆ,·Øúæç™tw¦©Q¿ªJ™/÷ÛXØ(ªoøŠÊß.›ØôÍ“´ß^Ÿêi›úÚ×ÍlŒ×¬:ûcœrrˆé€¿ØèóEî‡âSÖ?…1Æâ¤>Ö¶vv®^î.Îv¶ÖNžc $äOt}}ªSlziõÖQ€„f¹:Z–ƒs™Zº|È5„\/Ï­sé!ÅÔ·.[žIþ†ô_SUÈ6bÍ"Eê†4ÿQ?çðßãBfÛñªÇ%7U[ìäãª-€cè0èðãA•UÛ1UþX³£ÊNÆ€=¼¶Î¹’ƒ#›aŠî¾xá4}•¼aå½g¨c!Âå M•—uÄMªýí4hÓÉAÙOOùNÛ±ëèɪ…ÁäÙ%òt–Z(6ç¨uS¼Ž}ò*½4²šn ãzñZÊwý ¤/¯ÚÌtZÙQ½f¨r”ŠøRKç÷²— ’’ôµa>žþKnÄÌãVÇ¿®<y×8æ¾(h·†œ‚Æíª?[“\l !>Dc2x¿Tü1¿ø>UYZ–¶F¬77_cÈ}1s„¿•ƒ›‡³›ÿðs é‰?Ïáoíàêíájëx$î„‹_F†xÙ:»y¹9Ù÷|áMBèý¾Þ|VŒ9åÆ–O7';+{ß°û©%U&«4wÓì16ö.>ž.NƒŽ<È@•Õ ¬mßÏ‘ü´øBvÅeØE±K_ -‡x5{¾Ñ½Cÿò#;X*ð°í²çf*ú`dlµyÄ°áCôìxåC®üÐDfÜ^_{ Ï>ý‰û^JSL||ãl{ŸÞ>¶Vγ¶^¥•(Õ‹!©Š¿u6¸cÈ¡ûXy•R9Ïf„ù[;ºùx8¹„Å<Ï¿>}ñȵ/BE¯Î óíeçìîæhÓgðäçé„àzx¿Mg6M àjé¾,U’A€­‘¯¡Á¹«—C #në;þü)6¢Ï·Çô¶ursw²õè?êÖg¡¼ßâ0³àyçzÛYÛŒ=…².¶êêœ.¦B·÷/p·¶p÷ô´²p˜¼æB!4wˆéEÆ6ØÞÞqÉÞÛ‰& Êæ•„û÷[ö¤P‰}Üm`twû(+óOŠU¶oi¤ƒƒ“—›“ߎ«I!œz­±Ýå½ ‡äçiç;êI¶F’ÂMóÆÙÚ;ööq·wôY}ü©¼ªÅóÞÝÇ\˜ìf=`ÆE§3E§×L ›»ùû±€6^;B¨ø£‘I÷óJ ½ü!P’¼Åã{ZÙûx÷ž³å‚§½É®ß”.…Fç¦z_¢Ó†Œ^}!$N¾6&°—«§W/Ç>C§|ß=ŒñËí~¦ƒÏ(ŒK‰ÀÏ­çÁ;Y¸ä³µµëÔòïÎñè>ü Ƙf»ÛÛü~þÆcÉ7#y$Æ9qó{ôìûAîíQI¾¶]×_þ^«£þ(ÚʱWF©Â´.¸5¶§™Í‡Ùò‘½Bæ)ˆ“°;Ò¸×p¹%=7Ìfâæט”N8ï`œü-#ýæìÄ‹M572Úr7OÞý(·.óOeTï8å`÷.î åÆòÝýsûŽSxÍôÁ“–+†yjÑásäÿ¯æiç1TQ×/åbWKŸ 1‰s/{Øûß.‘ûɯ«ñú$ÆxÙdO;¯!òÚy·w˜8÷/&)\rµGgŸoÊŽ“Ü€O=bdlºR1ŠgǧÙô\€1Ƹôó; ³'ibœq§»™…Çü[ògn/ð4öß"Ã8n÷H;p9Mʾ^·³ê—,À¿?bmå|ó‹P^“p„§ÃÖ«0Æ)'BŒúíÃã’$kkשÑòÍñè>ìÆøÕžA–Žc 1ÆßZhmi~ènzU¯¨¿­íÉ×Ùc,Îõ³²Ž<ôDþkÌoþÆ˪ñøÖ;“Ð#uÍ–Kë‡8õ STÂth³ïoN¥_•÷âÁ'Ó$ìÚ‘9t5 VFÜå4€†ý´«ûÆÔP­ô™s‚äÿyÏœ¢ñõÌËÊc¥WOÇYO]!Fs¿BÑÔ¢*Þ@'Ûp${öò«!$ÌþüH êdVÿ°¦„;ÊÿëæÞAüõ‹ 4ï“H"ö´1Œ [Kd˜8±îŠ^ØÜŽyïÖVí;$$ÜlHdF},u0)¿¤ù„Ë)f6¼é·W§Ó•ÍPÚŠ=džږæ礧§ëóÒ3ò0*ã9†ØiÉ-e-}íâïߪ{ ú¡þƹ›7>—ßK|ãÄéþó˜"–ï_?£Ÿ°07==Ý@W;¿¨ "ðhÐÑY^p£rZî—nŸrà‘9™Yêfú’·/s(Ió~LŒA«£žTP–'ÈaIuûFR¬9=ÂVÌ=³ãR·©·­³1›{ûíg #Îœñ–òwzŒÇÿr*“—¢îu™¸œ €1æXÒX—Þ¥È)@²,,Z±1Æ@Š) 2©¤&±#F8ÉÿëêÞQœò\8þ®Ë”Y`;~]£ê·"‰1€T"€âÌwy õ4“SÔgÎ$õ·1·‹«úiù2Mƒºn’*½~ò±ñ„ßicÎeøìûL Œ¦½h\ùC†Îm…Ÿ? ‘€D,–[lmÛ¶<ÀYŸ_”ðXaNmåhô_Á}y<¾¬¯åɱ‹¤©ÕhS¹;Æ63,ãØ:`²I+G]¬t¢·2ô€štµr6kû×íVÿRì!|cþàòbtvg›ÞѧBõ@’U$ä7ÕAå¾¹Ž¿41“<ûÀÒ]kÂœº ÍÖmZNX°Ð´9×qř雖Xwã4iÓ¾M·Ëæ·Õ¨z䇠5ç²ä3‡à4ã2 óJASñ[^†÷lª¼° à2q)çkÉC-¥Y™º5%7]zm;Îúóõµ%ZýÍ ØõÇPà@t $¢\¥¡ÆQÄššthBQ€ä}&jݲ”_ïm É‰-nè™o¬ÝŠ_^õ»XÈ×m\I±üÒÄ,šW܉÷Ï°óN¢«sóFœÂÄZùžæhq*ŠQ ˜ªªÔ0òöê3ñÄVjÊNâýΓ™FW·€˜³VŸzhêÐË@›_šøŽ´*T‹«H?Nè?þ©¸Ec>—ñ©”É(ßc£ó´#a\ÿñSÌâë(„®(¹€ùe‘·Í"ÅOB ï[>tLc6-¿ÿ`i3h%eɹ sõrýÅj§ OsJ¤ÑiÇúÑ}ž¼ò«oi4… ,9Þ¦¹"8Bcðé¬ú悸,›¤4Ôy Gqõ4Ùßò*ã_„^F~rf”ü”|–“Z9þœ¶šÔÇl!t 1+ŽM.lÕv1Qãvò"%%y©s˜åhðZò™¹™EP1*=©¼2Ùק666å,•” ™Å2Lѵ[#5³Ð•É¢ºÁ¹/;¾ÀºIµà/ÐølºH h€0@Y‘ˆnÈ'xÞáó¼Ãç¥'&œ?¶}hÐø[w÷jÓ ˆX9 beÊ›‡§¢6ûõ›õàúªj݈Iªü¼R™”dó*"„$L4€º#Ž€¶dÈž -9ãºmÚüjÐö ,el¡Üù­ã˜r¥Ç&PJ*)É,B„]‡G%—H*d«°LÆkÜðóåH|6]X"ÐPP¬XDïÆ«°=‘¬äíáëçŽ÷nG€+__M¬Ža]`Üݯ/sÕøy8cg¬‘—§À·½Q1![âGöä@RÔ‚ógs«¬íUáúÒ jVÎ)®gX³õK5¦ÿá1s´˜Ò6ÛŸ-êVõçÌ;@‘eòÒÉ€(Y)I±™ ŽG–'Ð0™W š\:Ô²“ÐÀ-gš‹*QŠÌŠÂ$UßÓt>ÊÄR B S½êêݹ3‡H(l¦¡? ˆ*K?yûK —a#¶4O@–×~’å•"M½¡µBÊÙÁbp1eå³Èb‰Ty:T²¤—Î7tº±kI= øûáW)™HX.€ÑA_pãµ|‹Cøâò;VÿèVôŽG  y³Ñó¦6ÏM|Wný)ƒ®VSFheó•A'0~^-ž½*Q°Qø(3µ{»î¬æ `uÔkÎN¸ùFA±ç—Þ³Ûùu¨Ô˜XV,•ruué2Áö'©Œ†wpóe¯ßzÿæÇ$>dEebŽ~ùò.Š{ʪOPv)nÒ¬±Â yu>“M‘õ!€0E)mˆÔê½to¯?ªØk „çŽË’€Qe'žeË9žùèt»G &Ïžñã}(D¦>S†-jß¾hIH`Ùu¡=9ÿBNž‚¤Ë‚RªŽÖ¨ëtbÑ©7‰Yȹq8]ÃÒA·ŠŒ©™M5j+[ØwZïìN]´žÆ^þÎtôèï]Óé` ±ì<óøÛy<’¯ ÍíÇðÖO™µšoÕL°ûÀSÄgSu/ÔLÍV#yKƸåd[úñž¾]k8'#:Ûmx±¯oðžm_ºüQÝmÞ,¯ aú²iƒ<#F|ë׉“sù ±Û•,6Š®fÒ´ Z8~‚‡‰îùó×N´_tsùAÃIíÚ‰YÈÌ’as2x}wšs1¢wëÜYmÝØáI¶.Ÿ9;zü€KÎ,زúØ¡µ b¿=VŽ84f!Ö/{yWb?e@‹m{;f¼…^kúŸf‡ÌôˆÁ“ÌûNZЦ.”zMÞ¸Æc˜÷ {®¦z¯o_y+èz9 /ƒ ÛCG\vmÇȸtëÅà5'Õ|"×mð8&Á¾=÷ö¹ËÐm„g·…–iŒ6,ú±m+²Þ9n‹êU7àòÛâ5Áó†M¾Û‰Ÿ}ý¥VãÖ/:¯ ]¶mÑÜ×½–Emg2¶ß}?áç+±&¯:­U]ÆX»ïÑ/ÄÓý2¯ÁC’‚¢<ª™ÛùÃSY¦/Ûå;uÀøxÛÖôس—yÚ4‚Ì:ðc5nM+]2qJ¬{¨+“¨FSãm#ºŒÜ×ÞÇ—_ðîzÜóy;.¨×¶¸q,F-p¿1ÈÃÝÁŧ½ºõxlckϦ#f?»ùÛ˾¡L±·_Ęެ]·®­Ë)6o„mQ÷íÆu% S>OQôvÝ­[i/Üɧ4í ‰¯énŽ]ä"ùúé-RÃȤ½v-çD·ï=ý5—Á×±°0AÅé÷Þ7îjÃÎxTÂîjÖ©1€(ãê½Ï¶N¶<Êü”ð&¥P«ƒ…©¾R>tÙ·+¾;ºZ³+⢜'Oß”ɸšMÍztã@Ö“¾Ëbn*|ù4C ÓÖë`fØRîãÒÌø„wE"J³YëÝwã§>ŽÿÞÄŪµ"·G÷$ó[ôh.¸÷­‰›uk•Ü¼ß­§­ŸYÎPz/Ç®4€âÔ· Ó€£caaäå8p~LN­T˜÷,™Ö¨•i{Èúòö]RI° MÛ7ãWËO)Ï*'¾~–[L­±^ã-å)F%Hö¾XŒµZ´3ïÒ 0qæ•{Iöζ\ 8õñ“Tgë6@”ýááëï¬æ]Û1“ÞØ›ëUÔcIûôêcJ&¦qZu6k«ËŀݻßÞض9·äú½×vvê $¿Iø’YtNkCã6ºjüænÕÑÒH·Ö"#¹ooMÚóîðÚñÿÀpü¥ Øfj1iÛûÿи3o[¸% þò$לW'æ.9"ßÂ}¿ëdÞ#.üËœèíΉ.ýC³ŠUðW"Eó¦Ž}+ ŸÑþ?5ò¿áØ0Ð007Ü£Ï9£–ì ŸÛ‡l´mNü—cÌ꾡ó_X`@u"üÌ~ŠÌÎÎF žŽ¶úÿë~Âß ¤(#§H§I:þÒ¹‘â’ü 6W[S© yüÕK¨Jݨ@*ø{àç­Ge=¥Tûi“ã*ÈV|¨í_þgä_êÔÅ·:…¡¾6jcØ–d\WÇøo•¶Pþÿ²ùóê!Tšr¥ƒ­™ïB$ýbieýàKñßjŠbÀIÖ…’=YÐÖ.BZåN*„?ÐrîHœïîÔóÄ£ìZÑFÙ×:›y|S|P•¥;ØZ^~Wí]Š”Qÿq „c,“‘øOz!ñ\wûiÑODÏϘ;xæ‰ÑÙá=­`eiá5püíäyηü•‚Ä»3ÂXYZYY;›·%E€+:„d¥ß×Îålocmmã3`Ôù—é!JðÍÑΦ¼Q++Å–.ᥪð6÷º"g½²±²x•-C A’••u\RÑ3Š”)yçÅu3sIHëj!”t[ÒÖÖÖV=ßþ?ø¿T^kÏ„¹ÿeW‚ÍA”C£Ñþf¿#x¶vä^²ß–éžus“ ÓjQ©4@ õÛöéèiÖõ2í®µ¥Ñh5òÄñ±Á¶ê‹¯ø´iô÷,ûýáÂN¿òb¹F–¥¸¸,;ÿp‡Æ|‘¥õrZpæáîªä£éjÐJø,‡M£Óè étvÜ9´ `ü-þDÄ ¯ˆÑÁƺ²#ÓBV]M ž³$ê·VˆÇ^îãt´ßüãó{·ÀÊRö ‰p½lÿøö4À_ïMÓ÷í„­¿ 09xè0‰1I5à±Ãò-ÛIeÑ8%25Vg¨³9ˆÆ ÑhL&½á¢ò\Úègguø¾…jˆ JYt-—ýÛGÑ)yZ%ÑLíÿa­ùyutsB e>‹¾ˆÇ¶QÕ§·b^|J–º©‡iÍ÷·/¼ëº[` â¯÷^ÿÜD°ðý¨"Ç0=|aÏ.†Íp÷N\(þöòÒÍø"1­­¹“«Yëò:‡W¯¼NÉ%˜jÝÜÌZk¿²gû½ô"íÛ{ ˆŠR.]»“Y$âiµôðñÐf)R¿1òO°þ~ IDAT:'aÙ{X¶W:rAIŸÆ?êÎo¥Åg@é·óneŠ¸Z-]úx5/O g0ñsQ²DºíÌ|»W ùøøƃWI$CÝÜ©·‰"#ûÍÝK?Pì¦Þ>65å'þØšèdzÇJ¬œÚw€w®=zL\CË^¶]šÕQg (K‰¹™^(âjé9÷önÁV¤`¼¹wåñû`5²tíÓ¥9c@eé;Ýèz1úÑÔ¼(óm¿ !ò²ÎÛ¥aØ×Á¸ ˆÒ/ÇÄ¦ä µõ ý½ìhƒ0k×Ñ«ôºrâ,»Û ŸîÄÑýQ]¼Âš1”Ír„Зç·î®<„1YuÔÑ/4çñ¹GIùšÍ:ôíãLËÿºûÐ äíÛ¶ÝfàèžêG÷íì3Ò¸ÒdIƒÎ¢‰D¤¼*ÅkÑR_Ž°Aäo×/,Û¼½ΛӛîûýÔU¯jòz3mæïïÜn΄Æ9]ÒçÓ?½º.et vba -ô‚VEÊ^sH ú­ZÙˆN14›ëµlUcy‚F 1`.Ê (LJ8qÿShð6­úÅ5/o]yò xÍ{{˜(ÿæÞ•ø÷)˜ÙȵO×xwëÀKÂËFíåÕøD¯™{ _ Ü:¼òj&½pÿÎï¶Þ­1Xp?æÈ›Œ2Ö&þ½Ì1@IÚ»èkOú Õ`¢âLдmÕR¯ªZÂOíø ×'Ķù?Ý™RÓÑ¥Ë8êÍt”V)DEMóˆ\UJpJSžLèqäMA3á«»Bpÿü‰ýwx'@ K\´"ZK‹ ‰;{ìÁW1dÞÞäÔwìÃï&•½yrÀÈõ7åuU6Ž œ³ç’Ñ‹¿<œäï¹ã•¥ÕTŒ¤L§±v:™ÒÏÇïØ€¨'çw¸úGVøulFþÌ~^e‹²ßÝà{$Iéz=RxøàîwiePôÁÍÒ÷äã“ö>v¯…Ï÷R ‚<<ºÏɧeY7ϵàN–™;럻9GÆ*M}:¹¿ã¹÷ù¡œ·g<‡Íz%†üã‚ÃeTuwAMC­€£¡ÙX@Å®1gs¶”E~Z4Â{õ•uC¸8ÑÃÒ7úÑW“öáæþÞ^)%BpaqàØ¥{Š1»àÓ½Ñ~.·RKdïÚ³wÉÐQq3,"jמ»_ó@~ ·ðå–ÛźM¤…ŸÜìúî¿û™ËØ=K-— 4w÷ž½¿sûC¦XŠ—^9}âSŽ¬Š…àÙÎQ'¯ú”'L?ågéü8SŠ¾±¼ÿˆy[r¤,² qa˜×škŸD Ø¿lTر÷¸s»¦ç¶Í·ñ ‹Ë× Šd2¢‘NSu:`i^°›÷Æ lýñ‰-¶½#s!R|øÐþåãFzMvißìÂÎycÖœgqyˆ"™ i6nªNÀ‚˧£?å‘„ÿÆ3ÃíÚ#}‡+'réÕýèÔQMœ•Om"ô‡»wP“W¶’ßdÖ#p„–Xpèu6hhëK¤Ÿž|Èa…næ:ÔÓ¢“Âiö®¹C@£õù˜.”|ÿp:檤š$ ”þô°WØüy22+~ìÐIÚêâ’c—î)ÂìÂÏ÷Çø;ßüV Ÿß¾eõo‡Zuì˜û숯CPŽ 4xŒb ñ4µµy,À€òøÿ¨‡ß„¹Ÿ·Ï;ûÚ7P–“|æ\L‰€¨(5j!䥥¥åÊC7øݵS—ä'ûÿ¶xêϤ QÆ¢ßÝ-¦\MÆã¢DkÛû_ŠñQƶ}ÓDŠt©'Gö´‹RoºzÈ«h,s™¾k›óÔ»ã¢{ͽC¥…1E’$IQËFù˜.8V^vòóÑnæ~ß0Æ87¤G·CåU3¾|HÊ`Œç÷Ž\wc,Ë{{úÜ=±â÷’0›ŽžK1ÆÒ' »v¶8Zþâ¡Åýú¯$1ž8ÈzÞ÷X”çébyâQnÚã6ξ…Eå›—ÿ½«Ž‹réþg6ˆ¥S¤ Ĥ»DQÁnåØÝzkwëU¯Šˆ­¶b'¶‚RÒ]˲½Ïùýñ,È‚Þ|ß÷þ˜ûù\Ùy&Îœ9sfæÌÌ÷¼âŠ¤˜££ûÖwtÞçÛBœ‡BDAÒ-'ÏÎ År|Æì+SìƒVJv ZøPŽe“zÇÇÓíê»bŽ‰¾öpöŒM-EDaÆ OïgòÂËï/èØid~=ÜÎyqÆÓ¯gq òÊ…RÞëSö^¡Y9~ibT¸sÈf"–½uvöXq/CŽÌ2ѳË*9vLʾAvCö!âíÅ~ãÏËaND¥}ƒ<#n¥ ÷£««ÇÒÛ©ÕËd2ª&Z%…nf—˜weˆˆ”dsx¿E'Q™ÏÜ=}^dñª@‹æÛu•ˆÂ‚Îþ^KÎÉ1bÊ®MoÓy© ±üí'9ÐÌûÍ=í‡ì­ªƒš6Ägñþg(* îì½0ò1˽1»Mà""ïÃ6Gçñ¥UôÉÉ£°úê‘Åc{NZU#Ž;ÝÏcÀoOE+‚: :”R‡Áâ­!Ž!Û^Ò@LQ?÷róðôöò ›¶4öYJ˜Sé®^ýö¬nµFj%\ñôòºŸ\ÎeïšY³C{l#^Þâßy—Žf†¸{~™…‚×~}ŸqeˆˆEìÜ7¼” Û»Ý}­UûõU]½|;{yz¸»{xzzXqUVƒ‰ÿØ5Â?¸™ªgf~HHÓ56h–ß`0vì¥"\ÿ·ô¶É?þR¼Ô‰÷á³Ñú.Oìª@ï'/?4kÀ‚ ú’…ôsf®L«èÅñãO€Í䚈³o¤cx3_ë#û½õõ íÙÛÇ®M-ÉÔoßVûļq‡J…"È–ªZsEôVQ¬Õ1Ø\¾TµjáPÿ±ŽclÊÔÆżbÍÈQc=|:÷îÝ«£‹ü%ÅÖ mÍ¡·3zzp¯T šœ¤ÂƇÑg^2€ÈFêw¿âìG$Îãèݶ¡5“IàX~îÂT·4Ò¤¥íÜßP:þm1)ÃK1iëdÁ_9zä˜äÁ³©Þ>É @„¥MX¹7³Å³Z ƒÝ¹•MvЂ©«zïJ_ä׌*_™¾, "úN™qç‚S'ŽË(-Py•–îfŽ„ÐÊ€ÎH©ÝËøeŸBvó:ˆ„5+â,|}rœÁR·4Ô Û¢ãÜß@:á} j eoiF¨ÕD„"……ç®™t(;}ò¸„@©vrÚk`XÊ:4³¨‘±DXG¤¾‡à¤,åùÔ©S€*ÊüœÀ¶¿æ ¡dÀdÕ5s&Ȥôëp•k.å¥MKyrïÖŽi!+5ZŒœ»i\pÛïÞÉ!un•ð øÙ'©ó,;ZT L­óÇTuuûL$“îÐ2VÞÍ,œ(cYkÐT«Ús¨‡_ËFtP|„ÌÒi­E³KßRø¥RVÚ­&Íw1õñuÔV!‰÷ú…Ï;Ô~¸›em&þ›Š•0\$‘2™*ôÒ«@ø|èâ³úø]4HÏ·ñmijn$úRP oß>¶²\x…Tggóh@º `ÎF½ñœãí³W¾Üµpèl¾ÅšýƒZU¿ÿ'Y—Yóiú’¹ÞíÌT9dÅàào…ªj¨WÉ€*›-CeϾµZžzþ úøÉ'¯âÆ÷\¯ë4pÿ¦y´¥ù›üÈ1B$21f~n‹F!ê}wÓ” *„ K5†wì5`Þ´µ›PÈ­RFl„P¥ŸË%&Íê9"C©X Ó 6!d” ð9õrHOc ›3cî<5HA™,€ðÛe B@µo{«+Oxä]gX±Ò%Úvæ²GvCç†YÑV^±HÌVQÞ§wH”ûAW嘱YÅe²Öê Pž›ÅeëêéSTy¥ˆ2¬j WÜÔRïGnŸ¨95#‰­ºÍ™åC¿o”Š%L6$ @%ÔïVz‚¦iÜjè𰺃Ӷ¾ÊííØT¥ šœd=¼ž¢ª»ÂÁ€ztj÷§ÃƺêUŸ ôìm;ï‹R€ßíA¦è4Ó§dð .¹e(334²9ÓçÎS¯Õ¡„9ï¤Ð…Hˆ ¹”Xqy?~¹‡,HOXYhD$DV(Dƒ09ÿ˜È¿ö‘Õ*(@+=yÓà €·sa„nßyælÐkÛA“—²ë~“mGæypG¾} µÜ)yp)êY†ÀÈ¥c»ó»7ÒËм¸]ž!cË ".Ľ÷Ã2y5¡€É1$ Âà +TZ@jµ‰ëF,,×P¯”¯¾‰|Y»ëT^»käƬ}V®òúòú>æËב@O½^L¦NîMKŠWœ{Ooîoî5ê €ZЛÏ[sÀƒƒK%ruƒÏŽo?t/‹„Á@,‘0lí`"ï¸ú혱“Ýuœ}=è»Ø½ûÍ•ï&¤b‚žºŠe`€AFÊÒè4šŒØ•üÇŸFe²6`VHâÝ;‘‡ßŒ^ÖŸÀì9kHÆo“¹@QÆÀ^Ï<ϯ-¡²Ê«çϦKkâ°ª´j¡¦±ûD X>rPÔƒTƒ¶šD;®%ÐmÙ>ãW•nãíX 0YDX,`ôZ4ªäø¢»Y!„@ŤAëÏ%ÕŸ‘M„Å"Z P±çÎ$—ÈÈïþæŽÃ{›Ã”þμ̦·¯Ï­8k{§ÑÛZéª0ˆðËáùƒ¢ßË÷A‚ŒñË®Z{»þoU„ð²Ï]¾.–¡"‘ÿÞí?n^" ·®°EçƒÌ”e—åzuÕ¿ñQt³…×ÞI!å‰>3!m›0”¤XÚÐ_”vþâžw6< @I½ñÛSnå`7[L¼uþÚ»ÂÎØŸ°û»·ŒˆX–`cÛñ^r9"–|¹;© ·¯Ÿ§§ÿœ-Q<EÛÐŽ jomåýE„ˆ(){îÞÞzöž[UvµÒ¡m ÂO "òsö.›àêââãåÔü·9t’W±{ûº{zûxxxü4wK1ùÊVGÛv^ÁCËò_Oîíåèéף߈˜OeW¶Nh×ÎyÓ;¡àÎ,Sßy//o íâïlç0ú—\DD ïi3wßy9·?ñ0E¥G7Ìôõpóööòðí²úÐ5¡ 17Æ¢µwŠ@nöNŒìÛ:h›„†æÎz1oD7O/w÷!Ó×¥–‹QZ™·~ê@GgŸ€îÛOÝôr°=Ÿ(ÝвójÚ.(»¹~T{[ûn³ ¢0'~þˆOoo/ŸñËöð¥J½Q¢¨ìئY¾®ÞÞÞ¾]Vˆ¥‰*O}8cHwOoOw÷ŸænËâË),}Õº]§g9¼šfËÙÝÛuðíͧ(¤(Š¢’Ü9±©‹·«··‡O·gŸI±ü]Ûöö3¸UXñévÖG^TÖ¢GZøþ—±½œÜ—þç…Ù/çýâéíãíé3aùþ) ù®l£žÊq¸e/æ4é8¡Q*Èú©s'[ÇÍ÷¸ˆø"zo¯w/7€5‡n QXìálsìA•…?~A“cxˆ2aî¨.Ž6¶ŽëîrQœäeÕdï3~]Ží›5ÄÄ¢ú_ÙóoGý:¨«§uÛöíÚÚ††ÍŒ~üYn×¥(”‰îŸýmHwïŽí;9Ø;ût_õÛÙ‚J¤¾Ù{¥›ZvÙùîGFHòåíí}BJ½tQJ¸Y«&öµwtñ ùíìU—®'”ÔéЭY|"^^×­ó¤óf ðvtôÞz6^†ˆ(;½°ÛŽ½W]Ãò{ÍÛ¸}âÊßÐg\ÔÒo½1óѱֶv©eR¤PR™·wÙ'{{;;ßÞc.½ O¤[ü›®~ñ™Šÿ¸ºùf‡¯‰µ_wÀPTm8þi(ªNQµKPîÍ‹ªy&ñ;ÏÔª«h€lÅFÕH@Qʼ,Põy£(””¿}2©V-õ1ª!/pµcê!£vy ,¥~¬½tæ˜YN'S Ó¢œª6%Š l¨Ñu9O)ÍXçZôQõñ“¢êÃú¨/UGb*_!)µi@OBýHWSõvy]·.SoÔ'Ã?ÂgJ9Ÿ‘¢PRöŠÎ&ü™G 5Ìï œXÉ}¤Õ@VxPP§¨Ú%(¦¨ióÿCvÄšU4@¶b£j$ JmÀDòäOö¬ŸÔÕ¢–û>¥Œ’IÄ"eAJ)=¬‡ŒÚDê:ãûn{¤*çwèQ¯Îi•RJHmJ¨DŠàå|Bàñž “»Zü>¬Û?s–Ôø"üïÞ«þ¸³ç#K»ï½YVç‹ï5íʆáæÿ0ÝÕ1þ³<<¿ÒwKæ‚ûº‘ÿ¨p6ª›§bRþõÿÞMcP*ÿ ½ÿ·Â—5ü¬ÿ??÷Ô6™WÇ)êàšxeõ‘–ΚGÊNºæ/˜lYpãÜ{ Ì…·àî›ÿDw*ýßKöûXúÏ7«¾MèŸTaYïÿ7©‚ÂÂξ._ý¼úë ÊÇ;9ny]Rpfi§>S! ɼh0\Bá½âçзXŠÿÐ:“cË»öžuµn}”Lúƒ‚A¹¸¶Kç)7Bȧë¿õôtssÍ(‘¶meÎOz¶óèÉÔŒ<¯ÀÀÆYƒŸ~ìÄÙ&ÖvZªŒ×'v™÷ÛZðzÿîø]àÔUœàVŸˆ{[l"¶³ïxãtW½yâ­S·¾ê:¶ÖqÙÍè wî?~Ÿ˜¡eÚJ_„<Ž=ø±²…ô˵s±w¿ä‹mZ[–|ºò|ì»”¢¶Öjr§ Ô«;117ãÞ&fh›¶Òç0j™kÞÝ?ñYâÞÙ2/êâµ7¿êZµ×SÁkG×GÅ¥ )I‰F³¶*é»#ï;;4½pôxÜó÷Ž¹…‘zÜÅã1q/J¥Z­Ì àó£/*Üúé,š° ÇÎûÃ]Ltuõ:útË;±öšQÿžm4¢÷˜´o¦ÄŠA &lÓ x¡ap/|N‚áËàPwˆÍ„‰1pa=X'ÀùWðɆvÈHb.èè€â#B>îòƒïøL½f&ºðêÖÑT¦KûRÌÍçñïK(+3=9ðHò‹K—cŸ<•Y,ineÎD$„d¼x)æÚ³—¯s+ˆUó¦âÜÏ{F|üœ-•È´tnF_±no§Ê$€/G,$ÍXiÏ~Ô7§>Dž¹ÿá«^+=¹;™/Ïo_¾z3þíÐkÞTW•§7ç_ÏÓ°QÉÙyðÐçÔ\1¿PÓÆ™ùùläkŽaåËã×Þ::´gdxxñrì³—ïJ(m+3}g?¾øBäÒÁ‚æåû1W®ßýI ÖÔÒHx‰—=&J"Oœ~òòY™ê¨þyuó'ÀC+s#)ª”O»Ÿ.î>ý ?]Ø,jÕ®hž@Rþ±#>çòˆ”—Ú5hàÉŸeY{—…OŒxB©Ì~æ8äò›‡<8²Î%hv‘„€8o_ÄÁeÃ>+Ómk®v`唟cR8Úúê„ CßÈD ââO^½Ž?Jã¨S7ö.wº™Äùû".>èQ±v[ ÎáÕÓ\üÌÑÒã.ȘòŒ¼¼KÎò€5þÄõÀ¦êªÎãb~]Å/ŸSý{ª˜¨Ø*F†úL‰½plÛ²5ûãR+…Rîì^¾;Î<’FêÓ‹ƒúôÏx~'rÇæMÛŸðÚZé]Ü0¹ÿ¼½c}lÕÎúÃÅ5}FFÈ€‚föš½#JÌRÏyuuXϯÊê.Ï /÷ÙÈÅG*ÄÂgÑû†u«D¢Ã.E4 8là'ÿ¶ÿàÂácù†Öj¯¦O¶wzŸgåz-5KVL}/OPcÜž›<ÃE¥jï # ¢Áahl¹v© @Ó»ŽŒöÀ„›çb_ÔîÝòLX¾6D˦DªÕpù@Î9X³΂¾Saí~྆u«amTížC[X¾Ξ„!A`7hÔ»{;aù X £`ýJ×fžðõ Xµ‡•µË1ï#áÉEèï „ kCVj¡)èT–O  M¢Òºô %_%Ù´«vP)­åï—÷õžkàˆ«ï³*óVOøËÕôšŸŸìšØkʦ¯<ŠâgnÞwæxBˆàÍîÐÁs^ç™ ¸´÷çÓ÷BŠï¯0aeR‰”!)?¹yZغh5M-mF¹LFôŒLL T"÷í¿žR "üòÛ†Ýâ&ΈØ1kk¬yëv’ä+ýWBÈ£#G-Ú‘/Vág¿š=ÐïÜûBú@éóíKÑÏÓÙ:Z .J‰ž‘‰&*S®Dœ8½bÉŠÊJxlFèØ¥_¸L–¬p×ì¶]'Âä˜]'!²‹s»Yv¨PL„E K~ê¼/.ÄÙ×ö=>sÞ6–6ÚüWã»t{XòW—ÿá;²¼—.~Ÿòr†Ó?Ùô;€ˆï"‡y¸õÌ!"R‚‚.þî_"â“åAî/ЉE·C»LE¡ƒR 3ïqïÚ»BŒ¥·6Úø(¯ªëî¯}‡DHYzlUh—^“hôIÆýNî %B¬xèiøŽ¾2šmÛÁûRžQ–Ö«£Cøyúê­l__ûQ—3ñÒºà.ÓnÔºì·w®k—%ÒºivÁÎ IDATwÀê Hˆ¨?Fþóz(`ø.DÄÛ}‰)æKQ"Á”€š½Ó ²‚Û² ±\„ˆ¸}4 ?#"Îm†Øb*"âÇh@hŽˆ˜|ÐtŽòûp2 “ãÐV:M©}ÏïÑ@& YLÀ_"J°™à:Ý[@K[”Qˆˆ€ ƒÜÚÞ¬NNvëþËùõÜGCÍ*EÜ7?`à’‡â»Ç׿“_’þ±À}Ø,Dêâ´^ýן©ºr\òúM¢ìðPŸÑÇžWá[¼ù˜A!¾Xïì>¾µýø—ή“ÎÓß³"G؇BÄׇ¸»öʦ‰’T ïâ»þÂ+iÚ=Ï€÷ò–wuš]à2AußÉ(D̸¿ÂÕ{}‘<ëJ¸K§®Ÿˆˆ2qYŸÇý·³ä¬ú´Û¶CÏ/ˆ¥×&¶ë¾‰Nñèæ•„,Z0©{ó{û/8„ˆ¥w&;tè‘(g,¼ëÚ¨¿à6àßàg ‘2 2®ýäˆùN©ã‚N´‚S1 ¸P¶ñI¥ûvú ÔtÝ4ØÒòÆ:ªSÕÓ\ƒ^Üj›hƒ LÑvQ{¯Ü(8/òÄq €LYÏÓÒ‡uÔB&ÛÃ\«:#”IêØɈò cTô‡>“”˜&)‰U‹*·ßî­WNŸ_! ó8F¥BJªÕÜ•"55G½9›A£¦FÉ( àá³t]]iŒóQ\֔ʾΕ†ë×ìJªÑ¼+›ÈÒÒ%”R èKÕt;0ŠåcOûífjŸ+¬ki%D¶jÚ ‡EmN:¡Ç¬rmRó&݃ è:Œ™õ[²>A«º!P– …Ki`£/gù‘¹­ xV~òÒjî•jb:XùÂû 8ºF¯‰°ÆÝ pð °‚GA“<8§÷Âdy/’ y¤äUÕ0Bkɧ<×¹”Z8…]>¥ðγƒ[§ƒë·Øš#’Ȥå,N[Òeü€ Ã6Ê|îÜ·w€½„N°kòì1ñÞƒº÷éîi×¾6ƒœ¦¯àÍ~QÖÇY—·iÒä5+äcǬ›1Ýã,5{mÕÙE¹ú,>Ž=û† „r ï& À^½Þ¾“ù7WU&”–‘ööf4SI»n­pÏtôm{Ãöðn·mÕò ™E%**Å6r먴©WK6Í [•-ñëœoýn[óŸQ7Xï5í:˜"2®˜ÁQe(žèIxb†™:³J(ˆ–*TÅêÀR߃z OÌdUægg³è‡v!¡ÆÍ@c?ù}GÈH‰Ï&ä÷æ¢ìô™*êtIñ‡‚Fº`ñ(çVšÚª'»$T?úe0«G VK/–1eÒ¬ìlš`¢bÖ»·u]î– ©¢º¾[±5H˜ŒïXZ“Œ¼Ò..f¥&âﾺQëÜkÖj Ð@q\– t´tKõo[x-؃©ä؉ÔÆÙÈ|'OÀ¶M c !¾ é‹OÃà5¢÷P>pèD¬CdÐ'¥ElãÚwlZ ®”0ëHiuBɬ>}ÒÌBÌø©‰Žzþ•Óâ$ Ö~ØXûÓç®Ä_‰ØôóܳׯÓYßuʵ(׳Ñ7îGm]1kæ°U{õw¬Ù.–®s Õ›×_Ûûà3g¦M„ºNõØQgƒP*•ÊÄX¹9l9à‰ZŸ!Ý4Ü×`ÕD™HF©¨°«°A@U%æ j KAÞÀ€ú]ÇO积¡òe÷´åÕ_™,¢À fiÒEßÞ‹d"ªILÂ6¿_eü uCˆ@UM%™e5º¨.34-¨ Ÿ Áߥ§e›¶´´1•¾ÿTöˆH@œPJµ1ÖùÓ½ŽfÒWas‡X*@(p_G1Öƒ €¤üôìb}g;”wòÙ+çŸ4õë6{H"R’Qò£š¹µ©–ø‹ÚÜyóé›[@I)Âb’ßu}ïlQf¼zk°V=7j\|U´ZÓPÛ%)òŸÑï•J@ýõ¶6C¶íUyÀ¶žbC³#B0X ÊVP%Éàç¯Jͦ6} Bljf¿ÐàÈrÔ^çAOsx• ÑoÀÉh*¯W($ ¦ªh*6ho"ùô¡Ú™ JÌËÌ.2oÑ\N­øÃÛÁüCó]t‘’ÄÓÇUR‘@Ÿý¨)6£ à’«÷êç#:ÛËø:-œÆÍpH=äÜmQßþ׌ÖØÌŸû´xçq?íLUç9rGê„Üw¬ŽH@–\*k¦«©«ÝDF`ìô¹MÔªO‹YçÞŸÂ9sj¦ª¼‚BÑd! LÍè7¨2Iñ ^H5ÖÌÛZ ÁÛ%C£>q“éY÷~÷±÷ŸYÝüqS1C[WG*‰/äeÿ|¦°Á™–:gpÑ‘9¯Š|<25dø>°B'öúºwzž!Üä[‰^¨³-ÈêÓo,fè´©»'¦V!*Sú†E¿-ªW12Ù ,¢»DÌË»xþbŸ"Šã¦üõ!¾CxKÖwF¿…®jQ~1-gW-ÏÔÑäæýÈÉ&ÚëÃysoÍÝBºŽÍ í1û*ÉoÛþȆîÕ0˜ ™¨Xè^12tM´ ,_ðóí WßÔcs¼ÓƒcËá@ñï¬Wƺ?‚çÁó{àa M›ANeC9¾>#C°[^;¾ð¼ÀŽh(/†¯ï!ÄF®hjÜq&¨\ß+Âáµpà&€ ,p‚¥ÇÖúÈ0ù €gɹ؎M[×1³»ŽêžôÛ”B €›Gžtâ›0²u9Âô!!rnœ¼ÿRX6|À‚ýqò4•<1[Ë-™Ö#tÝ•Dù’‰W!VÓÓ L6Käc™XŽXÔò㉹^.XÒù›¨ îÜN(#„HK>¾«(óëÐ^·£‹YyùʳohÉy¸å'Ï@~‰»ó2ƒMET鉥޼MãÈȳ4»Î.ß#r ê^Ñ[ÕÅ—P„òw‘qÅ¢RáÞÞùýòø'îݨµÜ³rСðÝBûŒ[||ýJ§²¢2‰x\Ž+¸åb) ¡óŒUӻΠqvuu™}Kûè¹5:€í{,Yø“CXgo??Ÿ>³.ÌÜqÑÝR PZÆåʪF %æ•WÀªS_-Qœ«ƒ{t¢¨UÀ¼åã|Æ»ùøx{…Lï1ys{C dåå\Y®J*˸BhfßGOúÀÍÞíü'‰ àã’…s“Jj©4iäú+¡aÎßVÕ|^…@T%B\Ÿ†è5u^­{ÿàþåž3¶Ìì—1hîõ\UT äö%‰HÀåñ«¬1âòŠ  ·“gÖfìäéãëáîùD«ß‰Ý@î«»»Ÿ"€XÀ­àWÙšPZÎåJ)Žó¨`ý‰.΃¶=¦¬¬¼‚ª¾ŠP^^ »-æ•ñDˆ•Õ+I伉óÏ~l@]_;{ãåÔÚÑlsxZ;&ÂŽÏðl@I)€¤ ¢J(eB^%r¶ÅÀ¼Á·\ý «9D݃æZ•eÈ_ÒÿHEPɇœòÚ”XöÀÔPS­~`Zgái /‚«), ‡Q ÁÈ Î= h N€‰Ž¶5\~ UË¢\¾êÜ,w°lfŸÖ==œœd:œ<³P@(àòø$f3g ?:É£sç.á»ÓvÝÓ¢ô¡oHø¬mk5Þìrw÷ðõñò™zmQĶ–ÀÞzxuÉٹ>ž]—}Xb›)€Žu_+ݾw=©$ˆf݃ZWè· 2¬²‚!%k=#ïìâàξn}Çn ídlóãWöhÝùÅÍÃËÛÓãׯ¶'Id·7,\tì9µïk¦ïiçrø-EIxåtï{ëÑß:E{zùøy{]t8º]á&ÇØ~Ú@¯}݃ºt[zƒ}`ïrÝûC&­'²Ê²Šo›®JW ’ŸüÍ”Ò7>ˆ!Œªe:ÔDh¬õ$Zž¢N!ˆß–· ¹׎¨$ã·Å]®XÔ³§øf„¬‚t«Nó—Mä›ECaË€u°3åø~Õ›;Å×15i µ7€ Y‰T,¤¾½R ‚‘ÿaìÖám•ï²êÛ}Aw\ ŸPÉòž>¥& eÙküøcƒ”ïJëÙ«RÒxP ~¨1@ÃrUÖK¦Ò}F- ³ïšüÁjÍži4o ˜pwÐÓ£ýk¯»°EVYç~“ MÔ¢)¿1Ém»UBÌìZ­¨Í/¹ýe/9ÿ”Me‘Œ;I…gûu‘%ˆr$„.ø]ß1<ÔBP m]…•A¾cZ­ µ¡`±VB0(…¤¨CCš²*©XÈ÷Ч»WïÚ¬!{m}ñ¤Oê‰òM×ÔÎN¾_õwÄñwăÀ¦õÐ~@-]SŸ\Õ#¿oŸ¡ H‰„üÔè_ö>7]6­Ö¿M&?x¢X[-jëâÛ™D˜ü&WEW·n+”"eÔòGÂßpÞþw"zÌ„ÿ‡8S÷ÃlíÿØ+{qV¯¾¥F¶NïnRÓ+áó’¿»ò˜™¾¿<`-=ÚãŸow#Ech ÿ¸–¯¹‘¯³kþ[ÊöæÿøÓ¨nCch ÿP`ü#µ( †P2©TFÕ—T&•Ê(”ãÏÀ%RNch á¿WÝ ¥? ŸqHJÄ®ñq[_Ú±½lçG$Ò&®US.jD®l áßþ„©¸îÎOñØìÛ҆Œé™å,*dÉã;I „ÔØÀŒI¬ú˜óèQê4Å=ç·:«þúÇΣbž®жï2Bý¬±âU¤•½_¦Æõ²‘(­È öíËådw÷öñóqryE~DM°èÒLs÷qbBN°ï8éT£®i áÿº¥0Í8ü×gOŸ<‰‹Ê‹\¿övòõÁÖéëîþzåQü˧Cµnö´ÙpðÊ­ÔŒCãž=tP¶š¦‡í6®é§×Ë>οóðn»ö]ÍT‰º†¶º ƒ¥eqíø$!×<êÁýب5ª÷6¼©ceì:›4hX_@çðùóvjìÂÆÐþýêÙæQwï,êl…R‰ˆ¡;ÜŸÅg`ôÖãͦîh©ÍD ]>±¶'T]R@`d¹û2Îì{Ž»ç9Oš¡@ ƒAÓ§nìÓ¢)ܹõŽTÉ«”Ü ž]‰uða~­OÖCcø·Ûn Cz÷àÊÕÇ6kÝBS•U‘Aˆ”½Ng¶m«€©¢×ÁVOy]ýºÇž;ŠÄ?º#q{䥮|ÓÆTl5*úÖ¬>+^îÉ1ÙÕò;~ÈCch ÿ"uCH~ü•Ugž¿}ßZ àö$¯õ,MUª‚~¬Øà-"`(Ý´$AoÜsèªUe¶Sæw}—7+a}lØœS ¦14†ÿ_›©Òò"U¶¾±: "ˆs·¿A­@gõ'‘O ©Ì}Ø= {’¨JÁÔ Z®Ó\¹ÛndÝNüЭ²\kilp|Õ¡ÈvO[‹Zþ”{±14†¹ºineË+Mßq*öÜáqؤèî…kïÒºÎß(}´xÚŠíÇþ:iÌ<Ó~¿X«‚¦f“Êâ'‡"ö%+ xŒž°{ö;Q—>8µÕ†^smLÛ±íÀùøRÜ£{ü­=¬öÓ-µ„êæ’‘a›n5n¦Ccø׫Tkæyëàb’ýîIBù´uB'ïâ«û)!CÍÌëñõƒÖ¬Ò)…]¦îŒ˜ì†ˆŽ!ã‡w¶IMÍMZ{ûv2¡—/¦í‚\Û†-×®Zý8¸Ø4×@àx/]8òÓ¤,&ùw12',ë˧$Ú¦¦E¥¼Æ.l á%ü·¿™ª¾Å—ram؉ÌGgwW#ÁÈr/ͽm²e¸kc/6†ÆШnþšÀO¿¾egTÌ­„I'î†Ù¨VÛŸÅ܉š†  q?ÕC£ºù+‚¨àå帯-ý¬ °Qµ4†ÆШnCch ¡áð÷¾WÐeø?¤Ù°æI{½iþ÷Ú?Ю(ä°áµš¯„tàºN|ŠÒxüö""6 E€õzjT7¿wñD@œòË”1C&,“ÿ¡3kB9µeì¢}ï°^¢ ÉŒíóÓüŠÿ¥v!äÂö±sw5Ю*í/7¦÷ðùeeÃñoi %B„v†­¾N“~ãȦ1#ÃÂÇÏ<ó8ý˜7aÍ܉ÃÂF¯;r§cHAêæ…S‡ ¹ü×3©bÉ£[ÆŽ>vú/ÏóÆÕ§qJ_ŸÖäíRB#K¼¾:4lDÍ0|ðä¯Bß:±mÜÈá£Â§¾™@SÒ¨nšå•²‡uaʘû¼¦áÃC™?8eþLô?E9Éùü†ŠK“ÒeÿsxCCײ[§6z@OÍ ôN¤UŒ¤ôsRº´aþžƒ@øÙ/\gòÿjÍ@*’î:x-ÊK¦b¶Ÿ·r0àï¼âj^`hÿ.®¦¿Nê»án!„—ù´³ß`‘¹ûÐA!¼§»ƒ'ìA ¢ÒÄPŸÞ¹:öC÷f'Ÿ [Í%„þÖ1]W]Ë ê3Ä·5ßÕ+.K@Æ?·mÁÀÕgóR“˪äCÓ¬u¿>½å¡O¿nX‹ÔµÙ@·1}"ôðíäßmؓ䟬ußœü¹ÄzæÆù£!$Øÿi×®1OÂC´ßD~–¾º¾¹H6eñS6\¶k?/éT¢áͳS{µï]M5Çت__+y¿KóGù®^røº>?;éWgß Íµ Ôxíùë•õ?¹°¤‚´´Ì&–­4Uꀗ<|ÄÔ!m5n–iw»mr0{ÖÞ/¹œÎ6/¯ß)kÕ?îðŒÌ§×K¥Å‰/.]'“'Z žížrÌÄ©sÕœ{ÏF®;îkQùbÝÐÃm¼¹çy-Ü·nZM¾œ ¾I«ƒ“Qùݸ×>3Ž¬Ú€Ù4þ…$´´,oT¨ÍÍ3J9Ž-erèçÁÙÛwøüî¥a§'7O€-SŸÿÄðsOˆ»›­ïvëÌZÀ“]‹—d¶~vd1¬›fÜ7ê—!Í€J:×{òã·³÷\%Ⱥ›jØqé†=J” !_¢~ºù®½_ ^Ñ ‰a5¦ÜòÆ)ý¢E>¾ÞYÏî}Yœ½y¨98¶xȾûv“Þ½Ôï8,rû”ê¡CßDÙkØ) ƒVAÜÃ}–žšÙ½%Ùº4¼@%€¯¥ÓÛºü`Äe簹ϼۧͅƒ¿in>°Ð€]¶ïa¾¯¿oÚÓû_UÚ\½´K`çòðõîIŸ_Ù‡ÌÚ=ÃuÛÈ€s©š>^ÞKî3Tãø“ž÷»¸}ì5öêÓ+Ý!ûb¿±'Ze”9„—½Ø{þÓ‚Ëw˜’”Ø­ƒWœoí⥓÷\ͺÓý; ï_xxñr9[Íï5Ú\*Ì+ó»Å–´Ö妼IL?sc¨3rë„{¢¾ù wmºŒß;?èýñé“ö<·ó ÆÌ×osÅûÏ_l§£ÂMºÓmÔÒ&ÖvíŒðqÜKý>[Îýì).H½ùIJ˜‹1F÷ ï>´Ô²ƒ—ñǧwË™.FÿªQó¶Cу##&ÙT¦[jÃHÞõt‘˜ð¶Xô¶[ÈDq3{ÿ6*qW釬‹Z(ÊI¼÷Œ˜K±¦L‡¢ä™™µ%G…ÑånL!rïOL-5¢¦Îá«Ùn;h -OuÆõÏYÖª±ç¿º.íI€ °8žºÚ?ûµ)TQáè¨0é.í8t ö:“ššÙÞcðµ>Ë Òš m­ êæög¢Nƒœ(Êã©45S”% µääcÿ–ªÿžå þÁ@aùWÉ'^Ñ¿¿·ëþK¹ükEx¨Ëê¨DÜ;¤ó¨qˆ(•õ÷wÝH§È¾²Ð6p‘÷`z§Žž×³dtüŒ¾î3w?¢ÿ.}º»ƒç "DDÜ8;¸Ç¹t¼è㙞= Ä2Þý¼FæRt/ºtò¾VŒ%±óm}'åÊË“.é9vÓŠB!·´°¤‚ŽÜßeùÉ4yŠ·ûÚz"âûUÚ»þ$¤ãwÎö¾â U£Åˆ²I¡Žó¼¥#¢×L´÷ZŠX=¿½×Øœª¤[&û÷ŸvJFaåÃ-<òiJxñ];yÇ~+’ G»­ˆ|CGäßZmë;†‹ˆˆsÇt4m¿wA˜gŸp1""¾;¾Ò{à ±âÞZ[Ÿ¾Šå…íœâ×ñm qÑø £‘s/nW¯š9ïzÙÙ{Œº€ˆóýû/~L!bÚA›ö®»ßñéôQs}‚fÇ!ââþÆmyJGžY3ÞÅ·g¶H†Ü›®6Ý’éØôc¶6Î+ïäÒ¿NÌðòŸ~ý¹{—~“Eˆˆ(N¹îìø8G@§y°µ¿{Ø!bÊÓ¨û®Ë)üpÙÓÃ/‡ˆ˜zûwÿ…"ÄÔë¿yv&祬ôÔѨB¾DAôòb;tt[ûHÎÊ{«»¸½ŒˆÇæu›IGŠ3¸¹yÇçU"âûËó½».£‹H¸<Ýoæm9¦Ë?‡x¹|]€˜Ö³ó©Üê>—îÕgÏcļA#’*«ã/M ^sA”ëì˜Á“!E!bÙíÙŽýâ«SaZÏvNg k o‚žqã… kÌ4nT¿ð%ó+‘’Š D ÿEá¯Ó蹆9ÀË ħN|jæÕ.ãM|||||ü }óÄvÎJÉ@ÌM(®”hè%¦Ž†Ù/ðÄšnžf YRr:×´¹&K­…yiÚ\zÓ-iÒ¦ ½oQ1ÔA‘„+ƒÛW?6u¶1!€¨át=þ~W}Ù¹Sï›:Y¿£Ëxodj“ûö ªjéêi6¼Ñ«·m§Zo‹15#SØ©KG@„ÎAö"1W®|ièÑ”ÈÍŽN¾%Yw)„;×?™8¶7e" §ÓµøûÝ «ŽsP‚Äœ"±!ЄØšä¿¿[2q³¶´ýC[]ËÄ´- µ4Db1Æ\xghkQñ‘ÎúF·¹c雳@©UkošŒ7ï3ŒZZX°@³Ã„nJžÜK9ÍúuP§Óë7×—•äd'&‰\ûº""ôè ” €LUNv@ªfîoBg4ogŒ¥yPRÃfþløøê=Û@“dÑ$¾Æ6~ðál†Zº v`Ÿ<|`×®]‡/=†L$–‡/hjÝV%ÿóÂmGî?W*Ö6ÐPUËD±õ9е[Q%yewã²Zz´¢9ò©­(éí´Òš%ÀíÃúŽs¯y°&Ê7>,¼EèÂöF 2ÔXß\ ª²A"–ÈjÅ«±‰L,QiëÙÍD‚jêbYñ%•Zä}û ¤\‹sy粫U ÑhÕ¤„  O3P¥Ú)ƒ°@чaŸ’$?_²üƒ\w1F†æ ÅâèÐ\â Djlíê™A¯…!ä×=*`±ª&*7¼ ±º¾†½z¿VÁª-|ïÜ;µrá²õ×Oå—:ÿ´bË´n* Å ž ëÛœGÿ¿²\ª–ybÕʪ# ¦…)¯hÇçÅŸÊjr¾•j5Fveöýƒçt±yÝoD¢m "ÎãÊÀ.EšS†Ž¡Š4[m§rË(Ý–ÚËOߎX9ç×õëš{ º||„×n#• Àå[÷<¦Üƒ*Ÿºò~Uk=cá }·ÕièT‡¬MÅõßcPigŒ]–žë\kúü&Ÿª&L™`áþ Æ )*SkŒy¶‰VôßvahËúÖS •·4P+Ê)§G9¤( mŒ:†]øeð߀¨Bð£Þ½˜ºšj¼".ЖÖÒŒ"‹- X1ÅåòI H ·Te@´4P/I«APFµ T•¦*RÞÔ݃Íji?òݺV†lU¶Lo@{êi¨ñÅåÕ%æ}Èù±>ÕÖQ«,à Td1˜?¾þ¦L´uˆ¶qÔù(ECgÁš}zD<Ÿì¨E ”w³†Õ’íÇ(™T\ø.¤ç´Ë=Üú[÷(ÍÀŒÃo³ðôjw•úRd=|²h¥Ï$ôtQ™û¨÷À™c·Gt2­zš×ij½ôáýœñ--då÷ !ÔÚ@·³ž¼Ÿ=»c[@Jt?_èÞ‚î6ö˜%ÛÇÐåGþTÙ>IJá÷æÓ$³CA:Xåy·8%nÝîG‹7,Òf°l‚š0$€•qãAxýj«ÿŒn_lH¨”ËüêY£ßɪ™BE»•¹&çÔ¹ÛôÏâÇû†LÝ.©=ÐÌlÛ˜_9p„Ž$^:nI¾ý†øU>¸u9€ÉŒujçy§‚Ùkr·‚óGîÊÓD,·æT""”|ýôò“Üz§¡¡]š÷™È Õ4þ}zsÿ iaÙRÿQT,íþûàÙ{6BÇ–\=ÿ¨œ–¨ŠØK±f>£™|ùV>º{ñ+’}ݥǭr z{éC¾„¨5·2Ñ?wò] 7þø‰ëD?ôHƒtݵüæåØLùï3&-Øÿ¦–†êäÔ"?1å€$íê¦G?è ¶i›öÚOŽ^¡Ý>~ZM[¶ ‹~ð¶Bo7Ö×ôϋ舷'^y€£Å–”‹ t÷š-Àd1åå‹+Tâϯ7÷00˜,5 BI(½¾yùqZe}R ØËéɶeò•XyBøè I¥"¹mV\¡ ðôÍ# §¡ BH2&›;xÇ­N¦PÒÔȤ£ó²¥„¤Ü>š!Ððkg>S¦æžšÿ‰ @Há‹ÈO9ài‚´>¾½.({?e×çs‚kp‡CÔ4fæÂ[J[x´©1yrT9·\9v;™^É^ß´>CÃÃÝ(1/þù‹2!Õ¸º‘3P RU—¿ô<—L9!ØËØ̼økjSça“̤‘P$¥€°8.3}çùíæš’<gìÂõl1%%ôÈGÄ[WMš²ÜÅ/ª¥!3§DÖwÂ2M@" hC Ê„!­†mŸ´j˜ãã’rqï¹+:kØLZ11we?w­¦Í+2SµmBv.kKïX<7£mÂÙ50qP¯ðukÃ3ni‹òì<ÚUÞý(PE‰@ ®‰X(’PµsÁ§f=|ìaÁ”±–­òŠÛ«‹¼ÞÃ*ž>“0m'®š³"ÔÃÀ²e^J¦eàäˆiöZÞ±èËŠáN¿é—•‹Bf.ë¢ Üms&´Ùœ¸¦›Î¯¿-7m{`„¥•Ëc‡ÍZ­ @Ä"S*o¬T"‰åš‚’I„"1«á[|]3Üu_“–‚ܯªV;Ú±H(–gD —1‹;Ç…Û;[9´‘ªX/˜ÚfÍ}©X(¢0”T U·W& ÅRÀ„É3',ZÔ÷¤žŒÛµ_°ðù5Dgß6‚!.Ncvê.ã jf ER9Ç”|×s:µ7|Ú’ÐKs5a!_»íš=þ*c›½Ä{ÈÑŽÂqË#ç;h膓'[µ ÔÄiþ>–ndæ­ôð?ea¬U_`íÛ·w+}ÁÑ“¾Ž{xa¼ L ø6 Q*Š$Ðsʺ§Óçºyµ4ÕÊÉ*vé5³¥ž*˜µög t\¼à ½¦H½_.M™z¨ªb‰ñé‡çÛt™8þîç~ÎÎlu ´¬¦:g©I±‰Ãð]ߌów&–DÕtìþ³vúÐbËœ€‰Sü÷«ê‹*¤îýæ‡9™@ò­#—Ý («äP˽Ö2Ð}ò¦CÜàëó4c…í»¹Ëñ¹¡ 7„\ÌTCž†…ݦýË e_&µæL|`«Æ“)ú ¦Ú¶_õEm>U:º“Òö¢ÀÉÃk‡NÞBÿs1ÆØÐL›Aj¶\yÆo ˆr[Zì«[d}šk RMÁSü ¬ß•u4ð0¥n!Ê%MÞU ôÂ÷†ƒ.Ôd”Œ—µ1­S'sÆ¿é9Cã‹ðï/ÿªÜuÂÿÜÍòO×~[°fC[(‚.aSWNê ßs:ŠÒ¢„•K–ľ.à0Z­¼—¬]ïfÎn„ÿˆÔýOŠ]£ºù-²uŽ½~_>¬ñò¢14†FuÓCcøïx7õþ÷A"ü÷6ö·µfÿ*œ¿cêæoX;’}m½·ƒG¯©Âÿ5¼›Í“û-z„ÿþ]!„Lím5býëß×V¸y†Kña•iÇQ¼¿°—¤Å©‡#þõ’ü„£gžRUí·­[ÈÎ7?L:!„L µ ßô¶qùϨ›Zj•O±Çn™MÜöøÒN5¬3ñ!*IÃ:õÔ3c"Ö¹p¦{‡.£F5§¦zW1ªêš5fÝ×,kQW÷kÖÕÄyƒ:þùP)êíŠ?¾ÇÌz&pDÜy1åÈ|‡ú¾¢Òiœ@QÄÖH9&SMKK@=¬¨—e¼§3ÈKxpì̆²¦Õzq„õ’JKNu;ò⋪’¹Îsgõ±RÂbÄúx²':åÀ»ÆÕÍ?£n)~ëᔚropg—9dz€,ÿÕ‚Q}½½}ûŒšû¥XH¹îr4C˜}r‰k×qB!NnèÙÙÇ×/xÅ‘H!¤øêD—qg__^íÔ¯LBB>^ÛÛ?ØÏÇ;pÞŽË2B !dÿ9GS®î˜èçݥר»é ‘ÈÊÓVLâçë3pŠ4>!ˆˆË’WMêãëÛcð¤§_¹t7—ö³–>ªœ6ØsUT:!@dï#:ø…‹=þÅ~àÖÌû|ýüJê6XºsH×Ù‘OèRöŒ°s‘CBHùÄÿkï;ã¢H¶·OMd`† ‚ ¢b$#ÉYÁ, ˜3æ¸f×°†5GÌsÆœPA‰”œarèú@@PïÞ½÷}wûù3=ÝÕUÕU§«NxŽ»•ƒÝ£9bù¯·9Ù{¬æ#„”p³sß½nñˆù"„0FÕ˜öK!„0B’?|Ì7$pQ£ý !„âNþîëêèìâ³õÂ[ŒÆË„cýí.½þ¼gÞhG'§ÐßÎHÜÚ5ÏÉÉ1pʆ)Âò†Wg¬Ÿ1ÆÑÑÉÜÜÄ/ &Ä!CíÎ?ü° ÈÉkmB¨"ýÁ8_gG'ß3oËâM˜ Z7ÍiÑá4„äízã ?ñ¡.öö.«ŽÅ!y¥?be˜ƒ£sð¢}ü⛶Áå¢Ê·ÀrFÅ[»õÄ€€"lÈž6ÜÝÁ~ÈòÃ÷ä]±p¼ýŽØ”ßƹ;/yŒQõÁߦ¹8;zŒ}WÜøÀñâÌï~.Î.3ÖŸ"„úµzØÒcâŠëöÖö¸(ÿÕù±þ®ŽŽ#§®H®Â€nùpÒ{-sÓfŒð°³sž¿ãRSµQþó³c}]쇄o”?žüãóÇn¼È-Œ¶·qúÄE²¯)ñ¶±¦` øeÛ†qr6qEz=’ÛËÓîõqvtò;—P~wð°…·¡USœ–F|"W7ÿú®û¯¡î£Õ`û¡Ã—½IÏ,ª’Èj^¸›šì¹™XXXðáÁ!{«!Š1¿²ðá®ÁÆT–UXztî(×°UŸ>ä夭æ4fS4ƸáÙ\Ë!#VïˆÊÎù,!ðµ?æØLNÊÊ+ÈËÞ9}˜Ïœmò»m_èéèz7)·²²òñÑ•Ö2KÓGYY®¾ø:;''î`¸‘SX%ÆXò1ÐÒdUä«ü‚O/Ï»˜YGfÆ©W"6½þ#Šä &v¾áËede ¿' À¸òÚ “£cLˆWswrt<œN`ŒqáIc§E×wxm”Óq·ìjcŸ^ƒ1Æ_-7<"L‹à>Mî³³y–SÀÐyj0Ƹ¹w¾HÖä;&Ú;e¨ÇŒ-™yyY) ¼lCwßÁRј'·qË?~)+/Êãmëê;ùÆÇÂÊŠÒ¡~ÖÅcá‡óAë/Ƥ=?ãln“‹ ™d| “»ÿÜûÉ™9Å\\qÏÙÈ|ÛíäüüÏQëg¸z;ø.|ˆ1^5ÉvÞTŒ1þ¸ÉÄÚyÖÚs_Ë**Š“Clú¯¹W‹1Þ>'À'tuv^~fÒýI£ÜÌCë0®H:ln<,±¬ªFDàô탬Ý&Íú=-+77õá‹þËnTbŒ†¹¸ø;™ø)ûk=ÆEÓ-'í¹ó¹ 0'én ¹É¯ê1Æ7vOµr MÉÌÍÏû|pÙÏ Å–òy—÷Nuõ_]PTú5î€ÅáïÒ³ òóÞÄlíkP)%ZùÅ}Ž0¶p˜°àH~IyUYƧ³¢K0ÆOO¬¶uþ6=§0ÿsÄò .ã—I BÂãžÙê=ê÷¯%b§ÞÚí2r§cLä…Ù[/<ý$;7÷ÙÙµF¶Ã¿ˆ1.¿ãdd±ãNJ~~î…µÓ\¼ìý?¯³]t8 “øï¸ùɃüÖ-¶ê׫³:-nÝJ‘÷¶p_3==}·^ƒ¯EÞaiè*3ƒ£¦¡­)å~¹ô>{ź}»ëôì¿ùô¬ÈóyQDU’°E£{öèNC Ñ·¯<8¨—¾á½ËkßO7 Æ®†vžƒº««k8ûØój«Ë¥8ãØÁœž^F 6ìÑÃu榕#,¿Öû­k¿šÍÚ8Ö¦›ž~_ÛqS‡÷ŠÝ}00lÊê©þ?Zý"Š¸FºyFoÃöýÆ5<§ª%ÝÌ Ä o+ñH‹w×_न‡ÝœÍlG4<:Íd¾-Ðìï­2òÊàÕ¹ÇöÓ|™ý½V¤¿æ$~H1#$ñôm 8þMO¯+$¬ÈŽùT²yýòÞú½Œþ<ž|ìdSh1Ä/p`W--Ýf:•Í¬ýê©kv ²0ø\ü^oZ]f³hÍ(k}=ýþöB|ôcœ“» ùø¸÷ê¡«”pêßtØoãnú£×ì0Ö|ß "¾røºàÎZššºÆ¶Ž:™O?T½{Ÿ3<|•a7ý^ƒÜ§8‹€f' h´ÕUÄ<ê¬}¿õïÕ£Ço7œgIrÇÈîæÖ¾f}zvá|¾xô²Õñp¯îúz=ynÝàumí!€ã¸5×bŽõîÑ¥«þp_¿šÒw ¦²5”™ˆ¦¤Û¹SuaMM»g/CýnV×Åß;£Fi³¯£H„¬ù;¦uÓÑT×îããß-óÁ[É¥ 1îKOYöë©×­û”Í+‰”×ñuMQIàÐ9»èФ<½Ògl( ÿò¹du“!N†Ý»;Œ_¶6xHq4ád´À暊Ï')¬ß¡ À p$Î=ª¶ó«I*ï»Ì~@ÔæeÕÒq¯“?è÷ l¾'¿î3`êþµs•¨(ˆ¯y åÐUËÔT´äQ×tÚ5ù6}‘&׌Š2ËŠ?<³^Ý¥'5eò{±·L]ÓÀîCOD]h—HmmT8ºýˆªâYú›„Áë|so§PsÞúm=YÒæ^b²›:µÑÔ¶RS) çjê%:_‚¿7Có0ce|(nn¸”ϧ*²Ú\ÙO—YTTÙÔÜøå¿ôx]ÕÙõùù2¹&þIƒAiìÍÅðmÞG«¤¸ŠÅæÈ[ǢˀÅ(HÉ£úNqV`Ði4jzf"ÒbR#„j¾¤g—bE%Uß Q·¢tòÒnI›§~Çþ2= õ$™ÉÕœÆ.Q¬©à±ùñ+~ïúûAËÅÊ žš¥Eå²Æá$9µ|þ¹láÀÎÌ/EUMwix÷²MQ^¼÷!!!!áý›¸uLÒRõ_7`¿r‹òË ›"edf&<¹<*Ðÿä“’V³AQ7غ϶ «âS>e¤~8¶x¤ÿì=²¶¯PÖ?×èáOߧf~JÚ<Ã{Òj^Ço°ž“ÃMªã¦üy5écÊõ=‹¾¸èQŒ®7Ì9¹àðíôŒÌäø»ƒ<~ÎÆ€R¢¬<+dt;¿]PTšŸùv߃DåGÃ$-òIk"B°š«ãÓ+µ %0õt|Ë>ÃñrÉÚgLXö‰½YÖ=X½{âÓ‘·­'R`ƒþ†âʳIeƒŒ€ù8Ïkûö#;M$+]2iü,S£ûØA]V¯Ýø6õSÆÇ÷ÇMY`¶äwýôCK#î~ÊÌLzu+$Ðsû•Ï¨uÛ„£¾»¶ûÖ»ì¬OÇ[š§¡þKæ¤mjÜ-vÏïi™ÙÉ/.ŸÿIÎ Jš,IIÜËiEü_)§kÐ'iÒØß/¤|ÊL{ÿlÑH—é»^t7ê‰oE\ÍÊÎzýÇåWuB® ùS–SAET—žø>ùî™ý!“f½HLÎø”þòJT®‚ö`moÛô±û_Ôu$ñ@#ÇŽzºÚýøäÌŒô«{—xM˜_)!€ÉTæU¥&%']{ÿÑÈÕ0 À]C쥩6E}øøñnÄÚ]/Š]{( FysyÏí„ì¬ôˆK~Òc¤¥ê?%n•ÃáÐ(ï ŠÊà{Ξ Ÿ¾éøÓM—ŸÌpÖ†"[‘A ”í‘ÛFèíX>ÑÊì.¡Ï.­¦ ‹ÃVhŠäÆÞówŸ^êzxýÂðy‹^JížÇVÄXl³iëG¡)³•( Ïܽޣ vù’%—r»\»¡‚1¦ö¿ôàj§Ì‹ æ…¯Úuyòþ;›F@UNZBºœ:ÏÜuØQ1}rhèºc¯×­Å¢Ð$@UPf³ZûÝЀ_Q’ñùKãJš6hè@¤¤e®Â¢`€îžŸ¾fïõ9÷×uÇ€•ØLºœÂ ãΗά|}påìEuBwL4WD–"GQÎ1Fa*³¿¹Ï0””XtXyä‚«jö‚ðð£OÄþ6†'&(»Ï îsfÝ’˜T.ИÊlŲ•X4`)²˜ÔÆ­ ÖÙwûÁéËe —l8d<ût䌩ëç$›3kÁkìºïø‘™–ì × ÀÚ{òå¢ß–¯ï;ã`Ä“C—†‡ÏÛ¿òèÍ=˜€(ËÏ-©—PÊœow§1•ØŠt°°öò¶às,›>ÿvY'/¢4éÀà:|jOzîʥ˲«z8²±<Çîzðö]Ëú+/:•@‹¾­KÜeXôé寬˜½hS×I»BM™@¡€‚"‡Å ’ä¿dÿ'ñÝdO³ù»;¶¢M!ˆV÷mEªÒTXÇ׶þ¡½hy#¢=>¢œ¶]Ã+{ñâ}óÁ=cŒ&Ëo§&ѦÂù_¥å7&(¹²ÞÄNûŒ5àt@„¿gŸùEÜ. Îwwï`ÈuÔÃD;Ì3ÜÒç/>4øs´Qèñ‚‘Õè]Uü+|7m>·OHÒzúŸâ»éð’ï~hSU„xÙÅ¡3&7ÒÝ´duiKZÒÁ]š¾t|mKÞ—v¨l:Z­ÿ´]­OŒh5»M8á15p°aáû[§ £Cºµs>jÙí%ÆîÛüŒ˜;s¼ª´ôäÁ«CÆïÿ¦ÿhYKÔú´¡àùá£ù®èÇÛÔ^µÛÜý‡£²±ü½®Ñ«w-ÊkÚ0랉7Ï~é¢Onžþ¢Ð #Âÿa‹YÀ …÷þT\ËÑé;iöœÞêèçüB מ»ûALaÛN víó¿ÅÄòë/8°ïpFq²nßɳçª!’‘ƒ7$HøgX¦H AâÇø7Üü¥‘wýGë°[1K%DÝ)2™2´ïÖ§_:ÑÓ1ĸ ã¿ÜàÒ¤è›y¦ø[JËyyîeMˆOOùÊZü5îtr—©¾ý¾?3îêqB/ÀÃ\ë_]Ë7óèÕ [vù+šã4¿¾-ù„ òlÔU;ß`m^Æ¥ãƒÇ(P«/Šá3¨MkVÄRÕqðòÑg#¹£Þ“kÔú;5—#TDFÆ:Mé®J„„eY_$Uó(TýÞ&.öFÔF2? Â’ˆÈÇÃ,Ù±ñr‹$BßVÇýÛ¾)«ƒÍiZâÓÔ¼†Yq(ïvtìóŒîúUÇV.ΣZ@¾¾?qì S…U›—tìl”P†ª/„¹Z,ÙzôÑëÄä„Wýîlâx/½¡&×h7;=-éÝÃg«¥ßÔFΞ8uiÏòÍ‚d¯oÄœ:²~îá!ùAB\öøÑŽ}€2§ bÕÒ i«nL¸"òRœ"ƒö×õ µiŽG Hqò š°¿Šê$K§¤~»ÆÉŽò_ÈrS÷˜:Þ‘Ù»¥í¸#£hk['Ñ*Ñ‘Q“À'a=!º#kqGÆÚö[ÓÊÜK`Iù{ûŸëœ’å‡ÓNÒ’ý‹†…N'ÄuAîVûofµ8Sò§¿±ïöãü¸Ön5"ÆY>}M|nYŽtGØ0%ûå_×M ˜º)²å„Õén6f?‹0®žh=x彜o¿I>úõ¸7E*ÿv{ÿ”a«¿…È‹jÓÝ­M⠤ͧ_ß½ÈsÜÂVí«}äj<àl¦üp¶¿å˜y‡[ÚדO¶0µ{VÞØ,ùÕ¹Wì,ݲÍGˆù>F›c_YÛ:¾/æ5÷ÀÎÉA³§Ï1³÷+àKåÅõ…î6fñåºnHª2lo¦”·èFá ×~Ž}n×c£ýÇþýOyû ^ùkNdDø_GÒ‰ÅÞÞCGø»Û¸^N«B½=èk>á B•?ëoézeë´©óV®Z0ÉÂyè•œzù’ùåÑËnaö€DU &Ž°âèãbç9æz¸.n£¡m(!ù»"ù†¹}ŸØàîl76$,ÈÝÖÅwÊÜœa´ÿ B!|u¦[ß~. b„B²dçÞŽ‰2Ôðþäp7¿1acüݼGM̨n œATÞÜ‘>#ÆŽv45¶¥¾éÝØü¬z¹ßßÙÊ#`¸«å¸©›ë1B=Ø6ÑÎÔ|LH¨_ÀÄ»Wg 8ÝÞâæ0ýFâå–ê†zœøKÛ½œmFOáåàäöª!„–[Î?”† DlŸhce:ÎwüÖ Ë½Ç¬~Ž]زhˆ³SpXXÀ+¯as³$'½ûê1¢¢sÆì};®ÑX‹Ašsïl©Îæéb @ÇžJU%¿²°Â2nJq‰1Æ@x#íã\#ª|ÇôövâÐ)ƒÑ¯¬Éšÿ©Xê*•EõP·öÉWƒNo>cd<é°‰-6ê6 oA™-Ÿ¥î¹_e3+Ðfz7Ñö›™-ÍÕʦC7{ ‰3Kýtm‚ÓÔ{„êSöƼkîFÑ»ã×êûÿ>¹{í­9®ëš3m™b²-!`±tÍÞ ñsׯ[á<Äyõá{òÔÞñg½í½ÆN á½9ú½ÉÛáêžù®öƒC&Oñq°÷›´®!@èÍöé½½f¢¼9ëß7ˆ\lp¾sçZÌ; IOΫ†ucóÎEDŽ8úò™S±^-®÷èz–ÇÜÀÜk/d å^È›÷WŠ{Q‹­µ 2Çù#¦q^}3êTÔ¸Ù½k&®Œ@Júá Wc.\|ö抠àÊåÇù¨e¸cÃç1á烶ݺýòÃwÅÙ×Ï=ÿ Ÿï-‰.\;!êÌ雧·¯O`*²€B£Ë‹ ÒoÑNìDŸßsÌmïë‹gOÅÜ}¾)¤×£+)@£3èTÕ7—žNT‰zûâÔéÈss9wï3˜ D”F]¹¿$êéùS§®?~;Αÿ¬@ùµ47O @+BÅO.>åÊÃ,áÁ½{šÝ°ißÏ2ZË0AQé‰7Eƒõù…穾q_âÖ ày.^½óáS^Ón#Ððènõ Qúð“”½ˆŠZøØdÞÞVÛy°¥ ~u=™míiHù漄¦ºèuþÐA>–îÝrgpðP€Ñk'eÝñµ¢D$õ\¸_!3ââ»’_˜Ê€ºqRÍ•½)¢Ænì]s2wó­ø3ÇÝ~þÌJp{êoq`à„—v/#÷Rÿ–¸Áˆº`†»|üÙL­^ñ ¹ÕþaªÒüQýå'ô°í&-Ê—pó3Ëjݵ”7"LæÌ¥`ŒÆìJ|²‹jÁî>'¨Œ>÷)`Õ$EÎÊ÷G”VVó„ÏIkêÍèܽöÎÛÕ—–Š{ÎðéŸñôq-:ÝÍÓ¼"ùWYѳŸr]]]]]½ýô©”‘Y€±LÙÛFŸÀèlÎV}•Ýr@–榔<j 1Oâg;õHKÍâèhÙ˳ī›®óRüÞàMä]÷™žŒÎzªî+*¯â Äöc[fÜâ,âÎœþžÝ05ëÙÞ}…£¡®põDLeu@$ Y¸9ÔM’ND÷°“Ç€€Ö°+ñɽ/B‚û—˜NXIýÎ+Æ€Ó“ýü}=ÌìGäRÍ6,ü¹ÇÆú¾«Þ<¹b¦Xyâàâ™!æF¶;/¿Å ÜË7Õl)ü0€ Õ}y#¿uÀÐ7Ëi¾œ¼ûð`6å\ÄÖd}®UP/êHu%åß+¬î6{‡ôÒȾùàK+&?%ýKl6/ÙZõkÊ0j÷0³5±—ÒBÕÏã?:œò£K±½£ÀšºHkëj¾~Ϊ<Ê0† '¡˜€›ç^i{xY«È‡·¼²ZÓt "‹¥ŒhJwã›ñ&)=ÉUÔ—6qÉ „»QKAc®X*'Æn:ÈdJ nó×êœò6Ó®üÅ3‰A]*`ÄÔš¸öÈÛ7Ï"OD}>rò‘–ïêJ”z‘¨¹ÅüŠF­ •c°totâë‡'öÿAI9¼`ç=BP™UMu‘ýÆý†ÐÊK½RJ:ùÚq¨§J{œà€¡Èas8JLºïô-ŠO>-lö¶×`²Šk› (H2…"ºª]*¨ýðú…˜ŒQ¨ –žíäñ~Ú_Ÿ=|Ì(³÷ê?ÕP¨6›Ãaszy °uʼòFÓ%²šäOO¾x¯üù;ÆHò²0ßÆȶ2õiÌÓ&ƒ¦L‚1Š rãÎ÷ÓŽ ðõ÷÷÷÷÷_ºllýÝ˯„m¬hë†ÙïÎízXÏüYð<ŒmçNUxsÿQÞ| yøÌa ‚·T=ÉÄÒ΋.¨åË=À/¯—3 é*Sk¹|¹XC .ƒÂ!ÿ&Ý –žŠË圧jÔŒX?½(ýâ§Îa¦ò iEOÃ÷‡#D€PÁ“=ýx#€NK'v=óöÍ»L·Q€¸)k~Û_ˆ©ghäl9ˆWþ¸Œ´ÍH¹õš2´—€êkÉñ1bËÉݨйçŸ{÷}Y“cĵ}ßÈÔÒkYõò­Í;nƒMÏî¸2?;¯œÚúýh"Ñ“´„!îLûAóc’ú÷Ô¯«®ÎAîÖ«5-71àQ|B£a0|Z¿òÏrF×ý],Eå9Ä·æS‡Xªe=y/@$ùפŠQùzåšS| *öèonÓË ¶ª”—w£¾ÓÈþÊ-¸°è}×9ºãêËìbŸaCÿ(- B@Q6<µÙõâ‚9)µ&t¼mѽë1)%ò9 «/عx3Óz®‰*ˆK?N1ÿØý”æ¸#QuÆ›7¥ÚVv¸äF6Íkˆö¯Óf"Œ±ù¸M=pÚ–3/BÅpÚH;ÅmÓçg–4Z ^é¹µc3¤ƒ&7ûštfÛÊEb€¤›1bu[&T$>K¦ªÎéçìâêæææêêæà>ÍÇ´áØî—­xÑÐz­ ë²nêÉO‡4BÀ²žàÍ<¸ùbB$ÐÑ\.³Ù:ԚšƖ§}H«ÿa)= º±n¼•g!¿q÷­ƒÞÃ=~þ¹‘Š¿z|W£ÿp:ÄõÕEeU¤¸ù7ÜüŒ)´ [†>êÚ[¹îåÇ¢…»Î*´NÖ2! ÆŠ>÷í­Ûô:qœ¹»SÜ$g×ý4ei¼¹g/weè9b…xèÌ×ZAzÆ€ØÆŠµ¿8ƘXXÊ*2²f@Aý†÷Ê=øI­_gôµ²oÛ• ½±@ѹÑ-xŽÿ嶺¸4!»bò¶Ó K£à cýõMò_Þ¯e:¹öDÎ}Ãv߃•vT¾gV:Lz©§”|l`YDú›0˜ý'wÛêäæài‘‘3y¾ñ†+«ycß¿ü`»÷`V?-ÑŠáöWŒ-£Úì·ŸjCÞ¡·Hrc8s§ÝM?o×v–]žTâÖ%0UÓ¢!w½—k”™‰1¿(ùc¾tMlè›æSÏÑZ¯\LƒòB–WêLÚ»õ/-^Î-3Ëh{lp8é³á£1[¦!¶]ø…e+çŽÜ*¤¨*H$T-Û+{ÇQ0VìîpkopèºÙ'7P ô;‹ª¿Tð)6³.„õø°q®á˜åŒö¼(::€†ÚéÝ£íÇÌ¿æúf¨c¼ôè%Ù”±ÓGyñ†*CV/Âjª}®\9ÜC×ᛠβ³SPD2ªÊ¦sKX7nF¨éúë²ir£•Ü=ÇÓÝ?<æˆÛµJ6„±÷ŒÕ.Ž¯"ˆ_±œyL8°t7µO¸Y'ŠüÕt®“†{ð„eA]._Në=Ø A&…¶Ù‰¾}ž9nèÄÝ ß âÔ¦v1· UÛyå×qan.6ö6Ÿã_•©[Þˆð¥$ŸX;õ)5éÊùë1SX&*­¨ÕÒÖäVW $ƒÅQWUB¢†ò1[GCd¢’òZÍNÚt ™ ª¼®Ê’q%4-u†FÓ'–ð+«ë¥”TÔ8,Œ1„AVQ^”µT /±¤¦¦V(–¢*)«*+2ä`õ•%BÌÒÒT2!¯¢–«¦¥¥@•Ù"~CMOH…ÅVQe+€¨¾¼F¦¢¡ ®®åb MUSSÎØP^*`ªk«0å.°¼ºê¾¨ 5 ¦|‹¸ª¼L,¶†NYôè‘wG}87\PW^/ãtR§WW©èv¢Ë£Æ±´¶¦F –¢(rTU”˜PSY L 5 LX^Q#š†ŽÖ¡p‡÷]Z:¤¢šÚ:‘D†(4¶Š[Z[VJWï¤D§´œT€e¥å•4¶š&û›ýI*äVÖñµµµ(HZ^\ÉÒÖåКg’4T•s m]-zýž[WÏèLEU5ejSÊ-„XÐPßÀ—b*²U”•(€ë+Ê€­¡Ìjå>Ž Iyy¥²¦N?ðëkÄ ­¡Ú”ÄÂUå¥ÀTÕPa5Öˆ†ÚZ¾PŒhL–ªª 5Ö KU5õRXlU6ה˔:irh­äª„WRÅÓÖÑâWWÊèl5eVsK…5¥µB¬¦­Ë¤þD „¸¤¼š¡¢¥!÷$Æ#$4T×q LQÑÔ&xB¤¢¡Â¬®(¥)ª«(1¤Üâ a']M*`àÖVq ƒ¥©ªPV^¯­£M @ÔUWóÅR ¡ª¦Î¤’òå³6þ±tó#ñ àfÍ ›~·P‚1Ƹ~±‡Õ̘¬¿XÔ׫¡Á 3å%ñ“M¤JÉþñgºÿ®v‚¤£cæŸø…Ïÿ>Ȉð_ÅÛˆyË=S6èÇ-ÍW3´>~øOeÚ¿Ìw"î9¸b|ä㽞9ŸKLfD¬ ÿ6‡ÿÞ]^wæIÕ÷F»Þëæûë¢ÿú+¾-÷È͉_1?:òW‹"Gáß¾`ÿ‘1ˆìnRÜ Aâ/ß Æßj©Íÿq‚ú&@{Ç¡“öNÆ-ÌbmoÔ¡`m'íü^ ãŽ;¯MåÉQJ‚7í­•Pþ•.}‹ÅDJÝèµööÓî´ôÁ#,z~áW+c“¡SV,È™ ">Þ?áç`ebb>fÞ… òÒ¤&oëœQæfÖNþÇî§bùÉ„èiä®6ƒL,¦¬9Z-F¨)y[yöK;³ [£›lQîõ=ý™6ÃÌÌ´ï!ù„ÑÓÈ­n6æ&Æ&^ãæ¿þ\ƒúOs$ãí[>ÑÊt™¹Í¼mj%ø› BHR’0ÄÊòi—\ø“øŸÚèþI¸<þ÷¦ØÍ^^ó­ƒø¯íœkï3ª'–a|yËt{ŸQ\ 1θ{ÈÆÙ#½J@`|oßL'÷ñuŒqíB'ãQÛ‰e2qÉ+Ocë?“ê1ÆwÌvôúÒ ÂXzd±Ÿ»ÿr1ÆöͲwðœîç=uWì·»Êd’&H1þ9Ínæ%ŒñÃ#SÇÖ‰d¿:³ÂÎÑ9§ZúS+Bûi~1…¬jšƒßòsBŒ%¼â)Îö>¿ßiSt]î{‹ùb’îŸÄ?€®NÙ¹vñŒ3–mØóIî„Y™8oé¦ ÂòôÍ+æ͘¹ðFZƒÂ7Ï Ññ…“¶Ü«¡Œ6~þ^=E:Â8hò8^YU6O "íꧮ<&/fÖåÇ©«vþ!ÍèÔ’!t ¢ëØìZk½léØ8óyÇ»²S§-[×PŸ]-À4àꃻýZ3x! …F£Ñh4*•F¾œ±?ã̶@PTµXxè„ž2al8™Jóªê1+§¬Ž-hÛôšO3×ÖÖ¤¯›?åH\%~þÑ-¿Í˜1kõöãµ2 .¯˜´îVqóõÏw…,<Ž®®žµ<*Ijj5lì¬Íʦ¨»{ƒeÁ­û Âꬅsg¥•Kcåî¾®úÕû£_’ ÿðÍ’”% 2‰ÛÉtøˆ ¾JÅ£;fTK@Xù&1ELH3Æ)T8r„WzÄ‚ˆ÷ßHÿD|žPŠ`Ô’?§»w’GÎðË«0‹¡Ã¤”ŧÈlýûƒÜÊÌêb¯"¾U÷1ý‹v—.,9 €Ö@/Zýã Ì«áRt»«BÔ;w•ß–pÇìY ‚ÀíúàÜžÝGíìΦb ƒGMÚWA¾ïË~ûD"e÷ÔT±€'”|ï¥Ê÷îͲɛµÍ† ê¦(ãeú9}DÝG Ôå%ººOÌQŒìÔîîÜÍmtñ•ìßs“Ù§™XÈŠe@×è±ù?ô•é# >~eöåAðx|@}Ù<›ÛÇ® ÉqJâ=ˆ¡¢ [¢ÑeúÄ`€›»ÛÐB-e*pÍ:u £“OÒª©€±««Ëj“„Nò½sÖá‹Ðd­”ÿE˜·uëŸÆ.Ë;)PªÊùŠúßBéÝÔqJ)¿šËUbt†¦¨S!nXŸ?ûɹûx“Äÿœú™J-¬ÿ\¡ýùüž×:ÏwZ hN=/Y=aøŒ/LÕ»oÞé® ø]Æ}oXEJû¯Ý;{:¼\5³ÂbõÍåàââž9Öåô¹øÕ“ÄÓ¾ˆ¬õ˜RnÙãrîbÇÁ€©£¶ŸÕ¢@ùnAüäså¿À š}œ8Õ¬If9†t« ~T Þê@.qHüsÅMgSG#éÖѾnl½Ã¬ »µ0¶ Äìú®†=äŸhFÖ—ÍúãÆï¸rRPtÀô3ë}›Î ZmÛäpßmæ@&„E+N„­ñο:H›X"³Q"š3Ûv$mB{ö\±Æh!Ih+ŽD†×GíY¿vüˆ3±—:+B›¤z-… []y”©àÆ ¾JŸ7;¶eI µ ´Ê¢Ot­1ƒ•n}ød­gRõé|=ØÙôcnÕöF}vÂ…€9‡&îñ駉[„\6ýﮯޕ+öQgƒ•Ä?WÜ`z§ÃÏ^¦&$$½{¹u†_ÓôèÑýÍéELcP#@”öD–ć™ÖwÒ¾5¡N¸‘ñ_«‹/¯ q#Ê)£tVÒ(sÅÕͯ}‘°c¶¨¾ºmô.­@Fg¯2Ó›ä<ÒC—õCBPó*1gøÄóðËœ ½:ÞJ"E.±˜@z ´0Õ‘,--YÚ¬%ó¹{´!ÀäêöXËEÑÊÐJbÊ×5 ‘¿Ï>ôjÍÑ‹¾ÆÚ8§Ñ Taƒ€7$þ¹ºòkJªi-ìÇÏ\÷¸SqjlrPÙf ;)”WTCÈçäòo™æ5©“GL7š³>Ô‰"ßUhÚX)¾ŒyßxN}Á Ý¿ª±iò‚¯ 0(z+ëäÛ‰ •i’®N.®C¬Ñ—ä|% M¥éœd92…®=ç?B•‹ü<ö}”6¥1At€:¡¤¥hhWn€’}T.Öwvussssww·¶°²6ê‰4|Vt/¼ð(+éT!g¡kçÖîG!Tñîøœ£ïþ<ëk¬Ó(kZºÛ4þ ùR%u9RIü£ÅMÚýýç×ñ…B!¯,¿D† Ô9ÍÆ~´£øíýS©õ¡0çƱ% MËiÜ©ýWSê‚›––Kztáñx|>ŸÇã‰e<ƒgçßZòöKµX"ˆÚ³‘ªinޅò?‚9vÕµz¾°úÓí9»rfíšFH¼{xæ”9åõ< ¿hãÊU]ìê°i€e|ÇçK1–IÄRÇ4«so?&ú ÖøÖM'[ö¥Ùã²Êë…BQÒµC RÆ8S=ü:òàÅ·?¦Gò^5_³øZj¥H$âÕduÚs3е4ëtdý %Ë®Jt !âíÅ£‘/¿"„ !wôÜ“‹vï7×”ñx|>ŸÏãñe€$ %ÇŽýZ'k¼¥,3¯Zc`O9RIü/à¯ÝbLˆ__Üæã4ØÒÊÒÞsÄÉÇYRãü«]ŠE2Œñ§‡'<›XX:¬>óúÆž@ûI±2Œ1æ/°èx$㺠–½LMÍša2Èb_Zƒ¼ø‚w—ƒœ­™XM]Q#"äî-R^Ùþ¥!–æ¦vî£/'5VCÆ»±{¾µ¹…¹ËÖsOÄr¯–†çƒ{03331111553353ó+7V>nšµéœÈ–m!¤‚ǧ7 ±6751õ=ûYN1ÆÒ-CzìNÿ.ãÍ»>¬ËøÍyBJ>\Ÿàëhieeï>ââ«B^&Æå×ëѳ÷¼»5MWŠw¸öuXÿc\ö᪱‰‰Y ôïí(ÀÜ¢7ƒ­,^æ‹äT]ÛßwévCâŸþ½®¡IùÒþ¯mÎè(PN^ŸV×6•…Ûè‹å|*­Ëi4xuDë¨UèÇm©Ë¹½*Çr¿—VÛR¾Ý¿ýkÛÔŸTBÂ@IDAT·É ×dë0†àýÃÝí#š¨aÀ’¹ÃÜt'í_9̘|/’øGo¦¾Ÿ0-Óè´?ZœÑÑ¡ï²ñ4ç ùîÔïË‘Ÿ‹:ÔÛ|«XË»tÔ–q/–¹j¶‰oB­îßþµmê‹ZWµãÝ’6”d ˜9P¡â×GS$æÓ‡“aS$þ7@F„ÿ qÑ+—qNß¼ÑSNH‚)nHü‡Tj-6b$= RÜ A‚Ä¿ Ù$H Å $HqC‚ ¤¸!A‚)nH AŠ$H Å $HqC‚ ¤¸!A‚)nH AŠ$H Å $HqC‚ ¤¸!A‚)nH AŠ$H Å $HqC‚ ¤¸!A‚)nH AŠ$H Å $þgð3ú;$ÆåIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/http_server_body.png0000644000000000000000000002174313051004444023030 00000000000000‰PNG  IHDR˜\ÜW4sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ9 «·° IDATxÚíwxeöÇ¿3s[nÍMï¤B(“PBU¤Kd˺þÖ¾ºØ–U׺•.‚R¤÷¢´P4ÒëMn¯3óûã&!p"x?Ï0ÌÜ3sÞó~ç¼gÞ™¡A@ ÜÎÐÄ@ !#"d@ !#"d@„Œ@ !#"d@„Œ@ ˆ"d@„Œ@ ˆ2@„Œpã8s—Ï4úõCU<óÉwÇ&Mý2Ýæùî¼nûIIIIn,ãoôPxÝÖyIIII÷/L³9³–LMJJJzxUËó_0z69))iÖÊ|iÙ[N[ÆFû0t· ™-íß÷'x=ÕÒþL8r6ÿ’þУ¼i˜Ïþ´ÇÜ÷±©±²[ë.ŠjzùÏv×Mh&áö2Wù¹ †öi‚7f¤•kzô ÎÒs™öÐÄ8õ­ò/­ê;ÿÅ1(¤4ò¹'(h‰RBß$wÝ„f"n_!,Ù©ùíÔo­4s•ÿ:ëËË΢³pÙ_Lr«î%èbÿØ`‡… ŒõÓò°X‹]ª¤oŽ»nB3ýÉAÀÙm.áv7q7!º±Ý¹ª³¿_±yÿ©Œ2 ‘úŒš9wR¿@IQŒ³âÌæe+7µzÉÔPÑ­2fÁ‚­Ý×Y°á•¿¼ºöt^ïÝ5.D¢»táìñ뎉ŽHðQ`ËúñÅ9 Ö§åU0¡ }ûôˆö£tΞ>±ûçöž)}‚¥@¹ ¶­Ü[«"°ý­/.ø%ž2 ÎÏ|áÄ™3‡6ö5:NE”àrQRKF¶ŽG;~tÿ„^}ûõŽQ£|ÿ{=ñÙÞÌ"‹6®¿ø•³àü™“‡7ÿš4(9VÍT‡€'V®a‚_uêçŸO¡î9abo-Ód——úFÇ÷NJÒ¯S¨VÚ©{âàÉ QA à«Ž|ôØÓ‹e—9ýºöíÙ5:PfÊþãÜ©ývzÝ7 XB¬™¿®>Pm$½ó/÷W)¢ºÄ…É-yYY§vn½ä;xpœšñÔù.‹Í»Ç¨‰ÉÑ*F°…°{Æ>Ð7ØÇ‚ñü†ŸŽUBÑmÜäD_æZ­›»mÅî"øÆž~÷íu9âð.]•\eIqá¥Ã›N*‡ŽW3Mº+Z.4åCÚ–½eÍár^ª©üå½…‘ƒFŽHî&7]:sæÔ¾Mgƒ‡wófZP™Ë\ýÜœ…¿^,²jb{öê×Á‡ªH?{æÄžM©Ì€a=üÄpžÅœyÛWî+á5QÂöÖ]…ÆuŽí6òÁ>Y?.3–«‡ŽïS¯É9kÿ»,ÍH'<ö;+(Ϭ4a">iho?ÏDÀóØð¤Ç¹uªlïÂÇŸ_}ºP‡à„þ}ã|íYûׯ»!O­»b«ñ¿ýʺ¿ cYvÔ‚£&ÞsšŽ¼<ŒeÙ)_œ»ºg<÷í#É,;ä¹]\ËbÃxài–eÙÁc˜³¨¶‰¸²-ó“Y–º¤ºjœyÑd–e‡<»³‚óÜJ“&<ÆÓØð°Ç ‚`»ð¿‰,˲Ó?9ZYsÂúÓ_?6Ômfî†RNàõ‡_βì}Ûgþª‡ëx =Ðꢉ#{óúKD}æ?9,¸:íd|ç<9(ÈÛŸÉ9Wæl×®Ï7÷ébä5º-ôèc½D@ùŽÏš«Ó%@ØÔgˆ¬Í~E÷ P~©ÐvÍZ‚ýÒòOöš@'<ûÏÉjÆh”¬Ã}Ï>ÝG þÜ[rWóòÖZhuüèi=4mt|«ê÷ÞŸYðêKÿzmF·Ú2¥ˆ7±#€ü“Ùæú–É›?¤Æ©´¶ßìy÷HÞÕ'ô‚ÇÎoæ\±#¦>ôд1 ZÎE=ú•§‡†V_ÇiM‰D(¿kii§ÚåþcŸ¸/¢6/DŒš•¬LJ5xü‹®ŠË¹6@Ý3òj>@+ãúÏŸ|ñÕsýTTËbƒ¢h €K`ŸPÓD´Oÿñ½D@Á®=yÎ:‘Ÿ³sW1 í7¡Ÿ–öÜJ“&ZNó±áy3Ÿýñ×R@œø謾Þ5'¬îñÐßð«ÓbêžÕ†ýëϯ6Ž«øÀÖ,@6`r¢¶½Ù[{®âc‡KtÙË»ÎoPšä·×nZ¿báøPœ%'ÏTè8Š ª—@Ó¾}‡Å°ädVÖérên}BêŽÄE*%A_là®5þ)>v¤@¶—]ßDï!Ñ Ž§êW«ZaåÆ+ï¾ñSFÝ?,Þ›œ–ªÒÂü¼¼¼¼B=# Tèë ¬ï˜UÝiênÃ:päeT¸¾^ôµ/›Ù:ŒOªAñƒ–ûûˆgen¥ a5ÇàÑ øÄHÄ ð®k~ ݥ˩€ŠŸ¿y¡þ¹pe /Ðsð­sŒ­°Ò#x[Þ5ËÖnÞu¦ØÙxtß } ÕÖ¯¬R2o)`×8@ì‘óÛ ßHßz~¥DR ×Jwy‡jX©õ,Æ£ÇÒH©<÷ÒˆK välx{Ά÷»ôKLp;0±³m®×ŠØP‡Ô?6JÓ{|¢ìè¡‚ûòŽŽ°goß] ¨“'$(©VXih¢ÅÞk.6<ïq®ªB=q£b¼C4€þê¥!êqV/¾rì§#º¤Q~4à*:¸5 ðM™¯¸ýïZrÖ* ©Jví®Ä;,re£".£ÐzNc½,ˆfè– ÊVÅFÃp¤”ÝÇ TîÛY°s_þ¬¨(.sëÞ2Àؘê©,­ˆÀŠøæcÃóÇxyˇÍhãnWjl mÉSú~úƉ‹ö?05°ðÀÖl Ã¸Ñ$í)¬Z{uiõœ%yúúž\v«ÕjµsD~Q¾x]aƒmÀ‹u.¾Q~â+>ùwô`/)4¶ß'ÃìyÇ3x@ÔãÁQ‘Ò:ëE犚Ú^_d¨‡¼­²ÒÀ;DÃxêüv‹¾Hßðìt:U Ši] {ÆÝ;æ//~´|Í)j |˲T£ÐV±¡è:6I äï6<ïq"mt„ Àå]gëÞ+Lg717Ê!U=ª²¶î:ºuKè“’ÜBYìÄÉ\þòí•«§pU©ßºË  ¿/Z Èb'= àÒÒ϶d×LnlW¶}þÍyˆœ4µ‹W Wª’°]¹Pæ®™Kc&N§KKþ½<­öî`/ØõÁÿ½úæ óÞÞSÎß  w×1œßºzÅŠÕ[ÏZ|á•v `8±çRÍ< Wű%¯¼ÿGD”@YF‰£Žàº-Ÿ,?Sc‡7œ^ùõïvÀoÔô^Õ7¬¼å<¨c;iEm²Øû‡ø™Û6o8TtW/iûlæbx½Øð¸ÇQªžSS¼ÇÑEKèª}è,9¸èÓýæ&Œ{ÅMdýðáÚBH¼Ç·½=ÛØú;(â.øû©y;»ø±Q+Bãb¼m¹çsªºãì7çt–¹·™òÆ‹Ͻ»ûÐûOý¥_÷(o¾"ûljF4ôù·gD·4ùuí¢ÆCî×ó=©ôúâ¿&MXðz΋omLûæÉñ¿Dw‹ðæÊ3NŸ+°>)/½4ÌŸ¾qb®âè÷Ÿ/-@èìÄa-JÆŸ3øÛW÷•­{ræ¥A}‚\…égÏæZ»ÎýßkA‹~ç´ãð»/¿58iÚ¼!q³' ËŸš´«[¯ÎA"]Æ©Ó9&À?eþŒ8YKœí.¡?µâ³EY˜Ö{D‚ö+M»«‰•aÕ;tœ>VXùìƒ{ã{u¢J.ž:_`dý{8Þó'í;ø©¹›çufÕßÇnŒèá+‡M—{>-×øß÷òüžr…¶MlHcî¸nUúÛtŸ\jC[Y¹NêYlxÞãäñ³»÷àû¿å¯aÒþè®ÑÞŽ¢Œ‹ù渙óV~•Æ×}Þ€$jÌø¨U‹²uN(†Lê£iwÏhßÈI;L|wågÏŽïíã*¸˜v¾TÕcøãï¯ùjn—Ú™G’ð1ÿZ¶bÁCCzùšÒïØy4ËØ'eÖ›+—-ÛAÚr›òO¼:½§¿†¬séņ¡ Jyþë5ï=6z@'¥!ýð¾ýGþ¨ÒƧ<²àÛe¯·…‰u²6éÕ%oNíg>»ûžÓ¥ò¾yë»OfLJzf>*CÅ©½G³Í.§Õ @ìÓmö'K^º?ÔøÇÁ]O{uì3rÞ'ß¼>¼^6ï‰ó¯wXmr?²Iw5ãCQÄŒO¿~yL¸õâ¡Ý¿/à|b“f½ýݱ-ª¹P²Ø‡>üáý§'±UU'íßwèTŽÕ'aø# ¾ýî¶vFWņ$räÈ·Ï&ÜÐpTÕÖØÔÅÇãØð¸Ç‰CǾóÝ{¤ôˆÖš³ÒŽŸ-u™üòןÌìà€³¹ê)™(lؤ® <©‡’jo:JÈøwÎŒ¯fÌýmÒÊo¦Ý´~yÝöùãÞ>Îϯ_<ÖŸ¼ÐóvÃvá‹Y¯*™¹tÙ¼Ž’vwx$ îFøŠs'J•ºøŠˆ/žàÈ^ûÞªbP]§‹’´Ç$Bv÷!˜O¿ô¢ß¨ eƵe©ËÞù:šüÔðöv»²fèKÚ鮃Rô~qÃÁv8xÉÜðݯW<˜9BÉ;Ÿ=*\|›·Cû?_gîƾÜyêøé|;€Èé¯Ïí¦ Ú§3‰ÚË…ßž³}ÅÚ³žl*aûO¿í…ì68_Þråø¡ÓÅ´&¢WÒ”§Ÿz ¶½Ê)ö„;R##DÈ@ !#DÈá6‡L¿¸C±Ùðûï8zgÏâòe@.ÇÞ½ #¾!!#´?òóqø0NœÀ… ÈÎFq1ŒF8½?'4¿þŠyóˆÃDÈ·§iiøí7œ9ƒôtä磼f3<œ Š¬,âE2ÂM$3?ü€sç•…ÂBèõ°Ûoè-df¿ˆn"¯¿Ž•+[¹¯XŒ°0B©„H‡z=RSKüz+9º?þ€Á€AÄm yD©]b¬Bßý-5„…Á×^^`µ¢¢yy‰èhÄÄ &¦z9<4¹O}+غ /<‹ô2HiØyÄ…cñDΈݹXLxj Öí„CƒÏVP€¯7º&@.‡Ë£%%(.F``µTÕý[«%¾¼õð/Ä?@®bDH £áç@¾ƒÈ²;—Þ18•….^PÓ8j†–@Á%ÀÁÃ%€¦À òÅŒYH‰èhDFB"!nkwT•ás°q'ô„H&¤Á›#ĸ`G‘ ºrh}‰ÃˆÝYìØ„çŸÅùlˆ8\ƒ8¼èêž`ã‘ï@‘jÌ™ƒ—Þ†—œ¸­±á,\€´+Q“ PÜpÖ¹LÿîØs:¦NÀgKI !»S›¥ÎÕ›¡¤jØ8¥.9aáÑ»Þú/†ÝOÜv+)ÈÆ+Åöý¨°Ã_„P ÔÞ¥êaÿI8\xü¼ñ_"aDÈîhBBPTtUÔ´2ÄÈ¡r6±¥…G‘ÅNx‰ÁöÅk ‘˜DüwS‡oÿ6"W9` Dhüá­ÈžÈÒãÈyjñä|<÷O0d²;ž‰ñóÏÕËÝ»C«@ú0ZÐÉJs£j  Ò…RÊœPH0°/^z ‡GþiúUŽ_ÃÚŸ­ƒ˜B bÈÝÖøAÔtä” ÞXˆ!£ˆóþ ÈÍøvÉ´iW—+*@ËP¬ÇßÁËÇÌHL24ø~µV„Î2 T!’Á©ãšÉݱz)xžx´m8³G#JƒÀ|´v#zÉ‘¨@i=‰Ùö0lËÅÞS9 ¹y8pŠ¨ÉÈî2l6(WH¡@y9d2¨Òá½X¹Eˆô…/™ M¾J]Ï¡Ü…r'8 *Çã™WÓ‰x·e˜Xü.Öÿ„‹9¨r@ÍÀO?QùE!¼Š8yF+õÇ ÿ$âE„ìî&8ÅÅÕË;bÉ \oƒ3©øèlÛJ"}á ÈìM+š•G… :ª8(ň‹Â¨ûðøs&o¸v+Ö,ÆÚ•8óJÌQЊà#‚ƒ&?<Ò 1N¦£´ ÝcñðlÌû;¤äk{DÈ&à—_ª—{öÄ„ xýõ¦·L=‚ÿƒûPiD˜ARˆŒ5ÕßÀÀU+šƒB„Ax/fÌEÒð»ÝáåÅXñ%6oÀÅ ”Z@QÐ2Њ ešH¾HdèŒBÎg£L¸HLŸ†g^‚RM‚—¡†5k®VÊBBЩöîm°IUUUNNÏó2™,::Z–y_~Œí;S %¼!5AÂ5ýû`ä ¯ùà ðS &Iƒ0i&úÜ{ç{¸´k¾Æî¸x %z]QÐ0ðÁûâÀ/”Ù¥¸p^]1e*þòW¨½oðpxžÏÍÍÕét|||:tè@QéDÈns¬V(•M—ɽ^Ÿ““ãr¹êî!•J###•J%*+ðÕÇظiÁ ÷¿"˜k·µC€ƒƒ‘ƒ‘ƒh¤öC—ÎHNÁćq{ûÓaÃï;±qRáJ*,0»àECÅÔü¡›6Pi¡G‘—òPR… -îIÄÌG0vJ›ÏóYYYƒ¡ng¤(ŠÈ²;‚e²o¾Ar2ÏóiiiÇ]k'†a‚ƒƒ«ÿ}h7~ø!³r B´ð•‚1AälδS€‰ƒ‰‡™ƒ‘‡…‡‚Ÿ"Ñ£zôAdtîà Úßo] ÒO"# Ùàôd Ô½JJ*J ¦¹›öÚ ˆýQd@v!Š*¡’¡W7<03ƒ¯[©ÅbÉÉɱZ­×ìŸåïïNz²Û–ñã±aCõr˜8Ñ]&KMMu_¥›i;Š¢¼½½#""D¢š‰—NvlÂ/kqì8.炤A  rU › ^€‘‡žƒÞ#[£ùj)4 Dl нÃm@ۻŠCq.Jó‘ŸÓ'‘~ W P\‰* ¬®ú^ Ô 4 Ô Íj®Lï0ñ(¬D~)ÊðS£{ i³ÝÆãÚÒÒÂÂÂf.HR©T$™Íf±Xœ@z²Û–Õ«1}zã2Çqyyyîb EQ|³ÓÄÄbqPPP@@#A9}Öâ·C¸p E:ÈDÐÀ_9^ÆÙ‚ã33sSJ÷§/ d  ¡dªS-IKFa?ˆ}aÊõÈ/C‰"ƒÑ³†Ǹ©m˜yÕMÁrss-K3ýÎËË €Íf‰Daaa>>>¤+!»ƒÊdJ%ÊË!•V«‡ ”——ó>>ÁÁÁ ÃO¶!äínížÄDlÚT½¬Tbÿþ ™J¥r[ÜŠf2™Ü"EQTóŽãŒF£ÑhÌÎΦiZ"‘¨T*÷Å~ŽWIDAT䀻 žçËËË«ªª¬V+ÇqžˆMÓ^^^<Ï;«Õ*‘H´ZmPP„|`ddw)+V`æÌêåÐPtîÜ|™Ì“„¢¤¤D¯×;Nš¦Ý÷:=LÓj{©D"‘Ëå>>>jµúÎË×ìv{EE…Á`°Ûí*Š¢d2MÓN§ÓétºÇ’>>>¤„O„쮧q™L§k“/'ñ<_VVVYYiµZyžg†¦é–Šš»»¥ÍËËK­V{{{ßFã&AÌfsUU•Åb±ÙlÇñ-y%EQR©”a—Ëåt:yž‹ÅJ¥ÒÏÏïϪ3ˆÝ®¢´´z9&ß}–m[ 6›­¬¬Ìh4Úív÷ [·yXj²‡3 #‰¤R©\.W*•2™ì¬xž·Z­6›Íh4Úl6‡ÃáNµZqv4MK¥R÷ØÜét ‚ ‰är¹V«õññ!É×-ÔÈnú÷¯W&Û·¯Í…L&“Õ>™ìp8***ôz½{~€;árßúl¾¬Ö Óq¹\.—Ëf³éõúkåq"‘È-vî¼F$Õ®¬MëÜkÜËÇÕ&Œ<Ï;N÷—Ëåþ§Ýnw:.—«Õ:u­´Ë®ºÓ.›Í&‹ÝâEn†ŒŒàË—cÖ,ÄÇ#2gÏ¢wï«Ÿ&ùóG^ƒA¯×›L&wS«kn)ié8ô¶@,»¥Ó­’îÁ&Ã02™L¥RiµÚ»ðŽ2 c±@¡€Fƒ¤$ Œ©SvkÞR-‚Ñh4 f³Ù=ʲ1 ã¾êNÄnu£(J$‰ÅâÚ|Ó­\îÉwb±ØËËK¡Ph4¢\DÈm¤eR)Ú_Ýår £ÑhµZÝÒÖxš¦)Šr¿xžçoîWÜ"ëVa÷4ºÆ1OQ”X,–Édr¹\­V+•J2Z$BF Àý¡Ãáp:nsϽÖcítܣ׺i`ƒ-k×På&÷ðZ?îμD"‘D"‘ÉdR©TR™˜J„Œ@håøÔ]ž¯­ÓsW«tuKõ×ý)÷ÝU÷ðP"‘¸ÿv¯©ý›H2@¸ s^2@ BF DÈ2@ BF DÈ@ BF ·5ÿÂŽH5’Eæ!IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/client_body.png0000644000000000000000000004330313051004444021735 00000000000000‰PNG  IHDR |õ’ÒõsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 5D\Ö] IDATxÚì}w|TEÛö5gûf7ÙM'…B¨¡÷"]¤‰AšRT: XèQQA•&Eªô&½÷–ÐBz6Ûë9çþþØM%øˆŸ>ïó>ï^?Êî9³sî™3÷Ì]gÁ?üx œ¿ üðÃÏ~øáç ?üðó†~øyÃ?ü¼á‡~ÞðÃ?oøᇟ7üðÃÏ~øáç ?üðó†~øáç ?üðó†~øyÃ?ü¼á‡~ÞðÃ?oøᇟ7üðã¿Š7ŠrËéñOD%/þG7ú?ˆTïãKäýàûöÔÉüeª)úäßàç Æ@ïq[-V7ÏŒ1"èv;­v'/ˆDDŒý©Y†ÛèßâÛí´Ú‚ ‚’T*$ï@c $Š¼Åbq¹E‚ౚMF‹ƒ¼ýÈž¶:FDÄÛMf›H "^p[MF‹Ý-ˆ¢ŸCþÙuƒwÏî¥ï€íÒD0x9Ñ©Í_ zóÓ[F‘1ƨœ™¬Ì"b1ðóëwùÂaP8oRÙ…ª Sy9ëI‹•Y!|c ŽC›?yyüGi9.0Vø$*Ym²½M$£Â[.]¦ô¢ÜÚ‰À\™§û÷ë¿ú@€S[— éûBïqˉyÇyù]÷„õ’ÊØ¥šw—å­G7,ÔëÙ×æo3ÙEo?NûŸé?^¨þ+¹î©× oGð¦`Ì[+.Ì ŠÏ‹L"/IáÛeeÉ.ü̘—œ²ÏòµJÓè½î+ÎJQî-[‚h G‡˜°ìܲ[ßæå“{°’ÄõKÙ^,\( ÉôÝ"ÁÍ `pçæî\½%©Ëð·‡·Ö*9oƒŠ&„âF”êÏ'öÀ*ü•î¤MàÊö±Âa0¸ów¬ûùÔ­NP½Iû®më)91—éáÖu뮤›™L]«EçîÏÔ6ì]>oËa&1/X¶ºÛs2öþt5¨ãkÏUWH‹;Ÿ#ÓOË—K’^¨â8¶ïìmÔM;>ÿLýDŽpܱ~÷©Û"'ªÚ W÷NÆ«_}»£ÃÄ)5Õmù‡6­¾¥¬Ñ·k› ¥„<9K|]gÌ[r)“+¤éç÷í¾z:3Ï™Ðô¹ÝšH<¼thóo¿ØÜê°¤ÞúTÒË`¸òý¯çZ5©²o󎬘¾ï ¬I®‚;¶»|ÏEªzí»÷hž "Æ(7õì¦_÷emP†uèݯYR˜÷zæ­Ó¿îØŸmr2™¶Ùs}Û¥Ä0@°åîÚ¸îtjž&4¾cëJr¹TÈMÝ¿â·óÍ¡WÝR¿F s™îØxôâ=7É*×oÓç¹æüÃK¿oÙu$Ïî‘ÅtéýbÝŠA¹ŒéÛ7n¸fˆ¬Ýq`¬À1Æ»m¿üðŠC•v~ïñZ± dR©1ƒ`?¹gËþS7삼~‡Þ=Z$3@¸qü·íÏÚÜ¢:,¡û‹/T URÞ…o·]ïвú©CGîd4Ñõôë˜yrûÎ#—Üêè^/ª,ó-Ë~;@‰>X+)Ácj­"Aä|8öõ•gÌu6¨^9äПÌûñ”ÍÍß¾7ñ×4e½õjÅ®ÿìíwVž‘ÆÔŠÖºD™>¹v­P—ýèAºÁ^J§Àì¿Þûå']2ÔoÔ06Àòݧ‹OÞ11¸œ=uþÚSUjÕ­S³rÆÉõÓ?Ygáùý{~ÞrÌÀdÈÚ¸ví÷{Ž=*°pÝÛ´ä—t2ÆÉ];¹çbZx|õZUƒ6øö§{Ò\>ðÓŒV#86¥N û¹éÞ:mÄŒ“û×¼=sµ‘˜«%·aùœ?í½_£~ƒjº ³&Íßz1vÿòÎ ÞàTÕ®×°ª.}ö¸©GrÝŒ1Ãc‹/3ÊÂk¥¤$F«¿šþÊ‚-ã–ï¬8ú rµÚIƒ¶¯üÚÊK%êÀ¨„¤@¥$ ,±Nr´(8¾›7ñ“UG¢k5lX3rß÷‹|·S˺zhÖ‡K š„zõëlj×Æ q4Í*8M+ÍÚxðvb½Æ1­Ùkn©äŒ“Hã’«HXPD\R¥p™”óõ(c ¶ßV~òÅÖˉÕkV­°í³‰³Vœprë7ïµ- BBí”­íòŒ‰Óg‚ '~[6íÓê˜äº)5®ïütÒÛžºcoÔ¼aÁÅ=sfcW:ö¯˜D!wÌùòRiQ¸,ùh4P¦`›?ûùºçÛŸÆ×V¤!ÖßïX½ZpÞñßo5^±îùê R궣t±Á­R*ìºбqJ‰}ÆÍéÅ)d\ñ"Î@¢T©õ\Hîu2‰­jð¥óÞLËkæ¹´bÿù~ïüدMÀÕ¬¨ž:cÕõ>j_1õà~´ïeÈ~h‰ª¦ ËÏÈCíÕu›ÃŸPüM^ä´Á;wjZ#^Âmûªm秴po[·>¾Õ«Ã‡tQKÀ;Û¤îûÓ×GŽ ”;Í!]_|© •”¥_ؾñ|æÀß÷o qðÝŽï-Ùm±>4ñÕÉÓk7l¬W1 [ê¦äµìS)ýövÍÀÔSBô4¨ßTf»vô··zŽ×÷™š Jgï:ý InÖøÈ:&Y ¿LåzDž—vê7¸aåHoK¤¸zà—­9N© û~ÏŠŠ¬\A "0®Rdeµ°ÿ¾ÑV-"¶i£èïÇô7wïЮ}ÇzÕjʹb©×+Ñ+ÕeôKŸˆ.¸‚cÊ$dJ¥ZÍ ¢çâÕ ÉkÖ‰ñšBÃ+GjíçrÜ}[D½rð¨Eì•ó(;,¼YñR^NK„þ¸ÛÜqB@ BÂ+†‡K8œ>*P¼l*ȱßK·¨¢®oßâæH Qpñ¦ÌN±µ[Ò2!\-ã8PÖÃ;v§+ýî±-™vd¢=X[pä@zWˆÉLýâýI™F;¤’GµÆhP©V­°Ÿ7LŸ0¾m»ví;>[½f×/åå‹šØÈ c‹«RU)÷ª& Œ©,©vò¦åKü*ÓÃ8gú=^È‹T±z]eÆÊ™#'vëܾK—6õšÔÑ£»w-”Ü8ÒÛkŸŸvÒP¤ »¬H1¸÷ +Ç¥—pœ(RÓ^šõfÎìOÍ¡n•#”r‰„H ¯~¦àªÕÓÄ£Ž¬©“K‰œR¤bñzïÀþûdª¿¦o(JªÕkؾ^bqEYgwfº˜]¢L¢p¾¯I$œÓÉ‹DÒ׿øµêŠ¾ûuãÞ5K)ªÙüÞn’ö˜Ž]J-dbR)WZ´»y@©..©\*Ž¤; ËW¦8³²®èR†×Ö%— ^NÚ\PÍ­S °à˜”1®ÄÛ$^y^¼rüÀà Ǽ—$RY•HÇEÈ• È#ð£áð†å' &®ã¶âú™oO\ýÌàázÖÕ+zã`*8ÚøF~þåò¯ïÛ²rãw µU»~µd:/<Éd1HäRVF¶epÛrßÜï¼¼ö°ýjW¾ÿýÌÙ·°¤–«¶ýôõ‡Ÿn_µxéœéÕ{OYôv_ÑãàI¡Vø~­T”ë·)²;¸ž')Çq8F`À»E©T")²<¨œ‡wxÆç}¡œ—8&áJ½Ÿ2ÿoëâ^Ôª‚(ŠI‘ró““G Œ«Ã¬’Ap¬bû!oµ—!õÃi“gÏù~í²7}ÊýŸð†”œ™¢èµ(Z F ·Çf²K«¨8u{.xÎîÛ÷®ÜIy3!9=ž¶žÞ¯pHµuêÆû,—ô˜ùW«’¨/›ûr«”RÏ5Jh?Zµ.$>iÖÚ•uK([p|±íH­^/͘<< ìbàtXDMÅQ3rî]^0uÜÄ)Ñ ‡Ä(ÈîðˆÞ®´y·XƺaË;þ÷ê¦/ûÆÀ#‰ ·Ý,(«NœÿõDPöõC_šþ]ãúÃC¤dÍ7¸)‹“²ò ð>cIH€Z!Z¬.ÞÛ÷vCFj¦I£Ð)\f»Û7û01ËdS‡‡jd"•±Aûýex7Z¼ÐAŸ—ºvÇ)ƒÉRqgßá#êä6I¡z²\_0sΑë÷ F·T¨Ð¨”10NêväÝ1;{êåÓgîä "=V1+3/ñ¾b³FUõØôóæ,ƒÑ”ŸutÿoyªÄ†•c´îQcÇú5×,1)2}ÍÄÉÕ{ODt¢ÌÞ[d¥WVˆnX7vφ­gn>,(0Ü»vfÑ‚ößq¡ÄrÅ‹NJ ug­ûb[¶ÁhÈÍ<úËgs¿Û'Êä•1';3Ïš÷èö®UËîH”ŽŒtÀ•zæ·%_|sþvºÁhä”Ú`V®Dx¥¨x­ãàáÓsò³ÞÚ¶m§ 2Vzö•HÕƳ²ìõ“;ff;-Öì|㥣›fø}jF®Ñh‘‡DIäÄx>¡‚Âtô—ßr Œé·Ï®8ž+{œ7nÞ}èr:€ŠÕª&‡ÓŽßÝy”ý(mÅ‚Iãf¯HªÖ°FÄïûݸŸm2æ_9±çøC[½æ]däÿOú ŸnÝðYÿx—Ùdry„"Çy\v“Åãq Hê3ï-DzM_Nü…ÐEW›8i`x ”sÅÔ‰“,ûàŽ@ ih¨¡}5bªµ ´½=uÊ‚)¯÷»°tÎÁ c~³­’ù$cÈj1YlnßÛy»Õìp8 m4}Æ[߬Z7uÂVŽƒ\9xÌkµâ‚Tið\Þ¢†gGEÊy­êjç¦ÓŸ~]ÕÛ·Ón2ó‚èk”Ûa6™€®ûÐ æï¿ÿ|Î4Ž“œ¼b¦‘Z)Õbqy]7 º¸”‰c†®Þ¸fÒøõH®Ò·îÓŽ“ªÛõ|áÌ¢¥o¿62ªb\Ý–=' ËŸøù'Ÿ&xµ®!Ý{|ñìiÄIDHô[ÒG¡W|eÀ'KšxhcpDl£ÚIœç’ÕáD«ÙÄ<êÚ{ÖY=cäɸظê͆¼6ìÎäO¦OyèÄAzÓ’w§”r QŒíûFÿ&Udqè+}¿ù~Ñè!Q•ëvî¿rÖ7A%ðV³Ùáöx™có{c¶7œsøƒ>,¬Æð1£¾XºfÆäíŒÄÀèêófWö1ÁøÝêÞ &Uw>uÀsqȺd±˜Ý¼¯¿ÜN›Å"ñ~]v“ÉTèÕúo«Ø_ðhÚM†{÷3Â+UѪ}ŽVFÆœGé&ª£–s ”}ÿvzŽ 2UtÅøÈ`‡x[ê´«“Iåa1•+†i ÞvëzG_©¢+çn<ºZL„+¹ ¹SoÝâQU+êÁ˜è¶>xðP®‹©ªe€)ûþÝô\žIC"c*V•0"€œ–k7c+W PpÿVj._£~²oÈ}”Y@•âcÕ  2®¦[CjWà²ä¥Ý{hsñ2µ®rb¢VÎà)¸•š©ŠѪ9Ÿ¸.æeÜ}˜eà! ­_)J"ùÜô´9&y`xµ¤xfÏ¿zë¾R_¡j|‡9ïÞý‡6ÏÉÔÑñ‰A ˜à~t?-Ë`‘„$%DÝ»u;¨BR”i7oK"+Ç©ckÞ­;÷$‹ŽOŒ V?¼u%ÛLIõjËMwîg9yAª ŒOLÒ)A\éiw²mD¥ä÷Ùë¦)Õ$.냴{êÈØÈ J¿|Π«Jƨ ëÁƒŒ\dâ£C¼³œ­ ûÞƒGè#bd܆©Ù᱕tJF¢!ûA¶‰Uãå€'÷ÁÕ,K•äjÙ¡¾ñ´¼QÚ/ë]GJ¹NË:n UÂãîÕ'ø\KùYKÔG¥=ñåýš¼Q-E2S¡¸”ï»Ü¯¥K–Óڢȑ?ÛŒÇÛRIåk×X"ò«ìýä K”,QcQ@éú _}¼JGüñKÿ¿¹nøá‡_÷Ã?o<•PõsÞÜúçP&‘„ž¯úÿQ?=þ¬ÒrË?Ó®²USQLããäøÿÿyÞ( Ð.ëA<ïq»=‚ày}a›ÿÆWU2äÖgª‡ÿ¦àPƉ‚Çíˆ Ûç5×Ø=žþ±0"FämÏ»±PÝ`Œ‰‚ÇÃóDŒ‘àñxDñ¿3 öoŽ~Æ®žØùñûSG¼2âµ×G3iñÊ_³ ìE!Ëå,&ô„)ù±I¯DfF©U Ä4]ÂåM±æÝ>}ðAŽ1°[Ë{™öÐR~\y«•™œË\ÌK;3wú»'sÞ.9®ÿlæÂÕ÷ \`Oz•YUÊÉÈ{r'ø¢Ø˸sö½ñ#?ÿù€ÅQÈ‚íâoK¯Úå·è+¯ºa*ÙaO|ÜsªÅÿzô‹kœþyÁø|hô0or`v"zÜÈç»õؤçê|<áÃ[I©ô0oºˆÝ½måÚ ³±]fM®fesŠ3 ʦ@EïäìKþ(YÀnÌXÏ8Žìyëç þÞj3“Ýý}KÿîÝ<°rgºiö/.ÞzƘuké¬ÑCæþ¢T©T¹ R}H„N«‘ä^¹vG›Á–¹üýÃfý`"¹éæ±·‡uùpËUŽ|ÞÅóûŽ|éƒ-·«Õª‘yzÕˆ>¯^ç…#»÷]Ê*r™—j=Çñ™{^ñq½Q‹ÇvKñz<9Ž³^þ¹QË[/¦KEóêÙÃ_›÷“Ñ)c»qÉÄîÓ¿ÙáJ®l[Úú¹1÷Ü#>ûÆ®…3g|øÙZ]åÖ›[ú4í~ÊÆ8Ÿë¤8Ü‹‰BÖ¹MgÙ°õËíkkWo}ãüŒñ4êõŸ…èýϵ}é;í}p=Óã½&Š¾Þÿ‡çUOéðÛ]Þ{q÷ï4ë4þV–…Hü`\Û®½_¿ï½qî›mž?y×è2\ïÑ©Ù¤9ß DD”³îµªm'ÛˆÒö}Õ¢MŸƒ7-Þâ›ÞëQ·ï"Ç®…Ã{ŽZí""ï¬íÒvÀi¥]ÜЫÛðÓ· ˆˆ.ÌKnòâ-ƒ'õØÆví{þz:Ã[ÃÅeCk´™MDæ óG¶ê:s­…'"â³Nwnßzñ¶\"2ò gQ‹¼¸fK×Ö–íÞÞ§i­—¦.#"DQôvˆmjï&}flò–t\Ùع}··²D¢›?mÚyÔ-›÷ŽsöÐÖ&m'rì_عA 'ó¼×z¶éˆ9ÛïkÓòáÈž¯¾½”'J?½¡SË®¿=4¹ »¿6hÊ—F‘(cC³–í·œ5ä§èÙ±ëÚ›"‘éRïŽ-ßùá’èÌŸ;´ÝØÅ{¼5º/­jR¿é¶«¦¯Ò?ÂÓû7Hx^ª”r®”П¾këä„Æñï]¡VˆûzšÅê-ש¢÷SŒNB¢ÅÃÄÉT{« ªÎ9Ì&¢«g®©ÃÔùy÷N8~òôyI|ñÔ‡ÍâÅ3ªÖŒÕÉY‹Û÷ýØ@îqØœ .·³™bÖÃ[±•cªUðjJ5û ŽÌ?¿;àÈÎ…vn§”€‡“Ie2ÑV P¢×(Ó€8•†_óéWš[oîÛs-cŒÀ@–;7ÓŒ‘µâ.ž>qüÄ©;‚RgËÝ›Z¸vl¼”wý‰ãÇÏ^¸ªÒV4üþC&¤S%V®V7ÄKTL­>3÷"äæäæåæä\<0gþ•c7³«´z.{xLbÅûæuçžðJmhr• Ü¥{¤ž>™çíÒ½–Ýz÷ü5[P¸üÂé“ÇŸº. ³YŽ\½éü«Âߪoxc&Sëƒ]î9ì ˆðîÁQ8žrm¤©Š‚ Ôr©Tê´¹Dß®2u‘bÏJn) Uú>Š` Œ`qñ‹åòɃw'@@¿áÝd»ÁÅ”Ri¡vî3m>.%àt9%…Zå#$j¹=Ç hNÂʘ_YY;u !—ÍÝaò§SŸKúiÞÄ93ßúhV£Ê!DÞlÔ¶[G§»]"ÀX­N¢ÂÜ9væ.ÈùýðA<ÄÔ|!NÃyH¤RE€¬ð‰Ajæâ¦Ü+sǼoÔj­Vý›¿Õ :ôòÚE7s<¿-œ²Ã)‘Óý ›ñà/ãÚèˇ˜Lغaâ×Oä£ÃÉû‚Û¿Ú8Œ¹³]È»yòPçˆ1ÖrðKQ1:ä·úþͼ˜$..!бíÐå´”¸ºEq5ž‚ß,]_÷¥!•B%æ,«è›3»N—Z¯’°¢±ÿ¯\l^¶ Ó*µQ•†Œ#®Ä[䙿P¦ÃUX=Ò.“&Ôæ¸RaTÞ§ t;˜@0Lâ¸opU }<…ƒ7•;Ä»¥ÉuÅ £ß|8}üG –|úñ´˜@™D$·Åw;¦^™ñUÂUoò„7J]öØ. n§ÓlÔ0ÏC‹ ÕkU‘zôv*.§2R«…ýâgkS»¼2¾]¢ÆÉ‹×áÙæK¦.ZyÞ8¾^yƒZ¢ªÞ¨µê趻çvì¿Æ¿<·.“HÂ#CÕõžóJeɲ¢Hç猿W'#‰MÚön¿ñÃ) ÖóZ=yÃÍ“_Û|Õ –¶ÒŽ¿raÍø›ç÷[âÚ%èõ¥gç2ÆÜR×½{É$µhd¸xùìé{Þ‹G¿ÜÚF©.¤aÛ§÷ŸIËÀ˜ùØgCÞXdQI‘[ •Ré{cLÂET®.>¸zëÒ5/Óü?iT½Ò»æï¶ü0±¾b…2k›g_üdãÜoO½œHv›ÝAÞ>4ù2+$úÊ5+ý°lMãq+T )µ=_}óÂ̹/vÛ®‘>Ê6$µ^?A¿êO‡&<…ZVV«l IDAT$‹{E›©Àls™B­ÓéRF ÁqÌjÌ3ší$•‡(eD"ÀŒy.N¢Þú(Û¢ WI„¬œ<¥&T¯•†ôñ3Æ?Ã~üå%š1"N–Ô|`?{"àÝ'Õß-ÿE2J¥n¢´¸QVù³ÚËSÿ´¬8‚Ò‘¿åÙaÿ^””wð§‰/ÕKø‡ÓH‹¥ß=ì_4þY]üIÁ«p3Æžâ\ QdçýPÎÔÿ¤ ö-ᔢ?0O—”×ÿÄïˆDòï àûsŒQ:sûßĨ”ÂïÇ¿Æ_ÉßðÚ3W-|«kǶ­Z?Ó{èÄm'ÓãXÑ6ö²BŽ;¼¬çW`Oku÷F1ÁY°öÓi];´nÚü™>Ãß<|'ïi³¬ˆQq°_9IO >{ט”.³ù?E<+Ò+ûWªÒß'Æ™ïî{uèˆßÎ>xʙǧ͉õÆ@3v÷÷u½Ÿ}~íUO—GN÷Z›Dé§cûŒ]´1Ïý“QÙ|¡â«"ïry%÷Ä(ç'*•ÝT(5=:½áÅNm–Ÿ´öúÆ›“Ç´ªè˜Ð£ã˜O7 å/_TîùPÌ'ü§|mÇ4ò¥8ç\ ü¢Çéö°ÒĬó„E™Ê¿C¥Î3{ÂQVD„ò³ÄÊ‘èq{H$”Oäãχ?ÖêéuqòiŽ´c}ú¦ã„u3¦9¼ØµÓÆ)ÓVŸx¦N—:•‡)+ÇàÀ…V$õíâí)ÈË3Zì"8U@Ph˜N^´C+oÊz˜Ï  ÑpŒ‘à1òLV'$JuXh¨R&ñÉ>1¸3Þ›1›%ÛüÍ8•—ž½{¤¼?ð³÷÷êØ1NãqZró ܼ(Š¢B£ ÑË$ Þž“g”+”n§Ó-ßap‘kÞàÖ/L]ë!"r¬øàÍÑ3—Û:¸¤gÖ½7_Î!"þæ¶Îmš}½ûžà2¾3¨Ý+ ¶zëMß¿¨qóç/ä8‹SD"¢½cÛÖ~ñc*A(Ñ"Ü:ùkçö]ØwÛû}߇}S:NÈ'"ó…¯·é4îë‘5õ`‡Ö­¾:è Ûé!Ýúþ–šKDn‡yÚÐ}†Ï¼g'"ržYÒ¨~›5¼­â·,Ѧç¤+Y|ÖŽQIífòD›ùÎõë9ÖÉ"Yקá+ 7Y‰ˆèÁöyM:ô9“I—¶ÙîÙ{o½Ùæì:dzº£8 †Hä-9ß¿õÂ+ï­²ÑÁoõ¼ €èöñ5‹–ÿêô–2z¶FõÏo]Ùÿc×nƒ¶_È!"2Þ3°ï/Ú3Ž¾Ñ»ÑÐÙ+ "¢+?NmÚyÀ¥ºðëçzŒ<’æ­ÛµfÎËýÇ,0ŠþäŽbwá´ÅÃñ‚eåZ5tgWnÆñ?N¥i·‘9*ÏàËKÔ‰Õ*+ήß)JäR©\b¾¶jõv›‡4ú¨”ºuSRê¤Ôª¢–A^i`ßN1{Þî½çV‡çÝï2þ2³ÿw—¬Q:EX\²óðöé4"pqÃ÷ÆØ]ÂáÜ7‚‹÷x± “´ïRÝ™v÷Ì}#‘-íþ».9NZÔ}¢ÇeÈ͵9ÜÅÿëC“X³ZÁ‰#éÙyw;l·woA\•‘ÁqI)))))u«'UPk‚ÔPŸ?yÍăqÜ©Ÿß¯^­õ)1D¦É½§NŸÚðù]·\pºitBUÇå3÷RzDç½Þ¢Îðù?I5*V–?H„&±VrΡƒÙfN"ᘘuãжÝçˆ+sª¹Ýxg±€JãfÌvÏzç­±£ÃÂBu¹1'ÓBÁÌkXQW·ËeW½=s~u+-—k?¯8¹fõîÈI½Z ~íco9üSQ ó™óY¯¾ûE˜Œ]+Gç ½ãdê¡#^?ë“ѦUB%×N-ïÐ}WÚÑB6vîÏ[ãgì­–qVCÆ#W䂯?i¡4µúmõ—羚Ïgß:~®`ܬùA…\Pú0pF$BPQöý‚.<Óë½aÍ‹}#yóIoõ¸óÁÄQ‡[4Ušïý~1§ï„U"%¹…¾æ‚Ô‹ï¾5¿Ù¸Yž©Uh§òNÀe> à=|ͶÝ;ï;3kú[-Õ²?ºqæš½ïä‘ oÃ|ÎHI`dۡ㎼ûñØqgcT– çS²ò™PNèTuîæµ\Á]ËݳB•þm^?·jÞþä)m›µíÚèÈÂYSÔ®jL;/²Å¼×p{˺bxžoоç³ûg¾3er“†µQðàÜå;_˜Ôýßã’ü_É{ï½÷”®?FDLܼS¯úñA±€ÀàšÍŸ›µÍç¥gè#Z4ªaÏyd—„½0fúà–q"ä•j·ŠW™ï<ÈKî8bÒ€æ5c N[HL•¤Ø˜FmZÅ)ùì|sxõ6ÓLIT‚÷¸‚"¹Fp—‡UÐ5¨_[ܼSû™ýaf§~qÔÔ—:Öb¾À?_x]h)£Üžt†CÉ»úP8† Ä÷¤ÂòPŸô¤xªÇ‰ü£8¼À•Íå( C*+‡{]Ñ>zEWΉer?P*W¤\ÚÊd—Z¼þ°‹Jˆ¢X&ôæé ðsÆÿo Ü8ÜÇFN©*r©—­XÎ/glê•32ÊÃEÙàÞÒÕ¡Ô;ÅeŠ¶/ùƒáRc®Dn‘xXB¦*ÝÀ²ÙTeZU†2ƒÿ±ç“OÓ'”MÀ“&•r øKaÔ~ÞðÿÊ?üðó†~øyÃ?ü¼á‡~ÞðÃ?oøᇟ7üðÃÏ~øáç ?üðó†~øyÃ?ü¼á‡~ÞðÃ?ü¼á‡~ÞðÃ?o<áÄW?JwRáVØÅGäRy»ü[h(±éoñ¿eoýéŸûy£œžòuMa‚±êu–y ï»y¼¶2#æoAq‚dáfAEÛP•ÜÚ›Nø9æÍees+Î.¾õä&<9%òï$öéóþþööú};òõš!6øaŒ?8N¤LB÷ŸzU^.Y²pSˆ'žæ÷·6Çp;¯!!Mk—ÌioáØEÔlˆäJ°¿ur)1`7®îÆU !1²TI¾çNâº=Ú"PSþœØ†<%ê6üGÞxiÊŸv?\‘ˆÈf#‹Äÿ€­SŸ‹ Àpúñ4ýý[¹Š%Ú›I+Ók£iäH3¾ÛDfOñ]C¹<ºJ‘H$ÞC&3yx +ñXhË21„ _Ï”Ü÷ojHDtb:ÔûMßE‹ &‰ÈEkç@3¿&'ÿ÷?×d&‡‹D‘œFšM¥%»Šïzÿµž£ÁI]M+ÿeŠ"y\Ô]Cº$Z{êïï¢ÒÀ_i'=¤ /ÐØ…äð”¾%þë¡!RyMÿú¨îDò úádù¼!þáwñ¿áþiz¾ )A²J®Bˆ©©ÛdJ/ "ÊÚLuÓ/O"@,¿Ú+¨A ]O÷ýHpÓ¦%¤•SïÁôl5 ¯H?>,ìñÞ…ø/›\ù×èç_èäß×%¯RJ ˆH ‡7iú–F¼øsÅŒ'Àq’z· e{‰ˆ7]ÞEë¶QZvÙZÏÐÀx‚š®ÜybUu–’*ž~:ùŸ´W´O~ :Œ [Q3y¹ ÏCªB  D`",f¸h‚à±ÀÍA V'”ZÈ}úc f xj T 0‚݇ e¶+Q( €Å!DÞ³* TòbѳÔþšLfð…5˜«.4AKQ€ÍC€r)x,6C`¤œOL²˜ õp˜ ®Øuu^Á¶ùJðð,ÆÄÖÏ1zB«â³ïpáî?‚à“‚œvØmdpÙ`u@ˆ À††ûpæ"2  n;β¦.FÕ«oŽovbÀ«>iÄiƒÍ€`( &0)‚ÁDWØdr´j0€D€œVØ\`h!ç 0í PC$°||³ MÈ$ "­ƒ¡Ö€Hã@-eðnÌ»`¶A¥…Z‹ nÁz0Àí‚ÙŠ2'Xq2è´øy ¶EòC˜LТr#D´ZßH€ $*ÈpEÛûþ5Á‹Pj (¥“ü¤ú§æ¦C{É'Ÿ‚š;›ªß–Þié âˆU¥.})&RGÐ×û|•\ÚEmªÇ uÍü…ˆhÖˆR5{ÿ¼2™„GÔ  ¥/'‘†@²`új DDÔQG oÝ8¿‘Z&ùª•jéÕ÷‰ˆÞJ½ù-ñÑ¥CÄ@ ÒmÿˆÂ 0ŠnB[Îù¦Ç–A$‘Ò„ÉÄ@oΧGôÌäÂ9’§ì ºÿˆˆ¨zx1©m“‘èË ¡òÕ߈Ö_""Úò2iA5Þ§>‰\Rü«æ?¹­´`Ô£=¨Sh›¡¸Ï?BrÐsoPÃX2ê?rÜDD÷¶RJ¼¯*¹’Ú½Fiy¾~FO Túnéãiã‰~ŸH šH7öSÕBâ9%ÞC»?$€ÞþÌ'œ_NÃ|ÔZê3›ì.:¾”4˜FFä$«Ý'Æ,{Aù‚¶.§H%AFK¶]%•œ §>ïÒ‰ýôb¨Ï\²Štåg¨z;:öKµ+öyòˆt|*Ôo"QêŠ"hèz™L´v.4ýKrYö@ŠPšð%\G  qkˆD:»‚GM_ £(TM=û5åÞ 7F•z}'ÑÇKÉa¦É  ‰ŸSÚ=r›hr8!„o'"Õ‚ªõ<]¼J“z@òñÆôdR„ÒÈùtÿµH$€äÿŸÉE²ïŽH zašo‚9ò64ð="¢qÏ@_$ÞH#‚rúü""* @ÉÕ´<‡ö¯&€’†Ò¯{éÐQún4`ò“Ÿ{ŸZ&@ßÝ "òdÓÏ@?-Á§ˆˆî\¦_·ÑÑÃtè½OÐÓø_‰ò©K-èªùÔ¤oJÇÌ4±'Ôz>8BvÓ¸ Ÿvò†„^ÿ²6-¡¶­¨r”o Œ¥‰‹(ÛFDÔ«É5´ü‘!›~ßM[Óჴc…ƒ"ÚÑa'zƒôŒdadñVøÀ7&.Ý#"l´ê= ×@uébÑÚWiØ rò† Ôh˜ï-ìšM½ú5½=Œä Ê¯úȼ¼Ÿ’´X2Ltò¨z+Ú¼—®Ý¦Ë7)=“ˆ|¼Ñw‚÷¸ªLöž"D?Íöñ½Ñ’À¨ãû¾š·Az)UìH<ùx£~ºç$"ZÙªÙóμ Ї[ˆˆœFšN¡Ïw™))ŠZŸCDtÿ5Ó¯×Îж-´û$;G/v €æ#Áýoã§:›¦PÈã= àyµ^GÅy¸v©çpò>P¯×†§D@B:Ä1\.ÜE¤27áµÝ @ª@­Ähqá.ž‡´IýÙ4EŸ$8 P¢g,»†ÏæáÖ]ŒYÁé-é¹|?Ê#H€p$RHz ‹‡C+…B … !æMÇüÊ>tÀ$4}Œ<ìÞ‡‹ –“Hqç(ÞqX·É•0¡6»À$Ð>Xï`CO@FÏ€Š€Vïá£VpTjH]Xq½{Ý Ùøu¶_Ä'_!¹’ÀÂ1˜ünÜžp+‘„/çâëý^o8Ш®÷¸šB"Uu?§RtŒ÷ú£à>˜‚«IÈPbÆÌR…Ý–Âzl ÓB-Ü3N%"\n058@•Ûpþwܼ‹ûçñїر ²K¿ðBÏ©e ”€ Ÿèrƒ¨(¹·¼Ïq!ˆ ®À°áeWÏúÆ‘JJkê@ä @8XÝÈ58,»0ôèc±íê©0îU¬Ùã{#ÿÑ1#^îÏÈà ^„R…ö}`¸†•û`Ðb@ƒÂɉrqü(<ÀåÕÈÁ¤è“„J‘¨Épv7xjÕÂÕxs¶ßŸY؇ÿ9pï<¾ ßþÒ.`÷V@ƒJÁ¥ hV3\hôhÖÚ\ìÊx$ y}xnãýõˆŠD»ŽÐ# *`ÿ誡Z,v|‰·?ÃCãcÃW_~Âò¯ñÒxœ¼ˆ;·q|7N]€ˆp0ƒ #0!Ë•j¢FU\ýv@pyPxNn‰¹…À=3\"‚CiWsßD á×ãÐ"%¦ßOdÀ¡ ¸gŸõß@½hŒkœø §³ŽìÆåL4n½GÂÀ~8ïD¿˜:ÍêyÈÜÃÀˆ;O±PF¶þwl€;¶!ÇŽVm}Æ®Ç&K@JìÛWêõ<ˆ_–C x·Að8€X$È`åØs;² ˜ö› Q£Q2( 7.€Ë Nòï ú+‚Ø¡5%'HH¯§uw‰ˆr.R¯p¨RWÊ4’ ’Ý@¯WUñs+IDATôY‰b+PŠzþ_ ˦’B±1$…5¢œ?xÞjY•DÍÃ( ŒÂuÐYd""¢v’hhÕY2\ñilÑ1¤ ¢…ó ¹Ž>ý‰ˆèê$åª3´X‹Þ ©@QPÿ™ä=²cAB+Nø ÞØåS´¬§%ToÝ1Šæ ™’^šHÓ†“¤ÐSliªÓ¸— &hÙ é^(|´Æ÷#€TRjø9s©EÇQLh±UG«£gû“‘hù몘L:Š®@øímLVeÇç<¼ (¨àTDAH‘ÙDEkù*¦ÂšÓÒù’…²t¾¤kC·´Y3´(WIf+]k–¥.?h꬙kf¥Ym•s•ÓÒ¤ùŠà9Wžçáy;`å"wý>÷}î—sþç>ç\¸ì‘òåY‘×f H‡é–.‘HdüNDäܧ'™=¤{º€äÏ’[/Š'DDä‚d¥ HR™½Cö=/ +jåº%Ò(«ÇHbªd¤ Hâùå¢Ø–Ý, å•rUDD=% yZº`^^&ˆ']såä%Y’"$ʆÝ""®3JÒºH^)Ê"ä›E®Kw$µ³$dÉð{¥C´˜.Y}\Š’ÈLÙz¤Å7Ü–‡’r6Ö³u‘éÜÝ 5›û§ñþz¦Í¥c¢÷Þ Oõ³Ü<ÎÞ—³|º'¾1g-ýŠÙò.\¡ÿ“T/ Âxüpà ›çÐ:v}OÉ$F<#§™ $õæõ7©}…Ÿ™³œqýèXÏÎ3äôÈk!®X¯o îsFײã V¥Ó™9ÎÓTÉD/Ó#ÙcyÈÃo§©ÛÄþ/¸a—Ä„©”ÝGŒ ðâv\‹8Õ@QUS)À{HÌeýÓœ?Ê…Kd’}™ñ—‰*öšAbYºW?œ£t0Ñø¬ž-5||œèd&Ï¡¢˜yk}‹Hš`øc,H£æs¨ª¢  ¶ÍÜ7(šLí6.6Ñ·˜Ê™d&cÛtʵS¬©áä¯DƲh<ó¦m\Àˆñ @ »ëxæm$†Iy¤˜Œ}€þ½q ÁŠ²ÍpÅ`ȯ >’zRZÊ=ƒe+9Ø—v‘ЋªG8¶WO1|{š%˨¿‹ÙóÝ‹ê|}žá‰-Ç•@Vrû[7l[¬À è¥?åÄ~%z¾«Úîu#AȺ~u-OøÜ!.n‡¯º× SŽ ®â_Þ¶œ#µöM¹Ö {V‰‰tèàµââv`„Þ²}¯Þ¡i9ŒlYô¬à²A6Í—hdòš¶ÅÅÃϤÿÙ¶§3m‡ŽÕÿ¶å\1xöì€[ábðVë]ºÍ–¥ˆ[U’'$Ù¡‹‡K8üçmž[ÌÀž>ÿó«AS“ÏVé~—òd¬ð%®ðÓyÝ°¹Ö¶ç=Ç›×Þ× ýÑôù =A0àÈ.ÖÖ°óR²x¡ÚûÁ­ÙØfoœ{·i8'·œ½,döL3x˜îþNÁ×ywáÆn@Cc°wÞ ¯—1´!ÃôË™ÆÍ.M©øE«=?Š÷åX¼Ÿ.B*Ïž/c†i:5é=›þ3¯Cã¶Zqÿ†gÄoCLr:Œü¡Ì¨ ÒÛoW4£*‰Ž'·[ð)4‡k„lOù,ŠÎð"ë«bøŽiøíwowˆ§O>ór;— ½²1Zé†AKÝ ·Ý–٠ξ4„æ\Õ~¿ÍÁB“ìÁ­7ç?(dž‚FçP¬Å#t2ôŽ`´rÁ2X‡Z'±-×a»ñ¨‡·‡sVÿq5qk‡òÞŸÚè9o·¦rk6xå?×Fó*)OD¾Ç- Xaþ­“ÚrnrÇ’þÏ'ÿSaøϪʣ½kCQîhô)(ŠjCQTŠ¢ÚPÕ†¢¨6Eµ¡(ª EQm(ŠjCQTŠ¢ÚPEµ¡(ª EQm(ŠjCQTŠ¢ÚPÕ†¢¨6Eµ¡(w'ûÿ³S¥IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/request2.png0000644000000000000000000014101513051004444021213 00000000000000‰PNG  IHDRz}…Ç4sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ$¯y > IDATxÚìwxEÛ‡ïÙÝSÓ!¡¡†‚TQPÁ^¥¨¯ ( Ö×ÞE_A) öŽPéEz -ô@ ôzêî|ä„EDϽ/.ÍÙ³gvvÊožçÙ™!¥\¸£(·Ä‰É_@¤4‹Áä„ÄGÛ5 ^¤¥ÀeÊÉ_ÂnQ|ºÔ SrLª@‚MCVî+òÑ~³DLþBk’5B­…n¿ÛgÊIUròàúŠY&&&ÿ ¦Ü˜˜˜üChU r¨Z%;Ùå5¼ºDˆ²BU‚¬BÂ0d©ÇÐeÅWdS4E ¥Çg¸ý!Âê1é d‘KוÍñ0Gq+Ê“²©ŸQž88U<:Š‚E›cŸŽªV!žn •3 xŠ«h*ŠW‚À¡âÕ9r§•J!°)ðÇ`R•{eµªVd±·¢Uñé.¡„Wƒºßð áP=îñènƒÊMÈ0d±G—ˆ³’I ,{ᥠT—§_³R M ÕdÛ¨¢=H©YU‡0ŠSqNÝÜï¿=n„QÐ⣠ʴBŠÉ¯µ©7sÓ[ìW;%„…ZÂÐS „XóÇÁŸBc^JÐ$Ôˆ´Z<¾Ô LxûÛ‡œoǧg¸J%‡¥A˜vø`NÌ“ÑÄ_ÔšèNõ§Ö)¼úû|‚‚ò&4Šº)Ïú'ÒŒéŸÖ'Gü÷p•¡Š~Z¾¹?îÃÂRâj–ŠšÿvëÆlØã=¿­ß}ºsЖ@6‡ jòÃðzÚ‹ÂEx¬öOn˜‘m AˆŽWÄ'½Ý¦îyåcÃë«©e”YMê$=Ñ|ÒCÛâŸØ  [s§µê÷â–õ…2àÇU”ŒˆŠýĵk””â2,`Á.ðhR’ù² `Ô,Ýà¼ßžO¶±®üY› 0x~e„Z’N’ÅBœÎ>ÉØÌÝʭͪ®Â®±Jã•4 jÅ­!Ì(ÄT›3åà{êýpã=-¦ù2ëOÉ蹟†ÿVûÎ?nïºÌwÄã·Aÿ·n÷ aÝúA«™Ù •®ß@è ÌJÒ%ÔòF%eà[E  £{q^Aà ȲDÊ~~Ä`×Ë- €å%1øsnY"e•C–õT!1¨ÐͲHTQöQ¢)¯$¨e)”Ùeµ|‚ ô7Ö#½Fâ—7uþÆn„@0k[‰ZφW¿­oý¤mi3² d}íìIÅâá¦$>IL„pL„ر5U<¼ E *îSÒßC³fN*?3ŒCïu|÷Ñ–¿ «·n|Ûœk¿3:aòÍõv}ØaùÍ!eÝ{õ„¶ò­ ŸNÐ?hß'J©Þ2z\BPç1o]Q­¬“¿¿ÍÁšçOëX<¡±†Ägüö\kýÝÖ¿>ÖÌ;µÃ=ƒ‘2¤F˜1¥ý¾§›l{³ÝȨÓé½R«^ֱ͘‘SA7f<™ '¶úíñÆÔϵ±R=\Nk]Ãk”éØ}O¶ß~UHñ´Žõí å€Ûâå´[ ¤ìÚ­þþquÑe»>ñ¾©–ŠÏšÖÁýt]‹!‰­#_‹]8¡Ãþ‡ëàbÜÈÖú”¶¿>Ú¼äF垪Í5­ãÅç~„ÔNíúkZ¹÷¹P´^mÔÍŸdm°ñQ¦ÿ±öG7¹Þþ(ùÎñ þ«ïÈt}´0cü¢\ìÚiåšój-{hš†båev­Móè Ãæ¯Çµ¥D±S>w!%Íj²ö Bp’Ç·BÅ ¹F@š}^°¢‚9Qé4hҺƊ'#ÔrÛ¡¹õg!ÚbÇ¢9Åǘº_F¬HGÿÝøô76¾ºK¯³Ù“<´6Ÿ'u¼¶y‡œ ñB:P§K£ƒcê*îýb_tÃÔŒQ¿ç ÖZK6ÕMòcÑô÷ÛÔµ ï&}#Šì#÷z„p6Š)y"ö©¹›ß·måÞ„iùñÍÄöäœJW΢—t|tÃ^—Ý£ñˆbûƒû¬ Ò0 Je@WûîßÒŸµÊ7¥¥í›}²sMw·IÅ_%„]“72Þ¸ô5oµúa¸ô .‰"ƼbÿÕ5-SöÅ K,¢QŒÝ—êÉG P˜¨_–“B—~^Çn6¯Ìøï^Ÿ"ðúôÄ¥%º@+vqSû06äV(ˆ”7G+s–{QÀ+ÑØ—áÚ—VúÍ¢´¨¸j‡ÇÕ¯þynöÉ;§T›wxo×Â×ËbéG}•çfo1ŠeþÊ ²SÑAB¾‡t/9Q=*XNúCC…’²d=09¥Ež {ŠQCdÔ;Óf:áÇCûýBJò =‰‡à†Î6Œòæ1°*ÇDšö¬ßsׇÅ{>h3!!û‘-þ/vêÔ2~šž‡Eàõ¢”¯Àp߶ÀûáàÈÆq28IGäv4xâºÒÉkà)™«Ä?ÑÆ·zW6Å.Å®Úté]vR8ä D08Tä ŽÁ+± 4[ „Ä+±œûP±ö'Î"ykÆ…¡ÿ×ñ³e‡·öÕ¬òP—°qïlÞV$±ðѪ‚e¶êü<3ñžf#}‡lQ!×ú.söÔů·~öí-KrŽR/!%Òßtì>ß+­>x`ãŠÏw'ðííÊ»==»Õº/¼H{æšX´`Ó—›&t—µ+MÎÎð½ÐÆyÕ×¥XE›Ü¯õ¯>(Í-}=Yî{4öÁE[DµV\}v»©QÑCS·ån ©»ø®ÚîõP3`ß–¹O7ý¿¤íÅç¸ÆÔçž{nó!×›ò+ Ö¶ï(L,:nþ’"6oÎ~}uQ£h{Ý0-'£øÆwvÿže”9Á)ûó'¬,Œ­ålVÃæĘüãÑ¿åS1qKT ×m)(¨ìEJvwóù»ãŽ½–S#µ”L_ÅñP+; (®tBZ1iþcbcw>G.«.Ù\x”m)ZZ™“øm·ê„XH-Eª„XÈusØG°¡³«Ÿ¹Ù4 Føxw¥fì¦ ‚lªÇoø+u[‡C+Èr-Mõ)®`ëÝ« A:›Có.ýý÷˜ò ¶¦ï-X™'ô¢¨jü–XX|ï@R-Xûcga¦G‚¨­ÌßXPˆŠR]•¿$>ïK³s7 éZß¾bÙÁ!³ ДUIEaÑÎ:Â?o¯»a(³‹üŠ¢‚µyÛ tÿøŸ³j7 íQÇ6{^Ê¿`Q2ÌJ“}šÌ»cqiŒê½ËâÊËkïX“±«¤Òó»æÏ/^|P7\®E˽äO»Kß™u8¸vpÏ8Çm‡/ÿ8‹‚¾RÿЫk>þÒîÄÀ“~Vå*Qþ’©+ =BréÕq?·¤Ð§ ó—¤ïÐlW4 .H/ìó¿¥((Jœæÿak©Tèïÿ–S7¸U5å™É»½NË’m…źhÓÀ±b{Aþ9|¾!éß:\H)?Y•c.Ñ4ùkéß½DS7–½•pÇã[öÊŸ-7|²eçº[n î„)ÿ_bÈɃëkfO11ùËN‚Òý¾ÍýùéXVû®÷š7þcQþÿ‡M¹119+ÎäMýôºã‡­ES°ý+=˜rcbrî‚ Q4çšü=HiÕ„EáØÙRRV¼dôŸyÛhÙ¥D§åϾâT"DÅ|1ª)7&ç3º1id› =œÇôüˆ·éãHðÊô÷šéÆß-6¶Èà¢ë­—<󧃱±µ‹ÇÇb¾¥Ð”“ Bwðø%€ŸÇ:i^Ÿ”(A1VáöJ$ø ‰¿Ò™'²SÊÎôøŒ£—•.ç3§†¬ìÑå½G~.NÖkà7ŽJÇk˜*sv1c7&_`‚ê£|×Çí,-ÂdŸ‘KûÅ]&°o4köÁFWÅ‚õÛGþ`ïØq›QÐÐ"çæY‡µ²ö•8Û%ªðkb¢å¡Ÿ¥ÛóÝÓ»úÜv÷î3m³þ`ç&£6íöJ¢«g?›“\訞•úô^{Lð·DU3fÞщà‘éï·O;ìmWÇ>qzÒC«JðËû‡µ˜ØűlWq§f!Ék´˜’Úþ mCÝ®}Ò¾a» é5+Ó”“óÃèbÓ-ÿÙ„äQÞ»5´é'û3F>ÿñ¾nø*ûþv‘·½»Ï~ŸQO÷Ôz)…¯¯m9stíèÒŽ›º-Ð%ÎÐOß[÷k3S”57ÕWH”ªÈiÜ~bsË•k=k‹}mâÖ76»1xolûo® ¹ñ—¢çÍ»Ê7dúÁˆöM¨S³ÃRݲnϸ”ëª=´¬ÄÑ4ú½nJí»Ö¥I!BÆ[ÍÚMÏR®kV¿8]<Ž”ciyä…8&¦Ü˜œ·Ö27)MA{ö{­±v„ PÊ&³)ª±<¹‹rǶìðÕ©'˜º]º8¬¢¤Ð]PªHU ÄænRŽøb…?^ ÜçnÑ Y¤( ÊÃùYé^P•ƒ¼„Ø,=›•î,N3šÅîuˆ›k ÑÎúǬ\âý%/Ç™1SnLÎ{üG^”w û@x¼µ-†”ª8I÷6ŽÄvŽ¼‚7¸¢Z %Ç{È'€ƒ+Ò¿)ÃÙ݉O¢ 4¥ JѼÕÒÆF/г¥ÌݜL+ÑäDÊCðÔ•Õoh¨Qä ÿô¬^7HHAó¶Qo\yu§èÙÃ#¾ø|ÿ™,‚ÕŒQ æ<?¢CØ]£÷Nh=º…()öD…‡ÝØ!R©Jü¬Îœ¯….QëÊa¯ßï;”ûM13?Ü٣ɓ—TÒ«ÖSõmˆ¿ö®%SnLþf3F,ß–³2=ð>úÔƒyß$¹‘Fg÷î nä¸ónÿ.£]|ˆC€P>µo¹pÜšà|eRÒ½‰'˜ŒãvÿðG¡ ?¯ô³õMR¶å|—¦#øæË-¦e¶hÞ¯uà¸/oó#Ä®¤ôgV÷kâðäÌX_Hª¤ä»•…†(þ>®Ÿž%níž¹5-øɽ(BæåÔy3¹fýжÁ¾‹'&³¾DQÍwœFa®79+fË™¯÷é“ï¨lÜ~ÏB÷±[&Ãy°—€Éb®79OPU¡V~÷‚¦Í}¤¡8úE{BQ&~³gvªa×…‹)7&ç‹z÷ «QÕŠÍQýþ+_NªâL›ŠéÔ˜rcbò—8fƒ !pš-Ó”“ÓD¢¨~E ¿¡‰È¨š_šÝ¢š‘†jýxÛE×5iQ+Þ8+¥â7Ô*öí8U†,ªß§kT½S«aQ Ÿ_;go¡– ø-BñéÊiåAbÑ|~];zãYxC®8òÇYÎåIËД“sç#=4dÄ£{‹î(ß#\ŸþV—z3Ýá·và 8¸À‰-³Ø.ÐW.3+tÊë­ %224_õ…f¹To¼ûí›w¾oNv·”Gv­`ÏÁ}×Ö{é)´?–VK½ï÷lxÿêd_UïÁ Ùä}ó)ÇóÜ6ß9*.ѸÇíI]nÑ^¹ö4ÏÏz§ËµO/Y”Tù`pì/kä5›8X :Pøì'Î1OMÅ9yšrcr’²ìÝèe€rÃÝ×O÷ Ž™z jYøŠCŽ«cç¿éº¬Zà 6èóìì$ŸjêŽI¦·xXbÐQýljµl~ Äë@õ ¼,::È qÇ6l§œ@(1,ø4¬n„ÄoEW̓š µÜŽðÚ,nÊŒ5͸k)ü6 0°xÀëDóà³`w!üVt¥Ò†RÁgA Í‹Ý‚®`õe®H@à³!šUG·7«µÝ«×Åã´E'‚ÀkÇæÂãÄêÆgC8³êR8[exBÌy7&çd,¤ $Èò½ÞÇM¿âHY<§ìˆÄ;s -“Žšz§«¶èS‚_дgZNºäaÈéW½<®Íá—«¸äŒ ,ú)&ìI9ã•Î[nŸ§)j}}xJë¤gžÒ&ëñ×( ûHÛåwÌGJ¤ÐûäÇ-‡Ži¿µï.¤ÀS²÷ã ¯›zVÚÇ-ºÒåò‡<ÓV»³ð£V£§*RÁ´ôõSGÞ+§·Õ¼0´ÖbÏÔV^¸mïÛ +ëŒÊûãÈÉ—.~òfÿ´Ö_¶CmÝm¼œx;^õ˜2l~ùÈü WeLo)'Ý+í¡± ¦_9·^Ãï>`Ô·C'YB–ýÀ“ŠTs§´xçÑ«—?<æ—ç»ÉI7Ç {Õ÷~¶ÊдnL΃Ð⇹£V«å±›v6¶üŇT‡űê·æÇŒ±~ãÈÊ,iH ††’býnI¡X O™ºapÿýW^uðÁê_wG*I¿ñìøÙ“vÔÂ_¾ÐnÒ•×>3ÿ‘—ïù„i—c5v~λç©?ÏŸþä—êïÏ걟)+®épÑj¾îo‹[S3¿íεòúõíFnØ訅ï÷º¦ÆÍߧ;¼{Ïâ®bøà¹q®[òv×Oz¢”Λܕ }Xì¡j÷lÎÕu‚vl{)·®½»Æf?–£'Êí…w‡îŠŸyo·Üîà ë.}võŒ§c{Þ6yhý6On¬Þ4ùY~¿Òqë³Ïî„n›þT»g¯X4xÎÅUZ(½ M¹19gd¤µ}sþ¥v!ctÜÚ3sú}ðÁ}÷K©(ÞøúëÃöÜ:lC0ŠŠË ¼ØN´¬)|¶jXݧ™è3àÞñÑ—ÚŸºEGÙQßN½ÆóGÅJP…»^ûØUYó¯]üÚõx5Ó=íÖíƒFÏ…îG÷Ûs¯\øéÚW»´¾½}|øÕ÷ô©S'QÔØè2P%2x¾ÛvC­üïÓ£ÞÏ·uÀâÁçîݘùŸ÷Bó#íÏ,ŽXÖ¨±¨˜ÄgnÿlÕÀ7çÝøî²84]÷;²üÇ9@Âx~u TçäjaÎùU×CÞ}ýýK»é1Ý‹"hU‰šâÙxï‹ßÇûwG]Ÿmk7gÞ¬çœê'~Ãz$?y~Ñ*Ä‹!K|Oz «ÌÇW>¸¦{ÛùW·—5ùÅå ŸíþÙ€Å=F%ÿSœÌu-ÖU ½ºêTO'~fehÊÉ… ·ôÚî+ßÒê™–|»<@ø°êÒÀ.tø|µ£Ùw’~ä±cu×?£œ~ÒáÚá[_!F¿_"Y¸ñªµ…R É)-ª†ê[¼~xǵo¿nç¼ñ ƨåµ_ŽKlÑxmŽHÞÚþý„Oãâ"»l òÄÆZ‚ ðk¨>¤¥‡Ý;õPØQ•áë]´nEv(’Ò)AXò;ÕV–mé»,ñª1Ÿ­•“îiùÕ[ ºÀâûO¶Ey ôŒ(Šakž²-ï’$£œnþ…z41¹ C(~œÅ8‹qxPŒŸò­¯\ñCBí] {è"8á"nѲ—û¶;~ÿZ¡Y=«æMøÔ³vÝ­KP‚Ƭlµâ±Ñ·µ^qMç/Œï{_“$FN«çS3Vß¾«ÿ÷-Êì…Ísè}óSêÚAÒ·wmï½>ÛÓí°p¤^ôqnÑŽûßíÓdÍÈŠó6ž|°ÚÑc½eÊ÷—4ìÖ¶Kî½ú•›K#HåЪg{?Õó×¾ KF^ÿ!¹½vúŒØf³Þý¾SöV£Àݤö’«V–Öw¯º®ÝBMÜr÷È{:¬ÐuâãíNYr5JU…súehÊÉy†±#¹Óœä©«Ö÷Z[aP§ìéúí¾Úåãp…ŒlÜØc^–­Ò¡È/·ô-0NÚô…~ÿ“‹¾,NyiÀÇ—=w×ìk7æXñEÎÝÐÓ§RûríåÅR TohZÐ1 ß1g]O]5Êà§Ýús]«oÊ´//úú²ží¹¹IJŸÇ—¿³3ªúÉ÷ƒJ³/Úƒ¿ÜQ¹tÚæ6Ìo*)êüÊú‹_^z=š° »ò¹duD¯ïjw~] ƒð/ÚÚ7)Ï  x—,x­û—W]ÝinTA¯6Ÿ ùjgž–Êã3‚j¯¾§ÇOõŠú:žxËgñé~{viÐÑ&‰üv}ŸL¯ ü+’úlÌ Aø~_òȤQ·$lÉLòÜíni»N7<7%¤Á¼;Rnxá·¯Ò•ª­¤Ó/Ã3"Ìá&g#Jsáìn(ë&ö8jvª¡ÿÙ›ÄйË>¸tù«kÆî¿@†jC9ü^»›Ÿ_²(«\°¤ Ê½ÌýoœTm®7ùWÆŒwÏÃYú§gøÖËz=1ïö¹¶Ü1vŸrá8¢}«¡ë~>ÃsœkvÇoåúÿÞ»2­“™uónŸ¿ÀîB\8y\ÁØJÊõQbXðت8×^bZ7&&ç‹™€ÅåBË3à(9êˆâÇá?7–¥ÙˆL·AX ~ "‘ec³¬ô÷ynF”gÕÄ”“ó—ÈÛ<Ö£aQZ4á M õz?ørÇçuOöÍ¡ãSmÓÌÊ< ¦3eòwŽø~~ $ªŽxœX=x-Ø]•‚µRÅí‰ÍËæ`›îw¡Š!mxØðihàU±úñÚÀÀæ>A¸Aâ Bq£Û°— üüh4\Ž@´Â°à±à(*[U‹žËt¡IøœH/½Òí]öX–RTÓ¼1­“¾mEÏÏþ UÖë×mŸØ©ôõÁ1~;–9£ù#ö,z¯GÃcÂ>dz£{|½Ÿ>£Å¶ÇÞB+øåáÑ6ü2fdÛÞ¯ŒªŸqÛU/M콌šßÈi7}ôä¥_üç±]“Z&_µÉãzááV<ô¦ü¸Åç½SU[ZÚ; ߺzó]JÞ½´¡ÃÀíOšÙ¼¤‚TšwzOÎlq“ÉT"j~#§ÝQ…„ùoŒmþÝÕ’o IDAT{`hÝoêQòèb„î›Ñ|ÌWº&wîjùíõfã:¤šÎ”)7&ÿ8^û§÷Ž]0û½¨±_6xÅcÉûW>:©—oœòðÂ}¥G]- æ~[wÜÖ1Óš7þÙ扸îË>øÛôûÍ‹ÇÌË úò×1.½CEKÚþéœ[§½?槦q_u²(Uöp;¤Ih–¸sËm¿×ˆÚð颱¡}ßêñÏdø¿î¼͹xwõ®M’0l}ZÌ^¾¼ßý½·#E›ÞÿÛ1{l• FÅöÒPý†áó‹»_rÜÿÇš»¡c˜ZcÊɹàP·šü¼ª?}ÑòÛ¢j,ÁÄ3kcQ}ÇY '%UCóé®HðÕP„¦HšâG1!E/Ÿ\óã=!¨:žj‹1î¨}‚µà¿6¹7V7ªž}àše…)³öÇS·ÞQ£´Aíl„wÂÆÖw6Ù€§øºNE÷ÍïÓªÝL(ýoÏ‘óü‰»òŵѼ˜V)7&çw””Ï%óN»š[ÖA ªšbgóršËŽƒJ ”E‰A5Û‰~%½îÊÀ!~º|ßËß=q󇯾¤ @îZrmÌÅK‰XÛ#§ã–ƒqZ­õXsºûÃæ»O?©â‹]sSnLÎ!²ÎvMëf–Íý®½"ÏÓ⤽RžàH`—oYñ}J[‡$ªçb…ß3mœB\£{¤Lžüæ‡Ê®?¸Ž7àò÷XP²nìe,ßÙY{âá´á±J_ì®@RÂ뱪Z)H¤ÑºÙa³†M¹19o°j/ϾâÅ¡#4Ýpe癿ܴöå©Oÿ)#À[\mõmkz†n¿¡íÂË%#hoŽ~°O“ ÷|!Â_oz®¬Z *°ÏÜj½é†‰Ý¯;ôÖ¤]á‘­ç·‹,ÆÊœ--^è÷í¢õ}Q•9 º¾}çÛ?7¬ê:ÿºýúvœšP+¹_÷©£!sƒ=SnL΄oîì7O|m÷ÏÅg^1fý„©ýœØ³øø~êY¶¹ƒQöRqÃñû–î.aøs®{rñÅC»Îs¨ÞÞ}e½¶ë†¸H á¥‡ß~ÉÌK#¢âFÎA­jáßy Ûê´pEN¸ôôì±}صxâãS¾ú`WÉõ±™à¾|àÒ=—NO Cø·%ݱ<­ó¨ÍÁ'è(ÞœðŸ5ÑãošÐA¶m?óæÙ‚Ÿ{Ö)úŠ=vØÍš?Y£0×L™œ ×éŸZ3õ“|ñ[õŽ/ »7àpIãx{Ä@5Î(¤rÖ4)+?sÍ”É8>Bå=RDdü{S/=öµsjA§3o9ö]⧥6g;AÓº1¹0­‰¡áÕ°»Ë ‰n¯â5wBÇæ9Cëæ,'hbZ7&æ舢c×Zý zN°©€8ÃKœåM*0åÆäo4y€Jz$F…QRu_>ÍオŸ•arS/ˆu‡ø0ƒþ­iÊë¹4¯ÃÈRK¨ãä@6ÏïGHînOP&Ñ!4hãä±DJ0í SnLΚVãÞJXÏFlÅЈƒù%•·”aî^®K 8 —¤y-ôB½<Ü’mù CZ1ª:oeã“d¦rwºÊ#½†|ÕJߤDJ ‚cx5‘=^tÁ¸4‡……¸ubƒx|* iÃÐ0Þ+0+Ù”“óƒ› *ä¦Uø™'ugC *hNrktT‰ËÈÃM¾N¬m.. ç· 4+,ü&¸´@^1=£Ù XS‚EAÑIò1®K³YšÍ™¾˜Å‰€C>4Õ ¹˜ZNd!B°?«’}^®p‚)7¦Ü˜œ'd•²2§îªÁ/ÙXø<•ÁÍI¡i/µåúУ~®k<ߊÞćpI ðâ*w¦¤þS—†AôªG3•Å¹æ,?Óº19o¤– ½•z©$©ˆÂJÆÁbôã^ë'`gy•í?û ªZ6yŒú¾>ÌÀPÖžmLãÉD*øj‰.$+ÚÂuµé ‘VÂý‰h‚ìb’}¯'rImÔ&£˜û6 +AzJù+–óKØã1«ùϵ sÍ”ÉYà_±‹¦É_À“×7)“Êý5‹ÀÄÄÄ”SnLLLLL¹1111åÆÄÄÄ”SnLLLL¹11111åÆÄÄÄ”SnLLLLL¹1111åÆÄÄÄÄ”SnLLLL¹11111åÆÄÄÄ”SnLLLL¹111ùW#¤”[Ò=Ù%fY˜ülšâÓ¥!ÍLªBR'Ê¡I)×Ú†-±™bòW°Ø¥Ï/ð›%aRµÜ¼s‰Ô„šV³Ã¬¨‚/ž²Aâ´âPÐ ò½ŠF„B¡A¨†!É÷"%ªƒëƒ™éÀé+?•†¦ Ú]E–­.ãU¦RhãÕêTË#s(®"œ ®¶ ûϳMçB"}Ý“ArãeL3è9¿B8f­ƒñC載îI•ílîúíz`”Zuß6å†ÝUô»²†çöS⯺)"‚0+*xüWjraV4A‘÷¨ClX^"€Õ‚]b¨„(¤»O&ªJ¸…7€Ý‚SE–·|ÍB˜ ÇÈ¡ÅBˆ‚\7T•l7€¦¢çEU ³ Àå£Tˆ´“ï!ԆLJKÇn!HÅí¥òà[vG>B€ÅBè‘ëžG±Iµ¦Ô(bí6j ª$Z0ú¶`Éø†£ 0Øy'i7ñÓո Fô¤dowfßP^ Ùìkɾ‰ÍÙrs;€N¿–ÄÀ½íèjã¥YšpTJR’‡³Ó)ÔˆC”R* ™Î–p~Äç9¦Ö\ŽgÕý)ƒzÑU¤Ù¹#û¯å—k(N' nèBÉ`&vf÷ä\`>”-ýy¿…Ãy².H0xå2nã­n” /oP’_‘{ow'{ÿk ’HºŠÂA¼ŠŽµmÿˆk‚k(Sº°ávŒëÐ$þ²‡Y¦žÿ»©õÉŒ$O ëê©ôdJk´ü#XÑ—)}(A@ò Þ½žMHpÒ²9®a|Ú-C¸ÙÈÀÖ»90 Ýȸ“éq—_Df_ÐÏYC8¡uóëÅ<þXù0™±ÍødHéÉÊÍ\¼sóŸP~oD|1âkŒìɸܔʔxì“ðhˆ?0†Ñl1é:„Óx*‡u^Û¼:køy3täåìV˜ÿiæÕÌxég¬-˜Ò„»v‘P»¢êÓ> Ûn\}qÌ6ãÝç/ÍãȨˆÎQV–üuåÒx(†ÏV7ÌHZ¢Æo óñMÜOb&ß$4‰R–áA; Tþ»‚“Ðá­v,hÁK©ÁÕ±MÆ«2ÂŽç€úm¸Ü@ù©0$ãFÆlÁïÇé@™ âÄãœÁ·ƒØþ@±°»¦²O‡lˆÚLNá‡bžˆgÌ>”î²¢&±ã:©¬Öy8‚_JhJJ=k1k¯]Æ‚D.[Ю5+nÆ>iP'‘ØÝàgÁµ<7ÿ÷Â.‚œ´ð#¾¢Ò%à—?°pÒhé9 íìôÉÉK™4ŒØeì—\W‡ù+`¿™oijrS èß]»pY+ð0þ¬ ‡áúPÞ¼äê Ÿhíà¿Â[–åTŽº ù$,gŠɨŽŒûYh•Ç\SkÎkv&ÓfÀL¾˜3JÇ+a§•ý{•‚À¬B ¦g>–b¡e5ðòF/,Êšbë“c'sN¢ ²@R7_!^~/†¸7žR7“z¡€Ob@72 Nª5~^H̺m²ƒdl×@ ·¨\ÎäT&&1«)cvÑ©Ò1ÚÃk 鵇ê~ÙÌ›Ñü”ÇUN®Ë"±:Ÿ, ô»½û±tD‚)™ûwðvF K_íã()e>”eÖN^ÅÊr'@r.½ª­›A—£@Þ=GjÎ#Û`Ñ D n*TB¡¨6$^ÛDq)D‚¿Âø• žæ=‹òÿ1Ðà7håòdúPç=ºŽûÈÜ?‰÷L]*+ôû]:H<~²Ý ¨Eêuå­n2pìCUà.å…M8À«›()¥W¾ªOÏÈ3hÔœÍ , úqy³ ö¦ðÒ.,ŒßÌa> ûNšW ¡kSZ.f«@¼–XÞM6áñ€`ñ&I€yõ;,ßÀÏWîgû&ölgàu„{)Ø‹W`©tkRV4ü£<«à7Žµ°úL£f0ýãɼ‹½IÄ-9÷csÕן\›ž3“ÿÚ®äáàca.=ãMçÅK?ºÒ%•Ãœ‚Šcw4cÖ äÉ2pCk’⸨–R–çNÛ:´Ããâûd<$ëÒ:„¤ þÈæ’ÆDyùú(ô¯O ¿î¥Góöc€AÏúÄ‘™Ï/© P/Švf¥´hÈ/Õi°¦Rþ­ÜËû;@ÁbåÎXfìÄ+iMÇH¿$“[iö ïn.ú å·S‹+C™±CR¯&W†2uG §Ø\U§ÁêTv¹n‹ga2¾€­ÔªÂÙÁAW;³Ò°8P› iÌIAÝh.µòqʹðª$“{/7Ï•Â‘× ñ¹Ùý×ÈÍ¿à–›'Ð÷oçýy£[‚—½y*˜ØÉãÉä'_Äp(…@ÀÍÄäÿ‹+·}#Ûµ3rðíxî¡$Ÿßü»`ퟩ˜¼ˆm`¾TÇäÿg<‚º±Mj¸ÿWÉ  š•LL*`ìÿÆûVN.Þmªò·{F>^ýpØÎò´÷ó¼ÚT«¤Æ›•6áåsÿ%µCH¨FëHê;/œb‘Ô ¡öñõhT:¢ÿé‚êP qVJ@£}Ä™fÛjhòÄYžtVÇ?Røv-CÏFk‘„;itvžr’ËŒ¾’U×ò߆[÷3ñvš×æÞèÇÄúÿ&Íw²ñzÂ*hPŸ—ƒ ‡³ãZ^iÇÛ=IÄ÷ ˆâ<׃±ŽmTúqe™ù)½—à?Õ-ƒX{=–³ò~Òj¬xz'«–ª ×S㘯|$ÿ‡H$‘µIî¦Õt–*7®!+.9;ÊuE¾íxv²}b¹Ñy,šž yäbD¥§›Bl!XC©t  –ò©ÆHl*!‚ÔÀø,B4T… ÁZ`)6nÁiÁ&Në¶Ë~bÁ*ÉYPÁ®jÁ®TÊ… *[PA¨Vþ­¬h/áb!H«8räPKÅò²{´UºÇ`Ëq¾hå3•ÀoZU™<[Ž¯M/!Ó—ü€s —\LÜõ¦WU#Ä‚S‰jaL=¬ ª„X5hØ4B-8NUDeTV¿G Ê¢šVåí¬té²Ó%P¹‚£štYƒ±ˆJÍUŪe?Yfœ•›½ƒúlÅ¢pI4¹>ì–ò&TÞ -'ê–eS±i+ÉRYi¨ ÁZù2i•­â®'-.¥¼X*w¢²ÒÓ*½³B)/R›RQVV5pDVʧU­Ô…Ë{–ªyzîˆv¢†Ù„èV'±én¯Á§9jþA. ÇJ¼†õ# ƒíCih°ÉÍE´›ÎF/C{2=Ž/÷Ó¯1y»‰]HµFdµ¥P嵌lÍúÍô_ÍÀöÔ„G:ñE"s]§èx¡ÜÄÖTÒ-ô‰"f*™:oaqM‹Yjðd<§°Nç¥<ÅOi ŒFZi÷1©±äv@| *J5ò"&ƨ~¼V‹S¸¼%;‰Y»†æf«Ž+Ÿ~ ÑÞC"w(2›å>Ô¤Ý 6ºAgûPþšïó+i•¬¡h9,ñ0°?au1 o`O)M\ÌöðlSzLeÙié^v »À]ÞR#>¸æ:Ö­§#K ¹$Š›>fOÁmßFý€g;ñâ ž¾’Ž6"\|VÀ“Íò Ÿœ¨=ø˜vM¼ÔA-&ê €š HíËÜ=4«Gƒb´¯Ñ fÜÌõNædpMÖ¯¥ËPq'%‹d•œìrñ Áu‡Ò9`¥w1ÓÈ„ðXr(Œbëº.­ºÀ_Á'"œFVB&sw'<}SöðPjYלg¶S0”x’ ¯ÉMÑTŸBNUݲu –ÇâŒá·M\±ŠCCQŠYQÂuu;›%9ݟʤAÜ©a†„/naõÞH?AßVЇ3'•¾µy÷WF¥ E⾑-q‡ÒÙFèG)XlxïdoIýkqñ§¬,¡y3¶õ`þ~×bmJÀ7lÒ„=™µ‡N ‰ÎÆúFu ®`‰Fh:íæž:|Âïçveìo`eJ2O4åÓå y¸«·Ðy~Â}¡ÌmH³’ÀŠð‡zñtKnLezœ“q©ˆeÃh²˜ÌJ+Â_Þ¼•Úkù1:ðÂìVNÝ…BTÿΧɣoäû8ºîÄ0ˆØMí Æ}͙θèÀÒÞà o:±­’{€sÉ4üÉXN­Ĺ_€Â°‹éçG7~ ¹{ˆ[P¯)®Gý C¥Á”£×‹Inï;™º¿ÔŠ'õzÔ‘è¸ D0cÚ°lÃé÷gðÌa\÷àòóõvƬáð4±EïAû$wö奋‰_LV7Þ_ÃùúMÂÂÏ¿2¨-ß l:^ úоl 0XtcòÊAV&qïVJ‘ä€õôî%“¸¼’› ð3¹/߯â¶D\v[õ>?DÓp*9ú €˜M4ÎIö]´ á­ Œoɘeä ¦â¾žI <ºÊ_ÈÇAÒâ†ÅðFZ·æóc©Žø@ñêÞ߆Û1¯%¯ÎÅF]8ha„ÆB…(8lÐÃÁ³y'¶+ÃQ§`Hê¶$åbFíá·+y~Ïïƒÿôfñe´_ˆÝƽ‹™¼à¶+™Ù„Æ«™Ø‘ççóì^0X|/ìBXÙÑ‹†SH6`;îdP43½Ìë3™ã:­ÇN'\ÞÁNß ðóþRþ7ŒzËI‘\_‡yå+ÂûÎx½ «ÊW„¿³˜wàÒVàá•e¸™pC(ÿ£ÒŠðzLpáÇL–¡¾˜ o\]‹M;·óU2ÓZÜ‹ÜÏÿºDŠ`‚Šd‹ú†7Âw p¦TÀI¨‚ßs«–óKpØ‘‹“×À‘a6ã­Ô gt2Gà+ ô‹ dÃÁâò¹éyhQU?¢)ûßúÜÀ‡ƒY„µ=Yª?€¿ RmEÜ×1°þ3D£G¯ìei[†¥  $×ÕaÁòÀåfîâ€ÞÕÉÊTY°gDùeÜäë'ßÎ(‘®©:æGS³GxèÎiU'è) œ&KIÕ8t'Á BÁ’ >ÞÌfTm^ôP’Ïs‡y0’§Š‰‚=îfÒ“!Aš vPhŒ·>ÿ«LMHŠ ±&Ý›‚¢âu4q0±|¶÷É<aN0xôâòÞ#¸"‚™™K‹O÷wÕgÝÚåÿØ;ïø¨ª´ïôôB ½&é(½#Š4QŠH'” X×]]_]wuWÝ]{WE¬JQz“Þ $tB!…ô2õÞóþ‘{33É„¢¬õþ>óGræÜÓæœç>ç9ç÷<ïËoÉ£IxGU3a¥Š«Îl ¸ˆW©„Ì·ŽQPÕ*2ÂM>cäKí5½ØôÌ(&”ÐìS w áŸ^ssÅÚ½ÜYªžßMî(ú,ár§„)Õ&™[›@6Ø~‚·µ;õo¡´ );Oò¶öÂy;‘"ø ‘¶1>0‡²5uû‡¬õØ ÞãŒ0“Ö1$JÝœÉböf›H›Ìˆ|öq`(‹kµ$–¶ÊxUvPô‹¾›„CQç›ÓAýf@»O8ç&(œÌ;A"„ݧ–òwU2Ë´½ÛóÂûþ»ò–×}̓P¾/ËÎf4‡Ü½{²´ ?粇&­8Ü ¬KâíÖ|v™MØ›ÃÚn|œCÒœW´ÖW謾Hb·æ®Ð#L¹ƒƒhøE2=úð•`wùãŠj2 oSµ½·Ža·ƒ Žk6G7sëÑï#6—¨ýïØ‘ý7ñèa6æÒ;ö‚àïC‘w±4?ÝÉ```;¦˜–MhÎgj‘ì&&X¢£:Õ´/!Tjï•×wÕ`î:r\ x®&J¯ˆL!Aà3X1HÅ¥ÞY±ÕÕŸ¡~¥l- KŒúý…ü_]8 z×U§ö—YÜ[‡¤óꢩmÖ¼¦zTr]ù’ú4ƒÙuI:§ZõêXh@e+¤£o… ý#X\ö†w2ë&v]‰„ÁÄÓe›ÊÆŽŒ×[Õo~>LÊW‚ M¤*bªGQä¾aêq!Av>i šFsÁÎÝ5I;Ç‘€Æ5krx§¤‚`DõH~G1uÃIºƒ‰(%\¹æ«ÃBø¸•Ñ0&Œ AÐÛÊŠü«2®!kw‘b™1eœu‰=—hÝŽiõxrN¶ü7†?’°{5 IDAT/½¾³ÂSNBM$e  °`)Pø[ òP8'Åw ÞÎPdG2r1‡"#ZÕ ÍyÝ·‡0ÂÃê*±Ó‡~à0ù]¹'š×¶qŸZ¹låþºDæP°•â™üp[Šù¿ÖŒù‚âÞ* k,/Ÿ"¶ÓêôÅü0”y)LhDZãœQÀM|ПN° Óïýß©9ïÖR%§„9»YÂSÉ=ÉÄ–éI¢àö`À`àý¼0–/üPÄ´ö$ïáž$Ù<çV±®È+8läåq,•ØZÈÔöœÝÇÝGª´ù¢ÏŽfj*é.nŠ¡ îf0ðÉvÞÇ¡h6gcµÒ½>a—YöÛõÍ,8o÷eÑ)^8 /÷àƒ‰êuù®kKy¶//»Ž …‘‰œÇ ‰"øk z,fÕy>γ™D×¢­‚dቖügOb±ƒtÌ ‰Ç·pnÖH’=<ÜOÖðxª¯0cçTž[ÉÊü«ë0x£7ï'’å¤KO¶å¹c· #ìÖh:3<ãê]{é§zò™Í8}S#f4d^Ç"ï`¦ pBb¸•i¥×1PFÓwpx-rÁÀíùûr^ÍäÅ£¬È¡#ŒlÉ“ÌoËØ£¼tŒ/n§V"­êS= <âO’3çZGciõ!É×{LùüãH.ËR¼ImbؕȾ"¿÷öŽ<8œÉ‹'¶™ËÔµ*#ü…C”pÛùËV¶­„j6N_bÌ:\¶hþZ›¶iÎö³Ì>ˆ0|–F’²IõñG]à$±€,;™v2í\.eo»ÎrJ&ÚÀë»Ùpž4ù…ì.`_6¹(vq,‡³%Ì;€Ã‚ÉÍìM<Ö‰—’/óÞYê…cuñÈ ìÊFvóÆj†’v™™{ù$ƒ6gðü ¢‚ÈÍå/'xº%ÿ؇ÓͳGPL„X´Ÿ—RÕ‘‘ápy²÷ÅíròÏÃxL„X|€§€D®“ý—U/'¥nŽçr²Ø–Hdäð\2ErKø:™I?PbP ü×Aλ ™%,IdÖ><¿JÃMˆ§ìãàJ¢ÐEb©vpy8›Ob‹ã2r.—%lÈÁ û3élj$^É¢¾‘·÷3?«JÇ%%l¿Œ ììÈÆ-‘œÊg™„Û(*dúŽ;qñQµC9’Æãù&‡šVö\âÍsØÌdäðçÖ²;‡üB^LÆbÁ¢ðòNe©",«=¹ ѪY)sø5#ß¡V d;Øs™™ï21IÊfÏ%N9ñ¸ØŸÏ?:Òa!Q¸K¸©UÄ¥ñÈœÏç`>Häf°>˜ V%1?™]E؇óٞˋÎؖϱ4¶dW)n| D¡ ˆ]9d^æ­ÓÙÀÅÓÛø6$Τ²ÏN 3îgõYNØqÙYšÄŠ\"ͬ>ÆI+äh!‡Î±,‡H9yL^Oš%ÅìÐ~‘+chÃß#ÜÈê¡<³ŠÝvl5±&lÅ×~Õ%˜­·rÇ2J< ëÁ‡µ©¶\§_\ÓOüãá2ïÇBÂQ¯«ŠÀðŒ?»Z'³g c>&åÇ=nBÄSó=²¥«uÍôãGþø?›!?##\ú¹úïæÅ3lˆÇá š…¬¢øº‚“±³ˆâû(ð`v2\—5? ¬&ŒF?±’4Åߌ"øç&>Ëúy[f¤ó?•Zì7ûªqb × «îÂ=´úòÇ.^àÿTüÚMÙÆÃós1¸@@™×‹ë}*ªIŒºÓŒŸE»Êüú\~ |âbþ­Iÿ²ŽØügWÀhy?š±yà üh7?+#\úirÍ ;ÊøÙa©ô þ>Ó•;b¸Ñ]3ü–ÆêG™RÕCh‰b#°I×Ì2rSÄÿža(²Ñ,äÆÐak…Ð<‚˜€”ÅL“š†U£U`2Ó2ÊGI Ñ"’HÉûoóZDªŸf•9ß‚ˆ â"iòGbÉëø=Âð#V`p(Ùãy£¡°o탮ùÙhŽÞ…Q¹ÁÂ¥2Ú7çÛÎ7`ø¯¡¤aAÎOæùúþu áäMeí@VßIÞ½<]¢I$¦‘ùÄÄþÉ$áíd!ù>èż^ÌëÅ¿c+ÖÒªùø¬Çp ‡.qtü†àÞ 6£wn3â”ý®ÕW Bv2xSÅ°>V#È nÍ:k2`’à–½|IRsú‹VÙ$¼ÆÍF„À£ IXŒHà–Õ+ve-´Qܳ£„¸ì>BM}01I[Qït±Ëj\²zëÌhð©ºLƒkÌ“µ0½‡l&8”’±üm2Þ _ÞÆ«xê4È<;’/Ú2ê˜ß픡„ÎÇ1SKñ°h|Æ{“|¶ÁH¥ôþE ô 0qdmß'Q™œ:ä`©‘BÇïH»)ˆ§« cú’9ácÿ³Øx¾=/u%Lò*ûÇsi4ŸÞ†k¯7Aë&¸ãY:€÷"Ï ¸¬*{&±þ²ãÙÙ¯¢¢˜Xã´6yHžÎÈ0¡h&§†²zžxj7•—îâì(ZñÏ;pMäã~œ™Lò`PèÕ‘ Z´Æ=ý94 y"aÂ)È#y®ËF’u¯ª/<6’ ÝýÓ:ŠÂ d#H”–’mdÕÏD×½k/¨±(Ö§Gœ¿ê!þ²â';Æ-fk©¿ÕÂv(¶ f$F‰Bý­–—ðpŒ>iuün´ ÑË(ž€´€Ïâˆï'”\vÙϽuyx»ÏSÁ,>Ì[GpÃM-8ÐŽ‡NòPoÞý†ÙYje„2ýC8 ªEé0Xãg&¼xgêYHuGÓR>Ï╱lØÏû@Ч3'Fù Bw„º§ÁÃÒúô_Ä&HÜQßge ±;=>b‡¶Œãéæü%,|²’o’'aSpùÏW¼ä?Iù„wYµs׀Êõ êšpYcÎ\vRË\QÜÛJ¨xfaY0ú+–åzs†Y(õ9È?\Êýáú¤Õñ»7€DI6OfSÏìo8Sv²ü°ÍhÕ88äæÄd"  ŠÞØÆ‘»è“ÎßöòõYídÊÃ;±—€‘‰Å'Ò³‰5NæTãñt^jÃ{ûÀÄ5É/àõ  ­f~«Ì͇‘ù©lφÛÍw)ÞÅi²`”8äTÙØ›Š ÖƒÅPC" ¡† .„¬³Ìë„}ß]¢_öƒÓ_šH>¬”»¿ÉJaP&›3q Z´$y4µÞ#Kòn<…O¥¡ÎÑñ;7e†A˜£PeDÞýD÷•é#í:±±­¾à¢›Ú 9Þ $O™NûZ<Ý—%6-&Pü÷O‚æ 8>XÝ‘I󙸙‚><þ1Cb¸{ @,;ÍWv5ÿÛ‡ÔG‹´-Æs«YNÏú|sÖ\j~á§M”¯V§BMs¹å`dæ×ü'’p#S7s:žME>ßÊ\†j&UW·í¾~‘#Q˜Ïš|õÁãGÈèE÷–k$âb§æÝNhʾ"}Òêø=Ùn–Z<]ƒ ysMÍ`"ê¤wÞáT ë3£°ûÉÅ:èUS½Ú­El9Ç€%l50;:ЖBâDšZ²ô> ÏRAÇ6ÔÎdW)¶Q;”—9Í<Òò*ö`p].ðeõçAMk‡>² IPCR¥C·¾Ï«’Œ H¹•ç;r&›ƒ—qQ]f[ÙÖÉ­®ÿ=ùô‰Q×ôãXºF¿ž«n÷ßÊÛåg^QÄÀ »vÕP"£C UFŽâý,}Òêø=i7‚´ܾG)÷&³ÿ6"¿õ¿ñY ï%ódOtÒ¦ÆR QLmHÛn,,åÝBÃhæ|T©²EÃä'>>ÉgUO_0ð÷-œŠ3”cnêÈšMÌ9ç“ßÍ{Ã8~‚eYÄÅPÃÉež°„ÂÔSÍã‡iT‡aa4< AÛ?ˆIÙô=è#ìtkÃê¬*dV[þ²Jõqf ý¾ Õͽ›)Aó£ÁäêTûàñQô?Íí‰ÄómUÝBÄKû¸ïfŒ2uatG»ùþ R<Šº'9åbRk–ï&Y!¶)ÛÛRs)ºïæütÞL"®!9çÙZ¤Kéø­¢#\P-†Ò,>N‰cçÈ £¤€Ë>ol!ȳ³+ ØÍÎLÒ3ø>—fáüpŠ°£„Úfþ¹•dõ‚).aÎFθ@ ÛÙš¥¤…“-™(†Š+}:¢”…§)$ò øo2ÁDxsï]‰";²(VÀÀ«‡°›©ÄùËLØ„CBVH/`_‡Î²:Ÿ&áœÏfìFr…·^aËÃÖL\f9yþ°ÿ43œ¤^Ä­øíDtýÆ×q3ägäLýn õVÕ¤*‰Í»Ølþ©ûO>qËu‚¨Ž?‚íFÇ•qeç e@?ñÖñ7Š7Ò/g¡TÙ§ ¿2‹©¢ ”òc¹ïâG=+~B:tü¼0T5‰ƒ,üçVÄ}ˆûØ=ˆæA×I„a¹ÎG,V‚+ðË=¼q—Ú ßÏ3Õ~MdE™G²¿X÷!ÿ˜.› ®ñFÂ3¯',€¿.q#ÀFÑÚÛ‰œ‡ô6ïr|3¢4^ï§ü‘ ‰ oßCKá urõGàÑáÜTQýzðk¤wÞä«Ö«—tþ~Ù¿Á¢ê¶]¡öÊ¿r#E•‰N™bœHïQ`¼¶ý»ìNEš«©›×PcYzï8¦J9uèømˆ‰ã9½ŸÛwP ÀÌ¢Üù…f£…ÏïB$1š›,깤I ®Î’»3ùôfpóì½L4sh‹b@` e×=ˆ–vÆ @æÕ¡¼Ý‚çnG$°ýVP¸{ÏG±lÛšû/#˜À„IÂh#’euµÞAõ3°D ¦Q·93ðLeX¸wÞ׃¢M o„z+o]‹šV4­sibK;#•ÅÖ‰DÌ FYÓQâ ‚š-wsWG\ äÜC3³ŸYGÌ"\V |îVDIC¨®ÅJŸÙ OÎ)<Ú„_—¥ºˆ©à…(™‰<盫n E5­üp/b:Ï7Óº&3¨)«“)M`Zˆzùð\ÿ©­K¿ÍT#cú  oñyȘJþLóh¹‘Ä)Ô2©~öW dÆ2¤÷¨Ñž×byz).‰›ç25C¥ã™¸Ó\NÕ&µ/(8\Ìî«kÞgomövâëUœŒú„Þ'¯Ød ¡ð•ƒ×ê© Ï´áó½¸ šPíj-çÛ{° ¼{/(D~@øR–et$˜¿›O/û—IâmÜü¦¸\‡µAAÈ``ekj- â ¾C„„Ý5°¦aËݧ852ÐHbS<7gašÇ¸4²§bñðPoÂ4— %É Mï®$~ BPTÂ^‰Ç¢UÎä·ÙزG½*ÝT– ô23> YpèÑ‹‘ͼùMW‚‘^/dl„o—5[Õ½Íùï.„áaÎ:Úܤ~3z . i‚ÈØ2¸l -)9Ú—Ä®D~­k6:~¥0ÔA´‹ÂÏYP+ˆb§WFtp{$ÿʉKe\VÔØ•åèIÓ[·xSbm Q¨ÅîñT Æ߃k¡H|yÎ>®L e:†²'‚Øl6C4@ªvLsB¦s(”b€KÓ½^ðh^Ó+ÀÊÅñ¤^`U6ÑÕx÷#çÊÊwÑ9 €ìB=‡Ê€&Öãj§v\•çÁ ¶|×™%I$–p‹ƒ!°üo g Õÿ J 3ª-I•ÕÒQÁ؆¬º Ò-ÚƇSÙ°‰àþ¾L‹FHÌßÍÛiº²£ã×)n8 XÒ†6{½žë:Äñˆ§ó õñêÒÜÊq{`[³ï‡K©¶—®ÇµT ºb³Ö%‘| YÅ÷SÀô4æÆò}þvÀ{edƒ&FÖ”ªÉ£æ’/kUɉ×FRxˆ®{A⎠Œò~e.±šZØW !„¹Œ .QÒ]4¯P Œ fmTFÚ|½+}Í‹Y ð~{"E`ÅíÔ@Å€YT\CbùøsUêMëljdô#ì$E°2‘ýF¤ê“\ǯÙv#èû%­;ñmWl ØéÛ’ýýØ•EJ&„1-Ü`¥‡ç«xèz€ÌË[éÒ›™˜ÆœNUÑÞehh™´¨G‹ÍtÛÍ…‘)9ê¦:tÕFǯY»‘pæSoouÇ> àLƒ¿âûË Q{k‡ñ†·‡É+8ë·`ÕW‰0Èüß9V&°v;·å®=\šI°‘â|†‚Í„j*‰ÑH”$²r³i¾=€$ ±æ›èa£çI‘µÌ Ë,ä&eæ•md­>â«;p÷ÀdàËÃÌ¿ ï!mwŸò Çg–3f,ÎvœË¢Ëל›HÒ@ZíÁ»2—gRÍ»;IQòÜ“/ê c¿6áŠî%h¼„C}ñعóKrÌZ϶‘<ãbÍ1Z¯åÂPÞ8çírËT°€'Öb€ý>øþmwª¿’I“álz¶åÜ90•s#˜úÙuˆ3]ø(–I§t)£ãW‡+R4Ë\·H•BŽyÔ &mN»À¤­y·æS¢,”I5|xcÅ•…^uû¸ž(ó5cÖü¼«Øä¹üãU¹IJàá¯X[„#Æ"½©5É—¸TÞ‘òF:µ†ù Š–^h-1Ó›È>e†6¢¨ÒGš ?³ææíA«å%´ûx&ÍA¢YËV¶ÅóhYÓwÊ,TõÊo´-ƒð©Th¥ýÌ÷ŒuŠ¦Ž«Í«Q4M–½ˆ:èK*ÿÖwÒK•ÈD¾…”ç¼rH9ŸzÔad;j\bm¾ŸdP,×Б€µ˜×e+—Y!Ʀ)PÉæJCg Ôk¥J+È‹ ú,þû`ßo¥DÚÒ¡ãgÚLýpo+D65öø¬:7ÎÞhw0ÖŸ­è‘ÇSªT}æèÐqc7S:tè›)7n3eøE*F©òpêåçˆ|­ý¿ÄèÐñ‹â—7VŽOGLñ &ó3@fÏDkô?–8VÄ,¢¯å oFÌ¢¦¢“›tüØ5:x/øUüí…*¾ºB €`LW¢Î"­K¥Å&]qùIWŒ°©>(uãR*}[U~©ŠœW~\øµŠtQ£ã­ÝLæÕZê‘êÑ)ü«©ú÷šiˆ&˜,ˆn³¨çâ¹ ¼9˜-@ÿÅþÛÕ µ/ŒgaïÂjÛ•Ï[P#1\­|u7"ówÓØ‚ˆ¦ˆa<Ú1¢iV—Â\C´Â=]QØÙ©‚¬ñðæ,l£nšníFÖm`À3“z‘ä&Ð%Ôgm™? 9#ƒ Òxö4´±v b:/6Ww:+F¢Ìàó.^~ù ñ̤`<·Gª}¬^ä‰Ø'10Ôo$ïëIá rÇÑ%TÍͱ 8'38LŸ{:tqÛŃ7LŒø† @·IÌv&z÷öDi9ͺ3súfªli½·ƒ?u¢f.é2_%3®] Ù鉅xµ—R^ßÇ 1¤«€Ä†$ú7e¤…ïJ8—Cãæ„° ›/±ùëÓýìS‘¢.¤`:ÂsÙ××ú­éj±Â@v õÂÀo6«ò‘-'ªÏ°2Ó’•Ãc «Bº<‡±wG€“¾ñxÜdÃßê‚ î©Ã‡Ø›FH}ÚšÀÁÐÖš%H&ÞˆSmçs‡3¡6;Ó°Õ¡£œ l­ÛntèÚ ö‹Ä ãë !Ò «Ç¶#jÞCi4êÌÓŸdœ¥g_ž\¦m|rIŠ&ºŒ¦\Êv ]K‘+ 4«‰ð²^J“•|?’…F<2SVpIÁlðgIjÙF#‘Éb!ÂXQl¾´Ÿqw’Õˆó<¼‹% U}ʨéSal(¦ù*VÞÍ—f¬On¦H2xÇ"ÔBŠé°–u÷²TâÒeZ~‚úŸ²nE1J¼²™¹é ¸w?‡gàö0÷°J hº˜wàêÙÈ×Gø<!µ}Ó‘=,<¤åԡリI N0ûð§>AÊÙɘÊhDj“öT@Æ /Ü—_nÖöåÄh_®³¬:£Qk Hzvk´$Û]™Hmð©´œÏ]™rm¬Dd7ù×"ùÎËÚ,ÀâÏ÷hÄn³ÏÞ-`Îß:tƒŽ«Í+2­Uü]\aÁXªxÊfÿÒÌ•¶w–@åûÊË5”l¬ÔKÕ•JUç´\±–Êm¶ú뎦kË©CÇÔv£C‡º¸Ñ¡CÇo¦+o·üˆH¿ ]SùŸ)j4¸k*\øMÿq…èСk7Ö•ÙÈßûàž…˜ÅÖÔ·\wŒp«ãu>b2a¡RE ŽY$„ÜÐ~KÚbÍ ×D‰h݈ôxÄ,VõÀæ“×1‹q6}:éÐq½âF€…¢x(Ôžô.‹¤NerÄõÅo­¯3FøŸF088@‹J4'¿t«• ]Û´¯ÊoÀ\!ˆ¸ 6–C·ÒâC¤w  ©½A™ÿ cM;.€GçwëÐqÝâFbÍ.¦÷6.{ÀÈܵ9@2±h8òLÎßMS“zÝöÐn‹âÃ;ÓYØÜü},“­H`a bËhä|ÒI]¥/æµ8þ>eúˆ!¼ÅÒñlj~mš”•u#‘gðUgõ˜üñ[ù¤5é<“í½’î¦æM'åNBÃ3¨[—“·Ñ¼>ùc5—Æ"Ïä‰zêá÷¡¨åW›³€[?§P€‰;7Q£ F‚õ‡i¼\w%¡CÇÝLõ51úˆŸÕfég€ ÓÇ [H·íœŽ§†k nÐ IDATvÉeÍ<ºÃ|ßÌKMyf9nè>Ÿ™™H6<“x`5a ÉnÀÙ> àñðP7lÄ2Ÿ“õÙÑo× ã>ã¶S×`C1á˜Âß׺¤\ .7ãnaéVlóÙY“Ä›A@$GûÒu ±«Ù6<\<ÏÄ$¦QýKµƒÇ0úkÂóÔº…‚ù}Hä€Dj›‹Ô{4‡0²L¬KÕM6:tü8q£ÅÏôˆÞ uJ™’L©‡ô,à -Úäß·“##d6§[K]–N·à‘¡¤îãH¥^Nã–Ô–@ðýÒd< 'WEF){D¹Ú–˜5„¼ÃìÈÅîàéUÔiFC `Wg=¸eæ&¶ÀÌ>¤ìãX)n7“ÕK}NEàÑî¤Ý»”\¥%¤ÛiÞÜÞ’Š•"qn6b&ÊeæœþXÐuèøM¡Êá‘b„ÇøÇßï`P¤Hó¢F†öTŠ> ŠÆÕ7{Sâl Q üu{*.Úñ]H¨‰Ëyíl€vˆ"¦¢7¥m0Hk-ÝnµÌáìÏS»v4nPÚ‰r.¸Ð¢ÇU´ñ»`¢{SZˆC¿H CÇ7$ >lÅ-¼^ Z7å>+/êÃØŽ³rÚx¯ãûÇÑR¢vÓý„–ª€ñ*1Â÷ž#/iù3-¥Ù.:$úÐŒ<(ç'C´‹¼Õ"¬ÃNÁäŽd$³Æ‚qu¥‰…$Ý„?Év#èõ57wæ“NXdpеûoåLç² Œñà =¯#\†Ú€ÌK?Э@¡z©’ ­@=ÈœÌbuߥq´HýªÔNíãá•hß‹#(„×åð0Ÿ0ÛþÊÚ¢ctî p0¯Zµ".‹xYEão©MmQìˆæ«¡àw÷Ä"HqP›¤@IY u£±סÝHØsh²‚÷ºá¼ í2–óeH4ø–õwó¶„QâÁï9å³xÉÍ6¡&y6ï´á““›€¥„‘«Á@™Ÿá‘f<‘Ì—ãx RŒð`ø4žOµó“‰ÚÂ={I›Ž’ƒ{¿#V¡Š·L«àüQæ6AÌ!£˜é»¹³Hl¿@Ü-8¦b[â't#,X$Y9Œ×Wðü%ï˜|¾‘>·"ÈÌ¥×'”J`E$¨YVÎøó^.Öç•DËÕc„ãχ.'IûÆ÷¥_9FxùSb„—±½«ŠîðWCŒš®«–iÆ`¢±•3¹`¤zs²;!-ÑÈâe\M'X+uÄ–JÊŸ¬Å÷ ûíô·pYÿÆc®ãj3äÇƯL’ûÆ·Þ(]K™Š•Ó¸‡¼Ù“¹{5Ia T¸õŠ5Vöz!U‘S‡×´™ú¡”Ð/x§3÷XX¼—Oý!:­C‡.n~”ä3yíªÇ:tüæÄÍ/Et¢kJ7º|C¥Ÿ?±´«]U9 ôÚsVN H ¿öœ:tüo`¸Â*ª‹˜ÅÈèÿÙá®Àj *&.ŸŒ˜åÿ£ùcŽ˜…ÁÉàn\ô“{…˜…äª(Å,:ù˜…Áå×Ùqˆq•ÚŽ˜…Ñ?gT3Äÿ;2OÞÆÆnÙ¤®YôñO”yx»zUÌY”À€ð*G ̤Ÿëëøy´Áò.|˜Í¿[°tûµEȾƔòt™/§ñè‰szüéÓÍÈ.!d‰¦¦]!:»?U»1Ñ#„WЬ M ^Ý»ec.NåÂhºi1˜Ì‘ìGÁDî¯çʯ ¢tïÀ*ƒ v döÌ$ü µ1ý$¥ÓŒu‰ºDy8ƒôs–c€›çóTnÅú=epÊ?e„OíZrò0Ñ‹øÌÆùžjŒ„Ò ¼¿‘˜%4iÇÊn'gP'•šÑu+Çãid©ƒ™ý M–ñdoõúŒÑ€Í`5‘6œÑËỸƒ¸#èßà ]Ä¿²Iê…UìLæÝôJÖWh½„aûÙ?É{¿ùðf­$f)ÿÆäšjâÊ®´]Âm»Ù3Ys?I"ê}Ì7yõ«=°®í?¥ßvLÖèùÕN½Yà g„ÔaH;Žï£Æ'˜ã8ÞEýùöæÁUÔZÊヹ/FU7‘r€šŸàiÊß-˜•ì‘üuÕ?f½ãC(Éç–MSýc„à¥1üÃJìbšϦ ÓŽŽ*n^©Ã„£`äÑdžì ^ù›ÝO·’ç&#ŸºŸq ¦ àÒAvPìbÀW¼J‹æÜ’ÏôDŠJÙ’sFÚàËLì2Ëwâ©N›º®Jܸ*Õ?¢?â~Äõ³¾§Úª¬"ö”bwóÎb uGœæó,ŠÝÄÃœDªW#Öň#º¹”Í.7Ó«qG7ŠO²>í Ðï ß‘çÆí"¥&a 3ºoîÀî!é<ÿÐ. o>Ê‹ivÓ6RìæP i&îWç¬à¼’R>¼ÀxMišºŽb7ÇÒ8gäÁUZ½B¡›—ÖC m5]fÊ÷»9‘Î)Eª9ÿu–"7ol‚št´ìOce!…¦­¢YõÙ‡WqÎNI óR¸§±ZõÑK,/ ÀAü ·ñFàÂ…mks‘Œ|‘æ‘ S"#¥nx š.Û((¥à2/žcb¬nÓÑq£l7‚ zÔ02µ#ãÀD1&Š/ ¸ÙÂ<]^‚~Ñ9®îw 솆B$â!oy£¢ÙãªÉ&YÙíT3D†òeodâ`ÈF€o7qg²ÏªÖXÚž¯}tàxºÚ»‹óNšGãô!Cíwp[J8É)jbVQqsÖ£V¡”‘Â%â$^+RHájW2[œñ€ z‡ñV À!¿zÒÎÍl|Ò£Ú¡+ôãc H¸n2¡±•2_Cǵœ‡<ô c.P¬EOwsšZr5Z™Ë¡†ØBâ]míi;³lªý%¿PÛj9üÇ`ÛxêÙù*SX%SŽdùÄ;¿èÑ ::tüTq#±t K÷°¢ „E2§ _lå¸B£P(Ö"Ù8PÌœPíA$²]¸2°~é„;²Ø0–)4ÑísÒäpñ^ HBçI‹N‡×lÇJ¹?Äë±A©«Ñ»`šYIqrÖA-íÆphP€—³¨`1dA´ œ1Õ®2Ž!erY¢Ä—šŒmAǘI)Q»ªI}«K!lÊv`‘áR–P( Ll*KÅ1LwÑ,š6d4xí¾åU×4“êPm½fm „ψ&ÜN‹ ¿#±M¹¯‹ßd€°÷)öhƒl SP‡ŽëÞL 0p»•ùúKϱ4…„ÝônC˜ÂWÉŒê vPÈœÃ}á,ØKl"Øyo$›º²û,–FTS_Œ[FeP%[ç pÑò&‚]lµƒ@@5ÃÎÒ–¥ðõyíõëñá;ýyIþXz„j-ia÷÷çâpÒr ˆ©Q*ýêV /fòõq´'R€ƒGÚTA÷—¹;²¸ë&p‚ë«Éu£éà˜æÙ8pA0máƒu$u78¹3†Õ™jηØèsó‘3m,à¢U¬vöiJß«7©±=»Àûyêv q­r²Ó У¸ÀÍè®”\R›6_«ú®º¬ËTcwªƒ¡,g7œ—¼cà‡f {¥3˜ÀMªáì<ü7VuûßÁL¨£o¦tÜ íæÎ~òÈðqyåºÀV…WÛ0}'ýïP7J‹ñn!ð§DògìOå¶= ·šïG²Ø@ˆ™×w’'ˆrydË#©afê -1kƒ`ñaŠ[µ†•±Ìæ,‘îñi­¢zR·¨6/uô|sº´ëÑ2µ_ÍáSuùâÖæ›Ó©îöI/o³Ë¿âû+Å:#\Ç•P%#<`îòÄʬèÊ4î \má󬹒vU¹ ÖkPÅ W U¶îÛr›•Iá w·gQSz¯ÇÂâ†t_WEÛÊ[R!’º­RbÀœ¦+öΨý¦@¿‹Ù_4Wnª9PN«O¢¹R™Ö«ýR:tüTSñÿû³Sg>ÞÎù<žéŠÉÍmŸ±SÑg‹¿~q#QœÎÍ鿵£S[O2à¤>Itèø߉›+wn,-›ŸQÝN•ç¿vQ…*ªªQg$éø pÍä™ü«–Ïp³5çëÝÀÍï݉wãxÞ©êÓYÁÂ{ 43ø%¦$P8éšÏtMZ#FBæ4†DA-ÄŒ+vAáL<½Â¼ÿÎésd¥cxfÖŒBÌàý6ú³Ž?”¸·‚,*¥üDµÂ!$Ô`­™GjÜÍ¥G>ítEù¦`‡q¼ìíÚ14×õôêl!Ë\2JY×”«ÁFfj·~«Õã­–-Û¿ýyñ¼·é}‚bù®‹.qtü‘ÄÍvíKѾìâ½Ë{W{Ò&‘>†ž¡jʘn¬éÄ»8Þ3@!ñ·°÷¯'2£«ßEÞµ£)̘pVd’¦^½{Åñl[Ƕäb_îhOÞTŽ #B¢i[~èÄðvœ¹Ü,˜È×qÚþêžé¨i Ã۲󰶙„F³ÿ^Jãù¢3<ŸAñTŠ§R4•âIØdÅ‘18ð°XƒX=’’©lˆ¤‰°š-ÈI¤Xã—oʤ„Vòn}ˆHcY™´†Aí‰Ñ“uèâ&¤éCô5 ?e¹Ç xêNÞ©F‡Ïh³†Uã Ë hÃgë辧²îÄì–|Äê“´l@”FV:5ƒÜDê}F½®ÜQ E€Â‰™ä$Qo1¯æá µ›bL¡þǼå!µ?gŽðj*ß$Òz#YŸÌ·¹_’ÆájÜ^¶µ±ðNcΨ_™#(Å}+©û )µÉ¿ ëG4XBýÅLKFvá0`0жn¤d"¶Q O§S2Y%пx39¡Þ£yâv’v³Ú@T%4dÕ ÍdSH ô×g¦]ÜXÀ@¸Ln Ÿl!t «MïÍ\.!'‹'3é&( iù¬)"·’i#ª9œÌÍ„^ÎeQ›•f0>™\'¯¬æ‚Ðõâ2xê8ù%|³Òú˜@ <¬Ê£ØÃû‡¯‡äÁ¡à–±»ÁÀ’½|˜ ñ6 N“Ðí‘z‘\MvÌHê!ö’çä±Õ„5¤©‰|'¹"jòy+êzE ®Bø|^NÃ!HN#ÈŠÜÌÆB­ÇóÑŒ>€9P!uL$Ù½ÒçDYõ™©ãwˆ*Â%©‚!ȺDßm웆ÙÅÎL­ÄcÆ '§ys椩ta{±º~êK?+H¼¶Í¼Õ– …¼ÜÔ·Óï&8ŒÅ‚"P4æw¡ cÄø‘ËïŒäU%Ú6ΆJ"SªÒ’òÆ>^Û™Ô‘6¨qï€Û¢Ø³[Ëf'šØ8ãÀƹ!Üú1…Òí)‚Gr§•SpIZBˆpî…ýC¸e!Èy´Ï>W%  }äKu(uë3SÇFÜœ‘V§3½:P;‚`K2¡IÔŒd|Gì‘>A@¹\r«ïyŒªÎ$´õyàÙ@š LÜ]‹¿mR‰E;²П6ÖÉ^Wå(˜ÍiNòN½Z[œ2X¨_­Ê5uä°ÂÉÌX Cʤ‰F¼<á O˜wg…PØu/®eCéU§»·ænô˜±†p_,úwáûÈa͉“Ø=ƒVˆ¸i®÷ïG—XP΂AÄÂöB”¤ã²™LßHûž '(¼2Œ¨|>Ì£C¾í2Yy¼“¡'=ü«( óÄ­$4¨¨Sl;Ã’Ó,9Í'#{cNã¥ã,>ÅâS|~‚ûNðòJ`d Ü4ˆ#Î °âQÍè\fÈfËÝXDU»ÂjPͦՉ­šñÆqþs+?øG›zqº‚ .tÆTÄîþ=œÂ#1Âˈݾ9=êíµŠ¨{[¨üìêÁ\ÎU×ç©îÿš5¸Ýe Ј”e¾cÔB H„£Åpúp£‰Ñ—V^Îk/ë—BEŸ¦V5JºSëšK+Ê£µ-Ú¸(^xy4tüÉååñΣž«tF¸Ž«Í«ÅH 7Z•éÂUl  L•%®¾G"!¶Í$væWT 4À ¨"¨"h·5P|iå†Jìm[Õº`åPâ¾#`©zH}_Anѧ¤Ž? íæBç¹l°² /à [@¡NÒ¡ã÷o»ù¥`ä™m<£ÿ&:tüÅÍÏLÚ®ªjÆhÛUIáWŽÒy…«7RÕÍæŠüoéÚF¾rþëeÿâ?¥WÚL)dͤÛÏ2Q`Ô|\.Å¿b!‘P1`vdSĸ«1$ý‹}i8"Öþ=>–€3^ ¼kà…Ì@$°g Ìj3ų*ÖPDBÅÏ}5+µßÈÜÛ ¬îQ‰§.þ};®6ÄPÆ ZÄ!&k¦k-‘@´ÑÞ3'Ñá¼:”Åí®á‘Ì?±üfù©ã×)nßO浕ì,ùÄ}:6Æ}óg®M÷¹(Lká%…GEÒ /÷=7˪ÍÇ4—× 9OE}Ð÷¼%|>–¼Ÿ÷³+ê‹öé$ažÇÉÚœïáßN™&Ñ=Û<žÊÆ>5Æ!qüؤ&4n 0M#R7!¾Ëç¯ß3ýèµö]wF¨ãW)nR·ñÚ%õàyHk.Nâà`êjjÅpdy“y»ª|{wUãÃáNâᘃØ;Ž‹£ˆ•@GÁíÜÖšËSHJ m™¬,Aþd6—©éS0KäΤ…‘wñ'-ødD8‰ã8=‚ŽÆŠZXߜυ1 ŠT›Fþx •Vؼdn£9HôoÇÞƒÚ„eä'ñdX²f_p9Й´[Æ­x?ŠÿÐ5ª‹§˜¿¤á<ü5Mvù ”ÿgï¬ã£:Ö7þ³‡„„œàîPÜ)w -´T J{{ëÔ©Z(Zhqw§8Å-x !Bdåœ3¿?²›l„ʯr{{ÏóYølv÷Œ™ç¼óÎ<ó-Å0A«Ýè’]ÇpXè`‹Ã©íç“ŽƒÏÒxÌsrnäuo@Þ§jqñ8é:ÿnËûUÁ}Š™ýƒHDÿ/Á¹y£-É#x«ŸR~܉”áœìNi’¸Ñ”ÅÊ!G¡‚$"Œ[ý@ç‘{¸>œ«èWÄ0Ž üt#x±3Û·‘)Aòt'¦•¡Á÷Œ9K샹)S’›Ý¸Œª‹¯Ã¥ ñ7ñ][þµ–Jëùð^v¶¢ý÷t;Ì©aNà2TH¦Â|&'ßÓ³KåÎpï£Ê"^¹cj¬¨4›³n‚­xüÖ¶tXÊ€#™g7ÏØ,¦õb®gÎp»™{Ñ«ÀòAÖ v‡Ð/Äc†Ì®Â°³ÞïÒqÞŽD*ž ’ ‰&LvH&—Ï+/Ý´¨ÅéŒiÀùAL«C–;Ã¥nIÉÞµpeNÁ÷1$ª>é˜XwŠ:e@GX裰ì*Ö²ø ÐèY”¯‚B€• 3H„?µåÞ%ÔZË¢ži×ìtvSñ;–™y³‚çΞK¹8ª,¤ïa®Ž!B!S¥FH†—'KcXqÔ,Iz2=:ñŒ™†‹h²š¹hl0Ž?a2õxo^÷¸ FGóÄnnfq(†šËÀÌ£mÙ»Ó™ÜÊbÀRÊÕ ˆðÉQn¸¸GÌÝMš›3q˜-­Ÿ|Kš‹ù»Ð#hdðoxý©*Ç/cµaƒd'@’#dz–[Y¾ÂÅZPy±"=·w‡›ñŒ9ÈȆŽ,Ý]È<Åffú)ª’èd%qÓ”K²Eç²A'n ò!Îö§WXaÁ6%ò䣹/k^}CÕªÖæö º¯'¢&1-ó8˜‚ÍÜö¡•Y” ˜´“y™këu"Ã1k„áÌÂ¥‘¨SÎ fjû³õVþIåÈõÜv—†&)cŽáL8L’ƒ}'™›A5=pËÁ™X~ÒÆç·n:•æ¹ŸèX $ëñÅ>¢‹b±—B\Á_³íŽál6ð»PøÊT \q{è¨ÜÈô È“ iÀžÞŸfà†"&€[NOï×ál¦Çe@Nõ‰åíÈàËž bî%Âç—…á¤Û0ûˆJÛ`¾öZÁ°u¨wáEàHò8} OKðíQf ‚- lÄ·;óì­ËÈä©<µ‘REhZ–¥ý¿”/oæM@ ¾ÌBÛ:wX‚^ß!GQúG®yÇ¡ä3A‹¶{´ïùi_™À9…'Šr´&'~˜|›g"x>K ' œ›sQ÷œ’ÙM„Âm—'ñkÉT•Dø‘åòæ%8àäÞ¢´:ˆÖ€±çiÏò^03Ö†%} e; ãJ2ßç¹S†pÔÀŸ@7€Ù»œE­ÞU7˜¸¨Q.’<ÞÎ_³Îj÷DvËŽ„ä¦aU†Z_“1îêÈ&½Rfvdæ·sCÝo8šå}Î+…)'|‘Ìœ &UæpÄu½ëJaÔÂóMã‡Ã¼[’NòÓ `7á¸{òû.c ñ6… 7yθ9™Fd€W“!èlçåø»:Âß9Ï# èY…§f€dú2›â4ñíao¼Ÿs“‰G&†NP2Tü|¢§—·ëD¿ÆîԬ̉óp‡˜pª…‘rÕ.&®a¢‰%X{g™™`8þèÉT2”7{äP2ãk€,ÈG¸×Â'‡éØÔ—zP+H$NýUÌVÏn¢«àfgTÕãi~¥€Kõ ·š³ÉÛU=%›Âô”ܯ¥óïZž•ì‘-x¶"H…ÆÅîâh03õÿnÏÉËyÈ6¸4[Ó,È’< ”!e8~ýWøn´JÓÙøY°)ž~,Φ”`Á!b4Š*9hç%¬é†³ª…«±4Û²LŒÁ IDAT ÁÁìëƒijo±ÝìyÚï9C`sÞßí)¡Ípé$ã‚Y>ˆbÙ‡õ8ùp7/]ð³àïCËò‘<­µè yŸù‚;itÞω1XàfU¾G´©Ç÷¡ˆ…`¢ýìèÆÛv²2鶷É¡Þ4šËÁÌ<Ìu>™©^íÜÔ)kæ§4ÏŸ63~Þi£ð1KMLtÝʾN<Ý–„T¦_ ’ ²(¿†íøÔEQ?ÞÝÆ(|t“¥•˜xvÄòJ3:ÎÉ‹‡Ù=„ ÝÌ…›¼yÝ0m ü.¦—àFÈtÒ¼ûÊ<‚ î+¹Î»O¨l;E*øÄ÷M§ :;¸µô¾1{#a[½ÁË­táªwmÛ’{׬ጘ“wx¸|’¾¢ðUwŽúœ¼z÷‰yvu 2¶9?_{ªóU¶Ú;ÇQäΨ[òb¯àTu®l™{î…ÙÑÓí>5ʦc§O|ãg7©Ùs¾¢çMÁèéÙúؽ ë.Ð â.¡Á}Šj( üîªɧñ|X‰Ñg½ÝÔ\`–ï+ß?ý|’²ÿêáCSç^ûó¾ÒêųøSòJzYó8’r+b÷)­µp¯Sžêü2‡ß=>wΟ–Iƒ 8h ;MʑŸ]y¿?Bƒµtk‚|ŒÄá¬é€Ÿ 5ú]fMkTž*Í„¹²Ã‚ÈŠÅi£¤Å¸× üé…æÛYØó¯> îN,¶étÚÉš+ôù-”—‹þŠËDaQ8|•º31}C§MÜ í©µd+þ(bB)Eu KnýìÚ“F&…ÅØ3`ÀÀ߈nàòif2£6Y¿rJ¥âòÊ‘‡J~ÿ¯rIj'Ìft•Ã·µsåt³_åá¢|Ñ’ùÛÈ¿&= ü‡aþÅï­B嬃#¿bL׭ÑÆD|C‚›â¥iã@P&œÒ.v§x¢k:t4<ºdÌ( u‹r8ÑÇHÑø²3¦K´Ü†¦ k-P¹äÍè¾mÄ·$%”ÖW|vܸAGÏmgk‚LBšÛ¸× ü-éÆÏäsJK:#N0«f®à°æIç̉~ú‰ ¡ÄÀÍ[¸ Ætâ…XL[ønüìTƒ«7(»‚àõÍ+à6Ór?tC}ØóÁ•$z.Εó$Åàî@è NdyM4 îqžúÌÅ,xe¯&\K×Uãh(þø‹"Ü™7’·.°ù|âß:t¯:GÊ,½Úe‹WÓì;™³‚Æ7Ã5§°ˆÚªWÍ\0;G^maA¹¶›F²e oÞ2öÿ™0á~©‡Ü]žOˆlòygÃö³î [m?w¡ÕŸJ±…%Uh<òةؒ°â´Ð¸/Þàþóø[L0\NZnûãA(nGÔÜBΨ1`ÀÀ_òú°””ýθÅ üéæU×›Ùà²H‡‹ÿo"úuÿ³“)Á†Q|[Æg¨ü4Ž'Bã@ú“ÃÄŠÈa…„Êü‹®r¸çLÕÕ‘Px¼_j~ǃT³‚dHSÔqŒ.aôIÿSt&á£Ìþä7=t%%"‰ëóçï®û­®§?°<ÞãÊÛÔ£mÊÜ_ 8s7óR OëÐ~>ßÞ2ú¤ÿ1ºùy¼×žØ!ìíL¸ô`3;sm(›Û)(Zœ˜. ãB?°riù¸*„;½ äÐ@Î÷¦©Íö"líËõ!L­ý³´>è 1¶[Û{d™uej”Šâä Nõ¤”w³_p6÷âÊ@&”öY?ö£Z0»Ñ?t¢£ØÓ— ýî-ÎÛí¸:„»é³öf[.e_Wj™=‰W­ÈÑÁìîàYa+WÕõ°„“8Ü 0½ ×îgc¯òC§mŽââ&–öX|Š…%ݸ2€NþšÎÑ¡„ÀÂÞ +ž¿µßjËÕûù¶¡×ZT\˜û9Û‡.E<'¥§ Ädáð Îö&ªEsi[Ûüõ‰ÿIºqº=—²_9Û)Ž>Hµ$Z,gây⤈ TN ç§Ó´XÆk7ˆNr£rã6M×`ÒÙtUæ·2Ù[“.Ër”ƒ†-ÇÞØF³åX*s½?\¤WUÐ@á¹ ÔŽô„x»ŸÄ#¯FÒ}5³Ò¹ØT*•&µ7Om¡ízFvaNy€’þììÉSëX—LÛºœkÍèõtÚÂÛ½y;àÐXªÇÓzãN7š(ÀÍŒ”I õ2>αQØ4üB9ÝŽ1kv€m@çÚy>M ¢—ƒ•¸1¸ÏÒr%“¯ã ¢ë²¥ýVÑn-½Zóy\ÉÍ3´ZKÍf(“Bë¥8`Àrær·g Ui¿ŠÅHî‰|Ô‡÷‹sï ºì`IH;ï¡Ë2žŒ#îú¹i´˜´|]Õoøá®+S£º3ªÀ‡Q%¨í¤Î°pùgÛ3&„)ñD˜q;¹’Ä•4üÏ Þ…¦‘ ðà¶Ü©‡ï¤æÉÝÄ›ˆ+¡’a¹z”M‰ ½9œ°\ ¤Ž•s¡'°"„²pÃBœW=lùøîÞ=Ì;ýÁÍ m™¿Ÿ’@Rw²#¦!%Ÿofo2¨¼ÖˆI+8 ’¶ë9Ô†çÐ~6)i(þ˜Ò¸5¹q›²Äj\IäJ*þßàTx¬çp `ÔEöUASIt¡©¤d‚BõY$§b $á<î–„˜¨X ç“AÐn>ŠNT Jf2þ ˜ù`ïHÉDB|™znEDp qL¼·Žý‘H¡‘tŸKL&¤ñÊ)†VçÃÝã¶qK°ñJmÞ½ŠSòÁuƒ3†ïÙÀßžnf­bäåÜ8DG'xÌ„Œ,ïÖ;Á>']Š2å6-×°´ Ÿ›Ù~ídZˆ£ ®ëÞàM`ÜÊÞ½Þï2IƒªvVݤOIváØUæ+¼TŠçMdÆâ–ÀAFöžcÕ“W?*·£»\ëÍ"@pÂáùA´‰·{ò& QL˜4€1-y/šu—¹í&L,Ü¿”E-Ùƒö³àŠpð–'ãqP5¿ÉöBGžŠbåe2tÌ Öoæ¥6ÈGˆMfÉy& Ò g®Yù3ÆG„?YÎÜxçÛo‚‰HpzÊp)ƒÊ%<“¬+Ù©eOà@¡c5tðþ+èÆbö {&<£#]%À'Èt+q.€³W¨>¿ Tg÷ý„~þÿ)ÊE'uýsi"ðC,/”B/Áìuœ ¢GcŽÚxwó]½·7añ÷ü;Ág([ïlN’OÎá»;ÞlÁ¼W"SI•àæj%Ïu ‰´ ~ôªÄÒ^ìÿŠË.jzã.…秊ò¥x* ñ™'^¿hïfò&o¡V_´c‰‰g°+žkÅÏZinŸÞÒ3©t‚ÝK+E-ÜÑîš„aÓøïvŸŽ‡`:ùƒ fÚ(¼¶ôÀ,ÈJçÛCèPÞŒ”˜M "µB9SÒäOÇ 1epØÉ–ó´(ÅE™“J\*Å"x>Œ“ OÄ*˜uš‘-='_©·Ó'zl¶ÛÂæócÛÏ&’½_È™7ÄuŽÐÜ'¦8no.¾ÑÇ]^=zÎå9AÍÍÞàâ*èÞâù†<ÏnÕ{ÞsN¥r‚ˆ[½R{ïÕ{!>­í³Üí µnñÞ‘Bc„»sç’: E¸_ê!¿ZÎ/Ò.Tn/pm¡ßŠ¼» JÆmwyïûãŸO$ߟ…æw‹8n+Ì4ç­—ù.ßæ·ó¢@øsß7¾‰ÚÚù¼[cÇ3ø¯öÝ0`À€A7 øï¥éùÚ³íã/ö8zWÅ”»RàOñ§[!OLaÁ\þYt#Ö },ÚX´±èòc›ßßî÷@åÒtЙޓé5~w‚m,½^á‡Z’ÒùgTGòÉ0´±43{iEgï`ÆFÎGݘWÇèrþwQøy7µ2»•¾%Æ Lü8œYôØç±è ò®•˜Aó.N™¼K*ï~_“—Ù¤wUHñÉ\÷Y» )g#Ã6Æüà“à¯ÉT²ðSGu†µà³(üxPh²9uÌ)ùݪ“¶@³Ðè [Ú¼>ïw&&,á]fÊi ·w-/'G³±•ÆÀÿÝvÖãù¥Ä8<ý^j´›‹¢¤cV5âèMjFw…Šë:'G±&ŽN6NÀý%¨63vä8ž¹L3!‘Ô59·Æ”ûxª{Rh΋ë™|Ì\J…+Ò ˜Ñ`m/[Ϥ¾È Œ=F·Æ,©Ï‘[ÔŠ$ö•7€äâÄÒÅÆ…Á‘TžÎyeº‹V§ ¡Ñî˜]¢ópyG{ùòëÈ©›4(ÁÙ³Ôظ<k*î@ïPì;¤?r“¯S'‹ðHjšˆšÃ\Ö¬* ñ9AÐü²|çMõ$ô GK20‹ÆÛLÔq„Ï )„}IK$¬êM"—ý³ÏY4`L¦r¼…ïRòP¦›tKÑ`—á?ƒ²eiç·›iÔYÎ¥|šÄKÞ·áGé³…öó 𧜕"y*’À¯iþEWðzGÌN4Ã|1ˆé\`b£wô^EŒŠ&Ñ%¦PV6 Î š,Ãÿk*•§• À¥Ò*…ú+¹ 3’™T˜M÷³…TµEmV4 Ê|rj¦Ø¹Ø‰ßÒd9æ¯(Q‰öÁ ²ä>Vï&j!egðI&;[{ªSå$=6qÏln*ÜQÀ £0·!6¢¹Ø¬ñz±ü?Ð%(,:A£RC¦R H$ÑÍÉž¼±Š*‹)6•v¾¨e¸x üX7ÙþYÀ¤—T CKåDv8:Í:ƒŠ²9³¯yöÔŧRÞß3Z>¹îÉA—7Ñ¿6 Í”{hxºðM:ÌàÔ=9î¼Àª4ƒk üÏX7OÞä‡nØàÊf¯ö¤w&-Nã*XAÒÊÂÛI¿a`,¾É“Eùê˜A§Dq.6¥Ð¡IÏú]b®;g1wòæ+heæŤ»g“MLJ~UèÔ_ÌAMbÊu’²@á«£c§d0×Ó@çŠÊ±8¾N‰Õ‚p{vèvðãëL4µ³-w–ñNŽ;9„Ã)û)W½9¾8„%µ¨¶¯×Øæ“|וè;$\D“ “!YÃÁ,ÛÉttcàÁwÀ§ËÙΑ¼Z—«²v(Ïá¾í¤Ýb©›ChS‚Çî¡DÓSCf{vq9ŠoÓ>ŠÚq£H¦m瞌¯È ê,kÄÞt0jXEJx÷ïÇDzJgo{Ú”à‰{Mçë´»ä!yö^^)}×2¸R©»÷ºÑÚŸôT¾Házº•d`ubSÛ̼x”÷r:—çð|ZÙsí3=é]š~5iáÏÔ›`›'¸h¯ÊÄÝâjÎ'V^_GÕ)Ì^KºMŒ? 0h»‡€þÞnô+Í}Ñ\Îã% ßÿ߉ÎshU•Q婬±r?]Î{ÖkûÌfd&ÖæäM”™žÇþ¦k\öž_u&Í’WpyÑË.‘¤ ü—<Ñ„Çksþb˜‰#ø{>­ÙIåéÄè sˆ>•ØË‘8H…î³Ý'js,ó,O¾®rÍ{ÖÔ‰xB<&KbI÷†j9}û~䡆lßÎ#‹ØP‹a5Ñ2ˆšNœ‚•û‰ŽeRuŠ+<»Œ5IžìšÌçåvD›i6›óNDR-Œ÷ø°·€4fÅíÇ–k\ÊÁ±›§z~?`Ï—`‹wºúå&V`|B4ºÎcoºaÝø¢0E¸ÂhYŽ"b*  ‚ÂJCnàç{ÈÔV†fÊ€ÿáÉ”|p#>+ì, üjÖͯœt\cÀÀŸjÝÈCî·LÕ~ó%H¾üU…ügÆ€¿Îº‘ n{,rrr,;ZýE¸NŸÆœêøÛWs%´Ê“ï–æ¿Q‰®ñhWªë¿ª{ïßfÉ99“jôIÿSÖ¤F}æW§úNg‚ÄlåÇa,sÐk?à•tç“P«>ºêì຅Š­5ñ·’?ß: ù¶*•gs>Ë“ïÁø.‹A‡ï’¯Ë«Ò–Þ@UÆ•b•Ë³ÑóÊ©¥Û˱ùêíÎ-yžOØß<—¨^í‚¥0cÄWònÊ Ô•+wPrùΣ/÷IGÏ>Ƙ¼ç@çÈÐMF5ð£Á®¼¸ŒÓ™žHHª›¶óQTÐÒŠokp4‘úÅظ—NGA ˆï)‹ bÈ›´‡ˆÍ š?C¾c~:„pµ?j !EɺI©¥ùÏÜÝ]ŸI‹9Ÿ•›o«yHtº4bYNÄS£8ç/PkH.=Èœktóら~Å(?¨ s{1gkKp¥Q$ÆPn=_ôàá(öߦ~8Ów1þDnÎïŽfl Evç9€âýÔQ©†4†—¡Í7l׈(ǹNÄ%R<í%—à2åáš*•9Ò–ø4ÊðèR>O¢Dy.vâÆmŠ“G¹ž#Í ¥–Dp¥Sa!NÀÉâÔ±P!„Çé¹LìBKÁ1•h µpÉ0 üsèF‚B€ÂÜäEx¢›êÞð¾ÎŸwô:=Žà0 Éî\þJ ö\º¹´¼.g¡x|)ÙHU)k£O+׸tfÐdn¤ãì“·ŒÀugv“èàãÁžkCNçØS¦\6×rlLŠAºFwÊùÔ^\ÂSøgY7ÏƳä>¬ßym /vg€ƒÁ×ȸÍ;1 °†z9A#Q§¤?'Ó@e|3v*Ô^"M²ò»2@hÃáDÕ§¼ƒÓ¤Vvü]ñä;¹Sé|1"¼¥…W“~®VzÓlu“JÁ~PÀª°15;ü¤×-~y’æF@ˆ K‚N¶_gÉÄ6í†a¶z"#ùw&ïç?šìç¸ ‚vV°6‰áÑ’5)~ƒyHÄ+’éîâ½cŸw™LÝX,7ðߊÂG؇KÙªàÁóµZ‰åCx¥Ývp=•€PzFÑ­"§Ú#àޘͼ}õ÷Ò³´âóÊÏ*ÌmâåóléJ(Ú—ãìþUÖ‚Îæá‘w—°Û‚6‚çj2´«‡òl½wsûë%»ÚÐ,‚‡S,ƒwS„kÜ‚'ªÓ,$ɶs77"ù 6÷gê½\¹ÌŸë ÖL«üËVƒÔ˜r‹Ch]œ>µΔó>ºp é©,Èäê}t)Í”<\Tb5FW¡EË»r ‘å)iaæVjÔalzTbcsNgB"&…i[hرåiY’¯ûs¬¥Ñc üãèífÓnu¢èW†-‡0ÍâŠ$9ÊkÓ€¡T\@ǽŒª‹]ðùF:üÄØÚÔ×øÝ­vz wâ¾ÜL³ ªÅÓ•¹¯])0ÆZ~K§½Ô+Eß2¬;€u6±€àÞ™Ìuòr#Ê»0ÏÄ-v\ç†W~6‘#i­ÖP6š{üqf²öf.‡”üŠ”"¼ZKg(· L$¦²%ÀlÂfÊ?©<›Èïñ)wØ’góÈUžnÀ½Á„Lã'gþ«îŸÇÛ·™Xõ %×…JßQ¤$“ª2a÷“Dc+‰Iø-¤uEF”¢ö7Î?^óºuöÅ¢ n%¢Ì¢ji^ªËé#”ßj˜6þ‹a( ü0á~©‡Šp üÇ'S 0`Ð º1`À€ƒn 0`Ð º1`À€ƒn 0`Ð tcÀ€ƒn 0`Ð tcÀ€ƒn 0`À  tcÀ€ƒn øõ9ÿ0p÷n"¥Œ¹ÍŽ+FSø}.âÀ¼hT3 %ªn´†ÿ?¤$ÀŠSE3èÆÀ]zˆY“) üe&°Ñ øk`þ;ØY lþ83¤Dˆ?Äß(%B˜m(&]EuIÉïH;;A;Š‚æDUåï,¨”R±‹WVN¹$Š°ÙqdÈ?ª KðçZ[Ji¶ !q»øEÈNJ—Ó“»”XNÜ«µÀïU4Ù”ÿsͪcó÷ùHÇíà£ûI)M6a— »?ÎŒßyÿ¥Ù.„þÛZ¦°»üs?fa³àÌ’ˆÿŒÛ]JiõšMûSŠP(ÝÈŒŸ¦;* ´ý%uÒyý“û?0cŸü£¸F^ZùÚmk]ø«I¶ÈzMÆ~,Mâ»çd IDATìʯ+tmÑy¨ª·öž»T£A ‘3{ÙWKBÂý]öªÝ}ÉÄïºB +:,92áÁºgû:³ÜýÅ‚ýô3“ߘ’üô·ïãü½6ëÁÅß×ïÝŸBÒ•ðéƒÝ†Nßç_°Tfqø‹æ7þèÜ»ÎｩB6úœÒ²ÿˆÙ±…¢n[+cؾÉ-úþ´B×H!¤Ñæ¥ iŸüx$MHt)R1”u&miRîÂôûGé¶!Ðw([ý¾§›wn§ýìMfq|Z«ËþÞ×­È»Cú?¼ð°Uýõ?íÀÒ z÷V|RÛÿÑ=)¥§·ïVó75BÒú¾+þLwñ+~œ±kØô]Ǽ4ø?µÆ'ÌbáãujÛR±BØ_aÝH)›8½l^äÓcÍ&° 9Ñ%‰V.V;.f;4'š.…Ì6ÔP]w£g‰"¬ÜnÌV¨N©#@±Øý=O@“°X½&‰[*fa6ãrH!Dö³Â¬x˜fB «hn)Álh3º[dƮ߶õPŸ7ö†Aníxgѳ½‡ÌÜä8¾bEô ÑÊ©éB±`6èn4UJ°ø ͉ن¦qûÔ¦)Íë5«ápH!\;>þ²óç?3±û…¶±IË…g?ñ¤aFQ<&+Š’]At)…@"̾ê2¢Ï¦ p¸8³|^ØcÃK˜pWÿ÷Kß‘™*%(fa¶xÊ–mLYì¸xjí¾›…%¥vóµS[w5Ò_zP„ÙŠ¨na±ûSXk „Éâo2ÿ1SlÅb7+ßOL¶“BPçùu¸4ýæa#ÇtÔ4¤Š.úÖ1!ö>]7¡ûÝZúš©]2dÀ—»ŠX@!óÒ–E/=Xó`ÍÌ«0™:ªK"…bñ7›MD?¿êpfŠ”¯Û BØl¸œXlª åÒéûšÞß[ËÊ ÿl²ú›Ì¦ì;«k¨®ìö÷ØÑ‚Üž/%&+Ù%f»Åj6Y1I\.O76Û*ªš”“ŸÅfÉkLI„§çHÕ)ñö‰‡¬-V¨Y2û¹hµãÊ”Ùf±ãv,¡·Ö.,Ïàò4‹†Ùæ¯(‰ÙÝ…¦ÿ‘ûÌ)öú´ž§’µs“»Ä ú(qF×zÏŽ.,î K>ÿ`ÁÃï¿õáƒöÞeÿæ½é‰±e:Mnѽ“$š»}Ñ,—Ói«×æáwŠ‡ÙnŸÙ•áöí¸z±Êͬç'0ϯU[1§Ï§§9Œø¢fŠ¹O)E]ðôÑÝû“(ß¡ãØ—9ôÁìùìséD("æó&ûmïÑâÊÖw¯]¥»2Êwê0ö… @óîwë;ʾ·á¥b½×ÝSîªÕ‚êDJY´ñ¤ñ‹& ÁÚg:eXå÷ã:7~a}¿Ä]SŸ<ú²É$"ëxÿhÅ$æ?\½^ñ?~7µfë¡'ö¯SLÛÅïë;þ9UGQ„Ôp'¼œ «úûÂ"Ö=_3¨ÁKIG§§Æ™Jv¾oâ ~àŠÛºá‹WS²ÌšK©ÖÿÍF­"I=½|Ëœ³œèÂV{à»u׊_Þ}åч»”øúD’Ëüv÷˜ž´XùÖ‡)¦½)Òã÷NŸtæDŒIZ÷þŽ£6ëÚ´áuîûô¡2¯Vs&©%œÜíÐßûY£þü'‡‚œ7þÞ.#;~ôeÒ„éoâ&nÇG[-þÅʵçéå Ç>{dçÅ$ü˶í8îÕ À¿äªáÖTMG8]YèÞ »A躺;ÃíðóŒsBº¸ukévµ*Ë«;ÖP'˦ŸÚøù3×bo›‚£[Œ}¿Bt¤ç»Œ‹SF3{·E%·±›•øe￾¦w¿òwθÝíÝ&­«Ì{v4óíÚýÍ5¹„)´´s«ž">)1°|×{'¾æ¯H¡ˆ˜5“÷®[#“%¼A›‡Þˆ( 3¯nzwüµA%ë7l`.Om³%ã©wG¢ØÄÊÇ££†í©[»ø]‡¥)}ù#­ƒ»OkÝ¡aÊ©[¿ý8áâ_¡åC— MüüÁþþ:è§ w6Œ_¸¿xðÅù->:[2Ì3ßþÆ{}fî4¡¥îž1îíQÓV^ÌWÂБ¸åý—fôè¼isÜèÏ–§Ÿ\²ö«).SpD£G$ `¶g|7 Lô ±õªøý¹ÖMÉÑË‹LlUï_+Ë1ŸkÔêðží•Ë÷ÐàÊ‘ÑÍF™5ì¦Ìé=ûM~VÇœGZ%´h©o]ûõü^o $qç'K?zrô{_ÞØý}¼f÷IZ³•náìŸô­_ó}†Ù—VÏœòb•Ï˜¼¦¾·àòóð©»Ìf8dÛúu}sÃ<´óÀ.—&[Í6Þ§§g5yCh‰”XƒKœ?3ê­…èz¯ÕÆùmz ¨þýËÏ×|vs¯Š7÷±Î‘ѻʕþqÚ¤º/œ©…L¿¼ô³©5›¿­X­vKäÈÅ¡Ç[×|vit1»;fƒÝß.LŸ7>ŽÎ~=Sjì{½åÒUŒjm Ýuºôà—ç+V–=\#æ\¿jUm×vŸ"í¾&E‘jÍ<÷àŒ<ðéÇòôÇv;’v®žµ¶çÔKrsý³1&·^<«?0u—ÅÌÑÏFl]½¼Ïà^,±¸S®^?µWó{-9íÇ9Ö†ÃÌi×o'Kk…öØï®gPsô§…t˜Û¨Jƒ²åíª[¹æaiÿ¾HeïxQJ éòh›¸ã{2ÓÒ„I¤ÄÅkºõ{;_÷M±cîÄí#¢v1E?0kfH«O3âbÓ%múòôÛiî±Bª%ëtéRC`‹èûÁž˜õŸÙ<ýpü•Ôw“ÇgÔ®W]s»@ªN̺,Þô¹V.^<´=+#+¸WÏÅQ5X ÖëvŸ–!B×¥ÔÝÙó£«k&m?äoN?ÓÿãíVIâ²q±•_ª[³$¸+5í¤fHQªõ'—/ÖÒ„R§b€Û%J†—½{­|¹ÅÂN­ú¦h—Nae{?û¶æÊu‘JÐÝNM÷´‚Éäºrðx…çp¦#Õ?õÉlhÔ›w»GuJTaËJMÔÕòõ,¤‘5· ºêÊ]wL:ý“½z“(î,BOÔDñA]'´ºu|OFZš"õV‚üƒ*…ãúÁŸÖ^özääÕ\äÿ™É—O»Ìªt§_ÚôÑ%[Û!í#p{–©_OËHo]³œ3 Õwü쾪+Ç t›T÷Ø"Í]§I¸ê’˜C¤[ËÐðw« ©.LyAª3Øî”nDÅþŽ~4:Ÿ\¼1´ç7VÕ!Kum_0ⶓ؃'Ë<7È‘…EZ6/²5 iªX<ØzúJ|ýJÅϯ\Rªç?»Å7>öI—”j“{vª¯iÜغTVí\Ä}ýv¬T«¥ß¾’F½‡ÇÏãy­éL‹ŒM¸É=ÑŲª4Øsaã–e¯ï9ÙdÜ›»ÎSZ^·kKí.KkJìÛ§ƒüKš¥ÈÈtȸ#ë?=’MÙJé²wR1`V¦ÞÎpù|ÃÔæå` !ÍÛ%¾¶ITû’^«m¹ò[ã?B{ ÆÔ¬ˆØQ „é7%Ð&²'° Be×]êËŸ¸Zmþ½&µh·xߎ€b[*5{Iug³¼#MņB¤¤kaEmáö3ÃúﮩRtM7YÕ=ÿxÕíï»ÔÙüÉJ‚H‹qêؤDM½“PÝçy·úœ#7¬œÝí½-”žpp÷¹‹Ž Æ-£Š‹´zïöî-¥Bê:Š…k9« ŠŒß7ûV‘^µ*‡€T]X¢‡}œžvo^Šrçðâu5_:^#J"äÅ;¾cSæ« Gü‹wP2 Á;å–uز$6©È¨ba¶lW~VÚMAy îŒs¤b+©kw~Ðä¡?<Þìl­ÕU* ¡TÇþO>évK!ÐTÍd,후nßr1pß©êéºTŠµ/¥¾pnàŠ ¥©D%{ܵÄs@s¥°B–O/²EJ™&AH)©e¹ò/Óýq÷Q¹Ër˜ˆOº£ënóD‘˜/÷ï¼S§mEé™p9¶}ö­Ô5=mï­¬ŒjeÂÊxHî|åâÕ©ËÔc_Ϙ4V3›ïyuÛÀ7×ä¾ÞÚP*<°˜ÏÝyIÜ®¹Y¥GûÐMD„’|ò´®k®«ß_¸ëŒ×Aº‰î2áü·£ý*tµ¸Qyäé+F¦f8¤®ß\÷äׯ¾‡ïˆö€ÛG¾ìsé–¦ªº¦^^úpb‚%ªl)Ìþ&->õ:¡a2ùìe]×R}ì—qõšÌË3&³FZ,º\ºÝ ³ãÓU]W·mSTýšÒ½¬j>¿aæ´äÃßÍmúˆT%Ô•¾eçy]ÓÔ„M7nݪV¥²Iž[8®Ýd·®ª®ŒdÝìïçÃóf¡Ä'¥I¯¿Tsݶë¹e¯K!u×í_|~ßk…îÐܶvoämä7W5 a V\]Î\|XífòìÖWRwýnb¶‘aJ>yFÓ5wìÒó/:ÿ›¤,B Q]ž—ÔCŠ‡•Ø²lŽ¼s蓹¯½* ¸~¡Ûø¦m Î ª[•yú„9îÈ©eœñqH›ç@T1Þ±þ±ä;N)Å‘YŸ˜7S¶U³ ‹ßÝ•xp÷9éu]šjW(»vÊ»uûõ*éçÖì\¹Üd.0–mÁšËÚ÷é‰?¾9àvÅÛ ´ŸsäØ-©ë™×6Ï|ª—ËŒDð±sËC7ÓªGDJ„î¤D½ÊV-‰¨Ý]ÕDùÕ÷ýðIh—G -aq{w˜Ù?Ú®:÷½©ëÚõ¥Þq*€bRϯÿ*!YûcŸAJ¡÷±ý¨Ág?ë½zõa!ÐÜÑõê6íYÔËsÒÖ}dÝ/v˜óòëMŸÙâoÖl͆|´àÒ‡çNh¶mWòз¿VîþÐp÷­x軧›oÞx¡ûóŸé.@f¶*O¬¼õÑœ‰^(×íå‘YK—Ï_jR­ÝÙžžQéñ)%JxŸ!¯½»÷ÓûçNlùSRƒ/O”:Rf?1‚k<1è…w..?ïÉ6sŸéz1«ÙO·†ØQí ´­¸æé'cÜMž_æÜúà¼g{]³ îüø§æ³/î8v©gw0)©Ôn´óØŒùS^÷‹jzÿ¤ç÷¼Ýyî“ívîNôÁ¶ ËÓæ>Ö4.tG½N|1`ÖÄÖVïvl…âßíã­!ç>œÿdë5sÖ÷œ²7,ؤŠªýßúðø}çLl³tê×]Þ\¢Ô³{s»QCÎO°rÅ^EA—I…´oWnÉó¾9±Ô¸5[E9|”Ý^Ü}’,Ú§\9}á“’Ò´ìúè~u¼úΩ/{Ìû×ÐÀn3…Ë­éTž°ºäí/çLl¿ïLd·WF¹V/›½Ü$$ò>Io}— òMOdÁ¼RÏïÖÐõŸ«oöýjûêêJÊúyß³q{ÚýS¦YÜ 5)eNï*´Ûä|››(áJE¦/xªKZ–žS*-35ºÛkçg ýÔ}Z½—»w)'%"´ïý¯¿µ÷ãþóžëžRvôýãG«.*÷þªZñ«skµeÝ™>£šHw!©1f¢+èj•$8bºpâ¨Pò™¡ºÔ% #‡¶nSvÙûS4[ÕAŸ¯NÝüì¼ Í×,Ü2à½UV!ÁT>¦”ñœ5{$‰®Þ(ízJtƒ0$A•¤œºÑ¸yx¡%ÔT™SS„Àäßï½…©kžót×ä*oDóÓ4M1»Î¬xÿf’ûÞb'åù$¶^Îçþ÷ÝLé^1¾NŧŽU)eAfÌŒg'<0uuΦ©lƒ0¯ÑuWL^ü`ÚWYã>xwNnß$e™S g.þn˨É_i…› 2g‡ìÿµwïÑQTwÀwîÌîfIB „7ˆEA+Ú– ZiGå¡œ(pJQÔFÄc«¢ôÔPQ Ø(*(HN<€ä`x%,„1á‘BžËfwf~ýcóØì΄úø~þÚÍÎÞ¹óØoîܽwÖ÷®à6ªïâK°ËLþXZÃ+’vþsHd⪷vó[’¶ëG-©Û¼Æ—¸îÔáúÞË#BD쿱ÖãS›¼}ý=Í,PÔåÁž¢ÙPºßƒúêûKýó Ú6wÑd_¤]xú4œ¾·qݸ›€ …†W97oÝpP„õlR«ºÏ‚ÅÞc"qbù„¯œ3i°ª|’ºnÌã³fG79%Ž—ÕÉÇD Ÿþ(åÞÑ ¾jã¾ 6î-¦Æqꢆ~[my°ƒÂ•½MèaÕwÓ¸jADz³m2ðñݵP~Dð'ì2jè·¡M§ï‰â9¾ké«Çí¿möCg¿ŽÒà*4¾Ë*S„ÕG®™:…ªWsg™e»'¸Æ~âÿÿÒBmM@ !VòéUô éKA .¸¿Å%®1p‡Ü »ÒrÉÐE×J„8ËÌsÛ·½÷ö÷yçǧ&š&“wô°)é&[¬¶é <ùLϾôWòþ›Õ%ùã6…ï5$(è„ ùimz š? ­ÕºñWuú;/…Euê*BÖtŸ-*j×½ÏûΔk‹Ï–š±Ý:Ñ%6ØÍês…E¶è.‘‘æïNUÅGex/gý²áÙ?ž’²âŠ6q½šr¥í6˾?ª8ÛEÅvdn©éuWã Ièq±¸@Ü@KÅ n@­tz±j'©¶T¿³õJˆÈV7ý‹ma¾o«Z¨dIö0ºÌÚ3 ²;©U·ù' q­B¨bǼÁÙY‡ûUû–Uz}SFéÀƵWöE«`oyjò­Õ )–>Ô³àT奖Çäý~ˉcE¡Jöì}tá“ï°¼¬ú qòÓfîÚŒ¸«KÚÚH©H4©1³b£ƒéËjU!²ÛKlÚ"$ˆ¥IÒFšÃ× âfš3~‹ù&=·DlðôÕ'zv‰d"®_FÕˆ˜™YHR5*iRmDĤQÑkKJ*mZˆÕI‡Í®)Òï-M+ ÚêZUÄL’T;©6ŠÍæpIš½®Xf&Iš M¢ÇíµàgËtågþý©“……a½Gzæ¥âEÿuÉãÏÜÓuꊲãLIMvÏ‚­¹ó˜×½ìÊM«(?#; OzrN˜å7ñB”X½uù¢ˆŽw׌§f+ )ÞŸr}Âìÿt‹8hýö´T—Ë­¶¿9ñ‘Wã:8K6ŽÌ<ñTO}uIñI—;â™w´Ý/ìÊ9$¿N).˜2vR²å½º…ªì]2-wÿ~r^{gÊ›Ý;G“ÕyYKçWÕj$¢M~½ÿ€kH¡ÜU3÷~¾G‹ê28é7B(®CéËÿµþÑ%«ÉCBˆS+~·¥üéÉ@›­h½“ËñmöæÄ—2¦¯Üßݵqë†ã½û,Üäás3ã;ŽŸ=S÷öŸôöÖÙÚv.øæË{ç¥'¿¹ëçöÍËwZÝɇDùö ‹>Hœ›3}Ùîö~úÆRÿÓ×æl«¡Tìütñ¿ædM]’4úæÍoPå1õÃós²+'-ùbòÂôÒ=;TM„ßp__qpïaßì[×ç»=÷Lû}‹u+!n¬.}<}î|ÐVËž Ôý¶^žÓGIw3‘á1M&Ýë%aêb&&oÏA#Œjöº©ëÝ»¥)M:™å<¶³“jkøš «“Ÿ›Ô(QŽmøHø@xmñùSgÔn¿v繈ˆÕØqš‡ /wØO?uÄ0È4ÙÔ=†ò†µº:¬gœ½öw:5üÌÎ3UtþÛ=²÷-×w&½–9ìÆX¡å•¸ó6íŠ=Ëf§Š½K×Ù0äãÇœXÿ†¢·â€'¬Wœ]0£qƒ‹)hŸ1U{¤o µPd3]2djxœïúIQ&—[.åªqÛκ¡°&yƒ'Ê¥ªÆkä¯Íx=£®…Ò5®²‚‰ÈW7ÞEÊKíF‰ê£,H†;lU5nRÜ•6{¸oÔ7 Æ%g=fD„Ã7:^kÉÌÄwÓÄòUϺԿ–}öb»{?øÉ AÜÀÏ2Šš6JdmE¡ ~LdÔIgÑíÛV8K ±)Xw»/\p†L:2ccœB{pâôIzýÍ •Ê/Rë(å‡ &É,jK]ž˜¶á䈈q×!…Ø`Af™Kt±9cäÁs•$ˆ™\§‹…¢EÝpGßâ/w”ît~«£`ÆŒâb ®*!„d.9_ËLBP<µuw;P ¾H«4Ipõ×+Þ‰<˪%ÄF«‡>Ü—[.þ`LfZVp3©Û¨)JÎkGó+ˆDMÞÚeO?h„ò-¥£²²4T&É9ùù¥BˆcŸ¼eôFmãït~µ{ÿ9"ºP°®\ÊþÂúþqdå†ç*\¦¢¸woÉðý˜ÔsìœÂ5“͘a&FÖ n U™¦nÖ§³Î¦ÉÂ1|ê˜}s‡fnýŽ£’úôÓÒSN—™îø‘3¿5ñý¿Ü­z!)©[}/eh7Mx-­hÍ„O =Û1eìŒñLlê¾au³;kæÊ'†lÛtdâ‚íª¢óŒ“îÚôÜÕ/þíö??í­®2™SxßF\¨î3íY"tÛ4„8&1À•_57#œü¦°³Â7K¹ñ±B9‹iÀ²;z³ÿK»ð±(­þ"­nbýÀ‹ ô¾'!WÇMf†25Î o˜ÍÉõU˜î/È÷ãžÓ;Ö,\<åµulà =# E®›êPà¤g|ÜØãË&®Íݶž¾2õN·ŒŽ²®‚›®.°wÈz¢uÃía²Ð–EIDATÈ]˜›-d`3ÿÚ„ ªïì_°ß½B øm@zqÎÊùûwHÙÂzm!nàÿÍ þ÷½IÎ.~ÍÙ®G|PƒÃ´Ûd‹§"Éðö=®Jȸü!ÿÉeä5Cºnôìè˜pÝ6¸˜‚Ö¾˜¾˜BW1\%ˆ@Üâqˆ@Ü`â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸Ä n7€¸@Üâ7ˆ@Ü nqˆÄ n7€¸Ä â7ˆ@ÜâqˆÄ nà—ˆ‰þ=ådÓ†7‡5IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/stat_code.png0000644000000000000000000000436713051004444021416 00000000000000‰PNG  IHDR—)·=,+sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ %›VâwIDATxÚí™wpTÇÇ¿ûîÝéîtÇjT@åT±¦khalc fLŠ11 Æ`Š#aŠc vÀIˆ(Çt°ÁvHœH0TB½ž]{eó‡Ú©± šÌ~ÿ¸yowoÛç·¿ýí>B)Óÿ¸86Œ"£ÈÄ(21ŠŒ"£ÈÄ(21ŠŒ"Óÿ E—Ë:Ú¢ÿT?\«¢´çônÅ:•ë±ÒÒpk±G æ éú÷¾»ë$½ë$¥Íõ¹Ë^Ýÿù¡%4ç|rübìàð[éߤ}›Ë+8‰BÁq ÒÈŸþÒ¯ðàÉl ÏA–d¢àf,ZöüP¯O’wTZTJ…Õj6yÃ;k‚**‹%™'v^Áîµ³¿ùüã?¤~?ïõÕÓFEºÎ!¤¶ #þÝßxLX²u錎é!ö:ìyìC£„鋱7¾\Ø•ï¢ì!^Z€ýÁÝ G°j#Šë1f’¶aD$@rùü×( ”ŠœvôsóWÍ~Ò9®º<í­KŸ¥lÖ)úÊóñ½·.Ùf³Éo²ÃÖls]›0s-ðà¯GVº¿ËJƒVM¦/'¤¬àZRbÒÜô¡ÉK?« ¶ýW cÃüáàÖÕñ;SR!‰ÒÕ¬ƒÃg]={àpZ¡)8Ðá:Y!æœók÷d ‹¿çpºf@Ê^ÄïÂ’5Дc×.„Àš(ÌYás±nÖlÀš0lü1–¼†°™X:{’°9{ßÃ}[E²ÍJß;ûŃ,ÓÖ{Z¼­©-Võ¨%Ø‘E%«ÍѧßøÇs²(D™ã%Y¢´Í–[æ“€Âq-vGÚç¢åÇ @9kúä}›2í›s®ç½¼àÙ>ò½¡Žþù¨$w»2pô¾ßM¿üib±µKŽˆ¸qz"F…˜‰“ç`®Ç©S°Øò!Æéq1iAâ<ÄïÅäˆ&Èþ¹%°Z}g[ǵõ´¦$÷Àþ¯æWJPiÁ¢ÙS 5_Mzóˇ<5nu×½¼-/íÀŠä¯=ô~ÁY•]^çœ2û•Å3Çg?°÷pªÀëÆ ˆž6Š›ù졃™ ‘r\suiQeãð^ù È’Ãaw:”p9· }BT€¹òF.†o6Ð+ët#J©ÖË»‡-ŒR€GÌÄ<ÄÁ}HJ†ÅËç"5 ÐA–áû¨ý°l)MFj¾¿.4544H²LN¡¦Í—Οnô}ôØ|Ôç,]·ï»˜è)¾¼’çÛÌ–S)yÂœÖÏ´eÃÒë—ŽœÍÌÌ RýéÜõùë·OšqhË‘>þü÷8 áôýŒ^ ÇÛT|c¯6WŽSØëJSO¿áÝÏa©ÉÈÊsãvŽÒÜôŒg&Æu £Ðmù>Â2@@Q>Ì‚BÑÐIìÈîðo6¤ìÆúMõ Þ˜=çâ#8~»öu‚€Râî9dø(/ უÀ3Ƥuܯi´{uõå”Rw]¿ÐèAx­F­á‹î)xjŒ?Š?~ñ©£è¦1Ló“P€µôVqí I–{¶qj}HXx˜¿'U ýù² jBegzVNÜÊum¤9ŽÂõ¼Ä9ÒA¥u¢N NĦ±iÂúmXè PTY`2¢ºj¸“±z+f½¤xôSt«[³ãØgÛ’µ%{öÿ‘—hkS¤ÅZ(€–¾É‚ÔCO@H2@”¤¾þÿÑ EÁ)Jp8‚(¶{?J©Ø}7£T’ÄöDYyw¯câžàÝ^D¨¿{íçòp•DKScYE•¹©I[SÙhî¯u×ÑæÚ¼Š‡¦ êh2[…šFK³½®®¶F¡Öu NØ­'Ÿ€X-*Ìçƒç§Âk>JFe$®ÜÄôm¸—Ž76Àg ¦ŒÄ·iPñl, îíE±ù!`hÛ†5îžú›ßߨ-U\+uèÆøz¨ PÙ*‹ËkMFþ»kwdª K­Ã¦²,‚ÿ@’•}ûn–Üü{¶Ã5{(r¼Æarkó@ •Æßßߣe*•ÎÃÔߡ輆”nÚþ!¡Ú6Wë ~>|gïX_RúÜ4àpÚoþóë«wX¹üÎÕTNœ=`üb¼³_B‚~vÆÃn‡i,vüÚ…¢*,*\Ëu¬*âî7iRýù¯Îœ9#Ô•òBl˜?t~s&¥_þ[¹·¶žÓE‡AøùÝ•4:£¯·—otì´1yYÙÿ°Tr¢**4€ô%Å^Ÿ%ÑVTPÚ?*JÀho®¬mÐ<=õZΦÚ{õNÓ?Þ%ÞqÚ›+Ê*¼‚ÂuJ°YªÍVo­ZÕ^Æ\UÚÌ|ú‰‚£ì^~­EPò¼, D­7…«EKQµ548°©º¸´ÊÌ)”dQ¢þA!~ž­ÇiB`5ãnl"Á[×Zõíë0  ƒ õåÈ-†‚¥ 24FD†¡ÍAy¹EQu|Û5!°šk ïq:Ÿ¨ð`%Ôi¹u;_Tèc¢ ‹ë"Âü«ËJÜŒAžz¥ÕRß`±yxjUBq~~ƒ1ƒ‹Šk""ƒyBž ŠGŠ¶8‘¸ìO]^ !-©¤ã|…ÊôôЫ]¶¥¡Ž`£‡£]×Þ÷P¬£ív|.O/Œ~Ð1ñßœ4ÿËk‘‰Ý†31ŠLŒ"£ÈÄ(21ŠLŒ"£ÈÄ(21ŠLŒ"£ÈÄ(21ŠLŒ"£ÈÄ(21ŠLO¬wÒ©®IEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/user_agent_match.png0000644000000000000000000102052313051004444022752 00000000000000‰PNG  IHDRzî¸B[&sRGB®Îé pHYsÄÄ•+tIMEÝ4Ú^ IDATx“€lÿÿÿDX~« IDATÿÿfyÿýþÿs`N*)'ÐÔØnŽ›¿¥*)'ûúøöòoY…Û IDATÿÿÿÿúû®­®ãåèùùùˆˆˆ üüüáE¹ IDATÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÊUÐ×Ûÿþ +Q~7FGÿÿúÓž‹”B€Ð'#ùÓŸ^R@‹Õÿûߧ˜€šY¿æ§eØBU[Yýÿÿþ÷êÕ³‹Ï¿»ùüÿ&G8Zuþþÿÿü⯚{t3nÅ86á¸{¹¬´ÿ2'Ef*45ÿÿ [j¢Ïh¡Ðlš¶òȇ¾¸ÁË»¸1=JÎÁµý.Jbb¼—„þÿÿÿû½›Š;s¡ ÿÿøÛ«rFê5_žÑl§ÒCI2Á‰EÇÈÝÙÀ¡(<^ÛÃœ8il£Ïj¢ÍQlvë¼|ª†~ÿÚê IDATm’€þûøûøûøùý=DBÞÂÈ÷ÏÝ× 3j€Å“íøÿÿFz&¿ÇÀÒà­tîi13ÿÒª y þýü>*6“åØå(*ÿÿν»™¼ARjfþúB‚Áì̩ͯ†öú,Na™ŠûîÑÀ4c"ýûý )6AÝÄÙ ðú–sÿ$8KŠÈüÿÿÿÿ1G]i†£ÌsÒ IDAT ¤mC9<>ùùù{{{ ê6-Ê IDAT ¡+ IDATÿÿÿÿÿÿÿÿÿþýþþýÿÿýûûÿûþþè®LºÇÿ`µþþÿÿýþýþÿþüûÿüþþÿÿüûþüüÿÿÿýûúýûûÿÿÿýüûÿÿõܬ©Ž ú÷öþTŠ° ÿö²k>÷" ÿÿþOŸ"êyÄÈêÿ÷íçþ  ÿÿ5u¨ ýßËè Rÿþÿû벪¬^Š¥þÿÿÊ=óV½7ó€½¾á÷îçý .m£Ô’\þÿúóïî ÿ$QnC¦{"ùîã÷øø[©?6ÿù§sLY»þÍŽG×á÷(oµ5"ÿÏ“KÓÜñ&j®8'ûéǧŽ—FŠÆ ÿÿÿæ»o³‡tZ|Œþþÿþ1q«)•RFþË{2òQ C3ýøÞð DSÿÿÿ<ŒQ<ÿÒ„:ã?—K=#«ÿüâ£t[O}ªÿõ¼ÿÿMv ÿÿùÊ¢vUú3Çÿå¡þ!pä—FI¨¤WæœLþ?ž#îaãÁ„-a ÿþÿD‘WDüþÿÿþúïú*<'ÿÿ 1ùÿþÜ©¨.T²i¼ÁÿdµůÿìÒà HFÿÿÿÿÿÿÿÿÿÿÏŽV×ÿÿMýûóÑ#þþùâ¦wHú÷ÿÿÿþí±þþ ÍâøP ÿðZ¾ IDAT€ÿþÿÿí·¶£·þÿ T•¶ üÿþ1rª)üÿ÷جÿZ‰¥þÿÿÈ{8óî£p=<~¼ýÚúü0ÿþ6)åЮ>iþ3z^3züê¢kZÿäÂÒ<ýÿÿÿÿ]‘±ÿôÄŠ Kxÿÿ=}ìÖ¥ÔäûÿÿÿúñâùþùÙåPþÿÉ´Û8=ÿÿÿÿ/\~ƒ§…>Í øóòþ Bz¯ üÿÏRÖÿ NKeaÿÿÿúòñ#=:ÿûæùþ>ÿÃŽ`îùýôöû¢gæ$[—- ö£lMRŒÉ Å‘cìõúôñö¦né!W‘."ÿÿÿ1G]i†£ÿÿÿÿÿþÿÿÿÿÿþýþÿÿþþÿÿÿÿÿþÿÿþÿÿÿÿÿþþÿÿþþÿÿÿÿÿÿþÿÿÿÿÿþÿÿþÿþþþýþþþÿþýÿ ¤mC9<>ùùù{{{ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿû „ IDAT\Oÿÿ{†*,[Nž­¢šÀ¹ÿ ®xjé裯bWø÷"&‡ŒYQþýq{:7TM•¢¶±¶®þý›ªŠÝÚ¨±g_ðï#'Š‹VQýýt~(-bS‰–ÇÁ±ªýý–¤ž•ÐËþþ¯´geìé “’TRüüen;@ZN{†ÜÙŸ–µ¿úÿÿÿ1G]i†£ýýýýúúþþýýýüþÿûúÿúúÿúúÿþüýýýþþûûÿþúúÿúúÿÿþüýýýþýûûÿþûúÿÿúúÿñï[L½Çù ¤mC9<>ùùù{{{ îÔš­ûÁw6ÊÞþÿÿÿÿÿÍÉ`R°„Gëòø®¿ùÿþüüûûþú÷þÿÿÌ{9îóñýüýúøÿÿäáÿÿýóÅ–`¥tE´˜‰úÿÿÿùå½³‚N§wMŹ»Û>×ñ·sCÌåÿË<¼ÆëýÃz@×îÿÿþúì¤uJíÿÿý÷Ú¦vE©|gè¥NªƒŽÿÿÔŠDÇÖʨyaÿê¨R¨€‰ÿÿÖGÆÜö6<kuÿíÅŒ§vE·£¢ýàŽ¦Š¦ÿÿÿûæ¼²I¦vKǼÅÿÿÿÒ§r§vD®ŠrñùþÿÿÿñÌ—¨wD´™ÿ暣„šÿÿß·‡ªxE­ŒuöûþÿÿÿÙ±|¨uD· ›üÿÿÿÚ²~¨vC¬…hêð÷ÿà–¡¨êÈ’§tA¶¡¥É—]¥yPÝáëÿððn`ÿð¬lB7ƒW‡µ;:§w[ýñÙ¦”Hz¬U„ª讦Ï%i±ùGˆ½2<\! ,FÖ·Ñüê¶ÍÌðøÙ™n÷òÚüÿüÊÉíÿî´ÿÿýÑäú1*1úöÝüÿÊÈêðµÿÑãõ0" A@ÿ嘵§ÄR‚²DP1ª–±ûÿï­§†ƒAv­V„®þÅ{­ªÎ»yEä TU„µMcM³u;öúþí£°œ±M³HZB«’¥ûÿÐSÐó1Rƒ´N_G®p9ôùÿljRÜÿBT†µ4Õ¡zƒÿÇ‹TÖô0T…¶Rne½{:éîúþÝõYW‹¿ãŸli-d \~{Å‚Vóýÿÿø㾘c5œe5œe5›c5áü ÷çÏô'<7-Y ëÝßóÿýùþüøðù &^´OV0Ch# ÿ 1n÷Ô™綟0Zw붠þÚ°Å,XK+öÚìÿýóð(+øëüÿûáþ+üØëþÿõîÿ#.ýëúýâüÿ ½TKפ§[™  -<%ÿØž– M °·Ï(HØ1l#6¯½ÊéD—1tÿÿëíÿ /#¿èíþ $áÿúåýþ ÿ æê÷íü .#Þÿýæý ¬q8ÿÿþüéò/#ÿýéúú  ýÞùù ÿÿ Ùìñÿ  ÿÿÿþÿ’†|„üÿÿûùòþÿþúòø =RŒÊýüùçºm®‚ŽWxe 0ðÚèîõ'(óéôâ/ý )kù¥‰éóÚ.W` 솞ÙÆ4q‹ÿ)lûž~éúâ.Q¹ížØ Ä4kƒ<@27KéôûÿÿóÙâÝçñ(ÿøâÿþôþþÿñöüßôúÿÿóÚã)þýõTÐ ÿýþÿÿþôüûÿÿÿÿöûùÿóõö ÿïð½„üÿ 0åÖÎÛùõܱó)ôÛŸª†ƒ  þþûðøêÌ°åéø"TPϨŽ 2kÿÿ(L1Ç­ŽFsÿøÖÌØÿ%!ñ²ÖîüÚÊÔù%õ·Ôêþ þïЮ˜þÇÁ'L6é¢~ì¼Ñð)^]ð¯jýÉ‘‹>~ ÅÊß÷Ìçñë- %J7맂ÿó½Ëâþý¸Æü°x?èîöøѯ’øúþþû ¹ÃøωšlnùþÊÁÆüÛßÛÔ)(*þÿ üüþúüúùÿüùõýþW”²í­]ži;¾»àY…¬þúÿ $_:7 i;žh>Ëá/Syoþ @V>½n5ÁÌíܦvÐÖñÿ ]òÒ¼-J,)cêÆÎ6Aÿ4$÷ñýþ& ñúBÿ5'üïú( ôøAÿï󶥞• 0‰71øg7±š«P\2ÿaUsg´{EŸqMú9…UW6þÿJŠ¹ Õ‰ i8«‘ŸL‡Ç (~=>  g5­‘œL_>ÿÿüúöÿÿÿÿA‚·õ®¢i9mT-e© ÷Óµ‘÷ùþþÿB}¯c2µ¾ø[Œýÿ>y±ò­ i8¦†ˆAÈÿúûùùþûøýýþýùõÿµÅùÿÿÿ1G]i†£ÿÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿþÿÿÿþÿÿÿÿÌÈÿŒ€ÿœ˜áà!-ÿåŸIÆUN(ÿÿÿÿÿÿÿÿÿÿ÷ãàÜû!/"ÿê¨W½rYW7ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿþbU¥­ú ¤mC9<>ùùù{{{ ÿÿÿÿÿÿÿÿÿÿÿÿ26§·ñ¿|MÕ'Bàâ×ñW’(þÿ ø÷÷ Äw@Ï)BéâÑÛPŠ1ùø÷÷þù úÿø÷÷ÿþêñéæSDÿýýböl bYÿ ÿ†{ÿ}…IAÿÿ¨·æäreÿÿ¨·~ÑÌûû±ÀWVñïþ[±ÅUKûúþ7MÿF@™§ëé{o›©›’ËÆùø¯¿okáÞýý½ÃRMôó25Œ‹@>‡”qe¸°»´÷÷²Ã‚~ÎÉÿÿ¿ÁPOòñ48‚ˆÿÿÿÿ1G]i†£þÿþÿÿÿÿþÿþÿÿÿþþÿÚu{Ð IDATþÿÿÿþþÿþÿþÿ ¤mC9<>ùùù{{{ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿÿþÿÿÿÿÿÿþÿÿÿÿÿÿÿÿüìƨvEš`0šb2œi@µ˜˜ÿÿüó°•ÿþø”[1øùÍlš©ÿþÛ‰“s¬p*ßãðÿÿÿñÖ¥}t3s²+$ý÷íÃ…C®šObOÿýûúÿÿ ú÷üùþþÿþÿýûùÿÿýûùÿÿÿÿÿüùÿüÔõðô ù÷m§Ïúõÿÿþüüûÿýþÿýüúÿÿýúûÿÿÿÿ ûûüÿþûýûÿÿþûýûÿÿ ûùýùýýÿÿÿþüüûÿÿûU’Öýøüøþÿÿú÷ÿÿÿûüûÿäÅ…(X/&þÿÿþ=}Äüÿÿé¼u»³Å!0îÙÐD†FR?ùç•lc9/í ;ôØ°þ[Onjê»W¾×QýìÅ!" ×ÍÖI‹³õÔ“²§!.ìØÔM–DH-ÿú±yNðù þåSQrl»˜Œþôü»˜‰?]o™bDY–Äþü²|Nòþ ùïòL„®øËg¢ÄEî»"'×ËÈA· Îy5Ú0£VP(úÏ ieJ‹ÆÁ‡Vàñ ùðòûN‚± ÄŠYÞíþûïïøL‚² ¦m6! ï/ýæ¼îù2Vƒÿ¸ƒMìô  ùïíöL€¶ ¯u6/lÂБ<+gº"ÿæ¨jÀõE]eQ͘eÒÙê ìæëAx± êÊÑ ?Šþþÿ ÿþñÚ³®ÔW”ÆþóÛžviñU@ûïþJÄ@þöXžxiþj üå¼\ˆœþÿKŨÐRV®™¯OÆþøç¡tZ÷L¿õ±^÷j`nOþû³rAÞôy=P=«œö@`wþýøî°Yñ Q]zeÿì¹_³‚\sÜ£W“±&Z´¢Â\k@-x¾+ î¦naD‡È õÂpÞû>`‡lñÂp®Œ ^zc÷ÅtÛõ7aˆpòÅu­‹_g í-H?){±w=ßåî%þðÓ.fFLMÝ›[ÁÇÑPF3ÿüû2.0ÄÅÍ$EþÓÔÎ9b…ùÐ’ÌÛbŒ›÷Ó‘¤ŒbŠ€ýþýþ÷îÕüýÿ ýïãë+ ÿ& ÿûÿ üúøÿÿLþýÿ ýÎáüóðÿ߸˜þÿþ ÿúáíìÂÞgLþþMÄÿþùíÿÿÿÿÖÇä]\ÿý;bÿ¶sOþÿ ÿÌàÿ ÿ­tN6zà ÿÖ¾Õ ϲ˜ÿã³ýÿc×¾Õ ϲ˜ å´üýgÿü))ÿÿÿÿü àæï(#ýøþ -ƲTûûüþøðþðÿþSk½i|õXE ôÂçç A ÞÒ Ò²˜ÿÿ÷ëÃõú ÿþ. æÔ´?aþÿÿÿþþûÿþöö ÿÿÿû !2Dýÿÿ!3G ýêþÿÿþüüÿóÿ㉠9(Æ™• yûý )?!&ÿ3]ûþ '>!)ÿ2[ÿýÿÈ}EÐàèû>~ÃÕƒ·Ä Uxí°g¿üü1òèäñêÄ¥Rmüýþ 2!22þÿÿ/S ³ s IDAT€ÿÿÿ>zéÕ£ÚæýÿÿÕšM©‹¢ &÷ïïûÿÿÿÿùñêÿ! (úùö !$$%ü÷ 'ç¿ÈÿÿÿÌŒ[Ôéÿÿÿÿ%+çÁÆÿúØ®ÿ7ÿÿÿÿÿþw1\¦õ³¼Âá&, ëÒç%$%+ëÒæ%$áéõéôò 6~»fŸÓfŸØ'áÖåNa  ÕÝëý554ÏÑ××ÖÌ144ÿÿ&îØè$$ ÿW{^þ<-©|e(56äè0ᲜØ;-&ÿKrûoaåIEÿþÿBƒºC­ˆà!(!ãƧ ;‰FL=ÿÿÿÿÿ1G]i†£ÿÿÿþøïñìêýþ þýÿõéà÷÷÷ þýÿûëãß &ÿÿûëâÞ 'þòßò÷üôßòõöìãöôó þÿÿúïïèçÿ  ÿñæÙûþ!íãÚ(ýôðèåüÿ ! þöâîñ ÿ÷âíï ÷çØù þöâîñ ÿùêÙóþùñèãúùú  ÿÿÿúñèãúùú ­v9?z¼ôäûü %ÿõêß÷öø " ïãÙòëëðä× &ðäØÿ  ÿÿÿýòèâù÷øÿþÿ ¤mC9<>ùùù{{{ ÿÿÿ1G]i†£ÿÿýÿªr;?{Äú ¤mC9<>ùùù{{{ ÖÌDwTÿÿSðèÎÏ`xÖVjÿ4˜~ èⱜÃ3™€*®™ÔZjûÿþè0<ø îéÿzÔ‰* IDATïןª¦ÿלaÐØôôÎ…º—wÿÿ ÿ̘q¹‘‡þÿÿÿý×»“lâï÷ýൡ·Ãœkîòøþ㢵Ÿ²ÿí³¹­Áἑk¹’k¹’k¹’kÀÂÍÿÿÿúÔ°†º—zÜÝéÿÿÿÿúÞ¯·ª®õÔ¢²–•þÿÿÿÿÉ–^ÛÜëÿÿüêÆ·ŠnñüÿÿÿÖ¬yÈ¿Àý么mñþöݹ¸¤›îÕ¨Á¯¦öݳ’„ÿîÊ~øÖÿÿöݹĚm¨šüÿÿÿþîËÄžr¹•vßÞëÿÿÿ׸’¹“s×ÓÜÿÆ–oßîùó¼“iûýÿÿÿÛ¹“½”k¸“tÑÄÄÿ»“hùþÿÿÿûòàëãâóßËñóüÿÿÿÿÿÿÿú» ¶çÁÎçÿÿì™gxÿÿïÝÐëÛ±òúüÿÿÿã¦yêÜÏ÷úý=.;-ìßÎúûý÷áæßæÿݳ«$õÝäÛô0Pm2Nj2Nj.-%ÿÿ´s7ô 62JZØTËÎÛÿÿ஋š8NR 0^ò¯ÃºÊÿÝ«tÞû1%'Þ²z¬š–ïÜÎûÿÿôØ°n=ÙÚãíëêÿ÷éØÏúýôéèâßúòãëåâ/DLü "P%,òφª’ $Ehì£u^øæ±£€&Fk6MZÒGÆÓóÿÿÿú±t;ê12KVÞRÂÏñÿìÝÐõûþûéÛÍþÿÿü«o6çý!/Oo4L[ï¼u¨Š—ÿþ@O?¬~yþÿýïÐÄtº•uÕÎÓÿÿÿݸ‘º’lǶ¯ÿÿÿû︖}üôʺ–xÿüïÈô#<_XÖ˜‡ÿÿÿûÉ uºšòü½•søûßȤyº–yÞÞîÿÿÿü»–rÿóÆžrº›éô÷¹’qÔ¹’oÿÿÞ§sÄÈäÿ2D"¾·ÙÅÎç ÿß¿–º“lÀ¦“÷ÿÕ¡w¹“l¹“l¹“m¼•lñôúþìÆÔÇÕÿÿûëÎÚp¹—y×ÕàÿÿØÝØ! ýõåü % ( + +ÿõňä _9GD,MnlΟûѤ€Q} ýûÿAršè«iâêúê½¾¶ØJiqüÿû2Z’üüôÞÝ0t¹20 þ͘bßäøöß¼¹¤›úìÓ¿·ÿ÷඘‹ûàÀ—l¼ òüè¿yÊÃáêÂ{ÉÂâðԘ©¥ÿÿõÞ¦¿ —öß´ÜÖçþõº™´EŒ§ *"DyRq‰þþíÀ• 6Š"0A\/ḳùâ óCBB="7J‰»2%ÿߥmÆÊèÿüàȤzº–xÝÝíÿÿù×¾¸ÛìÊŸ¹‘kdz±ÿÿÿï¸òô=JL% 0B‚¹9G1ÿÿÿYÉÕäðþòÚ£€y$Eg5Pbó¿i¶·ÜýÆ>Ùø'5UrÿÉ¢~uýåÕ¹˜¶1LcÿýÿÛ¡yJˆ`ùìº÷ÿüµs?õN5JTЇFåÛÎÿøÔŸnX;`4KXÔŽEËÙöçÙÊ°ˆ’*Nv6C6¸xDýÿ7D-&:Zw  B†õ½sýþÿÿÿï­öbɉPÎß 4Ss** ©oFøûÿ"Jj6Sq6Sq7:áÒæÿõÜåÞæøÄ¢uhAh6N`Þ¤]ÎÕãÿáíî.ýñëÿ"ðÚÀѹ¦çêôÿÿàÓÝ83ýC ÷ÅðôùÛÈÌ*8:þþÿý"Kf`¼‘t¸’y5nœÿþú(GTÿüÿ 0L þþ  ÿýôäØÓùæÒ³¹¤½3W~*&°‚l÷èÎìêõøêÐëèò*\óÆ‹Öèûí±Ž–*WiýþÿúìÑêæñýöêò ûÒÉ£xů  ÿ4QöÚ  Ù¾Ù=Fê¼¥?kÜÀ»–yØØõ  ÿùÖ mV:^4LYÕFÊØõüÞåÀzì 7<^z͇µ¿â?âÀ±­þþþ-8ÿþ>[?Ë›¤ÿüöìý % )8rÁDD#ùëÎ×õR^H ")Q†àÇçýýÿ1r$ÿÿÿÿúîÉÞAB;%ü¼´àÿýøàëý CG=+=v—ÿÙ”fQ° ('&/OnØœƒÿ5m{!Høöþ  ÿN{51ÿÿÿÿ öáðùЙ™4d\òÜàäI]^ 1a ýÚçî " ¹¦Iˆ§ü3\™É$,( 4/#ÙÓÝóÅ™ C^øèæþÚ‹×ÛíÁ„Cº»Ì÷ø÷ ÿÿÿøüúè¸ë<ÿ 7m#ÓæO01þÿÿþû.^Šÿ :?TYýüÿÿû7dc /Gøîæùÿ E{’ÅŽdݪcN™ ÿýúïûë°¥Î#@a â¢ra 'i4%ð˜c<žf6åcJ=ÿïçöòÄfþ31GQÜŸR½ÈêÿO€30ÿÿØ”eP°!)(%/OoØœ‚ÿþ"(** 2M1ëÈÈþþX~žå¯]*¢sQ¹–‚õþ+cë§úýÿÿÿÿ8KSF°j+()GAcføäãøå›b=ÿúüñãéüûòÓÆ­¬ÿ>9LDóÔŒ Ö°•ÿÿþ.ð¾sK­üùäþÿÿþÿääÿðäVŸ¶ÿüùø ÿÿÿþÿÿÿÿý>_E¨ž±"xSÔãøV Æûáýü ÿÿ åèõ.µxQ%i´ÿ超aú1úßëüÐÄÒ0Urÿÿ9‰d9ÿÿ$-mpñ?Ä øùùÿÿÿõüûùêæþ"ÿÿÿñÆ”ßü?»ËÇV42$ÿÿþÿÿÿÿþÿ ýþýþÿ>C/ˆÃÖba+úúþNl`øÿyÔ¯<ÔêËfÏí7^‘šøÛ¬aª˜PcMþy#*/Iz|§Šr8¥ÿÿÿÿÿääÿñãWŸ·ÿüú÷/ÿÿüõüáäžÿ 0=VQÿÿ*=m¤>ýüñèÞçÇ“©nFZ¸ÿ÷üüþ ÷÷Íúüÿÿÿöæí"=f]=fõêáÚ±s®Ž LR!e‹£ûüü÷ÿÿû!4DÿúÁŸ½&^ü*âÅ{Úñ!ÿóÿÿý þ[ÀG.ûùýÿ*x—?÷ÕÝ0ÿöÿÿÿÿõ÷ý Ñ“Xú-€2-ÿÿÿÓ–uö-WYAÿþàŸÕçæâë,ÿÿ ýùÿÿþ#ôüýÒÝæFüÿòÒòû& þûÿÿÿüØ´™¦F‹ÃH¢vdŽÁ ÿ îíëÿÿôðá ýþûòõ þóÛÃËþ)âÀÃè;6 þýýÿÿÿþúûþÔ¸Í#všÿ FhȈ”N0!ÿäûÿùÿ þÿXÂH0ûùÿÿ 3Dÿâáõ, ÿÿ÷ÔýüøìÚìÿÿ % U“ÐÇ;íôø ýÿÿÿ{¸ð IDATÿ$HßƼ¹Ç Ô¥sò-0óÙ£µš£ ,+ûñæ.äÙÐÙùÿøç¬mü-=-='#ûñÐí78:.>.>.AAQ%Ì–œ"ýöóåøç¶p*WLæ¢kéº|´§ÉúéôàÌëìöþ0 ¸³?U:þ Ð×éÿáåïæ,"ïÁ}Ñï4O\G öÖÐÜàúñ÷î²ñ\ é¬gž{uý Ö¡‚÷Z õßÇÞÚáLxÑäíþÌ¢“Hh  íÙúÿÿÀ‹g\—8CP5·“‹ÿ  ÿ    ÿíÙÆôöýýÿ.E6Ì›s÷ ÷ßµÀ§«)EgüþüõèæÝÛÿ   ÿÿÿÿ úèÊþñÌÊïûÇ`(e§2fžÛŸ]òÿÿ3빨½ ýèÀæ +".⮡ 亗 >ÿþ>ƒóÔ„ðþу'iÿÿÿôàËëì÷+WMæ£jÿé»}³¦Èÿ-=-=,)ÿ;fXê£]äëù úà³xHŽ誺…Zèíú  ðΚ÷ðù ÿûâüûÿVªÌ¥™Zdþùùù{{{ ÿýýýþýþþüüúþûüúÿØ¢aä D)/*åÈ¢ /xþýûüúýúþûþÿûýç2>É»n%ßARýÿÿ SˆÐtLâ>@ýþüýúþJ$þÿýûùîî0Wtüýÿÿþüúüúüúüúþüþýýÿüûýýÿýýýÿþýúýûÿõæù=* ýûÿüûÿüûþüþüÿðÁ~ök ÿÿ8{ÈèÕÃôóô)R((ýýÍf|á>Mýýí&/üÿýý Kzšàæß)ÿÿ,:þ   $Cî8SgJÿÿÿþ)=þýýî%/&#ÿÿ"5Jÿ ÿÿ ÿÿÿÿ ÿÿÿ ÿÿÿ ÿÿ ÿÿÿÿÿ ÿ ÿÿÿÿÿ ÿ     ÿ  ÿÿÿÿÿ ÿÿÿÿÿ ÿÿÿÿÿ ÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ      ÿ ÿÿÿ ÿÿÿÿÿÿÿÿ ÿÿÿÿ ÿÿÿ  ÿÿÿ ÿÿÿÿÿÿÿ ÿÿÿ ÿÿÿÿÿÿÿ ÿÿÿ ÿÿÿÿ ÿÿÿÿÿ ÿÿÿ ÿÿúéÆ‘X*°£Äÿÿúé‘[?ûÚŒ6£’»ÿÿû±`,¢‘¼ÿÿü®_/¾Ô÷ÿþú—]4öÿ]„E IDATþó·˜^FÿÿÿÿÌ‘S£Œ™þÿÿöÂWt§ÿôÍ•ïøý^2úý³g:™b9›c9›c9š_6ùüÿË¡nš`5˜\+¦gôüþÿÿÿÿö¥f5ª¼ÙÿìÊ—žc2½ÉÛÿÿûá²­uBš_,ŸvZêï÷ÿÿÿÿóÈšgVóùȉU²¶Äÿÿÿûݧb-ÉÈÛÌ[¯¯»ñ¥Wãô¼}:˜^3˜^2—^3—]2˜^3”X>ïþÔŸi“W0âðÿÿÿõƘX*·¨³Ù©p¨šíÀŒ^\ Í.·¯ÖïÅŒ]Yÿ ÿÿݵ‚§n:“X,’U*¦~dØÚêÿÿÿùç[@üñΗž„…ÿú¢Y0Öòþùà—`8ÿôÃ\š‚±ÿÇ«¬ÿ `0øûÿèÄa2ÂÔèâ¹… c5š`2­üþÿÿÿÿÿÿïÁ‰M”T=÷ýÿÿþå½…Nšb:šgEÏÎÜ亃!H…ä̘_<þúÿÿÿþþûûúÿ ù÷ûøþÿ ÿÿÿÿýúüýSvÆšEþÿþúðëÞ—DýþüïíG* ÿþÿýûøÿ ûøÿÿ Ôœ^ÜBYlgÿýÿ A©uG÷ûÖ±ª0kûüÿñ¹ýdûK‰Â üúï³]Óà-a›ËؘV­™¸_mKÿÌŒSõï³hÆå2"þû­4vÁ$" íÄÆ¿ÇISCÿ·{l?vÀ ÿÿé­vV"d°33#ÿÿÿ üB€ÆD®a'-Ù"üúèÙżKDþÞ¿¯ 'ÿÿý4uÒýúêÈÿÿÿÿù÷ÿÿüûùÿà«bÆÍK{¼ ÿþèΪ¯‡I ”Î ÿÿÿüùýýÿþûûú ÿÿÿùöÿÿþûøÿÿ-i3À@ºÃbC:  þüûùÿúùÿùø úöüùýýàÛÈÏ>_Tûõÿ ú÷ÿÿÿ ú÷ÿÿÿò½úaì¬\ÎóEÿøÅ¿³ÑX•Ë Ö—T¸¹ÑMJ0¥fS6r~áÙ…É‘h3}d~7ÿôá¦oU 'É ÿÿøåÃÄü<\Q#ýÒÍÜÿÿà¥D§’¨¬|a¯|O¡{jòÿÿ÷â]DÚ«j±…f¡h7Á°¹üËšimM¢k?¯“…Bûõíòûé°_ ÷ëóûç¬#þüç¹®s>¥uPœgHÍÌàÿÿé¸x¢oIš_8¼ª±Ü©iÏí*XokÿýÿöÃa’x­ë¨iÙòþÈ[ÆÙñç±–!UUøþýÿÿÿÿüúÿD˜[ztüÿûù+üòïÿÿÿûÙ˜ÖúN+"ÿÿ 4}PhfüØ”òa"" 4r¥ ÿÿÈÎîBTýÿÒ£læÙÔ 'K}.2$ Þ¿ ìëãâÝþPnVÿÿ÷©¨P‘¿õ©¿ÿýÿíÎÓ'=´}Vóïåü #Cr— ÔÀÈ'H|ýÿý¼~M@<<,ýýóغÍûÙÿùøý <&§ÚØó)" ûÝ®èV) ìÛú ÿÑ‘Tó(wNQAýïÖ±–£L‘Á ÷Þ·£l$“¥úøêÞþ%þúÿ  þýþûæµqå wK‰ÈûÔ’5uÿþ2Plÿþþû :'ÏÙíL;ü:R1>¸ud$|RÑÜ;6ÐÝÉÏñêöùÿÃÜ#)  %P üúÿHÛ²ûÿÿðÓøüÿþùú÷ÿÿý R’*Ö²˜¡ü(6 Ò Š4Zÿÿÿû-Vˆœ;0ü³–œ øù,IZ*BY,DY0G ÿÿ.,澟³ÿÿüøýþòæäþüüÿ  9+BY*CZ)?L$7C ùóïÿÿüôÚ̵¥ÿ[Œ–IL'¯„~ $ú÷óýÿÿÿþûêûþññþÿ$þÜ´·ÿÿ뽊6ÿìÁÿëÈ$ úóÿìÔãÿÿÿüÿÿûÿýþÒ­À4J2ÿ)F5ã³³ÿÿöÉšùTÿÿÿýÿîîóÿãèÙ$ ÿÿÿÿüéĹç=“Lø÷ÿÿ9 ë|Õê úóã¾³­úË£²$qÉþþìÕ‹cûH\ôÙ­û- ý÷ÿ"a•Êx]Ï x þÖ¯†Q¯<772Å µ.vu5?¼ ·"h¼ÿÿ6+ª‡3A?ùãÄÆ»Òb•¬Ü[Jcüæ¼ñ#ô /m?=Ϊ}o_…‘ üÒ¶ªù5IÙïùTÿÿøÜ´°•ü&+'òÛ¶éÿ%F [lÊvUÅïh Û¸—N— 6+éç±ê K.6%ñ²{^?v® äʯòöüíôöüÕ¸Öñ)HQ*"”µ•ƒ&)!Ú´’!]œ ÿÿýæéæ%!ÿþúÿ9uªétD¾·(DI7-õdü IDAT€ÿþ+AT¡ˆˆ:wÇýýøæÏÓ»þÿ "/@:ÀJW®(" þù'Z–Ýw@ÅÆA:7D) ¯“,4.ïÒ¬ÓÞ`…‡üþý8v®¶U¦†Â$++ûòèÔ¹çôJuQþþ&_ŽÐ‚ZÐuùÔ­ˆ\¶70++í©Œ‹.1"Þ·‹ G¤þÿÿûEŠ Ç=¸²NFJ0/®’Œ2:3ëÊ£$JþÿÿþûÝë9!ÿ,r§ÙuO´Ô÷çÎÒÊæMŠ›ÿÿþÿ ½­¤" Ñ¥%b¾ÿ)\ý¡…ãÚ!íÌÖüÿÿÿ"ú¨Úů#9Q!Ä®«58'ܳ’ýÿÚëóN ÿáÆ­õúþïøúѲÖè -M2~©3½£ýͯÃF…¹ÿà¥pÔ [KM5øß×ÆÉëÿûÚÁªÿ'APAZa¦ˆb3LSùܯò Uÿÿ€€€™¤¯5CRûòè,)'%ÿ öðò¸în4'úêëô$Jw*%ÿüóͺ¹U‹œìÕÇ->dsþÿ #,0HLõèÞôôù%M‚,)ÿ #+ "*--/-41ÿ5Tñçá,DkxþÿMYÿÿ-Mjüðúøú!2 "/"/"õöþ"+ C^îÖîèì&T} "&'ìÜÏúûù"1ÿýü( &Hd÷êùÿ 5bˆÿþú÷%üéçÞàýþ )3þûýûý$.2)/'óêæ $M=VVþÿÒ·¢ýýý>>>ÿÿÿ1G]i†£å´RÎðwM[7øåœtf`šµú¹v6#i»#Ë["l¥ÿÿÓŽ?î>­?3 ¤mC9<>ùùù{{{ þûõûúýþù÷õþúÿHz›Ä‹[ñöÿÿüÿ8u¥ÿïʈÑRA6ÿþÿT¹!ûúÿÿq¦Àúöÿý .c™´ýùþþýùÿÿÿ;x`:ûüÿüüú÷üøÿûüÿÿûîØÚÁ§Ó¼¦ÞÒÍÿÿÿüòйªýøâ²ÖÍáÕ»¢þÿÿÿÿ×¼£èòüÿÿÿøàɯÔÁ²ïöÿÿÿÿÿùàÊ°ÔÀ°îôÿÿÿÿÿìÙÂÓº¤áÜàÿÿÿÿÿûèÉÒ·¨üÿÿðÜÄÔº ÖŹûÿÿÿÿ÷æÐ×¼¢ÚËÃÿÿÿÿÿÿóâË×¾¥Ô¿«ãÜÞÿÿÿõÕϼ¿ÿíÖ«çèøÿÿêÏ­ÚÐÎÿÿÿêÒ¸Ô»¥äßáÿÿÿÿÿëÓ¹Ôº¤ãÝÞÿÿÿÿùéÑÙ¾¢ÚËÄÿÿÿÿÿÿÿð׳מÿþôÝÙÁ¥Ò¼ªííöÿÿÿÿðÝÆ«Õöóûÿÿÿæ϶Ժ Ó¼ªæàãÿþíÖ»¢ÕÎáÕ¼¢úþþ×½¡üþ࿦Ӻ¡Óº¡Óº¡Ò¸ýþÿÿÿúéÜĨӻ¦åâéÿÿÞ¨ÛãïÿÿÿÜÁ¥ãéðÿÿöåßÅ©ÕÀ²÷üÿÿÿß®p ziéçèýúò὇kYïúýò˲¢þÿÿÿÿÿûóùøûþè͵¹üí̯l1Ôµšæòûü¬n6ããé÷ã²o8éõüÿÿ®o6áßæùç´r8çñùÿÏ“OÀ¹½ùÒ˜SÂÈÝ㽋«šÏ°Ÿüþáªi·®±ÿìÆ¢nTöûÿÿÿöИ¦‹†úòÔ¥€þÿÿÿÊO­–ðïïûõêÒ¢^¦„}úÿõÑʶ¸ÿÿÿÿÿÿÏœŒÿûîÇU¼¯¦×ËÈÓ—NÀºÆÓ ]¾¸ÊÿלS½¶Ã×¥b»²ÄÿòÔ˜¤„~÷ýêÍ›¥…„þöÏžfµ«¨Ò¿¸ùé¿ veü ÷º{=Øçýÿÿÿÿùé¦c#,‡ IDATl@ëíóþðÔ«kCòÿÿÿýò­l.ÓÒØ ýìÉKº´ÈÿÿÖŒJ×àö ÿøõñÿÿîÌ°´Ö·šôþ ÷ÑŸlJêìöþóÉIËÕçÿÿüà¥Ä«’ØáíÿÿóÙ¶r8γœáçîÿÿ÷Ï¢pRæîúúîÌ¥nLôúÿÿ÷ܱ½ÁÞW—¿þþOh ©fг¸DN,üÜÁªùÿ !>O ýóÔþ+9-ÖÅÍ,EUåεíëî%$78ûøá´äù;úÆæçð(HÛÀªù'>Hþ ÿþúÕÀ°*CVÿÿþûÕÀ®*BWüå¸Þð3Îääë$E$ÜÀ©÷ &>LþùÕ‘8vè´›7€ÏÖ…?ÿôÁpóxPTZÿÿ%Ü©•¥]v_ÿõÄtïqNX`ÿþ&ᥕ¢_zeÿøÈÑÒ]—þÿ,;>åé ÿýàì_ƒ†žagÎÌËCuÄ6BàÏ;ééî!Á¬¢Du¹ Vî{9ßßk$ ÿâ©lÔê'^‹Šýÿÿ5UkÀˆWÝØà.þóäÙÇÁ&:BÿôÖÓÔø#ùÜß0?9üôÞʹóóø 3!+(ÿþçͨ!O÷Ú³ïô5OíØƼ%'89üÿûîÚÞÒÍý 5J ÿíËâ ;G òÒÈ9…FýµÃÒÿþéÈÆÔdœ‚õÿ+2,œ}…:K©úÿþîÑÃÎc„õÿ+54œyv”+9)ú·¿­¶'lNê¹o0Œ9MCÿÒ¹›¶UfIúè°õ7Tarûýÿ,BEɶÃ8úìÖÝÑÎþ /IñÌ£àë !õòøûîØÝÐÌü -IÿÖ¿§(=AØÀ»&C] ÿú×’6uøþü%>V îƳ!^¬:t©++ ÿÿ缞” 粤®÷Ô˯”Dz³ ñ±v@Ýâñ ݬn²¥³äÌŸ¿”uô $ ùÕ¬‡d¿¢˜#1ëÁ¾±ÂõÙª¤sýõتsGíùÿêÔÅ,>ÿú )K34&ûûþïàÑ&)ø%øØßëÿòäÑ $ø úßÜéÿüíÞî+!ãÝÅ«ÜÑÏ1/þÿ,ϘRÞQ¦@;&ÿÿýÿI¤©mLÚ"øçÜ$c±ýþûìûýóðóÿýùïôþûþðé=k¡ ÿÿ&ï˜ÍýaRþíâ6Šž íÀ‰êVe\býùÿ#(›jñ\M6W*.1/È«L$x£ >N³ÎÐ>Ë¢3iÍ-,F÷Ôж»EVEäÏ®H¾þÿú÷îÿÿÿ úôñû÷íÿÿÿúôðÿû÷ïýä­Œ”)>9ìÅ‘Ç·'^|þýÿÿÿ9‡!ÆM›n¸ ïTZJùúýòö ýþñÿÿÿ -P_`ħm½‰ç-F#5H*AGü +XŠ»ûùüË™ËÐìK84 ý!6þø&WŠ½ûùüΛËÏéN=n§+ÙîûUÿûúû­†u#,)òܼ¼5Yy‡þÿ´o:áëî/ÿý ðù÷ÿ ìðï*ÿÿþû ÙÒÏ# >ýþÿòÖ¸ô5ÿúôøÿþ÷üýÿÿÿ÷2{°&ÿüó×®ü*< þü ôñÐýÿûïìö0 õóÙýÿüòëõ+ÿ þþýÿÿùóõ ûѪ³*zÑ2_u¬“ŽJ¡ýþüéáô, ýñÓ(ÿþÿúñè÷ÿÿ2Q4OàlAñþÜ…Sø5¢[S,þþÖ‡9ÚÿÿЇSó-™[W2ÿþÙ‹>Õë¶T–ÿ üûÿýù ëîùïþÊÿ18l‰×e_ò¾¸ñü³zJþ÷ôûÐd£ÐqYjHÿÿÿ ÿÿÿþ äöøþ8vä´·ª¯üýúìѹ‚Sçæøÿÿÿ,þëéãòÿòÙë )üüñýüè¸ÆÇð5.ÿÿÿÿ$dî±zû ÎM{úëÞÔþÿÿ#b~ð³}ù ÏžLyûëÞÓýÿÿ =wÞŒìôå·ŽúOÿÿ ÿëëõèîçýìÞÒûüÿþú#)&ÐÄÂ÷Ûß×ß$%(ÿÿý;Xhé±nËÅËÿóÞ¹µ”|÷ùÿÿÿ23óÇ´òþð̯ô>ýþ 0!Ù´·ÿýþýزÚÛõäÔ¼+Iüýÿÿÿÿ )E á¾Üçù ëɦü<ý÷íêãà "=çÆÙä÷îϪù4ýøïêâÞ&#ÚÆÇáûèÉå% çÂÄíÏ° )ÿÿÿôãÓñóûÿ'axæ­|ÿÌŸ™Nxÿÿî¿o°‡{øüñÚ° ùú!ÿÿýðÕÏêûõùùú"ÿþòÚÍçÿûõúÈÆë5.ÿéšc-éïû÷ßÝîî.$öÉ‹µ–—ÿç¼™ú2 AœjŸ»]‘¶]‘¶G5V¡`qHÿþøéÚííóÿþû)$%ƺµóÝâÙ%!ÿÿÿU‹¯¿š£gzü ()M—6@1þ÷âûø÷ÿÿþûù÷ÿûø÷ÿUsi·€< ùñú7e¡üøýøüûýüøöþÿÿûù÷ÿýøûúüFL5³mH%!ü 4ý÷õýÿþùûúüüùöþÿÿüù÷ýçîù ÿ®j:ðýÿüûú‚9Ñ,t¼3?@G¼¨h2üý4aLG&ÿÿÿ계RZ™Ø:BM¼«k2ûü1]MK-ÿÿÿî´ƒOU—ÛJ^Xºw.û5T|tþÿñ¯Ÿ{Šÿþýû¤i9þúZ–¹Har¹DÈûïê0_/+ð¸‚JFà2iš¿eœ´u3k¯ÿÿKUyÁ¨„™×þ  57v·$!èüûùùÿûûøùÿüûùùSHUݱuD ûþLu–úþû÷ÿýþÿüøöÿÿýûûûúü0bž¿’lŸo”ûñ "NLJ ¿À'‡–ݱk¹Ïÿþúÿþšež,\TilIy‚·ŠB¾õü 5Lt”ûûôݵ¯£¿kŽŸûûI|Š¶FÁôú 1Kw˜üú÷侯—ªk’©ûú>}§·Œa˜žû7e˜ üí̳¡ºþûþþþšfÁ;[~Œ'i°ájmƒ÷4IyxþýЋNðPÈLAT5/Ä¡c1þÿ?qG9ýþÿÿÿQª.ðq­q1ü þøñ 8;u¶ý5nw­‰<¬±!þ *SkX¥†ZÊ/Àýùöýþ4mw¬‡A«µ!þ %Sm]¥ƒ]È1ÀüùöÿüùöëëóþÿRbc»‚;øþüþ (N–^«!”b^.0J‚šýÿúöúøöû÷óùøߥlÊy`bA»|Gäìóüüù—RÛ"`¥>3$(h¢ë]›d!E„#ÿÿÐ IDATÿÿÿ1G]i†£ÿÿÿþüüùÿÿ ùõÿÿ ùõÿÿ ùõÿÿÿÿýûøÿÿùø ýöÿþ ùõÿùøÿ üø úõÿù÷ ý÷þÿÿ úö úöÿÿÿ ýøüýÿüøýþÿÿÿ úöÿüùýýÿÿÿ úöÿÿ þûüúÿÿ úöÿÿÿÿüøýþÿ û÷þÿÿÿÿýûùÿÿÿÿÿÿþüüúÿÿ ùõÿÿ ùõÿÿ ùõÿÿÿþûûúÿýüû ûõÿÿùøÿüùýý üõÿÿÿÿÿÿýúøÿþûûúÿùöÿÿÿþûûúÿùöÿÿÿÿýûøÿÿþù÷ÿýúüûÿ ûúüÿÿüøýÿÿÿÿÿþüüúÿýùýý ýøùüýÿýùýý þøûöþÿÿ úö úöÿÿÿÿþûøÿÿÿþüüûÿÿþúûÿÿùùÿ þùûüÿÿþüøþÿ ¤mC9<>ùùù{{{ ÿýû÷ùöùöùöüùÿüúüûöúöÿüúüû÷úöýúýûöúöúöûöüøúöüøúöüøÿúöýúýúúöÿüúüþûúûÿùöÿùöÿùöüøýùúõýúýÿýû÷ûöþûúûýùýþú÷ýúýúþú÷þúúúÿýúöÿüúüý÷ýÿûøÿüøüøúö÷üøúööúöúöüùýû÷ÿúûþùúü÷ÿýúöDô›H IDATÀD=ä IDATü€íèäÙΠÿÿÿâÑ¿úÖÛçÀÀÀö=@DüûùýòæñæÚ¼d IDATÿÿÿÿÿÿ éééÿÿÿÿÿÿÿÿÿ¢ âÐ IDAT¾9îë IDATÿÿÿÿÿÿÿÿÿÿÿþÿúþþþþÿÿþýþÿûúÿÿÿþÿÿÿÿÿÿþüÿåã´ß¤þa#zÿÿÿÿÿðè¢æ•îýÛûøúÿÿÿÿÿÿÿÿãýטàö û:Kþ“€lÿÿÿ ÊqT IDATþÿÿôÿ ÿþþþÿþªæ›ÒúÀýþ÷û&ø-b$|þó ÿüÿÿÿþýþ¯éœËÿ¸ w‡ ÿÿÿÿÿÿÿÿÿÿþýýýÿÿþýýþÿüüüýÿþüüÿþýýþþýýþÿÿüüÿþýýÿÿþüüüüüüüüþÿÿÿÿÿýüüýÿÿþýýþÿÿýýýþÿÿýýýÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþˆÚWÍøÕÿýû¹÷«È´ù ü.z ”  dFäÿúëÖI^—éÓ¢FUiíÉŠKUw÷„)ù™4B§ 7; ÿüÿY¿ðä™ .....-°æ%  öýyPJ|ÄímPGšÓì[P>ÊåõÿãŸe«Óèä¡g¨Ïæÿÿ•^Hèþýü ÃëžÿÿÿÛàÅó«ù.4hþþÿ þÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿò´ËúÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿìåÎÿÿÿÿÿÿÿÿÿ(M ý1a è×ÿÿÿýô~ÜýÿÿÿÿÿþþÿÿÿÿþþþþþþþþþþhÎÀZÿÿþþþÿÿÿÿ¬ð>é×pÖÖÖÖÖ×RÿÎuçOÿöìúzcµˆ‹H.y4$ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¬Àê­Áêÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿýûûþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿð»Ðûÿÿÿÿÿÿÿÿÿÿ÷ öüÿÿðýå›äwý*2YsþþýæÈuŸxH(nW8M}¹F-s[9Cv·K$ÝFBi9Eó×ÂÒü®Ä³‘kS«áC.À¼Ãf“¶[7ˆlBðþ,Ïåèz‰ @) ìÈ¢Fm™8@AòÝÍá 7ã€þ}\AÉó+øþ#¾ÅñÑÙìÏCFf;D ëÕÓöÀ²—îÉ,VœPçCYÑ´šø$bŸ‡`Ç¡‘èüœ‘•SgkªM+wÇyDø ÿüþÛm ÷V(gÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ—g7‚©Þÿÿÿÿÿì\CMÕýÿ™b5u›Ðÿÿÿÿÿÿ¯†Ng¬ÿòÒ++:ÁòÿÿÿÿýéÍ)<\ÿÿÿÿúä<,BäÿÿùåÍ,dÿÿÿÿùß9+EçÿÿÿÿþþþþþþþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿŠÏr„àb°ãœyÞU}ã]ÿþüýþýÿýÿþÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿõÇËôR!ÿÿ£¼²ô†ÎõL€/ÿ$1Dä³Ø'ý 5 ÿ øöö çã× õˆüþýýïÈñGþ;ÿúùò Oøœé]¶ µ íÊ ÿ ÿÕþ0ÿ8e¶9 9»A\ÁÿÙëi³È«Z©T ‹7 Dþ¿þûN+ÿõúûû:>þîø Om IDATþ6hiøA\>·]foaQ<¶Çß òƒ€ýÿøóÓáþþû5%)ÿÿÿ!&$xgdlÞíþù :ðýÞàå"1"ÿÿ9:8ø¢¸øÈÐ÷¦Ôþîã ïúÏ2ý / ÿ ÿ÷óøÿ2(6Áç±Î¶ÿuþÿþþÿÿþÿÿÿÿÿÿÿÿûýùÿ $}ýýÿ}÷‘³4L1S4yýÿÿÿõþ›IàRÊIÿ@ý‰ü¾Aýäþÿ)ÿÿr˜w3ýÿ$âöüàÿþþÿÿ%±ÃÇüó裕ˆ=5n€¤Æÿ9M~pMýþz{ÿÿuQHj¬ÄL%yE'þþÿÿÿþüýRrIýñÍÿÿÿ!)»ªúDS ÿÿÿÿ 1- ϼÖÿõ^34¿õ =5 ѺÒÿÜ̹#4üÿÿþ(êßåùüÈÇÖÿüÿÿÿÿ=ìÐey´x6ôôÿúö8â¬iÆê­ÿÿÎý‡iÂÿüþí±_& œàÿ­9ÿ£scrÿpaFÿÿÿþÿþÿíÀìùÿÿÝ»í, ôùøÿùêåôÝÌ·Ýéù by’pK6¾ÌÌ?8 Ô·ËÿòÑÙèïÜä:?'ÿêýéÿýüàÖãÊÈÊ93 Ï¿×êáÖïúÿþÿÿÿÿþýÿCTÿe€=QaÒ¹/ëÓ>bA ;ƒ˜DIcdØL ìÔÍ鶶NòÓ( íhVeVt•XABG>=9Úù,d;<-0äÚ–qzí†}‰I3ëi»ŒN ”2{â …: \TŸ£]ŸÿóUKVWW“§›M>^N¡³<cK¹ï•ÛÿÒÎ !y!ÿåíúéø2 BºŒ9*€$ þñ÷XòICøà¼Äßž¾; HSA7&Ê¿½6g“2*EI!}c`æÀÓõ§Á²' êgXe^{Ž×t9vÅwCþÿüü\xýÿÿÿÿÿþýüüýþÿÿþýûüýÿùûýÿþùûýþýüüýþüüüþþÿÿÿùûûÿÿùûûÿÿüûûÿüúúÿÿøùþýûþÿøùÿúúþþÿÿùùþúþýúýùùÿùúÿÿÿùúýüüüÿúøÿÿúúÿ¦bFB”¸ ûúúûúúÿþýûüýÿûûýÕŒ-|Ó³müúüÿÿÿüûûþÿÿýûýýüýýþÿÿÿüüüþÿÿüûúÿÿþüûüÿÿþûüýÿúúûà¹1pÁÔµŠÿþýüüýÿÿÿùûýÿþùûýþýüüýþâÀž« [v8ÿÿÿôüð”à}y!”ÿÿÿšç8V ÿþÿÿÿÿÿÿÿÿÿöÓ;7kÂÂ6§¨§78J¶¨²a™bÿ w$’ÿÿÿÿÿÿÿÿÿþχ'yÚ¸rgXAÓâùûõ†¥Æ@& ‰oF±Ëôü÷c‹½c?ïÞÆmn|Úëù7QkxZÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ² £> IDATÿÿÿô}Ï IDATÿÿÿÿÿûÿýþüûÿþþýÿþþÿÿÿý÷ÿùÿùõýýÿÿú ýþýÿøòúº¯üïìúöWjûWWÿÿÿÏÎï!'j€•ÿÿÿ³ç˜Ø IDATÕùȸü63þå ôîûî!jnöôSbÿúïäöî ÿÿÿhdýýæÙëHG ú÷ üÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ"%åúá67ÍÜúœ™þÿùÿµ„jêÿüðàl}«æÏ™>NcêÄ€DOrõ¬n™S¸ùÁ5-:÷å§2+KõþÕˆ*FŠþrgƒúthùÿúäÍz¹ÿüÊÄýüû ÌÍúþ  SOÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ©­ÕÿÿÿÿÿÿùîÒæêôÿÿ+Tý5iÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ?$ Y"ÿÿÿÿÿÿÿéÊÍãêÉËãÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿêâÐêðøÿÿÿÿüý)'úýýalÿýþþÿÿÿòÛTVfìôê:Y~„jHÿñÛTWgó øèò/­¥Œ ïÐ&Ns9úã -ÜǶAu‹vQ»ŠgÚÿxruW|‹ÈŒjŠ± $"ØÔáT~¡qIõß(Eq{B×.ã˶ 0i•t?m~™ñé{…ô…{j€;%éqÊCðkŒõñßzq߇u¹˜Ó.þ8ë¾µdâ°ýö«Cdïø  ÷óüVÀ” ÿÿÿú­CcíõøòúTÁ—ÿå’|³ŒÉ1 ø5óË°]Þ¶ûѬ¦\ ((íËÜm„Ms/ÿÿÿÿüÈ¢¤b¤ôêûBµ &úÄ §g§ )-óÏØ IeV•Pž+F2C%é$宽v‹ú®˜.ܼÖTÂ¥ ôUƒˆüågŠ}·mH vȇB eRHôÝäñr˜©X-Šspýìpux ùäüèmnt€’ŒuO5,&3ÖúéÈÚ÷.¯°Ž ÿùË‘*}ùݸvüЗ&vðÞºy·•|„¬Ë)"ÚÛÜRu”pM/ñÑZVoõ#úäÝ 5[«‹fá¬(lÒO¾ÑY¸—k|[¢Äë!Üàðy›´K'ôÝ¿Q`z $øòI<íí…ƒ`*Ȧ‚x›¿$!ØØæeŠ§_<®†EºôUéå×/ò¸Ðø©½¥äÒw«ìõ€’óp= 8u°Ø¼¢÷üþÿøû ˆùÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¡tCvšÌÿÿÿÿûâE2AØÿÿ£p@jŒ½ÿÿÿÿÿÿžtCmŠºÿñÒ,+7®àþÿÿÿûæÉ*?^ÿÿÿÿüç<,BæÿÿýìÖ47KåýÿÿÿÿúèÍ/:O÷ÿÿÿõà-.7¢ÚûÿÿÿýïÙ-£ÇàÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿùË’'KŒÿÿÿÿÿÿûИ'I‰ÿÿüZ6*Óôÿÿÿÿÿö᪴Êÿÿÿ…a?±Öÿÿÿÿÿÿz\9¾âÿæ²-+5¿æþÿÿÿþþþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ÷ä“žóÿÿÿÿÿØ°ŽFrÿÿÿb8€¤ÔÿÿÿÿôÖC-.£ÙýâÃ/9Vìÿÿÿÿÿöܺ,=]ûÿÿ²QOfƒÿÿÿÿÿÿ¢p;x£àÿÿÿȧpd{ªÿÿÿýûøíïòÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿüüüýýÿã*/ûùõ ÿÿÿúýþþýýÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ÷Á¿æLr3ÿÿºÍ¾õˆÂéD­Bÿÿ3BM°¶ÍLüFÿ ÿõôö þýþåÝÑ¿¤ úýÿûöêÇôAþN%ÿ ÿøøòþþÿÿ ûîß ÿÿ=VüúÃÓ©ä›Uÿÿ[Zû­®ZÒ§ä•Wÿÿ][ü¥¥÷2 ÿÿ 7Yÿÿ²õÙúç©«ç Üâü2#ûÞüÿÿ"MgÌMüÛûûÿÿÿ ÜÛõÿý'1ÿ"þ ÿÓãô ùJ ÿ-þåýþþýþþÿþþúN9'ÿÿ4!ÃÜç\8C<'nXWEIOcbZUKïÍÓî-2ÊŸŸÈüÐØÓ*ú +7SDxa^í÷úü÷òø:øÏÑòWˆ+ÿÿ )R7ì×ÐÏ  ¸¢ úýÿ÷ðÝÐûþý#*Bÿ ÷ìæþÿÿÿÿÿÿÿÿÿÕÔÛÑýÿ ûýÎÉü-4ÿþûþÿÿÿþøûÿöúëýýú 311øýÿ0 8ýÿüùÿÿûú ÿÿÿóÿûúÿÿóýùÿÿÿþú6-ÿ¤‰þüÿÿþùÿòïýÿÿ ÿÿøýþÿb®IáÚÌúXA6Hu§Aùú*24& û210ÿÈÿ íʧJr±£ª” îÄ¥Xªìüöú ûüû 311øýÿ£;çÿÿÿÿï:Eý÷quü‰‰õQ]áÚùý .&ÕÇäÿÿû„_]Ë÷ 7+×Åàÿÿä×Ã*ýÿÿ$ëìö(-////00. ÿÿÿÿÿÿ ûõñÿüíÖ%:æ©Ðÿÿøʸ /&:å§ÏÿÿùÉ· 0þýóÿõÖ %þÿú4,4+5, ÿÿÿúùÿÿæ±Uzÿ$ý÷ÿÿÿÿäõù(. ÿÿÿÿÿÿÿÿÿÿÿÉâìÕíè3 ÷óÿÿÿÝÑãõÅËÝ&M\l¾Çªç¦”æ%ÿ0///00!ÿ×ÖÛ#FG, Ñ×Êÿ #ùÞÛöÿÿôÅÈïÿþ#! æãõ(-////00, ÿÿÿÿÿÿÿþÿøÿùñæòèý½Èkjø æáúüÿaz€Bb[òÔNýáÅÌý0| $‰HZ]îe ìÔ§¶î£»ZüÓê|R[gx4ùFYjUH7ܲÇõ0¨} &æÞ¬–œ jd^–^Jî]§|Eÿÿ#!á©ZŠ'9Ô¬Ûýþÿ$’À)i» _éÏšÊHɺ"“½%eº_ìИÅFÇ»$ñ¦T…*BÒ¤Öÿÿÿ Je, ;j-Y@÷ÍÆÓÅþkØ‘ÒY]Ü@„QgF["£;k*L/ç´± j‘Gd/§Ak2`Dì¹·÷B$ ćh— a¥o7% ÔŒŠ‹ljJ Ô‹‰‹dnuþþê{~ÙKñжÈû³”(ÿÿ%Q%òCŒ¡3-Þ¹Ñáþ+›y[ž1J?-ÖÇ´ FWvzuRlVÙYWôÞ¡¬Éœ»º/5:0Ø”‘• åDZ-:ìÑ»ªÈØYhZey`ý^LϺ»6ÿ 0OhžL_oQC1Ô»¬Ù H¶—l Öί–¡\9[‹½³›…ÿüÿûôø ò :0úÿöé úûá21ÈÎÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿõìãÍËÉÑÖÝûÿÿþþþÿÿÿùòèÑÎËÏÒÖñùÿÿþþÿûóÇÊÒýÿÿÿÿÿÿûôÇÊÑüÿÿÿÿÿôêÝÊÊËåñüÿÿÿãÜØËÉÉÒØßýÿÿþþþÿü÷ÇÊÐüÿÿÿÿÿÿü÷ÈÊÏûÿÿÿýûÕÎËÌÑ×ÿÿþßÎÈÚêúÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿþçÈÎäËÙûøð“&VþÿÿÿÿÿÿùðèÌÑäËØôóþÿÿþÿÿþÿÿÿÿúðéÌÑäË×óòýÿÿþÿÿÿÿÿÿèÉÏäÊ×úýû—'NúÿÿüéÙäÒìÿÿÿÿÿÿóÞßäÄÎåÎÛüÿÿÿÿÿÿÿÿñÏÐçáöþÿÿÿÿÿñÙÚãÅÎëÛêÿÿÿþþþÿÿÿóÝÞäÄÎéÖàÿÿÿÿþþÿÿÿæÉÏùúýÿÿÿÿþóäÄÕþþÿÿÿÿøÙÔçãõÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿñàÄSŒÅÿÿÿÿÿÿÿÿÿÿÿÿÿôàÈÏáþÿÿÿÿÿÿôáÈÎßþÿÿÿÿÿâÙÒÉÊÌöüÿãÙÒÉÊÌ÷ÿÿfU9ÀÛîÜÔÎÉËÎêõûÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþþÿöîåÌÊÉÎÔÛþúìÇÎÝþÿÿÿûõØÓÐÉÉÊÓÙßüÿÿþþþÿÿÿõîæÑÍÌËÍÑï÷üÿÿþÿøëÆËØþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿíäÛÊÉÊÛãíÿÿÿÝÓÍÑÛäÿÿÿçÜÓÉÊÌçôþŸs=‰°åÿþþÿÿþáÚÖÊÉÉÓÚâþÿÿþÿÿëáÐÚãñÿÿÿÿÿÿìâÑÙáðÿÿþÿýøÓÍËÎÔÝþ÷éjYaÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿýþþûþÿý÷ôÙîŒõüüûÿùýÕÎê ÷ÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿûô©;cÜêÿÿÿÿ󽜚1pÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþýû­@c×áÿÿÿÿù̧˜%cÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿå«l¤ÒëÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿfU9½×ïÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþþþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþþþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¹wv‘´ÿÿÿÿüãH.5ÁîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿøãÇNiŸÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿýþüÿý÷ÿþþâÞÿýúþýûüþþûùùêýÿÑÎÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿõÒÁ²_ˆñôÿ 0L§†øÚȲ[ƒîðþ)J¨‰ÿÿÿÿ\I+]ŒÄG+Úš=d¦ùZÅŸdåµ9VŠ ‘råÊ IDATù@Å©~ÿÿøê‰xp°ÉÞþ h€bE,ÿÿÿÿýÿÿÿÿþüýûýÿþüýŸ ýihþŸ• \hÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿþÿþÿýÿóïåñä ÿÿÿÿÿÿÿÿüÿþïñüÿÿÿÿÿo4Æf IDAT>„eIDAT2Íàƒ&ë!=ŒIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/cookie1.png0000644000000000000000000013633313051004444021002 00000000000000‰PNG  IHDRz[T2ÒTsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ÐF\¥ IDATxÚìw|E×dzå¶ÜôB B ô¡wé(Š¾ŠŠ>*Š‚( *Vl¨€¨( ]‘Þ{ïzI()¤çæ–ÝóþqSnBð±=>â³ß{÷îÎÎÎüöÌ™3gAGGGç? WŽŽŽ.7:::ºÜèèèèèr££££ËŽŽŽ.7::::ºÜèèèèr£££££ËŽŽŽ.7:::ºÜèèèèèr££££ËŽŽŽŽ.7:::ºÜèèèèr£££££ËŽŽŽ.7::::ºÜèèèèr££££ËŽŽŽŽ.7:::ºÜèèèèèr££££ËŽŽŽ.7::::ºÜèèèèr£££££ËŽŽŽ.7:::ºÜèèèèü§‘þàëׯcL¯L„°ðˆz‰‰â)ýÁS<øØÓª9ÄËê£? Ž%"lZ¹}ýrƒ,ÿ]¬’ÑšÐóaÿ ý éèüc¸|ñÂßk0Ulvqþ‡$¿ÓXŠ@ø“{µî*ÖÑÑù‹ÐåFGGG—]ntttþGñö÷t¶¤W¨ŽŽN¥(Šòî{ïŠB9£„s>zôèàà`]ntttþ<ˆ =冈ŒFcFFÆï“}0¥££ó›$è÷ÏŽër£££ó¡ËŽŽŽ.7:::ÿ,tWñ?jPÍ&–¤ÄÁ5Ü ö `¢ T…ÀI8T•Xñ¢~"‚ 1A€¦%hJé*¹¢ ºÏTr-Êò”]QSÈã ·—DÐS èr£sÀË9ñùê9ßñÒO$¯ˆf£[÷l Œ1bä¸ñÃÄvßö#&N† ¦^[ñÌp´~¶ß >ŠJŒ1"Æ$œûaä¾]üž·çkg>_5ke·wW‡+ÑAdY‡¿Ý·zñ­Œ&ú†7½¯i¿Ñ>FÕ FjîŠ)ò¤FC_ž!–¨–,¦.{x`žÑ-9LôŠˆjÖ¯qÏAfI]ntî¤)r£1Ó|e nO?·rú¢ãGú½þ¦7l©+mZ¬5m݉´É‰Á Cd÷ñ/z}ÚÁ]Ä0íüœÝk¯4zy­¯Y "íö•zˆ,më´QçR¤ýÇÆù’3ÿúî/==¿þ˜¯[4«ÂµâÁº3mE®-ʇï:~Sm!•LkiZ`»§Ô Ó4M)ʼ¾wÁüñ_5ùNó ªVjé辿µäH!ñÍ«Öm]µn먦ºLùÎ+÷Çûndº¸dŽ_—çãžøn©&€8ÉQ#굊=5ï§F –¿é«ïüZ?XÍBüŽ×5ù£áç3«ÞûÑê¦]î­V¿}õæ}ÛM\Õ¹Sµä¹CR35€$º´`–µýS‰-ÃO|óƒ&” yE5¬Z·udݶ՛hÿÜ’îíÃŽ~ñ¯‹¹ÐµF—»ot±*f_‹#-…~uÙ¡ëAMEFÖí¥¤ÌÎÉã BÃá/{ßÚµyç%É„¼Ý/¦fE¶ñÀ/†W0-ûÔ¡KÎzýŸ Á91Æ@¤¡zçL2.Ý+0FÄø R,Æ„Ö„›_¦grF•Œ ºPuଘªYG®&]mt¹Ñ¹»Œ"0‚vÕžk³TaÀùMÁñ¾f¿ÄÎ>®Üó/‰Àµ;Œ{8cáÿ;´~í‚C Ÿ"ã—](ŽìT倨ÚD%ÆcŒAðŽŽöfׯ¦0ŒáÊþ ¢wlHˆ5®µ?\ÏTªc 2úGÕtÝܦrýñér£s—³°ÀžŸí(ÌÊ»¼mͤ‘þƒ›µò³]>²+ Õ3F ÜÛ¦cèÉ•kUŒ4òIx ®ª¼mÖK,r@bB•Ûá5ÕNÙd¨0aE0x{C-t“\Wö®óiõ‚Å2F¶é™¼f½â¾b¥‚È’‡COÕöOEwÿãFPRᎂ)0²ÝÔ¶ºU¨Éï^Ïö ¿9ç·* pG|cÞÉKãêE20,­ÆŽ8ÿÜGõyÎüÛáŒlðcŒ9óm²z*ƒ#;¦DoFPÏ~x9Ý–µhç7 ËϾèȹçG³J­10VdO—¤¦‚þÔåFçî°mŸî3׆–Ì[sšJ El°Æ4ö"3Fù\¼ºqQÝQƒá9ÉF¢,ÿŠ„‘SH´ÌÄÔó‡ëÄ%)Z±ï†À´œó©-¦zMhŽÃ‹Ö[ª%úˆªûŠ#B/¥üüUÃǬ䔌‰üjzòyK§z£ÔåFçn1oHµC!m`LI;v1O«?hRÝ„Ò¿œÕ·–nßä⃌âoôÍ2À×¾MØO˦nÔºfˆàþ 8½ü5¡q ]Ù'/ÜÊ«1lr“&UJ¯˜¿eòâÕ›ì®Qómjà Ì™.tÒ·&´Ê£ ut¹Ñù›[;€ˆôߪ¼vT|¨G îþÿò‘Î&Õñæw6i˜à8±äm‹ÈKÄËX§×“¾V)làüVŽG·¾Ôö\½¾Apfç\>UÕõ¥/½qh®ÝQ3¶Q¤çÚ\8ôà™¬®ÝÚûÍÞ+~Ä5G~zÎÅýEQÝžÃ[#®‡Ýèr£ó÷Gö ­‘({ú>Dç­sùUï}ÍOFqô‚jHlܧMò¾jÝž‚H¡µ˜¥ 'Œ­YO;š_vBQQ987Ö}p^õvÛNl]“së$Ÿª]^ëÙ±¤‚ JƉ[Uû¾d€¦z\Q®ÝôÞ¤£w»š$ÖldS3³R3Æ Ö¨n¯ÜÓ©ƒ ×ÃnþÉ–÷žûô¤š=Ÿð Ñkó¿lÇx¬I*ŒPÙTµÇ·}xþáþoùã+ÚL¬ò*ž«Ò+Þi©‚¾„áoôê2bÁôñ-jøVH¯e0úöí› [7ÿÛ¯Ž²žÊ*ÿ´\W¾Óeü‚™ÁîxÀÎUñÌwºý1þ“ѧuttt¹ÑÑÑÑåFGGGG—]ntttt¹Ñ«@GGG—]nttttt¹ÑÑÑÑåFGGG—]ntttt¹ÑÑÑÑÑåFGGG—]nttttt¹ÑÑÑÑåFGGGG—›?  2 LßÍQGçÏDº»„Œ1Òœ¶\Åé"dÙâk4@09ò2Mc¶fc¢Å?T)¸©o¿Tš?£Åj-`»ðEÛMÛs:¾{26Àó,ŠíV†èf’Ų"qWQv†ä)+™6›RºÃIéÉ ’ÅÛ\”_PÉW$˜C•œt•Ê¶Èe‚Áè KBYRq5¯ €{ûû»ó†köì"›Ó. •WcŒÔ"[n®äb2蹨ut¹ù}0& éÛÞ{ìê•ëEN2HäRÈâÙåõ¤Î‰À þ쑳7ÓeÉàÙ™)¬Ï”E)?<|ôt!â*×4&Zp˧»ì_ªO‚àH;W Yš‡xY’q‰]Zýìàˆ7'ÕÐJŽ&Gòª—žt¶NÊ«Ë8.Hƒ¦ºTb²$ ‡X»ÏØv+fÎe‘«.…˜$É"Íå×å½Å§§½¦’ÉdÔB[¡ËâÛò¹ï«1·:å­ÿó¥ú#žÏEf;³`õŸäçIïoó®Dm˜ÀDgòº·Æ]KsÄ=ò}Rýjšn¡éèróÛM@ÍÞðzÿhØúéÏbk…ˆ š-7ù§é;>껶~L ç`ó­;tÈSOT)J|lUC`(:¿aÑÛ“Ú½º-&Hƒâ*Û2…Ù’S³ÛÕ*®òj'Š·mÀ˜ 2N–véDY]5¦Ž6âø=I&Î@qá¡ÙÃAØ÷t£³õgŽÙTQîÈ?-ÁIã ï£q€ÜØ4ãÁ½ŸOŒzñ ‘‘ãÄÁkUš=Æ …Û'/Yt¶ÅÃÏþð;ìXÀÔ¬cß½øTÜ°qÁ?ÌзŽ.7¿×²wnnj†ÖúÕ£ƒIu@ øÖì÷fD£K^U5NÅ‚¡).{%'à.¸-.§€æÔ‡X¢¥»21%õp 6n(iPµÙ Š4ÕÆ!pW¡Ën*•¼â¯4U#FªÝe‡ªºm€4§bG±"E4mÝè»å)v[eQ³eÜÈÍMLljn×ÿÃ×|\ûßiËK ]ßÛTÅ/kù¢·õÆ­£ËÍï•[–(ácc#A®² ‹Hƒ5*bÅ&ÊsyçÅùë6LcÈ>w™ 昚ÁœWò½hô6X ñâƒ9,úÎHn•Àgöa»Ö&*Š‘¿ÆðË##F²_Õ`€ë(]nþÜ@ÉM³[âk‹÷ƳΜ YéÙÅ=T «ÎË?µpöà =z¯ÓZ÷µþödÿ¾ÀnÞÈŒ¾áþfNTn8@qjzó“åÆiLd†?zo‚,œy×ï>îÙÜ(0HÈ9ò©Õ‹> j™‹ù+IGG—›?CoDQ€ær•ö¬[Çæn\ºÅ=–áÆnÃ?xÅà@Þµûõû”§&0&âW½ð€ì¼É+Ðj4ÜÞ{¹†ZO¯k]Ë_sÛL û±eÏøƒ7–½ã½¹;ß/Q<Í)ÖêóúdQ€(äŸÝr³îÓ±\ѪŽ.7!Ä…àÚ¡ÎÃ[¬½€Sd§icº²v½¼ì{O9Qþ]ׄ{F–Ñ«®, T™µÀDQ¥Òp%.üñ $¯Ú=[´nÅ9ˆA²…ÄÄËŒ81~móU iäËõ­³ut¹ùKåFAPÛÇ»_9¶ÿѦ ÃŒ«Dcœ6ÈçO°Ážœ—§"›ŠÂ_721ÆFÕkë9cM`Œ!íð~C`‚Å,»caˆÀ0€xi ŽŽÎß”»&ª˜æª=Õ‰8>gÄöM»!A61‰ò’Œß°d·O㶆’îÊI2B2”ûÇþ}Œ0ƒzmM‘Jæ¸Öÿíz!W/ñ®3BŠCÙ}/F¢’¢Æ(çÐâC›×cŒ$$£‰Ùä®@wëèÖÍo²<ˆ uǯ²¬™yrÛ+_Ì¿)ŠŒ‹ÖàZmê û¤~«&\!¨Nû­Cs>5·¼TÉ­&ý\7*¤x®‰+.{áíOL@æŽ-v›šYY4¥¨P«6§)ö­Ü©Huh•F×1hŽBEQË\¨(Je·›qýèµZo%O·q×–×ú^LÍbP5IÛüTÓ­Œ‚Ú<ÛwÄ ÌÝßì¿Ù C7&²Œ/¬ž¿‰@šªÞ˜Ùë 3Ä xg·]¬ówèÅô‡}zRÍžOø„üU¯}&H%#iàš{ue¬R©ç`îßL’¡¹ÀË{gˆH™(Bs'xMˆ`’ ä‚ÆKF-D`L4€Ò¸»D`’P¡j7D `ªZü$# •}Rv=Æ$¸«¸$•ÞiPU2DÕE0‘I·)‹ê"”D ¸Ë\¶”â¼B¾úõþ£ßq¤»<ž?¼ÓÕo?Rç?ƒlÄ‚éã[ÔðÁ³a †¾}û&$$ü“­ÿ ¸ZÑ`%ßqüÎöQ‰™ÕUr®ò§!Õ€WÑ âþ[s¢Üwî]ž%`¬ø°Jážc*ýŠ±;\vVÚË*½5Æ@*ÊŠÌ‹o­EExýH2Lf¼úöÂß@Ѥ݇?Àµ«` ^cxk2ˆàçg&aÏvü¼CRgtí‰Ï>Àµ«E<ü¼¼ðÑÛP\ðóÇpò–-ÍZ£Ï}øz.ž€#*ﾧ&3^˜Š g1ÿKG½F>³gáâ9h<…èêxå9hŒ&¼> ûañ|h‘„ý0cÒoBÓ0åȲ.ú`JçoÉ7ŸãòE‡ÂK óPXù9`@aòr‹ 'EAQœ"ÙP˜Îa/\Näæ@–¡©PTØ QTIçPäç‚kpG*Ø ‘› I†ÓNÈ/€½¾þàTòr‚­—‡Ül60 ?Šo@Aòó ? ÈÏG^À@ Ë>˜Òù{òŇؾ_-ƒ,ÿ†!Òb0õËçü5ƒ)‡¹ ÓSwã`JÏwó?À û1ù-¸:·Úîü&úÕGþòý9=ÿ¼ÓW«–â™GQ¯?U}0õW@DL`‚Òàö£þ-ŠÄKò舗¤ž!$Æ\ûïÕ`„·o9KA`‚®æö³‹ež,®¡,ÛNñ .”¾áÜ·v§›©P\+¶KŠŸšày‰âèñ¶6È5¸ç˜P|âànŸ9 IðœV$"Æ àýâ ò«Ø½^ú|ùŸÓðîTWå®+Þ6õÁÀÕâÔOå /œÿ­£¯î>¹aËÛÒù«Ž=â<ņ1ÆsŽìžÿ^jjšäS=áÞ—êÔ«F´ccŒ Oì˜3=õz¶WÕV­GN ò=ƒ5™È/ϼûB¾Èʬ<Íal3}e5sŸˆvàÃj»/[Ô³êÖÍŸiHˆÚÝË{[,©;æ5©7®’FÿçwbíÖÂÇîúùr_µbÿ– êɯÆîÜtªz—‘‰‰áŒeYºhÜ¢fO}Õ(!RãP6Õ¥þ>íð03~U9•Û濱xØ盼öýÇ3” íÕ°šÕÂW6½0S|»qŸG‡o»>Ë;1wù̹ C'%„û]ݲyJïÄç74ˆ5e™µâÓïë {¹n˜¯íÊƯôn8aC½hÔ›ÃÑñ‘Ȉ âL‹²$BdÙ»Þ|Á™Ð¤ïs²ríð·Ã3¯¾Ý¹GtïÆîí†üÒw:+H^²åóiNk”ûo{o‰ìÚ]ÎMìÒ·åX~øØ…úƒ¦Tq§AòÇñ¼]‹_Ü}BR—jJÖ±Ÿö»5rI‡V1ÿC/gÆžSñoût‹6U /,ÿéåÁÝßZnñ4óXPûÇš%Ú‹[€ ñëK·oe~ærç)L;%†$Hš‹|¬Î´£ªµ®——ô÷\®+ÝebÃXþ±õB@Ÿ¡=–|±+_ç+•Õ;)6{a'&­&//wFQÕY£¨*M&oQ(îš#ßa·1Ñèm¶zƒÈiËÍ1ùq{ŽË¥2Ñhò  8 ÒvØUÙž•c0û˜ bÙ ÈX5açîë­ßØ•XUVTXÝ÷G}ÞwÛçS«}ø¹_I›å·­˜hð 4D·Ù¬Úóœv;‚l6Y}Žütf d®§"y0îr䩪 &Êf_£ÉX,AÜå(ÈU5 £·¿$2rf¦ ¬èV³%ÍžNæKÕh\s‹wøÖ›*®·z=Ù<½÷îÙÏE¾ô¡$Àcð˜Œë;ç u^iÖµ w«Ó<÷Òºä?%¾80uç7r½7švîÀ]Äâ›gßpæÇŸžê'(…NˆaõºÖ¨æ9gQxjÕ™›Ôíåé&b,ÜpkÑ’Om=“¼÷ïæµxv2d ‚—ÍŠ{r‡×É©»öVÞh¸jÏ»%Z‚ŒF q§-7Çè‚¢+ç.qÁ¿ 0'Ãhós²Á;¤F¢ÕÛT¾Ž³mF^Ш!ƒï£"‚ÜÔœ¿ö§ËZ%=+:{n¦h 3Å‘Ÿ£©š`ô6›aËsXüƒVéðŽAĵ-o8ÃÆuõœZvUÓÛnýzÃÇ»0\²Þ5;x—Ž€ù5ßO®?òPIPƒˆ«ë_=v,M Ú¼Aç‹ ‡Ïª›fËË–½C #0Ë‘Ÿ£i$š|ÌFµ _ñ ,÷è<åë?ÓtWÉ 1&âÒáeRÄÈÀfýã¿›µs÷Í{ÚGhD Ù{–¿;¹PµøZµœµÖ wÚ´ª« 8þÕÃÇž¶FÔ,J;o éÚsÂkf‰©ç¿\öÉ\Õ/!КŸq9-´Ûû]û6FÎÉeSÆEÅ6ÌpZ«Eû¤\#‡è5þd'Zþ=—²-~·J—ç£}JÊ0âÎÇŽ†$ Š•’P=Õèû†$cI¡ZxaùËÓ ¡U /á^MºOŸ$‘í謕ß.}«ùX”ŒK)~m^é7ª‹ætn›y¯+ø¼3Ë,µ||è®÷ºp-- *^Ë<™móo>aa0#)Ù›ß{-£0$&.ïìQŠLê÷ÂüÂÚc[62•ú὘ûÞ¨š»eb Gß÷õÂ{õ«ÄGDI ‚ŒLf³3""buÆ|– 0"RNÍ9~#¸óS¼î!ˆ8—ÚúÕ”9ç3 ¡fŽòN!ƒ„"Í£WD #vµôS"ÑÂ(6cƒ—hp›]ÐT"Æ ²o‰²Åêmv{—|¶7Íþ)-ßîsí*; [!üüAàNª÷ÌO’É|ñè'X7~£_Ô½+š·‰€¼ã˦<Ñâ©õ^'>N³+†Ó?¶_Œ±žØ»È?µrFpƒ'4¯ZNpLâ•ŽqÍw\úé…îUÆiÝÄO4âô'÷í;”X§9ÏJŽhVûðšÌá3¿wüöÄÉóåü/¤IÁ=ÛÜ× eß•Ðý$#r±àøΧ7,°+],beïY]ß63ÝÒ³C£šQ‰ ©HõC­ì­K§¿"˜jß÷ò«¢Ä\é{–½<ºîÓ‡Æ{‰y¿ßѹÁ M]ç£ÛVß·Jýég¹›>M¾”V¾`ª)²Ó.M˜nÝ¿”ãçö\eœBL÷^œ^ô‘™ÀDYü†Ë¿ÏýŸ4ÈÈÝõú‚YSãZ,ò=9õÀ[Ï÷öEùAË=¹p˜“Çïo^[\ùáÜ ^ïtïךsäš³ä‹ñ×[¬‹4 LÒM‡O|€;Ñ´uâ·ÓßM¹6ªFµ†íuújò®6O¾îm÷ˆ*Àóì·2½›õ‚gðÁl*µŠcQêÆžSׇúB+¼¼ä…~§w¥&%E^¾²¦2OŸ"Â| e/<Æ«÷Œ0¼}>9³nD4>¡²ªž?ñþ6«Vñ·_Ûvñb@³{Á…èÏ$<õÐV92ÜÏ–²ùjJH³»1‚f/â »>:9wWÖJJèþhd„ÙìÅ5»ââÌÀŒ”[9ŽÚ Mӊݧ “LæßpϬ¯Œ )JT¿×ü÷÷ñnöPû^-4ŽVqåWË[Œá'«eoxÒà“ôzÕnú¡zB|55çäµYÍÆ ’\ÐLÕ:MXn ³púbÇ!{Ç©Ûã#e®i›§ôMLc’l¶VASÓ²ó̱!^DÅwâåÄù— f3nµ3–nmòò.3÷´(åæÖ7Ÿnðä¾êþR:´ª&Ôë>á¯ÇÁiûNˆ=ÞÝr¬~±hn$00f¸­`ªøž©¾‹ä†ÀXú3r»÷‹HCX|_qÅó©ç³jÅ ,íÆÉóa/T¸\äÕðå±³RO¬Þni64Ò Šdª;ø“}àÈ?·¬ˆQÓ&-í Ÿ:ÝÕ٩ׯEÕ`ÕlÒR³ªµÖìW®gÔŠT Í…Š‹´BUåF¿_ôX“ËZ­¿ŸÉQ0HööRóÓÁª&z›k.[Úu{‘]+ò–ÍJa–“ù Å/ª½Qƒ¢A½eƒxqÛÆj½Û1A oûB8 Âv~ýÎÀ^ËDÕYD`>1íî½²ü‹Â-4U4Í Iþ1 àë°gZ´p[&0¬žþNÿËß=½æcMU4Uõ‰ÖeìV‘ìM0H+· o«iYÄ*NV{EµoÒuÛž%¯œ•Dâ®j=§G€5¦sãŽ;÷.~%Yˆ+Õû¼]Í4‡S”¤gH‡V™ÕË»fýkó»ûNYØÖûë¯wü´òža÷êØýÕçÜ$iª†–Ið €Õ×cnç÷½¹WDDš¢) @SU€T´òAÞ €1¶É}C¶|;cÓ‰4g@³ÇkGpLA± ܇ݹïpÁ}ýß~Ëj\ùé»>öãÅÇú<<@¬ÚmØÛ]$ƒD@LÇño,z|Ô±óiÕéóò»ÛgOžóðëæàMïxúY//SfÖŽý)GŒs·ü?0ÁWüóš (ç¿‘šãir|ÒØQù?þߪþýÞÚàmäNÛ…eÿ0íúà©Ï<üñ6›]’}ÆÜ-Í ž@*Årê%3Õéä¥ë×TÅŘ H¬âd>1RóŽœ8ÕõUÂíúʈ“)¢6ˆ`ñ“ŠgÒÊ~\Pè2}Š»€)"„¸@!ÞV{¤•¬°û_—Æìé»òrÕ€*>9iWÝÖˆ¹ºmIÆà{‚/YV QHB¢É—Ë p H‡(›À¥žn°–Ûà(ÙGhª‹Ü6§‹ b¹®Jšêpª4Íád‚58"ûÌRôz¡ÔÇF`àù×Î\©ÕÈXy`¤]<±qyäðM’ˆC+¸xuÏòroßbÑ|ãºuŸÚ n]Þ·üØÚ9ß¿cýRO“¨VyhMßV>ŠV"€ËŽôJ¯Ö®3¼¬Åë*ÃiÏË2øEˆÆ$³„Ù¿JŸ‡öþÞ¡A г/e8êEzq*›vûñ¦Ö¡Nq»bsh"4*,‘v~ßÕè £|Œ¢¦’`Ž®Ûîò–Å.gÛ R«Oi5 \%ÑßjûÞ¥e€Å(HŒ/ž‡ƒ%2À¢äÛœ 0E´ì>uƒ <}Í^Á¯±¿9àÀ®›Olk£ Æ_’¹¸2Ë\¡ÿîͦ95ÕÅi.c®SŽ‡öü ØjT4@òŠl;’m~åzÖóÕ=‚™$IâÜA€[-ÔüB÷SI]>qÛ®#b…1K•‡>ß?$Оv£UórÛÌ…y71Úh¸}$%ÿ`Þ-sýÕ+OùV¼¬®l!ž'²,r» ¥Ë-31†‹óÝsâjù‚¹ÌqO÷~¨·@ÿóÖ 3àæšwávj+]…Hùk'´>¸öj·^1ÁU 7¶ì¡Ø6Ä\Ç8á}±uïKvI5eûö Ýó;¾Ý³A &ºÒÏdÅ E׎œ Il,3,-írƒÕTNÈ=“®šCý9•Y$Tk3î#ÏGÔ4©ù‚y?ï:::©qW‰ÀD%2pÇɘA}f¤;t%Ãa÷ ‰Ó@@þÉ/ŠP!1 cLÉ9qᢹNó$Ukó°—E]=ïÇ|ehõºÖëÖÙ$'1{Æ—9ÖÏW.3¾KÂó@ úMXƒ&•%½aÎÔMË>|³áØEuãùۋÀw5 f?‹!æþ¦ ŸœñDÄÛsý %C²o^°Ø»FË(_YU Mÿ¸Ì.@¾Å¢f_¹…¸HRÁŠléó$o‹Y˾r 1áÄÁl¶LQðEdîþxý²µ=¦¬ 0i7w^-ònZÅWË;³cáìÚý_ò7‚±+Ö‰¡Ñ^ˆÁ‚dèpÿøùßy0åŽüƒ; €AÐ\…n±´g]÷TbTj[ÜPgäô:¥7¥¹¬^¸~# "˜F˜šA#?³©ll 8Ìßy(ÙéR fà^e €ˆž¯ îqû„¹H.±jÛÄ­+¿v´~^Ò˜ ãæ‘õƺ³ÌÀ‹ ‹‹%¢(y~‘·po”´üâUZT¼Ç«X÷îÉPÔ³{RD©6¢‡|5øö6!²ÿdr¤»DnˆXή=•úÏvKFùDÖirbÿ®.ï'ôsö‹g·ú<(\Û5'< áž·«î¸üS|ƒ:E×ɲôjPARËf±;¾zÜÞm˜¿é‡:ÍúOÿ&Ð-`;¾Ül¿é}mÇlÕS=*‚sÖª2¿|tù‚иñuÂJ·½$bÞm^í–íXÿQ׬Ä¡U"nÏ:»ñZVH׉oùáNËÓ9ŒuüBèÔw3Œ-ä$¯¼ž_Ëh5¥í^<Ô³ípGú¾Ï'ݸ02ªz4Ý<¿å{kó)^„ªý§'?µúË´¸ø8WÆñ“븰Cû’9œ¹V_õ]P|ß±|×ôÑJÒgíòÐÖõxõ=TLNÁÍÑ›5[¾}æð´ÝÃÂEnÏ»yúžµ‡|jaÐ\Hxø»ìF/ŸÐ7¦q+«VxóæñuE>ºþßë’P¾›4Õ'¡ÿàUßÞV8*<<ÐvíÀ‰ {£G/5À;¡o¿ŸŽÚQ0*,Ìß–²ïøÖñ-3Š®ß3xÅœõµÔ(1bŒijÉŠp&¨)'ׯUE9ëJ w:N®ýJ$!¢ÝÈð@×¾×údÔŸÙ»W-΢üLçwÏŽ¬r¿Xx:yË 0F FpóÄêd¯[Õšõ/7¾ô¬#ÕðÀ§¦O]#¦DÇVW³ÏžYÿupϽ ÙR6ðlHß¹õj[’†‡­ì·áË7â7p¤îNSŒ›0Q+mЪ$½ä³~Øê]ÕkFæŸ]u!·Q¿ç›€£ðªõó¿n1îûˆ ‘{ìœ\å^#JýòLs·L¹uYЮUðm/¦äžÜôù´ØÁsâ¢ÍÁÝÿ/xýÐ5_¼U«^|ᥭ™Þf–I˜(‹y?¾KÖL1–yä°¥fóøªA¼Ô†f „Úm:Ë‚3¿ÈÐl܈‰“Õ«Û“÷l5ÕfÀãB!.D÷zmyußì Û—d:cîyomx™s)vä·½÷¸uhበ‹݇}¼ лØ4¨7rZ?¾v~±yŸ7¿ö6 bþ}wmžslUVž“•w}BQ}Þzð­9a¾®Œsn^¾ìßì_c>ù¾Z˜;Ç–%°š·ŸWi;ñ©îåmf‚o×ñú+'Žþ<Ï>ìÞ§žhÛ¥§íòÆ´²G[}-î6iŒè<âõwLyÇOmøúôýáÝfÜ7²T2†&xç›×éSëç]ºÙø‰’jJ #j&D\?°&ßNŒWM#œ=…‹çá±5°hö÷ ­& ŒÈXsÄ—ƒþ5ÁàLI9´öâá]N±Z·é{;vméŽY¼b:½º½×ðû´¬³×OîÌÌ(ŠéÿÙ°ÉoZoÛ§‚…µŸ2øé'”K›¯û&õšÒúÅÕI-¢H¥ˆ®ÓÔyaÃñuߤ¦QÒ¤µmšF'2ÅtŸ±§~|ÀÍ#k®œ:Ñýa/þË @ã¾-^Þ’g½ºweZŽ¡Ë«?7Œ$"6h(–¬„Wñ0XPo\Þ¿ñÊá…ÑÇßzíèÆË7d9ĹŠìîÕ¦–/.Š(:´pÚñÙ-ý (¬ºd1kû'žñQ/;¸_#ˆ&¿°(ñv[‰“1zøà×fzå?µ~ÞùSãFÌïÕ¯5W"WÖ%›ƒ¨b\÷i+BäÔ3›æšwîÞBQù/5hä›0àƒUU,é—öotúu0õ _Á*&JF£§Žs9"8*¤ü»‹ÁUPä¼Ã%ˆ;3/Ø]‘fHì9õ{?ålò¦Eö žÛÅ© <ñöã»cE¸GR¨ò­œJÂAJ¬Jæ1œ(N*åáé/>¬ÄVîs°Â#ßNz¢ÉØ¥uB©üñe'©Ì|-wérƒæ^+T=EÅÎÙ?OiiÝwÅJþSz|%g.>}…Ï++'Šíí/>dÛÖcÞŠb£ |eV2¦9òÌmž 4üŽ‚éá¨IF‹(þã©xy£F-”šßÚ•ýùû¾ÂoIvó[mÛ’ijˆåW„WŠ†ˆÖ#ÿóíÅZ¯K7w.ÅÛ¼f£Åë?Ø’HŒë8¼r}L! »„xD`z ±Ùhù¯5q]n<µµÞ·V/ÉjüáëYض-Úâ‰çpõ æ NhÙÝ»aÑ$Ÿ€(aìSÄ;oÀfCX‡“g°ø[èÜ m[áÛoq>’„_ƒKÁÓát z Œzû÷cÍ €áÞÁ¨Ÿˆ9Ÿ#å2Ì^÷ŠŠ0÷c8숭…!£q`7Öÿ÷ BB}|7W/Âì…1ÀœO`·!:ÃÆ ùV,€®}дÎÃų0™_Ñ1°xý½[ 1ãœ÷Låߧ-')~ʘ7Á•ÿNÁt¹)g2s­’¹‰»ž¦­°s Ž€´›8uDðòFŸn8²—.ÀÍ ÄуPU\O…a.žÃ©c` aèÔ wãÆ5w@l6;"ädã8}§O@æhœˆ£‡~Y™8qŠ v;\:ä“ BËvÐ4œ>†”+0‹“„ž:§…6h2ÒpúCÚhÚ 'âòÈ2úG¿~pþÍ[Rq )þf¹gÜã²ÿbÁî¢ä¡TYiYyup‡çUôC¸½¡„JC¼ÜI]~såÑ펜ÒâýÊÞ¡ò‹‹t§Gã¾vÇŸ—Þô/º *Q±¿Çí£¾mÀï±ÿû½ƒ)*vþR•Ý—ÛßUrÎ ·ÌJ]éwºVy'J¼éêí—ÎSY«+ö|—Tðí?ô8žÝ1 XåÞ¾_Ýhî|ÝÛöùMç/áz'"0¸’¾ttÏvÍ`u9ÔÈVt>®2"&på§IûÖ¯/ÒLä̳TiÒdÄôØêÁD$Êtõçi‡wmϼ~ ’Ĺ1 ¦YþSê%«êoNÂÏNúìÃÔ‡f}mòl3ÎkóÇ·«vߺ¤Îq¿æ$9'>ùñ³¹-À]¶|sxƒøþ¯6m«i8õÍ#ûö–dSq¶7GŽf¨Ó³ÝÃϘEc–=³}ãvVazCã­&î©U¶O¹÷|F¦È dmœ|ïæŸõíW‹«)8 œ œürlº³Ë°ÏYeœûàî5ßÕIœ(8½t\jZì€X¡¥ï\úÒ#«—wï×·çðÌ‘Ê51&áØÂñi9õÏZàg†ëúÆ%“ŸÜðs·žÝ¢ÀDÉ`bŒ BñûÎýS–œWöœ µpp¯…ùÅá¿›#Û¾·×­Nî2åP­j‚=eûŠw^>}²K½ÚV"V–0´ìøâöMŽ ;Öï ð5‹+ ·p/Í!€‰÷&«åÜÆ’Q– “^|÷ÈŒë?},5{§v´ÑeónÖôÞ6›}ho6Íèé óëÖõé®Õc½]6‚`lro½£Ÿ\±>®}»—® º*©s4ip“ÃùB“f˜X!àOĘzëЂW/œ:Ã%ߪIO´èÙNP `LI?ðýk“Ï‘äÕþ©ÝÛZ¹W•Àomxe´£Ö¨>ƒ’–N¸?¢ë—MZDAb¹Ç¾ßµô»¼BÍ?¾w‡ÑãLŒÀ˜$çmz®[Q§E½»VsgU;”’@¡˜þï&êxaǹê½k Ò;˜Xܲ¼jhTuæîSgXÏ6po½IšËé‘4—«¨ü0AØí;ÿû­*Ø#šŠÑ-u‡}ä8y˲Ç2Ö†ˆbe¯KMqoÈlg—o_øUNžÓ§F§v£ÿåã%¦~Òuç'€ïÆu¬;üûz Â(ïØ®oÞM¹–.ûÅ5òjLõ@pXk=Ú©I£ \vb–Äø¶Õv< ˆrÏ|å4õlÖ½‘ÃFŒ¶~q#Aâ˜ÀÔë¶~ûyfN‘oÍÞI÷?æ%CÈþùà!©ÛûO5¸4TòyU•ÀAD¡ŸìØ#ÉG‚«ˆ˜_›¨ú.ÔX QDÖþ/wýüc¡M1‡5h~ÿ¤ð 8E¶|:8¢£p ì^+4ýÒa΢Š_,÷ÈÜg“ϤšÂZ¶ûJˆ/my©ÓÕ„•ÎZ_gàk3Í2RÖ½µóV§ŸØNI£Ÿñ60vhËÖˆæ㪠 mïym½ &Êtùç7nÛéR™_­íF=a‹G”‚ä<øîC>ÝÞ Ù6&µä+J9›žëî캬g—*ÿ^|×ÈHYW/ò*c¡1‡5¼)s~oC°¹´Ï0c•†1‘ ‚lfÜ–u`õaÿø¡^@sLztŠvÇ)ob)X›}•Tp‚„«k&*¨>¢Å¨‘‚ëæ‰ïŸ]q}ü} ÔË?O\7ªåèÑ‚ãú±ïƯ¼ù€î+í›’Q9ôáØ ß¤{ äê —½@U9@)ËŸÝ´ù\Ó!ÏøJiû¾^ð˜>SæY@$yGÆ|Lt{ç&@0 #­ò,)9y0D[<vÙÙó1rw¦‹;‰Úé÷ûí9›Y.³ wú6˜Ú÷á^¿ìû$NQÍz°Ÿ¶Ü¸–bÍ:²äÃåocç‘3_7¸¶aꚥ[™Ø Ø’ytÑ’GtmApß÷´É·äöÃÆù„+Y»–¾<.¨ó I]c×wî}«WþsëÕðñ­ÝÑ€ƒ‘9n:³ûzĽ= "²öoój9×öÛw€KþzG„ùi@Ñ奋§½7`Bë0¯ô3—¼zqÈëïÚîÖB£C„›g7®Í·i>Ñmã%@%"P¯k “`™íò֫Dz«<ÐUÒv¼ºrÞ¶f£'û›óÏ.Y3etï‡È,¨~wÆ! Š,ÿܺëÉÕþ¯cÉ"FeïG/Të:²u#Cꦙ«§>2hê§ œQôÎxgÛg[6¬+3:9gØžc¼Í°¬f–~`öâIÏ |û«V”—v=°sRÆ‘e×®^“|bj$õ¶ D¤ùhÀá+~m¿d1ò»g-š|}д·,DL`™{?:ZÐ`hÇg·xV¼äYÇäc »a#ø»gfJÍ+pJ™J" dƒ˜]qf¿Zæ¢ESß+°kAG÷;†4ʾrËëÅ^æèpoMéþOöúw¯j‰#yÂÈ ŒU ºüåäù7F7¯{3MG?ò¸¬„¦‘gO™wcÄ}%ŽqJžýÀ±[Õ†LzÞ@ µÄ¯Ü:¼sS쀟붬B•¸ZW_îf׶]šjŠW“'¾/Ά0”Xã (º´(+KjдNq¹â(ÈÑ„â{ÎÜ7óLžÐ¨i«’}D™Zt~É¿º{„Ìj9hÂý‚ \µåß*kˆD’WP³?& ·ÛAP•?¯!øDú–“›íÓ ÿ˜/ûßî“P+:¶iqX¯å ÛÅGD­F7Îõ8¹zS—Aý|½Xž%8¦lÄ…ž³×šÔíþþZXBS“r|ן&¼ó‚¬‚.ÿøü®u[vCÍûÞo—EœçgØ ¾sW¼{)¼A“ÂË[Ž­š×jòª:ÕL——M—[ÎlÛ»•ª zÃù¯¿z-KóÎÌ•q}Å‹cÌñ­­¸y~Óì É“{½œÀÇæôC:çìF¡pg^‚ !¢í3½GfùþÀO¯ï[˜ÔÜ[Ó}Ò|>å‚úh4€HåÑ_þŠ8]WÉ™‹vSVDYpžý`þ[³nô¿'ÂPÜ€âú¼Zµý­›ûçY𜸢qœÑ+4îê®i+¿?­¨N—WˆÝUòL…:ߌí™ym÷—Ç¿yJö_Y/Ú½§…T5"¤8pÙ?1ÄPx=­°QŒŸ§@DV98ÿÕÝW®©ªÒœ\Ö\*¸ FLê8èå~Ùoü4eÈ‘Õk;÷ëT5lß×/ïH½©i¸¢À„Ý3Ÿ•Û½çWaá+kNL—›?³¤¾>F¥À¦°’å$Š«ä%+8& 0¨äëáçW5.ª†ù«gß;×ãÞ°ØPå`J¾?ìEîÿ ¸ Uå‚ —~HÌ(‰ŠââªJ¢©ìsFQt).l{7lL0óó§œoÕ²üT99 ä̵—HKH“¦jÕ*Q<Âö°J@‚Á'¨vLjª~šR¬&†À¦CߘiŽ]o÷¹¬†FÇ„3]“}B«Y*Œä×dìàÇ¢rÃ&ʽt0§ÀYaÙ³ìW;$2øßNjYWó±f@bK»qùbÅçRpd|MœÉÌ•ë((vRÖíh­Uþ\ªª1‰Ûì‚û f‰Žk'‚ ¨0XCÞa1Ó|¼'¬ýâÉzç{y1CDw«Mi®Ùö..´9U°HJv­r¿ä-V#³†„ùš¸b0Çß$;|C«- 2H…É/Âì_%°Æ‡=¼Îó 3f^˜5äÀ刖ƒ^ emÏôÞÅÊ(ƒ«ÌPÅû)œ÷Ÿœ7¹öäén½E©dà*Kwª¼ÜŠ>*ÚðútcRËAS|ý}¨(uããb¢·ÄŸÚIŒ@˜B¢ýÎf_Ï]=yhn`÷Cõñõæ¹gÖ}ú˜l;óñ¹KÞ­ú„ß8s@0ˆ.ÙuãØK5‘°V³ IDATC«G—_ç!Zi2¹âQ'Œt¹ùMh,°ZMùàÑKhI˜ˆ‚›{ÉÔÂ×ê±,Ÿiç–¼š¢Öê4p8ˆHcÌ?Þ"æfå¢VëçÜúÓ™~÷Ö&^<â<öNŸk1ÏôÐ-ÀßäHÍ%@pUtµÐéçoðò7œÌÌ)[;g»Räôð2 Ê ÃÞþÖµá¹å?¼X«ÁÂ@³Tš‡ªÈ¬ ´Ýsª Å‹B9 Ä+Fs7Öè4"Ä#ù?W=*‘æ*DhùÈ„Ë?±eï°Î-Â5þ«^f¤:+¸ŠÁøµŸ¦ï¿”]!¯’OÂÄÞczýò,pyßJA¶„U­ZtcÅö¹VhÄ.9iøû¯´*f©Ð¯Õ3­j<ïÝӼ䂿V{_RßÆ.…Š½q`’˜µûÝ †îo4®ªqâ.&ûƈâ!»  j¹öŸTÑÒE¥: ó ÁþJæõÔ $1Æ]¶&ñÍOV17F÷©Ÿ|ìè´G n«ÒdXóZ¾”œ{þàÏÔ~ÆÓ¨ó~æËf†œšÙü¨à‰Ž\Á3®ÁK½‘S ÏLk§Œ=v`î¢u¢¤eTòŒª×|âæªaF…r ðÔÀë{g7½æ_XRíÄ¿ù ï‹ ‡ˆÚõ¿u`FòÕÀêX˜j׶zñmAÊd*ËÀdŒï3óêø¾{—¯¦{=&Ûã@t­_½éËÏ Ûêãk*HKq«:0¶F0ç J…Çf÷-ì´¿_` •2t•™\‘‡œò¦¯lݶwéü>Ã^# 8¥öüs¿ mX^?‚Æt›Ý¼m=¦8(¥;¿8JuIg{œ×¤ Z÷½ßâ€\±Z-ŠGX|ÂKß7¨F©KåªRïç<ù¥1y_LZ8üio¯Â{7ôÑ}&GãŒÊT‘€SîU\õs#vŽij Œqd\eu[¼Ó¬÷ÂâÔyï®QWr󴸇5~êƒw4”ó f­Ÿn¾÷ÇÞ–øÈ…9îU:÷xí°óàV#/\÷nS£§{‘Y©Òû£Ȳ®î_ç~=þ§¡_kE+ÓG4~~²ŽsêÀ¤¿ÍønâÒWëkÝM–B«WdËojtï¾ç×vKÔãætßg¾©íùÞ±•ývûþÔhðç¹ßO_<¤¾ÞÍPdvxE?ÕnXÀ©L)&xžÿuD“;d§=ˆjúž·»–ƒÌ;s²ŽT5®qò¹¯šdF$Z²3ãúÿ´þ¥óßõ$o¯¬×kVýôç7¾Y[ãái1ó€äñ šE #(ªN­sŸ7M ¯R˜]}àü¢¥/øª}geR°àÒ A‘íTvPQ ŽÎêkë~¨wçH¦ ë2é‹ó¦¯^“ Zê°ƒj$YÖ0É[‘‹òÖOXpƨÂ8G$D\©ùœ2EAAC8 ãTaN¡""A(Ib@àŒ*œ9#‘‘Rª€œQÙY›‘„» ãqFeç ‰ B€3™R.Ké3ÅÁ8D‘)$‚ˆœ)ŒRg;ˆ –âSÙD™B)Dm¥o£2g@D©ŒrÅN9 ’|TYn´³ñL–9Aü7¾(œ)”2A”‘sÊ¥ŒB†«»þDù€œQF•r÷Î1…s ‚Tú4¨ÂËt¬K§äØ2ÏÈ™ðÙqŽ€(H„`±˜Ž«©ˆD—§”9ˆÑõ8 ±ä¹”žSd×ID˜B)EA)³?AA,ÞŸRED §rÙ€3ÙÁÉû_Ú6" ‚à|dDЂœ3¦(xÙ×£ôÞ‰(„Q™QN$ )ÓåL¶sA#ÇRÙD+XÚ{Œrg/?üûæÍ?:‰¡x­˜QC*lE¡Dá)å÷)Õš$‚B%A%Îÿ!¢æៜÛIÅI$¥×$¢«8µPÆwDÈÃ=Œ%û EòÈGðPSu•´b™ˆP¹%(ë‘™4 üûï-Y>á‘)h,•~3])‡@©ÂÓ*ëð‡}Ôƒ(~vBy%Ìâ ¢PvbYâ_è¹ :»³ÌºC™GóˆýQœK†¤â«¡-ë¾-Û¶² ‘ÅûV¸w"h~ÄeÏ€‚¤ûãÞ{|2EÕŒð¿%x÷­ü.àÙk†œåF'¬û~ÓhÕîV¡ÒÍ?‰ËæŸÜóW_Åÿ±¸Í¿\é:Xíp*Ýüsáôâ.Úr?/2ð/ºDÐÉ3=û׆'"r^…J7ÿõéF¯Ã8@+üô(iôJ¶—H[W²½÷]IdDÅCJÊqVÞæÊ#*4EZs`…›}¨1eõ¶µvQÉù%‹ùwxDW—Ù³lS8ÿÛiš©Pé¦ôM‘^Z?÷ÆÕ›‚)2¡ë{ašGi†""·_>øã—¹ÏÖ¯N4ëmǶ¬-0+ÆàÚuºõÐ!ã%´ßÞylãªü"æ“бÁÓ‘q@$´ÞÜ~lÓš øVïÜ ÃSàI èúÖã›×Z‰_R·úíÚ:«):uì7wݼ¦ÐÆ}k>[¯}Stpˆrë÷¯¯œ9Ë4þqϼ[%Î˹–BxÁ¥_ݺz$ßðæ¯$IR…áNXöžyc”j=ÚuhK+†ÁóSK^+òÞ왈ó_ËVôe~ƒý_&ÿ‚ eîßôóB—ÌsIÜ7µK5‡Ï4\Û>}²CßrÄ(m ¥"Jpcû§úZ­†Ô¨cñòO$@$Ö=“»=™ê×ÀMJÝ1¶ùµ”l‚•§a¡È.Íxã>†×l,áÁîÉ‹&O´j#c«)iÛ~{§ß½BDĬ}3~™8ºH“}hÚ²/çS1c×”_&µê¢ƒc"3÷OZ>ïg*"¤ï¿dêD»!6(:üÁîq+¾]ÂDäœÁ‚³ ~™2ÉnŠ ½·þÍuó—#A"Áùùývý~Ò-ªž—ýàÔ–‡_%ˆfíúä©sWsÃt ¸ôC¯;v•3-D¼¿wöíkgs²³+å‚´ 9Yf¢gL]ÿ¨®¿è$GΕ¼ü?et ÆÇ/4Î;$Î;,†§_ÈÊŸ°*Þ!q>‘Uõ X²o^ȼ¹î~ªË”>ÈÝ3çæí+™)·˜jÙ¨ÖÍ“d¬Tœ•+'Uq;ûÙ‰ïÅôÿæ+!ÊØi╱‡¢­¢UÏ9'à(4k|šõ®Óºûþ ‹ƒ{nnÿTpàt¨<¡ÕÙ-GƒûÖ:³ùßß´®r¨Ù¡×ÚÑ]Žë•\G{jë²ÀÖóÛõ­‡Iíº¯ù¨×É“Ýë'‘“ÛÖ†tø¡mÚÔºóê±ýÏœí\'ÑM³ûEìë;Z×ö£ j7I<{ëŠ5ÉG ›!®ÏÜääp@zcË÷†C=d\ßÖC5ÛæÞ+¢ÃK+Þ;½{7q÷·×}©ÕKƒ.}3øv!*殽²µåë[Œ=ÄuN¥ ¢Ñ¸¨Gån~†:´rΉ6Ø;(4çô6HªU˜¥D6«çÔ+t¡^~9çvB|sŽ׸¶s»h ÷ôò;°;É—½Cª÷Oò#Zxx—fÁ@)KÙw\ï«q%0xµâ¶däÍlˆä2'QP8 jLzK™ªæˆòîySƒ:ïyuDÉFùþ¾mßOÊ)Òz¸k¨©± 8™`îî™ãCŸý2T å‚õÚÎoÆݹ—çîe(¸ŸØú½A > j­{†…§4XüÒàf¬_ÁÚíÙ+sWuj®cœÒÂ2 ¦SÕ«;o«ãP¥›ÇŒnš}nwªCWá#kˆ}:ÐG9¸m¿_«qm»·âiÛ'oþõõªu7ùl;Øaj›NÀÝMã¶-_{—Î’žÉ½|Jœ5hˆÑkÒ²sÁ¿à³C[.·›u,ÚäÔ‹&Œ¿Ü¤}íῘßišÙldÏ.m6à’rf~pÛá(JÛ=#WiÒ®K  µd™!ÔTì%vË]NšJÅ’m`CqÅOb+JERW’K¶ uʼnŜ†Àó/_—|ÝÍǾݺjI^¾Ù½jæÏ¿íç%ee[Œ&(Q(×F{˜²ï§Ó„Ãc–õÛ½qrƒ8”³Ž-9Ö" î^!{×{)BÿA]ª§Î(žÅˆpq㔞ÜöxæãS—ÏÍó.çØÍ>¹4¥(¬[ãÚ $xjÉØ4sH¿Y¿4@sO,5pÎÔÎTÖVíÇXÏêô_F2Y¨I>yº¨q¢(83WN|3ÜëâUuªtó¸:tµF,©Ué›ÌyÛ÷µÄ–W`³É¢)„­ÖB…ûø·½TÔk^Í&kÝÂ9Ùg-¢^ÅÁ¸F,ãO%z"pf—¯®Ú o6,Êd¿Öý>m£"Û8 Åár:·ž;$%+O‚ª?7Ú_ TñHH¼¶ú][ÍoL:Ì?ù]jj¦.Ö$Ø?®Ú­Õ£ìI_µ˜{ô›´¹o;!¾Q±wÖ|T¿ÆL½„Ù‡æ=È.0…8ÀRä`μ٭ãÄ-¨™7`ÃÖA'ÊŠBÊÄÔqÔ‰"(E6 ¡ÍÞ»qÚÛ+7ÀcÕ^QÑ:8¾”;Û7¯<ÖæãéXF›†`Öý³·ü^\¦Q@v€®úÛþË­e[‚–]^ûM`¯­^:gÉ­ôÔ3§C^[¬Q@÷ºQUjšOüœŸÄ6ÀØŸ¨fÆÈøº·~ÏÞ’0çäªsußšÂSΪƒP¥›ÇÒ­­‡—H˜ ŒÊ76L>ºówChu£QÏ,ÅÎHûõµ“ŽíÙc M4õ¬(½xÕX•²Ö?³1Š¢VÉÈân îÀµ`P2¸W>5 ÆŸþŽ d_ݾcìo[=U¯^ÿ‰¶Ÿ?YôJ½›É½Ê3Qá‘é‚8o8p¢ýçI?ihp3zÆwŽ Î €¤É‹öü4åÇ—ÜŒ^‰]#üýrE©.¶}ßà Ñ'¿5æÚ‘L”1Géàåvª Ö U®ÿ´|Ö/õÞ\– ¶Âë«Þ¼ôÛ±(Ù.ü,´ïÒÈp- H¢[f‘Eîo*öàh$7ƒµŒ¯G¹üõÅܤ~¹e(§[cîÏ,.^Wp˜³lå¿þd”||›–‡f®3ËÃu×Ö¥Š!‚|òÕ‰”J7!íħϥI\¿ñ½fGz\=òû¦ê¯l©“äÃ8X¯¬]öÕLbMÝ{t÷öÚö&Å{2–óK—}ÿ-pbð%óócÜ–bsxyëò%ÈSd@W5¤Jœö"³`ðD;p˜6ñ‰µÎœ_Á;Ô%î‰Íßú­•ÀòΩ ^Õ=“Z¾³¬Àì¶í“6½â½ê´~oE[×vó–ñkݼb8 {7 •0æTEbš(“ÞR`f¡>ÆK2  #%ßì ^þe³&¾u|•H&nq½ßÇÅmÀqtì¹;<üÈĵ‡8"ÚÒd»fñêO¶ò!”Ê P€œ+eœºÀ®nÞëßЈà¢#¢EÙÿÞÖäð’ÒJàò8 jðo¿mqÏÆ>?y%/èÜ^SÌ £òÕ!¨ÒÍc¦hªôÉ+®Üë¼ìi{©ìîã£(E̸¾Ã™©f·<`ÔÝ7ÂÓ¹=ýún‚ÎÁ˜ºï‚Ü;‘QŽˆ©×6¹Ä„ œ’ÿzF,kâºvÙ´q¥£àZÂÛQIVéæ1'Æ ¸JKC˱¢˜wm×6)> ÷Òò›—¥,ãòaCx,ÁÜk{~ªøä^Xzû&PYɸrÌ­N#S½‰qëÚ­ýlv£Võéƒû¶d4þ ±BpïO¼Þºáç°šIEWWžI)êBËjb›\óð‚ž^Ö·¼Ýu…)¿_¾š0t(y7N®ªÃwLBþå•ã°Î˜ÚUî9ûòñ ¯jù#É»´|œX|R avnϸplËëšç† çÂòñÚF“£³ƒbjÚ¬sÕm_€AC$ïÜ’/LÉCà @ª ¯Weãºiã›ul‹æ+—¨ÞÿU:÷:1ùÓëkW«ƒrÎÕckƒR‰>Ð+8¦˜nÀ¬E4øxE("šµNÙúæ¥< ö”ÍsŠtn&§ÝÂ)f»¹Ð3 ®8˜«µyvë²×O‡L ò÷´¦ß»ðëfuÞé HŽ‹ ÞÌŽÖ¼EFÿÌG¼ªö”–½ç×µ]€¬@•nž0pÉ·nç!¯m[2uëﺨN“ŸUãÜÜþÇÑOÚÞeðËÛ~›”²MÝej‡÷âÏ|ÑïÄ¢±º*ÛªhL­Ç®?½èãƒ?­=›Ûj œƒ¾AO~Ú»`ÒîÙš€OOÞèI8·¡ ¹*Ô1ž8h¡oÔ—ÖvÎJõAµZŽÛìÍ8í=Wç>éÀoãdbŠl5£ÕS­˜#BÕþß<'X2VÝ£Ú|Þ¦]sfç˜ðüFŸq‡QDϘö_¶kÝ„Ù9"r™‡÷øþÏû—•™.´Å”]ÚpÊ)%uG¬5®tч\Që­uÕãåÒ«÷”Ä# 'íÜ‘ ¢1$ùÝZw`öÑr}€D"Å·Ûew|ttÉ(ÐEÔ{õXß'ƒÛÆ §VÎPëa(QqàA­F÷ ‰ÛµhÒÙ»Ö/©Ù˜mÉY—à;Âò®¼o@°T²…â •ñíQt®§‰ÞqÑ^öú͈ ¬X¡Fòû‡à ’×z4ßpŽÁ9Z€R "LæÑ)xRa;sio!à,Ò^¼¶â6râS\âORé”s@qíSr,ç@p*p ¬¸špåÛ¹«ö&8pVº¿ó@(9¤X TÒfÎ‹Û À$,ú¼ñ¬‘KW^ɨRÚE" àª]éÒ/>³®/S\UÏâá¬L­*g¡ô–ýOèòr³½w­×ËÈ]§uݬ„ƒ³°¯«ª7¢(•…ÇAœ  P‡š3õØá.¯õhÊDtRCñ?Kô18P¹’í®‘YFF³DÀ ˜Rþä\^Vˆ‹AY½’íœA™Œ$,½îÃÛC±²ýK.Qú–±4n3Vlså]D–mj™óW)©mU¾5Å=\é%œËܬRz¡’Ÿ¨\ºW¹Cœ·©r:™RñDƒJ*ýež{QR{X…J7*Àæáý»DýÕb’šÈ­B¥›6.öèuó¢ÿÅc¡x(c¹1‰{’lj«øçÑÓI)J X9/•©"¢ ¹¼Š\ìGÔèÊ®€,sDà€¢¦ØªU\e|A\Û©L)önr%mÉð¡v¡FܲRê4@pÔÌ•½^¦© GEå+Q ÀAqT~ï’ ¸š"~ôÍ©$ ‚b… œÛe+ü™•Q @¶—ÛYÀ:` Ðâº"N§²¨qy¬G±âíλ(ö¯sP”Êíœ +”`Pʸê]‡?S—(¸äò¯;›ÄÁU€ã¡íNo瀢‚l¤B˜«…¢Ë¡ÎPÙY¨Ï¹Ì‚’ƒl«¨&éd«êÿ{Ñó…p¤:øÃGW/ZŸž(¼Xš Nî_8ãÊéó 0Ý=ÇÖ¬À¼iþ ‘ŠÁ ÑoâöÔìþ=›Ë úöðꟳ eN1¨þ³Í s׉HàÖ¶éÇ6¯2Û)$¸Á³Í¼á¦Qm×6~ºgõ*¿§&wéщò -â³_/˜1Ç÷•m½š…ˈ„i»çX½°Ð¸&8¾ÛøFmë,ºxxñ§Žž ÞÕ«wS'93D‘§î›·û×ù$²WŸ·?|8 N$™«¶!ÝçtëÔJaNÍ,@I_Ù¯mº¬m1óD¼i«ûùE/ôËw„õ^¼Å—ÿA¿1ëÄâ=¿Ì.Ĥ¾Ó~Ð ®Þ6_]»É—÷îå §Õžiøì¡î•¼sk¦ŸÝ³ÃÁ‘˜bj÷W«Nöô®2c¢OºÏN¨–Š®®Þ»ø«¬B˜Mò¯W·Ïè¨h hKÙ¶oÑçwnÝGPL±më÷ý8*Ò‡sNDÌ9ýÛž…3ó•ª}gü¢*}±PÉ»tvó‚k‡wæÊÈZÿĨƽêu`8"ŠpfažCd×9;üôÅ„ƒ(æ®ú~ÄL߸ÿw?éÕhÆ¿Ý AËÉÏVÌ[Ö¹Ÿáöê’U;¤Ù[?™ÖyТ%Z„›+ÞÝóó‹þá¿ùHÜ’A Éý~úÉ])þb3pP`é‹w,ø6êåÕ=šD`ÑÕµ£n\žøÜö…G?صüDã1{¢t`¾°öý×I5žÜZ¶[vLì–© pó$ÒCÞSDd¹ûVþjòòt–‰Aûéé~ÙÓrÜ¡øMÁ…ßÖ|5Ü;rWÕ¶û³·Ó uüô“A„´m¶ýò¼gè˜ ˆpj^Ÿs·ÿ€¨­¶ ”˜>œ#Jzw"‰_lN$ƒ»‡ˆ77o¬ö|Gp®Õ!fžÞ%»‡ê-Füã~•àöÒÁ{÷gÇÖ·¥ Åë`(˜÷oœ:ÎÔåë—''£Ã²gbÏ‹fü`<ÜÙ2æÔÁm' òN\>÷ ý¬U¼ðÎÖ)Çön5áPT°ÖqgÕ²ñïïðlС•ÿµUž=‘ùÔôcA>˜µkôÊÙ¯¾ØeJ͆È7úO|…Pçw£xá_ÄŒCî×vžqÒß·–Û³dlÔ¸FvjýôiÁC–tiC)\[øòÞF‡Nø^o?»aÂR»©/Oè€ =XUƒ IDAT<£ï¾ŸÇ†Ž«‘ð»v§WK¶Ü±•7F±äñ ösëÇ0›’[Œ9bÙ§nûþ«_Ïešø–¤€ ™üÜ ¶ÔK×üëÆ9Sbøõ5ˉW¨H *ŔœS´—ƒ IWñÏY;¬0Uj3y{³&qeź‹Ù_?¹×뢃+6Õ²7RÈÍ|€¬(ê¼DêœS€1@E·2ÛOhÚ4‚Éœª4ï[£èÄï™ÕnðÆ—‰‘:&sfLlÒ#Özî ¸= ÝG=?˜©ŠÈçzù›çiÍQ5ü‹+u3Û¡õ;ÃZ¼Q%H#Û¹!¶w—1k£C5L¶é£ëõü@K¹bã úK’6ïîu@tè£zöüäW_]Y"#Bî¡Ï>•Cþ…´'Æ5Lȸ²Na9Ž @ÊɵÍž9 ê*éXȘX·ûÔuQ¡eSU¹åîßf/´ë’ÌmœqCÓþMm7/ç3Dëí];=:~æ'(pO[³žZ²™‹ 8„è.󵲃“1µC ŽmÁrçà~¯.ßx lÏæS«U—Ï,ÛÅ Èö\4pÙõt¨ââÁvaïú› †Mò×S ²û´î#?Óˆh½qªÈèW½Z˜lçŒB\›FŽ¬yvfKÏônܳm·vÜÆönmOKÍspD®@nS7ÄFxVøBØÒmû|ÈÝ2pû‘¹çù·ëñÉ·¡~ÅÎx& ê>î»ÒbŽb̽f«ðóö œ=ÌåÂóWoù&µQùåIµnDõÀèö7‹*T5âIÏÿX£zx`··¸Ž¬² .¸E´xuS\tŽÂ<ŠÌ`tã¬0ƒéý%{NÖ{œèÝ‚bõ`”»7ÙAqp  SÓI`²–ƒ¶N_OÊ@Ð µfÝ<’âYs¨Ž¼š´@(╘áXxañÁƯv¼{~”ëÕ”ósr2Â:7ËK9‘—›/üâªKÈ|™É Œ µR&ëÜ}9p.kª<ÝSÊ9/ï^`s.QØ¿ì:]ÍûG]N·Ö 10‚ýäµs¦f}BwlrÚ€·×ŒTÀÊ­1QÖyÊž£{¾ÎxÀʱ¨6¾gûê@eÝKäEV+ºûDÎ4ùÇ+'¶ÙíOG÷˜ëŒýD¶Ü\)"^à…6+qò§Œ¢»OtjÊï”·R¬ùh ¶gß.È-ô>^Á!„qh»uªPëâ«Ë¸r°ÈâÐxFDGÚ h=?#ÇìïãÍ8äߺKŒ^& ‘"Ûµ{¥•ÁbhIÏ“»QDæÀ¨^ùÙì¡Ï“mæ<Æ€Ù²ïd¤G4ÿHG8t“”KÞÕã|Ê„eRÙÔüm͆Q· ^ ×#ÈÙ»r‹4©îuðü=•bžHº¡²®áØ= +ùx#‡J‹E–D—3èöÔêÏÄ€~¡á€`ÏΗ̧¿½ÉU–WÔ·µ*ÌßÄ]±pÀ×Voß[ÔôÎèÀrÏÍÛùëÚ¢›ãa]ú´prær"V˜E BÚþy_Õ}·¯î–:¤ó;ypxÜÅ!a†ô‹ç÷Ö½¦L1”oê¥5cd·qÕýº¢•˜{Ì»ùGáOT1P ®úÓÑ»~ÛVcT7P sÓ´F;‰º AÑqên¨´ÿ¸òð­• ADdæÛ[7ž¨Úr††}ýC´v I¸Œ(B~úUàÁ”GWÇBÞŽá—Òú|PŸ!øknî9Ȫµä "¼¬Î ŒƒbaòÍÑËÏÙ9p"†uêõÁ(–œBûgô/Ò†ú˜ î߸éž4¼óËÏŸÖ]^9³aÖ37ktr‡»·N^ªóÚ2½H€•v,—sv®ÛVoŒž¸B7+gç f?jˆJ^µÚÝÂã‹ÕÞõR]á݈%ö,mÐx8³þxXŸzD‚´us¼:Ïñ€ßU~yr}7ˆäãáç„eïŸ9(¥°q·ÑÃDÎPî\§ ­×Þ?Ð])|pqáKÛfLê?sºžçœXxú‡õó¬Òç˸Hæ\!â jV»kxÁ­}—O¬>—Ø´A­0ÊáºF8ýÍ0s5Cõeã9s€@¸Ððùý€’snŸ¡§whÚª.à±ùê¹K)qÝÆÒ°?&’?]Š•Új¾„[§¦eu 6å=r#ªãή–žæß_:qšorÚî­óÆënòLcÎ880¶Ç;§f~´eÁÅ°P¯Œ3«rò|Êšd‚o­~ûÚ›­?\è…œ;°jç×ÎÍ{›î¹@SúéUùž\DàXw®fxTƒ–n&bN=±cÎ+[¾«Úé¥nT¡ÌAûÏi”Ë)˜/|÷ÛìŸR{÷Šöå÷/ÜÔ†4 ¯–$ÑЂôü‚{¡F.%–srÛ—#Yôíú?õÇ™èezƒ:•ê]~š¾êvv€hôÚ˜N_5&¹ä%K¨Ùtý®ï=êlgŸãM»ÅÑë;T~yré†Y³îÊiök=‚´ZéÆ+¼¸cr¿ÿ»©£œãúª=jWÆ8“uÕú>ûî7LOôåDÀŒCŸo\²©úÀùV•©ËþZïêQ>5HÓN±UÆ-ûòíÈï–û`å®k{êŠÓ'ió‰OfÝ#ZÉN‰b~PkÒJ&Âí¾IOqPâQ%ÒÓt'ý !uÜrs×Ôž÷Œ½zLýÈÄá?·‚Ê ¡µüôòóçüªdç{Õi…ÅtÃesVãåáQ2ù øH²A‚–ÛëÖÏšäÕlBû>O;µ/€s·øýG{\»æV–&²ý·Qw>?xE8rËÙyϹjìðÙ†p¤s¯º¯ôÏÿІ·2 1 =3þÌ Â!¤ñ ¡Œq*s]@ݪ՛½¾A¡Ý4Z-ˆúÈèÅÁ­FÏ`á«kw‹|¯-/†D1¼çœ^Â#IÜzsíšÙ¯¨U3 Š³[9á`ŒíØzDGg?ÛuPŒž®!@Ðqff·EûMo€2gˆ ·jÝÛÄvw®[ìßpJõ…€€\Q¸XÊwœ!Š` ã²Ãá°Š\V(1JBvJ¦Vï¡!À€sOð‘òï¦[t¶ûÖN{;´ï¯ÉýiG z_÷€;gWáS‰NÙyÙ À923(\‰êj×o"Ûy½JÞïV?ëÔøÙ'šn›¡åWZ?z8ùvâíŽûz5õ¶Ñ„˜¨ƒ‡¾+j?ËSÖ”C)yyqµ³Ÿøòù܈†w¹´©Î¼jIÈ$’¤CDPlœÍ¿{½ªº›\‘ˆ:J|Çœ–º'8–ºmzûà}[ý5˺-8‰é3ÿìÃCP¶q®X5A‰¨‰u :.þ>wZÌK›5 Pd@@@ 6`ÞÙ<âЩÈî4sbÞÅ ú3‡ôŸžH‹î9m¼‡«jrŠ×W¾zêFR÷Q¯ëDÈ:8ëÚ ¯¶Ãê BÞÆaulõ¾ì6¸£†€œyþêùCnñS$„6‰>mÚÐã•~@æ®Ò¥àaF½9ÐVp"#Ǧ¥,—6?`¾ÍCŒ¨ÜÞ9óÝ ¾+[wˆUÅÔ”Cé­ éœ·”— rÓÓLUµ}ãÁCÒ>ùxýAM{¾èï'pŽÜôk»ægfçúzû•#aš¿é˜ûéeêÛvp(0•[ždºAjƒJ%œæý>áåfP Ó™w~ØE$üô„†‘Ù×ÓìBîüEoÎ/Ù7¼ÛÔÆõãG¬¸;é¹Õo54ú‡Û²Rˆ)¤ýˆwtœ]ün¬Œg¿îv¦xAÊÞ­?ù9zèÒS¬·‘Þ'Ø‘—ZÿÆ#Ç»#Øîü´â«e\@«E†“íŸEï6~ö•(Œ3‡Åaóæ(T}y^ú„®+Þhìè“—žmH^«q¬#ûôµëYŠfÕâ·V•ÜW`ë÷[¶iÆó6.{ÿKE#Ù‹ò8¤.youè“Ç.‹öÈÞ;¹#ö9Ô¹MpÎî­{÷‡MRIÍ©æÇ^Nâœ9e˜P54NºvÏ'ÔÇÝ¥¥Å™“Ø”ÊP°^ùþ8»F+Ûò©LW¼ß™S©æ;Ë=÷ÌÉph¬+^^¸¢x¶&ëêŽ^^Å‚ê>»>XòÖv#ØbûM‹6h¬×üJ”ˆ-c»ÛLòjØqäØð}˜¸øíÍnZ¹°HI|ñó=§Ô³ñà±›}öó_¸»‹ùÙùºˆÞ=_j §ÔPïÝéS†/zýww–Ÿkh?Í×( Éo4>¾}Ï„æ§b0ëAÊ€&¯FyiïïXp¯HcÚ8rá¦â¦R©æÈßjxœ[9êC»¤UlùTVV¾ß…S!iä²Ä@É|oï†é6}¬j¸†wíò´þ›Ï×ú†‰î:¨Fë˜ôÚ溵ƒÅÙ‹®Å-C`™)W}Ö_t p®ÖP¯ðJý ôn€+é) ãÎÁã¼É=ȨeùY ¼á«ñ 6 ”"sv†¬(H´z¯`NàÖ7¬,º…ÄH¸b1ç¡•jÿ ½›¿ݨP¡âI ¢v« *þ Ò *TºQ¡B…J7*T¨Pñ¿Àß#‰s‚sOüvé|vµ^oxVfÌD‰¥Y?冬pAïëß*".œý¹’lN(i«Á䯬ûVö©Q»I ZRÁz{õ™ýwªõá©I²å?¬GÍgOmÚbŠëQ­vl‰Ž“#õÀ©ãçkv|E'·]:¹n%è\dô^¾ÕÚE'„R;G³N|s#»qÃI@ÿ3ý ŽŒã›~ã> ¶JfÊCÒTÖ;ϺÓé=Ï9üó•»9eRP¨ÕõM¿‚-öå6ìõ¬¤®«ÖÍ“Å|eñk«~\py÷Zs¥#ŠÚïly»öïK¿¿Ÿ–¥Xóœ_¿wVÏ­›“?_æeí;¿ï—¤˜Ð¼c?O»™KIIÁåæ®Ï&¤›ù€9,ü¬Yó ¦Ö[Wö®>²rŠ…r,^.W2/\>°ÞáÌuܹ²siZÚ}sVš9ëvÚ‰u{guÚôÛvDkú±Ô›þ/OÛµ€É¹3%´àæöKû6^X:+]®À5œs òõ]ŸŽ¾´{i¾€Ùó 3ÒÌYiæ¬ûæ´£vm¶ràyGÏïÝIÕQ¨Z7Og¦/yö¬µg¯w;­7«ìt ppØ9 ¦üù¾Ûñ“¾&t9g殚õÚÍúÇ¢¼ÿÈp*«†é(&/]½&÷<ðÙ»ŸÌÖ!Gċ˦å¸%u¦6å (×djô P—äeýJ(¯" ÎPWZ®ÁÎ(I笔©˜áyqÃÏ»ûmÅ”J¤.©ƒ$¼ðYUgv°Ôßžßthµ½g;­Â#º.ˆ!`·ºBZJD<©ìR¨ îIe Ô%š*é€:€HÀeP("jàîöyº¦óo¼vtÝÅNÝJâ…œqE']ÜSL[œ£o‹Z36qŸÞÝÑúõ(cqM„2b£\ÕÚTéæ10`PÉ<·Û,W|½¢’=<õî-fu‹«BÓ¶”c!A95ºÑ!©çãFS ²ÝŒ¨ÕéxÀ9÷J6ä×aà*秞?F+¤)°šõ$ S6ß·z ¸‡|«Õkä@ÔW z·/yýÄ‘‹-š&(6œÚ}&~äïF Ú.¬ZóÃøê7:E ^Ú¤ª±èææ} g?ÈçµêÂZ4ða°¿,¼´|Ï¢/³ 9WXXÓ7š<×?}nÓ­÷z¾2u$Ø9dW¿Ö)vðþ:À¬ŽÄg'Ü™òáµ›c#<8ÇJ8ζñðuw† ¢„Wl¾óÆ°¡“ú€ÕveôS»¶r­§l¶ø7|¡EÿõÈ‘;®mœqjç*f%¼í°=º!E°\™ÿZÏjO½s{Ç<[ÜØ—ÞíL@²¶ž^‘”pŽo[¦®™òV“gß $¢DÙ0ÇÝãK&ÛÊ÷†ŒUzÔ©'ÞúzûÒ]&ŸH há­?/JÉÎo2z×}æ¥6¿Íû8®öÂóŸ}ªo5ªa¢IV¸.¡G×R~™~¾×· ŒvÀ¢ë'}ìýÜâÛUc œ›×oÇ‚ñ>üLS¸gýô™1#×w¯ë'¥­ÛëÀªð–ý¦»¿óæÅ»#üÌ)ëd¡UbÞȺ˜ÖMj¸ïýí§˜Þ‡•h¨Ì‡¨åöÎß/EÖ¡u ÆhLäžžzxó¡V“Eú‚€6l»–Æ?ûr£œ#ŸÚ´«å„½‘þHä«kßê±Ñ­N×vá\ÐèLÞWOÞèõÍ1#ÅÎáÆú•]#Ä$HÍÛÑÍÓîçDù»»"{ÍWÖÍ]\çõåìþÃ_ A²Y0-ìù-&—bŽPtbÿ±Æ}?Û!!??»ÃÎù_G~6Ap¨S¥›ÿ*»¡ñÔMþœS`ørF¼kuòç|4‘{½°õ»=Ó:(?7¿0ÏàÚ ^xßKÃÑP½ç¬]Ÿ)ìöïĸäÄ ÊŒQÍø¯>^šFn¬5¾JL·ž“ ;uéą́Œ1Î(p€û»VX{¶®D‚z¯¾}úÅ÷ïqÃÎuŽ°ÄÚ ¾²ƒÔnøÉ[0yDyÝÚ´6þù®‚îlXæÓí'O‹óŠ Ä ùéâèŽ;Ö·k÷tÅ°NAÏ©8§»>¼u½¶O;kúºvùµkõm¾öÙÁ HìÒcûò/̃][½ØÔiUÕ”R•º=»o[7ËÒös=lú”Qæ”rf¹|ù´ýï Aðo_?nìÁ'b†¶RH$¸²ü]^o\BB òàþä`ïÌ«¬æ³I´¸ 1¥¾M^}^P€&<ÿæñáSndM¨â®L•nþëxdqŽGÍ¿ X\ÉeÐëjÖüU£!sãäÝÓÛoÚ¹ü­¦- zäûÍrrz7oçY€ƒGl?ÊKÏšæÏ?÷ÃØÙ‘ol 0e•ð^N–-w×MèW¬Ò/;HÞÝt»_v¡VïI9˜‚«:o²fÚk÷¯—Y!{ï™;^í^VÊ&p A:öÜ°ö£Ü–+uÙ‚-¾=ï €à(È¿±é“-c»¶¼!Â×%$AX΃ Á;*¨Ë5¤óˆDÜm+ÊÌÈ-û?øõ¸ó}@Ù’EmPd=p¦w `Î^DpÜý-#]¨£Í¸qP2ÔníX2ýÞ³­u¼èäç‡/D<;»­À€‹"W4§”# ~êÀ^¿ÄQš2¾y®öÕSZ ±zmnN€J7*Ýüw!Hö³ß O-ª°ŒÄã:‹Žü—DŹK³Ž:8Ct ­“Z§Z«¾«&<{ãðɀ枻çj§åVn¨Õú÷]5´¹k¶â('ëK¼ÃµTôñ×=*ùL@ôªǫ̈¹’P– É•ý„+A”8H9`@û=V¼t-Ãp~ ¨é妯0c h÷A­ƒ 6-ÚÞ£‰Xa6¥XÁ®Î˜3²ÏÕ>°ìHäðÆ¥î,¡$ÙiRDBä=æ´¯¨°ò|mwµ¶øxzuá÷LOÎ};ø\ÉIõÊõýg[Æì^µFïV}ÿW£€Ùó(jÎýôNz­š‡s Üȸ‘Uõ…Ö§¼e,UÎË&è¨Péæ¿eÙ0Á¯V'­Ð`îéi|4Ç( ãøÌ>áã:ö®M®Á-HZDBÑ3²~'¥üB1ÀÏW{úv'€”£€iÇRˆPãO4—:ÅU Ô×zê"E¢Eà€‚ä(H7›|½B<-R‘s ºyÎ]!¦q»ÎŠ”P»ÿ¡u¢mû}[-Ñ<4ü¨CH<çüÄwÏ{u‡ÊÊÒ9K¿‰³šeîWº%^axòä5hÁmE,Ê8Á0Ñ`ò ‹Ä3§¯“ä´9µÙs˜Æ[Cx…{¢÷œº/5±²V¢sågÃåÏ»8µ©Y»÷’º~hwP§ü3-LI¿vÚ/±M`É©Kè¸ñKŽ —š©Äz÷bô!÷¸Ù䧎J•nþût#ÔëPùo´(ëžÂˆœ›„e¤çkí¢ÉßdÒ¦mýê©Ñ¨mK®h‚jÖ¹¸lÈÝä굫 ˆÔžyyåG›\ˆlØ©Òé[ØS„g8p®vU?ëýC§2eÿuåIÔx9-ãNwóðj>0dmÿ-KW¶}¦9aöôm£?n4ã;¿ÖϬ´eù†ÖmëÒüKû·. ïò-Î lôŸ=æ2‹ë>2èa¡&® lÒ´^ä%ƒoY–±d¦åÛdàÔ’ºuü•¼Ðæ=“±8²…9 ª×ð“Ó?÷ÍwbÍç"LÀäsÚ¬B¥›ÿ7 ËÛ9½f‘ €©0¤Ç¬ŽO7Î:²ô¼dOnß’Ë<¸ùÇ=¢›Y6oݺ ˆ Žl>¤ç+]Œú?²QÀ¿oב|û‚ÁK-¢ÃÁ6ûafj¹b!œ*vKÙ-œƒ&¸wdô¯;Çu ë¿üé6Ñí'®8µäã5c¦3}j<Ûgâëzä Æ?ýɯ‡ø`ÕÇã@RkÐO5kWuúuáõ}E­AgêœÆqE¶ÛŠ/‚œAôKß^¿Ú<Õb-v\+ ,'gv9åÚEòNìÒeâðodL±* уº¿ã±gÑS¹Ñ=ºÖ«Ë’‚™ÂÝbvÏc÷ÏÃÎäXPëßen«fM€r.Û-Œ2$bѵÍK¤:+=õÀ(”ˆàð€þqÑSý¸6úí®ÈJ¿²ÝR2SB„ÂÔû‚I‡¬”I˜¥Ð¦IêÿBýÝsú=Ȳ¸WíÖyÈ&sÎQ] ÿ[âï wË+^—Û(ƒ,—‹šs z»ê|cI ðå€æŠZ@®€BA£Gqv‚S.K£jƒÒlgüž)- ^æç,k],ê„‚ˆÀa~Îbá–+Ë?XãõÍñU¼Kbð$]Ù¬Î9Š: ²Í%l,éËuŠ³ä¶+ÃCƒ‡­L˜gQ”Ša~¤8ÌOáÎÚ&0ÙU"JÒRp8ÊòçD²½$FÏ¥yJ­œ«¹‚ËD0ºŠÿj4à°¨$À©æ÷á¯Ð»ù[X7¿DfV²2…èÕþ‡gGàåÎï°–qþW¶–þÿ’SR»ëBÎíL&W¸f±nné¥S»Bí—~}×á5 6Á‡+€àZE’­e¯ˆ%—pmu6£’@`r™~à Ø+v€óe·;wFÙVúOÅVáNË·¤l8\Ü»ˆXîY¸š”½®Ê5g¨ÎµŸ’ IDATËqÊ·?ÿåµFWÌM»}0\RT† Õw£â/š2®‰õʯ£¸²T© •nTüeÆs~aùs³<*ÔÉ” *T¨t£B… •nT¨P¡Ò *T¨t£B… •nT¨P¡B¥*TüñŸ‰»¡Š¬ÈöòÛÔ¨*ž` ÑpÆ;ºЯ×w?ÌIJ§ÂŒ²¬>³¿¡=,F™ÚºAÔŠHÐç?yÎÿcFø£xX°àþý4õ™©Pñä‚qN)+›‘û_ÎT¯¬(Šú T¡âÉ·qþ“¦±Ú¡*T¨øš‰«] B… •nT¨Pñ·Â_%@Á9gLõݨP¡â¯§ƒÁòBVñdÉ„¨_—l6›(þ/yÿ FàœË²,«q7ÿ ¢úiù‡€sn2™þwå2Ô·D… ÿ_V°Ú*T¨PéF… *ݨP¡B…J7*T¨PéF… *ݨP¡B…J7*T¨PéF… *TºQ¡B…J7*T¨PéF… *TºQ¡B…J7*T¨P¡Ò *TºQ¡B…J7*T¨P¡Ò *TºQ¡B… •nT¨P¡Ò *TºQ¡B… •nT¨PQ)80Î9pà8gÀpà@ßÚ**ݨPñd‚@+.ƒ2‘b&¥ä1fµÎ” O&(0A!LpÔ)Üq*goŠõò¸¸ouÄ ð1m³¨>6*ž°iç€@˜ gÒûKS¿ËV®+ÚÂ"7"´èÀë±m¹J7*T<‘ŒC®}ðÓ Ë>…;ìZ¢å>E¹¤ÇÖ´QéF…ŠÇ•P8c@9¸ªqsàÈ0ÐB¬«ïÌ»¨œ$h—5Üh!nUëz¼ê þœª“)*Tüy 0äÄÆ@ 9£E™I¶™_+2ÚµHl: .ôïûF ©A8>Î S*ݨPñ˜Z7¨ œ¢œ­*ÕäÀÎìë·×ǘ= …ˆJý°¤ –:&rÎ8 >Γ©ÇyeÊÉÕNÏþ›öaé1ålKÎS.Íb†Ú1†£ÇïÅ&7ðKn…íû ,Â:ƒƒÛÀ³>$úÀ­sp)µÜCåš´ʹûÞµó÷-BªžG݉nÔÐ_zD“Í7÷/jШ†öú¡²›úOƒåß8pÙÚ¨Au ÕQÿßÄ%ËÅÅ)£†Åþ(ù€L©ˆðyê÷…K¢ÝÍHŒ}Ü_ò®)p™–<æLuÜ G¦ê4$ ñßZqù›öeÚÊËÖÌ:fÎ/4cëð—ß?m-Ã5ˆ°~<õ|µ©Ò1¯< sNì_¯¾¯ÿ Ÿ†ÛÖGµeë³FOûVÎÞ=bð»GÍnóå/¿5#¯²{1Ÿ\Ú®Çg6DD¼8£ûœ çÿÒÉ9½²ø…7?-T‡ûÈ•†k‡œQ`ó¯MÊà·´vM!¾þY¬wrDªŠ§[ÿLºáÿÓÞy‡WQ|ÿÿœÝ½5HBBè„$„’¡‡Št®H‘¢(X(Š" "Ò»Ò”Žô¦AÐ;!=¹ýîÎùýq“R¯‚’ßg^OîÖ);ï=çÌìL!Æ4¤ˆŠ0®ˆ¸Ÿ`szr…|ÇäüW˜ã `üù÷ ­³ö郄QŸô+a…²¯·‹®êéœ{<‚åwè7*æI{ÞKçmß}?…{·ávο!¡P1j;’"8®o «Š|{öêPÓÛùÉe æ‹(‡{wî*$h`çádµNEdže¬RÞ¢Ë{`¾ST &Þ<±ªD×ÎúOŒ{ÉE”E»`d@ìOãÑënW  Ó œín@‚H‚"É Ê„ø¿(7“?áüž7»4kР^T›¾›OÝ'DTŒ}<8"´AÃаNƒ?>}߀ˆøøx`PGONÑ«It£ðèØ•GîbúÉaQoÚu7cBÃÆOG´ý¶ñ«öM#BCC›wzãàÅGˆ„xei…àÖ×.ÿòþ€NEE¶î»çB ±¬7Z5>§†Ñ-"º~¾‘mS³ãXB¼ºû°_óž"$¥»‡aNk#4ﱟC…œA™`Ž‡.€Nå`͙‹*3>Üë6ƒ€€â &zN,ný|ܳE-&'°ÊõUhSϧÕWW ±ÙÑpïĈ®-ꆄ4î4ìd¼/MïÞ{ú6{Ò–ˆˆÈèF[Óií¤¾-º½iBœ>0¸ù{G×ÍÝ2:²aƒÈIß–±ÈP!ÚÏ-©X»é•d+" ¢õØdßàni áå%ê´¹ôëw1 južqU95Ñ'¨G !¢mr„_Ô'§¹[õïÇ9@Íô ˜,¨ ;þ w»t¿ë¥Ì“LaŒ1FJ±ËÓKq¦OÿÆÐhàÈÈ2n®®•¢û|1¼¯VN˲ ÜÇÍÉÙÙÅ¥Õþn©ö\y`·!ÝË:kµZ]HtÕ`L̲ N:€ ×ˆZ1c×®}õF¬ð+éììT!´_t@©ŸVotŒ®dL;zòëžzNçÜ¢spz|B2CÔk‘P«wÒhTDX£MŸ=["‘¨R‰€¢J²ý—¤ß ñl8´òéL¤ÁšKðùvð+®%`æ~ÐpM.®‡}V× ˆæ Î`îëàê^~ðó8½RØ“;J"©b†¼Ó;´TAÅfÓ^ôaù’..n>C†&_¾iT’V%¢ rÒi5z½ Òè´z2'×:ÑA~Z­ÆÕ³VdÝZ7~ú^fçMÊd¡×§o•wwqÕ‰yÜI±ñ€±ý£Êpgê¿]‚¤hÑ¢¤JÙðPI²Úå0¡eM—ú€ ¿_FG¸éÈE{¥–^Ù[дè;.|ääí¥!G]S6ÈÙvæ~& ø¸ºe÷º¨$$RØÓÏ·íöÃt­°kÊ;G²ë"þ¡Å¢½F@@*}y½àÔª‘ÉùšÜW ¿W€€#zC»o!¬ôÓ¹¸6€h¿ì˜ ¹CÙEßÎò#¡†KöÆ‹‰`{ -c@ Ñ`†Ë&ˆrÉ›”"ÓÀœ|k9gk ÊY̪üE’,ù5Ô:.ETÎÝ=#!A!Pý‡[åìï&åa‘Iåü ‚ã¬qEÕ]ӫ츊„ªºà¶žƒ² ‚D€\nÂœ$¢œ‡•ò…C™1x®B#Å¡]w,-;„AÒ¹â_©ÿŠŸ†Ã†dx÷*¼ÿˆ\"HÙ “³àý†O…¶¨`P7æþ÷<Õ{åV>žRÎÑ!ÔÒýÝXÚóåDŸ+vþ×ö J\R^±àJ­Qƒ&‰t¨·§›{ÖÆD€ Ö×Ë]xeqïÕG€D€w`wFå0ÿR>€†¤$;ê%@ûƒ8ƒºi7`i2PW(SÒ’jòò(éÐ/cF–ÆÍå™á±ÜÉ«xOþ̹ziˆm7.Œ + ®Ý±;Àéd*€Éÿôåo/«ĸ=SÕ,W n(èH1»”»?·« ±ð´<·2`®Ö(NY!FK„ˆwÓÒÜ45Å¢/) HD ‘#ÍI·SPž%oT°9ÿ^Ï”„¢@¤f’UQzÕåŒ%ˆrÆ…Çúxî67Pý˲Y¿¤bÖåC&ÎHÌ´yÔ«,ˆË×ïDD<¶zmª»{û€²Pt¬%hMMRÀ#ªQøé¥cšD” ·wk6aù¢g´-µÈ¬ FéÖ/;Öî:ž¿ÑAÓaÛfغ¶n…Í[ @€VCaÝBP—…ŽÞðÎk`@€q-Àôôõ7í—À'~  {²îÁç{€`V'(¶§M^DDùØÆ•;ϧ=D53'Z@D€Tƒ1÷maH:zôZ"2Ã¥ã§/”‹è®*ºJ¿Š%Íi¿>Ì@’³¾ü1Nÿì‘|ÈNmýnÛéÇ\kþÊ‚BLÒ‹B€ž÷USLëã¥t„ e{-øzäÉOÚ„……6º¤÷;Ó;ù€TfÙÆyÕï}Ù(:*bæQÛÔy««–€äŒŒL[n¸…Ù323.“®blXÕ¤Áõ®¼ÖwÒŒaÍ|{6hÔ8ªq›aA½¿ødP"³¥gd)¹šÅ,éNaƒÚzOnߨõè%pfÕ7“n,h'äß’ÉÀhÉ–o¶A•+ CДý¨–ùäÈß/ƒ&OÕ#€6.l‡]ýP€¥&8´Ô-0ë¦-;’”ÿÖrNʳšÒ3ŽSõ‘R÷5[vÎ}d÷ ÍŸn;$M`V— aW¿}?¦yãá}¼ÚOú|põgY|®Q_ÜnÕ1í; x{j¿aM“&[ò•!Éæô È;g~´àÀ}Þðÿ _ °ˆ š «“×hAXñ×ü—ôåÓ_"B„ü&¹c[ÎÐkÇÈÞÜ3óðíyÇ–<Ç@^Oå‰ÓñdÈÿ³½‚Üãò%¥à1yïšç‰'ÐÓ¢FD€­š”³¬£ô±e”'EFjç½Ûd/}¼sVÓB®SÄ› ÐùÊ0¯ç™yãÀè“•Vö®Ì›ÿ¿îK’òÍõ­8Üïs@† @1Wœ—ô‰&nÈÿ¨?ýìçóHóÇX°ˆk>uzág?«7¨PcçÎqT>#×Pð+DؼnÇðY¯ž»|Žùs¸1O‰Üßr{žQ†û–.ðî÷¼ñÿ7‚Câ€*ãD…@ (îjÿÿ·!"€·n|!áW«É`ù)á0Þ{}И,kx“Uõ'nø¨þÿ5©Ýfl…—üE(§¿I („P< ÿGÎçßÐ-ÌëúÁ_Ëï`âp¹áp8ÿð…_8—‡Ãå†Ãáp¸Üp8.7‡Ë /‡Ãå†Ãáp¹áp8.7‡Ë ‡Ãy^Èñ_…nårÃápþ9H`T1…d9ç‹8°Êh!™ž5³—‡óüÖ ‚¨ (BÎú˜ H¤Lý¡cñ³o¸Üp8¯žuÀD2ED9×}B´Ê‚‚v‘A1´oøáΫ“D,ˆR¶1£,T‘,Åo²*nÝp8¯jÛ4$29H¢ìeEHVíF5#¹xÎ[Äå†Ãyõ D[|& ý¡äð®ˆ%sJr¯˜òH­¼gŠÃá¼µA0ï<è{ç²þ‡-JÂ=R¬Œ!{ ÖnÞtÿÓiv÷Lq8œ¥8„ BÌZö @v’““`ïµ ñÚe÷Lq8œhô ÀÊïeÔ¢õ‡oAÃ4vR— @‘Çu^Åž©Ü¼ÿÖOš}êd–´wëñ2MÛÓåCÉàÝ°¶€,qÇÞÌr¡UƒJfÏ3®˜OÄ¥?Lg Tn%C=<µy§·=º›pö¶9Ë *­K¥J¾e±°éÆ›2âÎ=ºò@aj×Zþ~µ}ž¬9eI»ì|fŠItöð q/¥&%íî̓W)wü(cÚúÑ+鬩÷‰ËJµ¨=}ý×ÖñÓ–Ãná­<“O]z(5kÑP]D)Ý:·ÿJfÕÖQ±ÈÎYÆêÙ+Týcnÿ¹÷’) m„—’çŒSF8=i·Èš‡TÍÃé\JÙe£ÂÜ®\§*åAT;½yûÒñî’~Ÿ'w[üAÛÿ{-¡éâÎæoŸ8øÓ§Nyw°;s>þ¤yÍÖlí‚“Þ¸amåÆç3nv˜S5¨$"‚ùê–СɊ«[Ízµåñ…;Öt¬¿e]ýzzb7g|¸oÉyµNR{¸³ôt»,«*EöØ>A'æ[ÎŽñþŒá;ß)ݲ™›ðÛ_8u×íËV3&njöF–èY)ºvÚñßNÚXQÞGc¹qøÈ„Í®þåEb@2óô ­XI§¤ßÛÐtD¦âìUË;íÂ5¡bdŸmã%!qᔩÕçG†Z5ç .¼y‘rsj÷œÅ×û·Šª((áãšÝ踲_h9ë V}?Þ·¡ÂKk6pzל £¹Ü<ðFQlN3fÊM"´¤ŽyÛ©]›’Å.¶Èh¥zA&€b¸ð½Hc,ÿ¢ =òÉ"Z>¨ý;ßrl(xDQ§;6Þúi~d«OólÈfÓÌ‘‰n¯ìùæB…‘íXXãï>?KDÄäÓý/k;ÅhÉ=ÜzfÔÐoª Ê4%Î}w®W§?Ü´çì6ݽ¼«UÛ¥Í&l”/-ìÎÑ…ÚŸÿ=ÉñÓ¸wáœj½“R¬DôxɈ9u¦™rŽ<7$vAçmD”¾úÜÀ™rÝžÐknØô,ÇãÝíA·­zHDç·O\—BÄ´þؘ÷ÖOŸþÃçmš Ø¿Ü#R&4n¸éb*]jÔ=¹ð².PˆEìbOWJþS˜Rp;#γ°Úe2˜“Jz2IJÓ«Rœ]M(¤iµ†ŸX™¬Ø•â˜)áÛ%ÖÇkg¼Ú nÝ=Fϼ‘.#ß·¢{LdDTTÈfãælN·"^_[¹Ûª?÷ÌíÕ©M“ðÐvƒ&ß5(ˆ¸kXÄ’+©'7LlÖ¢ãm fÜ>ñáÀ؈ˆˆˆ†‘C&.¹—¥8ÖæÝ:%2dØÁÝ˧¼Ö!&:¬~ï÷¥Þ\øV××€a_dhÄw÷ñ~—êžýÖ%Xî¥x´ö‚»¯4èÖ]Èï]°Œ ›¾¤—^“+Áª:³Œ¼¾ÌEuu÷W—*|òAÝæ•Äìáã¤-[£ùÌQʽÓ×~½ŸÏ‘S3ª„·³ãBú¥Áb³Ø°Üz$”¯¡ËöbÀ#Ø“Ý¿/(™‰Ì­”øô{Àtk÷Ÿ‘ÝœE"З«ýfH¼pá÷¤ÖÝ®Ÿ¸4p¨ þЊZþ‡nY±€mAÛ¹ø£–Ãêø˜øm&""NëzHç¼Õ©Y³¦M 29ÝïÔ¨ñ;?%à­MUÂìß<¼WÇV-šF´êµùD< åp#âñéÑcW#""âúñ¡¯ïAÄãsšûÞ±aZÿ:áM/¦ kLJ÷ÙŽˆ)wשYåû³f¾ÞÕ³Q°j˜Ø»¯M–5àäbÉR«˜Ý³„¾iS•,0±xŽÎ}¦ 1ùë][÷þ Ãd‘™mÓ„–uÛ|f$ʸ°0"0tõ¹L«ÍFÖ;cšÆL9FDñ;†6¨?qÍy›ÝNdü2¶vëÏÿ "fMٹ٘;d»lv±æœ¬ØmæôY}Z5ñ¥ã~{çv‰ˆŠZ÷k¼,ËLIÙ´æ€åw‰hÿÒ·¢Z~œÎHaD”µmù‚ýWMDLQÇÿŒ9^®y¬b©K>šS¾õú‘ߥ¦Øò¾€‘ñøŽE5Ú߈3P^;†1¢´5cÖÎü¥À»úÑÕZü8ÿÇŸŒ_ñ¶ÙˆÈ|iÛâ2±×îf¶Ã?úÇ5w‰èÑüs;ïJ>ºmÿЉû?\ù(ÁaϘ×m¼~ÅÜÄįþ|Qµ!i6Rd…1REaDDYñ–-ÿ6>#¿yôôØÈF-¼¢ØíÖôs=Ö¶ú>QÖ¹¶õ#Vÿ~‹)dº2?¤v÷Œd…ѽuë7lØw®Èn·[9.¸IÏ{Fû3l‘ß¿nÔk}îÏ-“›…=@DgÖôhÕzöæ³6«•ˆ6LiõÆn"2'ß^¹lÙÕ$;·_žÝ˜H¶Û‰±ôÄ ”¬*]*€¼ï'…˜ÌdfgÿãÖ *Ö„_Ï^lüæG®:€ªö,ûtx˜`÷Œ•BÛûº¨% ÔåG|Ü-õǯo ‚Þì][%}XëÊOŸSP”DDQÏ/]~·BèÜÞ¢ ©´nc2<ð‡Õ½g¤lÛÐODJÕ¨ëóèL@ A"rŽøV‹j:"Axz%ììNG!Ÿv;ÀéöþU•#Ôî±¥ÿÔËŽØÀ’‘ ÚRú§–Gpñ-K†éù.GàÝáÄLË‚÷ø¿¶"°Ý¾Í)ÍÖÌÑjˆ´5c[Ž¯ AôŠzÝút54}£Cïr`¾™¤ùòÈú^¡Aº´ÓëC:ÛŸ  ­Ü»Fò× ’€`½snÑa“lAAˆœýü ìççZð•Ç$—z½šUGQT»—zw™€$€(J(€$ "ˆ‚ciXé1]œ€DIدoâ·#F€ ØmÞ];I*uÞíÚ’úT­”Ä¿y¶ ƒ(€ dPª$YÑD5f-#dȈÏ.å*f–;)éºJUuŽæ§v.ÛºMY€´ßn@Í6eATpö ЊÛãÓ¡*ó¨V*§KjµÀl OAgoÔY C‡¾å8F@3ª’¹ËêU€xÖrÊ9]$d¶ü¶~!êù´ïÚ¶}WkÂþC—Öl¿ôõçÖœzýà8Q¥Å*©žnw²Ùˆ*W5)3>ƒPïã¥Rn­‡˜ÞUG™gÆ~´¿ÓÐ>Çç»èEãÉï÷~u²Áêïêµ(o¹þÛ®Î7ÍömL ßÄo‡LñÐ;#@ÿÎeʾµ÷ÍIµoÎ/óÆ'¾ûÇnn_²ºoæd¿vmaë9Q*$õ¹¨O?´ zÕÑåd_”TÈìQ‹‚ª²[Ž°¢oEs\‚üÝþÆãÀ¼ëzB‘}‹Ü™z†Ã¢`²ÞmÕ®Œ$ Ù­€äã%YÕv Ï^lÏ2FOwH O/§N@9EZ°£ÀÃ/€“oÍ>'å)^}©—QÖ˜ÓC¬ñiãÓ2Æòë†åý~xp#½bÅÒD”z+±\ù2Oz׉Àó‘P6Ä/ãЖÕ}—‘¶Õ/KœÚ• –í6¹«N×9ão–{ýäÉÔfÑ.Œ\QòýYõZ”mÕ†M ÜÐﳄ!ë}ÜJHÙw,ÕJ\¾8#ÜJyÅþ¸Ä”œ¥0Pyx'oùäÞ¾Êzõ¿Õ Œ±ÿcïxÞ:$>¬ëŸ<Ž–¥ßúܽ,«U²Í®B}ϬŠ¢A U ‘Tü$çE>‚¶¢§‡íÊÙ‡{b3į]±2^q¨†—þ¸H„YΘY•ŠÏ~híCª¸¦¤J•ñõõñññõõõõÒëÝÝÿ²½!æÄ¥žzcù"6'ðö‡ÓÑád€ÖË1FBå?vbæzäŒPÄk6Q[#¢²[Ó>#ùàÐÛ÷T¯ìl³ØˆrFÒ³Y€l50@17A(2 »¹tí¥óéˆH„`I¸ÁdO½XnÅÝ>ktòõvñóÖ9±»kºôêª)ð6|–`ÿ…À0˜ýZºÑ1—Xo_3êCütÏŠhªdkn*ßN{öûão&õfÉÊ=JDI°Ø­þuf³Ò-Û·¨TL$´K„Å°_ Ü¨ñª}dÅljY&Y±ìš1lΦ‡%Dhõþ›Âþi«ÎeZm6Åpyæ”+ x¯â3ÅB%Hé‰V‹µV¿×+>83zÅ)›b·[MÇæ nØ彌gZ⢤%Óƒ4³lSÑ°uÙ¼}WMÏ~G wÁd<5fô•?É«l¶Ú]ß=j™Þ§¬O%}ijÜX:úîådÙl±e¤\œ8f딟ËMœãWV“¯ùD€)ýÏ­çÉn—­Ö‹WP¶’|óFY&Ò´l­ $ða~‡„>Ìå9ÒÑ/çç3Æ•=éŸ.úôüC‹«–o×3Æ *VT1U2…Þ¤¨3 ÛÎ -L"¶ôµè‰¬¨Ä?o ßÛÖì×;†çIϨ:&ÓñÇšÞÍvÞá£ü /L¦(V™)Š)£v ñFõŠDde–´iÓm ˆ)-›‘M±òa~XÐgÁB{…0Ï‘Ž>›‡ÃyYJ”Hcañód¹Üp8œ »áp8\n8—‡óRqL#Ó÷DTèV.7矃6@“™lÏ{‰vB;šÉND|T1‡ÃyAÖÂHp´ODZ2É(T XüFtsë†Ãy­&2 ÈDОë8‰ 3dh—”â8¢›Ë ‡ó ê  Œ2 . €"d¯ €L#dSc1õI¸Üp8¯ 3E€¦?– 9ÂÃdWÉ¢VC‚ÿíÉC9Î 3n´Þ«ÛìñÀ¡(:>—² }‡PJ¢$‹ÅñëX.7Î+hÝ€eïa¿»W´ë6ȉñŒÙ!döKX·öÁgÓe±Xæ‹Ë ‡ó*¢Øì A0­X ÀÈFö´4i×vIÂÕ8É1:—‡ó)Ð5 ·hˆTßm² ZÁ²i è˜ÚF*Ÿš$²âØ3õ?1î† ™q7wÌBÞ)ìòÏ\—gK‘c ï®ÀÑTÔ¤¿ONµçỚΕS“|jwM"<õÕ°šur ©UµÎŠøÂçÖD²Ú#&zÀDÛy5|ê099"~1<´ùÐY=T²ß¼›œ½ì“ïܼgÿïjí¿O(Ø;õ©¬ ï7 ­>eÝ(•ˆ˜¹oPéúc¬ø×Å|ãNÀ”cþu¶œN|î‹8)”/ÿ¼2,0høª_r´” Vöˆ‰¬R?ªíŒuG, ÿ%†P‘m®óæ0µ)Cß´ÌþÊ+ÃL$B Șª8Ž*~5冎Ï=ý»c«šàÑéíýßZhηCªÕ³gS7­ØgPÇ*m΃†°pꕇ»³¦ˆYâ%­›«„ ›ùÛÑÃ9ùy^OU™:íüŠªt±Ç۽ʈ’èݪiÃjúgÎ@¯Õ¹8ëT3ruë7#>^/‚l¼3´ïÇÉÿ­%,éÜ\õù2ŒºÒ?l?<&¶Â ¸Jïæ¢û{•~c×¢·Æ¯•EWW•„Ï2Ù³>ÔcÌŸj¸¹èÔRŽüÁ½CŸ÷mì§ë:´{áÀŸ¦ºúæ¿dÝ €(©BCí®%%R©.ýiœ:݆hU«œ>ù@ŠcOø‹\‰ÁafÞ=³çð™tY]­Nd“JÙ©åñÁ}?ßNÌ”œJÖjXÎRã6o¼í?¤¹Óæ{’Íb…À†­ÃkÀ•­óVžÉ4ûYºìqç×û—TÓÅãûO]¾+ úZá­Âkx:ntíؚ߭ͺÔLÞºç¸QÑÖ oÑ( LÊo[lúIåå …÷ZÏ=ëÇå«Ôáý[×ô@`MÊ«\.Ý—*´€/¬³Ýó^íÍß±<¹P2÷oßqû±©t°vî¢ÃݵNîÚìÀž>òÓ‡­ôB‡éùR(xYïˆÞÁ¢³¯Í¥lm Xv»Ü^§olP!K  dÝ=³ã§?¬¨¯Ý¤}ƒ nö¯\t𒜞´dþ¢¨&‘‡w¯Îbië/ hóz+ÍÅ…»nìs|ëÖ«I25Ûµr*rsG •Ó‡öž¿ñ}¢Ûw¨àœ]Yé·Oï;z&Ý%ÊÕlÛ:RŸã@¤Þ<µÿ—³V(YÞ¿mL¸.ŸAhÛ½úûôÒA½šV=tpwÙÎá5ÝÐøàÂÞC'’äU9°Có" Ü=¼m’ÓÀ®-ÅéR wï:!Wªß"2g¨>ÚÏÚöÆCR»Eµ®WÉ ,7ö,?©Þ³Ö¶µ?&À·Z½vMƒE€„ƒ«í=DzܗÎ_Ó¡.ª4Òã;_JT»”nÛαì°by¼qÍæò-…•ÏㆠÈÖL! vó˜î“£›æ5Šï_¶µ™¼¬gý2D€]Þ}ùø­ûíýÞRÝÜ¿ágCé!¿¼7®bÉYmk£l\+Øõ:[²J‚d‰ùµivQ©.£ò"íE¤ÄŸg5î8|ÛÉ÷/2¢Ï„mWQ1'ôéÔyƪ™VûµÃ›Þè»õZ:dÝÚ±dí–÷‡ŽÍtö-Én~2ràÌ“© i´™$#€Zã¤VöO{¼ùѬ«Iæä¿~øz‹O7^p4«›l\¼fÓðñóD¯òšÔßÆôè¶ú.¨u.vkÈŠ¤Ök0îY»üà53@fó¡“Ôd®úúWã! ZÏŽYvrì§ï Ê“¢qVß&SlM±Y[;iü¦ó:)ÿÚU·~úâ¤Øù½nþˆˆS@¥;Ïø¸Y2ß›6ÞÀúÓ÷Ë÷^2Z æÔ }ÞšzåQò©]«‡¶Ý› ’ÎÙ,›Fj³F£-I²ÌDN'"¤Ÿ[´tù„ÎvÞ†2%¤MóÇ÷{cùò"ÜX;¾Ó˜Ïæ]¸—xjÇ‚Îá1G1Dº¿gjtçá;Ï=’m)?~ýAX«÷D¤»;&5}mäî¸DÙš¼uÖ{ [˜È0ß%ÿØ0mÚŠÍ5‚ë5ó‡ÕËŽ_J€´_ç5i3pý‰xÙœ°ö³±ýæàþñ]«<Ì ¦ SÆ÷lûÍê»iÛ—oökªZÌž8sþÛ]FM[t?ÓvÿØžÍVürØ߯Xùn—ž×mÔy“ßzgÅqGYQa*“Z:5Ô°Y;’ßÞ¶|Z¿n£²dÅ–¼eÍÊS÷󹤤r.3aÌëN`¥§Å0|ø´‰«BöDñòÍ+i%ƒUtçðÖÕ»~}©Î”Zd %ÏyÓ .ŠHcµƒï7ËQ£%‰DE*–ãü^à €L6kß`ø¼?îŸÙøõkDggw¬ÝfJzÎ?ÍîR¯ùÄL¢øƒBš|œ½}÷äf úo&"bÆQ]š¿3k/Ž~ÖñϤì5v¿58‰ˆˆöÍíÖñª1ûô™ƒÃÚ?FD‡V j5É”½*¡’™–j°*O/oéX×ÑüU·Fã·\"¢Ýƒê½¶üwÇÉûgEÄžO±‘òÝð.M&±~zIƈHÉJOͲ(Knö¸ÖMcúÞ79n˜1¸}Ýó.Ñâºw°@&"¢Œs³Bê LtœpíÛÀ ° {ï8~)W–†Ônõ{V‘ëRfšÞõJ†ãJ†ºµúÕdËئþð9dzS˜q½}³†SWŸ$srŸV Æ.<‘½=íRëè†37þIDöSSªE N#º´á“†ÑíÎ<23>èØ*lƦ[Ì–1¤]hî•´Ëm›„~½ý:³3Ó2 ÓwﻡþMÞHÈ.ãÌNü[}h%JÞþn@䀛æìîÿFíã DæcïÔ gqlO>òa`pï[DDôÝ”^m{ϱQʯaaáƒæíÍÎûo‹‚ÂÛ^L6Sìii&[Q«‚f¼Ó8|ì÷¿æÛzîÀòÑ#‡öˆí0ìÓï’³$f3f¦e_æzšL–™Â¬”™‘`t j µef´)L–eEaÿÛ«h"(¦kwâuÛÖu¨X¹ða¿þ®*·ïº_«sK·œ¨\õèÎÚ´£—L@6¯ÆážÙ;<ÊyPúc;0D €ý´ÿ²KÙôðj\\\\Ü… ¿0ï¤ ?'fÛ›ä׺¢>ûtg/%ý1`DŽ“@pq÷p¼òr^SÙ+Cþ¹zÒJØGjæËş縖.YÁEBlÛª6{VD<ùýúT¯ ¦UKû¹°JÌuÁsï+8»y8k +p²;WlWZçHšN聯³RÉámdg#RrÎ`’[çº^ÇN¨Þ¼ =g9%D£Õ”Ý~3w¡¬;ºVì¾oúˆ|'XâÍY.Žä “M_ʹ¨Îíh^v¯ZïýZãrnñ©ÒJZµèv”t{éÍRE@ÈèÚÃ1L]JP–öñ#¸}«ÖHTDÿ§'  õ•Ê•u9±qŸ£ºâ[R»Zä «¾CÇÊW7îLÉyiŸÝ½Á^¶] î/ÆB0`Ø$Æ?íòõßYÛí ¿/[{PþK¿ŽÙs2¦¤§$gYX¾àÓgӭ˧9ö«ƒÏÌe‡->µo©‹€Áþ>é’o¤;æP³¯ÙuS“§#ý—õñÞ BriŒnUx ´1–™šœiQþOÏOÆîÔhTx ó•OÖµS×JÇÄä·þÕZ§Ê5«Wðpœ Ó»ÔôªXƵzÝ:~n%}*שåYªr@•Ò^Þ¥k× ª—ço¾6có†:.‹ªddÛ>£ßl'=sÜM@³nu«•qqr®R¯å;ŸM ,‘]Y=Û7tAEÔ{6~mÀÔ·;h‰À¹Rd÷¶aÎ ‹N^Mºš:¢­ÆÉ5®ÞUëT–€Ôîå—w}lü+»8¹Õ ô-©Ñ– íÝ1²”NtîušuÀ4jão§ôW¯ ¬Ø<\5­b¬L–„bøU8qþ-Ö}2|Éíq¡kßú‡¶¿šfÍÓmÊþj”ÂJÊ~C¿øçÉ0{¯Z£· ¯B]&îôÞÂ^°Œˆ1Å.3&[3ê×—ì‹æ+Œ Ì d¥?°ª„‡tÿ11sqì /~‹-ÔbÈÇî¥áe|懈–øC›$"ìÈnÝÉÇMõæ\–jÏø<Šå2³Eøešz_|Ðü%ådä­o_½Y©]¬Ì@-jÑYt;2kÙ\/;<ø`¼ïÊ%ű,¹Üük`©ÒÞ¹\ÿ÷½º¶sz’uÿνRarc°²ÿø!sõöz!ž¿OxŸÎò«ðȪÜJ—z0 ‘ì –x¬G6èéƒS)"ÉLé«Ÿ3D±ÄÕ8P…â·_ø…Ãyu"Àˆ‘(2Å(Øu €YAk#P‹|+y=¾kð¯ê~2NШŠ]ùôZΫóö† Š ì9ËjDQÔ’l–€1Å{ítºªoÝ:÷[÷ž{έj2M¶lÕx Û¶lRmÙ²Iµe“jË–Mª-[6©¶lRmÙ²IµeË&Õ–Mª-[6©¶lÙ¤Ú²IµeË&Õ–-›T[6©¶lÙ¤Ú²IµeË&Õ–-›T[6©¶lÙ¤Ú²e“jË&µúÄÌÌ ¡iš&0_=Mcº¦iÒ4Mïãª|KÓè—v¾œ¹5`½¸Ò‚®>R‰ˆÈ•¾cýâw>Ú•ë‘DÕƒ|Mý›53³¯Ù«X&麙ºyÑ’Mç¤Æ…g¶~ºf_j¾"º¬ˆ4Ý›¶qÁ¢ÅŸl;ͺvE#"ÜI»¿xÿù›R‹dî÷Kç-\õßïr•.ªÅôµyô'ìæ<9rüƒoŸ(ôVK_FB§£‹'=ýÊš\]ôÛ”©éúÙOžlÒÂ3š®Q•@Õ`|9kÔ„eÉÂÁ§÷®š:óƒ¹ü‹ÀÁ³çÕÑŒœøæŒ+勈ò6Îá/ãýÛ®lãÄâ‡ÆŽzbÖ’T ñ;ƒZ“IµzVˆêòÊòm¿y¡U}gõ€*½þõ9 Wî,ú ÄD÷Wóæüû½/² T%døðG_bä¬G£©(éèÐŽwöî¡qúd=Ђüµ_QS ~Ÿ??xkXd?åhrïÔÁ7†ë?ø½ý.½:Ý."ás7•TŠA` ] ¥d@×´Ò €é6àÞªCV€’R1ˆJ}© —9K)™"0 ¡]Ô (i*ËÚ¤ë(Å¢üN¬¤T,t]Á·øûÐ4’¦b]\h¹2}=¥’Š*줤©Xèºñ Òüühš¦äÒŠ@š&ã¢QWfž(\Ñ­m|➌”‹ÖÌîÞqöƒ]!²,yIeÊBM»ØFDf¾Ä„JšŠ%·iß"²Ñ5×Eùé‘]Þ¸~sl¤eB»LmëRŸJDòüÿ*¥ˆ‰º.çõˆ%Š!™\éï=ìOõ¯ú|Ř.ˆ¨ý´Ÿô¼/Gv&ª7v¶‡ ¼Ã^Ö5*€ˆˆB[=0sYRžÏ…#‚;óȦ j®E´ºmò¼m¦DB×Óç·' ðòÞkgõn*ˆˆñ}Ư9\¬ëzâ³]D÷-À©]³¢‰®ûæq—FDÒ³ó?SzµŒDDÒ¬Ëï|«|eº?»‹ˆ?üuúþÅtºÆO5¼á¾·¿ÍÒuýÔûmÐfIºKæ|Њ(¼û°ÿf뺞3;A'¢þ 2u]¯¤á;üý„’’I l]„¢ôïÿ9¦wLf`x\÷§ìÌç ä»n{gëP""òo{ç¤ÏŽ»Já$ÈÂï—Ní›)ˆˆœ1·>4×9EB2yãæ$ÿ[z]ÁFÒÇ µþÓàh@è®ù·Q××OU^Ûÿß2«Qžôï¦ö&„=òUrž×4MÓ”ÌÆ úÄñÿ8ëñÊ¢3ÿy"õ:÷hÞ*¾C¿c›½ú4Ÿß2º¡Á„2ŠMÓ”ÒHß1¯{P¯qÁ£&N|ì¾n-@Ó»gÌr{Mé:¿û™?ÎvýœòÒì—§»½m4@7[œZ¬sÆÊ®@@“„Ý;÷˜øÚûŸ¬^öÚ„žõ€ðGnÍá¼ï7¾÷Â~@x“ž3ßž¿ü«Ä\·RÞŒ•%hÔ±ï£Ï¾ôòôñ·_+€6Ãç§z˜™Ím B`°†N}ûã5«ÿ=mPcÜia*)߯zý†B8oxöíùKÖl=YÌÌYïô‹oÓâ/+2˜Õ%Ö’ÊÈMúñûïö$ž-6òÓ|·óû”Œ|Ãd#{ǘæB:õhòô™ÓžÑ->pôñE33ç­îPHÜ€.±Q]ïýÌ”'¸-¡>àŒøñ “™™³×=q€F7t6îÉñõ¿¾ácW¥2g:˜–íñ*#?eïÞCY^V¦d.\>(!ªqìý N1³Yíªa¤ŸýðéX oùˆ‹-™i_”'Õ›—üÖ°X ɾ=Œ´š¼°ñ˜¡Ôþ9]½ËØEé\ª¼=OvœßÚ’j0g}r€€f\t ¤tüý€ÀN¯|zŠ™9íïÑ@³[Ÿ?ÏÌÌŠ9û³¿zLÞ_ú ùÓ«=ƒàíÓ+O0³úf¸ èþ'}žUvØ-#"@wÿí3sÞG7…9ôˆáǬ2MSª’Sû¿ÝúÕ·‡Ï•(y±­¼^¯×”|agë ÒT\¸ïÕn7tùóS /œ`æš^@ðMƒÿ7½ŒTˆà&ã–%—àGâ€Ð»žÛPÌ\²íÉ@ÈõO|Wjä⯧Çhðk>j§ì˜^ÓT̬L¯×kJeœKܹuÛöÄ3ÅJU?¨f›Q2¼OS'›¦)Wœ€pÁ¹cÛ?;‰ž÷ê+¥4¥TZôé®^úzß–‘šJÿ|ÞD&ô|_#°€ j}×èA0vo?|Ìå›èí:ý©ßõþ,MÓ”¦×¯U÷æpåççäxå6`å- ™PôùÜ]ŽàžÕ)¤Ìoj9áo¸Óö³-ÃçW¢þµ÷Œîiš¦T@›Þñ`£èì)·¡˜Áf )³’ŽÆí»ÜÖ½K›H‡TÏ’ˆˆÀRJ)¥²|hËËTÒ?zņ5óþö—F{KŠ‹Š ýn쇢¼üóçÝe%4Š»cÔý- ¬Ú„Ü1iLò’“v¥[ßÿo6Ðnì³7X•åÀnO~´bÙÒ¹6ð2+ë˜XïˆÀJŠÈv·ÜÖ£k»F~ÖŒ ÎΨª<óR@³aqe³d.Ê?™˜‡fq ƒu@Y±Ö°ÅM÷Æwb¹}{ ~-ÛŅ "´Ðèv±êà¹\ ü‚"[„ ßMów^¥L¾4êƒÓ_ô‚Õ‘µ/=¿GÊ·Á“—è€:•™–a !€•]V& û;fåU•ºí€’²Ü_UŽõ7¨—¾æ¥ÇßÜ°/µÀðšR1¸ø=Éyßì-«ž¼®4ü”‘óÚÄŸƒ¯†ç^×µ ¢ªð@”×%hÔë?¦æ-þfá[‰.Xeê®zqÄØ+vœ­bÍÄF€¦k af%'îûáÇ´çÈâgDëVv:ºë°·l[tG ô™”¯*:³x|0ÐîŸRZƒ¬™º~XÀùÈÞóE¾b¼Å©ß~0¦w¼;=ªïø¹;Só ßqŒÜ”o>~{l°ïÃãÿøÌü­g Sš&sæŠN:=ò©‹}a,¯áÞ>»19þÝnf¥Š¿~õŽ @Dÿ—<ç6¥,ÉJ^7gìM|…ú7ê9êÛ’s ©$³üj0€€Îoç—ñ™Ï/ïà–QŸ33ËËiðk7äãƒ挗Z@¯wÓ«K÷š¦©<9‡ßÛÕ —i!MûO^|0Ó•¾ë­ÎÁÐíÍï’Þî ùÃv­|î1V}¯í9nåþ ¯R¦é5¥òä¥~þƨö |ƒjýÖý_]³?Ï#¥iz½—X1¼s£ˆžÿLû]"ÿT}¿GÅl%åÌ¥áC"AdýM֘¬“„r>¾*Û|ÎYÌ»,øHTšÏ¶ÂN—l¶òÝ1+¥˜HPé(ÆÌ+²R¥eÇ,­"•Õü‚vá ¾EŠA¢üÈxÑ.)Ó7›¬ø¥*±ÂÉ—–åËQ€„ °ï¸tÁÖDTú [Á»Š¥øôó*¡i§f¶ŽÛ9-}ãCÕߧVãèo¾…ŒvÑ­ü{íR'©Âåàû³”ËÊ ‘дK¿UáÀ \¶P߬\«Ä»»|™Bh¿Æˆ•žÿ8åšahÈ+‰ÖÔ•­Ú+ 8¾ù»ÆÍz´9XrõϨÈþ5J[Uq:Ðtešê÷¸Ú¤Úª²G[6©¶~1ÚzJ•}b“j«f 0ë:)EçÎщôukš=›ÒÒÈ0ØŠÔæ›Ðm?µ–w¢šæ‹\¥¥!1‘Ž§ÿ›Ž­ñÔ©èÚUõ釃”‚R¨™Ë¥lRë  DÐ4”›‹eË(%…öìÁ×_Ó%}­ï]WÇ£K5r$„€”Ä\»xµI­M€`Ý—¬¡?¤eËèÌ=Jn÷ÅhV†,âúëyÄ5fŒÕöµÖšN*¡lI©RT;G®ßp §íÛiÊ:zÅÅäñ\‘/ëËû: Q/¾ÈãÆùxj¾Uk4©ÌL§OÓúõÈË£sçÔ¨Qܶ­•ã¾ÚxeM£}ûÄ Atâæ† I¡l}¬”¾ugÏZ[O\¡ÒÕÀ¾&/£6 @½öšzì1’’…ðíYS [ãI]½Z:´ì¹hIR^u°qAøë_©°ÁÁÈÏÀa€.—Y¯ºŽ½{IJðÅ­ ƒòò`ŒÌsçrçΈ‹ƒ®×\ÔhRÊÎÒîÝ @RJ~ðV{ç°¿ÞI‚«voIYY¸A˜¦š;—qò$edp~>Ün23)7ùù8s†\.2) Í›×ØH–^£û€##ÕÒ¥âž{èÐ!V Dbôhåvó¨Q®"·ÕZïXz/ë圄ÔT†ï橬,îÝ}ûªèè‹wÍÊ¢³g‘™‰¼<ÊÎFABCkrÀU¯á )ÅqqjåJqÇtò$3“Û-&LàÌL5e ÓÕ9½º\p€fÎDa!ìçîу##!%•ßááa]ç\êæÖd?UÔ‚ŽD)nÝZîßÏ×\"ÈãÏ=§Ý}wù²1eM£ÌLÚ·ÏšBÁéDƆVñ1˜‹Ì¤IyáU³#5ÿù©dò"ÏœÁÍ7[A+hÝ:=(ÇŽA)&â«Y+@D3fPb",bcáïÏ}úÔ ³Ô’¼¿Õ¹š¦Üµ‹gÌà¨(_hÐãÑÚ¶¥‰éÔ)ËK»š1¯½FóæYþ=¢£)+‹§Nå„„_ônkµ+GÅ4v쯼Bë×_ø<&†{Œ‡ áæ͉R^-3­Ò˜€xõUš6Íw7iÓäQ£Ô¬Yµ+UwHõÝñ¦i”M›ÄÌ™ôÓOìp× €;vä[nQ3f * µ-[øëæO¬ëðxÄèÑôÁ@Ž‰Af&Oœ¨fÍ" ÎÄòjgÞŸ™…€”–†íÛµ1càr±®[‰AnÞ:¨¿ÿ[´P7ƾŸµÀ§ŸŠçŸ§ÄD„ÈHJM•ï¾Ë#FÓY—Bεv…ŠÕ¹Z!U—‹,Ó¦Ìðz-'mÛª>âví| €:Òl̬딛+ÆÇòå`&€ë×G³ftäˆ\·Ž{ö$!êX¯ö¯¥*õˆéÓiáB””× —Ë·½~}~ã 8ÌfX îZÔ¥—%„ ´t)=õY¡~)ù¦›èôinÖL-YÂ-[ÖI·§®¬ú+Ïë‚´r%Nž¤S§| ñÒ%×ÂJ4€®ÃÏÏzq` ¬3ŽŠB\bbÉVlÓi“úëÙ-lyY·%¤„iBJëž;˜&ÊVˆZ΀®C×áp°Ã§³þ¬‰QéSwmÃÛ¤þ–ãÒG>U Y¹i]R‚­*J·Mð«.ðŸù½µªŒlL¯PöÔlÙ¤Ú²e“jË&Õ–-›T[¶lRmÙ¤Ú²e“jË–Mª-›T[¶lRmÙªLÿ›ìgG«5ÔIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/request.png0000644000000000000000000021147613051004444021142 00000000000000‰PNG  IHDRz¡à;è+sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÝ!«Òìß IDATxÚìwxŇßÙ=%½’Ð;¡÷D¦‚EªD±‹»×.(W¥èEÅÞ•Þ{@:é=!¤·“Svçþ‘sHA¥(¨û><<'çìÎÎNùÍ÷}³3+fÿœùзéœ'Rúz©þV%«Èe†A(F\(¼-Â(Cn þ]r#q™ÐH£Ü þ…˜jt‘øû™ƒ½U`·kYE.]ˆ Åhn1éÕ×í®‡Ò4@‘²â*LjMÓSòí4ç,ê\öËk¾í‡êÖÂ-äÚÑ…ûºB¡–™;!VN1Ìä9±œ*V œ°ãgƪ¸O‘Pæ¢Ls_ZJB­8Ð$f•`'ìP“Ù¯KjY)uR®WfÛàÜÇéçkReZ‘ËS„†Z¬¥ŽãÂÜÈOP½Á8Z¡Tì'G'÷÷EEŽ\‡hf>96ºœzf¡Ó…¸ ™D‚"¢y¨9ñ„]ÿãU/Q¬¦&>2!ßUCƒ‘Òêc©mÖR u.Nk’ ‡Z2óÄ%(7R"ÄS3;=ÛJ),u•I%ÀGõ-.ª5+6W ¤ióó²méU¢Çw%üqB°¦KK#oy Ë©(";3àÛé•7©$ª óŽ5Añ4$iæù<¼‹BÏAª7/´áöÝÜÔÔ÷"·»D‘ÌãÞ\¡P×J¦ ª“§Ž2¦¬d;@æ…¿ÊÂýìu šÂKí¹cÁþ<ß ³äîÝ8Ä©õ¢ fu¦‰Ê‡GÙ\‚¡6¢¹ÒøéðòfóÒÜ <ÿX‡®ßîf¯·üZ_ ÁÁÖzªvà„KâȬ÷\¡¯u1IIýzÞ~eöc…:ˆÅǼo9üBëää’B«ÕfQK‹}ŒAç©5aë¯èêèñ~^Ö¸Z×™}Ütith}¡x<«†#é1°Õ’fiaoü•_]øÄÑç:\þpôÞâKÂ¥8ݺæu~¶e¹×íGì„À©Í} ÓÆ›ë¶[”‰@ÿ{pvî)^Xi›§3²ç &Û»Ññ¹$Ì@©rç – våÔþ}ÃA¼~ \ðaWÞ9D²ç§'!%foæ·ã…Ã8+ŠXüšÍâ,T”4 çÁ¶Ü¹!iP—ô4Šáµ&Üs€…j¾è=Yqˆ­ ‘ø ÈÙ“Ô.Z å°¨Ößútœ—…»“çþ´tþór·ëVÇt^c÷´‹nšsd§CÐÕ­‹:ÿÔÏrÍfgÕž¦ªB×Qh:T.]‚¨èŠßè]—µð.°ÛQ*]|õäéR"÷)R¢é!R(¢¢¡ýqPU'…S4)¸´Š”Aq—„K¯HÝó+T‰Pwßrén‰1)h:V‹RîÐ=—ZG¤ây)ÉÄdZ©Œyø˜[k³2ó̓ Qú¹_©Ó«A$ø‚öçÞ“€Üb, Æ×æ›Ãx î;ˆÃrƳÞØ‹.aX5tçLJy µ7›œ•f…®G¿y°ÀœZ ´íï(~£Üß—Óçªz¡‡â›¾“ÑovéXj[~œëÚøÞüÒ¯Kð{°“¨®¾p¥||cÈIwu¹#Äfià__-ó»íp©S®x¡óUþÚÒØò!]7¬Œº¤À74 ä¥–Çb Š‚¶í)ÿ#b£„†:^jqïž„¹ø©Ž7ÕÒ¿‹wŽèèÿᧇ§E+Î×"šß  3îrwtLÐèÖÃܳ¯X¾¾ÙOCƒ†Þ·{e™èعÁªJí§“; n¹wŒÿê½ù-Ú5-É÷y8ÁV¿Žó>ŸŸDpã”춯¦<ühç[É%ÊFw0iåã2¥ÿ¯ÓÍOF¯È–—ŒÜHÌf3’uÅÇ©ãQY¬ÐáÁ»ÚŒsz*YˆoÝS$ÇûâŽNù¸úe”sÒ®vóhÇ*úsþ¡k‰.©ŒÝ“¥æ*ÉÎßW(#~ýçдMرƒOš¹ üØüËmÙ>ïTŸWjºØ–2t]1æ‚òmœs¢‰ÑC÷Ør¨Ìï4²]—ìLå¹L þí=ÐèÓé1ÇÖ½Ú•óøª\¼½ÁTõÞf±(Å »¶ P²»5\d½3Þ¡ SÝPç³}‘;dRËä]q­€XøJW¿—a‹OÙKM»>`“á}[ÜRl¹'Ñ©bªê|¶ÙÝ+÷?¯~7Æ·óweåµ&JÏ·JŸ õªcÙW`›Ð:`etÑ =¼W®µõîW{ÇÊ}Š—eß¿.÷îÙg“hx½û}3_:. ~ÿáÝ_àÓ$ð•6Zà-¿©Âh›`r5º3ÚéºÈ­ÜTóàQÑuý›—ºŽ®]!¶Ð›ä™L ,þ,qQAe=g”Ê?¢ïÃ|ËKö\c?Ý@ZtŒ"Oj&žm~Ž·Ò­­ÂÜVc™g÷!@õÆl£Ôý^4ÒâóúœåíGÄsµoqNéØaÉ3í!Dp E‹ÉŠúU°ëîʲ.ÃŽ”»ÊaM’ ”r§ UAŠûûyå$ZæŒmˆÀ¡+X[yWpíµcëšF¨‰!ݬÉëÓB „+µ8ó€PuhkVÏ.¬ð}æ¬/ŸÑû7sþ›]ÿhô¯Å:0­—·=¯üùšœšbÇkP(Ÿ™4瞦|{ÈêãÊ?Z*gm+_ÑÁ{á~×À¦Ž+æ¯ÊÚìGÛêƒ_wø†…âÒ-!Påšû :–—²€²ŸNHÌ¢nˆ—–ç*³¸Øåépv×ÅQM§ ò.§Aooñc‰Ž¢Œy< >Aò­†'ÊÍ+?%v#~/@. ý,®¯ö´@9ížsí*îQËd:÷[9’Ë÷9n¿<ߎ]D6bcjå$‡Á_ŽÓ¡ež°»cº’¢sõÇÍðà;±û(µ¹’r(†×*x¾ EæiGݱ O“tVŸŽñS9v¤àËXM@.‰ÎN–§6 Gõæé­ˆrçIË]–C%H!ÉénRº&»å·lôÊÇ÷4z&ðUEzJÉ绋­Š¾‹ÎIq)Y)~M®ó¡ÖÔ†ïÎßï‚#?e4y£–Øìz0?éhaÝ{Q«¸Qí¨T„ULñrzn-×Ê%€EU\ºþÇzæE¶n„tiQûôžjnº?¨ .ÝR× Äyù9[|U¾Í áÏëúeNÒm•SæÌ8^ˆû­æ`×1)ç;Áaðç£@|¦íÃÓ Uf爛Ox¾ùû½ƒÚw­Ô?¢\JãJ4qúãUþßƺžèîÇwùX!ÞÍÑ~Ìpùå0¤“©vQ½¬ž¾/±ë˜•jÓ#‚œÃ ¾W0ðí®_õ>>n‹ý‹£ÎÇ»¨ûÞ+Áª ‰ÖõLYN®QKÊ–Ý¡„ÇhAiaŒñìu¦d •}^âûX‡€£ñÙ¨ØÊÊ„ªë2O¸ô>þæÒëÉkf—8¬þ&œE ZUÅݳqHÌââšù§YB~:ÿ×~³:Êy¾ØW|Â)š×õÚÒû‰EÇrLJ…Ÿ5rXÃ:e•™6Kûßd;ó6jwúÊÇŠüþ»•_(Ћ7Cƒq©×ÖG‡åéØþÓ•‡Ùädh]Ì Ð5Œ°@Žås¤ÌpÁ.u„àäÊ íw¦ V|p´ô­vßOöù1Å9êªúMR[¿›esèvßò¿;l§Ÿ²ïÛø#ƒ:®ºE~ï¼ùÚ{6¤T”ÂÅiO<Ôf¶ÌÔCü»ŸpROØ•us»Î{sß·Õí]‚ùÀ19·CŸÑ›¿ß3¨Óö{M‹–]Ñ«Î8ï"ËSɨìÛ”>²39µ°bŠÊ,¿O¶?é?ny fÖì(ýplø^‰Fg™ýžhGâÓ¬ÎoÙ¾Vo¯²1ûK ñ?Y ¹‰ëEÓC6ýß1ÇäkjQaœ¹Lk_lûä¶ä_ÌêRMzpÕ‘âS¢¦ËÖe|g7™‡Í¹ù@Þ¤E‰k3œ²].õÄb½Ì¡—zþ•ëÚ–˜²Š‡£t]fŸ(ß’f¯¦ñÈúuŠ2Óúþr¤Ã©«÷c%hUvjÄ•TZ‹š ¶ûiwœrdØÈvT „“{±e 0™ilEÓ9\„ $Ä—  L É%Hšú¢C|1y.4ȳ“ë4äæ¬ð±*Š%öJIÓdÊqÛž¬Êzqºäáø’ýÅîÇCtMfd–mË:µ¨.“P²¯°2èf®Í1%%ò·j¤Ü%÷$•d—K6“¶õhI1‰ÍæÚœPŠæzuÙ —¯¥q ºzcú?bRÄçÅìpnO)—.m}\iÅÀisê[ãK 5mþ²ã%>–¦Ê’Õé®.Ä,ŠrJ>:ÅWÜwôŸ=™Œnb`p!z’rå½ûñQÏúD³5éíöökf8Ï©!7ÿgR=—³œö&“vbRðúçoÏ`ÈÁEEüþ-ÝÐØïÆàOCÊ ?s-oqêÛº¬\n¤Ë¿&'fS“ õl;Umb:˳ ¹1ø+ÑôG¢ÚÍè{Jçí?½Ë˜ v=õöA.ýÏ͆”f?oùVSÀÑ$qVålu£nxüsMN}ÐÀƒK³•©¿I‰"éªÈŠÇͼü(RQH!P*žË?yd††ûù>ÔŠg3¥ää)îísÜǨû€Z¡þåöŠ Uø/žÓÝv—”ª_J·ý¥*¨ÆÃ#vcðçR«Y¨|«éæã²Oó„û÷ìÞ`€Š:¢aøªôþ À2wJ£>Mš|{·‘AÅáºö^ªé‘+üo~dï5îâz&ü³,KÒÜ;‡×‰ÿ9®C¯ÚÏo±?yM­~ìÝZ )õÂJŸiw¬@÷ë ʽgу¼ÞY[õå­ë=¼l2í­®±)¶^¾K¿ócºœqKûù=,?þZØ«[°%.#pv&ššñV'‘_rØåUzÂtUiÈÁ¥.#T)fìG0zZ—“‚j¿š~cØ‚ïR¾/ÐYšóüáw¿Ÿ\$Ð\2Àæ {5 …ÏSZoy´ñ$Ÿ¶ÜE ƒÕç“×w¯,‹•˜[›˜ïÚ§ òZÏngé½®lý}Ÿ[pðŽåèò‘;º¬º)¸ï§¯-Z;?K÷jAÝڗݽ7Å.ƒ»4ΛÌ÷ù>-ÃöaÓöä¨BX,ú¼½3 †µ®[!žÊDÈ›¦´¾Öx»„!7—¼%v$ä£ ¤ž’êP»ZOꈊngEˆƒé…RZLŽ÷˜ºg^^W¾¡¬”—ØíN[Åé1ÅÔQÞm‚ÈnWkN„ÙÈÛÑ8(½ Z*Å9éåEäg9ññ³ »6ö¶'Ûr!® ˆ±u•íÍ»×"@_G—.îéeT¦!7—¼}srÍôoGZ…p9OÆŒ¥ø­u¼ÒåIн6úäÆzBXá—½ùì{ œöÓv4Öô*€YQ\•d²L§‰¯Ð-”zÖ‚ëšQ†Üü=TnÙFElW€.›ÕöC/DÁ¿NC+;—¤5[²‡Í¾-ICJ?? ¥·uf™;x¼Ü·n‰I (¦$kŽL¦wöb‹ Eöoë…¡8ÄØ5ŠÀà/&ñò¸z÷u´Rhsâýâ˜zƒa¾ŸX÷–«êï¸=xÑÿÏeõ…[¿ËYüPÛ…Ý3¬Aêëo0¥…å>ªc­©½Ÿ8˜³8ß;öѦ7]úáÌ6¤æ|]È÷‹âÍ]š/WwÖ¨¦³š{£c¿ÇóçôáçH +Âu›^r,O¯ðwrsËv¤9>Ù\ä`ÎÉ.ûõDÙúLWm_eO\q§®õJ~Mx5Ié¢|¸"mÎaGÍr#¥Åî\g“ ŠK[mtMf§—îÊÓÒòÿ·¯¬A¸W Ôÿ(á»4!J ËâË5é›ãJ…¶ IöŠÎ-«¨U~XyLšÚ„™wÿšsã§Y¨—ý=Åu‚-®üÒße+.׆8›TŒIñó3lá†óYîÒž½»{‡Ôc£–•y^&©q³KU`ôy#vc`p>XÌŠµê GUÙþDkSuÁªòö—GÅqCn νª³^Ý¢VÙšO¿lÖŽôR1Ö!7çƒ×)»ôÿ‹ÖIrc`pÞH|}òTSf±ÿɈLpp–¥,‡s‚¡>pÓ»®e¯w)Èúu’}mõb - ¿÷ñÂ9qǽ455¥]‘.­^ùµ²dqO߇æ£Ê?Ú•¥@èÑOŽðÄšC¥5½LÕ;)é¥Û§n,2»þ2}j‚Y»ÛýÉW_#žÿÇN7o{jø}sV/Iªò¥ð­·.óÖÏÜ£Z²]o¼ªÜ1G^¨ìþnrcp ’³çéÖÑ •aQ7ë߯ݼ)¸ÃÂ#VþºþŸ—#¯[½°óšúžÞxÜ “g¾Óá‰^¼mÑÀ•}s‡l ©f(º^1¤ƒPt¤ ©K¡¨©Yê<°Aÿ]ëE‚gUt°Š©0] dE²ŠçÕSRRRH÷E5¤Raµ EGª)„û’)€¨ÈŠfUE¹S­¸DõÑV=K©Ì’®Ô`S(ºÒ¥u½ýùåf„î¸Cw˜U¡»t¥¢d*Òt)Î`a]2<Æc~;zÈG‡‰hs¤Ú£wšåÀìȱ‹\Þ/ÞÓóËkð9¬-:ç©1ÜiE+]ÙÑ÷wßà,¿žÓkÇð}Hajô‰íÈÝ÷>phvý…{Õrÿ 7;r××H‰5ÍñväÈiӯ߅GñÁ…=wG}†. /õíž=¥w¯¡Ó]oG®¼mVò‚HùÜ‹T4Ÿ¯íùÃý÷8ß2³]a@ÝòȃÜ¿÷¥>ÕqV˜-ï=5DmÔ7·ÍÌ›¹ö†Еí?ÕæLÀyj‡í8ä΂¢ö¿ÚWgp'ÕË;ìà+W¯ ßøÖø×ߺááµþÄ7,Ò3'ò‹'‡n¼åµwîºAgp³µæ{¿PehX7Eš¶Yrøù ž—hÒÈÀ¤?q[vÌëú›áƒŠKªˆ>ÚÖ"Ñ‚pýî“Áyÿý}ûyªÎÒ®¸Ì{fþwækËß>ZÝüêý‘ßÞ¸nâ†G>™õÎ1ëM®˜¥Ä>ýÝ—ú·³¿°|ÛËÑäÿ]׆uÝÁ»S¼šª_±Ýë°q¸í»8AÊÔ7{LkvËÂØfšÓ§e^7Ó«ó‘Êóîß¿i^§z!\ÍíI¾@ËS?§Å]ûâ¦#Úd"dü¡}‡¹úVdºÚ?õÞ E=qZ>y¡ÃôÞ1wmèô⎈w{´½ûÓ;C[¾8)¢è¶g"¥ÔÔ:;Ÿ¾bE/¤WÖ}Ÿûíàφÿà˹”¡!7 ™žpåàO'{»_ˬ?ûèØs{ ¼¾yj˜]J!´ Lb'MÜçƒP)÷.ÌgzÇw^œ/&Ç1ö¯5é•‘–׆J!QŽ5ñ¥w×/›w DXk·j°µô›?¨½ÕÊuw¢þÙ GG?:˜yß´ËV¼~Ç„vz§q «÷ÊÛŸL¾jìÄçþÊ”{{gÔCH´ò¥ ûüÆÿM½âÛ¹3ž6Ÿ¸r—ÝÕ bùÁ‡:=T|Z‘è%›ÕýåžßØ Z*Þ[ô¡¯*z×q¾1ì›»G<þjïäy?N Æ âÿxžÆŠpƒ Æé+Â¥éÙ»2OÎg£éʱønûŠÌîË¥z<«Õ–ÌÚ§ŒÙš.â»GXO~ï4ùo:Úí·Lz¡oÙ41Á”Ñ»QÚÏkîû()$#»Íá<_³°6¦ƒK‘€KS7Çu-Õ”^ýÞß55¦¬JôB “æ·6¶ƒ¦È ›o4…oOIí´ïðµiÔ´vJ€rÿû³Wfù BI=á˜Ù1`æσιºãÃmƒb‹ýp†Åk®UÑ7ìÏF(›¶Ü¼­ÔÙ¾^jBü•#Þi Iq(µKb‘7BÏÉèýy\ˆ°ì¤˜ëîÛÒY·5ܘÔò¹5C‚Ó&' ÷Ñ §êRMv?¼7$´©j!¸t±#¾k®Ã„@“"6½sL¾wfVç ͬø­902¦TÔ±š6Åt½cðÂæ|—êw¤¹Õ÷éÏ^\žåUó³gS†ç𘟱"Üàñ7zG¸KÝóƈQ.K>ë Ï%šqbÏ;WþðÂŽÿ¤©ªÑ,±s;>òÆêïR‚< \æš‚+þ̇ªØÁ¿“«ÛŒŸð-ålû–nîÝ÷Í“W­Ûq×RÔ¿O(Bx[0‰*†¡ÿÞƒ¼jsT—KÅ5öõ“l¢&ÖÁ¿Ïº9›Äé‹CÅ»øoö””áUäYó!ÑÍ”ùž¶}´À·Ð°n .3sæ¿a¶} «ý©¸ð+üëóaÌL\"=¢¼Qp®¨¾F@³?ÈK~·`)‚ýZ\ƮƆÜ\r~µn°5ùå[½í–ª½Í!M·ê*R4pßǃvœKO–üý_‚Ëû•écéšaÔ­áL\ E‘á6K$â䟢©¨Ú)k‹EÅ‹2‘øî“Ô‰m3K(ˆŠØ*Þ%©ø»ÆõÍ„!½-ºÍ®"¨–¤RºG\)R*€'‡J Ü‹¿ñ¬®B¯¸“µäÖ×7€±Ù aÝ\ ÉRï'ùNÄYw¯}ò:ùÖඪát½ùÂ#Wd>7¶õyhÝòÌ#—™ukÎ;‘…³ïÇüIó!vá”WÚwþ궦©}{|üìåÛ^¯/õåzϵ`à ‘%sf"j²^4¯;'_ydæëòï^‘®XŽÛôL{ò¶_¥¿Ó£w¨»iÍ›‘ÓêJ¤ˆhÿ‰þNäÁÀ+ô{}Á=5ŒÃšõ¡Û{­u´âÖ:^3ÒõÀ¤’ýfäë É{éú>Á¦|­w²Qñ†ucð—c·Î›þÄ÷ËŒü¡'RvÃMO¾úŸ»tIû5Ÿ×ÝÙQ}%6ë«­ÓLŠOŠöÆ ÁÒzײ~wtßÛ³ÒüÓU‹´=“ŸÞÒõ¨©»ìž“ ?L._0p¨¯\Qrš#p:¼Ã|ÓÅ´¨ºoØÖÇ¿š;gm¤:áî¡öÞÕbÉ•ë6ëÓq×{iW\ÞáË_~œ|÷=ó?ëÐíšyÇ–¾çªùÁU…­â³Ðu¥ó®WCÖtB÷žjDm ëÆà"7WÖgõöÞ(Eß·k¢àö /hîÑp„~Znð^¢ŠÔ]¾ ÕRݾ@Â)NW­OR¼àòY¥1¾¾í pÅe DÕ²4»OŽÿªø—‡d½>ðÍ6Yaaà|w*G+ø IDAToq-·a/™Ü§èî W6ëô?¤ó•¾…wnht6÷©/<ÖE7*܃‹ˆË ì.·PèºEUŠ*>ë5¾IWuþÑeÇ–rÏ‘.әΒ.{¤}ëU‹»[½úq맾]×$™¹k¸Wû­æ ƒ ÛÆäÖÏ >dR‹{ë^ëmgÚˆ·ŠÍsÒДx[rcp‘õvÒ¥u"H¤Z»ùO6{·³ë•âä~+¬Nþ10À Eëgfy¦×odçôîyï/~8>?´ ¨î}Í Ý!j{çÏOÄ¿8pǾ„Aòb|ñÍ·ê'&i5çRØʼUK1H¤ìÝ9ͨa#vcpÉ`‘O~1íàm“2,÷úÆα÷¶'wÀY8za+øpÖÐ÷­›–æð¿ïò/Ú\óŽ)ðÀc×ÖûebãVK‚iðQžŠ¿i_˜çn_>õÁµ?öÚgñêýõ‡öýnD£?¤Õ_±§Ï§#ÞŸûÆfTVý<|ß­³¿úp%²fÛkgìà·Æ½6|ïCõZ¬Œ*«ƒÉ՜Ɗpƒ Æ©+Â…~"­÷›;:¶itÌ×Qÿ¡Åÿ]•WáU©c»•œ¶¤ØW YÓNW$ H˺˜®6G‹ý…Öú¾Ú¶¸Ž+£/×|rÔ²úÛrÏ\}°ÅÌ·{vØFa‡Io¾R(k~·‰¤gwÚw<!ã÷O:ªåµ -þzÅ3_l¥çx—5ŠÎ ˆË Wþ»ù²b´’âæŠxvKÏ2d ==éŠÕ¹ l“8ìþí­]¶ÆSCuɶ¸nyN ‘GR»%z®UÍÖª±fÊà¹NÕš©àõòåy–)?8½œnwI7£Ð1;Ï)¤rÁ40œ)ƒ¿ë©Cye·—Â¿Í kF:åÑaSq·®sïÇrö/¿à ÖÁßÓº©XÍì…_±Gq$.?ÊOÛzF¸Îe‹‰?%Aú1ø{(.üJªt{©¿3|n—¸À rcðçÛ;x›P$¥š;ò*!Ќ͉0ásÚ o§j Û;”:q ‚M•o¹u锸þ”Î/%V3b킾ZÛÀƒ?YoÖ„ðræ¥U¾Òè©Ž|»G=®÷CBE'×…ìÏÂJW@¸6;ÅÆgæ•Ö¤•¢ƒÕL¨™¢"ŽEç¥,Pƒ¦D6ç²ÌÎ5êσ»“Ø#’¨Öø0/ SE·Ïá{Ðáån¬ŽaÝ#f€WãPt•Eékf‹«R;Ü”DˆSÿ¬Qb„@©é1 ÍÇØLMçBä†Üü“ц6>l.ªô¨º7g’‹;“0Cხ¼M¦•7Ú“UŒÝB}3÷í¥\gnw²Ê©£ð߃ôjN?_—Ð*ˆœžM¢zgóBÝšp[-ÐÈʸ÷(Æu¢qA>ìu0¸Oî%[74ȃKƒÖµx.¨òO¿ ^fÚÂü’*ñbÁ¶$¦w¦V2’¶µqqÐÅØžÀ{yW·áñ:<™Ž¦s(•W q*<È#;ÉW Ý*ÔàæZ¼ø+‰N4ÉãÝÌwù¸t‚}y,þÜÄ«yF%rcpiTÀgÇ=›XÁÃíÎ=©'Ú»wÒ ö"î8{5„¤\wË—Nš“Ö¾l)¦w›Žc1ÓEe‡£}ÌNêÖB¤#bl(³ÆÆRžïÊÞ\–f²µ 2PmòÁYN$惞d䢤;¹ÜÛ¨aCn .Ê]dØÜ1]yVK¦NãàÌÉq'*„‡ñ|Š¸5†¯ò¹%”U¥ôöáÑ\„ àH¹FK!{=«¡\@Uøè«|hÄãÉ-âé¹T$rÿ®cQÝScZÕMoŒ 6äÆàIj™;T îÐrv7e»û½Ua*Ýèç$'—,P\¤C˜Î6R"MX´j³ïB¥•…#ed•±æ8ïu!Ðó³³ üò%.p_ò  ¹1ø#Ö*ÿZt•ss–ÄR±Éúû <Ù™F¡äº†üt„ŸK*wIf¶eG±6‚ƒ"ÏOªÎºbjÉÒ4 ¢£àþÖ9OŒáŒÓßpÂF†½rîFâ‹)ª2£œ]F†ãÔÉ!H,&¿Ê¤UçHñ©»úª>ä@s°6M 6ÖæQÛ›…åIì¶!âK(—(’Ÿ³ñ³n!·”‰n侮Œd'ûO®ÑȇÜÞNtûqrJÉp¹3Yb#ÁnÌLýÑÑÁX3epaøW¼EÓà¼0œQCn ¹10000äÆÀÀÀCnŒ"0000äÆÀÀÀCn ¹1000äÆÀÀÀÀCn ¹1000äÆÀÀÀCn ¹10000äÆÀÀÀCn ¹1000äÆÀÀÀÀCn ¹10000äÆÀÀàƒÉ©IÊ5£ Ο»nÂhNgBÌ—ùÆ+ä .ÈØBà”FIÔ¤5ÓÊdÚa…Áy#e-oa2Ë&ŒÂ0¨#vcpÁF¯*ÿrc``pQÝíSLâêcUÕ/ÿ…ãÖ¿öÆÿ¼<·ÈŽ¨éDñgÖ×9'u)´™KµÝšN¯Â-Ó9°Œ™žìºˆ½ƒ¾àƒ¢_/õCNÄ<—ÅPŽsiô“{òT -~ö˜Ñ’ù“躃ÑfÒ{sÊ Öþ^Óø0âÔdÞZÉÌŠfà#ÝÍ*5‡‘+Øk¯~œNôDæ­ãýÌón{’üi ù‚í¥gŸT òÔùè«Íè\É{!4þù’냦ü+"Nõ¸ÄÙTU³Æ¬hGëÿ»À0nνèNoK2Žà pÍå|âï/x«è:øa RòÔ8†¦×!‡ ÞpÕ'ìv"¡kÑS¸ú=Vk§&~¡*K¨©×|½¿¾ÅTωõ’lµÊÙö¼·‘ÅÖAë+ÆÄçCɘÄê„ Ârä*šÕ#n$ªi7bªjk¼™6 €_-J'ÓÈ/+iH™@ÅШ-Å“ðÓ@Òº)9Ql:Hú÷!q4B‚äú¾,oSÅÌvqC$Ç£XÜ™Z ˆ½Æý匞$OäØHúøzÖiÕˆýãI›ÀÍ=_:Y8„ì‰ÜR‹Çûó\DµêT|Xyãy¦yM†½ÂÂA¤M`~'ÐÝwzw/R&rôz.ó wöáÍ–ÌHvsÛ€dÉHÒÆÒÛû\½Œ¿):%NJØ4ÐÑœ”8)Ópi”8)ub—h%Jœ8‚ýÀE³컑´ <áNsÇXÚ°}<ãÂÀÉM‘¤LâÝΔéžþêÅבÅ}°’ÞI\å–/¹±;Áv÷¿“CHìtBÓ鱄‡É»«”›X¹—Èïx>›œ(N$sÏab2‰\‰IcEzõ:È(c@m l€ªóP€:õ·ÑÀ—0$O´ÅäÅå Úˆméôj^kKHV$5â“•-xt5¥ÇÞ) ¾? , ùl"zÓÿ{o⧉ŒI¿vîϸ¥\¾œk°©HVN¢S>ݾÇÚŽgšã§Væ:8-Š§7Ðk9}ûòS»êíLrìd"}–QÔ˜„k¾ŽâN3}¿gÈÖF12•Û{ðãv:.ã¾+HÏ=?Ñs#›'ò5¢t½²!áÀ~’-ѧt$ï\ËÖ}ôXʵWð\CÐùêfFÛ賄™qØn%@+ùcx}==~ ¤Û¸­ƒ„[(Žå²åÔíA€É=f¤ÝFüQz,aŸ/Ù׃Ž„þí9°›¡Ñ¿•ÃÐPR†Ò÷k¼4–—ýôcw7•žÞ8Š_C†û¸^Ü“çWÓØŸ`’gÛbö¡«H®oÈá|z´!îJ&,çòåôïËö.u½Ù4‚»W°";úór]z}ËÂÖu&Ê'3g=¿ç=öÑ “ϲ¬‹f±×,7wBÞíù7“Ša¾YZ”0a©¥lŽ%ÙÄ4€¤å³~?ÞŸ ÏS#¯{9·nD¯zo*ŸghpqUocpGDE2oómD‚Æ5Á<Oÿ: qMïoa“‰aÞ˜,tÕx³„®&´ôa{¾§ì4¦taÑ&RJÙžÀl‡{tÈÕ[H,%)›)D5wôäã--%¥k—Ò»'@ß&î!µ”ù«ØS¥k’‡®aÛvž 9—Ÿ3¸¾Ušx‹´,àŽÃ$ñÄDí…‘þ ÜBR)‰Çy/ÉMA‚dW&ûKÉ*à0ü¼ŽÔ2Ò3(€Zæ¦Ü4o†¼·²9Ýë}îIÚ¡œônÃ+!ܱ­†n³`«rIÍã£$:Ö£VmÆBŸM¤æ³ã(Ñ0.¾ÏäØy;ËÂA#4„¦v¦!µ˜wÖ`“ƒP'‰ÙÇH+à•Õ„Ö§½@ê”óQ6I¶3ö[/ÒGÑëc’4T•GCi¹†¤|Ž%ñv77㸧HüiïdQïؘƒy*‰~á qus>9ÈÝ—óõV—RÈðïé‰I %o­aW%vÆ·aÎ6ÒËØ“ÈSŠ‚t;©ù,ÝŽ×PˆMáö½ ^2±`Áį̂ôPbïhæGA©'£’.†³ ˆÈ•ü0‚6fpÿzö¸ª;±âTw죃|Øv29€ $æô…'©›y;ñye ™³ÌŽ<–ÂÕ’AÅX1³5{Ž“›Â‚$>k€æ“äôh¦Bß廯òS7f(ÔÜ_)#Ê ÒÂ[Ùó»„7”jî¤âó«þ\@d/œ½*ãà!&ÏÁáljŠ’h[³VT(ÖÝ×=dãz?÷ZRæ1!aOqå%Ô¨u“Hóå•ãÚ›SéyNé”ÃÑÛÑ%Hârµ„uN¼¼XÐ'·lÁ1›ûx§ EPÛ,8ïñ4w…1!¼[ÀÒ1´“¬>Å)B¼°;+[¬¦ E­…ónw½+pUÑ{ÉïäöÐx2³½ Š %3*ósoæ¥Á°Žî-8‚çvp°¯o%<ŸÙѤ¶áùLújô+á¿VÞ;î)Š$˜–»ÛX„Bb‘ûóÁL@spÙZ–FQËÉš ¦­&õb?U³Ü˜MO¤»3WÑT ˜*Í×Æ&ö;'ñ¾ŒiËî(çÿÞ53I ¡S#Ê3ÀÎoš{ar/ ¿´-`ù¯pïtKçh"˜ÙžÈ{Ò­6 v‘UJÿ±ŒÍañÎ*e'9¡&÷ç°`w?Ö**€p3ùvd@]o(vÛœÐqžìó:>^Õ43I'v)QiU"s–ÊK·lö”Œ tt0y¬ý:frmÿÒ´`®œ™:gÎ :üƒNOٙܞÚ<$¨¸Uã”øi‰ ½óbO4°pϺž `%¨´mǨö6V¥z¶!©œÄ½4Ûì9] }ùý@ÛÃ+xäZµdzR0/¬Œbiülæž0¦vgüÿ2êG»¾‹†,‚¯'2‡ýq ’õ¼¡@¨Ð¥Ûô®¸Õ<< $$ÀǨ}˜&t$e Þ‹(W/fc8‹Pñ®t”Púyƒ¼‰„³ÁÊÆë@PZćÑõU$XUp¢(t=­n~ÎbQwV§ÂÛÇx«#ɱîÖ¥³° ²@°©˜­ù1 ’r¨ÌSM˜›‹tRîË« Y л>á&€õY ï0ñUsw‚Ùpkp‚‹q ù&T>cdW°ƒ‹©½)MGj”ê\N|êq½Uÿ7÷0v€»¡×mÊg—»ëµW}êXˆNÇÎ@_pСrÒEÜNÐS/Ò)®óÅÇf0{FIÃÉ܃ü÷ ¯¬Y’sPü>¹ŽV, Ù%î^î&p‘U>ô¶€“z ñQEÓ´+ ½A@ˇP=I½PúÖ >ߤ1àknH—ƒ<˜ÕØx~a+:…ÊœíÌJDûtîf³ #oØQÊ‚Vü cDww‹½¹åØeµ±kg#[ƒ̼Ñ)ñ `íäå3o7˜Rðõ¢SÀE›—¨An|ÀZ½cøV ÔEt[Ë×Q$MÆÅKëHÔ œ=vä ÒnBŸÊÜ Ý™´i@Þ$¬Þì}Ú€¦ðq=êò} ¢Ò™'w¹{㋹ôµ²¿T~IÀÆbI¤N¾°ÄE•c6p±|×ÊË›hÞš²i$eìf hò5ã®$s %·“v„§ã@eÁFözQz Ó¸S¥Îr ÚÂcH›Äž|•^iÁ–½,(@ÞAú4bûòöa·›ùÃ0ÆC!ý7±l2å3ØÙƒþ‚¤Á7LDÆJo'æ /'XT¼ÕÊr6{Fa¿?8óúwìâ[}8µšÝ=Ùm]«Xko­¦j‡Uˆþï‘©Ò’uµF?òê(roF¿ƒÐrÒÌY…ÚŽì›È›ÄVSÀ¡a¸Š¹.š Sɽ…Up€—À•ÁÄ=›FÆÍhãÙ• ªRyS7\Ū.5X­Š ˆÜÆΛñ’ÔýŠR8ÇÝ öbk¾Ûk[K~Ü]iý½G_ ‡Ë@ei.ÝÂù2Tof«‰²[HŸÊj/ð5cn/åtl¼¼yl'þfʊɲ o'ífd­ ®è¾¡p‘í‹Ùûdµ%šì`©.Dåžo¤{.,UbNkkö<j°ƒ×i—ÕÀ^ @÷|vûÜ „çóÉŸ Á ÒóÙ«JöV Š[9¨ ¹šwÔß\%QÍBóLš*lq¼(*rGX¾¿‰›x1µJþOÞ¦ZÅÓ¬Z2ϯæê÷Rõº¾€Ùs®µJ:Ö¿¹ù#©åIUÕmtzÏÊYOOŸé€“‡©Õ}}›§Áüö*ŽÛÉ¢>Ùh«V„£"`æ*mõd%ZÀá©‘ªm¾¢y»Ü^\ìéN·}U2Vµ=ëUÒ9Ùª¸–ª® Xà0ÿöJ‹­Úü¨~S“ÊSdõÌW¤IÄnDMêàUåWKM’õ̉xÕtY¼«œ^õs•îZõ3U.-ª_ÑSµ×vàË6´[†Ù‹-þÁÒ9™‡êãê—c¨“ĸ„×a„?÷¤V¿¥¦Jò:C–Ît]sMçž©”þ æÍévËïPãaTi0¿µ¦”kl´–šÎªZ‰¿Ñæ«tš.=™qè´îàUÓçSƒ E¯^ÍÒ½8L¬ýŸÖbOm6–ßoäa£K+Tü·Dá›]\iãË!x¹ÿ?:ÎÆ^ ùGú³bùE´XLŠj1ø½6³7ú\Ãþ&~¾Žå{¸wÿE›–¾œ)ƒ èLü!ëFÖûë[ð¸ô_¿^ôR(ºKFƒ.p \ k¾9ÃÆ ÿà¿@I)5'­ó@or§Qz_õÂû/.&Ïš£¯Fñl‹ó´ók‚êüåŸíÖi·ÒÜ„_Ó¿üÒ—/\ͧ]kXjPùÍÙŽ/ò6¼œ"{aÈ©žˆòÙ¢"o£™rÚ­é5ÝãEÒš†-°¾Ùйª;Iƒ/@RJ Zc¦h:ã-ôú‚ÚŸHÙm\åõ×ic^:(L_Á«IÀÁþ뇠Š¥É%)Ô[ò¯¶nqÚÓÒ’»G3Ò×=ã“=ƒ@í,kó–¨ò‡úíÅÉÑ„¹@Ò°I×kÿ¼P:%P/ÐöyBxfÜÏ/ÛÊéY\6‰ÜÃt_GL)%NžXÉÌ4 rÏ¿9ˆŒ(¶ "XsÛAÛÇÐÖÊÂk8>žgZ€Þ߀0±i,É£æW™•Å×1‘w;{¦ôtÕgßìN$qQ˜!m*­T^Àm ÜhÍLF›®ò´NIô8šYX4”¬ñ<Ñ tÐxïFÞj|F!»§/;û¹Ÿú}²?)Q¬Pe|ÓÖCã94‚Ž^Ÿ’°zñëx’ÆÒ×ZC™zù²ìz2&ðå姕>õ8<˜=‰ëëyÒA㦾¬è Å›¯#móS*N/®#u"Ókƒei G¦qG bQ?œøÑ H—š1dŽgRèêZÒ¼z3k )AÌú1dŒgQpѦ!{‡¸¦Ë/'y ŠÉ°Þ¬læâ’tŒ a{‡âã¹ÙÖ Ù1†„1Œ­UyXãúDß@Ú ¼áIÍÉ”H’£XTe‰9:Q݉™ÀÞá4¨ˆpQ<’Ö 8>î÷MÅSåFQnfè®*®šÂ·°81Ó Ëà²%ÌJ"oºûiÀº>ìÉ››hµ„roø²³?c—1p#Ë'ী$ÿV6í§ç÷Ô'ahtkIÂUŒ_Á¤ÝìŸF •Þk"¿$ÖI¸Á&€„[ðKå²%<‚êríR®ßÎÎÉ ÷EJ|ÙÚ‡AK²‰ SNó+Ulùi;—-e“BZuÛU1ä˺=4oM Õ}ü›­Y°‡à`´I<·‘>?2 /+ÛþCGrC7¼’¹|)aø¥k7qZÁô4†®B@Ÿ/ØlÇ×Ä#}Ø°›¶ß"[±³Ûo¥ºò*nþ‰©Ñ¬ˆÐAòÄHÞcøRFí`ß®ö…’›8ºË—²¸²I ÁÄÁÌü…‘[X9À­##ÈÊí«èÿ ÷ç@R®S¿- ¸|ã ­xiaþ(º2îg ø‚™q€¤ô\‚úþdfê º,gþhúùלšK§] JŽ1`x‘?–7ÖsÙ2luÙ:€#¹t®.ÌmGp¾ HnÄ×'Îhï)Œ—\¹Œ­>$kºs°“~⪵ÌÅsá ñ %iÓ¦Ï ú_ÆÛ-Açöþ¼Z>Kø_¡{‰90ûþãÃà¥LŒ&e­ ãÆK͸ü§ßŸèVNiª ’ ­ú (ÍšQÂø½¤”²1†dS=÷ôzŽ”PPÊÚt:Ôv÷œÛ~!«œø€†*cc:Æû‰¤ðàrš¶ ¡Æ]½ølGŠ8IÇ¥8ŽÛ2J+õ:¢M‹˜ò+)¥¬=Jº™©~îŸ[ÃÑRòKÙ”Eû0,ÜÌ'j¸ÏfüØš:ßbƒˆ– (eôvRóY±4o®µo˜2¬_ÙKJ1Óº{{ê ÞZÇ¡<³é¾„©W‚@×Á̫Lj;ó†~÷}ǯùÄf‘l#› «”2\'.Ï$ÝmËH.%«ˆ%yÜÞ æ[Ó%Rå­4âËÀAÐû,ÉàD9 ãé¬U¹ÞÕD$Ì-¢›tÚú³9çŒ9”’Yq$sÏ6j5'ÿéÊÝkˆÉ'!‹Ák¸µ@Yþï²çÙ6K&ª!8߆9[I-eWO˜,<Dó5$æq8‘O0¥‘»ÁÏZO|ñï{¹¦S<)]¯ Pžê•5¯iEøÂB€8Ï.&®ÿ³waQ][ûÝçœ)ô.Eš*ŠbEņXbC{El1&ã7Ñ$&&±Ä^b/Ø{ïØ{AED¤ƒ"½O9çìïÇÌÀÐÔäš{ïwe?<Ι9k·µ×Z{íý®%À@WeœP.Íd@O@å¡­ŒÑƲµU?zU}#»°¼ÞÛz[`]ÄP)Q@0ÃI+Åô€ŸÅŸ›új0S¯“Ñê"6øb^dà‹£X -ÏãäH—ÂÎ?_@¼èÃR9[Íi% %aÊd„áµvÌ8 pØpƒû~ 8÷ r Q?m¶BÎAÊùh{GG¡°v†øáXtË3*[ eºÚˆG€œ/Aê'˜y;3àÖ9£`¹~%H GĤcK ‰"VXã·Ó˜2 õ!aÐãüáqoxÂZá,2 ìSbŒOŠj¨r‚ºî0,&Àá¾à'"@• ß}ÁôÃHˆø–0Cæ œiƒ ‹ˆî Ú ¹Jüãæ×DØîÁ>˜àaþ™˜ÿK·FƒZg!écºªE„ëÃRU°z@j :¼ \«ªˆOÕØaêŠh]¥ù­*‡k¿S½ $·²P¬æp´ [-JX¿×ÊF #À-ÓÙöÕ‚¶5¯h°ÅexbM—E½ª8˜ÑÛT…˜ÿ6Zª1”Í ô€Ô‚ÖZ§1s˜Û M³1àºP»&Ó¨kÉk˜;M¼Žg4Étü@tó%×cªÇíšÙ‘@pGas~•fÈô8VƒóVk#xè€æ ãá²É o05ÚhåÜ‚0ëeAÊ–‰üMF_9A±ºÎJÊ]¢ZÊœnq hUˆ9Õ-¢2h;­!êÃ;Y7e¥ZuµàZýš¤U’·Á¦«‚VeUþóê­–>W™©zÏnu½f„7öõ_©Ô ýªÙ*˜fæ?àßhÞTÇkúÃ"E…­¿¤\ìÚU³0ó("Õ±Vµs§¯)¥Õ=”×Ì„L¹Š 6DHvŵR©jYum¨ ×օǬkXM+®ÈÕbÖk²¿ óÆÎVb¢º5Bª¶¿{<µå»°°š¨”µå½—ܼRV`â;AÚø˜ú"à÷Hü–òïm‡á§þ¥…’\X1ÏŠöFiEç*á²Â_ƒ†¿w‚ß±A-"¼¶ü›©ÚR[*šŒUöÆTwô_éá{d̪Uü­ë@Û)ZMOßµ ´|h £T•º¦RZñJkóê V¡PÖŽJ¯Ð*3õö>Ò¿ºkKm©IÜeL÷…yqùB­¾F¦Ú¾?Å“­ýÌ”ÂÁ“÷*¼júžD ·£œíˆ^Òšþly<á]wJ”4kÖ¸°O(ÍÇøû0:zRÍ]  $i,i,'Kú5Â$ê0NÆ È<RQlô‘ %c\¬¿bR.mÕ —¤ãÌ™¬ìP2Ø"[ÛfJZxN¡c:r<Ñ Â`¿Ö¥ãš¢F‚âü0Óí«†¦ñ#C­WÖ¿W><ÝB¶»g×®Úò÷‹€c„J1¨Y毊‚jîiíe±n„Ù{‘6Ä¿m§?¼Î¿Aâ°D¥DJ ]’Ö² ÄÉiW0ù×xŸ<½èq¶?Ž¡Àoê8yè,õI(EIæO/™oζڜm±1ï‡ì Ò B›l¸|Îfû㶾~››ž­Ø R|w\½°]Ey¢µËñé»7t`P°7/v\9ñÈ9ž#yñb™!i*a´^sûùêIF0—·*,ó«d™ÿÍ8íµå¿Qܼa ÙÛl»Ü(yX£Þ»!jT(úyúd¨sT`°§Œ(DŒmÛxµgÔê¾ ÎµŒ®*&·ÿõÚãÏVÆ´›ì³\ÏsöóLÒ*@ŽãýÝz˜åbæâ®þ)#œw·Y¥93önÜé¦ï½îÍ“G8\è:K 4ü¨ÿñ&ׇú ¾ÙþW¨Õ 1^ê’[ÅÔ~xè»Æg¿VÏ‹êõõ­§S9ݵi‹Ý‘륎p_ÑìD€Oº7Ê:e¸cÊpÇäá.)ƒ;3j4pzÁïTµ#1ˆÚØ4u¸Û¾ö?ê®ùQûF“_=\TJaþ*u(V™¨Í ÔfªŠÒ¤}Ç–ò”ˆÙNÅ‚q—c?Žö›n!T.G‡oš(‚7ÈAhÑË…_¦!:`5”dMŸ.WìY“-±¼hÆÎü€{þeR¢¡­P=’o^.7ñ×&ÜßùZ?´=ß,¶vcU[þâƸÎæô>?†Ÿ>Ñáèá»q¯ºœ%ÿèï¸ÆÆ!ðèåÁ·º=#éjHÈØܱ­ÃÎ]?<6Ú­2µzJýÛËblŠß®á^£ÀóbÂ,Õq«:ßÞ³‡]ë–ðéÏ'Ö)IøÉïÐåË\DîÀ "·•g åË/Zì»wÉtiœß±gQ;ögYì‹ZÙóöD0ä^jà½biUA™óbU²ÃôV($÷8»ÌH°Ò|id±¬dÐÐoÏŸð;|Ê´ñäÎ;AÜêpørûƒw¤Ê Åú" ©4ÕÕ°:°9s«t”÷í»»Û>wD}"{Xˆæ~êo¾7¦E{0ãÔ/ÅÜ)-¾žë½ÊŽ©hò:Åíõ¡'µseàQcý–óßt]²÷ úëáÔWu'íìïnÐ7ðº6 AAAóƒù¦l¹!CoÞÿg²„TØÞ=N ¼]øîgïäyzï‹yƵ‹¤¶üûÅ ±4L†(Í)¨—”Óàç“ùΑ )ßÚ¥5=;ëEŽKLÒĉ B…HI\f×=™ “•Oä-…6VŽÜ•%¥™c·=þ½Q@Lo7,EuN,ôøbÿý|€‚éà7Â=mþ?·IÎuYa`»«% JI)ßqçëY »ù·»:Õ;•A‘À)mr”&`¹•—wlʬ\-gëlOs u»J|®–’Å*4:|r·O_Ü¿{1»QR¡Û¨ƒËœ}êÀ²©En‰…õ$Vë—ׇǞõo'êm³±tÁ Ï— ›ãÏÿair€b L<[l K9vtšVœïSltôåxv´Ñ“8ÔI‚G¥:@­3s©ž˜”¤MK祔ßÙ`å-.„q¼ûéåßy–jQ†¤Šç¨ênˆa6_ݾêÕ;_%äè­ ó’@jÍ›Úò~Ê»\' „ É ³†Z&¦O ÅÇ’‡¸0ò§H¯¹ôC$Œ:E @È+l¥I ÖvRK ÐU·–>,•onqìùëž³ZÏãÀIó|ÜlZxìN#Yhe X$x[اé7ÌöWÌ<ûT¤Õ(d·œañP/À h¹”É7}ëËŸoœu1„³²9ÛaSëË!ÿbÚdÞ ‹y–.$Él#ÁŽ\«ÚµQ[þþÍ•Œ¿Ø¡‹oc%T-Xз·yhëñͺVG@‘ôÚoîý™y$ï—߸=×à¡fuÖ·NNEÕÉî‹úú·¨™¿E}«” ò—$/›}oÆ‚‡_ýòpÖ’û?}•„…öe—4!Ò¬ÀÃÙ=Ü–ÀoèàõOC€&öžÁÔ!QkƨÁTt±¸_WRÑKžw\Úc܉'Ÿèå<ãÞi×¾Íð€šø·žÅN|\‚…AMr˜ý¬!xòæˆRF,TÔÑìËæt¡qŸ¯ô(š™l Pðy%ÉtÇd¨äÖlùŒ0´íYoC@¶ÙS¯å@(ÉäN_e&̉/ï&¥¼)PìªóøغNÿÞÑÄïJ¤ô‹cg½ÆNµÏÕ¸ç¡F/§`©š@ ÍŸJdÑ@“”Ö5PnIé —ׇ¹·4À*J@¦t^_Ùjîk€Ò:fQîrE­«¸¶ümÖ ¡‰1‡B͆*·dàVÊxÇýëÀÑ멃óéB½‘¢¦NŒíðÝO@àºkÿí¾ÞÓ:Zpéñ)ŸûfY°ÅUϘEõZ÷ØÐýÁÐ2D힨ŋzFÏ¥ xØén(‰Ës-ÈúBs™]|5'øVÒý±\¾ÂÚÞ°hñÕ#" †)1âÔ:ß‚œ’ìJ ¸Ð®Gç™~Ü:¨EQäë^Ïl*8n$ÅBºëÖŒûM~ €eTF¬@ô£KËê¶S„:¼TrU£&û—0.S§Ûe¿4ú,µÑ,ÃMÝ•ô‚)‘sjF,X%$€fÅk]v¨ê/OÞM ¬—=ÚÖÏà̽Nÿx¡›ËB)ÜxñuÛK`Õóúuó¾ïùÀŠþƒïmO '˜9¸Ù¡ÏÁÒrOºîâõ®…ý“L yøêãÅCvæg „@ðîz~æ£~-ö¯Kpò ¾Þi¿VDM!€ó½’œ†Eà܇ú"êù|ïÓ_ý>ø#ó«)]ŸT0‹’÷¼ŠµýlöI)€§¯úì:'p"ýj€÷ è(çMk×Imy/¥Z%å€i t‚‚'Zø HtÕD‰« WC4ÖDåR96…H 䂹,//Ï ÀàÕDÒw§âv±¬bzf ðD‹LEÈUG„‘‚VE„ƒBIÊ3—QÍ&E ÎæNGP¿È(]Õ ½<år]…ŠÈcÍ+e»°ªù¡zXÁ²nJ 'k´_ÙÛ}›Úã»ù„¶Æò¤  ݨ+»d*X%,ˆŽöK~f'ŽH­QWÖB®¼ ŒôüE—&cmßÉ{S b¨-Åy¨9×ò²€ :eËr@®%º‡ÝCí/IõhrTM)O´@URpoŒõÁVgݬã>nÕÓþO‹dÚ5£i†T·†€ÓC©jA®:"RPMl•îè‡}0Ð5’Õ `‰–‚ kÖ¿Ž þÑ«Z®Ã¨­½l¤:™[öŠÞ>No0uDôc‘HËZN*›/3fÃù6¹Zè-©8M!`«4XVñ£T@`ãŸ$ÊkÚijß*kE–sFÅÚÖ"jËßjÝü' -ZÖ½w?›ø„Ì ž§—•Z{ ¢7KY ü?ŠHÉ£Ìo#k­›ÚòÿFÜÔ–ÿï¥VÜÔ–·•ªá”%<¥œHõ¯Š BÕ"÷¾ò 3Œ”)BˆÀ‘€ð”ÓÇŠ,@Á "£½fF+ý’¾ù|úOµDàå)Wñ x‘Õìh"0 DÊŠ”À2j‘r¨µÂÞ0°„áAduaö)ax†r%ï-w5áusGÞ9ª¶TÃ]"GDþ¯¬ Pàí6;%„áYPr´üBe^¤ZNr„ç©„%êªʱ„¯J9–áõÊD \y!þ-¾þJ˜tµ}^…gV¿©Æ÷€ú=Õ)bktQÃg1±8(†sÊÑõÔa’¼¾?kb>eœ7¬åþ^~Ê0ö·@ (12;%†sªÑõÔa’¢~ßò>Hn1Oæ¥ïÕhÕ|”:h2y‡G1Âxéí ¿øÑB˜ä‡ }Ú·ˆñÛù&°um¡ç×î˜ÿÏúÂJ¯úD½¿:„¯†IRä] ÕDöøóÆ>+MJR¬0£GµÞ7þYÐÒc%o?@@ •\ ömn\¤7l©¤£õo˳÷ãä6;‚]ï¬{o¤]b˜4vŒýý‘u®ïo”ò0ÄîþȺ÷GÙ$‡IŽr¸?²n̘VFxò4Lz¨çåÁnŒ´~&‰öñ¿“‡ßéV1²¾"+¿‚”‚mz^÷6¡ D€ÓÚ ÐdeRé\öJ™hgéˆ= *v÷_x$ÿ‹tS°Ù{üg›‚2õ{z‰“Ùm¿‰&N_tÿçчÁ(·üxù±Ü©©æ`ówûaNÄ\ÊhCÞV¼ QwRÆ„‚@ÛBFwø¾Ý2*S#mþÓ_Ùl9­y`h¶¦x¨ã’?Ô‡.<úçX2æy÷Í– µBç/&‚N³jg¤âÜ1ºÙu¾ù*¦$+Iùܘë|½ñù€‡#ãô”¦.4ÕQ£€¨;lÕ0††3Y½˜Ü‘^a Ñqoùm˺_Î2 °9Ö¬.вþÊ[Î@›æUÐzÜÁ‰`®sT­Ö°’ Æ”þ €€¦›plë]÷Š™Ê­*M C‡ìIµòø'òCG_­ÉÔ®è&šümì³”ñ:m¥±iè=)0voÜUÍÁ+óúX˜ínÏWƒŸÙý§¬›ê$®Õ:¹+T—é—ô´Ý0ùÜ(&kä@IJa7:ú; ŒÍB:) ü:˜Dú^+}$N!õ$|9@ Û’ÅžÏ`y´'>ú"Ñj@a5èÌšJ8®‚©€ÐB¥1%ˆùÙ~¤ñÔxs¨…Ùà3ërEÂëÒ)¤ƒ‰²ÂŒpqCåŠÑ-î².ãZ‡PÂ: ¢Ã¾¹7´ñªÎÓÇ“]­vý‰ÃÊÈب4¶'-ÉŸ@V«³€Å°›Úý®åªÚò'˼~ž¯Ãêîn“<‰¬øè( yzi¼,~T˳£­âF{XP€™KßüA?\ 'w?^R9›EýÃÔ9?Æ<>¬rµ•ˆš‡ÎߥO&׆úĆºÏhÛøR·# °qžñ|"9Ö¿Sâdr³ëˆVsø±Ã× p]ä?åâ8r´Ç÷%nëú#?¹®çX‰¾ áñÖ¿.¾½,`x]9ÅæÛ~æk»…Ÿ!Ñ#‚% àÉÎA6 ¡ÎG†¸¿œÄL°/€Hº·³{ÐgAædæP›Èu½Â)smcŸa–¬Y òk—2‰9Ü¿cÂdr¡ë:¢•Ob!¬êØÔ¸ø-'ÈÓ(ײ?í´ì tg¼ €Pg]"ÓØíê¿íì‘{W©$2 edÉ]Åà ˜Ÿ…0³º_Vïž=Ê€Á—ǨBZ{ÞP~;Ô{ù‰ôu…¯@!‚8XÄÓ"þL¨©‹ÊÆÃ<þnÜRŸóS³bÏoe|£GÚÁl£É-VÍ8ñ˜r°3M@‰p2ÔÔMUÇÃüÅÃøEÍÏ|ÆÚqKF¾Bª?Ú1I«ågB@àßÆ3¹ßRƒƒŸ ¼óGmŸ(1#Þ©¸Çæ!׆֘ô²â\^ñÍ‘–6t’ÍÝì&ûb§.ˆ u -öñ´m¯F’y1µ'ÅÚ´y9Ü.Æk}-Ò˜qõÀ#¬{{Å‹nç‡èäçq;p•ûáIjµo3't}ªÐXÐúž‡‚MíoÌÚ~"N—Hg9$žä ¿¶Ÿ»öâ£ïžzAö0f\óôX $©wz.´Eu«D”Þ5ìk3à/UFìÚOÏ‹êU4xŠæL½ÝëN€2ìôF=3Dv¹Ÿ©‘‚½R" K~§ <Õdyt˜¬»IÁ1õý˜´Ù£¯~®¢ø¨ùøÝ-g¬IùC­21±Ž°Y)‚c94hЃГ¢Y™íúí^iõ׊)" šÒ¤ùÅðÉg–ô ÷™vúp®XÁº€‰=zó‚N æÿkaÆ)(¨ç*>½Øáßæ~ü m¶^õRŽr°c„Âj{£ôö<9óùXwEÁ ƒdûêœdÄ€-%f©?m.8_Èž+Ç5èveòåk™Êôq¾{r‘iR}S«§H©oÀ•ÂäÕ¢-§‹ibqh½ÞSŽ•J³5èòR0¦~VÞ“ìéÍ`…2Ûåò© ?ô™`iI¡-¤¯ Jº—doô”‰ÖÁ;¨»õ Û‹¡žÓæwxÿÅbŸ³Ÿ‰P¶ŠFQS#ÄÕÊ?çÊì/—àô@ß}ÏCWE…oˆn’? ^nñãWá͉ÐÒÀn9K&Q@. ˆSLÅ[¦±°8æªrßž „ŸšÐbŠeÈŠœªÇ‡4çuȾô‘àÐŽ,.4t2T§šk·£‚A  ngû@ò¸ ‡@:É°ºÀPëdõík«3¨Ïû­V”E&Œ±@iUV2`åõ–QíM)EQ 0³‰·”¡P‘P×£gÓÖ˜ÚÍ»Yú®°èF`(X¢ÊoÏ‹0ÑÄè$%Vrµ²¦Ær+Ç{…ÇE‰j% ™aÆø&Álv Kr;eÐíäAó¯ÜL oÛðâÄkE0WuŒxæ J€B#bB)%esGèös×·ŸÖ.bõ›½A«•%q¢vzG°_Úì\‹ó½Ó'c9,¨º›k1hq©·œQˆ¯d)(±3MÍ(p€9­^aV‘EEÖ¬üA™O™"§½‡Ô”´– »òÍGuºrñFÄ…Œ& èlöHIíôì¸%ÙÓ|W§f¡±nE‚/³Œþ ÎÚÛ)=®¨ôU—ö—,×µPúo·n¼\67Óöœ/n½©èMÕ+^M‚A÷±.C ©ßyî8Løå IDATAÀ˜ÙÄ¥rÌwìÜX:ÌuÓšÔâª6Ž²UÿÞ·Gû…Þ˜âQw™s‰ß²|‰$òÛùý}g«7Þ/6 l6…y=õP1Àx÷º×úzˆïøkÓê9¬t+m½4Ï4_PÏoÎF>UHÊD÷’ÈßãûzMSn‰Uó“Û°Š½Ðîvçê0})!6‰ît3ÄöÇ[_¾T³Ý}hàãvs$X{:vi_O™Ùg²]åÒŒÀÆ_ yÃ.™‚P\ðD»Eµ7ojÒÈôé“ŸÖ6±OÛinÔ@ÊæŒjù]Rò̈BlÒ©A> ®l¹S`å渌-ô˵^Moª7&¨U¡~# Ÿ^î·}¯‡2kîúãë‚Îql Ó-gü:f¸Óµ’ýq çt–ys¼ûÒzyF P—6ý%Ãò~PØ—ƒ¥&×7ùÍë²½øNu&„RÑ@&[Ô·ÞîS‰ƒTe‡¹=È7M¤ˆÒœA›Ôž¿9ÇÄ2¢ k¼5ÇÂ!Þ}Fó»ä*ÝWùšpVVül’= Ã+‰dÙ÷ˆ“‰CòF38éñSwœ{°Ë‚E Í[yÌcózï/að¸7N*fy$«°«üäTÜðxÃ[þ4Ýmâ¡h|âE@°9ò"X¥m³#nx–È@ÕÍýè†. ™àœtâÈáD?Öìá0Y·NN¡Š‚1¡Ñ¿wK(?™"¸–:ân)zðú ßkº8UåŒ#®€âõ,Ãg¬¬OŒkñòŠýKÁQ0ôÄÍË>—‡ù;óF’õ7•cfqÝ‚­Àß éŸÊ¶FÖ±>âvb_äÓv·;ƒP”¶;ï«­_]ÿø‹^B%èèæKÍön€A¬¯Õó 2/%R BãÓ?#c¢ÅŒ^ÎG:Û®›:˜™¶ÝŸ' úväÈ­‡4^/d|vä|øƒvnçÓr‚N¥»jØ’‡Ì~0"ÀåŒLòÆXÛ¨ÚY”?¼Ñ&Õë©õ¶`qàÅpeåM¯qZˆ¤(ï={!®çsEååL©éþ¸!Šò¥gy0yÐká?ÇÿA "îŽs ÜŸö8¢P‹±¸YŠöçÖš7š!ù¯1ˆøØk–MÑÈ­ñ^ %›Ç¥*™nð/Rµ¨;ÿEçHËM§`|S9¦ŸÅÊW%µ h߇uóÿ©í-×ħÑÿÄ)4%SûÔÍxpj¶Q­¬ùoãŠë¹¶ßöhúhd㸠Fî¯GÏN6øשæ&Ïþ,%þX§]$ïí~ý‡gîÖB4ÿ¢*WHjEÍŸu£Ýþè¢qïK¥Rˆºóª¿÷´ø¸ÔZ„Õ+!­„Š¯‰6|ÊÂ$Õ–÷¹™XÂÿ•ÐJ<£É¥[ù+Êž”ç´¦ ᙊÙê_¬Ž&…öuMŠk %(ž…X9g6CxJ °„/ûÓ6@û:Ï zx?ªAÉ3ÕgïÖtA,YQ"S ÑÞ©‘þ<)Íܽ…TùÏè¿Jêï-¢ŽQkÅ ŠÉ¶|˜äSûÄ?½`DLélu¡Ý¥ê$¹3B2Ã)”LLn˜äNÀíG"ÄŒ—,²Ëª¶=CÚÙ?ô¯œÄrÓàºÇ_Ñ*ÃóŠpîûPtöqÊîy ¾êö3*ÑÎ+K!’n22ªuÅX«Ø! b‡4x>Ôc…C1(uoÜ‹çR†6P…qtØh®ììŠg»e|˜$ÂŽVµ®ƒ}{a’;ÒVA‰Dö”†³Â˜z|GM—|ÈjPÄ×Ý,V´¸ò^Hm –L­—ðÖvðõ¿ÕyåÓ¢ãÊHIO«ÿhtËù|h_ðµâF;%ªl³Û_íõ{û º™£ààuqm5+L­ µ«‰¶[IbSÝïu݈lÏ®W4—EmìO¢ÄÑ«Î2ˆ”0lz}‚_³,@(ÍJk\(£Vñ önú¨€%§æ¦Y€¡o¾4? |é‘®ä µæÑ? >]3iÒ™èíõ#âëGÄ»íH˜”f ’ó¼Ã‰¶”8ìˆgWÑkܶÏÝRµoqÏ÷·(·ëÚ۷×ґcõ‘”ß3ä— n¼ÿ\2Ù˜BÖ¨7eçÔ•ªjMèòYÓIåêçWÐg$Ýyý'U˜Jc¾Š¯ýyår‚Ã'œ3Þ &)ôLQ´-Vdc^É5õkÔ|,ûJ¬Ø)Q÷3A·d ‚êªà+ˆQ¨ñá„geª ÓzC-J§]}°3Õâ‡Î¦¢Æ0ù¦—ìIÿñ9ÃzlìÕžN° –PZ<‰üÖ×%²÷˜“CÍéx׊ÊÜÍí“¢IäzÿŽêÉä©ÿv ïØy®1;F\‰ý5Ë$Ê`býƒVû.<ø*ÁUn¢³¯CNŸý>­†r˜Û¥ßœºi ¤µ÷Êëúƒ™4­Dé¤ãÍ6ÜR¾¾$JaBÁC)B9M(øiÝšŸ¹t#¥:e}ÿ„ï¥Ñú ÄN0´öÌ j@Í=»9Qõ¡ûxL,÷&M°Œcöz‚m …¡í¼è‰ätpǸ)äîÇ?iîê[mOœHî k}u¬qô0MXŸ]Ó&“#ÁmÂüì§aΞ>)¥ø¦O&-¯‚ ¿Ì¿GO&7»mÁŒ»cjû=ø·Ù•”ôl”4"X€{q!Ô qôGgFYÅv³qðj_0v"«Ñµj˜H~îøÅË!!ˆâcIJxKP€’•!òéu¹: c'’[Cý®7LÞÍŒ'I+×g}—¼šLNù]Uœaú|l“Ó#-–49¯¦E–Ž÷~{SÿwÅ ¡ÇýÎ==œÉŽ—.³ëŸÒÚ1¼±-—cqjìÉ+>7\·÷ÿ/ߤNlþxgÞ®Ü'³½.”S’?}ÑíΛĶ‡/IÖäÕ©?²«iú]"n÷°  ·çí‡þœVú£k @G´[—rµZ@t¿OæMöÜwÙf5A¶|e³@¹:æ‡ä« ›íÈj~»Þ®¡o`1Ÿ~L½çw÷O}æ­üŒã)¹s/" ø1r÷÷éuA1ËåúÆÔ¦ŠÎž#J':Yö$(HÊ JÁÒszù?ëµIŠ@Üëý8Ï40ø±;S?¨yc=ÅDa,O‡šFŒ²ŒÙ~Bâú|Ë~à†ʛ帬Íé´%ÿ“äüÅÏ)¾øÝg;ó»¼ä¾Šm3;Ì% Œ3æž¿Úb×-¿MEÇdwW:)AŠwµ<7tGI߃7êmýÕÞ‚ÀZoÚÓòiëuª C7·ÜéÑ2ÀP© E»™PßÓ#ÁÒ”g“Š,ÿðz‹œç<='niXà½gŸRĨN혤•®ÛîwÛž=&Vz§ß²ô'ÇÒåk©Àö·ÞbYWCˆÕus&‡HÍI¢ŒPt–+¾v=Ücæ†sQ­w_m·¾dcQäÿíÔj#¹íR‡U´Çåöî>~­ÉxÍOºoË},-q _9í¼ˆ†Kª¦µ#àn´“Ê¿O¯¾:ÿE·6ÿ0×jpõãìþ`)o¾ª>6š¬ÛBrΑ¡`õì;ÈŽÊÌ€Î}/GÍ òô±©XÙ(%<MÆ+!ÏÏ’=—aÇc~švu­ÉZÊmHÛ+œJ ž§}O¨¿!zò¡t· ¦?5”̳ëÿâ¿/âÝOR%L1$¥ûŽ¥¹G<#krdvóÆZ¿ú å´‘`(Xľ¬Ç=c¥7ÍÔû#Ì{Q˜÷ŠµM{ë½—0 V÷÷osbO'nV¯÷TFð°Ä  l÷¤ œŸó…ÂBón^‹Ã¼ó8›U_à”#_ º\ *ï((››¼©]fó/w¼öQÄù!.©K’ªVYks»R)P¢ù¶P&V)²ÆŒªluqL åE¼‘ÀÒk+_XÁÒT¿k®‘?”¿Jé,px–5ÐÎ|,‘ô6 O)"(P‹"€3Ïf6By•.'‰!E1â¥k—¾}ÐáMŒÒ¬Þúlj5^%uçÖÉø&žXzñùt-2œ·^|iã?Nþ  q9’àz$n0ߧáÒ¦š}‘ór OÃå¾”é G}·£Ù[RëÖÈ¥j+ˆ¦;r ÀRP‹EæcmÒÿȲû€å DÃòA„\±ÚXM)€Cæçæ4@¾hÙ­túøȈl¥ÁÐ@û^HTÔ±“( †œ²DmTʉ„ä×Èõ ‚€¨õÛÙ*˜–¢ † ~Tú‡Ï¹gêGÁuŸÿžì¨M„R‹Rµ UwšÙ]~>ýmþ°i²û·‚ÝîÍßžöžÚääÕ‚w£ÎÜÌe—´¸v*æ‹»@ %€JP †¦¬65³¨tÐFÜÑ|µv¹ñ¼ìÃïì5³EÎôK…‹kiƒVw\Þ¯ÞÝ_¶Zs¡#g©ŸÎÙç AöZ„£qaT®1Dâj~9IÑ¿R¥Wr™ ÇxÄzhîðL­kiBš²Ê¥A¦’ßƪÎ\™Ø(’dš?zìælC經€«Í±ß¼ötsÝr±Ï‡/ïÔ¼4²{—ñn'ú5úvšsâÚgCËh•´_š+¾ì7µ¿Óé‘M¿IæÖT®%(x¦$úsϨ=±Þ Ôâ›8iD—m»®| 0Æ_ƶ½4ÌådPƒeI£í&;d „Z>\æ½#ÀyÏå _DîUV›ô×S÷OK¶=í±H/Ä$“Ìhºµ¯un˜Mòž o€æ‡‡øLl°m‚÷¬ø›ž>¡ÕÅ’ü¸¾!ã<¶Ok5v–sÌ‚¸~—㾘Î÷÷çüx÷›3J<³à…˜„»Ã=$(Z×Ý?Ê#¢£yŠ…ÉýA[û×½ Þ¡Í• ãã<'xìúʯw;‰Ó¯/Ýjo„U´vœ~Lip=hd_çS}ýòxDÝîù€ÃÕ|ŒòYäçx`áÇ'ãÍÝ=V7’:œ,Ä€¯º»ø9¸­PñeÜÌìÉ=æ8ži?´½QUç£ìZ ˜Ý*ñËþÎß×Ϭ†ïuiÆ”Ñ÷[é7ŒP¬‹\Ò½W¨û>×›†›ìò¹ I|øu¬ïÿßæß KAhqf—ëcÃHƒ<Þ!ƒ½$'·KÁIXÙ½ÿÇŽçûxÍùÉëÑ¢ks+Ì;¡‡Î¯3oÐçÓÆ;û4øu¶ËU5Döv{º}öáÄŸ­$öÅ÷¸‘'Eªg¨ºM{8°‘ÝK‘¨Ï?]}ŽÜ›äqlëųž9h¾ÜuÉÊn÷h§¤ÀÝ™‡òÄf <—YD:mOVX‚〆kLYûµªG ©&-ìÚ3=ûþX‰¶†ÈûëO&žžj¬qT¯;Í÷ú În›‡8ÄvÛVü{zéy=¾vp¿:frý{®ž Œqp=©ÿÅ|-Ö8hÿƒXé¥6Âëœ~û_:‚²]vH6>×ÜäÁ½—ŸÞ)”K7\¼ß22´…ý±öæ¥Ýv~bJ‚·©?Opîê|Èsj¶Y¹/Û´l Ý”Ír?pæÒíyB^”ÈÁXŽÜÀÿ‘# ô\Ó€~dº2¾à‹ý÷%5-s>6n²Ž5>N@ ÔRWieçÙ™ÄÁéJ=zíÌo¯³Çº%&§MsÚz±NÃÜœ¼Ýç–?¡·n~G`±?©±6À¯èôͽ»b¦ƒ¨lVÔÃ1+ B÷]>ÛûêÈn V·7åü7Ò£TÓåãéõµc¡Úäð'ûƒ-$ŽØ›äË0EyŽò²ß3%à«îÆ Oõ¼é§ΊægzDÝ(6ªÕá¼Ýò߀™¢P“ããÉöùÛ_›@$½}»™>:¡ø+” `F›®é›zÞîýÿËüßì*®Ù"jŽÐ*g1µQ[þ{DÒ½¡äYÄö—¦`†»zæ/†§3[ötè§RE›ÖG{ƒ©dþ›­Píe$N_þ¨P Œ®-ÿEÖŠ¼8Õ ÔÊšÿ„uCªü–¨F×–ÿ*õùÞ²<žf­¬yo¥z(e ˆäuèg‘ѦÿÓ½¢ù "C•þD )í»²w¨&÷vuß s j@ƺߋz€ìwÖ\ºuÍÓõñ h³¾ Lµü0qáTŸ*1˜þDÐÿå!І%¨MEV“¸lÝ Áß±"–yD~tH›ŠOv»(œ]èœÀÂ|¹:Ô]_ì‡ti“ÝiÌ7äµÎm›b"„I3FÛfŒ¶}5¬7 e!„q>B¹ú09"„qÏ‚>­–`MÅ£±·ºÿzPäŒç:™ÁöaìXü©ð«”Ôsü•†³B8—?N&„³ªPC/ÉŸ‘Y"ŽàFÖyýVìßð‘ïaÐRCŠøº›ùÊJˆpJ[tpì®é«É¹Ñ­Lþ—ï+Mz1r\mZçšÅ ÉJ Øçrè; <ý'ó4!¤uÄ…˜Ï“êÔ4²@öx“õ¹6›³šœXE#› Y6›³êì8!PP"È“Ïq¹U²Ð`uAQ»¿€¡5_I# L=U)è0»•è‹™ÝªøÞ_Û]Ȭ¡&ëy²VÙêj×GãlLRN§4¹F‚5 Š€RºçL×(hMÞ­ßôá™ä‘¦ÒÀôiL#e‰ ã ð5™©x¹> =?™<긧R”ƒÏšÎ¹÷óÆcªm›ôáÓ#ÜšìB SšD¤N ‰CÚ¥…˲‚‡C ˆä£&ÁªÉäùW:Ñ|Š¥~ÒLÒ룡êÑ= }š*/ irsD]Ÿº-$Ts#øa×ÝíV°©ÄM,÷&N°¼4Æôõ[Žx·ò1‡/§Ù¥Ïë3PŠ[ƒ‚=Yòu_îtPÈã¡=—öi“5Ñ®»”To,X/§“ý "!Ò¸â)F"%¿×æ|p OÚ$fçeP@zïòxIìÈ–‘!f±#>2Ÿ<…|ÒÓ)>̲…±¢Z¦êäÛ*e29>°uúæl›3ž¬P'm‚͹QV[º„–~â$WPX;}ùl91 CÒr-`D›9üØkÔ[Òeâ¥Pr¸û|È"ºÏdä'Ö÷#©5pªqÕŠÆi_ïìVö D]rp”CÁÓ #ùêI'Â0/÷ìYöÑÕ*†OyKeÒÒЛ%_ö­“»3ÛÂÐqU§ìŸ(ãþ²Êõ†;Ç9ÄߌœÛˆ1|°¹åzO0Ù…aÖíï])6Ô´"¼²£® £Á´Mà2@ Gl<÷hNœ(÷—i3©ïã{íÏ4üƒÆªah½°¸ÿÇþÐlXOÏ5M®³íZ‰€ðN¾ê—¿û@;ßÆw‡N涮Žš…Öës³^|ˆîy3£×59†ô”/étÞûìÎTŸÝ‹/î=S"ťϦ¹.d_ ƒ>¼‰½Líq ¶¶h4Ã}×ÂêtCi¹AÌk+$a¨u¼ëZBùðz™à1³w猧»;\é ogǽ·4;9’H×´ÝnÇÚ‚©Î̵`ü»üqû¹`câÃ=ïÒ×1cÍÛ¯=¤úué+ ‘¤ÝéõÛÐ-ª% äv¨Q› £¼Te¸cï~z¦ÜþEƒ§¡hö”[½ï(COm®t¼VÜè䆲ÁˆR‰.Ó.ӣ݈%·g}ÖjÜ '£÷ä—Í¥Ôluô$Ýzgš½ù¶ÊXF1-ÖoçáÇLñ\¶9æˆ!»þ}Øê ú9Y'îèz¿#¸X\†Ú¨MÃ%$ l°yÖ•b—2+HÎ@ÉË5ˆÁz.ãã{jÛÐg{Á±‚ŒfFxl~nš÷Y€5Rz7²ÛW'¥¡XìË,-É™AÖÎÐŒ©Ý¢hß“žfR ®Wtâà§`Šë¾G‹ rfu1%P¶}Ž¼Æ†xQòáñ—ÎR€<{Ys‹é€%< °Z¦~”Ž$.é3y‹¹ÀÂwjN7U¸ÜißóqkY 잎E/³“Ç{/ˆ‘ªµ©ûr`$]ò¢)˜V¾h¼øÞߺõh`Ë‚J#m£<›¨fGŸ‡yÏ`jtM.J½ÜWx“ÁuµH8šIähù]’Ž×n¦´ìATɉn>Ä;w|~û§Ö—BwnØ€”§Ñ¦ÔðpRàá¤~‡“úNì{¿Øâ­ÃIAoÞXnÓøs[’÷iƒ¬ù¿Ÿ+‚k:Xx¬6£ aJ¨(SŠ2¥ S ²ß¯­:£“$LÌk4t8£ñ­$$ýA–S²‚ÆjœÍ¤Hª •‚L)pwSÂæ> ’³ ¡ì|•@ ¥²-%©bF;=…&=y^YFÑ„"›ÓJfÃ|&²3¬_eDøË*uY¼ !ïr{§ eÂZ¯ž~7ÌÈr_b8ÙÛn'Dµ §4V 2• Í)è1ëêgšßR¦ú•O!‘?IñI~þåÔ³ûBNìÑlÔ-%|¾6“7TjCMX¦H¤2¥ S 2• ‰¸½øDN]à]“Ž×Z7eçR€ÚšIµ·›JE·ÿ1Ѷé“!ý¥[Ð%Ì=m¾'K=ü,é³XŠ6o–N"Æ{Óùám"¶Ïh«Ço O}ñª¸ a±þá$H5Hô´”½",ÖEÏŠöÿ²Éõ!O€¡ð¢KÁ+CÄ­Ôáó A‰¡4‹WYË-Š%òLð€„é Ú-ùöÚ/ ÊG.ì§ûJƒ[ÜRt­ÈâT!Ú¸D#× †Ö» Z+D­3g‘¯¬½¡T.$DŠŠaëHL¯€ÀÐô¬ZðªÞåå„)Õ(= —#Ra³¼Í¥WG^Mùí¥ó¯Âzº\QÞ+EaaÏ-/ìA HL+† ­¦Xš\á”nK_€Fk4ÇŠ ÿa™ p±|¨YÅ o9Ãï~¥Ñ®N'ǵùA(˜F°ìÚìÿF¸îìºcÏ(³ Ío¿µeyÅ-Ìdñ#\Îöt_q­Ç…€nÎǮܙçY_zì\oå¢Ö+ÕD$€²¤éÂ×f÷‚&õt:Û¯ñ±Ã}ŒKª•¬JE™ìl/×}RkêT#n¤Sx~ÛvæÓ½ÔÞçs 9g Fˆ~@îM°U¨T vÇ÷Ñ¿„Œ®2=ÊdT©ÂmobO}‘u%18NiÐ×Ï~YŸ¾2É@vQó#i-¨T ö$ôt>ÞKóçtÐVÂ)êÔ5N©d‘æ¼;Õ ‚3ùÿcï¼Ã£ªÖ·}¯=3éBHhz¯¡H ½“€ô €zÔ£õ{oE¥÷Þ{é =ÒûÔõý13ÉÄóCÅÏ}_¹”LöÞkÍÎì'ïz×zÖ«¥ ÙŽ¸PPµÃÚ5uª~¯µ¸NZž15ÑohºzéÊÿTpIïXA •3öóXº«Àõ|X¥•´ez/Ín´ñçl)rÅ¡Íu÷N~ªúüÑA'ƬH{#® Â5b‰ùýä‚á!Ë/­ Ù= Á¶„AñιþØ–·“³^©q-þÖ?\onXeѨJÑSW佘ˆ)Ú4ý:/áµÄ¿a)qÁ…;O¦Ûá™=¶&… 5ƒ—¯¹ãµ½©G&¦®Ï})´êJ_„açÙÙ'uGÆÔÜ´|ïžÈ+þ¥„´Áí—üâSùÛÔ[?mkìÚ¸~(`lWfñ¡2å6©7«b~Dµ%‹MZs壚+–†T\²eÉÎkÃO·6]œn.eé…ú¼Ak„Öú¾ƒ¯l³raÿï6­¾,ÀVgåæÊ•æöò7Û¸Ì]h €Ð~´&iÊåàžµìZ6·î,y"Çc½å×:Ø‹Žû­Œëk-:þYlçþÕw¨Ý(Ù3%³s"½šÎ5]6(r.ÝcÑÁ&YOíþ/k•˜Ìñ‘ºçWånÉtýÿþäÞ-énªqþWÂlaÔ87”‚YÝ銯ÆJþª¨U’}þ¯YÄ¿: ªí¦/®5¦k×xÿrµûÎ žÃ®LøâRŽG¯œÿlHùûl¾÷‡D7ªÕû1ò÷¹ÿ'G¸Ä$ŠfýH±”¿Êã諱¤i2¥Ä¿möêà¶T­yÌÑjõ~|¨·ñÓ<ÚâߊßõÖ t¿å`ű3ªÖübØEië öW¬?úßóë¿fÿ•€Ešhm=)v®°Í?hÅ–¿ý•?Yn W&j^óq˜Õ3™ŽOÔ¼è_€ûzËÄz:ãÿÚ”IÜÝÅí!Å›‘;ùm¨v @w2nŒb™èÒ\cÿ“¢¹s`´b™èž4N£[ÃKM] êº+•'JnJ’Y<qtÁ"‹yg­¾ÞB“t1gíÉ Î›ý×Ñlm¯îŒ0ÿœþú-Læ´±}º/Ê+¾K:ÕS5ýM1#?p–Ÿr®Õ±b»:ÄöÑ•¿Øx9Îa /ÿWG¸õtši®4G6ª´ãO˜ÕHXEåÉ–›",Êý}oEÔ1N×û¾‹¸)ºxgYã—9ƒÅõ¯à¶CN©ñï°Š+»F%’†Äb\Ð{Doí; HˆåÃÅ—µã,bhgÏëÝö#…¢¹YK ¼npB+¾u9×Í¡]ã¤ÐmŽ~híï¦#?Ui8ÂÕQ:t²ï‚‚MiŽs–W:MÛà{# ä騯•*¯ÖT?¨¨üeäF¹PæÜåŠKbu³ª|ÝÉɘ${þÌlÁ‚@já*Q×ïÙ~Ù½@ïEZeÔ Ð°ï¦5 &,’ÂÚ2ÖzÞ€OÀ[‰ßHŠþ¾ý¨Dz-ÑY¶¥¡†™8Ǿ Q`7¶Þºys<ÓË6°2VMFo]½ª¢¢òWÞ½VÄ°†û–âq–@ÀŒÛÎ(\E¢˜AjKmÐ2õ©%ïy¦”Ÿšµ]´0×…_3ü!¤2Íöö„³4êXJEåÏ£„Ñ…ª8™_pÌÖ™C·lk°€È0QNgzÈ•õ¶#íúó "9þK“ù¶·R6Ó QÒºéuê8ƒ@Š$ Þ†‡ïÈ)5gõ4r5Zµ î–…{õ7®¢òäD7R7;•‘Íî·èôE}ÊíNµ Ó–NXÓºm´lÍp¤Å„”˜©àý+ÝÖ]&¡Óä#%êf€ps=¤žÎ*uºûìK}š¬·f­ƒë¾LÆ˹0ƒ™Ræ›´_žjÙ¯ÕÏÖoÜB>t7 =[ þÆUTž èFùjÝ™©cê–8ïV-w÷¨ošÿøí¾ƒ—m1‡îã¾ýÞ;ñB…ò³ÍÁ³³u6å¹|Øpvâ¹nk¿ßF_šàÔ„c5VoLx ­Åǵ>›{÷Ÿµ+Σq/Ô­ýâÅèm¶-½´W†Ð[’tV}u-iÞ}}ÈŠ“«g„·yçÞωʭ9­.†-xSBßvϼnšØæh4wﲘs½¡mµÕf£1*aXì¹í7B}h¦ÎÕÌê°èÅ ×Íêòs•'(ºS£ª?Èy).]*o©¦-_kž|ñb[Ââ¿óê‹­6|> ö´ö.5*ü|ÕŒ@Èç–¦®1Ä|Ñòƒ»—fO8=ælŽÿñ½Œ¶kkV]œ)ú‘§Æõ^é­1ÏÚ{ø_7Ü> }«böȇ&oMujçÝ`ôÙv Œ¼bTÈ‘u×5®ºxHÈòÊ 9­Ýæ\uö>ÜÑÛÐxŽ~{¾ÈΊË÷P’†…,Ù±ûú ¿Ê‹¯¬§é<#=As¥gùk=—ä}{»šº{£ŠÊŸÈ£WÑTQy(ODM•¿Vt£¢¢¢¢ÊŠŠŠ*7****¿Ž¶ÄAøû9 ‡ràâqÎíH[õÍÿÃeí§c¿Tá~pRÛïöþ&$%ÌS‰.^ìtÇË–ÖÅsÒÅz¼7PEå¯ÝH`Bçú¦ Šœ¨È‰Šœ ìjµ³Àe«œìaz¬íK¶ñIìºõ¾@FÝbC—#A¹µ/B‘5…fa^4Ô]NÔܣȉ¾M\÷ÉGͪoȉJòð`9Q³º^tñJÞ_?SFNpN­È1j ›àº;uœ"'zUµÝ<¡x¯—•ëý»RÁ2& D).'ñBçr¢’á+'º¼©ÓUT¹±=„-BëüT#«úü\1SŠ™R;çZ@݈yMöØ~nõyá°Xk'[l¶ Ø^t,¡]x–õ`«5\‘«dVÙÖ ¯‰Íen¡¨è²Á^ ÚzñÂ:ÐÞ 9ñßÄö˜Ø>ºÒW/98Â…—ÿ«án=œgZ*Ζ͢ê+æ—hâNuÿªýé¿äºfvB߶M*èÌŽ÷¡eÃÉ“´=ÄLC…9²å¡ÞCª_Ì£¦Ô_´Ï‚]wͼÓ*|ó™]Õ×ìj½ìvŸ+æa«Š-švŸ?­Fn…™²Â‚Œ€ÍŸLëÚ£Þ¨¨r(9_|qÅÅD½›u‰¯ÙT½õâäÉ1í¤Ë¤îÕ’FÖ5N‰CÆXá·#ÅûaϹõ/›#¼Öß›(RG6=?Æ7/¢YE‹@É‘SÄaÕVwxwŠ6¶íªõêÏé:*åyñEÍËXÄ€öeâºoE{GNå¬C³¸8^ ñO¥ìGr\¿…}kÏê:Ø2Y̯¿#udÛY=º™'”¯¤± %cû²Yû“+XáÓ|ƒŠ—;ýwÿ/ßEžŠúJ©òJ‘#\ŠJþ;Ýsþ¢!-æJ[ Ú—ýîÉ„…Á3æÇ~„Œœ¸ðӇ׬˂<]~Š½]àêxÏ\´yyFëxên¾›³.ÛQ¶†þ÷öù×oKPäÝÃnºïä®~ðTÔÜD«»ã$Åâ,W ó ‚l}9ûð$6àrr…]åp¾*ÇÖöcN Â`ÒöÉxG·¥?’ÙÃúŽÞØ÷è3À¸neNôû¬ÂÆ)@Ð…Ã9ÑLF ~syþÚt—ViΛC¦ý3ö‡BG¸cgL$³3.ëí”ÛsY˜Úo_ó‰bv ÷ÂÅ÷Óû&úQö“Jo_4€¦GøÓÞÌ(t„W³:Â/ÛW…ø»^Ï0ÚkÚ Oä*}3¸P³„øY´™f…î29%jsC.>/@hô(ö7_:[÷þ-Íù늦óÆ8fgÚzçÄÄûÙºa)#iëŪõ³§ò·nzÀt²³JŸÄ—C–² ý L__E#w;•eãågЂ†½ÿéëµÆ/üt§B’Û\Ïd¹ TP¦ŒKæ#$1ÚìÏ…ì¼Ú©yÍÑ€Q¹T÷N"Bç-8Õ·äéµ_s„+Bo’.…ºeÆIã—FW¯¶¾×ì„23äs‰iQƒÿUZoýÝodçTË-“\P>ÇàÑÂÃâ˜Ñ s®YkoH“gA§Qs7*ªÜLæ„l¥“[øI“5Öq*ÑSmvùkfMfO'%Ùúï«5S p2É‹>ÒÅh•ê–Öù,ÉëqsïÖ+¹Ü¢ÔœÓÓÈ¥p¯Ó»e!Å¡÷™úŠ^š¤Â~4õg³J‰£K1p,q:аóÂ|<–•ÜC“ù‡‘‹÷Ç|3izÔ×Mvö7 “cÖùr¾[ çl{C9µ4\ÌQs7*ªÜ ¥Ù÷dݦ>“¬›”Ä7}|´]ù+›²j´zåîZ3Äþe6eCuÒWjAº³t/iþ®t±¶Kè¬ÒÊÅi¿8Õ¢_ë’á&\K{ÊÉ늗UÍ¢¿“ñ»d?[6Ú NߪÕÀ»u“S¯ýzY½”®ç—Ñ’£wBH&CY)âl­˜A0ç|çz VÛ2˾ûëQuA†úÁSQs7„ølíí^áååèsïF¸mdXã[šûŒË–_½Ø''ÇîîØ%j×wz—˜Eí·¼¶mæÜâ¹Ãdþ±ñª×âƒ4™ ~m÷,„OÍ ®|–nM1‰»«ï6[r½ MµµFƒñTâØs;n†úNoª;œ«™ÓqÑK®›4“~Îg]üöv«—=3"†<Ù¯Yí©÷þq´À èÖjø‡º^¡¿D|vâ›Fôü*“ã¦Û3;Ìš¾5p:?¨RŒ+ã3ÕW¥JeËÕ?Æ4ŸÑ³Ýõoçj’ßéøê¾è_òÙî­ÃïM:ºy^Ü·+òÅÁîÁß%Öz±Õ³+£Ve©µŠTT¹±S¶ý  ÊüáBo¹bô©>#ý_­ÿÕ'P×kIîîlë\›HÊÉ4)(réîëwë}²ülüUÎ ¶VGÌ/¨˜`ôB sz¸Ì¿ðu«wP>bUæ¦TO@ã5«7U+ÿÇ)î¨&#•u OÞ/&ñQ/?©M#,ãüëX%ÌÂëOW“‘bE­#…£xì0GŠ„­`ëW[)^ÀØBd»¶2RÜé+#_U­Þ**¿Mn¤hZ÷çš™Á rÅL)fHÝÜ+ëw„Js„Ëßì·>ÿûO «¸Xx+äð7ºbbÝ耟¶\ºRø Káê÷ÆÏ®3e…Ù²ñ‰æ‡:~[Üê}óLϻγ”['fÝ kÝ¢ªcÙ,)šÔýç«®O‰¦ sdÓ_ú ¾ˆ”½z:×»¹xFz@Ñ1óÏÐ!ûÏm Zµ§Í²¤—4Q=–9î[ƒëÒuîVþI.H÷ßðÍÝzbR£•G—%çPãØ—V^L(pC€‚ÉÜzÑÝ)vGxd÷ê·GÕ1NñƒÇ:Âß kbzέ¿_6žîNi£_ë“Ѽ‚ÝþzXõÕÝ&$OÑ\h»jÝ€s»F¤>/>¯y)ÑÜ9ò¬¯yt½3£Ê挮ZY±j–¹“ꮤ*èäðEù«Rüºhy¹Óç‡~_(2úÔg–JoÖÕ©I@Ù½Þùµö„Ä\as¾Ë?üo9Z½‡L[û¥Õê}&væ;Wj»÷Þu¾¹øÍpÑææ}Q$‚ÛyîÎNYŽ»dõnùݽ‹/ß4ƒ"ï% Œw=2Lµz«¨<ªÜH´Ú;NR,Êt-²ôþ9-€ˆ­pùXàâXÝœ+Aeø!ƒIÛ7ã?Ú™yko{Í~ºß±è e©;/ãÅ;×NôûÜT»phàžŸý}_§þàù{OŒÙ·¨×‘qãB¦a[·©’òŽfÁùÆ‹SÃb½ú~%¤ ì—Õ³^=«!òM.Å)Âü´/Ç3¼m3U½±šCñï2.W³M…VoNäj»ø¦;Ž€júË~•5®JÚó"kdË`@ˆ½Ïƒ÷æ«ÃÛš5j=»å'ÿiýìÁæ7NtìH+¯Ì 9~¶†,>ç,tðV?Q**Ýüª#üã_s„o¸ÜÛêßûš¯×jëó9Óæoäà/[Æ%Kþsuãïd)“LŸÜ`zCCKQî;wÁæó–ŸéSÚê['G«7NFзz›eÑ~4YœG#…É]àïRÅkvb™™r\|ö™!¯––rñuMÊÈ©ž˜ï®/—­÷m^|+C0çZt¶xGhr,è‹ú‘RQy4¹±;ÂC“#Üù×ᦲaZŤUL:Ký©‡Þ0H^­pqÁí¦¥X½•³4tµwD$—ƒ»ÝÊ1TrWŠFOM<,1ÙŽQ‡6Ù@Tâ³V«÷®óï»{,)ùÞ˜-ßõ|vã/1ïü]Ô—õ· š;°pèÒÕ`ç,{C¹uµÄæ¨ TT5º‘Òìûæ=Ýæ>Ï9:¿îãs íŠGq„Ÿ5Pׯо9ÛÔòצ†=7eàdè:-æÅiç^švvÂü ÏäÕ†nUg¸—2¯¬ùòTë~¡³­}q©ö¹—©ßÉ|°Ø411ã)G¼¯ÍêÍç¼ï“6#8¢ëÕ)¿ÙjõvóÜg¢«·Ì/çDv‹Ýê]Îbµz›mVï…:Õª»ÎfAõ:Úˆ ³ÓÕO”ŠJ©”àÿdÍížáååèsÿ9žddx“Z[úòhŽð1»:v=¹kºÞ%fqûmŸ¬û5G¸Â{g¾Ý¿þsÙk.êߦ_Ó¤u¡IsäµRlVï{ýªí¶Xò| 4h}ŽÁ}cÐås;®†zþÐÌuŽóÏ~~cóE“†z!/©žÙhëg–¼Æƒ/–K9$üÄ †5_ЧM>ã‰%cÛ°&Ÿm»¼7G÷Ý©i_„wý:Õå°ñÞÌŽ?ü¸=!»­öUD-§oÿÝý7R3ZH©ò}t«ù½ZÇì{/GI}»ãÔÃÑ{¤#º¶›þY×Ómò¾X˜+Ž…½ùe|½çCGmŒ^˜¡Z½UTYn¬”m7ÏÔ­î7£ªî©g*»òPTW›#¼üþħíŽpÝÆø¾ÙR ØžØç¶Ý¾;zNPòÊw|ãjé»XÌ•¹.¾_¡#|]R/«ƒ/?·Þú¤IÉ•ùM>kñm/÷ìíÇN…Ç5ÖfÕèÓìVï¤Ñuæ “ÓÁ¸~A³G ¡ÜtÙèQsfæm^TQ¼,k{†'£±LB®Š\µ÷r§zŸ<_cñù›ßTˆŽF‚r#»j¾u—ÛÅuÞ¥oÚ¼5L”¿:}mŠ7‚A5UP,9÷:ä¸]óhìõ²Òª,9täüï߬û«ô^¸'zVBC¹ù•nÛ­Þ£YF·|uXõ- žœßDµz«¨<Õ®ò˜Pá*¿1w£¢¢¢¢ÊŠŠŠ*7****Bi5‹ó¯ó£ú¡Þâ~§u±¶(ݱíðz‰Í=èY—ö.TTTþ„èF¢¸nϧ•cO ®%#…Œ ©¥¥­¸i×.DF:Ÿè2×Á$Y²ŠxTï"G¾i;Ì(–ƒ=Ó#ÅÝð Äðʉá•ã‡7R„ü«5EŠ´‘•Ì‘B†÷ÓzÐ¥ðòZ-#ÅΠìûëy[hWo´Œ×zOÂR(I÷²Æ9Éq2RÈ¡-ªÖ¨¨—+â,±Û"´¶ò»V—8Z™su·¸NÖÅy{‡¸¶š“¶‚À²óÒ{a1\ë:¯ÏŠ´-龘Y7R|]ÿÊÔ‹5%åü°áŸ¥ÐôN7¹ RÞGÆÿT¨Mæ‡øŸ:z¦ãùFH¾ï2´¶{~t¾«ú+WQyb¢pQ(ãb²m!äëã­Zãî³>k¢69¢ñµ±îÉÃZb¦iËa£½ Ú4 ßÒe1§OqR™“ÃåóNVNGŠfM«çõùÞ2Y\h¿Ï#øi9æmÌ)j×^pùJ/œoƒOš¹°$“D€¢+7'gk†/Bb&Óh@bÛ5¹u0¦¤0+ñÒÕ·¾ip4rjÓÞòÑ:ß#™¼kytžª5**OÖ`J×{åâömëÞÑx]§{û_Ç P$’zÞW><¸ÃÉ™ày¹k]N¬¨’w*jÙâ,ççg÷Ü? #™c|Nk¾üZí]¯ÿ³Õ0,è žºÀ]gȺû;‹Æš·‰¬²yUâpÅ%’¢F•—“EÆèj_Ö8‡! LîRs|áÓ½¢FUsMøéåØê Êù/\^½z«ã-KLnMžÒqB‰N›ŒäëA•¯ ‘SÅÕÞÿÒ©[_©¨~ïW°üûȌỗÎÊá¾Yž Õ_¹Þ÷_Ï}ðìÞ%“ÎŒ-¼°ÔW¾>¨Üwµ3ž;eÀ˜×ðݨ—Ïäz£‘×ïZi⃠™`ÝÖ¯ÊòË£_ß½ëƒ[ü:½Ë~Þ郫Î[{v'7ªVšQ)ñaÚ!0›üÚY÷üЂp_’2¼ÜeUnTTž¹‘BÑ&íZ HtìK®Ë=ÈU!ëã½Ó¢ÒkÜÊ-û¬ïýSU#kï¾pæÃ¥7[ÄgUöwÂâ aÅmx£5k.õ@CE¿íï7œoŸÒ’­´ÎrA\HšäYI+iÑyjÓS{νTÏûJMïËåZ·k <³Ànò.yxU>MÃœ…u»Òf®éÑy¾ê<¸ŠÊŸˆö¾‘”Å\þˆ)#elÓ—¿¯wñóˆ™ÞfúÜ_v£ñÙ•ÁèfÓÏ^ \÷Ýq¾‘!óê^z§ðÔõ7j|Úôç. ÕË/”gBûr×RlÐÌèÀc cº!¸•çýB›°Z.ÙËRÊ·y¿r^«Ó\ îÎ åÌ3á/œèäqhzÝC/m\•äeÝîK2ªâç—ß=ÁîîÖþùMçÏçkkûï¬çžÛ¸lœ›‹x¦újaª°ñFëæ{‡]6dÜ®/5>+ùR/¾*7**OÎ`J€òæ¦KMvOiPqÅ„Ús:øät^œ;ö|gtrÂêÄ#šýoÕ_¶æØ¡W÷Ø’{º›»þ­^Gó<€‹Ñ+ûFµy¹ÙGÕõƒ;­Þ5áìSS,MËê´åNUë¥My¡{nÕBIKË ß’âßÊçç»±NgÆ×^ K*æ1B>»<±ðQgnd[k!p‚j߉ž ¹Á±îxFf ££†SãxÕëþöM&òä~™@Ò¯9k2´wF²­“Ø˕ }‰”J®-üª+·#8†¿´X‘C‰y@Jz4bYSÐrw:ØÔŸÛCWÎ~e#SÛ‘Á—µhR‹ƒíAòz?6D]š¬¢òøä"ºsó y9Ëap%¬›HtnÀ™¶ôÛÄèÓÄŽ§’WÌÃùd?]wòu¦TÇ&˜Dè~ÊÄ0 $FªNÅ®b‰´^ xq;è±”³ïoÝ`èí_fE¡o2.Sw%—ˆin‹zòF²ú8¶0¤#3œ›H{„®åùKÜ€œIêÅ{» ÛËœÎ`‰›3.þ$ôãùm4ÜÄ·ýiæ^ëÊ>4]ËN ‡B p¸pƒj%)•Ç;˜šQ‘Ž»AÃäKœlÆôLnÁŒ]\Ɇ,m@jÛ•§Øy Í¼ôÔoHËTBOŽ›'IoIWç- aÞ-Œ‚ï÷0}uu\(¸›Gî]ˆèI„÷ËO0, i!!ƒíŸä…&ˆ“ôlå2óo‚Bÿui ¤~> N‚ŽÄë\ìÊxo®6'ë"›’Aar4½:å`Âf ¹•Oˆ;Q™ ©Éû«¹™ËͳÌmJw6ž`£Ps=**Kn$^qôo@oI€:z°/‡¦NìH³å>ÎÞó#êŒí•é ÷†2_(ºú _ΙöêvFR ’3ìÕîÊyñEL}>“,ÙJø5‡§Z±Ö·#?ÇþlaY§2D_²šCª¤…¹ö\à˜žž¾Dûc»`bz !]¬½3‰“…j‚¸[ëûâéîòXPEEå“ÁÒîl9CŠÞö¼ïÌ`J-ö$]!$˜@˹<ú{f\@!Ù@v"^ë켜 ôgÛ^€(xbÝ4ˆÑÌÙT,`6Ûû¤]ñ ÂRrïcóêfŸá2ä˜p×¥Wª:qË@‚ž0'Ûažn|‘d‚§Æöï²Þ W?***7w#Ñ9ÑSGø ¾9Ç×çøú2°: [®3¼9$OfŠ'³OѤ5Z3è™7ŒíÍØyÏ ZyƒÖõÁ¶ƒž Á0R«ÎNémϼ‡$#›¯cøo ßÅ †â_¥°4šJ)/@Ï?»s=ŒØ»àEw› vPø4™—¨Ý ' èy­ž}ÿÓ‡I¯`0€ßV´½XÞ›š.jªXEå1E7½ÚB–¢à"û*1a¼»ûéÞùfØxéÙÅwU1>®Ý¡íi°Ðv?›"0ðwcîIò>@ † %È… 1* gi1“ùa'“ãŠ:àª#¼áÅ{ü=Z îöÎ tÈKä Ü‰Ä ¹—N»U`¡ÎöŽÀOyw¾9À9=\`^ ôÏ“eä«SP è4¸iî]wZZ¦ º7H+ 2Š·|Þȳ±xV?6**ÿ X4õ €®øQzЀL`Nv=²Ø£'ûS+ÁûaX“¤Fˆ¥`¶_\Øò8˜AW|YMAIÝtXlĺ½±³½F×)ì€c[f0‚ÀŒv½Õƒ³ý0½í7g °@aR_FߥÕ)‡û RÒTµhªüÆÜsIG9;®}`4æröÇ& öOaѹ÷©˜îWxàj%öTã PÊ}¾¯žâboýÁí6µ-oxÓrîžüX™§¶•~sTTTþG¹ù0‰Ïù‹e´>ÛÉÕf¬ë z–sHÍר¨üäFp/žjñµå*ZVG³:Zý„¨¨üéró¿ùÅn–Œ‰~ç\C©­¨fq•ßeØð¿¡AN¤¢òÛf…µ‘£J™‡–8ypoùÏàT Qútµ|Sц¶áL§’.ef]þ¬Nx«¨DÙm=LòïatÔ=-¢TŸ¹"PÔÐFEå3K{s{8ý<™Û‹gÒ‚»áÜ çf8 ÃÙ×Nö§¼É±ÁÔqeI’Ãy#èÀ’z587‚ƒ]¦¡,Ԯ̱A\Ä`?°0´'ϹѸ7äÄĈ¦Ä…s±?Ïø€…=xË›UÃXXÙvØÜ0’™ÕL÷·«¸²¥·ÂYÝÆV²#ϵ&1‚oë‘g)êÌ›íH gu›¢ÎëLmÇíæ4.uM³ŠŠÊÿUnNŽÃç­6Òð)FVÀY°1š–ëi»žÐ-Tñdည¶è ‚+çðÞ.ê®eôÓ¼^©Ø3ïåGL'FnfäIÎt HšÓš‘Û躇oðAë÷°ÁÈæÔÝem$ïôàóòtXG¯ƒlBw'Öì#&­gj@úD~9Kè:2*rýébã/ÃH>ý…ÖëYbÁ8L¼ÕùÒf-Kõ¬©g ¸6¡[7²ÅËP„É¿»pó"­6Ú’YÁêçDEå±ËD§£™ŽþgHÈáý Ü ÈדCB&ßôdÓQfgÜ•wör)—”\¦_dpbáÀ„Î\8Æ™ â2L¼ß”©»¹œÎõ;tßÍÄk!¯€;E#¯/öQi#‰9ÜJá¿yŒ©D¤ä“afpÚK̉ãF¯n¢ZÕväÒjЀ1ŸÄtVÆe=HóÎQnærä2_d¸¸ÑSKç\Íbö:D«¬<ÉÚ{$¤ñe,M‚Ô<ŽŠÊcàþ™)­“Í€iÕ¢”¼¢qÍ„.´K#ðÔ' bì IoP½L±‡³‹'ïÚ;{ B@¡ŠÂôþL³¶¨ %?Ï­j²½ GoW@3g.o·‡®jH ÐÚëù¶¶ô<µ£ð6°3‰±»¸£$¸i÷yÇÞå7',¤°õËm›“3.×öŠÁˆP—«¨ürc1;di-8ÙÓ-ÍêòSÜç–‹_ ~eÙ˜ÛÏ"f îZ0€Ä×r1˜²ÂÒæk· Åþ¯¢¢òxS£í]Àˆ_U8¸•áH.!0–”ý¼!Á@ŸÊü’ ‚Úå©ï °è"][ƒ ô̶°ã./5·E4]šòAÝ’;§»`&(˜gux8ƒDB9À´ã4h‹¯´~¬,8;Ñ5,xû°³;RÒùæèðÕ“I«ÏÛ™*ääaÖòœq.‡œL9U`TTþ°è¦ë v">“ì4Îdb1±¤ 3[†£H€ôlêorøË/ø:c(çNZ £ÁÂ}ñ9D·ó9ÁÁ äód›ˆr‡‘’¦¤ :þè>»¹ã…ÂWÜ¥í^m¼}Œ¨)©b̃ïåA¹ã5U¡QQùýä¦ÉO|ÚÏ”F¹Y¤þZ.#!ÛaÉœ]~Øÿçì “›Aßcj‚WEå/2˜RQQS*PtSøé)kü±ŸÚ?¡Q•ßŸR-šeB‘´öø=·” 5›žeI5u¯ŠÊßGn$ÛÚ²8ÿ†ünE#»&dºÿe‚:ﬢò·‘ Zš»0q#-Cñw¨^« g‡q²'µ Ïódç. ` Cð:‘ÎæöE5¯u$¬‰áîf«þÃP:j81†—½¡›fÚ×æÒ®dB€­“Qƒ©®ã§ÜÆ›Õl²¨uaÿ ® ¤¡– #¨¦P.˜”ž¶ŸjüÈd›ÛZæ÷äƶt.òvV¬Lì0Ž?“3é#ÐAâåî~ÄåÅÊEï1*œVn÷ß7w/vô%a(¯T±­ŸÞ;€&®LëÎíá|PS5—«¨ró#žæV´½FxEÛŽVês¶C·y–‹ã©(ÁËp¾ú…ž»™ÖŸç+‚‰£‘T¹ËS뙟~HLP=˜ªi4[Ã2IjO¼¼ ô^ÁOÙ¿ÖGIÏ&ìiF„íáË>Œõ¨äNô¾9@½õŒïÆDP¸;Š“§è²“WPdzDãDYûPhpõ´Ù&ÒÆrïí6ðí=L£Q7nöàÕÝ 9Ρø8c”Ô¨Lf^ÝCçíŒéÁBû@oÿMRÍÅ:TœÁ¼±—NÛƲ`€ ®êÇÏ©»–þy½‚ú‘SQå¦83+1à h˜r™éÍlë妴dÆ~b³ˆºAÓM(ZÆtåæi¶%s-ƒ6k9˜I½„¦óì ÓXq‚LOºê°X@Ãì›ÜËçÛÝ8U¢®Ž‚|€;¹äzö³Õßr‘ï²!‹«c|Ä'Óæ4Xhw€m#1àï΢( ¬×IaÉPÊ*Ts%rô,/©F¸Ë}5ÂÓ‹ym?»ž…È¡ÊVRžaz<®:4öN:kAAŸÌK—¹ùW3¹vÓö,wØšÁíp.Ørªœ‰ãxK,¹'ùzgHŽ ÜbÖ#Ÿ#1ŸO3Á4,8Dç^ÈçI2⮧ã*,œD÷¥ìÈ.Òí•G ë‰|ž[F<õt^ à®Ek邏u’_åoÌ_#\Ø|ç6ç·{%o£C£›ã¼Œ3i €r,?“‹C·u–ôBŸº“Ý&–”lPð !³-bèÊkm‰![?ˆMç·õG‘r²u&ñYfïæ¿Étj@n¹vÛ¥¤÷b=Ý{áô[ÇÙ|¾oÅêKö”’n‹K)cSçÒ陸úySQs7¿3f7sÿwcÁs.ekóKoúkñXøOÏ¥Ì^|Šƒ½¹tžAÇÕÄŠŠÊï:˜RQQS*Ð`ªD#¸£Kû®ä]ÒÇúa­ÿéÝSQQyÔÁ” v¯ø8<·FgjyÛh¥K®„cœÀ•´wÿÃ×ÈJ´.ìDv/W(©u sžÁ0‘óÏPF¨KxUTžäètJѳí 0ñùPF™©³3ús1‚^ Ù’÷GW7ò"hµ˜‹&ÎŽÄs ï%9´.¸1žù›ñÝNÅò¤ŽÃe6zõ—¬¢ò„F7AÇÔ²<»t#YF.ݤöÎ<¸ØÂ{‰gc;Û¬p@5.µ'´WGp$ «:˜øy0U±õbiâ‡Ðǃƒƒhãf‹ªl+ý ×ûIú¶çÆ%Žå’i ÚFÞ}W‡øŵ,•L¼G®‰Ë·AC}ਨüåÆÈÜ   ­—mÌ¥Û$Š‡6&ŽDR-™ëY”cs„ë¡fÍsi½†e’¸®`AtçsAp}<†8:n%¨%mÊØ"©”ÉÈ)_“)kfbëÎÛ×ïÝ¥@PÉav9?•T-£ýÀˆâpÞ¬þŠUTžàÁÔCŽ²š Mùebï±â<ï^*6ة߀Vé´>:Nð] ºè8e…™70 ¦á¿=©eú/ (ëG5=Õc@Ãw»ù43 Åï‡:P–å…Qyàªq(³g¡úr’‡ñ³­Â³+(P]**-¹ö'Öbfú1¦¦œ/mYÞ‰P'zœ+z¤Yá/ؾu‚Á¾œ²í;XAƒÖê…R@Rƃ¬&N³Å>úyÐ¥!*;Až-Sã &‡Ã4žd %l9;Ò,GÒNÌ&Ö¤*ŽŠÊ“*7ñ’güø<½h¼·rÐiiêñ{ ã^ë.ãmÐœ+Ü {²ñ¶:Â¥­n·oµ‡õ ß„“R {fçÆd*ŸŒ/÷=+2èÈ¿3pÃnŠfè[V"ç.;ÒAÃíT6Xx7€¡7Õß²ŠÊ“™»‘L8@»Î„zØ4ŸöÆ'UY(Às@FP˜Ö„;q˜¡Œ7í|v\Å«ÐîÊÊÞ%¯õ·6äK€w²ÁÖN`¤RnŠ}Ü4ñÃ×tRœ˜µ›6­p6žæR4é_OÚ—¸œ…§å±9¤:)¬OWÅ**Olt#ˆ»Èxo¶ÇW8y“JkA‹>š[ÙÔ…Ü0ƒö'Pi?@·Ö,Ó 6@:í°m$úÊ»³ø7G_¢°Kœ‰ùƒ‰ßÃèËô=ÍÁ±¤å“žF¾Ù&F%º·RR˜|•‚çb’h| ›±ª b©7Kâ$Rsô`s,KrÕ‘”ŠÊ“B)&GW·Î!²n¬e¶ G¡/<ŸÝhqÀ–Ž)æ5¿±;È]šÔ$"“Wî:¾Èœ@÷¥}ˆLH»½°cFÛ¹E?•Å»§ò šTþ‡ÜM‘””øzI6îà¦L»d¶<×±V·R´ÿÀ*¼³ ´†ïGY#ó@]ðbý¥˜ÚUTTžP¹ù\‹å¿1”Ðòï]%´Ÿ˜^]˜§¢¢ÊÍï?¶£Á {¢¢¢òw‘›?«F8%ªÍè–=¢-þ-éyƒ”ÞÐCŽ|x‡ÿ·›¯Š¾Êc¥TƒoæHZýÁ5­˜ß‚¤1dfíS¸Û~ª!q=~7”å¡W¶ðápŽÖ·•g¨À¡ÁäO y“+;œ( ®ÌÉáŒçJ:y”rMIå œ~_×-jbTsîŽ!-œål …TÀ8½ýëL}Ûj¦¸9†èÞÔs*õ geÝG¾]Ò~¤$¸"¹‘k£>*ŒÜH¶¶eÙï\#|gI5‘$MàÕ2ôXMå¥w&'’ÁîŠâ° ð7=B@ä†y=ìx­½õ.íIìÍÄ-”_@ÝͼÆ¢¦6XÎÕ¼º ‹è‚=á\nÿÀ ”4æj7žZ‰ß"BB‰i¦äWª-¢Ò¾À*¸»‘‘A¹…”_Hù…´‹ø¸7óªÒhÃÏ3†FôÙ¯"ÆçÐ(8‰G½Q[3˪ef¦÷bþV:WŸ•?@n$hiéÂÄM„¯^£2§†p´5 _ô`[?.ô§¿oQýìw;7‚ ílsÒUjr©O7 n¿tÅ]‚‘éCè¤áèhþáU¬éùáè®S{ÑYdød'#ORÙÏÞ ¡u¹6œý]ì͙ߒ«Ã9݇¶Ö@ȉ;Cqsçâp<èXÖƒølh‡‡ý–co® btHºtâër|ׇµ5ÀÄžáôõ.õ–}ÂG8ŸK–”LBWðÑ%€æ5®A7“}é¤s1›ruèS¶¸ŠYhUƒKWÉ4‘­'|/õê…nÞüûy&òr™q•ÖUAâæ‚!,=2 d[Ą̀Š ÚCª‰ Wy㟷¾_%k4‡}¹% †$-qª½í;ï ’{ÒÍõÚœ¡ü{Ã:°µ¥út¨ü!ÑÍð§I:Kn6Çsd¯Þ¡>çÛ3j/Äpi$¸`Áô#ôÛË÷x®"˜8Ið=:o`i®ÍnÔ ¦f¡kY©½@ðÏ]h`À*~.^#|ƒNØJYhXt’¯ãmJ` Ýó ÛBr®„‚…òªOobÄ †ÓJIyoŽvgÐ6r%)cX{šNù)—ìá`¢ym’Âxi7=÷ðv¦UäàaîZxgããAp<‰Û¥Wœû0ž·z0¾èÁBJ&±¹`¦_¢®aöÎ 0±1ƒwƒŠËÂÉkÔ¬`âŸÍ8 ¿ä29ô`¦_‡®x¹QË :|Ñœ6öÍÌœ ×dË­Ṳ̈j™ûåæà ’Œ¥$^$®.»Ù¾Ó8Q΃kçYŸÂÚ³ô?ÃÛˆé;¥>*ˆÜüT‰þöáßÛk„OmÁû‰Éàx"-6£Ó2º·N³é—Ói³Ž#YÔm@ëtF'.¥ÇÉò¢‹µF¸–™‰$çóÍnœ+QGG~>@RŽCp ŠÂ cñ$¥RômzïÇq%ƒñ‡ AÀë[©½ëÙ\Mb‰!¶#ÿµž˜ $øB^q©l:‰ë ¼Û–ÏöÊ•;´ÜHdWôz šGª4¼±—ã¥ïå¾e7½ñ^äT†3§ ‚Æ>\¹uzuG&uýîÏ잾Ļ÷/`žÌNÂø%87@NENáæ >L¨P–굩£pYÏ¡p„€ *›÷Bhx»QIµ«~ã†÷Ò@¶™l=©z òÑCFÉõéPyÌ”T#¼‚uèf¤½rhêÌ.{ð“·zøqÂ^#<>ì5 ìŽpgäËûÜ_#¼²3±ö¬MY/>l€ôù¼…Eâ©<0¸³/ 4dÙ^ÓëAA@§z¬oÁÁÜÔÓJÇ&û:m°­- Ýͺ!l°°í/íç’B}aa¼„-¤{pQåW$zS,ÏáêA«ò|ÔŽÛe XK|õ| ¡Ø±5ݸ—’÷ÛR´ðÚ~:´åuw¼g‘%Ù†Ô~”]Ç–Q\Š¢ó9gVõgŽ‰±g™¿Û*îÙI˜òëôZǦžÈ¸Ê÷1Œ.‹»7_6´ßÃSé£!™ÐŠFZ€ŽsÁ NT©9Ãç1 h»•®mù°6 è©Vžã}ЕúØ(¬3uêÑ[ƒ«ÎveHWv÷Af&ÓƒBU-«˜ÔÚöî›Ô㋆6aô³Ú»$5}ñRJý›ÿK_~ª&0‚‰qõ ‹ …Í1H_Ö…â­hx§5ŒÌº ßæ“3¼šÁîº7˜¨[!1˜È´ÐÁ϶ejû@ó@òÓ8Îæƒdæ8ÜC«<1JLf{©RIòÔpArkÑt#Ÿ4°Ý. x)" –á“3|r†+F5´Qù¢›°6^¼Føbºóf0ïïç™~È©˜`Ç%¦eÃE~ªŽñy àÖ=Z ~aÇ(òó ð`éé¢áˇá Án<¿ÙV#|e61“ù~'Sj„g'Ñp7‹[òVG€œ\>ÝÅGWm7Ãßg-Šà¿—8ñ,qù$\gÀ÷š, IDATIÖtáÐ*»Ü,ùÜÐ Ÿ#! W¾ÜCœà£Ý4ëƒå9î˜qΣÍJ€i7˜1Œ©1ÔÙÇñÁ¼º†Y)ÅW^ ØßÙ“D+¸’BèzÐ"õ”ŸÇöd4µòK"n‹É¿ïAÕðåVúöFNâ¶Oa‹0i踛½=øÌ„âJJ2Om “—q /r ÀT‚–aÖ0õ—úðï®`æ¥Í0Ý¿ÎðäšY×ãø#;pøm÷óM_2ö1ì2WâIåâ ’?ž"¢%VÜdO:W¦â:\ùì]uxTG÷~çÞ»÷„K€@pŠ»»»;´…  ¥…¶HKq)EŠ»kp. NpK qÙÈfwï½3¿?6 £úõû~ß·ï³Ïr3;wfî̹çœ9ï(lÂņþ¦áÖÄñ¿˜#<Ï’rç»ÆHÍåæ±Ì­Àr‡›­’êæåí¶¾µåçÌ*u¯E°ü×h•}¼ð X7䦇•Q)ýJºu…ü‚üc’WÒú¢¥$_TÖcʳ΃(P± Æñq¬­ßr0ˆh5Œˆ¬Èôç¿Ã×cc„Ûð}7ÿöáÅݨ@cóXæÀçØnùZX¸S|!g}EýÞA(®yÅÕüû;Xä€üþ’(¶ýLBϲ˜z2W´Yÿ\•oYqÝ·Á†¿_Üü Kˆ5؆úßüœgý#äÚ`7»¹†„øDØ|6Ø`7Eá£?÷—YѲ©ˆ2QNýþœâ6hƒ ÿJ½ß;£ô#ÝÕ´Í Öáb/¤ÀGùëa¨Rl4²G!{Œ£`…‰Ë|Û£Üþª¬éWoGàvgxðEüÕ¯ Dö¬¨bË·iƒ ÿ¸v2Ù¡ð» ¢Aì`tÜŽs™f;:"­/>ØŠH†gC Ù‹EÉï4ˆGÏàš»ÿÍx¤ Â.kò”=í‘F‘šAå±õñïó¿jÃÐŽX¯„÷v8”@ü(ø®F y÷×ZÚÛ‘\‚[jݱé86ØðOi7æ†>Bº}*îêQÛ±¥7&zd4©Œðþ8ܼ":ƒcù“y›sˆà}ãÑCÜ2 9¾ÁXØÍjÊ@¦H1!Å„”l4«»·m•ñ’HPyb¢/f¶DV7DvωX«\·úâ\ Àñ=ÁË€\¨‡µ¾(s F¼xŽCÉ_.Ÿ ÃDôÚ‡Èl$g£îÔ¬ ΦàØ`Ã?¦ÝP¡Àt?|öàPÑß$ÂãðÒ0T+‡óµQe?xbÛÂ]•‘5ÚüõØ/Çð8|%'^>;’W±…’vk°?dM>ý…I3#ü¼ÊáR4“ÀÁ áÍPoÒ€§à¡eh×Ç«ç«6;G! 4'ÛÌI=&¸á«gïX·_á63 Ä©†ØrÔ¦ÚØ`Ã?gL1Ô[ƒÈ1OÁqXp!éyPŒl€ãWðP0|”Œ½ ¹!¹ h Å„œÂa¯ßI“‚†, „òÝ}„üù¼s ÅŠ’èU˜ÄLpì¢eÜDhnFpKc[8áF\Ε»Ö>j•óD ø¨`0±ùåü3È:l—‘Õ ¼Í˜²Á†H»aPiP†àç€G–¿Æá3?¬‹}w"w ƒ{®ñp&#qÜòÓvÆ 4õÂO9bE ¤É—z _¤$#½H¢»æµ þ¹ psÎ9ú«U]œ®•¯XR<Ž€šƒ‰@=ÎÄ[UËС<ÞDà$,?‡%cáÎ#ŽÚf… 6ü#Æ”(uÔ¸– P´tÀÕçPÚ ™™H’qðfÖàá‚22Bõi‡¼€Šöx‚mOq¡>ðÖ尓΄‚\)¤·)±ÇˆÅå0â`‡þÞèsªzAŸ‚×Ù¨U+J£ÌQhUƒ^¶íLÙ`Ã?cLÈ"_DZ!ˆq<ÜÒ1é) c_L-ðØqzg°‘6ß_±ˆ@¨­>*€ ò-¦DC6-M¨y+ç<Í“]ÐÕ)Çü©ä‡”´|+¼wK\®]DŒ·'Â{Wo `C?;îæö@Èß5 úlG`M°q`C°ô4N¥¶vÁTo€ÇÁˆs6{+ õVØØ…6Øð¯CQ9‹JÞ¤šÄ`¶åL1‡OìV ‰5Avý‘|ÞÈÏ·6bT›q»^®l²†„ƒÑo+Àç’¤9ð¥!µÙð^onáwtp£»ZÎ=<Êš™m߀nÃ5¦òL¡+¶¯&ßÊ-®È=íá·¥YQllkÂq¡¿V¯‡ OŠ¨Ië(+]FB~_…âÀÛv£l°áß(nŠ*5îde©„¤¿ûUv÷v®œÊC:Z\.xÉ0Ú¸æ6Øð_%nŠÑ\R"áùï4@ä8höÚÔløÿÎ66ü=°¹½løÍ9’ef‚M;°Áþcêy2®GÛÆÁ†¿j„ Û–&ƆâÄ ~çþŽ 6¼Œå&+¶M'ŠÍwcƒ 6ØÄ 6ØðßgLÔŠ^…ØÁož=¡œÖ¥\Ó 5ƒd3#¿_KÎŽ¸xèL£A£9«¬Œ7÷ýT¾ÝÒ6èÿ;H¸»/&ÓµVãf¹Ç€ÐˆCó²ª/'î¿}+GÀcÓú6ön¼ˆ4 „Cîu¯&c|²¯mß"s93PåV1¨u%ý#sòý0F]:p´á ¹<1Áí}s˶žàd¯ú½•¤\º’ܤo7Èÿ¦á&ˆ»¾4YÙ#¨†ßÿí†i'¿jtöÈ ¢qÑÚ)_ì»å›/²dÂØï>ÁœðøÊ–ÃKmïÌq6³þ é¯C#Ÿ<´’ ,áÆÁ¨#oWÚÉ»¬“·?ÞÞx‘ìRÂßÉ»¬ƒ«›Ê9ÀÉ»¬³O™Œ;û£2\œ¼Ë:y—Õ©•©ÏÏPz¹ú:{—2½Ú·í³¾Žümç…ˆI¯œ¢ùg¬ÊÞåÍجǮ‡ý“Q`Ìê_‹¸I}q<:"ùÿ‹vÃXøüΉv}Mý„J` 5ºŽº4¯÷“°ûµT‘bîžÕ§ê•Î¥ËÔªÃIx’öâZÜ›(¢rö­ÞB§æò GÖã'a+4롶såc¼ EÝѧfè|k”©è/‰ †·Ïïܮа“Mý¯(ÕÞM*z@tÜÙW™Õ*5ë%çh* Æsóå:Tlê“÷*“Rõ:¹©ÀZõ“'V9ìuÇö¥ò­>ž¤G„ÅFD*œË•®^ƒÈŒpDJ{~W¢J—r½¼](cD ú—¡±¯#‰Ê¹DµvšüÂðôñõðòÍ{©í\xŽ „˜“ž¾yò@"v%ªµ²×rï÷‡3Àö:2#°AK¤>¹ûVpðó¯UŸÈÈ|cö ¬\ž1€ ýypl’!\ùºMf|y<"Ö9°Q}†W—ãdïrþ†Øož<¢œÖ½b37WeôÙåƒõ¿ºr¶DÞ:!1ü\b\²K¥ö<±ˆ{mѯSi_ݲvC˜”q+-ÇL%€ˆÖð‹=uUg¾<§Åõó—‰ Œ½°dÓ”/y³wÌáµ+ÍLiˆ<»kBÇÄL«'aŽÙ7q€Tª=Çáö3§ŽMjtûf8lj¶Œ:¸åO cŸ\ ¶Å‰ýw‚xx%ÿ×2!D¦póÑš“ ü%îø䃫—ge¢C¾ßõÓ|¢ ÙoŽmúrx²Þ cÌù9-ïÃŒûk¶Íœ Ïf¦Øëû'·Š7’÷åä°ýßOP—k Æ^mplïnÆ+B×l˜6EdppϺ¼djÀã8õ%Ó²]|/ïžG8€áöÆy7¶•-‚<8º(5EL»½jÛ¬/ÒÓžžø¦ùÓ·"˜¶oñ¹Y£“SõŒ¯¶9¶u+åÉÓ]Ÿ>Ž¦–u}÷똬ÿtß “R9Bœ$/J”BE0>9ôH_~ÌÌY4›6h÷æ³V‘´¬“tíâ­¶3®z:)!tcYÝï8Ò¦B³ÏNoï3òT•²yœH’zlb”óˆÆ•LªWmÍøÉéƒ:Û¹Ôê9­–,²¿Ï·á?$íÎú•#Ö¼» ÐxÿyÁN(Œ 7o…³ª³j[¦"°+§Î´šrÝÇMÉwê~iż43"¶|åÓig½ Äß/aûò¯«­üùÚ¹k­¿ºâ㦆Ð3öº{d_ûÎeB˜éìô֞ÎW+g÷î¦J\Þ¾¼ÞøkAìÀ÷òpˆ¾²v[ÏO+pL1Á³>ª9åRiWÈú'çÂRF®ÞNL Í»§Ni•P¡\ç²¥æ<¿ù¦F­’æ7W¢ìëv¬ìmLyk‚— ¾JWxÈiúL;»Äˆ—µFÞžÓ+hÐÉêø€#ÞΑ'™]~ÖtâB!Óÿ¬—x!W1rŒ Ær5Æœgšš¥óôäÍ`„€‚kô×EˆFN«S1Èpr |•ÃOŽH7¶MõžÔº¶'{—`{ýHU5š8Ý Mj_óuïW­ùík/bKÙÇ&Ò6%\ӮıjåK00¨Kµ”¥˜Ÿ €£o ¼«²D<ʹE `رD($m\xJŸÇeW)¡c9iˆ˜%i|xžgT"Ä"€˜,ƒ2"H–< •%0Jˆùmz‰/ÄóKŸ$ô¯à.äÙº»úwïÙÄ2ÿlb”ÙäÌ/d³)rΑ¬2ý³Þ]É@º¯¿í®F!‹Œ‚HéwNÿ²€2W§ß¬'1 0°œhCNÁ1YÌ™œŒšÊ  DbV3–€ˆ )žé¥Åãz©ò½€%SÝÏVùÙ[&ƒh*Zç2®»µ¾÷Ûè–g}´ œ‚S¹u¶ÆÒkB@EHól;F¹£W¼qüÓ“·ª/ú…1¸6ù8uÍæLén‰ÎK*׈žs>)ó‘KËÎ ™ò•¥¼.˜œ¡äs–"Gc Œ#L¦ÿhú ¸áµíÛ–¹ýC×tƒÉb štjn·»×î»ú•Ïzó:“ ̬ƒ"°´Ž TvÊäÄTB@$¼¾ááS]–™¬(Ùb@ïžÓ¦†þØÆœ'd™\¶F™Äs'²ÌL²Óž^½EA£T–l§’Ûð^³ ²’’9G pnÔ{æÁ^3öýnˆ—ÆQ™ß=¬JD–®tUç¸sg,’!ýú&fßšShìUIqI–›øꪻW-™2*ø´Ø«×ôas[­Tžn¾ºè[Ïd$R#o$$‰„€Jæ²SÔ5¯ÕyT‡¡íOÿ4TŽ¥¬Ô¤LH&H&¼¸’mb„‰•lìû`ýÌDß6~*P¹Ô‘ÒŽÝ;ùªz £¬ª¡K;ö*°RU3uñòwˆ¿u—#AÚÍ çVÖ[Ä”xë¹”è$B@äÄȇ–³Á•%Jÿã–TáÄ/̹Ãæ)~Õá8&›Kv^Þ°E Fj´h°w÷„v¥ªÖ‰ ;ãToº‡’0 ‡Ü;·Ýóš²_]KW×ëשMÉ9PåÝ©U½µ»¾ýaЬi–+š3«^é¾í‹.~+&Ü?§«ñe@­ZÙ‰WvÎûqÈÂc¶´¹6üiPí ع´ÛÃ’UÌñ÷u-¿*£…4hÝÝ/ïO=íÄ¿yõºóÜ_‰„Æï™ßñUͦ××õŠ}{4¥iwÆ…{Û6Öìž1kÐ3r„MGÏÜ5kPÔ•úöˆ‹‰Êl7ï(}ðCÃçÕ·÷ìR®Ð ‚g“I5î6?´b{·téÛðà¤ÆAMM//¥È5ÖnÁˆŒÊÍzlœ;?pH°$3€•KEFD¶®ž‚ƒogáùëô:%ݨu†ÍÛùíèÃ/Û¨ Ïâ¥?aL´îuí–­-ïúª| ý«H¿†J GþªÔêh§–>ÿY¯Œ»±,4¦¨‡'™)¥¯àyÞtCdÑÌ#Ï y'ú*™)•Ax^PË ˆ’ ÌQ|eÑÄ+Ô²häj‹Ù)K"£œÀ+– ²(òJµÍ¦úì¤aÐX(šRþYĈ`yÊ–'m6‚Wó¹;TT2QÆ Š‚Ôl¤¼Jà¹w5™L¼Ró[ÐÖSQ 0B£’,Iá%ÇÆ!„Êf*Ë /(-sR4›•ÚjÆjd1›S¨9‹:/K²,°TQãø-Ÿ.-JX P€Bƒ‹sÛf—þªU×fÿS ½3eƒ B¶2¿!G½T Òþÿ"ýèš¾Õ³|Ç4ïÚŒ²ÿ-÷M»±Á¦Ýü³ð˜ JÿçâÌ„Âc¡ÔZm×3ÈfHÀ+ˆ ´6¯!™`ñ~+4„ã Vd20Â¥:¿xc0ŠeÆ@ˆR ³Œ1ë ™ É JÿØA*Œ1Â¥ 0eqGÆ'…  9}$–†ðJ 0¢©ØØÆ (Á[+®Â"ÛV $cPj‰l‚,¿ë&c¹(Ãd,ªûŒ#‚ Ù IüéËãD¡€)ÿ#`€Zsˉb óÅ–u?."VRtñáÜñ¬ð j|±jlï+n©îüמ¼MR¼d2(|¼ª´o8øS-þÀì'„$‡L>´ù´¶öÜ~·+B‰É!Ë>õø)dƒsÅ&ÌWƒ1)êxðºÅI qDç_ôŠ ¼ K Æ ¾>rdýÒ”Äb_®Á˜_Êù{Y!ŠsDÒŸûùÓ—ÙàضÄ…Ùýiµ*cCʺ¾ëG¢Œ9u(Ì­Åš®ƒê^?DA"‚g\;yÚhÈp¬Ø£Ó3ï‰"eŒpwa›;Qˆ…Ǭ7IéŸûßgûG’3vÆÈS¿.Z6vy0ý äf"Ð¥3ü–µèXÃÚfȼµÒ\i”‹F÷ömê1Dø'%Ƥ5Ã>èÞ˜$šr#Due«úò·ï¾®_Ñ ¢ÖïÌܧEEc¾Ê9N~{ÿ²È8ëÉíS¥AAkLÊ©¨=j^­ŸTëÌáçm[¹F= ·V7˜àQ2(o¬ûæÉ“j6û6ߢoïWKÛ=Ë°²ãz¿ñý>iwuÝÅ;$³IáñAóçº;+Ë :à¯ó ŒR¡n‰ûW£ ?[žªîTÕ“Êp¨: wHfF˜ñΦIw¯Þà•êò¾­Û¶¥üd‰Þ®o`¥p¬1´wuHFVd…„'OÍ;}†‚Ò½f‹q‹ÜPfÀ¾RZÉÀ!å딸sÁâ<#ÆÈc{VoÐëÓÝk oûáGç´ˆföd^Ç7§wZûöÖ/î_¿Í °+Óªõ˜:-ž]Ý]®õ{4rs%²±;Û'Þ¿zƒ +Õ¼õØïíTŒSä‰U»;}»"xá×–wý­ÉÕÃ× \÷=ó#íé¥t“ÕCe²S麎Ú?`Ã^Ÿ1-.6FðiÖåëÅúU]ž¤³—ßuô¸Ê°{°¤ ;ƶmþÃɨ%5SûÖžMºüËŒ¤ BM, ËŒm›2™1ñÚšÉOEð`ÎÕúµ9ÎJ‡"©a‹ní9×ãÙ5A;›µ)oŒ9lõl½Ipª3jy` ³e—øgÄÍ;w ´¸d¥{—aà @ä̸Q’wKacüÓ·OòÄ S9WpõtÊùÂZ’1*ôH–U¦Nµ{µªâí"YÊ·k~åê4éû"ô„õ,”ø ¿j÷VëÐgäÊžLb!Óêtø ý''â'×—ÇnâÏ‹1{Onî½ôŒ£q§<²lúˆÙó”`büã0CÚËë'å¶S{ 1ô¦]å®7VŽ{~ïœk4ÿøGoO§·'¿xçÿáæT”¶kèõÁÍõöU„®øèÅýÛœë->þÑÓݾ¨ —zâñíÔ~+¯jxµgò¹mËúûö`Rüã°ìôˆkÇMm&÷8õÍëQCŸQq8ùeÍKÁ[’8¶ºóä+µ;~Ñï“•Æ,€U¡Ì„çYbæ%‹/4úqgçX0eø¢•¼XD…Ô©}§IՓ¯¼Ñ§™2aÐ'3 3?>¶ÑÀ :W¿ÜèFs­®ý‰‘™@ÊÔïr+â ‘ÊS&B™Pbp›±o¢ï\4dd©1 „È"U½¾ykÀûˆ„+³šÜX¦÷ÐæÄ{@»£ÞÞ½˜•‘ÁÑÇ&0ú??45Þ´”ámJž,±+UË.¿ ³ð° œð—ü³¢_í*33R²^Ùç÷3)€å„´©%Q¨d¶„cH^äLFAJ´mÑ6 cañw뢲zK_ÌæÓiíð0¥>0+¸jÝÌFâT²L՘תUµ{}ãAÙiûL™ û{´l ÐM»³gɪÎsN8¨òÔNÿì’Ñ#ÐW“Å\\šˆ¤ìÊ>v6ñOh7Éw<~®ƒÂ±TE×íU–W Ótòåd‰!õÊŒý;õ°) IDATÇ g9‡F0×&Ÿ´m^§0KƒS•µ|«•‰Q¤†”øüÂ…Óºx¾÷%‰¬¨P¥®•M™i)ù§ ÆÉ=ÓÌtÏöMyeÑÁgçZÖºˆ>‹I6žØnù®¬ov&ˆ#§k>ùWp0?øa۴χ,[¡Õ (7ÎËb6so8ÜeMÓ— b†Aá§ËY~R6è´ üÜÍb6ól:Æy}³ˆD”s.¢B¼Ý·mö’ò'”ò/Ã'ÙÁr®$8M³Ik@ >™·õ«O†¬\ JU*eoH©ÒÍz½s{g?^±kå‘j=>÷òña*‘¯ä¥•2Áª œôtùj‚æÙÏVïüy_•nŸûøú@­DáiôÉU;›Í=‘– ¥§QCZ¢ÊÑÝʱÏ"Q Æ[H¹`LLú8Ñšû̘ÒÞC©üÝÉWåÔΖNNxIÁÁÇâ0!¼†²´"K³³•*çÇ …h“Rì!–k5šˆôtY“ZkËENéFYœåÝtxÞtAÌ’efut1›Òaˆ9½rrÎRY™¶ü5ÿ¸!¾fÔó··ÖasuÑ” YfºêÓÝ·4;}1²M“Ò¿u jΟGœW..’ÎÔVõÛuúq‡¦¸ýlBˆáÙÕcÑAßõ·Ž.üÞÚ˜…çMÕ©2ýGl ,Á3BÀd€§ìÝžŠ·§âµã§=ú5“eFd™*† sGxÜYÎ……_}žÍ‘)Üë} ÿòP8H“¤R©^Rrd*ñp!Æ”h¦óòhP[^ý@fÝ ¤L³¤ÖhèÅŸ®ðÁ¶mÎÝ7lóeˆ‰%Þä䣲è_‡¨5¾„ÒÇ«†?Ë°š$Ì\¹ÿ¯•*—üë›Ò(@#œ9õ‡j ™¯9®h²“‹KÖýDð`”@ÎÎLÓëìü2eJBÀ}FšK)gÎNŽf}\6qPƒ)í ÇYÚ,wþñ89÷É¿>w¶+é´ö^LW²çwë-žuY9A›óæïÆŸŠ*&DÑzöòø}ýõ&)ׇ(J¢I2s?¦â|²Ù®Ý¬Ó}fÉûô½CWhÕɢ,šdÉœþüàÖÏûÛ×ù¨VI¢pþ ïœ#Ö¿øÝWÈ&þµ›ßÙù£ ÊdÃÍ…ï¾a]UÙŸÉ!“£Þê©,'‡.Z÷ÕªÒú–SÜX<Æ$K’)ýüÜiœÿ‡ \¹/|Ô§¯‡ÜdŒ=Ú1Û\¾mi;”í>äíÑfY’ Q»¿ï¯—(WaŠ‡âXèå{Œ±[f‰;—r䊬ÐÍ]•öô©D%1>äÎåkRš^d*¿ ª›‹†eQ2eœÿñ+”«RîìXe)¤Ø‡gŽ–¨ÛŸ¾Ó9OO.%ü,‰ÆWÛ^'%cãd A͆>?ú]l†$bÎ/]êÒl:ñðäSÂʲhŠÜñ6Æßný<ÒgNpŸ9GºOøiÜûÍÞ+0–puËã'ñ„Iô¨\¯ñ¹ECã’2¨$Æ]^xtǕʣ˔«>å¸õh÷™sò/Ë" ‰²ÌˆÂž—¢²²,±µBÜÝI&FÅô°5ËíNE^%æR»½úåák7â˜lzº©ç‰­ç8eIw…âÜÙ;²,É)—#ž½(_­¾hZtx~p&•MIÙàÞi¦¥:žInWTp¾{úð™ÜØ.fW®‘SÂýsçžQY4§?ÞúEÓt³d“5ÿïæ=Îã¼/¼¶F£Êö¾ÿað3wxÊÖÃV*¤í¼êÔ_ØJ%q‡§l9 @áV¡Q“i'ýJºÉ´èÍIF8h¥sØÚÃß´Ë4òA}Vv«[Y‡OµM-Þ²òÈ×ÎÕ ™» Ù(Óc³ÊyáÉM%•W©F3vlO&¡Óœ³×–Úr Á»î°ÁÓÉf¸Öü²ÿë/›2‡ò-¦ŸöÒ)™„®?œ¾²lÔ–ÝÉ>õGžÖO2]aÉÛ+®¶õ³5%[ÝåÇý!Ó;ì]´ ßgŽ‹Nn.)=K6œ6¨sG001«ÕÇãBw“ U鿽fUSî“ _œŒ[8xÛ¤´ò=uœ¾ýð—Ý‚÷tíÙwÐ4ï“?´Î"AÃ÷W¯Q@… Çã ÞöŬr=æuœ±#xj×#;ý»õí.òÅ_\ÿ8 ¨bEOFQqÈêR§Î¯œ”œéÔ~àŠ‹_–åûBøV£ìý¹[|Û•:·ªµêà¤æ-¿¿f*ÓúË×›‡ ðn0µk—€¢t "óåú,9²|ÌÖM™%›~Ñ{D'휻·mÒ®IŸéüj·ÿ醓½À(Êt^hï³öà×mÌ*¿*ž tgL‚圊æÓ6ïßôAàUË-(qï¶âüÍ _îÜsw¯Þiî%GoÛ ÿÛQÄ÷ŒYþ“<óþkõ%ï´¿bKîuö{µª¤Èòïö…[›´iùSþ¹k .PỨâw×!E…u±ÂWŠ¼ ³ fÍßAÆXÁS«.¼;-êýõ0‚|— •Ìëã»ûåü©@ëÿøR+Lb°ž*@Áù“ï;»kZ¦•XÞ¬]¥÷Ìü34¯ ”µ´½¸ œ÷Ö$¤ D$ÅÏ(þ%Ú•ûŒä·ŸH¡/V¶Uq6WQU½¿pqåß_Gq­ÍûN õ²P…¤ˆY~[TåÖ× _)ò.yß u°ˆ[]"[OŠëu‘Í·.IŠŸ‚­ÿ;VZþ©Rü­‹”)L~xz[A…ŒIž5x¸kÞ?ò¹zÏ”@qÓþw´Í†¿{gÊþQȨÐc-¼­$,çÔ° `Lm§°–MÜØ`Ã_‚ƹL~å‚s.`›¸É÷¶á”DP€Q`*ä³­™ÙÜ;î’hÊõŒðD¡$#ä\ Ÿ[³dd9ÞAž• ™­|-=1gÂÛ¸4ŽÕ‡,«Q«ˆˆxBHê…i7UלÓB§‡»¦Ý>{J’Í ×ÊõG.÷/ãBäŒk«¾xzÿ>ƒàÓࣶƒ3ÆHjØñ_fÅÆ%Á©r¿uêW‘A²n=µqu†QT84ùb£¯‹0¢$áÛ¾¸sùšÙ˜í^gt§ÇA‚˜x5xé7Iz#§öªûá¯þ®àÉÓƒßÞ¾x™Wð"u®=bIùò^9ò „°ø Ã:Ø:ЭAÉ|¬¯äs ¦þ<~ë¾ÐI5¤äÒˆ9Þ”ÆÞxQSla̼vX}‰20ÊgqfJ&m×_/Ó«?oØ]}Ú­Ú¥s29ðI÷q.C·Q³bD@bÏ.8½{{™1ûšV/Ãp$áÚª ;7f™e^çW½ÿ²ªÕKÐýCë$qŠœó(MÙíÜóqFRد綯Ë2QN[¢Z¿%Õk–$ [ÿéÃÐkL2hKÖo1n¹‡³š‚‚ÞßòÙÕÓW/¾èh-AIâÉ/mÝ×ñ——¶h[þ&qÃá•à8€A4åî¯pDPZRO@21Kþ‹ 3‡h;nÕªKy°í‹Á>óC=ìH>Â.¯&/OŸ/ûõ½öÕ‘xìó+×èÐ_nÚ©}lNðú™å.}½}üëÌJ#6®åevbJƒsa-ZÔ/q|ád]Ë£;Ö‘’íš8Сìí³ýKV7øöTŲ}ø–]Ó: üù¸B )'§Üyn×ÿ—kZž]YÔ;<|PõŠü™Yã|ÇžèQÓÓ²ezïÒËϪc7^>9pÕY;ú[ëv¬ÿ.pÑjjÎÙÚý©§—»Îd ÃÈãp3H¯T©™Œ:sïÔ'9zKÔî1w„1Œ ¡ƒ€# Älåˆõ·À+ä­C«6™÷°„ HFÄq sÀ«]óëNB€ñžž+£Ö›²ƒ»µû-Cë’.n|n¬Io¸a\³µu¸wÿGžD_X¼ylÝ ãšnž2":Q#TŠ}cPÖ©WQʆ¬«\&ÈïéíëORîoÛ1¾ÞÚ1õ÷,œ“±¬ý=µ¦Ãº9GÔu¾8s¾Š1s6¼*U32)Á‹‹·Kö˜" šIóÑ="w­IHKI«T¯ŽÙf_©jËŠ!' oÃáè§LSnƒ.+.Ý@xܸ|­NßOT”‘úöÖr4ÆÜJЖ¯UÕS41ν…§{“l|ó˜z4ÐrMÌÞÏ_Ö§ ,»³YáK_ ½r}y¶êúÑ 7Oì~÷EŽš`†h‚h‚¤?’ܪÝŒ2N|{mù ã[­ÓüBðqNFˆ9ñòòÁµ(d„h„Ùhˆd¤¢¢1'šVçUEŒ:kàs´†èßùõèÇQ ;îÑ›û—¢Âó>ßFÆ̾ö]G¬°²è$EåöÓ~õuæÍÙ̾t}Ù(šÆ˜L!SJ!Ë €$¶›ökIWAÌfZ¿úÔLN­Öô™ú™9ej•“d&Ó Ñ{šwh—ÿPLFxrf樺_,Ó[h¿ £vCÍwî úòJ%_ðY·×Žî[rå 7vûæéðŽËCÝÔH½±âвÏY+g?så9b¡Ù¸9ºÜNˆçõ—.ÛÔiÅu_g¼Ü9ìðO+M??¥¡yÄfåU¢Èt„¤GßOO‰ ^W«×4ÞÌt:¤Ç'“²®¡f‰3Þ™¯`¢I"„0™ôÏ•êÙd¢˜L€¼M2”öÖRÒhìéƒÛw$Å%—i3µI.ÙéJ;(,¶’—£ð:Z_«ÙTï=ï\­éçãylsÉæ=5fHŒ0sô¾_Ž÷[}2aÅžœx¹æâÉ××\qP#|õP!Ä€Û‹>,?öˆ’8r}áX}àÄ“šC6ŸX÷‚sõ&õ½Ǫ'þú~ßSù4¬n:!®]COBpõvBÇ^~¯dE\þÔÚ}¤ôêâSÚË. "Í¿-Ì;øú:€QŽ$‡TyÚ3Èd öÒ²Ë×/À1 ¨Ã§eÊùqö>¾ö9%ÓP8—s˜ÎU’_Ü4d¼½q0¬é¨%œÈ8{OO™fð¥]ü2±Ô´–¥ÛVŒ §¸á”í¿þ5éÕ½Wb%•1+Crv«Ùuú‚Äg¡OS“%=$IO9@Êòœ† ¥·açÕ´/¡…)‹ùuÛ8´7De9Ìl•…Gº/2òµ‘º8yyS™Tøù5ƒâü–+¤ä³k®2µå+‡l˜ß¶?1úÔkqꊢ¶t/ãôàÇë×/Ÿ¶X¤L–a™”Ó<{­è5÷‘Ç¿ltN[®–wÇÙçŲê´D2eêP¥}·[GFéÔf‘«Ù²e œ|oEŸrãO+¬¨¥¯/\sh9ÄŽAÌD@“¾oîÈÓû¨ññƒx§.ŒAà“ß¼Š¬Þ5 éu ”jÜ>ݬóÐXö½x­–YI¢äSUµgYR÷9U"º{;&óÄ’‹Sû¸äîþ9¡r¯¥3LO”´v^Ðè`orL¤ì4c¶1_¨žÂAk¯-nË/æÔô“§£û¬8`Ï!¯ëüåÆ@Ípª2¤jµð[—Ë—î(3{nÖ±cÏ{¯8ä`9Ò” uÇ.%¸¸Ýk¦ì¿~¿®–’|áÛ~ÕÆí•3³DŽ‚7êSD•“BaóáØð—Åœq#…søñTD ’@xyz¯¢þ‡mú‘dd<{n™«DÄ!Ã(ÉvJN\|l ŸSHúÃó† FQŠžràáøÆîš')zp`2Lɉ$/15^>\ÿ§j9ÿãK¨¹Ì>ÞæçÊ1‹cœ²\,O¡à*æì›u+unÿ­¬(ôõµÏs•$„,¹x妕›–ªK}ØeL—"ÔŽ¼=5íl(¾dŒyQáàS`„#fɬP*Ä…|êRúˆ¥›sKÒ;«F³VKjúÛ3Ê8¯jü”™¶°P3' ñÇ>b&Ž×—õª6t_ÅJζÅcÃ_u¥7`2šDJͧçLg•1=ÍÑÉ!+&Z¤TJrnýf6K”Þ¾AEÝåëEQÊý!ò¥]¹š\ëwR>Ýv'Qó“ =Ní¸h]yÙj%ž­¯g”>Ù=;ía9/¤Ü_¶gæ8‰Jæäk'¯¥µÔÀõ¥O>E‹9úÍ£ŒFu›z–rèó7Ÿ¦P1ûö‚ö(ù¹½F`Z7»ºjJZ¶L3„íßW¢Á(âZí¯·ûW¢’)ñÌxƒÉß×UW¾Iµ¤ƒó3̔҄Ë“ík•÷‚o×m½g÷™s´ÏœàF ç¿ß±TÛöÆE1If0í떣쨘ž.ž:΢¿PIS:°úµ]«)(£†+?68sü‘oïÜþÛ|dž³3/BJOV ïÊútü®ßÁ}æä}ŽuӌɢYEf!ÊKfJ)§¿xb÷ãnÓæÒL3•DY4SPsð‚¡aO¨,žoòðqPÆLíøö[ݾYhU’+WÃ%|qŸ´,¥rز¯Œ¾½<rHÊ’€JE3#ê^³÷™s´Ïœ£ýÛ³”fÓCl²Æ†?‡üM–vûçã›wñžõ:N˜ŸrfÊ™à›–†$ú$ìÒ÷Ú£Úts~ç§)%Í^M‹žrÊο]˱ßXü4ãùÙåb ¥šOnÚ¥=@¯ÝHr¢qY/Y¿0ÍÀyuh6b‚†‹ ™{þÐQ»²M›Žé¤â'ˆ·V}p/«öÀfCG)ÈÙoÎ.ø0>…hûE½¶Ís#݈þÁÎSWȺҵ‡.ò/ëL|´sÊëa®Õú¶6^à€Ì—ÇÎnX”¦7:UìÜjÌ]>ÅŽEÿÒânÍ-ëù2 íî–ÓÛ×Kº í?þpï·s†®Ý£0CΊÜúõð‹C„<†*‡¨óKÃŽ6HêêƒU­VbJèŽÙß ^tÚ"È9EÆ®1õÎ ÷qÉ‘ìñ×ç] sìñéXéÜÄ&¥¿½XÆAàñ`ýÈ}×ï/2îÔ¼ïóæYï8–ԧˢjâ±à£!yº£¤î¬KN`4ýòŠO#_>W¹×h9n¾«“&áÌœ£‡Ž[å¿%|©’3K»¿åÌÖµjç]³o³C¼éî¦OGSµ*çFŒTv¡ºWÎ/9Œ ¬óão»¢ýH¶k^ !äòw]ß¼é¼ìŽ·}Žï”ãÖöiŹ¶¼`I1ˇ <Üþùå“,¼]É)'ÂíÑÞé·BŽKTÖøÔnþábO7-gŽ»¸|òËÇÏQ—n9±e¯®2e„#O|wóôQ‘JïšMÆ.õñÐ1ñÒÏ“^w—•1(4`fÈ„Sª‚‡£óJ•‡·Ë³›×J´¨O¢8E„ƒ?¯y«|«Úâ÷ü¸¤ñœJþºì×ç¶ÏTïª Û>ì^yìT»û?XŸX,h@DH2ɼýSð¦&Öt¯ZŠãöâú©ÅãNÊŠvš1Aë¡•ž½6¢„ „ÜØ´ÏÉÞ•ç‹3 “ÒÖ<¬Á„ Q?çÓ5`fP˜Î?@n»aÌÔËJØ?¹ýÕÊM×*[ŒêNA£9•R¥´-þVíF6^ Kî¸h(¡`¼C‡oÈ"D}P»¯Öø:ófƒ…|¼Áغßw¯Péòw'ó^x‚Ú¸¯_ Ï/^׫ZÜ™(´t«¶·íkܶ>'‚ðxy`e@÷É‘‡o,ýÅu½Ñêíɨ½oMgW]…¡;\ü÷šÿn!8vn÷å8-h`eÖ:~.Œòôõ­‡e§í³@ˆ]Óaí÷o_]oæDjß¡ý—£uD+]ÿó©s”g‘aáe¦ì³@ˆ¦ÙˆŽ»7­jðã#•”R  á¶Ú»ÞdW50ð×2C65ùx¹ˆF…©¤»1)†Vôk3uµŸ¯NÌf‚{pŠl‰ê¬ã’ Nšˆ;V«™Wˆ'‡øš>èÐHüë¡*“BüÕ¢Ðx×í2óúÉ£hk©Fm=l«Å†¿UÜ009MæHÆ•EçÏžHM“«ö[³QmÞÞŠ|üàÊ=ЂØT¢r¾QÙ¬l8õ°Òï}9¤©g2š^Ï^šýT,-ünb@¿R\$ ñÆÈtëY/ù6.íälgïí#Ó,ë׸ʫJ ‹}!ð£'½õUÊœF cr&ñÖ„Š2 ·¦òªœWòÑñãžõ;*e¢Ñ˜”NJØ„™e’}›1H”%Þ\wëfÕ–ªØ~\@%Â#ùÞ#m vtòh:²^IDATN¿¸ˆ—®5‡µ5NÅ¡Öu/ïùµi§,íNÄsû–ëC ß@WF1F¢¼—³’#:EÁtITjM:À»ù̽ïO]ÍFTè<äÔö1þŸÌ!Y¯Nm¾bo]2úØÄëìûÎïc6"°ûÈã;F•ó˜Ë¢No¼¨ÙÑ«\:©Ðñ»qéá{ƒ—wÍþäBµ*ÎFÿöÜÎAóvò2nÎo»g¥ßÀq]|š }¶zÞÕm·Xv’W³1ŽÊ\/G ¯Ï옷¶ýÂSÏ}î­ßxšêîêêî—ªêú¿—æÁÝz]üs;Ïq:âÝñ3bÉ ãç‘Ü‚RÒ’I!Ó0sÃÀ»ÜL›ÓIæÃüìØŸV¬}kå^ýóúr¢7%j1J ›¿oÒ¦®YÃY•²×šP?âÌúÕ@nÝ—êÔ®©)µD"%*¶Õ£ç凰Ïsžm»LŽ}ûË‘ÏzH\÷+òPùhÔüBÞÅÅ>“¥õöm¯xªXpã-’¨Vˆ`‘$VCî¦|¾ÿ¨2vå†2ñq5Qà…ŠT]«×žJÚzµF—0Wxòؾýbì¸ó&‡‡šJMß^ݦ]3êä,˜½¼WnÍÉ#¿Dí©ÂA-1»´Û/hpx#¾‡.(Ú¶Îöôª7/hǼ7ï]Ç’†£úŽomè­ ZÄZx犱nSŠÊ’EuTÏ îç Öb59õ±ò: O(]Üüsó®r<˜²×ïøùÐèÕÛx+}–…Riq:O?­¼w[fÄDP,UóSZQkQÃo„òxhþÁc®áKË´œ¼¦øà²á…Ž>ëhì¿d‹A}ÆQyz3;-%d`$U)QPV¡ó€À3A왺l¤ÙahFÐ}à²ÍÞ^äÑÃ"hàN .ݬÏ^Æ+ 7|ÞÝkïúrÖ°-âóÓ._¹ÔuD[(ø}OÂùˆØíÄ,Ùÿ3óJU™G)PU!ªDQàEzy÷zCÛ u¼Û“®*RY:N´?ÐTf‡%ÆEùõÛ –w_0pÆ®@'o QU…r2 *UyQ½sòV«áK¨VÉÞ-Å[©sÿ S«Dq T%ª ªDUUJ8^äÕvSêºën쉽vߎ@Õ‚ó[7mVcøÂ}•&AÓˆðsñÈ­7òh:˜y‡Ó±÷…ñRT–hÚÆ)÷Ó£ìøU[ûõÐ÷—{ºêï'ÏIÞV–'—îï 2š»*Û§…•gŸ"uú. ØiGäëÞ“O /Æmù®l´FUË[QY¹ß¼Ã‡.iÀñy ã…Å¥»S0ßLܱ.sø¢(§Uä¥s§Œ&:mY[Î: ý¾W湬 XÄþkÒ½5ôêŽÏïûÝ­ùÝ'Î1ò@r¢{»YRVRµˆ}cÒkkéõ]_J9àÚ´WèĹ.‚MwX|tÝÔË9÷€ÐÉËëÔr±‰%SvÊòé²kÓþóÛu @DÀ’ãqSsNŸC½Oð¨e-œþ~Ûúu™$ pæÞ6úíç®Òì5ª•ë½2Ã× §ÜJ”ѳƒ Rª^Ü9ÿTFª•h½š÷l?ôCš5€ãò~3°çÆCdSÚO w¿G„k¬lìtd#]_ñóòDp¸Ø1é^Ë®‰­l7ˆåBÒÂÓ‡S­2ê…Œ^XßÇÍ©ê’ ›¿Î>´ÿ ®Qø[ ß­±LX6Õj{mL¢ÉøÏÃÍ ™%;6Ñ礗*÷†› ÑA]]Fª×CWRh`µÕ¬Zª±Év¶Õ©ŠýÅj^^Ö^¿*»Vµ;jêÌ«±QŽø»ª6<3˜“Æ«~´Ì ã?LU}«•?sku{UÞù£_\íD¹ýBzhtzI•5Ý[ªØ_¬æXQ#îÔ¼ÂÙÃÀ3›÷¹âïÔ†?ë3çlÆKÀ$š ƒ…ƒñx0e³ëÖè@*v؆¨«Ò«p†¦” z8°šiÙ„ G”@&Ì­)Å „tˆdùeNOG­äbPi•™)5ZŠR›Úá¯*HÊkG¬l$Á`¼ºpƒˆòƒ´ØÙŸ‹9â"زI¢é÷‰[/Z±Qk:s!WmÙ!è/ŸÌ¦?}¥hЊ4Ï9³fúËíÖœlüHÔ <Ù:ŸFݧv}çMäðÅþ o lùaó’&nýå@—™_kQ§|ƒRäðRÜÛÇnŽ9&j 7Mèe!6ë^  ºŽò˜µz2×~a‹&îÅÙßïüa‹){ÅOQÿxTó²R¾è³aJXÜûŽÅnžü÷¸ÈöIkÿmàÄ—-:iÿ¤ËIñcšÞ7)jƒˆÅÆ++OŸ}\5ã‘Jd È%T¨ââ¢!²‚‰ Þ½íL|XØbÔ\Ý©5w ËóW’¿{ñ‚~s—–^=(V»øµm³òü"[6´'РrÞ¾yýã#ƒ˜7­ÐB€­çg0^6ÜØ>taà§ïgFyz-áäÚ{H¸"S}Ð{Ýzz}4ôÓEªTøëœIÞ÷^•6!:útì[ò%|ðËoñ¿õ]þgä·G뤬ÛÚ|äWEY‹CPoĪ.ïzy([´ÝÇLù3~¶ÌWî#ß=÷ðꙇWNžÛ<Åì6¤aSw Àk]D‘¤~rö’v|Üá1k5$®J=áIÃÈqkRÿkÝoÅ©Ó}ˆ¼FÇŸ4 š—¡AĬo¿õ}÷cAõjÜàâáC<Ú“ì]Ùú¾¾Ï·Þ¼T©‹Ç yìLï4x˜lë¡ðôšvs~›\÷òöo¡¬wÃ`¼|¸±ÏhøŒz½&D- ™¶ÞE¤ˆT•‘,O>1x7r+È¿{Ç”o¬åîsýνk{÷ÃÆz`}JÆþñA„Χƒ±èVn>¥§7%´ˆœZš[ŽZOhí=-1•«è=ò(}Íñí+ïˆÉ½p¿f/"•/æç89'ùÏ ùr1(Vh>ê¼´Y¼Û·n7næŸwóÎã{Oü:õ~t±šT4œØô±=¯0rºú¾ˆ@yQk_G‹æƒÿ°¨bê²AH)"Õš¯ž=_Ô¸dßÒ]ç§?ÉË£r>”<É«áêÉ!¢g³ŒZ¬”Ç:ʹ5²÷hDwäL„¥ŒWnª* gkÖ/ˆ†wæmJ( ÂÆ÷” ‘žZJ$ƒ«‡kÈeÇxëí<ê7][Áĉ¾uáÝù²•^㤥b-_´k¤,Û.êk{©¦yX×iá•úrZ_ >í0u‹;RD * ¯X¯=2 ¾çƒ?Kiío¤árÂ̬ƒ›‚¼‚ŠŒžÇ£]@v->w·Q/ðEéwo7ìÚÄ…’òE¼$ÿBw æ„þgË•ŒW3˜ª®¨`(yz¨ªñzͳ$oïžSDU‰t/aF‡»žúôÉeFç\.PN¬íÿûoY”7ú¸íøúÇ.ãúUUý­×,ï{IÇo•çï¦D!Š¬*ŠR”›ºÿp£n±T/NT®ÙÐÑ’>P!Štpù*—>ÿ©¾¾ÀáÄïR % ;ØwÁqŠš3ŠJh£ZFÙŠŠ…6 /ø#ÉäÞ~DTòÐÅÉC'™·€¼(Ũ€Â“{U¿îÞÁ¾Ž¢ùÞoJQ¥Ì˜%ú®³DnŒW×»J‰Ãp‚BƒNã³öŽûaѽ‘_D÷[u0ûû™?’Ik6î>;ÝÇË Bû¡KâSVE)‚&áóßìÑ™à[Mú(gé~®¢Ý–Ró$Š¶ã”E›Ͷ*"jΊ7.P­[Ã6›4®§J( àöúô·ÛvÏë[DÜšˆïÒ˜™–Pkô¶™=Jˆ¡Í¨_o–k”؆;4gÍg|Û(½ì‹‰GזͧŸØu2,¼µC˜+½Ró݇¢G€ã§'¥ä©k‡å¶NÞ}ü\í¶"†´eÏ ƒñp¢·¿¥ÜeŽØ6á•ÓGUõÿ¶;ˆsp&ªóv[ÂC}¡¢C¶ígù1«q§†R ¡ÍÊ ˆ³+uC™£u{rt¨ªó:€ãÖÊÆØÎÚ†Qáf1E8㯦ª¨ˆ+H·©Æ+f_ßžß6Áz7ŒÿÏs7/}hC=OCÅ>ƒÁ`ƒ)ƒÁ`á†Á`°pÃ`0,Ü0 n  7 ƒÁ ƒÁ`á†Á`0X¸a0,Ü0 n ƒ…ƒÁ ƒÁ`°pÃ`0þ×! – „ñJþw! ²Ç‰Q-()TäY;0ŒÿqþB«ˆU8ÎÄOIEND®B`‚suricata-3.2.1/doc/userguide/rules/http-keywords/header.png0000644000000000000000000003772413051004444020704 00000000000000‰PNG  IHDRzn¦òOþsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ #äwv IDATxÚìw˜ÅÖÆ53;›#ì»d$K΂ ˜ó5 "f1`N×Ïœ³^Åœ&PDELH”$ ’a—%Ãæ<¡ßïéa» ¢xÕÛï³LWWW<ývÕ9U§Œ$8pààÀÃå4ºqàÀC78pàкqàÀC78pð¿@7UÍðŽAÞƒ6Lýën$cÊr7¯ZŸ]\py"Óš¶:¨iC$Œÿ’YóŠ ÕÒ°‚ ÚÒ·taV™0Æ„iE¦eïM£«qÜçu·¥Í¬oÇ{]Æ æÌž¹¢ÃÀA "vÇ ®ž;»¤EïîÑÛ¦/Ýâq…Ó 'Ü õÁÉ…+Öî †ÃíVÐÝõÐ~™³,1a:3&±a³Îí›)”»f,ÌtHO—„1;Ö.^³ÝêsH/¯©­=0”çü8EFÏ-ãÜŽ9p°ïðÔÇ5`Œ™ùæ-×¾4;%)6¥AbIn^qqalß«&>}A$‚²çÿ}ËêÔ&Mã"wŽå÷ ¹±÷©y_³Öå2ÁŠ’-ÛsÒ2šEºey.xºouºÉ]›ie´ì1U^îŠ_n»êÖçÌ\I7þ±w]¿öŠOÇtþé…g&DDº þMY›£R›7ˆq5à¢{»®óÊì $wç®2µhš†¨ðÇ?|Hgoþ÷ÆfµJŠ*ÍÛºug^ƒ—ì"˜ÓÇÞóvÖ‡ôúáå›þïÝŸ¢\M>ûá£ÏžÍA`ç‹Î•Y5â­¯Gµvȃß6©™ï]Û­ËŸ¯) ØVѦ…C»u¿~âJIRÁÈþnûv]=)¬›>hàÀ5ù•!–eíþ©Ü/uézþèVÕgJ¦Ú©ÿô‚ªAe÷Ùã¼ñ™UBr‡÷ïðÒbÿž9þüÚýϺ¶J@ÞE}ûß5mãîë`Á‚“ºw~bV‰,KÒœ{ácó%kù“#θå•sÇ tfŽ¿ÖÚŸ4ð¸YÖ]Ø£÷‹+KåÀƒß‚zG7Á²ÛÞ]räõ÷xPüîÁK\FϯgÏòÄÆJ²G$–UO"–e…ÿu…g3áŒLÁܹÆÛýèöæ7󤨶¬­Ú¦‡»cJ¸z÷ì¹zÎJö~šùëÑoö5=óñ±ÍÒ·,|¿îÁž÷½ï¿HˆÌÝùL9pðÇN¦‚¾¼‚’ÂaÝ{ ¤ê0€'6ØMyWÿº¬ÔoÙ/¹Üq]n³/Z æÌÝlNß‘6ÝÔC8†d$W Lã©ã9ÙCÕ1Tº»‡œJEÈUMcU}ûU ¯-Åú"ìqw÷eíÙíQÖ=s¿-¼ö´ë-g­eR=åÑoÏу¿&Ýì‹¿v7ýúг·< £Ç;¾xžÃúÓ£Þ‚Œ8¢Ïo…­ôèÈô*Š˜5‹EYÕv<˜îDדŒáæ~ôêÉ;31†òÒ‡ÿ¦WgŽ¸Ë` ö g/foǶͣkzõ¢ý@Ê ÆðÊ9tëÁ…wØc´ á°á•Ù…ʹà}öâ°SYë猣i2!Çbüò%Ç ¦W/N¿ŒeáªVLá„ÁôêÅ©#ÙPb‡cعŒcÐ{ßmâ­ëèÑìÒš a ¿ç¤!tïÁµÿSs( À#×Ò§7ƒeʯcç»m>§AÏž‹wa@†uÓ± #>â×ñ èÎÉ£J~æ¨r›µ/J8ø“PŸ3_¡’="¥Z`#d<ÚP(•êðfõª£{ ÓMy>Izm¸@ƒNÐç(¯]%ºl¨@DkØZT¬uÓJ½±f¦'²Òv@=Í3åBOMV?Û@¥Aiµá¸÷%éëg…Q—$&—Èò«Cö ¹ãR$êyFµ¼²Ç DœN9E ¸(Ñ(äöKO^ PTKv²@Dè³lIzv¤@Þæ:íd„[²$)°TQtôÉJŠR‡f"BK$éò áUf‘$MyT NG뺑r¡ô£Ua©ª¿1å«k¢@G¢6‰Ýõ½$¿O ÒtÚ©Šs ôÊ2IÚðº@©'+­™’bjs¹Õ*U ÒU$YŽ_' ìÝì·Úþ32m(ÒÇ7 Ôä;òƒzbº$uB ¬IÚ¹H?«-үіþÍ‹Õ«§Nx®f¦_è» Z3N¸uW›¾%Ð÷Ûõðñ21ÚVª·ŠDÝÑUt”¤'N+Z Ÿ貉òå+ 9PD(GÚú’@£¾ªöòîèéi’ä_,7v^Á\Å#ZÛÑV?)PF/Y…JB´°Ã×='PêÁ Hw!PŸ»$IùŠFxk¡›("Q’¤o.ÍÙV­ú¯]$P—{Bm¤ÆijÛQ–Ô ‘¢2IÒÎI‘ )ó ð(O*™f÷ÑŒ-’”Ž@‹v8RîàïC7 „d%&*1QI‰2ËuÅ1ý'ì9tþûuzL’^<É–ûÈdº_%–ýýÑOU¾çÕKÚ4W.ôô÷zûfySµc’@ßWhx¬@»¤oŸèÛmºl¨RkÃmÅ6’Ê”€©ß4m–@­Ö£‡´´*ÛÊ@ ÊdIV@Íã›]ãte¸x…ŠBQ-”ó©@ý/ ‡)E6Q…¥£» ôò;íK2j£›¥v³#cìß·Í®Výƒzy³=ر,Y–‚3j9 œo…’q+«Ø¦÷á!7©vv$iTª@?nt¤ÜÁßÀyh¥r¸ ·òª±aGhCw 2¼Éåð®ø”Þ?ðê‹Œù”—î楇™»†>Օеþ¤¶ÆãfòjÚŽ#© ©ÇÓ>y‘±%$\LèÓ`Ìr6,¢ûpÒŽ"æN`†èxDѯ+×1åˆeÈ@…g¢I&ô¥Ku5IHiáƙʒX>€Ðpã†@8Ü]=<(D…[ÃSkÃb’øj2»ÏyHíP-J àqÛ­*’å°Oª0à"´›Ì ïe÷ÆÙš8Ã%ô8‹ªüUÅÁ=lOV€Þm^|;³pÀˆ¾PÎÌ©lnÀkŸP!~xÊ™²<ü¶ø ½’ ²²Øš_ÃøŽ7…ŽÌ|O²x3¸é؆ïG#¸éj€Äî¤ÁÄûYœÏ óˆjH|,¯Ýpó5½{±i9Ïä ›Î=“]ãY—Ë ÇlžÏW_‘¹âè*ù 0˜,¶—… öP¢`ö»HÛ&PIÉ$&æýd‡ï˜D1Ä%á1´û©Ý^ŸgÕÖŽh¾ =п?-“ØY@BÅ™|9™éKºf¼=Àø8¬;ƒ¢¾4€¬,;ß’9䀢iãH°ƒ˜ª8YÊ™Òv«Š·+Õ%Ð…·è¦3Ši¢íåR¹Z"ÐOkÌ›:ºµ@_¯–6ÚÓ‡«nÖœíZ7M †7Ö’ï¸ãì˜?I’î;^ ¼ZWhGxº»aƒ$Kg§ D²Ê%IKž´ï¾õ‹$ÍÿÀ¾|ò+Iz©³@÷|,I?þ[ éÞû”ŒÜ®JUñ9ýʪÇï•×%ÐKk$é¢Á5¢ÇïW´[ çVJÒÖÂ¥îV÷TÅEÕ®»yíRÒÒK£•†ˆ×–-ºG èc$IËåA Ða-òˆ$=tž@Ñ=ôä#JèÎyRXw}RèØ E PŽ%I×4r&SþVº›D|5ºi€0ÚP(I"ÝpŠm 9óVùƒá tå‰r!P›þš¹ÙÿöA\1úz»ÖÏ(ã–Úò#ÂÚœWŠLQIÀV½¬ûX ÷Qv„¥·”qhظ³Y ÜZ—/IÅËmº™[$I¯tè¾q¶äõëåB1-5k›ZŊƕŘô”D Ôq¨~ÙY©fúêY¥F Ônˆ–ìg*-«8D¬Þ^¢«Û ¯²K$éÒÆÂeÓ¤é/*-R ^§)7(I‹î(îøð¹7[tjo¢ÓôÂוå™ÿšÅ Ô´—¦gÉ’d)óu"Ž·UÔ®*tsUC‡nü¥PŠª5ÿk «¾hÍÔ¾Ú8”K­k@j86®zZÏbêŽ_#ÙЭz Y#¯uÓ™2Ÿçѽ1TEùa”ÿPKÌÝIÕ¾k9ŸNÅÝ‹ô4,I g'‰UŠ^zScad¥@5*lWªŽ|«µp•¶ªÖJŽkT Ô£*6µü6uÜßT—X׳جƭº´Èû!tYO!kÆßÈÕ·ù4#ÏàÇw)€‡o¨3kSO¸ˆ+ãòkÌÅ–X ‡_B‚w˜¦¾«§¾u•gŸšÑ‘s ü»× }ÿ3àª;Y—CƒVÜûGµÜϱ€ ,›+G1=‘É\z'W·O'R8pàÐÍÿãPßLm?È‹ºg7üÏã´4c?xÓÔ=SÛûNνÍÍÇ5²*‹âì¸tð¥›ð~åE?ðÊó<ó o|@Vþ~¾Ûˆb|ùƒ‰ÿƒ§-Æp¬cÈÓm„²æIŒÁ‡qÑÇ` eÎpÉÁßž½}ýK8¼Ó¶xÜ‚~Ïÿ ý¯)&V qÜý1÷ÃËØw©Høã3ŠK‚’ÿæëíŠHŠxôc6[x‰uðϤÅaí™±…Æ=X>›Æoèt ·ÅaÙôK¯m4dö°õVM°.C8ÕìÁ•ªÕ %^¸±1&‚³Î­|¤VŠÙ‡|ëcÏ*%¯+ýZÌù{Tªþêoª#†íQ0õ.LpÕþ>“)CÙvæo†~]DJ‘‘t<™U?ðêXšÆL}Šf lo2‰¹ò ÃíM0†Ï_$Á1x“™¸ Ek0†˜ }žýTz?J ¿P™Tóά̵ߟ̱´ld‡7jÍ—køò1RzcÁ-'ÙSD”ÁdدVÁ :7³ã{â8òŒ!PJ‚Á}ŸÜhßjp0¹Æ^%tH+zPï›)zÄa ³7c  Ác§sè%6×lšLëôpâ͘°Âž‘utaZðÊùá[íÙ°‡‡cÙŸHcÇtž½À§*‹Áx)7Œ„1õ¨Í5ŸÞ†14¿ wEœÛNä°Q6_;pð×A}k·|&PÇkªY•ÿoþÂöÀ2y–|¯vQMÏ”¤‡Ú DK½3Qwˆ!’T¼N.d¢5èB}>Nm¼Ý4^%ò´×†mš«H·RÏ’¤òr!b5nžæ.ñÊ•¾¸^ ÛÞTN®|ùJôØÎ"üÅJ4­Ç?Ñše:¥½@ÃF+P¦4¯ŒWNÔ矩WCŽ}Ê®‰Ѥ–꟞*bT,ÖJ¸ôê"Iš}—@Ý/”Ošðo†½/I-bdR5›J²Õ6YQíDzÅ Ôö -[®+‡ ”v¢‚Õ3úá>™hu=O…%:€@¬–¤µÏ ”t†$,âU&i¥½°8„ û´ \Óo¨ÿòK^#ÐùãO7þ>›2Çtøíµß½c˜@†ý'LF ߪ¤›wIRÅ&ˆUq˜np+´ùiñ5ó–½-бwjÉB-\ >‘­“VhàÃ6/¬\¨Y³”+͹K ‡?•¤Š*t³õÞ½ëWšô•Ê•æ(´å`ÃCõ^•?eY5_ÎÓSE¬î?R ›>´î$ÐSµ`~ýI ¨Ig•Í¨Ã1Z²P è¼>͆éÆ¥­¡‡7 ¬ÂBef*+KYYò$É*׶Z¿^£ÏhÈ{uÓtb†ˆUŽ$Ÿ ”ƒ%i`+¦ ´|âP«>5{8pð×u@Ó `Õ–Ú• Ûv ne_Ægü²¾2nËw$Á*v €¤Öv’ù™Sdʃ•¯(¥á*€ö©2´ïIûz‡j9Ë:7 _7#ò‹Ã7#€Ä–¶.›*¦¨ZPÂÝßü4 ÎÈ-¸k(w…£Tä¿`å×tûºòÑY9¤%i4Õ³ P*ò?§åÜ,ÛNéúÝÔ_ñÞG¤§œÌ/qßB®™Lu²È­¸õ°*ñv:ƒwÝ ©ñ¶¼Í~[õˆá›ÈhÏÓóiÜ`n¶¿x@ÇV¿%÷Ðn‘ÔàŒ7mæ¡¿bHh°6׎ûÓ>þˆ,‘Ü`Õ®ðõJ!!6¬Â0µWs·bµxùf%‡¦3ýÞÊHŠx»¨²œå[Ii Ðõœjå¿¥e8‘|Šl:¤<†øCùt"“&1i"­pÇ3_ç‘·“ÑçÔUÒÊ_tÀë7qó݆D/À‡¥•(Úਊü]t7–d鉓ò&éù·õùgzì*{wõŠ\­~Ïöη4S—«¬@Ó6TN¦¦¯•¤ÀNˆRÑîÉTX¯±a´@gß«âõÑT‹7iórÜJþ%¿Tšˆ%iÖ:­™¯hÊ”æß'ÐYjçNù *'S¾%¡Ï–hk–®è.а'mÝ Íí|sߨçYv5¯¡+n«Sw“o©tª@ m”¾¸J Ö§jkŽ~£ŒF:ëQÉRÓ‘¨ïVi×fÔWíÛÆî愧”—¯çÎ(íÈšº›¡Íúp­ò2Õ)U Î÷(`Õ9™’4ºA±‘ö-o”.|×à ¦…èf‡í­&D7`»–´á)μ[’¾ù·"½vRÑñ·ÔŽ3ëž*áqzcŽ$íüÉöCîî&+ÞUé?xË8Ň‹äòª÷Å’(UC·h¦›÷ê>Ì~Qã‘·u-Õ?5ED)Ï’¤»Nèò¯%éòŠ»þLì¤IÒ/¯Ë.g„W7¿[EUœ¡Q]í[îT­Ù#£náÇLP 7IÙÏ š$™(b+éfú‹vüÛ?¨ì©óûʳ»`]U숷ƒ¿ *—½T”Q^%\n¢cðz*=?”•Pîƒ7ŠØ({­Gy!eAâð¸‘E~2$'AüBä&%À*§  o±Ñå%”û!*šèÈÊ,ÊK)¯@†ÈhbÂá%Eøƒ¸½$ÄŸå"%ÑÎÝ_NI9/±1öĤ°€ !%Àò‘_‚ÇkϳòóÀCÒ K ð‰¤DŒ!PAQ)¸IJ‹’büAŒ‹Ø8"Üv¾¾2JËvB½ãY‰vQ˜OPDÅí­éCÃ@qþ QÄES^L™Ÿèx¼AòKqyIŠ¥8?$%ÙËy¬…E± x]áY¡j/˜ üooÑü°›n8øŸ‡Çi‚‹Ò8ÍàÀ3º9àzøÊŽ3 Ý8tãÀƒ?ûâïFõ\9pàÀÁH7†ùcì}þgÍ%¼û>»*œNràà‡nà“'lÞykb}ã{^VÇø§æ¬Muúè i:V|Îù粦¤¶g8pð¤Áfûo'¦³îM6„ùD€[Ï£iÚtá½mW üÜq!M›Ðú`Þžió…1,ú€î­IMãâGÀ` so'>‘3ßâËÿÐ:ƒŽƒÙ Œáaô pbGN1Ì™Âä/É÷9³9þ®ØË2@Kšp£@WÎÖ’;:ûM{ƒvªMŒ@Ã.Q¯ . m›ÎQ»XN¿X}› tî»’ôò(†\¢'îµ:FAK‹o(º±Z Ö¢ ýúêM h#Ðð«õâ÷’tý°ÝYšéÀÁ?wÃÉD¼ò$•«jÞǾûæ•u}0´/@ÝVŸ¾*’Þ¿I Ž÷J’òÕ£‹zõR°B P\KûÙ¯.-+±ÀLnk‡_×G WKÒC§£¹ùá[Çé_'iy¾ÓgüP;˜ò+-àΧÀËáÝ¿„MÐæ­¸ì|%³x™ýÔ‚U—‡ÂY´€9ä™ÕÖÔºžÓ @ÚPÛ=E¯#a–2ª-AÂkäFOv†¢ü­±·UÅ_Ž2ç\xÑû|;˪®®~dJÍð­Ä‚©¸Â+ßâÓØ(wD‚sN}tààNU,àŽiïþÈ̙̜ɜ¦^G)ôhðÊÛ¦‚n-éÔŽ<ѵM•p?=ZÑ¡ eÝhyE4oFÓ¦¬ãÛø mwN·,pz·0UÉ>ÈZÅŠ_) :ªbþ‰ªââõŠD±ÇT ž,\úi«”¥†nνZš tÒs’¤MJó4üJ j%ÐqOKÒ3 Ôxˆî¹E1ÈÕBÅA-¹E w’»P7)i¤¢€$¾X ´ÁºõCIj‰@S·9`þ‰ªâ)ç+&F·½S-ðûç§ã$)X¬‘Ç(1NÚèõé¶vÙ²,ÕåÇ+1NZéåï+µÎ³^U«†Š‰ÖñWÛ.¦BtÓåj½yƒ’cuСÊk©[Õ¯©âbuö ’ÔÅx5k§ÓgüãüÝÔôÉbê ¬ùH=çIU?1J°ìVº=NÇQüúbÝ1käë(w8ø‡énª¾ð»×X3Äì=ÁP´jçÀ±)ã(’8øûâ¿íï&¾ƒ£}'§'8øÇÃq@áÀƒÿúdêa7»Ù»«~w:ì_:ª-©ý.ÃñË!À¼ö¯ÖU›ý@¤ Då@‰Ðþ6—þ@©pè¦VütÆÐnÆÐÐ`BGYÿù3†cî——<Ö~‹1¼0oÿ‡ð8Œa[ÅÑ(éâ­Ãõ üìýÏK"û}ŒÁôÞÏZÃM-0†¬:Ï1˜ƒëK™ÈšLÜþˆÊ>¦ßÓ…ñ¨ž~U1û$n C Æ…ßpZ,Æ°Ó_g]ö½Y^ëˆ1¼8õ÷6K(ÇŸ¿âæë¸ávn¯Ia¡Û—ñàí\{=Ï}ø;?$–îÆðñy÷g8b ½“‰>‹™/¼>™³Ÿ„i k94ÿ]¶®èxÚë¤"ã!·õ‡Ñ!õ7·[Élâ± ˜Þ±¤Á„Oˆiº¿ ðe>t§E= @l-ÅŸ$/#žã¥«÷5·¸hìWÃð•Ra÷ÇPlBÍ®‰Ù‘él?”e툞ӎš²å{Œ<¦AÜÙD„DeO“+”ýDlfæ0(e_3Šˆðº'Ù`à“9ýiˆÂSÎèGøpg\e/€aãç´8 1–‚gxy ËßÙï7Ƴ·æA ÀíÁãúO ´0.""lVôûÁßd?Rcø7èHdvg€Äp¹‰ðØ#+H €À¸ˆðØöõàF–å34¿—¾CÃLÊ:`ï«°3¾Ð‰1øýöÁ5»³X6 ã¦qŠ}+‹ˀ¨ðx# T`¼üXÂÛEÀOвөç£a Á`e½+€?ˆqã 6Uù+°Àëµór¹ñxjöh›´^»Ýdá ÙíoÂg¿„ZƒÇƒÛE0Ș±`°|¢ð¦rÂñö¨6tæÌîþµ3>‚"‹w± ÁR¶UÐíX€Š »¡ (ˆ/€qW+³¯a·›,ò–Q ‘‚~Ü|>äÂëÁïCáÅP­©kÅ‹åpqHIDAT}¹a9ù"Ë¿Jwø}XÂÇUÙõ>Ÿ] —±Óß-ɵ ý6fm¥g4¾ "¼Õ¤±fWºðFa©ð‘ÇÄ54oχ×KÁB'\\±}â 2~ä'Ämðù1n<cì7Ëï·›hÏ›DàrÙì*XH´>‘‘vïÔüâºñˆk^„Vh=ÚJ\:×ÝÁÙŸÙ2PAÿS^YÂe]96‘¯Ç🫹©Ï~§êñ=aéÉÓ>­->Y3¶HÒ[=ºà|¹C§ÇEê–w$)P—èª;ÛD6Ñ:IÒ¢ëê~½$µ‰ ìµ|›'*1ÞŽ§ÛÇJ’JÔ­±h¼z—$m[>ZaT*õ‰ñ H’®?A1öݸ=ô•dIÒ ÑRßþ;|à\Š–øìúŽ< U.½>R ~HÒô§+O’;1^¤jÒµö³­ÑöOì*Ggh»_’Îk,¢´½¢fË-«äp½"£uû’ôó5¿@ÍìZt>É.ÿ©Â¥‡Ï?’¨O×KÒ­­„K?o•¤Ûš ´`“d©b›Z6 ŸÞ¥ž—ØË&Ïn«ˆp+µ  t^›Êvëõ¸ò>ˆÃí¢N{D)qáLãtÌývøSízíÑÊ.~úI*ÌT$ºå]©B‡"З«%iT ™¢ü¹™c5òаشW4gLe1<­$¿Ò\ò®—‡ÙCnÑœÇÂô²‹qP´h\­mŸé&Ðn¿%«¢{H’jê µ5 I]¼ruÑGÛiö¡µ¯Ë Pl•K’%Š$ù«¤_¸ªŠ˜¡íÊþZÉ á³ctÿ·’%k«R‘;Ãnöî^¥_«?»®Lß=.Ð×¹’tN#¯Éw„E1Q3òte÷Êø]îQþdšü['´·O‘¼æ{]}”¡Å¹v!ßê-ÐkÓ$é˜d¥&ëû­’äÏW»†vä–G(9Ò~Ѷ¼W­`vv—«äg¹Ð‘7ØBÛ±‘ˆRn•Öðm—ËÝàÛÞèôÛ̪âò5KS“ÚQ¡Ÿ?” õ¹N’>:D ¨öZ°Zs>U¬KÄ(W²j%зiÃzÝ0Ø>FÖ²ªÑMûÑÈ΢U´ˆÑ§‹”ù‹šE ´^zz¨tý›*ËS—>É‘Ôªg:ò åçIÒ€‘¬ ôýµµ=V+³´ä;5‰± -?>"I¥­?ê’CJ9ßö˜J ÷ß°–-Z«ƒ¼ò¦Øcžž*Pëaš3]ãŠJÑ”5¢¿@ǯ“n$ÜLškÞF,Sò&©4 Ú,3v†Ö.R×~Ø,I74(íx­ÌÔØí#Œ­êtsGkáÒO›$éÆ®Ýõž¶nÒe½zs‘¼¤è$u©Ÿî&еóä÷éŠÁÂè‡l—kËxÌQ’´é[HÓ´_”¹L‡¥ôÞIz©›@®öúr¦Þ¼K.DIÊš$И¹’T¶A.£„Zø©@ݯ“¤œ9áÑEkö·jgzê;YAýx·@W>­Â}j)Б7kÚD%z„K­{iæLuj Ð- «Ñ«Þ{WcÇëÜt^ûP￧ÉódIã®è¸GtUWžœniBÇ%÷ºT³¾Vz¤0jØZÓfkH.œV ÝX’ÔúWê;\y¹’Ô3^®Z¸MÁ"ÑF&Õ¦ª™ÏÔõz=t¢@W},•ý®-Š99 JOŒqÊ „é%Ö´uó)yþ¥€tóQÂèëu*.ÓöÉ©ûÞј{"B§ß¬ŸÈƒ@³vÕ¤›¶4q£$=ØE ݪ͛õü‘!Iå[õÅçúâ‹*ŸkÞjíøX sï·¿ý½Z ´¸ªÚ_¯Ë$é‹ótá ›ÐñÒZ±XÓ§ë»IŠB‰§JÒGºím»”ý[ôÜÆ0ÝxUzzí˦.º)Ÿ+Pû³ìܶmÐÏ?k{¹$íÊÖ¼Yš1CÚtÿ|IÚþ†@Çß`p7ÝtLè­öV‰kŽèºEaºAë$Y*ø\ oGù¥œI=Õ®BÑzûrÐS?Û霞*\Z¤‡ÎèÜi’4ÿ%]]÷èÆ’¤õ+5s†æÏU;äNTn¹M7 ٟıw tÖ¤0ÝÍÜÚ«¦HZXÝìÈåÑvŸ,©¼HK–jCŽ$ùrõó\MŸ®'.¨ÇK’tÃÂhQ‰$mWI7ÏŽhÄT»Ø«>hà#•t3úIò(Þkwëgg 4'Ï~äÛ*‡±E~YV˜nj’Y#ú÷›’ôë£Ýøš¤0ÝD¨H²,õm%Ðcë%Kož,Ðq/T£›ÂIµ|ŸÓN±…ôâNvÈ¡wWöB¯8ᶿ:g è¦e’4éºÝ_ûèFá#ä¹(´ËF Fôùgšø™.?F Ïƒ«{Úùv¾ ¼Íp¢@N¶eà’.Šm©€¦£Åå’¥’Ù‘.¿t÷ ÂhN®$m›lsD@RžøÏÅ’4ª@ã—U§›ªgÀ—*!DI²$‘’]6ÝÔ…Ío tÁC¶Ð†ÚýX=ÎKÇ ™¢“† êwþðwc¨ØEjcŠ‚Ä5¢q åYå~Ã&¶¶)# 3ÒÈ .£1P^÷¡nkÒbŒhÔ’F<×|‘Ô‚MÛmÍn= ¦]@‡Ô°›‹X€åë¡ dRÅ~œ piÿ°J²õáÚ¤Ë Ýª(›¢HsDEôo^©ðV°>ÛÁñi|µW"m³¦º0¡‹}™Ð`íŽJ%k£HDÓ ÖB^Yl³s‰ô`Dd]»üô2}Fa\¤·ÀŸ¿—vvmè›®kc ¬ßT¡q—ã‚ n;  }’áȧèñ*‹K8â?Äyª´[{BÆ€¸fõÚ2‚@·t€q²ªEŒ?ÉNä¹î\»„"…eL`¸õ>ÞðèÕÓO¢a¨€>Í’bm•Ç¾ ,`ûJþuZeàülNN¸ò9îí pË­µ?>©½«ô~MÝÞÐ ÑV¹„ðÅÐ  -röhɪ\F!©±a,.¡YS&ŸÏŠ¢ßn­ØKså'£§·mCOÝÏÕ(µ¢ˆn Ñ@Àþ“xð`;þéÜ^.>¥z¾¡†ØÄ2hxøMoj7•îŸu‰*\âÅÈ å¾0¬äñ|ðAå߇ñÎ×Äõ ~Ýn½Js¡)í÷(Ö±WR.6Ïcç;­zì÷êªzéÆ°1›Š®<l¬¼ûÌc¬ØÂÏ_²|$sn“J–ö ;wpý%Í×måíG³hÖOâ¬^Ài§1ê âS€5ÛX:‰ Å[×n/ÀúådeVKç•Q_ÈÊLæL`ÜwÂuoŒpÃê¥$4%.dÉãˆ#ÀÃüLŽoŤ;™Sº?¦õÛѺ™¥x#|ä•ðêH6BÐGN©Ý79Óør[–óÐh€+{UŠÎ™W±iãŸÅ´§[]y¥r]g¬¼Nö:n<…K/eS¡mg\ºšœ5Üÿ2ÀÖŸQÈþ(ÆMeÃÎj¦aÃ& 绥¬šÇˆË®;¡NÉÎ[M ¹Ð®ï–¯xê'ú]˪) Û@Jê}iBÝ·p!Ù›ö­SEaå[2Àýû–xp“® bg?¹?¯®1ŒèEóƒ)`ËJ6l€ŽôMfób^ùí9½/ͺ’ÆðÒHf–qÝW̺›àj\‰ ;ŠË]˺õ¬Ÿ0äì½”Çx@Œÿ ;ì¿Iên<–ãfaÄp];€‡ï#{#'?RÍ¿UoânD‡d–áÑwøÏÕ¬+dèp€IÃiÙœG?ÁÀÈDZwàÌÛyïE†¾ píE”o§c[š üÍýXŸê¦b‡Z'ÙÈÃÿO§t(©—ÆèŒÓl³ED¬ùLÚ­*n«ÙO%u¶'Ï ¯¨óÕ’ÔÊ-’íébæ5J [”èO$éÑcm Bd†6ül+2žÌ’òÕÔmëÏ ¥ÞQ"Ö¶ìÜ~¦âôMôîR{Z;8FDÙº½Š™ÑJ’Z¡¶‡Ú5½z@÷,–¤í!íiŠŠ¥S…Gy–$=q±@Ϭ“¤_Þ(é2Iž"Œ¶UHÒ¹ „G«Š$é¤æva2NÔ„§íßï(í$5ƒÜ:d¤­Ç¹¡¹ð趓ÃMÑHÓ¶HÒÍ-Þ"I·6­´L•mU§Vvdw¬_+Kšõ²¢=¶E㵉Ê0ò¦¾}ÂŽ™~‹ >ˆÃìºÏ­Æ‰•íÕvøóú`ž$‹åèûOzkµ$ù6+a´¢T’>=_ ³Sá<èa§³ønnxÕV-§¸¢…Pši¶ i.ÐärÉÒ§g tÄhIjî)5•b•ŠEiÝ8:°/¦ ôÕVÛ2E¼~Á!}'IÓn¨Ã’Ô/ZÄغ›CbD”r$«•Çn“M%Ú2Ué©•Ãk^—,íœ*PÚ;ýs;ôî ©BíÃÒËú ôS¸Èg& —vú$É¿Ô³réÛçliO»Z%!ñ;ÄVáyh£%Iw¤ ôÑIz½«@/ÿ I]BöÁM²$ßNµ[¦ºœ¡Ô˜½èn$•ÎV“°4î¤Í’¤·{ tÍk’¤‚J3qBšÆ,–¤’‚JƒÏc™ª !Uñ£Ÿ×Ô+Ût“^‹ÞtÏKË’µÇ]YuƯ™TɳêpênÕ§Zª§oÕʼ־ý.’m)Sí©ÈVgœ_Kâ!ºY±kßòݳÝö,¼µ—N´¬º×?X{I¦f£YµÇ©³ïêºEå7£ž.®•¼,KÚ%Œ|{Ô¹ýMÕ´öˆ³ÝdÕ!±{þ–* MϵGÙ@™Gínj{Ýö"iáËÀÏ¢Íêý·­Ò­{˜ZëeíÞ*öX®^§Ë Sç#»cš:âÔêOêÖU†¿g¿‹/‰ïo›ˆ›}kºš.8ÌÞÒ1û™¯Ù›Æ‡½ù!Ùﶭ©£3ûÙ/ûØÅ5Äã£ûHîIÄžÊÁzEtïÕ4õªn~{ëÕøùù©ôKÞ/íO½¯[í’¾¼ñtŽ»êOÙÄà/¨ð×¢·*,ÇÖÿï¡Q_–.#²nuX° °6ÅPy!ìÃ'üWÐñæßU‹k·¿8Ê3Xµ¶šÉ¸Òò[$SËÇéoÑ£ïom®ßî€b_ëýíúìOFöq|:øÓ„í¿Šß¾Áq_ëÕR½ßäða¯§Œë/½õ~¯.ê*ÿQYëO¯¬34ûKâ¯ôáw(IªF B†/ÄfÖYÿ¥ÿ‡1´ÞÀY[Ãu22l €¼œv}rß[µð£@ù\sýûqøñŒ›_3Ž1ŒˆÃ6–üÙCc8+cÈ;ŸÚ›»?ªÌ±‹!²5~pÍŽ»çéA “‹þE¿\ù ÖáÏåÐCèß¿òï„'zù+õÙ]zÆköGîW?†1l7¶¿’%k ‘qu’—Ë Qï¶úñ ™·à€¾¯dN#¥/Ÿþ@ÖR7€¡*ñ,&*™ç?$*‰•39³·|S“Cú‘y hý§wh)_•cŽ%ùÀ$¿ö 6ùÈ\H¾‡ïÆS„Mü-†‘7Ÿsð¯b³—yŸ‘YüûV¯¦šµíl*¤MbañrÜÕ©-è¥GðÓz¥p¸›i£ùåNº¤ØóãÞÅGç›ÓÙ9…´ãxb$o¬Ö–‘á!ØÆå䋃fã* |¤·&5–m™l+ ©1-Ù³ëümlÚASiÙÄncÈÝ̦¼±Ô’å¿`EÒ£€¿ˆõ)×€6Mm­Oé6ŠàèÓ¡€Ÿ3‰L£e4ë³±<´í@”ض‚>Úu¡h[òˆN¢m ûqVQXAJcš¸ù%›ätZ¤UÖëò3˜Zðó<ÅâlR¿8å\îÁK¡ƒ›ï¤?üçKn8š¢2\‘ÄzmÔºûImJJ«vШãYòKM²ºéÑ™g¥ ùž[‡rI:oNæÅ¥\Õ¥ò\Öƒ‹Œ‹˜ûGoøwQ$Õƒ«l‡»ê'IÚ²2$eˆ$UlQ<2Ý%É¿] ÈÕÍ>jwÌ gØ[W[–¤¶QruÐemÃ\šç“¤e· Ôö2Y’|êìªL¡a_»H}ãEŠmû杻N3¬Ò+EhßêÎè˜OíGNHGHÖÈþÂh~¶´¾–-´”,{Ua®%IŸŒhÌüjÍòñ]8I’vNˆ^5›ndºð*»D’F6–+N¯eçÝ@«ß çèÕâ]’4ÿj%9ã];•_Tv $)gyµøýï³—D¬Ÿ.ÐËs”=F ä3Ô4:-]…’¤ÇÛ ôüu•?ð¥Ý­ÝÂn=r@#žª¾L#¨7ÿ%Ptù%Kzãb[²‚šù¨@.¯ÖäÉ’æ,\jÿ˜ýôõí‰GêÎcºwœTP[G$JRsúE’´a´@ç?R­‘wü"7êþ€s~Ó?âX»²|5Im–|A½pœ@ç¾-I+^è”g$é»[:þÿ4$Y Ï³$Kå%êØD¸•i©" ­èÐÃ;ÂÑ°W•›«WGÔüp«Ó͸›Õ8CÃ_ϯ« tó’št3 A ƒ¯Õ†ºõXRÏ–¤O¨ÿG’ôõÅô×Öº¹MF tï”jtS±E'УÔ4A-úhì/{£—–HÒ˜ÿèÜ)’´z’@ áEÆ“?Ö“ëé§Ô¹"•],mÈ¥Ÿ,iÛÜ0Ýä d\ºå.Ý}·®.Ð=ßIÒ³ƒÊ* ÓMW»­¿#ÐÑ•t3fždÉŸ#¯[DªPZþž@ƒŸ°Ëóö¡;ºæzÖ±¯©BZµ@¡ó“‡¦«qX f|¢B©b“~ͯ٠_=.ÐÉÚ—Ïv ÓM]È;¸ -èÿ^ ã®ª%k–$«i=þ‚î¾ÌÞÝâœêüƾ/ó¥ÀìOøÙ´îHÃFöÍ‹ÏáE`¸üÈÚŸžðÀ™íÂ× ±µ¨IĂߪnÙ1—pÁ›$6§W²·ÖmÏ‹·= xk7”´mh_f4]ì`È©xcª[:Z0í)Ší=Çeù c«©À¿‰w¾â™L®m[0œ}0GŠõêÈ’\^€Î¼žJ“Öàf–Ѧš°s·E¼ÈÎÑãƈ˜ÝÅÈÅÄqö¦¾Ž)(˜0I"€Øv¶¢#2`k•˜ b\®ðÁ§Pž Ð"ÑŽpPK˜Y‹Iõ¬‘ízÛ«¶ÐfˆýûÐSC­LÇ=UØùmÂÞ Z·€e¶nû„“ðU7Yø’˜>Žx(Âö.P‘ —XMGÓ| »rÃú1ñ]––1~=Wµv”$CUq5Qs‘îe#Ü9•K›TÓéšbN¹™Ä8 Šéy8Á_j±þ~·ZVÙÛ¾•]ÐÐ@&%Q“Mž›° ‹¶pç1<ôM½–kS§¥>-`æj®H˜·2|£„?î»$Ð É-#.še_œ^mùݦ_ú$Ûtz+¶ÛŽZêµ°W[%°;d×ûÌ,#¾+ᦆ­6%àË¢ÌG|»v†HÇx˜±„FUÝ‚ìb:$žÀnƒXÉÏÀyë©ÖsÕ®bÓ…7ýO]T[jtíR6ÃàAuT¸JäÄFs×…åaaøF€ÉS÷x6à¨8>)fÉNZ¤òÓGmzV㾬™ÿßÞÙÇTU‡qüsQ)!_ÈÐéH©Ì&™Ò–ä’™–`ŠSFÔE¥…–:”BKò…ôK­E›/Ë°•/Yš.g¥Ùòef¥ÅFJºÔCD8ßþà\2=Ü{)i2Ÿ¿î=ç÷z~÷<;çy~Ï÷²ñ+bÝDG@5ikîê¯sÁeÞÚÊÑÞx`þXòfY mIÎÅ?À9XWÌž,(`œGÀ €:–oæûß8õ;WÊ)×›Ìñb’ÜÝüçH\íÖï¡`;+öû’ÿæ´6“ÈH&à°!‰ys*Ûš¸Ó!%_'eŒq3g ™‡ z‚‹%ÑtîÄçEô4š]ûX2 œž·rv'Á¡„>ÒäE ¸t†_Ï1o4§°ê8Q˜ØºK¸_äÛ½LHöThÃK1Xµ¤½Jq)ý åÀ)Έ›xeàšEïS´ä € ½ £Ûƒ‹ÈÙÀ§«y¹Àó¬QJ.õvØ•Ÿðpœs$;½ï%~5@T ÀþçYõ[–³ìLÃä¢ 7 }$ ²HÜ6–Êt #h€ý86k.±ƒÈÈfÜp «¡/)]Í]Ý2#S²´Âm¿BúD’^KSh+ûHüs’´-C ¸WìÑ!­É—,­™j—²JmÐÈ »Ì=Á"B¹ž³}âìˆÉá™…—%íÍÕm­j¡£…º»µ@3ª_€hmû#¢\"ÐvÖTÕgî÷Òe)g´@Ã<‘©y vGQOiÎC>|7–%UéÙxuª°OevèãÃR•ÒŸÐ- £Á:R!I§ëUÇï“$w{NVJÒ„Š/HÒ»³šwH’Ž× b&JÒ¬¡vkƒ¦êà&ûóÑjÍWß;ìøÝô¬¿]Å5¥JŒõˆl‡iÆJIúp¶@;Ë%Ù¾›vñJˆ²äcæÚb‹{´åˆ$Õ–ÚÔ;[6f*:xB~)ËT}V :;d/OëfËK;²@w-özO³…o»´B½ønêýD9©¶¨kÇ^Ú\ IåE[ñ[–^OÕíÁöî¢üs¾Sá 7¨«Ø²|HxI½oL”à*it?sü½%Î; /,ì¯ÔoêÎòå*ö:rïZ ’NnRàˆ%^Ñ–«ÜcïJ8ʯµ¨77Ã}È \ä>_ª Ï?Uä (ý=ÒY̺q• IÚíÖ£k¼m„/W±c³¾„/,cknh|½LyùŠ >ÒÄ»€Š™ûÙÑÞzôÖ>gz%O'’½Ð¯Š~6øvCšÁO?0e<@Îì&¬Åµòæg¹¨-£k8íƒX²•}1ùk€´'ALÆØ´kçnøƒÇÞcN¬óû³±ØË‘«æâóJZ’«ø:Rvj›­u•aürš.NL«Ê@Ô6Ïnw«š5LjìyÝ6¶ Ò×S’Êâ¥ôYJ«0ä13Ưöë.Ù;ý§uG w1q/$ôŠaå;ôYdí&¼{ç墦-…ÅD8U¼|àb¹o*š.@ñŸ}Eö/OrVÆúº¦åè<\{£6Õ–ù_ÞqEšãBÁ cn ƒ¡Y 0—À`0sc0Œ¹1 cn ƒ17ƒÁ˜ƒÁ`0æÆ`0sc0 ÆÜ cn ÃMÎ_PæÌù¢„Ü(IEND®B`‚suricata-3.2.1/doc/userguide/rules/intro.rst0000644000000000000000000001212713051004444015775 00000000000000Rules Introduction ================== .. contents:: Signatures play a very important role in Suricata. In most occasions people are using existing rulesets. The most used are `Emerging Threats `_, `Emerging Threats Pro `_ and Sourcefire's `VRT `_. A way to install rules is described in :doc:`../rule-management/oinkmaster`. This Suricata Rules document explains all about signatures; how to read-, adjust-and create them. A rule/signature consists of the following: The action, header and rule-options. Example of a signature: .. image:: intro/intro_sig.png Action ------ For more information read 'Action Order' see :ref:`suricata-yaml-action-order`. Example: .. image:: intro/action.png In this example the red, bold-faced part is the action. Protocol -------- This keyword in a signature tells Suricata which protocol it concerns. You can choose between four settings. tcp (for tcp-traffic), udp, icmp and ip. ip stands for 'all' or 'any'. Suricata adds a few protocols : http, ftp, tls (this includes ssl), smb and dns (from v2.0). These are the so-called application layer protocols or layer 7 protocols. If you have a signature with for instance a http-protocol, Suricata makes sure the signature can only match if it concerns http-traffic. Example: .. image:: intro/protocol.png In this example the red, bold-faced part is the protocol. Source and destination ---------------------- In source you can assign IP-addresses; IPv4 and IPv6 combined as well as separated. You can also set variables such as HOME_NET. (For more information see :ref:`suricata-yaml-rule-vars`. In the Yaml-file you can set IP-addresses for variables such as EXTERNAL_NET and HOME_NET. These settings will be used when you use these variables in a rule. In source and destination you can make use of signs like ! And [ ]. For example:: ! 1.1.1.1 (Every IP address but 1.1.1.1) ![1.1.1.1, 1.1.1.2] (Every IP address but 1.1.1.1 and 1.1.1.2) $HOME_NET (Your setting of HOME_NET in yaml) [$EXTERNAL_NET, !$HOME_NET] (EXTERNAL_NET and not HOME_NET) [10.0.0.0/24, !10.0.0.5] (10.0.0.0/24 except for 10.0.0.5) […..,[....]] […. ,![.....]] Pay attention to the following: If your settings in Yaml are:: HOME_NET: any EXTERNAL_NET: ! $HOME_NET You can not write a signature using EXTERNAL_NET because it stands for 'not any'. This is a invalid setting. Example of source and destination in a signature: .. image:: intro/Source.png The red, bold-faced part is the source. .. image:: intro/destination.png The red, bold-faced part is the destination. Ports (source-and destination-port) ----------------------------------- Traffic comes in and goes out through ports. Different ports have different port-numbers. The HTTP-port for example is 80 while 443 is the port for HTTPS and MSN makes use of port 1863. Commonly the Source port will be set as 'any'. This will be influenced by the protocol. The source port is designated at random by the operating system. Sometimes it is possible to filter/screen on the source In setting ports you can make use of special signs as well, like described above at 'source'. Signs like:: ! exception/negation : range [] signs to make clear which parts belong together , separation Example:: [80, 81, 82] (port 80, 81 and 82) [80: 82] (Range from 80 till 82) [1024: ] (From 1024 till the highest port-number) !80 (Every port but 80) [80:100,!99] (Range from 80 till 100 but 99 excluded) [1:80,![2,4]] [….[.....]] Example of ports in a signature: .. image:: intro/Source-port.png .. image:: intro/Dest_port.png In this example, the red, bold-faced part is the port. Direction --------- The direction tells in which way the signature has to match. Nearly every signature has an arrow to the right. This means that only packets with the same direction can match. :: source -> destination source <> destination (both directions) Example:: alert tcp 1.2.3.4 1024 - > 5.6.7.8 80 Example 1 tcp-session .. image:: intro/TCP-session.png In this example there will only be a match if the signature has the same order/direction as the payload. Example of direction in a signature: .. image:: intro/Direction.png In this example the red, bold-faced part is the direction. Rule options ------------ Keywords have a set format:: name: settings; Sometimes it is just the name of the setting followed by ; . Like nocase; There are specific settings for: * meta-information. * headers * payloads * flows .. note:: The characters ``;`` and ``"`` have special meaning in the Suricata rule language and must be escaped when used in a rule option value. For example:: msg:"Message with semicolon\;"; For more information about these settings, you can click on the following headlines: * :doc:`meta` * :doc:`payload-keywords` * :doc:`http-keywords` * :doc:`dns-keywords` * :doc:`flow-keywords` * :doc:`../reputation/ipreputation/ip-reputation-rules` suricata-3.2.1/doc/userguide/rules/dnp3-keywords.rst0000644000000000000000000000474313051004444017360 00000000000000DNP3 Keywords ============= The DNP3 keywords can be used to match on fields in decoded DNP3 messages. The keywords are based on Snort's DNP3 keywords and aim to be 100% compatible. dnp3_func --------- This keyword will match on the application function code found in DNP3 request and responses. It can be specified as the integer value or the symbolic name of the function code. Syntax ~~~~~~ :: dnp3_func:; Where value is one of: * An integer value between 0 and 255 inclusive. * Function code name: * confirm * read * write * select * operate * direct_operate * direct_operate_nr * immed_freeze * immed_freeze_nr * freeze_clear * freeze_clear_nr * freeze_at_time * freeze_at_time_nr * cold_restart * warm_restart * initialize_data * initialize_appl * start_appl * stop_appl * save_config * enable_unsolicited * disable_unsolicited * assign_class * delay_measure * record_current_time * open_file * close_file * delete_file * get_file_info * authenticate_file * abort_file * activate_config * authenticate_req * authenticate_err * response * unsolicited_response * authenticate_resp dnp3_ind -------- This keyword matches on the DNP3 internal indicator flags in the response application header. Syntax ~~~~~~ :: dnp3_ind:{,...} Where flag is the name of the internal indicator: * all_stations * class_1_events * class_2_events * class_3_events * need_time * local_control * device_trouble * device_restart * no_func_code_support * object_unknown * parameter_error * event_buffer_overflow * already_executing * config_corrupt * reserved_2 * reserved_1 This keyword will match of any of the flags listed are set. To match on multiple flags (AND type match), use dnp3_ind for each flag that must be set. Examples ~~~~~~~~ :: dnp3_ind:all_stations; :: dnp3_ind:class_1_events,class_2_events; dnp3_obj -------- This keyword matches on the DNP3 application data objects. Syntax ~~~~~~ :: dnp3_obj:, Where and are integer values between 0 and 255 inclusive. dnp3_data --------- This keyword will cause the following content options to match on the re-assembled application buffer. The reassembled application buffer is a DNP3 fragment with CRCs removed (which occur every 16 bytes), and will be the complete fragment, possibly reassembled from multiple DNP3 link layer frames. Syntax ~~~~~~ :: dnp3_data; Example ~~~~~~~ :: dnp3_data; content:|c3 06|; suricata-3.2.1/doc/userguide/rules/payload-keywords.rst0000644000000000000000000002050613051004444020140 00000000000000Payload Keywords ================ .. toctree:: :maxdepth: 2 pcre fast-pattern Payload keywords inspect the content of the payload of a packet or stream. Content ------- The content keyword is very important in signatures. Between the quotation marks you can write on what you would like the signature to match. The most simple format of content is:: content: â€............â€; It is possible to use several contents in a signature. Contents match on bytes. There are 256 different values of a byte (0-255). You can match on all characters; from a till z, upper case and lower case and also on all special signs. But not all of the bytes are printable characters. For these bytes heximal notations are used. Many programming languages use 0x00 as a notation, where 0x means it concerns a binary value, however the rule language uses ``|00|`` as a notation. This kind of notation can also be used for printable characters. Example:: |61| is a |61 61| is aa |41| is A |21| is ! |0D| is carriage return |0A| is line feed There are characters you can not use in the content because they are already important in the signature. For matching on these characters you should use the heximal notation. These are:: “ |22| ; |3B| : |3A| | |7C| It is a convention to write the heximal notation in upper case characters. To write for instance ``http://`` in the content of a signature, you should write it like this: ``content: “http|3A|//â€;`` If you use a heximal notation in a signature, make sure you always place it between pipes. Otherwise the notation will be taken literally as part of the content. A few examples:: content:“a|0D|bcâ€; content:â€|61 0D 62 63|"; content:â€a|0D|b|63|â€; It is possible to let a signature check the whole payload for a match with the content or to let it check specific parts of the payload. We come to that later. If you add nothing special to the signature, it will try to find a match in all the bytes of the payload. Example: .. image:: payload-keywords/content.png In this example, the red, bold-faced part is the content. By default the pattern-matching is case sensitive. The content has to be accurate, otherwise there will not be a match. .. image:: payload-keywords/content2.png Legend: .. image:: payload-keywords/Legenda_rules.png It is possible to use the ! for exceptions in contents as well. For example:: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Outdated Firefox on Windows"; content:"User-Agent|3A| Mozilla/5.0 |28|Windows|3B| "; content:"Firefox/3."; distance:0; content:!"Firefox/3.6.13"; distance:-10; sid:9000000; rev:1;) You see ``content:!â€Firefox/3.6.13â€;``. This means an alert will be generated if the the used version of Firefox is not 3.6.13. .. note:: The following characters must be escaped inside the content: ``;`` ``\`` ``"`` Nocase ------ If you do not want to make a distinction between uppercase and lowercase characters, you can use nocase. The keyword nocase is a content modifier. The format of this keyword is:: nocase; You have to place it behind the content you want to modify, like:: content: “abcâ€; nocase; Example nocase: .. image:: payload-keywords/content3.png It has no influence on other contents in the signature. Depth ----- The depth keyword is a absolute content modifier. It comes after the content. The depth content modifier comes with a mandatory numeric value, like:: depth:12; The number after depth designates how many bytes from the beginning of the payload will be checked. Example: .. image:: payload-keywords/content4.png Offset ------ The offset keyword designates from which byte in the payload will be checked to find a match. For instance offset:3; checks the fourth byte and further. .. image:: payload-keywords/content5.png The keywords offset and depth can be combined and are often used together. For example:: content; “defâ€; offset:3; depth:3; If this was used in a signature, it would check the payload from the third byte till the sixth byte. .. image:: payload-keywords/content6.png Distance -------- The keyword distance is a relative content modifier. This means it indicates a relation between this content keyword and the content preceding it. Distance has its influence after the preceding match. The keyword distance comes with a mandatory numeric value. The value you give distance, determines the byte in the payload from which will be checked for a match relative to the previous match. Distance only determines where Suricata will start looking for a pattern. So, distance:5; means the pattern can be anywhere after the previous match + 5 bytes. For limiting how far after the last match Suricata needs to look, use 'within'. Examples of distance: .. image:: payload-keywords/distance5.png .. image:: payload-keywords/distance4.png .. image:: payload-keywords/distance.png .. image:: payload-keywords/distance1.png Distance can also be a negative number. It can be used to check for matches with partly the same content (see example) or for a content even completely before it. This is not very often used though. It is possible to attain the same results with other keywords. .. image:: payload-keywords/distance3.png Within ------ The keyword within is relative to the preceding match. The keyword within comes with a mandatory numeric value. Using within makes sure there will only be a match if the content matches with the payload within the set amount of bytes. Within can not be 0 (zero) Example: .. image:: payload-keywords/within2.png Example of matching with within: .. image:: payload-keywords/within1.png The second content has to fall/come 'within 3 ' from the first content. As mentioned before, distance and within can be very well combined in a signature. If you want Suricata to check a specific part of the payload for a match, use within. .. image:: payload-keywords/within_distance.png .. image:: payload-keywords/within_distance2.png Isdataat -------- The purpose of the isdataat keyword is to look if there is still data at a specific part of the payload. The keyword starts with a number (the position) and then optional followed by 'relative' separated by a comma and the option rawbytes. You use the word 'relative' to know if there is still data at a specific part of the payload relative to the last match. So you can use both examples:: isdataat:512; isdataat:50, relative; The first example illustrates a signature which searches for byte 512 of the payload. The second example illustrates a signature searching for byte 50 after the last match. You can also use the negation (!) before isdataat. .. image:: payload-keywords/isdataat1.png Dsize ----- With the dsize keyword, you can match on the size of the packet payload. You can use the keyword for example to look for abnormal sizes of payloads. This may be convenient in detecting buffer overflows. Format:: dsize:; example of dsize in a rule: .. image:: payload-keywords/dsize.png rpc ---- The rpc keyword can be used to match in the SUNRPC CALL on the RPC procedure numbers and the RPC version. You can modify the keyword by using a wild-card, defined with * With this wild-card you can match on all version and/or procedure numbers. RPC (Remote Procedure Call) is an application that allows a computer program to execute a procedure on another computer (or address space). It is used for inter-process communication. See http://en.wikipedia.org/wiki/Inter-process_communication Format:: rpc:, [|*], [|*]>; Example of the rpc keyword in a rule: .. image:: payload-keywords/rpc.png Replace ------- The replace content modifier can only be used in ips. It adjusts network traffic. It changes the content it follows ('abc') into another ('def'), see example: .. image:: payload-keywords/replace.png .. image:: payload-keywords/replace1.png The replace modifier has to contain as many characters as the content it replaces. It can only be used with individual packets. It will not work for :doc:`normalized-buffers` like HTTP uri or a content match in the reassembled stream. The checksums will be recalculated by Suricata and changed after the replace keyword is being used. pcre ---- For information about pcre check the :doc:`pcre` page. fast_pattern ------------ For information about fast_pattern check the :doc:`fast-pattern` page. suricata-3.2.1/doc/userguide/rules/app-layer.rst0000644000000000000000000000374213051004444016537 00000000000000Generic App Layer Keywords ========================== app-layer-protocol ------------------ Match on the detected app-layer protocol. Syntax:: app-layer-protocol:[!]; Examples:: app-layer-protocol:ssh; app-layer-protocol:!tls; app-layer-protocol:failed; A special value 'failed' can be used for matching on flows in which protocol detection failed. This can happen if Suricata doesn't know the protocol or when certain 'bail out' conditions happen. .. _proto-detect-bail-out: Bail out conditions ~~~~~~~~~~~~~~~~~~~ Protocol detection gives up in several cases: * both sides are inspected and no match was found * side A detection failed, side B has no traffic at all (e.g. FTP data channel) * side A detection failed, side B has so little data detection is inconclusive In these last 2 cases the ``app-layer-event:applayer_proto_detection_skipped`` is set. app-layer-event --------------- Match on events generated by the App Layer Parsers and the protocol detection engine. Syntax:: app-layer-event:; Examples:: app-layer-event:applayer_mismatch_protocol_both_directions; app-layer-event:http.gzip_decompression_failed; Protocol Detection ~~~~~~~~~~~~~~~~~~ applayer_mismatch_protocol_both_directions ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The toserver and toclient directions have different protocols. For example a client talking HTTP to a SSH server. applayer_wrong_direction_first_data ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Some protocol implementations in Suricata have a requirement with regards to the first data direction. The HTTP parser is an example of this. https://redmine.openinfosecfoundation.org/issues/993 applayer_detect_protocol_only_one_direction ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Protocol detection only succeeded in one direction. For FTP and SMTP this is expected. applayer_proto_detection_skipped ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Protocol detection was skipped because of :ref:`proto-detect-bail-out`. suricata-3.2.1/doc/userguide/rules/meta/0000755000000000000000000000000013051004444015113 500000000000000suricata-3.2.1/doc/userguide/rules/meta/msg.png0000644000000000000000000011374413051004444016341 00000000000000‰PNG  IHDRz{ê‡ÙsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ ú!4¢ IDATxÚì]uXÔ[óÿœ-vi±» •î ìîÀîî¼v{í¸v*¶Ø×Ä ›…]v¿óûc؅ŸñÞ÷w_æñy\Î÷ÄÌœ9sfæ#"”@ ”@ üýÀ+aA ”@ ”¨›((Q7%P%P%ê¦J JÔM ”@ ”¨›((ÿBu“¿jþ߶zN(Š Hº0VÑ¢¹@ƒº‚JŠ£TçÍrÚ?~z¿Á?»A~Ÿ¢LûâÅ~/–Õ:[¤§@…×Ñ›ßk·hgKõOpîÏwý½"Q´Ú?ÐÐa?KÕU!+cÇìéôçÉ\Þ§}û {Ëü|AeR”›‰&åÊ“ó²ãª„NÜ6:øìW«åˆ›÷üÌÔÙÝýœ¹tÍ€àS—ÐoâÒúÆòŒ ¡Ä¤×‚]Ýí,À˜ôÓaŸ +÷ݾ³kÕü&fô?xûœ®‚”6 ½âÊ”6ä³ü¯æA³vi¦ µ¬ð&n1¥,£ÎŸä1íë;ú´I©wþÛæX–ó z¨FÏÍõv_ó 9YYr D e½ !‹‡ÿ]ª„Àìy>ÝÞÚ!bƒu%ëÏ JeV‚ð_—¶«6¯k›Ã1©¦zÂülËúÇ·-Jxú[È-—.œXfÔ,§‘Ï.ÜÛµeHè¹×9 ”™žÉô ôxD¼a;NŠ"]§ˆ yy(prYßå§ÚÖÏ mè“Q©Š‰ ÊJþ”ÖSwŽõ´žx7ëÉwíwfI/Ué‡[GŸÜ›?ÊOŽh=ýzLÄòƒmË«¨»u`ΌӲã¦%ñ! ýÓª7:¸!/EêéèúÛ…Ûb¶jHçí¿˜‰Eùã„oZåÄŽYþþ!à™™ÙC>åÈLwFî)Çÿë»lëXÿ§õ/èRïïš^vØ¡Ë-d*a0çàÎt4ŸV8[¯¸å€ÇEŠ{Æù?:‹~8®à÷å•Áí&_-ô™ÓÌ¡NàtÔ£‘(+¤oªV²æ×o¤(æ:.¿—Dô*pÂ9¢”ÆU"?(‰>ùÕ²9\/7ý¡³“cf.GÄu p»9*W©ª‡‹}p¸AcÇ}1DDY1‡œ½89¶ÊVªPá(÷‡Ogÿ&Þo‰ˆ’CëÚ슥ï"IDD™mœéÓbr—GX{çz÷’ˆè­W­¦W2ŠeòÅÉ|fžÐQ¿.npßè#ŽÓ,® MÅ®q£~Ï,ö3‘tÍÏ$ýz¡íª7Š¬×vÆJi^×VC÷ÞÖÅîÌ?Ÿîë9"¢ô`§†‘¯Ò4{{’GíÙ×r ʤžslî—©,ÚnBË:6ûâ þÎúpÈ©™]¬”ˆ»8vïj·éÒWÎYï£íÛi"Òҵɭ=cuZ›Ÿ½NPï)? àqA}gpë³âaC²<›%dsD´rpx¿‘ÅI2Qœ§½Í§,_ ³V× (è¦bÊrDŸ"×9wž cœjƒãŠéM]% å<ÓÊ&²”Ýr"¢ÛÓ  .³)!ŽâòþeÈ)9žââ(9,KŠO¥¸8JÉ ÞL†ñ7¶ºÙ;„÷Ü&¸ím©äiÍìœöŒ jü9S){²3ÀÕ¶C¯íü=}ÂÇe1Æ»¾"È·ïšÀð¡ófM´s÷?ü6+>eŒí™18Vœ3aÔ¸‹ÉìùIŽÍÃÃÛÙ¹ìy•Å ²=¬o¯S' lïàÝõ-Ç4Œ0& å›/J€8Àtßß½*~‹ôs¦4˜ÜÃMm Ê4 YÒ«ÒŽÉóòˆ4ª.H¸“ e ‹^»¥Y{o~¶¢€ \³é¶ˆãÜgìO:;ñqÇŠ˜ÖEëÉŽ´>ÔÏØ­•}]m{öéãjëÜuáÆ{½¡vËiÓ„ÏY´¨SKç~63†»+C½zí&0ŒÉ[Ú×¾ó5Wš<ß^aK:;û…´Û|æ‰.€ û"ž~õ+w–‘è&€1FÄ|§4{ºqÕ£ì]Ú—ë½Á«†1Ó¢¬pAât±‚i´@€~EO}Qn–L@‘&9cøÒñ2+l‘rnÍü ß¡yû)Õ߬ºK?ëÓp2yû9›noS´r]^ Óöž¸bXþ¨‘'>òó êУ[X€oH»1Æ:µ´]19¢ÏÈé3"ºØ¹uø±“½ºL9§X•Åˆh(UNÝXF6Ê'6‚…%,óþ aV––03¥M`i SÃä³àûîÃÒ%+B&ì\ Hïëè o€ñ„<öØoÝqßòºŽ^ÙiþáÎÖ– ñœ²,jÉ0wX_ùéÆÙ“Ûôw›êÝ}Zàå…¢¼þë0.â—ßÆN[4Ï"ùEów_¿]žœ7{<ûD„^X/¼«ÝaÓO5&‡.Yp|Õøù£eدË\|}:ìk&¯ù6Õ»ª)ˆ_ˆ=³']©ûž©DØåÏJ 5P¨|‰:ö­âÎÉ—™ù#´[tõÒB_ì8s¥óÆ‘lQ·ÇÇ™sßäe§!ã*›ˆŠÕÏ"ãƒs|Û¶ur±@C0"Ú³hÞe=eg…ƒÆ1eßus(êm¹²¾ª€¯~Íßö¿_U$½9ë¿õº})páÎ Û/V gƒ® ³öö—¡ƒ˜˜üÎâVýmÊ uxMó궫]MŒy}lÇ û9/|[MÙ×\’¯²ÅãÖLõéÒô¶M­T#÷xyµ2jZÙë³»æ¾9Ç©CÊʶ:ùVc `ú;O.÷m!+ew¹›-§ŽÕ,d/ž;[˜× B¯ÊÄQá€=ƒ‚‘vjÁÐ8e3+ª9ã†9þ6néñU-´èalüô ýfíô}íêî<{Ŷ«ëϺ˜Ój¿FÔéÓeîéíã €—ÍΣš³jÖ+¸öwGM§g!]§õíä`kg×1'?o© ’¾¨²¡;“~Ûw¼ÕyÜÜ¡[$žŸÍÕm!áçõAþèÔ#‹ž0ž,ƽ§8Ò“¯¡L;<û€¡Þˆ¼€10܃«_±çBJ!jæGAè)1`'ÖøøÙQ¨Õ°€¬dÄÅâC&@h¶´ HIkò¹}“bÕ2fMý“N›àò$¼xãïT 0ã° «2Uó¼®nåÞ‰—Û7´V+šÛ{¾ ¸œQÕPU¬ÀÔ!L?»_º¢¼©[ÉP_?<6°.Sž"Ò«Öáú…*o¾…]]UÙÚuí÷\´(Îeì¢ï^zxëĈy§ºº7´hÒ~Û¯“ŽCŸ†¹yãôãÕëHåÐ3š„=NY0k• ™ÃŸÛ">Ç×2óØ ]QFOÓ¾«ÚÄÎÖT™Ÿ`$úŽUhå9¥é<‡…WâÆ»Ħ8%«Ó̾–$7 ¾Þmùâ¾½üΞ“œÎ1’ñ‘-S›5³)€x††”#ËL«øJ2–ÝÏkcøË’Kƒ&lâiÅk Wm^¾zñË{ô}Ö¾÷Q¿nUòs[5 {ív%rÏÔm7ý-k0dã’þ™W®co[U‘»4)g”?Å „äR<Žã¾¿Aœ¨©­˜§®HÁ3ã©52fºÙL#0ÆôõøµœZ>7ZŸ©³q@ïés}»]èÔÂ^SÙ(^ÝMÂܦeôСqЯ]]~~04n?»ô ÷ OGõÑ’˜–¯noW_‘7‹XšüHŒ¢|“6/±?[®ÈH¢ÌÏé ”û6«ÀL¬M¿¤'×r´K½ézUVÎ_xkü¶ùÌcÊß&Z5¬¬…=TGÍ…˜ìˆn[Q§"†¸!ò5¾~D`5èëˆ}.hÙÇy4ä@ØRT(´†“!®<úú©;imù¢òà"\,hzÆÔ?¹”ý#êF–£Š…  D©‘’0j9 ¥PÀ E9ŠLÏ™¾iî“qºL\…BÆg"Õ„@ù”‰„BÕB>_®ÌÑ”.˜4rl&nhuþèÖáí\wŸíÔÏW”¨çêæ]*~4kÞ&€ì›•š½ÿ7Ò…ip2îË3C‹]SÿJz‡žÇ—Þ½«ÝÀ‰€–'UÃÙÓ§ìÏqvÙo }:÷½}NCÝ ‘»»‹ñOUÙ=ݺö˜»¢cƒŠb}tòË·x¢¡bʨýÆ.{fBä;é¶åó%‰±Ô _ ”dtâÅ­ªxðË6o9õ$£W¿™­ì*â0Ó·lÖ¼¾å—ШFÁ÷b{(U³‰‡·­ŽØ3ä]B‡ôßr9cyHŸ%wŽöøv,š8¾»—·QéSÈ1)ú^ˆLhi'kÖ¶Š_«*ýZ § ‹˜vaq‹<ÂéÖ¼‘RYš›½Œ!—}øz|GËŸ |Ã5;&yuïØãÊvMdMª6ððòþ¹ncìÐø 5 îË&Œ,e wwz» yúžÏS‹aQC&EL]Ùs}ëkÙ¦s¬DãÙiR¡VÕzª L*›€$o*­Ú·céÙ‰;ÑÝ Ò¯@:”ÍS¿†ú(Þ3, ƒÖceíu7ögÔÍ(+KkSéç/ •SûøÊç"k~UL³“’s>~yYÁL5Oòä¯Ä$ÞÏQTÒ^:c€Y©JiéÉj1g©›Ö®—à ^'&«Ê~Mø`mdÏNžÖ®Uh¶z+^•²e¤ÒÌoP±ÇËä]‡¥°|?œK\<ï€m×ñšœ5­Õ–Õ‘¿Ýûì\ÿÏ/ÿ©óXo“Þ³OòEj­"#þ!3¯ÔÃ϶\Y+ þóLy±^ Œô—dž}i¾Âc’•¤@6ˆL¼þøüùóW/nÕ½<»µ{KÇ‘k#í:L¸}áPÿöþ&zùH2ùç{AáƒTÍ— ˜Y õÒs•Å«ˆ1:6-<µñÈNuõû¯ý-íðȯRÙZf€\ª–­9{Ö]_ÒùU†R«*¢F­GÛ§Ÿrø“*™¸Ü‰§R–_º}3:::úæ蕽|·í?üÇzÍ°ZpßÚ)=WÜcN2öŸøÒeöèÚU*”)SæÜ.¿¾¢|©éÜ;éÝÉ—[¶š#à1Í­of›‘Yì’3iûoŸŸã=;#“p‹ÓiÔØu@=«ÞŠÏ³"²ðþ=’eßê¨Â7ö'·Àüˆu#ò°Ý0grùamcïŸ;Ç/­_¸Eq_ÛñSçÌÒFÿhÙŽg“©33^¯=zÅ©¢dÛ¤¥µú¬5ÔTnzF†ÊÄ“ç£]ê7 0Šïþž6yûõj¦«‘Dåê:(Ÿ„ ÿe€§(;&iïšM©ü+ý»` /ï]<Ÿ®àò÷8 }Üåwθ@×®tÁlûÜ.îÝ6¿¼«´ Ø§ˆ:™ïLdY¥a£êM¹†AãÙ-*wê1ÿúþ B "‰Ä—-to7Ƹ|5ÒW[¥Ìº¹ažÃHd׳cŽÍгû¥Ç^:)W!ÌøîžBûF¯±^kwosj¡ÐHMyû(ê¾j§M»zwOm¬ÚÌäÎõ¨7áuusäÊÐZ©]§ßÙµ˜iYÄ«Þ¤LÜ–7@ÕïÚ<;°°ƒ[e\ܞƀ êàÉ&x¥ày$øyaÝ»àÑí.`¯G±un…£3 ôQ)W<Úõ7«¢ðIÛL6-þm×ÞFÝÖFïüÝ<«‹K^l‘ÚLÞXõì®ß¶oæ›TÜxör5µ;Ù7ê×\ùdëŽ7åÂf-ìf£AäU[º¤×¶S­+Θuèò¾u‹öx\ÕqÌ¡žªØÍØ_f9±öÜ'YŸuGƒm ò¸Íè¾ì`ãÛŽžºªˆËºûÙáäå³æBÄ^n–BÍõc>ê„DÜöÛúë΋çŸë•½áŒ} s•€ò%e]œê©ú«H0ÏWe6ë9z9é€ÐÎË=õÞÙó,‘ˬ=t«~3wW–¿§I¼nR×ù'^™è;ûy|½~ú‹gù‚:žÎ T”®ÓÔQ`U”û¢RµÎ¬µpÏvý² ¶mõâX… 'úŽöõrQ¨ÛyºÙ ò!¿‰C§n·±2Ô¯@àù Z¼%͈ô&í½tv×ê3‘wsâ$*9Ý<7‡Ô°±Mùúþ̹÷Ž°¨Ó†õwFoÚ'$R-§™¹F o?ýpÔ“¾>*#‘Õqò•Òà–°´«‡íµ‹‘šñð:Ž¥U¯içéf­—<'ïl9iܘt‡ F®^Í…y:Á¨šÇò~^§-ºqäEàè¥ùQg0qÓaý_FÇ4µ®iS5ýÔ¹‚†œ<<„:X¢gï©êk0Fà[n¼öfšÊ*­Ò°iÌÛ¸Ó•pJa­u£çäê.á³¢–fﵧ³.øuÛ³–ýºU‘&N^xå]jS;+c5…j9ÀD­òƒFöÝ0òvu!´ƒì ‚úAM3Žž‰ð-ü‚`m£RQ FíRPº!üQÕ >xÛÓWãùK4펓saL ÂãLŒígi8ƒÉÕqJ–ÕÔŹœ¦µÐZ1J‚¤JÁ_ÁølüÓú†þ6ˆ^ß*tì¥?V¶KˆýéÇIßËõ{§Ù韮¸ :7GügQÚÒÛeäÉÏIY_¯ôÚüè?ʽ¸×ä‹Ú6--ŠÇQìÕ-a#‹Ý#õ#Ð#ŒSje¼%CP¥°ŠÏüm@œRÉýAOS*éûŠ²ÚŽ Õ¾»æúwclõ‚)1© ¦MoU¯}|ÊàŸÆXò£}F®Ë6t<êoý°…HßÊycb–µþ7kòälm™$¥Ü©ýä6&ÿT¯=\2zö.ƒê¡{m%:ä2N݆Ÿ ´6zU»?D6àeŒ½;`*#ÜøOõéObøq£I%?Sö?%¸Åæ?»ÿ+PúGTð¿¶ùFÏüWôZq8ä ƒ?Þ­…ªþçÆÕߥnþK´B[óÿ8¯ÿ),ø—ïû#ö¨Òï,ô5ÿ˜/}³´×Dµ³ÉÏŽû€1y§04þé›r 'òø°ï ÒQS|žú“P„!{ )cÙBýI\=O0Ènª7ßÎ[‰b1c¨í¥Þ•›ÆÐh†â`x°Œ¡óüÂÚ¤vLžKƒo)ˆÔ#EXƒ«Ã s€o„ç\ñèI%‚W%êF'Ì8ˆÄD¤g#ÄÐC\ñé8ÕaÀHHFb"’“áPÑ›°â¡†)^ËÑs-âãñù Ìr±²#æ\-0fîFf"Ì´GãÐ7DŸIšã^^ÀÖ¸ÛüES‰P=3f¢´¾n}ò­›>´­*¢bí—‘ë‘–ŠÔT\Þ .^.j…«£f†ÓûÀ°DðJ DÝè‰ÌÍa$†`0Óƒ¹9J™æ}ÀÜ ææ05Ô¶ðê>îìÄ[ Nglè XWE|$ }AßæÐ<ÕÃ)°9æý0­>¸³x‘U0hË510ÔíçB\Œá¨'Óx­ôÈÅ` ]7ƒ1ìê!¾–Åôa/ƒß(0€1x30†l®0zú06± l@¡P7íX¦®Ù¦úp3LxQ"|%P¢n~øy†… 3ö€G0Ý€nÓòwzú°4rðIZ¬jH8 Ø6£7Àþ‹;ÃgAúKô?õ“ôñ [=_ÎÃw<Ça[OÄ?D§õ¨7áælœ‡û±9+µGSàêi'à<`ì1¯°¯´}&\]áæ‚ZN#ê<¬tÅ×X}i©XÝ÷·`Æ~ô[‰ÃGÓk–_ ”¨›Ÿ…'÷k\ÿ„ ;к4rå`¬¯åãˆ(Š¿ñ¥O{´ê –9&ÏÐðD”°†êÀÆvø‘sÔÅB"µêàü\x~²/!(3σžCs“{Ä8HŸâ‡Ñ°}7X?N)ƒ\¹YcÁ*@‘W ³ ŒŒ1` °-D|€A ,¹%ºJÔÍOCYœ<óç`ƃ^MLïªÔ€ß¶Auu€Ê'ú*+CJ ‡`ä©8&S›9Œáep7´cª§N@™ û)ÛtTª<ÇÔÓ ËÛ@£E+¬^÷ŠZ—ÞvìSfc÷hˆ lª#Ü{>nÞÄÍh$d£°mbyç™l`€>D@zV‰´•@‰ºù“` ?xxcÃ@È^¡Ã0À' ®LÇ…wêQ7/ érø.…)P‘ÁÀI¾"0Àï»`ìv;†cÇptì8¤ÕTõ@´0ÅíùÅâ"}Ûj¸ó6ú˜Ù r Bsˆ³BÿþèßV¨[F#ÊËÀ«Š¡õðìW,|CtoÅÑ ådå„ |„±û |ª4ÀAP"x%ð? ?qà¡ALòüo¥Ä@¨SpÐÃÖ‚ŠüJDôä1@BR­íÔp¥ŽˆhÃ@u ÐøcDÙŸd\Áù•jz„šDD!&dä¤>Ù’öZ]¶Ñj-Üî/ €$údm÷¯2ɉŽy@㉈ª=ÙC9#ʦzÆP÷~T™øô)“Œ €~9£nñÉAŒ^9ZseTº5l@ ’…>T΃ˆ(û)„ÒÔ£+ z—CD´¼7TÃߣ(ÿ1ø™yÖ>2y=ÄøkY¹|½…Ã;0`o…×XÔk . §âökð жÚ8‚ ô^…º®X}J1º‚ä¦À²5:ZA¨á_ ‰¨xÉÁ©L+¨=/ãêXÔ ÑrT®¦mcÕBHí¬B0 ¬ÂL`¢¾­QÑêµÇœc¸‡L1ž¤aùT\}ÿ1X>BBn#„†¢Fµ?UÏ L« V†X4Fh[ó®[žíÑ'D×%cì¼MÄèy˜;<†,ÅËl$(ÑÀªdª+ÿ5øWbøÓ–âµí¦`ÐY¬ô.9ÔP%P¢nþ&àÀダz¾xr¦„%P%êæo4n4®U+±lJ þ,ü¹•)ÒñB®Ž¯øÞ»?ÿaWÜm¯…Uq1¿ÿZöO1¡Jà¿TÝpJ(•ªçÉÔÃUõ'c3°æºÏ0†5 ÁxÈdº‡kÜ 0çñ?4˜U8P^ëšÿ8Dê8´ =.ÿéІŒáÒj0†±×AyÕæƒR©z”F]!Çiµ¢©ˆ+ÈüGK´1cˆÍV3SBÉpø[:Sý,#ÇqÿMõ'ÀÕWÓéLTOêîXŽû&vQºÕ•”XëÿïÕ‹18uSÏòÒྠ¦ÍÀÌ!Å'Þ·š0¬ƒ “00à‡pR ¤@níB8c ë=ŒyŸD"¬{¨­ ÈEè X7Å|G„Š!œä`.€À]­•FxB¨ÑQƒ<½0 ½Š?áýmëOUË/vyGR]ÌP: iG!`ÔoðcDˆCpëðûö×sê¢üOhöeç_¯¾+îÔZÒéþŽÝNý|²ŽK?—–¶›­³àôžkN¾ýYt®®nÕqÚuíI„µ ”]r¯ØÿgŠÀÍí8œ¬a0aÜdLêZ`Yçèô_ ªböL„»~ÏÓ u’Š”¤§£i9Ü\‹ Á²Q¶ 2©GœŒØ×ÐS c‚-ðq Þe€Äf¦˜€U'щÈŽù(›±oO˜wYbº±üìŸòu¥æ©ø"Ò}¦–ÀpìÒg¡žŠ>b«ù rÑTÜ#NïŸi_ŒÊ)ºiù†Dxý5A!ÖÁŠâ/!ú¦©KŠ¯G;Eà £uóCPÓ†@ÿ`툃k¦Þ­ßÕEý±@ŒnË´%*bëp(4_–;Æà8Œau=0†ÈñêC ’jÈùöSE˜˜ÀÔ†F˜ ožââ&dÃ15¦¦(Sñ8zU´¯Œ?¶ ÐÇ”¦ß!99$†@ß#Ï"% #kªêét$CÖ >°k{±z+# 2Å·ô8Ö/€ Ï@Ƀ>zF`m Æð ¥Ë øI’ü IDATP¾ÎbŒm˜;1Y$Z7~ÜÑ+ ùO¾>0ÎéùÀáAŽ}W3FíêÝN`{ubUý†NQY Œ%¿üÍÕo4d¯›7i˜Í1"öþx ‹]‡>CÛxù÷˜ ¦LíëçíÒepÿîv®>Û_d~9¾òл¤Sç¯<}Ÿ1¶rX°›{ÀÀþ=š;ß«¶Mx¼Ôî>½{wvtr]ùJãp=¢~ ›r“‘|xHsPÇ!ƒz;¸x¬¼úAmÝÞéã׺Kk{·èl°„K‹¼m ð±sj;ñêÉÃØ+í» ŽhÛ²ÕÍLígQ7Ì4Žÿnô˜IŸ9¶qJWO߈ˆA^vC¹ {˜±œgí܃:öî×µkpT*XòÕ¥>ζý‡EøÚ;·÷c ¿o­öä<žˆhSS¨bOúø‰ÚW&€~ÓÞw;° AH™D²4óß  ¦e “É´¼´ìCÞ¥õœºµBwØ×™8ª ’j|5Á…ˆˆ¤T‰%5lFci]ÛïX…À(“hr[èƒöžãì—4iM™N†sœ"9)YÉqDÔ·…ݯ—?¨J®æ9jíý¤§'CzªRrãïŽzMDc:ún½þŽˆ(ëÝŠ_~M'"¢ŒßÏ9ø¶!¢„“}íÜäDDYw—×·éšJD1Çk:õ戢–µh?õfNâ}G· 5©ÏöŸ}LDSú¶Ÿ¸A•¶k„K×ù÷¸¬XG;×'©JÕ+a¾¶‘/“‰hLk›¥ÇÞªšàØ Ýä«š/Pü^›¦}sˆ²®¯®ëÚ?ƒˆˆ” ÷7óþP ßïmœØbŠš±q/.¿«ÌIr±s~˜”«bcx€í‰Ç ôqWƒºvç¾pDÿàˆCËîª"1»»;tÛMDá>vûïƪçõu±ó)Ýüµ½wpï<ü”ùÜþ_†¶n(!sQXÔb}V\€îÝ ÑÇÂ3HNF µ)‰¦¥‘ Ä—ÛÐûÆz2 —×£‚5–Ž€Øäo"ô ï$ºîÆaæ~˜A¡#qÁIôü+ @Ï@YÓb­Û‚Åo ÞIqb7lðèŒ * €ÞÁ9 €iÃ`êF0º²`Ö,̘ŠLWvcÆ,ÌS<-ú3¼x¦›-VM@„GÝ ¼Æ%1p\ƒ‘÷DÏ̬†¾*ïln~âILW:Çî<r¯^ÊÙÞíե߀ìÍG²†‡YƒñÍJ™ñ>|ˆ•¥¾Þ»wïÞ½û2%ÕÞ>9SªjC“·{ ³ûÄe”nâV]Å*Žã‚~å0¯²³† êÝ«×é›ùy+­Ú–€¾Mˆuîƒ7é…‰Ñ3®Z!;¦sÿˆ­‡"³Mê´Q=DÅÉí\T=a]³´2-)3ñ1Äü'§÷íÝ»wïÞCfB“È—Ÿ€„—¿Ë›8T0l¥ý$!c€’c %uéE 'C žEͦ\â‘ßu󽡿wÊ‘UÇN?~ù¡e-WÏÆe²“+õøÏÎØ»wïÞ½ME¥.¼x“Ôw,Ë@Tº£Å‡—×rRLYójô¬VÀïqi¹qO/©(W~öô²j&7­ì¯–0ÆËãv‰3õÃë(Ø¿ ò/ð] ã£4ô…`ffå ˜¤Úà2TíÇ£~c¢y.«ÎFâÒEó WcÛ@•ªpô°ÖIôÝç´ý~%”€ ï•5‰ (òA Õz‡'A`ì>"\Û(áÝD F&pzßNmÑ|"æíÔ’òbÌ‹RÿþFì1(e߉k|SX9¥ŒÇDù±/='·\X›/Ç.!ýÆóJvUkÔÊyy9q -‹4ë•å*E††úúúúúúzuœ‚tô¸Üñ»×z»|¼¾¯q]»©_k¢”rk»oïµ}"æÌ›?sLyþÒœ¡y^µ"!O‘[4‚-4Þ=¤ƒoò£SõšÚr[ÅrOP@)q9ŒIôÕ n9`X‹zeYŽB 'T= DX+²s•b‘0{<—žSŒô—s¿xùH[׺Ñû6hì¾éF*q9 ⼦õú mTIÔïØó,Æô°\±ä–"ëÃK¥Aµ”£äô ÔEšø„õuVG×ÅÆ%ûµþ°ºl{ÂÃéúd ·ž —6¢A=œR½mÌÇ—+˜Ò oÖáòç`þv)¼½àâŽ} {…®Ë 8NŽÂxõøâ‚p_,»­1Võ`¤ä݀ѩ= Døu»KÛ"k “Z1¬{ ÎÙ¸ð„`@¿½°ï NÂésèꆸkx¬qs ȳ ôÅÝ38tR8ˆS·ÔgÄs9”®¬›P¥oÞ ö;÷WšV‘f§ z©ýnr–S3íšJ®mÝ}½ys \hÙ˜Ãî›Wn¥]´j)#iæ>-[´hÑ"ØÇÝÅÕÑF–û&NìäÕrììO®N=;sl¶Fßܼù¤V@ ÷†Õ-K[°´‚åªÞªpùKÑ€®êa”FÕJ½z£NÌM¹ŸeäVµ˜ÀZü»4VÆ#(læŠÇ—·Þ·pŽqÍ\’ù«›v°±u¬¡ØçMGhÔzlÌ•å_NÌ4ö˜"ä1°b©‹¿ªˆ‡‹“kóúÚ1e* ÿ!uCÀösºy¶h$@7'tn÷>ølŒ€¼+y¥Àô[ñàæ Ù_º3‚akÑØ{†#*¼J¸µò 4·‚¾1ÃÊ«pì†!͵µ7ÇçßÕfHàrTâøH01D #¨~é"DL‚!п Ì+ jÔ€¨í@Þ§¢ÂP´õ…¿?|½1¾/Œ›­CUö; =2? ­[@vÚ¶Aàà#he£›Æ„g¨^A¾Í ‰UÝ°ŠŠði›nß»wlˬ{™–í›T`o[oÓÎMÝ\Ø·i¾bÞ:—Pî×Æ¥Ë9@Я縑#Ï_¿}ý‘Îî¢â“_E¶jÕîø…+·n^[¿|»©s[=Àˆ ®\Šº|ÿ}³†Už_:åîÃÈë&o‰•¦g]}üŒˆxFÒyÞ»w{æ€y:ªPX¸XN⽶-Z8u+úÆöe›…Í[”ÒE‹Ð¼Z·ZÂV#¹vëÎùÿú„<ŽË„~öëg¿|ãÆÞÓ/ë—Q½ÌqbB—‘{Þ1Æ`XF/÷÷ÓgÏ[„ô¯û~Ï”ÍÇÜ¿½zÚD=»@gýbòC+ÛôŒ¸pùFôõK›wž¬ìÌŒ*ö¬gÐfø’«·î\8ºÕ? øÞgi¡Ø¾Q…ÕÒÞNÜðfÆ8gzýmGŒ¿xãöµsÛxíº™XÈte\ò¨¡C’²ÿ×CÅüiÓ¦}?×ç·¨h‹ö`€qHÞ LØùÀµÞ¾AæscÒpP ’rÐq(Ž¯€´(+#´ø€=§«Æ¨œ'cÊ,¼N…³\ë!ý ƒ2ï³áˆj'¾‡¸Z‡‚Ïáí{ÔkŽ6^êKȃâ!> ¾v(×ÓÆÀ€¡T4qÄÜM˜ÛÐ~[*þNŸ‡ó8T€§‡a“Qņf¨gƒp`-ôU«cÖ˜0Vˆ%¨X­ºâøTãÍ.ÄbÞDT4U«<‹šxó eLäY˜uî>¨f¡¡;>°‚A üþ¶ÎqÆ–p}% PÎP‡q§ÌÅc·D×Úš©±1q=¼J±œ‰Jo÷æŒxέ»šÄÝ=wå–Ô°öÚåSø°*fì}†E—N®ú€‘‘åǯî"ÀIïÜ}bïì¦ÇGU»çòŠ3ç.þ›Õcò²Ð&æFÖ:8—nxꀠ¨IùÔ¯ú5;x:1ªéÜÜ<óÌùKoãåg­ð¯k 0YF¬Ü¨]}ÕÕ²£+;¶ía$úŸ¾ÅñïÌd ±AÓ¸³ùŸG†1è‹m…ÜàÕ6ü%ð!æ%οãïÆâƒæƒûÕÔû¶QÎ~þÓ_ ÊŽî6œßcÀÿŸŽåü¯Ñœ€ñ§ñLŽ:“‹£à¹§>À¿¢î ²4l?ŒÞÝþ5ouÿ¥êúÇÞwÎÍ5føÚû •²¶ƒæ;T×ÿ¯Á²DÝü[ œ‚Ç|ÿÑ¥ƒ’Cçÿéþþ§¬›~0T\8®þ“Št"ú¹Ê~6ÿ7u,Ó í»ÇšþVm_Ìï¿–ÞjŒëú‹´Žb¨þ×J!Ò}Œ@ûôéNíWžIg³þˆÙ‚Âê:¡•å¯¢÷_«n˜ì}ïî͆°ìǵš‡È~Ò dŒ¥ŸÔ(l+idŒmà±æ)càŠï*ÆØU-‚Ç]ýãÖ(8¥Rû7cìýÞŽN}NÒßjåêjú»ôžYà×iæíÿ´õM ⊟>õIJ§ý@ûÑùC»Ïÿ-ûÎoMZ f,+¬A#ß.ë˜ê<À µ¯ó4•1Æžîœm×scŒÆèåù­í=B:¾ý)]U„±—.5lîdªž-c\ú[—FÍ\M-8*Áž;ÕóH`¬¿{­#/åÿ ¶1Ædwd1ÖΩÎO¹ `Œíœê·ðÜ»Võ„ ØÆ Žž(üì|ÈdŒ±»«G; Z‘OïãSÛø»988¶î>üA¬4ÞÇN5›=ÍVÓ«LzâØ ÙÊÛ™ì_¯n®o^ÿ©n»;§–#[!àóÿPÇðüÂm…O=9¯W€û¥•ë˨öﾽÓþø8bx°~ÌìÝ· ¥Wj³ùÜ _ö—ŒÔb¬bx²mÊ”Í×~ª:ïá‡7±)4MþÝ“1ÄÝÞßqøöŸ-·«›ûÍ4­ÓafFS‰¾@_¢'ш/e¾Ùy ¶ÀÚà ê_<ŸÇÀ3¥¥mÿyfl9yåÊ•U>c‡ì~¬:”'àóU#91¡ní¼çãlªÁc=¡±èéŠðwvhLS ‹Äê‡'Oävò)ËêÅ?Ø|<© >_ ²¦/PÓ›5&°yÄÊ[ówž½zåò’þNCÂ|Gy«¢WÅ"éë–ž][¯8=¸¹á¿Üº‰Ù9eÌîkÒ[û\BFA¿ °šòèHç?_ŸÀ›Îptæà±»®ª>ý:ØkÈôCª]ï[»y-|”À÷Ð/Aþ>ÎLÊ€ƒ‹:ÎÙ÷vO×#)¼Á¾>sÉì_>1ÐßÏ?¤ã¾;Ÿ²‘þ¶nIÜßÞ»ï‚;r?_í×±¥¯¯ÏÀÉ«¤Jr>MÜÙÛǧ}ï1/ÒÕCSúæ|¯¶¾>-ï¿ fûø!;ï\Ø<±ã´õš~:>ïÖÓÕk»¦¶Ÿ°ÀÛ¨-m½ýB—¼×.­ï±ê1r’¼üC3¾Fú{Çf)pxÕ¤ _ïNƒg'*@@üýcžíueŸoèìÐzKÔ+õ¨‘§ÌÞÍÇÇ7|Дxr®Oõ~úÅÙu-ü¼BǾÍ@Úƒ­G¯‰{¼µexUU;æò÷ó ë9ú³T ~ße¾4å÷3m½‚B»]ÿJ.ŽôZÿ“ÃG_Œ=;¹{Èœ³Lô ê $"€€#ÉÒ-£–vjME!x~vÍÔ¼xnkmK _ (ß4äâ¡Y2>æj¹? ݼ‚ëß5ÕߊHÓ2äx|D€›b·à|š&W’NóuéÊöYþ>^íúNËïåç§×¶ò÷nÙqУ4H>8ùÆ–)½<#Ž‚1d¼›Ô¯ƒ—·ß°¹Ûòô·¡“WïÀ7ÌeF<@I|=ˆ |ù{mGkÈœÑâutéÌX±]|{ÿÒúM#O¬¯n®Çã *Û‡]Ü?µlÊ…¦™ˆÏážmfån¡MïÿKû; ”ÉN-Ùzò:¹TJÉ÷ëÚµÊ!JyºÉÉÑ7&!955eIgïÀ©géñòúaK‰ˆ¸˜7Àvˆˆä©®vnqJJ;?ØÑÕcsÔ³ÔÔÔƒÓ»7ï´˜ˆ¶Mô¹ö©2ígc—»i9Ù îú”  ™§“SSSSãý›üv;(wÿŠù×?ȉèÆêàÐñ×Ù_\_}IHMIy´sx½Öˉh¸Ãuߥ¦¦~zp¼v³¢ô7û<ßÅ%¥¦$ÏhëÙ}ãâ¸ÃZMÛt!;;G“À÷{;¹ô=I”åïØôæﱩ©©¯ŽÏ®å;±~p¾ž..—%gfeKc;¹7ÜH 6u˜s0%9…8iw§á»¦¤¦&ˆr·³{'çܲÑm'¬>£xpd†{ËžIi©©É±ãýšv^ó¼8ΟYÐeöm’%5·sjÓ{E|b¢‚h^^K¥¤¤<=<·ž[?)QFÌã%ëwB’2.º4t¾õ.!5-aH+Ûù{’âsh³¦óϾKMKûx¿ƒ«oz.§¼7ÉÞÉå`ô[©4ûæúqÝѹMƒ: \+ÍÌ"N>ÂÏ­ï†ë)©©‰¯OºÙ:¼J%ú¸³qSû9;oeI¥o¯ínî×™ˆr3“B"c’¥¹Ü³ãÛÖ~NDœR¡PrÄ)s ¢ô°†Ž9ZÝ¡y× /UX¶vªÿ4…ˆèÉ®9½fѶž6]fFkžvå Ž`¾t¯Õì‰L>Ì¿éÈM·‹¼%ârs‘"7—㈈;¹vAä+ÍÓ·”9ØÑÙõô㘬¬¬k«†4í¸€ˆ®íœä×qLJjÊçWÛyÇ()óêPGÏVÇî¿KJË&å3ÿF÷Ýù”––¹~œg·qªaqmë/»n'i”ί±ìQrp=çWDKZ7é³í=GD”àÐø}&ÑÝ5c¯$¢Uüå•ù4qD]êؽSHûû4™ºç‘.zÿG4y"‘¾HÀê %µ× 캺æð­å-ÌŒM"ÖŒK:°8­~×*¯¼S"ëÁ5¡mp³”q@vÊ;NßÚ’òÜZánuŒ[M¡wgßã<»›'1d`úFzb>RãSäI±f&&&&¥·žŒnÓÔœHÐfð‡ŠBLÆ„é SÓáKîïPVŽ2Sª411)×(èáÕ}zàöŒ›[ÒáÊ–¥LLÍ&ïžþlùü4Æôø<¡žD,Ö¹G#WA™˜˜Ôšðøø´â­VnÌŒnf=I?gÛ ×¯€ÇË•I†Œoebf*þ’Åš›Uts¨Xjÿ½×ŒÏô<¡H_¬‡ý+v{Ž^QÊÈØĬ̔u#ÞmŸ.ç¾O&6â—Á¥ÍÍùH‰zövL÷ S“º!£NlM Ë×èÓA{þdçf,7é9¯ye cc‹9Ž„{Vþr3êK¥æc|*UhR-7k÷ÛlÆxÙ¬Y m±Xlçg“ôêm. ¯'à Ä}YÊËÙ¼u½LMLÌ«øÖ²8yçËáªôo.KªÔo,MNIC oh( NP—¾~µ‰ˆñø|ãå;àDè÷ë—›z’é¦ù}LŽUýj V8”Ë„7¹}ÀÅX~¥JåAE£mL à3•Æ@Äúöª!!m^ʨ±Gýò‰Äqà Ã{ŸmÜèÜóT ÷îÞãÙþNNNNNNÎî£32Ÿ&Ê¾í¦›lY>å×.v®>Ý{|™¢`Å^“ÉU4©F€•©Ñç´TðÀé—² Ëú,˜ñbŒ€Z¥$Ͼj’šñ⫨Fu}ÕWY-†OÊïºã<~E±ªéOY2cC #ÆA¥êÕôyQKÍ÷>È«U1S‰­¡¹UùÒÆqÉñ¥LK©s2^=3zð)‡d\A¨"†Ïiá’+ýÄ”r'58|üáæÛxð§on¨*Âã1*t'(Ó‰O)â [ÖéÔu©Î¯eÌùIïc5ÏÖk^¬E Y`Ħkû¦mÙ.2î;{8´®fï•m"T£WÚ\’š˜–ö:N\±<Ÿ˜uµêf"€¬¨6]>ý$•^XªfsÐg.ùúGÊ ]©|~òmƒ *IB“š{UèÐu•®E0VÚL“ A/iÓ+›¸+jûèeî%ýö¬ü±-ÕsÁF)Ê\Q“¦• «ìžÝrL»öqìÀôØ<9ÌÊ”‰ Ć–2Uh²4?Hbe$(6)O®=zñl@•bl°Ø³ÇKù¸H´émÜkÉëmûctÜkÚ8ÀóYÔ¦|z Œ±ä鋷ɹ¢&¬Më·Ý<ÎmX»nÉìÿ½Æù#ê†ÂûÚÝZ:O5n._.mÐ¥¢ì[{ܺ¸÷RjcC”«ÑðëÃ_÷5 )¦:g’pàC6ÄŸßSÚ¹±DÃWà¸\šÝ¿Ïå¯ ¨T³QãJV‰ii÷öéÃøL.//“¾;ÚoÄ&†æÖ­}…ÉŸHöºO—ñiOlÚØÃß"7;.áƒ\®Ìœ¨ŽjßÞ:tþIÄXžG¯n^|+/ *ñB¯ˈMÊ8†úë§5¿òæ/ÚrC¥_®=ºmW»qÁ$–nÀON=£2}S.|fSM½ ¶nµn£JòN.üEd;Pôk}åË›þvùc`)7›T³’Ër³’=SHð[÷vyµaYÆ6mÓyÆޚ͚g>xx;SåQ¼¹›Û½¾¡î[îã”2³º’ô´=ÏT'û1ü°ûŸ2¿¡Gd!€Ô˜×/>¥~Ãè bÛ¶Ž\Ù³o2W˜òf-†[|¹ÔcêúTp©oÆvz”a"ák-Õ=Õ_/,l c¬øH1Ï}I+|•¢(éÐ;)ÄEpª'æ{ú×>»qc`,£E“†bµ8éßÙýíö ê`uÚó#æ(ÀŠ{ýä¶ÁÌ€#—¢½<5çƦ·këÐ…]úJ‹Ä.<;Dè¿:Þoö–  Ï#Ú´xcž²Jµ§Iûi#sÂ:Oû&½ÿà‡íUÈs¤²\Uà$#S  zØò°GC=ýÍDra¹¦‡×÷eD(Téù¨t÷ÑX©ªu¾>}Y©*è"ÏHK¯±vPÇ×Éi_Sy –¯òœ¬l¹ópg“vMœ¼Çí=Яw7§¼RL–Zº®ï²; gr¯Fë>Œq3PÊ¥Y9 ýJþU…]¶—2'åH†o^i¨W¾µ‡^+g±I©ÌÌlï!ãm…@ÈâŽ÷‡Û:ºYšrô«Ì[¹€“cÇi¢¯w>±jäÖˆ®ÒQ÷–¶)ÍåJ³²Ì" ©õ!gTg8è IDATgWSƒ$)¯û²¥ŠU·Š.en…µ^•ðñCY§î³ƒk#ásF¦TÖbz¥ŽîÛ¯—Ó:ýÒ)qÒ ¡ܪàîèÒ~°{·ÚŸ\·îîÁ.ÞY¶Y}ïc¿´dÅìzUȲ¤9J€23³ò·Ämúu^ß}æAAzÃÖm®/Ä—Û§ÛO9ñúÛ´~Ãü7“YNrbÓaõËâCnFfv~ MM8OÐÕ£Òg‡fýÖ‡Þ1Ë`Àý¥­ ~i†zÒ`Œñª´í^oãÊ *EÍÉs²²€$ewŸ?5gÚ,ÿ¦u²8¾Ø¬bhøÈßú‡‚ŒËÌÌTªvª…LX§‡÷€•‘k×O‹»øÏx:#ÐL‹«µû¯Òñ÷¤´ÏI4wùF=P‡q« jc·QD2¿ž3ÛX1é«œL©\ÅI^NËFÅöðt›˜¤g±žcTK®½‚/¶;{jpuºåN½;¥ Lƒ^‰juêPiÃæ[*ÏS)ÏÉÌ‘ ƒÊ¿;2{Æ\¯Æó²I o^¹Mç‰K{˜2+#“Ë£·ãÌMw[y´Qþø’Þÿæ•©ü€xA؜ӈ käÑùãtFÔµ*+¼ ¡™‰£BÙŠÖÆ]¢Ð‘Èi­wpÿàÀ´›rÒD´HÝ+Sd:)ÑYNÅ›â±åŠá:§ýY ]\ýôË´ðÎE+(RW,Û4Qä¸o1V›Øbå¡HÙ¢Ô' ÅUU¨®¨Xaû‡‹›ÝWh­LlÓn[!¼Š ZIýUT,5²s…~ÿåôþÿ]™úë† þ 2¦™Ì´v·SGe¬¸LZ•_—f=…Y!|Ü|>²_khZ§4iá͵|KÕ¬®“]D¨yó l¹ìĘøÿcï­¢j¾ÿñ3Û4vw'K,ìÒ!(ˆb€¨ *v'6vw'v‚"*  ¢¨HÇvÞùýq‰}>Ÿ÷óþ>ÏçÇü»wï™sfî™3çÌëœzѳ¨¬.ÛÔx²ò¹Ú#„@–—ÂpŽ¬‡þA³¨Öµš]Duµ±èj¯5‰êq»îLh¨Ñ:5¨luZLy_4y U£¯N?j„Æú³²–ºþT¯Y%úïÑûg3õ²8MZÔø ÷ά»“*®+ ¦÷0P“þŒZ‚”Ç—m{O©=‹Ú}NlŸ÷'Ï3Û- M¥~ñžR—T½nƒ{µjâÌÿ«Ò”#¼©4•¦òOõLáŸÚ×jç]k0XÕ µ?üA+jŽ¾×ÓÖ·K5ôUMæ65?©ïgÃàãF­d túßbåk|Èþ¦æÔŽò¿œ“MâæόʀpùP+7„BHù툩¡Ÿ˜øµÍ8»ÆdÔr„ $Ì?+x˜¥%ÛÒŠ;sÝq±×Ü¿n··6‡ŪiEöÌiÖ9²•+},ÙlŸ‰!Pˆv/±´d YP$VÖßö**¾Ïö1·´ Y¸K€:=ΑmÅd8N„BèÙé(s#ƒ5× ‚”«ÛœmÌÙlîªãñª_ѯ!4ËÛÔÎsR®â׆9ëâ¸a»¾”Ü1ƒÐGv?»"„&Úõº’þ‡àc„~\ïfLüoöÞ°R®$ˆÿàKýÇ"Å‹=£Ñß Ç„L®@+m­Ì2ËåjŒůz™z+ÂËdŠ&±óïY³þJùðäL_ìà…E_÷\ÿ¡øvÔÒÔ_¬úuCFÌ:‹1+1ÆeïY¹$äH‚ TÊCS]Ì8‘’j³~y¼™Ýø†g¾©ñÌ؃‰ô€õ· S®=ÏR\é5ÿÀ[LË–8ÝñŒ ˆ’ç;ئ.eòZŽ,Éà4ŠŽÍÁ˜x¼}ŒS$A:M„ÍŒ‚…cüÕ¡¯E²cŒOpò™¦ÀX¥s¬üv×Å.Z3:2úJUÿ䋸–ÏŘPÊ$R%Æ9\o>ÆÓÜÝËùcöý¸ÑÛ:Tõ¿0ìß›ësâEöÊSP¿ÂJÿ—zøœ\"Uü­ž ãòÏœGl%»"•JÔ;b |“”¼µuúÿ}¶¸ÿ{ií ‡/åÔæ4QÅÆ ïüÚ6rç·OO:õ°±éÀˆB Ù~ýÆÕ•L\iÖ¿¾ï¼çáþ.7v¨¶ÛßcàŽÙ‹¾\=x¿¸½A·_§ô¥yn«:b €š›OéßRöðsQMÏÀׄx¹!wŽcŒ'l'_g)j;†T"1³kO-€výGl>°…†1…¦½y™AνDmU¾[û"©˜ôd‚üXBÏ\ÊÌv™r@Sµh@£kh±ÂÓtÝýò:Zšäóýq>n\W¿˜?êÐø"fƒ§£ƒ“³×Žë«uºG'£=]ݼwßxMÞVøöÊHogG'çÙëO`€´uþQ‰EçupptŸs¤º¶Ç[ýF/Ë8ä•zeãtGÞ¨é›$DÕnTôcYX —ë¶t€äüÎ.®b®®0ôøó-‘NgâÞ…ysV_)@?žœæÆstòˆ>ýŒÜ¸(S·ÚŒÚC¶xmÇWž«gÀù¤<Œ•"'g¡,gj ;—ë¶çþµ[ÉÔK[½œ=7_|SMõÝC+ܹ~ãþøó×àåâÜKÎÃT¾C=HJ‡9°Ó‹UdÔfùÇ+ÆÎS”’ [P‘ ËÑwæßwtp»:ÃËgKruk›#]6^È(H:o0­I¥ø—j7Æxßxç Éñ®Á»0Æh7üÌM­gm¿"Ws¢AbÓ÷Êg%.Hhæ[¡¦éPÛáÖ„nºýc\©Ý`œ÷æ,×+¬ú¦“¡n!Ók>™y{/'xNåï*©¿…Õ‘,)Æ Uj7Ê÷lƒ€Š:‡ùþv–Û^–ÖéGâÑå¡Q§+3º¾?ã´c\|s‚iÐ9c¥RYù—ÀwöozY |Œ ¯Y9dä• E£ÝÍÆ~®ÖnÞ]›gë^Á¯¨(- ´²Þ“V1NßΙv€/„QcØ‹N~~~læèWÌçó+ÊŸl´œxE©PDø:IÈÀÒ4‡f¯„$!E^ƒ,ÄøóÙQ6öNoòËÅbñí%¾ìI§1Ƙøäa`xây®@ L:·Únx8ÆX)Éß±sLE¨är²B×D:ÛyNÿZ.Éð§Ñ—ÀR>Ÿ_Q²bˆ¥ß¦×cÅ‹UýÜ7bŒ­ô›¹C$àó >8²¼VŒ±Rlmeí~¤B$–Is½ÙƒŸ~—ÕÑ‘¾>\ζ^QQ^lo»åe>ÆxïÌ‘£VœøYq‡ú[¬À8åê<÷Ä"A(¸«Ì Õ¢an«c+úâ扡+Nã’×ý-ýä{¼ÒÎm©@(Âüxkc‡b9&«>púò2U¸â[ê¶Ã›tŠ©vƒ€Zìgb½Ü§Wãûež¼Ç÷h¤0dhïè8zZ–„<À¶>×õ÷îA…Öì°>_WŸË«móC +_tb¯ß‚-ìVµâ–ËÅetŠNÕMÐF•‹j*$=-ÍÄÏŸ\ÌT âäߨ”"aíƒ3’"•E«>¼ *sèÝo±+ÃbÔ4ÓfuŒ t*µBVyfÿÍɽ“ky›©T*"ÿ"À¹L˜Éë©QÓ¼yyñÖÓvõn×LK»åÎcW]ïcês9PYm¦D„1(ˆB§“2 À¶ÞÞ]õ´4ªóŽ±gïk¦­­£Û|ɹygWŠjè~ó\Ø4…E§"Îþ}„ž•‘cµ6HW“Å`¶oÝI'/¿¤ŽÞÚÙv~BÜQ}m&¢ÐƳ<ù ŠML‰˜8J[K»›ÝØ{§VS ÐdÒ…®¡Y±œP.œf³õ* ¸{á‰sP TÁB55è€hZšš cÛ£"þSB(ãô-Ÿ žÐíb0-Ø·É÷úÏ)íÜ FLK{[ŒÁbˆSƒ±å*'nÞyÐʽVò‚¼ÜÔÛ»FØq/=¸ßQ‡ºõìã^íºoݼI…)Eú}__Z þ;jµÂhcÚ0¶‰v­¾2µU„¤úk¹kéi>=¾ùÒÛŸPšy†ùÛ_=¹pRˆE´RÓqÜ<6EÕAÿ—À*y¸Ïåµ%û÷U‡ÞÇÔf>}¥$á@oĖس3¨5„—iÀã™SFÎ(=½%|×êþµ¬†ÀµI€äoD¯ =ò¢nËvºP…7ú™2gï@Žg×–Úyy˜ˆÀdþÁ¹;WZ¶ìÔÓØÖoíœ@ýþNGçåM²(Óéڷɦ+j²c|€‡åêëKDz“î0ºµ²íôvšŒ 2óÒÄ#VV‡É~ Uü„o`Ñ[„²Y³v@œ–Kwì­CÚö‘~o:%W®„jˆkâÙ >´wqm«¯ñ¡‚A'_~-éˆä‘@q~ôœ%EÀP!Ý%ÑKTWGOÙÒÛÚ³{kÂlîˆ~– µ›é’Ù/©ºvUË^MÛù=æY¾-ž; ïl¢žÇ¾îÅjüXkÆðÞës(èôƒG£ÂgTŸ{DMé+þ¥â¦æyG@kÖFÉS¨€…0écúRPØ¢UÈIO¶7Âhݱ›Ë„;/ؤTtÔø—X¾mXKP͸GÊôè8ØiÖ=Y’èµè%\ª4 Ÿ#ãõiÖ l<:‰à6]Z@{#Ïë ž„ˆs,zv[ZµLÔ·ôŸ6ìÆÃ7‡™L^=rªßÈñ½˜4 ÛéŠãS%ÊÚ´_BSðññÍ,´{çINzQ›®­ÿ"g»èãgÅÒêÞÖ𦮷Ûôb‘µ\J¹X8•å;eµï”ÕùÙ™{WMº±ÙŽÙ®†®Á÷\ƒ+ ³ίuôˆzrsiõû¥cÌ)7¹›3kÿÙ¾—U!*òªÞ2¾L©É¢Ak]FK׈KFÖ~7»“ÿmuùeuB€¥*•vЯ‚[OͽæÝÀÖ[û¾ª?†L[×!R •À -P-ž´ÊhEü}¸•~3 ™6C,’hn,‚9Ë~p÷{/3>¾Œõô m ã¸CÀšÖ›sù¦>öšcÞ¬)Å¿Õ^þýCÜ«Oj]Û®,Å‚WI1TüþÖÖ÷†€—§—N[XJTÎáœgˊĽ[é?\¿ »†ûóly<Çãp½fêï^z!üõEÜËoÂFT+íŽú ²¶Äý„TÙ±É9r·Þ­:˜ó¸\.—׿[K|p²õI—Œ-ð>%µ…Û ní¾¼¾ØÙ4¸Ñã5ø{ZJNMð1Bvïw¬‘BëC]¦xôëä<*ƒPüòp.!¨àÀâ©g^ä@Ûν¬ { ÊJ¿%쟽ö*èµîìáaCg“†^…€00üF9˜>•bæT½OSäÄ@Ʊ]¥í<:°ÀÞÏ>÷â© R)4e‰ ¡¿yó^U•úZF¡×Lß “';·’¾µ~32 ×ùµ0! @IÊù«M©ˆŠÚW›Évpär¹ÕÞåÕKçVgµ øêYˆêõFZðõöÝ ­ö­;YÔZ‡cêçB LÚxh5 `iaZJ‚÷´“kV«äB²œW-<¦ýË3ÁýÿÏvóÿ¶´îb¨üzyí®cÿ³Ç“nX¾-ÎЬCóm¢®»žÒ`¬¾ysGQb¶¯,oçfñ‡„ÍÒøo2E’±}Ë>³Éû§é]æR£U_ƒ^Íÿ¦KOÞø®bÍ°(R©,i×¾Óûn9öjVÍfG³éM&ãNiB„7•¦ÒTþUÚM}¨÷?Ó(^õ¡Q"þÅ$ü]Ïþ·©üåŨO‚úÜãê ûøwãÛгXMM;²Ž¸A)¾öVF¾ëÿÉGªBóƘï¹ÝñDš0³çnüÏ&ÁÇÉ(îSÅ_ê£L"Á¡G»†,¸ÿ V)¤2åNÂÔ¨#$+15çÈBvpyÛÒÜÎmÄ£ŒBÒpƒEyË&øšš[ŽžµYŒéì@@Älœimiîè;á]~¥k\Z”1}”‡…%Ûgü‚< Q%Ipê™EƒûØf+TŠBonìt²2³´âEŸ}ý’D€àÛyã^½5íÈþ+â¦nŒ˜z+\ŒŠ¦ _rižšõ¨Ñ€5P½ª±Ž5~…|ú×êScõnh%§Ó™T*R·:’Ì 3é´†–»Æ×@5D5¦E¨©PM8¬æ±s·žszéªcdC-ÊCJIúh :òçƒ[IGý¡AðåöžÈè›jTˆÆ" U©'¸± ¿ U§­#ã©Î.÷˜Þ‰I/Y9‚ûUPêèÄòÙ”ü"ižU©‡Ç8Ò¨¾;ÈåD¹Í“¤w¶x‡98¾È3\íÆðÖÞxžôìÈ<Ëaî®J@]öä¶hÆ¢W‡÷||xÞ´£ï¯'¾Lz|ñí¶é¡grIë™!7dÚv-]- jP“j*ÿIqƒZ;™wêá› žÖ«®B¯.xðx;o|„Þ¯±åENþ¹¦>Ñ!ÿŒšhgÇ ž»EŽB¨ðf¸Ëâ¤=³ígÜFP–1gœ¯oÊêãB#$þiÅ"—}ïãdoïv81!„1R¾™2Ò‹ãà¶éü³Ê”„|Ïâp.—ë7~^‘#„ââßÿ"G[à¼ðèÒ‘‘q|”Ûœ§á!.ö?¾Åᱟ窑jáø‹x<^ÐŒÍ âɱGVºòìœ<†Ç<ýŠ¹æ¢â×燻ñ¸nw>ñkFêÁ@Z¼vÚh;{Þèë¤$QùºÛ}+ø>ÌÅÖÉëÖû¢Ò÷|\ì܆…S Œ1BHqwŒ·×ÞeýÙäk³l÷bBjˆ»ÕÆ[Å€ˆk›¦ÛÛó"Öž‘¤¬²sBœ¿Bë"N%æîœdËáN[wšŒ1„eyáþnöÜ!·³¤3‚œc?—Ïð¶ÿ†Ê†²­¯P¨ðp×l{./pj´ c„Ðè¡œ·éIÃ-¯½Biwö{;Û;ºúMÌ©¤„k¦áq¹^“3Še¡Â»;G­½ð1vó óHv.œÈår]}ÆÞÏ×d BhÏ\ç÷~\8Ζà [~UÕx:z¶#;$0"³´N… àó•mý&NÁ ìåyp– LíèliÚ&ã}fi\ÌÛÎ^ Ü»a ½çh}N–€ðâwþ¾ùÞ0­‹ç×ö×®$Ê>¾-îdîÕaŒõ»r‰ü³¤ã^Ù7Ûj$ã£2Û-X±‰èÍÖ-3κx©Úyi~`ÇI;iKIzòžÅØ ŸÒ„Šø_™~[ÖD:sŒñÞ¹A>s÷‰%b‰ ;ÄjÀòëE˜L‹ní[TÎð:ÛYÞÏ,­:B`œëgd´õÑ‘Hô9a¿µ³ùƒ§‹ËÌÓ"™Lðj¯©…õ²ƒä2ų˜!Ë1Æ™gm¬sËøB¡pm€cоçã¥áNvCfýˆ%JüìX˜³ÏL‘HTœýÂÞÑÎbôyŒ±¿»ÅãOã5‘®VÞÓ‹¥r¹B¸ÆsÐôsùX!ô°¶Úð8[(ÞŠiÅ6½ó¾Ý784GA(1ŽÛ7Üš;4!‡/”GûXÙðcèmçàU ÊU8vß<§1󅱨<'”m¸ü± ‹U> …BÁç –ƒ¾É1Aà˜ ãÂWœW*å'ƒÍ&K …¥?lÌL3Êe5Ù»g‘‡•gX¡T.— ·ø†û Õ7îø}O…"‘0/ÞÁÔ$¹€¨®P.•a, 1·ÉTÕ9?¥²ésû³òÑ%þ öVŸ®Œv3Y˜,ÃâçÖfîee¶„í³<£Žcœã9ÀøFÆK¾ßµ´qQþ:©“ÎhŸ-¯Ÿá€8>Ú,èØ·Êô ¹ç )1ž`Ó;®cŒùßßì8z¹éøÌß‹G€í¼½:i³XtÕ™Õ{¸+Î4ÓÒÒÒÑ_³$eC”ŒF§S…Τ1Ξ)µÊn§©©1À%¼í/ñ"  ªŠèÎéÕFK“ž½âåÖ¿¥¦‹7qýYÜ[‚Ü&0Ö¬ñÓd1˜šµ›1~–‹Ÿï:Bõ‹äv×ÓÐЙ±ãÆ¢`c~Ö«÷Úí6 맥¥Õ¼çËæŒÛ™ÌQ“§÷lNmØü‹'¯šÐBGKݪ‹[o Z°]WKSK§Õ:·vÉÃø䈈ñLK»Óä9¯.í Î-Ý=hÁÁ–z:Z:mcb.µ×®ò°¢/·¯ü4p´ï¨©©ÙÃfB·ÒüØ2„•³"Ü4tmcGír¹×{Ö·iqy>=àŗÛëëhiiÍ?µ"sç† ÂÑß·£6‹EUÞ8o¿p½¦†F‹Nf Ô; ƒn~#Z0itš–W¯Ü—oe™e4Ö ÛNZššnKŽ´cª0ˆECTÀD‡þ^6t´µõB'¾xMfy3wlkmM:E~ñÄ•ekµXšzÖíHظõøƒ„E¼L Î.Ýts¾ÿT" …J¥S©t!_Ìÿñ]KKK·YÇGO{éÒk€ÒÚyx+&N×rÖ7ïùk•4ë_¶w¢•–¦¦V;Û¡–=n'$WWHg2ÅÙizmzR~-‡¡%!:þ;\{P¡6³cKi­K ÅX\B`]*…L Í4B¾ Ã‰Ë«£Ý ØVlŽÿê¨ã7©Ci<ÈV^¾'ÇøȘ.0BhDЪÃ'–Ô@íb΃§ŒÚ´™ú—?ƒhJý*¬ðÇBú—™6±• ð•Rů¿V(R¬¬.‘?‹•Â¸,·H©Ì¸,å¿Ycus yƒ€¨x‘ƒ[P¨-èPyšô1Oܹ·>y‰¡©ßVòr‚°ÀÊʪÒ*•|)gÐöwúÑA“ÑÀá ÅÇŸÔÝu1žÛÓ™ IDATB “A{ü ŠZ­šSÉ7úÍ:UH’”)?(½zèýÑoÓ®f-yE¥ªOª:†%RÑ£/RgS`¬Ç ‘hVÀº€ c  HýAyålUÉb¾HP¬ TÍšµ@¢/ELßÎ4Œ:õ„˜ºtijé“tQiTÀ*¥$ŸŠZ" ÷+ M½úYŠ1½y—Êg0“©*Umu´@ižX{{Õv²C„BIk €7‡¾ð†XëjÓÊ•uóüŽ?vO¸dΣ={öäš9t`-D*&4´[Vu’X…¥¹€§jåq—n?kV˜›~³EŸ1$ŽcŒPÉDï!ͽ×î ±Ç,:Kª¨Î]I”K@GŸ…Xº‰ € ”*YZLȺë4áÈåg/;j1„énžÜN ñ}Yê|„ààLŸÃ? îÝ_NÅ#tsá°Þ³/µa0S!öÙ´™ú›Å T¿­Ìvr£Ã¯göVW m =ëÀ»Ñµ â=ßAÖaäª ¼Z*ˆTÍh¯K/,üBT3˜úT½ŽOnÆÔ›+¨¾åW.’Õí»:ÓU -¢ˆ¯L€²¬"„zèj3ÄB) -i‹¦ @í¢§Ì)’A_Zuªß+}---×»—ü%ÎwÖS6_ó|iCG‡ézŠ²ªÄ3¥™¿ÝShÚª««µ4`Ô®]´õ@z5}HÌ(Jþëé Oi(ÞY— ­ö³6ŸšEH¿f¼Ÿ:~€éÇŽÚÍ#z ¨OŸ44(OõXð0`•r¸ŽË/Œçõ!º_—öYÏóª<’Ç?™S°@³?ƒž/–c-orr {z¾zþ´‘qG-ÖnÓ“£%=öV¼Ö\S­ýn×D—¸¶¡OÎTÚ–@µân&=nÔýU€)”63¸†Q÷¦¹¶nÿMG8Ã7˜}oíZòKöÝMS6ÅÕœÀæî¶Å·¯¦ðIÕáçÄ°Ù¢ÚsÝ3Ä1ëÈŽ¤ µ8%xÊ*¥zi@8ÚåÄý®@èÖæ`÷‰ÛZv3 þȾô¹2±÷¼©a™¥R„ˆ)¯Ê¥tZµæç} ¥ÍÆÓ9 ‹üöñ †·Wû[÷"€`Ù©¯ 4Ô¿ýµ›ÏÈǯ9ÕËf,Õ?Ü&yãrRÿw·Üÿ!ebìŸbUEüÃg%dåeáa‘¿5N9•—°j.ù¥$ñÀ„¨kµoÐäÚê'ºŽ„3Ïþ¶F–^o©T”*E (nCvQézQHÿl9Ö¶sìwaÏYòKòé%KŽ¼DA‘jRìæyô+ %€dªpš €ÂêÖÏ´“&³DªÇß»["QϪfo}…ìÀ‹Êˆ5„?Î(¯Qaéþ´Öãz“¾qX<Ü›½*v<¯Oõ®§£‹wËÔ«—ÒÅ€P^â™<ÍŽ<]Ô̦uí¹d@‚·—»sºõè”õêM1)ÀUʼnºgŸêƒßš€A“^¹›J:½à¾FÀù¨Jµæ‚©/_½I¬,Ï¢‚-R§¹¶–ó‹^¿Ïl’¯v#•±œ U ËqÛ<¿Í2gsšk!Z{³­{8@!IäJ€¶¼[¿ÏõfË™ºb1š¹N €¯ D•—Q¯ÑÛç•sÙTMm‰J+bé`,ª§§H$Pzm››?ÚÖŒ@¨Õ×ý{"WÏ-™2·[¥#©8]Ü£9  "r¸ëÔ9^}™îscBgûŽºØB¿Uè\“97„  TUJD,+âÈœPÝåïV¸53›rt`èXëK-õ›EÍ·z´šO¬Ú¹{nälî)’J ¼fìœ4cÜ}è¦À·3ŒLØLZ œjÛ €¿*bLð¥ÃZœÛ:ÓŸ-¦ë‰…ŠáSWëQ0 Êʦ !¿2c4V)"1tõ\ò~®Û¶™67ï¿~Ç&J2…Š\¼½¸<ÑÖe_»V£?Sƒ95Tr‘H¢@­Fº„™4ïÞ½¯ãä®®h›9äÛZÎ<ò´³L$’*«Œ*b2;¸H$Tª*óãWìþ9g–…Í>]š¢Ù—;S°îlÆq騯á1k瘢™3üœÞ5g;¯ž¸Ü9#éØ,n˜«…ˆÞL)ºŒóí®P²dʸ•±Ùœ.¹T(•WT$"¡XÆ¥K#¦ ?#d*ø¾ÓÙ}ô1€9ÛyõÄV7×2ÛÛh’RRþíÖg>u–çñÊÑ#,C×î s9xj]ä4§5årÝŽÆÛÎÅ#€•—Î-šaºó'°ZNÝzÖ¶@» Ý¡ÙÖ}‘6m­µ"¾°¶#,§*LMbFLZâñm1ß•­MM÷V DVߤ„5Ñ[B¡@$Ђüä룢Ÿ|¼s¸Ipü]ž©:_5)®kÛöJ*ÝXÆå÷6” Y]嵓ˆ«ÍP£ó5 ùúðàæTnàµù­ë÷§FÓDã|«‘ï™hð]4.å‹*Kß1”3÷©ºŒÑ5?«Šóóª« t6Jø"ª™ºþ#¸ÑÁ%Ê¿ÿrZ÷FóËj2š7ˆ›¯›#]ýlQ ùo ™øŸÍ²KÊE£Ç79˜þÆáu¾õ!àÐpêðú‰¨Õg\®u¯zhøoñèã¬ëdÁþðEÎ¥¨ª{#ýAV£¶óŠüð9~ç˜è»¶.¦KòfÎYpËT]Æèêj1Š…#=(ދù½r“Žfª,wÓÄ5Ƨ>+ ÑÁmØ&ú?HëÞ âÿO®4ôSC™³Õ%‰o¨ZôgóYnj[¯ÈÆÂ!6•Æ™ÙäÕûǪ€Ð—¸3»/w´ÙîáÿNí¡ËQvcÖ¾úKD)%B%y øÕ‚ÞŽÑÄÿž#0Æä?ö‚×®!4c¸éõäÑG­ž`¶&&«iùï7„_µ‘1b}êå:"œÁ`Ѫá5ê`u5Ö†Y×ÇK× ¡R.\Ÿ¿QýÔ¨†{¸¾^9tñƒ#óŒÕV®ž¹@rzK­¤04˜ô¿:Üj!Ý Èvó^¡ª§‚4Ž¯ê$þ]…?ßgu·íÏ ŽA­‹ ö>›?¼[“vóï7¡Õaö'¸±W^.„~¾œé·6uÍxO—%Ï ´k;œyœ¡!Kù8*€›‡Fl}‹ÊŠã•»{¾½Ï¸årŒ0FHºuÆHkÞê³Ï“OM·*þf˜Õ‰ê W»yOË@”/q‡]8.>3Ê1BèÆzY‡ßÍε-~0ÖÛ‰cë°âÈcŒH`qqËlŽ­ƒ‹ï™§?B*i¡ÓP<µ·ä”(уQÎ<{{GÏ×_×Áˆç_ u^ôâñá¥<{ŽWЬB ÙI”zm—§#ÇÁÅ÷ܳœ:Ë‘øñAÂ#@!ôüüW{—áaoË0F€Ÿ[Á³·¹Yñ혱ëJØ2ÓyëÕïMÚÍ?qWü‡ˆð\±LªÀ_âwp\*ı¿À•=1&‹P*NNõ=úX)—c"ËÓÀðPRD"ý»ÃÆ#°nï÷¥P$‘cùk‡ÁFwÓK%RYÜÁ¼q ªá^s.K¤2¹4Ç™mœ^$Ç’çvØ¿ ¤2Qôx›ÉëîcB̶˜{1C,—gÝ´e[ÿKOïÙþ¹QD¸óÈe"‘ª"œÀ„à›¡•›cLa\Ž3Û2WH`Œç;´e€ûBŒ1& }¬mÝ܆aŒ •ÂÙÆú«˜êl‘š+Áœ7ÆÑÕéÜ'Æ8á`PÐêçÕg4æz8„ìIK$ÒÂ$gçyÆøìZo[ŸI¥BZúÕÜœíh&Æøó¥16þ¯ "‰R•¶Ãl°ËçR±LZ8i¨¡Ó ŒñÕ5.¡R0Æ?®‡ØØ;~,Êd²;ó¼¹ ncŒ7DzG–ˤ_·°a^™DHŠÝÍ­“ʤr%¡z½ÔÒŠ³ÿÁ‰DzÛ ó µã;;|l]‚3R±L%ýqÙÆÒ>»T ‘H·2lS,ÆøÈòÀ€¹{åR±¤ô³ë ‹KE˜ ˆò·[Ùv³…ÙÛ-ã¸sNK¤©L²|ŒÕŠ˜Ìšs©ä~˜5Ç>%¯B&“?Z1Êvú9Œñõ­Ó]BWHdR ?w<Û`e‚ÿªPJ`¼k’ïáÇ_0Æ7¶Oõ_/“JŠ>=lᚇqé“eVËù"‰0ÛÏcà1ŽŽ°¾ÕtÎåß‹÷n¯AgÒTgVïå®8£«ÁÒÐÒY³ôí¦(•F£ DcPéô´˜³Ö£B,Z³X̾Ž“Úç|}L"Âq/ëî­4Xôø ;©+û4c1vãgÑ“âßT!Â×­ÊbÒéÌZúÌŸ’¤]Gé~‘œ.Ú †f䎛Ë'šW|Mþ¨Û~½oo ½nî–ÍY·?0æöh>eåx}Mº¤"Œ´ÛûjÝ, ’’6ÁƒuÞæ—H>¾s‚à 󾕃äË{I®35ï+!Ë«Zµc"ÿn-ïfæ@ò«œÉÜWŸ¨œIó›`V|V*Üf£Áb1[Y ·pçáS¬læ«M¥2›µí£PùFM×`2m¸zŒ<·îž‹<û7g1V£§k¾JJ!!ÄÔdÔJ[ƒE½¼ãv—Èu=šiЙ­Žõ©êŽ­…{ŸZt:Ã)À°èÕÉ«ÄO#ÇÒéŒîœÑc:ˆÑ™ɤSHáh^?&“á0Ô²üË79èÔÛº§6Sƒgæ¬ïµàB§fÚ,sêÁå9‡¶-HG^}õ 4»D£]kDž]lѶ-€òC>ê×M›äI?›øvÍÎH6GFf©1lÛÜ‘Òô¾ÿ+Ä ÔB„z=«ú»ZV"§ּXÞQŸÖ~ÔÊ‹µÞuˆðºÌ²ڈpV3ª^‡'7ÏÕÙ ÖB„WM6¹ð÷ˆp ÐÁvRQðþ’Ã&^`ôë›;o_By«(Ø™ó6½¼¯Ÿqß{ËŠ%AÉ+cn+ãBV-E4ã :“&d\8ÈÃZXtHÛÿ)­Wû~F5øÚüøÙ3Æ_ñÅ´×£µñ[te¦GÍËY)¿(h¡Ey#®DT‰~–!Êo_ ºX,Шø^-ÿÔáEþï¦OPçÇm±©™Õ¦tØÎ ó/§yuØ|iû÷ºO3½ÂWz…GåeïZ>iæöÖ›§9AÃÊ'€®F\OwiYïøpè˜iÈ4€N+-I @ÿWNñZP,"}P–U”ö5¥;'¦P1Pô›ì8ÿ SqíÂ𠱎]»šüòýöú°õkÎ 3Nñí+¯ÊÉ5=oü„éuáã¿ÞžM*DE¯Ç„¯hî4Ê.7æðW9B77Žõ˜´£eWjöóŸ*á³'OøT"EˆxÿêE™€në6ü¼4RÚD7ŠO}x3-_Ž0hµèM­x¹ý®À¯‡@ÇvÔ§Ûã2L†~6™Ï/_ûÑÍYôÚe9™EñîDŒZôèXºîøk#-[ QtÌõn£ðÇÇ·_dK«WKLìK¨Ô>6/˜x÷]ÉoåëX§ì“{³H9YúnLØ’:!$¼ÜÚ'ï= Á¶c74è¿}‡Ztï©ù$>@qò¶xYµIFÿ“ᦎšåü|õlòKùË£cž`Г‚®ðå™›b-‰°zŽäBÀŽYO' Ví»õé,¬( Þ>¼™š'SÛ† XÖœ>1û/_Ì[rôªQá޸쑽0€–µ}ßGÏ pßçÓ|Ü['n9LòdщTz­lå´Al+ K 3í&qóo7R±P&'Ul1vËЮ?ÍÙ6Î<Û©çJçN±Gr‰HL†ÑoÃ=½cÜ _¶£³“cˆ¥×8-¬¨ÔcÔ®ENãØNNv#Wy¦ øüˆp¡@©" ç¨ yã8fV–f‡3{Ø9˜m¯]\q}¦ÏÙÅÚÒVßØ¿g €pF€GÂw9¸œ_ötÓÐA¦,›o"¨€PP ˉX Sıù“ν ëéX–\¡×’F‡6ô×™z=40hnmR’(îÒ ÍlÉ·|ª‘é 2lŸšo0°±^þ4rh[Õ¹ùaѱÅQÏ_Þ–¾c´ƒ³¥U^sGî  — %U1Ÿ_Y à «ÿÞåîáNl'gGŽÿ‘cèÕ@jÜaÔža=ÒÌ­í½|mü‡U)¤±T „B,¨¼@%á ¤*€%Ë–ÇGÙ»z¯‰Ÿ;¡Us¢kç‹#Ÿ!á ¥U>|9_ …L$’(ÉánÍ]éªÏf[;;ÚùG?›á  ¹pÜšáæC<=£Ÿi‹ölµû®JfWïoɶ:&nÝHבgg}êsûųüTÇf‡î~"€ªÉP…ñ–ò 0yÍžžù—,mì8Ö;ß4Ÿ>n +´¶±¼÷VÙ¯«„1ž°bW·üKÆfVæl?¯ù[uaà”c–ŒÛl®óÐac#"íJ¤bTA4½Þÿ´ò{Cõn…ÜÓÔÞ¼—~E`¬³wÁdb{¢:ð6 P$­ê¸®ϱv7ênŒ0Æ¿B”¨Ý7Õ…U£føþèàå–!3Sj´ò‹JôÑ/Âq |ÙÙj*j=õ‹VÀP›O$ŸÑ¯ÎÀ¯ºk<…àI!äV0;µf€8iŸÙÚ¼´«+êm*k°@Pò“Ñ¢°æÂL«Ø~§÷…v© ¤"é@µ9Öøpÿ¹ëóÕµÕn×ÆOªHÕ÷Ö9Jª’Tä‹u;´@Pze6ïòÀÔcãj~Sù÷h7€¯•¿¹ÞÓuÀÇ"ÂQÃ_5•CÍ<Ú¨xwõÿš„ddËÂSj·R#y6Bµ ¯/j¢áánVÜ8MåŸc»Yb¶érM|-²²A†fÊj#„’ö 9ž÷_Ñjúr¢£yøÿ2½7BÈ‹7øQF" Ö9·¸Ï¨o¼Ü›ÔkÈ¡¿„}G-k±~íúžœPü C„±‘¶ÆÁçªp4èñº@…P¦]ߦ¦ffffff¦fæÖs6œ‘•vë`žÕæ¤5 :ÄL«Îë ’{‡VºÚ±ÍÍÍyž#/¿Ê&­Ý€ʾ2ÈoyÌ"{SSSSSS“Ê»ÞU,õq1®nÏØÄ3hÆ›|é/›3(>><àngbbbç6"&!¨zMBÏÏL565562Ù’IT½Õ¨ìöìAýû<ü,APyÛëkëšð>*QÕû^-pz,M=ý|ihiKBÆf8rLªºgblâ=nî‡"ª²¢‹ËrÖÌkjbblf;cÍÑR‰ª!É‚°rœ±±‰©™™™™©©‰“ϸ¸äéJµÂI%©«š|[ÿyÅà÷ee˜í¶k_ë„’U©TõBÇÖ =+Ž`[} °Ú¸¿UbëFÌ­U—PñW]<â/gzs¦ G ­âVM([L`Lªjš,}CMc„J¥"ÔǾmnFÞ,6ë»ý…¤:B3¡ÛØX?-’b\îi10¥@‰ñgn“âê $kƒ¬¹$z ãIî¼íÏÔ¨^5×gãcÆÄþ@#·°ªô’eo]í-Ž¾¬¼óñÞy³¶ß­~f§—aøõ²ê¯QCf]}Wýõý• †&Nodïe‹ÝÌ8ÜÑé% Œ±¼0-p—3~c,Œ$V>ÆÀtÇç_Y/'yÛ¯à;lËíê+)76²mì\}çUËë¥î'?44ßDù¯ØöNJŒ1Æó<œ=øVýSòéåÆnUc\ôá’›³âÌSŒ1ÆŠ#ó†›Z~,S50K­¬7¼«älÉëã6†n’ª‹ÐŒ1ÆçCy·¾–ÿ.FuSù0S@C‚ÍÓ¬lìçŠ ŽC‘B~®ìô¼óÆxZYÙ-;ŒTÏõºöC€*zuÎ×ÙÎÆÁçÊ»"„ä£mÞË”# €‘"'i°Í01B¥®ðàq8œ‰‹vJTèT䈹_‘n›è óÈu7©¶y™nþHG¢¦ÚslÝÂ3K¥Uk$57ý¦'ÏÚqȘä"¢öÉzŒ:¿eÏÖÚ{Üü‡®¼¸.ÂÚ†3iå Ñ«åV#ÀH/›„ϲÂ' wÌ<]AV²62ÈÆÖÖÙg\\¶<ši:’ÏaëGùšÑž/¼C=>½Þ…Çáp׊C!Dìõ5{$»ÉýŸßLPXǶlôYwêñÃË”‹ÆïHC®R5i¬ ®,;|51ñVÁÑ°#Ï…€àsZB×¾C@qÄgÚÙC—ï<¼}ä𠯛Ķf†·âãIÇõëÄK½Ø2‹ÓÜ'ïÚwñvlì½ý?²G 1¹{á‘_ÔòóÇÒ¢Ó…Í'ôCS¸ÉÝÆß½egP¸‹õ›b š¢§[îѯÜytp±kxÀ0y-E­ ú€ît÷á£]㺺8Ž"”xdòÁd­¸G÷7Lì6ûAÓDA¦ªÇÙwSºúö£ní rXûàþýˇ–Íæ¯Ä€qå]Ùç†MÚ¿*æѳëEN h1™—¹É=fÜ‹½»°|¨4IDATuiïîI.¯Š‚˜K¯|í-ÀÑË7óÉãœÊã+ª­³O.ÜÊht¤%©tý7g€©-B8”Uü¾ûIzÓµ[·¦QHB¾>HëåÖ›Šÿ4šwá‹j§~­àñö“zÜU4ò€L%?.¶Ö·Ÿ?Q{êº9e»ðåšLC[ Å{Ÿª7+Jmí™mW¨ÜÀüaÉ}ó“Ö¾gsiÎçL«ÜšWŸ·Â=Ǩ½N#f5 Nî×*R?Moŵ逞5ÿbÞboŸ->0)hw¦Ùê;Ý5(ó_Úí3ðóÑÙ‹ŸêÜŒ}ð ö†Þ‹¨ˆÝïÙˆI¾ÆzMâ㯖?ÄL)ƒ»iÒš….š8yû>_Yc–)æÌ¡I£hõ6jûóËw°|þ”MÄ3"fÉžþ n5ÓÒÀ qúÂM‚¥­=Þ~`ÄmåxG(/í¾ÍÛõV®|«P_ÅLÃæÐoÔÎW#0•ZÚ!# G5QûÉýÖÜ€V÷O0ò24Zvצ§ÈqÂhC­¬=ŒºÝIzc0¤òv³§9S1îjáÙ¥dKL.ŒîPÝŲÄŸ×ov¦ÓpGû‰O® ÓåÍãOí6½¥Ó(ô¶Ë( ‹kíôËã®!ž½€\¦(ø’Édvb2»=yú˜JEª›âN=l8Ť}ÚœY"Ï€L,-ýôŽÅìÀ¼÷ŒB¥@â›÷ÁsûÆÐÚzªIÁºý;'öQ ón ·ÝZ×±6ÐYxÏÂY14!àeg|Ê =‹þÁo[\Ÿ§NvŸ¯ÔlÖ¼ù`§ fx†òû™®Ž:Z–ÞÛ>+^ ¤Ÿ>eÐmB#ú€2ý'tðëR§Õžmu‹_–«5»"¤ÚZ°vÁ˜êÍñ8~=ÌuVõÏšm£Ø+¼æÞ¹íú—Lj¯Ž­ŸyK ¨$eŸ22tÝfŒí¥éeL †FmYõûx1Øö,°J ÎSÖu¡€âú±›C¶¼¥QèÀbÌÙé¾M>†htŠä©8ï›”J×Û‹™øO4iJÈðwi7„²e«ÎäZ©¥ÛA¢(®söUI'9O¡P@äIn2(SsPÏ®•©µµõ›ë²¨”ãmÑÝÛY„òëãÛTÓÉFÛÁ7OYáchmï8bÔ´"hÙ·ì}¦â~âKS/¶ƒæù4øñút;û¹80Á¶¬,§^~~õ½(@èunS9ÕX=t™…5í|?R]m ÀPš·jIÑ—bfŽTÒº<ȱgŠ¯=Jr²äÀô“÷z~Ý7È„íé3bÏÝ/5gò×"I綕˜õfÛ©* 0âÐC7Ú½AÆnÞÃÖ}É“WRÓ–•ÇÎÜC¦§ÜÝ ßn.£u§‹P½C)§xOˆŒˆˆ˜äþò}ÙúØçcéVߣ&É y&Ñ9½þ$õÉÃ;G÷lÌ¿¶É{å}„àƒdw¶m£B܃ë75bò”i3š«²»óf^Û‰1 õhAä§àÚþœ‰^mu^<_]&Ó¸°ocTTÔѷͧbskÝã´ôLEܪ—¿¶—êã:rJÄä)Óf0Dßù-?·a<ÆÀÒГKr5Þ§F(E~‡â“““““_%¿Lìž~(pã~V«K'iÂgèu'ˆÜšÎÃþá[£}[8›ò\<#íC”ÑšäÇß"nE&æ` “ 4ÝFõaÄ—Lô @í®Oü(”Öð:" ÈÅÙæÁÝGÏâ®™Ùz‘‹DW3¯ËSc¯œ™1DËÓi¦À× ÏóOi)‰v6Í™¹%_ºyÿhʸ ƒ(ô–@¡'U•ä”ÔsΠVTË•Bj{ýš¤µÐ¤ %2@¿‚aÒ›i(J«¶ùÅéùuhxžðÁÖ±/ ët˜·=æÝ‹G»Öκ¼rܳ UµÄÑפ—Kd$e²r!¢R€Âl¶êà»W ‡¶­J>y9½äË©3G:ÓªDsG¶këϯð•K6œ»9Õ“˜Àí»uîÙ³GOc§ƒÓû/4¿zf·£SS¾ jxqóÓ èºj+¥å‰ äe¦¦n»Î}Oná}»}Sð")Óʶ'àÆ^ ÍVºöèÙ½K§¥QË“OoI(­¼Î™ìWvo9ªöXcŒâ’Ÿ9›Ùd<¾Ÿ&$c¿ª±¨Àxþ²û®s¢†z¸{xx¸xŽñ±ïwéBÍLĘÂluq“çŒáS€Fýó9ªÝ¦S÷=»wé½vþã½k’ùšº·+ËYýHôËá(q÷’/r[7«ŒV3Àuðë;ɺ­µ¥Eå@J}•¬„ºuv£ç%&§^<±¯Ÿ*6xQLÓ¿Ûvø}û29çãNjÞw¸‘›_½¸9€¨S¹)‘Ëß/« 2€ï(·§Ü>Ÿè7Ùå§?ãhê·²°3Áü"€MKÂõã/cÈ‚ƒ ³’ÝwtѺn=‘dï‹Êw"jzpBfhHßžxVDчw-†wBÉ¿uóŽœÀmºµk~âN @ÅO {Û¦ƒ&ϾyÂË€?óbQ-Êï?£º²õ©òÆ{û¤ ²ºô5kMC5ÖSž}—´ó7%Á¹£»µˆÒ©~#_£}×¾µY|õp\†Ÿ¥A媋 –ó#nŸ¹ù‡v'ÏVœý@c³Q«ÛdÝ[|³€ŒT¿ B1íˆiãàÖ2$ UÆ8lÅgY¹»§§gÕ{3­ó@¼)öiAì™å1q±w÷%°=¸ÞžîY— Ò7.À‡>[wò‘·å-á:¨úÅAÍ­Û«ø¨j¶Vý¨ö®Ë­j$î#‡š™TIM™·N~S+`a p'gêâg)enš)è4OwåJÚþ¨Y>t1H.:.ÚS{¾PWUÛÜó¡ÇWŽAÍ6¯<£r­ÂŽµ÷Hí ºN©=/Pè‘®k´vh?2U§·Ž¶¡Q=Öu]Nµ.p‡^Wöz:º‚é:zx:›ŸFÓnÀHüÇO©·l·zõ# ò™ê{ gû@«ÆÑtnê¬1ˆ ã k A{ xÃíÑfÞ\Ù5kÃõÏ3SOV>Y{ÚéM’U3LKê"}ÌZŸí6Dÿ莼÷z¹úÝ‘V¬iíÙ­}­ÚêÚõß{ hU`ÏõÚ×h=ÝÉ"¡¾Ú†FU(wÞA¢¦º†?4³NeŒµ¥ñý>ò©ÙnDÍuš4ÒDšµµeoDW>û(€û—«>æFäã?ß»ùßc@èáßæ¿&¥›Æ$pF½­“c5ßÉÙqàY›t'd^° ñ"¿ Å 9Wé4µ7z£ÿÖ ©>ÍGßÇm¹¨GWKÓŒ6e¬¥’ 'rC H¨¸¯hNÏÿ»ÖAUùºö`ԌѰ;÷y°›¾~çÆ¿LX5 ©ã ÑtáÏÉ B¨~Ï—ù§±ú‹zr3·¤gëBÅ.ï `;;1]²ŽˆäЦm¼½4ÜÏ‘9>&-W(G€1Bð´úøOW'gvzÑ9 À€@|xË2w×ñ,ŽÿÎ’@]ñÒ¶Æ:îx§Œª&•¨¡ì\þZ÷ñŽܼsŽVõì܈1B(Ê›Zxý/Û¿‰^ÜŠ ŸÄd:E/oàK{¡?.d8EfJéEoä—÷n{VsËvïQÙsìÙµ¶÷ä—cŒSC&ú§—aŒ1~â<îàõ—ãK_'úE&aŒλyø6É1Æ8)db‘ŒqNbøüMß*LÂqž6IÇ1Æw-çx‡ð¸Y¿4)o´gå܉‹>ÃcñÓ0g‡eÇ›•^Þë[Ãü8î³öWkùÑu•N.ïÛÂ.—kU…è–Ï8»/0ÆõßodùjÔÝÁå³â +ˆ˜@x“Þ ÂüûÉóBXlvàÌn4É‚{gz/ùBÒ¦„È7–wî…ß©]‰¡‡e{\¦ñ ­å®ßgŠ0^ÿOg§ÏˆÈyîüq¤£)æÌ]&©­ú lCÚȹyfpÖ.^Åú-ÜõæxƆ¡³Ç>)/Àb ûRéQ3õ=OÞµvÚ¸úÀôAËãÆ=‡ƒ&ïáˆu9V÷÷wuàìC7Ä;2p/±$åNd̹Ð/"3ÀÝÞ1[ºÍÉŒ¡"L”ÀyÚ¾KWMG¡q+2ç0^•þrkMb$•BC†#⦕íͳtzñÛÍ—xßÊ=Ž«Öê#é2›k­‘Aðêî”ð”e_`D5ŽYcH§` à5zTÙzâé#¹y]p`ë¡£Âï?q˜Àš:óp•ÊÜíÎçR™‰ )bÆFý A¥ã£œ¯ylͬ€­/Ï^ùÆŒÀˆÎhëTZ¤¯Ú‘±©‘1EÞ"Tz¸;$2Š1J‹ð6 ßZyõjeUåDñ¹)Ũ÷B’õÑܼç'®Æ/«?:lxøcGУ"D×ë.JU$g°ž¢*žwPŒcýºìæ ŸŸzÜxŒGÇ[6m8ÛŠe¢ÂßÅ«}õ¤Ó=£·¹ö¨{ oÅÁSá£ôUÞa6¨_óãVÒÚÿç¼Ñz7æ–é…%ëÅÂGuáóf3«/t©͘JÈä]SÄE­€¯˜ž+˜TYÊÓïþ‰ºX›íºùTqÈ›¯4›fa ·•—\kž;Ô0þÕfñCéÕ·Å뽬FTàì-gÂtŠ BÒ•ÓÝ…“2Oð¼W·gy+¿ÍÕÕÑ(cwlþÍC±¯+«],,¸\;ÆPMp>IØ·f“xÔˆÎ~þúTÕñàéµ¢)E…'ÏX÷g€®>ŒL"£Ò)¤µHïæ5 Î›3ƒ?l 0Œ†Ù;ËÄB¥·ŽaEcÐÎÞ"²{Å• ]î~Ñ«gW«ë¡ÆŸ·çÔÛ”mçé÷t)°Ut¬aùöó¿I¡GvJF99PÀ75åöŽ¥€Pfb®CB,†GJëK4\=Yd2À]ùúDG=î^@¨8cáKögÙ€´6éݼ=»¸˜1Q®bš¡XNX³‘I…zq› ]‚1mÿ¦%ócXÛýÇpºØ÷ŠÄð¤òøìôòûeE…ÉYü3&óû®w¯Ó²ÚRsÚèüüu‰ó=’[DCüó÷fcŒM,§o^Ð0ÑÁ¡ƒ{Dü—s1†-ÛóV§%±³„Ty§•ç¬Ý¹ó@Ö6É‘ÕD£Id24‹Uˆ°Ïš½›C¬ŠTÜ÷˜R»‚Gï{\<ñ…²mA»¢ç%Mç…s¿ª_àb¤Ú{áóùòͅ»>MJfå§Qeb»€E™SGa Hß"ÙQ°ò ®´7RŒP]Þš²;ùedMÑß„MÑlf÷š0”ä’Ÿ#ÍŸ¸dñ™ËU†TPQ_ËI!Ë¿þÏyƒégZF Ýþ_­³ºý¾ê;XC¯®\vd•=¸ûΠFÖT· G•;Ó~Ÿ”6\=C*éômaï.†×•17Ô;ª¨ô:@Ëgÿ¼3•EfÄQE ½›×)Rïl]?µ×-«å×íÊÕaGîmZp/ÎmMßµâÈc}Ûiõ2¤’NßvèÝ­®&ârQçäµ& kxëxÙû͈ ônÈäú¿þõ›¯ûl¡;y"ˆÜ„¿ 2:K ˆÜ"7@ä†@ ¹!DnH"7È @ ¹!Dn‘@ø[ø7a#=`žo¢IEND®B`‚suricata-3.2.1/doc/userguide/rules/meta/classtype.png0000644000000000000000000012264413051004444017561 00000000000000‰PNG  IHDRz—”o/sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ 9ÀÛÍ™ IDATxÚì]u@”ÍÖ?³ KKÛb ¢()t‰¢¢ˆ„"ŠbwØ-¶b-‚¢`€Šˆb*,ݽ°ñ<óý±€KYï{ß{ïw÷÷¸ÏÔ93sæœ33gÆÄC 1þõ ˆY †bˆÅbˆ!7bˆ!†bq#†bˆÅbˆ!7bˆ!†bq#†bˆÅbˆ!†X܈!†bq#†bˆÅbˆ!Æ?Ú¯$"^ï¶Ù÷΄þõú0Æ¡ïÿþv^Á¥Ý«OÞyK¥"µ÷®Ÿ%‰0BE~Vþ£ÏÅRiN[5Óe”ÅÞ{½ €kG6Ÿ½•ÊPúÚ/X8E™‚!88ZÌ뺈ø“= €Í™rù-yû˜TNs_ÄbŠÞ+Cõ/ï[Ön +¿^ ˜bå±è¡òtu™)ÞkO_;¹êS=Ç…ó)¢4ãN#·ììå½ãŠB ¼ÂÆoP<{Dáߺ`ŒâY¿ìzZ…Bécä¶e‘/]:ãú‡<$Â,àn9q]âÉî‰Gro\Þ&…!Œ=Þ1cÅ͸UýFGH1)€Èã06Çž“yy&tÃ%$rkó,œ›kÉ\äæõ!²ñRÓ4^¼vaFí Œ-îvõÂj !‹2½i®Ó·¹œÌ‹! £ ŽD]ìĤ}N>¶âødzG7ý”ðŒ¸}ˤ¼Ù¥qì@IÂÁ©w.oœÀ[<Úë@‹ñÀR¼pz¯×ø>Ñ^Ähüî(îÿŠÎ€PO{·M7¬{1ÿîÂs}¬Cݹúq–Ýs§³ëMßxúí$ZTNª{í]'·Çÿà'*¥Å¸%êQW#¤(MÜ`^ua‰è@¡Ä€ß¡c†ŸKB‡?È»/È6EmÚêùýVÝëâ$yÊÊ~v²@–Õ·` Y^TÈU/=Æ1†xÍYºZšŽ_ß>>ÜÀsÎxô§a@ªªŒQßí)3:ܺófá!Q[V%I’¬HIÉ-Ì­ ?²¯lN!©ª"K ïQ ˆÂNŠZ—XtbãŸ$)þ@»Áútïâ¥GŸä{L@ àEìÎw2ãä?G½‘¹È³ÔD<÷µ„£ÚW/ÀË '#ÂõÜB²nKÏ©ï7Ìqœ½Ž¨&sïÀ’˜|zæÆ°wž¡ÞšÒï^M~CWêë;ÅS æʼn½o ü眸ö„Ñ©÷¤i>ŠHT *ˆ{ ÿ0®Û×8ºB×™'ÊäÖÖbYéÈYìÈ° ;»Ä^8¹´íд{ÂßÉÖq²€ Çáƒc®_š?f €º‡á\/ùk·šç’JïZ¿Ø¥˜"ï¨%¸µëηŶ½Z#)}h¶YºiÉÈ=Å4 MÍíöEùû§¯?ªáS˜cÙr’\­é"Ÿø†¥Ü×/pœ<¼µku±ù¢‰ºR¬qg¶6t÷mÞ½­,)H¿8~c‚ïÄIþ#M }móÃóO Ñ1öe×Þ°x}ü¦ž®;~…O°;÷é?°­64#|Ï=«ÑûFŒ 1–™æ9ÏjÕ“®$ R~5÷í?°³ÈòG¡J 8°MÕPèÖ§Ÿ¦’°äþ6~¼¡³>*çô¤n€ùSçžØ²ÜÍíÎP©ÖÍÆ•¼yX(ÓëäZóm ïmb6)A¿<Ÿ‰îƒÜáå¹ÓŸføôkGwPèѯÿ@•V?j2„ËRϵít#®»tòÄÇüJI~ãd©ª?­9òhÕ¼‘‡¶(®—°ôžb®!uvó*Å1«ízÓÙ»i¨óT} ù澃’ب¬Ø}úv}G–²o÷‚K ïK{éôqt'j_Ê—}OÃ^xyQÇ/|+­Sèªåíë&!TðüÖ™„t†ÊàñÚaÛ.™LåäîØ{&hÖ9¦$"A€!…X$cj¿ÚHÎZ ô0³®o¿ÁwƒÐçÄÞKOôÑÖ } >ð”AC÷1)rïŽÔz•Ý¥d²qɨïdf>¬6=Údä<cH¾¿(hV©º±›ƒá­M“]Ëý Œ9ŠÎp[=É;Ûƒfì¹ÝsàVñC;Kßz²$õZÔÆñy.cÆ*V<9jVËÁ¤ª­É9°ëfSh ð›2µsã̺¤(’ÀÀ-øœX'¿s¡½ÐJª}}l}:וíSß8z,Çi¼ŽI®Œ1`2lÓýy“ôüﲜÖFbÿ(h—³?riÌÂi™5­“a &üFQM}QþႹ×Jé^ƒ túÄ„ù/?óªsž?º9ò¸Í{yÖgñQJ>Äñ5ë1*·y6G+huo§ ŒÕõܯ„¦žªg»é๬r~£²ó=;«EF?®'€B£U&d²/‹ d~«B˜Õ+âÐÒÈ…Ïx';j©[ŒñϦ:¥µ¬iŸ#DIÊ0„ á«9.÷ÕX¹pw[Í Ü9¸©×˜’ZSU 1ƒ]‡à·C¬`$}ôPÐnÿZA;Í¡1$»”7ŒÏ¡êèK?°tœU…J/]ˆž9y­–•›¾ì"WÛŒJ*ƒ’ü@$ Àsæhl'uy‘*ȳ‹¶ô›±J‘ À~ŸxxÇÚ ú`7[Ýck|gøúç)Œ2ï¶aŠÿsÂ$g”ùÈOeccC ;ÎÆ~B¨>ëªkà™^C4˜_C‚ç\‰OA˜høôé3ŸÖ©”*.k– l¸m…çÅ­éИº¶ë𰙉Ž*l”¾¦=ÎA@¡QYkgø`€—›Çåi;:Ûc<ÜDû†‘Û­2ÒY‰ 4t|à$C´eëÄÑ¡«x®GM£¢ó`´ ûÑëçÇ<Ýp&͸+ FÙáúµ/Êa Š–. ÇX{ÀÒÓƒÇÝ®{Ùf)« ™·Î=ò S]çD?g; eI4& ³ÖÙмŒaL¥²ljª ˜tE„¿¯p’³ê"xô´k—èâ1^óÄÞ$³ÅV$7ïa¹ÌòÞÊ$n^~á°»Ùñf±Lr­­ ÔùOIu—éÖ§o;wqµ—èï ×ÝÌìûü 0NÞº£!ùs KuØ…ûrAö.IŸøð>L0D ­ž±:x4`8ÓñÈ”W€¾¦œõSòødW¥øú|½IÃ;µ/Â@®·á’ Öl¨?½mílϺg¶Ѿ(‰ƒ{Ö‡¬Þpùk^§Þ_.Hû:X “¥zuj­ùéuÍãè21ùÜT*¬2ÄsƒÅÁ¥Gß^º·ñsEq«?™™™}7d˜ýïÝ=€ò¬ï¤ I €É· ÇâH͸1ªMúGƒÃìu§†9E¤Lדn¡AT¤oO‘½¸·`¤¾%æÙ¥PËß7XH™!þ£:ŸY•±ßwh«13œb)ßW]ÍלÝèð P‰9c4ô%I‚bgu'Vû›´‘B$‡?ñà. ¤¥©yüýÛ|QcVû®ƒÉR€?Y\VhˆÊ7‚õ…˜½ºKÓ JQVìj€ •vÙ…LrÐ0ôè¶þò ÁÐ!…•ˆå=a¼¦<²¶¶[XñkÃÕ'ê©…:ãšGG¿!ºLŸÃGŽEiYi HÊ @—¨s·˜*s!)®3åï7Ù4scUŒèXõ"$!ÕÅD¸†Ü}ÉâЧÑ7F—5”æ&}®wV’’ßG­»pz3”´1º. €Ñ¶Á§ªIe%:F€€9uý¨t.',)õ—©MÍÆöƒQóa¨ =u™[˜äö69j׎å[bRc{J‚€‹—¥¾óݩ›¨?¨TƘ cQ•š¬ãCŠÙ½m“ U•æÊjºß»·SºEqªá;çy. ˜^TŠ¦ÜŒQÔ PVRB‚í,÷Mn›r¦[v£ýÁÔ .;{ÔÎdlºýÓ®-?¸EÜZ2Tê÷:c IÖ~¸fâsž)'EA¨Ç$` ù~ÔƱI¡R­¯Ë8…ÅîV‡Y±ÖžÏ[iø½H‚[ÉîÒLNNLH¨lœný;Ë4v* < ³—·A×;•Á6S&û[èà¦d‚QHWá,:l /"³•zØ ü©øô™v·|þ¦p`à7ðEz¡±ëT$ È&+ó Ô¼ëBb,tžc’¨£*hD$ ,LÚ8Ã4Íu’O :UtÉ! ’€zNƒL_‡Ãg¯XäÝNùØ4™E ¯#€œJ§þE M*5Æ …ñ¥’£‡«—×ýêŸÌæ®Øò>lêÀ–;Àçàö”ƒït [è½eÕB‚.š‹Ã…ß- Ÿäª2ëÑÃû‰wïŸlÙ@tØehô†e_w/åCyÚkž“}?,2~ŽÎš2~„ ¼vF=ò¢6ÿE £™ÓÏ‚^>O“H‹n‘Ab¨¯¯ïjàuúÊ•îÌ짅õ’ßc„àè…1aG.ž-8=ýavõÏ©Ãdk½¼)åòC.\8þüÑe“2?½h3Œp7ã S»dÛøT„‰Ü+‘×¹ù/ÝÜ====Ý‚ŽK*”Å%fþ¡K–ª±Ñs`ðâã­VKACÝow"B)QSö¦&¤§&%&Þ½{§»¿ã™‡FÏ Jß¿7|Éjè¬ÛMN´“€1åç:BÁ{¢SÒ2vÌtº±w‘ÝØ)$Сßc’ü;Ãk»‘ð'<íHÈhÏ¿`Œ þz&•Ö:¥³©â‹¸攤p%ÇhIPèß> ÙVýé…:XTdˆHMâkV%FаØÖt×' ´ÜøR`Œ¡6;ƒ«`Ýç;Yœ§‡†:Ï›’`2~´H‘ë½ÚŽ å4m¿Ã݃Ë)ʽG©‰RD÷˜5æìªÝ_}úKÿ » ã^£—OPy2{ÊøZy»Ó²hv“-‚s©o™Ô-¢Rmhìä#KÀc^Oê÷qŠšuí^bbbÒÃ5S‡WeÞ3·´1çÌÂSq÷$ÍrÓÅ-×貫óõ¼vŠ–-Ì¢RpÇ#ûÙ¹°È’!Ñ+­]ùÜZû¹îSKHø‹ÁiÆÝl¦Î˜5iú±–Ca€ ›Of][œÇjÔÔª¼)0¸˜˜Ô„ýãuž‰û³šÆzóÎh•¼ŸþrˆÝ²beõîRÂù’y$»–úƒÄLœks^=>³JcV¸ ¥…ƨ DAU\Á/8ÀQõõRbôÔ±ˆ:Õƒýún-Õ´7NMb åHʃ—-ÇÓ¿4–p‡Z¦Û¼¹Çæ.*v•(~ÊUbQ­–T¬1u¯Þ;ÏýnIÏËû õ-’¬¹99ó¥¡jݹs&¾Kå C¶3®\=gµ©sÀÆ©¶¦z>p´å|zNr¿ªeEcèLŸÉöŽFé7¢äÙ~ŸûXÊ(8¸¯ËpgO½ å9R>?¿m¶Þ¬'@þ(tÞ|óÔVÖÎ={tí$Aæç|Ëoè~ùÚ1JËÙ¥m>ºxMàÐ¥Wé-å*¢ÂÍðYïXßSòI™{Ö«ÿ|¬ÂÜÕëŒ]JuïÕäræ‡ÍŸÍ™°XBkû¦ ŸiúR~ã{,œí#?ÎáaÌ)§‘Ve{»meNéÀ'C•Üì­>ùHúº›E•ðVƒSBMûÂÕ8õN2Í~¿– V½ex¤µÝÈç}U 6/ÏóÔë’^ºªÌT@_£çfÞ!D,N·ÐUVÌg!â7Þ} Ü]ï4|­[oÇ-±ç¹ü€Mï³ÊQ°èdAԭ•©Ç &åT먱~.o˜Œm‹¼Êwc',8ráš*«µ¤ÒëWÍ›Íü>n1MVwË:?Ê-¸£ð¢ÌWòÊ%ä»ëǸ›^km6°øË“noýÊIÈÚWé¯Êêxrj=u4„ “á³/IçfW4(ví§ÝG½•Ç)úøìc¡¼†¾vW©¢oï>fQYŠ:Ú’ªï„X0H>dõâÕW$ÙIwØI‘¼c„ð—·/?¾½ñ\}…—¶žÎ@Æ€ßyÒÍ̪ëwG ïÙ½*ú¶Ý¥ûªàëû¯ù%É+w4 µIÖ|~žŠÔ5û¨Ë¯¤t3³§`€Ú‡w^ëÛšH/-éQ=µcI‚¦oeÒîæ;¯67õe•©©¥q@ìŒìI3# J““ß‘­7aäÌ-‡Kç”°Ó¾–ZÓm»€€|ýìIi-¿Ký~ê¬7OSªéjCT«3ŠÔMt:#àdßyVae1”*¬µô’¾ë¤Çû¥;ò)4ºZ~dcŒâ}xùúiÂÙDåL—þzƒûÀ—ŒgyÕœVi{iñÙ/‹©ÊFZ½¾g¯g'%géX[ÊÓ„¶qMÊãç&´ÆJëʳÒß°[Å’ë®?¤û‹)¬ÁFš Œ¦忼ÿ¹NÍÂDóSÚcFA½Td5kÌONy,ÑSÇ ëùýDùAV¨¢d¿{v)ëte•¼xŸ'"Ö=µ-ztjGÔWäü\D7ÔÑh®úíÓû•L5Ó!šdƃäê6›rƒÍÌ;5NR"ãA’¬¶µ†<¥µy ¨:÷ýóÌB†Œª±ÞÀªì·Ï3Kµ‡i¿|öÉbø0¡°zþô²†~7%(~¾Ç}eé½ëk(mŒµÒ›³#5SÏOCùŸâ~ºšŠðþÉ#jïÁý”eà[êNo+-%*®-zþúSuƒ@BVY{è #„jò>¼ø\Àï6¬Óûþã¯~H>Bòª=yi`bÞÜ;íæ'?ùÐj‹!E3óAÂtµù™éùõ–úƒÑBý›1ÅÝøäý¼?Ë[™0}ÈØ£?MV›¼ð,ÿ›@’ä|úF®t7 ¿—ówûùþ©mwÊñÿ/üÇwbùT[ƒÈO¼ö`Œyîfzw¾Tcü'M­~sbzèNáßɇXû­øǨ£ýíæ·¡^@ü¡ˆ n}ÿ§R¦‹é&¯?uŽÿu¿ Bo®.Ù~µ¨õþ7«[äÞ5ðïB(ónXв³ &·èú÷ðã>>s[*ôÿ€º¼oÖôšÖû¥J¦'7þ{vóмõGõGΟԗ޶ŒiQ‡çO›såPWÖïö'Hp—æú³¼©*Á©¡w]¹ç$ü Î&ÿŽ1õ烳‘;Ð~‘¼ÿ9ò»íü­OÿpÃþÃy(îÄ_êÄŽE|óüúƒe ÕÜü'éý›Åbˆ!FGh×»ü„;Éß%g‡ßZŸ|nú/n!x[ƒ¿ÿ‚ÛV€Ûin“ñçëɯ¤ìЧ.†büqƒˆo æfV¶¶¶66ÃMMM­¬mlmmÍÍG½â£ÜôcƦ¦®p16Ô³>2> ]A€³ýÝM õŒÌ- uõ,­×_ÍDM³!ôìâRk#ÓµÏ*M'@ùOÎé8øÁÐx¾¡lm«±ÁÍjB(ÄJóbV µá óþiµ-~ã&/ìj¹!ta½½ï†ÔŸê‰¡Ã‹­gìÎøqJ„PDèD#+›‘#]]G8ÓÑ·qpN/ãþ@:oŸê_$bbˆÑ„v]ŘÚËîa²?{¸¥ÇéØ”.Mr0¤z^¿~¦9uìÞ9[æÍp:· ÁÛÁ[uäò„©ÎRtyïî¹Mš(×=n¦®‚PAÐwKt'‚‡™5ÏmpûÔnÓ€ÍN‡U“rMû~$MÍHömÐÁw‡‚KDiGPZŸZÆL³Í¹÷…‚BiŒ­y…„v,BA ¯G»N(„`À¨ÇgòÒLûà…×ÒŽy¶µ 1ÆÕÝR<åík1ÄøŸÑnšÿ"øÈVÑl€èWUU@iü’̺ëf¸°hɺ ~nîàÈÐåuM÷É€E§{Å£½)–[MT¬\w·¬yr ˆI›#ÒÍÌÁèwæ"nÊâîVZè%‚LA‘)l„PƵ].V¦^ž&†Ö«N=o%%n‰™Mh¬°¡…Ž}ÖÜ(l}]™$šl(Ê€®’@ A)g7Ø[yŒó²f1wGÜ¿{‡OâªÂÌÉsòËåiSÎŽ«)÷'ô êÖy;©†\˜iÕ¤\ £¯«Vñ%³€–œb‡îšÂÚXêC´PݹÏ5doGÞÔórkS%ªe¿¿~³œÄ@òë$ˆ¬oźÊݓ㟪XÌ XÙHNñÚ» Ìm©-Š!†XÜü0]²WÒíÓ× ö­Ü¿EƒŠ¨:}'}„ÀA-îxÔ~äó2R´f ":ù8O"VHgoò¾E’Ð €•‘éq‹Í¿ÏošôÙˆ æ¦Ù>‹úíyK¡Š]R&+Ù»ÉéSQÇd½ž³p±Ð¤Ê+KóDìD$¹a©¡ÓÒÓW¦Çn}ý³Èµºººººº::úg‹†\HŒíÂ2¼~sOÂ|[#ccûÉ'¶œK¨L–qà™±ÚúëïVŠÍ*1Ä€Ÿ\b9s‚¿‡§B¤ÁQQÛ(íœyéà÷F¯Hë·eDk6©Ûo»ÈÁh[Î÷dM*Tc–ìSÁ“^:ÜÛ:º£[ÿÂH­óüÒå1Äûn¾k/MÞŠf˦£4íßó=ü ¿£¥Š°kÛ¦Îa‘ò¡E\ô’§øuBÂýõ[ßœHÜÕVDtt µ×•Šebü\Üü¡¾ìÓë캈øûZŠT±>"†ÿ¬1%†bˆñ÷¡}WqË[Ü-îmÿèò÷OnWÿòmÑá%h›´½WŽÛ­ ÿˆm¯§ÿ Z±¨ÕEwü“î€_fá¿Œ„ÖMk—WøÈø[ø/Æœ¸A½¹½s˜¹ý[.jòY ’»M&-Be÷1ò¿ŠÛóe „‚£ìMÍLmœÜ#®>>¼ÙL]øt;3¯ùýyd~„ÐéÅN3Ž¼úÂú`5Èò B[Ý®ºSÝÑsÝ I.–æÆ“/,Ÿj¹#æë?v„w<³B£¼-¦\o9ª/42±Ìæø©kú;†·ëóB×5‡ùp~“ „PmÒ,íÑÛܳÅbô_,n¿‘u3Ýæ¸õ"ÔuÄΘ­ö?)}Sžxy׸‹†¯ŽŒ¿{3îæbg•@WǧuÂ÷0Ñ“£K̤­BnÜŒ½½n²´pþVÛråÄ*ãýwäžÜ |¢Ýñ/L—°ÄÉgÇ› GÏÇÇÅ_9öúÀÔ sN /ÆP}÷Ú»n:ÕI'³¬BÁ·û|ÂNT˜|³LèR–¡SYR²ÒŠ½vNž¾T-ø`âaÜü |s×’?ÍL:;ñdHÇcäï™8fÊð¸oUÿb±û#]ûùþStÑÿtqƒI•>£ûÔ<Ü–ZÑj~–<Þ³<" ÙXŸ¿kÕ<ÿÀ©{Î=hÍh\³Ô×oïãòï¿•eÌY±‡ÀwÆ´ÉÅõÕ«B}&î¹øèÇ­d°d¤eåäääddd Üçû)—l=ýùnMĵi׌5–“•ë¤ÒcÅ©# û}Í+ù¾b -˜¼ÙgËZu*üÈLÖNªYp(¬‡’¼´Œ´ŒJ¿­'cæM5æÁÅl‹Öt=~œÅµMÚ½¥Ž±k¬ÅÓÒ†,ÛPTÂönô %1H š…,Y ¯úëÔ  ò†ç‹’VNˆ¯ æ_ ÷_Oi|µ @ý—û‹gLöó›¼ýÌ=øöäÒìUBŠ cÖ÷ßÈÀUY©A³—?oÆäIY•„0oÙÛÛ ¦†D?Ìj4OpUä–å~þþÓç­yQŠ`mÈ„¯dílßKy…iWçOöó Úy6Y„Ê›¸#AþóÖDT´|UJyqNØh8»{­¿¿ÿÔYËå64ç$É’¡“'͈ûXÛزöäÖå~~‹Â4)Á’"7úû¬ÚC¥¶æì“°‰>’GWÌ\q-¾<<7sŠ_à”S :6»0d§ÅÌ™09h×™;Í)3^ òŸ<÷æËRaÒMK“ß}Y:iÕÞk“gÎ'›¬nþû+îA…µ¯ÚàºtS§±Áï®,\™½i¾ß¦d@ÄÆ©^ç3ħÌ neoôšËs&×cѹÅ+ûòök ”åaåV?Ð%tz@mü2¯•q¢ç#¦{}í7j†q§ï]Ϋ|õö‹0ÒÖǃü×ë{ÏÝ´6$}{Цäº_^;øßÊ‘Bg9(<·ÿ›ìH_#E,rvféö6šÊßí|„@ð5=›ëbØç'Ë …åªE^²8õS „¤”{èöïÕÄââÃÔQŽ¶Ö£?¿Œ¯h7,I¿²æuâ %/?Õ“r±iå¦ì{4U¢+tRj5§ô§®ÂÀýŽitƒyóæOtÒ ´ÔÿXÁ r­¯“ ]·ÁZ*ßEÚì¶÷>oNpÁõu!»n e'Î9s½H5$tVÏŠ$7ÿM-‚àÖæ¾üǧ;Þ¨é?{Þ¼À±& œ‡=üV (œ²ÝÅo¦ß(íu^¶Ë „Ê‚í¬Ò%‡-\4Ϻ[©¥í„R„…®¹’=sþ|—xÒþ-ŸáA¾ËX1eN°ÅÀ‡‘K}7Å™?gúø‡ƇžùÐÁñTvoûŠ«îSfÍD}ºÙiÕ=„PbÄÿIã§ÏŸéï9Ånϳj`³¿n\²SÛcú¤‘Cò’'”c@.^¸!Õµ ê×{ZGvž5o—‰¬‡µCF%'çé•Uš#fŒÒYEei¦x«ó'á˜ÑÍišÎîé;..±oûùý¡ì!¾¼¬1€ö¾SÑ×^ }“q=Ü?VbdìòÑÍ¡­ÚÂ{õ"Ãþzºìvñö30ëðéxvZb|•‰¼÷)WïÑÝ¡Ÿ>”wÒÒ§µ4ï[ÿÐðêt•Œ]韩ï˜2ñØšðuK}¬ 9cs+k+;Q–4ŒPý£ðWØ娖$ Ì|•g-¿Z²s”rsµ…_½ùFE8›’“jdMÑÆr(µ#cSRÉ^¶>êMíZCYII&Й€1ÈtÛ¸1 Zû‘éÒ[žŽ)]zi¨K6ëW×nИrÉÙ´7ÆxàÞ…zk?n¼=¬–Ì3‘œ/gÚçEZ¦©sŸGÑl×lG4Êú-Û„yOíŽp[ó|¸¹0O×qËr×Ãlv•f°ñàA*0Hë~²KŽNí©Ž ºF¯n üî.ñIº(Ñbú(K¯›©Î€¸2‹ü\)Ù¼(zð¬' ‹ŒÚ›ù¡¨÷ˆaCõtû9S–E ààiáÚ€‘î¥Ý‘ÙEÕÌÄij.é!®0p€ÖÅ3Ão¿Ë¯£wö–ËêºZ’€μ}tÆÇ…KwÖ`¨õÐè"O ;ueüš§ÆC¤¡ýG§{¬®V¾½^g¿ûÆêÖÛHW› 0hW\—à=wsÑÑ·F}@ëÄ1?ëÐðàÄpDAC=WiôQN*«§Ï¸žˆšvlÞgu‰éÁ? òŽÉî,†ÿ4&jx?hCÙ›'‰yL@”¬7ɸ‡çãÄP:Ƭ­þK]=µ:=\ôêôÇQ¤;:±‡±Ôô%§/ÙXÿ)>öÚÕ£«GO:» ÖìH6tóÿúúSŒ¶X #5» *s>ÜŒ»G§à<ÔÝKø ÖSú ïHÜÐ 5ÐÑ7%`(ÛÒÐú‰û«Y¾¥|¢è¯ìÙ(X¥µzJ¾,¢M-[læüµJuL€wĸôŽ”óß:Çh‰ª ™œ=/YÑ€ës¾q tõ‚EkF Ô<<=])´<åHVï˜5>½„¡(+Ipª™ªÆ†j;$lC£'«ü}!©¶nëô­f/Ÿ¨.;ÖÝcÔ—¡òH–ZÔÈ> B$‰^-g½ïí-txUp¨_ËÆë /ÅýYжê‰?tēܯ…ÌQd0 t6fÑŽVÕƒ<«OŒÎôÅV“§ ªméê9ÆÍÞRàSY=ëðRï3TRP˯ª­Ç¤ »ráÁCVÖº‡qæR_Ž>áÛìÂ̾ŸÃà•y{{ ®,(’”Í°À”.&¸åéP±zóSqƒ1VÚb3fÁö›s»µú&Å 6ðùÍþ‘&“„ö Yêþ|ZÀÖëÇæÿ-]ÇéJUŒ¡,ý¼Ýìè2ª€†¸âW?r§k2°ðŒPù§×õ~ª2ßß'ø$µù¡rš¤$ð ªËàÆ]'T]Rƒ4”X˜$êjk¥dä@¶s?Éó=ÇØ v\ü C/Áçu ©×Ö>‰ÚdmQFÖ‘n$®«ËNb‡›¥éŠ0C%‰ŸEeP Þû})Rt\Ç%„gòx… éðmý©|üz¨ß* =¨X°·|Œ$hö—oé £üɇ£Æ*´,ÒÆÿª?QùíÄ¡=Á›w]KÑûþ¤-yÔw̽ýIgL ÷òƱ1õMÌå6ûjxU²½ֻ莹ps ÔåEÙ;Ë{ÛâÈûNÚN?,É (ŒŠ ŸÖ2w1BòëH}Uý|ÓLª H¸â $¦¶oVX’Êê#W<¿snëö…aB’÷ê—¿úL´Në¿K&ÂXJe¨¥*£Œ›¹/Ávò &Æ`*ôŠŽ>ÞÆ? €( ƯïL5%¶ÛIÝÙy1ƒÚÒùaeÒýcâ  Tþm8̾®÷øq~Kötýtjft6úûNI Júž«†s}¶ %b«Ý°|É^Œšü+œ,Ÿ É73òD3ªôSãçiœÙ¨óD+‰³Ë÷7Ý;E.ì~Î4œ0˜Ê-û`ãàò¢”ÓŒÊóó¨’’Ê2¶Í/ï7í\Ô™èèèèè訨³K‡ †¥´³[Ñ’ZL<^c°TRÀç}jø”ËïÜO©mn@ð c¹ZË'GÞ:Âoã2Úª ÒCŸSìä—‰ú*½ 2ößIíc0¾eÉŠ&ÒI§ÓKªû’ú¡øÅQQñ€*ß+`áVE¹‡Ù€ éï] ÓÔuˆ0ÇÙ©/F#„¿Å4iÊ{ü÷2îÜŽ"v1ê R]ÆÏ wë×ãIfv{Á€Ã>_g4y’ɤØÄ:>PÔ 2î câ“Ñç¾Q(0!àñßÅ!€úàéwß ÅXÑýÓõ2Ö*’íé÷/?z_ º¶^Ç®ÀÏÎq {ï^ôGw²„iÊ޽̭m=þ¨Rac•wÜüœð>ÓÍÚ0téÑ¿º¤¨¨©W_<|PTG¶¡ |‚ïOýÚ% °eó|“‘aRC[¸W:¹¬ô¾ì`ç4Ú°¿ê“§o];0Ô•êæü(öbàÌ€Š5gÃÏÄy},\]}­5Ä^5ñ]Þ£–J—§î·=qÄÂÌ”“óüÁ»ò㦃—ÓŽ5 žg8ÆÎÞÕn¸É·Ç·^W ¸ëh ‚Æ­Tò̲i:ôƒ›ø³{â¹¼ÔóÛQûJ@øì¹÷\üׯ]j>Î/ÿµ[7âkBÊ›½—ï2;àž2‘;~¢“Ž™†,7!é±Þ¼,€M«Bl'{=‰·ïÍ(¹óøí¬·†´É8`ê† ‡à2³®T ˜ÑÕp¿oç±ÖÖ¶vUo>ú&}ñEk’j«;pýãf2ÿëò¦£×|ê*ò š_†&1ÆeìÜÂŒ1¯¦€]XC ß3&xÅylvNIE0iQ~N‡/ÌR™ŸS\ûýc~mVN0cnn‡G®­È/(­kõrINV‡À$Y”“SÆዶ¤¦˜ÍÎ+>¦LbŒIAyqaNNNNn~e-·õ3Ï$Æ{Ù›^]Œ1ÙøÈ2É/-*ÈÉÉÉ+(ªã§—…¹êk*òssØlvn^AUcLÜœ6 qs±$&IANNN=Ÿøñ£Èüúv^¾0[mIANIµ°E_î˜wãd«WžI¢á·E§U±dy^N)G€1.-Ì©¨á5ÒÍ­ÍÏÍa³sJ«8ÍTsJrrr …7T•e³ oKórÙl®€æå×Wçå°ÙìœÒÊÚÆ—§ ^Ia>›ÍÎÉ+¨ã56«¦¬ÍΩ¨'0&K òØlvYuÆdiANna)·2?·´SUÊf³ó KåðÙ99<‚$ë˲òÊ1Ƙ”°ÙìœÜüš¢q$° ›‰ÌÏË©m3—å³ÙìÜ‚".ÙÈhŒqui!›Í.(­ÄÜòì¼ c’Wº 0D˜h¨ÌÍa”×aŒ¹u•¹9lvN^e¯Ã¿…Œª.ËÍa³Ù9ÅeUÍ)j+rsØìœÜòêzaÚâ‚aQMýNæåæTÕ‹>é]YZ$ä‡GÙÛP][TÓ\÷£Ýsw>©Çÿó€ÿ"IW$o6±š‡ñ¿õ½ùæ±Îe¼áAYÛ§ÐØr>—Ĥxlþõo¢½æù9³ÿèÓߎÅÆÁâ>ÅÿCW4O-™¤|lžó¿½%IÓ7}Öß1¹õÎî0.­trøŧè?qœu•É ´t¥ÔÏÙ~ÅJSê3 š6%þ×ûôFÜ| ÿÎç¡UÜ/±Hùgz:ÚŸã?cg ·ùówåR»7†ñ¯\+ê !I0¶Í cŒÿ†’»!-Cˆýhªüãû×Ìø£¨õH½æÝòÂ7nÓ¯U²Wö[q¬éòh»DÿJjEšÔöqûŸ±ïˆðÆ`Þ-õßx?¾Cqƒ¸% <¬ ŒL xhŒí‹O‹w)F½eà#zc!ô,ÂÁ(0#Dp*jø¿ Vƃ’>UýE] ¼´‚lÝ@4ÎaÐ釅ÿ€–!¨-«ÿ½Û•}8¦®ãÿ-*¢®¢Ž+øÝ\XÀ--¯mIF©«ÆÀëUèvÐЙj2°ÿŠOš# Tg1TócB}‰Ý7ØiRã…{Df=½0ÆnèС†æŽáÇâ8üÆ ûfxy¬?Õü¶ræ•Eºz¶™Ud³ ¯fÇêêŽâ!pÓ׸õ…ÿÏq¡;‹\‚7ãâWÚ¦uFÁÛˆAž*sé£iá±7.@­¶é¶å%Fˆ<6z¨ãžWBŠA9ûÕÒ O¡:CõÍf¬>TPÃrÒEcÀÞ/¨‰p¼>ÀÎuÆ6ôߣ$S:R(r^ÜyÒÐ9íIŠ:$Y,:µwĤ9} ¤YÚRè’, Z«zÁ7´GwמNùÖžxn±Ð! &³¼]b;œ»š“ØO£vùÒ^~R²°-Ó´ºA8âVùG=΂ö£ítÐ Å/c}gG¶ü"©®$ÛY仩¨tU ²¤oí\ù¼þ{ Y,)áy< .Å’.2G¦8zÍ8à¾æTFFÆ£¸#µ aNö£9º„¤$ƒ.œ±ÉÛü¶¥Å>¼ÕGî;«¨ ))U €”œŒ´4p‡:û´§v‰m‡-B&)ÈÉ*H+ š„”‹†\=›æ>ÂKJËà‚˜S_¹ÐÀ„Á’fPè’R’tª¢Âì=Bœ½Èx‘ñì®÷îH ËûùIJI ÝP¡cŸ(Œ½¾wÞ‘öÛþáeÉQÞKCU®ƒ“KAó팠¡4|n€£££WТ/µB%-ìŸqƈàáò  !Œo‰‹Ùå¢FyÿøL¸«³Ãøék y¼‰šâµüaÆú±•œñÝ…*{{Ãßc„££ãÌ5ëeÝ;íà3!„ðçššU‹út路›““óˆ%;Î5>SŸ½.Ô×ÞÁÁÝovZ Fa P¹jÚ;{§i+÷ B¨ÞÓÕ½†š=ÚÒêVI‹°Çs]¯¥—"„òÓ/ùŽuqtržvœ‹Û7aB»æ:í¹™}xi€½ã´ÕÇ ¡­sœÜ~¿h¼ÃÔCß÷ë½`ïQööN¡Ž7 „J^ä°÷#oè„ ã÷BïâyŒ°wr½õljÇî3_/›YŠÞGxnzyh±¯Ý¼j³W…ø88X²ë’°Y‡–Ú‡îkAåç¥S½œ\W¸!Ü}ñç¢òªÊ‚ÕÎÚAgòx5A£¬w_{ZYÃÁ¸|Úða!G’ó ¿¦Ÿ374O/Á¸4E[×Ägá©â²Š²Â—ŽCîã‘|þ­#!#Æo*-)ørgØÚ¯åŒ1ŸÇ#1&<>AbAšÑ ÏZÌ 2×Úz¿“ãZcOUcü5þà°1AãôÕvzž'H‘ÍcÑ]äƒó&MÜ|¡2ã¼™…Ý›Rnu¾Ä$IrycGcòæî5ÑϪZp(禶žñÄ%Ñ%åÅìt#ƒ_k1Æ×Â-ü¾°s²?§71ºõ®ç]Ò6°™¹ìxNN.ñÎ@·‘‹äåg>£74"ƒ‡1™vjçî›1Æ$!àñ L’\.$IŒß›øWbŒq‰›–ékïõ6¿÷¹° FôßùšÄ˜8émâ¶ÿ Ƹ46\Ó"„/JøwÚJÇÒ;”…Ï-ò2ñÝRGü'ëø=´ª˜Â`v’“ ½“bó){ʷؘ¬îæFkcŒ‘êÃÎ/¥¼±×³8˜z œ}>œ³tû™y—ã—~½õ¤§¹.£Q#è=Ézcïs"´‚SV oÌѤå˜TÄ’U“–,ª¬ ,õ.jtP›z(ÍO€”ú›.éo*²ò£ŠüÄPTW—¹ì’ŸàVÔ $å”ÔÔÔ@MíIŠ)“AM^»¡~ÄZÿáý@eÂb•V÷+HëNÒÓ”dÛ;fŠjJK1CR¾sgEj³N=æ :Þ¶ ‡˜9Rï„MÞ´ð˜Í®’ öÁ`K#.pqþyßý–ƒz`ŒÝfÍÜ9xbB ØÉ(Òd:ÉJW£®»mHï®Æ„ÂŽÎæV2+Fù‡—I(ˆB!G @xw<¬XßcÚð~`Bxt÷'_Iº÷XÜzÓ ½ˆ8P=|²Ÿi à·ål¿ô Tß~òjî™Uh€T×l÷ó\¸†?þÂ#hRyäæ¥9/)•6~4“‚¤dä¤% Ÿ\M“îŸh  êé:4:6ቮ#"HÖ²M>J’Wï.Åf¡ž]å¥KQIc4kÉ ¡J£üŽB} IDATÓ¨t\\½yó²é³îžjw~ø\«¢«Õñ«¨òuÌØètF/;-E:´ÚmD€1èT ÓéBEÏiæÊÖ»Qø|©…aã1]ÓîʱÏÞš÷2¸²ïäðEÏ4ºJbÔõðÎm\y…Ï¡L[ï×ùWß±#“»0TUÖ¯u›·iÇ´¨…ú>³ô…]@¡ _{e0耡ôÊ~)7w9[,$2ê‚ÅøçcuÕÚ¹a‘“[)×]­Ý €(ðxopZB¦IP(‹ÿ—ímþò-2Dù–_¦ªª$¤hu’|“WflgðêÕ €úcñõc5ûwªÏk€„çÏ  °î–!ËhݺIUf¶«¹-¶ïáiØßÉÃo[Ä™:LE"ñ:›çy¿Å“Ô[ 8Ú'8âx ¦Ó˜+×/»·aôPsç…kw¤±9©Ÿ¹¼”Ý.ÎBŒÊá×%dÖÿ6²›£ÿù:FŒ Üuð—BG麤@^M³q[IJƒI+¬å„‚Š<ÎÄÚú][NSÕ”©~Ñâ¼~á×"‰>ý¤°ÐzW"EcWü<îFêú¼eWuí¢Ø8ýhŠæfÍO·2¦2¾Õôì¡$LIeª˜›è™]Q#¥ªLÖ.©<˜ÄYÀ¤¢´lc‘ :Â-ü÷Å…´ªoMüt¾–‘“‘Í `º´ZÓþQH’lwŽtÙÑhÒLÍ<ß°Äv¿ªÈS«òÊ~°ÃUÍaí»æÚéƒKè@?9ÏÑQc°¤roá–€†‚ÄçÒ€²7¹ô~š,¡ëc`¢¥.H)µîÂìõY$b¹5r#tëŠÒíŠ Ÿÿ0Ájp ç&½×v¿!3æE´ÛT9i&§’ÓŽ®iƒ‹+aøêéYöÉéû’²ÚñöÿBÜf1 |n3ýÕ ¤´4lå>ÿP^ô’¡®L¡X«22 +Þ¤å wìÛ˜[Ó\«žO—nÿ¦4Ócþ¦ä¯ ®ÿ|ÓÚ} ¯}©-3e;´—ï¶ÌñÌ~tÂÂç0 9|ÜÙø'é7¨Ö.ñsùPC(²@ÃwCìM!âž¾Ì7”þu’–nœñ~ßRÿò×—,=7wP!‚[×Øù$‡ÀLUèÖjÜgQÄUu‚&.ñk¹T™$3¥üÚ†¦áGÔ$ƒNý%q/üWV‚VÇå¶Ü.mÈÉKÒjê[¦¤°T.—ߘƒÔ!Ü:èSÛ²$L‰®ÚMü¼ù0õ٥Ş@´qÉÿf Œaâ†ý9WW½¬i'‡ ùh_¹àûÞ0BðþöUvÐwƒ{ ³ÑT’ž½ï¬Ü»ã³#Óú£d¯y@W×Ò SNBPY×èí÷Æ Jaœ‹käFBâÃÇ·£;ÿŽø)y•zºݜźÁ†TžÛ÷Mosc½—µ!#óþÝRQùŠŠ^&?Ë*L"«)ˆÞçê‘y§B½neÖüw œ_7˜ÐÑPøêcIãjÁM.)qÖê çäÀÜ}Gaàx˜àÞ'.)ò ËÉD¦q’àìË€øœ”IëkªÜbd(çÅõ£W?@×FË·-–ËzœOÁçV׈IJAÔŒ['®?΀>zÖa›fÑ>&4Ô}۱犀*×Ícê"]%­„çæ¦ùâô•Æ‚¬Š¼Ä^ÆÅD“‚Â--+ÿÞKZ棋gn€Úfk¶-d}yPÚQL> ýã›DázYx?Š#i¬Ü yŽîñôèe!]ÜÌ”WÌž£5šÆ6P”õuä_}‚þ½¯¯êèöþÍѸÅ‚CˆÄ…$ îî®…" ´Hi!¸Cqw÷àÁBp 1âžã{}ì%ö}ûõ¶÷fž^{€±¼'œƒ3UL-/ÈÉ——y2$¤Á›s7r0–³ÏÉ­• õjT•>xð‘ýùé’íÅ3 €úvYïÞ,Ôœ?t 6Sù5žB<·år³³Õ»A3±i£­‡õX þ"Vƒ‘×tóô ‡ ø<Í ê=kEªš+¥E’TÙyl[ÌÆÑ»$iµÀ$ËÍ.P–T‘<þÀ %º—‘îß :`ègqsÇYÆÆtô¾û~ñ[B€nccîÊ“¾âCÔÙ›o²ƒ2?7W¦*Ë~ÓΥ괭oR6C"­Z8|ãôÙÉú_8mZ·ÑÚä—ácRóµ‘=òSŸ7þú“DíêÕ b‡¾«&4›Øwè{ûYf‰þà‡ˆ©c—…Ou ñðz|ñŠÒ}X'ê¸úwŒøqc§·ƒEÛþýÇ9¯%RÛ¶íZtõñª}çʵð‘¿XI…ßPGó*kç~ÿèV×õÃl7thŸƒC5éí»íÇί-Ä»‹Ûº.¿þðôŽB4 ,E#FtÜÒ¸I=õµ{/‚çìÐ×·I}4:¸ù¦¦®öŸ_?H6®·¸¶Ž´îÂÇ:…††ûy4~qó «×³Wk÷jú};÷è7{K3ѵ–£–ß¾rZ¬«©iiÜwRï½Û][ oÜ}ÚdÊʪñaÊX•ÔvOCñ•û¯¿[X§p³ËƒÙ`øv»“mZt}è]O÷ú¥û'l´ \ÌtŒv¾Íu 4ë0¡Kt@mïåçMû—H*2p-‘tG{Á ï3z¢÷¶Áöõ«=}•0|ëS12ü‰ÍÃmSJ.v£†œèÜ2¨¹}ó§¯SÆí8© ¬š7¼åˆn·N6×O{.Øj˜ Œf—´?-L×Ïžô ´Ûú½7ŒØß/Ø×ÅÛ?íéÇcº"³l#DóêNÉ6ö|åš;‡Í9òÄ×F\á@T¯KDíµaŸÜ‡&ɾÓûzuvt!Äzœ¬@ldùÓžs’”aÓ·=±n@èÀµÝö«U‘_·¨}“ø!W7ôªZ Ó:i¿„­æ—ùðâ{¥ór¿úDèýÃ’-Ç=Ým-“Wë@ç&H/A¼û—á#¸øæ¼y/\s¶%@ûG´û½ÞÌËsBJvÿxý:§áâ/vŽŒ1¡ãàQ—6ŸWõ,}“ˆ†FÊÞ¹sËf2µXÊÉ¡£Ûú»­ßupÒ‹¦ŠƒNŽíׯÿØ+ûWþ[²SV¸%N£ÖX, V©B‘€1€Ô5À˜H(äõ†DœJ£‰ø!©TjP(0€q•†„BÆi8c"¡ˆ1ð•"‘¤Q«90X$ä8FÃñ›V¡PÈX1| ¡H$`ŒÓ¨ù¸!Œ „"!§Qkøµ  ¼H­ÑÂ)âFµŠ#E"Ó¬í>t×Y V©øfe@ùæï‹Çe»­ý¹O5Q¨µŠ˜P$ð²H"-HL  …¼ “8ZÃA  Ec „B¡@P¡_i”j‹EàÔjŽ‰DBV˜}\£Q "!Ÿð³`ü¤UË#¦|!ì(†D$òÑPÀƒ VD„ÂL$‚˜ Ä"!ˆ4 GTHd€H©ÖˆÅÚ½QQüd‰DjµJ( Ê&•çT*HÂ7$€qj•† ‰ËL:øßü<‚ñ‹ŠGA£Vc"¡Z?R©Ô¬ŸrËç{‡æ¥†¬jS"ÐXÂÛ®;ŸÜÚ%P©…"€igÇüja N©æÄbQQÚú4 h—²P,”š?•…„H¥T ÅÚó?9*5'‰„hTjN  (\C…‡@  ùE•R-‹…¬h~5*ßûwïnŠì(Ò,‰ÄeNìŒ $‚"*3qñÃ(ìC (!ž(î˜ Å…r @Xê¡0Vܧ@(*õãMÃ(+¥d"QÙ•'iS~~²[ÞjdI¥Iiè®6e© ,þÅx†U $>œ@(T€l…r"¡X\E¾³’ã3 3r‰Ô6¸<ùh)Hx¦V–†¥æa!áJ Æ„"Qééa’=õPr²ÄbI¹ K\ì0YÄ’“Îÿ.3|½P$*CÝ’«®Üraß®1‹:—»,ݶìdñ`!«—¥!+Z]eç¯ÄO±D\zå %m£â7¡p •!8x©€âþÝ»›ÿµå9ÏÑú櫲ú,e£‘í„¿¥8mîðW‚ôzƒ×€]ºÒÒüQ]0aÅ…ö_Äßú1ú¿\Ê÷ÉŽ;^µåïcŽI+ TÉnþçWç·_ð¿”ÿU°•ªd ÿ“ŸÊò?£™ú?Ń¿µþþÃõY¾7ü×:cÿ¢—·ÔþÞ¡Q¡«Û×È^Ékþì&áõ³”|Hõ0¹TšGŠ{zïUŠ’·ÄÐd¾Žyõèqt\JJ+>Ò?E?zSáÊÞ=}”«$PçF=ˆzpÿ~t‚ŒO6ðþeôƒ¨‡oãR¿\Õü ï_FEEż‰å"È2ïÝððá£l5šòuô£ûOÞðMâß¿zõäÙ«|UzúðÁ“5%Fár?<|›ü„»ßš÷$+‘óîñÓ¸œ?ÅÆЈéýÅKü/ÿeÑS>jNŒO£ü730†#MÁöG¡‚ëè ÒÂö VYþÚƒÃ7ŠZ&WÓƱ]¼çd¤ÉlßÄ{WlÉÀ«\Dûa{“8"uâÅ€¦MÛö8sÖ¬ý»x6ùù\\aDaŽ(wŒ¿[3ÿàÛùå9j© ”ú1¼Yt:—_ §ì(7· ;wž|šEDÓ;‡4kÓkÊ÷cBý=Çn‹.í&Ãq‡guð Ÿ4mJÇ–þÜKDÙq϶nÝêé+GCD· òé¹þÐe"nÿÔ–aác'NêÖ¡…½_ÿ$MIŸÍÑ+Â}—œx_XËݘÚbÚÅôrK@·DŠ‘M›œÉ¦GóZuÚýçœFšªýH‰ÔéÐÍŒÿ/Î-o#€¦É™Ý´iï߀•Hv›úLDD ‘´i#ÅULŠëûè÷ÚëË yeüÕd¬âäã½<=Û¶hѦ}{f½r(ÿ+ìfjxØ÷Gó^rD”ùæH`Px®Jû*§ÝØÚ´ÛwÑ¿w xû"tëó=}}|ÂÛ¶si>^­xæÒ´}Wpk–cÀTÇ‘2ñ«o«¬Òmó^]töo—£]‰ª~ÁûçqÄews÷áÙÍ¢azHD¹ïnz·•r¬©=š.Øó¼Ìb>4{Ø„'µ?4Šî¾ÑÉ2â4*µšH9³™g”šÞ®ï:àèÞ+O¥V— W£!•’”JRkʲ>F»JEJ%©TÄÒ£d¥†+ŠãMuaWjmÛ˜ãÐÍTR󣨊»U*I©"N­Z­&¥’T… ù¿/‡ÖhH£!"R+ÈCB0¦|"Ž#µŠ”*m·\i¼ø>ùæ*•*5¾¹JCœ†T…õe< ‹0åáçáÊ£¤†£¥C J RsÚ&šÂ 5ÿõ(ª×hQ "•’| ”GZ²ðsTÜ–ãH£ù×y?þ+Šà›{ËŽ«nßÜʘÊÄ©ãýK» 5_Kw)²oSy¡×kåò ‘6ºÇ¡ã»›øô¬ßjjþƒ_ejbTj ÆCvß8!3Ô·é6ëÑùeB¹¢hÛ{dËçÁtÆH\Õ¶©*uÿ‡R‘ŸR’ŒÍÍ ù¨ 9Ù5zzÿî—¢¡@@¿Ž÷Ís‡¥…ûiN¥Ò12)#1‹|èbPË–µÌt¸g«íB§âA‹—7¢F»YS}­<Û6Ç£Ç̲2Þ„Š –@"¾攕Êô²Ž Äb4îÍ»\ÁÏ’ÂJ;(Æ úzÚ®$ü°7‡};ðµ@›ý¬‰>ò侃D—Eˆž‰-{@$‚D©.ö¿×ž)7…”E ¯YZBÕÂ:ì¥x ²¡ÏpMƒ5 kƒŸ]!‘àyÒÎB¯/ü¨ml‰µùþu‹QkØ`ȉu§£ÄˆÅè0­ìÉ‹1\[‘ $bèHñ6 ȸSLI]=œÅô|·àPaÂœm‰'ž"j $øOÕ&pX Τa` Hª€«7ó€<0lÙ‰¶´©PÇ8B"Á¾¸ú;¤ºèr¦òèówËnx¡é˜v}Ç­?”wdñ¥ô¯??û÷_rO ï4t̔ðÀ (î:©2²‰NU;Ê]÷<¯$7`Œ‘¦ sËQëöœ281ãhL~É7÷Y’ʶªQákªco¥zò¾”–ºŠ©eNV6§]eHÉÍIÌÎøRìJ…QÔ„"‘:õÊäñ£º·ogÔvñØÖUË ƒ Óñ2 ûÉF¡ï8Ca±`±Ž›§‘ÔÚÁÖ\‡»^?\ÝücÙ7§yWÀñyH{ E>ÜMQ’C&?Ã]„,€JƒQ>xµÛñænåcÁ(ø|Mªàxô Rƒ,9ä2Lè‰W·á7ÇÇÀµ$œè†‘­%Ý€ë3`ë@ðÆP÷ß 3îƒS¡‡+äÀÉiØò÷‚7æâÞ<ÜŽ€ 5žä@"Œ­F 14IØÔ/^ÀÞí¡0ÀË äec¸ nÌÃõäBÒ0Èx‡›bþ5‡ïCñö0ÖÒ.î7¬ŠDÊ[XÇ7–³€–¬„ò5H}w š†x›…Ì$¨hUS/a¨ @,a©sñw¥Éx/Ok'üD Pm,yócxCÀY é‡ bïjÛžŒê¢W=Èó¡V"UVÉþ~Q1ѪÃ׃mDü>ØìÝ™¹ž¿qsÙO߇ºÕ<»~†³ïw‹N1»¶a§^«ž.º¿üÚrÿ”¥ªÒÑÕ˜Pïज़õ 0Ïùö¥¬ÑUD%œÙ˜XMé@œÆA½k|nÝâÖ];§ kŸ.-«àWÄßyþºv½ÚÅ A¯V«ðöA6÷ï~‘QVvèæTíÊ¥K¹À^v¹ÿ(¯Š´S JõŒ Ëd¢~† ¸‡£º>Ìê!;i©¥l*­¹µž¡G7ÜŽ€øD˜[Àô@´ëŠÍ/qí&ºº@¨8 üƒ0ô{´ž†#Ë@"‰ÄôY 1pzÀaÄ>@ŽVZ„Úö‚‰j»¢:€$©qà.Äì@»vXxŽ?Ž@¯A‰TËiu„…¼W€»ûak ÜG¬~£ÐÈúF˜¶æ”öê®R—7 þktïŠ+o ¶(©©-Z¸À¢Âœ,¤qç1x0Æ€™pôº¸£w ÿ Þâq=u\QÏ&ÖÈÍ@ZLÞ€X•Ü"I0±2_"P>A–£—•Þ~Ùè`òB¨Rp8 ø€„<ŒŸ -ǃ×:£ÒFäog7Œ1©„üúfL@P–:Êpr%„ºb­âV kïæÝ}и͇.ÜÜ3ãÞÑùos” ØùNƵM>>>>>>Í¿?ÇrN¼IS”ðge˜Ž.„:’2»’ZF¢¸ì"DÕ‡4a­êº?…5±mlgg[ÊÚ+€Î÷Û¯MîØDU hûý.¿†Õ«˜—ÀAÙ§}G™ë„NÆElH W;$¬åÈWu²SF¬ÞU&Kv“ÛJî·ì9”¾3^ÚÁFòçèªI‰VÑcTfUJ=suC™ ßÔ)dâ¦öxu½ð(ÓG@Ä°ÿ@˜y¿N†~v¬F¨#êwùb¾¨gYJŸÏjh¯……nòÉ·±y36oƶ•€F˜¿NMè[Ø* ø´˜ÂÌìk]ûÆÆš `XÐ×p-ºÀ˜‰84Яe©¯N¥Žüob7ec×l¡P]}ìÐãâ›9/N6nácƸœSǽÍ&> ¦ ¼a®Šèùº«ê^¼wÿ_nÞîcc´ðÄó¢•ø5kC†Ž­ªß=ö@ W^üu¹q7;éìó÷_¾xþüåÛßF‘ªàYô‹=‡ìÛPÿnôsg·¦%°‘ì<{¿^â¦ß/Å3Æ’žíØk +T‹êIõs¥¢ycWO½S£ÏÍ= 2ß=‘³‘P@ßR—BAè )ðø•vÕnæÁ(ÆäÒopì(¾C10ò’‘i„Çð9²Çðû €ÃóhŒÀíh¡ŸÞBLá{!к,bì ßïÄø½s‰—ÿÀ ^ð[ [@½Ž˜3s&£U„6€ô¤e–Ðk ,}¼ƒŽ7t€K7µ•/@_ŸR¹ü <„ïÆ¡ŠŽµrs"à1[ì—²·i€{[ü8ƒ|ÁñŒª1ô‰Z¶5¡+‚ý¡ ¤É}±~ ö`\šŒ{8š—û5€Ïùmƒí¶“Np«0¨äHIAŽ²’;ü]솱Œ77Çÿ0ÿKëZ‚hÔ†_óŽþe÷å?¾‰¾1°û šÁÚ›#––Ø­çÈ[ÏÞÆÇÅž}1±ž¥½©tÑog› ïWÒÙ~Ô/=^,Ÿ—Â!öÚ 6}ŲŽÀª÷]RÿãŠ%‡ï&&~Ú8oªµk›ºÂR™4Ëùið€YGÅ'Äï˜Üáµõà®.úe„Yµ¼œ Uë¸ä}z0~Sdl\üÛ‡Ç6¿Ô€<ã턉SóÔ2•öµ«xeSµöã¬â*cI÷N/üýDiŒ0(ÙWàÕ£;bó¤x äy«q+è5+Æáfœ^Kçáå þغÓg€C tuw=ü² ›×ââ3Àv€a5èÜ—À@#`Ã0¬sAñ{}q Æ,ÂÐæà‡0fÍ€9X¾ŽFðjŠä¨n _-wh€<ŒœˆEilMÐ/¹çáÖsF#t1ôªbŒS©GìÚ@¿QX=g’àìR¼û¢^ðäö퀑/ ‰»q=?õìwÆ”~X~mQÐ3€6ýñû³Ò[a,ë€ì÷ ¶1m Rd:÷R`Ø&¨ÔˆÕ`ýòBv¹VVèpª’;ü}v7I…vêÇU”ìT“¼xÚðÖ-ÃÚw|àÆ›B}%GDÑwîÞ>,,,¼CïUû¯QzÏ0Ÿ+oe%slÑ€Î!G£Rž\:pf9ãdG)Â9Ž#MâÜQ½BÂÚÌ^òËŒ«GYòCº……µ˜²ä²(ÂkiEø’#O´ ªs~4¨e‹z |™Ê÷—Ÿô¨Y`P¦BCDÇ玿â‘|V«y…91ë=ÚÎþÒç{~ñî5³*œOUMÈÜšæÔV×$qc¾3šÖLM¨Ãt"¢ÁždhEwäI ÈÄ„j;о…š`Ž~èKULÉؘ‡Sp…6 cuHÛùÖIÐwQÚŸO§@£7ÒÌŽddJ]¦Sa.tR$RÛ¦dlLNÍ)£–uT=H{rŽ¬ªEMz¤¤IvdP4%ð:¿†jY‘‰9õ™Q\`J0×þœÙ…L)|2Ñ(?2²¤³ÏHψL;hûJÒ*”ü)£•!ÕjBiD7’‰>MÜED¹šjV!Ssš¶U‹…:–ì­ÈÔŒ–<¥óÈÈ€NGkaùt›ôÉÄ”ReZØF4"=í‘d]…Ì«Ó4Þ€‡Ä €’åÚõye3‰µ;S©·þ»ìnŠùB9æ_ÖÕ”ó8Ç•f2å?XNÃbvS62v¹£”Ÿº»Y<¬Óo£Š²Ü—ãˆ+Ѭ\MÑÙCµv7Å8pNôvð˜_¿ R ª–Áç« Åÿpñ‘À¢ø'Ïn†¬ývvl® l\ù¦uÜWñò2 X|9U_‹¸?„lE“[þ§+[SjüeÊ#¨æ¤Rµ=th[j%wø»ìnŠƒ»–sÈù²Ž•“£²”¬¹X\Aå¦ê¼½»vŠÎ.ݶüQ¾Ðz#'>fÛö}…~üÁæûV/ÚpäÊ…Ÿ1"Ñœý{¥Bîø®[Îß­oëR(kàq`ÎÉ--ÿE0Í/@*AÕ2ø|ERÿ‡ö¨Ó;@_×Õ»õè—G½R°•ï Pµ<¼\,q'µ<ñÅT}m,°?„ly“[1f¬lME¨1uª»À“_Š¤>ƒþhô3¯<úüååì®Îzüšˆ“Vspüñ5‹‹,31úm¢H(¬çäb, yóìY–F¿‰sƒ¯Ÿ/Ÿ>Œ‚ž¥£­ þ-ÞžàC:Ìlà\¿Ø‹<ï=î~@õÆ°­öÿ€;W!cpõ„±äߤйuJ1l›ÀZ¯n…ä«ôÿ¿Ån*Ke©,ÿ'4SLÆü….øŸ+ÿærqù· òúoÁó‹y)åe×-7"T˜oºLÂåò›Syוé¿—Ý0Æ6Nïílo7oì?~×É7¾«æ?¯"u;cìä‚À–/ÿó¡è&öþl:³¬·søì/Y»ŒRý%xH­¸ÿðÝ_ùæ8yö矊æe|{‡m䌔ç·Ìóuqrqtêó}DRDŒ©¯ìüÍßÝÕÍÕcÒÒýlRTÛ IDAT2ŽÉS_LéÛÚÕÝ÷UŸÈ©|tÑÔ—·oæçïïÜißõ7ŒiCľ¼¶ÇÍÞ)âY^áÚ`™o®ïØÌÅÕ­iHçƒw>°Â|Þ|Ìé—{Ç:4lð1¿òœõŸ~@è[º§rÔH%¶qq¼Ÿ_Ñ_íA« âÊÕ-”m[® £¤Â«X/Fé·§7nµ¨ÑÙˆ6]¦_¯XeÆý)ú|K¥ÄýGDûÆ=î‹Šî,nåõ¹ðjE#ÿIª?ŽKØðÉ’ïù…Í.w‚¸¯*œJjúÊ4Jy|¤EÏå…TzìÞ3“èÖŽImð,ÜÞoü6"zz|±OÛ<.³{´¸î ¯èÔÄ~ÚÁ·DDøÚ7y”A”ícëu4çM+O»‹¯ ˆèàŒ®mûŽêã½òy¡±CÞ£@[—¥—?‘êý‘@‡‰Åa8äiÑMZø6õˆÍ/F‹«ôÿ/5SŒ±S¿„õ‰x8½GHÀ”Œ1eÒãñ½Úxyùt=7“cŒÉÃ:ev›½ãc,áî¾ÎaþÞ^þSVžR1Æ»°¨e÷ßþØ+ÔoÒƘ2ùéw½Ã½¼|ºŽü)CÍk Ø„M¶]y¿lB/oßnc*8â5 'VÿäÝ4¨í€[ ¼q'“ÇÝÙµ¥——Oïïç‚1Æ’ZxØ]‹U1ÆÌì>ï1ÿ+¸<­~ë%Œ±}³‚‡¯z4¹KPÈŒ{_š+2Ƙ*yrŸÖM=ýgn¹&é]”›~àãÚnkä‹ÂìE,3æT¯ÖAM}šÍÝ~‰•H_HÆؽCK[zûù78ôˆãÕ!¯67 ›–s¨…¿—oX÷gYª§G–†x‡vý^ÎG¿FæóÓ}Ú4óòô5§‚1ÆØëÝ‚¦Ý^:¦£ÇÝŒ±ÄÇ'Ûyùwºô1·C3¯«ï²ñbc]ß±Ä+Hp÷ôOÏ|5ªks/Oß©ëÎ3ÆcŠŒ—ýý¼B¶ÜJ\ù}ËY;Ÿoïãv$W4&Øwì…ðó«ó킽}ý[ìŽJgŒ©îþl×míÍ]Ó][cŒqjÙú™Ãý}}‚Ãû\}Îg\Rå~š2 ƒ¯wHxŸëo2cùïoù¶›@ù½=|•ìâÖ¹¡>>~í֔ΡËÒîÛy·ÏÏzÒ¯m·§ÿüQ¼¦O#Kûm|Ÿ]†?ûœÏ˼½;lØ¢¼Oûüüà Ô,çÜï¬U{@×ÈnÒÜ•Rˆ&L ʼ}Gœß²Ùø 9«†G¯Z“dÜ»ðIJÉ/ë„ZB›Xž½ø@ùîuN5ÛöÕøÓP}«fŸâ®~³ Ç·/Ö)q2’ezΘ;!È D¢:,-MÞ'…s“ýÔ}ÐÄ»u|ê+öþÔj×ð¡¬R¢ü_înˆèâšN~Í{GgÈj’Ýqr;“©P(ß\^ëÚN®áHý¾¥‹ûtN¥¡÷×Wú·OË“ÉÊ £;‡ÿ¸‹ˆ®mèâÚóIz¾L¡&ù½PG×CÑ …òýõ ¾Á­ ÔMÜܻä, §VË·ônÒ>"šˆ–éÖkÖv•R‘ñWÈ9Qîå gÈ·Y …êÉñE~á=‰ˆ(wûú5Ÿ²4DtðÇàžóóç_þÁ¶í2":ÑÞ?¬ÿ˹L¡.ow£éÛ:hêÞûj¥"#ú˜g“¦]¦_'N=ªuðà5W”J…Z?Ä×~Ò¾D"¢¤ƒ>ÎÁÏ’ ”jÙ¢!~~ŽW«éXĸΗQ~žoÓò õ±…£B†Í%¢Øüšu¸ú>M&WÑç³Mì|Ëåùû&¶ôõñ¼õ!‡^lj0ž#"ÙgOOŸÐÑ» ”*¢Ü‘A—^Ê"YR¨§Ï’›I …âκ ž^sv¼¤‚¸0w¿;Y •†£×+Ü<¼§®>¯T(>Çœðñk–.×ÐóßÜ=›Eì Ë‰Ëà3jÛC¹B®Ê|ÔÎÍq×s5)SZº5Yv/Y.—+ãOûÚùß/ Ž(öê\ÿ°™ù åóÕ#üF­R©• ¥üô‚öÍÆŸ+eß’õØÅͳÓô“r…R£IëæëpøiqIÝÝÝgžx/—ËeI—C<Ün&pDtwßÄÖ=# G´t`»u^—Ù^û¹gàÔ=DéíÝŽ¦MCr[w‡›tÿТVýgí!OÏìß~Ñ!¢Ä.N®›c”DDŠg!®®S‹LŸäc}¼ w7\éor˜—Óãdí^ðÉÁÉ-Fïã¸ìP/·Ø|"¢Ì7÷×í:Q¹gù âÝ0°*Öî&ºR‰ðÒü‚®sÚÙ™H$âúACjg¥^LUC(a€XÌD;ë›ÌÜo¦¯#•ˆ‡®ú1ãÀöX€[¸9UÑ“J„W]Iftr0•HÄuü×Í˺Ìç“U…wín,€P(mÞÃ>ùÞC çÚƒèCúŠDbÓº>§÷n2gtêǽKƒëK$"§¶£¬â>^Ê`ÐwØÈšÆ_?U­ãÕÈP*-7-®úS|FΖîB‘ØÔ¡Ýp''ÉÌù±¿X$êTú]—˜#+:ª3üpXë旫ʽôNìö-/mâ¤V Q‘ù˜"Q¥62Ða|~襁æÈ'WkŒô¥~-V©b“¯¸pQ±šú]Mx\¤Uj”Ê9žœ¦4\Ñ/`•:un¶,[€¤F†ZÜÄ #‘ Ä |ËÞ.ëÀ“„q™šô»qhÀÚQ0àSZ®•™ ?( L…å0MfVè‡/Aœ,?Y,2ðgEÀº®É—Ž†œA5ãBËÆ¢@œi~d¹‰•, €X)Ë×s±+Æ ÞûBÑ:ÄÕPO§»—~Çܦ¬¼ln3G³ÚönÍ~š9œQ©,$”˜ ´  !%# )¯Š’çåT«›P ÐœóïîhVÌk.®˜0n_Æá+Ç ]¦Ê“Zßr¹RÍ$HĺjMqþâ\9§£'Aµ°ž W¹îZÍHž߯sgãû{xÖ¬Hy§ÎxÜ·çp·k¦t´'"ÆÔ?›=~]¤.]=Œ´V„•‡©ÿžÝ”xM­ 6}çïPúv‘µÄ\ª²ß|mjië¹%>–†‚=fZ±j·¨éŠeùr@T³ÉÚ º¯ÝÖáÌ1°ÄL‰R –«Êû^}©”Ó0™šÓvå'çB &2°•Fr[®È õVÍ÷²E¢”²3ÔQåÏŽ¼ßÜè«h}AùªœÞüÈEMKåc‹{R ³žT,ÏRhŒ#Žû–Ž›„BŽŠÏ92†?@ò”KŒ˜ÔäZäÉ’·RbN~›wïÚq~¹ ?¾å‹ÖúÝ&,ì6aaÜ˨½æ7ïÏ.möU­'éëèéظ^Ù½²ÈèÅ掃~ª„ÎE ûù¡õ­›ËL´OY¹Úä?|©jé)òèdY:fT­‘–s£h¦$d¹Õx|óªAc7×jFIMj´nhsäÁ³rÙ  îté2¦÷âC}üjñkLõhóŽW¹¶#C×s8¥P·k€÷ä•çÚ8Ur¿ZNhßÓýùö©ÚX›Y‹®ÈÕ”\²ºí»ØFþºŽÿ¡Š¿±xÓ¹2=´íîþr÷Þd­eCNÄÂå9*®‚Ѫիeyá!c`,»»sã5¯•Ýú»?^¿1[ûÁMþí×µ2€1.1>N®&úf¦ª”×üK³÷à‹B¹o9E™—þòm,è4ÔÑÅ£ÙŒª»/eè76áúë4ž•\?y¨š}@Ð¥·ãÓ[ 0vuãDßÎSCzìë÷)ù€¹››ÕÉmÚSéO­9óR¶{ pº±p±6JXƳ_Wì+ÃÜ쫽z.CÊ 2Å·X‘‰y½‚ü¬Xc€&þìõŠbõɶH0©ê ÈκðQ˳ÎíZ“Íi”b!roO,xZ å4ZÉ:4 p|íü“QŸÔ´u8 úÓ#ÈIüð&!³‚4 ]r_¾|˜¥­ØµzéÓx^½ÌH£ØŠÓ)ý}êòŒÿãõõs®éÝÜõ³I1cdÍû´¸¶z¿Á86o¥q‡¡5ª5õ3þðäØÛ0†¼×WŸ~jîëaemù966»ð•œj_µhs.¢Â°[Œ¥}7`l—•WúøÕBQîJ×á±/yIG#;|ívg#UAN\Rj%ù v7Ä©Õjmv=ßiãC†wlÖضîÇèhÿQ†BZ¥æ" ½vg¯žÍÏ;×¾øÚoÖœF]˜¼º^ßOj9²S`PcÛú£ŸV÷n(ШÕGE#ªÔK~›Òiø˜ U…Y±Õ}Žj(EÃyÎjêÐÐæ]ÌsÛ°ïtàs¯sN¾ª#nÚb䢑ó&Ì~cñ¬Q¨­z‹ |ÞfMQç•šxëP·ˆOÏmg½ùÝ›Nè¼­QãœtjÛß>2^Å:û— î:¦Í±FîòO¯”6~‡æ„ÁªãÊ6çzú‡Ö4T§(­Ü p‡Æ÷ÚÓtÕåé^ÓþÒ­Ï´ ó›ê¼IÌݶ §R«‹¨Y|ÍiT €ú½ÖyŸëéÜÖ¹®ÉË—±-†ý´dç1™‡í½»u°w «Ï"_]a™® g4µ†ãÄÖÓ|Œ»{øºùÙÇfÚxù[€Ø4¨¶xxH›&ý~ÙÌ©ÔEI¥V‘¶OÞ,ƒê‡—uí×?hSgUü‹ã¦;z[Ëýkˆ×uÚP’L¾Ó´ŠÚ9µG͇ýjù dßµo×aÞ¸ðï¿k¿Öº‘•$ÿÙ'Ù°•‡D —N˜Gï¯ìÇ/•"PÕjµ†U½vÌòßÖÓº‘sæ«'T³ÕîÑúT­ëûKçΗcS¹Ù5ø˜`šÍs–0¥Mh¨vw¬n¾tÄ·ïœ&§z¹»úUÑËš;nÞÓžˆ ­³õ÷ ‡„¬Ô3ÍÊ’µž¼%°¶µLö8îåÝÀÉ!1æ‰Ø¦ùÏÝ Ñ6t¸\Gœ¥¦»ƒÃ‰à5*b€úôÝ3:îÑ.K.äûU?´´+ñ^äªTêÜTÑç‹[Ú­ysö÷J>ò×ØÝý/ÏÄ£b’F-_í+iFS¡ùI9͹2ŽæÜ7P(e"ñkÿÞ_ÚÝT0xùðs\x¹ “Ë:@s_iU²S"âYda<,ÈóQ|Á—†-%©ÇqœJUœ⧞ Å—I‘S–(¥+¿>SØ3»ää–ºúJð€òŒq¸ŠÅ+4Sú#]pÆZ†+Ç…ŸVnþ A•ú¦¿Àô¦ê’·¾–±?ÖCñ3¬¤zéÞX9ÍYGsö Š¹ ž½oѹˆåã…¯À_ò1öe”²´4ûJ«’@ÖU_'ÿ3‰zsyNžEM+ݲ蕦S¥¶ö X~/÷ñØé;¢f-ª—•—C”Ò•_Ÿ© ô8_£c™«¯(év_Š’š‚³ògütÁþŒ€—•ãÂÎÀXþ“}1U;VnYþxù?æ¢ùoK ôôܸïçÆf«,ø®\ñKÝ*Òo6‘¥½š4rlÔ§,³†?-Yd[H¡r-U²›Êò‡tÅE“ÊRY*ÙMe©,•åYù/P 1·öîÜ~çuÎ?OMÒÍmG¢þ·ÎâÕ3{Ÿ~Ìý“³§Ýû8{bß«¤¼¿hCF¥þÿ…}öŒÌG»ÎÇüñæ·/ì»ÿ:»òUÿ°› b€Cþ¸a#ï½ÏP+5ÿYÛ‰€&öô¯/ÿ»OVT‚O”./žÜù”*ÿ3̆彺àÝî7þœµgËÊÇs¾B½?>yŒ±½ý<*ÿJS[ÆØ¢v^oxA ؽ5‹î¥ÿ ÞúæÙ÷Ÿ *_õB©Ðî&?31™‹©Yj£ºÕ Aª´”T™R#Ö5´67¸ÔÄçù2i‹îÝWÕ@ª‚ä” }có*F: 2s˜¹T‘š©2ª[äNOI-PªÅºÖ榼P!ísœÔ¤——’] –êZ™›ðvœ²ÜŒŒ¬|ˆ¤Ö–Þª–Ti)i*TÏÈÊ̘Œ©ãM­kêŠY^zB3·®"ÀÉÒã2…µª™äf$È…BYJ¶Æ¤úïQFB‚À¼ª‰T 39N%2µ4Ó—’˜© ]3sC]ùiñY*ýjUM(2S³ äåT¯©ËÀ%&ÄšU5ÔÈHˆXؘh3Ùƒ¦|«ª³Sr•œ¾±¹™‘45)A¦†‰¹•‘®ˆw.ÏÉHÍΗ DR K ‰àTŸ’ÒjT5ILJ5³ª©+d§}Α©t ÍÌtd YâÖF]~/64 ÏNÊäÌL9i9B±®¥•…Ä“e§¥åÈD:FUMŸ>+ªYèÝòÀTŸâãª×¬€ ›ö9K¦’ê1”gjn™•úY WÕÒTR4¿zÆffFºü4)ó2S³ò8bzÆæfF:ò“ŸÑŸ˜jme¡«IMN“«4B±Ž¹¥…˜QIOnz‚\l©§ÉLÏUˆ¥zV–f ÄÓÈsSÒ³ÔœÀ°Š…‰¾@^ò£k±º¾ )UÌ-̤l˽øŽìApé©) TßȲŠRnzrVRj`j¡§ŒÏÖ¨jÞ{Ó«”—ÿ³ÙÍ­í#—½Ë‹»çÕñû_‡8ÎèÛöVžyßFWŽžÎ<¶ Å¹Ó—”Bºqúˆ$´g M|HpOC×f¾5egN]ë¿äø@¿š÷vþõYXÁ§Ûží'ý6ÌyÎÀvW2MÂýí®9ÍùM;ñk;°pZ¹Ø9Ë´~G'Á’Õ{úþ~a„^Æ•-&ìvô Ô|¸+·¿xvˆalçÖ1̦µ§Í¥#§ÃÙ3#HѣÔ=wýlÄç–÷;¤³d÷tgò»-—X½8>þ†a;>6ÏHxì×yÚìÆeÕ£oÖ\TwùÁAv@Îä®íÒw<²~H3£wk[£HÓ>î (~éÑî&l/\Ø-bØøã˜Üf“öÊo¦”oú÷è<~õâN. „¾-ú-Š¾bðK? hw9Ã$<ÀîêÑÓœ¯ßß~è“MNb»&®ôø÷Ó§<«ÑËäýñuwŒï\]kÀ½cÌÈM1¡­Û|ºùLà|õÈBÝü÷í»ï[3ÿ•¹óô¹+²NL¸ún³ÖÍSïFúu¯÷û…»;»ÏŸØ­Qßý#ZÖˆ92~ÊÍf"yüðNN{6­²l1}õ¸V¯Î5ï?Ï50Lïã?»­GïíïwîÚe¦Ñ©3—ë °W{çlI`ÎVÊk÷ߎØ{µ_mÁø¡=ZÔŠQéöѹqBhp}×fþ5å§O]í»øØà›œ÷W‚zÌtökV[œzñÒï6^ìäbþòÒñ8»~ú×®ÿÅ í°jÍ›6|~ó\Š¸é¹C‹JNÀ¹ Ãv}RpŠ¡-k­_»®É¸õsÛ;¨âo†O¨áÛÊÅ8åì¥svG×5Ž:s4UÌ]:~LÕqp uú»Ddž†`Ø6µÓ–Çj/—Fwoß üaûœVõ^šßë× ­Âr^ðîÚhÝIï¨ýý—Oï¡×bûÔ®u+ßöĽܹ¦KX‡‘üõçÚÍç q¹±>^/óÕDñ­\Ü£r‰ˆŽO h7ã2ÿ°òÉ*{ßÑ2¢ë»…¶ªM[tx²}øϼý—Ÿàçíÿ,GED“‡ŒŒÐ¦Iz¹¹«÷À#D4¤µÛö)|ˆ‰Ñ̓÷Æ*㶠vê²\ @FŒGÓj"âT*¥†ã*@ѱuÏI…×RÆímÚìG}ØÛjÜ”^AÝÔDUnˆ_“¤¤KMÜçQÆc¿ÖFû¤(5D4$ÌñÔº¶}Jω{‰(ëòw#öí÷ï¾–ˆò£y´Rd–rd²}øO¥ñUÑ”!!–Ðf¤ñh:èà'>ÂïF{cIùù©‡Oó…6¥ÓÏÂçl¢ÜW®nÞ+ŸË´ šZ8®½ô™ïwŒ¿gÓ¾û‰hB/ïµgâˆèáŽ^ÁaÃxÛ@ÙíßO#¢íܺ/~Â7_5¼«CËYDtÿĶ}Wð•ý:Úx‘¿¾úkËæcÏsDÝÛŽÛqƒ¯<950ü‡K¼‰›òéj{ŸQD)¯¯¿ðœàÎüþ¡³÷ðd qñ¢ ¢„0÷¦¯y³DNv÷f”²ô;´¨}û~Ú¤]Yg&Ø…/%¢ƒ=G­z¤Müsu†sè%Éžú8„¾ã)õ“÷ècD”{o»cèP>6—yµe«D“Û8þz"ž·ŠœìëÖ};Íì»pÿ»J»BùŠ‹¦ÆÀ¦9ï¿xü\œ¥…è÷ukÕµT'ßÉ9ÉóN]ÎÖký|íÚD‚Óì‡diôj†ñ=œ¸ðÉÒ¢úfm hN½Ë·w1§jXמƸª1ò3€±ñœ­ƒƒUç#,;`eQuÓºµ‚€©¬¸üSÔ£ê‹D"ñWY©Ú´VpqlýÒ’RQµ6FŠ%Iù?'ºëâÚÓNþý™,´P\Ï—´°°næRe­$ؾjV·K?‹mG?*†Öy“Ñdqmóü?>t;°îAs×­íø^3"éуF¶Í‹ÄZ'/ÄYšW-oo­Z r·H ¤$/@JÚs±„;úûz‚t™IÊ»(ƒH¨ÞP îC¢°§«Œéí[£ïµ2˜qâÚa€t,Œ ÿ(¯Gküg:ñ{ûw³_ù˲6Någ׈'T›*ôŠOÝ«ökT ÿäå,ý–Ï×­}©ßœGsáÛÀ+ëÐ]Ö¼Sª5š‚ÎEYZÌSͧžÞ°N<ƒZ Я©Ù³ø4ÅiLê𠌪š@– dßzT`P÷îÚµ·H¬—r9V1»~qŸÜÞåWûŒ àÑ“·ÕÕñ2-“€3§€¤WŸ¡ÞÕ `L:®­KE‰0™ðÓƒ}s7^2¨„õV¯ž¬S¹ÑøG¦@`R=þE•kÈ´Fm{{%G³_äjV½¤½'W³ší¬yg6•o} ^LªÏ÷ ÐIÕZöJ Ìþ7³šº…‚@A‘Ó@¥!¯+\gr5Ìmê;Ø×Qq0»¥n–‚o(]xI¸D¯\ãW"¦ï`¬÷æ³ìÎãG.S–44 X²ïCõ†C–7GÛ§wßsŽ9wÛeg-ÿaÛãÎ{;v6`ïVåÓÊ4(÷Ås{õm„_«?_;ï1rVgSh¸2øV)ÄWPl;Ë„‚b€pœZ(2p°³ãQpp°“šU§HµfÀJ•F"iÛëšê•'ý– &L%Ðk-uuˆÊQB Šg¡ð?‘D(˜v~íí¬©p~}`ט;ÕÝ6¬šb¤+y¿q„ä²ÛæÙû"ûÄxypõÔm‘5$M~X`|í§Åû"cbžÞ² ¸ëðbŒeþŒŽ‰ºqª{ë7Êì ||m·/^ðìÅË {W\34ùæ䩶ÃÛÜ]8òÞÓçQWöîýøYH@ªkš›þ4êÁÕXífÌz¹¾Ïñ«÷b¢ÿ>­gë1kÓ@7ÉéÕ»_¾Œ9¶~ŠÒD”ý"æMr:ÄRMþ™ów½z00¼õÎs7£ŸE_?yà£Ô¬I€K= Ï«tuE v3òì¢ï>~öøþÒ­ºÌ80H ÔYg.=:µ1¼ËX]ªÞª»gÞíK?Œº·î»Þ'>X@ÐÜeÿo?F¿xyåðšHƒ¯¨Ö+ßü»1²jР&ÿÁb„:‡¯6ynñ∠ï¤×œ¶ q#=!²tè|ýðÂ;ÖG,]™i;ìæöïZ4hXËDÛÕ>xõ¬Eì…Å‹#ν^:k%°©ÛØÚT{Ž×±k` í”5+:íX»âð½œCWNY1"‘íékGÑÇ/Ž¸–luûö!CÐde¤*4"—ö3&¶¶š?kÆÖȤ ó:Ô2`jÝ°^ m$fPÓ©QUþ:%ööÛmâÓÀ´G¸Hªñkàà5PGÄÀ„Ž]üª€@<<Ô±®sŸ&Ú AÆ­ëš›íRÌ‚j[· @ !%‚j¸¦Å÷ÌKÁÕ¨sÖ:6u[iñÔu°3—j×}-[' ]’þ°'r`ÝŒ5Ë"6¼õókƒü,!Ðq°·ÊõGGèX'+bÑ’÷Á‹ÛZ@ P«¾¥±€¾y}Û:¦Ú)Ô±t²¯Í§Î‹æ÷³Ý°<âÔKãÕãBœ€SèpÿÚêµ›«9Ôm`gf Ý®ê™Õ·­S@ýFv¦zÚa-ì:]?òÛC"–®Ìh4øÖŽID¾þ”‡òÆo¿-W¸NšöÛÖÎ27¾f±fÝÈ7G7F&5º¹26rÏ’ˆˆƒw2w]8]•@(äCÍôjÃºÕ µ êUw²­Î»cϬsvÛŠ¥+×KB~>¿¤;APgIDŸ‡»WŸzm4¹wÃÂe±þ|¤KþÕk6d6yfUõÿiW_'õ’EÑÔty—êÄDjÔµ«ö|Í*Ëÿ¤fêmQ~ìÛmâ¿ü'—^yœÄ+d óé²öù7›¤¼¸´óØ3þ:jéÿñ›ÿ·ÎíóGÎÝã‰srl`»eQ•Ê Tù?ç3Åã˾Ì]ÿ/)ŸNýÚaÎQ'ßfÒ”GÏ•ÇÎ_¨"ùƉ8?îNP×I5½ê°·½ÿy÷æ ôÿWNnÒå5m¦ì°÷2Ê|úäCöþsWªé‹*·ÿœRé¢ù/c–`LžŸ“/W ô uÅ‚oÈ=yûky~N¾œÀtô õuÄÿ;E¥D`LQ›'S‚ ô Œu%‚J¡p%»©,•¥²TŠŠKŸ8PÚ³²ÜÊ þ}_´oÁô'ûÑf»/Î7•K¢Rýqø:ݨÔ]B)hµU_Eÿ•ƒ,Q¹0—] ¥î•ð§ —Ä—·ˆ¾AÅ*˜‘¯|GË¿UùÝýŸb7Œ±“ ‚Z¥tîU¶kŠKËÉ7ÙWƒFö ´»øQówm`{±ÎÚu÷ßî˜K‹²¬í‘É•$¦¸³Ô¥Ï/åÄ÷|½Ý°~ÍŸŽi ¼]œ¯®ZÛs¬¼(Å=ˆ;<¶µËàMLÀq¯6=2‘²¿‹‹“«»‡‡‡‡‡‡«“½{@øÒ‘|B(–uÒ®ºçKMÉÀ¥iunÅ©—øpÆÈîM<ý|½›Lš¿9‡cDb$Kusv½gˆ½ƒ“³³³£““³³³“³³³³³};•æ‘w£Æ…cº;ÙÙ¶é5öêû|VÈ&¸¼Ø¥³Çú¹Ù;8Ú;ºûO˜³âc6­Œ±O]ìÛO[à ý¶S¶òq° Ÿ‹B|©‡x¸7v딤`…4v¼_ã¾'RY…ñAó::TßñLÅK|¼ÉÉÅÙC[Üí\úOXð¡€ñ2H0ÅÁuóÚx4²µklïÞüÏQIêŠØ7clý„Þ.®învön¾›— Ó|…ãÜ?u8·’[üÛƒò˙ŭ»Ì¸^A´s®‚0Ù)£¼½Ç”“è¾ü8ç\ù±¶¹21¨+Ž¯Nôê÷†þc¹òY—ÿókQ± oîžÑïçí÷* ‘]A'åD;ç=¶>Ÿõ ›G”ÛÝ·ñ®¨œáºmBš{œL¤ü>°ÑOWòˆSŒðó›•SÔEΫ³M¼·PemjüJ]rˆ´ÖÞNwâ•Dùcý³¨~x[ï‘ËÏh’Þòm¡)¼—¹É«ÛØ`>ò·mú¬D§—Vpql“¨$âˆrßurs8ye&Œ*mÉ”Þ.Íz$h´QÙùêCsÇt½±ìk3½nØÂùèkea¤wÕ˜ €nm.;_4—§‡7v&­bUF^o/Û½1J"JzºÍ?¸G‰[ŠˆÑmºÍàÌëáÚiì£DÞ³L¹gáHwÏ7YÊŠúÝÂ!Tio0ò-µ–„Ls·²¶qžðüK‹pRDJQÖ7{ 3‹q'Ò>B’J8BøÕx7;«Ñæc6žzÈG!T_üx¢½™•Õ¸=·ÿˆYd}ö-4¼Ô5rhSfg¾|cédÁª{¿z®—¥µµµëÁ[…!øxQÃÄO€B¨£2¦«µ¹…}Lâ³ó[=goÌ@>>9ëí<ÆÚÊÒí—ÅyíÂYûý…ƒÆÁóäÝí,’o]ï¤ëæ¼>PÓ2Ô~¤Z·¦ç±::ÿV0pÔe^¿Qú'ó¯üMÒ”™¶âWŽ¿š~hùx¡Qtñˆé²ùÝÁæ!è:á«ýûºÌ18VSáëç*6 ¸v;ÓpüÉØQ>9ªòŠçü•¬‹¾ƒ$(ê9ùd0DlÊðöñ°4KNº.a­Å h<~¿”þÆ‚¼ï«NÆÜy M¥À/?s·˜ìÌ~“AR˜6cíA²´)¡W¼†¢y bVT wZ7Î]4ÅÙÚÆÆaüŒ”7Õ¡pOëb:k¢•uÜ{„¹M{V͵±±¶²¶[»ÿwB'}F8l. ÓiþÍÅ…V•µÛqkbNnÁZãú©û€.-/+Mé~ýûØŠìÂRR3níø-"ÀÁ+ŸýÇ€»ÃçÉ=Ë^}ãêÿ[Eí“&¸g¤Þú Û‹NPäFkH‡.´3%/77óÆžøµUh˜Ž.µ´¬^¼Ìa7üäýFÀ{~²uTˆ‘̛ɂlcnææd?8>{¥¯ó§fÈ´fy®ó 3?ÿñþÄÈÙ¯¾±$Ó$4ì ÞþìÆÓÜ‚gÜ´M3 ý“·_ÔÔ“9¹¹éîÍ'îvÈÉÊ¢*(È‹îãå6Ú9kÂþS³Ïååää<}{<,å]#Pé ²€ym“¦¯°Út³ ?3`PÁîë5 ÜÆs7œH|ð,'7ïf´}P@¤0såŽjà¿Ôã¤ß+Äßdìú›fëbú÷’Bâo~íÍbº‘­öŸô$Ýp¦“ô÷ä¬lW@`ªCœ¼·åÀ vè8å?1©I„Lñ«5³¤¨H@Á­ }·PqJS.Žœ¦L/ÿx§¯çð;>¼jç{ªù.ö*¸r½^Â0ÒÁÓÚºØuCä®s#(.y¡ÔO œgý¦#/E€:+ÄÿÇ^pLðÏåp¹Ì–/!g+C×û hîåâ°íANvvÆ qAÙeÌ]IGÍŠI¹9«†ã”0ŸÌŸVdgçäæ<Õ­8±æðkdºeÏO¤4ùSü("\UÇg„`ŒÝ"Võ3~É]#ÙÝly1zòƒŠž6§¹­@X… Ì ]5ö½+i.‡ÿŒÉÞ¼ŸT:}žã¦Ù©Ì ³eAp:êšuT2 €Â`¼,x3Q4È yüø¢ ¿¡¾ÿ4nب÷ò–DnÛ·ã‘ã3?îÕ‰s§é3GHUÍÑ¢¿bʇÊ%ÊÀ Y·ÌcL‘ÿÙDJ:©èÛ¨A:oqiëõw„áz›N>µö;UÕ9útÀxÄì8« &ݬ²çOjLó¡Ð´Ò§Ám :s# ! ”‰®â´–°Í5SŒ»†þrôd9BŒqÖÇVaŠÒF³ž§ø!^SÕ†‚¾, 0íé¿Å=W²u¶>ŸYý¨™{ÚE§gÓ?Ý·fá)ƈà´|ª¨¢ õˆ±”ýÓ¾\Ÿêvþ× s¶³é ã'«GvIcàT},믦G¦CïUXɱ!‹©BÐÑðåkMË下òÐQÕŒ4 T%oDªý”YíïûªIáÞ•Ø&F]@v²¯Áæøk_¢}µ: KØåþÈ*2Ñ{óœ‘i°üo‹"„pmeYuÚšü—ÕpU 4ÿêDûùþqë;G…=Þ¨µ“¾ ¼¾õ¬\g§bŒ‘´‘¹ÚÀä—Å6îˆEitô-ç!;d´4À¢·„É|ô§èwÏ"Mâ/i7Ó5Œ… Põ“j©ïèz^N•&ÊáMšþ•×ëÌ,MMÒšj#€è ):ÞLoÅœSÏyD[Õ¥©_íP]¼ÈI‰eaëáýKü½Àg¡}Jò+€’”æ^#uÙÕ€‹›¼õJkÛÙ…7¬ÅH«iÌ+o„¢Æ@a=ÒíO)k¤Ñ侫F:Zr„J£3h”ŽŽM`„ ¿¦b·yóxJ©¯µ „žM±e_ijåî9)êD¦äXâ³ë0¨0¨Âw C5Lﯟœ°ñR˜«å˜±Þg§—´"€Ú’›4½U”pjòÄ©)§àËíh–ú|m%zO•ÃtfXLTTÌæ­F*­š¦þ®lDÜ¡¨ÇÆh˜ãœßç=I}tùt¿â$Ïà#AÙÛ»JÃýðô >›â¿nSTTTäªÅ¥_™áRÃt0Æršý¡æC]—ôÝ --2ò}ÙrÖÜiÓÆ£"###£Ë‘Ö³{GºÕ:zóº›{"+þê`¥ ˆˆŒŠŠŠŠð3*­”O|öÈu@C4u*zõ þ@véy.ÍáÙ…Í.s\œKÚ º¡UY©ŸpØc=ezi]{çbrÙ}?ܼÁÞÜÌÉÝcID‚äÊ”5ÿ†¸D´Õˆ;¬­ƒ+«$ó'Êmnü)Ç`o*€Â@9vMîìp„ܦzd]¾PWt•>À}ƒ‚dU ·¾[øìÁ¾A×bæg7ó©# |sµ(ã‰Â( ¨¹K5~dÕÔ5 ªÉPSV´™."9Ï _žšf »-e5mx’d€ ý§~‚¯µÉ1H§Ë ˆï~vS7"[ΫòvSc @“S_›øºàÉñ½›Š/¯;‘ù©ó³¡Ðä´bSB[µ0Ù5Rîxö^nÆýß·,± ÷ó¯ÈJ¸ìæ-°ØÈw†|aZf?zoÑÊó¨½-*dhhÖÖ¤±éóÓÉUⵎ’¶µîK£È•‹€UÔÆ¢+)ÒÙ-ß²Ÿ¿ÞΑSQ²/vRUvV@Vb²g°`ôc§·ªæ míÁÚÃÌ/EÙmXÆ›b̼ŠÔI\ŒÀ³û׆èû4¼M¿”öMôùb‚F¡@íûßù4­ _ïñ&L˜à¾dy€ /#½Ë\…C'ožÑoEøaõ¯ WÚàÁÚÚÚƒrZâD‰Ž>)lÓÀY2EñŸÚ$jˆàö¦å)ŸÚì$ j]/5yfñ§fy™6‘á #€êVÁ@E©.+ªìÔ°ùù—NÆk5߈J"…Ìÿ„¸AÔ†—y€ üÚ‰oMþ„’ˆ¿'ƒåo®€ä\‡§K@ÀBgómK€³Çøâ7Onºê½‚‚µçúÇ´ †¼¾©ƒ×±0€Êð¡Ì¸S™£,ÝèSg >rþ88+SÀÎÇ®îá½Q{Þ†ðÅõlf¿9Õ$4ó峘>Ãð 3ÓÊ›4ß@ë—û¶€Ð±ðÉÓÖŸÕÒÒoilüƒ ýå©ì²®Ê_/W«ùÈâW,Ÿ³ì“€"­­?Ò@E±±Ù)¤ôù˜û²Q€øe÷.¿à¢4¿¿¶xÕIVP1qs’g5µq¾T )%¦|@@Õ]:[sÿÚø µ©C¤~à|E(ª–~µ \ŒD´.#\,ÕlÜÕ.ŒÂ`Uþê¿Aaüúá @|}ºpnpbÖgñ½ü„„LU3Søt¦Xcþ0ô¯™JÆXÇsóHx¿:ñBcpŸ.õá^Èö ­¢„¦¬Ë»–,ÖÚ²qB{ÕÃ}ÑaM¬¬×/†ëŽà'FÖ Øn?ÆVs›‰‹¼¥m¹Ó­Ÿå›‰gg’šÿÑÂ/Ž‰n¸u(á0¦ý4ÏÅ€´$üUSxþ~Bdäõ"]©êJôÎv.Ï8RU‹k*š;[5eg?ïŠ÷ê¬oU“GëFXÀ ànY¼(½’@QÓÔ±2ÖïhªÀ ŸŠŠ¿uÒäïÛn8­²F¡³}&#iAyìØŒÀç²Ø˜,à0Ybê,è`²ÙmeŸ˜òC”¤„»äf¯ÛS¼b´ÍyA“Á˜¹+Æéa HËy =téüÑÒä-ÆŽ8ïm7FYmPkcíp×™Þê4 0ÉD7 ¡`ö=Ðrš›æ³~Ù¥€!ÞÇ¢‹7L´– ÕTYiâª;@ZPÅjà œºrÚþŽš’bCÏÕ6ÚŠm¿ùY)]e/«;u¯wöbs+%j‡’žëþsã|õçŽ2Ó1Ög ž0ÆRE8=3™, {Ê>ðšö,OÕ ±2ªÚ¼–oýõ÷;Á×·L&¨²j{çÙ†9[¨ “R±ô›2ø&úéWfÙŽ½ ®"_ÝÀôÚ°I½8³UY[Y¸E¬G8N^¸fÊÊþçi3#‡É”°™L.ñ}ÿ›™ßzý£sdŸ]f¯;~zçêõ®£9ˆJ0ú;:ù&m™‚1–ýÙ÷Æö;î(oQQ’jj˜Ù:'î «Ê8ÅbЋóyL¶ä’SÀìi3!ÚÑs¿Z9Í|ì㤫€• ’]ˆØæ:j ‡*%ÀR涮—®ï× .Q^w;7bQéæ®þ±³M˜eOŽ–+¦Ï×édÒÁã¦m ‹ç¢ ‹OˆvÜ€´öÝs=—5íKÌbvð á(ã³X¬ïË¥Q;£=,Ÿé›y£Æ/¦ÄoYþ‹Ý×fÑíÝO¤>ÒWê“·Çå¾¾ºË6y?æ2Û›Ä_9€à~zÓ»_=lÔW—58,Šw6è`äbÈò¶ëu-|žeÀ»ír nGaØÖ£Kˆë˦\´»ú«))Pþ|¢èUÏì±ýNýøý,ÆB?ê²®G=Ÿ ü·ó èY=Z0–ȯ¿{Cz-ªãƸsEª5êz3™,99Q˜â:? yw–Wë,Fôd€)%š€ÕÑ!+/ú†Ø™^Üç?¤×®õÄ¢§³A ³Â=NuÞ‹…ý…PïÐóÓêí!]߱˿¿³|v븾:´ûkv-¯Çã¡.W}Y¿7K×FèÑŠÐkgõeLé³8=Lj|}­ÈBþø§f’ìëk1Õ[ã¢^’É÷XÝ{Âyá¿ÝÓÔ÷,¥KRz$yA¯1ܽ$‘nõR@¼šÉöÛ}jkk«É;–Z¤ì⤆%Š±á¹ï&D°çMpYsùy{{{ã»ë'Ó¥¦Íø ÷¹;u{ÉnÇêî掠õúÊ•ê³\Ôu{x7¢ïÙ½ãúêОõê`—,_BþÁíè ƽ6BVì½³°€ÓÇc° çs~d¶×ñ‘á^ƒÿ{¡;ÿÇ´›ÿÛÀÖ·ˆà¥Ù%µJƒGÇîÙi8Pê¯nÁ·mYôàe…¬Ú°¨¸½¶ºòÿKI-þ¿ƒŸaú„ÞmWÁ=xõ‰‰Æßf1ǼÜûtj÷ǺöÄX$G'ÅÍIÞàŠ÷_§)è¡‘“\ÿ†üGçÜ_ëäÿ™Ç’ Å $þ€ó¯^[ÿbMÜM§±æ]ì=õù«ãî:5£t9êßg:zêQF>GAGO]AÌO9,1énq ÇÜh¨ØÎƽwîXbÒÝu|³ŸuEvJ~Ã¥ã‡/%§U¶™› Æ×`@¸éýÆÍñr–ãĉg0ªy÷øð±3©™ü~zºå%ÕŽš×W÷ž¾g7Ææ?´ cŒˆú‹G\»ý°¸†mn4T²tneÁúƒw\íÍȹ” ø×21tŠ&iU•~Ý?›ŽŠ›)Ù]O½KŽs[ð›ü`C-é ¼öeÕ"„ÂÛç¸Éie:²)?Á%`7BÄf?×ùí£MGÖfvÚÏ„PõLg÷¼AînŽô²ËñK˜|@/ï÷š¾4ûу Î÷²^^Ù:añ¥!# 4h›çz.hêôõ@ÛÇ…þ›¥¦ý+Š7üCFPõ‹ƒkæ7)“‘ÃËvð‹BH{ˆ1CÓÜ‘š>gÛ=¤I‚DA`,(}û<--íÉÓÜoí|Œ1î¨~ôä¹Ä µòCFzÚÓ¼·¼²¶þ<Œ1&Êò2²Š1Æ¿-ñ<šR)ŒÖ¯Mš?z|cV~¼áØ¥ñßc¬õÓ²VVönCÇPBx`»ÙÛäUu´Üæ±YT ^›Ý»¼&Æ8:du3fÎ02»V÷½ª1 =Î>ù&,ëë¥Y^ûøbr‡c¡^+v]±qö&öm(.L/ìž¼õyvzmskÁÓÔ—ŸÚ1ƘU_ðìÉãÇéï>×aŒY _Ò³ò;)1 Åž¼Âÿñ4µð ‹À¸êê· Ó¢ª¶”Œ¶tþÄÃs²Ÿ¤Ö¶ó1A`f¹£…ýK&É=@‚îÓžº?Ðýî·JžÞ8:Á|Ü»fêò‚ÝGpêó'úßÌ~ûêQÂâ­dDœ•{ða9¬;t{‘›†p>ocò5¨i FQÄ.íqýen¼¯ÏH-6t6C"8mœ"ý÷?êu´©Í_Û„¾Ln+±Š40ĈUv7î¸ècwæ8 –ÕÎäÑjP¡òû»ÛlwÏÚyñç”s¿%¦w{Óø¸ 1KB]Ký\Çãµ”Ú[¹LÎùü!gí,×W^IÓZV†¬+=êpkßöCi¯ø·÷Äœ+huß)Gæ …©y 0mßø¾NŒöv?¥U‘I冉¾èµ8댼ÑU—´²ù¸,y˜í\>Æ÷Cl\6d §ü7ç·9ò$ ´¢ó'§±ÄÊÆ!¯ž1>µ~Á¢Ø+úÓEÎSN¼9¹znð¾ä΃Iþc9óc|sçb' ‘kÝÌ-×^.–à5jœÞU»é,‹UûÖÂz\a‹0K}ù$Óq¯Ø¸£¢@¤ÝôÁ 8Ý1ôTªˆQlÕ˜ñbzªŠ+?›ÎnÅ8qžéœ“eÂc =GŸËj`þ"$'®vz© ÆÆõÅÉöã¦s˜$_"ñG_A Œ™á~ ÆÞÓµ0hÉ${ÃNÈÔ×Ë#a04Óã*ÉjbΑ¶²L¿ˆ„Û¡+ @éa>%DË/$çx.;²ÂËð™}ëáÕ­“¯+ÒúN~ˆPKÉC—9[ÂÏÜ¥H€AKl£”¦Ä5]ª÷½Hž‰¶pÇ=ëV&‹aõ`óæT R˜Êü{¶@èIDAT’¬&p[‘°f³`~µîJAµI¬òwÏ÷½¹‚­îT¯ëǦ Ó ‹Î€œ’Ÿ¨å˜N!íÅ$þÑ õ¥òû¬OTYúêìѵ;×·Å»k#>Ëåƒ,U¼³·/|N;6+*)þú}óA²B_ÓeÅëÍÍ—UúZòC¾ÉÝlíåp,ëÍåýŒ‚«c=ö’H„D\ŽKÈs›t/¿¨*Àã !*…X0ÀrÞ…] þZÂè²S—woÎâmd™: ~{·MÕ¹ÑÿÈ=:™Üò¥€Ã ¹þÚD1ÛÑtšûÙÔù£¤0BhÉ$SÚ¸]û òõg–’"cB@`D"“›£~çm|ò^¿à˜WRbU\î©;)ÃÔ ÇumRU¥“XuU4u-ï ˆyF…vCÆz\ØÞ‚©ë­u·?¨ŠÐæÖf›ŒJî· ùÚb’¨‡ölg>ÏòÒø]ø)f£ö˜´9z“«ð¯¡Ädìä‡Ï_ÊSQ¸ï´“)_Äƺñ<9ÀÝìÃW>ÌãH Ÿs÷gý)÷ïàÝÍ=S/rg\ÞèôwËìd&홳ÛííðWÇ; [¥ G#µ –1]ñЇ4rò^醒H‹ÝíÖ››šäNž?BüŸüKƒL Ú}@J¶ùŒ ŒÆtawhAbÙv•¼¼h:a!Æx›ƒI=Ƨ—: ŽÃ¿ˆ vš½^¼Ô ³ì·FaŒ¹•ï­uG_zʾ4Ä\2ÜØõ Wfœ3µñ6²˜Ç&„ Wz˜Z¹š¿âbLVŒµÚô´ ÿ ¢˾hj;wÌhËR&Æøû“H£«0Æõ1¦¦.? ö½ö>é„h?&{Û‡¢_„äÂ"hºs‡ÿƒ÷˜³ÁJ'äe æ¦ß•ŽëÒÌ zV…ŸÝì¼0X"ŠŸaîÁÀcüþø}×À&ñêÊ^Z;ˆ¹²|r@„¤¦smz,V8ÿñÑÃÍò™ãB{]ÛnÆ›âK[º9ÙD;õ[ëÇoNœdnj_Çkî[ÅøÁºQ¿ ñ¼TsOgKƒ˜ †°,¯¡ÄÄÔ¬K`Œ.Ÿ1çPÂÄs½¥ÖŽB"G~E~Z?ï„}kRÏq\Äï0r~: ¢“Á%VýÉi–—>~«½µÉnËeŒ+Æ Ö½^×ioùßßYØt¦-Úé—&@`ï^>ÕÀÜÆy¢[tJ1xuØÞjÕ½I–Æ«!„]Þgknìà`g1vÒÅÇù€²5Ö¾xê°÷4¯IŽVãç}ÔbK!„ü=œ«¥«]ÇÇU¡¯ï¯{ØZXš›Ÿù¤€Ú5Wwqð•9Ó§yºO0sñùÈ 1;Ån’¢IÍÌÚusãÄÛi÷/î–9iãT3šÙ ~‡Ýÿü‘ˆ0•ÖKMð1»šc@IqÌJ,nëÎå´7êÌ0 SzmqR›³1#Ôчc :Å“K`pÅ›haDcvâÌñV6¶&Ffþû¯"„0¯Qwäˆgqáóg{»Ù›9ÏÝV‹³èÅŸºæ  ;RzÅ s HƔ֛hilváKS’5ÌûVOêÖ]x<,à‚¢îíô¦êÂYP ÑZîm¶`“ÇsY$03ûx>rƒ´8ã8\൥!àK¶½´ô·ðÑP¨¯øÆ>›ä»o÷í½>õ¡v(c ܯg¾n^iåÙ[æ`R>tÊ¥NÓH\å¹{S@û€àó:"Ûb ¸ìŽ„ÒbCìM lmm LœN>*D¡OGzY­½sbì™ÓÌ Ö쿉P£¥žÖ“¼!û˜Ÿ Ô·c‹u!8zô˜ËÜdÀˆU9DG?ùê®y³¼Mô7^J¹{ë\‹\›\uŽÄÍÝà2fV¦À{5¡v*àÈ­~ C$9M˜äµö€×ZþûÖÏrô·Y»xš¾ö”VËYÖo£ÓÌIF ?OnýLÈIQ„à2k2ߧñˆæ^PUõ†÷AaŒÝ6ŸŒqœà11Â!8a°"ÿXqꫲާq›«Âô5` P[¥¸üåÉr¦z¯R˜¯ÔÏ4ÈŒðZsãÖž m”$Be÷ØGË€þΣ=ö0\OÊãßÓ9ˆà·|Òe£µ§ß훣Ûî%ók±8ÂHºçÈ!=~^}Ó§=g2v?MIhxbf6m\Ê 9ÕowKG<;3_Ø%F¶Óª—Œ[l¢–ðÚb¹5xý,FÏlŽT+û0àO÷“áà±?1"‘dèçðÔ“gúBU´¡ílµÐû‘ 4k>Ƹ® XjéÎ*ŸbË°§s‡À툕ç¯}^å(=móÕí‰vêðíqÈ„˜¦4êâS±‚Þ*€‘þü@€î.«´ ‘ 83#­Œßâmõ¤£&Oû Žå¾\;Ÿ­³r§°§3§Ø|›%ü-ÓÃN ˆ;™Ô{šO_ `©~C›ê.çK’óM5ZHúŽ“/ž»`תò9\@ þc èc×09“UY¯…½âê: Ëóö•¾°…Á[¤L‰–íóðe©ÝáYhÅŒñ,eÝ gT¦ë{þþƒa-Ò×øí¹'°¿7’Ôz)ˆ >P•—f1X-O†ùìÛ’ÛjäÏ1Ï”ök¾û<ïöÙ½©Í1:Aw½%¡þf? i‘A.†‹¶X=9Ø6 Ò¶?¤¹ïùs;¤!dv¢²¤øÍ«d@ "÷Sô¡à€ÙúBmÒ]«{Ye9€Æ‚3Ýü7 lÃɨòÝ曡X8Þ°ÄaGqž¿nÂüu•)W<|<·E'™iÊ·4«íº=yLêÖíûØÙ7ÌG®uYbÃTĬø´{_HËÌß$csb¡HiҺ͵ë±%áÛú1*?™ï >?m×¾‚–ªØ vWÌ$P¥aë$§½d^ãW¾´ÆªsQ}èÍäpÚx:d¬û«jGÃn±pºy tˆg ¾³*MþPã ­ü»cƒ°z[°Þ”Í…³4Û¾úú>iWqj „ú¤‹ûÝÐO9(38*6¢ ïSò×oÌ£Ép›€-3ÊkŒ<’,@5O0eÛ‚P“ýå~Ö=I¬ØÓ)žqGÅø†àÓ“²îc†Rš ‹(þz`è>BŠ«2Ö\c Ëöᘨ÷à^Ÿ¯D¼·\ßO½›ÓâP'€Ú¼ûtE…±j©Yúë÷º ¬e ž‰äå$2zzrÏ;rKo¹Þáö:êÿ.uS\‡4TèžʨÊcB¨Õ1Rq¡¬Ž¯>\¶yÓz*ð‹«y0¡ %-”7)º4‡×(±&«ŽN‘•nUâ]±»è² 1øDëȨÎsW½‹NXzëÕ‹mÓÜN^ Š}õÏŸn‰ BÂÆÙá¤ö$e½+c-qù/øZÛ­»z«@PþÖ‹õ"ûÛ´Ó=Ü&É€¸‰G/ݽݦÿoÑWÞj³Ë9‡Ýç^®ùC\Í)>wQŠü[5!„À¢í[úås]»+Ë`¢µtþƒDÕ!^ŽkA_ùá.–ãšAR­Õ4}}êà¾8´1ì“êNNÓ“KûÖ¿¯2Ðj°ŠLëÐE¨šc¶îY3ñ0ùéZ%wˉû>é Xy ñ…cB¨ìÍåÍO¨ {lÆ/|øü´éǦV×u¼°ÛW€gAàõÛ–2Àq4·™}è’Ç yq[‰$Óãêî±\—?}Þj—”¿ŒÈ¦Äk§%b¨åHí~æ =ñ/ r¿±¡ó¢–Í Ÿ"Žp»Y‘Ë]³2„>Œ5ž®fç=w‚¾4¥• ˜*MmvCDŒTp5dÛ½§%Ó4Þ>W7Sk«Ëë¨JÝÄÄÑH-E©4ŠØ¢ú‡ù;;ðd ßìF#MÃüjÔn.§ŽLjU¾2*²?ÿ<ì}ð”îÿ¡…pr_\RÅŠ_MÁ7¥}©ê´ÒŠúæ¹…•_OÕêN*Æš&&F 524É3Œ¢œZ»ºë ˆÌª.–%XUîF#·Ž¼g¶Ÿÿ,Šð¹ç_éœÔÚvÃ`Šë—¤½H|]ôáƒû†£Å m>#B/½¿ðøÙDg×¾`{xÐóÝ+“Rð/.Y ²Þ–4œŠ<äbom4F—×Dtn7`$Õm›1ysléÎ3™k¦‹¿“V3MJJJJJz‘¸[ Á( ˜íbn=î92}õâiâù=jÒäæyq¿}Ù²}_³þêo¡3¸¬¬„:›Á4d{Î ßt.ª›Ñ†qj>'Þü…ÐI‹bæq…T¤_?57bÆįl¥`5Ó ºäŒ/ËÉdQ+OïEý¡3ñÚù3gÏž={öìÝÄ=ìk{>²þ"û¬çn#¿»|<ýëÂrë&ÉÀérÈŠ±f&cúýxQØßiôÙ;/=L4³Ù>Þ&Cã³¹¿Þ®ŽÓ¼ë7ï=~öre«NÊH) ˆš– ]ã÷Æÿ¯ònÈ“gÿ¸g3¼p[šŠÚñÄi™[ÍåÌF@ßÒn)«ÎèGšy¡!W…£âFä ½©í­4n# »Ž¾lQ~ÈK øvo‹®©/õÕ£(6 ¸´K0b®‚˜)F—f\=· ÈRÒäËa »›Ëî+‡V§ŒŸ¼¼T(y¬RßéNiªn›¼†ˆ¦<.X5uÛ­rs—aôö¦ Mêw“*Èn˜£¿3ô„t+þ¨£ióó„²2Êiâ¼<»ë£´|c5»"0Û¸§ôä’¥=Œ†vÃm"$ŠÈ5.š³~ÜÚ£I“gÙZìõfÓ”dÞD]Üó‰$EC:4eÜ5dØ0D¢H 0ôÓÏc«£*"m¾~éûÅÅ¿Ôý8ƒD¦þXë` RίIxoKW^5˜Åh¸_@~̆·ß„2D¼¿ÿ¦„#±‰‚ÿoq¦0†^ÏK[d 7Z±ÇŸû6ψœ{› à660¹"žh¸EÇ«]Í*˜•þ†'.EÓ„¾¦€³~æ y®vé…߇9ûY©×&t oáfºÝv˜Þ’SÏâùûNSÆTüÃ$æöA9 Øfž[gº<ΩPlÌ5;Zcý)[‰°qctYTÙ˜ºz®‹oÎ>—ÕÐØÔ&*ÛÄl 8€Iʇï'ß¹>ÇF·²‘/­ÒoöÒµ{\,HB„€Ëh`aò¦½¤þ°GÀõ aˆŒÙÐpo‰ýuqkC@?›ñZ_’O„F«…‚¶þ;¯ÝóŽÙ˜àÖ×çéèèˆ×4ÈhI̱Å"‚ÙÀ`ñ$-jù¹Ïs#£Ø}F@è¡€nã;ÐyÂ`0øͼg71š8|á@Q¥EaË÷(¡0WöX̥ᑰÎFÕ¼òàÂÖukF‚AbïunNB}ðœû⺎Îñd•Û¯êŸ8û]÷õkŒÆdSëìlÜf>xß[HP‚Ï`4´ñ˜Ø¬¬›:7#Ä ²ôÈ&£Ž! E ½ƒuQ'ovº4á‘×¢¡®AÐBEýUÆR«¢ëùŠn~LuZ—*Y?§‘aVM hb16›é´x€Tó-oK´aùõõ-V°Æ(÷½vËQ™ÝÔôêøzãëÅ ¹%þ™k%Q‹QGæᎴÖrž=ãéÜcLzõ¶ãpŒÚ77Kë„ 3êÌ–oê  *'³~×¹úC; X7{åÕw?SµH€1ƒÁh3u á üú†´ï\ØÆU ý¿B:v3ì˜Tˆ [4ÃVg‹BÏÉþ!ßaþùu‹ªW½;ãÕÎk"X,Æ&3ÍâÑfŸ”¼›ªÍ²Î`0~=Ñë7ónÚ/Ó>i~ëjo˜”S×YžH'9+¢ÚÂVZœúØ-eƒ¬F×­e:Ÿt– $ö¼M%­?;§MÇwD{â` ˆuFÑ|Iü(£ Ä[~Ëv2Õû\ÃùIrÆϘ/*Ìo·=ý§½èŒÍI$D;nþœ b‰'í¹*!ŸE"õ~ÄÅexIâÅOn›5óƒ¶$ ¢í—›<Ç{úM"ûös8Õ¶ˆ8Å:Ê°¼â¼œ–'¾ã‡Ÿ}Y;A»ó1*™¡?†_ K2÷Z§A$á“6“$–€Ì¥ml—O$”ÅÞû#¤ d$^x¦ƒø“Ž-vx.^IìO›ìŒš¼ìâ®/Ezä0­6Aèg]n]žïôËF@Ä£ƒ³_=}þ8:D~ìöÊ4ü kC?©Cÿ½^?eœÒµùÑÎú‚@çüèÀåŽoû°Cd¦©"=çkGê ¦#E!IäÅOnEêGd‘sþ•Ü.I¬ Ú­!÷ßܽüìnb•”É­ óDö!„±jÄ™ýgŽºlôûÝ^c${ ñmÔÑÐÛ Š=G%%ÎRÂþ!ù…¶»Nóë‚.è‚ÿ?V¦ðï¾Âï–¸ñºmU¸Ý£_Ü]-yw»-À?S¬ø×ö1KVÐ]Z» ºà_V7ˆhª261‚¹¹¹ð‡‘U5Ƕ<133³²w‰¸ñ!„…c¡š|g¸š™šÚŽ÷<}çBmöLm[ìfjff4ÚôÆ÷fC#ÆýÕ†£G=Êç æµ’š/WÌÌ-Rª¹ÍV%ªyqÁdúÊvõ©µsf…D·Â 7GãÇŸëQÞ…Á¾Ä/Dê,åqÿ$J‚ 4nîµ…ÝÄ=—’ Ô©(zÞ¥ºà¿°gJZíö­ Ò¦[;Î9õÔL“„äd€ýBéZÂy)ÑP´b–wZʺ“Û=àÄ磯9[N  Â­/Þ²rÉåÓCîGo J­Ü¹šTá¢7µÕú@hmØ›A="ï<±Zb'æM V¸ú>|rLJœ’|ÊLÇôl¬¼²<ÿú± ø×¾$T†XÅ„øs 8Õó=f»Wlõ·èD=ñ=VÙêYa²¢ô‡w 7žµwûúåmÒp˜¹×æx/bò1¼»}fÑÜ™ –®}YÐ(¦ÁHég¶,8˜ØR¤ !`~àÝvJˆD¦JÉ+**((©ÿ>PÎ÷„Ðá×Ù¶fæÌY+·„ ³œ7.œ^†k—Lv÷[—¼uA—ºùû€ÑXK—¢À«ƒadÝ€?H¸u5NfîÆ•/þ õþip€¬G¢ªµÅðòØÄÂÖ…p.;4jïãͳóêñomÈÍÉn;ë]•:aêž…{ÉRPì–y«bò¬ Xâeìny%¿Õréa“uboOh1÷ìx`2˦ý¡0!p4þ‹—5 ¡Jo›B±ë×M&°5sùÎÆ~‹œXL¥U»v)wÉ[t9Sÿ°nÞˆ§‘7~Ë;q~ÊöX~Ú^o¯áÐVµ(¨jsxwxT > € )øIýÎX]˜ig½ðzìb‡•Íƒe£Uvê¾;¯ÞÞåñ°Ä€^ñô)K–œy<¦ ñôýס7ÒG¨Àà}A/×l ó8·Lôµ´éX=þø«ÝµYeŸÞHk†÷§´ÝKªÞß06¾5Õªzn7¦ …7£²Ô­Î͵ÃÖÒwíÓWŸ~=0¦õïÛK¡Kܺ KÝü+€@ð>í-®ÏKxÅ:vë•«Éà†ŠÆ¶øü& ‘$»lÀøtž…åÙ^a©ÁÚÄžCÏêVš)µ–Ÿ¸íôesãè÷¶¶¿'Õ®œæNÖõ¤-€@ÏHož?Yxè ·©®kˆ£:g‚íä„øÕîÚŸžŸém°„íp÷‘â¯ÚL‰GÖ›X/HºüKÉ÷^½»‹ŒLŒR"§6øôï³.è‚¿CÝ`Û´UšŒá6:æv¦ÁÜÑÈÊS7âÀ1îŠ0ª0O c„PþË«² £É€««ÊåU{ÒHÂÍwˆ„€±æ¤úÀ‘‘Ç"0 ’æ™+ÇÍÖ8ˆY@²û×z8ì0Þ2æwzPCÑ€…sã>u4¤0[päZt϶ ±ú¹Íï³e\rÓºk‡Sýïê˜Ù‰-Ûš¤…ž¿®÷"½^…JáˆÎyÃÐÈÁ2´®».º  þæØ Âƒ×Þ=´é= CÏñ»áí®ø,ц1µŸ.<”7ÿP Ư)î—ÒÊ!\ü¶Œ¦¡Ó 8ßscOœ>qêô©Ó§OŸ:uòøÚéOĵ³€4Æ­÷èónÇédrgÆV'À‘é7uÂÅS«-p®# AÝÕQò›JáÛòOə嬶…»OöÒ:¿~{Šš®‰´ÄzÅÎ+açÔÔóè£tÿ,}ŸÃ¹MϘÜIÃTÂî Ñº  º¬›¿ªoІºo™¿ÁgÝ­s»HÅÄ[ÇYìÈ)wãÔWsxÔ…‡c§ôÄäK›&.ó¸¢$×PWo97¨/À»›ÛÔìUH¢k€²©›AÝÞ·üÙ m,õ;6›Ú­‘Þñä1Ò—;Ç]Ÿ_f¹IúbLT›;<TµÝö8œuvÝþ(~Éà™ö‹'Þ4²Qaæ=ÏfL¼ÓÎlssuß5u»…ïUIÇn¢ï9§y}Ä€9Œ¯Uuœž¡–¥¦o°¸ád7ÞÎrLÊ­»Xo‘E€!½dòçyÎr_uxš¾\—ÌuÁ?~kÑPÏ’SlÙc‚F#WAA^ÖÀ°€Ë`²åDÁ¯‰Åæ „Hti:•Ü|ÐpXL6—O¢Ðäd¥`£žO“—“j³}…ìç!:ÑÀ(ÈË3n«¡ž‡( rmN!c39ü6‡u+((66ÔKÉÊSW×ÈWT” øŒ¦œ‚!»©‰Ã@tiY) <&ƒMQ”§#ŒŸm¢¿6&=¡G‡ %Í›u6MJFš.ôïà&&“' HdªœœŒðÐ vS‡GHÉ*Ð)¨K溠KÝtA› ¸èqOàzn›gAº  þ¿ŠÝüoéàoqÆÆ\¯18ìÙ¥Ž»  º¬›»ubg°wAtA—ºé‚.è‚ÿ-gŠàÕffd0¸‚–…AS]zögàÕä¾Ïét/Pö‡Œz–ä ‰†â´e¿Òº€×˜‘™)ÀpcVzF+d~(©ªƒæ-׿¬ºªO²222sòŠ¸Í¦JË‘•þŽÅ‡²üO•â×7àêÜÌe ÂR˜×TðåSzzzFæGñ†„P[–ù1GB¿_>¾¯f „8ñXÕ™Y_03©E– IDATÞ7ñpgfW}UQÆûwe•_Ó2rˆÿŒ­‡;žÒøuyïs¾¶§3ÁËÈÈä˜`¥},—\²©,-«è/Я4/³äK’]sçÿïŽÃ/÷ë-3«5ñ-‡“2>Ü7pž†1®~°ÊaI\g]í “rj%×™b>=âWZoªJ36³hà˜ÿÚJo̬Å~¾¾¾¾¾KgzL°0½!>¿ål×g‘kuôMÆ»¸y{{s°Ñéø¥–Óá€Uâõ)Î[Ÿ`Œ÷,q[y,QüuÜ< §½©cÌÈt6á8ijÀÆMKçL¶2½îzŽè@V‚À¸ÑÏL×ÒÔæ5ûÇçìþø”c\~{—éÌmÂjkòî˜Ûø˜ãh:*§¶³b Ý™‹üïߌbèÉÆÿ!¸³ÄèuS§okï-Òr¶ý·ìï†ÆæEM<ÎëÝ3ŽK.™2Ør=ï÷ñÙ¹Ä|Û¥œví ¦1þDh@ò/—ûK¥þ7áWónr–Ši;î|0qÔî&þ\ÙjW‚eË‘¢aH$2‰ÔfVÆÀHdrËÕ"”‘Ëž®Ÿ|&“I„@€Ä¿é<yõ¾ƒC¥E–¦’öS§×;_„<€ B úLÆÒÆB€1) f'­G# ¨EjnIœh€@Ô"‘ÈÂ;ùša‡1Æ„€`—MPé$2™,d8,È  !rs‹˜0‰‡#–¡ ø|ôCÙîr¦ÄxÓØ81`A`C[‹µú¶Ï˜W…ƒçðªÉ–vNK}¼Íì.ˆûP(ùÜf[¯UâÇVñRƒ‡øþb„õôðEŽûOßéçbfê]'øaª’6â 8›äâ ¯@xI½õæØäGûeÚÖõtç’î‡å¨?á:L®ªø*”SŒ1¹›åãÔ›o¦‹‹?;ÚØkÚÚÔ=|ÀHºø{q)Gðó˜´Ït¯Ø˧@V}ÄÞ=‹ÈÁû"zHÁûãëF{ïjç€ 9Æ¢¢‹û·'eÔµœ^¿ÎÒÔpņ ¹®Fã–ÖŠôÖÛøœ…”9YoˆÏ@GXBp`¼žÇ‰|@íZ2ÙÂÉ}Kàš±FKÂ_#„x—lM|V,›åjh8.µ ^ŸÝ›CF—ì‰ËeO¶qtóXãkihäþ³hò 2ܬm—¯ò³73Z¼ýªø˜â¼ >á $F¬´k¿nãÆ™Îf¶v>l€"G_çe»håJg ×i€Bà;yœ¥Ë¬-—YîŠý‚F€nq55»1hóX«©yœv›|ùa; ryhðîB>ÄlŸfec»iKà$sS뙇ùm.ÂW÷hÇÜÉã=6nZïjgâµ4!„ ÞL'{+÷A‹­ŒŒN<*€7§=œ–]0³q_qúã W³ëi•€0Fð5#ÁlÂTPÿl¯µ©Ñ²€Àãí-§m€¼˜™c—EYÚ¸.=ô €;×DëTJS—3õKΔ‘±/ãSí.&‹;SßnÎ5õ2ƸáÉþavþB×¥ìõq×U‘3ÅÈM3~A­ IÉy4ØqÆW¿6Ì(ªHøJ0ÞfÌ‹|FgΔéP£|±WÇ}ôm¸Ƙëm6ôR*ã‡V+ù5ÎzÆëEÿÿÈ™bÏ´Ó3³?cö¢3×ñZ¯ã 0ç½ùPów\ŒqÓã1aÙl‰×dìw6Îæýüú ŒKœ†¿}ô.¿ó¿;虾²¶æý‘c×…?¿¥Å›*t¦ ôLó1Ƙ(¾££ã˜/æL±_l2.cÞBá1•ÂŠwãoÕs8;d„¶áó*cÌ«|;ÒرãâósFM>(¤çKüp#ŒyåÆƦ9õ|Œ1Æ%S ´Åœ)‚ 0®¸4jÔ\&ÆMM¼jDí4Ú[%æÕvr+I•ƒž^®{üú„ygõ0ò>-ÀcÌ|ZÛl>ã´ ^VvÓ„m?Úìi¿å†°üÍ ; ç—acbô¢¸AÄ‚E–ëN¤aŒ âg›™¹0›¯`idÔ³yD—3õËkXÁA–V«Ržíð:éqÎ@sƸ§þü±¢çï.L?üöʽ‹J¨“ÓÞ1¤ºÛ÷^nM"S(L¯3$èr÷Qº ²´ÍÀqÆÍ} ©¦PÉ?¼µ¥4™ ?390½÷™»¯ò?feg¥Ý‰Ý¿{ÓZ£‰Ëo›JxyöŠŒý”‘TÞ±ÇÞÉߢ[D #”wÿĤ€t(ôËÆc0@“´uÚ“]´NPè¥ß³öí'ž¹žèá 2]ZÞn2°Xˆ˜ËøÀÚPUi¡ÿ¨7Ìp_vªÖdÇoaû¼â<›²eåÙsž%x^á›4á– %'ê\|NÃnG_å˜Lâjòna×E“BWÎòi?~‚‹Õ(K üj,jƒòËÁŸÖû.®gqì²h+ðÔ&ô–@½Ç …’'ÅЯý•Òk{ÐYS?99¸¸ºÚMpÙ>*f£Õ¦È*`Ÿ péjž¦Ž^ÜÕ«Œ©fÆ‚¤°á|FdéÞ²dÀ¨×pm…ö”.¤§åhŽ¢,d$’6‘“¾ù©Úþ%IÄW×í+ã7k¾ƒ››ËxgkÞ¥«…Vsõ Æ@£ðÕj2^2AR½Æ“ËÕ>ëŒCË7;÷$JÂc™›RL¸ /9}yv»„Œ‘Y´>¹ÙOt0Òp”j>…NV¾ë’ßMóS2\?kxà¦ÃRRí 2¹:… í.¦!Km<þRC¶ 1¹à‡z@èî·»XHpÉ1iïÒÒÒÒÞ>Ja©ºu§ ½})åž …Ÿ?‹Ý.á¸u‚Ç%‘IôÖΓxD›å&È2”æ^û1nÊœÃçâßÝ=Tð84­œ‰®Ý}Tý4ÒÐÐÐÐÐÐÎÿ® þfY#OtÆl秿IMMMõT%νLMMMÍz²‹öÃy*³†õS !Ñ¥\tÃg#Í?Õª¿~ÅøÂöˆnŠÚ}‰ô<üþåý‰ÄÝT&—¡ .ËãñØäé¿L[«/»y¯Aéè¥z&îa‹ó©,~³ÇÆ[N³ý¶lÛ¾qÑTn3ñ°\·æ€ Eš*`Iš/&]ŽÜ:_( œc;næªáý˜d*Iœõ¸ KÁB¬šXôYk—õ§!`! #áñ$*¹S áñhTj³!y:t¶6Š1ÞqíѨL›i7zzÀaÔÀEr‚Çãñx<&Kfþ:_M!~Ò 9K­ª‡Éß+^Çãñ¸ìcì§3uGZ±+k«Íœó»®—ݲW,¬<ÙÐ.¾2²Ÿbhr9`Œ¬Š¸;)“Ü\€`‡8¢ßxËbîbãw†+ü Ys,€4`Û{b³Ýì©ó¬¨‘0änb°ììñ9S"º‰¨èÛ›HËÅO^¼:£Ô¬É4! ؤ`€ÑýÔ¯&§ÁBÇæt>îÕ¾ãÊÞüÃë–ü9{¿½–(òCï©O¡R›¸|øy7ï—ï.Ê7ãsÈÝ<(>?rš´Ñµ|>6“ ”뵨y‹™ˆ OEU¦ýr½èLæŸPŒ"ÛPK@È’ TTYÐKÉ@e¡ ÷|FA-iŒŠ4¸¼–v#=M-B†qëU¶FZ²Q•<½¼„­Ô~¯WVE5UÅJýFLé?bÊÌʼn‡üÎ9m»×£E\¹–i¼$ÀzÔ`ø’YHi&,©,… s¤0FDe^£Òl ‹ e嵃F[m=Ùúy–fÑyŒ9’zf9”úš6Òkš Æ!¨«mRR6O“ÀuŒ@¨² ¾»E[r‰.º…šjå÷‹ZH—VË7ê+Ù¬@‚¦¢o o9Nßrܲ€åã†OÚ´Ôr()RÆpÚ4mŒ1B˜Áà(Hû¶¶ï4s£ä2ÌËcìöYfF¬ñ^ê4À€8MY¹ãF$ÿÚƒÿ4ë!Œ•‚w¬Œ:²G¦m´nÈœš™çwŦäç]=ýj*Y»'øJŽÒzÍcIrìâÀp„BÄí~›¯ç }€â×å*úƒ)íè\ò4fˉ[?ÕÎTÙ>v½ü\/*-Ë{ûôµ“fÎýYÓ¶©L˜GâjóäbDƒ…BÄý°-Çž}Gzþk•žîŽ¸ý¶¤¤$%áˆÉ8ï€ýó¼üŽ$ää¾xŸÝGKEFÀI~û)¯Še®£ôöÖƒâòòì—±»N¾ã4²ò*«0Æ4©Òȸç¥ee×÷â°2“éˆiù|;ûãI…EEŸ3_沈jÒW0ÀØ­[¹1¾1Ï3KJŠ“"7›¸¯àH) èKåm:ÿ¨ °àÎAÿtž¬Ð˜¼¾yÁîį!Q¢rK2>å©Y¹)ó¦´´ôíÝð\¬4Y»‡ä¥vúdÇ;o>}xö°JV}¨ 8o­>;ëî›ì’â¢Û‡–™xá‚7fÁÔª;W/? ΊS¤5'ôWž¿õLnQIá—´yLBnv7üSÛ×?/àüÃ_S7$i •…ÓÓdÆjë^ÝÕÕ€$Ý­§š,`ôgÜ£xÖ£ˆ•k65读ºÛ¨÷Т°õ‚'zÚšÈÌÖ+MéJšÝ…Q M õ6¨w×¢¶Á ‘é=]CS£åHvŒIÞá—{TÇ%W6!„0¦lŠ¼w1hJâÙý[‚·?*Uy–òÐk˜²²Ÿ-ípd`„0Ö8qÿåÌÁ »·n9ÙêþÄ«é$ €'®ØŸxlyrTØúõëƒvFPü“n—'5æTÖNw°mU-(æ Ñâ(©o«È; iµù¹õß«…¿µ\at¡öÙòf¦ÒíIÞXž÷ðefN»÷ìI%¥45ÔÊæ¨DwÙL¿¥GŸì¿õlÂ@`Pଂ9 =ÿPw!Er4³f/–f¼Í*kLrói|õÝC¾¾~‘Éìg)ñr'<7᦮[µ|ź­}'‡ìô1’RxØÌGû7œ}U¥¿*ÒwpÕRŸE—Ò¥O]9ãk¬´Î7O §n`%ýÑßwq|‰FÜåíÂEy „”²¦º@ï[/¯»uxù²å›\ÝýH¯¨ š=”Ed#Q{öìNÀ²Fœys~§¯ï²eýR'cŒÉ2—ÜN=µby@ñº…ŽCåéוä}¨ä(9ÍrÖܵ& ­Zã“ûÊoOûúúzÆ{¯*-Ù¢À²ÆÏ÷<:±mÙ²e{£?]¸—ÐcšºÍÓÛáwùù-Ì6|}s7 Éªuï&Ý*Et7=œÍ„AÂz ­9{A¿²õþ~k‚y‡Ý[;¡/P¤U{¨¶ä`žÝÍù.€8ü£ãÆìÚlSK—øµ;Ôÿíyc;},ƒ¯äH@†÷a~À±®Ä°CIÊñ}?#3ñ^ýípný‚Õø¾4õÛ3…1 ”ytÚêòÙ‰[ÇþwiŒ¡ôFðô[ÒOŽ¯êxG3py™F%ý³ýŸŸË&ѤH? ‰Ü‰>]\Ó>|Mí=vŽÓ€ÿª6‡&Eÿ‡óò·Ec@ˆ(-.Q×ìC#ÿ—¹_UV,«ª)G#A×¾ó++J8¶¡az·¾Ýe»ˆÓ¥nº  ºàŸ*ÆÞÞ¾²gGn5‘uàÁ»¿rdÆýˆówÛGìï]Ù÷íwøÙžãV\ʺù/ÆªÄºÕ ¥/OŽÉùw«^üË=m39¿Ž<õñ¿1-H¦Õ_*Å8¶}oÒÎﺔÆÀMŸ†îû\Íjùˆû=_Ä)áï±''f·©¡èÝÙc‡CCCO^¼þ•ÛÒ@ñm»ßÔ·¶6âX±±BŸ”³«ž=˜þŸ¤ZYÖã#ço»&ôÀA¶`¨MÙ}&  ñøÎ]‘×3Äùéà¶ì: ÷Ç~`µö‡UuãòéÐCG#_ù&zÈËß¿ó@ ¿Y† a»öÄ}lÀÿ;ê!«Àwk¸bo-9)ÒëDZiyŒ¿ÐRÁÛ„‡o¿¶Ìæ={g§êeð!)â_:w!ôp©ÁƒJVû¶€ø»tŠØ˜ëÐzìl½Ô¦ßL?ÂmpûAý·²Aµï®ñ[Øb@ùÏ Çíj[Šx}½‰¥¯ãS«pKb¯ÅÎXrˆÛœÁcTÆ$ˆN§/zv+þM1 7Bº¬È­áÈÈJUdÞ«kxéuhºuéêç&Q*Ó“£Ë÷^ËrsÐOï̾SÎ%8…Ïî|¨üñŸ¿±"çNR&š®]‹`@oÏ+âðoGE ]],ÚÕðèúÅb&à7ñ—žq„ý)~i``3­˜&#Ë«-Ü8ÍjÑÞk×¢baV'd±Çó:e—¡òèÿˆòó4?‚×ô29™ŒdúõêA£ˆÏ`¨àSFe-“*£¨=|¨4‰“öâÝCC€€•ò6s¨Þh àŒW/{˜¥ç{áÇ/• Yåž:Z}`Ð3P•+O¿ÿEšþ*•¦=j°2¥¦r 8`¬‰0æGå|(¯i$ÓdÓQ¡0«K²óÊxIU³ÿŸ½Õ„‰^5ey¹%_"3P{¸Š4é[æÓséT“w©YºzÃz´¦c)ô50é¦ ffg~ªkâIÉ«Õþ“’í¾æ¾þFÓVáæ|m”UÖ1¤/f§"UmVI&S^[ïOy`פg}iâb%~Cú÷€ÊŒ‡W>JO})7lÔPUú÷ÒÜüÒ¯˜,ÕwvEZgñN¹^£ÍäÔ@úÛWý‡hd¥ËõÑÐCŠW_žñ©ˆG’Ñ1B™ÄÇÔdÙ? û*SÚÚ¨¶<ïKñW’´²öˆÁRÂÔAvmƇ/B©{ß¡4 ¡ìýöÀ?èåÙÅßi²Ýtt´pMÙÇ/e‘|êë´1£GÀ÷’ܼ²oˆ*«5l˜" Áyõ&ÓÀ`䇷i ô4¬Ÿª,Ÿñ-ñÑ:çÕ«T·)iƒt èRÒd’"€´M^UxÒÖÃØ7Nƒ†õT¦c€êÜÌ|~·1ƒ{JÑhdQxãöÙÝ6£lÊš0.¾a3Ö3êÞ«·ÏïøNŸ°+¹!Tœääás/%óî¥Cö®¥4}+)ÃPYRôÉïfþÝà€#ï³­í6EÄdd¼;¶}é„YÛ:cä›ëAËW®:ý¼±®"x™çšè ˆ?¹>`Uðæ£±ï ›V¹¹™ãþ¨û3“7Í™°8ì>4”V"T^TXÍ&¾D¯uô\x/%ëi|ä[‡”:ÔÙ¤Yš´cUØØ´jËÜá— ¿ó™EOÇX¸ŒOºuv·µž]q# ˆÜºê^»üßÞaç¾àúÃççöùÛ;ùB˜ûÍÆÒaïÅ;ÙY¯‚¸ÌÙ•e/ö®ØzdÞ®8&‹q(pÁâCw©|f~Q!¿©º¨¤ r£×8ÏXúèMÖ­3¡6^•€€Wï»|uðô‰É5•™7ÜÌìÒ€¹¬¼¼/«¦°¸Aí®ÍÅõ}OB´&€ÙÊ+«´I€jŽì_zÒu1¿Sk!.!ÚrÜ‚¡”æ”aÍñ›“îRižÌ‚ÒWÇçL‰»yYÖnyM?zݼMÅaëñið-ýáÆÐ3íš8ºvù¬ù‡ïåÔ—f,ê|$£ !„PÓ4'‡ £—ŸÞ‰š9Þ.2“‰¬•þþÛ¼<¢âïT7õéWÌl&_|ð6åþ%O³7Õ<}të…gÐËÀýøÞ9 ­s…F€ºŸ¤ us›tç–ù|.®ˆÕ™hUFTc+oc– t,;0ñ^¼¡‚h´’Ép%pnTÝÈý1þ?µÌð+«å|Æ{S›Z.Æoõ1ÛÛô9IÇÜ•Óœ<âãnvïsüÞEËC1Æé‘žëî&Ï»A`\vÉßfÃ%ŒqÜ®ñN^«DùŸŒÒñ¬ÃxÇ"Óí—s1·Ôf¤ycŒ¯-7÷â[ágŒïeåµ,ñ<AúA61&Ö˜;úEô<ÿc“‹_„ú¹l9'ÊYa}+úÚ€1w¼¥Þ‹Ñnëăž+c± i’‰ÉãÊö§E½;9i¬ßCÌ/²m\ÌíZÏÉ.è,©ãvˆó8Ï5¢Ü²³zÃÜ«1>´ÎÑk]¸ðƒä Ö¦¾wDTÜ>Ô©cÌûî¨oú†‰1¸YëÞýX'$à‹Ó3§íëŒþŸÎO1÷¹C`³ÔcñIŒ1!h°63Èü*Úþ~y›Ëü-w0»rô“¨RÑÎ÷53Œ%`Œ3n¬ušº_<¯¥ýá[µ÷ ±0>æï5sçUŒqcÞ 7áÛ[Ë'Ž NĘXa©µ+±¦“d•Jç¡zîÆ62¿[Éùù VͯÛåÚ¬šmµ8,^ø»ôY…õ2>óÎÔ›{^ˆvΓÓóÖ‡c>ÃÄÄdºè¬¸€I#ö$”ˆö•ß[nèÊï,—‡Àü÷» |.bŒ1®pbžƒ1#û´±¡k#cŒçY N,Åóƒm‡.¿U‹1qÓÇÊr}’ä^°ž›Œ° œ?|Ô¤Âÿƒ§výµ›È¥%¹ÝÔÕh šuƨª&ç;šë§~x À¾X6ÏÒ”’}ŠI@TRž›Ù(aBe€ƒp"CƒìÉŸ¿r%T=iËŠüÃK¬½ŽÅ<¢wë©¡HoqKÅ´8š¶ÂãÔLsç™+n¾üÒÈ  6ö™Ã¿uÐÊÁ%ôÌ ¶”j59à~d²Éq‘ûƒƒƒƒƒ·Ý˦ÔU<ûa~Æä>6HOµ7_¸~_f{Ðà~zŘï7Vx ô4V¢äV°~ï¾ú€÷¼ÉÔÃP„v1Z”¢WâGhŸªk(ýû( Øs°M}ã/„31Lßž€‘ô†«o7ÆKÂÏ/5îÛ¶hÛż²Jr¿?Ærû®_wTã_Æ4™b ÂMMW›Rú¢LØ{+„!LU’E\¦x¦ f~äóÑ¥ð=Bb&çÓ*ËR€„€D1P% ÙJ•¢ò¸ì¶ŽHB©ìÛÛ½%ú³Ä°"! :Õ‘)øzÈåè£Þ[ÝÇV²èÇ•fTÚÛÞà¾C„1ÙÞÆ|âáæój]k-¡D 2Ÿ}bûb Y÷‘Àå !çÅÙààààààˆ'<ò÷‡-†»ú1‚+Ç“=ÜF‰?”ךá¬öÕ/*Gr¿Hðƒ8"Uš}ŸeºÞ]m¦÷@èÿÖº2å/ÛD¢=„ºñ꘱r —×s+`Õ`š”6åûW6~WP짧%,D¢Ð…Y uF(¬js÷¡Á·Šü¸óGûA„ˆ IDATvL ¾¾a\Žâªã²ñ±õâ²Üw‘Ëw¯çœŒ¾­¥:"îÙ³ïU%w£#ÍuwŒYzæ¨7ð(³ækÐEÉã$ í§!Ö Q÷–Ô|ÏJ¾4{\CO‹{g¶u%S[C³0¹ù!"ÊëA$"Ú\º‡…Ç cþ¯ÐJžu Œ„ÅfJB°è”¨7DBO à­Ê¡ý…! O›=O™*¢ ™&¯“¯zxÎÜ°Ñ%Ì¥ã»>#z~|•Žî¯hÏ;}¹¯&ìs»7ÉqAbÒ)yø {€1‰Ü||Æ¢š›ÓÛUFn½,à‚Ý S%ф鳄$Cî$lŽ >·lÍ°móÔ‘ó&öþSÌVø®X8*3ÂÂ36ÅEüÖñn낎Κ½Ÿ¶D•àJò9Ÿ`þιøž÷)Ž4Éoš½ïjŸêÙn¬Ï"?ðž÷EôÀ’©×ök úÐãîí§ðYR+²²ê…O¯Å*»Lr p:{îÒ%Þ©õùÇ"ÎL;|oæ0ɸI+hÔW%GGk¸¸Y.›¹lùþ ƒº‘;Óe#ÿm;Í&­•ïÕ·½åcå³ßûÓBkC§‰ú©Ë+ȈyTxàÊõ¶ÊcX%>ËÆiÙq­°æ’©ˆPyòµ51_.„®k;uâ‚[wQu»±Žï‰³Û~ŸŒ@{å¾^&ÎËv0ÍúQ£O¹â*môB_Àôï‹zѱ'ªxŸÛë9äÕÑÀ“ÌÑ'ýÇ·¶ ðõÚ%yr—Ÿëûéã`™þOjï9t;·w…ûÂIYwÆÖÒäÖU$&Ü4_|ØF• l±^K÷>~%Üj¢_¤þÃÙ£dÿOmA úsæÿ±÷ÕU-ÛÃkN’ŠØEˆt7H‰(&­`×5°»[l±»» )EP0R$¤áô9{}ìbÜïÝ÷Þ½ïÇúöÙ{rÍÌš™•B1ÓÈÄͱ¯ÞÛ {;UÓ!c:Hrߦf*v1ܱy~ &6-[U‰•ÆxY4giÞSXV=z°S[UUWötœa¯–ûþ³Î ‰ F€XÈïÔÛ¨G‡–í{æfä¨õÔê3V»¥$5íÃ×j™ó˜ãöÀò/Ÿ]uõº¨€LÌcv°4ìëäÀ)ÍJÏÌá3[ÎZªÓ–ÝÙÀž¯JJrja™ÀÐ}ÒB/C@ìfânÓSé}RJ¹Dqì‚õ:-°œ]´ò3³¸4µÕÕ2¯uFvbË$Vkmí¾ãGÛ|ùš•W¨ÔÙpíºyʤñóùÇç§>µž9ÓDøì}¶ÆÀÀ¥¾æ  Úu×ëݹdpÛù8f¿MÌüRaá< á:9õÍËÈVíªí2d„uOÅׯßU3[ÏY³Õ¨óG2J"d´Ô2Òl-ð5uŒÛ6ã r;ש˜m—ìíÛ‚é.”öfª^×9vÖs²ï§š’’Áj¯·aÛ@Âi=Ö×%/éuFn™ÉÈ™ |¬€’ Hs C­vPƒ¶Æ};÷ÒaU~r ú÷²j¦ÎxŸœVI©L^¶É©_3@ä e&&FŠ "!¿k_ƒ®í”Zvî¯ üZÄcjåçjš6ã2hñÅÊƦšLBÝ¢‡q[Qón:Fúº  ”{höhˆ½Œ]Æ6®()ˆ©Žš–Ûv®ê×Z@OªmnÖ „D…áö}Sâ^´Ô2o£Ø8e¢ò[7#†w¯ûòáÕ0‹I{ i‰Yå¶s'ÚvCD€fÞ¾•Y©yå2÷I!þÖ]€/©°ز§ÉHÛÞ)oÞVJ.4°ð‹ Í»÷ëX—t$¼Ês2°ƒª|Ïð¤ºÆ´ãCD†£VK‰J#SóÖ æ :éš÷kÃ&T:k © ¬¨¨*µî6%dóHëÞ@@Æp Í@9jÝÜu_?‹301dþ#TÿÇMŠwÌŒãýÐN÷'Ãw6»y/ö—Ú‡ÿ†Ë{ƒÇ=«Æ¦ #?ˆPóÊ+hCƒws,öÝÍnÂÍßÍWñÿ âÌÐ#µ ÔF•€Óm;òøkC äVúl”Qå™Rž°ãÅì†ä¶Ù°bÎovgÊ–C?éüßlPÓ?{X¿¢ %“RT“ÙàšL4±€.éø •¬~V×?L—ëŸ7¾Mn"7MÐMð?ZþÍ¢ºŽtó{3k„FìˆëÉ$˜¬#Ü©e-ý¨: ˜ A rÿ¤´Æb9Ôt7Vóoî:Âá.¡GüOw4‚ôÿã1ÚDnsBȽЛbE€P¢&&a)åä›Ê&®Ø{Ú寤“¼šY:ÄÔÈÀyÈØØòo‡)BÄÞ6´­§ ¿Sø£ÓÈv<B©ˆ 6²>sÆŒÌ2‘~š:ÄÉØÔÞÞÂ`DÐlÚ/z½¼ü‚ ƒumm¸˜\*!„ˆv-˜>ÆËyظ½„R^nVÃ|“òE’Oáž®öfvVƺn£ÆæJHíÌ&„ÜÚ2ÅVÏ0ødFMé¤ìÖ2§Å'IþÝÖ}Qç˜éÏ–¤lôtXþ› f„â;ãtFžÄåøŽ μúê_;ÒŽ¿¯–ýV'>ßkÝ×Uòï¾ ˆ?¿\°á&A”éöy‘Sý]„beØ;<½‚[º¸¬iYÿoéë}C|¦Ff>†ôóò/g0Ùœ†.ñXl‹A© #ÆŠ,f½|yýÚõØøW“­8³ýfÔ^•Ëï­þ¤5{¨zÜñèòºY„eÓF/ÛvžÃ,Ý<ÁwùSBXŒn#wîÚÕ£3lù¡Á¸¸Ø'Ob^¹²|÷%׳n äî–ñ…­¿Ž{ú4îg‡ÏS÷>àÎظ{–·%“Ū8"»BûÂé£Ú¸‹þ˜Ñ×kË«çáQq¯ýÛçùßÇoZ…è>wß©ýÞ]:ZS:œ¾÷n˜9tp-N»ÍYÇ–œN͘ªZ´l§ú“ãUÃõÁ`qXÌÆŽZ?:}w#P–û&#§¬þî??Rá÷õÕ?cž=õ\ÖP=Éê.ÅiwÙ4 =åá¯ÞÐ ü¾›EY¯?åVVüët“.*ö7êå»>Íø·n½ã6D}M)üQcšàoHn­;åZXp^rbá‡ÊC§OªQ?Ù ©Ì F·¾}jç ç܃±·w!" +žyÙyØ9ݾt¢›Wí9o¯RúáË×®A›N¯´E@ˆžG$¹û¦§Œ×âiŸOmÕ›>Âð‡Ù6LD@·Ä7ýÄ©*šVÖØ¡ LŠŠm鉸ìXø2}zZZš¶——aÊL…VX'l勤\cÓžðù^§þC¥À2vqé®DZô·qÒh É'WtwšR÷˜ƒˆ¤ôÝl?7s+S »çbê¶U5ÞÓÉÚÁÉÆÂròÊt@r"Ê\àníàähcî9>$WFÈ.m]demëêâh9pØ帜êÄ^ ÂÊÒÏ >rÀ€+%”Fìa3ùzéX…ŸXàïçac¸(L@"Yծœͭ]¬FO[^$¢€—övÿƒò`þ "æÂažË£K\µìÙme8`Ýõ""åíX2ÉÌÊÞÍÉÖÝofÒWÜú‘(Ø4?ÐÒÊÞÉÎÒÍ{zR‘„òt‡£óü3'Œàmbçq?­˜|G\Ê^]ör²¶èlnj=÷uZu¹*펟«…¹ÓȉùUqý–Ÿ(L:>*`*A©…qÿÄ¢êÑ–=O>/¦û+üš¤¥gT*Csí˜\~ˆïà"¥Š‘ƒ‡}ÙGϪ‚Ð:€$÷ü¼ÞË ƒÌ3h3îtaSø¿x ÿspg㘋oNr>•*D™ÐËÒòpJY]‘®š\ùŠˆ_n¯2Òј¹z_ø³ø삲z†Á¢×¶z–ŸøˆÕñ¦ÚSdß™¶Š2†8ŽÊ͉±4Ëcæ{Ÿ¢?Øõ3]•[XöÎÒ¢R\7§l£›æìÛ¥rm•œFZ6„ˆˆq—WŒ˜¸%ùWLìC¾e¢ø/c¢ï_92ÐÕ÷y‰´Aó^_t¼PÞøòÛ†WÉ1÷a?3Éwax…Y±oÒ”<ÜnÙÙDÄê4s}ËW,¾;ÑÀë4"î[9}ëÚü]2ÕLÝ">šãæ¹û97òØ¢Õ'Þ ‹ß™ZÙˋ˾ë3c…˜x9xØøƒˆxÐÛ&àd ýñȲQ³¶?ÆÊt=“±‡åQ´'zíðíç6^®xr{Ù(«Ù±ª óÅÛ4Ò=Œ-^ 'yÛ;MÚE§|q(ÈÑk™üy×ÄþCÖË1ïq?3o1bÙ›½«è¯7VOð\vczYÛ{ÐÆôÆéøú~"-˜tæm ""ÒÑ>•ƒ(,qÔ5½œ!ADIÒqmÝ‘…ˆ±gfŽžv )Jâdgö*Ox5dܨµçéB’/NqðÞC!hý±EÏ µ†–#"Š×»̼ó•N¶dŒóŽ›IˆTFÂóE¢&ý—†E8":MÞ±tDßmW½úrž´½[H\äõÎüwû·­õ÷t4±÷Ë©¦YÌÑkB˜ƒVvSP6œà Þ³'¡>ÓãìÕ°Nêæ7-¨fâK(Ž»öVÂh _Î2' v“_rV^^NúØi—˜JZß¼öóË(fÇîßî ²ÒƒÛw?§¥z÷ö̆mÅæÕ‚, È›°3ú„2 Ô¶«‰Nïú¯ R? rÒCTêó*J_áÛmbò²Pƒæq1‘O#cÔÛã‡÷%ÐE£kæå°)Y%<«1ë–úk2¹jJ2þ¾Ûñ_ K¤ê.§C§±„BJ ã·NIÛ±²’€ŠG·3GŒ³Š¡¼tlúŽbÒ­_Lj2€àú©gÆ~………………¦ÇI* @¥]wãþ=dB$ Ñž)¥Ã=@tùXœéì¥4óßxúŒ–®½¯cG¦¦3e÷æqo_Ɔ‡‡‹((*(§ï-j}|€Øü»4/GúÝUjÃþVÊÅÏ£""b’;´Å¬ ^UQ’@MÕ£˜šï/´Õt³&£tè·”Ë7Ëøû·ÅŽX=µ–q"1 ØÖ%l ‘"$¼ã¹:j!’z¦½Úpšÿ-øsj~„f35&()Ö®±úPFƒEäW‘潃×î¦ï ž1.èÙË ¯Š)çªíóöA•BYÞ˜q þÊE•f Ú¾UýËŸš2‹_!T¦ç^%G‰‘îb5¶BÒýAÔɾ ŽIUçM™ ÐÕèø…eŽËÕjŒ' “ùtŽÅ¢ø®wžle`4VÇÏ@qøR÷A³"¢v ÏزÏÀí£nÛZZÞŒ‹Ê±±ßŸÄp)O¬¬Ì¥ ‰ë)à€ã†Ü.m7s’wÇ–J Jþ±×ø½ç{ž Y8©¨¬ ÔôÏ_ÞÝN¥óã'ç—ü1'`kIY‰d~ØÙÑÆêßÊé0ª}Ë/3ÊM¿ËÐóµP¨`°ÔrL¶Pa•ñ…‚"‘ÂûµÏåô’¨¶Åj!@£FaH))*Q^%Û¢5  jʜʊ:Í ¢7y.ºï5q†AÏvl£†ÿ  ZÓY¹{Š——6MÛ~ƒM°YOŸÛÇ&Or°Ëì`6kì 6-¸‘ˆJDEŽšŸðW: së¼âB,oLû7ÑŠ=völœÇܲ¯%>—Á“¶~²Qà:¯BÓbÿ§‘›ï8?ÌÞJðôõ×ñšjò9•‘«0R§%­ºzâ´³ÿ$:p-":xûóÍÿ Ð>ýPU¥úƒ‡§•£hxÿA§¿€O‡ßQµê¢Ñ¥ú}2ÏØPTg<@3Âês7"ú›¥7@ç©×§@ù9•ý=Ú£…2ÛmÑ{wŒð˜{?j§ ¢Eã–ùìÞ¯­ ªã¦–‰¤Àe£¯¼¬Ø™g?F>‹æ’ŠùL­žj’ÓØAM©º´‰B$Brj-dzÇÞyÃD $yT-êkçwÞÖ—r'tÜôÉÛ.žÜ.k\BDȹjè:Ñ4ùn]iáª^OöÈòºY^ˆLR$…V,$@òÊ„:«4ëÖL ³öÖb#Ô«Æ_« +öi#ÉÈæ‘îÊ@ÄyâV­•D4!¡6/ºì°åÑLUˆzqá'e Ÿ÷|Ø\¹$Ið*µ.ÜÙÔž ü| ¹ŠdT… …EB!KA±Ñ¢œ\Ü¿nÜ7¦[ßlŒH¸-×Y±—_ÊQ¿ùvÞÊ¥MKýÃ*¦$Åû÷ì«}ïò‡µxßÔO»ƒÎÅçªÕS&Iú™ë „Á9vÂ{þ~‰ÜoÚ¼©ugõn Û<ûŒæ‚5ª `0  ýô©ý.…ì#/…ŠÉûyc†r>¼cªtâì›#·/bº,!‰—绎¢­~‹‚¶F‡,ðh0ûò–$=—´eJ’6­#pϬ%Buo6HÏïßñ®@¹ÍT´¹dï–÷ŸÔ‘ý³åY™týI|ýw-tút?pü*€âD3 ·ߨU Uqi)éwö¼RP©,âÀ¢áî›î˽I°Y8ªeï9¹Ï‘/T.[ÆPàƒ%–Ó­Ñ™·º¾ìL5|P¹‡ äÏ[r€TD%'Ùêê°<Æ z²Yn‘|üó€0 ¤4óͧ¯jÔ°LÖ`bŸáþjÛlÚ!Ì…%ÛÐ~|¿o'F·æÒIE@*â>IT‰~r4®$¬–,–¾·Ý۹⓲ ¯L¤Ü^£uo̓/@ òùn=óñå„Á’ Ë¡>Öí¼]ÓcÂ/OZæYú3˜ Iµ€F€ÅâÍùG§Eî`®ÕŠ¾ &Þ¿Ÿ#lZökV±”—<@³OV…´QÓÁ/ÉSG;ëhkëšØ®>p½\$OñŠŽoœge¤«§¯§ob»dçÙb%,}¯­3 ‡'©eSˆÕO{èX—"îw`¹ª»Ço¬bŠB”<<ºÚLWÇÀÄnß× ,) QÊ;µvÒ€úæ.§"R©‹ßXÅ_.›8,#RJ« w/Ôí¯£«k8eEX™˜n¸~÷3 ¼:¬bêÈh“Ñ9òjrîtÐò×Î÷'Wô6·!Š„Å;çûëëé™Øx\‹ÏAÄ¢¾½¡“nï±0Ö·¶s ½ñ¦$霶–îŠØrª2{ùä&&&&¦fã–ì)!R’‡ÇVÛ››šÛ ŠHÿŠˆü/ özýLl† ) Wø ¹å†¼ÖŠô¦ÎÉ —† ´Ò믿òD„Œn‰LôèØjKc3#ïY›¿TK1þà¢>ƒgÒ›¡¥£ç³?yŒÇ€C³äí§Äá'×Ù˜›š™˜MZy¤L$Cê«XXôÖÛÁÐÌÌrâêb~æ0sàý¯ÂÜì'^“7æuH'ù’ïüxF 142¶8ôBì礛ûõÓ?ø…Åis|œ l‡NJø\‰ˆ¼œ¶ºýLíGJPbf¨õ"Gî vÝèþúnck‹´3Õ|š^ˆ;¦¸hhéo¬D )J:ÑÁ6è̻ډ¼ÀT}æÅ¢&–í ~ƒÜÔ]Ì?¼Ý¨ùò÷vÌTãEQ?÷&[_2õ½/XêÇí­—þ¹É»db»DÜxnyƒn¯œt+·V2µ ~ißú]ÅU3&.ü¹=wÿ½Ô¯ð-Oÿ}B껡tÖ{V%GfEú§Òï*ý® ª.Ω`²q„ç=égæ%þEËëŒî¯F­ñ©ôƒiRŽQN9ŠBDÑ Kƒ´R™BüyxÝkYÓ²ÿK¦H=îf£™gæߪŸ‹4¨¨Qõ\ÂÏ}•ÀgÇØH-ßW*Kû:=§„þÂl¡ÉàEÜ~ò¼B(k”[DDý<\:Á—´WŽàt3®«j\·¡ jf';NmÀçlÐà:þ{ɯð-OßHtZ¤¡,.òÉιà úÎv죂?6mo ±¤.ÎÉ0ù=ÂÅEŸ.\ Wj®ÀþEËëŒî¯F­ñ©ôƒiRŽ‘F¦%|öäþÚ)ªNëz·àÐh!_+”f`4Ýiþj~ÿ5`·àª[}ùÜéBÞÿ_è9iø…“)%Í-z QÔØ2öåƒË¹e?tì9Ê ðæÞùÊö®çC‡!þ–j˜BWãA¦êÿQÿHE> t}s§?Ô¶’­êêdûï“÷Š Sã?“5ë7þ}”(á“ûO¦Ÿ q‚:ƒgäîÕ$¡ú/B“Ex4Aü£N7õM½ÿÖœñ_µóvêÿ_‚íÂ^SǬ«c4l4u£fkب‰Z]7?ðRPÿç¯Ý½7Á¿—ÜB\ha¤·áÊç¿·›"‚ârs Ë̪3ѳEšî;þæQP !w6¹x¯ŒûÍÄoÖžˆèæhõ©â/è%Âí2ÿ…2¿¦"!üϦ–ÎbB!—¶Ï·³2·wuýÕgšqƒ”äôú?¬--Ü}g~,Ë­¤)M½ïåbkaåzë}-ë*áêvW3+kçÍçã¨oièC†Œ[YÇÕ¹¹w©½•¹óðó1ŸH=wBòo™jj]ùÒdzõï%7øã ñ뾃·CÎÇÌÜé—ûÔoSÀš¥J~±”ÿ6´æ'³ŸzjÏlÝ?Q¢——‡L«íå_2LH¨"뙢¿°×b7n£ÃæøšýF¥µ91d˜Ëáxrÿîùꓳ½÷½qæ}'CË$f÷ëý†„¦´¿rÿÑõCÁ‡§xnˆæ“:Æä3¦o`*pšˆÍ¿‹Ü|}²lÜŽ·7v-rYEØÚù>¾~óÖ”P³§”r›…-v?ø™s'ñówô¡F'Ì›½òaöã#«þ=OÒï‡õòŸŠ VÑÑ;¼< ¹’bóîöF«¿¹õHVšy¶sfÅfÊJ­õdzQ¾rñ9ß½²ŸÏþž-”•”šØ?æîÚ½|€wQOuݦ)p””Õ,6ɸ|M—\±éNÔTõ:!He }4ö¯˜¤¦¨ØLÝ|θo.ß®QÁ&×QîkÍ[Èí8øEIã& ›¼ÿ>à—Pòh’…[ОKÞ¤"Z,<ò(ýCÚýã+M]ÆðeTanœ‹žþw9_+¥_Κ˜:D¼JJ{Ÿ8ÃÙlöÙDD<¸ÔÕqð´«1 ©¹|ªâ…µ®þ…ðWÒ’7Oñr QPhdb1"puJV^^f¬»~ÿ›ébIJéŽfs-91ÒËXwÛ‹ D|}6tù‰hD”æ„kZŒ®Õ¬ðt2ŽúP‰9guÌ/Úý&)…’”›[XfÔ·"wk¹¹Ïëä´·q¼F» ð؉ˆ1§—Y ûê}j껸I6z3Î|DD¤>14 ½ñ,éÝ«U~fk× ƒ~¹«|Rjòë?SÝÑňˆöèš9®;ò  0ÿøB7kÏ &æççÎj¿òúkDL¹¿ÛÔÎóù›””·qAVúËïå bÈdçÁÓoÇ&fŠ‹^ì02t‹yüöÅ­@g‹ñÎF¯/±:j¦™£çÞ+Q_ ní˜m邈ùÏ·¹?{ü6öæX_§¥R”\ 04`Cvv.R”Û@«¡A÷_¼yŸðh¸Ö¶èj™˜Zzžÿ"!¡J„O.¶ôœüê}ZrBÄ(#ÝЗՈ¸Æß~Ô’ýïSRßD]0ïoËGJ&ý±ÞØtBʧœÜ;ŒÜ'½JJI}ÿzç4»!kŸ×S›ùÞßÐfâ¼½Ÿòò?¾¹c¡oú©B†˜çc®·âTø‡i7.6÷˜$¡(QiÑ,oçUGî~)*C¬ždlñNÚP‡híí%× ŠÓ¯[9xËhõÄ'[gy,?ŒX¤¯wôs­¦N›Þ€WÕxsÛøásä¶éÿpº-®¶Ì——7»­øN/ŠBÄ>fœ©Qï,}l`3¡ q¦Mï+yˆˆ‚’‹BV‰dMÁ/þ*5?IJ'SM̃„ˆâÇó« ÖÖ~ò¶´¸ó¹1ÐýøJDÄôgݨ”®¼©?À¯1l™[à⣈"ukªÕà])µŠ¸¦NŸääÆ2¢B®ÎµxœÕö+Šã.¸©Ñð*¾rñ¦eíúy_ã€"e·™ÝIÍ®ÆÉÍçóšSi 1Ñ÷ä†Zïª1ûf=¿^®­=x'"Îrì»=¢R®.öa¿‰‘w5…ïöÍ0›v€n’ <ãÊí§uTËd8ô K¨©<ó ±Õl"~Ø«¡ë[‚H!æĶqö¢³'¬õuÞx—ºj¬¬ñŠPpÊÀx2qÙÇà=w)DÙ¡zþg¾Ð¹žm›®é´¸.¹áEÏ2°˜. Ûroö1ñ!¦;æ\%zÓdM§DŒ95sÄÄôBrhy$±€Fí™åŽ7Ò›_ŽN-Ý}‹PRYÂg–~+:‹©cé½’ïF”êÕ\ÆSKGûFÂÐR¥3}.à)š?ü4g)OT.•Pýüê°õ'[véªÌe•”(kIêùWÓ²ÄmƆh[ºìáébNꛀ"W­SM`DF‘Ä•ÌŒ›#†‡ÓÓ©@,xðoתym–”Ęn½]i“RD$Dz*ÄÿpzÏ«V‹‹(®18¡„bs˜L¡„âÚ2$2a+Âõ“â›»…Ÿœ£Õas|‡.½quÇŽü„P—ÖŽÛþ²õµë[˜ˆ„Àë#“y.»º©ƒ‹@Hm÷šX9¿¿m.VÊ\fkóQ—V¯ÿ¹ ¶@e¦lľËS곌_’šp÷j `rv³©b=&®ð{ö$rÙ\‰TT;þ@)/ﻆ³¥À‰–^¸lROY°páú®¼4íÀ€š¹ s·Z¸ëôB€7O¯ìز÷ÞÌG;<~Z3ªpœ&\š?âG)âï\6 H!ÔûÃÏÑ3B©y‰ì4Ö BZAiÏvæÍô: ?I=Z²¨_ùz´à…žK ztR‰Ê„«OZL. ñhÏm™„ÀÎñ.•†F_ˆ„JX2vßk^^^¡„EâVÉ㇧îš;¤cù· ÂÌÍûfD¼¨®Ù7nœ¿%”ÕëÊnÛ<Ü}_ž¼2õQ|V7Ú³sDèiù¶(Ê¿y/®ñ½©î½û–fåÒr”ê8C ã\h7@[ùÉ•$:Iõ—WÏ>”™X(K隈r bq&Ÿ/ýIgxUU¨Zh³ân$@àôÅ ƒ¨骾¸H/ÔìûǤ­]›³ÁÞ¦GÚýXò%á´ÕpDxÕB @C=ÕÇçéÒ…‰Ñ©%¿±í5·±P{t䙡%o#ÞÔO `«Íˆ¹ö†>œ¼ø†ÃþŨQÀ°Ñf<».ÏrìÂÛÚ,´#Ôß >´4”žÞH¡TæÆ?ÿX²¯"¡rûLæEžû¬@ÉP^ÊÀÛÇg"Þ•ÀÛa;¶Ì¿¹&û†œFAfoÛ;ån¤Ü]Š®¿-¦hêA(@€Ï矷 4` A|°dpxç9W7ÕJÖTÛõUTFæ €("î••¥=ÓmœÍóí»‘òzO¨Ô:°=(´oI¥¿-¥-#xŸâŤ£ë›4ê—D¬y]yÌ­Ði¤¦"†B«×ñ/Ξ=wîܹ³gÎ鲋g½ÝÔ\M”ŒÇ/°~älïbciô1æa¡’ƒë(÷º»¬û‚ƒ¡N~Ž^×ͺ2"cF­=åXg3G„^Oõºìl7$Ò®»Øˆˆ¾ž+»4*´Fv»-# ·¶ £ñæM’Ƕ³–­±ôú±Uo¥Ò¨×ÙKÏ߀˂ÖIÜ£¶ú@#Ÿ9£¼çuíyìx†V]•ùObÞº¬½Î"p}¡ÿv¥€§ë‡6ÚTeë9ÓôF tdk®Ÿý ¢å Qƒ O‹V¡;W¼:.%ƺ­€”~ÙUѬí9/¯óônÔVË5tYàÅ£SvÜÛ¥gñ猎Î!¾ÆÍAoøš®{],­uiV™õ•qìžsΊ9à ~{Ų »8úÕ‡ ¯©1áøº™·ß «K*ø2o¯÷D¡Çécs7>ÈSmuÃËë]‘Z7ëý§×#“@Ä€ÀËåè½èÉÓGJM·©ß¡¿C˜Q*à‰™ÊJZH…B¡TFSQQ‘AyÕ|e&A‚2 _(B&›«Àe±'#\E.K~ꥤ|B`°ØŠ \@$€Õ<¾’²2ƒ ª K‘Ëf¢P(Ê(‹£¨À¡O¶2‰H(’ ›£Àå°@*ä‹¥¢ÈA ¤|¾p•”$GA™E¤U|©ŠŠ"Ý~GW¹:°Ô+lh/&ˆ„"‰ŒÁd+r Z*Ê\PSá((rX Ú™@ ”QÈbs¸lxbÂUV`€L* ÅÀâ((pXˆH(q•UT% „2eeE‰øBd++°€’Št®š2k1@ß(‰/’2˜vÊ^íE•i÷—ID< r•X(ðD ee.JRÅ—¨¨(y‡ª"N»»âóøa(++òy<®¢2‹A@"âI«ÈaÔ¨Å3as¸\ €ób$ EEJù[Q™Ë$B>OJ¡¢² J„"±˜lŽ"—_LØÊ l ¤U|1Ý6àñª¹ Ê, P RX3h5? Ÿ/B&=ǯï܆¥¤¨@”Á`)(*  ¤¤ÂocG‘ŠåÍ£GD¾DV—|3”•TD,e¥z·wAuKI•ÍI˜‹ÿ©G Œ&zó ÂÿWÁÇ=¨äŸ SøµÚÃs6ý¼kÆp¿—~™åóÓ•C†ÓÏÛ§xl½Ö$ùw€¤<ÃÄe E5I¦~ þïšhʹÏûèЈ(<¹qÞî+/ égï¿eåÌV\ü…Z0%8±qîî« Lh8ŽÙº|F .’¦8ØùØ44Á¿|™j‚¿Ë¬†úbº¿4K4A¹i‚&h‚ÿø‹PTf½ŠË*ú»ûFJš Rÿ{c‰¼//?þÙeÍí øE)¯S‹þ’ͧfû ÷2¬sQ(Ê~›ùUü»™«?¿xÙ´ÚÿYäæ‡á$S½$phx!×A¿säýh ûwNÔC„!®¶¶Ý;òu ^ÝŒgh¶yWÚoXÖͽ‰jSÃ0Ù:cÔÕt‰ƒI層‘]½¶ 6>[du¤o·¼K*ÆþGWûí´¾’ÕÌÒ¸{ô[%eÙ³ÅîZ‰Î÷Ÿ’–þt ð>™8Mª‹ÅÚÞÜÌ{瞊/Ç^í­c¬o|V³0줬(ŽYuêѧӡÕÜêý¶zL n ÃR{›AzFÝâßXLÞ²ÎÏâÖVÏ“¹îyï™y¯Û6¡ïÌуjö:­"<·š}|µ¦L˜ïâ楬®Ý§9ïù‹÷SvÝõ1nrG:“q~×öÜÑ3^-õ´RÑJ·û»Øˆf:¾§·×Ó—[<ÁTM>3Û8õï;¾ðê“áˆðÕ>çiGú˜;SÙ é².¯íg‹*wl;ÒÊ›wNš\q÷qO+C øù..£±}ïN¢Œ´ÂÖçž^ꪀü­ï}ii¦ßñyJ3/fÓÙ‡zEu攤=^Ý´àÿÛGóß³73v.#"òâkY—[Û ‹l,Ìß•   ÐYˆxc±ã°Å÷ä6À— p]-E [æ>dÒjú凃ÞÆ~‡h»iaòYmó1<Ú"ÜØ|gb&ØËx÷Ïâ̧ºÃèW²¢û6¶~¥ˆË|LWÖDzsÔßfì)¢DÀ«ˆè€âóymM“¹ˆØ˜E¸$ÃFÇ¥‘’ -­¦9Û¾Èá!âz½1é:Žyˆ”Lâjm5ÝÝ1üC")Zô)bÃ@ß0ŠBIâZÿ}ìFmGDaúýAckÍ„‹®Îîﾆ6÷–æÇꚸ}E¤(Êu ÕÆÇ%ïí4µ6ÅT!¢´:ÕÊÌ¢T„åVj9-Ð/M62±Ï•¡$~¡á› "bÅË ýíüø´½ó§+6fFÑ™˜|°m0"bu¦ž¾ùdú;Njt&º°2îLû1t™Õ—¬ÍŒc³«°ò‰–g1""¦] °¶Γ!"–Ü[ÖÏe"ÞÚáé2z]NÞ™ z÷Ñö÷â¬:¦ÃÊ«³#ŸzJ'HØl¼QZä¤oùFŒˆy†ÆŸidKËî܉j«lþxÇñ.ÐϱÛ9Î|„(fo|ã<Ô™×±«ÂQ˜¶ÛÄ2˜.)4ØuëDŒXåì¶à!rÛ$ÏKñÕÏŽj;ŒÉÃm³27IÌçÉÞìèã°´Iíåc.kë¢ÆˆŽJiÕ™uÿüY± PãvF•¶!}†€ê[ ›{•ž9sؤ•òçkY²¥@Iº÷¶@Ù™KÙM¥Ξ¡8¬ê¶•©ÑàÄ`°Ý5šÑ* ŠÍE~fzr‹.Õè+I§§áNoSyšÖïÏœy @$¢ÒôË"™¯¢‚ÒÏ{"Qêcû#Gƒ¬¾:E§“pF·,¾²ã4WÒrÕ“:0ï­dP~üµlFNÇvúÐüÓÉ™¶½ZÝOl{À‚ӶȽêË"„ñ7FuêÎeïÔ¬Š·/{÷±¯åi]¾–Ñ¡gëkçÎJ)d2DÄ%wòÀ¿#%3ïÑÕBAªb¡¯‚ÀjAˆŒ¢àÎôvÝ»ÞtÐmÏœ0Îa ë¨‘Ã\]-±ˆž’èh  ÛÙ²KKêíW¤”ñ¨ì„Çg’( Œ|è^˜zÀ¶ãOQµxC;áÕ»…æìè]söþ+sôNÍDPí9„ÃÞù3Vb“rÀß”U¬ØŒ¡DªÀæ2L&“É`²‡ÏšeÞ¾nP{_Âl¦Äf2™L&“btšµtšdré÷X%†fJ: Õ&‡w«á§0é5*ÿKÄR1“ÉÚeœ+(ÉØÊ tù ÅZ³ç°~6gj\B²~Åd”û³ÓË_íê3FÃ{ä½+¯e‰·«ÍìÛûx>;~¿êÕ‘N^þ}G {r#ß?*Ó·Tà¶îÒ™W‘'ƒ3©Ú·Öî«ø"Iò6â–þÈQµüðj1ª(péÎQ»x®v%<ƒ|ë,‹!wË@7™'¦”¹ò\„(ú.˜«G£_A•F•H*f3ä˜ã{ z¹9ù·÷"‰„ÃäÒY iLéž°¸µÈ‡ý5†‚ ]NµT9L&‹Éd"¨Ž[:·Ÿ¼Øæ½èbáø9‹7nÜ4Ï¥¿˜jÈãÝr3jå”ì¢×~†þKöÇ=FƒQ'ˆ )ŠÃ¡'ƒ¨÷·àV/GÆÅÔžîZ,U‹‰"‡@ß#"‰˜ÃâÖb¦Am©w÷ꧡ¡¡¡i¾PÚDkþž¼›º Ý½UÉ[™çÈQ4K¯¤°¬U;%€ÊšïÍzJ?´²=¢-"«‚J=šÆ²×bîa9J ÁòršJc(êÔ¶SIÉ+Z0AHõ…WtiÅï¤í2Z_ ! R\6C®Ó‰ AŠ’°‘HÅÒŸIxˆüoí…‡Ž=ÈIž¸{-´èÐâ­ÿ‰;mÍü ‹†sé–í÷ögß¼T»·O}òAO+#w†êt;ræ]f‘T¿c3lªöâòçØf[C¿95°ÒP¸QÕcøHOD$J¿V¶lÙˆx¸ÿÓ¾ªGÓ; «ErQy«6Liö·”m›·(­H«éD¡HøKA¶Sk^Rž#ÏB ÅßÃï-;¶ZœHÐ1ÊžîKYIu UÑ´‹™ž‡ëõå@x~)‹Ù±¹„JyY_‰µ«µëô…Ó\4=#—N¶VüiEœ^\ßÜi˜v+‘‰yÈU®{yx&ÒÁÙ”-zãèlèÛdDÞIVÑÔhÙüki©¼T´¾ÆC¿Ó?¦No:Ýü#á€=Föût}ñɈOYY m]†dU×s/à¹`îË~Ïߧge~8>ßÓyÆñÓÖiõÚÊ3®Å¼ÍÊʼ³;ØÊ;„j\œjido,J›´ç~zZêùeûžFyy†­™ýîã§O’6Ž±ó^ó¼½´oÝÙXB€´ëÑ“Ÿq".»økþýÐYÆïD¸bꘘl1TìÚ¯maò‰\E“æLNï.Çž$šØš¢B‡ž*2|bš¶ä°úõ¹kêbM«?.ðîÚeʃ‚zºÙÆ_9ôUǤ=€ $yÊôÙš,Z¦üxå»/³²²"/lµ:ÿkmwÔ™1·Ý‹][¯Æfee=¿uÀÊÝ·¼^èèiaÁJyvàirvfÚ¶ñ“EäWãˆTOk+FRdXdJvfÚÖqSÄt3¸Í¤…Ïß~Ì«ü5½±Y¾šÜ>õ8!+ëÓãã+-‡Ï”×QOñÉÑKY9Ùq7¶½.¬¬ÊÊÉ+/[I&ŒŒMþ˜3rà »qï333_?¾ûµY'METeL:£RLý`h>Ò°oðòm©™Y™é 3‡Y.<ž ¥–Dñ>=óü«÷–&¦4þ‡,È•ø>íÝóKWQD±·½ $<<š™ºiÂtÙO°ÝDkþž§†b[õÍè!Bìx*âqèÊy× ZtѽÙ™…ÌŽ]»(0ÕÆ<8ÚqáÚ¥…|bà:#:È š·êÔZ+ç*´°Š|pháÒ'¿ {™zÆßõ#ˆ@˜]Ô;³k&@«¶š«pZì¾{ù‚ž&£žóDû ëºô=½nÙ¼jTtôÙ}ÕCʳ>¾—©²ÔÏÜÜ5gÁœ»2µÙ;™¾÷a²XªÝÔÛÖ„ù`¨«wf3~L*æ!FëinŽeêp A€‘fº©‘,Û®@€¨ý1X}_r?e†š&>;÷¯ ¥.ƒ;²ïyîÐÒμÕ[V€ IDATn g@™¸´¬©u7òòê%kçªè¤mÿ,æ‚""têÜY•«cWuù¥ŠÙY]A¡×µ¨[CVÍ=UÚ®¯ydÜíæ2në.Õhkgl®s÷Ö®Ùó—=æt^³ïZø38Í»vnÀ`uQïT;´mÛwn¦Ä5½»7wÎ^òˆ£¾fÿõÇîf„p M7?²r‰põi#ÕöÚ©Ô1šwë܆(·èØŽ¥(? (< ?³lɆ«ùÕ]õ\_<]ÁDðÜs?-xjð¬kVoØ?Uejàš]×ö…ŒÝ³kìœ=+Ëü·<»³6dýÆÃ_y-»\|t¹‚„’”•ÓÞÄ[·ëÜ\Yû—­Ò¾S;U¿ã\ßó;W/ž+å´ô^~m¨q@`wñò0»»~éB ¥o®©@{Ok¥éõðXóà5«J¡ùìC÷œú¨!´»}mKð’%÷»­Ûwã¡«9B8jÝ:5iÏÿC$Sÿ«°}¢o|å?Ó–WXríâuÜÃoñ@sƒÔbɯ²_½xƒÎBIŠÌ>–JþUPtåÂM!á[s“ì i“H¨É"ü¿±„Åaÿԡ㬯æ6·6©ä°âfˆÃO­’¶ZÝÌoie¢õ4JÅiõ%¶ÿs†Ì¬|mme¬ñ4ZÍmýÕ–MöÚh2Ñü‡žI ´¤¸D$•±¸JmZ©‘_1>k²‹¤Ôofù‡bPRR\"–Rl®R›VjM,á&rÓMÐÿçà×’)ĆƸõ^þPðó-lô†žáwæÿŠr~¤¾î{ü3e7ŠØº•6š´Áæý}£ê¾i$ç¿b ]¯•?œõG¹ŽE8þpt¾ÿôóúˆ4J?í2þb|šà¿An!ùW½5†Â:'RBHô ƒÀûˆ?8¦"!„ 4Òz_Býg²„u æzÿ/œ !C­ºˆ,  Ušªeè@5ÔN#äk|ën&Õ*ž8,ÿØßÀ&v½‹–ëÙ·@÷HˆlíÀ¾C¶¾!Ô3­^ï‹e„¤[õ죫o@ƒŽf?7ïé™Õtl€k;‚ÜÇo$u‚D.¡7å(!ˆìÑñƒíLMÍ-ôt\½¦>N+#5]{²Êv¹ú:::::tt ÐÕÑÑÑÑÑÑÒ4¸_IÖÔÒÑ3040044ÔÕÖ0syìÞ›:£^}:t¹“…¾†––f£ óÖ¿þ"ª%)äë%Ý~šýôw™²–n!Dìhª­5t3©é,!¼}5X‰jø†„Uö6½ùÁL"¤,í¡–‰­ŒBÈÒ!ŽÚzz†††††úºýõ,\6¹G¡[Q–ù"dºŸ®–†¦–¦™£g艻ô§Æ Eiiéêhk;xŽ½ø,ç'ô©$îêgž´‰dü«›ù/¡àf±ßùú!©Ÿ„”¿ªŠ6±],ªµ‘dß"¤6ZEQu£¨Ö&kX&E!âÖ™6ËŽ§6RJãM¥¨ï«­S2ý?+6ÌeÌᥡ1ñ}÷¾ë²üwîË£ý¢$ÛÖ\/µXL7‰¢P˜×ßÔé "R_MõRJ¤ˆúD×1íŠØ7]W{P¾ñÖÞi£§o¯[AÌê«9§1ãÑ~}GŒ gkôrü$¦»_îgló©N./“¾ jñM·§ûš÷옱ŽÅƒR:ú©d¶‹ñ`ÿÅôGÑ™M3ôLlSxõ~0dÈœ-µ%T<]b6þ¨·Ã€'Ù’Tûšz ¶š{%½6×ÆÁýv¼û¡„°,ý‰©Ã Z¼´ÚÛcÖ¥ÄÚO¢ÏÏÍÌÂRyˆ(Ë·ÕÕ[²û:m1Wþ!Ê×Ùdäú‡²Šêb,´­j{Ÿpi‰­³¨±á£îb]&kô+õ£iÙõá·ÕüžÝø‡…©¡…k@\ò½·×©'§Ö¹8ؘ[¹\~Y@oS§CûLôãŠwjýtSCSÛ!×¾ ¤Àx€FZ‰„vÌ{w¥«ÁP!ښ›š»ùÌ|_$Ž?â8i=!„òd–©¦Ád!!@ȳ]³]æî!„Š9¿ÅÞÂÔÌÄlÖÖK‚•1JðeeÐ##á“×”‰±~ÔLÂË7}”“±±Ñà Ï•R€‚/Ëé™Y°+çÉý‡B¼œµÏÆÒG‡7—Ž›Lñ¥DÅ›fù˜š™™˜Z-;xWJ'tÓ²«&„ˆŠÞºYY.{|qó`Ÿå„`ê£#nv榦ƮÞ3Þåóiœ¼¹tÔdª0»˜µn¹çi:-0!QïaÙ¡ÁŸ ÷íäo=ycçf¹Yù¢ŸÔ缌.]´ÕÙò½DÏ{mò‡‡Ý؈@DÙoÓÛtíö-m5 !¯V#™€DðÍcQG³1žJî=,Õ¯·Å–·„Ü›brº˜±ÀÝjÒÕBÄ—v̳43155 \´«Š"„›ítÿ¸Òä¡õ_½LÑÀþ¸­×†˜Ø—ûü»¿˜`r•U”XÀUSkõq«Äø{#nm Z³t!ʶŸËŸjÛöÎ z(±Œ}ùêùõÍë§ù$KÛ;©w<˜Cëu> ¿mc?ŒQøzܺ‹7ž>‹»0³WÀ„­FCòS2(þ8V/Å7ÅÕD¦¾q²ñò²e?=‰‰}þâ¹Fò‘›ž0\<4åÈõøø—CÄ÷M¿ŽµPeuœ`ºö^\\|¨Sù ÁKD;ÿÜÅ71þÙá…v#¾TUS#Êʪl¹^Ñ¡ÇŠSM¸wÿðx©ûüù‹Ø(ÅÄ;®dƒ©ÚL…VºóñÞwÖÉ—ñÑ35?m8—¯ªª**N \}êJø³ØظËÁZc&nA€â°ûìifŠ@på*Ǩ Û*åü‚²ý;Ÿ9-^ÚØzøö_šÿ L Ðº÷ç#ed:0/é†÷¢ý¹eU"±¤Ö]H~Ù]k䯘iuŒ(íi6Wð=>Ýs•kÒŒ%óFÇ«µ™,É¿$ƒÆîA„Èxiïx2÷Þ-ýg¹G9S^‡]#fk¬Ô50äÒÿ„ºî’–V\NeèXv 2 >ûØ›CMc(é ±ÔüyD¡@"D"ÞŃºõql„L>:SsÚóØÏcnåž:ýH¦Ë¾èN€®?=à©‘rpáÎŒîÑÏ_ÄÆ>ŸÜõ•÷‚G ´p•ŸAAù9ü®Í””kgÝU u|‚:¬þ¨Ôê°$øÊN¶}T¡eÏ.¢’Šr€fÒÊwbF¿VÊUÑ1o½/^Äÿ×ÞuFEytág¶Á.i–€¢Ø&bEc'± D£‚% ŠØ!Q,1{Á® Q£Ø+6@‰Š»bE }wi»{¿» »€S¾ïœ/ïs<ÇeÞy§ÏóÞ¹3s/3sJI:ÅxíÝ&&aF§éÈÙž°k“·HQvþ±¬££‘±WØ•+í¬œx²íðö¥°ñÄ&¯gåÕi º‘Zô]¬íÿý–h|iŽŠÞâñã»é²6]‚mƒæMÛÔgµTÑÇD }/®¦È6úʉG@½+®õSñQx-ùIｃ@$°h>ßO­ïJ[z7-DZ ``(ÈÈÇD¶>¡_9­º 0Ÿ”Ês »8™HÜG]=²¿¿q¨g˜Ðyª“…GÒÍœn-,ß^ÔTàí[©‘•¹ÆˆŸ/ @âe/ó¹õfjã»/Y¬¯  ÙáÍ1Ætˆ–Z˜Öš³a£{m£‡¾tqþդݨn½Ž~•ø¬‡øÎ=û^MQð¬ÐðùXï_4#K%+-~W ¨”&ÖuÕ¢ O\“ÇrÊtîåäfK Í¡]Àðù| ÷­ÌØÎBS6'_Gè9°Ä«'ë9ÐqÉñÂØYm==ŒÌ,¶ ^;ûëŠH¥oK•–b‘&‘šMmî‚D– l™;!¼óÌ|‘¹i­˜u[Ûß¾~̾åWÚÏ/ uw\²?©[‹^ÇÇ»úE¡ (JØȘ¥>¦%TZðEß¡wœøÂÑD= }@.!Äzü¼ ãI)—Éž§l éßYµóB€ã‹í÷êmø‘Žö;û›&&4\h³(¬ 1Ækd‹}¿g"¸¾îÎN‰ü ŸÏ«þ diÞ”c…µÜŽLz `/Éîæ‘íáu%ëÍs‚|ÆDuNÝüIÊÆÆ=Bæ¶*ã‰Î¬¶xh‹:M3±X—[GK@ÏËŽÝ”ÊøÛ¯\¨+EÑë±»=Ÿq]\fj$Ö´±™©¬ôNÔ`è‚8« C;¶*YÔ´wÛºÀH›Ç5Ïb y™Ú™+Ï•‹mL>=yÕ–n=x`i)–ç€i·høׯ}ìÚ£GOw è®Ö ý·K=ûëÅãZ…öùpõìý4i×m;ƒBÜ Z }½kï…=Ûwó j÷‹O½¤Áo7ïÿÞX0^©4G3Ÿù*2èÔÏDb^TZ ¿;*6É ´ÖÜßÞ}U¹{» ó%€ñÅãæÿvùÒžíqVۧƞªà¾1ŸW Ð*@ 2rÕS¿F}¿­G/;~pY¤×èÀÐ y×Éî!þ 0̘(Û½"³äIÜÁâ1ý«¹&Ndjefccm[§Á¾ù])ÕnŒ˜™Ú¾“fêÎüÔg²:uk”~åÂÍ|Œ/12i0Áµ‰äáƒ'9—’D-[|L6‚ØÂÊÚƦ†¹é‚ï'_Xû}RŽ†É|Ãú—››¯¨°¦Î€ÔÍËŸËî'm<¤1É®T)L ûÁn%Ï~rèAƒ 4pƬð¢SRõ ç“‘Ç„ æofo» }ÂUa¡‘™¹••…yÿˆÅÒ´Ý[Ò5[^ k~ä<À´Nš”ÏÇDÅ«þÐ>¿@lÜÞøܶd-E|iq)2yž¡ÀTÊsë1êtJÚ‘};‚[½éÕwþ{÷g9ü)ºa‚·{žÀ»óûŸX¹v0ÿðê¿dùo,ÄUÝIæ..>Ʋ»ººìÏRÑáàþSçïõ î°¬ë?…NØÀÐÄ¢©Ÿ§P–W |æâ–“ž¸ù²0Оæ`Ë¿¸êì=?/OÀ Ç@Ï“ 56¥^Ÿ‹ ‰9Ÿ÷(»|fþ¾4uŒ{'×î¹üptw?€¥ìš?alÔ;•&—77öݹ›Û¨EÓ³—Î8{}ùOA1^®ÑCÅL˜£ÎѸEX뼯GÅ<)ÐôñáõÑߥõë‹”7ÖÏû¨@éÙ³gê9ùŠ¸éëê^àêÜÒÙÙÙÙÙ¹Q‹ÏƒDÛV&Vª×´e³_53¹ÈèS.c€±ã¦%ëFR ÌZ™¿?fêÊ=jÿ Ò§—BzöUÔjQÕ:µîÑI¹*,ïÎÒ3rÏ/<Ás¬e&Ù›”®î©C[~®ë; *¡X Øöy‘+Ý`jiëéѼ4ÿyOnßx’ÍÊß°˜*)È“6Ÿ´ú› G¹¯²Ußýk(Kå2µ?U±T¦í4RJåÒì{/”VvBµ9nš¾piä¸ÉîÞ‹ÊÒ.!³íøD¸Ž·¿Õâ’Ã55@Ûf}êòÂÛøí°45È.2½zi¦M»ò†—ú6z{kþ’+Âe-Œ‰¨ãèeW§Gzø´³5á•š8Í[1 @QÎkgç¡{õ.,+”Š¶nÆÒâM~çkóX˜7Û½~dØPe<ãQÍå‡â-ˆi1¡áaöÕ²±ül~tË°½ —KË”xtâ„IË–B<ƒÉºê3YòJóMêû-\ˆ¢4©TN‘hÕ„þ#´]çPϦA‡Ð ûRÕhÜ»Ax¿–¦†ÙE¢Ð•KËÎ7m.Òÿ®Žàï±5lÝ%7Œ$“* €JV(UÊEôeÛçxù>ÑáR@Csªáºßü³g4zÂcJ{çvS6Ÿh[ψˆ†ü°C:wv¿6.ržDU,³tl²ì`'å¨]—ûžj®¯·!¹´PÇ É¥ÒeÅ‘¹^“b¶{¶‹ÜÚkÉg€¿è—ÓëÌÑÅå•Œxºµë¹aÿɆ"B³°°~OƒÜ›@èÝ}Dì(wyÆÅuÏ /|e_±¢zô°dÖLö‘K5›aŒ12i5#ÄuÄ¢Ãnï·ØC*¥T¦Ù¢+‘ËŠË”å%¬×i¼÷âÖ_ÆÝÓÕl·gçŠy‹×x6ýVɘÖlØoȼ ƒÛÒ{WSÊRÊíîáÉc E‰ÂÐ60xòŒÎ–D´eËߌ°J¢,,hÒ5lÝXg@õu{‡ [·¼hWHШðH¿ed"T‰çįã1œ›ûÍ÷æ[Ü›ã”îoì$euÚ/uê»+%RïVèŽfíâY/uhy úGÕ\ÔTU§|KBQåøºEª¦ðj‹PúêXqa.ßÄBmáöÊ^c2¦û±MåPÙ6JEfD`æå›[ªm ÷¾áºsÅ0{ýWªmŠŠÖªúX;G*š·¼~š«¬ëѼñžþbz©éeQÞ#ÐM¿šUæ­6B¥d‰UJHoœèŽ=ÍJõ*lÝbU Ýöªf½_w[mv•§Î‚«"¤ršš‚ŒX™¶!¼=Ç)Iº©®·tØîö$«NuY)¦¨þQ5ÝI®÷´úøÕ*ÆØj`÷Ò±ÛŸ8ÅÏSVð",þmø÷?P}@€MÜ«¤ãä¹[=;»öœxõB‡*Û#Õƒ}àqyÁQÍ£ªM]ñÆû‹U»¡Ì*ýY¥ÑÊ7¿ß“.{Oãèu[uãE/Meq~~Õc»LPÃÒ¬ÚÐ{»úQAŒ±¼Üleõ Odja"|Ÿ¶½òˆÕoïª'ÌðbïüàϧpÎÂÿªtóÿ "0v|ýŒ{.1‰í°o—~énõÉ÷‡‰À°vfØÁK%Ö¦ÿ°Ð½ŽwùOàþžq^T ,3m–¸{É_Iöë îY¹•XŒ„­çžåε9G7ÿ}Âù¨ˆýi‰pþTG¼Õóç³T¿ÄþËÉrø/Óî”Ò¡:‹éO:pŇÿ{ðþä{Œáû:` y¤Ç)ŒaF}0†b}®Q“ÚÉÕhíOl:Wx!¾ð²ŠÀ½‹á펀 DD/ÎR#s =74mAÁœŒA}WQ†_"5‘Ó >Z?•ê=Þ?†W×<=¼w?1éTPÛÖcâRõ/¡Ë·v;þ²˜ˆ»=Ìáß…?@7êiw÷<Í›Eßͤ„ÓZ“«hæ,*Ri¦ÍÏ«èÛ™tþ1}߸‚nÞdÐÇ$WI‰2m¤yWÌ'Ô&"j2r'"’§@Óˆˆj€j=>Dù.'RQs”^JDâD½&ZZúGÐŽº‘“dXK“‘¥`£©EÞ-(¨¯ݸ·Á­Ãx¹Š8s8UÖM×–£I[ì8‚¤Óèß^a‹YsP€ax3 CÂ{ã¬âÝЖprBâk”„ü{ …P` ¼Á]À«%ÚÀ³PÝA6Ð7ê¹À½x€¡‡¤¿€go+Ø¡W°k)tÀ“¥„¢—ê5 *ÀZS‹Q=`€HG½Ú95€cŸJ5>¼ï§™c¦ß-ˆE|iFrkÿ‹LjYò–ì²ôdº­½jÕw‹2ÔŽlI¹hÚâ—vµ€²K§g¨@Ôqâ¦yCª×OY9"‡z€,ëñé”ëêÅ–¨ÑðZ”z-£ð=wŸ8pø7/¦ÚƒÊ”ßN+·-lBPžŠHFbß_ÙÒÍôîäÒŒRÞêÈJ…äÆ ·ˆ®@=Æ©vh–9ù¿@S¶Qd©UÜì4q  „û²Áž®z‹)­±(ò1$€Ö$˜GÐ ¢ “ô¤›MÉT¥êŽj?}gŠú÷ÖᮃW?Ò<Ȉká6²ˆè‡þ-gÌ""…ü•Ï+™¢ÂÞ–Ž™¥²¼Gí}|N>ÈÖµ¦þoi¿ÎÜã>w8é¦ | µ$`&8š‰!ýôž*ÓPôÖÊcW<šw×nÁÛJógÉkÔ0ÁU¨ÝØLãœTåVà O{m vãjEcÿ&˜*ÜùC»Í¥9°“ ¹Câ1º P€/£0l5jkO†ñxåñéÛ8»¶ò몲&5k ÏÜ Ü«+"""""""§HJ G§/¦Ù ;m «h-áë9¹&bŒI_¥ù|>tÈÊœ,©Ò9>?'áÛo¹¯Nº©Ö¨ŒæG’¥„BM=éF™Dõ\¬‰娕nô5ÊWÄO‡3µ©æä=˜ˆH‘K¡Ñsâ-#"*{HÙ¶'•‚ÄB‚D#4­‹ €<®^ºQf“F 4­¢‹tþÅ¥U±í©•núûn¿¡6€êæ¼ìA•É»ìêÖ'hvgÏåwŠªªº²ïîóöõOË.}_“þþ}¹ÏNº©DH ,‰k1u1²eX ¼Â]ÝÍtwˆ_ÔVK¤Xð¸\ëƒ[É8z9%Ч T<\•£{M t°ÆÅDxs z,>ƒƒvl€‹' p¨ ‡ú&ö‹t¨­½–®63!Ð^Èn„2†ä|ôsÔdäÙ&aÒ$Lž‚ VŽ–vpæW$^~¿ dÜÅÛ )áŠÖ©@\€ÁÌ}L‹Œ¥¿Þ=Rl2¢±žO°¢—WºŒÝqì´«¥*öàQ±#Nxú²Øª®÷µãÀI7U7ªS—8T¯›¾î†(´ daGàB’œˆˆúÚ@G3I~Q#S@YDé{ &"€`@EJ"¢ËK ¡!dä¤)õ•ØŒjÛ@¶m‰ˆ¢›‘µ5™  ²0¢¥{«É(C§.É“  ÇRÍŸ& ±oeÝM…tCòWW=Z¸˜þãÆ5KtñŠØ”¤O?»¡u».BvjM£çøÜïèý"Z;ijC÷èè(5&Oùá‚žžÜ0,ª\3¢k»-×^rŸ;ÿ*üSÅêƒÂ÷®âÎ3¨T°© ?w0àÁ Ü”¢W „ÎÃk9\|!z„˯Ðó ©Gñ¼~½a%ÅžDuL(ÊÐ;†À»G¸p |tê 4‡”Ÿß•{0´D§j¬0 ë!Ro¡L kø{ÀÃH/ÑÄšµÁ‹ú•¢ç@H´¾»‰sÐ¥Œ…0 CS!?£[ã´Ô³Võ½ì­ÄêÂ,+õêY¬í·tªED ŒJòN'_«éêßÌR-!–¥ž9SÇ­cmSvçBâ%¿¼]U ~ëŽmù¹é#ÇnYCS½lߺßOg’ëH¸ƒ×þEø×{Ñ\2GìpzÉ?2ãÔÀÒVptZÏ„º³âG·âÆŽnþM8¹.}`ÅþÙ[•:W̲®ìè9'9å@¬ÜAÝpø'5eŒ±JÄG78pàðw‚Ç58ºáÀG78pàÀÑ 8ºáÀG78pàÀÑ 8ºáÀŽn8pàÀÑ 8º f«AIDATáÀŽn8pàÀÑ 8|*þh¥i>Ë™'¾IEND®B`‚suricata-3.2.1/doc/userguide/rules/meta/classification.png0000644000000000000000000012036613051004444020544 00000000000000‰PNG  IHDRë£ZØòsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ  8 –Ò0A IDATxÚìw \E½Ç¿3§l¯woÛÛ[zH%R¥ºÔ§ ‚Šõ (‚ˆOP XÀ H“ÞC %!•pÓÛÍí½l/§Î¼?vo D$¼óù#¹wwÏÙ™ßüæ;¿ùÍ̹„s ‹Cj™ÀÂÂÂÂRp KÁ-,,,,,·°°°°ÜÂÂÂÂÂRp KÁ-,,,,·°°°°°ÜÂÂÂÂÂRp KÁ-,,,,·°°°°°ÜÂÂÂÂÂRp KÁ-,,,,,·°°°°°ÜÂÂÂÂÂRp KÁ-,,,,,·°°°°°ÜÂÂÂÂRp ‹Ï ‚sÎGþµ°°°°8”œÂ9'„XƲ°°°ø÷Á?|¬Lò‚¡´Þ2¨euN-%ÿan 8hWÌ€ey‹ñ½Ý!Ò€“ö§L“YSäC>”® Êa¿ôaceñ ?—VÙk"ÏoŽ»lÔJ¨|B(;qºïâ…¡ËþÞF±,o1âšÎ5x¾±8tÝ)Óßi¹ëÜʲ€üa/&ûÆ‚ÎÉA:Ww÷ €‰Êrg™ƒ¦3zsÔ¬.v8ˆ±¹]Q?¬~kD€W®/”Òi}ç€Æ>…ƒ?AN¾ËÃÎ*7ĵ¶Še5ßmVtòŸ–oN@8’:L@ p H®ãØìâ”R;×ôÝýZÆ8hßا—ý?ìtŸ)Ïç'GQôµ¹Þ°“nnÙ¸cyo—&‚³3ËŸ9Ûï`Ñ¢‹vg¼ÒÇêš`ˆyפÿ/å›s¤Ðä‚ï-N J”™[›b7?Û!"DÒPåÿÛW«BJdñ­­ÍÙ/}®³Ž›ðÀ±tùú®ã݇púñ•¿>>Xh§­íñë‹\ûõºùÎøÄkšöhA¾9b:8_ȱs‹ï;·xÛÆîcþØ7?•M`°ÅKª:» (Óõëú®_güú¼²Ù¡TÅùÛ;íâ´x„Ãàç^8õò ìéJܲ¼W”åzJY‰÷±oÕ}‘ÿúSû¦!ó`û]Îå*àóã%⇪‚Æd›|Ý×&Þ0ÛnL1¸ ’ã§/^RtÉ;þÑAvíêÿî£ –É*NaX|?R˜³ï‹Œ;Ÿ½eÂ¤î¾ ÷õÛIŒ¼BÆü¼Ïìa?/âÐÈóä2T.ùæôß/rs“q²ì°ÀwÏ(ÿæÏ·þa·A\vâd4_£ýÖw¿¯Lnö{‰HW®i¿´WhêJÁN`“Nžç¯òŠ›·õ^ùôÐÎ!óæ'Ú  ô<ßxüྔpE|ðŽ_tfk¯ÜÑF…Õ;"—ܧDúÓióªp`§"c%f8§ñ!ìp?[`S8ýøPØ-»û´¼KZøÙSfQ‡dz@‡Ï—ùß¡çlÏœþ›óVG†¥×7ÅwE³¹·ËF ™Ž&^ÿù&'0pzúIœ¥w·¬±ÜlÏñC4‹ÂÁPyXù ³í­ÍÑží]Ýo œ×Yqr™üåãŠ_¹¿;>|i0p&’ÜçÝ H”1>¨˜²,DDT–­°Âx{ÖôØ„€HTƒõi9ÿÀEB lÔF`2ÑX–Câ¤vŽ¿ªTNw’J«¦Bi©H¢:‹àT U2I›|@eœ’2Á:²¼À!Àäƒã™ú$B8OjÝA²à¨Ã)úm ÀšUÝ뚘!aÕ† ÈærÄŒ»$Á/HifD(Ï »@ILl”0Îã*K™\¤Ä;Å?Ç.DUîvA“ô÷¥—÷§uÀäy5$„„lÄN çHé,¦sPˆ”„$*ƒµ+Üo¼Tƒ êÜ'.ùÊ‚Á%S¿H(AFgçî Ɔdj£09©,ÍÂâ‘H¡ˆž¬©QZ"ÄT–bõ;Ä'`°­«º×´˜Ü·ÖgE@¥à„#d)ÍŒ˜¤ÂA ÆûUfâßœ`!8²lÆéUœwvf‹*GVÚß•Móå$Qh&ãýª©ƒ°K4,’Õd”HèSh‘ß¾ti •ˆØ¿ÀbÌ’ïC:ÎQTåø¦¶Ôs[’QhË\ÑN®6¶¦c›·´~åA= ]¼+ë‘Ê*¼7±âü‰Žd4óû—{¼“Ë.9L¼üοM¶ü¨DHL¾5öËoVŸ\&u5G/¹¯íù.¯ãâÂW/ð‡íTKeïz±ë'¯Ä&~òâ²Rp¾°¬uQù­¿k\Q?ñÅãl¿~¤ù¯Å4Ý(š;­ùî5›zN¸¥96±zÛõe>32ïöä£ß¯j^ÕqÒ== 3‹n8­ô´*Œ½µ±ÿÚ§ú6 yuùô;¥ÁP[tç|'Àž{ºéÜg’ppþÌÛñôµ5S s²OXÅÆ] ¹.?¹ìŠyÞD’CéŸ=Óyûª¤JàöÙ/\VúÝ*'ÕT}ùšþŸ¼Øÿî†p™÷²“—ÏqûE$âʃ+zùf¤9fœ~_XÕzÚ Æ+×Ô-ðÎqÉ7fpJ슿 ýäŠúYr¼áê=M*¦L ^wJøì‰ lõ{ƒ7<Ýýj§BœnÛ.ýÑÑj—ÀTíÁW»¾ÿô€ïÈÊå–Tœ{·þföclÿ}"ôÊ7JÞ{¯ûè{»ãìnùK‹Š¿w\h²G3_^ÝûÓ—WvªÕSŠŸ¸¬jºÒwÄ_3??¯bi±ØÙ»úïí·¨ÆؘÇ„:ÿÕ§–ž?Õeß´#rÓ“ÝÏ´ª†Á¿¨ô7§7¸øšu=W­¢ï\YÚÖ9tÔµ»»ò¿ÝC‡ìºã[6©þjyï¢sj/šî¾ííXSöý˛ҙ‹J®_šê2ñÌ­Ïvݵ2>d’%'M}éDróc=Þ‰%WLÇÑ×î½íçSfñâÀó? þåá__‘2­Í ÿiè¿ri×öhäÔ¹EwŸ[~éÒЩóüEJöþ—û·õhàŠ“qpû5gT?ÑñnãÀ/ߎO˜W~^½ÓÔƒÂâ gv÷¯Î-Í´ÆžkVJkO_X\À8!ôÔã«}L°uÛàï\iÚ¯:»öÖ#ïîJ<»=c‚t7ǾÿDç³=h#!c²Z~Ku"ËA?ÿj¸gËÐS;²õ3ŠŸÿVõ…ÆOm»öÅÁê%^X:És¨L 9 Ìl‚læºwÒðØÈê•w7-»uçŸ[L§4¦"”~ýìºx·m¸â¡®m¢ãçÖýpÎ:¹úÎãü«×öý÷#í7¯J½$|Û)!7cp9ﺴþº¹Ž‡_êüÖ£]·ß<­òÒÙJs!ˆ9”þÍK½[&!X³¶çúç‡JLn2gEèÑËëέ¢÷¿ØyýkñÃg½rUýñ~g|¾âϧ„b{"W>Üñx/Î?©úÎS š"¬Md žM+7?Öùç&Ó.ÁLD/?«î/g=‰›žê¼ýÝÌ甽úíê£ hFgJðxï8-Ô¾+òä®ly•ÿ–³Â“}t\RØd¡ªàCߪûúTûc/wݸ|Ð]SðøUõ_ªápÝ~qÃmË :¶ \ûx×ýÍæùË*ÿZ¸Œ10žÎ2@¸üŒòSüÆߊ´S髧”]9Ï…žäMO÷¼«rÂøÆw»~öF,Ê¡éÀ*'?ðå’C¹gyï*Óý×s‚<©0•ÿ›,—1xáìàb‰ D3ÿØ_¹1#M . ‰ô}33prî©5Ÿ]ltF¾ù·¶[ùçÕýâsnè,a€pö²ð I{as¬;­ýayTMôeîz±ûá&Í:zèÆà  èÜÝû•Ç„ÛO-:çèð9œ%³£_]·'~Û³Ý[#<—Ã挓ªç©6d£×<Ú¹¢ß(y/ýÒêg@õÁÑ·rËEï(µÓ‹Ë.¨˜Ušíì|Ee«×w/k4Ö7§£mÊÊp¨ñs¶cçºçúVìL?ÅÙ×–¼õ…~ô,áÀyöÜ\rwv.{%píùÅaï¼Þþ?Ï%àµq¿ã¶E¡e{¶g‘£ë´ÚE%°A=’Ûo—Ûœ#Rè n l|b“óç_m{{¹±µ#ëЫ÷é¼d©ûÇÛ35Un@kïNÝýZÄ0žÙ೺‚bçl7ÀØÞ¶Ä]«“ðþ¶Ê®$T6,„Ë<òFÿ©‹ ¦{… ïõÞ÷¶1yV8çi…œsVùT‡¹â­ž¯?ÒÇ$[k4;§@,òPÄÙš ½ÇïèÙДêÓþ¡:¾xAAu•Ï >¹)ùõ™1£ÞõBw•Î¨Ê=&œ£ Èý­®ÌPê—Ï´ß¿]…kh˜tRÐýíÃÝWì⌲ýù¶Ý²M­¯ L½¢¶ºØöI[âÈðjŠAOY˜ä&CÛ:¿þ`Ö!¼Ýš9sš3i¹G—~­AèŽ\ø·öI†ÕéºÔ.šRrÃŒîK6qpˆÅ=ç<Ôß¡‘FîúÓÛÔÿž¿¾¤->9ï¸ðÏ^ÙarÁîÈeïÚä Åz3ró²@f0{ï+=›Ü: pè*x>\5Mó©WÚ׬í›Zã^<ѽ°ÚuT{J•3$ã‚ûÛÇÑ%Ny¾'µ7f‚’h$½¹ƒÏ¨õ“)¿{' B»z³C)´@²\åâùLJ–epÑ)sC" D¤à!„„¿ï¬"ß7-ýö×I°É5.Iæ[ßµ”Àã’Ì)—å]YãÐ+xÆ䌃ÊD c| t Æw-“é’|ÕÊf…$‘Àá’D€Ø(Òúê5jMá÷¾XûÅÏW fŸÞ¹o]Jå@k⡦쵳Ü?»hâ¥gê½éG×=Ъƒ·1ÍÏY„áŸÁ3Ôvî$ŠÑÞœaŒ‚è¾Úý8!Œspd¸pÚÑÅw^`wR²›Ï‰¾Œ÷5^tV­}o— JÏ<ÚÍNš"–VÚlÛs[ 3OîÈ&Š©Ý6A&2›næå~É ljŒg˜lÅÆw¡¤ÈgËà<Ú‘Ù‘` ú’kÆ‚qñ,Ö+¹›Ü¿!Ùžá7·7¥°Äæ$Ô.ð|‰)%cf³Ü$â’ ÍlêQ“@ôGÞLß3Í÷ï<žï›NDzÉ6‹šóæø«$žàç•N{,Ú¨Žù4ãn³V‚HÅ/›~ ãTJ\pÏ,¤^ÜšZ×­% ™æZHáã׊-!9°“59CÎ{âêëƒTfÍ ¯»°ä°jW}PQÃœÔ €aæ››|ß9˜™0‘“>|XÂáòþãµGjÙ_?Ù~ÏÆôÔÓ'=~¤|à՛܄9÷ßû³CfŸP‚ᾶò…–ÿÞi8Â9(Aÿ¢°Cb1“€°uý†bp„³œ´'Êòg^2Fá‘ÿ¥GîÞ Œv+Æ$¿ïù+««SÊožk»}cöÌ/M¸y¶=÷ÞKouLiŽ~i^ÁùGçN¶Ïè;m¦û¬»;Z5ílz¤Öýå£ ¿4Ó·¤Ä±dfpá m>9°?³ï[BØ騤€¦²¬ ¤0ì¹ë’šÓ‹qÛ#í÷oÏÏ/ÿBà}£î¾—«ã¹'·:'F´Æ˜Â‡=ëEËù:3‡+ƒ*È”cô22|FG-@ÊÈ¿û¾Oûùȹuø\‘˜þ‰„¹|‘f„gÍr‹ äœ3þ‹ƒÜPë8q²½q£ºäS@QÌÛþ¶ë‰˜àÌFœïŠc:!LçäÛÂ`É÷¡™'ŒÉqßÏfóûçþb‘W(%„³¶>Íèø†%@DÕ›GÃk§p8åÚ2 Æ?H 8·—$hÞ•~xUtW› ã³}(Ï…ºÊ¡Ä!Ú)£ çØ šÑš5LÀëeÛö¤×·¦÷ j=q­/sè<ßM&ƒâ;`ûë¹…NH@J Þ¾$|×w¦½t’+’ÉW†Ì_UTìíÉþå•Á–nÝíÉm¹$ $ä³ÑÌ-ítñrÕîFJg‡\'SˆB‰›ö÷$¯ùÝΊ¯­ù»ŽÐsê=éŸ÷XØMý….;-®²s¨8áÔª‡¾Óðã¹²Ó.S©‡ã›Ú²Ä.ä[žŒ8Èoà „ƳÝ@È/–ÛÀ»íÌ0ÁÚUUøáà\ œ0Œ]YS&ÎpƒsPº`ná}WM¼ôûë&ñUÚKlŒÁëœï`ý¦ ¤ð,B˜ùî  ›P’ì”à‹pâßDá#‡Œl.qùí¤o[ÿ÷ŸêþÙó=×?Ýó|S†ž=Ý7¶„lJi1!®ú¶=©]Jw\ïŒjI}tFµÏ÷47Ýâ°´vÈfQB¸ª<»W=·Êóí³«kêc[#†Í);+ ÛÛS{£z5!„”ðÖþìê&cJ}èî3´;6+‹”.´sÆFµ{l/ÌmS% f"“jËGæ+øäÓ5ˆþg^e”s®Ó'ù¾ÙH<»S§¹è‰ñ¬Î2j~v ÎÓšÉ`ê‰Èe¯'ºíöÿùZýGÉ߸}ïŸÛT¿ÏwÇ—KZ›Ï7©É€çÞ¯VŸSMßÛÚÿ½5©~—ëÖ joœM/ûC_0hîþfV3Íœ›‹dõêþŸ¾Ò¿>*ÜôÕúG¿.×Ó×=Üõv·JñéúáSŒ4v-»§ýÑ­É´×uÑ’Âoå·Å•Ç×ôœõÛÖ~“Æ“ O(ŒS!ÕÑ÷Ãu©´S¾é¢ú¦áêûÚ^îREoàÖc<¿¢ëµ8½ú̪åW6LŠ§Í¸ÆSãSõëïo¾gkºvbèÁKëo^àZ»#ò“¿·¼ÚeÈài•©Y–ÛÓÏ8O+fBa:ã`¨¬óßtjéÑA€Ð=›úübßÛæ¥gÕ—|x¥S6µ7öf3£²´¤Áå'¬±9Õguµžé~Ú;]Ó¡y ìóÊmn‘˜ÛÛ—ÝÞ«B†,*ª]ÓC’L¡*Æ–ŽtgŠC@Y©÷¨"ÒQÖ´ª„9õ®r;mi‹oŽÂã•æV8ÝD}W&̓WV¸+$Îööd6÷°0NDaV«ÚE;{Òë:5©ÀyR½=>”}§Uñ»Ž*‘¸Évv¦£T>¢ÒeßéT  ¢8¯ÎvPC7·µ¥Z"âtÊó*Éxy[:͉,ѹ5®BÊÖ¶ez3f ä\T"ílNì΄CAE•ë°$‚wôe6öê nP—cQµ½ÀF2}]s:¢ˆhM‰ka˜®ÝÚ“49ð;Ž©µu÷dßíVTNgMöVK¼µ#ùÞ³ûì‹*ínÑxqSJwJSŠl …²šÒwm‹ô=#yžsóîž¹?n×=ÒÇãc;~š÷š“K/º·¹5a ïB! %Ž©År¼?»¢G=’ªñ†‰ž©.ш¥–÷’c&¸˜ª­iÏ&4À4!Hóë]¥NªeõU{’qFA*tŸX)lnËlÐY.gÜa—68<œmëÌ슛VüãÂ#‘g¿Ý°d‚ç“Qðñ«š¹gÈñá´ÅÈÏÌ‘gÉi¿éìê¯Ï¾íÇ«3K?Wù÷/š#gݽwe ù¹³ÈœÃàà€DsN“_WÀä0sÆÌ‘g×P€ ?%.÷`<ƒˆdÌ É¨FóáÛÈm$øt.¬ïWÁ1æA"#µÆ°YòOËŸe„8úå~Í=b,¿T—³Û˜æ1Ƙˆ12H¾Y÷±­Hò&ýRð|å¾7¿9„ƒ#UîrÍ=üu >Z)Œq2|ñ/JdxãàpMé°ÃˆÃÞo»ç^ûEaüçÙ˜;0c¸äàÐßW}ˆ¨joøNqßžèŸèy¸ûvÍ<z`ǹ/§áø˜žÏ¼‚cøøÒh>‰š{Ýà`6‘HF«o¼¯î¹v†B‰aw­µå?¬àÿòÓe Ékë>oå—<ò¿êåù-‘c'•}ã‹õœÁ%‰v·Å®ÿGçÊÈ°pc¸o2n3%£ÛNGt<_v2>;ŒqTe2ZHé}Ñ+!ã.Ç¡ö¬µ‘£†ûÔz´]Æ¿¾Ï¯cë~ æ{¿‰roiÖñ¶ßXÃ9«÷Ý™€`ÜU#7|aäñ ·Ïý9ß×Cr5•öç0ªÔÈëä–Ç=1”BóëX×) g=íƒ7¯÷ݺ ðé)!Y7ž[ÑsùÊ4ìd4ù±»D®À£6y _ñ}zÄ>ntÉrÌ}rbMÇ4ÊØh‹Cl%¸‘hÜ[yÑ\ùnÿÒ‘"·(Q˜Lêq…#÷<²ïŠã×j>ä[ûrŸe©ƒ¬Î§UÅ÷_ë½"Ù²„lë|ÀÉ¿P¤ZSr>X7~YÉ>ÌAˆ¦i·?°ëgd¿Î3ŠÙ×MÑí´ÿ®q}¿B¶ƒ|§YbýSðƒšá¨01ZÒƸ¨Ð:`ñY#—©#œñ¨:0ªö4Ÿ¾³ÞâRð}öšꑯ…Å?×ðý{»åð7Ö½´°°°°Ü•‘#i IDATÂRp KÁ-,,,,·°°°°°ÜÂÂÂÂÂRp KÁ-,,,,,·°°°°°ÜÂÂÂÂÂRp KÁ-,,,,,·°°°°°ÜÂÂÂÂRp KÁ-,,,,>9>Ä_x`Èý]cnÙí“‚qÆÁÆaYÞbœq<ï–sÊ) ùGç?¢‚‹=yF $`sˆÔò”O Íd³+œÅ^éÂãŠ)ˆey‹t“O.µ•ùås%Óú;–‡4’ˆŸüoTp*‹êCr+ïò brT¹ávñ#gW˜–9,ÆMÏPæ„ÇËçL§-ç8Ä <Î9'òïð¤‚sÕ ?]»Ù²ö'háø‰øá\rÞóVŒe1‹ªñÃy䛯b0c¹Ç¡.áxù4RæÀ?T[¤‚Bà•' YÆþDÛÕ%C¢p;²º¨ÅxwÙ S¸íä–‚ÚxÈùôƇkÈ‘á°KþsX–·°¼Ââ_QðÏíøþ>HŸå|þÝšÿÿè #ÕühõÍ]µÏµù_?¤å?„ðV†(ÕÇåx‡‚œóêÕü šé µŸ˜î?Øûø‡µÏt×þO(8!`&UcT×AȇlrÂÁ8r?ðÑŸ'bÂ9˜AÕ85Œ_’CB 'Ålú#Ö—°1–g#Æÿ°–•48ǯÞpΠ'D%IXîÄÀÈŠÙ58Éß„B6B }?÷Ì}#ËŠÙ(5LÏ^Ò!×5 ªÆMçÃ6áDO‰J*¯Ý„€pbdÅlœ˜ÆþÕ-o¨81Ùù É5IÕ¨¨$ cyø¨~Eµ¨ iàæ˜*|˜êçª<"FRT`ü³ØÖÿª‚óq1/ÆØüŸOó¨Ö=홣§¾·ò˜´Ï>±ÕFNN@)Il(Ýúœ” ¹÷>\عRÎøÁû˜ÞuØ3'ÕíÚûVäSDïW9þI$"»ý¢ãþ~#ß—pÛ×ò|ÿßN‰½ýá¦M‚Äšš ÏRñ@–ç Ex¶žsÜ×S‘üsƒÜøÅ\X0˜ÍßÕÛ|óÒ{×íÙ9ÿE4ùÔ‚?.¨iÛ ìç&Hüeé_Vµô¼Ïñ?£7Ö[³âœ…OýZ6ôáö„×\|쟿æKÇò¯5¸ëÖ}± Òs u{ÿ°ä“Ê;†0ê'ûw!³eÒã³–ýéK…ƒ= ¹A‚Ðu?È{Ó^Xpø[oBîlxíK3ß~‘Èq7#<[¸ý1—’!ö–õÄ•þ¸¾ÏäÜ•øg[Á À bÉG@Ì ŒåFxp¦ƒ±áOêÄPÁxÞ” ‚æ(ÖmNÄÔ3ó^26t"dÔŽ¦N Œ„ƒÀݽ²lûË6=M8§ê@É–‡ƒ}-„¹Ë]2ò¥<¿ÆË b¿p"jŽ"]’Fƒ C!Ÿæq›p–žrÎ̘ÎAxn‚BL}8bÄT‰©Í)àRAÖåã¹v1õ|wx¿åsæâæèò±R²pÛCEÛ Oç«[_•rŽw ¹%‡©ÓÈß`RHqùG¦ÓÜOç!DH7œ•" Gr78 W盪/(GÞ‘ "ì{ŸäE‹û‹† ?¾úˆ[q²<ìx võÿS=´;KâeŸÓ´µîL~{ ÉvÙS= m F£ùjj1ÛÐöLÙq)wQ¾Þ¦FLmØhÜŠ«ÈE0>Ü_Èh\Ÿ ¤ÀÝÕóº[8²»D·m£|ؘ9ŸÀMb(c€›ùá5ÂF6BÝQ¢Ù$Ъݟrã’SXN=ö鳄€ç ÍÈh±‡µBmoyÒŽCWê~ùöÙ¿ù¤|ás÷1Ô¼ÚäÜ7¯Z€©RC "°]üÈ:"÷½^Ѻ£wÞwÒ"  „7ýÉ¥Wí]p.cDH7…·>“i8g(ä ì~!Ø·“P; ¦ÊOí­lËÝ ™Ö¢Æw<ÑAÑ@2|BÏäùÎò³¡¼ Ñ£{ õs Áã5'öVN—"ï–¶¬– V¶ñÑþ¥ï½;”Ψ=/–7öTÎ2ô®¢¦}í\´RªòôÞŠZ0€gç3¥-EÓ„T4Tuü`ECnö•—Bü¿ ¥ý3¿¬ø4οr}Ì*mü3¯¾¨§°œÛ"ëË·¼›|ÁPI-8=/†Û»:Žü:m.޳ܮsÆb¯ë›xFÊëÈ;¨hwt"ö—·nbÊ7ü1VsÆPÐçè{§hï—Ànoè›tzÊã€ìžÒíÏxS)N©æ™Þ;á8ÅëÎ_ÄÈÆŠm¯¤êÎ(ªØ_„êî)Q¯â‰vQópFsg¨“õ5Ì÷DšíISw @"¼·+X¦¸eÈCEM/84‘Aåö†ÞɧdòßHÄäÖòµëÙ ¥žhõIýeópHO·óé1ªÒ…g½ƒ}Ÿ„9-v¥(V¢[v¶VVsND5âïHÕÔÔ–’íÏx“iF ¤Ð@Ãiqá°Í çÀšŠ¾­öTœÈ¥CÕ'•UÁäcR( F¢`ïêlùI½ÁDý{»§.I8eÐ;Jv=Çlr¦ŸrCL÷¡Ïu×/6dŠÔÚúÆ·%K¤x£`(²Î’eÇõULçùAˆ€E‹v>`vL˜Á qu>Sܲ^2©h¨æ¤ÁÒZ€ ‰%{^tf³ ‡&œ) dkÑöûœZ$´ãorÑüþ@¼¢5Ù5íܬS’þ½/t7BðnªÁ=Ž0DI蹯®ÍÙ[â vmP&%ÝSÎJ¹½8t†õž7…XÉžÇB½DÉ-Åoïø‹/ØâåÍ[ ÁM¿mX÷'V°d°jQFRË×þ0Ü; €pžðu¾è0‹#UÇÆ]jåÚU7E Ó1ƒ<_ÓÿÖoY¥5T}l$˜ªyó¦¢hBwiî¨?žŸ²IZÁ$“RÕ7),7³ä½Ÿ7¬{R­8~°j±"§+ßùi(™%Büù‰+ÿBÝÓûëOL qÒ[7 D9n%;|ïýlÒ{O¨³4ñÓ:çæ§‚àˆ¼Qµs€kÎÁe;)éÚ)2€Àß~q¯ÎµÎêwn %h<¼ Zvz©aõí. ±Ú ›ÕÇ•ÏúŸš¼ö9›ã,O ”US_ºÞo”T-¬˜lï|¢fëóÔ`Jhº)@wÕÆBUŠo‚êtxùÜ´Ý%Fß­ë§^V+_)_@‡ž«[Ÿ @è«yë¦pr¨êsCŠζ?׿û„¨ˆ3Hjoõ;?ñeä¬30¡ï“‚ñòÃœƒ;mº´ëa¯\7Xq²šÝéHu‚ÑAEÏ–ê6äöš•7fB‘Ê…Ñðá$úRúû@'záî'x`þ`íçTmgíêÿõ%⇼|Œð&Ì’™»Ç7° `Šmàm›ïˆ¾ð|¡ï‡n‚31µ×£y“Ái†=^½âG•]‘Ê%ƒ•óXjCýê;™d~׆|ýëtÿœº£ùÀ³ ko÷¤8(“¬#bjO0IVŸ1P5]¥­E­;ó²Ç"žÎG&¯šyb¥ó⥓‚›n®hÞ Ð[Šw?^»é -47Rµ$%öU­ûµ?:8ªH<îïx¡¨»•*ÄžŸøÖDÏáý '$±eâ›?õÇâ0"•ë~îêIV;X}¬®mlxã§.ÜV ”q"¤‹æÄCµ4þVYÓ6•A‚o×ßÞ¹‹ú— U.Œû‚Û~Y·}% ™•U(/ªYL»îŸÔø:„ÜpþYŽÁ981CGÆä{=o¢þgß*­öteë_ý]=цb[´E-ž•¢ñ†] j™{tÄ*\Ño•l}¡·ä+¹9¬˜Ð7õLEÂÕ¡ö¯·Ý×6á¿Ù¸œ¤˜)9m[qI²$ ÔÎ l™VÒÕÑ?{bÖSÂh&V~„b³ …³ ú¨êŸ’((„n&ªÏÝVU« Ã@Ìï ´\VØ ú‚ïÞ!ù–µN?S—€²2Gæ›ç .¹l{î›ÜøFß‘쨯ù© 8 ã…s‹w¾ ³ÅSlñ­‰ÊEÂÀ^QÕ »éîÚ›~‹ØõR0[¾{ñåÑ€©ùÜm¡ÖíééS@ÍD#'|o°ÐfvOYõ¨7{BÔé¿ž_Þ¶ø¶xå¦ a$6OiÛ(i_PŠæj¢È]u‰P Œ’ŒË⊖Ï45PT´ù‹Lx–. oöî›Þì7#• ô¶}û`Y`j2-îIÐáÙ31Í’¿ðcÞ®£.M9íûOY€xÓ…óh˶L*ë nß ûÅK*~ÓëE¸ÊÙ»M4x¢îHÞ¶' ôi .Ì8%pdÜ´×þìë;%ë¡`F6¼´kâRpD Hà©›Bmqoà3 Þù0Ü>¡¯(4¥g»ÀcioG«R´°§žU´¼ã‰d2….{d'ì¥é²zºûö²½Ëî,wˆÙ{î¶àPgÆ5ˆ/™×[4(b¾þ¢Gî*èÝ™¬Ÿ Âóe8;ÿ& ó{˼°-é+ømEÛòæI3ˆÀ9M—/¨Z¨ 0Ix%Üòz÷¤ÃT*3Á–*ß_u88’Aj¿¶°¯)˜>2¤3ÁnR‘K(x÷W¶À3NeÑ’2»ò[»–†/80õª~Ï´t qGºøÙï÷¡¹Ü“5˜Ôž.><Øc’)Ú9 íy\,þîžYÇBÊ&;â›Ëv>*OžmP§.ù§œ/ðB@焺Ã7¿'àtŸù, IJް»&ÞHÍc|=}Éš3Uõ¯EýqîÄP*°”ë½ö,gú{¥kF˜Ä¤¬.±M²~ž N¨GñÍVl€HEqgaXÙeב±ÛÎ$ÐÍSëÝñ§šU¢a€pÙðg 5·êpÂŒüË™’©îw3cí›`Š=Kh  õ$2Êt09PÑ|ì­àTHïæ¢Cê}lJ×êÎ…wuVUÃäà »Oe%·8UÜ`nÿs †ç ·Ëì™´¨ e¥]M)tk Þ9š;¨ñïyÔ)Äâ\‘Ó{À¦€kÔ6¿/d‡ÉA‰ê¨Ô„^oR†7“pÃVó·Õ½òMw6A8h¶Kv,¶6Ù7–ωr€sæ*U“»ª_»ÌŠΨ„*0øúûA}¿ŒƒÓdÕYÉ*@„pAò7~¯lзó˜+“Nûh¾u¬åóۈ曨òG½ñÞX`(‰gêN1Ý…Yo½7ÚDÍù¾¡ÕTZÒ[g¬Ÿ-´íï&¡ •¢÷»RÝp 9Y0`€{jÊ.zPò›FÊ®#V$ßþ¬_5b¼#˜%Qß”JiòGoÿŽ¾ÂY®¡õš÷ó1? 6örÂ<O½  œ$5êKDºr“Ñ­x§€X”~îIõƒLnÒ]Þ¸>vø=Š ´kþª{(˜ºbÐç8%®¤·ÌÌ­pQó4Hý]v * ¤}Sòþl«IÛmÁTd_Í$G¤°3‘žVÅ(`pÊæ£o§ Èú ÊÞûIÃ@'地Œ@mTÓ‰Œì+ÝRA¡õ8c©ÄÂ#ò‘™ìO»«¸¾Æ¦ê©4åôä6S1»fš2˜äÉ¢ˆÕY8I5,¥«»lƒ[=š6ä''ã\»EPfÛ”®LÙDFšuÈÝÏ”õòá]$Dó zD`¢{ØF‚) º£wã„W/óê”s%^Ãæ%ËŠÖ~gÒÎh×ì ‡ «M 寜gãä8]óÂùåÞ;õÂþÒ:žÙY»ö6€*2Ê1¿ˆÁ LcoÙîné¾Öîª Œ otý4fQrcXÙUú‹¯»c¨h…—·U-öu­pdÔôÀƒö‚yI‡£€3šj)Üûôðó Ü¥º,‘ÜGð0 F$NL"Š%/_8¡e#&—§îøü/#«óÿñ £ò̶Y_͸ýîw×ô뜇ut¾0ù­[h`Yû¬ó›ÝÞûbmÓ."3@¤Ñ„§Ã›"d–||ʦæ.qÇ’žªÑuű)’ZtGeÒgõwwÛ’6U˜4&’Êâö6IòtlQ®5À  $¹«¸©Ÿäˆ~S”s*œÃ…–Mb~1í3°˜™[÷ƒYpBÌù»Š¶¾X U Rº¬Ý%ö ƒ;Àê¼=íéé 9 ™ Ì´<áq/ÑÎi¸u.º†ß±›—s‹“¹1^‚´ó¶bÍ–Üú?s¶‹'íµÛÞ\² @DFe’›0*ÆÈSñ¸à‘ N9eúþì¯HŒ˜Tʧ{‡û,Í´6¼|qÀœÔ1ý¢„¯ˆÄ×N\ý»j<®QSÐ%a$2©¨Bn¶G„ý7ýg<‹B87ÇÇ…‚ͯˆLT\Ô´Ÿ–M]ˆ¶‹)’ö¤Ÿ±øqoïžhy߀,§*áL´acivMá(Íú'µyƒÌ 8ÓÝÓ©ÖÞ¶¥sñ½ÍÓ怼Ÿê#šëØdÜ^"’ÚêÚ=tìú=S]Ð@²,/¾´Ýð)iÂÁ9ÛÐ6ÁV¡€Sîœú½¶²ÄÔ—nlpíš6k8 ÿ{œ?±nÊ œS»®²¡·Ý‰·Mÿ‘jAuZJ™ÝÅÛ¶ÅK>oJÄ„ •±å¤+y¸c›€™k ½ÓÆ% K Ì© ˆO¸hgy’⋇|e/>*.Ýpâõ:$H­.Êؾû‘FÒó€âî[)»–5~þGŠ,ñ&1²aIAc°  Ú#Ëê“JSwœp³ÐòËêuwf=7ƼpšÛô2¼yÙ—Õ·¯IiQ:®7hP èŽ7‘×ñ`û¤zèqÔ4*.ØpÂWùØ…èoäÜõ(Hð¸Mƒ";À?;RFzƒTž(­®Úñ²ï°³ñ ’—ʯ¼žlIs¸ &2vJÄà¶3žH{6|¹äFj¦= „@6`×ÄŒì‰Àk75¦ ·Í8†€SÉÞû|õÎÛýóÄá\‘ŒL>£L è1F\º¨g¢6R•kIcªì|ÿ~S‚@Òi²ÉüÆsÛ‡¶Q{‘Úè;ZNûmo1ƒÈwÎ9ÝÏÊ FF}€Cðê6ÙHB @¸)ë)Ÿþ™xJý<¦P˜,q†›Vy¦*;!Vѱ²½/H¶IY‡îÚDa¸ð_Ù†L¤A"íåoß^ºsï°]3®UÞH$ÖèOtjÁc2>g¬áÄþ 'ôO<)®$Œ1I¦F*  løµ9¡eA(ËRÓÌobc5Õ¼<Ñ,  µ-wfâTOƒ»&æìZã‹Æ!€&ßœþäå-ŒRJ©@uªþ¿vÍYZ¸þû%=ˆäCQùD»)‡†Á©GØV”wDÓELj—¸ûŸ)ñð€f ¦“¡·Švo!I†”ik{»ö{<5·’i›ËwíÌŠñ ¬—¥ÃN)[¾°â NhX`Úe.Èœ¢ è†Ü±¢¸ë=Ñd„3€Î(Ë’Üœ”°´dä:ÈSPuè\ZÞý’‰ªHUÎÔY¢xïjÂ9X¬pó/¦®ø=k‚3"O(+ëŸ|qœn­n|L48@ÄØÏIcÿÜê™èL&kÊÚ’ö·Õº3 pèÎú””(Úõ¨Í?ÐmÏíÇH„gÓîçJš›‘bHꎖ·jÞ~Èå0ý]+$•ƒBì^áUx$Xò)r}ä0œ ±¢y,ù\iç&¥|‰É#p|’o)Ûñ4 LO¸<0¯›§ý›ßFHs¡{}Õ›r EóÒ`$<kE•C€}Ï#nŒjóÛ¨)„î7ÉXtÚÕý“íŸtrÿ¤“&-ë˜~¦"¶…7o‚$3¢»ÖºÒIpN´î@û:50-#åJÈ}]¯Û¡÷m_: –¬ò ¯÷00ÇÀ„™ÎÖ×|±4(HüÍiO_îíeTä”# $Ñ\¶ã) "U38¡`ª¤ëÃÃ?Àl剢ZÏ–?:²&Hb¿ï==¸X±ËÃÁÇ!Œø¯8 \ª«ÎÓvg¦îC–@ ”×½÷t÷¬Ÿ¨€¶Ïù®ðî=S_ú–bwPuPfîRšÞe-Kì΂Í?«{t7ñ/k}<4 Ç¿ç¦XÙ;i^õÖÿÖõ¬.K†giÛÄΆm?¯ð;œnh·M^~ytÆÏ÷V‡ã~GxóÍ6CÛ5cAפùÕ«.™Ú4Ém©`U´hBñæk½75OùAÏÐ-uo|[sx„L‡^sa{åÁØ-eú$5 ±Yßk}»áÕ+Ìe¿(öÂøwQ,ü%%rL‘Q½­º:²…3®ò)U;˃`È-i´½lË­¾¦Bº¨ÄÍÀ"&Ù»4C<>qEZTÉx÷ìkÓ²s¬åÒwØÙE+ï™òò·ÓN7·WÅjOöl~jòŠŸ4îÇC¡âº=wM̦¹ç&BÓ¸ö»iϯwÊ7û*ζýï„ׯT>ÃæÉT|)³ýÞª5·&–^¸gîÙ5;3£ûƒ(²Æ{¦_–u n}О.¤˜wjËüoL{õ¶‰Î²mó?ïÛvû„~iç1wEe2º™—s0’*®5IGi‹ºyAu¾EYQ·yurÚ©:E.¿— ŸÚ2±¥|ÃMŽƒ!©)­à&™˜=Kq½jÍ ’wFš³§†Êñ™y2Ô°¡Óéª?µÔnŸVƒÜÊ…­*ÈT5îœv¢ft têî¹Ý5»ï>¬÷† ˆÙ~¸ç R1b’š’ÓƒÕ«$©1÷@ÓД‹Š‹óþÀÂ[îu‘…   Ç:<²7(×îø³þ.ú3fª¤ñö2#-'[d6¥yÒ±ù¿IAD²Š57ŠZÌ9´W/9i ¨ܲ}² €’Ò/ó 1xjÊu]C?kxírÕî¦Ù.­ú‚Žp9cÂ`‘£òËÁrS´'KNE~Uük^^óÖÕ¾²ã»¼ 9£Ìµ÷̼ҾîÎÉË¿£8T‰RaJËœÓu¢±§G5œQ{J äP:àEòC´%ñíUx¦iäé²<·¥_Pú±NÍ?Aux.¤:\ɨê­QÝ^0€01ÕåHN@DÍU¦¸¹MNŽØ^H¥Œ Êj†pªyª·Œçça¢ 9ã]ã\ôdýuLïtÇú gYÖé¶Ç›eM1¼SÓn»˜ls&a §‚a¨Žx‡À%&º_Ô~grÀtצݪô:“½‚irÁõVêvŒŒ3Þj:ªT§ DéqGûtÿdÅi.Ì´}tœY«gâ¸'‘¢cOÌ>Ø(3Wºh¢I3íŒì™'YRÃ1’öD‡¤kg¢WñVäN²©Ý.Å›tsW¼ŸrƤ@ÆWÎaŒås×äX‹]Ép*Ž’¬Óåˆí•tž M7ÕW¢—ˆ¡t°ÊdIW¬E4 yë³N›o±+NÓ^œõømÑ]²)gµ†`Øâmv%à 5mEYo )Míò¤íñÂ*€+öȉ&ƒ%rlCÕÊÛc‹ð™ÝçCªŒ#Ò*kHN0Å\“IÉNGzHwÕd=þ‘5 ¢'ì‰vI70Ñ£ø* Y‚Úãªî ªtIº êP0÷xöD,)ýä|xûý>gâG¦¢ûü:.Š<€2Ž\’ϵtã »ßï9r2ztŸò¦ÕûQð÷•v¿–ÿ` ï·QÆY¬þG³Ì~?¶üc ,í5ªìû|€ï)êƒK~È…á¤àcûÎH>a÷Îïðy_»xŸó‘4Þ~|oäB(›&¬¸‡¯jš¶dt)‚cXÁïî9âþ–‰•`ûõ‡ÚþÄ~Þáû¯&ø¾µÛ¡>ñ¾ÿ‘\üèß¹O%?ø׃ykôT7¨A”–ÿð·eí Ëÿ©˜;‘Óò#oŒå?še>Àøﻡé>jûÿ±÷ÝqvEþUÝ3órØ}osÎZíjV9X–³Á8álÀœ± G¼ƒÃ?Àæ€L68`cç$ 9`K–•ƒ•VawµÒæœ_žÐÝ¿?æ½Ý•´2¶ÁF‚ù~ôÑçí¼y==ÕUÕÕÕÕUç_8Y–¦ýŒ'·‰ï¥çÿTéŽÛg<¡ðTtx‡ '}ÂÛ§K›Ð¯ÓÙIÓè»*|{Rœâú™%û7 nÁÂûâè‘›€‰m«xÁ6~”8– IDATÄO«.ïñÇ h œY“°ÛÞngÁÒàÿ¢"¦d|ï À”ŒMø(ÞÆÙòîzõžv¦µÍEÊðw^çN×Û†)ãïÅoÛ8À‰aûÚJ•Ë;Ïú0ýø¯8×¹ —Ÿ šyHÇÒà+¬ºÅg®bÒa-!ȘLùû^D"•×MF lâ_Éz ó9Õ+A†ã¿××4· My͉4rÓä9~çy¥S½¥rê,þÓð†8‘7’ù,§Ï©K#ü¢!€rÒÜ R§4Ìc:Ç9ß p€˜ãøä£, þ¯æjHeÍÕœOåÞlÓà¯y!ßÖìå¡`㙽@BÞ¶Ý-Èßnê>!y€Éè_ò¾A ü›ì¬‰ 74=–yt«lLxu€ ÁÀpÀ 0Qgà¯@JƒkóoCÄ«p‚7]Ïä|Å©&F&“?Ëvžš\Ýï~ê!¼5oÿ{B?Éž œnu5õ¸eƒ[ü_Iû ï+xã»å[þ/m å¸"“ÙïüpâõÔ|,ëÐÝym]@GM÷åÛG§¹'n'5‚ˆž#«óö=/q tొ·žVL.·ÅIiõÅtÿN~MD9´»xóKv?â™áÑ´?,ÛµJp`õÜÇDmdúƧÚæǽ>¹ÿÉ’†õŸàÌ,Еä d¸pýwËvÜlÛ7é.ÜÙ¶¶lãÃTB@c°òé/º8N:CNn1™A~*Ñ òzéîÇœ1#©E„°êv~ð°üàg®©@Q>öûtQ>œfduîɮФd=H˜Œ¤&GêS×€H€ãD ÂÈ ‹[/~€À9’¬ÒbÞ™ôG#ÐTË€!’a s¨9B0¸^}ÿµš.H˜Lma¶cê‰$û&M4SVå)‡4÷Ñ»ÏåýŽ]éG2³ràˆ„{ûÒŒzØG[œããÜ`¤vAi*Ÿ7Ó™¥üN4å/bfg…F’e‚ŒÀ „œ¹’Mþ4“ÏìÍäÞ¥³².€‚j±G$®j‡¯·»Ë 6:1Ü)2¢ùCÔœ8“D¡SCMf²1W` ÿ-›(, þ/¢¼A#…{·E .ïÉ‘Ëv¿jŸ¹Jó j]…›þ—g]WwäÛI…gpÖ;ËgƒÞ^²ñ®wû|UâžÑòk;k.Ô'W¾Œžü ßsÙ/o©»€IBÞPòÖ½áq5°´mîÇÂÞ £7c÷½9‡('±¬‹Î¿ZS }ëmUÍ ŒØý=ë\ðëXÿísû/üv†=”¿÷¡`¢=TxYç¬KUIœ‡þsVÛœ·–Ï.Þò+_(ÏùÐÑyת6ÇdÌ™©Êùá¢ý-+oI@I×[ÕŠ„"ƒ9k¯(0ØÀOg¡Öe¬«hÙç=þùÞ¹_ë)(‘†¶îÔ?Òè/¾¢£æ]Jæ4ü_áÑ]„†ªoê.]lLÕ6!º½ú…ŸŠŠÛgÍvÆíjŠ¤'Ç˶oçßØ[é­~óeçxo"˜ z7ÜPÓÖÏÎy)Üž¦µnWHhæ3Ÿ-ýè±9—yŽ>–èe‡¦2{A߬Ï÷ ¨æl}¢´áe›!…‹.塀$áTŽ÷œt”¾ô}¼àÀYŸfÖÂÞò¢Xx[!E³ÔXŸWÃ¥ÿ6œW§íéƒÝ©» µ£…;~‘ñv,üzOafÁÆ/–¶v‚„²ò7ÿ¦¸c¬kþ7:«êû¿_ºg =n_K—ã½J<ˆÒÀêúÕß´+Eè± u¯þ+ˆålübEsóxé¥=3ΓzïYºæ.™:Â%—Ž¤§%‚‹;f"f—Qëw†ÂoÍz鿲GbC3nè©Xä>zwݺ»ì†)öcÎÁuå›îÖJni©¿ÚÖúÛšýÛ€Lø‚Ls ¿ôÛf ä̉f,ÅHƒglÐ\F„ªnJØ”höù]ÅóÃ¥ ò;çÝ<š–ã{«ßø¾?æ˜qmq¯éwUo=C  ç½qmõÁ}¡â‹s²r6¹rÏ+„MÑD±Ã3þòc§{ù‘ó»š&o ]ÏgÅÙXÙ‘àìcÐ?ÔŠ€A¼üSßî™Ó5óÒpñÕ=%”¹ûfßÚW4ÏÝü›[î鋺k® »Ô’×?Yt´(‚¾Ý_]øú£zæÒþÒù®¦_Ìzó~ûDžJ¤ÀÇò7ÿ<!íóofÄò¤X6¸…·ÑÔáI£Ï£meO‰`ÑpV~nÇÎŽÒZŽ¦)Ñr®nYz‹N ë¥ñ«òžh+ùGšÞ¸ò¿Tkx¢­¤k›mÆy1NQäìùɾyÿEŸ¨^U¼ãY›Á£œ%ŠoÝ7oA8/†Æ‚õwgÝÖ™=/ä z¥ºÁ²¥AA"€´öWÜ¢¬á¼_†½Œóæ¾zO°ë‚®ªZ Šˆ[új_€€Ž±7g5¿EŸÍL&•U;J‡s>öКKÏî80’‘Ë€ÇòÏï}Z ÔfgÏO dõ¥VÔ‹а»oÖWGªÏf€AÈÕ[ÝÚÕáÞûKÛÆŽ}èñîR701¨ ŽFRG8)èc…Û~nw/;¼ô‹Œˆ3¯ôZ’7²[^ŽszJÝ`”Œæ×t¾ÕU¶@“¨ž½j,í1[¤j°¨ ê¥U;»GÊWÄ@uÅëZιx¤¸@Í¥ðØÙž­¤¬„m«8°u¸þ¡¦¥µÀ`0onAã>¢ë梋xzï2ÇáèÊŸŒy$`Â2 - náÔ˜P+FSΑ†Pý74]Cî-\T¼á•´øMÃ. ‚ð‡ÓŠŒ¤_R$|3p´Å• ºæ[ *ëÞ*¢í‘Xâ$cSâ¢/­g4¼x膹¼mù×MÇèh0;¯ñ×ù{4NeŒE*•Ó g„«D&§º qûX—ž±0!¨¸£8*«ŽXáµ Úg¦Ä(ÙÉÙ„>MV±unðÆô¾e—B"ÔΪÊlzÑY³,ìp¢C!ëfâ\ƒèÀ80wiÄÙ\úú·‰.‡š ”ƒ€´žNnOÜ*»1`ºwÑÉÞuGfÈß´ê³1;ùÛ‚âÿѼ‘8˜ÑÞ8>÷;š–@F£™óhÓ³þðui`$(c( ¢ †À‰@mÑ`µ£ééªæ.3} Ó°iÀ6Þ)0X\ qÔàŠ–+RÔ Óo‚ ]‹8ðZ‡°, náÁÎ]¿ñ't¾ç?6D‘ã=%{w ¯Z‘‘ER A)€F8‚àBr'óî ¤€Nq1‰KšLRò˜t°’ð¾ê׿as¬ê¬>WWœ¤MzÓ©%–Æ8•'´¡@‰SN¹žÊÁ"MÊûD´Ã„>Bt¼)LJrß¼. @â#²ÎÝ]Ცû;Å5èl}dæ¶Ç*?:ÈgÝèêM€Ä ,èÄã&#ÞhdKA[“ÎØHØëJfùïÇ1¢÷Ëž|\‡ŸtÇÂdïîG FT‰õåÞ7°üà0ý`i½y;þ'wPî­º8êösÂ2F68Ì}_¡£™4åA©6PÈêØnPÝéC^a& ±¸¥Á-¼­˜"‚~¬´ñp¨â+ûW܈\@.ÓÌ­ß)=ö3ïâ§CˆÀT.€´ˆ@¯. @Š‰"8hHFD€“zRGÈŒ:4O8 €™1ãÉ>²Ó2ÚÎÿú [Eghóz²àÚtÅ.EB˜ŠÏ#,*kRBrþ•ôo¦ºŒnÌ>v¤ûâÕm9y¦çˆÉ¡Òµÿlµ£´rZ+¢þέ˜qnGí••tÛ„,Š1‡ DDN¸L‹•7ãr€¹–í½ü;þ}ߪØxwè#ߊÛ)M„g†=Ž)¢éG Žì‰ÌüæÁù—™ýç²ÈÚþ£âÖ?xâ+ÃÊÉ#…AŽtºšÇê¾Õ[µŠ¡@ÎR 3xG“½ŒÆí!^š Ãä ˆBÎ(Ø[þâIDGÊ®b²Ó½†ìáÔÕW1_ˆÞÌÆF Ãñô¾½®X¨@>æëÝ¡û–Æ:¢Í1¾ÉIå¨÷»»7¾rMq‰- ÷HYëÐã4´nÁƒ‹*:{‘9€„oËîØB„ 8 AO9r-G³faßÞñA$0aÚæ$™¡´jAþÚD%ƒ¯ñ%‡­ª7£ˆÉCñ²[(yÕ5ŽîÍžxB p‰TBg"FQΠLŠ5eyN;1 \:›ë±`Ë6 8–·é3Ëžþ¢#Î@H>Íé˜ñ‰QÜXµs á€IᣞáVÊð 8@hÆAR°·nòFÂÃ…« ›Ï}†ìá’¯·|6ã=ÁŽsM†<‘,PƒD•¡@¸«ùþ Mf P€(O¸ý þ¦_/¿ÿü¬‘1b3ä´pɵÝydƆ{ZÂ:iiÙàþš¯“E2{viE_aÚ¤ç‘\Ñç¾/«ó…ÖŠ[^<ÒX²þ¶˜?ÏÞ¿Á­UYu%h] ˜êÈ/^ÿ¥xF%kð‘Ž%çªv úqv™@†ê¾3Üû•Úç®ø2m£‡YÉ-Dz3˜¾ â}4ÿõse»F:ú*ViÃ}·þ;ìüZ4½¬`÷ÃÕ‘ýK¾ä-¼¤·cwùëÿž‘³ÐлÒû;g}m(7ØtóÓ„-O¢rºD³®J(¶É¾i •|rtÛ•¥-GöÔåGÝÞœæ{ëÔøáEWÇ=•B<;ë…Û»k>9RzvÎÆßÎ\?²'|Cá¢/GŽÜŸ¿ó7‘åŸ?X¿§vß7çuש0äïXö³¸ƒ˜u3‘ Ì?²àÆyëïÎ/˜ÛQ˜ŸvðWeýJã¹?ó˜çûOïÙôÑ`ßn*ÍÉ Lnzy—øÎn[×ZQóU8Zž¯})Þ2ÿ3Qל˜íOÕkþ³»¨n¼pVÞþ_‘‘­;lWV6Öͨnx²0½¢sÆÂC‹®©ßðHýs;¢âh^xÇPÀ]fuLr°cέi¯Þ^¾«öÀ’K…åCùAï¸ãŽwr߸/uBÓHrÛÇÂ3Óai6ü±´ÉbäãöPO¼ô“ÃéÞT‚7Ó •Ã>æLøCÅÞ¶µjéWÚËJœ\áÁTd¦BÑ&r<¥’ É(@¸½t×¥Œÿl^pVÒO¦›ç[+×ý—‡Þ¸û¼+„.b)'o²MH~Ч\'ÜlD@2ÔÄÏÍ”Xº9‰ €*Ì8bPSyôå”Ç.ùDà@ ȉJ’ù' JêþÉÜÿ€b–037¥H è @NYæŸæ[h\$4ÙI=l0\ÝÏé;zΗÔÓ°ìõ‰¦¦ã óÕÿ€Ie€“c­¥nc)N˜ôä„€’"©9(Ô,dl¹Âß5þ,üC|¦l¨õŒR^ó$ž`§z˜r ˜,ƒ‚‚=$q É“sS„MMå»ÐŽOIªNIºj^dØ”°zªº9¨©;Tþ9œ¢a'~b´³Ô)Lѧáh ‘ê¡HïžÚC‚©žLeÊËNíhS^Á€TT‘\Á’9³p’€ZÚ¼Îùàt-{=•7p²ØüT¢MðÆy“„J™©Ã—£©ô?nÐSDã©éÖe]€Yœ:™EËWËnád'øôŽ«Ã"h°oÖ׈£úDA"™½³þs+“['Tc™617NIÏ?ÍÅ¿™ò÷IÕ[N¾gškxÒ·xÜkžêõOîÉ)‡ãê×Lߎùèîr!YRòtç“ÞtÞ8ÙߦA<%'੹ÂRß–·ðÞAÜáü‹¦“IÏxþ…–Œ½‹åŽH°§¡Å‚+šðŸÖT?¡hìDDóÄ¿é”Öñ¦dþÿ«{%B÷SáÉgn`¦ÌØw[µÕ‚Kƒ[ø[¬G˜8˜šsd§tÈ_-þ0Qb-êÛãõ£)þ”×DýDšctŸo°Z:Ï‚Kƒ[8¥µ;m­Sj›Ervÿ¨|ÏÁÉ¢é+-©¸> ` ©²gAP(€‚jOþŽ_¹iÑhö\»1§º#,X°`ip É…‘õ³×Ü7Vñ5cô©ÌþcÓj>ÓU2W‘»ácAò™nÇsY +oÊØû4¸uϹË@Ї²öÞ›Û¶—Îíe]ó¾0˜[‰#눟Ž?”=JZÿ?gëîõ²—«›¶ 91û©/gU9vD+¾ÞU\+Ax³jÇ3ÝK¾{®v×Sýg­îÌ•P•G«þ­7«Ö»çÛ9]ÃÖXY°`yQ,œ¬ÂP³EzóöþŽg_uhÕZKŠsv|'«· ©Þï;öHZ´¦qÑ Q;Ú"íŽhÉÝ}GIÇHwýmMËîè*H+ûËçó»Ã €’Í8pŸâ¹¨iÑ¿‡]ªér„úÔ’Ïu–” Èo]ò­Î™—$$ÌèØH˜B€H¸7+›ðø™-3’>S• pJF(»NSZž ,Ü´n””kBIJ—ô–ÖuÖGÇ:¶zö÷åHŒBßÒOE€ž–CMmM]‹=P8¸ˆJ<Ýo=Ý•w 2WFgÝe:è-œqWfÌíA`Ñ@è+“»}·CMDd£Þ®Ñœ¯Ä$€Ü7æ¸.ÞÁ~© ,Ü÷Ö¥&₸Ý猙$̱ b;ñv%Þ©ˆô¸Û›šhÜW!'Zí*¡«®y:9ÑÖŸt`Èÿð8=ZÐÓDH‘ƒéƒt4§:2È y0OXI,X°4¸…w¨Ã©s"Z™¤œ%5¯äIÙ“&1r AH&®q¤4ÊQêú+³UÍÈØó¤DÑÞúœâ©  ,‹Û‚Kƒ[x´¾”–+zB“©Ài4«!§q¡†aÚï€TÒFú4Y ÀiB¤8DÀ`á¹zü•œ¶¶ì®£á‚ËâN!€˜Y¢Äd.Ó,ùiŽY°`ÁÒàÿâ8!þöm À d¸Á?Ü;žV&á8-j–RÐ<¥aW,»ýÈvúÌŽÆhÞ…º¤§îœüQ2æY Ï?ÐkÏÙþÝ´XfoõB3q‰uy»vÙÔÔ9L;€ I ;€AÜÊWgÁÂûbÆY$8C@¢î´êç?ÎûpzVôTÑC²®¦Ós¢…d¢wTvÏþtùÎ;ô<·1çp·šÿñc5óÀh”´°¤Ld¨cT KTCª·^‡;<ü©ÎÚO¶ÏXàm­_‘ó—Õ±ªÿuhdt´=Y·å=í9V$)ÛJ·ÿÒ‰Iñ~YMÌùãe è`ÍçÚkÏç–nÁ‚¥Á-L‚ñükZŠeÏh?PO<½L³9€‹¾¹wñ¼dšPôµ/ý]ƒ $RôÑÅÎP°gÅü%œˆ‚–e¿ R~Òð¦Ýóï¤4—`Y—î½´Ô¦ê-0€å-a|CÏŒÅ`ƒxáG|KÕtWe×¼¯J:…ª·„›Ç…,3Ü‚Kƒ[˜âIî-w—™ŸÍÔ&jú|S¥P‰eÎÀL'5 y¿é¤FW4kÞäáxâLæ&[G[<³>\g “Œ×ï¹ËàÂ,ÒÀ]Eãî"óç–ÉN?¹“©:–ú¶`ÁÒà–ÚFÁ¨'œƒ©^ñø¼ÏbÊYöÉ,Wy §xbð¤{¦úi&÷w¼<öRæ€÷ØÊ/›RR`êϧu–XºÛ‚Kƒ[H*V öμ:Lïsªo³q&©ÃÔ6£ùüOe“½ , ná]kT!@©i[RlJ É÷õqªùÌY ÓRß,XÜÂ{ÄDØõ‰¥2ßÏÇAª âq-X°`ip ïÎ(>©ÄåûkƒOWIÒRß,œ°NôX°`Á‚¥Á-X°`Á‚¥Á-X°`Á‚¥Á-X°`ÁÒà,X°`ÁÒà,X°`ÁÒà,X°`ip ,X°`ip ,X°`ip ,X°`ip ,X°4¸ ,X°4¸ ,X°4¸ ,XÜ‚ ,XÜ‚ ,XÜ‚ ,XÜ‚ , nÁ‚ , nÁ‚ , nÁ‚ –·`Á‚ –·`Á‚ ¤w~+€[Dû!€ ¸Ey 'ó†)‘¦` ‹"g08ñžFð]hp¿ œNp)¯|pˆ3ðÙÀFÁíZ”·0 •Ûv^Тș ™¾—¢xgš\CD´8åƒ4³8$ð)ÐKF-œÀv |2 '€ ‹=Îl @ÀNù]+Øwjƒ€Ð<Šå9ÿap¨ ÀœXÓhI¨…ãÀ8ù¡>^; QÝb3W‚Ky÷?|ç·‰€D-j€v" €D¬Õ…Í6“%LÁ´ØãŒE ïi-‹úŒQå,X°`ip ,X°4ø{µ#S{§B|€†¥˜Åt_@ü`»õòâðr"EÛéÇ͘#¢zld´¯O×âûK|DFh´óèøp„HB"" ¦…{ÅTN§Soˆ(ç(¡lÁ?hî}woHXl°s¨«‡#€ÙS! >Ò1:<"NÑuDBÙžü”¼Ël€s$€\‹ vvµŒt·Žs”.’ø{Ì>L u 3.`ZVáj¨¿u|4Nþ…ôÖàâT3ùN¼Ž1Öºñž»¢”œ¸+ùÿ)í‚)ÍNûç Ÿ¾†×}ꉟý,nœ<‡  ¨û×þà¢WžÙ'9@€8Õ‹º?ocº½¦ôÛÿäë(÷l_Û²0uÖÊŸü£“_vêjÚGœ’òHCO>õ­+ì#N>·€ ì¹ïÉ|£·?Œä$âÿ•¡?UßOÁRúèºn»øÅ_ÝÖ=MFÓ²DÏ›?¾dokÜ&›ÓÝ ¿B *$¶ë7žz Aœžf °ÙF÷Üÿ姿qá[{ì\ uCÏS·®~âq$x2cšC‚$rdÓý÷„8É1E!€}hëkw~ô™Û¯xñ_Xû£kŸþΕ«ï¼½/Ž²9¦ÉE͉|2íƒÄ)˜!Ú¹öÓ«ïþ¿H ðÄÓB HÚÑ—pÞKOîW¼ïŽONñ\q:¯¦Þ!¤¿‰]˜Æ8R‰r]å•©$ Á8Ó8c %…Rb*ÚwàØŽmŸø‚“s(N8æDÎtÆ !P‰JÎ83€È$ÉyŒé:R…$B0®ë\$”J²Ù+¦'*†¦  TQ@h"û²—?}.‚À •3D¢’B$ ®»« ô¨@œšà¥’‚©f†D1;‚3Ã"B3›—dJ©Éýø~ê2C3ˆdG¡3C¤DV&Ÿ#834ΉÊ2€ „6Úxk"8?·¢Ö&SDMñ4ͦkœ DB$*”¦ÂNü“iÜ`€ˆD¦Bn0&¨,q]xºÐ„žsë­÷ß Bp&cºÎU(Erë-}® IDATî²Û>½€c‚˜l`‘P™’t0ƒqA¨œ\es‚Ê à”ÁBB$…ÀôÄG*ÙÒˆz´yí™×]KL¯U„L1¹'XQ’ ¡ˆ€ÂèØòj¯&ˆ8c?e‡73ÐqÿgŽÌz±ØŒ Hd;%ò„Gqê R‰ .@@´÷PÛÎm%W^ïVœD’&ü²CÝö³›{|¿â×ßÌt'jxaíÝ?ÙrOÎGnû,†Á)•L¢Î3È„ N"ÉhŽ S N$YbZ‚ T¡ ¼e×ý¹ ¸\ 7´ !E!tûÌ«~u$ÆÄĸsnŠ¿bòòñ\*¸¡sA%¦Mo2­SHÉû,¤§¯B ;öüF‘[”7ÞÛ¬†G [AÙ’‹/ #Ö¨mϦpÌÁdYQýªŒlO¼ñ† k o~é¡ì²Å¥3«§&y=ÒÖ¶ýµ‘Ñ0rœy…óVeåå¨ÃÇ·lÌžweN¾_p`áÖý¯¯ñÍüdeŸ%½{_élíB„ iËŠ«gÛeµeÃoF•KJÒuµ÷ªáÌ«/_°Ø&‘ðÁwæÎ>÷"‡ÂÆÛwµîÙK$öÌYçTUÚõη^~’ä\={I!K$_ïh:£éU+KjgÉ1Ò¼ÿõ¿xf\SZ™Bí=¶y”AqU©>r¤uç«£!'®¼¢…iïg˜¶’oÞýÒ+þÊÓ±·ÆFÇ4ùJ––Κ-QŠ<Òp}ב&&¨@G°úœÒÚJ4â;k;²Ÿ Žzåå.¦(”Ælhk:Ì8€žü¹Åu ]ÛÀ®ûš‡êW\¶„k€Èzw?Ò>2{Ù%ó…Î#Í­;7„" d:z‹‹ç­Ê̆»v75ôä†:Z45a0)gî%ùå9dxǶW·ç/úxnŸ'Fº÷¿ÖÛ̞֮9«lÑ9ine´mccÃ`ÕŠKü‡1Òrlçë#£1‚ ùŠ çøQˆhû+„+—_•ãØêm;£³.¼ÉçŠZ×Þ|DrÆSšZTä×l‰A. ²SVä ÓJY‘@ècý 3¯ùæ’KëP@láÒÆC”R…ÄÇ‚¹aöÙs‘Cv~ çÇßjß»³ Î!Ûœ”® ݸ&¸âÇ+®\L)”Un{µ)œàDRdÅNŽÐæ<ª.û¯Í©qs€’çS?¹¿½ïÆÚ² RE¶Ù‰¹Õ)ˆ]±;ᮃ‘}öŸËËM…âÚMãFç)G*N¿¯‹²§ü¬«ŽpúÐîÁlE~¤oõ·žºý›_ؘp•×®<Ûi3½cÓSLƒœ³.W:×<÷­›×þþ]=ñ¼ù+²ó2Xƒd¥ƒLö¥û²y¢1O½/t÷zg.r¡ÆWÅùŸ­ª«%Ü0×\èíЂ%E‚¡r5™«0| (Á¤‡õ8"Ä–]8waÿ Ÿì[ÿ½õ¥­†§tÆÒù2¥¦oÿý2³„ðç×K tPQ$›Ì Zë@G"sþr»Z\pÉ—™S á̓!@¦sι¡ë*P:}àô¢Ó `@Öù×ùb‡_ûáÇžûÕïŽ6 dÔ-+¬(¡§f b ,]Ôò§/=ùýÛw¼ºËά]q–CÎuÃ>#¿0[è‚é‚82ýNŒ†»Tƒ˜SW ÑŒŠr¢Bb\Ø .^zÃgü’Á…’¤·ïëP‚¹™yn5*Ô(Ø ±Ž¾1:Ýy5Bô—/rk^úÞ /þî¾cÃÁ9Ë‹«Š™NqjÖÿŒskjKŽ¼zïxH›œ¥(ô6ubzqF¦[ =’·4{†™®qÀ C34ð´ÞCä­ü\†¶kÿºçc¤BKxx ýEiù™<j l ƒ6iÒ à†!@0UgÌŒ"J*7nW釖Þü‹ þý‡õç]æ4º<÷½õ¿ýôú§7¡óü©ii /βë»~{Í?ºóÀ®fwÉÜŠ¹µŠ ˜p”ùÔ¨Ðã`ϨñÊŒsv¦ÆûŽôúg/q$¢‚ÓàŒý{iYI.ÛEb|dxÀÈ,ÉG†Êµ Ö,gãGÇ"œfÇRpé…ËVt=ý…ÇnÿÖö—wò@õÌe dï«žîÐœ£R Js#Ã0tIQä~Q‰L›`xDP{·?û©ú»®¯ÿ¿kkžøÕÃŒÊùç}ÿâÏ~Ñaô5ÿùö?Ü´ôµ7°”ƒSŸ\oÍM—~íÇ9YΡýϼ|ûy}÷ûC1sìAjZ"’DhŒ§Ë\34.ÙdsÇ ©âäIkJpUÓ©$II D‘œˆ1M;Õæ•`ŒÖÝúÈEW_!Å;Ÿû~á‚M¯íàÂt­¾“»@"O¸´’dåQU—퉛³€,ÉQ]Ÿìˆì‚ƒ¿»õ×××ÿæƹ¿½ùŠýÛ›hÞ…—ÿïãU¹á£ëÖßyÙÃ_ÿJ[ÇœDû)\㫼â§çÜð19Özð©¯>pãÊ7_Û)$@àBvKD2ÙJ’`\"M¼-W5F©BÌ MD™Ê¨©ÚtÎÄÓÝr³¥•Í½ôÃ[Ÿîk¦bò*¡6Injg´Ûa°„à“ò5…¥Ì(lDŠ6wFZÁ¬¢EW,¹õ—ûù ¥qìÍßvv¥ÓÑëÌQsÑW/\\§÷ïÙqï§úÊÇö7´ ³’K& ÌA&2¡š¦ñÔN2 ˆkÊ6IHe‡$ã‰3 .S‰¦FAr€P ŸrH©¾áÞ ¯»ZŠ´zæk~ê¼-oî}»•Ú¿‚ezµ‚’ÍîІ"†„GF$¦JAÅI¦Ì²¿zñîÕ‚à²+GÙ–½àú¼…×'"‘Ñ}¿~ñžÛ³fžqË̽ýäÔgÞ¤$Œ(·”œuK<46¸ë'/?ú쪧өŒ‰aUWÍèÁÔ¸Š6ÙA©jÊ4Jv%‹$HÒÃÄOp”MJs°ù<²ÑÖT@'pÐGc êñØOšÜÉõ=GB@0fË®[øo?á 5ÜìÀ³ßÜñä¯|Ù‘´¬N ‚ð-Xð‘üù¡ï5WÿVV(p ·ÌôcÎbZ‚»\öãlˆäñ’Ó]…s°e̹¶r׎†-*“ÄCÅîáz—š¢ Æx(NŠé”Õ.N„Ù!RP÷´÷dÍ>×%¶ì¥WÔïûɶøøH! R‹S‚Â`B¨¾ò[5W@t ùКŸì}ü®ÌŸØQIà“€#0-¬i.Kâ\KúÝn‹ 4P "Ü1)£²Ã®hZBKÍ:‚ÇGºm6 ›ƒ‚s®É1\ ’Ö-…+oQCcÝ›ú—ßß‘;çù;²ÓÚ!ö¾ÚàÓnpÅ—?ƒµïíï8¦3©Ñ‘¦ cRF {¦LLºªñÔ¬¬Ï1/·z~FAQÛö?õ‹ÖÆÞD\Gê Î>Ï‹‰XB¥²]ÂX,4`0àF|èè-! %‘cëîoܵ?:gœº²+ƒù¥z<Â*b|]û±¨àLhêl·x&wr ŽŒŠªèŽ—ûG†™žP‡lþÙuk{"6DÄ––W•9Ôt 4c†Á£]»þ,¬ÌñØ=…Øx7cL°ÄXçÑáÞ0•í"rpÇã÷Œ©QØÒÅsÝv-ªò÷5L ᄜР£T’?3·oý걜%ú;»; /Ëð@èj\‹kÎܪÜórgÔçTÕøÒ”žMì|uSt,¦kÜ™Už™_jˆ3P|1~4<>Ü<Ú3 ¸ÆøÁ}ÏÞÓytPMhDñdͽÀÍ#1U%T‘ØѶÆæD,ÁôD¤gÿXBògTØ$söäÔ^’‘«ô½µ1œÐ3F>øàM+Èv‰C‡¢Eµì:Ô¬L0cdÿš‘U^08Èn?¨c‰è bc-»Û$EBÐúö¼px˛ᑘa =­ £|$Ft<64ÖÛ–Pù4ç·&V,ä,øDÅ ±õ®Ÿ'~Î È­›IÇ»»Ž5 éÚxû®á-*ÈEÀ7âš ŒŸënlù•çÝÙõTÇ`Ñ›WMÂ}ö«ÌLÙ÷âñdä×+ U' ]4ÏG bƒøÞß¿þû;¶ìŒÇ£º7´¨=¼~’žïNK'²]†ñHhœ3ÎŒÈXÇÞh˜S‰Ž|aós/…Ç#‰¸¦¤ kdf†€¨·¶h2˜Á >rä͘RSœ3d2ö¼ÙÕã[þÜ7æLSG­ÿß+_~é &Ìbt¤¥g¦4Œ†"ÌÐõXÏîWùó>;±¹DøH8nÎb#Ý£=Ý„Šø¡·žø]ϨӈͬZâ’"‘8'ø/iƒ  Œ¨ÓxŠˆ$¢\f\P3{ßáÑŸWDXd´³µtÕM…5EBG Æ-=³íw–Ï^U³x‘YwF Ô¦ ØóÌw; Š)ÄàyÞU¥ùYiaYnˆ{õþ¹6Ehc ˜®ª eu¸ñ•_ôî/Qìv'U/”)7„¿ºÿ/¿PìÑžC#á´ê¯±0=¢ÆâœA΢WûþÆß/3'h„»£JÍüUrÑ#jtœªR_ÑE_é}âíÿÈë÷꡶‘¡ªú]o×ÀðÍ­š]¿gσ;Å»DY¢ƒyÝz"Žr–Þ½~óƒA$<2pÄ=ûÊÂt'ãÿ¨a3Ð…®FÇu¥®z›éæ!ŠD…Þ³å×ã3.'W‡Ç† —_©HV{Cæ›?{ãŸçeû¸:ãºO$r´}KDZƴœ|‚<1ÐàZ|}QNº~LE?¶n_h/°øÈÑ·<3?R4{ŽmU£!Ã`({*/ºeÛóO­»ï€ÇÉÇ;]uç¬ìjŽ©ñ(‹Ålõÿ¾xyßÁWi®–DdøØ‘ÂU7å|ˆ£èœÂÀ¯ür¼¥’ªžÐ[F l„Ž½ñ\Ï¡u§“ë‘ÐPoñòÏûÝ0´îþ—^~sÞgžšYæäS­q®%"á‰ãຒ¾èÊÏ÷ýðó­#Át\[Í V¶ïé—cJ%TÇ»ùë¯/ÌÏáÄÈÉÏÛµ÷éM9«W^—å`§™ñ–<€ƒÜˆ‡uMKNVüåçÕÎ|å͵G•E* xŠ—Õ-ÚÞ¼ñWÑÖ2ÆGŽ5/¿©|~WÁ™^ê¶ýiÇÃ?)˜õ¡ùg/€ÀbüÐwÏ ßÙðú#Jv¦GûÆ™s?rKV&ˆñ™…žCk92C’x| …Û¨nè„HcûØØ¿Õëõ #<>ЙµøŸßn€W¾¶ÿ±ími"ÖÓ{è`ñ‡ÿ;(#ç‚i57TÈ>ë˵G¿½þ·ßÎÊM×ÇÚc¾%‹. Ø©ÅÆYBGOaù·¯~rçÓÝ.·KµŽÕ̾î™BNÍÝ÷mzØ••á>V‹qÁQr&º6mýSk03‘Gûû¬ØO .ÎèhBzÇw¼“û4ã0’sƒ ”]žœš¬‚RY"BJNwN]VQ™l÷fV-òye¤hó ][½h‰ç¨x Òó²ìv›'»Ì ¦ "!ˆ7wîÙ~Ÿ ”Øœné9³/¼Öë”PvJjÜ.‚ìòòåW³23Jf:Ý®´²¥™¹$Bv8]™eå˯Ë/-”@mÛöȸýÆó®››sdVVžsiY¶à‚*noþœ`nìæV/ò89Qž¼ºêsoÈÊösNlþœÜʹ¾4·ì)έ¨’©FÅ3»æâ[òs}Œ Îå@Å\Ÿß6onAý%e…Þœ O°¤ ~…ÇÆP–l._°ê¼Yg_ì°)ð7ŸàÒí†Æ¡äd`î. ”ìþ‚œŠ9ŸÛ é¶ùò2‹ë\—=P‘?£VÆ8Ql¾âE³.º);]f\ ±»³Š=^›Í›,¨”eš:•„¾Ò…ùåÅ Éár¤/¹¾´¦–PüåYe…Q‡?³æÂÂêڌª`n&‘3rç,s»‘d›Ë“Vuáìó¯tÛ16¸¿¹a´þš›½6MH¶@åªÚs¯ô»(çŠ#Xš]>Ëé´;3fä”ËÔ\éy o¬[±”2F‡?·,«¨”{ÆÌ'†âÉÊ_tuÍ¢å%€HìÙ•3™*ûÊVÍœ?Û‘VšU23P\—UT@ “NGznÑâë+fU£’Ç;ºû϶ÙÏN—DÊm-ÈîŒÂ¬²™¦[U0‚YÙÁôÊ¥yeµNeLV-Í80ÅÈž}IÍÒsìvÊ…,©p¥ûÞŒô¼ »þcõ7à³AŽZGÁà¦ÅŒ @"»Ó‚¥³¼iiæv+JŠ?+ßWP_½(˜™²3P±0ð rÅ•ž·èÚÚç8P0Ž6_Ž?/Ça—ÝY•é™A3™ €àÜ–1sE^i‰M¡6·Çé ¦—-uÑÍÅ•%`bóŠgºì)uÊJ–]›‘ž_,¯+œY'Øì_fÞÜ+ª-·;@k_³ïPàüÏ}^J Ù—¿øÚY‹D”¾´üº@N®ä æÕ.õ: T¾Âù3Ͻ6ô Aí¾ÌœÊyÞ4·=­"·´Œ¢.ÙìîÜ93/º977éàÌ®Ì,* "!Ù=ÁŠeEu‹ùeÜj Ì=Ëmç(I6—/8ãÂÙç|Ø.áir¤‡ TÀc{/ˬw´ «°¹ZFA¡“>R”$0´T Š²º–<èDdH]f€"• †!&½BÀÔŸàps?Ž yÚ˼Hd ˜!‘P 4I{nç Aè_]Ú&n»ù»ó¨¹ÙÜ%”ºb²Mó‡Œ @”†.P R²ef€`Ì؃‰þ à˜®Cfˆ© &;/&^뽫Π<ædÃs“éƒÍnÈ p“€(É&…鸤R2Þ›ÀyªïÍëL.ÄåÅñïËp–ôó (À „€®&…HÇ –9üÄ«Z¿âßPX˜òôToStNŽ&ÇÑì˜$ÓsˆDsËä8ΙÒIÁ€qdóE€HSØÀnŠrhã3ÿsߢï>”ã@‘Ú­2ÍpÉL©ÜB¤ \K¹Géñ}H¥UBIÉ®þcýà‡/ÌË×™+bÂ=O@Œ¥R–¤( t}úœÈ0f’B0S̽"Lžá›7ÁSš”ê$Ë%…TÁ€11Ár“”T ºé³|Ìþ‰ŸýÒkO6Åt @ ‘€ž ¤$ÉH‚ 1UH 9NHÍ¿H䤡É8®Á©LËt˜Èéò_IQ„U@Žçó¢˜æ:ƒdØ0ÐØäþÓƒÉ8DqÊuó>azë…LCvܦ¨¹I! m’À\Oä†àžà‡‚ !CMmFš’úÿÛ»Ó0©ªkoàkí3ÕØsWÏ4ÐÐ@M3 Ø *(*¢ÇÄûDsCÌ`b®‰&¹IÈM¼qH4Q“\}ƒšÄ¨ˆHЈ(ó<Ï =ÑcUaïõ~¨ªžh×ïƒO4Õ5œ:ç_ûì³ÏZ¹ºv­Àsº®FGð:Ÿ™”D%»­:H~dêö¹³@ˆ <§çE‚a%5ðK&iê<§ó_I’'{¬'@GC IDATÄnÿ=9ðH=’¤:ÿ$Q:H¹¨ÜŽÕ »|)ݾ¬ä”))RJº@ :·-u{·]¾µä Q÷IºÐ1=©·ÒãMbr $îÛ×uÎ7~ð'w;7O̤.GJdçž@Ç¿‡dØ+rã]ö:ífQ’0µ3tì¶ ë»;˺I·çᙈë^ÏdP(¯Ç²…Du0 žìº”0ùZ$ÁëÞN (¥Qò¸³‘Iâ«ìØ:©ä³a·ƒ´ëþÐí£)—T—WT»™J|ÑÝkèÛÍ1>d‚cç)ý /®·oŸè’›ðøÇŸèyN²œ‹@Ëì?Á¡ÜĮֱ_ö|pç[íõÙz-_ˆ½^@ìò„½_1ûˆ¯Maë¿öVÖí„[{ù““l<ÉB:#”_0h„e™©e¤øA;Ɖ>Kï›°—ÝíožˆÐH gw‰íŽ#{ùxÝÞmç.y¢ý OÏ儽íoOº1Oø]tnèý’ðq[µû³uÿ‰H¢–>¼t˜¥õö€ãÒ“òÇïHôÑz=pû¶?‹r:"R€¦€S€¢¯·žêu¥cdt|}¶.' Í€®ãä{N uÎK¤†ù 44,pã $¡Àó¥;æz¿ { Ó—]>B/?DÉkÂÿþT×é1‹ÒyÎúíÎR?yt’ |ɉ”DŠÐ– v´O,È# ¢S{hã{m-1D()ˆ¤‘]QR^Ñq'`òÆ=èmœ Ôt`ù-^NqeµÛvhÇf×(8rxý¦Š¬1¹…‘3§W"ªXýŽ÷MÞ0­i@’(™Åã¦û:Òý¤Ù‰h×®[RŒ"C«3ÃÑ}«WFmQ0ü\UÿV‹×¿ ¬\îýÁqYÂœàŸ%„€D PĶ.{ò'ס•ejN¬µ}%#¯ûñðAéž×1EÐu®».WèzZXÐåœ8yu5ðj/aËÔ›&§gÊëxXò…ûßùí†ÚÏ™\†nÏó÷î=½:ªÀQ׃¹Ë^—w„ˆÂ©Ûÿî ûöÔ M··k,ËDé:U× ®èè#€„=j$ªêxpÁ·–þs{ tNFndßÿ½s˱̑Ÿ+R´sɓ樼HI¼^·I&Î6Åk7-Ý´b%¡äÆ[Ž/Ãç3AÚ‘S5ÕojßHòûÀ_ lzïé%ÏþI†'L*Ù´üáo¬ î7©õ½§wÆ.Žô/×E×I<ê~á“}‚¿ÚgÔ<øç« Á ©5ó¯Y}$sú—¾É1€b5«~óõÍ{ÃsñçB?èA@âÑDwD4à $D[j ‚i Hìv’’Ðá0D›A€aI°ÛÀó‚ˆ ðH…ˆ„0ƒ`Z œ8q€(Z|J™ 44ƒ ^ âQ€šýˆ6“Ršþ ÄÛÀu¢Ðý`ùÈ»´rœsóèéçú´–E·ž¿»QǦ矽éo ¤”zócW>žuÞew|iÝïï6FÞ3®ºJèضñÙ—ÿô‡Æv*˜pÝY]ôk©+y}.‘„neêVr®B 3ÝÎÕLxô¥'ïýÕÀ ðÖÿàXøÒ©W\—æo]÷ÔýW­õ„?wÔUç^U`lþÞŒe»”†´ð®™$í8½rÇoD¦Üø°\w÷ÎèìéW\mùQY¶hþ/¬ —7qÞ-‘HôÕÖ‡ Þ}í¬ €@šý Òj·¿¾kãvÛ¶\"²² CééÉ»”bm^G!*7ÞêºJwjÞüùmk·´—Ÿÿ•±}Á¬{ýµŸÝsø˜>T±ƒËúF[É53oûQqp÷Òßþ°¡¡@Æíh»" Ýš¥¿¸iýÎæ²s¿7 Þ±Ù¨[›ÙdóOM»µißÛ œ´ CÇŽ[–ÿð‚÷Ö7—_xëØóç:[Ÿ\ü»‡›ëTáœï•,ÑÃ…—ÝÖ羜2Bc®›~í‘\͵¹¶:Ø;^xæ;w7‡FŽºð‹Îê×»ÿh]S_Üh<Î>…q¸•7þ°õñï¼ûÄmV(#\XQ4bjÑàòôÜb­ç2÷ÔÁ-D¬öpKcC¿Ë7µ†L¾èÀÖBEÒ/þѬ9£òòôºÜ¿ïÐÑÜÜôäï¼a4­ùÓ¾úŒYß|¤8OSDy%lÝ·/f{©ŽæÎá7Ýœ1û†ïçåš–æ7=÷»?×Ì™kö¾0u½»*cÒÓæÍ!0í·VǪ¸“Ÿˆ ¦òòλ¥zÆP;ný¡AsÔÿœ Òuý’ {dùÖõÎÔiyUçe~êe–•ÏœA{CÛ^.£âܲAzKÝÎÄöÔ¸}Õ¢×#³›ýåqä@éàÁËÿòrñ¦`^î8#  †‹Ë§ÝüEÝjÛ›5õ³‡Í,*ò“€ü°zí¯K›J†N-XõÂþ§tú”"­õÐk¿ý'–«°£u‰ë)ÂæWWå·]r×L ñÉÕïþßÿÖÕ7æåfðÁÉ ÎNš]‰µ(ŠÈ?tú= †¬ùÛ¾MkZv-üñêçý峿R5c–Õû*3«´pø¨m¯üâÚꬂþ™…ƒ +Ç&¨:)En¿Ò"» $ú¥§k5µ-MWD¬n÷A=`Ør혀ÅSo+ÕAÅ“5ßIz5»êÒKÆ[!pm¢8G^rî¨=ÖÒ¯÷'é@ÉÔ w.ùýâ?È((Ë2Ö Õ.5NͲ˜™‘¼B» ¤GzVeÑ€ØîET PhÍûK·HIÇVD =Ïr\P®ëºzêwM´5Œ¶8Å“ÆQ+Å]:çâûÎq£ åxQ0¥Ipã¤ú—”ÇlúÛ‘Õ.jºsp“‚ÈURJ %mp5[g»$Š¢êHížúÜË&™qˆÙ„þÓîøeƒëÏ„s‚³“Ÿ)'+<è&H"£/)w‰ÝÒÖÞ|´vÙ£ÿxþ‡¼ÊQCE/™§†ò*æÜ“±ñ­š}»öíY¶áXkî˜+ªf_š.€4Czj劦éÊu½.¯éºžÔ4#±êCI• •ýÉu\Ô4]h AaÀÔ\ÛñNtHË8äÍüöôÜ7n_hõÚ͵õÁAL¾ôª`ÀwŠÑ‰BGMáÇ–w{}ÁâìÊ™yE†eÆL½SŠ4åÙRš¦™(J‚ÓžZ!CuÎœ8G3Œh¢³çÕ7ÿð¸›9a@Å+DŸ_tÿ•„äÝîÇoµ¸ãê¦%幑ȉ♳(“œ}œƒpDî±Ý»6®HuM^Ùq=*åΘ¾ü+š쥊¢În @I03KLù|¿‰v¼õHý–W—-x*³t䈽hÜu€€ÔnÇ!´:çQ1 úìým€„Š"(ÇŽÇ!_*LÍPšã¶çhDˆÂ9uƒ¡€EQ•ˆB"ä©Ä0@ Ç\’7ò"×nhÛ·hé“Ï쨜4fd¹:Å…|©þ*¦áîXüª“_=銛- ¶X¤vÉS8¡!à ›V¼¹ÖÑJLt ”ŒÇšÁL7 ”¬vF -‰À0a÷»KŽƒs¾òµ’LCóA­Üµ~õ¾SÈaZf(äÕmÓ À‹6yÂï³L>@?é‰1Þ}ì膻cõs-{öW­ CÙèO¿E[ßYáD£éƒF ¦…v¬UX`¦ýËž1Ã4Zö®\úèkš¢¾t+£¸´hèXCÆX€f`ãƾ­eA0ìÃëk±_QNG‚K©å©~wÛžöP&úƒÎî¿Þµðw¿‰º©ªšQT5üض­ÇZ¬0†²aï_Ÿ²sF²À ií{c¨L?ê~Ñ°ý͸-P&lëçwlÞRÊÖÂù‘âã‚Ù¶{‚ƨ'ß‹IW¡/ÑÝK·¿·4æù}Cœt'%Ceá¬HíÂ_¶éÊÀ¦- ^øö ûÖ¡M[ß­Ùž±3ž¦ß°‚ öm[±°Å3MËÒµ“~$Óó†oYòÈþ(¤e#µ®{ýÁϯ߼NóÞ¡<g§ÃI0y$ŠÎ¿ø–=/þò©çïú“/³4ès[êÇ›Š®üý˜‘A×"Õ[žŸÿ¦<’‰[6¾S›;q¨k;áœ"tÖ-¼NþÐÉ>#V»å(™Yúǧn[Üo`ú‘µKÍ¡×æåt¾¢ë„†\9|âŠuÍÙõ÷±¾èö†¶ð˜«nûõD i=oÊW‡oýò¢ùÿ9 ²*¾ï½Ú£µC®|2'ây£"‘Kþç¾Ê©“ÛwüíðéÏŒgKyiaýâ‡.ÙR~vN†¨ß±ªÅª; DõðRgiÀÎ{0»RrâZÅì©›~ý ~Ò 4ª§ÜоôÅÅOy¯½I`ç=«6‘ô|3>õ3?ÿísw¯ÊÉ ÔmY›}þƒ¥…šén{êæC¾õ¹®¯¯í%½ÜŽDÉiðÔFp§úš[23‚uy¡kèzŽç‰ì!“2BB%šÙzmq™W4´ÊïÓ•KVÿê’âœxs½HAÄšý*#Å¥Âsl‡²‡LÎ h¤¤ç8iÅ£Ò32ô‚±£&OPñv0sÊfß5qFµŽñ£ÛšT~ùèJP§é¾Ñ£ÃC×ßy$ PN[[Úàɹ9i‰†*‘A2s‚ÊQ3bHE¹mòT`Èù·Žœ63:Mm熡M¤•äi‚²ÛÚƒýÇD²Ó‰¤tbFVEna1† GMi”dæÿüäK®…,¢ãŠ²S<üä;<°O@o÷dvC u³³²•tÀó(Y'Q7A3¸1& '®@Ý‚D3x’àÙ¤t{~òg‹§ßùtù Ô$¸vª½†Ž¦^ ¤T€B³@פ¸iSè>ÐìÄÍŸ53ÙB:‰2ü@šŽº (€<ðÐ} ídÍÝ€DéÄ‹âqË ¶L?ȹ*q{¾BM˜>pc‰¦@š‰ÉÛAm n„„ÇV „é•zÝðÀóˆP†ˆ ƒ“öG ª¬˜ZÙíüþÅtMº–9ìÒ‰²e`Gç9›Tª›_ cœà쓆)@+€@´]¡'hÜB]êÎ*aP(pâ]ƒüB8ÙL„0|˜j€n<Ù  /…øñç8¾'8û(ˆ=+zC—&[\Í‹hQýâçÐî½þ;³ÜV‚n-ÇRÅ Ù›œš½óÇ¿Ö¾nú¼Ë-ÝsmG÷°óJXjš=Uc:õT@€ ¡W¿~Õ_Ù±qƒ'­¼1WN¼üúÌ4ß™Ù*‰±Ó¯ ìsCk$"BÐMÔ4:èè&‘kè:¢†º ÎþbÕ”2é@âM¡¡n‚nn @D ¨é tÔ =³xÂ5ƒ+‡>”5oüñ¶ÿˆ¥¡i€0@ÓCi‚D÷5…Ô@·Pˆñƒo/üÅ׶E*/ûúÄK¯5/¿üÐýum  ¾Ñƒ1ƒ³ÄxW ˆíÛµzm¨ß £uM]Ía0³sMJÏ#PÝæ—ÚõqÙ݈~#F#Å” [¯¯?°Ëõ”*Ž ž èà4ÜøfNôÛëëì¼ò©ÁœÓÊq÷.ݶj©{ÿùZN0Ým­õ—œ™•‰ˆ„äµÚ¿scFYµÛupÏÖŒ¡ŸËÉÑÆÚ@ÙEcæ}57[@适~ìà¦ÝyÕÑF^§À'88¡@#ºîí§–mËËS ÜÖƒ/mZ¶ü¬kïÌ‹¤íyýë/Q°£NŸZ<¸tÝsßÚ‹÷ßôàEn‹{tí‚÷½‚ˆß§Ç›þ¾åÝ㯹³Ÿ¿fí‹ó[|æ‡ö{VaZ~ÅÞ¿=PŸsûäþ 5;7JPG·m÷•Fv¿ö¸®Î™{ " ªcÛ.[°´úkÓB»ßZþÇ? »õ²¼l‘9ì¢iÃP7…0@´7è÷ge JÍÚð÷Ç'øgz%±P÷ù‚aOF‡]xOzÈ'ë–,~tþ® çDfT›¡L}ÿæÌóæ.H÷é-º•f ¼æ›>ãvã„óÎ55´·¾ýÄÝ–TÏà g76îtíý‘ì4ƒjö›a¼àØ/VÆ7Õü¹eìÕ_ÍÖÀ×°æÍ5+ì .ÐÉ–Æo¥Éòi#æ]p÷ _DH„niܦµ«Ÿ}©¥¥%Þ掺êÛeeYÒKLºs†3öãyð¾J)•UzvVvPÍ_2>’›{ôð¾Dÿ#4rÀˆ\ÓgŠä 0b »›â£C¡á "à –7î]Ñ7P¹œ1ùýòM@ÓR•Uhº–hÅ@ ò&Îô5¬ÙSÛ¬!ÈØÑCëæ¯45Á¼œÒŠAb‚^ÅŽÙ±±aÿ¶Ö¦VÝ6ŒŽ:‰ߌq‚³dÄ‚.Àd6ú-Ÿ·c‰%!.2º.J@/ÞìRÀ²LJ®ÓV ä¹Íq”*‰‡S·—HüSI0³§ôj­}å]ðAtÇ‹Gµò‚þ# ±,%ñZˆHù\òýçæý׳“gŽ^ûÔëWm&"ðÅLÆ8ÁY—€U^,•³®'¥¡ủõV˜N3z2Ñg%ÑÕÜu -UèéÓ6H€†¯dä,Øðë½ Îþ·W¥ ˜[¬‘¤Ô}é Üè±X[Ir⤴@þèKóÃníþ÷brÍ Æ8ÁYÇ7‡¢iÿ{ž†°í`cCczVä„÷¯øÓKBzSÑFÍÝD ÚêîdW¤4,ðZ´Å\ÃHKÔ³ä!8c9¾’ÙW¡ÐâGÖ¬|áÙ‚’¬c_®i4Ç©@Då9Ò“å=”ç(M•3t@ÕÈ ¯?j8³3Bиõ­CÇ2Æ]9ǯK×VRuÚ;RJ"Ð}y_±îï¯ P‘[Ü_åVŽ;øµ<èÿ¹ŠJË‘0°eók+–¾Q:÷çÃú[9åS‚oÿpù3?8¼Ü Ö#–¶ù‡UUM5ßÔÃ'8ëK™?z^:nÜ÷þ×ËuÕµýËJ!£´º$§8QU‘3xhyÊ02—žöÂá+›‘H+<ë†Ûú ÚN 2äl;”Ÿ˜Ž!Ì8Y÷!AFùe•çÔÖoYÙ.Šô·\<Ïxåâi—„$Ø€HIR@¡~“«oøîŽå¯×n[äùÓ§^6§¨_y|“±g$ÇõÁOg½Ô' ̦EøÁ g=1õ¼Òxk „aøý‰j}ÒnSd‰Ž…H^¼]Ï´tHÜÏ)׎)Âð–…Dʳ£„–a$¥'4uÝ@^¼MJ¦_× =Úþ~ç³/×ιï™H˜¤J”Ÿ»®£YaM$—:J'î¹. ç[&¨di-.õÑú€úà¬OáúàŸI¤P³¬P¢±GrÍžn…¡£¾ Ã×ù¯D„šiRíh“ÒI•1Ôt+”úWÔ}aÈsâ-­;¾òüŠ~çü47 ¤¬Ž" Ÿeø:^@hf@ëx…ÎøæYÆx…už=¥® Rª6w·Ú½ÖÎîñ'}PGµXjÖüù»ï/Û>`ö½Õ—M!›0qN×úÓ'}ŽoÆ8ÁY¢=¯²Óf}ááYÊ×&g:"‘%ãþó©³nå‚c'‡ÓÉŒq‚³ %Ú›Ùí„Éöfãsbö¤Mžƒ@tÂfŒ1Npöcbì¥yØ'ðrÐÑxN„±ÓßÑÃcœàŒ1Æ8ÁcŒq‚3Æ'8cŒ1NpÆcœàŒ1Æ ÎcŒœ1Æ'8cŒ1NpÆãgŒ1Æ ÎcŒœ1Æ8ÁcŒq‚3ÆãgŒ1Æ ÎcœàŒ1Æ8ÁcŒq‚3Æ'8cŒ1NpÆcœàŒ1Æ8ÁcŒœ1Æ'8cŒ1NpÆãgŒ1Æ ÎcŒœ1Æ'8cŒq‚3ÆãgŒ1Æ ÎcœàŒ1Æ8ÁcŒq‚3ÆãgŒ1NpÆcœàŒ1Æ8ÁcŒœ1Æ'8cŒ1NpÆcM‚#o°O oyÖû^Á{Æg›~Š#Oí"ÞhŸOT@¶äC•u# <Dà*p$o¾Í2ZO5ÁÂàlÈðÎó.Ÿ E„ ã 9ÁYÏ}#ÃaªòÁáø>N „ŒuFôÁÉOŠÀU_€€N'TG«¡gwMÜÛö­²¢"­ƒþŽ.|owÈÌ#ê*ʈ@•V°{;oÛ¿¹2¼JÚ2|Ñé!;nαU%„@Þþ©#ò,ï­Y‡ø¥)Ž‹S«%=°ÐU6ð^Ìҕɼä£ë~Ej²ƒ}*[-ñNr;U–ÔýÓ¼×k¬ üºë^‡.òy®«o‡~ {¤@¢(èî:ñÄúqÿŠŽ{{vÞ¸¤.·£'ÒÉ?[0oÓ¦ûá{Ž—FŒ¯{gY7Ãþej* R_î ¨3f癳¯)0hEˆx•¦ltÿÎ!ÆïáÃø ¾¬e,º¢²£¡'b8"hÈLjX› ²ü'O^±%ßCß _àm ›b¼èzlß"¿õ¼„I«Á.oítAIYY²ˆ’²2rvéà¨':Q±)mÔàó³äQ“FðUNÍöÐ ª:Ýø97«ÀY]ˆ;9ºýRÝötÞ¢ƒUÊù= ¤, ºz7ŧч2Œ¶ÔBe%%"įr2#M_:[Ô£@€·Ç–M×¼¿{fÃV‹÷BíÔ&M§úô¢§Z¥2 ±$U‰×žùz2ùª×Ìß:.ö1³ìô’w^ë{Ýtäò4UAQÁqnÔö ©º››ŽZæ›4zæÞ”èÉ jþ¤v–2Ñ“3c¬¹ ‚S–úÕæ©QTR—>¥‹4Uitz³¶}n\ÜWûŽ½bÌÀy[NX8˜F§·ÐíyvîÐé÷ã•„œÇPTV`ÔQ ÙÅ›žâîaFe\_ê(Rà JŠ¿5•ºÂÔ ñ+ü„äc(*+ˆD+-nd\W“Ît!c2ÀÍyÁ½6Çé·º¯—×¥A"Æ\õï8ßÚòòzêúo(VRà rŒb´:JíµšmZ´¨Ö"PÞó ÓFšn}²ž¬€‚”ýÁ‡Þ><ù‹ÑðG‹)Dà—¾Ÿ6ÈÃÖÕ+hð¨çe|¡ ™h´e×!G “%g¾Š½gù[{gO7Gÿ‘³Þ–p~¸ÐÁ*4éà‚¡¡ƒû1­lODBjµ(Rñôrð¬¨Ò소#„œÚ¾€iggke1zîÎ2 ø=µ“©×íãK‡ ìeo9}}¿>/ð¿—¶ºÀã¡€ÚæWŸ¿´Óm²‰ßo®>÷cí©==[‹X¥ƒ±û©E>‡®+* <Å ÉöÛ–]!"¥’w)ã«e=1íZ C®4R·ZaÑŠi{–ÎæI -ÊÃf5Š&›'_L"Ô3çsúÄýœÝúÚÙOYsˆBeoÕûúÙèqa#x9ù„-+!¤æKFS‡ B É?Þ½ÿZ²@± ý¤­½Ûúè¸Ïe\YÚyMy5½e :—ǧxìf½‚î>IÕRêkœ´ €è¿<¶ç—£›®¼ûxmËÁOGû‹ÉåSÀçJåãs¸P•@ÊCì ß¾ý"ü¥ÙÖr–9kØš[Ø€¼„À·Ì(hé徆¿ô+ëÏW°>ëÒo.½ü¦ŒÈZM²yfä ø™ÝWþüR¨§£“›»­ã¢è«„Rý¹‡‘í“K‘cG p± ±›G`®O÷¥§?ûŽâ››özWÆ­Ÿì \ß¿¤gÿ%€ˆÓ²÷•;Æ…t²µ›±çjú©µ£Â†ºX[m¼ø!Ü Âüúº¸»8؆LZý"„œ«»œû»{xMÝpqBˆUTÒGB8zë„Ç—ÐÌ]]»ªÓ´z1Ýz¶ö§ ^åò©ß ¢Ýq‘SK:…=< ؤ54Z¶¹ö¤øΣgulܹ׭Þ¿;Ç »3ëš’J3vvzû'N¶`yôuÎäbÝZUÄ1¦>;§ßYq¹û¹ýãJï-Û~™ššJ6Mö\µÛpK¨¶6)¾ 4>æD{àfuÝßÙÇ°e-R*3W hU9e§¬sÔ•ˆHÉÍL -± Z1h›šE7°fª×…Ðñ™Ôe±Û“/àÚâu³_9‰Þ Nææï}"†5»ù nTp«efÔ-h)Fs«>Ý•Ó¯£íÐñ£'m½`†½8ÏÒèøúÑŽ2¿v ÑL,,”e=#bNœì>huT°%²­ÕÆþ#æöbhj·Øó¶Sü‘ñ°6ÄdÛ™q«BúŒiÇZz­x›g °#ñÍœiÓdÏ<¨0aÙî ËjÎìÞ>ÀYÕ,`æ˜sÃÎb¸è„±˜áã3È׈¥Ü“CÚhŠÖŽ¤–ê wg©irUßMþÄŒ rìêa“…uó<½Ý€w0Ýzã#@‚VÓµ÷ÏfÍ1à1:Méו¬”•Ï¿)­7¸<R|êÄ–ãg "ÎÙs  ø±€Öb^H{!­›ë\}SP/n»z-É4÷_·1’óäJ_Ó…¾³÷, s¦:dž=ø¾–á±å,ŽŠfCeZ[]…°ªDÓ‘R³ÎAª%‡rxã{(¬ÛtsÖ’q‚ø”úI¸æǾ}Ñu‚£F©Ï±&Ä €`ܪm|漚”b –Ž®HìU¡Õñ«âš>­Õƒˆ8vᶂ9n߬PmZÁûWÅЫ ?b¨µPš´1lóâÛ€öãÖë¾HÐ/ŠN žeó§8t)Ì2—L :pÊâ)‹sS¢‡„ ;‘z¿;£¾Öþ3ö1ûÝ\¿yçç ­ýœºõôW}øž™´÷ÃZÍ‚Rë6|û|gQ®V}:¬N«4´èô[šÅ›øCÑÊu ·ïàå=ºVÉk¡ŽPT\Ñ¡‡ãõå)èœXÀô¶*ýêJ1aCª?=¾Ãè”Ù[ÖM²´_7îÒì?ØÖwqÐyçUGÓ׎´–X0ø1£D„¦»ç×âaíÞ¨ÙïîÞÌâÒhº:ÔçÜj°¤)/i ì>u­ò²’ÞJËF¤±ÀF…he|è¦; qÙü=ûFg[U BÒ"‚>‚¦ž&WÿD¥ÎR#@ìÔ»Kî±½š÷èÐÚmì7€ÒÉJÚZÎÍ€´r™Û»Õ)a›º›ÛÊ^õ(Çö¦ÓëU˜ù‘fÝ´ÿ¥â†UT­ÔRÐh߬Ψ¦¢ª@¸ ËŠH€h¦ªXQÉ uZBµÔ€g•2ÕPêS9i¥¥ œêAAI«ö±…íqGŒ©]“E«f<ÜJÝ]Øf³×ÉnׇÛÅÃÁ¢ƒëV_½-Ü }«fe_ $Ö—ˆyE• :­”êt÷që†ÌÝ5>~Äý|úä^-o_¨GGY»ëþûþˆ¬DÇìÀ<ãˆ!K®Ÿ‰¨7DZ`î®ý&ªÖC„cý®”w˜9aHÛæªÊ€XkS¤Ñ@d*µ¬™þ àœx_Í×¾¶vV¬/¥$÷²çÐÕt|u—ÉkU^taÏŠ-—^é;u ƒ[º„Ï_›ç»Ïã½SÀHgËTÔš¶k³á¸"„ÄÍöÙdÖ|ÅÓ“gFŸÚ2þ z×Å{§÷lÈÁ¨Ò¢×õø}¯÷Z ¿}|}KŠ´ØÚ'Ú1êîç R¯Í§Z¯Ì« ¯öõêýÏá};þ…‚K6-±vZüjX²Ä,ÂUŠŒÚ/¡QýVïQc]œ :;FŒônÙLU¡–¶@ˆb­•SÔ4šÞäa-÷nºm=³Û™r­»úÊâŠ)»¬š¡ªª,F½ÚÞ'€te†hd?êÚuVïôŠ•3¿þ(âkYœ:»“Î)§íz–ÖRio>'m‹vÔú·n„«µÑâü "~~”ß ²A+þ»Ür"ܧdªàè´P ¬Ò"¡lGÌ-Án-eîãÐÌÚ’·ïJ„ ÎcW—W±¸5ß…Æ6€¼b~—æu”ðJòæÏ_""*ÅhËì­ÿí{~mÐuñèðõR·¥IHF䦟݆Y7«OÖ¬ç0üy!÷ÂbåA+uéÿÀÞqв¶×7g±áïn"|LIÏßp`Ÿ«½E£ÊʦÔ¢¨½ÞUiÉéO«¾Z8ت^Ç@l®ç“‘öðáÇ™Ék«ò ps÷«6›øøáí“›g(‹­`*ߤÌÙ'”€ ÍÍ{Ðòª¸¤Ñ)œp_îÝp]°g¾oàì­J÷wn¼[þ×Û]g0œ4Є¾ù¢äºŒÀ¡Ø¥gÇ}ä)ˆô,ö‡•1¥kRnŸ={öìÙ³gÎÄ·28víî_ªž@ —åã{/ž·]U•ñw9•SGö®ñèkgnÜ­º¦©îsõ›øæÑñ¢7±}f*Òˆ8ç0”\ÁïÒO Ðs9wéƇ³«gÍÜ­ªÜL@•ÔmzW×ü•}챸Qq 0¼³u#ü’ÙIe ôqFÈœA϶N¦!„žµYÑwªž"€"ù¶bË=BUõö9bÐBrÿF‘Ï*  XV°wâW€eã}"O? (›¿ø*!3þ0ê\¯÷hk}N¾<9:è4 4(I»šþÊØÔ¸É&êEná³ùbB$nû•ªDx}û Í W_¥úñ3i¶Wæ®è¢FzU¯×´•mÙ÷AB9jØ}¿î=]Evy€rnÝÒïZ•?«™P£—‹SåÓ1s¯._ã%•„ѺvÙ׿§QÍò^ðFø‹Ãå(ª6SoeÀ­¬¸øU„<Û?õM…°÷ÎOÿ,{¡ý^ý‹)DšuðóÌq},¬»ZúžŽt´_VŽv O gµ®® vóöy9Ø”ñ}Cç^ê'ìIŽšÑü~Å>ŽÖE,ÕY{/tk¦(¾Õgì8’¿a ­Ë³»7Ϝج8ÚÝæ—10bÝüP[(~ÌWj9Šèb›_Θ¼í¬mgõúá@k~ìîµ-‹gZ0ß)1Àé¡þš“w˜ÝU]× Ū® ¢¡÷ô&›V­0[þŽÐTúŽI¸³CG]Axü„U]C~+—-q1l¥ <.›Ãå%àýüœann.®iúNÛ±"ÌQæò°¦šUw8L³“ól“Å«ï g4J@ªGØ™KLÓ Û´ô] ‘”SÑ©jlÚ²xäؾ[”t'­ŽŠZoè<(tý6«FPÛ^§†Í‰KW3ì¥ `Ì]¨ÞÄŽ6;p0²ŽdØtzÅ'ŸZ<{¢ßÛŸJdghwû#‰·Z*—Ź9Õ—Å®}²íØGf —€'7m1z£nÅL k˜uÛ '?[ðxùOÍÍkÏËpbodé·”±(b³jø¢=cÐX¶avßQë8‚Úµ”৫¥8Píz½tbví.«¦¡öôÛæ ó²SÐê´lGôFÓ#Á³½õôªëø¤~@¥1 MÜñÜ^½¹MÅ0¤{á¡”ªÕ®êÀbÕDƒŸbU‹8‘ª©©Ä gOo]a·ö5Ÿ¦Ôw`ø¾ @R̲Ð`ëµ Ý™[Zé ±>³n‘Ò2_ké%'Åǚ鎼Êá=zqDYô™WÃâü5­¿) ¨F_ ÿSR)„?¿\Õ·Á“x-žŒj¬ŠBüùÈкMãyE?¸O=VdÔ½ªCJ6š²š!‘Œ¢êk/NFÆÆ)#VZÃì¿(¨‰Ç¡YJñ*w¦ùç ^uþˆ ÍO;v¬ðWÔF^úAÆû_U¢;d1žì‡FÙ¦Œe½‘êDw4ï_ì>J²û(D<á0)6_fß}N=ÚwÀÔ½_‡>ÕX…”€û&+½îÍh÷Þ_T#%›¿híoŒŽÆ€ñËm¼Æ^ռȯ24LFK_à¶ñ¼¢týCS°AD6š²š!‘L¼‰G"ÛÈYóõÚíç4:MÒà °ìëÑB!V7ùõÉ„Z:6Zc“ÛÉâBBÕœ=q29á„Þ¨ý4Çj$ªµ•qÿõjMRCœ˜<Èxÿ †#¤Á2°A^²¤ÝI.gSÒöé¶V}š‹³Äï%•ø»ˆwß»G×.œ?ÿRÿÞÖö(ë¤lÛÐAÍ-IüºÊ§ð”AcüÕ`P"&n˜2WÕ!ÄÍâ̓øZÁ»{«ÖÕB~å_òêßÛ™ú« e°dÖð¿¸G¯ÖaÑìq¿ÞN )·kÿ! ¨ùYZ®(ur›âsøÿQG't†Fÿ©[½Mñ—Ç^~T´Z©Àÿ””—U²¤ÅM•:ïï 追»@èz6Á +½dY"‘1i÷ųñ)|2àÇ-APœ›ápëÚç¢J»þK]í”dŸøs¨ü®b9ÈAÿñ)üÓOMxßÊô·–™›rîFY%4LÞ°Ì_n€ÔÙ±šL÷ÇTrƒ~KÜÞ›3z=z›˜˜zè9ErzÕ„^&&ffffff¦¦&Ž~¯f!á€åUžØ2ßÁÒÄÈȨ¯whìͧ!u#“°^™ëéYØù‹/ò#ÍzyÏ Dtl“ 5ÖÒ¼‡å¸ $u>f»}:,HãI.Ñ_™·Ñ¿_)±Ò.KÞÞ#Š2cIä…¿Ò ©ÊÓ3´þI~uìž{Ï°—©™™™™™±±iÐØÏ¿V7!—Ë?¿©‘‹#9Èáw´ƒÜœ—ÏŸ?v÷¤Z3çÏŸ?þ<'÷V[ **FÓ²²²²²²ž>}–·åÈ–p¡…Q¹£õù+ñ*O·§¼-¶€ÅæŠi°os¼Ë ÏkÑQb,œ 2kýè'Eùý+|)Oš`xXâ닯qŸ ÷˲·×‡ù:[[ÙM\uŒ-î§Ï-`Zš}®à ½ryoÏêY…²¥­üÈ戤“ÿªJ^…°MÈÞ³xœ½­M_÷À3?BŽ5»XÅï`7'µœ"g59Èá¸õôµZ "€–£nËé¹—Q‘”þÂßÃÎÁß÷õë?Å>TCÏC̦-=ôg›4E ïÕŠé>>F+âçÙkSßãý†¯^“ô0=5@5ÓgÒúzI¢Ðνu³]iù½¾Ë×n¹xù)7,›&‘—Žíê¨ÇÔ@Ä ^Þ¯ºO¸Ÿšz7iwÂ,¿ÈëÅ#_S«&{o¥n°Õ”ó™äc#œ|šþš@÷c^î—²v7ú”WbËÍê¥!`ÜŽq-·¸i_c}è:Ù¾5ØO2ŽXuôãöµW e3û€‘¿Uô ÷ñ®þ¢ Ê´mažüýë;P§æní0óXWmEðš5g³þð×8ß°VŸ[¼©¿Í¨È]ª ¸qá®wÌn©ÃŠjü`;K@¤jº37Žà}Ì©¬<l@k;(´ßñë±à"”M4¹j#9ü=qƒ-ºYÍœ>K‘OW—,ß'ýáE@€fÍÕ ä[%tÕ±3{9…T 'íFÖ>°4îM·VŒÕ«V!b…®/×ÃÈ(1£ ‰\5Ùnü¢àô˜?×Þ”ã7ŒúZ¤°9Ò  Á§_ðãÎ!6ÛEgÕ+±üÙ70¬õ|eôœÖVÍ*+¯ŠÉ½x¿Eÿ@J«âV3Îe=:O³Ë>Œõðù®÷•/ÐRQ$B®U3¢—?ä·ÎËAÿØbJA½YÇ®Ýôôô\&íÓ.¹³?«BèßÓ¬wJÊ% uwSêfaÑ»nüïbãSE2HÀ#BaW‘’GÆ ììââââ6Z1çER…„hS35­/{þ¶K*Šˆ0ò{ù΋Yé³pø$ €ti†FKãÓÒÒÒÒÒ>L{™ófH[‰3Ì6v%½>&9`@ Ì"ëlVÊÚ]G8©&}@Í褊/‚@*jª4”Ô’s—äðÚnÂЈ=0úøÄÁEl„ðy3~ÄG.ÝwYè¯FjòWNò/ëÒ¯·ƒ–9fb.®:ªÐÅÎÌÛ¢²È‹iÍd2™L¦•çœ¡Í÷,8-^ "Ž]±æK즔u™h¨¨7*nºèõ0ò›3IÿcÈÜc´Ð׬MK…÷"ò?Ý;{;%¡¿ ËÒyßb·IùÔGV¢ZçGYújÏ]–¹_PîÑŒNÎ?ýW¯˜Úö )ŽByKr‹›ßÒÕÕÕâ/øV ›Sk|Au“ñþ]+Ï;. @ZÛ]¸ÍyzÒ²wOã>cø]‚ož¥„-=¶¯ Þ2ت—±Ñ…J«˜¨H•mÉÈ_:¢>ˆ€ÅÀ¹ï2vW®®æQ¢7¨ª¿agÚ›2¶´Û­€‡UÃÍLE`bâùø¬ª°kª9< F¯;LÝÙ¸æÚ'm‡åá^Í\™~>ý\Çíð ò§bUUµpK-í:•slÃz«4<ä-àA©·¥••••e“>¾3-F.\í¢E#îÄê´µ!^þýìÝ(§E+÷F‹Pfóáf̱GÞÉw¦ä ø-'1[)Ö2ŽŸúÉ›ã:ìÔ¾‘ðJ‘¸­ÄM=Dü¡áõ—â¥4áù!†§HkD71Bm{!³ÚÛÎ;l¡#e¸‘éS#¼:_ªÅÂèVb÷c£\âÈA¿a*nàv*ÃñW21‘iD†ëi#ÓDêA†‡®lì ‘J¥ÝÎ¥R˜x+,ø’}y]*ß{½….ÊLÚ°€FãË¥Xr‹›ÿ?×ÌžY¦c–|v!C®ÈAÿÅ”ä 9ü ?"9Èáÿ†¸ÉJÜáá7ü»˜×ó‡ƒ3ＧÖ-:ôVv¶o7í|¦ò)ó̺ ¼ù¥Í¥éAÃ<€ØÕ3½}}}Dà;t⼧%B/ˆþV\4Å×ÇÇàˆ¨ói cïàÖši§ÞÃÏOÇ¡?ÅÎÅT~Îð €ÐÆË;±uI¿··ÿ´EÛ¾òÅŠBà>Úêîât-‡ówn¯¿¸&dAì{‘›ÿÊÏ9¤`Q°ýþëEc IDATù×Þÿúüê_×e{¯9y…Vý{–"‡ÚFÛ™²;träcé·yq¶þ‹àAôÐÑë2ef¼8lÂÚ?‘P”ÆôÇmЧ ¿äFÜð85åÅï'ŒÚBjÙOÀª,gqÀ}äº ¾xPÜ’ÒÊÆÊt±v’_çßAŽSYVÁ⻺BÓÜïðþ}QQQQQ{fè÷q¼SÈîu½¾¸ÅÚ!°ª»ßÎÝ»·¬šž}tª›oX@jHŠžX|¯óöÁ݀┖–‹ŸÂC¯´¼€°‡x0ßhÚïˆÚ`ÿ^ß.E>ŽŸjýÑÀêí×õ[jÆ\º,Ûnü7ì BÀ¼]7»SEèªe<›SAT”ÉT¹yù®þ+ŽÍðkSRZþï\„À\W§üÆ X\VyeMƒðavIY,_4 ‘ŒÕ¼?Fˆâ–”UH\uäɶñëâžü+lðÎM¡\ þµÅ” »ù Õ—'¾C©NÍJ>|%ý‡²ü‚ôÕóg†ÏYþðsµtþoÉ“gUðêIÿôÆ‘Ëé…Pxwã£ïsn›>mÊ¢µQeü&ºÕµuÛ¶ïСCûö̽ÆO×ÃõÇ^O‹V¿,̳s§NÝzšo½˜fÒJåUQu½­Å“'\urã/üãʇÂvsÇôkצM›¶mû]µhœ œª !ñáÁ‹ªE»æf=þUæ=7„ÜÛ5så‰'Mî—0t7ï¹tÄ\Bˆ›§¤ÀGJE JÞܾt³T–mófеï]{<å«Xd>¸{nÿÌéÓf/^û´ €½3|ÚýrÑüŠ3î(@Á9n—À™ÅS¶Þ*FáØa}Þ³vÑÔ©{âîÖ¦”Ø=3"¦Ï\°2õSY2:£WNvö ÀÏgIKçÌŸuøÊózî¡‘ô³»§GÌØt0Qj|å¥ÅĦäTçl]9/<<|ýžSuÌA£Ór®œ1cÅÖ‚Z¾<¾²hVøÌ9Ëîd—×Æ(ƒŸÏ“Ìž>oÅÎb´·l~ܺU×>dœß¹ôàE(y•¼dVøôˆ¹§ne7."ž\‹™3szÄìE‰>Õ¥¼³+bzøâõ{ËøˆP˜6aqtùÇ”is–\Û¾þúº"Nn™qòæg¨þ˜ºj^Äôˆy3 „ÍÇüä +b _%Lž·IY±òâg¹”ùÛ4öŒØ;~˜$FØ—w™o>WÖצïÜ^nAC|Í—†8%<+ªŸ*ÞøøÎó›»FSÔeýš“ñúS%ªrîÆ­ºQÙeÖܹ‹o Yxü÷7ƒòËASWJ½Qé7Á¹ Öî7#0"îµj£V›!…/ïÓÑwiþ«)GÇVU5ëþKÕÂT@³ööîª),–dmZ$ðž×F×Þߢ0æB®Ì;1P@Qê—“_;Ó Á׌<й•yT`c\¦»éN(2ƒ:bÔ O‹%v×rª|°YŠC§ÏtÔªÜX§aëmüœ5mÙé Bÿ”º;UÐ}øÐàÂøÕ!›ï‹_Q^òñqÖ»2䕺;…¶4÷3:LuÛ~À*aÆoY1ñÅm‡ ®¼µ'tW!$ãÄÊAËâú êoµu¨Ó‘×\B€”&û[jä94ÔÇdã’•êJ¡Z9좣ÐË!`´wßw£<'îp6j˜ÿíÕ¡ÓO¼i„—H^ÌÔð“¹ACÆ»_¸îJ!¼Èû³•GŒëÒ•ÕÏ©ÿÇXúðæÅ¥[Ò† ´ê×9aý¾>x0MߦcÁ£X—!Ë-ü†‡…z_˜å¿6å3!@°(-å̦c9ý€Æ ÓéòýMÉ%z~võà)шüm¡öcö?CÄœc<7$ âá….á»^ Rq£­ø( ñâÆŤg±àª¾í.þædz,³T*”ıE.Sw…‚ú¯åî[»xó) ¿?Iœ>j€a÷nN¾ƒVlÞ÷(·¸6Äèb›ü®³ãÖÛ\)YCÍ­”ëÉÉ7¶Í6aqÔääë)wÙMaÄ]éf±âIÍ/žˆ $ÄÔ$¹±ô•‘µw" ŠœíÌ?”ó…Yâ·:;úGÖ · eˆøåØ°•÷Òœ=–ðó¯ìpŸ¼^¼¬û‹ýœ—ß®ýõièš‹ÕßxüÑ,QK**¹| k²lzõËGDD^UQAy<~vôLæô½ˆxy³_ÀÈÕ¢b OYùñßëᎈ·¶ù-JåW½·µsÌ.¥ª¨¨FÄ{ô½IT×í#Ÿíˆ8ÎÙàÌkQ«KmtðZ. ðæ\çe×…„)J?ÝÛaˆIWŽó<ÿ×ú̽ðCDÀχ,MƒK‰J’8Ù­ÿÚ‹Âg»†ÍT~L5wö­K°b”÷–„çXxÍ —óS ) œR¦íÇJ."¾=2×nÒDÜØ¿×ü+•µÍ?ÑÇrb5"~Ž50tË–Ž$ôw"ðüOÁož»¡‡:îØ7$;äaƒÐzÜÛ¯Ñ4¢µpNëíâß Þ0HÕâ¡Þe]Ç ·ÐnêLm+SÑúBI‘P<@cqÙEùÓ …¤øý½7,Ûûi ê ©¦À*«–2ŽHu€o󔻘IDšnd¥£kê½íõ:ãöÕÄsûšww°¾¢àSLa…ùù!£D Ü¡+dD¦”,q«¿i£&õÎ6Ћ¾•)¾¼s·€êV®JV¥`Õ•{Qf%ZÂÿ¿šYïywËÀ»‘F£¸Pt+¢dNž×kß' 0À¿?ÓH Pe›¦zQ©¡£¥Ê//RÐë&TäÔ;9ˆÝÒLMq}9ZJÎetÕ®³,Ç»*wµØß¿Ÿ ¥ÜÚLD5Bq¾|­P=²(ä4 ůb—™Ç3ÜZH˜–Z x©%O>(Xê©AÚب1vW°@[UÆìê³}ßÍ13{õYçäÙ?0 ÀͺçÏ’OŠüòƒ…‡Ê˾ëæåƒ RkÛ$Šš¡ív¥nòhøFÆÈáJ³>)í|PèdÃT}ûɆŽÍ®¥# Éü¦¸A¢ÔyO˜ÁðÉûŽ3’k¢­ŒeÕ|%q‡Â*l¶w駡cMµ©ñ›æ4lmá¹lÎ Dà•¿söõ¾œ2Õ¢}O+²-úyÍcB‘’Ÿy—ÞÓ¶­F}¤DJ@ѵ‹Õ RÎâ*¡ðZR«ˆA§Ó¸¬ÊJTi¡Ê Z:Z¹X5÷ŽŒ<58zØî™Qº½zÅÙ/l_g­“Û.¸­¬óo±påj¸»=âf³aËGXüz«@§øÕmœ¦B€+@‘ÿ‡ÇU 3@½ƒ#Uú¸Š{³Lq†:­oWï‹žÞ}ãuº·8ýµ•¡×¸{}:Iö‚å¸$”]9yhùxï°­ICMꉷxpžÝþ”¹–ðþÀœ‘Ok³ñÙµ^\ŠRdÐdÈï ¹›‚æn*ÌÉÜ·g»ûÑäÌkÛ&P¢q9 OÅÙHFüQV l®(:(ŸÅZcã–¡®(¨f×z£P,ŠbÐh²¹0ºFν‹1[¿:ôÐ<+%†F»¸¸X‰¤…IÂe- c׆ڎaÏ&î P©JøC£ãÂt0sÃÅ°~ßv#dDì=éhן'>”Ò$d„bO›Qç…BþÐÔC¶%xÊz³†zÄžZsx²÷W6õO‰wB@Q»û¡ z"¸"tbO_±¦Zµ–ÒÏiƒ¦/|[ÂÏزk+ö—w ´ ©;wmË?{í‰(ª˜ êøêÕ­zÀ¬M¡ŽÖ”óët vÖ£"µîFûG\!lÛ¹;*joTTÔÞ½{£–Lxtÿ‚ ¼DŠ¿dQP^VN!U]^U‡•àÍg^‡ž-¥·_¼ªÖ¯ ¡b ®B½.¨Š÷ÇoëëÙ(†îué:Õ~ˆøܾs(“rriSSÅæQˆ00¨kê¾3¢!î³îpÏîßS& k{ŸbÑëEn.Ð)An‰RçžB£ï½M8„Q’“($SùÃ3*6ºÒ©·èÉŽã UË¥ÛÖ¶úü8‡’)tŒ{«ß¼ðJø³4/õAN¸[he% íD•‘©¬H#H ÊjI ”0`¸Có§n ©QpõpuK/]e™üC®ŸØóþ'@É!`Ìì0ß//îè¶ïÍ..úPyêæÅ‹ß*ùRø1ôÆèð¯¦lݬ40¼34ú¹ê\ß“"ÚÀýù4ùñ—S*òXÕ2"ùʵ›&Íš"Ÿl@<5ÁaHT³ "¾Ïg:ý¸¶gß«]hï µoôƒÒkÂ\ªí]£†èï»ðÞõõJ4úŒd@ltcYò•þˆ}mŽº/º’·É· ".Ü¿pÄOç(Ó¹5tu­)û®¸tÒ÷õì`â_zõ €¯ÐÜwüø†þ!á§×c3 …²j^›.žñ[Ázi‚ß`okVµhÕy_Ë[ww¾4Ç,ïL¥îÙNCAX&! aêéÄ^²ú^Í2UqägìpsTg{{†]¸ùPW•ž¶{þì½ôè@~YÂ7• fêR‹¾ïéç|V$d%Ù b§ac–öu7uêWö*=OÙ8y«tì7ùõ€¹Ö«hZîƒrîº@(Ý"ý¬ß†]?:¼]ë½.|=ÓM;>¹¿‹ç¼à@¥N¼t?‡c&6ŽXôêÉ;Vô {P*í©Uæ7Ô3|çôy¡Ó=¸îi7R6¬™2ãäª8Š«Ø¢›}¿ÎfZ·RŸÍÚw^Eªšu»v,àR|Gón-Ÿdf¶2¥ %:…BmÅš¥nƒG§_µîªø3-»d}ü5`0#ª»§·GàÝ®êåT =B¯|çå=úò­ûÍ•HOÝ6v,}÷"pߪ¨ÃýÆ~böPüöðeÁÁsWeyÔ"@/ÕO!>ö=-58ù©Ï¾Í?y´i1sÌÂÜ™&¶N%/îçòŒ.û@XC 0FôÔ]|êñÒë….·Á £xr}gÑFðàÉ»)Qç°7Æ w8ÇŒIœa(4õjK“†d ‘ÐhuÃ( F¢R›E(˜ˆ4¡:‹(´ÝÔ»GS K@ ‘šÈ[˜…HU^WH Šðý®%¬KÚ`ÄÊ··yìÑÍ®uqe$²Ð —b¢²¡þ©ÇDJ‘iøR¦%^„E!FC€’œ+SOܽ~¢Aþ¦‘Ãæ=Õ@g»®?@T`m“ ˆS[ˆ °@øL©£W]ë0'`mE¶¬u«§ˆ®uDn©(@¤Óhb½Ü°kê™Jœ²XGxѱ6±(/Š²Q'‡¹xº©­@CÚ’Õ2¡ £ "ˆw°¨"©w†ãÏ,ò%‰Ä®ø‘ƒlaMàwhôj‹Å¨³ÊÒ·ÍbÜõ;mTÿ.–“÷æÿ¯Ú£þ'/—sá¿··ÿ“Ú¤€ö+;±ôÓJ'™Ñ+ñO]ëÿg¼ú3¯„üeLþ/ûÒ¯&šŒÿÅC^⣺˜yGdY’ÉH hÒ€=ÅJ!R)Ä»à_×Öúõ ’lµtXûƽaQ¢Hé…ÿkâ†÷íi@_+»~jÛ¢ÉëÎNÈlË>Æ/²%Î=?iÙÙºŠÁñ˜Áo ÑåÃôgì{ó×ÕŠ]vìôÉ>"äs¢fWOþ¿ZÍ@¨~uíQîÏ?’J%µvú(bì©7Ÿ|þÓ\5oSfŠ·[|ÛÄÈ—KˆwŸ.©_É™ÕõìS¾×}ÇGs¼£³!„pG›¶ÝšÎ&ˆ@ÈËëÇÇ{èëêëz†Œ»÷^H“‚'û-˜AuÑÞ?<ßÌqHN9Ö‰p~Ù]“ÞÞlBüÌ;ßÍçÿÛhGH¶egë/„Ìuî°#M`U‰“C‘gûž¦¾ùìúP÷ǃõ¦ÝaÄÓÃìœÖ?Ü ÜŒÝ>°³»¾¡~OããæÞ~W„¼µj«»\Ôdnþ-kƒÞ'ÿøo<=HkZ1ùžý¤²sßÔ¤sª|TWW§“††ØŽ¦¸ Öêt±CWˆ-úüü˜®@ /*:‰.k›ð—Çdo`ÐP¢7Ü>dž¥!^ɳñ‘Ĺ£oŇk ÄÆ”‹Æ”µÆR6¼øBÈI)‡e}©„FnÆYló€ÓßoL”œô°au ¦Q™˜ ÊŒd.³™]:}÷åw™t™GØÆÛ1Gå•IP]¡¹†F€†¶¶š*(()éuh¶núüº ït55E‘%UECS‰N€ÉG.>î1cwvöëìì×[ÆÙDEôßyã3º¢ººðäyuq휘ñWb»‹…)%ŒæmèÂÕ²ˆƒô« Ò6Õ³’L ÝL»•€V«–Íu”@Éç;ÍõG(Ò@E]µOÖüm u­VTÕP¡(¨ª©)1„2è҆ыeNÝyé]öëì·Ï'1Õæ°OûR @S×Ô`@ ÜûyÏžt"-Ô\÷¿Qém*FxÑ̓áæ¥õu ¨®?1J²ïœôw±c2í<Lx˜WÁ.J36qc ɉžÜAϳ€ ä{ÖÙ>ÎÄ"¸<çÚoG3“>á›Îðâg Êy?FÁC¦µý)|™<Ì×ÉÖÎŽéì{üV!„à'KýN/~ð !kÇšÎ?”MˆàÎñuNö¶L;ïa3³‹ÙHá«”á~ÂŒ>Çnf ²¿J9êçbÏ´µ0~ùÇrA͇‡ð&8:ö«æ‹]‡œµMïþ|Bxy FùÛ2™Ö6öË÷'ñ ‘5 ûÎüŽ^›/Xâíá´ïw&í3!¤ðÂã‰× ó0y”’ÿ$qP?{¦½½³÷°äW?!¯6 ^ûðëñ%#‡lˆ%¤æä¦v66övÌñËT ßrRš8²«ÏA dZPï]1—<-{Í>ñ•?éÐr{kË>Ì 'ï !„?ÖXgER‘²± 7Ï µ²´°u J|ò•À»±›œ™6L[›à‰+òʹ„ +ì¯}¸nz˜‡»«½ß˜we¼#fœytcÿ¬À™ !¬ï/g õf:Ø3]‚çBHîɶv“_ÝÜ7À×ÃÁÆvýéÇäíÖËoåÅ­7håÑo7£»;4ÅæÝzõ¢tîn¤© ”‰ïX»ÊäÅ }çý?ólЮ„AÌîÂî£wîÜÚ·‡†xª‚Ô¨q[SOÆÇvR•°Ä‘º{k+!‚)¦:s.–ˆ_†Íº5»“϶KÑ‹¼=\˜žgÓó… ¨Š Gû[[Yöõ KÍ-#„$­s X~g„›µÓ‚ BÈÛÛ'û»9ØÙÚô½(·”„ÔüH7ìm\Á£4z÷Vh«oÒN àÙ‰ýváÃ… †lØλ´(ñmu£­®|°þðóGbúvo.ì?ç°e+,i§É¨cUAÙÛ ~cüw&…õQCüï4?5îNE!bÞ̓n#æ""ůqt°{[ÂÆÏ'Í\^W#"?‹3wô«Ág;ûOUürcPzm’iÈqD\8Á½ïÀ¥Â—9‰ œýg Ÿ‡ûغ÷‘ʼžð¦+•}^ˆÇì#¿¥šš{|@,¼»œé*ôƒ}¸{ºIÐ DLÚ9ÀÞ=X诚¶ÄÇfúDÜ5{ÀÊ£9ß¼z[į̀BD¤²=- Só9ø5ÞØÈdUB"";ßΞYÄæ#âŠ1>»®¼FĪÂWn>lèzznãÔˆÍ 5ïoYôõ-GD¤ž,õ>üLØë“íõwg²«?¦õqðaIuS-<=âè1¬ôíy[‡•”ö~¤$k¤©') /¿q$:1s•…©ñù—UˆÈλmbç[ŠHQ¼Ávv‘w¾!"ëéQÃ>!Eˆ÷ tp )–õ餵…û'6"âÛ„ÍÖã‘Ï.¹rõ:WPë†YW/UÒ¿ó7DDœïëûôk^Ür³ÀEBâŸn2ç^ RÔ¹qnÞ[ÒñKÜ*C¯0B¶³¾Å½Âï¡V†Ëâ?á³ÃgSÚ py| ÄÓv%¶6Ã@°¹±[×’¯§¾¨ŒîgßUÀË÷Ôô6Y÷pO}9ÁHx&oåšáÀððpù"j—O.@À ih«Ý¾œÄárøŒ6—N7DPu÷òÒTª—ã ʪTEqrN ›ÃÕp˜wóPhj«ßN¼Æárø´V‰ gš_z´Óä -(‡Ã10TûÙÃL>py¢@¸|nØÚfºšoÏ.«fñø‚µû/ZèÊ^N¬Q°ñ6ÖÅÆFUßÏä_ÙÖ@›@êéëž!}[ÒuÌ ù‚˜P€•t>Ýcêá$7lÃ|*uWÿ—sß»¿/ðNoK´š¿V¸2:–˜:ʾ "X¸ûöÔUÌóã凂!~6€€­l³%u~ÌÆDÃÙÛ…´·™<©ù«Ëélt4 :¦˜ú°Þ½( <(|“^Þ±óDS‡Ãáp»öÕïžòø%ÂQ4˜æÛ¦…ùÉ¥@@¡€Ï5Ý.^Î62¬ôÂE“žÓ&O0)V&}9¬J†"]„‡ædi?5|&ìV ±¿U!(Ó \ùƒ˜¹úöj-á‹…jìúõR¥Îf½+ â>Åzÿ•Œ´n JÆ#^=>Ý€ ´è䦱+Žµ¿ª=Ãápôû…èd?{ÀºR3/Ow‚@j>gÿhݾµXƒ— к½äð#™úYÎR×Ñh¬ÿTaÉàBÕf¹oò4ùÈTÜ>óÚŠèB”;jòrPý§»^8ü*¯}íììgþ8Xo“H7/Qìml¥¬ <‰ÙB]½ŒU)sWfK|J—Ï1ŽN®NN+c³d;Õ®ö·N¯99'ÐÍÕÅÞÎïy 6_HéVpÒÑÉÕ©¯ÓŠ“OðýOø=ÉÉÅÕÕÕÕÞix©%nÁl€÷¶› ì+ý<Ý]œ‡/:Þ„@íµn ºšü/e`‹ÎB Ä·²š–Úšµô¡wÖÆÜâ7^V~+Wn«CД[3h?¹¿7¥¦!ô=çæ+´×Q$²ÂïHBQG]MÔ[û“Ö¹­j-n-š«”ÿ¨¤©h *ФFyuM)UþÍÉÙÕÕÕÕÕÕér^QnQЛkÜüápšq€ûxOŠ Ó9ª¨7ç±¹@PÒÚ"úIWÖ¹}+ùÊö!sxå”!ùK4T³Žµ^Šºšü‚rDîj*ÐÅ)€HoÑQØÄ÷Åøí謾ή®®®öÎC~jÀ›ïNÔ¹Ïâ[™—z¿hí²«[—¼“•¥Mk­Š/?P†Q@Àæ†ï»•réèçÓs×Ü-ÿï=½ò§â»´P(øQQKÖ§ ½–45³ñ´ŒýY‡O¹™¶£Þ»´¬—9ºZÖÑ¿ŒËòqIUUsU-@Yö]z³é›Ž?¼;ùâ[‘ÓîUÉGí­_¼sûÖøÍŽ£='”½YøÆcïßN¾tðö–ð»•4]è4ùÀýZH{”>¬Ý/)Ãkâª{wï¦Ü¸ÙòñÈó3ü“²/µ>”œ‚rF§æ4ñiµ­¶jQiym›øye¤›®øÔªÑN‹]ð…ÑÄ‘UÀ§Z(þÁ¡3%ý–¼Üüêº RªQÆk¥¡TUQ ëlçôî-©¼/Õµ¸³4[iþ¢>uÕ–4­¶÷ëáÁ‘±N ø›ÜŽ ÜúlÔ!Ã(†tã•ÛuíQó„\9† IDATcNì×:yƒ@žÆ®¶'YIJ4uBÔ,flÔypÀÄRòWF­,¿¶Ùå ›¢Ø†N«àò±ŽbR…öÔ%íFï¨#ÄÃŒ´±­÷öá¤àÉö’R¡ûº ÝçÏܪª"}ÎX×Ó·Cart& °ÎlMÎDïMý¥ £Ë ½„ ›ÎÏ ¼Wþßz`ëOÅ å3- èĶl6¢ÇW?¶l;¼#½uk•o/å¹ê(ÛØð7Åœ7 « ´%. GdJòu#3wÔ}¡v™"á<òfú„@h •–º €¬IIœÚN£1Þ$m|Cøåî¡%Ö]òôì+etì;ïDH—‚“vÒ„ŠƒÏn]y]ÈmЉ©ñK âõÝœfívšJ—6„yõ¼ëeä_ I”àƒ?íÿ‰ÀɽîÜ2ˆ€SzýúM>%y‡rõ›˜ÝBÚJ‡qDDÏ)Ë´ÒÈopÝpù,Ÿèéþ{“ß I³lÄú”RÏÞmÅ›¬Ù¹ï¹µÞsû{ÿäÿwÞ…Ü´içuâ«ÀIˆHñ«ÍLz¿*f!âÛ;'\˜L¦÷éY_*‘¢©Žz]¾ñ3.ïÔÃáÐRǯécÒ+óþùAÞΦ}Â7ÇqñçÓ}«‘_2ØÉÄÄÔæÅO|™rÄßÙÆÖÎÎÖÉkoÂ#DDê£y÷ŽÏ yˆ¸f´É¼ƒo‘W³1‚imÅ´³q ž”‘_‰ˆ¯nõw¶µµ³³uòÜs)SˆùÓ«ú9XÛÙZ»˜ð0·9¥ï=- -lÜJØÔõ¾–ÓN""~¾ÒºW±üCêØ@[¦µ­ýœmgªù²Mrü'k }Ö_Ú¿ØÍÑÎÂÊõôÃOˆXž2ºG¿]u·~~œ0¨Ÿ=Óžé0öþ»¡Å2ïò“Þ½ûM߇X}rÓ ¦­-ÓÎ>bSl€jÌøW’0¢‹÷DŒb¶éì[ѽp7qß 3s33«U‡’¹"rÇ™·_ŸR&y/ …Õë¦ ìÓÇÜÊÑï|Zžðõ“í혶¶Cgl.¨ä!bÂF×þ³“„¹8¦vvXÃGüöà¨yoç˱º +|» “imçº;>C€ˆ_ât ²D·–÷îmü²Œ‹ˆŸ®ï4íÝË}òÎ/·£»9 hØ¢S+G[u®Î¨KU¼471òÞ÷XXùH£V‘YBj|ÏN›?v€¡aO“a3Ö½úZ!Ì•ÿhŸ™m€Ø-ye£<Œ/‹iœ…yS-Ú-½\"ñêÑ*CßMñQ Ýí,¬ÝâÒó…6f~IÎœážLÏÐÛo â­ýúMN¨Ëø"刷£µ­kÿ1÷²‹±º0Í Wïr®@¼ü)Q}.©ûÞ×êÈãüºVK?Þ­‡Á”[5HQ±¡Ökï×Ýø—“vyÜ÷ú†FVák}©Z–_›·êv³¬þbÀÄåþFö!Åìÿ>›q“âFÖ]–Ò7! ¯ÕûŽ”øî%«Ôúr›¬¼þ3Õè­š²ÞÈØÔ„Bü>~KB}ºß(¶NÜôôX-Íú݆%ý‚€2›ßàAFvaõON¬ÞŸM7’Uµxá Ò(ÁÅ¢šLÙH‹dÔR_¹LšˆØŒjœ8TcÛ«¯/mÝñ ¥ÄMÏ~ëôLÒJŒé²%ø^ö¨iªÕR”‘Ѫaí”ÌJÿ.•eŒ” [<~7‘½!£„&W 2+m<ú¸ÔæDÓѽIyVêä`W¨»LTº$œŸO^å©'êÎCéåÒí%²l‚€€ÕùYÙE BŒLMbwYÑÈ…?K”õGö€¦)C6SwýÒÁ%öË®‘öÞh¤"“1$cÏ7ñÐ~ ÚN0”½ñ*Ùsá[?¤KÙ^jÔ4Õj©šd44¬È*á¿þ?®ehÒ¤ …ò7§Î^WV´àP¼ÑÁVnÿì}~dœ=÷”!ue?¡÷06aü^U®AÁÿ½ó¯ªZÚøoŸœôž@ !…Þ¤÷z¨Ò”&(" ˆŠJW°÷† E,WDTºR¤÷Ð Ò{Î9ï÷ÇÙ‡$ ÞÏûÝËw³ž‡“½W½öìY3óÎPZJ(mú ºZaZï¶N¥>ÿ ¥4Gxi)-¥å?Ï2UÉz-Úµ08åZVÿĵ¿J¥ŠüZ0R1•½T þ¥¸~®Aÿ9fêzô+aÞ7‘]á/.ùo°c”L³›1_Ên®óÔ Ã˜Ø¾ÙÁ$»FÎÎÆoË+ÓÁHîØ°ÆŽó6°§öÂÃÚ4oÖ¬Y·cÖ¾ŒË9B¶kjÔ®3vñi£8t¥aG~|fÌ—œžlý;·jÞ¢Eìäņa82Îξ§ã&ÍÞ;')×~­® /íÌŒ{4mÖ¬ÿ¸Ù—³í†al~eJãæ-êÕërÒ0 ÃH?úM›&ÍZM^gFÒµÃz¶oÜ¸é  sÏçb¡g?xë­Mæñ»yN–!{vë¦/æƒãê½#õ»ç4ýÝüÃkë¶ïÃÀ\Ã8ðft‹IúßøL9ì™9ï+–Ÿqcñ»ü­3cÚÏû?À"Ûr2l’aC»ÕÿÇo—ŠÐÈÛ4½bdžaÈ–—•Wú2ß ¬+™G¿Ü|2ã‰níN¦¦¼¿tƒl»[Õhõ[$JR··î<Ÿ/9¦õ¸õ®y_95çéñëÚ¶n¹ühò•z+_9pØô6½G£‡Ï<¼pÙæSÛÞ{è×Ìß¾~'ˮۻµúép²)et‹Ú3þqXRü÷O¶jÕ'ÛVTÍŸs²s½Fþ㨎ýKhÜhh²]‡Cöc±µ:”¤ì1M›¿q K’Ž¼×¸n»Ígr$ýüî´V=‡^mCIù¥I­ng\úÿܤ­­b§äI¹¹96»6.|ìžyËì'64í1ô/èå.¬ÞnêÿÆšàÒNnŒ½mÁߊ›±=×òàµvšbëÚó²sòÿõ ûûƒZlNÉ—IðVëšÌ‘¯_¼kÆ—¥IãnjÌT‘âY¡cÆÖO6fä¾øÊ’ÖmëpI¹;7 œ2½ÓÌîW±ý—.îåï_>xgÿ¯=p]:W^¼*ÅVN{îÙ÷w<óHJ… ãÒºOwFô˜Ý·šDÅNSÂÄ_/dVÒŸÛ¹%£Ò-Oõ­"ŒZ·¿X­ÜÉÍ £ú^Ž ÜZE{©4xúÓ›Wð”ÔvÀ°”„¤„"rˆA`íH·ÌLsZœZþB̘‰î0iT¯µûR½ 7«ÅÓÝfs”¶w\§Óiö«Dýó[?½½g—®}F¬;‘u‘~ûì¹>q]ºÆõyé«=WäÇýkßØ«k×n=g½µÂ¼˜¼kò¨;w6qÎél²Žmì6âq[Òª®]»Äuîx:Íî<Ù:N­mÚeLfî™Ø¸A¹YûFöéÒ©KŸÏv$\™É™-ˆöî×­ïÛßv^ÚôòCÝzxwTÛUé– »ÌÛ™Ù§g×3§6êÖvÍþLvóF¿nâº÷{íë]Îm×Ëíî|ݹ„õ‹æõêÒ9®û€·W›~ù“Gv^wðÂ+S†uèØuêóŸ{š\õÖŒž]:wë9ø£õ'¯$·'l¿X¿Nq·½üÕ6້íµ<6 ûCë/MÓëûÝ)Ç–¿ÔyìSWz:õɘØÑKòv½;|áÅ^ñÜò£?¿Öïî—Œj;vIwÞ̱qo¯Š?¿aI‡¡” 7‘t㛞úú†­={OΔ³ë:ÒÍC½ôùà¾óYW{HG¿z¾Åˆ'$ýöîî÷~~ÕGÔ!¥ZÓ{Èã/ l½3[’Kº‘Ö¾9}ÀÃW’óÚßÐzšó…ÛžÜðIëþw]krŸ.sWï“$‡KºqdÞÞ´Õ™v× æÐ_??.¶Ï´k–œØ·nÛCfµœI­[þžf“4¬w³•;e·åÛìr8òòó%9ò“_zþù¤ì¢¾^¿¼Ò¦ÃÐÓ ÎˆmÕ|Ý‘$§t#é÷ϧ¶Š{áÒ¥KÎo×ú…Íg$ûî…¦§\Hºœ˜xáó'ºwš¶NÊìÙªášÝ§.'&^óZõV£mÒ®•vì=;99õáfüxÜ9ÖÚw2ùMeoؤEñ‹.§¤¥%íÙªáêý©’v,ºmág/]N¼púŽM'}/éغÏ_ú|ƒ¤üË{ÚÝÚî·äÌ̼üNí[w4çDÂ…ì|­zóÁŽC&_Lº|ùâ©)ŽXxHRÞ¶¹5ãž–ôíkwwòhbbâÅsÇú5mñÞ¡tIãïèئÿ#§SÒ33/͈«óÀ®’‘ÏÚkÜÓI—/ÙߣAóOOÛ$‡27ÆÖmñþ³‰‰çç k1þ™Ÿl©g{6oµædb¦]#û4_þû%åíoW£ÕÖ\9ä=wxÛV‹¦äo™Y«ûs’>zjؘé‹ÓÓ3/ï[ܺÛӇȶ½MíNÇmJ>²í™·—”J7‘tcHŽ¬è^w·l:ktëôÌëæ~”ñä§ßiä{w×ú[Æ~Ï«_lsšÀ ølùçÝâîêô|äÒ¾ws1 « HÏsŸ÷ÖÜqo¿Ÿr&½p¯éY~ž¾W*†pùBfaa"ú–[süt.:³æ÷Äô¤Ì¼«„§ w .ÇxçÑÛkÝR{ÁêŒÞú£›»‘‘œ2ìé—¶Zünõ+D+‹›ÕÍ‚a¸[­H†5hÒäÉÁ^–B]8¾|fa³GÞŽ +V¡æâwß©êuEì©×kÖO«Þ òñ º»‰Ïš'ôÄ$»Ýî6`ÎÊïžj¹Y«Í3$$4´Z§ »×¾a_ÃÍ300`öœÎ+g½™ÀÚ/VusBrâù!~~ÁUbkUZµm'Ø?{õƒÛæ|Q&$4,òÅÏÝ<^Tn?`Ò€V’¬~†ðòñv3€»æÝS®¬—5å’ïNy²lPpHÙ¨ÙoM<òÁ¬œB½Ó]/~ÿéS¡Á~Aá÷4ໟÏÈ6ð®;#}}|Êté[íÄÆWy† œºpśӂý}ËT]/ïÛŸÏñó‚—ÝÏè\;"$´ü”W¾œÐ·Š›o€Eøú\!¹{­a=­Ÿ¾»ËÀÈϳEaܽ*ÔiWAµØà"ûÃÃÝ3Ïv…}(5Ÿ¯m_¼÷ó‰ öš­ú÷hqËWïN?¶ù«¿jmw,ìæW€LÉO=wßCÜ2lrMOÃL3+Ý=éÝó9ºaÉà®q+·­Ž(²œ ÇŸ5½ïƒ{£«ïjÏÈ!n%9Uïv•±ë”µ]u?§adÍ:Í{÷}7nê eoiâ›|$—0Õ‡M$y^§ú·„ViмEÇéSGAðëO>øĸÖ3áM75ijè´§gÃiÑÖÆ¿Çgµv_·JçײÜ<ªx™sŠöù5) ’&yo˜Ü~¥¼×–‘’™ž‹§ëØXäSáˆñó.¸äÕ»¢—îZÛb¼—o/Èà~lÓ²IsÞ«Ø Ux ÷ÅÓG}€ìA¾N2¸Y­†löìø—ßø‡Àf­8yRÿ=ßðÐóËj6iày.ÁCvÛãs«ôqRÏ'(¼vØ3®%sç#>\¸˜ñõO.ŸçÙpšŸ»‘m%÷Àù}}nËsZ¿õãîq³ç_‰ƒ^š¨ûfb7E\ ¯àKú‰D…›i¶ [|fŽÅ×ך›‘Ÿ˜S³b\.ºuטå^ë[Î\š7ªîׯÑ¢}¸#3ß· l¾xÆÌÇ~xÁíj×ÉbÜskD–;ùÇy— À±á,ík¸í÷ ÆÀáeµ‘Í­øÕôéÖcéQaQ Êõlßhæ‡ßäNèãepä÷_SËÖjSTµuß,øøÓjYò–Õ«Ê·ܺ–ïosµŸ´æ/nW0ßüK©dqe®¾Â’ìÏNx¢ÁìÍsº?NŠ{Îœ£÷€ûŸpÿ“gm_²ð©N#í?-S³ýퟷ¿=ûòéW,ºkÀð·~YHž³ŒnRõ½ÿÈM_Õ©ïÀ+ü"Ë™p #%Óàí^–œ>ËvÜQîj`ñÚüß;À37- B0 ”Ÿ&yr±Î}îÑgz½ºcb3àëQk?,iÛà$Èwxº“ñü¼×Ç,úãŽ:À§C¾ý€r~–-i¹æ“-9{BtÛN>|xÀaæÍ#ÓÍ(ÁPßhâ³ÙîÏ™þ⮄[Ô *Mºp3ÂsÓ÷Ž/îNôí=¢>šñl¦ À°¥¼|ïTKÓIUýÉØþiï>÷l:•æâRY‹– iÙ΃Ü?mrïc£F3fÌèÑcÆÞ÷„5{ëÑô<ðÙ·7-÷:g4U‰‹sÿí‡õçmFÖÉ{rÜ{Dû6ê=xÌèÑ£GßݱI%2Žè1øX.ÀÅí‹&E4©*Wð‹áwû˜èäC‡³$­{÷ž©¯e9í©g¶ÿn Š­(åÔáÃ眇¸Ë«~L}púðŠþɯÿâyoSïëÄt‘l§O. öêÙ§ú†×ß5 0Œ‡º7{äÛƒ®oÏÌs‹ È:ñê,[®øyÉ ýpˆ¬ÑèîÑ}l'·;.o~hƧ€whTÏQ£Ê¥'œ´¶\ÃÀ€^3ÆþdÑ¢öôkæ´g½¼â¤“î[ÎÄ·­^ü:u­üí+¦â6é/^ùb·0²S.ž¾˜êš¿ÃEÁ-šG¬ÿ|­óõßôÁn5‡y[ ™Îs­eÊùŽË{_7òrŠvïè»F=zô¸»{Bvn¾5¤Œ{vë;§=œ­nÜààÇŸ¦†ñëûSÚ z ‚|7kQÆuïç^]sÈ3¼sÈUN†CvçJÜ|jÞ”ûÚ#Ó›<8Á °e§:{¡ôU¿ ¤›³[—Z°vßÚ¥×*˜‡?ýщq÷vj|«<<³mî·ÞÚá›·F …¶»ïý)iOÝÕíLº%,ÀíBR^½†­VÌíréÛG¶Ú:¾SßÿJšmÃ3pLecÒ›Û¿¸Æ}ƒºOúêh÷ê%*¼oYøò]µžíé“‘ï3öåÁžEy¥_å)}Êl}k`™Ð4BžÿÇâP«óÔTЉkµj6mQÿIw´mØ8(Èër¶GÜðiM½¬}lÄ+çÿ27Àp³¤ÅïM s}øóóó×¾Y¶sýûôü짭WèÓa⛟ŽÓ¨íW¡¶ÿJqÆÕäðúܼ|ð÷HŸG7ÝS·NüEÇçO÷ëÝäkÙòì.žë°ççÙ®òæ){ûð¶ó·_^µÂ9Å,{²cÏF¼Ôà«bŸ¸§í=][¶-ço¤Zb^úì# [\ ÿñ:7ý²Ýnö)hÖïþ‡ï˜Vuȇ†S`”-7ÏÔªÑø©ÙÏõ?¹ùË^cþcíºLYýÞcµâÒÙ K»=·iÿ÷‹JßöÿlËÔuá¶×A;nß\ X¶¸†W,SÅ¢¼¯ ­¾Òi!ËT“V»œ–©â*;$)yÄÛ¿;-S}ê´=t¬»X(»Ã!é‹Ïdد‡.}î()^Øýê+3Ft~Ý ³›ôãõ›uNºî(Êì(v‡Šo%åo›[3nÁŸX1×#ÔŸn¤’§ä(ôíŽÊúã¥fý^µjùäÈ‘¥V¡ÿxËÔuá¶×A%W.çMI ü¼¼¼|†ò¾æØo[>¹y.][˜‡íû½IyùŽb+èè{Žî^{~þé-' ¢S->#aÈ‘ñ¾í¶r¾–ëÐÇ(!]‰ˆêBXðB• ©Or²¯œ¹"¾Îàö1%…å¿jÚ…º1 R¿›[Ò³CëÖ­ÛOYüÏ5ßüÊÔ¦-[7iÚë¤$)çâ–.­[·™²îú­N/žÜ¨q«·ÖüO¦Ìð.í; ¸ÿ|f!I-ýxƒæE¤›¿·~ehÓ&í~8˜øhå쯳[·‰ýpÛ¥›1ÌCùF„«P2oý‰½ [:$ú^··k†þ­ÙÄo”2æt]«•ô/1û&Ëbvóÿín)-ÿúòw°›ÂÆÆÿÌx}fTÒœÿ´ÂM±º¿ñáþǯ¹`®7ã#+5„ßÐ3vdS­†q3=càƒ/FP‰s6 Æ…cXo¦Eå\Â00šü¯æ,qh†ÁЗþn^ów‹Ò*œ'Ú ù0†ÁÚË ¿Ñ?Ž¶˜ñvAÍ´ èFl+÷\<ú==:Ò¹¿%™s\ÚÇ·Ñ.–»§ë…±´mÅ; ®ìYN\Úvæµo‹L HÙ@ûö4]Êhþ>ÝMÒ^êÏÒ™ó7Ù‰¹k°»^…ûb„ïÍ´"‡M‡éèÙlîÈhùaI:ü¬@Ã^ý›f%í|\ ¬Á’[jðó÷þEÂMÉy:û©@Xî'Påž’”²K |TÆèµ%ió"–mI¤cËò Õ°QVùeìW‹('/Ò#_™#þ:S üˆ@½Ÿ-dŸËRˆ“wÕ-ÕÚ8ËŸy¹€=ÌÉŒ—xt¾~]κX=òž¤žcîËŽ#¼²”§€ Þ{—øDª4eTo€]ïòÅ1¦>Á{ÏÐh±µ9³Å+ɱÐs4M*¼2‡´*<Þ‹ç^&Óû!D¦½è·Õ¬ÚŒÅ—ÛÇP5؇oóÛüÊ3q<^B¹œI  a^üø ?%pït*ø“¶›'—P£#w6fös„÷ öV§òÌÄÏ ½ÌÁËôµ¨p¾ý{¾Ù„ÍBëÞtm`~Ç ƒÕKÙ´ß0îO@:äžâÍI̦Ez4Xù4ÛaÖü8—t™ŒÛžyK9‡! ƒÌc¼µ„ä\Ú¦K€ÏæsÀ‡Ç†2ó5ž˜…§Á©-,ú–À*Üۛǟ¦RKÆvæ£ÅU˜;’ã+X¸‘!ÓÉYÇŠíÔnÇ‘ÀàôV>ø–€JŒïÃ㠨ؒQ͘3 `é+$ÝA;ÀêÁÞU,ÙH妌î ðÜlòê2¤<¯¯ç¹é©Yøi6:ÜIûê&¡~ýkv`ñ¡ß=Ô+Ã’g˜ý¸1ó1FLç_6¯àûßpXiu]ë9ûd%0÷U*õå6ƒ7WàÍ£±¸H½l!{OS¶*÷ ¦±1•ºëy¾Sîâ×…¸ø¹Óm<À¾ j{r{Ë~ ¦Æ¤d•T’¾é"PÇHæ-×ÚçªßYq-ú*^’êúÊ«™–QL¸@”3'0¯·@µ›):P ¯OHùêSQ >aѺ,IZ÷¶@ÝWI=V] mç%éô'µ{TYg RðÁ¹ZºqHÒ€êµV…²ªSÞ%Ý84«§@Õªa%ºÏt‹ÑµjÞVþ7H-bIÚ&Ptcõï&Ð}JÒÃ1²j`„bÊ 5FÑ¡ ó¨ÅxI:½V *-Õ·‹@3¿‘¤Ñåå^A-»·’ÊÚ&jÓD•Ê Ôh’r/ DIÚñ€@;‰Pù Ð3HRÖo cÊ T¢R«Uu´Ö´¯ÿ¼@·¶òG ‡•¤OtR×:´\ êmt[^øY’æö¨mOÕ è`¦f•§0Ô.V3õæµé¤-šôe‘GºO ˆÁÂGeÜêì^2Õ(@X4p ü‘gɦuþ;ì IDATŠ¨ª;’¤FÈZSö¢´ƒŸ$OÊuHRûÚeåT±)z{OeK_LèáU’4>F $›Ò/KÒÆ©ÒÍUž@ù×…m-=-7KtãŽ,Íÿ›¥›?c7"µT’tQVÔìIRš@­'HRʆ¯•¤imZ~Q’¶¼!,:%}'PíqfŸá(¸ù; QQ’êù ´ò¼$Ý$,:+)UÈ $鲪UQÏ:û‹@ýWI’Nôø§’ôÇjŶ׬ßKd7ÙgLI8ñ:‡©y ¯žæ_e0ÙMæ)|û˜×ûWh¿^ K’ö©V-=²¨ÈËÓœ9™îj+¼e—©$ЂC’äï!ÐwÇ%)YkKR=dq7ûèVKøKÒ˜ƺ^Î~eú!^’>š*P㊰› T}°$]Ü"wK9¤a­:&IŸ<,PÃû%éØ ­:Qp˜ŠŒ•¤Ü“QK’b¼úÊ |¡È#Ðüݼ‚–¤ùÓôä;’”u\ æKRá)gd®ª(´’rl’ôÖ‹údu‘'¶O ‹§ùg97 »´r¾@ì–$Ûf¾=$ûZF=#IJ¨Þ³E¼ ¨ëƒR†@ø›sèÙP “çªÖF’v…x äLØ5¡¹[°hþ¯Ì¥0»)(ùêZV ùΤTvµ´è–AR^vÓ§¥zO)uó»~ñbá`€äõØ`ëd #àÔ› ÀaØx ú„a4–¹ WÏßÀaÎCòN§7˜¡&"èY OÉvÒÖ‘Ã(„ÃGY¹ˆã¾ì†a`TØ´ ^W~ZÇÌF×h|¯ú»9!%¯5w;y0ЕØ`h%óÇÅ5NsõÑ `Ù^â˜x7€j³?óGRf³oÃàý_ ›MÎ[žL©ŽD¤À­1}±eB»Á‘o’hÕHg³•7¯÷3ûþ5 F$ˆÎ­J\ÑÀ¾!‘–´‚†µ¢At,ÔЉ9°ÊXÞ¦€›"‘æºA'Y.qòRÍyn9 Ér{+/ŒÅ0ð© •R #v‚¸Éåx¼¬¸…qÚ›^‹™¶gG³IÙ0È"öíXPÃÀÚ`ùœˆçÞK:0fëðë _5毦Å0V¿pe‘f·Î¼ÃîV¹ÀN†6>Ãë¿Òn?~KM/mC’­D­¹-•Šî|‰;ßà‘žK§³© {—¹@B&Ÿ¯6òõs¥–©ë«I4«Àƒ«p†`“8¹éjSƒ»ˆƒ*¨3ÕõÆz:{ñ¨[PA Aá^`r>#‹;€3l9ÙääãîðÆù‚æ?ο:v¶QÈ”S4X†[àõ¬-NXU¶+¶AVŽ‹Þé®®òmÞž¸¹d䚃fg““_È*d)d7qýkíºUxn…eݬžEZÕu‘èJ ç»äç—üô®QÏ9Ç2æ];[= ]¹rÃ¯È üÊ™g´¸ŸÖHd+Þ6u×8R˜=‘Ð|žG@ÃB±ç]¿Ü½ŠlÀêð½`¬…·a+ôÜÏ7úG›­ZDòÕQƽ˦àI » =| /‹d»rÞç"ð‡9oƒÁò÷éÐK¦n.ž¼ö üƒ8iðÑ>ßk.dÚÓpÃÀ°`wÀn ƒLãê5–²›ëY0ý;á /?o~Ùºtä¥eW¿º}ª|ú ÀŽ¥ ɹ«© ‡÷#~ûx‰ƒúuÆ>|Ö©gÃÛ‡zí©Þ`æt£{/¾þ à ñ$K–°õ"Ô Ø°èÛ?_ݪ'6’4ðhŠ|ñ<Îòîy³BXW xy‚ Rüv%XW*žš†ò6âãÃÈIÛÆÀÛYðx1Èà`2ÀS2?áíFw7lù$ä<4‚;ïçÚØå]6ì€OVü…gîløË X²âjN“žw[ÁYBèé¤ àÞA ŸÌñ½µê¬À–sEt$ŒTî¿“ñ_2ãe.$ÑÅö óÆ1ä¾í÷hÚ`þS Ò£Ï`¶'˜õs³®ÆͧöéÖlIà‰Ïyó.ä+/t8œ)ì8Níáëp6žTÈ]žðñ{ÀÑuµËŠÉØ1¦"9ðÃ9î¬åŸÇ“Oòä“Ì›ƒa@s^À¾^ÂòõÿÕA7 »ñ+P†}:J Ooy¸ _9í­‰;ºÓÌ3­[ƒ…!¢J.ÝͺÃ.gø¹yÈÛS Õ']º›³Â²1ÂÐ>›$-/‡—¬á©c6Izª½@^Þ²"*(U’ôó{õûA’tIV„Ež†î*Pë‡LÝ[×b áO×wHÒ„ÚyxŠ@ ©/¼ÍÊ?=n^÷´ ´àGóúÓÍÉXå”$Y$PÓû%¹”)Vùx 4ñÉ©»ñ–Mr8TËO ‡$uv!í¸@†«ÕÜ•.ÝM@!ÅD‚ÜktSó†%ênf~!I¶3ùÖ‘Ã!]‡«a³5¸_’2v™ƒV~T§^,0„ÛS"Ò¥»©V@ÀÄ=îòöèÕŸ%‡Âùx*º—ù&¬ÓàjYÐëG4»«@>>æêîY"I-}MÕSwÐÏÔ•ÔVeH’FÖÈÛGD}åHJ•¢r±š¦ p—ÆÇO Ã"‹E‹@«²•ïTß2ho†$¥0/:55)y’”µÃÔÚxy D”l½ÔJVw¹[²XeEwe¶²¨H”ù¢º› ä[ b(¹\:AŠjU ̺IHJÇp#<+Øs‰?å|ÀΙ3ääãåGT8@æ9ÎeR!³“ìTÎ_Â!å ñ8uŒ7ªWH¿HB1Uð ’/r9 Ãòðõ0¦Ï’–Ũ(Ü 0ÈNãÌü*î 2¹Œ‡Q¡>o0‚9áKU—%òÜq2 ªW"íáUIÎðgNm#,Çes¨RÅ4N§^"1„”#įÀ›‘Q¸ä§ï ¢Ê€=‹Ó äÛñ¥|Àå$Ù©ZÄéãäØ©\ «Á¹cd¹Qµ"@~&g°9(K¹ €‹ñ¤Šj• ž…#‡Sç0<±l%º?mfñóãÇð¦jr9•Lh8!~ÈÆ‘ã¸yQ9 ÃÕO¬¿Õ—V3Ø0 Î$3ÿr„:ˆ¿H`å‚£ÇÁj9qŒ<+Õc æ—Á٠؆Q6An:gpó¢R™—8ŸJ™(‚àøi1øX¹xŽÔ, ð ¦|(À™cdT¯Œ#£'±úQ)NÅ“c§jU aÀù3dæbõ$& C`œ@b:Þ8R±ûP) þ˜©¹r~‰¨‚¯G'Ïb7(‰ŸGÁN'€‘1\‰j’—ɹ ØxxY ¤œæRnú€pRÏS8NÃNÅxªsìªGì~‡ËÈ\[*Ýüw—3›…ÇM6ç}s 3tñœ5hEÊ 5Ü?Oð¸.žÓí Zž\ºþ/ÊcÝÕ{V©tó__’OìK¥27Ù¹ú©{xìÏò<»‰½n´áü±L_àQžgßæþÞ¥[àÿ¢üƒÈzøò_«¾)e77±\zõ®½A8å?Ý°´”–ÿ#ËÔX*n.#_atßMù¥0®gþΓú'ÞÄäÒ¿±uiùÛÙÀÆ}1 Œª7"¼¥áñÿ_²MX‰a6ì/‹0…YŒÓ—Ϩô·‘«€mý‹aâÛßÇ0ØüWz80 àﳥBß»1H‹çõuøw`õ¢›ìk ÁÿÿrpS}ÈÇ“ÿŽüÆm45YL€ÿNv¿ëq /lë;íDðz,Ü„3aÅîL‹¿ÒIÔP>üÇú•2ˆ¿·ü"<ý2¹¡$¦ŠÅ +¬\ A¸Øí\8 w/oÁÙIM%߇'þ9)¤çBj2^þøx’ŸMZ&ß@¼Ý’qxâKr  ÁÍA8;ƒÌ þxXÍ/mF*9ùXÜ Â2|nîX 2SȲŠ»{.IixøàEb2V_<òÈrP6¸˜¯bÒeeB1 ù6ƒÐ2X +™,;†ƒ"wCÊàÙÉdÚ0,Ø¡l(¤\"ÿÊÝ2ò )cºóJ–Jž 7w‚1 ?ƒ”lüƒ±g’o’%5™<;Áx¸™ú•’èàAr&a¡ÈAr2 &3…<Š{0Ý»™ŽÑ9)dä\†ìT²óññÇ× á 9;“åj˜™Àôø·&é2!¡„ºœ‚B°Äå$Ü|ð´‘a',9HK%ߎՃ 2°å–¼|ð÷H¹È '!ŒÄË” ÁÍ #œ<0ðõÇÛ£ˆŽÉ–MrÞA¸ç‘žÕ“ ³BN&Ù`à„§$î!ò2HË"À‡=k)ãrmwa¸ˆÕ0ySVYyxxãk!9ÿ`¼#éÖ /¿Rñ· ž×-cÃ奉ѢKùúz¼é=e ïÚ’tz› Éf˜pØæåMÇ'P·%éëNMj#Ðœ/uò C†!Љ Iªã#Ÿ8¨kö\ßœÀÆYfe'ˆÙ™üåîæ4@¡=ÌšN7¿¾?”Œ?-PÅÉò¶ˆ[ŠG„Çù ”$)YZš$I­õ袤4¹!Ð%©ƒE þU:+)CVzóœäPwoÒ A‡Ç7( Qµ ’´sš@c&šË÷ Õϸ[Çtx;±¦ÝâÓ%©®ü»©s”¤Á.r…©R˜é›waµ@µî•¤´è­{\#§÷å ‚†Uʉ ’TÎUÇÃWv)À*Ú«I„y±á`IÊI(j’‚­¢º$u«X°ºsä”(_§!Ðã?JR Í!WsûZUs‹<—ãïÔë‘‚&Ÿ•¤O»Z!kYåI9§ÌGcjö„$ÕFúIÒÇà í¥(¥K’v--èsî}·W‡ŸhÄk¥¶û"¼áefHYòDÑ“$ɶW ó$éÂvîX%‡C¯öèõ’ôå4á¡T—W±G¥åHÒ­È«º$Ù²ä‰h[€f½¹j†°ê²$›| ÑX6){§@5;éò5yU’2Ö ôÜ*Iúi¡@=Wÿ9"|Ó)edß9U ß.hÿó"@BÔ~¦iELÖþ­;­# …¯z”U£©rd Tf¼Ž-hù1X"¼Ô¯¼ªß+G¾ÜÝxWA ‚_ß莯$)~‘9Ÿ= ÑU’žh(w+eçªIÖœ‘¤úÈ«šI7/DIºÕW >VV¦NlÈ·³ró•ö‹ÀôQ.ÌnVt¨Â]Ê·ë½qu›¡Ó›òé¤Ü|¥ÿ*Ñ’”wH ÈörØ$'»AßrU á£|)7ɤêšÃÊÈÒ'š¹A’~™/,:—§ïPƒzÚtZr¨ j(Éåã[N9I*‹Ú“$[ŠºwÑÜeEBµxO ÏŠÊu(á¨o¶ í+Iö3U¾KrèÔ뽿IrHçô®÷ äßWy6%}-Ððg%© ÂK åe+Ü] UûJÙÍ¿‘ݸ›üÔù•ULŒ*ÆÈ‚jÄ^ bhW[ òÑŠŽQx˜@ Ï™ìæ»%IDzz*&F1Ñf’L'» 1ýäNĹZ ‘Ÿš×s²•“¯-Ï ¡˜hUŒ‘Á5®S×g7uäpE'(&Å%YÑ{[5¥‡ÊÔ»£ÕTYÇZtFJ•;zqæ Upœ¾¸_a5•— ЛG¤Ly¢Y_è•q h­5*0RöTYÐ » Fxf¤@e¢­èHúAû§ 4q¡$mxC ùG$éƒN}±GŠ/†nNvã/›$iý ÍÜgTÕ»Dv³öˆ$eý$Pì8mzY 'öš «y›ìÆ~T ÈæõkÐdZ¬0tî »©jr‡!m*­èU(/Ð ‡$éñ‘ªRQ•*ÉyÖ’${¶Énœ!Z… ‹ÊE¨ÃíÚrº ‚DavÓnr¡†e”¨˜ÅÄÈ †KÒ™7Z´E’N~,ÐâDm}Y '˜fg+'Oº(PÙZæů»^Ãn’U¿–4PƒŠO+åÿâh~ž¦~ОÐc*“ZšH\Ï€«ëÚOL¥+Z·@8–^¦ ¯É²×Ésæ±wàã¬êïR(¹ÐÀyÎd±ž^ù¹£_¡O˜©™ˆ¼žæPEÑn0J°ý Œ2„úðå²7ÓëQ–ãô?8¹¬ô-nDòÍ|×Òánê4åâûœÝ}#Á‹¡¬=HÌ šõ¥zR_äü6¸"68ɘðдpùº—­‰}=€§¸Péåüá Œ3vCx –½Q@7_ç­:< ÐǵҒí>î Ü\0z»èïV2=]I¦Ü®ÊwiRÔn˜³˜Z. Wˆ E$[ÎòÚ×ÄV¦O]NgKúé+–òêk¬[Jó¥´ÍúWWó*dÆ’9ífƒY0ܤ‰Û5YX×ý=CÙ›àëa>h/ç³X]„ò÷½ff¹ì:àÒcæ•ê^þ-SÁm±Â¯ÇiÑš6­Ø¶•Ôì«ë´, H›6Ô fïQü½ ™; ¨F9¸˜A³V´iÞ­œ¼TòÞn‡;|¼ ÀÈ¥F$±ý¨Ò à§xZ·¡Mcvì2Ñ1Y©ìÝËÙL0ˆð¸ «·þùÒö­àýE8¡ËCYó ›“ˆíCýṼ3ððÁÏФë_ãÇ‹´JõFÁ}cX ñhV•M°òÆUr¸w2@DŸ}Ä»_Ôª °+™6mhS“Ýðt¿g–j”/L·mÅÐ-¬ÀoH|柘Íâ l-€7 /s,£ˆEÙÈÿ ›¤q$@‚mÚÐ(‚½GðóæÐ%ðd|on âèU ò°É,ùˆ¨¬ßDØ<ÁÇ‹xoyQ/˜Bß ÏæøÀ®³&M~ÛÄ…ÔBÓvع·:AT+€W T¯Ä¨ç œ0HH0;œ¹îšõ”+$”RŸØ­ªø*Døè&µì®FQ-9p "ü´ü~8P>ÈZSŽká+ç ÑD=Û tïÒë!Â'´¨aU èƒ?¤\uˆ¨[?Uñ6U-’Ö-¨Ç*IÊØ(!º­£Ü"PÛ‡¯‡ªŠ@ç’ôÛƒ¦2 4w†ã‹ž$‡äv=fÞuÂŒÚ!PÙ±&…ö?U$``g !Iá†(ë<”ª†@}* á«„,Sw3õcIÚ¸P ÷$éÓ8×aJúfž@Õ3V qK\º›óèaOUj×EXXòajÓ IÊÝ(P»»¥4•u54, r¦”bbÄ{ôv©Šo5I÷h—¢‡©X×&¹ 0‹ðÔ€A @D*Gj(P! .£®m…»Æ?&ÙÌ°¤mÛèÄeE²iȺ­£@=_’$_DTÁaªëœB‡©PåKsú T·ƒÚÖèùÍ’”½Q P=BT¿¿$)O]£êÐC¡Î(èç%iñx|«¨m=µ®Rª»ù—·Y³f]¥^$¨.½»¢÷=4­HZ1øh%±‘`àÈçr&­»Ð ,ògúƒxÛȲÓ{,k>ÈMÂV®=(ã ¢z;†µ'= Ÿ²Ìz‡;$&Õˆ¾²S!Œ¸žøC÷»hY…Œ j´àýåt®„Ü1…ªÁ¤fR· ßüH?0°å’e¡}7—Á=šõpó Fg>]Àñ ´nCËÚœM¢Y+z43W—tò èÓ…œD–üÂ#³ð†ˆ†œK¢å]ôm P=÷(¦Î¢º/”¯Ï¹DZ £_ €Zå°D0u5ü1 l=Î&Ð|ZÔ«€#œÉ3©Èå‹TlF¿Îȃ‰Ó ó =—Vùù;ü­ägìC‡.ÔŽ$/‹,+zåIv §KwÂý©Þ–áNº•aÖ;Lîp)èFô鈆ÓGx•åëM|µ€Ä fMÄ‘ÇÙZ·'¶.¹IØ£ˆëN°ÊãDmÛÓ² =éx–eù&¾^À¥@fÝ^ oC¦;ѵèÔŽ‹ ÔjFŸ¶éIøÆг'ž"!‘F-èÕ äÃCá/2mÄ䧥XÅèi^¼½Œñ·qù2aµˆmʃ¸l'¼ãxüqÊ\Î$(œG_`î@€K©Úœ~°gqA´íH³ê Î_ ^Szw%v0]ê’šLX5^ýŒ· áM´;Á!´m ÙtLãšÈ°ÉT!#‡f=Y±–jþníA“p<¼é|7ƒ/±h?#&ãM¢;±©_±T"ù;]kK1SéG ¨#ïæö"͹@–gí»dì¦bsjMf×ó7Ðð"½‡RŽµï‘¹‡ŠÍ¨1‰Ý/ýW<ú&óʯ|ð-U<èP­YI§j©ÇÍ¿]wóÿ¸œ;Â0nrÎëUŽX+»—àCDsüÂøjÞ ©¼ÂhïÎÞÏ ô!¢~eY>ÿ¿BO!è0ˆø#Ô+‡o0X™¾º”×”J7¥å†ôp×@½o,wí?Ýðÿ'ÑJññÿé¦$ð€ƒÿÄóÐ*b…ý;—ü7‹zßÖ» Ú•™ÿ÷dùçðñ¥åïg7†Áäx–¿ú‘ý£±T¼Þ¦4 î"ºÖ¿aã:l„`ý{†NۇœÈaȃ Ã08c¿ä&å0nùë㬚ˆapÎø3¶uü½ šŠ²Ê’z3HÜ‹Õ‹Õ9mæºI^{÷ÚVÅ®W7ÀÁoè³÷¿¤ä¿îëUÊn®-yYäç¾Ñm÷¸nË|>=ƒ¥É¿çDž‘‰=ûïéÌ#”{ïaLœùçÇ¿C %ùÅ}wü3£|þ;T羊ç¡£¼†A"tðÁðÂnvÜ ÂõÏêEû{0 NnÀ0ƒ “¼5 ÃàþÏ1„=Ȳ¸»Zyû2åcsô³û°Ûå}uφATCòÏ\3¢'íîÂpDzTÃÇÃÕ­½.ÄÊ ’–4\v” !΋e á†Á°` ƒ²µ :q'tTñ|Ð0¨îŽˆapvÍÕ“ôð¦ÿSf?ö$ª‡àáfÞò dÞ÷×ûR6ð¼z½Ñq8Œ’y”È^K@uJ=ÿìÀqƒ~7*ÈàpeEuØ‹iâpHåìhô¯’£ˆ7º ¥:uÖ,¸ë(®+×­âWßž'‹hr½u]=¥ú,rÑ!I5ʨڔâ&[¨‡ëôæ(¡ÿ¦‘ªx¾›-П¹z?'+ªþ°$uô>²I©Ç¢¦öîÓ¾}Úó‡šD 4o›‰™*wÁ(o hÒç’ô\Saház>£ãé)ÐÎ|Iúøv¹éÔ!í߯#ñŠtÚ¯ýûuô¤2œY4«kï~íÛ§½¨EŒ@³6KÅ…Ô|¬~Û¡[Õ"\ ¸ ÖhKÕÞ}êYU eñ&év t[o$Psx¨é¸ôÖ)óJEO•½«ÄçXÃÓÌßpf@eÚjß>íÛ§?~W…@––òTÉèÎg´ómûYå¬}°µÄny _Kбc:¼_±^­=[ÌΑë™Þ]Sø”°‘ÅìíRÌT ì&XÝon‚ú½•'Iêàef³.ÐŽ7L t¥XåHi÷çmqHÒñÏT9Ìì¡é Ij‹°Èæ| v¹¹üÄú72«þºóIjêëÊ£j—/}›%IÃ|L˜õý}M°Oy½½Ur¸ØM{õmd¦ïxø½«_òKëT#Ò«^W9áÇÞ#wªÞWm* /IJÙ%G/sÄ ‡—HÒïŸ):Äì¡R}Í•¤J…²›ÏíeÞm>Z^†—¤uo+"À¼^­©’\{3{M:%PL3³‡ýúö@q즑9‡ôã zÏÓÉë²›~¢C®[gëT‚ò’ÔÇ]A• èSÙ£¿&)ÝÉnŒ¸~®@q3•°] K­" ·†!¬ºTt# ¯SÀn$}ØGx*5IîèöÏ U U`¸|Áæp‰Ý”ïUð‚5uð îYù—ÙMD?×lµ èËÓzë>ž8PHü,N½šÝxhÚãš6M“ÆÊ@Õ:›IÍë w}¾E'ö«E€@gÊHS… ᥳé’Ô…ÕTûiàXIDATÔå=¤ZUÔaŽ$=ÜF §÷”²›?C„;“ŠÙvÔñÍkØ¡c’:÷’@},I6RP-Iºø­@#]içOÓ©å(¤½äP› Näiý“E5×óoh㕧rZzu­Þš ÷fúäN•«-[Š@mS£h&?¥ 4v @ße¹ØM´¹«ž!ÐË…v¿c»@]^ppL'ÎêÄWݹּØÀÓÄ7f7Lhgš$Åú ™ªÅ_ê²Ílu…Ý|ü¨@3›{Úßb²›úžÂ[÷>¢O–› ‡Cf ôk²$mþ@ Ùû•Ÿ*7Ôü%³ç«ÙMÑqS$°›+åíáÝÿ¹ù†íûVwôQ¥òf«ˆ6Ê”Òw ôàÎ?c7Eÿuy@’~~Z ÇŠ¾BóG 4}o‰ÒÍÁ•Ý»Y’6Žhíqs†ÃCå]M’¢0¥×¿Än®ú7øiIzqŒ@oœý šFÞÅTRÅŠŠŽ(n¨ÎdK‡jô YmÇbFü"IQÁÂG9’¤¸á®Q“õá纔w5kû/>W݈›Ÿ‰<¶„bói×Tp# ¯²×¾ÙND@ú)€JA¦n?º2Qåð¬J?/Ò¶"ñ{:awãN»é¼3•ÀË<2žVu1ª’í€H*ú°þ›~¤m=níË…ó¤{ éù;6ðË/œÎ$®+)®T2µ’> …¦y 2ÀœRdeb"ÈI¨áZBP@1”xg9@5$¾ÝO\C¾ý€aý µòXÑÔÀ™ÿÓÞ•GGQtû_Í’IHaWö²0ÙØÂ’„MQ@PDƒˆ²Ã²+†Å€€²>£‚hØeI>TdeÓB„È>“Éôïûcz23! â{ž÷Þ¡''§§ºªouwõ­{oÝ{+ZxË}ÐÚ»SÎ"ª¾ZáQC >B`ónð­ ÁýàýWqy,ÀºÊ Ï^˜7oÍ…ðŽÀ7ËA@¨À˜g_˜²nj®u‘WwÛFcëW¸’ Û7`Τ^€1~ž2EWÀ«ö¯€Z­à‹/–zRÏ@Ds€¥‚õ¦ïÀÚ°õT~ýù×dˆ]í#X"«7ƼyX0* Ñ³øl:4hß&CÐÞÉ ¿?l±I?¯àêU\Ë€”†o?EÔހ†¶Ô®ž–Q~ë«ßˆý[0jj»`êN'S·PLÅU+SÖÙëÖV»ýéF#§ªËÙf“n2 0z5IÞ?A€V$Í|éN]A’g·à¾í¸÷’Ì»Ë+é2ݽ 01“$cÚQÁàœƒ4¥àŒX$ÉÈCwH²è¯Ý`I™2åÆb’äÄ>˜”ϼ[LOg©D^£ l:Ažk^ʸi¼}˜;­–;Ð奒kRM’’™×™UH’´°Ðì Ýì|‹‡í&IæÑÕ¦LݸÆ{Ö°® ͤoy›]9!N0u^àFhdCXe¶‰\<€G®"ÉÂ4Tk™k“¶ ðëšoñIOÂC6½‘LžD€ã6ñ³é²€ðWl7¹ôi–@’%Y²q.Ó&½î!@·r*H€góI²g3üî®öY­6çÏãܹœ;Ÿ^nömyˤJ ÷$@ö‘m7ùJ{|{Iœ&@7/fÉ­~Š'ÀÈU)Ýèí?-÷)@¸‘yÔÞmÁÆÓ pÕU›tãJÉRÞ¼Î[ùrZ*Ì'MÅÌËc‰åq–nÆn^m@zxsãZy`¹ýpv“¹×ߤ$Q*eíj83=›à¬$’4ݶ ½÷-$ùÖ3øÒ2îÛÃþ„`jIŒ“«]±Ž0 ¦'%2/‰kvä‰|ul7ZvÁ寠K;’\ø$fYHÒЄGÏçˆ0°Šf[>ÐéK\—*U즆–ƒ6“$‹X ¬^_ì⧠:ÌI™Ê;#o ¿ŠOÂf»)¡ôjÉ/÷pKVïM’õ]Ùû=»¤vX¾ßèöQ™©˜d þj&ÉErÛ–­äƒÀWäjómføn=éßD>¾DNnFïV•ÝXÑ^K€¿”äï›å,«>¬iÛi{÷-’¼¼ËfJ·ÚÔHòÈûµJ棙Ð?>éÌnHfÉëÃTL²ŽŠÿ”Hrç ¹'u›ÐÅú:ªñVåæ«25p( bÿh¹m¿Í$9º v‰ ÓУí¡Õ"À ó™zƒzÐÍ›Ÿ'ñ³ ˆÎ”ÈÙ‘øî9ÅvS9F×¥¶!|²:]¼™œ!—÷ó‘—Z:Pífc7ŸàœDnŸChyÛAS4ˆ: ½›pÿE}Þ“ Û/±×Û“@ªÕlÊ3e[Ð^!@·.¶\©VsêI¹ÑôkD!2Œ%¤DZŒtw¡×‹ü~%ÝÕl.¯’,nEµŽY™Ö’±tSÓ£?:"_¹ä&›yRèùe#kuI2÷7¬ý y®‚ÛN˪¸9›C©RÑÅ£æÉ·Ù±Ñ\¾ÚŸYKG×úüù½\äìÈ%ìD¡¢®:ã–Ø9ׇz]A o9äëíåIèYJæ]!TÔìëDçÖ`SÛ^÷'>aÛzT«Ù°ÙÖa%’üm'ýž¤FCmu>3Y(š‚í8½ô–Õœ’æ_'TvŠ6`ãp[>E-Õî9›%6’|Í'ôT«Øgœl×x=€Pñ²#½ËTƒá³Hò…:ôhc?óF;ª4¬7¶ÒñÙ®º<íe À†í\ûÈtB0ÈÖ¶à:c Ôh¨Ñs⚇˜Š zj4¶?5ëµáç¿Ø›ìN —;5®|n¶Ýï!çõ.Ôé™r‡¥9|¶Ujj]9|6K%Jä‚~¸úÒãÌnªŒ™ª0pFÎ]$œ+(¥”ÓVÐÙUÜڊξóåJœÊmê®#iض4p¢ÊJ•c'rΞûÖ‹ËãB5l™>¦^ÈÝ_A(MeñDeå o`ÉJÛcÙh :øLAúòŠ¦(YǘòOÆéœüx!*x5ôª’·YîlùƒG§XV¡BÀt'>nP€!lÈ+sïšË$¼þ­ë~|Úh¶èg&,ì µ»xz×L¿› àÀ¾ÃCã&Ôo&¼x"~‘„®dMÕPgÂä˜ä50ß]ק±$àѸUݬô랉߲tŠÖY9 õÖ´± ÕËã:Þ?zDN&UpfúúkñS›$YÚXß·EäÒs’Ž7ö7ê<ü·Ý üB"J„€ñλ“G„††„tþäðE!°<¦é¨MW­™N„ýB[&½jýÌÖƒ¦ !,ÔMzgþ´^O€€{Çf-êd¤g@X&Ö¸3[€Â½í+í̳÷¦A‘p(¨š-ìÝ*þG«{–iPtïK÷Œæo·êýÉ­ {cÕ-­wHHÐs‰I–ÚõåÕœRGñ@*¼Ø#Øp5W"¯Eµ6·¹’sΆ…w5O…uŒºi– ¯ÿ°-|ÈK¤yဈIŸý’_PPpûXtçÐcö¤(ÆñÁGéÆ”iI?¿7öȹ^Ôcû©¬ÛûÖt·ÐZårÊîCï96bvJG_Ã'I©tL×ð)ŸYý>oióÁ±â+?¬è'Ë*W7¾˜GÞM;³+ù´³\DZÒc ¾G3%R:ùÍÎÓ7Œ²üŸƒ qEÊÔ¦@‘nªfFÕj¸Ÿý&I’,’¤Ý¹÷ÛV5u¶3æ#û.v‹{à–0¤¶MÞÐöè÷TcOµl4Âb¼Ó«÷Øaïïn¬`IÒU³m¬*4n€TZtßB7­mŸX]©Ùh¦´&sÝĘè较^œõ~go ªdj_/zî°®ÿʘZR?›8ýé€Ú’ƒ°Ö¬klÖ5Å7@˜é5e\É”–ZbšÛÚb±X$ŸaÏFKÚÖÄ?*?35€ÀÇ vM›èx5õë×ÍßnB hhßçÂæ&×€èÔgùY©žˆÑóxv‘2µ)PLÅUbò¶äHÕ÷†Ð.Ý#"§­?âð¹çgæ¹Öó–ÓTÖjQ»"ULe$wôêíy9 6I7µ1ßh㥅€Fãî¥Q–”Ê…FS±ÖÅÅ7"ûÇ-Ûó]JJJÊ?웵蓣•é#$ f6|”Ýç›í  ô—×ålùWjµ(3*WÜ\WÝê~GSÔ.Oõ  ykÛ‘¬û·àÞd†þü/n¥Û¯fOèÞ²<×g{uè½àÓ™ÑmÊS! ¼´Z—*£MÁcMUz 4ú1 6Ž™Wšw?kø€!»zí‹•OºyW3ÞÉ…¨dÏ|°mnÚ÷±£ßÞ´ë`kOI!Ш}£üs—L†ŠÓ“¡í¤Öµõ¬ž•c©ï£†Àë§ëxúfŸšuÝ´V/ÿ'šm¼z ©Ùaœ. ^Ÿ4Æ`%”¹}~ŽùzßàÎ$„J£U# ÇùÓ‡+µQYÿ»Ôż;嘷‹Óô˜?ع¡Þv›å`!©R)[z)P¤›* Å¥W†tü« Piô^õ=4B²ÏÜn!Ý¥lÜ  pÚÎÛWVz<ù@Fž$L×GŒx{ùÞäÖž:«‘ÕúqÆ è³mu<€âÉ“¾ˆ^ü¦€Kl›z ×쀊Sãß=2pzœ®f›‚¢{ÿ¾! €ƒ§O6ë`#­S.ne*™ØºpLqÏ¥ c e„ê=ûéÙ3'Ž;~üøñ½ GªýbNN˜~2åøÕüʘ«pmÚ@¥Y¹ïwkÁê©CÞýê²¼štWåÛ´`ÛàEqÖÌ1¹é—’O\ Jï??püôíÇ;7Ô—Qxá‡o— ÌW‹Mz}5•â|£@1W…´?ªgHXx×ðî 7î5K,9úfÝй$MwS'ôíûìø '¶ì»ÎB’¹1ͽ?ÞqÀ (ìFÿw”) (PØ v£@ »Q @Ân(P ° (PØ þ¿á?ÒÇeœ ö‹IEND®B`‚suricata-3.2.1/doc/userguide/rules/meta/gid.png0000644000000000000000000007313213051004444016312 00000000000000‰PNG  IHDRz_iÔ›ösRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ6„ IDATxÚì½uxG÷8~fw¯Æ݈! Ä à·âZ(N[(-.EJÑ¢ÅâÅ݃ ¸»]¿»;¿?®p“Ü@ûyÛ÷÷<ï7ç¯{wgGÎœ9slÎ Œ14C34C3üû@4£ š¡šÙM34C34³›fh†fh†fvÓ ÍÐ Í즚¡šÙM34C34ÃÿïìFå"Ç´Îò?´>tŒõýý_5þ]ï/ƸÞ'úªª÷±Î— ú_ïYÃO¿4(Ü gM5©ùªqm 7ù@çKÝÞêÇn8½èÔ)¨®¬Érú0€õŽ¤^±ú£Ñ?ÅŸh¨)ŠømèýÆÝ©_»žÊ??ûŸÞáÏQìgQÕhˆz&7½Ð>7;M}Ôpjá^…*½ØÑ3ü/, øGâeP#ÄcŒúÔ4B³H·(Ëb‚@€1‹Š{a–E¡ùŒEˆÐ­¨þ·,B þ®q՘ŀ~X¿.¬CƒB˜Å5¨Lû) !¤QýïXD €5ÑfcÌhªÅÔ‡ ¤)ÝTó©‹h@iÛ zÍb ~2FêÕÜtûõ^aÌ‚ }cÐm³~A.êNºjf ¿j&¡3oz¯tê%Õ,ÆD½ u{¤3fmSÐxðŸúPx1ê‡!¤gêTS‰žéo¼ ô¾a1" é©ù ÇQ/=¸Ô Hݱzo?‘k=„~ëSñŠ¿ßÏ/K7HµÑÇå“z‡Æ ¹^B"ÐÓ3»ûujÚ©ÿïWBÝu¢êõ¨Áý®>âõå]]Û™´!#„ª3ïºð¹’ „ˆW~›´tëÛ*‚)}ýÓ¤ÁÁá¡¡Ó—m/P!EÅÇ=˧´óoÝzФEiµélHEsuÖ?&,$<,(`ÔœUé"ˆ®Î;ñëì¡þ>^í{ ÞsíÀ€¨‡‚ÑÍ[ºGµ ò÷ í2ëEP‘*–½¾¹¯_çvm|:öròE!ƒ¨÷1¤æ!Hþèô†¶>^ó®$+XµL&©ÎÝ8w|xP€_HÛq?n-¨!„µ³‹RÖ•žýí‡ÎÁ~­[wŠýêܳL†a1Æ -¿±oydPðÒ GRS/Aàs»VÆ´ ‹ŒìÔwìŸqïB€ªJßúÓ¤ˆðH_¿Às)gˆºÜ´Qî>A*Ć„E„¹ÚøÞ®#„²Ê}+¦„tèvðú+ OÔÏkÞÜÙÓ·[ÇèŽ×^Íe0A+REv/Gê6å¹·§n9û®PŽPñÌQCzÆ´ëØu!&¤Ù-A>XÒ¾mTÿ¾½^.'²ŸCG@f/)„TR‘†h•/þÝ': oHûikN‰e4FˆQl˜=6È×/(¬í˜¿¥—JB¡¸øÛ²¨Ð°ˆð¨þ“.&B¸âÝÖã:Gwíݱk¿q'ç€qÙÙm?µôÞyó¹\µa!$˾7}XßV>Á!acl_(A©zñöÄ"Oÿö¿¼e Õd©6WŒ ‚½°cytx`@hXxç~{/Æ!‚xvhÓ׃c<\CnŠVí_½rgHT¨w_?øùùG´ëô"¯f÷7/_???ÕC????ŸvݦËB•É×æðmåã§-ãïïçç8vÚÊÔW'|íœBUÜÚǧÇЩ—ß”X–„äUgw­ŒíѺµ§‡O·Á÷ýùœÐîp¨f÷ê9mÜ=Ü\æÜÌPbõ#iqÆšþ-ý{N¹›"Ò –H8¿ÖÏ?pÁ‘—*^ƒR¼<3tðÀ¸ä¡ÿ„×|’¦‹1Væ>ŠjÿíÆÍãz½Q©~Qüò\÷®1—ßU`ŒÙ̳ƒÚú¨~•ñàäÈÑK2JdWÖNêÚgôS&Œ˜¾F[cyÊéCæ§çÖè6ðcñ‘Í?o;xcé}ÚXwcŒ±lÁ°SWÀ¸nÏò)1ã×dU³ãu³v¾”ų¬N5Ò_'Äö›wP1ÆxÔ~ƒ¦®ÄXqé÷E]G-L-£1Æö, nß5§Z1ËÐJ±XŒ1~qýpÿÞƒ¥äaŒqÉ­îß­À§?½Ø?ªç©§9ãÄs›;¶ëžV\‹YV.‰e c¬(ÿ}éw£æü0ªsôŠëÉ2†Å,¦å’ó[f÷›0¯cŒ ×Lˆ´ýf…cŒYuoEOÏ­Šêþõ£%Æøüš¹½&WKd,Ãœøa`×>£¦Mž²bó1í¨2¯/ ¾_ˆ1Æï.®‹î7þQÆX¹vÁÔ¡³6‹äcåÚáGü–Ô`ò ¯.‰ýöBA+¢ïD9åë!#ÞLÄŸ…···÷Ÿ¸þC¡㪵ëö¤ç¾þº{l|jÚµÓû_¾¸vçú™‡®ÅÝ=·áD*Æ8õæº.=—°õk(~°8tÐ6ÕÄ2‰{061ÃxÎÏX¢Â–‰ëÄrc\þftϘ_O\Ç㲧#£Ûüt:ÅøÈüáÝÆÍg0Ætñ®yþ^u ã„c«#¢ûcŒqî ;º_…1®]ÿíä?í«’cŒñ»S+C:vË“a¶*kÿüaÃ&Ï0pôþ[ÏåªÎ)‹¾ Ÿ¼þ ÆXYöaáø®?n>R­ÐPyjŸ˜ŽýúÄnLfTó¥JÅRÆ8÷þúȈηó0Æ8ãÑþ¨ÎÃ÷?©Àc\4¼Cï;…5º”øþéíÑCGÞOÓ» T°uþèï?—~zðŸ(D½,¾éºö™B[âÅí]ƒÇý”¢SâÔ’¡­½{½ÅcL×åï^5¥C·Q·_ç©Þ>;¶¼C¸ßˆ UcÑÔÍÌ‹íùã ³,‹EêÓ½Ûuœ>aôÎS×µ|}iCdûnÑûÝ­R·%K¸0nôÈgï2ð Ÿ‘n ¦Š³ìÏë«Çu‹¤ÚÏ®œFÌìèjŠ1fŒëç|ý×=ªW©©É¦!†f5 iÛ3  oiÀÞK+ O|?þ‡ƒO€¢V6dê¾M+=mŒY†Œ°B.zr÷yÐEVvÇô+¸t®¤¤R+c³R†Çw›¿hZ{' ôŸ̯,Ë¥Y@Ø5lܹS{<”JæÆnì»n?aS”`·¨Ñ}[É®žx•Só¨Y3†pL"e~8qçà×Þºj¹2óÎ7;’šÖƒ¤HD°ýçm:¸y!W)c¾l@À*är)€Ñ>mά[õVÉœ<çÚÃÎÔüåíK·®:÷¬<:Ô HeJ} BX!S2À2Dákœ²¬L®h¬+kJÊäJF)IåZ¬Ò¤4²g-Â\T­)¡@ŒB.“|šæ!Ëwx¸x_ LŒ»|ê‘xù¶íÑþ-T«:|Ä’#«§f]ü8O®#ÔÑ,£j…Bñüú}÷.úu ~ûú}ž 4êž’¶×ÏiûüeŠzV¨¦¥ÖÂ/¼=@y¡LG–&gH½;\!–vtð”e$ÕAyJ–¬mŒµ9¬c{€îÊy]`Ñ˧wâeµ,eàîÐÎßÞ(,.áƸ:½¼YidbÁÅaD€eˆ ¾ð,_É£H–Ajd˜Û›È*^”([9sa•…åC^5" 8¤ 1´Iwõý|4Ë/€ÉËL-®gÅ=ókÛÅÃD<¡yë6>¦X´ô‹(ÍÍH+­•gVA«ØAí°¤6¿¨ÚÜÈA î¸M¤~˜Q6µ£›C뉣9p-lý-@®dXR3@šÎýXj8¡±ê¯•eK!y®T"õ Uêß8°çð@­%ùÞ;ž“»E"L†Œ•T+˜útK\¤P œâr\RQ›šž #í­JÞ½:ÿ¢²²Jdîê×»wŽÚôƒèý‡/¸v™Ð¦…%B˜ ÚEú–f&ÿebA€1Ù²e %a3pBdyÛÂÉŽSY+°ôêÌ’æ¶n-,¾,O# ºoE½ˆûh5«¾rò V:€•ƒûˆ‘îj£†8#«@е !Ÿ_f8:’£znohÌGuriÒ‡4×^eOâëjaú®& ˆN¡þÞÓž%Ø8˜RYwã|ÃZšqxÛ61¶XôQÎ`­Õ2uüzÚLusuù9…¶.~†B<صìÍ€‹±­7 µC³tro#³&YÆ£××#Uyö‡\‰QwϦч€Uäd¤½5bÕ{*`Ž‘³¯‡e½Õ³äh‚®ªÒɈ 9¼O… _ß+SXx¹ð@V™™ðÆ9È?ÌÃXeµPq$ç.ýܹœð¡½c@z,GJQî½—Vîj'¸qêú¹ø„lǶ.* ¡›1ãñÈïv_OÙÃÁ?v¬²)vƒµ–³úÖ8QÙð © ?<Šfå þ¼”fÛZ;PûHÃ)ëV‰OžcKc#­:qôдUûú†XgKÌíxÏ¥rŠ0Ð0cDO@ÊA`éínu7î¡{ ®<õÁUZˆJë”-År€€Tu Â|S]Y!Ô<¿{ñµ¸ì*Þ̟טòIcKßÙs}µVÏ7qwÏÝyøñ}VØè…½|(y-#•+9†Z>bmUÕ2@dÌôŸbšµ&wÀLµ˜ZñÕO\AÒrÖš¦µ91/¯ÿ|¹hÔ˜™Æ\J…,ÜȲØu`‡];÷=ä;[ò³ß<~š”kÕ‰-­Fʬ×òÐ/V.¾´kazÝæÅÃT;dUÒù'YhöòC¡þ0ů¸¡ƒ¿qbëÎwÅ`URbáõõ_ÚuU.“ò¨/WAz5÷^s—ëX+!$«.<òË Â±Ç˜î ¾)eŒ¬8êå&äÉ(¥Uu ž•k*FF$WÊ ßn·ç,ÝYZêoWÏ?Œ]~Ђ£¶ Ö#ÜO?K×>r0³ÖrjÎF(I½¸õrÙ¯ç6P‘ÊJ¥ê^hß1¡ŸvvL¨,åþÞ}ØD~Õ/Ô¢i>K‚¢îîÍ+ï^=Â,@€i#Ͼíu½ÛÂJ‘u.:ù†£`¾±!<:y¸Mÿ¹\@^MWÖH ¹\ÉÔF_Ë` úyN>Þ€Ù7÷–[EO €Ž¾Ž—ß$Åw q1åj8×sÚÄž‹·¯íØö?EþÛì¦)¼p¹Èi•0€‚f Dòâ³Ydnck¡ïs €lZGOžnÛÒÈ òã?OÛ¼vs—3‹KJJmZ„ZpÁb¥FìÄh%ƒ(+ë>£&gíØ¿ë×u&fþíýì™kôöÆñ³/2 LÇô¶ä  Õ= €h¹™ 9`Ö¥ßØÎsÞÞظn•Ûî!6‚Ž‘Юý[µ©(ø¸w×î |‹ùÃ<)’`°R»#HäÀçS_vK">ÑR€ dXŒIÖä5mÒñWm=ú Ë )£{’€õ!AóÈ[½{ë&kKS+ûÖn$MI¦¤ÌtÑÚùÜL ³3~ÍƉÃÚ# ¼xý…™§_ ËÏúB¾lÐ#]ú-pøjÖ\»Žªïë©£þš„šX]¨}º:;qËÆߊL.™lÁA@ñ)¤”jhFÉ`̇Ï%­ö†1ÈiLò9Ò£'/[… Û££…€ h¹çø¦”vÛZ›QM™ÃIážu«âJMfüðm¨›Èó×-=ÔuÞÚ6|L+Æ*¢®ï‡ŒÊzrvÍîs¶‘ÃæŽíC}·˜®Iï_Å„·¡iZ=f®ès¢ý=`i©¸¶†d¹âøE¿?½aÿŒØ`@’„£P«0ÂƈŠcsŽóò“¾†e5;YbfooO`ÂØ@èL1®S2jU„`³2DfÝlèä'±¹«¯—³¹•­‹›ãÉuN&W„Ø8j$Ryê«—µFŽžN&–VŽÎ®ÑwÎì¸zâ‡QëlÍ “+«< €$¯JÁßŬ)Ï5Ö¬#Šrq4¬JùÚT‰Jår3s!‡@šmbåq÷ºñ®Ï„ïuö¥Fi$.a–E¤ÙÈï~ö‹UËpZØÝ=°äƒAkw‡Da '3B]ÚÖ;HHß(cÁžº&7=§Ê3ÚÃÔˆЊõc?´O>çyE óšMÿo¬UI•WjB«¯ATå&­]¹·ê¾dÆp{! OkÃòwáP*–Éh_èíd!Kþ¨@+TK̬íå%ã“£§ ÷ówëÃËvŸzS²<ÊáSÔ ÖwíÆæ¼å¶[¸x¬—½)äÜÝû85£èÈ//Ž0ˆÀE”bõ,³þÃ'm§ÅBèýÅm‹Ž<0õû¾]B ?ÏÒÊÆÞÁÁá3qŸÕÐ&έ‡ÏüÚ@"-™šð<ŽêŒ1¦„BG/×Ãç ÒªÀÏL%I Ää¿Ž—r¦xÛd''‰Œ½Ú8ñTø'€•Y·Þ”LžÖÓ@Z‹; æà[qyåNjv€kjßè°•Û.^çy<Þ¿æ§òÀ«~ M9ˆ0Ð,·°èÐÜëÇ‹ä‘L囉­LiF^%ëÜ¢µ Zë°!CR<âIÜÝ·æ›…Ûʈ@Àܾ| YwæÕ¾Ï(7ˆò5çžÍ«2ο.Gˆ‡ÇOSî¡\åÕcÛÞË ŽìÐ6Èýâ¶c\ÏðVÈ#¢Çä ã'NÛÞßÝ6ÔÏÕ^ŽÏAÁócÇëì½:™J^>ºóü]™ª7ÕI¹JÂÝœ ­¨­ð>¾¾·qÃâZu‡Óòr8G‚ຶñ.~—’ZÂiÚ½Ä &¦•=–‰jê¤ µ²‡€ÏB`lÊ#Ä嚆:¼8uRUÛ‹Û·Hÿî6æX)ÉÏË—Ò!6+åî‰ÏZ3,Æ"‘–¢ÀÀÐ@Àåòx|®N”Ää”ohd»ˆ~qÜÍ×’N}ÃŒ}£ì ëö›,Õâ}qþxyçÖ@U~j±˜ëhãÂUGT±ª®˜òH’'4Ԉ엩¿ž"òÉ´ð×ý ©†Ò ¨¨ ª…‚¨#Œ¥uÕu2!$©È?úûnã ¿Ìm/Ô¨OÈ.ÐÇòÞ‘sªß>Çv­Lì\Ã"½ãíU „pyÒË5^{óH H\X¥1hJs‹XÊÁD@ÂЈGq *lˆ>±læËؽf«x ؆;tòð3§Íœ9sêÄÉflЈ™}:x€\"Iä!eÙ³ŸvÜ»b÷ˆèC_<Áˆ4ô-¨ÿÄ‚XZ©6ƒpÚ¼o ¯Ù|5!¤0 2:€JùmãÞ2%¨|Õteƪe+)ï^Ý[q®Y{ììM€òÄŒ:6¸Ÿƒàúo; £gMˆí1hðàAƒô8%6ÜâÏ?WËê1—€Žým¯^¾œ_#'ÿCéìó¦b‚ âN¯Ûué¦ëÞ×®5ÖŒc8|â”^}¦w=?~rlï–Ö9y¶_­ˆµÍ~¥––†‡úÁ¦Ìÿfc™‚-ÊùPˤŽýÆ®Mä7?Liß=æÔ¢õûÜðrµÎÏÉ•pì~?0>ûeRkÇÆ üyÑðÙk&]ÛÑB Ë-ÎßûánktjÃÌ˧|¨ªâÔbÁö+ßõâÚÈ–KOœ½|yßÓV¦¸8§X9e÷U@еgï„ŸWõŠ»æh‚KŠså®=¾ò±ÀÀ¤ß›ûãÞ)ÛOw‰¾ñpýØÞ>-- ‹Ê« ·^ z}—4kpo';Aav–÷ämþŽæÓû'ö ]pìûî9oìÛý6·:;¯¯ÿîÝžÀÂoËÆy½FO»>f^ï”? I¡Ìì—5í©ê÷÷Æ}½báÑGQFE7~Ûü(™©^7÷b@Tˌݲ¯·qÂÄqÜÂÜlHÊI~x.xÄ´I±ílZuÈ\ôMݬx陥‡~ßݼ&÷ ^¼mî“?½Pu^q »~ßvÕ,Ve×ÊH¾¹…†Ä iÖ™É?œeI6;?7m‹›…½¦;´s þåœj, ÇÃŒ«ÀÅ Ø¿Ž­·5ðrþö‘Ýžwßszº^ÎÛ³—]ª'&\f–¥e–mz­Ÿ?zÚÊÅ£û|ÛóÕfI18Í7Õ‘Ž³¼Ög\˜—- ² «CÍáÏh3®{èÚ-³_ÞŠje‰Ÿ=Až=GXä¥Å­Z¶U¼¬œ—ë–_ò‚F-øƣ췋‰†ŽÊiïÑ Ë(v!ÝfŽîÝÚEmé—ŠoÒäâigpeóÇêÚî^õÕõŸ~Ȩäü±þÛ³,ƒËåTÌ cGsôs$¯ÌY¹hÎNcCmˆÅãõýš>~öj­\&W2ŸŸ…Tªë7`YZ&W?ÀH›Èߎé?b@èýîV`ê2sÎŒ5¿nísÌÜ d"©\nìÖãÜoßñ±»˜ÃKWö¾·‡•pÜû¶u´‚Üs¿ä¥§Êø6­ZÚbµ‰ Êr>~Ì/ŽÐųµ)c@ˆ-ÉËÊÎ+¤‘ÀÍ»µµ _Õ@/¨.ÊNÏ.PÇÑ£µ£¥*ô°¦¼03+[,c„¦6­Z¹p9@RWšœšãìf#ymYFfveŒâ¹¶ò²6æ €€–Õeg|,®›Úº¸»Úó)€Ízù´ÒÔ#ÄÃF&ªúøá}•ˆV…Sc’kæG`¦®ª8ý}– \ÜÝí,ŒBʺҗIéžÁíÍIiVJR¾ˆ¦Ú+LËY×ðvŽÜòÇÓ—RM<£¤Í]½<mxÈ*ó“ßçÊ1²°sñt±%Ô1¸,ïcF~)œî>NV†*™¿®8÷C‘ÈÙ³•…©Â ]›õ$!ä¨UoZAÛ{µvµ³¤ô‰÷Éwv.>V½jñôÖ®Æúåe*ñÒÏßïTܾº\·DñÃ¥ý¶˜>89‹O!ȊljEˆ«ÑúY%¶†NžâV[„¶4©«*~û6%)mt=ÏÄ6Ä×Kª‹RR³”„ÀÙÕÕÞÆ\5Ó¬¢úÝ›´j9kfÕ¢•‡¥ Ø.+ÈÊÎ+’ÓXhnçÝÊE@!QuYÒë4LQÀ cêÚÚË„~žô!mk¬ÀÜÎÛÝÅ€ÇÑèûtfÂShÕÞÝ@áû7ùŒ™¿·caB\¡ìS8?Ë€­“«›« ™ÃÚÏüúô‰.¶ÆZ<‰«*>¤§×)Toç&¼üZ˜¨¦7#%IjàÔÊÉ’Óä "eÒóg‚–ážV*Ë-[]–÷1OìîçcJiƒÅå Ïžs-½ÚxX«"墪ܜœ²1ÊÜÖÑÃÙ–C±Š’ü쌼BháåÙÒÄP ÊK{] ‰âèÆ2˪^¾IwðôÊ ’3å‘‘>„Æ _ý1«°²_SCƒÿ”ß4S?î¨þ ¶©¿,ûW?kÔ«§Q–e›úPûPõC߇ú†Àê„[é«Y[ëgB•þÆYV'‘ý›!QlãA±MvõìÖ±‡«ÙØû IDATAiO})À¡gš$lícõùÔ¸k Êè1«¡&HYwhê@HÿJÐ4„šÀÌ?yD³þŸƒÚòüeeÕVm::M?ºóHŽøFÆöa¡žº…d’Ò ªªD&ÞÑ‘®‚ÿa\§¾~—S„9F~í",yÔ?aEýšd7ŸTw•z'ĵïϺ9ô*ÿ %?oôVÓ¾Ž ¹k?´ÓðuÝn7>’üWOÿOÂ_oC¤é†<6²ºòr1egeBLaa‘©‰Á—BàhYeU %051ü‚÷ž–ו–×Ò4­â<S+ cBK»:ÓŠ5ÜAïÀ ­(),ã›Y˜hé^Tš'ØØR’šÒ¥¡•¡>Š¢¸¤ÌØÜÖP@6G34Ã? ŸK¯õ>îÂÚ_wKt˜:d<9´xóµZ ÊêMëW=H©Ó59×+ªedµŽï{ð*¯Ü83PmþËëW¯Û°yÓ¦Më×­^ðý÷[œ)³Z^£M¤6ê(kï\¹—‰ê§äUm_ôãÏ»N¤V©}Xx`ÅŽ§E€•ï®ýºfÿÓz k:+¯-ܸq}|¦ìÓ ši¤šá‚Ï &Õ%ÙIo>ÒŸìD¹„ ™ïÎ3P@+’“Ýz)tMPª4EH'°¢6'#n!ù$˜èd;bYÕ'JqYüÓ”Y¿mtç"3Eé ÇŽ6´öšÜ»&OM}C–¾züÌ­ƒ=€n..¬PHrR’² k]ܽ‡wRñªòô„T \Ï.SgÈÌZÔ` ŒBüöÍ›°ZºÞ 4çPšÉ¥šáß’n‚¤4¡¯ZÈ|zdùo7D(ŠRñ qIúò™ã6¿«D„¬èíªÙcûöëÛoÈ„³Ï²U«–¤øºhñ¼‰û®§(Œ€Q¾Ü=iä'Ý\i!ÄñhäÒ3:*ÄrsKUoò^]ž2r`llìà‘Óo§”(ïØ’ÙgÞùmÅ䟯&Ô°„n®8SG·îƒ’oþù4«VÅø’" XžvcóúCÏd•g¶/Ô§k×¾#OÇeªü`E©:Tñþáô±cþx˜FcÔÌkš¡þ]vÓÈB†@!®.)¯Óæ–@A]ñÎUKÅ“†wáJ’f|=“è0m׮߷¯qzþø-ñ‚K`ÌðÍœÜ)ÁíG÷å %ÆXI—ì>•Ñ.:êé]€1ð5ÖÜÌwŠ¡a­àcÜñ™ ¶öõóž=û~™³uúˆ½ïzOþ&ØÕaØŒ•³ºõLQJ† ê: '>þÇ•I½qÈjKK+eâã[—_+°[²ãÃ+Fl[8éD\ŽŠÓŽ<ÿÍêU›[uÛ΋BЬR5C3ü7Ù ÒÆ:Ú$À€‘Ü<úK<8÷Û©†<Û¹=·åè)=‚ìíl<¢¾Ÿ~wóNF KÔØÉá%ÏžåId€PUr|:iÜ­­—:;­zA&ʱ‘‘m##ÃC‚zM^Ô\Ÿ`x|þ<êð]ÿV66VŽ^=:š%œÛO˜Y¸<#c# õ³¯b–ÁBÛØèÎ¥/.¾{ÿ¡þH‡bÓ㟼)ïÕ;ÚßÉÜ. ÷ºÙSlÌH €’®Î=º;í;xô°¾B@Åh›¡šáß³Ý|YàaðËs[þ(-ýeÇ:;.Àë\`³n­\ôVµìëªJ Ê|)A° )´ÝÍ~ßæëù»Fú¼x|ÝÒg¼»@“Xq çÈóûîPœ|{Á‚u ¤Š_¦÷È(”zD9q8B€¢…¥MBY®œn ¨CÔ­PX…öywó±û^­=ê'âü E%-03¨$·ˆÃ@T’ÊJk.Ü$š¬];ÌŒjÊ ß ÍÐ ÿ]vÃ"2_¬*Ü´vÛÖ-s͸ 7 è:c\IIR|Ccú= :âÕµ_¯o÷î ^yëâ›±g~u^†z‰êj0"0B¶mb¾[Pµxóígý¢„<¢VÁ€æ¢šeЉ†±núLšzmÒÜ+ñ1–õKs 0£>§‹-“* !ÐÈ€ïgX¶gÿ©%ß}eÐÌkš¡þKÊ"„Êh²x>uíÄéóÍÊïnÞsÚ…;Vge³&ŽÎÎÎÎÎθ&7« ¸:wëiA§]?¾îy·¾æÚì õZàòI R䥧c.—Ç5õñ´N'QBˆÂ5Ié™-"øˆfš I «Áº‡Ô'̼gŒèqéàþ,…æP+–EvNæv¼ºÔôb@ ¼xp÷õ×¹$F†F#fn™þõ˜‚'gO\Kb5N«fh†føW¤õ…2IYIö¡£ÇŒc Ú¹—\!«®•°f««+«jê8&®3&\°ãðw§qƒ&ǼX´s×î0w+V!I¸æç²ÐV,ª“Écßé]]–lú³×â3 V¢>]ÅÒr±¤ò¡C <„Hª “ž¿î4`z+kp4æþš‡ñZ˜ å5å<Ÿñ£zˆtS!}÷òQ‹–}š¤˜¥ëªkä4 ƒß 9½Ÿ}µáÏb÷ (¤µU5b° ìÝ+ìÀ­3¿UgX(sÝN™Ó~8ËH«ª++«j-Ú·ûzÀÓõÇ÷ÙÛÎëàH6 7ÍÐ ÿ1Ë–-Ó#Ó $ɱtpÕTËär¹\.‘Èlì­í=|¸’'0 ²7ç[عµ0!H®“»whp S‘W%’+äÊÐØqcº¶Â4æZº{zÛ[€“EÞöËŠek¾±à¨ŒÄêCb€ÊÔÖ‰ê¤r¹L*ÃãŽÆ ŒXháÐÚ­8¿@*—) Ûá“¿¶ã\Ck[+™¸Žkéææ`ÎýÄcsï_+c¾*gƒ‡›“™{DX¨µä¬]}}Ým=|„òò²ÒZÆhؘÉ|[°€„Fæ~ÖÆS'ÔŠ%M%¢¨§‚iÿ½Úš[íA#géä»ø¤¯ÕÇ®”ÕXMÓ“7CO€O}9QÖÿO׉h¥ÔOØýt#Õ§&ÿV*ôzBâ:€ë_,©¿r]%WÝÝÆTð/l›õú†ôN¯ÞUÓ”¯¿æzÂúÿ¸tƒ1–Q2˜âPŸU&0Ƙe–%HŠ@À24S?éѱ ƒ)’$¤!¬TÒ$‡Cèµ|fKüÛûF˜UÐ,Å!%ÃS­†«@µÜH’$¤s-bà .1Æ€i%8ˆøSˆ¦Ù7:¾ªÿÐÅO¾ÀkB½¿vôè×>*BG—΋Ž‰é­Ø¾ƒ—l9–U£T¯ –®­*<¼qÉ°þ}zõŽ7ó§+“åJhYÀZ|íк© 7§|;jè‘{‰Œú’@ŒúþÎC¦Ì“¨ÎQв—W7iDŸÞ½ûÄž·rgz¥T}.B¨6nS¿Ž¾“ƒáF‘>aÍ ãÏ W*.Ÿ?qÀÆK™ªTÅU8ȹ>+,¢Kßáã6?ªC]ß³qíîóå2@˜¡YDÔÞ4}'BHQWvbÛòNQm»ö›œQ¦=°,ýÊÿ€v½&þt1±!¤K“oŸ˜=qD¯ž=û ³î÷3Åb9 $K=þÕØïâSËóši?ê=mD÷ÀŠ&è¶åb!BLJÜ©¯ºFÌùåtæÃ]Æ./ª4ä5š¼z˜‚R&ª®’Èh„PîµÑã÷ь޼£XÿÚ­÷\s5¡-‰K§ö »=£\®±¬i‰N|ö÷ƒFÜIÌÓž¨®8uP÷Nwªôf.@ˆ¥iqU¹œitZ#T5ø^û÷S.Ó¢SQÝG~¬–6FU½»¸{É ¾={÷îݳG·¨¨N={õîÕ³û q3î$dê¦ïÄXOrOÙËõ1_­ÉèÏl{zê&Àõ®zÃõÒ½4’v› ›ÚÔ¢×T¬FH‡Á \èVºò5C³E"W›3– 4^hÌ8ü¬^»ÄÝŒ“óâÜìùÍ#M¿ÌŒs’Ÿì_5ëAÉ?ÎaÁÕ¤­À€ÍL¼|ôzæ‚}ûìÏ1"4|þSVc’PG÷ÝòÓ¾§5ã&ΚâjM‹ËïžÚ9yØ˽—zòT‡tÛñd÷Ö/Ïm©¸×DOþ{„”g§ƒ…³EÓ À€ÐÐbáü©óVüô(øpGžFR¹ðå8àÔÉoªJkââŠ+¤È¨&þáõÖNORŒ#{÷&±@dr¬ ÌŸ)75ækgœe1¡®D#ç³,‹$ UKU©q[·ö½xP'w«ÀQË,ŒUB›¦o˜ ÍÍjšaRÕ€u9Ž6B£ï½x–Z,µ¼¿ú:«›‹¥E¨D_m˜©‘9Nºp÷ž¿ÏH+õ¥©@¤núŒYƒZ¸¨+ÊØ=ozÛM×:ØqtÜŸ(\“TI}iµê¶5‚ tû ˆ@$>iÇ Ë’êˆShßw¢sÄ Œ¨’××W¾9méÆ–Bp ]Ô×ݱ,ûI„Ä,Ãb‚T¯ ®[ÿ¥ßb—ÒJÚªÂÚÔ Úifh¤jmè*b€ø4ïÚ7ª;Æ@UfY @„ÖÓÒˆl4‡Ñ¿ËnÔ —ÔÖ14°²ä—÷2%.¶DH*­Apç..fDýcÒ:ÑƘch¤yèlÀ™³âЫåîahÃúÖ13÷,UßýÑ.(4ôص·eÅUNfÚa+%ÕÇ~ÝåÖ÷#•€¾«®µO²’ÞfD_9¢—Ÿê¿ˆ¿ÉšYE O.ˆ?>yUÌ.^:§pÖ¢+iÕ#ý̱fKÓÕ¡Îþ8OÜ75Æ]¿ö¯þƒ,ZuêuïoÇB~™ h %qM¹B9*zqûlÜ«ÔB± Ï·µaß÷oS.ŽÏ¬d7ì—¶ëÐ!7[ sŽuñ„Ææ<>ÜÚ±þFµñÄÁÍý³:w9òëÊì„ä0J»=¦½¼÷&­˜gl¨É½üBýZ‘ÄñÏŸW*)Š•‹±AXÇ(7KAméÇß((VH¹†ö£Ûšr°XTË—ÊóRždTc¾™¬²ªÎÌPV'’²,‹•›òäyÒGÄ3àú‡Fz8YâšüÇϊĬ€ E n›öÝ}- ñ/ß–Ê “ŸçûÛÒ²Wµ«&?½šSÆ Jð ÷v¶Ee/þHä†[–gÔr±¬ZDYvìiÁ'¤ÅY×½ðkÓÒÎŽyŽ­J~÷Æ%ªK‡Ûwn'ööw§x”î­¿9¿ß~Ï\{0*ÆŸP9:5û(jÞÄ?M/–rIFŽùíºº[¢Ä'—•¬’ž™gÒ¥ ¯u`°µOVüáüøÖ]úøÙ+$µIÏ_P¶^­[pž>zT¡àr°\Á1 kåh…’>Ö˜‘µ9¤ÿ@'V}E(BʺÜK—â|ºôõ²5P‰ VŽîVŽÅò4D~a¾ª¬æÃݸcee^Y©GX¿6ÎFIOo¿Ï)ç …rëÞÆÅÓÒÚ:V$/¯È¾ó$A¬D$KÆ-¢Úšñ?¾ºš,km!Kc(ž¸¢Dد]˜7W˵åþy'¤ß0G>Èê*ã®\⸇·ñ"€yråŠAHg_~õ­Ç/«eÀ'±‚0 kél%ÔG6øŸN‹ú9ûÞ‰«¥–>>³nÃŽ£JD€™Ç'~ûåÄ ‰‚mRÉÂõ2oJkËH>×È؈~|$¡ÔzÖœ¡:¸ùwZ²`¦—–×` Õ•¼yR"ì_¯m+/ǧ§ž¾õ<;¿¨Nª0šðãüî.Õ= qwnP-;:úDÍéçðûŽ ÂX# `-Ó¡€àò:<7¸pB­js Ü:Érã^}¨k$‚²`åàöÕÐÁí:µ÷õöê5|RÇ#—Î,$íût r é>aP(0êJcŽå_K. 8ª¡Åp Gÿ´nì€ ,“c@(Ò~ýysBq‰X"Êz÷rǯ›^Êàþ»ö\YTQWWSõþÑÉ<eõƒ[Žßx&‘HÅ5Gßùè]°Ò-kºð´’%˲J¹D¦ÄŠÌ+ËÖ«ª£¡*aÙ«_ä•×Õ”?¾þǺM{JiH¼}fב?sKªÄ¢ÚwN-_»WDðJ¹ Ó ¹œ%¸e¯öý¸á:Ã@mú•…‹7¾+«‘J$)þÜ°eÿ‡2@¥7×®Z~äúk‘L!.Ï?¿cÍñû™@‹+Þ¼~]Q+Ñ 9*Ö^žö*é}¹OPÔÃC2ŸÝÉ“+(?¬¬Žòè6}ˆÏ±ûóDŠzº(oÚ¶ÿtZA¥D\—pa×¢ÍÇh@"Q•”@J3•o<ú.« RžÜxôèÖK)P]’sðÀ„ÔœǶí¿ø°°RTWWwdÝÒ1Y/ÿøaÙowž¥‰¤ VM˜È‹÷¯[|þEÉå«ÈUwi(ihí畯ÿ¾fç‰;¹…åJLÖ¤]ZðÓ†Ô²j©DœòèÚ¦-{SË€Í8ûãÚ?¤ ž^Ú·ãÀ‘D*©É;spÇ÷’ éÞþŸ^ÿâC‰‚¦‹2ÞnýuC\>€Vþ"äÛׯ¸õ¦€­(|±|Á§.WNÞ´yw±Hõà¦ß/TÕ‰Å5%¯ßyô ð°Ùœ|Ò@Óü×¥žÀÈQˆËá{89}5¤? `^7ç\¢dd¤‘æzÙFÖ0JR”ºmûvB°"¯xþ4ɧ[;/Ãôí%ÈÆÕÑ€9~3 BPñî’̤}¸É_‚0vì\Á…£×®?‡ ÍÍÍ­¬úŒžâl„€Ê¤[Ïò{kÉ…ö¾%zÍ¿—=&Æ…ÂÉ=;þÁÓät%W_ÉR7þ 3Ì?¸c¬£¡wÆ€+3kT—›Ÿ~úFÀŠ¤Dû}c;Jr8„ƒ´BÜ~Ú£C9ÇŽ¿¢!ü‹‡bÙZ‘B.u·1SiMDb`ø“æÿÙº"¿ÍÚ¹óãR Ãí[æf¼ó{Oš0’Šž“äòʪ/^[G/=¢'tîôV.0„ B¾KûÞ>WîÉÚDD¶¶S&òŒ \ïåžïŒÃÿð-PÕ+úùÛB.7óë±$|l«f4Ívô0ñÝÎ,zºgXëG»õq2áeQc>A¢;;6ɃÇ-›9 ”À»Käü×?ŽkÛµãþsÙb:¶â{¹Þ\‘SZÐ"þ~üÐß?Ür¾Ž¬­)#k'+åéS)½g­ÚÖú‘]F|;Ë5sõ0w‰1@Q ‹ CCthõÂû5A¿¬›í(ü²ñœÚ*¯Á_ÍŽ €?fl`"§-9dQÞß¿îáË·NV†Æ†R;E ÜÒÙÅÝÅ @F”Ï»ý&}`l8ßÀXÈ0“¦Ž1¨õoõ2á›Äg9;«U®CßÖŽIÏŸAXTÅÛ§&>íÝQY~ðRž±vn~æ\I`ì¦ðÞn–,-u5Ç›/<ýÈ)ÈJó{}"›×Òú:Ä¿Ïn4Ì cÊP`àEªõeK?oBB$AÕUœ¹ò°÷ˆ¹S†G›”q­Ú£Ôò®Z mÌGKߥ‘ÎÓuB•u…Õ; nnï6tʼàNéÅeå…ùiñwÎɘõˆÞÜWÏÞ¾/¹d$ÞR’Xj&Pœ¿t;ff­ûœe†f€£3,ͲŒê&¯Æ®T­ÊTȳ3d+kDM Œhéß‹áF À˜çÖnœFOt$þBÖ~‚ DÐJ]Çn8÷ƒÀ8ýÑ®]Gˆ@Ÿ„¬²¶JúŒ›V´çÈWC®µhééï1nd/R!‰>s×áÃßpnéÝ¡ÏÈØpS`kU5² …‚ai¥Rmº Hæî㢖¨îR6³uïaë¢ÚÒã»w²¦v֦ƊŠŽ§W)gXF©ëìÒ/jZÿ¬ê7ÇÚÉÙ–Ì­¬”ر2¡g˜=€1£ZB–Lµ? ÕÙõ±ÚtŠ@\U‘˜øL¡ôxýè^:‡Ã³4»{bGÍÀ-¦œú³Â2r0œ>onÔè-—º‡t³A@ ¨ª—WÕfœÿýÃÃÓc._^X”q!]ü­™‚Ŭ\ÊßÚÓ…ÿä}åИ²ûiž¼nÍc1•¾&LýlèºjlânÁUáĸM”Þò8 '){cõDò仜|îzîÆ'û4¼æKÌ2r¡Kk{ÕF*~ø¢ÖoU„ê ßÌÖÉžWRS"2׎ +³œÞɱör°4|÷.WéÎÒŒ‚´é¤êM+xB.RJ´’! 5л÷ùD`Ú?~’Ùk¨#<ÍÉÏËOÉ5w Œd¢’£Çv +O{sƒÂo€c*®ØñÓrwÖ%`Y@Ä•Ý|âºËý³À,ót=z I"EM)771¹Zbmaî¼ ö}PEö3VÙä1Bˆ‹ªjª–v†ÜO*˜\¬$yê‹ŠÅ£(ZF³ €0f0ÔÊ…H•iA Ý|Üh¥RÒµ‹ñòqgÞèýs¯´Œ‰ìɃÛñB| Ó7W/ÕÌìa¢a&NAíìü"xBnͥè}¯QÑî4‹)O ˆ$ .‰º)†‹ ’Pi©j‰*|€àq¡±+¢1Xš%¥g3t”Úœ X"­a¡!"`®Ðàéêi»^;ýåC¾¬(³:ቪGŽ¾æ-ó.«©Hyrïäém·ß–ŸX;¦Mça+|:ä<½wu×â±Eßnÿ:¦…^S˜j# ‚\ÏaÌ”8°«Îuà7ƒÛ™)q泫_5±‘#@H7#ÖzIX ¤&ꧡY£L®¨Ì|ùQó–y5 ôO‡ÿ+GAò@hbëÒoÆIÜÁ½çßxLèf´mÎw"~€ø'§Ì[œQ©ëw3w4–—«~sM\-íÌ㟼“ËÔ»'I²·î?1·îÈ(¾|Âà‰ÏR‹Ôì“Ã1¶°'DR)iÏ^<}?|ƺ{vmß¾}Û¶m{ P<üùB•:$ cŠË…P$CÃã ŠTSBHeÀWÛí1€LN×Ê1¿©ënÒ¹Šé$ÄÀø¯‘#€å”Ü?·üñN¬¹éI« —´yï}BÈ@Jù(¡Ì#ªmK—ÖV–$Y~)›ò(éë¤4‚oÖÒէψi{öÌ/»y2^†?¾IÀF>Am'~·ª¿G‹¯^ªíDúäYš!z„ Sž|‚@…IO~·ðÞëw5•²€ö¾-í¬­¬*3o3@„ú| ¡Cý,æw$o¥©™WEzI©¼¥¹…ƒ›¶ MŒF°´:õÜ>2b‰‡¶oÛ¶}û¶ßŸšŒ×í}ÑhMªnÄ·ûÛ’7¦-¼Å7°,˜Z­ŒI)ÇØÑÉÙÍÍÍÍÍI)¥l„‹1Bˆ"Iòä)Çö?ÌÉÖn IDATðnŒ0Ù»½ãË[‡½#ƒ|Z·´ãóu•R¥ºg×>`—n„’®¯õbÛEßX½uuÍ•ÍË®—0Æèox º“ñW’ÕVžšœÒQ ##J„ +s?1£ÂÌ-¬Løeu¥o«ižæ´0nJ0Àùun]´÷Iš„neƵ6°(Ë¿õ¨Ö=²…¹ï31£:ÚXÛX˜rØ‚{´Ñï’ßë’MéÍoýîp þ-PÑrroÝ·GÀÉ›g:FùxšSs­ÈŸ13ºç¨áý£m ˆÌ¤¸{ñ9£Zîm¥{?º¥_α»e0 c L' 0gá¯ßŠr:z"iÅà ‡ó-zìYÑl;õéòäÉw3föîß«‹•RT‘xÿÂý2ï½;#ï_Þ\hè>©c.—Ãáª,/ѱí÷Ÿ\%ë¿ëù»B‡O7sÍ>‹j>&nÝu( ßØØ Ï1aN»ùǾòàRQ]N?ÔÜâ3ü¶þUõþ̹ X4»X¼dbtR߯B<íåU…7/œ&GoƒR`…’Ó¿›Ãɳ§®ú[r+3®ß¼ß5˜|ó(NÞ©Ûíke‡ôŽ6ç)_\ÙMu÷‘üüóŽÝÆõï€j3/&gFÇø"hJ2Z!o3ƒ_Ô±+¬F…YÝ=²Ä08Ø'èž¹àÆ©?]èö¹/Î<ü`ˆYyüƒW–PS|ÿΟNNãi¬ö°F-üeK¿o—ì§b½„7Žï/· kìÅ—ô¶X—ñrþ³½ÆL iåH ÌVU•º_Þá› ,4Pá­Ï‚é›ú¯}º¸G¤PŸ¾¼Åóft·ÞÚÑa«Ö½{F­Þ¿•KÃÝÌ^ßr Ùþám‰¢8÷̹Ëc¢C]œ"=ዉÙc¦‡€C·.åë–f¶šâÎCD÷¾íïnÝø[õÈÁvTåž•û#'¬tEÛ 4…òžiȦߌþq|§Vç:¹òþz83ˆ^´~SìwË°½¼·O)6ú:Ê—“r^-©Pžžö²ÓëÛv³»?!>Û/>  ›Óú®ƒÚu\¸ù×þß"[gËô3Ï¥nc¬,l<Üȳëwè“ôäö•g†(75åuúÙíé¨Åà^² ìæ§Ù0ÿ Ò cK{Kilnge®Vm¸ævf¡kJŽÐÈÆÖÚ€B`daeom®º¸cŒøf={jS›vÿI @Ùúo=ópýøÈ·¯ž½pµÖ,x÷¹«ãºè’˜¹v³ä¦ÝJRB,Æöa±§.hk#»zþÔ¥;‰¡“~»vpy õíè&cÚ¾wùȪä{ì?qîžYÄä{Wö·’•d(ŠŒ ð²à¨”ªRëtî+àK>–ÒP?8+tð¸P7 ­C ³,­T²,£¤i…*h0]Z˜)1±uméþÙ@ë¿ñ\_¤7îóÍš'ç·[ŠÒÏŸ=s71oØÒ£'ÖÏ°`9Fv¶–$#ñüú÷ýZì\·úôãâù›7vR]ÚÍkK¾ß¼{pƒ?önY¿ewÓ°ÿ¯½¯êèþ?sïJV’+1 !„‚»Z´P¤P¤Xqm)¥¸[±RÜ]Š-. $qw_ß+óûc%»›Mà}Ÿ÷ý>¿~¿{ú<ôæî½3gÎÌœ;sæœÏùëÀl‘¤ÁÒ½'º9ì\¿bÛÑ{ß®?9sp8wOo{ éàâîh'Ä·÷òtæ£Æ§n_ ®xºc÷q~Ø-[Ø Ä+—. Aɛ֮/ð³ï5sºܼ|–Òö‡Ñížßþ+&)‡#v÷ö” À"N]ÙG=?µ|ýš A[V/l,àØû4pÕÝ!”¸¹:‹€U«ËËKTÚ0 ª Ó„ÞþmÛDê<þƒ áàömž^IÔ:ÂÎÞÉÑN¬;ŒÆ¬C«QÛF4vtõ’€[õÿaóâI¹Oά_¿1ËeȳۿÛ8»Gü:¿Ë‹+ç^&ä´óöök×)T€sºôñô èãCÆœoæmùùëæ×mÝôÇ…Ž¿œÙ7çK`h­“»‹Ò{ý4hàÎ!`ìùÝÌŽÎgOž®m\ål½½¼¸†»‘››«ÏÕîøD^]ïÝاŠ:¹býn¥ŸMk~ ­³Úaâ »ÿ<¿ö÷ Mz ;·{iˆ¸øï¸$Ž­[7;½Ë>×ÙÍÃAÌ5³0¶nݱDЯSxºy6ôùª™·‡=€Ü±oŸwñÝ5ëwAÀ×—.íéÏ¿ùâãä »†…Ö ›ëçf±Îé?b‰X†a´W k¸Å²ú›XkPÕþßðfýµîW£ ÝÏ,k|ÇøãWhâÔâÑ–ì1ÔÅš¿bT[›ýš{º—Ykÿ³ðHí—My6\c¬.KÛ¾pÔ’ýÏÌJȼ1µÕ½õ«+cüúæÉoGÌ}û± æ>-yþà)»j¤Q#j£.1ºiZkZƒ©¤¶žumQúBLJ1–…Âëa‚5ù¡Z„uãÀ„ }Çîj‘A,c‰Œé#lý|14m\3Ë÷¸ùë&ígY£žÐñh4ÂMÞÂ&µÑÝ1cc\~qÄWK«djü©±d:P óÇXØxÌ`öSã³®9ù¢:ƒ a/„aÿFÔ€6è<Šµ†Dé]µŽØJgæéˆ!d ÆiðÔ¬‰lC\› ~²ËŽ:ð ‘ÕC@Ôd¼Ôùcb¬} ™ìe >—ØÀ¨öÐ] ä¥/Æ]³¶Û!¸R+¤¿f)Ńk'ÞTÏœØ^»nÕÞ–¡”ű—nߎÉÑX^Èh£”‰o¢n?Ž.—ªÌƒXUAÆ»ó÷¢R `00ù’#B‹TãÞZS 2f0´¢ÐwŠiä‰Ñq—¶Zo)¬ÇÜ0ɉŠtÎÈz? 0 @Æþòúdš!™Œ ýØÁIÔ 0ròÕu2tœ¡“ B¢åUçñ‹"ôŽú„6ÂÊtPÔÔ ºªI}ŒÂ:–µçèÚ,£×µó¡fH¶' ÜÐD5MÇDM[ÀÛ¢}RsbxÊNx±ÿDLƒ¦8CÝ‹ #p=Ûú´.ѺæMD¬ö¸vG]sò¿»™2o¤ÎÚ6bÁa¥V“ëÒ9ØØÿÕrFÆ~7€‘H2cÎwšô7R¦¦\ÓtÀsUÕRG¥€j1]—ßîÂ8Ç&Ð4•[Å»à'ýÁŠá[ßnÃ{º¼}›[ÍZ¶ÓèÎw4Ù©ÕHÜ­WG{‘n@º4lß½¥Ë»·‰¥2ª¶Y4™×b.LÓN1¿B`<f)µmNúž5/¼vê³8JÌ®-]«]ÈÂk†!WÇ‹&ì˜É¥&0™É¯ö˜0Â00ABBµlÖ Ã™<0TäeÒ :®˜ñ• £ñõš-Žd.sþ,ϼ:‡Ñðé_Dó3 æÕþµÄçÚËjÃF „Ì0Ì!²,³ÿUÂ`ÆP­ ýÑ &ê…0cjZs?üŸ$ÝÍ$læÕ¯•úâ敧 µâ‹ÂÚwïH<ükÃî™Fø–‚©õÛ\kM»À ÒÄsû¢$Ã{8>p‘û~9àË–!Þð?¡kpC½x7ôE]8uàÝX5Îÿ=]cãó¿Oãõœ¡ä}|yéêmŠÃGÀV§Û¼pâôå ª-¢Âèñ;å‹çlȨBø3Îmt&©¿­Ù›…Ì *F[[£¥#(²¿õÖÎÍÓËUûüYRz‘‰ä¿£— Û¨µ66û·¾Í”Ñ»žrÀ uøŽL÷e¨ÎÍþ?š8õ6åð'Íç@)i–Uáï¿m\½j×o+gz:‰,¿£H‹{Ÿª ¸–·<,Ƶc¡K‹‹SB{±PÛ:…°,6Å æ Ì2X"ô4ð‹Ä¹Z¤.°ÎO+Y韨nŒT!à"®cŒÄèßmìÊsI%ežÎâ¨}S=¬q « ¹þ]þ²8”“²eÛ®2yʺYÓº.ü}‚ë‡ñ—gjnÎ’Ð]]«RvßzS%“•¦_:¾÷Üõh I0Ҽ’2¥gçHÓË÷WËäÕ¥wþ<±ÿÜߥjðiÛÆUž¼ú¤¬²23áÕ¦åË®=Ïâqy,#/)ÎgíZ4àïÝr®¨¢ºº¢äÉsÛwŸ•´l,¬Ê¸û*©¢ª:;áù±gå"ž5k·•¬ô#TW „н‹æìºÑ‚ËR,Æ<‘sxën_éá*²€Ø;ç^} ¡„ÁÖÕï«aû„6º`ÑÄéñrA‡I›'øå;v8©˜F‡gçܾ×à¯:…ÛÙ ¤'í9sM®f0Éó ëGkµÀ˜­*+,«¨Æ$ßÑÅÍ^,Ð%]]N]†R—WÉ”˜àØ;¹º8ˆtS^˜_©!ݼ€²"ÿÒñ½w^$«1Á2l§¯gLÞ‘‡°¼4óÜ¡ƒwb’ÂR§ã×£gŽì#à’zd:@¦%Þ»ynÓº£_}¸º{#„V–gŸ:´ïþëtše‘û·Óæ÷iå§.ŠÿcóÖø2–K,âµêõÍÈÁݸzÄ 㼤˜KçN»øxÀ„Ÿ—Ìf !¦5ékÿ–åÅ.ž8áiàÔ««'5–ò§ö¸þÖPРyç™SF7v—ÔÝa¬®Ì¹óÚáƒGåývì^Ú%Éû·o‘Z$.}GLÜ%„©*¸|rߧ jL2ŒÊ·eÿ¹sÆ{’Š7÷þÊm¸x¶‡½$ÀÀ2ì‡Çî9xµƒZI‡ö9kL?'1¿2#zÓ†}éÕÌPb÷ɳ¦·näÂTgßµçI|ÃRjJ0à‡ùcz„–¦Ø»ve2và LpùòüwÑ©ž17¼ëIíWO<Õ™õƒúÌ}„1ÆX~÷ìšÑs6°¼+þþ¦]Øü ÉÓeyÉéù%yÉ3 UE©…¥…‘f2“Þ¿|ù2!5G¥…g–åÇ%ec,}ý2³D£,ÏNÏ­ÀjYÂí£Ã}¿ëðÅ—¯^Å*±êZ^UŸ”*S¨rÒ’2 Ê)Æ@šM~ûhìwn¿ÍÃã²Øoz†¯8ócŒÕ/ûµ˜dŽé\8¤YëcÉrã[w.½äp¾Q±•ï'öõÓ®¤í:FvóðŠNm{>M-eÙ’qí;­¾dxýÆîŸ;ö•˜UŒ1–%Žl>²¬x¸ôù©±ßÍ8r÷Ï~=î«õõÿ­Ï×߿̨À—½>ѾE‡Ki*ŒUÑWv 2õU®cœyoëv]ßäVêñÜYŒ1®ÈÚ·fÙêýÆuïµñI††Á³ŒFyÿÄê^Cæf*1ÆøÖ¡5+E+Xü׆am­¢0ÆgÅœÐÿÛ3Q%zÎX–Å ­90ÌÜ…«f¿ùÀ•º€ÜYEù©=›Fvk=rÃÉô*cLç^ïÙýè‹bŒ±<ûÍß|õÛéÛ㢔ï3Ë–e*áÜÆñ3¯Ù²fÚ3õüŸ^2ªóÈ%2Œ1Æo®lí7øû˜Rw}ÿàa¢RK1ƸôåÀö!?ŸÍQ&ÍÑoÃq]ðíú‰Ý¾úù††ak£…kÿNþûÂÕ¿ŸdVY@w·ò]òúìÜ…+b³d¸ðzŸŽ½=ÉÇ㪌E£úLßxÞ€ ®}+ãìòÑ~Ú{jï°!?¤ê,¼Þ½u÷óñ•Ú äS  ˜¹ÍP]üÅmC'Îîr*Û|Hh>>X8mö¾ç¿jÞî|‘®´ä7‡~Õ÷ðß0ÆtÖý~í:ìÎÅ«ä9'ôž·ãƘ-ü°~Å’èi,kÀ‘Çeé 'üãÒkŒ1Æ¥¿|×eȲ[ WÄÝ5jê¶{Æýþq•€¿âC\l¹œÂ,+-‹ŸÐ¯ÇÎkï1Æeïn.^ñ[rn9ÆŠUßuŸ´æÆ«ËŽmZzôúKŒñ_;掘²©o[Rg]AŒ´"“p m€IŸn}:ùÜ;{¦GÝÉqœ?ó Ð(içàŸ–®ˆlâ0Ú9¹xø€–àäéîÌÊå€YÒ¾Ñ/›7Œê¢PÔäSV&nZ·ú}¾ —ŜͶë2£_3BaÖ{õ’Y¼ óÏK©.¨*·`Ũ>‘ wíyÁØéã}l(…B1rá†y£™Û+Àë³kÎ¥,jHô/l¦jY¬#‚ä’5'@±©J§–ž¬¦üãÇdÅÀù“Z5kNÆÝÎÈ¡Ä-¿¿iÃéäõÛ~jä$)þpçðÙc7½ƒ¿mB¾¹ñÒwê˜ Á^Þd~l^N~9Üš¶‰ty^Þ¹g¿ö ²¯MúýUæÐN~|µRöúùCJ<ÒÅÖ¶SßoXûF|˜'dçènç)oŸÝ}UZQéÓiô¨/‚-î 1„¸$` Íêê-Û•ÞÝzê¹Õ‡k°0aŒ„]¿è¥Ý @‡kAq™RÃÐB.XFƒäêîzxU°onÀª)£¹<>OQ!Å4€Hyi"@_¯ ^zž_]»K‰œDFhΘ+qj$Ã"TM©Šó ”òØ% öHUjrŸ³rvSn÷1?^üq×öc…M]¯=qkÞ½WG0JñŠتEuAÅYö„¨.J»|íY«©ëCbwßËcµœð½›÷ñÖí¶Š² ¢“=;ø@øÀÑö6$BîÍ[h’T´‘!%³ DЧ¹–‰$eddZ÷“BèõÕ ¯»µijƒ ôÖ(P¿‰¾]ÂñÓ¯ |Zôñ`YDªÊ‚ŠÚ 4.cìѦ“¢¤MŒB!C¦öŠß¸fuç¶m‰ŠôÇ7KFŽEH÷m?æÕ~`÷fûÁ‚ÝUìPad6%H®Q©ÔRšàÉKYJRH~níÊì )­”9ö˜6¶Ÿ‹Äc¬Ç6B»&ÍBŠ2ݹ“[T.·7¬3ŸDïÆM²UÆ<óœý¿?¡± cœñø-Ø5Ù½dAš)åÊ–}¿Õ¯}Ù£7¢Æ–΋×9ªr¾Wø÷'údç02æØ–û¤-—©,§$ƒÇÎèo!LÒÖÓ¿ÿy•õίÏ΢IpHYafôýè,B1õöïS' |wOj”ßÓ«iߎ$@% $Ir¹èâ¡ë.½g÷hÙü|¾yùú]Bü° ŽF#üòë>-=lUç!’$ØÙÛóy''¶Ž¿]}ð¼Óø.2En\¼|àî/ yd'ãY`$A¶ªª*?/79%Ù¥¥·ƒ£È¬™Ú¬»ˆ  ä}¶FíhÃ…úR2%¥Œ¸[0àâáŸf™Â„˜—ö• šQWæž8tÂ#b·³3àòTTÖû èâ€XDÍ{¸–ùµE‹ðOŸ¾àòe›†ñ÷%æi„ö”¶}, ¡ø¿¬9ñqÞòe~º7ò…4±õƒ²4¿šŸ‘=lêL(ÎîÞ¸jå™+Ç»D¶ðÙýäQt•'75=-lP?7‰a(!ãÖqö‡1f4ò‡·Uûtæ÷’2θ }_–ûfó¦í†õïÞ ¶íÞиfi™š±‘ðXH ¸ £}iDÉ»+ßÏÜûÍÏ[zzsÛ7mtëÙÅÇ…déÙ80Ø[gãF,=·bYlçÐÝ3€¡T¥¹i®Û¹ñwþ/Kº·ò0ê Œ’åg>¸ù<¸Óø†ö„þÛÀ"‚`Ê’Vþ²5ùýàpæÆÕôDcŒc›ð†gv>±ªr“Un#‚½àÕ_Ç“„ÁSö"H`³Ïž±Ö3ž.ÌÁ{÷J¾ížÿæj̇\3¨¬T¨5, è:#Â[–þtÝ§ï… íÆћմ$—Ë óò“ã)ç–Ž®öH7üÌ’~b®{^îÀ2TA¡¼º¨Ð~ÄOÓ}„9Ñç·ìßÒ¢)¿ «Ò’K¾\15ÂMUšyþàî£|fFpTy¹™þ=¦ôo+áCìùu6ìèxféTÿÓ}‡9!º6÷ÒY°ëÖü\uCr9e™ WN!šÁÈ#¸óå«}ÝøX­À$Ÿ/v"VVÒ|Ìgôp€@"± Z)—©¸xð1 ¬¹ýˆeîâé-;l½¹q|犨3E Úöõ0¶£v݃k×=8¢3ŸT.œ9cónÏõ³û›Ï‚(¼°|ÂÖ{CVî uÔ 7Mzºr¢>fhO¾°i§² }û`ò3 Ípl쿘üKïÎmœD<ÀXàÒbïÒ~Óúõëýã¡¥ƒ\Pjç jÒíÛ­$góî½7Nƒ¦/é˜õŠ´Õ~¶ Oά[¾ÿíœÕ+ú´$jpáQ݇‹©®R!°Ãˆf±R<ý‚9îÌšé<ºóäÐPO(JOHy“#;kÕªîkTùzÄÈÙ=ìX0CÖ¶uI#„TÑ~:»íÀvo{1°ê´Ç»×¯Ú¾jñ€+½ï=jVS€®ùfÊ¢p\†-Y¶dß®Ó'_ê5~AÇ´[Å„° —´stÞ¿³» @Cï®×<øÝ»m¨#Ÿ@¸&ƒ‡oPè´ƒ¸|þñÍóW.ܶçl[n}®$€Ä6GÿV#»„€¿ÿ„ûw§üX<À”]£iÃ:J€?iiòž;¯R#ï0ô‹‘ÍÀwÖ‚Ó=¦^*€Q€BŠÌ?_¥w:TÂçÕÙõÿªº¡”ßÖ=—m]€("’ j¾^¦ÝÂÏËŽM©VZ£¢ž WƒBYbIwDZïòökÛoyó+¾–غ÷j£µsÍ—!,•ÿâMººÏ€b>·s´=˜‘пö¦Àõ˹+(bÖ¾m£zìöqë9Œ Üûøž ªžMm ÝÚô«¬û”!-—×aìO+†S IˆÐ>J^´õà•¾söLïí ¦‘ØRE]†ÿÑ~0ƒÏãÍ=•åÔe D?:¿cë¥ô_wîèÖÔ]û¬aIa´14ùGàâg§®ÔmÑù< ¬ ‘sçaa›]"<Ü}T^Q2á\ô ],óá슨÷̨ŽX† S¯>zxu‡—“¤*ãñØqózþ||Fß&:>M;ÕÒzº±Ÿ«ìÍåàî¶ S«s¥8BäïN­}2mõ¾ÃƒÜ ÀLEEr¾\<¬‹_€P3¿àÝ7oU(ç E:|‚ÆÎY$c¦x % àíõuÛÇ$•öŸ2ûÏË«½ÜœHS%ˆ€Qd¾á‹¶hHêÖ;!M¹;rÜ‚¯–žšúES04¦¦=&îPzk <ŽÎ‰“¯³£H`ˆukÖ ïÝ}0*ìÕ«»7_¿[ÇEc’´Û6 âÄ—¯-oa²Ì1“Æ!ÏKw¶^Dc>Ÿ·vævû†CIžžê?³HR7[m¸†aâzØŠ‚ø;Ó»àÆå –þ§_¼k˜úÕ ÜÖ[~G­—Ï#¥*: ²ê|`1$_ Æš"G_GžˆO:ŽÈž”ŠÑ "?%©¨\øµ3‡¬óDùÓn~–æ#A@p¸\.—CÆ_H³ýMÁ7£ÂR¯Ü(Àã>$5õ ¶á2,6é=ý0ÅÒjÀ®ß ¶WW¬~YÍûjh3@@—••W+Xl’¬´0mßþÏ>TPÅQžn~ÈÒ¦€JZëZœþ±\iÙ0¥2¸Ëdw"÷·•;J¤j†¦1£yóçæ•—_ÚðH£ˆ¸\.—Ë%aØÙ)Ë“2KŒÿ¦…½€0¤öÄ MÓMV~4z{çø´[>æʸ\^AÌÑWivßN€ôW×5fþÊnM])ŠÒh(í™TqfjN©!IJ C3†˜š¦(†æñ­ÂZd>ÝWB~ÍÚ5sü›5澸ü€eY\^^œW¢”ØzpäŹiÙEÚà Š¢i†„Y #Ähd©))2šürMLNÊÛ§OŸEEGžÔ½åÈ9÷îõr’-<+xÆù}ƒ5J£¡–AIK ÊåÚ³†¢0Ð4–a¥i²m—ˆ—û¶JY†Ö(òR^‚}ÓÎmªâ®,?»lãÒöYš¢iša‘HèÎÓ}|U¨í¤„ô$Ž @ÄÓ®,0ÆXäèÞ¾c§Ž»ukí$Ü]4xø’ãž]Æ>y~wÑøþ¾îN$a–²hEuNÜ ¡oGIÍš±ä§Y¿4›sqjï EQŠaŒK)³33*djMÓ¥5Ü°Ó44md/-ÈÉ’ªh†fÔÊÒ÷OªøS¾íwÿuÊëWÑQQQÑÑϼQÕÏ÷^_[Þ‚Ö(ó22Jd4Bˆašbõ‹ Š¥h (?åí¢¹ó®<ËçóyÕ©7Ÿ½Õ ߈C¿×d½›lá«ç9%­»ÙÙå9ié…U„BQuzï¶?ogjÛ“ü/j$à‘,CÓ4MÓ, ÀЀ¥”yyy ƒµÏ$—¬;§¤AuüÍØ<¦ƒ@ÐfbW6nÍõ@¬º"÷ý£»v üƒü"Û{ ÏÝySR­dX6ã¯}i¶!ýèDš›ñ^fèdëB OeªùÜÕ ‡Ë ŒÎ±Œæ=‡'êU)âðEBµÇ7 ¿7hÌàáí"B’cž{´0¨OS(y' Hýá?Ɉ<Ø{xºhvmZ?qã”>ƒõ_v|÷ðßšst {Öý¨i6fþèžv<ƒå6ï2¤é­%ÓGñv¬./.Szïß9ØÂÉ…î‡cüýŸ|¡8G«•EÎöÝ>{òÜ!®ÙŠl0­.“qgn=òU¨'à2¡XlÃ%J6òí@À!u^ zO:€k6]}‘Œ¸ówMwJlßää‘—WÏž÷ÆO̤疌Ûq$’´¬ì̓©ÕŠ¿ö,¾¶`µ‚úbѦ1ÍŽÌ—ØgÓá©í SßÜ¿?µXZÆ°‰;I<@J|Úm_5­×¨‰1?L3t¸Ä†É(æ®Û·ÀΆœ²rÕƒ™«¾I jæmýʽÛèC;Àëýk–¦zÝÚ·ˆSýxҤ݌˜_Q^ʽ}rÄís&,ß7弞>qÑœƒOú6®£†ä“ Åh°!?ìÝð‚ñnö÷êqׄ@-ׄ}=~úˆ^W—O=å2åò’/VýDzy/r䌪ªR‹ÇŒ’x·\:oò·‹V¼è?v`ŸX_w2WÊ5{U[¸ôg,VÊmXq\¿!÷ ë»bNÿ!_„l_=åC«0¶ðcL¢tþ‰ ‰uÉ‚Ì:™í´ââcžI–¦šÎ1zšR1•y”K+/]ÚÄø?Ö¤0~wV»Î"”†õkÕ}ÆÜqNEIË~üµ×¬íßvòÙ²pV\™ŠUW«5êţǸ4l>eÂøÐ &¼?÷ÛaÍÚwâUe¼K«6mECc«SÅÙjªl¡º0mõŒ…óÏíîúòæÙ“Wî*4Jµ»èÔÜI7ùdó£ç|Ö܃ټzöwÛüœìnó7õõ°Á„¶>ó7ÌúaίOxÓÕ…j¯ÞóÛq®.šxªá¼;+û{x6›4¢ýÊUß?<âI)+òŠ¸+On–Øpž\½ÿf2•¥´b׌ïp¦Ì.Ê™:}ÙÌí—{ÚÙJZ̘ØqÉô¡7|=*ó3ûþЦ‘7gÕï‹FÎ2ô´¿˜*¬æûÏýõkø~ÑüØ«¾ÿþz±:%§bäÜ]®ú–*JÕO¾X`é¿3uvýàCùÓnïè@—ä¥g—Aph ÈìƒÑ”fÈUº‡7õª,ùE:Ž kÌã‘pÒ›çY¥2gïÀÐ&¾<Pf?{WÖ""TÈãfªsb*\Ú…yàẨÉÙ¡íƒ=ĬâÝ€ÎsܸÛÕ•À¨“Þc[ŸÆ>®\ÂÌ9“ÍI|—š_Á³s‰ˆl®õ,TV=ý¦Ïæ-Q—ƒLXÍ9fæ•¿ºz /f$æ)A~b®Á‡V;Vè±ï *d\¡¤Yx¸„«ÚwO_ š»Û×ö<”çßï7pïéWgÝMe˜öáMNi5âpH†¢0‡çãØ° hª>Ä}(’2~MZ5r²­ÉMML-ª$ôÖ\†b½Z´ v¶IyþLêÒÒßIVYœ””X¥`y\.°4Ͳ<¡sû6Í˪b_¼(×p›…G¸Ùñu& EÑ˘„J5võiäC@¥ß%ÊlÚ‡!uîýÇ9|I’³•Æ58,ØÇ••¾xß(¼³»¸F‚UYI™Ac?•¦Ä}(¬šÑÎd†¢ý‚B¼‹b£sxþmƒÝ€¥ß¿Š.U2‚C˜¦($tlÖT(à# Þ¿|^¢$5óu·`sÓ’³r (#³²ÈÞ=²E0.MKËÇ|»ÐV­]…DÝÃæîÄuáÐ*EjÜ[ää.ÔÞ)MŽûX\EÑŒÞ<ÇŠ=C‚ÊÊwï]†z; ^?‹ªÒ0ApDSÒÖ©ip“Xr’ߧdWáílò,"Ý·kbžE¹Gtm ¢*!6^Ü8¢± ¿ 3%5+—f .—dišEÈÑÝ¿y`Mvb\JÔ½QhˆŸ³.§7`„¬(íu|ÏÁ»Uó í÷.ëÕ“ažyL^ÔýÀ*Ë2²rÞr·úsã,¤µŸ€I,fý¢Ö6H‹òŠË^LŸxlû³ËÁÈx)#Ö©‡ÏÜßÆtnæéloš½Ó4±«ƒÉ-Ó¦aTY’ÿþá‘ù¿—<|´Uh’}ÐgdïýÌ„™u>f¡"cÕYwhký¶£?g&VÎG3ÙÕ)¡OâŸÔê›ÿô9•<>Ù–ºš…ëJµl^ô§SNÿ’4Õ¸ëÊUýÉÒêÈ| µƒ@Ì’»šÝ¬Êÿk¶;g?7öí‘ã§J-Ë×,Y}íÜõæq•µmôúœZÖK3Ÿ?°+Jî÷ëÂYÚM `³ VÇæs À»Ë'Î^xåÕ´1ßD§€í¤éƒâ.:u= ¡@æÅ¢: ëÈÒî¬Æªøüú‰SWâ‡Ìš #~QÇ?µ2÷}Ö8«ó1 ¡:»à“uYêÄú{ÖâqÁç´¡v>St5}ƒÐ'%Y«èsÚòùR7„ç˜>GzŸg`܉u5à“¥Y|Àˆ}ó'ëºùYã3W7¥yÉù%R5½‚ZyÚÂÿ)+²“2ËÜ6ó”p-Úð?I9ï^äk8¶vÿ ÆsuÌ||ÿ^ v­BþgÙN{#E¶¡Í‚Hkfo+YéßP7µ—½ÿíyT{Åþ/NÞÚ¸€`ÀòBfÛ·ÿXcL—Êæë&+YÉJŸ·º±’•¬d¥ÿ YÓ§XÉJV²ª+YÉJVuc%+YÉJVuc%+Yɪn¬d%+YÕUV²’•¬êÆJV²’UÝXÉJV²’UÝXÉJV²ª+YÉJVuc%+YÉJÿ#ôÿšï<=;GŠ8IEND®B`‚suricata-3.2.1/doc/userguide/rules/meta/rev.png0000644000000000000000000011560313051004444016343 00000000000000‰PNG  IHDRz™®ef_sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ •õ(ë IDATxÚì=e@”Íó³×p4’6 J)Ý"(­¢‚v¢ˆbw‹-&v`ƒØÝÝŠAIÞ×÷ìÿÃwêûþâýÿ˜ ³3³³³³3»c ÍÐ ÍÐ ÿz 5“ š¡šÕM34C3üÏ©›šÝÖÁ¶ +úRû±vcˆq½/òFùï2u|üLäû•ùAiKÐô?¾ÏUH7¥‘#`“è+- |ä¸q"7ÊÍߦª‚ýñ¿ˆ7M“ñ¯¶ÿ¾iZ èW¨Ÿ­ê<®øÝ•%èïÌÛõƒ Ã6º«ýA]Î×óq è- ~þäS¥ÆÎ. X˜èâi´ìÈg£š‚Ây>öß“²·èb€W§W[}²’U¥Ædpx]Ö3÷wÐ Bï¯m8mùÄ£Û#k{¹¾©ßÔŒsÏ^ñÓ&­Nˆ9ð:_ƒN­“r‘dýÑl3=Š"?Y„ñ:;æÙXûiœWgÇmïúµg °öú¨©Á$×Q‘Ò¢ë…ý ‚üÂ.W@¦1h„ycüîÚwß!Îîƒx)žÆ…QNîý]].–ãÕ ÑC7žmdPõ᳿MàÔAΉ[^Õ¢>ÎÛôÀGŒqåkÛ´wåíˆâ;ïy­hì I­œV5?(­.%QæÊ´ŸD#ðÉé.=‚1D@ÆÄÚH›Èí/0~áaÚóWaïÂUƒbgŸÅ˜À˜?ÐÓrCÎÙ!žì¿$[¦Ž ÑÙyÞŸ „OpÛÅÜé­°îÛûé6Î_8¹º~þþ‘.IÇRcmÓ²‹¥£#"¥·ßÄ£qS@DJoß䄧«j‰xs²{¿ï¤,ö3µ9]Þˆ<ø8X¿­Tô‚ø6Ö•"êW—;ÏÝÞ1#V$MLIB!Ãë}*·öù†ñ±ÉÎ3Š%eœl¼‹ ¥ûvy§}ßaMOŒIÊ61ësbT€kP߈¾¡‡ž €Ë«üü’²]\|“/#„ÎoŸãíææêè={û @!4#ÖfljzÿØ¡#†pè³jŒ+„Ðõy1¸°<±ß¬¬¨òÕØþ½=|]íí&ÌÝ%$º» oJúì„#G„xØ»$k6r¸„˜¤@`,ÐI¿õvrOZãŠzîÖ3S„XÔ>Tu¿ ;í Kö¸+m“¡ÖROøáe)Æ€ n^ªho©É×õ*‘(0 •t'æIâ–­¿¿}쌜UIˆEÊÛb@™¡ÚŸîìžéã`jo発ûB]i׳OîÖ¤QcÇÄörî¿°!öó£l{s èÓ®qfQ )D–ÚÎ õè7aÖ¥ÇßÁU< ¨@£÷^;4Ä\ZJn€˜:6mwÁÉ9§¿ÃþÉýXŽ)£¼L0FµR%Á„DŽ&bù¶ª‰)®³Î{Dj0xe•Â&ˆŒ14=ãÅÈÇPwï³Ç2” ¿ ÇzÔªžûWž~/ÏD +•,a±˜PÀa„ö/ëîäÒËÁ)0íÂ7„<_Þ6`ξ%cFîë0,y; I„»ÙžR±¾ØØX~a‰dÄžlGwŸßšI„fÅ÷œ8owüð1Cc‚cÆ|ÌY?bä˜ÁÁ#W`„ˆwÌçâîÓ·oogw¿uÇî!BT:qpoGï^!A½ŽžHkoÙO€·ðŽ¹¹y!W £ ÐÅ7Ö«%¹š"¥ÄK$õeG)Á›ëAÎúÑ?4®J€Eñ½)4KPÑÖœÙuöÆ &€øÅ–ä OÞ½Õ‘ À}ëæ3(¼ÏU ]†ŠV‹»_¿eïÝïw ‰’vÿl2µF\gíkyÑ}ôº w}êòD°›r{‚¯¯›ÇÉþ}ÃU™Z…GUÃoo¶`.÷v º—Ø×ÑPµ/ú¤eqÁCCbx•*e|B‡AÇ5âüýÁ• lMHâo"2 €Uðãg mÀuR‡|:vØôìõÌ{©ù¾¨ŸQÒ®§g¦8 €ìÓŽý¶~Ÿ]g—}u-WET#?Xµ­·c¤tw*Q5°J ×MÜ‘³uHuþå^nN~ñ‹ ­VÖ=º´hZøywd—®¸~׊ /}»Ç>}Ü“J×ý¸`¸iãp#äoyáÞÈh»Þ´çÍÏ®\â­ÚtñÕȸQŠ6MlÃÇž û$ûàδ±óK4Fëåãª]»IÀÐ/ièÎ>‡”=eaÉ—Ÿ•mõ4¥RE¢À“«×„ª¢Ú˜Û¹jЊfçÌôÁ½"ƒAUýÔ™hŒ1jj¶ç?¹™+Ð"jÜ/ =sgK#)›èŒ:ù}qjM‰ uK=ZDF*®øI_ÔÍÐÈ,²*-é‰h²åïïJy<òÂÙã]ÇÍŒí}Р‹ÉøÕõ«jµºPÒÞ¹>³éFK/_zF˼uÝ@üí¬{d|¼WŽ† SëûRð­ Ý .rñè›ÇŠåç´øô….q è^ºjûa­5¨5\Ä€Y«öÏò”RVUKïQ~AÖÖõâAÇ]omÀlã°ï{R¤Ê›m¹Ï¯^Ï¥@ÙƒQ‹nˆÃ잧Äu½3 ÖÒoM êvÛ·ï€.ƒ„18n(`ÜÕDW¢HdñÍÜ\m QKGÕß?gRÆÞų_m7 •ê¬116ËÅRÁRkéÏ €Îì¿ÕªoTG*`PmoC¥~Unáj„ÐÞ1@êè5B}Ý”"~r+FÍr-B!€ýàþ×~³|0@*ǯÝüxŒ}-¤¥Õl©ä¯+êÔ Æ†Îã\÷[³zµøóÇ@‡tó°”³20@Áýì“o¨¸Zäp„Ü€-aUuZ½5ÀP“ÂûÆ«]»ŽXÂqS8þ¼!å]F¶Ú‘%­&Ϭ+^ùîáAö'¢F} 4¼½”« œ'lezûg½é¤)ÛñçËÇ«Ôª=qÝ_P7«tزcñ‹ç÷/—d¬¢..-6ˆ©{W[mL VE€NlrÿQkæÏJ€¯ÏÞJ¼»`©ªÅXá:oå“惋 ŒùäÓŠã\k±ÅF^ï^;¸qõ¶ëÅCúzKÚøضÀXHTtçÔÁ—äZ,Vmok¨A—êÍ.¾´·òÓbü’·ñÇ­³‡žSk¼“„Z§RuCgŠ‡ùøRH¢ª2º~§…G÷ëS'2€ósfkF-3¢€Íð´aÍí­S~ןŠ¨õˆMö:4:9óÈÒèzÇ+dÒ“3™yµs©›ÿ‚ºÁ ë•¾ÙüÕÝ[OÊ*E¼2DòÅ„_;O7¬‚€\.z% ›m=ýå‚8sªpçÒKƒ6Ý&ËŠ«è5UÝUT‹€­ŸÔnà=ÌÔ:é‹ Å”®ºê7-37Ü©‹qËžWôž:‘g¿`t3vpÀÞYÏ€DU³²²·1€D–œ;vˆŠj¸„èæn§ºá±©5ÉÒYÊ4ÐÀDiuÇZFR%[Äé¨ÖÌ_d¬¯Ë…R‰¡«·¨VÄH•Bæ% »¨¬¨h¨Jýxu«/VkQ£]HºêðŠ#ªã–tüš¦æ&åLz~u•ïø —‰l6î¶#Ìv6¬Ý˜Ì÷sü`¨©N)þQ­tdWøç?¸FmueÈÐÑÂXpíe¡õ›ýZ~š •ŸÇÿž°R5­ wï?Öã~†¬¼yN[;¡+~WòY/½bõ'„Ú1™ˆTk®’(4*ýÖÙ6¢ògBžÓO,’ôNîD¯kóyùŒâ¡N97viK)Å㼸¼oââÝ4ƒn£zYÕ÷%€FÌèÉW²^o>—¹}„Oè˜c÷w˜‹yxÄÊ® ÝÏܹ‘¶ÓÎUíè¿ô”×ÌlG-”a\8”Œ»—Ú€¤ÈË9m?H†_¼ko^÷Ž\&+ óGZxT™ ùëöª–“}ýçžzΠ’ÿbk/GÖVLžHâÆNÏA£Ã;þ¬#?Ô÷¾™ºÒ®ÞÖ—oÜ¬Ö „ l}ê˜Ã·¿vL<“{“I‘ú_ªµ:BxÛœ‰=Ç®±Ò­¶âçÝš н‹àÞž©wTü/ö6B¾+|]^µ~àÞŠüGÞ@ø< dƒÌ ÑaB¼sÎiReV&EDþùt;@—Ç·1„Š£,‚väA|›?"½šùÖe!#]bùW™»Wi›¼&)¸Ew/Ü+ìð鸖ƒc)ÕéY™Œ ,ÙuºQeJ1žµn?Æ^¶óãÓJKò­D,•„Ò…$Êß0º¿wÃ7}°|¾TÙÎË|D§ Rí=²çä–›¥€D7^ID±æºÒEçê…L 8>g‰°{œ­¡S­RB`:ºXݼ®ôöÊùQ…Tð³ô“Ÿ³ß>ÃDDí:ß&SåÅ™³ã¶ß`   c×™v>½aòú¤œUƒ&­fK—¦ŸÏû‡öþÙ}Ü`V²HiÍ3|´øØgûØŒ†4¢Ò~#f¤vBhÑ¡5¯–¾ÇªS·:ýâ24TT9lŽôç•CƳ¨T±P™Í€À=yÁÇ͉KÚØ›êÈâ‰j€DB„ó"£[G,8Ÿ}eãŒjÔjãYF3 Ò/ŸfÎ_  FBVM^§ @]EÁ8*ž‘ž·ãØR *=ÇÛ=W‚Pã#¤ÐÒa z6‰ÌÊØe×ëᧀÈü5ÓŽX¦,T!UÀ`üX³#)k¤ÕÈ4úïá Œ±©ïþãùO…H†õ4Æo «“ ¾—wÖ°T@¥'ÆFAñ¦ï²¦,¹>mŽŸty¨[BÕµµÜ|ÔT§ˆ\ú|»¯IXêÊP¡$  4²ÝýE‹¥ì^¶ë¸*€˜_š•uŽ¯p1ÃÀ ýÉɺÁ<Óï½M´êé ×ªëÚ”3#ÞŠÄ|6»JXÍjýÞ™;ÄSû»&WaF‹.‹vm¥Fð}‚úÌzóC¡jãé1HÖ$«¤ÄÛêí´/féñåéä¹Sm¬{èêCglh£Ž_O¯·£è°¿ç©Ò ^¬ Ü"Ø•• v'û¥.º2t°Ãî6]ì–î:¥96ÀÏ)ðü6ÿ ·6ŽÅªRäuúÇÚ/¹"v•P£ ìXµù|ñæ>úÀã²øÕrƒ¹,_RÝ]Aˆ$ºÖƒ&„-ôv¶`Y«mêÎ-ípüöÞÏâ{Ú;¶³Y:iÈ©I7@Xñ>99)ÇËÏ°±ƒEÜ$Õñ„HÀbWýb¸×/ÄÝÔÿTû¿Â°ù#\çí}«¬%Ù(¹¸L<[ÕÙsšò¸›ÚŸóüÇ­«¥ ð¤Þ…!B ÊË­4¨þ«ô©ý¨ ^¦±–E[à&#’d»¨?ŒEe~NvŸYÂF" ~jš óîÛh¤HcaVX51*%¡CY½ˆÆ‚A AÈw­¼‚ô²…—Bëãµc¼çä½b^ùþˆƒû@¾DŽõrá6 ²Šßÿ¨jbßØhÞk’²˜²&e+á²B 4²sVö !…§ëÊN<ë}–-Ô BME½X×úejÖ—à ß:jˆaõyÌ|—þÖ$†uª_òös)ÈÙ†&µTɲÝ7EÙ~•-4v–Ü` DÕ“‡O³wÏÕö™k¢NmÒMÛ”÷¤ºöØ…Ó•†øË)l¶‰QÉ©Ç”†<¹ÂH: ™ˆ‰÷oßË[“TÖŒ™ :úF4Üë56ñ±æ·¼wÏŸåîÝðÒìÆšö ˜ˆ±F‡>&›–Ÿÿ˜ÔAZ@áDP<‘XŸOöÝ» mI+¦hËòýþ½ç*‹)ûõ!ÿ‚hÀß&ߪ}7¬ÇøÃʪFÖæ¿òÍ´3g ä_š¿èZŸ¾~¿©[|ÍÕà?ââMi醉ÇüJÌË/î¸-ì{Âÿ7@ æ.^¶L~-¡ZMN×í?‹Ü¹ƒ»ž³uOœ^FWÈD„0&OÞ5aØðN;;jýæ,ÆX×bXÎŽK¶ï¨Q†¯ÚËRI˜ÄßMôæûnš¡šá?{2Õ ÍÐ Íð7ƒb3LòíZЈUL: ªsa0ˆø”™Çu)ÌŠŸ´“ ª=ÿ€1Â{àšx=¨ü´zEÚ_I4-Ï°¸ÑÑî²ñ¬ÅÓF,¼Št:oNP·êM´¨2¢ßUïY{FYÖ Àó½uÄáô¸Ú¶Ãc|?ÆgMë!{–Y2Ü{ïž³QÆ2ߊïx'ì:{b3ïjJ¿Ìg7F4i$VüZIVžÌØ) k¯¨™#ûBS{–™Ú ÍðOU7$}Ëe ç"Iñ„Q)–ok«0&·§‚DÌ-.æ¯Ù¸œA b}_9-îÊÕ{—Ç`€;;çŒ[}¶÷øÔ™&¿òØú™î» v<ÐV$sÚ#æÌñÜ6mrOX»‰.{ @`BÉH.vÞ€*-H”-Ý|:/2ÔDz U¥…•‚˜? ‹ª¸û4;Ížš@àðÊŠJ~é|Nòk% ™±c1ï`ÚLŸ[wsö,Q¦f®&~ê›ïhÒ,gÍÐ JÕ ¢kZZY}#¤£Yw3êmWµ‹™“ À¬úÌ‹óüÀ†[ÆSÝëo8«ÇŽ1ÌNo5h+ @ÍÿòzVö½×˜®åeÓVóãÑUòµ`Á êkÓ,jÍÐ ƒï†ˆ"!€[– ˆéÑËœŠMZ=F˜»á¹Óâç?;ÈÖd¯>{€éšõgebÔ%ªöü >.Ì|ô{',U?ödž•µx*^ŸŽ»¶gh qvÁ€q›.¶îb¡#þãøˆUw=BkŒÙ >ai¬©xCʺʎå D'Kµ¼|üHÓ •Æpvñ ‘«O™Zšhp“Â}¾è˜;hejaÓÞ¨YΚ¡àOÂEŸ?}R!as¾/3ÓÔgã{ÏYÆ.Ö ƒ–³¾:çG°{G©àñù FíØ€™ç¦Þ*î¤_³aAÆ2ÛQ÷}oÙêý™fDûElÂÂ)»sõAÄú:ÿüד¹ûô©à§%¸r~æ¾5ù¾:½‚-æï?ô>5º“¤êçÉ Ê1î ?C‚z!„8%UÌvÛŽŒØig_­Î¼ÙÈȯ½ê‡)É bNÌÓ¦ öÝm­;4«›fh†?U7ØSÇE@"øÉa$-;åÔc̤"W(¯›$•æ€®J{Òëàz6›$-ëî­Neå: õ”±%ì’#»O[˜ž³fä J&±¢£†¦dwa¿ò-áùS&R Ê"Nõ!@tí¾.:¨Wâ¥}©ÑsJ_ ÷Óc’åô£^ÖÙ$aÎŽ…Â{½z¦ ÿ ÇÐסK¯ÞÑmç†f÷p34Ã_W7tŸ>Á$€hZ õÍWü('Œ\Ú¥.8Ëž×KM60ñ󩂪֦­ÉµSZvæåœù¬ªš?Ìw_õ†xy'æ õ”  œ¹ñ´¿Íº«‘¿ÀCÍˉóZ•:#(àH[‰„€¹`éJ5JM´Qý6ÍĪ/pW<çᢃÃVßP¨#y`’0 š÷¹I÷ì&Ìtl €¹²›øW]ˆÝ Íð?ë»Á@¶xNÎÖä€0 àŦj÷–í½‡dRm‡Œ?h5qz2dÌ žz„>‹¦zpîðv«¾+nÖÀ­[×PöÎk zY0sTú‚T±æïbÈo5jPâ’é!š £—"®\U)Æd‰D&WcIP ]|¬Ñö¹{÷–·ègBSª5j‚>çñ(ª Pí¢Êüä"Œ@á«KªjvP—^جzš¡þÜwSkæ`-«ˆùA{G ˜}qß\ ÌéË£ú'„žëiÚ¶%™_öúé]ªmbF¼+è=bù€E£¹÷¨¼¯OŠõ–Úv„ÒËÛ®3Ò×:ȸGÈþ~;Nîé6T¶—‘ã­B·ÝzDÊéK2\Z7÷kMJ¥µóŒZ=½5'í^¨Çä.+G9.ïÐ?zPÿˆ`JÉë½™Ùc3.Eveʨ6è=hAüÂv¾K¨HAÄ ÖšåK)QÕ§×Oñºœ™lsûÙMLˆ‰¿?Þ}ôÃò¬mÀ¡ƒÛ·²¿$†97‹Z34yÎœ9j’ššn7 Õšûn‰ª¡Ûº›¹)ô.’N==)ÀÕ35S'#šNÛCbÛé2U˜êFmLÆLíNA!PÑï28Ä H­Líæ-KѧCñ§|};oÿ®­ëæ4†NL„|Z÷î]Ô˜ê],»©“«{±èa¯ªÓÊκ{uY{©ªiwh¥§Û¢´õ[wïÜZMËÀª[g EEÓ¸‹Eg=À4w—ò’ï]Í»vpìëÖE¯¼¼’¦ÛvÔô9®mU©¦$˜n ~j݉i{æ·¦4<C$ª¦nKmM MMM-}·9s'ê ŒjÕ³—·…qIq C¿óøÔyÝ[BžA4±H˸ƒi›Í¢Ö ÍÐœ3%k¹xrhÞ¤S¢Ë{ç7¤šá¿h3õÿMõ–çöï7ûOÝé#_:u34C34[7J¬hÖ5ÍÐ Íꦚ¡þÁ ìM,÷³‚çÙ©¨øÐHÕß+ŠeJ(2S”·¨UŒ±ÂÖ°B²ü¹UsŒ•R¾‘!ýw,X!uå%DÙFå¤qâýaÅføïU7¡wW×õ°µŸ~¾¤f[Êo° ‰Ghå¿Máv!4g˜ýìŒ7ŠÿXþ²UG›bIÓ;„ˆµAæQ»¿"„V ·qtòðpwwwwsqìfíÐ/>•-AÒÛO¡³ë¦ôöqéjnÕݼ›‹oÈÜͨ„îí5z—ãá~® /¼’¹ÚŽµó]z!ˆ³b³ËÄè IDAT\?{[ÿ^Á^NÖîáÛn|“¹ ÎŽó²°²:ûªý±ÂA³ßõñr½^ˆ0ƉgxÚ¥=.ù¾s´Ý˜te¤< pwöïñþÜøŽ¾ËþM{= ܧÇ׺¯Ô4”ÙÙÙ½.4¸¹²ôìó¾;BS£»$o«è::tkKÿ‘'wÊlÓœE•Í³ùªn‘Èêº]³gõÿ) ª—™F£€Aø‘ï†Æò‹.P¨t ™¤È(À mþýÃ#}2Ƭw5@¡Ñi*µGÜì+W®^½zõÚÛ/îœbÞH=ò@ú²Çí-#æü4mÃÑ×/Ÿ<ùâÈš /÷N¿ñ&ªoOT}Ƚ½ðÔ†8•F§ëI+‰J£QHpyíì¬òv—îÞ¿p&ëò­Ç)ž«c#_rª!øåËòW4[²óš²›vË>?¬÷ïê4÷¶TÇ}{pr@›—··“{Ÿý×?#X[g%:9»zº»øÇŒ{V"üºgÚäý·›1bB¨ôéén®îž 2.×Ú…w÷DzÙZY÷ŸœÆª7øôX‹»Þ!^?ÓÍÅÅËÓÍ=8öâ‹"éÌØ¿dTŒ‡»“Kð™g0‚Ck¦»º¸y¹9EŽœó¥R,½½ì󕾶VžÞ#â¹±˜\®RÜÛË÷ÀTù>gh¨»‡·³£çÜíq}Ñ•­'(y6¾Ÿ¿«‡—‹£CâÌ-,@ˆûõö˜(_oG'ßÕGî"„P囎ÝNu°µÞ“:¨SȼÚ{õo¦zZ%„^_Ùîçêåíéæ}òaB€šk9=혿½U̪·Xü­‡©ÉÃ|áÿú„²'Þ][ï¶cV°‹õÅwã²;™öá ãâÓC­£÷bŒñÏ˶]=oUbŒqÞ‘ .“yµ¿Š†;wŸw® Þ;o¬|K$c¡Õ|}}Àà2ã[;b\\ýÞ‹0ÆøÁÚ‘Ý#—bŒ˜ì6^Z2gy¢ãÐUc¢â]k×ÓEcŒ?t¶¶}Yˆ \uɦ[$ cÌûêÖÝ>ý cŒ1g¨·ù¢ã_”<0C슴~ü§ô—M3bÓN~Äüü€î¶kïTbŒ1.Žuéºéfæ|ìÑÓ1zþeŒ1ÆŸ‚Ìm.—bL`,b99_üÆÆ…§íº»ß.ÁcIáUg{Ûï1Æxñ„÷°¤êÇc$¼«99•| þ߆&s¦Ôv$yLµ”§èo÷Žå¨yù8jƸMøê§×WHS+I$Á²AA”¸ý3 <(c±¢Ã{I-sßNüo”?SŒ^_Þ7ÄÖÉ÷5ÉrA¸ àp¹tUZSc@ðåî-sU¥ª¾÷T-£®ßÈñÒü2cÒ˜˜°àž6žÇ}Ga@UyÎIŒ’Ô`jŒÃþݧemc„Ê&Ÿš~¾ànz\\\\\Üër~#¾ Ó¶Ö?JžÊãÒÙÉǪ•J=üøB‘ôùÊÚµúí­Û”îQí¥¿µp3ë–{ÿ†³]З'Çàޖ̈á£é׎T¼}ôÔ¤“ À¤§»CG-¸›y†êÐˈÏãñx¸£¾aö‹OÚºZœ·ï|­äñ…º^ÓO¥…€XBH$B dÕ]'÷1~xûúÍGž©±èýŽô^²9s¢¥”/xsR~E£1Ô·òÄÓ|.¦1ç3¦ ÀÍŽ1)÷ð7äçcÀ‡7³?Çãñx<¯1#h×O¼" 8ï]_;HtˆvïLmàͽ{,62fÉ L/Ç÷Î)Ùö"=c­W™[~Vr"ñˆ{Æ…´/z{Ÿed0Ô‚Êãñx|­@_÷û—N  MOòÀí¼|õ/º ªŠU’4 ÕÎo8ªÕ'ÎAƒÏãñ„VÝ)´s_*°ØÁ=@êãC$†›——ýýjð&Ãü^è*߃>+ÞŸ(÷ldae•Ó<1Cf\Ø8J(¤ÇÚw†F®éŘFcHE„H€y›†ŒÜ1º—Èo&ŽØÑé|ÖJ:  ­­É«¬â¨ÔÛ£™çU… -†Ìôm``4)a éŒœ½nƘ ïlé—LÞy#´»ÚƒSkTA8!1Ȉ¯Uøtï«ÔØ®”š~´—§ï ½9“¶èv» ‚ ™ÜˆVKKƒ_%ücÎU°YL†fí˜[j1.VTÚ۔ͺ„A¸ù¶`éœV÷ ¿<.€âÇç;{o’¥Ia%ÿüª“ÛùZ^t-bé ˜¥ß~â°€B.…B5Úvr_G jÍ$¼á¾¯´,Æ ôk¡ÅàˆIj5Ö§S¥¯ƒi05¸Âï vå&ö9‡—OÝoy±°úì{ýºèRÓ«F‰DB€ð¾±éŸS¼q5›„ A^¨r+¨dMRÍ;Ù -¥Oq¹åTŠ†´$èi¨•U(+´*m™ÖËÙØ&zOÚ.·W•ûx{×bÞ±#ÈÚäj½ßßÇ;ôÀ9áø|ÇBíà¥jÈ+±ouÊÞR'Øù<0ÀCCš/"ùuÚµS½¦:o˜ÜÀ]a¬É,ý̪.T«W‘mÄü©eA£#ú];¥û«7ƒ£FÏ#È@¢1˜G­4Ló_x9ž·1а´5)Ÿ?ûlŲ@Mid”we×â{jéS#ê "Õ]ï׊A}ü©LÆÏ'ÊþúëH^:Í´ïcª!D&;4ë| ïÓg0S_²5oÄ‘SnL¢ž]?í\fFìÜ!µ8R( “HˆD"Q(M.d‘˜DþóåNKM£Šÿ¹–v?*ù­˜ j¦òþÜò/D›™¼|öèùÒØË­d°‘–ªªuðåuÓ´ÙÚ&äÈÅ—ó9{Qÿ€q¹·6Õ²†SxûµvöÐ:M ˆÎÌ×Öb‰$RUÀæ²UiZ ±e÷ÜzüªˆÏ-}º'0z˜ùÓãŠ4°juAû•æõ¬G–‚ïêb ×=¼ñ²€ß$5LÄÏŸúQm¯\yþÜÏÁ €ä=Èvë†mt‡á x‡ÙæœÙøTϱ' àÏî<þ»¾ÞœËg.T×ÒÿÞ7ÁñÕI36]ºªZç®$|€$’ˆ¤Û@ àöŽùO)¨Â@þÎŽÞzöƒmZÓû &~¸ÞÉÕÃÏÇÓcÒõ…™kÕ|=prvó÷óv [?nóš6‡S«—%‚J6Ø XÖÏBhïèâïã¹ô愉ýI€Éºf»§, 0÷ðô¶[äf¯UÅà ‹“Ò.h¹yšUxYÙ¯º«s2s֥ɞþAA.Îa&Ó’[)v’µfÏŠÜëäéãçéæ|±¼kÊÄp`´:qtþ½ù!ž¾þ®N5|cýÚ&ØlëÌ"ï€è[G—·í7 I“m"ÓEÌ sôõ÷sq‰4÷Kh§A>—ÍÖèU¢xüèáË$ÿëæM£oÑ×{ä\ÑD#ežŠ—{D¾^1åÏÎ+Ö^á#ðœ]ß=9tÄ:¥Ïŵ(<[O4J¢Æžµ¯ß2AXðÊÇÊý>¿au‚Àe¯³&åV)l¥)â×ÃQæYú†ïÕ+$€ü؉ú­ýÊуl;ð®õyŒeH®°k‚ÀbÖ“„SÅã¦ô/ŠQRD9”夈h”Õ}ˆóUN4ŸL)ܶ :ã±áÙP#‘l4nÃÆd‹)v^ù³öu…”}¯¯S]b'3ž¾X(‘`)Ã[Q´® ‚’Hé°aË!t`Þ¢Nƒ’zÒVGnŸÉIñPUØJSį‡#BõH[;ªßÚ¯mx‘QiLÀ<Æ2$W¿ömO Ô“Ò³ú ¹å%òPV¡%Ed‘CYÎ݈%‚ôîGÞeí˜NZÿënãÿ•MŒWp?4aùé¬CŒÿ42•·Ö…n\Ù™„›Ï-þõp{{ììÌâŪ&9'¶6¿YÝüËôtÁùÏß.Q£dš_óý·ø ”r»™þÿ=®b,÷ã'ï‚‚üòßÈiþ{’€îjþ3éÅ~eöÿ&ûY&•«þÿXNÀpƒ›°’<þM**Œe¹­XØþ-ºËŒJþžˆ+eù¯ üªn…Ï=œýú„ã¢!¡=v\þñÉ»¥g‡˜õÙë9ePÑ‘ˆ–~[BÜg'6~ð+íL6ª(±ø·àú¦™ßåZ¾°ÐÑyDο\ð0ˆK?L_tìw åÕ!ýâÿÔ¼$5ûûµ^fÌ|ϯ7Œ¼{.~#®ò²íö²ퟛhaã°û¥¤f’ ›]Sv!„jnÈCa€üGc#ƒ­º™ÛØXZÛ»5%‘¦Ñuè¶õkµ*AœÇ!¶–‹N¼õ´ì5zóEþÃCƒþ­æ,ÆËýfyY~v™U¿éR?ÎÛµ¡ö¾E蹇y·^cÓdo#·ëx¥!$™ãÞqĉÒêWLoÍôo§]»[™wµ´ç^) ôÙ³­ù±ŸÕQð¨äªU·­W>ÿSnƒ#)³l„yU̶Om­ T:BB’‚L¢2häúÉÙØ âÈ‹ÃàÉ› 8,b5?Ë2ß.S”XŒ9¯캂åÖÿ·onöV Þ¸½¦ü£â± à>{ø쇢¶q# ã¡ËýZÊetãõ®ÊpûÞ .œÊPÔc=;D®»ý;²EŒzLb04t]2Á 3€L!w0i½%yœT§"Sé5Ùá]š/|}(rÈ’žýf>zñòÑ£§.d´ç^ Œ],@ÑtémýHò¥_à0»i»§÷é&‹“6£…š*…ÉTUSQ8`ÅCP`[à_`q=ë2 5è -uuM&¤/àב™í4>L»VV[F§“•N§V‡¶£yƒ{_*0J?}ëõó'/_?[4ÔyC‚÷¹7¥ˆÎ`HKAÕ‹à€ a«³†{´û§˜¿ Õ ª¸#„¸…wÌ̺r%‘ª‹‘è̦Ùn..ž®îÁ/½*F€X_ï&†{»zx:98N^žÉC•½ÍÞ×ËÃÛÛÑ¥×ö‹¯BiS ÞÏÁ#®ì‰É¥¥îžcs‚{Ç6xºxx¸»xõÞ}ñRbnäŒìÒÿÚY£Âúôvqó˸ü!Tr*Ölè‰YqVÑ+jH%@¨òáÉ «¸ßøôåèÖÑuþîNžžžýNÜû®ÜØG̶eç£üœ66¡ö'Ù:8|gKûó¼‘öööÎ>›O>D€*÷êlpì¯f—/   wÁõñíÂÒmLŽìãáì¼dßÀ܈€(!ý½»×¥„°ðèºTWWOW§¨ÑóóXb„Ðå•^>ɹsÇ qð =÷¼!t Ñõ²˜2ÖßZnÁ…©]­FTµZÙØZP­m]5¨@töØ—ùhÔŽ—Hù>`ö‚ÝãgO³—Š¬e’ºkï¢ ¡ÙòDéP é©áV ²óÚšuïÒFŸ¢mä`iò9ÙŠ¹)ݳ”½Lìàèàà¼÷òyË  $œheÐ?£˜Z[uÔÓ upìÖÄU?ŸŠTLµU@È¥O?yïü1|¥©ê¾ìÌz$\¶nné¥Ø&(qù‚e–-ÕëJñ¾Fzp˜sd”g[¥i‰ÿ¾4E)Ô¸¤&cœé¸;÷®xbßÕáÀé·âpWó}÷؇—„%¬zŒ1¼ßÒgj²ÿŒšd×h Æ%çmmÎ~¨Âÿ¼¿×Ò¹O¹LBùöÔêlc~é+G·êP“o—ü£’…‹ùåÙÙ¹|1Q›X\ù&§6±XüjŸï€¥㕽ºLͩΟž5*òÐí\õÚ£«íîBi ooû®§_Waâ“[wÏOra ¹kzõžzy9ôø,M$.Ò+|GIà@é¹DÇž6Š%cÞ›3N¡¥³¯u°s»•/ÄËSiïíbŒñë3)1k0ÆâWzØ~`Œ1çÃ9;g¯Ÿb¬$kwȸ’KoZXÚ'¬­NšOŽò´õ:ÆW}t¶s¹[)ÁXx#ûb![Ü º|IŽ?™mkiyú c,Ê¿×ÓÍC`\’ic=„1ÆøáÁ$Ͼc¥mf/Kp¶c|{G´‹{€”kŸvMèµLJ¾—§bŒ1.z}?÷Ñ'ùX§ƒ FŒ_vJð㞃“ç7ÆLí=3£þMâþÝÞ)U9Sjf³ã{’oØÕ7†ÑÈþG˜ðr/eWð$Mr“ÀÄ`/—§ßaŒqá-ïWâú,æ(0,yqí“üÿ|–î›!Áãç.]{ÿÄxg‚sÄÂë1.fW 1Æâ¾fcN•b‚x<·¯E¿J𳿩ÍñïeÃ],FîxÑdØ×?"&¹Öz륛ELu¢¦ž«Y·Üû×]ìóž€û[F$Œ¡_=Rð®& ϪТ§§Š¼#2AábBšm $Š* ÄGo~â ’–>ç3—P1&Óµ¼½=èu[1Le0[yêY!O @]ú_Ü;tõ5ždî`UqEbÉÜ ‡" ß]Íu³Š5%ø|>_ÐÊÓ¢ÛµÛw@$ĆÎâÚ3Tèä“ÙÏDÃ"ëÈ&¦Ò¥ ˜æz$`˜:š±¾ÍÀHHs°1¢À;9*]yx„" &$øÐê3-ã“ÛÑ3;8wæ²÷4u Ž$H3y¬-¾üø#,Ô0`•ö7î^·Ó aLqöö5Pkª ¤²Þ¹ê¾>¦*˜¢¡+á‹KÄ1oÞš RÜü üø•SãÞ 0`}LJ³»’ë³øš"’¹«Ÿ¥1½àÞÖ ¯ñaµ‹bnÉËšõš«XÆòËDZ­u”‰™Ö ê•ÇÐyóè¥DÁÀÿ™®b9'•³YL•ºäVZŒ‚ŠJC»¥ŸÞ7߸µjkøåq<~|¾³÷ ê’ú]j8 j¤.ü^®ÀåNÕ0¹xrËýµ žžÞî.þïþP$cXÅÄ>ûвS³¢¼½¼Ý]‚²ß–Àà­¹C;~ðóññòòŠŸ}@PÎf‹ó_¹¸yzyyyyºzþ5¯¤ H§€jœÊ:Px$ÅÍÃËÃÍwã…L¬×¡&Qš®¯.ü!½l@×DúQ•*Ù²þ±„h¥¯^#Š4-ÉÇbQÓF(U¥:½ ÿd Õ4T#…§m²uäJb¬¬wÌФÊÎÒzAÜolúõd//////'ÏQ:ûKRÑ@éäÞfäv/'?°1G‹É¤–—jx#²ô_BB¸Î<{þÂùvùû7ß„þlÚ5àæ÷J ¢b‘DƒA«Gáú,V$`JÏŠ7Ü¥°®·Iia¶oJ·Ä°T‰"9kßFµôMž2§*!†-»tþÌ1•‡k'~÷ÇÿÀ¯¿3Eh«©Ë¦ çKS™–}UÞŸË/ÿL´Öe@pW“—Ï8W:àr«?Ð71€_ĦYê ø¦`¢é˜¯ÍÌ ¸eo²íñì|'EH¨·´Ýv⚈_õóñž^QòžkIVš²:*I̪¬L¹ìP§ j+‹ë7Ö?i{Û„ÞUk¿x׉_þùFpôp'¯\+ªÝTš' ð Y´nZ,™Y¢J2Ãm¯Czð³ªFz„ß*ÉVº¿óÚÒW§WUp©V_È 4¸D¾¤²ÞEJë€ÙF]Ða價õµoÿå}<¢iIä7hȆøÖòÊʼM»}Yº ÆuFÊÏ!C–/ܼ̈“ÚtÐAöÚÝÛ7"Í$c|`—?ˆšlÈMMT™Í¢ÕR¸h«+0…<À€8_ßVjµ6 #Ù;Q0†N!‹Û,óÙð¼´Á=¶€ K|œÎî׿qm‰!i|Щéq…ÁóœÔV&LDcž<›îÝkðŽ'úYëÿSÂEÙºÁD'GGÑóçYùÒß‹®¼¨NAöØsˆítû ¼Ã{ædm|ªçhK«^u駞üÄÀ~qå­fëðÖ²Ì ‰%"Töj_¿øe@¡«ê›™ÒÅ!‰uçÎ=¡¤F åãÕñãÓ€ÊpsJ/ IDAT`w3¥y— éÕï~¢hhékªò…‚vNNijǙïªçÐì1±Y Ä5i Â‹'~¯¬µâ‘8ÿtdô,1™ÆhajÊ$DäîÒYY‹`?¿òV³u¸I=ù2UL%DÂ"Šçÿu×ê ª×_3˜ƒ»0~ç[Sƒƒ‡/$Î÷¶é‘U$AHüèέ.ÑdÉHE½cP–"äh¡Cܯ/K‘~®¸·3bô:¥è"‚à’Ê>½¸÷ú{#3c¬Þ-!¸ÕÏ¥ç_På$qÚòiøòÊ‘ó·r¤ëEþ£}ûòÚ:Òê &ÝdïÆÉR†{Æi$B ‚{·os„DÜl @kg¤ª²óÂ3@€XÏ»Ù_¯ªÇâΊ !üááÍ7ÅÂÄøøø¨žÝpõܹ™;¦dŽ’/¢4¤ và –Ó†õ?ÿ¢XZúdÚÄ9§>ÙwÔ—Uo-óC+­s3OðO ÍRº®b±ˆÍ©ŽºàV±b´­î7i°ÓFº6«\Ü{ìvi rGÛð׋“&!dÁÏ^Û.fqµIQY^Þ%){Aܼ…Å¥¢‘©iZÅb.‹+7ô©Ó}\º”¹Â©ÍW5&ƒ%¤õ_¼Ô·ìÕ!ñ—¼0T%ó¹$vpègš5ÉÉeŸ“Æ’¨Ú¸ÚéLOòN ¶gSµ >»­]Ÿ¥‘Î@‡#{’&óØ üŠJLjI¾ÖzÚý]Õ¢-ݦHÕZ5'yÌþ^­4ÉbA‡'¢õ¸âåâ¬Âdr’4Ûž®”dBÓQÙ‹â~*,,â'¦¦ép$<6G€¥ò¥„J&Á¼¯‰®·O\:·xtUœ—M•Á•è$­Ü«ƒ”Æ·r«ØB1,f±9µ§ø+6¯ž41¥çÞ¹dŒCG- 6 ”OKŒ{ðUï® ÙõVAIƒq zóYJí¼¬N€6 °jµÊÅÆaêŽÜþ±Ë£¾L³wtÕV#‹ÕÚÏX¼HUu)Ý„€ÅæJ÷ qÞF v6‰éƒòæO(p~1±Á D|.—ÕîgìNórHt’6…Uì*!XÇîðÑ+V­sï¶Rd¦~ÇÈ3&ÆÆ€ˆ*[ª:€f·˜uS^ ˆëc|þ’ƒ¾’už(7rØæsO¬ŒHrvï]6vÂDûÕB@ÔØÙ«]™õY¬i¡HÀ„††Mz²‘Ló’ë·í_ScÙl§6 ƒf2ØlÝš–˜àsØ\Qupã°´†;Wnž2ö;‹BfØù‡ï̽l©G 8,–ˆ¨ŽQ4p¹ öé˜~ÇÏ7Óú§žLÕKAn4¯·ñd…ÙÕ„â ieYØ¿–XÜt^oýtó Óú_ú.;L¬ø`CjoáU˜3¬$?¸‘ö;Zh˜ƒ¬„„숥!žlzˆ2ˆøå”n9\6 P~ˆF8.—œM4Á8‚À”ËÉVÀME<ù+»6@åÖEeþdàÿe@Qæ;•÷A*ÊëP’4ÜàOòEšjYÁ_/ÖˆÓ´ÁG„ð9ÝÒ–2žQ¹J¿²¢J,×¹Öe§`µN4J%ùÝÆPY^*‘3‡UMGƒ.eÃá@݈¸¤9§á‰°¸{ò•Õ¾׈þÇ!•ík†4üHQù»¹Ù r¡ùp…Ì&’PþÎdâÆn¡øϧ¯ÿ/p¹95¼YÝ4C34Ãÿ3øÕƒðܽ«/|Â))¿²e׉쥗_,”®ÔâÒÛÖ,NJš2mƼ̋ ~FPþÕ•))),!¡ìä·®# oVJJÒäIÓvßÑÙÝiS¦L]µý¸l*¾,<¾°?59iö²Í߀1`qaÊä‰S“§¿õAŠÚÙôEI“'•ð$ð2÷ð¬iI)© ³Ÿ5@2wÍøi©‹ó%P›²Uï'¦®\•’’’Ï‘\Ú²róùÇ‚7'/X÷Ë©ˆ“’’ò#úk,ûWÜJñ{mÚ8íе‚ƒýQ‹•”tùJH·aéÔÜåõ¢›áŸªnxŸó* òó«ríûû×@’<¸~=¯þ]ó_\}ø• ww:ø)ešøúù9Zš\X1,lÊBøˆ1kÖŒÃ?Ÿ]Ýý²\Á¢AGH|ëú 瘈•qþé„^Ô/G=ûÍåjp‹ÎþýÇl¹eíêýì}e@ÕÍòðì Ý©”­tw Ò¢ØÝýØÝùØÝÝÝH©€"¨ „"Ý}ú7ï‡shPŸ{ïÿ^ï}ÙÊ9gwfwgwvvfv¦##À-8èŠ#ÆN¤rR¿äU¼··Ö_yÓØhyýÆæ Ó÷?3´s³ì%·a´ßøʦw£€ †¬ÁCŠCþÉŽñ9 HëÑ£‹N«ÌxŸUPIØ%/“þÎöá¿xñ²µëÇßÜ‚$uÿ¸u—âÿ…â»0ÛÙº:=5•Xÿ÷̆|»±fÒÆ„z=Xô¶Ç¬Û¥§²,Ùd“Öq-úËOUÅX±nÏ£âÒráÛuzïß¿üµ{à•Õ-9z1 øú=ïgõa–Ÿ‘jÕ°ìlô§C·_™©1 ÀW.ßuþöw7–š™˜«K‹7FUY¶²Ž·‹9€ ù;o÷áÓÖš„˜ žÛy{Öõ ¬Wµ»ÙÀÉSŽ¹$@  ñq!½¼Òõõõ%è $)”d²RL‘9 )vtä 3GOÅÆ'9@€Sü:>¹’GëjhÑ]K¾éN¢8e ‰Iu|9ÕÎöâÊ„÷!!!·¬–)­hjk£Ì¨ÌOŸšÅCš†~“î*S^žŽ-ã¿{ZA—Qòp´ÄŠ¡oë|œtÂb2|Üû¼ˆxUG± luâ[smÁ«„”j.éÜÓÌP_¸•y/ßex¸9WÕÃ|ñNÁ@¶è3e¢\õ>SØÝ×®3ëÞ¿I(ªâH+w²³2b5-}P ”„×ùå5Li%Kk+9&€ æéówýúÚ¾yþ¢”Mô¬zwVhCñ%¨I|“XZÓVÔ°·1¡‹Hó“ÞT°•µ{ZöÑ­MO<•.‹ŠÕr³3Ñ××g11ϺÛùhÈ@ŠõÂÒÙCK»‹’¼Äç—×Ãr$•žDp-¬*þzeáì%/AøÕOŸ':z¸Uýõ"ÖÕôsǶÿm¥"k5éÌáÅ ªš*š}Îî_+Oý(y…¾ªìÛ—1e5l±ó7­ë¦m›5$ÅîQÏ/mëì¶XÞv‘f͵¤\nóW6-)ÅÅ|êfcHg×EW5¥Ð´æ €ø…|SIŽ)rÞìíåSùòJ ,Ç'ˆŒ G.Yk‰>òßw¶µl:¤™ú8!ù#wFAíš5kókyÎ öÍ`IÓ÷9¶ +íÞ‘W%l¦ãz¹¾™21Ðë|rM£eÙhýWþf}:¾~¶ûìë!„=Ó‚î½üõû÷¨k{=­üÊx(ø|©_ध‰Ÿ3?¼^5mðšgù(àpØÜÚ*àç­œ½xL@ñÅ0k¹ð%jïš­'V}˜ò­€;{×úwò rnì\jí¿‚C¸ubÍí˜ üC£ím;ó9ókè™.° nѲUëÖŽ”TŠü¼˜1žý¢K[ºLR3'ÀqË©ûY_Ó/î\ê0þ˜€B„[&ø¬Ø>%9áϹÃæ_IJPX]!`×T×rA4óu’×Om¿ž"z§U[ðríÚm &9¾{Õó´ nya9!•••<”>±ûÏÛï²EÕ ÓÂ7ì<"CôÛÇ÷ÝOîØóÿÉò+Î9 †{>ÏÃÈó–ÞÈAaÝ0GÇãÉ%MN 6v"kŒòvr°³sì»fï¹ìòZ(ó…X“loìž$@¤ðø8¿ñgã~‚ˆ_Õ×Ñ)¥„ˆW6οölƒKÔã¹û¢š'(©ósµK+}q£__¿ ¢¿·M¸íÆDL}ºÙgì±ÆV¼ÔÁ®N–¶3¶\míQVéè4‘#ò̾m¸)N™££Ó§2N{žrMA¼Ûäë´à‰èË÷¡‡¦¯;¼2GG§´RÖ| O"RÅ)ûäèäXʦ«FZ?,CJOùÄ`øú ƒ·ÝÇÜà”~+¬BÄÕã}wÜL@Ä›soNý:>ÀêfbD™8Þ©Û°j‚ßšsÏñêL›Á[ÞŠ{–~ÚÀjRUóþ7ÀŒ=5Ì3`š¨ÛÙçmO¿ÚËÑñ^Ve}Ò@)/]’qqâtáŒ1˜–P¶{£#-ÿóȈ±ÇÕר3_\ÝNú?;<½"+né¾{‡öne4ÀÔd)4 ŸØsêJ£K‹öwd­~¥XÅ" K )N½Ë O\~ò¢3œºó±{o…ä§r;[þtÍÙYv]¹þYè KzQò©Çe )æˈˆqƒ¦ºö¿îØH{íØk»¿hÏWe€,SöcRô³HYO§™õ‘Ù9u7“¾5²w3l YaÅ¥ ],û*2LÿpØì‹è¾Vbü¡þ¦;ulûßÎ2Å`Éuëª×ÖC1‰.—£ãGZ«}IMþZLÍ9rrÕ(‘êÆmòŸQ×·Ê×åÆ¿z•ü¹ØyÒî§çÖÊ—ª£Go‹ª ´ïGßïÂûú0$>‹âiœ"ÃoÅÙ}SœÞF?}öRÏ{Å­~qÑöµ¦Ò¥ñiyÀ”ëlH£ß0¶Á«€OS>ru}jtHTrÍÞÐ0ûÎ Téí÷øpMÚ‹¡ÏÔ½V†žŽ4:KEYQ4!"˜oR¿«u±s4ÓªŸvÍ‹Ï›’¯wî>¬Óñ~}o¿tã= %ulŸYø!êaô‡š#GV¯[¼‚^ü6[ çÙ×Uª~ê{›¹è·ˆŒ€}g_^ýàvr¹ÚõKöÏ—þêy!Wé`h¸—ZEdtlg¿576âÈËœµ©—ï2.Q?ó ëÜ©Îæ÷ª}eiï¡«& ¤óá“‹csk)ÑÙàhcÖ§o?¹ú™aÉˤç”uìùßÝ2õŸ)¼ª¾ŽN©eÜКPßd{½eêSøî~C·üøµþ¡ùŸW""VeÝqtšÎ¥~•pªWp÷ß@„«:;ÆÎÉ»’K‰?DØ×þß!¥(D\?Ñ~Ó•ŒßÝ B•Œv1½ÿµ1<:õýæÒëo;ÌC¿[hô߈žÝ¿ó`HÊ?bM …%{vìx“_.ºáwîfW•:ý¶ ®´Ãygî>å, —7±EÕo¢ù%†MíØÓ[ZLüwª# 7{ñä1CWŒ;|[^¢1Èåÿ©f‚²kéØÐwÜ^Vú¿ó ºÝb7×@¥¡Ûõ#íA[‡˜w¨nþƒå7~¢‰Èáp€Ð™’ŒÅåp€Á”`2hÀçqBdIJÒ~È¿\¶‰K’Fð÷5i Åáp Á’`6yÜ,dsø’R’ÿwærØH,ó·µö "ËE ,Ž'õ즣t”ŽÒ¡*þ[gH“¿{ Õ¯uÿ FòO½ÿ'›ÿ§×NZçö²HÿM[µÁ¯VØqNÿÙ !äÈ¢ÁÆf‹ŽúíÅUBò#tŒ|kÛí(ržÏÓqÛBþ FB¹êy’ó7zŠ ¬Î?w-VÔ||ù‘G™ÿªÇ\ΨäþkÇ؉0㱡Ç(B?çùÌ¡ý,­lL-lçl¹H‚@ *eÁh?k[{K[·?/„“úÀÏNos·±¶µ¶è7læ›|Jôåù]KÜÜÜü}<ûúºó&OÌGHùÅÃ{uµŒ«# LäΡu.æÖ¦Îþ£n¿)hÊ›­ãÜíŽï¸£ýƒÇÝ‚r·+™F²ÛªÐ*Dv›aÕÛ´7Qmco³y›±Ó©¶CŽ·e²iZ…³ÌÀoW›ciË–õCSY[þÕî? ýþ£@ñ aÒÛÈ5œr×kè^Ñß3†;|šÕ>±¨6g ­àè"àYÈkk‚¨?S¢Ú_6MaÆ]^;jéäWù›Y®ºž„ˆˆù“\\ýŽBÎl7«Þ"" ¾Ž°3=˜ÈFD^Î];;ßL6"âÛ+ëûOCĪW¬œ§ŠÒ2Æž6ó"@¤¨:+§½·¯õ3tˆg~Æò¸?-ì|ã "¦ÜÚjé5´i.ä÷—¹÷ t1ã'tê(¿n™"„<Ûîî»&fvg›ÙO !%Ÿ¢'èkkg×oðÌäü:Bp”§W¬âJwëi{SÔ°ÓîŽv6¶£í-â !$íLÛùÑ«Çô3wR•8{˜½½{ÀøWYå„!äÔ"»I{÷-žàæêâ8ùS ‡ä=:¾ÒÑÚÒÒ®ïñ')H@›ÍÙ5—>¬ „|¿0¸û «DôàûÛS“!Å÷FMÙ7/ØhÐvb´!#óJ÷Ìbac?`üÒÜú@蹎¯v¶³±·µŸ¼æDO$´“êÜ÷³†zÙØXû_‘YÎ'Í¥ëÌØ냼œmmlOßø½Fˆ”‡½adLÔô!¾66öK†UfFàeki»7ôƒ¨«ìÂKÇÚÙÛ;÷–’O!yáz–3¢vYZ[çT …Ué †öµ°v˜ºîÌ—ÐéfƒÎ!£}N…çB"vzø¬~ubÍ wGï‘ñÙ5„Õ'–±°±ó½8?刮ùÌâä{}'leç^wròªÓÜ‚MS‚,-,|Ç­*!d´áù»í çœÍiMM@ä=:ºÊÕÎÖÆÊfä‚=Å\ „„N·¹TL[ì6ñRç[ìÔA^6vvŽî碾!M¼¬È§óA6s¢®îXèåáâà10,­œ¶¹la^Œ'ña¡öc‚(¤M_½tÅ@#@ÐôöëVú>QP•ýV µr°) ]oòÔ¾ÑÇŽ`Äæ]£·v‘4:^&#%Ž ¹¯é&Á’ˆ¨Þ»¿¼¦Œ~1w 5RAˆø,Û5ûé² =Üy%Uy ¦.iéþÛ×O§!C¼?ÅÍô’Î?%Ý bìé¡NòEÞÏ] ­B³ˆX“~ÏÑÁ¡¨NˆXljY‰ˆX”xÈÑ% B€ˆ±¾ó¸UˆøõþxGgß÷e|DDÎ_}ûXœMb#"–>w³6O) âÕ-Aý†‰Î•Øµmg^CÄGgø[ˆˆužö7sÛi.ˆ¾u)!‡‡ˆß¯Œ1}S|Ôd‡8 å#V¿˜moïö¥¢=éæêæÁ'm=·âåjÚ"†ìŸæ3j©¨ÂÅ?l§^@Dä|îk`{þ“³®Í5tœ×7뢃µGV "bÒ­-AD'^«çâkˆˆeñ–fV¾3¯ "ò\>Ô!ò²ü -vÅT "²ßùX†eñ±4ÆÄÜn솧"È ÷˜w$k³_ZYÛ9Mº×ø1îô0G×~Å"bò¡™cö"âËc£½!"bÍpoGSŸ•ˆ˜r©Ï°Ýbéfd_Û~3K©Ý-½7½CÄé#=œƒ×ˆžº·IÍü˜ nîxˆˆxyÍ„!Ë‹„ÂÁŽŽá¹µˆÔt·ÞgÞsù%ÞîîiÍßÍ»?ÁÉÁás•³nm6¸¤=DM`"âóÁå-%­šÙ®½wÆq*¿…89 ©­—=¾<>ê‘Ïc€!%»|µ"~M/ìˆÒ:Žk­[”BסªÁȳwMæWxtùÍÊ?AfÓK®@HaÄÌi*dÀƒšÔ Ä‚v¨) »•‘§éìê¢Â"Ã.:Ù¹ùB!)!¡K0?¼I`¨„>{ÖK±U†µA]åhˆ oÓ£.·€Ð&¢&0¡,<¬›„ÀæiƒËí—-´c Ùå2´ú%,Åbñy|ªŠÊîÏLE)¬.cÓ¶/ð˜ìëêâì¸ärÚÖÛ~¬-GBj?ܶäúÆ£ÇDZäìK3ßwŸ1ÑU›jr Ðqð`ߥCmü‹åþ,HWïàK!·úía»§E?ðØlȪÓ«!a#/µ–¼Á×n½ˆXÕïòÀÔ{‰Üο—Ôp“žÙÙ=Ë«vŸì2Ñ bȈ‚ò@T|+“tÒ ‰Ò33Y’ðƒæ?Ñ"ªöh÷‘qeN…¤‹ @ÍÞp*¾•J:iKˆ“CKéÈI—Ö­¢LVJÄž&4I)É&p„)yøuÿ»}â5ÇÆšWßÀ¥7 Œ„ Ñ®"#zp(~d]\Q!ÌM±³‡Pð8Úú@×C i Ñ» ,®æ(*ˉ]Gz9uðVª~Y  F'@¨Ë*“ðê$îk}êRq«y¡deÄ/-é !%TWþ5»Ô^1cOw§`Ó.굩ßéD»ÔolY¾Èäh©Ž¶ŽÇØÕ ƒZ&8Ó$â®ÒP„m Êó&Áö>·³\ܬ‚âiAAt·•çæ ]R Žªwbs¹L&€ÈÑ¡¢®!Ô¿¢ŽÈ)K~>1~vŒý³ØW² R“îîïýÍ£.í®x{qí¤ƒï> µSBøYöç_{=$%$€Ðøéjñ¯`7ÐàÆÕIž¡´èÞÒà„†DGN(·)v§]3A#û]ãFW•“”·ôtÏŸð ²ê2œÂrF7²6›7MŠBšZaø¶S¥µ,’ ’¼ŠZ1ÚŠ¯%@4dTe¸E•@4€°œÍ“‘•¦´›û­i/›$l¡é*bÕ´;Ç}5ÿ–I]^Z†¥o}i³oËâš<,•–`Ô²ùReE¿@P¦¢” ´N¬k¨Ì.!´Ÿî„™ÔÚ¤&wµÛÖ®óÐ>^ʹò¤e”r)µ^N>ØÀ¯ù˜ÿǬI¦ÖÏ8úÛ·nNæ|I+¬€¼Ž&-÷-žGH²ÚÝdˆÜ„ׯªy€¢µ•RìÅPQ”•­W3t åáÕýÅé ¢=øæ衪^ƒ ¥¡—•ymêÇè"aÆuƒnîYÂ.Íyõ.€>b¦ÓÛÝ›kD*Ò­ØÉý©Ã-B«ºää¨1[:ô犘/•Í+uU× '$~'ÀÍ^¯ò§´ÓÍ^.æÔ}‘±õR"‹)*…Bί-‰6¨ À (Â’m®Òc¢èM’~òé, Òþ˜º¾˜²½-=ºJ1ók‚ä×±yÕÂv ­ ëçOg'"ŽçÖW ã°  î.2k8DX º&œÓ€ò.œ‰p™8€x.›sfM€¤Û—ªõM$ÁÃZêÕÅ1{-Jz/PîÛµFR%%fºÂ°9ç¾=~pP_¾áÝ+êM¼ÿá}ܢ˜˜˜˜ˆƒ Q×,6ú‘ bu^fz^eùg¥JÀåò„"ê0Œ&ÿ99k²§£†Žnaf–¡÷ rÙl {Ù×ïÅ;—~Ý;É~/¨¹p; …<W³ˆ~ÿ#Ë“—Ø)jw-ÍL×sšÒUC |.ëYÅçpŒZ¶;zÊm÷W”sXa©ÇÝž°;6-âªZ¿m£"¦y:{tÕVÎÉ)õ™¸žˆ\GH‰ýÔ¸NÃårÙBP·½¼cÀ¼áv4»WeQ51®‡”R·>Ý ¬š6bÚâàǽ è\撥ƫðx…Íh”€Íá ü–ì¿6q~¿Á×¹å“&ÛÞßÇG€N=Ýk¾/÷ xsáö—#¨ïJ¾l“šô9['Žšï:ú‚YI9wï¶UoG-·JýܦYýMÕ—ö»8rýÀ>¥AŽš:zÕÅßUûôÒC  ríÄÁ}O¦Ï²—n\ ziÁE€Öˆè€@gõ7U_轑ªê3f5a—|¸—É—Þ9þÙñhÕ n[~øîщcþpØIñy|±ëfÛH"SwÈÒ¯‡ÚY3¤€¦Ôk󱋈à¶ù–Ý´ÉNî7u5¤sr+ýg®°‘^ú ¯ñçPµ2¼©NÎ4!}þ(ÎìÅ<Žü@g‘|*0–=ˆì¯Ú¸5jjë8l1ïŽ\3a£ìÜ7{ƒ;XÉ/yµ)ô7ÜSê¯ß-Ÿ‰ÔÿÔ*Ù#"Bó…mB€æXZ‚nª l¿í¤¡lŠêÇ@Èýi¾Ý¶<4T¦µ‘=±övúß8À¶]6«,ö&kœ«†®i=¨æ3Âã°%$EÇ.¼?ÐÞ·eQ;Ú¤ÖGt x“%ºŸÔEo²ÜÅH»¿¬ußDCZ¤‘ƒjEMÀf °&SÛfjž¯²¡-§º­µ$ŠÖ¦ú­5ö6WB;l²Dáç0š¹mè>! fò®—'út°’ü2Õ*o|9Ø›þÔVÊúŸgqo¾è&ùAÚÍBßäFLˆuGËÝz(Ó ½Üð­òÑ·…¤içI{ÚÍçªñkh¨èÿµÓ‚'n¹ ”€Wž±älɸYÖíѨáCÒ½¥žý&³y<¾P°öèË~–íijZѨ½h¾ZRäçš±fjŽˆ´7Õm­%BH{ªþÖØɯUk¹DF[HñÛùy¾}Íþßáÿ¯K7ÿ³¥™ÈCþ : µ‡WÌ:ÿ,•.£1yÍÞñÝÈ{Ž„¢OoX}ì)$¼&¯Y?Å“Þ‘ûßµ¬:J»ùßYÇ¿²¬[5éˆÀÐQ:ØMGé(¥Cwó«/@Á§WgOžx”Pú_0ÐÚì£gnòÿGe ~vø±kñSnB±,€…Ï]zIý‹:Ó(eýëØfj̵g©µ¿ÚšSzòÌ庎Sõ¿†Ý´µtp—Ožô&»ŽÔÏ×ÊR†B€š¯Ž]ù¯f7 ¡_ZÿDUgÿõ©à„d“*ºgDì?…ÿ ò!~e¦‰Ý"þ¿î×æ…µ;(m™_í““ü!MÐÁn~ƒÒ®ßM]yNªIòŠËørÝu%……5„”l' ,ÍÿPV+é;dˆQgy;¿ ˜+@iUu%àUåò”娲¶dw=eª¬° šÃg°¤µ4ÕDVèÊâï\–¦´ ´¤ŠÃdÉjiªŠ¢=òë* K*…„©¦¥%ÍG±Us,ÌþFWÑU•¡ó«òskeõµäùu_ó+ôu; k òêä•UÕôîÒ-WmyQ¥P¢“ª"pKs jY:ºj@P[™[RA§Kêhk ‚°¦ø{™@WO‹€BnNn‘ ƒ ¼šª, ª ¿URòÚZŠ„SZPFd:+Ë5hLªË‹Ë«ê€.¡¦¡!Å @ˆ°¦ §V^Cš]XZM—”묩©(*¬`KH+h©+"!DÈ©.(.P49eue9TçJhÐj *)å®Ú²‚ºÊ‚’ ¤Kvꤚ—§¥«Ãì°d@P—•WÙEW5ï{"ŠjZŠÒLDŠW_ÀÒÔ:k×—PÔ¢U$?Í4ø–§ª®©&âYÀÍÏ. CU«³‘]’]%©!ÍÉ+tÓÓ€ÊÒŠÁÒÐÔ !„*),¨åði –º¦‹FPÀù˜© ‹Ù_¿éêé kˋ˪($ÒòÊjJ²ÍIBÞ×Ü"=]ÍÂœ<ŽäT4TäX¢ Í5‡©«Ç¬ˆ C»-òÈ«É/,ã#MIMC^Š‰yù\(ki +sjª²j æL“éÐ_ýÎìæíµ9ÿòæf¿´ œ¿sºÅÖiåɸ™¾¼÷°ÎrþÓ½ƒ£ž„×ÑÈ›§÷¤ù›ÑÜûc;^ôÇ÷ž¹-¾´zˆAÎÓe㟹If?5è7uï< +†Häú{9¾yZÐmLÔÉÉ €‡G§ÞúîÎAþdoÝc‡ZÏ9ºq€1;+ÂyÐò®6Î*åI _¤îÆÜë,E.¬Úª9w˘@•Õ±«=å C—? z{a@Á«€Ç’b®Õ¾Þ8ô²I§‚ÇÚ.£÷OÕlqbÖ¾¾8èZUÜ™uÂcS‡_þ&}'ö©–ÄÞغç~yQU΋°:GÛ–¬{˜¾/ú…“<”¾:jÎçþ™‹øŸ,õàl>à­´yØÃÓàðÒ™|ŸË[‰üY¾ß_6|ÛKgß ª/*TŸ=:%P›°ièéî½d‹‚ÝõOì8¢¼(#åÓÌ@íCOÌ>ü0ÈX]çê?GËÁÇB©äñ³øåçÂ|{+?<<åv¾gInŠÓà›Æ© ð][c媔ùܬ´{1aò ;üwhx0*Þõ¹k\÷*I¯Ì/ŽÝÌ¿–ø¤K°m¤Ã“r=/×Þik~ö›{­GÖƒB&<øP4¾/Sþ”5´ýþ*¢„nþø•²oÐ>E“ªp9ëàýk¦$Ÿ5óTª§Ÿvlx 1Ž¾»] ðúƒIrnžv™¯Ÿ§Ë8Ä^]+¬- ./4$l|–ÿuÝÜ|»JU<~;äPè3ùF°¿Ÿ6¶ò¦ª–<ß!õøëHkÒ£ ̱Ó'ç†Dör´a]¾gßA²=-ºÓó^$Vì pVž˜àtá«šO?‹§¡Y}Œ ´¬ „Ãf‡Å*QvË>yü80é5êìôèr0$Z¾¢°Vq¯2”•¹WÄ@YQé¹þFj@ ”º8‹<5´ ¶ :&±Ög]‘Óçò ÷àéžm6g0™?¾ô Ô½4Xí vFý{gßüãUÒJ~3S.|üæÜUîÑ{Í“ÎÌÝàdlÅw^f‰á™F BŸÂÀ¡§sæ-é2ºK-ÿ«ÔÞuê9xdŸC÷¾ Æj¾K¯´µÑ£‹üoÙå©!‘7ÏÇÒ€–[¥VP à‰B=7 €¤”¼¢¼è´G YZ] ,&±Fºë»ãÇ€2ÅO2(TÓwy÷>K¬²ìo*R§t3vãñï¶$KÕUCü7S’Éåñ¿fWë¬%Ž!k¯«%Ñz2xêî½déRÒ ŠTó•»Ëä¤1Yrö¤HßWÆQÎM†¥—ÆÂÉ£óªë(€2¤]5€Õ ÙuŸ4l}àêáiáþACG:›)Š=yéC—ôЕQ_RNŠÍ©+lX6ñ£«ŠlØ£ À¹Vf·ÇŽ bЂ½Aß®JË*+ŠV­„±¥t åWSçõW™ßè2„%#ò¡ä(9eu}==0uÝ:•.ò ¦Š- zúzºLÑ¢X¶cCQ„IqÊxžP(-§Ò¡ËÒ ÝuÄXhôæÉuù\!ÉhæÉùƒæí›1%óe¸¥·ûÅÛ/üM¯w³¼G¿wá‹Þ­ÕáWšÛvœ0zÖûõ"†w¶S§ÂÇ¡Æ჌Š¹ ³nÚ’óž˜Ý4”Îß|>ɯ÷i¥Áï €¥§§Ï¢!èër—S©×΋!´&W@ïÑ¥‹ž¢èy‘þºíÖtDš„4À:JIˆÉhC‰ÛDîØ|ŸAkd14 z[6­I?Ä%¤EëCHñét===ѯú]¦J©êò Þº.ž¿÷¨K/-I9‰å¾¶-̪ã %6]µÀÒKÿÐþ³6SFì<¬àÎÙ·ê¶]$d5•ùI¾×XtëÀÛ3kô¹ÄZ Eýà®òWOý’ñ9åÕô ç W¿ü =Ïœ¶sb\ʧôONÎïï;ïb ïÿ9ƒJ.l MüœùñͶu»~Ḡôì¤2ßî}ü.3ýãY3Ê,ÑÑ/-¬ŽŒIý˜W÷3¶ƒrÝ­ü”jGn¼’–žññýóÑnÇÂóÔÔºV—çÄ~HOÿø~ÎŒ *zr_ß&–ó€!¥LÕ~NNN½²yé˜%;R?~þò9íþ' fý˜Ïmµç~;ŽÎ(Ó­¢g¹b˜)i¯%¥;YY‰$X¿µ«Š.Mzû.-ùõ²•ËK¹* ]LTªó6ÝŠËÊJ?½|N¶¤lóÉk&êtlþßHº‘’×ì¤&ŠoBºÜŒ~´kíú¥·J”»X•/‚ùåÖ¡>Ó§2ïZááìààì¾âà] Qèçaù©RÔ«ók&ÚÚ;ŽZ|“ºÛÀcƒl9"@ø¯?hõè0y÷¬òK+óy"•/¿`åÙ’é{§Ñ[žT““UqÎô)ÙyÉ?=9Ò¿[;yê×?#óZxòMâõN4@ ÂâŒ8¦Š‰tÃñÍpš¥úòyTL[©Þ{ô€ûyæâ+Ã>üÃ×XÔºïÌë{E\_\/:›fdÇ%|`ÍܳLòEhL]㵩Žßmá‡+7CK2ýRò¸ Kê».èM.ßúþÜ\b:ìêÑ•Êt––ÅÙ[ÇúõTÿAT- àpEÓMÓr`'_ö)KÔù²¤#üÜììFÎÛ^, üªlG—Q‰NfV •m˜ÁBçî+”u(¥ÿ‘Ë¡—%ìR¾ñYxÔdýì ‰Û€F£3è€HÈIK§|!pyöüƾi[ÿÉ o%9ÛÀç°m“·Æ\}ýôbèŸ#Ž‡eŒœtç°Ø(Yr;-G/ЭóæÑþ|ß‘‘n:=70ê›’£tLd>Te‡)ž}– Pùœé8²3{ª»×g“yaáÎþ±e¨û­/a혙¡{¯<Š‰8°kÜîм†Û B]¬ŸÏì€-7£#ŸxÕ]ò}‚X6aDv÷±q/#ºÀ‰ )Y@§3hâô,5‡®VÎóV·eø¾oF#"#Ãç Zõ‚0¢jpw÷”ëéžG…[î<ÿž„œ`kóE~©€„ׯz£S°†*;:9Ay)/jUÕ‡vþÁCS$ßr3å¤~JK{ãø#K<¬gDJ‚.z.ðíSŒ²î@ºܯ¨l‰Hçi÷Ñ€â„7eš ,˜Øä ¤açcT›q8QÐx´r«Òø…j4í1#ÕNo õ!üZŸ› ¾\ÚZBþ9©@ø4ôM´ éík7·ã#½çÎ$M~ÄÒhL QenÖã³Ṉ̃Óm@ðírÿ ÛWœ‰ŠŽžkË žÂ”×}|b82{óÊJ¡MÓúMœëÕGªƒ¡ü¸ü(G¸œš³»®"X³`—ÑoxK›Þ}ÙÄr¨G7‚f×Þ¼:v‘t÷9sÚZCáí=,—¼R–B"}øÔu¶¤r§>Þ³Ží¯C|øçyíIóÔjÙüª‚|II=”¼K—`˜ÚŸH ‡ÀÑ)—/[vìÌŒó¼ ÒÃâ{:XÔ}~‘"­öj¤1€¤Í˜6ÏnÜ4Û‘¹æØRèàíø06ü¦6t4îàYðŸæß]Ö^7ú^AƒÒ´´œ[‚ ìd0·ÛƃÍSÏð 2>È©HÂËÊnq.a²$FüùpE°ñvϺóÆ}ßY–Åê½Ú^uJ"@#b@ÂÓ»…«€±ÁGg¡gÃO'Gwh÷;Á ˆÍS‹ðër×­['¢BI^z||ÖÒ+Oª×òYªk³{ë6óÃ+Õµ:wÒê¶t×NU&¼¿uÁfZøÍß$;öîÆÒ!R¼ìŒ´„oÒFØ@ie¥´¢$­¹æ@ÑP“úú©,µZ+\ áyŸ¿`† øúÚ±â @c&&ÐVn]é¾hοˬ¿'à!§7$+S(àd~IIæv ÷ïÀ)-ç÷ÐÓ$Ð2Ðpi„Õ9 Ç8ŽZé$ÔµGU&0Ö”EDÛáã7 ¾S~L:M‚Éh“ĈÄ{Âlh/åYGù¹tƒCÇF,*3tÔ¥*r*šýNÉu–ªOâDDâmTÏËJª“s™=ºËŠÎCåNº•eˆ¶ó(¥ŒÝ±$x2©`n€,>qõrƒ¥Ó˜©ó.EeÒ8y['½û  öT4Ôµ«’ "— áï¬íü‹Ëò »Ì­¾ì½÷6=/èè½dÅvŽÎJJE5eMû™ò½V§“’hÝÑr]»èTÖ)¨)‚(]ž¹g×Cÿ–öL¡ËpÄyËÅ ]³­MM‡Žûsÿu:½ét•-“î®KGBÐ̳;RØÖˆàç;)z£Œi¢ÔRÆó6©¾Û_ P–°÷µÒÆ…¦­™)okkkkkk¥YÈ=;¨ þ,¡v6pÞu>äÃûØSûþ ²¤÷ôŒËæ}!;Ã^ò‡[:u··³³³wÐ¥>¤—ôˆK¼­/GCy)nmë°«œœ2PÔVh³?ìwûJj¥S^Ü9sæLHR¾BñǽɦÜRÕjä Û²±Ëïþ]¿jWC{;;;'¹ê÷Åhÿ&ö‚ ‹HÊËÐ*Š*Z›t_C}-11111ñí_‰/xO|gl ¿auñÊ'Ê=äê’r›ÞÚ 1ü”·u”Ÿ\¦Ù ôc³y,9ÉVäj^?ýüÉ£ƒXjÒüâJ!`Á }ÀÜ!1ûañ£ü:ónò ¨kµó|hêë‡3‚m¯¬y'©ºù˜æ¿I)Ìý,¥­D#>Z’_ò‹R^{øè2Y² ùNQõ%îMbØÁe @@ŠK‰ûSËåËH4먪 £¢–Ólé“Þ˜B¶&¯¢ÅÀÞ\»î6cQš¼úÀû¿þÚ³brmò¹€Ùך¬'¦4“_Ím„hcDE‘ÀÆF©q¢º9˜w y–ðîY¨º¹}ÖÙíiL9_____Ÿ€é{÷)>pâIWQ¢Ó3‹ÙM¶”ð]hè+Pù™ŸJy€@—îÚÇl蜽¶½©„·Ù)¯Kõ{jýl)(èyzûx÷ë7aõIéŠè‡i•„ t23¢}ÿr· ‰ùAð=!VØiœtrBG@"…@4àoYqÛÐ/ÔUÕÔÔTÔ2=û>Ü´šg°ºâ@QØŽ˜ò¿eRDU[/oo/Ϲk÷Ôf„Fä E{¼›‰Á›ç÷ Ñ懄ðo^¼^&ø¡&ˆ+¦‘:dPvr"ê2PZͯ_á¼r6]Y¦3i½h; ÿº›ºŒ[| P'[ÆÌZþ'°†äŽvì€Ò¾~ú1G/ˆdŸ½}Fïy@zZ ®Ê ß½ÏpÞ yÂÏÙ¶~_%0|F8h©~.,óì'½ï“Ñ`Ø°Þ!OO§*ùÚJƒ¦ž‘ ¸èu‘ø¤ »vêuf5Š}<*O´!ÓÞöÖ3À²œ¯y•<èço”ñ0¬)L¾ä_ün .ÆáòU”×7 äÜO¾õ\»søèæŸ"/á½ÐýçOÅÔ‰—ûK—Q›’Nè+øS¿Q‹Úvíiߨ,%õnȦ³!îo¸¶sÎÂÃy¸¹<¾“TÚ.0nÓt‰áDÚ5$ö¡íèAÞ÷~¹xµ ÍÕ6ÛJ ,y´8xLZ™ùð 'ôl¦Õ'ùé†Ø½íÚÑ®*5%cÐâýûu­žéÐã}=(Üx)Íýï[ Ô̩澋Ü‚Lµ!³í%5&F"(óo 3ïÜÕË6R¾ÓóO› ú'QÔj•J¥R«Í{QT©´^§EAP©Tjµº6®&¿Z ¢­áÓ×^ÓÇÏ;îì»JMD¹×ºöö¤úÈð±ñ¹†óÔÆ9{”WçŸáï¾#.“ˆbƺŸ}ðbaÏÏ“kÝœù¸ßˆ¨ï4~Ê~üÔÑ;ªªÚI@iÒ:í^.× 5Õjê_‹ZEJ‰"©”$ˆDD‚šTJRªH´NTJR©ªý ˆÚo‰H´yTI² &"JØNµž i&EÍü~`’׌c‚Îꀂ1v÷ÂÚþýûF.^2À—ç¸Ì* çjW¯ñU¨hìð~Sf/ŽšºâBªý­>:¬ß'çLÛpyËÈÚÞ†D‘€û)é¶;¶®^¿ôìèøë­ß¥eÔKL–šÈE°g $•ËšqðêˆN ½ÑØ°qÇ> µ´&Qsœ ¹££Nß"©Þ$Vt÷ÇÞý‡*õnuyG˜4Æ:ȸp™'!S@®€BËÆÈ.ú4‚¼™¦*‹`¦€ý,è(Eó mÜB<Ú:v€ªB€0ÙfR|— :û}F¿ozú\Ím”œ7c»ŠUG¾88j×íyàZÜYuq9À4§Ñ2¾ ɶ›œ°?@ê‘Ϧß-Ö\3jãÑAÌ €ÜÄT;É _}%tÉ>W”×ؼyMŽÍÍŽä•6©—˜[ŒÖÁ›OŽ™6n¨wfüÅüVû¿E™Bè›ad “š{øø³Óþ3×(0agXР5gZÊd5ÚɦsÿKgûèÇÇV(@/±ÆiépqA—î0qFI(VÍÑ)g1zRŽbÃCDµGü"¨ 3 P=&‡­-ˆ†€ X¿ ²¡*­Ò4oÚ]N§ÿ,™ýnSÞó8ÜT\ƒ| ¿Ç¡ˆ Ï·HË,ð2²s óê±Îÿ\Øc‚¯ÆPÛ­w¯*¥ ™XZ7¶PÔ˜pJL`âóÑì¢ZÂjÝHÉ¥LT‹‚(ÔKU^‘Ú²QëFææ-í­U>)ªDG~”+C‡dµ Y1É€'ñÛöUú~Ô·¹îU™ÂÖÆÚàF.$Å¡[WHoã¿Õ0+ÃÔ „Ì5PyÀ¼p8¸ 0eøº‚JåÔ=fepk†+ù¿SÞ¾¯Új|ŠÉ‡9°_oåónÇᣛ:ïY;¾u½pîçëkfmÍ5é¶ë›¯ª¿,.‡•©TóžJMdõõª¢ß§ l÷Á¦/¦õ'"bÌÚÒö¥2§&Ó"¥] +s›—Êgu›[^‹Ý˜*Þ<» üü^†ù}{yÃŒÆt «Ì 9ÜdèêبD`ÂæÝðu||¼DA•ßI¼Þ¢GöÍLŒ6B+)@ R05G«–P&FBPB¢†y?ø(tT†L‚ÃR4“èÎ<€¾5²•X~Ÿéoî¯ÞÛÔΤ,÷ïv®ntß±¤¨ÔÁ}è<÷¡Àªµ3Fï>}eíp™Æ,Ò¥%ÎüQŒ~­ˆP”•+•Iêª*°ŠÇSGvûäÜÂam«7\Âñm‡œ¬dÐì¼üسoçö$9YIu}œŸœ·²²¨Ï41µH.+1¢ÁT…áC†Ù†Yè¬)K(+³wwK9¶/`¼˜þzjŸ…•£VÝÝàÅÀº@ˆ­°þ+¸¹%Ë $ W×áÈ1Ø?[{EIH k€ðvsd‹8zÎZýB„ò2T©ÑÈ2‰æ°Pqa•eG Þí8o(†-ÈBöh×­7—ÎôóùúüzvŹÏØ ¢²¤èÞ݆dd•–æ­žþ^ï~š•©ŒS»·ÇÝ%¢ýËFÏ?PT¯!/¯P%‘zݘ^þ+ÎäÜ9½¼w¯€,Áp¢}­wïØ´§Å%%E¹wFúô<ðk‰ª‚¼¼‚ügsúy®¼t¯¨ ¿äE%ý´9pÈÄÍÕEåçå(ë¬ûãÜ5+S/sïoز[­w§+:äTãš;Ô‡ò¤@æj§^$‘&J#dT.h×Ì,AhCD”¹™‚5¹8““99Qï÷ˆˆFZ@ÇU»ÍVFõ÷üòf_¡à¼™Y'R=Ï^äííÝw°ß®Ë÷‰ˆž^qñWA$]ß=ÐÇkH@Äëå6º˜ˆDñxÄße牔ó|]ûêÐÛuðŸJE‘„ò=+Âúz{F¬Ê¯µ>ìë'Ue.šêïíí=ÈoÊO ‰ˆ*ïùººéHõšµõ{"Õª¡uÊrs˜RQGÝzºÜ($"*¼ûcŸõ"j¯ìLÌ´Z݈DD±K©‘Œä&´pém$' #7çþ-@NDD¿-&&!©´öϦ%ÑøVЙ'Ñê—Ï<=½–*y·ãðáz³ý³üõÜOÎoÌ• ï?° #Ž) ×m ¬º°—ƒ?Ørñ”G ­›[}‰Õ¢tÓõ|2;p¥IoÊpM G)žˆ>ÛçÚ¾IŒå㼑¼Ag¦Äªç÷žT9wlò¯ÚÔKHÚŽ½ÄÌ$‚P|Ï÷ý™‡®üÒJÁws¸ºáümæ10ö×Í Y–ÞŽVü$2‡«‡Ãù{‘ð&àp8\Ýp8®n8‡«‡ÃÕ ‡Ãáê†Ãáp¸ºáp8\Ýp8W7‡«‡ÃÕ ‡ÃápuÃáp¸ºáp8®n8W7‡«‡Ãáê†ÃápuÃáp8\Ýp8®n8ÎÍÿ¢A|¢øpIEND®B`‚suricata-3.2.1/doc/userguide/rules/tls-keywords.rst0000644000000000000000000000627313051004444017316 00000000000000SSL/TLS Keywords ================ Suricata comes with several rule keywords to match on various properties of TLS/SSL handshake. Matches are string inclusion matches. tls_cert_subject ---------------- Match TLS/SSL certificate Subject field. Examples:: tls_cert_subject; content:"CN=*.googleusercontent.com"; isdataat:!1,relative; tls_cert_subject; content:"google.com"; nocase; pcre:"/google.com$/"; ``tls_cert_subject`` is a 'Sticky buffer'. tls_cert_issuer --------------- Match TLS/SSL certificate Issuer field. Examples:: tls_cert_issuer; content:"WoSign"; nocase; isdataat:!1,relative; tls_cert_issuer; content:"StartCom"; nocase; pcre:"/StartCom$/"; ``tls_cert_issuer`` is a 'Sticky buffer'. tls_sni ------- Match TLS/SSL Server Name Indication field. Examples:: tls_sni; content:"oisf.net"; nocase; isdataat:!1,relative; tls_sni; content:"oisf.net"; nocase; pcre:"/oisf.net$/"; ``tls_sni`` is a 'Sticky buffer'. tls_cert_notbefore ------------------ Match on the NotBefore field in a certificate. Example:: alert tls any any -> any any (msg:"match cert NotBefore"; \ tls_cert_notbefore:1998-05-01<>2008-05-01; sid:200005;) tls_cert_notafter ----------------- Match on the NotAfter field in a certificate. Example:: alert tls any any -> any any (msg:"match cert NotAfter"; \ tls_cert_notafter:>2015; sid:200006;) tls_cert_expired ---------------- Match returns true if certificate is expired. It evaluates the validity date from the certificate. Usage:: tls_cert_expired; tls_cert_valid -------------- Match returns true if certificate is not expired. It only evaluates the validity date. It does *not* do cert chain validation. It is the opposite of ``tls_cert_expired``. Usage:: tls_cert_valid; tls.version ----------- Match on negotiated TLS/SSL version. Example values: "1.0", "1.1", "1.2" Support added in Suricata version 1.3. tls.subject ----------- Match TLS/SSL certificate Subject field. example: :: tls.subject:"CN=*.googleusercontent.com" Support added in Suricata version 1.3. Case sensitve, can't use 'nocase'. Legacy keyword. ``tls_cert_subject`` is the replacement. tls.issuerdn ------------ match TLS/SSL certificate IssuerDN field example: :: tls.issuerdn:!"CN=Google-Internet-Authority" Support added in Suricata version 1.3. Case sensitve, can't use 'nocase'. Legacy keyword. ``tls_cert_issuer`` is the replacement. tls.fingerprint --------------- match TLS/SSL certificate SHA1 fingerprint example: :: tls.fingerprint:!"f3:40:21:48:70:2c:31:bc:b5:aa:22:ad:63:d6:bc:2e:b3:46:e2:5a" Support added in Suricata version 1.4. Case sensitive, can't use 'nocase'. The tls.fingerprint buffer is lower case so you must use lower case letters for this to match. tls.store --------- store TLS/SSL certificate on disk Support added in Suricata version 1.4. ssl_state --------- The ``ssl_state`` keyword matches the state of the SSL connection. The possible states are ``client_hello``, ``server_hello``, ``client_keyx``, ``server_keyx`` and ``unknown``. You can specify several states with ``|`` (OR) to check for any of the specified states. Negation support is not available yet, see https://redmine.openinfosecfoundation.org/issues/1231 suricata-3.2.1/doc/userguide/rules/prefilter.rst0000644000000000000000000000064013051004444016633 00000000000000Prefilter ========= The prefilter engines for other non-MPM keywords can be enabled in specific rules by using the 'prefilter' keyword. In the following rule the TTL test will be used in prefiltering instead of the single byte pattern: :: alert ip any any -> any any (ttl:123; prefilter; content:"a"; sid:1;) For more information on how to configure the prefilter engines, see :ref:`suricata-yaml-prefilter` suricata-3.2.1/doc/userguide/rules/file-keywords.rst0000644000000000000000000000603113051004444017423 00000000000000File Keywords ============= Suricata comes with several rule keywords to match on various file properties. They depend on properly configured :doc:`../file-extraction/file-extraction`. filename -------- Matches on the file name. Syntax:: filename:; Example:: filename:"secret"; fileext ------- Matches on the extension of a file name. Syntax:: fileext:; Example:: fileext:"jpg"; filemagic --------- Matches on the information libmagic returns about a file. Syntax:: filemagic:; Example:: filemagic:"executable for MS Windows"; Note: as libmagic versions differ between installations, the returned information may also slightly change. See also #437. filestore --------- Stores files to disk if the signature matched. Syntax:: filestore:,; direction can be: * request/to_server: store a file in the request / to_server direction * response/to_client: store a file in the response / to_client direction * both: store both directions scope can be: * file: only store the matching file (for filename,fileext,filemagic matches) * tx: store all files from the matching HTTP transaction * ssn/flow: store all files from the TCP session/flow. If direction and scope are omitted, the direction will be the same as the rule and the scope will be per file. filemd5 ------- Match file :ref:`MD5 ` against list of MD5 checksums. Syntax:: filemd5:[!]filename; The filename is expanded to include the rule dir. In the default case it will become /etc/suricata/rules/filename. Use the exclamation mark to get a negated match. This allows for white listing. Examples:: filemd5:md5-blacklist; filemd5:!md5-whitelist; *File format* The file format is simple. It's a text file with a single md5 per line, at the start of the line, in hex notation. If there is extra info on the line it is ignored. Output from md5sum is fine:: 2f8d0355f0032c3e6311c6408d7c2dc2 util-path.c b9cf5cf347a70e02fde975fc4e117760 util-pidfile.c 02aaa6c3f4dbae65f5889eeb8f2bbb8d util-pool.c dd5fc1ee7f2f96b5f12d1a854007a818 util-print.c Just MD5's are good as well:: 2f8d0355f0032c3e6311c6408d7c2dc2 b9cf5cf347a70e02fde975fc4e117760 02aaa6c3f4dbae65f5889eeb8f2bbb8d dd5fc1ee7f2f96b5f12d1a854007a818 *Memory requirements* Each MD5 uses 16 bytes of memory. 20 Million MD5's use about 310 MiB of memory. See also: http://blog.inliniac.net/2012/06/09/suricata-md5-blacklisting/ filesize -------- Match on the size of the file as it is being transferred. Syntax:: filesize:; Examples:: filesize:100; # exactly 100 bytes filesize:100<>200; # greater than 100 and smaller than 200 filesize:>100; # greater than 100 filesize:<100; # smaller than 100 **Note**: For files that are not completely tracked because of packet loss or stream.depth being reached on the "greater than" is checked. This is because Suricata can know a file is bigger than a value (it has seen some of it already), but it can't know if the final size would have been within a range, an exact value or smaller than a value. suricata-3.2.1/doc/userguide/rules/dns-keywords.rst0000644000000000000000000000135613051004444017275 00000000000000DNS Keywords ============ (from v2.0) There are some more content modifiers (If you are unfamiliar with content modifiers, please visit the page :doc:`payload-keywords` These ones make sure the signature checks a specific part of the network-traffic. dns_query --------- With **dns_query** the DNS request queries are inspected. The dns_query keyword works a bit different from the normal content modifiers. When used in a rule all contents following it are affected by it. Example: alert dns any any -> any any (msg:"Test dns_query option"; dns_query; content:"google"; nocase; sid:1;) .. image:: dns-keywords/dns_query.png The dns_query keyword affects all following contents, until pkt_data is used or it reaches the end of the rule. suricata-3.2.1/doc/userguide/rules/flow-keywords/0000755000000000000000000000000013051004444017001 500000000000000suricata-3.2.1/doc/userguide/rules/flow-keywords/Flow2.png0000644000000000000000000006332513051004444020431 00000000000000‰PNG  IHDRzç—ísRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ2820 IDATxÚìw|ÅÇÏÙrûMï!tBtDAEbAŠ€>EŸ>ATEPiòDªR)*" HïPB éí¶Ý=ï{“Ü„€ø„«Î÷Ã'${÷îÎÌ™ùÍ™3³³HDÀ0 sû¸†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†a–†aXn†aXn†a¹a†å†a†å†a–†a–†aXn†a¹a†a¹a†å†a†å†a–†aXn†aXn†a¹a†a¹a†å†a–†aÿ“""".Y†¹Sù¿Û8Þ&iضý×]{ö‰{O sÚ¯ÏCÿß·¥Û¡|‡ã“3"ïæ²å±æŽA”ä-Ö·HhX±R%Düûå :6®A»VÎ<d1Ì‚ Þ‘&Jâÿ¡5·EnŠ|UUd¹a˜;@Ð4õÿW+.C†a|ƒÄEÀ0ÌŸ¸€âr9Ž¢qŒÁ` ¢›^±Ü0 sóc)ÈÊÊZ¼x‰Ùbqë‹Ëåjß¾}“&MØ»aæ–‚ ijvN¶ªin¹q:9997ùmŽÝ0 ã#Xn†a¹a†å†a†å†a–†aXn¸†a¹a†å†a†å†a˜»Znܺ÷ôúGD…G|½ß¨;žäy¥°è£¢tÞ Eù.Ù…EZ” ¯ìüÙ’¤’åp3'ïyí ?üã"ñ*Ï›ºw‰ëÿø3·,«6Þôo¶8‹RsÓ [±×.ÞýVçèVã‹g¦‘Hs奺Tgaa b@Íu8£Õ „¾Ü‡TG†Ó©¬a"¦:ò.¢!V¯×l)ä>‚¤Ô-(ö4§ÝV˜+QgŠd É7›ˆ¹Ÿº%"Õ™ã°e“F‚lÖ™B$Qräd™‚"þLI"iΫ§Áh ø£o!‘æ(È͵…ƒæ°ç^Ñ Àä)gÞEÑ)ŠÒõ.Eî[’ (æHuQ€Á`¸‰]‘¹$S´(IˆD ¹2œN¡ðqÁ›­šêÈ¿Œr˜N¯¿UµŽ€r ròÖ…›o¶Ü4½%ZþJýG"WºÍ.­! ¿P áoÙ‡ÊGÞ(i»?~æëic|·üÀÆ/lüâÀw_å;(ëàÜ3Vè̈àåõŠ¾WŸVºÿü«ÙF¸¸ýƒ•Çk"züµ`ëÛ÷nßW`±\ùzd×ß,:´yùõŸmžöø–Ÿºt(Êpríëk?›qôû‡6¯Ø³ìo=}9-ßÝ„|QŒˆH^Ù9ë«×ùuåg6,þéã§VM{-'ßáÌ>½äõW5`‘»FÞ~Pq¹yyF„fî»üã/@„²ü»bc¸««+ïÒoë-þã{+Þy`ç1Q‡€‚ ;f?zéJzù‹E–tÿC@õà‚×Ól€:Hýé…[~$¤ÒNJé/ Š´mAN¾ ‹œb2öL]ýß5:#•È×5>` UÄü>ì»}ÓqA*á£]ë·z{ ×^¶TK2f¯Z4fxM)í°\ãŠ^QIY>vPZŽêî݈J'»¤÷ ^Ž¸÷e tŸ¼ôÝéT²É”°5º2Oíݲ^¯½æäÝ€(ëC+vhñØ㨗`†¨ÓéerÙs®*ª (ÂpÚò L¡àÊIQ¥ £Ù €öÌ r@”$ÉÝ»$½¬7Aa׊’Þ,‰H„º€ˆº÷ˆ Í‘¾î­^?Ìï2èAÐE&jÙ¦–SQ‚½Szüº~]¯ú»A"TÒßôÙÂÄ [ãËɤ‚d…½“îÛóÓm[U‘ &Íé²e\&A‘¢( +?Ãá°†€I’@såÙr³Pg‰Ðu(d½ ¤)™—$k´N{Nª¢ª¢!0BÅBïdKl³î!jž#õL²9®aíæu5'x\AQgBrd^P4Ð["t=)Ž{~H† ƒÅªäœ9sðp@—ËAæh”Œ Žì+6›]4Í(`ñÈ@sزÓ5MCÑ`“+·,š« Ãa+@}¡AÖÉ@@@ª#ÇžŸK²)Ô`0‚j϶ä ¨4Z¬î\ "J:“(-ë’Ó¡ÈÆPƒÙ„ª#Û–Ÿ¢!Øh¶(¹—œB ÉbÔùÙiÆÀhT{îUEÑP2Â,v& eÁ¤8²òìvt†€IB$P9ö¼lõK€æ(ÈNÕ4Ôé\:£©ðnÇËY“k4élù¹Dh ŒE€œyWN'€ ·FȲŒš«  '“dS˜ÞlÁ ëõ@¤Ú2/ ¦½^¯9smy9 CŒF¨öŒ³?¦] ‚œt½!Àž“ªj d Œ±¸)øµÜ;㚦© ×wÇ ÐÑeÿ>vE_­^C[Êî‹ùqÝútZñþ´þoÍ1™iËèn©ñÏ 1\N1æ‰o­ ‘nsÁ¦)šFHúÐŽß·xá76Ûn[’ ¤KrUBöN'Ô|1š"A©Ûg4'+B{&Ô¶BQD%?Y¯»²óÓ‰qÕ2nÈ~¬Wÿ.ç7ÏÞ¶ùÇ*‰=ÕŒgÏåuzñ½ LY?y¤µNWdžØªã sÝ)— pþÛ÷Þ×mäë—7ÝsÊ_§ª#ýĉ3BŸ×^3n¿ºá»+‡L{933Ëå„ä#g´®«9=£IQpþ¾øÝr)ýÀ©#W»¿:[g?º~ê«áMzš\§\ÿħ1û \¹©‡ ì)pé—EûÔ6!ãØwë[Œ^\.& ˆ@4àáyÃS¥aa¹'V]¦vŒñËŒ^Õ}©K^ûî«Qm”ò/ص@Í:°~Ú«Mû˜„¼“¿nmü—•`÷šéoG5yÀ$9Nl]ûÀÂæÍ£I+ ë¯^~L¬ªæž?±{»×VÄÊ¿}5æ•rí3ËŽc[·4>+ðÜGß~'÷k‚@P´fÅ´ÍüæøçÏ'ç…WŒ¯|eïzWL‡}¨¨2¢+ïÒ¾ KãÏoýjôëØw šyxíÛ£"Û=lp&íÚXû‰ª• Ø=TRvh|ƒÆ~µÙÉ+ö…d?·êía1µî-W«fnÒçmµ~æñSß¼µ}ËZT³Î$ÈëþƤ@ÌünÒ¹J[³Îq|ÏžÄaó"wŸ ¿}¾qí®ÏMÔ©'6¾û|H“‡-²íä¶ÍõŸ]RÅ’r𗂌ȋÇöÛO}s2=ºj¸‚Ë“Rcú¾2J³ÝÞM‘º(öìœ+çѽש ZÂãÜ>Ž’}fÏoG»Œß‚Ö~Ùó½S}é—s©bÖO©ÆxñRJ¸k“U= (€€|2òD"B ­µÛÉ9[\.Mq*N»¢)»¹×áIŸmÿŽ(Aú©óÁõk H@‚€@zYF –v¶â„/ËK_»ÚÒ©«]ýZì\÷y¹^6 @-çê›þépÕìwÓCºu~hˆ(hbÎK—.ž‹²ö¯ÜºiOÏ _šD×½»"XT§N BÌtpyÜ@AÔôºàà¨èÈ+¹qµëªN¯îÝié<ºyÓŠ*öÍçÞäKW÷~LÕŸmק£Ã±a›WϯþâS²0¿bë‡B¬pYUäø.-èëÁ’ýcê…‹åË…i (+¯óüäȨp¹ë£Ù)é éÍ‚NeÇ ªýR‡‡;:5¯üz°€P€“_qÖx©yv¤ŽïüïÜàNº<ÅZ»Ó“NˆOì¥JVM+a(kT•÷=.:3/î•r(%ºQlËá3Ââ*(èÏ®?øÛo½zŒ²®y,7Çd՟ݺ(¤íkòÅ÷ì=ÙóÍ)ƒÜ¨u­O_x9³ËƒaÁÅ’ îl®W9c‡úëLQ͇̎Ž¯ )‚Åqjïo§âCÃJjÿÚܨP³kÙ1ºØ¾€¢Ÿ[©ÏèÊP4>õ¯GÏ z<¼Þƒj ‰´’=ãâo=Ž™büy¬ñhï‘m¯^9w("ÇÅíß±¢Ç[ßX ÒéÏ_ί4¼{ÏûHƒ`CÒÖy³*®R½êéG*UKhµé«q±ƒ7Ö©hìW;;Sµû¢ûÒ»l駓v¤IæZú¹g~&êCÌD$„[µ”«jµzºC»Ït;LÅ* Ž&“þØkåþh*Þ gÐó›ÛÛ*5Ià’óª"èD”Ä‹kǯüÁH(¢[jÔ¶ ‘oÆRžDKzQ±;=7ô„¼‰4—µq´´›Ó¥ê“Ö KY«BΙ3®*Û…‹ù¡5¢ˆ@qaçß ®ü$:.nþ꽃 ^úÁ"£FºúÇý¼xÄËå¨øõïbAÒJG2ÝC­ÄqM´Tˆ49œ„: ‰NË(P.e…·ŒSíD*ê"ìù+—€¤Ša¡1Š D YMšêr[‰\RÃÇFmŸ9À!ÇÄÄ7mðàp÷+ËÄŒ«é¡µcU)€ÁUâà¸R/j6ÇG+Ç}Îœ‹ùÊycí…uOœøfl7kL¸„>M;7µåz)£æ0„5ABA$Õ!™ '¾}w¿!6(,4ïr¶¬ 5¦r…ðc'Ï·®o:tTmýZBƙŪ-cÓ{ýH© ó\FVVxH6%} $ê@ÁlÅD ¹Îo}gÏú¨ˆrÉ'¡¹ìÙ ˜B4 &Ù(—¬>¤˜ªGY€@0X-¹¯‚!=ù÷oß4D60ê©À®€ ’OäFTPœTsàD$(Ø·Ö™¶kåø¥U,²ê%GÊYÅnût帠\ÉÏp(ϹºÆƒ^ݾ Ï2²DVoÙø§QÓo{ü؇rCªµ\ã†÷?Q»(ð‘äÒ4UQQ/‹Qõî=°vqrøïq]G—;¶÷—µë‚.Ÿ¯:²-h€p æ‚dÙª©g5 H±ç+á¡ ï©JAÂsëVKåêé @ŠZ¡Ï‡÷ÝSÙ¡(6P5ßi ©NŒlÜäÐO]=š!€JÞ¥|§Î$ zÇÐQ´{âä¥5¬ ‘gðºcÂF—Ëé>Í™W@’ PTg‹Þ=›óJü;³¢f.ßöþ7Û:3Rö®xû‹×G>ùñgzõ&S  €ªª’$H’ ¸T Rí‚ A‰4•ž—¢¨Z¿ïÃ-ûæÙûóâIkÞ=ùÈØ©…ã AuiîžBµ;P\•û/éØ,HÓ<—°åªuû¼0’~Z²}Ñ“)WæwïÝDS½¬å%”‚,Ÿ5â²¾kßg‡ "œühë> 'Téxï†5sbk ‘¢Â1眤 ©Òû½ÅúB—Ö™ý×  (^Ú1ÿ´«Ó·û:òáÜ×™;sPP4·àªDÚ5qZrªšgÚPUI+صä Óýë:¶WssÒö¯NP—»(•<›&êEÑZ>Öïç•“ë6š`$ÍV±÷¼.í*•‰½ “X­Û“ºÙ¯$í^þæ±ÿöÉT,¸íS¬>^æGšV:Ž¨‚btyÏŸÍ1XQt\¸g¬V£©–³õø™èšå¥ØMòN|r^jU3H#úë…BÓ ¦í=²çh@8Zƒ1yË”Ts›†Õ@ÓP4XMh ë»>Û°zo£>ÿrG´G¾=ìyàÈ'•Ñ‡ËHàC W×oþ|Ž*¡9])?o|¯ÿÉcI×ÎlêÌÖÀ`ˉ՛T @Q·ÍshnõN —ù `¶(?}øÄÑ#çršÊw¯Óã& ?,[*ÊŽ_f¹” æÈØVç†ØO§ß´›-Pξmû,‘hÐ+)§NÄE†DÖ­wá‡Õ€Ö0HÙö¥µb;àÕ)˜AÖA‰^K8•::öýGvŒoÔkôGÊ— ©ZXÅŠ—·~ Ah±ÂÑŸAD"±Bó†I_äPN¯›öÃê}W~[ðóò5$CÕÎýê¶îô;µäbÉL©y9š)<\Ô–qfÿñ ¢ ëD°”o»~½(®MoÑÁÕbFò¹¤A-íøúÞÌÉwbiÉ-ñ—b/0W¬®íçß²VÕôáàʸz6߆ùg¶ä+%g6Ñ ú}G²1írª£R•Hp¨•ÃedŸZ—™‘©iP½SÓŒý»T³v̺{ën4STóJ÷ü»å=‘›þ;CÓË•[7I^3Û®œÝôñæ;@"MCIoP~ž9.Ý –¸J­‡MÈü=Ý >è8}áݸG(‚l½f”Ü‹HP%Y"}D·g†­™ÞólåÚYgŽÕxø¨ Ðôµ*Á™Ê&¤ŠíÃœ±v]Ù®[±@‡ˆTs­^¯½¹nÆð½óœŠ9ºá}£Þ“]D2ŠT°~\O¡ ;]\©Åøõuª„* ¤“w¤»È-÷Ýr!"H}ÿ«3×ÍxcṂ( :K\«Q ­›8ÒOÊ:}Q TÖë5Aî6úµ/ßš¸ìø Ê?¯˜Z5¨eÕ«¯$ì¸`Ô]¾Ú¦Uãò9[eI\N¨ùÈäã¯>v¸y§ 57ü»UP…zŽ«Ç¬ž-o— <«‹P”t: d½(é°ÐŽžH²±\Åüåóž])ç‘*÷‹ÇÇíºøù© Ÿ"»ý»›¦R…ëF÷jòÔœAÒD·^£`Á³€H1Ö¬•´hôaÑWÏ%Wï5ÚhQ6‚æŒHx"ìçÁŸÝ!‘«\“R&jTé>!ùø“‹F?hR22ŒÝÞz>Ò.ìøöåÅ/­0ê•œÔÜæ¯~(ª@žñ2Š²QE @IgDëxüð;Ó×\ú!/×ÕnÀ µ³§ìnP§Iíòµ£Õ'òz=¯¨˜«ß7|À7“zˆ«–›r<²Ùóf³ŽŠBB(K:}áדJ‘õï£FÎ?Ù4ïê¥æ&ÿößW¶ÖœqϽí7ÐýhDéb#CJF"5%´½éàVþš{zoí~Ó‚t†ªmïÛÿ^‡K‘‘Š1¾RÓŽ§‰3瞎û–¼p€ES…ª÷vmŠû7J²¤:¡J·ÿ›ðèž:6ïôfÕ#ƒ=ß7(€2ÒÅNcŸL1­2½±üêθ8ëšg[U¨g»|$â¡q1ºí3S·åá»ý•×Æ×{j’3ß“"Í™›® £ÅŠ^+£4WŽÝ.˜Ì‚€®¼Ì‚ü<Éd°j €jÞ'˜M3:³.‚!D§×ߢöMD€ªŽ<[^ l°†I2’ˆJ~ÚM@ @AÔ™C YU ]éªd5èdü›^Öç1–€‚æÊÏÎÐ4M4™ª“@SòsrÌÁ¡@@š#?'ß ˆ¨äçfe‚ ·„†£¢¢€ŸyI%É!h¤:2lN½ÙjAWþe»b µÚ³ÓvÊfKPˆWä†4Õ™Ÿ[` vå¦;I4ZOQÚ³¯èƒ").’LÁ‘ àÊËHUI0EK"9sósóô¢šå"‹Á '@Õ~Ut:½;ED‚(d]v¹Ih ²‚ öœË’)\”Dpæååf ú“ ò5s€™EAÉM¿¢jh ŽÖ‰ ¢jËËÊÐ ÑT÷ Hµç¦¡¬7êT[ÎUQª7ÉJnZAÝ£×a~úEÁ®×é4G†Í¦š‚Â@CApå¦ÙìvQ` Ð\…jKZ^^ŽÍŠ¢€JNn®Ó‚ºò3ì6›!¨œ^Öò2. º S€É–qÙé"sh´#;Ug ÝËüTÛ©EãÞî;õ3WêMæ "QÍÏLU4Éöœ¼üS`¸$‰™—M0…DŠDš+«À†æ€@T Rm.90HÔ¼Œ+Š Æ (ŒšF`ÏIUI¶†„Ú³®:vAoµ•Ÿ+c)£¤ƒm_|æL¶X¬E[£wèС}ûöÿ¹ñt€TB<‹R‘‡P4X˜mÏÚ$ôDDÝÃmºUì¹gšË;Sb´†žÕ˜… zÝ«AéoSÏò^¯ôâ59‚âIpƒ#îh³ç”XGY8bôLNQáJ¥b–EÆ¢[‰vßÆíVx–zìë©D€E7-•Çâ›yONRÑâþK½eͼp4×ÔœR)-N‰×z,ø›¸Ñ®(Ge%áGJü(Y¥lWú2e¤Kþ(Y“¢WÙ–J^{ÓR•Æû ^Ùö®8×ñÊçµË¼xÝ«ÔåðúQŽ¥Qò{Xºr—ít‘mú?#kpÖQfÕ-£èÊ,ÒY/ù¿ê4?Î0ÿP²VnØ\ôù£¿¾å†aþ‘Êó÷yÐ,7 ðÜ0 ðÜ0 ÃrÃ0 Ë Ã0 Ë Ã0,7 Ã0,7 ðÜ0 ÃrÃ0 ÃrÃ0 Ë Ã0ÌÍpû6 ðìŽ{Í[^†ñKð/o/zë冈$IRŽ_ÌT]O5ÈÎÉÖ4mvB$ë .‡ƒ»”;4$Š—OîjXíÿ¬Û±­iš¦8EGœŠkÎìÙ™™Yl°;Urؽ[G@A”ŠöÇø›wósox(Š¢h4«šS”uzY§ck1ÌáÑþ?ûçÞúPq™‰(ùÂy†aü›ÿo÷/ž™bÆW1ßø]E†¹3<ôÍGӴÇÛl6¶ ÃÜI¨ªZ£FàààŠÜüoebæîL±Ö0Ì­Äf§üpâ…CÅ ãoœ= óæ¾h”å†a˜ÛGR<óŒ{àà_ŠÃrÃ0þƒ[\.,þéW‘ ä¥w ã7Zƒ^oOïÒÖ¯÷/Åaï†aüÅ7@€©S=<ééþ•–†ñïFÓ`åJÏŸ/Â… ,7 ÃÜïæêU8}ºøÈ„ þ-–؈ ã7œ;ˆ 6ÄÄÀ®] ( ùM+æP1ÃøÏ`ʾÉÍ…uë OŸÒÇy0Å0Ì-L¹±Û!5µŒã,7 ÃÜzÝQL8Ë Ãø]«Àåb¹aÆ'ÞÃÁrÃ0ŒOäÆ?_jÂrÃ0þ†(‚ÝÎrÃ0ŒOPU–†aØ»a¹a˜; ŽÝ0 ã#ïÆ?ß2ÀrÃ0ìÝ°Ü0 s=ï†c7 ðwÃrÃ0w‚ÀÞ Ã0¾’^wÃ0Œp:Yn†ñ üD8Ã0,7,7 sgÁP0 sÛqo.Ρb†an;î‰ Xn†ñ‰wÃËü†ñ‘wc2±Ü0 ãD‘å†aŸ`±°Ü0 ÃÞ ËMÙ\ÿ•Åø.c*þî O¥?>…¹¦¼žuÿÐEgÐM¼Ášn®v”ñ%ú3·¹ïÆŸcîî:ŠˆÊÁ]{ €HÓ™ƒâ«U5éDw@oüUÐŽü½\•zV“|ýŠ†HšË¥ˆ²ýéõªþgJ[^ê¡CI$¸‹Cc*WŠ "D¤™Á–sù`²³i½òÐ5‘æR4Y–ð††tߎˆ‘HCÄìÔsÇÏfÖK¨o¸ WòÇ¥7<˜ÊÿÔ5¿üžœ””””¼yùŒGú¿’Žˆ@øÇý¤kʸgO¤äy@¥+((oxå""•èånÊÏbnŽKI?Žóîés’’’NÙûê3Žûd£vÖ\ëmÀ壛ýÊÛ ¥ìAî®éÌÖg_œˆD…¶½Öa!B"Mtwaîšãëo>9dø°ácÒoInÍf\z#ÝõµÖÀÖ]»w©KDèê~¡O‡IËÒ¦<fÏMÛ»÷`K -W½~õr iꙣO_L³„VhÜ°ºÁh4‰RþÕÓ;¦&¶I4€ýøáýçRsL!åš6¬! ˜¼}ݯGOÖØúkû† " ¨Ør~Þ¶·~§vÁD΂̟>˜Ð¹mÀû`æ )H!åª?Ò»—€]*[|kæ~Êѹ‡NœKEÉ_¯q\ˆ4[úž½3mT¥Vƒ*±!‚([L:·Ïzl÷6GDúåƒYwï;Z `ùêõãË…¨ö¼åk6$'Û¿ßw¼}ƒênÉ:wlïÙ,]bóº"h'÷ÿ–¦5k\ÌyáÁÁÿY¸$Ü" 3ýêΫQs>ý¨ïïܚ^–ýñ±)ön¼;;Q 4ç]Î8ùx^{’S5%wúËC&.ÚŠ‚°mÙ”×çor:•_¼úøËsÝê@€®Ü¤Á†^Ã}6nÔ_íܳòÃÿš”O€HNEeY@p§$|håÔ½¹7úŸÍçèî™[`I·£fÕMSñÔO3G¾³À¥ãêÎ!ýžJδ9s.é3`ã©ÕžùÖˆ¾¿$ev-|ã…©+B-¹—¬ïàƒi.Ôrß9`ÙîK¢ˆNgŠ’è©-€‘ÁÒ‡£‡8—ãÈ|Û IDATDÕ¡‰’€ˆ$‡ÅM?DÍI¿e.¬Ñè;l±w(N‡ÍN‚péÈöŸÓ¸ª+oÚ’eAAA{xÝèÛ`@Ûåó¿ûÙ÷ñQæîÝ›.øtƒ‹esÂ3Cïye^ÿ¶]g]ºóü¬¥ŸÄa‡µ~l;èhòàúu›ê„ ‰MÂ<#(Á8jöü‘=ìܘñáZÇ—kÚ²ws+bqšÃî ͹pÉšòõCÃP¬ÿÈ’O,€lêtti㤫ùZúö¤êOÌ{¼'Ô¬zÒ¡ˆˆRVÒ¦—¿º°xÙÜ6Ï›kíþú°Þ.©|Hê˜9_ô™óBͪQº}Æ–uªz”@Ž¬ÿጽ<Ýã¡?<2vbëò–ŒS‡öžK°ä§;m?oýÁª—j7Nˆ°ˆnièN¯÷ǧ4Yn5û”GÏÖ DYéµy ï±@æÌ×_MÑEÖ¨›ð’1 ÀÙÓéV£I& °ƒû8dÁ9é¹~ÉJü¦vàÊÕKù™™¯Œì’Wçrò…Ë%„Œ™ø\ï>Ã_x,Ø º‡üHþkR#äžØöHï>i(êª7í4÷Õ'-—Ïý<|ì55³î/°41#ý|åZH«T¯]%€³{D9këÀ'?í9nEŒ p"%ïì±É}·É*¡æÌ»¢«d/Ý i±õzVšõØ”CÁ_ ©C™i)—.eéê•Ë9¢T±®·Ü¸z=ÏLù§û-Æ~2»U\DQ¨~œ8y§³jÆd#À¾wí8ÒF Š–ö jÿÎïs^^u8+¤NÃ(íêÆm§ÀuiϳϽz9Ûè²å€§#Dümþ˜E'+¾=gUý/_í>ÈSS·b$¥8¯…¦T]Núù‹i[lR]åª6ºüÕìßÓçþ§ÿÜŸOË‚­Û´èøÁ¨F£‡¾`hÖ­Õæ÷g¤+;W~ðÁò߀HP\nµADDÌŸöïŒzᕱ¯¼óêÄT·÷Š‚ ¸ïèQ*Y,íýÿȲ_îAAw;Ù&$®?rÞû¦)g_èß½sç.ý†½’sé§Îê=¿|¿š“ôüc]%´h}ßÀmÇÓˆìÃúܳ÷T]Ú>¯YË/d«ÙÉÛöìxO§Îm:Þÿù†ƒD¤)¶é/ö«Õ¤ý·{Îzn™r¸]«{wæe$ínÞâþý¹ÄüEÎ\Þ©ÿ¿•Ò†¤ó»–ÜÓ®mžNúúÐñõo6iØzsý²jVç–›6j8tÜœ|%íZœÐû#÷—fü«ç¨™?9¿™óFÛÖ-;µkýÐÓc.ä؈¨ ù×î‰õZô[xuÕ䧻 ~×FDäš÷r¿#¦Û5"MSÕÂhDD)Ƕ´m‘дYB“&MšÝÓ/õ/ævútúî;¿³ÞÝ*ELŠÜ·Ÿ|3~nÑWŠ®B×`ÈíIc‰¯žVìOkD¦þš)=…%Æ(79bñú®{ý&•Ió>F…†„k«OáÁ"+—éÉüűÌœ •*A×®»ñ+ÿ½æ4¼"€7; Rò*×ÖŸRG ½k,õ!kÍ­_[à7Ù ñÚÚ€7¨+E¿{U„ëUüƒš÷ÿaµB^Çn†ñI ÊÇ%,7 ã‡X­›ËrÃ0ÌíGýqÿP–†ñC,ÈÏg¹aæö#I (,7 ÃÜ~L&|Dón‘φ5¼r—ÍtgÀÏLý“ADUU~h¡ÛQz½þŸùˆ–{ç*§ÓÉO‘N§»n9ðáÿpÞÿxîú퇌fó]¼Ï ‚˜žrfé¬É+Vøg&ñÀƒ/ŒŸZ¯ikMSïV3€ÂÙ3'úß߶WÏîeŸa0°Üü£IJI¿Ø,±wó®2¢;Ö/Ïý/H=}æLd¶uî}BUî^3¡ò]o»®Üèt,7ÿìžÜÌÝÕ{X‘æ~ßë?<8r×GoH»aøçn~<3Å0~ˆNÇá ÃøJnøM Œ?@U5›ÍVt@–eQy2蟆FšªªŠ—£Óy^þ¸½ËÍ]‡,ËŸýwžÉdòlµ£i5kÖ4h—Ì?ËL’ôûÞß'Ož¬iF³ T¾|yÏî:~øËÍ]ª8EKoˆ¨ÀÝò»Á Õ4MU­pé£$I¹î§ÀÝÞ ?¢É0ŒÐëYn†ñMÛõ¿ÆËrÃ0þ‰NÇrÃ0ŒOðÙD–†ñOd™å†aß´]ŽÝ0 ÃÞ Ë ÃÜQˆ"Ë Ã0¾’{pžå†aüIò»…Å,7 ãŸp¨˜a!ËìÝ0 ãx™Ã0>B§ãP1Ã0¾ònXn†aï†å†aî,ïÆß`¹aÿ„g¦†ñUÛåu7 Ãø^UÌ0ŒàG4†ñÜðÌÃ0>L±Ü0 㓶+°Ü0 ÃÞ Ë ÃÜIp¨˜aßy7<Î0ŒOÚ./ócÆ7ðC ÃÜvÜb~D“a˜ÛŽ[hx †a|äÝxÿÂrÃ0ÌmônD‘c7 ÃøPtXn†ñ…Üð`ŠaönXn†½–†aþ,¼ß Ã0<˜b¹a˜; Þï†aßÁrÃ0 {7,7 ðÜ0 ógᇆaXnæŽón8vÃ0Œ/ð7­a¹aön8vÃ0 ÃrÃ0wRÛåu7 Ãø~fŠaön®‡t7Ø…ˆ12,䧯—Í@AL&£oÍEŠD_-P¸tú`íÈîû^cbbÎ/Úð{€…TÕ}ÄériäØ(€ˆ¢¨*®¿Ëƒ@ÄÔógèÆÞ ËÍ?ÒëD"ûÂмü<t9{îìâÅ‹%?|Ñò_$*Î þ#]q"jÞ¬éúÏk%OU• ]¼˜"øáØá/™)d)FÓ´ëZÊ ä.òn$I ,:hµXdI’$ îJÜeòÏì,sѧө×ɲ$ ‚À6ò÷ÁÔ]aÂØŒüp­Ôí.N˜ßË ·:†ñ~øƒt׋ˆˆèFcc柄æo+h}ÐU²Üø ÑÑÑ 6ü{"áïÐišV¾|ùn•¤:uê”+WŽåEUÕŠ+úµÜàݼpáîÚÀ *ÙF¥ÌT?>rˆ vmönü£uñ0ŠuÐ_ „ùM†a|¡:¼Ã0¾gòD8Ã0¾rpx0Å0Œ/E°ÙXn†ñ …O±²Ü0 s[Û®Ë Ã0>‘—‹å†a––†áÁË Ã0D3 ã+ï†'†ñ‘w늆ñ¢,7 Ãøön†aï†å†aØ»a¹aæÿðnxfŠa_Àën†ñUÛåUŠðwÃrÃ0wšwãt²Ü0 ÃrÃrÃ0wÒ`Š7 `†½–†¹³¼Ea¹aæö#Š<Î0Œ¯à‰p†a|äÝðC Ãø~D“aÁP0 ÃÞ Ë ÃÜYäç³Ü0 ã¿FÓXn†¹Í äåù׊å†aüÖ»ÑéØ»aÆ'ÞÑÈrÃ0ŒOÐë‹¥‡å†a˜Û¦†ñ&Ë Ã0>A’üë)M–†ñ[,ÿZéÇrÃ0~‹ ø×s ,7 ã·xVú±Ü0 s{Adï†aŸ`µ²wÃ0Œoš/Çn†ñ ‹í°ÅrÃ0~‹$ù×»_XnÆo1™ükwt–†ñ[d™½†a|‚Ñè_o¶c¹a¿E§ó¯×„³Ü0Œßb0°wÃ0 Ë Ë ÃÜaƒ)—‹å†a˜ÛÙÌá Ãø¦ù þõª)–†ñ[øM†a|çÝøWzÙd ã¯@n.Ë Ã0·Þ^‹aÁ±†a|Õ|y{-†a|ƒÙÌ/~aÆWð ÃÜvÜÃ(»å†a˜Û "€$±Üüy ?wQá Åçѵߥ2ÞèÂTæm½¯WúFTæWJ-Jiñu®“ˆ?º}©ÒÿW¶·ÐZEW-³ÊÎÑõ’QÂ’D·4µ%¯æIr ›—¶× J[ˆþ8åô'ÿyD‘åæfåùäÓ»[ˆn¾^Í!@ÄÔc;³ \XüUüöƒÞK·(ú.! ¢ýܾÃIˆ˜•rúrNÞðîˆàÌ<=nØíZ¶jÑ¢eÿQo¥8ñbÏÆm÷]Hdz֎Üë¥É@@Ô~\öIωuë7LìÐsæòïBD¼rèë„ZæïJF$p{´U³a“"âÆ™o%4k–PH“F Ÿ_f®qá;C›wz& sÏö½¯cr.ž=º¶uÓ„„&MŠ®ÓúÞ>9'7Ö«S?!!¡iÓf-[4o’Фqýþ#§¸oµÚ !!^£#ˆ@„ˆö®ï_û–­Z7oÞzܬÕbÚÑÕÍê4H(Î|ãÚ÷Žp".x}Pá:On™Þá‰)™WvlÙ(!!!¡yb«–‰ ê5z{Ó‘ì ûîmߦ8ïM›6nsïÉTåüñMíZ4kÞ¼E‹-š7KhÙù¡E×5gæÐÚ?<ü»ûú€—üÔcüçˆèÎFöwïTªßæ—SW‰{àÅÙßÀ”&ü¢~ÍÖ›RÑ]…pÁ“‰k¤8²Rú÷èœPl†‰_u}8¸QÃFMZ¶jÕ,¡IÓ¦MÚÞ÷DšóÖYǯ¼¥•Üf½Ag\òC÷w“Døä¹ç{ýwCI&*j§X,—îckß}}_Ã1o=Õìû…ŸH÷ÿ«GmÓu4 ÈùîÈ¡¶î“'7X¹Ôøxó¤·ž~úÍuŸ-Õýý*höiÏ \%rÒœ¯jÆä^<:qܘû’¾ý‚fÐn\úíãMG¸szþ‡µg´æît¡Y¥ùüySLäÙ.EùúUÚ;&|´qê¨.€€žÌ‘f®œ¸fá:—­° ½¼c×/Ò¥#žžwzû'£ lNA”¥?(Ø2 ŸÈ£)…xŸˆ„¹™)iNs¥¨ @twìˆè6.!:RO}vâˆÿ®<ôÎsu_úpÍ =&EWVC0…W_üÍ‚@QE¯ÌœðÞν—oëÒ¿u gêög_[9eÅÚàpãšM?£$îžöÂÛ§V½?Þ$ª’Θ}qŸÓaœ»í§êT@EÅd”R249¼î²¯> pÙàê±-O»¢k¼AÂáÒÚïðÞ†å=•¥Ð FÍ6qÁ¶–mº~ôõîÄ—º`Q úÚ,TŒÞ}öù¦_~ ’»Op”—V0vÝî.–Õ“DÔäø¬‚#=ià !£ýÖ6ÒF äbwK›‡J÷DT”8¯oØžînï0çÒÑgîÖ¾s—Ömï[°å°·÷Š›LîÒ¥ë½;zg ˆùû;wë1}Üóíº?òÎ ƒ×çJ/=öà²/K¢pù×a½ºµlÔ`ðØY œÜúå¬é;—½Õ¿_ŸO6þ6ãÅ¡SVÿ–´ê¹ŽON{ý…á=úP÷þ£“óÝn"iÎs)΄ö’dîÿŸ?6@¹ÆEv»XpñèO+÷:g.û¸Q•(£Ñ^¹ñ{|”¹íóµûÓA Œ¨’}òçÙîZ ®Z²¦õS.WQ%1eS!F½|=ÏÝ大&M»´jÒ‰Ô|ô*#2_Äh@A4™Ì&“Þ ×(Ê&“Ù ×aá°5çÚÿ¾Ó¹Më.Ú>ứ٠Ú/=ü`÷Yó¿9쩺wy}Ö-óô=8“íi;KÇ<ðØ{Û±ô Á™›úöû{»ýðEDôhÛÈ·å9!¤I|„ ³FLûbÕ¨®µ4M@Ù 7{e‰ˆ"ÞüpêÜ×Ç&»`ìȱ †Ø0ÖJ‚d4™ :½^E£Io2™t€F 7‚ÑT|€Ð Áh4åÞ÷dCóî#© bN:>ûÎkS&Ît÷tE$ȾœüË™7'Î]5m—½°ÑÞÜŽT­z×!½¢N,Þ´¿H—=i$A_œD£( l0™Í&ƒl" F“Ñh@$w£@Ä‹{×<Ú­}×.;vlÛ‰4Dļí:÷üôÃ÷žx|@ûÎÝç®=˜ý㇉=žHËÓÜZ3}p›MS@–Ù»)ÛyÙ¾nQ¿f|Ò²2äü֥˿îi¾©è„ä-ÓÞø"yÍ·‚$õƒá݇Ϩ6gx’Ÿæ¬óòo´8µ-ñ™iËVU(ît%Êûd婯V®Eû¨nmö%÷JlÛ³~삘ãG÷m<õ…Gª™Þ½FÔÙ __:òý£kWÔ Óûî€g^úlí'O¢»[’,ýw|½_–U ¶ZÉv11&²HuîÝöýÅ@  º”#…\8¼ßÐò©*ävÀä°JË6ü~¼U3õ¡O5ÉŸºbﬧ»²RÖgWý°Yè‡+ÓÜzëÈOûaóf½¦€FX³a³ e÷N¤ºŒ•^z¦Ëè·­™>´È»B@¥ ý§ § @sY¢´¨‹×# f^9ñõÖ´ÏÚ °rÒÐ7Öžú`´l{ÏæÎœ53O´ï9âØ#›z–³ÍÜxð½GêRAê¿j¾i ž†»È‰(´BÃO¿ÙvbÇš™Ó_ž–©ïûÔã÷´N 6zÆ(¡Ñ•Ú4Ô==`dxNnÌ…KºÑz;€êÈýiË« ºgxźªÇ QH¥Æ¯õ©ðHûâÛX4°]ÓÕ—ˆQêî¶^p9H3WlÙ´†·c‹öŒ#«Ž8ú @µ…Å·»?ô½ÁÓ~šû|ò*™Ó»××ød%k`“xã²9›š>ÛéOÕå¼,×Ó§tzø–ój@¢^<²m›$ÚÜJ¯3‡&6k¤“„ëõ¿DˆjÖÌ¹ß ˜º¢{ÍË»— œ8uÃü‰‚,:rÓÔj>{î¥Üís:Œ{³ÏæE-Þ¹çÈ…+mjDCÖƯGõ©~ã⺻½$"­ËÀ±±—™òî¤É³6ÉV°¨E'¬þ|cÅv-Oý¾k×o{+5m}vã"•DÍ]šÖ4—ÓÓ•€¢éúh(€¡q³ˆŒ<€¢inÓT'9CË'V Ó@ã®;Nn¸êw÷B„íúYùùÄ`³éä·“Z·ï:ÝADU=wþüÙ³gÏž={îlrºÍ. @Íà ûxbRL œ›i#M£Ž†[9íª玭¯Þ´ƒYR‹:L—Þ|ò´›S§NgæÙnHU{£ûGŸX<ã‡3ÞOýjŽÜãÇOy®rúäÙ”,¼AP˜€‚cêLøOŸµ}ðΤɿžÊJ:“ :]Ø¡cg@0šÍF1#ËþèÈû>û0SƒKö›jµ¬o)ì#<Âê‰+iDP­ÙýSg~þß_ÿêÃß›·«È"Ù:fÚâ)Ï?  :ïõþm{9”ê5Å~þÌÉS…yO¹’S(ˆX§n½‚«§bªVþÃH- ÚÙcI…y?•t.Õ=œt¥ì’˜˜˜Ø¢mûN÷?öZóÁ¯Ýß œF€Âóï½™òåëRr¼+úò9«žï™ ?æÁ]ëVfÛÕ?Y›5)°ÖÈöæÏ}àýMQ®œ(´ñéÓIÉ)Šzý¨0!"‘ôæ´ ¶+&Ošôéê=¹¹9rÜS¿Xë”'—+;CølÛÀšW–KìfÕ±wsïqÆèÞ{umïÝ1Ä‚‡7­÷n_v1ëøŽ/S÷€ Š‰­j’B J:¯GQ° ¨ÁÝ·¡W§´}‰S;|/K›¢ÈZ «Ó¡vlJâ”1q«{½2þÁ.€ÎÔ牧kEXÝزw¶  "*úò†}í<  m÷y{µ®áHÙ¤i•ZÕ±¼{&%c笯»¾¼Ðéü±(ÖÐòC‡Õ•¥ß¨wÒ…}ðÑs݇¾Öwù¤¢ ƒ.´òÈ¡OÃM^ÏØ4`ô'}žÜ©u\Ò÷™§ÏØU*,XUjÜ=Všê’#sÅüÄžã<Þ!^8ôÍÓ#§:݃ÿzsTfyéÔÖk–¬ÜÙà¡A4*š“”tÕu¬2¯ÿì¥öÅO¼8ö³…£ceKäÏ ¼fòHµ]~~üg¯.Z¿ú¥_6]Õ§Và BŠKî;üñ*%ǸDš.²ÞúÕsLÉ?Î1/åÙ%w‡ã® ÖFS_ïòÖ'_ütu÷Us·¾¿ê‚zú_O‹ˆ‚LjAúÉÔì&å-¶J?ôòØ5÷öÛ–ô”X˜ZG¾³ó3Ov”oÎ>D æ¦ |豨Nƒnß‘2/l:ò]QTNÄbGHsVjÔsÏ{ïç<}Ï׿¾oúü/tã+¹A€äõ¿ÌÜül\ ó·Ê½$BlTNDõ~ot; Å©H:Éy¸”yŠ'¡Ü„Êî8PpXè¹ ’#íd€ 7û aŒÅà9ÓžzæÉ _,1Æ¥¨ŠÓѼ­Õñ•âtÃQü> —¦¹µ¥|½VÆ”§–üòh¿Ä(M#AÀÌÓ¿þzU˜Û¦¾váØAôd«ù3g%ç†>Z9<ïzÕ;Í  +] éºJ"Sµ‡FuÞøúì¬úB÷Fsè½#ˆ7¸ ž>¸³Îà1Ãû4€”ï?Я34¢wío¾þúü¾¼1C*Fê‰bjt]þM;ÔL9WN¼õÊó;3bF òÓåÃ÷t0"à™mKÞÞóßÚªD.ÜÓ³ÝäçN(K¤9]²÷ä3"¢±£ªׯI\‡7út1¤õêÑV^/j‹à,COˆ ªØvPËÏ»šºyæ ½ ¡z‡áæ¹½ÞZ9LÖKÎ÷—lm×ëµ)/¶Q EÝþÕSß[¾ÿËÑ­K•JaLêºdÂØ·ß{ñ‰Éó†DxrèrxeÓS0î|Ù=ð•‹ÇÓªÏý÷f€”ƒ' Ä2×DĵŒK~íƒï/WëÓ§²gòyfêz5¿|à ®o×on-|³jG|¼~û¶õÍàp(ÐéùW?ðÆ‚ÊÎʡšOßw$Žû`ˆÕn·kžB „üï7¯Ó:÷®­s›DQjáΉŠÓ®j G˜õûwmÞÕ¢Zx éû-›cå{ƒs3’¿übMÍrÆ¥ï.i>ð£¢nÖUOù­ï¿§·Ò3 ?Mµ&¤U‡P£Ùa³k^¶V»Ó–˜Zï=×û¥×¦ôX=&È‘vò³Åk¾9§v \9«ØíN¨ÒøÑÿi_qð²=ähŠÃ¥€ª¸2ÓR6|»ÎàéwÉá4ÝÛ«ƒ‘ðÚꬸœª¦¹Ç1݇½ºäÁÞIb4¦æ¦]ØøÝFÁY¸6Ê-Ú´ ±4Õîp]ÛcÊW=4sÅö jnò/¸ÒlÛΞ²;ª'‡dwØÝC¾‡LxèsÓÑUÂd"@ DQ”-:÷¨*+?·Ýiﶈ/Z1ƒˆîæD5Û&™`•žc“·®ýbé‚.æëÔùY©›Ö­ =Ær:„¶=»þbüÜakÞjCD‘m†½Ñéç ³VÍüwO™»œv/Å'Ms9ó·­ÛtFsGx±Q›ö ©v»£°C3ükü„ûûŒþ¾K½öñ¢Ãn×Ü~‚>èÍ?Õí‰W ½&hÉ?ìÎ~çƒ{ÍFO{­™Øéü¯{~‹êr?¾ïÛuhšX¡~«ú¯Õ MSœNÅýØZ; ýÆ}ŸûÞ£@*¹ö|·EÓÙ S5[´©€Dd·ÛU­´wXN—wvÕúí ©«Wî’ó/oÛs¼Sm°Ûì… ¸T›Ý®h~æÁN÷¾>îµ9ŸCal¾h ‚¿8:âøñã}»šuè”›vÅ%<<¨ÛƵ³rlUë6®Q¥B•¸ÙZ¾[÷¶¹W/åÙµ=êZ59¶\åZ5ªdÐÒºuÝœl[hÅáfÁÝ瘃¢cÊLJX ` ‰Š«h45kÙØ ¨rpl§ö­ 7ÇZÎ’±mó•¦Ï=îRV£ûÔµ:¸(È-»=P3D;}hïy±bŸ~}‡÷»OÄ踊5k×0éÃûˆæuª×_žß‹Žhšæõ{ÉëQòÚÚ=>«Ô׋ÒàþëÈê™S¾K/¼šwšKŸO×ÜAó>诖Y&ªËY ‡Ó©ªªW¾ˆJß½¬²-Y¥’¦ÝÈ(E_Sûá-Kîz¬r½${{Ù{Äâ·^Û“v£¼ÓuŒ[hÏ?(óëåÄ»&x ]S»è‹•Èåt:J›Èåu]ísWx/­Ìz]ªQ\{5/)¶üÜÕãõ~ñ#‡æA¢çŸ§Â:óÏÇ—±,íè{-¥½æ|,ñÄR/õ+ñQ« {fjFž€^ ½/LÕ»®b©°žû×Rç_댠÷Áëâðz¹sßhÃôÞï¬ÊÑÉÅ,ZgΛ_·| {â¹äíðkš®s¯?X»V¼œOIÑû¡cTuî§ÓÅëkK8:x‹y&xû¼ü:Šä5©7“ø²J oœ÷R_òª%S…x£ÚUVŒö‹O xêb¦×ø”´L¹ú–ogK^¹…›LZYµµ¤}nÔ ÔÝí>U®Û“ŸN)CÉu€¢èG[Þ ùÕö<ÞwÓÜ“V7¹Hnrmé-HáuöµöUJ¯Š*ýë_º–ï3qËþëÕ—›’Ñ[<þ(œyuß»ÄZä—_†‰ýåÉ)ÁUÙû¹[}õÒÓSTzmƒPØðfnŽ®”º)ÑÍ=tJ„­)Œ–h­·®˜È»ôotNqNþäÝ©¬(]‰);M¥ËíÚ:s«ê^áÕo⢅Ïo.â¼Æ:…>Þø±ákóJt½úÇň‚{a»{9I)!ô+ïF¸ýbCxåäέ‡ÎÎÚÞBç 0ïøO[§_ÙûÝ®¤ÔRW,ù:Ï©z«G¡G}‹Ç‡ˆÊ÷ë¿JͲ£×¡C›Wí<•vãÞQÛ»uãwÛöi…ƒÕ–³fÅÒ“…þÝ´’=Ïìþûò©ý_-[ºxÉ’Ï.ýeÿI P+{¶d>/î_³hÝáR£Í›){^ú7_-_´páÂE ?ÿ|Ñæí¿ÛÄÌs{¾Þr´Œ‹!¢’¶bå×yN¯rË]1ifö™¥Ÿ/KÏsÜ*K¹ŸÎ´e\r¸Ô›1¿»Oræe8œÞ˳®_þí¶ô‹ûWoÞ©)¹Ë¾Úh§âÑ.’òÛÖÕ›w§–9:°}õÙ´<ï1TNFò—+¾½|åôŠU[\x³Å^#Ã’-X`¹ñð#ÂáC߉ *á@\û`ÒÍw¦T¼¯€:÷Ýÿêk‡~øþW‘•L ÿhÊÌ,‡výîþØ]¹Î©×œ ®X0#%½Ä[Sw.›½áà¥ëÉCÑXµhéªmE“LJ^Ö¼§î»Zf~©¬TN yýˆ9Û?tØ]tĉm›”›>¢Ï²ßN x=Åý‘磀˜ZjDÝ”ÿR23Ù—¦Oþ(¨Å½­Z$¶hXeΣÇÌ^MWOþ8kÙ¯]úèãYiYÞËhôé){Φ+—Oþx9+ÿ×àf“2nå×-yé餴‚kíKe»ðó¶']ñnÔ(k¿Ùè´õßm%냋l%š¼²yÕœ/¶\(³¶¯}̽ŠºIÐÖ.]ž#‹«—¯s]ß3ºYüÊ»¹Í¡b"DuΈÿw{*>* çòñoökÍCÏí?sU5U¸·Yô÷?ÈÉÎŽOìÞ4>Bufý¸~ÃÿÚ;ï€(Ž¾ÿf÷úå©Ò;v#((‚]±ÇKb‹5±± QSM11jc7*bC½€ŠPÊwÇÕÝ÷½;Ô$oÞ×÷Ï3Ÿ?tÙÛÙ™ùÎìÌï7S¬a0‡[w‰mî ŒåRêÁìr£›_«.A•Eææ]ÃÝÿð­"rr¯¦B[÷…¥ÜÅ{–oQx¾H>øáü š¦ª×^qzUê‰T•cJÔ%¦o¸ŸÇ0WNÊ*Ó+}ZtmRS`l€LÕgN¥V<ý‚ÄL9çÑ=®“·®4ûhÚu ¹gp\ÏH'kJ9®AÒ&a­bQËDÑB}õà=c[OóýRµ)ü÷bŒlŽÉEQŽ–Ѐ(ŠŸó5þvâøÊZÌr!m£"#š ÂWÓ¯ç`à¼B;Æ¿ÖÌå{œkæ£Ì(T6ÂUÊ;qsûRox…vؽÚþýöƒy&@zÕÉ´³å3a‡žý[º³{öíÖl ’€§7§kBc¼ ï= lÑĽüAê}Mcº:¯¼ªšqj<¨O¹€*yx+õì $unÙ©ë½ÌÇFÅÔáø5uFîM?6ðh–eÖ{‚Ì•¿¦^Ð1¦{öíçï&M—ܹq&¯–¥:uïÒ¨uTéÔÒOáªpªxœy0“<¨í‹æŠsnû펉E¡b"#šÒÀæß½rñV ¤ôoÑ'º£ˆ¦Ý<|SÓ‹É.«Örß!ƒzä_Ú»/Ë ýe/;aJK'Ó­ôsY…*À(¬K|§f üÊÎtm¨;UZY©aDq}ûK§ïI¿ãkúÕ êܘúaϯߘè$R„·lë.wmѺ5Å2±T•}ýäõ¬Z3=`Pˆ—!ëK¯È»yòÒ}@îã*D ¶èÐî4•ÆÔ.:¦s¸T ömÕT.j)¸yèÛG^±#ºúÿÝÃ+µ:úKžÇúÊÇC"{¤i0ƸðȮ;Ïjk*–Œï?rY©ÁXpýû¸ø·ª0>³eÆ;[««TeY§¢»Çå”0¹©k¼µ¢´ª*óжע{|üË Ìêwo["Çâ8ùlÐiuzƒN«­5Z0s³gǾÅZ³Ã4'»iöÈ_¦VW©2S¿îÕgda5~xz}ß±‹ŸT¨ïÿúEdLÔ†.cÌíJN4|î£RõÓ»zu w[ÆFt‹9qõ^¥êÉÆ ƒ§$}‡1þb鈅;ÏhÕ¿]Ô²s|F¾Ú1Å_M°æÀ]ŒñÁí3:ÇŽ¼‘󴢤`^Bäò£UW™7¿;þíùÛ,¶¿å…C{vþ%?øtæÀYŠJÊžæÝŠí}*ÇX[x*.²Ï͇ÅeOógˆúðT¶dÅDuY¸éç2•ÊÂÔÍ‹–[߬}ôç¯ÔŸhÖ/{Èøù)OÊ*2ÎÿÔ»÷›¥¿Ÿ·ò§ß0Æ×Î÷ÙùG7wM›þ#ÆøÞ¡Ä–Qcnªjšu#¢¾:ÃhŠ‡vëöÍͶtÍèÎ=ÞwLoå“{±z>°¥cÁˆ^‹?MÃgŸÞÜ÷ï1®™Ü'jåîóe*õ•ë‡ÏXÇbŒM™=ºu™ùáΊJÕ™ÏVÆTV‹õZ-DZ:–ø4÷ú–Ÿ.;PTÝêÙ;5§Jõä÷qýz\Ê«,ÉIí9èÊ£ªjuÉšqýVüpcœöÍœöÑîe?©,+^2"jÉ2¬¹÷ZÜowów4eÙÀQ“rŠËf\Ô«û‘'?LñoÞãàå,MMÕ¾ÃG-û–5j—M²÷Ò]ÞdÑoMNQéXÖb®5ZX‹É`bÌ꼄>¯³í‰ªêFê—‡.ǯ›7hʆ;˜»Ö#"2íƃŠÒÇKÇ O\¿cüղب>³³+5¥ùt‹É)ѳŒYg°°³ÞhÁ˜ûm÷ÖïÎåÿ…Ùþ°f 6_•‰ð—ý1Zuq‰¸K¬“õ[šví¯pvkÞuÊ/‰8°UoxXc€Zƒ…1iÔ£²yïsé©¡Þôñ¯Nž8ÁK©l=xæ(/–J:fæ¢>¡»e8$‘+äR‰\¡‰ ºÈ×<<›Y>{D¬³«G븱ábõÝŠò³;Oö›8Ù×ݵE¿)cüh°µ×N_zmÑ– /—ö݆5ö „‚¬í›T!›øX8ѼÇeþUÇTžO/ž1 ›ÜÅ=rŠ¶R ‡_Ôê0ÞQíB}ܽ‡·óË»xëÏ¿h ,kÔVk.þíÒÒÏõÙ´I9`V°RŒ„Îã§õ?ò ÐZ >*ÚÓÃ]@[¿ç1‡½ú/Ú÷Á›‡¶ôŽ{óíéÛv¨Ð[‹—oÿjéÛ}žäéÍr%7³Þ[Üïì®_jY¨-ÉÏd%DaÊêüAuŒéáï!;õM-È/«.yPÕfÔÄöÞr¹×´5(P‡F$ub—Ÿ!ÄîzmQ…ɉQ€@àê«x¡‚pÊ9²Mm#¾–"‡‘ÊaæaıÐyîÇïîþ×ô‰¯ÓbEô›KW¿õ@%)¸™4èÇYS°ÎB!Ä$uÓÍ… uÿÉ÷™h6™–Ù³vÒð÷LçSFîX±t߃ÊÑ#‡»Óz†CÀ‚¢ëôæâù%á#^='yQPäµ2¹ÒGšÆ@ôå¾>®ü@œ@ÒH*kPf°±–^þÅŽö´™å°¥âÊè×_ÿôÈQ{öoš7ã‚Þs|B¬Ø\Ž1ùÃh‘œòªŒ ÞT–}Nˆr0Ï/«R7uâKPh‡hØ^¦oÚщŸ®IMLš8†vnLÛgÿ”Ñl±‘2mÝÐ3À¬×…Ès€s¥ErŠÏ;Š¦€«›‹rXc 9N‹clQ5“JØÈÅœ]ÎQü%äM4©QÌ€Þ]ZT×ü¬(%n,´½xš®7‘jO¬ÃÊAkxˆÜX«Pf˜?ŸcF`á„o,L~c!Ü¿öëây³b£N4’2:£õ-e©¨è¯ØE4@$RŠ)-cÆH„ØRÛD&ÓH8­ÁvçßU¨D+Ħ25€†3éL ›¸ƒÿkC$/v¸_‰œ6p, €,º Ë}ø^0½Ž1 a°³ôÌÓ€@&£ºJ+ ‹É;vaï± ó?sÁ÷-È ÝÞýzË°fþ aQCóõóÇqHÿÎB‰L^Ÿ·ü³„Otú^G.ÝY|èJ¼Xª}ýå„@2¢gÇ]¿e^Îœ:wò¾CN(TÔèJøˆsL­ÅÄ>›R”ÆHì,YX¡Ò)¨Ú¢ßO¢ÃiŸ*t¯nÝwêVb|ž‚}u:û €\œŠ‹µ|3£~ú¨Ú©±«ø÷2#?td±Tigñ  hT[9ýÀqž¿äm}~ÏÔ¦tÖˆÔ· ¤Lj5 î4Ƙ­Ñ‹ü•ÔC 4MKÚ®k¹÷£%€‹¿g þÜÎÒ1±Ó–G($3Su/^âì!*¼£·¶/Òb$–r½3n÷õ'вsG‰X¤7àøÁ'§€öö¾ÍWuB˜ÏÝ»„ýãUÄ¢:×{x[?´÷b.B ¾ÿë5×ÖË·GßÔi ¿dó%µˆF ”†F¤§ì@%ùWï”˽6w¬*õؽ äí_?q>횣Ÿ¯#÷ö®»¦’Rèf˜Ÿ×!–Í0^<úùÑ „Ÿ¬˜óNðÛ«:ˆMë¦L\óÍyhÑÅI¡33pú˜ËÉï©,û×O|}Å1Ð Wœ@*ãÜñE‰S«-!ÓŽµï7™ °0"[U pôÛÍ•‹IоÏèûŸ/:Sâݶq#ûLë³õÅÕ»¹æÌ/ P~NZRÃ<§‰RÖAãË;]6zy+ $ˆ3Õ@¿ye’Ö„Ÿ­~èó꒼ײíªC»tº{ÕÍj`VÏ™ô ¨ªÃÀø;_o,@¶Õ<~”СWâPÖc± -wì±ï½¥F`jf¾Ñ'i1Р†š‡0§fh@ˆ3T=xDclP™)7qQÒæ4¤)¾•%í0Ô8 ›‹ÜT«3aЕæþ|/G`âÐ3©{Æž²Ó½_†Ð+mùÏèÝ`Œ\ÝüöÝåÆ·¦DR×VÍ|øß<ü‚-üJ”0¤y 0 ®}o톕¾“› Ƹ+Ú:£ñ)íW½?yÖ-÷àèÍsZÞ°p`6ž=¼Ûã;Ÿ™QÊBœçLÃ+>+RnHNY•²-iÝ–Y'%#ZþÉ®¦.ðƦÈÞŸ43Ñ#(rÃœ¶-@8áÚõ)ÏœèïÞ"ˆå„Ý~únÁê Ä‘Y야f®`ú²-­]>i¿2¬cŸ™ã‘£x‡RJ¯&ÍÌÖ¯O¿Ð“K½9OA›Ci_oÜ´}ØW•”Ô©GÂò™oFs­HY½:é³³ösCĘy£»Š`⦅¦÷¦O“‰‘È«Ë'«[.Óõ†¨0=ùƒd÷_®˜5‰Dz#Û>zü®Éñ Àóß¾kýø+N®]‡LJzù|uçµË7ñ—aåÀÑÎ4€Â#8<È d®A>®ümånÁ¥Îb÷äÕ£6ëêéÑg¹géåzH(‹è¶qÜ8@ˆ±˜]·Üþù6?:{‡)…>! Þˆ\=gº³L6ìý/<ö|´jõ¶ K6oƃåÒªe3‘°^eSe¬û^38’_¡€OXTÒÒqŸ'¾ib¹¶ƒÇ5÷ÂÐUS*WL&¤À£ù¨õº€s£à° 7>KÜ}›†ˆBfé¼nîÛý};eÝ:ùã¹3g 8sp¯y †5†'ž­Ã4ÅCúµÓ³‡HZ·ðéÐ9‰q®Þ×&¦¿³ÄQ!>]&O Ë]0ÿXU…6eëj³o@v·ysîà’õïÍM”¹ù'¥$/ywóöô¢MÂ¥ÖuG‡;IÖ¸»G¿ýÅË©gK¯¿ù1%ÔóÚýÏž™â0Æ—7N2{½‰Ã,Ë16w2–eY›ûË0V5–eÆ~úñí«™Eüñ7“£¾=›ƒ1fY†ý×8ŽcêcsÒc†aYëLGuQÆ¥;ùß¿ýYꌹGçÓ®cŒ±Y;cpçÎlQe†aœýX–e†Ã˜eÙžuuébYþqÖC–{ÖùÎ+–{æ$𜃗kMK]ë»­Ö¹óñq«{6‡1æó„åon±0c¦êQÿ¸øÌjÛXÖöÀº¨òI`ŒÚ£G/ð“heY§ºOÛÞÀuÈm¶Î9’µ¾GŽ«Ëy–e–sŒ?ÇñgçÒÔ…÷칄1¶;¼:d‚c¶pÙÂq÷lžsöØžgÏ Ìq˜cí¿ðæÝbùsÏä3ÿ>¸½ ZËÖňµ†e9Ρ„°,ó¬fnê'kÞÿûUì_ÿÂ:qÑ´šLÆ]|Üéñ.æŒîÞÌÞ™¦lC!dóø@ö%Ìc@fcYÒ²Õ-;u¥5y¦.Ÿt À×]ò‚Oúyþ#Q¶Ó™MåÉË—ëÔM\û覮Ý']ƒ@[’œœ”m©x\0:9FÂQ;>‘ïôÖEþ¿'ÇŸê–løÅe7¥húOÚ:ÙŽ×=›FGg?ª~”øŸ®GÚøã—;ÒÒÏEOZ×ÚÅ6RiK$BªoÌböÚ¡”Ž‰ðs~pïöüùÁÁ'Êñõ5ÌpÔ0¶ö§ÔÅ!šn8ŠCËÝõõw3áÿ§B!«‘SýœBè9y^/»ã£Ã_¶;\ólYB¶×% !ÇÇÚCØsÔ¡l<'£^f6kþ÷½Õ^©±›—좉1F€0XÌz­™rSHþú€¿Â“Q¯Õè @ÑN.J‰¶ŽþO#åpgD+\\¥" tÕZ½!ÚE©Ò¨n”#0f««ª$tsu¡þ$‰Ö {0kª®®±°X$U¸*d€^¢¢}Д_*ùwõüë‰ý»íÓOaÜ8P(^‰ô¾ôÞ _`„b¹›Ø6Êð×J_ÿ%2'‰ÜÙÞœþ•&Àæ4ÛðJ‡7j»³ÌÉvÊ)‰ÜEª@7Áu[¯üÅâðLÁ©›­þ³Í¶þ¯Ê7­tó°®b`µmù£Á~„ Änžõ2÷å5€Ö‚ÑÿJÛòoí_¼JÉ_E$z…Æn^®ÜðFZº¤Jçéãkª.¹xÙWÉûÓWõ&Îð<¯-Æ`sþ~®o AS^e”úñkžóŸ¬¡¨¤ÚÛLJѕšhWWÛ:ÆöuR³¾Deð÷sÿo” Îô¤¤¢‘—¿éÂ\yi1íà.ýÿ_ä±á0ÿÝbþR¼]_ð û[üg.ŽÉ²Öyñ帆gÆz`?c±ùH1ÖåGa¡º°gÕþ0€ã!Ðé¬A ë= ‰ 3F&rcëÔs' +TDnMYûó²ásÄ·ðq\¢×±?i/ýuÌa‡Çú•<Û‡Aá«–¿¾ì… ^ËÈÿq맹óÏ÷½òýøº“š+ñW;u¡òÔ†ìFSÞŒkÞ ªüK='¥>¼´ñz0 ;4¦ì! Swýr:<@ÎÏ«ïš¾õÞÞ?m$…WòãŒ/ý, ‹µzð5Çb±V‹X³ÙZµøŠd¶ùdò,[w[þÀb©„˜à³‹ ÆÖjéXQùúɲÖkì•Ü^cTiûMž û¬dð #d]P†¢êV–á¢ik íÁsÎð7¬%–? ¨ºûýy(ûMì9 —[ú¹Y¯ A(•ê*G/¹wƒP~Æå‚2fä’w|]ÌI)¢)@€À”Ÿ§5±^M½]e¥y‚F~r 0ÆœÜ|¿àP¹DÀÖÖä—‡„5+ÏÍx{ºH ¼(¯¤²ÖÍÇßßKÉq¢(0W?È)ä80<̉3çg§>ó ùÀ;m;D(LšœüB#Kù‡º+H$uvs•ëÕOUz4õu•%tsSRØ;#@è}u~~¡ „›¸9‰)Zä檀÷î än!A~8€+Èù½Æþ!an2sQ¨ðáïj#Õ¶‰Ø]©¤)d1j©›‡„ÅÏ^‘?uç¯×ŽèŠ««Q^žµÐóÕƒ/â|es¬±F£µz˜Lu|³( ÌfkX³ÙZaø¦㺛 ÖŠd¯äf³õ&|…äoBQ`4Æua²Ž 2™µ’H$ÖÊ •Æ •Z+ŒX "` ry]õà­ù32™µžÈdÖ+ù |X‹ëÄÅ6¸úüûV¹öƒ]ùAÃòZÆÀ+eªö mÆðÒ­ŠݺlÄ\Fú©øð·x FS”8m†Þ³U¸—èÆåÛ£Víht1éù”/'w®Î=?*!qöΣ“º†džØ:g'›~xÕÞ‰nï|:1Úÿ‹e‰¿¢×ZødÝÊè:iåô>mØ‚æ¤4Œ’šUéW ×~óõãÓ§*±ñbúeoùä·g¹·ìì-6^¹U°ú³ý]0ª_X±ö²B†.ž¹9éÓƒc‚@tõëY·ç6yÆïÐ6N\MfNá²ÍŸû"$«7­HÔ ]ï]¼ÐrzÊÊ„ÖÕ+ÞžøÔ©eSw|éÒ½[¾íßÂmχS÷fánm›þRUd¦D¡šâ¬Ù«§ýð!ƸÝÄ¥ï|»pDWT[‹ss‘LV׎ñ-›Ph­ÎÎÖÏO:ð혽1´·±M[Ãò!ÆÖz‹öipƱ}þ þÖyûr\ÿpѱw”^!q|¹V76T%DF1bŒñÇóûœË­Ì<ø¯^³¾ç¯È¹ú]Ï ‹ òújŒñÅíÓ¦nÞ6ïÃCã/§Ç¿ŸZŠ16õ†«|t-räR>”¡"·{÷·5_Oš?uo¥ó8'W¥e±ê—˜è·4¬¯~zûþSþúÔ'ÍùáÆøêž¹‘ý¦V²c|æ»÷úŽ\u—»õTP‰Ïmùñþ̧‡ûè`MG1IDATÏÛƇª©,VëL¥/DvŒçí"]ÙÝeD Æ8cë¤~ó¾à/+¿œ;lµ¹ê÷=c²ÊÌãêŒcQ‘q¹ÅµÃè &csæÚʱݣöWþƒ"8¯¬ÝuêàºÞ1õèQa›ØX^•-‘q¯Y¹6>6Á±ó5>è÷É–Ï,Ðëd¾GRw/Š¤€ FGk³/ZÈr˜µ˜Ìªëg50xÞ‚VôOÓ£gll\¿. ô8ŽÐ…½$å”®²ê‚|wkT4Žr£ýZ˜ Ç –þîŒwh·v†ŸIëнï€^ÑÚû™8ÖìÙß9˜’J)‹N]W›Œ,ÈÖTÍêj‹J‹ à¦tb—&)1 š–ò¦ …bOKæ=ÓÐâè|ˆ=áßvìæ¹iÚh¶nžÌ@‹„–ë73ò%.m›»ªT÷ š4i"©å¥À%"nÅâQµfQK±L@‡&ÿ𳺦òι«gŽ´xÏôŽh!uæ‹ätAÜîoú!‘øôº©‡8ÛgAdX¡†ûÅ#©ûÚm_UUVü~çÒÖ5‰ ïíŽê}È(6´ûà÷ÆÄ°,ˆ…Xu!Æú³™Á×pã ŒhšfL €˜TkÂ&ÔÿÁ3¦¡DzÍÚ´ÊØ{À@!È¿&ìí0lxèΟö9ûÅÈÅEP_ø±i«X>˜º´¨Fov÷nUuåb¹ÐÍÓÓSNN^Í—ÑpùÀŽ]')•>=‡¾Õ«‰wnÖm h–e(UÕµ­…"1Ô<ÚåÇr€iIõã3O 23Òå¾=Ä"l÷D´¸ìÁéã× Ü<}»ÅœõF·Ì²zN|6ûÑ„á­ï¹.röðôôdJo¹ùÄÝ;XÎU<Ñ!€»¿]®5Q€5 KT€³œEUÉ4““2G ½›—66Ä1ååüN«º•ÑdjÚmè´Ë«ÅÇËÅp KÙ”¡ÑcžÎ³ë<Dôè1ïRNNâï°ùõ8Ï%ûçô Û0;rVBŒ@æ¤7P–&@ÛÖ!_,™·{»€Æf©oÄGS†€SEX×kð’•‹³WN¸+Ð=°ýŒÄw¦LŸöY«Ã­+‹Œ®¶ÌWR®A[¿Ÿæ3e*ËIW©ÕÕºzÿhnò*VJ™iïÖ[6¶1ª.–UÔð1aÍúò ø \øpñ¾ñÎr¡Yäµä£àä¾dÚ Ec{;yøÆöéŠ-5&†«È»9ü½Ã×&# &]Õ}s‹õÿö¶k‹z/{Ÿ) r4›©3´©ÛTV/rXÉÈf¶ϳÄá8ìàßc7Œêù'ÕÛBÉq$¨gMÜPNKÔ-,gÛ¤~žc„ŽƒIóþÆÝë–M€û©)ŸdmŸ=äÕÙЙ@xÅ>¦l}õmñ08œÃÖ¥ÌÆ9ž{lÓEd÷ElhMh žÏ|{øÈÑo~•ôï~L¥R©4:µÆ…ìNÙAµF+)o' Òÿç'™ý_‚ ˆ7)2AÅëƒ3ˆ Þ²Feǧ~¹+Ã9OLLŒŒŒ”eÙvD«Õzzz""cŒä† 2€„˜`E±f«GÉÍ;sê 1f³éĉßL™snókt:ÝÈ‘#µZ-y7‘~11|ÿªY¥ª6”­¦lòÔ‚ >¿ýÓV½½såOíâ1A`¢(:ùÁ’‚x ¸"ç)\¦fËVfCvydA„+'=óWö³ƒ7›ïGrCo©8\‘- g›î”È+Ö X‘ÜÄ¿„Ñ,·u”ÈAÜArCArCÉ A$7A$7A|HdÀ¼ûŠ,D|i7 ûa`Œ½fÝñoíÞö6#;}‹NÓ>Óœï&cR¥2ÈH¹aŒ!rA%èÝœær+$%€ÎÉI +Tì2 »D¸x²´+T0E¡ŒÀD Ó¸€ÀfJEA@P»Z, `50‹ù](Ž#…^ÌšV+µ3D†z7À„˜ë?¬˜¹@ãám_Ÿ&}ÉÁFôÚ3êã=Ê—0Y‹Ðæö@êÕNŸím#ÓWù‚ºmhç¨èD°$F‹:OQdæh²öBA°Ä>¹½sÕÍ3Ç &YëS´l³¡¥ªT׺°sóÚ^¾üX«Ó rU¾:ý«5 tÑŠÎvvZø‚Î9ât{ΦDû•Ž#ÀåÙºžíÊ|y𣼜VÛ¼|OÇAÊï´ùlóK1ýéˈhö,4»9ƒ¼&é2Ã]¯Êžî ¢=¾&ˆv_92‘)wÖ¯Ùü¬Ó¬¯¹9õ· "c*Õ¤Ò¸ýz­`ór˜ ó÷ÚMÌÈ%šLå¢÷Q¶wšXmŽ î_{°ÉôÞ:!úæÞC §Na}:Ûàn|r?JËU/À[Œ‰7U-šß*#wóJï&9@’rlŽ·Õýð’[¹Åd $÷2%*;‡•$‰…‡&©tL”$`€Æ ˇŠ_üÔ±œ·l¾¸w_\ùOT—Ý~å‹ñ›Ýõêàý£ö.0rRÂí½w e;ÏhQxè_< .àzþ'-¦íS Jô=÷®Üò«ç¯Ñ{ˆjÉôÃÁ ¿5·ÉËKsfæ¯óFÎX­vs}|ýïCUvSßZÑúÂñ‹ÛÖ´—–l—À‘é´ÖgöF„…ks”.Q­qñØo`.Ÿ8T®Vc­ ž]تö)YúÓº{ýèšÑ\Ú³¤XË‘9Ü£‚nž;)‹^Å븨€#{·ϸpA4íY×û‹û7Yӿɽêüå$0˜ Ew­Û» Ÿ—(¹{ûLwæIR®<ÒÍ H úCÑU)âoŒ¼i4ærs×£ª2oÜT*£Y㓘-(ÂÅ^´­1£žÝˆyqó陟ûý|¡ýt:`Ì&F¢[®\!¿oŠFMÁÚ½Æy{ð{¸\_¥˜Œñq¹êvÂû¿ f•‹áæÁ‡O"-FÌ[wX‰²…˜äÁ¢ï>¸uÏ”dö©Ø½zƒ*²…€ ÀýÃ'Ü>ªëã—[T¹h:Xy;6Î å¯ð™‡«+0µ_Éüƨβé.ûˆ(bÒñégŽ•볓 Yõ£ ÖÊŠQPiôã-kw|×/f«ñÙÉE?Ï]!¸éTr¤ %Ië&©À|cݺ±=#b“ OOn×)ÂÈÃ÷ӘؙâÚ|µ› $(V@à‚.§=ðȘÅdл브1A4jc¢YÌS¦à½ßþtu;««Ð·€ëÆËÝóñØ¥Új‡ìoÛTŠ’.‡gôý«Ø0rÇ[ÄÓèA±„ø{çî&ÝU8ŠZïÚÃ6å)PeG¬WPÔóGsÛ¯íYý,È­LÇ]¿L4I–g\;òØ6èXà³&¢€®E5ë­¾}jå­à KîzCæåò-ÙläÌ[¿ï:sü^L4V鳬T![©ã“¸Ö[Ç`ÑK¯1[­ŠLT¯L`Ùú…L6Ä„…<-5bWò`ŠøâþcAë·HÁÐÄÜåj~ÊMF¿OÇwªø±N9®ÝÏcE (U»ÚŸ–mÒS§DÞ´ªxï_5ðFŸûŸ\óSÛáÝAymš‘±4z¯|/Ån»¸yÅG00¸l4˜<|| w™O®þ²á±:¢x¿’9’êZ7î¸Ë‚‹·ª €Ó+eþ¢Ö¿TýÛ~ŒŽkì­—P`@Ò£}{¶žj6q*JŽ=ëÔ.f¶(2 bï›1äŠÅ Õë]´>X“Â÷Œms»rýÞ,:W㺿 Àjæ‚bMô,Þ N¹ ‡§G]:´§Y×@_Å_VVdˆ¼¸ôКÙEæMbÀ$ßêG±±ÈA@0<Š³è5• ©æLdï¾1H®9ËÕ¬aIƒ'*—¬P°ÌG ‘ W˜Z­í7•K:²In.ؾåV9Áh–Œ¸bE`Æð«å¼U÷qÄJÊ@³1Æ€½ôŒŒ¡"ç(ÓкcÔÅKÎãöü÷xé…Ý@]±°fÓ¯šÕ¼%½wYÉ:ÿ‘œ«q¡|€€ŒÔæ­Jl²‹ ù){ûü¾™=ª¶âããÿàøÙÿm-Ým¥ZŠÅjÇÎù)㬈Jüo³»ù4™T²DA%ñ‘Q‘´.Z÷½8cþÝ2…sùº…œœù÷ã‚-GŒüså•{úšÍZ‰Ä„Gj=ó$>Ú{pë…:=†é4btèsÉ+¿„€q ·ísnü7ï4ôÏí~eë4,\ÛÛK–Z@xOà ™Øâ *ÝyNÁÏŸÅ> :½òÏݾfÌNŽ#Ë1W®Ýðé¨Mþ~Z4>ûeZogs1`Üd.ظq·xŽÀDQ4¼§Ñâ “ArÕ{x¥m²i=r‹ÓäªÒfÜÔsÛ'Þ7)®ùë¶ìÛW1r‹[±Êåzä^N+¢ÎW0oá'Je/#I½1t9òˆ’\w­VMå!;üÎl¸²fR’¬÷ÿ¸þ¤Ýþù}‘ƒÚÝW«Q¦’¨”À³äUoØÌó?Ï?zÌ*× }–-àÁ YËÒéß\µ‚>ƪä®6 &löñ僑1¯’-k6ùL+båjÁgWåÀtþ5¿2Lzï\j гn‹±ÓÎlŸuÝÄ=‹5kÕ«»FIç§UilR#j}\ÜôÙÖÙA`ÜvõÔ½RõkåòÊ—»t•°ÍB’ìs%dcsË›³€šAäí³F ·]†ˆ‚(ªTîțá•[U@QwÏš]˺xÚ§G½w ã¿{GøÐ1_k9V£us<0&Wœ'P ""Cnt&Ú]h䎩}"c\±Ïï® £·s¾Eœ‰¡âT¸l¡ ˜ l«NÖFà</Û6uc‚cäˆL`inÅœO³°ÿ"‚ýˆ 8Ÿ:ë™ÀçÈ@`ŒÙò½÷憤¸ílÜcˆÙ˜1DKÄoKG$ÿ‚Æ°[æÛ êqzžµëü>éT¿c§c³Û+>»«ãXŽOâ¯mRü>oÞ?`Ïà¶RáJeº®/È÷îZ²ÄµÐÇZˆ yY}Ôæ"y2òmÚ‚WOýš»p™y ¦‡7Ï쿳oqÍOë$¿øE«Õ><^üÂl%)u‰aŒrHTRÜiIw:N¼iÖnU–Ʋ6 JÏÚ¯È?G.àÜ*ÕiöìO}Zê M›õ˜’ï`›_˜]ó1@µo£±ÂÜLJL”\{ä*R -˜«Fï>Í‚—Fï×tâÖï ú¼þÅ ™Cê„E$T¢Ùìí!qÞ9IߪÃìšÁ÷ƒ8¨k«¬WƒÂßÓÕj´5:Aü·)@+×x®äíè #€¬¨r¯f÷\rå-— Ђê%òù"ªr”Îç €ˆ2 Ú7O_Ûíž=¦ùñoú//­ï)§Ø?;Ž³”ƒmÁÔ×¾—Ð~7AÜArCArCÉ A$7d‚ Hn‚ ¹!‚ ¹!â½…fÄ¿$›ì7™OIrCoWû$ÎÅ Dé?ª÷™¾DAA£s%¹!ˆÌF”Ôw/تÈÖLþi&¢¤’-æÌ–Æbƒ›÷LrC™Xáè\}»}õ=Ït­ÛÛý']8&JZïÿLnlÛ„ÒXD6D£ó"#0öo–žÿK¹ILHˆ WkS<.A -ø²(ˆWdÊôì‰ Š‰q1Š¢d†ÜtlÛìÌÙÍ(‰¶?U*ÕßW®†GDÐ^|Ù¢eà5.:‹ÑDj“mË€Áh¨Y½wzü?_õ/ö*N÷­ ;vì¸qㆠÐD‚ÈN^®C Þd¯â£éº0ˆˆôÞK‚ÈnnÎÛthÈ!"“ ¹!"“È€y7¶Î›ÕjµX,»!ˆìë¼üSõgpáœsÎ>|H#SÙ¹OÁ»lŽ««kîܹÓJÊH¹yÍ‘}x½P‹DDfõ¶ÈAÜArCÄû€-’uâ!$7‘eaNûQdÑ!¹!ˆ¬ìÚÃãÇvé!¹!â]¹6pú4üúkVñnh œ ²¬wÃ4n çÏC\œýO’‚ Þ•âØÖ œ;Õ«SgŠ ˆwÆøñöÓ§g‰ô’ÜDÖôk¬V{ÔnÝ‚¨(@|Ï#8$7‘5 çÏS>Ùö+'¹!"Ca þøââìZ,pü¸Ýë!¹!"ƒ9}ræ„B… `A(YŽÍ"I#S‘Å°ÕY[¿)<âã¡hQÎáýÞߎ¼‚È‚=©äMDDDØ5H¨3EÄ»”ç*&âÕ`ÞæÅr$7Adm$ArCÉ AÉ A$7A¼‹L#SAd´5:AÉ A$7AÜñž’Þ÷BrC†Ã@#SAƒCrCÉ A$7A$7‘ÝaŒBÅA¼{lï§E Ad†kC©÷¬°i?¦sð Þz“r¢ãòWYéeó¾aædÂÛ‡0%é”"s²AÀÑj2š¬rò!ÖE£€ýó刊%É ZZ|m{‚ˆÀsø¸ÙDh ‰Jr &Jz½‹MAØ›dç‰IF½^`ì•VC@† ˜ãÙÛؘ-OÐjH’WÍä>WÉêã¦M­’WÎÚ`ÿ„¶·ý9J4c þÚ6òë5¡kU{³hÿÖ®Wö“cþ·ªpã9\ÕÎ57Kþìtÿ,¯æñã;v¸«€Èes¼EªýEç)ãºkÁéA_wÛw<ñy·^Óæþ°ª˜·˜®]lDzøð'—ž&Ö«RÆ)¯ØdÈùóËyÊ3<:7bÜ KéVk§ôe€¤8Ô™zGõ™’b]rU8tèàÁC‡Îœ;סhôØ‘Ó’€!cÜl2& £Û„ŠÉh4[ì‘lŒO2YmuF6›,2·µÞ³Éh4)¶j…µyÅŽ¨¸D+·@DÅd4#päd³ÅÊ•Fk’!>6ið÷›wö¯ûŠÕÊCDT«Å" çÈÍ“‚ˆˆŒAlðç቎H*‹{~£SïÙ…41ÆÅÛÊŇc~™zQ99Bó^ã­¡A#ÆŒ?};²}§=»wî;zêý8Æ,ñÁÓ†tnÕ¾SË=6¸Œ6¯Ä–³‘W{µmwþqcÖ½«fwìØ©ß—{ žm´¢!vþ„±Ö飆ŠfǺlh»M§Ÿ0A`IOu ¸ô<ÁÖ¿ûÀ|HcR¢MOÀ½ÄèÖ%~;~Uˆ¾w~p瀮=û´n¸dÛqcøבÝšuhÙmØÌg‰f§zÏÎožÓ{ò:³pkÂÀž½úèÞ©ãìŸ/‚pvËäEëÿ8¼å«9ß'!³y<±Nô)3A`w.ïn"®øªû÷§!"*W›T¬u-8..øúgUüŽˆx`^—ßîDÃã: îDóǧ×5hj@TbG¶ª?dÑnDTbµý´ü’³D¼¸cô”uÇmŠÈ9çˆÊúá-{->‚†'¾hp9,ÑntÄÝc; ]tíçÙ þðòÖ€!s?(ë?|ˆGf•ÄJÙDTc|øу‡Õ¨ÈÆèk–WoýUW€*½W;²˦X£U–xDd4@ÂáC÷‡o+‡ˆê2»6ÖððBApÁØy£ïµhh³bpzë¯E¾è)<»{ÇÊ|?ª0ê§GÓ[²Ê¶žèuàÒ¸ç«6¤ÆÖ>& 9ÿšõ­’£×RŠ¿yö´ûS äîùe§äÅ[@ŸoV\>}ò§u'P%åðŸ$ò—¦a—º¾À96¶²|ŒY±Æ¤¼¶oþ²?oþ9§âž=»eèZ£ò½ »‚ÈË/~eÏz¹ÆYFTdG3i³ë>çû ûº"åkõU?}RøÑ#'D›•„¨H«8»ÝYÖ£ÀÜù³r{ª)XC¡âÌ«†øöí‘ j·fcWÔ-N,ï:qW‹îÝÊö—µ*aЪ$ÁÖëÏ•??ˆ‚²{í\W©}K­­´‡%Âóã?Ž<«² ÀøåUG˜ PÚA[ÀRlÑ)pA«AŸÝàm ¿åÈJ–ˆ\?w,B¯U}ò–ÞypWao-€¼|\×ay»Ô÷ñÐéPAA0b==òc Réóø镸8/xüÕÔ%èZÈÕUfÙ í\0jrä-Ìå—"r¶Qm¦öïÞ´XïÕw6.¬Ãt9òÏ_±Z”„ý_÷9•³÷·ƒªqõzÒ’›Ìl}AñÉWqÉò¹:§n$0ˆïþW{ÌÜñm+ÀOûW1rçwK4YàÀvÿâyÏŠÕ9‡OÚŽ™ÞƧm÷q¥Kï­™[,è-”¨7íûÎeRýN‚Ý•rÔ @DÆM“ÇϬ=èÛ«?~s®Ö®¹ö •#HÆMo[Ú?ÕÁ„ûÎDÿxb[~W |Íx+ âîæü4ÚvÅí^h…Bêx³ûÔU›"·4láÎ#]ÔŒÉÃVl­ëý²—ÊÀɽA`ÆÇǦl}>½KÙ¯ÆÍûßÊ1*&º¹¹€VE•ÖÕEŸ4p &¢Ó­>ˆñ)šUüÞUÎS· ¤By\Ý ÿëôÞ¿âbMáQ¡&u³¶U®ÙóìÅ‹'§~ì÷UD¼‚î^…«MëýÑø~ÃÂ,P§SÛë«'Ÿ}rbóœÀ ÛÔ.hJxñäQd¢‚€€È˜póäWôõ§wo2¥w¥¯OŠ—"~hm-¢l•Ój¼ÚÛ[c¸wïqØ‹˾™oÌíúܽè'žW6-?y?øEðŽ9}—ï¾$‰‚,è|==ÚLZR"zï’_/»úç«]ÔoÝü„>ú»o‡V+Ž†€¨Ò„†‡…‡…ZûÐXc'›Ý`䜖fU2_æŽàûxûæðÐ$×GsbøƒŸ‡'Z-¦ÏŸ> ŽàŽBµ0›³JbÅ)S¦|ð±pÆØ“—ƒ­.M}ªršP ”­UýÞÁµ›9bö©8yTç?w¬¿ëY¡w‡6–[—¬Ütú‘0uÉ¢ yôá÷ÎDè>®^6Oþ Ÿ)o;™«ÙçMj—T¯Z¸xßÁÃášR“GwrS ô4üõýÚÝnŸ´+ã+c}eüÌc¿™”ÛK›«tõ¸ó[¯Š¥«Í”wc>wäTñ†_Ïá–“B@&y–)âºôûU§/ÝkÞobÓÒâ’ùë µë; I™«lÙõ«P¢Õäak±3W~ÑØ[§«R±Ôš%ßç«Ú¢c`3þà䊵[Nœ¿Ö¸çØÎõ‹Š®^¹Ol]uìïuêÖ։Ȼ{xùikÕ™}êˆeKZ¹pe©úÍýt ‹Ôj\§bûlCÆîŸY9qæºK׉ÆðÇüy?öóÕ¤À»‰‹ƒðp(^§:Ͷ!yÂ7CÁž/ÝO6ôËî­ðÒP ­% ¹Å$7]œÿÿ^…}|5õiÌ©muþ˜ú€t×è:Ý+åÚkd*ù>8?e*s½æªtóÇɼNY“Nn¦Ÿ·éfè«’D¼Û@™€ ²´Òƒ,“Ü‘ 5X«•ä† ‚ä† ’‚ Hnˆ,ŒmjUN°Êð’ÿ_Ð[4ÿÃü&^*Œsžó 3ü†dçÿ—ÖX,YÅDÒ–ßOž;Î/gn¤½¯í *¾[87cïj±X:véž'o~’øä²ò⧵«]õ.™-7Yg7¿mšß›ÿçÿi·ªñ¬“ïÖ}Åc›? *Z¢dÞöàÁ¯jÙÀ>Š¬‘@Ř_·lÞ¾«ß—]ÈÙEn$ITiôj;©Cn@­qq¬ÜÊ8;‹¢J£SiÝ™l J VëD‘‚¡ÙInœ}Lâ]ÛÙ9µAˆ×7~d‚ìA:oõ£° ArCd¸—ϼš.Ši» ï\Ó³ÔöZ•‘ÎùÞ={“G‘8çeÊ”)Uª)NW|Q¼~íê~bQ˜Íæ-ZhµÚw¬rYÆK%¹Ém.âÍ[·"¢b’å&88¸T©R¤5ígÏŸÿué/îè« ‚?þjÕª‘qHn²SMp¼d/¹bMÞŒ1&‚“Ü©S•C2A$7Aü³CE/~!"sj°…ÖL‘ÜArCÉ AÉ A$7A¼ %ËìBrCY\nhdŠ ‚ä† ’‚ Hn‚x¡¿‘)5˜1‘i®MÖy É A$7AÜAÜArCÄ;©ÁYéÅ/$?ƒaÄ IDAT7‘Å¡ÍC ‚ Hn‚ ¹!‚ä† ˆ÷zñ A™Uƒ0™Hn‚È,‡ä† ‚ä† ’‚ ¨3EÄ{ª5²LrCD¦ÈÕJrCArCÉ A$7A$7‘­k°@¡b‚ 2Æ@QHn‚ Hn‚ ¹!‚ä† ‚ä† ²u Àb!¹!"S ÍC ‚ Hn‚ ¹!‚ä† ˆ÷zñ A™Uƒ0›In‚ Hn‚ ¹!‚ä† âÿ‹ô="‚(ˆÀ¹ýÈõüï~:U{"Ìx;#Atj°X6®H‚‚ üƒDYg¿›Mn¼==ïZñèòq´2eÿ‹‘BVg2ÿóȘðôÖ…ü•‹e°sø];¹JIˆä]爘¬ñ™ZÏ%äÿu•c‚ðäî•ŠÅý3[q²Ô‹_>(¹AÄ¡}»´hTSìm®,Ë›Þù”?`¨}/&D”¨ZÊÍÝ]Q–A¯[DÄZ5kÞº™ãiOýþû…‹™ dºPõßÛ¹ÐGùý|ýÌ3cÙÙÏËFÞ CÄ‚ %ÿm•eŸ~²‚Ù<›3Pk’íœ?~çC¾9syzy B¶Ž’Öüƒ+úA‰ ƒ4™msï³»ÜdlxÙÎÉFÎæ¦&­ÉFrCÙSä¨3õ¾À9çœS³ãlåVmv|Éwmê´díµ>d¹ADµZ/_>ÆØû 7Œ±÷AøE©P¡‚Í>˜˜‚ Þ½{W’>üìÍ‹ŸÅb)W®\&äh–ñÃ>ì¶ÈÖÞRÑO·2d ÖdìÝ>0;ûŽé4jGŽd kvN“Ö¼F2°¥!­yeÈ8ÙBn(›_o²ArCÄÛµ$7Ad É AÉ A$7AÜAÜD6‡^üBD&a4’ÜAÜArCÉ Aï7Y!`LrCY•*«¤”ä† ²8:@ÖX¨IrCÔ"¹!âÃ‚ä† ’‚ Hn‚xpq!¹!"S¤¬òî’‚ Hn‚ ¹!‚ ¹!ˆìcYe¦É AdqôzHL$¹!‚¼’‚ Hn‚ ¹!‚ ¹!ˆìŒ(ç$7A¼{hdŠ ˆL"+ìãGrCÉ A$7A¼wÐ^ÅAd*X­$7A¼{\\À` ¹!"SÈ"ƒS$7AÜArCÄ{DYÁ@rCY0In‚x÷¨Õ`6“Ü‘)ÐÈAÉ A$7AÜñžBÛk‘Iˆ"( É A™LAÜArCÄÛB»ù‘IxzBl,É AïÎAÈ™ä† ’‚ Hn‚ Hn"û¡VƒÉDrCÄ»G«¥íµ‚ Hn‚ ¹!‚ä† ˆ÷ZNDfàâII$7A¼{$ d™ä† ‚ä† ’‚ HnÞDLÞ÷çõÙ¾uœžúéÝ'ù¾ÙÆB/ŸörÊ0͇ô.qNIr²œoþêô¤óEš›¥›ª·±öS€RÙ䕇 ]#¿Aöá[ÇT÷DÀ49Œ/Y=Ցק'u9ÄÔåá_äfC¹‘ÞÝ­cÊÊY#«w™Z>Ÿç«ÍÎCäÈ™}P±° cV¯ß=97CÎQ°Ÿi?S®Iÿcqÿœ³dMd’ÂôyFLúª¤ŸæÙÕß®¹0cá/Évg8¼`Òi¯O&ÙRBƘ¿vñ‚37ž©ÝüšwîÓ´jäÈóâÑ£Ÿ»}4{r•½Ä°¸ð»S&Ï/U·{ßÀZWO¬[¶ñ4c ˜äæ7uúL?×ôìc¹Õ»Ã·=-®‘ß cq'×O<:kÊøÄ»û¦ÍûE‚ýáµÇ·ß~½qú[QjA`¢$qÙŠ¢ÎgâÔo x»¾)ÆlÕ™íS:vfŒÁ™íË6½ª´šÔ·ܲhò‰Ϲ#ñ€Ü«H•ü<ºƒGûÙm>)d³qÂí#íœúÍà3gÅZÔŒ1Q¹,#€ÊÕæœiAGW®ÝyAq²§ÆËÊÔ©ÖàÃSgm³:’ãêW¤ïˆÑesj€É¦O¹dÉ9ë«Áz cÌ’¸ôë¡^}×v)j¤‡¿ýú _:w¢Úžõ;—Mü¸[¿êÿ©D›] Ù´¡MÖ0.=¬ÝWË<¬ÏfÌX“däŽÂ¨€0rN¾+3æ‰V‰‚(I YAEæ-ÆNkSÆ?ÃòÉÕ²™Ü "€sµGÆðÙƒ[eLV`ˆ˜æ[Û߶cŒ lÛfžV^:·M>€ÅyýN0K‘A`+*}²àÄÇÜ'·hòéûä–^%bÀ0ýèb`¿iŸ5jtëòƒ†Å¬Z¬ûu¯kBÄ­[÷d§6&êÑÝ{‰€xziWŸ¾ßä«Ý¼tùŠhˆZ?¹Çî½¾û¦‡ø“»wNÅ<ü»ï—Ÿä–lZöðü¯ÿý·¾Dsˆ ,x·©RÄÂí˜ÊÅW§z…òÄ «úøîü®)zD`LŽ~~#艌`J Š‘›ÔäÉïôP»ëÔšRå«éâ˜bŒÝ»go©&=ËxÉLãá¢V%·ã/åBš):b?ÙöŸôNµ)ŒÙ¤Öëíu=*(oùºçw½šמËårraóëOö.|ÿN‚OÙú…}¬Üþ“îyŠMûöþbÀÔò{ÖÑ#·&Íœ=Û¥Ò¸z¡ÉÙªb~‹b·§Ú-§V‚„„° Sç€Ï™¢ ·†=¹Ñ§i£…;÷T/ {þàþÙûçv7iÖ¥F!D`¨<¾sÝÕŒ_ºø`TÿårÞÕòØž"ìñýàÂÆôžÏùIß½{êÜÍj k}QÊÍ–…ïÜ0ʨ·n\¾V.°{!ÑlËyd’¿‡Ê«àÇU*GK"^Ú¿=¢@½/*å”­˜ÏÃ%Ù)b©EÜîõ¼²ýLý½­œ pž½äÆVRïYüÓ¾DîÚìËáÊçLíbá×-X·_qÉ7bÂ(W b.Ž^x¬O«—o9UÃ_ZwÃè=côÓþ_÷©]Ò)“%‹åñÔ Á»ø˜‘øfHôð)µc÷¯V­Sáß®9ž¯âçcû·eN.Ïӻ˷8±_­/‡¯4nøG%·p³%½ªcÄÈ{#GL©;ûЄÏóÚ¾1ôï9¦Gûñ+Ê/PAרœeõ® Ÿ ªa+('NÿVØÝÛj+} ÷¯Ú¤wßú/; éšÍ3w™ –3ã–ü²dXkÑ^Žì.›GÁŠýûõKsAÓ.ƒÀñäÄÞ]uºô Èï¬ 92=¿°gÙÏG ‚Gû~#k•ðÿݼ]†ŒÚ5ÊÅ`lÑ{xÓÊy¿=¤Á¨9%r¹0cìÓq3ÿ7sþH·ô¼›ß~üfãUc¯QSê—ñKi&ß*¦øý'^L>¸¡Ð¹eA÷j,îÞuû‘k2Wx¹&ú|V,õ¹_ñÏ&}ºiÀÐÉ;×L}¶{Æ]}ãmà @ç>ƒ éùý‡oÕ»oew‡ +¼`­Ö½»TKc‡D—\%zõèžlÖâB÷EÛ¯TSSQäªÕ¬›2î£_w|$¡Sk àÙ©½·¡àøÅç,^ßeëDÍë5æå c.½:–_2q|Ííß»I(°äëÑb„{ÕLŸðï8¤àò?þw½fÛþË95ˆÀ90%þù’ùKÅXËÖë2 ueähž¸äÐì‰-æNœbõé3~R žºxmï‰3Š¸ð ­C7ÄÌþº¯›FÌŽ±ÆXØŸ›š÷åU²ê'e|föj¶ùRxJV2áöŽoê÷\R¸Êg¥|â7 ¼ Äž:vxîÒ_‹•-ûqê«4lU³°“H1A'=Ÿ6jZá ›ïé6{¨õµk—1(RÍFÍZ|Ž2TkؼR^ïø˜‡{×ÎZv ¤GÏn±gWõ[vB°w¼så¿pâÈõ»O,V«àÓ–+æÖ  ’”hˆOHHHHH2&šd´Õõ°[º´šðyÞ䶋w¾€ö_Üøuiˆˆ¼J«îỈ¶ ðˆß.Üõ+à놎-› ŠÉh'Á`²¾Jl@æÚ¹«Çßݹúö‹ø´®l6XÌ)÷1Z’ûûŠ¢—S·½ˆL`.n1ly®r5*sݹõ‘I ð;×Nï=D.׶Óç…æ ùò~Œ'wÒÖ³·0¾qì…ÆÍí¥c€› [ЧQɺw>ã÷K7¢â ÜQ[P”tåK ëVîÈe3¸hÐ\È€Y ‰Öd3$&˜- ‚€(¶ž²´RÜŸ;¶,6ÿÊW“û¨™ã—EÅš*VS¢bJJ¾Ñ”þ‹¬ht6/Oñ/^µMeÕ·£VZÒúuÖ}¿üìÿÅðϵÒF 1°·Œ¡pEù¤Uÿž~:q]H}sÆÐGJ“’ œsÇíe9u¨ÁæÖ‡ôoÖ$T[ Nõ ç–õé2ë0 ÓµËÇÆüªB‹^u‹Zûvì“è›3òú¹¿ß´¥bãâí V#f­”q¾ j‹ÔÝ}°}no5xÝùmóé¿:WþÜf[%6xêŠ#6]êYÚªãzÍž²qËì| Y·I“êóˆöÕ©?®U»t^/§X ³„†öùe{€˜Z…ëõÞáC¡O*¸ T­Ö§erX «+Ö°¨‡êÔß)S†»ô™Ð¶Ów×+äˆìä+×h^Ϩ9Fß‹°öÞ¬Û€ÖŸFdÆÈ ÀÆŸ9?FÙæÀ"ÃC}ª–,ÙÝ-ž+¿Õúw’¬ bžµKzoþûYXýÂ9÷-\•¿yw÷?ÖÙæuŠ*Õí 3êlýÖQÌ }6kÓ·ÍÒ{ — 9Ì|qìœ]–ôH‰R‰Bä»ÖÝg*ÆM¾úìXÑ_ÄWOXg€Û:4ØÏCáʱí§î4*R ¬r1Ó:W.P³ù±=AÏê7î8gøöIŸHg~ÞТó@†Ì9|æèO}Öah6½ŸÜ¿}ö÷ƒßÏÿëóÎÓz5/aws$íà9«^½ôë姷¿Æ'Të?fTAˆjñðôAÇg1»ŽX’÷ß8¥W9Dt›¸äÛvmÛçï°éã\îQxµ‹!ª¤«+&ÕY'Ù c/Þxáºi †Ð»ë6n¹öèïÝ¿E¯ú¥< ÍZt½qË ÷ÛÖÊ«N6¶9úÅÎ˺eÓ*‚´/ç±þè…Ý*½mYO4‰Ã'LøbÀ”ú•w–ñI±¾‹‡8¹i-fbP»ù¯ýé§B9µ¯ -Úz§&i⦓Eòû@mñiû;¢ÌŸ»1f k¹jSm?*äøá—÷ž«ÇöªÒoÓž¾MËHqa¿Þ ÞC•~÷ƒ—€L-ÇNÓÿJ˜¬×ªÍÑaþþ)/M4ÄÑåÈâá—E ‹ DßÛ¨T.¹]lýXÎSõ[‘+9*°;±’ˆV@ (œ#çÀ@ȵþ•\@­õÕKÏïÅC!w{{ÍDuÕ&Ý«6 0pF•âÂüž¡«5Á%g¹G~Ò:ùˈÀ- €V£5G'ÙÆ6Ú:üd¶0&‰@£¢íÞºì”-×[~ýÕèáÃ_>ÿ£Ýï°X* ^¸²{ÍÔš‚Lxe±àk¥/zæú±ÉÌã-‰öÒŠ2ÏùY·_æ ~9$õúlÐXÂÆ é}7NÐkUƈ¨¢Uࢶ°§=–¬rQ˲5g±Ëˆ“³Œ©taãUÏu3ý“#:Œá“Û×" 2€P¤Ti/€ j­ONÿ%K¨œ 28÷·\| ô?¿iŸ†l ÃçviÞcßÑu²Yn½xû¸jyÓØ0§÷ü»H•à#³|¹³ˆ§ðšJ£X¬UÇþ°$ BÚq)½qbßA.zš]}Š!´¸ä-ê%Úz ¢€²ÕR¬ÉÐÜ+DŽv¹îݦ}q‡` BVy÷KÆy7h\8bhb)û{TÕhÕ{†5ߦ¤˜YdZLMGM­§W$•$IƯcéå†sñ{c;š ¶Ó9*\QiU)^ë³[—µùJ{³x£èÓs舢^ÊÜï77ì‡\N°‚ãL4ÊŠ­ø-¥L[p»•&0D`xåÚ9uŽ>ÀlÝœBµ;Çnš}îR§¤üíêä„Kè;5$¦}!¾nÊ5çü™ýšÒ¢_If{dÜb~)’ò÷áæ„iC‡«Û}¿? ”F-lèÛä2Ǩ0:WVæêX«ÒÊm‹ŽþåZ¾io-"$>=¸ò×í3¢à‘¿°—‹æùßW­úéJ˜ðyÓ&ß,^S o.G5b²!îò㈪¥‹&ÄÇú”¨?gè€Á­o?Q ˜Žà¯]sçïJÜ~póÅåý¦-ÝþÓ×!í@B*¬I‰é¸qœ»¯õãêo@‰ jÕlÀ™!+åv>­DõVµû}QPÙòØðãÂ]êvüóô) žºø Ã—C:¤¾êÍZWÖvꂃ-»zÐTçèÐ0‰fMj©aøzïæȜћïûlܹ×ÏC÷|ÃÔnûž'gfÚ@šÖ¿iÕ¢;þ~^óÞÙNCû€½,èõ˜˜­b7¨DÄX‹”+ªÓj,áwvEjQN*¸zzå÷×_;z7OÞ¼yóúÝ»xþ‰Á%u‹Æ¹•sàüUGž1äŠÌÑ6è`‘m‘÷ää]0á/&¸|\Y—2£âü¦‰ËwžS¢ üù³gú|EDÀtZ!w¡ÊuË‹Ó{N Ž7+Š¢Èæ{—Ž-ßý`Ø·Cd[i×å)Z+_2{C·~d§äÙPqÀÅéxõC!zWé7¶1nþýºF’oÄRîÃÓ܇¥×5Sbâ”bå‹é4jCÈ­"%Åjë:[ÚöG£1ÝŽ|¿ó\ë1}$@Æ1DäP¯cÏA Ô¯˜¯Çñ&õ™°Ø§V¯½Û~Ô­mñ¹Õ‚­"Xâ_ ï7þF” !—!áE„ŒžZ GŽNfP¸Â!1ìÎÔÅ{û®Øè«ÆF}g.[õg¨c;½Çb pÅ t+ ŠžÅŒ¬¾xÜ”H  K~B•çâ¹}þܺäA”Q ñìÖ3Ö<ÃûéÕ§OŸ>}zöê?¾užõë9 L1ö«z˜c¤Ü“FµŸ5tV’¯or §ÜyŠŒ¦W€¿3øäÊåí©cæèM—ïjS<–v n`‹S?¬=vûáçeò¦* ÙË»a D}·þm† ¼^´ˆ{žRƒµí5júŠšåäøp³ÌA—sÖÌoF=½íI75ORÜKN®Ù¸)4,B¶pæ¨YÚgü—þ<û›.5Ž´!4<΢³„†Å @©O YvlÝaêÆ:å´Ã;¶éþÕšV*pó/óËôþwžÇ<{7bþj° ë"4ùý¥‰_5ÝnB¡Åç=Š~:o^ ãùåaa‘ŠÓC$EGFª‘j=¦,Zµþ»¹ýÚkb*QÈ•¿ä¤•›æ &<Ü,˺>}ªÕúrÏ‚¢y >*2&Þ²%éÌŠ¯?ß½€'A?gÕêJ|Óo†‡FpÛp4bƒÞSV¶lïU†(²ñÖ¡õIŽeÊVaªµŠû*rDxh’5máµî]z6Ô·ÉŸÅ yæ/קW‹!3Æl«¼Ên–íU(!:Üh•4µ4óœ|»FÂöY ˜m‚óHù'Ãÿ×ÓW¯J5»Àqºä,¶xd½¯º¶H²ÈfeÃCêúF•Î©ßžû¿¯ûž¯uصžE6¬Ÿ2£O÷Jýv,ˆ ¹äX<»wÃ^­Ë8X=¿pÙnvÊ‹9áÄò1vWöÔóW­ÕZ“"£bmŽ"o3¹Åžúý§mýߌvqQÖ“ݽ(ÖnvÿK†,*o6-]ý£Wéa¹=R<ĪÄ6ì?¦‹))n÷”~-Ñ)¨Xyù'¦Û¬F‡‡›dÅ&Ë…êvm¼¾ñwX‡ rEN0FŒkö¹»`bEÆš‡OïÛÌnöÈðè$ËKM ë<¼ûîþÓºwºäæ{p×ÖÇû|3ñǽ«{” wN.‡‡…›eÀ¯E¶˜djµ¹ÕbQÒ”%•Z-Ú§8r³Ù"©µ’ÎеÕl²È¨×ëÀl2 ’«¨ÒˆCÙjb¢Z8´rÐã|½û7­˜~ÍaDÇ|œ´…;e ð¿,Zô°ê£jÙdÊj±(<í@—FÅ’ Š^¯³]e»Ùdd’Z-‰€œ›-gs)V‹UyÉžj ÙbEZ2(Ïå$ƒÕÅUg5›AT*‘Ùg©0³Ù(ª4Üb4:³— p䦠R£luN-2Q§Q¥[ÐÍ&³¤V‹L[/ ­F‹¢Ñhr‹ÅŠ©+… J*µd7ˆÙŒ¢J- Nn0 ­à£5É`Qkõ*¸ÅdAQ£Íf«Z£Cäf‹ERi$ÆõoÕ®òÐ5½ëçKÉŽ;w`ùrøî»ìãÝØõFRi%•½UTkt¶¸sUÐéôNQ«S&; Õé’k5 ¢¤í]"&ˆZÛ¢Î`m—8Ânà¢wÇ|.‡·i¦Õ{w¨¯ìi$I+IÉy†È$µFJŽ‘ØÒäç±—N†jÖ^Ó¨4jÛxŽJ£±¥\”ÔbZ£¢)).*1íLI£÷r×k´š”z `O UZêý}dLÐjµ:æaÓV¦ÒhUŽ‚F«°UfD Rk )6äö©-³·„nØ]úUÑÛQçqª—œÚä;Á¿|ÝÀyìcÀTêôë««kJ;g»¹-…v÷JH~.{Š*µ¨J?Þ¥Õ$ŸÈl9ªw•QíÈ‹dÛhmF°•.`Ìnm†`ÏMx)µ¦„¨x£’æ'µzOw½Ö!¶{¨t¶à5Z1ÝiyÈ SÙ‹ :õ†‘Ù翪ôzûDMA­µ]hS † ÕhåˆÐÐs»W<𬿴~¾´Aè,²½VFMóK[\Ù«C//_ÀR›¦³›êÖéT D`*¯Ü9\!e¾,s>×>'EíÒ¸~eL;w–¥MÝk£,Î#Äic!¯ž znïw˹£U NA«ïGmçk¯rº½Ö~N_°tÍÁØ?”;ç³ÿØ3áþ¤9?m(à¥y•SÎ^Ÿ§¬CD¯Â7J¾q‰ImuöR`oXîØKóªkÙ?[ ØùmVK²»&¶> Ç*mÆøÈžå Þ¤#ãx’tKK7 ÓÏ2žðÝ”ñÄBVŒRÙËp²ðª²Ê~7,ë/sžçŠ¯*fèðØ‘¾W}´Å5ÿÓ$ýÓàúÛO²,Nxm‰z«Ü|Çirî„¥¶pHL˜ë×ø#S/­’~GÙNƒâiVŠ3'/æ•%á êüõTŸ^þöõ¥Ói¹óúcöÿ*€otì•Öø·iø‡ÕÞ,Ýrðêõýð.J:Öƒ¿ùmS.a©‹w:Œü5¤®$ÿæ©Ùk\߬ã1ÿO`Œ1Æâ¯ïéÔgt¤ñÝé:;ôý¸PÛ7gÈÓhþäòÖ³×3–IÍ c쯭Ãm¿äôƒ,áùÝÝzÞˆý§D0öèüªa3“SËc¿-›0bÝ¥·I½CªÀyïÆÍ1›Oîжu«6C¾Zø$ÖÄâ›”_Æ"îþÖ¨ÛwÿÊ„,)æéð>ÝÚ¶iÓ¶më¶cf¯‰0c Ÿwï1ðV˜5»2õäÖ_.pv¸%fTû6?ßÙ±ÃÞ ¨ ÌNÛ—­fY~ÃÛÚ.A«Ñ`²¦ Š°ðÍÛ]z|e`»Ž'ŸÇ<84mÄ‚£©BÖÈ1ƒº®?ÊÒë ÝÞ?qÆÚS,Õ³ûv[¸ûøôÁ½ü|Y÷3OnCDkRØÀñ«Ú™C÷êœM¯¤[3^n5cwwŸ±ø¹\ÞvAåé-ZMq!‘±©Å=ÝMWð5ð릺˜€).4*ÎäܾpÙü"ØÌ_­ Ž‹-Ƙ°ˆXçHŠ 5¾ÜL½œfLµ8eÊcÌ2½{Ë?r;éë¯ÆTðmñEÏGŠc‰ç+Ü¡äû»æ,1²W}[5ƒ70ó1®Xß~ðéÀÉÆŽ=t€ÛÓ_› Œ4pkð‹³’~¦r‹ñù‹Hçˆ=$] IDAT‡¨ÒæÎáb”Ź]ršÆ:Ý}‡Ð±îõ©e€ÀàÖÑMkŽ\I·ýÕ%ç§uøí±”ìcà^¾¢_œÙµB)W“Y±$F„F%¥v7xhÈóØ$%]‡Î”cLíªÊWÌa¬R1GxhÂ;qî>`ï&è÷ån5º¶.®Ã~ß¿ýçÐîí{¾i½}dm§vC¦ü˜ÄfI7qP@ûÀ~£g?L²õ}øáµ³§¯?ü÷úá³ö1ÆöM0|ùTª/G^»y-øÞû®$ž>ä>qdßšŸTªT¹z¯‘Ó·¬çbA@¦$…ÌÝ¿}ûÀÁ_/²¹7¸{·çѲÍQ ½v mÿ¬JèúÿöbÇ~ãï\<6 kûÀ®ƒN?6Ú<Ö »–´5oë³ CÝFmJãYͼØ'å«T­V³NýoF÷”EG'Ù»QðäÒþ~Ý:vèºdÇŸÀì ‰©bãnü²c×>#n…$¬šÜµ zʳ¬N9üf¿.ÝGY“»ˆÈ?þóâŽm{™÷ÜbϙۿmíÙ©]ûŽ=Ö¾jKí³ã³ûÍÞa÷òNíÚö5'ØÊB¶Mºxû¯?Ì6y~2´$¬˜6²]û#g­30Æî;qí¥‡Wvl?xÒ¢D…Û0ûLÔ³³ËFn¿ÀLÑ“z¶ùþ¼@ëË£óùu1$åwË¡ ¨Ôâ¥}K;´;g½™'¯Fˆ¾6¦_ö¾Zº;¹k\Tþ·00 íÈ™kM ÜÍ1ùŠTq ÍY¶–Öé]Z_zýÿrî²Ã‹_1¾iцMëˆò³û׬;ÝÚ¢6…£ºtÜzÏsÞ¢YÂåõãˆ$ä®9aܘ†…cûö4ÃCógÿr¿ÿÈÑÅÎŒûó‹X+xú,à癪A±Ú‘s{ü ·üíÌÞ²¹Ýñ¥h7CãâA-×\!c'ÔÈبÅٱ纴\¾iÏ/›—›<õ»§á‘œ3%)¼W§>ðQ«±ƒ[í™6âôÇfEä‘Û·í³f‡Icú†lÝyêv…±S›¿Þq“™0&热Ó÷G©¤W.}IŒ š4âÛBmÆ,˜1ð÷e#ÏÞ c˜Ž×SH@“.ÖÚŒ7®¼þÙ—S¶2Æ.o™ÒrøÆæ½F êRovßö›ÿŽ•üèúâÕg:öéíën_¡‰àúñG~KWo¹ó(82&N5¥Ë—÷Õ°øñÛ$ä¯5vì¨rìï6')^Eýµq;¯=²IÆùcKQ‹G‡= Po\<¿|ÐðY‹ûÖÏ1ªsçxtnÍÐ%¿u<¦^®°‰<3¥‰0‰±Æ¨ÈˆˆˆÐCG/ä.\)G½Ý#ĤG{]T·SÿQƒ»üõý€±ëÎ!ÁC š3ssÛ^Cêzý˜fèìY%Ü„žS¿ý( äR°Ha$0Ç.{Œ±ß7NYv2ìË!#êç~ܪnûIðèìš~óö¶ê7fì ÀS ûÎÛs8O<·ýñ¨|ó—,üÈôû€á‹Ü?Ò¶ªw•f]Gõî¢b'uþ"HSvâÄ1%O6l?>VY‰;µuѱÐj«ajX‹oUBÔÎ1Ámÿѱ Eo‡†t½^€ˆ?¶óžŸ ñŸÏë¾û\Š­vSÎ.8y•ã_0bЪ0?½G‡VÛ.ä‘êBUŸݭŲŸÅd—ÿ³°gToŸ˜­U%~Ó<|"bÞÁ7Ú†'eiµW:vî–žËíŒéùá·„bœY;1(êSÇg×ä¥ ìÞ9¨]ûöíÛµiݬmØþËYˆÈg„„õ½ñ”µš´#‡ˆF³ùÒÂÁ=cWyÌIý®u›·…ׯÏMjõÖ(µC;â)¹•qR—V—3„„¦û‰I,âòÈÖΈm&õʶîQÓˆÏÌl>UÏ#"Z^Ô¢G¬ÖŠÇ׿¿!á&"¦XÒ1b„NÌS?²SÈÙŒ‚”ofvú±•ñãÆ6ýW!š§í5kíÁZX€ã…â‰?¾óå„îÃZñiÒÉàö²P;,â­Õ_g"§/Ô˜Ñh2=Ú¿(¸ï»9,Þü|Ä°™;„ß&~×kÜnÛCóXæ±w?Ôé0"_^hß €_²Qéâ$WŠ.]$rO™@"u’ºH%rðo˜´aí¬™CvB°Î!=zõjé!»¯’öðM²›~qITT8.©>oI€€Ö˜RÑ€¢‘—Ëi]ælSuϪ‚R¶õ¸7½>ÏݳšpK/ogW9a¬w3¹œäý#G†áëxX,O3 œÞv7Õkî›ÆWúíAFîç&>…T.³ðܳ—ÁÄŒ¼ëÎ4rå²ÁGÖùwìÚ»?g0i¡ÊÅ5ï–rÄbÒ¹:×2±%J?ge‰ÇöÜ®U¢g¯Šž O’®ž8z8.²÷´ƒßij=¶qöžóþþ>R«A+qŽ«×´ŸkqÔ·isÃôÛn˃ªºê †¸R…³°›Q*a¤Œ1MÅÕ­í"5ðµºä§² Í1.½q¹#äÞùfäû½\¶è –‘Í0óÃ9̮ս\MYO]^@ Èsîõk‰9FBxGíX)?°%«ÍOÓ ”.2T4xµ1€æÎcI¤Ÿ¸3ÐÕ£žÙt¡€ /uõ '9ð"ð(˜Á½_´¬úÉøQ£ ò )tqyªckPxˆë(‘´:Ît»3HÑu\ɳWñk"lU(}LN¶Ž·Ö°›gOÿ>ÃèWÝ‹/R)e>ˆ€„xz‹>'9ðœãô¬Åþ{žÃ oó#¤”îÎ>wwìp¢MÔz­ÇŽÃ4Eê¬[G&ÄLÚ|Gg´ƒªÈï\·–Kœ@Ž\žÑê"Sz(³Õ(æžS €R‰ÜÌ™…±:oæyÖŠ(©&·†]=¢ D¢PÈœg¹Å¡ ïÐ?UCyÎ*j‰()•RVÅ7_“##GãÓÔÚ¾óy¯a…juâ•“c‡N;pz…ÔTÔyÚæ÷j8‰T&a'ò–·[Ôæþ’škjÖ´!¨Õ¤uL“fºÂ ;O¾ªÞñCî®CGÜ¥¦ŒK£ç!€ÌÛøë^ÇOK¹u®Cß9.RÐU¾†(s•£Î"š;šÕ:D粯]B´ÅîˆHª¿ÞcRç5'Ϧô[$ ÷Ùì9Æ è¯&ô’K˜ï>²ÜXvá½|-•ú´”HUw/™Ébå¯wÀ­š3«7‰¿° Ž'…àuBhz¤Åpu‰‹oÀ•ëÜ Q(dŒB™‘ùœé‹£ÎRE5i…[‘å8¥«#%'—.¾`øüÐ"o'&ýó¥#¥<{ë€M`·Òýÿìèyyt7è/5茬Á¾»³‚í0N–Ç+æ/ÉT›\ܽ…tóÕåæZy\ý>Ñb±ŠÒvý÷¡„! ÎÌx˜]øìy,rƒÉ¨Ð꼪×ö•¾;“dfYíÓûßgå·|-¬[;ÿÇ÷RU¹:ÖP¸ýèM¥BÀyzÕק&'©ôÖ|ãjB¾yNÒ;*(åÔ…b …9óâÖ=ÿåÁ3¸™òÒõfÖ¬/LÜs^+“üª¦Pv]Ñ?°³ëƒ [Oß*ÒhµšÂ{ç??‘¨ U%ÎZ¸G‡wïêßh)3æê¥n-[Ôýqû¼L¡‘K'öý÷^‘øŠÊ­±æŸÝ4|쬟’žhµ:N«ÊHNIÊ«ß.,,HRÚ‚“ǾÈG…ÙlF ý¦Éø|ëÑ4ËÀ!ÍŸµæ`²’ –¾W_µX-&êÐé«åmç CÌF0èt:VSxÿॢú ý€CaáÉbá”NÈY 'HÍ•³f³µL‹(ßñ€g éÒÌ¢scAhT nãuêâ]£ÉÌ_©×èbŽ±_ßÆ?$\0±–5_ÿz_@ó®e›±R«3XYKÛðÖ\vÖã,µB¡™3·nÞgd+y{<šÍZË!oyœv?GË‘r»á3S¿KÊ7°Ë£k§HÍN ¤€X­©Ü‰N›ÿøÀõ;ž7³ÏSéB€ÏL½¯3YÈ¿`Eü…G7.!Ý=¦ÝÊÒ6ôs´¨²U‚GÞbPeå ÃesQžJ]l‘×nÙÈyÊè‹„È\úL[ÒÄKñJÜê„è !G×6jÓ·O¿¦»î"|5}Øÿ1§>ÁT´TLá,úÄcÛB®~ˆ€hpªsèØ—ëÖ-\´xVïµ"­ÒìâáÝjÉ`æ„{¾; ܻ֫qC볯€k†ó‡½Ý;¤Š_`ä;QU½äÈs>]gÄ箉y§Ÿ—ªõc¦Î€È+b'Në¼QÚ¸ÝÀ^o׺˜_\²êNoe³³U‚írQÊÄrÂ÷VW”c0YÀa¨Ü«æ¶]Ë6¬Y>÷¤õ›wš·iW_7°ÔyÓûË¡ýÂ-<‘¸úŒZ²¸>ÀØyk%+ãû÷ÞE[vŸæ|AŽJÅZÐñû‡ˆƒ—ì®zp゘¤_ !ž5ŠY18¼¦Ì2¸×Ùï÷êV#àÕØiã{\Ž7틯6Ôð ïÒtã•W¦6•pÃÓœbÞ•+Úåóæìl•Á`³ð› 1o…ì¨÷z§ˆŽ­¾Mp¿òVI½0"x%Ã#¢Â­zߘ%£»4@]z¶*ÇÈJFÍ™ú޸¹7nß{^ü”áfw趨¥ù©Jm[Jg³²ó¸Ò=;=|úæ£g^©.·/ûž½vÉG…®Î’¹xßôEÛêÎ|ôª;Ëæ÷éùL£ýÅõ‹Q+KÉe© ¬VhÔ¼ó‰“î|×gë†ù[[çÏ­Òó¹Ç€è)Î °Õ9â:´Õ¬ÍÎ) éÓöí™qéfÙ‘¸6±ƒÂê.JYÞÃÅ>f"ôùÙ.5;_Øøᔠɼkà²õkÀlÈËÉ.ÔX'N›v~̸ˆß¼<JìíAC'¯K˜ãWXP,Žî,FuN¾Öa0'üaçEõ±ÿBpƒj¿³òü˲2õBªbAsyÿ̲Ñsw#"W*Ú®æålA®¼¦Ù¤-Ð[Ä/m5xÑ,ŸIÙ{r•©­K'Cd5¹ùZñÿÛŸµ ‹Ê,äx«%'·Ð¦óL ¿šÉ—ûyŪ;Qmè¨9,'¸¶•Ïªâè "í9:Þ³òúáyžã*Ó9按¼ü0Gˆ¶ì­å_¢Y_X¤Ó$^ÐiâWu\Ù{ùUÊNžã*ÏqAñÀ’™éj oSWòÔ|e•Vf‰Áñ®å‹QR‡°=½K—ã*j¶”\éæW¦åð\…5€ˆ7Îî¿™¦z¡žöÏW!Àc½v£É†wv^ÙÒÅ>Gûžc°«™Ò³S$@rï3bîñ÷Çq5d¬ÝswÊÎ×mzbW—Ý0MsI¹1€$oJÿߙޮ¾ëþ5›ë¶ŸåãÁ«Y3ÀüFÿAÁ ¯$ì–Ô iî_æ°ªÃ+,½¡0¥O]BBaˆ£}0#š¯—œ:CueòwŒF›á_©’†±ë|H©ÑMi•ª}÷uI´ƒ•5éú…„/¶Ý%-gÖ®jS|""†‘”ä/ÚBŠž\½yÔý%ù›6žŠ^> DOÆ+9rêÙg~ÙÂib¶§.cÒl)ô~³{M©X¶vÌÓÖ*ìvüe âKU†ÍF¾|ÛÂ0¢"‰aJ”J cÿ5c{Fƾp„0¤¼¹CJÎ_qtTREˆÀñÕŠw±•_h§2÷:5¼_È€î%9øåÅL4mîd,igÇ.?¶tÕšj.¿mg>!äfÂÎ5{O[åžC>˜Û³¹ï¤0­5 y÷ãç~ò‹ÆÚ¢çè©C:Š·4d­ˆ_|-½ Nó. §V„_c|ücZ3s|2i¶|ÉÄ*€ž¡ö&@^:¼dÓa:÷{ê ·þÙŠL»Yä¯(à?ÁMC^TQ gÏþÓÅM)KðlGº•|îJŸéUùi¿çU–zƒ(,Ö—y­ÿô2.qžï|áO~/Ïû~ý÷ùÛ¼ÇÚ.eôý+â%7Rxaaã8Š&¿ºû–uSâø/yæ–Û,¡7☴ ¢3Þ ÖJFj¿­¡—¿Ú˜ãße¼ôæ‘÷‡Ë«: ܼ÷?û}Êüìñ­ý“?5|½å½ßôô.oýðË*‡×DÙ•/ßnñä•‘ï‡4Ä犜¿Ï§Üfú—Œ‡8,±§™Íb Ë–ÄW`Y ,–R¿"¬V1Æþó2ù8jCì^RÒáãÄ7è(Ó”)“a™€]¦†™ A* H¥R)H¥bÌËcÄ }±ÎOÀVìé»øÐð¶'7çå*ëVP™W'»—íòû©°¬VE˜ <¼¼õhÞŠYC*¼••Õå˜ËÄk óÕ23xu<¼¯¹··¢|!9³.'_÷ì»C¹!gÖå©™’²ñ:hldŸ ›xË‹üªÞeÿ"–ødã81ÒS& ´õ c* X­â*‹!$±­ÛûžÐˆÁdƒØyL&±ë ýÓž†ãÄKBÏ·çSþWöáWB†…BìiNNbwb¤R1@6…žæ˜Fˆáù’ÄÂ¥ ó‘ËÁÓ³$cÀ^BÀqQæ’PTá’@†){©ü¯þXjÔøç‹Âê7/ž~ÕâzUlZ÷øRÛ‘‰š'«/úéa‘Dæ1,vv¯–Κ8yËŽÚžÊü„5#v§lؼ2ÀË%=aGü‰‡›7ÅïŽP÷\<£o0ª6-ûø‡•Té=k~ð+ž¤àÑõø%kŸ³Ò*µ&ϘóFþ©÷}f´*¢?L]½rÞ…ÝËwž¼Æó’æáÃãFö}qJe7OmX¹ó§ ˜·la£jÂi _»wõêu¾®…ë-¸”¦¢ˆ3upØk@dNwÎöɧ ©ïœå7õsC ÆœÄøøUiùwÿקϚ^ß›ÎòÕæø½gïU«ß62H_Z6~}aã‹&(=&õ¬½|ÆâVŸÎVææ Ä/kÛòŲ¢(º! Pˆ¢G©…¯ÐìÇKBÀÞ-Û;jùKJ%ð¼xI¸©´’WÏ0¢?aBÀÛ[¼©=±(ßyìi*»äØ /½$³€¿t ö;F¦‘‘/Çôó…·Ý¨'¾Õfßå³É|bý°ðŽ f¿·éDZýðƉ.A’òÙµ±á瓲Ùõ“Þ =îô­LDö³ùQCãDÄK?;sW…¼fö .ÑK÷ç¨ï}ÿEÛv]/©g÷ysßÙ›ùùɧÖuë«Ç‹ûãÆ-Øe0›î&¬í9&ùInÞÓûïun»øØ-D|xyg‡Ž! 6ÉÊÍKØ>·ÕÀ¥ˆ–%“{ŽZò3œjÛ©Ï#5Žë³öHAA~fÊÅa‘’³MW¶·ïØý“íDzrsn˜4v'""Ÿ:$8hËÑËjuÞé-3Úõz/Ljɧ>îs_UøôþO1owl7ô3D|xîЮc?°ò<¢öT‡¶½Rs´øfw:{£þ.…ù;Wåà¿-ÀMÎç*®r… a ®_Í‚ñCzzyz4|+ðàÍ_‚[}Ÿš¦âk)úÑ#¯¹ 'qrwÒ=*(Õ’9“©ÏÒ]Yñó"zªQ³N»îQï ADp·^OBxHÍ1™s3&¾7ŒLÕ¼µÍ5úUO/p÷ó‡Ã3íË™uªC±†}N­ýzíç”—heª<.J7 ÑYãlBŠtzw™{µ¦÷âÎ<¨Ý¡kc¹¢*óÓµÙõÞhõª y €RêÁ¸W_¶som)‡À暈àU»ÅŠ]GLúâ‚'†Œ}åèa[ç0o]¾õÍé{v €½1ß' m¯jñS¡ÿ[y«Þäìï¹F?D®ð™´hË8³A]1;fJÂëMZ0È—Ÿµ=d.5mÚ¹Ñá‘Fšw•P¨WÉt¹Å€öE:»¶Ûjá…ÔÿšýjÊóùƒuˆèVÿõ†žÖ„Ë×4úñϧ®¦hîžÞ j7ì=ôJ8¹½¿fß‘7šµFé×L~ªñ®PWRtàðÅmÁ“¤™Ä]~l!–äØÑo§fYTÖ tãL<ÃÈ4šb}q¡““T›—¯Õ'_?ý߬B¾¨PÇ!™îÒž‹¿h´Ú´çó}:uus<"‘È•¦±c¿ù)I£7˕ޞΠ¶"_6Ð:ª›äу+·RŠµZõý³“cä› s×Æ—÷•_T\—qðÔ5aß\AÊÏ—n§ò¢ËТÛÙNÕ¼ð+\úQ(TÜü:á€F–åy°˜ z àýñúõO¾^Ù·oŸw&¯<Góš@ÜÞmé›|åZm/ ÊÎk^;q£Yc!à cwœO§êëvlá®lî߯ß;c?jÐ}p‹š275¤ýÒ)#ûFDDÙ2bíö&ÞN5›E\ÜÖLüˆñÙ{b{õxð6¿rù|Õñå+Îþ"5k´u‡5Ìû2*²ÏŒM?¬ßh6uz“ЪÓêÌFå°±#¿Ù8+""¢ßÀ÷}úLé÷ªËšµzqùœç¬Z ZçÝÛ]×/"bøGû{ é!‡æCôöMîÕ#|Ìì]#ÂŒ: ÜÜññ¼­GÄíï¼£ôô$H›…bÿÔ¿ Í¢]ÈÛgxSÖx›ýÄAs‹ C€ç±ÌY.â §¥mx„ßx\ ò‚‰/Êײk†ˆ¼P<äyûiUŽáRR~3„y2/v׌Us”„]3nȽZƒ¶ÌÀЙ…òG‰,9ÃL4D†ç¸&³[½ÚŒ¨ÅÄààG±TF e&m—Û¨k?*¥’¿ŽÖÕ¢Á2^Ö*:G¬¬%6›—–aðjXÇ+/åü ÅçOì]èòï±ü¡PþŠÑ ¥œô9ñéÜÀ>q¯úº¡h¢E«‡B¡âæO;vƒÕ“ …Š …ò·‚Z¬P(*n( 7 …BÅ …B¡â†B¡PqC«€B¡PqC¡P¨¸¡P(*n( 7 …Š …B¡â†B¡PqC¡P(TÜP(*n( 7 …BÅ …B¡â†BÒÑ.bIDAT¡P¨¸¡P(TÜP(*n( …Š …BÅ …B¡PqC¡P¨¸¡P(TÜP( 7 …Š …B¡â†B¡PqC¡P¨¸¡P(*n( 7 …BÅ …B¡â†B¡ü‹ùÌìùžzÞóûIEND®B`‚suricata-3.2.1/doc/userguide/rules/flow-keywords/Flowbit_3.png0000644000000000000000000012754513051004444021275 00000000000000‰PNG  IHDRz¤°öy˜sRGB®Îé pHYsÄÄ•+tIMEÛ # K½ IDATxÚìwxÕ×ÇϹ3Û7½'”BèHï"Uzµ AQ "R,€Š  HQA¤IQ@Q± HGŠô–ÞËfÛÜûþ1»›Mñ÷ p>nv§žsæ{Ï=÷Î !€ ¢üad‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ Hn‚ ¹!‚ ¹!‚ä† ’‚ ’‚ Hn‚ Hn‚¸CåFAv$B•‚ëÞ±àœ#c‰‰‰HF'ˆ»Qk"ÃÃ…Œ±r”!"¾5ëßÏçë F Å!ˆ»Omì…–~­bF>1B„2’ÿÿûQ7›oéöø½9€ OwŸÚ@a~JöUA(/¹q‰ Šà€”ÜÄݦ6Wþ±–B#SAÜ"Hn‚¸I]öÙL6"âfô§x||±cÇ­ÖBõ­VÛ AïRÉ A7ΕcÇŽ­_¿În·«ßh4šJ•*‘ÜqS{Rˆ²FÒëõ’$€B«ÕªŸ=Pí† ˆ›Û«e~&¹!âÖArCÉ A$7A$7AÜArC& ‚ä† ’‚ ˆŠ#7BNˆÅÿóšeHO8¾kq¹AˆŒ!„(?7ëXŠb•(Êïž)Tl™W¯z=K”£.88**/é„kÐéÈúw'ˆ¨ØsÓ“²B£«¿±U„3ëÊÙ¯†¯ö¦ª Z#:-‚_÷1tDÅîL!Xw}3cè/+gü¶òßV¼ñÛŠ×|ÿ`ð×ê'RA”jg\M(ó39«$&%²×²U÷ãø‹¯çý7‚-ýè†÷ÞCC©§¿¹%Jäü¹êåSÇÓ‘]ç àÈO³K~&ƒ–¼õß'&B±ä¤ 6Ä`Ô€àÖ¼TÎ fcÎÜ´dE¸Q/+NŽ2S,999Lçkô„=¿À‚f_‘“áÐÉZ½ÉBp&3[vZaa¡¬ð òQì#??;“BL&–—eõ l7z¹¤ lyɲO8ÏK.(°ëýBõ½Ü–Ìõ!FƒÆ•³GƸ-/?; ˜Î& ¡pd´f'[ Zß³¬(P˜vêÒ‰ciñæpNC.¾må@p¸â¯žÖÉ™»oùÄsRüCBò’«ôœ^?:wÝòï†N}Wk„ßßêsÌÖò±·?0 ìY0ÔÐg~³º±NzòÛ ’õãÛ] m·vë[U8 ÿ\Ô'=ò“ACü¾›1. ZžšQè¢ú *eX¹ë«µú *öôK¦Zý;>:²ðÒ7kV]hrà²vÈ€ÕÔ Jz<¿iÒ¾?Nû…Eæ'÷k8¢ÓÃ)¹'·¿û¬U_Ù¨Õø†ÉÇOT÷Ñȯ^èÚm[‡>UÎ,8ÍÚR‘t:žtå|f§—> Öí}¯gAûµ½»Æ)žßôíÇKu!Ñ`M-°‡wš¸0ÌŸ\5þèñß@ßœ¤„j}fµèÒ õç%yöÌ¿¿Y}'T SèE"·¯ÜÁ8›;'–eY@)ïÂî£güŸ»H¶ƒ-õÈšé¯ÇÎýÌ”¹$ÛáöS Jˆ?Z2Ó!Ò”Uh¯[µŠ“S TˆÞ·Î¤Õ©1A­)PoÔfîß’TèÿÈŒe:„¼+‡3-€ù—YóIë¿®é‡ÂùãŒ^ñ‰}Ãu~ú”ïÃ_úµ…$íU»òʉ5?ï8Þ{úº`+8úåäqI÷wW~˜m¯6vИþÂÁ÷/¬7û @½OF+ÞXè_߇zr-œ^Òãâ±sQ]šµym‡ýE "2œß¼ØxïÄÞý;r‡ègÉá´ìµ÷ˆíáé«Í&ñë—¿==®ÁªÊ}^Óÿúd³Qï„j@ԞݾrƒÈ³O|=±³êA¡ØƒZŽîöè Uwr“þöoÑÞ¤€UÙ§R &ár†9&*ýÄ©\½|Œk‡¼r9Á?è€ÅÙÐlÔ½1¯bf<‚û×oï¿eë¾V©~›*uW­VpéÇ‚´¡¯¸=_P70$Àš•¨¯Ô4$Èä9Φý"!#é²Ð…·xjI\%Ùn—¢Û=®±œËLËi4¬ÓÈAhçL6†ÅDX³ÓýcšúûšHkþg¶œól­Z¥Š¢(êÕ*IR³fÍ CQݬrâäé‘÷Õ›‚Ñ=Ù™Ü)„»h£î‹I(¸:É ™ˆ xQ‹Å$DÅ)Š&µ©Éz÷“ÔDE CÆ®@LBd¸Rªg½?{6EÃüÓŸÿòCfï©ã¿¿óðÕ˜—ûvoêà8(! à\Jˆ\LFׯˆê”>E 8p.Qrí«¨¢ÈI ÷êÄÿTÅ+ȹòÃœ§Ûµmk·ÛQ}ÃèÑ£ʽ3¥º+Å„Â%:Üë³g {1á#ÀŸ‰ŠQ¹b^n‰¢ÙU®¥ÔV„—Œ7½?{6ˆˆBæj}|àÙ/GÐIůaÏ{ï±Ù„ú†FDï¨pŠ÷®\ã’PfÈî,öq;Önâ_6’ê`¶pï˜Om–|¨5ø3‰+_!9 ¹!ˆ›•?';ÑêLAž/¯5jyA-pÜ©S€èy7ÿy)hôµD—ÍÕ±APÿƒ»$«AÔåfÊ–|qçöéHnþ;µADÎ9Þ¼r=q{ÇTÞ³=äïw°¸’Üüw™N >}˜3*Q€\ÖpéN®oÜü—ØÍpÿKJöBÊoˆ»’›ÿ(sPd¬³~­OâEsr<ÝHÜåØ“BqÛV¡áGöpòArC”On#Q—“tö/¨ñÝj®¡Ç£$7D¹ä6(ø&œ7¦' €Jû~ÔØ"é 5D$7ÄÍ*E•þüQr:ÔšMó Í™%(»!nzO „Ý MOS¿àÑ»·ÊV=på.Ol¸¬aNÉ qó¢ Q‘1î›-’âpÝ—`JM0''ÐMAÔ˾³ûS$7·<¢„€úk€ç!Én­üû÷\F*ßõ)u¦ˆ›Š!+-øÔ¡bPcÛ @4‡¸s¹y3¦%Y’ä¢þ]7ײ”,i>?KȲ91¾ÁÒ×¼0ÛaôÁ5H·èß­0L’%I–4€ü6;x ÉÒ?^ô7!ºÕµeg¤žûr¾Î`öˆ¢(\á¤:eÂ%‰3ŒÉÏyGÀ’ܬ§ز·oWs µ:§ÓNÁÿ=$[œ;Q 5?þ»ízU¬…¹6«µÜåF½±yÁüöíý1×å¢Õh~Ú½ûØ_ÇSêAÄ-¢B8çœs2ñuúêœsÀ…à”ÝP< ª©‚ßþ}õ\n…ܨ·ØØØË—/K’D‘t­¾ºY§CÄð°°B³ùΓƘç gÄÈM@r²Ñ`°EDàQ‚ÐétÞï´(·çä^§\D‘’"""0!"#ÉlÛ~~жíz~åR»ñh Õ‰ÿÁPv; !2`·ƒÝ~Ÿ_¹È'¯¡ç åõ/AÜñÐÈA$7AÜAÜArCÉ ™€ ’‚ Hn‚ Hn‚ ¹!‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚äæ¶ÂLJl@Ü·­–l@ÜAÜArCArC· wô«ÙHn*ô®QBE’@QHn‚¸%rãt’ÜAÜArCArCÄ$7BÏ¿E_zý{ƒPz3ÿÃü¿6A”K„” 7!¢˜wÿµ{ÿm$7¹œ¶‹ˆB(i‰I…N§ LÒ†„G4€7"ŽÄ«)Á¡‘Zt­¹ª¤!¢k•¢åÔ¿Drü]px€^‹wôt†ÛàŠ3%)ÉîTÔë^ÖÃ"Ce!n`î !Йw9)/22B#±!êw‘e¥%fçÛõ怈?ׯâF“¨`r#„@,œ;aÌŸyÜ_§Š#5#'"®åÒ3²@ô¨Ž€èRO` "8’^|nÌ乫ëEûz«IшÎC+_Þ¢oÚƒ¨˜@€kf>óáÖãCÞ_>ºEõâbDTˆìÆaIŸ2vÔe§Þ¬Aî´¥gÄ6ì¶`î$³ =W½wl¸ÄÀåÍôƒF¬[·úóÊ!:5¿)3B1ùë·Væw{qpS—ø€@dG×O{þýŸýÂýs²²Z?:sæ¨6¤5·qv…Ùy}§­×: ïŒêûâŠ}ËŸn¶¼Ìôœ”taá¡Œ `¹™©y…s`ˆ¿Q œN‡ê,8ëÕøÌÐÈ­Ìì–¼Œ¬õ!¡!B±ÿ¸ãÀåËU³ò*ø  @ÀÝsÆÐ5íT#Ó©pÏñ*»!²³Ÿûeoo=X/>Ñ÷ÑE?ö}¹GÈËLÍ)°É:Sxh ç€( #%©Ð aáF@p‡Ã¡ö•Ö¼”Œü°ˆ„…yY™9²Þ „pZ³7|}0¥NƒÔ|[¨IÍsR¾}ò­ß>úáû&aºô½«û¼4õLŸoãÂt¤8·¥ÜxTÇšŸ  4ýúw}ô“ƒðt›ôŸ>üÎƈÊÑŽôKöZƒ×Ï€'7½þìG{#Ãý¯&9^[¾ªczçÕSÆnµ7údÖØœËûŸ}öåÂàºÊ•3A-{¼?uœ’zníÞ¹‰_|_ÿÕÕì?6­}hØì'¾£z…†™‘ „@}ÌÐÎÑKþ8=êY;ó…¥?W«–zá\¥ÞSŒm[çžó}J%LÏñŸ½åÓzE]gû»£¦µyuî¨È”}«žxmyx:I'OÔø…™£{$ýå»+rÞæ¯ZÔso¬šû(æ–k·®¨¢‚ï©&1ÙnµèÈ#·³Ü0YëiÌξ^§ €uõ—yúýš° iÕré¥!OšvŒxý—e»·×ñ×ì[ÿú;o,î¸ä4òáo毸äûÙçc >œùZñŸM¸¿*L¤Ã·{?ܪnçæÕ¶'´yu`gwB- ohp› Þ¥B DàGO¤F¶Èúz_Æ”7¶¯frfŸéÞùñ=Oìm~zÁÔµy¿üºÑ,Á’飾¾aÑX e&¶/|2êU£Ú‚ãâ3/.¹d{¿Úf€ÄA>ܳM“–]ë„}xÿ˜1÷Ær!¢B2F›@pŽÈv,ÛäÓ¸R”ß Uˆ +7²A·ç‹÷Æo1 !ù©‡Ï.]sý³¯Žÿôí¹OŽ\ät*ÉŠ#%Þ~äâs˜0³FphÚÿÕÏ»;@ICI:·óƒ%[³>]þ^(àߟֵÕoëÖý‰Lc¬³ûø…‡[ÅØìNE±qæ*RÌÜ6ü_qìòSNÿ•·ñÁ†ò´×GÏž1yeJ®â´jxVlþüí›k$BŒxežMÈý ʦÅ/î¼Xãó%O@â‘#i\“qxûºc\ÖÊA~?žOiR%BáÜa/UkÔ]s!c¿,yqöé“%3üe!€JÅ·uvù10¬j•@!„)ø¾·–ôسžé7 ±ÚýŸ}1Tëxgü!DžÕ!1­Ä@ `²ÆlÖ€]ÈöŒ÷¿:ꇅW3 "̾À-?´ï½¤Vš}*‡@±¡`¹ÍàŠâ^5ÚääƒÚø¤_; äÅ?ÜíÑ°žO?÷x[ƒ5}ü¸ È «ë}5ªw5z£² 0çê®cZk^rJΟ@ÍaSŽ}¿ÿªEšÈ¸`£¡D:¥6I\&lkßzfñ ßÕËß×3”ÞÜÖrã´9õ2®SœWòŒ9éIçÒ•W7On©{~J¶ÅVY’êUñËÎ;i³3cÞ¥# ×þ4~܃æ3kö"Ó¥ÕÏ{iåú%‘rtµHÍ„7çÄé\â"À I¨–y„@×È–š¢ÅÅRÄ–gë÷ä³…xu®“¯žÉò[ôêˆP€¬ø4‹ƒ €Ö5t_þ¡( •ðìöõ_ÇÛ^ìmÒúD¾ûÁ²K[¦¾4ã“MsFG…„éÌæé³æEø8ívY«Èˆ ÜcâCܽà¹]¢í–ÃÌ5R@P[UÞ¥•ò•§Ãá°{·-`2úG…Ákþ<áü¦es:Ýùßöt{¸…”±díקNÿÞ´Ó–j:p:¹A'Õï6¼Kpò¤×?q€©ÿ#]^xcÑ™ógÏœ:8¦Ï½÷]|¾YIG_Hv …""8Î?zêÔ‘”Ü‚¤sçþ>z8>»´¦ât:¯¿Àß'Ò ¤ìÜ}òüé£Ë~)iÙ©½'ë{1äÌ® Û>qhÏ›K?ÎúÀ§"4Lê8tjøɯ®;¬­Ñ¶Gœïô…+Î=sì­}»w?Ÿ tÏ<ž]4ÍâïÏÆ|ra@§{Î?räÈÑÃGŽfØ(BÊiúôéåTDDÖX³Á=•LžhB’ÞܺEã¼ËGâ“2ët2 Ssgî•Àª|à~ËÕ³§/&F·xà¹a54:Ÿ:õ˜õ†¶îµ&] ¯^«A³v5M¹þ:•p5³ãqE3`qµâ´XdÑ5Œ«äi5ßµëô…Ä°Zõƒ”¼+ ‰rDõ*Æ 7ûÆမ3aÜ8ð÷¿Û"O ÎèS¿Qâ'Ä#‚Ðú¶nsþÔ±”,ÛýCžêT¿jVfJµZ÷õéÝöÒß'.%gu0jHïzGod£uõC›Ö Ó/œŽ«Û¾[g¿Â«º˜’#vbýÊþˆšÆ ã ²Rr4u«ªÅ½”+ÙAÕªZ2’“’“““““’R‚«Õ6éþã9{ƒØØ;ÕéX~³ûEó}…§‡Œ%«-Å-À˜kmðšÀUlëà‹¶îžÛÈðšÇS°XÀd‚‹!:ú®kéŠüáíVW„à?õ9çÈ‚÷ü¾€{qÑW\Ý2eÄG©èúض $ ºu£ÚÍÿKê¿^.T©±dö ¥g»# ]3Ë]‹ ·Š• ÏŸX²hìZ™æW µqßP€ÅÜèŽOœ”å/!c ŠÝ—P^^Fï !˜ºeV*@Ü+Q„Ü–r£ú¬ Ï•íË‹ciù€¢ê/^oKÅe¬„Q$U ¼º 7yùõºžòŠ¯Í”Š²×Â2÷Lr+ PüÇ ²ArCÜôz²ArCÜ$‰l@ÜAÜArCArCÉ A$7Ä­ƒfß$7A$7AÜÅrCï»›CÞ'ãÜòM´éúukss²É¦E4ø1³Ù¬Þ¾|ƒˆ ññ[¾Ù¤ÑhÉï.ï;•G{Ìdºó½ÿÈÍÅ‹×ýt<¦AK®(dVVKî‰)ÓæÏ{ÿŽ¬bòë³üjwÒp™<ïò~aþ÷£_ܸr)=ÔâæË,ËÕîi[³M7Njã¦0/5c÷¸k „PhͶý´:‰º*–ü kÒ) ‡Z”‡Ü€à W@p²ªzWøÝóÞ{!Wœ\¡›N½¼OÒ[êUArsG@‰ô]îþke‚Ô™"nz´AfFæÕ«W Té‘e9::šdè.‘šB‹%9))7/Ï£2ÕªU“$鮫"¹)×¼8~üø²eËl6›+™dì™gž #ãÜ ‰mJjÚ'Ÿ,µÚžxˆ‹‹:tè];VErSÞ1ÇdYVE¿âï¥ îp‚,˲âzu‘B–åëå¶ ¸[¦;Ó ·¦óN*s—g:7v92àwòÈ.É A$7AÜAÜArCÉ ™€ ’‚ Hnˆ›Ý.LÜAÜÜYЄіqü³WÆsÃíAaʾõ³ßGcÑÄ…ïÆo_½¥2â‰Ì]óÿµÿ ½ª›ä¦XV¢Râ³Ú  !]?¸–v?ÕµøŠ„Ó’›éjéPýµhIwkÈ=[ÓÖúö\f®#Î=‡wÏ{0o—E±YrrEéŒÓšUX`÷h®€Qõ¸-/ÃnçEà[Ä-¤Â¼‰A€3ïü¦ËúMš©[üæ¹3ÛYhHØûÙô¤´BPì‘ÍG6ïÛ•9!÷ô7?¯[­j‚ê´89Äm9g·¬ÜÞ²Núîß¾0@ $Á…óþò›ÄPÕºõ#c}M’-ãô¯K^Év˜ƒ·ï¤åµ·8®Ð L¹¸ædZó‡&¾®A+c‡>ܵyOÇñË{OZeÛõÝ' ƒã«Ÿ“šNxhêòºþûw¬ýCÜQ•%˜Äó“NÄçGv~nA‘cÏ=%'ßeÅYŸûÕñËq=&®ï2¨ÏO ß´2—‡ƒü³«Oœ´u›²aÀôU¦¤Í{ŸÖJÀ$9éÔ®Æ}ÐgÂœüC³ÿ-G’Üz·×nD©Ž‹Æ7(ïŸéW¸±j¿·6×­ãsvÝ2©Ö}¾f­%'7¦÷pM≜ì,a-ôoòPOVãîÏ;Ïÿux·q~&”Œõ‡LpœþÑjKJ8“S¿i#!äÈ^“ë…[8àõ(dæ'¢;­ IDAT:mZ!sXuƒ¯\hÍG¤´»bÁ­¶˜ÖC{jeô«Ö9Øù×ÙdEäà÷XÏ'Ggÿ½ëü¡ß5&Ÿ”KéL˸âˆj20 ÈWîi½rF[ïêÎTÙ½t3p‰sÛœ_–<ƒ’.°Þ#?œ•Ëm‰î\xJÍžµUª8 h„0„˜—p€37‡›}Ôšê#µR®bK³ÚͲÌ‚bÿ؈Â]x¦‘™ ›» @DE .|âL  lÐ;òòêíõä]µmù—Mz‡Û¬—¦!éA€œÜJrƒ @¸+¶BáÀ…&¶×«±=œöÜs»Þ}æà*Q’Aß¥ï˜ L“àìÙY¥%ÙÏ’3óQ€¶x›ÓOÒê4Eá‚ I9ç“tqXFŽETèÎbÁe+‚Žs!œ……Ú*¾µz8¶iuô£sîkQkàDÒÎ(n ËQgÊC‚iMFû¹„ä,γ“ö¯+´rDûŸ Û·ûwkA¦Ú1¦«ÖwãÄ÷ñçNÙ RÓ÷.Ü8{J¡—Ð !@€ÛµúŽÒ3“…W¬øÐxO/½±Rd´îÌÑ#Üžžøýü¿S ÌÕíeh hEÒ²Sû7ï±Û2³Îÿ”mjʸ `òÑä%¥X-i©7œ=}Öž™êtب9¡ì¦T¢:>>x÷ü!GÍ‘u{Ž >©€ÜtÄ´}_ÎÚò}ŠM1÷OoÜ®±ÐçEÓo_NÞ›ï4†7i=l‚^ƒN+“µº¢‘Vœû5z¦»²æ·Ÿ¶9¥°¦÷êÕœpÏ°E?/šôÕN}\¯)­Úý\¨@¦ÑéP“uõ©W˜¤5 ª£åôÆÝŠÒ@Pœ¼Ò°z•â·¿óŽƒ;=;CÇJzY+;-PoجŸMùj¯\ù¾g:??oÛì—v§a:“$©-+Jƒ%µ5!·Þò¤â&µá—/_^°õx\ëžâ{DZe4úXsAç¶\P8hM ÑØóÁnÈuf%P`ÍçýÀ’%Ô—¿›ü 0G(\0 Ó›AB°‚½PÃœË U›„†€Ó;^iØuíºUôf(È‚¡Ù¬¹Bá M~`Ë…ÿA)Xò’¶ÍÑ©C;›Í¦*">ýôÓ¡¡¡Þ]¸pbbnór þ•×ãú½ªÕ•ïtI!“Ñh‚‚<0øp°æ …ƒÖˆ–<Èô¾ K`/»ŒþÀm€P¬`· hðp‚Õ"ay'X-é[ߟЩyM«Í¡z_Q£FÁƒ_sµ;  úö¥ì¦ü;ä î"Œ%Ûu1Ú À^àr"cj}GXsÝ d 8d d d …Sf»–D†À  áçm §VnÜ¡0~o–5®~Õ(îÙˆ Q¸VD°ä¨Ÿ)»©@²†ˆÜ)òs,Y®|‡!8,ˆŒxbÕeÜ!Ƭy‘!e7wug ®ñô^¯/ÕÑN—¦}S´ ziW±êOÂ)*·›Ð-èžø³g[>q_›îæuŶìY—´¦H)”áhïßKûÎ+6Èžw·Ü”{¿AqBpíN!u; ‚ .š9‚ ¹)Ÿ–Q PæB·ºI– ’‚ Hn‚ Hn‚ ¹!‚ä†L@Ä;ûN=’‚¨0È28$7A$7wô¤ ‚ä† ‚ä† ’‚ ’‚ Hn‚ ¹!‚ ¹!‚ä† ‚ä† ’‚ Hn‚ n7óÑèˆÈpºÈe`wӃףGÍ{¼ˆô†ò’DLK8§ýkç®·€Eáwí+™›ÅÂî’ôQbpñØïZ­Öó¢( ðÖ€$ËN§Ãû•aÿ‰÷V+ N·ß–‹ÜDFF¾8¤‹·¾X W­ZÅïfÅФQCÏ{ïìÔfâ¸1I))žôÆát~µ~}nnîP $®(ÁûkW±Ùôv¡›/7²,×­SÛû›ÌÌÌÐà Î9YùŽï¯",,4,¬èÝç‹%"†¶óµ¶ËÄE?ίë–ç{íÃF. ÌŸÝ^(¶¸\¸áö£Û¤ˆ\è‰ÑÜ!ú6TÏ Ëð×5ü~íMün˜|%—cäêcw¸÷ÓÆ…a-†Ô‰òwx-îú‚€ÖìTn 4j5}²-í¥§ºª ª¡´¤_•üÂu–š¢ 7JèÚ`Ñ^<;B?·÷ö_;¡lìÜïÁúU‚Ïïß±ýHúð‘ B "ÿyÅâÄØ.ƒZÅ©‘yåÌÑÝ?ýr5³PcðmÜú¾{›Ö–ËýxÆBm“NC»5P@ÌJ8ðñç»:Ù4:ðçÍ_ì;›,¼ÚZ¿Jµ†ì«c%£¯žÜóå–ý½Y+ܤïÅï>Ý­m2¼SÃÃ?}µcÿy¯ËM˜B¢Gv­þî²uZ i$t8¡÷‹õäÃúk(Úµ.!·•Të —ÐA± Ü%žÍ”Ôm"7áïM[~Ì,äB`½6];¶¬­áñóÞøÂfÔx¤ˆÛòë=8¹›ßÉù«÷<4ldå@ÿ°â£Ôˆ.í}}úÃEƒ™$3Áœ ®Ä4ìüp·˜o,±´žäAØó«÷xáÁÆúµ.Š·9Ýê#"âšô¼ÿÞ£&?óÒŸÓ¢ÖÕU1Ⱥrbí±ü§{¶p}æé9Ÿn®Ý~PfUTq²¤ÿxåÞácGúÈ×3cxjÏ÷[÷{pÈðè`ƒêÁc›‹ìþh‹è2ü^¥ÞЖÆY+öšô"“]þâ¦À¸‘#h¡´’Š2íìv¨ÞÑ}—ÊM‘Ô{2!ñÐîuª÷«å'GdÞ‹ Ï߈ðÝ{“‡Ïhæ1e~ÚÙ/7Ÿyé©®ªk\MÀŠ £Ú½»¾N„~þø‰½—|Ñؼ}W”q¨žA¼zà»'fü0wÚÀ·í}cXèÓX²ç›ìÓ6|snÐÌ¥€G·o8Ú¡ö Vqˆâ»¹/¾µùä“/½Ú»m’}ùýéÃ4¿ñ­–m+WÚz¡O·æªøüºô½UkÏFuz¸itàÁÛ=öLˇûÑýe,;8Ò/ûò‹e&²uóžC¼wÛ6£ïðN ÿ޻㔹ë+ãìܵYç#˜ûõéÍ$–uùÐË‹wôîDb“´>wÒàRp÷¾¼“¯Mƒû'µa` ¸šN–xgÞ ÙÓ®Œ5¾ÿËo'/™Qoø„…“Ÿ>ûüü±½ù†ußNýôÃk—Š3 R–ýÖdó^ùÐoÕôÇ0íÄWo~þÛ§ž rû÷­£ÑêþXñöè8ÿ±F…î ¾yõ7Ï.™W#ÈG¸·ã[É`ûaýWµ&Lï[3JŽüus^¾íÏ/O²ä¦|½á+Çî3ÍWd1/åâæ?RŸîÙB½‚wóÙ†ïRÂ/Ö¥ÙT ´f_X¿vËãŸðÕ\/»€+'ö­ülÓéÂÀ_$@ àÅ_6ïhÐðÑÑ¥ý®5hBäýBdIJ?ûË«ë.~þÆp›Í!ëü$/z ¼'Ù*æ1WöÄÐÕâºÔ¯ßœÜéÙ "¿ptÏï]àÂk4º¯E}L’UË :NøãÀéx!ä:-;4Ž ÇÂ++7ÿÙ¤fÄÇšVÕ­9_'x“¦{ï6µ¢<–ÖèôÉ'~ØqÀÆN={Fùjÿ²zÓ™BË– {¯$ë×­’{÷LÛ³'£jŒ|éä¥tf ¿¿{? p ÉùÓG; Ö46To>Ý õ€IO;w¶0”I’$yûŠI’Ä2Ïïµ~ÿK‹¾î×0sŽ¬î§_5tÇ)_·}³¯Æ`lvröÖÄ™½""ÚÎ}y$¯vXˆ‚Œ±€¨Ø¸:µJå}eD{åš½M—¶}òSŸ';D2If ™_dÕµë–ØN½úAˆªIÕ}âjÕ0ëý¡À 3~ÙõS|¦…ÉÆæíï‹ô…ÌCËHlU+ôÄ™óùv©iûî±ìÊšÝ÷ï?ÀGˆ,éè÷¿¥W~¨SÙD´N{ ¿_Ý:µ«¦)q… ¦¦´›ëéÐhÖúÊõ[/}yÈWV+(:ÖP­F­jAFïÚŠà¢ÛSsW÷î¿ð§¶ÏÜgxõù¹O¼¾1ÎOQ¥A@|¯*U¯YÇ#ȲV_µz­:QþÅ-g“$9´Jõ¸Ú1jó?ýãzÞûX|ú„@àŠ©ÃY}}pê ª²ª&!¸#oÓÚ߆Î^³ãå'K°v¨¤WM-ËÂ?_· lUëöÏüuņc]¨莙kù½Aý0Dˆ·Ÿ•ÍÙ±±5‹²WnˆNKÚO?ìLε3­Oë÷W 3à¡ŸÖÆ49wìhjf®OÕúÝÛ79òõr¬ß»Iµ`!/ÌúrÓÎî6Tè§k7°oÙà§Þ‰®×¤EÓÚkÞzéÃÍzËÑ·óß|áíÏb4¯:ëé+Oˆ+~0gñקšµlS3V¯±õï©æX(òvÍ_y¤aó6úÌÃßØ’¦Fµ`ʵ4lÒ¨V«QÓÊþæÔ¿¿2iÒ{d›v÷æí[1zöˆ @¨Q^9¶ÖO ¦­ÚsQh ÐkÄËýj¸L’|ŠL"ëeIm™ÎïÙÎkí×0PÁC!$chûÚÝò!$]ŸÝ~>+›œþyCAX÷_§›¨5›JXFðk´BÈÓÌœöäšY/¦äñ?j¾em§Ø7ž–P­;!äM5øóß“7oíW0æ±1g ààëoÌÚ~2§Eë6Q9GÆŸh úvþÜÝ—RÀùñìÓ4¬t½… Ÿøé]꘾2´¿Ç×ürÆ•©Åq¡Á1…I{Þ[ó½˜Vá]GíÛ€“üüŒÅ_@”ŒKç?»rÊØW†?žÛnÒÐ6‘jñ¤è”°„…˜¯¿¹Ì¢°;9V3á ‹Ðj4(ùé½GLÚ»ô•ÍgŠ÷ ³ÿ>âÛlx“¨G»,˜·íßG9“4¦YãzÍ{õ…tKÉjÂ5ü^FíÆ}¡àÅÇn=/šµhUI{õ©áàèÎ…C^XÕ°EûÎ-˜9öû¿25?wå6uýÄó?®Þ²ßdÀ ^p.·ìF€@«÷àÚu=õaÕ3.>rüÅZ¸~ÏM]ûÝö–ã~jTƒqˆê{­õ³ ù¸…VÖ ѧ~ÕP€l“FŠ¨T54ÀäÕ|rkϘ‡„Ê}ßµ‰˜«„Ë‚U©\µz€E©rµØ-$192¦á€ö @'1hqüän•ÝýàêÍú<;èÒÚÓ/dJ/¿™Ô«wŸv « Á²®lßö^O±É^˜ßâ^€Ä¤Ìˆ¦÷»²[×¥,5Šò[~6לsѤÿkž?w9»iŒaãç?õeùß¿UÏTÒÊ[' ýÅ sÀ]F~2qpíkUE9ç‘xôž3Wïž÷dÇ"WiåŸgŒêöFÝŽpä6°àg›^³ºêªÂ_úà“B‡Ap‹oÌ=üý]' F Æ×?´_·ÖQ¦Jƒî}eí¢Œ¼ð—FÕ[üÕ}¦ ÉGöeàGõk”(zʺ¿àú­z,lÕãð_~¼ô…>¬¿mýLwYZëÓw'¼>ÑÉ+i§¦NJзó}-|8s®>Ôý~Ùe[%Sj¶gûÛ:Bcݧv\þÔVß_?î‹ À½Ó2#Ë™ŸöDßî5O<‹×ܾsa œÚ»çÇ”Ž2sl^4§NÿçªÊ™¹BøøV}¾OÃù¯¿Ôé‹ÙÞ×ù¡MóÚw{J еß‹G¿w1§_ŒŸôï"+q]ÇôYÛ{á–½ÓiéùþßúÝ­çú)‹Wp¡³Û Õ›ë-_ì¿ }«‚àºã†Ö® €½{„ÿ}îâýí½2wZükC+3Ø¿ê‹V¿c(n$)»ãä,©Ç^û–½{ëÆ„$'ä骣§²Ø,VáûÃÛý~zG¢%;MçÙ­@c e†R#žž*çÁ÷„¹¿càTŠ2´b-±a «Í„ ÑêÒ¯Z ²Ñº2ÍO¼Ð¥{ïQ3· éRë Cþ|eK[IøFÔ[öÅ|_t"€$)Kžzø´ð5ê²ò\+ƒ+^’sœ:=2` x¯>npÌ7;5é_i/^Q?lºûh‡Òá…w_ëks×\4:Ÿëô±„`èÄW»õ¿»KKw! œgó§ß|§o=«â®ÝhÍ×ë««©9s~¿|áŠ=gÛÜ{¯¿Æ‘k¨¨ƒQÇ42cB(΂ZÝŸù{ä¼ e@üÏ_bÝ!•$ž>qò»/¿“«3ªŒ}f„¯ÎuAêefuðB«½D!¹j뇖µìöÆð'«ôàE/n;0öÓ—besèŸ|QÙOïRUµîeþ©‹÷>ÖÖçµi+?›5„•..y!_ÿèÓº¡¾ª¹üÜÒ¤Õé F£Éžùúô·Î\6¤M]O|+]Ç¿{pd÷o]¹_rÇ–íð»kÏÕï¹oá‚c:­U²ç|w4aL»ªÿ6ØÏÌx£ÛÃÓèñµÛ]ÿÚï® „Ä·-™½ú@JÇûZ™Ñbq (BÒFh5êy2Ì9×Vê^+åíegU>;â|{|u¸®’ÝÙÙT>Ÿ½tó¯¯}õ[ÇH€ü”_¿Ys­y,戸ÚK+÷^J[{fÄÌ)êà¾ÛÂμì‚B_&4…\€%;õԉë?Yz¶ÀÜÿ‰˺5Ïð2BÎÕ³išÈØP̤*u›[ö|»ÞßÙÇÅ2“Ù×ßßèsž3múŒºC?šÑW8`ø·‡Ú÷n\©¬zv‘Ó&_?ÿÒaR­Q㶢à­ÄC3¸]½â hFL˜ÔkÂ{ugö“ÀïŸo°˜*ñ¬Ä³B¬V»ú+¿Óî…âö2õ52.0D4šú@脉‹ŸñÕüï~,#áÄÒç>ýv[-#ðÌËßoÞT4 Ulšèôêûü§ï «¡÷UÓ ×5Pq§üj7À , JÞÙÆ›˜Œn«éüc«„n™³V]ú›%Sg­< Å µ p.tžï²wN.Œƒ¤aŠÃŽfIU•ËG·žw ¤Ù™Ô¡\”íYóæÄE?èƒd½ Ž8hnØRæʵN¦Jã^".ŽùF’UÖÏ›²ýjÕ©¯=jëÂ?"¶ŽõÄþô@Ÿ¦î/]{4¡´F^·! ÙžïYv0Ñ佯鳿övœŠQ 8¶seBVà׺h ïñͯ7ÖêR+\ƒl „R¥7?^:gΜӞ0(3¸çBáˆi ×­ýbX·†î¹-¨Ú6ñ¯£žVZ½$ûÁo«wi«WÑJ–®Ý 0Ä_½”3dæàZ`Ž}û­±oOž–l¿Æ€˜»ZäïsíY?‚ ÑlÐø†[_[þ{‰ßÃëÜ;,&aüôí¨°lܾ³Å3óߟûþ|0oÞûóß™šsêÇýIvD@IcÖc±LñŸ¦>u÷níø5kŽ¥ê™øŸýît*²Ö¨Úé×ÍKR œ×Y¸VŽÍ˜»±ïø§uîtö®Ìn´¾8läkÏ=÷Gý¤ 绯òÜóºv ö1J ™ßY8yÐÐYÝáÇ3/å„/ùºX÷ z‰©poƒè)Æt6iÚÐvj›€’lÔk=açúŒõÚGã“ôêþâ§][‡Ží>`Ȥ…]dˆ®Ùôƒ‘ ÑxâtÚK?wÛ‚Ðë©™¿M׶íl¡5öº>‹}ðëgü±v§Ñ / ,Þ¨“%à²ÿŒ Ûg>ûÔ£[Ú˜;•ãšmZ5§²F Þh`ˆ ñéÙ­Ö¬ÍÉub‚ õ½†10úš¿œ8ìG™yòc`µEÏ‹òÕ—Ž<&k zkÚèGOóø“3k5 7›{kD—weÏvt>áó–,Š 1 Dd’ºbñΔª\­C³è)Š@¹zçí[n{ûÙ¦44 îrŒl4êÕ.@ý®}|Þ_W»ÛKf¯F¸Ø…/„òÌ-?¹²pÍBTƒ\«Ýå™?>Û³Ý}ˆì»Þ™Oø”wfƒ|Zvf<Ü­sѶ¸5®åSï ÖNú:óÓõ¨í@tó[ûÒœMŸMêÏ ‚¤Ñ@òšyÂ4<ïñ¾]‹ê+ÂUwÐçóGèŒ CdBôöüq=Ÿœu¶ÏWþL2tî©Ú± §íhó„]Ö:ÓÎíÏ®½q@%÷ÆùWXOó鶃ïtÒ`Á•¾]:«…:EãûáÇËêUòóÎTûHA B!¼:sôà'çTÕIÿèwÆd£N[ºp×66ýÉWÒæ¶ܮɅϧ¿Ðú“9Av7ƲV¯•ÕD!dìȺ¯õÜ(n‡™7X^SÝ…«j•“‘’kqø‡DøèYzÒUð ÕÙ2%s°A#"8 ’S³‚ÃÂõ2·%¦d‡hdÂaINÍÒùúTpÚ R³œQáþB€â´¦¤DFÅšœžçeàyiYù樄­¦ÿÙný¬Î W³tæ€à3Ïœ(!kAâ¥S£çüºú½¡FßEa~Nv344HrU”yNzŠCïäcðÌÛÉJO³Ø’¬  ÒÉê&©WÓüCC4²ì´æeæ)!¡~LˆŒ”TY¯ÉÍLÍ/tˆbãëš`YMèá÷ß¡U+פKNfžÈP¨¤¦¦HF¿ ?sANFn¾UoçƒCB´²B8Ö´lKXhë!–¤ÔL.é#ƒ•ü¬”\[X!5Ó,1†Ür5%744D–$´_x°÷È©Ÿmia,»3S|‚w‰ZÛ¶€àÌÊHžùÔ³Í'Ö£ŽIÇ@Ø“Ò8+¶E­Î¬c‹BB‚™:c „bÍMN/ “ ÖÜŒ\0†ùêÝÓKœÉñ)ŠT¬ã,kL¡¡¾I)ºÀ`³VvO‚´Ä«† 0=SÒÒòÂ"CP¸’ KzBŽäfÂälGT¨¿g*3‚°å¥gX´aš””Ì¢1$dÁ!¡Z„¥ŒaÍËεbHˆ?S¯$®¤¦$˾ÁAf}~gšÐ`Yb „Ó^˜–kñ/Öù9tH9 LLNG­)"4Б—™’g +ÌMaÆ £VÖ¼»äïkÔ"â¾¥£6ààwFµ¯ðu›r•›,ì ”9+É»Óîñîñ “x.¦²g7ÿêù)Ü»i΃PjV±ga§5wçÁ„®mêxJE @±U\ó8KÌì,~Ìê!ç“'™*9©Ž+é©É›S ˆñóKÙ¼ÙÖ¨pEçš IDAT¨G÷¼^Ï-E'\¦KNš.mhQæ„UÏa ¶+.n\ÿ EFwßlà}K»\í>àÒ‡å‰Ï %"¨È–€ת¨^³>#Жy11——K&kÃÃÂd™y¹É;v lw”&/¹#G`Ĉ²½ ž«„[^ò¥[G¾þí² +â‚Œ·Å#håÿFä¼fM–ú K|öžKâ=IŠO–-á ØûzÉÕ\ÕþâëzbQÒûvmSÇë>Ò;ñüP²HRü3zRɃ+©5B 8þܳãbb^~pÐD€_ù%9!!†® eÝÝ•óêª]ãd°„¡ŠvW¢;X¶GJKBÖ_kÖñ1»^dcР¸f—®2÷âFÿê–*/«xD4ãÒÞM,s—}R#Øô¯n©»3³›RÉÄMNŽ<­¢»­pýºvÉ€s¯H¸Ù{÷Ü'྅èŸÏT]‚ Á<Ë1û÷C“&®¾»÷Oÿ‹¹½ï²¹ÁƒRopE†^CÙ7œØ”½ïôÊHθWÇ ðß­ÛFÜu³¼zÊ%Z_õKÏ÷j›PâðAð›Ø{ È m¶èqè¥5œ‹’%Êÿï³#¼ïû¿Ë£Šõ]7à•œ“y³mXáäÆ]ŒÃÜSß?:llJ>¿Î‚Å?”ò³w˜æ‹ˆŒmxw|²]¬™út|6œß»|ČϢðäž^}œk<Ÿ¢èÏë†(þäÈئ9ƒ7ì9ﺖ…ˆéçï;jŠU½rJªgÿÈØË_ž¹y¿ª,€›–Œèöéîó ‹†üÝÁ^ìÈŠ~±'²¨m\ü±?§>?²ÿ~}û=øêìåWót=f¡”=]k»í‰ìðªÑþÌصÞ2Ü"„+Þ/]Û«k÷¾}ûõíÛ§ïƒÎûr§EÈØÅß÷~f%2V¢¢ ±ßW<ùáƃž{ ñÊÉFN=ulÓƒƒ'æaQ[!Ê°¥÷sbĵ*äU\~åœÍ¡€çÓâþ-qàëù³ñ¼ÈÖ‚1¾ê­—F¾üÖgïOþÜl2ïŽL‰Ç帷)Ê>2WèDعlìà©ß£:BòO"ÃÄÍû »šáðÜWëÑž«ç~ì÷àS‡NÿÚ¯÷“ɪ +Ìón²Ü¨ Í-éc_˜?xÒÌ0³tí©³¼ÔDu5#)žyžDã5ñþúö {¿>éãç‹N{av^aQß[=!Ë»¥/™\ºŸTRºøÈն׻­všúua~¶Õ¡¸¸bÏÌÎ¥RXW«å~Š Ø,¹ù6;¸îB@(ÈÎ(´+PêÖm¥Oƒ‹b}zM0ýð7ÃƼÒìá±óæ}8ÞÜš…¿>øð„lDô~R¢à\UcP…ˆsõ×Z½¦¾0¨YQ©ëÜâÊì\Ew{¯Ülñ¢…óæÍ›=}üɯ½°x7(ö‚Ìk‰XW÷ KN~¡ÝÓ8!‘ ‚5JpµÆ>²`ëG‚±ÄýÒª‰Š›ëhKÀ짞µ €—ò//k6:sSÇ<=—¨5ZD õÔÎv5·GŸ&iùP<§õ|ö®¸©‡XÊ‹Â:€¶‚Üì<[éYzÂMÉSHÇå g†øJP2Ÿ…ðZÁŠ®éƒ(yÅRE$¿É¥b!2<±û#^w@Ïš¾àLŸQóå™{çÎ{3ØG¾t`Ûì«mÆÿcï¹¢¸šŸ·»×áŽÞÁŽb/¨ˆŠ¨¨Ø{ï-ö^bA»±wc%{ï]°7 ŠôÞáúíÎï;Ž£“_ü¾$ó‡»oß¾7óvÞ¼©ŽÆ ;ºmÿÜ5Ë+˜ÁÛ‡çw8›£†:þ½Gõô—ð‰"=fóšUáéèÕõ; >ƒe)õÔÑ“g¬>´Ï©_‹O—7ëùÝШâË¿ðû€Â¥Ï…ß>±ýÈe…<šÿnˆ“˜AuÖñ½[¯>ÿL‹l™Ô¬–|:4`mdÿf”nå ,ņ•ñ6Œ±ªм¾ÌÙÒäsŸ IøãÛ_‘ë b£ÀI#zä]^;ÿ®jòy2>ŠÜß1>¬ÂT?í¾“YænúúLðÎHïö¶F ´êŒ¹“+[äiÑ›V¯ŠÈß¾ªdÉ­0´“WSë ÃÚ;9S€•Ft¨:ûu4k¢áÔå&ؾ142•æ[ô7ůŽ+¡øD~bã‚s?ÙÖô›5u˜DÅ9Õð²RjHn®˜pRÔväΔ> IÿôtæÝñyºFmúèÓZ HŠØ²eçû”|¡eÅ‘'Ôw³ Ê䉳~ìÜwÔ³Kû?&ËXeMðŒÐ\õ„Aý‡ï8ì/S<ÛÑ!óŸ„NõfÎg­T›Õô¯ ’˼‚lm˜õs^Ms‡—̯ô_Qƒý¥À!¢fnGß}O¢¹”aÝšŒZq*=+;òBpz¾o<ËÎN];¢Çàù;quŸfo>JHHŒ{t¨C—a 9øúØÌC‚ã““cž_êѦiçI¿"â›+ÇNÜ c ÙÙã8ŽÓ)ä –ÕÊå ñÝÝ-Ýçl3‡šŒ ]üfí¸”˜”ôæÁU_¿+ïµÜÛÝM¼:‡†}ŠýðbÒÐ.~]†'ekóS?´mÚê×ñ‰ ñ»fö¬Ö¸OTÆ>ØããÓ#4"&)ñ㊡m‡¯>…ˆ[ftš³÷jRRRäÕM=[½÷Átê)ïoµì5YˆšÈ®m›ŒYz45#33úq7_Ÿw‰rŽãŒ-Ïm;ï×Æm _…®íÞdÓ•ò¸çmº {›˜påç9£W\B”/4jÉž¸¤¤ˆ‡7||Î}DŒÙV©V«gCâ“4ºÂn•‘7š5·xûû˜Ä<…ÆHMÜé¶~½ED%&|Z<¸óð཈ñ½{=üœ‰"~îîÕ*4&ÿéîß­¾ŽˆOŽM¯íÝùƓȬì¬c3ºvµ7Oé8gÏ•ÄÄÄû»4ðò=z·ÈÜ?>ÞÓaÔÂŒÜüÌÌ̤ϯ†uÜw/#oüÔ|à.Dõ²q½Æ/Þ›˜þø–_ÿ{ DÄû»z4öz/2&!11¸Wóà#ϵj«Ó©5,‹ˆ®ÿvìÖkº#æßïÐ,àjè«øÏog ð¼à4bTßÖ>;.ÞKJJzsyWËÖ?§©Pß«cóA37Æ¥e&F<êزéá]Âñ–^ÝÞ|ˆUsìÉU“ÛôœùrT‡fK/'¡6<зÉÄUÇÓ2²Ò#ïwòõLVE<:ÔÂgl²<_Ça»‡¯‡#¢J¡Ðp¨R(´ˆ{¾‰O§OI*DÄÜðmÛ¼Ob¯¬5dí…Ä„ø„¸O³Gõ}“û¤M3ß#Oã“®íî8c7"»iÑÀVA£< OÉR]Ü<¸ã”³øþõÖ*n‹]OLLŠsµCKß7‰¹¨Íž5(pÄœqII/ï hVkº7˜x¬aËî1™øòðàßǤdçdï™4nëDJËétµŽEĘ;g_ Õ°hºÿ[ðW«Š €âÍc…ÀÓÎÊ ZÉà^ÞÖ²ª­Ú;ñD­›Ô•Élƒj['e$j8Ž‹MÈe²kÒÿÂé=NR¸|ø~»¡ƒííÜŽlå®×ýÔjÛ«»OmRx˜"„ÐB±ˆ¢±XD•¢¹'Y±Qa*Ëï†:ÚÛ×ònÞÔ^x/äÖŽ×]üÚ5¬]ÙµZýiþuòµ@¥Ç„éšôèSßÙÞѹϔ… Köü®ý•ûM®n+"´lÔœaOëR„¦Œèèmog_µÍ„ÕÔ:®le2‘ éßÚÖÒ²B-77~jžüK š`1?+:YÅ$mG,ß1;07&êNl^Ÿý±wwoRÁêúñS@3f2Ûö-ê99Øóh}ÒRDDaU¿c‡v¹ÉŸØ«Wï^£&Îø6ž0NNßlI©Ò3•Þ•eq Ÿäà–…YÅ:Nx½È ÉôdK¾èù‘¯I§ùR±Á­_PEÆ{”Ÿ™ÎÙV7$´©àå¬ÙK¥TdÚYÒÿ Eb¡˜! ‹Í—|>³bè%=~8‘ƒµJžœ¡2ã1”þü`[͹²uo4#F^E™”Tšê& 4ڜإÞöG.[>n]>1·®¾|Ósm6htk'÷eE~•šÀÍ—ðh^‘39"XVj4gåŽYZUZZzøÓnjÛô빆º«½û¯¬Ø¥Q ×ÌtNuÏ~qaÿ'®\«Ós›¥)69–’X3†±QÚ´Lµ”ÇPzMõ¦Ž,[TçαVõÛŸÞ:— §ýôà×±ýí;}¼à¾fËìIg?©ºµ³ækŽ‚Íi_h Ep¦Ö?  ÌÃÅ pá)ZK3 M 'u¬PàÞ½|‘@Êê[ˆ\ett†ˆiFÈ›ziµj%eºaè+ €ÕiDVUUZOd λ&^TzýU–‡^ÁÚc5ª€)ËóÞ0jØ à‰êùX:«fžBuKß×{9@NKg¾MÂiËj´éÚLOÂŽÚ6RÙ£•ŽÕ*Õ2; DÀ˜YIrM—!¡™~¡H©8Ä¿‹úæ°†Fƒª¶sÑ mæ4û§}³A~ÿ·ñSGù5½l+Ñå*8ýÚI‹Î0õêûCøñdœN®Ôð@›§µKį́'J¥~ YÒ €|¾$Wž£žV­ÒªtŒ/¿é¤ƒ+Û»št'á)uœ>NÒ?gÙø“ß1Ò•á´caíþ>É0)BAÞÇ')¼¶bàt®:îþ­£:'åäþU£Ç­º°©'ð%›ÎžªlÚIÌŽâ>rˆ¸÷ofØzyW1'ŒÀÎÑÙ¾Çǽbbâ^nß`Óõ»U3zÀ½w—OÇX»Öj¨™½î^ì½(§­›*|qü”¹„Qê8ä(I‘™ö¾¤T[3 ¯j ÝŽÌT¥>B‘M;ý |Î…P+ÀüÔ û7ÿ> >º#UÅŠ—› gY ¥ÊNO‘kl¤bµ&O«à€:%Ÿ«$cŠ.µ"s"šÏ(3{º>ÊÉä¦&¼ŒÈUƒÄRÌÉÛÀ¿ ’;htœŽ#Xõø.¸Çwùì‡ys¾h]M$pê¿òב MúUo)®FàIu:¥VÀC’•ŸïbÉ'Ígä™ù2«ÊS•ýQ•Ã¿M&ãoàwãè(Ói²U¹EüM·qƒ•‘Sï‡uô.U À«åU›&WE·iãróôm€Œ°ÍçžëÝÆcžÝ¾÷:ú˹í)ªHV$·*.ÊøcW#ˆ:9â^lº·wû ÎUÃî<ÌSèr–þöD&bYKgÌÛçÞh€"pe×n70èîêy™,À«#óûL߉àÚ uìQ¡ ÷É“14ÄÄóµ,‹A„šÍ‚Ô×Ö.ù%rÛoH²®ÑÒÃ%úéá±s¶€@fïU¿2­–‹m]ª‹Õ[¶_ÐfNÜ}çõ4 KtOõôò”Ñ#_$(ôN¡'÷$)$µê»J%„Ò²…"P¨ÎV!qoo<1uYppæg§jµðèꙤý(Š¹¯ÏÞýØ£Ž‹@jieÿ{ø.‰FJÍų–X$5,äÆ£öïáuü—[¦€jAÕ蛩+ÙP–V†HVÂXY[éÒf2k©DEª/šéûýè¾"©,3GÕeê¼Z"±±ò” ]ûÜ”Y»ÙvkÀ£_¶œ²éî]·b)&kDB_d®x¼ßÏ“+ÍÜOÛ¾}滋ó >n®ÈQõš¿·K j,™:nè€þ¶6ö“5»½ô=X:× ß|fÛv¶ÎÖõú:Yjv˜6+véîÝ-$ŒZ\i~p0zöŠÙ³&tÚccU1`ѼæίbŠá[[H ÆÒÊÊ DjaÅg(caBˆU…†›WÍÛôó:ÃKÂ(‡¦;¶m²ã#ÖëÙè⬠.=¬$T± Þ°@¼eÿºé³Wõ¹w•¹î-‡Œ °…±µŒ"ÅbϨö–«˜u?Œê"§VØTi´jï¯5Eà±dÁí K‡ ½Ã·¬°~ÝâÃ\|âñÊ>Mü'ô`~™Ó¦¥!O,“ixÀɬ,ĆOœgncIiÆÌ[>}úè;Ž®6Õ».æ¢ÑÝ‚ÂH¸È›íoZ¥Â¶jãÕ;¶;‰ Z`f-ƒ¥Ë˜¡÷OìpÚÒÂÃи¡šÃÛǾñÜ-[šÄ÷3"™ÌLh\Cú_Þ¸… lQ¿2eôž±íøËúÄéãñ”Ì©ñºMCàÈþySJl.Ïã&®Úãa'5mee-40EÊÂÂZ,¤@äÛ½ñöá]Û÷[}iìêòyËú÷î'&j¡«Ïê`/Ð~°´6R²°´æÓhëØÐËc_÷n÷ïÚ–ýôꪇNþ +cèa­˜è·zÖ„**׬Ѹ®£NÍŒ:|æ‚1§Á‚ÖdÛ7è4®›„ï²tVßíãÚï5·È“Ó³W¬ЊÍ--´§}±…¥Tjzô¸>s÷Ïê·ßL‘¥è²`k}W)‚tí÷Óf¬Y30t‹[ewW– …6Ö4žÐB&1tÂJ-e¢Â“#"òîÔ®e1›5ZÄüJXþÕ–)_ž 4Kˆ§V©X–ÕÛ’TJ•þ'«Q«Ô–cQ«V) •Ú`I‘§~~•¦Óª1dý°>+néÛ¨4Ú²4ëDZ:­²¨X‘Õi …J­ÕÍOyö^¡Rk9Ì»°¸i—ÑirÔ©åOŸ}СN¥Ñ©Ó#[t’¢2LD­R*J­ŽCäXŽåµµB¡dY­Z«c ‡Äq¬N§T©9Žã8Ve˜5r§V«t¦-Ñ`#àt%"€·n˜Û8äX•R©P(4Zõq¬V©P(UjDäXY­R©æX®ôÝjÕj=t,gìÕª …VÇ!¢V¥TiXDT=ÙÓ2°Wb>§˜ÕªÕþ‡J­ÕžÓ©•* "&|ŒÈÌ“«TjDÜ4¨ñÙ§±hb(dYSü«´,W@R­EŽCdUJ…B©FDN§U*•:–ÕiU­ÎôíX”ÆÊØkÓ~ØÇ%"jÔ*…R©ãôXDÔiÔ …B­Ñ±¬J¥Òéôs`U*¥FËrr:B¡Ôêii’’-˜D!ÕS«ôTã´j•R©b9ŽÕjT-gjà)À¹J©+”ˆhX투V£T(J•Þ¬V8l…B­Õéé¢Ñ¨TjÇqˆœN«ViYîÕ+ܱ“åt&‹–CV÷á凘‚ƒË„,èãÍ „Ó|Áû„ðøü‚È#†/`Ld£´OWÇ,º>nâH™&vË¥ôé;k"ÍÐe„ë¥-–2Šæ‰D¼‚ Ú÷3GÍé8vJujß·AӬĠËÍÞ0{¨uÐø5íž_ÞåéßÛN`p-ç „Æ½‚"i†Ïð ~&¤0Z ‘Š¦”Þ­‘ðù|CŒ8_,ÈðÍ€D¢/Q Phô‹£ôqÙ#1F§dJ((%ªX¯dø|ÆÄyUï»L1|c8ãÓ!£Mºpüæž½¿vµÙQBŒJ}C¹šÇ§ Âci¾€F9³þ`”Ëø®Ír>\>•Ýðw;}ŠC)? B†”8 ŠP_ 4¤µ#4#¤iŸÆ·BšÇ‡â‘Ô oã;÷ìNW¤ /àõ)Hbø"žÉ‚P|>¿À¶@|AýCñDíIÁ .|E¨fø 4ÏèQÁ0ü¢1þÆ8/¾ÐPÏçL‡2<£˜¡oo6 "P„P ߘo€fxBQÀê¡E"‘É\tg^s6J2nxܘçoÔöv³@¡€„ áñ \3iŠ¡(0&'еR½òë?Zð÷ˆŸú«C4 (¡ËOyñ!µnÝÚ¾^I¥W0'Ǽ‹NÎ ¶nUª8YÌ„¼ô¸·83k§êUÝD D—úöÝ' |‰µ‡GUñÒløæ TªÉ”ìlzhÈ;3‡Šµª¹“,_ *²ªOoÃÓò´„Tr¯î !ßt !»È¿Þ¼{÷`Ü8SŸD$œúÓûwi¹*Bó+º×´— ¾)EqÿuŽó³ÓJŒ¦üç«rÿ”|ظ9)+¶ø ¯¸‡x©T Ͻö E‚Õ¿n5|-– c©‹VAûêñÉdS4KéÅjM« íå÷_Yj–¢?´–Ê®çù¿Àn S–òåµüÏ€¿:fŠèÃU‹®¾®^r`É™¢ÚÀ ±ÅÇèþQ>`zƒEÕø¤¿?¹þ±*Ñúdú·q_WUZaRÔ¢ÃýŠÔ±Ás5ƸŽ+âÈEª ÅÑW¼²`=ÐÉïÈŸEÜ‘Ha½vNëð¿¤,Lÿ#9ï_Ënô*üüO^u=†.½ñâÐàº=6cÑ\4~þÅšaw¥òŸy6ò ûœG ÝX[·ûVŠ¢TñáQéF¡JöVø“ð\ˆ<öÍ»èLBJ2¬¢qçá¿eñ5,C\ð!äò†îÐ{ĉK†!R ^3µMÏïC‹…bcÉ n0 Ô…ã›Ô¯1ßÛ%ãšw™}Ÿ¢HÉ‘#ûŠÍƒŠ¼ûÉ¥^çÄ,]A¨8!õpG¯Q˯PAuΛ×ïÙ²¹É⯱è} „útgSE¿åE”.ىᨛù*C®6JÆ„PQ·v{õœŸ‡ÿ™#Õ¿þZvc¤»¾ïìÈýgö}ïOñ¤¶ÆÚNÄd76x vZ}Du¡?$cmmÃgC,#!ˆX©Õ„‡‡FÀ•Ÿ–ì¿ø ¸ “C®˜Ç„~+4)U ƒ† «‚ߌ…‚´[EöüW ŽÃšÙW´Yñàh}]Dùû²‹5 IDAT$–6¢b³6È+^ÈŸ´âìÁ…MŠ½KáŒÑð€ÄXTàâ¯÷\ýqpE¡ØÒÊœ†´&(È+Æ D4 ™ofkcÅçóŒiS8ÄÆÃÙ<ÝHêÓù öÑEg]BfÁâQÎPž]4å"Ð|‰µ­!©—w8SÉ`ÿ‚y‰Ù:“ +·±Â+zȼZø»—ˆ,‡ÿ´tC8Ýž™ýŽ$²'|•¦ %Kä)‘‹& håãã×®ëŽ3)*{ g½ñÙ„PÉ'W©ïû*.‹¢È‡Sk½ÛÓ!ùâtß­›6k½öØ}–¨;÷Û“ððÀºÇ1!‡§8BÉ“{7«¶àº’"TVì‹)Cºûøú´ï±ïZ‡Qrbs—v­[ùøNþqw6G½9¹~Ó‹„[?}øI‰¬.HP·cF@ûw)ŠBîlêÕlį„¢ÂnìÙ±O+ß®ƒ'‡~ÊBtò´K&ù·òñõÚô[ˆ€"šMÓü;Í9?±g³Q›^ñ |àò#æéÝʧ•ûžû¯¼dÐ\ÙÜ«I`Ï1gn\òhöGQëgtèüPÔ£]½Ç.?q`Å”ömZwì;ñC†š¢Èñ±mÚLßÍ1$GÉI™8 Ó+"šÐ·ÍÜÝQ ÏPV8õýÃïúwòõmØ}Ä•—±E¶í¼ðR8E!9¸n ùD¡¨ŒG&æS¨¹~pu`ëæÞ­»Oyüsÿq«¯cÚÇ®Cç¥eÜè>â}Â'ïFnÄBHð¨¯_ž3²w€Oós7çjLx~qh÷v¾­|:õ{ÿ}’~sHxsgTï V>­ÚtxáY\éQ•õËÊ©müÚvÙ}þR•t²fã€=?-lѶۚ }GçŒëá¿òÆG.íµƒo“Õà;c½ôÑ®¨´| åüæßÀïF½¨‹ïÖ{aZ ûòèøÖ#ö ªçn³áìì윬ŒÏã:{_ÿ˜{lÅÀã!‘ˆš Ótš½ðè툺_v´þª^·óm2eÃéôÌÌì˜'Ýý[Þ‹Îþ|{SÓ~;ó§ è8gÍ¥ŽeµÊ¡w#ÓYD\Ó«Ùþ»/³³³3âŸ-š¿,9?^^íßsvlVvNNö‰5c{-8˜=©OûE›¯)ul)ѱœvï‚.=µïïÚnâI.ûm¿ÖO?§eggE…^´ö¨ñpp¿y;/ffege$-ØòÈÝHDíÏ+†ù|ù1!W®½µkxà„cˆÙ“zúí¸ü$;;'+)bpûw£2÷l=æSvvVFêÏóûVn> 7Ìê4`ñCD ;6Ò»Ëø÷)9*æܲ}¸‚ˆÉáO¿ã¸'–å0e˜w³ÈX­*å´ŽC|‚9O;¶ò=ž““›òâ´o«¶o•ïo¯ï8v?"ª?ðiÓ¡}ð5DÄg?5ë6M±«jÝ–»/>ÎÌÊŽ»½µqóN‘ܓ݃Ư¹Žˆ¯., è4']¡Ö(sB„d(×MnÙ/ø`fN¾Z­ø¡³ÓbäIá­¼;]ÿ˜ž““ýþñE/¿ñjDÌY;oòÙGorrr“ÂÎúÅÉñsÈnÏž•KGw÷kpýå'µ†eU¹<ÈW­´&ûË(mŸF2©¹…UÅÀ¶^§Ÿ~hÚØïvD4hó_¾ÑÔùÃûp@UHˆ¼_ÿúÀ"q¿ÎÍ­-,dnž-ܯ}Lã¼j†ŠÇÒ¡…õ½ZVµ&àìhvûꣴŒ,Ö þa®½\<|½N—ŽtNfFF–›WÛ¤ËRÁŒG€æ „taŠ³/+—‰À\ÊW?xú&#[nߨoðÔÞ4d\¼ô¾u#·ì¬Ì¬\]‹ö·Ÿ¾ j¬šÕ©âd.f€% ›F6o$•š[8x´iVó\xrʇ7Õú ¨,“ɬlƒú6ã±EY?©ÕÐ×ÝNÊçñª6ª”ö5=×p½{ "¡(ŠO`Æð) (y#D.sjÖ ¦¹¹™]ýŽM,àVL¼[ˆ¹˜ðè—‹Í:dBŽçœ9ú¢f}O$R‡6Mk[Ȥ.­ÔЦGdgdòx !ŒDÄgR/ïfVB-ˆúu÷µ”Šù|‘G]Ûôæs”¸È!)4`¯•¿JOÿ¶sÓê°°m¯š50UNRž]9’`¦EÀ6½tÈ–°ƒ}q*ˆ t^½kßé¿­½¶7ì]æï— ok–ž‹×Ïž|*䧣jÖw`u”Ì‘2y\¥ÊÓ¡„ÇÔJæbQr®Z¥VÙIúîybÃ/Ž½ëŸÁdš/ –9fÌÈWóx†§×¦2¶f$5G'lâ`Eç¿}—q2"»Ãòîùw÷]~+¿Szàv¾ˆGéu7[36OÍ•V8À& @Q¼"AU”J•g!•ÚÆJ¬KÈÑ2fâ 1¢F]Û6­!(’!°¬FGIÞ]Ù›K©eüªW†/ øE‰» JÍr"sàßo /g7ÿoˆm¥¼\…Š%b ÒÒ“«U5J]*¦ß8úÌËÇ«2ð-œ¢_ÝøX»nÚ|½ŠU§JW+Ì0)[QņDz¦ÆŽéÃð‹ÍWQúŽéÐ@Õ£õà};{82š–ý§w¯iPPËã{ eMLŠ8B à5yérŠ¡Õ´ÔuÄäy |ÈÈ’^{*;1ýÇͨkoœ¢-ir27³’…š#B R22ª×3¥ŠãSòõmYiZ•îk¹xÙ®nˆ¤‚T©ÌQ«@~t6ëi-ʦ‡àÊÍ+ ù.Í«$µlŽû5*Ý}‘UËU¬–›Ë ó°¤ÊNè:3s»”ø8ÃðXu\® ›ƒ0îåÕðóã³ÇZS K}¼TÎQÆ2;|‘ó›˜Ú¿‚žh: ȹR\<6uØ-Z#4Àÿ„ïM¹ªøK9¦Q³H›WkÓØqÕΣ‰É)ïÞwö]ß&•A"«_Ój÷ŽÃu«¹#jXŸ·qëþšÍ á‚ÑìÙ~àCBòÛûÇ®GdVsÖ²úuF1Z.)éýÛøÐÈݹþVGHî‚þ]wž¾ÿéMDŽ–’Êwä{ëæ^}ñ11>zßÒïF¬¸Àg´˜ÿî]B.¨rw¬Xxþ­Î$}:íâ\)åå‰ÄEÌ›ÛGŸ$ˆù”"î^¿®ï¾|Ÿÿ<ì#Of…`Þ¥·ÏÂ¥›"câ>½þ~X§¡Qú€lÓ4ÃïX¿UuɺÝÇ“RRÞÜ9rì~RÏz.öuG<Öµãú«É@›fUÐjå›÷ÒòPž²wËÖ´<€èÄĺ5í‹ñôrøŸg7`éà(0 0³q²3çÆ-Û鎘#’¹ØKx³æŒÌ{}víÉg„Ó<¾u9,Y `µbÏæèk»§M›6wÝÅ©[6r5wª×óÀÊ!GWÍžz˜{y|â䩇^’¿îs•Ò`éØÔzu«àÞÃÛJ<¼}u°¶gso«Ì9“&n Ñl=°ËI ©…ܽzÔR. ^Ÿ˜#¿}óf²ÀÂÚQ\Üffá ò™ë¡ß¶å_Ù8i„So˜C;–ˆEîkfôÚù[†œ%H¸'_v¨éø'Kí•Ã¿Ö2űlaÚâ‚\‰ŒÆ\±Çe7.ÖÕ—/~M'zX6zÄIÅ{äk†÷…Q!b¾"eÏowtˆˆõì·f“v}¹DÌ|upúªãlñ hcø}aˆyq ¡i`p‘§J ­7^+í.gr·HËRÚ•·äM®øMo+—O›ŸÏ"bʵ•­zÌÊÕéË-Sÿ\ø6!šgÏBLÌß¹h1rÚ·SkÖ®ÝL€„¨s“öÿ|PVݳ‚ñÚ½uO¯jÈa±2éж-T¯®ÿ+;öJVÕAÆüo©-´òO±™•«¸ª’ ž>jˉöîb„»[qɘ©|›8”Œ P©þÖìÆèjütŒ7ÄRêT™9:…™Ì\¥®·´‘L¢%ÿ‡¢¢Møªœä˜\^ 7ëÿ üÛÙ ó—¯ ¬¬þæûPYÕçÿ3/µq3á>_@£i´ÄÿR¸)‡ÊìkÈJªÑË¡œÝ@¡ý´³ÿ/–WŽÆ¦S<7p9ü“*GA9”C9”³›r(‡r(g7åPåPåì¦Ê¡ÊÙM9”C9”³›r(‡r(‡rvSåPåì¦Ê¡Ê¡œÝ”C9”C9»)‡r(‡rvSåPåPÎnÊ¡Ê¡œÝ”C9”C9”³›r(‡r(g7åPåPÎnÊ¡Ê¡þmìƘ¹î÷2–bÑæÅ1þÔ_4ÞBï¯(YìOÓѤ'c_%z,~AÿXÑW—5ŒÒÇWäIÀ"óú£ˆþ&)aÿ,ÑñwGûu«âkÉY*ö±8^°DýHñ+qˆ&kæÿI/ü;Ñë›óŸ|A655E`f'“|ñ½HŒ%ëŒj !¨ÎNÌâì,iª0¥fA­EŽC ( ¾Tθ"!lJb2 „b„övV„€V•›)çì¬-ŒåÜrÓR´bKk ¿ u.—‘¡PkiF`cgMDäØŒ´T`Ìlm¤@AZ™š–%³·—ð¨Ì”T%Ë™.@"´p²–”†¢Uç%§)œ]ì A}ÑLeNz>mnkÆÏJKUhÙ" ™/u²ä'§¥.ë'GóÅv¶–ßbA4fO.=M»þ«¡ÉJOQ¨u@16vöš°:UZZ&gúQÊÂÚVª„tUgý Bˆ*39““؈´iÙJ0É" b+™ÒR3YäLÑine#Òé©©¶à:¡Ì-l¤b"ª2íhBôAuyiJ°·µ&""›’œÄ·r± ˆ@X<-Saë`ûåoƒ¢Q夤k]]l ôRd¦¨–V¦Tº;H©”´L‹Ð‹'2·³’þH7߆ݘÖ[5Ù^ˆ&uDŸvÞã.ÎíãŠES‚iJ€¹µs• í8ïŠæÆ–º°U-&e½º¹U*,d„Un^¶£ç©Bw[vžVÃAZÆxôü @1eäœÂÿü:ÒÒÁÚÕ3híÓ’ís ÿÎîùƇvMìõ¶ó¦Ÿû×#„dļ^ºdyD|EÓZµNdå6fî’ œU¹‰ÃºwÉ4¯{æÌ~[~ äÎÞ9C~¼ºñÊåîµl ìqW-p“ø ²Za‹©Ççµ+m1a¿úwX2xãùúÖÓ#$dÓ䎓¨·bxÿóéšJ6–úzSÈj¡ÁðÓÓë̘0#OK«²Óâ2ä+U ‘³­Ýn×ÊITA¾ã’²F™¥šÑ´Zp‰çM²'Ô—|"Es¶B¡bׂ)ç_§g%ÇKd2ƶú†ÍkÅYO;wcVÉÝŒèôßG‹§/ÝàmŸ7¶ko¿OÏlW çmŸ½;¬ºìŸ»oÒÖ†¡2ã¢sxì-Y-ôý†ÁU•½:ô§*kè‡ð†ÌYÛ»±ù„îcdnÎbÔŠ\'ê?sÅð€š˜êëÑËsþþ#s:ê·”#ó;^ÔÞ>þ³HHêû[:qh»üôæ!B îÃån#\ztÆñ÷–yÔÃÝ=×O1éóǤ q‹ç¸¶nn*›¾rÊxæ¾Òê2¾Ÿ–´lôÜ€™·ëvòÈW*ò_¿KóæÞÍ*·`!ŸÊËÈVKp„¿èäˆ BѦ³  ˆ½¸ú1ñ¾ÕÃWDë…~ƽãì9!÷ß~½¬[eE&ë;¥ÃëOªw@чʕ5ï :ªh·_ŽVo;Ïéù’õ¿úaP1½EQ¤ Q9@cuÓ2ÛÏ/ìX¼åŒÐÂJž‘êî?déôÙo¯´šyïÇŽÌãUüÛ—î½æÏi+m¸àò³ ÀŸÇùsšs68¨äf–õís§öëhçѲk÷nMê¹K…´éL3´N›Ÿ–ÏŠ°:®ëÜí]R¢š”Øé8z^7ìÅâµG—vaÎfÕ=¿£="bè‘  ë €bJWÝ Çÿ®P¡®ó33Ì eæ¸f‚ÏÔŸtóÜf)¢‹Hk™w6Þ‡_‚¿ÓÞ>qöù§Éíjþ!éY¬ÅÐÙ)‡~ÚweÓ”NÅÆT’î…e|8Žà¥ÄÝømî™sR iNZzƒ®íÄcSû˜{N­D¿MOMŒL•l>´q÷0Ÿè:«Ž-ò#ù/Ž{ ]öÆJÖäo^±ƒù6!Tù™M{ÌÚÐÕÎ/½êRÄσ*Û]1ÍsèæáþpâÇî/?Ÿhï"cƒ._ñ´]Ƴ¯†/ZÛ®ºU¡ˆH(EnjÏék;ɲ¯-n³î·±½ýÚÍ\±ùöœ%Û¶ºÁû æãçü´­aÉ-kW3Mì„%ûœ„{kùÀ%ëÛŸ[oFÎR­¼7 G×ÎQÇþ!©M]GýÇœþìÒ葯YD •ø)Ý£-€‡×"*zõ3@€‚#†G« ­—>R½ª.·Bƒî«7oPï x}rKƒÎßgnœ§ÿhïáñí“ïÑÔuÈ:uv“ʶe¡N•—ç;zÞŽV=¾h7°]!¯a˜°›Ç&EÞÑ«XdzŒšâW×í‹LØ óàiånÞ4à Õ?Mž&Cýa E–fÍœl-á!¢×à%W'½P½lË~1 –­}C "s²}Ê´ã‡2žÄvæìYvb@†Ç7NüôÞ•j oOg€`µšjÝçö}Ü{û­÷s;Ô4Áwæà)i•æv*hÒˆI»NLhW“þƒ*[EV^‡©Kwú>ß=0ÈW¸WýAºèE£†¶Y`_Uk(?÷í08¶oÛ*RÚÆÞ™/Ð~¿d•@›3cx—m‡ã‚Çl¿voJ^k{s¼ví¬{Ç•mx}ó7“n,ÜêTxaóÆMM%~HÍ( ¡ õæƒtï†ÏŽÂO¦Ý…GPòyUƒÚ@®èg£×4sf6î¬ÍÀ¢†ƒV¥3lè&GWýƒ¬JêÜÒA`_»(g^–Š57£ô'ÇØ®:vïÕý# çlÛ0µÇ*›¦;¶­&ˆbk—­Zr, Ÿ ͈ÒZ-0<Ú0¯‚¦:-«ßq%Vn¾ô‹M¡y3šel¿ž·~\ÕMº‚-—E›Š•ë×tE› -Äü/£ÀfÕâž}æÌoig¡pá…k½úµrÀr”¹è+ht½&MÏ?|C©šd3B–dÖÞ62bsF›'Ò©G· [WfÞ-ÿüЬ¢WGÆ !êtšô´ ‘£„ÎŽÖˆ@óE*×µfgã+glÛÔ·£»“9ä¨þ ÷µz²s-süá¶P– ÿß.ÝB®þ4ikL½Íß÷ä DÏ䟊àA£QÅ*U«ZK ºûˆ {­6xÞ—MVc@(gTi–Ú#B±ñôDQ,‡…†,ý™¤^‹m.|ø—íC~½üb`UU¨=xÐ`cò{Çß#FMì·\|§å€¢  $5öI­Ú]€eõÜ®{7¿ùÛV·Íu’Ûù8I……\B§«Ò´Í°žÍJªËW߉ÃN-;6ÈŒ§ç8ǺÔò1¬Ç×÷CUÒ¬aƒ[M[ß½¶³@Ì|:÷ K…§^ àѱ‡í²S²T û \iÐ4"!Ù áƒ|—«Õå± ž>Û%&ÀY³àÐÇ®MºúuOe{3Ãvä:×ð®áê0mòÕŽ© ÷œÙÄjéŽÃû×-¡6¤(rwûÔ4·{ÆKºÏ\Òìü.kºÌ™@­’óÒ߇W”ØPf+úm8=Âà A»atçw•½«™ L>>NZ¡É;Ÿ»vkSP  oߦÊ_,éy”y;w^oÜñO,ø½v?ë³ýrtSõ§éN@™¼ß §'ÛVwàqyÏ.ž29KÓEw_ó‘“÷\}ÒÚº‚²ZS_[º°öèÿšß !€½ï?´‹«““½µä]t<´‰ŠÝ¥~eŽ¶p«]§N:u*:H­ÍÍŠû š)á¥ñŽ.ýiš …Š¸§ ÈKxǸš (¹ÕY³ú·ßø €"„ˆˆ­ƒ‹V£B€ãŠ(R ^[£÷T»„ —Ÿ|à ¦'Oy¶eçãþ­ê«õ›@½Þ]©„‡»öžn=q4[ÅÖïùt@ßù?F˜#ž¥¨?ß"ëSTŽ,ÀÇÓÉÑÑ\ö2ϧ©2¤óÔÁU.Ú,Š ªYÅðaBm*6¼öàá£ÇO#žíªòÎÚ„NŒ IDATÜ·Kà½4é;Om[ü]õ Ž]"!äƆñ#7\×–á -ìP¥` ¥l»„’ºkê1ùÜï:Ø×öQ+s䂃: È}i“&Ti§FDš/à „|ùä•Ëâ/ Ê%E?õ6 ¶¹Ç_ºû)‘ ixxlmëÙÞ¿wïþýû÷ï‡]{{[L®a·äýG&ɈU+¯ïø1BÎ31Óýaz©rãtb[ŸúNŽtNø§MQe±¦ª^}Ÿ=pu_#¿.´ûûÂßHw„Э]¯^a׫ÕË—Ü*VN½öKH»ql÷EßIã¿›=öu§¶ÊÏn†NZ³ßÇ 8Ž3ƒÚ Tû¶®Ïê6¸OËŠF÷)ã}Ô7¦h•(mé²íÓF´¶P¥ïÚôS@ïIVÀi´9Ó§-ñót>¾k[“^+¬øÄ m -GhÙutçÔ­£sÓϘøúyÄŠýóµ o¸b~_œÁå$5×­Ÿ3`Ò°ãµë¹9Z+ÒÝ{ÞyÉÞöšì8Ãxµ'µO¹ír¿©‹§w# ýôüE¯/¬WNÉ://ÁÒ§4·«¿`Põ1+¯zÍ­71GÜ?» í1ôƒù*Ë«¦Y¸¯qEy¥Ä6îÎf‰«6ín I¹kת!9t¤{`MÓ³ªñÁšAè?HÜt«5c°ÀŒ¬…~ ¡œkùnÜ?ÜÎB¬ÿõµ¼ˆþhÙsàꮓÆ~¾©LHHX;ûEhè%ûA‘FóTÛ-±1èn€eÑ«ËÀæ#¦ìòó…J2! _¹ánë^;oµü®µ›~«Ö›{L·¾,úá:¥5`“Ú­ºö÷«j\9Àwh¶p\‹ùs—œ8ºÆ 1ƒ ‡üåe` òût×JKt(´¬ÈfG¯ßò‹;’îX·’æðÑcßê‚&®F\N̬]ýl"—QnÙëþe‡¿ÐÁÁÁß@ºAä R“öÂŒˆGa±=&/Ô¡EFôs•ÐÙÖŒ®V§y5g¡MÅú>VOCî%ëÌGÎ^ÖÊÃŽc5qIy-[5"hÜÐéí‹ÛZ^u\- ;ƒ*#&תuóº<š€.+*Mäçãi.•U±£?~Œq«Û~pÛ£Ç\<[‹/¿à:Ïï"={ãeÃîSækMP¯ ˆœµ»ÏÀŽÕ_½ÿï\«ù¼U[ê:òÔÊìEóúîF-PVRœ™»g})"XºÔÑ¿]^r|fŽ\æ\ë‡?ÕsÓ&Æg6 ð– È*zØXWiZ«"¤ÅÇWòlê$¥'¦†p,Ë€:Ÿiݾ¹ ÄvuNžFÚ¸^U Ýj{AÆg—ú¾žn²ôÄd0hÒ*‡ò òÑŸµùYi¬°…w3!cêé„H›µñõzvïfSqí‘ÕÜ*†ÜzêîëÇåiý}êǪRä¾¾ž|D¾HpùÐ¥ÞKzXð ¶!BˆÉ>M Ãwt°“£àN1êΖºÜ!12âýûOŒEÅás–÷hâ¦Ñ(Ó2ri­Æ8zVÇ9z45K¹™^­ÇÄ6†o’’ùxY_»úÊËÇS¿;ä¥Äƒk/Wb8¡hÒ3sÊ´+—jõÝ“bܽ[U–ò rà\¥abÄC°®UÅž‰KÐxû6ÐA”Y»h9v«[fçäÙVíìï瑽€_Ã^þ:Zì]Ï.))‡°:ý+t:MÕ†n–¤¤Æ@#ÏRR¶õª»ê‘àQ»Vfjª{ãVuœÌ¾LwuNzϪeSO>]H/€m]FH~–\ZgåÜáÕì­BB#¶óW&ÅWªÙÌ£‚9—–’dãÖ¨¡‡ P{4Né\ÉQl”rs"Ÿ»þ°²{MSå_iÒ´îîùÓÉÚ* r5«ºyâÀg^õÊ6ü?Áû ¾©{tãÂÕ›w^„}ÐIì­ÍLN_À°û'ï’Ô¬dñGqF|~ñàÔ¥/^¼xþüEø‡Ï"›Š6æ< $÷ãõ£wÓëÔp¡Jñ ÑÝ¿v",Qê^AfÄaÊÇg§¯>±•äŸ¾ôÒ½¶;Î.åó³£ÇNg¨w}jXËÀàˆ„Uœ9q4WÉÙFXhÏ Û}<¤jUwðýÂí'ãÝ•“¡yuª;x©T){…ú"ðµ¢¢‘_ðùðù3Ô¯ÿ…ÎMWöŸÛ/ÿ‹ð—úÝè £ufÕˆ·jg¯¤èSLC]ŠÎº´}»àvÂó’£/fˆ$1·s8@Ø {œSÓ×ë KuÀÒ”1²Âü&ªÓGv\zœnÚ&;"tÛ øåîtW;pòêS£!uê û6^x«(eâŇWÊÀ ¨S$ëøãŽcbÃ_™=¨ãœ]·°Tí‘I_Æ?‡Ý½û2å ¦„²è@"ßÜþóþoÂß¼y}óì¯C»·?ÿ:‘d¿;·õð=®DæDÐ^?·ç·ëŸMod%„íÛw<5)lﾓªÂ½…Èì÷ôSrZL؆½7õ,¿¬Eb2Á¡åGöo¿žWd!æG]¼vO©áhöôRYÄk%7öÉÕÐH,™r©„k˜éM…#¢I˜2`t¾AÔÃßçÙ! •Â°a†™™ð¯Stü¥‡)B@샽[HŽžkš¼+wžxûx?¼|._`ß±­äÆŸ¿bY¡V«&µ"Ü›Ð;ÒÍ«ú7o@ !YŸ_Þ~öѱvó:²”{‘Â@ŸÑÏïE ªùÖr0â^¥Í‹Ø»ôJ‡O7¯ù8²-Í0<ž‰b  E}~úâC¼Ø¶’_+O>"¢Ëˆ¾zÿ9±®Þ¶EåKWÂ;¶óD Ñܹr9‡³èܾáÕ‹!MZµ¶ð@›yçÆýt%U¿¹_;1Ç!E‘È'7_Fg7ôö„ÅÜåEóù< Àir/ßyÙ¦móN¥iÌZ¶s‚©¸Ëü_{çPŵíñµç]:ØPcEÅ^QÄŽš˜Ø{ öîµwcÔhì%¶˜Xbb‹1‰&X¨ÒE‘&½ŸB9ýœ)ë}8€€˜˜ûÌ{7Þù}Pffï=eÍÞ{íÿZ"‘PXËÊ‹Db4- ˆ(ÕâûtnáŒG(ªäåÓ˜§ifŽÍèaF@«È Nf‡{27£t“|;Uÿsn»ùåäÓŠGYjèÉ« J£­˜UQPÄ£r-¶îÚ·cs'yNÒ#¹õˆnM—òøA¡¡¹ç€‰vƦPš•Æyt0ÏñLqnÞq@O4µ=6èiŽªÛ áåiQLƒÎ=Ú9¼úd ˆ}£{4-.¾ûÅÔ¯/E}¸<¡„b“øƒ@Öó‡ORòÌì\½ô³ …b3‰¨0-6úyQ³N}»}àÔÖ³³Kžgû.Í[J­(È}‘A}0°µÕý{Wó‰ÛÏövÖ”H$äPäYd`Z‘Ò©…瀮-Ks’ãÒ+|†ôÈ^<ˆ—Ú óñ)|œ%²ˆÅ1<‹|)¥»ÞÔšÛŽsg8ØZ‹RîOÈW8ürÓÂמ‡W4ìÞãû¶¾3¬m !ÆØÐà…ÎÕÝ£÷6Àq@Èó‡!Éy¥v.-¼ûw1=W¨‘‡F)³ný‡6µ²šŠß~ú>µ¨ìç6nŒËÛ±f̀˗_ý:t(ØÛ¿w“ªïºwœáÆ7ßuôÛê(0*Ú·uõ¶5ñÃþ ëNÙ»OGkÎl]x=.›ýÁe3Wº˜’ñòÇã[§n=OÉ ¿ðÑÔeaO“¯î_ÿÙþ­ÎGÀãß.ά'€­KëÇötwm¸ÿÄîF¯­ÔD „¢O¯š»é@âËìß¾Þ9fÖærtÅ)“§Ìº|'"ìÚ~¿YKVï»E(Ê°c‚÷Ñ+‰ïlÙ´fÛžC%e´A‘:íãñßÞ‰Ny²pÒØ RŠ‚ûûçÏX,=+ýÄεiEÊú'®À ?pôȶ¥+¥tnÜÍIcæ’·XïIR¦ ùä¢túóØM³Çîÿ-‰PT¯‡§-Ýò09óÖ™/&ÏÙTn€òÂg;Ÿß»|UHB.Ôˆ{(¶v”çgdJËM«ÇœÚølßþ¯"¢+~1fì”K¿…¥D½åxE؃K'~yÁ?#-ñäÎÅó·œã(ê÷#ó6ú!==õÚ©Í“fnUrD[ü|Ҹɗƒ?ò÷›ðqtz…lqnºŠedÒRî-ßáÃÁ¦Fœ¦Y³jvEß#/Î;]pC«óGxzTÆ""jr?ôñº‘…ˆEiýzö‹(EDŒ»¶oüñ TNðîv.Åt !îq Ãö:ÀïT‚iQÌg“|´ò ‡hЪÕ:úõeÕ…Þørí‡ÓW)klbòc†ð‰Ï3-IЭž<äZbѳ+;®øÞ´CØ¥mm|¶#bɯ{{Ž˜^¤AD||õ`¯þ£2exw÷¤Ç˜öL‹9;hÂVS8z`ïïã´ˆhTäLÖcÃÙÔš•È¹uÒ{äÄ|5rªl_¯Þ—â‹5y£†ºPQ3bÌö9ãn?GWÇjÑ•¯û¸ÇºßËJîéë;YeÚIšñ8¹5¹Ó†{ÇåU†E9ºrìÇyÒÔû^½£tµVªpǵ—o6ØÇgȨ5;F>3¡–g†=̨ ³òó¡Ñ{~G¶tѸþ[¾Ï@ÄÒìø~6"â¥ãÇmFĤ[ÿ:e³éÂ%ßÞ1àÓs¨Êÿȧ×å="ª “Ç êºñlZͶœÝÕ«oÿ‰“§Lš4q„OŸæ^N#"æü¾ªßÔà br|„ÌP¹óúÁ#_Ê5;×L?ç3""{nË'c×ÔYcÔ©Õ:šCDÌ›èå“«dŠŸßîòánDTøïí1lz¡éb©ì5ð…4oáС‘™%Xž=kþœU‹—=É*£eÙ£‡øÄHU³Ç^¶û‡ˆ¨ÿlá˜Ùë¿ÃüºúLÌ—hMш>&õ•Ö@#bò¥>=ËérÆõ황5=¡ÒظdDv…W»ÐlÓÕW=z˜`Düiï¶+MÕ~vïØ…'±üù7>C—kß¼4¬ž…C‹›†oha:¾¼[Ï¡Õê2 ×æ–T弄¸Á.NÄ\$jü€™Èܨ5€•Óä_âû°KïÑ}ìÕ£EkÓ²Œ=7¶ó!ƒšG&° 6·a ?Ó[ÌŒåçfE ÍI‡f£s”v…%}>2õZuîk.‰€¸d…³‹‹¥ @—„§ƒ„BCøC™¼ÑíÝ;CŽÐšMAÞ3ÕdÁ¬µ§9 ˆ¬¬ì­ÞÑhæÚ©±EŠ6^÷×u¾°œóȽ/Þ?zBŸÃGÔ±½›2;4_ª»qö‹ß( •™£KÏîÊéíûô‘TölªTÕ„%SVî;¯,/#åîo¿ìß´àT»Ï[oam›¹ÒÁ\s ±®´PãÙ(»Ovß|ï„jêÁ¬„ÛCGàj†‘vlÜÑ$‹X[‚^cЪµ«vžf`éàìâlóÚdZ;µÙu`—9ÒFuÉå¯ö¯Ûwõ̦ÉÕíµµ¦v,˜UÁ*D‡Y€ÑÙ6$@óV˜«¬3s*4³àX`Y¶º–¡±…®Mݬ,Á²K's}|©Ù´A¶AIeíÚƒõ ½“rä ÝÒÕVCz91_±lóV^À¬“SÃ8y20+GÞ•JˆÍ­j´‰#’¦c?ì¶hì¨6=M=¬CÇöÔäåS?Ÿ7úR¯‰ã?êêé)}PTi…þê®´[,Re¾<Ÿ‘8Y@ðÏ«éÙ^¼Nž1$øçø›þßá‡D Pu'𱆗+# Ç®Ù?`jNöËä_~<¸çDó»W6UúIjøªÿ]E V,u¬V·Ôv†× Ü]5éOÒÙwØ„– dÆ\±•®‚«a0Ã?ñÏUP7@*%ÕaÕC†Èi´Œƒ½À~Ï?ådæ¦Ä…ì]û©Ãàõû&Ûˆ, 3ÉYÌ?Áµ™QZ•]jy‡Y–J`fi×Ò³ÏRÏ>K—¥Oï—T¸Xw{×…ŒÖWN¯—HÌSïœÞ˜À@%K|ï§Ð«nŸ rd WÏ2ªk‚&Íb½­*Š¹Ø4^¿mûÐ «âgOv&%àä›æ¯»ó¼w'w k«#»²Hj9w*GÀÅŸZk ˆÀjô-FNºxíi!û¸ÙÀÙZ6xx.yd¯Ï©£5!‚ê»G‘·’±S7žð™–•›špñÀ¹}ßooê=qËÅ~9yÙ)×/|y°ÂþǡÕg”ïàÆ.2KlÑ@Y¯'þŸjwwhÖ ²³aÅ xOy—s7 2Qz•Š†7®u©þ‰)»y+Ú¦¡{7oßGO;½ UKZ5¡â#2@’-‘À¨Sk ¬Éëõ“Ô5 g“fÍÅtia±ŽP'dæ liïèä™j*>ýI¤V‡Ð¹…­\.Óê€$É‘éMõÎz«l1ÛË¢8%ê÷ùî-ZŸ8ïÔž…)·Úµt±Ô Ì]=<<<<<(C…•XȽî$B¹½}êÆS÷ª¥è´Fmd(+3ñË,y·8Ø5°4ÆFëÓ[×bîÌÖwm §<<;þa®”˜[››©R“9PË¥%%Êú–X“êÐuò¢šŠ+ãÆÎPT¨±éÖµ­µ~ýn‘¥™HxíL{Z¯Ñ˜z«æÓ·iqnReÒ¶Å&Ì=œ,ܺhTW~)ômçhoßÖ,÷§ Ë'vm P” 7# OJ œx…5>œéé1hU:#S=ùÏ©²~»ãÖ´Eï¡ãN]ÝW¦Ræܽu×ÊŽkßá{¿>Õ 31EÆëg—™ m=<<<<ܬ@ËI„Už1eKå2U‘ ßÜÁ±²oopv†víÞË®Í;îÝ¡µc{R’§›ÙÊ5Z ÙBy³µ®J lÐX qóàwW,<Û| Í|ÊöŸ8І4™1ÝoÛ‚UCPšmÛÌž­` Àí/Wülç÷ý ¯7ÝÆHç¤<ô›1Ó$d¦,]öÜ¿ivÿ‹gôîÝ¥àI´¦Éˆ¡-X«q6ß-™¾ º‰Yi)cknå&,íqø’ÅË<›XQB™DÀuýæ~viö’Ió‚Û9 âã?Üx´—GÛùùëçy^Å£oý†­ø óžÇƤJß,ÑãòRžUô R¥g1?õÉ]ÿß#§T‹ãÊó3‚ïÝ ’[–Þå“}ˆÈ1ŒA_|?0â *"¼|F¥êéò˜Ð€;wRòJ‘e9D|™qÇÿ~–LùôeYÍJh ^†DDkiäŒêБå:‘ÑF†?ÈWèj«ôXD,Ìxø òaq…9–ãQU|ÿÎÝû‰Y2DäX¥YIwýƒÂc•4"¢®¢( ìyMÅbµÊQ›p?($"³XYuîåÓÿ{/å4rƸ¨Ð¨øQ-M4`znå¡lö‹¨¨g%ˆX^ð$æY®éôJiJhLº©Ã~¿(+«X6uÀÆïòk–_œñ"(0(000000(äAz¾ÂtVMÑ“˜4†CNWt/(<U¥…÷»[`Àä'’d¦3ä¤<ŒLȯs_3Âœ: ‘UG‡ª Œ¶¼0 âEõ•I‰ô÷¿û8­¸ÚPø"úAd"ƒˆˆO£Bc’ŽCZœ£`ž? õ-1}Wg†Fkõ,"Wš—UªÉ|ö4» •yCc3XDdµqÁþwîÆúILf"Þ?µÞ磅¥ Ö£V¯¯x®þ¾zZ^—þVjŸëg¿^(Ö»±q0ÇqU1ùÿð´5Ov}׌ÍCД>ⵆÔ:-ß4wÂö3÷±4#j@ç¾AÊ?¹þ\6rö‰zÓžq¿»•T\ÏåzÃî çäþbõÞæOºåÕv½tƬÏ*þºÌü½ôL½c‰¦i=›"áêÚë¥gö,ÿµE;„花34I.ätm†Ìø|éDá;êS""a¿\8xáf˜HDÌš{Ù¹ÊÁRL(’~ÿÌÆSw„1J\Wì<Ü·1eZµú ¢8iÍÒåÚ&#¾Ú³²Ù;N*C‹ÒYá«?ÿªDGh;jùÞ¹?¨_gºW „„Eýoï—µTH³ÿl…'%$VXRÔÛ=ƈ`eÇ¿—ƒ©w®¯|F£P$¦È_qŽ0:»IDAT?9šf±Hôv"O¬ÊBþð¥©ô¥34Í!˜êV¼‘eh–CP$ HÕ”ôß{§ë­t•–ªu’Uí¯_¹‰XW‡ZG¯ZïaˆM3•ýC‘aÕ|Bch†#”@$ü‘HŒF()y'þôÖþ‡Ûš¯þB!4lø^~êþ3P ²L±´ÔÞÉÙLð6šAäXºXªtus$÷'¡:¢&ü…à 5DƯªÇ²´¼Xjá쪕–ظ5d•R gílgN^-àd2©Mg±HP§D ¬º@ªuqv4I"‘N^$•ØÛëËJ%öŽ–"!ys¥¬@ÜÀU"¤Þ¥Âï%‚æyÿ/#õ./Vÿ÷Æ$óXí °æ´Æ_‘€¶pþ‚•©2Ƥ?|u žˆF–î;q½*ûu‹ƒ×µu5OR³„×ʪs(Bˆ&쫧×l¾¡Õ„—n†¥V¯¿@]yþâI“nç”.š8ó‘îœ[»úH ©\/dÒ*w¬]\ ªÊzöªb„(~Ÿä·Nª¤«¶õú©ÓÒS·Í›åŸZHHíoIuí!yOï.=v»²sô®>9Ÿ ÿ¿Š÷÷2Rïò"äXZ®(gÑ”ëV(J £WKKJ¤2 Càˆª\Q\"­ÐÒ¦W”ciy™ 9Z*+eµ:[wºL.-)‘ªô,T%¨×ªÊJJ¤zm…Zg´vi÷(è´% pF…BÈ•J‹‹¥r#G‘cØR…LÏT¾W¯þa´2i‰¼LEHeTr‚F…¬¤D*Ó1•"rÚ .UÑ)ÊTÀÒºÛ¿FeåäʵÓi4e%Å%åjiøcÔ–—ªŒ´NYTTTZ¡F«ŠŠˆÊÊ/(¯P!`…LjdX+×N­Û5vsêÞÙÃÖ hƒNOsŒA-•J•Z“— z]åZZ–.•ËJJ¤*=]e®­NOQȤRy `»l•/ ËüÙý-Z¡PØ*CC TŠ2%Ëa{ïñ⻇F)!¼àù¿à®»ADb,Ë™>ÿè•kÇíE5…óæoÜvüûö‚è9~;À­9* ËNG/ìrxtmdž‹‰mÝí²óe“Öœ9ÀÉPž;wóÕ öÏÏg¹_?µ¢*P }bë‚Û/ -9e¸tË¡ ’BV,Û&hÖNgl6ëCY™ßÌ^’QóÎܺyÀBŸ4wÁ^ï¶MŠŽÚ¬(ëðã_.ÁâŒéÓü–~9ªUÕ{„È"f,ܧ[éeEýí]7®è2W-ݘ¥³pkó nGNhe+Ì}xnÝ-;/a¸ÑÎ=.2zÂç|É?¾(Ô îœí°vdçàËG~w»as÷Œ™ßç‡'÷ÿ î涃q›`R#W‹€È”e»Žt)øõrX‚]¶N/³`‚×úO|§}{·sIÛ1³½Ìu¥Mî$ÂD$ÚÒ— gŸ¡\A™ùçgN÷­Šþš²]ÛVÇ$—5tä”Ù?{¤‹ N|ëòL5£(*è2Èï‹SõèîÝÊ>%§]/÷FÊ‚äɳV~~9°oCRÝE|lÍÖ —›§wÛˆm·,2qÿ¶é—OØKÞã™qžÿ¬qâ»D'Mí=äS™Ñä?Í2tt|wsÑ iÇM ±"sП³É¿léé»Ô´påáÉ%^ã×êúõ9œƒˆLÒµŽ­»õO4È’{Y¨FDÝãA^=vÿô ј;vWb®šÑkââ«—¿p‡¬jÝdß_ÜDDV“?ÜgR‡?|>Û÷Ó½¦Äî×6¶ô<ƒ˜v¸{ïh9"bfЩ®ÓÎ"r»û×w±,ïÙ@¯á᥈ˆúâ°^CgÊY ¿¼ª³×h©1îðô‹Î"âé“­\mĤ<~T¦1ÔöxÒ—öÏë=`tñ×Ý“}fŸ@,Ÿ;qH\FEaê½yóv˜ˆ½´qÊW÷‹¾oվυðLDÔ=ú¡×ÀQ%Æ'ähúq|B…¡Ö ªÈM}œ”A³&Omò¨ãsåæ­æáù^sZ…ã £ïà]»÷ídóÆŒýdíΣpsý=&1÷DÀY[:X)Ësärç\6÷›èQ²—"ôÝczNÙ.@€žsçYž_«ÒçÆ%Á–vvˆ(ð˜¸zè [{êAÜàÃîM„fÖvæƒ^`æй[×WQÖÑ•–fäÉ>90‰¹Ûõ›'…Ulä‹~Ÿ3 /ûrzÍ5=8Ö²ùèÞB{ª,€£YŽ¡õ ÍN`›udãïùY`uNe/stMQïÜj¤½9@ÃNMô2@Os:µÞ”¥M—A¨áYb5.c]ÍzŒœ@VýPNO@Ö­õ°•3t;׬RÒ¬F–[Ô¬»©¡v¶sI›†„Eš6Š*½Z‰e—®kz÷ѦIë.ÕÁF¡í׊L™®k¾kÃóLÕ™ö5Í«rLËÑ›~nÔiÿ×7Öß>Ï5|ñÌ…ŒŠ¼Ÿo\#ˆˆàÞ»‹P@Jl¬j&\D®L6VUI™„6æC«T´™PPDƱ©­ºŽ`’PB ê¼šÛe9ÚH m*£k;{4–«tT›•K…DbK# @Äoj!Íè)iêw—妤ÀÎmšÍ!Ç‘9U{â¯f°z®ËT|U%¥›é(‘Ђ"zš@ ”(ýÁy¿m?ÍX´|¢gÓ¼¨Ÿe°Uç¢(Óì[í ý¤–¼ªÕˆ5£dšþs²é44ÿðü3Í yå ¢õÀè@,•¸tuüÌ(ƒV¶gÎì}_ߟÙJtEßãë³ÛM/·^e”X‹ euã0Q§f‚+iòJWMé“bÖÅ¢¡«Di¤9ÓË\àÚþ-?ί¾ó±¥üØ8z 8úç³'ì?^ôA#x/…¶M@UšF“¦¶BýQŽ¡ÀÚÆÍÐxÈ·ç–›6rˆ‡õ;z( ªÑUÍuÕ4EB‰QöÄÃÄu.ƒ.Ö"D"aT@„×ê½KFwå#­ßbÖ«²¸VµšSÙ5×㔫è†æBþ5àùÇy¦EV ZrÙ7£SŠKJÂ~?#ÕqÅ_¹`ÍÁ«/3³ ²³2´Œ»[Ïå«SBnDggg‡ŸÛä3iAQ ˆ ûj\Ä2,Ë’¡Ë–•û yœš›¼cÙ×Ç·Ø ÞüôõûyùyÁ§¶‡;!Dd*¥È°Lµ}`YŒe%Gx!õ¡Ú:ŽàýàÔ’ø™±!?í¿þÂÓMâ;iJêÅUÑIYYiOí¿é½p‰­i ËU7a9µ™DV˜\XÞ°u¢ë›~ˆÎÎÊŠ ºÚÛw®œà¸êC9†aÀ\,~–”ZP(§ˆñÒ¾iÅJSï^µJòâD=ÍÉLþæÈmÇÍ‘PË2 Ë}ÐÌíY@xA~^JøÅÓ7^j³_–*ÕÈ0ì«Š1 Ô É@ˆAQxèàѬ Rt€P$ëÎ¥CßÝ2p¦ÈˆQy–MÍëÄáàáù›x§™¡„}û´M NÍÌuï3¶™£y‡Î=FAŠ£ãŸ¥f™²hüÐö8Žé•–ð<¥ÌÂcËÆe íÌQcÀ^=;™äÔz®k÷.Nnmõmó 419«å°Ë&Q¤mÏ!º”è˜ÄtGïéÞâ¹­O¯ÖŽjéÓ³ƒµVЭGwks!§Õ=:õ°Ñ¿œÜgæ5Ó£2À.A$úöoãH""c *„ë·¬ld%qkÛµW;§Èð°äôü>S–ÏÞž`iJöêäc¤©^Ý[uöp/.ÈÈ5:ôöl=hÄ`UR裧IÅjóM–5²‘0F­Ð®UŽ 2:Ú¬iÏ®-Ý›¹gÄEK–žm'FF5îÔË¡z¥ÂÝËÏNùøA̳Fý&¯žæ-"œFchÛ±«G×î6å‰añ)Z›N+VγQ>YF:µn¨¢múöì"SŒZkÖ«g7K‰ jQ4á êOs4¥¹Í«¤ÊI¼þ[äà‘¾æBß¿ðÍ3Í‚O§[ ៞ Šç¿Ï3e’ þ‰ZÙ×w«©%¬›¯•­µ#Ë!bbø/³&‡ÎŽOzÜ|”[}¶ÆÙW[U›fÍÎÔÐÕÕpšRN¿1­-[óg¶úH–eëˆ(ÙúTŽõê$km¬G`Y]Lý2˚Ű¯Ÿ’ã­Ø0yV­}5K—ìÕ!"£Z?Ëw͹¤÷WÈó¾K4ßƺ‘jß Ô›² ªBb"¼–ùÍ”6)#ö—µŸ 44–;wò=ðÙŠf¤FLÎW:+“&ˆc ¹ÅêfMëˆ êfÄ«[Vuº¹IÐj§»­Ý'ÀÚ³±µ¶ÖÌŸöšèum Ö{ª«mŠX³uÕUˆcÈ—jš6r¨Ù(cY¾”slìhum÷©g®wÏ!5ÎÌÃó·òo™›¨(P*ÁÊ (êÿø´²"„€JŘ 5z£@k°tq2m©ÿ(BP¥"VVHQ©ÀÊ((•àëûžwYkYj“$¢–EQ—Ë$¶ŽøGeEãùo47ÿ¯/ÔɱZ¹‰ÿ:ÿæþTÎÃó_lnxxxþ±Pü%àáááÍ onxxxxxsÃÃÃÛÞÜððððð憇‡‡77<<<<¼¹ááááÍ onxxxxxsÃÃÃÛÞÜðððð憇‡‡77<<<<¼¹ááááÍ onxxxxsÃÃÃÛÞÜðððð憇‡‡‡77<<<¼¹ááááÍ onxxxxsÃÃÃÃÛÞÜðððð憇‡‡çïæg¦)Æ*@8IEND®B`‚suricata-3.2.1/doc/userguide/performance/0000755000000000000000000000000013051004444015334 500000000000000suricata-3.2.1/doc/userguide/performance/high-performance-config.rst0000644000000000000000000000133713051004444022473 00000000000000High Performance Configuration ============================== If you have enough RAM, consider the following options in suricata.yaml to off-load as much work from the CPU's as possible: :: detect: profile: custom custom-values: toclient-groups: 200 toserver-groups: 200 sgh-mpm-context: auto inspection-recursion-limit: 3000 Be advised, however, that this may require lots of RAM for even modestly sized rule sets. Also be aware that having additional CPU's available provides a greater performance boost than having more RAM available. That is, it would be better to spend money on CPU's instead of RAM when configuring a system. It may also lead to significantly longer rule loading times. suricata-3.2.1/doc/userguide/performance/rule-profiling.rst0000644000000000000000000000445713051004444020756 00000000000000Rule Profiling ============== :: -------------------------------------------------------------------------- Date: 9/5/2013 -- 14:59:58 -------------------------------------------------------------------------- Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match -------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- -------------- 1 2210021 1 3 12037 4.96 1 1 12037 12037.00 12037.00 0.00 2 2210054 1 1 107479 44.26 12 0 35805 8956.58 0.00 8956.58 3 2210053 1 1 4513 1.86 1 0 4513 4513.00 0.00 4513.00 4 2210023 1 1 3077 1.27 1 0 3077 3077.00 0.00 3077.00 5 2210008 1 1 3028 1.25 1 0 3028 3028.00 0.00 3028.00 6 2210009 1 1 2945 1.21 1 0 2945 2945.00 0.00 2945.00 7 2210055 1 1 2945 1.21 1 0 2945 2945.00 0.00 2945.00 8 2210007 1 1 2871 1.18 1 0 2871 2871.00 0.00 2871.00 9 2210005 1 1 2871 1.18 1 0 2871 2871.00 0.00 2871.00 10 2210024 1 1 2846 1.17 1 0 2846 2846.00 0.00 2846.00 The meaning of the individual fields: * Ticks -- total ticks spent on this rule, so a sum of all inspections * % -- share of this single sig in the total cost of inspection * Checks -- number of times a signature was inspected * Matches -- number of times it matched. This may not have resulted in an alert due to suppression and thresholding. * Max ticks -- single most expensive inspection * Avg ticks -- per inspection average, so "ticks" / "checks". * Avg match -- avg ticks spent resulting in match * Avg No Match -- avg ticks spent resulting in no match. The "ticks" are CPU clock ticks: http://en.wikipedia.org/wiki/CPU_time suricata-3.2.1/doc/userguide/performance/statistics.rst0000644000000000000000000001424513051004444020206 00000000000000Statistics ========== The stats.log produces statistics records on a fixed interval, by default every 8 seconds. stats.log file -------------- :: ------------------------------------------------------------------- Counter | TM Name | Value ------------------------------------------------------------------- flow_mgr.closed_pruned | FlowManagerThread | 154033 flow_mgr.new_pruned | FlowManagerThread | 67800 flow_mgr.est_pruned | FlowManagerThread | 100921 flow.memuse | FlowManagerThread | 6557568 flow.spare | FlowManagerThread | 10002 flow.emerg_mode_entered | FlowManagerThread | 0 flow.emerg_mode_over | FlowManagerThread | 0 decoder.pkts | RxPcapem21 | 450001754 decoder.bytes | RxPcapem21 | 409520714250 decoder.ipv4 | RxPcapem21 | 449584047 decoder.ipv6 | RxPcapem21 | 9212 decoder.ethernet | RxPcapem21 | 450001754 decoder.raw | RxPcapem21 | 0 decoder.sll | RxPcapem21 | 0 decoder.tcp | RxPcapem21 | 448124337 decoder.udp | RxPcapem21 | 542040 decoder.sctp | RxPcapem21 | 0 decoder.icmpv4 | RxPcapem21 | 82292 decoder.icmpv6 | RxPcapem21 | 9164 decoder.ppp | RxPcapem21 | 0 decoder.pppoe | RxPcapem21 | 0 decoder.gre | RxPcapem21 | 0 decoder.vlan | RxPcapem21 | 0 decoder.avg_pkt_size | RxPcapem21 | 910 decoder.max_pkt_size | RxPcapem21 | 1514 defrag.ipv4.fragments | RxPcapem21 | 4 defrag.ipv4.reassembled | RxPcapem21 | 1 defrag.ipv4.timeouts | RxPcapem21 | 0 defrag.ipv6.fragments | RxPcapem21 | 0 defrag.ipv6.reassembled | RxPcapem21 | 0 defrag.ipv6.timeouts | RxPcapem21 | 0 tcp.sessions | Detect | 41184 tcp.ssn_memcap_drop | Detect | 0 tcp.pseudo | Detect | 2087 tcp.invalid_checksum | Detect | 8358 tcp.no_flow | Detect | 0 tcp.reused_ssn | Detect | 11 tcp.memuse | Detect | 36175872 tcp.syn | Detect | 85902 tcp.synack | Detect | 83385 tcp.rst | Detect | 84326 tcp.segment_memcap_drop | Detect | 0 tcp.stream_depth_reached | Detect | 109 tcp.reassembly_memuse | Detect | 67755264 tcp.reassembly_gap | Detect | 789 detect.alert | Detect | 14721 Detecting packet loss ~~~~~~~~~~~~~~~~~~~~~ At shut down, Suricata reports the packet loss statistics it gets from pcap, pfring or afpacket :: [18088] 30/5/2012 -- 07:39:18 - (RxPcapem21) Packets 451595939, bytes 410869083410 [18088] 30/5/2012 -- 07:39:18 - (RxPcapem21) Pcap Total:451674222 Recv:451596129 Drop:78093 (0.0%). Usually, this is not the complete story though. These are kernel drop stats, but the NIC may also have dropped packets. Use ethtool to get to those: :: # ethtool -S em2 NIC statistics: rx_packets: 35430208463 tx_packets: 216072 rx_bytes: 32454370137414 tx_bytes: 53624450 rx_broadcast: 17424355 tx_broadcast: 133508 rx_multicast: 5332175 tx_multicast: 82564 rx_errors: 47 tx_errors: 0 tx_dropped: 0 multicast: 5332175 collisions: 0 rx_length_errors: 0 rx_over_errors: 0 rx_crc_errors: 51 rx_frame_errors: 0 rx_no_buffer_count: 0 rx_missed_errors: 0 tx_aborted_errors: 0 tx_carrier_errors: 0 tx_fifo_errors: 0 tx_heartbeat_errors: 0 tx_window_errors: 0 tx_abort_late_coll: 0 tx_deferred_ok: 0 tx_single_coll_ok: 0 tx_multi_coll_ok: 0 tx_timeout_count: 0 tx_restart_queue: 0 rx_long_length_errors: 0 rx_short_length_errors: 0 rx_align_errors: 0 tx_tcp_seg_good: 0 tx_tcp_seg_failed: 0 rx_flow_control_xon: 0 rx_flow_control_xoff: 0 tx_flow_control_xon: 0 tx_flow_control_xoff: 0 rx_long_byte_count: 32454370137414 rx_csum_offload_good: 35270755306 rx_csum_offload_errors: 65076 alloc_rx_buff_failed: 0 tx_smbus: 0 rx_smbus: 0 dropped_smbus: 0 Kernel drops ------------ stats.log contains interesting information in the capture.kernel_packets and capture.kernel_drops. The meaning of them is different following the capture mode. In AF_PACKET mode: * kernel_packets is the number of packets correctly sent to userspace * kernel_drops is the number of packets that have been discarded instead of being sent to userspace In PF_RING mode: * kernel_packets is the total number of packets seen by pf_ring * kernel_drops is the number of packets that have been discarded instead of being sent to userspace In the Suricata stats.log the TCP data gap counter is also an indicator, as it accounts missing data packets in TCP streams: :: tcp.reassembly_gap | Detect | 789 Ideally, this number is 0. Not only pkt loss affects it though, also bad checksums and stream engine running out of memory. Tools to plot graphs -------------------- Some people made nice tools to plot graphs of the statistics file. * `ipython and matplotlib script `_ * `Monitoring with Zabbix or other `_ and `Code on Github `_ suricata-3.2.1/doc/userguide/performance/packet-profiling.rst0000644000000000000000000000301413051004444021242 00000000000000Packet Profiling ================ In this guide will be explained how to enable packet profiling and use it with the most recent code of Suricata on Ubuntu. It is based on the assumption that you have already installed Suricata once from the GIT repository. Packet profiling is convenient in case you would like to know how long packets take to be processed. It is a way to figure out why certain packets are being processed quicker than others, and this way a good tool for developing Suricata. Update Suricata by following the steps from `Installation from Git `_. Start at the end at :: cd suricata/oisf git pull And follow the described next steps. To enable packet profiling, make sure you enter the following during the configuring stage: :: ./configure --enable-profiling Find a folder in which you have pcaps. If you do not have pcaps yet, you can get these with Wireshark. See `Sniffing Packets with Wireshark `_. Go to the directory of your pcaps. For example: :: cd ~/Desktop With the ls command you can see the content of the folder. Choose a folder and a pcap file for example: :: cd ~/Desktop/2011-05-05 Run Suricata with that pcap: :: suricata -c /etc/suricata/suricata.yaml -r log.pcap.(followed by the number/name of your pcap) for example: :: suricata -c /etc/suricata/suricata.yaml -r log.pcap.1304589204 suricata-3.2.1/doc/userguide/performance/ignoring-traffic.rst0000644000000000000000000000243513051004444021242 00000000000000Ignoring Traffic ================ In some cases there are reasons to ignore certain traffic. Maybe a trusted host or network, or a site. This document lists some strategies for ignoring traffic. capture filters (BPF) --------------------- Through BPFs the capture methods pcap, af-packet and pf_ring can be told what to send to Suricata, and what not. For example a simple filter 'tcp' will only send tcp packets. If some hosts and or nets need to be ignored, use something like "not (host IP1 or IP2 or IP3 or net NET/24)". pass rules ---------- Pass rules are Suricata rules that if matching, pass the packet and in case of TCP the rest of the flow. They look like normal rules, except that instead of 'alert' or 'drop' they start with 'pass'. Example: :: pass ip 1.2.3.4 any <> any any (msg:"pass all traffic from/to 1.2.3.4"; sid:1;) A big difference with capture filters is that logs such as http.log are still generated for this traffic. suppress -------- Suppress rules can be used to make sure no alerts are generated for a host. This is not efficient however, as the suppression is only considered post-matching. In other words, Suricata first inspects a rule, and only then will it consider per-host suppressions. Example: :: suppress gen_id 0, sig_id 0, track by_src, ip 1.2.3.4 suricata-3.2.1/doc/userguide/performance/hyperscan.rst0000644000000000000000000000604713051004444020011 00000000000000Hyperscan ========= Introduction ~~~~~~~~~~~~ "Hyperscan is a high-performance multiple regex matching library." https://01.org/hyperscan In Suricata it can be used to perform multi pattern matching (mpm). Support was implemented by Justin Viiret and Jim Xu from Intel: https://github.com/inliniac/suricata/pull/1965, https://redmine.openinfosecfoundation.org/issues/1704 Compilation ~~~~~~~~~~~ It's possible to pass --with-libhs-includes=/usr/local/include/hs/ --with-libhs-libraries=/usr/local/lib/, although by default this shouldn't be necessary. Suricata should pick up Hyperscan's pkg-config file automagically. When Suricata's compilation succeeded, you should have: :: suricata --build-info|grep Hyperscan Hyperscan support: yes Using Hyperscan ~~~~~~~~~~~~~~~ To use the hyperscan support edit your suricata.yaml. Change the mpm-algo and spm-algo values to 'hs'. Alternatively, use this commandline option: --set mpm-algo=hs --set spm-algo=hs Ubuntu Hyperscan Installation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To use Suricata with Hyperscan support, install dependencies: :: apt-get install cmake ragel libboost headers ---------------- Hyperscan needs the libboost headers from 1.58+. On Ubuntu 15.10 or 16.04+, simply do: :: apt-get install libboost-dev Trusty ------ Trusty has 1.57, so it's too old. We can grab a newer libboost version, but we *don't* install it system wide. It's only the headers we care about during compilation of Hyperscan. :: sudo apt-get python-dev libbz2-dev wget http://downloads.sourceforge.net/project/boost/boost/1.60.0/boost_1_60_0.tar.gz tar xvzf boost_1_60_0.tar.gz cd boost_1_60_0 ./bootstrap.sh --prefix=~/tmp/boost-1.60 ./b2 install Hyperscan --------- We'll install version 4.2.0. :: git clone https://github.com/01org/hyperscan cd hyperscan mkdir build cd build cmake -DBUILD_STATIC_AND_SHARED=1 ../ If you have your own libboost headers, use this cmake line instead: :: cmake -DBUILD_STATIC_AND_SHARED=1 -DBOOST_ROOT=~/tmp/boost-1.60 ../ Finally, make and make install: :: make sudo make install Compilation can take a long time, but it should in the end look something like this: :: Install the project... -- Install configuration: "RELWITHDEBINFO" -- Installing: /usr/local/lib/pkgconfig/libhs.pc -- Up-to-date: /usr/local/include/hs/hs.h -- Up-to-date: /usr/local/include/hs/hs_common.h -- Up-to-date: /usr/local/include/hs/hs_compile.h -- Up-to-date: /usr/local/include/hs/hs_runtime.h -- Installing: /usr/local/lib/libhs_runtime.a -- Installing: /usr/local/lib/libhs_runtime.so.4.2.0 -- Installing: /usr/local/lib/libhs_runtime.so.4.2 -- Installing: /usr/local/lib/libhs_runtime.so -- Installing: /usr/local/lib/libhs.a -- Installing: /usr/local/lib/libhs.so.4.2.0 -- Installing: /usr/local/lib/libhs.so.4.2 -- Installing: /usr/local/lib/libhs.so Note that you may have to add /usr/local/lib to your ld search path :: echo "/usr/local/lib" | sudo tee --append /etc/ld.so.conf.d/usrlocal.conf sudo ldconfig suricata-3.2.1/doc/userguide/performance/index.rst0000644000000000000000000000033213051004444017113 00000000000000Performance =========== .. toctree:: runmodes packet-capture tuning-considerations hyperscan high-performance-config statistics ignoring-traffic packet-profiling rule-profiling tcmalloc suricata-3.2.1/doc/userguide/performance/runmodes.rst0000644000000000000000000000271513051004444017647 00000000000000Runmodes ======== Suricata consists of several 'building blocks' called threads, thread-modules and queues. A thread is like a process that runs on a computer. Suricata is multi-threaded, so multiple threads are active at once. A thread-module is a part of a functionality. One module is for example for decoding a packet, another is the detect-module and another one the output-module. A packet can be processed by more than one thread. The packet will be passed on to the next thread through a queue. Packets will be processed by one thread at a time, but there can be multiple packets being processed at a time by the engine. (see :ref:`suricata-yaml-max-pending-packets`) A thread can have one or more thread-modules. If they have more modules, they can only be active on a a time. The way threads, modules and queues are arranged together is called the Runmode. Different runmodes ~~~~~~~~~~~~~~~~~~ You can choose a runmode out of several predefined runmodes. The command line option --list-runmodes shows all available runmodes. All runmodes have a name: auto, single, autofp. The heaviest task is the detection; a packet will be checked against thousands of signatures. Example of the default runmode: .. image:: runmodes/threading1.png In the pfring mode, every flow follows its own fixed route in the runmode. .. image:: runmodes/Runmode_autofp.png For more information about the command line options concerning the runmode, see :doc:`../command-line-options`. suricata-3.2.1/doc/userguide/performance/tcmalloc.rst0000644000000000000000000000134413051004444017606 00000000000000Tcmalloc ======== ‘tcmalloc’ is a library Google created as part of the google-perftools suite for improving memory handling in a threaded program. It’s very simple to use and does work fine with Suricata. It leads to minor speed ups and also reduces memory usage quite a bit. Installation ~~~~~~~~~~~~ On Ubuntu, install the libtcmalloc-minimal0 package: :: apt-get install libtcmalloc-minimal0 On Fedora, install the gperftools-libs package: :: yum install gperftools-libs Usage ~~~~~ Use the tcmalloc by preloading it: Ubuntu: :: LD_PRELOAD=â€/usr/lib/libtcmalloc_minimal.so.0" suricata -c suricata.yaml -i eth0 Fedora: :: LD_PRELOAD="/usr/lib64/libtcmalloc_minimal.so.4" suricata -c suricata.yaml -i eth0 suricata-3.2.1/doc/userguide/performance/packet-capture.rst0000644000000000000000000001160513051004444020721 00000000000000Packet Capture ============== Load balancing -------------- To get the best performance, Suricata will need to run in 'workers' mode. This effectively means that there are multiple threads, each running a full packet pipeline and each receiving packets from the capture method. This means that we rely on the capture method to distribute the packets over the various threads. One critical aspect of this is that Suricata needs to get both sides of a flow in the same thread, in the correct order. The AF_PACKET and PF_RING capture methods both have options to select the 'cluster-type'. These default to 'cluster_flow' which instructs the capture method to hash by flow (5 tuple). This hash is symmetric. Netmap does not have a cluster_flow mode built-in. It can be added separately by using the "'lb' tool":https://github.com/luigirizzo/netmap/tree/master/apps/lb > **WARNING** Recent AF_PACKET changes have "broken":https://redmine.openinfosecfoundation.org/issues/1777 this symmetry. Work is under way to "address this":https://redmine.openinfosecfoundation.org/issues/1777#note-7, but for now stay on kernel <=4.2 or update to 4.4.16+, 4.6.5+ or 4.7+. On multi-queue NICs, which is almost any modern NIC, RSS settings need to be considered. RSS --- Receive Side Scaling is a technique used by network cards to distribute incoming traffic over various queues on the NIC. This is meant to improve performance but it is important to realize that it was designed for normal traffic, not for the IDS packet capture scenario. RSS using a hash algorithm to distribute the incoming traffic over the various queues. This hash is normally *not* symmetrical. This means that when receiving both sides of a flow, each side may end up in a different queue. Sadly, when deploying Suricata, this is the common scenario when using span ports or taps. The problem here is that by having both sides of the traffic in different queues, the order of processing of packets becomes unpredictable. Timing differences on the NIC, the driver, the kernel and in Suricata will lead to a high chance of packets coming in at a different order than on the wire. This is specifically about a mismatch between the two traffic directions. For example, Suricata tracks the TCP 3-way handshake. Due to this timing issue, the SYN/ACK may only be received by Suricata long after the client to server side has already started sending data. Suricata would see this traffic as invalid. None of the supported capture methods like AF_PACKET, PF_RING or NETMAP can fix this problem for us. It would require buffering and packet reordering which is expensive. To see how many queues are configured: :: $ ethtool -l ens2f1 Channel parameters for ens2f1: Pre-set maximums: RX: 0 TX: 0 Other: 1 Combined: 64 Current hardware settings: RX: 0 TX: 0 Other: 1 Combined: 8 Some NIC's allow you to set it into a symmetric mode. The Intel X(L)710 card can do this in theory, but the drivers aren't capable of enabling this yet (work is underway to try to address this). Another way to address is by setting a special "Random Secret Key" that will make the RSS symmetrical. See http://www.ndsl.kaist.edu/~kyoungsoo/papers/TR-symRSS.pdf (PDF). In most scenario's however, the optimal solution is to reduce the number of RSS queues to 1: Example: :: # Intel X710 with i40e driver: ethtool -L $DEV combined 1 Some drivers do not support setting the number of queues through ethtool. In some cases there is a module load time option. Read the driver docs for the specifics. Offloading ---------- Network cards, drivers and the kernel itself have various techniques to speed up packet handling. Generally these will all have to be disabled. LRO/GRO lead to merging various smaller packets into big 'super packets'. These will need to be disabled as they break the dsize keyword as well as TCP state tracking. Checksum offloading can be left enabled on AF_PACKET and PF_RING, but needs to be disabled on PCAP, NETMAP and others. Recommendations --------------- Read your drivers documentation! E.g. for i40e the ethtool change of RSS queues may lead to kernel panics if done wrong. Generic: set RSS queues to 1 or make sure RSS hashing is symmetric. Disable NIC offloading. AF_PACKET: 1 RSS queue and stay on kernel <=4.2 or make sure you have >=4.4.16, >=4.6.5 or >=4.7. Exception: if RSS is symmetric cluster-type 'cluster_qm' can be used to bind Suricata to the RSS queues. Disable NIC offloading except the rx/tx csum. PF_RING: 1 RSS queue and use cluster-type 'cluster_flow'. Disable NIC offloading except the rx/tx csum. NETMAP: 1 RSS queue. There is no flow based load balancing built-in, but the 'lb' tool can be helpful. Another option is to use the 'autofp' runmode. Exception: if RSS is symmetric, load balancing is based on the RSS hash and multiple RSS queues can be used. Disable all NIC offloading. suricata-3.2.1/doc/userguide/performance/tuning-considerations.rst0000644000000000000000000000324513051004444022340 00000000000000Tuning Considerations ===================== Settings to check for optimal performance. max-pending-packets: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This setting controls the number simultaneous packets that the engine can handle. Setting this higher generally keeps the threads more busy, but setting it too high will lead to degradation. Suggested setting: 1000 or higher. Max is ~65000. mpm-algo: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Controls the pattern matcher algorithm. AC is the default. On supported platforms, :doc:`hyperscan` is the best option. detect.profile: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The detection engine tries to split out separate signatures into groups so that a packet is only inspected against signatures that can actually match. As in large rule set this would result in way too many groups and memory usage similar groups are merged together. The profile setting controls how aggressive this merging is done. Higher is better but results in (much) higher memory usage. The "custom" setting allows modification of the group sizes: :: custom-values: toclient-groups: 50 toserver-groups: 50 In general, increasing will improve performance, but will lead to higher memory usage. detect.sgh-mpm-context: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The multi pattern matcher can have it's context per signature group (full) or globally (single). Auto selects between single and full based on the **mpm-algo** selected. ac and ac-bs use "single". All others "full". Setting this to "full" with AC requires a lot of memory: 32GB+ for a reasonable rule set. suricata-3.2.1/doc/userguide/performance/runmodes/0000755000000000000000000000000013051004444017170 500000000000000suricata-3.2.1/doc/userguide/performance/runmodes/Runmode_autofp.png0000644000000000000000000014357613051004444022625 00000000000000‰PNG  IHDRÊp·¯¬˜sRGB®ÎébKGDÿÿÿ ½§“ pHYsëëqÍ•tIMEÛ 3îQ; IDATxÚì]w|\ÅÕ½wÞ{Ûwµ«Þ{—«,[îlc¦÷^B „P $!ôÞCï6¸€ ¸÷nK–eK¶d«÷ºõ½7÷ûcWÅä³°$¿óó¤Õ¶wÞ™3wîÌÜA" 4hÐp¢Á4 4hРA³W 4hÐìUƒ 4{Õ Aƒ š½jРAƒf¯4hР٫ 4høUíuð­Ší¾¢þpi½}ýMÃýöŠ+ÕÿàO¾!âàs~rQƒ•^|×¥As‰i¯þX²d1C$}AbRRNNNÿÄââÒÒ’A£N“É4uÚiý¡mx<ž¯–-3ôƒD¸ÀfÌœ)IR“Š¿)-þòKA@€Á cEQòÇŽ‹ˆˆø¾øî‹X´¯ðåw ›}­âuâÔ‹þvO‚Õjé'_éùWß²dÏæª<(\+Š6è †qãÆŸäïøÙç ?ßTž;^U<·¢¤Û·uµ=$düرýî–#¼øÁWys.“=®¯`du•eÅå o»éZNêC{€¶ÖGDlÚ˜ñ^' ‚žIöµ¨-òù¼ýÅ^e•’ó¦ªò ´4Ö¶¶´ô‡oÒÞÑ™6"iÔTeàs+鱺¦Êåöôϯçìl·G%$žàuxª‘¡`ÛÓY¾–ˆ÷mô €€€8àǯD€ý÷*Cz€ˆû]?<°¹%Äþ~ˆ€8d쿈’åÐfiРACŸàÔ´WdŒýPØZyF-Vìçaì÷E«é¶ÈþññÙ‰K >È>_}Cƒ,÷Lw¨ª5(—œ”ü@GgGKK‹Ÿa"’$Éáph¶ûÿ‡^¯û~7¦é¶/¬UDAŽ{˜sÎûù„ÿ{EâœÇI0&ø/£¡±aÉâ%f³©û¯.—kÚ´i#GŽ<©J%äªúcÝf¿~êTUÙ°a[G§SUU¿´µµ]xá…111'/š†J,0dÈ‚°lé²²C¥Ýç|îܹýÄaýywâüÿ?)tòT,€( |ûí·{;¬(Š—^zé/¢úØ+‘Z¸i¹ìõ ÄæϹb ÍÈ› ^¯·¦¶Æh0tkÔ`0pÎOnx… «Ê+ì">ðøUÙž<|c'ª­­µ•©*÷ÇVœóÞc…_ÛY|žŽ­Ë?6ÛBˆ°fïw«‘§-±ªºJ`ÇŒO7lØpÎ9çô“èhçÊϘ 8#¢ÇÕ>lÊkˆ»c€k°€%(ŒzÛ¿g±ˆ«&›#!k¨«}€Q­7Áá‚í½©þÿg“Ä_Nq,“Nþ|Эñ8 ÜÏ¿u`ˆÃÀ’.‘ÿßÀ€TsXµ}"‡¤ Aƒ úš½jРACŸàD®{õoÝû¡¡ !âÏËÄQ÷HΟAÖÖôýÏÇa~6C:ý÷H[4ùSÒ¥_²°”°«Féÿàð³Û;õ*õ¸Eý³R׉´W?k(pA ÞT¨ŠÐÍÚOÑ€~÷t8S•ŸÐ)ù‹œ2.AD$HÔûR¹ÊHEúÚßÍ2.Š({ñ¿×‘ ¿ÅÀà'ˆ“ ã½/‘8ªJk?Ý|A¹¢0úñ»Ax¬rO)7¸„ÈF½{}Rÿ¹L !9©ÈÕŸ’qÿ>Õ'8z$8´ä™µ‹?M6D U-±™gþ1gÄ0º­®º[þ_¡ûº«’EæZzÿdÊzãÌ+‡ÉNÿ,´?”õÿÜýLDòµu´´˜Cb™(ž.€r{éŠçn«môêDFÄ u#Ï=ç‚ ‡Ù?çI½Zq7]/ 3@Ûêëß[˜ró æÐ;Þê“_±ÄUgs 39ôF ^z‰À`ñ-ùí¬£>n4˜ˆ¸”8%÷Ü›£"Cº‚%=}È‚?¦g¥3°WlÛÃÉqrŵü‘ùÁÓ^ΟœÊÿ_»GǾ‘\5Í-JpL,þºT‹}` %OºúƒÀ‰«¾æ½ë^¸²óª×&OËSd(I\FÙC‘˜„z "—Áç‚ÁŠä¯‡¡Îˆ‚@(»AQúv¯{óó™÷=­CRøà|<ùܳ¢­*'.·—,ù÷Ò—Í¿óa+AoDŽ>¨ 2Ô™P€8Ên @Iÿ¬´`D¼Ä EJºÀÝñy€81 ?yÊ>ãÆ¡CÒ=bƒš^&I¡iÓÇÍY@Š—ËÎÆÂEkž»cæíO…[A@½üûþ(¾@§$A’e(2¢$ú!Fð¹PUIP2"‚>7q¦p(xæw¥‘÷žwãTW烠ÝÏV0 czkÂÄß>bT]\UÜõ;6¿p­ïÚ‡ç %É¢ß%|èó¨t 3¨^”½@LÒù—ý€ÁæœP@½â »QUI0bËæ—}Ùyí+÷«\¡_꾨9@L4‡¥5 À DK.}¸jÓÚ 3ò$¹½è³gŠvîá …äœ™?ïƒ(Pãî…[—}êñòaçžs¾ÕÐUÐAâÕ_ß}³.ÿÖIs§yêöoùôÉšúÑ™3ÿIi±Š«~ÓinÑ/¾Áˆ;¦‘B0èý•+dˉLr¨(@˜TÿÞÓOV–¸†55,ÝöÅÛ>Ð%?玸˜`”Ûm{ó©ªÊÁš2êü»âÒ‚»Ë­éÌxxÉ#;vuN¹õï¡zÏ¡¥ÏïÙº @~ÁèÙó%+ýòë ·Õõ¯ãs¼ b@D½-:2-“d ‚ˆ„èÚ=74ÖÖ…†Ú”¦‚Ÿ½ãª·¼•dñÇa¿J‡ÝG)BÎs"•8„*‘ I°ýÍ?lÙ\3ñ¦çgÿæ.eÿë¿ýN±¹ð³oßû4û¬û¦ßð°®ü­ ‹?QÔ€Ú%¼ùÙë#/?{šÜxð»'~Ûwù¬[žÊ7zë+×®h— Ž”i A“~ót¼Tú‘œù sXâœsà*q ` QrY¾ôɇÃæ?6ûæ'2ÒÃÖ>ý‡fŸ¢º7½zgGД©7<32/q峿¯:*ûÅ%è våsk–ï™pýCáf_ñçlÚÝ9éú'§_û~֣ ásþœqÖƒ£G¤ûT õ~‰t9ç@œ¸ €¢„(JpdÉC׸ƒ&ÍøÝ+³.™¹û…›ŠË›-fφ_SXiŸù‡W'LÎØðÂ-UMóÇf"óóÌ_çÝÚ´ëõe/>3ÿñÙ·=ܼrñã·¶Ë0n®Õj v餋nµüœSï!ÙªŸj"9Óé`ÓóWïÚÙ>ñ–×çþööƯ]»ì[ -ùçwŸ­Ì½êÉé__¿þŸÛÖn L 3Z|k½°3ñò“Ç`ûÎÅ]'gß6÷ö—‡æ„~÷Øy¥`‹3$O Ê›vó3ÑFP 5÷MÅ,Rÿ6òAË!D_ņ—nmÅÉ—ÏË÷v‚ÎX×Ð` þzBT ˜¤Šµµ52ˆîÒ-œŠ ¹)îŠuÏýž‘B@ˆº„ùÊÎÃ:ŽlßõÍdŽ5Ù¬ž:‰²×åéCãÍ\&…CĘÑ^—“¡÷ðŠG[j]g°WRÑ›ŽÆ P4†…‡’ rë‘-ÄœÓ8!ˆz‰¹ʿŸ—äREP\Þøù÷ ‰ Rˆ˜`0‡%éEàDk_)ª²Í¹æ6‹-X=º®¡¼uD2–_€ RÁ×<âÂê](›‘Î1јìU5ëg€¨ú:Óf]]óÕ¿7,Ù6ë¬ÑÀu÷Øó.ÍK‘<20ÝÙFÉœ¨(žSNºÇ\- Qù×?7Dçµ9 JMYE• L¥à¨ð–² ®°eߧ>ò·G.›S.tÓƒÁÍ‹¿ølÞ,EÆyªli£#ÓFGgŒêL!]‹ŠÀ_óTYÚ¢’1,Õ“eH’¨*0ôu65eŽ ŒÑMM5n· KÖ4¡½²£©… @Þº¥·Ïß½ý [þøK¯–¿é‡½„æ ›Õ†\•6:2}´-(‚ô±z©{ Cœ~~Ecˆ#6ÙåˆJ3 ª È £©QÑÙ±F›MW½h_ƒQd&ˆ¼ñ`-Ó¡Ñâ[uÇéË62ꈙÓâr/˜uÏcÕ oÛµ×’#6ÓÚ¸¿9|X^dÚ蘌4gË`1ú;Æü#°Sow3E'8b²Ñ™V{0¸D£Û-ÅäçZmv£»lÏŸ$‚Îh3‡Úë·îFJF,ýð¾÷ŸYdŒ Öðœ³gÞÿ’aï3+–î ˜ÞZRçÈÉJ“ëm蔂b¸?zc̟⦜ ""NнF5°=ÈZôÞc☡ e%æÈHؾ~߶áÑ®<ðòýë>ö†‹G·.™|·^¯#})büUw|úk6%,Ê6/eõ²Åÿ~ kä¹~OᦣóZfz¤Î¢¶,{1fÂobtª:Øe꧷«ØG÷ÅrÒGd Û»ðíV·à<âl.Õ›må«þc?ë²Ìá‘›Þ~ 1w´³|]«eÄèÔtÜɉ@U!ëâ{j¿ð¥w.¸ýò¡3¬úüaOÍ\«^)ß´PIºzÞ¥g!Ó™ÌBÉÊ÷|îËGŽIçò`¶Ý ”J œhÇUˆH!ð/vôV”ÃYZByScö¯ÿ¤.÷Öü‰ùk?ºU®žGõËåÄùC¼µ¥D\‘"挟óí–îŠ *ý¼GüãžÅ/VÆÇ8w¾¸)ᬬ<³Éj3›Ë >ßê‰Ïk1ž2Ñ+õÈØ_W­‹j}PzX¼¥ðÇ07©²¸<{Bâ†Õ›œž1ùüŠ·[ùÎa»¾åà–=C.½šsî¯Û-³”wüå³'nÞ÷QÎìR6_ôé£gÈò]¿{sÉä;>±§Mæ`¥uÝöEïÄæ]!þj.ÁN´@Á›š7^ì^¡ÒM¦!|Ò5K£š’ÝQ£Îλüé1§ i<¸O7jömOØ¥¶–††Ô³Ë›9€ÅŒœ“hWÜ`Î9sæù繎nð ÁSÿðÚ¨áM‡·:!ìôû?ÎÊŒâ€ÁSÆÌ?ÝÓZGþE‰ƒ~]–d=#Ä¢ë½5¸ù×Nž?³õðF‹qùÓ3.¾Vç+w£)÷Ò™0¬£ºHŒ™6綿›A ›9zùÀ+å_û8ó¾#û;c&ß8çÊkÔÆÂúŠÃ‰sî›wéÙÈQ0eϹ.Ôì–e¶‚ N¨²=zflj*ð^*" NbÂô³n¹K×YØÜnš~Ý-Yóñ5©I¾ð_ó.=ß][([sϸëy›Q-Ñ)¹ùzƒH*%ι/+ÕÑÑ\¡™rÞßÞ«kKw˜†ýæ’û…ÃÒ 7yŒ9çý{IF¢Ñç…¤iŸ”çj('&þš.qb7ÅW!|Äì¨Ñ »éŒ‘TkÚèËþ‚ª ŠÃλ—øÜÁ™c¯|¸ŠTÐ ?÷/ ‚ì#ðAÔÜ{bd7yÑ’:û– @ ø@U ¸`O™õ»ô9 z@ì¡+1cdîEw’ϱ=ÔÊ…„)×$ORAö‚qÔE3Ç^¤¸É£“§_Ÿ6 ˆ@ñ€âå†ôkf ¯“A9õ†‘ª|n ʘ1yÈ Dà2(r`#Œ=mêÔ!SIŸoк+"É^qèewƒ ²·×4)p™ÓϘ6ä à {€ìYS~ó¨êÕM¡#ÏŸ1æ|à xAådŒ:ñ¡²8'£®~HõªÚ2Ç\þ"ÙKœTâA£&Þ0 ñSfg,©2DO¸8^Ÿ«×Œ) ’Jè2öš¿#øÛ8Œ¼âaä {8DŽ™xݘ€{ÈÄý°³ï …ˆcâü»“/ù (ëÌ?å@/(*€"F¸ðÏŒâ&U…™ðû©*ƒ*â1µ^ËÁçêvÉîçõ¹ŽÙ‹)»» Aõø)½6úß¼ûÁŸ]8fàºõÓëb @ñ’âõ'd@õê ¼Hñú)ò¿‘^! ^Wà ¹L>¹×@®W lî¬#X"D²«;ŠìÙÃP®L^¹'¤õ:Œu‘ÜuGTòº! Vò«š w÷ì0¨‚ÏÕóÈ)³)±[œ~ARˆ] h „ ²«K´=öËÝT)ìqžYÃ.J­~åBQ'¸¤K×ñ¸ÁEÿGã<¹tœ0égI·'ºïz2¯üøí;ϯ¬ò2¾#Ú£’®÷?z“û¿<÷Š(((°^_‘8 dZ.qÎ 0°v‰!q•PL|ç„^1ù¼mRÿ’k@ ò_½q,@õŽoJŠ¢FÌ,KÉsî_¸¿ôÿS‘1ÿ‚P@•cþòX³5pé?xQèY€Ej™]U)¸ª 2ˆ!a€RD TÏç¤zYì¬goš rË÷èâä3ºêå ‚¯õà•_EÎ^`RYܤۯ™ $“?€åÜ_VÚo äyÿ÷dÆüú¯½×£\Uý4uUÓç*ù•C€aס‚ÔS¡˜@E!þ¢kž¾ˆâœüñª_oBøøÛ&À¡¯Þwçf¥KR¢¯»éõëH!EåHÄÈ?ÉH]„ÀˆxW¬­\Q À@ ìŲ@ÈOsF»\z„¨Iþ•,Ä]ðÔ.PIö‘ªú5É#…Gžþúy§Pµ}IéÁŒÜ³&{tY—<³T=?àÝÙF¿ õÕâ/6WµãÈÚÏÊ–r†¨Ü!3ε[t¾¦âo‹Ö­ò¨ÌŸŸ3íL“^Pœ5Åß¼Y_×fNNȉ=´»"÷Ìë­bÕºwŸŽ™úPz¦•#4¯{xëÔissV½þ¨eèŸFŽ ¯Û½¬xûfEåL’<ù⸔Xyÿ³«6=-}ÏŽ²;xý[ò³¯+_úoCÆ5YÃ䶲«?mhhbŽŒé™c't5¬üvцäá›Ë6;[›¬©³‡L>m@ ÇP;ÊV®Yîò¨¨³'M½*%5F%P[}û~}}«` O›zqL|, ¯ßõÙþmÛH´Fæž+W.2&]š‘—XµìÏ:ÏžqþXÅ P¿ú›ÏWºð¯xäåÍ»ãæß4×]YT´jQKK82¦gŽ›ná¥+^z6.ÿfùàóîŠoþ-~Òµ|÷¶­¾éW,Y­ß³èàîªÊE[Jæô‹Â‚ `áî+ê†Ú£UŠž0ö Æúù¹mä®/Ù¹øƒö>òÌŒÜ<”ú²uŸ))QÑ?î¢ÔáÙŒxKñŠ‚Õ+É•9¼£b!é¢áùéµ»>:pØ4nþ|ÄTgÉÖ/fÍ»ÕæÛöÝ¢u#Übi<ðíÛU• ˆh‰7ô´3b{Ñ¢gLïýÏÕx [^ÛiSµôƒÕù—ü5î [3,zÝ+Ùsžg9²á“’‚BN Yã3O»8,2¸eç3³Òƒª¶î(V|u¿ˆÍ›”·ù݆Œþó°¼0guaѪÏÚÚ½Àô#æ¤% ë8üõžu±1AõåûÜ.wlþªzR“L4´,Ü´|]dÞœì©såÂ×–¿ù:×Cûþ/–¾øº1mlzþÄ–m¯~ûÁ‡\À£ß>V|°)yÒÙ± æ¢%/Õ)“DÕYs`KG»Œ €·~W]E CoÝÁ-Í.oýŽ-K> JŸL'„ IDAT>áŒP;/øæ³N/ðö}ŠM™Aáá’%5cê|kk8¼½µ¥Tïî:tÔ•4n~êÈ‘5+ÿ¾ý»U*Së˶,/;X›nö¤ÉG¿þ[ѾAì÷ç6¢$*%›Þø»’›uÚÙ±Ñ|Í“·TyA¯Vmzã¾Z#uüœð ¶5¯þµÑéS*–­yçEsÊÔŒqc:w½´{õF§Sf¸ª·Õm`x««öïðúÀÛR\QZàÞ÷ñ_kÛÄ”ñó’G m-ú¢¢¤ ©£zÿÆŸ5zèp¦¤©gÇF…:›ÊªJËAÄÎýï¬_ø‰=sZæä¹åàÊWni“Q€¶Šm¥ë? àÜ¡³/25}µáÃ7úó–.»÷ýV“Ç”:a~ÒŒŸÜW\PÌ$8ô僾+ˆÍ?#%3bÓ¿/ÚµãoÞ±êÍç„„1™fª%¿liv!’»éPMÙ‘À‰ãrk}é^YVÈS[]¼Kvè³»v—³ôIó3ò'w|¼}[™(Êm;ÛšZ"FÎÔ‹’651%…y+*÷mó*¬ýಥÏ?#%ægN>3Lä»çhnó0¦º‹ö,{ÛeJÉ™uIˆ¡fÝç‹ø@‹Z‘éšö}±oWqì˜32&NsîzmíçŸr´í}kÉ+ïÚr¦fæ¯Xrÿò–kÛûé#õ{ú¤ù¡vwéw¯W–ׂ*·×–ìõxT R:+wµ66#÷ÔÜØÖ®´ï}oÝò51#gfN˜m懷¯ZøšöÕ*1§žæ6HÖÌŒÑãŒØQS¼©µÅCΣë^{¨™‡¥M<3)=ªð㇊v@Å]h݇•už”)¥MÚ¿øù¦ú¶“½rÕcIŸ¿àþ«,Á’,ƒîðWKÖ¯ípÝT±u™qâ-cgMSˆHÙÖFk/ß²#õâÿ¤Hå4^l+Y·Íã_<Á±g±cȉ1ƽngCkhÎÜÔæ6)©¡I¯E&0Éf7Z¬‚322-µ”¡ ! ª»¬²¼yÄ-/¤Ä™ @¯T¬[¿Ñ7m–„‚d IVLrˆ‰i/4——ó"P5lü? ŠâN…ÇÇXöÞ¡R*n¬nÓ͹ñF‡MT‡ŽQn±è«¾X$$NzÚF ¢’²kî¿뢴Ûç%@@‘*»ê+¥QW§™4!vè¬@L˜Îd‹Šgh MaS¡PAÂCKß±çý~øäÓCXLÜчo­9¼?8x${ÌÈôqã‡Ü鹻ߨŠtôç-s(rÜ›-éÈ'+ʦïµÖWroHѺ5)7l’kVäiŽÄ)Ìfo(\è ?nîE"BTDðÑ]küƒ\Aèê¡‘1Aìþ‰èi¨ð¨ãÇOÒ«•5ÑéÙŘœ¬ñÙCsdVpˆÚ%†¾ŠËu£~3nö|’!1+¶|ÛUÅ¥GcÆDaPú”“f21fÉGÛÉ‚l‚‘dGö‚y)—ô Ë*;ºn}ÑráÁÅoÍ~6Æ(Ù!ñÃ;‚§îPue{Þo¯Œ‹ £Ìª®Ó ¡gÝfo—™¯©ÊÕÉ#rgDÛ!6gR{s'q& .,ÞbÖ7QLxB˜ØÐĉ Ø~tk3Åqö 6“(#ÛË Êv®62 u¶¸!Sæ‡Ø(ÜtdçúŠÎŽ“i¯ˆ¢Òvxås4zìö°Þ^¥ÃIå­N{f,( (¤·Å„ÙPPKÛ; ñAVUÎÁ tð¹½SŽ¦ØÑ#¦ç¯¼wèÊÐÜ´qgeŒ›i–@éÊŒû·pµ+äF‘{Ë|l±›UHœ¤zW)\&êE½…8L§#Uîÿûe‰PÐóC_ܹskqPl‚„¼M²¯£³õÁ:+ !ƒ²D45: V; 1Ün#þ­lC/{`ík>»ìŸIy³ÓÆž›éO×’œ©ÝëZ©³¶†‡ŒwR«ÕL.O; hMT˜^œ÷wàjͶ7¿{ÿ=}H¬¤\ îÄ‘"÷V:;Œé±fÕŠÊ‚ârQmlm1„$0Î`:³Y2™~bý’ìR3®x¼îÕ¿½rá‹aCÎHwNÖ˜\òv-‚÷«“«½Žëòv6w Mf2xU-‘Á6¡¦±M`1`²„’J$ "¨| Íu0oÝÞ¥ÿ¼Ó-†šmµ£V ͸³±N IŠ%™L!I¦Pp-‘)H¯`RP(TÿD#U}rØÌ[F–?¸ðÆL)vRÆø³²&LGÞ=-äϨr¨âBäio‚¢u"(* ¨ q®' ÁŒéˆqb¢ÀU:yöJ š [Ÿ¾Ñ=äÙën˜JM ï]¸º‰Ê^Åœ—…  ‘w7:.û¾¿Ÿ¸|Ìé"(š³Î| sÞýMÅßìYú⢠kçÝû”õ¿ CP(óîá÷Øu"Ç€ËY‰f[Åwn¯¿è™5v# Òºè÷ãPÎå@–ˆËE4 ‰«àÏÎ3R½ò÷»-RŸ•µ¥Ì:ó_³¼‡|ûêÚWnvñßGûñàEÄÕ.~‰¸ªö>n«×ìm¿O»ø:«·.Þ?ööÅ©ÉAH|Çãó;LÏŸÏ þÓqÈçQT…ØVTêUô’òµz§t¡#gÝû¹·£±|Ã;»Þ»n_á?.¾>ïÇc ET}J×¾Y‘I’Ø XoL’É°õÙ?ÍxêÜùc€ vÉ_VïñèD‰|Õ~)pYQdÑߟ$¨*?xíÇÔ%N,xÔÕÏŒ¸Ln(ørçOíÙXtÅÃwâ÷̪WJS"U lÞ"PU•1±×=é9½à„;Æ/IG"2ôµ4òðÑM:@WsAa±(‚‚cã7|áÀlÆ}‹7}þE…‡»VJ&0˜¡zÏ&ÿô=Šr"_«`#¶o¯‘tBàÊ›‹·î =fÖŒÛß ö·6×öÐ@Äuf ÑHAcšYhh8Z!AgĆ}k !±’$üÀWÒo¬óš¢’ôPµñí7èÃ’…¶ÃUMŠ%™R»ýƒÇkÚ|1)!muµŠ F;ÈKk+A‚ÚRy AèjÔŒ)µ;¿*-,7ڤĩçžþ»‡ôGV4ú¨ÛÈ8éLÀˆ™C“ ~O£ŒfÔκÊb{dÎÍÜŸÄ䩲.cJîæW/\¼=×ÙØ6bÔ÷n]øyÞÄ«ƒwß¹èÁëBCLuŠ<*r)éô+Wpç’ƒù‚«VdþÃ-‰©‰!V<mãÚÊÊXz¬·£ƒ€Ë®6EVQ CKÿ|pcŽ#ÄÖQ¹OI˜M5N¯KÇöðö­Ÿ/}¼eèÌKU_‡"Ë‚>þàØdŸ×Ù®(8ñÒâí÷,~øæÈØè–›¤ì‹Ó’#UµMõvÊÜ×ÕÞ|>—S0’¹")>)s|â†×niËJn­®Š1£ìË…Û¾=3ÿ¬ûöÿë®…™xíÒôkÞ2Û#RÇäïxåÚÊôáà¬êhQ˜]9"*ŒoÿäÑÖœœ¶£ûx¤Cö¸¸ÏÕ®pÑ€ukÞ}þÀª!6«®ùðNóäkÃE¬—>·‡8Q{Þ]òœiâŒ\Ÿ»M‘UKÜØôìeëž¾²4}˜\_Tß5õ¢©HDŠ×çrQ÷ÛÓÁOôÒŸ>@mó†u/~üÝi7=ØXÙ°ê£çμᮆÒŒæð”àp{KÉ67‡%§ ÞƆ#‡d• !IÁááHäk¯9ØÑÚ.Z¢¤ÎÕß|Qtúoµ;täkk*/öÈd‰Ê±•M­¶¨„Ú’Ý¢}XH¸ÑÓRÝZW¡¨$ìŽèƒQÇ[÷U×KÑééÌ×Rw¨X}Hb–«¦H°¥…Xû:êÊ:ZZHÐ[#Ó¬A$oMUYMhâpƒA€ŽÊ·mùks®º]‘½Ë_¸/+Æl2TË9—$iÎœ9£F:)Š¼é¶»F]ý ØúõÇñY¹fÁÛÒÔ&šÃBâSÔ–Ã õ-ö¸›Uj­(îhïôvGlŠ^¯_GMsõNz[\æÎW.´M|2w\*WÔΚýmÍ­‚92,Æ^¸<8):‹šÍqYqÜÝÑVuÈér“Ì¡‰A¡¡‚ÚVu°È=Ên—Ú*‹Ú[ÛMÙf©­±G§&ÜY×R}DVHDZµ|«bH ‹vê,)Ù_[Z°qʹW™lá[–¾%ü&=3KUUé EQ®¿þú„„„_™Ø^z¥Ð;fÆÜ¢Íël_9ÿªÛ*€`qÄçè©¥þp±>./Ä®s5–·ÔÕ3%äXL:"PuM•e2!º o?`öà”9#HU] e­ $š1 ®†JktºŽ7V© NfÔ«­•œí‚1$ÑÎÈ×ZYÄl)V»Mm+¯=rTžf÷T® KÎ5¹›+y½ªd Ž‰—@i¯)–YxpD8"*®úŽVyõç/̺âŽðàMË>ñí_‘˜ÛÓipžŸŸ?wîܓ7mxöÓu§ßpwSUóâWÿz域¨Ø»Õ«2kTvPÔT²C±&EDG©®ÚÆ£eŠÊÌ‘éŽâj®<àry ¶°æ¢÷ì8÷÷×2DÅYßTY¦(h‰ÊÔjD8B̵%»ô¡#‚ÃŒÎú²¶†Z•P2‡:¢t’äm*luZÃâPnª-ÝÏ ±Q ‡ áÃ!FP\­U¥LgµG§MF ’Õu¡ i’$€êv6Un]ùmLjVöØ©U‡Šv~úäДHQ»©¶Ûí³fÍÊÉÉé«©-@AËÈ÷—V#NŽ´±Ár®¡‘™¡à?ª•0ÐÅ µÇ´~ÛÝ@]PxF> ÿ@£¬(;p‘éc €8ì1QÁ1]sY@œXPNœˆIŽÈìq@ŒÉ£À_²õÖèL›ÿÜ¿'ƒP—Õõ+XãF™…Ô°Ä…TnŽË±Ä’ôRhj|8N?ÔHÞž¬·EGÛ£ý=¯Úµ» Q°Æ ±Åž“Jœ@Ÿ \&&YI#‚1@q!(&gqàœl±9Aq@@A±v € ³FFfFæ x`ѽ#i ø§Ð’“n?´oc?çVï°ÅæLðg=¢‡…ÎÁ’b K 臉æˆÈÌ@åÊžÌ4 ¦°TsDªÿ™fKDÅfù•ÆìñCÈ?`z{ÂHÅh1(1nD¢ÿŽÄ‰õ·0‡§wMÈø?F²Å ížÈMáÑ‘ïŒnb:ž96à¡™ã€8‰¦È¨ìÈˆ$™C’sC”Ö¢À\H戨¬ˆ€JÑn ‚¨¬qÄ«d M2‡'õ¸‘>dHd(éB¢‡Lô?=6@µ`²' sô¢uÖØ›_íDÌ’˜f´¬;™+º2I½Ê'u7jÿ3:6ÕIàßBĹ¢ô*-Ò«lH Áv½¡ÿý{ƽ*ìùS—[wmë8æùÝoÒ]ŽlÀl5<Æ@±×…s™½ýDH¤(þmšþééªywæº7ÇðÛÃU¯?õªÖý½;Ûuß{±=VgpÞS!¬‡Ø^ºêù«ÿ’‰sUîšÅ"ì~æ± ƒzj˜výÒóB~¬°é¸éÈž;°é9ÑÕË%ºv¤ËCO‘«@óäÄU®N{ÿ~cÇã¨ûA—€c\â{&p|Šµû$É.Û¥“o¯¿0ƒDdNœ3ãŠÉV‹Ð«’¦†G0“r/ú«ÅÐJ…œ0ƒ Yèè‹bædRIc¶oçIˆsYÐ6 ˆ¿ÎÇH–„«?‰ ©´/,Vp$Œ D¿'Ð`Ñœ0º‹X-.èÓ¡3…¤›Bøà©ió?•tùåñUW„÷ýâÆÑU_ÿÔ9¯éN¼üº=9Ä~¯òôÀ$üï.q©>©öJ$û<§‹soxUÏñ}‘=PUÅçvõsUªªâuuzœ}¦!¤î”Ø …ÇÕ){Ýý´:,WUŸÇåqr¯«³OrSØGR´x=®”~%"Ùëö8¹ÇÕ9 "âÜès¹¸z"WpŠ?›50…ÌÖ _¼Ã9õ‰¹vzë‹{¢È>{X4õãònDT¼meÉÎu}ÓRIg0ù<®¾½×ã´‡FLö~H,W!:%gãâ·V}ô²"ûðDë–1†ŒqEéƒ[‚ Š¢Þ`¶ ˆ©Y"0ë–•½¤Èr_4ä@%C"ìªk6ù,:qÓ´â/¹0áôËoã\˜#C#¢Øo;TR!iÈèøŒ¬>YäோÌ_¶ÆÄ$£ úa©mâ` ½äî÷É…÷½c¡ 1aU}Å7ÿ…â«¿º¼Þ~%üËr¯‚d´©ÿ¾»¹(Š:ûþúýu"HzÇ€Õíkq¢Î6p[á‰ÍüþÒŠY0 ½µŸ°ò¼öóû>'ýp`ÕÌÒdÜ 4hР¡ Ù« 4höªAƒ š½jРAƒf¯4hРA³W 4hÐìUƒ 4{Õ Aƒ š½jРAƒf¯4hР٫ 4h8©öJDk}„Í­&Œ>eW£` Bü¥M ú¨*k_6~P•þ.Sÿ¹d‚8ðÊøéíÇK(ˆ¯}ª °ŠY—€lû5|›ß/­˜…ŠìûæÝçôF3 œ•«ª=ĉ©ÄƒˆÄ9Ó1AìÙZÆ•@-µZš‰E½'üÍû)ü… Pgì¡—8r™8"ž¸ŠuHD(ê+ÄU@†ƒ¿Í#Š:è¨2p•ÃWžýÌŠ:ÙKŒÂý!3 {\‚€+¨ª„ˆ'° ßM™ˆ‚²‡²“åâ‰Ò(“XùònYµIÒ83EÄš“ž?ÍdÐA€¾€ lÑÏg·Ä{ÅSÖý¬!BCÁÂßUÎþíoô‚ä·ƒ®×Á óÜ@Mu÷§7ßÅÁŒ8¡Á‘<:}òy‘1á@@]í{1FD_LvÉ÷z{¤€Ãú*Ö¿ùÏèéwÇ'Ät½I¯4¸øEDoËÑ >\Wß*`ŽÊÉœv^t|rwéÂ^#@„.è­=wŒ»õL@@€( ¾ /_Ób½}þ•¹²z¿üÔˆ^I)ýê_»Öl $m±‰ãÎN6Ú —ü:ô¸÷rÛïiŽ¥ºÇ™ý3*×>¶aGÒE÷\È;»S0zÙÕ(«ºŒi—x§»½±i÷KÖ.wåƒqñD€ %=GÅ*x+AÒ"¨>}ä;Q¢@ øPUüä h@QRûÚ;Zšýc & ¨Æ€+ {Op5Ü~Ôí0ðt66Äϸ>Ê>gKG}ù¦—¯È¿%îé" :%DÕ Š#2ý´«({ˆø;v?礢ìÞÕÛKzEQÝ­µ²,û­T4€?ÜP½ (@c0ùq¥³¾2({~\T˜êsºl~öZë覉A \’Î/QT|Dþž¬[/¨*øÙ– ÀX÷ƒ( Þ€ˆÀTÁÝZí"€¨GA P} È8øBƒã£Wð´×‚#%}ÌÆ]žÖúŠo/Þ0tÒ%·GFÚ9'PÒ#cÀUT<À‰üÝ™_Û¨øüÚDô Š—ð?ˆ’@u7v4‡ AÏìr èé$û¿½vÓg°'d̘oá²³¹à½{6|úÎ…·ÿ‰1T;+÷~þF}]“!4gÈìkV‘sBÄŽòõß~Öáâ']—›©zA©|ÕË%{ HgO˜xuzNªªrwéW¯>XjŠÊ 6 ó¢»vOÁ7ï·µ¹lÉ3FÎ>K‡þ[2(5ŠL²ÄN8/+TªL _®úÏ“‡2Fd¦E!*Õ›?:°k›J¦„)7¤å$ª>@RÚ —<_Y^iŒŸ<êŒ ŒP‡î#7.ÿ¤Ó ¶ÄÉÃg.0€v”­ÛóÝB/·¦N9WÒKè À[úõ+‡‹0Slæœ[b£-ŠLƒ,%ƒ\Ũܹٙ €FÎ:ýË»³!,cö£9@ó¾e{×,÷¨†è¼ ³Gå'`(Pgé²7<(92†Î¾Æá0Úyt÷'¯6Ö7ëYCæÝf—j[ÉÆ·^lñÓ¦^ ]gQL9ºæ탻I°§L½:15‰s:‚XRÁš4&kú‰Ô¹¯ýçµk>yû‚ßßÊ”Š¶õNk»Ç?aØŒs! aÏ⢠ßúÐ’4ùºä¬$R€ Jé×ÏÞôáɧݘš¥È @ç¾OŸ:RÑ6äl+IþzÞ‚€­W®]âòPhÎC&NýÞÚ÷§@œà•D\ñâÙK Ξ5‡ÊW×zˆ:­zò¦f9*mü¹AìÈwÏÞÑÜîDoÃÊ/üKJ8-mÔØÒ÷¯]³t—)˜ïzéêuëË’&^’:$»àÖn©5ê½åßþ}ÛÖà cΉK¿~Î#KLiÛ¹üɻ屓Υ£‹–<÷ÜÙXâ²ê§—FdäG%8ŽîÞ @‡–=¼îëõ#$ VøÆÛÖl!†’®mãã—•U³” çꎾ·ðx6oÿpá¿îâgeMš/øxñ ÿæ€ÎŠ ß¾ô0‹ÈOÍ›\·ö™’2E`LÔyw<{yAa]ò„Kââôkÿ~ÁÁòvQÀÁWظ"+>ðþRTþÄs†U|÷±ÇU_ýsÉ›o‡ 9;#oìÑ/ï[»v—NB¤Ž]ïݵ§Ô8úl»¾ù›çîknw‰P¶âÑkyrú”KÃ, ˾¢¼L¬dÅ#×ÔKò&ÎiÛõŸÚŠF@`ŒïÿôžõÊâÇœŸ–ºûí?î)ªô N,ªª~—ð™"'\0½uï7 pZ½äŸ·ù£ÓÇχÊËßxJVT@µa÷[«. Ξ˜™YøîÍE»K ï–ÇÏß±«&yÒe)Y±Ûž8oËŽ«Ù¹ýÕßî-v§O<Ïâ)Ø¿q­J€ š÷¾â?¯[Rf¦çÏîØýÖªE_(€ð«œ°#ö™^8èB3Ì:g]37ú°Q7lÎÜkl&äÙC:^¼±¼¸(oêÈ’gï×¼wìœ3¸ 6£s÷îÍ ;ª ÷WM¼ã¥¤h‰йï»7ÿ’;ú‘òM³Ïz:ud ÞŠšåÌ$}ã”qݸy @†˜¤˜…üþèîs³G¥?D €F»ÍÖÐZGjÛþ®ââ+ IDATõ«2/ù0kh$ç`c%«7¬ÈïÝñŸ’fiö wE‡BƘŒ¶ïo¨o©Ûú…0ô¡‰ó¦ø<œÌßúãÃeÍ7›®÷…M>ýB£¢"Žî¸•D½»àã£Ωx01F q¼Ø±sï²…I¿»’ ^z ¹,é“ÙâeMåU»7¬Hž÷òqÉœ¡Ã\÷ñs/9ý%±bסҶi¼9ØjQ†Œð´?ÑâòÀ·÷7šFžÞÕlØøÆ’Ó­[f ÝR 9—_|•žA|FZõž•Doíöý;K§Þþz¸ÃÎX¾Òqh÷¢²³ÿ$žZ« ACʳüACcGëÎÅJâÕùsÎb$Ä'[ýýï5í×%:ÔÃ+ÞK<í‘œñc€H/º+«Û¶n*,kz×£)ñ ¤ñRçæÕ?•=¿ìPõ¨›žKN¶1i‚§rs}9'ÅUúÕËÑ“ïÌ™p 6|ýÒëÍS&‡;¿‚ÃöÙ>D€HÜÃUtÐTSË]ÍKŸ@âumº†F†®²ƒ>ÇèpR@•yب+çO„²¥¯“hµ: *'TÑœ#à‹µµj§Go5p @o” 庺”Äí[?hàœ#yg§³í0§TvŠH“T•T&À{ ½ÑS»ë}g!'@¥³ÎÛAŠª4©Ö­æà y”˜yÿxCnª-®m‰8g(÷Ðÿ±wÝñQUiû=÷Þé%™Ì$™ôJ’ÐA•¢‚ˆˆeEw]ì®nÓ]Ñï³­ŸkYuuW]+ºkUYYl4EDZHB ¤÷6émú-ç|Üd“@'ržŸ¿8L¹å½ïyÎ{ÞvF$d¶Yë¬nt%ÛÛuÖɬF¥5Å›P[C=Hîê½oØÀE€u·!ó¸ÃÆq¼>è÷,Ñ ð:ì{Ê6í¯G±ÄÓ ]{kÛ ÚÞ"©ÌJ†Áµå»ŸbYØó/»1lªB L)$¾Ñ]Q_-hÃB9° …Ik6x¸º»=.Gé¶×« Ä0ŽÚJw‡àö‚AIÆÜÆ?ÍD ˆ‰° `gO7qåå|ÔH†÷tÖVÙ\‰AÞÖ4)HG¸wLRAùþÂ*tAQ ‘¤œ‡ÄOjë–b¢Ò…¨±€ÀŽê"x[œX±ãP{>‘\|Wyg=,ÄDA#,íÜ" qà¬)ìEÖhg“ˆRg ‰áˆ€BãnÓÄe ‚û"®€Á@ Ø„Hcùm_fL0€µ)‹% …¥L ŠšŒ&€ G D{Ww[MPæqš ¨¤µ@(>æ‚ZÎ9ábêÛå.>„€`Œýc¯}³#`Xµ)6FKÜÅÅ%›bU€·, §U:¨ünD- ш’Ę"#Cô €˜Øð”Ù! °¬@Œee­ü¡Xˆ(õGêK°í¬RoŠŒQ©•`‰‹OT©X˜HÜ €€àÔоg—ÇaR– X#oˆÇ˜y¿. Jâÿt°vï}„ˆ„1–½þ,qz‹Õ „ &>"ã<³Åtvbà§WÄ0ÀÀ "î®ü­…L¿ÖÈ‚;,7Cüì«õ‚ÇD+OªêZ„zŠ?ýrÏÑ™Ì ‚ÓÙ#X¬ àÀÞU,©á\­Âãq 0ˆw´ Qš„IŠ"Uò䋯‘¼À°ÐÛÔª¶„¡q"@ Ë° °´Ý^S­ºtM*($ƒc/NÏ0Šö:;= „E…y÷W¸; Ø‚4÷×Ýf½ñ…à0cun;;KtêÎoséçFë­Áκn,(óÎΚž æˆHŒØÐÔ+â"@"@x»—×(Ÿñm†aXœuí}wn×”Û® R¹9%Q‡^’‘!J¢Çåe4*p,ÈnÑ#øÞœ÷Wο/>YW\Þ!ŠÀ!Ä0ÐÕU§J¸"Jב[Ö‰XˆØéît@(hƒŒ Ž‰>ïjK°ðv÷`…^ÉÀ±]Bˆ†(ÔZ²oçwÖY÷˜´ µÁ zRÒ.º$`XpvÛUj Á‹‰wô8@Èvðý’VËì« 8í-‰@ ®æ½—Å·»WDAJF½¶6‚1â”–0‰œ›6ï "öx²ánæ³1ÙsÓ¾zïûžU¬º9Êò¶íI¹y£E­‹ž™^°ý}£òâª-ÚùI±JrI±×?žÿô3û·‡ÆÆZzJ>Ý·³à¢{ÿ¥g!ÒÏgó%ß×53¢Èw•lÉÿrÏ´_½f,&Ιvìã?©…›µ¬£dóãëÏÝpKPö/c¾Øš÷éK3\ܹ÷ÉJ—uvt¸iÖe%ï=“þ·èPTþé[\Ú²³Ú9é<¼ã¹’}é‘‘¦ú=¯viÌ òºéW%~úQÞÇOâ•,oË}÷µ _ºxEöŽ»Ô7º«ŽÕó-@ÄÞš½y_n ˺wÚyqHÆ̬ï6®5«ï3jH嶧Š ozøךÈé ÉÊ/ßyëÂÅ u»ËÊ—\¡¿ú‘àûï:´íóô)i½e×5jçÝ´<Æüù¯¿ÙüÙÌq¶ýïw{y5&ªˆ™I“Í_¾ýâ¼ËW°|[Áæçù„»—ß° áñ̯}yë r·V7b1Ï÷Ößö¶K5ùš«!1Ó/-Z÷üáA1±¡ÝÅŸìÿ¦|Å#¯‡è‰K®þúóuA:¢AG>Ý}Åó!ç/HÛ²1oÓÓš×BOîÞMGRîÞ‘ÖCî_Ö^~™³voUU)f ….áÒvn|#ØÈ™Œª¦œ–«®¸÷a½ælìj¸¼Wªà(º®è“§ Âêcæüö—ª9À˜(M™—®})wó?~¦ÐÇdÝýVl|8–°&êÊewr9[^«q£¸%›¹`®³æÞ³ÞôÅ_mxT¡“׬K›juy!åò?‹Ÿýõð¦çô‘sÓV?Ã,")Í_ö[.çóØëR[ç\ñèK0×—›9Î\´!±ÑÍ»ÿÑLÆD“ué“;"#‚$‘bÓ¯|Z³û¢ÏŸ•1çó/¾ˆÃDC/zpÑMÏXÿ˜6î¢UþZ Í¾i•9rÿg¯ö ´+/»ŽJ\¼øGÎö÷‰1uù}ÙaŸ°,ã¼>(úüùÜœ´ú½ŒÙi’\,7žÄË©L )-ytå& 2§.øñ“bˆ—ˆ€’¯}RûþáÏÿÂc…9ãg×/¿†x0aL³×¼¨ùü…œÿ<­4MZp÷S–`½H&/}è¼ÿ¾ø}þzUج¥~f9oÅC/íý÷Kß•èS.½;Å+Šªé?ÿ»þË—sÿópº˜L½p:+öÔ9÷héBã™âŸF’pù“iYÙŒÁ”¹|åZóMoîÛÇk,™Ëîÿ‡I¯Æ¬sÏßö¢€´ÉW>›>+Ãã€yn*þìÙƒëMÔìû>”j±{`þo^Éù÷SßølhæU3¯¼£ × :íæ%lðá/_.å‰!~áÊ?ÞbаggÃà€9°Hâ.ùí¤Ë~ëó{ˆ<^“[ & sÚüßþƒa0‚C„d^¾böåèÁC@””©«̼ÑÓŸE¬0MÿÅ“³@DH›{‘ÇA!úÄù—þÏ|Ä‘@pÁøãVßÔ/1S®úû&_R–@ðî¿_Œ4IKïI»öïéóž2kÖ/\À‘ÀëŒ ð ´ä²‡—0°¼0!ƒeúU+³®Ñ hV&ö‚(ÂO½áÏ3刼|ºñ³Š%„(ƒ£æÝõ79Á "!Dô¢ð¹7®š#B ¸„`.dÚ OÌRô_$ 4§ÎÿÝ«, DÞÕÿfdö²G³Áèü,·£MYù@úµ}e‚G^¡Œw÷â’ß;yEŸ_”¼}ÅD$uTÖ’²ˆ¼0„&lô…k.YDwß÷1h3®{lšÞÝÇX™}÷?.dA@’ e¸z d™¾êŠ¬U€€ˆòa :+us $zˆèA?œ¯ú B ¯Ã¿(¶ï}‰7ï÷}@ ¸Apƒß—x× åy"«?‰ÇîWô‰Ðø+ÜòÝ‘«ëoCôåù÷Ë¿ï}9.K°OìràÀ_h ñÄÍ÷Sè?8Á…ÿeÊø¢9ƒÐëü~ŸØÉKÜÞªë ò.Âÿ ÔÉOÚòAžÞþ·øþ€à&‚»ï°}Ï`\sëIXÂW"ßWU屨E@ôÑ{B·å£ùiæ‰!ïuø±„—ÈM3ütû„£±â{í¿\4̧~£þêßõSÖ¼3èøhЛh¨¯ (?É 7> æ}(i @§'Þ¡Ä9î(à$é9LÇÐÉ$6HX}O`øãO„“°ÄtÛOcÑP²:¥ºž.KœÐ~¯”^)((((½RPPPPz¥     ôJAAAAé•‚‚‚‚Ò+¥W J¯”^ÏcªÆd Öp!@T3©`ǸÇÖè üµrgz~Œ1p à¸1³XNE0&dlìa‚%å”7;/D·ˆUŒaÔïÀE€°ÜXð,§ÀXBc°?Ë@BRÒŒ=Sø¹º?¤…*8RÐdk ì麻»1Æf³yDLøH«•aÐO¤8î”SEHHÈÜOȉ-Ø Áû÷ïW©X1š°BÍÍ-*7{æ4Þ˨+ŸaØQ²ã¡| ×^{­ ð'öøv÷îýû÷ó¼7`WH@¡T¶·6OŸ’É)#˜ F1 ˲ãs+^BÈÌ™3§L™rB×9677w›’!CQDÞ™žªÓêFšÉX–…;uBÂBCÿ÷ð±@múï¦ÂÂÂꨫ«ÃXJJLÂ#Z±€€e¹ŸÎà§vB8Ž0]³,DzB(PO!IJ,ð,Ë1¬4Ò 4JtÔÇò …ÒÿÚ8ŽcYV–p î—eY†a–eYv¤ïKæÖs(dß© …ÿû,Ë1,Ë”ú1!²Þ²wvtf:³„,m–å{.Y{–E#ï€úé:ÌœòAŽË„›ÑsSãX¼çðÖh–ØÄyÖ£Y‘ª¾t4N4: ›âìàGšî‚ ð<Àe&BHEI’AG2´5䊃XÜO„×ëõz½¢(Bcù˜g9îäõz¥@ç™üh½õz½|Ö!A$Iây^¡PÈ‚õ-*GTÎòõx<£–\d–¬AÀó<ïó½žiË÷x<<Ï8½2 “––æv»x? ÃTUU1 3þ|—Ëå»+–eGšmBgÎœ9£G/gÏžív»‰Öh4EEEÙÙÙJ¥ÒÇ0]‚†P2Ž‹‰‰ ‚MNN¾à‚ «Q<Ï÷ööfeeFß›,Ëž……2þüQK¯sæÌ ¬‚?~\’¤3fø‹—a|VzsMŸ>}Äé•bµZ—-[ØK/--EqáÂ…çDFU±|HHÈ•W^ðÃ~óÍ7+V¬`ÎERêh¯œ³dÉ’€Ûh6›mÞ¼yQQQçê¾F¡»ƒ’”””””ØÚÍf»Ý¾hÑ¢1Á?f¤Õ#/‡Ï¡‚Ž†•ƒ#q1òbmŠw„8HÙ?0Îî+ Œ؇Nñz½øÜ5‘=S5fFÕC=WŠ2 £ŸT¼c4P6ŒL.œs.í3ºÚs€‚‚‚bD@é•‚‚‚‚Ò+¥W J¯ã^备!SÈXÜj´B.T£‚ ˆºR|ÔûëçÉôvL€=—¢ÓéêëëwíÚŲ,˲jµ:((Èh4FF3|>„fµ/Ë’fÌ F£Ù³gOFFÆ ðTbg „ÃáÈÍÍu:#Úìu|¨ß0b„&<ɯ%IêíííííµÛí½½½„·Û]VVæßdr´kÈ(™ äËÈÍÍ­­­mnnnnnV«Õl?†Q(2Û ½^o0´Z-eÛÓDmmíúõë1Æ:.33Ódzþ5²§C<Ï477ó<¿dÉ’¬¬,*ÃSÃÁßñx<Ž~ôöööôôÈN§Ì°’$aŒÝn·V«µZ­IIIYYYúLRzý1SœÓét8N§ÓétÊíH|m_:;;›šššššM&Ó”~œ²ïtžú8Öõ¶¶¶††—Ëuìر-[¶¬\¹ò¶Ûnü5:! ©0­­­úÓŸ!+V¬ 3›Í‰‰‰tŠ:M…©¬¬<~üxaaá±cÇl6[LLLDDDDDDdddxx¸B¡`Y¶¿Ù1«R©t:^¯×étøt¬(ç(²^ý;ß –Ý×̀괞žž‚‚‚£G9r$??cœœœœ˜˜˜˜˜˜©Õjõz½ü¨|@“qiêúKL¾5¹ã5Bè­·Þzá…V¯^}õÕW§¤¤ø·}šàL!{úd)Ùíö#GŽ¼ñÆ===ùË_222|œÜzš#B’$Ù• #›ÍVUUU]]]SSSVV¦R©¦N:uêÔ)S¦Ì˜1#88x€gÀÿ,C2À˜›hŒºçOiò<ßÝÝÝÙÙÙÕÕÕÞÞn³ÙZZZšššZZZ!‰‰‰qqq±±±ÑÑÑZ­V¥R©ÕjF£V«å)ôd]A‡<ãÁl[]]ýí·ßnÙ²eòäÉ×\sÕj ñ™ Á’ø€ã¸¹sç^zé¥&“Ivf¦8Me–ýòZ­¾¾|ŒÉq\hhhTT”oEòv—ò_Ö¡<V÷”^ÏÞJꔪƒ1.**ÊÍÍ=räHnnnYYYRRRFFFFFFfffzzºB¡@ý–ee-ç8nxM=Ë–ï’õt÷îÝ÷ßÿÌ™3ï»ï>“ɤP(ôzýè ž<ä Œ$Iûöí{ꩧæÍ›÷ä“Oú"c†aÎò½ I—CœÏs%ù!:;;‹‹‹?^TTTXXØÕÕ•‘‘1mÚ´éÓ§OŸ>=--í”ó h¢ ôz_§ƒÆÆƆ†††††ÆÆF™Re>eÆ?ÿc¬Ñh"""ÂÃÃåÈÒ9×~ú½WVVnÛ¶ ”J%B())iÁ‚¾×FO}Hÿ²Ûíþꫯl68θ¸¸U«VÉ;8Œ4¡œéâI†ÓéléGkk«k ‚`·ÛG~~þ믿ò /„‡‡s‘ïõzÿûß>ðÀÓ§O7 ƒÁßÖþÑ>ÖMžçóû‘——×ÝÝšššœœœœœœ””£R© …R©ô¥ÙûpÊ}Ò&fÉ ¥WŠ3#…ÓG-((((((,,t8111QQQòÂP.6 :Î?½f˜T‡·`ðѱcÇþïÿþÏb±¬X±bòäÉááárˆoDm¨Góx<½½½%%%[¶l)((xôÑGÏ?ÿü‘{¾’BQ1Æ^¯×étÊSŽœç$WÚl¶ºººÐÐÐ)~8W J¯g°Æ—Ë%é®®®ÆÆF›Í&g8B,‹ìX0›Í²ÛA†Ñh”‹e ~yúCÝãñlÙ²¥««ëüóÏ—S)L&S)c0M{½ÞÆÆÆ’’’C‡Õ××_uÕUóæÍ“÷Ç>Í3ãÒ‘9T¯×+7±Ûív»Ýív»ÝîöövŸ“'((Hžä¬Vkdd¤,a½^?äBžz?)½RŒ³÷dèîî¶ÙlÍÍÍ^¯×—± WÁú|¾.—K’¤¸¸¸„„„øøø¸¸¸Ÿxmv»}ûöí.—K­V×ÕÕ †5kÖh4ø±™’C¿ÅÅÅ›7o¶X,ƒÁívgee¥§§ÿ“áÑØØXSSS[[[UU%I’N§Ójµ²T¡PÈ[ÃÊl+IRXX˜œØ1VºPPz¥€Í{2sLvïú‚ξò<_YYYÜ–––„„„ôôôŒŒŒôôô¤¤$­V+'™ŸÒúó]†(Šn·[6iŸ|òÉÈÈȇ~xòäÉ>Ãзýøé$Zú^`Œ÷íÛ÷ôÓOÇÅÅýîw¿“]"²‘x:F·\9âr¹***ŠŠŠJJJŠŠŠ***ÌfszzzjjjZZZjjªF£‘›Œøºø^ v†ÒŽ ”^)†6ë†d"‡Ã!»›ššš››e¯¢ì…!>>>)))99yÒ¤IrVBˆa9ólH¶­¯¯ÿâ‹/:¤V«ï¼óÎÌÌLù˦„!‹!‚ ?~üÍ7ßdY6;;{ùòå²ÛÁ?½A.“'„ÈÜ][[[QQ!Çm6›^¯×jµrCK£Ñ.§ÖGFF †S®ßéâ‚Ò+Å)éòÿóc3kkk =zìر’’’èèè„„„¸¸8Ù· —ÒúŠ)4Ìk²Àn·?øàƒÍÍÍ·Ýv[TT”R©Œõ™Ÿ.¦¡¡Áëõ¶´´¼óÎ;jµú¡‡2™L===r“¯•=Ƹ«««ººZî6RUU%BFFÆ”)S222¦N:|ïˆS&3Q)¥WŠ3s#¢ tt´ËÑQ}V§œØ+G„ìGwWWˆÙœ––Z[[«7€ââb•JµfͽÁè;à7mÊÏÏ€ÆÆF‡Ã™„h´ZƒÞ ×ëúÊáú‰\«ÓYÌæ³98Ø4¶DGAé•b\¡¸¼Í%ô IDATúégþj ”2øB(/Ï{åÖ9ÇëA’Nôs`Æî°KV©Taaaf‹¥¾®Öétµ¶¶!rß^¹^©TªÕjµJ¥V«U*Ãqh:B[3Œ­–à{w·¯Ç Åà¨&¼s6|´I=yÙ¤ —Š‚÷œÌñ¾?¤ÿ=d–¿yH†xuNìý²¯Ö?V0söyT…((½RœÌÌì36•*µJñÕ‡Ó WIàhöÅi€¡" ðY²ÔQtZR:ÇÖ3¥WŠ‰É>ýÿ#Cý}þÐ>ž àj}À‹³?Qø¼½T(¨s€bd¼ 2Á0ˆe† ^I–E8æÞ·í ŽCXBȈ§õÚŠ&ÃRPz¥a#!„ÀÙX»í}·ÓÓ°BDtÏxì ]ß¼·iÊU÷ô2 ö›¼!ÙôC—àƒ« ü¿ég1#Ä …»hËËÿH\útêä Iô¼ï¢Ë}v»ýøñã"Œ±|…Z­633“Ò+¥WŠ³ê@rw¶¶Ì»Þ¬FD~{ôìml«*äE €B 5°,A‚$ ”z„] b)5aðz`5ˆ#àõÊüHNƒ €SÁHpLaõ‘©™ƒ¨µÈë…ž „ü)ù§9@HWg×îÝ¥å•5„ôÑ+˲III¾²”^)FjíL$.éÒ;“ƒûXI¡–ëãaÉ~|ó«õÕõŠ ÄÉKïŠ ¼ú¬åª?'övän~E0^<ûÒ ¶/_ªæf^0ÿBQÀ(PågußlÁ_—äUG]0ûª´€yGgs°î†ÝßtÍ¿,íûý½Û£I¸ä×))1‚ñ+ @€ҷͼq}òþ ¡-Š‘²c%^¼ xúþ“D¹!$uìýÛõeÕîØY—›4]ßüõ¦ú&‚{åí­SªÁÓUWWr¸<çs‡ÛJîE ë Bì Ž~ò|sgpúÅ×áòõÛ_|Î…•:*~ÕÙ!¡£å؆¯^{#dö/’"¿z{u“‹f?ÿmÓ((¨õJqöèUtwx9îßKŒÕ„öUV1œýØÆšnóâ›gZÊ9¯-=t .u^ɷﻯ{ØÞxLŸ½ öE¯8GeË—˜B$‚êKM`­9"óÊë4"DG9Ö?úf{ÓA&¦ëV´Õ¥üa}’PJHåá/[+j£Ò‰@™‚Ò+ÅX_qTðöÅl?¹zì 7ože‘®¨£©NdÖ˜,Bˆ>vviUýÜÓñç/¶´>l·µXWXâ߯nèT ^fz¨Eå¾3}‰Ôæ9:D/°ÁÓõÐãp9¯»¥ ™aQ9%Ç"–“$/åV J¯ãXt‘9¼“„°_&(߀! ˜büVÕ‹^MÚ¼Pæ©Ö¢BÁ^gц¨çÌÿnÏAkj£nJ¶F¡}ñ)lÝ„ú2 ülga€ ‚(³Rœ+ƒŠ€b¤@Ĥ'`îut{z!Žñ´êƒB‰*xÆÜંm®¤ÑëM± ¤Š+šQ|R\ŸÉêwh¡ëˆ‡b€uõb½N­ýá©hz?¥WŠqƨ¾¤¯v´¿‰ô¿MMÓ/ æë+ömênkê(úÏ‘ïÛ“ç,`ݺxMçþM½šDN«¶¦¨pi]£Í‹øB=GËwçØ;êþë5UìÔ𠸿$춬_M}>Ô9@1f!s «2XâÓT’SúO|ÂéCbCT‰KÖþ=ï³uûÞÿ)ÂÏûÝ[ Iá’¬yù¤Ô5©™-`&"5}ŽM“d4ê ÿ´UB9íj®{çޡ๠~¯A’¤ ‹ÏÐêXFË"0¨‚£RtF-ù!ASPœá@«¤)yòù® i3æ-…ŸÌArA‹TZD"?hû©´ ¸c‚¤Pý ‰rýRêðÀ{ Rè€%àuûïŒ Ö-®S=zõ¯ç/Þ ‚F¢$* x„@*-äÊ‚˜ç0æ¿Z÷ˆ…´EÇÆûöGP©T÷Üs¼å8µ^)FÀ9 s˜û‰V¹ÚJN«ò:û«]1á]þE±B¼vèû'€àAîšøCjÄ¢WbDÑ‚úrB¤ÿ¤G¯#ÞÕw|jÀRPz¥óι¨©ï¥¿sÀï}?Æ<ñÿ!þ!Ø,¡È¹¿Õ³É/b ñsÿãøÎC¹•‚Ò+Å°²„æ_N@â Ýðš‚Ò+E`¨•„Â"„#ïC –‚Ò+ÅOö=øv¯à  … y¯#oq ™çïŸ$ûƒ¥³ÁÇò³g£ù0Ôz¥˜'BÄwT4U–ID¡šªðw3±Q|YAYÔ”…5 :JwuK铦X±HD{Ske¡GÀ § I˜dGSQ®)1Û`T"öÖìs3ñá1±Ü5…Ým혀6<-<.íKV ~ j½RŒwóRˆU{þvkaNŽ§·¦â‹¿ìzçá‚ƒÕ ÷áoÿùTw¯€°TïúË·[+µ€í5ß½vOÞÎî–¦ƒv¼þD—S\-?ükK‹!@ Øöþ­ð`°`ÛóҎןlmir¶?øêÍ9{sŽúd)¨õJ1!Ø1*hßþv=o½òæ?YC@²W}rß.…F ˆSj ÓGÂœJ¯9„ ¥à³VeÖõkÿ Wò¬úìÁË ‹gf)4:†é#MV¥S¨Ôà±å|öAâÍ»—, "22t­{sÊ…oèQ_G J¯ãØv––º­1T£Þ Œ&1,!¨KÚ=Š;ºÚŶŠ]/Ü b9ÜÖÖ¦h¨ž3uÖ@ÿ-RŽ*‡‹‘ö<ûÉAc†NÌ·vôƒ ¦U”^)Æ;€$a@'öØcT ß|·ß£¶FÄ%b<FBˆ¬›}¡£.¿³ƒO\ñ Êö‘CuqÒ´äèÌ,gMNKm)cedŒ‰Ñ¥Æ¥Fg™47[l+o­«¹ˆé×ÜnF mxÒdgCAKU…1ãÊ”´0¢Š³DF%_£o.ÍïíqZ¦ÿrö¥±„‘ô "Uå}£—1(¸ÿÂq\VV–B¡ êDA­WŠ³¹Q!š°és×LGˆ6L`P„L™ûË)€` 0% ï"€i3W®E€ÆDî-¨¶Î8ïç3’¿<#X:uUøôU@0`Œ}Í )((½RŒoï’ùŽ`‚X%H^§(H€éDF&àK½ÂR_'ÃlIÆ'ˆALú¾?ø ¥WŠñL°Èï/Á"J\ôÇHu‚ä=©ƒÔýj~H™¾„ƒ[Pn¥ ôJ1š(h;Ö©?,ôŒr÷k†‘] h4É©¿×7¥WŠa ûEgOgog(ð>׆ݎµÖÀ°£KK1–x¯©hA9¥WŠam1¸}ÍÏ_|ùeçZ¹ÝB¨¥¥¥¼¢<’ôÙ·×@ÿZK’Çíq¹]¼×ÛÞÑîèíe±‡°êä”´`SÇqò®0}ýµˆ¿3àì µRaMȤûÔQœRU¨ŠLpvˆ(PIqñ§Ÿ~*IÒÈð*aV©T"„::;šmͽ½½,Ç"„¼Çë­¬¬4è 3fΈŠŠÞ½ûÛžž2238–%1ÔjµZuzïåQ „ ³Î²@èwòÒ­ )¨õJ1´s`0ɺÜn^~:½ö% „†abÚÚÛ9R^^:iҤȨ(BˆB¡Ðjµ_}õUfæ”´´4•J…1¾øâKœNgkkëgŸ}¶hÑ¢Ðаòòò­Û¶1 3mÚ´ŒŒ …BA!c_V–ï¼#iøSÓ„‚Z¯gŽ¼¼¼-[¶H’t¦Qœ4MaY–ã8—ËU[[ÛÐÐàt:A0 ‰‰‰qqqÇÉ´ÈqœÍfûúë¯Ï?ÿü¤¤$žç‘ÏoпÙõŽ;,Kvv6B¨···²²²¶¶!Äq\ppp\\\LL ˆ¢ˆ1ö™–g!I‹Z¯”^)ÎŒ^e’:J…>'*bFEžçeŽ“$©¦¦æøñã<ÏgffNž<Ùh4Ê6¬ÏØ”RVVVVVvÕUWBÓºL‘J¥2''§¦¦æ’K.ÑjµJ¥RþHÅ–––cÇŽ•””$$$¤¥¥………!„dfW*• Ã~ŒÕB”J%¥W J¯§FNNÎçŸ~J瀼ޗYÌëõ644466J’¤ÑhB<Ï ‚,ÏóôM£Ñ444„„„Ìœ9ó”„®V«Š‹‹U*UFF†ÉdâyX–U*•,ËÚl¶úúz§Ó©P(”J%ÏóG§ÓEGG[­V–e%I’$I&÷ÀÒëÚµku:U J¯á©©)''GŽÞ †B¡y¤ºººººÚf³µµµI’“`2™´Z­Z­fYÖg¨V3™”7mÚÔÝÝ}ÅWûï¸5<§Bêêê¾þúëÄÄÄË/¿¼··×ÿSÙ>•iÔår¹\®–––ššš––­Vk±X¢££¢¢¢ä/ˆ¢øÓéÕ`0,^¼˜eYª<”^)†#‹ÁL‡úùùùo¾ùæÞ½{.\¸dÉ’¤¤¤ÐÐP£Ñ(¯ÇO'æƒr:üã—/_¾lÙ2Žã~„ò<¿qãÆ7nÙ²Emì\²­*ŠbOOO{{û±cÇvìØQTT´téÒ[o½5>>þdw}ÉO>”^)úÈÔ?¾?àS—Ëåp8œNgOOÍfÛ½{÷Þ½{§OŸ~Ë-·Ìœ9sðqNyùoYYÙË/¿|Í5×,\¸ðGûCå–””üæ7¿yꩧ¦M›¦R©|Gd|–;w¾ýöÛ‹/ÎÎÎ 3:N¯×k4ša®ð¡†ùˆ‚Ò+ÅDgX«°©©©¸¸¸¥¥¥³³³½½Ý`0$''§¤¤ÄÆÆšL&߯àô¢óþÔÓÛÛûî»ïÚl¶?üá‹åG³’ÿAxùå—NçÏþóÄÄÄa®çdsIkkkmmmEEEEE…×ë5›Íƒ!...---<<\Ž¡ –%S J¯?à¹ø³ƒ$I[·nÍÏÏW«Õ!!!Z­–aŽãÒÒÒÒÒÒ8Žp¨3"Vß‹œœœO?ýtÊ”)×]wÝO·øü|ß¾}yyy^¯÷Þ{ïeæŒDáÿ©×ë-,,¬¬¬”] N§³³³Óåreee-Y²Äç]¥æ*¥WŠÀ𶶶~øá‡ï½÷˲wÝu×Ò¥KµZ-˲r ÞGR§Ï§Cr™üÛo¾ùæ½÷Þ{饗ôzýð íÁ³ò)Ün÷¡C‡žyæ™uëÖEEEÌQ0Œñ>`ÊAEI’¼^ï'Ÿ|òÏþ!ô‹_übõêÕf³ùÇM9”^)ÆÕzDQôx<.—«¨¨hïÞ½&$$$;;{Á‚þöéi²Òé_†Ûí~àÂÃÃzè!Ÿ¾–€üɺ¾¾þ±Ç›?þõ×_¯T*uòkdzwïÞ}ûöuuuy½^«Õ:þüôôt9Yb°™؉„‚Ò+Åh¡Ô¶¶¶¶¶6·Û-§÷úhVVÖ²eËL&Óè䟈Ž?þ駟šL¦»îºëlVa ÿ¼$Ijnnîèèèíímoo·Ùleee .\µjUppðéx!((½N,ö<Ù ò‚Ün·Óéüæ›oÖ­[×ÐÐpã7Þzë­V«ut§ÁWÒÓÓsÇwÜÿý³fÍÍ~€¯àÅ_ÌÏÏýõ×Õjõ(Y€>µ×ëýÏþ³nݺæææ[n¹åšk® Õh4 …Â?L7d%¥×qn“i¤´¶¶¶¶¶677=z´¡¡!((Èb±ddddeeù¦Fí8ñ f‡Ãñá‡æåå=þøãrêÕè_ÀúÏs¥¥¥Ï=÷ܼyó®¹æYò£ª`Àeäçççåå577···ëtºÌÌÌ”””   ˆˆˆÁm¼ÏB¥×s3t}f…ü¢­­­¤¤¤«« cìñxl6›Íf‹ŒŒ\²dIzzúþìsìرÿþ÷¿aaawÝu×Xƾ ~ë­·ÚÚÚ²³³åö]£Ä ¾1BggçW_}uàÀ³Ù-ï¡R©SSS‡÷>QPz†jIIÉúõëwíÚuÁ\rÉ%‘‘‘r-¿Åbñõ‚1åG󯉪¨¨¸÷Þ{cbbÆ®¡äc®úúú-[¶ìÙ³çßÿþ7ŒÊv-'c[ÇÓÚÚêp8d/ÓvìØ¡Ñhn¸á†•+WhmC“(½Ž1bõWY‡Ã‘“““ŸŸ___ßÜÜœ˜˜¸|ùò9sæ€Ügú”HG?Ùíöµkצ¥¥ÝsÏ=#Ô@à\M¹¹¹þóŸzè¡9sæŒòF'ë9+ïsÓÚÚºcÇŽÝ»w«TªˆˆˆÔÔÔóÎ;oÒ¤IƒI–‚ÒëèâùŸr%y+'·Û½uëÖ?þXn§´|ùr‹Åâß¹nìš þ,#IÒ±cÇžþùgžy&22rÜŒÒ÷xï½÷N›6mÕªUrñ}ï¸Ýî‚‚‚ÿûß»wïÎÎξöÚk322X–U«Õ*•êd­l)(½žmMQsrrÊÊÊBF›Í&7]¸p¡B¡8}×ÁØâîîî·ß~›çù›nº)""bœENÜÅ{ï½×ÛÛ²zõêá[ÇŽþ•?ªªªvíÚÕØØhµZÍf³(Š.—Ë`0Ìš5KnC>@ùf#Pz Õô×ÎÞÞÞúúúüüüœœžç'OžkµZ£££-‹.êxòmùsk^^ÞË/¿|óÍ7Ï›7owØóôÝÝÝ_|ñENNÎÚµk£££Çút2€pEQt:6›­©©©¥¥¥¬¬¬¦¦&11qîܹiiiV«ÕgÕRn¥ôHËŇƒ¾ùæ› ³fÍš5kVBBBDD„N§S«ÕþKªñ·¶@%¯¼òJkkëïÿû 2Ø|ƒ¢¶¶ö‘GY²dÉ7ÞèkF>vs$†¼rŒ±×ëõz½ò&@‡.--]¼xñwÜák«8xʼ”^‡^4 X¶{<Ù…êv»‹‹‹·oß¾{÷î Ü{ï½IIIã’C‡·Xe)uvv®_¿ÞårýÏÿüÏ„Ê£`žßwß} Ã<øàƒòn¸ãÏfrÎؾ}ûßþö7»Ý¾lÙ29ïE«ÕªT*F3ؼ ´;éuoƸ®®®¤¤¤¹¹¹««KÞ°/&&&111%%Å« Â,†ÙÖ­[wìرzõêììì Ûoß×:¶°°ðý÷ßOMM½á†ä*¯ñ*ŠÁ·V[[[^^^[[[WWaaaÁÁÁ±±±)))ááá'ó®P’‡ô:ü¦§§gß¾}¥¥¥ …B¥R1 ƒ1ÖétS¦LÉÌ̯‹ý3]<:Î_|Q­Vßyç:nÂŽ“bq¹\üq]]Ý”)SV®\9êPßšËåÊÏϯ¨¨EQ¶Q<̘1cîܹ¾Ð.­·Öëà'ÚÑÑñÆo¼óÎ;×_ýE]$÷ÙT*•Z­vppbši2Ytuu]yå•ëÖ­KNN¹¾¨cT8c»Ý¾~ýúòòò¿ÿýïMUüoVE·Û-!ÄívöÙg7nt¹\·ß~ûš5kç{MLEÃô:øQÉ}¦yž—$éðáÇjnnv¹\F£qéÒ¥ .”“l¨ŸèdôñÆoìÙ³GÞ8–JfH}“÷bغuëG}ôØcÅÅÅù&¡‰lÚûlÛ;vìÚµK’$FwÞyçM:U6e—ÕÀx¯n{ô:ø©tvvöôô¸\.‡ÃQQQñí·ßÖÕÕ]~ùåW]uUTTÔÉ™Zdþ㦦fݺuÓ¦MûÙÏ~£²*tT¹žäv67Þxãõ×_ÁÈj6‘IvÈÛ/--ݼyóW_}•žž¾`Á‚ØØXN§Ó邃ƒýû+Žcž½ôzÊé}ûöíܹÓãñ$%%……… ‚Àó|DDÄŒ3ü[MÝùT~ꩧX–½øâ‹}Å tú9†€M›6555…‡‡ûOK\,ƒ…ÐÞÞžŸŸßÞÞ®V«Y–mii©¬¬Ôh4—]v™\2>üª”ÒëÙ0T»»»+++=š““ÓÚÚ:wîÜ /¼044Ôd2FŽãL¤” Niq8Î{î¹çâ‹/¾âŠ+|Q,*·3bX‡ÃñöÛoWVV>ù䓃Jo®$„‚ÐÛÛÛÕÕÕÖÖöí·ßæååEDDÌž=;333999((h<™Dç˜^O¶´ïÃ0EEEÿüç?¿þúëY³f]zé¥S§NµZ­¾ÇàKö¦ª|FÔGŽyþùçŸxâ‰øøxJ¬?‘g¯¿þú»ï¾{õêÕ²Nm›rz´ÛÕÕÕÒÒrôèÑíÛ·çää,]ºtÍš5™™™²e£n„so½ú Ún·Ûl6yÇ!»Ýž——·oß¾˜˜˜o¼1++ëŒü>ÃH»££ãÀ[¶lñµÁ¦Ü~ì±Ç‚ƒƒ/¿üòääd*ÏÓ™ã‹hÿþý6l¨¯¯Ÿ;wîìÙ³F£R©Ôëõr¾íØï£Â9àp8vìØQXX(§£êõú˜˜˜ØØØÈÈH¹kÐŒåÀ©unnî† äæIÔ‘@ÙÊÊ™ŸŸ¿iÓ&«Õú›ßü†JõL—°þ„ÛÕÕÕÔÔTWW×ÐÐÐÓÓÃó¼ S§N½ì²ËT*µ^OW²7nDEGG‡††ÆÅÅ è;4K9 xú駗-[6}út*Ï‘ „ÛíþÍo~óÐC hCEñ#HV†  EEEiiióçÏ7Åcvï,Y²$::úd«~ß?)üDH’¤T*(±\}ëFo·Û©dÎT†0TB:!D¡P$$$ÄÇÇûêÄƘÑ,hʧ#-d*^*ÒQζcšú )((((½RPPPPz¥    ôJAAAAAé•‚‚‚bŒÓ«e긹[ù^Fs*êqsûçÞÏæ³[g9)½Sµp¨U*_…ܯsævœ5Q³,«ÓiÏBÑË(¬;›|§Ñh´mdzòYV!£Ñ¨j#Ñ€Ÿ( ‚=EÕÖGÿ³cç7ê‘ Ö•—EFDhµÚ‘ÕBŸEš IDAT ½ô÷F§ püxѳÏÿM§3ŠEÅÅi©i Ë ‘TÏŽö¶½õÆH?Ó3EYYÙ+¯¿Å "I!«TªÃ‡GGG›CÌ˜à‘’1 ÷>ñøŸ¬áaç\°’$ÝtË­zcȈ Z[[ !Öˆ¬Ãa¿ûÎÛ²³æþÄC WµÕÞÖºã»üÐù·‡„èä{‹%<²…µÁøù«–—OJ<Ú¸U’¤Ý{÷¡¤Kbg-”$iD9+JxDO¡Rkë>ywãÆ7ÝtÓ¨’óW;¶k¦® Q „\±X!IÆ`¤f1Ä0¶ª¢?ÿõ¯<÷ø9ì÷{¿ëD–)W=Â;í#wËÇ1 ‰ÒH 5Tmüb׌éÓÔjõHÑ+Ã0Æà`‹52Ølã®$Læ0ŽeGáµ!„´Z­%<,,ÒÚÇ®cWÚTj0‡…k5£NÔZ6Ìm ê,Œa!3 ®o§~4\ŽR©´„…Y£‚¼Ž @c\°xg'¸ ?ÝÝÁr&X"¥ƨ³žHàõ‚!xT_'Á–€aǪ´€ÇE0F„`£q&Ãc „NXÅX%I,ÁxÔ‘‹1A©t0º‡ÚÉÕCILp@lãÓméR[zdëÛOšB#Ç\<!&ÈqÙ­ 3…Œª B¤èà®=›Þ²DŒ-ŠE ëèi¿éÑ!Ä ?gŸs3,:°mc命c‘¼gÚœKæ.½aôÀ²¨ÝÖ°áÉ;ÃãR0–Æ–`%I JZ~ë‡WÝÓWàÓ¥W[Eáù—ÿræ%+D~Œé¢B_x÷*B6^Àçßdf´Å¸µE‡/½ñ¾Äiçaq,‰Zk„žy¤¥¶4qj†lŒû‹!4z6UÅ"¶w¶^qçcZcÈX3 ÃV—·ë¿¼Çå[„ûûëÏ­JsJ8¾oÛ¬Å×^ô³›¼î1¶òb9xÿ‰_#PÿZr@ äLwP>]zeX€4]*„Ër²^b -èì±Ë$+ï3‘––vÖrhN,§‚Çž´ 0,‹FVÄŠòŠœÃ‡ž÷ÑktttLLÌh2ËcOŸx†åB¨££ýXÁ»ÓubHsܬY³Øsc ,ÇÉŒg„Ë)ä%oK[ÛÁƒ9Žó³m¥©S§šL¦À;üÙj µ#€ôÏñDQܽ{O˜µR6¬!J¥Òb±Œ6zíEd,I› ~£Šã¸c¹ÇŽÃýó?!$+++&&fô¬ÈXÓç>ð3¸›š¶mßæåEY¤ãàààiÓ¦±£ „;eÛ?õ2-ÍÍß~ûl™ÉÚ«×ë-‹Éd ¼s`Ü@’$IeëUþç„­,qQc,‰¢¼¼’—«¾×T8ZÎ`"‰’ä7‡Q}ÐÜ@$ ôi¬ÝDàãM/T•AqŠÁOÉ”ªôØ—êméBAAA1" ôJAAAAé•‚‚‚‚Ò+ÅGÀB[r†Ÿcœð¶nƒD }"¦Ûk„´¨4òO¨,¾¡xDûÁŒIzí“!€”ZP¨F¢x/‘å… !4ŽQ#BbÕ RƒÜUPäw‘¾žc ¦9Ä€J ¬ïï,óMŽÎ•i —”)´ TB@0ˆ^à=¤ d®êzí—vÕçlx¾(/WE¢ O½ô73/Z¤@@;lušðxÖÏøêû?5m„¨1¬·j뫹_}êtóTÖÙ×Ͻêæ`xZÊ!(Q­dá„5Ð'åqfŒ¸œâ;K|ü׊â‚ «ÉXñ‡Ì9³":܇&(Œa• Æí)ÛW¶ïi.øøÅcû¿ó R„$^ü«9ËW¨º 1ñ쉞fh쮀â{%§ä÷þeeEgÒe|vÍŸ·^ùÛ{[¶<ðý¶m˜"6î~á>gŸêaBƘƲ¸ Æ}½¬ú“¢ûÞÄøÄŽ4“¾:`Üÿÿ×dbØ„Rè¡ôÍkwn/ɾç?×>±åg­Ó7¼¿ý•'\”:Èy溆6'ƒ€L0EMú†¾ŸTûr$}¢öIž`9;`Éï;’ß&„ùŠÝõ»ÿºÆºtå#›¯~|ó%«–­ÿݱ£¥, Žš½¹_ñxBäÖ Ä׈‹ ¤Ožý²ëS×*±üó¡Tºïñ'X„Cz¾{ñùe†¥|~Ý“Û®¾ï‘žÝnyy¤p•myb­K¨O¡+~H CsEŸZC¿ûkõ¸â¬‰• „&"ÄcßSU¡¸èáßFÁíiÁ¢û^*-wóíµyïv»¥Úœo“2϶ÔÛ3Ìäp›89ý¼ÈYS•Ÿã$,àä¬ØäB@쪨9šãÁX5=1}2wKñn¹v‰·K\Dlrxku¥(¸EdŒ>O£æ&‚eF ±æèÁæÉ¿{=-%´·™<üñ¡þëéuÖý·Þ®ãŽmb.0)k—*B[+ë˜ä¬ÅÁZ{mÞ÷ÝÝvÀD–7e6Ç âíh,ü¾»Û‰°ºˆ¸iÙj•ÒmÛßØàQ)9ÁÓív’ÈŒé|{Óe÷:±cÝë<£PëÔ5;_)ÊÏ%M„rˆl\Rº±jóŸósÊ0ÃaÃçþü.³Q¡d<"b”z“R«'_íßðxÞžB­9X£Å%ÿybßçsÆPƒ‰+ý`í¾ïr5\õõËû¶lQ‚tF¶þÛ×òæ° ¸ë·îz÷ÅÎ^§6$Ä[ñ¯­/ý©©µClö4î8°y½wŽ,gNŸ–ìÿäÝŽb@ jÁ sæfˆ8V…Fk æXÜ]ôæ×ÿzÃÎc­A-t×ø×£ mjCÃ7xçO­-êÚÿÖÚ’‚"ɢ׶xýþªÚv5ÓylË?¾ßüèCªÖüûêí·ˆÁd0G?üsE›—caü©´,XVoŠÔ¾ùçÊÊfÄÐ'žŸuÍ­AZ‰c=XµQ§R)ÛK¶ø÷UU½ºà ²ëð[÷9R«·˜ÕŠîÜwî)(s«öòmO;V© 2ª5RÅÖçŠK*€{Éëß|ðf›Ñ™-Í{ŸÝõ¯¿vvó‹¹~硷*±€ÐY’l`|¯@ˆHBçßóFþçÿßÞw‡ÇUíϜ۶«wÉV³d[²Ü‹ÜmäB/›^ ÉG !„H!@HÂ/„P Õ¦0㊠î½[–eYV/V×îÞ{ϙ߻*6æûÌÉh­û>yò˜ÕÞݽï™ûž9sæ̼¸ô׳%wJ\Ö˜”aeåçKîØ”ìTd ɹ#l20›G²à š¾|æh¥÷òý,% @.PZí\üZöß9xþSù™é›Ý°eñ½•Ã/‰@´Ç.ÈÈ›Jäk:¼¬ˆçgŽž‰\o=ðIIåIÓœ Jý ´ˆDz;æÝýŠ´ôùm/ܾžÛ¢3F'dŽË.¸ÎmW²£ÉbOŽŠ³ûO9%o{ú e„ƒ^½{×ÆÕ™÷î7L„丆מüGÃìƽ㲙‰Q1Š)ÀÞxxÍ¡ƒ0sJ6wÒàŒQ3Ü»[:zèß;Ò&\á–ÜX_üî§-m ÙûÏ’{ðÄïýa×’—?zørdf|æ¨Ôñ× 6˜Ù"¢¦•Ôðä¼i#djØIà nWÔîz£–2.¹ážh7M?))<;6÷¦¿„%g:lÀœ-«^>~ôØÈÌDYÓ<™“'cúÁ¥ú_6lÌ$ß²âÕcÅÍyIv“_p&ˆ½ª‰S¾÷Ô¾Ïþ¹ê‰K¹—5&aÈŒ¼93dGT\z:‰ãI#džù RuÊÞê¡×Ý¥@óæ4®úã'D“fAýÁͯ?;ìÉL»?;)Õ©€©ƒQ±ûÈ¡âa#³™ì0<#¦¯xé¶=zJþ¥N»ßÚTµË¯_k?_B$f #i”æO£jßÊýŸ½´éµÏKK<óúyÐK"abÄh ÈÕ'ª‰·m}ùg»Á`¾ÆG[LÙfì_|ßmÍ~bˆä­uféÄ€˜æöAŒXxxd2™xGE¬~{ d°0GÊðù¼ZJ÷\þÒ‘ÕÏíÞ2÷Á?Å# @¦pfÇE7¡íT¥{鲟}¸Ê bÀd(­l€LGÛê¿Í?QZƒŒ‘ÑJƒXÏhöpIRAÉa.—GU%à@¨!ˆ­Bÿà€…¥Í¼è™ŒDÙöÅûW/Z÷Ì5·¿4ur è  æŽˆ•€ÀÛ\á«ÞóåóI( ¥¼Xr¶€d“ÛvôÀmÍ~`Œ‹H Ô™æ‘F&ª1¡FÇGs$I‘¹_G¼ M:¸`5áÎL”èÔáu{?}~ßËm¼úšß>Œ±r >ŠœfÒ¡¦¼EÓ–’P²öÚ l«nö‚â?¹ì‘ïÕ5µ! ð5xfÌBÙæŽSˆJ.ͦh6dE‚Îç¯ÜS“×[ 6‡ÛJlÞÅsò/®ÞðÆǯ}X?ó’¨.@IaÀ˜âNs©]´“m¶°hV´lñÓOdÝø×¼QÃ5—²ýɹ'º¢âÓo7f„éÓýmª3JøÉ™<|â½ÏŽ¯)^üÛÛ ·ŽÏÇÓÈfëHלâ†_š`kåPR²¦ªazÕª<Øš<ÿš»¯r†‡U-ûíGü§Ošý4ûH­\€›K7/mÚ¼âŸèqO³Ó²Î^LM5GCqÌ\[òH½|å‡Oþ>ûŽ—/=ÄißùЈêÎV#]ë"ì¶ÿs[87Ú ÁlšÝ4!<{Ú¬1Óšw¼ûö³Ïïü^šóôp¥¤°`“P 0zŽHêÅ’¢*§ ׽𫈩͘8YSáȇ¿*ì¨ößGæ¦ÿ<öJDÈ4hÝùÜÒçžjò‚Í Š `€)PRT&É@e'0©ë%ñƒšíÞÈA“†Íš3lÎœø8—ìJi+/#WRδñaÑ6l´em{SƒdK2ï®ì±ÃA'¯™>ûáŸo_¿×ï5XâÐŒ‘шòé7çéÓ–í^½¢ŽœÙóŸË›«s˜v×c»–.¬<¼?eÒ÷K ûðï ÇŽ%MÈKÎòI€lONâ—@qÅ'£Éý…g%b茕lþ¸ìèa_+ºŒºíÊè¨HÎ)jèeã.­>Yê“TÆÇù’™#yÊþytõ[¥Åû$wöÔ»oŒOŠ˜tÝCo[±¼Q\pëªQPÿö‹µþ¤aÓÃã<$€s9nøt5Ühü‘= c즸 yEZÒìG?>ùå»ÇöïnojµE É¿ü7é™ñºŸ´ÄYçí+)«59ºãG¤!È4XÞ‹"6¼Z¸{—W‹›öÈÂÔnî‰wÿmïŠw+Oøsoùg²«|ëâ7ןJJÈO`@8rMI@Zò˜›K )yÅ`|€É¥SnN›˜4€ÀM†H”qÉCY˜~€¸ŸÌšz»dŒ‘:pú]é¦ÜhO+¸èž‚À+Ã/ú¯ád‚€Y@ÀM@PR§Þ‚¦IÈääißM0~r"‰ˆ ³fNΙ8ŒÅ9p] é",÷æ¹£@ÀÅðKïÃ+2 ]¸2çÎ:¸Üîìq·üLF΄!˜Ä ÃDd‹ËŸ´ ßðÙGL¹q„é£ÀÉÆ ŸgP"3fÜž5«Ë¤… D %vè•ä20}cï‹E0€#J‚Eg_rß €À4@˜DŽÌ‹ †^ †À>hæŸâ&d/&pCpÃ>ò;¿  .0ûÚ_1ºNxz ÁN«~$L˜Ÿ2i~à 77ÀÐ pŽƒ.ûé` ¸„7ϺW2D2 Jš|ÛÀ·×Áä„öø“²&Ýý8˜`Òà ˆ(~Ôü¤±`ø„OþÞTÃ8çêäš“[U綋Ç`M®ú " бΦ¶ÜÀÀ%ˆÀ8é^ìŒOëÞîßDÈÀn 7º1^𠤇Î< ² Aœtoðº—vˆ2uÜYDÃœ™ÁìØÙ<ˆ ÈðÄIáì'>»nRt™tÇZ-ÈU‡á™$‚¬™4õàQN ¼ŽÝ™Ð}Ü d00}-2á'xù´éàsŠÂÝ8}ÁHB'Þ±5¥›ÔM+º_B¬£ˆ‘á ŽA­ £ƒya’0‘‚0:F Ï“7Öc+=ìâ¨û ]»xxú: Ï ø̺/§ÛW‡uwû8ËEvdð«´œMºþÝQ„¤ëOø5ïÿÊ÷t¿¦ž¤?mÿ,¼}•ÕNÚá¨;Ãäñk>ú›¸¾roxæíwqßiÀ_ˆ³ Èך÷Yì¿WaÕ{µ`Á‚K^-X°`Á’W ,X°äÕ‚ ,XòjÁ‚ –¼Z°`ÁBÆ7KÌê(¿JwHÿZ 5¶)ôH9{ƨ A!©=nÃç.¯äp»ÂbÀð‡]ª’¢…Ö£ÏsG†‡E7C‰jghW¨ôŠA”‡3¬7ÔÞI¯ô¶9“û¬I3,<,üí!6oI2HÅΫ¼J²ºèO}øWïL l^¯˜ Ú\á=ËZo£µ±þ™{¯MìÙ¿·ü&I Uec ôý¹ ki¨~óñzÉ0QVTÃïï…Åöæúˆ¸dR_d–@³9Þ|âžÕ‹þÖ­0PÚ.†½ñÉ „˜‚=1=yE!(gâ”òcWŒšyÃZ¾¾¬h+Þø³0Í<¢ÖÛ°»<×þè©Ôœ±‚ó¢Úæ [ò£†îíûåˆÈæôL¼ü›ÓÓkÞ+³"6Ö–Ÿ,ÜC}³°9‚¡ûfÝø“IWÜ®û½!å¾cò'/=Úƒ¼ž‹âc(88\aq)ΰ’WYYÕB«»)2)<&!2>QˆP¢Úá»ËC!ñ£‰dEKHÏtzb ´€`sÙ+KŽôÙ%‘pGÆD&FëÞ«³Ä$PTí[@WÃÛRW!¹³%„ (­2T JöABÎC¯3£¼Ïƒ B„·„=,Vb– ,ôŽ;lQ`Á‚ –¼Z°`Á‚%¯,X°`É« ,X°äÕ‚ ,yµ`Á‚K^{_›ºßQݾæ/;·Ü:ãDÖ8žNÎÙGâ4®Ï‘´Î·}£«.6ÿç>«EÓÿö–¯ÿ¢~cÒÿ£V| í§qôÍ("¢sÏ>-¯ˆ@§×yB’ ˆ(‚maé+—¡„ŒºAž SH@DÄ”@pêŸö¨[Q""&c(ÄÙ©B"IF¢sÍ÷F$"0†ýê@âÀ£4i $Aœ•ŽõB  ßȤ‰DÀ¤¡_ð‹3´B&[ÉÒ×<ø(¡Ä¾Eqc*2€óßw·gá£Ùzrã+?-.,•$‰›^PÂc‡ÎÛÃñ0øéÏtEdTï\ŽÉ£c£¢vꔀeîà ™ …Ÿ¾_p›‹uÎlýìÑ'ýøšß±h‰dw¦‰é†_÷‹ÁÑ~ƒu>¨ýœÐWs°®¶%!{¬$±.Ò:¸>“j d2ÖíXl$NIŒæݨŸ@Á#ïþè;%Ãß&9ã“F\:úšÆxÐäÝé ÐH€6Ö´ñ…†è«ÓÒcO;!L§½¿“u@ `ÕúWÔ¡7F„Ùú…ý ߦgo;\X*KŠ0Û8sÅ)3ÿ¾ÄØðÀq/Bè&( ñÄþf?$e眬Óõò4{ïºNøŠÖ¬‰55ÌîìzSÊ+‚ÞâñÀùÀ¯âðúWùøÞ9sŸþ<) ¸Üôû€¤Ø%D¼íÄÆ%ÎéI‘n—¤jDÄõv!€)š$Ë@à „i: $k6 !ü>yÇ1ù&§J(ËýN[€ûüñs~yù-WKÂ׶÷Ý_®ýå̦_|1vh¤aC†sb²*Ë2 ˜ G7?Þ5`¨æt1nx¹ÉQRdUê„é÷ IµKŒôãk>P.ÊŠp£¢ö7ªÁló~rǤTдعæo?ùì |.ÖƒD„À ŸŸ%Å.ID2òþ —äI 30 ¿Ÿ:l ÃAã~Ó4eYU‰ŒšCKÞLKº,Ü­²~Ðö… Y—=<õÚ«d£±rË«-ûí-s³01Æ%„©ûR K2‘ÙVsxM­—>X‘$D0ýíB“5Y•I—ÿHÜðû˜l³ ÞZY´î)3Ç©j’$Ob{Z^ û¼þVâ,jðì_^ý›+7/|yÞ}ßU¼µ…kÞ=Q|’1&‡gæ͹Þã«·½Wrüˆƒ^óVN5snù¦W‹cŒ@M:÷æèèpÄÛ˯|£¶¦ApŠ~̓ —?ßdz}ôWïˆK2s†’ þ¨°dxýí sŽ¼õϪùýuÿ| û‰…©þòÝË ·m’hO›zCJêoÕ¾}ë—4ùöÌGÝðcQüùÞõ8©Ë§\Ÿ‘“MœxéÆW‹ä¦p¤LÊ›;¯}ç{ÇËËí^çÕcóæÌ“û%Õ¦×ð·)~“äØQsóáÊÇ®=´jqÔóª;¼zaeYpS6´`A”G*^ñlQ£êÚþÆAùÒ!c†­^xâx¹ÄP ÏÊ›;ßå°!C}áÁoœj2¥ä‰7 ÊLØ»ø÷'[@ÿüò%w%&&öÁÐõvà‚Ж0égOßøÅ;ÞòÀÍÐÖRºùÝ¢ƒÇ%HË™}cL|dÓ¶·lY!äø]q¦N«Úñö‘]»‰@HQƒ nÍu`fÅÁ•‹*OT”£³gç̘^¾öåÚº"XòRóä;FK7Œóç½öZæ""’A:‹{±\k IDATõ̦ÃZL8úÉÓ›VïMŸv]Þ¬«Õª¥+Þ~—iJä \·Ç7êòì#ëw¾¸uÍ–ä±—æ̼2B«X¿èÅ6G†EŸ=Qx¬}ÐÌùCóÇxëÇ»v–¤ŽÊnK›6/i@2 èŸÞkPbäóCÎÜ9Øx¬ª¶©éÈÊ5¯ýÛ3lvnÁ¼ÄHßÆ7þØÒîÓ"SÓ’œ‰Ã‡L¿BiØüÅ¿ž•Æ -¸.3/uÏŸ—”62 [<¿þÃÕ‰“æçͽ®uç3Ë_}'2'Ïa·Ç ¿${ôDÖo©ÆÀ:É$N®¬Iùõ's‚âϞؾvê”ùÃf_ÇŽ½¶ú­ú‰¥ %ÄæÌ”›UôÑ·n8œ9õÚ¼‚+åÊ¥«ÞûXRôêÝï<^Ï2s æ¥ç ØõƯOÔyÌ‘6ñêèèÈþÇ.'ÝCf´íx¿Ö„Úm¯nYµ9eÜ%93¯ŒO®çUŸŸÛ³¦'&†…gŒÏ1Úüí/.Š~Å°9 #×¾ô³Ê:P48²ø·;¾,ÉœuCÞÄQ޼˻bGNsh®S.KK‰3MeïõtOÈ9q¤¬ïj¬,/Ú¹iÐ-ŸåŒu˜qq?ý÷}V|çÖᱚª¹b„E…üçG‰“’ŸQ ¥OþwMUEZªíø–ßû<5;ŒóQ—ýz,Úâ\P${Óœ¦ Ä~+°°?"qÀ˜Áîmnn¦ý«ì“~8œªkj)-ùô×7! ð7U…O˜BfkU…ÇE“ÁIõ$¨HÇ9Õýn2ÚëPs£YÕÒ¦4/¼åwrîRZZÛ!Q@Ÿ×Ë%ÇÑ·î*{ È0yiE-8}ºU™q†²+&ÈÌI"èÜÓéOàm•&¸m ok5Ê?ÿSõú¿ ³¥öDmƒ™Œ®2òW”ùN5½¼èÐ" ¯!ÂõzÃçhmÕ&ÛÈ!Ð3ŒF˜sO˜éóò̶@EƒÃŸ~¢¤^åÌö¶Aß]8r39 S$ ÁovZ’¢Ú”¬Y÷?ÈD”˜,#S ¦†@@>ÁT%°^ë ÷öc¿‰eÊ?[fxRâcbJ}¾ˆiÌ-Ã9J’,J>Cï4eUaai“ î~T­(É*2YFݦpÝo"™¦aHêiÞ[¿Kè´ç€ú!2á¯ÜµÍpƒ¬…IÀSoý×ØdÓo”Æ$”dÎ+IŒ ¿oÈwÞÌMV82Y’ µ6(( @¤} Ó/˜­{k$ìW P>I†ò«(ý’D‡q” cî#ÆŒFAf² £Ã€5‡ñïš}ñ]÷#2&+LRP?"˺¿0ŠQ^N ; –äyó`{:öŠ—ÓŽŽÔ$ïÑ·a«>òòNw„ÓíªØ¶Öç OtÉ­»·-[Ž* àØÂìžð¤¡ •E%¶H›;ƥʭûWÜæõK‹IÀÊÝ›™ nØóö/ö}¹•dI:s‚fÃÀÌÔ?¥•iG88ÂÐႺï­\¼!ãâD†k®ØÔ¦Ý+¸ÓçrÙZ­ZÔæõ# .dÍæ„”‘ÃZJ‹ NžXWX¼³tãe5¦Ð2&¤Vn\î•!,*7üõ‹7ÞàšFÂ$Íípuä)÷;i%Å­8ÂÁ‰4^ò§CÅ•?U¶gÄ tWo[%G9Â’\ræݫ>Ö9 !UGDrŠÛe/߽řà Op±Ö=Û—¯F ÑÉ*;QîuE "µìxãÑ“UµB*N—ªö#ïU¶ÙìaàG»JWÿu˦êñóç)‚E¥ÄWqD;<1.5î[½Ôà‘0A‘d MˮݻÝp(añ.—Ó8°üßÕÕí²s`x¬»bÍÇàA·Ëܽè—;¾ØÌL9vGGVx¨z¯D¨ð}/þ Ôåä¦××Òè7\ù¿|{Hfœ0å¦;?ó§×^®Ôí™ñ+™€”èÈØð-»«rdÁø9?;ùÂýbk\‚§îÐ.÷˜»‡Ø5{Å>{ù‘÷ …æâoÂŒ+&(Žãa§–>üƒÜ‹n1e*ˆþ¨® ‰ÊÕϼ[ø>×[ê}^>pÞï']4>ùšâÝ?{ï‘ëÓÒ›Oì4§eL“%WtzÕ'ÿX\½yÜ-ÊÝüé£×%gg·•ìô9‡Mu3o‡äËŸòüñ®÷Ùå’ÛêÊ›‡ß÷®]qDF»·?wÏ©‘“ÆÍ¿Ï&õ7–¡¹ç/7Ÿ°¡éoõ¶µ‚6æîgÒRã…cn~xñŸŸx¯l©[3jKG}@³ÙRc]´ãÕ{}e7ºö®å/þáõcE‡ËÕ…ûâç>&sà‘Ãs¦_¼ù•ë‹—S‡Ì„9C#"ЙãðYþä­#çý<;' .ü7 Þ^üù³u;ßEáokl0…3çŽ?ÉH4²ç~§â…GßúÙÖø„ðÚÃÛÃ&Ü“+I䌰ýÃÇ++/¾þ/‰nüàg·Ä%Ç7Û."ge\â“oùá;Ï<¹¨ìCŬ=U‰37Q’j<‘|õ£·N¹¯àŠI†ïü-¾zX^%{̈ù¿moõ"’-þvMù©ðä„~}A5÷Úß lõNH¶°ðä,—Ó.„%nbÁƒoÖ?ä×EvÁÅ$d2ù¾9IÓ¹-…)ÑÓúA]ñ¾övoÖŒ»ã2IB˜hÙ7Ýô‡iUÇqÉ9Ê© Äq·=•QY¦Dgsý¼N[=)¯DÄd{L昮  ¼Ä lqIyqˆeq@†D¤x“ó@p’í‘ ¹“ƒoîŸ" °E¥ˆIÁ  GB®+ H€ì+`KwgÎØlw|v7gHcÁƒ.1Ùb1Øp,¸1%»båÇ"NZdúè( !2`¶¨Äa“;¹œÈΤ”¼¤Àˆô«Ô""t'Ž˜ŒÝc°†@$@r&& O ÐE:2Äœ©©£R‰€8#>qx|‡Il8WâOòùï²Çæ¦ÅëBo!“¢2ÇDŸ¡‚0Ð[d‹ê&ÁЩlH6 ']±ƒóƒgñ2†œ$wrʈä€V€9b3]ñ™üüÐÌDgz“]q¤ÀxÇ°ã*‚`s¶3ÞÐq!$€wÿ˜®«úo¢P7NºSÓIJ÷±èüKÇ‹gi…îCÐÉmÇõ/²ñLƒ<ƒÌŽÓ°]& »;Û'tnÊv¾Ó„ Þ{ý:­À¯ÑŠn¤_<óºÆä+Zß–VX -X°`Á’W ,X°äÕ‚ ,yµ`Á‚ –¼Z°`Á‚%¯,X°ÐŸñI̲z[OXl[ wG¨$ÆQ¨qÛÄž»¼c²j×ÔPkT¡¨€RˆäDÕ¦©ö¯¤µömhve5„ž'ͦjöP› T›†È ÏžV$P4M³‡Zî.‚$c=¹ —ÏÙY]Åñ ½bs¸{ü¾cÔkeYdYjª«ìYÖzºîݶü²£û„èùb L’HðÞ [³k' w™}}Hh«¿­uã’·›³w>%Y1;J”õì'·4TùÛõà馾IVöoúºÞÖË™¦ÑòŠ 5ÕUõ {®ò*kNgXÄÁ+T»B „È"ãÈjÈ8°$ )=gù®+?Ñ S²ÞY³c²·½%".Ð?¢OƒIè ‹<¸eEï´dˆ‚Do|¸ßÛ:lòeŠÖ’Ü€ÔÜñ+ßú‹0¹fß~àPõ±Ü4âfõ Ks®òjøZ4»û»¿Ëéq…Xp@ƒ·Ÿþ•î3lN%4Ö( ªK‹®ÿé_Ò‡fèÌc.¼õ‡GkËŽ¹#†öñ_+Laè¾[~ùœÓrÁS•¥;V~¤ûÚû௓8ºk]ÁM÷Ϙ³ßzÁ×ûѷཚ5pCçf(1¨OŽ¡¶;„Œ™†Îu"”¨6 ÄC¥*"rC7ЫügšºO}ñwcŒ›†i@ÈqK¢‡w¸¬Ä¬¾®Y,XQXòjÁ‚ –¼Z°`Á‚%¯,X°`É« ,X°äÕ‚ ,yµ`Á‚K^{]gŒˆ:þGtÚŸ,ôÙÝX?j+›«LºÉÔ[<÷ÃÝ´â Ûuôh#nD$"DIFI æç ¹‚óè+Y»D(!;•â¹ "2 „IÔÿznŸ˜ Š<}N¹œ:?~…jBÂ@Ǽs·_D©ÿQ 9hÒ*Jr§I7‚-HÏ2é!JˆôMú’vŽâ~7^@"dJ—V‰¦$í,G• €Á7Õ ‚Ÿo–{Ø¢Þx|Ãû‡6,kjñKª'qÄÅCfÞ‰†~6›!@ÄöêpÅ9ìç^¼ˆ¼•ååÞøìt4ûE[øîTw<õ¢îàÊ+ß©¬¬cLKÍ2ëŽôÌ(ÝKȾÂ4ro}»×ïŒL`çff«€{+–Dg‘x?¢:@2 J¼áèš…‡7­ikó2-*yìU¹Ó¯ s3Ó8ói%$B õÊÝ^Û ðpç9Îdž oc{k»'6ûƒ#Jh”m|çÀúOÛµ˜ÜÙ¹7EGÙ…„34À­¿¹ÞÏɃßä»À[YYåMOEq^ ˜õ 1÷Ön{íþ5ï~šqÍ®|äßßyÛ¡EŸ>vÙñ*¤®VÐ]å±™BEK_(¯ªaxú¢»Ög¹L–½ï¬yýmt@¿‹=ýO^±å¹%OýJ|Óe¾|éÿœà8¹æ³6lªS4ü*i@ šŽ®9¸ö³3K® œÁu÷«@j9òÅsÕíoî7T *×®züÚ ®ÉºöÉËyóâïüWË–§>|ê¾²“u›ÃŒ!!*.8úïûŠŽVJòYxîN`—ABÓ±uûÖ|NòN+æ-2÷½þ_Ëß~/iƃ—þô•¹÷üN©[÷ñã×WÖ·±nÚzE@Õ{–Ù¾¤sÖ DT yßûë½CÊéo %y%B¤†Ã‹ ´_ú‡…ƒ‡dhÎGÊè+ù¯$wÛæE2@ó¾ýk?󈈌QÅî÷¨j-^[züHåîÇöïâþúâëZª”lýäÈúOÞoB„Š]Tœl`"¢¿rcÑžmÇwïÛ¹CøNݺËk@ÿ "µØòÚ¿†ßûêäKf:âí‘Ç|ç™q“'|ãîúVy]ñækk[C&akéºÛ‹ÖÒÂí+«KnúÌ'DÝÁϪK•ï]Yøå‡EÛ׶yu¦`ë±%GöJ ""µ—þrIcYyÑæ%>½öغ5u­Œa?QXBT4:øï‡JÚÒ¯þû»99i6§Ç9`üÜGW$àƒ«éxsáá/—µµrDD†5û>®*­©Ý³ôðIÞptõ‰#GxóþV·Ÿ**Þ¼äðïŸ/Œ\p›­¹ôȱ —í\ü§òÈeh8ðÖÚ7*vþ&.Õ–§W<ÿxYEµ¢@éÚ¿­}çM?ƒÆݼb«¤ `ó¾/þ¹¶žƒÙDBø0Èu¿`xÝ‘£Ååý ’À§ '.ìys¯ª)Ü­ûMQ·yã{ÿhhˆ N®}ºðÀIÉlö# ”$Ö´áË7·þõÛˆ¡¿dý3ßݽ¿^æ'wü|Sc+00Ê·½µcÍN”÷Ö "àu]¸‹dv¨üìi9û¦¬a‰ÜOˆ‚ü5üš[iï+GêAj;¸íƒúü0ð_ÿÒ®G$Yß)&釖þvý¢½ k=üÁ#Û–/C‡?yl×– UA”.ZûÎ[˜)tÈ@„Þ+AÙ›Þ+ ÿT•îŽ ƒ®].XìE¹îT¥@YSíŽÎ;“4—¬©™#ÂÃ#G_>(o$0okÂÜŽšyùÙwæŽÍ+Ùº–ȪK’Yp ÛI²§æÅ'Ç2û !“Æ;dêWÁ`u¥õŽð0ÙÎ\"àac“½µ¥u(+²ædŒ0Ù¦jŠ‘”4(Ó0bÈÔKm(Ð3ìòq—Ý”1᪱WÝÙr`Us½e‡ªuTnDYÑìJø€”Ü\AÑÙ]î‚úËRÁ×ÚføÚ=Ò…ÖÉ30{T6k¯5L˜¢ØAIuJ²’42_%ˆË½8uh¦$«2×ã/ûùØ‹.Í»êÁCŽ,~Á/;›£#>Ž’b—ii“R³RÜI£²G¿ Wc²UE-î´LE‹¸"pP#†»]­UÇLIU›£ƒ”T‡$‘-sfÒÀ„ˆŒÉYÆ¡$©ñ9‡Íº:sú­“æ]Q½o}»×/ÛœŠÂ‚z ÙU›MˆJÉœ™C ® W¾Ñ®X’W`Lº'W™‚I àŒœ ÁM!H~Óa:2“ ? ’ÝaqÞö ¢3/ „âÜlõ/6PöM¢¨]‚G\p”ä¯é"ˆsNÂຠ.ybƒà$Ù¢4©Á«ûÎêlp“Sä#ô—à@а “w† ä“ÐÙ,à+dpÓaê‚àZÒ€$¿L‰Ü°Ý/á™—!q&'ιÙ/Hf’ɉ‚écã‚P’¥³Ú/qS!¸ÉM ’Ý®è,FÀý Æä’^ï7Œ³Ž£àÚùÅ~b¨ÚQµ£ÙZ¶ëý×]ïËð€@ MŸ!+²‚ûý-—ˆ£,+š-­õGIÕþʽh‹RU ˜LþFTA³AåÁ IéèE(Û€±óJmÏ怰°ŒËÇß¹é勳r]éÍ56óô{æÌ»Œ{A8'A~vó{ÿ9f`ÅŽUÍ:熉²Ëng‡>yIŒ—68YŽˆ©XòĦŠ‹œ¼bï—Û3¯¿D¥dïÜòò‘Äõ²'k›Q˜D )a¾Æ/7½÷IÖ¨Yá úÔ¬I7}wÕ[Ï~~xUD\´ŒzcÉþS<­àÎ cPr¤vxÅ?¢—·ßz¢¢’›¡¬ÙÃk×-۱ė1õfÉîhÝûÁ†E§âãÝÇ¿Xä|¹Çe3‡\a|öÆŽepâø®Í@B.i±2ÛôÚkƒòæ$§Æ‰þ’ýJ¦ŽisÔÞüóÏÿúý”¡Ã;oo®/Þ£¤]?iút ãÆDèZ¿’Ž¯ÿ¼Åå0tВ좭hí¿\ÒÜs…U,~xCÑ4›·èÀ®ã9?þ›Ý.GÆØv|ðÎœÚZ¼êDQ1Oæ ;£kÖ-Ùüį)3¥PkoüM–¹‚”ÈÉ“¯½îË÷ï­ß56,:õ¦º£{ôè‹ ®¿Äh98:¼mÓ¢—Fçh8òyUY…äá¨:ÂÊ6½³Å¦Žœ4µfïŠj£Km-\µ8zÌOìn[bbÚñÝ/ì[‡¢r_×ÃOšd÷ÚºýÝ&Œº-9^ ½ !y¥@6›äȼêѸQ»Šwojin—mÉy·ý}`V6“ ÒqÀ¬Ÿ¿¼íÊûÛ“òïŒLŽ¯ÇpÝ Ë¹â¶õËö6ÎPøyܘî9µouC åÝòdæˆ@”1÷—ä|·rïzOêĉ FÞÝ„Ò îiô½ákn&ÁùÜì ^"„»îŠG–ìü¢¶ª^0Wò´N>Îî° Nº°þþsö•ï—ïÛ–:qÌÕG" âG-Èk}¿©EG 8×2fÝ«VW,‹û¬)—©HjÚ·Ê'Žn4¢²G/xؾr™ÛÁ±³òç¨>uŠ×~Avà|gáC®ÿSâ„Å»·¶·z%×À¼n•)1‰ˆHIùàs‡7®;q -åâG2ê?n–ü¾ˆün÷Æ]í­† ƒGŽ¹õ§U›–4¶hù÷¿ž94Z7`Äü_Û6,-Û½)<}êèksëš… Ø¼Ûrjßôzýص5|òÚiÀ‰“ï¹$cZÉ®õM -¨Äe_óhêЊ,°Ä ·?vpýò{¶Åf_2**«ã„“ǧŷØð› Ð90ÿzÛ_[Õ4`ίOš.ü½à/³°fß:wê” W ÄUµÂ„Ô™75›jKc+È2œG–{Î;Ò…Iu ˜0"uBP AÄÉ7fìõc¯Cƽþ6r§M1üõ»€’+yØ?Ƥ¢äLrÉ}Á Á˜$œHI}Ã/@pD¬ßìna0hJÄA ÏÊ*ÈÊîXÁ“ @Tˆ@KÉí ‘¦Þ&$wÚ°+~ ‚· !ˆyR§ÍI£ ÕD€LMšpsr~pìÆ_?˜qR͹7 ˜¼?Œ Èia©“G¥Oî4éà™ D"r&åY4éw$p¯pf\6yÐe žØ $”°ÌaWÝO$@p†jdÖˆ«²:b† @œ´ˆÔ‘óÄ/ðà@Ç©nÉ•0bXÒˆN¿D±ZlÞèëò‚»0„IŽ¸œ1×ç×Û€„äŠ<%?Ë °!¸9hÎ=Y@ ¦Ü‚ÙS‡_ó ÎC38œo1MíŒ.w&¢ÿ&ºV Ààg›ºˆ(¸£ØE„]Óè ˆ:*`ò^;BI\wešP°Ü@ÇñcÑÍ’ˆ2x1@•0¼‚s¡Îô‹nUK€xG^F ©4" œë' 4/$"xš)NO¶IDATcÛÁói$çÛd€d>oPXcA»›4C "Ñ¥=´Âbçú »V`gbjÀ€O§ƒAÀ€¹ß+¸ ÑY¥6 ; »=‚%¨SÜC-öÚõ“ñ,<þ¯ë0 É‘2òŠ[tßo=Û÷tûw;[€gaφî´w<Ùª$O¾‹»Ò;Ξj8ëgõ+ïõ«Lžþ·3Hî6DEø¤i·¤Ø$ Ñç3ïZ’à¹?3ÔZìkžå¯¥™šsém‰Ñ‚ÃÕLΪg’×ÿ8ä-Ùâ2Æ],¸Uë­÷µ™Ô˜!Wv†_,Jz…dAäž7c87ˆ:s±,ôÀ¢)Æ^ „è» ×>$¯>|ÿr¾E²Q´¸îe×—›˽Â,ñ¾nÀV· ,X°äÕ‚ ,yµ`Á‚K^-X°`ÁBÏãÿ²µemëŸOXl[ wG¨ì‘Q¨qÛÄž»¼"Sm6ÕÖ+öÝ{F#«!˜ˆ@¤hšjæQ„ÛD ÙIr¨TÒ#US5{ïaïØ‚ªiݬ‰ ¡hvÍÖ+ÙRâx½ô@³žN¤:×Ï“dµ¹¡öóמÔîž¿+dÔk=pcÞÖ&IVBH]U›cÝ/Ù6Hô<'$ɪ0ÞàZQÕ²Â=“¯º³ï ,2Fœ¯\øœ¬ØzIe$E5uo(A[SÃÝ7MZM^ÿáKmMµ¦iöüã,I ™iè½ã#€q¶’ǽ.¯Šæ™{ûëÞöPLàS4Û7ë>ýí(‡IWÜÞÚtŠ±Þ©™Ô›\Œš¹À{f«Ä>‰‰WÜá÷¶ö¢ Øk<‘Íé’”¾'¯†Ÿ†N(HÌÈ•d¹W¸ œwë%b4›S÷ŸwyEdv§Çîô@h‚(dj ¢¬ÚÂc-ª{õGjv§fwBÈûîïb±I±ç*¯Äî öý(I²$Ÿ¾è IæQ’A’úh;iI–%ùt{MóFLRúРK²,—»mu„.±²Ü#Áùö•™¤h.§­[¸•1`=ÍuÎc+›ýëÚu|Ûîµ47>TfrYp°L‰¡$I=c"DÆHôêêÍvâðÍ4ûNá§ÀÏhin9´cƒ#2¾û“/+" ¹škˆXs²Øï÷!ÃoX]× î‰ùr›îmï"V–YO‹"R/{|È°¦¬¸µ¹ î?´ÞÿI^™,7W[ûÂ/\î`L€!žjlhooïA1$Y–…½úÌ€¢ªG÷l8{Z|Nج‚Y‡O¾Må[ÌÊŒ564ÕÕÕŠž¥‘1&ïmÏBèúÈ#MÓì#ÁúÀϘwÝ‚êWßk¯,ë2rde'ËÚÚÛBoSAp1iÊ¿÷2é[$–ˆò'Nš8|”¬W;Ú]!`yyyssSOß4ûºîd=Ó0s‡dI’üÅ×6M ÈvCCCuuUçwhª¶ôÓ¥ìGd=ËÙyXGªªQÑ1Ï<©ªº`Á‚ŒŒŒoÛ{=KeŠû÷öÙRŸß×Ã^Õy©ÖŠºa2ƺŠxM˜0aîܹ}Šdx{у*ª‚ Y2 ™ÔI²"22òûßÿ¾¦içXDB|ÕQýtÉ’Ý{v‡b„LÎÒØIlxxøìÙ³srrzÀ{ LJÝ_O8°¦®®Ç}þó†¾ãOáXÁWú×ùü~æ)B”êîÚÚwH>ÓËÂç×M.С,D&Á·Jr@(Î:Ö>]7¹ÑŽâˆ=@ªüM-R!„Ýúj}ù—õ·¥`³ÅvïüȯV¸!–ûº6Ð[X°`Á‚…^À7Ξ ¸út¡œ„‰¹ØîË.L'½dÕwMë v<ë}ëý¦ßòåÕf³9NI’zï~:³yÎÃÀhš¦öÕ= MÓl6›,Ë¡nßâtöÅ4~Çãr¹”^>Õ¹¿×ÛZæp8úÈdæp8Ün÷y0-Ƙ½¾E¡ªªÍöÍŽPã窵µµ¶¶ö<Œßù¡LÓ´øøø¾é[qÎOžt¸ÜþÉ3²2-Çìƒix\´ ?+ A¼&[%Œ1"šü”æëÉ•…EÍ“ý4í]õ¯¿Dþß—# õ™·‹ù{·îŸð³Wt¬nË¢—š³² >x=å¡£4»>xEþtpÎ>GÈÍA!þ’›áPpâEQp¤Î6Q—ÜP²CÔj+vA‹œ%9ÝŠ,3ª4*R›üê­¤”ùǤWE“#tb¬Ñå€ìÛ~ <ÔË2•ÝŒá"½^6 ×oðÆñ<Çæl«8Q”¬7ú Ai™3îÎœ|“É’jÔr €1ÐétŠ!*sú‚Œ)s-±Y>a¹ÎæQ §6.¬krqžNq¬ FpârãEb¯=¼êŽ#­§ÿìˆÈuäOàÿ?²-j6VX£Òx˜Ü^*6wºqå‚Ý«£TÅ…5ÁY“Òòöüïí¤ÔÀ#‹&¬<×Ù|ÚíÄó|ïÂÉ® ÷»V˃î¹ç°€ÃáØ~¨$ 6."Š"¢Ö' D¥÷Õú†¤OI7Mà ð>‘COîß´á7ÞÆÐè´-MFKZbîäŽÓl’6cÚOõzµ9mg-ml°fÌxÀÇdÐúØ«tÑjúG¿Úå°5í2i8Žã@„¬¬,½^„tÅëþ/+Fprɯñ NÙå”ve—jÿ¸¬›Š 8ßØ‘þñ ÈÄóôæ¼ð€ATë€ôÙ‘y¤–žžîããóì³ÏþíoõÎQpÈ5¸ynàŠŠŠÅ‹ß{ï½ááá¢(pm%;>Ç’ä®­­¥ŒõæF'„#„(TéC[¸]Έ@çÞ‡‰*!Ä3ø©§žúûßÿŽŽ;[>Ð"ל×\.WUUÕo¼ñÚk¯ýáøÓŸþôÝ7wv´¿õöÛn—˳cio¾¶×Ÿp~G£”yÎH£ÑÜ{ï½AAA}R8ÕÕÕŸþùý÷߯ÓépBŒàk,!u¹\»wïþüóÏ-Zd·Ûcccïºë®ï½‡í§,+²BûâÞf×Dá0ÆÂÂÂ&NœøÉ'ŸÜqÇæ¼(ï:¬3ØÉ€\Kttt<óÌ3o¼ñ†Ýnç8î–[n‰‹‹LǠǺ#yyy¯¾ú*TWWõÕWžEÏ1‚CoOQÍfóóÏ??oÞ¼¦¦&­Vû»ßýî)˜,Ë^~o3ÆdYîÃf"OQ$%%ÝÿýO<ñD~~þéÓ§‚C¯¶!Äét¶¶¶>ùä“/¼ðÂÏþsŸ²›¿¿ÿ‚ œN§— N«Õômƒa÷îÝ»v퀯¿þúÑGíÚøõz‹j±“¹Vìær¹–/_n±XÆŽ»|ùòÉ“'ëtº ¼ÿš;Á>üÀ§žzêµ×^s»Ý`6›Ož<éëë{Öþ¹çžÃûñþ›ßív¿ûî»)))yyyŒ±äädQÈ ×\¨Ò‡ì)“ÜÜܬ¬,Jiaa¡ÍfÓétcÇŽ½»®Nw^A_ùrÇQB×JÀÒm·W_}õ¶Ûn‹ŽŽöÔX¼|S¼6›íСC/¾øâÊ•+Ìf3¦¨W¨Z···ïÞ»/,$xPZ\Ñ:mííÛ¶ï¯h…T(Š ”šÒËð\ͯ¿Y# ^ÚºªP™ž–|ñât:ß}÷Ý3fDFFâÖË»é8pìØ1Ï\•²$¹•nÚ±÷pqCðËÝ\[ÞX~,9Xsÿ7…‡…^ éè[(¥/[±é5‡Å2F¯úeàuÉÆ÷>ùÏß¹^O/Ú¸iÓ›kJ3†SEöÆ6Q}`åÂÕ¾z‘uÆáp¬X±"&&føðáh«^×á³Aèe‘]ü›]NÇâO¾Ú_¯JqËè<#0 2Ħâ…™m­Žþ·tLjÐ c‡šÍWæ2è Æø´8sD´7ô²ð*°EôÍ„˜äÁ ^é7ÔP±?ôbëŒËµlÙ²¨¨¨áÇcfzùQÌ™B»Kï’׳žUU”©4ºó”wž¡!.§ýµ…Y‡æL,»Aržù ²ÄtZíˆÙ ŠO4-ßðàÜéz£éÊ<×YVï¦.£}HREQd Š7V8*ÿøÊÝínÿþ÷¿§Nš––v‘v»†"L´½7‚#„lÛºåãåë„Ð,[[]˜ØöÓys“ºk!!Äa·}øÑ'…%åÏ>ùs__¿×ÿû‘9.<<^r_S=­*Šá éeÖo7í¼eÆdŽç¯¿Ç,w^~:PïrÁ»½;v{ã7î¸ãŽÐÐÐK²[IIq]m7Ÿ>¥4=c°ŸŸÚÇ»ç©@„¿üßKM¦ì¡ þ¢Èž™Ãðϯ>ì¿ã¡ûïI’vìÚûîòméÓîKfþz.7-¼UO• uê3Æâ³r¶¬þ oxSH°åºzÊñÔ××-\¸ÐóO·Û={öìðððþûÆï–í¥•6cÌsác—’úv»}Ñ¢ÿzf›SJcbb¦L™ÒóÇÒ¥KgÎœé±ÛE~:!¤¥©ñÝ/·8L ¢JíµÏ±öæ†Ì²5÷ßq³J­Fy‘à!Š"ðñ2gøøôAC<±˜çõ!Sn+ÎßùÁÒ/~:÷–Wþ½°ŒÄ¿÷iÙLbî{®æô©ðàFáÇ+*¿Øa/¿öæcÝvÅú¼!ªq¹Ü•••ž¹\®–––~áHgÍÑÎ'JT&sT2Ï]ʺ„p4—÷‰Iå/ñL…VTTzâ2EQôz}O»9Î+VÄÇÇ'''_êÕgÀƒ#´‰¹¢ZôV¿A[c“¡}?ªçʤö—–¢îÞ{ðX‡oüð!²tÎ×Pâ2s ÷¯YüÁ’¢Ø9SœvÖý«ÈFüÈ!ŠÂâ%/[í^¼xñˆ#ƯÑh®Çqç9Sžç¹~^­‘ã¡xõ_Ú4ÓBB4Öª£UU3FŒÏa¼À@rð"p<0$7ð"ð0 ²›!‚T8¸ø…¼ç?Ôsgÿê¢.žãØ™úê9Óîv·Å‹gee1âòú÷£Š,ó‚èµ×™*²·MbŒ+,Þ—_ R©¼¶Ü8Ž ””˜˜Ð/cÌf³­Øv$rÔO 9¿!…1F€„eŒkh©ËŽ³¸ç$-ža))Ù I#§WïY¼ãA˜8q"Çá’'ý½«Q#æ%§hd[ÝÊ??Õ9:§íÀÒã»6ŸA£î|LEí…ëß++È÷<Äı§·x|×fMøØÑsïr7îýì ÅíT8 îàWG¶¬&¦äÜ;×^®X Õ§«ÚNV~øí–íÿܳf}Vš¡­S?å©ÿîÿ÷ý§#* ÊÆÿjÑ鯞Íß~T׸4dÜSq!MŸ9&;[JŒzäíöÝÿÚ»võÄÙÓäËžât:.\8þü°°°="„r¤ €s6 ‚fìر&“é*WàLæPß p¯-7Wg ­:Ümpëv ÿéoÜöŸý×›ªÉ(3ùëmv'!D–å­[·FGG ®zÒ_7!@œQp—U—œ`Ë_e’ìgpÚ*K’À`ØCÿí<ýí©€ ½¢S†­?xÈ"5ÆÄGi}£j¹³¸úT©°â5êvúŘèå>þ÷ïߟ““ã±ÛÀ~ž€úúúg³ žÕDFŒqÕ7PÛ㸋ü h²QFûý¹JaD½Ï•JURRR]]ײƒ$GkMgSmùÖ÷lSƒƒBÂâR&ßd ô ŠTÎÚcíµùŸ¾`…H®åxSucéуæðdѯ¶àHã‰í­v^nLštOphˆoPìeÏ 5jÔСC¯“öVŽp<Ïñ<[Rjïv»Ev8‡Ãår]ÌbÂEJÇív1QwÅÆĵqßþý­:"2jçÎQQQ80²¯Ÿ~` Ël8½©¸(hòæÞ­5¨b3“J¶|BÔ~‰–@5\×P²k…<ÔžL³RÊv~AŒ™iC³Y«¶xÿ–ŠKtö•>,)ghéæ‰Ú7Á€‹o!ý„¢({÷îU D–ðóó›>}ºúdžÚ\lêWZZ{efmÊ.˜ñ‹7¨ìn8]X¸w]þ‡Kn¿ývœeÝÇ‚S jô#Šœ æB³f¥¹8QÍó€OÔÈ[IâUZŽ#¡Y³ƒÜNNÔð<Ç,©ƒ¦Ä2"F9KúŒ€$Ï_ñ½¼Fx}‘ ä‘---åå§)¥àp8$Iê3Áµ·µý®ÜóY­3B¢3GÅejkjšû³gŸbAbbâ•)G`”ž™8E8ã~Ä­ŒQFÙ;ðکμ¨áÏíô$/jÎ.!Éñ"wæ„ãE¾[C¼J =ßwæ¯ÐPHÿæv„\R¬s±‚DArY¯äixÒnYb&¿Àñ÷ÿõíÏ=1_q¾½vßÒ²Òj­NG©¤ LN9Y­âp,´6ßц¼)7(Ê÷Ÿ‹äh^+zñ £ ¨™pp1ÃÄ ¹ØΔä”êÒc¼WxŒ"!„1à84xúWë÷8Ž+p5'$µ9jð¸ÈôœöCÚ¾‹AAÔ‚¨ŽÆáAÔ€¨^j­ª()äxàà8û[Ž"@Cþ—Uå5Â/½ÞÛ [í‰ý—â cñ†A®-„‹¬ëzƒ!Lë°Ye•x5Fl0 Ý{ÐYÛÐÑßéÔ&ÿ„à„4Ê@Õvhg~™š[°ü•’#ù¼.4cÖÏ£’ÂÛ 7íúb±$dÞô+ §âyNïø¨Åá7hÜ ŽÒÍ;?×Åù ¾õ7AJÑžo?ƒK}üéè å<ç>¸ü]}HLÉÒ _ð´ #8d@Fp•<¼`îáŸñW# aŒ1ái9ÏýåÅ+VH’t1=Ľ¹»Âu¶Û¹Ù/:¹vÿÇÕ­†i¿zoä SJ7ho(^÷Á‡Y÷¼1jÖ­Å›þ×ÑÖ„k)\w"¿(nøTÑY´öÝECîg✹ùK_¢¡£Ò† zs Åÿ«RcC‡=ì•ãX§PoÈŒàÎÆJTövk‡U«3\ùh‚*,2)nÿ2Ø¿IIÉüù󃂂úëûÜG?ûmÉJLi¿ Ì£Š$9­n¸í ¹4œ<`L˜’5m®šÖ··YÍqC›/¯,«l>¹%ÍGv«M°$…ÅgD¥&nùÜ?)G®/c¤QKk+ë4"Qd·Ûi¥ôZEAÔÈ÷O;ú¾¿´ìýOYiƒZ Þ±ü1‚ô…à<*Y·vm™;x,ϪGœ5G·ï^üG«„f«9]tŒp„Ž „ãYé†Kžtõ9r@8`@€pÀX×›= &2Žà€(¶úòã²$ỎáìñPð5‡Úí6& d¹_Vžñ‹a ëžVIHœ8ŸÖlÜôÞ .mš¿`“üÆÎùIñÚ7ïØ=l¦odFBZ†¢@ä°Ù~>ZjJ?ïî¢U/ؼ5aÌL'æÄ¡­'×77´ô2ÂýÞŸû/I ÏY¶ö¥/þ²€‹œ¢‡ŠšÒzÌQ‘“¢Bêëj÷”u¥M;[³¥|dÚ`ß]Ë–Mž?Ç3òdGKÕáíí®¨á3õjWÍ‘õ6U™AÝYßDÉ­9¸¾SöÍ̶Wï«obÓ“Oí\ÙÖj418*œsVæï+ ×5WÔp¼„(ΖÒÝ«ƒ³o6™z (% {*ŽãÊËËÛÚÚú¼%Žbɼt¯?Ì(Ó˜SGÎÿ3x"˜¼ÉŒ@ÌØ”Épf1¨l3È2aƒ&ÜÌh“§ŒOÒõ[ÆÒožœqs/G“yò^±bEzzzLLŒ ü™¡Åý‘ù2Ê áC&?ñ_r&g(½š)ööý@ˉàŠNUµ½Qß#d`Tr'Üø,Wµ¢´¨‰ðPÉ}ìë—klF#ÙüúíÄhŽð Kð1ëŽ}ñ–CV*­Øõͧ  jßò¶¶¦KþXQÕjð5ùü¥…•¼Òpä›Ú¼A¥ÓŽ—:*öþïY›ç í™äÖÖ&Ï°žÍÇïŸ;élRÜý£žñ®Ð=_ÍóJw¼sfºÂw~K°K[l6[[[[ë¹´µµ½ñÆ)))C‡ýÛßþ¶k×®êêjEQú£O¹ët ÊÙs¹ºN!„Ô××;è±Ìýeš’1Â'týçIAp ßuÁ1Æ$Iúvû¡ØQwS弚ÍoJ›xëÑm n{uåñc¡y™nEôÑ»‹ï²Äh}b4æ¬ÈGÙÁU`¼îÄÞv·Ô\uÊ5í4 5û>–7hè©ã;â#’A1zðUKEÙ¡Õû?ùc3Íüé´RcgÖ9÷<±©Ë =v‡°Z­òªð<_RRÒÖÖÆÎñ;q»ÝN§Ž=zôèÑßÿþ÷ÇüñÇçÎ{,Jñç?ÿ¹µµuüøñyyy©©©—ÐÂóP½ÿÛÚÓ'e…^mN•’þM*€ããAq_pß Æ€#‚²‹±;WÍSÂ@Îy´_«‚#„¸ÜRy K0¨$×÷Ôsò8SÁ?Ë :AqðšðÐÔ¡‚ä´ÄýS4úÔîüœQ…Ê1âàž•qƒÒc•WXÓêŒI1ëj4: 2•9Ak¥†R Ú05Y–e7$ÝøÛ⯞/ØW9hP„$uM‘"„ȸšË!(Âs0„ööö«[|ž'?Uº+6c 8@W6çþóbë¾¢(‰‰‰žM ÎKQ}}}=ÿŒŠŠºóÎ;'OžìÙïý‡Zíxñ¬'®H@eFÂæ…7bccciié…5íÙ¡}Ïž=Ÿþyhhhllì¬Y³nºé¦¨¨¨K=Ž‡Š]K!åÎèˆÉÚprÿœÒcIƒ!„Ž*k+?X_Ùš0f‘áÇŸ‰g^¦¥D²Uæ¯Þ0xî"]¶טÝ8"ðP}dKG‡# n˜9$@–έFŒ1 œL³ÉÇ]‰-/TŸjjjLæï_ŽQù$šRqt«"K¼:Xg”81(45õäWOWU;8ŽÇ1~ic[Žl§bHüàQ'¿~Ã7c\ €­¾Ôêp`Í¥U1*žŒò¦à€Ð¤Üy?+úòïí®®©ZŒ1^€ÃÛÖƆøõ¬îmmm(Äïý¹O¯:m;_{ª‚œâF8ÔZ^_oç8@xÔø¼±ÑÅq—VïµZ­Ñh4õÀh4êõúÀÀÀûï¿ÿÀ¥¥¥þóŸÇû½)*c„HÑŠ–þæÖOw÷‰ü ¤¶à[»D¼0ÌPÅétº~ Ï›ÝnwyyùÆß~ûíµk×ÚíöËy81E¤'d‡gO2éÆ¢+£r}Á†Cß|ÒÖfeŠ«|û''w®lnlŽtTì?´òu§+àj-/øæýÓ'‹ƒòMœ:´±¦ì4ó»uׄ>«öŒŽÐŽ’¸áÀÖÍÖ†¢mÿZ°eÅ7OHϯ „ãiõþ-Vë…ë!ÄÝVUqô¢ô»á.ÔÉPQYåv^)1àu¾càŸ—˜=º°ÎGÔù' »ïý_$>xFÎàðŠvCÁ¦%ñé>Ɣجh}`°´E­1F MüÔYyÙÛÞzÜà«Wøà¼ã˜rXïã €5Š&bJBê®Sû÷¦ç  Äép·ŸÚª>gA£ÑxB¼óÎ;CBBæÏŸi4EQüî…'¤k+)væäYá–i‰ƒžÿdëzÆܶ&»¢êù!„{sg’g{å±ÁƒÆÙ›JTfÅÍ óºú‘uÀEV\FóÑG}oRö]gäÊo—çÿósÒ^ÿõ[‹b’âÊ÷|2E¥±+Š[f*^ëìlUªÒû©T¢ÛÞ&¹\À«u&?ÅÕávKLQDVv94_Ž#ÀUÜNk;¥L¥÷EÞÑÑ 3µ>þ@Ý.k'c2#*¹èº‚ƒƒƒƒƒômf³Y­VGEEÝ|óÍ ,HNN¾œõ<(Ä¥(Ÿ,·+¬iÓ? ËÑ ákÿqWÞÿ{×`ŽÐZ;µ¿¦ýïn]w05oÔþ%Ï&ÌþSLˆkíëˆÈ›süÓgZ§ýÙ«ÖVëL^±Õ)!dóæÍV«5;;[¯×ëõúî±/³”8çúwž œø×Ñ“³e †Íº{Õsó ¢ÒÓÓBœv»¨5r„¸:­öÔöσµúÄwg3ð¼ätŠZ^/9:§R©ÕL¶9œÌU{âäžÃ>!1F£³³IrK¼Æ¤5É…c¿¾\]C£Á/®§àcXfþá%ÉÁÉ)·þn. ϹÒq£KâM:ÙÁ"FÌ ÷+á® IDATH™¢Ò«yN;ö±·©\æüß2Ù ’“…Œ¼sVÆ,›Ím20$–9ïéL—Ÿ¨Q?yPv¤ÿäž}ï=׬`ãg[•Ö'ÄÓ8èp8EQ¥¾¾þ{ŸZ­¶¬¬ì£>zùå—³²²¦OŸ>bĈ¤¤¤˜˜Ïn„@8ÞÝ^S]˜ï–˜1$)(:A䔺;Úš[ !)–èD8« ¶[­nS€…׆‡6Ü®eГ¦“[¹ÀÆà$•b ®Žêc»ìv·14%8&Þ?~,Õ•»OlýÌÅû%ŒçM"ØŠëÊN0NgIÎõ5‘êS•ÒÙT[«2…Eed‘‹«»=› ´«„h‚}µŽãÖüCòîxDi<Ñ\×îWSÔ|äÓBpnb”úøîí„™XFÜr{ÑÚÛC{UQö½¯;÷¾UXAurCîkR[[›Rg<ìÏt”ï(ر]äíNSΨ‰ƒÖþãw¡ÙC;j+ã§ÿÚ¬«ßøŸ×ƒÒÒ:ëj’f?eîÛ¡ŠóæÍûå/9a„žÏª‹* ¬ â˜D•ŽÂmkÃoü³É¤ŽŽÞvxËÚÜ¡ƒÛÕ&?²sùû‘Sž÷ ÔDÆGíÝ(žòÏ}<çæQíéå5.ÿØl½é¤Él"î~IQ/ULGŽùÅ/~!Šâ˜1cÆŒ3xðàÈÈÈèèèîöKMó:Ëvµr©cFg»lŒð*ßá7Þ¼~ãg1m^;xÖ“=ìÿÿÜçmíeÛ–EGì|áMætÚQïTt9wþ¦aï{nßÜôÜ᮲¯W­¨‘ml©È/?Y"ïøêcQ«íluzø%ƒŠ]±Îß×÷D[;é1¸ÓSÊÒÙ^,PÜో"¯1ê4 ;=Jä´>À€1žHÜö® Iq3"~@¥3ûÅy6âbà±›ç“=¨µäà†o%[b"C<¯8κº:JiSSSAAÁ÷÷U«ÕŽ3†óóóóóóGõÔSOÅÄÄœmi¦Í{–~¢fÔq¥Û–p†Ç¡liÁñÎÈĨâ ï)“–‹>(®VE'Ç®~]1ß0áöÛN®}%ú'y>~¤|Ó?Åœ…~«å4Sûæ:%:ÈO(Ú°˜Ÿõ›ÚMÿé¯Çùð/ð*]Éš'´£?J”û¾!<“—+÷}¶gÔYñwcô˜  Óé]K™&~¬—à¼^Ý¿+(‚³Gߪ­+/m-ÛU´½cøü'ÂâBƒRSëŽØÍÃNNŒÚ¿ä ªI7›µ•wÙè½1ƒ5N®³tMK«Ë¨ñ‰6!ÅR·|Õñæþ¬xÓ»­ –` ö ·Ä§ƒµôàÉBà›‚“‡Þù+Z²jÕúo§Îé=dÄOÿŸëø²µ›¿‰½ïnêîËûüÎ;ïìyÏ÷I®MxpÔ×*Æ`-×î°ëÕⶵZ†ßæ&YKe@ÖM¸ItÙ;Lñ“‡øÇ4mÿ‹O’ÅmMPZ¬¯$w1F…ÞØíë‰%Ë6›ÍjµZ­ÖÎÎN«Õj³ÙÎëFEñèÑ£¢(J’´aÆ 6¨TªÇüñÇ¿<Á[{».ÈB”®‡*àålØHyQTi]¤”oOˆ‰‚3WQ¯×ÇÆƺ\®Ûo¿Ýl6o[ƒF£1 ~Ï=÷Ì›7/88Ø`0t'ªÀ˜†!sÿ õ1Ùj ëOîqu–­ÛžþØÂPMPd*¯nZ·åØøßhäÔRME3¼Øu99AÃBx‘¡½ºÈeŽzS\ÎMœZ]Ï«ç´æ8¿àØ ˆØ•–#¬ùÔaÎ/%uÂOxêv~ütMI€)>oVP€‘“›lM¤¯Ÿü¼HªÖÿ«A3iĸ™²{߸£¶ÁÀ€cj£ŸI’$"˜"ßíÃI*b=Yv¤hðO~î®øšÂq<Ïó”RÁD%™Ù³ªö/—&%çD?½•p<ÏñÀ«u”º' RëÚâàMÖ'#Lújc£3Õ“ñ*J®Î¶+Þ É¸YCü‚9M`frªnïÛ¿ I¿Õ0ÂóÀiƒÂ9™JZ¸òÍz»1$<éPѾ¡“j7-9PÂ’I8ãäËà<Þ¾üòKþÜ•S=òây^§ÓFƒÁàù¿ÙlŽ‰‰1 ž÷wßjµÚn·¿ÿþûàããóøãßqÇ‹åí9?VP 3˜lÍG#@™gù²Îº:U`pNs0JUÙÍ@«2ø˜B$ "Ò²l(³w^À˜"3*)n)(çÁ˜Ž…_ÿéV10cÌ‚!W´ ."<¼¹~‡g²ÁUi–æxRSRj;¾vpfº¬ÈÄÓ væ@233-‹ ?tlóæÍûÇ?þ‘““óOHB@*]ÿJáѲ èDY@jµ1_“†Rð‰Hìù!Ødä(­)ˆoϳ¯gv©ì–²î~¹àÛ÷Öýß­à—9þ¾ç<¯c]ÓÖÉe×è8D½O€ÓÞªVÅ%\¿¬@E2ußË¿%¶Û5rMUgÌ ‹ö¨[j«jNŽ‚¢‹¶h;.jˆÌV\ööÖÒ­'+ÃJ}H׺*]·YWÑ3ÅmwuÖo?ìln°Z­å{­XÖZ°"eê_©ÒP{lãÑÕÁµ{—ºùÕæ’}-Ú¨´AÞ6Å‹¨ û^™±‡"h"sï9n€˜1ýž-ÿùiN%i3fÜÛQ\Q}ðËŠ¡†Ýý×o^»·bM„¤Ç=x—>Áðæß>³Ñe³zä-M5»JÄ¥¥÷f´NJJJjjjïC¿ÀÀÀÜÜ܇~ø¶Ûnë“6JSüp_û[G”d¤ÇQD¶ï_ûEòäW˜ÜÁ(eŒ1Åak´îìàDÙép4YI¤¡±²Ì`ŽdÔM)ÖÚZ Ú®k@¸öª‚܇ÜþÌ¡ÿýâÐæ-co¯ÈWDpŒ1Zå'8éUR j ¢ÖÀ<=óž§cž-''çl8ö}ÇÿØc](á8kùþÓõÂÍxŸs¶üòU*˜´­•e•ñÑæò˸€PZVqª!*ÄÔ\Y$¹’£Ôm묤¹º9pà(Þ±.b£ƒo~âЧ©]î°:¥½©¦"6õªìž Öý¼Œ2bH˜ýÌÊó·)|ú ?¢â qÂ/;í;9s4>tøjÿÝmdúM9 Ñìi3[ÚÉÄŸ¿YUÖè9^Ë•aÐðhʸÀøÑLèIQ§=^‘¿Í”ùÀÄèÃN»ì3Ên ŠÿKxLD[ukHÊXŸÀ;^ ‹ î¨ëÔ™4^8êAvÁû_~¦úSd70ÆÒgÍN˜hëtú(.æ;vòãi¼Ö¤Rgßú·m µs¨§‡mÌK:j4~¡ŒúL}æ…¨H¯ê2—¶ÿÎð=6sæÌ™3göU.Ï“ÁwÏÓÞ}Þ^>Î×Wßpl ÄÞ>xxœ£¾Lî¨>¿Z †(ãÔu}áþÀÀ1îÎú¢­‹;ƒMÅû ‡=øKZþUùñÍå|Óé£ßIœJ#Ùk›êjHKñÁõ“‡ç55»B'öù𺠃ãy>gPTÅéŠàðÈ«2G‡Q ·4;y`ç§'yyyg[Ó./aL\×xdÕ{¢Š³;]\ecúì»mYÔy,Àas§¤Ý8bμC+_i ‹ì¨¬&Áƒ€KâÈò­ow™Uá:­ bAzm°ØxòÐò7||.ðOŒIhmMȉ¼È9+‹òu‰jè<ÒX\xtõBNéTEL =m ã9€¨A šôýTFQùÅæÎòÜÃŒ1Sø O‡p×¼1.0)×L€Êç;ÜŸ¥?$’RÐPf ‹E£9(e@§ò‰Í›É AÜÖjSX\øàÑÌ”/j}B¢‡N`È2èƒ ¤ÏRÔ¾,Oó±ûü—©œJo Ð+nÏ`7¢ó53@™Bˆ)(”Q Œ*ƒ! Ô3† Qüô¢ðRÛX/O—Y‘¦ 2퉗«Žíw8Üq“–˜ÈÜLã“9ížÚ²BCÚ܉y„Óóú 󪊊)}`däÐ R}iίYtnÓl¦Þeµ³aw¼è´ºÔþ>ÉCGÉ.gdÎCL›[›Û¦=¦(}ì™ %G‚ d¦Äî[»ßyUª'cLQHüˆ e«Í–®ÐW–GŒ1jÔ¨Þî³Å(gËœqGK£ ñMÌå´K¦À ©v›]c²èL>\àÜÜ°‘n…·Y  <‹ý CQûêô·€`äØx&ªÒ’ü«$Iј‚ô>>¦Qh"I™|Ÿ[µi¿&*-§Ò§M{¨³¹xÑIˆ’5í6•J@̉ã­þø =Ú.û¬r3ϘÕnåßeÄè1 ¯ëgÏLO{¥ž5ι[<ŸÉàÕ–Ô‰ÓG×»µ~Ññ9aŠ«kŒ'S¿–ÖPñ´.œÓg ÝmÉçÍW;vŸÓíöîûϤ2ãÔQC§y*ÙjCŒ¡)¦ð ]­ (118QqµK.§otj@b*¥ ËŒWéÃ2'yÊP§Ê 4c‚§zÒ=;¢¯þGZ§§ ;|¸ððö˜ŒQW¾%ÎsCšCêXƒ‚ ¥”R:}úôÜÜ\è‹éÖŒRAïï¯ëjþTé´~áZ¿³IžÞmàAª©g‡=QçÖss/½§AØd‰íN7E¿§Âk}C»—  ” “_˜éÌ»xÁäy› Ö‹ªCWã¹Ìüˆ1 j½¡k!c/ªt"Ès–®SÎÎÈ>Ϥ ˜Ò³£˜„7{êSŽÏ.ÒãñÐÝ|}Μ¾mÇ¿p¥gwÏ¿#F.,ÏߨÈòÙ%E®Ô´dBÀÖÞ¬ÓwÍöW«Õ¹¹¹Ý£ŸúÿË=Ñ ³dÏ;çÖ‹úÆîDã‚ÏÕ³S ß®í%VßÎÒm5§«8ž|·œXö'}v$ZÏsG»]÷6äEµ7TîÇÆ{ðûó,ÖŠ=_–Ÿ8XWQâ´ÛúyK„ÇÇCÅñ½– ‹çëœNçñãǯJ Ù·;^˜›9j554*µ×•µ7Ö€ÓÖ*Ë2!ÄÙ^%S¢8Û[kJN‰*9¬ö–§KB•!ÞÌE .eŒÍ¸qÖ½Ó2ô5[«¶¼·þ§¯L£1cŒãÁÑPÂñBwgPAAÁÀ¼W{ áNi;¾îýÓG÷œÞõaÑ‘üšÃ[škkxÞqpÙ Å;¿l(;|dÅëM Í•Ûß?ðí‡í¼…kXpÐc+éĤä[nœeÖZT¶‚m+ùþß>bëTDÅÖíSBHkkëÀŽ¤®¢é¨#†Þ˜0l‚¯ŸPYRfÐ+M MÇWÙÉŽª•Ç ¬­ ®†#Çölvº•ˆ¡3 x !׶àz†rÉÉ)S¦LMHJ*Úù×ÿ‚T°÷Û%iɉ='cõÓ> Þ師ô½Tê8±æ­üµŸZ]  ŽÔ^[t|ó—‰covÙ;Í)ãófgÎ}~hn'jõ>üõ±2ð]Ë ²aÆ͜yc”/_Vp´ÿöHõ|¬ÛÖòµªç 0f³/[?•¹­é4gJL}«¿¿dmâÌIê–)1‘j)Hê¬r9Åßü£ªºƒàò·È\w{\jjêsø}cþŠŽvÇõKoƒgíÐ’ü­zŽë1 ’R‚—­?²S}ø¸!-¡þu…ÛBb\LˆÃF#?i“ ~dHtDõ¡µ†Œ{’2übë z,6Ä˹´<³ÛqáááÞuÓ;+–%»]¥RõÇ‘µ77Þµ,1ÄÐsYjÆ ®ŸÂ7}ôDÇF®Õº«ö~QZ%Ž½!ŽR¼&bȌȡ (KÒð^ ÞÁ§¹ô´ÔûnÈ8ôõ›”yÖæ>]ÏšÎðÝÅu pßÙð¼¿ý>Ö¬V©ÔçøX"##ñ²õGÈìVÎhת܊Ä,é7NþÙ´jáì®Z xš@½aéÁu›hðି=~û±O~wlû*·ÓærÚ¥’Ûå´¶ÛÚš®ýøÕ»†8l=ÓXŽ#UE‡–Ë :SlÔC¼HpݨÔêi7ÜÐiµ¶¶¶r'ÉJ·ûâ£Ã ¾Z±óK%ÁUWá'F…B$Y ë®× Ux^ ƒ íw>¥4((hÒ¤Ijµº¯ÎÜní(>¹½­±úL³Ÿgêí¥Þ]Œ<+èôQ¥i©¯†ˆÄÞŸ—,˧Ží‰äY€]æy=AŽ¨"÷•äD•º¥¾B£Î“®$IX»A®šà<¹jXXØ]wݵdÉ’––èÑÀó\HHPÚ($Z(¥=ýÕõÄ&„ãøî?9¯EƒÁ0kÖ¬   ¾zÂs7{úäȃ<„Reß¾}‡.}~!„AoscŒ Ž ìýy1Æ&Œ/ò|¸{383âÄÏϯ´´Ôjµž§6Ƙ(ŠaaaÓ§OîÃzÏ3 £Gé~Åår·¶¶]`‰àþÆs¾½¿0zÌÙó*+;E׳Ì/ãÀúV7Œ1znûL˜0aéÒ¥›6mš0a:ñ.ÁA­1òòò† V^^^__ßÙÙîããÃq\cc£g,Ïæž~ƒ´´´œœœââ⢢"I’ìv{}}½Ûíöóó3ñññÆ ëóÞGyv ô¬77À.pŸœWŸw[樂;wîçŸþ駟ÞvÛm—}Å á8AèEÀÚ¿/€÷¹›1à5¯êZ¬¾h“èÓÖ[Au9kß ýQkU*Ubbbbbây7‰Ùlž8q↠$Iò¼˜——çéMHHˆ—eY’¤ÎÎNEQt:F£Ñh4ÐÿmÏž˜‚Rz¶Ú¾x+õÉGyÕyýÐáu_â[o½uÇŽo¾ùæ#Äívûûû÷ÉG…„„8Î[gÅSJ-KϪ’››«V«/^¼`Á‚K½îæ ;§ç446b#„TWWïؾÃårõ>5éÓSV"ýAôž«ÀóüOfM½iúDOy··µðáímž]²¼HÄ —úàï¯ûù»;ht¯wäçç7uêÔóqâ„Ǥ7ÝtÓ Aƒ®ÏN‚\éÔzß¾}-•…‚ 0Æôzýœ9súj Žn}ôÑÇ/]º´££ãÉ'Ÿä8îú-ˆ‚C+ë7§ÓÙÚ*{çp8<ã–û0|SåÝwß½ûî»ÇŽ»k×®ôôôëv,4 A®¼ãÇÏ~:}»,8!D–å… Ž7.%%eĈ7ÞxãŬ|‹‚CÄ«aŒÉ²¼lÙ²aÆ¥¤¤€ &“ ®ãu¥pª‚ µ€,ËkÖ¬ñññ:tèyµ×mŠŠ‚CkÞnžÌô³Ï>ãy~úôé8= ST8vSåwÞÉÉÉÉÊÊÂ}WQp2@ðÄnï½÷Þ„ ’““Ñn(88±›$I+W®LJJJNNFµ}lƒCkÕn²,¯\¹RÅ1cÆ0Æ°é ‡ Çnï½÷^@@ÀÌ™313ÅA”ÝÞ~ûíI“&a» Ažv·O>ùdôèÑžv7´¦¨2b7$éÛo¿µX,™™™»¡àd@e¦Ÿ}ö™J¥š2e v)`ŠŠ R'•ªkצ€äòÒ9›=ÛÝòòòp4/ A~,yIã®Åë–}Ä(à“&Ž¾ë)­ ƒno0ÆGx.¼µƒçmý´Bº§ÝmÑ¢ES§NMHH@»aŠŠ ?uuè3î¼ïíõó_^mî\ùúŸ@$„£Š"»)¥OZ»þïÈ’ŒQEvSE9ã5JeIQdBˆ­êðÖ÷ÿÙÙÞÑ籸ÝîåË—gffzìFA»a‡ aª(n TH¿ýùŠ_).þU|°«lÿº¶æ&Ñ;dlkeQ{eaùÉœøÔäšCkê*ʉÊ7fäþ~†¦â]UE‡P‡ žuÇZ* *ŠŽ¦ ÏíÛÌT’¤U«VéõúœœœëvÕ#Œà¤W*‘eJŒl/?tzÿŠ6‡;b¦ž•ï[õ•1,ÉœÝ^²ñdÁ‰èá³,þ®­‹_íl9}bëצ˜œàPýþOþ%ZÒ|‚ã-‘1}k7Y–/^pà 7`¯FpÒ §È2•¤†Sûë[”¶²=ÌÕÚa¤¡w©ôþz“±hÝÆÆòêÃ_7jo+:PQ>Rô“™Í±,Ÿ¨± w¨ô¾:ƒ©O‚¬n»½ùæ›S§NMJJÂv7‚\&„B­U'j“Ǥµµï:i~pXF€ë(ÙÐ5Ë“×$MýÅà‘ÃEaŠÔxbUpÀ(á˜[V(€§ƒ‚ôÉñ¸Ýî%K–Lš4 í†)*‚\f¤$Û[ÚêêÚªOìYô I¾;1!@§kO¶w¶Uïø׺Þã5ZÅms9–ø´ú£›;Ú;Z –,ûÇ Æ°Ar{ace­µzûÚ7~çôLr¸œöÞÇnàv»¿ù曨¨¨ÔÔTìUÀA. ÚLË©Í{¿xç9iòÄÙŠqy?9ºþã#ßU˜&÷¶{´îr½¸­²¤81ý¦èšÿ^ñš¬p“~öƒŸ*fPFɖŲӞ¹àof_}Q¨-;éo6÷23•$iÙ²e&LÀv·ÞÆÂX‚ÈÀc󖭫˵ñ™Ã¨rA›ðDºúEîÑFs9l*½0`ŠÛÁ@D‘p Ùm¼VÏP<n‡:QT*» ¢Juácëh®?¾â•0?ADƘF£¹÷Þ{ƒ‚‚<¿Uå­·ÞÊÍÍÍ[rÖÐ IDATÎÎÆÌ#8¹Üg;!@AvŸÿ"£ Qi @2@xQÛ•’a¨Þ˜Eò‰4N»óDΖS¦ž|†ºd’‡ üèV­E9êŠ4–‡¼M‡Ð Á%€ÅlzõÝ/’§=ÆpŠ¾ŽüòÁX’$I¤ö2¥TIxžU(1–»`Õû¯?÷P@`yõ„n~U½Æétükþbíà9:?¾*£þ;éÓëçy¡|û×ÏÞ;=,,Œè8W%ÈÍËï~´€IºÁÏß|–G^]#]ÇSyײ>úöÿûl™(ð‘Ð Á¯2äûõB”4=8ÜÒÒBB7‰q¤Þ’$aI (Z^×~èÐ!"„n.˜F#oØm¶v“ ‰ü€šÿîÞ‚Çå17² 4M™¢º*À&¸´]Kr«(+Ý{øx²òtƒ ¬&µŸÿ€µ¤<««¹Œ‰‹–éÛÚÚ$I¢(24º!8¿®~üI Š‹H¿V®Ðqœï´[ÚT:ÃtX`Œ9ÚùãÇ”Açú›ÍæççG†Ð Aÿõ—ËõÞ'_£ä™‰á‘¢€`ˆJJQÔÀtŽÒ4*+8bçÛ·ÛÉqœ¼ß»ApEƒ(¨—ó¿úÁ39 ,²#‘°V«ÖrJõ@sU`ŒµeE•…9×ÝvoÒu¿­¨m’ (Žã”J%‘B7ýWm-Zd›à»X¡ûÆÀ±+›k+Ê}ã½n'„ÅÅãÐ!V‹I’¤ŒŒ ®bB7ýîZn§}g‰-2!Q¼ £D·Ýe·ÊÝKïrœÖ71€$xzß_åÓy§¥Ku:,¸íNk›ÓÚæ´šAè¼üy· ¶¶¦±7ÝÇ°ˆ´ú½—L6©­pûñý+·|ð⮥_4jÏýnëw_‚Õïø¬ &gí¿~¿æ'åä å}ÿ†ÿ¾püh§ÒR¬ÊY¹eýü÷oÚĦLlìoŸžpǃõ9ø@#„$ñ”‰yH;£±±¡¸¸øçŸ&2C膠¿ƒ9ź€¬F;ªšššB@±Býîí?ï½þÅÏ'L±îÿ«ÔÅ_óðÛŒ»ŽwBÙ¡õnÁévBEîÏú€Àíß-õð§3ùkŶoìln*O¸þ©™Á’îÆ-}ïÓl§ÞA1TMÎÊ‚MKw,ýYëo(-È35DGû;w,ûöغ…nCjˆŽÄÈê Í©üSn?9}ËÿÃL‡rCs\Íþnøaï‚VÚ£“EçÀK?÷õIBï–Üv@ÚÛÛM&±§®hoÿ%€wóÁGóÍQ3B£¢:büúÿÁÙ\ÊÓ~F=`à-5f6†EÑà®=¶ÔáQ©I"žöʦšúä!í•'ŒIY4ïh®,LÊ@°,4ßïä™°äa Ìu…ªÀŽ£ÍµªÀ4¥–n*< ‹®PÐØÖ\aj¨Á(Nš:”ŒqN(QàKó÷Ò ™”¥Ôhz¿Ö]®ÏwhÃʆ=~zŒ± Ó¦M?~<‘B7}¦IÿòÖÿô#îò8Ÿ—à[<·Óå!GÎt:[p#È‹ꨙ+otlvž„1F‚Ó6Q ï@ˆ:5ó}Ž’›Ëaµµ7ÏÙ’6úú€°Ü»"Âc¥}ýì­G%Ivߌ7nÚ´iD~ˆ1EÐ73¢^yúw-û¾µšZ½¤ßö÷ Dözseç ÆÞEŽ_;?½_;Ïé8R&¡.àÝ#ocì½òY'×€R­ Œˆwó¼Ã[–·ÕWÉeÍÏþ˜c†E¹קÆKd8$tCpAHG¥RýýÙyúš û~^ÐPyÑ P´W¹z´¹é>}tךª¢<Š>wËXͶª=KÃ#"äœ~rþÐÀÀ@"6W4ÈŠðKÜ•j-ÝÁ±©.‡uÇó1H ¥†U¨c3G†E_„#{\èºÛ9´e…Fo ‹=K›À‘u ’£Œ‚ úên¡¡¡DfÝô¿ÊË­fSÓGc qéÙàrØy·Síg¼šÌ™5$ Ç S}"Ï?$u«*+A…ŽØu¹š¸8ß_ƒƒƒIÊbLô‚ äœl4DgÈ+!e‡ˆB¥ÑúRuõyñBÆÐP‡Åä²[ºs E!ž÷Þ¸¸nÛ‰II¾Š‹‹ÓétDfÝôv»£ÊŒU]W‡ë9½°W,D]sãáí?1ì)¢Á³ d3›v|õwT³;=#ƒçùÓÄ”¢FE‚nˆ1EpÚ “‡‰é ØÀûèM5Èg¤£h´}Ù—­‡W2ˆ¢%Iò2 ÆXÅ©S§mҀРÁ9´›¡õ BƒÎ?ÈfqY[ݶ¶¶ªc5‡6Ɔè“GÁ—S0Æ’$eee?žp ¡‚ó‚R©Ea =5p»û¾~ÙO­ Gã¡éñÏó]üÇ’$ 4hÖ¬YDTÝœ¯YÁ2”–x5¥ðÓàp B 8St²ìÐ6lØìÙ³€¨6„nÎ׬P*¸0?Šw{– ÝI^áh*EÉÈg •w†Y¢yÉñÜ_þ™0ëO4E „ÞEÑ°kå‚(±œah_•'000555+++  { ¡‚ aY ϽúVÀˆ¹Æð8 òwUö7Œ±Ón9´äØ •—S”Jå½÷ÞÖ¥M®ÂÁ†4Á¥µ,dºûÕç2ز¼Ÿç7V—+5ˆU Š@r߆Š¾ìˆQ}[GŠ1f8T¸}¹Qáñ-JÓ4Ã0¾mBãjñÝ\ŒC3̬i“G ôìó/ì´ƒ!&+aè5A‘‰:£ÁÔØX°{mxBfLzöåÓBu¥E¬B×K®a9tdÇ:çÉ‘É©¾ 7T*U@@‘B7¿Rו;^HHðƒ÷ß»k×NÞÝÜ°íím³É̆üæOóýŒFé²Ê Ž ½©&*9ëœ,…^Èߺ²=wYæà,ÇãÈO ¿¡›ËK͹îºël6ÛÁƒ£bâ£chš.­¨®8¶?kÂtè'Ý`Ôùék !‰J$aèG?ÇÀ{<¬RC3 =:\hq*(ÌÉ­Ú¿ÒˆLi]¸†¢¨ &j€€~íµ×H+\> (*99Y¡Pœ0¬*Æ@Ñ0ÂËgb a‰ë—ò½G§ïkGÇ{\ŽÂ _æ­ýsúà¨D†Eàå3ˆŠDCÕÉcëçÿiÌ Ñi4š.Y=Ï-·ÜMÞû@SÉÌÔeoT›Õjݺukyy¹Óéô¸ÝI›ùdLæX–cûòÆ0E£¼­?Ç¥†Å&)L&…¥-ðx^üÆ¥A…NÜr¦ˆÆòã%?¿•’œ\W[]RYËÆE¥úG*Õ~<ïv´75UwÔŸôW¡”´t ÈwÕ¥÷1ÓÓÓo¿ýv¢Úº!¸Ä¤#÷@‡ÃÑÒÒÒÞÞîñ¸+Ì«vgM ‹•‹â­—bŒ)$² (@W^ïøòŸ×ÐTPQ^à‰C¬Ó~|Ö¼#÷½Ð–˜Ly°œ6¹O7†üôöƒÙ)ˆfBBKv›ÕátJ’„)•J­VK3,³vÏóiiisæÌQ«Õäuº!¸\ÇwOYYÙ+ý;>áöG9}F§ ÀH (ÍöÄu‹ÒV|¦«.eìZ€-$jã¿~lI*Ñ œæÎéí]q*´ü‡Ñ§8Cˆ³>‚¼“çùI“&Mš4IvWՆРÁeJ@999?ÿ´ò@îá Œ‰)cf(u4§Pª´4Ë €¡ìxôîµ ëæøžîRp‡²®9úþI¥ Ÿº0°$I'¦Ú³ÿ;8°f¡¶í°Ñßß—k …^¯okk“Ób‘e@©TÞpà 111„hÝ\ÈËË[¿~½¹½­±¡žñ ÁŒšÑ ñJõ´ªÊß,| ¼WÓ‘U˜Ò„„'nd•šðÙ3îDÆ ˜›<í5îæRJ©S…¥sÑ€{°Ìh„lÿþ?ëÉ° _§¯Çã™4iÒäÉ“Oœ8QQQQ__ßØØh±Xd EQƒ!888***&&&66–¢Hp)¡‚+Ǫ««[²d‰ÙlFI’$‰"T\|çòåjA𲌌]ãÇoš2EÞÓÖÞ~²É3íþ—…æ®úBÑeÅ€ýÒoPE ¦®'ó‡f©¥yÝÿž‘¡T*»üªÕjçÍ›çïï’$ ‚ Š¢¼¢iš¢(†a†ñjCD¯!tCp%‘ŽÛí^½zuqq±Ë嶶ÞýÍ7þ&S÷ã[?þãEŠŒB4MyœŠaATFŒ˜Ëh X„®.€÷ðN›©4gCíÇ Âg"‹É“'w¯¥ëkjr! ts5¨9µµµ'NÔìÝ;ó?ÿ inÆݼ¿òÛÝ:q⎠îˆè!0›ÌnC ­ׇÄE%èüdZ0·´6T´5U‰¦gS±¿Š Ä®†gøðá³gÏ&ö¡›«œqdMD²Xø¬,EEEÊN•êãG±êtÀãñŒ?>99yéÒ¥V«ewº›ZÚl'$ ‚J­R+Ø ÇЀYŽƒnsOòÓ¨Q£fÎœI– º¹úù‡î¾V¬ iP©Àfƒn h þìᇕzým·Þ+kFK–,±X,²C÷_`,ÇËœq2^Þ`YvĈ×_= =B7W?×Bðè£ðÑGþþð—¿@|<Ìž g²§Àɤ¤mÏ>{ïý÷+8N¦ §Ó¹k×®ÜÜ\›Í&g8 wÈu0ÆIII£FJII!ï O k¦®Ü‘ÁÃÃ'ŸÜz+¬^ S¦àÔTdµÂÞ½¾NÔ¹F3 ­­Õn¯IHH謇˲l|||VVÇqõõõzˆš‘ç›’’’fÍš5nܸ n`¢Ý 3êwà¹ç "Þz î¾Ûë[i(,¤G ²Ùð™ü8î³»îº÷ï÷V‰ó¥Œ“'Oʱ3ÞÉl–eBþþþ©©©™™™†° ¡›Æ5K—ÂÃÃܹðç?Ct´—ÊÊÊ}÷Ýàf®^Mu.ïâÄÙ;räþ{ï½ÿ®» CO"I’Çãq8Æ óUsÑôdþò äšíÛáÿ€5kàÿƒèh¹JB¨ººúÇáà°a5áá=±Â˜IJ²UkÖx<žžŠ¢”J¥ËåZ¼x±ËåòF¸†€ÐÍÀQFÀ† ŸcÆtä F²X,«V­²ÙlËŽ3&b÷îîD‚:ÝÆS7l((-ÍÍÍõ&KîÜpOk Ý ícxã ¯¦#Û6·{Ù²eµµµ wÞyçô©S™˜ôÔSÐã¤[,ë6lhnn>;ã¸Ýnbnº¨ÚWÑ@0F6Ìž½ñµ×ªêêæÎû›ßü&>>d-æoƒ1cÎüÖ%)+?_DhÙ²egQ^B<Ϻ!¸P ¹Š¯X5!@¿ú*úé§é«V]W\¬OH8åd??xï=˜>ÚÛ»(8Y]͉bSSS~~þàÁƒ{úÙ˜" ÚÍÀVsàÍ7Ñ{ïacýý÷c·û4=c5 æÎ=ãBššü,Œq^^^Oœ‚h7„n<>ý^}Õ«­ÀîÝ°pa'ÏøÄ»ï}†šxþmmZ»êêêš››{¢›3¦þ$ t3PV¯¿‚à«Ë O>);|¸¤¤¤3ƒŒA¥‚gž9•¶´BN§³¸¸øŒ* Bè,“å„n¢£áž{ºî<|øàë¯/Y¾¼¡¡á4›ë±Çº(óGLy9P•ŸŸÆù©³OZº`xã ðIj%³Âôõëm‚°fÍšS3JC` ŒÝEµ€ –¹®BCCƒÉdê>?…E‘0¡€_~é :›-ýøñâÊÊœœœS&•R “'w?[g±@ç,xQQÑÿAEÒÌ„n<0­þýï. ΰ¼<†ã6lØ`³Ù@vS¤¥A·„{*—K¾MÓÅÅÅÐÅÇ çÍ"-M@èfÀCößz+DDø*8aõõZ»]ÂxíÚµ§NL½¾Ë8‡’$ŒEQUUUÐ-ÞOž™"ŒC@è†!ˆŒ„k®ñUpn·Êé¤(ª¢¢B^£Ú3Ô nj€$I‹¥ÛåÉD8¡/f̆ñ*8 Ïû··€Ëå*))é8L§®Ë©B»]öK’Ô=ú†¬Ì$ tCp:ÆŸÚO '´¾#$IRyyyGÄ0ÇFÓõÝc,ù8tÌfs×( cLŒ)B7 ŸDYÀÏba\.µº{l±HQȇJlÝrª“r.„n|€1(•sÊà<™GZ[[M&S‡EßÕ˜¢(_í¦ûÊ)æG@è†à4JÈÈ8í¥J’¼!ÔØØØÓ©¬ ´xœî^aoLÒÌ„n:1dÈi41î$‹SóMg سêt^ºéN+§Ÿ" tCrvôSB2‰PUWW×±×áèrRsPøTkèî©!tC@膠“ÊK7ÄjkkëØëåN˜ _Wqwf‘é†S„n|ࡇx–ÅÜ!ÈI*¬Vðx|óéqÆÚnq€EÑgÊ•C@@èf#'ç”’`ñó:ÿ:ÀX­¾Ç@}X˜ï5üýý»Ó iZB7^EÔ×{wˆeí@ mmàvwÙ×àûUÓ-†d³& tsŽ>ˆûúë•ê¡¦={¼;$†ñètÐù8|QYé«Ý€]­¶k4¾¾¥Oh²Ęº²äü2—|æÊmhÙµÙÖÚÒn±·™íåÕ5‡[­R$ÄE´*£^ëo €nufÛÛZM›É檮khm3Ó è¦U±!AœB W\iÚæfßIneÍ:êÂÅÅpzаU§sªTÐYÃqœB¡èw\*8öƦf«S¨¬©kn5Ñ4ŠŽ‹ Ö*™°Ð08½ú;¸œŽ¦æ‡Gª¬®khnÅûi5ñqÑÒ × þ¿‚ä3W.×÷×KV´ @3¯”8Ÿ1“ RñnWþ±VÉQ¥£a¬é®ÛnfJùxs{ëÒUZÁßZžRùØ@5®²Ø6•Õé pLôÇsfߌu%1ŽÙ &SGË:)>,Yà:t–'ºžd0Ø}¬'„P7W1@sæÌñÕzp§ßc|j*ë´/ý;Ïù«·¥×þ²®¨‘·Ò'Vùã¸@5–¤’ÚWQµA!¨ì›gO—Ôq.—¯ü¹ÜL;£M`Ôú`•2EÓµÛÁC­ŒÔ¢CöÜ2{ú$c`ðE•|æ²jë¼Üƒ7mn²If§€´t„Q3iâ„ÌAƒ}GZ„PeEù+ï“=ç ?µŸátf@pH¢èùÿüîó÷LùžGÝŽGŒ1 9T°q±ÎQn2Ž6qŠÇy¶‘cLQÈÍ »ýóí爎Šº2ç€ùó½ßŽýã‹hAA&O™21+ ÂÃAÎÝ"E}sï½åqqòŠožçgÎœ9fÌ,ò«b:­Zò¸l]òá²’wÞ~ÑQ³ý–?,Ü´~!+ñŒB¥V*œ–úþå/;ròY]úÚõ.$+ IDAT 9Bý"³Ù¼?ïèŠ{ê¨áç¨u uŒ¢U'‹Žï]—©˜3}rb\´R¥²ZÌϾþÁ 9/¨Tœ(œM’i•å4:Xa™|ÿó’taf•°eÉÂߎ‹š>u’OøçUA7rOÆ’ðÉ—ßV‹¡úØ¡a!XI<ÅòE¢ µ±¥½üPjšzÍ°/Öæ&\{·>röÄ—Ý“”5â,¯ç´»¢oÿá÷7f%%§\î’ÛÞ³fÁ®]^£hßž=?¯^Í2 x<ž?>þxä‘#0}ºïIŽ{ó¥—dËH¦›'žxÂ_Ë-üø½ÃUV$ ³î"›*}èÕw-<—9iCnyôË?Ü˯^j·Û¬Ï¾ö®'iNÌð©þ!‚K"ø2ˆ¼!‰ x°Á;ìzvðϾùyØéuh¡çø/Iª>q(qP¯¸FþG,aÀ=âÆ5{ŠÜn×eí(Å`ÿþS{æέik£:[F«ÕjFXº´Ëy'RRÜç–R(ÁÁÁÖ}óýþ–·Þ~ówN~çÍÿSe\7sdbxÚøW¹Í턆¢–àqÿzýÅÚœŸ–n:®:wÖ$ G¦É{+ù] ¢ÿ|øqž3&|ÄìÈ„ I8×–€÷`Žec2G†Þ²ü°­Ü©ï%×`,•Ù•>r¢È s»ÖäÞäqáØÁ㶙ÚÚÚ.Fª#æ¶Ãn³ØœUu;÷ì¯nl3¹@À4Ы…4tpƈaƒ4JÎh4ò<ÿŸ˯§Òê}_COm( †ˆd}PïƽiA‡Ýœ9n:îKb:ùH¥Z“oQlØ´íúÉ×q†ø²à„`ÍðMñØcEÛ¶yg¯ƒ‚ƒ4 _~ÙåÔCC‡2‚iC“““¡Â#…ÈÖð×—þ,xœR{CƒÈª9†b8­ZiÁØ£Š»wæ(=¸SbZ›¹t‘|÷´¶µ›íî]{sN””›yÖêâ–e$O–MŠ7jx€^kô÷§fÙÊÕ­ã¢âIî4€BÅÕW—O¹ë©^»åQHLŠVoEÜWá×Åøï' žyìw~~~—ÝtÌñîWü\ãP¶ jÕG »7SÍzc(¬«Ú¾"?X-…)­µRò-†ÀIì- ÌÍuYnù^‚1Öøµ£$öÙƒ1¤ºá³ßßÚTwãÌ›‚‚‚.;?Ž|3ÿùÏ©=ññ!!.‡ƒeYùñC"#kÖøzˆ€C¥*MH $É«lÆÆÆ"Ž¡T!‰øÃï!,Ha*ZÂ@Q4Ë Œ1­`‘$! B^»ž¢ Äusù4®Ù¶uKAµµÉ£pPúИI‰™þÈg›$©Ý4ó=ã dFÆv°Õqí`ïC‹a ¢R‡! ¤^ëé±iCÅþH>Žˆ‹\úcÓŸ}:uúôôô é9f.H‹oÞ´þûÍ…ƒ§= äÔ±\‡!/ò§MàQ‡G‡GK’äð8-û+·þh¼ã §ìåóH"ŠL8·ÓË—ª±ÔŸIZŒ±JCƒüÒµ[ó~ãÍ·TªËi®JVm¾ûjjNQÉw«¨ð.ã¦i:">žzä‘S G† ‘vr‡`Y6<<ÿñšOó«nA•»¿ÝÑøý‚ÿãhªª4Û¾c :°i¬Õ›÷+mvðniåúMYÃFÆù @®©®¬xýýÏã'= I T¨:~|Z c„ÎÏ–=cð¸ìÕææÒ]‹‚„FõR’°(Bò°k{éðÒ\ÿÄUð@Æø›XôÏý99o¼þzBbÒ…’|úµ×^;Ÿæv8ì_-^±»A;|úoiF雲À÷þºlS4²}ù'¡±© •º÷šü*)»eï‡Ón2í‡*jñÂùC2’õ~Z9}ï¥%S70g´·wÜ°^ÿøÇʼ•Z}]h¨æûø­»ñF›VëÍ¿4fÌŽãÂcRB5î%ß~[Ü‚_üó ÑA~Æ`}îÎM«éYâ¶ï/¿uÎTóîÓÅJÓU<÷×ÜœN«Fû¶oÏž”f¸vÙ ÆÒ®=Þ_¶wÄÜçU:#E1g¼óÓ%h†UéüS²¯Ý¿æQãzçAþ„_Cò1†€ð(‹Õ6üö?úï{AeTx(Ã0çÿvÎkfªº²üË•;¤È±1IIßçwFQKPWV‘”‰/Ëú".»Õí´„… "íÝéï¸çÖé,ËÁ¥®RPYS“ûɧì{ï¼c”Ðö ÛvîôÒÞ`˜®RI~èsŒMÿ&¸|ˆCCC¯¹æ„â Že0–Ü.— JͨTJx‡KÔª9›Ý)UjÜniÕ ¯ìxœx^¯ÐírÝ8cšJ¥º"T‘÷|¶èÇR>"e䵒жâ”p27'nЈËPò1ÆêJŠ"“ÓhŠQµÜ󵑑çÒOºÁ··¶¾ûí/ÁÃç(5Z,É P?Úý²Ӻߞ¹¥¾yߢýõ¹K~ÃË×l:f 6‚|ôTZbÉg5Bˆ–$èt w(ØI§G9"„.ùÂ(Š¦‹óÜ7ÒohöÈË_µŒßýøKœt£>0 ã~IogºÅsN’\j ®ãöxÞ“»òƒ·Ÿ¹;(8ä|„¿ÿ¾›Ë~Ѥ\¯Tk¡¿쿦qtþ·‡16…Q~÷Ò_ßøçß^¾´^©µUaHR†]~ŠV¥Dáòç„Ð¦í»›µƒâÂdÏK¤·óœËÖrôµÝ0Æ Ã^{ï³O½þ·ùo<¥Õéûÿ¢ûÃîË–/oT¥‡‡œõ{!IÂzƒ^1è–eËWÀ%Y»(ûw-øøc`Y øÕe ®¶fÉŽ“‰Y£`À”ý“Óã„qw½üÁ‚e’(ô[ø©~üw{Kóú£­)C³ûä'¿:Ú]phLʶ–u¿¬•µÍK@:÷Ü•@_mÉC8–ë>°]^fÀëïÎ>ãA9ö}@I>Ƙa˜vEìÇŸ~.IRÿ²ÊöǘZ²bUöóD.ÒŠËéÒEZ½n©Õf¿ýöÛmÕfÁXµ ¢“¯²†eæóÏ?KHÞ%Š"MÓ×_}ÆéÕl.‡W_tì¨6u Ã@ïƒÅ®2'(~ÐÁåk>øàƒ|P×=‹Û×nŠ¢jkkív{ïÏfÎÙÖ2u¹]îí;w­Þ¼»ÞÁjýCÇÄgäü´­µÅ~*0N/,·oßÇ£GÃEŠÂ@þô'xûíÓvNž /½.á‚‹Ê2ò E±¬¼ò«ï–”´ˆ6§{æÛ²^ßVߨcïWQkjjRRR.ÝÈ-îrØ7lß³ëx 68ë®W³Ø´è3Q–˜R¥9ëÃtbêñãwüðCNv6…Óé¼ë}dÉO> _}Ú/“'£M›øk%E4!…‹Í5»÷ìÝQP× Òg½”¤€Â½»êJ ¢Ó†`i€¶IIÞ6NrhO%úú Μ̬Ó»_.W$NJ¸æzŠÑ%|íMÔ€,?„1fXt"w·*vðØ_ߺ}¸8) uÖWñ®4鿦#ëêAm-Ì™ã[ððáhñb³Å²k箘†^¸xÃ8|òù‚fý0CÆŒLµ KàqB\æh›© ðåÞ㶚Z=¼6 š,íS©Õ³*ÂüïW«3nòAHqÆXJQ‘n( µ5Ô—Ùý0ÃÎݱ‹N×f4Çqò[q»ÝýäŒOMB­Y‘‘]¹&&mÙbQ*?ÿì3‡ÓI*­\¼®…1^½nS£~DH|§PzuŠ¦õáçLÁwUò/EÚÏÿ>á¶G&<ð·Ýûó¼åUÏX|µot#› ¿lØܤLõ ê)sÍ“B©¶ôØÁÝkŸ ÷ÜŠ÷@›ÑØâç—1t(ð<¿fÍšC‡õßzB aÞ<˜9³ëï& üüVIúö믭V+áš‹Úµêëë×n OÌ좨þjIg.7XÚ·.ùxÊ]ÏP4Rk”™7?]QV *•*::ú|é!ärØVî-K–}þ1”cš¦cøLjšî2ƒ1Æsúع® _ó c£†½ÀSEcPjžn¬ûÒ`€à¦¦Ûøáºâbguõâµk÷92løð~ZOf3<ù$ÜpC÷ÔÂø¶ÛÐÚµuvûW_~ÙØ؈üÿEµ€÷ç“1é7X:_f‘%ŸõJ>}±%(8pêSÝí‚´‰(ðçܮ5H"xœ2l‚1º]Î1cÆ@_æd{4¦~\¾¯B¬­ùºÍK~@ô……E/ÌùÅëH¡sµ˜ÊéÌ,)Ñ?ù¤*:zÒÃÏÈËã,,ŠÐ=@C~–.O$Püã ÿý/ÔÖv•¬?þ-]ZXQñÅçŸ[,–>™ÊýPm,í­fe´RyÚ™æPþWOþüÉû²ä×í[œ·g:oÉ÷Ø›·/ø›Ó)œF’ÑìÇ7¾}bÊÜ°á‹\ü…‰HDùGj rä7BÄ Ÿj±XòòòDQì}¤_®â²F{X¦úB­ù¦9…µâh}eEt|,B”œ^Û\onm£8}xÚPWý‘œe p`”>0Öd«)”ÁþÁ–Ú"Æ?Žñ4ÖW”Å& Wq¸½¶ØnjS'R(ÆÝ^n¶BPTF4X –šýoŽâY-n­†»€ª¯È°˜¢©Î0väC  ¢±1bÅ ¼bÊÌ„©SaÔ(0!%ôzÐé:¢òäO› ¨«ƒÂBX»-:ã†ÂÂÐ{ï9æÎÝ¿eËŽ;»obO]ìܵ+1{²trïP,g/?^WV“”бô¹ú¨¹µqúð´a®†üɈ6…Øj .È?(ÄZWDëã¡©¾¼(. ~˜Z‰ÚkNØÍ&MH²,ùS…É,E' -|ºU9þŽw_V°príG6þ4jæÍ ]RVêCœ m{{ûŠ+n¹å–^Ž‚=ä¨ YƒhEÚ¸)ù«ˆLÇwOÓÁ¼õ«úPgÅúCÛw2´ÛC)ykí‰ýÛ pí?å'7þÇi®Ûòé›’ÂH»*·|õ?^°å¬xš¦P,ØKv|õ/‘V@ˆ¡áð/«‡ÎyPo0¶ÖW]X+»=.ÝeìNã¨ËvA¼óÜq̘“&ÁŒpÇðÄðì³ðÔSpÛmpÓM0iÜpÜuW\sóÍpà@ÉÈ‘_òɶíÛ}Gžçãââû÷jäëP Ð,PT£hÇa4 ÀòÖ–}`ð…ò#ŠKs}ÁÚ¯ šoÉËýe¥BîªÜ˜·u;C{xJ)ØNìÛ Çy³à`.¦àÄú÷溭Ÿ½)*üwõÖ¯ÿ'ŽœïzDÔ!ùŽÒí ßì|±½¬¼–Ço.ÄNz|øäiožÓè%ŠC?~¼¢¢¢—gõ¨ÝP¸#‰Î…aŒU‘c2œùÛWlÈg)†­Ï]ãátns#cŒn=¸…½î÷¥ŠÉº¶öÇE€­«ŠÛ±§¶½Õh+w JÎvxÙÍMÖûõ¡ÉQic°§ÜõëÞeô“_…(äÔjöšÃ-\Ú¸(}‹5µðèÁ¸ä¤ ¨˜â’ÆMs]o¯èñ@q1÷Þ(Gàï}Äß~ûêU«òóó1ÆòÐ!ϘH’t×]w/«+ú3þ"„GSyÎ&»ÝmL•”ÖC'AØR|¬°5}ìh,žƒ¼ºHHg‰‡+,ÇZœNNq¡¢¨°*bdlûòuƒc9Jä®ñpZ·¹‘5F·îÝÈNzœBÊèÁ×Ô ØêlW("¬à®mmöKtV;)YC2ÿ8»Ñú>$12m %™Áݸþ?¯Œz|Ax R”0 $¸Ý 2pHNo XB4Ç¡‹–™—唂$€ÇãÙ·o_llloœÖ`ñ‚&õxOòìWÑñ/ËÊ¢0–@’0:xÆ\J@a4*œ¦æ“›PÚ,Öej>ú ›6™C–Ñ€(#†“ÍsS­1ÂPv`вˆã†â# ±fë§.سµöÐZ«.× ŒE4§gËWiÆáׇÏÃyë=EEáGiܶmG\Ü¿Þz+77·‹¥×ëï›7/-4TüòKè—ÚÁ›J×ôÐE…&¤Vmz??¯aËnÇK¼Ëe·cÁn7›ìímÞZ€¶æ*»Å"ßïh77Tºœn Aý¶w·þ¸\D I¶æ*Kk#Æp¥»±³²†”ÙC3H±“xOÒM/S'”–Ö# aŒA‹À† ¹é.J0Bœ¿Aé¶5ŸØ©³8ÞÚœ¿–M»^øNɧ‰˜bQÈÒ\ç®/;°wH>p†`ÖVÞØâdXD1ó¦ÆÒB|ÑæÑÞ#Wa¥(êرc½\ÊÐ#ÝÜ4íúÂ}ëiæBÌï D^’DžgFÞóbÕ®oœn>dèTÉT­0„ ­Çší §ÂΆšâ†ˆ„€]‹E™(í\½*aøu~qØšm9y%ð“‚´’È󀱤 4ú¾÷˜ÚÇrŽBïª)96âÎ×'ÿáÍ)¾•="úà–- Û£ØÈÆ*ÎéœëP (*Çß(k2î«ûï_>gN~V–S©D§»rúØ<aaíÏ?ôÝw¿Ÿ4é«7¯YÃó<˲Þd±.—+>>þ¾yó8¦L=»íÏš)ÞÞÎ#eHÒÈØì1ù !1Ò\}¨hß°7íÛ!™r6}þfqî^ÑYS}â«„#‹_=¶ó‘•ÿ*9^áj-ػ佺.y½¹¾¡¶²D°7¸]¦Üï^=–³£tçwGvo£(tEóMzæàö“»ö°¦$òXyußKU;8ÝBÈ°iØ\ÉéÃĶc VF¡gCíɺðøÀ]K¾65Ĉw®^•8b¢.v[·ãèÜ’Í_yÂ&k±Àó°¤ I}ß{\ÝOG÷„0PŽžuÓîÿýîðÖµûWoþðɦ& ¢Î¦™2ÜÙ ês’ËÁ1§‚ïz¹J¹Ç:Sþë–.4¤N¤© ÂŽ”&8A¥V1ê cH¸6$Ùž^wl/8$uÔH êà?s³92s´„µ ÙCµZ…%ÏÄ I=¹µh§‹3ûn0ͪôÁш¢h†ÓÇ…eŽ±×—éBâ’¨ ŠK ’€üÃã,Í! ‰= BÈãrü²ðÿ¢R†²>µPzä ¬Q‰Ã?ÿ»ïÏáþ FÝñÔ´ÝãÇOK&¨©‰Eäkõd1uÞA[llÎÝwà •Ê‚††¶æfÞíöÍr +8S¦L™5k–Úd‚3àСBcHû¬”jmŸMnC¸AißõÅ ¹×:ÜtDÆ0wkIc929ÝÕ^ÙPÓÉå–]ûÀ£ÈRt4¯!!vì­¾ñw„F;\ž€¨ äQAq™¨%¯Y1P’ñº¤Œde`JìàQ-{h÷öÔ‘×ôµ§" Ú›êmåûüòó&&&FDDüú\#ÿ»AEm;Ts!(§SòUAÆ°pmp’xJXtdݱ½T@VÚèÑTÁzSS[dæ k²‡iµYòÔI£'·írÑa£o¾›F˜f”~!ÑEÓ4« Ž4Î^W¬ Ž§)ŒÔ!éIÃǘª ìv1}æS±É Ðs¡V6÷1BŒ14¬„ÓVsÂQyP«ÕÈÓR …"33³7&Båp8žÿ÷7Óbhú|,@Œ1Å :ª_"ƒ$¢€fK ÈuÁ$hD ɲBH1€ £r;Eƒ$žcC¾ašïQ£Ä# Æ{V-Ôƒ“†^£Öù­Â/ÆnºsÖÀ“G–/ίZÌE›ÅB!a$ŠŠ©¬L=~<º²RgµJ4­t:n7%I€àYÖ©V»9ΦՖ$%•'$Ô††2#I]œ ²§!>iÒ¤ÄÄD(.†Ûo‡#G`YtrÙgÛ ¡}}’(R,Ã*ÀÞXW¼ñƒÂêÀ©·+ijâöýÕ·<ø Í@sÁúëÖĦ;kFþAÓ¼¬EqÓ˜ëÒw-ü»›Ð)…Òj÷Üþû˜‚Š¢¡ìhnÃæ÷’Råv¸ñƳ²².‰v#7û›,äÒoòóèu¡ËK$ù x'Ñä;§@$áÅf1ƜٱÑÚÖ7htXl‚À÷ª ̇Vªw”¨5Z$) à‰'žè¿«c¬V«ÿͤÿ|7?súÃ*Í{p¿ ¼Èò×atl`yðþ€ÅŽ±Däêøµó/}'&%ñÜËy…³5BK!4~Î-µUy›~H198*®Çé„h”M¹³™ÝAá5ùÅúÎZÐcŽç1Æõaa5‘‘´(úY,"M«¥ËÕQ!ÇÙ5ǹ ‰¢(IR¹\ÍqZãó<0qâÄ´´4¥R ?ÿŒ{ UU§Yk.ß}¼¨nìmwúE„ÇeÈ+Ø4#ðNN‰x[ƒ»#”ãTô‡_h„µx¥‡yÈYºïD•¨iÞ3ùÑᣓ7¿} KЬ§¹¤ÞtÏË/4ØX\±•aÁÓ¯ø I’¶oß^\\ŒZ¾|¹ŸŸŸï›ê~Áž*dÑ4ÝÝm‰b˜3ºdÆ{„Ðœ9sn»í6øã½sÞûb©9úšøô³Ÿ×_Cò…ÓþÎwÏ9oØã™c¯·µ·ÞY_zlÄ ³Ü.Ü›‡ò¸ G7Ed ’:••^N„3g¹(¤&'½ÿç¨×ÿõN«6mè„›:‹xÁUôÑñ†D0†FŸóж¥Ÿ0ì,CPxÆ'eSî=º×¤ó/Øøõ„1ÙBgŽ<…$I’¬ªXu:p¨Õ=i•Œ\p®ÑÈ}`êÔ©£FꈪZ²Í›‡ú’X¤'øÇ2œøpÉ3Ó0bÔÉ3žø‡ŸÆ›¬~÷R£a‚†Ƹ³2'–6$s´aKŸœÎøE]ûûw”Qâ¦/oLÌštgÞ¦…ã&ÚûÍKzÝ_#¸ŠožŸ3d¼*6¯Ú4éÆ)}­ª*‹ì¸qãFš:uêÈ‘#½ª· Ý3ãbŒív{÷lž¢(ž1®Ûíöx<Ý/âp8¼Sléééò~½^ÿÚ3-Y¶bÕÂuãny„á8ÀWFMá>I¾(`µŸÖµ³JìÉß¹9mÔä³VcN…Ö|üúà´$©S—$)88¸—ó-øœŠåÖ{>Y•ÃrÊàè¤Àˆ8,IÈÆ*TpcÌ»‡·®~ÃE÷d€Q¢½uÅÇ•ƒƒÁ»Tc,Â+¯¼ÒØØXTTTWWg2™¬V«sÙS?¹ñ½v“F£ HOO—»³}ô¼ôR—»èŸ1…1„häåuƒà «€ŽˆV ‚,F’7(±\ÇÁ«èœiXn@ P$ B_a¯1—,™6mÚÈ‘#}…ðW6¦äÏúúú¿~øƒ“Ò¨µ†¨ä,DQc•V¯3]MËH:ì£-ˇŽ÷3†œýMåïXk;ôC\|‚7ž˜çù™3gÊ ú©ÝxÛ}çömkŽ‹ÓxRࡹ¦Òfj‘gGuÆ૬®BH¡R‡'f–Ú‘6r’x&'%û"3E½¢‰1Ž‹‹S*•111111`³ÙÚÚÚ*++ËÊÊjkk½ã@Mž¢¨ÈÈÈØØØ­ÖÇû›Ÿ?;vœá­‹Pý©þ´y1Á}ú¤ƒ»#+­¼Eð8O=?ïx‡·Û ‡žaîkoâÄ èË'Ol5Ý0UØysç“/¾2ëïÆj?ÿh?7ÓÕ'ùXãç•2¤hÿž¤ac%±ë¯4ƒêËŽþôC2R|¹F’¤´´´Ó†ÉþÑ 9Z`L™ ;¿DÆÝ|‰Æãï¿õÑGw¶;†`²(üÌ4Á»ìf›Kã§WqL¿]¼6«ÙĆkiöŒW¸ú$_®›1züŠßHÉë;½‹(pÛ'öÿR³ó›‘#Gxx®¡9²— rº±º±Ø«O‹9 $ EE䬯¡(0¦(Ä)‘ÕäÌYóm*N00ju˜/×ÈoeòäÉÙÙÙçûßÇÃûïÃÒ¥ÐÖgâKLÌò9sÊXVqµ«6¨‹©Ø}e>Ã’>„PKYÞ¿ÿûÙñŠú¸A¯¼öj”¾Ÿ 䫪ªõ©0²Û „x„'¤·56ùƒ€U ·iµµd·¶gg÷x:¬e¯j“‘‘ßÛ|ç°ÿE Ñ­¸$‚Zoä=ÀpÈÜÚôÓ‡Ûüþ¼¦.&X§R©e_¦÷xA†*sMŸ4½Ç›LpÿýçÏ÷r—h: ¨¸¸ï¿¿Â` €^ÓVWºtñ¢òvÏŽµ?®Ú’™›k–}ÿMY;¿gýŠ•÷By¶oX½bÛ¡æªÂE‹W·»\ ?ÿ"§›?ÿCE[þ[Ÿ-ègˆ³ J@smª$BLÆÈæšRšQ”v.ÿêû?ݪ®ßÈÂió’$éõúÙ³gÓ4}¾ (:Ø!ÀÑGಙ6Ìÿ³£¹\Çð™))ŠˆtAáô‰rgffΞ=»Cíì ¿øÕÒeeðÉ'°p!¨Wpaí õ‚¨ÈÑõecí‚L4ÃädÿnâDÊjU©4{•gnEµÖ¹dÍO›w«»ðÐÁm÷üýO7F|ñéG+6ïQS‰#9½ôÑ ·®ûqñŽZ~S„®¹±ö½O¾Y´èóÊÊÊk§<9$-}þ–}ðÜý*)„(4 sWJÒ•m\@;ããbÇw“|Œ±Ñh|ðÁ9Žë½õsºa°›¡ð€2¦dUÑÑZ=2Vƒ¢Ò1 I’:¬'ŸF$IÅ &Lœ8ñ4*9qŒF êñÒPZŠ÷íC;wÀî=PP ÿÒ®Ö?’ýÓÁ£n†[ÔV>ÖÀ©Ñ¬ž1u9ëöP0@)£²3¯úW@Ñ CSÃnxè™Û‡ýûé»×¬YT{Ã_X†Ê˜pßK÷Œþø•‡¿]óMÛ w(-©Þ›ÿ™íȺÙþ}Ù/»xQTkü@£d‘µÙп‚!Z­ÚmmÒ„&(ªA´Ö”$QQ1‘¢$Iây¡KŒ%ÆXÅ„„„Ù³gëtº>‘Ã9è&2$/©AañÊÝ –FD§ ø.Í-I’F£¹ãŽ;âââÀw†Žç!;( ‚ƒá¶Û`èP0ä„‘àrAI lÞ ¹¹ØfCGŽ1äبö‘Ù¿/=1Ëäz:+«…§ùdñI…$ò¬æ‰! ÕˆO¿vª@;ë÷çfŒè'ÙsrrêMÉÔ`I’âSR ÄC²NF2EG¥,Év$+öXrSËNÇv[iâ4Ó´S·“xâN’iëD±U;Mf*ùäqãÈ‘ìȶ¨û¾HŠ”xˆ—‚¸ñÞÛíO„hêMª&™ýü…!¼}û~øîþ~ûÛßž<¶ÎÙÿ“ló¿56éiŽEÊ΂âr“)Žë號g’ jY:Æñ,;ì¤èÙY_ͦé–s§ÖU.¹Ò9Ä ¶ #EÑL˹“`Áýí]nŠ·e St¤û’;üWº¢”÷õ[Î7Š®ôtç/Z~=ú5Á®RkmEÖ±öÆœ¢Š©ªi9ýZHCWû¹¢Ê\IVÆG Mèõz»Ý^__/Šb"7uB—¸{Üþo¾½é‡?ßV¶öŽ›ý1JŒ1/ÀOw¼YQY¥fÇ«}­Óé,KFF†Ýn·Ûíj–ÁîVݨ+WÀ¯~•ä…šq»ÉÚKs ÍýÁ"® G1Dåá°[CËÙò«ÓJsÒŽ¹+@Ä€¢’uÚŠŠÒèl·Hѽ­G^|ö­³#ßþÁ?¦Â¤èößù«gZûŸüÎ+ c X=µí•8rô˜cÞ×ZµÌ—=÷òÏÖo<ÈëSÿõû0œ°0«™P®y¸ù—ovC.·¨X‘g¿åS4t^í6Q4zÄ“z¸Åb±X,999sæ̱X,` wÌ];=E4¿ò½Í?üùk%«ž4ÚÙǺz°ë¢¦8/‘Ëd6›Ÿ|òIƒÁ &ƒ›«Ø©/^~$½>ˆSÊ–+—Íúg„„N¦ë!RzÓÓÿwåŠ@oŸÙ`FÊõåvšah—dŽÅ VmÎåú/ÍöµpYŠ×}ã¹µåtÑ£ÑÙz\–bËúËõÕBLF£€(À •RüOÿòÒ/Èkõ:˜æ?ð›wÅ$™å5zf’æúâs›ñÖ'Ç¥Ûw*0 ,† ÿóãesËIª±X쩧žÊÌ̤i:‘)6™.¥’‘yQ_}éiçç¯{{Z#ÁáÄ™H×GÑê´Z5ĉºrɶJõKqóg;Šr³ÇæMj4­VËq\bÛë-6(Ÿ= þøÇä›W eö³~HcüIAA‹–j8^1üìÙçû¬é×÷/6^ÐèµÜÞÑb~ ¦=¸¢P’gûr!ÆHQ Íj &1ÅHÃëJ@±ZƒhSÔ2LHAŠ‚äÌf³NàÔI‘Î`4›ÍN"kFý ˲ß}þ/LŸöž?ö*Š¿yãÎ;á𡃡°'kwÇÖÿÝ@0½RÓ Þ¡ ß“T`Ì °ùøáö½¯Í«(—º••5¡3y§FnÀ˜m²®^=äó @u‚h³š›ÛÎ|¦ÚæL²âß”LÐï¡V=Ýüæï]TŠ‚F<Îc»ÿ3/EJIK›4Œ16 %%%w¹ÒþýÀbñ8…°,ßò6„2ËÆY6Îó—ÊÊš**ú²²(„(„ Æj•é„¨©/†ÉËËKd7Àþ)e?áq†w³)NÉô>IËÇWVU]íêjllħŠ<çk?{ ¼fÍ$­w cLÓ°õì¼ÊšÛ÷®_@80ܼ÷w¡–ÝWÇáØ)Ô••Mí1ŠÌDoÆh4nܸqÿþý²,Ó4Ÿm¹ð»×î{üf«U–&ÜqcYŠq¼0µþ¯opPñ´úàF{•cîb‘¿~Œ%ºî{C ‡cÝÍ'‚×.…zΕXR4:Ó¸ ñx¼¶¶ö.¹LƒgŸ›7ƒsç@K lkCCM'O"µ~;EÉ Ñhü¢èMMõ™Ln‹@+ “¦›r¨Ô'=oÞ¼‚‚0wÞÏ5X!„S÷“Vàl>"¹.vÏÍ*YhÍÎP'_ Ë*èj¹àí<¹Ö˜ÂDì¥%ñx|lãE)...--ânœP”+±"#˲ÛínhhhiiQct¾åjå£_X5OŠá v:j=õYVA…ÁdÂÕåûäË{µMÁžþÁâK>£ÑȒЈ —µ0nÏ´r ÍÍ¿êx<^SS³víÚ‰^úJsó®]»Æ–¶QhZu~Ë"~!ŒqUUUmm­ÉdR7‹ß’Ý{öw2ew¨:8³¸sy­é‚UÍÃçó?þðáñX Ðïö†ÅŠúoýµ›ðWö^¹À°œÍQ6…íìïlqúuª‘ËÈåñú#šôNg6˜ÓbáP$4¬%_Ïœ¬ O ‚póüEQQ_xá–âíÙÌ—ÐNu¶o³Ùžxâ „PKK‹Ó鬮ö5úmóð@nU­ Õâ¤+-BH‰i™ƒ=mFsúäïMý†X$tíÌJ²MBÂÊâ\À!IòG‡ÚygS8(fáÑ_ø¸»SÿRYY¹jÕª‰6I–åãgÎHÀ±Á|UbÆÜó8•gYV„ÒÒÒûï¿?™Ò!ñH ¾n{³8’üñÏ“¦™X8 ¦MNç ŽúÂd2ÕÕÕÕÕÕõöövuu¹\®¶¶+‡Þ~­båŸëRÌúÊ´LGÓ‘½éö"Šf¦ÄøÀÍ 3 ˲0ßn+Ì…) ˆúº £EÚ‹Ýn>a6›Ÿ~úé)ך Ïnîês¾÷î;{7YÊjíåKf’¢Üi’‰1¦(¨(hÏ/¿_^ûÍ’…Kã±É€(ìÿïW2¡+Å”ú…‰ëèq”wp˜Õmš¦—.]ZWWDz.Xèñx¶oßîõzÁm z'r”Bƒ!##Ãf³åææ:Žã’t®vu?u–e9@08pà€¬(3Wn²$8²Õ;šž³›;[~ã…s?ÝúcÁ×l¥Kl¹s0Š|§G©þ‹aÁ§oo¥®{òoå8˜dô“ÓÀ >öŸz'??/qèpò–¯À-//¯¯¯OKK».üÔÓ{ï½{ôø)§wDÒçέ}$onÀ!€Ü(¤E¿{øðö;DÐãt>ôR^Yå—Ý'Y°ïׯÚOJŠ1ˆÁÓ4-Âðð°ê¡Ü®f0BÈáp¬^½:###±7¡(Š‡½^ï… |>_$Q+ø©¶†A£ÑX­Ö’’“É$Bb¡1ÉË{›Ï7ôÆÛn.ú=Â#j©ÑM!Ó\nnIKKËoló‡bÃД]±¼jùjõHÅÑRUc,H„ÀgÛÿ]Œö0öëËV<ñ¬ÿòòÇò°éhÃà‘ßä&~Ó×ÍÅÁÁAõ ŠÛ²,‹¢¸fÍš‚‚‚ mòþ*åFmåûï¿éÒ%€Q{[›Ó Mv‹½Do²èE +he)¦Hñß3ìé{û€¯kþ¼J „°±µ£ôáïfVNè§~#¢ûd‡vè¢ÙlJ|\Õì•+W®X±âĉ'NœˆD"²,'6ƒ¨BÀ²lNNÎâÅ‹ÇﺜŠ¡oòï¼^¯wÛ¶m’$ÙÂL”õQ677ðÁc×€³íj7eÌÒ¤f§Ï)t¢Ö`R$IQ¤X80âuú]=Š·½Ø‘m0¦`Œûúú™‚*WÐ…ºmYÙc˜BF£qË–-‰È«ßï ‡ÃÑh”¦iFc0¬V«ê:MèaO<ÏÖ­[g™Ü¬]»vÉ’%3«Ùª)vvvîÝ»w``€ç9ˆ±$Å##±XLFÌP4Ã2V«ÕAŠVFC‡4MuwwËæâüšofåç%ïX1ð¸;Žé<”7'[¶íQå™gžQGP@4 ƒÑh!¤V¼MMM5 S8þý¿:S‰v }üñÇ<ÏOÄGÀ~ÿp—;˜½pÝü¯¯EÊm}`5îÃp ˆ}¾ý§©À›jà4ZݸÄác=VVV6ãt$ùàôéÓ§•{»¹å@z¯ûBXTT”––6CŸH8>~üxCCƒêÅ'×·€¢`0è÷$±ðMßcy Kà–eq Àñ=ïÛç¤éÆåã©“úšššÕ«Wƒ1™º_ñ@rïä&q>Á¾}û†††EIæZEUWWgee½õæµv ¯ØX¼èÏX^)š¢()¬Fµcäè>·ÿÝPç±Å‹3 ;.kFmCuuõ#<fiÑÙÙª¡`&g©-÷ù|ûöíëêê’$ %·ŸÖf³ÕÕÕíÚùÞg¦W¯®¬]¯7§CHQ4 „bŒB)±pàü§»ûÏï«(v¤¦YÆ:P‰6dffnÚ´)É3f¶ÜŒ£¯¯¯££C=ì- ª‡ªê †Nxž7 &“iáÂ…ÅÅÅãC‡l80äq;=”ÎÂêͼÞÄðZ¤ÈJ,ñH7#G>Ëój}ÛkŽUWW«µTðUh¥Ïçkkk»víšÛí‡Ã@ «–¯fî2 £ÓéDQ,**Z¶l ½½ýÃ?t»œ=ÝÝ@›JkM¼ÞÌ:HÑr,$GQ¿ …sívƒhR4n”H’”½aËÅ2­TûžËÍØ»•$I=8UÕû±ç41 Ãqœ êb°úÁÖÖÖ]»v)ŠBS”¢(ê M`š¦Y–ƒ”šÎ‚o¹AP__¿hÑ"†aHV.á«Œq$Qí¡¡Žµªå ÂÝpn·{÷îÝýýý,Ã`Œâ’„Eû³,KQ4€·µ|I’ª««×¬Y£Ó馛åÃi›X¥öÔðððÎ;Ngb:z‡D†„;¦Óé6lØ››K„†0CEJ–å>ú¨©©)±pWˇò<¿|ùòšššéébÃéœÇ™‹‹/^¼x±··7 %Žˆû6UŒxžÏÉÉ)))Y¼x1 [3ŸÞÞÞÓ§Owww'GÇ%ì%–´m6[~~þ‚ L&Ó´½8ÍOÒIH†,Ë~¿ßétvtt¸\.—Ë‹ÅT/Ìjµfdd8ŽÌÌLQÕ¬9¢5„™>ÇIÌPÔÔööök×®©+Ù!5_&333;;Ûápˆ¢8¾¦-‘›© }¹73×½šü{ˆÜ„?(ÒÈ @ rC Dn‘@ä†@ ˆÜ"7@ä†@ ¹!DnÈ @ rC Dn‘@ä†@ ˆÜ"7@ä†@ ¹!DnÈ @ rC Dn‘@ä†@ î9ÿ•¼O­Œ´/IEND®B`‚suricata-3.2.1/doc/userguide/setting-up-ipsinline-for-linux/iptables2.png0000644000000000000000000003564313051004444023371 00000000000000‰PNG  IHDR~xz–sRGB®ÎébKGDÿÿÿ ½§“ pHYsëëqÍ•tIMEÛ  Ó-° IDATxÚí}wx\W™þwÎmÓ›fF½K–Umɶ\åÛé½²`avø±´]ì²°`IK„Rœ;Ø‘—ØŽ‹ä"Ù–d«Fe¤M¿åœßW’å[’mÙŽïûøñ£¹sï¹wÎ=ç=ß÷¯ J)hРAÃôk] Aƒz4hРQ 4hÔ£Aƒz4hРA£ 4hÔ£Aƒ õhРA£ 4hШGƒ õhРA£ 4hШGƒ õhРᲃRz1‰%&ríL\Áj/Xƒ†ËÍ ¡‰?ãŸo°ºzK}CÓ`„D CÅ$`—YÈËN[·vÝfëí¨<2ò7!€qooßûÛ¶76·ú#d0g=¦ŠUv=^ºté¼¹<ÏŸºdÏs ´|=4\º›ÒêGEQ!êAŒ1Ã`töÉcó?‹5·žüýŸ_õʶóV¥åãQZ  »¥éØÞMnÚÿð'ï)),aä[BbqqÏÞ½¯oØæÇŽÜ9+SsŠÆH…ÄcRËá]Þ†½¥©ú{ï¸9';K}žédz4h¸\¤‹Å¢Ñ¨LÑÀ€¯µ­Ý7ä—¢×ñÙ™©)ÉÏsŒÁ`dæŒkûûû_xíoµºà¶ÏèõŒ"%§XI= c„YP¨­^oœxìKŸs»\²,©?úâ[[âö¢â…k>ûZõÌf` wàèû¯.ȵÞsë§Ó‰Ðô±F=4\zÝ*8ðùƒûÝ[[ßã‘ΚœUh´8x>ôú=CÞ“‚4T”å^0§,3Õív:ùQ±¥½£ã'¿ù³«ò¾¬™ùRì|zúÃÂЀ¯þß|õÓ·ŸìònØ×^ºú“»Q/p­Ê_ Mk¡{ßC·.-.*œ6öѨGƒ†K)ìHb¼­½sûÞ#;ë:RËVdÏb¢P B€0 C¡£{6bžÕ JKgdäääô÷õ~÷g¿/¸ù««Y‘'JC4zí¿¿X¶ìö9ëîQD dBתÍëP{óÉXó¶‡n¬œ6öѨGƒ† ˆ0çaÿж=6ïoq.Ï(˜ ˆrîvÆ„–Q†#»ªíR÷º…6o5ÏyЕšA”IL~JHgÓáî–úå÷þC<2iƒ1¥”ÐÉ-´}ç#÷¯MII†ËouÖ¨Gƒ†s[jTY ‡Ã„ `0èŽNÐ}‰Ï7ðÚÛ[š‚ÆÌŠÕ&“N‘'º‡…âx…äwŸzqñÛùõLùe€ßxù//£Ñéd³Ùî¿ÿþÌÌÌëcƹ–B HñhLD §7è°jˆ•¥h,ŽN§ã±*±_‰  ;kâÆìtW‚ês¬ æ ¾nŒ‘%­`ïž:׆wV¯YËqÜÅšjÔsQã˜ç¸1úgYöro´Ÿ-/LàÅStž6F[8·,r¶ ãt *F†B¢Élæ9†RŠ „¢Ãý{vlkó8½¹¸bAya¦ ÙÿáÁc­È˜P¹hqav ‹Ñô“ú[jkjû$cra‰"ƒÆ;“íD¡îÔ$#ë…WÖ+”VU-µZ­SfÍÖsµ&¤hÐÓÝÝÛ7 *TÝõG‚=žîÞ?¡€ |Áˆ¤êÞÃþpœE C>ß H(¢¯ßÛÓ; $ÉCJ<Üãéööù”S6Q„ŠGÃáp8ð÷tw…b£bì÷v{<þ` RdQm|hp¨y_õÓ¿ýÞº6BBHå¸m/ýä[ÚÊ++]Bä©ŸüàXoìÈïþé/¹ÅÆáÆß>ûR³g¢Ó?y £/$£Y¯Yå¦Ekr®Á•µcÛ¶êêê@ S5«kRÏU½ÎD;ßÞð^HJiBJîê–‹½MÛvìŒÈŠ¤d–-\½¨t÷;ÏƳ¸ea:!ò–õÏ8~u^jøÝõ²9NwBåÜòÎú]õ'ºDIræ”߸r>éÝ°aS@ Ä•Y²nõ|ntÅêlÜ¿«¶YoM¤Ñ_”YsËíyÉæƒÛ6î?áåY† ¡rõMY†ðÆ¿¾â²ÝfÎ{òø‰æKãÌY©6㈧Åñº£‹n¬¢,UÊK9ôau}m=9Ùž½ôλnX 7”ùò÷ÛºòÒ,\‰#4è–8s%šÈ3E‹39«Ï`‹ õ:tH¯×¯Zµj,7«&õ||ÐñáÛ¿ÛX¿|ÝÍ•eù¡¾NßÀÀæ·ßÚ{Â7ÙêŠ,þùÿûSso¨õè¾æîauwíÄáÝ¢"FØÙâÌ®˜Õ[WýÖæݶìÙ ge|¸m‡/¯þó/¶µ‘¥+oX0;Ë+¿ÝÝäÓȆ»wl?ÊÚV¬YnxýÖšÀÉšý3fW-Y`5üü—/eñÐþÚûãe•‹ò²\I©éå…f½0ªÜÁê»<±õ{g민&9æ–dÛƒ±ä$ØÓMñ~0¦\™þôz½Ãqš˜žGˆ6¸¦&‰ƒÉªFˆÅ¢ÇíÝ»·©©I•y'+øhÔsUØ”33‘Ù²i³7ª[{Çý.¥¯¥/R±ô†Ò¼ÌyëH“=M^?ex–á–ãÕèKBRåÒ•™n{KC“5µ`åªÊY‹o}ü‘O$Y”Mï0êq퇻5v‚xoçþñ*^zAÙü¹ånwê+4·5×}°UÉYrû²¹¹ù…7ßsG¼agK;“+«–g¦8]v“ÅjOr%0SJ"Ðétb°ßÓçëóöQÞ„©H eÑH46ÏQYQ®”®‡b’¢7é4·´©ÛË0P@êÎ !dÇŽ‘H&ïO )\WõkN«X÷UjÜ´¹¡vç‘Ç”³Ãóê‚ÁëY—BBa4:§Y†å9ˆ¢‚F=š’• ŽÅQFR‚Á€¡uŸxÔ™‘7î– pFh4 ýÈã0z#"åŽg ”RB•ÑB yö—Ï.ùæ¨Hûºžýõ/ÞÙmK4ꇣjÌì áTƒŽc®T§ªÎr@´(è)ë\#nß Ãx<ž–––ÒÒÒÉî±hRÏUýš}¸yØ6ë“ŸúÌw¬vií¶±¤ó¤ Øx2nÌH0êt\(Â1bϱ– >U3…@r’Ýçí@ô7?ùŸ†9?Ç‚-9·Üzë-·Ü’jgBò©ÑÀ0-ƒÁahi9æ4»ŠJ <µ5~ÔâР1;׊:¢[B ½NP‰R“Á`³F0˜ÌŠáôæ$§¹õÈa=‡ÚESFb‚nÚ÷¶F¤H£cYÔ =SG,¢€"ò<¯nlaŒ:D&¯ÁjRÏU “~÷‹o½b² E4º «V,“2¹^ÛðÃÕR$\zÃí3SÜ7ÜöÄÓÏügçv“Ádpé"1‰R†%™ÀüU7µô¼ø“o}SIŸ4ËÊë>õÕÇŸ|景í42D4º ¾T¾j<ÝY8eã+|7âmë}öñÊ´"Çg—5~ﱯY |$F?ûÏ_²’H$2ÒxjjæÐ+ÿþÏÄïý³i.è?ÿÏ<÷Ì·÷›,TŒš“JÿñÖÕ‚ïø±¦yäJQÅê»Kó3`ZRCŒÝBý¿­åDõæMÍ]±‚Œf‹UÛàšB‡bõlQƒ V«Jè ô··K’Ä0̤^èTvÅÀ¿ýì÷e÷}ˆ×ï[`yxý'_©ÌKóë±X,÷Þ{ozzú%¼ ‘¢OOL¢#£ÅávÚ¨èë Fâ€Ygb’Ũ)ÚÙÝC1Ë°:Ç8S²EG|ý:K’ÅÀÐàÐ@ÿ`@RÀáNrZ‘¾îîᨄ, I.õý©ÙòÂæÞ¥kîJ³ÂSSyÇBƒžÞA@˜áôÉ©ÉXŽ è­If=K¤X¯·7¤0é)I:žU½~ˆóx<1™b@&»Óí°P"û}ýƒÃˆ“’MÁäÜz.&M,záŗ뻆ͩŖĬ®ösBrVqQ4.™4•ó:T¿c“¯æÜÌBG*Šòè£&&&Nê½hRÏUý¦1§OË̱‚;%Ý=Þ<Ãé3²rθ֔£n‚f»Ëlwû’q§f¸O×FÔ1CEÆ™˜š™"Œ}©39rLŽSWóº±Æ1§KNÏ<Õ B@)ætg>3fí®d»+yü-'%ñ „vïÞFW­Z5ûêµW_©>Ô·øÎì†åuF½ÇÓò` “Íæ¥FÌ Ÿ·¿ûèn3ˆ3T–ÇÖÝh4:Ù5[ÏUmë9ûÐÙg¿… å%=+)»dáü¹v#>ß3|ÄWj+|æ)ÌùÜyçiii>úèÎ;áô²ÂçäÇÿõ»‡Âi³nû²%1Ko²ò:=¥àN˵¹SŘ¢ñÎdG#ðuµöù†DÞ‹F.2R_£žiZ1®‰çLÏŸ³jy•ÛÊ]}‰Dº»»Ÿ~úé+V¤¥¥=öØc€qÕÊÇÇ ñ±o'¯øbFé"–ãÇæ%àHÎLÎ.BZnÉI‹<ÐÝ|¬£±öþ¯ÿŠO-ïòŒ­4!³ÙùdvvöC=ôðÃçäœÒò¾ó½æ¬}ÔêJ#ýA:‹+E:jö_O׉C;K—ÜÂrP±æÁ^8ÙÛÛ“˜”D)eF æÒ¨çj„Á`X¼xq,Óºb à8NQ”úúúS—e9ŽKLL\·nÝš5kÒÒÒÆæÉ–êj%m±%!y:7ÑàcZ1AýEþ¾Úê×gV®r¥§Ë"tLjùÿ¡7E1Žž={ö§5Ꙧ¥Ã`0|þóŸ×ºbÊEñÍ7ßä8Îd29ŽU«V=ðÀ+V¬8›ÞÞY—¿î‹Ó£R!„(%D–(`–ãÎÎpÉÊÔŒÏ{4½dIô¶›µì¶¤¬µÄ ,ÁÌyó7×üÝ2›ÍEEE ÃhÔsõ..Rl,--]°`ÁwÜqÓM7=½GËÚl·ç-˜Z½)r‚öÖ¿d3ŠçÌVdõ}«_ˆD‡¢g´˜Fê~uŠŒÐ¸dÃã¾µ£ŒÀ Š `ÁÈëõˆNýPJYŽŸY¹œR+mJ)EÙs+¤Ž(%~¿_Q–e'Å°W’zFÔHft„%ç¯ÜH)Ì ±Ê\&Fj 7mî_ë¸é¦›~øa–eÏÉ8c¨9\ï(}€a¹iS¨óŸ¬íãié¼ÙÑh!¬ˆaI"››A²w×ïŽõ¥-¼å6£Ù @¢ƒ½ Å‚9X9V%R=¦qÄ›IlHŒK¼Ù¥Óq”P%2ÔG(#˜xC¤pýúŸë²çæ-¹]`™éÒ#%7”ÓVP„,ÃŒò¥ûo5ó°iÓ&‹ÅR\\|H=jÉG9Øâh8ª ÞâÌže2é>ŠV(E˜_Ó6bžíL´]¨}@ņú8‹ëz®ö±ÑXSRRÎÃ8cij2Íû‰3f8LB‡þ ³EzÛu™K²ÓL­ Q%äé(Í/šÙ]³¡¯×‡1æÌ)™s×Ƚ‡»J ïÈ[Jú·Å$/‹áÁ˜¨/ºáí®}·¿o!$Ø33+VÂ@Ý`ßI,ó΢*·ÛueÇ4Q¨#Ѫ`¡ ¥tãÆ©©©6›mâŒŶ)B˜…Ž/ßó^ωƒ½Í;ö¯ß÷æc±ÜHLfc@ 0,p`Âý¡`T•NXêË;zâtиñiTpUOfyÀ¨–'êÚÔX/8¬£’B.]š÷Ɉþ“û»[[,Y•éY¶ú÷^a»Å¡7%¦ddE:÷xo£³heVÉìHçžc»wJ1_gÝN»œi™qß±¶C®ÂÌòªÏ´µôG:v×n­v—¬Î*. ´ìhøp—))Cgv9r*lÇÕ°–HgÌ`ŒƒÁàÖ­[¯ ©0(p´úoÙŸú¿Yi Òs¢~ûnE&Ã݇<½0sAú;êê…„|Nj +þž6ÇÌys Õ @ãCM;6E-%cöJ³šô´5IqÙ˜:+{Ö\ß7OÔl‘ÉùU÷doã-1Þ”\²Â•dWdM û‚C :]#›^†4&Ìsg'óŽræÝC kÐô<ç6Y,'wm}Ôs8,E¢¡ÁððÞÄÄSJAzi•Ý‰»1vä-JÉž!èQb–+ÜçˆîŠ!Üu0(‡cÞa±F^=—ÓY ö$žù '×WoyBaÀ×××/Y²ÄívO°…+éXEÁ˜”—Ó±ëOõÛ¶vŸèdò+ø´GíÛ»—áɃí·z;{;o]/,Œ{~×Þì í;ÿ¯ýä€Ñb uî¯ÛòNx¸·§©V¦[¢«k×KžöN„eñ¼ÁŒêoxo` bq%ÑpwCõ‹°Æ;G$–ÁWlD3F  „ŒdÉWë(*‹’`µó‚žÑY“K×ÍZs;–c «À„PʲzJBDeQ¬^Ð3‚=­âÖ’åë°£”P:&Õ]ùŒ¨Fr5wÏþýûa´WLê¡”Ê [tûcí‡vúOðÖ½I©•WÎÆ ÏŽÔöÄ '`†aN°gͨºÏîä;0 UüÍ;«³þñoE¹º`oçÐ@ˆ38ÜyÃ~Ä i¨±ÏÓ›9.ËnÈZp‹™œ5?Q> ”Pzš‡C`°ÕRÕ}ìPVT°­³1qF%òW†}NÏBFˆBà ȑ‘«4´ä,_' ´Fã+ØÒqBöôÒÒ•»r¯@_KcX4ò,%²ŒYÃQ¦"õŒH‚èE—¢”"Œb~b‘xõ`ccãÍ7ß<Á–¯èæ:sj^-=숇¡ÞcǶüÊ`ÿ±žÁ£ïoTv&Ä`KE@OE“`8f—NŠƒ.!=#| {ÛömâÜe‰Y™£F¼-¨"‰„Á»^öÆÒ²JŠuf'Ï ²6I?žX¶lùO<éΟ;FYŒJH r<†% •ÅhDQä„´’Ão=ý> /Z}Kþ±Ÿ¿û“á9éœù+?Ï(qIŒ©2‚"Ed:’BŽel3×eûå»?~ŒãlHÉ_öI`v—áØ[?&ø{ùÅEìäýBŠ,J &AŠ_”Nªz÷`9¢&–S‰Dz{{¯n[ƒ¤Þ#5µ­e7ÜaIJEêÊ)ìÚõì`¯/]J)fA‘ÇíhŒë&lÑëãá!Êe¢ð`_O{C ·5* –Þå6GÛÞå)Œ$ e8oÓî=³¾±!ËÅ lÞO1 ècê~z=ƒRŠvÝ¢-µïϘ¿¦åýb½#íW²‘>&Joù"°"ŠÖ>úoF«—Ý¿&e9ÖÙ±à,¹í±PÀˆaxƒÑn§Î礋‚I/Ç {åwÓ‘…cª@ñÝOQ! ëu¥·?1Œ`2ØœRò×|)eþoK²N)Æ#»ÞzNo²Í¿ñ“:/‰tœûÐd~5ÝÍMfæ8n|ÿ_ÔtÎô؉'«OÖe—Vð,jÝå gÞP^D:ÛÏë͇ª”îmÝm'ìe˜…(Š* QE"” lÎ]Xuè¥ïÀò¥ýGß—­ór2­íGöyëwvùšCan=,Y¥þæ=ïæ”UŒR×Á­Ø-{747:Ë 4sÏÇ7ÝtÓÿ¬¿3713(——}(¥³:k" ["PB)Ö[“R°{š(Îä²›]§43ÆÆêT¥Œ ÖTa´A}B–êCțܼÙ=v>!”7»x‹ F+lO᧠zó¢[êÛúʯ3f–ÏZº2¦“ë%J)Ë£æÚíó­s@‘¥¦šmï¢Ûþ(í5Wáž·ÿÂôìOr˜Çs*ÆøÖ[o={öÕmëybt*°å´¯Î88~YÀç>Mmhô#¯ƒoü.¿b© 7^òÊ'˜azN6ô¶7Ònm4_…²:C¾ôÈÖ¶¶Þvïò97}fÞÚxãL×á»gÏ°\Á¼Uõ»7Ö¼÷ÆÜ5w)òdõ[†EÝ­máŽÚ$½‚0-<;ò­Óéœà“|lÃG)AoÌ)]  S¡ç¹ ³ÀëŒuÕ/jóüj^ÛeY~íÍwîýÖïõÓ¶×~#‹qwÆ »;åy½ÉêHÊäxáºí"UO`\P±üø¾êÖ#²Kçå¼bÑxãŽõ&°ÙÓÆT ÇMPÛ‚}ä:%ä”óJÆ“qYN7ÚQJ1ŠyÃGÅ~QDs ºê±yËûÝl~ùŒ™Š 7îDAowwk$èçuMXEB “+-·¿«Å9”c²:ÎA9Æ;²$Õ¾û<ôMËË“wÆ Þ8¾.ÒDRJåð@À7ˆ1B”ˆ¡áþ^‚Â(ðF‚BFõ>5 Û¶þnX‚‘”/T ùºö&U,}ñí«n”Dª&| 쉩s«JßšWÌò‚öZB²D³ŠK !=­ÇÁyx'‰Úüb´y{~N&!§M Õ€]^^>q5özÉPnݸéO#@>ùþÿnýÓ¯Bð4løùñ}ÈäÈP°¿+2B€Ê½GþŠ*ÁO,AÌÅú}žñ’4j˜¼ýö;yU÷JâˆtÔDEqd×ìt*RsK¢á@hÈ7ÞƪŽUŒB0èí<ô÷?„·äQ8Ó*¤¦ÈÏÏŸøð¾.R…!Sþ*ë_ïóƒ%ˆzM®b_{OB¦8,ÚÒÓgPS{ÃqI–‰$9ŠVº&@0p|ûp¨“`cZŇQ­¸©n”LÄklCM}CÑh´µµ•RZZªõiÀÎ}‡Ë>y¯VñfBj—L€ µ§IDATÓfÌh;ºwx°×lOPU-A˜ACÐ?ìiªé9²µK²|6ïð<¿zõêIÝ—½^z—u¥å'tkš‘!GjAV°ûøVX‹Ó–è>ñÎpVúŒâ`Ãë;ï~䳔ȢÈç•ÎoÙõÚ±½ÖEk–…|ýˆ7茖 æ‚I†H’ÔÐÐpôèÑššš;w=÷ÜsÚpŸ J:­ÈßDs Àñ:U@g„À ôôõ¶ÖûÛ„;§8-ŽÂbQ’ÎÕ,ý‹/ÎÊʺf²N+ù`œT¸äýïf˜ò‰s±ÛfôœlokŠ,‰f+ê銺ÊT‰[ò×dùJ)à ©s–8¬b «p°þäpZGíÞ5#mf…Ád¸ ÑÀ‘#Gjjjjjjjkk8 IjýÒÏœsŽxVÐTªI>¬ÎdDü½=}]-‘þ“Ê°7îkÓÓXIA®Bˆ$Ig÷§(ŠåååUUU“½éuA=aÆ”9ýõ›­8!ÿ³ÕÃ4ïjm“ WèžÒÊsŠgB¨S7  J)!±aÛE ƒ`0XSóç2;ÇqçÛtÇ8 ½þúëo¿ývKKKSSÓUwîÜù…/|A-êòQ-`U·¾ÐXaf"eÔÓ&Ò Ë²ª°vu}ì¾lc¬6xÁ'ä8î‚ ªWƇ ©FãÂ… óóóÏ1²µJ[“´J ÌÛ¾¾}ÿF‰a%"zí6sFz"$ÉòÙ z›‹ VoMÊ%ã›ó»{rWUUUQQñÈ#´¶¶nÛ¶íwÞ©««SO())ùö·¿­*_…‰ÌCõ^„‰œ9ÁÓÔ'ÒŸopâ§]pàŽ”=}¯eY›íÜYºS­¬‹ò‚^£• R ;v§Y ô´Áp¶°#˲Á`X²dIEE…Éd‚)%¸Nl=ˆRŠ0cLÌ3!  %€®lJ€Š½#sdñT·]í9³ÇÈf ñ‡F£1/////oÑ¢E<òH[[Û† Ö¯_‹ÅBcÁ¾.Ÿ­çÞ»nÿéúõ oyHÛäšPb$ûåX˜˜øs®#y… –,Y’žž®™ZpÜucf©§\˜G³Â|:}½ùH.$éœ>˜L&“É”‘‘1wîܯ}íkç—w4\ÔË=3 ‹,¡W£‘ØøÐj Õ±Ðè ¦òø¢1S‚†ÉÉÉY´hQff¦ YÝP+xÙçƒúnŒF£Ñh-?Ù4ÊAß|üK_üî·~õ¿¤˜Öíçë+ŽGG÷} °Õj=C¥U ün·»¨¨¨  Àår©F78݉D£žK ´_`ŒN¾œàÇ»&÷ÕÌûn—ëß¿üÉýî?×üãwˆ¤õÿGö¡ào¯cãžO!ã$´´´5kÖ¸Ýî1ç¬ü3SÇõÃE¢(„(„:"=Ž¡T•%J QdB”²WO¦„(ꙄªíP2–/qjóAýÓ9©f•–<ñÅ»¶>óÝà`ßÙ~ç4]_sK攟\½„a¡©f7ñ5»] äô®HIIÉÌÌÔëõhc{ñÃøã/õ LÞøN›G8ÂYK~ò3‘Ö}u›_ŽJ”p Ek>—Ì5oßô®Œ$¥g4v(w}å˜Ê­¿ïa«ò½‡÷ìgXÆ2köÍŸñ¾÷‹ŽŽÆ¸~Î⻚N¿\O<ŸÓ¹£ò/ý.á$:{3Îòø#©'>õÿϯž:"9g-¿[0šf†›?*%EB˜Åך7Bˆ( 4Ù'U—Àß?Ðwt›yÁvF^=‹År†ä~ ñ±§„ˆ¿í`Oåÿ{ÊÌÑPï‰hŸ§»nŸwÇÂe‹[·üÊÛ´Ïšï ãÅŸú¤óàwîï Ä“ŒáÎÆæìû>öÊ+sþé·f±¹þƒMmu‡L‚¢K]1íƒf# y§my¤!BINÇž?–•Ž˜ÑB@‰(Jaç&²üÍCIŒ)”áyö2æ®wGU…KZ)ÆcqIáAà9õ‰(‘£Ñl00šD*Ï11Çfwüð{ß}wÃÛ?ÿé§WnÊÌyi&› a†²?yl_vÉBkBâ57Ä;j-Τ„¤ô‰Ë=cÁè‘àp]õ ¤ïXê̳•³²².ßc쩇d¯üÄŸÿ¦Þ•çÊŸŸj–ƒýCžøÁ@Á–›ÏÒ^]R*‹YBy‹ËZ÷×Zó¼AûêDýÀÞÞ¡ÖíÏaYÎíNIî#F—±ÓUÀkÄ®„ äïݹ­:sÞ=%é†óÉ!Yýƒ~g¢ép͘T5gÆÙMŸæ‰ˆƒ¢¬Ø춓GwwÇ]sg™tÌù\ã²Ü^X`9í®!€ÞŽÎ„ŒtÌJ”þî–={ööúcöÄŒÊù•IvDÄ£v×Ô7‹„)š[5V;>o¿[¸¸êÓƒþMƒ=ªYŽÄ8½Y¡¸/(-¼)§l¡åÚã µÕ8ÿ¦‡èdHGå@ϱm¯J{‹KJDñLÞ±X,Ïû¥ÙzÎ1ö@‰€¹t壿*ž_Ùùþ/»û¨51Ç]¸rÞÝ_™¹äŽ”Ü^ÇE¡D´¹·ùŽn8±gÇŒ¥·6'$%ç­~dî­Ÿ-X¸Ü–覊L :mà 8Ôïíí8ràƒ®ÄhÈëéîóÔÄg!"F¼=O7"¥~ﶟþÛtGËs,@†¡x,2Ðçíñö+€"ˆ vww÷ûühü½×^zöég} Œ^…Àïëëîîö"€!J00‰‰½oÿ ¨{³Â_$.ûz»»{BqeL »»º! €ˆ4EBÞÈßýý/ýóÁÖÎèhшðPÏëøÕ‡°xÑÜ“6=ÿ—¿Iйÿí_<û–Þ™™›Ìÿòß=ÔšBåµ}›Í¶¤ª*ÁåNp%VÌ©\ºtÙ¹åËÌÎHÐg—ÌË,,Eך­‡RÀÄXÔæ²½ðëþ;˜IŒw;Pû·ßÐîý%%¥¢x¦Ï‡,Ë•••çª¹"RBa ô*&.ŒÕtñ$иõù„™‹9$Ús»R“)[ÞX³·éÿý¸£è† —Éd±3˜ È^–íücOȶbf"Ñg•œØò’ÓŽýþHÆ‚ût·¢7"tZ}ÂË7¬BÞ–Ú77ì08’Xˆ…ˆ ðL¤ÿdõûôãŠDgÌ]²hv/ nØ°i §”°†„+«ŽïÛz¼×¤¶FŒÎdÒ÷æ_«-f3eOGgêœ57/*êk®yç½½XÐQ@Ù% çä莭=>(4µt2C>_ŒÅ˜6ì­Þ]ߎ,IhöŠËÓM›×?µÏ·’Þ_8«pÎòªr~t©Ü_ýRk<;A ‡cØ~÷}wÙ9¹£éЖæ€Ê*—ÎËaßüëvb’1#—mj InÛ–tÿCéF€H8ä ¯ºï¾â™‚Ô[÷ÖÞ¾PDÞüΦʛ>{çm 8€`ãîõ?œûO«éä;_]í³²²n¼ñÆ­[·z<5»•¬ YEù5ëF”¯e—U(ºH ¥㱢Ǘ×X† †;ÚŽÖ»Óóõ&(0î#ÕFôh B(÷w6 ž¬ë;º-Õ¡sÏ,Š‹âò)!ÄápTTTÀåÜa§Ô¹$àêíêW¤˜ú3 ƒ1LïÞ D)ù¨›r¼F(¥À&/|à«žæã; Ö¬µ˜9bY1ÛžÕïéÊYú =1ņ ç%ê z 2äßüåĨ^ @u–Ü_²µÖF$væ¬B‹Ý¤klœ…5Þ^^ÿ@„€Jo>ó“ÖÔ{¿¸¨ìÐöw<}q,m~ç­Ú^ö¡OÞiÜòë?¾’úÝÇ:«ñòŽŸÿø[6|Ó{¾Ø²ÜÂ|˨(Ë{ã…×Cö¦*Ë‘·rþヷ¤3ùÆÓYµà‰Þ“Ç£†Ô›«ŠOÜùÊïžÊòGié‹­dFú{ž«—TæöÔ +îûÌ‚™© Ûÿòãÿú¿ßÿú±†#»|î”Ç>·ŽÙòÚÖ¿ÿ-sæ¬×Èúãi;ò÷ã]_ü sô±'ŸøÎ_ÓËšc~óùßú3oyxMÙÎw^}ó¿¦~zYݾ÷uésî¹=?ÏÀ"¼mþÒe®ÑüÈVGâì9å¼ñŒ8+óè¡“ÙEK2¬J»G™“4*‘›Uðâ¡€ÕhJ³T%‚üü|£ÑXSSsâÄ ¿ß¯ú­”ä¥{÷i1ö©‚Ê*"#r‘_£àÌ6Œ™Ë¹6Q–C‡¶®OÀþ¦MÏ ä”ëì©GŠÅá¶$$ržãQe¸¯7àóÆü=âPÏPû66PVP‹¢xÆ/%„`ŒW¯^m0.+uN…zxžŸ?kF| V]þ1Æýýý½½½”P˜FòÁ“‘烙`o+Æ3€Œ YK@]ƒLÉ9–Ô5gín³Žî˜›s,0\bñ|@PÌÉÙ@ ¨{¬¦Ë+ú(þ{?û{rœ`æÖÕ×5ù<ÝÍ-'‡qRýþÝ ‰vÜqÌóéeŽ¬ŠÛ[7gfç/¿óáìTëñ§Aß“˜¨c™˜Z§›—­X’“êÓ<ù™—£’sŠm]u‡ëŽ…‡ã ÆX›Ãa»€cA'´Ö~r—ÝqÃb#Ïæf<ô‡?}¡1ð˜ÙbÏ\°,=11^Tpøä®á¡ ¸¬cs»dÑêyE¹Ášª²7k÷ß3sVCKðÑïÜ‘iݪeM¯m=Ùåa°iÙ +çf€c!=3CÇŽHcžÁA_·G„b), Š 3ÿγŒ$Ë##¨7JIIq¹\---^¯×ëõʲœ“dnÞòÜ€§­â† F^/ÂuÁ±=›Š­û¨TÇ—„wB‘PÄ[·eéÜ9’ïnû ÐDuŽ4/obõ6`XÌ°”RcYŒJáAˆ‡¢ƒ]6³¾ = 3nEQ(QÎæJé‚ JJJ.÷ææT¨G¯×úw~u„ãù=»÷ìè:$ËÊtn9Ÿ·f° &aŸ·ã¯7Mx½bÈIJK1 ëílIrÙ/ïÏ¥bLbtjJŠuFeÊ°V«Õ¤×‰$å+ßøjAªÝž˜õØçØ]{ÛŽÕìÙqÓ'?oS ¿@èØ@å ¬Ú[ Á¼òÛ§üY+—æÚ9B¥„PJOE F"¢Þ¤£Š À£7`1,Œ1Ç 02£NO¦iŒ²B8³¬.®HT%…Q‹>`ÄÆ’"RÞ<²+ ¨1A£›¾îÕ[kïþþo¥ðÇ·¿ùüö= só\f9“ ,‚a¿Ó’u–‘|*VgŽãf̘‘““388èóù†‡‡#‘ÈР¯¾±¥¡úæœÊ™³ÅeÒDµ¹8AßÛÞd(©D_&ÙA0Àû/?“Ÿ– É2`&=3Hb<ô„|’$!Ì¥˜ÁËY‹ÝÂ8ó(¥„RY–ÏöÍQã³,X°téÒip2`§F·ƒÁ`8µÕâr¹,V›,ËW»Ƹ 7³÷À[0ÁN¤€†ªcmº^4HNºÌ"Œ=Ù¥4˜Sé õµo̹É0›M©kn\Û±ëX¢ÅÐrðý®ð¾OÌ¡bè×ÿþè–½ ÷¥ÀÀœ2K7"DÃî:òè·þo‘jßý} 8–"fUNWd%·8Ç·ñþ86éÁßxÀ£Ë.pàcd$òM-¿x×Õ퇇@Ãñ#™eËXÍi•šQfïï룊Óî¦tÌNOeQâuÌØî™B”H4Ês<:.Ä$]Å쌿﫽eI±€¤w«÷-|ø‹·²˲n·Ûív«†UI’V­Ž×Ô|áWºŽî™µê>wj‚ƒ‰—Ç™Ã2”¯ºó­§¾§3ZRrŠ.9ïPJ=ªÝZúê]y™jeÕ%³œÍ‘`Opž½I)U.Œ¾hÑ¢ÊÊJ½^—ß«‹Úk;³¯Õüô”\-Ü£($%É)‰±I˜è<Ñ“ì¬N¸œUœ(Ößÿ©OüòÊÎÖ±Äââ‰!yí ËþøÒ_¿v`#c)e«ËÊËœ6ãžúÉ_±Àc£™--×EE:vüèøpH± 2 ‡£’¬Pi8VõÆ›<õÍÞš™lw'å8âyþ¥Êì¤ÃëŸ./G7ŠaKÁ­Ÿ[Óø«~ˤ‚ÁÈg¾ö/.,E"!Q&@)‹(ã‰!+ ÿô‡? ö ˆYß¼qžÁªÜq÷-/<óo»Íæ¸H­½«8ËIjÎ!­8)ü¯~í‘oüÇüL=¸SòÖ®šóÜ_}Õ¨‹FĹ«oËK¶ ÷|æøÓÏýë—¿L¨œPrÛ ²/¡vüjʲ,˲z½~Ųeè˯½QûÊ*†¤‚E·d1)òˆÂ~Î99âL€Ï£XŒx÷y›ìÝûê¯þ§ŸZ®K¨v©Å?[ïÚûzAZâøÔcÕÇEaÙ »GªÏ¬f_ÊÊʪªªÊÍÍUó±Mƒ7é¥Ù<Û³gOuuµ*Å]¹FzeïnµZ/iác €äx¸«Ë#+ètz³ÛÄ+ý}½Ápœ¶9Ý«S¹Çã Çe À,)É.*F{ºº +p‚Žãõ.;ßÝí³ØífƒäpsçPVVš8Üïéó³¼`´ØqÜ!¼Íbðy{›[‡â‰<½>B)b„äÔT)¾>kN¶›¸X$†Í6—A±¤¾ü³/t9¸{i6%2ot¤%'  R<êíñÆeÊ z—Ûm”®®A«Ãa6´¿»c("%¥g[T"Jc့o@&Àp‚Óí6ëöõö+9’Rœ–Ëhûk9ïÚõÁÆ %þP|(J IyÉùåiùev·cÔIü,IAhXj<°­çpµKwÙÍÑH´®Ó¿úó?¶&¸ˆr [•wÚŽ7ÿûo3í¬š+çôÍ5œ››ët:kjjB¡Ð)%Ço–BTq)))iÁ‚yyy‹å"ƒÑ¯ õìرãì’`Óºáu9}&2&ŒFãwÞy k®Ouœ){Ž9N*¢â<•s[¼ð“‡=©ÿôøƒ Y|ÆmÏÑ"_~ñ<áˆg?ñežcÍÇb±½{÷nÛ¶-Q ˜@040èK„0:Ì0¯G Ç0Xã%"bX`q’+ÁlàžÇ#€H4¶ÿhËÊ/ü49+SŠOÝt­>˜`€ºÝ»;v½’™ ˜Lg&B „Øíö[o½5;;{hh¨­­­©©©½½=ŽåcS™cìv»óòòrss“““AP‹Lçú}i¦k8îïï?gÖèë„z€çùŒŒ ¸^Q»íÕaëüªY ¾¶ãcǦ!¤®®nóæÍÁ`Á˜Œ¥…D`$êd„cAõ£Ù§ŸSBµ"¬kp”®[qÿçd&«|ÃbBðÁ›ˆ¶íÊIuëtÂÙkƸ´´ôÎ;ï3«¢M4 ƒÑh”ÂqœÉd²X,ª@Ä0̕ʬpi¦«VÖî }û:ûÝÑÑ)õ1øùã_¢×ë}ï½÷ZZZ&%°Œ„†Œ m„o_k|þ]_Í)™%KÊ;1ö˜Ž†ºo=•l”ÒÓÒÎV‹ÔÖǃ>èt:/8=ψȅ+ñÖÆ4\pò9rdûöíCCCg'œ>®î±sxžwØ훫ßé“KVÜ›3k15P|„ÑšR ”È]'êj6¯åG½ûÊŸÞß[eزaC·lÎK ¿ÿã_vnHNKi;òѺ½×ÍÍåmky|È–l¦Þ-ï®óاÅkúÿöÜ3{*cSS|ÇJªR³óv­{öýýµÑQÕÛÞÙXá™?#Mà9` €¨MÎyEs㜭VÕQW^ÚÉß~ÝL|œ2¬›ä…«¿ÙãçÏO?ÿŒ˜‘;}ÑÒå«–Í–E÷»¯¾¾äá?ß=ËÚÚ˜{¸¼­ìhiù±ÆÕþ¢(A¯?®*iJ™ÖßÑ»ô5E ‹b^yrÛ ¸ÆNM_ýÞOÒ²Óý=ꞺwXzo^€œ¹ —Ï/8°¥Äí tUîÿôXÿòÕ÷\7+—Í‹¼ÿk¿«¾gYA¤ xS‚Ö¥h¬*Þ°­rÍãOã³D) 7Œ1 T³ôöûæ.»«·«¥êhÉÆWŸù¬ôK¿ýÎÜc ÒŠ¼X^ñ©ÓâS2Kv}´÷ÁÊÎÇ^æÉ`Oë€-ç¶% DkqXµ€Õ¢_bŒ@`û[Ï=ÓNR£-®¶&– :1*:(%ǵ¶vP½1*¡â)DäFs] .ÿ´H#Žõ0ùؾÏüùƒ5þð†çyE‚L¹!„@OkƒlpÚMF½>3&)ka¶þ¦Ç6¹[¬ã¾ÀðNDÍd–9}öÿøu†Ú/¡œJð•$V@(wäýWv %¾öÂZð ízëù7»D@å¸PWPq¼Ä˜,Ë D¢âB§!„0YªÞ÷îÏ_غöégf&Xà¬x3‚ Wcw³÷½ô³_oîB(a;·4%%›Ô¶‚iŸ}° Ê?_ÿoþĤ[uÁÊÒZN¥>qxLJ[w{Ü2=K|¾€ 7j8.ènÿ`Ç^"“3”BÅäìtUwKMC;p•~ÖbÌÌ‹Ò„öbÌÝYù¿¿{wíÿüNÑEÈpì ‚Lzg €ÜöÍ'¥¿½ô³Çr‹JÓþö?Wî¡ïþø?ú_·¾ó+{Tâ×ÿþŒŒHþöeÏýå©Wå7E¤<ô­Çt–!„@È.á8Êdyö­wÅl}òž/HHH½ûÿü»_¿ô¬=h×iÈ)sJGÞߺë·Ï?¿ñŵ>ö½‹6êcL®ütsEsëó„Œ ¹‡ÝÞºú¦C%GÛºÜAÁïèTĤ¡QÓìù)IZ`6Oôz(7r¥T†É²×ç 2 Y%jöÂú¼ÞªêŸî-)©í²§Íʘ±P£Žx0îÁ@mÙž®êý³Ò#V.¿>6Ê©Õé”ï=wíÉÆ]ÅGw—Õi¢²² —ZBŒ#0Øçn(?ÐYspfŠ}åÍ×GGÚFÓ„‰Ê ‚\f¡èìêöYµ£ËÕ7 ɠשmfclt¤^Ík­RkΰMº»»7¶{{YkÆÂ;£"¥ Hâ9Ü%ŽÊAkCsÝž÷nš•|ã¢Ùv‡³±©é³Ý‡·mN›w{lJ“@ÉÀàôÃ)á8 t¶t”o{󆂸›ωÅA¹Aˆ«§§º®¾¶Åu´º±ËKe•)".Å`±ó‚:è÷õv6 ô´«e·C#æ¥ÇG˜b£ÎåØŽŽŽWÞý¸ÎgŸ½ì1²ÄáE!Ï¡n”#„ƒ²Ç“–ùÓ3?)>Ñ£J(\²Tôƒ$Û_;­åS êŽ÷~eÕõ99Ù 8(7rìY÷ì;x´¾«ô¤Ë”8=5oº 0%ZKViáàóÁñÃ;%W}n¼9?5rNá Q’ŸûëM\êŒE‹|îÑÅ"|]B¡dû¦¦ÒÏæÞ³66)ÎïÓ±áÃ)½]]­ûßúÊí Pnä‹Œ¿ŒaŒÒ×ëz˶#Í~ml~FAÞÙNÐÙgàx 4«vÕì›ng¾½íÚ¢[WùÜcmðÊy‚ÿ® ™~Ý]Θ¨``|b¬Þζ¾²Mßþ§›â⯨â Ü È9ðy†zzº½^Ÿ(I”“ÉI8áìæÚÝÕù··?:é³L[º’§ Ça_pïÖ»¾qWP°–€,ñõŠ1V±ûƒºâ­’íüÚ'ŽM¸¼u~ëF Ö­ßTRU« Iº– øúÕˆˆl®S@kOÖ¾ðúûêä…†¨T£ÕÆØøü‘°LÞö–®æ U‡—®ù6/¨'o±ð©)ÙïjoÊ,\êj>îi"P™ èI]*¼  ƒ„I’öìÙ300ã‚rƒL}$I:_Ò_d¼N7¥ãd¥«½Ã숼–Ó¨\ *-|ü×ÿ™—ž6òCY–Ýn7Z7ÈT ¡¡á¾ûî[°`Áܹs—.]š““sÝQ>©8ZöΧÅAk–.:9-.d%P«]C}Ýg$zSaÚð*r¼¸Xg²ž¬?™—›-Šbxƒ$I(7_üÂ>×Ëbã(bßÿý¤¤¤¬¬¬… ._¾<--í ÝQþ?|¸øÍm•Ú¤…‰©Œèi ÇÑØÔÜÐ"sÈxÝ(Žx†ŽíߺtÍ£å;ß=Yw 1)E–e ”jµZ”›/¾|ú駻wï¾ô9û×r677+Û}}}%%%%%%[¶lyî¹çRSS,X°råÊŒŒ Žã­éììøó;;S—~Ùá”EÆØ©ƒ,3µÎp)™´®e­a2ìÚð—i‹nµ8£ o~póJb~^P1Æ8Ž3™L(7_<¢(ºÝ̆B¼^ïööööööB–,Yb±XF&ëüå^J^üU³Ã)‡ Œé°SÁdŒbC( ø|ÛÞüCúôE1©yŒVoX°æ»‡^û÷Y3§ƒ¢F£IHH@¹ùâY¼xñœ9s°çõ¢¡”ÿãÿ’––v÷Ýwßzë­ÉÉÉF£Ñ`0„A}¾s'‹™mˆ’¥ ±_c@8˜4u³<ÂópàÃõÙ³oŒM%‹HH§ÎÏÐVoˆ7›Í(7_¼ªÕjÇåÖ"gc0 >>~Íš5«V­ÊÎÎVJudàF‘› ïJ½í{×ëD¥rãž÷uË­fÍiÇ !äàH—îâë¡„r ‹í ŠA(X²RPë+2ôî$¤ð–‡öÿ剢ù t:Œ'R‰rs¥,„K'--móæÍ‹-A„°ëV™Ð`3Ûæ ^˜ÈÖHyVûñÿEØZÍBaxù;`Œp:+÷µ?š{Ï#ÔÏ¡ÊW!³ˆÒPu&¡¡ÿ€É¡¡@ƈ¿öÓÊ_ƼëõFíÄåëaŒ¨µ8k”%"ÎËY$1XQQŸ““3Æ’Ÿ(¹QŠ‘†–"$ÊÊ>ÿÐ4´ÒØ…[ðÈ_‹áÀ)ƒÝn_¾|ùùT&LyyyDRÞÄ«¼,”Æ[¼C#û>ëwÓȼloþ7š›ui³r§“ÁÖ抽}¾¨i×9bb8oCÕѶHG ¹r ¢«Žv¥¤ëŽRÛR’ «8}ÇwuµvYSfG§çðÇìhjìcjMÞÜE‚J5ñïÌ3 –RΙZàóºDIÞ±cGtt´ÕjK»› ¡–ŒŽNlù톟®~ûÇw¾þämŸüõ÷C~r­!”ðî#ýTkCáFù„ÙçrÕ—õv÷Qµf*x£JõU8ŸÐ(´µµ,Î/Ì’h=ôÚÞן R OñËOv»µ:“™Ó9,ÑIb{ÙÞu¿lií7ZT^þ~í±,Øvô£çlߣ1ewÍ¡ ¿.ÝSjOÎî-s×Æ ÐS¹é—eJMNç‰Ož+ÙºQT9TZN0Ø,ÎhÊqW‡ñNqi==ݔҮ®®;wŽQë'Ⱥ¡6vé¬óÝoyÛãõ‹’:wÕ“é¹ÙGæ ˜¢$&ÄïÜÓVðÞƒF¡R)Ç39š}Î ”ZŠ·ô4”p„‰ž^HÐ1ÙÚ8Š†º´4j@b„ç(󋢧³¦¼ï¥o!²ä”,é²€„;À®†'x¡T¹—ËUUU•šš:ê½MÜÈ"ÄͽëDÙ¿o{©):-Ï‘˜ïLLÓèM„Ê«h¨;“r¼@yõ6kâç-ºïa“¯¬xëÊ«¤öÝ{¶XöÝ¿EDªËÿñÃãÅgÚ½\ÚŠŸü’ëoªÜòÇ棂 oN”bæ~31ÎPZÑŸyÛ÷ã²s\»ÿo×¾RujÍT¥  à7ÿx6cîò/2lGØéíQÑ ÀâçiÆ_5i èF€ØËF¦ÃÑÍF á鳦ÿóo£Lôƒ,§‚új1ôÒ†Ñã˜n^–"bÀsÕwT„ÌZ\{rk½¶µ¯­Y™Äq¼Úh“uz&!jƒÕÁQ¦IZœ¹«vßf«EÓYw<ó¶;Ͷ"áÃOŽíÞÄüÝgFÀÝ2ä7˜L'8gæ8톎ÊÏ=Mj"Dš5=Mõf«»::‘+Ä¿ûØOõg™Ý›šÅdre‡ÃBDohS Æ@ò‡v zO.eñ´–ð†N ÞÐÙ˜A !ÊÆi—bôfÍIb1ÉY YY­µ'Ë>ß4àêHÌ.Ô™Ìãó¡èxõÁ­1Ö‘%ÌS,Ñ\4~šë×~ÌïœnqD]ŠñÅ£<ÀPg]¥×를Á–2ÝdàD@t8è“´æ¨*ðúˆÀ`ð&“ÓN-¦ˆ8µVËóÐq¼ØíöY“g[,jI†¡æ2WÏ 9!ßlä:ëª4Ž$ìîè±&äiÈ@Wý1¦‰‰NKh,s‹†È„¤‹szÃu¤æðç]»þ’’’^´7??ÕªUØί–!­­ÍzýÑ™oOʵØMbB^6öI—ÇÊÁ¾Þä8>£p‰Ñj—Ƭ8J!|Þ¿zdÑŒ Q’ÃágQ‹ŠŠn½õÖQòŸMŒÜÀˆ©ʽÈÈ2SÄšòŠ r‰•»•%„pÈ209´MÈ2(’L8 Dù(L @)È0Ê’ß„p@déÒ l”›I¢8ƒýýo¾·¹º‡y8kÊ´¹V§M’€±PàW~>¯‚Š=Ûú»[ó­ÔŒc´c‚Š|þö_¸–Ý ‰É²,ìíZ¼xñu×]wá3L\WÅ&”EDDŽiŸ²6™ L`¡ åKY`§¶%1ô°á?•30LY¹’K‰I¡ ŒÝLm”çk4›ï¿çŽŽã܃}'Ë÷þlóñâÝíõ'ú»:ú:Û>Ï5^ ”Ÿ/ {îug\ÉŽ÷…±kÍñ#z+·&%§†µFùJ¯×Ú-¸2õxùõw¢çýÓ‚ÛïuÄ$s‚Z–¥îÖúæš²¦êÏ`Á*¯„Z$È(\¢3˜îÚ"¨GéQR´¦¥®öØ–¿äf¦ŒLªûF£122rÔëâŒpdJµ¢ÃGJʺ¸Y·Ì“‚“š›ž%úe÷€+è÷1&ëŒL>ÒÒO›±h߯ öÎ×êçƘJCZjO–¼ÿ‡d§V­ÖŒ4mìv{TTZ7È5¤5ðÆ{g-\%‰À“D&¡ÔhuØ¢ãì1 *ž,.Þ˜Q¸¸lçF^uGùDk 5¥GÊ6þ>V/Úìö3´F1mÒÓÓa «÷¢Ü\©‰Lü»ÇåjŒf21<ƒœ Cx#Š‹1F9ÎìˆvôˆA8CDc¼@(;Þy­éó¿Ç™Ýá8#ЮTõ˜˜˜¼¼¼±\åæò«Œò<öíÛ÷ÄOœ8qÕgÂØ 8~ÚIDM{­µÖ™”}²¼˜ãOUc^ =©«(Ýøì÷hËþ8«Æb±œñ*U$Éb±…Ô_øj»¹ *Θ ‡~ûí·?ú裶¶¶öööx‹h¨«;•{/FgÆnà€J£‹ˆM©=º/}Æ,Æ€ã‰Ìàø¡ýÇ>_oáÜi6AgQòìœ-(*•jÆŒ¸ŠæD?³òòòuëÖmܸ±±±Ñëõúý¡±¥z½ß´WZèÃH’¤Rc~èñ•!¥„Ô<¯’$¨)=PW²s¨¥*ʬÊr˜Õ*+ÏsÊ É³Ý(BHNNÎ’%K`ÌÍQn.Uh6oÞüƒü ¢¢‚röŠ‚EEE<Ï_à Çe¸3¥T%qaïLÉé;ê9 !<Ïs7zÂGJU*ÕX*“ ¼2çx´K«Tª ËÈKk4š3j¹$I>øà²eËÎ>ƒÑdîìS9"0Àxª1x];þþtëþ7#ΛY•K(¥0bßÙéèsrrî¸ãŽðš‚hÝLD°fÅŠ999ëׯå•WJJJÎØçÙgŸÍÎξÀÃ`Œù|>QG½œ,Ë>ŸoÔ™)„@ 0–2ÆÀX]Uö5EEq,—Ž™jIDATQÇ2ËFÑ—‘—–$Éápœ³HÓS’Ê+ËmÎëe”›1¿2GXZ|ĜӔÊpFÚﳋšR:{öì+VŒ÷r(7—¤¤¤µk×®]»¶¦¦æÍ7ß|õÕW«««•¶”››[XXˆþÔÄ8S³gÏú훿Ì+º0|3fÄ äîí6[mg+ËÙ²¢Ñí·ß®¬¾çO }ns‹û²¸TJ”>==ýG?úQUUUiiéSO=yIóB‘1”üHõQ©„ìÞ3äŽ0fó<àuw5T:Ž3ŒM6Å¢á8nÆŒ?þxx¥—ñ¾GѺ¹ÌU_y6yyyyyyO?ýôX\är=JéÃÞûÔs/,½÷_@&¸Ðè•–@Àçîn¨HÉŒJòÕXQJ©Z­ÎÌÌœ?¾Ãá€KÈ@ŠrsuG‰c™Ldá'ÄÇ./ˆŸ]‰rsÕ™úÈÄ4!ŽãïûÒ]¿yîÅÆ !:}†Z« -‹ˆOä,­ïPÅö·òòòDQ —$Iùùù‹-r:ç<ê¢ÁÈ2¥$ž1ÆóÂÚo=Q<^ps_gkÀïãx^ì0ä&œZ*ï4ßa²ýÞKºsÆXsÕâªÑL#Ï#ËrTT”¢5áØÍeÑk”d *Ç ßøúWî™ݱçÕû7·ÔTô´5û½Bå€/ ß7àꜤ!ÆØP¿ëbî\‰òRh9q´ê“—òóóGš60<Ü)\ž—±pЙB¦¦âBæÎ+ÊÊÌüå¯þwßö×Iy–èT½-ŠWëåAQ£3y†ú$1˜Q¸„nÒi !¤dû†E«¿&Kã>ã¡¡²´tÓóÒâdvš—$˲Ãá°Z­—?ó!Ê 25GÙ0[m÷Ýÿ yÓÆžî.WíöÎb—L8N¥kko7$ÍÊ)Z‘”;›LÂŒ[„I t·] Ÿˆã‰,CÕ¾mõ{ßN‹ÐŒfI’FjŠ$I111Š'uÙ>”dÊ¢¼œSSSçÌ·{÷nµVŸ˜L!I1Ά1">Mg0Ê“3qsÍÑôÂ¥ŠT^øþ‡- Ð^ßÔXº£óèljQ:½ñ ­‘eY«Õ&%% †+qÏ£Ë ¡„ãxÊõ<Ñ– Jó¤ôªT*Õœ9s8ŽÛ·oŸËåRfuÌVë`cñ»¿ŸuçãVg”,_ò:¶ÃNŠ¼âÊ¥d¢)Ýö¶#2Nm0'eåRJd)´L@¨‡;4 („ ÐT]ÓYWæk?æk«š–‘B9þ ­Qæ‹dddddd\ Ojt¹a®®N×@¥¹7JYjŽ*ü„×Ê”Œç_Xťݭ 2NÅ™œŠ£ÑhæÎëp8ÊÊʪ««=$I1q RcÃÁõÏæ¯x$&%%迤ÎrBH0௯(K›>;¸²ŠCìív§ÐÕº·£åˆMe‹·Ç¦Ú¢-+Ç@€ˆ" õ u6Õôw6‹ýmÁþV6Øf3j­Ù™’$ŸT’$›Í6kÖ,³Ù WfÜÀ(Â5++¾¾£WÅ|Êô÷÷×TWOð`YB(û¢+ÿ`_tdŸ¤ŠÃó|fffttt^^^}}}SSSkkkTtŒÔÜtdý¯›¦ÝTtËÊ Æ»ÌÛiÍU 6?‘®7Y®Ü¢zJæàýë^ÎNMpØín÷PO÷Q6ÔØÓ^Ú*Q 8 ¡¥d¤ ^ÿ€Ãh0&Ä0 ’$Ÿ­&’$éõú¢¢¢pÐ+qÿÊf \Òëõz‡W&æ8Z²þwÞöû¹R/>£!T§Ó)ï\gj’Æq”mŸÏ×ßß?¤08ØÔØÐÔí>xr`Þʇm–€ØE‰…,K­µMÇ,]óÏ}Eš«².]{CÝÁWŸ*œ–¥ÔFJ)“å€ßçñxü~?c %!Ïëô:µZC(e2cçÒeLF³pᢢ"A®\$‹õµ ÕjµÚS)‹,V«Noàxÿ5Xe϶?‘Idã„EG£Ñh4e¡’`0X8k–ÇãNøtÇë/þÀ™³´pÙ­ž*–Î}ŠP§ÇŤæ¬<¸ã×®»ç~Ïàen´Ê¢Èv¯{fZr\ØPPB0‚ZcÑhÏy‡çC­5’$™Íæ믿~Ú´iWTkFw¦Î¾px’è5ØðPk¦ÒTê° ‚ h4š;n¿e¨¿çÀ‘}ýv».6/ÿºÕ1ɱr$I‰¿ž×¿PT€ã d»ß}^l9, º£{RsçÎóy.[3 Ý­6<ûãT‡Z¯×Ÿ‘µVY9WQ½³/z¶Ê„u*;;{éÒ¥‘‘‘cÌ7|åæ|¿üa` L=éÑh4k¾ôO”¾u´¼œÉM%ÿøéN?±$OOÈ*ŒIÍ3ZõÊ2°Ãû+gh¨Ï[säóº}ï%Ùk|”ÏïoÜóåøìY³|žË0]k8Å'lzîçÑ€Ãn;㜲,›Íæ™3g666VWWÃðLîó銞‘‘1{öìÄÄDÅ}™âbäFIOùžêGÍ¡9Šƒ-vŠIÑh¼ëî»õÑ#GÒã#d¢Üܳ¯òØ&WP&T­^CU: ”ç8`rÀ;È‚"ù´*•Óf.H²òG)5B¬ýìå€Ï¿`IÀwI-Yéööy[_øy”Ða·žmªB"##—.]êóùzzzª««kkk[[[{GIdC)eŒ©Õê„„„øøøœœ‹Å¢´å‰Ñ¸p¨ø|?¾¾¾þŒûkMncÇÙl6¥Ë™kh’´×»oß¾mÛ¶…3CÈ;E`dµœAÈ°5>ßï?^פK]P´òa•š—¥q7ie•jÊÊJ7þ15Bgµ˜G¡Â¯=£Ñ¸jÕªÔÔTýʲ,Š¢ÛíR¿j4“ɤÕj•ôØa‹a"#ãk´áDX;1š3…G’¤ººº-[¶tvvŽÝ)áCš[Zšúä·~#eÚlôæN—A9p÷÷ï^ÿ‚Üq4=9.):‹QndtÑ€¶¶¶šššÚÚZ—Ë%I’(ŠçtU”Œ±z½>??¿°°P§ÓÀààà¦M›Nœ8ÀÄ` ¹¹¥¥¹Ì«© Ô:9èõô€è¶Ùl ññ‹•\@h”M&Ó½÷Þ5Y¦ Ü È8DG¡··×åry½Þ@ nÿ‚ ¨ÕjNgµZÃ3ªÃÒà÷û·lÙRQQá÷ûC½Ô¡¦ÇB”~õPdúÙNO )Œ‰Y½zµÍf›DƒàPnä’¤g,{†·÷îÝ{øða—ËN 7ö³Ah5 ÙÙÙË—/Ÿ€yW‘Üœ³@G*úXOÀFÝŸ1†=AÈäשîîîÝ»w766öõõƒÁ‘Ù9Ïé4…7(¥F£1**ª¨¨(99`ò¥é¹Të†1æw IœÃlø=^£Å¦° ¿ßã×êtTò÷ ‚¡{„^Í1Æ<½ANk1„&z|^×Ï«Ï`_@Žã˜,ËL[D„V9)‚L Ñiii)++kiip»Ý@à|ÂÁqœN§3›ÍN§3//O™±=I¹T¹‘%±jÇ{u˜¿{ïMÇ÷ÿé¥Í Vßwó¼LÛ«ßø¼|FÑcOùºOh´zÏIb7D,¿eE‚]¿ýÝ?µçÜÓLåT •wí=š:gAkɧíCd »Cäu³Q’å_úRz”Ó¸#SÌjjjjnnîééñûý^¯WIí¢Œ¦Ñh4:Îd2EGG'&&*ùƒÇë=\U\r¢,Yîn8¾¿Ö ½ÝÛ?üÄk0ge§&™yÙÝSqìx|î\©­®¼©÷¾;æEÚŒoÿ‡þ7½ª_ÿËʆãGŽÛÃgêïi+;|(iñªi3æ¦ÊdÓ‹¿ïµäÎ]<Û̃àAÓ™ŒŒ9(Q˜ììlp»ÝƒƒƒÊ`% ¡Á`0™LgKÕä )\²Ü ¯ây`D•›â7¬ÿ良ÞF(åyžR „1ÓgFZtÅ·Þô_ûÄ'îàxAàO™,”rÇ™l¶t» ªb#ôsŠf™)Æn)«;acG¯×ëõú D“½þ_NE–DSDü¢Eó]Õû¶ëÔˆ’¥‚J¥l*­Œˆ‰âÎ0‹„§§H²,Kb 0âá Ö S×عÄ}® ëætD‰däÍÌ8°{˦Œ›rxJ€rBÝ‘ßýê£N-Kbg—øèÃwPù”µÂàÔàJ¬2U¹ÌrØL\wýâcÛøñv7Ô€1Y0XÒ33í&>2!}zv“$žðCŠõÂ09艠Á‡‚ (7cC0'Î\\xlÓû›ªÕi7s”É’Ö™¸ìæ["LÚ‘bÁôi¯¾°ùäý·&›ˆ<ÔºcÇ..&7͈APnÎmÏ€è÷ yý ‰AÛ£¸CóoXVV¼{ëÁZ‰)p»=>ŸFÈ !$½håƒ'º~ùýoù"åUÉY3¾~ÏÕð~¯Çë s… S†Kæ'»{»ºý|R´Ýëèq¹c⣕øs_w{÷` :&šúº=r¤Ã¦âÏ\‰Ùïîkmïô$NPÛìN»ÕH 4ƒÄÕÑ"òz›ÕÂãxA¹9÷$6œÈ•Œmÿ3wÓç4(Ø°O A®yëAdŒ £‚ È$‘›óG§å<^šê¢Î?¾“ ±† SÙ™’Å@ÕþþïÅ×ËkÛµ>cæ¢|`nN<€ëÿösç¼[¿|× jhÚúò?¿Ûý÷og?ðÝß‹2“‚¿z 69×|󉺖Gÿ/ut/2?ó†»ýÚ?%8¾q÷wïúÉÏoÈOVzѪ6üî{ŸŠ{8éîǯR Á€_ªæ©).ëáoÿëŠ9iøPäêäR;™,ÖíïO¯ûÖ>ó‡9© y?\÷§ÿ{ö¿ýѲ|!§/”Aa’6cÅæn€Coüú+Ìëþóë íýèDÁÂ[~üìÏàmyúû?yksÌ÷Ïà(…Ó$'„RGÁÛwÜ þ¡þþ‡­þÌß<¶:lÝ`\A¦¦3 ø7¼õæ¯>yëœTÆpÚwß¿$ݹó“OΡ†1˜,‰’¬l+&Ë¢ò—6vÖ´OWgÿ€ïê Š’$3I)høPdJÊ “ņڞ酳B¶ ¨ Qb_k»WäN?ý¨J ‰A÷ìõ¸ýžîº–>½Í®×©0ƒ èL)ÈŒRBC‰T׉ÂÁ¹Ã¶ìü’Ãñ´³©vÃk5S±£áxKÀùÈ’9jµ,Ël¤„Ï A®M¹!T0§$šË–Ü”2+äÈH½Íí]œ9.B§(óyýaW§·¿O£U“óZJLk4§fçÚ™wÚ¬…y¹YzpixqÈ ÃæQo_ŸVOA®9ë†ç5×Ýrû/ßøë癦ÔH#abõáÏ˛܋ïœO›–›°¥ª´øPrfœEôõ¿»ýȼù_8nX_dI’OyR’dvD/\<× „ØæÏŒ;°mGºUˆ0i¼Cï喝þŽÛFh”,aç7‚Ly¹a (ÇO¿qͽmÝï¼ò×ÔÔtwô ̼~åÍó2`ÉÊ5M½¯mÿpC¥Ã:ÔÝè‹š÷Èm 8Ž*n‘Öl‹85\k0GDØG*@V}í[ÍÏýýƒ÷7،ھŽMæŠVÌÍs œÑ∠šðA"ÈÕÏ¥»1ŸÉÕR{ìd+Qé“Ó3£¬úßIõÕU-½:{ìôœ”‘³ªÚ=´ÔXû{:Û»‡’2ÓÔ§_à?VVÑ=àµD&ä¥Ç‡?—Å`O{³KÖg& {… S[nÎœÓ> -“|VÏô™ûßÀÈ)™gîpÎÕ‘Ï\Ù ûÀdªË ‚ ȘÀ)š‚ Ü ‚rƒ ‚rƒ Ê ‚ (7X‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ Ê ‚ Ê ‚ (7‚ Ü ‚ Ü ‚rƒ ‚rƒ ÈUÉÿé)\\j1kLIEND®B`‚suricata-3.2.1/doc/userguide/setting-up-ipsinline-for-linux/IPtables.png0000644000000000000000000002777613051004444023217 00000000000000‰PNG  IHDRz«ç×ÀùsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ  ¿ßñÅ IDATxÚíw|UUÖ÷×>åö›Ü›Þ{‡„$$ôÞDª€ °‚Ž:–gÆ×):e™Ç. :ŽbAEé  ”ÐR%!$Þs[n=çì÷1´Š‘¬ï|½瞲ÏÙ¿½Ö:{¯E(¥€ Ò÷0Ø‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ ÊMW¸$a`Ïó¶íáš»Â\…2€ä†RJq™ª¾Zûùç_~]cñBz¨„²ûóδB®t@ ù9?TšWÚATn!æâ]ó–<Ézz+O?xשšVBˆÛi7[l²êPI°˜Í­'H¢ÛátÙ¬«Í~^?DÁb6µ:Üàq;ÝÁn·»]N—G—Ãn6›Ýèù’üãøÛ©zÞ`é?p×á%GƒFΞ:ÆžàRp-g¾óé6_=ߪO~â®ÉŸ~¸Ê­ðjmn;ga,{fÕÑI#’Kç ›sï°D¯7^|Q‘ÔXQ6uñ#\ÅÖïr,±ñ¡±Ê⛨?ñŸ/wúëMî%K´ â†Þ´´•eñö"È€²n`肇o nš1ý¦‡~û§ýÅ-FòÝçÿœ6÷¡å?ÆX òÔHþwÿjÑܩÿùnm›2cƬ±ÛwÊL¿ã¾¥¿Z4w°ñýuÛÜ­Íõ »}îÍ¢¥¢¶Åùý¦ic¦Þzëm!Š–ý§ÎBdg*!m°äqcØAœu#déc[úä¬|ë}¼è¬gn¼ܶäöÂýßܶþ·'öRQ Ct:o?€F«‘DQ´Ö¿ñò3^)ª–2•R)<,^v™ ÉÒoôæxÞß×x¦¥õ‚÷vÁ¯Bd Y7Û?þ×›ó !mø¤á -®¤(eA~€øêsÿpkSFOÿç?ÿù¯Wž`Á I’.he9¾pÛzKìÌçþòÇ”­Gb8–m/%~^ªÚ;©©® õÕB[ ¥‚Wkµpþ#TrsÓwWn{wæÌÓož¹¿)pþÔQO¼ôï]ÿ÷ëé3çéRÇd¦e&rå·Þ¹øW÷ÿÖ&J%Q”d•p»\CfÜÊùÏ÷<<þ–†?û>¿T”(H¢(Jtú¼;6¿ÿüÝw-9Ñê?zP,%„ÏÙ¹S§¾½æ›¿Þ{ë½þÞJ¾ŸBþéë‘ŸR —vw @Úm—«üúüÒM/û¶S‡£” â È/7‚ ×Ï™BA¹AåA”A”APnAPnA¹AåAåA”A”APnA¹AA¹AåAåA”APnAPnA¹Aå›A”APnAPnA¹AåAåA”AKn(¥?ýÕö7Ð^Ùg»"2àå†bi¨:Q\„·³µº¶žRr‘xȪA;«„溳5ÍBÞ~A¹ù‰ã{¾zôñÇNT·Í5g¿Þ²Cj§+!äå‡ !¤#³§½ålþà›ýUWü A+7.§=3{ä·ë¾$ ” ‚H8ž³kåû+V¹É&ÐÓû×m;VúÖ;ïì/ª"’°éóÿž¬iÝŽ›69Ýîw­|oÅGŸ®o´‹'nüvǯ7l4ÙÜ‚HA´|üÁªmš9‚r#ÛRpâpƒ³ìPi#ÇÃræ“ß¿¶fïü…KSõ/þóÓøôÁ„õ94açžÃTôìÛ±nëÁ³§åä©’ÖÒ}{÷Ûis ñoùó³oÕT¯Û’3jì8 ,Ï®ÿp…&*5DÇ uƒ (7ç!œâžÅsÿþÜ+‚RÃq\þÁC§Žøí#¿~õÃÍÕçŽQ•ŽeøÌ¡gN—¸œÕÁ±#Nå;›‹u)§óróƅú™2­Émt@JæƒN©Öüðñß¾/cgM̤”Z7r]à~çH)œþȘ5Ͼ¶nhzœ¿Ñ;{Ö=¯üf>Xí!UT’Æ8X,ÿvóöÈIs?ú`۞渌…uåÍEõ¶:ã¥æ€$Áœ5?•+Øs¨hJv"*‚ u ¸—S–=ëWó}Q}kòäÛýj÷ýíÿ÷/O?µ¯° 0TUóÚg›'LH~õ iéI³´o®9:$%8f¼D÷©ÿyþ…§Ÿywîƒh«Ó%€Ón JYr×Ò/Þþç‰z'Ænä:y*ý!¤¡¢dÓÆM¥µgsM~I!¤ª8¿¸¢™R’›Óà‚¦Ê’Mßm"(7€}ûsfÍœ2ÿ¾Gï?ÀóÌC­sUæmêuj/e¨¯Á«¾ôÈs¯¾§ÖªV<ÿÇÂÂ#¿éCXýá{Ï¿¿ÀùÒk_R{ÉŸŸ}•×¨W=ÿ›O›ªmyç‹Ý°oÍ{Û « håf ã²[©F§€ï¿ýô7ÿý×çÞà.ûõàPctxÄñã…ºÀÈÐÐŒ¤èý¿ ŠOaY>9)¼À¤lÊ9US¯Jtv߹ʪ€´ÔïàE‹nU«´ 1'ŠNÝ´tùÉÍŸJ«7å.¹c*¾÷CPn®/Jo?UKK d›qÿâÉûw¶Yk_ûxCphhP ¿‚e©$Q*I8<408(ÀÏoä´ÛçM4kZêºuÛ#"ã' \ûMNvvzþwŸì:QaЫ‰$*zn–áóÕ²i b4hÛ (7Ý—‚[æÞüΛoÕ6™Y–lýj“!.Š8í.VÚÐXmn1¹Q<ÖVGFvZsƒ%,2ÊR]tælݸYÓ·nÝdð=iÔÆÝ;’#CMÍ&/ÿp?åž#y‚ÇcçÌýøíÿܱøf@Ûiûì³Ïb+ 8û†Ò èÁazÏ—ëÖ8”«‰úì“w+µ^>îšovæÅ¥%y¹Ïy¼ã Òîãu7Ïœc«Èûþ‡}&Q?nT¦ÊÎ[kÓGŒò Z¬YóãR’Nîß™s¼ò®î/9q2%%E­Ò–×,š5…c _ŸÚív¾žs ðE8ÒöØ]Ù¡çí¡klÖFSÍ™¯>ÿ˜„»gþD €bs½TFjµZµz}g]I°Z­:Ž°|ÛÞ ç,pxÏó#éÀ÷ºöfm˜ê«M™9u4¹T©khÇÕzûÕædº\®“E%Ÿ­ÛPmç"ïåão·šyÉíMï¼õ–Èð­VÛ¶½(Š«õÐÑüM;~¬nå‰ÊK§78Z­[c¸7Ü!W¨ÚÚ¶­…7nÞz°¬Õ¡ ‹IËæX  O àvÃéÜ} 9;J{ÓÔI¤¶¦úÛÝGNÕ‰šÐ”ð¸–9o¨B@¢P^tÊUWœä+͘ÚGëQn¤_ôÆï¾ûêû#¾qÙ~‘ƒTZ/ €š*«Žï÷!æyÓÇgfe·ýê¹_V¥/Ôù³,w‰=rþo¢ 6œ;ê<>$)êýÍ…ƒ&Þ¡Ôè.ÏA×fUQW«µüàWΟÐ6Ê ‚üœB#ÂáÜü·WoŽ9?:9YA’B€áÈß½j<°hvRBüº ›Š 9 <öŠ@)Ë“ï×®dXnòw9[¯-rÞÜoW<ÿÈ??¿^W”é;òªßž×û•w>nÑ'' ) ‰Wø¡ÜCYŽx<´òÄ}˱z&(yìœ+n|Ém¦ÆÒcû3'Í<]A”Š6¿ýâo—jtz´n¤ß •öíÛwèða‹ÅJ8ÑßÇ8|xöôÌö›/¼ÿñ±÷¿Âñ|'ß )ÔðÙËOÝöÄK¢Ð©ó©;WD)E%võDÁcúáÍÿ÷äã½kàô¹é`mñ |DäS™ººº%ç6ïÊ9gaÂS†E&eª4¬.iµºÎæÔ”äÅÉÜé"‚|ÞøpmäôÇ€váÁ°4×—ì:å–ÎÈ ¥”a \Óºü§$oëÇé>Ö…‹~¥×ë{ëÑí‚Üx<ž¯¿Ùàtºz7f-x<™™i©ƒ/ÿêܹs?î; I½,ˆv{ë­ æùúø\þÕ?þXz¶œazy²µÇãYtçíJ¥{æª5õµU«×o1«£$mph\2Ë€$•.rœ+Ê›ÊΖ•Œ]ðF¯í¼§#xÜ,Ç_‡A‹RZs¦ ç£? šþècûøöN§ rc·;ž}Sìȹ”J½xa­³¾éÐò;n¾ü«-Ûwœ"©J½±7½Gž;]8ƯqÆ´I—û×ç^ Ÿõ”èñôâY–?}äû%£S¥`ç¼!µ&''ç“ï‹S&-$ {µL@—ØA”R*‰;?{="931k|gºTi†úâºZê+­MuÍ5eÖâÝÿ~é??ÿž·‹ÓüCX$Æfnéá. @€ê¾„åèÕ7"Ç°¼Ûåt9ì=mA†!Þ>F°ÒUD–R ,°”·YÌ¢(’Q¡Tjõ<0,ÆÈnHT…¯6íØzÒ–}ó±‘rµsnÿ9aØé÷ô÷£‚ ÜvÛm‰‰‰}ñ|ø…D%f¼!ÔÌÕgYÖÜoµæLÉéu*GÌ/¸Ä GJi@hhqÓе_®¿uA7 önÊ !Äb±¸\.9êÞ½8].€"ˆ‚Ãá‘w¥P(\.×årC€˜ÍfùˆÝóq†q»Ý„q{܇]>q—Ë%IÒår#Šbkk«(Š= »¹p±N‡Ó ’$Ùíö>z&$I…~=`vQúcÀK——ß[›}çÿ=0@ „š8$ó‡íg¼·lšzÓÍÝ°qzê³,ëååÕ½³—$°PJU*•Úf³y<ž*±ÈŸ³,Ô Åa¦Õ)R*QJ½½½}}|›š›áBõ˜+qäÏ5Z­îžè4{rŸ1xt:Íf¬KÐÙñDIE±m´è?í¶á›¯¦Ü ?Õ(ŠãqÓجi«Þÿ-0ìÔ©Óºè©Ü0 ³téRžç»qêEÅ%ﯗ$)99å®[&¾÷Þ{×ô\(¥ƒáÁìÞÙîÙ{pc™G2sÆ̌Ԥ+VµçKÅÆÆÎœ9³í¹ïŸlØm—$†a,XP[S}ðàA”‘Nâv»¿øü‹÷ì–-Ð{î¹'00°Ÿá™·6Õ—JnÞ&!„åUúà„;v:®™3gv)¸Ñ aN× ¹­VÓ Òëõ¼s=qmÜ7!JÙ™r»]üÏójµº{Gäy…<j´ZECÝ˸¡Ôf³™Í*YnúÎírPÉdv)|Td€&*äJ…w c5=z4$$$33³óíÀôÊcÑ]c™¶ýqãNK¡?5N½éòXzÞÕíWÛét0*/ Ô<ß^A(¥»wïv¹\ÿ)¦FG®!I’$J7üFA¹8bcccaa!Ê ‚ô¾s'ÿá¥×3Ô3`mUQ»I~“Ëóüž={:ïâ`®b¹†ÊœO ìtÖ64mÚ¾ëXQ¹ôccGÁ€¬3áqÙ e|7B¬V«$I £Ü HGÈ‚²sçÎCeÖz.,e^Ö0í Ÿ ‚[¡T¨¦ ”r<)>´S²Ö£lш¢h±X Ê ‚ôÜ´VQ®Hñ4ƨPÁñCÇS‰¸¦`ˆÍd®)/Öû%zò¶šF3Ë2²Üt~¢/Ê ‚\µƒå9üU^SêÈñíâ]ÏDýÇ£tÚm¾ûhÒ¿q;!fð`›6Ölj¡”ÆÄÄ@§CÅ(7råÿÙðCú„¹‚»—wN)% ¹hIØ…tÅÝ›ÈFe¿¯f°1 Ô—ŸÎžv§ÖˇRêqÁ”ÅŸ(© Tš2eJç•å 8ÎúúúKz{{Ž+L›*/¯ïåú'„ä­þSù™3@Î(Ê°À°ÄU} äx)Ç ò'¶g€a¤Ýç„Âá”äÔƨB.Õˈ"JÉPi/$-¦¹ÉÑj;pàÀÕðr0TŒ PŠŠŠî½÷Þ¤¤¤Y³fÍŸ?_Î$Ý~ÁaƒÉªÐÅôQf"V¡fX…Ð|$o‰Fi³´ØMºãøw48 ¿ÓeyÛ¿¥œ>ù¦eZÖZ^ðCÃÙSá#:NÙ[ê\gü„Eã¹}ŸVŸ-ã¼b2fßY½kE٨!1IC˜Þ>_yAõO²Kˆ$B|Ö¤Óë÷æææúøøL˜0¡3­„ÖÍÏ èÝgâ&\ž!¤çÍuòäÉÕ«W/^¼X§ÓÍŸ?ÿàÁƒmÉ€@NìӺÄWmÅÉ#±ï‹Q>8hfѵùí×ßú—¬ñ#¶¯xQ"⩃;3nýƒAm;™³3eÚÝQIÑE‡9+¶ž>Õ4láÓ!ÞõG·î6Ž×FE§õ¾Ö\íÑåUZà5Ç:t¨®®®3¿Bëægäää¼ûî»_ã*×–w8W6zÓ éj’J)0,q˜êÝ.7¯1jôZ*^¹F´ÇÞ"1Z¥JÑ|²‘„^®®Ñhžxâ “ÉÔíÊ ¯(¥mYl6›¼Þ‡R*Âúõëׯ_?a„^xaäÈ‘@¨HÎÇDú°ëü“T* AžsVÐÂ0ÖªRÉÛXôJ<êÖR“úF¤*xÞÔ7*ƒcY^£§¢©&ÿˆ@t%?¬\ÑVK!®ãxC†!¼¬Vkaaa@@À5ró3“’’òÔSOuþ1‘·¼Z–ÿW?ÝÕeƒ‰V¥›þQ^ÇùúµœË º$1#eA.HÂr J@Zªs[ùÔðhJ倊 ‰a8 Dá”pü‹·ãïø5뤄! T„g|‡ÃñÇ?þ144´ÛÙ£/™B),,œ3gŽÓé€øøø… N™2%>>>((HÞÆ[Ãs±o{0 È…ú0Àð 'Jš°´±‚Ûå•ÅçOÑúÓ¿j­F%F† «%´€°ìuÌHF%*x€a˜ÜÜ܉'^3ÈÕM¹iÿLÓn­u&]…é·ý¿]>b/±‡Gì z½^¯ïÒ¨”RŽÛÛ'ž“}»gæk4ˆÎ›ÎIÖÒcyUC&ŒM%Ç øVÁ`«*Ô Œ’­Õ…gòzEe‡'¦‚à(ÝûµÕ*F^ÀVß·Éã–ÛtÖDk\ï­Ù* ]~–9{¶Ü;u¦Íbîøuzï}‡ËKœåB)ë”1m¬ÔZ|lo‘Ï$¯œ¥£î\f:öI৮ÛûÍšÁ“æWçmT‚Ų/[ŘXvÇßïžþô¿)ц¤ŽqVäŸ<—”="wÍ?Ø¥¯‡úkúÛœ¸¤¤$³ÙÜA?T©µYª¢’¢ˆøÄ.ÕØî #oW|’•>ÉEEàü†§ŒüCfa¿ ðã÷qeînÄΛ9T´Û’FN'„¨}b’†û€60%QǨƒ'=ðBuqAÔ´§‚¢Â¦=þœ]êZèÆÚ\_^”•-xºš0Ps¦ÀàmhÈÏœ9ÓËrð,a ,%ÓnMŠKeå%IèV‹{‡S^c3Û®z…X–S¨øˆasÜ.gZÔdÙÌqÈÆ}×…2$Œh½TöSÖ«‹ 0ý}Tã–J’”ž0]~òœí^U­È…ZË2lÿuZ)¥¢‡ ]újSy‘©¶¬xÇë%~c²3uÇ ,Ëq@iÀéaqQ­§x†a,õÅ~)Câ‡F%Q¢´˜#wïp¶„±ŒÙj†Qy (6­+α¸íõÍM­á‘ö¯«–S¦]­ƒÉ.Z´èo¬¬à¡ÑRïåz…Ä•8P‰²ê _ ˆ†Œ§¸Ý4x<PX¥Î¢ œÊÛìM%Êk|}´@%Ê룲¦R ’›R}x†ºß™Rª÷ ˆLʬ(Î;ûÃè9K%±³)î”*R¸cõ˜ôxéBÕÎä?ãºÒ[i]ÙI7QÉoÝ¥ 9Ã{XþÉÑjä'^ÅZ“Šï`•Úóƒ°(çÊ&,×}•0¤æÜ™Q““¯ø­Çå,üa'=_™Ê C azRp‚aÙš’cܸ¹ý6\M]-u5ÍAÑC|£‡DeNÙÿé‹nç .7‘MZVI¥óÑÉ‚[6Ãy•{ÿª—†ÿuw°l<úµìw¢-+}F?œ‘qôƒrráí?oÎ:93˜Rúăw=ÿ¯wÍÚ:C@o±¼(’ÐT§@.Ô!Ç+®¼±|2R»Ë ÝiÑÐÈi Ug÷}ûIö´;X–ëø)¥,G ÷þaTȧÜù`E”B£V¿ðäݳQ(ŸþyMu5¯à—/[Î]üb…\ÜD×”Êðˆˆ+fl›2yb||¥ ŠÀsÜ;ï¼ãt9ãòå¸Ü®nßlJb£#+**.ÿê¯zê\y…œ¨­¥¹yÍš5¢(¦¤¤LŸ~³ Ý>";#92<äliI?UÑR°î5©´j¥ÓR© ÌPÖ Ÿíßï©8$‰FIòˆ¢¨èEÉ:Øqàƒ¢½Žæ²ÜÈIw{—ÞÔÂYN»•e¹“' /ŠùÈ%q™ÎMo$ÇåS€KŒ1J)Çq±1QmŸø½…J¥(È;"ˆÝßÉG´Ùl—d;§”ªÕª¤Äxù¿ÞFƒ—(Šn—ãXAn+jË?ZQQÑ“:9}çVmä¤_¿dki”(e¸,oðì¤_?çrKʘß  cT7„z$˜ñætªìyÚ[mÁ‰Ãõ¾A~Ë^o5›y]@øà±P?úO—[ÒÊôo®%œ2$i¸ÝbfzXãùçmÂÖ×Õ%›Ff×oI’¨P©–O:Á?,úX§I‘4D¡Ôìýú¿cnYâq_µÆ9ämZ•àñ?Õž”¤¨¨¨Þ”›Ë|+ DQbûù ?œ¼Û+þJžýÕA½†aº1 @Ŷ}¶ÝB¨¬¬´X,ÉÉÉX…ª_!ŠbÎÉê€Øñ¢H !¢Ð»¹q´æ'¯J¤á‰é5¥'|‚"Ú_šœìÆãöämùÈSº'>!¾½iCIKKëLûîËÍìÙ³›šš.?˲ôòòJHHè†ãÀ0Œ··÷¿Z¼xqkkë/‰a˜²²²ÖÖÖÔÔÔ®„2 W¬{o0.\xµBT ÃÆààà.N’$yÍ~›D®[·îõ×_ÏÍÍ]¶lÙßÿþw”›~…Óé¬0K!±jr™•zãÝ)Bˆ—O`ñ‘ÝmvŠÜ…9žØÌÖ+ŸŽóWzÇÆx<u ooïÁƒ÷r¨ø’‘?88øj=­±±Ñh4¦¤¤ôÀ[&—ÝÎ~»·Ûm2™’’’ºwÄË?T(Wò®¯¯ ‹‹ëÆáÎœ9³råÊU«VµE…š››åøN†bá†ì󄆆žç%éz$h+-R0¹ØPÒ? ÷AS3ò 2X†ˆ‚è´[ ÷|U{ø«áY™Hûõ)rÇ™ùdttôõ±nÚ;×€#Òz@ 8í­›ÞŒ öѨ Gù`_"Âåљɓ'5ª ‹ýÿúûrèG­V‡‡‡?óÌ3Ï<ó̾}ûÞ~ûíàà`…Bѹ7îÃqÜCl} Ë€¿–P '¢æ²Û2R“äW=—ªd£^£ÑŒ3fôèÑ]òPn~fÝ‘ïè¨Q£Fu}†n¤K¨Tªp×ê´+”êÅ'Í•¢R¼Ä–i+ó£Fj›éÒùfA¹é¢#Ã0˜í¬ßÁ²ì°¤à5ùùáƒFŠ"½áÇåp1Ž&P^¤2ò 䦦N™2Åh4vo9Ê ‚\ÃEœš¶ïÀûÅÚÐø4 ýkñW¯Ó\S¦ð´âÓ6ƨ¨¨¨¨¨¤¤$…B=˜˜ŠÃ)‚\[q–/»¸±!oË'ÀÇwyBé/å2*8¾ý_¯‹R¦Lœ8qÎœ9iii …¢‡3àQn¤SÞîŒi“Ÿ½oÊþ÷ž(Ü»®žP±ÿhG—N‰RÊ+Èî/?ò¥õ*µ¶ýåëtº+úþÝ)é”âPJ?xë_¿{â±ïv¬PùECbõ~!œBc¶µZ›jÓ'ÜâåãßO‡ãÉ¡­ëbRGB:žˆ%û† C Ø"•lILôx|ÕÛ^Û¦5 °aÃX–í­p:SÒ5ʼn‰‰¹é¦›XŽW©µ^Þ_ÿ€ ÞRtp[ÛÝs|zÑ#„H"Ô•¤RG»•gÐœ;™÷ñS·Æ¨š‚ƒü/™4¬P(¦M›½·: ­é²âdggïÚµëìÙ³.—+80àäîU—#ĕéò*›©AEƒpoG„ü=›ó_X8x¼!,™Ó4Þ>JµŽeYÛe·4;m-Ζšú⃠{õÄi’D/ÑBȬY³8ŽëÅ7q(7Òo%,,láÂ…MMM%%%%%%¼BQqzë¦Â}Ó–ý¯BÁI]™¡£ñòÙüáKóþ³ËÑ;çæv8-gr¢‚CBCˆÝ~Æuâ´“UÖ9\.A¤”(8F£äy†Ñç§gØIºô}“$I™™™½ûÖåæë’à¨$È)ƒûèçk#õñ´~QpõÏ €mÝaÿ€€€¶uCÕU•þñÁsŠN!ŠCuÐcϧwà¸ìiwîÿníÐ)·Ò8”R ©.>ªtÔcPk´rš4ƒVqÉBBÔ—8qmï¹ÓÓÓo¹å–^o:®tÍæHLˆ—ÓÜ_O¢"#äeפĽޫWZ¬·?8ÈtúkBˆ xòòó-fKŸô7†¡}¿Þ‚€êçý˜KPöæ«Ï?ýÔSe^QÆØ¡þÑiA‘‘ˆ$•€^˜"xþ‘ À²„å ®¢¦âèֺ✪ÈĈ¤Ôn™¡x%9S[²õÔ¤x‘RÒÎZ‘$I.||Åʈ² ‚2f̘!C†ôE’ÉîD¶^{û½²{õ÷„ë?¡ÙüzÅïà{Óöâ_~§Ñj¯Oð¸Ý}ôQeU%ü—Ê=Óår-[¶¬ã„Gýçl«««ß{o…­Õa²¹ê,.Þ/.$vPDr–—ÑO©Jn°¶˜ëÏ•ŸÈáL§CŒj•Z•ütòÜ'ã†dz\]/2G)Ë’Óù95?|íPJ‡îãã³sçN›ÍÆ0 Ã0—ä‘$)00pܸq‰‰‰}g+tÇ™:~¶iäÝO‰nt]:‚á ìèÒ3ŃÓ2®ÿÑEy=ï/‰ø/k¹€<…„„Üwßýk×®Õ™ÍÁ P[Cñ†C{Þ·šÍ.[©T¹œ­ÞK¥T ^ ¡aŒÎO^›1øÈ×/¹lÄgN ,ÛÓ˜€$Šå'—mycPRœ¼~½Mkxž3fŒ^¯>|xUUUIIɹsçL&“$IÇùúúFDD$$$È¥útÀæºÕ¦ x@PR®aÙJ¢ÀõÏwô†Yb.^(jöKQœ°°°{î¹gç΢(úùúÉ+¬é…mÚ$I–·Û=$upùáO÷>š>5>c¨$Q ²ósEKŠaa¡ôX^í±îÊÜ´”Q¢í·u»Ý³fÍÒëõòö¡¡¡Ô>îkÇCÅ}}Âü<ƒ3Çq~~~üÅõ¿~²wp»Ýƒá—eãx{{Ï;wØ°a›6m*++ã8îjÉÃÛ甑$)22211zÛÎUyWf̼?13S€ŠÐ~ì` ,!N=ttÓÊ?eAÇÇÅ …v’!BVVVfff'íľ¶%QnúA sy$I’ EBB‚¼ ö:Ø5ÇÍŸ?ÿ†31K±Û±¡¡¡÷ßmmíž={jjj‡Çã¹<ß¾¼=ÏóƒaöìÙáá;wî8½í_‡>1ûÄ ŠMóHPiôÄa3×—Ÿª/-4W„ƥƈ¢$[²mvl7EEEMŸ>½ÿ$6A¹éK¹ñx6oÞœ_xRž ùÐCu¦Òà@‹wÜÀ×Õ= ºýöÛ].WCCCKK‹Ífs¹\n·[’$†aX–U*•*•Ê`0DDDÈ ¯GŽÉó¼$јXISÙÎòãߊ¢ x<*F£V§øÙà I¢r –K^“y<žôôô3fh4šþ#ÓÝŠÝa ¸þ¡CÃp<¯P($Iây+º PŸú‚¿©T*ÃÂÂÂÂÂàâ¼ú—¼™nS‡¬¬¬¨¨¨Õ«W766}ýŒ¾—g‚x¹ƒ&çÁš={vVVVïÎ þyäFÅzJlI¤ìöV·ÛÝî(C)íWµ9ÃÖ•QiúuŒ“ŠÍÍ&¹È2Æ`ðæ9¶Wö+ÛüD¡W)p\º‚]ÖA¸öºãçç÷è£îÚµ«  Àd2ɹ;/ÏéÙö‡N§ ™1c†Ñhì‡&awâ|‡Ãj±BQزeˉãÇþÕ/ˆÑëõò#¢P(–/_îçç׿NÑ]ùðƒÏ ‘Å@=ÿÖ¹A>^iÆ%r•ÿ^qýò­'µ#žžžéƒrÓsl6[EEEiiieeeMMMû„__ßÐÐÐØØØððð€€€~çêάbµZ-OÁÛÛ Õéñi¸r•áþkàHnhuß2-ˆp¾ ±´oÛ†Óµö)sæ‡éìk¶¥;ÔM˜??LåÙºy÷ÈÓÕNó®¼â)£³voüª´Á5ý–ÁÞŠÂœMn¯Ä¦šš)“FïݸƢ‹k¬«ì8]¢Ç†â³%99911Qö‡ÝnA£Ñèt:yÚ^›ÅÔocê]6t¯Xß¹ÐézÁíjjljlllln!„¬yõ±ïÏ83SBž^¾´ª¾aÅë¯ì;íÔ¸JÖí*r˜×|üÆæ‚Æƪ’‚¢Úƒ_½y¤†f&¼c± àdÎ7ÿ|íÓ°ø„ ¯=ñÙQk×´» g1\Õ ŽXûUZ Ãp§×ëCCCF#Ïó—Lî·Qž¾™’'&â3qm]g˜þ©8Íõ•ß|¹–T†{–ÜüÝ–“ÿ³ñõHn·5÷Ä)–óYrût¨ðùÕ?Ü–:zꤱ»¾ß“2R”j4´æï9̆¸ÆJ0 3|ú-Éáþoí8yïÿ•é£ãß$Š·¾¯Ã@ðËyg×#¥à8nÒ¤IÙÙÙýð–ô·¾Íó¼OŒb„ÇÝ÷ÐÚó•Ÿ=< ‚Àƒ ‚Š!Àk9Ïò?ýZn‘Oâä[¶=ývIXêàqÏÝóȲ¿HŽ¯ÿPJU 0é¼£ø2é-¹¡”ƶ8òKŒ ¸]îóÃ#¥@ø¹óFûÉÚÉ~GÎZŸ¼3ÉáÚ,g3¦¼ÿÙÁwWÜ1!ÕòeNÅ´ÛƒýNå°‰Õ&¾´¨Ú-x‘ÀÍ3‡­{÷v|ôÁRó,,Ô‡´·(Esw#9ŠŠ«â’âXyøB=ŽS§Šn1 ".Ì_™w¬<=5œ-5ÅUæÁƒ“¬uåU&1%1ÚÒXyú\W@¸kivkô¬MÒ„‡øª©Ç^XxBäõ ö‰ 4(±™”A®+8 A”APnAPnA¹Aå›A”APnAPnA¹AåAåA”A”APnA¹AA¹AåAåA”APnAPnA¹AA¹AåAÍÿ ϯ 7d¸IEND®B`‚suricata-3.2.1/doc/userguide/setting-up-ipsinline-for-linux/IPtables3.png0000644000000000000000000002570413051004444023267 00000000000000‰PNG  IHDRzz>µssRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ  [¡T: IDATxÚíy|TÇ•ïOÕ½·÷nu«ÕjI-µö}0c¼á%Ž8^f&“8Î$3y3“Ù—Ìç͛ɛ͙ä%“‰íÄÎØ1^ã`lc ÌbÄ* ÐBZº[­¥÷î{«êýq%E$Y ‚úþ¡O«uûöUݪß=uêÔ9ˆ1‡3÷`Þ‡Ë ‡ÃárÃáp8\n8—‡Ãå†Ãáp¸Üp8.7‡Ãå†Ãáp¹áp8\n8‡Ë ‡ÃárÃáp8\n8—‡Ãå†Ãáp¸Üp87Œ±«&½ûœYñ*©âÙü8œkGhBêëx,Ús±;ŽÅÊf”h%A¯Sìö”Tç¥ÇO|{zz¢±x‚¡€10ˆ@ìÉÉ®LÂâ¤ã¹Üp8×vLë}Ÿ§¯ñL{ïP¬w0J@0N’(‘M:É¢,ZÈr³ÖÊÊJ„…ññ«~¶éÔ‰.Ï°7èŒÄÇ©L˜ i±’lÖ¹ìæd]RYšâpοèp¹ápfSbÆG>9Þ×× †¥zÎétš,ÖKA‰²gïþC}Q 6§eä•ÌzŒÆBÀ{±sðb«]w[ȺšÊìÜ<õ¯­gš?iî覾¸FŸìJÏ)Ñ%P?ÍÀÈÀPg«&>èÐ' S¤;n»‹Ò|*—g–…¦½õ̱ã'ýq)¢H&‚D,ˆLIh1ArØ,&Šr\µµ7aQšh×ÄcÑç^|µ›8tieάlŒö[„C€,@8õu4a_ó=7/©^¶lÛ[Û›ú• äL˯2%J&Oµc„`=ç•Á )Jï}›nrçäÏ›âp¹ápfmÞt¼áðûûk6;cTƒDÁl“$ 9‘HÄÂñH@ƒ¨ Â}góløÁî3˜,@ùÁOžJZ’VX­Ók&‰Ået #„`ÐÓ8»› wàôj[ÁJK²1`ôJÚ1ª;¢zÛN"ω¯l®),.›ÅárÃáÌ‚Q3ä÷=ÿÒë~[—Zh´9 f‹:x™:hln“ˆ%‚C>H¼§÷®.HzàÁ/½ôò«G‡íE5®¢¿WgD»~õŒÑb«¬ß"JÒDShJúˆÀÛ}NîØ÷6¤gºçAq¸Üp8—7U®ú×q­9ÓÜøËß|¤Í¯s¸K$­VÕÆàÒÓŒ! "Á¡çüÀ±7‡‘}ÍCß™–^"ê:{j°¿«pYÁœÄØôü¾ã÷o6ø>ùî“æZqDÞ½8œ‰ÃOýEÛÚZû=žX,ÎlK~~~º+óR­injzæÍý®Ušm©ýÖÛrÙa;þ.¥ !d´Ø æêï½zÇ靈N„b<­Iv§1)é “¯+1„3§´7ä{íõ_?ðÀãor¹ápæPhBÀ؇»w¿·swTŠc£Ó]dJNÕh (á{?Ú5Üßi×É¥ÙŽ/Ü_fftvv=¿mƪ’ìÆ&œj £]} ’RÒ &Q`Zãœ1¨ª¿a<­™x ‚ˆ5Éî:ì»ÖÖß,shãðÉç†VõçÀÀÀ³ÏýÏ¡¶‚•·.[;vĤ±2úcdÐwê£7uÁ j+¬W_‘_^¥ÈŸZŸòøƒ¾óg´cršØL®f%vÁé=¯ú½ùЗ¾¼~ýz£Ñs’3m¹Y`ÄÅ8Éç\Ë7N•JI0~æç¿<Ô®½çëIv#@é•„C½éXB ¥aÏ™CïW¬Þœ¿d Âx3ÆÆhºn—Yo QƒNØÕôîç¹R7¬¿yóæÛÌfóµbÝȲ†BoرÆh%ÑjMâCwñ>$dYÞ³wßÖr×<˜îÎQƒ\¦u,QØɽۆú»—¬Ûbu¸° ,Æ6Áô´Ÿé=: wŸØõØn¿}Ó†T‡cÖ]93‘›³--ÿñôÖ°`ÃpƒNÄ §ü÷ük>z©ÖŒŒ ¿ðÚöæAmÙÚ{uzifîõ#’ú;.´ŸØ_X]oÏp3ºÛA$0ìélqº‹¬i¶C;Þ1…Ï?|÷ºò’"­V;‹Š3¹9yªñW{ZËnûIÜ ½ °÷é¿ÿùSÿÀðbÔŸÏ÷‹­oõkrKW­:ºHôyæe‚ˆJñäš1šˆÇA%¤PH>±ã¹ÍÕYwܲÖh2Í–âÌde !ŒÈq ò ÚqŒyîŽEÉðÐÐs¯¼íÕWÔ®QâŸ×i¢~–(£ R‹ÔÇCkõu?­VZûÐ×v½ó›áÀ»_¹ÿvƒqv‡™÷³ËÜ3¾Ìw›6ñxìµíô î²U³ 5“Df°2u­tf5zô5BˆQ–ˆ°•·ÝÓ´ýòå_ÏÖ¿Æåf†(Š‹FcÄb1¾Ju(BÈ' 'Žö²Ú J‚/,^¥¹BrœU¬ÞØNÞ¶mÛ¬_ü—›Τâ±ø¹sçeªÜBb±—›kBÈÎÝi²WZ’ r‚kÍ4´ºô¥·>õƒ<ù'jV®ÄÏXqødjÆ’‚ ª‚ ,΀‹uðÁÁÆ’åë¸ÖL«éBGfPHÞµóƒ;wʲ<žŒ[7Îe&^߀_1JãÜ´™6!½hyOÇÀ‚N§[»víÌlnÝpn>>x¨ úæénƒä¨Í%iõ)Y…þBÈZZZ`FkU\n87]]ÓóJeÈï5Æ JºX4†1‡ÃGŽ„éárù!Ôhõyì,L„¶¶¶îîn>™âp>Ÿ¾˜ÌI”ò™ÔŒ›ˆWkB¨~â3g΄B¡é8\n8×³Ê „EF”D4ààj3¥ãñÁ¾ )‡šC„ŽŽŽp8 Óôàð•)Î5­{óôò~ø}ÞáàÅ~ë…Þö¾ ý|³-e#¼]§s @"îi>Pž‘N)U%&¨Ö ŸLq®wR¥¯¯OíÙ“ò_VhT­ †=ñÒ;ûþí…]ož „Òëkù‡ÎæO¸ûfº·€16ÔבðµiõÆñÖÇB!U}¸uùNƒ?ûÙÏ<O]]]yyyYY™(Š—-ŒÍS©»«ó½}GOöÄÓËëk—¹€*@Eo±Ê î¾™6Šœ8¶û ­ÑšˆÇÆË3ÆE™®vs¹™×égºh4šÆÆÆ×_ý™gž©®®^¾|ùŠ+V¬XQYY Ÿ®x  ££ãÅ·öF¬eåjDˆ<–® KêîVä„(ix«N½÷ "jÜ·=«¤F€¥çNm/)*”EmpF3ݾÍåf>lÑžžžßüæ7üÑ:mB¡PGGȲ|øðáÇ›L¦ÒÒÒ’’’êêêÚÚÚÚÚÚqYïëíyùýÔU››WÌèoÓШ-ŸäHc”?¦¡5:ùÑûr"ºú®GÂ`Cß¹î®öLwŽj×X,–éf}âr3D"‘ÆÆFÞËg ÖÑhtxxx’9r¤©©I¦?2ì;Ò<¨Ë-Ì/f—KªÆøñ»0E­‘´¨áým‘Ððò[ ôfsnÍm;Ÿ–q†pjjªº!yZòÍåf>ÈÎÎþ»¿û;Þ3¿ß?00pþüyõ½^¿iÓ¦{î¹géÒ¥N§ÓápŒ÷ø‹}Þƒ-ž¢õ02ç&ÌØ µ¡®³–tþÔ1„ÑÒu÷hõ5¿ª3·l ¯¦§ýÃŒLwii©*7|!üšóÝhµÚŒŒ Þ3óݨzÓ¦M=ôÐêÕ«GRR’(Š[8‹5µvJ©% R乯u#r «9@,î‚óFø<èõú¿ø‹¿hiiyýõ×}ôÑ’’»Ý®jÍD'ñH p²¥#·²fÞ6a2"œÞÙrò„ F€ XÀ" ŸzùÐDqÌ“-º|6zðÄŸX„`4Y,€êa€$=:ða€Ðüe§eŒiõFI«ct¼xP ©YE’5#|üñÇãû¦~U fÝŒŠ¢Úôhtj}Åú^Œ1@!Spø lÂ)gqÊMmmíÄJ¸“Šy«È„I¦HÍW&2%QÅÓ~J! _ôû‚îš;MÌsrß®A%ílª¹¸²26ÒÛytWÌåk®Ûá83†zÏê³Öá¡ý8µ.ѽghXq”oÈÈJe„zN_l>¦ìì%7™’ô=^è¾Ð†ßy®hÃï$éçû19ñ£`s:tÖôÈ`[$Ù¾}ûã?>­x cÝ05/¡í9ø‹mÿpÿÖ¿¼{ë_Þ·û•çƒÆŸÊ… õ5üòãW~<4?lì`¸ô`oã¾À —]R²™g0_\æ!Æxâ-¼ì£ƒRËlt1|~¯³¨÷ôÛÞx.†S ¬ó£_ý$Nu’–h,ÉGl°u÷~k˜X5Ä{ôµíhˆzŽyéß|¾°Ö`ò6½±ÿùïG4n« yö;žð5½u`ëˆ)+ÑýáÞ—6<5Ûí„ilî2t-xk êŒûûû9¢(ʵî*V­™¨¯ùø»ïT{kž[“îûø¹ïŸoÌ)¿©žÉqQ£E1*Ë "i5$e @R—|9u)ÂXdŒ)‰¥ `FEN0cAÒ ,Ú¾÷mçZ½Ñ–Š(‰˜ª1‚¨Dq^çÁœùx€1ªÈ° N˜Ì\uy«Vi†´§Ž½ÐØ-6³¬-JIu^ÜýB4}ÓÊMwÓØ@<ø‹þÓÉؽ´|ým}/‚”ªÛK«WÆÃŽ'ßò6O³¹üžÊ5!^äùÁ÷úz Š06:Kk´âê!`‚ Eqß¾}Ë–-³Z­S¼ªt3Jc 1ÄCƒŠ I[ûÍÿð|ô??|kËŸ~Ïl6%.¼þÒs§ù›ïúÙc!a…ÑžžœŒ‡Ãe·};I¸päµû¼~ª¬µOT¯[3xfû¡í¯2A¢µìŽo˜¢'¼Ý ýÛzÅäO/|¼õ¿âTb‰¸½êþÚ-[µæºBÄÈ¢Êhe¢QÔ0@U—Ü0ÆhÐï Ÿ?¸ã?N2Æâ¡áÌ5•‰„¢79`LopP Œ1,ŠŠW†{º;Ní8óC,ô&(PB€1 ,ø#’`AÄÂhS˲|üøñõë×OQåFnÔ2Zz{e^¥ë“_üizaµ5£ ÙUhMwKX”´ÚÑ+Ç’¤Õ ꭅë7<¸îüÎ_ŽŒ$D­pö7Oç][¾¶‡ÚÞûïçë×D£Ñ’»þ6¯Ô}n×3]‡¶­~üÉŽæl~"7ßÑß°×µú‰‚ªòÄpëîþUý—(ŸP]Gh%Á•¬:í‚ OZœ@ F›#¹jÉ}Oq¤~œÊ1"ÇXAN:U__?¾PxÍZ7 ’ª¾øܧzZŽ{N¾uöÃpñT˜qIÉ8Æ4z‹5£P‰ª>„!ìïö§Ü]Dd}á]ýñ€œ°fœÝwªG v]®1J”D”(`L)ðœ<Öüa#%q¬“@.7×KREQÎ{'ö.­Û8oÙˆU!Œ…u§9%ŠÂÓl‹ž‹EŽÒÕðÒÖ¦‹õ(àíî¶oÄ(!j÷£D¦£Ï=F•¸hHNÎÊ?}|÷Ùƒíêî •Ôße·š´b¤·épVÑrƒ~ÚV]9bŒ ¢€bŸ£è Bˆ(‘¨ i¡ááá”””©œaa\Å!ÆhÔw¡¯«ß–_UqÇã·}÷åKݽM‡#á( , 4¡Œ=2 qÂcYÆ°mí‘°·áÅF®ÕåëÌ,,EŒŒ.^`IÔÂÑçÿfDÈ*\û@ÉM7cJ0þüá\ŽÆ$¦¢([î G±€æáæ",Z²–fæä*%gW:2³*$ç,­ÕHBú’{“´ÃÝííúÌÕ5›oë?þvÇ©Á˜æÈÌ0:ʜ٢„…ä‚›év€£è椇³òö¼’œ‹ Û;N·¤äUM&*ºªnÝè=¹+Vf¦¢Œ±¾Ž3mÇ?†±3®£"(K zíÄŒBÝÝÝSó. ë&âmjø`o馯$YL4ðõÓ—hméR좯·Ù]ÍÇ5¥2SçÔ0¢Pªw•µßéHp¤­qï±=*'¨Éîˆ\¸Ø bá£ñ‘ÞöH~F4MKMg‰aÏ™Ob„„½=$ÅÅ×Ư32ÒÒꪲvŸü°¨öN£±à´9óˆÚ´wg H$ gÕÀ@‘•Üµ_|X‰3/]÷µ¥LY†Ô%w¦/¿EfºÒÍ D"³ìú'Ef‚ÆX¸ñ ¦¥·î+F7²‘¡àö'‹8ýScFIpÐÓ:<`±§,YEÉ´Ë™3ÆDy»Ûbþ‹«mbÐS0œâI„ï}ï{Ó½z×ÛØá³ç–Ï8Ñ´º.™l(æè>ôu ÷uं¼åë-©Y’ìòyb!Á §œ[Qö]0ºVY“õ±aÌ 6W‰Ýõ¶ {»G<“òë]y… ù.´'b ½-]ƒØœeÔ£ ·[ë¨t8 ¾Î¶ØˆŸiv‡1”íyÅâçèŠÃé}ÛÜ©V6v'¬VkII‰Á`àÃ~Œe&ˆbFj²çÂÙsÝÞ$gŽ(}®‰ÃU¿JA £„!„ %c‹Ö££ae«Ÿ„«qa#„G3Y©/Ûá…cP½Ï„ÌäaŒ!kjš« TI(Cýݽçš3òʦ§8!Æ §ù`¬û˜#ÕA) ÿcÙÙÙ¹¹¹×°uÃCH4¤müjxàb<Ã’ÁhÏÐh0U ýã#ÞŠtI©gI‹†œ›ôf%÷MútªÕ1Qã.ßøHÀïÉlMsa¹ë~/ÙÛ#èl&›=6ÜKE³6;;uЫ± «6y: -in]†ùÞëRqÌ–¤/ÞuËÛ;÷úðWÙ+n·;“•ÄŠÎ¤ PñAO·Î~ŒcX2 Ëf°+B=^ÝØå.®p¸òÎ7Ü÷ëgë¿ðU¢L#A¢ ¢Þ‹ƒçf8’'ZŽŒ±©×t°s0†Â&‡Û4UL@‚Þê*PßIJu0 z[:0`”Iú$ÉÀ€* k-¶L‹j£2@H4Ø2 c`Hv1``u™”ž§žŒÉVS2£<ÖøútâXmÉ÷Þ¾¾º×ûÔO0‚l«î|Ì–jg QÀ€ÌQ Q‚Æý»âÑ))yÖ=Ga_Ïy¢(YEU3ôº ŠÌ´zCñŠ ¢æÀ®—þßm+aSiU„P"&w7ŒFºL©ŠBÆM°Ùl׺ïf‚:NX${w|š6ú‚Mø#û”5;æÃúô§Ø§?>á…ªG|3Óuià¨Àh2ǧ-i¹ŽŒ%Ív ûz“YŽ¬|ƒÙŠ6ÙRõ&ó¬¯K"‘àPZNIF^¥d¶O.PJCC>@ŸkE¡Q—V~Õêx8xôƒ·—m¸óÊ y㛼]g{Ž¼µ¤$—:é·Û}­Ë ‡37st4äØy¼+¹ô攌\gv!QäX88Ðs>à÷htz½) y֮ƂFgÐêõtú>M,¨Fúgú 5zIÄgkb*Z~óþ7Ÿö˜m)W°˜T­ñõÚú/+JÝ‚({mÔOKKS3Qp¹á܈|°çãa)=;3—QÐÌ`0Û¬©.PCï<‡«äL f#AEf€B @dÆ°€ýô\žQ¹»ámëÒ{âg‹Ùì]´ª8’V·üÖ?Þö‹»¿þÝxôòŽ*L¡aÿ{?ùã¥Y­vRÐ !¤¢¢b\®®ª¼wr®§ùT_OwoD49óÔMãcFDA”QDÏuTPäô‹/ÿø‡X@ˆÊþS¿zíÿa!I‡:vþè“í¿ ÇÑÄ=ÆŒÊ{ŸÈ£ËXjA‰y˜xêkJº§« Ÿ©5½ï<õäªòl½ÞÀØäh5N·|ùò‰ûõ¹Ü,ŒU?ñÆPJeYV…·Ì\ÓÚÖ>,kìl¬fæ¥#a®ývŒ‚¹dƒ¦cÿ` ¨’ð·œtÏ9¿ Œøâ:«ÛdOó‡;ž=ûÉþ„BTÅ u7|÷M'ȧGïÜI¤Õ­X߸»(ýVš'Ziû¶íüá7êkÊ5Zû´ËS­ÄPWW§×ëyz­…õ®¨5’B¡P__ß‹/¾øØc=ýôÓ¼}æš`.C-‘Å€JéÙ%BçénF¢CžüúZßù£QïE‚E[vAçŽi=s.¥è&ráµß܆0"r´÷t“3;¯ïèÖÓ 'ˆœ D™»%|µ£Š’†(2ŒÍìF”9ë;×øë}"tüõ ëê(»L}AJiffæŠ+DQ\éµ®c{ž222222ràÀ7ÞxcÛ¶mŠ¢èt:µfgvÇ̤ÑH‘@ …]zDŒQä®Üøñ©÷K3«F„•¥9¡–]=}KF›ÃtìÍ>°‚§å6¸¢çÚ) A£s¯ÿRfr4ìïîíjv}ú´ºM¯×?ùä“ßýîwÃáð¦ñxüª#1&Ë2!d ‰LÅ?­žp*ßK!„\¹‡©r*—G)¥êšðÕ¾wÒa”R§ÓyÙØy£ÈôX¡tã8b@QîÍ¿OZGRS³µp]!ëMu¹QÈ»ùw•ƒïtWd–s“¾ü>¤ôtz ΪÜÊ%J ~kðÌå?B‰¢“PÍšµ²B)c²B.k?Þ²²²êêêJJJf&è\nfŸÂ¯~õ«MMM GŽ¹pá‚j X,ÞDsç»)Ès7\hôzì©NJÐÀAŒ1Ç’»Ò–ƒeD{Q½³ ”PÂÖ^zë#jfe’Æ ô¾? 0 2й7ÍF›ŽÑDÀ§$Bée¥MBˆÅb©¬¬¬®®v:36¹ÜÌὬ¨¨¨¨¨xôÑG›››ÛÛÛ³²²xË̶1¹Ç»²rÒõÇÏxÎ'§:g`íÏîµQ¨2z•Œ€LÆ®™I|Ú_åÿš£¦KD,êT8©÷Ž³`6›Õ*É999êìuÆ­Êåf· UUUUUU îP¸AT~ÓÍ«[^xk°Ï’ášú¦çqú/'ÚŽîÎugMÜE)UK€F·Û›››••åp8ÔE¨Ñò¡3mO.7 cósæHå@JªóKw¬ùé+oJu'Ùl”\‹í?~IW¹¶¹,¢$¢=Ç?¨[YIÆw«+ÜË–-s»Ýf³Ùh4ÆK‹Î.7ójìpÑ™‡q •–”~çQý¿=ýÓÔå÷gSen“ûM¾Ý"ÂèÖm%Î#AõËP(A„% `°FÿŒ‘Ö „b@Ȭ7C5¼ûËâœÔ‰Q|”Òäääêêj»Ý>éàYi=.7œëÎÀa !”››óÿêŸûŸ_½ýá+k¾ð-›Ã6¶® ã¥fM£7‹)¸°=û~Þt¢U@ Я}ì ößö#@ ŽÂ›Ï4yí{?ÐÛïHsu­w>ú;Àh×®ŸôÊ‚´à‰Ý»˜ q”n¨Øp{ûÿâåüu_~ìR±@h†—ÍÃ]lo9³«pùòI;¼FãxxÁ, —Îu®8&“ñ›O|õ––Ö¿ü›¯GD»³xEáÒú´œ"ADjؾ"³¶£ûÍÉ©©›m»g 8IDAT™xÊ)é®øÝXĉÆ/ùÖS«Éߺ/N¼µ¯¿õ+·vz±¿é=sE¹¿Û_q×·Ýy)ýÿ5ôñdm¼ëø~Ç›Zw¿Uý»ÿiŽ5ݳ³»¥„È^j©[sóf$Nú£áÀˆ·7)5Co²Lk·†ª5CÞÞ=?ûó[êW©ãÓ:ƘÓéÔjµsdŒs¹á\ç³×ÒÒ’‡úâéææpølãÖ>F‚káKJË+Xº6«xÙìh ¨µ`4K¶l<ò³'uÎÒ¬åwçëà|g³ÏÛ¾ßw˜( Kî:¬Dµ©.½Ñ€DS~uvDZӖü~¯´j‰Ù¼­]þõ?a’PÍh2F MÊÊuÚOW"f£ ßÓßyÖž‘=]WÆÈ×sá½~{ýÚ•ŒMÖA\.×¥Á“\n8œ©êΖ-[< TYQ®®J ŸniOYZ[^w»šNt¶æT{ùwU9Üæð/ÿšH?6%»\Ù·Ü´qU<ª‘÷š*»ú®Æ—ß³å­þ=„†li…+û+¡2!’Aòí¡—Îd  ( Aõ&½,°«§ão>øÞÙwÿkÃÚå—¦F'„äæ檣æȹ.Îü>Þð=™æEcL§Ó=òÈ#/½ô’ÏçS·kPÊ rÝ_Õ­yK릴H4¥N!ˆ0¸ûÙJ_qw’YÒ˜ÓMVKRÉÊso¿Öž‚OïÁ)Ueåi¢¤Q ˆÎµéôÙ–Vã†{ò5AÓ-œ|g[º5ÜÝå/Úð»¢ÖÀ.݆c‚ƒžxLÁ‚ˆÆ*:L2dF}IQÊäx,4äiØþs)оzeõ¥‡©¿–——«Nâ9r«ÏDn¥ñX4J% V™Có=üF³/LÆ‚@™äEäʱÙl?þø»ï¾ÛÑщD(¥ %9§wþ‹bvyíìøD!(yÝïüÙ…“‡†}¬ø ÿìt ÙX÷`F×ÙfGÕ]é…eBÌW´¬Þ`2J ì¾?˜ÙYqïßöžÚVU›î²:ŒÒÒ{ÁêÂhrφ/ÛéiÞËâ#ùÕ·è­Q£×ê’F¨Ò r"‘ˆ†åx4:ì9l·ïÌ޲œ$WéD͸ÖPJKJJŠ‹‹a.ã6f"7z½^Oƒþ3{€î°JÄãó9ö1ÂŒ-X™o„°¸Ü,²)•Ñh|àZ[[Oœ8áõzC¡g¥4mûQxÄŸ_½Þ`4ÒÏW§aŒ`CjaÝP Q@L®² w™ú+®¥£ˤìe6D èÌÙ«· J€Ê\¸R­9… q3‡ÁP§2оyÓ†¾ÞŽã/ý-Nʲ8sl®B“- ‹"˜Q ”Œøz†úÎô´ qnvvѪdl“Ú$­aŒ¥¤¤ÔÖÖZ­Ö9Qš‰Üäççý¯ß{`xxHm­Fûúë¯uô_P h͇y £Q fŸ«.Í£¼ìïb›U!„ŠŠŠŠŠŠúúúº»»ûûûc±XIié' ;:å9{iVQ %ˆ’i»rEN=æA'Qd6•b êRöÔT,à÷è f„ ‹\8ú~šUO(6»#%ÕÉ( ÷oì¤ °¤aŠ¬Õé z½Óá(,ÍpJe…L^ØVíšäää[n¹%//o®o8ƒ{&BªÓ™êtŽ¿éÊÌ ‡#7Ôðcc…²ø0^\6Žz×ÒÓÓÓÓÓ€‰Dî½÷¾ýû÷½¹{«ïBevÕÚT—S‘§—üp¸ò¢‘à¾7Ÿ±:2ÌÖ”«ítg ŒNÉBGEC#™…UŒBÛ‘‰žée‰„Œ’e!dJ²™­É£Ùƒ±Ƙ¬P:&2“ÆXFFƺuëJKKaîÃßřݳÉmM)eìÒd<7B÷å,Ò»6–2]0›Íp×Ý[¬II?}æ-ž–sIY©…ÕÙ%傈¨”~f1¼ßæŠÅ»dõ±÷·Ê='».6×?üzS£t¶.;³°*Å•Þzô“žÃoTæʲ2IC‰„šáhÒE~Ö5+Š¢Õj+++kjj\.ÌËV›ÙYg¸1­tÆ'V‹ùi¡Ž´5uõX_yåå@GG¯ïLça³dsÙ³JÒ²‹’R¬‚€~›™}*M,m'÷ŸÞ†ÎU¹‡›v¿\ÿðŸëMºÙ©pÇ@ÒAËцó{ž/ÈLDͤP`I’–/_ÞÑÑÑß߯&?¼4ÏáøÔ‰RªÑh*+++**rrrŒF#Ì׶¾Y“›ieHž‹®³€ß~ÕŒSœk_zÔñ¶¢¦a¼sçÎPp$éA`ðLßaE‘ Z,鑤C‚$˜È ”Æ#TŽ  ˜4ØL#Ö“(i22\‚ÇûÞOÿlÝãowÚ±™õ¨W¥3Âáo5íÈNÑ›,I“ú›,Ëeeeõõõ555}}}ííí===>ŸobqõxƒÁàr¹Ünwvv¶ÃáPS/ÍúN…+µó¬ŒÒ‹/úýþVn(¥V«5''ç²Î"²RÕúmmmï¼óÎðÐ(IŠ,Çq¢ÑVXP'OŒQÀ(J0F:N”4F/ txBiËï¾éŽ»ãQ˜n®/µ?K¤Øñì?[I¿Óª×ë “\”RA}ôÑÜÜ\õS‘H$‹ÅãñP(‡eYÆët:³Ù¬×ëu:N§›´+jþÆ鬌RÕH»Ájb`næ\ºãõz÷ìÙÓÔÔôY“+Öx7ˆF£Þ¡ O1×ÞûdfAv"SYóu*‰ ˆpbï‡m{^ÊO7[ÍFA/í`±X¬®®nÆ :î²Ñ4ûç¥ß2ßÃäóË c¼®§›8.‰D¢½½ýÃ?ìïïWÓÂOwN¤žM¯7Nç cR[8p ··wb¾÷+oSR¦¥¥ÝÿýZ­ö…^èêêîè쌋Βڂeõé9¥â§÷y3€Hpä|ãÁ '÷%|ç²æ´ôta¬&Ï¥ßB±Z­÷ÜsO~~þbyÚq¹áp¦¤;CCC­­­---½½½j†ÍÏú”$I¦¦¦fÍš5j¹ÇóÚk¯ù|>AÀÁ`¨»û¢×ë‘LvŠ5C’"Ç1MÄG¼¹³²œiNQ”&8¿TËÀb±lÞ¼¹¬¬lYÖ\n8œiÌ°TB¡º B–eu[€ð¢zd“““M&Ó¤Ïúýþ·ß~»££€!¤FÇ0õˆÑEõ Ig>K>ÆÏæt:7nÜXPP°¸fñ\n8œÚ;SŸ¯¯¯¯··7‡ÃáX,¦:n0ÆZ­Ö`0˜Íf§Óét:322¦;›ãrÃáp.£”ÒP(¤útT¹Ñëõ&“Iµe®¡árÃá,>aârÃáp8W‡o)äp8\n8—‡ÃárÃáp¸Üp8.7¼ 8—‡Ãå†Ãáp¸Üp8.7‡Ë ‡Ãáp¹áp8\n8‡Ë ‡ÃárÃáp¸Üp8—‡Ãå†Ãáp¦ËÿÀùFk©IEND®B`‚suricata-3.2.1/doc/userguide/setting-up-ipsinline-for-linux/iptables_vnL.png0000644000000000000000000014344413051004444024125 00000000000000‰PNG  IHDR7 ¶Ú+sRGB®ÎébKGDÿÿÿ ½§“ pHYs  šœtIMEÛ ).Îù IDATxÚì]e`UGÓžÝ#×ãÁ5¸»»[ñâZ¬¸ZZ*@‹Š»w—`  â7WŽî~?n I Tíû½ïÂ9{vgwç™™™E11Ñ™fsJJâøv£uüçU}š ø©ø©N?Æñzÿ³’•qûܱV b-ý³½¤†‚ ÏßØ¥÷ÃT@ðG”RJ ðà¤ß!UU)¥Þ!„çy'?ßC¢hãy“NúKô-¼B…?!ÿfþ•>‚åÙ´ÆŸýå!`ì\çäŽ?ú 59ý|„œÌpÒJ!&þøÚvG-÷Ç›Ÿ7(+*Wf´Züï„P έ÷ÿu°¬$IøÃ0†¾¶[‘S;ÉIyJKû£ÀV¨\½~^¥kT­R§¢û—ý*˜á4˜H¢$ËŠã]¢*„RȲ\¨*Ë’()*@¬V£J²$)æ#”R__WBþŽ£‡R n…Š4þÑËX]¹ò> ’w¶"K2}§Â‰øbE¼TGß(ѸùW®[µH>·¿ÕY dùO<¦*’Lèÿê6øpÊ£vþ‹ !°Ùœ†”“þCPŠC™†k'yö𥂠îî½ CG7v“þj3DV tŸ~æUÄáC_h¢Š½â ï›ùð E”H¨ÿú!©¡‹ze•ó(³åièÙà…nDþCü ²Ô¶m9›Y„¿%VØêc&úãm©uïÜ©$(ï@)ÊèWÝÙ(XÞ…ïÞ_Ll!ŠŽ·dN¼÷ÈÄàúùûÒá'Ì¥ýä#j¢ÿUœÊ!DQÅ)Vœä¤ƒR„*´šôÓ‚¯¾åËRY„Úc'µ?eî’‘þ *2ß~pßv_Îþfv7“*RJ]+·š¾ö‡1Cë2DÍ¥—æûdÈüùCw½± û»«’d³I2ùí¿Y÷ ç~½p˜‰ë0¬ Q)Ò¥[Çb”‚Gû¡Ý:VŸ¶öÛq½ƒ ¶1Ìó\½o×™‘k>/Øtôôa}*÷øaÁâ¥=U­´ôx¾KÓ«{W[|*Il¯7µo2d…°g[KLțӆ·%2ö)ûËéÅ•ë77g„E4gçYßù«™³WÍnQÒE Ú¸Ižz¤º—7©&²KÉú_¯Yи´‡B€úÖê0sý¢a½Êƒœ[6I^õ-g3Û!J Ôðñý‡ ˜¹ìËRn¬À䟲aAñ€’ã7¯újbY"Ê¥; úzÍ c›s’ øôýþ»IcqªBUÙfßtR”ÒÝF|óóÂVÕüd ²¤mÿÅW³WÍm]Öã÷l!ŒåoÝ¢VA…•/Ñ£cEìSbHÇ:C—|;²uD)°¼NÃüoîJ)Çqye!„œÕï‘3¸ÄI„R”"×Ân‡æ~½|{ü¾½íÕLµ\ÿ>Æãß/<ïµnyu*3Íf Nünìvà„Á…×bÔX;bBˆßØî  D‘YVUJz¾eÉä[_mœ1¨ýìWœ&»š*ÛQÏ݇â·}·x?Ùti +ã-jBÁ¯VþÀX±áÈ1m—öµ÷ÂËú­ÊO_1õÄùŸtÍ߸ÈÁÙ“–®ÛñôðAKZ¶+ ¡åkÒ±ŠwÔäÏ7ÿtäs×ÌG_vñ$5fN§ž“¾¾C«E‰?Œž~Ñsø’¥À³kÇ´Ÿg…Wœ3°S1•æ¨Í]Ð4v æÌ/IŸÏ·µÔœþrÜb«Bߎࠄ¨Š¢ª*ÂHïÖ§d—½ºÏö`34ùú~Ûuk¿áæÎßvãÿ—ÅjÞž$©ªêªßuB°àdŒ“þ>J!DïgN?}vϯ_àò5\ª¦&Ÿ}¢&ß{Ì”,Ë·®\IÓ=8i 0–éå]±Ýö¨kó†kZÖßnUî Nzøý”âˆRF«7µXgru5æÒÏÏšêºL9tâ×Ã…Ú™4o‰ N{mÛr+¯}ôyº&jë̈Û8¡_ÿÅ„R֤ױZW=ÂŒŽÏkùèÖ5‡uÜ°¨°–a{ñÑ‹z5tµƒŽÅÀi¥åMAŠì×svÕ’þ­g.»2ãÓrñ—­@ƒºóÓþ=£™\ Aêå³UG}3fH­kÌl6R [Ô‰ðdóòok4” hòxÓ–ˆÔ” c·–¯X2·)Ãð.®Æ7Í#ž¹yìªNM¸íÖ¸²7Ý\ÌŒ®F#‡±$jÊï‰ ^4°S0¬‡~9ô íÈÔÅå*–‘Ô–^³úå½[M?sªAå*íJAêå³AƒgŽÙ0$*erI[âZ£ã¥¸[7C&R‹Š”§ Eê±üˆi7ÎD0'oY“ÂBØ™ë”y¶£0–$ÉCñ.›ÕÉ'ý-åæ7üÀÞ?]š¸¤Lµ³)·"FÀk圾VÌ) äˆ Wíig†´ºî)Hçâbä.õ¨ÝQåw†#TU *ÙSÒnwõé`§ «`ÒùQBÕsرŠ•­" *ªX«¦Ç¹ûóÖóDT”REx!‘´¸TÙÊf`“|ÂÆW>ä×µçÑ‚ €¨ž„bŽ_?bpt뱕­,(Z~0Ð7ºy8ßq\UýüëVþµ|G˜‘.}Õ0hKN]lj]«ÕA0@ÆTȤ؟ Ž*Z ZF‘U¢sS$åÅ#K(5ñÔ.;b)!(µë›LùÌ£•o™”ªóŒg@ëÂYQ9WQÊ@(¥@)!­õ‡Rkc D•uî^i^ýb;k·ëx`kçúívñ†ìA›Èr¸yñcª"ƒEÛ‚ñ¨I ª¼\9/ þ@T è7ÙA)QUB ÆÿcB!ä0€òê€Êì÷.¶€Í:gº”“þ6J*<~FŠ6í0Bg`aŒ²´C(K”cÌò–Û mZ=VZ”â_ßÚ}44žU²BÉB@²R(‡nߢ:¹kôÖ›·¯__~Ðsþì¾îsMÛx|7tY‚ìß (°äˆŠÊÝ]ŽbŒǤľpq8%}ø–ýÄÈÇ?#†M}:¸Ýè_<‰Œ_6ëÆwsÇJô>76>6¿\³2aâ„nOË÷»1c¨°*h¦$†<íÒxOH2Ãj9` ÀsØ-¨öÐ*¼[€Ÿêp=™ª´Ð˜9µ“.¼Äš¤iˆ“žK¨S­x`ùÆ@îq‰‡Ã™m•‹h6¸ŒŒÉ«ÓL·5½nѺKï:‹CÙšR‡—oAFçX,0ùe•ÅV#ÇÜ÷4¼½ñv:ôÊÃdïvŸT=vïEÄ“¸ Ñà_¼Ôg³Š aêÛ/Üeìà “[ñ ¦Öp×kU‹Š¼±cõ¹—÷ÄÙÔ¾ñù‰3­Ã¿jh¾ökSbS Î%P"‰*!„eY¸¹|ÿò‡KÎvª'p¬eÍ'Ê‚$¢¬Ú´£X6ùÚÉ» äMÈæ-®8QÊINÊ3ýæ·ÚmGé<ýüý\Á°4áyš1Ÿ¿-1Ae ~^góðsKML­§§Îš’&°7W¬ ÉñI‚œS¨QŠµON|•™eaPÄûúiÔÔØ™Àp^ùü´,µ¦&§e¬ÑÍ×ÛhN“8lNI9£”œf%ˆ¾pý½{»Žm0"ܬåAAæ}òûjÀöâi ì‘?@Ï‘”Øx»Bæ|ýÅ›J1 .ùò)Éñ6‘ä”Ë{úzPï—eG’Ó3³÷œRÊÜ}½M˜ÊI± ¢J«óô-vžâ2½«¯ÉfU°š–’*ò.>^FÙœò*Ù 99 ñðövÓ©*e8H‰Ž­sðr¡ï;{ΧÆÆÙd @ƒ»Ÿ¯ Ø“^ÆYµ¾^®|fºÈq¶”dÑÓÓz'¥'&˜)B”Rƒ—Ÿ‡‰I|')Tïåëá¢Q…ÌÄø4¤wóõqÁ 'Å&Š }[0RJ"±@ö.ägy'Šy·^MLy7_lM–x“¿ B‹‰/’¬ÿs(õá)S¹ØÎqœS¾ä"Bl9)'ým”úO«@U™úV8ªMX6{½Uͳd Ji•*…o^Œ9üc¢¢6çîøO®´î6ýÇe?Eˆü‡ùïC)‡Scì´¨r’“%NúïA©ÿ&’b·S^Ç1ÿôÍnK9é½\B²,ç!¨8Êú9]9ùlp 'ý5zòHÅÌÌ÷×;¬Vòo@¶ZÞßI @‰œ™–a±Ø³ÿÚšiÿcŽ«Óÿóå U}[ˆj6‹ÿ_¢®¨*[ìy“-KeÁjWé[vOÞo-g°ß[d·;yिLlNY ¨Ýª^Õ|i‘×í÷èáž5mïtRQ"ˆ#·lÚ;xhfÞ³)¡þí{5  6•3X®¯ßšØnXãk[$Ëž­»—9³éb•¾½‹º!%ýå™=Ç24Aõ eœº“ /P·4v 2Š¢ ht”tiëö(Äæ€UQ0N¼¸[§NÉÂïzÒ%إ✠ÓjxÚ¾ÉtŒ¥”]wò›ñ-gÉzþ/‰Ua«èb>u82ÞŠ€*ïÝZøÄཇŸ¼²‚[±ö]ëêÕä“[«%ªµª]‚a1Ëg~ܪ6êظ¸;€òàد™’ÝZUPDAAž%wíŠM‘Ý ”"¬­Ò¶u©üúg×N^¼™ÀyækÓ¥©Aƒó«_·m•NíÊj;|+&ýÏß»@œbÿÊ÷OÖ¬[ü'¢çß5kJ±:3¯M$ì_³ÔT²Z£rÜ‘=W8ÿ’M[Õtam׉N´+ȳYïV~Zó‰-‡SB‰¦aŸ.>4nÿæs2ƒ½OëO[â—wü <›í´K6=6 ³Ñ„¿³·«7’n_ˆWÿ08‘âÊCMÎèõé~ò‘ñƒRŠ1v$N9±ÊINÊ [Š(|Õi+ç6¸qô²kãfnH331¯Õëµ(¥”á5:ƒ^«eR Hçá±eÌètŒ(0¬–gµz½†gr'—"H¿u%Ê·áÀ —¯ÄI\þÏ|3±‘Ÿ6»§àî#›^úõLJÐðUë†bÏê}š–ESâ“V5òÅ\8wýlhŸå‚ž»r5r!QêÞ~dÈÉ6XŽ×juz J)E˜ÕôZ-€Hæý/ü/©YÅÖ€Ñ5{~«è¹,``8ãa ½ÖûÍêt Ê%á©êYaÞœº Eˆ™{n_]öað­´¢…}¡1»]ž^ðJ[Ĉ=šöìôäÚ™ËW_MUqÑÁÓŠŠ×¯ß5/¹u0(ýáÕÓ—ãj­Ÿ?êÚÙà”LåMl BõåUÖݼú¸ÿ‘3­*è8ÿcêg\:vñÆ•P•Ò ÏçÛŽìº3yÿOž¢”½ô7&¼ž2N£7êM&ÎQ‰ƒæu:^Ë`D•2E`4Z¥à˜_ŽÅ@£åjöì[ÒÄëôŽ¢ H£×éô:ýQ©:J‰ÂöŸ8sðŒî¢îüÕ'¡7òKŽ~‹EÔóÀÞ–Æ{ÃM›–w2„R_jnzëÝaÏÌ’’Yè²z—×Ë®}ø¾ŸW.h¥D± 5ê5(ey ”RŠYŽg€×°Uºô)í¦Ñé³Fê&F”R ˆÑêu:½–A”R¯®Û¥ýÌÇÈ|ìô2å­ñÿ¹»ôzgÖ”“>¥b½¹ßO#¾~½uòÒT†Ç®ÞŸî<øçM‹‡øÚM߬uãÏ÷ú´ž.\¬ØÌ_7¸@½õ>wkq¥ŠÕçY­£9j!„ìqOŸ$X”ÔçŸe"Œ3­/Ë3ÈK^ûìl±Ÿí÷%*\ŽfKŒE¥<‰Š‰x,Ûң£ž¼° œ(EAmÑ®øÙ•·)ÙÆ ¹u}j¿:uFÍZ5¥±+7ïҳ鴓G72æڔѕ®X~ÛÙ™¬Uù6øp÷Ošô1ØŸÀÀË—Ú¥”uY¾¹8#äÚg…ÕLœ5ZÓ¶©»hG¦ª•bVOYvýÉ“§¯E©ÓÊ°´÷/GÜ=´'$Ua0c‰½'øVHð}+Å€PÆ«ø¨KG¿ô¨ào~ý"E¶$<‹‰ˆ±KäÍÀ(båÆ‚/7?¼v~Án[@ ;04¶`í—UDBA‘IFÄݧÃ5§ôSÜûêõ¯?k\}À¤u3Ë«V¥áÄ©-Û6ºe÷øö®ˆ’¶ ×.›ß£Q·>MkQœê¼õä×Þ:ÌUè¼ýØ× [·Y²{¾Q&eËøy T,_®¬Å€¾+§OéR¯{¯eXõ½R†¨PãÇmQÛ~ €â®ž?pøRÈ™sñ‚Å\ý¢¶}ë.Ç^Ýe®Õ­¨Æ}Ôp×_Ö?¾b­iÄD]™6AÏÖ [6aKñáCßJP&®ýgõïÑfÎÙƒÅ=™ŠcçßNK{ûy«Z{‘€ÒAÞÆÀ åÊ–õ#¢8då×_õh2dÂŽŸ[ÕZwƺa}›6<¬eŒV¹·/¢~ãÛe‰ó¼`„ÃœRßérýß#'X;éCQŠr†ÒÞrê+;ƘaY Ö´onùnæÁÒ]qœrfóA™eîœK«Ð¬*%jøõëÏ“$úÚŸº÷Ûó'ž¾¡+ Í­.!„rü@ìIßœ¯Þµ…§ã)Õ¿mß.S,~uêÎŽC(+×òu o­qB}õ÷ž+ŽÿP2,¿l;{àûMî#¦kL5ê™B.ß7±ßÁzC{æ’=XµÜºt3Åì8ç Ž.xyÒÚuû—O\‹ÔÕ£OÕêZ_ãWÚ¸ûû;™|ŽèrE¬Q­ä¢Ÿ#Ž UÛ—"Ø«´%24,Æ âêWèùõ—ˆc0Ã`*ÛŠ Ù°?ìä‰;?ú)µxýÖŸŒù¼)¹q!Bv !„r†!@˜e€/ToQíàã§cÕ—÷5 Yr«ðIÃ5)ÇÖ-^£O 5í™.À T‡ƒÛR¼‹¹ÉbâtO6îר[÷&Ó_±< œú$òÖáÍÍ*~öŒh߯€K4pΞiCk“9Ùœÿ*ìèÚí©%\PÏïf<ïW»_¦Oƒ·qrûW) ˆÈvjI±eg=8rhßÁŽgihFª¢Õ`†eY Œ—Ç¡sö)#K!&œÞ¼ÿàÖƒ³Úv\Ãg?üÁ<1»ÝÑݨ-G6ñ}}‰Ê»˜)Û 5ŸPiÒÖÇÉ+¼¼í[F ü“M£zW¨_ulÆ~iJŸ“vž^½$6.>%Ù’ ¦G3» ^í é¶Ô$j0žèX~Ó U#gäž%–x£á‘=ÉÅÀBÌɵñm wšª‹8 9¯C½Q~zl˾£;¶vñ¬ ®Ft}ª-1ïò9m4Ž*Xg°ØsK}$¿œÓÝ—$ÉÉ'}J1(óÇI}3ÄÃÕ½Þ N&*çð®üÄ'÷ĉ}¾¨¡ *¥r¦5]”•Ì´ »ã¼ý®Ì匮nFë\Ý\õˆ—oÆÑGµ )3êAtšMe0V3´lèáÙ¨OÍØÄÔ÷‡ ÄÜ|”Ö¸–É!Г©K½…[v,øhŸ5>8­@£r|ó©}3oœÁŒ˜ xÕ3Y4§e¨ŠdÒEQÛûš_À+R·–R.58®ð·ã=B^˜™\Óƒúç¿ñS¿JUòól܇d\K¨3|x³@·e*”.sýŒÇ7+›•õ ¨T³„ C(å n^ž^î<¦€Pòó˜gO“߯LRJëõÓ¹F Q\Ýuõ,V£Ré|¾•Úïíö0]IÉPk÷h u+R¾¼)Á–›ëˆç;4)P¯E‰Ç{_/Ÿþ,½ã˜:Š H‹vm>ªM>Þµ`PÉ^œ_=dBìÝÅ]5§Ï=›øËpW½¶Jç±  ªPŒ³Z%¢ümÚ¥_ûuÑÂÝAu¡D¡Õ­íP'?Éù}Äî/oW/ rÕ I©©—,¿_µY³²Å|}Ë7«[¥(Œ¶TíR¾|‘®Ó¼¯ìŽS×ígÚ4+Ô¶#ûëŠ óÝ ñ%šwm;¥{òž¹ýŠ„z SÆËÔxL÷³÷SuzéôÌÝßméxaÕQ„( $ˆ¤B Þj±åñ†ë¥>í^‘3úµó‰N”J¶løð×õ 7Ý-[ݨ¢xUªzîQæÛFádz{œ•“œ”¶Ã$ïºô²çw»lê)"{ýº¤Rl‹»y#^“ylõE}~Nßr0üi*ïQqCÈ…*îtÕ­££Z³¼Š½óDĘMzjÉåHQi‰©ßOi yì9b颺HH»FXÍÁ›ï^¹§búðz8b0 ˆ‘ÓnOXo›puÅð»Î¿`¨w®?F,z'L]ýùD¾‰ƒЧ˜mBó‰s?Õôhú Ò[fXüÙŽõmì?Oš} !¤åž,ž¼ôȦºe Þ5;í¾y@‹î¸{¼kïêÙýð”­ëGu.jV öôµ†ÈÕévŠrHaT¨¡ðîƒDQ˜ôàã¡V½jÔ`¬ß9‹V ×*6H kZí»–s—̘ÜÊ®€-úNRÐÄ›—~·gICO9-ôêód½qï!°E„D>r Õ•3åŽóX¸éǵòÉH×ká¼ó;ïú´ýK+=2aÜ1÷¾Ë÷ν2aÄu)w‚$‘dKÕÁ‹Fè^£\™·mÔ–#áBŒæüÚs6:П•…ýíëšëþy÷üÂÖ§"PÞ«Ò÷‡¶õu;1hæc$¡Âí:’»¯ìøŸ2rUÒ²Æ=᤿éșիým e»(fûçŸñÂçÚ“ÙÉ\­fýýæ…:'B¯#Ê~o“I*7lVâÎyqIhÄísÇZ5ˆÍ$Ù_Ìîsù=}6çábuú1Û7?ÚfÏ+ ~×@PV,{nž¼÷â Ñ»ZËn´ÂûŽ2rõ5绲÷¿uíV‡“s0#GZÙ@%×´æÊo#|÷7ec™“[}Rn¾ãÐûl‡œ_ÌÉŸ·›}{ÊÞm‹ @˜ 꽨cÚ²™k”ã\ 5÷À¨¾VÁÇ—Nç¢ú!yŽô^§¬gí '}8JýÿK '²„XŽª¸X‹ÆñÎØø-@)*ؼuq!âĹh–ý¶™ˆ …›7K»t*Cú ”RJ Ãäi\%‚ htü¿Ã J]ŠW¨WÁõôþKâ_ž£ª¢P†ûÉý(å¬é÷†$ÉÆqÎÚNúh(¥È2ó{ºóûEš$S–c°Sƒú7Dº"Ékx§”üSôñPê?¢TQ%¸¿X…R"Ë”ãÿNéU–q6¡a³ÙtΫ;œôéO–פD”¦î\é&Ê¿¹O¨"K À¸‰‚›½Ö¶C߃b‚ü÷œÕŠ$€?ìÃo^EVi¯ÿ˜ü}&¨²Dè»™@d©À¤c]êûqdª¬’•·TòXÌë dåÞÓòG‹QVTòzÊ(ÎWãüéÎHPþâ2¦D°X·Á“çY”“>JQÁœa3›ÍÇ­ë¼Vƒˆh±Úe*Û]®ÛÚ?-Í,+€ŠÖLsZºÅ*äÚä€Ñê¨h5§™%•U,éVG »-ÝLT)Q­p.e•š’lTªŠvsZzf¦à¼’£YKîf„¹<Ë IDATKjÒ¸;K%ǦgH€@¬æ´ s†ÕF$!Ó*YÒ3Ìf*Û,i™‚-S’ •íVsZºÕ&Q!=±xß-\ä”´¼¬ì§Ú­™›9-Ã.f%fÙ,VÉš™‘š!)”Å’ža਀HIRÑó™Pò+«ým•¬–ŒÔ «]¦TÁö[³”ZSû¬ÝV!#>-C|ŠÛ£W¼p7%V‹Í–‘aΰå-h)¢Ýœ–‘i)UåL»ª`‘U*™“\šþЭ„>9Í–§ß¤¢%Óœ–aµ9B›‰Ýl6§™%…PÉœ!«ˆbβºd•+™R D±fdd¤™+Al¯˜CÿwÆŽE2§eØeÐiG˜kfZ†ÙlS)ÍÚ™f¡ [Ó¤²sFµ)šœf%”‚*¦?º6døYà*gfX-VsšYT(@ÎMG¤DµâÙä•Y{™‚Mv͘™‘å~¦’5S3lv…RPíV‹Õžmw8ÉI¥D 7íå³5—O\ˆ9Ôºã L“ŸŽ-›VÓXu•Ÿ•nòÙŧWê™dÆ{Êé —“îïÚ8öé·]o½‘òyó€L¶úqËQKlj¡­¶[î/>_c`kðÅ°"Øf3º~òÊ’ü&¤0žOž»œt÷¶I¹TÆcåÃëj–^òòáõ =Õ4[…é.Æݹ½§qAL(ñè<þþñÏ6=¸zæüL¸[߉=õõž»ýZäS—>¿ì¹”ü`ç¶qZD†l8´ì›Z“®^¸}g“óFâüM7O¯8sóûiÍU•(6´ìú¡Ï¶¾”Ö½ ãV©Ç‘¸;ÁÏ5-ÈÚ\[‹Ûª§&D.šR*GÑ# ”u}èôuóý­¿ ä1)÷õÏ!§WŽ¾¹øËÖ è¿»<¨uÙ…Ïî…¦V9Gdkó™GÏDmZÉ“¥Ø_ðöE—/ßx¾­¨IÉ›Q¥Z|³êjZØ™Ës4Š©L‹à%U홙忸Ьˆ¦Ý‚mÛW6zàPȃõ’’G:5•¹|_]¾|)1lãâ>2¡Ô½êʇ·/½º1²]1Á Ýs^N^NY÷SÑò‹÷\>0ïèó°3šæÙºpÒ)±¿ï¦Õbù±Wlãã§f š@$©Â¤uå.L™p šÁ7[6~™E†\Ï dªÜ¼;ZRÙÿ°ÖÍôίÜ\;}Ð9vÄw‡|[/Þ:§¤¯ž–ïäÿë¸ô·Û”M:Ö«[©QFšüíÚ¤ï¨ç;Ü­ô /:U˜w+_O~ye¿ýZw—\ë˜QÓ&Ôhöù®­ç»v cŒØUÿàÇ1ÍfgªÅzoéu¹ÁF"ʪŒ­ÙLf0›¿cƒg?×øôtËý·}%±T»A¥v «ÿibå>ß|ZZ¿ò³ž·†¬.pjê¡X‘Õsy$N"ª¯ÂÖôhsìîm55‡¯Š:ä©?Ó¼ÍÏ*§Ê.‹žLœ^£VŒ[Ë Ç¾¸ZòËö¥ãO>ݳÄ@ Çç(EA•|µ?©{~BÃŽáM­ï¿ó™ ¦„¯íÑ:lä¶muø3µì·zËѽnP=cÈqø„8ÃÙybà\•,ÞQ†D~Y¿—×ÈÃÝš]±÷Ù‡—hG”*|•þ…ÃåíÓsÓ¨~Õ¿='[ì*Á¢wú›¡¡·—4xùý–Ð$ŽÏ³p×z[¦ÌªSÿ‚Ö¤gÓoÛ¢¨‘M&„é6]]|pG/9SV¢Hf" Š …³Ëµ°q*ÑowšY­Á ÐpXö*Ó£Þoë¾—¯Î˜Á ,<öŒgYEQ>TÞ>‚¢”Bòöþª?OvTrÆ÷ {U¨¯ïúÍ/ˆÀVÞZ¨ªº¶X»zÐÍQViêÑóñÀª>qíÄOîΰgÉþp#Ý“MkE\Ø@¶(—WÏÜæ{öè'+,½¿ttóY™J‰>—×÷ nº¥m¹W'C{v/=Z`X0¾y“!ÛwS¥DÛ~•÷©ÓèA¯ugk¸ìI±+/ïlÐmÖG~ð’Od0p[;鯢(v{º ªö§éÆbÏê½Ë¿HF² À#Ö°Ó B&/>ÜGŸœòåN’+ÇCü“$bÓ=Qóåóáîo\µ¨­ß±%—O_@±cGÅ TÕ®íR“L^TS)ôøeñAôükSîÆ>=3ù‹mjöfz]d#„‰ë¾nKÙŒçbAªÄ@ƒ2ƒÏÛ ÂTæ TŠx° c)â|¬/(ùK«›X€Ú"BUG‰"„CÉ;+•Ä°ˆÁ‰éj¹&ØŒ”§‘1À:¢h|ŠèbSÍŠÝúô•[?ŽBP8w!(JTßÀÛ7€¡ñ÷#šúòO1$†>'¦Iåó1W£ B€0Fä)e9†d}ž$blM¶ñ®š¼QÒ`ïÒÉObU )!×Ýúûb ð:‘*«²F¿ÇÛ¿S€Ìv®h<ñ»ýC”;»§/:UÂÛv*ÂLdx®xr{ëÂb¶«çÒÌ3*!.®Ö'QÐèIô…ª™žTʆˆ¾ßœWñ=!BÃ0‹*k€ÿ¢9åQÄSŒ¶‰$ýþ èŒpš¥ÊŽ›?•õʾkÔžÄé <5,>½è«ñ™#Îsg¶'«¹«­‚ Z •e:ÕÏè_t×pLŸ&Üë­áØdXzÔ*n}P®I~Î&=p¯Z£1Á.3B :L¡y‰HdZ Qy¼çZáÝ©8‚²Î<-!ÚèíÆ¥»óI½g•â ÁQBhöb†³ ÏªÕ DÁ©ù+EK Ò+2;/ÊoºôR@„ ƒQ ¥¹oP¡DU JTBƒ <õ>!ÀjR¸WñšA>µë¤ÅÝ *§ñr¥2ä.v8gU½–!*¡ÙŠ=¼‘Ý!I’!poL G웲gn9ÞåË‘YÓ6% ³¯lÓÏ>‘ /WÎýâ-]A6éI:å3Ï37×7v1U#„Íiú¢eÜpŒÂi Èòô†)öÙªù×x½‘Qì,Byåb&ûý¿ÿ¦©yLLE|€ÄÒçWÌ)ëçý¤°½¡›—žû.£Îö»åŠ®8w/ ©²Ö1e r¬¢ª*0l–S!D©l*Û¡VJ¿Ró4MÇ÷n@•2<J(EŽå§ª*ÁLJB|zùðõÔüe ?Ø®bä¬>ë¤>—Y`úm?|òÓoÛ}-P¤1xbYÁg{~Ä ežï}äÓçlÌ…º¥ML¾ò+‚Ï_³†¹µ&ý-}›5pÕÍ»tó¯½'>£Z°%-©h‹¸ˆ5bÓC>]ø`콩C‹Kñ§W'×;õâÖÉÍ5‹¹b¿²Ë/Ÿ¿f»touêÛµ¸»o{ÈüáÁgzðÉ×ÿ‚÷†ŸŸÖ§cÔbyƒFN8~§ÿíØCe 梭9R~æé7žý¡ SFóäòÞOO •gçRKÈÔîøó;.çV^µ Õk2Pç.ê2oîµ+§ôžÞb 3Lfäû<÷Å=˜?)ç¹bbƒ÷œ©±èJú½ž¦—â˪¶å±gw}¯ÿ|MÐ"†?µ÷Ò̘°k—@ös)JÁsáã‡'囸óøæíã Žw\IÂsyãz¢1RèÚˆ—’C~éûpí†éÅÃ3%g]|´©:«0€áSnmo¾qï{Kô’J!Ž»•Â%IB+ŠBQE–Y– ¥²ƒÅ§(Ê›g®X½µ7/]Í ÁÇ~±ótS¯ñ…—ž=yðì´y/ ºk“æ?~þûYŸ £Q@ kÐ1Žf̬Q;¾¸qåÌ“ëåO½¿³îÓS/BŽ^YSÎO—çWz:Ð÷ 0ÿ[›\‡¢æ;¿%ôì—ýêrz^£ÜY°>aOÌõ³÷toVx—i¿ N­Ýp+2aVz°¹Ä´•WnòbP¹ËÏ/çÊy1ãl=ƒ5hX È`Òh-7ܪÙwïì¤nUƒ€²é¡kN:ðâîÔÁY÷J{^„ n_i×ãài]*Ü?°ñjËU7­‘¬ëo˜)§Õë8­^‡ÀiK9é½²ô÷ò¥$+;6äØÆ:µâ­Hïb`Ø-VÑ€©bµHz“-Q¡:“‰EªÍbS p:½–grjëTÎÌ”£(Dg2r (D;éÖ™ˆ®5>Í:¨P컨²Z£N‹UQ°Ù%@ŒÎ¨gÉjV«×jÞqQD«E Xëâ¢QE›MPXŽUltÑ‚,ZÖ¨c(öuãîE'ºažRïü#AµÛí¢ ˜Ó›t B”¨ÖL+ÖäªÏÒ23– =ps:¯7h5,µ[ì:£þµ™£X3m1z“Áq>¤Ø­vQa4F½ŽÉÕ–d³ a5:–)=yɨG“únHåô†ªH‹@±ÆÅ%—ØÒ3@©ˆÕ ¼Í& *[EªÕòL^­!E´Ûí2â4ƒQ*Z-’Š9X^Ï`DÁn±QÌLZ À0˜ò¦î†ÃTʶ`²Šo ×—BB¶²Ji` ªb6[½‹«Nêª,ÙEÑÀ³˜ÙšiÇ,«ªØè¢U¶ˆÈ¤gß,›Å¦¤5x)¢`·K€YQÏbD)ýðs)È–#åhRÊ0LžœKegWöŸ !ædg× •(’Õ*0 & 19ªH6‹@Òèõ<‹‹EV)ÃkõzPJì™…b£‹AµÛ…:)E:7XÍTgâ1ÉÌ”.Z"Úl‚ÊrŒª2“½ÙË:£–£VsV`'«7èx,Y­¢la4žZ K«Èèõ<²[l£;%±“þŽÇ==ƒ7Ml–³Bg48,ƒÉñÒM¯å"kpqù½†8“Ë›c}ɦ™u³èÆ> #1ÿæeÑôΤy–ø÷›À¬Æä¦yý¢Þ”]Js㛯"¦Çª}{ë¹_œ7hj¸ s «Ó›tÙíÆèê’·œU¬™V¢1¹¹¼©Ü÷¢Z}®/²:ƒéÝùŽˆ×yýkžÍbUùlÍby“Û; ð`½›+¥TU DZ`0hqmÞ®¡ìS†²¯ $‰a9ƒëëÞ¢,Áš#B$$ ¿A9þ™UF‰RÀŒÑÕÅ!ýƧÓëXæ5o9ƒ û[# gÒçX4úl‹*Gçóˆ>ÜlrpéQ Ïóc„,+×ì{š¥$Klj´ž ¢Õ¦P¤Õër«¡T±Y$­QA±ÛU­ž­6Ç|˜×è4Œ"¢¬2¼V£aÁN8†ÉnÇZm¯ë I'fÚ4FÕf‘t&dqm ˜á´:Mžå ªŠÝ&:Äï‡7‰ÿ@¯Ä…~bÚºÚˆª6¾ú®uìÀ(“b3Uøü–ð8ÌuWˆÙ¼ˆ¤/¸ð死ƒo>«Šr†Y­²?ò®}Wx¼¦³Ÿ]’}ê ;ŸñèVìÁÆÿª ¬wK¸S‰µPŠÚ=›ñ8ôÅþ"&¡îÄ5ójò¢$Õ›¾iýçÅù·ãm»o4ÇLíWBfÜ÷˜/–SSj­Ž¸+D‡ÙcBâNxsRÑŸ_b.Ïö»¦Pß½_7²¢¡ÉÊyCªjv½+Ä„Ù¢ï áÝ pCŸ™ZF ªôÍ…“8[Ã#÷î Ñaöè»Âɪíä¨-hÀêÎ…2y]jæ eÿù#;cHuíµ³FA†añG©QD)Àª½òÀezžÅ9tsJI–‰óqƦ¨ú¾{/„ËQ“ú”!¯Yøºò=A.¥·Æ> ?PÒ‘l\vÞ-Þsê {ô‘½ƒ j®’TTQõ=¶Ÿ¹/EMPîÍ;ˆÑ￵Øhµƒ±äÆg‘w–qgÿdÍB8‚6¢²¯ñ5½y=‡·óïÏ’j,Öè„9æúýþXɪç^_ž˜ZÓW…Ú£·.ïÀSBs8-©LÜƾj¿Ó³~>5çj¥T5ªw(%òê½ùYå “M}·¬š]P\mÒO¡öè«;ñ$+ö‰çÿCoî ”Úüûí97%kçäØ¡9è=3˜{gS ”Z}{ÿ<Á›w{N1–üövh˜¹`l}E¥ ö_z÷Nú¥Å]Ôl¢”ZµMC…kE9juëtøöwˆrë¢bÂlQaöè=ó:Zm—µï ù¾=Gå^ë÷Ï©,«²}̾㭠bmW^ ´s…·=ƒ¢Er©rCØï’©|•ð8Ìf|ðÌ8×uz4÷X~—3¹ù¡zTîxÎuùÚ¦ÛÒÝÇëTÉ•¤]˯vèӥ߲go—©ÕôááCÆ$KTå¤âÊ?œ9°ëÜ÷<Õ¿ã×3J^ì5æ$äv² ÌÚo‰ù»J¯³iØŠ-›·ü¤]ãÆ™‚ /賂ÊãCÇL¥ª“·Ê_³U·6-?iêν•RHÔâu›·ø¤MëŽXõo'#ÌnÝsäô Kš·®Sý+Y‹Ù:_}ÙmØ}ûQ‹À¯jåĵ“º¿¾åžüÁýª`·Ym‚˜¥*v›Ýj“•?êfR¢áB.©QщVô± „žÜŠÔ–t‹ Ï”áÈ ¢T)W¾Ð…ÍáõxÝ¿'Öö¥$›ìT5¾m*d¾@E‹1±©e:øi)H’¤ª*¥„úÔVÖk³ýTþ²”«T®È¥Í÷ë6ô¹wËRÛ|§®otèØ]VëÕ®’õ™R°¤6>%¨ŸVýFæ;0)×éÑŸÛ{#J>”cÉZ¾ñÖ¢µuQ¡rÕö&3µùjEí¿Q¤Iµ°MçÊó—U ªªB(@ýªnWO&5¨ÊE[óWñÈQ]Z1¯›/Á\ †ñÙ]±r{CÈúÂ-Ô ËÂì<Pû鑪Ýßx®lñ…P„ÀfûOÌ’B˜•"~nZóû¨›[Z—jpüF¸–<2q×°Þã&íâ0Òú­XÓÖ³\ûÊ_|¨ˆÙ'W¥*‹vÞübP÷N3_)ˆª8¨]àÁíGî-´tu'%ú—¦ÕÆ„îlSªþ¡à DÅEÎÆô øÆŽƒ¨ÓÈvýi#OÄ`×6ÕáÞ#¶f1!Ö«vIS.5¥Þºòbà·uY OAÞ »whþI›¢þ¼w©Ú—wß©ýþñÆeL²šÛGP°z³Ÿ´iݹ2§æ^·„wkÒ¥M‹®íjÖÌ—ë¿­kƒÏªÎ­^÷R±É%}´¼o` _–RâW¬˜¡òõ‹lûéÊŒqIøv=KýöI  ¸Tâž*åÊׯ²UZ|x›ßE)ÁToöWë¯ghY„V“r`דJw„È©¥S¨¨*5èÜlïðõ"§ Þ¸Ò{å¥pùZÅÔ›¹nÂ,ß½GÃOº¶ž>nÓH½@‹×©’y/:™¯Õ ¨âß³_Äög!Œkp/”¼pÃÃæ¨Ý[‰*_®üÓ”Rmêù¨ïpX!fïŠ[}—u|­’øÈÈG÷DE¦P­*2PÅ o])‹ÍÏ…=Œ¼ûÈúvA;„SŸ>Šº÷ðáÝXõb4F£žÓ¹ºº¹(ÁUÆv¼°bM¦,‡¾dA,ì7žØHTHL‘žZú^·6©½ÿ^˜-zϲJˆR9Sî};:Ôýy|ï3 D_Þ9µrMäÁ_v?7ËÅ–BT‰<³{Ëš[›6K±“"y•R–eÎûÓÞÕ»ä8gyãy@,ÇѽN§vuÔµ˜×æ^ä+—™ø’Á@)âxQ ˜IHH-SäÕ§ÝV»÷¾G¨`oÓ§ÅØ¡˜ÅHH{hõIÝ>mòϱBD²íO±æÍ’$I’ìˆWUÕcòì]g`TEמ™ÛwSHB BOB¯‚t”* >ADŠô. "¢4AzGzï½÷Þ‘š¾»·ÍœïÇM–Í&„QyuÏH²»÷Î9Ïœö+éîï@©Øëw¹œÇú¼;ë„wF§Èš‚1"D»{ªpû¨Ÿ%Ë]ÿ3–#æy#À]yˆrÓ½ïµ_—#D?ÿ#„Ç ¶Y{µx¹[ÆZjIzuq #‹4ºÓe/Žu“º åóc†îïg{Ÿ‚‹ óÒ½=kWê´-±ÜêŸË‚ r Œtjú…JÌaP+®cJ²ˆÌ·—^òÅ÷­Þ|9çÛaÎ3ÑÒ©™­û ãï܈Kµ“8!få€7W×U†âhâågÏŸ<Èn^(VXÖœª’7òø51JL™r© aòèÚ¹3GOŸ>y‡Õ€3MjRàA£ é8wìô™£§®ßŒƒTxâò¥„  L° ¯Jí@‰¾kϹ»Sã5²)Ñç_>¢ñÔœ>þüÜŸÎ!¦¿ùî•ÙóN¥éÀQ¹m¬IKiPõ­‰YšËye•‹#’»Ì˜nµâ˽®¯YàBžÅþ}~kœ½’£rƒý»Ä;ï-?lï3èÓØ‚un/øÅyk{·ÕëÙ|Û²”ä¸ñæœ! åiUeIËaRA¹„ÍßüØzK¿a£þ¸Ãyd ²$)Úöov_Ý! ‚ÄqùÈΫîô3üÓæÕWwj†b\¿ëc-ø^‘ÕŸ\åƒ#å’Í:ô+Ï‹èÌï³×/Ú÷óÔŸ®{\Ž|§I•y®Ò{íÌ’*Ç«ü0ó¾ñ¢ý ÿøêñ¾}ÿÏ\{xÓê#çõ*°þÛvöÕÙŠúOi?áËAŽáÒ÷¾öÈ $ºµ$ª™'Šh’ÝŽŸ©' ç#ÿ…œÜÈ4)2c0þ›ˆ¿1æöÌ]ÚkÓï «JvMVŽcß0ÿkgå¼ãŽžÐmͷㇼÁŠmîÖ3 Ø:\<4¼Ù7sÏóÚ‘]æ  c¾Ìß:lVúºòáÂ.A¯ßâŃ‹—µñ·®á§kÙ÷ýêä̼¾™õè,•pa;¡ëªï¾^YØÖ£ïcôÔÜíÔa(­Ô»¿Â³÷T³žÜ˜6áâȱÝJÔ_Öí} °¡Ê#cŽ®Zeõ™õþîëÕæU²|[Ô·Òuö+±÷V¿:â; ~ËF-|ÿ×_ÛÕˆñß·ð “eåGÌü®Ü5ë.”È­iß:¦[Ldí•ÝþO¥FóvunÝNÇ‘þpÏå×æU¦ RýŠEÅqˆ±W•éþ‘ÄБ [\=¾cËÍsæÒ¥£Æ^RýM›bê®\-‡·J¡b‹£S>A¡Çb³~аť»6ߺ¯RR`Ç݉ïúÕ~ K[Ví8ïgDz{u Ýê|ËLì±pÖ÷?HÇ•?Mºd%¥=$J"Ðçsµä¯"„I$cLn^)îü±GÈÞêm\_ÌHÄk÷vœ<¥íŠ;Õ²_œãKq¤ì;Ÿ|šÏÉ úÚ±Ó›{·Ë¨î×¥â7güËx.KxÛÞtÀÎ{/Ø‘¨0«ØNä0¾³çDÀ¬¯jÞ<\£R–•‰’€ 'Š3‘'žôÿHF—æ.uŒý¶®Qky¯w¼ì7þŒ^½@8@„ã0FÀ,WÆ„`ÄC láPƼ 8ሕLdù:0&„ÃcÔjçq„0F0&˜Œeˆ À¬ Ô£Ú!Ž#ŒR„0á3)"œuÂI”y„“ü~:¶r]“Z+/YW@€1†!ɾR Öï$ùÑæžéY×qý1áBÀLÖ@ BZ"nwtï¾&U®Ä£ô/îi³ô 3íO]dj ^µ8½Ï/iQ%}e!#F™õÀœE¸À(€uü'<ÞI0bŒp<„9ž0“Zû“p„1Ê(e€?X¹.pH½©Ç¬T8ð¸,ƒt7žgÁÖ?5Ei/EF™ûI%E“6]ÒÖFÖ›™I!A°µ;(cà=Õž—u±B3V´îØd0ÏYå×)/k© ìdLyQÊÊVµT\’{¢¦Šõÿ©ã¹>ÝVªcÞjÉû1Fu‡mÔ¶‰ÃuDÄR5è‰æ¤Ië†Kž[7¥¯[©Z«šÑ ¬OL)`BFp„Q È=Õ„n²vu“–ÅÛÆÏPh„#ÉêŽÃ8ÉˢO¸µf0¢ p²j%±îŒ‚CCMqöHµÞ^òçŸéµÆ’ªþ“–ð“ p“ äU›FÇ“&¿ ɉ©nF‹ß%I$½j ¸?ÂRB“õÆrç•aŒ˜j|§*kÖwÀ’s<àþÝýhÉT3O^|ñ3?BO63ö "Ø00JÿÅçidšèÅŠ\½ÜÑ~žç­?Ze=cô÷¶PJ¹‘Åiñd9>ùÝK•¥x'µ¶\ÒëÖúIJdgŒšÖBÝÚ޿°U¥„S,gB”{Ò(¥©+jÿvgVª¥˜bNRnº$u–4'†a‚à9ÕV\Šw"ɶ¸aÇðœ|ÊËZÙ¯hQo²–Ôj €Sì6˜ rŠÏ¹u ¬Ø“ð#‰HÅ[sz­7Ï—R®ê7cðdˆÉö‡¶cô좦ÕXáƒôZ²®¶Æî™k½×L ²”Öx¬7$½ëYëí/´¥|òa‡Ïûü </Ì=a…È)¥<ÏYàä&…£” ‚ÀûßýžF¸àö§f•-dz5ÚÉ¿¸˜¦)Š¢çYÄMÑ”æi&ùåž0]³ÙÅŒ|‰àŒw(~>¾÷LÞ7ÿÈÉM üÛŽÑÏIVñ¤j1À’‰yc⎺$sLÀÿ¤þM×a÷’åÉñ/hN<Ï[Èm¹1)¥ÇQJ-K$I²L®g^MQÒŸûWUK*ö +Jl ðó)8Jùäü=ÒGGîÙ“T5„ufÆÉÉiÿ«Zcxa7húsˆ¼ëú^Ò2{¦*‰-ò`²wÛRÖš1 ƒÂq$)Ö•ÖÚ°‚(>ñÉs‰2ÿ_.ᚌ±››¥¤çyòGäÍSþ?*Ï[¦@&ëô”¥yVÃŽÑq'mÆ&7’1ÆtÝÔuÝýø^Wxuü|âC)Ÿüƒ’ñÓ¼g‡Ü/lÃÓbu/ïÀôâ.t7{üÏؘlÑ·[½.½^VUßvô‰¥|’–9•AÝÿ]Bˆ'7„—5ù2“€SÙVŽßÄÏ•œÝgqìút‹O|(å“Œ)ŽŒÄ_’#Rÿ ujyáþ"H¶òJÜØ/Šbšˆøo_u’êoRœ–l6_\Ê'>”òÉ Ú[õþ×?fú ô™k¸»ZTÿµEå•9â‹HùćR>IS/£ŒÔ5awyö¿ýŒo•$§ùj¦té}úÜâÿP¥9Õ†áÃ*ŸøPÊ'©$#(宑ú/(‘4¡(ÃriF¼þ;a?ÏåõȆáÛŽ>ñ¡”OÒ2§2¢¸ÿ"KâUSOóøY‰Ô/oîX¾ôAë?bKý¹þ>ñ¡TŠÍ¥;éwÎÖ]®Wyÿ0—úŒ}ªË‘àÐ<謀êN— ÿe‘vö0êtV³»¿KŸ‚érê™4¯TsÒço N[÷ôßð’úÚJËþoÁ€üžóeOøäeQ 8QRì6YâõDÒåè‘6ò”EÔåúré¢`JÓ_v€Y±+ŠÝ¦Ø‚a"ÛE1 "ÛmŠ]‘em N®-‘)ù 2^’¬‹ð„D›¢Øm’$¤i-gϳxJSÕ™^¹öΔßNªW†TÔ“€ „ª=v­®…ŸW ¦-Ì ŠÝ&+V; ‚¨Øm²Ì#NQ’æÄ&!A±Y? œlý¬(vÅf³>›Â0â$Y±+Á/±á„–>~æ3äÐcVw>ÏšMàE‰pà†5+¯›³êÛÆZìU[‹ÿˇՌC”»=njM™‰EÍø©vö´¥à¿Rç‹Ýéø#Ód>ë“G)k2ï\x^²+€C®_t~»åÂw‡4´°Û'í´n3 ñý•ªc>í°tOœµèÀ¤ çôkÚbéÕâySûl€~0ù³úµÓw‡ÚìaYµÛ {û‘˜OPhíO.˜Wç×?Ô·ÿº››®å(ÓD¿w°n±\ 'niY v©qqÛ¨©´f;Œ‘‘h|~îÞ)牽={Ý„áxbºî’"ùƒRíù,J+—âœVÅ·ÿèÓü“ϾºÝ¢A±|µÞË9µíëνZ½zç©u1æð¹ÉŸwÿÝ¥R„U×FN^Ñ¥ýGu>ìùÕj³fÇ­¼xVô«Î·gŽIÉsTÎÕµÖÕ#§;jv0+‘íÔš‹<ωŠL8¹F\;õPà9É®`„(̹rá´víЩî"¥AË}Þ)àÖ9 ÏsaŽã8žx~žìòUGÙý{>|ËU4GJêŒôX:½oŸöÍGן96›‚×÷kÿiöïw>×v`=Ò Þ:–kÒ¾^ëU»o@¥ï׎ù£q½7›îþ°g‹vu›mpÿ0cR‡NK7Ÿ›Ô¢M»+ç Ò~n—íê|8í„ΧÓm„Q¿œ…OåæþŽŸŠÌ©PæegÈgVŒjS«…ý“>•¸S߯P>w–ò•ó,í|ùöñîûÆú7zì´ f@í·}ðæû4üíÝŽM 0¬aàš6Ußý¼Õx!„ÁÔ.£ÂÅsdÌ‹!„çyBÈ?ʼnÀó<Çq‚ XVÅÿtß“ç¶/“gÀgIùäåPŠ™ʉ’›SMÓ(˜IŠNsŽ]?»i³ZUÊ„`Nò>2bˆ¿‹2t$¦V˜[ѧUÕ\å«—§fc„8I1ô`ç¼×ê®ÉÚð­ÒJâ©EZ4:3uuµ÷+_¹t?¤t©ürè÷ËûÊÄaÞ.̬T¤v¥þÕ[ÕÑ“=t€‰3\z‘)ŒÜA.{õ1å9óþÅл=KÈéó‰œÀÇÞ¼™?guKóh˘˜§˜ýnœ‹`L!’°uÓ‰­²w®çœ5ãªWÛÚ€BQ…äcW Î"óNM·nsXR<ˆG ³s…JÕs•¯[mªÎqÌ–óƒÎ­Kk>~Tº%Ø0sºGïµ¼]JL•¼Â¨étÈó˜ãQð KZ¾W§f¥ÜˆWû ÷¯ëNí–U^È™ODì‰ ²U²]Û2kÖÚ¸lcLWUʘîÒŒ¤žŒé݆š†®é†Añ£“G…óç°‡U©teC¢Ž£º+vlÇ5úwtÞ=V÷íÀí³ÐÚߺy§lµšsê·ü⃶C¿»Ò"B4QÓL¼°üJîÆogׄòV¨ébñùøTyl1׎» Ú“4Z¶ÚUsË(ƒÆ×n=Š¾s£f³’ÈE«F¿k‚ Í™3?0¦¦iº‰˜¡¹4ÌëgÖ_¯Y!?.k¾PŒ¸slÍ=b|ø¾…G\JJ#G¨Xg~㺾ÿq¿¡Ç›±¯[qôõÁe!Kž\þà˜5ëê›íÞy>{á|x$t`‚"Ž;¿Ÿ¾lþÖ{ €ŸÎMŠ19pøNÿ+yö)îÜÿˆÃ)çR±BYmJˆ?òH)—ýuƪû²Ä3†QltŽ UÂ%ÌÛ³Úc|y^‡·¾y}öòl êâƒR¡vý±åô™kÂØd8[¬ë&,ÒùÃñÕ¼ÖÝKc“1ŠsÕ{§Hx —ócþñµCå?©~÷Ô½ ï—;p#O©ú™Î ×(C¤,Åí÷OÝÃÌqæqé÷[¿!m¸‡FˆQÊûK56/¯·ÙmؼkûÉ»Ñ^à£÷/ÔüÃÙ‰Õr‰æ¥Bèòé?!#*2J^wà$ÓÕçÓ¢_é¿áßçñK²1N“eß'>y”Â<9Ó¯Ñùˆn;ÿ<2iÈÄ ˜XÎB8N|°x'jrìÏ•4§Ác)G¥mú­OUØâº8¼e10ÁJþˆ·nu¯NIŽ×´ßȃû–l[w²A8LÂüî|žwòªWПÛNÞ¼·î–ßÛ±¯7-ºäx¬ê4NïßÙzPEB#„?möùî?·Ä†ý‡‹g&ö.ö~³™Töæ·ðý_¿»[¸`ˆ¶w£.Ÿÿ©É‘Ù+/ÜÙ8pwˆÎý.aýi›ôèŠF˜sÝü]⪸ës'”çõ“gî Ÿ<ÿ†JÙQ^65Í0æIL—‹—e ¦KC²"PM5(ðY¨Ø$I0ë1‰ ‰g¹¿4—JQlu¹¬Ô9@X¶)©i&eD$èB¾é—gŽ.Z㆓óº¥árq²L0fª:VdŽº¦›ˆp²"a„L]3 jÍ-u9“r÷0‘m’áÒ%îÖ䧱§ÁTUƒ"^’„”Q+ÃEÚÙ ~©“@Rd#ª«º !’(ñ¨®ê Ë<—J%™74— ‚"ÍéÒMŠ ¯Ø$ŒPSUuÀ‚Í&0CÓtŠ0‘™`¤Ë;nôþ0´õCHÝ”¨®ë%‚$Š^STÕ „R^–SJ¾Úµñî'5æ_MjÖÍtM3(æ%IâÀ44Í@ ’Ĥ«eÀ ¢(ò ë‘ŸOTÖ<~GM},rwhä8.}ìùë:¾?­c}šÎF÷€ÿSãïI2´kY<~ÇB¬¿ÿ£å}òÏŠ— ‚yIæ¥dsÄZO8é^Ja°(v›çéÐ:Óòbg["ÈbŠ5'?ù,'ËIÑQ‘B²MDñŠ !Ä)r²aÁ+BˆK¥(ó¡t¹¾1¡Î[½G_Sd¨zñz¬b·ÉIý˜ÖéW²%m^QRN dY@èZÀ SN}ÚìZIÝÜNHÞ~˜ðÖÀ‰ *“GçE‰OþWlžwùiWKý`¼¬ði?1zxê„ÁIŠ-ÉÄâDY€qoÍ£û1ŠB@’m"Ƙ—$ÙÎ3Æc€æxÙ–¤å‰ )“-ºÎV”ZùgQÒÒv˜%ELÛñÅÉ2Iö ›:×rÕÊ+}s–—’Ÿžx|ó‚Â?¹«ä1!XÏýô9·éîV¾IÏ3‚=V½í_‘O‘AÛÈ*¥²~v7ôHŠËäÌu¯«¥J—„ðsuav¥Lå·Ò))¥î§³â‚¾n>yy[êßyÌɼöçN·ìWæA½†³TÇ‘§jU7KcÌ“&ÕK»yjRÏ¿§žjA,$°,›¤~K›LKk¢§;ë,uNwçò¹=xÏTñ`±ødúJ)•$é¹>¢i!Äšv‹ªÕ4MAtÝÀ8Ó¸=qQÓ4I’Šà R IDATÀBtËõhõ1MÓóâP„܆dv w&ˆ{üîBæ”ËaìdLñ9ý|ò\B2º¶M³~‡VŠéQÃ4G¢öÌ6¤Œ¢¢]û–ÅO¯²1b/æ•WÍ$möŒ#sú›ÙÔ:ƒ ´TýË"À/1 šÃaB’J÷˜fÈ[=Êò&Frl;Ié`ŒEQtN¬Ýâ>,»QÁúˆ V;%w@H¦;áÝYÈÇ%'a?{21BR–Èzúø¤Ë ‚`¡ „ï8L)E¯FH$Iây^’$QÝó ¢(¤Yàe·ž>=©O!€rWíѵ NŽ„Y…²¾2QA„U)k/d‹è×»<DB¸ä4L°æÙZ$ÖwÍPJ^`U?ng_^ŸOþ*”jÔ4MÃÀ@YÙºÕ%Ê€™”2`4!W×+;ëe3MÓ0Ì''e÷öÀy6`¦a2Ì4Lk›PÃ` JåƒúISiRŠ35 ÃL‚ÃäËšÞ—E¦æ°å²jŒaX—£¦a˜FŽc&eIŸEIWeÔd F­Ñ2@ˆªñ¥>ÿ­Y˜ ê,wPjšÔ4Œdº9 &µî˘iISÌ!–:d,¶»”¦‘Ro}ŠRò²¦šðÙ‚•h¼n¤QÀªïÄ;¨eøP“RÓ4ÍôH­¬‚.Ù¡éÆK¹µ¿õs* `”`ëû3)`Œ£€ÓCߙֶl6—›~*©‘UFb’( ‚À<ÖURKxjRÓd`…=00Æ(C‚™i0`4yH,y%F Ó4LÊõ\o™ç£xNäó‚UÏù·™Rj™¡n缆‰³kP/ÜÊe°V‚Õ­…Qêþ ÿúøÞï•pêIÓeªŽ»w˜`„1ÖìñyhS“¦õZ»eÇ µ"u ×[±½Bb—úcçg’®+‘Uycøö[Žüâ/b#°Øè=»vßÜÔäõ¬ pÄÇC·=>7gZkgZ™m¦·=´¦Úš^,ˆr;ÖÒϳ·ʯpƒwN ïøºÉB¥ìÛKo_·iH(Q‘r]¾Ùúðäª ß„pÎ*_LÛ¼ü­?Î:vmaV» ~vðæúÞ+Œ(c&®±`Óè_~Ø{oWÓH]Ó#;ŒÞxóÈÚícÂæÊÖbïÍŸTqÃà ?/œüËÓÇ4” „LS¨?nîa×éíË ‘}Æÿ:¦ë†»Çzµ(bøø(|ò‚¶à€ˆÝRÝ–gðÄ Bpù¡5ï×óË×m^®OÞ)Æ—¨3¤òú*Jd¯1[¼v!g>n›«ØœM‡ÚÛs/7›ø)чæ7+ڴ祹˛Æ‘ò5i<´|ù&-ÇóY+w/y¦Z¡²5+)–»N›/¥¹U”ËõßΫLx·V››†+•·§a2ËýÃIÁ!'kg-—£CÿÐ ¸j]ù×+„ÔÞtQé¸qÞœfuZ 8·hK»€GË+diòеçM%×ÃΤ *ÑlÞ鶪VHÕkUF–É*"1 kèù:YË~Ô·{üydÉîï”·X‰ÉØ/ERýÖôz½å.?›u0'ùj„ýT¾Xç=µ›5#¬¥9Î#o%†·ÏÚ"g…É ŸvnU„qB ^ iQ·¦Z­ùþšErµwJ)ª§ži ¸½ÛƒgeÍq ¬Ý®w¾ßª–1ãA¤ÁÜ…Ùw¬[þËsû:U10H a>K•þÇ¿÷sÞ®Z·F‡Æ†,~°K“7‹}tôŽé_ðÍAQ«IyFì(þaå\F¦žë37ëÎr¨¢”á"÷\¥ç×C¯Ü«|¥ ÷1™Nó P­uî¨Æ=öð!(YÇ´uÔ }Øa¶‹Øvÿ¸j½Å¿}ܲHhÓ‡”K?•*ÔFö— HðÏ»í‡Ê¥º÷Ÿñ® £Çû+g±fýoÿ¶¸‘íÞü²Y[=ˆÝRÃ>dâeLÕÖE#Þo#!DóÔkÛÝ6·FpegãÑElIYüÏÕ ®Ùñ?—îs úäãRflÌÙh¬Ÿ;p/Ï Ô€j¿Lo¹mÁNU”'ùû‹/úøóv\8r0¤Ûìu«E4ÂD>¼ý„vÿÒ1®\TÛ7qîÿU ©Ù´ìò‹MNô °aÌÛý%ž)Qó5ï¶åÁé¹?ÖÈí''^<±?°ëo~ª™ê²˜(þ~"Ï)~vËQþý5·O¬Yô™‘½ s\܆©÷tш‘"êZ¹Ç©?^2û&ÁFž"Us:q×£Sƒ:•*Æ ²M‘yÉÏÏß_ÉĹk«¶ËÜÙ›´z^ £+{–I9g´™«J®Ë§®&ü¹wç½Èúg°aÌÙü™Ki…š9òÝ8m«Jã÷,=üZ¸¶tŒ_³¤¾qÅ3îê)(\<Èô®3#DÝ2õ| ‡Õ8Ó§'ŒÑîݸr'¸XÃ<­†íŠ>7uT¥!’5øW-Šb͆;›15ø¹)-cÊ'éIz©_¼" Q¿Ð`xl2¤¨GZëýãéÉç‹5:§Û0ÔêPÁ;¯vŒ¬h³wZ<;p[‹Xo[ ÛƒF„b|ŒSxxvCÙoZI·úž%XÂa„ LŒÎ^þᘃ6ž'Ú t*R%ÀfûtѼàmM§ZÌ!  Ðleö{?²RLÄ{çä°^£ZR™ñàzîrŠ¦Ap‘¬è$猿s Ýç_ntñÈ$’,pÆÐÓÓÉ^@EÙ‹„0óQpûÅhŠbfr'\5.ey[–`óf",%3i§L‹Â˜¸âc æ ]—rä¾wˆ"†³Í 惠 ÿ[­¸Ƭì‰gá ™[¾Š0ÄÝ ÉaèT +äJ8‰8Cr6v¿ç)sK)uëVO¥œ~.ÆXrœù¸P•@»_¿%ã·×íðÐeÏŒ!ž…ˆÚ£DH "˜Ÿ\šj`Í ÆNÃ/‡Ÿ®&rcH{xéÄWã?žyMá(â%™'–›1f‰¿d$Ä T©ë1âx˜(ŒÄ,6 À\º¾qvów¾SxFÈ?¦^}?¿jÓ6W:QgÇ™XŒ1€µKcC`œt?ÕV¾_¯¬ïEUŽ‹j³kºò YRÛœâLéˆ/˜›§‡49[è݆1 _¦ŸO^¥L>°ÿ¤zΈ=}:;)–A‹¿Ûºã±Y û¶lüÜÞªEŽï14hõÔ©w*ŒëÛôaŸ7áP¢·ÖA¼oÚcPáv!& =§ŠÄ¼ós\³Æ·Gé"'`Db/ì¼[º×wƒ÷¯øyóþe—kþòKñ«N!hߤQ›cÃÆlñ(žÏë:”ú€K¸}ô]8úðÁu£¿9½éhpû¾Ÿ›¹«sòQ„æE»lù¦xý沸ƿüT°eîÅâé?~“Výþ]‹sB°ß‚νƊ÷Îì8ipÑ{'ŒXM.sÔ8UCêõ˜Í,èÜ:9ZBÉ6ËE$|gÜÀýCfŽMðÏ»¶K×àqâõ —¢zOzhíŒU›‰·KÒ Š'O˜ÈÏš[7…UÁ“¦u¥ëºU…„—í¼ç÷'y¬LxÅóÕ$â’¤ 2@²Ýî1í’M”¬š0/»ä…!*µóïk†a>ñüaŒ0¯ØÏãù«¤Ø¼}ªÉóÉI²ÍóØôN¬ØD„öÚt)÷²âg÷|I•`0æBX’¥¤[Ë>-ì“´¥5>Aô÷'™ì»Wlí~6áïÜ·jb‚n/ÛlŠð÷øbL—Cãlv1³I \N•Sžç²âžøG„Rê¦*@ÉI}^Ýu]wêzðhš&¥4ãŒæV♧¢´²Ñž]ûœñS.aŒw[Ÿ¯Ns_çŸøPÊ'ÿX cÒ±fP¨TŸ7zdézyû¬æg^7z1˜qs½ Óë™-iýûŸêaïJùäF0FÿhºYzšÔ­Ü-ª@÷¯^?xƒ$¸W3rGÊN *!‹J#³žè•ªNæNZ”þÃ(€l6ŸÓÏ'Ï-¼o |ò÷KZŧOòÑ ÃHÓ ±ê–1BîÚÛ ¶ÙµâXcÏÊç¿¢{Sêv/|©Ì˜õÐVå?~`ò‰O|(å“4°¯\÷¹§uK²zY™©!@„c«zƬŽ$ÞmM2TÜwyKY‰Ž^OÊó\¦Œ 0¶€ü•0b(õ5BôÉs‹oÉüûåŒGx©`Ó4­TJ)!R½ÁŠ'BxŽ{^hI³_»»@*m)ú”òIZæÔ+%– ö,~òB/œªY yÓ1ÅÒAD«è*%æ¥g÷¼€N÷l*˜ÁQ†á¶ðñ¡”O^q¼Ä/Q^–ÖóBcj[ ó2QùZA²çµð¬´u«¥!@)É5¬Œ¯j°çE,7Mâ+r`ò‰O2¥@géî 51ñUs"¸Îg脨®ÆÇÄ9TãÉ™¯ý+y¬êSMH0þÒ0M3uk’ŒëtÏOQÍ•¨± ~0•¢OXLMTu¯äàyþy¦yZ7|òk¿c\ΈˆÂEó‰QsGæ#gÏfËS ªdTᢅ Š*Îa!¼HTD‰" „rˆÉA9Bí˜1fËš;€çò-Q<²`ÑȈ’EóæNå;0tû·‹¿§zz-W1˜êwÜzçÜÜAõ]fRí Zæø±±ËxÞ]ËŸ»X!ƒu 1 ѨÂEòJ£œ_ÖBÅ£ ÎÉ1°åÎQ<*¢DTd©¥#"JDE-(!1,Ÿ{"‹åã·×k’Á€ Ù:³¥Q¹á•ë”ÊÂ;íæœ^RÄÉ*LX6ðã(1¬Ò²µy—î5%ºÓ©»\I“€ÀP]I“tÐ0\§Ó¡2@`j‰‰BHsY_7è.—3ÑiP†€©N£÷üYc9]&BˆQÕèt:\æ³Ó€å1S< ‰ 8êFe"s¬ÝnÙŒ&º“ ñÍK7Mi˜ë‰fË_¦å Íš5{°H%ùg¬ý: ¯tÚ¸µAQÞKw3]u¨†ËáÔtŠ4§‹B`µ’a.‡ë‹_GäˆyèRMƬñ;ÕZÆT× U³žcüpÚç~õ?6Sl2¨xÝ9î™âµ‚[O}ƒT–ïô™75MÓ3§ŸRjš&Às–1fá“[Ongå 7ù䯒'NJ•O÷ú¥m¹í'Ô­·'c[¶žß .[áÖ7Œ\÷ÁÄi‘|t¶ÒEÖtþhÃü=>{§C­.¥›GÚ°ãÊÁE¦¯zT±Zpç†}t£(åCzw ŸYlÚî„ð/nO/òÅç|.€„³‡·;L¹ÞµûðuU (±×mÛzôÝ뿉\y%•a DOnÛnÿCKi纭‚MÀ)ÙÚËí»å;Úè,A’îôŸzÿÄŸ3~–+Ö8;â“E‡èÀ•óî^+—gDƒ6¥p! zÿ½š§+EÍ@ o…Ç­¦_¹¨Øïh³zrÌ‚¡…ªß0‹®r|Û%WÃçqS\®Ë;û¾òæ ú_×]úFÃÈÕÚO= ˆ›Ç×ÕÙõí{Kþ¸ +w`^®†É…ÝÖ.EX´Ë6 æ¹ƒ‡÷Î=ۤߞÀÝ·7XPöïÝuÂÁy¶ Äüí} íFØéðoÑ*ÌO8yîÄÝ3ÔÈóɇ·=…lyBÎLX»g0ýº£ˆ˜ê¡e5‡í»‡§œ³¦áR•îLüü×íZç)ße…Äœ¥ Îø¨Í‘Û|Ó‰³ß ¹u7‘­<òBL(ùþ”aE‡´]ºíƒ*ܾ©åuíø´Ç®öcÚ……µ7<úîÆ©ÓNVújR‹¢q±BÐÑ!]×ÞæÓÑz¦Ë¬1lÌO#¶tÿ„Cˆ2e¯3Ïy§ç†F˜€³}ûÞÃã/Y³i ªX«êÍ«·ES¡D£èU‹7ïÙ··ÛÉqMª¬»´7]º¡åùtìˆ2ιwh>¦÷Ƀ÷[UšEyjÛî†Í²uì^({ØG㾎¹¿e„Cå{ŽoU´B±Kú|;çêÇÓf—àî:í+{~y2–ç…èÎܯÛÆèá˨cŠ%o=—êwçïYv’GðìÙww#†‘f+ 0¬YžžRË {1Æ!xZ'{+…2#q>+{‚1ŸÓÏ'/ŠRL ¨Ç˜~;‘ç$¤pz""fü}†ßÎ×fû„úßþ±`éàA9²ûÓ’ýû|Piý  'LÈZ¹bÒ©œAÜΩ“»ÿÓê¼2º¨z,DÉFÅ80aÆ]#[ŽÀ”„i„ŽÃŽãFœ»`Toúßô¹ TKé²à8‚&„#iøXx¹TУ?î%A ½y`ÔÀ9-˜Òfq×k§6ï¿!G³ÙÞ,:fáIOCLˆ92q´Þ¤Lq„0(¥s“Þ9ûÍ Ÿbƒ¯®XöÅÌ#~8"[°ÄUÛ¬Fá“;ýû”ÛR¹ÌÏ pˆðbA&…–_¿$ì½íî‹!Ãg´ÙúÁ»ûWN®¼pîð‰¯5,µpȘk²Ž¬\pFÏö7>ŠWyK'Ÿ›…4èú)Œk~³&€0˜Ÿ->õiû¨·ê‚øúÈßi,µª”bIØþõWÎsW?ž½à'ÿ:]çnÌV¯k™Ùçëp 1Ä{܈¤?¢Ë±w~XÒ,L›ðÕî©]ÞZÐ÷\Äù¹}¯'Ê#&–¬SvñÐÑE?—R¡Ççá}õuèùX?Xø­]Ù(ã»}Û)Ó IDAT–?D;b&ÏŒï‘Z)9téÉÈ9ŽF†’Óg@÷jD£”aŒo–‡õ=>=sÅ8>ù;=~¦£ó²ýIܘê:ÃxQ£¦lø!§Ž÷^ï»0‡ü׺¥¦ )2áìDuj=ÅS» °-{d±ð³cZ _tZ$`±¶AÆ‚+&p\rM‹SÃ8ñO¢ra÷î;‰§w.ÚC£4ÛX°¨Àè;yŽ²È âÍ%ã>z¯@õÊEFŽ:=52 ćä/\qòå­r)ª&Dg U’hÓŽw¨ÙeOß¡^­•ªš Ë“Ü… ÛïnlôZ§hÊ¥×ÓXøôµ¿¨ÖM¥! Yr÷(´}ù¶XÀòÐ}¿¬kT²VѦ-æýX”óÎÑ:ñ¨˜¤’3õ –aÀ"Úý§Î‚ÀñGbT )¸O+Sµ´?âøP1á±ÊSÞéxÀ¡xj#¢ˆó;}õn›ßNìj_Îr(/IeI©}Ú&üý);·\¬Y¯oë+ Ès:¼Q+ªaûY#B²”žÒ©ð×›vù¼L§;Ëæ‚s«ÖÞ¸|ap—9Qµé…¶MÇ(a~ó†oq0†1¸sÞ ÓÄ¢Ï?Ƃ䈋É©ëG?,ÐÈöZ·­óöqOz_"Ó4IH>›öˆ#ÄO¾Ñ§~ÊÀ¶“jvë¹âÒŽšáI‹‹bÒ4Ôí3—Ü3ë®c}®]wCŠæ¬íb+^²rn±pË÷ص£æŸŠ¼]#ˆˆ•;6¹|åÏ!¤>Êš76)2UWB‚Q-Ñ‘H1;>}{¥›I‡—+*#¤><û¨v&¹îìM=™Ð ©h› Ã:Ô+ùFý*?¼Qýµ‹‡w†V:L /ªðëçí~}ÌÀÐ9¬T‰l"„xA”$Q’D‚1óð–­û÷žs²ôËKùàˆÉ¾ŸÙyH¼èÇŒ¨ž£\³sßL½G$„ãí¡¹ƒ8%(ПO­(ä…ªæ“ó¾ÝL¾¶g-ù`Ǻmo•n^Q”øç ½a×òy$1(gV…"$œš×«Ê€&ßæãW|³ZÈÝ÷²ÈÅ™!¤‘€ìÔ¥R 8[Þ€UãF}5ãú›Â1BTÕ{vÏçÇyÅv0¯Ln]½~©zõý~~õÄ›ôÒUKe ”sÊêÈ£UÃÊ4(ZeÌô“Óë×?­L¥Â~YÞnWãÁž=8Ø_9ýÉ÷ÍNnßËclÑ4`Œ1ÂL7Ã[½'€X¾BîÍ—©$=ع‡|û}¥]‡®òB:¶ç¤ªJÉÝgYéóñûzh¡Pfâ°}Nÿ¾ƒ¶ØË” A¥¹s[¯0œr3鯷t²Ï-•m†³qûô,j‰ÔŸ°þ¤ëº×ž‘É”†(ef`jÞ DHzhêNÛÓu]×ukä”R‹W)gä8N”á"_a±O^ ¥0Ï]÷îzh¼áÊöþï`”©±±S-6V£—­¼_íèÍyÎ^‰Q ){¥-ŽÛïU‹Üx~è»E]ªïdaÝï•xÅqƼºoåî=gÉ‚¶ík§ ß¼Õ¿ÿÖ-óFE´«1ÞÀcdÄŘVÈh\œÆñcŒ0yåôß³wßtwWøÁQ‡‡P#&VÇiA"ÆúœûJ6¯dÝ?öôýÚ‹vÏl{¿×xzÈš,kje~·`óMìÜ¿…o|ôöŠ< ®tÇöE+ùó$aÓ¸6#³Žï˜:®2Áˆþ³ÉøœÝ¶áÆÚrvU‹a(…ßÒˆÖMoÝ„Á +ùFáÐá›7o8·²B6QW¹JŸÕÿq͉ÇÔaU;»jýÁŸæ4ép†z7nO¼]uæÖŽpÏÖ àÖÜS‘_œ¸¹TÜx<Á`(æR£Ú‹¾ÚºkõÖQF†+ÎrÜ–ŸÖàŸ¾È½ì7kÚzuÇMó&BÌ=`ëë×w¯} T­`ãn›î[ùøC.¦i¯Û¡¥Âoûcfšªé΄¸˜DpXí6sOì^´¼Çàº})²®êšª;âbšaMÆþºæìæfl~Û>GP½Á“7œX N|göö8ŒS(n0—·kËoæVsT'íßs°”6ûÊ=Š€±×ö»rãð¶w$üpDãî]ÖnÛ}f^õüHàù*]Gï~|¬³9á—%÷1 ç‡+§©è¹¦@’ž]DìE$èù~ Ÿ<%ž­Ä­g?×},´<~ž±±4Ýzi¶@Ó4u]OÊØ°: {Òa¤9w¥WÆGë6§|â“篎ò2£”1@˜ãx¦‰9#0)âxÔd ‚B5“#ÀOPÀüÿ·÷QTßÛ·ÌìÎÖB ô&]Ž("(*( ØiboAªíGEQéMzQzï¡… eë”{Ïûav7»›ª¾èž/°Ù;wîÌœçžsÏ}Åœi˜äÊ`„ˆ@ Æœi !LAÿ!×TL…àNF’gŒ`Bõw€3†ru•>7ä…o†MV5ç'Ë?z£m_"RJ)FLÔ :3×$8×k:ÂTFœiA  ŽÏüúkÆk3-Q¯×4D(!hŒšbú¥QŒ1pÆG˜P‚¦1ý,‚ \rXk*¢‰Ò¯Céè«x%sý¾ààuh !L(X«½–ë§|Ôª;Ç@3ÆÀ4¦/{¦”„ߊ€3Ž©@€1Žˆ@ÓG €sƸ>BÁñ!úrš7©ë² ui>‰_Ç¡ÖTEcH0gºl]àBÎ4D(Áˆ© ºGLÓh2SŠQd•w` Q×/›3µÝ˜o+þôÂ˜í Œ õV¿L@˜b2‹ 1 ßÄ!îñam2¾˜».+Ï3 äÑ锾ö"'F·šR¡/P|ê¼l¡ÿ2|[XHº0ô1*i"\=¦[Y©Ê=ï­…06*ʸeDÅ©1¡Bh‡"D±ÿâ°¯B‚H"¢;úì’ ùΠ¨(„}"‘Ç""ˆ¡w[_טD2Æ亡uŒ©‰9ä¢d"Hݶ|‹`1ÕßL(%ÓÉÜ–qôW(4š"´ûtØ×{®¼dΛĔÛŒ"„0!BØü:|4qÔ…bžÖÄüçË$rÜÃÏ«_‡˜ÿj;ØŽÅk‰ ƒӉÈìŠðc1Õû‡ƒ—B?=èÖ¨YÏÏjSÙæë¯ÏB~w!♡‘kTNQÁ†8äÅP‚ цPÕWÞ©•½pø_*ÁÎFŒ|Øejª†±Nm0Á×æ¼ý=•LB¾ÞyD¥è¯"IHÏÕO‹¸U (]0äÇÜ"q¶Cå»T¦çS„r4B•û³[äÛS7`à®øR–D$nçÙ Õa3ëÿƸ( ·~ã!t;™ÖQ¸ù¢ïQ}yQî…þHé¹á™ÙèH¸ž<]À¥,LÎ ¶€»S!¢(ï„1zVdÍF•·jWÔ`ê«›írÞ84z× x†syø^¯×b±o¥[ÂMêøWÔ#ßv¨Zî£Èü·œª\DXŒ4øüëÆeÈuš+Ës{{ý.· ŒÝ 4Ù£p¸óvîÀJi®ÌÛÙãÖ ÿAM-úì„–µãøM7šh!@¹=ŽÉ}¯ÊnGb¼€5}.ª÷qKË?¡Æõãt‰n¾{”Ò`òu€(¥79'¼©< Ð !”ø³Ñ˜¢ì æõ+Z¨*2-Ríëé­°Ì©1ß›¢©þÌ+ÙšÆ ‡^OÇ!Ãb[~ üM,ªÏ'û|>¯ŸF%RS\óË ¦\+Ò÷Ç…/y<~Æ!Ðd¿ÏãÍG{¡ØÊ5bÅçñi0¿W¨9x}Àµk´þŸÊ,âÊQTŽpUñy¼~¿ªÿæzÍ"¿+û½Õ‹jä\"¨²ÏãõthªOÖd¯ÏçS¦È^OUüãSdŸÇ+Ë ¤¸¯U}ñÛŽ…QŽG¹‹oWd¿¬ø<^%°€Š_Ö/Gcœù½ÁÞ‚–…«ü¥Í3egÉ ÏÇhÈ~]gq5جÊ€ìºö ëù¯z¼ùLü™¦\Þ4ïxºW·Ä²_V|>ŸO(Èä)+†Cᮂ«HäÞ2„€3]«~ÆAóf%<<õÙêqÙž[I„ó ¨~ŸßëSTª"Ë^¯×ãÕ šÏË8 `>¯¢wÉ'kú“ ˆ3Åçóy|ú“ û<Ù™Y>¿.ùs3!/&µwGÑ Œ)¥ú¾«rMD IX42ܹ ”Šê-×¼nb*\¹bF˜3Íçñú|¹Ê,úGÄü.\÷ó·ºTÉvË€¸æ¹”6燣HÀæóù}~Ù/kr_º@;Z¦Ð`'ü@Ü9ª!YVþ\ø›/ÐMÐd¿*û•„½*3¬°Ûd)Å#Ø{xâ¶M;NÍ«ijê®øöOÓ‡?à¨ÿÁÁCý+µ¸×} E5§ÂmÏÌY¶Ë{üço^Íç¥þÐdzöälïRÅá’ý~n–rŸœ8þÜæØ2Oî»4Ó‚mòŸ1°< Råùá[½Ç—/{'V`·vûné.ïñߌJ+`B¡ï/}¼Q¥/å‹{ö<Dz¼UNÙæ:¾åðÌJV b;¼ºaæ£ßŸ>°eË8ÂHûOæìÉZÿêçkžlQLeb³¿Ýá=þíħ(°þ ÖÍ{ÿ‡‡ö8ÿ…èQîμ êà)+~»>óȇ½îÓ80/³xú“3VìöíZ›JÅ/¼tä¯s*Ù¸7¶ã®ŒyÔZ§œ™4¬Jx€ƒÔyú¯»½Ç§ŒhK1¯üöÿVγ.óÈ°ê©Ä>õä¡—©6Ñ•¾÷p_pG($âî0n˦m“j—w EfΟ0nÏþíû?/"äÏÇáÒ;¹Éͱ°b}yý€Z/~¼ÝslÉ/¯8¸b¯Ø|éÈ>—«Êk¿7+mz|â¢E³Z¼¶aÓ‘+³l²v³²Cñ`•Âpç)Ø%P˜ó•ß7ì•Ó¾ÿ¬›ÆA#%Gnߵ߿»sÝ"²wþóx“²TK¨·+í]³¢X«¶Úô]—ñ{÷îH›ç4a\¼áŒã‡öùv>Ý¢8Z÷õñ»ÔÓ¿þÔO`²~Š[¢«»’Í×kÌÃ[€GÓÜBšÆôÕ;ÎyÔrp5¾N÷-žÿ{«¹Ê€kþì:OÚŸ{'§XTÀ´åG_í‘Ó6옚(xš½=ûÏU»Íœ${IaŠ}úïËüsôÇ ‘Ê™ŠÛ­;øÕÂov¹ww«áPüJÕAS·åÛ´ÿËTIõ~êà•Yh¸U=;òµ @¥9‡Ž.Xô†BÀ¸õ©YK¨ç>}§)ÆPeä7‹f¼¿É}|ä uføZn7â'˜Ôïo]ï¡£V¾gª\¶Ûðîê´~®umû¸j¥qÛŽ­á¬ºf_¶£vÛþž¬I“Ÿëçü&Û™ßG7ªÔçÅÅŸ”½ºbúš²e¤˜–UûkDÎÉj}örÖªÆÖä¿8b*ܸoñÍupñ®ƒ½½;Wª¶XzfMšüÜ ¢žcª]}6©âw+¶÷¶¯Ys&qZNÏÕÈZúþ'ÖN™ÿå4n¯[ýµJÕ[·J“ZÖó«Á‰~/=?®G98hüI£Z÷×xÁåã#¾ôm›†õ‹>¸zvlj»Þ|N5\ä•é–^ÍÊxd}+Ó‰«êÝ-èÅ® ðØ ë„öóðÜÌÃÈüZ©a?>ß­Lµ]4&Cê»/%·”Š×m¿~àÿzƒ”ðaû“µp±¶í>ÎÛÚ±Ýë·øqÆ3*ŵÏ``9:¾f…îJpVŒùñ£ºåz½4ñ ‰¡Só>nh+Ó¤Û¶Ió:Û.Í©Y´Çå¬U Í¥ßÿâ(fþ§+$O^ªWçee;ôêzjhøÔÃÕÞ®iÃL£þk«›8«êÒ-VVASn¥4—ëŒ ©§ög®#‰HŽk+$ÞyBÍL?ˆ*¦%;¦ÎèÕ¬p‹öÕ¾{s)£‚Y2aLÍI ÌR¾M‰Ž¯þ¸}ÙÄ1õ¸WóÚºÀÛã›U3{u,-±(™ŠE‹$™¦áZ=?øiçÒo§õÔb‹SX Ùk~ÊÔÍç1§4Þ½þ€Ê]kœÁHKJ©[ìùqóv,ë÷T)‹ ¢I‰`–$I¼‹ D$gÿØ%ZèÉ‹¬~)ó“;6¤É"Q<¤hÍø´´ ¾kv_,q¿Ý„Í’ cb¶H&1Z¥¾PÉrëÙ«aÿ5{ª7ÅçÖì,4í¼Ü ÍfÑ"™ÍB~}0›²XîG¯SƱ«’Í×7š&“Éds ã¿áœE¹€8.rߥÝ{ÜÀ,\žX¦ ã!@8p³¨h2›5›nilõ„·¨¿„ dmü}¥}à×K¿êÒ¢4ÂBÝÿæugÁ—qD+Q!Žaýì¡Ë&Ø»vîYŪ—1g¢|hÝIWÝW.]ImQüé÷ço_5æ½j8BHßüªkÈþCU~g ‰Žë¾QÞYá.f8P¾ t…«”V÷e¸µë÷#“ä–U7ÿnÛÒ¹?t¾v4‡ù®}³»êÜ?¾ûr}Lf¥¢I²˜1ƈ’ÚL˜òó§®RæS‰C÷=7ø§K¾™ÒÅÇ€Mfcj–$Q #Ñ, úCĵ¤R¥×.ØŸãõÜr¬V1 _ÚqÈdR]ªd#G(¥~ VÉa"ÄZ:AKW5$¹·?ÓöµñÇÚ_³ÅŸ. s=U0U/ŽêÐ |êËK~Ý93úÃqINt\,!f\v ׎®-?áyzâÊ€“"6cAúÁT>·+ãç¥Ý†o´˜B؊ИGŸÚgÑ’øÙ®ä]„L0 ª½Ö«=Å>•—köücZlp½Do–(ç'7ŒQUR¼NÚOs®œLÿ|ò«¿f‰ÆÁ˜#‚ïò«Â5T´vI4wo‘B¶]—FX0ã×wõ"+j•0µIðò«›QPV7"å â¾z©rª­¿è(“|f›Š8*Z§ž³+1ÁqèC#@ºâEÕ0Â7Zò ' ŸãëvR×0 eýaDØÕ ÅÊbÀæòÕÝ×v#Ž«v–°¶¢qÈíÞÍd êzÞ‘ª ˆ¢›lQ>õa«GŸ ^=Ëòc¯³9¶2%Dt„&™=r V&”Ñ*…n¦‚~rŒÝ~G‰D¤fA˜úÒ÷]üzj)‡%!ŒÍ4ÚÅùScà\Ÿè*J' ~¸“4KÈ:›)$R‚ÌEã(¿ÀÒwŸÿ3¶[ÇQ&`£o_êù­ª5œñW½Ô?Ö컆Œ ˆì Áú“€1÷½ô4êS­«\»÷ªñfÆ׋©`½·áO͹vµJª6j1%KœºÊ1c‹¯»ÀR² únfRQǼ^Ïø8¶8¬ÈŸÙãÑŸþuôcM‡à³‹¯¦Ìž:¿þ´7¢ÕÆOè/¢÷ÈâœèW‰á¡#[ )º÷í7©fâºðEZË.i11¢Yû=Xmâ²ÖN{{Öo¿¯)9qþÆ~š¦üð曫³KL˜¿gnŸ qHÅ@QbúÍÿ_jÅãÚ}Vuý’ÃÖÙlf@¢M2Ñ›ää¼ÆQÏú 戞³q {náæ¢9óÇ·ÉÞ„Cg|9ï¯ìÇ Î4Ž3výòÈ‚ Mo~õ‰q~æ«®—)C÷B!åo¥k­¶“ÆõäDÌÜ:×'ÀÔÞã¦ÏYñ€G;1~è “”5|Æô3šÌ!±0¦¢Ó&è)Däc‡o›²k‘߯®÷ÁœUóv˜<¿›™kÞ©Ï÷ßpÊEó!ˆ¿9⇠K£Ï'•ü:ŽÔÍCÒösⳟ&g™RMÒqÉ·ñËMÌßü³ªÂ晣§Í;5|ÎÄNBÕµo¤¹0ü‡ç×™0ò›'w¿ùô2/¼ñò£LÕ­SW7žÖ¹¯à0‹!Dì1³kÏkâFÎúü¢§ˆÉ¾!D³ö-™ ’Íj¡•Þú¢ïÑ7ºÏ¼f4‹@S\9^N¥Ø)jx<™ÙÂ3"Øìv³Ç£Øí(n,’ùÆåe ØÄ9EÆHQT&{Ua“Ùn—0_N¶Ì(!š(ÙE‚˜ìõ{UçÄ·9–R lŸbªÛåå€LV›Å, àÞ—Ê‘d·›E \ue{ˆ 2Fœ±¤©.;mBÈÉõäx4@’Ýa±æ÷y| ÂÔæ´ ä?;»çšìvù©@2;&Pe·ÛˆH6›IÄ>—[eœš,6›#À½Ù.?@ŒÓ~ŸGÑtÍg¡BØ V§‰òœÅb7qŸÛíÓÄàK‡õwYÖD‹ÓbW¶[ßÉ-ZíV3•Ýn¿â¤ÂI`>·Lm63öº<’ÃF Klàv|)@Ôd¶8œN1À%‡!„°àˆ hRHgÐ. öؘë¡ÉZÖ—½æ·ÏüUÿ·]w04”¢Õ” £f‹Ó"Kb‰)píÇìŒ7z+ÙœRøY%gè¬X¸puÇ1»¦¼Ùo· Q*Zm1a¢w˜Ž¸Ø»È¡‚É,9ãb‚V‡( !„‰èˆ‹‰Œ¯Úc¬×@›Ãd  6JzÄ‚ÉŸoub‹‹C0æú¶ÙÌ!l²K7DÒ·Å仳5¸ßHEQŒ­‡¨(Š¦ªcÁbþÂSbcÍ¢,ß6„"~¹RuTt„?o˜Xcbr“‰è ¿›‚è"\p[ر‚d‘¬ÿù÷œfg\îR#>ZÎÈ'Ö§€sN$K¬Fžk‚3!@œ1UU©Ù#EÜØл θØÀnb„B&›Ãl§œ #Áj×ïIøKaÀÀ­ùRâñ V ¹ËqPÜ&J³ð]$(>ŸÆ€š$³™þ3f&ûUb¾« ·Ól¸öç\_X ¥>ëåŽBL gµ…§–°SJßÙªC.WÞű»XÍÖÀ?ö¾ä+ .uQ€ÎEøT&JåÖО0pW})„³È5#„‘´J!X¯€qÆy¨|a®²*½A™5A’€¦1]«4ì@]–…”L3À„̨jªLÓ(FšÆ¨(€.ŠP@°8c, *Š€š%3%Àç@PÈøb"PÄPbÄ4 SA—Y ÈŠÂmWj–gt Ø»f£©Y¢·frXxÚ Sò€pZÕoÐëÉ IDATn@-Á LcÎY0?EY·¿'S¸Æ8¦Í¦®iÔüÍsd@ˆ–æàÓ5ˆ„5«Ó<(`×oöž'δÀë÷ª£ÞåˆüŒ"ÅúÛVwôÑÌÓ,pÆ‚1MUs+œÞëcÄ5¨Gz;lr¦''OfEg…Ð,@ ¤2¥”„‚zÐaZ̹hœ F\c@µàîCBŠu•pL(¡˜D qMCÑ2•QAÀt³ÉU5‚¸Ýk¿ÕçíÖ#×ûBó(/Ý».}Ǧ¬}++ªfë=cÞÆô¿¦{„Ê*.ßsÈ™»¾x¯!ÑWµß[zfÏ/?½EqAÙršLÿÃçv.üí½¦W+<:hõ¥]‹– )Fü€I«&o¸º{öŒ>6ðÖíóñµDUöT}nÌ”—S45w #1ãölèóHIÆNÚûCžU{øŠué;Ö¥ï\uðç“šØð‰Åv.˜ûŠÝï1•è4©¯¬X}ôF×jÖZ-?ù×úô›26u*!výjÖKåe`ê€9ß6|õ¿^¼9}ûºôÛ²æ—fÞÛ¿Oš¿\—mKÚ4øÿõ†‚æó:_»8¨*Ó• ¦[ÊÀÖ‹©šªz]ÕŸf¡<¨ÝŠßÛÝ:T™´ù|îæÌm=Z@4ñ³[×ìšV$¯žð¤–Ï­º¶wÖø‡‰¬æy8I«O~Ø’õçs•„@ùMÀDœ¶d¨Ýëç8aÜ_[Öìùª¨ˆø¿k½¸©pµÙ'w.Yñ¡MQò¨¸àò½†nÈÙû¿÷-ÚuV|B÷ïoºôG«j±€"¶vaàb|åïŽïXºz¨=Ø,˜Úý^]*ˆ)Ý?Xsmçø…š½gý(ð%>6iö‹ø¶s}K5ÿfƃ$êð%tœ:ïÕ|›•IÒ뿯ÚpiÛ 'ª©TÙ:hÉêµÇTM4óÈ­ý^óý‹ÎýT„€ÏÙæËßÞÅ Œ\µe]úŽué;¾ù ½G¡M†L_mç¨A W3uP•kþg'ÏljUj~1wsúöué;þÌú­”æœxtY)«¦Ú«ürtªÃÍúþ¹o]úŽué»g/t×òœÛÊ4šwzÇÂùýÌþ» “p}ŸDržL­×$á¾É‡E,ØŽÍ÷Hõ‡V–}oÈ+儘ò{ãÇ“šìºrË1özÏê™ñtùZ=û~ 7ˆãƒßêR£ùà f7WäRïP«s‰:}¯ÏÖíøÁÛCGt¡ M.Ѹã›ãÞïѵ:ø öËýyåå7>ìÏ•¿ÇÙ¦-^Ô¶~É–}^éت8Æù˯…¶ŒêA?Æ¿¹Zuàغ¾; qíä'ÞP§blèZ0Æcø{ln©'ßø ä‚–%Ÿh0ô³x!i¡©¸ÝO+}еûÛ;Î «ZäÔ5nôˆf}J7˜—ðáÀnÉd¼xçþCS~kY¼s­¾( !®ŠU_Êø}ée,µýieÚðnOܼ`A¢hÿ"’R}´Ç3¾nßêÍ… óf´Àê&\Œ©0åyòhB£ÝLmU#Rò êàé®~ÞªZ¿W§¾/ù„±¢(ú¢úH÷¿ûîÑ6¯Íµ-˜Õ ë 1<ªü ëE{ò„¥®EØVRÛûây@±݃:À™X¬Å{#+_»õ[Ÿ ®žbδØʽ‡½7ðݧcE”Ø´}÷Nmú~¯qåøè\c` •|aÄàÇLe˜"6®×Ão¼ùÚkí$ÙK“š¿7²KJõ–o2¤V»^×: ü¡#ênè×´Xë2¯ +«* ¦ýVlÙë´›0aNÁ©#ƒEb¯úQ÷Â*79cmá$çág“v¨Üü•qK‹Ý×þãš[:kyªù'õ‹Z»Ó* °8"1¾èª÷ëP¹yëÒOÇvgB,Å°“àÄ€b ý‰*Í;TyàÅn“ Ê9L(ótÛz݆ ~î©ÚxlÝ–×±pM©ÿX—L;?ß¹×û¯Ö®ÓnÀk­%â-S¼âK3FŽmÜlø®z3>­ï8‡³ È²Jã:¶cÙêáI&Náò¦å;³³²O^ÈQeŸT¼IÚìß¼1æÅŸ®¾¯B‘ µ«mÜXlÖám£ÞiQAª­„jgw±8ãRËÅí_œ¢ó{N°Š)¥jßgÞ¿~?÷œƒ)Í9aNiˆÃöøøøÄ„ØX•j[èÌ–c×|[¦Ì‹¯Û"ÏÌÀŸ˜ŸGó!€—˜Ÿh»íW cºfòèÉßî[øþà×|§‰*¼4yT£Y#ÆŸM±3^ýù>ÅüôÙ"X¸ø ÊØ‚vŒiŒE;9cLcüFóy"²‹6ÖîX6Þslí¶Œ@¸U"å߀ç GrÎC%[ ö¥BûW/=Ù [UË¡ÕÒ\ùÿæ.ó¯V·AêŠQ¿ÄØ/oÜ M9»‡L,òT yÛA|h«ëg’L,ŒV9Oh"ì^wÁ»|ôÂrõë‡ó€V»^å•#8W6lUš$G ±˜—¾ë±à×í¢TøéVê–=ÙÚñm9»3ÿ›XJ±Vl]î·õäâB›î~ÕL*ÑøĬ_}±æßÇ®º¯R •GH¶k•´|ÊÚBBÚ~¹BÝX„2-UKêC•.í˶œ]¶ ·~ÖJ€YŠ5Húõóõ×L¦bMÎÍ]䎑]Y«ri½YÎïÅ]R˜Põܲw_[pþÈšÁ/¼µãˆ‹[JÍ=2ãÒ¯Óç-?›(ѸûZ>Û·Ò¸WÆ<1~d¼¢D”»ô›z®Z|yÁOÉX¦Šë'Ï>ÇÕi¸Øùåï˜wñäºÁ/¼ùçÁŒ¸FÊ®¼² °ßÞ¸›V¯S2¥=·÷vtm+­]tÄî=x¶L›Š¶¨W\Ú³¼ÿq’ o[¤p|b‚YЊVm¶vüo™¾Œ5³¶µ­êÔòX³3>>1!¾°ç1h@„¸Â ñ…œÎ¨ ,cK¼<õ¹Å¯½¥vŸP®è¬Ñ¸C ˜Vë¡vNLÐéø>yÒø¢™Íú?‘’«¸©ŽšucŽáqûf/±µìrç!¿ë²µ‰K;7lÜðù/Õ¯¾ïD¨bñæC ÍýÕ)ÁŸ™Eú~9Æá¹j³PÑ^ªŠiÁ£eë¬&]Ú$^0y¡Tjj…r…®]ö"Äd+W5%¥¸ƒ#ŠƶÂå«¥–.lÂ3&¶è]LNªUÁªæÛÎì¯ø_óÀK‡I± åS«UJ.‹m±\õcŒÀŸDK^¢±¥*V¯˜Z5EÊom"±L…ÔªSSÉLüLV›EÌv»ÃaA×Ò{Ũ‘²rVM™ŸIDîó­Üwͳk]Z­ž RAgá*¯3cõÚ3;¦¨Š4·öØòÝ+ÓþêÓ1©àÞÇvéê'#öÿ¾d_|’åz9¡Ün¬+˜Fýô];„à›b 6÷ö ®ýùÏGŒéŸ‰Î˜%“Ë”káõ°8{„¹À‡ zª¾?½G §[)AÌÇþxÂŒív«@ìñ™Yø¥éãb|WmVAoÕï¿WLj˜ì3Lv§]¤(¦R¢¿üeó¥s;ÖÉQ©d:úå×&›ëq±}™`qÕ-µ{Í®‹Ëg- FÉv­¸l>ñí7´þ£ˆ˜ì‰P“Ýi‚¦p¶{í¯™Í!Ì™”X:¹ZÅ›@ ±b¿µI‰Öò(‚]Šî  § ù$¶aý"©*±¥T«˜Z­b¼C¤6G¶0Æšßk‹`"Œ_ª|…ª©+%‘¼S[ÁR¾ZjjµÊ%‹;¢Í6&×¾›zÃŽ¥éEæÈC1\ܳ÷È•k;¶î<¥%$˜#ŒXäóÖ5«mªÐ»PôR¸þLÜW³‘œÚwÊòzY‚¸©\Û SÛõl3@6‰âå£eÛŠ}šuNí»üü•9óù+Gɪ|ùìµÊN ¯o߀ËîœMK—­ØmÙÿç;C×n©-oüãJm]é_uý* åÌø|öü‹Òm^ùGʾ2êËÔ3ô}øñ™y Éû6Ì\5dCKŽ®Ÿ¾gÕê•Ç\cÍv„Æ6QT†ËóœKHógc*£šÊ0!ÚÙ-Kçý)˜© PÆ9Ö4ÎUn&ôȦË—å DÄ;Èž,óµïünn2‹T aJ0âÄd£ZÁNÈΗ;<$ ®©€µ ¿ul¸„"MQ "Œ åœ2Gì˺äÓ( .Èê’ úê·žIq½”ô?^c¤¦Ÿõg/›äË8Çø?²–ÐËW\÷ÇŸhÝzË ß:¼È0"(¨Q‹üY§•„³Ÿ÷|‘Õß7àT–LÀóKcËÜ7¥u£øG¿ó\]DõtB€sDHÆ•ì–‰gÚ¶ú¤ïüŽ‡.1P”¶Ý:¼×ï.PäÏ>¥$œŸôüsrí=¯žÎô¼!þCι«bâ–> ~-Ý£§ç¤Êôõ6‚8 B”‹G’4õiþXÅ—W¤_ú‰„0Áº³~.‹É\þÀÃlúþçŽgè2'#à“žAÿ|¹Î¯ÅŸêþÁI…!œÚîÝJ‹:œöhê¥#¥5÷nÖ)å¥Å2Ò{žÖ1"(Xd„kš)ÖãG„"Ž­ñ&Î4“Ùœ)Ô LU1 O-¨Œ9&¤!]ïxPÈ#Ð2Î]å!Ð:÷jùkæ«O É®î”ä9év†Ïš‘°üL÷ó9‰Qv@Hÿæí¾Ÿ¼#+B»²~ÁÒ«’„±–ráTù’¢âWÌIeïV8ÖTÎ’@„¦m[¹|A&B„áb*"LcŒsÀræªùKñLÆfSÿ—Ûµø‚yÁ'2)hŠâW4M× B\U¿Âù‘0¥ìê1?G˜8ç”R¢kÕ…sÍp1<—Ó8üCõ[1¦ëç­¬=éË6O¾Ù®äÑÍn#^öñ7¶í}EÔ˜Ÿ?øâ;½ž~·ßñ£3@dšØsçþ]Ë3„ÏæÃEôÔC㿼ÿy«)FªšôóÕ•Å5!aó•5&~õ`×AV8µ)‡ª±>”zf³‹PŒD¸òùÐ}/¼ßçÉ·¤}‰‹ÿ"_JâÇfüàý¥vo|úì_C?õV|Ò;§÷?X)†#ê»°–?ù^ï.]ÇNùcGš€Ûªlº:#ÖëGýðÅêÖ¿hÞó½²iKv©B¼î°¯Výþ8EHâ'¿üÖ5è•ÇöÚ1dœ±/v\ðÔH/"°ry¿ãë}ºv7¶üÚmÇ‚ÕŠîYýs~å0.^»tébIÈ>°}Så‘ž»¿aç®ÕãD&{S^y_“N&Ÿ_tNŸ.‹®½_¯-Ö Vñæ!H®õáó^œÜ/ý—oBüêQ^´v™2Å­àœ”Yryna¿Œ0ýsۉǧ~x_«'¬+oLW¦~´åñÑï¶yñM6ïËcLÊ;íÄê©Œ²)…5!„ !”J11Ýñ{ÊØqíÛ?þö›I »wo;Úô“÷´}²yÅÌÝn/U«IӶ͛·kT˜\øu~ò¹v¿ü[óS£ÈÛ¸mó¦m[4¨Ÿšw9·pÂvŸJêúxBrËf- ¡Üâ5Ñæc$±ýó7żջÕà ]¶ŽÆîøŽ_w¿šT>9ÖBå¬Ë§N]jO©ZRÀ#ìÎ8›~ÁeŠ/Z¦T¬÷Âés—¼½Xéâ‰6×…Óç/{ °Vhbré8»‰y³N;¯adŽM*]:ž{³OOW;‹–*šhW²/Ÿ>uY*TÂî»pÙ ¢½P™õXZå#R<µÔµ£'ej+[!éÜc´hyrí´[Ö7µÄ–­˜2rÁ¨iMÚ¬:‹l…‹—(#g^8sæ¶Æ”-[ŒRŒ0Ê:vô‚)W6ÞF®¤¥]q©öRÉ%bL#LØ™}G|ü¶÷Å"¦R©É6â>¼ïGÜšX²d1§’yñØáœÞ»¶êÛ-[VOJóù;Í;`̨^•ã«îÞ3ËÝà(Q¶xaóåã'®y4 Æ$”* 'Ž_EЕÊ[‘÷Ä¡3ºôl\Jyzåô•lc ¶øärIÊ•s§ÎfcŒ9JW*qáÐ)a`/^¶D¢9ãĉ«.öðË*Nï8n?¸Yˆ¯XÞ†}'ÖþeƒˆHe*•¥þÌG/%ÀqbÅr¾S'Ü2GÌñEË”Žóœ?uî’#„ˆT6µÐéƒç&À!¾l¹"1äÜÑn™c)±x‹ûôél„"æÒ•’9ëÄ‘ó~^bÆÊ7^j5‹D*‹±E*”/h60`^Î-÷äØpS29©téÄÑ,·†Ì1ÉåŠ à=uøtùw'ö==æ³½ö¬Ó'3²•Hi@‚­ljIÍëpö‘}ÊÇk'M8ÆsN9ÇŽœ%“‹’.Ÿ<–éR6•®X$ýà!©\™XÍ:súb¦qT¤Bù8I;u(Mæ‘«ÇÄ^ª´ýlÚ%©H‰¢VùTZFñrÅ.;§a}¨‘-©d‰ú§.÷põ¾9 )œ\¶S¸v:ír–b+Qºdœa„ ?·ïÙËT,eâþ3GÒ|I¬TQ×Eм9'O¤çº„Äl+ËO]ðXËÒœsn%–/'xܸrîBRÙBéç•R…ä PÄžuúŠ/|T‹Ö2©¥±ûʉ—ÑïC¸…Šòÿ>[@K×(åÞ›víf—ñÝ9î(y'›®¸qwW³½ôåûַªqôÚßž¥qŒixEv7a×qÕ•ŽnØ£Š¢17ó˜£\Å¢YGŽ^ÕŸ2}>ÄJCšîšæ¥ôßfd€Wûèë¾ûû¿ð“÷o€ì±}úçÔ÷š>ôŸ~Ù¸,ÇÖlä;²Cáè?öžÿ—YêV‘™}P;ͶŒPV—’ÿ¢MVˆÉDþÉmÎ9ç¼`¥þFʹ¾[ü_ª=Á5•aA¼©µ5PM0‰Æ|ð.âo[îÍq)Œ8ãrV¶Ì5.Æt/ÙI¿_•¤ˆi2Fèò…KmË7ÁAƒ>`ø›O65"ë'ý­Ð4íŸ)ègÀ@þ;ÆŠ¢„Ëšü»@ñ¦MM†óý¯`)’Péçcø¥]¯·òàÏß>Ó±Á·UªþpÉrKA'`ÌTªz‹*j­\}#W®®”¾û¼F je·ªžìLߺæ¯.*ØîïÔÊæ>½rÑN~ƒih~ÿkÛŽùx©#Þ©ƒE³)ävPþû ’$á_•‘öÿᥤ"Ê Þó/Jy÷¬Ö{tË”{z–eÒ%„êÙÉ¢g’è«$ð1ðc]D ‚*Õ¦õíöÐGWÍxvïWgÿºGãp5Bˆ„µƒ @8°/¢·Œ‘9µÕ’yOì[8/«R·ÁØ4Î’[õ¬oÆgÖöŸö^Ó‡O."1Ÿ¿Þ˜ß §¥¶oÍì_ X®ç·r"[·ï?3|Âæ=“l6\ŒÿËPUUÕ´P\”s®iš¾9œBŠ¢(Š¢›¯<‡ßïWƒP5t”ªª=ÒaPÂà÷û¯w:ýÀ¼~°.¬ªª®¢ƒ1¦(Š. WðU‡úºØÛ:éõz›wôž‡ V¸ÏÛƒ ÜKÆK¿0ø•~O>3ôã©oUñfÂK{w¿ÞçÁ§þ÷å'= «>ëøc›{tjÚé²gï·`“ã“ÅÓzõîúÖ¼… RQñŽÔš¤Z+7lÙ¡®…G$ssE©1hêûôxfô„)Ãêjiìo_0…Cã/&m •ñÓkÆ>òX›g:UhýÔ£O7|§Â‹=R 7îW»\Íú5*'TlÞ´eËÊ Y_ÿ¬ÆÚõò+ovMÛE1•ëýžòýºYÃf”zý áL:~ýuÃrN˜âÊÌr¹ý@–Õ„û;t?óö¤þ/´i1ÄÏþã71f<çùÌëu³Žó(ê‰Ná®Ixíàëŵ‚ÞLt¹]BHTÝwAòž.¸·šäí¹N®ºÒÖþÝW›\Þ¿÷jûlߢNå8]-ø?OT¢ }„b!Æ8Ì• ¯U‘·¼V!µ°˜aþ¿ÍåK!7tƒôoõª%!DQ”®=túÿ VnÌopÞ^åý6ïµ&·Üå Y?Ü·öRß³VŸÓ *Fˆ3F°ÁBªO£ÆÀÆb|±çlYuÂD6nàÜ"bßù3çr°;3Ÿw#b¢jO³m]¹Þø©2 dÍø>$MJÁ“žA"&«^s©Zm[tépF¶V8¢M®z¶æ‡5™ImýSL_ûÇ_/6ýÝúÀof« &uÑË/#„¼»¾îÙp:±HÙÄeiéC=öìýÂ#UúO,5ªëÏiò¸H«|ÍnTy¤På$ýï!Wà¶SNòµûºä|Qá°‚ñŒ±¨‚L×ëynAÈ Œ}x5zªíåK“yP1ŽRûõ.6ª…{º„{Ô—B‚¥|¢{ó»b*ÝoµøªÑ}à—VoõJ¶¡˜ä:•KÆqŒÝiGŽî;|þ² yg^_t µê%"@4cÛªK [×.Œ-ÅZ>ÝÜ.ÅRÄæv=Ð5•+,’?/gº‹ú6Œ¬Ú{øè ¯ÅKa¬z}UËI—3×÷‹|-«c/U­²¼óÜåãó¶jQ=á¾n´ÓÜ kŠØ~â¤zÉN@˜énS.;«0n/‘r_²å¤ïÛy¦X ýo{#ÁÈœ(À?@‹¢¨ÛY“ÉdË·Zñmûp¦ D½Î±Q\䆹š¦á`K,Di2™Ìf³ÉdŠb>=„Õ~Þmszx3*² ÷…ž÷ÛpòËÛl^Ÿþ^Öž0ð/`)gôm9ñ͵›ßèìؾ% |iÿ~#ìÏ8p ~êðiŒÊIK;ëV¯îé5ìÐKýßØÎ\•1z~B«9WŽ^ nÒÆdÉ{£Ô?.˜ûˆ »§¶}¸ÊÛãç,UV»€$ôõ¸ÕßXTdÇŽãçÝ!ùÌá3ÂXðæåû>z2aDç'û=Òµjãe‚Ízxñ´„Á3×mzÇ$«›Ÿku¾á[Ó§?Û¯ñWŒeQN5‡MéWëx§WÿD” „ÌN§(`]< C!aÅ-‡Nyjè'Ï–Ù4yW4)ƒ¯Â|}i'äs-)QoÒc )‡ñ2ÞÆX–å|CŽ(TA@w¼ô¥¬Ñ ¢Úÿ6Äa¡fƒs},cÿƒ»ðŽ†ïꕬRÄ$\Ÿ"tQ(òÔ‰ÉoÞQ3Vˆlå÷1ô)0UäP¬MŸÏ'½XB;òpõg®iaáÃÈi^žO¹§¼Nß OïæS&­¥Üø~NföÚsu¨Ò"4›î;tИׇÛ¶ï ÖWߊDÈ{®Ó QÊ¿PdÞ5ª|󣈌1³Ù~"½ñ(^ ”ÀëLèáÔ£‘ iZh-bZ†Ðz› »…Ö½P¨ðnè"i~­åÛ·ë]5Ƙ1NÚ¿¹ƒ‚Ïç•$£¢¼[ƒP“Š2‡Â8VíÁ\IDATâã #*y?_ç,y?a‚Ï/›Ú±øxŽˆÕ&éÙS×;Gžìºá½©ÓV›,Ѷ›3ž“™zëdŸßxDþ›1BôÕ¢0†3"€;lÿ†³ýìáVþf<6Ì÷ò©H¿dýÏ„Ðܨ BˆsLoyw`ÔbPªlþƒ`xVîE_O-ö¿e/·>wŽ°,”"„ÖÛžû tüàOŒ§ä¿J©Ê ÚYŒ1‚ 0ÆôD†[âª|9&¯÷BB¼¨»Jú2Õ W§t'é&ûv½Œ;ýp½B¼/¹U%â¨ug B1R},Ü7Tº üYꟄÝi¤z«¨?ZlÖõEÙ׳°¢((ŠBˆîKåÆ PXöîWÝ-AÝjçõ·Bõ·*G„öcéìࡾ‰·"­«ÔÛדP‚«¹©†Áó"I2´' Üzd‚¨ fŒ1ùO"”ч1ÕƒTQ)!—…ÝÕ=>¡0ŽZ ½Nòú]áã(¿'ßè{¾ r·Ô¾Y’ÂØBh(ñ0|)¤iȨ>‘/a „(%:]!„dY&„ „£r ˆÚ`¸óý{ˆ¢rY!˜«‹Ñ›X ›of¦i! Ïú ÿ½.bÊi uéæƒ~zVNøY lÔ^´PÅ<¯YŒä KÈcŽ1ˆ¶°áâu:E€ž¦ÛßQåµÝ×} áNX¾?ŽJ¶ äã¢dP°STô²Ëס^õǨ|Ó+t=Ž›_îbŒa(>£WÊηÍ[ $0#¢e°ÔÿÉç>lƒj(o»`Šr#òç\ã› …[ö|·ÜpŽ¼¡¼¼'Õûåô¼ýöfaI†ñhÞ6 ¶2`°”|Ì¥Æ0äcgý¥›¡–(¾¨ë*Sk2™îú†ÖÜ´„ BÊë!DmÏÒ»ž¿ÿ¥…}—÷Òò퉢(èõ]ï¢h$£¸e?ÿgù£H QÃ#¡µ=&BÈ× eëåU '³›!Ký¤7ÿcEQô8"$°×8oœ °#*ÜYÔ/(ï }³pðÇ@o¢(mXüéjQ?eYÿc(É° ¾” QUc¢ù)è…’îr5 Â"È&ï.Ú(N }{óÉë7Ô¾Ë{:QƒtHOžUAyò÷¢(‘ëè…y87H‘zèù&q˜ÍæpwŠsг' ¢2`°”¼Ö̓hPJ ¡!㜯˜Æ ×xÊ<Bx¨åWÃ"j/ðÍkôÝ<«åíF^Ñw_aŒUU ÷óÍ!AÄVÜúµM å§1‘Wå–s£h‡Û„ñû¿`‘£½«|y+êïAÃ}SÿuÍ"„pŽ5M·ž8Š®‚†žD¦' A1ÅÙr›ìÖ· Gv•s®›rœo8ç¡è\P¬!|é+B,DTœsÆx(É[ÿ’s ”i,ꪱîq…¥x 0?"œ1ÃD¡˜¡®â>»¥TÈ÷Ö`Œ1&‚³f³1c2`°”<ŽƊ׫ „L¦cy½¡ÀÎä÷#„U4-!Ô?úý±I ìwÑiÏdÊýÕ¬þË»ÕlèãÍ4+ˈ±@³!ŸD7+ŠHÆÈãÑ› x~ni Æô–U«!h6tŸO·ø¹ÍbŒDQO`SƒÍzË6ËCúï-BÈjÅqŸ/p¿(U0Fú˜ š ýÒÂz;œ#E t!¤(H–åÐYT5@cú˜x.request-body-limit* controls how much of the HTTP request body is tracked for inspection by the http_client_body keyword, but also used to limit file inspection. A value of 0 means unlimited. *libhtp.default-config.response-body-limit* / *libhtp.server-config..response-body-limit* is like the request body limit, only it applies to the HTTP response body. Output ~~~~~~ For file extraction two separate output modules were created: "file-log" and "file-store". They need to be enabled in the :doc:`../configuration/suricata-yaml`. For "file-store", the "files" drop dir must be configured. :: - file-store: enabled: yes # set to yes to enable log-dir: files # directory to store the files force-magic: no # force logging magic on all stored files force-md5: no # force logging of md5 checksums stream-depth: 1mb # reassemble 1mb into a stream, set to no to disable waldo: file.waldo # waldo file to store the file_id across runs Each file that is stored with have a name "file.". The id will be reset and files will be overwritten unless the waldo option is used. :: - file-log: enabled: yes filename: files-json.log append: yes #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' force-magic: no # force logging magic on all logged files force-md5: no # force logging of md5 checksums Rules ~~~~~ Without rules in place no extraction will happen. The simplest rule would be: :: alert http any any -> any any (msg:"FILE store all"; filestore; sid:1; rev:1;) This will simply store all files to disk. Want to store all files with a pdf extension? :: alert http any any -> any any (msg:"FILE PDF file claimed"; fileext:"pdf"; filestore; sid:2; rev:1;) Or rather all actual pdf files? :: alert http any any -> any any (msg:"FILE pdf detected"; filemagic:"PDF document"; filestore; sid:3; rev:1;) Bundled with the Suricata download is a file with more example rules. In the archive, go to the rules/ directory and check the files.rules file. MD5 ~~~ Suricata can calculate MD5 checksums of files on the fly and log them. See :doc:`md5` for an explanation on how to enable this. .. toctree:: md5 public-sha1-md5-data-sets suricata-3.2.1/doc/userguide/file-extraction/public-sha1-md5-data-sets.rst0000644000000000000000000000020213051004444023252 00000000000000Public SHA1 MD5 data sets ========================= National Software Reference Library - http://www.nsrl.nist.gov/Downloads.htm suricata-3.2.1/doc/userguide/file-extraction/md5.rst0000644000000000000000000001214513051004444017272 00000000000000.. _md5: Storing MD5s checksums ====================== Configuration ~~~~~~~~~~~~~ In the suricata yaml: ::  - file-store:       enabled: yes       # set to yes to enable       log-dir: files    # directory to store the files       force-magic: yes   # force logging magic on all stored files       force-md5: yes     # force logging of md5 checksums       #waldo: file.waldo # waldo file to store the file_id across runs Optionally, for JSON output: :: - file-log: enabled: yes filename: files-json.log append: no Other settings affecting :doc:`file-extraction` :: stream: memcap: 64mb checksum-validation: yes # reject wrong csums inline: no # no inline mode reassembly: memcap: 32mb depth: 0 # reassemble all of a stream toserver-chunk-size: 2560 toclient-chunk-size: 2560 Make sure we have *depth: 0* so all files can be tracked fully. :: libhtp: default-config: personality: IDS # Can be specified in kb, mb, gb. Just a number indicates # it's in bytes. request-body-limit: 0 response-body-limit: 0 Make sure we have *request-body-limit: 0* and *response-body-limit: 0* Testing ~~~~~~~ For the purpose of testing we use this rule only in a file.rules (a test/example file): :: alert http any any -> any any (msg:"FILE store all"; filestore; sid:1; rev:1;) This rule above will save all the file data for files that are opened/downloaded through HTTP Start Suricata (-S option loads ONLY the specified rule file, with disregard if any other rules that are enabled in suricata.yaml): :: suricata -c /etc/suricata/suricata.yaml -S file.rules -i eth0 Meta data: :: TIME:              05/01/2012-11:09:52.425751 SRC IP:            2.23.144.170 DST IP:            192.168.1.91 PROTO:             6 SRC PORT:          80 DST PORT:          51598 HTTP URI:          /en/US/prod/collateral/routers/ps5855/prod_brochure0900aecd8019dc1f.pdf HTTP HOST:         www.cisco.com HTTP REFERER:      http://www.cisco.com/c/en/us/products/routers/3800-series-integrated-services-routers-isr/index.html FILENAME:          /en/US/prod/collateral/routers/ps5855/prod_brochure0900aecd8019dc1f.pdf MAGIC:             PDF document, version 1.6 STATE:             CLOSED MD5:               59eba188e52467adc11bf2442ee5bf57 SIZE:              9485123 and in files-json.log (or eve.json) : :: { "id": 1, "timestamp": "05\/01\/2012-11:10:27.693583", "ipver": 4, "srcip": "2.23.144.170", "dstip": "192.168.1.91", "protocol": 6, "sp": 80, "dp": 51598, "http_uri": "\/en\/US\/prod\/collateral\/routers\/ps5855\/prod_brochure0900aecd8019dc1f.pdf", "http_host": "www.cisco.com", "http_referer": "http:\/\/www.google.com\/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDAQFjAA&url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fprod%2Fcollateral%2Frouters%2Fps5855%2Fprod_brochure0900aecd8019dc1f.pdf&ei=OqyfT9eoJubi4QTyiamhAw&usg=AFQjCNGdjDBpBDfQv2r3VogSH41V6T5x9Q", "filename": "\/en\/US\/prod\/collateral\/routers\/ps5855\/prod_brochure0900aecd8019dc1f.pdf", "magic": "PDF document, version 1.6", "state": "CLOSED", "md5": "59eba188e52467adc11bf2442ee5bf57", "stored": true, "size": 9485123 } { "id": 12, "timestamp": "05\/01\/2012-11:12:57.421420", "ipver": 4, "srcip": "2.23.144.170", "dstip": "192.168.1.91", "protocol": 6, "sp": 80, "dp": 51598, "http_uri": "\/en\/US\/prod\/collateral\/routers\/ps5855\/prod_brochure0900aecd8019dc1f.pdf", "http_host": "www.cisco.com", "http_referer": "http:\/\/www.google.com\/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDAQFjAA&url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fprod%2Fcollateral%2Frouters%2Fps5855%2Fprod_brochure0900aecd8019dc1f.pdf&ei=OqyfT9eoJubi4QTyiamhAw&usg=AFQjCNGdjDBpBDfQv2r3VogSH41V6T5x9Q", "filename": "\/en\/US\/prod\/collateral\/routers\/ps5855\/prod_brochure0900aecd8019dc1f.pdf", "magic": "PDF document, version 1.6", "state": "CLOSED", "md5": "59eba188e52467adc11bf2442ee5bf57", "stored": true, "size": 9485123 } Log all MD5s without any rules ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you would like to log MD5s for everything and anything that passes through the traffic that you are inspecting with Suricata, but not log the files themselves, all you have to do is disable file-store and enable only the JSON output with forced MD5s - in suricata.yaml like so: :: - file-store: enabled: no # set to yes to enable log-dir: files # directory to store the files force-magic: yes # force logging magic on all stored files force-md5: yes # force logging of md5 checksums #waldo: file.waldo # waldo file to store the file_id across runs - file-log: enabled: yes filename: files-json.log append: no #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' force-magic: yes # force logging magic on all logged files force-md5: yes # force logging of md5 checksums suricata-3.2.1/doc/userguide/output/0000755000000000000000000000000013051004444014373 500000000000000suricata-3.2.1/doc/userguide/output/files-json/0000755000000000000000000000000013051004444016444 500000000000000suricata-3.2.1/doc/userguide/output/files-json/elk/0000755000000000000000000000000013051004444017217 500000000000000suricata-3.2.1/doc/userguide/output/files-json/elk/Logstash3.png0000644000000000000000000007135413051004444021526 00000000000000‰PNG  IHDR&øÎËUsBIT|dˆ IDATxœìÝwœ]uÿñ×¹ýNË̤’PB¨‘¡IE¥¨€(îª+¶•Uw]u-kYEåçZWÖUìâ‚i‚€TCB/! IȤL¦ÏÜ~~Ì$™Lf’;“p’×óñÈã‘Ìœvo>÷{>ç¾O æxHˆ$I’$I’$IRb;z$I’$I’$IÒîÃ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$E&±£7`çR)æÉŠT*!a'I¦Ó$bÁæ«Pèé¦PbijjÓ›&?•<½=y*@,UKM:þ²¾ŠêU(öt“¯l}ÊXºŽšÔN’g…eò==CRµÔî4ï§$IÒFa±—Þ\‰ –¢¦6³…³ƒì'#e?)I’$í› )ç{è+e˜ýê·óÎ7ɾ3›Hõ¬eé3÷sÃïþÄC+û‡•˜Áù—}·NV_ϧ>s=+Jƒýf¾ñs™ ¬½ñK|â·Ë)¾ü/jëb8ãÒosÑì­OÚrÍðï×µPÚú¤/¿Ì~\ü½Ïrr´ßv)ûÕ ;z›$I’Ö Kòÿ8ßýð!dZoá³ÿþ[–ŽÔÚOFË~R’$IŠÜNrªÒN$,Q(¦˜{áù,Ž¸ì/óéß-¢·˜dÚü·óÎ3dÿ½&Q“_Ç ßÎ5×ÜÁck‹ýïàe´ßúU¾ñâÑœÿÚÃÙz–žåqëÕWqÃãm”€J±—¾L8ò|Þsjv-ÝKã¶ß/°ˆ%IÒN(¤\ÈÁ„“¹èœi°ä~Ñú:Þsøh¯›°Ÿ´Ÿ”$I’^yìÁ‡ŠgHí<÷ìóÔ—ñäº2P¦T*’ë¸Ûì„›ÉLd¯}÷¡¶¼ñG‰‰SÉž&,SÈ•©;ôøÊ'OeÊÆ)iš1—cÏ›ËÑG\Ï—.»¶„Œ,9ël>uú<&-Ûù^›,;(’/¦Ø÷­Ÿã?ßÇO­`ù’¾ízð5xÙËžï$œr*ï8ˆ\qÓ·øÚ5ÏQœ|ÿðñ¿çˆÚƒxÛ[áoß¹ŸÕƒRç©ë¯à†…mÔr.|ý,b±Ùœ|ÄDnýà Têáï8ˆìZÈU?þ#O•fðš¿¿c'lÇ#I’´Í*ó’{ÇEÇÕÒsÿOøâ¾AÁ(ØOÚOJ’$I¯@[R)’ï룟ÂÉ’·ÎXÅÿï¾íö|‰0¬ÚãxŽnyæWW𻿭£BÈÊŸ‡ñ]ÊyS`Æ11þ¦åtu½ënã‹Ÿù Ïç_†»ènXv…r®—æSg6@i!¿¼ú–w…°îV~~Ýk8â‚©¤<–}²°º°q•§~Åå×+­æo ;8oÊ8hžAs–nr#ßêõ>û(Ë^ŽƒÈÍ–¤yÏñýMÌãã?úåæ3$š™V‡Ž?ê^µŽÜúETúèÊi €³&“`/Ýøþç^|˜Å¥S9ÔJ–$I;…J©Â¸#/䂽c,½òGüiI%=[",P¬6°Ÿ´Ÿ”$I’^l¿‡–rôõ•hxÕ|âãg1' ´?ÌO¿ùSn_–«.”¨RĆýM…r9$ ׯm 7ò­â™¥\q»n÷ðËbAbý+êdé3-¬¿•qÿk *­t”‡.eä­ bƒÞ£0Ü0eX)Q¦â=%IÒN&Å´Ã÷' ÌzÛ×ù¿· ùõ„7ð•Éï?ó®yiŒ)Á ö“ëÙOJ’$I» ƒ‰¡Â2…\‰ÚyïâÒ?‰@î©ßóµïÞÈ3ÝýBñD|„ƒ¿1ˆ%)·.§¹42‰ƒö®åº—ÖQ*ôQˆMç°y•·-§­ `ý±e*›$,Ér¦Ð´B8±D@犠úžá×ßú!Oô•(ôõQ©™ÂÌ)Ô¤K¬i­þ <ˆÇèZ¶–ÓH38dFŠûë¢/žs{YÅ’$i§O×’Ml·nqëì'·Ê~R’$Iڹ؂V ”ÒûòŽ÷‡”qÓm/œ9—ƒ‚8Éx/KžZF×ö8e,ˆ®º¿¶ŸÊkcìwá»9sÝÏøóò$óßð>ÎÚ?Ùò{ÒZ‰‘ˆõ²®¨‡æÏä´Ç®á‰ü$Ž9ÿ|fn‡ÍÙf±8 dÕg19{ç¾f/ÿþ)âÓäÍþgΊÁ‹¿áã_\I[µË â”—ÞÅã¥y’¨á¸÷½“Åÿs-O–÷áFÓËùz$I’F+(±èןç_®‰ü ¤œ+±ç{¾ÌGIBû=|ã«×òìÚm¿Z¢}ö“[e?)I’$íT &†ª”Iïu*óþß›s.þWÎvØvÞnI’¤í%¤ÔÛAkïÆ—ûŠ4çË@Ê}´·uÒ·ïd?¹õeÚOJ’$I;àbíK¬gòÞ{P»Å‰FúEŒTm©‘ÞÕXššÚô0ozH×Â+ù̧¯à¦G—²º« h_ù<÷ýî;|ìÒxaÓüŠ,¹ö{üàÏϱ¶/„r7/=ó~zÙ¯xrðAœtm-‰±üomÞ­ý¾ÒÃã¿üO>û³{xry Ò·Ž¸–o}öÛÜ°4G8Ò2F\v‰7‡/üì¾ØA‘2]-Oqãÿ^Á}=cx’$I‘ ˆgª¼½“ý$`?)I’$½Âs<äåz†$I’$I’$IÒ&¼bB’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$EÆ`B’$I’$I’$E&±£7`WÔֱǑ“™±OÍIâ”É·õÒúÜZ?ØʺîÊŽÞDíÂu1^}tœ“æÄØk|@†öu!O<[æ”yªkGo¡vAÃ>L9é&4—ºI㈓§°f)í/à¥;£´£7Q;H¬ÜËìÞ6fçzi*•H#—È°:3ŽçjƱ6ìèM”^ñì'õr²ŸÔöb?©‘ØOJ’¶·`;z#vZ±“OœÃQ¯m¦fĉò¼ô§gyàÎvòOj4b‡ŸœäS¯3iĉBü±È¥.Óf}i$±FšÏüŸ$™'ZËš«¾Íã×-¤`-í>ÂS»–qbgµ#N”dYÃL%çñ¤´ýÙOêåd?©íÅ~R#±Ÿ”$½L &FÏ2û‚y}PªªÉó?Ë­¿^EwùeÞ®*±Nkæ¨x‘_/oeAÛU—®áŒqöO'™ƒ®Bû:º¸¹·Da”ëH%2¼¶¹ŽùÙ5å2Ïötñ›ö«U[OóÓ™ØÞÊe%v«soâ1ÎxGŠOÍ«®kk[Xà¿(óÒ®¯¦lgË2'§>i+xª»‡» tne$©¦¾‚x†žÑÈìa—Pæºk¹¥Z_ƒ%¦0íC—rðQUM^xàÛÜÿ½?ÓÅ@bZó2d›âÄb!¥Ž"}ÏuÓñl‘ò–h«œ7Èf˜|î8ÒÃ.¤LÛZéì êÒ4UGíÔñb™Ü¢nZÉQô™ 2i&œ3ŽäãëXùx‰]~瘳îyNè«î?;—݃뚛èÚI&Dz«f^ÇEj7ì'«›7`RMg6dØ;§.iÍ帻½‹;òÖïü¼nÅnØO®·Åú âÌ­¯ã”Ú3’ýëè*y¬»››» ´ ¬ÃúÄ~Ò~r$»Q?9iÜ>ݸ•›Š”{¹lE'-qÇIÚâ&Mù½; Îø×ÎãÄ#G>Wd¨Ä¤ñL·±xQÍ{£€T<ÁôT‚¦DœÆ­þ‰‘ +ôŽ©‹ H&Òœ6¡‰“SPáñÎ>–mqYuÙ.™\Ç~É85A¤ã ö®Í²o˜çÁA‰[[GOó¶iMœ˜Š‘ªTÈÅãLMg82Yâþ _BÇØ«©‰sâ9®X×Gë.ß±BpÀëÓ|í˜ê»µìä8GÇ+üñùp˜†&šúšÒ0žŸez"F:è_o6ž`l–ã3í)Ò3ü ®º¾R©ΨKŽpPòlW/‹ëkƒ Kã[¿Ìa'O¬z–øô£™xˆO¬{Ù”R43í¸ ©šA b™8ééYê'‡ô.)Ra#ª7hÌÒ8'9“BrÏôQÒ4¿±‘ú¦±R…J*Nrb†º†2Ý/01Ò‡6ÒTŸgí‚>J»üY€&u.â5=ŪçH”:™A=Ïe’»à~¬ºyÝ?)R»]?Yå¼AÀÜæ \Ò”fJ"Fj §¨I$Ù¯.ËÄRCðóºe»]?¹q;·\_1?4¤˜߸Žt<ÎÙ,G$Š<Ø[¦`}md?i?9¢Ý«Ÿ¬ÍÔpbf+a ‹ÜÛ¯wü¤íÂgL #6a*Gž˜õ|õ¯žÃœ‡á©5CvÁA’·MkæðÑ,L£vúý˜û'í|v¿~²ºy“É:ÞZ —ëâ'ër¬%9¦©‘ÓÒ1onà¡\«ý¼nÑî×OVW_ñD gÕö¿ˆ¾¾N~Ü–§=žâ„æqœ„úÚzŽè(ðxõµžý¤ýäHv·~²½§“Ë CçŠ'²¼µ9C=ÐÒÝG¹nœã‡$m'£Ù%ì&b4;ƒqcš·–}ç×ö75ƒ…Enë(P}oR⮎<£Yu0.•ýA$HfxÕ@DÕÒÞÁm}%Vrü¡µn’•‰TµŽ€úDÿ;°¼§HP©”x$q&ÇâÚTÇÔB7×ôT†9“â•mÎ IöÓœçÛüj‚ê+™L3{à¿}I[wçJ¬-æ¹½­›–m›•M ›tV]_ÀøLí¬éͱ°/Ï›ü)°6ÄúÚ MýkÏ¢nLóÎbÖé{U·H&wêx&Ÿ6ž)G§©ö™vA}ŠôÀÿ{þáNº[JÛót>Ø=P«ééñÍÿÑΟØ_…e9z—çéügER  ýÓ—(‡æKô®í¯™dâÔQGj]7ë– óeÈ.§ÂøžVšÆ4oöôîrû±êæuÿ¤(í~ýdµó6¤ÓLؾ›Z{x²Xfu>ÇëºY Ks|: ÁÏëínýdµõ•ˆÇ‰‡òå"w´õòt±LK.Ç]î Üld?i?9’ݯŸ,” <9ô4WaZ]fàä¹N~ØQ"íø!IÛWL •È2ußä˜gÏÌO]¢‹ŽMN YÞÙÎÑÈ?7¥ØòÒKܵz¿ëí¬Ì‚•-, `¯ñùh]u¹S*‘h8BZŠ!ëÛöb±È:²Ô0!'ÙS¬b!­ù"a]Š9ãjاÐËšD §g È¢d³uœ“­pgK/kFõ_1æÏûìã÷‹3-QaqÄõVÊ,ʨ§Âùv¥Raý94a8|û]u}õ–™”쯧Xª–‹gdØ;/y¦»›ßvæi ­¯ ’S™xpu÷NzÞÔ$Ÿ¥{KGÉãNn¦qrcŸœÓÈä°Uä)oíh«\!·²@œ }­k&(†ko¤eT;olꯙ ©†ÉoÉ© ¨ôÉ-ê¡íñ<¥rHiM‘pŸéƒkÉ´öP¬Ï2nZÍä{ 6¥–Æi:ÿøJ¸ä ì‘ûizÙ\7 a-m›ÏíÜû±êæuüP„vÃ~²Úy7~!¹éí„ÂLMÇi÷ó:²Ý°Ÿ¬¶¾ò¹¾ðâÆA@c*ÃéWé”r=dIòÚ¦–¬Ë±&H0¿©†)ÓÔ&ºÚý¼Žh7ì'Ç$–æ=3šØðlðR/ß_Ó×ÿpZ÷ýì'í'Gd?™HÖpACYÒÑÉßÞûIIÚ~ &6ÛìšÃQˆÄFüK;á2÷¬nå·[ÙùÖgj86tÉlHo>Ç=}eÆÚ7$‚õRØä,¥|ýg·U}žAXäÖUkhi¨ã˜l‚l¹Ä³=ÝÜÖ[¦¾¾™Óâ~Óž§7–丆ZIÇÊ%íêæ/¹-¿þÄÔ“xûÏð«ÛVR"Ãïý2ßï¯|á“W²¨é}ßÅçN¹/\þ4¹y†ûÙ&Ëœ~6_þô±”Vu ¼‡–\û?ü¾æݼ/ñ3þ»÷B>Tÿ+¾z[kQŒñÇžÇü•×pýâáïǙܖ¨Å`ä«R£­¯ µãø§ñ)â@1×Åïû†¿d¹êúŠ%˜<°â®ÞN~Ø–c5INßÈë3ÉLger\Ñ÷ò××ÕOÅç?så–N*ÉZâ˹éûW°`÷óþÄÏøÚë6[N¬ñ@Ž›¹’ ×ù³8d‰[©¥ø6ŽUÉ‘ÃÆ"×KÌid [?˜Ül¾=˜rt €pe7m+ª¿Ì}¸yI¥IöÿˆÊ‹]¬~0G1– ~~#“‚)µ4M˱fy‘Ž?­¥x@-µSÄ %r‹zè\^&>§‰†Ú"ënËSI'©;¨†š‰q‚ž½ÏtÓµjËŸúþšYÂSßÍ›–~‹¯ÞÝ_±ñ'òÉOâ†;fðºpÓšIL?‹OžµˆË¾ÿ}Õ¿}ƒl­6Âm¼Oã–æß9÷cU‹dÿ´ŠìœSxÇyÇ0#VzYrço¸ò®¥ôÕÈßýÓë¨\û?ür鬿ÿ€ßÃûF[¶&9óM|ùSÇPlé&LÄ :ŸæÚÿ†ûÖl·¯ö¶É–ÇÆ­ï3w]»_?Y­|¾‡[ YÎJA}M—Ô ÷ {aÁ~Ò~rÛ„e^Ê—˜–L0!$jøÀÄ2ßXÝÊöö“ö“ö“#Ùöcqo®c@¹ßu Z®ýdävß~Rzå3˜ª\¤§ëYn=9ò[»‡Û —ùËêV~SÅã²µ¼¡aÓî±»»È½Û°.mø²8 l¼6 =ÐG–ÃpT;·0,óXGulüYOsVcŠu­<¦¹pjGnx))ö­É0gíZ~2Ò}ƒZ:}Ož¹æ®þ3©jöæÄYËYж/Çï‘fÑ¢±ï„r‹~Ëeÿï:7éj¿É¥Ô5š%UX÷ÈcL¼ðšx?ë†vÉ啽Œ½¾z+´ïàú ‚G67òöº1úC„Ë[û/kNÕõUîãÛ/m«óÜÒÚÍáÓë™LŒ½k$û ^æú*ÖAnñ5|ãë h¯Äh8ì½|î-ûqç}“KGx‰¦8áU9Øn’[«¥Núº€±^}ßÕBq¸ZÚÊAäz‰9L ÛYù@~ë0L$¨;rÍû$€ò²NVÿ¥b5oÔ–æíëcÕ/‡ÖLÎûz¨=»Ž$123Ë „å2½uÒûØÆ)ƒLšÆCS”žh¥§”f©]ÿœÚ I2³ÒdîjeíÒxÕÌ ÍORÞ4Ýs­a@ãG’}üjž¸ý7ÌX}—=ÞM|æú¿w‘ç›\º ¯©°è·|õ²è c4|ŸxïI,þê­¬Šâ ÝŠ-[«å]ØnØOV-,q[K+=Í œY›¤.Â2uä˜ÜXË  Péï;í'í'·IXâÆUk¹1ˆ±wc3iHÌÔq~]ßêªP±Ÿ´Ÿ´Ÿ´ŸA2™åµ™þú}®­›‡¼?ö“ÑÚmûIi7`01T)GËŠ ûì7¶óÊË×ѵջ'üMùÇÆ­Ù±—)æËýëŽP7è‹ãXlãƒñzËá6ž½0«¡Ãèã{%¦6NäÈ8´õ´óßmÂtœXÃ!ÍuÌîíä…aVÔíËqõOòË® P³Ï|f,¹™ï>ñ>|ì Ò‹mÓn*FÃüâCéŸó½ÞõgfòÚw_ÀÑeŠù•Üùó«x¨æ>ð®£Ä©¼x#ßùÉ_ií]ÂñwspÓÜ9t¯X ¹œsÀض*ÿb™å;°¾ÒÉΟÔÀ‘‰þõ<ÙÖÎÏ; l~‘ô mÞÆú*WJ´“L,áÌ›í\_ƒŸÄÉÖ¦ J!õÇ|„Jÿœ¯?8‰³ßs65¤Ht>ÈO¯xˆ©§ÍcÖ¾SyýÞ?䎩ïã½å+¸ìÞNR¼‡í÷'¾·ü.Þ¿æ$ùÝe·0ýmÛXKÅ•¬]\`CS[x÷GV~áaz†HÆâÔ¿zë‘ë%ömdJi-+Žx04fi>©ºz€ }kgí“#O¿=æ s%Ê!$208´tRÖS[écõSeR‡4Q›…Ò¢V?T€)µL:±†š£êH­è÷íà IDATö ÂÁ5Sè½—ÇêÎãিpG{•aáÕ-dç„KÒ?ç²…³yÛûßÀÞa7]=IêÊ‹†SîëÛ›³/z3ójBb¥%\÷¿¿á±†QÖFay*Æ~}cûÔ—’õtlµv®ýضٞãGŒo9‘ØÍßcAK¡¿îr˸ý×÷qÂûÏàu+ögæþ³9ó€n–}Xÿß÷[έMïáƒÃ-ÿ{3‹*38}H,ñìµ OÞÂÝg_ÄoçÝû ©§«ù[qo²Žµ‡}˜÷m2fÝÌw–¾™ÓÍÚìT¦Õ¯æ¯Ï&ØkÖj»ïãß¿…åñ™›m×#3?ÀÇ^ÍKµÓ˜6¾Â«®¡õ„cãKÇóþÑÔò®l7ì'G# ‹ÜÛÚʽ­™x@¥\¡œ¬å_Ž¶FúbÉ~Ø-ûÉj¥âIf¥baȪ|‘ö+¼ÐÙÃ’†qÌ&`Z&I²+?Ì—¦ö“£e?i?9’]»Ÿ ˜VWÀ0Ç[¹Êaý<ö“ö“’FÏ`b¨°Èšk)ì7‰Ñ·g%–-褺[ VXÖ¹ŽOvŽn ËÛÖðáÍoÔ¸M Åm¤OÀÔtŒx®BH'S÷ùY“/3öG_Aþ™Ó(•î'øùw¯cí¦¯€IÇÇa‹~Æ—ÿ´ŠôïàçΣ£õhj＜/ÜÕÇÞ'D6 ä ¬z1Åüiiî\7äbÿ0äÑ{Jt`,·¾ýž®T_©T-šZÏl€JžkW·óçüÖ¯¤©®¾*ÔÖŽã’$ÃYÛ΂H&Òž7ÑU¬ ûEÅv¯/ =û,>öé“('jHçžâ·?|‚ž½_ $˜qúÙ̸ÿr¾x_“O:Ÿc&upí 9!÷7n\”#;uØw‰ñùÏÝGì¤ræ6×R7m7/ xèI[ypÜpºh¹ù ŠCk)¨PÉU‘!áÈ÷!h®aÊõ¤b@!OûŸ;è\S]ÈYͼ‰½Æ1aÿA¹D÷_:è꘷>ErýÕ8ï/h¨¡yÿ¹=äŠ1j'ô×L÷“yŠù–õÑÝQCã¸$© ä»7_Æ&5Sy‰f¹ðà&îydÇÔ>ÉÕ+K0 ÉÞg½Æ[¾Åçìa©—ðéýãLÜlL9˜u/½–9ü€/ÝÑFíaïá’3÷¡+7ÊÚ ÎªÚò}í¿ê%X\W»áù/[¶óìǶÅö?ì1!`Õ£=›Œ¥Že´¥&ðü³´ò×=¹œJ÷Ãœ<ÅuO÷’žÃŽ-S3tÎZ'ðÈ÷Ò;Ò *÷°º7ÍÙ4ÓŽ~ÓzšCG÷Ðu¤¸}ØÅHöÜÃåÿ½”=ÞùÞºâüç•eŽû×÷q@ãäçm¾]Ï? ©ö9¾ñý«(x?,Æ×o]Èñ¹¿qã¢SÎm-ïÂvÃ~²Z‰D–³Æ¥¨!digwû?-Íé4“(ó\¡Üf§çæŽJ„–¸im7/–úx´\Ë)q˜ÒØÈ›*]Õ>N¼_á¹"?z~[¯\£ Áé" y¦³–XŠý³')–‹<_˜7¦ú*Ó› ˜’JPC‚7¯§Ø‘§3žâØÆúŸÉWæ‘žÒ0ÙËP_@~ɵ—Þo\OÃÞI&î²hAJ¬¼ãWüHí9Â{·á@«ÈêÇŸ¥­œ`Îv©¥â“Wòì“Çqà£;”¬<ñ =9Ìy‰å·®e”ÇË'wâÀ !¹'sÒ)236NvÉwd¨§®(iÿKª›·Ð Éæ14ͯPy,G%•¢î°ú¯š.Ó»¤´ùg&ˆQsx ÉönV.-†¥î ŒS³g‚®GŠ01CÍ8 \¦4ÂQÕàš+î[Hæ130µÿE¨²LßË“‹»¨Ò¾hmsâÃŒ)õL™°ä”©Ð½ôYúNnbíF?ÎäÓSx0ÝÁqùÑåôNÇwÌ8SµaöccÞàí=~”è\2ir ±gó&ãã¦3.·šÎrvøÃ-iö;ehdÈÐ;ÒkŽ×01›c]_ÀøK\OÓ™9~è:b4þòkØU¦ã¥uÂ2ùîNZVõP©Äé+@]0Ü>1C*(Óºh½Häz) º÷x‰e7_Å_ß8ºZÞ•ívýd•ÿyöªË282lïcM,ËÆD8¥>îvܵŸl·ë'«Úàž\ž•$™JÀQãx©­eÄ9²±–‰Ó,ê+ÚOzÏì'í'í'7gbñ$û|S¶ª¯XÅ3<ì'í'%•ÁÄp*9^øõ3L¸xfW{Rçjîû¿•ÎŽÙiS³iJ¸ ,qkk/‡Nª¡‰'67qâ†B·uòð6ÜW0“®ãÍÙ»[úXö/sQ{Kkê™5®™¯ŒÛ8íòŽnžá=¬ôuR©M# f¿ùLzô|þŠgÈ£ñ¸ðïÇÏ"{ÏØ·sËŠ´¿ØÊʧ¯æò»ÛHÌ8–Ó¦¯ áèù”oÿ_¾Ú’áÈ‹ÿ…7Ì~’?W"Sг¬8ü±rý/‹ôÏ)^Wu}•ùü¯J´ì úJ¥j8fÃh0·±‘¹C¦éî^Ǭ«Œ¹¾ å.~ß—æÂl@*SËßej7YþŠŽnÚ씬—£¾†»L{°ëZb³G ±–^&ú.^·úJ~ÕÍÆ–)„DM H0a¯©dƒþ–JBJÛ±–V±â{ß ñKÿÆô¦-nôFm·³ð¿oaŒWeW-hÊ\29d™!ÓTž_ÇòB’ÓÓdëû§ë¾·‡â¸*罿›¶iÆO&×0arÍ&Óžè c˜Kyc“jišÒ}snà¾Ä!ùG{ÈϬ'}P3{4hu“á@rp͔Ҫ¿ò·ô{9÷µ%ž¸¢… _+†}´¬ÉòÚ½øsk{ïMSâYÚ­ƒX:íXŽÚkñÛ¨™9‡lëš>xôµ¤x®y“V/aNµãw¼‰;››èÝw\Ñn?6FÛü(±üŽ» ?úŽ}î§ü¥¥ééœ|ÁñôÞýMV—OØÂÖ 7¶\ÅÍ›/ ¹ý`õûÆ áƒ|gMžäK!³‡ÔÓŠ¾¯Ùd¿æšaǬ-n{Îðh*•Íߤþ±1ÉÇŒ¡–we»[?Y¥J©_wÔðñq ‚d–s&þ‚¥Ì­½¬¦ì'‡ØÝúÉ*•Ë½\Ý™áà Hd8gâ¦D__×ômÌØOÚOÚO÷°{ö“ÉDjà ¾ -…p«Ï¬°Ÿ´Ÿ”4v#»ÖòÀ÷ž wá~ì73¾ÅiËË–³àKx©+¢{t÷uòõ–ol¬áðL‚tX¡%_àñînnî)Uyæ0‚'¯!ÕÛÎÍ…W]”Š=|¿%äÍMµ’Ž”‹<ÒÑÉï»F^WqõsôL™Jm¬¹ÇOâ…?.¥ÿ"½ OÜǺ3c¯‡ ~Þßó™ÿèíhbïSüßMÁf?ûé·~ËèžmXfÕÝ¿ç™w¿Ï¼:F"láÖ+¤¥­Ìý§õôQZw??Y^²LžYà©F^A¹³ÌW¿Y íIÞ6kË{ìÜÒŸýi‘{·ËiGc“N$Çt«€õª«¯2÷¯^Úú:^_ŸaV2F:,Ó’/ò׎.nÏ•ÙìüÑ—¥¾^d˜«¬OÉÒ›®gÍEóÙ3$;ÿÊÿÓK¹~-ÅýÎáÍûþ7W?ûWZßû>>yp+«Û;èj<™ÕÛ±–Âö{yâ3_¤ø‘K˜=gKgÏ@ùùkxô›?gMûËÿDPŸdË#çv˜·R¦ûŽµçÔÑ87Mz\Œ T¦ÐZ¤ç±nºV–7oLã êª!x±ö5߇°£—Õ7Aó‘5ÔLˆCo‘ž'ºh{f˜3ä ®™ö PZÃýÅ9û„G¹re 6<¥È ×ÿ‘Ž|”ÏŸÞCÇšvÚJÃÕÁ,}ò]ô~>}l…Xy1øÁ³¬˜8—óÆP•x™¼'¹µK9¸°åÿóRj"·O˜Â²-ÜJáçe?Ú×ÜÅ÷~šàÿð ÎÈ@xñîŸòý;[©ì±¥ nlébÕ¢ÍëdèX˜Úû-|âs§Æ“ÝOsíï ¥\"vëÐzzšg+1Ùd=tÕmiÌÎðõ[š¶ù”•žõcã÷¹vq™ ÇPË»²Ý­Ÿ¬NÈòŽV.-ÖqvC–}R1’TX•Ëq{[7÷†¹J×~rø¥ífýdU Ϸµò¥|gK³W*A-Ú EëêæÝÅÍŸea?i?i?9òÛ³ö“õ©ÄÀ­Í*¬)oåknûIûIIÛ$˜{à!Š[$hzÕtö›?™3Óƒ¼[¡wY+K,ç™G»«¼°¶IPË!ï<ŸôïÊý;ï©„AÍüý…õ\÷ÃûØês—‚€}ó¶ã¼zV0èÞ®!«—V¸éžÿ÷pe g3h»Ù ëktµTGÃü³˜}ú)Lž3aÐXU$÷üý¼tóïXrï ›ßXc·kfTµ–ß·†ƒ»Û˜U(:HèI5ð|Ý$ÏfÉïÚÇ;ÖN8~ì*FUË»2ûÉÇ.òyµŸÜEí„õe?¹“³ŸÔz;áø±«ØmúIéÈ`b4b 2õ â”Éw)¹¯ˆ\bêɼ퀧¸ò¶–ÍÏžß)Ä?ÿ<æ·\à ‹ó£ºŒ0ˆ4ÖCèì é݆Ûgilv®ú{-Ï’j¬'Nžb{'¥­é£1Û15³ ãLX!S)'F>– èÁãv³s»Šmçveö“;ÜÎÿyµŸÜ•í\õe?¹+°ŸÔz;×ø±«ØMûIéÂ`B’$I’$I’$E&¶õI$I’$I’$I’¶ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$I’$I’ƒ I’$IúÿìÝwœ\w}ïÿ×9Óg¶kÕ«UlY.Èƽ7 „^ìÀ ¿@.=!”’„î%r %„_B¹'ª7äŽm5ÛªVo»Ú63;ýÜ?vÕV+i%¤±-¿ž‡íÌ÷œùÎìGß±¾ïs¾_I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Á„$I’$I’$Ijƒ I’$I’$I’Ô4’$I’$I’$©i &$I’$I’$IRÓLH’$I’$I’¤¦1˜$I’$I’$IMc0!I’$I’$I’šÆ`B’$I’$I’$5Mü©î€$I’$Izö 2Ó9ûÌÉ$©°{ÍlŽžê.I’¤SÌ`B’$I’$5UìdöÝгÞX+I’´¶fÉe»˜9)b÷ÆmôW )$I:¹”“$I’$I§£°ç̧ýTþË?ÙÍ™gÏ"{<¯¤˜L±X…x–l&NpôÖÔŠC”ÆÙÁ+CÂ0F<‘"oæ* ª…<å ü\˜j!›|šÜDÕ) T#’9r©ØSÝ#I’$IzÆÛ(Ô«uªý[ylSž@'• ©V£ý3‡ß»Q¯6ˆ§Ôˆ€ ‘"Œ†ÉÑÐÖ÷n'L¶2íŒÙÌ©¬a]_õsÔJÃÓuŒ,ãk›ÎÂ%Ó{µF¥Ha¸â=’$† &Ž"ªW(WÉœó>ÿ¡ëH=ôÞù÷S:êQY.úÀ—yÿyc'øz¶³uË:îÿɸ}Í µS×õC…ݼðãŸãMóŽÝtç­æÏ¿·³y};šôbÞñùr} ôÿìã¼ïOz¥$I’$éè‚Xlì%v•Á½T¦NgZÛfvZ¦Ìav¶—'Öõå߃ÅÞ!Â3f0eh =•S¦·“úˆ·ÏbA{?žì¥t´«ú‚$“Û1!Ò6¥ƒTÿnJ&’$v &Ó V¦R«Óˆb´-zo{÷u´å_ë¼!¹îYœÕ=‹³.x.g}ù¯øÂ}{9õw¤ÄÓâG¿ÕC’$I’tº‰Ê “Ì>kÑ“%¹¢²—'·&™;sç%¡šßËÖM{©ÂQV ˆhv°q×,æÌ;‹i”éßµ‹¡®QîÝÊîÜ,™FبRèÛΦþq6™ˆÊô<¹™ô¼É{·ÑÎdÑŒ‘œ†w¬gK­‹YÝÐóäC I’NSãhD\õö?àUçÏeVWò×8ÓnýÂ÷ØX…x¦“™g^Ì ¯]H†V.yýkxàñ/pÿ@QZ¥L¥Z£1ú?]a,A<™"9t‰¨é–Üþ aßRS϶’>ìJ˜€ ,²üëÇß¶Ä jPmLâ7ÞþZÎO=wò•o®d(¨3¼­‡b~JA"K&^£\ª%÷-óѨ•©TªÔëQ‹%I¤’ÄÃý:° S"K:¬R©Ö¨7"‚0N"•}_DµåÑs‹“H&¼]W’$I’~Q™=V³gôǾ'y’êÀÖ ì8ü°á<þÄÁ?ïàñ5û~ªSܳ‰Ç÷tÀþ?ÙµñqvM¤kÕ~¶¬¹Ó"È Q!C’*ùü0ÅâÖìÀI$IÒ3–ÁÄaB’­ÝÌY²ˆY]¿æ©j¬_µœåÃ#?>xÏܹö]|òMgOÏ‹/™ÄC?ÝM©T šœËU·ÜÌ+®:›™]bµ{ž\Î/¾ÿ}~²¢—(ÝÅUøYÞs^ êóù?ü,÷ç#¢ZÔ’·ó¥_M EîùÔŸñÅÕc›Šªô®_E/Œ„µ\XÒ@a «]ÎÞý;—Õ‰R‹xûÿù7µÁÀO>Ê—_ÄÛÞt­?ÿñë)V̸üðú—\ÌÙó§-ïeÃÿàÖ[ogEÏè&h£ÿ¶OðéÍ—rË žËÙ33¶®à¶ï|›ÿ^ÙG hT‹ — ûâ[x㫯á9órä7­àgß]fJ’$IÒi.ÞÉêGw>ÕÝ$IMô4Ùéøi¦¶[ßÿ6^ÿÆ7óÚ×ý)ÿ¾û$7h°{Ùòàhn0çÂùä¨Rº¹þÝâ]/½9]bñ“^Î-ï~·,LeVýlõÈZŸ±3¸ôŒ РV‹3㢳i(®ä®Gßãx%澌?{ï 9»#E<¨R®&9ó·>Ìgßý".Z0…\Aº‹—¿Š?úð[¹nêáQBÇe¿Ç‡ÿçuœ;³•qÚf]À+ßõVnœƒ¨J¥1å†÷ð©÷½Œ‹Ïè$$éš÷\n~ÏïseËI};’$I’$I’¤§˜ÁD“å<>tÝsèŠÇÉί^š<ùƒ/óá÷ÿ ô¿¾ÁŠ2@7—_9ƒDR~ü¬¬¤8û♤¢õ ›ç,í °b†On³gÏÔÞµÜ÷íürÝ Ñ´yë+çÛ~ôYÞõ¶wð{ú,™syío-¥}lUµÄxìû_å¯?ö)>ÿƒM#ûj„ó¸þ¢ÉÄêU­Kyý. 0´œoî|äÓ_gYOhJ’$I’$IÒiÆ•rš,Šªä÷í¢Ì‘ŠÅóËù—Ïm&V`Ý#«ØUË1mqÀ¾-’¹$!Aé ~¾²ÆÒ¥qrK.`FìQúÛÏâ’Yì¸{'9—€½?ã£ø7Ö•ÔKEºn¼Šyµå|ý;÷³u(‚½·ñµï=‹^3Ô9W°0s?»+NÑxì|ñÖlÔ)¯ù&Ýø§\š‚–î,a£AfÑ \˜(rÏWþ‰¬,EkùÒ禱ä/o¤ãd¿'I’$I’$IÒSÆ`¢™¢uäR£?W ”ëUŠ½«x t67¾èFÞ~óÛ9sv'ãm¹„eVÿl5µ¥çï<—󻞜|ó†WqçÆ“KP\ó([Êû6 HÐuƤ‘?ÆÏçÿñë‡ïbFk <”ßµ—Ò¾S4†*) €8s§’`oÞ¿éuióÃl¬ÝÈV©$I’$I’$6œòm¢F­L=¹ˆÅSF~Žz·°·T¦Ñqïýô;¹4 oãá_ü’í`ê-oæÝ ˆQZó3–WÏçÂÄ.:g&«æ/  ¯ZÆ)È%¨•F7³& ‚øèm ²é‰ûïЈ¢h¤M£—úسDcØ/C‚ýÍ¢ý-£F:‘eŸ$I’$I’$I§ ƒ‰S*¢^«Q«6hÔ«T«SŸÿR.N<»åWª‡L¾ò#¡Dc-_zÿ'¹³§@)<‹wücÏ–×rÛŠ ^˜dε7ò¼öPbÅ])žâwÆ· 9~‚o}ö+¬®Q¦‘ÆœidS5öôÖ&|Î 2´¥‡3ˆ³X:+ɽ+†¨”+¤]È|+T’$I’$I’N+NûžJñ6浘zb™.f/¹š—Ý´häC//çû÷õЈ'I·Œ®ív³ø¬i,¯W™ÿ¿Ãµ­‡Ÿ2+¬ùÙJ*^Hrî\PZÅ'{×ëñ„1—?È®×¼”©™ yõóæ³ñ»›y1¯|ç»xÉÜ6ÿüÑôMôœAŒú¦;YY;Ÿ¥ñ,W¾åõlüÒ±º¾¿é&:Oåû‘$I’$I’$5ÁÄ)5—[ÞóÞqÏsÿ?“"‚XŒÁUËé}åML¢“kßþ®Ó:–Lîû!ˆQZû -_ÈÅ£yFiå26œêÛ%F^œÆž;ø—Û¯à}×u³àÂ_qÐÓµõ|çŸîf÷aK9ýœ ?ηoÝÈù¯>ƒ°íB^÷¾ Or¿%I’$I’$IOá±›<›ÅHær$'ü)ij­¤cã=QèÝκåwñÍO}”/Ý×7ºB@uÓ÷øÔ?Üνe BßæG¹õsãK«G–DŠ/¾çv…û_#,¯å¶å¥ÑŸË¬¼û8–q b¤r9âGzOÇz¾Q`å×ÿ7ü—»Y½u€ ÐÞˆûÿ‹Ï~ðsü÷¦Ñ‘ÎqÄs×Øöã¿ã/ÿåv–o J¡ñƒø*÷&úÆ$I’$I’$IÏÁYç,=òÎÄzú‰T‡‹d¯þ0_ù½…P~˜O¿÷ËëHGvÐõ’ßç¼[.&}ÄF=ìùöçXù½åT¬¥g¨Æô¡-\38Dîˆli›Ã]­9Jæ’$I’$é)d0q$± ó^s>—ž›œPóòÊ5Üö­]ä맸_£b“³´Ÿ›&39N<¾ C+ò l®ë7šNÒº4GÛÜ$ñ$4ò5*;K ‡ ¢ûåí$VîeÇÊϪ‚‹…¼ðuIþìü‰Íö-¯ð¶­³½Iut,A˜ä·gtqI¬Ê·¶ö²lý Ã$Wwæ¸:›bJÅZM¥a~Ö_`Í8LJ± oŸÙÎY£цžÝ|¶Ð ’ñ4/èjáòLœl½ÎšÂÿÖ_b÷AEÄRüÏ™Lîï哃5NÛ{âÓ˜ñûç¼K:&Ô¼rÿç¸ïó?§ØŒ$IÌÊÐ~N†tWŒXQ¬2¼¦ÀÀÚÊ!ãÁa™Å9Úæ%ItŒ;T¥¸¦ÀÀš õúñµ{VŽIQ…E{×qõðÄ~Ù¥Ìl¾×ÕÉP3‰â3Zè8?M¦3FFÔª ¯Í3°¦J½ñsº™yaìèç.²ã»CTÆ«%kC’$I’¤gœX÷”i~ª;ñ´Ęô‚ó¹æâ#_“Pâë»Ç<$xíŒ.ž{<[Ö—øàÎaú'Ú>9§«ƒ—¥L‹oßCÎîhç¢UøIÏ÷T"º³­üŽ$¹0Å•é€'ŠÑþ‰òlª…[r!DÀ˜—›ÜÒÊ%!ä }üUO™B˜ä–]\‘máÊD™U#≠7·†¬èɳñ4žD §¿s^<ã¸Ë½ä̹óظ}‚·MœÀ˜¤Rt.MÆ‹J5 }V;ÝKâ„sZè˜T¢wÏá' Ú2tÎ)èƶ!öüªL#• å’vZ; vF ¹åe†‚‰´«Pœýì“ÂjW•û¸ö¡m,É.dyb‚ÏOäû*•¢ý9#µA©ÌÞ»ò”J12¶Ó93 ˜ÚBÇÌ=›Ù=px?‚–4“.NÕu%ªãüŸX =;kC’$I’¤§³ã™â|–é¼bí'tlŽ3/ÏqŒ)F$â´ß8‰©7MbÚ¥)&ºiЖ"Û2òçê#ƒ l«Qí-ÑwïðÈ•¯A‚ÜÔpìïȱ©$­sF~啇èÛR¥–¯QZÝ϶oîfó7ö°gsƒØÔÔhbUcà¾Ã}uj=%úï-Œ\ÅŸHÒ:% Þ6òN«›F®bÊ5Š=#‘‚¹‹ZHîͳwKãY·$Æ¢«Ì?¡#n¾*$5öá¨ÊÏ*L|¾¬Æe祣€ödòB‰‘eŸ®ËÔ×öþ~P¬Ò[«ñÄ`Ú¼‹÷nÞÍ?ªƒ Áó&ei¥ÊûJš¥´ÆGêkk¡ÊÐhÔx¤ÄÀÑ.PNÄi¿¾‹Ž©#³;‰ELúÙuùðe*ÆZ£IÕ¾ƒU©‘!I@¢;Ƹ—·%I…#ÇÖjI:Ÿ—£ejŒ°R§´¥@ßC%*•ˆƒgªžŠÑèäo@bJŒÚž*ÑÂ$©ór¤{ T[3´Ï€*å„ÓrtÌh0øÃgá’ñËÏ:ñÃ'-Ž1#Þ`ã!u±u°Ÿ¿¥ƒ÷t&9z•Ö¸s÷^þcøx'ìë,Û±“eÌŸ4™w·L,¿L$RÌíçžFŠ—OÍqi:Fª^gãpžÿè+±eÿ¥ÖÓÚÚ¹1;û¸«šãÚCÎÑ[®µ$YÔžea¥Èžx–çgFêk} 2™^žipÇÎ"{Žë=>Ã$¦3ù¼‰í+1žÔù‘M¬!´Dëד(–) ´ÐÑ’=/CáaÊ•Ôâ,™P-“?Â[Ñ®A¶}ëÀÏA, ìJÓvæè(·«Ha0"jL¤]žmcRTavéÄ/íÏ”ò´E9úŽ4ü:µQoPÚQ!FƒáÞ“ýA5:0.{Ž€ÔÒv:º€j™Þ»ŠT°OÉÄjèYX’$I’$=ÍLŒOÒÑúkßš#ãÈÁĘIžýŸÙÁ´ Ÿ÷}²'Ì£wCDÔ«FµËã„Ù‘6‡-ʼn^9½¬íÀ©é…mLŸg熨öVi'$NÇ…Ê”©…qZ.ʱo+ðXK@ã‘<‹ºèèÎ1õÕ¹}=¡òè ùáí7fžìgà´]øÿ(â ÛŽÝìˆÚB&ÇL4&NÔ¹ë„B‰_O2c¤ ž3é 7‹± ¥÷¥|fç ‹§ù­Ž8ÔŠ|c°Fuœ=æû C|¿e/IµðÎYûîˆØÚ?Èýõ87MÍ+ôñÓÊi^_ñNZOì’øóHÇ9r0ñkŽIÔk ÜÖOìy´ÎjeꬃÐz…¾Ûoi¹Ãú‘¤ûæN²û‚Ñ¡"»og’øhí6>ÛƤ]ØþˆêÃd¾#=ÿkÖFÔW ç¶ÂaÇf§Gl?ü íYº–Ä€ˆò#C&R?`mH’$I’ô âæ×cų̻n ­Ç¿’͈ Ä–;w34^0q„Iž}ÂIi²™Åmõ#.#NÍÒ6#”Ö) ï{"$³$C"€ PfpãØs„“³´Í½ú½TfïOûéy¤D%™$7)„TœÄ`‰üö*ÑŒ,™,)Z—äh?;C¦í ~–ÜX¡´±DµPï«x€Þuub Ûéž× ïŽ<å0AËÒV:ž“£eF‚°T¥R8úäO|úu¼îÒ2«6æiæœ7ÿ5Ÿüí.Vܾ’¾:¤Î|½¹Ä/ìÙ¿IôxrΙ/ããý?¹þâ˸îºk¸áºË˜?¸’M Þλæ¯aù”7ñ‡‹×³lãð–ñ™tÅ-Ü_Çšþqfã!/¼!Ƭ^,-âç·×Ù2nÀ1X.³:JpI&6f)–:wïîåßJ´¦³\ß’âÌt’Eé$‹Ò f ¶pA@g6ÇeÚü: ›Êrý¾ÁF™oïêãk}%¶…)–¦BˆÅ™R-q5à‚î.®OD,ÛÓÏ/k±xšë[$8°ù54ØXfk’ `¨RáÞþ~¾‘¯ÑÚÚÁ²u¾»'ÏÆ Ám¼´#Ë¥™©FuÌû8ܾúZS¹‘ý͹á¢K¹áy/äÏ_L¸v%=罃wÏ_ò'¯…°ã®:³Î¶]©“‰8F-%f1ó¥×=áZÚÍÎïßAñI!™¥mtͽB}¸Fub©Â©Öˆá-UêÇJÉ‚€Ä”$ñdHR r“ osìÑÚÕ”Oé˜å+ßÛۗ³lóÈï?œt ö§3<Ÿ7Ì;´fâ3_ÊŸ¿.ÎîwL:¶cÔeõsÂhdck'ƒãýúOFmŒ#~FÓ®]¢iGž=ËÇlhÄh¹ºÖ–ŠÃôÜS:víì?ö©¬2«6É-º‘7¾íðŠ›®å†k/f~°'6Po9‡ßyïïp~ß V/ýóJ¶žù{¼ëcͱ$漂O|âw¹þ¢Ë¹á¦¸é¢iÖ<ÎÖâÓã–£•ÇªmI’$IÒéÎ;&ƪW)€½k¢P¢|€ûÄu0-êgÇýåñ7Ýÿï÷€0<辈 $6:qéÖƒÖe*=4H¾§AD⯆(žÑA6œ'X_f觽4.j£cAbd=ñF£%ŒÜ5•G—å¨×)®¤¸âÀËé$©­ê¥PKÑýârûöïNž›"}g/=›Ž°ŽwãÜçŸÁ·Þ92™—]À5s·²¬ïL®šbýúãßèuÿû^ÿï|òS÷3xÈ †ÐzÉñœ©ÁÞGV0ù·—Òõ•ûØ;öÔ#v9ñ:*6è?êLæxwNÔùåî^þmwJ´gr¼¨íÐH#Ÿ¯rÏp":xzrÝÞ~Y©¯_õrAK'ç³²q:^• (úù~ùèk¹GQ¬8ðXKñÒŽ${{y(JñÛÓ;¹xÿ[Irf6Í¢žþéHûNT_Õ(m¼•OÿÍ2ú!m¾™½j1wüígøø:ï\ÂÕÏ)qÿò½'üYêXµ4Èðp¢«9 í¤z ǤpF+Ý‹G*°ºb/;­Òˆ 6»é×eˆMk¡ûœ2;©}âµ^cà¶^‚ÔÒN¦'˜ÚB×%v­=¨NŽÕîIºVÓzó:ï¾›Þ( cÉÅdV~‡U¿ø79ê'y"ŽQ„äC8áB “Œ;šž¬ï«CÇi¹¸®…q ¾eÝ¿>l‰¦ #CÛ´‘×-=\ r<‰ÎS\Ñä«ùý7œÁÝ÷×|qgÒ³¹émoâÍ¥Oó…í ™µû¿ùäÊ<±9ûþÔ² /gÖ“?æÿ¬zï¼b©õë'ô9NLHÛåÀ茶ÆçG— ÒsxÁﾆK;êTË;¸ãkßæ¡ì ¼í —0)ˆÑØüþ·ø$‡¿Ëy÷sÇØY•ZÄ}[àåKN¬WåÍu¶sbi$œø ü^GÈC{š¿|ÓµzDˆÑ`çAw,DQƒÝu ‰0`J69²‘s®“å?Óüî)|¶mí(Ž³ÄLÀܶ6.d˜ÏÖ˜Þ1™‹cÐWèçïû*D©Þ>9ËÒ®æÙ0N‘R_ï(ÄÈäRµˆÖËÞŤ¾Æß<8…—½ñeœÛ–$>ø ÿüÕ‡˜~ÓùÌ=s:¿¹à+Ü>ý-¼¹þU>yÏ É%oä}‹Âç·¾œwœ=‹üÇ'ÊÌ×þšµTÝAÏÆ ³/g½« ¨ox˜ÂØ¿g'mL HÌLŽ.WchÝçëÛ‡)gh )ÈIDATÍ@bF‚ðÑÚaËþÙ©ö€ Š¨î©R«QƒÊã*ç¶ì™3=N¸-"1v¬­ŒÓû“;&UŠ÷°¢åfÎëü%·÷·±ä’4Ë¿³“Ìåï⽩¯ñÉåóxí[_Ä‚(ÏP!AK}ý¸cʽà xÙ›^ÉùÙˆ°ö$ßû‡cEÛqÖFfk2dñð‰ý­¯%Z['ñûj7;2t]×FK+@ƒá_õÓ³z¼öÉ…™‘ µ^fhÛ±7¡žh úÚ™õªküy–í¬Œô»´…_|ë^®~ë ùmg3çìy¼dIž­—^8òçÅ[¹­ó¼}¼±æ~ÌúÆ,ž?¦n–í9RRÓ`põO¹ëeoâ¢É¿à‡ù…cêë;üªºˆWŒyž ßÉ[Ã~Ìßmz%ï»,OOf:3ZwóÀš8óçv“ËßË—¿ðS¶ÆæÖ¯Gæ¼÷·›í¹̘Ô`ù·o¥÷êcåkWñÖã©mI’$IÒiÏ`b¬¨Êže=TOáø§klY6ÈaKÞ ¥`‚K5DDáø“BÑP•:Iâ$ºC‚£AE{rô—QíF;Êï;6$ÕžÑvé©Ñ âÆ@Ú2tž›$¤Aeuž¡þ‘I¯ø´Ôþ+óK{Æ -K×Ù!¥eJÕ\÷Èå¼ùÕeªå¶ “ÈÒÑž ™†rþðs$¦,"·ã^ Èræ•ÓYÿ³õìÚÝÆÀ‹¯`^j=ONäcGjþËùãÜDhäWñµÿó=zicÊ•7sáúác?ÙEjÉëøÓWŸÏ@ï¥äîø"yç0 ®>—L(Wص9Éå3Rܱ·tè EÞ]cpIü„–YùÅÝC*–[÷òþÁã;ÿÖ¾=¼óˆ ËŸ˜J­J/)¦2'–ë4€0–`Áè ƒ•µ^’b‰,7·…<Þ“gmrij¤¾î(³«A±È²j–—$ÌŠÁ†qæð©/ 5良ï/®£Ï’*=Æ¿e…×qf=ÿe̺ï‹|ôÞS¯»…˦ ðß·-çêÒ¯øÁú™éãõ2Éäîõ|äC÷^÷n^òk×Rž¾/£zÁuÇØð|lL9½Û_À¢G¾Ìÿº½Ü…oä½/YÈPé8kƒ»rm”‡ûG÷l8q6¶ä8lºþdÖte™öÂV’!P)Óÿó÷a©µXœì¾åw—(—%zö ×иGŸÔÚˆ3»;`×£…CÂáÚÀú’ݬ»ýa65ã{«·ÒÈ?Ì Ác|ïñ"©ËaܱfzšÁycëf |a9GÜr£^`w1Å’LŠ—¾bL}-b ?ö5’übÜ…$ wóÅ¿ßÄì×€ßÚöiþ÷7ë\ùGoaIÇí”Ï?¼_ëîÓ™[˧¿ðmê缉?¾0äon[ÎU¥_ñƒõ¦Ýr¼µ-I’$I:ÝLŒ£²~Ë7tsÑüã›A­¯’•ãÍ„Ök ÞÖÃqÎ+,Q,æhËBâ9ít–ò+qZ/ILÂDUò;DAŒìE­´´õ*ý¿,P*‘ÈÑÑÉ‹ÚéŠ  !Ù¥­¤€Å'k4 Ò Ò#K6u‡SK¥é¸dt–qh˜Bÿ8 B²ÏÍ’èϳcS( ¨å0)FöŒ8CTaršl;#wiaÒ)Ì´+4€ w&×/î`Jç;x”¤«³«ç¦N8˜(o¸uÌRNá˜à A×üILê|o߀XŽJ=ήŸ|›^ôjþè} ¿‹ÿhŒ|^¥|D®%A@é°‰¶¡u5¾¼.Æ{߆%•µUþqÝÑ÷HxêÅXÚÕÆ%ñ¢?êɳ¹VâÁj ¿™€9¼Š<Ëk1ÎïhåŒÑúZ^¬²¡ÚÇúýL’©VÞ;ydCÜ-{{ùJ¡ÆÀa¯òœÎ³*yþªX§ì­5 ã‚\‚;û+Dé4ÏMQÞ#\D~H}å'ÿkt)§¯Ó¶ ÁäÙë—hPcÇíßà»@òŒ#|$û'g«ì^¹†¾zœE'¥–"ª«¿ÉšÕWrÎ’ã‹&«þ•õ«ß|øäIÕ­‹Ó„Äh»ºú¯†)×B²KZÉŽ~ÃT7W¨#{ñ¡cRuO™* ä®h¥òà0âä.ÈîZK[«Ô&Öîð ðOþ˜5¶Ý»œôëÎeNù“öÒnë™ñOŒ?Ö¤X|ÃغI“ x¤_u,ËäL‰½Ã“f<ùðÁõ5“9“ƾFHÇÁáêþ1¬ÎÀö½T¢:åü ;wh4b W %ï;2M2¨Ó»~ÅÄKEêFÖØòãoóÀ‹¯¶%I’$I§7ƒ‰ñ4JløÖt¿ãlæMôr÷ÁÝÜûwì¿ û”©×¼w˜Ü bAœÖË:ÚÆ ¢üðÅ" HÌL‘iÈßS R­1tOì r$í—v²Bmí=0Lïò ÓÏ´§é¼&}p¼çðuÁÂ)9:gEä\}>¢ühòœVRçv1ûÜm++ò”Ž0ÑÓ¤‘K]|9Sý2ùê”é¸ò]üùUsÉÜ}‚Ÿß1UéßÜËŽÇ¿Ãïê#>ë nš¹¶K/§þ‹à;Ó\üŽ?äEóVóÿ¯­‘n (lgÒ  ñý¯W9÷=I~cÂuTç#ߨ±óé±wé‘Ó3)ÎT¸ ªqGo¥ÓrÌ\ÝÕÉÕÒ“ï燕ˆz¶DSjt(€j£Nãð`&já•™ˆ»v³+ˆXß_`S¶•¹í]üUû¶[ò¬=Âgx ¾8ÆDX½;C.›%ÜYdÊoà7v“oä90åA<›âtÏŸN&y°VkQ;‰µ´‹mŸÿ4ÿëO˜ÙyÔNÐ÷ –ÿýO9ÁU~&¬±3Oï†$“ç‡Ðš¦óÚô!ÏG{ ô>^# ã‡ICEzK3íì8´¤é¼îÐcÛ†èßEk7ÖÉ“F¶s¨íz€_¥ÞÌ«_PcÕWwØØ:fçž /˜ßÆÏ{ t,X@g| ýÇÖÁ6͸‚Kæ·ÛÜGvÎ"2½Ëèºô¼ã¯ ÉÚ®¹LÙý$‹&º¯@¬“;º:É_fzÜ‚ÎÌèòMé¥í¤Ç´i¬ÛËÖ{FŠ4lMŒÞÔ Ò7Þ†&ã|¯M°†;ÕI¯[o¿‹èݯ⊵ÿÌ/wV!5“ë_sÅ»>ÃîúÕ㟬ù6?>lüØ0f¤ƒ´.¾‰«£ù»=eÛ#橯mÃ!Ï;ä5¾Å­ãŽaG3Þ¸¶ÁèRÛ‘±2ÁìËN ¶%I’$I§5ƒ‰#ˆ†z¸ÿó«(ýöbωµm}ËV–ýë“ljNßêÛÙþ£dÉM6TöT^“g`ÓÑ7˜mì)°ëû5Ú—æh™'Œ5¨ï­Q|lˆ¾µÑý±#*Ë÷²c°…ŽsÓ¤;B‚¨Aug‰Á‡ zÇY÷;§õ’,Áæ~ú÷˜œˆŠìþt]œ%Ûƒb•Âª!úž8r?«»×R˜6\ØÇYWMaÃ71²ÈCƒÁU÷²÷%W2ÿ!h=ÿwøÀ‡‹4€¨øÿ÷GÁaýógÿãÛ+»Î®»¾Ë¿û>pmH<ÚÉm_}}u^óî¿ä¦Â0µ½÷ñO[+@†©s*X矩Ð÷ú¯{ôŸÒ¦üç*÷œ”K•ŸÃå<»£Êo´ç¸$“ 5hÐW©±|pïjão´;Aœë&eIûùqå@ýÕª¾°3â•9–¦bõ* òÝ¡ÚáKÔŒ:P_›ge–ƒ[²éGßgÏ›ÞÁ_'1ø_ýR‘zkÕÅ/ç•gþ=ßYó½o~ ï?¯—Ýý r'QÝ'±–¢þ{XõR}×{™·èhW_C}Ý­<ú™¯±§¿ WT§¸¬—[³´/I“êŒ Ôë”Öåé¢2²îÿxÃhQ~h/Û÷äè8'Mº3F4¨õ×~"Oÿþ=+&Úî §dLÚ:ÐÜ°¯ž?8Zoù¼®øÞΦ©ûi×G;õØÞfÑ»ê×zõö'Ýzõ‹Þ wòaúp¾Ö6K#µ}ü©º{ÿµçÞÝ‹vÒ\]8q¬~~çµ:õÙ÷Kß+Áú]ÙYÓl,Ì×®?ÏÔCÓ¿ÕÞ‹s‹¢@S3ÛëÄÈÍõÕðpÍn~“øÿèÃ}r½XÓl°åkÑêÔÐh§Ú5_³SsÕu bÓtn}¼<øu½òÞä’;DûC«v?Sã“oÔ['g×t EÓnjÇhÕ`U›Z¨ó«=~… Ó_óµþYªöp ì­vÍÖÜï窻äP~6ʵ™™«Ø3 ½êu«]­šmujNŒØ4ýµO®W±÷Ø„ ¦uål aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€aˆ&€˜¿û?ï "(í¦IEND®B`‚suricata-3.2.1/doc/userguide/output/files-json/elk/Logstash6.png0000644000000000000000000024212013051004444021520 00000000000000‰PNG  IHDR£„£ìsRGB®ÎébKGDÿÿÿ ½§“ pHYs  šœtIMEÝ  Ût" IDATxÚìÝwtTÕÚÇñï´„ô’zｃ*‚ Š zm×rU¬è+" vET±€"* H¥Cè%”@ IH/Sß?B ™ *†ßg-Ö"™™}Î~v9g?9猡A“–.DDDDDDDD¤\2*""""""""å—’?""""""""嘒?""""""""嘒?""""""""嘒?""""""""å˜ÙëwB¹âñˆüfßµŸü¥‘€:½q÷µ´ªìäغŸøxêrç»N¿Þíú$Î`Ah?F hOýÊÈ9ü'ßOùš¥ñýª1Ÿª×1ú©º|ÿô;lÎãÊ(i?Üì¿1„–7玫áë óÐ:~ølKã­¸.j¼(ÃPš=ïàž~m¨ä #î¾ÿì[–;g_Œ•è5ú5î¬^äwqÓxäõÕ¤;ÍDvTbœ½ÝßóÛÃCù ‘mobä-]¨RÀ‘Msùô‹¥Ìsy]·âÛÿòäSc¯ÝkãçpÄ^º¡í]_§Sóâ4¾Ü‹ £Ã°‡Ö&ï^Ïï©ÎË«þ›_sžÛ›ßÿ7žu9«Œ²Õ½ìsK1­Ú…çG7æûç&³=ß›vû'Žç§¶ý%?دôþx-¥ã[‘ãž kÀ™_9³²î—/ùbñAr}2j£´÷=õªô#;ø}æt~Úž‰À·>÷œN~ç”mÛ̸G?"6¿¬ý±œÎe9÷¨u+¯ ÏdÂ+óI°_Ä‚‹=wööܶœŽ‘Ò®K<ŲØ×<^àúåo‹…‰¨>£;(êœ7æ°âgùt/×oê^B¬M[rˈAtoX ÇÑ?ùöÃé,K°]@[zèÓ\àúó‚Êÿƒ ×xˆÝÞ‚Kô´®ìñ:YÊ󉿬Ÿ{Zÿ}c±ääÁB¥ú-i×¾'75ögAÑ—ü2ô?Wcž3‰ÿnµÐùÞQùj Çlf"ÛÞÄ}ƒ»R7ÄFbìb¦}>íNÌ1xù +Ô¡Oטã—3uÖ1Ú ¹1Fâ—~Î[Ó·®?²—-¹wr^œšo!ªc)Úèn¿l­ÉÀÞMˆpıpò‡|»Ã—n¤}H­ÿ÷ yc>dKÔµÅöKõ¼<´€y»1¨Õ!&½ô©õŠïSn·›…Ó]³<öQcH=šÚ’H}ö-z~7šw¶Y©rÝhÞ˜ÎûOâÏì0®ý½È»ö{xÉÍ8ss"Zª>_\ývpícÃiàGƒW€—&³»Úµ£óÊø˜ ¦Â¶Ÿ};oݑ¸1 Hr€OÛyýŽÆYHn/ç–“WlW/Œ~Ôì1„ýÛP=Ð@nüz¾ýèK–&ØÀèO^wrÏõ-ˆ"‘ ¿ïÂ×p&Øõö»¹µK ‚éì\ðïÏÞE–ëŸ=žŸÚö·•K:þÉÅãÄ–—Kn® ÈeÿÚßXÞ·-ªùcLpa=õzn›|NfØKü¯3æìþƒô“‹À3e¸›=ôGO}ÜÍxO©vÛɱtîØZ@j”·Ç8£Û9ìBÆûº¬s²†0ºýïEº¯~…W—¦áÄD•¾ÏñBý_xêíÍ]çÝœýÚ bn9œ„w`È L&ì8JžËráó^lN/ÏϪ–O˜ÛsÛò§´ó˜§XºÍÏÃÚÀã|kû'cŽ¼tRNÝ` §Ç ÙóÕxöäÅËõ›ûº›8æ¡ ßWÒÉ´š·î&ÙÇg¿Í«Q>d^Àþ»ïÓ²þ,Mù€ÛØ]º'ße‹WñëHÏësï榋ÊÃz¸äµùE\C”øWÛçÎ`Ê—sÙžé8ë£A1‘˜Sâ8~r§l)8P•ð †Â×4źé)Û§ðܤµœp6¢L}"lÉ$ä"ÌQÝ~Åq¾™µ“ì³ïqò¢ <ï‡Ûýwa=¾›-û3©Ðú1>y÷užºêßÏØ\ü_JWûšÂË’°¹-ì‰K˜ü›/·þo,Ÿ¼÷:O]“ÍÌ)kIurV®à(‚Íaô|øe&MÃË£®§eÅÂ^^ qö®ÝÜ·‡ûò˜ÌF\×™ƒ¾Ý†«B8• žëæ±ýË(¬õõ4:ðÏ?þ Ÿí®Æí\CÕsò_ÆÐvÜ{_GNÌËÃŽaFBKî}àJ"MNR×|Ãù}V9Ûxì'–ê½è¶ÉýƱÏ}ªØí™Ü÷1}ôdý×o`ýΪ5‰ÄÇàGµF¡8Ñ4ò¿ª´¨”ʆ½9¸¼geêóÅÕϕȼ‰Ÿ³=g/½ð!Lm.5/Z‰.e¹òö1wÑ>2ó3Ø·i;i¦üŒxßï öñíŒel?’I` ï-~{îú˜POå®ǶÄ·AB+DÑ´â1­³R«^þ•ËÎt‡—ã¬l}þbijä2Î>&ºÊ<·˜=ÖËyb-o¿ø.óv'§ €¼>>˜ð¡f·–8V}Ǽ)d¦ìbÞwkH?õø:,A„˜É‰[ÂøgDZ0ÙñÏÏOo;¯ÌåË…œÍW¤×óï2uÊGLòï=u5,Ê·žUåÈK§ÀD…S}ßX´Œ˜:åmžjÄ™ÓaOýÑS·¸ïÖH%ãÌg¼Ëɉí’ݺþŒaMèr€¥»ó.`ÎÎÀ†›qêåüP¶:sXópn{9*Ûº/ÏÝÿŽùÐR…^ý«°áÇMç]5^Rœ¼Y_†‰ Á¾øÕéAÝø_xgü§üšÑ†ûêyAíàMŸ.K;{5f<Äî’;µ-m¼Ü®#/½þí~=ü÷îkY¦lùv,~>œZÊ}ðÅF¾ uhÁV¾9™‚3Öãºws]¥}üôöË,Ü“…‘Ýî WæŒÙ”…³â9§¯^•aô¸žNŽ¢kQ¹ ž¸T+΂¶.\L╨ðöÿåµ[kâC»>‰±+O¸IÞ8K¹ý³›¡Jû6íœÁ¯»2°[æþÌ¡ÿëKË°%üZä–-ëþ™¼ðü™O&Íøžo\CËŠ‹HHv¸‰‘·ûë¹=Ü·Øã~âÝï`ä#o0ȘÂæeëI(¨Ff‰*ÝÝÕm›{Þ^ygO?Jú©¹Ê–F|–ULpúÀd" R þïbì;·Ÿ<á5âcJ&¶‚pb=²’ÅÇûp[ö,Ö¥:Jh+s‰åê“á¾äÄeb?ù©ü£›XyÔ‡º­|ÉILÇzò@âÌ9NŠÍŸ°“g}N[6WágœN'Ö\ÛÉ“iNÝîUö”áéyÑDõR¶‘#;…ŒSwù9]ÅÌm%õ;pf%sÂê‚û”»í¹ëcfªßä¾<ƒãÌq¡àðfŽ…v¤v´…ÖX¾\W“ö=jPÅ^Óþ™$ÚÀÇí8ó!òê¢óüÿñË?Ï’Ë8ç˜yþ1Í`¸¹ÅH@E÷õråùPóªÁôkUŸœT üOî· ÿ03;Ó9µ»¶ô2ìuY›¾`b`ú|™¡AilZô3çm"ÏïŸ:ž/ ÁyjÛNüÊ|¼¯92YýþDf±ƒËA~V:™žâbò Å×–uæ/ìÎ"eœ<‡±ffIÐxêžú¸YÅŽwð©ãyl•|Œ»8ãÝíÙwZ,kÓ¯¥sM†w tß´¨¸ˆc^öG÷}z1™æêenç’ÇLq±»t•.^¿aoëné¼Äú·§µþR6þûZ¦äOÖ±dì=jRѼ…;XÂkšÏñðoÜó–Ùä¸ÀP¡7=yMvLã¹÷¶rÂqæ/6Ñ-ëÙ¸?¾ƒÁ„ÑM|…Eã^ã‡@oÊð´žVš&"®ÎÃ~Syæ‹}‹/&— «ÓAòÂ7¹°¬qð~¥ër‚Á`(ò×,ù‹eAuÛÑÌ´‹µ» ¿ Ãé°asºp8]bäíþZ<´Ç¦q[¾ÑâKΆ/y~Ñdœ€oÛø¿VHÈsy¨›Çí}¹¿ü?~ÓM¨iÙvÀFL •¹Ž³Ú+7=—ôu3x棅·z¨R5ˆÌ${áäÞ¨/}÷s,¼?×ÕÜηqÇ‹çòNŸµ“—nÅ¿rf’p¾Õ»q]­láèÿÐHÈ:Ì[Çÿ©ã9EâæÄ~Ž×âõŸ7È=‘BòqoÏ^}¨Ú¾9A sH´qòxRRžú£§>ns3ÿìå·xÏcË›ó²wOIµ46ý™EïNMh]1„½óö“çº9ÛÝ8=Âëû½™¼÷¼?®y:·½|xšÇJ‡‹?ßþ§<þ4ºª>'VÎ&Åyáqr_wÏkÀÌ„œƒ ‡«ð_ÙûôÅhg/ÆL±±»tÏmK/ÏëÈY—Xÿv¿þ{Ç¢±,Î[Åvÿ.ôoAÿ®è×Ǧ?ˆ·ûQ§•…-{²qb$¨Ùõô0,åë¥ X*FAdxŒùlÿø9òyž|f4O½ñG ö3å•ñ|ÈäeöÃæù¤$qóŒmЫ~EBªÑù†^„íYÁž |ðŒç훩Ը mkz¶Äu’ÑøFú7$((šv7  Æ±5l>á,RF†€VÜñàP®nEppÚ ¸žšÇV±ùc„1˜úmÛÐ0Ôèa=µ‡Ícùƈ+yüåQ\×(œˆÆ\?¸5Y+VoóT·\Û»X"{2¸{-‚*Óªÿ Zç­gõ1ûY'‘i›WÔèF¶®LP`eZü£‡5#ÈXx`»áŽìøâ#Þ™•N×;»mö4^<—w¦Ÿ8ˆ_µ{›¸º~(þÁµ¹úŽþ´ò·‘¸~-' ¤óücè|S_"ö.gg–Oýñ±èÜjû Û¨„~Rê÷ånÿí¤¸+ÏT´þ€3Ý;œ´ìYÛ“ÈÏŒc—£)W×LcÝ¡üÓK“’Ç™§ý)c< ü}\¥ŒQ‘2|ýϪ»3? G¥æ´¬ˆoH=úô«K×…Ì-v’ÝÖ Œ äcuamȵ}jágñÅd(àÐò-»ÞBßÆá…7¤Ï- 5žÈ·º§ìMýP,&.8\~Ôþ§Žç9Ί›Çò‹'Ýþ_.ê ¿Ÿ?þþ‡W£ù5Ãy¸'¬üiÞ_äà©?zêãV7ã݉½„±uqçOws†ÁC¿³s|ó&ò[ÜÄÀÈ,Ý—‹ë‚¶éfœ:^ÎéX_¤~.·ç¶ÎËh<\¼uIÑeÞÅŸoÿFjÒ¹n6we¹²¬„8îWfu÷\Fþþì®Ô‡Á]ªE›ë¯§VâZ¶¤9½>¸ïÓ^îiËwzˆÝ¥«tñÊ󸎼´ú·çµþß¹¯eº“Ì•³ƒ©ï,æÞ»ŸåûÛ0‡ ßÇQP¡!m*ì`N†°^/†€˜Æ<ûz¿"Ÿ>ÂÔ§^gIê‰Ó—™ ÙØV2Odkite¸Ù’’6{àý¹·1däËÜj#aÛ"Þÿ|Ãßé6_êôÁÐÄñl‹Ëv»OÖ#óy{š#‡Žæ½0'Çw,åã—~z‘2ž˜6q?ÝÆð{žgH°¤í¿óñËIv˜¨í)F9U¹öîa˜>ØήXwûë‚l7ía·x.ÿèB>žÃÿÃÍŽdb—|Îøù …—S»­›§í]z¹‡–r¨ÉÆ©„-þO¾z>‡mg_@ãL]ÃÇŸ…sÏmÏò^¸™Œý«˜þÑï$:|¨1à:ýÑ»²É4}Ë‚«žàÎÎ[ø¾ª§ñâ®< Â™~2qû<&ͽ£^gP@>ñüȇK’(°.á½é•¸÷®ù0ÔNrìÞÿl=é®2N(âʼnP"ó"XÿumäôÐO,ð^OÛs·ÿÖ‚”â˳ԣO‘úƒ¤Ø½ä\W‡‡sqÚ¬l?T@_ëöd9ƒÇqæíþ”:ž¶$¶¬È°×þCþÓï—*F§Ë7žü=_òÜɺÛV0óÏæÜýÜ[Üp|¿ý²˜ÃÝ/ln±'¹«—ã³ø½Í^û` ™G¶òëÂ…ì»í6è¼·ÖÌæ9w2òW`HbÝÜŸØ\p¼ì+~©7OŒï‡¯#“¸53ùdC ×Ôû‡Žç¾ X¤Ïx<^û9Nîsóÿt}ÇøÅûëGW=9–«NŽåŒ£;ø}ÒX~ºÀ“æïu×=õqÀÍxÏ·y[eŸ?½ž3^ünú=i3súÑcßJöç]èœífœ®LÅãÍüp‘Žõ§ÇÛ“LÜæîÜöòk]r†é/™oÿ.>Ñ-¨m?ȯçÜÊà1N¾§úÕsÌñTwOedmáÓw#¹wø£LfæÄîå|úáR’Î9OvÝŠ€ƇåK½¡ã˜:e<#œ‰¶OALœòÞ×ÿRÎC""""""åAÙ×:yûùsÓqN“¼õÇRÓXµÒ‚#.§b,—S¥t«^øÿÀ–©Ua/»ò/¼GÖ~V­ôÑ8*Q‡×l%«[š´®‚ÏîƒX1Þ¼Éc튃ä*H"""""r+{ò'~ S?Û@v‘¯’÷©u+uí‚õÄælÍ'ºë-Œ¸¡µC$o_ÊWŸýÄætÇy»ÙîfîÜ…Ú¾ÇÙ¸"‹ÚGþuL„·éD5rÙk¥AÓæ\Q³»NgÌTjy=#n¹‚F•ýÈ;º‘Ÿ¦Î`á¡Pn|éÔ¿‰¾Íçס˩q´%‹À†½¹kpOZV Æ‘vuó¾á«eqÔÎħ;µxûêö¤s _R·üÌûŸüF\¾ë²ˆzÁáµlÊê•͛9ó ñÎP·® yëY—ÆZÞ8œ;®jH„¯‹œc›ùåó/ùõÀÙi!¿¦òöcÍ9ôéSŒY“‰¹Æ ƾРûϯò¿9)Dy5—‰ˆˆˆˆˆ\ZÊþÌŸªWq×ÝÃ9b#GÜÉÍm+b*º˜ª{#OëBTâ2fÍÅÕø{¤'UÎI;Yb®æÑû»Q×7žu’‰îÕŽŠjù·1GЮk d¬çûÙËI €Ö]kRáÔËQ=xäákhâDzÅH‰lÃÿÜBcßã,úh‡ϸïRP¤XSxW~b m£2X¿èw¶Y«ÓõŽG¸»eàéAÕ³7ÕÒw³ó¸‰ˆ7rgû°Ëç¡^‡Yµ%"[Ò4Ì„1¸í«Bî¶UÄåh:˜û4¤ÂÁUüºx3™UZqëˆçÍCžx;—‰ˆˆˆˆˆ\rKÕ2—àW‡öëœþ15ksSOýäK«;ʾüì{¥šÙPÑݯ cÔæžþ”…jݺC6+Þ}›Ow[ Ýù&Œl¨’×€ŠlÍU ý÷5ÄÅç²*±?ƒZt¦Žß.¶ç™‰êØä²jòd¾ØU@è®,†w«@d“ØÄãää§p,%WЩRMTîpõlúpmÌÆP)ÑoÞF»k›1ó‡ÂwXücfÄU} c_¼†JUƒ1“væ–Ìr­€ƒ«·h#OW IDAT‘ݵ톰:»µylXq\ ¤¯gÆ´õÙqWÕVDwnE• pMpÜ«ò=Ïe³ãíêü"""""ré®UË\ÂÞÉŒ{îm_ ÿcô¥b˜/P;ßü€;‹,Ô¢ƒÍ®tŒGñìM*\ä;D: uë—ü«†S嶈²bzr×]NBÍ€S®¨Uí;\Vò29šn\¤oü–‰O~ÜÏ]¹F#töËǸ²Žr$jV"ðäå=9)Ù8ƒ5+`2\VÑÏ?´–Í9èܱ M²ê`ÉÛ^xËPc f·Û>Ôkz2Y¾™¼PÒ\†’?"""""r)¯VÿJN™Yvàß½5í¹F|#ªS+ÌÁácV;ýF²’³JÔ‰ôeYºÿ*5=¨UþE£©2:GT¿-]ëŸzÁŸæ]kâ·c¹'r`ªU´@¢‹ÐÖ7sWW6û5Ë2Ïuö“zœä¤daÔŠòÅhÇCÕ@ 9g„bˆUÛréÚ±7ÚüÈÝ´ŠÂÜ/µ®L9üòúó|(Œ¯Žæ†€â‹qf¿Â©ÑŠUÒ\&"""""r)/WÿÚâóØ·xÙÍ;ÐóªV8жï•ÔÍYÊk+VyŸ#+×ÜóZºýç|×gP­sC}í²ü«X¢ÛÓ)r×Nä±É»É°Tã–מ£oó®ÔöÛÅˆï;€N#ï#ï,jwoOÍüUü–éœØ@T[®l|€e§¯LqøÇïì0„6÷>Ì=K÷áÓ¼'uÈcýümd8(øä·*–œŽí‰´œý-_F³¨HË^×av5¢w$ç^e?Ï šScÐ(©—AdËƅɯç2‘KÏ_þ<Øìß2áëõäÖ¿šÁ7v"ìà>7‹=ç|õµõÈ<&|¶ŠÖêtìP•ôµ±dª}ä_ÃLLÇv„SÀŽ?Žpº{Û’Ø›~MèVÛû±ß˜ôá"vYkqUïv„'þÉ—g±+Ïù‡X²:{p®myVòÓq|%ïNœÃúã•èxM/ZúbåôI|¶9K__D^ܶåEnù‚öÿ<‹ÕÇìTmß•>;ùý(P:ag§˜mÇ~gÚ¯ûÉô‰¡y#ö/Útzòv.¹Ô4iyú“Jááç½ápÜ‚‚)‘“r²25&{‘KrÍT½Víó~oThDDDDDDDDÊ/%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1%DDDDDDDDÊ1³7oÊÉÊT¤D4&{‘!¯’?ÃÃ)‘“ÒRR4&{‘KrÍTÝö%"""""""RŽ)ù#"""""""RŽ)ù#"""""""RŽ)ù#"""""""RŽ)ù#"""""""RŽ)ù#"""""""RŽ)ù#"""""""RŽ™‘‹ËX¡2Ú4§A•`ŒyÇ9°}[fa/ñ“&£ëѤ^4af+iñ{‰Ý›D®S1‘Ò»É#þUÛqݵhR»:1¡‘x”[WðÓ‚Í;¹rõkÊ£¯^ÅŠÞakÄ ^º3“wßXH¢ý/¬]‘mnÈUcË_ÍHH³Œуš>E~Ýwi¿ãÝ/Wq´ÀUü'ƒÐwØ\ß(äìÒbùáó¯X°?—ìq*‹h7»ú¶¥n¤/¹ñëùqêw¬8jÅ…‘€ÚW1ôÎÞ´ˆt‘°a.Ÿ}µ’#EÛÂB—‡G>ëmæ;9)ƒiÖÿN†tk@¸¯ƒ¬#˜3õ;V³ºo‹âÊñfû^Õã KÌ5<óXæŒþ€­aôxúe†T+n‡˜õâ8Vu/~û† Ôè>˜»ú´¢j ƒŒCë™3m«ÜÔ±¸úy[†±"W=ýƒ‹î硯xrÜdp±.C{»<ðkþoß_ù۰ïà§>"6_£KDDDD.÷ä1ˆ&×çî.f6Ìýé?Çq,Ç—ðªuépõ Œ~µ3?¾÷ æŸuòmO]ÇÌm¤ëŠ)G,1WóŸzPÖý8‡ßwÇT‹Ž}rUë[xžΠÓbÉ>§ßýë2è¿£è‘Æ湟3ÿ½$Ûü‰n~-#‡´åÆÇÆwÜ~:hUÈÝTÞ‰{nkBÂדø$ÖJõ«Gpß}×qèÕ9liÀû{ažûÏÆZè8ü^F 8Ì ßÂj°P±nsZ·íÎÀ†þüV¤Lÿ†71¼C³Þz–MYA4î{wßÑŽØq«H;·!<”cð÷°ý ¨Ç!Û©Y;šÞCûRÍowáÏÎ VLx†?L.°TçægîÂwÆ›Lß_8±êqדÅoßY¥'#û‡óÇä×™tÌD­žÃ1¬ »ßüãïêgö¶ sUü“øõɬH)N[&™Nðoìe¬ËÚ^çÆÈßþ ý×Td GÑsÔÃôL]ÏQ«Æ–ˆˆˆˆ\öÉ3UzdD“}|:f>G£{1täMTóËbë’CÔ ÝÂ×kêrë½ý9ðúrjÝ'ýý¨ÿüH,_§sý€ ÞÝuŒ”¨~<7ÌÌê¸Ú\Ý©:¦£«øêÇZßܶÑ&Ž.ŸÆ¤o·‘á2Üð;M+[ÈØ»‚¯§þ̦4;˜#é|ëPnêT g»Oçãyétuf›¼1”Ö73ôºVT 4{t#?Lùšå‰6ÌÑÞìC,Ž6ó|ëÍ,uváÚV‘8ã72{êw¬Ã íÐmÁ.æ&ØÏGÑ=‡Ð+"ƒUï¿Å´íÙ¸ƒOÕZ4!p¢é{[WÖŽ]B’C¡.Ž_µVTI^Ä'뎑é‚Ø…¿r°ÛµÔ 1’Þ™Æù«™¸êivX´3`iÃðíHÿyO<5–o“šq÷È.D˜ 6Ä­õ0õÕgyjâ W ¢{xêYÛÜìÛ‰¡ý"ØøÙk<þôL‹«Ã }ká{ûFB[ö¥AÜ·¼òÌLÛ[•[Gö$FONK4­ë˜!e¿í:•ø9É–Àò»qR™uϾ½ÄE§Ž¸Ì姧?Uè~ï£ nlbÏìñ¼ö}TíD›pu4wrwLåå÷ÿä„«0à]—pÛqs!(:sêAROæܬ)q¤ûÇPÉ×®lvþúS¿YÀÎÌ¢™5Ö”½l;E…–óî[/óX·tæ|·•ÌânË1zÞ¾×õ(ܨ¹ò• íœÂ¬ww™»)ÞÓöíIËøb‰7ýw ïNx™Çzgóã—’ê\œ;•/W&cu[?¼.Ã\™ s(ÝîŽqc_ä¹{¯£Y˜ùÂb]†ö*9v‚šÝÌýWÙ˜÷ñvæ(ó#""""—}òÇHpÃÎT;¼ˆu©¾4íß Ó²Ù¬J²á²f’ž›É®M Xí©Ä¥ ññ¸!GÚnH"/;ží{SI]¿„ ÉydÚÎîL#¾fš_I­#?3{SÙÙIlüé'D´¡~ `ƒ9Ð39‡–ñîK“X|üìŠóÄŸ¼ÿÚ,Ø•BŽµ€¼\–€3ûUò>¾Ó‘²ŒYË–•Äæ¹³Ùêß–öU´(×H²àgò2É;oÍè–›‹ðõ³œ=,¡Ä„BzÜQ²]`ð‰¢ÛÈGÒØÄžÙoóÞ¢C$>L¡T Õ—ó¹ã*È 5ÓŠÓèCTëy|TŽþø»s˜+˜°çœNȹ¬¹X±àoñ2±´ùxìeÞ]Ê ‘WqaÃý¶ï¾€9’î·w%uöl¶e;/Êö-Õ¯åÞ^~yûyzì%Þ]Â爐ÀNê®Ml:”íñÊFoË0TðÇ–žÂ¾ÅÓ?ékÖ8;sÿ݉2_¬X{(ËؙÃ;1bX3Ž~û¿ÑÕœ""""R¾”2ka¢bÍP²â’É7ÉK3°†à:4:Ì¢#Vð­Nƒ°,öÍÅÓRÅeËÇê,\$;]Nlù¶“'Þ.\®ÂíT Ä¿áíŒ7øô¢Æǔ̎ &²·LçÝÀÞôö<·`Ë’¹Ì^¸…¼³–ßjt»>-"±ä¦’TàÖ%ïÃÉ$QF§òJ¶Íö%Æ_‹òËž-©Ð¤Jsê­äŒ¢KG_¢›Õ¢$Ë欴¤³€ìð óÇìE—‘q[“S‰Ÿxò]ƒB©@>YZŽzLsÖåš»†rMØ~æ¾ÿ:‹÷eãĈ½À‰ÙïL¢×àã6òmžJ3à_¥&‘G9”fÅUJìâ¥$ué@Mÿ%8Ú= 7ÕÀ+{¦aüêt7ɧ‡í›ˆìy~9†bëa"¢ë`zdþÌ›[³q„yOÛ7Õ¦5»¿eážL¬@ì¯ó8òʵ4]Æo)Þ$˜¼/Ã÷c^9óÉäo¤í+½h¶”Ls57±^DB¦7ûá¹½ì­=ÇÎà[•kG"fóg¼²:»†“ˆˆˆˆ(ùSx¢m0±T°`p¤q$ º6¯Aà¾ãÔ»þzêÙÿd&!4éw+ÍÎáÿŽÚ9}U©8ÉMÏ%cã·ŒþtùF¢¢ƒÈLvâY ÛŽ_˜´|6>á ¹îÞaÜ“ÏëkÏìoÅø«ñNÞ?…ýÙü[þ‡×®,EÚ+¸ !¦MdÛK(U­¤çéö€Ëž=‰5‹ãè7¸w ïÉñOs ×"ÛâÞ¡µšÅûÏùê [›öÛißüz†>A›:E?€1ŒÖÝëaÊÛÌÖd-IÝÎH¾5¸á‘»i¸k/}KºãÌÜ‘•ŒýÊT4o#×>•jš{”ã“i&":ßɦóÂW(Œ_Lر9$/ÏC‹½›»Üoß~^9îëáC•æµ‰hX›7Z Å`0a4ÂCcGóûı|g-Åö]àra0‹$  ..hFóª µÛÐÄ´›u{³pN‡ ›Ó…ÃeôkožžÚ«„Ø2ÓpàH®³,eüwÛÉRŽUDDDDÊ¡R^²b#ywA-šiÊeǬ™l¯>„žB½½sXœÖŠ‡ž¹Ÿ^†ELš¾½Èó,øóœ oP'¶®"©þú·¨L``eš÷§ïlBÑ@p‹Á<>ò*ê…ú`1ºpÀétÙ¦ £Å9äX]˜CÐûêšø[|1]àîX"º3芚„EÒ⺴ÌÛÈš-ÊÅIÊêiLÝœoýþ<óÖk¼ò̼8æ Æ ï@%€Àš´¨pö sf³uÎbÌÕiSǤ…ïŸNüÌi5è^n« çÏgw®V¥î¦±À¦}¹Â°‚™+±„…ND¥`*¡ààvùu¢o«p*øW¡sŸæ8¶¬ç˜Ç+ì$mÝ‹±u?zÔ # ¸*û]EèÞUì͹°vð~ûžê‘ÏÎÏ^â™ç^æ¹^áù s9Vp€©ÿ7‰9Gl¥Ü¾Ä ÈlØŸ¾M# ªBë~ý¨žðÛN>\ºRÃV´ªˆÁCœ¼+#C@ ß{;=V&8(ŠVý®£zÂZ¶°zŽµ1˜º­[Q?ÄXÊöÊó;amnã¾Î9ÌŸ¾ŒcüýýNþó¹àトˆˆˆÈ¥ª”Wþ¸ÈÞ>ŸÕ7ŒbØ5»˜8ÓßÜpæå5ëøî¼|Ñq¶®È/<ˆó³ä _Z§ýÉg_†3ì–ÿ2¡’™Œ¸5|óér’Œ+¿á׺wòðë}ðudqðÙ|¾& §Órr›÷ñÙØ9,k5”'ö'ëè6~[¼ˆý7ßÂÈûyÿ°÷û‘wxG åÕ›+a;ºžï>Y@¼MI{*«?}¤®×1àª64¨^ NppÃZ–ï ãÚÁéýðCðî{|_ä¡Ð¶ø¼7-œ'†¶¡òÕ2ºþA’ò}ˆ¬U‹H_H^=…OÒ­(n™¨T'š€è†<ùRŸ"¿ç«çDZ,mÓ?ZÊÝw>ÉÛC$lú…w礠„Ró÷Ïáã·rËðç¹1ÄFâößùäËMd\`ΕëíöKªG:i'c0ä`wÚÈJÏ$×^†íÇ/äý~ ò Â\¤ìZΔÉ+Iv_jö½‹ÛßaÇ¡l·ñ²yYÆÿ¾žÁ¤¹·pç°§¹9ÈNòÎå|öéÉ÷yŠµO4½ï¼ÓäìÉÈ/E{¹ Û]ìü¨Û©)þf#×ÿ÷U®?«Ä}|ðÄ;lÎÓ‘?Cƒ&-O/e*…‡Ÿ÷†Ãq¨XÌï,•;1|ÔÍ4<±’l`ÏáD2œT©[ðäM¬O´–§PØöÆt^ÄÿÞ‰EëËWZJŠÛ1á©ÿ7Ä“^Aeû>¦½ô+Óœg½î[¹ =®êBëúU6Y9qt–/aÙ®4lºè§ ±¹|ÖLÕkÕ>ï÷eúš*[Ò&¿²›¦½úÒkÀ]ÜT5œƒ•ŒcûX;g'­èi8".2cg1îlnîd'!ÏuÞëI±üúu,¿*X""""""r•ù;Ê]ö4¶ýú%Û´b)i´¹k>Sv)""""""ò÷1+Þ/ܳ׿ͣë ù÷0*""""""""å—’?""""""""嘒?""""""""嘒?""""""""嘒?""""""""嘒?""""""""嘒?""""""""å˜Ù›7¥¥¤(R"Š½ˆˆˆˆˆÈ¿WÉŸ€ `EJ䤜¬L Å^DDDDDä’\3G·}‰ˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cJþˆˆˆˆˆˆˆˆ”cf…@äâ2úU¦IÛV4Œ Æ”—̾­Ù—‰½ÄOšŒi@óÑ„Y¬¤Þö݉ä8S)½‹ü1P½×_׉fõjR5ÒâÙ¿y)?Ì]O|Þ_¿rõ©u+¯ ÏdÂ+óI°«QåŸb$´ÅU¯ã™gúPÓtœµ³¦3uæ|~ßt{d}š6mEûJ‡Y±9 ë9}Ôè_ÁÏ=N¿Z¹lüi:“?ÿ†oç¯bKrM;¶¦m—¦¶ýÁ®t‡bï&ö,TjІn}naH»öÿ¾ŒYJ—‰ˆˆˆˆÈå·f ;ï÷e¸òÇLÌ5p_³=|øâ/ÄÇ\ÃÝÞB ¿,¶üvºa›øre}nèFöŽþ•¨G_ ûêWxuiNLTéû/Ôÿ…§ÞÞŒ¡ÑuÜs{OšGYHß³”éŸþÈúT;–êyyhóv5bP«CLzm1·ÜÍ­]jìLgç‚/xö. Â;0dP&v%Ïe!²íMÜ7¸+uCl$Æ.fÚçóØžáÄ3€—ïvðËÖš ìÝ„G 'È·±YºªBÊÆDË›ûP,VNË”­Ù'ûÔQìÞOú³£Ôñ&zÌÝÁOÇì猣;¹&2ƒå“^çó“Ÿ3øQ­U3§!†C¯dõ˜ßHTþÇ DÕ­GŒO¶…CDDDDD¤è’µÔ mÍà^.~üðgö_Ó#j²åƒ—xü…YôêNà®?XùÃçüjkÃ5µ ˆ]Håõ2¦Š´hÌže»É iǽ÷uäÄì±<üèf$´äÞ®$ÒT¸Kõ^ô ÛÀä‘ÑøVno°)£ŸäÑ7aì1„žUÎÎ_™+÷à¡»ê±oÚËŒzì-~Îéʨa­ 9YSŸjÝéîü•1ÿ}†±‹-ô¸¥á&u)#K mëšáø æïÈ>;™h;ÆÒy»pR™Öõ‚Ît–hºvŽÄµÿ'fo;•ø‰¦ç¨'¹³©‰Ý3ÇòÒwG¡zWÚEè]n¹²Ø>wS¾œËöLeÈDDDDDDŠ2–öcÁºRýÐÖ¦øÒìƘ–Ìby¢ §5ƒ¹ìÜ€Õ–J\ªÐÛÿ$%ºuý ÚÐ)äKwçÖ²uÏfÖ†D²²Y7ûöE¶£aÐÉ]+ØÇ·3–±ýH6À` ",ÀLNÜÆ?;Ž…ÉEzf"Út¢âÎÙÌÙzœì¬£¬þa>)õ»Ñ(ÀP¸FÌÛÇÜEûÈÌÏ`ß¦í¤™BðÓwžI™G’ /“ósåš“ƒðñ³`(ú’9”japbÿ²\`ð©ÂUžJü¼Å„q$ôù2CƒÒØ´è'fÎÛDê™8}ÉIL?ý\gÎqRlþ„Ìð8²SÈ8u×Ó¥Û½äâ°¥²/šE· ~ð2Ö¤}°/U[Ô¦$Íâ¬ëRœdåCŠX|ªpåƒO1´Ù©ÄÏaò]‚‚¨@Yê­""""""ráJ™ü1€Ñ€Åσ#ÉнUM‚ö$SàêÛ×2ÃJ³·ÑâÀ¼og›þÌ¢w§&´®ÂÞyûÉs9ÉMÏ%}Ý žùhyƪT "3ÉÕÀårQ¸Œ6âŽ-öGÞZ:ŸðFôh$dáõý§WÒäž(  F(¾Ä&£ ·ä±.ß 8UšÈEeOdÕ ¸£ÃG^Mò ٟフ; fT¯0È\ÁÂ}ùgÎv”õûìtlqw?I»zE?€±"m{ÖÇ”·‘͉úö*¹p¥¼áÉFò®D‚Zµ ²)‡Øo¾akõ¡¼úÂPìùimxìŇ¸Æ¸€q_l£ðKwìß¼‰ü710òK÷åâÂIÚæ$5º‘­+X™–ÿÃèaÍ:oÏ ·º§ìMýP,&.8œE¯†°“¼~-' ¤óücè|S_"ö.gg–’>òWrr|ÅgLÙ˜…oüðÎ8Þxá^{soŽìD%€ Ú´®pö sf³å‡…³Ô ]=?ç¿ÍÄ“‰ƒ¥m?ÈÐúpàç_Ø™«>,""""""®”Wþ¸ÈÚú +nz„‘×íàÍ_ÖñÅkëμ¼ò¾.æSö¤ÍlÌéG}+ÙŸwr훺†? çžÛžå½p3ûW1ý£ßIt€å¬O;H^ö¿Ô¿›'Æ÷ÃבIÜš™|²2gLÑm,á½é•¸÷®ù0ÔNrìÞÿl=é®2}µ™HÉì)¬üðe’ºõçÆÞíhT£&䧷n5¿ï£ß]¸öñÇ`ÂD¾-òPhëáyLœÁ3#ÚÕç^iGb¾Qujé I+>æÝE‰èº) Cƒ&-O_NP)<ü¼7Ž;@@Pp±ö‰êÂ= ¡qê2fÎ[Ç΃ d¸‰©WŸð¤ ü™`U„¥ÜÉÉÊt;&< 5‚›æ¹GºeßÃgϾͲTçY¯ûF5£Wï+hÛ0š³•‡wñçÒEü¾#õô3¬ûÒÄ^DDDDDäòY3U¯UûüiY’?PxkJó«ûsM›ÚÔ¬A€ÁJFü^Vý0™[2ô@e)—ƒ©t Áûr[;‹¦/`_ž2:_ìEDDDDD.5Ó_’ü¹“Æ„b/"""""r)®™ŠKþ‘òKÉ‘rLÉ‘rLÉ‘rLÉ‘rLÉ‘rLÉ‘rLÉ‘rÌìÍ›r²2) Å^DäÿÙ»ïð(ʵãßÝì¦l:¤„Þi”Þ« HQAÅ‚½cÇÆ+°<ˆ QEé" %„PBÒ{¶d÷ýƒ $!"z$þ>וKÜyfæ~ÊÎsï̬ˆˆˆÈ%¨JÉŸAAŠ”H‰Œ´4õ Å^DDDDDä9g*nû©Æ”ü©Æ”ü”?ŒN IDAT©Æ”ü©Æ”ü©Æ”ü©Æ”ü©ÆL ÈÅeô å²ö­i懱0•C{v•‹ã¼kºáÞ„–M 4ÙÈ8Gt\ NÅTDDDDDD.ÜEKþ:3õ±æ|7m.{­ ¬üño5œ»néM}÷R/MÆö¼ýéF­®ò×ômÆ 7qõeþeßȈæÛ¹Ÿ³ü`>.¸’Ð× ÏcÓS§Ôk‡?ç‘W#?Z ÇØžÍò(&÷èï,ž·€õÇmebjŽÈÔ±øé÷ˆ*6² õ›ÕRM9RøuU<.S3nšØ—†éŒ!Gs[ïÈýU‹Ê®gObÇAž­¯fü=g'~c ‘½šàVx¨ú5©òðiØ+›øžÐœÅvìNÅ.#Á]ÆqçàÚœú6£Ù7ØnHpäͼüÖ,Þþ:êz5ãîO3¶‰Ü¤8jÔ£Fɸæ^³‰¤* '"""""—˜ ¼ËÊ‘»1NÉ Ýóù%µ&½FvÄ߸çôæà^ŒîümÔ0‚¶…Û™‘¤É«TWNÒ6Íg^ó‡˜ÐvS_ëCò‘tŠ}#ˆ,éf>õiSß›¥Ÿ äÌ#jñ*’žHûF²bÖéÄÁTƒ¶#oã†Æðí2ö(éP!ï6Œß¿9‹ø-Ñ@£ÁWQ7iŸgÚȉŠÃxÇPzÿö)ëOxÓvhâ—_HÁÇÓ˜j>™¨3^ÁÝ÷\Æϯ|ÌŽT;V÷_‰õº‘!í63o™Îƒ[S¼ëCŽëʹĸ…Ôšvê,Ë9 dgeâUÎ뎬CÄÙ›2äúkÕ£ù›V“êÏÁõ»È íDš;‰òĤÒÊcßÌYLt¶Œ*—¾Â‚‚rûÎBŽîø˜‚B"¨„¯1›Ã»Ö°d]:a­.£õ—áqh'±ig~¶Ý™Ïžô Úµ '¸Q$Z6åòöݸúºôjìKê¦yëûƒ(÷Sqìmi±ì³5cÈèQ\;äJênå³OV_è‘uˆxWú]3š1C:P+c-ó>ÛÈ1« §­ˆÂ¢’?Cݺ³ûÇ ³ötö4Òaô8ÆïHÍ#KùàëÝd–ÆÜiÓ³¶­‰ÍÕ•"""""ò¿Ÿ3ùžóº¡Y˶§§”5ƒ‚ÎYàHü!j”ózÅ øt¸»¬äñ·¢)T쥚ÉHKûƒ}âd¿ð»|4LéN¨ãó§½Ã† g™÷=B[Ò»OW"›†áçf#3q?¿¯[ÍÚØ ìJüü‰Ø‹ˆˆˆˆˆü{æLu4<çuýü–ÈßÂENôB^}+k;;H*tó¾5%šŸ¾ˆæ'KDDDDDD."%Dþ6.rb—1'V‘‘¿Ï_üq‘·í îß¦àŠˆˆˆˆˆˆˆü¯‘êKÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jÌT•…2ÒÒ)õ Å^DDDDDäT¥ä·¯Ÿ"%R"?7G}B±ùGΙʣ۾DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1“B "RÆqàw`1°(,@PÔ2Kþ›xÖ’uOýÛHÿ†e‹€ ’·:õU¥ˆˆˆˆˆ€’?"R=d ÀJ`#°8\ò^8аÁTœ`1q2±r8¸ç%ß’ã ÜÈÉd»š‡ˆˆˆˆÈ¿›’?"™Ñ+”–ÚÑ<·ˆÚÎÎøç]Ó Ÿˆf´nN ÙFú‘ýìÞ—L¾S1=,à;à `'“:¥/ùû7Èö‡€…À}Àp ‰š‰ˆˆˆˆÈ¿×EKþºòÔÓ-øæÉØSTÁB^­ytF~yüuv…\ÏKs˜ùü2’ª©Œ´Éýwô£Aék-†!}ë™9w=Ǭ®ò×ôkΰ['2¢¥Ù7Ò£XðÑ<–Åå£P¹N&~ ž¯Öï{SÌ­CÛSÇ·˜ìøßøæã¯XwÜF鈻׾Š§mÌ7½ÅÎÂs‡Ã+GsËð+hêIþ‘-|3ç Ö³V^†ÑŸ¶#'rSŸæ{“sx+ß~ü_Ö+»íª–_ùr½ç tðÓÌ]ëT!vàä¿´þå'Öü'Î: %€DDDDDþµþgWþ8Ò~ã‹…v²4£•j½ö`º·uIeóÂoYµç¿Ft6Š~o`jqω"÷¬6o´4aÌã÷30$ƒíK>â‡MûI¶[¨ÝvwŽ»‚ë{—^aQüÙIáä­^‹Máb¦Œ fÓ{Óx혉†'sÇäì}q%'ŠK–4G0ð–aÔµì-· cP75Ió_çÝÝ6ê¾»ïJüÓß`¯¸ ï×qk羜þÛsýh9l ·OèDÔKëHwýÁòϳÜÿŠß;ºæ Úf>ý·Ð^Ü3Ö-ký1ÛRÀ˜ÎÉg‰ˆˆˆˆÈ¿Ì…'ŒõÇ­W·¡ÉüþK,†S¤PºÝ8‰ë»ÖÃÏ™ÅÞåŸðî÷Yt`"-½½höü|SN%~^cæòx’Ž?uÝçŠF¤zC¹kP1ß½ú“§<ɬ5þ\[oj™S(}oîIúÂ…ìÊ«xre“žmÃiô ¬Ãµœ„Áà†ÑÌzž•¯¾È§mgÖðlÀ¨Gn§eÌ|ž|'ŠÌÓÃOeeÌ`}‡‰Üã5©ŸÀ ̸¹ìØœe/»©¸|ª¼ÜyË0X¸¬OS27,"íÜLW/5‘§ LþX9¼nÆ{¯cÈ®Yy"ˆ¾×u"À¸0à×îF븃™o­$ÑÍ…ËÅÎ’™ˆÁŒÅÝpN‰æ¾ŒéÍœß ¨Õh" ·ñâqMvåRá$uýÇÌiñ“#GðÌ[ýI:œF±omj×(éf¾ ‰làM\ég9óØõí Ž?{›@ò²W˜U’ø1˜kyíÆ7…C ~`o^Žúàž¼uKBöc#wkÊÒx—]3œzÇ×2'³€ÌŸäÁ’1Ç؉jÉO/ÎfÛ ;ýhÙã]or5½ kxsMæÁ„¸lädä°§Â2 pšöc¼g8ý6ÍeMŠ7‘×ô#pÿBö繪X~6ETe¹\Ü[UR†ð¬O—Æylÿ:»¼«œnVsùwºà‡êÅ-â­Åã˜|çó 7¤°uévûÕŠ9±ös~h:‰‡^ŠGqñ¿~Íì é8&¢j0á¥{)þðD©Ò\^Ãá–·0clMìǶðù»Ë8¢»äRâHcÃûÏ‘Òs#ûwä²zõ¡(ƒø­›øe_ CoêÊ €™³øªTÈväGfÍ fê-©5ø>žoOr‘;µ5$ÄRÖÈÛ+“Q*´\À5¶£Ëxc¾×âÉãŸÞöN óXjÌ>|-'Š]—IzÉÂFC§œÌl €gmMš€Û{O²¸IÞ-xbúÐRÅõ˜÷èôÈÕé™îé¤ y~§-3'3»Fƒ<â¾õxwé Ö±“Ÿ3\`÷HÚ½²èݹ¿ûd¹HÇ£vA“&dº½÷dÍÅM"ò¼#Z¸?1}¨0îpÔ6ïÑé>«ók§ š4¡†Û{Of.nQÃ;¢EÞÓ‡zÖ’ýpŸ÷èkÖ„&>Þ-2ž˜>4ȼáèÞyNO[î*toCCG?{YÑt刈ˆˆÈ¿–¡Y˶§/'¨tÎGâáíë÷Wî¾W<Ä+ÝWðÐëQ¨Nä.?7çú„¿Öcxò¾žÔrìçã'Þ`mzÙ_¼ó¨ÕŠ~ý»Ó¡y8þ&™GbÙ²f%¿Ä¤cÓE?ç‹}ÀÉŸ~? –’¿X ˆ|9™4© äîœL°€S¿/ø:Àå%ëyÿCÃrø˜¤–Äá”@CàY ¾ZˆˆˆˆHõŸ3ÕmÐðœ×õsZ" 9Q_òÒë¹ÜÐÕAâ9·p¹°&G±ôÓ(–*X"€’çÿü =´çdâgm©÷zr2éS_MDDDDDäßKÉ‘¿‹œ˜ø F‘¿Dý’¿^ …ˆˆˆˆˆ”öHþ¸ÈÝòwnQeˆˆˆˆˆˆˆˆ\lF…@DDDDDDD¤úRòGDDDDDDD¤SòGDDDDDDD¤SòGDDDDDDD¤SòGDDDDDDD¤SòGDDDDDDD¤SòGDDDDDDD¤3Ue¡üÜEJD}B±¹U)ùS#(H‘)‘‘–¦>¡Ø‹ˆˆˆˆˆü#çLåÑm_""""""""Õ˜’?""""""""Õ˜’?""""""""Õ˜’?""""""""Õ˜’?""""""""Õ˜’?""""""""Õ˜’?""""""""Õ˜I!¹¸Œž¡\Ö¾5ÍÂü0¦rhÏ¢rqœwM7|›вI8&Ç∎K¡À©˜ŠˆˆˆˆˆÈ…s ©5íÔÿX,–sÈÎÊÄ«œ×1ÐaÜ<6¡ŽÔºÜrK1›b­=‚çïoÌþûÉѤUª¡Â‚‚òûFü[]ÃŽgP»f4nPŸFM[Сk_:‡å²wÏQr‹Ë/ÓèÛŒ¡·ß˽£ºyys.kÑ’ÈN=Ô©öñÌ´+ð•Æþdükv›È51Dg_¼–ë ¶náp¡ë¿èø/6¯Ë¹ÿå1Ø7üF’ýb•ñçŽÝ\÷ân:óø³ýIß°“´âªÔ[)†3嶛ÝPú´ ¢ðP,Gr‹#Þ ûrë½·sëuýh_ËÊ¡˜£ä”.×àO×{ï!òèöå–„ÑVÃoåþÛÇqýðôjLÑé2Ko;–ø€^å—_å2bØëjÉè;nçŽñ#Ø.˜¼ý{9’ç,S_©ÁCyöÁÜ[~¬ ê÷¸ŽÛ'ÝÀ¸ë†sU¶Ô5§Ÿ†µt×3Õfôó/rÿP®ßIê©ìºG#&ÌxŽ)× æê!'ÿ†öjKxñQbgc¨ógëÚDpÇQåדGcnyew–ÚöÉ¿¸¶obž ÏÚ];ùn½i$#®êÅ•}ÉO8Äñü‹ÛgÍõFóÂ=µ‰Ùt¼ÿÁ¹XeÛ¯¸o˜ü83F¹ømÓ ÏtxZÞú"¶H`]TÅÜÞÿd?v]*Ÿ""¢9SþåœÅ\ð'{(‘-ŠYòÒÛ¬.ªMšÍN–’=ò/fŽÀ½wö¦ilýn1¿ìMÅáÛ€NCFÐ'ò:rdñÌüèsN„–ÆŒ~ø.úg°sé\–ýÇ »…ðÖƒ˜<¶#¼Wg²$Á†N5+;K÷§yó^í¸úÆ[¸Ëþ*¯¬L9}¥¹ö•´÷LâHqSº5°Sp¦G6Þz•…GìÜ,„\>ˆÛnšÄÕ^dÑŸ¬.cPgn½¡üz: PœÃ†·^aá‘Ò™M'ö"¯¦Œ¹{$a›>áÿf ÛDËþã?ÅEÊKß‘`»xÍÊ‘¾•¯¿ûß—]ØöœØ¾…´WryàFÖf”|âyÖ¥sS;»gÁúgÚû¿å³@DD¤–ü1Ö¤Çíéàg¡í÷QüU:ý‡dñvìqÒË.ˆ_óÜ|}/.5“·ž/æ}ÏŽ ¦ð¡<9®˜Ÿ¢ëquŸË.N`å'±0&—Ñ‹z=®eüUí¨ãc  q;ßÎù‚uÉö“ëM0±)¾!:×Å-q#Ÿ—DäµCéîFâºù¼ùÕn²]o[ä¢3úÐfÄêǦ÷f2?:“§†ÇIˆ‹'çá©\sÅpz.ei’£L ï;–~ÁÙl|÷5æïÉÃÜ}©Ó¦%€Óκ±yÆjRŠêŠçÐiY´›Ï¬fB¯ɤWÒÀ»€„­ß3÷«-$ÙM„D^ÃÄQiäo'%f _|ºœ˜gÅãQ¬ÝKuE3>bwhÿrÇsaë„˯> =Ž°xU4IùÇغø ":QÓÛH‚ŠûxEmÈ­ü×­5;rí59¼{œd—ù÷Õ˜¼rÆ"º^Ǥa‘„“ȯË÷R»»…/¦ͱвãßGÿu;³}*ég)NÛÁ†´tmÀúõ™8Ϻi^ÃGm€Ï·÷SËùt¨x,pUÔÝjÒãÖÒŸ°1S_LjˆÈ%6e½ µœé¬ûp.Û²ãùlú‡l¬àƒ{&ÞÒ‘¬ïgòУ3ø*¥“&w%ØíäûæÚÝéî\Á+O<ÍëkÍôyÁnàV³3ㇳýã—xð±—™߈k†4À£¤\÷ÚWÒ8ásžyâMV»sûä¦DÏ~ŽGfþ‚¡Ó`" çݶÈEe'²‘ Ò6òsì©ÄO {ë–ïÃI(mùPæœ×T‹Î‚qZÊ’˜S‰Ÿ0zÝv?cZ¸±Ñë¼ôMÔîLû =¢«²¡Ì¯I ¬»cëË×…³ûãyø¥/ˆ©=ŠÛz…àÒƒÛolÄ¡/¦óàÔ7ù±  “oj‹¿±’ñÈPv¬Ûälwž1­ƒ¶óÉœU$y_Øøgª`ÿÍ•Ži%Ç¿cÛ÷Ù¨}Y0fƒÍpÃiê^á´ª‘Áö¸0ÐvÍâ¿âù©/3?®6×OîKD9MÌt1ãéJaù»ŸSp€9/~Ävc»?£³Êø=—Óu_tž6R•c6Ur\6ðl4Œ)CýØöŸyôåo9Þ´+%“ÍV£¹¾é!æ½ðÎZ¡ûhzÕ2•i·é1óxîÝ-œœOð oL=•äð Æ”ž@zIÞú¸—u IDATØ–O–%‚špå±÷§Ìûr9{ËÜæ–ÇîC¹x¶½‡·_{Žzf±xATÉíN§¶}c…åóʨWžV7<À‹ÿ7§oëM­¢ŠgÕWŽ Sp{:Z—1}êSÌ\k¢ÛðöÁ«n["27³ñ¸­Ìqäíùœ—ÞÝP’øðoo `ôä>„™JÇ­¨J埯 _w<ô aâ2>xk?g·ã–Û{VNBÑ•Ã’ÕÏÔ«Ù£O_Œ™œç Gº¸Ü¶_“Ø“g[Acº7ö:“Xw«AŸÇ^gö{o1û½7˜ù@_Xÿ9ßÄY«Þþ)¬ùïfüGÝÃýíü¸`;™.pUXO§Úc`©mŸüûðåñ4÷¬ñ,|ùu¾Øã¢Iÿ L{í^~øf†¶®‰¹Òý©¨ 9+n[UlÓUîg¸S»k$¦mKX}0›üô}üô},e{szüËÁvúõóôs8Ißý+Iµ®¤u <¹²…“¨Í‰Tõ¦ÎrÛj•Æï?¸¯"""—–¿ðR7¼kú`i~#/¾:æt®ÉÝí1ž'Oì‹óÒÈ9õíÓuúÄÝ…™z=o`p›Ìé¤X-e®–pÙ‹°9O.ét9±ÙKÖuárUaÛÙºW[.2{‡Ò¡eXkšønà·ìÒgÄ„·j€'V’çQæ<Òi%Ï ^Lîµè:ùnhy*ñsŒ"—ß<)"תo+L5[ÒÊÍ×ùFêÔô$ÿpNɳA\ßŦãî4jíAþ‰ìÓ“W~*évoÎ3ý‘1Í™—J–͘.püsçÜý7Q皊Ë3Ÿ:~¶cQ$û_Aý0wêØcøò÷ztèQ—°â†ã¿å„Ì@qvÒ™I=“Ä<",fBúÞÇ3£êáŽýŸ½Ê²ÿa<Ï_Féº/¿J}x”ÌFÎéoÐ ·èï)p9)̶a ñÁÄ ŠÚÝX?žÙV¼ëøãN"ÀàDMs!Û‹œ§g„®?3®Ô—ËU2 ¼Ðñ¯¢ý?ÄÖ Ë+Ærù©ãg~;2®æŠxûã‡óɉ¤c[oW$b+™»ù…áﶃ<` ÌÇFV¡«^çîU§öÇLýÚÿ£x†U¥ŒÒuòÍ`4”$1 ˜ýjb1¦™†–{ÌβûTáq¹*ùlr’ŸiÃ/<7²qf¿Zø™NN¾½‚jbù7×-Â=¨9WÝ6[óŽñfÚ™}7xÔãšû&Ñ<ö¿Lû š¬â3û”›tGzÔ0í¦Àî5ëPHj¥ a7‚»ŒãNÏÏxæóCX£Ù7Ø”é3Ž Ë7<°*eãLÎ<ëÊ N—‹bWùûXÞ«…Gw‘\³="Ö²à°õL7ÄØ¡>üuxÖ§[ +kÞz…¥I'ƒdÈÓ;ÓÔ;Šívù™é¤¦ÙÿÄy‚K³A ð‰'¹æÖÛË7 ÖJêétZ¡‚mði;…éýç¹HwËžÉþ KYÑ©=}êy±ªÂýqâR~z#Æ·Ü×_;T•6]Y_->k,p§QC–P_LdœGü‚ð6f©ÓÓã_Ù8WÜ7ÎÞÆ©‚²ˆÚpœ‘=ÛÑ2´†=Ÿrô¼—“z.w,°U²¯"""—¾¿ð>'™QIi:œamBññ ¥õ°)<6®%¾ÆÊOæf3XóÉ·¹0ù7£ÿ€úX̸þêm‹\x{OÛ4Ÿy;óðh:Œ©¯½ÄóSâÙ_æʼnWRÀ§>mê{—ítÎ<¢¯"ÉT—ö¼HYñîéÄÁTƒv£oã†Æ°lû tåOùC† Z›Ù—‡;‰›·co;Œ¾ýñòm@ß±Chc±“²}+™Í‡3¤eŸp:DÐ Äæ¹þ‚qåBÇ ŠößAzE幕>~À™MÜ>'­{Õ&ko Öœö· oÝL¶9ó@gsp/Fw¯O€om®AÛÂíüšä¨âþüÙxšñòpýÉqÚŒ—‡¥Ì±;‹r)®Ù’Öu|ððkDÿÁ )ýh‘ó³ƒÔ ‹J>›¬Ù¸c—‘ j^ŸšMé?²cÉ3U øµÓûÐ$À³Ñ…ËN—g©}7âsùºÖóõúdÌA\ÓO#X~%Ö«3CÚái £ËàÖïÚVê¹*åf¤I‰ŠÃ9”Þñö«M§¡}ˆÛH\g™¸U\~ÕË(ŠßD\\Û©6þ>¡´½ê*ê§law¦³T}Uþ!îÌø…\ô½ûV†G6 VÍPEæÎI­ÈXµ’V–†]héØͦƒdgg“MÚ¡-DÙѽ©÷8©©¼<ê3tLSö~öÞ[œE—1Ý 3U^O§’î^^X,¥ÿ,x¸Aþ¡Íć^í#ÚÓ(4ÿÀPšvÆðtvîÏ"­Âý©  9 ø–ûº³Šmú|¦Ø8¶q®ŽÃèÝÐKf z–óž—UÖ7*â"'f#ÇB1¦³‘¨Í'“Öçù¦â¶šï£#ÛÑ´dÃåù°¯"""—Ž¿ôû gÆ>þ4ˆ ×=ÌÌš&²ãåËÿ¬#¥¸² ;Éغˆµí&ðì¬aä&îæçU+9xíuL¾ò ïùóÛùK8ÒÙôŸé¤t»Šá}ÚÓ¬n=°f’ðûfÖÅ2hL'úßs7¼ýß”z(´ýØrÞ™ÄCãÛ:` O7M ¥È ñ€›æðþ/g~âXÎâY‡¶^{YZrY¿ýèO¼¿è:&Ýö×x[Iܺ„ÿ¬=Õ¶†¿dâOðF@1©1¿0{þv²]U+WÌeü«xÿmÖôòË37¢©ã'ö$@CbâtØØ{ÄÆ ZQÈsBÉJ…GÖsô²ñ¼pmMì‰ÛX0{9ÇìUߟ Ž§=•=GjpÓ3S(zæà ŠÑé2^ú?¬q_0­äØÉY´írÆ?:¡i±¬þi G»Y­¢c.½-ljŠŽË‰±’Ϧ7¶,á½Æ2ñÖ§j8ÁöåKÙã[(&u×üÔx÷LŒGq. ¿-bîoú6>Uofj6 Ç;¼9L\joŽñùS¯²6#–Ï>XäqðÆøb’vüÀÛ‹Îû ”¢ƒ‹ùpùõ\7ñ)FúÛIÞó ³?ÝA¶G®.Õf\•”_Å2œ¹»™÷~ÇÝÃŒ›ÜÈŒÛÀÜÖs¢¸lXɇ¸«ýßÌäõô‘\;j WzàÈM"zŇÌù9»Á‹æÝšS¼ûƒ²‰/[[¢mÜ×­)>{²/Â9Š;u‡Œ¡ãñż°?œƒß°²ç½Œ½r7‹#*©§|ÀÍn÷¾H·³¶uðã'xeÛf¿íÉèá¹£g-üÍvrcÙ0÷–wढý)ÆX^ú5•Sy¯gPV•6ýÇN­‡äÃÆ2éîç^x€U«'µ‡§ë|í°¢¾QIÝäƲ6ÞÄä°=üšh«ÒþUØÞ]€{8ýÇÝ„ÛGOñI%cëöUDDäRahÖ²íéíšAAç,p$þ5Êy]äß*#-íú„¿ËGóÈ”î„:0Ú;l(ó+yîãÅ.+yü­è3»Ñ1‹H%}È#´%­ü°cÅ€gó‰¼02WfüBj±Æ‘Òœ©nƒsŸY§;™Eþ.r¢òê[y\ÛÙAR¡ëœ÷­)ÑüôE4?)X""òû ÃûrFß܆âW¿dWa(4Ŷ÷çrž{$"""ÿDJþˆü'Ï9±Ë˜«HˆˆÈ¥Åÿs7ãæg^åVCÇw|Ï?&bWhDDD. ºíKäÒ­GŠ½ˆˆˆˆˆÈ?uÎTÞm_ú ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jÌT•…2ÒÒ)õ Å^DDDDDäT¥ä·¯Ÿ"%R"?7G}B±ùGΙʣ۾DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1%DDDDDDDDª1“B rq½BiÙ¡Í#üp+<Á¨íìŒÏÁqÞ5Ýð‰hFëfášm¤ÙÏî}Éä;S¹pœü1E çù)&>œö ‡íaO¼ZóèŒþüòøëlÍWÅÈ¥ÈH@›‘ÜG?¸—zyØÒ·þ—™s×sÌê*M¿æ »u"#Zú—}#=ŠÍcY\>ÊU6 …rõsOÐâë©Ìˆ­Ç]3ïç So:È:Ã/_Æ’=9'ãèфɯ>D7ï3E8óÙúç|²*§¯ºÝsà ®l\/W)±›Xôù6'Ûp)â"""""r)M™‘‹Ã½ö`º·uIeóÂoYµç¿Ft6Š~o`jqω"÷¬,ŽÑÒ„1ßÏÀ ¶/ùˆ6í'Ùn¡vÛ!Ü9î ®{ìA<^z…EñV%ªÊžÉê·^æë#L–š4l?˜›ï›Šÿ¬™¿·àdY¬}ýÿø2ÁŽÁÍB­6C¸kÂm ßÿ,_žhÄM÷&lÞw?Y¦`ZžÀ¤û\$?û ñ6…XDDDDD..ùcôá²÷s_¯æÚâYñŸ÷ø*:§ÁLH‡QÜ>¦ýí$G¯bþÜÙ“ís(ÝnœÄõ]ëáçÌbïòOx÷û,º?0‘–Þ^4{þN˜ö![suƒ\BŒ¾´½v0uÉeÛ3˜•Wr¥N"‡ö$뉧Ýi½—ư丣LŒ8Ž!Ù¬{s:sKÖ3¸ûR§]+§!‚áã{°éÅŸI.V¨«Æ…­°€‚;ä³sù\r§ñø°V,Þ÷Y8±ŸZ†nþ™uC:Ò¦Ž“µ<óÍŠ(Žçeó7ŸQ;° ÁÞFâmŸDDDDDäš²þ™•Í!¹Òº”i<ÊŒ_LôÕ‘ #˜B{s÷ÍM80ÿ9îzà5¾ÏïÆ]"ñ7ði}=76;Àœ§áþWVbì=–¾Áiü8k.{òãøà™÷•ø‘K9‚Mºže1yeoѲgͱ8 %²‰oÙNg§[—\—°h÷©ÄO8}ïz„q—»±ïëL[u»Ñ1Xê]8Ç~‹"7¬%µÌå…¾:С¦•¤4+öÌ}Då4bü”1ôkS‡@w#XãYøîçlÉÔø$"""""—–?5›tåE³hE9V(ؾ‡ŒŽ¾xM·ïL½ß°8*•lúvžïÉeÞÛÙcƒÙ—@o1ñ«yý‰Í¸ƒY•!—0£‹;P˜Cá9¹¶ü|l€»—C™@@ÈÜv”\ÜÃè3åTâç5f.?‚«éòiG@7Hv(Ö¨¸0 «9O#àÜjÐï©·éwz GWÍæ«}Eà:Ä—/¼Ì]é8èVFM  ðpë~\ÌÒiØN¹„ü©äOq^Ù§æ¢N.€ïä'ga+y@‰3?•4»…@/¹;>a–Ï`†M~Žñ¾ìX¹„¯ÜAêB.eöt¤A«ð64õ[˯Y¥ŸÎãAí6 ñÄJRb.eîÜrZÉ-‚F5¼1»‡ÑcÊ£Œou&ñSä2àëˆ'Vr­ºâäÏpó ÀÞKÑ©0ç°éÝY,:êW1E¹Yä”ÄØàfÆl;Æ–e_²eÌ5hÖuãïxßWŸãÓƒVTDDDDD.ê¶/W¹ŸuRiÅ»V§~lÇèD¹¬"'–à ìÑßñÚÔû¹ãÙ¯Ij3ž;»ý¹ù_s$³qÅ!œ¦Ë˜8y¼K®ï1¸Úi wõ „œ-¬8PTv={"Û8ðls “<;ñkСoSÜ ãØ©«~þwj_Ñߤ=$Ÿ¾lÇAAf'RS9‘–q:ñ|"ïå­Ç»S³¤]ö b×-á§c>4©ï£ñJDDDDD.)ÁCDœØ¶™ÌA#Ö:…Ň܉5„à¸oØ›kįë<Öq3ßZI¢› —Š%“.ƒ‹»òõ›Fr©q’ºþcæ´xŒÉ‘#xæ­þ$N£Ø·6µk”t3߆D6ð&®ô3œyìúvÇŸ½ŠŽM yÙ+Ì*IüÌ5‰¼v ã›Â¡?°·@ý¢ê ¸{Y°X˜,5¨ßþ*&ö… ³v“}Þ ¨\äÜÄÁZc˜rm!_¬;HšÕL­Öƒ‘ÊÆØlt –ˆˆˆˆˆ\Jþ’'È:RVóÎg5¹íægy?ÀÁ‰èÕ¼ûñ6²\NŒk?燦“xèõ¡xçÿë×ÌÞŽÓi"*¡^º—¢ÇÞæ7=ôY.5Ž46¼ÿ)=‡1²G.«WŠ2ˆßº‰_ö2ô¦® zð˜9‹¯J%€lG~dÖœ`¦ÞÒ‘Zƒïãùfñ$¹S«QCB< eý‡¼½2]÷ó˜éóÈ úœ¬²cøåÍ,9õ3ïçáÌØÌ»¯{2vÔUÜÓ'Œ³œc1¬ý.ß'ª&DDDDDäÒbhÖ²íé¹PÍ  s8o_?EJ¤D~nÎô ~­Çðä}=©åØÏÇO¼ÁÚtg™÷=jµ¢_ÿîthŽ¿ÉFæ‘X¶¬YÉ/1駟Ÿ¥Øçh<©dÎT·AÃs^×oG‹ü-\äD}ÉK¯çrCW‰çÜÂåšÅÒO£Xª`‰ˆˆˆˆˆÈE¤äÈßÆENÌ|£HˆˆˆˆˆˆÈßG?Z#"""""""R)ù#"""""""R)ù#"""""""R)ù#"""""""R)ù#"""""""R)ù#"""""""R)ù#"""""""R)ù#"""""""R™ª²P~nŽ"%¢>¡Ø‹ˆˆˆˆˆ\‚ª”ü©¤H‰”ÈHKSŸPìEDDDDDþ‘s¦òè¶/‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘jLÉ‘j̤ˆ\\FÏP.kßšfa~ S9´gQ ¹8λ¦>áMhÙ$œ@“ŒcqDÇ¥PàTLEDDDDDäÂ]pòÇ>”§'›øÏKßqôìY­×åÜÿBÖ?ó¿»Jý»à/ØÖ…ðúóû$r.#þ­†s×-½©ï^êå!£Éؾ€·?ÝH¢ÕUþš¾Í2á&®¾Ì¿ìÑ|;÷s–ÌÇ¥_sÝ<;ÑÎ/ýÀ± ?LwÁÍC:Ð8ă‚cÛønÞÖ'ÚT'"""""rIЕ?"‰9b÷ÞÙ›:¤±õ»Åü²7‡o: AŸÈëxÈ‘Å3ó£É;ëJ£¥1£¾‹~Áì\:—e¿ÅqÂn!¼õ &íÀÈïÁãÕ™,IP²áÁÔ™[ohIÒo2;ÚFÝ·pûíWqø…ï8lW|DDDDDäŸïÏ%ŒÞ4v7wuoJ€=ÕŸÌæëýÞ ¸k-,^4ö ý©oñ éS·á³Â‹ÁMw°ÆÙ•AíBpÛ΢y ØpÜzþImyÛŠÉÃe0y Gu¦‘¿”˜5|ñérbrœ` ¡ËõãÕ¹.¾Îlö­úŒÌ¢ë©ý{j2üß~ÏÕ}5òg3>´1€:ä±é½™ÌÎãd«:NB\<9Oåš+†Ósy,K“eº`xß±ô Îf㻯1O.ÀàîK6- œ†p†ÜÐÍ3V“R¬PŸË€O‡{x*rg¹cËY…_óÜ|}/.5“·ž/æý?{÷EÙ6pø·›Ýlz!½P¡÷ÞA¤#E:J/ŠR,ˆ€t¤‰(EäDñEÞ¥„BhI„ôÞ·~ lúIÞû:‡s–ÍÌ3óÜO™™;3“ß8Ÿ`¤T³qLkÌgK÷¥ð¥ÇcðعˆMŠºxÅìcí™{¤˜ pïnÂZw¢¢£’Ûq˜)ï±[Œj<¾Êð^)o›AØ™ßØ°å4‘:•ÙùKåÝÞPq"´š–Á"â8?üI½¾ÝhàmAÄ‘¬Ør™dÉ !„B! »d}–•Unõi˜ý ¦Ngéa-zÔÇÕÍžUß”q“õ³æ±àÓoïž·Žsi œêt¥rèæLý”7|é?ª>ªbnK *÷VŒyÍÍ ˜ª9nFNoe/mÐЯ–}i–°ƒŸ/¦’ô-³W&Ñ ÀÚ»"®ºX¢2Œ”÷ØüåÕŽ±ý¼¹üÍ<Þ¿™ ßÞŒnãŽÆìüu=KßÆT û™ÓV°_Ù’1£ü \;›÷–DѤ3õœÒôB!„Bˆ"\1=Sz;Ü"%;…‹WITÛ£)¤DCÜa¶!!5š »¶qɦ¼TÅÜ– ׺qÞÁ®À8ÒRïqjû^â+µ ²­ PÙád«"ýöaVÎZÁþX¹uBü#IµÈL!ó‰|¢ ]FZ@c­Î;èÔNø8ARhi&PXzÒzÔDV³àú¶å|±ï61áá¤ã„¯“üq¾g›[8×jEù;¿±í|4iiÑìØAˆ[}üí” æЦS8öžÀÄŽ:~ÿ)€D˜²“‰OÑbTZâYïU&¿YŸˆ_wp-£òRáÕ¤¶—~ãÏ ¤D±ûÛøó®¡àù 0$\dï¹h2ÓîråF<ñgp.&“”ÛW¸–¢ÄVc! /„B!„(Ô3ÝJ`H‹#åÁ;/Œ&ŠòBCr$Éò/ºD"Ò4øØ(‹¹-%¶NÒc’ÑælÛ”K¼Î'+i¿g¥]{º¾1Aö‰\<°‹m{/’)í.ž7]!ñPÝ«•ìñWžgq4x×,ÙDÝK#OúјMZ6X;Û ²ô¤ù¨I ªþ ñs—,“;{'¬È"5[žï)ÖÜòpÀ[N¹ñÈ IDAT`ëb‡M•×˜·x@ÎwJ,-b²RB²mÄ Åv _ú6ÎÅ?j)¥]E:¾>”ŽÎ·Øµjûo¦aDUhy¶kçbEú픜¿øf"ëÞENܳį–¹ùëþœhÒe¡5Þ_Çh2¢ËÒåL³&LÒ„B!„EôÌÏ‘<íõ‡…ƒŽçIÓj'¼ì´$e‹¹-#ÉÙØ–vÄ’ô€ÂÖu&YF¬]]ÐídÅ‘mXºV¡Ëè7™v—§¤áÅs¦æäþPº ¨Ìàaíˆ]»Ÿ (,qoЇÑm õûoeå]OÉù[zÕz…¡ܨï—;ñ(©×¦™¸£—8?ÓÜb$#)ƒä€-Ìø:˜,¥ žÞö¤Äè6•;ÑÁ.”(—®t,{•_²QhÊÒóáT ÞĬÕ$ŠZÞ£å2“µØ¸Û¡" ñmIÇr¡\(`þB-m*„B!„x>þÆçHÔXkO|V»µ¡OËr8Ù»S»K/êdp2²¸µzbÎX¥]«»bcçMÓp½yŒà4%µ0yÔKTr²D­4aR€ÑhÌgÿ„xVFâNläÛ ihü»3õ³ùÌ™:…ç}ʼaq°+Gír¶y1KÛ÷©*C}?k¢÷®z˜øQ¨JQ·ÏhU„°?þàZ†ÜêQàŒSèÜb$ñÒq¢ý{н¶vvÔê>ž†TÇ^ M9º ðçê÷_óåö$š h‰—J‰]®´Tåç£Q¨]qsuÅÍÅ+eÁå¡t b½ºø;ˆ8€®NwÚUtÄÚ¾<ív¥¶Žh³ó—´µB!„âùù{Þ «‹åJx)ÏOÖœ_r>C½]AføQîTÊܾ.è"ÎòÓÚ=Ü}†?—¬9ÄšÍÎ {mË ÄdíÆ’MFRýÈîŠC˜° 3C*amcÃÉŒFõ£ý›ùgå¥ÏâyÐÇsâëD·èB—êS¹LYÈN$ìÜ)ŽÜp¦Ó€&´Ÿð¬ü‚_r½Zww_lteÊÐúxtÏ ÿ0¢³,q/_w ÄœXÏW£‘û~ fnnÉ=ÉNóÍw®¼Ñï]–º¨H=É_!Ú`I™®hxo;s¯§‘rëöµ~›/³ÝÇ[ï*¼7«s®’îòÃôÅ6[ ñ¦ýÁX¬»ÊWwóÕ¶~ =›ž¶ÙDœÙÁׇcÈÖš›¿þ®ÉY!„Bñ¿HQ¹z‡¿bvqu}bðÐJåó}16…]ƒw˜×l~(ïÝ/¬„¸¸bŒ 5úðÞø–xèo²qÖK0æù¹Æ£:m_jN=/,´$F\çÜ‘N@'7‚{™[„B!„âÁ5S™òžøþ_ñËeµw+v­„m>Oa™Òo°cËîÉmâ…f"%p+‹?O£oS=‘™¦'~žÈîÍì–` !„B!„xŽþÉݽ#l\wDZC”p&R‚ÿ`}°DB!„B!Ä?çLþ˜H;»œ‰g%èB™[„B!„⟢”!„B!„B”\’üB!„B!„(Á$ù#„B!„BQ‚IòG!„B!„¢“äB!„B!D &É!„B!„BˆL’?B!„B!„%˜ª( %ÄÅI¤„1!±B!„BˆP‘’?¶ö)!r¤§¦È˜Ø !„B!Ä¿òš)?òØ—B!„B!D &É!„B!„BˆL’?B!„B!„%˜$„B!„B!J0Iþ!„B!„B”`’üB!„B!„(Á$ù#„B!„BQ‚©$B<_Jkª7¨K,2c¸y)€ ¡)è ]Ó;ŸÊÔªì³ZK|øu._‹"Ý(1B!„Bñ שÅ]QåÓƒó{SVÏ­kñþçShhûØç¤FÎ4>“¯V½G[¹±Iü³ÃÉ©vf.Í»oô¤[û—èÜ}¦/bÑØVøjæ×t¨BÏÉ X5çmƼև~ý1îÝY|ùéxºV²•[ô aYéMvîœD5M>?´kÅ7Ç×ÓÑñ±ÏOÅŸ¾‹™ÑÐö±Ïù³ª6…½¿½EeËb׈2]¦²q×a‚Ïrâç¹ô÷·Añ¯Šzáq(^±t™¿•3m ¿·Å¿¸×ýMõϯ?Õü€½ÛFRAýOTË6“V³ïôy‚Ïpü§¹ô¯d•«ïýsõB!„Ïójµ¤Q{Р†žm³–r0^n™ÿ`·3SÞ~™ò–±œÚº†ù³ç2{Ù&öÝÊÆ¥á ¦­‰}>#NiS‰N¤Wu;Ö1gê{ŒŸò1 ¾;M¢K-ú}0™žå5ÿ² ÿÿµ™Ò&M’Ø5=ïç¿ëúÛ§‹g·æÞW#iÙ¼'SOú3uŘü“[ÿ†˜ÍÓ˜öàó!î¶üÚüúyS9¸4ÚG¹xšÃÿ™B{/5`wï5ÿñõûwthªðζ=,ÙÇj/㺞¿ß >ù.GÖ¯åR©&Ôw³( ¼Ç(4”ëö[üEðù}lÛ?+(4”é4•Íþ"øòQv5–f®÷;—e¥7Ùñód†ÍÜÈÑ€³œÚ2•Îû²ä×#\ <Æö™mpË9j<ŒIz1·³e,¯Œ_ÉžS\9úíýö²ð¡ÿç‹èäZ•÷¾_Á«ž–f목ò;7¢çäõÞ9…óq1»½‚âTHœÖ_W–žs~àøÅóìáÛwSJIÁëk̬cæ{µo7>˜Ôw Šׂ¶™·Ó  û™©“–ðÛõ$´Ùi¤¤e“™”Šöñz§É”#„Bñ?“üQ»7¤qö.fMzŸ…U´éÝWc¿/ÛÀ•ô¬žö1³ç|sÿó̯8“ªÀ¹Þ+T ùé“çð͵Ҽ6®#¾EH¦¨Ë¼L7çs¬[ý'÷l2zL·-dÂÄylŠ¬Ãèq­pWÄqpÕ:N'…°aö*Žëç¿œÅS”™Ï²zé8âñêCƒŠ*ˆ=ÊAiä¹çLwC¿căz•ìó:µ7-š¹cºµƒm—ﯧ°ô¦Ý›ï1¤†×~^ȬŸ" L ºÉ+º bY¦3]2Öзõ˼¾YM¿Ið6†²~ìGœHà½n=é×oÚýϽ&±'AçËãhti=ÚöeÆ™*L[6  `Êä—ӘùsZ”87hAÖ+¤>üHJóëçNý¸wbág݈^9”f-ûóih.íK•{;>a½q0uóůßTzE~ΧâI>ñ!¯ŒßI´ñþ¹}Åúøjà M6PÞcñð{•úsäƒ4ï5›ã•ßcÙà²Ø”ÀòYõ¹8§MZguJ/–ÍyלŽiUµ;õ.ϤK»á|kÑŸeKqô.´x}Êîcèà©„\1É.îv*÷§ŸñµëÈ°Íú¿ÛE[ÞyŸÝ1™ÑgÛí ¬«¦êF»ïåÃ) q,8.ùnOe>NVÆùQý-Z}ÀG ÎóQv´öÊþSX^]@;)pÊwK3ßç=@ª‹W³Û|üàk"ëî_ŒÇöå5œ?ù;E³ü“ƒÜ¿‘6÷XB!„ÿ3ÉSZ ÛöÞ %;…›WHPÛ£)°D†ØCüxàñ)ÑlßÊyÛF4õ*ÂEmöM¶l:Ì•;)ØÕi‹_ø6¶ž‹"55Š3ÛþËM÷†TÉóLç–{š2.›ŒÖ$G<>’ÔØX™)d>ñ´¡ mz:ZÀÒZ÷Ε¥!ñÖRM °ôâ¥ñ?Ÿ±tO(Qaá¤ãHig¹õ§Àù(é+7ŸÏÅý'ˆ²,…EÁó‘îÎm¾@d|ûW-á€Cg^)o h‰<µ—?/'aP:Ñ •ž—R0=üœŠ©ÀõM±îmR+øs–í %11”ÝŸ¯àb™N4,¥]›ænÃýݵ¬™Íêù{ˆ2‚!=ŽÈ¸,ŒJ*t|—ÿ|Õ™ËWp*µò¥~¨Øó~Ά3Qćcí´ùæªßÝñük_¾CR ~[±žˆúýhìt¿g"÷óÍa¤&^ãè™"÷ld÷í4âp:V…“µ<ŒC~ÅÜŽ)í<ë¾?O|z,ö'JíŠE@Æy>ûä'N\‹Ç±eóßž¹8iq+¨¼\ý@¡…Æ'5É—73¦ëp6† ØwÊ|×Ñ›ý>Wê‡ÒÅŒkáe畲o5ucìVO>X6?5¹ê‚…B!^,Ït+!-ŽäçŽF¦"œ ê“"HzðÞ]wS-ñµµ€Bþ’15†D­ Paëb‡Mµ×Yøùk9ÒJ,-b´RBÖƒ5, ^îiÊ̳¬ùÐÅs3jz×Æßá0'“r÷ ¾µ+`E6‘©äym‡1›Ô,ð+e‹ÚÒ‹Vãßgh͉Ÿp²L ìí±"›Ôly‡UÁsË]âtâjÄd*ü-IºØ›Ä>X';Š‰ÖTrTÁÇ\@áX›6fQ’ …ӣϮŸúhŠuôv¡ÉöŸþpn²R‡sÌÆ0’um›îŽdjÒRöÞ{4Z8×gÄüùŒô>Ï—ãzóݹ XZÞƒ$“ )q951‘~s?¿Þ´¢N;kRBcÈÊ领ä;ÜÓÚã‘“y1d§‘mº¿ŽÑ` +%;çB߈ÁôxLTT)ævo/c>‡§‚ë †ÄÛDg™u¡Ëæ¿=sq²¤ÊDóå=ª¿‘„3ë4‚qŸüÊÇ¥"9ðý—,ùú(šö'ÿuöjæûÈG½ÏâÄÕdf›‡qø ;Þ¯œ™Ñ‡ —Ü)qÀÈ, ýöBût§¦ãB yû¿B!„øIþ˜Šñ»?•£7NçHÓjg|ì´$fþK“Éôð$#)ƒ¤3›˜º:ˆL¥-^¾ö¤Dëáá#…,Wú)Ê̳¬ùe¢8¾7„ƒ«2lTb¾ÜË­t(,ñh<€7_v†”£ì½™õXö!‚³7õ4©Ý“á“ÝiX)wâP–¢A;,2¸%Ï>ïùHíꇛ’´€ÆƒŠNYD§æŽ³‡ÚmPþœ$SîÏàX¤õ ¤Æ¤»g>§œ$ À‘ þÎÄ…ëî—ßxÃ.pËûMFT?ÎâÀL¶5ygýg4;ù1¯¼}„h}QË{Ø!IɾL)ÔÜFØTíLj—؉C5w¬¸Ž°pðÅÛ2=é†\ógArÇ¡øÛ)¼½ ©«îy¹eýÌmÏÜþ_àw³åéqhõ þJìKû =¾’‘?}†•OSÆ}¾%‰¯1ÑìúìËæ·Î5†wÎçû`†\Ì“bÅÕÜ~ ïÆ!ÔÙø`9Kª¿·–•ö3é<ó<™€BcƒÚ˜M–<ý_!„B¼Xþ¾¿ö¥Pcc©xâ³Ú½Ú”ÇÙÞƒºÝûP/ó,'î=ÍE­‘„ G‰®ú*½êy`oçA^o3ãÇÿ’RQ—{Úe…È¿_Æý†õ©hªôbæç‹ùtæTæ/ZÊ¢QMq°¯@½òýÙvcÿ»—{ê²4¬dMÔËY–“øQ¨]¨?`çk~ýGëQ‡~!¬ÑD&´+G)çr´™ð%›g·¢”¶µxsz#NΜ̄e1ôœ9?K%¥ZŽ£¿âG>ý)KO_JûúRÚÇ [‹‚ËÃÂ…úÚÓÐMÏí{ѶŸÀÐúîØ»ÔfÈôñ¼äEØÞÄ4~›q­|qp®D÷I£ð ø™S‰Eì_yâý÷m§ØÙÜÌí¿–såY䮿—¶ÓÙ°l( ܭѨL˜`0èˆ6»?æÖQàšï÷¹ï‰Ò^¬¸šÛæã÷[i ;x‹o2¸¾'Ž®•éþÖ`ÜÏý¹Û'ú¿B!„xqü=oÕEs)¬oÌ›¬é?=ü¬þEAÆíCÜ®>‚…]ÐÝ=Í«þ Ï/¬‹r™’5߸2rÐ4¾pU‘|ë8߯>H”Pm9õS”)ÜK‰>Žc_Í&ºuw^mߪeËAV¡gNpðš3Ý7§ÓäI°t[r½Zþ;ËÖ»1uDC<;¿ÃœÊ¡DeYâéWw D]ÃÊ}QÈ}?Ť çH '³[Ez÷Å?[®P´…«Í°{ª7Ù×ÿ`ÁÄõ\ÍÖÔ¿€™q_sÌt’%qF°­Î˶'ù2Î(“Ùõsß@c¸·ƒ÷gøòɇ›8á£&îâ¯Ì÷GÂôVT?ƒÎ7–ÓëLñçòíÀ¯™ÑýË+UıRS¾ß56WIÁÌnÿ›Í–Øú3lþ\T“N0öø:ÞZú!Ÿ.ÿINé\ßµ’)›n“‘µ‰wæz±pÖ/œv×~|“>ÚK¬,‹ϱ@xh¶öÏcSØ7šÂ¢–{™²ä{ñ‚JOM)ƘPàPk½ÓOýu¾™¶œÃñÆÿöp=½¿¥ÝÈÃÅøËEϺ¾B!„Bü=×LeÊWxâûÅߎVû´eHló{?kú5þûÃ!"tÒˆâEf"åÒÌ_’Ê æz"žx„ËDvÔ%v}w‰],!„B!„ÏÑ¿"ù£‹8È7_”Ö%œ‰” ¬’H!„B!„øçüƒ} Q2<¿G„Ä^!„B!žï5S~}Éß²B!„B!„(Á$ù#„B!„BQ‚IòG!„B!„¢“äB!„B!D &É!„B!„BˆL’?B!„B!„%˜$„B!„B!J0UQJOM‘H !cBb/„B!„/ "%J¹ºJ¤„È‘'cBb/„B!„ÿÊk¦üÈc_B!„B!„%˜$„B!„B!J0Iþ!„B!„B”`’üB!„B!„(Á$ù#„B!„BQ‚IòG!„B!„¢“äB!„B!D ¦’ñ|)­<¨Z¿•½PfÆrå<—ÂRѺ¦vÞ•¨^Ég•–„»7¼M†Qb*„B!„¢ø,\Ý=g=øÍ $'%bÏ÷*ïn|<¹·Ž“òøÅ©u &~:ݱ¿ˆTåú¬ûû+¤.Û‡¹| :q‹4¹hƒÌŒŒ|Ç(q¬Ù“Éï¥SÝÊT,_?ÿj4hÞŽ¦^©\½r‡TCþe*í+ÓmÌۼݻ%õjT¡jµêÔkÒŠNMJ£»Ì­D¾ÀØß¿K‹aôÔ˜`x~U:Ñ`È$>x£gNs;Óô/ÎßTÿçÍú9ž(ãÙê®.Ó‹9+rýøõ'gŤpjʇ·'þØâ Ei·Dûõ`üè×Ú¯/Õv%3$˜ðT Ä¶B;F¾=†‘ý^¦¾g6!AwHÉ]®Â‘æoO ÞÓ\KÍ©„Òš=F2qÌú÷è@›Znd=,3÷¶ƒ uj“ùE.#ˆ«¦êô;†±C_¥c]7Ò®_%<͘§½bÝ 8wPØP®U?Æ Ä~=èÒªeÔñÜ#;÷ÐSùÒgÎ<&võàÖÑ Ä>È®küxcálÆ÷ìÌ+]ïÿëÖ¦Þ†;ÝNFQúYÛZ…[ÃÞù·“¦"#Íb\®mßÿ×SÀ ®§™°òmÆÀQ#9øUzuiCãŠö¤‡…p/ýùŽÙÿïs¡‚¶o~l¨ðêü! {›øëD8™<ÕGÎãýja¹”€¡ØýýDZéE9!„k¦ ó9‹)aôñgøùWI’øÿôÉ®OÞ×–ÒÄqæ×í¼‹Þ¾_ÄÖðÜ™M#º,= k¼õ*^'þÃ'ko’¬r¥zû! o"zþ¯„iKιPñ¶¯'&à4qSÃù8‡rŽxVehê¯ãòÚp²Ÿ¥¿ÿ¯ „B3ž-ù£´¥J÷·x³¥?Nº0üg-?_·¥Ã›C¨fcÿ¬étÌt¤œÿ飱ÛkMgÿó26§S]wŒwØöíO»—]àE­e…ÌêÇòEûˆ1äý¢ww>¤eϵÊôªκMôí™ÂÊà{DɱYüS”vÔîÕÒ¤qâË¥l Lã~÷»GØPRÞJÏF=h½'˜]‘ú8¯ôoðQ½ E›‹ÍíOqâ™ûø0}|²>íŸ.FO”±ž‹ûm¿Å{ ò=Vì'£î¦›©óãõ5W/”Ö”mÕ—¡]êRÚNAFDÿ]¿™#Q:PÚP¾í@Þè\¢9ä:–ŠÃÜfý‡Ò»iìÉ\Ûÿ=kv\#Íô¨ßnskWÌ>Öž¹GŠ ÷î&¬u'*:*‰vmFµ¬,;~›=ìß~‰¶o4ÂgÛmBõ<üüðQ§“¬·Í]ô1ÇØ°.Š+éXبÉÈÔ‘‘‰^äÚö/îæÊ'¢ˆeüäÖ‚7,þâ‹}7ˆÕCÜo_ð©»%©J:æj¯o7Fåî”NõèÓÊ‚ý˾aWxN&$aÿùÎwÚTÂù`4±KJ7©…âìü¤ÈØå°¹DÆÃÎk@›™IF†È$ôÌNtªOM”y&n3cÊH©fã˜Ö"˜Ï–î'JáKÆà±s›uͶÓíÔÇ·ýØ —C9*hÂÙ¾?Èt€»œÙ¾§&¸Ø* Ób~Œ›ëCùŸíÒðѹIýôc5(-Ÿ¹@ƒOó~ ï^o"8¹ç*¾-mؼàgîzp.Fcã1†¸ó‹ë@óêN=šˆ°*Ó*† VßÑvÅîï–³k`~.0™Ç.´™ûX°šã‰òë!„/Ø%ë3eŽÜêÓ0ûLÎÒÃ*Zô¨«1š=«¾#(ã&ëgÍcÁ§ßÞÿè[f¯:ÍýëIÖÞqÕÅ•öÞn¨âÈÏÉkãBI²ñÁE£SWwÿÄ·?îájžçÀLhãnp9$«:XùÙl&µNbûO—rwz°í;(Í–ÏS”á‹uš–šƒ&1ï“YÌÝϬ²ôµWŠ)ÿs%X—©ƒOâ)ŽßÓæ©GÚ•˜¿êXNâÐøÒ¬†³ÇCýë<™•šQÑZa¶ÝíÊ×£n©l¢â³òÌÍ ³cÊHÂé­ì¥ ºâÕ²/ÍvðóÅTÒͶSá¿mÒ'Ý 0µ<ƒF÷¥mM_œ,•Ưkä\¢±€ý1߇Ì÷­¢õé‚æ¢'ϵ:2®§3gÖÌâÝ…;IkÜŽršÂÎÅ ùe¸p,¯f5pRh(Ý° ÆËq'›gèïE™ ØWCÞc$~„BüÏ%LéAì8p‹”ìB.^%Qm¦ q‡Ùz8„„Ôh.ìÚÆ%›4òzÆ‹Úì~ùéAwSÐÊñXü¿Œ$5Öj 3…Ì'N4Mè22ÐkuÞA§vÂÇ ’B#îß`éIëQXÍ‚ëÛ–óžÛÄ„‡“Ž¾NòÇùÌÇ߆J5 \ ÕáÙ¤¶—~ãÏ ¤D±ûÛøó®׺qÞÁ®À8ÒRïqjû^â+µ ²mÎEcV»…<šÏ,Ð乞Tà\«åïüƶóѤ¥E°c!nõñ·S>6¥b[³eóÝž ¯|÷_‡SAÛ~Xÿ"/ßÆÒ¿3ûaâ¤Í@‹uцGÆ…Ï7i6+;ÑgÔKx©rÇ-«HåV†ÆÞ«ò­¨ñ«?ÿ–?“ë2bL[ò;¼çî ÀÊÞeF"…Üá¨)Ó„Ú³œŒÔ£‹:ÇÙŒŠ´¬hý(±nQŠ—>XÂÚ/?gí—ËY:©ý_nd½ÿé£9´éŽ½'0±£Žß Ñ&³íô ?:çÚöýk>J ÊÖO—°ùŠ‰Jíß`Ög‹øôÝ×éVËuûc®Í÷­"öé"3,ñm^ÕÙ¸•Lzü5vÿLž×Þä{.VÈØx‚‘øË'‰ôlL-g%h¼i\ÍÈ¥Sõ¡Î|ûj‘æÛ§ÜW!„âÅòLYCZ)~»c4Q”’’#Hu‰D¤ið±yú‹ZE®cZ,I’õÿŸt „ÄCu¯ZT²?Æ_ɹû£ïšå±"›¨{iä94f“– ÖÎ6¨,=i>jƒª?HüÜ%ˤÀÎÞ +²HÍ–>nv>°©@MS ?§+)íbEú픜wƒ˜Èºw‘÷,ñ«¥!=&ùáE‰)=–x-NVÊ|ç³'£m­‹6U^cÞâ®ô°´ˆ!(§ŒGs‘ªÐeóßžvùî¿ŠÒ=Í—§0<¨¿ íÝKD96¢œ—%¥uAüx®, Z•ÁËPeè‰ÑƒÚì\¬Æ½Ý;Ìì]K´\ÿ~1ü?Ƴð2r·½©Ðc…ÙãÏÃ7Ë*±u2_/S¦š²­ѹ¶;êŒx¢³mrØ8©I¹žôð4º”HRôi¿g¥]{º¾1Aö‰\<°‹m{/’e•wß•véøúP::ßbתì¿™†%úl#*kˇ‰c…¥ –èÈ*ðNW6^åpÏŽàv‚Sv<ûݼ1ålöe|°m#ÖfË/j&lõFôw~gÓÁ`Œ±}'Íçv ¦ó"ÓŠrî`";-“­36’ëéX…•šxqïÔ9îdYR®Y-JyZ3mI;@…Z…¡E%l/_$ ÀÂ_k¿`Ç]=`$;5‰”lcN*¢ˆý/Ùˆ6â‡b;Ð/}çâÍÜù·ÓƒúäÞvN2f‘¬……µ6‚³{·rv/(ÔÎTjÚ‰×FLÀ~ùbŽ™Ý ³}(ÊÌ÷ñ­O4¹·›˜k.øŒ½.Ö¤_y4è’cI3ª 9+hl<¾y,9‘„1!c÷^¡e 'N…Õ§º)¯ï–ú)¸¯F>vû¹ùÏü¾ !„ÿãÉŸû‡ÿ§cáà…£ÅyÒô€Ú /;-I™…ß.­P*rNL¨\°QÆ=Ú“ y½ø¥æäþPº ¨Ìàaíˆ]»Ÿ (,qoЇÑm õûo=ö`Š.’ó·ô4ªõ C'¸Qß/wâP:S¯M%,2/p)F/q6wÒ_¾&¿‘a2’™¬ÅÆÝ1oK:– åBr6¶¥±$= °uÅEI@–ñáaÁó™‘Œ¤ ’¶0ãëàû)mðô¶'%F¾¹ç¢B–õ2·=sû³尩ñ þ`Lã|Â+4j ÁúîNîÝN'Á½ ëر7mÎpþs±Ž˜ýKxkÿƒýQSÎ÷ÿ)ž^E)#wÛß? t¬(üøc$Ãl½L”jü¯W»ÊÊ%빕fÀ¦ÎÛÌou½ôD-ÞNXŒP;xâ ºñmíê‚.h'+ŽlÃÒµ ]F¿ÁÈ´»¬ˆ{´ï MYz¾3œ*Á›˜µ:$ã}JŒAߪ,¥T—ÉЃ¥KYœ2"ˆ-0!l[³!Œ³úž™?„ (Õ,У3’gÌèÍ–¯Ä­cQÊ0`ŒJ|ìÎ F“ ƒÉTäs‡Ì;‰ry™V>‡ùévö£6®Ô‰Ýô¬9y¬ÊÑ¢Z6‡>_Ä®ÈûAR{uäÝQMñ·½D€@Ozb<±qºâ÷?ØTîD»P¢\ºÒ±ìU~ Ë. ¦Ìl[]ñ,hŽÙ o“.‘ëÇv±·I}^*kÍ~³ûcÄÚ=ÿ>´<È>ßï? )JŸ.h¬› ,ñ« ÅÆà ÷çWl•I…œ‹46ßƃ‚’¸t쯶®Kuj(®|ÇB_†]P7ñ\T[À¾ !„/¾¿ñ95Öï~ôYíÖ†>-ËádïNí.½¨“ÀÉÈ‚/jY©\ªS«´?Úw®€FÚNü«‰;±‘o/¤¡ñïÎÔÏæ3gê>ž÷)ó†5ÆÀ®µËÙætÆ4.mßO¤ª õý¬‰Þ»êaâG¡*EÝ>£TÂþøƒkrçOþ×ÿÖ”¯¥æò4Œèˆ8€®NwÚUtÄÚ¾<ív¥¶Žè€3$VéA×ê®ØØyÓ´G'\o#8ÍTä6N¼tœhÿt¯íµºçƒ!Õ±W>˲y²fö_O¼¹ò,r×0&sãš‘Zm|IºMvJ× ÕhW&‘€ðG/t.Ú\üwÅSµÆTÌå.Ã&OÝ ;V^g=±fëJµ²ÓIךP9V¦}‡rب5X(² ?~e³WéTÅ;Ú¿Ú0ç* j`ò¨—¨äd‰Zi¤£É*×¾+±«Ñ•–Š£ü|4 µ³+n®®¸¹8`¥„ì°“[7¥k]W¬l¼hÖ¹†‹g yÇžèK7PÖëFÛŠÎØ:øÒ¤ÛK8Ý8Î «ßïEìÓOsLÑr÷øyL »Ó¶‚6¥*Ó¡[Ul…­WÐØ0ÇDJÐqîztb@S%—NÝOZòó}5ÝJ*Ö«‹ΆóŸ Ò‹±¯B!Ä‹ãïù}†.–+ᥞ_/ ºEz¼TŸÊeÊBv"açNqä†34¡ý„·`åü’ë¥Ðº»{øb£+S†ÖÇ£Ãxfø‡e‰{ùò¸k æÄz¾:øèO‹ÇX•¦ŽõUvåÜÖ¯»³›¯¶õcøèÙô´Í&â̾>C¶ök6;3ìµi,w2tµH6}"4&œæ›ï\y£ß»,uQ‘z’¿>B´!÷ã$…/[ÐöÌí¿6;>ÿòÔ~´ÏUÐsåé*|7£^ËÕp-^ÖÔˆËü¹·úöcTã[,?½ƒ/wdØÈtSÄ°gWìËbýÈîŠC˜° 3C*amcÃy[ÚU|Ðnj\ü¼±õ®Â{³:çÚ›»ü0}1‡‚ù~õ!†yåC DžßÉÊía…¾%ëÖvÖìéO¿aÓyÕQGÔ•ƒ¬ýî<ÉšJ¼’«Ï˜2 (¿ˆeS/óíWî 2…ƒ-H¼qŒ ëŽcÈÛæ†5á\ógrý—¥,‰•¾½ÇÓÅYƒ>5’À½kXÿg:…5UZTÁpyuÞÄ—6’ÓZÞiáݕ䢧ÌŽQKÊt@Ã{Û™{=”[¿°¯õÛ l|™í>´S:`á@‹·çñø)Ê­o¦±èìiÖ®´¢OŽŒm퉣ZGJD0Ç6¬æ{zŒ˜ÛÊüúÐÉX¢Uù}Ÿ€Á«(}úéN³oÿΚþÖzdÞdÿsĶÒc4ÖÍÚ&5˜Ã¡*Fy]ád„¶Hûg¶¿›Koڌźéü§€¹ÀTŒ}B!^ŠÊÕë<±@xh¥òù¾›Â®Á;Ìk¶?|ôŠ!^0 qqÅ jôá½ñ-ñÐßdã¬/8–çïΠñ¨NÛ—šSÏß  -‰×9w䇃ÐÉM?Ï{!s±„xÖ1¤ñ¨NMÇpÎ_OÁXUÆÜWÃX´ð ±™ „BˆÓ5S™òO¾³î_ñ$³Ú»»VÂ6ŸÛ‡Mé7رå÷ä¶ñB3‘¸•ÅŸ§Ñ·©žÈLÓ?ÏŽd÷æ@vK°„BüËŽaØÖ Ïëµ1,þ‘‹™4íàöêŸù¼÷H!„ÿFÿŠäîÞ6®;"­!JüÉsJð¬–H!„x±d‡îdÉ!¼>s1#Ü;ÿ«@'¡B!^ÿàc_B” òè‘Ä^!„B!þ­×Lù=ö%Ã@!„B!„¢“äB!„B!D &É!„B!„BˆL’?B!„B!„%˜$„B!„B!J0Iþ!„B!„B”`’üB!„B!„(ÁTEY(!.N"%„Œ ‰½B!„B¼€Š”ü±µwH ‘#=5EÆ„Ä^!„B!þ•×Lù‘Ǿ„B!„B!J0Iþ!„B!„B”`’üB!„B!„(Á$ù#„B!„BQ‚IòG!„B!„¢“äB!„B!D &É!„B!„BˆL%!âùRZ{P½A]ªø8`‘ÃÍK\MA_èšØùT¦VeoœÕZâïsùZéF‰©B!„Bˆâ³pu÷œõà?666O,œ”ˆ¥FóÄ÷*ŸÌ›Zƒ›G¯’üøÅ©u-Þ_:í‘“ÜSåú¬“€ÊZâõo§Ófç;&@‰SíÞ|ðѺ֯‚¿_y*U®AãVíiá•Ëá¤ò/SéP…o¾Ë”þ­iP«իפa³6tm^]X·t˜$ôfc¯t}‰¹+?`€o(ÎÆòhèXQuä"–¼Ù ýéc\O{úLšeùþ|:¹ Go¢-݇O߯Dð‘kdåúœRh±J\[¢·mîãóñÐnôê‘ó¯V‡ŽÝ!Ë”wy[¿Œ{÷-Æê@#¯ln^ '9ß ¢ŠÒ]ÇðŠòôû„yM#8p: tjÊô/¦Ó1ë‡ne`,+ `é'ɸS–·Þ,MàÑ›Myú2ôþ z©}è8¢;el®þMIºŒ}½‘—°ê²–rÇðÖ[Ýñ aº¢íCAý>õÊ!¢¦t§Ö™ox|Uh¨Ðk2ÓÚi9¸y?\‹!ËÆ—†Ý0ñÏþ‰àÌpöÌïB0öücr[]À/ ÿ#Íó/Sû4cÁÌá% ø1ìQú]a2­ò‚âÌ5jÔгmÖRÆÿ¶¶xýS‹Bñï÷lÉ¥U{Mä6UpÖ†²÷ë/ÙlK§IènkMå³é’áH[+*ÏýïÖt«À~CKº5ðÀpç,[×oâðÝ‚/j-ý^cÁà8ÏÛC´á±ÿ+=hñÚpú7/‹ƒ1‰«{þêmÁ¤š”8TëÂÈ×ÚQËSMÒõC|ÿõ¯œ×£.Ó‹ÙC³ù=¸*}êÞfŬ­„š»ËFiM¹¶ѽ>eìdÜ=Ë–Õßq(R ¾­1¦W|w9¶ë eÚØòݬÍÜҚ߾ʧ³‡Øy©½ÚWÇÍÊÞu_åÝœq0k gR噟‚Òž:};S†TŽ­XÈúKîPˆ äÚ-’¦Í O“Þ´ÝÄŽ{ú9cE³|çïÇÛö&;/”¢÷à†œ_qŠ„<Ó¢}VÆýÇ*õYèL&T™ddd?WMÙV4µ8Áò½×ˆÑAì¶åÌõ´$åÉÀ³b%|,ÓIÖÙ>ö3|ð#â–1qý ²sö!í)bŸîù2¯·4²cîçl»“Ó ±±ü¼<íÌi étŽ½¼LßÂê¥Âçå×h•v‰ølu!u!ï1²~ ²«SöÐæJÀˆ^]?b¦ÿNÞ_qªï/fhÔ>¾\ï¨Ý¬ú+‚\úc!m»âï¤$,ÖXÀ>µßGròª+ƒë9qápBž»”.ÜÁŠý‹±ùÖƒó‰v­Ç8²U=, Ó™=&£PãÙ¸/£û6ÃÏ.ƒÐS¿²ö‡“$>ºìGSº=“§4&lõR¶\ÓâšïOæüµ\«Ð+Ÿ˜ƒKË·™Õ:ˆŸî%RQšÞÓßÄsû¾ H"´ÅóéŸr Bñ\²>ËÊj÷†4ÎÞŬIï³ð Š6½âjŒâ÷e¸’~ƒÕÓ>föœoîžùgR8×{…ª!?0}ò¾¹Vš×ÆuÄW]Ü=P`W«?¯U¾Éúï1qÑ>”mÒÎK…Ò©!£Ç4!qÛB&LœÇ¦È:Œ× w‹'·/ÓÍùëVÿID·ìZ¸6gDO7ά™Å[“æ²þVEúôðCX–éÂÛ½Kñת˜0w;©M;P>牔¶oYº mŒ»™÷îTîWÓ¶_c\M¹b7ó+Iü¼HÔ>4¨¨‚Ø£ü”–÷±Ý=ýŒêU²Ï;èÔÞ´hæŽéÖ¶]~øñ¦Ý›ï1¤†×~^ȬŸ"þ½ûŽ®ªJû8þ½5½B'ô^¥* M)ŠŠŠXfìŽe^Ç®£Ž v±€ QiÒ{ï!¡Þû­ï ) :ù}ÖbrÏÝçœçì½ÏÝ{Ÿ úЭ–&êUžýÉ!f}:‘W6¦d«õ{4'gC ™¥mÜÖŸnoFì´¹ÿo1/¿÷OìL€ÑMÎæwùûçö;ï塶’™¾EqÅÕÚueýñkÑÛŽ£ØüÃñ71àÁyoò˼xÿut 6ŸÕ-ûÕ­9-ŽÔÒ…=í0™>õõ4œ±i m;[Ø·? àÌ8@Ln(íëz¥6š:Ù½~#›³ëÓ­¾XjÓ¶®“¸ÝÉœ9V9gŸd2àÕìzÀ¦Ÿãá"¡åUÔó¬"ž® böS¿Mm¬/ê· ÄeŒ m¸¼êÑ!$móñ® ÿ>ûÚqpÎ÷ì¨7†[;ù_àË€oÝúxåÚhÛ?yóíWù÷ý©S˜ÍY«‚ܹÄÌÿž©ÓçsÖZM‡çN勉åbXýاáÓ¦=G²"ጫà8ÁŠù‡ñëЖ œê–—ŠµŠó2‡÷ãŽ+Sùñç½ä¹«>—r÷È~aѪ$º7ÃϘ‚éÐÍŸ«ö“ç*æÐÜ©|½*™ì˜©<ýÞF2Ý%±ö®ÛœZöKZVñ1T·Þ;HŽ'èŠÒã({]›v£^Ò2–ž9;ÒžÀÂ?eÖ‘âJïÉæˆÁ<8®QŸ=ǃÏO'ºþMÜ?0¬ôÇ ˜Cºó·Gú‘ùí~Ú—±Â~¤|{O«0&T~®Ö¿ÊbdúÊ4TÑ.ðvYæó× Ÿ ®‹!~Îæ¬Ã|õâ‡l°ô­ æ.Ò7üÈ÷Æ÷%¢ß-ôɘÅ;rpUëZ\¬ú)""RÓ?î¼hf->HNq±ÛcÈ°øáa¬ü÷3u%?.?DzN2ÛçüÌŸ+èYçµ,~ù˜É[ÎÛO½ÉâAû?‹Ÿ·%‘››Ä–Y¿[»-O~j,ŽeÆ÷«ˆ9–­’iG®Ì¼ûü,Ø“J~q1…ùv¬>VLX©e7Ì›eñÁ,òÓö2ö Jϳªý» c™¿4–œ¢lbwÄa ÀKß½v·$ ÞV 0‡Â³rvnlùùØ«—…rÍÔ‚ÌCÇÈuƒÁZ‡«ï;™øy‹wÅ‘t$ž|¨dRœ+å";f#i{ÒÄ °FЫe¢2)²˜¨Õ¥'Á{g1'*•¼ÜÖÿº´æ}iåc(“ÈéÅÝê±ñÓ™DW3[q?}hÑÞɎý¼±g¥p`ñT^{ë[Ö8ûðÀƒ(ß±x™±ŸJ"ºlùcÅëÌ®Ò3‚vJ/ÍnÙ“ÙuØEý6µð lA[Ï8v%$½×Fd§p<ÑÌ;‘mÇÎ^¤pî>ÉJ£¾q®û‰{ÒÈIÛÇ‚Ÿ6å0WO‰»ŽàÑ"’@ÏpÚŸ`é›áÖšˆ¼höf9+è¿Ï=ÀtåïaÆwi1n4m|.¤³4áéïWdšÿ÷ßþ‚ß³»ð÷q^· {·±íð™IÞêÆÞo°¶Œ¬söÅ™iyáã¬þµ¬ô¼Ìa ¸½//²> IDATé?ÿÌ®;g±p9IÑü6õÆÛpFÿÖÜúÄDÚþ‘éÛ2qVZï åÚ»«Â˜œG¯vŒþŒ2Ï÷>ÌÀg>(û'|3õ]þy…ßÙÛª[9øVõY­ô+¹#‰eÓ×xÓ£<1ÌƼﶒᦚ×ââÕO‘Kݺe9óÒN?èÎåÆ]%õŽ¬²NÞ[íϵRÏÇœÏó  %”sw|Ídß¡Œ¸ûEnóË`ÇÒ¹Ì\°Kˆ/Þ­oçõ÷o-l±šRˆö,ù@áÊM!ÓVõ»ÝV]=–á°槓Tì}ª<ßPOòvŸü'7ö¬òœÀ„Oû?3všãs™³§›í":ÐܲÊÖ-êuh‚'Å$&äR«˜Ü"ˆ öÁb­ÃU÷ý“ÛÚLüÄSä6àç„'Åä«–TÙ'eïa]úµ\ÙÄ‹Wкp3¿g:iZ:ø÷ ö ?)ëTÂוŸJšÝ› /#ä:ÁR—kþ6Ÿ%“ùõPQµŸ±Tq?ŸH:Åynl¹3yî™ÓïKþþº¿6„ŽÁKI<•ôpa/r`ñ*MF«Ø):cz†Ñ+?g§Ç+6Ží8Ï&Ô=Ö ãË9VlǾ#ë¸ÖÔ;ИÐôÝÎsApåý¹«4fÞAf²÷fê¡íY‰d;"c¥ñ,ŽßɉÀ4‰°ÐÐÍô-¸¢Cê8š`:4“$»›âsöß;(8çíÀMÎΙüØ÷WvŸoípã´»pÄÏcÚ’=¤»àøϳ¹êõ¡t^ʉ”?:«¡º±wàÊ(ÄÚ8/#”oÖ¬þÁxí§Àe#µZ幡ÂóZ£ÝxæÌæ幸‚Ï#•ZæéʈfcÖ5ôjäÍ‘ÐîÆ.`ÁÙ­ÃèÛŒawNbXH,sß}‘Årqa¢vßêCÕõÞíÈ%ÏH ÕÅîS×µ(«ƒm|MïGê&?³‹ÁHk`¼ÙŒo…÷d ¾¡äǾ—%ì`mxµÏ:] Z³ƒünCèòÔÊë½Óí½â˜«ÝÆ«#ןPæùæßsXÿádf;Õ‘`ËɃˆŠê–¹òÏJE§·UõݶckY–:”qy?³%ÝyVßûWÔO‘üq_ÀãgÍš¶‘ç,AÔõµ‘YPõ‡nƒñä4%–€¼©€ïZ¡Ø£góÖÊ™XC[1⻹7÷?LÉ* kË÷<ùÉ Œ>Ô©çGN²êƒÛ]£7Òë.îlÍ;ÿù”Ø<'Þã­þ% ²lø†ûc&` ¨…)«ôµJöqa±“K˜#‰u‹3r|+î¸{0)-æP¾ VºåþA³†Å±Eg$Øë G‡QLz´6Ýš•MüÆ`ºhŽ©p;;“ô•"U>²ˆ^ŸÁÈ>Íi–ÝšÂMËHsžü4ï¤ ³Ÿ†xp`ô %ÔRÈ–"°’xºòãØ–1šÝ=ð>>‡GòHëJξ[˜€­Âþû/,M=wBÜ•Á†oçÑïùñ ÏÉâü[8ÉI̤\ nœî’?¡òU3öN\1Qdß0”þu·~æ€9œ¾Ã#ÉÝù3©®j–g®ð¼,DtŒ¤vëH&: ƒÁ„Ñÿ˜üKß|™é‡l•$4ËÔg;6ç2¨g:ppÁ!Î|~²Á³17<ñ7Úì™ÆÓS¢ÈȲt(<<ƒ)ÓwÑÈëîÓ–ÍŸÆTRïÝeÚ{e1¹Ð6^ÙûœB™çÛ.d¦‘’zÆ3*¬[U|Vò z}7¼[]ËPßCœÁ°F1̈³UóZ\ìú)""réúó,x[ gýl©=€±ýäF§cè\¸•õ'*ÔºŠrq†´§cC_<š1txS}ˆß|‰­bŽ®Þ…±ÏM\Û:¿Ð– ½©Æ’^Åñtƒ+‹ý{\tЀ̘dŠrâØçlËàFl9Z„»Âþ»ònÎÔ5|µÐFßQ-ð9Ïn²èÐö‡ elïú†Óåºëhœ´‘]åã_93!­»Ð¥‰ïY7ÐêÆÞqbÓÖñÄCÜÔ£õBC¨Û¼c~Œ|7ñíÂìçQ^ÅçU@̧OóèÏðÄ“ÏòÏ×æ’P|ˆ©/½Í/G핞˙ƒúÔ;(êp£kfelAéà½äý]ûÐî:úVòÃÊD,Áµ¨]«µCð4U~ çQï f_ü\YdŸ1k×™ºžïW8¸æñ‡¹µOKÔ &¬Q†ßsWû:pVzO¶s|ÝV]F1¸y ÞþM<~¼]¸·½‡+Ý?Ï#©Ý odª¸Þçy–iïFü*Œ ÕnãgÕáJÞ÷g”ùgß7«÷YÉUi_cðl̨ñ-Øóõ'¼ÿs}&ô#ÂâUÍkqñ꧈ˆÈ¥îÏY©lO&êH0_yˆ¢g~:õ³åGWr´Í¼~Köã›ùîÃ…ÄWqãt$®aææöLzú-F¥îaÉoˈïW:˜[õ¿5ŸÄcoÇÙC܆™|¶6»mŸ~Ê]ãžbJ¨™ìCëøö“$9¡úÏ—v‘¾égVt¹“W>Mα(~_¼˜Øq㸷W,om˜Ç”ÙøÛ?þà EX¼x3)ýí8ÝàJ¯xÿæêÆîÿ>`“ú|ùp¤±öãIî;‚ëu£UÃFP”AÜ–õ¬ØÄðñ½¹æÑÀ;“™Qæ¡Ð¶øLžZ‹'ïìFøЇy©EIEVÂ#›PÛ’×|ÊK“мŸj¶ÚÌÖ¥ÝÊDË/|˜^¾Á9’—3åÛî¹ýy>t½œ¿ÜJ–ÛJ»þÝ 0sïÛqoi²èø¬Wx%æôýg’湇٥ß”·{oÎÇw=Ã-þ’cVðéG«Iqžõ¸fÒDLÅ°/zß¼¿Œ{&=ÅÇ“œœØ6‡w~‰ã¬ÇO`wV0MCÌD/óÜŸCÅ nº—˜“Ïrår`["4µ±=¾èü&gñþœ Ü}ïKŒ4$³eþ\vû7ª"ž% ƒäèƒä‹dO|.»˜£Å\kÛÅÒ~­¢þÛUE""aÉtözŠáç[7rwñŵ¹çŽG˜<ÑLæþÕ|ññJ’ÏŒV%12x9âNîHÌ#‡–¿&Õ½+Ýß½Ê q£¹yè] ª€¹ •Øíóyý‹ÕìËsWyŸ—ò2O}KчÃe#'3»di]eçrfÔ“w²=8ýc×r¨°|,nKzŸ)¶ºøÔmÍS¯–½*Çø柯²<½’c8zo©Ý ÿ”hNœù™Á]À¾™¯ñbâÆ ½‹îð¢ 1–m‹¦òʺa<ؼò{2ñ xoæ-Üsÿ«Œñ)âø¦Ù|¼<G³² ¦ |»| OëÃò×*¨÷-í¹‡9Ù.ÀBh³ÊbRÍ6~æ©æWò¾ü?¡Ì?»¿®ìºXª×w76žî ¿òì¾Qì/±Q1 ®½›+c¿äûýEz”¼Ô@Fü:ÜÊí¡‹ødYŠ–ÀŠˆˆˆT1f:×ÌŸ¿0ù#Rs“Ú„b/"""""r)Ž™Î•ü1*4""""""""5—’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜¹:åçæ(R"jŠ½ˆˆˆˆˆÈe¨ZÉŸàÐPEJ¤TFZšÚ„b/"""""rIŽ™ÎE˾DDDDDDDDj0%DDDDDDDDj0%DDDDDDDDj0%DDDDDDDDj0%DDDDDDDDj0%DDDDDDDDj0%DDDDDDDDj0³B rq=ÃhÕ¥=-êøc,LåpÌ¢Žäâ¨ò&|#šÑ¦YAfÇ}0™—b*""""""î‚“?–†cxaB¼¶˜$‡)FÚäþ;ûÓÈZæ×׎!cûO|0} Åîs¿Ó¯×NÏu­Ê¿ͯ_}Ç¢Cù¸àêõMu‡ðä?"™óìGD*""""""œüq¤oaæl;Yš• €¥î`º·?õIcËì9¬Ø›ŠÃ¯1=®ÍÕoâ1GÏM‹&ïŒ6cônʘÇïg`­ vÎÿŠ…›’b÷&¢ý5Ü}KW®ôA<Þ|‡¹GlJUÙ£E0è¶k©ïµ_±99Tºà7†tãÆQ9|°/‘¼ÎòLç¬tõæšNµqßάo~bm¢½Š«6þ‡ÿ¬Éĉð!ÿäÉf yæÃ(Œ-†pûÍýhf!ûà~øf;2Xêàéq6íoÁèñ|ôê,ŽØu±äfô¥ÃèÁÔ'õ½Ã´ès÷œLüÔ¡ß=0¶µ‰³Þæ•_¡^Oº„ê]•1‡]Åm½Òøyö¾³fW‰ˆˆˆˆˆü/»hßöåL[ÅÏ«“‘›ÌÎù³ˆòîÊuŒdíÝJzDWšx0µæŠ€#¬>PH`û«h|l³v$“——Ìö¹s9\« Í}K©ø0¿ü´–=Çs°k­‹\ò-É‚—(Ì¡ð¬Äƒ{A6ÀÃËR¾ÑY©Yq ä¹Á` §ïÝpKkf½Ë”¥GI‰'Ÿ@êêËù*d®M¿[û>k»•ù)?dºX9³É>¹$ÅžIBžu½¸NìasÖ`º7ôæhHW-â`¡‘_¼[ÞÊËoŽ=9zÆjJagÉו—J–MY¹LØ38œmê´§™ßZ6e—­»D´kŒ'Å$È£ÜÊ-W1yÅàäÙNï»ÿÁ¸6'?Ç)rðõ Ä“"r‹ÕÎÍD­>céŸ37¢òp)"""""""e]´äÉ¿¦ä9K u|mdºÀ™É®m¹\}E+:»(ŽB·‹‚¬²·ÏàÙ/öQ`ô&<œԷÛþÿ^.Žd6,‹cøØŒ¿c©Ÿ-ãp VjwÃ=ý!w=Ë•Ÿ=‘‡\Ñþ:n{°]"Ë&~cû5ÃT¸“¨­<7+uÚ7¡VË&¼Öá6 F#<ðú³¬˜ü:?ÄÙ"ùŸvÑ’?–Zýså¾ÙZ@ÃÁ£éX¸×Kl›µ‹¢A£¸ÎËç‡ p™QëH6’2Ypš œÀ­¶óÚÉdèºÈeÇEÚúi|Óò1&vÁ“o]MR|:N¿ºÔ *mf¾èÐȇزÏrå5g‰O ¡K$$/ž|*ñc0Óñú{׎üºýšùsnEìýòž´”žm~„ä"+µ7¦¶¤¬ŸÊÇ+’ѼŸŠ¸±çeJ ù8\vr³r(PÐDDDDDD0´hÓñÔt‚Ðг6ˆ;Lð9~_¦|»>Ì˽–ò¯÷£)TL¥†ËHK«¢Mœ»ø·Ã÷]I˜#–i/Lam†«Üëamèuo:7¯ƒ¿ÉFf¶­^Ϊ}zèùŠ½ˆˆˆˆˆÈÿΘ©Aã&gý^ß-ò—p“ý3o¾ŸÇ=$ºÏz½89šßˆæwKDDDDDD."%Dþ2nrö-dê>EBDDDDDDþ:!ùã&oë»<²UÁ¹Ô‘šKÉ‘LÉ‘LÉ‘LÉ‘LÉ‘LÉ‘Ì\2ÒÒ)µ Å^DDDDDä2T­äŸ¿"%R*?7GmB±¹$ÇLç¢e_""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜’?""""""""5˜Y!¹¸Œ^a´éÚ‰–uý1¦µq98ª|§ ߺ-hß"‚ ‹ôøìÞŸD¾K1‘ wÉ&¬oæ•;rx祅$:t¡är`$°Ãõ<ò÷4¶–ùõˆ±¤oùžw¾ZÃñb÷¹ßéß’wÝÁè6å_Hâ§Ï¿aáÁ|”ª„G3î~ó1úøœþ•+/-¿MçëeG(°¶äþwá “¯:È:¶‡3¿enLNIl=šó÷·¥§×eÛwòæ#Ÿ]TÁUìÍ3϶旧?'¦è2‹›W{þùú Vüëm¶ä× ~ÞÈ•ÞKíßä—„sl a೯0¡A™ßÅMãáWד¥†&""""5Ð%›üq¤m⇟íú .— k½¡<öÐ@ÊÆŸeYL ÿHz¸ÝÆñ¤3‹M"÷Œ:mônÆØ=ÂÚlŸû9¿­?@’Ý›z¯åÞ WpÓÿ=ŠÇ+o0+®·Â\I§‘Ū·ÿÃGìLÞ„w¸–û'ÞÃÈÏóC2`Ïdùû¯13ÞÙ;„&]†rûÃO0ùe¦í-(‰­3›Uo¿ÊGì§ón'…E ïeÑÏ,„4ïH·+pCkoUxç  ®wóßþ˜•©%;wÙsÈÑýFDDDDj¨ Nþ˜ëŽäÅ»,¬9ÉÐ> 1_Í7?Ÿ Ë-£è^×Èñ•_ñÖ·»È2xѨÿ-Ü9¢ | ßÊŒO¦³2Ñê]5Ž¿îJ]ÃqÖΡA?¦¿ðÇB»s˘ÞÙ“@¡ÛBx÷¹çÆ^Dú·q6Ÿ}·6 …åaô£ãCi@.kß{©Qy¥3u8¼ÿYO=˘7Ðþæžp”k‚u‡L`HílV¿÷*_•¾Ï`õ£~§v.C]FÞvë_^B’S¡®˜ {av €C—°úÚnt¨ï1Àíäëùì\ô9A/ð¯혳Y8Ë”Qѵö&ràá$±mÅ>< §“µ»ÞÀßÆö¡i€¤èeLûj1Ù.0œ»K«?ŽWǧñæË‹Hv‚5òÖSÿN¯f?ë6âßzwÝ:€öᲬäÛ/f³5ÝQÒWOrò[T#FjC-g‹?ÿ˜û|¸æwÐÆÇ‹/Ý /|Ê–33“† úþëyú­‰¯ÌÀ…‰:×>ÍsÍãŸïîÄÐêÜû´4Í‹·³`_+Æt:Ê{¯¬¡îM“¸¹wCü]Yì]ô5ÎÚGñý|E±«ð¢sϘçIxÓfÔµæ“m÷©8Gd "Â#‹ÅG’I)PË‘ÿ!ëy³µAOšÅ}Í¿{‹EÆ~ÜoKvø4½¾C¯át 6` íÍ£j±åÓxàÿfꡦŒ‰`m0Œ‡nfÓ‡Oóà¿çÛs0=ΑhŠ̃ãêõÙs<øüt¢ëßÄýÃôÀ"¹tXêÒµ©R×°pO^ù©ý+ìÃE›ù•ot–úôªûÐ\fí>™ø‰`ÀýO0¡­‰ý3_ç…Ÿ AºÕR?Ÿ®Í/²+]CŠIL+®`ɜ㛢ȭӆpKuË5àÕìzÀ¦Ÿãá"¡åUÔó,í«ÂúóÀí͈ö"÷ÿã-æå÷áþ‰ 0VÜUµëêô³ÆÀnÜó·dÎzy™ï;rϽWQÛTZFý~ôsýÎË?ÉëË,ô¿©;¡î$LþŠ˜üƒ|òÜÇg'~ÜÙD¯O"¬{3üŒ€)˜Ýü9°j?ù•ïÓÒ` öñù'KÉn}3·¶ˆeê³OðÈK1ö¿…uÊ×çÊbWá9˜Î<Þ\bæÏÔéó‰É©8SjòÇßÄ€_ä½É/óâý×Ñ1XíKDDDDj®?ôi×™¾ƒ…›“)°Yؽ?~–%lN.Ä–žìøz˜p¥näÝçדQ€Ë#˜Â|;ÖZVLX©se7Ì›?gñÁ,ld3ö®¾íìC¬Û»'>;¿aáþ ŠÉä·©ßdÓ¹„r ¼­@a…g¡ÝØòó±V/ †rÕ;úA¹õ¹n0Xëpõ}'?oñ΢xÜÍãɧõƒL¤`U<¢fà30ðÔ/[ö3öG}XaÅ–0<€ 0žYF1Ÿ>Ë››sKû+úvĹn ö¤a#?m ßCÞ€™Z]z¼÷æD¥Rà†õ¿.dðK}iå³‹Ä ìǪîgÍ5ïOdü,>Ý–D®¶Ìú•~¯ ¢¥ßJÖîÂXæ/%§ vÄÑ=¯j¥þ]dÆl&mtwšzof‡gzföþB‚ºU¼Ï űÌø~1ùà‹A>föÄ-çí§6b*tBýÓý|űÛÆÖÊÎáfý¼±g¥p`ñ<¦§xÓæº;xàAϾ²HϘ%ÎØ ±»K·.— [½t ãÆU:¢q»­4ºz,Ã;…aÍO'©Ø»tðkÄ7Ô“¼Ý'¿É=+…<§å¬Cô õ ?îôvE ;X› ‹'—{:±iÐ.¢ÍýW±!«ìÞƒzšàI1‰ ¹åǪ®br‹ 2Ø‹µWÝ÷Onkw:ñSä6àç„'Åäë$•gIrXÿádfs€ÛIQn9UÄÌ䈇=—¢“›¹Ê”Qšü°åä•IИð2“½7ëÔ··Ù³ÉvDF|‚=ÈOÊâäŠTW~*ivo‚¼¬äVÐY#Ï<*Ãùô³&|B|ñn};¯¿ë©þÕjJ!Ú³$ÃãÌK#ûÔ)¹Ïëáᮌh6f]C¯FÞ íN`ìö ­bŸ®Ü2K‘»ãk&ûeÄÝ/r›_;–Îe悤ŸNÇT»?~g²šÉsÏœþwò÷¿Ðýµ!t ^JbŠÖVŠˆˆˆˆ’?çÉ@H¯»¸³M4ïüçSbóœxw~Œ·ú— ª ²lø†ûc&` ¨…)ëÌ…Y6¼Ãü0“ŒðhЗa"Ó IDAT2Õ lº†r)p$±nñaFŽoÅw&å£ÅÊwƒÁJX÷±Ü?0rÖ°8öŒ'ÛØë G‡QLz´6Ýš•MüÆ`ºhŽ©p;;5맪‹@Af)©öjno¥ÞíñKœC’JÖ_UU†“¼ õ1“UÚo…`.íÓ2‹ñiˆÇqFŸPB-…l)²WØ-9ãÉ5¸,!xSÏ'=CAVY[¾çÉOöP`ô¡N=?r’î?2OÒ™ÁŽÍ¹ êÙ†ÎÁ\pˆBwû¬n÷ɽñ®Š=z6o­œ‰5´#¸›{sñê¡2çPaì\`ùƒçpÆ}ɯi7Ú™ö±qÉ7½¹œvì.7N—æ“ŠˆˆˆHÍdüs‹7`´X 8Ÿ|›s`K®Ú/‹&ƒø5ÛpõÅÀȼCZ2lTÎ~D§ãë¶âè2ŠÁÍñöoÂàñ#èäíÒW_Ë%ÄEêš/™º=–£yîý7yí¹'yåwxãîž„ø5¡scŸòΕǮ_sÂÒnͼHZø.“K?K]ÆÞÇmÍáð¼ßØ[ éí¬^Þx{ûàZŸöCîàÁ°vîn²«Ý™stõ.Œ}nâÚÖ¡ø…¶dèM=48HÙº‘ÌV£ѾÞ¾uéuõÔ:¸š½¹¶ û1GQ.Îötlè‹G@3†oŠ§ûüê^ÆÎ5$·ºžÑÃðó £ãè‡xvb»’çôT ÞVýiÞµ -Ï|“ƒÔ;(êp£kfelîóÚ§ÿN·ò÷ ¢y ‹ÉÛN—«Ü>*ŽÝEª÷eÎÏíÓ‰ñ÷ÝÆàÖáøûסËÈëhtb;3uW‘šéOžùã"}ÓϬèr'¯|4šœcQü¾x1±ãÆqo¯XÞÚ0)³'ð·ü‡Š°xñfRúÛqžñYß¿€÷fÞÂ=÷¿ÊŸ"ŽošÍÇË“Ñ<¹¤8ÒXûñ‹$÷ÁõƒºÑªa#(Ê nËzVìbøøÞ\óè?àÉÌ(óPh[ü&O­Å“wv#|èüÔ"Ž¤"+á‘M¨íÉk>僥Iªï”%ˆ«Ÿx«K“ Ù {XñÞëÌ=ù5ïÕTtpïÏ™ÀÝ÷¾ÄHC2[æÏe·£’R“—3åÛî¹ýy>t½œ¿ÜJ–¨ +²¯aææöLzú-F¥îaÉoˈïwž=mú>ý2”»Æ=Å”P3Ù‡Öñí'+HrVÑÉÛ“‰:ÌÄW¢èù%tŸ4ÓG1ìË*?CÍ‘¼“íùÃé»–C…Uï³üâ]')«¾ã·æ“xìíáx8sˆÛ0“ÏÖ¦ãª[vÇî¢Ü¨¬õ¸fÒDL=ÁäÝÓxsî8î¸ënñw³‚O?ZV|‰ˆˆˆHMehѦã©qOHhèYÄÇÆÇÏÿÏØ5áíèx”­û²q^­ïæõ›âxùßKõ!\.Yù¹9Ð& ø·ËÓ÷%Üq€/Ÿz—U鮳ÚÃÀAWÒµef™ñûؼr)+ö¤ŸzŠbŸó'õGàÙüz®c>3+"""""—阩Aã&gýþ¿øݶnðiÇÍwvÂñÊ·ì( §÷ЖÇ,"S‰©qÜäDýÈ+oç2®·ƒ„³–p¹)NŠbþô(æ+Xòß`£kËT6-Ò“ÔDDDDDjšÿâÌÀàK«“¸sPs ù$lÿ©ß­%¾HÓäÒ¥Ù'Š½ˆˆˆˆˆÈ¥:fºÄfþî<öÎyŸÇç艈ˆˆˆˆˆˆüŒ ˆˆˆˆˆˆˆHͥ䈈ˆˆˆˆˆH ¦äˆˆˆˆˆˆˆH ¦äˆˆˆˆˆˆˆH ¦äˆˆˆˆˆˆˆH ¦äˆˆˆˆˆˆˆH ¦äˆˆˆˆˆˆˆH f®ÎFù¹9Š”ˆÚ„b/"""""rªVò§Aã&Š”H©ø¸ÃjŠ½ˆˆˆˆˆÈ%9f:-û©Á”ü©Á”ü©Á”ü©Á”ü©ÁÌ ˆˆTÁ ä9ÀN X 8€ È<€âÒ÷œüÙH‚€L ä"n›4á@£Ò?çÃVzn¥øÁ¥[uùEDDDär§äˆHÍaŽ€e@GIãB/Ù”$~’€ÔÒòó/Ñs»ôïv€OéyTvŽé€'p´4N@Qéöa@+ 70hFI‚IDDDD䲤äÈEfô ¥yû6D†ùb,Jçè¾höËÃQå;Mø„5¦edf;Y'âØ{8•B—bú?âBg׸€Ú'«_é{r(IÖü/Ú}ÊH.ý³XLÆ ˆˆˆˆ\¦þúägKþþ}ØðæDûâññ&¾}÷wºr¹3âßjwŽëMý² E'3j._ÌÜB¢Í}îwúF2èæ1 iîWþ…¬}üöï¬8R€[®2þÁÝo¢_ê,~=\|)íçHéŸß8=çä’%Jf›ØJÿ}°óÌ®1øwáá›±à­9P\½>{WA5c“¹–œ“h¶à >>T—Ûž¹ƒŽ§Ú„ƒœÄX6,˜Ã’¹¸¬¸å_wÑÍûtIî‚dv-›ÅÌõÇ)tðŒèʈ‘}éØ0Ow©‡·±xöR¶§ÚϯmTûdÀ»á•7ßxÕê6¡îÔ䨥æï~Ù<êD±;°Ü¹¦/ãp§±ÜØ®˜Å?'Ñg@6Ÿ°ŠÌ°¡ 뇟±è˜M  J³~4kZ@ô®r™Œ¥‰—å”Ìž9FÉL™ ÖŒÁÏ·YÓ‚ôè]ÅçÚ¶’£' %lË Þ›~„S0-ûŽáæ;ܤ¼û;Çl©x5åúۯļôk^ÞkÞÛõ– sî’Ðñõ¹Ç;ÚÊžë^z´p²è½©¬)ªCºÍNΟ0[Ïͼ2•‘ pÉ>îäÑöѬsuc@»P\‰»™?c.›’l¸žÔëqc¶%ÂÇHab¿}?› ôŸ4†æÞžDþãV~˜‘Fš ™Ä¤M°cÍß2÷@¾¹ry1úÐfX_"ÈgËWŸ0c_AÉŒ’ˆ‹'ç¾Öéz­8È’ä²£7áW¦oH.›¾úˆŸö•Ìð1X}‰hÓ‚ÀegðõW°mÊZR5ð«$ïИÅ{™8ˆ'nt²l_½Cú4û Ôylóª¿[7ï@~±ÛJ·‘7r]׺øºsˆ]ý ß,:DQØ ½ÙÌ–øôëVSâ~^˜Lûƒèf$qãÏ|6{/9îÓû™é¥Û g—•ï6â×´cGõ¢e- 9q™5c1Q™NLáƒx´äØÒ§¡Îc¬úñ;æȧ¢cËÇBhûk7¼ ü¤XÏ/3Wr ×…9b0^ogÅ¡H†µIàË÷rÌ^Qõ¢AïÑÜ2 µHa÷†ÃX '_«^ŸÍû¿ÞîÛ¥ØË]ƒ™Å”OþàÆ^TDa¡ Ù³z&_<Ì}[°øðNrpa/.݆"âw¬cóÕhUÇ“­> =X¸f?ɉìø}6u:ìeä˜íÌlK× 7¸Ú÷ z]iQ´…O6'Ë«îÙÙgl§á wŒ·—ž«=‰ã7¥£Ÿmïsv&ýeóyl2™Õ9žL'TtÝϸ ÚrÝ0ß8Aç_W*­{6ªŠËÃ`¥Î#¹uH[ÂHb늃Dôðâ—÷æoS$"""rÉ YÿÀP‹€¶i?‡7_þ€‡ë0jü•Ô1ƒ)¨ c‡°ëû÷xöß0#¾!ÃÖÇêHeÅ—?s àßNþŽ]y`iOGÛrÞý÷ë|¼ÁL¡í ÖÐËåÆFû†fÈØÂʃ'?¥ìÉlXq¡´mä‹áŒ÷uí‚ûèRí?™ø £÷„»¹¾¹‰C >aòüdˆèJ‡`“â\Iäפ9¶˜ã–:ÝOôt­ú`Ê«o|öÑzËò^×v,1ði9œQ‘G™ñÎxñ“uz\GïÚ%qµFt¢Ñ±_xý•/XmìÎí·6aß´·yá“õ:_MûC™ý$`¬ ,ƒ;n¹µ#Ù‹?å¹—¦0;¥ãn½‚ÒËg©Óž®ULyõ >Zo¡×µ©ìØÌ¡=¸ýúFýõ}ž}ù –tå¶1mð/í'-½°›¾[K’£âøx6¤A¾ìün2/¾¿€¤È+¨ãQš‚¬fŸm­`»3®AQ•×ËNâÎ}ä×jF-ó¹oM> ÛÑ.°˜”LŽì8öæ6à† ×ѧU¬°cÁô9ìÊ>{šM…×À]Ý{Ÿ°Ì™ÇÉ(©=óØ‘ïð£ÁÖ2õ`÷nVLû‘9ñÌ|o›³Ï=å§â:Qy¬èZ^p]9gÝ«¤[«¤ç‹Õ'p7N €6D˜ÐÔŸŠâïM“–NbæáöwñÑmËÖý!·˜Œ‚˜duôÃÃ…0˜}ð6sàØ>s¦b„‚3s+£Ò(´YØw8“æuìJ+–½ŸCy­ñö0‚ѳt?…Ðä\e¹ èÚ“†'óÝîTòݵh1=ïMSŸlÜÅGY¶î(¹ÅPõ±AðUŒýÅû2(tÃÖßWqå£ÝiêM€í(óænæ@Aeó%-ÔëÞçÖi¬8˜ VÌßNω^%ýpvõúìJ·+{ ð©ò’¹Šr±YBñ4R²ÏHŸž§Ï©-œœXÿ¿.w<ó¦|ÂÑ+ºÐ¾ïÍ ïOQÂ>6­\Âò=™gÂõ>YĬ[Æü1¤nGvWÉvn— {‘½tàïÆå>{?ç.k?æ ¼šÞÀSÏ:5R·šÒÙïaçꢨÂ:áÂ+ôÜuòÝrç¦ð?XW,ç{¿uQXayŠrlx×òÅL6À⌷1GÝ‘ˆˆˆÈ%ê=]ÇÒ‹ëzÖ'À7”6‡Ò¶(Š­)Œf Ø (°»0ûGÒ·_}¼ÌON/7˜ñ´hm—Ô$.2¶ÌäÇè|¬‘Cxøù'yò¡¿óÄ“Oó¯± ði@›zÞå«€=¿¯%Ù\—4ñ·b1– „]®ê~5SÙýTT–ƒ¬=[H¼†!mBññ ¥Í‰<4¦¾Æ 96é»w’ÝtƒZãåN×kúrd3±ùçSlß¼c·a\Ý4Ÿ &ô»¶Sé³` Õì³og¬ê°xzâåå…oPZ^u#{ÁÖ¥ûÉ­2ün Žnãh­k˜0¬=jàJd·Á Ë úð™ûtU} ªq*>¾•ƒž]Ô>¯°ŽW\Ýz¤sÏ®FIŽêÖ·êÏ…ÔÉ?¡®ýhÜ®-‘þe+©³’òl$lŽÆÝi0½úáIÿÁÍðRo$"""rÉú3Ü&l$¡Ùüëº ì‰QÌ™¾Šv† Yßî&žxi0y‰ûXµf5GFŒ`B—£|º#½ Üøøí¸¾IКÑɖïÞ#­û@®éÓž¦uëAq6Çvmc}\Fu¡ß]“à‹/ù-6ÿÔÀÑ~b_üÌý7µ§V¿‰<yŒÔ" ¡ j…Ô-?ðõºT4ï§uiçy%¹å¸]€”›ýã$}Ó–5ÃÝO_ՙDZí ù~kÎàêä~ê•ÙOÅe9lÛùnf·Œ¼™È‰ßƬï6’ê¬l5TÅåÙìøfv ·Üð¯ø;I?°ži?í&Ç}~xñ‘Å|µd4·Œ”Á†T¢V,eŸo½’äDµúì |ÿÁï¬ow£õ‰—ûæ%îóXµfu³##FOè¹ v¦çÁ¼E¹nOàäô6 ðÅÑëžÿ ê™à ÉIŠÍÛøõ§Ö%±…'Wy”¾ÏH‚€ Èsgíôœö…gñˆkú1±gm‹½(71ÖwÓÓ–%9l@t¹tKVÅ×*½)™<ætdæ7ëë»ñ¾.¯Ü虽dÔ Ú<"ÏUß*OÿTxø`éz.½ˆˆˆÈ%7fÒÓEþnr÷ýÆ”/òÑÅIòYK¸ÜØR÷³|Ö~–+XCàà³ÒÁþåÆÈéäJ ÀÔâtâÆÆéÄM`4‡õØÃà&^%¯u¥$±qÐœ‚Ã~Ÿ³ÑšTs§E”þéU3OÏ€ÕÏrp_‰`7x·`ÄMmp~8›˜¢Pºök‚ýÀj²•ø¹$)ù#ò˜r.练ŠÄ_” x°ôçÍÀ:NÏùoñÚR²¬¨%IOJ’5VJfåÔÚõ¦”$€|ªS¸#y#3¦oÔ•¯,õ‡ñØĤ-ýŠ´K$¹b‹_Ê÷[Ç0ö±g™`($)z _-KÔòT‘KÔ.ûùߥ6qYžìr ãœ^tò ¿Ïµ(ƒó[\fÛ“«`”,!ª´£dFJ#þËK‡DDDDDäs̤™?"R“Õðå@""""""U3*""""""""5—’?"""""""òÿìÝwxWåýÿñç'“L $€ [öTDe:QAE\E«~m­ÖÑÖZ¬£uá@[G•¢Õº*‚"‚âÁ ˆì= !{çóùý!PÂPŒü¬Äçãºø#çœûιÞ'÷¹®ûŹÏQ-fø#I’$I’T‹þH’$I’$Õb†?’$I’$Iµ˜á$I’$IR-vPŸz_¿fµ•’Ö^’$I’CþÄ%$Z)i§¢‚|Ç„µ—$I’¤Ÿäœi\ö%I’$I’T‹þH’$I’$Õb†?’$I’$Iµ˜á$I’$IR-fø#I’$I’T‹þH’$I’$Õb†?’$I’$IµX„%­°˜4Ú÷èJÛŒDÂK¶±rá<¬É§ò;[†ŸÑ†NmÒIŽ,gûúå,Z–IQКJ’$I’jîþÄtâÆ»Oä½ßÝÏgE‡¶ë¨#†sçå<ü§Él¨ôbëÿ·0’:ŸÍµ¿Dó¨=6ÁöÏžgÜ„Ùl, í¿eb[†ü↶¯[}Çö…¼ôäD¦­( èÛ…×ë¹— §_ÛúTmú”ÿþ/>ØRaa$I’$ýìùätˆD5>•ë5ˆ¦dññ+¯2ó«mT&¶ Ïa ê9’›«rùÝS )Ø+Å ‹mňß]ËÉ©9Ì›ò$oÌ]NfE,» æÊQ½8÷¦ëˆ¾ó&­)#d™Pü#vÝ…4ûèIþødé'ŽáòËúðõ]ï³ÍÔL’$IÒÏ\ ß ½®ã¶žó˜Yu<§÷H£jÃç¼òÔó|°±Œˆ¦C¹mto.mÇð®ëxè¶ÉuÆ#Ž£eÝ 2Ïä™ oòUQ*§ýæÚÇÅÐæÏWÂmO³®ÍÐ}Ë B ’†GŸÃåçK‹øbÖ|üO<÷›+"Hí1lÿm¤KX]Î9•¦ðáCwóÔÂÂOêlbõ²Uäþþ ?fý§.aÊæÊjC0ãäQœœšÇ¬‡îbÂÎv¨štíH2 dpæè˜{ÇÛdVYêý‰>âz‡ÏåÁËØVY“äö†Qä[I’$Iú!/|Üí Ú­~Ž[®û3O/kÂWžLãÈoöF6ÄéÉ_ðäco³µ^þï¢V¬|æ6®þÍ}¼^tW_ܺÁLÞ|`_­à±[ÿÎüؾû?. "ÒOâš‘YøÄ­\ó§gYÜä\®”FtZÿ¶‘~4‘ôhY³™¶¤°ú­ŠÍ¼ÿæR‚¤Ñ­UBõA™ÎqǦZ5…I‹v?é ¼úFugÙËw3ö¥MÐô8z6ðA½Ý‹â3šSPN§Ñ7rïýwqûÕƒhT’G©°$I’$ý°ð§*ë}^xwÛó·2oò+ÌëEïF;'¨e+yñùøjCu»÷¦Þד˜¼0‹Â‚MÌ}uÙ­ûÒ..°G48àq‘dôéMÜ‚IL[–C~æbÞxj"ÓÖW~K›€WW?âHŠ$6 (ɧdŸÀ!DyQå@TL$Õþ2#’h’ ;Vm  ¨F ¸jWðs㦯!sízŠ¨K“äpë¼_áÔIŒ&¦EZn|ƒ‡ïÿoåuç—ÿ7tó2I’$IúaŸz¯ÌÝDî®e(9l,ˆ"%î› j°`;ÊC@qõ¢)ÊÌ¥|ç K‚EYdWÄ’VíT|\ñ)ÑmÙõŤ¥›æóáâ|êTßÒÿgÛY™ ¤w¦uâÞÁc4;IÊز©€j+·‚e”Bl½8"£1àªÝqWð³žÒP€¨„dêPFA™±ì_ˆªŠ •ë_ç™·—°aójæ¼òkS{ѹž™$I’$ý „$¢n:I»æV‘ÉdÄ—³£ø›©m(ÚùrÚ Å;ʈk˜Dô®_—BJd ¹ÕÖd|Ûq”ä–›–°û%EÑMû2´oÕ·ôÿYe&sf¬&ÑŽKÆœD‹]Ož¢H;fWJ†üO™±²´z»ŠM|¾²’:ÏâÒëö~€°zôØšð’,Èô“uûWEþ–TûZ DUè›’$I’ôs÷ƒÂŸÈÔŒèלä„4ºN·’Ï™»yï j%Û>ÿ˜í†2¤Sbã38vØ`¬˜Å×;'fHb£ª¾å¸r6ÎùœÊîgqRë$bä¤ ‡Ð5¶‚Ìïê[úQÉšý4OÍ+ ºíPn}ø^þzëÍÜyÏ8îÓ›ú GÒ­y\õA,äËWg°9òz¶Š!sÚƒ<°3ø DÖ§ûˆ«ÝV¿þ_û7} ¥«f³¬þ©ŒèÓ”¤ø†t?ã šg~Ì—9†À’$I’ž’Úpì®bcc÷9 /wQÑÑ{m Ñ›~ æ± qÈã IDATñt®¸è4ºDÍ MbanauÛ1 G€Ïßÿš¼ ‹Ö³$§'ŽÅ衽i’;‹''¼ÏúÒo&³ mráð£Ø<ífli¸ßãªò×ðua †\4š ÎèFâòÉ<þÚvä¯;`ßáIG1°{OÞ_F¾s@"åeû@°˜õ_|ÄWùuHIkLóŒ$rY;&“ÞË"£s{:÷nO•óX’U¾û³íUy«X”Ý€îÝ2HmÕƒ^ÚÒ©× 9œ­Ù6û ƽ¶’"³ŸÖ>T¾Å+ÃèuÎ…\tN_ZU|ÆÄ'ÞbE‘_’$IÒÏkÎT79yŸí6í»ìžRÖOIÙç€õkV—¸w3z]Ï=ÇÏàúûRl}õ3RT¿Ÿ1ñ]$vÁ~Ý—†•Ëyú÷òÁö`µýÑ ;2èÄãéÑ6ºåìX¿”O߇÷–lßýN+k_“ÚK’$IÒÏgÎÔ´ù‘ûl÷[8Ò"Dþ¸óþFö©dÓ>K¸B”e.dê³ ™j±$I’$I‡áô£ ‘¿ä [b%$I’$I?ž†?! >½+?µ€’$I’$I?ea–@’$I’$©ö2ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j±ˆƒ9¨¨ ßJIŽ k/I’$I‡¡ƒ ꥤX)i§œìlÇ„µ—$I’¤Ÿäœi\ö%I’$I’T‹þH’$I’$Õb†?’$I’$Iµ˜á$I’$IR-fø#I’$I’T‹þH’$I’$Õb†?’$I’$IµX„%­°:i´ëÞ‰6 +ÉbõWóY¸¶€ÊïlN|z+Ú·J'9¢œœ+X¼b+ÅAk*I’$Iª¹CþD1œ±£òÿ×dVZ`ýœ„Q·ã™\}YšEí±yðpræ½Äøgç°©,´ÿ– m|ñ…œÑ®nõ9‹yuÂsL_UDÈ·@]ú\3†”Wdòæ7 °D:Åù}Û]EÁ†/˜<ñ%fo.ÿoM÷×î[÷EРçP.܃–©Ñoüœ×&¾ÄìMå„#îÈŒu"SClùb*O?÷!ʼ‚’$I’þ7yøS¹ý3^~­‚\ŸVÐÏLdÆIüêÊþ4!›Ï^›Ì{_gQ™Ðœce@·s¹¾2—[ŸYLá^c#,¶%Ã{5ƒä°`ê¦}²‚m±¤w:…1ç÷àìë®!úÞqLY[nt HêµìD·ýÚ6–·÷ØÛv—]À+÷ýžù 5ø .½°'‹ïCn÷m}†¥ôæ#Û³åßñÄâršžtW\qënõ‘m8ÿ—ƒˆ˜ú7~¿8’c.¹œ«Ï\Ï­/­£Ü+%I’$é æáOD*Çž7ša½›’ÌcÙÌñø”e”ÕïÉ9gå3~銺]Å—¶¡ÎîFA¾úÛïxhq‰mOæ¢óúÑ!-’¼³ù÷Ä×™Ÿã£B:L…ÅÓyèI4¡¹Ç3‹ ù&ãÙÌÚkÈÿíÍœÕëLúN_ÊÔ-•Õ†`úÀóÔ 9ÞÇ3_Q 4éÜž$ HgðÈãøøîwÙZe©÷/š´-Ȉ,"¯2ní*·}È„'3ùjS᱑—TPV\Be¨Ý·õ 1MºÒhÛ;<ñÙfòC°xÆ[¬í{ -놱5åXŽ*ËsÖ‘S 3'/¤ÿŽȘ´Ž5^)I’$Iÿƒ)kÍšˆï8œóZ¯fâí¿çÆÞ%püpú5Ü3K Qðù£üêª_qùU¿æ†'ç‘›ó ï¬-#P·;—\Ö“Ü×ÇqýwóâÖŽ\:¦ ½ :LE¦Ó­EdÏáí¥»‚Ÿ*¶0kú2‚¤Ñ¹E<=÷E4¤÷1 ­žÊ”%»‚ŸFô»üZFÎòI÷sç¶@ãÞtOñ]*äë·^bâ Óù:¿ªÚ}¨<{‹VP§Ë5Œ¿ï6~Ó7—É/-$?ømí¾}_ñ’‰Üöè§ì}s?ŒIoIJE™ÅÞ€ˆíkÙ¾3ã+Ï^Cnlõ£^'I’$Iÿ5ÿÚWñ$ÅEP´îÆ}ˆ™Yû,!<å.‘Á§OObIaˆäN'Ð|ÃëLš¿•Â­̛2…Õ ºÓ:ÞépI‘ÄD%ù”ì³ä1DEq1å@tLdõA™DFä®ÙDaQ é;æZÎ?*œå“ä‘wÖ±mýzŠH¢q’ãã‡(^ð0Wþæ6ÆÏIbø˜4úYZ¨,íùåâhØíl®»º;›^›Â²â0"ê„SYR¶; •SN$±‘^I’$Iÿ5œþ„(üò_Œ?‘ÁßÂÈ„|ùîT&Íø’í{™Î‰—žAÜ{0yu)!"ˆ«OlÛ ¸ãÞ»fÎD…ocI0ÈóeA: Uä°z;´oÔ‰V òIÞžoç‰&½csêPFææBªE¤Á2 Ë &9–ˆ¨†ôóF¶ßül¤4 >!‰:”Rà ƒk @l£f¤–mb]N9¡²í,žù>[ûM³ØwØ’_óûMX|KN¾h4''¯bê£w1se!A¨, µ;ä DÅE¥.ù’$I’ô?RÃð'Œ˜”úT,yƒ‡fM"*¥-§]~1¿(ÜÈ}«÷œwEÓbðÅœTú&yg3ßÌ}‚ç“7ïEþø¥”„ÅÒ0=üm¾óG‡©Ê­|4s §hÃ…— $뉙¬.A ŠÔù¼ÌeæªÒêí*¶0U%½:ÁèkнŞÁ–L·~­/YÀBÇG „ÓàØQ\Yç_ÜúÜjÊ€°Èh©¤"Xó0-}gýúRÚ.}ž±-&ww¢¤`Ë6*O8‚z‹(®„¨úGT¼‰,Ã;I’$Iÿ#5~çObç\7f­’¢ˆ  @0¬Öu|»³sÌVþýÌ\²*ÿ;9Ú±p[[ŸÉÎiÄǧÑiÈUÜ4ª= ®jÑa+HöÜg˜¸ èÖC¸ù¾;ùóÍ×ó§;þÊ—M}€øftnW}Ð Y8y&["šÒ½E [g<º;ø DÔ£ëðËÙÖN›Æ²bÃ﯒­ WÖítú·L&.±1Çœ>€¤sXQTÓz†ßa0ÇfóòìL"“Sh’Bƒú‰Ô ƒ²µ±4¦7ƒ»¦P'¶ÇžÚ‰ª/?g³OþH’$Iú©á“?Ud}øoµÅ5wJtUk?™Ä„r¨j´ë˜(Ž8¡'õ#s׃ŒÙÙnÓë÷pç´OyúÙ.>÷·Œ«AÞšxá³ü’‘óœa;sÿq[;3t§MÓ# lk¿ø˜Y+’9eÄ1œxÍÿÁøGøÏ/…®Ø8GžIáúÑÝI;é*þØz-[K£HmÞœÔhØ6÷)þþÞV|î§fJWMæñéçqî%·pvÝ 2¿z'žO^³´pê·H'.½-7Œ=uíyî–{ù g)ÿzì}.uŽ®bËü7?y-e^ I’$Iÿ#6í»ìžÕOIÙç€õkVSo?Û¥Ÿ«œì쌉‰†sÃUÇ“V¹’gÆ>‡9Ájû£ÓÚÓ@ºµnDbx9;6-ç‹YïòÁÒ*|èçÔ^’$I’~>s¦¦ÍÜg»ßŽ–~!ò¿Â½rNïJ¶”„öÙ_¶u1oý{1oY,I’$IÒ!dø#ýhBä/ÆSK­„$I’$éÇã+–%I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ"æ œìl+%9&¬½$I’$†*ü‰KH´RÒNEùŽ k/I’$I?É9Óþ¸ìK’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j±K Za1i´ïÑ•¶‰„—lcåÂy,X“Oåw¶ '>£ Ú¤“YÎöõËY´,“¢ 5•$I’$ÕœátÈ„‘Ôùl®ýå šGí±yȶö<ã&ÌfcYhÿ-Û2ä—0´}Ýê;¶/ä¥''2mEf@ß"P‡f/ä§w§IByk>á?O¿È¬Íå„#®Å‰\vé)tM ²ù³)<>qëKCÖM’$IÒÏBxJjñ»~ˆÝ瀼ÜDEG[)i§Šò²ýŽ‰¨Æ§qóͧÒ,<‹_ù_žÆ{ó7Q™ÚšºÒ«þzf/ØJù^™CXl+Füá:No^̼)ÿâÉ /ðâ´9|¹-ŽÇt£GŸ}ÂÒÜ*k€ÚGdœÆÍW4ã“Çà±Wæ².y—žà“WSÓŽËþpÑÓæÞçæ8~4ç7ZÆ{‹r±¢’$I’jÛœ©nrò¾s¦÷™Æq\Êy}Ž 1˜Ë×ÓÿÉ£“–AÏ븭çÆM_CæÚõQ—&ÉáÖù¢Ž8«O©âµ{obÌUà÷ërÞåýiFdL%e»¹`yeDã-I’$IÒÏeÊZ³f! æÿ“Þ(¢Ç˜Ûx|ü­\1¨5uwÎM+s7±ûõ$9l,ˆ"%Ή«j±Ší¬ÌÒ;Ó:qï'J¢iÜùHêPÆ–MÕß3,£ bëÅÕˆWÝÈ莻‚Ÿõ”†D%$S‡2 Ê|åóþEШWw¾žÂ[Kó(/ÛΗS_g]zoº$CEi%‘1Q캅EÅM¥.ù’$I’ô3VÓf± R¨Xü÷Ý|-¿üÓËlé<š+¯GQ7¤]3­Èd2âËÙQìËJT‹Uf2gÆj‚í¸dÌI´ˆÛ¢H;fWJ†üO™±²´z»ŠM|¾²’:ÏâÒëö~€°zôØšð’,Ȭ´Î B Ø㩪@ˆ`(HÁæmTÖoF½OúD¦ARÑF²Ê| ™$I’¤Ÿ‡¿ó'±ëÜtÕ‰´NŠ"2¬_³š¸„ăü5z]Ï=ÇÏàúûRlÝU ä1ñß±‘Øiøu_V.çéß?ÈÛƒÕöG7ìÈ §GÛtêF”³cýR>}ÿÞ[²rƒŸP{I’$IúùÌ™š6?rŸí~ïFúQ„È_øwÞ_ÀÈ>•lÚg Wˆ²Ì…L}v!S-–$I’$é2ü‘~4!ò—¼ÁcK¬„$I’$éÇsˆÃŸŸÞÇ•ŸZXI’$I’¤Ÿ‚0K I’$I’T{þH’$I’$Õb†?’$I’$Iµ˜á$I’$IR-fø#I’$I’T‹þH’$I’$Õb†?’$I’$IµXÄÁTTo¥$Ç„µ—$I’¤ÃÐA…?õRR¬”´SNv¶cÂÚK’$IÒOrδ?.û’$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤Z,ÂH‡VX4ÚuïD›F‰„•d±ú«ù,\[@åw¶ '>½í[¥“QNÎÆ,^±•â 5•$I’$ÕÜÿ,ü‰Ú\NlÛ‘\rt¯Ü÷{æ$pÔà+¸ôž,¾w9{;,¥7¿Ùž-ÿ~ˆ'—Óô¤Ë¸âŠÓXwûkdµvà>"›ræ5#8âÓ Ü>!ŸF.áÒ‹z³ìÞYdæüˆº4ŠÝÊ[?Éììo+òÉBìQÃêükÖ…ßR;I’$I‡š‡?©{Þh†õnJB0e3ÿÅãS–QÖxYÎôemÚy=ûË”t9›K‡Mó¸bÖ~ö:^ü”ìú=9ç¬|Æ/ÝBa·k¸¥ÛÞöá”®©7ÎcÒÄ—øps™“]Ââé<ô$šPÈÜ¿ã™Å…|3ÞÌÚkÈÿíÍœÕëLúN_ÊÔ-•Õ†`úÀóÔ 9ÞÇ3_Q 4éÜž$ HgðÈãøøîwÙZe©÷/š´-Ȉ,"¯2®Úžª’<¶—ìJ/êsÂù­YùâC¬(Èm2áÉL¾ÚTDxl$Å%”—P€=o>1MºÒhÛ;<ñÙfòC°xÆ[¬í{ -놳å[úˆnrG‡Â#ï¬ «²_„¿¦FQð=Î?™D£è\f®ßFVqµ=Täù׬ÿo«wfI’$épRÃð'@|Çáœ×z5OÝþëc{ò‹«‡ÓïÓ»™D6îÇ©[§òϧ¾d[Ê@n87/¿ƒGó1àÒ‹¸¼ßZîYVmæLR—Á´ùÏãüùÅ"šž|)¿35w¾ÉF—„ép™N·=‡·—î ~vªØ¬éËò‹6tnÏ›[rÿ;/hHïcZýPê§7&¦pGþ†+ÚÕ¥|ÃLya™Áƒ?ÿðÄ4"’èûË?02-‚ÜUŸ1åå,ÚQyÐç_Óþ¿­v’$I’5ÿÚWñ$ÅEP´îÆ}ˆ™Y;K([Í^ú%‹©L/â¾ÎÛ+rÈߺ„·&>ÇÛ÷]¾R•ý¯|°šœ‚­,˜:‰…±=èÕÈ÷QëpI‘ÄD%ù”ì³”1DEq1å@tLdõA™DFä®ÙDaQ é;æZÎ?*œå“ä‘wÖ±mýzŠH¢q’çûA"2`pCæ¿þ%y{Ý€Š<Ì•¿¹ñs’>f{ßzBeylÏ/'EÃngsÝÕÝÙôÚ–[áD%DQ§ù ¹i=<‘·óºrÙýù>·¶°:±Täf³ræ3Üÿпù(x,¿¼² #þühÿßV;I’$I‡Á”µfÍB~ù/ÆO/¢ÛÅ·0þþßqiÿ–Ô ÿfo°0‹ÜòN|ý:eæïüÒQˆÒÍ_2wÉö^½R•·…¼]+v°©0š”X'»:LTä°z;Ш­{íŒ&½csêPFææÂêûÁ2 Ë &9–ˆ¨†ôóF¶ßül¤4 2!‰:”RP欻æÄ´:‘c+ç2{SÅîm±šÓ¬^ T¶Å3ßgkJšíçÞß’S¯¼…›O‹çÓGïâos³©üÖ> X¤rÛ<ÿÞR6nYÃÇ“ß`]jw:&‡ô™—¯y•;þü8o|¹ÌÍËyÿÅ×X× ’#¾×ùÿþÿ¥v’$I’'a5m“RŸŠ%oðЭ7òë;'‘Ùq$¿8¶>a@(Ú¹ì%HI^9±©ñ»×—E7>ž!Ç5"j¯ÃíˆL¢Q|9¹%¾ Z‡‰Ê­|4s ¡ˆ6\xÉ@ŽŒÝ¢Hí9œËû'AÁÌ\UZ½]Å毪¤N§3}ÍÞÁ–L·~­/YÅÂm.ùª±@,mû¶dÇÇ‹ÈÞ}[ §Á±£¸òÔÆ»ïGa‘Ñ„SIE°zЈ>‚³~})]3_bì_&òöÊ]Kû¾­* 2wPý›X!‚¡U¡ƒ òÄÙƒ£[%ì¾Y«*¨†¨ …ôù׬ÿзÔN’$IÒᤆáO€ÄÎ#¸nÌZ%E"€`pï™A›>žGE—! lY—˜„æ <0cƒì}ddƒ~ ?¾I ©t>m(]JæñÑ'»:\Éžû Ýz7ßw'¾ùzþtÇ_¹ã’£©ߌÎÍ⪺`! 'ÏdKDSº·ˆaëŒGw?ˆzt~9#[ÂÚiÓXVì“?5VçŽ9²˜/—åí±ä´’­ WÖítú·L&.±1Çœ>€¤sXQ‚°DZvëJëºÄwÌñÙ¼<;“È䤤Р~"u¾½Ò5sYQï$Î9¦1uãÓèrÚi4Ûú)‹v÷èÿ;nÃqqù l›FbBCºž~M·|Ì¢åyþ5í?ø-µ“$I’t8©áKuªÈúðÞj9Škî:•èªÖ~2‰ åL«~dņ·øû¤s¹ôòÛ8+®ŒMŸMál£²aõãJÖÏfC»ÑÜ~N}*6}ÎKOLg£+ t8©ÜÎÜÜÅÖãNãÌÝiÓô(ÛÁÚ/>fÖŠdNq '^ó0þþ³ÇK¡+6Nç‘gR¸~twÒNºŠ?¶^ËÖÒ(R›7'5¶Í}Š¿¿·£Ðš‹jÔ‘fUk™‘[}ÁiéªÉ<>ý<νäή[AæWïñijó¿y¯MT:'Žºð'ÇòF‹tâÒÛrÃØS÷h½‘çn¹—¾­‚ELü{*—Œº†»/ gÇŠ™ðäl¶UÑ»úÿšåy¥8ó…_=ÏCSÏeÔÅ7qNB%Û¾žÅÓÿøð›>êü@ÿßR;I’$I‡@›ö]vÿgný””}X¿f5õö³ýžñ=~ÍǾÃï^L‰×D?q9ÙÙ5; 熫Ž'­r%ÏŒ}„s‚ÕöG§µ§ÿ€>tk݈ÄðrvlZγÞ僥9TøÈŨ½$I’$ý|æLM›¹Ïv?§%ý(Bä/~…{.äœÞ•l) í³¿lëbÞú÷bÞ²X’$I’¤CÈðGúÑ„È_:§–Z I’$IÒç'þ„(üüA®ýÜ‹!I’$I’t¨…YI’$I’¤ÚËðG’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ"æ œìl+%9&¬½$I’$†*ü‰KH´RÒNEùŽ k/I’$I?É9Óþ¸ìK’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j±K Za1i´ïÑ•¶‰„—lcåÂy,X“Oåw¶ '>£ Ú¤“YÎöõËY´,“¢ 5•$I’$Õ\xJjñ»~ˆÝ瀼ÜDEG|1¸qÜ…”ÏúˆÍ‡à8é'¦¢¼ìc"Œ¤Îøé—1¸{[Z·hN«68ú„9.=Ÿ¯­'¿jÿ}†%¶åÌ«Ëõçõ¥G§£hß¾#=íÇà>M©X»„U9„,ýkÓ‰ÙjŒ IDAT¾Šó?diAp÷õHì}#ã/ cάõ”¥ àöñ7ѯâsf¯,d×Q1®â¡_ÆñÉìµ”%ö挂9sXW  *£×ßu ½K2¯°c¿£’V‡¦}ÎáŠË.ä¢QÃÒ·+í¦È­ˆ¦Ã•÷rGïM¼ûé6*€°¤ÞÜòÈ-œ\ú1ï¯*&D9‚q9™‚%±\qßAüNI’$IΙÊ˨›œ¼ŸÙª¤C"ªñ©\ÿ«A4ÊâãWçÎÛn綞çUeÔï9’›Gw$a?#.,¶#~w-CÛW1oÊ“üùæ¸êú?q׳Ÿ²£~'νé:ÎjMÀÿ`!àˆ3/ oƒðƒ:>"õX®ºa×Ç1þýLʦ°8:\ðn;/uo=Íí7ÿ‘۟ΚÔ3ùÓØ é’PÁ†ù 4iKƒH€uŽèJ“4ìÖŠÄ°onÍu›·"~ë—¬.}ïó–$I’¤jÓ”·ŒL㸋Çø'câãåæ³Û’ÙÓ~s íãZñË?_IϺ±4x)·?ô(Ÿú¿íRú5Š„ˆ½ŽKˆ ñ¨Ó¹îÎøçSðàMÃéQßi:œFR]Î9•¦ðáCwóø´ù,_¿‰Õ‹gñì½÷ðÊzH8fýîýwAÆÉ£895YÝÅøÉ_°*«€ââpštíH2 dpæèHsÞÿƒ…ŠWòÆgõvaOê}ÇÝ/¼~OÆÜ4Œ¸òÐÛ›( \郸èø Sîy˜?ZΆ¬,6.ÿ”—Çk¥G3ê”tÊÖ,$+± -@Mº5&ûýwÙܨ;-b@w¬OÞÒì¨ü~ç-I’$IûLYkÖ,@|§ó¸ ÍJžúã \{Ï;„õ?Ÿ ²yó |U´‚Çný;ó¢å²³ðÙãcù¿ßÜÎS«Z2üÌDWfV;î‹ðî\~Å1ì˜t7×\{ÏoéÂåWž@ª“]."3èÑ2²f3mÉ—æP±™÷ß\J4ºµJ¨>è"Ó9îØTB«¦0iÑ7íQé ¼úFugÙËw3ö¥MÐô8z60ýÁB¥¬˜ü<óç‚®‰¼†'wáâ›.¥Õ¼Çxð­õ”†¶pêµïDݵÓxoÓ^ëY+7óÞÔÕ$tî@rþr¾*H¡SF D¦Ò¹e‹æ~̧yMèÙ$"SéQÅšE[)ÿç-I’$IûSã9D È’ã"(Zó.÷ÿþ^fl«þB“àŽyðOãysIEee”UEõL'@r—þ´X?‰W¾È¤  “Ï&½ÊÊÔž´MpŠ£Ãe$E”äS²Ï šC”QDÅDV_¾‘D“dرj!D5bÀU»‚Ÿû7} ™k×SD]š$›† Á¢%¼øÜ ÚŒJû¸ýÜc"38ýW#h¼u; :Ñ(*ð=ú#¾^ å9¹ûý;(Û‘MiL2qU[ùru&í“Ô†uÖðå¦-,þºœ]R§n3ZÅná‹ åÞ’$I’t )kÍš…(˜ÿOx£ˆcnãññ·rÅ ÖÔÝkn EÑlÀÅüáÎÛ¸ýú Ð,v?ï- '®~<±G]ÄÝãïãÇñ·»FÓ&"œø:Npt˜¨ØÎÊl ½3­÷þ+¦qç#©C[6P-" –QP ±õ∌jÄ€«ndtÇ]ÁÏzJC¢’©Ce~öëБ¿àe^ØØ™KÎjAì~n3Yoç¯?ÊkÅÇsÅY-ˆ lA sJˆª—DÌ>ýˆJ¬Gti.ÅÁr6ÌßL\ë#ÉhÓ™äóÙPVÁ–ùkˆjwhOÊöE¬. ~¯ó–$I’¤ý©á:’0b¤P±ø5î{ÿe¢RÚ1äÿÆpeÁÆÎùïD§þ±¿à²ö‹÷—ÇYYXEl·ë¹¯ÿÞ})Î-&÷³ç¹ù±%”„ÅѨqù[+½B:_YÉ1ÏâÒëRéÙjÏà«G­ /™Ç‚LÇÃ…*(­Š!9v¯§pêǨ(cŸÊsøè_¯ÓïOrz~nõPºbs?ÙDYEˆéÿ˜J?^Ì°ywòÜò’ƒè£Šœ¯’7ìTúg|Á¤ {,ýŠhHßÓ[P°à²*ƒ×,$;¥'Ç›BÖ'ë( Ahì«{&ý©Cɲ7É©úç-I’$IPãwþ$v½€›®:‘ÖIQD†‡ *¸ó©‘ÄF… eE•‡ˆHjË)§6'&2šð]3–@$±Q!rÌfk»³Ú-„ø4º ý¼xÿ_F’~š‚dÍ~š§æÝv(·>|/½õfî¼g÷ŒéM}€„#éÖ<®ú  òå«3Øy=[Å9íAØü"ëÓ}ÄUŒn «_ƒ¯‹ýž÷•o`ÖÂ0úŒÆq-Ó¨—Ô€#{žÁe§Õeé+)ÜO骲f3aZ9}ÏjCÜR”Ê-ïòääBN¸l­÷}üg¿}TnžÉ3³Ãrï8÷˜V4N©OFëž ÿõõ ‹ÿ„MÛDP•³œ%eGÒ¿M ó—åB%kù4³!Çu‹cý®÷ýÔà¼%I’$iOá)© Çîú!66vŸòrw½×ÖÅ›7Bû3¸xôÙ é׎¨Å¯òäÔeäWABÛ\8¼-«ÿó:9ÎãŠÑ§Ñ·]_¿³ˆ:}†Ð-ïS>Z_J|Û\8ü(¶L•·×&ÓÿüQ\4¬?G…-âù'¦òu¡Ë\ôÓSQ^¶Ÿ1‹YÿÅG|•_‡”´Æ4Ïh@b —µóg2é½,2:·§sïöÔY9%YåìÊ#ªòV±(»Ý»eÚª½:´¥S¯:r8Z%²möŒ{m%Ef?®}¨œm_/a{ƒ£9søÙ ;}G7 °tòþ9g å!Ä6§_ß,yçS¾y¨0HÁºuDõ8žÖU‹™>k-¥ÑM8aP3ÖÍüu¥»ŽYAe¯‘œ›±š9«éó}”ËÙ¶øcä7渓Oãìa§1¨[ÂVÏàÉÇß`qÁÎûZ°ŒP‹þô‰Ï˯/dGož`ŠíÊIr™úò,Ö—†ê¼KüÛ$I’´sÎT79yŸí6í»ìž6ÔOIÙç€õkV—h¥Š òk0&$vÁ~Ý—†•Ëyú÷òÁö`µýÑ ;2èÄãéÑ6ºåìX¿”O߇÷–l§ÜÉý¨½$I’$ý|æLM›¹Ïv¿-ý(Bä/|;ï/`dŸJ6í³„+DYæB¦>»©K’$I’tþH?šùKÞà±%VB’$I’ôãñ•Ê’$I’$Iµ˜á$I’$IR-fø#I’$I’T‹þH’$I’$Õb†?’$I’$Iµ˜á$I’$IR-fø#I’$I’T‹þH’$I’$ÕbsPQA¾•’Ö^’$I’CþÔKI±RÒN9ÙÙŽ k/I’$I?É9Óþ¸ìK’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j±K ZauÒh×½m%V’Åê¯æ³pm•ßÙ2œøôV´o•NrD99W°xÅVŠƒÖT’$I’Ts‡>ü‰éÀµ·`ö­óEñÿŸ“$õææ›ÚòÚØ |]æEÔOEu;žÉÕ—õ§YÔ›'gÞKŒv›ÊBûo™Ð†Á_ÈíêVß‘³˜W'<ÇôUE„,°$I’$©|òG:D"3NâWWö§ Ù|öÚdÞû:‹Ê„æ3x(ºËõ•¹ÜúÌb ÷z’',¶%Ã{5ƒä°`ê¦}²‚m±¤w:…1ç÷àìë®!úÞqLY[n$I’$IúÞjþD¤rìy£Ö») Á<–Íü¿™KŸ«GqTl ­oy† ­‡pÉ°Þ´¨[ÁÖ%ïóïg§³$?Hd“!üad9Ó—µahçõüí®Éä´8™‹ÎëG‡´HòVÌæß_g~N%„ÅÒ¼ÿù\|jGÒØÊüYˉ xñôOç¡'Ñ„BæþmÏ,.䛌g3kW¬!ÿ·7sV¯3é;})S·TV‚éÏgPƒ<æ¡ŸÔHŠ$&(ɧdŸ4‡¨(.¦ˆŽ‰¬>è"“ÈH‚Ü5›( A ª!}Ç\ËùG…³|Òƒ<òÎ:¶­_OI4Nòã|’$I’¤ï¯†„(üò_Œ?‘ÁßÂÈ„|ùîT&Íø’’ÿΆ‰KŠ¦h[å;_T*Êb{EIu¾™Ä ³È-ÄÕ'¶íÜqïˆÝí£Â·±¤N$ÅI‘ä/ÏÝýµ¤Šü-äWéÕÓOGE«·CûFh•ð!ŸäíùvžhÒ;6§edn.¤Zn,£° b’c‰ˆjHŸ1¿adû]ÁÏFJCâ’¨C)e¾ñG’$I’ôýÕ0ü #&¥>KÞà¡Y“ˆJiËi—_Ì/ 7r×Ç»gµç•פ.Ql¢Ä¥P?²„y¥A¨¡Phçò˜ ŹÅäÍ{‘?þc)¥a±4LO [9w”“˜žD8yÈĆ$ºF?%•[ùhæNц /HÖ3Y]‚@©=†syÿ$(˜ËÌU¥ÕÛUlaþªJzu:ƒÑ×4 {‹=ƒ ,™nýZ^²€…Û*­³$I’$é{«ñ;;àº1h•EdXˆP‚Á]ë]"‰‰®"kÞgìh{&ƒÛ§ŸNï3O!eå‡,-Üû † ;Îakë3Ò9øø4: ¹Š›Fµ'!¬ŒõsvìٜҶ>ñõ[sâÙ=w¿7Húi’=÷&.($ºõn¾ïNþ|óõü鎿rÇ%GS ¾›ÅUtÁBNžÉ–ˆ¦toÃÖî~õè:ürF¶„µÓ¦±¬Ø'$I’$Iß_xJjñ»~ˆÝ瀼ÜÄì³=DÉ–MÐîT.8ÿLߖȯ¦0aú ª$´îLj³Ú²yÆ$ÞÍLeÀ¹ç3òŒ£ÉÈ›Í?ŸÍƲáuÛзk€y³—’„PÉ–f&sÂ9çsÁ™'Ð&ì+^zú-–©Ì]ÍŠŠÖ >ï†pEsßeGZ]VÍ^@¶ïþѬ¤¸x?c–°aþ',É&%5ƒ#ÒSHËcÝ—ï3eÖvulG§^íˆ^½€¥Ùÿýl{0 _mO¡kçt´èFö­éÐý8Î8w(ýZ&5÷i~}f?ßR{I’$I%ÅÅÔMNÞg{ Mû.»§”õSRö9`ýšÕÔÛÏvéç*';»c"@b‡áÜpÕñ¤U®ä™±ðaN°Úþè´öôЇn­‘^ÎŽMËùbÖ»|°4‡ ƒŸP{I’$IúùÌ™š6ß÷ɾ9GúQ„È_ü ÷>\È9½+ÙRÚgÙÖżõïże±$I’$I‡áô£ ‘¿tO-µ’$I’¤¯M–$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©‹8˜ƒr²³­”䘰ö’$I’t:¨ð'.!ÑJI;ä;&¬½$I’$ý$çLûã²/I’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ $I’$I’j1ÃI’$I’¤ZÌðG’$I’$©3ü‘$I’$IªÅ",th…ŤѾGWÚf$^²• ç±`M>•ßÙ2œøŒ6tj“Nrd9Û×/gѲLŠ‚ÖT’$I’Ts5b:qãÝ'òÞïîçËÔó¸ó’|Æýy[*ÿ?ží¿ó³"/ž~jÂHê|6×þrÍ£öØóÌó™ì÷ÉÌìÚ“®Æ%(j ãÇ ¦G„‡S;Ö¿r+Ç˽?,½nC2Wóaã8ÆïEûˆz”ßÎÚ„¿“œa§ò¨ÙZeÖ#—²vÆ ì)ãbT—‡üMè~Ë=Œ¹¡#an ¿ÝÁ;ËV“œáÀ{QëPƒF=Úöĸ+hìæLú—¬]ö6[Oý$SSÌšÇo[Wz-}SæNÇBø•·U[çšæ{îxø‰oX ïy+︖öìœHÙÀ_W$s¬Ì[ãm;ÿø‹ˆˆˆˆüÜg«+÷Kþž˜Jf§ò+fk9„i -‡/ã™7û/Ì^²šMGì4Å̱] >Ïg ŒfäŸâæ.nv¯93§3yÚÌc;ùM»qÇŒ©Œh€¡ûiúXiÚ!–ÁcþÀØÎUjevdìƒ7bùøyþ8óU¾hz3ÝÒ[¥&GçNÅì)íÉîîFîúELyð ^Ûß’»î£µR0k$ƒÆ£u qN£¤º~óð“Pç;˜pu!ëæOgÒÔù¬Jfôﮢ‰q‘ëPƒ–72ù–0vþõI¦L{ŠßD1zb_ÂÌ?‰aiDd`&=Áô™³˜>sÓ^ÚE¡L¡½«¯sMó=Ïxø‹o¼‘)wGñÍÊÙLžþɶ8¦éD QÃmó5þ"""""?sµ»òÇÒŒ¡ßC— út˜3‰e« qk‹ÓNâl>œÙ¬l;ÅÞm°dleeâ)®¸kWFšÈH^ÎÂ7÷Rà5Ñ°óP&ŒîO·fV %óæ_×±3ÏÖzÇ׶¡¡§€¯?\ÁÒЧÒ:™³’œž#?ì Z70(ÍØÉÛ¯¾Aòi'–ÈšäŠ;v*³cwó±»q=#pŸØIbÂj¶œóh‘j˜‚é~ûZSħÏ/ !µ¸âJ“=x„‚GgqÛU·ÒoCëO¹ª‚‘ƒ~Ë ð3l}~>Ë+>gØ‚iÕ£+!€Çˆdøؾ|>÷#2Ý*õùÕ£Ù¥ÑDÚJ8ã ªº¤m.+û”g¶#Ï I‰{8ñJZ­IçˆL¢¹¬|‰áƒi‘ùK¿åÊäý%ËÙ_ò ¯þùvV½äÇÖúj¢ÓWð§i ùÐt=÷MêÈWKãÁ›1®‰£gSãXîýýUä¿»€šËêÓݹwR_ÂÍ ºÝÉè‡I˜5‡žÙ„©ß]ôË­²ÎÝ×0~D;âŸäþ‡ÿB‘K¹mx„ÄÜD§£ãñ©sXv°£' ¢¥¾×Ë…²FÒóR älccZqÕ[´œ§H~ÿ"ˆ‰®zÐY[Ðûšp¼GÖóîWß7~ZÐÿ¾éüö23×,àÉœ„Ö½‰ Ó#º|ò±ÃjÞØÀþBw•S\pd8–ÜtrœÑ{”ü –„Ö3Î.ïpŽ”oÉÝŸÀcÏA¾÷lÓ%0²=aÎlNWó÷âÈ9ÈÞ#…Ô‹y˜×^œÏ#7ä³võ =±^;GÖ'°bKNŸ1À•¹™×? àÎ?-ൗæóÈ bÖ$|Až‡*1¼ ›ÑÐBÿfóü’¹Ì¾ï&º79»ÿ–USçš›ïñðßÙbÂëöþx|ºœxë…døß6¿ã/""""RW›?Õp祰q{¥Å'øê`.y;>b{V…é©8c¢A€…îýˆ:þ.‰»2)*ÊdÇ»ïp8<–ŽÁ``Xƒ ²P’¾™E>KRvÕIˆ'ÿ ž{âEÞOË¡Än§¬Ä‰-Ȇ¹Æ9˜wN2om>B^a»ÿ™HJP/®n®I¶\è‘d%ДRvΤ܋£¤`«o­zû–¥1­B ÿÈ Š¼`ØšsÃäï? Yüa:™ÇŽSB#Z…˜UçZœâ¬õ-8Ëì?Lø=ŽìبoLAtèæ&åh)žò3äqà1мçíÌx(–Œµïðu)`‰ ÿÝב—˜ÈÞâŸ\~U£ÕäQ¥»3~òã,ÙÚ„‘“ÒÂr뀋¼´]ìL/öûl)[›8îìfݳ3˜8ù1–$7âÎ{ûÑì'1¨ˆ³ ›CI <½ðM¶¹{sÿýinÁkš¯ŸñðßEfÊ>—Å10º [Ó÷Ö4·˜±š ÿÛæoüEDDDD~þOºgNïÙI¯ÇãÁQꬸ;Á‹Ç `&¨i;ßÍ‚FWL†MØÌÙì«g¦(eK aØÄÙŒ þŽ”MëYó~ •ç^¯¶7Œ$®G¶’<2íUŸMQ}g¹ NRðýwyçwdÙhd\Ú;¤æœyÎ…®-.§}Ã-ü» ò¥´¼üêaçôÉ"ªL=vŠÊ!ªIV[súN~„±]¿oü§ÜkB=ìÙõP­Zœp–»°Öÿ±1l²€“r'AQ\N*oU\ÊajÍÐñãÚô0럛MÒ¡"<˜ ¿n  ×17¥O“ªk¨Y “ß<|3jÑŽ{éy<ö\R“>&³ïÕ\ô®+ÿȼ;ÛbÃÎåO²àÓ|ÍO-×_õÏEó^Wüõj>8p°wÿøö©ßÐ=d3TºeËqd ~üÇOf­^Ë•O¢{“MœÎvû¨QMóõ?¾Ç\éëyqÝ&NyšÛL¹ìÙ²“ÓöVÚÍ4¿Þ׶maw7ÿëùU6j2!+-(¥`Çjf¾šF€)ˆæ-ƒ)ÌòŠsß:&¯ÁÚ‰a÷OdRÑ žüìÇ QÓk&0¾Ë>?Ïáb71ÓXدhÔ‚Ææ]»k‘ ä—ê?»r\™|–t”ác:qÏÄÉ~9‰#%^0lD\9’û„@á6’—ÿ¤it’‡]\uùÆM '6ºrã05¡gÿö˜Ëv³'S ÉÚœkŠNeãê×–&–½”¸ÀÚ†Æ%äØ!°óåXö¾K‰Œzí¸uúïé’¶ŠÇ^J%ÿ‡Ó€Ý£ïÅ’øq†“ ^2‡MÏÎã5‰á/÷™ ësÔ_É̇±†5³×‰Ãã&;éi&&ý·u¨ù=L^†Q©Ñn`Uê`|i,]Íøâ`!Àãvâôxq{¼~jTÓ|­~Æc.ožŒôßd  d×<¾éu<@@Ô(žêq”Óe^?Ûfó»¾7Ž8t˜‰ˆˆˆHoþVmµùÕßíÙFÖ°[¸9&‚¨A㸷ËNæÌÛ =F3#6…Å/lâ¤Ù‹×·ÇSifLV+ØK(qx±4îÈà!í¨ïÀ|éXÃû3òú}$|YJÛ¡·S¶“¹§4É– ߧs¶-#¡ó &ÆÜÌŸ_Èéosq·¤eųN¾„˜vA|Sù™@žbö¾“Ä©'† ™ŸaIEãÇ°6%æöÉŒmGÿñ_—êA#µQžþûÇ2¬çç$¤Úè×wÊR2\õéÐÃÊÞuÅx0Ñ°ëMô3’y>ù4Ö&a„x~WÈþøǘZq®3…\ÅÃÓºðÁÜ×Ø™mæÒ15‰qÆw~¯¼q‘¹ç¦†3àóå$g3b!‡9tžñ¿~ M;_N»²ƒìöyë—‹ÌÛ93ã†uËaCº…N#†ÓæÔò=Ub êÁ˜q½hŸÈçÑq7ÑöÔ6VäCpŒŸÑö1ј§pÐg¾åx|Ž‡“à¾ã»Âú2õ‘h>}e%ÛrÃ82†¢m‹Èpº0ùܶRòý¬ODDDD¤n7œY¤kÂïæ=ˆ;>û§Êyÿ&~Y(F=ÊK¡ÎùŒ7_ý„L·Ó–¿ñ^ûqL[G€»ô¯áµOóðx,ë¼ø¿¬å“+Æ1ïå›)<‘ÊII5ŠI×æ¹c5ÍÂKé·É|Ûe< îjŠ3c;[º‘ãú>/µáÊåÓWf“uÝ0nK§6m¡ü;Òw|Î'C®í4XIDATˆs-ƒ§> ‹—ðv¥ãøû,IcæøXš ™Âœéd–Ûhu áµ-ž7eêFÄZò–¤±ò…¹wÜ£¼2ÎÍ©]ÿdñÚtìõ:rE½4þyÆX Ž$(²3Ϋôé¬|d>›óòÉ«xÅdãò8(Ì?C©µÓÄð‘GuM›oÞaé†QÜ5q6w4vrú«M,]¾‹ïEª€@Ô°ñŒÍ\ÄWéÅ>srœØÈs«ê3qì,^ ñ“–Lü+[ÈvW1mÕ*ž]?Š{&<Î] ]díÿ„ø—·’í6s‰¿•´dð¸ßa~y?öùÊ× Å>ÆÃeõÿdñ"™üà\nwg³oórm<}öØò¹mþÖ§ãKDDDD~Œ]ºÿ0…hzÎŽ§%(¸a]Üt‚{Mã™>IL[”J©ö©¡’¢ÂZ »ä±)×ÑÌuˆe>Ç–õºÖs·B\'×|¯*D“˜.>i»›‹>l0ŸÎ™Éôµq»Þ…¹A•ê'‡l)§Ø¶uÿžIÅ^š ßL Õð@?xɇ¶„ ´~´¸ý.ºT®@K–Œ‘’+,n UèØ©þXô×iÒ’sçkÛõ+iñHŒqã»Në[‘÷ª2߈k­ˆc£ÔÎ_å1ÖËxžùàR±PÞú³œûŠŸ³¾*w’F gÊS_ðòʺtîÒsÂzV[†óùK­¸¼i1M»q‹Oûÿ\À~<Я!'X9{‹ÂS±kŒTër/ë@1‡7òówËØ—h­/·Üþ0#z7!ÄÃFÒ¹Ý,›·€uÜU ÿgg^¢Ñ£y¨W#*¤EîcùÜùût:nMgº‹å16{Š/_hN̺uÄ·èJSßTŽoø…™‹på¥ÁXµO=Ûís˜ºìiùfUºŽâ…aì;ƒ…‡R²&} ­zßÉ}õ=ùä³eM“k4¡@ëG«‡^áùîl _ÎÖXk¾‡u-ñÆst­k$vçïLûá$ßÍ3&ž]Ä–ªwç#¯mîÅgNc[ÙUyÎÙD„E‹o£¾<<¼7-«ûb»|–ýÂϛΒNÆïWGÉ#%UXÜè«r÷û/ÑÙ 9÷ÞΞŸB®Ì×ïÏóz•ùØØ`4S^ë@ʺ¥œ¬×›N5Äïÿ“߬áŒÙ—–¥0ÿª®9$F„¸±)¬oîE™+´~ŠsŽ=•Z ㉻Sßp‰-Ÿ ÁݽÑýùã÷çîU—îO# åm¼3uŒ±ìÙrCö#Ížâë©?‹ïî.ÝY±Å®€-†µ3qàüb&ýzS!O íÞ ·³G¹¤¢åÝã×ͳ‡Îcñ­ÏàᨬÓà^ïN^ՙШM,ZqG“þ¼ð\oªèÁ«épžÒÏÓ›øcånÂ:0âÙaÔÑ]¿®ÙpžØ÷³Ûø{Ý>’«´â¾G{RE_”òä>7¬w+Ì;ÿfÍI7õ’qÝó4˜µ ¡e? o{‘×îh@*=ÆðΨ6„ø×bÀíÍñ+ÐÒÚxíå¡4*/7•¢|¹2A)>%°Kê¥ãp¬¡í†3²¹‰uyÇÄüÿX^`Œ˜³_«Ûʮʳ/ú .Œ{éÚ†&±kíškÐå¡çx¤¥w‘Ư¹@^2FŠA)nl1¬ýúgY€ØµL™½‹$…õÏCe>ÎÚ»/Õq$VGåw2¢}Þ¥2ÿª¯WUWbDˆ ë›+s…—Êœ£ êÂ3Oõ¡¡×%víO Þ°ÞT)$}hOžן¦Æ3lZ·›¸à6Üÿì½4ñÔ\]l™oDYSŠû©|ß±¿{¿,Z¯¿¯å`*€ƒ„Ø 7ÚÚZ¶ë/}ª:HN·£+Â8×öÈå¢* •XÐWíÇóOt§žñ";wÇÖ§• <ç†èÏ’Æ{1Ïu…¥˜¯‡…ĨX22㈌ËÄQÈÓ¢—}ɤ¯góí–d ™õÓ§0mæ÷üøã£3R¯ß­øsÅß-æÏßçñͦd¨Ñ•[C è¼|1Z•”S›˜;m6³î'É^03$îbþ³™2wÿ9Kl&à„·®(åÉ}nÒÆo™µè/Ìú‘}f u{´"èÊã&Ž/þ‰Mqjz×ïl€·&ûbhDs<LÇXðÃ. 9ˆik à•';(óŠÈGOµÁϪnœR·Íàƒ©sørÎ?¤ ¡R°)ùÆD ÆhNªÇvQòô#¬C/hMìýf*3,dÆç¿pÚ hN·«ã7³ÐóÊ) •¸qXH¼MŠ0'•ŠõêgFê*Îǹ;È„uÓ˜0m6S¾ZC<XÍ}©Ì¿jëAát•âFâÚúæ|®Ð¨ìùô„vèA]­‰=ßLå«ïfñѬ…¼©#ôÖîÔ$m³góýü9|þÍöµì[ø‚(ó(;jcC«|Êwø²“tl+W®cgZUzƒéðÏÌÚ’Bjm-y[˜Îá¥Æóåöd‚‹8Î]Ý#Ë|p-¨Å‚Ý»S•T¶Lÿ‚¯æÎâ“9G¯ú©„òߟ%÷âžë /MËLÊÄŽ‡Í˜HÊ°6l9'A‘€#PŸ~ň+¯4æ«#eï¾]ww÷ìÈ&}€TŽ­ú‰£» ædÇ”¦¡V÷=Òsb )FÈ:}¡ÁÞÀEND›i‘çH¤Q¾¹¾ü÷gÉ㽸çºÂ”ÚåPá—®¼ÐBJŠˆä×Ï~âpºcåÔ°q>ÒŠOX‡—òþï1xÕoMï»î¥gÿ{éÿß!ÄäÍßHíÛ†Ó³fË'¾ÅâsÜþÁÛ +Á?ƒT/÷M—ÉôªJ *Ž”“ÿ‚HKpãšYä\ W¾Ú4cßïI’ïW±ÆüÃWÂSoÿ _0îòþWbÛ5vÒâRj‡ÑDYÑøT¥š7“ˆ.ÔÕñ[#EU⸱[HVœÍ¬ôB#µJcþU] ~ñ$F„¸ñ”Æú†êžÏFzbàGÍÊF4Q¸‡Ô¢’/  é€/Õ+ Êë{x¸‹û.`StÁ³Ì7¢l) ­êyhqÞgúÜÂÈgQþüòö§:€om-n[üžý,‡=§ä6ÒUÆùöBòvm|ýÛ¨¢PŽ)1©@ uƒlJ4ãY¥&~@zžgÝýYÜxÿ#ûY¥w®+ñå‹ mK·&§Ù”áô…Èàĺݤ6ï@ï^­°Ÿõ¢íànÔKÛȇ[þ÷Å=<{[e¢÷ldû;>î: ™Øt{ü#¸ ×•hÙgzGcúiàúç)òóêø¯èws¹ê­4ÕÛ8¶vq…ÜÀå¿ ÂÉÅ[F,›¾ûL&¡êÊDñÚlvW¯_óÉ5gòÿÿ­ÙÏr5¶³õßNÜ~?mÆŽã±'qkÞ›ºd°ke8Ž[žsqüžfMxRöGAeŒ”Dñâ&G'çãmª¯Ô•Êü«¶äÍ_bDˆYÉæ©,ZÅ9ÇJä¿Û¹4híû®Ânm…W_]úwßNÇ1“ñ_ uz´§Væ6Ö$ç]e¾×NácC«~Ê9Lj½h9âºøƒõì),z0¨‘SÄ.vÜ€kk±ÚÂxU*DªsÏ«óUß#—¯6ª(  ¶n'¦÷º?ûÆ]ITïÔèªË¥?‹ï>YÏ*½s]I/‡2ϱþŸ(wmÀöÙ¶©8‰8H _Èç tŒ¾­Ã[Û‰?¶ž¯¿ÿã™V4Íä[Ÿ¹£c/†µsâ)ÖÏþžM±vÐäÏÿÍ?ñOÍûèÔ¾ º½[ÙQ•>UkP7@ÏÙb”ìÂÊ $µéE›€$Ž¬œÏÌ.+MÖÑ4bokL†ål»¨ð‰¡Œƒ|ñr8–Lkñ?m%* kÌ?|ùút¶ÂÞÙ)D1¹áHþÿÿﮬ§%¶±ÅneúOFÞ׋[ûמx–­?ýÂü}—I?äúøÝs9$c¤ÄŠ7y¤*ÎÇ…ì¹®0q²Tæ_µõ ÏÓ$F„¸á•dž§T朣‘k˜þ}ßÝ[ÛÙ±v;_•Š%r S¿öâÑ{ºÐ«¯‘Ô ;øqî"Žfä™Yd¾×ØÕcÃJ„ÊyHså“F*Uv@_«wÖÊú«i÷y¶Î¼1×Ö¢¶…6 4TÆyaaÕ=r9l£Š¢°5Ãrá/>ÿ·±wÝÊ­8üï!|:7Ë÷º©?‹ïú¬g•æ¹NÓ°iËòÐåŠGö? wîÛW™°=Yn…ÅMCb[!ÄÍMƒ[`-êW1’zö8çRíjÜÁ'ïöǼdô$#Ze°øƒil¾l/½´KUÕ¿´y4ãùz±åiìN/­4JV÷’Ï-WÓøwäõ×ñÇø¹Q-Òõ\Ïsò^À2[g××kQ<ƺŒúð9:yæþÉ‘v‰Ý+çóãÆsd2öã§ikÌyÔJÒÅ£l^ò +Ž$c0ÖãщÏÒÁ£@Ú–|ñê·„+ÄšëñX•ÆœQ†šw3~D2Ó?^MT)Í€Ó½¡êÞ¶¼.C% ¸—VÝãÿïtï~½]NÎ*gŒ.žßTöÂNÖŒ"µY¡kRIÏkÅMî}TÚîT9K¡½®>Gªï'®ù¸P=ëñ.¡„Jv9¤1P©^sZ·íÁR¦ îÆ÷èØiÆP¥?O>P‡ƒs&2ã¢7íG<Á³÷Çðö÷GH7Ôàöqé¹c.ÌM¦J¯Ñ<òpGŽMÚL¬C¹n¹eWècg‰"Óu䱜Œ9qãÊž÷í*åEÞBë&6–}8½_ Qvõ¿ÜÈu¿žëyvÞûÃkqÿë.¬×¢ä¬Il6‰Eç-htž7À؇ᶓø5°&²éëÉ,¹hAçY‰Z-ûóÐS/âûå§Ì?–žµé·%³uÚ§,:ŸgárØɼÃÿF`ßÉoXH,­é_eÌ棲·½é¸©ì¥ÕÚÁ­˜ûµ½ûõn_ÅøP?«x6zÀ¥ó›Ú^8¶~)´™Z|—ø¼VÜôm¤ª´]¹UÒö*ä©z>W‡e4.ÔÎúqFïJ«,%{¹‘ºu©jH#Éê•ÿ‘h’ùS¶ã²Ö-=@ÏQí©ºäg, ñ«GÓ̃,©Ü—*1kùfg$É8´úoÎv@=?-çâ쀞*½î£sÚ!.› ùòp%è •rX•Ê¯Á³•¹³£8‘†ÎÓ@z†SzV \}u[Ìv°zÑæÅy0jÿ›£˜6™+æÌ 23u˜ÌV,™™Ø€&OøQŘȺó1Äæ{WÉõúØ2’ˆÏùdŽ.n÷7àä©œÈÐÖ§-~dz2<ž âÙ²d ½žïH-·#œªÖ…ºÿørí b­÷ç—|ìFŠ“öÉ¢ÜÇêݬ4x·Ç[­÷±ÑÞ™­‚±_ÜÃ’y¿²5²à®W‹o£þ<|_š…H:±…óþdïe;•:=É]ŽòÙçëˆÒTãö×'dù§Ì×´Rs(¤WàÝ”70³êXCîhqž¯&.årÝÂcJ1¿ðTJ1f֨ƨƯMÍ1Ä¿2‘¿Àׇ̈́ö{÷‡&òÍë_±+-€î¯¿N‡ øÚ:Š7ÆÙUaXܘ/¬~ǽè÷ôšxzÐà­1ðÑ\NT-¼=]Oc{tY}¿0l8ï‹ã‹O×c·:Ã__|ºŽôV.Î-ƒb½ÐzP³Û=ŒÔŠêÞÒ#öðûœlŽ²€Ö“Ú=ïgÔÀ[!š½›ã¦ÉNSL§ûFrWÇøØ“8¶î'f-;Fªãú®ç9y/Vß·ˆÒdÃœ‘AzºÈàÌÎõü3  ·TõD àÀœ™žõxz:×þÈ×þoðò ¦,?±“¤«ÒP j1®0Þã«Ý—=– Ž­µ\quSZ·‹6Þw§8¥hüéòòtû÷#>Ú’€¡ý_åõú+ykÆ´ Ïóª9{Ò6Âî¸zœšÛqÏ°d¦$Ê¡Üvªóz¾;Ûæt“¿ÂÞöæc¬®¼—VkåÇÔç?µü®?åøP>«€ÁÅóŽGu¥½°ŽK¥ÒfÊå/nå@ÅI_­íÊïæ»díUø9Rí|y=Æ…ÊYßÙJi+Ùo9R9ò÷¯ÌûeG’ó~„E‹OXeôñg‰Ï>SšãÎèY•@£Ðâ[¿ ¦ý爟Ç{3vàÐàV K,QéY‹ž>¤#;ű裤æ[]Iõr(–ß9îO§àÞrÓ?{º'²ô×…¿SQÜvp˜8»b?nÁ¬˜X£7ñýz7îzyÓ?ú¦òÇ;ˆ·“/ »o>zº?ñ&“>y—7Çâ–}Ñë“]vïfCék[ËŸÇ2pZìöܹÉfÅáDe/=ÞaÕðH5sË/0á£ñ¼=¶'¡™ÉdÚÕÚ'}¬þØÍM‹ËÁ4<³÷_ÿ˜NTã¾1½©Zà:Wã׆Ѷ#ñÏÏyéÕOX} ŒéLeË;±š oD•®÷Ðéò2~ÛŸBšÊ˜SN/¾ú*½yâÞ0~7—?\@xµ»Û#cp7°.§LäÅקòWz'Æ<Ô¿ì™Æ­Zêý™wÞ˜Ê:mWÓ€Cß¼Ç+Ÿo@së@Zh%‘;/ZŠÙG†j]éj_ͧo¼ÍäMºÝٞʚx6Ϛˮ¤3ü4qÿØ[©Æ‰¡Zúïáû9ë¸ä¥S…æ§SŽ1ƒjŒf×ï^ö3S­qe ª6òÇ¡ £Iˆx„qK¥Ëì9™ŽÃÅqÅùBëçˆfÕŒ O?Éœ ³Ù£uÖžÎÓØ•¾Ït#®ÔY¯R/]`GF©Ìžï>äÅ×>æ‡3u6¸6F4¸×ÊSC|Ùõí^ýøw"t¦ª@ƒ÷-ws_ƒÓÌûà ^²M×»éªçú®ç9y_@«ºoeG‹wíÖ´ªd"*>“—z3»‘Ú˜—ß'R‹GõWïÎÞQues¶Îº6Þ i%G2áÿFܶ¾Z@À-m|8µõé¾ÎòÌ™³×“ÔHiœæRk;Å:ØG8ÛæÐ)îmo6Õ½´Z;(?¦6ÿ©çwݹÏ*®ŸwÒ×[é´™Jù‹×_¥‘¾ZÛ•_%i¯ÂÏ‘jçsíuÊg}gw*¥¯Œ~Z‹Þ]‡5Ãte‘w˜Ó1cÀÓh=©ßÌÆ3ØMIÄ'›±kÝm}'/>݆ˆ?–q,ÐÓãÁ.Ä/YÂÁ‚7.¥á¤.Hß7'_xéÛü¹{L/ªi=r–¿•ø£{Ù{®à»)ùj `lË¿x‹g^ÏôÍ~Ü9º!úüihÜ=±$ÆqrÝLžº€íöN<ñdò®é.×GJ¯Á¡ìýsö'9¬ÄÇÔd ½êúâáSÎÃzª×bÐjqóqýv7êD¬dæ´y¬IjÅ£÷tÞ^j}¬öX`‹ÛÄ¢M§¹œ;K8àÙ–öùTC@ónÔ¾ð'KöF“šÍžeË8]¹ ¼µ`fãüñ»kÏ÷·ðׯ{Hp€Cq¼8Iï =Unm×?Ysâ2ÉÑáü=ïgÖ\´ÔªG—±âP©)‘ü»t5ñõ»ÐÐ+k³]ÞÏêÝÑd¤^äð‰xâw­gwLÉçs,Y‹—±àîQÉ•yÑBh1ûˆÌÓü½ñ4ɦdNï?B‚Ηüë qb:Íâ_·~1¯[œ<·Ðü”bÌ‚¿ZÞWêŸÌ¥ƒçpkP÷`šD²~™šuýñ¨Üˆ*©áKÌÚL9gP’˜/•ötšùÖDg›<çuÖ«ÖËž°ƒ~Ū£q¤™Md¤[0x¹¡Å@Í.ͱmÿUGãHŽ;Æêßw”³oÕ€Fï¿—ž´s›˜>~*ëbm×w=¿’wf‰ÓE «D¯×&óÍWÓøæ«/øü…Þ°åg«üV–=# ³›î9Ë‘6 OÓøæ«Oy¡­7¹CC-ÕbÜ 0Þÿ.Ÿó5N_:ã½ð"ñÈ.âÃÚRÇCƒ6  íýβùx†ú¼ yæìd,(ŒÓ+Ô燒ÕájZö¶7ê^Z­\i£«ç?õünWUr9;ï(ï…ÕÒ(6+^•nújmWÞ»½Ï‘jû‰ë3.”Ïú%ßûUUÓŽÕdGïávåöIãæ‰2- ñ¬Ã-ŽCü––ýSÞõèÿðHúœbÅŒ‰¬;™Š•» §gòŸ|z [@þ\KC«Ze<«Ô"ØÁ¹Ëf¦x­ÛHtçÔò\­Ýs¼sWMÜ0sü§ Lþ'QaàÞ®ÑÚ¦5ÞDzúx2fàÐßqáý4÷ßÄš¸Ü`7Ÿù ïç¾2fá´}¿Í6’¬¯®PŸµ\ºê:ZƒGý¾t²þÃäˆÜ‚šÎ®`ÖŸÃýÔ ÓÆspën¢LÕH1Ù±[íX/üÅü G¹l‡ˆ¥ËéüA?n XÏ¥X¥µ>VïÿŠÀ–t)÷PeI "ÕHUO-\ùAn^Þx6z “†gÿM‹›.†pw-$Ù1GüÃÆØ~Ü›¶„Ýñ¹ýPøxÑ;M/'_ï@wÒÎ%“u‰í 3r?ÿDºQ·¹‘´˜$ÌÙ‘K¼Å ÿìݼÒ‰Ùžõ»ÃŽ%Ó’=v8Êùât#ȵT/fÙRãHÎövG!s›“¸쩱$šà,¦óSŠ1=Õ‡)§§±å® 拈òkO­*nT·„óËîš´íVƒ*¶:hÏüNŒ (3Á½óÎó“XyÛÓyW¯‰W=žç`æ|nÑâå¯\/G†šÝ``‹` éñD›<³ä:<ý $O$狨–äK$[ëR÷ÿÄtï¾ õø$°ý –¬ÞO¦ûõZÏ×eÏÉÕÚ°D IDATÛŽG‰×ká2[2ÿ}ó%Ë.Z;¦”D’Mêoi=üp3§ä¾{kÏ›€sJZ¾dC9ÕbÜ@J¡ãÜê\]®¼cËùW:ã]‰=!œ‰ýèPÓ“smñ?µŠZ]ž³Q§ñWrQŸJZ‡‚”÷¶ˆRÜ_Þˆª{éÕ*í ü˜Úþ=§‹µw// ;«¨Ï÷Ï;…¯5êgÀÒh³Ò;¯5ýœ1Sø9¯¼*^{­ÇÚZé©v>W‡e3.ÔÎú[Øw÷&ev9”r)k·šTÒ$Ý n5ñO ÖžnAwèOÒ 1ÖdØsÐèè|ÆÏ$ÇX ž ÐÏû Qƒé_ó‹ÏšTÇ‹zz¹ÏËH2ãìžl€±ZWú×:þ$^Õýp#+ ñ "ÐÁžL{ÖI\”! žµsæÅ’õ‘úìä$NªÃ‘3?9yn¥ü”ÊšŠéÙðl–».ØÓβ÷òm´okÄãâr"Ï¥q9¸5íZz±:3YÕ-|œY ÌójU»Ní©ØFyåíû¬…]£Õdo$4|ñÔÆ]y¶Ks‹b½Tê0Š‡›aúä9œJµáÙòY>ì–õº´3¾aþèHÂ|CñÕhñ ľœ©›—àÔˆAcGñXêE¦Æ]¯õœ|cÆZëµp‘•´„xbã\ÝݺQµM3|¢Vm!{lÙœ¤¡j1nU˜N²>R}l9Wã]…-ý»SèÕ¾1-+ùqrÕ2E™³•Çég§óÔ¡Äóž«Ôö¶7Û¸´©ì¥5x×i«Ðj©íÿÕò»ڶгŠÚ|Ÿ¿NÊkú°ämVŠçµ"§ïPi»òª¸í¥vÆü„%Šë}qÏ´%¤xÖ/¥»„"(£¯•éìvŽztdp« Ü=«Ði`slûwiõ vsOd½èÝl0]5[ømK†€ *Q9Ðwm&G¾Ïëo¾Ç›ï¼Ï[Ÿ¯ ÒtšyMeé­‹i¨”Cu?b%úÀ ´­‡Ð³^^¾Õ¸uH/üOlã„»²En €žÀF­hU3ïÇ ¯.KÔîÝ$7Êàf•ñö©Bë!C¨qé?&Øó¤á…Æ«ÃÇ>HïF!øú„ÒjÈ j\ú—ƒ fõúh}©×º r¾,î^“[뤳ÿXR¾Å]Ô…qo>΀†Aø5bàÝ-Hݶ+džù‡•úqÏ­Õðó¡å AÔŠÞ‘]F%j}œ¢òXù¿å. †Ê=¸»k-ü}‚i1èZfìaû¥ü—4 ¶Ýàv†¶ÁÛ;„æCŸâµMñÑ‚ÆX‹!Ãpä§oùji"†w¥Š^m¼¨§—'6"þ݃¥åPz×óÃç6½ïL O Ñ{v’Ðèv7 ÂÓ;ŒŽ· èäVŽ¦Þ&ïÜj)Ã>r'Å~n^Jå·¯”ž.oý{'ŽÙiÞ£‰G¢1%Ÿå˜­ ½k$°ç|îN;gjå)i{ð0:ŠÙFyÓðÌWw{f ¶À¦4¯îÑ·.}ÖÁ˜÷Nël%V±^ 5À”FšÙÞ¯!}ûÕÂÓ`D§1q~ÛA´îd@£@¼Ð÷ÎvÙ¿C¢Á·Åp^Ó‹úþn´°;ܯßzžîž¯ÝTÓÏ»N*ý·(EÜÜ=ñôôÄ'°ÍzàÉ°ý¯ÃEøWªÔâQ-ÆÍ ãÝŽÕÉØr®¸sbFJÜY‰;°ŸÌ[†q[å3l9Ž£Hy*ŒS»=_ÊmWJk}Þú)îmËý©¶È”÷Ò6•vP{L}ÿ_¼½{9QèYÅÉùíJ\éUÖõ4TÛÌÕõ ´ÎkENß®ÒvåX±Ú+Cõ©¶Þ_ûq¡~Ö/ÞÞ§øÊìÛsŽô£ü4s#Œx…/FÚ¸´w9Ó—žÅäÞ€–GX‘l Ö Ã+¬¯Œ˜çÕùù­IlºœÈåì¿h4iXíR“I74,B åpRþÌSK™µê>îýwúYˆ:¼o~Ü[äïe*¶€ÆH­Áó`Ô4ÂÏ¥*–Érq53æ{0úþ×ù<ÀAÜÑÍÌ™½•[þ4þ·`>SWÜˈQ¯q•˜#›ùîÛìç©ÕÇ-Œ¾#B7ûÇ“2q«r µlgY˜ÿ£sÖÈu|·2Œ1O¾Ã¶XÂ7ÿÈô5QY»N9ȼ¯ƒ=bŸ<¤#áÄVæÎÞ’•·rë`IUèc+ öXq~ äƒ{±Dìâ×oVqÑ’ÐÚ/ïໃuïË|¨'éÌv~ùv3Ñ67j N»È¥|p<•äS‹YÛýYîïp¥UÕÆ‹Rz€17N¾<ò7_/¹—GƾÇ0/;—ñí¦LæÌZÀèßà ±áøæ‡=$9Êp²YÜ«ç™Ár¡ìúH9î®þ€˜ÚsÕòS*¿Ù_xz†ºôÍS°søiýêpôbv«™#çÍ =ÀÉT;d_É+3WËSìö´Ärø|%zç)2ß™U¬6º’Ƈa:±€ñÙu·FmcÉ®fŒ|u"C⎲þï\è’û2WækŒR½ìhw.aS«Q¼;e()Y³n-§î¹—1NñÅŽe|µü~F?ö6C41ìYµ‚Ã>5±[áïz#7q F[ gÿ[Âܽ^ô®wÖsc}nË3ªëµ!Ï:yJá¿“Ô \ÞŸîÏ@w¬$EeËWSX‘óÏØ»(ó”R<ªÅ8 0Þ3-êcËÅóÍ®§BÜYc°/m ÝÏlçt†ó<óÏÙ ãtûelUòæQÆký•ñö&_VÙÛÞdìŠ{i(¶ƒÚc¨ïÿ‹µw/”Î*ªç·+çñ,W[kŠÛfFWÖ©Åí/·RH_¥íʧ⶗CýiUYï¯Ã¸P=ë«íMÊ€¦aÓ–.­³F£[A‘Ÿï¶Ï1¡ÓZþ7íPîÏ€!JQEg±ÎBÜœÜëßÎ ÇJ~?yóÍ^!DÙ3™Ìe÷µ2!„B!D)ÓÓº~,;+È×ì…B\òM!„B!nÖþù+æz—B!ÄMF¾V&„B!„BQAÉ×Ê„B!„B!*8¹B!„B!„¨ÀärH!„B!„¢“Ë!!„B!„Bˆ L.‡„B!„B!*0¹B!„B!„¨ÀärH!„B!„¢Ó»úÄËqqeY!„B!„Bqyùøº~9äåã[–eB!„B!„×|­L!„B!„¢“Ë!!„B!„Bˆ L.‡„B!„B!*0¹B!„B!„¨ÀärH!„B!„¢“Ë!!„B!„Bˆ L.‡„B!„B!*0¹B!„B!„¨Àô¥’ŠÆŸ®/>Ið/“XaÍþ£¯º}yô‘´ ±¹s³æmæ|¦ãÊãAÝc`Ô|VùáÑÛÛÓ Ä´ó;X·“ß¿›ÏÆ‹æ|å*y;¸†ÆZ½â±!m¨îc#éÌ,þn!›# ”EHŸ·?dD<;óÏMü‡D»žàw;mgWË{u¨¤¯1Üö.ÆÜÛ™~&.ì]Á·ßoäl†ÃåºÞÿ“[Í»ùp¬…iï.å‚Õùó¯æj,ˆSμø?Ë,Ådè0j£Údðë;“Ùo/½´KUÕ¿´y4çÕOú²á“Ù™VZi”¬î%Ÿ[®¦õïÌ[o7añ›³9¬Z¤ë¹žçäý#¿[»¹¾^‹â1Ög̤—èâ•û'{j;—ÿÈ÷ëÎ’îÖˆ§?žöÆœG­$^gÃo?±ìp2vcž˜ü"= ¤mÙǤçgrH!Ö\Çr¨4æŒp«}ŽNæó÷Wr©”æ@aêÞ¶ËQž÷\¢Ö–…>¦¶,âù¥¬\Un¡ßæ“»C <1-¿Á·§Ü]<¿©ÔÝI[ë*µäÞGï¦G£@l;XøõOlºdq±ü¨Ç4E<)ýÿpï¯Òv'L*q•B{]}Ž,æ~¢¬¨ž‡¯íX,ÙåÆ@`ƒ–´kß›»šx²*ïCžùl?ôK§òòÆ>Íówžçõùg0hüiÒ8•}§ÛòÄs͹ôÃdf4Skàã<óÌμ½˜³9ãÌP•þ¥†ç‘ù;OãœA¥*å÷jr/uLæ—‰¯°'Å—¦CŸâñQ·ràÃÍÄì‹’´ƒ ièÃúñÔ•ùç«ñ|vQOþcxbL7ŽLXKŒ-ïý¨êÅŠÉ_³16kÅ´[’I¶ƒ6¨ O<ì¤]-o!ý¡–~DH?ž{¸.ûg¾Ç¼é8j/=Ík߆cv¥nJý/ŠÅÕX7¨ìyqÏŽR>ùBhÛÌÊ’ñŸ—ã‹!Ê®þ7‚¹î×s=Ïi·CµùŽ ëµ(9k"›&Ä/g-htž„¶ÌÓ£ÆrûñwY XX?íc~;oEïH6yø¹×ñ›2Ž¤gmúmIlš<‘_ò,\‡Œ0üoÖ¸ÿX°ÈRz2*c6•½íM§¸ó*m©’¦Ú~Pu¾½®ma#vã¼´Ëpåë/ºŒ»_Ç–‹f¼šŒtéü¦V÷؆*mm¨É]/>D­í³y{va}Ç0öÑΙ¸‘»+åG5¦½š¹xþ,Vú6RTÚ®Ü*i{rŽT=ïº:7•fUÎñÆk;KøÉ!wBëÕ§ª[I¯üÔêJ³Œ­|ºå,ñX½h}Çt úog8e­_}šeîcQð¢þfÆ$;àÀÊœî9˜þZÎÆÚ=Uûî ±Ù…¶Ä&Á«AÇ6ü÷q‡çðæÔIphð¬Ú€Ê–.¥e-!úÐŒîË/‹Žšÿ;T.¤z9ËïÀ{Œý§’qoýßLŸÈ«½X<_áïT·&N-›Ã÷›¢±(¦Ö¨õÌ^cä¾ÿ}Â7_NäÕþ©ü6ç_âíäKÃኯ>€ÞãÞcê” ¼÷ôm´¬”uÿ—á¤]ë7åþPN߆N¯Åasän ¬îA„xiÔë¦Úÿ7; ­o£ñéŸyëÅ÷ùîXu|²?Õ ÜiýÛ1öñ[IXò 㞟ÀüK-ûd7‚uvâ·ÿÂ_ŽÞ´ø´¸ƒ¶Uüq$GÎojçå44xW­ŽGŠ™æ#_eÒä‰|ðtªd$‘YpHª”_9¦‹pþ,VújmW~•¤½ ?G:;Ÿ»67•&åó°ó³yi+£¤ÖbðÐcÉÈ]äíæ4L¸á¡´^4lncïétì™IÄ'™±kTi{¯=ߎ‹‹çH: ¡÷Ã݉_´ˆý©:Ç¥4œ”Ãé{>çѧÞbÊæJ ª/aEZœåo%>|7»Î¤*l†²¸ÕÂÓlü1é5Æ<õ&S6úqßØž„HO,‰1_=‡?û‰-¶.<3®7Uô¨·³«åUéåô­Dí=„¹ÙúÖ÷ÃÓ·ÝîêC½ƒV£^7µþ¿éi°Ånä—õ§ˆOŽfÏÒEìõjOÇ|4 -{R÷üíŽ"%%ŠK~çdp;ùhÁź·á2ÈÌŸ?ïâ²C­¯œ¤w…žª;âµo +]&9êËçÌcåy+•Ût¤Ò‘%,=KjJÿü¾’¸Ýiì•5Ùâ÷²rG4é©8x,ŽøkØAò™MÒâm,¸{Ere^4VÌ>rdœdÅÚ“$g&qrïa.ëüðÈ·R¸'¦“,œ¿‰Ã’ñvòÜÂóSŠ1 þjé]©‘ûÏblX÷PšUŠdíN3µëàÒ„°ÔCI´áÚ8ƒ’Ä|i´§ó4È·&ªoò\©³^µ^ö„ùâÝéüKšÉDFš7/7t¸Q«{KlÛ~å¯ð8’ãŽòׯÛIÌùù< h >xéI;³žÉoLbuŒíú®çWòÎ(qú¢t•èóÖtæ͙ɼ9_ñå«ý`ã<ªüV–-#“Á÷œØ×æMc&óæ|Á«í}ÈÝ.«Å£ZŒÆ»ÊoNæ”Ñé§/ñ^(; ‡wÖzž´MéèwšÇ2Š0g'aAaœ^¡>?”¬WÓªìm+¢’Kò+Ëùöš0T¡ÏÐ*ìþcïUŸ:wÖN®œ‹®NC‡»¯º=©wq9Ó&ËßImxâ™ÞEêWbº$ýìÒ˜Qi»ò¦Øí¥xŽ,ñ­|¾öe-£díX2­<ÜÈ9êiݼ0b!Ó¯º´à¿d_ái½ë3èÑGx’e_¼Çêã)ØÑÜý!ú$ÿÁ„½)Ø+åÏÁµ4´ªåP¦Á+¬6!¦‹œ‰7c7Åq`õ:¢ºu¤Ž×¬^æÃûjᆉ£sÇóÉÖ…Ëõvpž*íÛàsd>M ì_ñ'ç>LË€õüç+aæS¿ñÎ[¹¯Œž¿˜÷§e¥µ\Š±)´‘«åUïPê°žYÆô?bÌss·6Ž}›vqÉTd“Ž*=”궉=ÍÕó»ÙY#HÌ™Ë,—¹˜âF5/\Y¸txzãÙäa>™ö`ö†X‹›.†CîZÀŽùÂVÖÅäÔEìŒÏ ï+½Óô²èñ2’v&™¬3ŸƒÌˆ½lp£^+#iQ‰˜³{Z,qO²w…vKGÖkìv;ætKöfÛ½œ/N7‚ÜyQGbö‘-5Ž¤œoÚ…ÌmÎâì)1$˜à4¦”òSŠ1=5îRNOcË]Lç÷é+u Ô4âǵhß³&U¬uÐú( ¸¡4ÎÜî—wžÿˆå×±=§Q`M ¾êQ4yÞ`r>·hñª¤\/G†µz gH«ÜÒâ‰2yf—[‡g€ž¤#‰ä×’x‰$k]ÀAÊÞï™â=¡cÞc¤Ïeö®]Æoí%Ããz­ç«¸dÏÉÛŽG‰×ká2[2ÿ̘’ VpØÈLI$Ù¤þ#2:Œ–”ÜwèíyÒÈúæäÔ<8jñ¨ãn¤:ÞÁ­nÁRå[Î׸ÒïJì—ñoâ:ÕòälPüOþűt-A.ÏÙ(ŽÓø+¹¨Ï%­CAÎö¶ƒú<™Tü.ÝùöZÒàÙ`]­[øø‚åÊߊÒN…×]ý xÒbÇzþO~XN¼..úƒnŸ ¤E¥µDºÊ1½Žd}÷³ó1SXÛ•_Åk¯5XÛ*#Kã|^šÔÎúÙsËZf—C)‘1X{Ö¢’~?iV0ÕÄ?í"±&ðlÒýþ%¤9@ã^›»^yœ¦á?ðæ—H¸2®ÜkY—à&u™2ë4Z-¼0å}ÖNúß½]IC­j'Q•»ŽfœÇ<^ÿþ$&@c0¢sX0ÛmĬþ˜1«KÚ®Ÿ„vÐh4yÞ Ó ÑÀG­Ns)áR7µþŸÀ§Êñ§•½_þºÝ¤ZCU½Í$¤çí8;é‰é$îœÏë3ó¾J¢õ¢J5’£­€Ïƃè}ŠÈ ¡ ªu˜…gLªãE=½62Íx†ø '`¬ÑAµO³'Á„WMŒ\Ä h½‚2d°3ÓŽÓÏã‹ÒàY'g^,~9œ¾7î$NªƒÃ‘“Š“ç†)å§TþSü§˜ž Ïæ¹ë‚=í »/ßÁ­Œx^\JäÙTâCÚrkko.¬ŒÀLÖåPáãÌ\`ž7P§ÆujOÅ6Ê+oßg-ìmÎGƒ5üñÔÆ^y¶Ks‹b½vzŒG›âófq2Õ†gë—ø¬gV¿¥^6ãWÍ=‰˜ƒ_(~z-ž•ƒ°úƒÏ6þ†[Pc†>3†'SÎóYìõZÏÉÓnv¬¥°^ WYIOˆ#&ÖÕÝ­ÕÚ7ÇçÒR¢,d¯'ÎÒP‹Gµ·(Ì?'XsQ}l9Wã]…í2{w¤Ð·cSZWòãÄ_§ÈpeÎV§˜x*OJ<ï¹J}o[q¨ÍcÅo‡ÒŸo¯!'{5 aëâ®Ü™¸ÞNÊuW?&_J _hØYÿs±à*1]ýì˜)´íʫ⶗ú9rQ9‹oåóðµ‹eôµ2È<³ÃžÚ¶2îžUé:¤%¶½ÿqÑêAÝVöOÅŽŸ[n£§f# 6^ÂP©2Á•+䇻6“óÞäÅWÞâ•×ßæÕ—a:Åœ÷'³øœÎÅ4TÊ¡º±µï8Ú¶·Ó§A%¼üªÓiXŽoáxøF==MÚж¶·JGX‰Ú¹ƒ¤&w2´y0>>a´v;5#·³/Áž' /4^­xè©‘ôkŠ¯oÚÜ~µ"·±/Õ6BëKƒ¶mhä¯U)¯ZXTÓ×VîÆ‹ï=Í ÆAøUnÂmÃ[“²e-juKWͯ"0÷fxÚø„ÐjèÝ´ÎØÅ?‘y/iì\Þ·…èÆwrGë|¼Chydz¼=ê|´Y ß°‡þýL¦-J¤Ëˆ„éÕÆ‹zz¹qbãâ¶]XÛ £_<}ëÐï¡¡´ò´µë_ßÁÐæ•ñô®J§»SùÄfŽ¤”“ÍÄÍL“wnµ”a9‰“b?7/¥ò[‰SJO—·þ€=‘cávZö®AÂáh2“ÏpÔÖŒ~µ.³ó\æ•£‹óq$À@:IDAT¦Vž¶§Æ€§›£˜m”' £g¾ºÛ3S°6§eMoŒ~õ8¤îyŠã¼ÎVbëZƒLi¤™èý1``m< Ftç6ïGÛå^7 Â'¨ï½-€ßVòÚS}iàï†AçÀ¡›Ãƒ:×k=OsÏ×nªéçY'ÿ[”" nžxzzáTæýG3®7l]v×?$¡j1nVïv¬NÆ–sÅsšÅ€§›F%î¬ÄîÛKf‹»¸#ø4O¦ã(Rž ãÔnÏ—‡rÛ•ÒZŸ§~Žm¹?Õ–¢Ò;—ä*‹ùör¯E§z©ì9š”ç“iNÚéJ\éUꮞFæ©- ÈðÎ5ð÷¥Ím·Q;ê_ö_¶»¼(Ç´ÉÅò7}»JÛ•_Åk¯ ÕsdùŠoõ³þµ.k™}³Î‘μiëûÈ|ýˆÈÝKù|ñLîhãÎÒ$;` ¨~U¼ª6á‰Cò¼úó^Èúø„+cÕjR±ÚÍ$'$‘nh\„4Êá¤ü™'~gÆŠ¸Ì{ÜëoáÒÁµÌ˜»»ÈßËTl‘ºCedÔdžIU,“ùÂJ¾øÁƒ1#ßæË;±á™õõ¦¬ê=O/ýð“–=ÀèÇÞâ~_+ч70ë«ÍÄØtÔQk£´j xdº¯sôRyªÐVƒzú«™µ¢*O=;{l1Z?—É+/e}\[±njù­nLÒÏmä\ÓGùäþ@,wð󌕜·äÿŽ=~;³¾ â±ÞàË =I§¶ñÓÌ DÙܨyûCtˆø·¦’¬[Ȫ^/1¢Ó~WS/Jéî¹q2åð_Lýí~Æ>=‘»½2¹øß|½>“y=_þÈ؇ßåk+1‡Ö3ã»]$:Êp²YÜkæ™Á|¾ìúH9î®þ€˜ÚsÕòS*¿ÙWxz†ú ÌS°}èiƒê~>»ÅÌás&›÷s<ÅdýSJãÌÕò»=-Ñ8[‰Q>Kæk3ŠÕFWÒ˜4™Ìã?òfvÝ­—¶ðÛŽæ<òæg ‹ gÍòuœï‘ó"×æk´R½ìhÿ[Ć6òáWw|á¯^ÍÉàÉN'ùlû¦-Á˜'ßçvM4;W,ã o-ÀF̦ŸYÞà^š<£-™3Ûã›ÝÞô¯ÖscCîÈ3ªëµ[žuò¤Â'Ê¿¡^j ôzåz`%)"œ S?aY85ó„R<ªÅ8 0Þ3-jcË5ÅóÍﮡƒBÜY£÷±'m=OnåT†ó<óÏÙ ãtk<öªyó(ãµþÊx{…)•ö¶¥‘Ñ£´Î%¹te2ß^+na-¨c=Ëß¾ ¡ÚNÆœ¸z“¥juWK#e?ßNfìèç™2JO±Í|ûõF¢ 쓕שj1íRùK¾JÛ•OÅm/'çHkùŠoÕ³¾ÚÞ¤ h6m)oé Q®hðiÿÿoïm‚(€Ž@„„`)C+tAB%8 ƒEâAAЙ;¸›÷ôŠY±bfv×óC¬6çhýÏ­ðÏYÆ=C;u'ËXÄ>¶—¹®Ðtú  ):ã˜Mïqº¶ÿýEêcÒšâs‹ãîöë*hce‰+HL8˜p 1á@bÂ!€Ä„C‰ ‡ë”]øz>ª¬€šõúƒòáÐp4ª²jVïøˆS$åpekDIEND®B`‚suricata-3.2.1/doc/userguide/output/files-json/elk/Logstash4.png0000644000000000000000000036512013051004444021524 00000000000000‰PNG  IHDR$qÂiÚ¶sRGB®ÎébKGDÿÿÿ ½§“ pHYs  šœtIMEÝ  †B4¢ IDATxÚìÝu”WÚÇñoµŽ;ŒÀàîÜ-n@ˆÝè»±M6¾ñÙ(I6ÄeãNÜÁ îîÌ0îÖZõþ1ÌÀÌ0C ù}Îá¦ûÖ­[O߮ï½FÇ®½,DDDDDDDDDDDDŽ"›B """""""""""G›"""""""""""rÔ)!!"""""""""""G"""""""""""rÔ)!!"""""""""""G"""""""""""rÔ9©šLçMpá#{ÓFöTX®C 9ˆáŠ%µu䦓gÄ€‹ÈÈ0ÂÃâho‘½=BÃ’FÇ®½,…UDDDDDDDDDDäwÆEÛÎ ä®ßF‘YW!{L:Åd³~G 3B“éÔÂdû¦,<Énš¶ïHJè!ÊUd°ns>«f› Wñ qÄF…æv` """""""""""r ËGAN1‰-¢°×Y(HQNaÍd„á$21•–M#p`y HßQŒ->õ0Î$†ž<Œ–n;~ú†yÙ½0"""""""""""G’á¦i›T"vÂ;µdçÆ4ü±ÍHMŒ&ÔŠBöìL#ß[UÜJÓÖ)4‰taU²gw:ùžƒÆKàˆL¤E³x¢Ü¾’\vï΢ä )—l8CÉpÙ1ª –d²=- BIhÞ’äH;``w…RN™Çe¸ˆkÙ–æîÒvç“ÔÌEVº‡˜Ö-‰´­aî$¡û@z'¹qÄvfäˆþ 8œ‘Ýbp„6gÀðn$8Õ?DDDDDDDDDDDŽËKö¶Ý”JÙ¹a'ÅŽ8R“\îÜÄêu[H÷DÜ4lßM~GDBKv³aÝfÒ*ÂhÞ2ã€:±´lƒ?s «×l!ÃC«±t{ßA‹ö­i™^Ui9”ú‚}¥d¥eQQYˆ¤–´ëJ”ÝNXRkš» ض%"Ó#èÛ@dU#0BÂNü€ÉÜrvgB9‚Š0b«žI>õ:î=6„è(mó6¼¹‚SýDDDDDDDDDDDäH²|lßT€ßÀ²¹-lÎýcLO6{òÊñ[P˜‘I\çDbÜ9dí+aàŠŽ'¬<ƒ…^‚@Af c ³Pl̵”µ…Ñ4ÞFÁölJƒ†¿‚ +”¸ýE ©Øô«þFl,*“¦×‹_Ëc‹ˆˆˆˆˆˆˆˆˆˆ6BãShåÆfúðZ6¨¶¢‚å÷Ø{Þôá ØpÚŒ¹»ÓŽ=2•ÎݚÉÀƒÃ«íÊ,aç¦-„G%Ñ29¡$7KÀ“–O…J|ó$*S&¥™id—SæâÏ Ò®ySò·dQV‘KFI-"÷'M”(Û¾’­¾ntsþ]Ìž>‹ue1ôw"ƒSì@Veà;¬ šøÊJñ™•‡î ‹Àe¯6ŽÄòQQê!ÎpÂCìªÝ xñ-0ì8]NŒßC¿±xJË 6Wan[c6&P^‚'X)gX$n»‰¯¬ Ÿ †#Œ°PÁZ;\&þ²R¼ csGæ²ýeN µ÷»#{ùë0pƦÒ"¢„m[wRG\[:FU+átã0 h6n»IYЪ±pCÐÄ_˜Æú¥TÞ’wàvÛð4ÚÀ"à© <$ˆIeö¨dÚuI>¨e¦¯œ² Pž¹ƒ4w[Ú¶³³k{ù;¶@J3’bÃqÙÌC%$Üt¹ä_\ÝÃ]õ·—•o¾Â‡«Ë±€µ[KI¸û:ØÃéÙô/]ÂS÷½Ï–Æf&Í9ó±G9+ ‡¯x€¶{÷=m‹ÅCÓ.£-P2çßÜøúV¼ ªØ ‰ì~<ÇuŽÆáÛͬVüôŸÐžÜñÊ-ôq@ö÷sÛgé4xyp#ŠaLãúõ*gþ#7óÌêxÎ}âa&6ÿŠg¸æ™Uø-xlmÕ|_‡Á–À Oåo­]4ó³{¸ã‹LþüË ×ÓïŽdìEDDDDDDDDäÏÏ°a·ƒa³a™&Κ$„bØötiBJ\»‹L“’ˆôå‘î³ doE¾â||‰É$Eí"«Ü ¢i RÃòظ%ƒ~wn¸ˆi}ˆ$‚¨¦1¸ ³ñX€å#ç‰-hÑ©M rÉÉOgK†¿e?TB†3Ü]íï ò |ûFxXžB ¼@XÕîÊ¡¿JN8w??üÙG$qà ¾ÏIL<6Ê°væï$!ñ›°á ÁqÔ~†oà =Šõÿ‘ÕÖïŽöëñÛ°‚>|¾8ܸœvò9Z,/Åå.R;¶bçæ ò¢SéÔ-E199¹xš5§EôFvaá-ÈÁÝ‚.ÍË Øµ3ŸEÍûw¾|v¤¹hÙ¬=Ý]à/Í'mg>þ:ö»c!­š`䧓gkFû”ʉš*2¶²;GóÈÝ‘S™ŒØ·ŸâÌm¬Ë ®IŸŸ`ÐÂ2 ìvN· ‡Í`ÿtBîð‚øËÊ*§²‡æÂÀ"è)¥Âo6\á¸l@°‚²r?à$dïdÓÏë# bZ`ØìØnÜ®jSðXA¼eeø-0œa„:x=>,WaÎÚ'ˆ¯¼r: '!á ¼ÑØÂG/ÏîG¥X>òÒ=ÊwñÃs²>"[ù®zF–*žµ10lå¬zûžŒ°ƒeâ7ã9þªsèäÎæåw×Pb©HÏ¥¼´¸òMp`L\6°‚|^|þfU¶Ù8\n\{3]Ä5ÄæÇç4- ›§;dYË$à÷à÷0M° ›ÍÓíÆi·Õˆÿ!÷½·hÀ‹×ç'hšXÖåêèwA 0ë~=£O±coø;“ð6#8ë¤ø—|Èë?ì&èWBJDDDDDDDDäh±¼äl[GNÕŸ…[דQí霂½mcC!@N笊 ÖoÜ÷þ¢ ¶e4l÷þBvo.À-ÁG(.ü”–VP^¾›Mùun‰é+!7½„Üôý"!aR¼y?æ˜tÔ‰NNë>‰;=™Ro(û†zxÙµt3W”`‘(»ésÎI´_ûËk?˜ ·Œ ¿“”Açrá)ýèܦ)aÞ|¶-ŸÉgŸýÌê\†+‘ï{’K[Um1œ{^ìÏ/ÞÇÆs¦pA*°ãmþñÀ,2M'í/}Š‡‹2øàŽøbWWǢvÿ(¢ð°èñ[yvU\)ƒ8ÿüèß¡%ÉQ Òv²~ÁW|ðÃ& öŽÀp·çªgïel}?w­:†+ÿ6šÈŸà–é5ãð–ãwµãÜîcb  p!ÏÜÿK ±R¸/ŸÍ«V±Á[{œ°5eÔÕ7ט²ÉsXñôcÕÞ#ÉÛº–<¨¼aH¡Êa@e»Y»rùû†Ô±êŒÉnÿh3>WK†ž9‰ñC;Ó,.{ Œœ«˜ùå—|¿:¯2SW­ŽÂá‰]8ó¸¾tnJYÚj~üð¾ZS@“€§ ¯#‰þ'1qTwZ%„có²gë2~øâ;æl."€‰ßS†¿û¶üå”{ ¡ï©œwÊ º´I%ÞYFÖöUüôÙçÌØO ¶~÷B~yì&žZqÀë±–ò@Åaõ©#sì ¬ ¼ÜîæŒ:ï,F´z…³nÉ#,öY½åx|A g(¡!N˜ù²*2Y·2óWÕÑ€ŸI;i1æD:UÿU¿Q=à¦ç‰H´£*ÝÌ–r f“G'מ11}xý.:œuO_Ç´mJ¸FHmMäÆ{®`d¢‡ÛNÁ¦Õì(Ù»a9»7­cGi«—çV>”Ü…·I(ÚvŒ©*×”Î)nÌ Ä´oG€¹ƒÅ»Êñy‚Dô¾„ÇŸú;§Ó–ä(BlóŽ žô¿ídÚ„|KÖÙò4n¿é:ǸþEyЋ7CÿËoªLF¶ðî“o:€ŸŠÒbJKöÿ+÷6rNªÅÓqÄ;p͘øñ[ Œºþn®;µ-âB±8ÂiÒng^g¶ 9èfwÌÀ«¹ç’‘tk‰QÍ{3áº+“h3€ßŒaà•÷ró¤´MÇ!14ë:š‹n½™s»„c3¸o+€×k’0ü:¿åL†uI%>°‡“ØnçÜt;—ôŒÆUG¿ÛYZKºÎ vŸ:"Ç^ï+ä ùI·òÊëoðìeÝ ±eÕnL °u-™F Ý&Ý o¾Ä“W $Îô0ub‘Ú5 !ágç7oñÝŽBvÏ}Ÿ¦oÚ7ÍLÉÒxîìÈ^ÇG¯Ï&óH¬ÍP¾™þ»zê$ÅÜD3àÇHÃZbÒ¿}šë®ü;Wßý&KÊ€ÐnœsV/¢)aÅOò‚¢Ê ËVòߧ^äë4ÙËÖQ àN¥c<˜®zì[ ÜN³öñ8ÌPR»U=¸{[K¼Üí8ûÊ1$ø¶ðÅsSøç3íÇtLÀÞúd.•È¹™°Ž=HÌÛÌ¢¹?3GE‘$–i§ù‰×ò¡Q@>3ŸÆ÷iþ†Å+l÷½ù°ÿ߇o½Äã›ãl`ÈOÛ‘í|5câ'´Í8Îè˜ìøúEî¹ín|àV{4$åàcŠ°³þËWytÊã<÷õÎʸÚZ1ê˜&8#®/GýݳÜrÝÜpßKÌȈgÌø^ÄØ„5dߦ3´+ç]Ü—p€ÌÙL{àNn¸s*_îˆdðäie¯½ß}µ»–×ÔôvŸ:"Ç^ßpÃMb‡æ8€Ä®h»§OáŠko䪇¿#ÝÞ–“kC¸-„ÔQ§3°©»M'U©]ƒ~ön•o㋧ä Àm°ç´´ÆÏŽ¥«Y¿n1ëÉ&™¯xŸvôäüV9kB¾]£5X¦ABÏ¡´¬âí‘VbAþü÷‹qsv2iº„EµMùdØ ¦/f£8} tJ ÅYщVn°²6S”Øž¸öÍs•Ñ¥Eeˆ2Wl¦0hâJÊ€ØÊvl|çU>Y–‰EÆŸ!¾ÛÃLJ‚æ»ÿm:5v?ƒûÿõ[¼XLšì{*¼óÙÜÞ¹#L6¿÷4o¯.å·û¡ycâ¹”¥eÖ‘Ûuõ˜¶ˆU¼9uö@[V¬%+NR'ƒ½KX¸Â]eÐÌõï0í³%›A¼›Þå˜1·2À  aØl\.ǾùÑm:Ñ!5‹%kçóÖ#9,lâÆðåQ†[é¡÷m˜&®ÖCèàeéûŸ±p{9¹|ùöw´œÔ0¿èP”40úÖá÷©#sìõ5®Œ¯=ÍkƒZPº|.9¦Xøʪ¶ò¦1u9]{†ضœÍ^'ÊGˆˆˆˆˆˆˆˆˆH]=Y´˜Ç¯_|t[eæ3óµï8þÞãHr>§.øö€NâZÇWAn~åíZŽ,Ž”H;•‹ȆáÛÎÂíз4ë’B¬§3M´Ù?³û¤ö NêLrœ. E¬Y“Gw“T*'vÊbõæj‹n²Y¶ªˆIIÑל8'5š.ß´’ÝÞÚoæGt]ñ Ø,ü ½ï_ë¢Ö&Y¹4|ÀJÃã¹´,pÄ^æ1±ü”g®e±§3cNÃU“®¢Cj,®CÔQš•¿w³‚/à ¶òõ|·¢œË{…án?–KoË¥xÉÚ´‚E æ2sA^Ó§Aû6pÇ' @.›2<ûÖÕ¨Øü)MÙ[®1I›ÃïSGäØëiªôP’¶”¯?]Ohˆãàµ!Ì|æ>{ +£CñäQZ^/hà ÇíPjBDDDDDDDDDjrü^Hûš×ÆMšrêÅ#+§WÀÀ°ûb(fçÆL*ªþ²,«²Œ™GQ=wämF¥C‡f„µéF«%lÝ°u½ap»Tºw‡fž-,Ëða¶:ì5 ­ª}Cm3a<þzoS{KMÜ6âÆžÉÈ™ÿæÛÌÞø¯wQë†82ñ<¬×¸ZLL¿3f 7=q-Št–ÏœÇêõ$žyÇ%ÔUK½wÔ1}¹Ì™z[»`ø cèקM]n; à”8¶ïÜúïHkȾmvlöƒ÷l=x½A,ÃŽ+${#Vuþ5}êHûmO/ Ï<¸O„´=;oƒmæ#Üþƶº÷dðÇ áÆûO£Sh63Ÿ¼ç)Çt¸4ZBDDDDDDDDDjpü~›æaÍû²ñ˜ éß‚ˆjÏØÅéE@8Tl佧_fmE_EfX-’bsÈɫ禾͠`Í rhF“ä¡Œ k#k²ŠÙµ!Ú¥0rL$a@pÛ2vy›“`^…t$†¦tkÎ{ò ø*ðٚѧGÕ¢Øi4b ý;üëU?—=z!í–L8£ þ³Œ¢ßhÞ¦#Ï_˲ÑdÈøÊ„€¹™n{ŒÙ¹exlùûäì2à%šL‹7öüÕLyï[nâ[ucô¤ 8¥SînÃé9oÿCïÛ°ÙñçeSN{ÂH }’›ï²Šñyü¸ÚOâš³;ifðÍË°ÌÓÐà>Õðcÿ…¹µt´&-Iq9 e Ña»)ª3#á¢õ¸cé ДQðñòÙëÜ*"""""""""øÿˆÙÀ*\ÈkŸgÖÒj;Å«–Ú‡3Ƶ!,$´Y?&ßýM¹‹û.îA¤Qùëÿ}¿2w‡¶7cØ1³–±® –¶Q@ÖÒ¼²×§b[UNγkévʬÊm¬¬…,.¬ ]§ó.æ”®MˆnÒ–Q_ËUë_§-XE^#FlÙJ^Þ"ÞžQXÙÌÞ“8¥MÆoÖ Ï£øj;\„D¸«Ú“@§ŽIÄĶ`ðY0"òpëtÛ÷2yð>¦ÜjIœ½œÂìtvåV ) VàÁÙ°}¬Œ_XípÓïü3Ø,Š˜æÇpÎU§Ó¿k':§ø)ôZu÷»ƒytúTC½"X[¦Á¢pÑóÜrßn™º¸žd€Ÿìu;Ù;“Tîæ=xö߮ˆˆˆˆˆˆˆÈ†ãwÝ:Ã"ã»7™9æfFEÕx3goþ<˜ŽL íø[˜6¾ÚÓ­|øú\²ƒ`s:(Ï,bÀуë§>ÆüGïà…^ìæ~Ù`D¯Ê0”íØJ~ÐŽ?}-ô €,–oÜ?¯¿Lcú³éqÝpÝ8ã¦)œQ}×Û¿à•™Y4z,`Û—³~Ô¥t¶Ç2îÜ¡ü8åG2¿I Ï£Ö»âµ«È›0–xbqÕ½Œ8 ŒÝÕÈi€ ;k¿ä§ÜëÅKogÈ¥5‹dþø5ë=6ü Ü·áÛÆGﯦç…Ý IÂU ©V*ŸŸ^ÿŽÝþºúÝ­<³ª–f>ÕÐc¯k‘rÓKÎÎ]€…é«À´ã q×2•IÞ¼g¹9£ mCrY¿n>WEDDDDDDDD¤¶ßC\á¸êj‰;Ÿ¸îà›œfkÞ~»ÞœËº´"|€Y‘϶EŸóô]SùjgՂÆAñâ÷ùpUneÞ"Š«VŒ6°gùî}Uf¬ÍÂo8pøö°»¼êÁÂu¬É­~+Ø¢dÕ»üëÎWùvåN²K‚€ÂŒ-,üäþùðWlóX`Øq‡‡SëÚ¾†ƒÈ0ì5Ä(YÅG?WŽ’ å)œÝ;ª–ÈÀIˆ}ߟõ°ã ? ¶µ=ÖˆxÖ§¾c>äóþ_ðøK?³1Ï ø(ص’ϦNá…u•ñwtMßxgíuÔQ·Yº·zŠÿþ¼ŽôŠʅ¾-/Å™›øù'xèã-”[ Üwœ ={7?ö) ·dQä¥do™Ï[<Ì[ëÊ*“Wµö;[í±ÿµ}êW{}/¨“æã.çÎN£ƒ;€Y[YÃM˜½”´U‹X´ve–Nª"""""""""R;£c×^ »…h¸IêÖîîÌ\’ƒÕ‰Ó.œÈf±üþûÉ2²ý ¨ÈŸ†-ŠA7LáÊ.¼sëC|—S9NÈôWà :p…„rÂ<4b9wÞ>tS5‰ˆˆˆˆˆˆˆˆHÝì M“îi@1†_Îç ¤µ¹†™+ËiwæUœÝÅǶM¥$÷Js5ó·”b*¦"–—ô¥ó˜?{«sýX8H9™Ë†ÙY·"ŸÃFEúz–/[Gzi Ž‘ú4lÊ&gÃG·Â³ò¦¼µ¯»9ƒº„²ã£i<ûÒ4þós!‰!Ù©€Šü™X¾"²òaQ!Ø°Õ¦±¥[Ø\l„Å„c3ýO©EÃFHø2Y¶ÕÏßNšÈI®4š×Ϻ¯È¸Hè<„ Ç&Cö"r} ¨ˆˆˆˆˆˆˆˆˆˆˆ¬#$JYóég,vâ¸ñcéjl`ú7Ûñ8›sÂä鶇Ÿ.#OÉ‹ˆˆˆˆˆˆˆˆˆˆH-ŒŽ]{Y /í":>³(Ÿ¿¶HZuJ"¶ôâ–â)"""""""""""µhØ {,Ýö"5ÄOQn^e2À,aǺÍd­пQ6TDDDDDDDDDDDÖ°‚3…Ñ£[tíÅ]É™8i©.TDDDDDDDDDDDæ¨ï©äqÿÇ Ç&âÀËiÐþŸ0Î N%%DDDDDDDDDDD¤Q¸†DSº5+g—Ù‹ïìÁé{ÒÉ.ö0«•ñ§ñõ[ß±Ó¯ ŠˆˆˆˆˆÔz׃ÓÏ;…a]›Z¼“5ó¿æ­/W‘¨¥°I§ÑÃhºñGf§ù~Ý~›ŸÆC÷ŽcÏ“7ñäOƒÛÓ¨öŠˆˆÈæ¸SúqâÐ(6}÷k‹L…Dþò6BÂJJ›Äû³ÈÈÈÃc„C\lµ1á8m ¨ˆˆˆˆˆH­œ©œö«9¥W*Îœ䆶¢ï)WsãIÍpÖVÞI§±'2<ÅõëF©¡´>ˆ¦mOcÛ+"""5Ø"{qùm—púqgpóíçÑ7F7OE6B»÷Ÿ|\Ñ9L!mÇ26Øñ>÷L™I^üXî~è ZŽC›oßd£÷ïÐæ"&¥%ÝŸÊùcb€@£Ú³³õl¯-ŽA—^Ã…=Kyû_O0§Àªz<ž±w=ÈäÔje7½ÀÕ,§ ƒðöÇrùE'гi€]¿|Ê ÿOº×‚zŸ;z\mÏcÊù¹üûï(h~\êáéû¾$½Î#‘ýÿÁ”ßró3k©8°¾– ©£±ü«›¬ Þï""UìûUA®½ ¦>ô6K 5RBþº ˆˆˆˆˆÈÑ¿ôŠmÛŠ0 {Í&òƒ,ØÈš>¸ûÉš7ÐѤ†îá‹G_`v~åÍÓWD`„wã¢ÿ;>{‚¬ cä•WrýÉ»¸ýãÝêyîhÎ"ÈZÀ{Ó½ÿ/suÅòìw‘ß³x/>úá·žAg7JJˆÐÈ„„=ª CÇ £o»âB ™ùâ{ìéÔ×Ú…¬Êö¢ï""""""µ±ž@EA&@ÐC‘ ‚&6¨~ƒ?ÅW÷>€ë¾[éòÙíLYT‚Úž n¿ŠÁYßòÚc+)ŒíÅÄ ®æŽG¹ím8`Á,[Ç[O%ÜBdz.甔ƴÇѸöNLâòIƒiíeÏŠïyãïÙPϨ¿_JßÈpzÞ~5ÞûŸc^aåÕ£áŽ#9¤€å»³È.¯Y]hëÁt)ŸÍCsw‘€o?]Ëèóú’<}79õ<·«zrÆJ›QçqÉ©½I°Qºk!ïN{›¹Ù‘Œ¸í_ Ÿ}Î-ÄÄAóÓïä–¤¸õÅí$Ö¶MVG“~œuZ!­N§€ì§j¨€Ú’®=‹ãzÄãßµˆ^~9{|ÅìÄt;|é\õ IDAT‰¿7šîMä­û‘×_ùœUÕoXÙjÆò—ØÒqâÁ1/±p¶Ï=çWðÍ–L궑Çî›ÎîTŽÚ¸»û.g–m'öJÀ¿s!ï½ô> ²üXuK 7͇ŸËú‘bîdö7›i;$ÈK÷O'«Zl-Æsï^¾\Û–ñc»àÛÂWÏOã“Me˜õÔ±[k“ˆÈŸŽ…w× ž|nPRB¤ê[hÙpùíW1iX{¢Ì¡±Ñ„9œ$ô:‰Ën¹œq)šETDDDDD¤vWåå—ߨü1—Àë°ã´¼J„iš-°LÓ´í0Ž!áxýÅé,ܸ ?ãùw6=x íBjÙe ˆmëÖ±zÍv”6¶=¶F·×‘4†kÎoËæ7îåê<ÍwÖXþï¼nDX¹Ì|ö–máå»÷'#ìÑ)DÙã8öº{™úäÜ}å t±6"SšbËݾomOÖv #R‰sÖ÷Ü×±M†rÉéñü2íþ~ー½§ “Nl…Û*bÍ‚l’´#Â8èÝ'”us¶ã©k›ú®—ëÝÆFdDZ´\û·Ýø onoÇä«ÆrÀÏmq¸âŠþä}ò0¿î!>*ìÏU— "¾z¨Íš±ü%dTí1¯ÚÆÕêXNŒXÈ‹/Ì$3XóV@ü1'ÑnÃÜqÓÞÚÙ‘‹®I¢£þcq¥žÈµ¢Y0õv®›ò5¾aãhYG`œ-G3Ü÷÷ßx;ÍàØ3{c4®‘?gsÆßûÞxeZµÏóâÝUɈ½†pímçÑ'ÚPÌä/§a #œn§ŸJWÖñîÃ÷qï3_°Åò™;íy~ÈkÁ §u'Jï!‘ZXý•¿‚t†8*§“6¸A|ÁC7w“šˆ#gÛJ¬}uoßHž+‰ÔHûnÙÈö:Hì7ˆ˜õŸòŪÊŠw1çã)é:‚v¡u·ÂîÅWÃú¯_á¡Çßáç®»j(Mí6œ¡å>öÝG÷—á³¹qÕû\Í‹R3ÿ¦Þû,ßlÈ¡Ì롼Ì+ “‚5‹ÉmÑŸ¶¡öøôßÈìmõlS·CmãËøŽ÷~ÞN~Ñú ëcúÓ?ÑQãÒ<®÷(Zmÿ˜—dRRšÎ¿`O‹~´ ¯ëBÛ~è˜Wläƒ÷æ°6½—Ì ùïÏÚߦ ñƒé—à¨çXœ¤ï‡mágü¸µÒœ5|9}#žº‚R¾‘/ÚF±§€ÍË6PäŒÄmod""4Žx:5oàￆpÆà&Ø5ù«½MTÊ™H¯¶Nvþ) 2}XÕ~}cUìàç»;±)îe뛄ˆˆˆˆˆÈLJsJBãB±¦=„¸P€RrJ°ƒÍ“k™X¶#Ý#Ûk'<ÞEYFᾩ£‚ÅÙ½‰vÔuÇÙ»õ}îú×þ¿³ÞùœÁ ¡KÔ<ÖU°‡:÷ߨq†ã²|ø‚&þ:Ÿ« Ër’:ò|®îŒ«"‡ì@(”UE  ¿ËÀ–a¤'÷!|ýgl«ËQ÷6u©o?`(È ¸*d–7=e.bBlÕÖ·NX׋xtêäªõOm¸li„»ÒÚözˆ˜ÁÒl üµ'»Eªµ©ÜMB¸ +·®c±‘à¦tEqU³-¼Ù”ÕÑuƒ¥¹ï]Ðà VNûÕÈ:DDþpylH3–”ÈÇGósÐ)Pþj–°¹u˜”•z9xf3 ¿Ç‡ew*£'"""""R«ÛvSNM{t¡Éçéä&v§G> \Ñ „ÙëÈÖXf-ëL6²‘?ŸÞ}5Ÿð9án1fÿ¹óxæ¡·YV¤y寧a¿£ñç±5ÏN»a½H80ë`DÓ¥slù;øò×@VOI1¥µþ+Á´ÀòQQRLiiÁ†¼OPÞ ”QZRLYEà×-Æm™}?…ãΛÌäÓú“”3ƒÞœÏ/àh€1íÙ3si¾}ˆ/k‚]9õì³8ç”4/œÍ+¯Íd§Ç.ë6ÛxÞÅ\:¡?Ñ[>á™ÖPdRÿsûˆ''‡ÐþgsåäÖÉκ‰~2]3çñK†ÓSNÂðq¤®û€–æ<Ä6‹=ÓÓÃüÙ[ñDuatŸ¿ÌÚHvVÝÛ,³õ¢o`>›ZŸÁ•“ÇÑ%¸”×_ø†Me&ö˜½ul¢¸4µÙM{îd.?œÁå¼õÒ÷l)?àÅ­Ë]ùuÇÜÝ™Ñ}-ÿ¼‘šZ ÜÍ12~«âNæÊ Ž§›±’·§}Áºâõÿ¼ ÙìÂÄ‹Ïcbÿ(¶ÌÚE|³bæÏÚLyt·}±©ˆª¹o{LF÷ö³pö ¶³¥Ž:Jtí,"2¶¨Þ\u×dzìþ^ÉŒŽ]{5,‡`¸Hì}çœ1œvÕ¢áßÂÏ>äÓùi”Έ+€'Øž[^¹…>ðçïŸgÀÌeæ3Sùª¤;WÝ<‰V%óyö‰/ÙYßh ˇ×5ˆ§]FÛ’¹Üó[lñ¸Û2¬®·òæÍ] ¬x†kžYK£~Tdñ–—aÅâŠ;¯atrå²æðÜãï³(/ Þ&""""""ÿëÛDö¿‘‡Ë?ŸZÓˆë`wRwzFïdÉÆ"L ¼çÕ¡á¡Ø *G'x¼‚&–a`w¸q»]ØŒ:ª®V»—ƒƒÖ¼°^¼^AÓª¬ÓîÂâ®ÜßAÕUpwä»®atbµ'J—óê”ÿ²ó˜k¹kB+ì‰Ãø¿½Üÿ1›+4‡“ˆˆˆˆˆˆüYу³/í‰oÊ;¬ò¦0츶¯ú´#ŽD""fñ ^|èUÒ‡D±ñ»ŸX[¤“HÃö(Z5·“¾«ÐKaÖ. ³~Û†ÚâFñÐÞÿ|5ìɃ¹ôò‰ í”D¤?— ó¿á°³üÀïüpk kÎïðÛH9õN9 ñòýÏóÃŽR ÏÒ'´¢@âX.9—»¿ÉDã$DDDDDDäÈ»õ3^žw —>ø4QV iK>æ¹ïw{$êùã°ð¦/â“ ‘½–p¦rÚõѶh;‹æÍgî/kØYü+ƒ®•‰¯¬˜Ò’ʯ"†#Œ°PP°^¬¸¡üó‘«èí.'míR¶Dt¥÷¨ÉÜ•bç¶Ç~dwõòAW{.ºïNNŠ3ÈÂÅçï_–Ì2Iã¸ùæ ´³•“¶~-åqíè0p75 rë#3È î+ŒiKdðÈÔý;©žŒHÉ ÷œS™Œ¨Ò|Hšþð5{ô-KDDDDDDþg,J=ÆßΦ¥¬›>•§ÿšÝ:DDDä«a ßN¾zÿ'† <†'ÇÀ“älXÄÜy Y¸.ƒ²à‘jNg=ñ&gU{Ä»ô)®}nÞj™AIcN£·2>y„{¾Î$èl΄ûÿÅ)eDÊϼUm‡„èc&q|6;ø†Ýþ(Fßöµ«Lwv'¡IÝheö|ÏËS§³ÑÓŒã/=“Þ¡D¹ «úäšÎÚ7­úÅj^}ðædq&âšû/c@ä‡Ö¤5 N”‘¿¤†%$ÌR¶,ü†- ¿å­èTº÷íË€þ}é`Æ{2Xµ`!s,ec¶—_;š·0—"ÿÞ±%¹µÔi¹Hîœ@ò„{yyBõ'ciç‚SJ9IìÒ°{Îböøóglç¢vm*‹NŒ¼å,/éC¿”Ó¹çùÓ)ݽšÅ‹òѬe쬞Œ0lØlì!b€a6'n· ³Ö Xh ù«r4®¸…¿hË~ÚŲŸ>#´i{ú ÅÉ£ÆÓcdw^¼íVy~Ms²ùúñZµ>€ÍnÃf¯lÏŽé/òÑ6Á@Ó»ÃNÙNoò†ÝV•1Ë„Ê5 ‚˜æþé÷P‘9›'oÜN¯aÃÒ¯};ugTjwF°‚çÿõ ÷–·á —MÙpL Ò‹ï¸ëÁW˜•µ˜—4±n¿ŒÁ1Õ‘»\¿:œˆˆˆˆˆˆˆˆˆˆü5Ùg#ÃIj÷!œpÒñœ4²‘@ 3‹Òßh¡xù[rƒs7+ý¢å»p¶íIŸî- 7jŽE0ì6ò×í&´ÒX_)^#‘cZï/cØH|6W\0ŽÖ»>çÙ{oä‚‹ïcz6ÖžM]5g”²ôç]ûïÍ%w\ʈD;Þ=³xúž·ØQ­üÎÙËÈÖtM""""""""""òÕà†3’æzrLß>ôë™J””ïaåìéü²hkÓK þV­¶ÙÈ[8ƒM§C‡ñÿâ¾ËÉOèAß–aø7¼ËwåfÍT‹aóáæwad«³y|êPÒH!5v!ÃáÆôÇsÌÐþ„íC¿Õ›Ès§Ò³)àÝÆÊl߱țû_Ž¾““ª ïÍ%wüà=o9bÄþE­3àÍYÙ¿]|DDDDDDDDDDD~g–éÀßž!@°€-‹`ú¢¥¬Üš‡ç×.Œ`8‰ Ã^o¡á!•9†Ê™—æÎá©áÜóŽã˜¾iU‘ÃúŸ>æÝOtY³¼åÙÌÛ¿ŠyÑ© éB\æj¾ø:ŽSNL­Ú‰EÙÚwxäõ Î>á:tïK+|î\Ä·ï}À¢ÂƒÔòîâÓÇ_$ò¦Ë‘Xõ`xo.ûwïý…²çñŸ'¦³Å£$DDDDDDDDDDä¯Ëèصס[qÚ™=)Y±”ÅëÓ) èæz :ãé2l,ÇëI‡”8ÂŒròöleùœŸøvörüŠ—ˆˆˆˆˆˆˆˆˆˆüµ5,!!"""""""""""ò+Ô½¨µ=’¶=ºÑ.¦Ú¬N†—Û…Ó¨^Ð ´õX&Ÿ;ŠT§*"""""""""""«;!álÁÉ—\ÈéíB÷.À-¦?7<ò/Îoç®QÔß™ý;kW@EDDDDDDDDDDä`6…@DDDDDDDDDDDŽ6%$DDDDDDDDDDDä¨SBBDDDDDDDDDDDŽ:%$DDDDDDDDDDDä¨SBBDDDDDDDDDDDŽ:Ç¡ ¸ãi–Ø¢cpã ¼IÍÊ|U% Âã\€_Ñ‘Z2!‘|âÜzbÍÇšžùwn;¨äVESDDDDDDDDDDDjUwB"ÉìO¿f£5òÈ( """""""""""r0£c×^– """""""""""G“µ‘£N 9´ÐžÜöÊ4Þ¸¥7ါõY<ýÊ4þ}z3ÿƒý‹4F½ýõÀ¾u„úÚQyè} Gô* ‚îçÜÌÓ/Nãµ[ûßfŸ ÿ­Ïñ""¤ï¢8&GÊI<úÊ4ž™Ü—­ ÇÝ77^©öï‰shëR¿ù«¨qNø«]Šèå‘Æ –leÞÜy,Ü^Šùg?XgsŽ?÷X:„ë#óñÍ&šž§Mdh“¿ÐíõQ9œ÷…3™AƒÛS±Š¾ÞFYñþózPïù‹®ÿfßuÿlç¯F¾^G,ÎG+ŽG³ÿ9ci å›–0wþBæÎ_Èìù[(êóMäþ>=ｿâui#(*""rˆOŠfœqÏUtèpO^ý7}Ó–!C‡à+ø‰ïýgóĽɟ5ƒì®ÃéYÄÊ/ÞeN豜{lGb+6óÍK/ðѺRLÃMó¡grééh${íϼýêç¬( ‚-Šî§]Èä1]H R´s)Ÿ¿ñ.3Òã™xÀþ¯–A§ sþèN4q[”íYÁ—¯ý—o·•ãêrÏ4°=înWóì =Èž1ƒ¼žÃèUʦ™ï1íãUì½pÄÓ{ÌÎjÆ#}Ά2S}âwüe´÷ùÿäú¡ÌY÷%ss5ž¶Çödòí×1¬­›œÅŸ0õÍ- º»Zߺö#æ4;£F_»eöh;T©ÇAû|eé~QÆqáÙcè•E0‹¿~·gí œF¼þ³ú¨ÎûÂÑŒ3!a=8sü:–½•¸ï¼þíÊjÛ×sÞvw¸˜'o@ÉŒéli7†Á-Ýä­ü‚ç^üí¾(zót½Ÿè<-òWü\iÌ9Ä]ç¹ÈÄA\ïÓ¹ò¼´wf0çÛÍt8c ö/îçž•û¿ëN_YFl¯S¸ôÌatN ¥"}Ÿ¿ñßo-«vÝÀÝl$W_{¡ ^áéÏ7SóTä$yØEÜpz<Ë_{Ž÷×”Tnûg:Õõ=¬®ïø;=Ø#÷Æy«»ÞÎc¢kT™÷Ýnù0‹ÄÿÅçÀ‘è8hÚoWœ=„6î–ÍIù·úð$RBJXôñÛ¼³Ç$Pá%xà ¯ú|9âçßâ@×¥uŸB»]Íó¿âºó÷Ò©÷ŠˆH½‚Ùü8í#vìú˜°o-Å’FôƵcŽzq × w±cÍ.üQí9éìÁ4±„´›À?/BRæ,>új V—ã¸áº1$; ¼ëÙüý䮄m›Ågß,¥ e“¯=6öƒ÷oïv6WŸÐ‰óøvÆ Š“{sÖ¥£Hv4¦=û˦Œéoñ·ü°ÅE§ã®âšáñ}@ÚZÏ-7J'ýBéwþe4¡Î"ñC£]ÙFÖæ¸Hêw6ôð2£zßzç¾< ¯ùÑG´Ï¾Q8†rÍã9&©ˆ%?Îdµ¯CÏ¿ŽKzE4ê}àS•Ã}_³ùñù·Yãr~äÉ—–PTÇuVh=çí}çÛ1ãH-ÜÈú;MzN`rÿX"ŽÈyºþÏ ôùK®7ä^ϹȖ0”¿_=–Žá,YY@»ÓÇ\Ë~I£¸îšãèêÞάKÉmÚ—s®=“.aFµR.Z2½bèxÊ?¸e|öŸŠœ$¼Œ».êKbL+Ž?­Ѷ?Ùù«ž×«Îï65æ' ’·ôsÞûèS>øäGV—XäTàü_|‘þŽfÇrý•#hçNcñÒlRÆö#no¯ˆmAœ-œ>×<΋Ï<Í«Oþƒñ"jý~©Ï7‘#Þ9j÷êiW}ç„Æ´ëOñò©‹ˆH½,?…™9TxrÙ“ëÁª¥XÖçÏòïç_âå9Å@1?=ó$S§½Î×Ù@tS"ínÚ;vóñ«óÅ'oðâ¬bh1ŒINìáQ¸› dë,^›ú/¼¿’"óÀýû p ï¼ùO¾ö¿¬ßAŽˆL ÂÞ˜öì/[ôó˼ðÑ×¼ûÂYá3h;²7 öÚ/þyÕ âõéù;ã ùI×Ö{ÑP:ï9îúž}e>%Ä5uQR£o•Pp@_7ÙG½ÏhRŒ¦ƒÍËòŸfÚ»ïóÜï±Pú߃„ˆ†¾<µNm >* z_X~ 3²( ¾öd–¨µ7më**v{…w+]Å­VN;1c!!W …ÞÜSzÛ/¥ãe½‡_…¾rw^R ‡”ýÌýr/qVwjþíýÀýªÜü\k\ˆ562£"I!6Ò|Ƹ#7~ëÀõ² xçáZÔóÕröªôoB<èvçÁ\PÊ—R›ð×Ç¥LH!„¸'¶b¯h"=Ý D±êãïø3KÞ·"•½,\‰2ãVÞ‹ì?×ñþ/q¸ToD§Çðp×t=xšqù·¯§òcƒx8(“Ó'ñs¤½?˜L—âï“O5?w&‘ã@O &tëÈÎÏ>bYh*2(!iÜ>Nƒç'ÿâ«MáßE«#Ea%3!ð¢rY=ª3*·]¸4e‹z~!C꨸¯ç…ÕDšÝvÛ~öVÔSé~´ÓŠý†QÎ!¤ýº ¥˜ÑBVJ6àA¯UL6Žþ•(¤HÃBvràN…2:ˆ±áÙ¨?ÃÚ8p|å vƼp\pRB_­ Ü7&#®þ•}¸ýã¥VŒñÎÿK·z }±;\gç?r"Ãü3ýÀý©Òã2oªúéÙ™bĹ\@uI DB–¯çL–GgMŽIb–A@i Jßì‰Åj+VÝþýrÁï)R¹·ÁiÌÁí\è=˜ÆÏãÙq¨ß‰ªdsä·0lõ^.âyÎïa©yøJ÷û¼¸Õn_´ÛnïUŽïïK;­Ôoäß¾œBHûU8µÝ¶ÈLÔýDwïI³Ñ/a=’Lù qâÎ ‰è{¹Ö£7-G&û`:U:4£RÎ^~O+<(8)Á]&#þ=íWáÇK­ã߸X§v¡Á‘´ñsÄ%LÁèlÃpý‡þ¡~à¯×?W÷ì'®Ó£´éeôGR©Ð*8ï"œ…ÌL/ê7iFír„ÆzР‘3ÖË¿r8Á,ý›²Ýq{ð× Ï—R›PÔkÿ%bB¢û¸ÁìYÅæƒYwvs§ÃI IDATÐjWªw΋ÌcæŽÄÛ*÷Z=ól/Ú4¬K ?ˆ?Çñí+Y°8„óy¿vmÇW!ÃXÙývV|“õï'2fÀÂMp§òm3$U !D)—ɶ}1ÔjÛ˜G›í`ïÎâ$b#3l%sVhñX5²’xnŸ/û…ó9fT¿~Á·§èÛ²#}1åÛ/cg¼T·?qÃjö ¤U³6hŽíaûõ ¨HU/-ÅÈÙÕ߶“Ú¸#½R9óÛ|±/éV“}ŠO^ÔcFæÅKGPúé„P4c±êöö3ÿ}àHêÈ=²ÄïaÁ\g†ìH‹®•°¦D°ç»ùáxY§‹~l¿1!!uTÜïó"Ÿ »í6èí®eàâ}i§•ú|?“s@i¿ì´E—Ú¢³Q¿³`™£ŸhN‹¦zý±§n­ïHÅõ;ó>wá™þmèØYOÆÕC|ûõjÎfÛoqr'%æÿX-’·odï5;OFüËÚ¯;—™ë 1¾êæÝÃzÊøæ~«Â 8T/JvbŸ»þÁ ËŒê„ù|Ÿ¼5Ÿ.dËL¹Bñ7ÓWÄ»ãšá¥¹s™%å0ó¦®à‚AÊI!„(™lhüæÅW›¡[Ïâ×ðïÖoRÙv.Y&#„BˆH]3­ñíÄø§­,üßBB½G°tZv¼ÖŽ}f“ýÔ <mbí¼‰|mèÌÐZ±,3‘}©¡¼Ñ÷UB’ Î19ÖêE£SïнÓH–k2wN3v¿Ü6Ã~@Ýk4]ʪÑø=ÊÌ{»`(­ÚdÆå̜ӟŠZžíÞdb“cLì݉ö#¾E=pƒ¯ØæVçÞLHÈ}iÙ¾?“N4ä•çÂùòjÊ>2–f'§ÒûáþL>ÌÛsGPC/•X!„ø».ýÈÛ¯¼ÆØqwþ÷âd™ŒB!Jºì³+™½òñ»3nüóôˆfç7Ÿ²ò¢tâB!ă¤-}YVS¦E?‚Ï,cü5gÚ|:í#øù²‹6ØôxþNŽAéh5Í}g],Ñ[ùê·Òsôì>|úoØ™ANÌ.Å?Œ§“¿Æƒ©v>ol¹L² 6ÏŸÇ€CiZæG¶«@¥÷ÂßSÇ“+Ýcš s—êZb7ò|ßuÄǤau.GFªÇ Nhs‘ò T˜®®dÖŠãD!ú³Ùlëñ6U^¹³F©ÉBQœèé…<󌔃:"„BüçX3¹¸e “¶HQ!„Œï$_§R8!¡£|ý²$ SS†êùC&@ã݈‡½Î°ìl8Õ¥YÙDOW|ï–ÅÁ`Ãj±“vãcSV,¶Ü"ò(ï‰{‹÷ Ù;)o- Žº+ìqÖ´m2c<Ÿaì‡ky·L4Û¾[Èì%[IÏ· ›Í‘ÚƒßdtÇJèÓ®‘åV`’äîyÈeŠ¿Hüïlb¸ìDu- B!„B!„B!J¶R8!¡µ½«µ9†³0 c]¼ŽDÒdÜ 41mb†Õ¶/¼M‡SŸ0𼑛ïF* éqićL£Ûÿö“ ñ J /®Xp À¸wÏ®úÇ€–Œ?“ÙÉgé¿öÆújÊõšÁôV{=ôuŽ%›qd ¿º÷œè|ªâ«ƒ# ÷§šg±éòvK!„B!„B!„%_‰ø†DªÆŸW•¥<ýP¥fç=é`àê¡Êtì@E]*{fÎ`WðÖ®z&Gç±,º3Ÿ¯^À0Í2žyg7?¡ÖãîXœÝµ³ãg"š½Â¸N•(ãU‰ã²â½v”Q«ñ~x_ÏJ?'ôÚÜo[,Ö|ÛÔ¢Ñ;@v*©ÙVt¾Í>²>®NèT÷–}ŧ? þe‚èøüÿ蔆Kòt„B!„B!„Bˆ’¯DüÇ·¯dÁâÎgXxÞë½Éú÷3` á&©PB!„B!„B!DaJÄ„DM‡0~Ùó§Ý ú×4 iÛÞ‡‰äÜø£Æ›6/Îbæ:B~Å» Nr1Õ‰ ÁMè9òUÖüÞy£^añéL䃦k™9×@œE*“â?@åAëq£ðYý ë¢ÌyTãR¥#C‡tæ!?ÑG7ñÕ÷{¸j°Ý\îÝf8]bWñ‡g7†õhB5?=Y׎°vù*v_7bC‹oÓ¾v–5»åÃNþÕîÔë5„Áík⣷~õ(ë–¯bw”Ñ~ÿQX:*G‚: bX·†ºZH<ºoV³7úöt”öµû .CÇ7§0¨B¾¿E~Ï$զïQo†÷kI5w×N„°ü»]DæÜ–†JáwÅ^¦\¯úôÖ‡¶5¼±Faõ’Ùc*BºUس%Þ f픯9cx°§‹.è ¦ IcÁŒ-Ę‹”•ïÉäQZ–L[ËUó}Ê„S]^ù #»ß™ÏIß|ùÑåû»O_Þaâ‹i‰ ¸·<‹ÒàFûù=+.î±}¿‡õ‹:øø«õ<_>š%GWˆÿ‹@ž˜2ž.N¡|2iaÙ7-[Ò`šV)ƒ£-›¸óØ°r‡bób/•3•Úöe`§ºTöuÁšÍ©kùaËR-€ÖŸî_'xÍ;Ì s¿õÿ'³ï_›sŸÚ¬1E¾>ü„爊ÕÕ(ÅÓöb_ ~]&ðAÿÛËdïì),W1¶~0ìÆ­EŒùu]™ðjUÖM^Hþ*u×c}ûzjOš<=–! ³ùùƒO9êÙáÞbfÅüÞm fïx+EþÎíÂÒèeÞo¾…·? »u½0¯pmboÙmå:í²ºÎ+ãùìJ*äææ¿ÿí¨w ß«ÂØèP6EKÞ–¦)ý°“wÅ1è]ÎÃK†»Ä‰ÿäµ ¥2ûûÆ—÷t>ß%î¶?^.~š%¶{/¹°Ù”« [w99PmØ\fµ9Êë}¿à|õLûµÜ’Ùùí)úoãƒ5M˜8ÿŽõYJ¥ÏWÓÝ ^ƒ-•GýÈÊÆ_ðèØí¨š?ËôIOÓ®’ž¸#+™úÖ|~6¡~™ŸßÍbÉá¼Ú1Œž\Mµ×§óFïÚx[â8¸ü^]p¬Àž¼ùj"cö_$æ§b×W™9¾/ }Dìùž÷'/f_‚‡ê/°zª…Å;ëðâÐÖšNñÍ„Wùxo2—!„(ñT:ÊT«O£&èìÌïù9×dð˜GÐnZÈÛ§u´ñ/ô¾Â;«"1æuŒÁÁœŒhȳÏ×!zÅ<¾Ý”Óí%ÉVôrЖëĨ^>\»æJ³!cxip“—!+ßþèÊÙÿ©˜ËŒJe ©Hïqƒ:ô5|F¹Ž#9¬%ç>ÚE‚c÷»”1'槵&R¬¥'?%-Ïâ~´ß¹íçñ#†{nß‹´þ=²¦çç5$°¢(s›ÓØ1š+–´©ìLXXîU}•Su½Ørû–ñá—IÕúP§ó†>o#vÚZ"Lzªôy•×[$²iÅ|}%§€†<öÔ3¼`úˆYÄRšæÝKzÿ¬O§xÛ}¯íþ”·Bu7?nªñkǘþöGÑ–ë^¤Øúp°·&—-B̯-Oç¡=¨àtî¯Ð²žÎŸFµ-¬Ÿ¶€Ý95xæcf¥1J¢×]Æ`vói,¢-ÿ÷nÏ¥ØË­rÝ•^çnü¿½ úùŸV‘§ìäGñð*‹dÿNÅ«ïùó•d?JcP¥óð®qâ?H©<ô%`|YØù¬Tž íN¼µ˜i–`ZJ!o'Æ?meáð…„z?ÃÊiuXñL?^ˆ¯Íø_¾Âs×PÖÎ[Cù‡1´î§|¸>‚7º7Ækõ&Ôåèð¨7¡ “êû(‹>îIÔCiuZ¼4Ÿ™s¢97äb}­!<ùoýo; -¦ðu“c¼Ñ{g<ºóñç¼qKó·AƒødJcMx‚±'éðæ§Ì}ÿ2=^ ! p¬9Û_ãÉNïSuؾx½+~˹QQâéñ¯Z•]&©æ‚aŸ¾b+jçìcîÞH’Ì°uÝIÞŒ€5‘\6Ê£urN±Æ·3åâþàËÃQ¤Ùàô–ÍD´”jj*4´»,2ÁZ¤4b}òa¶—æ¸=|½8†?¯g¢qÖ‘•m•YwΖÛ/,rLfŒ9Ùääh0͘rr°Ú• _›ÆS1ó™Ö°˜ûp+·ÖzPNŸÂÖ+qÄgìÖý7ÁãÜÏü–H6‰ì^³›Ž¯´¤’àEùÝR‹µì çÊ@_¡ Í5ùô Ä›!açÌðs ½u¨h]uø7íÇȾͩì’EÄá |½òÑf'*?<˜áÝêáO,ÇvÇAu#žëÉÄ!6ŸⱎµðµDðDzŬË(xèÕNµëÏÐî ©àª"ëz(¿,]Á®3®MÆ1©ÑqvX[óhC?¬×BY³|{¢ h½›Ò¿O ÎF“| õ£ÕÀ¡<Þ²"nÖTÎmýŽEëÏåÞ¹¥v!¸×‹¼Ð¶ž¦¶-û’ŸÂ2°©tø5êÈÇ[RÕÃDlØV|BXš5ï©•B–eùÒõ…!Ôvv¢Æ¤QèV¤ðXïT\°ðP¾¿ó}Ò­¬ÝÈó¹,ªýïmÚøw'cCCÙ®ã™Pý7&}vuÍ® غþ:R/ìfÅò K2혘´v÷E[¾'‡kÙw¹ ]ZVDs}/߯¦Qÿž4)¯áú®o˜·ò©ò]±"SyT£Žá*ãfÑ·°ã¹ð¢ývíÆú9§Y[÷%fØ«ëz1ñI#!çjÒ÷¡+,üp#Yõ ?ÆjÏ<ÞWË’°kdšÕ¸Û©K…ÕŸŸ#©ÿü­ºËÇëÑwrǹ”!õCˆ *´¨êÈ÷¬2 fL›J8Ÿ #Ë÷JTÑ_aÝÖÓDg\ãðºx¶ÀÛEM$x¢†­s¿bÓ•¼ËOI°ì[?^îP¯í±Äßõj‰~”¿æB@çBÚ,+eZåí6gùxÎVbTô~s4þ›—s¥Cþõ—r4ÝzÇ6º¿õ2A¿|Àç)Ûeï÷JáË 9’éEû h¾}ó¢óúçÛúðåßÄØþ¾žF1žvRŒóSI¼q‡¯Æ›vƒkpqå<.dÛи+ÄÖz䣷*Æüyqv¹Žiyš$£.@i¿Ï³·žÚ›v£GÐÄÝ™¯?ëM c…Âã®x…ü*ìæW¥ó´3Q.Åí%éíÄÛ&…íåõ*§ tÝÎõ}1GcòÙyÍ`Y” mn”ëø·h–éFew'¼þ9³–r±Zß‚åøÓ%ª?wë8ä|vÐþþ«íŽ=ëŽÒ2{ij¼i÷l¾|ÍZεúOZ†Å=QéãÄ”ÒØó~Œ/ÿâåöÂÛ…ë*JíN1Ó,ÉÔ¥/(QS¦E?‚Ï,cã5gÚ¼<ísøù²KN±éñü=œC4§¢Õøùh‰ßû+תu§¡» kzúœ`Õ‘ ü: ¦þÙùÌÝr™ääËlž?¥i™¼bÉ:ÆÇ®bß¹xŒ€Jï…¿§ŽÔS+Ýc$ߘIÐQ¡K/ÊœÇÂWIIºÀ†yK¹ÞxÍ=s[[Æ1wŒÄÌxŽoÝKŒÎW„™BˆRÀ–Á™Í«XþcgÒ,Úd·ò¾h#HÌk —IqÀ[¯Ê ¼«×Æp"’Ä°å¼÷Ù!’sŸ¡Ç©|5|LñÄdYÉRXV´4P·ÝüÛ0&\àTx:Ž Ʊàã÷xµ} ëV,ü»é€9v'˶9ðøëSY0ç=^íœÁÚo‘hl"6-çÛ=q¤{n¥au÷ÇMëIû1ùhæ»L|®;õ¼rï1PkÔ`µÞ„ZÌØ}ðuQìMíþNSÌe*…2PáZ>§ #õž|•©NaòsS6'ëÝêPC¾r3 <§¾šÊëÓVø8Ïuðõj/žïéΑ%S?ã¢j´&@Ÿ¯÷lK[ëf½=™Ù;u´ë× ßÛúfwK†öô%ô«i¼öæ ¾¹\•>=*£Ï;<ô æ啼?aß\dà¨NhíÚ]ë=ÁÀá,ÿàmÆÏ݆ªít(›»‚Ö·1M ¿1}Â$æìÔÒ¦wc|Ô õkÇ觪¾b:¯M˜Ç¯Y­õt<”–Yc ùì[².²têbŽ¦å5ËmO/¤²ÛÒ;‹_“j¸«õ»qiϲÜ3♦¤l˜ÃÿÆÏdel=FŽj}G¹Ù;&z…}plNµˆïyçíylU·eô¨œþò=Þ˜³U‹n4òRI›|q³{õÚŽŸâ¨ã™iµß®åo³îR×uèæʲ¥[‰õR>Æ·&;ì×¥BëOÖÝ%œ zÜî¹$„øÐÒª®…#{ù|ðÙÕ[QÍ)·0§\àtzež|®?× ÄÓA †Ö~ù#G“­8Ul@@òöF Ä}~Ï´Ïöí{sÁþ2TÝÐN›e%éÐj¶ÐAM}(׶?­’ÖóÓÑ‹l¾[kN"윑ÀZ¾èTN{bS—§¶¿8•§^™$B/fÜú–¦åξÝ^ìð7ãiå8ÿVãZ·-°á\6¶»ÅÖx‚Å~Üz÷|iýÛ1´U«×ž%ÿgM•ú<»ëYÙµèkŽ¤^æ»é‹9éèc7f¶w¡_¥c£”_ÂXÄ\Ìí)ÅÛJÛp©Ò‘Jç¾gÊ[Óùö\9žxîQ*:(,Óæ+שÓùpÆWye¼ˆƒŽï,ÇvöÝ<‹8hö³“Ž c¥²QGÙMÓ’¿~,……Ý2,îy¨4þý§Ù/³û3¾üKÓvÚûå©Üî/M™¸Ït”¯_–äãdjÊP="Ãâ0ïF<ìu†ßÎfSÍÊ&rè|:¦˜=lŠ«ÉcuÝñoÝßã?s$MƒGyOÜ[¼OÈÞÚ·“ƒ›¦ÐØA‹§sn`IŽ$6ÇØHÚ6™1‹RéòáZB÷ÿĬ§ãS`¼£Á½¬i—ã¸ñšnKêU¢ŒnøçÍ:˜S®‘pc&ÎjEÞ† „ø7\ìÒ:j0gn¶i6cFt8ëµ3ÕëZ8y9«!•Ä4#Vµeõãµs}ízÎeMaYÑÒ¸K>Š ëø|ƾú özòĨŽ”»ÇkZºŠòÜ#6~2‰_‚]ôÑ-€™Ä³Ç8™¹Øûp+ •£3¦”.ný†ÙóV°ßÚŠ1c;PVk&îd†ÚÝèXÕ'· ´îÓ‘²Z5:uþàKéw¦b.S)”7+·£Êõßøbþr~OmÈ3£¦œö¯;ÐR®E3\Nnà÷ I¤Å†±yù÷ü~ *¶©eÿ/„œM -á[~9”ûÞèrÂÙ¼#œ4Cá'άqçö8Õš|ˆÏ¦-$äl™FÙY&t.7ƒ(KÂNVï ')=–ã›ÖpÒ¹ Í”* TZW<]´dFîdÁ”ylÍ»2bË cý¶K·ò£sC¯ÖâÓ°9^g׳étéQX·…Äêm¨é¢´ì¯ÜVRÎ!±|ª8©P{Õ¦™G»ÎgãY¿•¯n`ͱX22b ]¿žpßÆÔpUá˜Xîš_KÒ ¶%;ã^H$ñÈ6ŽÆe“ù'çÒÔ¸èånŽ¢7Ñ7ÚÏL’ =žYwygó­ö÷®uÝÎÏ«öv- "ÕI^vë’ƒúsÛ{”Î%!Ä¿`>¢b ê°?ÚŒ)æ(G²ªÑ¶šSî=цˬž1›Ú¨Þy8S>žÅŒ×‡Ñ³¾7:T8º¹¢ÎJ&ë¾5 Jm–̱ìøáã•®&~]šwáïnLÄœŠÄ¡Fe<ý¨ãŶP#AU=qò ¦\FçR”w¢ðØáŸ9f…ÅÓŠqþÍ°¡,{”å؆7Ÿ‚TŽ­$¥¸õ.ùÒúÑá©6$®YéW ïRì®w[Äk7f¶ßojòkÿØ(çWmw,¢\>JuA)ÞVÚ€)v«÷\&)-–c×p±!ÍÊéècŠ‚ñ‡ýüèR{(•ýeÊiuÌRÜó°D_¶[f÷c|ùWf#Šv>ßK»S¼4K¶Rx ‘ Ôjô®zÔæÎFÀ€Žuñ:I“q/ÐÄ´‰V?Ú¾ð6N}ÂÀóF°F³}s2Cz¶¦S9_Ž-9NºÍBz\ñ!Óèö¿ýdh<¨RË„+&¨¶›ß¶PãV!ãÞ<»êcZ2vþLf'Ÿeȉù²›{m?9иRÞ!ƒL èÁ†Å¹\%ü ׉L2b3$rzëb[7§’ó6,M_æǃpÀÈùï¦2{_Š–\KÙÆp=·’-çÓ0§7ÿÊÕ÷¥¾çN~O(4üÕ}0^þ…©ïßúwÜʵ4yÿê{mgKÄ&mĈç? :‘S{Žc$ý¶x~W¼eʶµW{8i¶b¾ú+?l?K’®¯ÛHëºPÏkÇŠuì p®ÞŽdF¦å½ÚFNÔ öE9Ñ°«Ž´ó)7ßmJ‹&Í\åæš–ŒÒnÞ,PxOmCGPû'éöº¬Db Î俬jI¾5(0%s=CO€³š;¿ž—›ZƉïXàÚ™Ã'ñ¤[2'¶mbÍ–$’ŸÜ ©qñÔ“—ŠÑvãâC<‰&<u$Ú]¦&7À)æÙÆ¡”.4r&Ò» ž—B¸­ÆÛÛç৘úÑ 5MaŽjn}ÉÏÞ1q j}…ü6SFkî:V›SŽ)ï¸Ø°I(uoQs¾öÓš]Øñ´y}źžÖŒxRŒ¶»ÔWuóÖÅn]ÒÙ©?€SÀ]Ï¥lyªÿ†é*µªO™²N¼=» B£ÓbiS—S'ÈTëЯsdËjŽl•Î‹ê-å©gÆáöɇ¬ÏÈÂæâ…³Òòµ *Çšµ(GÔ£÷øh¥6+·ÿ3^ßÇŽø. È\ÃÑĢτ¯$Æ£•Ê9PÁÆGƒhÒ®"å,UP_þ…¸»ä³ðØáï½Fc?žþƒè4«âT8UïL+ó>f_7+¶¾¿lXíÆ­»8ÓØ~¼šþu7 IDAT{¼î NÛÀ¬“X¼ŠZtø6´·^AöÇ *;ý¦– }•Ë±ðc£U¬ïöÇ"»ÊGi{€B¼m{;ؘÓbH5ç‹OÒµ8æ=M¥°¬èc @ïW„±Øâ=í=”êô^ÎÚ]v˜OåñLQÇ,÷~–ìËÙöËs7Çÿòø²¸4ø¶)Úù\ôvg'æ:ÅIS&$î*UãO€«ŠË…ÞB Á#ÐUjvÞ‰bàê¡ʼ؊Ÿ-bÏÌìúh kW]aó×óX8–ÏW·æü¶¥<óÎ.r¿ébâÚ¶­dŽ|…³CyíX:6 fÇÏDŒ}…q¢Y õ‡Mcf«>AtÁKGx?<‰¯Ýʘ¿ã‚6÷#ÛKþNÐÄ•-‰ñcÛEðù)':½:ŠÀйH¶A )…ÿÎ ‰ôè8Ìí‚(£=E–¼ƒð̺N¼œƒë¡9½,¨ôAôyy$Ág`ʧɳ—ýe*œ+% ¥|Ø”†VCëøï|ŽPëôh0c²ZˆÛ:›·5†°¡R«ó}*T*ÛOÃýõ}PáZ¥1u4ç8|!+`µ˜0YmXl6Ô:2ÿÀ”í_côU2å¡bn»ð¨ô»â.³_Òc’1ÜtÙlXl–b»‚õ0;Õˆ³Ÿ+Zâ°úÀ¶t­t…KÉFÜË{¢!+ s/‹»ööðOy]¦ùp†Õ>ÂÙK¹”aÁ¹ÁKLk—¯¹—ÃCsŒ 3 ó¤œ«‘”l+:ÖQãäã)l#óv­ÁÁ'˜îÏ çÙŒk|tÎ^~¬d¥p©à×1*¼uل昖ýÅÁº%™GÓéج Êxp1ä2Ù6+Y)Y¤†®dò’³yß½p¦ly7Ò \1±wL.s\)¿:iUïë¢|ígádzèë;+Õuroä±Þµ¾æ?ÆJuɈ_¡õç"¿½û¹4}{‚<‰,DiçX‰6µ ì˜?‹MѹÁ’®\W^Õ’.§8_óy¦w>Ê{3÷h›)™ó{6±¥Ec:¹`÷#¶Ø­?jª ´·ÞLVDe¬`ÁVh¿Ái…rT—دï\«4±;¡XÛSŠ·•Ç>Z÷²xhO•Ÿ”w5i7…e÷4¦¸Èo‡óÅìí¿…L¥±‡RVGeaNÑ›y÷Én´ï5š×lbæðž´ë:€gg†p%_E3^ÙÆÖT_T‡Öp"ïnAKÔzÆOÞGÍñ?°o÷OLmÆ´×$âŽ;Ì\ùi_&ôäËm{8°î}Zÿù1ÖD‘ÿ6EüÀ˧ᔟ9´ûkÆz¬åÕÉ[n} ]!þ… û9ëÔ’ }pt.G«nõ±œ8B”Ù‰Êõuœº{÷¿kÝ´Uíæ§Ý1è¼|ðõñÁ×ÛGµÂ2MQÓPȇâ]fbO^@ݨ'WóÂÅ==;âya/2ï%X1sô(iÁ½èQ×W·r4êÙ“ŠÑ9•l´x7¤a+îÅÞ‡i¸ ryˆAÏ=E§`ÜÝÊÒ°gw*FàT²µOÆMÍ£5}ðð ¦Û‘±w?×Í€ÚjRÃC­ø»â-S.ƒœËû¸P¦ ý[âáêOƒîÝ©{ˆSÉÖb»üL\?Š©A/:UóÀÉ­2÷à!ç"÷žBݪ{ãê]ƒÎýšÞñûÂ#¤e¥A­Ó!“L£ ­GM:w©„³N&/úÕùvà‰¶•ðtóã¡î}iÊþh³ÝôÜÄk£:RÝÓ:÷&«ÕªX¿âC“Ü›u|pv-OËÞâsqg3”–ݨÃ:œ }_ª½¿ßÚnÂÉäÔëÃc¾—Ùž… +É'÷[£7½òÇÕÕŸú½žçÍ!upSçßO‹cb"ö®ù÷g>"ûiïxÞËúE¬ë¥Næúí×%{çôï×èpÒ«‹q. !JI†s•VÔ1Ÿbߥ$RSSIMM%!ü'Ui[Ùìð\öïó}SÕß /j´êEò‰?Ÿ†)é(«÷Øèôâ³ônT™²ÞþTmÔ±#ë‘´õ.î%?:œô6ÅþO¥¯DÏA58óÝ®K¡Õ ¶ù^ÿ™×ßæ‹Ã ^MåÂ9+õ;’r&CZç,µéT1™Ð+;mõÝúð¿“R<­RŒßp ¢E•,NœKÍ·¯w‹­,ûq«Q!_Yœùj &¾ÇÄwÞgÒœMDÂYþá<Ö]5(ÔŸ…õLEw™ìõ›F¢íæ…cs—xÏîXD©|”¶§RŽ·Æ>ZÿŽ<Þ&O7ôìGýôCˆ1ßuYÑÇù¾Ÿ‡U!?Ù\±;öPªÓJ妔fÁvÓ~ª‹y–dÊmÄ__»õ(òù\ôv'«Øi–d%â ‰„ßòî{X!ëóÆÎfú¢Å„4û‰9K~ãàŸáÄ[½¨Ö¨ ‘[Ø~Û{Œç™Óµ!snkl¢wÌcøŽyw^`;;n=óÅé'Xôüc,ºý‡§fÒ¥ï͵ˆÜ4A›¦ß‘žñÂgôìiÿßBQZÙ²ÎòÝ;9ä >j!úØF¬‹ÀàXƒNgØ”ftxW-Kù`Þ˜Ò-ßÚ×ø~Ò'DÚ[6uŠ”ÆGìL²“»… —Ö±(d FL¢Ÿ‡‰˜?·óå·Çîù½™¦k[øì'F žÀ/ gw±tñâ,€JO¥Ãx*æs¾0sn¦1Ÿ·VüÀ¼M2üMú»™‰;³‹¯–äm+j+_ýVžQcß¡¯%ž°]ß²à÷˜ÜG|uåé<äi4‹Ïðé…ßEs™R¤Ÿbùç~Œ2Ž™OkH¾°‡¯ïÎ]–U¼cW ü¯næó5ùÜ{ôq1pýðz–ìŒ#ôž…3âÙÉôTŲ‰?Ý‚ŠpíáFYMdáá5ìl8œwçö"ýú)~ßú—ú`Tóp–š!ûÊn®ÖÊý½1]?ª/C¸fº-ÈÊŸÞžÙ\mã¦wCoI'âà¾ÞŸ„ÅG!äŽÛÁ¢^Œxêm>ñ´¶/¿ Í­§JËLñüy¥ O¿ó<Ö¯âòX¾¿/‰QØîIŽgv£ýåý„gçÅDI‡øê[†x9ÞZR/ïçÇ%»ˆµúüu¬ðcb0Úϯ|Žø>r¬¯ ¶<‹¶~îE¯"Õõ»Ô×ü¿U¬KvÎi³…¼º;š¯f¬dsµ§ï8—dJBˆÒ>áHÕ6ÁXN}Qðâ‘1šC§¼Ü¦.ÇñåGžèÝ•1íËâ¡3‘vý,{¾þ‚ߢ̀™ó?Ïavb?ú?þ<ݽô˜Ó£9½eK¿NÑïy¸Õ_æ¼³ÈN›å@ŃhµŽÎgvégþhÿƒ›‡òÉÁ|ëOÛFÓ¼>ò|jN kq^"³KÎ^ËÆj6r抑GËžäbaï Ï—'Ë¢+%âÙ§5TRŒßm8”«G%K[n»e[1¶~À¬Jq«Ý|Ù #…¤ÕX•‰Ùj"=%-÷î|»}Þ]ÖÓaÜ…ý~3Ûh/¿w;6 ùýSa,r­xÛÛm7Þ¾Ä'‡ìoÏ ñGC¸^w ðÂxå?,ÞJ´\–¡¹·1…Ï›þ3”öÿ’ý±‡bVZv©(ã+IvËð ë*ï<,ÉËó>Œ/‹yu“Òù\¬vç.mDiíêkÖiPjoGSéËÓnèó ëüu‚ñPçpá(ëæ½ÇœñÈ'í„âÞéõRB-ÁµÉËLmõoÍ?M¶ˆº~WÚò=™íö…*3éªfŒ›ùu£×ðþì-DlEJWWéqÞÿ0Ö½ßóõ‘Šú̃ [îw$„B!„B!„Bq_”ˆ ‰šgùeoá¦B2èÝŒç&=EgÀÝg»O-Ø0¥Å—ŠÁ怫‡›GÞ"CÏE¢ñ*ƒ&=™l«g¯²ø{» Qš”B!„B!þÅtûòî_LÛÈ5óß·­Ø€'˜2$3¶c–ã „â¿¥d|ÔÚfņ }ÙZÔÒGr22+ ölÈð7GÒÜHÜÇü?q&«ðÙ›!¨è <›?Éè~MPEsôP ZÀ8Õì1µˆ;p˜ÌZ ¨¢OåÜ‘½l;M–L@!„B!„âo`N<ÌOkM¤X¥,„Bü÷hKJF4~xíkØõž=[–oŒ¦­7¸ŸÓ¿ç¨ÝÞÚŠ!5kù.¼2¼%þ9Qœø3•ŠíkãBî„j mjqæÀAö•iBë¶=Ñg|Ç/²å¡!„B!„⟦ò¤ÍëoÓîÀ‡|¸;ÊvÏ„ê¿1鳓¨kveØÀÔõבza7+–oàX’]…^L|ÒHȹšô}( uhzqSCb1£¥BŸ·綂Éß^ÄPèvuø5êÈÇ[RÕÃDlØV|BXšmùžLbaóé ëX _K,[Ìê° l*=­0²W#Êsý!glëÌŠé?qÙXø.j½›Ò¿O ÎF‘PV!mÔ¸¾¿hýh5p(·¬ˆ›5•s[¿cÑúsdÈÅ !„%œº¤dÄšzžÐó9€íƼˇS_⑲@Ò~>›µ†h'ÅÌZŒj*´i…™]·_·¬bÁOW Æ@ÚÑ6í=Äúe?sѪ¥jýœ¤!„B!„ÿ<[abñkR w5 ñ¢^c7.í¹@–{cF<Ó”” søßø™¬Œ­ÇÈQ­ñÍ{µ³.°Ý¥PhÚ*¼ìî/ •ÖO-™‘;Y0e[ã-R}„B”x%júÜfŠaûÂ1>ó?FV=Ï—3¿åP’½·µJiM5zw²3°Zñ0Çr-Ö„{õ²_Ùd³âìn$áj &÷vTvWa½–ŽAÞÛ(„B!„B”Öä0¥t¡y3‘ÞMð¼Â…l5ÞÞ®8?ÅÔݼà ‰#Ì1wBšOŠ1w6Àš~‘qýhVÕ•pï†8_XC¤Áþ5O=™q©ä­Ž-3žD“ žyi[2H3ÝÈ -ïµÏj\½Èü3ÜoSÛ0¥Æ“a½·K-…§­ÁÅîþjÈ8ñ \;Ócø$žtKæĶM¬Ùr‚lùH¶Bˆ®DLH¤jü pUq9Ùæö.z›ý*V[n'ìè‡*5¥y•£'Ö §In׊ÖC†átÎ@…†o‹1T¸7̳š‡0TmFÊÈÙÐkdK=B!„B!JK2'Ž¦Ó±Y-”ñàbÈe²mV²R²H ]Éä%gÉP;S¶¼iqfÌ}+ÂÍë¶4ÎM¡Oó4õpáüÚ+¹ëÊJVª— 8p3 rñÁ[—MhŽtyIºžg7´$atî>¸¨Sîy— MÛîþZqòóƶ‘y»ÖààL÷ç†ólÆ5¦oO@î¹BQ’•ˆ ‰5R7i5…,T)ö0ß,¼ŠQ15ꬳ¬ÛîGÏÖ5hÚ Kâ0×.Ÿ/)5ñG/ ­Õ”Žé\Ü»Ë9òAk!„B!„¢Ä0“pò9ûð˜ñ"‹Ã³°É'÷Û½7½Jæ×KPå‘!Œ¨ÊŒY±$Ý‘†•ä°ãdôíE÷œS,ˆÈQÜ^|èa’;÷¦G86E:Р÷£ø\\ËÙ ¸Ù[Ïȵ½Ç°½Ð‹‡/gwJ9ºô¬…³jÿ}(«ÂþñZãã|úùv¢Ô6l*°Z­ v§Zƒª¨/à|ªLM!„(yJÄ„DÂoy÷ÀýHÉDÂé­,;½õÖŸBÀš‘€Å+ïñÇøiß9òB!„B!D eŽ;ÉñÌn´¿¼Ÿð¼×X“ñÕ·> ð:s¼µ¤^ÞÏKvk¹ùCÁ4Os<¥'#r9çnÛÛÁ¢^Œxêm>ñ´¶/¿ %Õ¦|áÄù+‹6fä‹ïÓ;û"[·%¾9ïýýµ Þó#›« aÜônè-éD\Ã×û“°ê‚é<äi4‹Ïp>5G*’BˆGU³NƒRû€Àã­ϸB´×æ<_—˜_—ðýƒâï¿ûz)­½Ô!ÄŽ^ï … „B!J?ß|…Êk§ñe؃xY³ ½êy\áØù4,€cð>èÁ¬™Ûù§¾1íX½7Ým¿ñËE£Ô!„7 %£_P—æBÌÉ.Úl¿Úµ"UÝѨ‹’f6¨¤‚ !„B!„¥•ZçŠop{Ú»_dÏåõåH¸Ôå‰aQßSƒZ_ž–]j`Í€•Ju&$Ôj™ŒB!„B!„B!î³RÿN"•J…F£E£‘ƒ)„B!„B!„B”Tj)!„B!„B!„Bn0{V±ù`wÌ9¨]©Þu8/2™;±²¾Æ¯/?¬lÉ'=dz?ÓÎF\ÛñUÈ0Vv†ßdýû‰Œ°„p“T!„B!„B!„âA+5ÂøeÏŸv'®iÒ¶½/;ɹÛ3]ÛÈ̹â,R„B!„BˆÒFôS†¤±`Æbtuy僎ì~g>G³¤l„Bˆ’¬d|CÂfCñmLV¶üïrR»ñаٴÿ(aûV3gP5œo,×ÑçýïÙ{âgCCXþrsÊè+óÌÓhåшÖÌ¥gý^¼ùjü4*¼º-aÛ'ƒ5{5‡Nfßê© ¨îtÇ«£„B!„BQ2˜óÓÚÓ¤X¥,„BˆÒ¤~ÔZ…kãWXð¼/¿½Ö›¶ýgq¡ùTwÎ]æÙîM&69ÆÄÞh?â[Ô'08ðKÇLd_j(oô}•$k"(ûÈXšœJï‡û3ùp0oÏA ½T!„B!„âo¥õ§ûä錭ãh(Ûe"_~úM\U *Cû·f1¾…ÞMéߧ.ž:º¾0„ÚÎÕxfÒ(»©¥ …Bˆ¬öÔNÔéÿ0æµ±dÿ5¯béLjÏ{Ý“Z*½þž:RO­`t‘|sŬž ÓÕ•ÌZqœèĶ~6›mîÝx¬²ƒÔ!„B!„âïdN"윑ÀZ¾èTN{bS—§¶¿8•§^™$B/fÜú¾¤%–Ͼ%,ë"K§.æhº<2!„B”d¥pBB‹»Ÿ‰çâ0æýÅž7!a#iÛdÆ,J¥Ë‡k Ýÿ³žnŒÏ]¾”aŠ¿xsBC ’(ï¡•Ú!„B!„Bü­LÄœŠÄ¡Fe<ý¨ãŶP#AU=qò ¦\FçRäƒB!DiU '$L¤Ääà]ÃÏ08øVÆG—»;n0î]À³ÝZÓ¸ßlÂ;LaöãhRÔùTÅW—÷½?ÕØ{´Ó‘³êð¯¾õ »øýãq̯Ðp±çÇ‘|Üê>žsA®T6L{ƒ§§îÇí±1oC çÃõäž;ð’µé{6·ÅïÏTÁ¾u£Àf»*‡ˆˆˆˆˆˆÈ9çÉ`Û?úv¯Ê¶Ï`ÏÌç÷Mô¨Ç{ìx ÝÈJP€ùaÔm^ÓŽµlÍ -üÿzÏ„ˆˆÈ¿¥T H¤,ù’—–œJç$‹uŸàª‰>ûìÈÖ2þ«ÒF»øâîn|qø¯©”¼™ëøä÷xSõADDDDDDä_æ"iãrº×fK|—ƒÍ{ôˆYÇöìBœÉlÜIÿ äZßÖó'›Ùº£ —öÿŒ|±ˆˆÈ¿ÄhФ¹÷?|ø”ï9™7L¤ë]“¥ú "B@€M… """""""r±ÛKǤ‡&}"""""""""""r¶ýÇŸ‘é ‘ó‹ž‘ÿ HˆˆˆˆˆˆˆˆˆˆˆÈY§ 9ë4 !"""""""""""g¥,gÞd2Ñä‚fT¯QƒÀ  óæKÉÏËc÷®]l\·¯× †¡š*""""""""""eZ™hÜôê7lxÞ})AA4hÔ¯×Ãú5k0L& JˆˆˆˆˆˆˆˆˆˆHV¦§lªQ³ÖyýåÔ¬U—Û…ÇãVM‘2­T÷Ò·]-Â-N2÷ÿÃ’¹KX“AïfÌM9¸x1i [S?(…•¿Î`[µË¹¦u,q,˜ùËwïa’ª…ì?>_£""""""""""r~*5/µ6WêÌcÃfÈ‹ÏrgëHla¹õÉ{éPH]Ì{£¾feºÇçaXÌÙ,úüG¶¸ Œƒ+ønúVrOZÏ‹'7KÝëyäÆD¥m`öÜmX]Jß+Pîpi&3±]:P-oÛÓlTlÔ‘®õ+S£Ãîê\뾕̞» {•¦ô¸¼>a¶«réîÛNJ@ múÞEÿ vþ“Œ)².]:T…ô,¬¾öo¨BŠˆˆˆˆˆˆˆˆˆÈù©Ô Hx2¶²jk>EÇû^âÕW¦[ pp1ã^ŸJBHP™u‘™”LŽpd’œ–_è{"¼n+u:· ؽo>üœï'ͤUù˜«7£nè±=¤/û…¯¦LæÃ/–‘ƒ™òƒpîË—“>æÝ/g³fg. 8ŒÀ ) ~á«o¾àëµ Ò™?e2“>ûžy` Åê¶RÛÇþë„jDBDDDDDDDDDDÎO–Ò’¯}³Þ} ÇýO2à¢B´%Œ{õ+Ö”ïÃЮ«õñòOs?†9ðp&s]¾ö.½‡^Ó`BÌà8´^~V>ÀãÌʼnon É5¸êö›m%79ÜBÞgaÏqÚÎíä8¼àõâ><“Ù@9_û6C–KµRDDDDDDDDDDÎ;–Ò”¯3‘¿>xÇ ÇXg+þ’eÝT°`:#˜‚¬äæ¸ðº÷1ý‹ilHÊÁ\¥)ÍkØØ—æo0ÀJíž×Ð2*éo¾ÍÔ]è7ü1ºžÒ3&&"|î?!í)""""""""""ç¥R1 ‘aŽ&6Ô .Í ®ŽŽÅ†ÀLxÕJyxÎÄÎlaä®ÛDn“ huachß­9•Ó–òÉR/X ÛÈÀRЯ7‚¦{Ò¹—†y!ûÔvo Ž ËÇþ'¬×K­EDDDDDDDDDäüT*$¦NKgðÐ×é[ÈHà<°œIì=2›RáL!ÄÔ©J¸ÅŒÀhjFGa3ÝE͇ÿ oêJ~ZTŽ­»sC›´]+™üÇ*RªP«j$Ö#/©Œ¦ftEl&pšÉÛ°œ­µ/¥qËVoÛĦìš…ÅP¥bu²*„c1˜®\jV 0]·2VÃfŸûOÖ""""""""""rž24i^f–Cß~çýôÕç0[,Ølª­""""""""""RfYT""RlF»ŸJßaʾ#ïÝ1Rçr ìA‹hû—ÿÂø‰óØ“ï=º<ªÓ]ôLü†™½Ô» õ£ÉÙ³Œ)¾en¼¯ßô‹›FQùð‘¾)œæ×ßIÿËR1ÀMæîåüï³o˜ïÀ{Jå`¡RÛý_Qi7/¦ t{a$·U/ðYÜ$µˆt¯•J­nàî>—P?ÜÎÞÕÓùô‹¹ìÊ;!†ŸõJ¼,š]ûsW¯–T s“·”)Ÿ}ϼýÿß±QÌ<ûa«Õ—‘wfòæˆ$¸Šþ\ä¿ãHû9‰/ÿÉkuú|ŽžÁ+óä§lÈ;Ü‚ÅöfÄÆ›ÂngÁíizÿ«~úü¦ò´0˜-óøáűÌó6£Ï éÜ°î}Ëøþïø;Áé¿Lðµl)Wø;nw±b‘㯥%-‡"®Á'”Ã_.æ'ÖWsdóÂËÈO¿ÆgÌç7–:ÅX­Xu¡„Ûûø,“£åê`Þ’`zt®tj瀿zç±”¬þœ8®ä秿س÷ÎZ£ì§–4Ž/ íáV¦$òóò Æñj_q7÷ÝݑͯüI’Ç÷qûËKn1ûŒ®”¥|;ÙIº§xŸ‹üwÚïCíçªeù‡É‹i´Ý®†tª̆ ¹E$à`ïêxŒëRѺ§A`T3À|Q=Êý™BºÇDx­z„XÌÎÜS ô¼@Þ·ÒiÅÛÌö7©5–+]Cõàͧ\ž´Uüð£AŠ%Eήtþû*ßírb˜ƒ‰¹ð*p½·¾Ä·‰€;ƒ¿ÇŽâ»ã:`œù.0¨}Ýc<×ÕÁ_ß~Â×ÿ$‘\•Ö½úñèÓå3ü¶¸‘¦~ÄéÇ þú­–Xß}ÇœF¾ûÅÉsßæñV϶9º3ƒo63?ÞqÖÇoŸßM«¦.¦{“¿²ªÑçÅþÔ\ü /|’A•ËïæžA—°yÔ\’ü” 6_ËÜdù9nST§¢c‘S½–EÄh>¯ÙÊ!ÕÏÉc«Á ù(#›ù‹=­~b©´ ÅŒÕÎT%Œ}¬~Êäh¹Žavvü~Šç€ŸzW¬X¶ús&⸒²ø‰=“Š¸GqùéKÇÿÅöðl}eùš·{×N4j|Þ^ÓãvlÇÀÀ04*!"ÿ¶@bêÖ#Ö–C†3äø%5;Ð4o¯ÏßEªfM^Ãåw·¥Úqìp‚)¼Mó×0¹Rª$þθ¥ûÈôºÓÙÙå*êG˜Ø•â;}(^*úɇËWúÎóøäƒÖÇgc¶’›çÄž“‹Ó8|§¬˜åTã"?ÇD›§Çp{âXŸ˜T²¼r,ÉT HgÖ®$åY¯Òª ›¿ç× )ä’ÂÜ)sù“—R+`S_ÍYˆö¹ÞV2J´lÿ¸íä;œ8òóɳ›±;\8óóp{ý•¿¼lòÿK¿‚©Dµåæ3ysÓ>ò<…î¬Ü›áwY™¿³=/­%~'ï§åÍ×Ò6ÖDüÜÏy㫵¤@ÕŽ·pïu­ˆ5âY0}#Õ;‡ðå°oÙ[íVFõOaÌ+39à[cŒ½Žá·ÛùmK#nl±›w†M&Îy,(‰i{÷ÜÔž:¡¹Ä-ù‰¿^Ì~§…J­nàÞ~—R7ÜIâ†ÙLúü76fx°Ä3¿^µPâÛ‘ösb€j—4ÇX:‰oœýy¨Sm‚7n80šBitÝ£<Ò¹!åqÌúô¾ßEvÜ:’˵¡N9ƒ]©6ª]T•”¹sp·jI %¬Ì ¤êÈزìØëUà<÷©“ýÝüº®&×]Þ„Šî8f}ò!ßoÈÀ›»_×DrCÿÖ¬~g =…‡,±Ýn¥cö:RíÖã/¨:=¼‰-*áÚ¿’©Ÿ~Åœ=ùLÆTþ"úÜdaüƽ˜Z<ÆðÖ«˜íî@¯VѸ÷®`ò„oø;ÞŽ×ð}îïp¨.‰”œy¹äæ:\v,ùƒyWµæÂjÁ˜Ü–ŸÐ&Fµ¥÷@fyowùåïA¦œŠç®^4Š¶±e—ýôúF5»ÜÌ kZR=Ô 7~ßô%sœà·1Q®ñ•ÜukWšÅXIß:—¯>ý‰©'Œ¦š‚©Óí6îºúBbHdå_[0Ž6Š…ï;¹W¹“&!A4q?Œ˜Hr«~…çñ Ç †­¼~+˜|öý÷‹Ýyé¤ùY¾9Š.·5dë×cÙzÆ~•]‚>…JÔºõnÚ„‡pѳàù>“væE¼=ë’œ<õm^Ž±‘YD™ø[†Ÿãnì'Iöø¹–ú«wEÄh…]ƒãCéôбrÈùû[ö/´¾Ôè賌|õÓ|Æž»Øë§ÎøÕR|Ÿ³þÊÀT‚íüÇ>Û«ù(S] –ë+ï3?Ù[ø9à£ìüÔ­%©?g&Ž+1?±gQ÷(Îÿm—ïóÛ_¿™mÿj{x–b”²Ü Ù¸n[6m<ô$Áy$?/ÍÖ³zå Lf3&“ ‘•7‹Ó¿a—ÓÙ˜é>î2[ KJɇ/ìΔ¤…T%*Ð8´¼AS«w“²qÏ¿³„4ï¡ upl}*:“HÈñøIŸb¦ÿ|øLß‹#ùÖîÈ$ð¢!|üÞ(žº,)߬9ô ¥b—äù=>;;~™ÀÀYÒ¼HÃ[.†r–òt<œwÞz…á^MóÈC¿10[LxÝÞc7ã\N¼QD‡?¸í{=s —¸çðÉô}v4¿?Š§®ÈæÇ KM¹â§ìŠ›ç3ÁV½õâ¾àÙÇß`¦©3ÞßõãžçáÑs0Ú÷¢U¤­ú•<|C$KÇ=Ïà—&«]wjóUNÖêÝèU~%Ÿ|ôŸæ¶TéÎà[ª²îãüÒ—l¨Ö‡»EÝ…‡î¨ÇöIÃypÈL˹”\D¸©øùñ×Õ?Ò~æT£c37ËæogÇâ•äÕ¿”úAÇêµRkÚÚ§3lÈSŒþËBçZe÷Á­lÌŠ¢YlX+qa]7ë-aYF5ZW k%šÆº‰[ç çÁ~'تu¦³çw^yâF϶ҥO[¢ÌGš¾|¶ýü ««ÞÈ­-ÊœXb:sg‡d¾›¼™lïñA_HÝË©µe"Ï=>ŒÏ6W¡ïƒWQÃæ?P,ÑÕ4Úù5CÁgÿTãÖû¯ ª•Ó:÷Eä_lçê´¢U; )vóxfc0ûé·úî;·n"ìÂëèážÉO›s9c·ßJÒçÏLâ¯qŸ°,}'Ÿÿ€ÕA±e9hvûSŒ;Š—ìFå¼ ò=þËÄß2Çí7ñs-õ[ïüÆh>®Á–”åð>+¢®óQ_ Bc«ù,£ÂûΕ‰ðóá·Îø+ç¬ßº]Òí|Æ>ßeâ*X®ã˜Ðë³.øŠ;l~êVIëϹŒãNä»ý(êÅY½qâ·šKÇóﶇgI™~BÂëõ²~ÍV¯\ÇíÆë=~"h&³‹Ù‚¡ )ÅA 5È‚3ïXèqä`ÇF0…Р™›ÕßåâÉ÷’š˜¨|QoîØšøo_csQ³…+ ÑþòQ ¹«ÞdÐQ4»n0ä®ÞÈÁ¶áèÞzr6ñý×Ûuëu4Ùò%Û‹V¢ézG'R'¿ÎÚìô>á‰ðÝß;IuAêO“Y}qÚUù…8Ÿó/¸“çòÝœ‡¶ùy2«/¾…v•g³òtÎ}9wÌ‘túÝ ô%öÎþ˜ïÿÉ`:q9x2–1æÙ‰¤–ìTßcÃs/»ŽÖCéì›>š—þ·g‰ûf<ÉKxû¥EdÌÅI^Ž[EflTöÙΔoÞ…:{¦2~e"Y^X>õty9 Ãæ’ttÎ(5;5ǽð}~Û”‚ƒ~ûa1>tœi¾ö}B¿µ˜ë‘KQï~kjlÑ}G¿}tkeº]S™•ŸqΞõÛçÆèi~ó[’ã+^^f²?ãXJŽ?òâÐc[øf m_»‚æ‘2#îÞû©?w?ò7šRXó÷ ìÕÈ´´ûY¯dËÌTîÜ’°Íßðû– ÀÚéÓØýêU4/?‡ß“}—„½˜y>#5Ö™‡Ó àÅãñàÈuîÞyñxL„F’½>óðm~/Îô$²ÝVŸß[ÁË´'+‰4‡÷¤îVhT9qÇÒÌß·šûlÔm@Nb:G6ñä$“â ¦üỵEçW¤¸íg µ;4§Bå`†½ß/«W§ú„¬]M>àÎN!ãHPãñr¬kí`ïêý„\Q›Ø½R>~{íNœ«ã°ÝÒ˜ª[k•ºžÙ?ù<81Ý“[/™k~ä»NC¹óÚEŒ\ô®#•:õ§[æO¼²: Od!a}FéGÒv$>ÓBÕ ÿ?æq¥ï#Ý]`›,UC,§xî‹ÈÙc&8"kn:ŽBúîL{‹©{]àu“Ÿ•N¦½ÀzžË´2ž|2^‚Òó1ÊU"Ô 9np%Ïç­¡«°&*÷xˆþã4ûàõÚ¨yY?zµˆÆ–“J¢=øð«!ýõ1Ì„T%¸ñŒ~÷Ö£ëÛÌIl4ÁÑ–ÓLpy ›ÓþÁ™ž@†«Nû>¡Õ-æzg‚ï~ëßljã«ï8—ùÖêEô‹ ‚ë÷ ƒk>¯íužÓZœ>¿ÛéÁµg“þØDªâ'ÿDÇÑ=¹0òOføëËûY–äö{Ü…çËßµ´¸õÎÇõ´Èk°¿úêõSF ØShßÙD¥*¾b¾¢c)Ÿß[ χ’žG¾cßz³?óä8ääºà+îð_·N½þœÛ8îÄøª²ŸöcU‰î œ‘Þ·ÿzX¢8BªÔ.µíaÉ¿Á²hf³³9çÊÄß2ÿÇí;_þ®¥£˜Q¬zçëzZÔ5Ø_}uû)#_}çmÌöó™üÖßåSÒó¡äç‘ïØÇå§L éKZ|•Ývæí‹¥ºU²úó _Çÿ{qœïö£¤÷Îm~ÏoßõÂDÅž¥³=<š HDDNK~ÜB6_Â5­*K‡^Íq¯^J¼+ˆ:-¬¬Ýša\Mc.ßÎMÀY‘J+R)*œ@W"£øiø̇߸H\³S«Þt«IHx5Ú_Ûò[ç³5ûT:+EŸ… [ÒªV¨Ÿ oQy9’FFH ú?p;ÝÇP®\eZö¾ššû²&̓©bGþ W6Š"¼bc®îwYó*S9ê·jIÓßõJ¶ÌEâòed4¾žkšU",¬ ­¯íMý‹Y“æ¿Wä7Ï%êÝ;ÎSç`Ïü•x.¾–nu ®Ð+¯m‘WÑyò³pWhFó¡„×£g¯ºz‹Ê‡›ø…+pµ¼–îõ#.W›îý¯¡E°“ÄKHkt×4«Hph,ío¸ŠŠÛæ±9K?ÈéÞ1)Ø~„Ôé@S×:lK%==ƒôô ’·/f½†¸ne“½6]ä±úpåÍÛŲÄ.½(„=ëpºï}v'Ïçó:]Û€CSç³qüó<öäPž|æžzíöÙw0aÄX¦ìv^¬1ÝèÛ©åÃb¸èÚ›h‘µ˜E .¿í€µRWúu®Eù°hZ\s#å­`Ñþ¿ç¾ˆœCîlâÝT½¤ÕéݾÕñìÉ.î]3Ö `‚ƒÿ`6p'/⛿\ôxân½´!Õ+F]óBzÝs—…ºpŸvæ LV+ØsÈqx±D4¤GÏZY0þú®™ÏF×sÝEÑ„…FÓüº‡yaÀ„׌ÙÙ=o-¦KûpUã(¢Ò³ÏÅjêüíûHö¬ÛÌþ×;­~T!7 }ö[í~úŽö¢ûè5i_7›U[28w÷ߊÓäï˜Ï?zÒï’êD„ÆÐòê«©•¸„µÝ~ÊÄß2Ÿãö—/×R{1ë]¡ß¬ïkp~µïúꯌò}ô=äúŒùüÅR†Ÿò)ÆysÊç:%Ž}|—I!µ¼ÐºàôQv.Ü>ë%¬?Î3Ç›ÿسd÷ÎP¾ü´]ÞÅñ®RÚž """§dälb⻳¹gàs|8ÐÍþ•?óæ”8ì i¸‰Ÿ3<€•¨z±„Ä6æ¹Q½ l½—‰ObNª›¯5N! ù("ÿùÛþǸé·póÝÃéá$aýŸŒû|å)λhöŸ·ƒÔ¹f·'Že}\¶Ï<ùÍ‹q,Ç'MbÌ/·pç]C¹¹œ‹ÿbüóHrûf1~z,<ü 7¹“Ø0çsÆÎH8ôÈ®­*=ÀüÁFÞÚèg½}%\¶woO âîÛ_àýò’7Íeü‡Ê—¿n›¿4K¢ÀqŽË9õÍíqÓxÿ§Û¸wÈ«Ü¿•Y³–‘ÔÅ‰Û ®„ùü¸¬Ÿƒk“7ñǯ³ÙÓ¹è|¼µñ7Þùñfîyp7†ä¿ô'>œs»cïU{îx‰#\$m˜Ã¸ÏVîU'MNSÁöÓ¦^§F¸×½| æØÏ’õžèØ°ŠHÏy€µ;ìt¯»™©‡ÏNO[W&@]«ö䟑 nß_2£ýsô:|³Ã™vôý;&#—ÇAfZ¹.ƒ0Ü$/ÿøf}K$öÝK˜ôÁ‡æÒ šN'|¼müŒ\–Í–_cxÂÜÒó.†ÝDnÂvVÎœÀÈ…W2¸þéfÞCêÒÉüÕr#?¸ŽÌ½Ï—*T IDATëø}Ö,¶ßr ÷·ß΋}·3žÔÅŒÿ,Š»nyŽ÷£,dìXÈWýE¢ûÄþâTÞýù6î¾½,Ÿþ ëËÕ,zßK°nW$F>Èø—§ðWË…¯·²òÑösKúé¶í^²×ûé·úë;ÑG·U¹Ú®]üžæ>‡•³ˆ>~§'k-Ÿ¾W‰{î|”·XHûgŸ~8—n/ø,ËüwùJõu-ŠYïNæçl)N}õWFÀžÂûÎ.{’ï˜Ïg1SÛOùÌõwÞ,ô5eoçÛBßSýú}ü•É OOû:…–]éN_uËùø­?g:Ž;íGNÉî œ ¾cú"Îo?eé*•íáé14i®.¶ˆˆˆÈ¡®1Ðq¼òòŸE®ˆHéc‰í͈,Œö?¶xœ×;Ìâñ±ëÈÕ¹/"êc*°þõ\Ít~Üj××&""g¾^2aŽhH·ží¨i;é0†'Ÿ¤Íó™þ÷N4{ˆˆˆœ]^¹€¾ƒZàù«ób¸¤gCìg’¦’"e [xy‚H+â}6:÷ED} ,Ñ´j˜ÌÒ™}e""rV”Š'$®~a8± ~àÏݹ'¿òÎJ½+n¢ÅÆw=7`«÷ ÿ{ËÆS7¼Å¦31`Ú‘ÏfÞÁ÷Wbf†*…ˆˆÈ»wJ£k2èòúD9ì[õ+¾^Àž|ý2B¤¬±ÕêË«Ï´&ù—wxkz<¶6¾žÐ¹/"êcˆˆˆœ ¥â ‰¶MüoÁFvúx¹H¼¹:UÄ67•|}g"""r6y³Ùüó»<ñ³ŠB¤¬sÄ}Ïã÷~ôoû²7¸™Î}QCDDäßb*e/~àñâ=q.'SmgÎòÕlš?‰§/‰Ä `P½Ç3|;g)[ÖÏç÷ï£}”ùÐ65¸vÄ×,\»š-«f2ñ‘¶DÔbÐG#i~c¦¾Å‘&Õ ‘3¬ÌÞ}·UïÉ•¹ã¹©S7îøÖJŸ!=¨bk~¼=¬%kGÜÈÅòQæu¼5¢Q&ƒˆŽOó|«Õ<ß»+îüSßg¸¹j<î{žE«xòº!Ì<èQ­9ÃÊ쀄7}ïMZEjn*kg/"ÑI°ÙJµî׳ô>ø{/é·1í ìkÙ‡¶&Œ€òDGXÉXÿ-÷^5I{\ª"""""""""""gY™p¥Ç“rä^/€™r1AdÆ%qäPìw„jâàœ¸o|Ý_ý‰U‹äõþ-‰²¨ˆˆˆˆˆˆˆˆˆˆˆœme÷ ‰Bß:á&ë@åjU"ðð'ærU©bË&9ÇCXµX ß㮞—Ðòú±ìì<Œ±7ÄbV=9«JÅ€D†9šØPÃÇR3áU+adäQôÛœì™õ+ImæþŽU)W¾× ¹›ª«~dIš‰ ]†òù[·ÓªR–C/Êv»§j  \ ^h-""""""""""r6”Š ‹¦NKgðÐ×é[Ø£ 8,gÒ{q#-ç®oxäåÊŒ6…e•œìYø CžŸE²ÇMê#ù¸Õ+|<ç>‚\©l˜öOOÝÛccÞ††OGNùM/¶9£ŒMš{U """""""""""r6é•Î"""""""R:]ȳc{³fØHfdÔá¾±Ñ.è„uœkóÄTj=û|†Ñ›«ù^ïÑØ_Ô>›ñÔèËùëÙ±,Ï93‡aŠ¸„¡/4fÊóŸ°1ÿßOGDDäߢ )Üü=vßírýÈðºÉsFP«8ëé&¾ˆˆÈ¿J"""""""RF¸qæå’›ë<þcK1×+ÈÍ¥·¤ï%5(çIgóÌ/7-Cî¤IH FÜ#&’ܪƒ®iIõPƒÜø|ÿÑ—ÌMpb‰íÍðn~]W“ë.oBEw³>ùï7dá1S§ÛmÜuõ…ÄÈÊ¿¶`Þ¯)ˆš]n.4Mkõë~»ß¶4âÆ»ygÄo˜:ùHGDD¤ 2©DDDDDDDä¿Å ´Y_nm° /<É£¯ÿ‰©ËÍt­˜Âoo}ÎÆœm|ô⇬ hÏ k+²|ü0ò2vÔåÆÞu8œŠ­Zg:{~ç•'žaôl+]ú´%ÊlTïzîÎÒ_ä‘á?°¯aGªÚÆu‰ß4­Õ»Ñ«üJ>ùèORkùNGDD¤,Ò"""""""R6˜"é6ô=ºý Ÿã_`̪b®·, ïáO  kåC,lŠ›ÃØç–`ÎsƒõX2ž´%¼ýÒ"2æâ ˆ$/lj­¢ 3à¼yÛ™þçv2ó!wõF¶ 'Èd£B§æ¸¾Ïo›RpÂo?,¦óÃÁE¦é°oçûoþfcŽF÷øNGDD¤,Ò€„ˆˆˆˆˆˆˆ”f‚#±榓áðœ¼Ø“É¢qo1u¯ëÈ82³ñ\ÌõŽð’µú Þ íÉ5wçö°ƒ¬þó~üm5¹’ñzmÔ¼¬½ZDcËI%ÑLÁ“ÜÙ)dÝ…÷Ѐf‚Ë[È؜ΑEÎô2\uŠ•¦'+‰4‡·ÈtDDDÊ" HˆˆˆˆˆˆˆHé`‰¢ë“Ci>íY^Y’ –,†¯÷ÈP‚‹Ü´’’‹z‡„õŽ2\1 熟xcîØ¢qÍCwsÖ^†-<²ŽA…öw1¨ÉÞ|u<Û³Ý_ô8ot9–Š·ÀÇ1n²:¯…t€5<†pK1ÓôIÕ_:"""eôR_–3o2™hrA3ª×¨A`PÐyýEåçå±{×.6®[{¨#fè-V""""""ržqgŸè¦×%­¨¾q5–ö¨æˆgJ¶ç ïÈ \‹[yºõjÞ|÷Oö™½x p{ïÇ°l3c²ZÁžCŽÃ‹%¢!=zÖ"È€ÙoHng÷¼µ˜îÃUk?ãϤ(ºö¹˜ÓzÀ𛦳Ø鈈ˆ”Meú¥Ö›^@ý† ÏûÁ€À  4jDã .ÀãñøuˆˆˆˆˆˆˆÈy›ú¯'2ÏÖ“—ÞÍ3]ÝÌúx [òÎôŽÜ$ýý5¿f\ÌãcßfÜËhºëG>YŠÇy€u»"0òAêlšÂ_ž«ùÁ›¼ñH{rçÌb{ì-Üß¾¼ß*ùÛ¦òîÏ´¹ï ëKìš_XŸå<¤.\ì4}§#""R6 š4/³W²«®¹–À ÀÿÔ–Ÿ—ÇÔÉ?`6›1›õœ¦ˆˆˆˆˆˆˆˆˆˆ” ¥âŽ¶%¢!Ý®lGÝò6NzêÑ‘Á†ß¦2?-ˆ GY®cã'#¼ùصû ¦Šu¨yB:î,â·Ç“RÚUC1øw óíwŸ%UDÞƒ‚ð¸Ý†Ù¬ ,""""""""""eC©è9¸±óà÷%y'¿Êp‘e´aðè[iš0•cg±Û^øCÖš70â©.x~Íç+Òq\Üœ'^D½=Óywʆãÿþi7öæÝï>Kªˆ¼yñjÊ&)SJÅ€DÛþ·p;…d°Bîz+̓rõT€×ƒó`ÛÿIÂC•JdîŽ'Ï^7®¼lR þoÇ•½‡íûr°•Äœ•FžÇJpù¢+„ñ¢*ûŒÇjxq礒”t‡ÃLXT Qå0y]ä¤ì'9=§Ç„%°*GSÎê$õ„¼:ì ±)cJÇK¼¼Ä4¢QÀnÖíÎÁ˜"Z0àé´-¤.âÝ×~ds®ÿ»ñ^¯S…¶ xº -«™IÞ°©sÙm¨k˜17êÇó÷„±¸Ò‡þnxö:À ;òê}HZ²œœFÍ©Á?+2gMEì²}.â—ÙËØ[£<ÜçRV ‘ÇšeËY¼v=‰fš]ÿ7_R‡òV;i»7±hþ2Ö;›rÙ€Góv¿û|ðGNÕU)ÃL¥%#æJyløà yñYîl‰-¬1·>y/*©‹yoÔ׬L÷™Ža˜ˆ¾´µqlK$¦YºÕt²à‹iìH\À”ÅÛù«Àß?Î;|Ãßd¦ê¥ðl[Ê¢ý¡4ìЋžuƒŠ|7ÄÉûìLÇ ¹8¢.ᡇzÒ,2—-«V²ƒZ´»òj:ÇZ jÔ‡»ºÔ!hÿ,ÃYã"®¹º%Ѷìãò:yI .ÕS)ã,¥%#žŒ­¬ÚšOÃÆQt¼ï%g \̸ק’„)=›"‡$ ƒìµÓøò×UćÁk5'¢œ‰¬©äžütR2óH?îoÞò`™+g2}ánRw=¼?õ›Å´m;¹§ºÏ° bZv¤¦ÉÁæߦ1cçAü–Àc/ô¦ù¥-˜¿:›×CVn »WndÙ–mÔr“çu‘Q0oYNÍÐ$""""""""""e^©yBÂkßǬw_㋵9ÀáÁˆ´%Œ{õ+Ö„_ŽWUÅVÌ´ò3óñgþ¡—LÅ̃×KVrn·üìds L!a˜N}Ÿ&‹…à¨` ‹Ät'Wyéñ$9Á€k÷<~[Ÿ€Ñørúß7˜!·u¢I¤Yƒ""""""""""r^2•¦Ìx‰üõÁ«|¼, WêR>xõK–tc˜,˜ŒÓKÛðzñº='ý}tÀë!¸œƒ”½‰8êQ«œ'7 »§û ÕšƒÇH¸‘Fb|2îðT 0p¥ï'ÍCüª¼;r ¯òK’è×þRš–3Ÿ”W‘²®TLÙ”aŽ&6Ô .Í ®ŽŽÅ†ÀLxÕJy”øö¼DD˜—ǃU—&Õžeýû‚êkÙ›˜ ʵ¹™»Ìb¯Ó††ƒ-«âÉ+É>Í¡Xö­f÷ šÝ؇«$R¾õ¥Ä¹¬Úà¤r˹§K‰k°"ÑFdˆÃC¦+€ˆ°cyk›Êš}¹hhBDDDDDDDDDDʲR1 1uZ:ƒ‡¾N_s! pXΤöâð“†M͘(l&°¦à*Ôª‰ÕfBÊ{Ùº-‡FMÓºîFÖíÏ9úw›³™µ L$¯Ü†¥Qkêf±}áfÆåûœFÉï>109vóÛ/+éѹ—t¯‹+3U¿Ïå¯ý\ɳ™Ó…Í.£wKpdƳô·¿Ø–g&¤¼ùø¼j@BDDDDDDDDDDÊ8£A“æeöµ7ôíwFÒñdï!¡üm¼ù@Sû”¯·Ùðæ%²g_&îBJȈ$¶Z6ãÜ÷WŸOÀl±`³¨‹ˆˆˆˆˆˆˆˆˆH™`QøfÅP·Cîè]ŸÐB\WóÝ䕤¸UV"""""""g6( Ãc÷Sé»1LÙç*d!u.gÐÀ´ˆö°ù/ŒŸ8=ùÞSHCDDDÎ¥2= ‘Ÿ—O`Pài§c ­Níªå0òŠogÂ<>ýh^):æ¼Ãoä9V*ÔoNë6]¹¡q03}­ÜÛîŽåçwxb•ö÷<È£×ïá™oâp3 9·Le9ó»wíü‰ÉBNò5E“ˆˆH©Uæ7`f³³Y_¦ˆˆˆˆˆˆÈƒ‡¬ýI¸ºÔ$Ò²–X£j‘O²Ý«â)¥4ˆˆˆˆˆ” ¦rÔoÕ’†&òã²1ø®iU‘ÀàX:ôjŽ{õRâõ„„ˆˆHé½”«DDDDDDD¤L°U¥ÇÀô¬jÛ³‰‰ïÎÆvõs|øöºäüÌ›Sâ°«”DDDJ-£A“æz–QDDDDDDDDDDDΪRñ sDCºõlG½H'¾ªÙðä“´y>ÓÿÞI–†NDDDDDDDDDDDʤR1eÓ•ƒo¦Vâ2~Ÿ1‹ßNø7ýU¤7ÀC*ͬ­Þƒüúë’XhG>[8+ÂOøÿ¹`ŽæÊ‘“Y¾ôsúVÑ[¶EDDDDDDDDDDŽ(OH4°mâ 6²ÓÇ‹§âÍ-èЩ"¶¹©ä—æÒ ¨A÷K¼wÃÝ|¿ß­Ú%""""""""""rXéx©µ×‹ßÙ˜<^¼'ÎådŠ íàñÌY¾šMó'ñô%‘˜­µôÑHÚ‡_Ę_â‡FúÿÔ·éwëæ¼Ý»ÇNfÙºå,šü }ê4EÔ‰>¯ßÞ͵Màï_§i€™ ßËø_ç³yÃ2þþâq.¯ls,}ß}Qxò«w¸>ÆVøz§’f¡ëªÒŠˆˆˆˆˆˆˆˆˆHÙc*«·UïÉ•¹ã¹©S7îøÖJŸ!=¨â‰cÂ}ϳ(cOöº–>}ž;ôÿë†0ó AL·ûi³îzw¹‰–7ä¹·î¤~1nð4º{*ÍâÙÇ'±3¼£ßèÅ÷n§}‡¾¼×™ÑoÞDucß?ò¿'­å…ó³çòÂ׳œBš…¬»Ý¡J+""""""""""eO™ð¦/à½I«HÍMeíìE$Ú" öûÚçÞïyýÛ5$¤îbö¸±Ì)ד«kÙŠÞYîjÞxõý“Jxç›i¶å]ÞšGZZ¿¿ûk«÷ u¤é¸b­TÔz§’æÑu“É׋½EDDDDDDDDD¤ ²”ÕŒ»ÒãI9òÎ ¯×(rgòv’lcOd[ZõÂ-€ÿÇÜi»9fflW‰ ÜÅ#˜¹pèá¥f­{Xl†œcÅêw½SIó¸uEDDDDDDDDDDʦ2; QÄ[' eªCE+¤;€€hêFäs ËUô¾Ž¾ãÂMVR&É3GÒóñÅd˜Ã©]¿<){œtd‹"Ö« i·®ˆˆˆˆˆˆˆˆˆˆHÙT*¦lÊ0Gêë 3áU+adäá)öQP.ÐtÒÿªßÊS}. :²—=ð8]³g2mÇ©¼”ÁMâÜ)ìjó(ƒ»Ö$²|M:þ€o‡w丛Š½Þ©®+""""""""""R6•Š'$¦NKgðÐ×é[Ø; pXΤöR¬¡Çæmˆaø´qä\3æèÿmïdmúžÍíGñû3U°oÁ¨G'°Ù~jyuïÿ…§^¨Ê«Ï~âX+)kbäß±Ëo½€SH3@uTDαœ¬L‚ˆˆˆˆˆˆˆÈy$$¬\©È‡Ñ IóÿÀl@å{N`æ éz×ßd©þ‰ˆø`S!ˆˆˆˆˆˆˆˆœGìvG©È‡å¿þEÔíÇÐ[QÈôHÞŒå¼;ò;¶ÛUaEDDDDDDDDDDNÇ~@¾ý;^òj‚ˆˆˆˆˆˆˆˆˆˆÈYô™²IDDŠKS6‰ˆˆˆˆˆˆˆœ_JË”M&}"""""""""""r¶i@BDDDDDDDDDDDÎ: HˆˆˆˆˆˆˆˆˆˆˆÈY§ 9ë4 !"""""""""""g$DDDDDDDDDDD䬳¨DD¤ØŒp.|7Q“ßæçý®Ãš©}·ßv9Vò’°r:Ÿ}½€½vïÑå.@÷?ðgDOu+¿‚Ÿ&þÀü}¼X¨Øú:ËŠ›FQùð‘S9.¸æ6nîÔ€¨7Y{WòóĘ¿ÿȾÏT9œÌ{Ï ©ÃÏ/|Àº¼C—eÿåpdW‘\öô0úU+ðÙî¯yrÌR2¼V*]Ô›×·£n9;ñkg2ñ«yìÎ?!†ŸõJº¬ˆ²4—oÆõw\K‡úðì_ÁäO¿cA¢Œ@jtîÇ=[P5ÔMÆîüa›Ž}™ßë ñ±lãB|—þÊ®äçMqÚÀ“¶ó[¶‘%8†v{Æw¹ìpúŽÏöùí÷|;õØü\µ‡EƉEÄ'§Y:ŽõT•Š sDCºõlG½HƉõË“OÒæùLÿ{'Y¥»,EDÎã(ÐJdÝf\Ôª3×5 æ‚‹‚pó}Ý°Lÿ€ç6X¹øÎ{x°÷^üa7ŽÃÔ† ³Y·«w=Є„oßáã ªwĽ÷^Éî—box;ðe»ÅKcÕO>üä?¸á ÜÙ6‹Éo<Çê¬0_u/û·fØ…ôžÁr8é \…Ëo¿ŠjAÿë›GQG· §rð~÷æ§êåzœ™dzÀZ¥+÷ßR›õF1.>”6·ÝÇÃ7'ñ›É-p<Öʾ×s–pþÊÒZÞƒûQcÙç¼üy&•/»“w´ãŸ1óH‹éÊÝ×D±ô“Q¼³ßL­®w2hÀ%üóú_$»Ï\5v¥.çÇŸœ¤{þ½óEäܷ߇ÚÏ5+4!""gûÓÉý[l¾û€9§Ò?‡üÅù~–eV>>maeW¢ØcO ¿;ßñE±c”3P¾­Ñ\ÔØÍ/#ß+Á`DQÜüŸ½;Ó©ú8þy¶yf33Æ,Œ}—ʾDÙB!!²”ŠŠ$ùµRQ(!$•P¡ˆˆ,Ù÷5û:cûìf_žý÷Ç sïóÌÃdÔ÷ýzõzÎ}Î=÷ÜsÎýž»Æoý†ö®¿.FҔ׺êØy%“ø+JifЇ)ÖÊuçv¿qówªu«²•·ÁFÚVåzÑxWSœë ¸ëUú[¼1ŸsójüK?Màµn38kA!þEŒ„V¬HIC:ÉVŸ›SÊ4¦zÖ&n?ÏU+¬ÿó0-z7 äâóDZ@ã_‰³Ž°8¸5%b×ñÞ+¤8àèšUœkÖ†JþZâK×VL;ow)˜ •rX•Ê¯Á»Ÿ¦Gsìr::o™L™X5pûAÉÍz°úP÷íÑôŒþš~=‹ =%ïΣéG¹j6\ÏÃK­¼nä±ÄŸÆ$Ö_ˆ%.ãæÃzHÝzøŸXÄÊð2I`ëâ­<þV#ÊyDä:fª-wŠd·ÒŽsZ¥.¥£¡îo¾YwŠ8+Ä/û†/BÓò>œÛ³ŒŸæï&>wí«O×N)L9~…h»¿jOòR÷æ<j ùÔVæÍZÆ«VôaíÖËƪ£eyúñ¶cÝÏÓYxÒ‡'ö¢º·U†÷ƒñK1¶íE—Fe(bOæÄú_˜¶ôi*íäæ2)ùh7úv¨C—Ù¹:‚RM¼™7æw"-Bêt¢O—FTô·¾‰ysVžbÏyJE)M9ÏK7XŠÛïJ½FYôŠeЇµgXo=;"+ðD£2è.oç×%QÔéÚžza:.o™ÍäùGH–Mþ×ÆÏ_LBê*·©<÷³=˜ÆÝ_¼¥Ÿ„ºƒ^ç ›ìÒ¦vöKûYL(1Ørkw/j½(Û´+/¶«Mi_ —÷óÇÌyl‰äÉÜÇé/~!¾NËEËd½ N/åß*Ç€ìùŠÃÿ±#§ÊüÀÉÜA-¦U:ÖšŠuçÞÜãq€Æ«4­_íLëÁX£°ìçßØ|) »B9¢  ó ðV›£\5æÝ£- Û¼‡¥:Ô£é«}¨ççM­ÿõ'kìtŽ„¶VˆW•bÙì+?JÛoËL&áÚêºb4}® §çOæT¦ÊiåúѨÔó˜[aß«Š¿SoŸjåTKS«3c5åvx¹ û·JsvŽâ^‡¨ÎÍ!ÆØ{¾­næ C!ªz„³fÛ1NŸäÌ­ÿ>ÂÆu§ñ­ŒG!?üZ.-gìÄMÄÚBˆG«0ë·ÕD¤Øn:Œ FŸpŽ„œ˜ÊI’wIŠ5ÙXåê˜'!|#§î&Ñ‘,y…U"ÈGt† •4×ò@½Šåw`Ž?Å‘³©xÖÄ”ñ#Ò,‰?ÎûŽwëÁaâÜŠYÌÙ‹Ї6åÅÆñ,\rœ´\ëQ­‡\yØýB)¢ ÙkÃ7ö†õoÇÃE³ï1Ðê´`·ßˆñlVžAûÜü ¢òr:7ÓP©K ¾a¥ðJ3óðóCõù>êß‚âY)dÙÁ³™Ÿ7xÐ呵 IDAT£˜òÕH†´NcÉœÝ$äã¦(}‰–¼Ö-Œ#?Žâ£ç^ª ý›‡(Þy¡ñ¯KŸ—ë“´ì+†¾;–ù1ӷߣë²Ó ¥šÐľ†/?üˆ › 4íÜ€`G «§Î!<ã43GÍàDÙ.t¯r–YŸ}È»7 iò,Í‹ëUÚÉÍ ¥žäõNEÙ3mÿ»œ´†-)gÌÙž¦¼Ú³"gçáí÷'óWFcú½P ­zšZžùÙ~gõjT)€G©†T:÷+8™õÚ&¼Ú¯ GÉ;_mDóH[êÕȸú…ú×ÆO³Z›RØÏþ?›G×Zj=EÕÈù|úþÌ>UŠîýZRR^+„¸K'„=+v`@{?öÎÅ»_üÁ•*RÒxí|X#^lÌþGóö{_0;²"ž*Ñšû8=ƒF…夂 æô[žñ­Z ˜Ï8üŸ›ø¨”K½Ìj1­Z¬ª47p>§Ü‰_ñÁæœ(Á³ýÛPÆC¹*ó µ9ŠbTŒ#ƒ±+Õ¡5-Ó~bor$¿Œ™Æ{mÅxÕY,«´ý¹ëÐ÷¡´¶­cÙ‰Ì[Îßž¦S©µ4gåTê7jc òïÔÛ§»Û \/jíïßÊýÍyÿ¸7ã!êóD'sȼó¼÷Ûêþ,¥Pœèr¨_³;pÜZښƆ=ß:›÷ Dg(ÏËߦ±Æ-_‚c²ÿ^<‰=g²aRúMXÈîÃ{رpÝ*{ál÷xÖκ…½)«¿ýßÆjƒY>¯ÞžÉæåC©]±=ï iNˆN‚!Äçd—ÞS‡5Óĵc¢ÃœÞ@ëMå‡lŽÌÄnJ&!ÅŒ]ëAñ:y{`]./Yʉ p¨¤¹–‡“r¸ ãà×¼>d$S¶ðl¿Ç)¡¿‹õ€•„ã8p> ‡>„æ=#añbŽ¤Ý©ÖC®<4žÞX’â9½~6&Ïc§½1¯½Þœâz+±‡Ã1UoËãýð*RšG;=Nq½ƒ6÷Om9‹›i•ºÔáQÄÏòM©py%ß=‹µÉµyùÕ”Ѓ¡Lú·²±|ÒpÞ2‚)[üéܧ)¡.ï=%i€Ïáe¬=u•”˜pVÍú•µ—”ÞOª¡h¦”¿¸ŒÅbHK‹aÿÒ¥œ ®KßœÐ(ë,«6%Å”ÂÙC$êü¸-¦Ó€FïK€žôó›™2b2ë]~Ç”¥­ƒ~ïR6œI&=á«–'Ó‘½=AµRôøRV'-õ »þ\CBåǨ꣖fTÉ3ŸÛ¯Z¯6•2dW’íê!Öì‹!3íÇN%°wûb3I9Œ)Z|Œ,ý3CôµñÓ¬²Ï ûÙ¢ÐƳÇ-[üfn>ËÕÔ®XÌaïz4(!W$„wƒ²ÕÀ¶óV'%þkþØMrÎ!Öž¸›©£¿eõñxÒÍ&23,|âB›É«nÝÛµzqm^Pý[¹¿Ýù¹‚ "Ï{¼­w²I÷ëñΣL[Úe¼F×fR¡÷7|?¤ s»ÏeækÃxtõKÌoŸë•MÏ awã™|ÜêuŒLÇ1ITe<&öáP—o9q¯Ô5>Ћþç§òÁÐ œ2ö•@DñcÇj²£÷º1¹Óxxã…, h¼+ð°ã(¿§ç|šÚ·O¾ô"O=Ê©cX:íúS)͵<´ªåP¦Á»D9BL—9ՌÔÀÑõ›ˆy´!å¼7`«?˜»”Å3'Å„I '¸í.®_Gðc=h‘²Œ/§a+šÇôB¥Ž®1GþÁ¨Ooü;vþê}ÚŠE7²æÜ ¦-ëAŸŸÑI›À‘mûˆ6•"õ–Z™T–s/ ¼K”W¬Ë³V;Ö‹1wãq®ÚáòŸËyô³'x¸è"êÖÁ÷Ä|ÖœLÁ ]õ?mC€Í¬w%ˆÓá[Ì“ôó)dßâ ëÊ!v\C™¼—÷)æ‹wµžŒ×ãz0ç¡‹%Ü3{ÚÒâI¹¶ïìyÝ8á íÐ/LñmÍS½‡ó|‘DmXÁâ5‡ÈtéƒÑZ|‹y‘~ìF™-Éq¤Ùõ€Ÿ#é±É˜sVìH#ÁâC€§Å4=™Šyæcû¯}O©^=¨XC© Ùõç°da¶gÿÆî°cɲäÔ¡‡¼ÓçscüÔªÒ¦Rúº¼ÚøaÒ[rÔ‰±%‘ËiFJzËi>!ÄÝ Ã;À@ÊÉ$®R-)Q¤X+äŒRÊ6{ž¶5C0d$còÎóFCW—w¾¿”ã[vÅp#ÉúÒ ±ã:¢îÙcjóƒõ$û”QHÛ„^1¦ÝÅ¥<µ:‚›T¸3°¦D“lÍuœNÕSÒÓC1fåùEtœMeŽ¢ÔÏ”âHÊœaQ&WâUƒJšNeû5×÷±WåÖ4¶î`ÂeËmû?¯4Õù—bÚV"T¶!¸¶R¿QÕú›ZÛ]G”[Û½ÿó®µvè¤,wÜ¿õWìo[9èÖ¹‚ "O»›çAî½ûö‚„#iSfï'!R×ï ºM Þ:õƒŠåâ|¾œw(3DMÀ†§>äéò38qü>ó‘q€ñŸ/`G²χ%Bü×ØIŠÅÚ´,ú#dXÁ£XY2.gïj£;ºŒ hŒeé4¸/ÕŽÏeÄ÷GIÊu#¹ršïò®ä¡V‡úÁ½q/^÷ü…=‹ ÐŒè°b±Ûˆ]?7Ößi=ä^¿%jT ¸Z¾¨ù"­Þû'Žå·+%ë(÷ñÌ·B]Ô`Ï©Tì€ÝfÁbw`s8ÐÚaf²ï_ôÄbŒ¥šðd¹Ó¬¿÷òI$ïŸÏG3Ž“ õ¦xXRb­PâZ Õhñ *†%|9“·,Æ#¨íú÷æ•´KŒÙïBÙíd$›ñ-‚ž«˜ƒ_>Ú¤œ4>¥ýñà2V@ãD1C&û³,*iV•<ó±ýNë5’ƒŠe°ƒAFÆÂ!÷øiWm7Jýgó)Ï<Ûø”TÐù•À_w€4+` „¯™¤L»T»â®Ä—é‰füÂБŒ0øÇOŸ=¶6ìÍKÕ#˜2a&gÒlx×z“ÑMo][NÜ9õøöOÅP«‡ßË»ÔæNʬÓ*ÅT—¸¬Rwó"ÍnÏ=ô~Åñ×"#ç8æk">ݬPŽ3l¿F%…ù…Ú\M¹Ÿ)mó9ÂC{ÑÏé~W‹WÍx)¦ÙЖVÚþœ8EãMµf•HܵŒÛî}Ê3Mmþ¥Á·B=…4›Ê6h©Ô]ißOdŸâ¨Öß&°£ŽRûD¥œjÛàP©µv¨%øÉîß*ýͽs?*÷i÷ó\|϶õÎÜ··1Y“.ý¢œÝ¥»í,q§‰»öS4§½óÏç5M®Û*l‰ç‰É’[ý„ÿ]¦s;9îÕˆ§jáé]‚Æmk`;´—+V/Ê×0päTö ¾=EÍV~ß¡hÁAAóÃS«’¦s5•r¨Þ`%æð)´uÚÓ¢RQ|üJñHûÇ 8µS鎻S=ŪզvY'~ÁûÃF2ìãOþÕ ®˜Î2ëóÉüyÑ¢º}7òðAãS“ý{Ò²Z(~EŠS»};ÊDíâH¢mÐc ö*mªáT¶ÏÖ$mûN.[­•êÔ¦Š¿Vu9÷ÒÔë2+r§Ÿ ë#¥ð÷ ¥V»v”‹ÙÍ‘D3Ñûö‘R­O=Œo‘Ôißž2Qs$ÑÕ“›.ïÚ¥VZVòÇ«HyZ>÷5½í ì$ÞNL•Žt¨Š¯o(5: à½^RÄ¥ÈÈ€—Q‹_ͼÝïq*x`Ðf¿^ÒnwRæëûÀÊ¥ípÔï@‹ ~xVå‰öà­Én—qû÷X­#O=„·o:¶!èô6Ž§©¥™TòÌÇö_/£M¡^-Ä(–Ab¢BC“{üTk7f…ý¬Á7Ï6ž½ ÁÍy¶I9Š„P³Ý3ÔÊÜÏÎ(«Ô»ânD—\Ø~mãδ©V ßbUhݹ~ÎwŠ4h 0¥“nv ÷¯Jë'Êám0¢Óä>Në\XNÜYD¨Ä·j1àÝŠÃïòÙ&•rYTÓ”cZ“±6ƒc*uçþÜô¡Óå±² ¥VûÎÔHÝÍ®èL…rØ°*Î/P™£¨õG¥øÜL´Kû]-^uËç½ý9qŠgY©Á¡ɷ߀¤”¦X?6•4«J9ÕúMºÊ¨ö»Lõ>åÖ6ØUëE¹Z ¸[Uçî(øñ° ò¼wÛzgîß'$Üø$»!¨"ÁH2ÆP*d“ê|â¤Ñjr®Üh0…᧻x£2õBü—92ŽóË÷›èÛë&½h#êÀr¦üy“gjyE°"Å(V1 Ÿ°j¼3¢m®__â×á“8¯”6j¥]Êc›¯*”ÃÙáýÌŸL[Ýn}†ÓÙßBô±ü0çÀíïu·4FÊ=õ=£¿æƒ_ÏrõÚñE“ŽÕn!5)… «rjÛ—˜+ys™¼¢½z¿G×"Vb#¶ðãŒmÄÚ€+ëùqeý^ÿ˜glq„o™Ã”µÑÙûÂhÝëtÓ#ø&Be¹+î¥YÕê2õ³¾ ¡O¯AŒ}AGâ©mü4}kv™/­aê\/ú<÷>_u| 3§çl‹,WñÝânôí?’N>&.ïYʌͱXCó^Þ~u7?Î ¢w·ÿñU1=É‘;ùmÆblN‚#KÇ.òÂǯòãóYUéi‹Ñ–ʹ¿óÓΫêOGäÞÇÿbÚòçèûƧtÌ<Íú ûˆkjÅîkì&¦Í+JŸž2)ÀF\øF~˜½?».ÕÒÎ+çéêöcÌÝNò®W“Y¹ òB³t®1ØI›Ê³ÿD¥ûU•zÝÖÆm5 óÂV.>ð"Ÿu-†åò^ü°šK©v!Ä]:¥sf)ß.Ž>¯|D{M,ûW¯àX‘²€«{³¹vo>™ØÔËGX»~gºv£_Ã3LÚ›ë8=öO6×~1ïåv%É<þ.ž±¤%)Ä·NbÀ»‡ßýö§R.µ4µ˜V!VÍ29²ïœÏ«îÜœ{°·o5—z‰ÏºÅ|a7s§¯'Ê …r$[”æ:Õ9ÊVµþøwÞëJ³¸¶ßUãU•4_•íð(ñ0ålçX“Çãèy§9H;¦T?8¦27S,§Ôúâ褿)¶Oµr:Ù•:Spÿ¶¨õ· ÷Î øxXyZïÕ¶ÞMÕkÝóãp¿Ñƒˆÿ Ûó*ŠŽo18t!#;ð¨ë|Ž/Çn$ÎVXòâövæ[o0£¯ãƒ¯’)"„B!Ä}Ád2ŠrŠ›Ø/KbÐð/é®Ës΃%f³¿½ˆKUf¾À–£Å¹l*éÆ]ÿÛc²†ÔðùD4ê÷Ã0\ɘ·fáä’‘ùì"¾ZÙŒQs70ðâNæüð+Ý¥ !„âN8Àç!ž}©&¶q¿q(3”FOTÁ±VáÛ!÷*O!„B!„âî)OHü›IѶ3YÝe-_ÙLªìw!„P$OHñO…'¾Tm׋—ZVÆ_“Á•1{þN.ÞÉÈ "O!n‰«å !„B!î?…å ‰ÿü c¥ XŸ€<>béHÞÃ×£ã´I¬â¿C.H!„B!„Bü»È+› ËŽ8ý ùMZ¤B!„B!„BQ€þ#OH!„p•^*A!„B!„â_ħˆ_¡(‡\BQ(PB!„B!„âßE^Ù$„B!„B!„BˆW(žÐT£UÛFTô@sKšÆžElÄVVl>KªCv˜B!„B!„Bq?*OH´ôå£w³jåþºå¿k÷“ô`oÞhVìza=*dùò!T7æ‘™oS~Ü>“'ýoù[8'õ%„B!„B!„¢€Š'$ªz„óǶcœµä~IW›&Í‚ñØ”@–ì3!„B!„B!„â¾S8¾!áp ú6&»Ç­ïrÒÐpÐ46ì9@øÖÙ¼÷h :Cy^þ~4ýë0nù,“ý÷âIôè9“ “zÐoÂBvÞÃŽ…£èVÙë¶WDÝʳæpÖ-ìMY}ÿ6–¥Ó§¿²ýÐŽï_ͬÁ Ôè(öÈ«L[¾•ˆ£»ÙüóPZ—0`¬6˜åóúÑéí™l^>”‡Œj{Ç—ŸÃ’­{8~t»ÿM· 9?ÐxQ¹ë(–lÝÃÑ­¿òÙ‹X¸âjzª¯ß£ò@–ΧLaõ®ýÛ:ëöº[<‘'åó"B!„B!„B!îžûö¬³G™¶´Ë˜F×f­xižnCÚfdækÃØ‘¼ŸwÚw¢[·³ÿ~f«¯j(ÞêuEÇ]ùhO5>œØ‡*FwK ! é{ «w€a[ҬϴÝßç¹òt!m;¾=1S^¤q“î|Ùœ±_u¥LÎE ã½è²††Îæ´Yy úRÏ0zP)V¿ó šueø¡Ú¼5 &Þ€çýøæ­ü5ø)íñ ‰O÷æ!ïìß9[¿gÕît³ÿÈó-Ÿ¤Ï<#Ýÿ÷%¹êî™!¬¾j—Þ!„B!„B!„⮹o/H8’¶1eö~28´~ÑxëÔ~¡Árq>_Î;HTÂ9ÖOÀ¿¶<]ÞÃýÊÓ€ÆX”ÐÉGæñêS}™}ÁNHóç¨qük&®‰$11’U_OæP™6Ô¿öÔAÆƾ€'âÈRy4ijœϼÁŒ]—HÉÌ$-ÙŒg€:<©Ú¹-†•“˜½?–äË»˜ñÍŽœ~k®ß‘v€é¿ !=Žƒë·mÂW'A!„B!„B!DÁÑ߯·&]"þÚ7'ìvÓßXâNwí7¦hN%zQÙ_˜]_±FƒFààê†x-àe^ÿ| ŸF±á—o™0c+Æ°üù”ÕÛ‡çüH‡§áÛr®˜ØÏ“åpº*‡Ã“êϽǫ—Ør™sEr® é(éMÒÖ²7Ç)î‰V# ÇßÉúo­;yB!„B!„B!DA»o/H8ùêDž A 6@’0†R) ‹˜T«Óßi´šœ ŒAaøé.ZŠ”.‰yû^Y0Ï’xýë±LHìÉ[±)Ä­MÛ¡;IÐùS¡JQâ/X  8®”^K‰_0¦ñ6^}ñH´â×jk{ØHÍ¢hùb¸‚ 0•&@›“¦²þŠîÕB!„B!„Bq' ʼnd](%}5D&æu¢\‡©4É™®ßɯ5âç©…ô\Æ2=y·Û6†ÿ•Âƒ¯ ¥eÚjž?£þt„=ã*Ö°¦´¨¾„è+éÛ¿6>Ž¿-ÅZ ç§6ëyí_8¥Ïþð¶Íf!fó"νþƒZF1m?Ôxi4c¯¦ûóçˆr¹V4茙Lr¦Cpz÷­¯Õ ƒ&‹ˆ?Öbûn=W ã÷˜òô}£1~š%€èMÊë¿âjÝ%ËsBˆ¼†¦š¼ý:!¿cÑåktµøTlÍË}ÛP;ÔΕ=K™6k ®? ¦%¨Ù+´žËê€ö¼Ü±UB=I¿°›E3ç±é’ ‡ÖŸZûðÂãÕ6ÚH9¿‡?~œË¦KæœK¨.äá´ åwºnWêAGñ¶1öÙâ·,˜ÎÖ/>dÆ)SžÙx”jÇGïVbÑ{_s03ç¨X‹n/?KójÅ°]ÞÍüï~as”å–±º­>M¯2¹þ_älÙA’Ã@H½.ôëö(UüM\<°‚?oâ\æ-[£QYN5Í“r-_à•öu)]ÄFräß,úq>[®˜q¸û;'uâ òÝÝ'…¯>]I”5ÿM[ð(Ã?ªÎ¢aÓ9–åâ¼jðîØÖlü`{Òex…Õµñs6sNdÝÓ¼=Ê>Ëèþ¾þäO.Zïa•ÜÖw³·££·‰jbÝGTë(n)Gª÷páXãê1U¹Î]«g E åóÆ«xgÒQò1Üæ‘v™:è“©ô¸•i#qÞR@­Ù±ú–}Q0ûYÜuÆÊô7”Ç|rÍÍÓ.³gù~^Ž¬ÀÇùtl7ì GðéÊh®íJ¯‡0¾s8ÚD‚ÐøP±iGºµ©K¥ô¦D"maÑ‚µI´ÞÕXâÑ]íÿtŒ¢O«Å­vâ÷;ˆ d­|]WÝžä+O=! ŸU˜7©ÍíÔösQöDïºf¶ìò¦Mó¼ç>§5*ó×æyµwWëèæß¹Pùé_æZ õªX~Õ>¢´Ì?Õö»}ù9V秪µ%×Æ–‚:Õî^ßS*³Öµs ùíÏ÷X¡¸ ±xYƒ†Iw]ž±2–˜=Ìþö¢k/V2_`ËÑâŒ\6•ôã®ÿí1YCjø|"aÕûa˜N®dÌ[3‰09Éîì"¾ZÙŒQs70ðâNæüð+ݬ\ø}4?ÔÅ^ÃËšÀÑeãyoñLYKy÷£R|þÁ\v”4h £ÿ÷ç¬àú7´m\Yñ¿µþœ¥»ß$áÄ~žý3?Æ„xeÙw žú _~¿ŠÁé{™3k%{˜±:ÀvEyý®Ö]›ü%¶Bä ¼ŠU©Eý-éRݛչ“¼«ñâ›O ÿs2ÿ;l qÿ¼ÕùïÏÌ·5T ƒgëñÚàDÍžÀÔ#fʵ}•7ÞhOäG‹ˆ«ÚW¥ðÛ˜wØŸêǃðjïG8ΖÇ>7Rá™·ù°¥™ó¦óë‰X²¼KQ¿}ÞzÏq#p<×ID‰%ܧO«Ä­NǼ;Œ b­[];gu's€|ä© zŒ×^Ê{ÞtΪ¼}êë ¥ÞCVÇú´"¬]•÷ÜGö´bܵ¸ s‚¼¸YGªõàÆÅsµ9T*õªV~•>¢¼ÕçŸjû@­žó57¾Çô*óË8£ cKq·ï©‡ªç4nöç{½ÿ C!âwÍá“]®/o>5•öíoùwÇkÿ:ÇÏýZñóµökÅÏh(Úv&ƒS3}À¾ÊOál1¬ÙÕ#oü¯I‹sþH=Ä´O3í¶YˆÚ4™Þ›&ß–b:>™¶í][µ=i_õnuSyZö- Á«|ÊžGÇGÞÅ ø6ú’Ž™gHµ©¯?Ϻk¯PwBq'Å+U¦¤G:ÉŸ›SÊ5á¡Ìm|¹õ X³ð ­û5¤ôï‘œ±€Ö¿2edaH¢W1õïˤ8àðÊœmñUt\‰ÙÂôo£8r) ·ŒL ¦ô ,ÀáJZb‚UÊaU*¿‹“u»Z¶Ì$â¯Ý ¥ ¢E¯jœüu'3 ñ¡Á{ãx1zC>ƒ =%[õ¤iÚaL†ëyË6¥‘n“Öœ Öq‹'ñYqRàæ<fLb͹b3n>¬‡Õk@@Ä|–'ƒx6-ÚLëw£¼1<×*zB—;I²J'l&²ÌÌYYdšt˜ÌV,Y™ØjyªýîF™òª—š †<÷l _…_&Ó~ó„²xîôïÚ˜Š¾DîZ¿îäŠÕ‹Š­zñÊÓ5)N4û6ǘó9*}ÉŽŒìkcùár<ÓúA‚m‘¬™þó¦ÞxZS_œvCúð U?}ã/itê˸Q«‰±GÅžŒy!žq£Vsµä3Œ|ÑÄ_ÇàÙÚç™:ÃBï”ò×âW½¯ôlIâ’Nnâ—KØ›`ÅPææ|&XH¤ÅÉvZô„Ôë«=£’¿…è£ë™ýÓ_K¶goç+¶ž­HÛÇÊ¢¿´…Y ¯P÷¹N4,©åÒ¦ŸÿË!’äM÷µkã;÷cä IDATç¬,Ź½ÄwPlïZ'}ázÞ7ݪ܆o)™âr®·M'yäUöã>´ÉÕw1}ºìí˜ëÛa9㈥„‹eÀH©¦Ïóê3õ(©¹Ä¶Ç(Ó܇9#æqÆ|­Ž1÷¼Õ¥c«ÇÔYYFJ5Ë{½o9©–÷óü¡WÚ ìJ›Ú!X¯ìcñŒ_Øp! »Ö‹r-žãåu)ã«!ãÒ^æ?‡My݉šS¦_2+ƒÖ—žy‹ÁÍ«QÔÉšß:ÛP[—Ö[q¬&ŸãåyŸÛ÷s¦œx.äìX23ÈÈ°œÙµ–-OÕ§fio´ÇÁ‘qšåéòB}LÞÅ­÷Ói‹5ä…'´©ù ml«Y‘‘=ùu˜8³t&?oŽÁè‹7§O“8~[AÚç6ñ-Y¯T35^|—qÆðÙÀV”ÈL&Ë~s¿âøé‹ÒrÐH&OÅÈOS+0û^‹Ãæ¸qâÜjÁáD¨æ¦R*/§SÍýéktÿ`,?|3†wŸLã÷™»H°ãöïP¬“;§{‚AÏ—âð3è“9-Ý­B(R¹3ovôçïï>fðÈ\®Ö”Rž7~çQº9Íí«õ¿÷»Þ@‹n Êý$§5š¿&þıôS|ÿñwìNQ?«e(ÓŠöE÷1ýûµ\±(ç¯ ¨OÿW!qñX½5Š¹QµèÿzSBt·ç“ûIܼ·3ch Þx©2§gdàñ,KŒ½ëàŸz”iDåÈŸù`èxVk›3ðõj™:Œ7Çn@Ó¸=õ52þÝß—#®Ÿf…6¢wÒÞ•Ónä{îì¬ »ºœ+mÓiy•ÝqsßÝ“JžÛáj<Ê´ãÍ.ü=uƒ>û“ÔFOPÞxkýŸ#Ù¥cëÇT‹êzs ªc€ŸJ­)|Áatøe=@ô(/w fÏ´¼1ä3fž©Ä³+æñ´÷2e†ú44­`Äw»QOó.õ ÒªïoåuiðR«ó7^j÷³¸Æ³Šõ¨WÌDT¼);ÖpdqêϹ(õ,=kûÝrrCƒo¥ú”Š^ϺÈ[^Íb¹ÌÊ鈴øœúë\ÔúŠÚøàÚX©Þ×}KŒ²ßØØÅþìöDA5žÖ)Æ­ÎƼ‚‹ÝŸû8›;(«¸9pÖV”ê(SqÞdWÓ(¶+{<§NgwÒY~9•­WŠsµ¸_9M­½«Õ‘z?Q®‡êïòŽ­‹cT›k)Ö«ú>Ö©Ìí\ëùÛÊã–zûvg^åj\èåmt>¶$÷úž«eÎë\ƒ+ç(ä‚D¡c:ý Ê Á·ÿ÷æÇ¿qÚT8×yøÞÿ#ˆ÷—nçÀÆoé7…7¿?Ž !„øg#/=–LÓõ ÌnNÇ„^z@ëCÕ6œÍÀž•LB²»ÖH‰z]yï­ú\Zô¹Î dìÿŠ— gâ–@z hM˜Ëy8)‡ ò\·; %hÕ¡û–Èug¹•„ð}ìLî¥åKÍHX¸Ci¹ž~F¼*¶ Ò¥å|=a«’ëòÚ-sÊr#¼¼±$ÅrrÍL¾ÿ [mñÆ –”Ð[‰>póCíi]Ùo¿24íÒŠzmî@Fm9‹jeÛ3°%ãޣ߀aLÜäO÷þ-(îdÝÊ¿ëäŽ/GPòÑFø\ÌÊWI‰>Êò™³XyACÙfµ°m_À_áñ¤Äç¯;IÊu‚ß‘yšëN“’•ÌéǸªóÇëN¢&ÓiæÏÝ̱‹É˜Jùk(Z«/,fá¾hRS£Ù³øN‡Ô§Zímù˜ζÓJpÝFF,æÏÃq¤¥^fÇ+‰¯ÒŒr.PÙ°rw i9r"ž„=kÙ“IJäaŽ'kñ5êd˜»¯‡èk㧙°<ÛHöû€ÕÚ»bZ®±Ù‘kÂí´ »¸œó¶©wš‡Ký8×vÜÊy¼(ݤ>úÝ°æTéñ¬X~ã„wu¤~¬qõ˜jU_o®1ÐÙ`Ž^Ëo›Ï’þ% 9àY—Fa쉻˜ôÉþ #Ýd"3Ý‚‡:”ëÏ8ÒŽ²xÍ)RL)œÞŒ«†"ŒmÊëò œâXÏñR£¼ŸE!¦ ¤Õð)Ìšù=³f~Ë7ï>›f1?×÷SìéáÌÿõUŸ†}´7õ'¯¢>–@úõ›žäÓï¿ÏÉïÆt.Ú=÷®#ÕÚ¯r?uu¬Të¸ÜO]îÏwA^cœV1nu2æX|XpÛª6®âÖÀI[Q©#Wæ^yÉw{Écî£÷+§©µwµ:rÒOëAíwJ±uQ.͵nÌTçyÊ}ÄÅ~Ï}àÊ>¾½}»3¯ru¬sò6Þù¹;á^ßs±Ìyžk¸?éùOp¸²/ Vþ‹6ÉžÄßߤշ§ !îé`„%ËŠÁëF£õðÁˆ…, h|*R“Ãü–s+‡Ö·2í^îK»b§Y:i$kN¦bGƒOXyBM—ˆL0c7ÅsxÍz¢›6¢‚Ïj¢ì®ä¡U-‡2µu¯ÅÚðŒî^Lÿic·%¢~¼ï*mhbÝÊ-y£!Í^ UÊFHÅxó±Êf±c½°ŒÙkÃI°Ã¥…Kh:¶-5×q%×Ë>Íg~çãá7~3w ¿x’ZëX¹”)K^ ßà/xVÏÁÍ{‰2•&ÅtsÄbRYN9MG‰æu)1—UÇ“1‡V,ãüçOQ«èV¹õ»Í쯡T'wæøILÉùØ¥ƒ¬ËØvÙ›ºOéIŽHºþLKRÉÖŠ7NB¤Å“|-Ñî ÿoõРÉ5/±§Æ’xã ‚Bþ:|Šùâ]ý%Æ~ÝMNpꡋ娧6Ï|Ô·ÓƒJµ¤G']¿xaO#ÞâMÑœ³²vK&–ì[k°Ûí˜3,9'NØåUM÷½c°Ž2y¶ЗToïJi·Žï¸Ø†]]ÎyÛtž‡+ýø¦íºåç´ Z|ƒasW’íù<¦j¨ ²ÞÜ“[Ÿ@õ1Àšuãb¬å*—Rô”òÒâpxPîñ´¯ŠGzÑ&o4ÎêÏïö:w¸°¯iJëÒá]Ti¬Îßx©¶ŸE!fKaÇÔ‰,¾h‡¬Ô$RLöœ½}#~J9ø;¿5NŸN;}äÆÿÏJÊBクÒm`ÛÊÄáû1h´”hó/èÕï”uå©ÜWÔÆgí×~}¬Tî¸ÜO]]îŽ6ª±üŸuûÇ<µ˜ùžYU¶u‡ÇUƒ›s€ÍSl+Bêª×QÞó&'gÏòÕ^òšûè)Ñ@)îßJ„bÚ.âÛ»Zí ¶¨z\Ÿw=x«ô/¥Øк6׺õœ¤Ú›aß&ÑvãÄTp“> òšÅû?ŸÆh Ft f;xWp%µr¨‡j붻æ ú­ÉÏÅ›¯Bâ¶ÅÄçqxV«"!Õ+2qZ_4Z- ™ø)ëÆbQT"7WãÀæÈþ/wÐY¤R}Ög׉ì€ÝfÁbw`³;ÐŒ¤ï›ÃðuӱƊÏóyí³DeÞ\jË©¥9ì ÑhrML4h4Ùs÷~§^'sÎÜÉgÇld&™ñ-‚žl€±L3Ú•?Ïé«füK ' 3`ð/Ž¿>÷´!ÿgã5Úk'H4ü‹á­Ë5¹»9Ǽ󷓑”AÒž¹¼ÿ}8™ZJ”*BJŒJßžúvže¢ Ÿ²¹„ÐúdÈdO– 2‚ýË/Gä?•ÚÈ)ÖœVoïy§in›]nÃe\\.̵ã³<œ÷ã›·CïÆ10#ÉŒoq?ô$äŒ%Áøè’nÉ[GÅcÃcªÚzo)ŸÚèýK ?@†0¥¤¯‰¸4(Öø^~ð(_}>Ói6¼ë e| õúÓº5¶Ù(ÖDi]6ÒÇêüŒ—wºŸÅ½c%#1žØ8''^ìWÙùË2šòíS’rb ;igöÒœf¥·°àœ l$Æg€¾8õ+¢;vçã¬r_Që§NÚo®ã»rиÜO][îN¨ÇòE*5Pˆ[m*cž¡ãÂÚVʸªws`Ui+Z*÷TÎó—Ë%æMî¶i×ç>jóå4µön#E¥ŽÒTâzåù£úú”⦿ve¸4׺5VW.¿F¥¸Ðò½´*ûX}nœÿy•«c{”·ÑÝsw)WlsîžWq¸x®áþòŸe“Bˆ;“¹cÞÒ¡^0žÞ%iÒ¾¶sÉêEÅÚLÃŽ–"?M Í&æmŠÂLHp0!Aþxj­D<‰¶^GZU ÄÇ¿4;µ¢èÉ­œL÷t1•rXÔ'ºŠëvçEµžåh\)ýÇ“o¹BO±êu©W^GÄ´a¼ýÎpÞyÿ#Þýb)—Mg˜ùé·uf+'Šµ¥Ç£eð-NݧŸ¦|ô.]µçÊÃOm^ð"OT/ŽŸ_ êv|šrW¶s0ÑŽ6¸)oH»‚ð®ÎÓ=êºu{v=hý¨R¯.Õ´ªË)§Y‰Þ³›äêéP#„"E¨ߩ#e¯ìt²nµßepL¥NÜ‹n®m§KÛ÷b­Û‰'ªàíW'^è@mï,"·BûX7žªD‘ j´íöÚüä³°Æ€·‡{V*¶b5¨UÖ£eÚ¶¯„g¾›«·ó@gž©JßPj=ó&õ~˜<Ÿjvº¢÷î"ñgèP#oß’4îòÁ§¶‘*?üû¯Gäƒ- mÄŽ{/ÁÈw‹m8Ÿmýnô—ÛêÇ€·ÑûæíÈ73¶îÃþH'ZUôÇ»X5ÚuzŸÛêßɱ&׸âÚ1Ue½·ãbUdžâ­èÞ¬›e‹ÛÁÜVÚüo0=«F™à@BËÕ¤}ÿþ<îkåÎ_¤Ö~Õú©«íW­hœ÷Soúrw¥­«q•¸U9~Ϻûñá]álî 4®¦ªnòÀªÒVÔëHmÞä^›vuî£÷›TÒ2UÚ;*u¤ö;µù£ZÿRŽ›4js-µ9³bùm*}Ä…yR¾÷]e«µo³óª»ï©ôE•mtïÜÀÝ9Íî^ßsá|†â¹†û“Ü "„âŽ8ÒÙõõzú÷ýïúÚ¸²ïO¾Z‰É³u=Ãù3Ùª\Ÿ’ÕùpLû\¿¾È¬wÇ°áÔL]ñ<ÏõI· QGÖ1õ§}$«òŒ«y$(”ÃÙ¥u»q¾Ö#¬&¬çXuëm#;¼Ì‹Ñúó®…+š4¬v3)‰ÉÙwQ¥bÆ”ú÷y‹‰½õ$žØÂŒï6c»%Ù³·ôyú¼2œçü¬ÄÛÈ´o·k.¯aÚŠ’ xs]m±ÝðVFe?BëQŠ6}{£ûö©,§–ÇÅ•LšíE¿?⛢vâÂ71í»ÍÎ×­ø;¤%*׉;nÚο˜üûsô8†g}²¸ô÷¾ÛCše1_ÿÙ‹~¯JGM {V,åˆ_¹|å}üx ‡ÏÒ{ô›d}8‡ßw× ï°ñtŠ gíòõ\hžÿ¢Ûv2íÇ ^yþC¾ Ò“|f;¿|¿‘h[4¸°&ó¾ù¥ý_ú„ï¬ÄÝÀÔ÷’$w ÿûy–Í5ƒùBÞmÄêÎëk¼nÎû¦~qT¹ {¸ØÖõw¡¿¨æaÉé»ã&urÃ’ÝŸÖ™"—ñÍ’^¼:äsºddÍšÝĶ°`»¥þU5ÆÜõçÊ1Ue½·»¬1Êc@lÄíù‹K5ú2öù@Lçw1ûÛµ\±ÚÑü½u_fô·Ïrñ0«Ö¬áôóÏózãÓL¾”wso_ÙѪ¬küNå±ÚåñR­œ¹Ûîi…¿“²d<¹/X¹¼v+Èõ(Ñ‘Áñß¿`dÔ³<ßöFôñ"#ê4ûVÏdôöv ªr§ë´“ Ú~•û©Zû½9NUêNÖý÷µe Ó>[Äƺ}ó^n_‰»ÒÖ•Ç8Q‰[•æ@|x—¨çÊ㪇Úö¨ÍÛŠZ¨ :or¸×¦÷¹6÷1«ÍÔÒN©Œùju¤ø;“9¨òú”â¦,³Ê|Gm´P,¿ZqÞò¿œwUâ• ùŸW¹:Ö¹Cµ¥»wnàÎ9is ŽüŸWqv®á>¥©ú`-¹EN!„B!ò7•ÂXüajœgïñdl€Wõ~ŒíɨÏÖkû·­Wño짞U:ó4+øý¤Iv›Bˆ„<ƒ*„B!„ù柇éþr'jèÐKòhÛj˜Ž¤`o^»WëBüëú©>”zÕâøû¼Yv™BˆŒKª\:B!„B!„B!îK…â‚D»AÏQrÛVýÁm×´¾T~²7o0™±›°ž¿ÇÒOx­Û ÎZd' !„B!„B!„…]¡¸ QÕ#œ?¶S¼¸pIW›&Í‚ñØ”@`¹´œ±MÄÊGÛ„B!„B!„Bˆû‚¶P”Âá@õmLvŽ\ïr2”jÏ{Cš¢ÓP´í 6LêA¿ Ù}x;Ž¢[e/4ÚPºþºÝŠ£@Où~ Ùý}+5:Š=ò*Ó–o%âèn6ÿ<”Ö% « fù¼~tz{&›—å!£4!„B!„B!„âNiÿ ›P¼Õë48<ŠŽ-ºòÑžj|8±U ñl_zŽríêRT èKмM1öÿ¾‡äà6Œßž˜)/Ò¸Iw¾ˆlÎدºR&çyã½è²††Îæ´Y‰B!„B!„Bq§þ$4X.ÎçËy‰J8Çú©Øà×–§ËëˆÙþ—*µ£¶Ÿ]裴:Ä‚½i„4ŽÇ¿fâšH#Yõõd•iCýÀœêÈ8ÀøÏ°ãDYò!m!„B!„B!„âŽéÿ a‰;MܵïO˜¢9•èEe=¶ÓÛXÛ—§òãXX;‚NgoŠŽ°°üù”ÕÛ‡çüH‡§áÛ¼³_îdK;ró« UÖ£ÓkqØ7–·Zpxê£áX–<"!„B¸K¾š „B!„Bˆû‚GÙö lccɸ÷è7`7ùÓ½ Šßz»¥5šõs¶ÐímÞigfÙ¯{¹êòu+ÑŽb~¨=­+ûãíW†¦]ZQB¯Ã •ïH!„wâ>¿ á qe_¼²™TÙ—B!„B!Ä¿˜ž êR$b)«Ž'c6%phÅ2·5¢VÑÛOo˜/nc}\QŠ\Øž„ü}`¹”)K’h4ø ¾û¢5ã÷e2‘b’§#„Bˆ;;š !„B!„BÜvÐh4ÜxNAƒFãÀ~Ûu Þ¯}–¨L¹ !„BÜ ye“B!„B!îV¢÷ì&¹zg:Ô¡H‘0êwêHÙ+;9˜xÓ×!Ðx–§Ó U ÿù{¾^˜Äc½š–[2µÁMy{ä@Ú=„pužîQ‡Ô­Û¹d´~T©W—jrJE!„È/9z !„B!„â¾`¾¸’I³ORéÅøfÒ{t 9À´ï6{Ó™<(Óî^þƒEÇÓˆß9ŸÕšÖôj\Ìå“ ÖËk˜¶"ƒfoŽâëOzP>â'&¬ŒÂ àQŠ6}{Ó¶”‡ì!„"Ÿ4U¬%Ï !„B!„B¸È³Jgžf¿Ÿ4Ie!„ùp_CB«ÕòàÃ5(S¶,ž^^…®|Y™™œ?wŽc‡áp8@£‘'„B!„BÜÏô¡Ô«Çß«ÍRB!D>Ý×OHÔ“÷6ºíW~Ü›„«Ï<8pdGB!„B!„B!„ø*$ªzçí᜵äQÀb è?¼'µ¼¿¼ž0°§_äì¥4 èÓÉ´ð .Ž)–¸¤,ì†"• #À¨‡…´¸+Ä%e`uhÐý,Q£p`M‹%:&‘,‡þÒâ’Ñ…V¢”g&ÉQìÚ_ï8æ´X¢c“È°ØÐý,^‚O…·`ɵ!„B!„B!„ÿa…â‚;4‹?ÀÆó>ŸŽÐÔ¦÷{}iè$ìàë/~'"Cù̾Wõ~ŒðWwî$±Z}ªxųoùJN•nM‡ú%1&G²mõFvG^$&Ń:Ý^¥{£òøë-¤\9Á®M»8CÔåd¼kucH”v\dˆXj?ÓËšñŒ9Xžúµžº‰—“ñªÛ™AêS¡¨ž´Ëálߺ‡£qf¹þ „B!„B!„BäRh>j­ iÎÛ#ßdÈÇЧ~ EªÓóWiR þÏÞ}FWQ-|æ”ô¡÷&½ ‚€ ¢ ¼XÁ‚€Š½–k׋lW,(׆ŠØP”&(½JïzBzH;uÞ3 ôÿ[‹%8sv›={v™BêRFøšUþbÃ1lv*wlJȤW¤m¿»¸­©ÁîmÉØÊÖåŠNU qÆP£Ó Ϋ˜=o3®ÊMèÞ­>!Ùéxb;rÿݨšÎöÝ.õjKô)ñ˜ùGðÅ]ÁCw]Fý $Ö¬ÜÊ‘ŠÍ¸æºöTqªb‰ˆˆˆˆˆˆˆˆˆˆæ(- ñgngõö|6Š¥ó½ÿ¡Qv0±@ÚR>xc"‡ÂC±edã/AX)‹¦ðÕÔõ„ßôµv±ðÇ L\o£ïËÓ>¬ ³ø$S IDAT¡?©ûæ1îË9ŠOÃY¹5:6'.,§*´íD ÃÍæŸæçíHßp3¯Ü^ÿ¤8LŸA…6í©L.k~™ÅìC~"“=tªed_µKDDDDDDDDDD¤@©yBÂt`Ö{¯ñź `1"}¼úk£zrOϪ•0,WŽ?à÷ù79nLŸ `âJI$93”&Ýñì°'yðú”+ø6…Íî$¢|8p„ƒ™n¼î\²ö'yJ†ÍAxÙ0 —”Þ#‰ì\4• ¿,cWŽ#DDDDDDDDDDD ³•¦Ä˜žDæŽ~•—§ãMýѯŽcyšÃæÀfœÃxpR»GoZǦ3mä3<ôò7¬Í0p–‰Ä›•‡ßD¤ç0åZ©eN à Ǜ™‹ßD¸ç0eàlp%}z´£V˜¡š%""""""""""RH©xeS¦=Ž*ñé&xSXüÑ3,5Lü&€¨ª02ó87Ï„”‹#(ØÀ4£iÒ¹á—סc¤ Ù`GaÄo$…δ¾yöV.*7«‡ý´’‹À¶gI\NÛ>7ßФQÇæTÌY÷>i-""""""rvÃöjv½»zµ¦Z¤Ìøßùñ³ñ,8èÆOâÞ{Áñ_¥o_È×Ûª&‰ˆˆˆˆˆˆœ >ùnîü|ò\v\n/žü¼‚ïBžÎZîô¥{Ë x®bâ§_1go>ŽØvÜ|c#·ù¸â‘Á4¥ÁK÷Á°Xe¯G“üµŒÍwRñ’¾ÜÝ·u"r‰_6‰¿^ÊAƒ múpOÿŽÔò¸q6_~>M™§¬n΀û9«_Ï‹·»˜¾õ"nl¹‡w‡M Þ£Ã+""ÿl6Á)G•úW2äÎ[Ð¥Õj¶æÚ›ÚidŸ”^Æ$""""""rþxçðɯÁô{úu>~O\Íc–‘Zä{œ Âëv£ÖÖ±<óØ0>ÛR™~ô¤FP¡]|‰Lûs6åìàÃþÇŠ#Ù  î5{pW¾Š¡·TeýÇ/0ô?ãØXí&¸2Žà¸+xp`=v~ù"<ò_¦ætäA­ˆ:eÅQÌ~ÎêWÒ+fŸ|ø+ô6‘ {A"?ï<evbYºÞÖ›–kÞdúÊe¤w¿žÞÍ’˜¼;ˆV}zR~Çl9bB̉´¶Ú/Ú"›¶2ÔoUÛÎ5lÍŠ(úï~UùÛ¹ $0 › ;v Ã(½ 6†Í¦W6‰ˆˆˆˆˆˆýïÞù2”!·?Ïû1~’7Ïã£ÿÍçp‘Ÿuô‘¼b:û›ÝÁ뷔ŵg_Žþ•ƒ^8é+ž$Ö'”eЛo‘¿}Ïfìwïλ?ÜÌÝŒàÆð|öÿ>‰ÿÍIÂåžÃû_•ãîÿáÑ^oœÃŸ­$ÄÂßËö&ÞÏi•É ªt¿cöћغ3Àß3òUDDäoÇhи…ž‘óê‚~BÂf³Ñ¸i3ª×¨ñ§~C"?/= lZ¿îèSzòADDDDDDDDDDÄÒ½ ѨISê7lø§ÇJƒ‹.Â4ýlX»V¯c)Æý•å5ký¥ñ׬U¯Ï‹ßïSM±P*žpD7äÊkÚS7&ˆÓž3pg²qúD¦‡êÎäˆ÷Ä'/BBCÎIüf~ {Ò°•¯CõÈHØEŠ»ÐAå©Q3– SŠßçÃ0 ìvU&‘@JÅ‚D¡ý©²ð{f,Ëã´/l^Žmúú­494‘—ÞšÅ×¹ÿ·³f^zâ ü‹>áÕøòtþyúT<–[Ær>·’TÿÉ¿31~GBDDDDDDDDDDD*  ‚¶òÓâÍìö‘Àrm¹û¹[i”‰&,À“þœ}ìÞŸ3º,ŽìtòüN"ÊW$Üu˜äŒ|üÎHb«T&:ؘx²I<œ‰Ë ""ʉUéÁm‹¥N9ùv°;ûè „/+™ü¢Ö´!""""""""""R¬ÒñQkÓ‰ApÅ‹¸(xë÷äàlÑ-ôä´+¤.á½×~`Knà€ÐFCxóþ&¤-]JzË©šÂªŸaGµnô¾¸ Á™ñ,š9—•ûrðP6ÑínážÚPÅ8Īå8·Ï…?¬em©,üú#&§…U6–¨½“IDDDDDDDDDDäl9JKBì.çÑúÑБ‚G2nkEúýû:•R—2jÄ׬ÊðŽa³S¹cSòÖí$¥qCÚö»‹vGö²v[2ÕåŠN;XõÑfü•¯â_ƒÚ—u›2©~Y#·߇³luÊ:¢i?ô ® ñcfíb¬Nr鑳`+- ñgngõö| –Î÷þ‡W_yˆ++iKùà‰ -qbSMá«o¾àëun 2Xøã¾ül<+óÀIÇFµŽ¨@«&Oeú¬ïõþ£?®DÝ‹ªàð¹Èܱˆ)¿,çPd]ºöhAy=$!""""""""""rVJͦë³Þ{ ÷}ÿfPópb#€ôe|ðêW¬¹‰çº®aÄÇ[É/AX®7~ÀïónrÜ&˜&¾‚ÇlAAD” Ã$•|®<2"‡Z˜9‰ìžÿ9¯o+O¨ÍGö¾½ìŠkÎcפZÄ gúUkDäo-çH– ADDDDDDDäo$<²L©H‡£4ŠéIdîèWqßùwÔÙÎǯcyšàrlƹŠÅ ¨L8©Ùø}!Dy“ØŸä¡L½Š„.›Ø=è^=‹…g²3ÏAÕˆ` #O/l‘¿¿²±±*‘¿—Ë]*ÒQ*$2íqT‰0ˆO7Á›Ââža©aâ7ìDU­€‘™Ç¹z6Á‰Æܱ‘ôθtÀ@B·¹¨Ö²úÑm¡åË-O“æ­©_.ŽMGâhu‘OÂFâsµ !""""""""""r6JÅ‚ÄÄ© }î úõ¬ÖpláÕ¨]- ‡ ÀFX¥zT‹vb€-”¸º•ˆv®£Ûm¹[™<·½.­ÏÅ-²Øµã0ÞF•1°ãÙ³©k»ÒµY3Ú9òIÞ±„_çlãˆÞÖ$""""""""""rVŒ[\°·ý÷é×ÿ/OÃWŸÁîp¬Ú$" ÁÁA*‘¿‘ÒòÊ&›…ˆˆˆˆˆˆˆˆˆˆˆœoô‚D~^þ_ªD"""""""""""Ź $ö$ìþKãßµÃЪ„ˆˆˆˆˆˆˆˆˆˆˆÇ…œøMë×cš&5kÕ&$4ôO‹7?/ø];Y³j%6»›Mo¾±rAÔÓÄï÷ãõyñû|˜æŸ—Ã0°Ùí8ì ›MOIˆÈ߆>j-"""""""ò÷RZ>j}A?!a`ØlرcÆŸ¿ a³i1BDDDDDDDDDD¤z ÃÀnw`·ë`ŠˆœÿF7ŠK‡!vÂ;L>è-øŸ6ÂkwáöÝh^ÁäЪi|öõ"ö¹ÌãÛËuÄUI_óíWÑa!Ô¸¼?{´¤j„Ì=+™üårcžÆ÷ü݃=ÛP·B0¹ûW2iì÷,<àÆ,6Òo+CÓÞ¸ù²Äû8²o“Ç~σÇâ.i9œà¬r5O=R‡ÉÏf}Þ)Æç£ÂUOñòuq§ü ‡Åo cì.W¡0ÊÒåÉaô¯Vh·=_óï7'ÓtR¡Õµ º¡=u˸ؿn&c¿ZÀžüSrcXìg¹­¸cUT؉³Ê[|xàüøKX7C›ð¯—»°ð…÷X_þF† ÈbÔk³Hô^0g—8læ“€µÛ*Õ'¤ü7(dÁÀ±Jrìïpß| ¶àïÍ€6@M Zá…ä”6øôˆ6óR»Y<óÁfòÏu\¡My|D/ÖxƒYɾó—¿ô¥8ÞG§ˆ“O«Ô­‹?n*kÓÏ>ng´)…Ú U¹gøyi» ‡j]Ú“>ÝZR»|8W 1yâ6¥{Kœ¶U¾: þ0ÂNl6s±ê—o7oyþ’§ÎQ¹ÏqðéðIì;›|žmYË:cQ•‡=ÁU¡«yç¹/Øœw¢í ©Úž¾ý®ââÚe 1ó8¼}SÇOcyRAŸÄ£f§ëé×µ µÊ‡ã?rˆ ó&ñͬ-dúG×<û8 '¾ÀÈÍeNü½pçíÖ·sT_Oj‡œ'Â\ýϧs6FÔw´Y÷w¹Jé˜Çª¿k1æ°ì£— m5Æ8m›Õõ»¸¾w(mn»-óøñå÷Xæx= <¾*ÁØ˪N[—#º=O=ÙIÃ>g‹Ëb›Ç¢Ì±Ú]Â2°N³=¦7 ¼ŽNõËá?¸’ Ÿ~Ç¢DŘÏC¸e¿Ë¢\ÖË?¦Uþ¬êsÀâ:—ýÊótžþ‰N+S«q¶eyŸM½°˜Ï( —wõpDD¤$ƒŒ²u›ÑªÍå\ß0Œ_ o kÀÍ÷^‰cÚhžÙèä’ÁwóÀµ{yáû=¸ :Ï f³v•Ÿ²õZ†£RW†ôŽå÷OFðîA;µºæÎA—²í¹$ûN„±>¡%wÝߘCß¾ËÇÝT¿êNî¹çö¼<‰½N‹tX¤?¬a·;„ÿ>Ú#‘4êywÜv1ß\LšYòr(4ÓB·Û{R-t[‘Ei_ÊÂ÷yzµ“c_&²Wè̽}í,=xÊc•Ž(*…%1ã½OX˜r´7è÷d‘ågå®ÜwKm6ŒÁû#h;à^ºù0ϱ…ÜBùqV ¼ŸÇb›»¸cUdø¬óæ¨0?gÛº‚&yÈðÿigH,áè‚BbÁÿ¯4:`=‘ïVßã8º0PØÁ‚?¥JÀÅÀõÀuhQâj¿ Úà•®¿W\§Æù}>m|ÙüþÁë|ïì8ËT§Ë໸³ÿnžþp=ÙfénSÎY<ǯ»&5ÿo(ÿ¾ÂÍ‚¾`üöÃä‡U¡u÷¾<ðH$ï¼úÛóΠP¼™,zïM&ìõ`ØèФ;wßvÿ·ó¾ßë)q0þŒµü8Ò|:=¥“9UÛÑ:ä{}õéX+ŒÍ›Îê¡õèÿà TZò¯~¼“LG,» àöûM’†O"ÁLíëáñKR™öí‡|¾7‡Ð*-ù¿[ïäÏ›¼ñ[Þ ¨þ‚¾Í™'‹¾c‰û·¥i¢Ì¢¿›l1æ°è£;*[ô¡ýcŒ’Œ?NSLßÛY“V|L>Êr"Þjœç)n hYÀÖã¥3;XËœ ‹mÁq%*Ë4UçÚ¡ý©±üs^þ<‹J]sÇÀöl{s9Ç|K,ËǪÌýëå<òÎ2L·Uþ¬ÊöB>Oÿ´ž^¦Vme®EyŸ]½(4>/í¬º8""R¼`âêÔ¡Š3‡LoøÉ[ªw QþÞ^¼‡4/Ìž¼ž+µ¥ÊÄ=Ä{ÀˆªKãü |•Laàs‘ïñâÎÏ#?ߎËíÅ“Ÿß<6·r4Œ‰å»Qéðo|¼â Y&lœ5ƒ„˺S7ÊFR¬E:¼Òoà=¼ˆÏ?IdÓìaNró<¸róðpú-ËáØeµR—~\š³‘4·³P4á´~t8·&¾Ç 3ÇçËË$õXoÒ^ŽÎ7×gçøwÙ‘gžÆÓ“¢¨œÁ콇IÎ=9þ ­ÛµíG~ÙœJ©,œ¸.ÿjOÍ -lv•d¿dZ„±½˜c¨ ¬òf„GÈOI{3q\ýÀ……Rÿ¹!8¿Íàÿ®ÍdÔÖƒ¤Tìųƒ,‰¯ÍUí«c?°˜¯'¢Uß^´©lçÀ‚/ywü2Me^ÍÀ~—Ó$ÎI掅|;v*kÒN™®°…R£s_n¿¦%Õ"Œ„Ü«§ÿ4æÛQ ½[#Ú å¹Vk™ç¿”î-+àß¿š‰c¿gÑA7á·¹0 ·³Zož½ÅÍÌm ¸¾ù^F¿:OÛ›¸£w+*s€¥3·PµSߎøýq§îû3¹M¯cpŸöÔ‰ò´yߎ›Éæ,?Aµû3¬_ ï¼ñ‡}ú÷lr[™ÖC‹º¦˜°§ $®ÃpFÇ]|w\ߎZá¹$¬˜Êçã—sÈã B«¢ãuT.éñP«{îæëëÒ8#“š<ÄkêçÑɽjt»çº5+÷Ц~ñó÷çc;ƒcv¢½t®V C¿ÛéÓ¾:‘þL¶ÍþŠ¦l#§uàcÆÆü_—‹(ïKà·/>aÂælLNŽ³ ~¼ùùäæ4v¹[˜·ðݺT ÜÙ>‹óܦʥέrÓ÷º,Fm=H¢­ˆv—\:3>OÃ?° *±}§è2É*wRÚ9ðáÎË#7×ä¿bKº·¦i•0‚ÌËx¦„í-º}®wðéæýäx­Ž‰“ÓÚ˜÷ÐìþBéúï‚{ 8½N© ù›¢Ú%Í0V~Í÷ž›¹·cM¶l&×{™šÔÞËäÙ9”°Ÿ“¿¥Jô%” ·±‡VÜØÙÎì·?cÚނ駴ßøb\¾¼1s“H>Ãþ¯~ÎŽ*ÝŠ¨¯~Êv¸g:nå¿#g“hTåÚ'ï!nÆXö^^ø÷cXuÄZ×<ý05~z™ÿmrSñª§x©w?5š•91\öÔS´›;œw´C;|4/”¦±_&‚-œ†½äNõ‰ö$0ç‹ù¡ =81/fÑnÛ›’N+Yö?­ú·¥•E×jì“à´èÓZö¡­ÆÖã@×ï€}oWY:?8˜6eÂhñøÝä¿1–ýÍn<ý•è±Ìë!«1 ·ˆö{ür¹ÍÀã%[µ®¸™A=šGkl'È(~›aQæ·ÙÊÑùžBeðú'lˆëf1(:ÍÁÕ:ÒÎþ;ïÿ¶ƒd/¤L}Ÿ×*q¿ÕÓâ¸Y”ë¾âÆÌgf¼'pþ¬Ê–€ãŸeZü¥à<÷üHQejÝVnq.ï?P/J+›:9""R,3›-3¾gìw3Ù’å;é2Y¹<ŽÔR úkî”x2ªP.Ø8ÚQ©×׺=ä ¼IóùbN}…Q#_ä‘nÙL·œT?'…‘ºy,/~°œô£ÏáZ¹.±žds±NGÀ¸MÜ);Ø°û!-†2ê¿/òÈeLþ~}Ñw~Xäá蘲3·wHa¤­dþ½é"aÚXÆ-:LN‰â³Ѥ7Ý|¿1u[ÞÑe¡0üeâˆtDsÙ½ÏòæëÿáÙ»¯¡iÌÑ{ lvøý'¡>/fH,åÃOþÞQàýì–aX+‹2°È›Ý"?%âMbæãØœ»“1¯|ª¬“{_AUÛQ7ák^xæ]fÛ:qÏúlüøEþ=r.Æ%=hc`Dµfð“1u$=ñ:ã“šrÇK)Ê+!íåÚs{¯ò¬þlx£O¾öì—ñu¸®g­­Áy‹nÑ“ñãyé©×ørGUú éJ‡õ¶ââvV½œÑ«ùbÌl’+^Í}×Å°â£a<þúÏd·ëJÍàé+¼oRLgî¹µ»¿Á£O½ËôÜ ¹­QÅöþ¬òÁ:`2à¨Ô•{oªÌ†Ï^áñáß²¹jî¾¼Á¬ã-Éñs×Õ?Ö~æZWÂkw¡æ¶¯öôÆm«Äww§zЙ³Bí}ÑK#D4½‘~õw3öågxâí9näòŠÅÔgÕNtòÏâgžç­ùN:ßжàü°ŽÓ\&Í£Iݼ“ Ÿõ¹æ¬j}nYæ!6õ¤6hu¶ÿ¤s11êx»Á£O¾Æ—ñu¸®g-‚-Ú®?^&{±ÕnM夹ÌM8å‘}ÏAf}:†©{\ËÄ<%mGÌÓÛòZ­hYÖEbj>æY¶?VǤÈ6¦£Éìãéú”m5úY§äo"¸*šøX¹x7ñ¿¯!¯^ꆽFx3v°ñH-n¹»/W4­Jt \ Lúø;V¥û ­Þ‚*éËX|Ò]ø&Ù›¾fø‹Jv×è)çèj[ËõÕOÚò Ìârú_K¥N}é6…VídÆIçQ#o›·¹©zQyœF(UFcÚ*Ó(.B+Ó´l«wfŸ˜ÄóÞn8Ê·æb×/Œxê9FÎwÐñÚÖÄq­Ôn×Þ”èjS¢þgýÛR*p×zìcÕ§µìC[1ŠX]¿‹,w* >úœ•™ñ|5â#–Ù/)úe9γ[–C >¢#àXÁ ¤NoîïU†•Ÿ¾Â¯ýÄÁú—R%¸¸mÖ㈀ÛN)ƒ%þ––}ñ@iŽ¨\•Ðl7Moy„W^Æów_AÅü,òýÅ1‹>nÖõ«¸qØÙ„i5~³*ÛâÆ/Å×Ë¿î<ýS–#”©U[¸¼ÿX½Ð‚„{tC®¾y0>pCOùóÐ}éym"56)•—Gˆožëø@ÉtçâÆI˜°…Q¯‰õñÖƒgõîÜ}¥ŸßyŽƨQÜ0¸3qŽ“Ãð»2IÍrã·Q±Õ <ú@kLšÂ¶ÜbÒQ¹kßã¾G^dÔâhnÒ…Jg:Ÿá¨Àå·v$uâD6œ6ï%uëÖì9q·še|ŽŠtéY‘5S׺SüDFHžŒvÎþ’·Þý–¥þÜ{ßåTtx9¼~3®F=èR§ ¡‘Õ¸ôº.TtØpÚŒ“Òx?e–Çʲ çÍ0?禖úÒÖ1kUyÙûÙ´#•Ô•sXu8¬=›Ø–e#<ØAL³ÎÔÚ7•‰k’ÈÎNbõ”)ì.ßšú'w•üéËù`øè„™[S^Ìq»¾ÉËõà :Þ¡ò¥ÌgÂüݤIbí´‰¬kCÛ‚ƒ[ô¶àâãvíæÇï±y>:´Â±r sve’“ºS·rÒ †Ç÷Í%ªe;b¶NaÚƲdÙäY¤ÖëHƒðâ;UVùÖ‚cm¥KÚ¾~*¿îH#+i33Æ~ͯû}ÄoñÇC;wMô‰ö³¸ãêIšÃ„Eñ¤e%±æ牬 iIÛJÎ’³’´÷Ž¢Ãäì™Ï¨aï2;™bë ù»™1o7Y®,v¯ÛBº½ G×¼O‰Ó^†K{“G¿ÇÇ£ßã÷Ÿe@Ô>šœ€ Ãâ\ ¢ê¥Åœ[–y(bfóø¹˜…+m9 ÍÌ­)ä¸]œÚnÑPžƒ2q9iä_0¾’çÞ}¯ |Fòbïj”/aÛwtÐV–.O¾UðûwùHWXø5?û^È·?ÖǤè6æ”Å•’¹0×#ª_B÷J–òâI\ÅÊܺtªŠàŠgÂkoñí&“zÝ1ì¿oðÚãéÕ¬N B"#°å¦“{Ϊƒa}½ö&1ï›eDõÊ¿®ö0ýûÕ7ÐÇá‘ IDATCâ†=Õ¯EtHÇdÎj75êDZ¾!•²7³-Ã:fÎf¦ÌÙu¢=pF\TSd»Q‚ö¦øiÁ’õ?‹ìß–Nû»Öc«>­eú°º~—¤Ü ú¶E\£¬òjµÍ¢ý8VpR£c3|KbæÖ²R¶1ë§åG¿õb¹ÍºÌK6Æ(æܘf;A‘A„ÔêLí¿ðá{cù5³%wÞsÅIãº@c¾¢[°eý*®M˜Vã·ÀågUf%¬—áyzþW#•©u[¸¼m¨^”V¥"y× ½™*‹¾gÆ﹧`lÔ»zò.¯ÏKýc÷Dtæ³™ÍÌ­ð?½Ä}Þ.ô 93~¼.?ŽÐ+FPAxÈ÷€V›¦æF~È1-/E[·"bÛxfmÏ lœ1}/u§Yô|~Ë?9 [D]®x;WÇìbÚ#˜½3?6ËtX .Ã*Õ¤‚ë{Òܘ®T6ΞGÒ¥í¨6ßÅóBŸáfûW¯ðÖ’ŒmvÊwìÏYSyc}6¾˜³‰ï7eùƒÐzÝèà]Â[ŠN¼;þ'^yéÄ¿ŸD›—®¤YÌ\f%L㣩ý|ÿË\gKeâU$ºªrä”x¹,ö ¼ÍNÅNŽÕ"Ö6)® ŠÎ›U~ÏÁÄ’éÉÇí0ñ›~<ùž‚ãhbÅ$¼\a oå•7û_l ²fsˆÂ_m3qRã²[z4¯àÌM%ÉFááº/óÐñžtdS%Ìf±Íi7àÏN&Ã}ôãåBÉÙ”UðÞkOf2ÙþݹÂû†G“s8·ylÂ"™TO8Ñ!EOƒFÉò$€}OD¹röœHKþÁu,9DfÖñ<äœMŸÒ[WoV"™ÞBÛŽ8¨b€§dÇìD\6B££ÊÍ Ó}Ò£bd¯ûŠQÝè9è9n‰LgÝœiLœµ¥ØºêËN!ëX“á7·Ã'åÏ ø²Y=f?î9º³£Lmº îËí—®äµy™çZP±ç–uÖö„Ɖsñx»Aæ(ªÝ(b%锉{f>Fdy"ìëoÊÞi-NÃNÅn÷ÐÏé°nN}ɲ/‹ß?~Ÿ)û½€ב ²\þ‚©¤³i¬Ú^'E·1@h•â‡Wçÿß`9‚ššQ¶b(ϼÕ0°;ø:Ö#|Ã:rlNœî¬œ5•³ÀpÆP¯}wn½s(‘ï¼Ê”ì\ÌðÂìU¨>!Uh{I%.[u†.¾¯à>°„yÉWqSÎDV¥–¼ÿâÞ¿žÄ¨¶Ô¬D5Ïf¾[Uƒ6«SÉW[üO.&§¶V…‹n7Š9_”,®bûŸÅ÷oKÓ4Yà±ÉBÖZŒ9÷i²Åb¼ókÊÙÏt¼~—°Ü_£¬ÆyVÛŒí·ò—?`¬`',ÚIÖöŒãßvñd"Ë[»˜mÅŒ‹¬ÆY%»•oh|câ÷úñî›Î7s·’懓æÒ—¯¢iÌ\2ÕŒù~eƒÅq \®VõrKÏ*Lë1¬e}XföÔË¿ö<=¿¬ËÔª­t§*ïù¬9«zñÇÚ–Ä‚Dƒ Íü´h»TŒýö–tº¬Ï~‹g—¤‚¨Ô¬6åÖæµæ·cvl6xðõç™ûö±¬ßñY=^V—ôeS)ºÿ`Q»5íÛX±ã~Àïóàñ›øL›3ˆœµß0lîç˜@pí~ kž@â)·úZígFÀcU‚2(2oÖùù³êqnF.™«Çóü§[ö5laT¬IÖI³eÛ b`£-óG½5fÞ®la-bxçB5ªL%¢ìkÈöÎh*E¸ÉÈóCd mn븫‚iš7døÉÍt‰ƒ4Ü€³L,ᶌB§Rá}]„W‹"ˆx#<–rÎ%:·mÔíx|391×)g˜ß4ñ™6‹1ŸaqÜÜÖcÚbêЙ‡é´¿½ÁT£i€òóY”™[µ?Þ¯<çéù_Z‰Ç ÔVZµ¾?T/J+[iiì-«„ßÄ4NlLO™óN†¼5åëW°dÂ+ÜT¯àÑM[oÁ¤…+غqËÎMµƒÁY‹;?N‡¨V¼9ñm®.g[4í†~ÄœkؼðKž¼´,zI€ˆÈ™q%,ekh{z¶Œ%$¬z4÷n%½¡ÔjædÃŽìb.†^W­"«aoz6)ODd%ZõêEõC¿³!#¸P6"šô¤“±&⌉¥|l,åË•!Äf‘uÜIëw`kÕ‹+êÆ^¦*—ôêBôŽÅìÈ9“ÎJ>[>ÆSϾȳ/¼Äs#§qе›±¯¾Ëä}ÀA¹†-iY#„äââ ©Á%µsY·-ó”kã±0Â1›Óÿî[éÚ0Ž2‘iÙëªZƆt?¶ØŽ }öº7ˆ%*¶!=nlNöâ¥ð¶2ÔmÕ’úQ6Ëýo³8Vé¹Å”EÞ,òsfœ„žÕ{Aý¤¯_LRýkéÝ<Žˆˆ8šõ¾Ÿ'4&ÒV¸ÜìØœNpåã6qD5 ÛU5 spp–¿œ;Õ$:²ͯ¹žy«YzÈk±Ím÷IÜì_¼óâÞ\Q» aepU¯‹3Š®ÛÉ«WÞðZz6Ž%,¢2í¯íNìÎElÍ6ñçÁW®1ͪE\¦ÝzÔ¦ðëòæãhYÔ¬å«q`Ùj<-zÓµn¡‘µèzsOš‡yH²ˆWþÌõˆÓÛ`«úéˆëBŸŽ5ˆŽŒ£E¯hvd9ËKxû°r"._6’|Tiß’ª‘QÔlw)UÝûÙ—mR¦yÒ…zÑA8mGû÷~¿Ç²®žIþŠšzóäûŠ Ãiyž—ôÜ2äÁoÑŶ§ÿÎ{NÊÄ—ò;ãçûèöðýôk_Ÿj±1T¨Ñ”ƒïà²/~|%hΦ]-iú­Ž‰‡¢Û˜cï]vl+æxÈÜ€V»½X²+ÌÌL233IÙ½œõî:tªFÞîeÄÇ]Ç]×·¦N\ Q1qÔïЛž•SY»= OÚ*&,2éúà]\ÛªËÅQ§U)i³cç½%ÁIh°iy¾Á5éÕ¿>[¾ú”Ñ“3èпS¡×¶œG…úa'wC2Ù±ÍO³Ë«’±% WVÛ|èZ=Õ{]æJζÏs¶çk1KVýOËþmidÕßõ[9öiÝ–aþ¡ «ëw±ån}²ÊkàmÚï\6+ä°wñln {ÃrD”«O·..øŽ‰Ëb›U™ûJ8Æ°ºYñòã—°£ìUô½¤*Qq´¸æj&-gCº»Ø1f ã¸\½ÅÖ¡3³˜1lÀòóÛøCýÊó}žžWÖejÙVZÔ×?R/J« ô‹_6*^ymß|˜kGdÐè®ÿòÖÛƒY×g4»â®gøЪÌ|äzïââßgØýÍùùñ匹÷Y.9ñ×?ÂÜ 0´z®É½—¾—=CíAïóá#ÝùfÙ7ìÓkGEDJÌÌÝÊWÎãŽÿæÛ}Zó3£&'à ©O‹Ð-LË*þBèÙ?‹¾ eðÍO12Æ$eëÆ|²ˆÃÎ:\u< 'åêT&¼rCþ=¬G¡_ïçëçÞd~Z€t×eØ5™föã¦ÁÏqC”‡ÄMsùxÜš3|·­‰';ƒ´c]{#¯ßÑŒ¬£w…ÁÔì9[ßãéo­ã ªÔ”š¾fú¾à“Âø†w§ÝÄ€AOÒ7ÒËá- øìÓEögóÙ/•rß \ïKfó‚qŒú5ñè#ÎÎÊtpöO¶ðþ‹ý¬Ât¬|&X•AÀ¼™do²ÈOIy’Ù´·,·½p?þÏŸù’DÚr>Ë ›gd9™ñKùîÓ$ù€àcåö,£WLd~ËAüçíÞ9°_gÿÆ®¾71¤ÝnÆx!oïBö]t;/÷-‡çÀJ¾ÿx&û=Nàm¦Eܧ>PàÚ3~¾™;|‰kóv2{Î*’;{ñQ_½‡çñÑ·1 ¾õÞ‰ö‘¼y.¹úh]K\ÌÄ•M¸ý‰ôJÙÊœóØ×ñÄo¥µ ,ZØ?ÙÒâý-3øßÄ›¸ãî¹.ÜÅSøtþa\îÀñêS³¢j…Ú`Ãò¸†ã#yÕL4ÈË7ÅàÞ»œo>™Í!/%»Y'¤Æ‰¸Ì6ŽÿšÅwÞÈ3¯÷ÅŸ¶_?ŸÄ¶|Æ¢ï˜QwCGô Øw„„ß'òùÒ4Üž³¨3'å/à™MnJ¶*­¨¹Ž5Vçy‰Î-Éòà÷;O´A8) iÛ]¼³²è¶Ëêü-q™˜¹lŸø#¯£ßUƒxf@(y‰»Y={,o,»šûêÓöjWó‡Ï<³i‚¦ß2þ}E·1^麇Ï^ÏŒº·~<Ô\àë!ÔéØ߆Ož÷sML0Þ#‡Ø8ë#Æüz€ÏI>^ø(@} ¢zÏþ\|p2/oÏ&k×üvÙCÜÜn5ïü^ø<šÃÅý°í™ù'M¬Þ´‹œ«j³u~¯›-{Ýt¯¸žE}“«Pš|íýãÓzVý…’†aÕw´êß–RÇ&> ÐØ—UŸÖ*̳øú]²r/æµÌb|•k±-@ûï2¿õ䴱®)Œþùfßõ<½ŒÃ¬ž9M‘5 Æk¶Y#L°:Ž’\‹ŠßÙÀØÿU`ð€¡¼~›ô‹øü“…G÷cFX7ÓkQ®uèìÂ,&VågqýŽ(¦^þµçéyŸ±ž°h+-ÇĹgW/Jõ¥¾Aãùõã/ÝÄ/O|€^Ap½<ße¯|´•| bz|Ƽ‡Vpãµ£Ùá"Ú3rú3¼»oŇS)ÆGrbþ°J´»û¼ßäm.»k>GNù†ÄÔÏë0¼û£,Ȇ C™ø¦É£7¾Ï6·ú€"òϤB±6x±à¿ÇºTD´y˜W:üÆÓïm<å}òVÛΨÛFp\cšFíeÍö,|@HÃÁ¼|Co¼>—só×bÓÚøp­ªpÁÌî£:ø÷-ŸónÉ1ŽÊ½x~ˆƒO‡O:Ãwø‹\øBê]Ë5æ/ü´S“""òçs¹JÇõ炽QÍ“¼“äc ®Dv¤‡R/Êi†Ðèæ'¹§KM‚³ð½TÞŒýªßiª™"""Rœšþd&„7áÆÍñ½ùëòâhU}Ü[~åO¸á°p1p=ZŒ¿¿ôÜú‡±T&š2ÐKÜäÇQVõ’Y1Û£²‘ö%ñBM¸3¶åá‚ã¨OÒ“J½_cD‡EÜsûã¬I÷RæÊOùµ ¡‡ºÁ"""rÆjÿ)øûç1ž 'G¿Gœ¤ºâù|É€Ô/¼s—‘›~pÍÔ²N?í`ÀÅÑwóî‚ߧ1@:PÈæä}ý½¨}óX GŸŒhSw-FÈߎ+þg>_2€/¼É]F.×LåÃégðZ)Ù®Æõ<#OM²žŽïa–L?¬r‘¼R± ‘i£J„A|zQ v¢ªVÀÈÌ;é] ÁÕo剛ñÜô,ßõ]³grË.7ö–A—Ifžgù¶ º£ÞPœÇ~°S&Ħ#/"""DMŽ.J\ŒsQöÊwø×J*åG'ú7ƒIÁ¶’ª<\´>i‹™Í¶iÿã™iç+[gœV¹ è¸_DçûÜÏžyú¡U""""ÿ`¥bAbâÔ †>÷ýŠújžž¤|9zîBƒª#›Ç³¥Ãf¾”¬ô<|Á1äåzpÆrרƒØ–íˆÙ:‰iSÈ5aÙäYt}¾# Â×°æ¤4BD0D‡;Ø’0ŸQÃV`Ë÷©ÎˆˆH©R*$®z3U}ÏŒßs9mÍÁA½«ñ ïòú¼TÎék#:óÙÌŒ¿æNffžÛ<…4zŒ)¯»Úç}¶¹UÑDDDDDDDþ(_v Yž‚øÍ‚9;áå"kx+¯¼ÙÿØdAöÃl±A‘ Åüðg'“á>1KazòqûLü¦O¾§ ~Ó<“ô‚‰“—ÝBæp榒ä ãôç+l„G“s8“cÉ0s’Iõ„]D³×}Ũˆnôô·D¦³nÎ4&ÎZGžWõFDDJR± Ñ h3?-ÚÄnOÑÛ÷Û[Òé²òÍK%_ÇLDDDDDDäëô¹?¹¹d®ÏóŸn=:o` £båH²š/æ7UÁ4ÍsrSäéé5(ÛnmaÔ[cØ•í#¬ÅC ï\D3]„W‹"ˆx#<–rÎ̺ž·_º’X_ ž¼–K¯‘Å þÍÛ·Õ ¬Fÿ€¿‘?‡?m9ŸÛBÕgäO1 Þ^¾ûtI§~BÁ“̦½e¹í…ûiå)áoÎ}jI[1‘ùþîüçí×ñ@;rçÿÆ®J71¤]4F¡4¶È]ÀGßî¢ö­ÏðÎÐ3| [MæiwuúH^ô32/fèˆ7ùüm4Ú3‘Ï—¦éé)UŒ[ü埊~ü¥›øñåï‰ðʦàzx¾Ë ^ùh+ùÄôøŒy­àÆkG³Ã D´gäôg8xwFq?V›W{ü‹9™jßý_5~›îÿZD– öÊ7ñÃÄ«Óã.¦¹;|Câ^vô ´ßýÄß1ÿE£Çs«ÈÅ ¼nºÅmcsãwù"@س+>ªoHˆÈ)88H… """""""ò7âr•ŽIê ö^~OòN’-`¸Ù‘J娣ŸÄð¥ï!)ß씩JVüaò –]|™û8èŽ$.¢ð«•¬ö !ºJYñ)=d&9;g3iq a% [DDDDDDDDDDD.Ø glÊ; þGÝè|’ŽýX•yü›>Ž$åQ¦VB vµ—©Jå l’s ?ƒiµŸ‹#‡ó‰¬^–cÑ…]tCûÖÄ]¢°EDDDDDDDDDD¤T,HdÚã¨aØj'ªjŒÌ¼“Þ{\ýVž¸©)qekÐåþÇèš=“©»N}ìÄÃÞY?s¸ÝCÜ×¹*ebêÑû‘!T]ýËÒ k°S&Äg±_>;&ÏÂÝm(··®@d¹æ xî~º”É'¡¸°EDDDDDDDDDDGiHÄÄ© }î úõ¦#N,7˜Ù<ž-F0ã©Ê¸¶ÿˆa‹ N}ó¹'á~¹¯û‘å<ì]ü <;‹d?àÞË‚yqêäôx4ð~[>áÁ‘OóÚ;Óy$:‡íÓFñØ7{ÈÍvˆê–ˆˆˆˆˆˆˆˆˆˆÈq¥â£Ög˜dbzŒafŸ±t½k>Gt EDÎ)}ÔZDDDDDDDäïEµ‘ -HˆˆˆˆˆˆˆˆˆˆˆÈyw¾²IDDÎ'½²IDDDDDDDäïE¯l‘ ‡Š@DD KKIQ!ˆˆˆˆˆˆˆˆü„G–)éЂ„ˆˆœ¤z­Ú*‘¿‘ÔRrª^Ù$"""""""""""çÝý„„Íf£qÓfT¯QƒÐÐó_~^{Ø´~¦i‚a¨‰ˆˆˆˆˆˆˆˆˆˆ”À½ ѨISê7lø§ÅJƒ‹.Â4ýlX»ÃfÃТ„ˆˆˆˆˆˆˆˆˆˆH±.èW6Õ¨Yë/‰·f­Úx}^ü~ŸjˆˆˆˆˆˆˆˆˆˆH ”Š'$Ñ ¹òšöÔ â´ç Ü™lœ>‘…é¡„º39â5o )Qøf~ {Ò°•¯Cõ²EÄq†BBCñû|†Ý®J$""""""""""RœR± Ñchª,üžËò0OÝhx9b´eèë·ÒäÐD^zkÿÏÞ}GWQü}ß’^I ôÞ{T@i HA)‚ *¢‚Ò¤ˆ¢‚ŠiR¥÷.M”* E!éí–çÌÝ„üŸÏ뜜“dwçÎÎÌÎ~gçîîéDçÝ}€Å‹  /ÐÿµšØ¶Îdò®kÜë½ Nœ×ß#!"""""""""""éʥݰ`Û!N$§‘Áà‡é1ðªxþx»º#Ái#6ü—¯Å’ì0cõô'8onüÝÍ`'2ô0;öøâ~콊#Õ¦î!Å)h%)ò"aáQ$ÚM¸ù’7o‹‹û)4!""""""""""’aÙã¥ÖNNLxä)KYÓì?‹0V¥K¿®<âDlgüèyŽK{&À{‘ýëç IDAT‹‘*=û&ík'‡["WObû–] ³_QjT­ˆ#rU˾K¯G|q:®®ÉláʆÏüs"yt¥K£òäóI"ìðn6lý“s š}¹Öì’KH=Þþ°e¬álþö3¦ÉC»w{òx0ñ+_ŽœÉîk[;q8x•mÏËõ‹ã8µ­—<)U£Íí„M:Ϲ›ºùâ<·‹õÑñ\‹õ¢B£ú”õI&âüÌ%žåÍ6Uq;½‡õ;MT©÷íümL\x„(ÍIˆˆˆˆˆˆˆˆˆˆˆdš9»dÄù{þJrR§×`F}ôOæ®üÊ×cêãeYVß<ä ÀÝé 9.œÓ»W3cún?Çí788ˆ9ö ¬eŸ½%½M$]ËÂ?(V¯*ÞöãüôÍæÌŸÉ{°ªDq_“ZŠˆ€9'MÇ~M÷bn·õÁþÚ1êÇElÙ°€?lN ïÔý¦…¼Íñvo×i˜¼)ÝfÓ¯fÛ¦•,ù¦/ÍŠx`úGä¢7_ÍXÈ–M«X>ñ=Z÷JY/½|¸ølK0µz|Ìü•kÙ¶i%˾–ESvFËÁÍ oió(þÓ–Œ¦¶€•‚&±mÓÚ;~~f@EÏÛ7´ä¦õw¬÷ÍS›“¼Æ7s—±mÝ|¦ nEiŸ4ra´žá²ôê*­}K§œ3S ŸGùbÉgÔ÷ÿ_®™øó ª{«ëúÿízÿùNƒL\õ ­rg]øïQöuæNî@a7•²ˆdõù³_­šH‡üÖÛbÎœM¾bý÷M qK#ºù3‘ŽÕÛ2mÓZÖ {˜Û‡óÞT°m›&Ó± sP£Lõô9ö¾Ä&qp:qž5¤6o|>µ›Ö°zr?šöH?æü_ÆŽ†±ðݲ"½»Š»Ó+¤]&|ΊÆç^â†ä3OôŸÈê_Ð2Ÿ‹r0#yç+ ÚÉ?òœÁe».ëÿ.Æw׸]Œ§Ó©—û—5í&sÇN® ÜGw_§÷Ð< cél3!áL<Ïšñ£™úG,àAN_àê¾5ƒ}MéÙ´î®·Æž”DüÉͬ8Š©\C^ìÕ›>ëR>Èrûë±\>KÑæ¼ÙºÖ¨ý,Xÿ7qfÜ1[JÐuôx~˜ð oW÷Æ„7Á._\!"òÿ„Ƀ<•ëóü[ƒéûßm'7“_uÞþ¨n ûÓºÃÖ‡tããn¥¹ ™ƒxè¡(¶³»Líès í–ŸÍ#^¦y›Wøä@9Þø ù¬·§±=º.CÞ}”‹ÓúÒ¢ùK ßUœÞÃ;RÊ#|äß÷¡WØè“^oËSϾÊØÕx³_Cr™ï®,y»Ì[šÜ‹Ðîý.”ð½ñ¡‹ûѦC'Ú¦ütxo'Ïnbå‰Ä;Æ|Áó=ÃÌ·_º¹n››¹ê÷"mÙ·"û?}™ÆÏ d©×‹ŒíS?Óïz=£eéÖUšûf\ÎwU"r—Ñþõþsó±ø,O:ùÂZ¾ü~;áv³ˆüËì—XòF+žnÖŠ§ÛôgYD$ÞïpýïgÞdÞ8Á«ÊSTH}%Ì«O×ð§Ce˜…Œâ`Ã8ϳÝ?éCé=ŸÓ¹ÍË û½¯÷oL>‹qÌù¿Œòu×ã¬Hï.ãnñ‚A}ܳ4ò‰{ê=œÌ¤—ßa¹wkå`4FJ0üÈ{n'iå9#ËþQÉ®ÇnFeîºþïbÜx7CþôÆõ™Ù¿ÿѱ˜é}É ™ªÓÌ÷êX:[eÏ™|‘FñýïW±EüÆ„QÓùýŠ“ÙŠ9©[Ìe¢œ±œÛ³’ñ#>aÌÄEì¸ìGÉZQ!àFïéÄFŒOÚ÷ªGNû9VN_Æ«<=ˆ‹µá´ŸaÙ¤ Œý Ÿþ¸’µ›~åÏH²Däÿ9“+U¢¨GW’n†wéÆ<·‚ï–áÒÅý̸ ·ÇRÌãƵ°Ê<»Ãñ®Ó 9ž¸¤$âã∋'>ÑFbl6çíiœÉ_‡Âgf1qý ®D…²cÖ >Då`‹q>\æß„íÜR†þ–5G‘”Gtl"ñQ1Øî²|JºÎ&|¹Šï–O ‚Ü(ÒºÏDíàbª8ÚNè…P.\åÂ%'UÛVá/¦°/Öy[^î9)ìÎÁc箯{!”Јx¸Q þäÜ3‰é¿_$êÊ·„˜êOSÆë¶ðÍ`½tÒH§®ÒÞ7£r¾Ë:p9`(@ãw¿fÙúµl[;‹/»W#Ð žåßbþí(˜2arëo Æòó°¼8d"«6¬dùýh^ÔFËHùfYo¾¿œm1ûãNÔºk¸—x™ß¼H㞟±hÖH†ÑŸþÒ MLlø&ç¯`ÛÚ9Lê÷E<ï¼\­“^^'ö¤ýÛãY²v+¾ëMƒjÍ:u![7-fÚÛµn~3Lîc°ŸÒ‰5êãÚ‡'ÅšõgÚâ•ü²èkú·í¤½)ç nùÒ»G-rZÒi›·eȇҭÞgÚ¢•lÛ´†U“úÓâÆ·ÆÒ<ŽŽG yšŽaé·Ï]¿KãݧÌbx¨i‰ü×9IŽ‹!::†è˜X’©ÿŽ#Ù Î裬½Xš¦ån]1ô,ñ$U®nfä]>“9‹Ï±®ã“»9ZªÖ‘O§/b릕,׋º¹­Æñ‚[!:|ì"6¹®ã`«aœçY²¬«7gÂÏ°}R?ºù•kN£˜3‹bGÃú68WÄÂÆã±TfÓËTÜmçÖ`ò)I»¦°vãjVL@ë’Þ)ç[×mÑe>-yh9b ‚JòêWÃiš#Ñe9¸#å+vbTÇã5Ãe.êØärìf\æFõo8n4Ú7ƒeéë]Õ¿Ñþ·›{dp줷/÷u>"“uš¹¾ÀzÿûÃÿò„D¤%7ùoÜGi gÛwèÞo ¿EØ B0EÞjÌiŒ¢ð*H±‡ÚУsº6­NÙByò±`²Ç™xkK§Ã›ŠÏ½È#>N#>oYªW­Bµ2ùI؈8òQ½rqJ=ÔˆŽ›Ð¨¢¶d½@BDþŸs\cçôqŒúü'v^M=Ik! H~Ü.æbÒõÿ$†"ܯy=¯ßÞ™£òÃ$l=B¬Ë4 ùì"FÎ÷ⵯf³nù Ƶ‹ä»Ñk ³s[a»FÒ±ÿZ.;®ÿß·HEò&ŸãLÆùpùÙN.ìã×?¯â]g ë—Í`ܳ—ù~ü6®8î¦ ÆeÞìàŒçÏ)£øxÙ9’·B-è×ô_}»‹´ÇÃ&íÎóö9LÞsýN¿Ti8‚ ‘Ú‹gGLfÉÂéLÞ™Z!VÀ„ÕÍvÇ­s¦= ‡O^òû™oKßõzÃ4ŒëÊÕ¾•ó]Ö‹8 àÑ×y«ÊAFuiKË7çcjþ:­ ¥÷ª,3!uºPõÐtj݃ÑûJðæ°vw7^æV ÃûVâÐgÝiòìÛL‹nÌ°÷¿yqÝ£dk:æÜĈcù¨ÏhvF`h×Ál¼z«²=Ëvat¤ ;¾Hó7`nÔ‘zº æ>»ÕƬeÔ>IùøÏS~7šþ5Ï2oÕY’ ÷ÄJüÑõ¬>|ÿJ hÑô1JpŽßVlä¸#„"…sân6a .I™Â>X­V¼KÕçÙÖ­hݤ.uJbŽØÍ¢í§±VhDë§Êãyv7óîá²nq9@s÷q#9&]¥#!Š<ðu79€ÊÚØz(£áŽG©ÖÎÆ”>ÏóDãywI¯ jAA7nKÃw…°+‰8Ì^®ÿ ã?nÀ‰ï'±;&|d@ôæw¨Û¸#ï. ¡÷Ð6¹Ëg¢;\æ ™°=¿ðËáHnxöf„}û¿FºˆÜ‹Òæ¥Bü2y7W¹•†ÉÛÄð ü1g½ûŽe¹½1#F´¦°[g·ýNBŽ´©ŒoŽ’4íÑ–Ân<,©ËÁh½dÃ4 ë*ûfTÎ÷R&˜ÜÈàFÔ‘E¼ûbæ·§Û~mñõÂ?¹tõ,[¦|Ë6ß4*än°Ì›|õ²g"S~½@äÕ¬ž8‹ÐJÍ©RÆñ™ðåRvþAbš ß“ÒÍëÂÊ ÌØy+¡{ù雵D$XÓMßwé?äJ\·üÎ%· ¼Íž”nVÛÊo˜¹ëFšk2¦E7Äoû$fï»Ä•³¿3}ä§Ì:–ê˜uw±Ž=ݼÚö2kãYb®ýÍŽ} Û4Ÿçb¹rô7ö^±âï¥ ‰ûéßê? .»Ô£'Å›ÔÇmÃDæ'êâfNÞEŒ‹=í¶yû:öËké×õ}fî %:!Øèd<=±¸<ŽmÆÇjòY|¶’œ¯Œáó’™6n—4!òßàQ„×f®Lõ\ò5,~ïn¹a'bç.–{Šr>€gQUdíŽð»üæhÖŸcÓÍyºçO7rÖjE¹ã“øvÓ"#Ï°ñ‡Iü™¿>UMlîÇ0vç™ñ ô§\K*œ˜Î}G0;¢CF´¦ˆ[:ãƒ,Šß]–¿Á¹Ê(_®ËÁÝe[pÏTz™»ÆÃúH<;¯–âÒ•³lžò-[½êШ°—q[ÌÈ؇ŒÕwÚc$Wùò0l'Ful˜g—Ë\×±ÅåØÍøÈÈq•V™í›ëeFãi³a9»Þ¿ŒÕO¦O.Û̽_¸—Ëì™­SÌö÷¹?¼_¬Ù!á;¦3xǽ§ãL¾Âþu?³] /næ«Ï7_ÿý÷¯Ùé"ó»W1i·b?‘ ö¼$ÇÙpóõ¸9ÃmöôÇ“$â’˜üÊS‹|e4áNáõÜó³öFü:ýGŽýôµr-bnìíiX+Ñ¡^ÌsÉý^fþþkرæÃ(`ð-R–‚ñÇ9–ˆ#þ";æ.àô3(ë7ÛŸ1íµ2xϾ1Ýè½â²á·nÓÎÛí§ÝüÍúÐúê$^Ù~ {®´/’ûV~ž¦É+xíï´Ÿšpèºv¾õ÷ÙqyrÖóÔù™ŸMaÀ”> =‹ž–P¶/ÙÈé„â\¿=çñë¹^f¥psWuµŒ­ºÚ7£ržG¸iËfsêŠ3CíðÚ¶1¼ð<]L¡o`[žÆ73·p)Í™‹[&Gœ"âÆU‰¤Ëœˆô¢˜¿Å`™;~¹<‰>NBJÖÑç Kö%WÊ;§ì‘縜à4 ¿ózruMøÍ/[$‡Ÿ"ÂV°d ýP®&ßØugÊÄ¿œn\Ý“*͈ÓHÓky½‰>r…䔲Œ;µ…•§nÏo@šëxPáqã¼:’b¹~£ª§ÝNbLbÊ1äÀ®Pï»Ûúà.{.Ãö“×›¨·ê>1â‘ö´ßì–vÛ¼ãhuzRªåktz¬ î1¡œ÷M9$]Ç‘é« ¯dAhÞˆúžMmªx‘ÿŠ¤‹Ì0€¡¶›1RP½¡Œ¯w–¯ìfEXGš–óaL}ªÇldÖ%åï*#YŽõ,oŸ¤þ´àŸ'¿jï1wIŸ”þÖŒ§Ûy~ó²d¸OÎJiÇÁƱöÁd;ÉǧñÙüÝ\´ÃߧÐô§¨²„].ÇKXî^êcÇt"K—ç*ãqËœ våàí"–r§T¯Ì¤g4¦0*óÙœrçÛ±»¬ù,¿Ñî“S‹¯¹SÌÇÝ -z¿NzcŸŒ•«Ñ)í|Yñ-RÂu9D»ªc£²5^à2¦v5v[ă2?uÞ–Îø2í2qÝ~ã0×ãi‡A9›IØãzlºÜ`»{cÔf–²5Sײ†=SuêN©Lõ-éïW²ï€K_K‘{9ÝríÔy’s—!OÊ ¼{žÒGÿÍùxð+_ 믉Jç<èp80™-©Æa&L&p:M·¥aò.C÷±RïÌx^|y$sndFù0¾0œ¿I?Fv*Éïh˜Ý½ps$‘h·qn^ož¨×ÚõšóZ:“®ó–šE+OþºX°f%›f½AiŸ‡³p*}ÊÝx8§ÕZVæÒŠm\´§}ê¬ðOUÎÁ§Ç:ì‰$ÚØNÌî^Dýò›6¢öÓ´ÙŒç•ÃœŽ½½ŒÖ3Z溮ŒöÍÇ œ-Ë2|Ùß|yHÞ9™·;4£a·ï8]«/CžÉs½ŒL¦”üšpÊ_ªó¹!øÆ×3ÜsQ$ ‘Ë1vƒeIÄ\NÀ¯`Î[ùõËGn·XÂãì)~zƒ~;±W’ *šóæc‘Ü‚ d½¾,½ô!­ômD]J$Ç]§™DLx"¾ùo~KÅ«ds^nVTùM{‚$§›Wùß1e°6n±á Êq³]yå#ÀåË-ÓkûfBžÀ5þbÜÝéôêF/>“rÏÕqœ«á±j¯ê tø“S%»ðBiOU½È…3™ÈK¡7ŸI~áB(¯%ÞÝ…u{¿¯¾DÅÆ•©ðDub×ÿvÇ#`2â>c â“ŒÄà±—£‰Ø4˜g›¥¼Ü»å‹tî=Š%çm쓳ðŒã26Žµ¯¾Ämß™q:p8ØœF1§5 bÇÌž«ŒÆ-Æc•´ÛBaÜ2•^fãn£1€Q}Üh÷… v»u..Ï…È$ƒ¶hIì“rMoŒ”v¾Lå`TÇFeëo°Ìꢎ‹‘ÛåØÍøHw|™f™í›Ñ2ãq½ërvŒM¶»÷ƒÕu›É쵬ù:Í\ßr¿ûÃûçžHˆOø}nümß^ùÿ,îèJvù]xÌÏŽãf~m.ÖIäL¦ò*ÿÎÕ¡´ú` ^¾~øùùÞüñr³´þZ¾Ç“Ýx¶B0~¹«Ò¾ku|ï6¾Ù–¬XÜÝ!!Š¨;nÁUi×¾¾n^XM®c£cÕä]Ž—úTeç˜! ˜Nã·[dû[ÔEäßä |ç:ªvãÕ:ñ¬ûõR_I«o4Ý×slr:ñIF&$.m_Ι*=èöXA R»Ûh¾}÷Qrdä*Ï?bË=”±QlkÇZÉy^൧KX:]ºPæÌ~½osÆgQüîz\Ÿ«Œba‡A9¸j œÎTzq™Œ»†c×õaœ¸lëϔ!WŽ‚<þR/jG®eõ™xƒ¶h”ϤŒoFÈlŠ"É‘ÀÕËD§ÜÆêY¤&emG˜}ùŽÇŽ˜R¥1öSúL}“~|Çë9’9»sÆ,åœ 81—¡3‹2lä4zÙÏóû¢Ñ¼3ûôõ[‡=ŠÒþý÷°|øïí4XÏ( Wuesµˮ÷ͨœï¹lœ_:Žé•ßãÓùð´]åÈšo¾2Œ„äå|·¡&ý¿™ÏKv3oÆŽ5¿5€‰ùk1Ǫ÷göëyHü{#ã?œÅ±Dð7Xæ<»Ÿ‡0ðX•ÓÆù øpÔ/D8à²I:ϯGCxïÇ‘Äuû™'o”ÿ®oôÓ{ôÿh:]§ØøóbŽç  Ù }7öü¦öåƒa?ÒÕt†3¦°#G™tÓäØL|×›ÃfÐ3 ž¿×MbÈ‚s${TKÕ^Ò^'>1sy•wéöÁžEymÒ|^KµÚá1ÏÓc¥Aû82¦öåÃgÑ#îæÍÝÈ…–Éw÷È­T}Oÿuß±°î~\Ñ«ï`μÙ|ãM†>u¾.Žc[-WÇ£¥º½Å'&òÒ¾H®øš9-ÇòöS›è³, ݧ#"Žð¬¾øïz~Ïà0Û?OP®úÆ7/òeõ96Î0>Éà”DØj†ÉËÀ7&°<•ˆC«øbèbÎÚÒ9»ˆMöEÄe²„Ó‰ƒâ¼«[9 ?ßâwݸ¼o)#†,á¬Í(æÌŠØÑx²'Ìà\Õgµ«|¹SÖ¨\´…˜ÄL¦–ɸÛ(Î7¨lœß0“50ûÍ\Äÿµ–±ƒæq*œ.Ûb:ã· Œm錑Œòå²ì˜êx•AžöÇEG$ŒÝ\–yzõïpQ&Æí·¯á~»O{¸,g'ή÷ϨÝÜ+Ã6•¹kYrÎÉlþɾà¾ö‡÷©tù*ìWØL@¹Š)R´ž^^÷ýóâã9ù÷qöîÞ…ÉlÆb±`±<Ðs:""ÿœ3§ Aþ0Ðà3æ<3‡6oï &ÃËîsÎÆ|÷]u¾ë8œ]qªÉ>ljg¡G¨|Œ_öF`|ªbÖ+‡y¥ç|ÎÛþ×ǪˆˆÜ+ïÊÝéäœÁ·ûãU""ÿqááÙ"ôÕt§ÓÉ}ûØ»{»§óþÏ­˜L&Ì V‹“Y¯à‘ÿ*'ø?Êëï?Nò«Ÿ³5¶O·¯BÂÎÙ\Ö»£ED|n¨Wåëæ&¨,DDä_ó`½ßdº~§L&Ó¿7!a6c2›õÈ&ùOK84…á+ú1`Úb†š¢9¹e2~žÓ§Nñçþ?®ßi¡»DDDDDDDDDDD²Ì=!Q®BEJ•)“%iyzyQºlYœNöíÓ#™DDDDDDDDDDD²ÐýVæÂEŠfyšEŠÃf·ápØÕ:DDDDDDDDDDD²H¶¸CÂX†'›Ô¤DwþqOBR$W,dËU/¼’"‰¶Ýzå…§—g–çÅÓË ‡ÝŽÉdÂbQÉ ÙbB¢qïçÉ¿e.«vÄó7l›lD›¦÷Ç/P!t!ÃÆ®átâý}·çõ÷HˆˆˆˆˆˆˆˆˆˆˆH–ȥݰ`Û!N$§‘Áà‡é1ðªxþx»ºkÁi#6ü—¯Å’ì0cõô'8onüÝÍ8bÎpâ|,î9‚°D_%Þá†wŽ<äöÁ’Ök"4!""""""""""’¥²ÇK­œ˜ðÈS–²§Ù:`¬J—~]yĈØÎøÑó8—öl#ö"#-TzöMÚ×.N·D®ž>Äö-»ø3¼*ôbl¯²\Ú±“زU(æÉÑ]ÛØ°/”8M@ˆˆˆˆˆˆˆˆˆˆˆÜWÙæ¥Ö–z¼=ô ú|ø>/ÕÂݯ/¼Û“ǃˆ_ùräLv_s¸ØÚ‰ÃáÀ«ìs¼\¿8^ö±uçI’ W£y³ª߸«Âl¡Àceqûí|)ë ¸ž IDATóø34.á…Ií@DDDDDDDDDDä¾Ê6ŽÈ¿ØóW“:½3ê£7x2påW¾³P/ƒÌš°úæ!oHîNÉqáœÞ½šÓ—°pû9œ7Ö‚¨Ý«Y¾íw–Lý™ã+Å+åÇKí@DDDDDD${q/ÉksÖ²mù<ìsû5Ÿ’Mé÷å Öl\˶õ ™=¶ zÜú¡Ùr-ßá›™?³yÓZ6-üž‘jóÆs"Ü ÒyúRÆ×ö¹ý÷Ô|å‹%ŸQß?“ù¿×íSx”}¹“;PØíö4ÝŠ½ÄÌé=(宦"""Žl3!áL<Ïšñ£™úG,àAN_àê¾5ƒ}MéÙ´®Ï±NìIIÄŸÜÌŠ¡˜Ê5äÅ^½éÓ±.åƒ,7_ át:‰¾‹ÝžHBÌe.Æ™0ûøáaVCÉN<Š5¤¾÷IŽÚªÒ¬¼ïÍÿ›|*óÖÇ=)ñÇWôx¶O?ÿ.?œªÆ{£;SÚ0yS¾Ç8&tÎÁoß~À í:Óó“ X[ft낸=`å|a-_~¿p»Ú„ˆˆ<ø²Õ¥xgòE6NÅ÷¿_ÅñFMç÷+vLf+ætž«d‹¹L”3–s{V2~Ä'Œ™¸ˆ—ý(Yë1*¤<³ÉéÀÛ?‰ð³Iö+HQŽ¸hj"""""""Ù‡%ž®…iýƯŽç¡gÊá—r]À\–òÞñÓÜœºGôåã¬ûásæýíM>? æ\uy½¥•yý†1uËΆ]àèö9Œó æjUÉÈÛ4Ý ÑáãþÔð¯ÈàÉC©ŸÃJPµŽ|:}[7­dѸ^ÔÍm,äi:†¥ß>wýtŸ2‹á *Óñ¶íÓ¸¨áVNSç3êÀJ¡“ض~ L`¡Õ÷‹ùæ© Üó5¤wZäô¸#O&0ðP·OøyÕZ¶,Oïè;—""’e‹óT¤%7ù}SNζp¶}7€îý¦ð[„°P Sd<®ç Lx¤ØCmèѹ ]›V§l¡<ùX0Ùc‰JJÙÒlÂÿáö¼ü⋼ާ …MIüµçñj"""""""Ù‡g šÖ´³aÅ!­ý…Ø*M¨”rÝ ùòì¸Rž¾ÃzÓ¦V ryš þ0ß}ø.Ûñ)Y‡ba«Xv21U‚N"w|B×~K9oËÀç'Ÿá§~£Ùu€¡]ó‹¥.‡<ÉåÉoдEOÆŸ©É !ÍÈoµsqÍ—Ìr¶æ­'óQ¤Ùë4 ›Ä—›þ`zªí7^u¦ñ—ص75òãaò¡ÄC9qXŠðH!ð.FÍ<ùå@Ôͧ>`»=O¯9qË߀'â¤{«vô^èFóžõÉcQó‘ìËš2±pé5zC»´Nš&HÛÉÎ’d”ˆÙJüÑõ¬ÎSŸÇ+5 ÅCuŽßVlä¯X'¸ƒ 3—wÃZ¶¥<£9¾m«O&àT;É6¼J?MÍ„ ô=™DXý)Í+ù²}[4ÎøC|Ý«7›>Eýç?àå¡ÁÄþµƒe?Mfæ¶Kx` #Ú–U¹1“³V+ÊŸÄÐMgˆtÂÆ&Ñbzª.â|øY|¶’ÆcÇð¹=”i¯nâR†žÄÈéíGñèQž`ow 9ÉüMÁT«˜ _ÛCÜÉÄp¸NÁõ?Ì;À•xˆÞ²“Kõsàmôx'ɦ²Å„DøŽé Þqïé8“¯°ÝÏì_wÇ :ÕïÉ—÷2oûÕ¼ˆˆˆˆˆˆH¶äMÙ¦µ )ìäemqbÂÍÃäf•ðß¾(‹n 'Ø0ëk6Ì“G.*?Õ‘w?K`ŸnLºÃ/7~V¸’|+U“O16*ʉ58žt7ù±âŸ'¿jï1wIŸ”/5šñt;Ïo^ÀFÂß+YÚ7¢¾gÓŌτÄßÊéœ(Wă’ ;ù|C´,MáäòXþü†³éäÓÊÕûèt‚Ó¤æ#""Ùš-("""""""Ù‡OšÕˆcÁ;hÓ¡m;tä¹w–Y± UýMø×ÅÒ¯š;劆3ñ2û–McÖÉ*— áØVNåiBóž©5áW©#}_z„@çÝ>'ÁNìåh"6 æÙf­xºY+žnù"{bÉyÛõ´«¾@‡€?9U² /”öÌpÊŽ¨Ãl¾Tˆ† ÁçÄNýKêñd@Žo>Ibº)8õÔy <Ð ñ ÛIßB+àÅœ‘4ãA_(ù0á[¾)$ÿÊÊaDD\!"â ¡ײ5¾Í«ú{p‡ ö`hÏúT,”‹à\©Ò´]Š\`óWI ÛÀ„eNžûx(/×+Gá<©P¯#ÕäâüÙˆ»‹ì˜ÝñõpriûrÎTéA·Ç XÚÝFóí»’Ã &ïr¼Ô§*;Ç aÀÄp¿Ý‚"n©·7ƒ%ˆJuëP%øŽgUÛ#Ø»ÛFíÖ%¹¼ë,qW³Çö0Ï• cã_±iO6ÜHSDDäô@ŸÁNŸ:‘áuO.eÌç_3ó˜ñ÷ Nþ}&L&ÍJˆˆˆˆˆˆˆü«L>TjVä9‘zøžp’µ¿%R¹Y5üÃ×1è)œ)ý#&þÄ’yß0¼¥k†bú‰$pƲw¼13’Z¯ŽbæìÉŒ³6Q³òë EÒy~=Â{?Ž¤^ÒZ†ÙI‰×'°|Ñ÷ô«ò_ ]ÌY›¥Ú¿Å'&òþHB×|ÍS[Þ~*7–TÛ?‘»8íßÅ=îødÎýv(ÂÙ},GR(»ŽÆCèv\sæéÉ@]·‘ðT_º|•öî>P®bEŠ-†§—×=¥•ÏÉ¿³w÷.Lf3‹‹Åª""ÿïçÌ©BÉbÞ•»ÓÉ9ƒo÷Ç«0DDä_ž-òñ@_qw:Ø·½»wá°Ûq:ïmnÅd2a¶X°Z¬˜ÌºýQDDDDDDD²€[êU¹Àº¹ * ùíÁ¾Àdº~7L&SÖLH˜Í˜Ìf=²IDDDDDDD²Fò9VL;§r‘ÿ÷øg™L&,+‹*SDDDDDDDDDD$»Òs‰DDDDDDDDDDDä¾Ó„„ˆˆˆˆˆˆˆˆˆˆˆÜwš‘û.[¼CÂX†'פd;w¾JÚäHàÒá-,ÿåÑNU˜ˆˆˆˆˆˆˆˆˆˆÈƒ([LH4éÝžü[ç²ê·8þ1ç`ö¥äS]xq|¼)G|žgÅ~,A¯ç~àD²ˆˆˆˆˆˆˆˆˆˆÈý–-&$J»bÁÖ?]Nœ³Tåñº¹pßAB|^ò¹e|üy"—ìj"""""""""""ÿ†ìñ §ç19œ8S?ËÉ£0-‡ÍdÛ{9²g5ÓÞ|„ 3x”y“e³ºÓòíIü²¬/<=(òÌÌÙðGö®cþð÷4áVàúõ©GˆÅDŽÆ?°á‹çé>v>¿ïßÉöùñ\I¯<:JDDDDDDDDDDD2ï|©µ‰À:ýø ú^>hñu_šŽ¹]ÚuÀ£lGz„¬áý¾?r¦`g¾|¿›ûµ v«¡l+ý.Ÿ¿X·;Š Ï“¯ððþhQ¿-ƒv–aÀç/QÊCCDDDDDDDDDD$«XÄL›M`òÈAî@7vìŸEϦ˱ÄØ 8·—OGÍe{¤åÞi†ÿÆ!LÙy‘8Âø~À`NæN¸ãn Égç0fÖ>B“ ôë±lh:€fEàè‘$µ‘}àïG¹æ=éݶ&åóûã¸z’í 'òÙO; ·žåé7û š¦Þ(žÐ=Ë7j2[.Û05⻟Z±¢ók, »ã”^•<ÿSùÜñ¹‰ÛèÓj¿Ç© DDDî‡pBÂÉ• ƒèØWF-bpP(fL`ìë¹Ø¯ž&,Á ¸˜ß›¨ƒá$¥l{|=‹ŽƒgÅÛSL¾|œË7Þ_‘x‘cW½(`4!!""""""ò¯2yS¾Ç8¾~*”©Ÿ}ÀÈ¿¢ð.^‡nï ftâ+¼2ç,ɶk¬éÿ Ÿý™Xð*M›†2¸ÏŸ´þ`Ñé}NrËú¾ÆW%ÞºâయɑûÆü fÙ¯`~’¶}ÉËkóгc9Qoc[çÇ8o¾ÂFô¥ü Ý|D“wÙçèݶ8w>É-gqrÝXÉ#7%‹¶©uˆˆˆˆˆˆˆüÛ£þ\uy½¥•yý†1uËΆ]àèö9Œó æjU¹ùÕJɱ1DGÇIøé],Xzkþø[2òIãnlý'&6»ª@DDäþç³C&"-¹Éïëê5Ò „`ŠŒÇ‘’åàú™òy'ª‡xáa½þÂk»ýŽÛ/IäØâ5$5ìM§‡Bð ®LǯÒÀßÎkzz÷ž«Hî Â4xµ/OĬféߺ;BDDDDDDäßæS²ÅÂV±ìdbªÿ:‰Üñ ]û-弋ïš=óóhíœ\ܹŸËúŽ¡ˆˆH¶”-Ù´pé5zC»´¾Á`‚ä°ü8álÊ”lœ™7‚ï«Ä÷záe‹ààÒOé·ðö"·ošpx"¯ö>£¿XAŸÀXþZþ%}:Mr n j¢Íáp­‘¬êŸÄ¿V2ò­INTãùw™ñ ÀFº.°ÑôË¥4Mý¿¿§ÒyðaÈÀ70­¹hýÍ2ZßüG;‡u¦Ï†kw¼{RDDD²J¶˜ß1Á;2¾¾#ú¾{µßݹàÈ8?“êogÍijóݾÞiÔ ÀDÀµŸ‰¯~Égj"""""""ÿC®EãðËŸ®$ßZbò)FÃFE9±fÇí€=’MÃÞáë#‰€ ÷ ò´øýš¬§×‹éO*Ø®°úÃ÷øáxÒÍÏN¼¥É‘ûȬ"‘ì"öØVNåiBóž©þk¯RGú¾ôΔ)§Ø˹p!” .pêà&æ® 'o¥¼¸gè“ìÄÜÜ>” ˆHp¨DDDî#MHˆˆˆˆˆˆˆH¶aÛÀ„eNžûx(/×+Gá<©P¯#ÕäâüÙˆsµ¥“¤8^A~©&$,xùúáçç{óÇËÍ”ñÌX‚¨T·U‚-®‘ ³þÿÞ}'WWvåá•j"""""""Ùc¨ËÞ oðFØ+ô~u]B¼Iºz’³2lö \¿òÑNÔ…+˜Š×£JŽ-lð,Êk“æóZªµyž3˜¢´ÿ=,>Ǿƒ.~ˆS‰ˆˆd©tù*z<¢ˆˆÜœ3§ ADDDDDDDä?$"<<[äCl‘ûN"""""""""""rßiBBDDDDDDDDDDDî;MHˆˆˆˆˆˆˆˆˆˆˆÈ}§ ¹ï4!!"""""""""""÷5;dÂX†'פd;¦;–™ \:¼…å¿œ Ú© ye‹ ‰&½Û“ë\VýÇ?æ̾”|ª ¯3Ž7Eà0JÈ·“WwfN“n¬ŽÌ‚õDDDDDDDDDDD$Kd‹ ‰Òî‡X°õON$§½üœ¥*×Í…û¦Tg"""""""""""œl1!Ó‰áÓ˜Nœ©ŸåäQ˜–ŒäÝå¶_â·iÒçÛK´úvµ|©¾ðsxn0çõgÄ+ )“ÃLÔ_«øôaÌ=›n©×kó»JueäÀ©SăK»æðÑûãYš¬Ö!"ÿ/9yB… """""""òâãçŸ-òa}ðŠÎD`~|P}/ï¶èÍá€&|úMÚ/{Ž¯{}@íÕ™Óªë:2¿wV÷iÅKÇÜ©ñúW yµ2ËÞùI©Ö[çÑ”ï>}† Ã;Qëwxôñ|üY(G;þÄ›ªˆüÿ”3§ ADDDDDDDä?$11)[äÃú žÙ&ätcÇþYôlºKŒ ˜‡¡KÇñîóŸ3»áH–üþG73õÇ©ìðc›ïåå•gRÖûšØ§ßä½AõþOlÏïFø‹ñÎlNé…Ö"""""""""""YÆTº|§ŠADDnððpW!ˆˆˆˆˆˆˆˆü‡$&&e‹|èÁD"""""""""""rßiBBDDDDDDDDDDDî;MHˆˆˆˆˆˆˆˆˆˆˆÈ}gUˆˆH†™¨Ý»;9çÁâ ¶”šñ)Ö€NR9ÄIèîåLž¹•³‰Î›ËƒëB£°™Ì:–˜Fr7êÏð–¹ïø°X¶´¿S¥1—uéÜ´:%B<ˆ;·‹EÓæ²å|Îtóá"ÿf*6ïHûº¥Ééa'úìnO›Ë– I8ïªnqËÿýûgñ  ì¿c¡9ˆý†ð|ÁTÿ;=“w?ùHG¤át#¤Z º<[“þ‰œûc5ÓflætÂ{c2XÏp™'…ë=OçÆU)àk'òô.ÿ8Ÿm¡éÔáv+×[á6 éÅ—£×pñŽÝ1Ö¤¿2,2…ÉêZä~º£þï5ß3 ên凋8›݈g¹Œxj'ƒ¿ØKÌmݨ Ï5iÛ®5ŠáéŒçÒ_;X:g9¿‡%áôªÀ[ðåÃñìŽ3ø€Œ®w¯ƒ¾,.‘ïŠEÚ yF^{øbàTÅgð0ySäñV´{¢EsùàˆåÀ¦Eü´æ0‘vÀš›&¼C™…òÙ!ÿ[¿§¼îõÍ¢cü¶˜ÂíVšf‡c;ýXÞ’£ÏvnÉ㥂q\ØÅüf³õbr¶>פ;®H+^Ï‚8ßå2£8ùËLøV“a¬aÀׇHÈðng|\t[,›Hõ_¡cÕx~þèŽi–‰q„QXÉU£•‹1 Á2ÃýqµLµgGÆ´éŒÒªc£q™a¹Éã.“mß(/¦ ŽOïúÚD&Ç¥÷ÿÄ•É6é*Ïæ ·-ÃkÙíô®GDDÒ?Ù»T¢ժףUoÖ¦^ä]šö½žÄº|ºñèK=x­Å>œ{š¤”ÀªL™öívTò¡4Ò°¾å+Þßãvó¶=KHzµµðë…¤›ÁY™21ì?U•—_-Oè¬q|0‰BºÑ³gN_Ä7ƒ|äß»Lk^z$šùŸ`o´åšö¤ë‹58øÉ6®83^©®úаSS zuqæ ¯w«ÆOdKøõ‘‰#9Š(GÖ¤á–ï ^éPŒ“Fòõ9_îØ‹7Ú_bÐÔÃÄ¥Ú·¼®×K6X–”÷ º7ÏÉoG2î‚…¢O¼D·.µ9:f#á®ëÀa°ÝeGÊõd‹ØɼEÉ\s¨ ‘ÿeÿÒïJÔþde6¼JòüëÏ’wûTF}œHkNÊ7ìH§W„XÄ)µ<‘,áVàò 匽õæС¸ŒƒÉkÙ‡w`ù¬o™r&¯üUiöB7^Kþ„1ëÂxææ²wL‘N,ï^ˆ½Ÿ§ðïS>%Š¼ ^¢kçšýd3—³iŒ”îøÆU¼~¯q~ZˌƦ¬¡ïj\tÛš›jåì,ñ%¿z4d@&Æ—í®ËÀœ³&/wH{ x6Àõ²Ë%]ïϵ`×ÛËd{NwL›‰±¶Ñ˜-Á`N›2wÜe¶íÕÑ…\ŸÞ-k&Ç¥÷û•ÎFeaÔ&¯z¹Îs†ÚVzײMHˆˆHx»xqò»Åió¹}I¡Z”KØÎçÛNsÅëï§~—‡É¿ð4'“ÁP‚ò ˜‘àAaiØã#‰¸1ƒo ¦NûRŸ3ŽcñΔëO×ÓX˜«!y/­ãûˆrÂÁ5«8U÷iJ˜ Ëi›«ü›°]ÚÊ”‰ùó|,o7ââ“IŒ‹Çf‚Þ"áºnœVó6hGí؃\IrKõ1><ôö^¸8ž÷×ãëÏ\ârYœ†•‡ªpôgVŠ ž¶,ÜBƒ·jRÄý0‡3²Þ1" ÒøËžHB²¤„x,$&ÙHNHÀá4n g ¶K¿\32rô íçèÚ¼ù8ϯ«Sàqof\Žwç´=3ŽV‡aÃJÁ–ïÓÛoÃÖ—¡o+ÛO£QÍBXÎocæ¢Pªµ}†êù,œßü#ãæ WiÏã|çÒ.œ/Ƭã’Ü‹Ýúûjp Ú¶ŒâË#¸ˆ7Eë·§KãŠä&Œ½›ÿÂÝt3lÅ¿ÌStnW ¹Ýˆ<¶…YÓ–²÷Šíƒ•Ü5ž¥k«G(êÇ©K™2çwB“­„TkÉK­kR< ™°C›˜5}5‡¢Xó=ÃÙG§z¹ÿªýçì gœ‘¶`ò¢p¶tjR•‚¾&âÎïaÁ¤Yl¾˜|½=u´³ê`aš5(K.û)ÖMÈüC18Í®·s}|Îãd’ëöïV°9tHbõÑÒ´ª|† #rÚ'園èFî‡ÿy<\0ûP¦ùë¼öx)“O±aê÷Ì;ƒÓèXsq|]Mu¾ð(Ѐ޽kpzÒxE¡˜Ç¯?Hh,À9v.žEþÀG öÏKé.)çíE©Ýaô «¥Q6áA<õÚ­õÜçÄЬÉå4û“K¦jµëDëš…ðsDrtý ¾[r4Õ]&|«÷f`µ}lrÔæéª!8Îíaá´¹l½Òù§Y.±øl§®Aþ·Ü)øh%L»f27¹=½+‚÷áCÄ9Áâop ú˜9M5ÚÔ±°þóÉ,?“rÁæÊ:¦NáÍz%ɱ1ìzaxµ$÷mÇ(£¦p,Ã4úAµ^aÀcGøô³õ\4 E¿žä^53õRo?‰ÝÑŽ|F“÷ߤð‚á|ógyõgXók|ß»bsP·Ù8‚q¡)1Å1;•SåiÚ ú¼Ôש úo“›Ë8"ÃS±¼GñÇxÄò_­;Æe„/ýŠÑ!îDgç‘O:ãWñºÉ-0sq¾á2£8Ù8†6y¤aÏgiX)¶Ð½,:›_Î%àH󜷓£q‘ÉE,k ¦ÎË/QÝß›*ï¼Fð¡@ŽÎ»ëq„Qx¬êr îr™…Pƒý1JótxæÚ³á˜Öl4pUÆc»Óûp1Àà¸3ˆÙ2Ûö]—§¶ O33š¹qéÉû|s–W&Û¤ažÓ¹^bÜ·dOz‡„ˆˆ¤ÏÃáUs™6{5‡£ì·FüòåÂqŠˆ”k§Iá'¹æŸ`Óõ ­%Ë‘øÇiâ]¦qûiÉ·BsÚ×±ôh|Ê@êV‡¦1ôëß¹zý>|¼ò• gòe.Æaœ—Ÿí$)üNDãY¥7_~:”>u¯±xî~Òƒ¥³ÖÜuèT+œù‹Ž“z{g"§–OcúÖK8üsãg ¤n¯øäãÁ|У sX³, ³Å Ç­A¨Ý†Ó3'¹|L·—´Ëõ,†iØÂ~aêwZ¿ó_~6”> cX4ýw"ÆmÁõvé—kF¸xŠWZæ`çwCxçãeÄ<òE<â9½ó þUK`¬!T­ìÆ¡gIÜ ãÏ®>â½Ñ ¸Pª6ù=n\0~ˆ—ºÕàÚÒÏèûÞÇÌ «H×îµÉe¹£}å}‚^ÏåãÀäxgÄ,hMz!x„Ô¡ç Å91k$o÷ÇŠ¸Zt±ÊõýÍà>ÊUª>8ƒmÁ\“NÏäbÏä¼Ýo4?ž,N˦Eñ¸y¬=ÎãŽ5Œ0ˆ±¿¸QçÙ‡ÉeÁp;£c(½öïV ÷0uÒzÎÛníO²‹ãÁ Xs=DÄ•Œì?Ï~±òX‹‡Èi6þ,«Az`Â\ƒ®¯>ÎÕ9ß²à¯8’¯ã`tQ:ôhKýŠt7Câ)}?›Ýᡬþz:‡âŽ3飉ìópQ6¶°ÛÖÛítÙ‡øVlC»R'˜6|ï}¾Óãm¨—Çúú¬Ò”Ò'ç0¬ÿh~¬Tœß IDATÊåv¯|T ºÂžã1ÜÜÒ~G¿å48¶ïŒ•Òî¿­éÄw{Þ¹=–7ᛯ^1ITìЇF aPúäIˆ"Á‘}ÏÆã×ñº%³q¾áÀ NN'†ö)Ö€"Gg2äý‘L?š—6=ž¦»«s^..ÇE±¬=‚ÍßMaWäIfŒü–_£ÈÄ8¸ â\ŽËì†ã¼ÿcï¾££¨ÞŽgkz!z'éE&`£(" XPìí'è«(( ¨ *Š PA"Eé½Jè„’@zo[çýƒ2“%€|>çxŽdwîÜ63÷¹wvF/ÍkïÏWn§ èµ£^\¦]U7ŸÚc¶â÷}½vð4>½ZÅKo´âõIOó\Ø|‰þ¹E$„BÜ’“]&/#Î\Û…@Iµç`ÇŒ0øP³¾‹=ѹžÝei ã®îaìZyñŽíi¸mé$gØq,„5¹Ÿ—žiJìüÊ)"ž vOâéßeò† váW;c*CûGÚ¸‹]'³P¼|p¤%qtÅt&|6‹MîÖ<õt{ÂL×# ' {¢°ÕíÊ]Õðö¯È½ï"ÌdÀlP.IKû{Ý4Ì•ºðDG‹>ų/¾ÃäµÜ?¸eMúm ½Ýõè‡*ÜÑÓö¬<–Nvò!–.<ȹFTrŽoçL©&Ôö7` ©OcËa6:w;Ž+%’å;âÉÍŠaÿ‘d’·¯dGB.'÷s(À¯Õ['m—K¨Ü¦®M¿³ì`I‡XþûÖsϯF!¸A;ªž^ȼ]ñdeųsÁŽ—nJ-¿‚Ã4á··ÀwÏBþ:’BF|Kü™¿b\„6nIðÁ,Þ—DVæ6ÿ±œäšm¨?È/ºŒF9•Ý²§èKÏÁžôwêV¦Œù‚e“ȶÛÈÍq`öµ\ òŽ³tõq2l<@ª1«‚Îvzǧýßvœ¹¿®'*&‡r¾< =Î=3YÍŽbÁÊcóhöÇjÐÛ—Eãø:7‘©øסßs¨sr³w¥á°E3çà ÌÚ¯R³Ó Þÿ¾ò=„pùe§È:õ„ŠÉ _Ù'×0ùÏXQÈŒª+i sÖ'%3žÝ‹ç±Ç§-ò/h…×KÑÛ ñ¯­GTºúöíl:ëÄ·ƒí95h[Ã¥ÈcPÁËßCN*9®ë•›"ÎWÎxVÏÜLà#xáþº32ª(âöžÄR«*A^e¨|†•;íT®„wé³¢8”¦_½cû…ž¿MEŽ#®n<|ùXÞˆÅß‚WÕvT‹]ÂW“~ä¯ôÆ<þdJî)¦ˆ¸Bg¼n(î8_7(>GüJæ¬&%#ž]‹æéÕ˜áÞš×y1yg"ÙxÆBõV²Ò±«ç'&Ivøäeð°ŒâVuÉù3À³¾ b¦òÓµaÌ9ÉÄÛ|(Ø¥]YIdœ?¯ºÕ çDííôŽ¡"ú?àÎJ$-¿s_,Š…`*weÉŸDÐÞ—Yãø¯ºàÖ˜ ‘ä4íHó¬Nr¡͘í±l_>‡íËA1S³Uy|þŸ~À¬¸iuªÛ†Ê¹²"g0Ù¯ÝâaÿT"W.fÞòHr/{²›+ýìÅ G*±YVÊû S«^ŠØNˆ•*­P*Ì›7'Ü (Í&\mjâ»7’lƒþ1¸ +Õ7#d8N¯ò´¸=œ3›w\åK ‹¾^Ûc7²:±3}²ç±#Ùó•{Ìâ[P%ÜBEG³wT¦Y»J„»ªaˆþ„"ò©wlSäùÛ€oÎ8"ójVt Ë«¸nœ§ÿd檃¤¸!öEÜñ^gn ^ÉÙDW ì{zñþ˜¿xã|Ï㈫å̈#ÝYàÜži¢¼—E㚧à^U#.Ú@žæXc ½8b=»ëë×Aá1 ÞgzqÞßœÍpë¦Yüþ\Øvz±€>[±]áe0êç3Uk\Rü¾¯×FNãÓ«ÎÖŽ/õâÒæ,rõ}r%G‹Ìsá}ëF?n4YBqMö̳ 8ÛU¦”i/9N°„T&('–DøD܆qßBÏ^V¥øqg R7/äâü´‚OÕ‹i(ÖÊô~~gòÎWû¸xØ^>TÝà²tëGyÚkoÿ|`0[1âÄáv‘°bÏ®ð¤,„7¨Féˆj|Øp ŠbÄ`€gǽŪOÆ1+Ú~¡<~ÕšRÏxˆmG2qn—‡[Å¥š¯C*³…ìÝ3ygÕ÷¨€µZ_Þix‚¸Ëné×ûžnªŠb0˜LSPwQm ¹Ýõé‡9év|Êúc";`Å×–;dphG½[6¢y /‡çŸ"ÏãAPiŠAÉ8*˜Bð1$]‘Fvª€rAIÇ ˜Â0姟–CúÎ_xkÚAò >„•ó'ã’7¹év|Êøa"`­Ð–{ªD³;݆oÅ@,ÄâßPB̹ìÌsƒYÎRÿ]—ž? nSªå «{€É¾åX– ŸFÏ1¦Ý¥ßR¯j;½c¨ˆþ_Tõüy¢`y´Ž‡£ü}\+zû²SF#½Õ)wb_ÍÚGe¯7Ô».Û¿Û†3¶ÓÞ·ždTG*‡×/fùíM¹«²/†¸««Sýó‰ïÐQ‹ølí<,¡t{bC³b»*é’ó¨1 œ@ã.²œ€9ˆp?;i¹n¶ól;!þq^UhS×ÆêI±ø칟9ü^ÖŠZ¾{9\[ÿ´ï$.¤#íʯá×ów! àS³ ý{8™ºiûÕ5t¯× >µ»ÐÙ/š¸îÜSùsOxöptwö v¥ÜK‹fV¼cqæd6)ešÐ¼‘/±Ëc±{0fñtZ¯Ðs£Þ8âª.;…å]dÆ¥b»,nõܸõæ‹oôÆë±P¹­ãüIì÷((Æ„_@¦HròÏíåül$eÛ5®¡'ˆ*û(à ‹:cY<Ž1´ãýXjö™pP/>Ô‹óTí®±?ºÛãú»šúÔ.ƒ^>õÇlÅëûúmäi|zÕŠ—Þèx±ú¤«è<Ú·<‡(yJÄm/Æ îé?˜gŸy’—ý÷ÜÓѯ}5üåñÆBQ"ÙNlâ w+º7ÅË'œÖ]àŠÜΧ7U˜Ù{$˳Ig¯ÊÜ^-‡ÈCéƒ%¥`üêw§­²ŽßÖÅa¥th(¥Cð2èäC÷.'ñ{Ž`hÒƒ5‚ñ ¨Àí=î"èÈŽd_Í`%ß½Ã#ßeäÛ£5q1glÇùñƒÏøã´0јƕ}Q|Òï‰G¸;¢,þa4îÑJg7³75ç:¤áÆÚ†#Ÿ¤KíPC#èú`C²6l"Ö ¨Ñ¤1µ ºßÓþÌIÜŽdDô¤{ýÒøù‡Ó¤G*ÝÂÞT·NèowíìÄlØ…Ú¼'ªàSª6{ÔÁG¹¤Fí&«NOº•:Ʀy×-mw^&®z4¨è‡5 :ºVãÊ×KØ8µa/†Ö÷Ó%"¿Ztº¿yþ³™Ý¤îÙ@|­^ôlX?¿²4è9œ×­‡¿¡`›¹ˆÝ¼G£žÜ]#oÿªÜÝ¿; }ÄïÜFjD/º× Åǯ­zu!ôèzfÉÏþÛëWyÎä f3زɶ«˜kÓ©s|ÌVŒJq·Ó;†Šèÿšåqhn²êíK?=ÕaÃåÎbÿü%Ä×»Ÿn•,dßLtÙÞ ½¯)ÕË\–Z­{Ò½\2»gäçÃŒ·ÕèAšñ¶*:ç…€†ýxiØ]Ô ²`6¨¨ ¸ÝîKÎëæÒíy°m‚üËаÛ}4ÊÝɦ³Eß^Ü털A'0|ªµ¦žs/¥žžNzz:IÇ·²Ç^¶µ|È-ât¤ì`Îz•»ŸJ¯&U )Kõ&]yzÈm¤¬ø›£Wõ"U3ÞVU÷|¥X«Ð£_-̘ƤѺ_Ûp9wŒ_~¼^<=¥sä›í+v [Æ ¹êrw¥TvžÒz¹|~š×ÌIâõG6–ò¢7r¤Tgº½~eiÔ­Uâ·^§1à?ß8ŠókœŸYD P|¦²wñ@›Êù—¥Qûi¹•Íq¹×<;qšq‘]g,{Ù$c±âý8H;Ô‹õâ yâ]zûڈݶ€ik°ÙW3uV0ƒy“Oƒ\$F­âëé;IW姰ÿi—œ?=å&eÛ<Ö4Äÿ}Ò“ÌؽüµâoŽ=Ô‡a-1åTñ¶ût«ö1¤×ÿÍ:åqœ.üxp†è”NïXÓJ¯úÅí]I[˜½¦¯ôiÅê køz²öº‡§î #Ðì #ö ë¿ÿŠ%gœ`Jdÿ©R xûI¾÷k,¼n¶ŸÿÞpòÞ™¥q>q‘¸~6Kk<ʈ±]±º29±eßoJÁmŽÈ?GŒâ ÷Ô:N×È{…àˆÝί_/#ÆE½)Fk;!þõ/ª·‰Àµ÷«K'ìgÙºÏÎómjá»{«þ1ˆ“Ãs'2!ù~z`8Ý‚­83ϲoùT¾ý+»·£À1úöTsˆ…JÝûÑü̼w8‹ŒcsùûÎçèßr'Ÿn)°ý˜•4Ï¿¦NÏ»db-aÿ1²;Wã`L.n§§ìt ÛÃÑž^ O®©§®}I"A{q5 Ëî̽üøe?:‚qŒ¤YÏ÷߬»ncÀ4¾¡ˆñúþbŽóõ>+6‰;–[ÿ1ÞëŒýÔVf~³‚³NP5®yY¸Hg,{I*V¡W?fªhÆ€ŸrR/>ÔŒóŒ:i~ÌšµØýYk»<ëÏóú,*6ÖʧƒÞ˜msqú¾Y¿>õúÄ5p7.½¡Œúí¢7÷PDž ï[EÌC”äK}ízþõÛç^y¯/¿þ…ã£kí¼}çVÞû:ÿ§‘² !„7ŒÕj‘J7ÛÌÖ²õ¸-ð»gà¼"óÞý'øhÜ*]€1”N¯¿@Õùcø:*÷ú¦-„c¨Ô³_³çy¿õßüoÒ>roøvBˆâðªÙ‹nê~?j—ÊBñ³ÙJÆõ§d¼©LUõŸyè>÷³ä ¬•é=úg6DîâàÎeüø|KJY«òøWchØ„ç}Â=!ÞTêò³VnáàÞu,ýò)Z‡ž»7Èñ<‹f £÷Kß²fÑËÔ· ¹ýI¦.ZÇ}[YóÃËt Ï¿'ËàOÃÇƳxÓ¢6Îab¿!„Bˆ0ßú<øؽ42b°–£UçZØ!ͳ¥#îä΀£¬Î½®i !äB˜ÊФf"ÛNËÏ„Bü·n¾,+µ{‘Ív1²×ÝÜ9ø' }ß …¾}j$Ówòê}/²Ò¿Ÿ¾Ó”ÈÑrûCø*ã>>Ý‘Ðü[ë<Êe–ó¿—§s<° ãÆ÷ ~ò@Z·íˇÑí7ñ!*™üš¾Àäá¥YòR/Ú>ôGZ>HMé8B!DIb‹^Ä÷xèí™üápZ§-ä«?cq à]÷aFàÔ‚Åνži !äB9ØøçFNÛäOB!þÛnÊG P¬Á” 2³yÏ,žì¾c–“‹o‘4S±sO¶|ÂkN“¡ÂÂϾeà¼>´ ZÎß9»ÿÁ¯lLWïÓŸ'ñêòhRUX:é3ú,HóRóPœóŸcÚ¦òˆáÛñ éûy€ô!„¢$Q³8´øKÞ\|åGÙ‘_ó‹7&m!„C%¤’ÉÚþ)/lÿ§¶B!„¢xnÂ_H¨¤¬|‹§¦¦ÓùƒùìÜô hJè%K+F¼ɈN /ÿæWúiÎØý)ëwî±M®Ô“Äç©€‰ÀrAÜ>šeÖ°uã¶,~‡¦A>^”±|(óOز''QnçB!„B!„B!®ÊMø þËcß0™¡¿ŽÇ«|+žž4Ž ©yhþùï¸ÈŒÏ% n¼8Œ0T œ%‹eÙ.ðõÂ{+\d&d¸l ]_ÞD€1jµ‚I:•Cí¸ÇÓí*\“ž/£ÂÎßØœzùó]Ä­žË‰/0âî*” ®Bû_0ëÝv”2ä5g5Æû^eèíå)U¾C^îA£t!„B!„B!„âj”ˆ_HÌ[˜ÆˆQÑ·°‰~ñÛ˜þÅéüÇ&99õÛ¾nö>_¯| og2ûŽçõygp¹-¬ÝÆ» §Ýõ%ž/œqïÌek§6ÌäÅ‘ËItxÕD>×™¼öV>øßL6–7“9Ÿ1¯Ìæ„Øù#¾ø?>ødÏ('XúõÖ…Ô—ž#„B!„B!„B\¥v½FªTƒBˆó¬V‹T‚B!„B!Ä-Äf³—ˆ|¤)„B!„B!„Bq£É‚„B!„B!„B!n8YB!„B!„B!Ä ' B!„B!„(1Ì•îãýÿëA˜+?ȘQ 3]§Ä½ëóÂøçhêsƒò~=ò{ƒó(„Bü›LRB!„B!„(‰œÉÛøm¾ƒ4·äW!„¸È‚„B!„B!J$SHsêÁäƒgH ëÁÈG],ÝW™{ïªCi× þþáæDe¡b âëÛžúeͤYǬ²+ÅY ±²ÜóÌ£Ôõñ¦Ö¨aðÁ÷)ß©ÐmÌ{2òa;ËÕ澆§˜úƒƒ˜Ø]έ*aŒÝÀÏóÏÒä¡4+g$vít>ûe/9žæ×àMåv1°[c*ú)äÄîä÷og±6©ÔeyœÎéZ=ü@+ª:ˆZͬŸ–•á¾"_|¼r÷ äV•ðw§shÅ ¦.8D–*ýH!DÉ!lB!„B!ÄMÁ\¡-mÝËùèÍ·˜°ÆL»û[PÚJ`S?Þœ´…yùµqüC†ÝAicñ,›òQ9GùöýoØih¬»¹B{ºíä‡oWpÖ – -©qâgÞ~ó3VÚòä°Zìûú]^¸ åö®4 V<ί1¤{”fçwcxéõ™]ÞÝ«b½,‘>mxò‘êŸ5–—ÞøŒ?sZ3l@# —çq%éÒ·Öq~|ïM^ûd%JÛi&÷¡ !„(Ynê+“Á` Þm ¨T¹2^ÞÞÿÙFÌËÍåä‰ì߉ªª (Ò³…B!„BÜ‚ðq–®>N† r"Ú,«¢Ü UO/äÛ]ñd©°sÁÚ½sµüÖ‘˜^Øó“ô·Ù `;ÎÜ_ו£b*®”H–ïˆ'×nfÿ‘dÚD¯dGB.öÔýÊh€¯Õèa~Áº•)c6‘‘š‹ËLnŽs¨å²»FM„6nIðÁù,Þ—DŽ ›ÿXÎÝoµ¡¶ï.v]’Gð+ŠÉ _N¬aò;Û0乤Ï!„(Qnꉺõo£VDľ½¼½©]§ªêfïîÝ(Š,J!„B!„¸Å¸²’ÈpäÿírîiDF|Cüð‰x„÷?î—ÿ¡‹1(/º QÄ6€;+‘4ûÅç©Ž<ìn·êÆ‘çÈß¿Šª^M~AÅLå;¦kÃ2˜s’‰·ùpeoÀ7ÈJvB:糡f'’ìð%¨žcL»Bò˜n÷b bqŠo(!æ\væ¹Á«` x‡†àˆZÄgkça  ÛƒšÃØUIÈ;¶…B”%bÖÚAÇn­¨l¹òŽ{:ûþœÇºTo¼íéd:/^ʽ¼½.~Ï•IÌÑò|+R­‚J^<'N¦`(]J¥ I÷z»lÿÿÆË9¼¼½q»\(Š‚Ñ([!„B!Ä›Ô=ˆïÖ‹ž SùóTëø(ƒëìäÃâɹâ©Ef¼­ªî6)74¿ ³lÙdÛULµéÔ¹ >.+F¥`]$îÜFj§^t¯—Àâ“õêBèÑùÌR!èÒ4ö㥦»ùüËUœ1¨¨ ¸Ý²!„¢d) ]Gô£üº_Yº9÷Ê;'™J FŒ{„úgç1zÂrNÚ4~ éÓˆW>zœš§óÙo”ªÿo<Ó çúŸùn{7üɉö?iþIlÿB]ª¨çÞ#!„B!„BüG¸S¶òÝO¡ êó CL¤Gobö´µÄ_>àHdÿ©R x{8yoOÕÜÆ|csKʶy¬i<ˆÿû¤'™±{ùkÅß{¨ÃZãÓíó8©³‚üÈ›|ä"1j_OßIºzy]$®ŸÍÒ2blW¬®LNl™Ç÷›Rä×B!J¥v½Fÿúìõ+ïõã÷ѳ9î¸ò3SH ž5„–@â*>ý+rÎeù¾ùÏyTm$G'Å܈W?DÕ#0y~$dzªÐëþxšÏŒµqƒJaÊJ%×mƯt¾¶Óòp›ý -_Ž «T7¶ô8â“2°¹̾!” ÁǨ€ê$;é ‰iÙ8ÜL^„„—%Àì¸bÿS–œ&%ñ ‰i98U“5€RáaZ ¸³Os<& ³ùqgâxl6–àR3Ï}×'8Œ²!¾hÆ÷ßb4™°X¬Ò»…ÅbµZ¤„B!„B!n!6›½Dä£d¼h@u£¢` «CëIöœÌÆ ‚3èõüňäLúð· ‹—PÌV¨Ï]ƒQC1bŒx€áÝRykIUš7®;m)Þu‡1nx}R6m"5¢9µ¼“رh G*v¢góòXÓ£Y¿lÛNžâL‚ w aPçz”óµ`+×ïçTRqéFÜÿ<ýï¨N°ÙFêÉ(6®ÛÊ^Ç¥û*ïK^›f¡QŸ'éÛª*&g±yõfvgƒwÝa|ìI~²À»þSLxª ›·‘]§Õ¬éÚ¾•»Ï’#?†B!„B!„Bq0””ŒË´ç¥wŸãÅ·ÿÇà楰ø×å‘WŸ¤m¼‰ÉcfGš[³&SëXH,@Üzæ¬ãò\(#åÚ܆WìQ’¬a´è;”·)?”ˆ¡T :´­i™˜kÜÏó6&4u+VÁT§ }»ÕÆ7Þuú0´Cu¼Ïìfý¶h•›ÐóÞ¦”µÜÿ:~Û˜KxÛA m_sìV¬ŽÂV®>]:ÕÂßài~*b=ÿ+ƒ‘ mêà>²…güˆhÛƒ®5¼oü»1„B!„B!„Bˆë Ä,H¸Ó³ópJ»§þÞŽŽa@Ê&¦|4³¾Þú™U¤Ç'“ ¸óÒHé8íl IDATÊ°úœÄ¤õ ˜1ó~Ž´£Æº¹s˜þÝ/lσf—™jíãã:ÊÌ/¿ç—9?3}gÆJ ¨]6œð2XT7Žœ$NîXÆŒŸ0oc ¹—ì?äl9§WóÓô¯™ôÓ v?KºðñÇKñ4?¿«;–±xÃVü0—£nÕ”Ç[ú°B!„B!„Bˆ›€©¤dDµÅ²|҇؟~•A } õR73åƒìîè»w1öëƒä]ã~lÙç*Ü.7`'Û®‚ªâÊô‘Ñd% ЂÁXƒ!Nbˆ *ç‚-.r£×òçÞ»h× êÜ…›,ŽoYÃéKKC^R‰–JôøCÊšÉI/7/o¯[º ~•¨V!£Á“úÈͳ·B_JR’T‚B!„B!Ä-Ä×? Däã¦~dSý ¨]§®ô¦|öíeçömM&ÌfyäŠB!„B!„Bˆ’ã¦þ…Äþ={PU•*U«áåíýŸmļÜ\¢e׎íŒF y—B!„B!„Bˆ’å¦þ…ªŠÛíÆérâv¹PUõ¿ÛŠ‚ÁhÄd4¡ (Š<»I!„B!„B!DÉqSÿBEA10bDQY0d1B!„B!„B!D‰dºÙ  ( F£ £QS!„B!„B!„(©äeB!„B!„B!„¸ádAB!„B!„B!„7œ,H!„B!„B!„â†+ï0Eбk+j–²pùë˜w Ö±xÍq2Ui0!„B!„B!„âfT"$ºèOùõ¿²tKW¬9ü¨yÏ žå3Æ­NÆ-m&„B!„B!„BÜtJÄ‚DmK¿¯ßÏqGáŸÇÓöÎÒXV'“'m&„ÿ%ˆ¶/=M™Ù37Ö™ÿG¾Õ;ñø.4.ëæ̶Lýq-§òÔ Ÿ‡Þ9”®qÓùéP^ái(^T¹{C{4¥¢¿‹ôè-ÌýîÖž±ç/TŸOc&Ë‚zðx¯Ô*ëEö©­Ìýv«cl¨EæC#ÿ†@Ý?˜wEPÚê"ãä6~ÿn&«cì¨WS†:¾5†G+ø^ôtž»‘´KVÓõòéAŠÚ—j¦L³ÖçjÚ8½k1Ó~X͉ÜËÒPt¾§û™^[éä¿È6Öê_ÿ>K…n¼õZ æ¾>‰Ý¹ÿn^ Aw0ê­ºÌù GÂû2fpG/á¬^uy7àµqXõ¿ lË–ÓØϹóg/­Šî/BQ’˜+ÑoÌ›tõÙÎǯNcß…ë°‚w¥6ô{¸ -k„à­æp#ó~^Àæ¸ü±…âKµöðpç†T/ã‹;3–Ès™þgi.ÀT–{ß}“º¿½Á¸}ÿ¿àÅþZ¯¡ÿ¡k°±T#ú<þ í#BpÅnå—/g°æ¬£xcíûè”Ugܶ?Oï3c€ë2–5Öõ-Æ=vÙ·²Y÷á›L;bÓ.»âYœqUcgC0-`PÓ\~}{kÕ…×­'±„õ^ Çê×Ã1?íx >­—ÏKÊ:‰ý5î+<®Õ=fL”iù`!ÛÙñkñ2´^Ê«ŸîãŠj÷8V½üð¬Þ‹jsÏÚäjÏbÆ¥7|è­ÎÓ>èäY¯ý(fÛþËJÄ‚ªª!r«¨žåd©ù sÆZ™··Cz×Å|dïN |®3¦?>ã•=fZ?ñ /ÜŠ7fFcÏÌÖ­“Åέ.Bj7/4 S¹Î ¿¿4¿x‡ñ1&ªÝ3Œ§†µãÀû“ຘÆîãÍxêùœ>){íTéú$Ï>Ûƒè·ærÒ¬“üûÖíÃÐVÌû*;3¨×s8Oº=cÖ’¬z^˜)ïÇâ _²:ñÜ•ßíÈ ã²A€^}9ŠªKöe®Ð™ç«NäWïòéi?Z ÁËây}Z9Êc.¯ý=‡Îgv¶J´jçß­×Ænzý×'BÊsÏã=©äs Ä–Τ-Ìšã(ÑMQ2&SêÖÉbëÜ슕þ"„¸¹X*ÜNsïXN:#¸³ºûöåœ;µy×fÀ ¾þ[FO9Lš©4 ºbÈó*qÿ7—h‡Õ|•7['ñÇO“ùædÞšrßcOñ¼},c–Å!k³×³¡*óÀK¨²éÞú&r†ñÄãwp`ìj²¯f¬}Ä>zeM(æ5Vñ4¸.cY‰«?ååíæ /•5–mψþFÖÅØuË®?\ˆ3®vìl.K³úNæ½3‘U™éóváu›^D¼xÕŠ¨xË·¾vŸN׋yL˺Fi謂 kkk§ŸÒ†§ Ýîw’õŠëa¬zÅfå<¨÷)^23.µßà|éÎ/˜µÏ‰^:yÖk?KñÚößfºY¯w^uzÒdæ ºM`À7?òÉÄ¿yãánŒ ÈSŸ¤ó´µÌvvaÜøœyo ­·ÂíÏMbÜijztí^gd³]¼Úk»1þË7迨/?W+ìï}˜ê¸1#*°ìÅû|ÄBóg?çá YôÊVÜu†ñù áÌÑ_â«óø§ŸQßgÞ¹Z­<Ì䔌€„7ÏY—°5)oÉ&Ýá{é'UÚR?w=­;A²–ÏÙM§a-©ø[4Ç`¬Iý¼Ýü˜çE4pÙȳ;°çå‘k3b³;qäåâÊØžOcN™.”‹[Ê”-±d¨°gÉbŽwèN­ ñ¥uòáÔÊ¿‚#~-ß|q–½1Y}Ìää:°eçàPàÊÕrízP,Á”³¦±üD< 9—G¾´xýcÆM`ÔVí|žÑ«KçÅ4^ž¤±/åšµ èÀ/,Ú—DI¬ž»†N¯¶¡ª5ªÀÝ(&Êj~ï0é:iÒi+½¾pR·µëÕsêvcè#wÓ ÌLÚáÕ̘6ŸíÉN0xS¥CïÙ”J~ 91Ûùå«ŸX}Öæ²´yd}ï¨L€;Ë~`ʼƒùï­2Q¾ã#´ËÚC²Í|Õû5•ïÅ»Cͬ;^®m*cŠYËsÎдoZ–7³ú{Æψ$MÕË»Õ;>ÊÐ{F;VÄš“†)´%ýÌ`bT,¹h”11„n/¦ž¯7µG? ï|áŠ] ß—‡å²T„±’øøýeÄ»¸âߢd9þœé×’‘çû‹±ð~Ÿ[ÎÓ>+õ*„øGf¹©xG#”-Ó™éÀ³wVÃgÿ>rT0V¥º×Iæ.ßÙ,€Ólž;ƒ Á­)íkà¤Ò”~Œ,÷5 NæO?%/ç›Âxõ®Z”ú;Ž„"gKÂ<¼†º iûïÜÅØ—sV©È£ž!lñwœìXpû©l˼5W…­•ÛÑʸ‘O—"Á‰ó>å½0 (¸¯j¬]òcí²¢;nÓûL7žréŒcõÆ¿he]¹i$¿‹ÝJ‡G#8üóçÿºð²ëÅçã ±³ÖX<>Ï£E /Mþ7÷/Úu«KèÖ»výéÕƒâ§Û?jåÓzIY K,q­‘3:é{Wn¢o Þ•èòÌCti\ç™Ì›6ƒ•§òPõbU½X©ˆ8]»ÍuÚäz)f\zì†Þ®ß?ôÎzy>®Ó~ºó² qý¹Î®à»%'È̳²n[,}¬ÓYz2‹¼¸µlMì@·™2MûÓàà$^]Mª K'}FŸEi^j6«P¬Á” 2³yÏ,žì¾c–sõÂÿî2,bø}—Û'œ¬t;^½1âEÍû»b^òÓw&G"Ó>ßHÿÿ;Ì—i¯‡S r‹šâ&¡f²ñLö[ª1¸öÀK&-ýË—Á”´…Äü »#é8©¾-õR8æPð¯]û®Ùä¨Ùi€3n%ßüÕŒ÷ÿ7Ž¾Žƒ|?j3Éîü}䧑tè[FÍ%õÜïðñ)_‹ÒŽÎfƒ#|djå_ÅžxˆÈDðiòSž©…Áv€ßÝ]øšõÆ€0LÁÜ=â]†I;º…y³–°;Å ªc ¾å‡ÜD¬5´òi$S¯.3ϧ¡±/0š ¨.õâ;—œT¯PÊú*ì/ðUíïÉÒKC³­ ”ÑË¿nk׫Ǔ®AÍyâÉÛIþi#Aûžå‰§S8õÁJ’CîàñÞ¥Ùöå;|c¢vï êUM_ÂÜ /Ô>ÊÔ·>ç¤oKž~¡?wo~ùgœ˜ÂÚ3¸m"³§ž ×« ®z¿)€¥R+j®øˆÿÍó¥ã˯ñÌÓ;ùfÌH~ìÄë/ö ÙŸ{XéÒJc™5îç¹^¬šò6+B¹û‰giîyE>Œ¡Ze<ÈŸŸ|OýqXõö—ì0·ä%ü¼»L¯\irF¼™–#.žƒ¹íB ä§ÑïyØgÿN– !Ä?1Ë]‘v \lr”cêr_nC-ïýìÎQq¦bOFïGಠì8Kª-š9S¢ðiÜ„ )ù.Ö~ɸ/kÏüßgCœqž_C7ÍæÏv/2àöüìÝŸ6)óxoÛaRö~OÝüíoÝG6)ø•¯ˆwæ |gëa;µßg,ä¬[…«k—øØG¯¬ ÞµµÆm Þ5µ>Ó§Nxkñ:㵌e ø7¼.®e|p ÿ®zñNq†ÖþôÆ©«¦|CÝ1=‰ý¿Îƒ…Ö- KèÕ»þ¾m:õ`Ò‰ítãG­|:\Ê:…6¶m-,®uaÏÑNß°_+v ¾5:QuædÞœ‘M•nOòÔ3Ý9öÖ\Në”G·Žtc8­>¦×߯gqãRÇÇêÍ/(„hž?ôó|Ò_§ýôæ!Jt”r³.Hز°;[âv¹ÈË°å/®»óWêL– "àöÑ,Û°†­×°eñ;4µ˜ò1’²ò-žššNçæ³sÓo|4 )¡&Uãï ª^Ôí?š™ ç3ï›Qô«çŸ_yF‚Êûv<G~ç³%ž"ÕYt„âV˜ì2{›päÚ. LÝöllXð6_j7p±ëxŽî P–Ê=x¦‹‹ù¿Î°á#ùdu }Ÿè@Øei¸óÒIN·ã6X oö¯¿Ðœ˜¹¿s §ˆ|x gçD>ŠOÖ–¢ßðN”»Ê%{ƒ·Ž´/ÿ–ÇÏ`« ÏŽ¸›p€“ä¨lÎÁ¤™Ï¢Êp>,ÐÜ—“¸]û°×ïA§šøT¢Ý 71 Þ’¢÷=‡nÚm¥ŸÝ6¾pp£T?59;âÈÌŒcÛ¼ß9Z¦9þÜ©›ùôÿ&ógT"Ù6¹Ù,¾Œ€¢€bö'Ø×DvôJ&¼ù1Ë\`*ËÝÝIòœ9Df¹Šµ_Wò.–l''ë4{%‘¼í/¶Æç’½‡ƒéü¬&4¬T¹³® ¿ògTIùó×M¤2¶Ô+ãÕä÷ê¾'Jþ)úâùó’ž Õï=ê³2†Bü3¬UZs›}+ëc8ÎlckNMÚ×òA°gö{òÓ^¨Ýe(c'ÂÄ7§w£PÌ(xøcÌI!ûºýr¯ˆk£3Ž?m ¨ÏK¼ÚÍΟ·“òŸY»5â`Å»zjÄ,bÒ„i,MoÊSÏÞ}ÉxúZÇÚ%¿¬q›Þgúchí1^}Ò“±¬9œŽ=ÃÙ1—¿~,"ÎÐÙŸ§ãT½~¤KXtÇËí»zÐí´û´§1v\«Ÿ~QÛÙãþböšã$§Ç³cþvy5¥U9³nyôêH·<šmnñ8†¹ÅKÿ)W¶ŸÞùC?ÏzíçI_-‰L·îEÑEfB‰ËÆÐõåMd©V+˜¤S.ü+—Ǿa2CWùV<=iR1dCp!?Ìsyï1¶õzžø »RtœÆ_ýÎï'àª!˜9ƒ °†V$È”PDäBˆ[Gž³÷ÅAÁâ‹yP|«Ó=ÌÎRu/Eá-šâ`&K¦c"/ääÝi¼’ey—¦að«I·Ç‡Ð-ä( >}—å‡3qcÐ͇^pé[®*em1D'Ûqےس|qíZQÍ÷/œ-_aLß*X°qðûw·>­›¹ìÇ~ãíQÿ?s.-?¼‡F¥þæì…[ÏõêËíqôöµ$z“ç`Øóò !‰Ýk¶sÖV‘ Û¥m`ÓùžögFÂÛkµÕjvjæ_¿—&^ë-rF|Cüð©ûã&=rn¢cû¼ ¨YªÜÕËbÉN&Ζ?™Jæ®øį+=‡½Ë@ÿvý½€ßþ܃_›t̘Ïû»2q—*Þ~ÜŽ\ço p»±ç8òçTÜjQiXÈ6‘~ íÂs®igIwV¿"'ªªUƫɯÛãr]~)Šœ K¢KÎÁ¡z‹F¿ßE¢G}V!þ ^TkÛˆpÞù¼3* &³ çµðÜE¶ÁŒÙÃÖ%³Ùºs)jßÑO½„ÿÇïò{fªo)|Q`Lñ®Àí­Ë»qW’} µŸ^ÏŠÄ®<œ5‡mÉÿ¥gª¸nœ§2ý¯(’Ý3g>íÆu¥a©¤›*iŒµ—q&Ý} •u# šã6#>šŸéÇÚc<½>i¦LӢƲ >µºÐÖ¹ŽO{v0hÇÊÜ©½?ÏÆ©èÔí¢4c‰Í$ꌗ‹Þwáõ o­ C³O¯À¬ód^ZÞÂãZ½øôÜ1£µ€3ýìʼnG 1&*x°ЉS´êH/†[ÃÎZm®×߯ßt¶vÞôâÒ>úÖ_8ªÙÇW²C'Ϻñ¿Gó%O‰XH7–¥¼ŸBtªZè…?°B”ô\®îRå"nõ\N<ý#î>ËÔÐà±1Œk½Œ¾Ï„£ø¾Ë žzvGLç^šír)„úw£Õ¹é¤çº1—nÁ ! ðszcVò8ðû_¸¾Á#‹Gò[|U†<Ûše~y8Qâ_0"„Es“y&g‡*”2E’íshe‚²cH´O݆˜"ç‘]Ä$–êEQ EÅ­*øT»˜†âU•^}’zQÓùùR]žäCÕ .K·Ìïy㇣ØÅlŨ:°»]$,ÿaË=xø×hÎmƃl>”p»8Ü*®Kfðôòéò° úû2˜­dïø‰Qƒ°V˜çlî¥õ ÷=½Ï´ÛJ¿ ´·»>ý0'-‡´m3yã«(r ¾„Wð'#ÞEHÛ¡<^o?˜ÊÑ,>M^f|‡sA›OéPûæ3~õoXBëÐóÙa<9 «S¦nu>™:E1b0À‹ŸŒæïßç§cvöë„rךwRìVÂDvÀF éÊþÒZ«ŒžîËéù÷ªb8ÿ3[s`>†D9–8—ž?/v­~š1¤Ö„%„wî¬gcÅ„±,8sîe.×ÿ oC„_$‡"žc|×m¼ùÞ¹#«Ž®]ÀÒ6ÍéXÅ{äN΄ÜCûŠ+™m+0ñØG{9™²aëuk8Ï¥]§;]ýŽq&´'ݪìç—hÛ¤±\dœMåÒ᪊KUq©zcmõ+«“,Íq›Kç3ýxJ{Œ§×' Ô|¤ˆ±¬âC»j‘º~IÎMiÇfÊ5ÒÚßXþ,ïÙ8U»nõb ½ºõ`Œ\h=èÅ[ú}ÚÓ˜G;®ÕO_{»üIÞÀp‚L»Èqæ`ÊûÙHÌÿ-4Ê£_GÚå±è´ùGlõ(†¹6ÅKo,ýùí>îÒ=赟ög%û["~w?oaF}ÄäO?¾ò¿Ï>äV§ùméé«~ºëÌ^{k#µ_›ÉÆu¿ñ~ó(Ƽ2›N'§~Ã×I=øzåz6ÿ1š;öçy§8^èßOszñDf»Ÿ`ÁÖµüýEo2gýÀîš#™Ð³,ö½_òü”4îÿj)ëg<ŽyÑNçÚqªzy1¦âÖ½ý>wгYi¼|ÊÓ¶G#\»¶ãô¦zc3‘‡³ŠXPv·m+éuï§gƒ2øû—£yï^T>³‰ÝiÖið¿í^:(«™µú,æR¥)Sº4eBñ2èäÃQľwÆЬk•Â7°"­{w$øð:g]Ý\õmÌ€áé\7Œ€€pšöº—*g6°;Õ ˜©Û”fUý°éäS¿ çÓðEÑÙ—¡t;^z÷ºÕ %°t]îíׄÌuÎ¥a V³¦Dt¿§ý™N[¥ºuò¯¿Ýµs“²{ñuîç¾&eñ÷+K£ûžã­A·áoP0˜Í`Ë&Û®b Š Kתx›­…€ÆðúðNÔ ²`6æ߈àÎeïÔ‘¼ôê(^}ã-^ûp±¶c|;zsO: Ô#:û½y·qrm$†6}è^7ÿкö¹ ÕÏÚe<ÿ3>U?¿–Ë—‰+¤*ûa ¬I×5ð’;çKEë¬ÕïåN!D‰9á[½-õ{X$™´´tÒÒÒI<º‰Ý¶ê´ð!çØFŽ…=Àð‡šS#¬AÁe‰h{=Ë'²ë`:ŽämÌ^«Òù…§¹¿y5ÂCèÑü^ž¢!)-ãHÞÕd§èk¨âU•ÞjõÃWLš“F›GÛ_|$‘bÆÇrkÿ”0ïØ:…t¥ß•ò £é½÷R5n3‘)¶ë6Ö.ùeÍÕ·éé´ÇÐzc<½1dûõƲ^Uh]#‹Ó=¾ùW;FÐß_‘ãTOú‘f,¡W5êA;¶ÓëÓcí¸V/>UtãaP1‡u¤ïU ö£Iï‡hœ¹‰gíº±ªvéÅp9:mžía s-Š—Þè3„þü‚v×ϳvû¹Š˜‡(¹JÄ/$’6ÿÄÿmöüûö#SèÑ㿈ß‹®çÿi‹bl·‡.|÷ìêÏ´ú³+ÃÿÌH¦¿—©W\]´þ¾‰ƒ:2±ÀŸ¾_ø à]µ-•|L¯Û_à øµúˆ^¹ÇÈt84ó „·5;Š'­à‰!oòågvüÁĹÑؼ"hêÅüÛ~z ŸN÷fØÀ·ø<ØMbÔj¦~¹†sMº_HÃLhÍòø–¯Ë›c{Øú4?¾6–•Éù(*¨8ò;S?LÿaïÒ'ÈÁÙ½3åû^ð0ƒ‡Ž¢€“øý«˜úÅÚs/ V¬Tïù8ã&°÷|fë|V —§ëì+v9S—gøsïó+}+¿gÂ’³ç~.k©@—!ƒ0~±ŸOöë|O/ ­¶r‘½í®wò&¦~ÊЇßäóPéÇ60ã«UĹܶÌaUÓÇóÅ}dœÞÃÒåË9úðÃ<Ýú(ÖüÌ¢ZCxyB¬® ¢7ýÆ×ë“°Ù¹Ðw JN·ŒÔôswy]¬Çƒû´öëù K;ïÀ‘yLúãQ†==š^J<Û/`o@•ËS Y§Œã·Ä³çD)yŽ¼×§hïËÃrqv¿mmÀ‘ãéÅ_‹Vpª½œ K¯Êç` …öûd\¥¥Ú„%€âMÍ;ëàÚóù¥“Gö3lÞkç•vøîØÌ” ^ô #î 'Èì #&Š5_Oaa¬prè—ø0ù!îó=KyáȈeï’)|µ4Æó›ž\C-Tî5€–±¿óÖÁ,2Œ¿°ì®—y´õv>ÞXpûÉlɼ5Ý™‘L›\†'¿À'ƒL¤ZË´/Wï®ËXûf)«]Vü IDATö¸-Oç3Íx UŒ·Ak¼¦BV*ÉZcYÀR®!Õœ'Xšêù`Ü©#èì/O¯ ;<¬[½XB³n‹#oHÅTh=Ûéõi½|šÏ§_D\«™¾‘jšÛ}À6\$nû“˜C÷p)l'73ý‹¿8ãTQ5Ë£+ߨUž"ú˜G1̵±7.½Átçôú¸ÎyÀ¦Ù~*èõÕ’|©¯]¯‘ÜÓv¼âÏñfÆ<ü+³ªÐÿ³i;™wv;+•ñ1ßDfÜЮ´¨o§äàZæ¼ó1˹ðWG€øÍ‘´>–®hE¬Ý˱ëøüYžáÂFõ–ºí5n$—'ÇàËXË'¯ÈŠ#îÓ6>Ë8O)¢}œÌ˜†•þmßûüñéï)ðÛ¨ßyãGõ E¤“ƒðÎ{ËØWvÚÞ˜ Ö ¸Ìlp¬¦ñUóû cÀú1Úßw ¥S€·k¢p[£«ùë73žø‚ƒž*Wq€Àx HTÏökvZ|~Ú™ˆHÍ kÇOcÓ“ÓYxÔ{¢?‹êy?Oô^ţϤÑñS¸¡aU泿ç’ߎ$nà |=•’à ;­ÆMåÿº2{ÊS,(íƒS¯à»©O³47ø[#¦è<ô` s&¿EšóB«Û¶ü~Z_–?ö"ëJÎ×¥Æh,hìk"ø9X‚ŽËvÑ@º¿9Ÿ?ú ›Js4]o¾‹±JùtÚ‹,ËõU±ž‰ˆ®¿cj÷…üååTÊ~R—g‘›T³—¸nWÈ¡ òS(ûŒaÜàN$Ex)Ø·–Ïÿý +™{i[Áxßæ†qÈAlWeþXõqþIßà2(ÿ|äsg¢š} .­¢å±ÝOΓó¥&Úçyé Ú±QŽÕà<5Xf:³öâtºjÅ¥HOHˆˆH{õZ´§s×>\âàëÊ‹­¸áÎß`ÿ ÙbãÒ ·sψý<öñ>\ƒ¸””"~\ç£^Ë.U”á%{ù?ùózÛ‰6²ÔïÍ×ZX•á:1LI)bSz'n»» ‡g½À«[\4p+wÜ1„}Óæ°ßf‡AüŽ”k˜ÐýŸ<ó6«Cë¡w0ñænlyz%?ÉK Ê!¤#îCã5o1í­BúN`â¸lzG}AÖ—Qù§\½£HpdòÕ‹¯±<»¼pŸ»BØûq×ÍØüÆ“¼|0‚KÆÞÉooÈâÑ·Ó*%ã`K¼žÛ`YàcUJv†Áq4ªƒý¹À¤Sƒ“A*V«+þôîZ¢W;ýJûïŠ>x­Su!"¿Þ–?÷ß[ü`kĵÃþÁtÞÛí|x—ÒÍöäî4 Keëñïö†\Ú: üªÃózg)ðXÎhì[mðó4®àâ²&Òÿ–¡4 Û^i€OçÖ^æ>ñÒÉ›ÔU­gàŒr“ c6ÇöⶫΡöyçÖ„~LË÷¯=É šö›À­ã/cûôoɶW“žE[q´6Øw[à\"¯Aà8OÌgVŠÁþõäeUç3-ßrîùÜ¢†±—ÇþD0ùï¶ÿóµOgÝ>Ï£sø˜Až]Ó#àyz *𲌸óß^þ'— ]9ED¤zvâ›7ç"[1žSßcoÔ“Öeßñ•ûÈõÀ¢Ï7qåøK¸hö>öºÁÕ‚6e›y¯ÌNãexK È9þm K ½oHf×G/°³Ô_q?­¼ŒÙqýIÈú†WÈ Ð[~Eúƒhe&3Ö O øMx²VðÖkGØz¨‹ÃFI©gI)üô+5õаÝ-ßóÏovrÔÙóþÉßë‡p ÀN—?<ÁMG^dʺ³‰óÔ2þ<'Š{>‹ögq´äÔËzý.]‰Úþ)_¦æPJËg/§ïï{Ð$$Tg0ëí¤À¨ ƒcå'ð2{óÀõc²EØŸ`G3ñ ùóïhüÙ4þµÕEƒ1ux>¯>ô k‹ërÅCÑ}éklí7FçºÎ·OðÌêNŒÍMv.ºì:&ȡ«¤ÍIºÜÁ¬'ÿÃ^·úG2áš4r“™º„Yï. µÐWñJ e'Ê$‘C¬ZÆñ2ž²ãf"S2îú>´·Q°s9³Þ™Ç†\­w'°ký7z^ ×ôhD_Û½Ç̹Û)òÿd{Ǭwæ…mÈõÄ @)àÖVúпRþŠ¨>ê/ ÇûÏÇðäõٶݦø3û8³ƒ¦WÞÀøÁíˆ'“ Ëvb:ÞÑ_ïã»bâÕÝi^Búóxë£5ä$]¢>½OÎÆÃã­|··z4Ârh%ïÏ9Lçk‡Ñ5Ñ¡eÿæ…6Sà<°&ãá±^¾ÚÒ˜«ú^Lœ7oÞ~Ov„3àž±´v„‘üÈ$øÛ¬;vîß1Ë…å Õä?oµqYIè{=—o!×e«h#1ô¾c]#t|àvÊžšÁÊ<ËO×;^ga éÇ(ú·ÃsxóÞþ¥Õä&¹QÌŽ”Ns¨}9ù‡×I™Ûƒ«¬”²2 N—wY>59 7ŒÆ½¯å–!ha¢äÐz>{cËŽ¸ ÚŠq^f˜kĉ9p,†ÛÊûN?ÎÓÿMF§1U÷ 宇êò9£ñ¿Á2£ciT·õg¸] ó伞¨gÙ>Ý5Ù{µcãc»¯aàó4;à2;ž òMHˆˆÈ…È_DÚW“Ò”±É7žrC´Nb֜ȩx‚Õ•½—|G7bì&öºMD¶lsã(õ—(ãÔ¬m‡Óßû Ïl/­˜0Ÿ(#gÇ;LÙ]Jž¿üb–Ø‚X÷QŽ”PMâ÷ãÊÞÉælptü-ÏÝÞ³s;ïÿmSÕßÎX&"“+ÚL»ï王£pXÇÜ¿äˆÀIúüwx·4{ó³‰ð/# _d2u¬Ñ\qçÃÜo%÷ÌýÏB6çÙbŸïä\Š×ƒ?4–¸pTzD5ðzŽUFUÇ*Ðq4®kd|€ý ò]1ž\R·»¸ìâ8l©¹\”ßì u|k'Ò®^.ëw`W’‹žçºÎ®"*7 [Ò@îY7}Å¿&OYžŸðöÀ;n§‰}Uù «~o9ÛÞz’—ÓCh7ú.&ÝœÉäë)Ž ¼¬ä¢Ü5².+þ5™åù T.óÔÍ]˜pk7rg=Çÿí€VÃï`â¤\¦>³´Ò·ÁLD´ÍõÉ{xcÚ ö;ºqÛ=£é³æ)æ—t:}û’‰“rK¦>³4稗j{JÅŸo5)q!8Ù–ÑÁpM[RgÎçí76’a駪‘ Ÿïi«Ý ëÙ˜°Ô4J±“tIK ×, ÿÊ3™0Ú|8w‹dÙÌÇYšÃãï ‹}sõ×ûý¸óºDÖÍ|œ— è;q·÷Içé]ÆŸ’Ôß>Ïcóô½ï~î˜ô#oMŸÂG‘Wrÿ½ƒé¼p K¼Çy€-ér.ßô:Óÿò ~s'÷º„¥[Ì‚—ßåâi}Yþøkçí•M–€c9_5cô`Æ•?ïu´ª¸¬ñ½¹¥g6Ÿ¼¹¡¿kWÑÞrX6ó-R&aËßfò]¡¿êõ*„7ëK“g0yV Nä¶Û±÷ñ9¤ä&Áý~sIj Êg߀'s)o/îÌc<Î5ží¼7u 9>3qÇuXnÇúןà‡¬$_u7mÊ÷oìÀk0™ˆ1ʵÆ –¸À±8 ¶ƒõrÊqžÁúøë™ oð”8ÿ1ÎçL¡Û@v„Aû‹qÝ®¿Õ俶ÿóálÛçÉ~§FnœÞ_ˆ28¶içiàsØtþ_û²‘s¸ŒXC-xJ'nÒú]%¸°á°f-ÛzÙ´7ÈÄÂÚ€¾C°aÞF Nä''Ëð9 È)tá3‡Ð ó(þpOÍ™Ëö’jâBÉ/r×ýSxie4£'õ%ጦì-„Ô !´iošú’/¾Ã׸õŽ++Êñ³mö•`9ë8—Q„)Ô;?›]‹þͳ/Ìb•¯'wÞÕ‡VY›Rq¶Lßæ‘„ÕiÈe#ûÒÀjÆf6RVàõÜÁ•QÕ± ¸Ì¸~Ì÷'Øúwsdó>B’›ZŸ6u3X¼ÞEãæÑ„Å¥P”Êöü²ó´Nåç¾CHº¬sºuíÜ)‹w¼]œ³¯æm£üËsVb;u§î¶¹Ìß’Mѱ V¾œ–½hn´ÌNÒe±®ËâÝœZæ©7Gê¶ïMÓó˜½!“¢¢LÖÏËž¸.$G˜O_“5‚èp+Åû–òÒäXtÔüöU»’òî–ZÝEŸAìÜç¯ õ`!.ýÂœˆÔ! Œžò^}åÅŠ?ÏóôÍÏàýƒ> ÓÖÛ¤;MÃÊËëž\Äš-ùœÙÏãØhÜ«=ÞUŸ±`[6…ÙÛYøÙ ¼Õ]ïm$\z á›æñõÎ\ 3Sùê÷ùú «Ú>Ù›»‘…ë2)-:ÈÖ9ä¬]̺¬R ÷me{¡™p»µúëxÙ¾Z²‡Bg!{6¦‘g‰Änª¡ËMÀ±\ct£qåÏ©ª¸¬õésS/rfÏfs‘ÁÓ%Õ¬çÎ\Ì'+ö’[˜É†/f³1´—$Ø r“ Ç~UÄì˜CUÓò âößxùâùG¸÷þɼ´,ŠQz_Íqõå­áå'^aÁ¶lŠ]NJKÜØÂC0ܸÿ§ûnœKŽÓ8£í‚c7èŒË7ŸU>g1hÃö8㺠\Õä¿Áž'çàlÛçÿÊOÛ±q®ntž^lþ_ûè 9>Gyzæˆ w ëîfþËO²hW>̆q}¦#¡ õ‡Ø—ëÂïÌaË¢%d^Ö&ŽÅx»ýŽÇ®iL.v¼÷8Ï~— ôãóøðø/|»\úü .›6€vusøÄW–|gç©\{?ãñ©'ÿ?ë£9túÚ×ý–…éó™9o îžÆHs›W¬ãˆ3‰c§};Âi°ž³Ú2ª>V—×ÏBƒý9bôâ×ÊurpG¢.¡IB Ý©|¸®1]{7"ÁÛ óÞÏÈò€û<­S)ý&"&,½xkaº§b?ÝG)òY3áÑvŠ³ NÜÜõ%ÇNt¨œ€Ë¬”Æ„Q¼µŸ–Y™…ð˜)7ñøÓcNÄbÉ"5ÔÌÉ_÷S´ñ=^ŠèÏÐñpc<6.žÏì…[±µ½¡%è)‰Z­º>ØT)Oñ%_3"R›xrøú_3X’}r,Ùù6þÐ9ø"¼…ÛX•;ˆËš„±«¤ )eëø:ßK³3 Ä‚#ÚF᎓îÂÃzšU{½?Jñ¾“×ô²Œ|—!ÍŒûd¿» —¯b å÷á.sWŒAýøýAŒoQ6…LJb>>uxlº” ÕŽ}Æ•?ëU´Š¸,ÄõÕ…󘾩oÝ@Ûš«]ÏSx„‚ *CǬ\jÅ‘ 7YÂÁjÇnë²êÊøvaƒ.‰Øþ wâ¶|õ_LDûèåühp\ýØh|Å îP[I™N¦jÛÊ ­ æe{æËH çR¾Î‹Ñþ-åëlß9ö Õ”VùœÉ༷, 1ˆe›Œòؼ@õg”ß-ÅÓ&˜óä\œ}û¬é~#ðý…o8\MžmtžZæ 2ÿ¯m4!!""çÀDZÃYxz7¦žu3%‰iLtÉ!Ž:Á‘ÒË–yÁý˜’ÉAÊ-È[=“ã?Ž¦'Ë0Ù3òwIÙö“gláä—Õâð"ãzŽå®Ð÷xìý=8³ÍŽnŸ—¬EÏrÒ]ŽÉãÔW4úñùýxýþ ë+؃‰ˆf]hcÙÎ;á|^7n_ùg™m!ÿø“¿} ?`ov=“;¤s䴯حWmU+£ãhT?&"šu ¸?A·Äât6ä^Å%]í„ü‚Œ}ÅäÖïL·ŽáZxà?OëT>ž%®¥Žø:K¬äâl‘±„›ó+–9 oE‡ð¦ðXbl¥¬/s,óPRàÂ_‡Ÿ–yÚgç—P°þ#}}ef ëPxʬ‰™°ØÜ©_ð²لĦ0äöñÜVô ¯µ½¡)ÀdõƒµÕ©ý§0™M‰™ [d söÉ3ÒïǧJ‘ÚÄï¡(/‡£Ùž×4W‘ûÌn¬{ H]ÏÐ-h^˜BÙ3ÉñFŸñx·8ÏEdb4ÊGÊÙ€H+Õ\ï=”¸pÔÀJ^Àžt9›ìbq†qŸLL†ã€„㣭ÿÍõ&ðØÔ[ýØ×h\ù³^F«Š+„„ö͈KiÆß;Ü‚ÉdÁl†{Ÿz”oÿñ³2Ž¯g3Xo:ókd¢¬)ñ¶h#œd› s“jÇ~ê2pUÝ9èÇd6cªt¬M&?¾jrÀzÝÇ3®u/=û»‹¼8:þ–'zW×V̆ûn˜kŒÓl‹ÑþËcÐ7`WD³Îg‘ϵaí#&`,ÆyZàú3ÚÎf|žì=O?+}Ví³¦{E£û Æy¶Ñyj´,Øü¿¶Ñ+›DDäœ8ÓW±-¬C;ÅêH çàöx7®%ÃFÓö66ï, nPÚ˜K›•°q{ÁÉäÉT¹ 3m‡r¹i9ÿY~[ÝXâbc‰‹‰$Ôl‡Ûx™¹i'æÎø²E]Â#“¸tX_¢w®dgñ™]ÀËö~ÇÎz¸öÒ$¢"âé8dM2×°9ÏX‰IéD§Æ¸Î*N*•Ž)¼cn¿‰~)ñDÖi@§aChtx5›ó|˜c{qßÃw0¨U,Q±) Ý¢•«8äÌ‘´è܉ä(³áz†e:V/ \?^0ØŸàóòvn÷ѾOùi™8 ÓÙîmM¿Fy¬ßï,å|­s¢=\¹·á\Ù,G½V v1SyÛ:ºþòRF0´M,ŽˆDzŒDì®l+2Zæ4(óÔy›V’™<‚á≈ˆ§ýð»yplê˜+Çh!²Ãþ0©/-£C°™ýøMàóyŒ·— ŸéÔ>ØWv oLÚ7ŒÀÙœþƒ›aW-‰È/žŸ¼´5ä·Î5œ¬ÙœWŸԂ=,‡#¬â»µò…×Éþ•›1÷Å ”"b’é?ªQæê®÷.­^»ãpúµˆ"¬NSúÝ0”žsî“}çx·f726<'c¹jÇèFãÊŸS•q•‘öædzx ?6•Gž›O†sïüí>?Py0_ýzÖø¾\Ó«1Ñuâé8lí­aõ‘ƒÜÄ[ý1¯2fãÊ(O:²n…)ÃÚ6Žˆ: t6ŒF‡¿¯æ¸š0Ûlà,¦ØåÇÕŠþšà°Ù±˜ŒÚŠË0/ œK¸ ã ‹ñþÇmØ7.ß8ÿ œ‹÷FËŒ÷Õ(5:–·+ ò<9gÛ>kºã0¾¿øاÆçpµ¹{-¥'$DDäÜÒ¼’m¼7c Çþ‘çoñrxüôy:ÎÐd:†¥1¿0¸]HB;šxÓYXyº?´a¥2lÄ4O$<1…?N\i˃¼ÿÈÓ,Í G5Ÿ[¶ûsf.¸žë&<¨(7G¶~Ë«ïn8ã÷×úŽmæÕgÂØûxêf y;WðÖkËÉò&;M†Žã¦#/’úþÙÅY¹Œ?Ïú€æ_ÇØñrmYiËxóõ埕±ˆ7¿LdÒ]qµ÷(©ËÞ奯”?FlK¤ÿØ›±¼–Æ?Ó Ö3*#бªfYàúñÃVƒý9ƒÁ_ÖÖÝhƶƒ¥ø<.Òö»Ô`»N¼·ô<­S¹·ý—™_ÜÀÄ{§2¢t‹¯ãho>?x²–0sV]&Üôžör4õ[^ý÷úò¶e´l_à2O©ÓÜ5¼ùn,ã¯{€çb¬ì]Ň¯/#Ó ØÇø0¯¬ø¯ZŒå¾'c÷#ýûÙ¼µ*·Ë`{¹ðÒ‚çÈJf¯mË-z’aÙÛXüÕôR5‰È¯`¬š¿U¹c¸Ù6‡Ws½?½ ’À臟dt¥Jïþþ]á‰É‹²Ýsy勘pÛ£ 3e±~Á|¶Öi\Þ¿]Ó|Å¿f_ÇÄÛ§02ÜÉ¡æòúÒ,ÊÜçÞ' oô¸²u=n~ìnÊžXL·Š1ÍŽ‚²³­aŠŒÆr%Æc_£qåÏ©ê¸ü¸‹òÉ=><7ãñ¹9–_Xþ¤ƒåÄÀÝ`=x9ºn‡ÚŽcÚuuqí_ï-â°üF¹I®ñØ­ê˜-ÕäP“÷Á…¼üAnxˆçêúÉÞ¶Œ7^«î¸úqÿ0›¥Æó× çØ¡Í|½èv_{“ºïæù5mÅhßr­€qú0Åò½Áþɨo\Õä?F¹˜Q0Zft,Öm5õ·Ú ¿3:OΓ³kŸ5ÏðþBÀckt¯ãyöÃÕä©U›ŽzY¬ˆˆœ`·‡¨D‚Fao³¤]Ôþ)v.ñ¡)˜6*éO}ËQïY—I»¨ýlØQH¥2£§?õ­ó¨à†Zñv¿¢W6‰ˆˆ\ÐB[Ž`ˆÿK>ÛåReˆˆüÂ9µ£¯×Cù""""gÅám›ŒwU“öÑÌöDz HÆ•¶³ªwóŽö–odôÇï'¼­ô¸«üí£-~³=Ñßc@²ß•¶3/ßK°x 4:mLgúW@µ‘ ˜µ>[å‡nÕ…ˆˆüÏè 9…ž9“‘T­†ŒMׯå”(SÉÛþË¿?ZÅS0m<åO49ƒ2ׯ%Q¦”Y™ X¼,Š©ù'(¾E""""""ŒÚò„„&$DDäš9+éÀàŠÿBù ûqÿmò?ˆ!X|¬r€¢óü®B“""""""MHˆˆH­¤ ‘_pŒò •@ZÅßK*–%I@_Ê'UUe""""""žÚ2!aÕ¡ùÕ b*þtQuˆˆˆˆˆˆHMÒZ‹ˆˆˆˆˆˆˆˆˆˆHÓ„„ˆˆˆˆˆˆˆˆˆˆˆÔ8MHˆˆˆˆˆˆˆˆˆˆˆHÓ„„ˆˆˆˆˆˆˆˆˆˆˆÔ8MHˆˆˆˆˆˆˆˆˆˆˆHÓ„„ˆˆˆˆˆˆˆˆˆˆˆÔ8Klý“U ""rœÕjQ%ˆˆˆˆH-˜&1zêãü~h<»—ÿÈQÏñ&B“zrä[¹íæQ\=¤Ý[Ô¡8}ÅÞŠU4é}wL¼‘±×`HïŽ4²å°so6N?`gÈ£“¹*o«rbNþ=ÓsòóÃÚòû¿Á½â{»Ï"þsݾ‚­ñh¦Ý—Dêw»)²Ÿ,óhÜ0þú‡Öì^¹BŸš‹ˆˆóz½µãò®C!"""""""µ-©;]B³ß›L¯¦RSK0…µd̽£Høîmþöê. ¬±´é?–[îö“ùÄÒÝvš¼Ÿ.Íaþ¬¼µ¿˜°‹:qÕM·rûi¦“‰çªOÎügŽ›|M:ˆˆÈ/€^Ù$"""""""µL /mií§|ü½“”^Mp˜Ê—X"›Ð̾Ÿ…‹¶pøX%yùáóY,:JL¸StgF÷¶°èå7™ÿã>²r³Ù·ùÞ~w¦V-©ÌÁÖxÞ3–ÖŽÜúÈ$ºÔ±™2˜ûþú3_yŽé÷_M§zVÀL½ž÷ðÌŸúÑÀ Ø’ñÈ4nïÚ‚A§lo®ò3†<ú$wµ ,4ð0¯þóºF˜ÀT+þ?øÕzDD¤vÓ„„ˆˆˆˆˆˆˆÔ¡MèÕÚÉ’§3ÿpùÍ}[Â@˜ÔƒäðÍìhu7Oö_Ç”§Vã¿;+æ³ðÒ.ômŽkóFŽÄü†Þ-åã}ΊBM8Zâ†af®Z{†ù(É/¡`ýG<úú6ÊÌ$Ö¡0ËS^v«A ˆØË‘˜¡ lœÆ§éÎàJ.NgCîU\ÒÕNØÁ/ÈØWLnýÎtëΡ…‡pQýÍAˆˆÈ…Dò‰ˆˆˆˆˆˆH-aÂѬ'm<›ùnw.½g ›\͹<ÙAéžÕìÉmWw¡y|]¢êÆ“Üs8CsøqG!îÜu|²ÂO¿{ocDç¦4ˆ‰§yçÁÜ5±¹‹¾a—óLâ±f÷“·i%™É#Þ!žˆˆxÚ¿›Ƕ¡ŽLö& “LÚ{¯óÊçùôs9 ÖÊÛ›ÀI‹ÎHŽ:í6Œ¯€Û}´ï“D~Z&ÎÂt¶{[Ó¯Që÷;L6T”)""rÒ"""""""R;˜BiÞ+ïæd¸+ý»ë0k¶¸ø]¯dÂ\ë/…2zÄ@î¼¢Q67…‡¶±â­|™á<ìøô9žÍŵ×Üͺv<dzeáLÞøúî`cqeëþzÜüØÝ”=6“7ßeüuð\Œ•‚½«øðõedzCh4t Ý2>gÚŽ" wÊ7Wü–º¯çùï+mÿÄbº½Ëkiì((«ô!²¶î¦x@3¶,Åçq‘¶ßÅ ›ØUä3ŒÉ;s¿Ú‹ˆˆ\x—úVm:êé>9ÁnQ%ˆˆˆˆˆœg¡-G0Äÿ%Ÿír©2DDäÎé¬×½²IDDDDDDD¤&YëÓ¹åQ~8àV]ˆˆÈ¯šž‘Sè ‘_=!!"""""""""""¿š‘§ ©qš‘§ ©qš‘§ ©qš‘§ ©qš‘§ ©q–Øú &«DDä8«Õ¢J‘Ÿ‡)š^œÊÍ–µ¬Ø_Xh0ð!\ÄŠ²MÄí÷LâÖë‡Ð;ÙAöŽ])õak8œÇîjŠ3n(¿½¾!moà¦z[X±»VŽ|˜Gºe°lS.^Õ²ˆˆü y½µã ¨'$DDDDDDD¤vð’º:“ú][i,ui×¥»Wì¤$² níFþ¼çø¿?=ÅG™í˜8é2â*¾OcKêÃàèõ¼ýÆ|·r?‘Ze¬õéÔÁFêê8UÃ"""?+MHˆˆˆˆˆˆˆH-á#?m-9‰]ifÂ\·5—D¥³lG)Ñí{ÓôÀBDDäg§ ©=¼yl\wŒ¾—\LÇzQìZ°—R¿’ü ÖÄ£¯o£ Àì Ab ³<~¿ßñ2ü…l_—ÏÈîéÎŽ9ûË·‘Ÿ•^Ù$"""""""µˆ‡ìM)k7’«âö²|O ~|ämZIfò†wˆ'""žöÃïæÁ±m¨Så y©?Rtñp†ÔÛͪô*¦#Ì‘´è܉ä(sà¿‹ˆˆÈy¥««ˆˆˆˆˆˆˆÔ*ž¬MüX‰iÇ*ö”–ÿ›/w o¾›FÒèxnúCŒm¹Ÿ__F¦7@9[ø1?÷öïÙ[Õã¶Dú½™…þ»ˆˆˆœW¦Vm:úU ""rœÝ®ÄKDDDD~,±ôð÷4󯦖ª>DDäWÍétÕŠ8ô„„ˆˆˆˆˆˆˆü¢˜mÄ¥\Á‘»X±W“"""µæ­*‘_a­oäáÛRØ?w>;4!""R{®Òze“ˆˆT¦W6‰ˆˆˆˆˆˆˆü²è•M"""""""""""ò«¡ ©qš‘§ ©qš‘§ ©qÿ ¢ŽI `WIEND®B`‚suricata-3.2.1/doc/userguide/output/files-json/elk/Logstash2.png0000644000000000000000000041263213051004444021523 00000000000000‰PNG  IHDR N† sRGB®ÎébKGDÿÿÿ ½§“ pHYs  šœtIMEÝ  8…j²; IDATxÚìÝw˜G™øñoO;³;›sÐæ¨då,Ë–œq$§€ Dsî8ƒ›` <¤;Œ±ÆI6¶…-ËA9­´ÚœsŽ“gº¬´¶¬•´»Ò®Vòûy=fº»ººªz¶»ªû-%¿x‘†˜6ClW/·QõÊ>š½ªˆB!„b 4Bž0%_ù%÷”êαÞ(û~y??Û;Àü»ÛðÇpÇàöxù1ÿòã ¼sV„aüá4þñ§_cS ýíî~´‰À¥©ÜèþÿóÅôø9ñ«ÿà;{mÜvÿ½ÜwªLʾDå4y¿Æ÷ö #w¯WØù€FØ$í£ÿÅý×F‚{7ß¾û·Tû¥f„™b&.+›d›—¦ª&<öD2’cˆ0Apl€ö–N†‚Š5‘üthªé§ñŽÏ:l©y¤©éñ£é"È(Hd¬¶ž~ÕJBz: N:5ˆ{°‹æöA“ô\+Æ(R3ãPÚé×¥›lÀÛYOk(šÔXèkjcàŒt¦¢ãbp9íØLz@ úp3Ð×Ï 7ô®­bƒ´ò™ õ•óÂsRB!„Bˆ ÑÊ“?{†Æ ¬.Rò–q݆¬8XþÑ÷±¿êgì>y“« ø„ÂaT ½ÑŒÙd@_ { ¿ è-Øm&4¾1¼A Ða²G`Òa/nO 0XXô*~·› ŠÑ†E$ V5£Ù‚É ;ÿáœ7'iaB?`õäáéôF &óûÑB>ü á°zF“‘ÉŸvÓPC~'×Õ½Þ„Ñl Sf˜æiw²|uÄG;NvÀ7òËÏ<Àc*o/ýô»TFXÐyZ8{?íó©©„‚>‚Áª š¢ Ó0šÍõºéçqôô:¶Bø}4S6“nêõ§…ð¹=„4Йl˜Œ×#:ô#&³ %äØjû™i»µ£÷»çp;ƒrþs@ àuâV5Ð1Y,õÊ Ï“óµSeg~Û6Aa Pf؆„âl¿o~zNÐ{êóp'uÃg®æí¢ªúlŸUõ“¯³Å C;¾ÃZVp×Ö¥¦Xq·cÇãbûñAÎöœ6¥<Žw}n‚¦ ÖÞu'·®-$%ÚŠ>䦷©œWž}–õÔ ¯b—ÝÅ'îXÏÂL;cÍÇøÛ_Þ|ÇͬFØïÆ4’¼ê|ô¦e.ˆÇæ áð+<ùäNŽõwøN=ÍwRPL \ÿÿ♧¾Ëâ~ô Þó̽|á>6}úKo{ª¼ß$S˧JÈçÆoHdùíwrû¦R2cíè|CtÔâ¥g^àµÚáIêâÜyüüãw²Ž‡_¼¯•_Å'ÿn3Ž—ïçkO52:¥ú,e|éW_f… ºÿr?ÿ«]Ï·”bì§æàùÍNë?ÎÇ®¿Š‚dîö£¼øÇ?°½b˜ðyžy»Ýûýû¨~ï·æl»}~™ŸžðûœVõ¤¬ÿwݸŠÒt£Mxî楚QÔiž'çoC„ÞYßë¹÷ËÙûý»yèÐÀ ÚB\^4o'ŽvIA\2P „BˆË–N§#3# …úÆ&)qÅp:"s£i%ô]GQéyó)|¨•H_²ûŽnz}a"ÿ?î¿çjßv;çJÍgõù¬¸êY¾ùýíÔ»G8v¸Òb!©ˆdó+´»dçGÜ&žÂd3O5BTnNµ‰ý-§w~F­ü4÷nqpê™cgêbnûŒ ß¿ºÃ“Ü¥‡ L1 ž A-–MŸýO>½Èò¶»S;q9«¸ë³¹DÝÿM­%à׈ßüy¾÷ÉÅØO®¹”;?·øô:jÐDÞ{ÿ“oÝ–1‘o,Ñd¯º/,Êç7÷ýœWº¼SOóÌÊÁ`60T[N½„œ8¢»¾†ª.S:[§šÏNA5Š•Ÿü:_\ñÖö–(RŠ7ó±â…¤=øm9á~GžÏ—Ç·ž<7fÜÂW®-#èRÔ©×ß;bê$Üøo|Ù¨›h_k?À׋¯GqEMŸ#e1·ÿk#_ý/vöYÊŠ2ÃvÛÜCó\n×rþx>Æâñõ¥QOK™+ùÀÝ1îù/^é Nã< M­ T) Ö£)¦”L€‡Öš*šG‚3lCB!Þµ÷×RB!„¸,/bt:6¬]ÅÊeKÑôR ⊑’œÈí﹑~ð.®Þ¸£ÑxÖu]®(6oXËÂÒb23Òq:R€WÅßEUÏÉÿǦ­™sxß'Ov,êxæ§ßæî¯>ÀÏw´£ú¬ùĦ :žC'0§‘ª)™²¤S©ëIÉÁ ZI+9ùeë!êÝïèæŽÐSùì¯ùî·ä§Ï5w$ê2ÙtUÜäO›©SÏ£^1`[p w,²*MÏý’{ïù7¾ðÍG9æˆeÕšdŒá ªcýØÉýÑrþôÐwøú~Ï›}ºÓnfÕP%ñjþñdç{û_Äg>ùÏ|ú?怰–ðþ÷.©M=ÍI©£yøû<øLëÉ/ZøËC?æ×{ú'yR~’ͧ˜ÏH(ÑK¹ídoÏ ?áß>ó>÷_ñ·^€®¾uQÊ4ò¸ûô<ÚòËHè¯eßë;y³q˜ÀTëïû3ô²ó·qÿþÀžÁ“­Ì…ûð_xè{?âW/¶Ž·C.ër"˜,ËÊ ÛmƒWÓíÎ8O&c±ÓüâoùÞw~Äÿ¼v2@‡.—uùtÓ9O˜bÐF9òÛÿ⻇Ç÷å>Êï~øK¶·fÞ†„B¼+ÉB!„¸¬èõzR’Ñ4#åÇÙùÚ›òÔµ¸lF6®[Ïïçè± FFFiïè≧ŸÃj±02:J0ÆÇôzýÄg—+Š[oº½^Oö‚L4MãÕ×vS[ß …{Ó´ c§\6Ù1)*¦´µ¬phT?úkž84€ŠFçï~LLÉÜ™©+Kˆy¡ƒÎöýT׳ÔKAš£·€L3hݵ '䛂Íä¦(}üv°ëH-Ãïx¤X­|”Ÿ?y€5Œ¿æ1®ºúˬ0CD¬mÒÎtM›N»è+çá‡ZЇ†©;RAwÈNb©ý&» Tkîf–X<ìþïßðÜqšVË/J¤èW3þü·†¦*Ä.\K&@¨œß?¾¶Q vð»g®áª÷%a.^E¶ùU†³¦’æ¬Ôìó¹šû~u†‰NùÈä¥us âMùN/{âÌ(~Ü’¿qßüu~ -äÆvÓÔêï¯m¸ß6âà=ðØU…Û˜þÌ«YyKÐÄã¼ÄÁA?þ:3¯ý$¹€ÉnD3ß¾Pô„gÒnµ¹Þn åÚú?|7½á¾ºÇY»îÓä¶( Š6½s9hº€6 3`2ÍrBqE‘!„B\Vâãbhïè$–åÅåÃjµâõž¯Ãét°eÓzb¢]äfgqàÐQ’0ìzc7wbÝë®ÙLeu-åÇO088ÄÓÛ_`˦õ8ãOŒªªÊÈè(q±1$'%âñz©«o”µË…¦ƈýT„˜€¿ª`ŽK;ÙÝͱڑ·B…„z8T>̉‘J´QG—»‘=°4RŠ’qù ‰Úví¤õ†\V'’ (`˜ãÇûψS>Ö=€ïT“Q½Œú3 (Lþò4òhÒÒUÁ~_!Wßp5ŸºóS䥹0Mr»•‘p2„K;‡›½̾–Ã4†®fñÄ­‘謘“›•ñ¥ÿùý$w¿1¤8M4L9ÍÙ0•|F“ì0¢ë­ä…#þa‘ sî>ñÅ-|?Ý5GØ·ûu^Ù=ˆÿNkOÍQZ'˜Nƒ–à[é¸ûÜ'ÛF8t2½À0¾ñ´px ¡mt(™´Û¹Þîü‚ÝŒ<`-èÁ§:PtÊ4ËYGçBÚ€gvÛBˆ+‹ !„â²ÒÙÕ#… . v› “ÉÈúµ«8t¤œÖ6/‘N'#££hšF0"z«ÛI¯×³bÙ4Mc÷ÞŒŒŒwøGF:¹å†­FÚ;:'Ö_¶tù¹Ù˜-4MãðÑãTTVáóùq:"¸~ÛL'Ã%ÄÅR~¼rbAÌ_jÈOØ”KAüøg­¿•!Uw–Îy•pX{Û Ðø³þ:ÅKõ¾vÈKÁ¶ „2-…Qꫪ8±Vç¤QZ )¾:u&I{z½‡Š2õA±Ýf›xÚté’…ƒ0>×AnÎÆÜE!=-eÒ<¦¦$³°´˜Ø˜hŠ òÈÍY€Ýn“Ê»” N2ó ().bñŠMÜþÿÁ÷þ®pü‰.9Ïîí#¬èѺ÷°hü®àƒç¦â8"ã²Ùôñ厓s­¶í.§? (zÔîCœp¸ÈvÝU´ùCôT¶\™ãíªå`#î‹zd:yTLX"NÆVÒÅRŸH”+Õïý§§nÞÅñ€5ÿðQ¶–¤“½èzþé3[pvg«g¤üÝÖ%ÜqÍlá0Ö”e|ø?¿Ï÷¿ý5¾ññ2ºi¤9+wàS˧ÓhƵôïùη¾Á·ï»‡®Ê Zïa¨§–¾“X„½xÃ)nÌtÛØl˜i»ëí樜”©¶ñ°Fo#˜íØ  æ¸ !„¸ü/K¥„B!„¸8ZÛ:hmë˜ø¼xa)K—¡‡G§×Q\X@RR:Ý™ÏìÔÔŽOBlµX¸aÛ\®·¦U%)1Å KIINœtÿ~¿ŸÕ+—aµXΛײ’"Bá0û¦¢²Zæ1¸$2¸ës_œäû1öýö1öŸœ=U ·ñÔowQö™õ$˜ ¸ã‹ß掷­j|†ÿy¥ûd u½ÚÁÞÚßò¹›êë ¶WÐIits¸z䢅ۙjÃz=#åô߶…\løÔ×ÙðŽ´ô&:ðVñ§')»# s º{ÉÙöŽÚû*ï\ÍÝcɾõßøù­oßy=ÿæuzÂÓIs6L1Ÿª¥âY^îû,›c¬ùÄWXó‰ÓSêÚñ•î‹wÎN¯ÍNÙ̬ÝÎõvsTΊuŠm@g4àé¢ÀPÆgú>o~÷«üjŽÛBˆË›¼Q „B!Äź¸Vbc¢Ù°v‹ÊJ¨¨¬âxE%Ï¿ø2½}}ÜzÓõd¤§žèŸÏOo_?:E9c 6&š¯»æ¬ƒáP˜üÜìiå٠׳jÅUÄNĨÍE?Ù2 wuå¯ñ؃÷ñ‹½ƒoëœÔ-Œÿø÷_ó×£ÍôŒ†CuìyâÇÜýÀv|ouø)è8Ü:ñ¹³¢› bÀè õT˜’¡ï;Ùí«è1ÛíÞy‡8é÷zLv;&Ý™ùŸZ‚ÍÏðà¯vRÝï ¶åɇ¾Í/NŒçÇP°™¥Ñ: Dû ?æ祿e˜ aF»*yîW¿fû»WÝÿý·øÚïs¢m˜ zhØ÷4?úÚCloöŒ›?4';ÏMØΨÀÉÊä,å4Å|ªcUüþþò»'hòÐüŒtÕ°óÑpÿŸëðhÓÈãÙêxºõ§°DØ0¼#¿ÎíÔÁžZ¦±Ú­è§zvL·Ý^¢íÎ_÷ã‰[')§éœËSnŠÂÈþ?òxyÿ0#Aí‚ÚBˆwáUj~ñ"ù³ „B!ÞõŽ~€ø¸X|>#o‹áíBÓ´‰ytŠÂâEe‚lV+™éièõzt:Vëøý/½ü*MÍ­$'%rݵ›'}‹à”¯ì¢±©…ÌŒ4®Ù¼aFÇÐ?0HLôÔƒ§ Q[×@KkCÃ#Ò„B!„x—’ÐCB!„BYéôôöÑÕÝCOoÛ®ÙLEe­mØlV¶l^Om]ÃÄ@ªi´¶µ³lé"Ð)g<6JFZ*MÍ­äæ,8ç €Ùlfai1K—M;着¢ÓéN$himãè±X,fÌ&‹«Å‚ÙlÂç÷Ó?0H}C“„B!„BÈB!„BÄÇDz|ébÆÆÜt÷ôRS×@8|î;^Ÿ`0H^Î6¬[}Æ:š¦ñÆî}Œ¹Ýl»fóEͳ¦i446 ‡±Z,Œ¹Ýä¶|`pˆŽÎ.::»éìê& Je !„B!Î B!„â]-&ÚÅu[¯ž˜x×뻩®­ŸXž’œÈÈÈ~¿Ÿ˜aUedd”»n¿ÇË›{öÓÝÓËG>xý䑸UM›ôƒ©Ò4ÊêÚñ x4 ô:=ÙÙ™ût{<ÔÕ7RRT€~’|hšÆ£z‚p8Œß˜ò¾ òrhikÇãñJcB!„â %¡‡„B!Ä»–Ùd"/7‹Ù̉ª:;»ijnÁn³áöxXµâ*JŠ xaÇ+DF:Y¹léÛß°m •U5ü 6ë¤û¹ÐA‚ŠÊj òr0Î~ùn·Ù(-.¤¦¶NGVf:Æ·Mš¬( š%E¯¨¢ ?—U5X-‚Á ^Ÿï´ôL&9 2)*ÌgÍêTU×r¬¢’‘‘Qi8B!„B\aä!„Bñ®´zå2 òrÐëõ¼¹g?-mí¬_³’¸Øzzûy}÷^îºífEáÿ÷$¹ÙY,]¼pNóèõù¨¯o"?/û´NÿóQU•æÖ6</®¨(’“èî饳«UU).Ì£¯”äD|>?=½}hšF}C#n—%‹JIINÂëó16æ&&Ú…N§ÃíöðÂŽWè”F$„B!ÄBÞ(B!„ï :UUX•Á‚¬ úééí£¢²šë®ÝLrR"£ccdge¢( ªªâ÷û©kh¢ ?»Í6gynlj¦¤¸`FÇš•‘Œ IB| ñqhšÆkoî%%9‰`0ˆÑh@UÃdf¤“‘žzZZmí¼öÆbb\8ìvFGǤA !„Bq‘!„BqEÓëõ¬\¾”Ô”d4MeïþC446ÓÔÔ‚ªiæ³aÝj’““&¶éíí£¤¸€£Ç*°Z¬,^TÂððÈœ Æ N#!>Ž#åÇY9ñÇë%7;‹ø¸X:»º ‚df¤Mº}nv®¨Hv¾ö&áP˜¦–VÂaU–B!„W(B!„W¬¨H'N‡“шÓÀÂÒb4 /,áÙç_bÌí¦¤¨à´y–•àtDÐÓÛGm}#7\·eN‡HNL¸àtúúp$p»=ttv …),È 5%ù¼iÄÆDsÇ{nÆÃ=ÿâˤ$'¡ª*•†&„B!ÄeNæ(B!„—½¤Äx¼^CÃ#§}¿yÃZ²džöÝÿüëV¯ 9)‘1·›¶öN"ì¶I;̽^ƒþŒùéêîAÑ鈉&.6æ¢SEe5Å…ù”FGg¡pƒÞÀÈè(1Ñ.bb¢/hrå·Û»ÿu p*É@ HwO/Ý=½¡ž¬V+€_ÞDB!„bž’7 „B!Äe-.6†k¯ÞÈÓϽxƲ°ª¢j‡”£iðù|x<^"ìv òrΚ¶Õj9ã;MÓè¤èd'~K[½}ý}°@¯Ó_Ðö>ŸÇKNvGU°°´ø¢æÏëóÑÐÔÌÆukHIN<³ìÃazûú ‡ÃÄÇÅ¢Óééîé¡­£“Úº†‰:B!„B\zòFB!„¸l¥§¦°qýv½±›¦æÖÓ–Y-–,*¥`ªš:LF#+–/%9)q" ÑTŒŽŽðú|ô Ž¿] AQaÞÄ: MDGGé¼hÇv¢º–¢üÜo¨khBUU²2Ó/zè¤Ý{’œHzZê´·UU•Æ¦ŽŸ¨¢§·O²B!„—˜ !„BˆËŠÙl&&ÚEGgï½ãÐàñ'žFÕÎ}Y»aí*òr³§µ/MÓØ»ÿ…ù¹X,fº{û@Ó&í¯ª®%55™»ý‚ÑëóÑÝÓKfzÚ´·UU•Î®núúˆ‰&9)å"…š =½})?NKk;š&·&B!„B\ úØøÄ{¥„B!ÄåÀép°nõrŠ ò¨®­#à—›MWw—ô´FGÇÎèp6›L¬Yµƒazá|E!99‰Ö¶vâãˆt:£³«›èh×ið±±1TÕÔíŠB¯?û~‚ÁàY— P×ÐH0šÑ ŒO‚ÜÙÕÅbaAfƼ$°Ûmd/È$#= ¯ÏÏðȈ4t!„B!æ˜ !„Bˆy/Úåâ†m[HOO%9)“ÉÈèè¹9 ˆˆ°ÓÔÒ†ÓÁµWoDUUºº{&¶µZ-\½i®¨Èí;  †p:D:¸¢¢¨8Q…ÓéÀhxkÚ¯¸ØŽ;ÕbÆh4 Óé&–©ªJuMÁ`æÖ6¼^GÄÄ:š¦ÑÜÒFQAÞ…0²Y­$ÄÇÑÑÙEbBüeSÇ6«•ì¬ ²2ÒñûýgLL-„B!„˜=2™±B!„˜÷,3•Õµ„Ba4MÃëõÒÞÑÅšUË$ ±rùRTMÅf³RT‡ËEb|<‹yFûÕ4ªêZÊJŠNû^¯×QVRDcS3Á`ˆÜœ(Š‚N§cÉ¢Rܽ}ý¸=<½«ÍBVVf“‰Ô”d ­mŒŽ¹Iˆ¥¿œìÌ‹R^Õµõ眤y>s¹¢Ø¼qK†Gxyçkô Ê „B!Ä,“9 „B!ÄeG§Ó±iýdeÐÝÓKlL4½}ýì݈Á¡aÞ筘ͦ³nßÜÒ†ÇëESUìvì66«›ÍzÚz—“‘žJlLôYÓ …ÃÔÔÔAjJÒioL•ÛãÁd4ŽO”|í]de¦_öõ«¼¹w?UÕµÒè…B!„˜E2P „B!. :EÁn·ãt:(+)$9)NGÿÀ Ã##ìÜõ&áp‡#ÐP(°fårR’8~¢’’¢B`<$ßÀãõÒ?0H0ÄARb<—ŽÎn rÏ›¿`0HgW7cn:E!11á‚BÍT0¤¥µì™WLÝ×ÔÖóÆî}„NÖ¯B!„ââ’ÐCB!„bÞËÌHcýÚU„CaúúûiïèâðÑãØm6šZZ‡UÊJŠ(+- šZZÇ'#NLÀétœ–ž¢¼õÔ¿N§Ãjµ`µZˆ‰v‡éêîÅhÐOiÀh4’ž–:ñy``ªš:òs³çtBa£ÑˆÛë¹¢ê?/7«ÕJm}š¦ÑØÔrÆ„ÕB!„Bˆ™“7 „B!ļ’–šÌâ…¥ôõ pìD%½žË–208ÈÑò üÀÛ8x<n¼îZâãbÏ»ã•Õ”æÏú±AÚ;;ÉʘÛ0@ƒCÃŒŒŽ’žš2§ƒs¥`Ý{ÐÙÕ-'ŒB!„ !„BˆycÝš•˜M&zûú©©­Çëóu]½^Oö‚LÊŠ ‰ŠŠ8xÝ IDATäùÿ†ªª\{õ&L¦·býŸ M”‘–†^¯Ãï÷ÓÚÞIÎ…æiëèdlÌ=ç“ {<^ZÛ;CÄÇÅsEµMÓhhlfïþC¸=\Q‘  ËI$„B!Ä È@B!„¸ä’ÅAWwÏ”¶INJ$%9‰…¥E(ŠÂ‘òãtu÷°uË&EAUUjëp:ÄÇÅÒÜÒ†Ïçò¨¬xNŸ´w»=4µ´RTwIžðÂãñ’š’tŵUUs{0 ¼ø·ôôöÉ %„B!Ä4ÉB!„â’³XÌtu÷àvŸ?¶~YI‹–ÐÖÖú¶8õÅ…ù„Ã*Š¢ ©®­§0?½~|>‚Y—ìøìv¡PUÕÐëç~  Ú…Çí¦§·oJ¡™.':§#€›®¿–¿í|¦æ9©„B!„˜ÎuµB!„¸Ô¦:9mRb+–-! í"7;kâ }£ÑÈÒÅe446S\˜?1H08ŽKšŸÔÔ|>ßýĽN§ãêkå„B!„bº×ÒRB!„ârØõúnÿË3„ÃáI×Ñ4 eÞMâ /yÒÓRÑ4þþ+÷G'·8B!„BL—„B!„—Á!ŒF#áp˜Î®n4MÃjµa·w€ ÒÑÑEQQþ¼Ê·¦i„Bê¼È‹ªª˜m6iLóê®,™÷Ü÷5n?ËòÐqüìO(÷JQ !ÄeþƒOtÑÞ{Ë* 3ˆd„ΖFŽîÚÎÓo¶àž‹KÓ>þ½/±Ñ"[.1ïæΆÙñ­ÿàw ÕG…ãî»ÿvRÚçî{ÿF*¥+æòJ!„BˆË€^¯gÛ5›HNJddd”c•>rŒ÷Ü|=uõ$%&PVZ4ïò  ü—|Ž€á‘QFÇÜ$%&HƒšOT7M{ßàõ=èä¯,&ŽmGÒäÑÀ×Ä@HŠI!.oFR·~–¯ß•0ýÍUó9ÈÌ_ȶì2Š¢ï羧[HA]†©q¬ÜœuòC$+7fòxC ¾$¥yÛØ÷Ú\ýíÈŽ˜k2P „B!æ=EQظ~5ÉI‰8Ö¬ZŽÓ阘È6>>Žþ""ìó.ÿ&“‰Ee%œ¨¬¹d##£tuu“Ÿ—# j¾Q‡9òäï8`Êâ#…Å\ÙÏîÇdz]¡‰[·è’m|äÎõ”¦:a¤…ýý¼X‡/ùîÿÆuÄ7>ÁÿÔqãâa}ØÃÇ¿¸‰¨–Ù>´˜-e±„ÚñÄ£{q\wÛJb1ÕñÒÿâG‡‘…bv颖ðÛ²10Ì®›ß&Œ‚9ãîýÚ¤_w/ýŒr¯‚9i)·½ïFVç'âTÆè®?ȳxŠ×[<s?¾¼뱟ðO?<Ž+‹¾ð Ÿ+eÇ7ÿÇ×ÿMhy†ÇšK¸nUQÁn<ó¿ü÷˶~ýKlŒ(á ?ù?ù×Ùï–ú¹ÆäUlJµõ ‰KÉ^²‘¼?ÔRî95ÿ–[ÖZÞ÷þk¹*+{hˆúýÏó»ÿ«cá=§×ÇϾYÎòu+Iioeûö*F9w{Ð¥Üröú~± ¯&õ#¦ñ;%E „B!æý ˜ÁÀƒGù㟟â/O?ÇÓÛ_ॗwQRT0±N¤ÓA8¬âõúæå1ŒŒŒé¼$ûƒ4µ´Ê Áå|¤lå‹Ÿ»‘ÅŽf^øÓS¼ÞŸÈª»¾À篎Cj¥¬[øøÕ)08„÷TÏú5¬4·p¼Áƒ=e)¾ûÓ\ãìàèñ^”¨¶}d™F)_!„˜m–ô«È7ÏðäÑaÆgZÒð7?Ï}Ÿ¿‡Ïåª} ‹(åã_þ;¶•DÑw`ÛwwbËßÀ'¾úIÖÇN£/ý&nΣêX kWÝõQ¶Ä ðÊÏæPøýsÂ#usaÌdl\MÊŸþ >èk×Ú':]uQKùÇ»?À†lšW^ä••ì5ïçKLàÀ/N¯Šw¼F0åö0Y}'Êóábz¤Å!„Bˆù{±j03þ/.†— E§ ×ë1ŒgLXœ•™NcS ²2æݱ(Š‚Íj™óýªªJù±,]\6ím[ÚÚ©«k`xd“É4Q™ión²è+½bÁÖͤâè#¿áñCn”½#¤=øa²¯YKJÝÉQ÷!~ô•ÿåȘŠ)ë½'+ñ|ë{;ŒZË×¾ÿ!²Ævó£~K5¹üý÷¾ÀÚÈDœ (¥,„³G‡ÉéÀx{û;í)ï0žáAÆûëb®º‘U0òêOùÎõø0²×ýu¾±-k—Ų¿nŠ»ìzšo}ë9ÚC6}ö»|®4šÌ(x¦®‹‘0 zèjëÅ-Oœ_ë¶,w‚÷/UöS7|€á•ë)ÙR‚óІ41K·±È =ÛÎOžh'd|“¦;¶’£šôœ^ÇiW¸ÎÓv—Ÿ£¾]è”Ø…b÷^RB!„b>ÒëõÜ°mË”CõhšFeu-Y™éóòxŽÊŸ 2*Ýv²Wœ¨baiÑŒ:öÓSSHOMaph˜Wv½ÁÑc˜ÍfÒÓRÑëe `.oÛ"ãÆCj-ü§ùÍÛE¥mhÿ÷ =ï"äƧjx<¼oOÐ… IçB̕ਛ`ŽÂªÿ©Ÿk…ø¬LâŒ>ºêÛ‰ˆ©ØSÓ‰€ ½5ݨۢq&8ÐMu ÀÝÇh ŒßB‚ŠÌGá&–ÚO>ðQV\(€.o#K¢÷ñr¿GÂx4v±ó±ß²À´à\WÃçmz©oqQ¯8…B!„˜gâbcØ°v.WÔ”Ö×4òã'(,ÈÃdœ¿qTŠ 󩪪¥¨0oÎöi2™0^`™¸¢"ÉÊH£¿¿ßÏë»÷²vÕrôz½4Ö9blØhøõC<Ù@18HÍJÂì¤9òD£Iç¿BÌKÞæÔ©ÅäÜÀõyÇøC•0%mâ3_¹…Ôà1~ø…ŸÑÒ3DŸ—„yÏøäñy è€Ñî1š†èÌ  Øˆ˜Y§° ù_ ÅÉÂkJ0ØrX¾úí!3¹zY¯þµ±þ1 ’˜ ƃn‚Æd6¿w+9¡*ž|ºûõfì|íAjA\D2P „B!æ×=—¢ ‡9z¬‚ ëVŸ÷Iø‰A‚üù=HãoIèôsû„W0"_p§þâ…¥8N^{c5µõ´·wRŸƒÍf#!>WT¤4ÞYã§þÅ×é]¶…%Û6ÓùF;¦ÂMl-‰¤çÅﲧQJH!æ;uè ¿r=÷Þ–ÅÖ»¿EYM-]A' Š3ˆ$LýSORáV x–=·}š•þ‰/wQÎbúhð•óôî|†úXƒ#ïCÜýÏeôE°t:/Sj*Á`Hcõú2ÚÿVNŸD§™]ìb®ÍÓÁÐN¾qϨŒoL¿•þs+©W´ãi:öï âÖR|çùëW°±(’‘×÷ðHèôúè:~Ze1xžö¶K=ˆ‹G „B!ļ‘–šLQA>éi)SÞæDeõ¼“à´ŽUÓýåS~¬‚Ee%œVvVv›••5´utpððx`\EQˆ‹Ál6‘˜O~^V‹EôEäo|ŠïþLãc·­á†;—¡µsàɇùÝs øK¥€„bÞ Ð²ýAînÝÆn^Aþ‚Rë½ ´”³ý…§Ù¾¯ÀØ1~ýÀ¯zÿõ¬Y~-ÙŠ›îê<öØ“ìÒP•=üúÑ<>uëR2ÊŠ1~…§•¹9sŠÙuòÚËU¬¸µ€•7®e÷k2P03’Vn$9²¶À[K‚90°•mq«X—ú<5íágß·ò÷]ÃÒÍ×böP½óaþSž é´úØ_]{úuãyÚƒN ÄE¤ä/’—S…B!Ä¥¿0U>öá÷a˜Æ“ïUÕµ¤¥¥`·Ù.‹côùüt÷ô’‘ž:§ûÅíö”˜pÑÒÜñÊ.›Z&]VRT€×çÃíö°âª%ÄÇÇÎéñþê‘J!„BˆiÐÇÆ'Þ+Å „B\â?Èz= `4 ÏñÓÆï´tñB–_µ˜Üìtvw¤‚ÄœX½b‰ qS^¿½£“„„¸ËfàxEù9s¾_³ÙLSs+ ñq-ÍøøXŒ#>ŸŸßÚ²žÞ>‡s»©©«ghx—+ ‹Å<'Ç{èH¹œPB!„BLƒ„B!.1“ÑÈòeKÐétdgeÐÜÒÆ«¯ï&¾4SSÅÆF7þôïM×_ËŸŸ|¿|°@Q2ÒRéêéÁçóK剋Jѽ5¦i `³Z1›M“®ïp8ðx¼—Õ@A„#â’í;#-•žÞ¾‰óû‚ÅnÇ劤¡éÜëišF}Cõ MØí6b¢£q¹"‰‰Æ‰Á`Àl1_”ÐQccnö8$'“B!„Ó$B!Ä%9|ôi©)Œ±tñBâãb9VQɉª4mn£‘ž:Þn³±tÑB**«‰ŽŽ¢´¸=ûÊ ˜õ M 02:Fo_Ñ®(V­XvÆ@¦itvõÐ×?@QAîeuŒ÷’íÛétÐ\ÑFt´kZáÎ%3=´”dÚ;ºhik§¥µíœ¿n··ÛCKkÛËL& ñ±¤¦$“—“É4µŸÏOCS3 Ítu÷Ìùo¦B!„W™£@!„¸D–_µ€£å‚A²2Ó)ÈË%9)E²º¡©™W_ÛM(4½Æ z=ù¹$ÄDZ{ß</i©ÉÄÇÅ184DCc30òèšÍ¡½£‹Üì,2ÒSÑŸ¥ñБc<|T*O\.Wi)ɯ¨$:ÚEBB qqX,l6+®¨È‰uUU¥üx%f““ÉDrRV«õ²;f·ÇCCC¥%E—dÿªªrìx% ËŠg%ý`0Èáòã”;qAö&£‘œœ$ÄÅâpD`·Û°Y­„B!ÜnCC ÓÝÓGGg— !„Bqd @!„¸–c5[(-)¤³«›íÝAB|]Ý=\wífRS’'ÖãÙç_blÌ}F:e%Eæç²ý…Ë—..caiñDgÿÐðO=óßE 4]]Ý8ŽY ÙTS[Ï®7öH¾B!„— ™ÌX!„¸ü>?K•a±˜qDD°ha)y945·’—›Õj™X×d4bÐëiik?#œì,RS’IJL ±±™p8La~.11ÑëX,f’©®©#Òé$*ÒIRbÅ…ùD»\ÓÊ·Á '!>Ž@ @sK›T¤¸`v2ÒSINJÄy΂ÎÎî‹:ïls»1 Œ¹'_Ál6ÑØÔB||,ª¦0æ."h„ÝN}c3q±1³¶˜˜ht:=]ÒÈ…B!„¸ ÈB!IJZ-ƒ!rs²éDUU\®(t';GoÏ gl£(Êiÿoçóùˆ‰æ†ë®aç®7'íhe劥´wt’‘>þq†‡ƒAö8ŒÝn# MLt,Ät…B!ü+—/E§Ów}N™÷Ç408ÄOmÇÉ蘛eKa4hikÇïà÷ûILˆ§·¯Ÿ®žùy9dgeÎYE™v8³™ÈHKaÿÁÃÒÐ…B!„¸ È@B1‡’X¶dÇOTM9ôÈþƒG¨®©;í;£ÑH0ÄépL|íšt á”ÌŒtR’/øŒF#xßíè…½ûQ~ü„T¬˜²´Ôdzzúð8n¼îš) hš†Ùbž÷Ç×ÚÚŽ¦i ðæžýg¬Ó?08þŸÞSÇšª‘™‘6ëox<^ZÚÚædBò¦–ÖKò»tqÏ>ÿ’œlB!„BLƒ !„s >.–’âBš›[s³zå2`|bÓºúF:»º±Z­èt éiÄD¿hÙÒEƒA**«XXZ̲böí?DfFÚ”ó SÌæ‹ÓѪS‚Á Ñ®(>øÞÛs»Ù³ï }ý„Ãa©pqVÝ=}t:Û®Ý4å8ù£cc¸¢¢æíqŽŽqìD%UÕµÓÞ¶£³‹ŽÎ.,3eÅE”•3Ó…ðù}D:äåÎjyhšFMmýœÖÁÖk6‘žš"'™B!„3 B!ÄèëàÀÁ#df¤ …xõõÝ´wtâv{ÎX÷hyV›€ëV“˜O|\,Í-„Ca-,Ád4²nÍÊKzLF£‘ÜœØlVn¾a+}éeZÛ:¤ÂÅY㡪rdétNy»±1÷YCp]Òã ¦®¾qb0o¦|>?û&66†”äÄYÉïÀÀY™é³Z&ª¦±ÿÀaFFÇæ¬Ìfóe5Hà‘!„BˆyÎîp¾«ŽW „Bˆ9 ª*#££”?qÞP=¡p«ÅBa~.q±ã¡‰r²³0 bšáܳ­²ºV Ä”-ÈÊœøÿãsmœÛã!9)qÞ×¹à‚wrDØg-Ïn½^?»åÓØÜ2§uá÷ûéë8gšO¢ccåG@!„bž{·Íǧ“*B!æEQX»z·Ü¸¼ÜlÜ÷IJŒ´T òæmÞÓR“±\1äÅüðÚ›{8VQÉÞý‡8tôÑo ·õNš¦çß…´NGXU/nšŠ‚Ýn›•üjš†ß`hhxVËÅ`0°iýš‰IÚçÊ®×wKè3!„B!fHŸx¯ƒB1´wtQßØLʼn*zzûÈÉÎÆŒ†ùû2àøË!ºº{¤Å9ÛIiq! ñq«¨Äɺ5+Ï9¡qum¹ÙY³þ$üL¸ÝZÛÚ/8¢ :½Ž¬Ì ¬VËEÏ«¢(˜Œ&FÇƈŠŠœÕr‰°Ûq»=ôõœöýÂÒb2ÒSiïè:c›ÍÖ²yãZâbc…C O/<×ëÃíö‘žÊ¡#Çæõy`0èåÇ@!„bž{·=„"¡‡„BˆKÈl6cÐ뉎Ž"-5EQ°˜Í ôz=±1®ËæXö:BCC³Tª˜ ( &“ ¿ßÑh¤¸0Ÿ²’"Ìf‹–ž7‘Ñ1çaÈ­öŽ.öì;xÁé,^XÊàÐMÍ­ètzÆÜn¢]âæP8ÌÀÐù¹ÙsR>¥%ETÕÔöÝÑcDEžëÕjµ•™ŽN§##=•ŒôTjêxýͽӺA«©kO!„Bˆ!„bÙlÖ‰ÎÑ„ø8ì6Û®GÓ4ZZÚ“JÀxXž¥‹b·[Ù½÷7ß°mÒâs ‡Ã4·´RZ\8§§v¼L8|ᡇ=F¤ÓIrR"£cc³6)¯A¯ÇëõÎYEE:1™Œg„zÇ›Y™é¬YµüŒ·JòrÍ«¯½IÿÀàx¨§) È`B!„3¸_"B!æŽ×ëÃï÷ãóù9xø(>ŸƒÁ€ÍfÅl2¡ié©”ÎÛI‹ß®¯½^ÏñŠJg9¼¨ªÊþƒ‡0›MìÜõK•‘ž6õNðã•”–ÍÏsÙçCUµ NG§ÓqÍæõ¤§¥ÎI¾ós³©ª®%SRT0ëûKLH ¥µíœëôööŸu ÚÅ­7_ÀÈÈ(GŸ ««ûŒÁ†SR’1M4ÍñdÊB!„B\î”üâEšƒB1þ8+ ï»ã=DDØéë`xx„ì™ó.Ÿ@'žÞÎ証E ÎîÔœ¹9 p:"¦¼]]C#)II³«ÿbyõõÝÔÔÖ_PkW-¿$“”W×Ö“½ Ã,ÏûðÜ £½£ó¼ëY-n¾a+N§cJéz½>jë¨8Q͘{|Ò÷ukVR—À¯þ÷‘y}^œ ¿%„B!æ/¿?ð®:^y£@!„˜g4Mã=ûPWTÔœ<õ;³|ª¸Ý©0qV§BÊX-Óïì‡Uš[ÚÈÉÎÄ0O'ñ.)̧®¾UYø¡¤Äx òs/IÞCÁà¬ÀøS(ðú|<ÿÒËÜ|ÃÖ)µ«ÕBYI¥Å…46µ …ÈÍY 'B!„3$B!Ä<ÔÒÚNbB<%Åttt‘˜Ýn›yÓ4–Öv)Ÿq©¸²Y­–.^H^Îô3ìŒÎÏÍ&S~üÄ”&=¾¢£]$%ÆÓÞÑ5ímÓÓRÙ¼a Š¢\’¼C¡9ÙÏò«ãõù¨ohBÓÎý"óÈÈ(ÛŸ‰U+–a4ðz}D»¢pœãMEQX•!'B!.½ƒÌÅ+X^”Nœ]ÁÝÛLÅþ½j%<¥ ΊJòɈ³£óÐZ[Á±¦A‚FÌ! =$„BÌS&£½^ÏÚ5+HIJÄx ç,¢£«›P(D[{']RAâ¬íö¦®%Úåº(鵶u”?ïÞ*s»yåÕ7èêî™ö¶N§ƒ;o½éŒÉ{ç’ß ¶¾hWÉI‰³¾¿á‘‡ˆˆˆ ¾¡‰ã•¨ÚùoC z=·¿çÆ)‡$:EB !„bö)˜–ó¡O€•qï|øC£gÏïùñcûé>Wo¿>’Ò›>ÊǯÍáFø[^ç‘_ÿ…}=A¤óöÒ]3¿›ÈB!Ä<Y±¨”Ìô´K²ÿp8LM]UÕµôõH…ˆóÒëulÞ¸î¢ ètÊE™4øbfû_wàõz§½m\l Û®Ù|I `¼£º¤¨€öŽ.FÇÆpDDÌêþ"N"Nbc¢ÉÊLgÇË»p{ξ,ÓÖÑIÑ4 ®”[µôÛ¿Êg#åž_×â¿)Z >ÁýïïæÁûž¥-„Bˆ¹¤XÉÜpغˆÌH#ª·êÝÏòÈ“‡è )Dälâýwmfqj¾ö>õ(ÿw° `ˆYÈ­¾…u¹±(uìzâ÷ !„“1ý>y[*~õ]ªucÏXÎû?ù!þ_{=Vñÿ´uû/ù÷vc)¸žO}ü3Ü5üMmŠãÆþË[þÀ÷¾Z·ð/ŸøÁï<À“‰g_Ö&"c1+—”±jS!Ž;¥.n’¾õNV9Á_ùÿÙ»ïÀ8®ûÀãßÙÞw,zï• @°Q¤ Õ{±$Knç¸Û‰ïœsâœí—Kq.NlÇql¹Û²$K²ze¯`ˆÞ{ÇVlßû$DˆEŠ’ïóv3³³o§¼ß{¿ßSüÃö2rº/¿ù$‡uñÙ¯>LùÚ¹eG+Ïô†ß{gˆ©â>>²ÆJ°ùi¾ý£= šy icäÝdEЖñèã«hü·ýLˆ¬¯ÂAAX"â㩪,¦;ÑÎLµ"Ë2]ݽØlVâßÓ;Ÿb±ÇNÔsìÄÉ÷Í'.gZQ½ì¬ ÁèØ8Ûwî%²yÓºsvø{¼^úú(ÈÏ#3C=«-º=^–•—.©Ï9::No_ÿEÿ_zZ 7l¹­f餜‰É2­í¬¨ª¼,ÛÏÌHcÛ[èíëgxd‡Óuö#¸ZMѵR¤XR“X}¹wE 2cÍûÙë™®ñ¡ˆßÈ×¾ZÆö§'ØüÀ &Ÿü¿ ¯å±‡·²<ÃBÔÑÑןá{zˆ}‚oÝ;ȳõYÜr})ÉJ­{žçç/œ` @a¦ôŽÏò™Í%$â mÿŸøåóG )Ë9ÖÙ‹ºêc|ãá¿ú‡_pÌ#‘°öS|íö þë;OÓì“Ïêø0ÞÀ‡ÞBešÿH ;Ÿù-/7¸ˆ ͱü–uüÕ_WsàUë¶Õ¥óÐøÚoyÕ·†‡ï¨&Óà§sû¯øÁ›ðˆË“ W ÙuŒßþp7­­#z”¾)|¡0a?Ä/ßL¡óþnG“àè‹ü¾fŸ¼.›"ËXŸÐÃóÿvˆ>§ _à…ßவi¼Y»jÎe/÷ bÉÎ%ÍÁ錑$¾‚ù¥NeMM0Â+8ønà”ðÈžzõzþîždV¯Iå…Þ^f… $++n]!Öů½÷Œ A:7~ê/x°Dƒ³ö^ÕÜÁ#ËobCJ-³ „…%‚ ‚°DŒŽÓ×?H(¦¹µY–‘e™P(D dbÒAR¢åËÊINgkT… IDATNDBB¡P Ñ|ðÚÁP‡ÃÉÀà“'ccï› DΤT*ÙrÝrs²ÎZ¦P(fÒÚ$%ÚÏZ ‡é¢¬´øœÿk³Z–ÌçŒÉ2ýýƒ:rì¢þO«Õ²|YËÊK/{º¡3E£QêšXV^vY÷++3¬Ìtü]]=´¶w"Ë2«WV“š’¼¤ŽÛ‚ö7¤ßÄ>QÃÐ~ÀW8°,¿‡Ï=fCuøT‚±Œn:ÀsOþˆfG9ÿß·¢yó¿ùúÿëC‘»•ÿñ?>ÅcŽoóë0h2oáÎáßóãoýO| úÔÇø¼÷;üK¨Öq£í7üðo‰7¡†}úq>áv¦ðñÏ{?=ö4¿ZñW|ø¡Jºž×ðè½vüד´øÎî±WįåSŸÝÂÔÌ_›"iåÝ|úScò›ÿÆžhÍœÛøY`*á¦ôŸñ½o<‡ºúþò‰Ïñ飿៾ñ4±²ûù_¿‹•;ZØ.†T ‚pŠ8;¨s‚²š¿üî‡Éœ~Ê·ê¼èoR‚åÝl‹1¢Ч&cOÉÂäî¢×{j¡ýÄÿýü1¬Yëxüóás[¾Ë÷ê0|ÇVî^ÛÌï;0”ÜÌÃ5¤a5ZB^BgœtCÞh è s-Ó£‡z¿Èž µbÕ( øÞk“­Õ‚zƒg_¹j´j ä'È»A‚‡ÎLF@TZµ8æ‚Axjµ½N‡V«™y˜>C<ŽŽ„‰Fc„Ãa‘¦C„Eã>ÕÁ²¡‰ÊŠ2Tj½I’Þ÷;AGg·8ˆÂ“e™I‡‹Å̪š*‡†éëD©T‹ÉìÚ³Ÿ;oÛ†J¥¤§·Ÿ£ÇëÐëõÜyÛÍ ús®³îTÛ]Êúú9rìã“}ߺy#9ÙY(•Ks4ü²òRZÚÚ)/+Aqç a¡)0&èð Œá‹½Û1>ì#zú'qÑïŒJ ñdçï`ŒàpBqzD§†›é°ñ áÓÛ1)e¢ža&g,ƧIÀnŸ{x=M¼ºÇÃ7nâ·»úžó'¡Äœh$<>zÆçpÑrà  "ó¼ûíƒX_èÔžÅbȱ¾Ó½_²LLÄA¸‚ÏóúälÒ•Ãt ú‘ca\Ýûxqÿ |uEÚíoñƒŸéùȽÎ??¦ÀÕYËÞ#.’ÎfE©TF‰Fcäç°¢ªò‚:Þ¢Ñýƒt÷öÑÓÛG0(.Í‚ ,¬æÖvš[Û§ïEÕjÒR“ÉÌH'%)ƒAV;]4Õãõrôx=SS>‡†Å.ø-I±XŒÛ¶Ý0“>H§ÓaÐëÙ´a-’$1<2Ê˯½‰ÇëE’$‚ÁV«uÎ €J©\’)eN]=H¯k ^ô:–/+'?/gI·f³‰²’"N64‘•‘ŽÍf þ²ŠábHOÄ èÁ:ì)”g”n˜¾Žâ›ð!U¥aU`êTG‚-Ý ^þ()$jt†b€}R †@¾˜ ¥9…­DwXžY¦÷u32nF*=Ï:íkxx4õ$r×}•ûéq\gÝžG™rP—%`  •7oÂzâ Ï»ßb¤¤ W3¶òåÊí|í÷ᔨõjbá0Q•uß›|ÿÏ1}z¶°æó+p´àíÅcÎ&ݨ Ï…‘ôlžžQ\s.›# +ÌߥÛKý o3T¾ô;¿Èç¤_òÛ·› ‚.±”y‚»Òß Þhðœ=£ 2Ì¡Ããl»yŸùÚŒfÅ{‚ Y+¹{k"LdÏYÅaþ‰@°èLF#Ë*JINJÄfµ V¿ûP0åó¡×éÎÙq …Cüþ.·›ññ zzû‰|€‡ø™ËµBAnv&Ë*ÊH´'\ÒgS*dge•,¯ehx„®ž>ºº{ðûâËaA…Ãazzûééí?㼤D¥R Å.ZUe§“îž>^xé56mXKIQEy³ ̦$'±¼²œÔäd =‘h•R9çz{ûÈÍÎZzÏ{±»÷`dtì¯C¯×QS½üŠø~•J%•eŒŽŽSßØDQAþ’*¶|m Ñ¿gulœàé#“˜ªîá¾B~ï{e&ë·Ór߃^úí>×AöO~™;o+£õ­(J¶qGŽƒýO25<÷2Ñ­¼Ï_ý¯óƒ_§ð•/§ìŽOów@,³º´ ÕÅ:³Æwð“ß=$0d®å¡OHï^¡Å/"?ÂÂaÁ™Í&V×T£V«©oh¤¢¼”¬Œôs¾×h0̹­FƒV£9+ϯÃéâ™ç^¼àý‰‹³árºff(ܶíFRS’>ðç“e™p8L8!‰ O_ŽOÏ&P)•„Bâ-Âå1=C**„ð;QÀÊ˱'$–š2ç{óssÞ½ÁÎßßmBvõrø¹ÿä©“^ä"ˆ8°cj%Ÿþæ£$à ußÏùׇ‰@°÷^ó¯ásß|Œ8yœ¦]?ã;G GÆçXg€¤-Æݦ½üëë}‚ý<õû•|ã‘û©jÿ9Çü ¬yø#¬=ù=z¦ìæG?6ðøŸãÿ>ª'<ÑÂŽ'Áîñ2sïwÌ"Ú€ W·ÈЛüð¾ùS|ûÃVbŽnjŸýO×{‰Äð“Ÿ'ó‰¿Àw‹2Ñ]ÇKÿïÇìý¼ôï¿@û‘ûùæ÷â`¢“=?û!/õEÞg™°ß*£û~Æ7úVrË­›Y[ž…M-ãw ÐR»“½é<ðñëI¿á³üO~È¿<ׂ÷Œ©1o#¿ý·§1|éA–Û¯ç+ÿ¼Š±!a]"iñZ DÛK?â'¢:°(¤âò*’æB’HNN"Ñž€Éd$!>ŽD»}Þóó†ÂaÆÆ&him§«§I‚ä¤$l6+“ “ɈæÔˆ¸X,ÆÑãu¨Õ*jª—“œ”ˆÏ秭£“ѱq z=e¥ÅÄ]ä”ûP(ÌÞ‡€é †N§ÃãõÒ×?€ß@¡Pž–ÂÀà𬢂 ‚p%P©TÈòôõ둇îC¯ÓÍÛº‡†G0Ÿº^_ní]ìؽï¢kH’„^¯# ñáGX²©”.ÖðÈ(µšøø¸+úsüäÉ_/éýÓjn憮ä|çÑ ¾÷wÏ#ú‰AárR`*¾“/á2QÚÿ-þe×8ïƥЦPµõ6×”hD˜ ¯ù{ÞÞÎÁÞ)$¸Œ®µ”âbF0¯ôz=7n¹N» ëâðÑŒOÌÌÈÊLç†-×wôbfÆì¡XƒžåËÊéÃ#£x§T˜ŒÞa¡Ñ¨Ùr݆³^—e§Ó…N¯C§ÕòÊëo34<‚Íj!!!{|<ññqØâepº\LL:8pðð¢ÔaA„¹¨Õj23ÒXUS…ÅlF–eÚÚ;yî…WØvÓæ©ó85%™õ 3×âË¥îd#G×_tàôõÞçó“’œ„Çã·cs¹¥$'ÑÚÞV«Åh4ˆ… ‚ ÂÃÛò"ßû·Ÿ~¼ ‡/r΂ıà0G_ý G_GL¸¼D @¸ôF¤RQŸ‹´´uð‡g_àÆ­×7=ÁeµZ0 ŒŽ£V«ÉËÉ"-5å}Sœ$I¤¦$ÏÛ>J’D\œ €¡áQÒÓR¹nÃZÌïI™tZ‚2§ËZ£9įFƒ””$††Gðùü pU$‰Í×M_Ï%iÖëE…ùجVjcͪš‹žw.^ï)ÉI—å³F"&NâãÐét(Hpš^§cãú5órL–’¢‚|Ž×¤ª²Bü8AA.I oÛËüó×_‡BXúÏ…"õp)R’“X¹bùLG{Oo?»÷ ‹RUYAIq!jµšÈ©þ*¥êMµv8]446ÓÞÙR© ¼´„òÒ"´Zí{ìNM-´wtÍÔ5X2'Iº¤Ž“ó1ô$Úðz§0¤¥&ÓØÜŠÛíYÒßW\œ kWÍ´õP(LíÑã46µˆ W¼ÊŠ2Š óq8œØíñ ƒËíÁåv“’œ„=!Y–‰F£¨T—>ÎÄàtº/©FÐ~T“eþðì È1ïÔÔ^V«å®Û·a³^}‰Õ'NÂá0ÉI‰Wìg¸–S ‚ ‚ óC¤„ d0è¹ù†Í³:ë³³2ÈʼŸ±± ú‡xöù—ˆF£HHÄb1‚¡)ÉIl½~ãy Ï~XuðâËo ‡ÉÍÉâúMë祓b±ùÆÆÆñx§p¹Ü4µ´-‰Úù¹9df¦cOˆÇíöàt¹(+)Âát12:FgW£cãó¶=ŸÏÏòeåèu:Ž¯£©¥mÉ lV 7oÝŒÅbžyM£Q³aí*,&]°ÀŠ ÂB“$‰æÖvêN6μ–ÏŠåËHKM™IË'IÒ¼]’é2ÕûUH:­–±ñ‰KZOnNÖU$èíë³ AAá#Â&Çdàì§|I’HJ²“”d'!>ŽÎîž™\þS>½~VZƒ¹øýÆÆÇÙ³ïÐ̈ûÁ¡aöî?DA~.éi©WÔñÒj4$'%ÑÕs„Ö¶ŽEݶB’HJJ$.ÎFSs+jõt'w(¦«§ŸÏGØl&;+ƒl2HJ´“”h§¤¨€—_{ë’;TÎôêïF¯˜"ÏN—›Wß|‡‡î»ë¬¶»¬¢¥RÁ޵⤠Â%7'‹µ«kÐét¨”J¢ÑÞ)/}ýƒŒO’7gÚ¼K¾.)$ÅM·7épbµX輤™§E#Wg•Ø±ñ‰yMÉ(‚ ‚ •A „ÌðÜŸ^¡²¢…RIA~îYµ²³2pº\¼ñö¶\·á¼³‡ðNMéí`xdô¬÷ƒ!Ú;»‰‹³]q…BËí¦½½sÑ·½eóFòr³(+)B¥TÎŒŽ/ÈÏáÄÉF¶ïÚ‹ÍfÅl2b0üFFÇp{¼óº?á%–jéB¸ÝŽ8IUe9 …â=í<“½jQHHÒáÚd6™ðNM¡V«ygÇ’“Y³jJ¥«Å‚µláGÉ«Õêy鬿»÷Àår ÍÏôá¡‘QüzîªiN—›‰ÉIJŠ ÅEAA®1"P œ“B¡à¶m7F¦¯‡ÓÌÎ_ïñzÙ{ –•+–Ÿ³ p_ÿ Í­X-”ï“®Àjµðú[;ˆF£g-3 df¤‘™™Nzj jµúŠ;¦²,³ï@-±Ë¢¦¹µÜœ,$I"þT¡åÓ´Z-«kª)/-æ·vÐÛ×/~s8rì­mäåf“œ”H¢=H$BÿàZ­†ûï¹ZMsK;'N6â÷‹bÇ‚p9™LF,f3CÃ#è´Z‚Áàe9/q6+[¯ßD|œñ‰Ib±ññqç¼~/†„ø8üþzýât´W”•°}×Þy[Ÿ×;Åö{¹mÛ WEûÃíöˆ ‚ ‚ \£D à&IU•H’ĉú“D£ïŽ‚ŽÅb¼³sÛnÜBÕò Ö¬ZAGg7ïìÜC||÷Þy+CÃ#ìÙ—ËMWw/9ÙÓ¹zO§fimë ¥­ƒûîºí‚Š›N¶íë -5…ÌŒ42ÒS‰‹»â·ÏçŸ×ô=c`p˜=û±qÝês¦}:^w’ºúF‚¡ IBR(ঃc'êÎz}ó¦õ33f–U”RXǯÿŒ¨] —‘V£áÖ›·Ò×?Èî}A’àüMêu:”*åLÀžÙ÷K£VYÄô=é©ètºy â†#á«¢´wvcÐë),È'AAA¸F‰@Á5Ìl2â÷û‰Æb(Oå&>“Ïçç¹?½‚R©$/'›ÌŒ4âlV&&&ikïÄl6¡Õh˜˜tðÌs/¢T*ÐëõA"‘ …‚ç_|•­×o"Ñž0ç¾ôöÐØÔ2$P)•¬ª©")Ñ.¾¨yÒÜÒF8fUMÕ¬œÓÑh”ãu „Ãaì ñÜqëMtu÷r öÈ5WÝýÿ–Ì&bÑ(kâöxp¹Ü¸Ü$„˨ ?‡Ãɾµt÷ö_Ó3|ÊJ‹XQU¹äöËár‘—›³hÛëí˜÷vp5äòoln!=-«Å"N‚ ‚ ‚p ‚k€^¯'‹g³ÍÊûŸ•™ANv&½}ç=Fië褭ãÝÜú;÷ì ¨ ¤D;­í„B¡éBˆÞwsßyëÍDcQºº{±˜Íhµš³ÖßÕÝË[ÛwÍz-òÂK¯M×"HMÁl6a6™0›ÓiŒ.Sš„K¡V«Ð¨Õ3…™/‡Ž®nFÆƸ÷ÎÛÐé´„B!þôÊ35b±½ýƒC!tZ\ Ç;=Zù”¤D;y¹Ùtw÷33á²hïè¦Ùª+ðš1ŸÚÚ;ñ‚($ »=ž$»«õÝNá`0tÎëóB ø§÷i±ôöÌû:ÇÆ&ˆÅbgÕ®¹R445“•™Ùd'E69>.‚ ‚ Âg4_[ƒiD à*¦T*Y³je%EH’D4åg¿üÝÌò“ÍœllþÀë³ ‡™˜tzOa@I’ˆ³Y †Bdf¤Í9ânÏþCtttͪ{p&§Ó…Ñ`À`УR)‰Ådb§f@\ib1™å•åÔ9~™÷#ÆÀàùy9ô âp8ß}hu8ygÇnñãù€RS’Ù¸~ 6«‡Ó…ßïgxdL¤q„ËýÛ<#­Ýµ¦¦º’Üì,”*%áp„Þ¾~›ZñNMa6™P©”$Úí¬¨Z¶ø×Viq7wæ@†ù284LK[¥ÅW^^ÿ–Öv2ÓÓE@Ÿ À±õÄÇűõú³jȲL D­V¡:UØxÕŠ* z=G×s›²,£R))).œIst%Ú±k/ÝK¢ˆ¦Ïçç{8|ì@ðŠnçi©)æg³ÒÓ7À‘c'.Û¾hÔjn½yëLG[œÍÊmÛnÄíñðÆ[;ÈÊ̘iÓgaá]«A€©)qg±Oˆ£zù²%±o@€P(ŒF£^ðmÕ9¶`AÛº“W\  ½£‹¤$;‹Yœ AAAD àª¤T*Ù¼i ¥‚¶ŽNêO611é@¡P°uóFl6+Ã#£ô Ñ×?€,Ëäåf‘–šJoÿÀLšÓŒ«jªHOKÅ`ÐðÖö]tv÷ÐÙ݃R©$=-•-×m@£QÓ×?ÈÈèO=ó:•J…Ï矞ž/IÄÅÙ°Z-ôö ¼o!Ãîž>FÇÆYV^ŠJ¥" ÏÌ`…BhµZôz¹9Y3Åd—šÕ+WÆèìîY2ûäv{®¨vmµXÈËÍÆj1c4N¥¢21épÐ?0D[{Ç‚ïƒF­F§×¡V«™œtÌt¸ÅÇÛP*•çk1›yàÞ;ßÓªédÿÁà ú=( í Äb1dYÆíö\ÖÔW‚p9¨Õjô:-n÷šüüÍ­íÈ2lÚ°æœÅì/§U•46·b2ÉÉÊ\°íC!êš,Pà÷˜òù–ì=È{µwtg#Îf'AAAfHÅåU¢Úæ5båŠåg"bϾC‚Aî¿çv¡0f³‰½ûÑÚ>]“@§Ó²rE6«•Ô”$vìÚG[G' …N‹ÏçŸY8¦±©•Öö‚Áþ@‹ÙLJr"ƒZƒ? £«ŸoþŠ * rs²¨©ªœ•{y©p»=<õì ¢!~€ï´´¸”ä$$I"‹184LWO}}Lù| w‚”$R’1Mèõ:VT-C­žù:B}ýƒ¼öæ; ¶ïÝó»£EeYfhx„¾þAÚ;»æõ÷'K™ÙdÂã½6’$‘hO ¼´˜‚üÜ ú—ÛÅl^´À‚×;EOoåe% ²þ÷¦^œo ñÜw×mK¾-ȲL}C™éÄÙ¬W}ÛÿÉ“¿'?AAA¸bFÁ5B!I(•Jº{úG"„ÃaÂá0©ÉÉ<üÀÝD£Q$I"¤Táñx›ùß@ Èž})*ÌÇž‡? `‹ÅÌ]·oC¥Tòâ«o2>1 LÞ\^YÎòÊr€9‹üUUV𻧟{ß*‹ÑÑÙN«eýÚUKòá\¸på¥ÅT.+Ãd4Ó#B;A[[ç‚Š³Y‰‹£zyŬ”gºÔ ÁðÈ肦JÒh4„C³“$I¤¥¦š’ÌÀàÁ`ˆMÖ ÕjŸdxd”Á!Ñø„«Îµ$0 Ü}Ç-ç}ϙŌÃá0kró ×/Ú>šLFRR’™85SkþIètÚK·gÐë–|;e™ãõ ” ×éÄIAAA„³ˆ@Á5"&ˬ=:ówB|›6¬E’$j§«§ÇK,›s­m´žQç tª3!!.ŽP(DO¯ƒ×Þ|‡ä¤D’“‰³YÑëõD£Q‚ÁS>>ŸFƒB¡ »§Ø¤hhjÁãâæ6/™4 ’$-ÉYK•B’X^YŽÑ`@–eÚ;»9X{¿áGÀ—•±aÝêYw4¥½³›†Æf&& ú9‚Á Ͻø*¥Å…Lù|ÓéǤé€]4ejjz&ÆŽ]û¦SPX­øüb† \M$I"àÐÝÛ7“Ú'  G"˜Í&\.7»÷¤º²‹ÅŒÇãa||’†¦ÊK‹m_N9Ù “~H©T Rª€… ,õ”Cn—¶öN–•— ¹‚ë= ‚ ‚ ‚°°D à*¢T*Ù¸~ f“N‡ÛíadlŒ`0D4¡»·¦þÀĤƒç_|õ’¶FikïdØdÂh4 ÕhYE#{ûúéìê!?/gI|7GŽ`hxI’e‘íë|ŒF[®Û8Óñ²c÷>Ú;ºõw´Pêš8Qß8Scc¡É²Lcsëû¾Ïápâp8Eã„«ŒF£Æl2ñÎŽ=ÄŸš“eìñqH ‡NKEi1¯—]{PZRÈæMëINN\”}ôûýx¼S„ÃaT xþÕëux§¦æ}½’$QT˜¿dÛ@{gJ¥’šêJñƒAAá¼D à*F …B¤¦äÓéS²³2f–Où|¼ùöNÆÆ'Þ÷a:>ÎÆĤcÖ4ýÂüã“3£ýOËÏËÁçó35å#^t]I’¨\VFB|míK"˜' C„ÃN>ñ‘G …B¨Õêóδ ƒ¬ZQµh³ñÜ##c¤§¥’hOXÐmi4 s/ ÓjINJ\rß}8¦±¹•¬Œô9Sè ‚ ‚ ‚ œI ®"&£‘¢‚sjs8]=VG|\Y™sæF/.Ì'‹QTG}CÓL‡âôˆ¹<ÒRSصg?0ÝyºC! ±wÿ!œ.7zŽ[·Ý@B|­í´´¶só ד•™Ž$Id¤¥ÒÚÞÁŠªeH ~¿ŸCµÇèìî™·ã1åóqôx=kV­¸lßÉþƒ‡éèêÆïˆzr²3)*˜t qèŒtYB’$4j5Á ±o;«¸÷b$‰ô´T¼÷N´Zí¬åƒCï;I "  …X·f嬜Òí]ì=P{Á3$I¢··ŸÑÑq IÌl„E¦$b—é7wºÏÿBRά®©^Ô};=sÌ`Ð/ø¶’“’ž÷õ‚A¢ÑJ¥bÉ´7×KgWËÊKÏY#JAA˜gJ y5ëX[‘M’Ibj´›úƒû©írsa ·%TÖ **KÉI4¢LÐÛr’ºÎIBâÑ]XD"Pp©©®ß»ùË«*+p{¼ŒŽ““IGW;ví©q°¬¢t¦ a~n@`Ö솂ü\º{ûøÝÓÏ¡P()ÈËahddÞI}CE…ùÄÙ¬‹ú]Äd™æ–6Š ó‚ `µZ¸qËuH’„Ãáä­wv]tÇÚ[6‘“…Ç륩¹õ ¨T*ÒR’éí˜õÞ÷ŽÚ¿Þ$HKM™ ÈÍ¥ ?—I§“u ï»q*-F~n6ï.·­F‹ÇëÅåö,Z$A¸I’„N«Åf³24J¥’`(„,Ë >‹A³@³ eYÆï÷c2—Ä1Ÿ˜d|b‚ÊŠ2Á (\,‚ ‚°°wühRÖòÑ/=Á†¤3ïg«ÙxÓ=Ü¿ïüË/2>O߆ÒÆò{>Î'o+â½ù ‚=»xòÇOs`$Œˆ‹òŒfOJù¦8 W>³ÙÄu×ÍzÐŽÅb¼ñöN‚¡[7oœIÁ£×ëIˆC£Ñœ”HaAFƒµFÍÐÐ09Ù™ÄÙ¬´wv †ˆÅbŒŒŽ‘œ”ˆ=!I’Ðjµ¸ÜZÛ:ƒ9v‚腉׬ªÁpª#B¡Î9-ß™Áº5+ÉÉΤ¢¬“ÉÈÈèجu]Š”ä$*+ʽ¨±,Ë8œN>†Ûí£·ß‡Z­¦¦zùLꉮîº{û.jFƒë×L·O—ÛC_ÿƒžì¬  +kª¨(+¡¸(—˃J¥Âv…™>^×€Çë½ ÷nÞ´ž¤D;ö„xÒÓRÉËͦ¤¸ªÊr*ÊŠÉÍÉ&--…‰IÁ Â|°˜Mè´:‚¡.·û²îËØø^ïCÃ#dgf,©Qæf³‰¡áQ¬ |.NHˆÇO$Áãñ¢V«‰žÜp)Nß?ùý~dYF¯_ØŽù“Í$ÄÇ¡P(ˆÅb„Ñ™Ú:ƒCÃôõ¢V«Ù¾s/'êORVR´ µw–²£Ç뮡©lûÎ_³¦g7G'£¨RnáÛÿt“ïìg(ª§è¾/òµ/=Âjï!ötûÏÓÑ a.ÚÆ'>ýQ>þÄÃ<¸m-E&m­CLÅA.™ {ͽ|ö Ÿä“Þ˽7¯¡Ð䤵e_ì|ËNÿ¿Ëê/ð{¼ìª#2kÝç[&,…©’ýÍ'Ù˜ ê=ÈsÏü‰—¶×Ò8Å^IzN«âzØ{bôÜ3$ 5ÿkþ|k:êác¼ô̳<ý§7Ùq¤qu:ee¬Ú£ö(Ý>q1ã,%\</zùuÊK‹)ÈÏ pˆþAŠ Ÿ@§Ó¡ÕjÐΑ~  /‡”3ŠædeRw²€@ ÈÞý‡èíëgõÊjFÇ&èèê&7'‹å•å zÖ™Qàv{ffÌ¥¼´xö V¡ ¤¨€x›7ÞÞA|¼Á¡‘Kêd×j59VGZjòûŽÒžO^ïÅ…äådóú[Ûô}èu:Âá0jµ{BÂL'È…vÔÜr󖙀P4åðѤ§¥rã–ëؽ÷«jªÈÊ|wVKjJò¼×ÅXLe% “eâãlT”—ÒÐØL\œ £ÑÀÀÀ*•Š„„8&&3…LÏþhIÔjI´'o³ñöÎ=‹ZØX’$²³2e™þ¡y  Âå¤Ñh¨©^ξµD"—ÿ1- ’•™NR¢}Öë±XŒá‘Q‡p»½”̤F[Ìs¿ÛíYø^¥’Üœ,ÒÓR…Ãx<^^yýí ¾ÎÌÅd2rèð1dYÆd4RR\@YIÑ9gŒ}P]ݽètZtZ-½}hÔjœ.7M-mD£Qr²3ñx½ŒM̺g²Y-¨–@&añÅ\õ<ó‹^z€2žÊÕY ýä¯ùç#ÞóŽFT˜—óÑ/ÞIòîŸò­ï·0e_Éc_ø_ŽŒòõ?ö!†‚ \EÂz>û©õ¸Ÿú_=<É+xô Ÿà³#_çÛ'+æ\ö;skØ°²Š 7”aixûÌ'*Ìs.–šìÛ>ÄF+~Ë×ÿ}ÃáS‹ë8x¤“/}ýQ–mø·¿ÝÌï{Âïm˜+âë¬Ïß~'§fHÚ·X‘tå<ññ5ÔÿÓ^&D¬@X`bFÁ|<äêu z6¬]͆õ«1ôŒM`Ðë ‡Ã‹¶S>Ý=}x¼^=ÎÉÆf&&'  lV+ ŹGןž)0sÊS«èîé›Õqçv{hjn£·¯Y–¹ã¶›Q«T$%ÚÑhÔôL§+êîéE§Õ’øžN‰ a4¨\VFaA½ž¡áÑü ïr¹§»§¿?@jjò¢Œ¤Üµ÷ IABB<­†Î®ž+°]ë)ÈÏ%>>nºv@a>²,ãö̇N,££«›Ž®²2Ò1dgeÐ×?@8|þN6…BÁýwß>k4ªB¡˜=;4B~^99™¨Õ*tïé¸Q«®ÜX©Íj!ÑnÇåv³¢º’‚¼JKŠÈÍÎ"=-•ÒâBŠ óÉÌHß Ý™ç²ÒâBÌf3½^O|¼¤D;)I‰ z‘Èû~'£¼´˜œìLt:¯—@@¤é®|Ñh”ä¤D*ÊKhmＬûr:@ZS]9ëu‡ÃÉ+o¼=]ä€[nÞzÙfXMLœÄX°_¥FƒÙd"9)—Û}Þñqq6âãðz§Î}ïuf;Ib`p—ÛÃñº“X,f,fóÞ×Á!šZ8X{”ÆæV</=½ý3³/eYÆápž3^(&‰b·' ºg\‰3 ¶ |ý»wÈàCŸû3þÇcw°):ë:™ ƒ¹ð&>ùÅOóéÇïçŽë*H ÷Ó2 eë_|™{²Ìd¯^KÎh-µþj>û¥ no¡è³ÉÃ9’«ÖPàjÄyÃÿáo× °ãða@aYÉW¾÷yršvÑb»…ÇVòä¼LÇT˜€³Ÿ^E w­ °oWSb‚¬ Â%‘´É¬Ú\F°î'ú\Ä É”¯.E>þÆl¬œcÙþöê T')Á”F‚§–מ5 "qÎe‚RgrûGo&_7ÂsÿöŽºg÷[żýtÉ5ÜX–„=|‚wNºf×+âXÿ‰ÇYmíä×ÿü;꼧ƒlûü_òh™ÇÁ§xf¬€ªŠ,üGvÓì‘aa‰F£&3=ü¼œ™½§-+/™êÝÓÛOÿàj• ïÔƒƒÃó:Š9)ÑÎøÄ䬎ô¶stJŒO7s¼î$ÁP­FC~^å¥Ås¦åINJä¡ûï¦îd#Í­g=T*Š3þ·¼´˜®î^†GF‰É2£cã¨T*ìöâlÖ9·s¾ÜÄ%Å…æ34<‰úÆ™‡æ‹±fÕ *ÊJpºÜ¸Ýnâãâ´mtv÷Ð×?@Oo?©)É‹::{¾ zn¿å¦™N#Y–‰*rÝÝÓÇŽÝû$æñxyêÙNõ·H\H¨X,Fø#v33Òiln¥«§—åËʯÊ<Í™idf¤ÍïÍ«$QT7STú½‚¡Ï>ÿÒ¼Õxhhj¡¡©E\T„«JjJ2ÉI‰ŒOL^ö} ‡CŒOÐÑÕC~nöô¹ÖëåÍí»¸~ÓzT*‹ù²u$‡ÂáKêL¿éi)¤§ÝÂÎÝûÎÐIˆ#ÑžÀŠêJö웞UyÞÏ !IFƒžž>‚Á‡FƒÑh¸àëàÉÆf††q8œ5»î\×Çõ t÷ö±aí* z=>€X,FFzꢧe.q÷¯ká?¾óU†mÕ|ø~„'VäïŽðg_ºíkÿÉWÿ±)ÿF>ó™ÏóÄä7ùñ¿~û?|ý“ÿn ¢L:µ®è$;¿ÿ¯$þý—IýÕ7ø÷ÆÚ‘¢Ÿ[OŽ¾‘¿KÙuxñûþ0!žáë_à:ý¨¢´RPd#48€WôK‚ \²˜³–ÿ¤Œo}ñ«üëG§_sïý!_;ä""Ͻ, lŠŸ¡!ÿñRŠfMœg™° TVÒ­@ NǹB3Q&;ûñ“‚5ÍŠ fÏÎÓ&S™ô nrúB+i3Øö…¯ðH©ÇŸò÷OÖ(/ç‘ê Ê3ô<ßïµ „…mÖâ\ÝÓù`³³2fñ•e™@ €?`bÒÉhÄçóÓÙÕÃÐðÁ÷),GYiñq6N64³~í*ÆÆÇykûn2ÒSééíÇ`Ðcµ˜Ÿy¸œòùHKK¡º²³ÅL$9«ðñ\ŸuõÊj*ÊJxæù C¤§¥›“M]}#‡cåŠå( üþÀ¬wm]´ut`µX(+-"ÆÐë´D¢QÆÆ'˜œtPR\Hiqá9óè* ÒÓRIMMáÅ—_gtlü⾯S£È­3M-m †yM ð^y9Ùd¤¥ …Øwàð‘ÞÆjµPVRD^N6z½Žh,6ÓiÔ×?H$A’À`0 T*‰Åb$'%2:6¾`õdYžu4ôÓµ\ ŸU°:&ÇP©Tˆ“Ö<Òj4<#!>ŽªÊ \n7§‹p8ŒJ¥"Nc¢×A¸: ðâ+o‘žºöeI’ع{/{÷bóÆu´wta2HJ´ …°Xr/ÛþMÌ™m±äçå0épžØq8œäåf³}çÞó£Öjµ(• B¡0‘H„“ͤ$'‘“ÉŽ]{‰D£l½~Ó9ƒ1±X ŸßÏÎÝûÏy^œó¤Ëåæ•×g§!HOKå–›·Îð!, ’ì`ÿó;éðFÀ{‚½í~·H¨º‘2ÏÛ|ãµfÆ"@ý«üjÏ:þj[ Ʀ± ^°w?u±?cS®Ž†&×g3¹ç· †AÆÍ„@B›´ŒÛ‚;“ëøÏï6‹Ù‚ ó@™¸‰Ï|²‚Îßý#O |ì ç3›¿Å¿6”ιìŸwŒ!´.A±î µbÕ* øÞû6Z›-ôÏþ%5Z5öâÜA‚‰hÃA"€Z«F(”\ìÍ»$Qµ¬âÝ“$ ½^?Ò㌑íùy9´¶µ“h·ÓÛ?@ÝÉF Fƒ•5U$%Úñû¤$'ÎŒ;] 8+3ƒ{ïº ›ÕBK[™i ¦|>›ZèídÒá ³«‡8«µZEnNpv   22:Ȥ$'¡Ñhá¥Wß@£V³rEf“‰œìL^xñ5œ.7mÝŒÁ çž;oåÈñ:ÚÚ:ˆ…`±˜¨(+Àçó³{ßzûf¶»ÿàa‡Ùvãõs;…$QQ^Â;;ö\Ô1ß½ï =}ÓÓô ¥Å… ÚF¢Ñ(mí]=QG \òm:';‹ë7­#ÒÝÛGFz³i¦ƒ" “›“M$ådCZ†»n߆=!žþAêšq¹Ýx½S Z´9Îf;Õ>$&&'§Qí„ÃašZÚ1™Mde¤Ï¼ßï\ÒHLanwßq ƒÃ$$Äc:5JÖátáñxÑé´8œ.öî?Ä”ÏGJry§F1Ÿ)Óß?ÈÉÆfFFÇÄA®:Fƒ‰IǒصZÅ>D8á·¶ …ÙvÓ–éëúu‹Ãèè8ápø‚GÛ/”Œô4ÒÒRyåµ·fb²Lí‘ã³oœUª³êNƒg_ë‡GFùÙ/7s]ܾcÅE  V«q:]L:¸\n¤¿V%ÚÐëõx¼^ýúi_ =¥%E³ã>z‚üÜlâÎ1ºðD]µG_üóV$BgWJ¥’êå 6Õ>ÓÞÙͱãõçÍw¼TH’DMu%™éx§|ŒŽŽa±˜éèìÆj1‰D‰Æ¢ŸjS““ÊK‹QŸQ1#=ŒôéÔ7Ñh”æÖvŽ8‰ßï¿øÛ&¥’¼œl††GðNMÏLQH¹¹ÙLN:˜œtàõNaµZHJ´“”h§º²‚#Çëhimç{¸ãÖ›°'ÄÓ£%ÕêzžyîEûÐ(• q"›'æT°ñ] ñq3µR’“0 ŒO¢T;‰F­&/7›¼Ülº{û8|ä8§K\áª1åó-hðôb¤$Mç!Ù½çãî¼íf'±X ³iñ;‰=^/ýC¤¥$“”d_ÇH!IT/¯8ïÌÓ÷êô÷¯V«‘‘yãíçn ÔN”JåÌ}ݶ›¶Ì܋ɲÌÈèƒCÃ(ĵq ’ÏÑ$¢LML!Õ¤cScêTÇA\¦ŸÄD;YYèu:hm祿´hVág³ÉHgw/Eyç ¶(•JÊK‹).Ìçdc u'g²\¿f‹™¶öN:ººg^7 ”–RRT@(& ³ª¦Š¤$;jµ½NG0Âç÷Ÿ5“Ç`гiý*ÊJhlj™L³˜MäåÒÕ݋Ȭ°ø²2ÒgÍð8Ÿœ¬L²33hni£öè‰sŽÎ„+îQp ]âãm¼þÖv‡FˆF£ìÙwÂü\RS’l›MÍ­”–sYOoÿÌ,Ã¥"ΤKœoáp˜žÞþEù‹{B<ãã|¯Lï/êpœº¥ÖÝÉüîŸö2¢ŽãÔäeba“΀Å(‚pIbLÛIû½÷ðá›;ùùî¤Ì<~Km|*H aÈ^ÏcŸzœ}ú'_¤É/BF‚ 42:ÆëomgõÊj*+Ê®ØÏ!I™éièu:b²ŒV«Á Ó£T)Ù³ÿà¬÷ÖT/§¦z9ÑhŒŽÎ®é‘‡fJ¥•RIVf:U•,_V>ëÿNwîëuÓ镲³2fFyŸVV\ÄèèìZ7¬ÁétÑÑÙMsk;ÉÉI³ ªJ’4S¼5rààašZÚ.ès/¯œßb¶­mìÚ{àŠ œI£Qs÷·àõxIJJœ5C¦ƒéiÉøýYé ôz=Y™é  “ž6wÞm•JEUe9…¹<÷§Wgf˜LFL&#àt͆¤D;U•df¦¿ÛfôznÚºù¬ujµ´Ú¹ÓcÄÙ¬lX·zÖk^ïÍ­mhµZ‚¡ÐUYÌøj"I¥%Eädg²g-Ý=½â Â<9QßHYI[®Û€ËåÁnG¡PÆCç=¿~P'nw&•Ýi}ýD¼¤íOL2åóF1 ÄÇÛ˜˜t Q«ž¨p8]¼öÆ;3³Ù–ŠÜœ,Ì&n‡ÉI'¯÷}ï;¢‘(7\¿‰˜,£$‘Vèjê^rÖòãïÛøÈ£Ÿäï3söpèéç·u^b²‚¦&Ÿþ‹ïò—?ù?|¯ó}VèaÏÉÿŸ½÷ŽŽëºï}?gzŸÁÌ ÷ÞØ‹HŠ”DR¢HuɲlË%Žã$v┿;¾Ïq··Rn'7×7‰ã8²,Û²%Y]¢Ø{o轃2˜‚é3çþ1äˆ  jÖâZÄœ¾Ï9{ïókß-ë{ØsÑ{Ù Â^^ŒÙÁoýÅŠÉëw¿À—ÿz£ÂS 7E|ä ÿü>ý‰ß仵€·‡Ó¯ÿ3Ïí&’™q™ðÜÎÄpú?üy÷]<òØvî^^HšZ&0ÖKãñ½ìéÌå_¸Ÿ¼ÿ¯ÈÿÈw_lÄwÕxšð]âGûÆ?ù«÷óçßÛˆ«oŒ¨>ƒ\‡ÓôÊ÷ø_GÆ„Ã^pkl3•µ«„Kj> &ITV”±nõ ôzý‚¥ŠòÒ¥õÑ’HLŠ:¿–H$‚Z­žîõú8xä8ýƒ“Ö5™ŒƒAâñä>d'éNÇÌÇ–eNœ<ÃkøºÇw­]Íʵ rÍ#£c¼úúÛÄâKs¸Þ~ߊ‹ éè袴¤hÚuÆÜn´í”ºÑ M-“4âñxªÐt¼ñönúú“÷¹¼¬„åµÕ¼úÆ;ìØ~﬇›š€Åã¼òÚ[ŒŽ¹yü‘)=ÁÒáõ·vãtØ CŒŒáv‹FnµZÍgž}fR ¶öÎ.ZZÛÙ´a³yA×ÕÝË;ïíãé'™’‰ÙÑÙM^nö'õBqúì‡ðú|ƒ¡Tö¡Z­FN$ˆÅãäç²ómA.54RßÐL,û@œÿ’$a2ÑhÔ`¸\nR¡PPZR4) éíàb]>ŸÊþ,3Ï<õجs³ ÿöŸÏ‰—æ^âÿ%šù3þä{çð‹¯A@  ¦ê'ùÊ—$_§ù¹oðݽS? ]6kv<ÈöuÕešPGèn8Ë·ws¤Khn"£`Žèõ:ÊJŠ±Ù¬<|ŒÑÑ1žxt×¢Õ»_2]Þu>D¯ˆ$¾»g?»¯ÏGGG×´Fv¿ÿýH¾MÖMqÄãqÎ]¸„^¯§¦ª…$±ñ®µŒŒŽñÒ¯Þ˜õ<"Ñ›¯åŽD8¡ŽºúÆ9; 23ÒÑëõtu÷ Ë2:–p8‚^¯cYM’$qüä™[v¿ª*Ê(-)¢£³{JùIÏ»N7%£ ;+“ñq¶ËšcîqÞݳdÈÏ˹,™…Ï秡©…¡¡a–ÕT%kÏËÉ:öŸüØS¨ÔêIe¥š+™&Ï|äñYµ=·áHíU¢ª奔¢T&©?ECc³h(Áí1yR*—”³ØaOC©LfôôöÒÔÒ†^§çm÷N2D/iiÉ1b`À5ÅQ››ÍÀ ‹‚üÅÉ*X»úýHèX,F"‘ ¡±…‹õ ƒI ¹!×o¼ýC®aJŠ ÈËͦ£óÖg1e¤;¹{ãúYƒ"®F­Vcµª±Z-ÔVW¦~F£L‚„B!B¡0CCÃdggŠU0-’Úˆ-kOnÖpþûML'@ ‹HÃË|÷ocüþo¬Á=›Vs"ÿÎT IDATàÔ«ÿÅ©WE‹ >ào]Ñ×çÞ-)/+E!I$ òP*z'Á\inmÇ=«gn0’Diqá”ß'&œ= Y– ‡Ã¬^¹œp$ÂþƒG¯»Ï®î^–ÕVÏ«ü̱¿¾þºzú'Ÿ»×b1sï–MX,f†¥¶¶ŠP(„V£A­V 9{þ"‘HtÑïƒ=ÍÆÝ× †Ðé´3:yš[Úhhj! ²qýÚI›ÕBCcsÊQîtðôò“Ÿ¿Dcs+Í­©uÓž|üá”Ðö£šF£Yôk]VSuÛÕ¿ÌL]CÝÉr‰F£òÒâä„)‘Àëó“átÐ|ÙÐ)|ÐÄ =¡PµZE8|{ ‹ôz&öäD‚ü¼\ =­íì;pøÖÝ ƒžÊò2œŽ4û‚ˆI«ÕjlV5ícnœ;‹Y¼¤‚Ñ„¯ÿ¿+ñù)?j L@ þ¦_ñ?û•h ÁmÒ™‘õ Ñ ³)»œþ-Ij•jQ"ðFÇÜ8®©å¿Ô G"¼õö{ìÚ±»=‰‰ÁPhÒ:’$±iÃ:*ËK©(+aù²LFã†V«Åf³Òß?HOo?Ã##45·22:vÝó…Âx¼ÞKíLÇÉÓç8pøƒ.‚Áà¼K„ÃÚÚ;‘åå¥def P(Ðh4©çG­Vc4èìîYÔû Óiyä¡èt:Ú::(.œ>› §·Ÿ=û11 ‰âóû©ºªÔP$A–åI† •JI}c3Ñh›ÕB$E–eª*Ê(¹Êá#Ê ¦2%´´¶ÓÑÕÍ…Kõ\¬kÀ`Ч"lÛ;ºxý­wéêî]’š ‚; I’X»z%—@ 9.Ä—@f{Ü3©TÅl¦¶ºrÁgÏ_Äd4¢Õjƒ¼·÷ ñxœD"A}c3 MÍŒŒŽ‘••ß?Ñ`@«ÕÞÒ6Ðj5˜MFœ;N§µZEsk§NŸ']g½J¥J•>ºÂ•Rˆ6›uRÕBÐÓ×OA~žxQ/sæÜÑÓ½ÀÛ¯½Ã¾óýMD@ Á¤oÑ×gxd”—~õ&ùy9I`†!×0J¥‚];¶‹šéC$ž`ÿÁ#Dc1ÒlVö4ª+ËéìêáÄé³x½>t:™é$ ‚Á—êYV[5E ¤¨œ¬,öü ÝÝ=$dƒAÏšU+Ä‹ ¸î³YŸKk[Ç´ËÝîqÞÞ½H:Üd‚ZMcS ¯oI–Lwڹ G"45·RY^zSN‚p8Ì˯¾™Ë®uú]A–eÆÜã8v4‹$b<êê›8}ö<áÈâ•Š’e™X,)˜l0è)+)bhh8åTR«ÕȲ¼ ÏOcS+…yb^*@ n á(˜÷G¶ƒx<ÁÚ5+°Ûl¢A¦ù@>±nR9 ×ð»÷ ‹ár$<¥rÖš¨²,ÓÖÞIºÃÁ²Ú¤èo$åÝ=XVSIvV&f³iF£ÄLûܳÿ?²sÖi¯×Ç{{.˜QÒ5<‚kxä–Þ…$QZRÄúu«1’‚ÄC®aª*ʦ¬‡9täí]H’ÄŽí÷Í*2i1›éï$ç*‡ƒB’(*,/€`^”rÁQÝòa:½³É„Õj¡¹¥M4œà#  …P(K¢äе(•ÉiŸV£aŲš›ïOž>‡Ï?1·¶ †¦d£-ÉL>µFC,cpÈÅÙsoÙX‰D8±Žx<Ω3ç'-;qê 6›ËfÝE£ÑÔX/@ 7Šp̃´4O<ºKˆÏÀà‹wvï›6R¯¯€òÒb;'NT·×`ÐÆR©ù’$!Ë2ÇNž¦¾±‰êª ÊËJX»z9o¾³•RyCÑø^¯wvïãчD©œZ3_–e^~í-Âáð’½y¹l¼k-V«eÒïJÅô×ûÊkoãñ&³e²³2gudeeÐÜ*Œµ‚$îq}ýóªwÇéìîA©TRZRt]GA $2ä .X4$IÂd2¦êø_A£QcµX°Y-˜L&¬V3'N%.¹kìíëŸsfÝlx¼^ö<:¯wrb"pK®Q–eê›ðúüA‡ˆ}N{Z~ÿåe%Œ{°§¥104„ÙlÆd2.쳫óR@ @póGÁQ«Õ<ôàvá$˜Éhàñòö»{§Ô%¾–Îî^ÚÚ;IÈ2 …‚šª .Õ7²óm8ìiŒ¹‰D£˜M&=NOo?^ŸŸã'Ïpüä¬V Fƒá‘Ñ>W×ð-míÓF×K’„ÕjÆåZšŽ‚Œt';ØŠbšçôZAEHêo\qŒŽŽÇg-EÑÛ7€Ãný‡h4Š{ÜCFº3õÛá£'P($–ÕTͺ­,ËŒŒŽÑÑÕMssÛQsàV`6›H$Ó­óórÙùÀVº{û0›LA²2Ó§ô‡Ñh”}Ž,ÉëO$¼þÖnj«+Y³jù •sóæÛïÍûöOLÜ’k”$‰Õ+—Ð?0H4½eNFFMEY)éNJKŠ&õÇëõáõú¨ohºnŸ9LF#ÑhõXÖI @ ,}„£`® ¥TGn(µ»¯«Å²àd· ²,sèè‰ë: €TÆ$ —êd¤¿ÓaÇq•€ñζqèÈqZÚ:R%<ï‚œóÙóÉÉΚ’ú‹Å_ºÏ©J5­“ 33¯Ï‡ÅlNý6<<:åþÌæ ëìê!Íf’­ ¸³q»ÇÙ³ÿ0îñqdYæ‰Gva48tä8ƒCl»wó¬ÛOì?x$•Y$Üjt:-«–/£¶¦’_½þö¬Ñíyɬª4›uʲ„,sîBÝ’n‹h4ʹ —èéícͪåäÏ9Â5<Â[ï¬»Öörs³Sí{+º¥™Hñx‚eµU˜MïÏ-üþ >:©ÿ;w!Y–¨¼´„‹u ¸†Gxä¡3Žß×C¡ .@ àfŽ‚9 …hhlæîëç•Upþ²A!+3Y—÷Äé³ttv³¼¶š²’b4õ$ÄB Üݪñþ›3ºÇÇÉâ¹’$qÏæܳy#{ö¤­£kÁÎÙïŸàÅ—^E©T¢ÕjØvïf23Òéêî%¶"ÆØsœ¹†œH ÕOvtUV–ÑÔÒÊè˜;Ùæ ‰Î®ž”±,ËŒŽ¹ñOLàvSY^†Á ‡÷¸‡×ßÚ=)zøÐÑãø|~$…‚í÷m™9 àõùuS\T@cs+'NžYTñP`& V«…ÌŒt–/«¦­£kÚŒ´ÚêJ¬–Ù ^¯=ûÝTFÛíÄ蘛w÷@¥R‘ît°kÇ6T*ÕŒs §ÎÒÒÚ~Ãú=¡P˜Á!×-u$ç^oéóÖÖÞEa~.ç/Ö ‡ž$qe¬>qê,'N’eÿ71÷‹ÅâOÁÒcÂç @p›c4¸e…£`èõ:j«+9uæ<`§ÃŽÙd¢¬´xÖíZZÛ9±ŽO}âib±(í}t÷ôáõú8|ôÇOœN ÂÊ`0ÈHwÒÛ7ÀD @Ey) I" ¢R©nëtòÁ¡›ÞGoÿkW¯œõãûjÔj5•å¥©Œ„!ljD"¼þÖn²³2q»Ç—ô³:[)ˆ—‹šÊŠÉ€RÉζñÂÏ_"!ËÄã öì?„kd„P0LßÀÀ¤:Ü‹™Òâ"Ñ)Ü¡„Ãa´Zmêo¯Ï7ÅIIcZš];¶¡Qkhië â%‹ÑÙÙMB–ÉHwÞr!oàjt:-?x?ƒžÁ!>6íø²nÍJ4ÍŒûiëèâБcD"Ñ;®b±jµš¿ð Ø~*•ƒAO,cxd”¶Ž.zûúäXc—Ò·Š[íÔ‰F£\¸TGWO.×Üû>çUÙ”£cnTJ%:vR<ÅE46µR]U.^ú%„Ýé @p›¸‚…£`ƒ!N9$K¯tvõàpØ)-)"£×é&eôôö³ïàT*ÇNž¡­­cJDm,§»§/õwcS µš-wo ±±­N‹ÍjÁ妲²ü¦¢Í“ÐM¾4’$±¢¶fö){´u¤þ^»jµµU ¹†ÄÇÌòÞ‹P˜`(”z&²ÌÉSg1 ”N»MCS ‰«"DeY¦¾¡‰ªÊr6oº ­FƒÇë#0N‚¥Þ—…B ãõùðû'ˆÆbè´Z z=㣴wt¡V«øì§>N<' M«m‘•™Áζ¢Ñh¨khâȱ“ÓO8 4@Sgαaýº{úˆN“1–H$8xø8Û·n™6£oßô\5þ܉t÷ôðÆÛ»õ8=½ý¼ñönÞùÀ¢_“,Ëø|¾yo§Ói ‡#7œ9‘™I×åöœë(Ýé ®¡ ¥BANN6~¿ŸáÑQâñ…ùyètÚëî#]WcH @ fC8 nŸÏÏ/_yŸßO~nÁPˆÂü<–/«@«Õ P(ˆÅbÔ74Íy¿‘h”=ûQ^ZBmM%{ii6Z[ÛÉÏÏM€o'V­¨%+3ƒ}ûM28ÏZ=Í6ë:U•å(•JŽ?EIq!µ5•($‰­÷næ¥W^'vYÃàNÅj±`µšr\·6t]}kW¯ ‰²ïàº{zÉHwN+œøÆÛïÑ×?0ÙÒâ"23Ò“…REIQ¡xñ—0n÷8o¾»gÖÚìÑhŒç^x‘P(<­¡,#ÝÉÎÛШո†G8~òŒh\Ám‹$IhµZ^}óÝi3Æ òó(+)B§Ó¥"ë¯F–eA!¼½ôõÞƒö¸ÇKcsëœÖµY-dee’î°säø©vtv÷Ìk}£Á€ÃaÇv•öÏý$Y–éîíÅç› ¦ºrÆ€‘h4Š¤Pâ!;+Sz’@ ° ãvVfñXüººGJ¥’ukWM›Í"I6«‡=Ku dd¤O»ÞÅK ,«­J9IÎœ»p[ŸßLs^@ ÁíCüLž2G·|aŒëÖ¬D£Õðâ˯áóùyô¡Œ¹ÇéèìZ€‡2ASs+<´ƒÁ!Y™·e;ÔVW2Z­–Þ¾þyÕr†B\¬k`Ýš•³®7nMu%­mwŒÀ䵤;XÌ&4j5Ÿÿì'9pøÍ-m³ns¥†ZVfe¥Å:rœº†&6mX—ZÇãñN1hiÔjžxì!Î_¸D,§ª¢Œ‰@€ÑQ7F£A¼ìKæÖv>6£Án.( îÙ¼‘ŒôÉõ”W®¨%žHpúìyÑÐ‚Û £ÁÀšUË©ojatt «ÕÂêËè뤥­€ŽÎnö´÷326FvV&kV­ ° í,:]ݽ¼óÞ¾m»gef›“M~^¯¼öÖŒë;‰Ëj5«@§Ó¢R*gÍ8t8ìÞÖ{î&7'ëŽ|ÖÆ=ÞTÉ¡`(DNöÜ®óŠóäÂÅzLF#›7m §¯ŸþA~üÓ_pîÂ¥)Û„Ãa23ÒÉËÍ!/7µJE]}Í-XÌfšZhmë  ŠNà6&‘H°ÿÐQÎœ»° }QNöô%Bö82/ àVRQV2©Ýè(=½ý˜-&$IÂ=>>§Ò4s%óÖ»{?”N£ÑÀÖ{ïžÕ~e Òj5Óê+]ªo¼¡r…s¥±©%å$¸ºìÞµ}åÚ::oÈIP[[5ÅIš/f8yêñ‡g- Îý¸×–J–ÄÊ$‘HÐtlC@ @ ˜ ¡QpÃ+–Õ Õj¨kh¢«»‡Á!×-«I|EÌÖf5“vàÛ½NGA~.•e¤Ù¬äæd£Ñh&‰Jfge²cû}“„üæ‹V«¥¬´•REB–¯+غÐh4æ ÷P^Z‚Õj!/'›Æ¦â×1F…B!l6M-­„Ba z'OŸ£e'“Á '7'›`(„Ñ G­V£Õ&ïUYi V‹™t§»=îž¾ë Pß*ÂáC.ýC„Ãa]ôú)¢¤‘ïìÞG×<5gcåòÚiõ)Î]¸4cíwàƒ¦¸¨€þ¡ÔßÁ`ˆž¾~´ •¥”–súÌyV.¯¶îû|éèì¦q:2wii6Øzf³9õÛD À™sˆÅâ$‰Ëÿ(•Ê ì7K]}cn7jµ‡= ¿bÊ: …‚Š²9ÎźÆžËmZ¿nÖò|j• µZEWwï”eéNV¯ZqÓ™‘&£‘¾þÛ¶<åÐ(@ Ü,6á(˜’$a4èèêÆ5<òE ŽŒŽ±võÊi#ônß!‡Œt'Ñh4õ±lO³ñØÃN«=p#÷'+3ƒŠòRt:=½}KöY³Y-<´ó~ Y¡¹µ —ê1de¦“•IwO߬"‰²,SQVJqa>ýCÒl6|~?µšªªrîݼ‰õkV"I rs²±Z-( FFÆÈHwÒÓÛOVfZíäŒÁÁ!û‚×æC8attŒÑQ7Ã##ŒŽŽ¡ÕjIw:.k9˜q:ì446ãñúP(èu:‚¡ ͤ§;où9ßò~ »ÝF4Å=îÁl2¡T(RÏŠZ­žwß•™1É1évóú[ï2v•ÃO ¸Ý¸ÚI‹”Jú‡˜˜ÐÜÚNvV&e¥Å r¼c'N-j„üí€Á g˦ ¬\^KnNµÕ•lX·fÊ~òÔÙË];Ÿ)-.š1âÿfs308„=Í6£†ÑD €Ï粒¥í†*•ŠMÖ^×ÐoO³áõúðx<È—ç,«W.ç¾-›P-€VƒÇãÅd4.È|êNA8 @ Ü2”fŠÖÞ˃leëÝk¨-r žfÈan³L •%ek×sךåT¦cLøñ„HˆÖý@bÆ‚‘e÷¸ç;þšUˉÅâ\¸TÏko¾ÃãìÄj±,¹v´^•90ægpȵà…e%ÅŒ¹Çihl^’ÏÚ–»7’f³bÐëÙ{àŒ¢²¼”ÌŒt*ÊK9±nʶf“ ƒQÝfKê  <ýä#)ÑÈs.Q[]9)â~ýÚU“ö‘âî&/7{ÚÈüêª .Õ7RSU±¨b”×ÒÚÖAMUÅuý+–×ÐÔÒÆðÈi6+µÕ•446S]U±$Dãñ8Ã#£„BáËN°ô9Ó”JéN÷lÞHaA>E…ùD¢Q^k7áp‡=žÞþy˘{œ’âÂÔßݽ}h_(Ìå=ˆÇ§N©¯LÒGFÇ0›MÜ»yÂoÈ5L_ÿàݦµšGwíÀjµÐÖÑÅž}‡(ÈÏ#;+sÚ¾z®ýÜ¡£'صcÛ‚k õôö¡T*Ñëu3:4ÍMH’Ħ ëæ4* ¶o݂׻ׇÞ¶ Fý‘Ñ1 òsÅË/¸“é:ŸõÀàŠw¶°@„0 ¤nÀ„çåÿ¯ÖE€M4¯@ npFˆ&ó.>ý»ŸdcúÕv†•Ü½ý1\Ç~Ì÷~r’¡è,å}–Ï=XƵÅ*Ã݇xî/qÂE-¸GÁâÜùK8Ó“Bu¡P˜¦æ6Ö­]µ$ŒžW“‘îÄl2áó'çöƒ ï(ÐhÔlÙt==}ø'&–ܽ";+FM4šŒò±‡&•YVS…Ç룻§7!¾ý¾-”ÒÔÜJUeùûãÎUF ³ÙŒR5û«o4虘ÌX¾§¯o›ÕzKE¤#Ñ(‰Db^•å¥“þ®®,§µ­cRíòÛ‘xÌ&Ó eC!öõGŸb£¢='y}ïY:ÆÁV´Šº‹üŸæ™à/Ÿ«Ã?Ý'Šdaõ§ÿ˜ßÙ`%1tž7våb·Ù”Eõæ‡x|Í>ÿU;šoý;Gb¢Á‹Žp,!²Ìèèûºóë…ÂÜ»eã’ºI’X¿v{F–eôúÅ)¡äóû‰Å—^GªP((.*`ÌíæÜ…:‡\X,f¼>ß$GÁ gúÕt÷$Ë89vJKŠðOL ˜%º±¨ ‘‘Q2Ò3®ãÅé°30èB¥Râ°§¥ ‰DÿD€X,J8FN@yÙÍ—îˆÅã³–_hjn¥ú*çǶ­Ãž†×ë[0CÍÈèZó,B•óE©T R©ÐhÔ©óÎÉÎÄd40:æÆaO›÷>#‘*µjJ©¹àE–eúú±`I"I²,£Ñ¨±˜Íl½o3’$ÑÞÙEgg7Û·ÞsCû=zìTJ4÷Næb]#£c ¹Ø°n U•ex¼Þç+ó¡»·£ÇO±võÊT¿wè¿âù IDAT3œ9{ü¼&&&…‹Ö&9ÙY·Íýq8ì˜-fZÛ;¨(+/ü2÷÷^â¥ç{é¹u–žNà ’FùÆYÖûÿî€æ~t]þ[8 Áb÷êxOÿ;_mVó¾K_GùS_äï!zLùí/í$ñúÿáüúª‡ùÏý!ó|“ç[×£ÉUdoûŸ®Öã»\eSaŸËv‚ÅAMÁÎgØdpÃOùæ¿fèŠ ªñ§Îvð»_ù8µŸa×¾f^ì¾v@W`Zö>»ÁJ¸ñç|û_1p9ó@Ò&(ÙaEÐÖðÉϬ§þ2*ê á(Xb\[kܳ4Ë”–¡P(hji¥|êC§fýƒ.º{z …è”*’ÙÇKhúHðâK¯Nú-ÒÚÖÕb™dè%‘Hf³’“E]C²,³¬¦jÆýG£1ÆÜã³: œN;]ݽTU”Çq 01 "Ë2å¥Å©lƒæÖ6FFÇp:ìó¾ÖP(L{géN‰D‚q«ÅBVfñxœ‰‰²,cµZ()*¤µ½ƒªŠ›s8ìi46·2:æÆn·a6™. 8潯@ H$A£VÓÚÞA4£¢¬ä¦Ë1µwvSR45ÒÄb1s±®ñ†§ÎœÇ ×³aýšyo‡9yæuõM¢,Y®”ŸY·&™‰·{Ï~d9Y¢æ‰GwÍ{_>ŸŸKõ´utÞñmg4رý>:»º ‡ÃÔÖ$3›ìiÓ÷E›6¬£®¡ dðOLÌIåR}#ii¶yGè_KwO-mìÚ± —êµ]t‹ ­p3hÔjŒ#¯wI–¦_e<ð{¿Ãý#üþ×0ý÷ßðýîjžxv/_l`Ì´‰¯þùjŽ½éaÓεè|Ô¿õû±{©Í¼°—=þ»Øú½·ˆ?¾fÝG7ò©ogež…¸»‹Óo¿ÈÏuÉÜÅ×ÿ¸ˆŸ}ís)HFÖ~ù<|ú;üÝàSüõŒçÊyà`UòŸsùý|úãÛX‘c 8ÔÄþŸçõ:1$L¥Û¦=~Ð2Ÿû#wàC; {M™'«žaWúqþíGíèï~šòñ=üÕ¾6ÆbÀ™Wyaí~ëÞB^lm&Œ„¶h¿µ-ÌÉþ•—÷áXyßu¶,êl6¬M†xãgÇßw\±½ ã§on寞Ìä® Ù¼ÒÝ=9ËC²²æ¡5<÷Üá«œ¹<ð…?â™* ã'_äMÍ£<»r›³Nò«~‘U Xä)©h‚¥Á çèñS¤Ù¬T”—.©tó⢊‹ æ½]<g"H>ÀJz½I’ˆÅã;~Š†¦òór(/-¡¹¥íŽ¸Ïy9ÙT”—r©¾1U»>‰0îñòÈ®ðx¼äça4f4ŒD¢QÚ;ºH³YÈHwráR=i6ÙÙ™S"ù¯~Ž”J%Y™3ž[EY)Ý=} Æ\h4ìi×ÆòùüÄ |>5U©ß33Ò‰D¢´¶u V«ÉÎÊ ÒÔÜŠV«Y0ÃGyi1±XŒp8‚kx½^GWw/…ySÏÕïOŠ¢Êrêú®èl„Ãa¬V Fƒ‹ÅL,§µ­ƒò²üø|~ôzý¬mF'•xŠÇèuÚ£j òp{H³YçuÍccn<*&“‘t§cFqÏ™8¡Nt¸‚;‚–Övž|ì!dàðÑäç‘îtÌiÛD"Áźzûðz}K²´Ý ÓéR¢ñë×®¾îúËjªRëÝ{ÐÑÙ}ÝmV,«¡äæ×RߘthÊr‚Á¡Em—«KU]]")9?‘HfW˜M&ôz-±X“шV«™âPîbÌí¦¦ªâ¦ær¹9YÔ76 GÁR$æb÷?ÿ+Ž¯ÿ6º~‹ÿj £L¿fS;rÀßÿÅK¨W?ËŸþÚ—øâ™ó7ñs5OóÇ¿ñ8ëö5±/XÎ'þàãäÿ!ßú~±ÜÍüÚ¾Èï¾Íß›T·G2¯à×~}Sgèßÿ˯~^™»ÏþîGyôT=?4ù»xlð¾ÿ­㳯å_ø¿çÿ×5ó²o´ÍxüÿY’±†î8ÆKÿù¯4y×ñÅ?½›ñŸÿ zÖƒý®Oðûs~ïòù]µn£»–ßø³‡Ð¼ûï|ýzPoç7ó |Êým~82{óÎt®ßz{ˆœ#ùo•Â¾‘/üî6&~ù}¾zv‚ŒuOðÅ/|Ž±oü#‡âkù/MüôÌýþìá t%<ùÉJê~ø]:Ã¥Q‚'‘r&&ˆÇ@ŸIj&ª/ã#¿¾žž¾Çé{¿rÙQ ¡¼Îvaáœ\v•“`,Úh˜ ÒªE› nAï$XÒ¸Ýãì?x„òÒÖ¬\Á¡#'ÈÈpÎ)ª{AúŸŒÏïgõÊe7$9Îœ»È¥úòrs(/-¦½³×ðN‡×ðûaDe¥Å8vœ;™éÄâ1vï98c-å¥@0B!Ih´âñ?òà1áÜì,ÈÎ"Ç磩¹F3)cÃé°ÓÒÖAºÓÁÈÈ(F£ZM$Åd4ÒÓÛF£fÈ5rCQ*• •JEyY ñx‚žÞ¾i±x£Ñ°àÖ7‹^§£¦ª‚`(ÄÉÓ稬(£ªrªÁ>#Ý9kÙ¦¤ž@Ö¤ýÖÖTÒÙÝC<'K`6±§¥¥Ê5éõ:´Z Z­vV†+,_V4Nµ´Q—‹Á ŸuýᑤƀÕb¡©¥•ŽÎî”ÃI ø°1îy,$‰ôt']ݽøü~Òl6œû-`0”ÒÓ ‚ìÞ{€!×ð‡¦Í”ʹG¸Çãqöî?D$rý¢êYN:®¼ëœö‰DxwÏÂá0jµI’s»q:ìÁT¿6߬©¡±©½>9vÌ6ºZÇd4κϜì,šZZ‰Fc(•JÊJŠ&eÍ:'K$hkï$‰GˆÇã×KÍ !´'!'ȉÈå±\–IVùR`tZѤ•ðåïÜõ¾QB©Av™Ñ)«ƒJÒV>ºÿ×ï*Þ—¦ 2êò`RÂU´øÄ Ã)ÇL`h€€Þ‰I)Ï°,ƒÌŒ™¯—óÐ;T˜3 „]#©28}ß®•ZW‰Án@ïãý Íã}ãP™†aJ7%% d×½Ž«ÛC‰9ÝHtÄEàʪ MÇŽ*òg9¾^˜ãýŒÕ<¾MËѪÃ{¹oˆõïæ_~ ç³Oý?üí§xÚOrø´‡LGúgùTî)þåoÚÈ“KμøÜ[\¢ƒœm±¡¶”][²8ófÿäŒu÷ì,CAœŽ‹CSÅ¥£ãôŒCMF9æ! >÷‡Sœ ÂQš‡Ž®á á÷,:ÂQp‡ÐÒÖNwO/E…44¶ðéO<}ËÊÅb±T ûDBF&Ñ` b0¦®›/õÍŒ¹Ý<õøØM&"Ñ(]IÃëÕÆ…BÁúµ«¦|œ¯^µŒ}–võûv•A L•[šÖ a6c2§âŒE£($‰’âBdYæb}#+–ÕÐÓÓw¹œ“I÷¸‡p$‚Õj¡¯o€qƒ^GvVæœD€ãñØŒ¥s</f“é¶lã¾þA@fýÚU4µ¶cÐëÐëoÞÈ"IÅ…3;_†GF¨,/ÃïŸ@§×ÍÉY V«©ª(£±©…ªÊrÜã\ÃÃÄcqjª+'­ÛÜÚžüüU(himg`Ð%:MÁ‡…BAA~.¯ÇËé³çYV[ÍþƒG¨­®dYmÕ¤Ò0ç.\"‹ÑÑÕC$¡ ?ƒ^Çàk’óáNd`Ðu]Áù+ ¹®ë$$‰U+–±ry …‚7ßÙCSK+•å3gS%d™sç/ÒÝÓ7­ ÙßZœ;¹9 +hl1›±˜“ã¬,Ë46µb·ÛÈÌHŸý;5¥¾±™e5UD"Q¼—³ ].¢‘(ñD‚Ìt'ŽÐ,5d‚n?áþc|ó;ïáŠH¨­ÙdiÝ NªŒ aZùiþ`g”þáï9Ö ¡Êáɯ—q¥£Ò˜EºVA{$(ÐgdaõHØfXÖËȨnÆãÅ×^~¾Üa´etŠÖd ¦ÂH¦MtÕ46¹nœÀhiUVÕy&.Ol¹Vð{&œH’Djz¬4‘izÿSwæë („8îꉤMacŃ÷`=ÿõ³_Dy ‚9’¶ò~ª½GøåÀû²¤6@Ï»üÓ_¼DT6üÞÜÍÃØVUbÍ©á+{?2Òå Ž/ó+Žóß}±i·ë'(¬Ê‹KÂÏÅWÞc v'¹ý_’~Äóï5à ƒ.½šžý5Ïçy§Î75£ 6ȉS#ì|p¿óµ ÍŠkœ YWðÄöt˜8Ρî¨hsÁ¢#wáH„ÊŠR´Z À-3ƪTª?`#‘dÔ³Õj¹îGîL´wtÑÜÚΚ•Ë& NWîA¥RqèÈ T*%áp„â¢z{ûÙ¾u G"‰,ÙûûÆÛ»ÉËÍáÞ-g\”e™ºú&Ôj5­mLɲ’„^¯OúÇÆܤ;ì ºÈÉÎLE,N4ÈÉÎD©T2:ꦰ k›ÍJGg75×q44µ Ñ¨g4Œ;ìi ŒRWßHMuå¢g¢Ì…îž>ÒlV|~JHsYu%£cnº{ú¼ôѵ¤Ùlôôöc4sc³Y±ÎÁ!——C_ÿ ³‰œì¬T ®+Ô54ÑrÙQO$0^'šU ¸“1ôdf¤£P(èèì&#ÝI0Jeç™LF22œÄbñIŽ‚+Yj›7ÝE8I•qƒdI²c'Nß±Yñx|NeÎ.Õ7ÒÝÓ@F†—krÑð’¢B =—ê©(+I;þ‰ Ž?M†ÓIÚ ‘GŽž ¡©åöú6\äð`I’¨®*gÌ=>Å‘’H$ðx¼F45Í­¬XVƒ$IèõÊTŒÑ`Htvõ`¸ü·×çÇçó£P(ÈHwLÑL|ö#ZíÍûÈøÞãâ3ŸáS;zùñ¡«xâóOá|û»üÍäÕÖàô6r®+* ʸßDYa pÓN6;uôk•IUÆG?zƒ¿¼ˆß±–}¤˜‘ý?¥7òðŒËÏ;¸øÄôÇÿ»K“,$ =ÄàöÇøè†>~~΋}ýìÌ‘ˆ5L½®±‹{iúÈ3<{ ?<؇¢ø~>y·š ?hÄ\IH›Ï†9´ŸǾéîËPrÅ;Ó¹öÅõä/¯Yåô6®:×5ÁЉƒôîx„nîå§'G0®~’Ïì²ñú©è¬Ç÷ËËų+æØÏÛXvO>ã§~ÂèUÕ%ó ~óë»ûéð‹ ¬«Ÿä£…=¼ö|7õÁ¿â+š+cƒ–ª_ÿSžýÿÿ+íx´kø£i·BÈÞ.>ÑÞ·ù—ç²ø“O¯¤æÑ/òÍG!‘€Iq»†Õ<óÐQº~Ù„_ž<öíþG7}MfŒìãß^8sÙI aÈßÈÇ>ÿ,«õaêþû š„çGp P:3²¾!šáÎÁb1³võ ´Zííñ€)•8v4j5 -8ióÊtˆÇ ¹(-."?/‡žÞ~l6+J¥×ðáp8e …Âx¼^Üã|>?ƒ.Æ=‚ÁƒKÜ€#Ë2¯—þA*ÊJflÇ–¶vJ‹‹ÈÊLG£ÕÐ?0”4 èt„Ãa|þ FÆÜôôö“›“Eºó}AwOùy9h4$IÂh4 If“‰¶¶NL&#cn7íÉÿ_yÎFFǸX×À±§C”•–`˜%ßh0 R©rq©®‘}ÓÛ7€R©¼ee³®0æ'Íf#‰àtØQ«Þ÷Ÿôzüþ lóž/F£!)R=ó(;V§ã>ôþcO7!EþÞ—xX{}—Æ öÈßΧ>õ‘®‡¶,ëteÏp6[ZF¤+NI~{zŠùÈg>Îc²ñ{­•}5Û+û¦]æ Ì||]÷Þ—GÇÞäu$&º©0±ñÉñÉÇ6‘ï;ξ`)Å£GÙ×Æ–«Ö%4H]{‚ªáÙ>ÂÖJ5ͯýˆçO  П(á<ÅS¬!ÏwŒ·Gó);Æ15Ûf:W)s僿÷¥_X{aã¾KãºèD/—ºµ¬}ô>ùôCÜçåÐóÏñNGÄ,Çjç~}¢‘@ðaFa®áé'Êé~ãmιß÷ÈÁ~†¬ÜýÔGùØ£›©6 ðÆ¿ÿˆƒQâÑ0ÁPèò¿¶µÛXî=ÈëgFˆÌ²àV`¢ç‡/Œ€9 §ÃŠ^%t÷QwðU~ºwŒüUÅä–®g™®ƒÓM£D®Ö ŠŒÐPï'wu-YiEl~ð^6®Y˽>É3®"ß¡åµåàÖ¸ô¿¤ÊÚUâQ»ƒ¨©ª`ó¦»nËs“e™‹u TV”ÍK±½£‹â¢$I¢½³‹’¢BFÇÜ\ªoDN$ÐétØÓlì?tôCqŸïÞ¸žÚkÊË\!ráR=&ƒártl:µY–éíÀçóáp؉ÇhµFFÇ…B  z݌ڗêIw:hïèâR}#’$‘Ÿ›ÃÎÛøÕëo§"iïÛ²‰Š«Ä§=ÇH”ÖöŽ?5)"sͪ¬]½bÒº>Ÿ“ɸh™Í­íTÌ`˜hjn]ÔŒ‚D"Ao_?&£»=íÆ÷#Ët´wQZZ”Úï[ïî™TŽCèIgÀ•Ò5Ö¯addŒukWòÒ+oÅØ´aÝŒýëõˆD¢ìÙžÞþ;ªÍ,3O>öÐŒcw$a÷Þôõ¢V«Ñj5Éù± YfYM›6¬›Ôï) "‘§Ï^ ¯÷¸‡‚¼\vîØ6í1Nž>˹ u·U»˜M&>ñÌ“·î3T–©«o$7'‹4›í†ÆÅh4:­æAÿÀ ã/¥Å…·M°ÉÍòoÿùÜm}~×j¡|Àt üðêuUŸç;Ÿåïÿêez® KmÙ|PÙ«Y[àáÂ…þ¤Nd羯|-‡¾É·º¤ó çš ¬žžl@°à(0U>Æ—ÿ~òqZ_øw`„kMÏ m«¶ßÏ}k«(L7¢ÒÓxžCïíåx÷ÂÅüÁG>T×+JÝiÜe\f>5‰Ëjhhj¡º²|Úu&†††‘/D£1r²2SÃ*¥Š·ÞÝC4cͪlÙt½}ttvsðÈñÑmžù>kÔjŒU×´qÿÀo½»‡4›•Êò2JERH2‘  ³ry-í]3j pæìE›“¥dYF­V!Ë2%Å…„ÂalVËu²,³÷À¡Ty H–¨Xµ|Ö«ÄëšÐëõ8vš[Ûq:ì8nÂ>ÉØ’HÐÔÜŠB© /'gÖu³²2hjn½üQ¯¥° ï¦Ý=}D¢Qd9^—tÎÜhÙ‡1·›ÑQ7 Y¦¬¤(y}²œ2Ú]MQa>ƒƒ.‚¡è+Z®®oŸ“Å™s±XÌhµZ"Ñ(í]7ì(ÐhÔ<°ý>~ü“‰Dïœ(.¯×ÇO_|™Õ+–S[óÙ{ï8»ÎúÎÿ}nï}îÜ齫7«¹[¶±i%ÙdKBB6›lÀù%ûÚl’% ,Ë6 „`°ƒ{‘eY²º4½ÞéíÎÜ™Ûë9ûÇŒ®5š¦¤çýzéeÏ=í9ÏsÎsÎù–Ï·nQFÛ›obxdŒC÷ÝEqQ!*•Št&Ãk¯¥`ˆ¶Ž.¶mÝ”“kº¸ýùæ6š[Ûsû¹<“*žHNg°ZÌÈòÆsr†#ffC8.yv]×ÏLIB%©p9×ÿ,\®0raÇÍôt_¾WL·åÀçÿÿÛ7ôȆ2ùÄòÿ××øEoç¦x¨`’Ãá+qìö1` ˆZ X€àb®6³ HÀ lvÍŸ»pà:!éø_úr†ßýØ6‚±Ì’Ï799Æé_þ3§)zLðÎ"·“i÷Ñfµ (Ê"ck`jšL&CeEÙ¢mâñ]=½\hi#‹ó‘½Ÿ‘±q~ðã]¤É~;`X%ÚO­R184‚¿€ºÚj¼y =*•ŠàÌ,ZÚصc+•åe¨Õjüýƒ¤Ói*ÊKéîíC§ÕQZR„$ILggæ æ]Ý ŽÓ×?Èä¿üŽüÃ7xi|Å4…½Àï÷Ì·[ ‚ ŒL¤ëþö ψ®lx„ôÐ-ÆC‡î¥´¸hC·qb2€ÝnC¯Ó‘ÉféììÆd2bµZ—ŒïèêáÈÇ{ò½y·lÑH˜Ó¿(Á“J¥H¥ÒD¢Q$I"•Jsÿ=h'“)‡ˆÅã8‡iïèBV´Z-ÿÈQ©TLMyêégÉf³úp8ܱk;ZÚ)).D’$ z=£ãã FÒéy&“‘W¿AwOß•M,’DMuóuŠ | ¢ýý¼ðòáÜß uì¿c×çÑàÐÈ"çA<‘``pZF£!‹QS ]Z» IDATU±l„d<‘`r2Ó¾t½®ž>jÖi¬om嵐®f]™“)âñÄ‚ZW{?i4ŒóŽ ·Nž¡½³{Ñxøò½Ü{×\=„ñ‰IžyöE1i nyS«E¯×ãr90 ìÙµþÁaŽ=ŽN«Åçób1›™š22:¶ä>*+ʸÿž;¯º-íݼþƱ[²Ÿ›êØ¿w÷‚ßNŸ½À©3çغ¥‰=;·ç~çé_¾Ì9\NEE”Å8w¾…®ž^R©µe_ìß»›¶öÎœ#áäŽÝ;e…²Òbœ×¹ž ÌeÄ>{ž];¶]ó}ŽM`2rÎñ›!=$@ ¸Z„ôà¦æZI³\OSÓxÜ.SÓLO)++Á¼B&ÄÙsÍ‹"Boe'@Q¡Úê*tºÅpEQŸ #geL&ݽ}¹b„—RUQNOŸŸ“§Ï±g×vÜ.'»vlå­“gcttÿûö좽£‹Šò2‡F¨®*_0&²¢,¡¾Š¢ÐÙÕM0ä==ÌèØ8¡pP¨«©Æír¡Óér…)[Û:åñG"•JcµZrzú]=¨Õj*ÊK1 Ô]&mÔ?0DYiqîïlV¦µ½½NOV–©«­fb"€F£F–e’ÉápxYç•PWSE{g7*•„¢ÌepÈŠ‚$AQaÁ‚¾ …#LOIgÒd³2ùyžkâ$ˆÆbtu÷Ñ?0ÈÔô4:~¾òbƒ[Yi Ü{'gÎ5ÓPWà /¿vËßC‚ÛI’¸÷®”—•ÌºŸÐÜÚN¯€³çšyì]‡E_?÷â« -ÚÏž]Û¯I›6ºÃþªÞ3Ü®Œrúìy$IâÜùúû©¬(Ça·ÑÒÖ‘[odtŒ‘Ñ1zýý|äCïghxtÁòµÍfyðþ{øÉÏž¾á™—×z©ªœ{^NOiniG¥’P©T¨Ôjò<.œŽk£h255ÍÌl•JŶ-›®Ë¹ø¼œon½ê¬@ @ps¢öx}Oˆn¸uðæyp:7®Ìf&“arrŠD2A¾×KžÇnƒm(&˜b6¾­ÆQQÌfÀZnAÔ™$IX-/Àã“„ÃaŠ (,ð‘çñ ‡‰Dc¤Ói‡†9¸ÿâñÕUå ÏÉC©$zzýÄ ’‰$³¡Pnßv›ÍMõÔ×ÕRTX@8%q™ö}"žÀî°áÍóPïÅb¶p®¹³É„^§[`¬–…³ç[p:ìÄb12™,Cã4ÔÕàv9Æa_­988L¾7ÿÀ=½}”•–PTX@žÇ$IX,fL&ãœIâñƒÃ#‹ê¤R)º{ýÄãql6+e¥¹úI§Ót÷ôáóåçŒ?½þ~*ÊJ‘$ EQH$“¹â¥=½~ffCØlÌ&3™Ložƒáæqž ŒrêÌy&' Šl>xÿ=”•£( ßúîÉ.!Ë!I>üf“)ç yú—/ˆlÁM‡N«e玭lj|»`q<žÀhœ»×eEY`Ð ‡# ÌËà¤ÙÜTV«¥£³›_>jšL&ƒF­áÉyjÉû§©¡“ÉȉSg—l“ÛåÄd2ât8Öõœõ òâˇojgËéäï}tÕõEá­“g8ßÜšûM¥RQ\TˆÅbfKSV«eÑv=½~zúüÄã &SËö•Ñh ¤¨0—µa¾Êz×›þA\.'V‹eÉå]=½dÒ|¾|,fZÛq;”•–Üð¶†Ã††).*Àn»9?Ž¾ù­ï‰IT @ X"£à¥¹µ’âÂ% ËnTt:³I8 ˜3®\Ôî?{¾³ÅÌðð(0g.+-¦´¤˜ºšªeå‰|ùy úù†œ£@Q”e@NúF«ÕæÚ ( Ý=} |vvõ,œLÔjî<°wA{º{ú(-©æ :.§ƒ‘Ñq òŒûjQ‹Z­–†úZΞ»€VSIÿàE…¹cI’”sÀœcaçö- öÑÕÝ‹F£¦¬¬t]‘¢7’óÍ­œ:}nImne¾rÅåZêjµ§ÃŽÁ`Àé°/(¾)+ ÑuÈwïø\´µw.p\t‹îe«Õ²ä|R]UAÿÀáp„¶Ž.¢ÑèÜ¥¬T$`j:ÈÔt·Ë¹®s’nzù¡D2±ÈI³éL†©éi |ù¦¦Ñ¨Õ<øÀ=xó<+nWUYNUe9Éd’ç_z “ÉHï|!v§ÃNeE9¥%E¸]ÎeŸ‘²Ò‡°Z,$S)Ò©4&“‘x<ÁÈØ8µ†šª·é;¶n~ÇÚjµZhj¨ctlœL&»îë] @ Ü<GÁ-Š,˼~ô8?úÐêF%‹ÑÒÖ±@æA0Ç®Û(/+!ÎÅrzW#6/”J¥×QÄ6›ÉàË÷21X²À§F­&/ÏÃøÄ$²,£Õil.Ö5ôË»\µ=Ù,>_>’$ÑX_»¢qèRczŸƒÁ€^¯#›•éì꡾¶zÃŽw*æBKÛ²<³™,­íttvçú×›çááï#J‹ÇñæyˆÆbŒO’L¥èîé[[ñc`ƒN§Ig´<÷Â+lÝÒ„/ß»®ý¨Õj*+ÊZÑQz¥øò½ìܾu]Ûøò1›L7­óÎãv …ùùÓÏâñ¸Ù¹}˲ï:­–Gz 7g2Ù5É6éõz z=F㜴¨°€Û· ÓénÚkzdt‚t:“{. ŒátÚ©©ªØ˜Ï¤T‡Ý.&#@ à6@8 naB¡0ßûÁO(,ð±ïî5éõÞ(E¡³»—“§Ï‹ÅÅ ]‚$IÔÕVSQ^ Ìiuëtvñøª‘œÙl“ÑÀÈèø’$WCVÆÆ'–]žÉfsR6:ƒÞkW08ÃÄd€ò²ÒÛLM)-.ZWŒŽMàËÏ[$Ktùõt¾¹Êù> G¢øò1 ¹þšœœB–å\aç†N«åƒïœï?ùÓ\FÇ¥¼üÚ‘—ât88qò ‡îž>vïÜÎk¯Y‚[f.¬(/½&ÆÊÒ’âkb¤ÎÌH$1™ŒW¼MÿÀPξg×v^9üÆM7N§ƒ÷=þÈÛÏL†·Nža×Îmè´+;T*:ÝÚç݃îàü…VdY¦¥­ƒ¢B¥%Å7íõl6›¨ª,Ïý½ž"Ç7¯×Ãôô òT–p$Š7ϳáÛ,@ Ö‡Úãõ=!ºáÖ&‰ÐÙÝKiIŠ¢L&Ño€h1I,ÇdšÓzáøÉÓƒ39 ›—^y}ѾE!›ÍÏfiïìfÏÎíÔTW.p&æŠÓîÙµ™™Yl6ë|áË«CbýrÙìòE¦‹ }œ:{¯ÇCYI1E…Ë·A’þœÎ026@(¦¥­ƒMõ+¶E%IlÞÜHÿÀõ˕幈ÓöÎî÷©Qk£¨ÐG]M5ƒÃ$SI |ùXÌf2™ ±xœT2…Óé 326Aõ|&EKk;³3³”——^Ét:ÍÀà¸)‚KØÔXÕÆUEQXé][’$šêÐh4?qš;vï¸.çòüK¯ G(,ð±eS#‰D‚T:ÍÔT¾þþk"I¤( µ5UlÙÔˆó äÖ²Ùì†tŒŽMàq»7túµ?_7nf¥F£!“ÉJ¥Ñé´Ô¬³‡@ Á­„η—O~æãð^jØÎÁCïåGÿ‰ÿñ㌥WøQ;ØúÞßäSÔryHF²ÿ0ßúûsl<ðnÈ·€è‚Û«ÅBÏËî]ÛxõðQ&§¦øàû_ÒY IšùÈÉ|o­m46Ô …yþÅWב—*.*Ž‚yÊËJ¸ëÀ^ôú¹ìŽàÌ,‡³éê"*õõ1ú¨Õjì6+‡ßxµZͯ¼÷±\ûWÃåt°wÏ.¦¦g˜ššæ­“gŸ`ÿ»sŽ¨d2…^¿°p±Ùd›ç!/Õ˜L&éó`·Ûhj¬_Ñ€_S]I*¦³»FƒÉh ´¤ˆh,ÆàÐC#£TW”ãpØð ¡ÓjsÅKEÁåt¢RItv÷PWS}Íû÷c'èóˆ›C ˜Ç—兩hÎ!9:6Ž/ß».']GWá² $I¢­£‹l6‹Z­fÛ–¦+žÛÖÂcÂ?0HeEºË²™vlßÌ«‡ædÝÖ˽wXSøÈè•å¥nìóòÜ\hn¥©±~Q_Ý¢\¦ IDAT´Ÿ”×¹¦ÃÕ²¹©³ç›—•¨\'´e|ô/ÿ?Œÿ÷ üß®ä5Û­¾æãüõo§ùÊŸþ€žÔµý”,ûÐ|Þù]>÷ÊÞ÷ïùÝË þðÏù¯¯N!߆}-+|™ã8øG|ù7Ê/Jžá?uòÛ¿¶Ô²Süõg¿IKbn¶=Ÿæ‰Ý/ñ§_k!¾è#ÝÍÝŸùSÞ3öþøû~R¢Ó¯ÿ¨Z6ó‰?úì8ÎÏ_8Eï 8+vðà»÷R¶ÿ“üg%ÊùöÂK=%;ã?óûûìÈcgøųopn`ÙR@Ó]ñþ]wñ»_p£âë¼:™.¸îGÁmH(æ§?ÿ7öìÜÎÖÍMœ»ÐÂó/¾Â¡ûî^UN¡¼¬”ÁáÔ*Õºœmljª§¸pN;Þl2‘H&7ttÝõÄfµr`ïÔ -m˜ŒTjñx‚ÞÙ~*ËËÖ½ïl6‹F}ýnóšªJNž>G,çèñ“Ü{×+ÿhÕéx׃÷ñ̳/ ÎÐç`ll‚ŠŠ2‚ÁFÇƹóÀ^êkß6ÂËŠB8A«U/iüŠFcxÜ.<÷µáRã*¦£«INÃf%8;K82§Ñ\àóæú´½£›ÊÊ2 z=áHäš÷ëøÄ$Ý=}b²æqØmØmVš[Ú™™%±¹©žÒ’â5ï«`åL‹YIï÷XÙd"4&zûÆ ¥ì‘sÐÉ–ïó…¯fìbRpëyŽŸêå3_ø›|˜G_jç‡ý—g «°nùÿnŸdëùó¯¼Æð|椗©~Ø>§ahâã¿yþæ ¦dÑë‚ëüí%ºàö$ óâ+‡yðþ{P«Õ 06>±¢| Ìi;K*‰îîÞu;›•yùµ#ìÛ3§ýÅnë±xüч0 ¼uâ4n· e™ŸY–ië袼´£Ñ¸æ}§Òé뵨R©Ø¹m ¯=NO¯ŸÚê*Š }W¼½Ñ` Ïí"Ï㦳«‡x"Ak[Fƒa¾ŽF ³³¡yã¿‹X,ŽÏç%N GˆÇãH’”3¸¸\NÚÚ;q»]k>oVK]MUîïæ–v9MyMÉ‚Ö©© ÕUèõº¹þåÚö¯,Ë=vBÔï.}YÑh(-)Æf³°esãºçµD"Éä*u[.g20uE²=×½^F«Y·‘/ß{Åë†#Q\N.—sÃ^’$ÑP_KKkMu7åuÜÑÕƒÓa_Ujo£`0èQeÃg?Ü:]>ýÇßçA>û–üo|µw_øÂ&^øÁ÷}x'Óßøÿù¡áŸüÀA}fÔ©i:ü ÿä)¶ÚC|ò×`[‘™øX;/ÿð;-SþÿóçèŽ)è ÷ð«{7ûk=ècÃœ~öI¾ýü,û/ë믜!l/àz#'g Læf0Ìæ1ï›|ý:‰$"‰¥—E5EåUZ2gd Kè+åßJr|(C½èꃶýw¸€q~þý£o; æI½Á??}õ{÷òÓþþ…Y’ƒíÂ,÷òío¾ÄIPÌCŸþ<¿Ö¨'xüIžÖ½‡m˜» ó¯C"«@p}Q‰.¸½ŸœÌiÇÿÛs/ÍŠ]£ÁpÕQBžzúYt:-^¯ç¶ìÛ…Ñh`z:ˆZ«¡ª²œŠòR*ËËP©Th4š9­ú¡‡†×¼£Á@8fl|âºCmm5ùÞ<Eá|sëš·ßµc²üv6‰Ùdâ¡C÷b·[ …Âœonåå׎ð£ù9Oÿò¾÷ƒŸðäOžâÉŸüŒŸ?ó¿xæ9††Éd³¦¦±Ù¬Ì̆®ú¼2r–úúB¡0#£cŒŒÎ…eggs’HþþkªÝ¬( o?I`jÛEí%Ž à¶}ÿÖjyÏcS^V‚Ëé\·ÑR–ežéUâ‰Äoã°Û¨™¯Kr£™ L]U‚µd£yó<8ì6::»7ôµ (JNžîfc`pož{Ãg,øH¤E÷ÛÌl(—‰Déèê¡«»—ήüýƒÂÉ}U/ã<÷w_áùÀ,¯é þç‰ ™7ñá‡4þÆÿâÉÉ~óSI¾ð5>ÿûÈçÿîUä¿Ê{*ô¨Üûùô<€òò×øÜ|‘¯¾œäÞÿð)º/ÃU Y·-{ mñ»øìïì&òÜ—ùìgþœ¯Ÿ°sh¯<Ík_ù;žžˆrò+_äo^ŸÇn~û3b?ùüñï}ŽÿòOm~ðÓ||³éòóêI"Yy¸ø_û“?âO¿×OÕûÿ€O×µñõ?þCþÓ7šñz?{ÜË|ºš7ó}!þå¿ý1Ÿþâ÷è*{7ßã@eªã×?÷Qªz~ÄŸù,ŸÿÚ[ßõi~ï@†.ëká$7ÉXů|¼ ßý%½Ie•e†_y’üÖ÷yª%¼hÎR™jùЧî ÿ»ÿ̱`VtîBc§È$é .eÀÏ2Ý;D°ÚGjëóÙR ãüôܨJúbú½y'Á±à/þñÞ|½› y4á‚ëþ ºàöæÜù¦¦ƒTU”ðúǹÐÒ¶êv³×À{‘T*ÍÌÌìm×÷f³‰w=x?“)2™ æeŒV‹…ºš*¼yZÚ:H¥×f8ª¯­Áé°ÓÞѽ@R#_3CÂÎí[áé_¾°&CÙlbsS#wÜË#=À{{˜X,λwrÇîä{óVÜ^VÞxó-Ž½u ›ÕBžÇý*‹ôzT*·‹Á¡ìvZÚðåç]Òv3Í-íËî#›½òÏÎp8¿=÷­íÜsç~¦¦¦Å$%¸m©ª(ãž»öS[]I$º¾Ì3Y–9w¡…sZèêé#“¹òœÂ?xß;M}55JŠ }”–¬MBH§Ó£’6ök¡$IDcÑ›RªP’$ÆÇ'oª¶ÐÓןû{ph„L&ÃàÐ0­mÄãqêjª¨©®¤¶¦ŠŸ—sZ\c”YÞüÎyµu€Ééþá Á7÷2O’LÆHdõØôZ|û jü¾ØO0Ì^ùÿôÔyÆ"1í/òg¦¨8XC| ‚w Eü*;Ê/ú’kX¶Ô$hcÛG?Áææoóýóa!ýv#‘„€ÎŽ}Ég” ½ÃŽHF’,z ”´èµ@:NŠKœ óN‚o`*™t’  Õk…£@pf'ÁmÏèØ8vÛœaUQŽŸ8Íj¥¬tyíçDb}E¿ÊËJI$”–¡Ójimïd:8sUQ“7+µÕU zú‡@²Ò’%×ËÌôz=M uô£Õj(ôå_ÑqB¡0ãc”—•0>`vv–D"Iqq!ýCø°Ù¬Wu.N‡›m.`tlœ^ÿUWÍêq»˜š ÅH§Ó̆B”•³eS#››xåµ# Œ—‰DikïD¯Ó±{ç¶k2>³ YQèïD¥R188ŒÇíÊÝ+E>6þþAÊËJH¥Ó ÉfQdN‡T”-=¶ÑXŒÉÉc“´µw-0bgg™šŠ JpÛ226Îðè»wnÇfµ\ñvÙl–ç^|…ñ‰Àš0W¤½º²œÍM 8ŽwìÜC¡0]=ë“øs9Ü{÷Á598âñݽ~6Ý’>…Ì̆po`™¤¥().DQš[Û©©ªÄ`ÐoÈvGH§Ó¨U*É™ ­†l6KIq!·kÉmõz=%Å…¹¬8Á5"3ËàÅ(EY…{û{øÔ¾J\ª8‰,j¢Æ–o!59NôbŒ‚o%I"NcÐën -úH$º ³ëf{_,+)&ç²¢‰DI&“$IÂá0Š2÷»Z57£|of“麶¯­½‹ÂÂ|JŠ ×½·ËÉ™sp8ìhÔ¢òµAAV$,Û?ÉçIóÝ¿ýïŠ!kŠø•¿¬¥„,‘éºMÌ$@ådÛ»îÆqæiÞ²¡c|ýïL¥Ž¿úã‘£ÿºÜd±Ê1 LÅ^Œ*?)PÈ+4£ž¹¼ÍY¢SQ¤E84gˆÎ:œ%vÏ— —œ×µé£ÅŸ2ñ`˜äðQ¾øçÏ3ž;?£ý4£¯¸´Á;õF€kûƒ4†Žð£áÌ–-…ŽÂ] 8Š6ñg_} µZü'¾¾í(ógߥ=)züº!G8ÿ¯Ï3²åŠß÷Yþ@õ-¾ý|  0x›xøc¿ÁûŠ€Ø~ya±déQŽŸä‘Gð™'öa¶©.s€Ê±òBäMûS¢Ï×á(¸¯¦—¼™ªTªò.7+³3³¤3™e & õµ4·.-¹¢Ói9¸ÿ òó‘T?úÙ\áÙ‹Äãq†ãq†GF±ÛmìÙµò²ΞofdtlM’-7ç'Ÿ‚,Ë9­û• /e¸1™Œ4Ô×ÒëÀfµ,ŠÜ›š23¢¶ºrÉíí6+Ñh ³Ù„ÝfÃn³13»Øa`4¨\Cf@GWñxœ^?Û¶4¡R­/\ëRÙÈèG¸¢íFFÇxá¥W±Y­ ð¡<¾ök?æÙ^^rÔ´ËÝu5´µwâÍó`6™hïìÆír’çq GŽ'‘HRZRŒF­¦×¿ºÓãV˜G‚«Áj132:ÆÄD“ÉȦƆܜy)ÓÓ3¼öúQ,3“©u++Ëä{Ñiµ(ŠBpf«Å²ì=)™löª ¢²¢ÐÝÓG$Á?0´.'@MuÅ9 ¦§ƒ¦§‘$™L†<ûšÖ[¹žgfÖ,«´±Ú?KqQAîï³g/PPA¯Ç›ç¡¤¸pÉk,˜b`p˜t:^§Ãd2¡Ñh(ð]c§¿â¢¬kÈÞYŽ­››8w¡…m[6‰BÈ벩Ñ/'±£Ñ¡ÊÎŽ¤PTfÊ>Â]y†ô co¾ÊàCïæÃw ð½ã,;>Ào>æä©ã2˜AÉ$IÉ2±öŸñíSOð>y7ÇþêEFee››ð̶rÆ[áY_{ƒ©/~ßàû'¦±nÿªÕÀ[‹ß™‚g_¢íƒ¿ÆÇê䛯 ¡®:ÄÇîÔqæï[ ³cýý£º´½ÑW 7¿ÀÙ_û$Ÿxx:<€œ¿ƒüî¯÷Ì_ð_¬Ü×@pýæy'›ï.eæøwd×°lé/gÚ¿õg|Vwq.ÓÓð[ʯ¾Á_þ´‡)aW¾î¤þ¿ûVúÛizϧù›÷€,ÃSˆi'¿öî#øÔNxc;Ãàó?âÈÁÿÀA› /ñõïœwH˜ÊöóÑßù;I.|ë´Å…°”àú#׋لÙlftlü¦>ý*)ñ»MõK: \Ng®æAKk¡pdÅ}ÍΆxåÕ#ÔÖTár:I§3LLLâv»Èf³deùšÖDØ“Tšé`­ÅM«ß¤šåoÓÊòRFFÇð÷P^VJ&“¡Ï?€Çã^Qú'ß›ÇàÐ0f³iÁ˜:ìóƒŽ.ÒéÌš¥7´óm gxêégyøÁû–Í”Xò5'™ddt§Ã‘3¨<óì‹kjÃÀàðºÆDQüýƒœ<}vÉå-­xÜîFœ¹mÈÊs)ñùÞZ/ß‹/ß{Éó2E,£­½“‚&£FƒJ¥"b6™rFúl6ËtpfÙëBQb±åËÈä­•æ–vŒzÃ\!^1•­L¶¶0¿ûÿŠ?úæŸñ?ºŒ‘sOòäŽßæßÿÍW!4JÇ‘gùÑëÅ|âßý.wáñ•ÿmâ7~õ3üÏ›HÚyé›ÿÀ«Í¥J]r˜³?|’æ¿üu>yà }Ôľþ;\øï\ð÷­xŒ;¿ø5¾ô üÖ?×~í‡ùÙOûyßj¥òÌ þþ+>ñ‘Oñ×ï·"ÏôóÖ¿Ê÷ÏGP®F9Lí^ÐÞ•âmåH3ßþÒÏøèÇ>Á_¾ß6>ƹ—¾ÉWåÔ‚¾þÛc¢ ±@ ¸1¨,•ì-ŽÓñƒà¢9l¥e˼ŒŽÌðv¨Œp*K6"8%#ºûF<¼™8ò þd`¾û>öo.éUˆMÑ~ü^öñáß¹Ÿâ?Ã+_æ¯~ÒNX¾ô±ÜÌwþö‡˜?ÿa¶{îçO¾º—‰áiÒF/En=¤ã©¯ò¿N‹ç”à† Õ5m.©kˆ^¯G­V‹Åoúsq»œØ·gÙb²©TŠŸÿÛóƒoç;vöïÝMaY–9qê,ç›×WØ®±¾¯×CMU%]=}œ>snU§ÃÍÄ–Mܱ{õˆª‘Ñ1 |+®3˜bxd _~ùÞ¼U#øfC!tZFãòFüÁ!JKŠ×tNšÛ8vâTîï͛ػ{ç²ë¦¦su bÑ8ÅÅ…¸æÉTŠ“§ÎæŠû®‡äƒèõW¦ÓxüÄéU¯U§ÓÁû$—)184B¾7NK$%™Láv9‰D£ F9}öõµÕìÛ»›Ÿýâ— î@°:UeX¬ŒzÑxŒññI&S×]®N£ÑÉdÈ÷æqÿ½wb6™ÈfeΞo¦»·’¢Böݱ몢¦{zýŒŽ3<2F(^óöf“‰ûöH&8{¾…ÚêJ65ÖÏŒ#QÌ3j•jQ‡†Gq8l«©7‘h”Á¡êk«oÊhõöŽ.ª*ˉD¢Øí¶ugÞ]Úñx‚Á!dYÆl6c³ZG¢$ ò<fgg±Z­ØlVvŠ¢H$˜™ ár:Ðéttv÷PWS}Mα­½‹†úšw¼¯¿ù­ï‰ÉS Á;Œ KÃ{ùãÏ>H‰*Kç÷žà¯^™\TØXe(`Ç¡¹oWåùTñmg8üÜ‹íµ 7á(¬l$Q«)++¡¢¬”ŠòÒ%×#“Íâq¹0™ŒôùûÉÊ233³œ9×¼úE(IÔ×V3<:F(F«Õb1Ïc\.“b±8Z­–l6KyY ƒC#¤Ó7wäšêJî¹sÿªëƒ3˜ÍæUå$††G(¾B]áÁ¡aJŠW–nð R^º¶èBY–yþ¥×š‹ê×jµ<þèƒØmöy­Äùõ…öŽ.jkªr’=½þ\´ðÄd€sç[ð ^U?|è¾%e.EQŽŸ<Í…æ¶+ÚçöR_;gLiim§©±€é`ÉÉiæ ¢Ú­VÆ'&iëèdf6„$IètZ’É+Ë(رm3V‹…׎¼)&"` ×ëÈÏËc&" _±³w5b±8o<ÃÈØj•­VÃÌlhÙú%—¢ÕjñæyÈf³¨T*4jõÜü㘓”ÓiµÄb1Œ&#e¥‹Ž‰Fñæynº±H¥Òøû¨­©ºéÚ.Ë2ƒCÔ•–\Óý^Zsâ"étšàÌlnŒ›[ÚQ$0  v;}ýÔTUÐÑÙÃæM פ-c㘌Fl6ë;Ú×ÂQ `c ÂR÷¿÷›;þË—ùÆ[AaølX„ô`E.ÄíéõSR\HcCù޺͗F»G£1@—ïE¾Â:Š¢ÐÖѵèÃX]yÑ1p¥Åu7:.§ƒx"N«E½‚¾µÉl"‹¡ÓÙW«+%Y= Q^Gˆ–ÖvöïÝÅÏŸ™"ON§yé•×i¨¯Ååt I*ɉD’úºÿÇÞ{ÇÇ•ž÷½ß3½W`Ð{/ì˲}µ+kµ«bYV±dù:.‘e;¶ãÜÄŽcG×þ\;×qœ›Ø7‰«8.²å*;’VÅÚ]mÑ®¸»ä’Ë‚Þg€Á`:¦×sòÇ€³‚ € ù~ÿ!œ6ï9óžsžßóüžžuI[ZšŸ •ÊTíôz6«•K#cB$î Ï>ý^šßÃKå2Š,o«Éñ­Źxiôºs—Ãaç¡“Ç×Ó‘CÃ7ÜnCC= õ(Š‚oÉÏÊJˆl6{WY÷ȲŒ$IÕcV«î^÷ûÁþ^ææ½tnÑKh¯P©T;.YÌfN?Š¢(„´ +¡Š¢`·ÛÄÄ"@ ìS„P ¸i …"£cŒŽMT7¿àÅ¿¼ÂðP.§“l.Çà@oõ%XQV‚a.^aÁ»xßaSc=†‘$ §ÃN4çòè8F£r¹ŒÃfGu•UOÃUUÙ\ߢŸr©„$IFt:-í×±†º–\!OgûõƒÙl–\.Gç6·w…`(LgGËúzº(—ËŒML¡( *isæl.ÇÌìßÒ†cº$I"—Ë“Ëæèìh¿«ÎÉåÑq$IÂír"IñÕ/14лeUÞ~D¯×Q,) è9e r IDATtº{ö{$IRUL·;쌌ŒÓo2îšÐ&@ n!vŒ‰©i²¹,m­-äó45¡P…•`ˆ®Žvz»»„Pd³9’©±X›Í†Ëé  ÓÕѾåzáH”T*Mow'ÉdŠ²,ãXËÎËåò,ù—±˜Í¸]ÎM×/‹pƒØx`%tÝ~[Q.—™ž§¡Þƒ"+ÕFÈãSx—ðxÞµ?H&SLNÏ2>9µë¿/Œo T*F£á¶÷ŽDèï¥X,V ¾EJÅ*•D¾P`~Á’Dscö·›Ïxý3´47ÒÜÔÈôÌÜ-59·Fg{m­Í·¼~±Xäß~µJMKS# u¤Ó’©…B‹ÅŒÓa'ŸÏ36>Å¢Y^o÷V_çᙧŸªöq¨«óàõ-ÑÜÔ@2™º¥ììt:Í`/‹KË[Vªí’©ó >Œím-kÖt銀ât0:6ICC.—sÝ~§¹©‘éÙyû{ï‹ï”J’èíéÄ¿Øñþ @ `gB`Gñú–ðú–¤JŸ‚™ÙyŽ>À¡Jƒ¼h,&‰Š½ÄÔôšl6‡Õj¡®®–h,~Ý õK#c46ÔÓÞVyÁ¶Z-ŒO!I`·Ù˜_`°¿—l.Çøä4*IB«Ó’ËåÐëõ E =++Ajj\ج›{çò¹[úLeY¦¿»³ú³ÅbÆårP.— †B¬&ÌÌ.095C:¾ik£[%‰nšÙ«ÕhÛ Êe™l6Ë‚w‘3çÞáû?ð~ŠÅ"Ýë–›œžÁl2¡V«(o³÷ƒF£æâå14j5ÍM B(öˆ¦Æz^§©k,¾Ê‚ׇoÑO¡P ½­…¾^Ré4Z­–_z•|¡@.—ç¡SÇ G¢¼õöù[:Ž¶Öæu"T*•Eajf»ÍN&¤¡ÞsSÛ=8¶©eP¾Pà«_ÿÖº{Q4çÜ;—6ÝÖ÷Þ8s[Ç¢»Î\ãvQã®4ž={î à©­E­ÞžÍ‘Z­¦©±žÚZ7ããS›6¸½S E漨U*š›ª÷µaµZ°Z-‹EJå2¡P„øj¢Zq·Q©TŠ…ûïK¶GI@ àæB`×9÷Î%òùµµn‘èÖ/Î’D{[+.—ƒÞÀäô G ÓÞÖÂ;G˜™ßüBÖh(•JwÕ¸\¸4ÂJ0Ä£ŸÄn[Ì(•J,ø«Á÷²\Æh0ŽD‰¯®‚ÅR% ÒÝÑÑhÀë»±¥“,ˤ3Ù-ýœK¥só^z{º¶ÜV*•*âÕjA¯×m²­2 .§ƒ•`¨©êëjinjD–ú{øú7Ÿ'ݽ€É™³çééꨊ¹\nǶ½X¡T*®Å?”Š•Ä@ƒžÙy/}=äsyþñ…—·½MN[µ'éêhçÒÈéLFL&Á.ÒÛÓÅã<TìnâñéL†ž®Ôj5‹‹þ›¬¯µºY¶ããþÀÑCäó.ŽÑÖÚ‚ÅbÞv…€N«ÅårÎd0›LwlܳÙ,³ó Õøñ`ï¶{;l6f’JÅJ0DKs%AavnL&CC}î5åN¢( ó ^R© ÝÝ÷Ý÷¬¹¹‘±‰) …jµ‹Ù\­”„+âû*Á`³ÙtKVˆ@ àÖB`OÈd³˜M&}ø_ÿÖó× ¶ôtwñØ#§(•Ë,/(—Ë:0„Z­æчNrpxFÃÄä4Fc%sþì¹ $’)|‹KwÕ˜\©ºðz—²2;ïEQº;ÛÑh4D£q ù •ÌôÀJå@#‡†ð/H$’huZJåò¶š9.--ã°Û …#(Š‚tŸór`…·›X1…Z­¢­­½NÇj"y“Ñ@C}jš‰ÉŽ>°éþt:-}=Ý„#aº:Û1ë<µ—–‘Ë2ÑX|WǺ°–ÙßÓÕ‰,ËœyûÛ¶N§['€)ŠÂWžûn—“øð³Ì/øøÎ+¯m;hh0è‘×*R©4Åb‘:O-áH”b±(&`‡Ñjµ ôrüèa¼¾%Þzû<±«æ¤³o¿Ãà@ãS{z\ÛµgÓëu456¬ }ج–jÙ­(•J‚¡juÂ^ …ñ.úÑj4:0¸s¶j5‡1:6ÉÐ`v›N‡J­âòè8Š.§¦›è³cçT–¹xyŒÁþž{º‰ñV¸œ,sµb&‹326,Ë(Š‚ÓaÇíráªa%"ŽP[ã•@ @°¡@°'ÌÍ{™_ðqâ#ôtuá[\Äjµâr:P¯oIR18P±‡I%Sh4šª™…Z­¶Ð8yühuÛ:N¾Pào¿üU²;˜)¾W¼qæm©$'Ž!—Ë“J¥°X,X­fz»ßÍê/•JȲR ð[,f,f3Á`˜øê*}=[îGQ2Ù,F£‘¦Æúu"ÁÌì<…b·Ë‰Éd$É°ä÷ÓÒÒˆ^¯'•JÆ1 ô­l6ë–ûÕëuèõ†Jãæ«ìŽBá6›ßbÅbg·™šž£»³ƒK#cV‚<ñèC¼òÚéÛÞwWGz½Ž©éÙu¿Og2\¸4ÊÙsïl{jµšR©¼®:fÉ ‘Lb088<ÀÛç/Š E Ø!œ;Ý]´¶4sáÒȦ"b6—ãíóöô¸êëèêlßöòWîv›•™¹y<µ5Ȳ̛gÎqâ#„䱉)¢±žxà–³÷o—Ú7 ÞÅëöƒ¸tZ---M\¼9}×KScÏ>ý™L†yï"V«…x|u]G€p$ŠÕbF¯×¯ ,•*ŠR¹LWGÛ–û˜š™£³½µZÍôÌ8|Í<œ$Ÿ+Éfñxj6ô¾ÙKÒ™ “S³ÜÓàùäô ù|¹\¦®ÎƒËéD§ÓîÚþ …"£c<8„êšJ>ÁÖ(ŠÂ¥‘1¬ ‰dE“ÉH[Kz½~Ëu¿ðǾ¯?Ûf–@ ‚ýE>õS×xê]œvÁ^!Ë2¹\ß’Ÿp8J¾P P,âr:iinºöõÅ¥e¢Ñ8&³íA“b±H(áø±Ã¤R)"ÑØ]5.ÉdŠT*E¡Xdh ÕD½N·¡£wq‰ú:ÏÚè¼ëµ/—eœNǦ۞_ð‘H¥P«TÕe+A4j jŠæƆM-¬V Ù\ŽL&‹Ù¼¹µ§¶†™ÙyjjÜlŒ®÷Rl2I§2´·µ°ä_æÂ¥Ñ=çD2 @¹,søÐ0Åb‰ùßmŸ»L&C}CÁ`ø–·c46ôÙÐé´äòüËË?v„ —F G¢”Je1™;È”œ;‡9|p˜O>@kKó-gù«T*šp¹œÕ{Åj"Õb©ÎÑss^Z[›p8ìÌÍ-H&q:wä³ë´ZÊåÊ|f0è÷l¿n—‹:O-õuT*ã“ÓÕñÚçžË£ã"Á-!IužZŒÍM Ô×yp:LÏÌ EX\òãv»6µ_<÷Îþ®ÀÓhÔâ @ ìs®¼¯Ü/¡@pÇ(ÞUåò…ƒý½ëþn6™¨q»p»,,øG¢„Âj6ñª]ð-Ò×Ó @[k3ÙlŽl6‡Óa‰»ÂÛ=‰Æ¨q»hll¨¾ü^0ºòw¨XŒM°à]diy™¹y/V«‹åÝÊ€ñ‰iZZšpÚ핱2™,*µŠººZ 7ÈƳ˜ÍDãqT* ý&b‚$IÔ¸]ÌÎ{q9oh*‹x½‹ôtw"+ /¾ô*ÙìÞÛE)ŠBb5ÁÌÜüŽ¨ÃÑXœ†º:š›Éd2äòù›Z_¯ÓñÁg¾‡#WÝ*š,˘MFF'&I§ESc`¿¢’$;F£·ËA2™ºî²:­–'{˜‡N§¾ÎƒÕjÙq ³Ù„J¥brj†r¹ŒÕjÁl6³à[Äåtâv»ðùüÔÕÕÞ±1[ô/Sç©ÝVŸÝ@«Õb·Û›˜ÄS[³-Ñûfî5»¡Á;fñt¯pu…$IÔÖ¸ñÔº©óÔ237ÏâÒ2v»m]R‰ @ ·‹ ‚;€ÙlÚÒfÈåª4¢ñUÜ.熿۬VÞ{@¥ƒÑ`BÁ]G.—Om • õu!@ n›ûM(o.‚}AKs㶂…«,„45]íÕŸ‹Å"N‡£ÑÀü‚·šIÅ2gvÞËSïy”¿úÛÿuW¨¯õ«ß.±øjõÿ#c4Ô×ÑÑÞºîeº¹©±‰)Ü.'‘h¬ZÍÑÑÖzÝí65Vš76Ô³àõQçñÐÜÔˆÑ` —ËWPÙlŽÀJÞîN&&§è[wn#ÑÏ¿øʶ3î÷#²,óÂw^åÉÇáûžzœÓožetl‚y¯öÖ–6(4 ÔyjyèÔq´ +Á-ÍMœ¿x™RYô—ØlV‰$/ÑÝÙÝnãáOT.Ëå2‰dŠp8‚N§££½uσâWp9U»¸·‹‹—FéëíF«ÕÜ  Ú7†¤ž‘± :;Ú0›L{²ßÉ©¬V =ÝÔyj©ó¼[ÙpèÀ çÞ¹Dm›r¹LOwét†h4ÆÁáÁuÛ‹ÇWñ-.U{.¹\Nâ««Ô<âË"@ ö=¢¢@pÇééêä±GNm0‰Åâ¤3Báµ55k ¯o±êÙ¯R©X¬àt8He2LLÌP,•Èær„Bjj\8ìöŠ]ϾÑ÷n·“åÀ ét†y¯T*Íj"I¡P «£Xl·Û¹ííɲB8©6~4™Œ,ø–ªA'­VSÍ M$SëzÌÌÎóüw^½+zFl‡¥¥eœ†e…ù¹\Ž¾ž.&§f6,¯Õh$‰?û4Cƒýè´Zæç}´¯ 9*I»¸tÃýjÔjQu ì3®X™É²ŒÉdZ×W¥R¡V«1™ŒÔÔ¸q:wL$¸I’°Ûm„Ãý˄•J°L6‹ÙdÜ3á@¯¯X$ÍÎ-P(®ke·SÈŠÂêj‚Ö–æ-—sØmhuÚu‚N§ÅfµnXÖ`0 !1;ï%_¥T*ŽD×­+ØÝs:;·@M³É$* @ ·¨(ö§†ÚZ÷º&½›153ljŽ`4˜œžÁ ×£Óiéëí®.#IžÚ¼¾J6ßõ²ãfɸ/Æ÷Š?µ,Ëtwu[Ëv¼: R«½¹i`rj†þ¾wÇ=‰â©uo¹N¡XäÕ×N37ｧƷP,òÊkoð™jæø±Ã(ŠÂ÷Þ8Ãäôì¦çâ©÷ŽÑh$_ezvŽb¡HSc6Û»™z™L–æ¦F Òôxx°ÿú/èVë¦Y~W3;7Ùd"›ÍÞóYÙ‹™ÁþÞêÏNG¥¢âjnF(P“ɸ.6‹Ó»fÛ°…b‘ç¾ñíMôÞ  .Œqøà’$qêÄ1^øΫÄbñõ×»JEsSÖYÄß{ã éL³ÉD(!—Ë£V©0 į²”Ÿ$zÍöÁîSãva2 ‚ë¬ð6›îvt:- õu8vææötßÍM ÈJ=/Ð×ÛÑ`X÷÷T:^¯§M¼…#ŒOVEqNÇ¢™· £Á@`%¸îT[ã^woÜiÊå2jµ§Óóªª:ÁîÒÑÞÆé7ÎððC'7\3@ »ŠÚJû‘“œl¥Ö,‘-0ræMÎ-$Ù^ ‘„ÆÖÄàpmµfTÙ(¾©.ÍÇ( 3Á"„Á£¯§ £±’§çpØq8ì,x}¤3YJ¥®µÆ·&“‘¹ u;²ßG>Àk§ß¹¶OÿòÊ]ÛXwË—æMª*,fsõÿÓ³s´67o{{ñÕ²,39= H*¹\Y–Q©T–/‹¼ðWîY‘à gÞ>Óa§­µµZM]]-þåÀº~¥r™ùߺ~WŽDYM$ècrz†–æF"‘èÑ! UE.§ÃÎÁáAœNãSŒON‹ÉE Øôzõuôz=j•ŠŽöÖj¯–t&ÃW¾ö-ҙ̺uŒÙ\Ž©éYº:Úñxjîê1(ŠLLNsøàðžï[%Iôvw12:A[k3µ5n²Ù,Ù\ŽX|•ž®Žê²µ5njkÜ(ŠÂ’™B±HsS#¡P„P8Œ^¯gh oÏŽ}bršÞ=ªÀ\}o óÞ'!`‘ÐÕà3?óiNÕ^xˆ‡žüÁ7þ‚ÿï/Ï°²U´_mçÀ‡~”{_7ךo潯ñçÿóx+XD肽@‚;†Õj!—Ëc0èJs@ ‰†z^ß"jµšL6‹ÕbA» >®¬5™è#ÉðÜ7ž'‘LÞSc<37ÏÑÃÐjµäry¢±8ùµL×¥¥eZ[šÑ]ÇÖa3B¡0n—“|¡@cC=P©2˜[ð¢ÕjiY«ü¸ò{¯wñ¾±yzóÌ9ZšQ©T>8Ìj"¹¡OÁw^þ.?òéO ÓmóÓož%Ÿ/ I=Ý:0Èé7Ï_MlXöêJ˜X|•Ë£ã>8Lcc}U(hl¨§³½••`˜™¹ù»ºy´@°—xjkxäÁ¸\ÎëV™M&žyú).ŒqôðAÌæŠe˜J’$*UÅöíngnaC†ö|¿Š¢ðÖÙóôz ÆŸ˜Âbµ !ÑÙ޶鹑$©ZÐÔX$qÃJÃí’Í嘞™C’$TkÖ~¹|¥ò«¯¯•$_MP[Sƒf›B+Š‚,+¨Õªûö{«( ’J"ŠP{;Ä{m+Ÿüüg1üÉÿÍŸÎäÑÔ}Ÿÿ•þþW~ŸwrFº?ôOùɧZ‰ýÝ¿ã?|7Š¼E°ÃÒý>õ‰'9Òl¡žåͯ|‰¿{;L@ ì’¾G>þIÞ¬“ZuœÉ×þ?þûóDJW–Pa{à§ø7Ç^æ×ÿû9ô üäoñ‹G×?_N~á—ùÝw ýññé§Ón×"gÃLœ~Ž?ÿ_ç•Äxï6*Ë?ü‹?Ì)}gøúK癋ƒ£ý0ï}æ-§>ÿ$Íoüù©ÍnÀ’#Ÿù—üôI;òʾñÂi.y(–z~†}„Ÿøºßú|7,N¨`÷BàŽñÖÙó¸].ê=LNÏâtØim­d··¶4S(°ÛmLÏÌ¡ì²vj6™xì‘1ô„BaBá²,ã]\"“ÉÞµcœNgxéÕ×yⱇYðúhokÅ^®L2ÙìM‰ÙlŽT:³ÎJA’*A›b±ÈøÄ4­èt:^}ý |‹÷Íõ¼šHðÆ[oóЩã<úÐIê<µ|÷õ7ªËÈŠR©>p:p:ìè´ZœN*•ª*R9ôz=¯¼všƒÃƒŒŽOV«]T’„Áh P¨dË–Ë%üË¢±8©tš®ÎvZš1<þȃ ô÷ròÄQFG'XM$˜÷.n韮V«Ð¨5UAI ¸ß°Ûm„²¹Üº óµ8öj…Ú•ûȽF>_¼#M—½¾%ú{±­54n¨¯£¡þÖª ãñDUؾ]¦gæìß0&Åb‘Ë#cØm6¢±:­vWƒÕ‰d’å@ZM.ŸC«Õb6™ˆDbtwu`2ï»ï­$I ösáÒÈý)\ƒœ¸Ì?|i_P;~ ™ÀŸü:¿w>µåµÊuŠÏþìÓÈ_ÿÿùµÿ¼‚¡ÿY~úÇ~O¬þ&_šÎ‹LF@ ¸]TNþ©_àûóßàëˆÙ†ùú#|6°À¿5†©í§ŽäÁ÷ `}ùªõLÔ{æÿæ?ð…ËWâ2…DmëGùÜG›9û…ßá÷§Ò˜ÛNð©Ï}†_šáwN¯Š¹{WÑÒúôÇyÐù±¿æ7ÿàuV®ÄòÇ/söü?ó¯?ÉЩóþ—'ù;ïµ²» ËðGùÑ“vòãË¿ûƒ×X^«<ô2ßgGÐòé9Îèï&"òÿ»ŒºÆSÿëbw‚ö¶Vz»;ñ.úéîêÀj1¯¿8ÕjJå23s 8ö›jTx+X-fŒn·‹Ö–&ÚZ›èë!_(GîÚq^]M°²äÐa =jµšD"‰$IX­–›ÚV:!›ËÑØP·!P¢V«q»LLÍ`0xí{oÞ“vN[ GÐé´Ôyj‘$‰d2Åìü†e|‹KLNÏ261År`…©éÙª½P6—C§Õ295C[k3‘H”l¶’G¢ƒ\.G|u•d2…$©e™B¡ÀÔô, r`p•êÝó£ÕhÈd²;zˆ¡Á~ÜN'ÉTŠLv£¦( :­½NG±(ò÷ÑhŒp$ŠAo ¾ÎsGåû\.O¾ÇéØýŠ­Ý,ÁP˜· ÇÝóE¡\.£×ëoj½B¡ˆ×·„Õb&›Ë119MsSCÕ2ñÚû_Û…Ýn£±¡­FÃìün—kÝ\|»,‚,.ùY\ôc·[éìhÃS[ƒÛåÂfµRWWK0fyy•J…ÑxÿùôÏ/øªß¹w.îëcÕlR-+9äßüƳ”¢|ì³?Á?ùä3<Ôó#sÄŠ`éz’ûéŸà'>õÞÿÐ u¬!: IDAT%?“Kzÿ¹ŸãCÍVZ8Akè,粇øìÏ<Èò«StöŸóƒm&< +1Nü‰_áWO,óÝs•*•õ(¿ðï?GÛÄiVúˆÕæ¿}ñ ¡|äò,Áæ'ùPë/PF ·5÷×?ÁPÇWÿËßr1–'[âÒ[g]I‘ÉKÔ:Å¡Z5˜p%ßæù³aJÚF{zˆØw¾Éþ$™L†L&K¾¬ ’òÆÞäôø YEÚà¢ïXåó/s6PBÁn¢mæéO?E§a…¯ý·¿æäú(¾œö³ á=ýµ¸‹—xytu}UŸäàÔ~šc¶9þê÷þ–‘ô‘ ‰÷þÔ¿àý:âgþŽwrp°…ܹיH ¥`¯Ù*Ñòžœ§Ä)Ü t:-=|’p$†ÍjAµI fbr»ÝÆñ£‡6õ¿ß“y_«å‘Oàv9™œž![½+ƒ§•¯¿ñžÚì6&“ñ–2,u:mm-×=’$14ÐÇ×¾þ÷­ÕÍo½M`%È{{˜l.·sÜ$x A‘^zõuZš×õxH&SÕÿ_ €AE€xþÅWP©Ttv´qpx÷Z¯ê9Ôjéêl§½­…oüã‹ëö¥ba ¯—óû<À"ì’$a1›©©qݱ{Ï~`n~þ¾ž=ÛßÅË£ ô¡½ÉJ·áñÔðÎÅËÛ곋¯’H$Éåóäòyz{˜[Àl6s`h`ËuÕWY 9ì;#£ã˜ŒF:Ú[™_ðÑÒÜxËŸ/›ËQ.—X;'ÉdŠÙ¹:;ÚÖ-w¥ÆØø‹‹~ààðÀ}!x)ŠrÓ ûó99ÉþÇËl‡ø¡_øa>uì,¿}±“ÿÙgÐ=ÿ?øüö¡êx’ŸüÉŸâ‡cÿŽ?ú/€ûóŸÅð'¿ÅŸÎäQ×^‰PDyíþ 5ÿöçiøËßäÆóèC£”?{’vã£YÖGèJžåË‹%Ô}jPÊÈÕ¨’L¹Æi’¼ˆ6 Áíz®ÊÕPÜ4XôðìÏò›-µhRËŒ¾öuþþÕYRñ.ÆAe;Á/ýögèâoü¿u1…)ï2 v ¿Ä\|3[ 2±ù%rÔao°¡õV~:C €ÿ #±ÊÙ’ôM<õ¹_äã}:âgþ”ßþâÛäùø¡Aš |ÍŸâ`WQ‰!Ü …"áHŒ¦Æz<µ›=&Iš¨¯óì‹@Í@_ßÿ÷sâØá»vÌ+! eY&™J3:6yÓÿZ­õ ·,ˬ„Â÷õõ=¿àã+Ïý#ó >úûzÖY5m‡·Îœ£P,’Ng˜¸¦ÏÁ–ºJ…ÓaG–e¦gæøú7Ÿ'ŸÏoº¬Z­æ=?ÌÑÃÐiµ4Ô{8þÀê<µ¼}þBµÂýœQ-¸?Q…b±ˆË鼯ÇAV”=ýî756TÏÆf³226±ÎÊíZ¼¾%E¡¥¹‘¾ž. ¢Óiéí颩ñæ…u•$q`h€b©ÄèØ$-ÍøýŒŒN026Áøä4só^ýËLLN“N¯oŒL¥˜[ð2>9ÍÈè¾Eÿ:+¬+ñëÙ#ô÷pðÀ ƒý=\¼<ÊØøÔ=ÍúýtwvÜ“Pœ7¿ös©iÿENÏæÐ;Œ¸=Iò%þòù ™ Á‘oó¥Óe¿·ÓM|UóÞ7¹,÷ò`›$+C¶;ýË¥2áKo¨}’ï?ÕŒMo¦þг|ò˜ I¥E%à¶Ñ›híG8˜{‰ßûµ_â—þÓ ¤Oü~ö}[fñªÌvʱ(áÑoñßÿÓïó…ôÑü‘ÆϽÇS]ON¼Å¿ÿgÿ'ÿêwþïÁåg¯ú›`·˜s$s€ÖŽ]·YœD…ÞnCäSùÂJ‹^ ²äyW$øÄU"A´åbž ÑkŘ v1oîÏçž~ï›ú{}K öí»cnjj¸kÇ;ŸÏc2imi \–ñ-.ÑÚÒL:Á·èÇd2R穹®Eƒ§¶†‰Éé-³LU*Ãý\»¯¯ïh,†]¶q`h€G<ÁìüÑh›­Ò#btl‚p$ºéº¥«JÛnFÌQe]óã|¡À’?°!ãô ³‹ÅLY.³²ØXÝ …1 d³¹ûÎJJpÿ‹¯òü‹¯`³YÈfsÔÖ¸ijj ¥©ñ¾Î6+±Æâôú]ñÀ¯­qsyt|Çú ”ËedYF«Õ’Édì'›ËqáâV›ƒ¾bËS((•JÄVW9ÑrdGö­( ‘hŒÕÕ6«•Æ†Êsεs±¢(”eM£š…™l£ÑÀÜœ—††::ÚZ·ÜOG{+—GÇ·¬vÐjµ:0D0&ŸÏß´Ó~el¢"|ȲŒ,Ë•Ó*5­ú»¿‰8¥+WÙ (² ¨1¹L(ñ%ÞMX,_ŠCŸ“ê&4ò>¾7¢ðÙ͘‚kñ꟭Y[ø_à¿þO#?úÿœßýa«³gxýíUêÜIrâ@ n‰R©Œ’;ÏßÝŠ2s—VØàMQŒã‹Ã §—Fë ­?ö DÐàîjÆ@Ž`(-ª »Ž wnN-yý3üÀ‡žYW² 7è÷e0¦Tº»½Éfææ«BZ­B­V3>9Z­¢¿¯€¹y/í›'Ré ¥r™t:ƒÙ|ýÆeY<@¥?Ä·žÿ:ƒ^ÅbÆh4àr:8vô‘H”L&ËØÄŠ¢ V«(—+c§RUz\ùw;\Èo¨¯C£Õ°à}·©t¡Xäô›g Ctv´spxߢŸ¹yï¦Û”ey]ƪ^¯£P( Ñ@pÏňÆ*¶_+Á—GÇ1™Œ8ìv  ×ë¨q»Q«ïÍâÌ«ïÁ…B‘t&Ã…K#t¶·²šH¢ÓêT]íhÔê›Úv>_ “É093‹Ñ`@£Ñb1›…t&³#¡¿÷æYœ;*• ‹¹ÒÉh0pøÐ0²¢PZ³Ôhµ›ÚÞ*²,sáÒ=Ý8-[Ž$IÕ¿·µµÅÉfsØö9ÒétÛrùN•ý®¿.#ÑþåÍM8ö{vþÙx‹-“‰d7b×\ ½8p4Ù!µJö¦»òxOÁO<È¡@×9©<ßJZøžç÷ÿ¯ ¨*'ÿÙQb“~²â¶/·û”@. ­y·M„J£‚ré*Û·kQaj=Â1÷"o½³²f§PÌ)—lG?Íç†^âWç{Ä5Z£¹X¤,æî]>¥).}åE–‡ž¦éC?ÏÏJÆ—^#˜CíïýÔÿÁ‡Ì¾=’ÜXQP ðÖÙ0O¿ïA~úWOb¶ª® @²äûŸ¬…ô›¼æ=» w”X,Î¥‘qZ÷{£ÑP ({l°W\ïF®µqºâe¼þåtó§‰+™êÃýV‚ø–üØ­V<žš BOÛ%.î«(  É$þå@õ÷’$a0èQ­VKKS#±xœd2ECC±ø*…|•l[·ËÉâ’ŸÄU} ¶b9°Âr`ÖÖ/Ë2Åb‘É5;£sï\Äfµðø#’NgnÃ2*Ÿ/TƒS…BAœ\Á}E&“%“Éâ_ Iím-46Ô3Øß{O|¾ÀJƒ^OY–Q«ÔLÍÌ¢`0°XÌ;r›Õú,353G"‘Àl6£Õjééê ‰ GËeMõ”J%ÆƧÐé´Øl6L&9T½,.ùÉ狨¤^yðãS lrnTksØnpñò(‡ Ý’m¢Ëyó£{»;¹pq„C‡¶|VJ¦Ò´jïîrõé™9jkÜ ö߇–x ñK/1ñÑ󩧦ø“ï.¡êxŠO?¤åâÿ'­¸@R¡×oïºËyßdDú>õ!ß_\bÍÉzŸüüû‰þõñå‹«Ø|„µùxîK+”Ä-@ n›¼÷{¼•ýy~è#nŒtÝI>ù^3_½@äº9‰2eMúñÐñWÁ·.¬ 4çïs1ûÜ9&¦µ„ßÿ,}ÐËß½ÇÐñŸx.þñ!ì:ÅÅä¿þy=ÿê3‡üàçøÍ‚,úGAÓ>þÌiþ~‚ÔºsRbé…/súÁŸâA« Â/ó…¿:·&H˜ZNñ‰ŸøGŒyF¾ø &„j/ØÔ5žú_à ¸“ÄâqúÖ½T›M&ýËCa–üêëyW7éö-ùikmÙ¶Hpî‹ûúóh4ç ÉУO´0ÿòøò  ¡öØH½Å˧¸4+Óÿ}åSûOôi™|îÏøÒÙYFÛx„÷ÿàè¾Á[ñF{ÔÃø‹o­ô?~ëå—9^‹B•Ód›屆yþþ¯^g©P¹£+Y?c+vúñ‰>Ì€e™oü?ãÕ€xž‚¡gââ ®‡>È'?ñaÞwÀÆâó_äO^^ºÊâMsøqN.ñüÙŠ5\96Áy¿•Ï|˜ýÀ3<>`Æ÷í/ò§¯øɦæ 98úÞð‰}€G{ÔŒíOù˳áJu˜`—‘IûÞáõ‹a°:©qÛ1j²±%F¾û5þú¥(-‡;hê:ΰaŽ·'"®:/J!ÌØhŠ¦#CÔ;Ûyø}qêè1{ßGøøûÓb.0õÜð‡¯,¯[O°‡_Ûrù¾ú¼RßÐaq© î8'åàðছ™'“Í¢V«¨óxp»œLÏÌÑݵw ëü˾ùíïlÛf?óìÓOmZIp…¹/Åb©êË}Å[9°Äã©]gÑ05=‡^¯£¾®N‡,ËV‚$SiR©ô¾I¿g&rIB­R­ëm°:½^Gò: jµE–«Œo„N§¥PÁ@%Iôtwb±XhkiÂ}VU-ù—Q©Ô4Ô{nj½X|•p$JÏÚ=9‹c40 wôóÌÌÎÓÕÙ¾gûS…ñÉ)úîLuI4V©FkkmÞò/\áðÁámowu5ÕjÙâÂ[oŸçÀàç/^¢±¾Žå@¥å~ö}›Vˆ|áÿ|_çôw´Ÿ‚–öü5þ¹çËüÚ^¼&»Q Á¾)`éûÿâ瞢YUfú¯~‹ÿøj˜kßÜUúz?ù맭֌*Á7~×^|‰7½i„¹ó#Ÿ¿¿œ„õ`_páÒý½=èt3ÿº:ÛI¥ÒŠÅjY¾ËéÀ·è§¹©a×ËÏeYæõÓoÝ"pC»…+™å“ÓÔÖ¸Ÿ¢X*¢×ëÈæò´67U=¹eE¦\.“Îd ¬Ñh4Ô××Ñ(IÌÎ/ÜðX®öäÜâc‡$!©T<òð)‚Á¡pI’H§3¤3™u˶·µ`2yçâåM·u³J¹ ‚µûÄZóÚG>uWZ¢ø—(ŠrÓ"@.—'ã©uc·Ù¶eŸS(YZZF£ÑÐÒܸ+ŸéêÞ*{ÁøÄôž ×âr:H$’ƒa<žÍ+.%IÂt“–Ž’Jâòèøu“9v“%€¹/ù|FC8åÒå1dYfdt¢ºÜ¢™Îö61mIcÂ^>¨åÒM‘"@ »ù¦@jâkü¿¿Wâs?r˜X¦´ie¾œpî›Á¹oŠÜY„P Øäryμ}ž‡<±éß-3ó ¾w…—£Éˆwq‰l6Gks&“qç§tEá…—^­úóßíÜÔVèjÆ'§+cn6¡Õjèï ™Lá_J§°ÛlW½q‚ÓaßÐTÐh¸ñùxò‰Gyñ¥ïÞ3"ÌàÙ÷¿—†úJÕÇ•ŒÞL&Ë7¾ýâ¡ Æí¢»³ƒ —FD3b`‡Qà® .ŽŒÒPWwÃ{Ãõh¨÷ÐPï!°$[­ÚàôõtU›û–üd2Y zŠRɤnkmfl|jÇ?ÏJ0D<¾JgçÞŽóùƒ~×úl—ö¶¼¾%ÒéÌuíêp$zýû JÅ3ï{’†úºû°¡ñΟþ¿üób@ B`ßËå9ýÖYN?¶Á ׿ØÐ0÷jÜ.'‘-^,o•»µáßf4ÔסÙF“MEÞ:x<37Ñ` ¾ÎCcC=ã“Ótv´_Mà°¿[i°Ufe[ksU´¨©q ¡`ØlVÞ÷Ô8v¢±—G&èëéÚ(Q…Ù¹ÍmŸ®4Bþþ¾Ÿ¹ù^ãÌŽçB ¸ßÈær¼ðÒ«|øÙ§ïŠf:“azzŽá¡þ{¨Ô¨‰ÅH@sSã¦v‚WSç©%°dd|•$a4°Ûm˜LFô[ÜCÒ™ ¾E?¥rµJ…,Ë8ì6òùmèt:bk¦w›yo¥Úq¿œsI’n(kµZjkj6XɲÌJ0D4¯^ím-Ì-x±Z-t´·’Jep9í[ß Š¢061…oÑF£fqÉ¿¥•ÕjÁn³ÑÕÑF2•¦¦Æ-D@ `B`_12:ßà‘‡N®Ë”.•Ëh4[¹Õj5áHµZ½cÁ{©»ykKó¶–“åòu_ìÇ'§Q«Õkþ÷YlV Z†T2½! tá|•$át:èîê`xhÕšþÌ켸ðo€J’xÏcW¯k—ÓÉcœÚtYI’øȇžáK—›\0ª«­Àh4ÐÐP¿+ÇšÍånzµZ}O}×÷/Á`˜—^}“½®õË~afnžC‡ˆÅWQ‡Ý¾¥8žÉdQ«UëÄËÒ™,ÝkÞü+Á0õuµD¢±j/›Q_ç©ÞïE!™J±ºš ‘L E°Ù¬èu:ŒF#v»•d2E.—§¿·ûºÛœ_ð"I*Rµnšw·—Q!_ }“j‰;ɵŸ7 ã[\¢¶ÆÁ`À`Ðc³Z˜ž£·ûÝcî›Ï³ ­[wÑ¿ŒN«#‰2;·@OW'õuµ·t\ù|žR¹Ì+ßýKþÀ¶×knjä‘ëXS @ ‚C‚}G,¾Ê×¾ñmÚZ›9~ô0N§ZC©TÚ2K½³£b±È윇ݶ#Õ{¤7@:a|r·Ë‰^ÿî8*²‚ýªJ€·‹H4†A¯Çh4 ZËÖ›˜¢·»­¶"$’)V‚!ÚÛ[ CÔÖV*>Bá.07ï]·ÿööVžzâÑu¿ËåóäóyqÑoAG{+V‹å¦¬9L&#Œ4«ÑÍŒ4³-éù}’º»ª«Þª©®zŸ÷}EQ°Ùlx}>T€sÜE’ÝJnvf³)±Î=EAwÅ ?N‹ÅlžU·!ó²ßEQ8|ôø‚×ï©)7/¾²—í·m¡ ?—xŸ&ý¢Ñ`œI8ÓÞáç.Ô_s '+3ƒ;vm_Ò NGr7Ôrö|ݲ¿§¦ªrÁôyòÐ)„B!Äõ%©‡DÂ3›Mh52ÒÓ¨¯Ÿ±\TOwO¹9Ù †YÁ½N‡Ã‘Œ¢( ÖO<gxd”–¶v^yõµ›¶=šæO1 GÈÏ›¿ a\Qðù¤¥¥¢Ñhp¹&ɺ¬¸tÖÒ \ *Dc1‡Fnùs;#=‡¸ç-ÀtNð'}«ee³‚Áçë†B!¦iµZPöî?˜ðÛšœœD8frʽfß9>áâ¿žû9?ùé¯Ø³wÿ¬ Õj¡¦º’`0Hss M-èt:6®¯¦¡©•†ÆZZÛ1/±ŽÁR”•3¸„ €Åb^0â[Íjµ0ætNö/  „B!zzûñz½ J–bz„ÿ{ÛƒËJó¸eórs²æ¬++3ƒÔÇÌl„Ëï€%§ŸB!„B\‡gXi‘è.Í Ðh4¤¤$ÏtJ_*À[\T@O_?“äæd¡V«g öööõ3<2ºhG¶Ûí¡½³› õDnÒX,N\QP/#Çokk;•e3òyy9L¹Ý3…+¯VËatÌI0Âh4Ó… coAÝD“ž–:oqé·JVf奜9waÅëtRB¼)3#Ý»¶sìÄi</6›5¡·×n·]sê¾åèï\ð÷ÃïP½®nºøpcS 'Naûm›©­^zÚŸñ F£aI×Z­VK$£©¹•òòÒY){.W\XÀÀàCÔ–a2ê8Þ¶eM-mô L·o<Çj±PX‡×çÃ\Ó5¾½³‹†¦j«+Ù¼qý’j¨U*¼ïnNŸ½€Éh¤¬´˜p8ŒÃ‘L4幟ýŠP0ÄÆ 58Ç'P¡"77›¼Ü¹!„B±F$P Þ¥|Á]ݽ$%ÙçŒ6(ÌÏ#®(tvuc4ÈÍÉF¥RQ[]E[{ç‚‚3çê8{îŠòæÞȦ¦Ü8’“f½] Î@{Gùy¹³:¬ Ý=Øm6º{ú®Ú±¬( £cN òs‰Çã´¶uʉ ¬s `ëæ ÿ6.Èâ¥\q]^ZÌÀÐ0ële ¹½}ýL¹½¤8’çŒú^MEEùœ:{~ÞÚ&ñxœÑ±qrs²ˆ+ -mLN¹©olÁëóQ^Z2ëó=½ýÄãq‚Á å¥\¨o$Én'99‰‰‰Iºº{/þ MºÅcD£1Ô*ii©ØmV4 ‘H˜X,ŽÛí™9~óÉÍÉ&;;‹¡¡a|þe% s<5 µÕë€éZ—2lVëLðe¥Ün§Ï^ ½³»ÍÊŽm[çÜW\I§ÓQ[½Ž‰ÉÉéàe:xÓÕÓ‡Ï秼´˜ÊŠ2¶$P]!„Bˆ[‰ DÂKº(ˆÆb‹>´«U*ÊJŠ‰ÅbôöP˜ŸÀäÔÔœe€†¦NŸ=K¶éÈèØœúP8„ÇëÅb6ÓÜÚŽZ¥B§×‘‘ž6ó0IÿÀŠ¢ð³_¾ÈÄÓ/¼ºï…ùŒŒŒJû™s°™Úêuèõº„Ú®­›7àtŽÓÛ? Iˆk`6›HIq019•°Û G¨(/Y47ÿêü¾ÛÙ¹}+o;9ïûGOœâíO¼†¦Æ'\8’“P«U¼qô$y¹9³~×}~?Õë*p»=44¶°q}ÍÌÀ‚G2ù¼92Ýï ×ëÐjµ(Š‚Û㡾±™õµÕ¨P±¡¶zIÛ¯V©fÍbLD&£q&°Ÿ–š‚¢(ŒŒŽ]·õOM¹™šr£ÕjyàÞ»ýìø„‹=¿ÙÏï'ÉnÇj5ÆŸpÐÖÑE{g7%Eìؾ5¡ÛU!„Bˆ›‘ D»ÔѲÔtýƒäåNçÚ…Bäæä084Biqá¬Ïµµßº£Úûç¶X,ôöõ£ÕêXWY¾`j¢X,ŽJu±sàâ¨Â¥P…îž^9¡/3?:1g³dffH @ˆkt©#[¥RQ^Zœ°ÛYZ\HsK«e&ȾÜnÁEÇ.×${÷b`p€¤$;Ý=}h4š9³bÑétvv» ë«—t_qéØ$ÙíTU–ÓØØL,ãìùzÖ׬[RÁfµZMGgçšÎÄX®ó¨¬(# 208ŒÏç¿îß1_:ÁKA Ç‹ßàä™s3éé¦Ün¦Üîy—éèêÁçðÄ£ÉED!„Bˆ5$‘ðLF`£Á°¤Ïk4ZÚ;ºP©bñ8Å…s>w­SïodƒC#D"‘9mPSµn í«&®(¤§¥Hk4<<Š~Gð.•Á —$Ä5:}öÅEhÈuŸ(Ôj5Uë*8_×°¦‚Á¡aÎœ«[ô3½}ý—ý{€x<Ž¢(ø¼þY#ÎŽä‹V–Ó^¯×S[S@}có’‚0]‡Âl6q¾®‹ÅL~^.±hŒ®î^,V3Eùoé± ƒLL¸8rôĪ~OþíxiÏkL¸\+û}eßþCäçå …¨­©ZVm%!„B!Ä ž ¥ D"3 äädÑÕÝKqQÁ’–ÉËͦ²¢”üÜ4 U•å3Et/‰D"3SÝoE¡Pˆ½ûq¡¾‘xHpIGWÕë*×ô;—[ÜùÒo¢(œ:{×;ë·_¯×Ï ,¬Äø„‹ÌŒôåí‡ÕÊÆõ5”ÑÞÑEÿàåå%Œ»ðx¼oéqœœZ“:Lii©³î^Ý÷úŠƒ—tv÷ðúá£?y†ÃGŽÍÌFB!„B¬™Q ZjJ *TW-w¥p$ÂÐð(¥%EsÞ‹+ /íÙG(tkwt÷ RYQÊȨµZEÉ"˜Ñ1'Š¢ÐÙ=Nmõ:zûú9²@Ni±<çë–[K—wÀ !V&#=í†ÙVµ tºÅo }~?êq{¼äçfSTX0+Ïr¥8’Q©T+êv»½ì}í »wmŸiçŒô4›Z¯©œÎq*+VVtZ¥RQS5lqŽOPX·ì`ÈõW”5«ÅôâË¿¡¤¤µZMWwïu¿Çjië  Q^ZBzz*V‹E.0B!„H;%[w±³¶ « ßh7uÇr²ËÍÒò0¨Ð&åQ»¡Š¢t êà8½-õ\èœ ,c%Ä’@Hhñxœx<¶ä—ÔÕ7’‘>ÿˆÀæ–6FǜҸÀÙsõ<óÔ£¨®2ßíö ÑhÈÊÌ  ³ÿõ#K®!¸jÛ*ŠrÕc°Öú†äàq ÃœÙl‰¬° Ÿº†&2ÒÓÉÊL'‹¡½l6„Ûíá×/ÿŸ:¿ý¥€qqQ»vܶ¢Â³&“‰¼Ülúú—½¬ÇëÅdNcllœää$ôSéegeàšœÄ‘œ¼¢vÈËËáB}•å¥×”‚--5…óuD"‘‹õh®¿X,¶èŒçØ8CãkrþDc1ZÛ:Võ;zzûééž1R^ZÂî]Ûné4’B!„H*ôY;ù½O€Ý—?Óo掟æoüÿýã Géí×$³ñéñáG+°]ñV¨ç ßûöO86Aâb-hÒ2²þRšA$ª¢‚|‘(y¹ÙKîH G"˜ŒFì6+]Ýètº™Î×ä¾!¹õ/ ƒ˜L&Ò/K0Ÿ”6«‹Å̾‡™pMJã]'±XŒÔÉËœ5ñùýhuZÔêë›I®£³›1ç¸ !V(5Å1§h|"S«Õdf¤£ ÐÝÓ‡Ó9ŽA¯Ç`0yáÅWg‚—›œœ¢¹µ`(„^¯ÇbY^À ëbáôP(¼ìmCl¨­&9É>óšÉd¤«»‹Ù²¢Nd½NGfF:­íXÌæwDƒ!&§¦HOM¥¥­cÙ錮W††Gèí`l|¯×‡×ëc`pV‹N¯›ó; ‡hjn»)ÿ¾&\.zúÈËÉÆ°@ «3ç.Ü:]!ïýêØÑsˆ31´Yð?¿þ$¯e(f¢â™ÿÆŸ}úÝl÷žàpw`  jìÛ?ÅWŸörðä24D!®•!—{>ð1>ñáð¾'wSeŸ¤¹i´i›yç'>Á'?ôNžÜ]‰ÕÕFËŸø’®Ïrí~Kî¡­øà?Ì©*½Çùùó¿â×ûOÒ8#­,ŸÜ¢Mlsôpäüèü3Tv¶~è ü÷ûrÑ Ÿå×Ïÿ”Ÿüê78ÝŽS—Kmu5Ûvâ:y†n\\¬:™Q š?˜¾v.c´õøø™™¨U*ª*ËsŽ34<‚F£aÏÞý·|Ê¡+5·´Q½®âê?€j5¯½~øšó?‹¹zzû)*¼zú¡Ñ1'Sn7Nç=½ý3é,3ù¹9T¯« 55åš·GQzä8 qM®€MT6«•ò2 ç.ÔcµY CìۯϷà2‘H„ºú&êê›()*äþ{ï\ò÷õöpÇ®ô ÒÔÒF$Yò²±XŒ={÷óð÷̵_½®’–¶²³2±¯ õÏ™óu˜ŒÆkjÇÖö6ÔV3<2JVf~• ŒFã²g 011III!9ÙYsÞwMNÑß?ˆß %%™¬Ì ÂáÈMý7ærMòó^âÞ»vS°†E¸oñ©:žÿ^z"€&… Û úÎø»ÓÞ« TØŠ·²û¶M쾿{Ã>iL!„¸žÔ)ÜõÉ?æÁ_ñÍ¿ø6Iëùíuó•ÃfžþÌ°³û‡|õOš æ>ó±Oùò—y¾7¶ÈõY®Ýo…¾‹;’ Ôð#¾ô̓ _ºýj¼ÀñÓ|úKïaýîwñؾf~Üså½™Û†ßá÷w%jü1õ׸8ó@eˆSöH*c øÐê¾~„q‰ˆU&3 DBËHO£¨0EQ–<ªobbrVM‹ÙL_ßçë™r{¤Q¯ž–FÙ<µ.çv{. ¤ÁVé<_¬“Ãíöðê¾×9}ö<Ý=}ŒŽ9 ‡ß}‰DpŽOÐÜÚNIqF£¸¢084ŒÝf[Ö¶(ŠÂ¾‡$=—¸qŸ¿Ôê„(zº¡¶‡#ù†lÃήFFÆhnmãȱ“˪Yâšœ¢¢¬dÉi{ÒÓR±Û¬äåfSR\Äèè~`ÉßÇiïì&“™‘>3ª>-5…¶öN’’lËN_˜œœD(¾¦`Çë%Åá@oÐãw¡R©…ÃLLL24<ÊèØã®IÆœãŒ3åvÆÐëu3é„âŠB{g6›Â‚öþwðø]µdEúi0pßgþˆ§ lnßIÑèIN6óñOïfp ÿ,ï,2“¹ieSLÞÿçüÕ®œ#¨í·ñ§ÿðIŠšR7©"}ón6ghÀšCªç$¯œQ©Bq½h³ïå£Oéùùÿþ1g'Bø]ýœ?zœ†aá̇øý~úç¸0dª¿ _í㦦Ü×Ô^ïô ½NGÉ Öƒ!Æœø¢Ñ(zŽÂ‚ü™ú K‘“IÎÅs¯¯ÿÖîÇãqöì}{îÜMIq!‘HµZsãîe=ïØÕÂÿùêçNÞÌûþøwùÀöãüõ¹2>òéÇ0¼òÿøÜßö¡*}€?üÃOò‰¿äÛÿø Ò¾òqLßýK¾ÛB“qq]± ^ÿÆ?’þå?"ûÁ7ƒFˆ}âvŠL4ÔØ«ï¢Ìs‚÷OrØÿ,ÿ†žÒ÷WQ‘ŒBˆëw‡ˆ1§’Ô ›ì§ÿ„ØQJJ|ŒÆ×Æ÷~~cU!6w½¾‹÷¦Š—Þv7ö’t ªžE®ÏQ¹v¿U´Iä&Á>:]ó…fbLtö ‹¤œ$´À¬d›†L6äýǸ01PòxøSÊ»« ¸Žý+_þÞI‚55¼{s-5y&~Ñï‘ZbuOki‘È?y98Ç'H[F:‹ÅÌò òòr°[­L¹=ôôöIƒ.Ô™áóñ“Ÿ¿@NV&m]Äã¡^K±Xœ—óÛ¶lB¯×q¡¾‰¡¡aâ+켜ž}p€¡áQtZ-¡PhÁüÍó©ol^•ýLq$Km ±jª*ËÙºyãÌÿívO>ú0®ÉÉé¢Â#  À¬½Á`¯Ï‡kr’Á¡&&\L¸&g®ƒÓyûÓÐëõ$Ùí´µwNw^k4šëÝl¨­¾æÔ5˺Ž{}ìÝ1ç8¥%EäçåP—‡V«edt”ÌŒôE‹Þ Œ²wÿÁ%wÎ/¦»§¢‚ü-«ÑhØ´¡†’âžÿù ÄbKÿMêíëç—¿~Ç‹Íf¥z]%Å…ŒŽ:f]eÙU—÷zý ‚Òâ¢kjƒüÜúúÉÏËYò2F£a¦“ÿZb±8Îñ‰[ê·ôµ×ÏüÍ'Ùí7n7’ââè/^§ÃïyŽ´x²™ÔMPíÙÇ_¼ÒÌX¨{™ÞÅç^‡¥ilÉëõåBü#ÜYl¤¡ÉHí=…Lþƒ„B¬2ƒÕ„>¹‚Máï>ûM|)·ñ¾Ïüÿ=øU¾áÖAØKè²[Ÿ°/z3ziºÄâ†$’ jf¼é§ ÉI€7Äœ'•ƒˆ3`< †Hˆ( 3èP Ī’@HXÅEèt:&&\T”—.k¹)·‡“§ÏJ#.‘Çã¥Å㕆x‹¸Ýö8tÝÖ708 @k{'V«•Ík—Tìx|ÂÅààЪìc4åŽÛwpøãrÀÅ5Óh4d¤§PZRDé<éÓT*)Ç¢ë1 ÒRS(/-™¾ßÇ™r{P”8ÉII³þv¶Ý¶§s @a~—®ž^ú†ÐhÔdgfŠ„)ÌÏ›3³m5(ŠB]C§Ï^ ÅÔÑÙMGg7j• VK$!3#‚<6®¯™w=Ýì?xäºÍ®hkï¤z]ÅÌ1Z »ÍFuU%uõMKV‹ÇgfZ,fú9qú,;·mÅ`ÔGÐëç?99…sÜEŠ#›ÍÊàð0eóß{\š…·˜ÔÔÔ“S\¨oœ3kl5ŒŽñë—^]q°ùF¦( gÎÕáp$s÷»n܉ºº,­ÀôߥKªe²Ÿ7,FqõM¢ªJÁ¬Yz €`/‡êâ|bW–‘Lî+ãÀ¿IŠ !„X}*bÑ8Jà4?úåYƒ€ç(Ï¿|_½kŽ—# ·`PÃ¥e½E7Ó‰,PdSmQvm(çñ»²9ýëÙÇJ—Í=–£&Fç¹!æÄä£.z]P›¹Žû0Åþ“9AÐ’Vž‘ ã>dX§Xm( «¤¨P(„N¯[ö²åeÅœ=_7Óq"Ä­ê̹ ètÚ%uTu÷ô®Zç’Û㥫»‡¤$;n·GRY‰KKMáÎÝ;—5Ól9Ôjõ¬:7³ÞS©fu~Ûí66®¯™Óïõúèéí[R‘ò•ŠF£¼ðÒ« Ž+ ñ‹…GFÇsÒÓÛOqQe%gŒ14ý—»°ØÕW @¼‰w<˜Þ£ì–‘X}ji‘ˆ22ÒÈÍÉÂï{•ñùŒ»$H ÄE]W Äãq|>?Ã#c«ºƒC#ì¸m ééÓB—2ËAˆ+m¨­^µ Áõ¢( “Sêš#¹þ9=N9¿¬Ô2Š¢02:Ʊ§ùþ~¿ÿðY^|e/gÎÕ¾†íÓëçŸ ‰Æ®­óÑjµ’âXѲ`ÏÅ™rqEáB}#½}ýœ:snÎõ¯¡±…ì¬Ù)l6+5Õ•x¼>›™œr£( .×$åå¥$'%qþBÃU;åãdf¤¯Éyçšœ" ÉEââq½¹(¸Îí£)éÞÿp©f3ëßÆûïÔsöÕF¼  Ò`0,íw5Øs” êÛxßÛséÝ— OBˆ5ê>Ä1ÿzÞ÷[Û)H²Zy/ï}$™öýçê}ƒ#ãÅ<ýD-©éã©’ Ž ,Üûÿø½³Lb¡æ©OòõþßûηøöW?ÉÛ«-Ó2oåÝOTb›3Ù8Jß«ÏqØ »œûøÖO] ¨0îæ÷?ûl5…¨ûÉ 4$b$VŸÌ( Éh0¢V«±Û팎9ÉÎÊXòƒaWw/ÇNž–Fâ¢ÑQ'/¼¸‡¢‚|rs³ñûý´µwq×;çõCoàóûW¿›CQ0™Œ<þÈC Œàv{8|ô„ ±,çëp8’®šVè­d³YÙ´az–Ïïg`pPa³ZÐétØí¶YŸïíëÇd2-«qcsë5mãõêH]WQÆ…úÆY¯©T*ÚÚ;q»=<ñèC×”‚©¨ ŸñæÚW«Õ˜Í&üþñxœ ×$^¯p8ÊÎí[1ô(ŠBjj ‹yÞud¤§‘‘žFÿÀõMlÞ¸­FƒÖl¢¦fuuÔÖ¬›“ŠÈégdtŒ¬Ì ’˜¡r½­F@J$ŽøäI¾ýd~÷=æoŸ±ŸìáÄO¾É.x‰+jšš<|ì3_ã³ßùsþ¡ó*+ öp¸>ÈÛúx­Î-i „b­„:yöoÿåCÏðù¿ÿßg^úgþå “X~ñÿŠá~‡¿ùçTã¼þíâ½22±E=ü/|¡w;=q·¯/Ä¡SðOôÓ||?¯uçò®ÞOÞCŸæsÊ?ñµç›ñ\öÃ÷Ôóý¿û1–?}›Óîç ßÜÉèÀS¹© DË/¿Éÿ}cB~¯ÅšPUÖl’”H8³™÷¼óZZ;(--šU|òJ=½Ó##Ñ(^¯ORšqµ ¿J…¢(XÌfÁàš¼,.*àÞ»v£Ñhèèìæ|]ã.9 bÙ òsyèþ{V½ÀõˆDcƒAÆœN@…Z­F¥R¡R©ÈÎÊ`hx”XÝ=}X-Š ß,à\ßØLmõº5=¿ö|ãbPJˆ«ÑQüοⳙÏñ§ß<7=#A!„«@µêi>÷G‘¯ŽÑúÿäkûÇæ6V³ÙòàCÜw[E™VÔ'½Mg9¸g/oôHm±vdFHHù¹¨T,$…BL¸&¥Ñ„X¢KÁ´µ˜Ep¹þ!:ºz(/-æì…z\òw+VhÌ9Îá7Žsçî7Ì6›L&L€Ýf]0w¿Ý6=ÓàÄ©³Ø.~.uÔ;Ù™ttõ¬ù~èõzvlÛBaA&£‘ÑQç¬@Á•Á‹1ç8{~³Ÿ'dÑÀÇB,3;¶máèñS×u?ûö¢)»â¢¹µ$b±8'Nž¡° Ÿ)‡µ5ón¿Õb¡¶zu ³‹.«Ujb±8Íê§X G"¼´ç5&\xW§ÒYHÎÚÄÓ»õœÿv > !„«(Ž·é|íï¢|êC[pù¢Ì÷Óqê…ÿàÔ Òbâ­¥IËÈúKi‘hjkªHMqàIº"EL›[Q©Tt÷5•Iy IDATô3>1!&Ä2d¤§¡ÓiÑéu¤¦$ãõúVí»’“ìX­v›@ @sK›±bÑh”xÑ` 3#}Þþ±1'þ€ŸÚêu¤8’gÍ®˜u~êudd¤ÑÑÙEŠ#yVÀçZ ÐÝÓ‡×磴¤ˆÔõÍŒO¸ðzýƒÁ5+rm2©©ªdãúòósɺ8óÅáH&ÉnÑœDŠÃÁm[6›“Mo_¿\¸„B!„H`RÌX$ÞI©Õ‹ÇÈHO¥©¥ü¼Ü9Ÿ]³a!nV]ݽtu÷^÷õ:Élߺ‰‚ü<ÜnûZvG¢WSVZ<Hv8’é阥´´u`6Ø´¾f¦CûB}#y¹Ù7žŽ9ÙðÈ[2£ndt ¿ßÕbÀ½ÂàÀà0{_{‡¸wÙÁµZMey•åesÞ««oâØÉÓ+Þ?EQhln¥½³‹'}ˆÇìbÒáH„Š²Ò%­K¥RQ^^Jk{'U•å×Ôîã.†GÆ°˜M¬¯­šõÞÆõ53ÿžœœdÌ9¾jÇ?Å‘LQa9ÙYdf¤-99{Þ²ªõp„B!„×F"ádgeòà}wMŸ íœøÖöNÚÚ;¤¡„H@i©)<úð z`zijs\ꈈ믹¥œì¬™óîò‘ÝGò¼çf}c39Y™¤¤8nÈ}žpMrêÌ9zzߺ‘ÙñxœS§ÏqÏ]»ñùý×æåW_ãáî¹.éyNŸ=Ï™su×e?Ãá¡PxÎ=H’ÝŽÙlZú¶FsÕŠ¢,š†)3:æ$-ÕÁè¨sÑÏoÚPKgwáðõ­]a0è¹çÎÛ)ÈÏ[Ñò&£‘gž|”æ–vÆ].r²³Cœ<}V.fB!„B$ ˆ„“™‘6óoföHµúÆfŽ8-$D‚º}継 Çë]µ"ÉBÄâËK/““…ÕjajÊ}à b±¯>JgWOBäŸï¢©¥ ÇK4½¦u ðÒ«û¸móFr²³–]·àr×s¦avV&ÙY™³^Ÿp‘––²ìuéõú™ã¨V«ñú| ‰DÐj4Ä…´”ÒÓSç]^­V‹EÉÌHG«ÕâöxæMË`³Yyèþ{xýðÑë’îM«ÑP]UɆõÕóÖŒZƒÁ0]Øþ"EQhikÇíöÈM!„Bˆ 5 DB1ôÔT­Ãn³àñxq$'ͼïöxéííGÊô ‘˜ZÚ:èdrrŠÃo'‰H£ˆUŽDØP[½¤Ï^êŒÅâäçÞ0û‰DãБcôö $ÌvE£Qzû».ëóùü´ut12:†Ã‘ŒsbƒÞ@\Q–•–¨ ?—ŒôtÁÀ5w’§¥¦RZ\8ë5­VƒÛíÁjµ,y=u MÓ3/œD"QÜnjµšü¼2ÒÓHKM!=-•`0ÈàÐ0CãD£Q<^/CÃŒŒŽ1æ'5%µJEWOïtýíÂc}lV+5U•8’“ñû+®çTµ®‚ﻛ⢂E¿o¥T*©))ô b0èYWY†Ïë—ß !„B!Þ"ªÊšMÒç*Êúš*vnßÊÐð©©)è¯HG0:æäÕ}¯H!„¸•=ùØÃdf¤_õsuMT–•ÎŒìNTŠ¢04†-›6ÐÝÓ»j9ñ55?p/¹9˯-1>ᢹµÎ®n‚Áв—ÏÍÉâч˜s|›[©©ªœw™P(LÿÀ ‘HƒÁ@0"#=ÔeÎ`ñûhuÚ9÷?ç.Ô³iCí²÷e`pˆú†f òðùýLNº™r»ÑjµØlV"‘ƒC#³:èóórxäÁûÖä\ŠÅb(Š‚V«%‰pàà Œ …nêë—Ïã–‹¸B!D‚³Øì·ÔþJê!‘PÉIìܾuúÊïŸ3í¦GƒAi,!„¸Åy}~2¯ò™æÖvJ‹Š>H0æçÕ}®kúœÕb·Ûxò±‡1ÔTU𓟽€Ïï¿îß‹ÅÙð¿óÌSèõË«ašâ`÷ÎmìÚ¾•Þ¾N=Ë5¹äåuº¹ç‹J¥"7;‹ññ RSg§ ŠD"´´µÏÌr‰+ ê%¦Q ‚¦‹ÌÛ,RRæÖÙP«çŸ]áöxéèì"‰âšœ¢¿«ÕJVf:ééi S\T@EùÂE˜ãñøLÀG¯Ó‘|ÙlÎÕvù¬Nǃ÷ߢ(x¼^<-míôö Ì d8’“ÈÌÌ 5ÅAjŠƒ©)7­í Œ¡( jµšx<žÐG)iirB!„HpWÖ-»ÙI @$”ôôé‡&ŸßŠ¹Ø-mí<|LJÌ¡R©ØP[MWO¯ä;â¡_BÜä$û5å½_ cÎq~ýòo®9ßÿj*,ÈÃãñ’—›Ã¦ µ3µHt:¥%E\¨o\•ï ‚~ã%ÅEäåå ]F*"˜Îï_T˜O~^.GŽ§µ½sI³4 t”'''ÑÕÝKGW/V‹i¦SZ§ÓQ[Sõæ÷.áœS…3ç.pæ\ÝL1îKÅßu:éi$Ùm”—– ‡ÈÎʘwGŽž `pÖën·ÇCk{'0=« ‰•‰Íj™8S«ÕKš³–¿év› »ÍFnNŠ¢09åÆçóa³YçÔhÈÌH§¢¼EQ‚hµZþã?Ÿ•‹¤B!„Ë ‘P.¥´¤hÖ{Á`ˆº†fi$±`§B,[òN!Äÿ7Ÿœ|õi ©)Æœã˜LY »/ƒ³Ù”ÐAÎûï¹sÁz[6­§±¹uÕ]=ttõPZRDmõ:4jõœýW£Ñ¨¹ëŽ]¬¯©â|}#Ý‹Ž8¯¬Xxô}qQñxœ¢ÂüeÕP¸äü…êšÐjµx¼^4 [·ldÏoöϺb`pˆæ–6vß¾ƒœì,‘h»ÍF0â؉Ós‚ó‰F£Ô76Ó?0ˆÕj¥¸°€Üœ¬êïÝ‘œ´`çòÏ™Í&¹@ !„B±( åR>f“ÉÄàÐ09ÙÓ±Á`ˆçþI9$Ç©o”@’·Šü¼\lVë’® ‰¬¡©…7ŽLøö~ýðQî»ûŽyßÓétäçåÐÕÝ»ªÛÐÑÙMGg7jµšw<ý8ÉIW)ŠBOoIIÓÌG2÷Üy;%E…ìÛh,6ïr“‹ž_ápX<0=:æäÄ©³Üµ{'v»mæõâ¢Nž9‡rñž&‹±ÿÀá9Ë«T*E!®(:rŒCG¦gT:’“ÈÉÉ¢µ­sV:­F3ïþlߺ™êª t:\8„B!„ RKˆD29åÆç÷““yñ!ü͇åàUŠÚ™Í&RS”IC !ÄMn¾4,ó‰Æb¨Õ‰y»ãñz9yúÜ ÑÞÝŒO¸æoãh§sbͶ%ÓÓÓ·¤Ï:rŒß¼v={÷Ó?0HøbÇzA~.O>þ‹yÞåÆ'ÞŸ†¦ŠŠòÑh?¯Ú;º¡»·oV¾?Àh0Ì t„/ëð¿Äbž½mŽä$î¾c&“‰@ ȆÚj¶mÝ4“Z«¢¢ŒÜœl òó(*Ì'3#œì,††‰D¢rÑB!„B,Jfˆ„ GÀ9Ù™4µ´¡ÕhP…ää¤E –¤…â&·”|ê±XŒÖ¶Ö_,0›Hb±{_;8kDx¢ëèê&5Å1ïë¯wM·Åíñ‰D%ßÛ?@K[——_}múæW«å±G #=‡ï¿‡Ÿýê¥9Ë:Ç'C†Y¯ÇãqÌ&&£ñªÛx)°rüäêš)).Äãñ¢Ñ¨ †B„#ágx}>,f3 ~€õµÕôôöóà}wÏ*î¼®¢œp$ŒÕj•ô{B!„Bˆ“"¡(ŠÂ¯^ÜCcs+z½žªÊr&\“‚Á«£¬ol¦¾±™Ž®iH!„¸É]>ël1fÙpW[<gïþƒ3…k¯£Ñ@NvÖ¬äëíÊî—¤¥¦®y6·¶óÜÏ~Å©3çihl!vEg»¢(œ8yfÞe£Ñ('N )9iÞ:=½ý<ûÓ_PWß4óZÿÀ õÍäåf/iC—Í„ôùýŒO¸ahd”뫉Åâ  fö…`pz=Í-mÜ}×ísŽ±ÑhÀn³I@!„BqM$P N$Ååšäìù:FÇœ„B!6®¯¡¢´$aÓG!„X;v»mIµZ“pÛòô9zûV¼|FF峋íÆbqL&#›7®_µí‡Ãó¾®z‹:¨ýþgÏ×ñÆñ“sê< ŒâšœZpÙ¡áÎ]¨§¹¥mNáÍýpìäi†GFQ·ÛÆÚê%çú¿ëŽ]³î[‡†Q«ÔøýÎ]h˜ÿܶYÙ~Û晢½~€x]=ܾsûLÝ€É)÷U—¹Z}‹ÙLiIÍ­Ó醘Q±Œô4vlÛÂÑã§f^ \,`¼·gþº&£1áfÆ!„Bˆ‹46Š6ï`{ué¾±NçL‡Ø’V BkÏ¥º¶’Ât êÀ}m Ôu»ˆ(Ò¼bíH @$¤¸¢púìRjª*(,ÈÇd4âtŽ³±¶šÑ1çLÞa!„·“ÉDYYÉ¢Ÿ©kh¦¨0VKaA^Âl»¢(9v‚¸¢¬`¿áº¡ ? !„¸~Ôj5÷Ý}ÅE‹~.ÓÕÝ˺Š²„ÚþP8Ì÷ÿó¹•ß´©TØlVžxÛCMF^yõ5‡Ölûßþ䣤¥¦ÌyýÄ鳜_ •ÎZ²ÛmüÎ3OΚmÙ·ÿCÃ#+>çâñø¼ë^ª@ ÀK{^cÂåZñ¾Y,fT*^¯€Û¶²¾¶J. ‹øÎ÷~˜ÐÛg0è×溙v7_üâö|ñsÜ»ÈcŸ®€w~é#ÿýËüGGmæƒ|éóUüìóßà\@Î'!„¸NWªþàoøÌ–Ù¿­ßùüÝÙ©›ç}Oí¤*ÃŒ*à¤éÈ/ùÁ¯Î3½ìÚîøøÿ౑ÿË—žëÃ|ûgøúû ç¹ñ<Ë?~î{4…¤ÕWõwÖZËï~ñ#ì²C¤ï$/î?K×$$mâ·m'_SǾÍ_ý°o|¾|;›?ð§üáŽ$â#çyeïQêzÝ(Ö,ªv¿'·¤£ 5òƒ¿ù.‡œQið·â.¾¥öWfˆB,cxdTB!na•å¥W ôzPEyËòç/´]v›·ge©z.åÉÿ¯ç~†ÅbÁ³Æ)¢Ñ7NÜ/*X-\®©„h_·ÛÃÐð9ÙY3¯™ŒF¶lZÏ‹¯¬,PÇgÖ½wÿAî¸}&£qÉËŒŽqôø)*+J9~âôŠf“äædQTX€Á`േHKM‘ Xuqw=?ÿQ?}2>G!®µ™¬ …îç¾Îwê/Eaã„Ý!Ô)·ó‘íÄýÓïò¥3#¹™ßùèïòáѯð¿O\M®%ûÞò¾*ž‘éeݧ¿Ëç[u— 5Rþöñ˜û0=aiòÕ¥£àáßf—BMÏò•oaäÒírs=§ÎvññϽ“š¿Í#Zy¾÷ÊU5ÖÚgøÝI„šÂÿüÖa†.Îkk\$¸Ú¹ÜÑÕC_ÿ ¾AÿÅTS#£NIÅxRÙ6ðßÛEøµoógòþìŸßù[<^xñša©áé~ù÷ÎåÇt<Ê»·&£¾Úr„é9ÖH¬rE¦éÇ@[Õ”zNñFï{ÿÏ·Ø7îæÈ7ÿ†>í™ÕɯNÙÉG?~/¼þm>ÿÙ¯ðÿ^s÷G?È®ÆÊßâ#÷éxý[Í}þë<;Tɻ޷ Ç<—°ÅÖ£JÚʇ>ñ6lgÀ—þäs|ùG-ä¼ý£¼·Æ:ýÀj]ǃ¹ üË_|‘¿úq/ÅO~‚U´ðÝ¿øþ½FRï{’ÛRäÑV‘ØÔÆT²­òý_ùÚÿäk_ü¸§«”©Óüë÷©xïó¿þþoù_Ÿ}7å ßçßNM¡jsÏüÞ6ú~ücNºæ¿÷RKxú=•4üxÝ!‰¬:­ì$ 4@×ä|ø1\ݤlûÜ‘Úú j²Á“4\<¦*C.÷ìRà?øÚrüN¢¤Q•kD%­.Vû´–&B!Ä 5ÅA[{'ÑX ³Ù´èg}~?Ýl¨­N¨}°Û¬<óÔ£œ8y†Ž®ž9ï»Ý^|ù7+JQ³šE!‹qä艄>G|>?‘h­VË /í¹®A˜îÔ·Z-Ü}çíW=‡FF¨«oÂ嚤G£á¶-ñú| Í:¾‘h•J5oãKâñø¬: ݬ¯©B§ÓÉ…á&¢ø›øþW¾†wbŠ:’B‚16ÃÅne’ã/¦ËïŽv¾ƒw'Q_m¹‹B½Ç©ˆ]…F[ ÔÜY€ëè³ EÝ‹™;î¥dôe¾x¤‡É8L|žo×AL±qµ¤$+šž~Nüàoh2ÆæÉüØz4¤l¼užýüÍoZpF†WùÑÑüéXÿˆ ±ï• Œ…â¨êÏ2Í£õåÓ ¢Ðx–þp I5 9„‰KmI"æšÀÕø ?zÞ…¾`'ï|ï'ù”æküÃù >üÁjºòüàÈÝÅû?öÿÙ»ï(9®2áÿªŽÓÝ3=9眔s´%Y–s¶Álð²Dc–ŒYl`ÉË.˲þÀYØ`pÂrV°r–F“sΡsªïQi4Š#4ïsŽÏ‘»ªnUߪ®©ºï½ïý4Ÿ[ò3þs—)Ÿ¸›’²gøñ>9KG¿_'/»•éͯò£zÉ9t^„< y“»QﱃTLöŒ€×á=þ/”jÀd|n¼ ÜQp(H°Þ˜ü^€Þ$Ï}büI @!„…'žyžüÜlæÌšqÒuëê'\à¡!'c5`+ hÒ ìtee¦3Î,lV+íçXÇm·\?æº9Y™ädeâtºØ¹{/o¿û!Ë.[Ä¢ùs©­o ¹¥Ö¶öÃó œ´qAU1›M¸\nV­\vÒ@…¸tDM»Žûæf¥sÓÓ9€MÇ‘ôAA:†Ž\/Ú¡kçdÛâmâãýÿ<7Kg88Äš÷>äõ·Ö04Æ„Æ!iñ:#ñq±ØlÖqÝGGg>ŸŸÁAš›[§`‚á¹3‚Áá<ÂG§¼²Z-,^8¥‹æ³wßÜnSJŠX8Î)ísùåKHNJDQ/˜À¦-Û©®©““~IQ°M»‡¯®2³ñ©_ñð£¿ä×z“½CcîmÇÝí°žÂvü4n<Å ˜6{!ÉíØÑ<Éqqöy0DÇ`94@AdêU׳$Ɉ9.sÇžþåøʃ?â»#¹î‹÷2+B=rt¸z\(öd쇻±é‰L±ƒc·Ü…—Kú,–ÌHàÈ€/ ¿×O0 ¨) Sj¤SPT4I3 °'_Á·ñ+~ÿ_?å#‘—ÿ|ô.òMÃëFM[AÑàÇlh“öçïåÄÁÞWߣ H¹þ«|ùšbâM  `Ž+æº/~•“×nÖì:~DA -ÛºÁ¶€/~÷ÜQ`:&HŠ}*7.çnÖ7JÚI1þdDB!.‡ÒõÌœ>eÌIŠcc¢r8·Ù&Äq{<^þþæÜn·œÄsýÚ­ª(ŠBZJ20ܘÿѺç|?V‹…ÈH;-ç X÷ñ&üþ‰ qx<^ŒF#Ý=½Ø¬úúúIOKeú´ýf IDATRâb‡'áÎÉÎ$##M[¶³æ½ÉÊÊ@¯ÓŽÝP[W߀Á '6&š¸ØæÏ…Ùd"&&ZNþ%÷ffD`ÈéCS-d,XÅ¢X3­&ݘ9‰ÕÓØÎÓ¸™ýÊ—¸óz¦çö2"͵¢b2ÛÀ cË:šW^Ëm‹šyak7Ö7ñ©«"yc[kñ-|ýº>žûí_ØÖ«>žP ¨a¤•;XήçåøéÝû·ÜÎ+ªxr] jÖ îZh`ÏŸÊqhSäÚB\Bõ9\ÿÙkÉzþ9þ±»-iw\Míë;©.sS{Í |rEÏnhCI]À'¯ˆ¤æï[ظ}»‡îÏ& ïû·öü‰ÿxµ–^ DRº$þmæ¤ñ_qNù›ßæwÏ&òÍ{¦Q|Ýxô:…@=úÏ©e·_½‘†—*ph#ÿƶ¼û76.ø< ÂUèþÇŸßq0H `I›Ï÷ßÉŒ0/ûŸy“ ·Œ'ãOŸøˆTƒB!.&ÑQQ¤§¥žpy¸ÍFcS3C‘vû?Þ[¶Ó~TŽy1’Éh$ ’œ”HD„mÌ ñqX-ã™7{&^¯—Ë–, 6&š¾¾~þþæ<Ϲ½…()*Àëóát¹ðû¨ŠBB|áráŒaÇ®=úøôzÝñ =M¸Ò–s÷Ý·põâRb»6ò~W—_]Šk_;isS©ÿpM^ Ð7ër¦8¶òÎÆ2'Ú®¬‹ô9‰Ô¼¿‰tâNYÂÒ¤z^z~-‡Ó÷„0$Ïàª[¯¥°s[ú“Yº$žò÷6ÓÚß̾F³®»»n½š…©ƒ¬_ý,kê\8ÛꈟÇM·ßÂMW]ÆŒØ>\½šš{æ4fL½·s{G'ë7n¡0?£ÑˆÛ妯€óf£¨ O=û&£‘¬Ìt*ªjPUõ”_Dt:é©L))">.V.¢Q<þijúøL&ãÚ³Ì[¿Ç×âÿÆ÷þwÏ1=…Bqn©Ø ®çë¬ U Rýücürm7Ç>ñ©¦D¦/_Áe³ Ɉ³¢zzh*ßÍú÷>`s£y‹¸p¼ÞÉ59¸¤B!Α̌t\.ƒžöŽNiGÝ=½' „4šÚz¦M™“WTV˵p¢W'UeJIƒ)¥E‡?Oˆãº«WŽ¹íÃÁÚõÃ)†>Z¿ñ¼¯¢(dgePW×@˜%Œ¼œì®›˜Ïm7]GgW7¯½¹†P(„¢(tuwsõ•+0 x}>Ê+«Q…¢‚<ö¨8éüªª …¨­kÀl6K @œúõ«·`OœÊu ìýcN !„ã,„£â5~õŸ¾ð©éô¹£NHò¶³ã­çØñ–Ô˜¸ÀïgRB!ĹÑÐØ„ÇãÅátIÃð8s¹\'\VYUMIQÁ„9Öžž^9a'zu …¨«o<£m÷¨Àç?¿“ºišÆÃ^¯Çétñáºq»ÇNsKbBüáíûykÍ{At:õðçûT ('ÎDhYbB<¥Å…X­aäfgÊE$N™1ó&úÖ Dìü/Wº‘8Bq^žxqT½Á/~Œ?në—ÑbB“B!Ä9¢iƒCCRçÙl>á²`0„N§»`Ç684Äæ­;èíí'¤…p:]rÂÆðÑúlÛ±›ˆˆpŠ óÈÎ̳Á†GÔÕ5^ãíìì>üï¶öþöÊëÜ|ã5Ç¥¸ …Büý·)ÌÏåò¥ ©ª®cëöô ㎾X­¼ïáIŽE!2ÒN__?­mí´¶µØFˆSá­^Í¿}UêA!„BŒNB!„¸è„‡ÛN¸Ì 7\°ãjljæ½Önä †{Å+g5Ñ—Ó5ÞLvV]ÝÇm …Ðëõáï¥i8®ã‡‚ÇÚµg æÎÆn›‚B!„âìÞíbã‘jB!ÄÅB¯Óqù’…ÀÈÙ0ܨÚØÔB}Cuõ ìÞ[FRb&“iÜËåró÷7לUƒùÅtrs³™9} KÍÇãñ’™‘†¦i8γ*{`pˆå•x¼^âããÐ2:DUU<]Ý=¢>æÏ™…Íf=îó¨¨H**«éëÀç=M’¢(Ç Ð4 ƒÁ@(4öàôÁÁ!TTQZRxAGÑLD;ví™Ø¿!½œ/!„Bˆ‰.8‰:€Œ(B!Æ…Ñ`8ïùÓ' “ÉÄÿx—ÞÞ>T³ÙDB\,ññq(¯<œÖå—_{“ó柛=®ÇUV^yQ=H òr²¨¨ª9|Ü&“‰üÜlêOØàÉÊåK±GéÅ>î,t: mí‡?ŽŠÂíqŸ4ÿ±BšÆþ² ”W¡×ëIMNbÉ¢ùGF‹°ÿ@Å„¨KMŸßOMm=Ey‡?‹%)1aDŒöòqt° 6&š¨¨H\.-­í£n£ª*höH;éi)Ô×7 …ƒèõz óså…N!„BqZ”‚’é’ÜT!„—¼œ¬ ¦N)!6&úœ”èìêÆjµ yíÍ5'ì5>ž,–0ÒSSà˜¼þ>ŸÆÆæãÒ )ŠB\l ³fL%5%ŸßOk[;N§‹Ø˜hâãƒìص‡Ööâbb°Ù¬øý~ìädgžp@ Àó/¾(”RZ\ÀÛï~x8§þÙž¿å—/9üÿ/ÿýMº'ÈDÑQQ‘̘ZÊû­gÖŒiÌœ>MÓÐ4ªšZÖ®ß4öù1£ Fep,£Ñˆ¢€×ë;ü™ÕbaÕÊe l6ëIçz8¤¥µÁAÂÌfÂÂÌDÚí˜Íg? Çårc3£sN—‹;÷PXG\l ~¿ƒáø´a~¿Ÿú†&ü? ’—“9êz—úÆ&tªÊ‡ë>žÐ÷#“É(7e!„Bˆ îègíÉ@F!„bR0šL§$èdï¾2Ü—`0ˆÉdÂb £»»N‡Íf£·¯ÁÁ!EÁ`П— ÙlbÚ”b¢‡¿‡ª*$ÄÇ—‚é¡!¬Ý@Gg‰ ñL›RLrR"zý‘G@£Á@fzÚˆít:sfÍñ€\×Ð8f@¯×3­´„„„8âãb)¯¨5H ªêIÓꫦ®®ž^R’“3›&L ¯¯ÿpÃôŽ]{HIN䃵°GDPZ\xÂíEA¯×ã?jô‘¢(§(ƒƒATE!))‘AÂÃmÔÖ5°kÏ>ÂÃm”¢( ÙY„1øÆÍ[éëq~ òr˜>­›ÕzÚõáöxXÿñꉎŠbæô)dd¤¡* UÕµlØ´¿ßO dÙÒET×Öc2éëë'%% ƒAÛí¡½³ «ÅBVVzn8ðR] Š‚ª@HNáãq{ˆŠ´S—ƒ¢(>P „B!ÄD## „B1)¨ŠÂµW¯$1!þ¸e~¿Ÿ®î<^/oÚ†ûM”«Ó©X­VÌ&f³ ³É„ÍfÃj E!+#ýŒz"{½Þ3ž§Áç󳯬œÓJO¹‡: ÷&ñ•×&]/€ôÔ›[ÈÎÌ ¾¡‘¦õõ;VcæΞÁ´)%£.Ó4gþü×QÏ“N§##=•ÓJ‰ŽŠ:¥ãâµ·Öàrü …™ÍDEEÒÖÞ¦ièõz®½ê âãbÙ»ÿSJŠ€áÑ>Ÿ³ÉDX˜ùŒëëñ'žÐ׈Œ(B!„˜ødDB!Ä%(¤iÔÖ7(¨­k`ÝÇ›.HÚ CR’“˜6¥˜¤Ä„Ž8g3™³Þ G=ØËýT55·òÁGëñú|“òZ;$Î(H0Z£ÿÉÊÐ4ˆp£‘žcF[TÕÔQR\8êÄÐí]'| ƒÔÖ5ÐÜÜÊ-7]K¸Í6æ1¸\nÞzçýã‚0<ÊÀ}pt‰Á`àšU+ˆ‹=|ì‡X-¬–Kÿéíî–›²B!Äg ˜TßWB!„˜4¨$:*êpz·Ûú7_ ¢(äçRR”ʽµ/UQFL"|*ÖmØ4iƒÇÊÍͦ²ªæ´¶ÑÎ`ôAiq!sgÏàå¿¿yܲ¾¾~þöòkäç’ž–ÂàƒúúF›Z°XÂNZ¶Ïïç÷>âêU+ŽKa q¹ÝÔÔÖ³g_Ù)õº²Y-‡ƒ]Ý=ø|þÎQ /B!„Bœ(B!ĤÒ4ÖmØDYy%ù¹Ùì?Pï4hÛlV®\~1çhbåñvºÍÖ:½îœîÿTröOT§$8Sé©lÚ²}Ä\Gr°uû.¶nß5âóS èôôöñ×—^#;3£ÉHgg§‹¡!Çik_ÿí$ÄÇÑÞÑÉì™Óäæ$„B!Ä&!„BL:==½lìé%&&ú¼7B«ŠÂ¢s/š €ÑxzùÔ‹ óÙ´eû9Û¿¦i$'%Ž:1²öñ¦­' œ+^¯—Ug]ŽN§ÒÒÚNGG'ùy¹rò„B!„˜$P „BˆIEU-œGlL4‘öž^ýW‚Áà¸íÏfµRR\@aAUQ±Ù¬UùOsÔEiq!ªª²}ç¼^ï99 Œm¼ƒçRZJ 3§OÁ`œD醄B!„˜È$P „BˆI%))‘Âü#½˜§O-eûÎÝçþ!K¯gÞìäž x²4Š*ŠBIQ ñq£æÌŸ¬E!ÜfcÈáÀj±àp:ϸ,{DC¡PhB}GUU±Z-c¦$²Û#PE‚B!„BL (B!ĤR?2ÕÉŒi¥x½^ö••Ÿ³}èt:®]uññ±—D…Î05Stt:n\Gl\LR’“¸rÅåèt*]Ý=¬]¿‰ÁÁAââb1èõô œrΧÓyAçmÐéT‚Á#A »=‚äć'ý±¯¬œâ¢|lV«\B!„BL(B!Ĥa2™ÈLOñ™¢(,˜7›ø¸X¶ïÚÃÀÀàáÏ££"1›Í¸Ün'‘ö¦N)æõF4’-3#…ófcµZ.™z ·á÷û1œfpUQHJL ¹¥U.> ¯¯Ÿ=ûö …ˆ´ÛYºx>ÑQ‘ètÓ?ƒ!r ×ëXÿñf'«¯×‡ßï?\Và_TEáÎ;nÁïàóù0›MجVÞ|û=ZZÛNº}0¤§§OB!„BL (B!Ĥ‘›“y¸QöX9Ù™ädgâp8qº\DGEž°a\U::»Q‡Ã‰ËíÆjµŸ›MJrÒ%Wo‡½þô{ûúen£8].¶í™æJ¯Ó‘žžÊ²¥‹ÐéT¢¢"‰ŠŠÄçó““EB|ƒž×ßzç‚»ªª$'%2µ´˜Æ¦fªkꈊ´ÓÕÝCrR"]]=§5r$""\.!„B!& !„bÒ(ÈË=é:6›õ¤“ gf¤“™‘€¦iìÞ»ŸìÌŒK¶ñS§ª(ŠrZÛhšÆÆÍÛ&\ý‰& R[×€ßï' áñxq:xOséqiÐëY¹|)z½ž”äÄß'ÄÇQS×Àö»O+P`6›ää !„âyXŽ {Öæ—foSpvÖ³wóF¶Ö rjOG z{*¥S‹ÈŒ³¢zzh¬ØÇžÚ^|šT¯8ÏüRB!„˜ âãb‰‰Ž:çå*ŠÂô©¥Ô74âóû‰‰¾¤ê- b4O{»}ûË&PåŒç9˜,šš'vz&ŸÏÇ–í;™=s:Fƒ¿ßOgW7Í-mì++?í€PWwé©)ƒÁŽòB!„˜ØŒ‰ó¹ïÁO³(þèN53X¼ò&nýø)~ùôfÚýc<ë"™vÓgùÜ5ùÛåÈÛ°–'þðW6uø‘'iq>H @!„“ÂœYÓǵ|{Dþ@à’ª3MÓØWVNIqáimWQUÍ–m;ÿ¿ . ûË*8P^…A¯Çf³ÒÓÛwÆe•WT14äd``€…óçHåNbjìrþýG³yã›?g£CîBˆK™™’/üßš3rT]ùÿ|Ÿl÷;ëFî»u% wû×¾Ä/í¤ûèÇK] —=ø]nlÿ-ß^]O #kù'¹÷š™dE¹»9°þž|q©ñqÿf›Â½ßº—Evð5næïïl§¶¢²fråõóÉXxiN¾÷ä^†FëS¡D0ë3ñÕvBí;yíØÝ8@È–DÉÒë¸eöR¾ðp ¦G~χ]rBÅø“@B!.yéi©$'%Žë>¢¢"Ù œø¸ØK¢Î\.75uõæ£?Åß—7m¥¦®^.ºKT(Âëóáí=óÔH‰ ñ,œ7›ÍJ]}#MÍ-¤¥¦Hå !„¸´©’ võùý÷¡¿¬x<¨1‹ùÒç2øÂïùö¶H˜É]ÜÏ—:æÑzncÖ“rÅ?q_‰…ÁƒS@3oäÛSÙòûÇøe¥kæ|>ý•ûøçæj~¼¾I9ž d\óIÛÁ»5ÿ×ZÚý•íaóöZ|ø.¦,ú$×¾WÎó þc/§ÞÁý ìx˞燿ýˆ–ƒ#SˆÜ«ì(æ>ýÙyìýùzä„Šq&!„B\ÒEaîìçe_ÁÐ¥Ñ6 RY]Ãô©¥§¼ÏïçÕ×ßbpÈ!8¡°03W®¸ “i¸7eVf:{÷—“–:É+FÏ5<ÌâõÿÎ÷ßîD‹ZÌ÷q±þŒ}¦_X_þÙçÑ=ñªoþƹ[ïñïðÛ=®c†È’k¸ÿ®e”&@ûÎwyǹ€«]ó¿4aλ‚Oß½’™iûêÙúÆó¬þ¨gH!ü„ËN\æ÷ÞqÇÆ”<—O|êzæÇbrµ°ã/ð䛕 É`!ÄÅNEz„“úúv:»FÜÕ ·/„ßçÇïóß?Àå ¹?f]ËWzÙÜàÐXÏPßvžþíT”wàÕ…¡sºpú}ø\Òû|Ü’Y8/èàï«?>$8Èß¾ç^_ÎOoMdþÂd^jh`ÄYW"™uÝl¬¡Zž|ríQA‚TV}å›ÜYl¢oó ¼n¼‘O͸Š¥É›y¹YΫ_ªTB!.e¥Å…DEÚÏÏûß%’k}ϾL)):­m:;»$H N*91áp`ÈáÀh0œ³ò{zzÙ½·ì⫘`/{vô73›pÌéSIFÃVPH¬Œ‰SÉÕÕ±©²ùÜ®Wë>þ1v |e ž·ÿ|õ‡ü¿òLn]‡P#çðÏ^‹}ÛŸøöÿÊ÷ž:@òí_áÓSlèÆX¦£Ìm&–îù׻ɩù <øu¾ù»-„]ý¸,F^\…=5,–”p3i×}Ÿýêüêßÿ…Ï®È%\…PÿVþðø~ ïû6¿þïßðëï}Š‚=âÿ¶ TK>w|n Ï<Ǧ¾#Óãú«ØUÖ7|>ßýß_óŸ?ø4y{žáÉ]M0îþvR쀧‰Ú¾ÑðƒôÖ6ãìÉöã{j›˜š4obOïðÙRL©¬zà``ÓùÑŸ>`ãºjÄQ’†"µ.Æû>%U „BˆKUvfÆyM Ó]VÑQ‘§=ÁlB|f³I.:1öo2+óð¿}>?Íäçœu¹.—›Ý{ËЀiSŠ/š йkCÉ3É4›HžšLÏûkhˆœB®MOtaÖæ-TºÎõzÇvÓד´p9M¯²z}#ý®j>ü+¯5k€JÔô+(z§ÿQN—ËIçÞ·xf}€™«ŠI;á²Rr¨Ì£)ØŠ¯b~h=O½º‡v‡‹îòwyú²)­#Bˆ‹œj$ÐÛC×þ×ùÝÏ~Éÿ¼ÑDÚm_ã_®HÀ·„/~®”Ú?ÿŒ¿ô þø/ÔNý,_¼,Áô»ïeʾ'Y½ghÔImC›øÑçàÁÇ^ aúý|íŠI!2ÞB=€ÑŽÝ4Ú;€Š)ÒŽ ð:¼]¬0¿G Š žØJO~/À`2H @Œ;¹o!„â’Éœ™ÓÉH?¿ùLB—Hê!×{ÚÛ –.ZÀ{®# KiIï¸N.H@Lt™i”¨Äf">>î¬ÊôûýT×Ön³^¤‚#|­Û9àÿ'f¦'Й«PõÜ6:ó3++žÐŒhÚ7W2‚Ð9^o$‰V<¸- :hï÷*Ö+Z3G:NèkêG)Š%.þDËâHL>Q™#T¬q‘£sùÖ¯ænÓt&èˆ LHÆ!ÄE,Ðú6?ùöÛG>h…?&LãG—ͦH?“üÞ5|çƒZúƒ@ÍGüùí%üxÅ, ÙÜ›¶™ÿ|¬ §fqß´$f’ªk§ºÅE(䧿v/oXÉó³°¾ÛÁ€ +?þV¶UX05ë–&±ýõ–‘©… I\~M*Ajwµá?î‚裱J IŽh'ësß8.HzbóÒ0㡽Ó)£Dĸ“@B!.ñq±”’•¢œÿ>7öˆÜafóE]^¯MÓN»3ÒSùÄm7ÒÝÝË®=ûØ´eFƒŸß/§ ¸¨àð¿ÝÅEùg\–¦iÔÔÕ iæç^ßû¹ÿá5³©ZǧçÏ!-¼…W›;(w³rþ ñ½lÙpRÊs½ÞA\½Ìù±„©UxC€j#!Ê-!œ=N”Y)Dêwâ<Ø€•f‡¡º»œ(ÓG[ÖKw·sÞhe³ï¾!¼-󃮡# `ŒL&ÉÔK› „5KÆ,æÆ6±qG;^ @Ãçõ „zTÚEU@3’<»ˆÈ”R¾ÿ_W¢¡Áúoü~úžÝ’Á=EïñÍG×Ñ«è0†ùý„dn—ñr°çå5´N½†Ô›¿Î×Ô'xrÍ~:=`Ž/áªO}†›S×NÞÚ;tüß\›6wqÍ5‹xð‘X#Ôc‚ FNçÖ•ñàØÈÚzŸÔ¹w(B!ÄEÍh4›EaA1ÑQöÁJiÌQ“•I[{ÉI‰§½­ÕbÁšn!*ÒŽÁhà@y%Ûwî‘ u’ ·ÙÈÍΠ®¡ñðÈ‚3ÑÖÞIwOùy9˜ŒÆK¨–<Ôon òK+‰®}–F·×îzŒÿzE]oó|wp|ÖS-dL)!v ŒõNZÖ¯¥õŠ›øäÂfVo fÞ-\›¢Ø¢o×{¸ýN>µª’Ç?hF—³’O-1²óûi¬‡·¶l7•í6ZWŒVæÈpì{‡]wÞǽW5ñÔÚFB 3¹õ ·÷Æx¬Ã-?$!ÄE,DÐÇMŸ¿ìgžæmhÉó¹ûêhª_ÙNå>7Õ7ÜÄ=WÖò五´Å|êª(ª^ú˜õ[ײÓx(„`¢èŸ¾Ë'ºÿG_ªaжœU«®ãŽE <¿£sî °óñJœ(w¾Æ7ùõI|÷33(¹ñ+üüF…@=:‘ew^¿žú¿”34âœhZóÖ/þ2‹#Tè~ß?»í`@Á’±»?ÿ)f…yÙûÄkpË ãOŸøˆTƒB!.6Š¢PR\ÀUW,#3#KXØ?¦ÁAlVËiç÷ŸhŒF5uõ$ÄÇqOm“É„A¯'6&š²ò*‚Á \´“جS‰ŠŠdï¾2\.79ƒ§ÃårSV^ÉÀà Ó§–Ž9yøŽ]gp*àÖ1õÊéhë_åÍò!ün…ÒU³0nù/ïî?œßøœ®§Oäê¯=È æ]¼»§¿£½­á,¼õ.>}ó"2†6ò®+—ìžõ¼³³‚Ý5!Š¯ºOò–)å<³¹¯»½'Xæ:q™ï7ÄrÙòdªÞù˜&Gû¸È[u;ŸºóF®šOÏGÏò‡5õHûˆâbì=Àö–\3Ÿ¼ý:–—Zixë þøA nW#»«ƒ®¾‡^Qj^ö~3N¯·Û}ð¿QsV0mà#^ÛoÖŪ IDATÚ…w¨ŽýQÌ^uw}ò.Ï×Söòyvs>¹ož!œ;X·« "¢‰‹Ä¢×põ6³÷ÃWyîÝnÒge“š;©¦¶èq^4_û÷9H]JRT6K®^Æ¢YsXvÍ­ÜyõLÒm^*^ý/þë½9Ÿâü¼c”L—KM!„ùsg1¥¤hB“¦i”•WRrTŠ•‹U ¤¦¶«%ŒÔ”ä³{1Ù·¿œÁ¡!šZZq:]rO"ªª2wÎL‚S§”ÐÖÖA\l4ÆS  iUÕX-VÒR“imk'&: “éÄ“g?þijRñgHSÌÜŒvíjžS@‰fù÷ÈekÀ?ì=£üÈãQ¦Bq<a+º‰oýJÒÔ •Ï>ÂO?è:nbcÕœÄÌ•W²|v™ 6Tw7v²öíwù¸Aæ&çñ9Pª@!„›¼Üì $€áQ—Bªt½NGA^Í-­8].¬Ë—¥Óé0ô,Y4ŸP(Äþ² vîÞ‹×ç;f=UÕῈæ4P…ø¸XÜn0<¿Ã±ßk²ËHOeJqá‘—aU!r*q‚¶öNzûú(ÈÏ=<‚ !>ŽÆ¦²2Ó¥rǃ9‹ëîŸNÂo~ëÕ^¢¦^Å5É|X>xæ ãQ¦B1á…px…Ÿþ"ÀŸIŸ3Àh½µCž6¶½öÛ^“øÝFF!„“[NV&))I”WTÑÙÕ=á7/'‹¥K¢NÐùþþ††ÈHK½d®‘²òJŠ óÏi^¯—æÖ6œN@Ä„8â i M´wvát:imë˜pƒÁ@JR":½Ž¼œlÒRŒ¸iuõTTVÓÑÑI@R.±êŠe¤§¥àv{ع{/sçÌ3uË妪¦ŽìÌtÂÃmÇ-ß³¯Œ©¥Å'Ü^FœÍ¢‘”EŸàŸnžMºÜ=5¬ýÛs¼¼£ÿD*S!„BœÛÇ@ !„Âl6ð&|£fQa>‹æÏ9ã¼ùçKo_?--m”–Nøc=ç"P°ÿ@9%E…§½](¢²º–7m!¼°} %EL))Âl6t}ŸßOeU 7o›´÷‹%Œ;︅€ßÑh¤ì@…yìÞ[ÆÔÒ¢ãæóÐ4ÊêÂÌfÒǶUTÕŸ›}Âß— „B!„8=’zH!„x<Þ‹â8K‹/Ž†÷è¨Húûp¹Ýg•²g¢ÈÊLgמ}æŸr^ù£išvÆüªªR˜ŸKjrM-­tuuÓÝÓKo_?švþú»$%ÆsÙâ…£ön?£Á@iq![·ï"LÊ{Kjr{÷ 1!nxn˜hTUejiMÍC!ÒR’1™L´wtÒÓÓ;œfH?ökJ   ×ë/‰`œB!„š „BqQP›õâhtƒ úK"Hf63mJ UÕu„‡[IJL8åm[Û:è ¨ ﬎Áf³RTw¸œžÞ>^yí-B¡ñe™žÆŠeKPUõŒ¶ÏHK¡¦®aRþn£££°GDGB|õ MÀð¼Y™øý~zzûpºÜÄÅF“˜pj£NR’“¨®©Çn%í,'ÛB!„BH @!„‰ä¤„“ö2>†sÐ7àóúÑÐÐ4mxc†{Ϋ:Mƒp›õ’ªEQÈÏ˦¯¯Ÿêš:rs²Æ\ßíñP]SGvfÉI çüxb¢£HJL ¥µm\¿wLtÔY –_¾„ysgáp8¢¶®Æ¦–Kþ7«ª*öˆ¢£#áy,–°ë âO»l“ÉHÿÀ!-Dµ§»=‚H{ƒAn–B!„Bœ !„bÂ3 ,^0oBKss+i©)'iƒdTT$]c®ÓÓÛG_?SJŠÆõX¬ça„É”’¢³ >V‹«ÅBB|y9Ùtvuãp8áÆòÁÁ!¶íØ…ÏéLíš–šLtt$›ÕJ 8«ºrÐÞщ×çÃf³²`ÞìÃËœNÝ8œÎI›æI!„Bˆ³!!„BLhŠ¢°ì²EDD„_ý{½^ ƒƒô n³MÚ Á!áø|~ŒÆ‘õ imíôõ÷SRT0îÇ‘—“EeU͸×ñK|\ì1×:lØ´õ’ùÝΘ6NGm] `±Zp¹Ü§\F0¤¥µ¡!ªN%6&šÜœ¬Qç$°Z-#G“yi!„B!΄ „B1¡¥§¥ž–zÁö_USGJrq±1$'%Ê âbcèìê&%9iÄçÕëj7+W\Æÿx—ÁqÙGCc39Y™ãþ]º{z1èõÜ|ý5 9DGG¡×é/w»=tu÷ÐÝÓKOo/Ýݽ8œÎ³ÞozZ*n·EQHMIbÖŒiôöõSY]CdD»÷îgpÈqZeªŠrx‹–Ö6’Ù_VÃéu4À!Ýô P˜Ÿ{Éÿ†œCƒr#B!„˜à¬á“êûJ @!„šý¥:ü°¤—ǥфB¡ã> Ïnx«ÅÂm7]G}C5u àt¹ñù|ç¤üÚº¦O-%:*r\¿Gk[;SK‹ 3·<,Ì|ptÍ‘ðL_ÿoÚJk[ûiíKQbc¢‰´ÛYºdê1÷ÑQ‘ÌŸ3‹¾¾~”ƒs èu:ÁàIËMKMÁl2’™@~nÁ`’âÊÊ+ÇÜ>>>o8 sIÿ~¢ccå&"„B1Áy½¾Iõ}åÍW!„šÁxaçЩ*í$&ÄËÉ8Š%,ŒP(4brZKX!M;®áy¼©ªJvVÙY#>w8œ´¶µÓÚÖNsKnç´ËÖ4¾¾þq(g0ÉoT¤kV­``p¯×Ëö{p:¸Ün|¾Ñ'E¶X¸|ÉÂãÒFZ~T$wÜr›·î =-•îžÊ+ªˆ‰‰&&:Šîî^¬V ªªn³’ž–ŠÅFÅQóF=ÂDÓB'Ýgzj*õ M¨ªJLt”üЄB!„8O$P „Bˆ MwTú•ó)P[ß@0Äh4ʉ8FB|Ý=½#&ä ·áv»±Z,âm6+ùy9äçå …hni£º¦ŽÚú4M;¥2TU=/A¢H{n‡0³ù´¶S…HûðèkV­8üùàÐåÕ”•Wâ÷ûÑétæç2kÆTL&ÓiícÞœ™$%Æ3¥¤è¤ë6Údphˆ¸SìEŸ™‘F]}#½þ‚Mb.„B!Äd#!„BLXFƒá‚¤þéèì¢`üÜì1sªOfKMÍ-#]ÝäMÈãUUõpêž©=Å”WVS^QuÒ€ÁŒi¥X­ãøHNL ©¹•ÌŒ´sR^Dx8sgÏ`Ji]]=ÄÇÅb6›ÎK]§&'ÑÓÛ7bD@cc3¥§d8$+3UŒ†Óž!„B!ÎàIª@!„U  ªºæ¼ìËívS^QEeU á6y9$8 ¿ÿHz›ŽÎ.âã.Š:‹‰fñ‚¹,¿|ñ˜#Vrs²˜1mÊy9¦žÞ>¢¢Îý¤Ùaæá¹ ÎW ""œöŽÎÃÿ¯iêŒ **È£¢²Ÿß/?6!„B!Æ™ „B1a…47n÷I¤zzûèí맰 ü¼œyÕʼn™öôîíëgpÈqÑå”ÏÎÌà†kWnù€¬ªæsÙâç-ðÑÔÜŠ="â’¹6”ã5z{ûFLÂ|ªúQ…P0$?6!„B!Æ™¤B!Ä„ ˜ŸyB¡Ð„N™3¡$ zvìÚKzZ y9Yåwˆ‰æö[n º¦Žîž^Ìf3ù¹ÙØlÖóv mmç,åÐD‘™‘Fk[;)ÉIø§7×€ß麟«›iSJä‡&„B!Äùx¿“*B!ÄDf±„Ûä¸Á`ˆ}eåL))”Š>Mn¿?ÀÌéS.úêáI/ŸßOtLÔ%÷»­©k %9 ‡ÃIB|Üim_USKa¾ï„B!„8_$P „Bˆ múÔÒsV–¦i¸Ünúúúr81èõL--’¹Î@˜ÙŒßï' ¡ª’Íòl¤¤$QßÐHnöÄ•±¯¬‹%ŒìÌŒSZßb # áõzOúëè좧·P(„Éd"%)I®+!„B\tádΘÇÜât⬠ήöoÝÌŽ†!‚§T€‚>"…âÒ2⬨î^šªö³·¾¿&Õ+Î !„bÂÊHO¥¸0ÿ¬ËihlF¯×–°0’“¥ò(ÌÏ¥ªº–‚ü\©Œ³y ×ép»<úC¡{÷ *Ê~Ê‚´”$ÚÚ;1šÆNÖÓÛ‡¢(çä·.„Bqþ(ærÏ—îb~ÜÑ"¦±pùõtnzŽÿúóV:Æjí×Ù™rý½|æÊ\lÇ,ò6®çÙ?½Ì–N?/çå½Dª@!„QD¸Ë—.:£ÞþMÍ-8].T4MCÕ©d¤§J¥žcªª¢7dTÁ9 )ûõÏëõár¹ðú|ƒAt:ÝI·14·´’“yÂuBšFKkSK‹å"—½„•<üP/=ô[v¹'Ò¾õ¤ßú]¾f_ÍCªÂ+§J1)˜(ú§Çø—™#è•ÿ¿ØyèF©1ûó|gÖ‡<ò‡×@Íâ/ý×vüÿ¥¿Fæe·qתédÚ „ÜÝTl|g_ÙAW@j|ÜŸ…m%Üý/w3?üM[yãƒÔõCdæt®¸z.ióïá8ùá³ûq„F)@‰`Æ=ßà‹óì„:vóæ»ÙÛ8ˆfK¤hÑÕÜ0s1÷?ñ±ÿǺn9¡â<<¿I!„bÂ=t+ K/Àh0œÖv­íô÷ ž–BZjŠTäy‘–BsKéiRßg#ÜfÃçóc4&äñ……™¹|é"Þÿh={ö•1cÚÉç¦ðûýÔ74’˜="Ã1¿g¯×GYySJŠä'¡Á}¼¼º™&ÿäÚ·BLÌ\ ‰ñõù9ï;áô ¶ŒÌŸ9•ËŠ/ûp”ô$-û ÷…1Ô1ü‰!ýZ¾pK*Ûÿ¿­rb͘Ë_¸‡Ï¶Ôð³Ò }\H_u; "À{àýý:µå—ïcÛÎ:¾ôíOP2ÿv®ú°’ýƒ¨b+½…{çÙñ–ÿ•ÿ~=mG(¦Ù+í(¦bîúÔÊþs#=!©u1¾$P „BˆsJQ4íì^KæÌžARbÂ)¯ )+¯$;+ƒäÓØNœƒ‡I½ž¡!‡TÄYJIJ¤½£sB\r²3Ù½w?»÷–‘‘žJtÔØ0¨¨" MgW7N— ŸÏª¨G$hLŸZ*s„¹{bJšÍ­w^ÃüÜŒ®Vv½ó"Ï®©Æi_ÀCMáƒÚ˜wýb ôôî›?>ñ.5.{Ñ*î½c)%ñ í{>à}Ç\VzþÄ£kó¹ñÎR^Ù{€^ÛXeh'Ü·ãèÛ¹.ŽUßyˆÂÞí"µ‡û$Ñë~Íwþ\‡Ï\À??z?º'áÿ:Šï»'h nÆ Ü{óòc4ºÊ7²aHwÒïíPÂ)¾ö.î¼¼ˆ„0p4ïàÕ'_`m«Sáýzq5oì 0Ö±÷gmìrl9˸ûË™–A°¯ío¿È_Ö7àŽXÀCß™Á¦·X°jéæ!Êþ±š·\óøÄu3H³¸©ýà~÷Ò†¤…OˆKì¡)Š´p tuûŽ]HDFÉÖýý!âGû‘yŸ[æekk€‚ƒŸj;Yý?먬ìÀ«†¡s9qùüøÝA@Áx2$1oVÐÁ›Ù|$Hp¿c/¼u9ÿ~Ssç%ñjc##BŠ™WÏĪãÙg7$HáŠÏÿ ·éßú"o¯ãÎi+Y”¸•¿·Ê¨1¾dŒ¸B!Î ›ÍÊe‹`?«rJŠ N+ Igg7U5µ”bµXäD\ˆ÷^ƒô=9[F£—Û=á3,, ¿ßÏ?Ö|€Ï7vWñŽŽ.âãc±Z,¤$'‘Ÿ›Ciq!ÅEùäçPŸ+A‚£Û ,ù|ò«Ÿ «öo<öÍã»ÿ·°+¿ÀG£°–pÓ¼!^ýå÷ù×GŸ§&ý>v!_øüB¼ïþŽo}ó1ž¬HçÆE±Œšêe¨cì{Ä c°}»ú‰›ž…M…°ÔRÑÏË'F†ÄRrt l­y-RVòÀý³p¾û;¾ý­Çx|{ËæD¢?É÷¶ÜÆ?/7ðÑïÿ¯?ôs^h+à“÷Ì!êàAÓ®âú¸=üé±ïñÿþϼÏð• §òéûà{ÿ|÷ßỿ[Khþm\—aBžÏç¿´ >ú}ëQþ÷#—}þ3,ˆVÆ<–c_œÇ,Ç>‹Ï~ùjÂw>ÃÃßø6?Z]AòÍŸçîÛp9¶BV¦ìçÿ~ð=~ø|#Y7|™/äWðÿ~ð¾ÿD1Ëo`v´¼ª q©QÍ1$ÙL¤^óeýéùé÷àÓ—gcS´®ýO?ûÞ(:®_µärË}shzþy¶öéVè¯aOy>Û\¾õÛÿàçÝMîþÕ<»Çt>ïà’쀷…ºþÑðƒôÕ·àìIÇ÷Ô6ÆS’´neÿÁsª˜RXñ…CA‚§øé3kÙüq-b)J1#OMbÜïSRB!„8Âm6¶íØMÿÀàmo6›¸|é"ΟsJëkšFEe5F“‘ÂüǨ£Bƒ[ø¯ü+ßüÙ‹4N½—/Ÿ¬LqöB†<€ÁŽÝ8Ú=[ÅdÀxÞã7ª“ð¹ñr$HpGÁ¡ Ávzô{ z“Aê\Œ;¹o!„“ÌÊ—±mÇnúúúÏY™Q‘vúqŸaèÂü\æÍ™‰Ñh<¥õ5McϾ2Š óË{.Î?M“>k“Å´)ÅÔ74ÒÕÝC[{Ey£®708ˆÓå’@Á)S±ÆÚ1FeóõŸÌ=Ò˜ 3¢u†¦A`Ž¡#¿5-t„Ç[ðvvã>´(褽ß?zº‰”acßfpTGIû.Ê÷1#5Ž®l…ê¿ì ;o32âЦFÓ±­Š¡G*T¬1f\-]¸òÐÝî"¦Ž¹oj^ä×O-fŲûùÉý6*6óÎÛo³¶Ü{ð«¶Óå=´•†«£ WX,6ã´ë¸onQ:7=ØtЇŽð8+þîΣŽe€ŠM› §\c•£'-Ú‚Öß‘¦ú[ú¡ Š0Õ!.ß‘s …|¸|Ú¡*!¹¥ qI ´½Ë/~÷ȯóTüT^<Øß¡=8ú߇è¹wrwÊ6~÷ó\šiIJ°„ RtíÔ´ºÑB~ê?æµ+øöÌL¬t2 ÷“ñãoggm€y%9\µ8‘oµŽL-dHdɪ\T‚Ôííà¸q˜þ~šú¡8>ŸäðÒ?óàqAГ“Š]NI%%Æ „BˆIfÇ®½8®.7 DGEÑÞÑyÊeΞ9]{öQ `Þœ™§•jÀ'A‚ BⓇ¢(Ìž9·ßù€ÖÖvœ.ר)¿**k°Z%Ø)þŠp÷9ð¶nâÑŸ¼Gg@Á`O"ÑÔGG`úðZǵ„põy1åÆ`V«ñ†ÕJB¤¥í{¥ Ïûn?6›‚·…­5*wÎMjx+¯·t2XáaùœYâ{Ù~`€áðÑò=^,)qXÔ†áF+ÕLl¢ÝÀØß{ *‘”Ž <ýË5µZ|‚Ÿw¦as—^ûí6;N§ó2ÓyR½uÖð&L¥'n ˜LF`*o´ØÊ‚­µ¸-j5Oüs#Ùnfo3.»§z•+–+Ÿ=‹W‘Ò´/ƒþÊý†O˜¿êé6ð mL¯Qã¹9(ÜÅŠ}yå±#•Ÿ·fзO ÷>Ñ_ãI0X[0¸G(ı!É®˜ËU¸R‰ˆˆH¥’™™EIII¹×«†…Ò¨a}ºvŽ!3+ûw—\…ˆðjW¼=‘V_‚ëvaô°:dlÜDŠÛ“³¼‚ÜF"cúÒ9Ä ³ÅMÚÏë9qÃ;×Âjñ!¼ýÆõ«‡Éî¸ì18?ŽË”c'kÏjâ­ÝÕ³>Á>Þ„6íÃèNfv¯:x‘E‘E¤²\çõ4énFvªG˜Ÿ¡ ºrkŸ*$¬ÛE¦óRŸ³qèÓg˜þÄÓ<>㞘ñs;ÈÛü3_þ’Ÿ·ì £æ†ÅÔÀêãGÕ¦½¹µ-ì^}˜B]o*œýÄrfÍÛÅi|h2ðž{í Þ}û Þ|ún>sÿöi͈þeSÏ]pOþñK6寿2ÖðÁ‚íeI>5c˜ðÐDZ{ÛØ÷Õ÷Äé€JÅÓˆ‘JÌh4bñô¤¨¸˜zukÓ´q±›·`·ÿ¾'VŒ>ÞÞ|¿|§ów×Y¯Nmš7kLp• „ÿ…/”&}¥¬lZ4kBòÉT’O¦°xé »yKétN§“¢¢"µl®@]Wþ~>}û;FÞ6–7[1¥±wÍǼ›‰ó2kÄ;ÒÖðÎG~Lþ ¯Œ.áØæe,‹¢§Ýõ»“îËÔí2Ö ÃÈ tÜû*û (ÁMaÂv’Üñߌ<78Oì"ÉÕ†êûv“v‘õíÉ+yûCoƽŸos“y(–ï¾MâæðËÕ}ŠÓ¦Ïø¬öX†<úã=ܦ`ÍGóØ‘ç 8r¶±¦ -÷ÌM0ÙÚ8‡·—§mZÄ¢V·s×óÿ‚¼Tm\ÉWÃ;þNº<ÿ.³ßóaÜðûùÇhoì™ñ¬ùx.ë3\¸¸‚8¤­¿d9n¶ñá;VÆÜ:‰gûá>ÄÖ¯ßåó½ù¸t®‹TV¶„¯øçÿ `Ìà;˜9ÆWN;~˜Íœõ™\ú[´{Ái² ÎüÛ‹¼Îâ<²ObÏ]É;s}Ùçn^kÅ•}Œ-_Îæ‹=ZÌøêp¾ñ#þ~¼-ýúw£cÓZšÝe'¿e-k“">éF"zÞÇüÿ¾Ž'ßuþ½þ_à3e-CndÚ+í8•’Ý+”ð* „ÃKfóA\¶Ž§\†¨¦­”’©¤Ìf3U‚IK?…Éd¤aýzÄ:‚뜹)êÖŽÄËÛ‹ýâË}ÞÃÇÃñ»ê2 „„S#"_ïÿì+¹ÓIAA!ÖÄë@VvU‚ˆÿPjú)ª……þ÷ü4v:Ù²m'‡ƒˆðjÔ­ @Qq1[·ïúu‘k??_š4jˆçUœ*lýƸë:v‹çŸV–G•ÆD×:ÍîÝ'K×)0T¡Ûô'è²á9^XŸý?;Ÿœ rø IDAT±W£;xqt&¯>ó Ǻ~ˆˆÈõȈ_Ô ¦>ГF'G<Ï¿Öe”K -ÕhÕ£'Ý¢ꋱ8“ãw±aÕjâ’ ”$¸†l¶’JÕ^=þ%""R‰ÙívÒÒOàtº8¸Ü{Ž%^òó¿7Iàr»I?•Aú© ^äIø¯ÜïÒÑ©ç½æ.K8æåå·e»nEñŠdÀ„T}{ß%ØjÖ‹¾ÕO±îPž=¹¦\äÇÇ«o8¸g\+² ½7»l©l_öÛ—)brm)Q """""ò_Ê‘òï~ÄíwΤŸ/geÇï³*MÙ‹ˆˆ\{.ò/å•K ¹îiê!‘«èÏœzHDDDD*Fe›zȨC.""""""""""Ry)Q """"""""""R‰)Q """"""""""R‰)Q """"""""""R‰)Q """"""""""R‰)Q """"""""""R‰y(""""""WOVF†‚ """róõ¨TíU¢@DDDDDD?:EDDD¤ÓÔC"""""""""""•˜"""""""""""•˜"""""""""""•˜"""""""""""•˜"""""""""""•˜"""""""""""•˜"""""""""""•˜‡B """""""""ò˜¨CÇf‘„ù(H?Æž¸Ml9š‹ów`ÀÃZƒf-S;Ôcq&Iñ{ÙE‰[á•«ÇÕ´•N9‘ßÍ€gµŽLœ2žÎa† ¶¹Iß8—}Gªý2]¯¦@Z™Ä]âÁ&[â:>~ï 6§ÙQç­\ ¦°j3‘ÊƃÈ[Ÿáù.ɬMndz/ßLÖO›Hq\æ#æHƼø8׳=Ë©Šˆü¦`º=ôQŒ}x õ~YÈÌ)S™6ëg¼ûOænÁƒ_úÕØìÇå‰y‰Ôö “£0{ú#<öþ^Bz£}°ñ²åXjôgêÝíÈ_þS§<Íì-Vzw *÷ô˜Á¿“îê‚må,¦ýõ¦½¶Wç‘ ®•Ãò×ÞdEÆiÖ¿:“×·äâþý¾’6Šˆü¯3ú4äÖ»:øéglÎ>Ó‹oÀ+<Šàâ\ªy„Wg¿ËœYÏðPÿZ¸ íxUÄ?7¤‚²ì«;Ÿ¤#¹D†b8ºˆ3>#¾¸¬(“•ú )9™L¾2¬ËÃJ„(>NBöÅ:ðd%œ °†[Ë?©m©J‹àÄfvg•,ƒ¥}(Klþg?ZͦõGpJÓÞu©èk”B """""r-ðkÒŽ® Ì]¼›ÔüB2þÈ'K3©Ó¥V`OfÅÒ¤rr÷6NØ3X³d '‹ŠHÝ»$›ãeÊiA‹ >ôs×$™ŸM†…,ˆw”[ Ñ]¸Ÿg<ËûëÈ,²a³Rì´`1\Ñ~þè{EDþ/õ´3æ{ç0wÞy×^‹Ÿ7žÑ´*ú‘W})ÿ\NA§;y°Þ^f(ÉÇvNÇI<}0ÛsÉÌ.Äá6` kÁ°çΈÝÌYx­~[±\ÅäžV¬–‹u¯±Z±¶|åwÌXÌ€½ˆÎI4.K|¼…L8ì6€ÙbV¢@*œ¦¹¦Œø†âY¥>¾Úñ×Î#·ÉixrÁUBAÙœn— ·»„‚_WFtár»ÓeÊ $$Ä‹Âéélr“žR€Óç‚Ýq n=˜»bêRÅXDFz~&ȾÒý6Ž+xïy Õ#""ÿC×ùàŽc™P3Ž7ž?LÛrÞõÎépá.ÚÆüÅ;8Y ämbѲ¼ØµAËìàé‹Ågz›=}Íg;˜Í¡´<Ž‰=ƒ9¶jOÎÚNr±†T8ûI¶vÓ¢»VgÛ’äó§2WçÆ 0â$ag å–rd“” ͪ6"< •:w=R.I„4¨‰Ť¦h>©pJˆˆˆˆˆˆ\Sn ³ó°%oäïO¯(›SÚ€g`8Õ-Y¤:ÚüÎr\—)'sïŽ «†·ñ%.ÀèEh¸/¦œsË0à×z"°óé+ÿ`ã‰B\ ®!5¯p¿SWð^S Ïy7ùSÍ_?WEä…'ámÑŒ§Þêƒ&“xŒÙ­6òƼòñÆÃxöZlô0£„ü”DrêPÃ×HbŽ Œ¾Ô¬ãOî±tl¦ºÝ÷#,ëy÷oo²'GsØ_5®|v½‚“-PcèT4~ÌœûH/¯°¦ôw;C#€Â,Û“W¾“ßžÂæ¸S Й)3cð 0^$c`+néù›XwLKSKÅÓÔC""""""×”‹ü½+ÙiíÇ„~©êïKhý.LzòQÆ7ñ½‚rÜ—)ÇÌñµ±d6Áønu ö ¤vçÜÚ°|g¼Áã³¼üÜF_jw@×P/ÌSé´‹ñ·÷ÛèCdËvD×öÅøïuçQìU‹˜Vøš}‰ìr3=ªšÐÌ"ò¿ÁÆÁŸbê´'ydúSL›þ,Ä;ÈÍã/|Åþøõl.lÎØáí©eõ%8ª;cúrdõNR’6›Y‡!ƒšl±Úò&×Í"66SÃA ¯ŸÀ¿Ä’f",4”°ÐPB½Ôáw”$}Ïkï _šžÌ˳fóñ³yïÅÉ =sÿö‰fÔ (üË’sp|ÅB6ä‚o€2V1{ÞÖ²$ŸÈÎÜñèD{ÛØóÅw(ÒQ*ž)$¬ÚL…ADDDDDäÚq—œbßBôÁ¸Qƒé×6ŒÌµóxoÅ1Š-µèÖ³ «6’dsƒgunèÓÔ5ë9Ràs1}šqzÃZöe¦]²œ‚Ó ì>@ÌàŒ¹¥;ͽâY¼ÎƒXuÐJ׫²Å&’R“(¬Õ› F0°[sBOŲ2-‚ƒšS·™ãA­8rÓ7²1á{/Q_‘©ýœÂÍ^;ùqwŽË´±°øÉÎzô¹u8#úµ£fn,K3jQ7s#k)a "ÿõ\%Å•ýqÔ®'-O¯å»-§°;³9°#•à†0fôPú·²r|ÙÇ|ðÓqŠ¹Ú•BH·Ü>n(=ëÙÙ<÷]¾5Ú6£zP]nèßÎÑíè>àFõoC-?ñ‹ßâ­UÉç}N¤¢¢š¶Ò©&"""""""""ò§1â×xÓ§ö¡¦ÑÉ¡y3yiõ©r ½ªÓ¦wz´mLíª~‹2H:°ƒuËdc¢Ö&«G‰‘?¿¨<0© Ù_¾Áû?g«ã_®[JˆˆˆˆˆˆˆˆˆˆˆTbZÛDDDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤óPDDDDDD®ž‚¼\ADDDä:çëP©Ú«DˆˆˆˆˆÈUT%$DA¹ÎÙl%•ª½šzHDDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤S¢@DDDDDDDDDD¤óPDDDDDDä:rØ| Äy€°µ€I@[ ‘B%"""òçP¢@DDDDDD®Ç€o€×€¤‹lÏ€Ý@Sà@Àóœ÷ù@*à,{- üƒÂ,"""Rž""""""r5lÖÿÒ/Øf¡tÔ€ë7Êp™À: æ ë¯AéH„Î@/ 6¨Ã"""ÿ“?µ[w }“Z„ú(8•È¾-qlOÌû5c}y<"hÒ,ŠÈP_ŒEY?¼=Dz±»^¹z QM[锹J,ÏëeWr(}Š#°‡Ò) 3`ü(픲`JŸÖ·”m眿ŸûÞ\ ¼l[kJŸäÞ-Ûv­¯²}­””µíJÚxá{í€OY»›P"BDäœϪí{ßh:†^8`ÍMúæÏxëß[H»\o¿ÉJóA¸½O}ü.ØdKÚÀ¼¾æçt;ê¼½6l¶’ÊuF+Q """""rõüç‰jÝòZçó·ÿÚ›}…r(æg‡Á;£þ »¸³g-²½ÀË›ý1ã/xÍy–¹¿Øþðžz5ºƒG¥ñ¯g—pÂqþ6cH7ž|² ËŸ|¸|÷Ÿß~s-Fþ møB€Àp`JˆÈ…LUèrßcÜ”ö3&bÇBã;Ÿç¡6çß}ð¯ì(:sÕ$ íÝ<½†™ï øü+êe¶IE1ú5c“!&ìÇ·°tõŽæ@`íVôêßžšf8½ù=žž·ü‹—3Ðzü4îí`Å•¶‹~ÜÄž¤\Ü~Õhܹ?7· Å`ÛϧÏÿë3 ø5PÙšzHDDDDD¤r9“$x•Ò‘` ¢YۤΙÉ;òq›ý¥?.XÊÙu”,‘sxP½ûíŒmìM^ZÙKFª…¹9¶ðe>Ø{&1à¢$×ð‹lMÇ6-ˆéÞÿýkÎ)ërÛ¤b™©Õw1`;ð9ÏÍŽ%íL_þÁ½lÝq”û¦¤iÇô[sˆEIö >oįÙ0&t°b;ø/ÌÞ@JÙȃÅEÝÞÖÒEu,M=®ûßØD¦KQ—Š¾:‰ˆˆˆˆˆÈ5ÿiÜjcw¢QUL%ÙÙô ~¹ƒL§™ÐÖ73ah ƒÝœ:¸‰ØgÝIÛE¦)øµŽcªú,6•dï9²é>ü:‘ÆwO¦ˆ†‰1Åû£'Ò3Øx¿O_fö¶||êugÌÈ´¬€3;‘m˱pC"E1üíoÍYýy u¡QU²ö-çÃ$¹l¼{»5"”loú–O¾ÙΩ?£ý°ToË-£б~0ž…'Ù¹ró~Ê¥ãä{/hCÞù \6v—(wÅ®`ðÃ`1ЪìˆTz,µûqWw:ˆúõDMÿBÓ8•QRîÚY‡p_99.ÂÎÛfºÌ6©PæêtˆÒø~aÜÙ$A{Úf>_v#Ï ©JûÕYœ”Äy©ƒ•6ýÛàã:ʼy±ç$ "èu÷CŒhäIΖE,óȨ–½é\m ßžÔ¨©XF…@DDDDDäÚ2ø·`üÄJ~z'yœ'f­ÃÕq8#-˜#zóÀÑü8‹é>ÏÛèÞ.À+j8éafíìg˜ú·—ù<%ŠÛƶ#ÈxÙ:v>ñÈã;­£ff¿Í²S…ì˜ý¯¯‹gÅÛ³Y•™Kì[Ï3k[nk4“îïÿŽO™ñÈtžOøлÓÔ¯ôG¥oS†tÈcñ¿žâáçðK­ŒŠÄ˜ƒcè¸÷Ÿ~œ¿½ý…íÆ1¹_žBû > ¹í¯#©“ð%ÏO{Œ'ÞߊwŸ{¸·£ƒŸ.hÃ…b^.v—,·K•+ý½³ìˆFŸú ›ØŽã °%ûìUÉèLu? 5ÜÏs/½ÀKO>ÀøëâgpprÝ—|2o!K÷ç]¾Ü6©PT·¶dŽæ\¬ßIö±dŠkõ€òOj{†Ñ´:pr ûÊ΃%‚ž÷œIÌå¥O×·1!4Žð ¨KE_£‘kË]x€Ož{‰b’Ul£ÄVD±Ó‚¿ÅBÍ.1ùŠùë’•ŸÃ±M_±è°£´CÈéÄe´`µúa*LáçOŸç±w¶ãºl‰YŶcgëø­®UZö QÞjþ½2žŒÂBÒ÷­`þ&'­z5ÄϸsˆûnGóK(8¹›M ÅX½0nG< ¿ÜBbN>™¿¬ã³¯ ŽéH„ù?m¿¿F½içÚÄgK÷’VPDæ¡ÕÌ_žEí˜(¬¿õk÷’±3à{¹r¯¬§æ¨3\D0øÓbäšîÿ”Ï÷æŸ×©oôµâÌÎ"cÿ¼÷Ú›|°ü85†Læîaš äzå*&¯0[±z^ì†cÄb À°åÛÊ%«1š±˜’"lœMÜu&I°,8í6€‡Å¬˜K…ÓõFDDDDDäZs™j9‰íëd*"3ý4~&Èƈo°…ɧ(<ÓËà*&#µ§7^Äks»Ð³û¼x‡§ããX¹|9ë^¤Sâ’uü>U|pç$sö¡I9É9„·±¹¤å­Ñí:ûwg^*™Ågþí¦05•BÏ@|Œ§þÃöñ ±âT—©/¶?Û^“'ît¼~#QpéØ9ð½\¹&@³?ˆÈ1R¥ý(ÆDleÖË¿P趜·Õ‘ò#¯Ìøñì iK˜Ö‚]Z²f%©NEðºcOeG‚ƒMëѯK5¶/;yþÔBæjÜз>FœÝ“†½Üçs8žMÂîŸF­Û§”K€ÁõjàE1é§ 4bD*œ""""""×”¿–cùk_; ^•Í' qy„3dF}jà"?Ó†OD(>ÆDN»£!Õ|06âZ¯´X>ù× >1R·ó­Üwï žz›¸\×¥êˆÜ|²°¶Ë#üXi¿ÅIaf!†VáX=vQPÖya…üÓ¹JŸrt_¢Ãä_`‹cv7`Ä;¬Þ… ä9ÿÓö»)ÊÎÇvr3Ͻ¸ŠtgiYfkuªY²Iu„^¦M—ÝË–{E·6©s\¤²ó¤zë(¬áM˜þJOÜ0™ŒÀTÞhñ3ïÏ=ˆ¿ß ~Þ™†Í àÆn³ãt:Ñúµ×)W>{¯"¥i_"ý•û Ÿ0ÕÒmàÚ˜^£Æss8P¸‹ûÊO‡#•Ÿ·fзO ÷>Ñ_ãI0X[0¸G(ı¡ÜbÈ">M=$"""""r­yxbr’WP‚ÛèCdL_:‡xa¶89±a#™õ‡1ªK‚}­DÆ eXƒÒg¾ü cꔑtªá‡§¹t_£Ë‰Ó ½©Ù<šÖ‘¾¥óŸ­£•ÛèÓêl¦‹Ï{l0b±7Y{VoíΨžõ öñ&´iFw2³{ÕÁß^Ü×#Šá·´§¦Õ—*uo`Ì°š¤¬ÙÄyk2^ºýA'6ll™YXШ.u<Îo¿‹¼«ØЇ1½£óó!¤n ã}ˆÑ|JÛôkÊÇÃ÷2±Ëÿ­r?-d,"€CŸ>Ãô'žæñÏðÄŒ—˜sØAÞæ˜ùò×qÕcФ»Ù©a~~„6èÊ­}ª°n™MpݲŸXάy»8MÞÃs¯½Á»o¿Á›OßÃÍ|JßäÓšý˦é;ƒä¿dSøú!c ,Ø^–$0àS3† M¤µ·}_}O|‘ÆHÅ3…„U›©0ˆˆˆˆˆˆ\¦r¯Ù3SX³cÆ £—f„œÚÄO§ªscÿfä­^ÄÒ?ÚÝ4Œ‘ƒ»ÒÔë0KbMÔ÷?ÈÒï·’Ö!#†1¤_7Z‡d²fþ|Ö/ÆmªFŸÉ÷3À²›5{s(>[‡WY ?ªž~cÿflÇ«]{ü÷®ak†Ü.Ìá­éwËM4JßL\B"{\4ê=ŒQÃoâÆ(3‡–|Âü­§°[jrÃ59¶f3ÇmnÀƒÐèižÿ3±Y ¸¡úv¾?Õ’Ñãne`û0²7Ì烕G)òªM×®Õùå§ÍK)×þ6?ªþÌý›ý#oõ¢ñKü:´»i˜säà®yM½;–Äšìõýãù)î{⋨×s£F ¤wëP²7ü›J¢Øé 0‡·v÷»å&g£ôÍüœDï_ã‘M~ÊQN_"v®’ ö_ªÜßßWÓ¸èxéÌ©Ü\vEÅÅeFw§yîz–nÏ 8;ž'ýißÿf†íO·Æ¾_ñ)sמÄök &‚šu££×Vn͸`´Ëm“ <ªßIìî ð"$ØŠ·‡›¢ìdö­ÿŽÏWgQ³U"êµ£™×Q¶ÅgRrÎ=Ä]’ÁýùD´nJµ ÚtîÓ•Žm¢éÚg#ú´¢¦o ‡—Ìæݵ)ç}N®§³reê QM[éT¹J,Ïëa7r€o€E@q•ëF€Z@qÙëþ@•²ÿzþIí< ,6û®B[C€Àp`¨³^D¤22â5ˆ©ô¤†ÑÉ‘Ïó¯u\Øõl´T£Užt‹nDd¨/ÆâLŽÜņU«‰K*ÐôS×ÍVR©Ú«DˆˆˆˆˆÈUt$  ´ý°Øœ 3`ü€L È¢´s?ŸÒ§ãÏ<äj¡´“߯ì=AeŸñŽ—Õ‘_V.@ `ÐÒ'îÿ¬„Ào)ò€4 Hv–µ# t]ç3m´\ÐÆ ãqá{íem/kW'J×'P’@D¤R3â× ?÷ŒkEö·³øxkŽ:þÿ‹(Q """"""æ:JˆˆˆˆÈ%T¶D3©Ä”(©Ä”(©Ä”(©Ä”(©Ä”(©Ä”(©Ä<‘«'+#CA¹ÎùúTªö*Q """""¢""""R‰iê!‘JL‰‘JL‰‘JL‰‘JL‰‘JL‰‘JL‰‘JÌC!ùLÔŽ¡c³HÂü ¤cOÜ&¶ÍÅù» 0àa­A³©ꋱ8“¤ø½ìNȢĭðÊÕcˆjÚJ§œˆˆˆˆˆˆˆˆˆÈïfÀ³ZG&NOç0ÃÛܤoœË¿>‰#Õ~™®WS -‡Lâ® ñ¿`“-q¿÷›Óì¨óV®Ê­Dˆˆˆˆˆˆ\ŠGµ~<÷÷&,œú*Û‹Êm%òÖ™L ú”‡ß‹Ç¦p‰ˆü6S0ݦ<ÁàÔ7™>ÿ%ðo؇±#ºÐ¼v(>¶ ö¯ûš9_o#ÝîEÓ{þÁ£í,çq𩼸­°ì_FÚOff»U<1kEŠðUaôkÁÏÜG+”$ÅñíÊm$ä@P6ôÔ‘H3äÄÎâÉ9{Ès]¤CÑw<Á_c¬¸Rw°ô‡Xv%ÆåW¦]2¬m†â}|Øx™:~?sþL½»ùËß`ꔧ™½ÅJïŽAxŸ(Æ><†z¿,d攩L›õ3Þý'ó@·àr?<Á˜ü`/Ü?ÍâáÿÎ[?Ùè~ÿ]t 6` lÇ_¦Ü„uëGLàažœ{€ð“ßÜôWD亻Öû4äÖ»:øéglÎ>»ÌmIÂ"fÌøŒøâ²LVê7 ¤äd2ù–"ü½¨9ðAþùê+¼úÌCLêY#€ƒäÕŸóÑÇóY¼/=p~yX‰°ÅÇIȾX¾“¬„Öpkù'µ-UiœØÌî¬Ò#g°Ô ïeI‚ÍòìG«Ù´þBiZâ.}RDDDDDD®%ªwêAäñÅÌßDNái~Yóß(}º°8i»]¸¡Žhvc$Y6sòÌÓ‹ödV,ÝIzq!'woã„=ƒ5K¶p²¨ˆÔ½ÛH²yhñ¼l¿'µnìLð¡/˜»&Ìül6,dA¼7ü›ô££ksï&5¿Œƒ?òÉÒLêtiD áüöV‹éE½´¥Ì_wŒì¼S\½€YŸn Íi"¨U/šä­â“rª°€ô=Ëøtƒƒ6}ágø½íÕO]¹Îh5fÍ÷Îaþî¼ó§uÛsÉÌ.Äá6` kÁ°çΈÝÌYx›O Ž¬LNí[¬þ‹w–§æðy¨WUMr-¹ŠÉ-<­X/zÏ1b ´blù6œåÎ33`/¢„s’Ë’o!Ó» `¶˜•(«ðTDDDDDD®!Õ|)NO§ðÌã Î|RsÊ&)(Nbý÷ÇÔÂ7­*=jbÍG§pPöä—«„‚²·º].Üî JÎtA¹p¹Ý¿]G9Œåz$Œø{Qx"¢3e¸ŠIO)ÀécÄ'4Ï*õyôÕŽ¿v€¹MH ÀÛ8ÎioU?JN¥Qðk9§9» ð V°/}@ÓAöñ «àc*øí¹ž î8– 5ãxãùø-寺æPÚ ÇÄžÁ[µ€'gm'¹Ø,çÅéËϾ1õ>¬Ú’g»µ&tÕ¤8ÝkÂ~’­‡Ä´hÀÀ®ÕÙ¶$ùü©…ÌÕ¹q@Œ8IØ™B¹e~Ù$eC³ªH¥Î]”K€! jâE1©é1"N‰‘kÊIaV1^ Cð6ÆæŒ~T ò„d€bŽÅ;Óúd5ÂO®cKÆ•ö ¹~£0`<;äÜäO5reägãS# oã1J\€Ñ‹Ðp_L9.Š²ó°%oäïO¯ ÍYZ¢g`8Õ-Y¤8Îoo~V1žÍBð5@±0Ѫ7w,cOf†è=vPPÖQTÓ y99Í:]Dä¿'ámÑŒ§Þêƒ&“xŒÙ­6òòÓ˨vçcŒ°¬çÝ¿½Éžœ3M#>‘Ñ´9Φí©ØÜnJlv\Ê\C®|v½‚“-PcèT4~ÌœûH/¯°¦ôw;C#€Â,Ûs‘i¡ì)lŽ;Å€™23ßãI0¶â–Þa¿‰uÇJs©p)"""""rM9HÞ°Ž“µ†p[§šxP§ë0nŠ8ûHqâ&vÛ2vhI«w“}ÅÚ/[‡«8b¯ZÄ´ŠÀ×ìKd—›éQÕÄùÏæ—´6–̆#ß­.Á~Ôî<‚[znòö®d§µú5¦ª¿/¡õ»0éÉGßÄŒ>D¶lGtm_Œ8HÝ´†ãƒ¸­k$V/_":Þ¤ 0•ØÉÞ¹ŠÖ^ŒëÛ`š÷gÜ žìX±ÿ"‹"‹ˆü7°qð㧘:íI™þÓ¦?Ëñrcgóø _‘9ˆáõø÷‚XÒÌA„…†JH 's†Ü}?cº4 ªŸa »3¦Ž¬ÞI¦2×TIÒ÷¼öñrð¥éàɼôhÛ˜ÚUý0et`ë–ÿÈÆD­M Wñû¨B """""ryÕaà­¨úúë,>b#¨E?„§³æ`.n³/AÕZ1¤³'»Þ‹§ÀýçסN‘?›‹üßðÒ+˜Ô†ì»…»ŠSØúÝ\¶~§ˆÉµ¥""""""×ü—™'GrçжÔò…¢Ì_X÷åg|½=cÃq¼ôpKNoüœ·æmùãsR_¦»Ž€ˆˆˆHåþ:ªDˆˆˆˆˆˆˆˆˆˆHåeTDDDDDDDDDDD*/% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1…@DDDDDäê)ÈËUDDDD®s¾þ•ª½Jˆˆˆˆˆˆ\EUBB‘ëœÍVR©Ú«©‡DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1% DDDDDDDDDDD*1…@DDDDDDDDDä0ùS»uÚ7©E¨¯‚S‰ìÛÇöÄ<œ¿«4iEd¨/Æ¢,ŽÞÇžcÙØÝ ¯\=†¨¦­tʉˆˆˆˆˆ\%‹§‚ ""ò_Ï€gÕöŒ½o4C ls“¾ù3Þú÷Ò.×Ûo²Ò|ÐnïS¿ 6Ù’60ù9ÝŽ:o¯ ›­¤Rµ×Vm¦»ˆˆˆˆˆÈÕááa*ÿ¢¹#ŸžFÛ¤Xve;ÿ´º,õÆðÒ#8²a?9^±x5ºƒ—ˆ`߆C亮¿ý»¤ Š³ˆÈo2xSûÆQÜw÷ÆÝ2›z´£A@¿J¡ÐKunu'wß>šÛnŠ!Ê?‡øøTŠÎ½ÆšªÐeòLî­}˜uûNãƒàÖ7ó—{&rû­73¨G;êûåpøpÚùŸ“ aôkƸÇn'¦Šûñ-|·x)ËÖnã`š“º5lAtP›öœ¢äb=ý†Z›ÆýÝÂñHÛŲÅßðÕÒŸØ°ó2Íá4iÔ˜615ÉÙ¶“¤BÐkÁé¬\ß4õˆˆˆˆˆˆˆˆH2׺‰{†Õ`ëÿäÍÃøF¶gÔ=c™”ü ÿŒ3Òùî) ¶}Ï»ÏHv@3†Þ5Ž¿¤&òuY”v{P½ûíŒmìM^Zi™Æ*ùˤŽä~ùÌØžU[sëݸ+ý9þ±!KO¡Wì¥VßÄ€íÀç<7;–4GÙ¦ƒ{Ùºã(÷MIÓŽ#è·æ‹’ì|Þˆ_³aLè`Åvð ^˜½”²‘‹‹º½­,M=®ûßØD¦rRÁ”(¹¦¿ÊÂè5ù^zûÂOà÷é˼{´%Ó§7aõ™tÞ†¬_d‘WÆîD£ª>˜J²9²é>ür™#þ z2vdwZ„ûP”ÏÚEóYºïôõ„Ðiân XÇë³~ä˜ ,ÕÛr˨t¬ŒgáIv®\ļG(êÂãçÕÿ ï´_žÑŸÆïãÞn%›Ã›¾å“o¶“î×ù‚Ï>ÏgöŽŒÙƒ–5pf'²mù"nH<îæ+Ù?k û[sVžB‡A]hTÕƒ¬}Ëùðãù¥Ø—&7fÔ©ê ù'¶³xÎç¬K·Òó‚8ÏÞ–O½îÝ·¢€ËÔQè¾ä¾åü/^ÿI[¹N;C` {¼5›—&¦o4µ¼òØÿÃ|–v`äÀÖÔô)"aõ§ÌúêynÃ¥ëTo ÈuÏ}zóßYÏ¡Ci،ޘ (,±c/râQ5†>uNòåÌõ9톌ÍÌ}!ž@C~ÙuÀ¥v?îêncËIQgÊtSdwa·Û±Ûí`·cw:(²iÄT…3W§CtÆ÷ ãÎ& ÊØÓ6óù²yfHUÚw¨Îâ¤$ÎK¬´éß×QæÍ‹='IA¯»bD#Or¶,b™ç@FµìMçj[øö¤Cq— ¥©‡DDDDDD®¢rS¹ HØvŸöÍHyÿ9>ØWÞµèÚ·Ñ¡)¬ø÷W¬Ëˆdü_ûbûþ}Þœû«:i9ô&jŠe¡=<Òûïñú§«8`oÀðqÈ‹#Ù»9=Z;Ù›Nãqçv»1øD1æÑñDîý7o¼»{Ðvämt(ÜJÜ©Pn8§þµGOSä<ÛíÒ†þÝÛR3s9ï¾·€e{mD IϽÄ&ÒùœÏ®Ï®Ëø‡†à;‡×>øŠõ'è6f(õ’ãØmoôÇö/=„ÎýzÐÊsŸ½û _ÇeÑ÷bòãØê3ŒG‡{±ò·ùðÛŸI¯ÙŸ±1…lŒ=À¾­ÄÙÚ–{¦]|ßvæV¥Ë%êØQë’û¶ëRõoJ¢è‚}ƒWMnèßƧWðö¬/XŸY‹·"ºd5o¿9ŸŸ’Cé5¬›7‘hhxÉ:7'éÉa‘뜫8›´Œ\þíyô_3ò†øìø„Y+O`lП›£òH¼‘‰wŒfDßvÔ5§°kïI ]`ôiÀˆûûSøÅGl­Ú™…?óÓ¾Ó8m)ì;Y[&``ßÞôîÜ¿ñúDZ)äËR“Þ7GZrˆeK¶“Q.7ãÆnªGŽÕñµíeE\:çuó["0´=ÕÓVòQš$èyÏCÜÚÈ“œ-syéÓÍ$×£W»HÌ¿¬eãÉÅý*«lSuÈEDDDDD®?w.qŸ}Åúƒ'ÈÈÞÏ'ϽÄG±GÉ*¶Qb+¢ØiÁßb¦j‡îÔM_Æ籉äägphÝ"Þ›¿‰tgÙŠæbnŸÊÄV|ñQi'<ðmÔ›v®M|¶t/iEdZÍüåYÔŽ‰"Àx~ý™¶òó¸ñ,ür ‰9ùdþ²ŽÏ¾N$8¦#5Ìç~6WTwå­æß+ãÉ(,$}ß æorÒªWC| |ÿpç÷ÝŽæ—Ppr7›Š±zat:q-X­~˜ SøùÓçyì-ä”k‚*-{\rßü —ªÃ‚õrûæþ½õ—±§°ê‡Ýœ²’²w'™¬[¶”¢"ÒöïàD‰«ÅxÙxX úÿEä¿…+÷gþ1ùa¦ýsI-&p÷0||½1[[Ó¢x5o<ù(¾ö#í'rŸp< þ´9†¦û?åó½ùç%M!¹ëö&ûâ5¦=ôÓ^ù’cÍÆs× !˜ê >Åäf+VÏ‹u¯±Xðlù6ÊÝŒf,f ¤ç$ ¢Î$ ¶‘å§Ý†ð°˜s©pšzHDDDDDäzä8͉œ²ç]&‚Zdbû:™ŠÈL?Ÿ ²1áê‹=#_×9t&~s–0ù5&šµlËíÊ€µØúU"6Œø†Xñ ªËÔÛŸíÀ0yâN÷ÇÛPx~ýáÌK%³øÌ'ݦ¦R舷)õœÏšð©âƒ;'™³E9ÈIΨ |ŒpÿŒyàÈ%-ïl׋ÛUú÷âÿoïΣ«¨ïÿ?ïMÂ% û’°©B”]Á¢"à‚beן{Q[-ßÒR7´nu©ŠÖ*®ˆ ¨UK](²ed' $dßîýý!(ûög~ó|œÃ9ž;Égæ¾gœÉ|^óùÌšÉ<örzu5\@îª4>ùè#f­Ü¿£æðÛ,<Ä:¢ˆ;̶±öH׿g•RXúcû‘p)…{Þz‰ðý×:|=ªGÎH!ÂÄ6hFJT:k· —‘»~ïÏïÅèŽÍ©>¯‚HñÞú`)ÛJ€ü4Þý¤'wwoGËÜ& MYÄÓ¯¥0ÚçV§]ZìœÎ]³¾#·X7‡·?íÎ]=ÛQgît2¨ò”¥³d]9]ROàÜ ùbÚÖ}§ŠiÈ}[¤‚ï–gPvÀïç°)ÚÔoIr š^9ꀢ©sBcªSLæöGŽ©ÒH’$IÒ1*Ðn¿ê[ƤÇÿÌ‚­…„£“¹xl SAAv11mê€â¬IÛ>g´tŸyŸó·¿½Ã¦ãªq÷ÍCè“öïo© (;Ÿ’­ ¸ï=Ib’Ñ0”MFE§½ÖpQ5R'`}Y[¿!±…ëȯØ{Û+(ÜQH }2IÑK)ØÝñQ3% òs) 7ü϶¯¼ý!·¯z½TϘË+~Ì+159¾ûåÜxÃH þðiE{ÿäÿkÛb±Ž0ŇٶÜZ I9Ôúwý§o¢Œ¶é†Ò1.HÍŽC¸½í Æ<4ì@1±1„ËJÉÏL§ Ë3ÓF¡"@ƒö­HJnÃèGz!@TT¸'Ú.äµ¹ˆ î5]H€@0pø“·~á|–¿7m©}I¹ðWÜx…‰Ó¿!³ª×kÍ9ƒGpQ2P¸”Wä—§óù¢,úöéÆ cº_#¸_H¤¶ô?»¤1瀗!K•q¦’$I’$ýüAB¡CÜ¢EW#ª¢¼‚R"Á8šuëK÷ºÕ‰ EÈø|6›S.`@÷¦$…âH>íb†Ÿ{Qe»»%ÊK(„)\ý>¯/I伡=h&ÿ›é,OìÃÐÞ­¨ŸGÝã»1âÎÛrRÜAîcirJ':4‹ç‡Yn¢[1àÒÓh’OíãÏ`è%MØöÙ|¶ìÓ—açò¬J:‹Á½ZP'.–z©}rz ˦¯üþ%¼?Åöíu‹›pÒ%Ü>j §7N ZÌ÷½nÁp?¼bá‡:Á¶®Cn[Âá×°:‘ÈaëáÌCÒ±®œíK—Õä|.éÖ˜¤¸¤öæòΰlÆr6Îãó¢T]Ü™&‰ñÔ>ñ <§&kg}Îü—îaô˜»ùÝØ{3öO¼´¦œ¼Ïs×ÃSY¼pëjžÃ ^-¨O½Vg2蜚¬µŒŽ&¨te›?âé×–’Kmú]Ï}=Á³O=Á“w_ÏE{®Uq¸ì¼ÝÓÙíwLlùt óó ¾F²>ãùI_ì Ä5éÆÈÛ® Cl +¦þƒUE†?ª|Ž($I’¤Ÿ[y6«VæsõÍ÷rÛ„{xríÞ #,ŸÌäöWrí¸G!/Õó>aê¼d†¸†ãžeüsq p‰¥lÇ*>›ð2³³ÂD'íÕL8Ÿ¥S¦ðÍØA 뺔Çæ|Í«O½ÏÀAÃ{Q1E|õÙž»ƒŠ¤ý¶/X‡.GÒõ«?³bC%ÿÁ?‹ºpÓ]C©Éâ›Y/òôÌLÊ[î󫑜żðLC/¿Š{û'ÉÝÈ¢wžý~®íãþÃí«q¨B†ÉZð:¯7ÆÅwÞψè…ßðÙ‹¯±$/ }ëüÄÂCo[8ñл+’¨mÛNnÔaÖ½oÿçCÃù‡®GØÿƒ¤cÿ4¿ížy9Ž}®ãþaI„³×³pÊxÞ^žO8œÏ”Ç_&2ü"~óÀªlåËŸãÅ9Y‡¡¸`O+ÕÉ+ SQœGvn!eÌãÙgB ¾ì î¹8ò6óåGÏñÆœ,Ì ŽÊ^%sÞ‹üqSgÎ=¯']S›R3&BQöV-œÉÌ) ¸êLRzÝȯy†GßYE~xßóúÄ'Þ&nÔe´«{&wÏóiÙžçuTZ¥¶7’’$I’¤£$ªf$Iú_/HB« ¹ý–^4Vðí¤q<:ëÀ'jHû³{ѳÓI4«O°x›V.eÎô¤m,0$ø•””V©ïkP I’$IG‘A$IUE„ÏãúáíÉþûÓLX”cÇÿƒI’$IR¥1($I:öUµ À—K’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…E[I’$I:zvfeYI’¤c\|Ä*õ} $I’$É›NI’$UaN=$I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRm $I’$I’$é?•ÈñºÑõäfÔOP¹žåióYøÝ.*Ž¨ÑI9¹mkš×‹'X¼ƒ«¾bÙº”F,¯Žž@«Ôör’$I’$I’tÄTkØ•+F {ýÀ~Ë"dÎ{™G_I#½ì0]¯Q5iwñU\{~Kjì·¨dÃ,&<÷6 2Ê°óVGåˆ6($I’¤cHTzŽCÿô'=q=¥¨Ñ²Ã.ëÁ)ÍëW’Å׳Þá¥w“YVÔëäÎSCû4±ò™Ûyà‹Ç=ˆ‘çw业1„‹²øfλ¼4y™å‡kÓ] I?¹@ìaÎÉ¥ÐsÈ.è|õ£²Y9k2Ï¿µ˜¬òÃ]¢©Û©?W\ÚÔqŠ¶³bÖT&L]²ïï©RÚrõ=7Ò# J7¦ñ÷O³.jב>v¥Y äÌ}šß¿´œ¼ðÁŽ‰D:]=†_uK"œ¾„ÿ9—¥s '4"õý¸¤s}Å+˜p×x>ÛîUåsê!I’$I:†nÑRι†+RãØ•þý'Áí¸âWÒ`ö Œ{ru;3ô–«¹½<“±ïШ¬›x?ã—ín#LIn1Õš_Î-—5æóñãxtu>ñÍ»2âæ+ø?›¿å¥ÍÝæÔM”º#$é'U­yÿCž“ïŸ䌛Í¥Åç/|ŽI§pÙWrã¶õÜ7cáC]êœÎ×ή7Ç3zQ4èÈ[®æÆŒ±Ü7s'aË^‰bhvþ z$AÉŠ‰ŒýË,Ò÷í_/#mñ:FÂ)ÝqÁô•LÚ° ¤FÛ˹º[%_Oâî'g²e÷ȃ@(L‹s“TOeÄU]Xþð\v¸CUÉ|™±$I’$„Ž»€z—¶¹ü‡ib’;rRd)oü} [ò Éùn.“?É ^ûÖÔ Õ¢ibëק“¹}ûî;È- Î^Ì+Oþ•÷–§SP^AqA!e¥ä–SípmF¹'$é§v¸srTîœwüfÞ|}&«³v‘µv»ë<ûEÞîkÁÁ¯TST¦¬´Œ²ÒRÊÊÊ(«(§°¸Â‚W¶˜dNïRÈàïçýìV–>—×?HêÐõôdªpɯI§~‰¯ã—fí4¦ïÍw2¤Mˆì´7yuI1Q-ÏåÉ>ë­ÊçQ&I’$IÇ€`\K.¿¶ ^}Œ…gýž“v^ºn2cÇ–“[¼ûƒ¨$Z´¬IéÖ-ä‡ê’R£:‘~·òP³úDçoá«™ïóöŒoÉËY×9Lêʘ?_A {îsÜõe>ÅQ‡iÓ'%é'W~Èsr¡Ž­¨S¼‹Fÿ†?w9Úáí|=s*ÞYBä0ׇpÎBž{¾ ã~5šÇ®øþ³]sŸaÌ繎&¨lÑI¤$Å›X—}°i*عn3E4$2Ô»ZIDAT)9‰hØw´^¨mS€Í X¶óû½5¦ï-w0¸uˆì/pï„…§¦2¸Ãɤ6ŽåÝÍy¾«@•û·¨%$I’¤ŸY ‘öCGrÊW/1qÙ¾‘²]ìÈ.¤< T¿-—Üú;®IYÆKo­¤$®&å;w°}Å<ýУ<óá&š ¸•ÛÎiðÃSaáÜÜ{í-Œ÷&Ú_Í­ç4 ê0mØ !I•æ`ç丄XªÕìDû¢OyäÎ[õÐGœ~ ·ž—Bôa®QõÎà†kOfÝ1êÆQŒºÿ-Öµ½ŠzÖÃÁa•½#‹ÙU TK")t°îÕ ¡šI„€’üãˆ!”QÊÁC‚åP^VB9Š!`ÕUÉ $I’$ég¾-«Óu#›¤ñì”5í¨ÄÔ£Ó€Ûxäî·a¿û2i;+(ßúŒÇsŸ~͆ôm|›ö./LË渞iÚøxZ¦Ä}Ó.#gÝlÞ™»‹¦#>xè6%I?ýy>®á¡Ïɱa"E‹™ø޶擻a>“§eШKZõ8Ôõ!Š:{ÒrçÇLœ±Žœ’rÖÎä²iÕ«uM *WÙV­)‡à‰ôûE£§ŠiÄ™çŸH Ö}¹ýßP@y6³'‘œØä !DS÷Ä&T§˜ôÌG‰¨Ò9õ$I’$ý¬ª‘ܹ55SNæéC„QQAà·Œo?‡ïžFÃk~Ëe¡Ù<û?O²¤1aÜë)à`"§¨©lá|–½ó1[ÛžOã_ÞέÁ ¼ôñ 2‹¡zýTÎ~%¿L —0myÞüeÛX¶óÏïΨ»ºŸÜ/$€`Íö\Ú»>äÏgÖúRk®JgP I’$I?«VNø·WÛÓÕ¢õ5c˜õW–Âf—ss‹u¼ñð\2bjQ¿Þ÷?.Ë£(æD.¾î"Žõ>\²HrW†žW›oß]Ä7kbØÞ¯—wßÀ¤/vR½E/w °äùÕ„[`À!ÚÜ™SìS‹’ô“*'sÉb¶÷?ø99{C6 Í°§‘ýÞ žÎÐskòí”ÌY4›%‡¸>äÄtâŒó/fXŸu¼4{ &=~n-ÖLý’«t¥ÿÁc1æʤö¿™‡ûC8 Á½ço‰ëÄà ç°þ­•äEö=&6}üszÜDÄ dMgük‹v‡âšÎÐë†Ó)¶„åÞç›"£U¾@«Ôöi’$I’t̨N»[äÊÌǸsâfêõËýÕ?ðÇ6Nâö{çl!#/éNëF „s6°èŸo1ñÓµäC£.—2ô¼œÔ8‰ðÎïXðáLšµ•Z®ÍÏØaR I?­À¡ÎÉ) CLÝŽ\~Õ%ôhY—PÁ¾ø盼òÑjv…u}XO)j´êÅ°A}èÜ4vmbñGoñÚÇköû=UâŽ%¾éi\páÙœ~J3jÅD(ܹ™•i3ø×ú]׋ÆÁ›?z‚?M^I^xßß ¥ôä†;Ñ¡) sËNÊbë“R'”°ê½¿ðøßRèþÔÑ8š $I’$I’$é§$¡õÅŒ¾½M‚¬~í.þ4cû/6VoDÇÞ}8»skš7H X”ÅÆo–0ë£O™·Áwèè1($I’$I’¤Ÿ\„Vý¸åªŽdOy‚¿~žmÇ¿ŽY’$I’$I’$UaAK I’$I’$IRÕeP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRfP I’$I’$IRm $I’$éè)ÈÛe$I’Žqñ5«Ô÷5($I’¤£¨vݺA’$éWRRZ¥¾¯SI’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…H’$I’$I’T…E[I’$I’$IúDÕ y‡.œÖ¦)õâlßÀŠ…i|±!Š#j @tb mNnE³zñ‹v²iÍ –¯Ï¦,byuôZ¥¶÷“$I’¤£$ªf$Iú¯ ZƒÓvãºÖ ì·,Bæ‚×ùË É8\oT§\8’+û´ a¿E%çðÚ‹ïðyfvÞþ̳ߵcôè6Ìx{=td焘\ýl†õ?“ÄUšÍ·óßå…)KØQC½1ò—ÝhY'Âö•ó™›·gdD€P£Î\:ø|º¶¨CµÂ­|ùÉd^ûø[ jõàwGºŽFR©qb/† <‹¶Éqe¬bæä‰|¸"—r$œpCžM»Æ‰Tdo`ñG“ykΊÿúyìI::"¹K˜øÌlV¯Î $KTa…¥e”U>̲èÝèsÜV¦Ü5›os#µ€—ï_EÍ@þîéh„šŸËµg•°pk9­,õÑÓˆ.jüã­´C‚ÝÊ2ðæ´3¹çâœÖ¥ïmÜÈ>QA ‰Žçu$.ü¯½6w¯ …s®»ËNªFÎÂÉL«ÖÁízÓ½áBþ¾µÜº«R-$I’$cN¢wÊ þúÇßs÷¤wÑM\ßrûãïøį©söEt®$X÷t®¿îtJ>}š;ïÇK«šÒ¿{]˜Ü¨<“OŸÏô»˜û—q<½80ˆoÀÞ1Ì™0ž)Y­qE7Jÿõc~ó;Æ<=‹p×ôk"&¥7·\݉‚OŸfôãx~q"gZ“h ×’A¿Èqë¦0îŽß2毋ˆís=7ô¨MÔ¿±ŽnVkwåºÏ‚™Ïñ?wÞdz3KéyÝ÷S<’:qÕMçQcÉ«ŒýÍhä_^ÇÐÔ„ïor°~’t´”ç¬eÙÊ JNãÎ'äáÿJ‹ymY>e‡\V@¨Ñ‰Ô)ÞEÃ~£øÓãOòÜcàæ>Mˆ–‚q-¸äŠSÙ4i ³}äü¨‰N¤QP²…ïrÖ_Aöú-I|R»Z}R[²b÷~ „Rèuýžàeþôê,Òæ­£œº´N©NÀª«’ù—‘$I’$kʶ1ýŸËØ^Rȶ¯–°µ|³¦-f[Q_/asiˆ¤P5v9“¦[>àÍù›È-ÜÅw³§2mkäˆ;‘]¤½>•Ù+7“•ý5¯Ü÷'^œû;‹K(-)¢¸"DPˆ&=ºQçÛ©Lœý;ósX?*“×”!@ÂI½95<Ÿ×?üŠŒ‚"v¬žÁÄvÒ¼[+ƒGºŽý·8š]ÎâøÌi¼9w9ùY¬ž5™ç&Î'³"ŠÚíÎ椼¼ñÉ*² É\ñ1çWÐþœ–$Ž´~ÞK:ú»>çÁ›ÍMfcÛ‘ÜtVý:‘¶,.>–˜¤´-žÁ¿¿“;û”‚Ó®à¦>ÉDjÐvàPR¿~•7¿Ê÷…·GuG“W Ä$‘Tí`ד ¡¤Dª%ù%¾3"C((-¢„C‚Ë[í ³³*ÊJ(¢C1Ö\•Î©‡$I’$éX.¥°ôûÿŒ„ÃDÂ¥îyb$B8 Eúq”dfýøBËŠÒsÊŽ¼³¨<—Í{ž„ GQ«]?®8í8jE±#3—„(È&H|ênÙÎïR “•^HEl¸ºIT«u<·?pÚ!QÕˆdÖ 6Px„ëØ_5êÅS–•¹×:sYµ ˆ¦Ií8"9[øñ!Îrr¶ä@«ZÄ °~’t´‰mÐŒ”¨tÖn-".#wý<ÞŸß‹Ñ£îŠx‚[Öœêó*ˆ/á­–²­ÈOãÝOzrw÷v´ÌmÂДE<ýðZ #!Ë|4•¥³d]9]ROàÜ ùbÚÖ}§ŠiÈ}[¤‚ï–gpÀ+ˆÊrØ”mê·$¹FM¯u@HÑÔ9¡1Õ)&s{A*A$I’$ýW S˜]B¨Eª¿¥$ ãiP3†À¶#o%Ðn¿ê[ƤÇÿÌ‚­…„£“¹xl &G q)õˆ n 7 «S·aQ¹Š²ó)Ùº€û˜NfÅ÷mÅ$5¢a(›ŒŠNG¸ŽýUP]LL›:Ä 8kÒ¶Ï$-ý˜¯whŸLRôR vw¦ÔLI‚ü\ŠÂ>u)éX¤fÇ!ÜÞvcšGv Š˜ØÂeÔè0„Ûº¬”üÌt "±Dÿ0§\€`t*4hߊ¤ä6Œ~¤DEÛy¢mß;‘Õ%V¾ò.Áù,o:ÛRû’r᯸)ð §Cf T¯×šsà¢d p)¯È;pDAy:Ÿ/Ê¢oŸnÜ0¦ ñ5‚û…HjKÿ³ëAAsx²Tg*I’$IÒ¡2¶ÍŸCzÓ Ð¥1‰±‰4ïÑŸ¾ÉïŸ: ÆÒä”NthÿãTD ¡CM¹]¨ŠBò J‰ãhÖ­/ÝëV'&TÁæ9óØÑâ÷8Ž:ñI4ëöK.91“÷Ít–'öahïVÔOˆ£îñÝqçm 9)îßXG}¶·œŒÏg³9åtoJR(ŽäÓ.fø¹'UVÆÎå3X•tƒ{µ N\,õRû0äô–M_I¾\J:攳}鲚œÏ%Ý“—@ƒÔÞ\Þ–ÍXÉúC.[CÎÆy|^”Ê ‹;Ó$1žÚ'þ‚çÔdí¬Ï™ÿÒ=Œs7¿{cÆþ‰—Ö”“·àyîzø]Ö•ZõJ¿ oþˆ§_[J.q´éw=÷=öÏ>õOÞ}=í¹Æuà²óvO‹·ß1±åÓ)ÌσøAÈúŒç'}±;$פ#o»‚±%¬˜úVyqSåsD$I’$ý—*ÏøŒg^LàŠ·òÈRÖ/˜Æ´U­èU&¬C—#éúÕŸY±¡€ÒòlV­Ìçê›ïå¶ ÷ðäÚ½[ŠP°|2“Û_ɵã…¼tVÏû„©ó’6âº{Ž§^ˆeÄ/oâAv¬žËûßÈEÉÉÿšWŸzŸƒ†1ö¢$bŠ2øê³ <;wIG¾Žž¾Kݽ·7c6㟋cø€›xpH,e;VñÙ„—™&Âb^x&‰¡—_ŽýˆändÑ;ÏòæWù„=.$ƒçëmŸðÌËq ìs÷K"œ½ž…SÆóöò|Ê"‡^ç3åñ—‰ ¿ˆß<0‚j[ùòãçxqNÅa(.س†ê䕆©(Î#;·rK~4ö*™ó^ä›:sîy=éšÚ”š1Š²·°jáLfnLaÀUg’ÒëF~Í3<úÎ*ò÷ZÎÿš‰O¼MܨËhW÷LîxäT¶o˦¬z=’k‡€RÖ|0žçÓ²qÆ< V©í¤$I’$é( …ªýdmE×nM§¦¹,[¶õû÷jÓsôz̹ûgg;Ÿ±$I?› ­.äö[zÑ8XÁ·“Æñè¬,*öÿ©PCÚŸÝ‹žN¢Y½x‚Å;Ø´r)s¦Ï mc!ÁϨ¤¤j ÍqD$I’$ý·ªÞŒóG¶¥ÁSOóþºj|}mgÖêB!„B!„(EQðññ!66–N:¡ëz“}9Òÿ#„m§%÷á Áy-<Øív²²²8xð #GŽ$,, UUÏgB!„B!„ÂIš¦‘ššÊúõëñôô$,,ŒŠŠŠF÷‘þ!„h;-¹;cíêÕäåæ6ø=?FÓªöç³:RUUÅÑ£G5j½zõ:oÇB!„B!„-ãç燧§'+W®$**ŠòòòF·—þ!„h[ͽ;#7'‡»ï»£Áï½þê[­UÑìeeåáç냋‹K³öÕu¢¢"BCC›{X!„B!„Bñ; §°°Ð©‘ Òÿ#„m¯9÷aghÕS6UÖûº—— Z VhÖˆ‡ìœ\òòó ð÷'%5NÑ‘Í:˜®ë(Š"ÃëDëÙ‹8²y;齉ïÐvs†év¬šŠÉ ´U‹ »Õ†b2q>? ºµ”‚";~^˜Z{zÎä¿Ísé\Þ4› ŒÆóšÛf9/טB!„âBQ^˜À¡_& ݉ñ5î>Ý·XÓY´~k®¥ÀZ€»fÝÌÀðÜ<úfbBcHÉIÁf·U»¯ÑhDQ§×x8½ÿgK‚³ß@^qóböó„¿^q].üùÌÿgéVÊ­ÜÌìoâõhåÙ?YE‡Ø0Ü/º_Íu¬eå(îîçw~}q^4ç>ì MÓÐÑÑt­Þ×utÇ÷Zy §î6›cÇOP^^N§¨(|¼½)**jÙ,:”——sèÐ!Ö®]ËÒ¥KYºt)k×®åСCm2”D´oö¼]¬X¹ž„Ê2vòO½¾‚ÔªV¶™»‰÷ž~šv¡5½y •“ðÙ³<õÚ/dZÏÙAΤ³ûÃxuÑvòí­o®6ÿÖ†‹mŸKgòVΑϟeþk«Îon›áü\cB!„Bˆ Iê¾ùtˆ½’˜+IÝóØi¼øÝ‹Œyy Çôc\2ôæ\6‡«¦\Åèa£É2g1æ?cxæ«gX¹k%Þ‰gô£Îh§9’ž¾mCEÕS†ÀuãT^¸]eí3*ÿYåO—«„8¶É+vì{Á³%óþÔ@Ü{þ™Í¥¿w0çõÈË ³Xµ0•Vu7œ¯üié|<6„.ÓÞ$±•ýHž|~¸Ô·²[ºN/Zmù@¿cÄØ5½ÞK×i“MFZRRʱãÉxxXFÓulv;v»­ET”¦K‰iii¬]»–¢¢"|}}éܹ3aaaDEE‘˜˜Èš5kHMMmÞµ6þ#Wc^9vzìvr7¾Èu‚1¸„ æ¦W6“ßhÏ`Kö9±èe$~ÿ ·ŽîŠŸÉˆÑèBpŸY<úÝqN ’Ñ)=ü¿|áFŒFþÝ&04v i¥$o\Ì[/ÌçÉ'Ÿä™—òÃöt*ôSíVå`õçoñâÓOòä“ÿäÙ±lw6Uú9h§NŽòì%—0úÇX°WV9^­ýÂßæM§có–¹pie$oßÌÎ#yXÏË Òô4JDxʬàG¤¯éÌÍëæß³} £B!„BˆßCÖ‘wè{Š– ¶„v›Kæ‘wÎk /-y‰ µ„]QXVHAA‰‰‰¬ûuëׯ'íxùù•ѳso®y#š®£rfçVMŸN[ôÿD‡Âä¾°÷˜ãß:ðÞr “f i‡¿kš:sïºbÊŽ½ÉÏ6jÓžÃú·_áý¥‰”_ …‡6s.òw!ú_zOÅY¥§§óôÓO3tèP>ýôS«Ž;²sçN|}}qww?K‹:…kî%nü[$ºõfú(~X{ú&¬ùÇ?ùM‹gÁªÅÜmëUtÞþ1Ÿ 7.dôé7¼–ìs®bQ¼ûÖ>)†ÚÿÜ}©/}ú?Íç_&ð÷þ}quÀß¾\ÆÝÇÒÃË‘ÿû¯aH×ùúíí¼:qg„[y‚u3P#grýô~x©@(\ó°|í&2úL!̈«o``@4.Ž£ííË» Vpp{:S:wÂ¥­Ú©š-o?{ó§Çàè÷V‘éò[ÃJ~røöÄß`£àD.ºwo‚\ÏLì™ùB!„B¡Ù«È8ô*•¥Ç±–§c­È ¬`ƒ¯8 ÚAÐò í>m_÷¦(c9&טÜB1[:Òí>Tƒk›Çt8å0¯®z‘aG“[‹ÝfgÇÎ9–€‹Ý„›Ù_7¯Ã7ÌŸ¸qøzù‚Ý€ªœù _k¦Z:]hõTJþ^§¾–•eàÖ^,TŒ˜ ¿wí˜äOüX±b=ô‹…õë×STTĤI“°Ùl¬]»‹ÅÂÔ©Sù÷¿ÿÍĉëíߦS-iº¦c·Ÿ¶ÆƒÖ6#ÎX\º°¨ˆÌ¬l<-¸ºº`³ÛQ4 EQÛÕÕ‡îÝ‹!éu+ šÆÉ”TüýýxógJÝ“:Ò@ß=íeñë»È+¬l8>€Ì¥¼2iõ?"¹æ¯7ÓÕµó3ù5p$Cü³Ø¾eDz˰+î÷Ŭ©ƒèàÒðgΚ¾‚×ÞÙÄ©ÕZVñÚS«êlño?½¸ÛîerhÍȇÓòߌ\V&/çã¯w’V\(¸v!nòt†G[ª§kÒ(;¹‰¥Ksä#–À.Œ¹æ2ø6#o¥I¬úïROæQ‰ߨ~Œœ2–>æ:ŸÒäͬ\¹™ý©EØT ºbìÄáÄxš³•ì­ËY¾#‘Ô¬B*uP,˜:g6}4'¯1!„B!ÄÅ qãMÌ.„÷üF—` FƒE1¡µbâ®>Ž­üUåÇ©*K#ýÐBJ²¥ëèïÚ<¦OÖ}B€%ÒŠRJ+JÙ»o/ÙYiøzXÚm$ÅÀ¯{VSP‘ËŠã+Ùc$®º+J•‚¡þ›æ..ݘÄ4Ðu˜Ô_eã>Çoþ5{¬Û.·“»á?Ü7ï¾Þ•… {Ì`þ73·ãqžØGL¯¸ùn]3i ãéx{ÿ·k/OöÒØÿÆŸøó»?³yï Š4P'ðÚ†…øÜÎìãdó¡è`#{ýk<ü·—ùrã Êp£Ã€ëxõÛ×¹,Ô@Ѻû™xýûlK/Tü{ÎྗÞà‘±AÔëßýG:»þ±ú£ø:w3½q~ÿZå Ǿq ·GCÚÊçyðáWùfW6·Ž ¿éq^ö&zXªß½œ£_ýƒ?>þ.+ Á=’¡ÃüHºÔ£”mOÝÌmâ@B†cŠo·HÆüáïÜÛu/ï,ø„Ur°ªþô¹æqÞí.úy) çòåèà:ù«ÓΑ J4@ñ£×eðŸ×þÂèÀš3´6·Sld­{•‡y™/7§Pa ¢ß¬»øçó1%Â\ïúÉÙø<ò_lH¦0ùFÒcàdîã?Ümjâkí{ÚHÛª›K]Äõ=?à艢³äLü^Ž=ÊwÞÉUW]ŲeËèر#YYYÌš5‹ÜÜ\Ö®]Kdd$ÉÉÉLš4‰;３+VSÛF[..]3ºÁ~Zß{Í×Z{ŒÚv»FfV6%%%xxX0Tlv;ª¢ ¨* (õç‘:}j&ÍnÇfk|U×ƪ2iii“™™I^^ÇÇfkx-‰ôôt ÀÁƒ)<€1tÿ÷(€•„¾oÏÙÇÞ|دÚÐT|ºõ!ˆ-ì:T€v‰{½yì[²Ï¹Š¥–n£¼8ŸŒÃ«yï¡'Øï=•·çv£á‡tò7}ʆrè;£7ž€n+&3φݞEU'Âä†(-ªDƒê››7?7 ›‚r{íWë¶[žº“Vî„PÚ¨Z¶\öíËG Ng2¡ÛÈO7’·š\Û³É1ô'nÜ Ìiìݼ…ïÞχ;¯¡¯· èT$¯àý·ïË1Cð¨LaÏæµ,:™Ç5˜E×êk«©˜Ñ­díÛARv }FL Ô¢PYf"ÂCq:/B!„Bˆ‹ƒÙ‰ÙÅ7ïAgßHuG±ÂhLÃäé‚Åï2rN,C5Gœ“˜6$¬C·C^AE…E¤¦œÄßÇ‹µOo"&4†]I»˜²-zo…àÈ ŠÅ”—”S˜_ˆÒ@ß[ŽxÈÈ×WhÜ=Iå† *hŒï§òÙX¿»¹gê<-û{n›ú?„]Íß_ŸFŒK!IŠèâ×ठgÒË8ðÙ{ü¼¯×?ò,qÁŠrÜlâPý )X÷WFŒ}…£áã¸ã±{ˆu+%%ÅB”£ÄäÛ‰økÿÂìÎÁ˜ò¶ññ¿ßã3K‰:ü#7„Õé+ ¿…WŸL  ˜B\ýLªÓû7»¼•÷2lòÛ¤÷¸Žÿ{y–Ëxêõ¹Œ) `ÿ‡ÓPíd|;—a³¿ °Ûe<0ÁUGXõßw¨·´^Á±ß²%©sÿ }}ªH^ù/¾|« aä­·óä\Š¶|À³Ÿþ‘Þý8¸ 3b­i§7·nIÑÓøã?çÑ¡pÿ}ù füz„Å;2+Øèþú0#G¿DBè8î|ü^ºz[I[ó*Ï-ù† ™ÏqC´É¹k¬…ï©sׯ7=.½?DyPzh ¯¾]7gÎäCœ+O<ñ:t !!‘#G²yóf† Â_|A^^Ó§O'55•‘#G’@‡xâ‰'øøãkÛhÛ:º®a·×_^×54­õ… £®ëX­V’O¤:®®.hšŽ E×ÑUªG<(õ(Ñq¬V+••U”——£kW\KNQQº®sòäIÊËϾüºÅb!&&OOOŠŠŠÎº3l%Y”žÁžõæ2xã”da#´^ÇmKö9W±ÔÐ21.|[åúE¯rCTóóöŒ%<0çcr:ÍcñœÎ˜Üb¹ü®ÛɱûÑÁSEµGÓ«¬Üþë¢g×ѽ$ãIŽ|7tíi% ¬øn7e¾C¹¦¿¯£œàÑFíÔä(wûòÂGtÆÃчÜ0K4ƒãã 1 ¢“²€vlçHÑâu?25çk‰bÐ%Cû÷ﯿÃo®ñÌœ6_°wÃ%s+’;!‚~°(.~„GùaÏ>†+¡]ºÐ)ÊŒV˜‡Õn ¨kW:GÕê{FþmNæ0 aÒ„S'Ò#°˜W¾HboF}¼\±§Y¡Ã'1²¯GýÙDkλ±¼y×l3„«gOrjÐÜÝ›·ÞÝÀêMô˜ŠÉžÇŽ¥[Èwï͵s.¥‹EtvYÎ[laùæx: ÆèD̵<:1dØ%Õq¶lÖ:™!„B!ÄÅ!¬÷£YwÅ·Ðyè«8f*2hÅèö °@·T즑$¬¹›ÍJ×Ág_H455•Ç{Œªª3c2›Í<ùä“„……5¸ïÁÌ}øºc+,$+' ƒ]å’ u<=›_š‡Ýʧ¯¶ÌJ’ “(Î,F/ÕÛuüíÕ[¼)ÎtŽ}±ÖíÓˆ †Wçª$çÂ=¯5=Ú¡59©JùÝ¥÷È‹^|®æ_·qU÷t:]õ3‹vsC˜Ï© ý0õò+‰4¶pÿ¦b¯:Ì¿x›“~×±dõLõWAŸÍÀÊnŒÿ_|ÿ¯ÉÜpˆ·ù‚Ü;XùëFû8~ϽïÊ`úöyòÌcæŽç9Ž1wôŒãEŸ¿òÞ÷9:¿­³ðÙׇ~XÌáçâx¶™Æ‚Æp×_¬ŽõNÆ©]óîÛü”2—{By§©¸*ÀœÎz”÷þ´€$ÿÙ|»ñC¦::œî˜~?ýF/àÁÿ<ȤgúâjMbáŸ^"Ák‹6ÁÕ!Ž¶ cÖðÒ’]µÍ9uµð=m´íšeØ4þöÔß«sv;céʨ·«s%•‡ßËŠ+X¹r%W\q!A”WY),,¤´´“ÉDpp0 Øl6¼½½é@zV6‹/fÅŠµS.5ç>Ü­ză­Z[ŽxÐu»Ý±`´ÑhÄ`08^ªMÕsûÕŒv¨]xÂŽfwTElvŠâ(F4¦©¡võ4±ÙlX,E¡¤¤„N:Lqqq›$ù¬±ž§}Ú¢]Õ2oüü I»YñÞó,¼nùeÛY|KuËöœUüuÂ|\4–ÿ¬˜Ï0¯š–Ì>!Õƒ?ƒ?qW^JÎçß³áó7ØPïh¾x»Õÿ©•cåÇŸ³»2šÉ7Œ!¢fzŸ¶j9{÷S D0ª³GÃ#?äB`L ÊŽl²Kìhê òÀ3®aôÒ“Ê·¾ý3Ûq ¾1ÛÃŽ4’ómô÷2£Xb™4£‰Ÿ¯bQ*xÇÝÂè×f\ f: lwÄwæ‚M0ùé¯ò[f¥v…ƒ¡A.p8²&þÏf+J§Ox9nö¢tŠð"ÆûôFgæ_+s.—õéè:¸DàÍÊK­è¸bðŽ¢£ÛFö.ÿŠ•ŒgHÏ0¼ŒµyZÞ¼O}G©ó7sPozûm`]Ò1Šì¡ø•à`x L´åÔõï:~~[X›p”ÂÑÁø×û¿IÃ1Ÿ-º–åE!„BÑžMžtóǶÜÍŽïÐ{üÙ„nM½tÇs኱#6Ãö/Ÿ»ß@bG½‡ª6üà @XX7ß|3Ÿþ9Ý»wÇ`0`·Û9xð ×\sÍY;Ø**+IÎN#X]¬˜<ʪÊj¿?¦÷XN¼’Eai!::ÕÑd2˜ðt?ó—Ó¦útZ²mFŽãU< b:Ààî°õ`ãû´&'.‘cæûŸþi6éO3ïê¡„ŸƒßÛ´ì |µ‚︇q êÓÑ4ðîO$?‘ŸS††O3ú=Z·¿–½o€ß·0ÄREE€™îSûc~o k+¸IßÈOG!äž[âS7_Näέ#»yqÏA2«pLÐÓ–$’cœZâÄ“^“{¢¾»Ÿ}éUh¦¦ã¾5ÌÒT£hÙ¿²x¯ã½[û^)x¾[bðÏ–sâɾÄälà«]àËýL 9{A£m®±†ßÓæ·íA‰=Pßvä )<ünž}öYFÁŽu+Q5+ÑQ™5c:_|µG¡°¸¸˜k®º’ä]8vüšjbôÈ<ûì³µ…‡æ܇kèºÎç_~Eii½ñIôíÛÛ1á´54M§Wïž¼·ðƒz_÷öòâÊ+.wú¸F“ÉDçNQ¤§g“—‡ÉhÄh4*> ¨ªŠ¢*¨ŠBÍMEAAUtTT]EQÔ& U¼ÝÜÜjG0DGGãí퇇‡ÆÇLJ””4MÃ`0PPP@vvv# K;™ <€œ¬ìPÛIo/΢èxÚ胖îs®b©e ¢ï˜iô3«n¸”Îq}xô‘gØzÕ[ÄWßcµü_y|â^>:˜Ç×~Å=ÝÝÎÖš#¿>̼³'ãó²É¯O3i߼η©„yžŠD/?Ášÿ˦¼PFÝr5ƒMç¤l9ìÝ_€1ŠN M³ÔÕì‚;V»Ž^YBàêéÒèa­²ˆJ |÷Ç<Æ0O•’ªš¥‚{xO"]öq¨ÒL`˜æfÞêÆ×| F#Ø«8µ»‚ÑÕš­ÁQ%è6»•¢ô|¬&_\4l6;¥Ù”*ž¸êØl6TƒU¡Áü;›KÇZX¾r;G2Š~£ã‡tM±KqëÌ´[.òì6}÷>¿ýàO—ᓘ:<¦ÎÔcõ9•7ÕO ´”* ´Šb*7o·ú1\ñvŠ‹¨ÐCÓ1ŸóyB!„B\LÕH§¡osô×›È8úáÝÆVV#s²Žü„«w/b†}äT»#GŽdß¾}$%%JZZ={ödäÈ‘î×7|[·m¦Âßþ`t7²%i#‡SÓ5¼+iyiÜûÖ=<×óøºùájrÅÕØp/p[NµàéÃ{Bˆ¯Ê¾ ÏݤòÔbŸ·5¾oKs¢øMâµ|ÿ£¼}Ø»womUfÛ¶m‘‘‘Q»ÈuKzÒËm?L¡6W@£àðn²dfwß3:[²Ï¹Š¥A.QŒº$ÞÝGR‰N¼E[ËFQ9 IDAT2Ý8íéŸVþÈß⼜{"_1àîßwÀž»‰¯“5L±ý«ù?ˆVÀîoñk¦?Coºž‘a. ·Ûíز÷°¿P%|L'<š]Ü;µƒêâ… P˜_^g݉ö0{`,½frÅ`ÿÓ¶Sq ¬þ1£—qtåÒBé”IÂ?²/òÇ-ˆ”ê÷Ùùÿè4”Ž¦* ÖŒ•u—ÎæÓž®÷ýoþó ßàY»¸tCùw6—Zþ¾üd iý{YB½Mزv°ä§½õÎÂØ›‰7öbtn"[×,cÕÚEäs·<Û N\Z個'.*¨.ž¸E…§Ål¯ °pulç\Ì s6/B!„Bˆ‹“­*ÿñ z ˜ºê( ƒê‰‡_oòÓ75«Í¹sçòÈ#””„ÙlfîܹMî3±ÏdvîÙ~6ÍSÃÝËƨcLìttVíYÁèøalÌú•p‚ÝCè`&ÄçÌG®TUuzqé¦:ÇFô…»&©<½XcÙ ]‡ð¯U¾Tew¢FV~ÛçMiI¿Eà Õì£;·3ŒÞŽs;‘œWÿܬy$ç>axÁ` ÀÈN/ÂFc9hä{ØÜÊ÷´‘¶ >K8§r&~?eeeTU(­L¡ìD>îfð ™„®ë¬X±€Þ½{ãånÂ#ý Å™6¬e*v=«õÔÄ‘#‡IJ:ÊÉäd2ÒÓ(..Æ××÷ŒƒÔÕØM¥K—.¨ªJJJJíèMÓpuu%((WWW4MCQ QU•®]»:}² rïÃuã½Ð6¾Á·'ª+¡Ö$¾zs+øNäêžî€NiòN¶-rÜZ²Ï¹Š¥!I¬Ú ¾±t´(€Förÿ2;c^_Â3£ý(`èTdžWÙàmH+=Æê¯~&ƒ †‹u,xŒNé‘,?ª5m6ã¢Üšìny;V²÷ H`@´‡sE“³P,t‚Òý8\|öwGµDë¥i¹˜ƒÃ‰ˆˆ¨ó #ÀU­Ž}9ßí¶Ñuæ5\yí¢µ#üøý 5ǹ5–׆lÆâ‚ã?:ö&·v’âø9£Ù¨iÒèǵ7Ï¢¯¸ÄNåÆ[oåÖ›¯`°¨¸áÖ[¹uÎl†9[þÍ¥­ ™,Ý@§q‰ïCTÇH¢;Ó𘳠Ãf^Æ ÈNʤ²Åç­Szl» À·['¼  X:Ò#Jlãx™^»]eúvåOl >†æÆ|Ú8™!„B!ÄÅG×uŠs¶àîÛÅŽâ:œòr/ÊJ\Q\‡£"póéKIÎVt͹'²\\\xðÁ±Ùl<øàƒµOÈ6æÒ!—bô2áf1aðPp5šÐÌsa·a5û k‰êMIxÛr6°3g+»3vPe;síh»©–|<áñ+Uþ¢±/jú±2ràþ÷¿CE‡4}Œ–ääØÉü彸#ü¼‡"ƒ?Ýb=áèr~Mwþ½iˆ!0ži±ñåk¬Î>ó÷ŠckÙ§™™ðô <8{ cFŒbܸ~ø×kÄ“ O ;ìªìïl¬A—05²·&`és ñññu^qtó1 ã²^õÅó|ŸÖºÜ´gâ>“R=«C5Ô a\Ñ 2¿Ášœš÷J§hû{|x"§M"҆ࡌ€ÔÅ°µÐ™^ž®1µ­ÞÓÚ–ºÂí¦›n¢Àn$:n"Þ}§6y;çqÕUWáïï¿¿?W]u;ç6y¾fÖgv7ÝtSm;-*Øžž^ŒOròIÖ®ý•@OŒF»¦5ø2Uý=Y½z'O¤?t‹sżƆªƒNÑQdçä––Ž——7nîŽî¶šQ:0ì’Kl´¥#, C‡eݺu8p€ÐÐÐÚd†……qàÀ‚ƒƒQU•ÌÌLâãã±Xšž«­QŠ£”¸oþÊ=®åÄCÑÖ¿ÎsÛL {éïŒð=ï'nì3‹%•£X˜´‚C[²Ï<·$Ÿí<<óo¤ôAÿ(_ %'Øüõ;|yÐÀ §þJœ e±ü¥%» !Þ¼…ÅŸm9uLcqSÇ­å›7?å°-’Yón¤¯§BEv" '²ÉMOdÿî$òìþô¿r6ªÕé¥$þv˜Jc ©Ü—zª]ÕBXl¾&Ú¦²Ù} 5bš?Ü¡>ƒ?§ a燛ùú­IØ••Êœ£Á©º1€Áû°ã³ ,|7›=#ñsS±–PìÖŸñC‚0Tgõ{©ŠžÉäîžÕ¾LŸ°›×–.gÙÁ®ê”^?¯Î|>7B»Â/Ûøî7„š(Ï+#8~=¼ZxΊo?WHÝÚ LŒïŠ¿Ù‡àÀtŠÊ{t%*Â¥2‘ßJÁpW¢"ꨬgÉ¿“¹4úD¨àèòïYK€»­0•2N-Í`ÏßÅòõ9x‡âeÒ(Ißþðîåß¼…ÚKŽ±uã&:¸é”gaÇŽã”zõgf\c8¨Áþ“ãØþÑ>{¿‚!ý"±T¦±gÓ~ -½¹z¨c;͉˜ÏÊÙkL!„BqÑ)/<€jpÁìÞ›­„“;ç“•´U1á×qûþ“{FW?Jówãá?Ðé¶ÃÂÂxöÙgñòrî—ÃîÝyäò¿óâʧ( ¯ÀÍlÄâbÂè¢`ö7cuµS¦Wa/KÃ\nÄ„‘Ï–}Iô 1DDÑ^[x “±ÎƒØuäAI%$g9uŠÍΉ5éCþôô¢âzf±’¹ý>Ï„ˆÙ±x( ¾ç:B¿z‹»Ç_Á¡[Fåa'íçc8ñ›`}.ݹëù›xgÖG̘ÊÜ9Sè姓{<‹NwÏçºèQôT¿béý·óرitówÁ~r3Ù@dMª/ƒ¦÷€GßdÎ~Ü6ØBî‘lúþõi.ufÿfÄz÷s7ðîeÏ2jèAn¿z±þFʳ‘ê?—Ý× WsþðÊyì+\ß,?ß1‹~ÁFŠ,%èÖÜc¶gâ>}ÕƒŽ1>°å¿<ñÜ0žp±î1ÌýϽ¼=~³†1ïÖ‘må¿ÿù‚A³ùêþÞŽv\{sÏcxóö7™6®”?ßOPé>~xg6‚jÑè5fhÝ{Úøõ{^².Zhþüù”••ñýO?±5(ä“k™>}:Ï<óLí6Ï<ó óæÍãîùïNzfÓ¦McþüùµÛ´tÄ€·—£†Ç³ò—5(ŠÂ°a—’ž‡ÕVÿÉg“Ñ@p€7ë×oäÈ‘D&Žƒ—§w³Ùè´lxzx˜˜Deeþþ :F>(-|漩¡vÑÑÑèºÎ† X¿~=!!!Øív222pww§ªªŠüü|† Fttt‹b8K·y,ùÙν÷=˳} þ}¹æ¹OxõžÇ°)×`ºG»ðcywÂÝÕïs.bÑ53!áV–,úŸåTn„öσþ“Gg÷pÜ«2ØwRƒÊßxê¶ßN;b?$mæÎ >FŽØñ69FI\Á·kòq÷ë@Ä ÉL2€(ã©wÞ^BV‘¶Ö-I9­ÝLwƒ¼õ6i§oé«t¥Õ7R×È Ì™ãË/«¶°ýJv\ñ Ž%6Ð\›Š¥Ë n»>€•k¶³kmU€Á=€ÈÁ½Ð°‘¿y;J‚{c/¼U¾ý§2|ë[¬ûùWÒnïsZ^aÀ?î ¦fÚ}ëX±̾1ŒÔš'çÍDŒžÂ€œåìÚ´“¼!Ýð7-ÿ8Ùš7ý:8F™Ø Oiu'*ܳިköÙòï\.ß\yM ?­ÚΆe£uŒnxt$ÂÇqÒmå§îbÇ®2Ç÷]ýˆ<“)£;`¢¼éSTŒøuîJHÉIö­]áˆÃìCxß \6.Ž¨: I»EMäÖ›¼øùçÍlý%»êNPì(®<Œ.ÕëW¨NÄÜH0N^cB!„Bˆ‹ÝZˆf-##ámNî™oØ úÍØ¢9¹ëQv~Û“ð¾¢Ù*°[ ›Ý¾³ì5˜õ«v¯âHòLÝÀd2 XŠ*¨ð°¡h îE&Ü2ÒY·9h¯ÞŒìÙð: mµÆCb*¤åÃUŽeh9éøºL ‹79F?8«99±W䑱åÞû €w £ïz—ÿ17܆?ÏÊÍÜóøB^yüG\ü¢è3~|›3‘®Jà´·Ø´´ =ö&‹æ?D9à5–n²cì7—ϧqïßÞáßó¾vÌNàêKX×á\ÒѵúwF3]ïý„×ÜÌcŸÎçÏŸ‚G§ÉüíNÆžÎìï,A3ÞfóOÝxèoñÁ“ßS ˜º2ú®ÙŽ<¡à3ò96¬ïÌßþö _<ý˜|ˆì;•)Ý=~‡5‰ûtÄ?ñ s=À/-äŽ?^J, ¾£ŸgýÊpþüÐ˼þè÷Tè5ýï|ûÒÃL®yßDÞü9ëlᾧ>áŸ÷ ^±Ä÷ †d#®FGÖ›ºÆZóž6ÞvÞ9ηh WWW^ýut]'77ÿ3F/¸»»óÎ;ï4ºMKÖx¨¡( ~¾þŒ9œŸ–¯DUU†#édvmQAUÂ:ø²ñ·ÍìÞ½ÉÆâëã×¢‘ÊÞ½{›,UèºNJj*¹¹y„††âêêƾ½{ˆoxÄÃÙ”——sðàA¦M›V»Z÷Ù”””pèÐ!Nœ8Aqq1žžžtìØ‘nݺááѼ¡¢=³’ºtïíàòy7ÐKJ¸ç™ä_!„B!šãèÆ[±WÚóÏxÆ×û^IÎVR÷ÿÕàFÌ°Q”sß]«ë:¯ýøÏüø$„[ íæIE¥þURTr6—â²Û•y“þ̃—>ˆÙÔð¸óO>ù„ñãÇ“—×xgCý?Wþ[!¯øÔ6Þpó•¸Î`×àxäÃê}ÛÕoÏÏC᫇e[q!²rä…tÈ7oà¶pYåQœ[ÎÞ‡£iiéi,ýyÇ_Bÿþ}9šœ @Ld0Ûwìbã†ML™0–а;œj©!áaax{y‘˜t __\ÝÜš=¼Â™Å…jxxx0hÐ  ÔôÆââfÍd÷Áb 'Ôyj]œ7’!„B!„h–˜ø…gýžGÀ`ºŽúê–LµôçËàù¯òJûæ _5]LðVx`–L^/.VN|õ^ØáAtD>.Udìù·ÀëÒϘ"Eqî9{nŒ¢(„taÌÈá¬øe £‘Þ½z°gï~Ö®ý•ÉãÇÒÁ± BKÕÔ|!õxzzÒ§w/ÒÒÒññiæÜvÕTUEÓ¤J-œW•¹›C%:Nj‹i–DsIþ…B!„ââÉc×>Ö¢}ív{³§ZªÛÿ3´‹ÎW·¤óJŠâBa§èøÖ|´Š×2ÊpíЛq~Ì¿þ~¤î αæÞ‡ëª)Ôý3<4ŒQƲté ŒFǼté ÆAh‡Pt]¯½×LµÔœ)—”Ý»wŸ·;xEE©©©ôìÙ“Î;Ÿ¯Ã !„B!„BˆVÈÌÌdË–- 8üüüF·•þ!„h{͹ŸNÓ4ìv;š¦a³Ùjÿ]UUEÒñclß½UUéß»'¢¢1›Í TUÅh4¢ªjí¿Õ¬­e4ñóóãСCxxxت1„B!„B!Ĺ£iÙÙÙlß¾¨¨(***šÜGú„¢í´ä>|¶vl6[íKÓ44M#´CžEÁÃ≦iX­Vìv;F££|`41š7¬ç¼ŽxÐu“ÉDee%)))TVV¶j>*!„B!„Bqî(Š‚‹‹ øúúRXXØä>Òÿ#„m§%÷áÓiš†®ëØíözÖ}Õ«îË`0Ôû³9Ede×®]çõί( nnn¸¸¸4»J"„B!„B!Î/»ÝNEEåååNï#ý?BÑvZrþ½×©–ÀQõ.++£¬¬ì|Z!„B!„BœÒÿ#„ÿÛŒ2ÔM!„B!„B!„mEVöB!„B!„B!D›‘ƒB!„B!„B!ÚŒLµ$„B!„B!„Bˆ6cÜ°aÃïƒB!„B!„B!.Æ_Öoú½câœòóõ%/?ÿ÷Ã)ùyøøúýÞa!„B!„B´¯¾µº òóèÔ©s»‰½½Å ÷eÊTK⢧ë:íå:oO± !„B!„Bˆ‹_{í¯ª‰»½ÄÞÞâ…Ư )<ˆ‹^{úÀ¶§X…B!„B!Äů½öWµ·Žüö/4~m¨ç9!„B!„B!„B\Ädă¸èé´ŸJa{«j !„B!„Bˆ‹[{ê[«K×õv{{‹dª%ñ?®½uæ·§X…B!„B!ÄÅ­½õ­ÕÕÞbooñÂÙû2¥ð .zíéÛžbB!„B!„¿öÚ_ÕÞÖLhoñ‚ŒxÿãÚÓ¶=Å*„B!„B!.~íµ¿ª½uä··xA â\{úÀ¶§X…B!„B!Äů½öWµ·Žüö/HáAü¯ÓÛϺ ííæ"„B!„B!.rí¨o­.]×ÛUìí-^h¼/S=ϱ!„B!„B!„â"&#ÄE¯½"hO± !„B!„Bˆ‹[{ë[««½ÅÞÞâ…³÷e¶²ð àÑç:îœDîš÷X¸%]UQ¥m^ LDL»kºå³ôµÿ²·LAU[8¸D1àÞ‡!q݉ ôÃÇbB«("/7ƒ£»6±åP6•ºÒrÞ†9i¦öômO± !„B!„Bˆ‹_{í¯jok&´·xá¯ñ Uï¯ÙÊ©ªªÄ`v9oÊÍeŽ¾”{¯èDÆw¯òÉá PÎU‘DÇ‘ kE6› &“©ùÍ(ît{-Wôól¤žàPr%F‹?"»04¬ ƒú®å“Ï7“©.ðâCå¤%GnGØö«B!„B!„¸øµ×þªöÖ‘^â5Gqõc)þ~?%–¡´²ÿœj÷¶Û°Ûì¨F ýí×´ê"‰µk•£ÙĹYæBG«þÓn·¡Ùh†æÌaØÒÏJöñåÛ_³;· ¥zD‰âÊà«oezÌ(¦<À; PŒ¦ ¸øÐ69iÑ‘Ûøk ǼÛãð¡õo¼Æ²L½ÍŠmíéf(„B!„B!.~­ê¯RÌÇÍäƉ±x×têE\ö)_lÎÆzÎ oƒŽ|S38¯F¶)Káׯ¿dùÑ2h£Nü–÷ *¸†áòËFÐÝ׈^p”_¾þ–Õ'*OîÞAôºáz´… ùéxªÁÐê˜Òúƒ~ê/z©6T͆ÍnCÕŒ¨ê¹ˆUo0/ÍcÄ'& wtŽýø=»s+1™]1Ž£žÇÎ%ËèuÿL¢zÅâ±nÅŠÚª åÜj‹œ´øÈ­>–Á·7—]‡¾é'¶¸Eâ€7¢ü Â¥C`í¢ŸØW¬¡(-¿É\ÈŸ!„B!„Bñ¿§U}k¦0ÆŽ­StP¼è>~8¡›>å˜ærÎú3u]o]ìª;¦dÞf=#¹Ž±ðïo°[íÇ} cû—Ǹäꛘ±ø}¾K¨@im'~kâ53ê²AØW½ÁÃÛ3°¹F0xÔDæL‹&4È×zõ@†Ýz úÂ÷ù阵öa÷Å|® §†<œJLcm¼¢<|0Ý:v ØÛHy^&iÇöñÛú]¤TPç\»sÉ°~t‰ ÅϵŠÜ£Ûùåçýø^q;ãÕÕ¼ñÞ& tŠÁBXïK>¸ a~˜õJ 3±û×5lJ,ÄŽ'}n¾›i!Ž–;^ý“ÎO//dW™U5àÒ‡a—ô$:$3Ze ¹©‡Øöë¯ìN«„šÎdÕ½‰c)(Ê©óWLô5“1¢ð3CeA*[É/»2©T_›Á`6 ª ƒ£É„¡ÎÅ«ÚNòë²Õ$jiThv4MsT¯ÌôˆJÿÎá„x`¨*"=q/[6lâ`Ž­NǸâäy»}ÅÝ\‘À'¯¯Ã2z“úw hÅ,ÜV„®0ûÄ7b ];†ä©QžÂñƒÛøuÛqŠµ¶ËIK´º3ßàÏ°kfÐ/˜y+ýë|+lÊÜ]ý÷Ù³Óø÷›(TM­.>!„B!„Bq!h݈® ͶnêÉíOÌ?í@E\ºˆÏ6eµÙHˆVŮ뀎®iu¾h§ªÊ†â¢®Q˜°Œ×Þ׸gΦþ.K+[܉ßêx ž„¸å²no:š÷`æÌ»ŒníÄð«Ç²ëßK8i3a4[tسÅ{^cP½ûpÙœ+Ý;_[‡÷'‘«3p"7ÎDgZõi Œãê[¦1´k(ÆÜDÎ@‰Œçª[&kt+U••hº‘Ð×rãäD[Ê9yp/ûŽæ` éÆÈ«®g|¸Š¦•‘¼þG–mÉ ë|óÕÏ-²¢i† x®¿i"ƒbƒQr±g÷>ŽfktÄ”ë/§Ÿ§£SÅʼncÕ½}0ûn®èïFöþ­lÞs‚*ŸpúM™ÍÔXºfoäB²‘›”Šˆœ5›ñ½BpWê_xŠ^FòÎÍüº=™RÕ1Í’âÎènfænøÛ³IØw€#Y:!݇qém736TE³Û9æÜyŽYª\ˆw—öÁÕZD~a)U6+ªo?.Ÿs#zFàVr’ýNRîÓ™~c¯aδN¸ÛmuânMN~'ö|v¬O ¢Ñ*سrY¶Ú)½„B!„B!„NR¼è>aáTžÖÙÿ;«÷€±ŠÑ `4›QQPUëÉÕ¼»èÝ.M¨bÅ^Ý÷ú»„ªƒ†…^—Íh¢èÉ/|Gb™ Mkû˜Ûl¦æ¡r§Ë„qĸØI^ù®:F…¢¢<‰<—[†õeÚ¨í,ø! »k }§Œ$L-a×go°xWvUEõˆaòm·2<(µc³ZÑÜ"ˆì¥;xÿ…¯9R®¡ª\¢grÿmƒéI8+—°›"kÆÇPtdÛöUb4›1©&: @•øì?üwW¨*Šb$`ØÜ?µ#½ÃŒlÉ­ÄèãÔ±¬˜«§r§£Ûf>·„£å Šb`åöüñÖAtíŒaßQlg]Œ[§ôð ¾ß{—÷ŽbÄÕw2B+&#)‰£II;v‚Ôü EÁh¬.*f‚â§14°˜Ÿ½Ã·{ò°Š¢â9–9·aÈÌxv-XEÂôwî¼M.ŽóqéÌÈnI,ç5Ö'£«*f—@zNK´¹œ½‹ßà‹­ÙŽ÷Ê%œÑ¸‹ñ=ÇÓõÖ´ENZx¶ª*kÂ'4‚Ž~.µUºŠC?ðæ¢ ¤¨9{3»ºFÜü#ˆ N'£ÐQÐjëáIB!„B!„Bœo­5Ь=M.`«Â†Óï½fBMì¶b2 !Æ sŸ~ÁñýÂÍÛ4TE¡"ý(y.Cp×mجz½YkÎ{¼¦ zFV^ÈÙÅwKÖ°+1ƒÜÒ*쮽ùÓ¿n%–LV-x™oŽTbvuEQÔ÷¯ñ ×ü¥úäÎr0K$:!w_ÿ’D•Á„‹ÉŒ¢Ú9¾þ'¶õ»™A=üã—¤yv£Ø~`É®\t““ ŞʺŸv3𖾸ÕL뤚0€Ê"Jªl˜L®M¦ÿgï¾ã£ªÒ?Žî;3 !„ ¡÷^AQi *®mímÝ]˪»«kYuÑuU\W׺ºèO×¢Ø(‚]AééB ½N¹÷þþ˜4„)@‚ß÷ë•ÉÌ{žçÌ IÎsÏ9ú¯OX†Y¸ÛÆã±0M0 ǃeY†KÖš¯˜º)›Íksðx½X^†aP˜¶—"Z`Y&nØÆåÈÚ²,§ø*̦O¿bcžƒÏÙŸÁNÛÈÎкûü¸áNÉž íÜlÖL…­ ;qRßtë܉Vú’Щ/Crw°rÁwÌ^šL¾c‚/“û4ÀÝ9“¶ˆ‰kˆåµ0L7-s×áò]hó%{ò‚d­ù’©›r›·ã)«0&ÏšÂw[r°|><–o“ hãÁÝþŸ,Nõ|ø}^ #“¥ß.¥óˆ&ø¢ŒÈ†Ò5Ñ'UP­oX{.¹ñ2:–†“´É_³9ÇÂëÛÁwS¿âäûÆÒ‹ÎçÝ@çs·ðÆÃo°.äÁS…éI*<ˆˆˆˆˆˆˆˆHmR½Áðý¿L_ñ)}¹€u)9܃,ËÂUý‘ó³¿ IDAT1²êäÿÜÎÞÏÇ.ÍPRX0M¯¯ÜÒñ®‹mWmE—‹×ðQ߸Ûxç…·ø1ÛÄëõáõ×Ãç7ÈÍÜÅ7ïNàãEøüQX–Ó¬…‡rŸªs¬-i änÚ@†c`ù¼¥%›v:wÙ èœHb=HmÜ–&À®5Û(2Lü–'r¬“±•=n_ÚE2ÃÉßÆâ ÚtÆŸîëĪå+Ù¸u'É»2ÈÞ·DZ1ŠÛÙ0Û(þ°ÉNZCz8„kú‰Ž'!±-Ú´£s¯>DÙ¸8ŽƒSpdmQÜ/élÜY€Çòby-LÓƒë1(Y‰ÇqÇ=äצaS°k-ß'¯b¶í`Ö‹§]ç.ôèÝþÝ[Ó÷¬kèœø>/OÝ@ ^ £Àh5–??0¶‚3Fçw±³ƒdm]Cº>lÞfie2 [r1<–ׇÇãÁÛ¸M€½k“(0Ìâ}("ýLú‚ÿ½Äq,ËW|±T¿O*«zß°ÎAª²‘<½^¦õóÿ BÁ"‚a/QÕ¨lŠˆˆˆˆˆˆˆˆÔÕß'!"õ›ÿðü¢xοê^nl[ŸÃÝvœ»ø5ž˜ºƒaTiu”š˜AP¼Î¦éÁòz‹ÏUr>óg±EnʯÚ®5¯Ê$9º,amxý>|>†ab8ÉL~ê-šuéDBôzr<ÞÒøk_á¡ÜZK‡ì+/“S„kš‘M)IÈ!üÔ³ÀŠöcàR”[ÙŒÃ4ÊŽµ É‘¯~úèÿÈí?”3OéEŸÓÏ£Ïéù¤¬žÏ7_.b{[®­ý;Åu]Ìzm8ý¬aœÜ¹% ý²v§²'·a<®ëDŽ­D[‘ë/DQÈ)~óŒúåýU<+Ãpll<¦‰ÇqpCYlÿiI«æóE|?.¿åBº÷:‡!?¬çkO> œô9“gïÆ1MÌrÅÇ‘³7 ®3¦-CŽ$ïÒÂC¹AÓÙOÂuÁŒŠ¼¯E9…¸åÚs]·l(×Å0Já«Ñ'UUÅovŠ63éÙÿ#±ËnÛ -¹àŠá웺Œ4_[]0‚–Ù8s³Vo'¹°ª–ƒ """"""""R«TglÍuÁ…‚Õ“ùＦ\û×+èá?‚×å­àƒ™ÈYX–·ÊKšW;vÀµÚpÉ=·qZ\Çe/âÅ7—ÛŠ êƒø5/¡=,YœÆó&Óƒa”Å›Ñí¹äòS™óÏ ä„ª7yl åª9;§* DÕ÷cFÞ…rÇøêù€ C6Á‚ `àña`ïÿfQÔ+·º‹ vI f°ñ‡ñÆ6£]Ç®ô0ˆ½Gq]¢——'Ì&Íñ–+’”- åpùUŒl&yþ ¦.^ǶÔ,‚®·Í…ÜÛ5¾Üñ`Q[>Ê5‰±dð¾\¥æƒìþ®\u÷Å´ÝóÏÿßB²ñDëM32Áãâd­å›EÃè~FCZ5õ`§«1ý‡õ¤Þ!òÓû¬4_5‡ Óƒy6d9Öª5^U´©“ÓéqõÍ ‹?’ä°à•Wø<%ŒÏ…éñ¯¼r|–.*G.^’Þ0zÏÄ1,,ÊßÔï£i×>Äç§QdãU¿yº|ÌSùÝo«*+‹¶„i×i$ ÝÄä{±]<õé8ì<Ä@Á²ùìØûV±<ýtFô¸€1Ý'0kSFL{†žÓ—˜HV‘ä¬Æôx Úæ±)é;Rm a/6ñPHVAÇñ”­¾õ³½ Àðùðöú°¼^̘6 =«þÈ!•lë`ûTRx/ËïaȨœsíyä¼ó5ë³² ”á§yßs¸¸· —ó㎆½ƒ…k èÙ¯íÁ«³6S`¦ŸÄAç2¸ä-YÈö¼ÄpÄyŠ¹Ž¥©ÃÓy,çöÞÉ'ë À01|‰œ<¬ ^rXÿS÷ð'«­ì ~œøM¯9ó‡÷øÎ÷kþzIvN{–‰¹ƒ¹f„‡¯_ù†Ô°'²y nŽ-""""""""R'¹­/âüξÃêdnâ›&1}u>^Ÿ¯×[¥½Ž —ÈÒø–¯·\.^+2„j@õ„«)œÊWïÍçŠ+îæÉ«+ög¬cÖįH± <Þ£7†YK-E^ßôÔ_s]‡ ˜%›6— íœÃÔïw³væç¬ÿÃXºs;w HbÛÞ01-:к¡r—3eÆFŠ ¿»?þî¿?×ÜKç›IÉ‹¢Y‡64L_Ïn»‰vÛq±÷.gÞöÓÛv·ÜÓ“¤¤4ršwì@s?ì›û)+3ˆrq‘årÚŒº˜ó[leõËHÉÞÈâm#Ûîbný] Vî(ÀjԊν;³7•"I|.#ó¿â‡õ˘·}ȵU®‡ö_VªdÊ î~3/fïü÷˜Òô.ï;ˆËïD8?“}YŒzÄÆ7§qÀ^æNšÎ¦ðG…Øþåt·¿’¯ãž^{IÚ¶»a{:%FCÖÞ™¾‰"×Ä—³ÅÛFQÞs à”Æõ³|ì Oý–ž7 ß•wÓ1e ;³ ®]gZÆ@Áª|»½×× ú¤jjâ|ᬟ˜òì ÂáV«-¤Ó†&d±~ýv’S’yb‰ ˜XÅ™—éT"""""""""5¬zãU.ùëÞá޻Ä‚lÛ®ð\†YöÇë‹Ü ]1¶òqWùá<öÛsÓßÛÐùŸÿ®ðÐNïYó˜rÀ­ÞJ(Õéë¢äxíñÙØv¸ø<+,D–‹òx,ÌêラvᡄѤ=]šT€ù#ØK˜üŸLLß­èÚÃGaú.Ö-XÊ·ŸÍc[ϸ íœÍËϦ0|ÌéôëÜ…‰9$/ý˜‰_f1ú¾n$ 9.®Î¢‰¯3dÃú·§M·æxì"²ÒÖóýܯùfñ6Š<^|†Ih×ællÍY]z2èTÉóLcÑ{oâœu§÷:…3»ÉܵµÓ^àóåú^}3—ôìÍÀ‹™»r &N gȈöUáP¾¿ÝŸ Àÿ¼OlVôv¬È§ö¡{Ûæ$´ná²Ò·³fÁ"æ|·”m¹6^Ÿ/2¢p3&¼ÊÎaC9¹SkÚtï“›Ææg2óÓEì šx}†“uäy¯JÙŒýbv §ÎåõöqƈôèО- ò÷%±äëϘ9o+…¦…ÏS3}R55˜ï±,LÓÄMûŠ‡ÿò9¡`¯Ï‹Ç©nÕؾ&c© 51^ešfdÃaÎSR|0 ãg{ÃV^µòƒÉ|ðØýL±m»,>£ü÷û·áñDöé=>…"³2Ž`y*Ã0"³IŽbáÁræ¨j]5®ë …ƒÅë\XE1 ˲ðú|€G–$*aš,¯¹cÜj@‹Öñxòw“´3‡`8ŒëFŽµâÏäŽûÆÒ`ÉK<öÞ6ÌèhLÓƒm‡ ‡BûUÍLÓÄãñD–2=Øa›`0ˆãؘ>ŸÓ4 ‡m¡Žc—¾6òÛã8–׋eyq]ç°m¹®K0ÀuœH•Î*[jȇ †×Ùˆ¸âþlô‡±ÃáýúÌ0 LËc•Š—¼'áp˜p8ŒScé±–w¿»òÃáðåíñx‡ÃÍÀqÂáPiŒ%mz¬ÈÎó%›-×DŸTV||öíK¯±óA¤;ò^¦YcÓ¾òrs¨ÛàðŠˆˆˆˆˆˆˆˆGclíXÈËÍ¡]ûöÕŠ=26ëDƦ7Šn€a˜eƒú•Tñk‡ˬö‘¢Bd°½Â Ti§G:Þðz1=%WD¦|˜¦Qú<žx]q}CKxý¹l)2‹7$¨Gç3O#kVíÁ6MLŒ²©!¦§x`Þ-Í0LÌrË?™>¿×uŠ/OqFq5ÊÙ﵆aàq¬²Á{3²¤Î‘´U²ÞWä±2‘¢ŠŸ;ôEhW©LÓÄ).zwFù~+}Y:Øï8ô1e¡#Ë;òøÁò)ÉÃëõáñXe碸BYÃ}R†‰ÇªýqŠˆˆˆˆˆˆˆˆHÕ”ŒÍBÍÝ$ýKQ›KG¥+3X\ö†U ¸ƒÙ_'Ñcì~{gSV®J"éOóv=éÑ*{ûL>ÝP€áñ•`—Ls9ÒüŸ_,‡ºˆëáÚ:TŽ‡ÍÿÀW¿†ƒÆWQ†áápoKeò>\ȇûF¬Ù>‘Ú¨ GƒMúâ÷x1{£†D—AÈ6 Éؽ›å_Íã«Ù«Øçzðz¬ƒ.í$"""""""""""ÇG--<€iI_?‡wÖ|…—i`áõYÅwÈ«ð """"""""""R[ÔÚÂx<&†áò¬²ÂCñ¾e;ˆ‹ˆˆˆˆˆˆˆˆˆˆHmQ‹ P²h_‘º@#ú"""""""""""RcTx‘£ÂƒˆˆˆˆˆˆˆˆˆˆˆÔDDDDDDDDDDD¤Æ¨ð """""""""""5F…©1FýØîñBDDDDDDDDDDDN Vb«vyXµ©<ëàÇ6 9!˜†)3”|ˆˆˆˆˆˆˆˆˆˆˆÈ‰Á¶Ã„ácڦŕ‡âå•T|©ûìp˜øø¦ìÛ›†åõ“vË-µ¤’ƒˆˆˆˆˆˆˆˆˆˆÈ‰À‡hR\tˆoÚ¬¸øà;êm›G½9f~^t(ß´áPð¨·oj‘CEE‡Ç¢ø`a—\WÅ‘ãÄ4M¢¢ëay­£:^ß´Y•^çv(Daa!ŽãTx\Ù†Ê"""""""""""ǃišÔ­aÔÞ Àòù¨ïµÈËÍ«°øP{3ù…ˆŠŽ®ÕE‡ò Ã$*:ºÂçëF"""""""""""'0˲P-r¨xUx9ÎŒ:¶¡âUáADDDDDDDDDDDjÌ‘ÍÝð&0tìé´õ±íÛϘ—>Êa‰ˆˆˆˆˆˆˆˆˆˆH]TñŒÃK|ïAôKðc5êΰ3Oað 3Ö«!Vt+N=£ñÞc©ˆˆˆˆˆˆˆˆˆˆˆÔzFמ'¹>ì¡É ë¹ïŠîDS@fa=•nP]DvQqQ·âþõö 2c²ˆˆˆˆˆˆˆˆˆˆÈ‰%®aÃãB¥egeôñ f<¸8!»øóòE€HÑÀ ¤l!"""""""""""¿Lò“V²%Xüe(™ï?œÈËo}»J ù¬_µ›àÁO """""""""""¿@YjÉOß>È­}üÅ_Xù¿Çymu.`4èÏÿ~%]<ÅOç-á¹G¦°Y‘*9üRKñ.à7 ¦S,„‚Ùlþa*oÍ\Caûky䂵<úÌRòŽá*E-µdø‰7Æ_îëBÒ3ƒ”Äêe‘ê?àªx‹j©&OüPn¹º#«&<Æ ›³°ëuâü?ÿžßïy‚—öïèöwÂC€¤Ï?`FïÞ ?£±4dÐèþüøöbRÃ>Z9‹þÅE‡ÌÕ³™³b ;Ç6h‘C²Zpá£qQ³ ž¯áé;^dUá1Jê ‹Æ=FqùƒéÞ¶9qä°;9‰•ßÏbÆÉä;Ç _nxê^†EéZ•Ê2i2ìž¹¶=Í×ãdâÖ#\¦âg×ÝO±gñè?/¡eÊÜóð7¤‹k_DD*dÆ4!6¼—í»³ :@Þ¾|û}Rý6`Ätbì­gÑ·CõÒæ0á¥é¬/Šgð7pIÿ¦DYY«§ñâ›sÉl{ ;g/«¼gÐ?åUþ V#¯æ·gw&–Rú†IïÍeGQÕ¦O¤ðà³i_ïuè2¸ݼP¯÷¥Œ{r,yhêG• yéÌ^‘‹~ˆˆˆH­âä³má<æ6ñ€K×A=iJ˜+–²­À…¢md„wR;yi5úþqYG,lÒ·¯guQ,íºöeLÇ>ôhüO‘¬ý¥öò4eЈöÅ_Ä1hX;>غ‘¢*œÊ-ÜÉ¢Ð(=Õ¾DDŽ¿PÊ>Xr=¿ÿ(i«W²jÝ:V¯ZÅÂœ0¾NàoÞšŒWŸá´†ÞùWÆtø‚-·ˆgîûŽ]´äÂûÃiÍ0ƒÝâ}õ%þ¹z7f‡K¹®çfþï¡ÿ±ÓiÌÉ×ü™ßÛÄøÏS©Ê¯Í)<xi3ò\ºyË=d”/:øé{î©4_ý5»mDDDDDDj'›Ó&²Àמëº÷dd\:ó?˜ÈÌÔ’?,÷Ãu—žAïV '™ÅŸ¿Ï¤/7SÔâþùÈ94Kú˜ÿmìÁØ~ÙL~»€îNÃä/™•ÕQ}â §,ããÉ ‰=ç2ÆôŠÇ›µ™¯Þ~•)+³uƒVe6ìÏUwÄ"›ïÿó8o®ÈÆÆÀßö<~h,mÎ9n_M`U¡?ñd.¾b,Cº&ÐÀÈcÏ–¥Ì|o:s“ ðv¾ŽgîBôê¹í¹5ÍIw=Í=rùú±q¼<7r%»Û{qÎàö4 íaÉ'oðÚ·AFÿã^†ÕèÅ]/ÞÅ‹zšÅùÇ»w¤.ð¶Ìð–àìXJRÂÉtì?Œ.ïmbUAÉ«&õÚåŠ+Ïf@ûxbÂYlYü?ÜLßû÷¿î&<¶ŠSND˔̚µž\}Ý›-/¨øºþr…ÇpÍq‘R8%SžaÙô&´ëÖ>'æŽ+®bó¤§ysvÌgñž ®cšÀ² B;?ãÅw[Ó©ÏiôëØ“M£Xí‰ìLžÃ+w‘ëxiwRZ´*↻NÀðšXúx J…‡ vg±ý³I|±-‹s§ðÊô”¬¦”»ô}^š<ŸmikùðÍïIUÑADDDDDê oËÑÜ}çXúÅnç‹÷§37=Á—ÝÅ_F6ÅSrPû ¸adKÈÌ¢°¤’Ðæ,ù“Y³µ€˜–'sí=·rVƒ]¬\³£a'Æ\7†vÞ •Z/ªÍºZ@Ò'L[™MäO^—ÀöÏxô/÷ó—&±¡Ìú½¹á¾ß3¦WCö-ùšYówS¯ë™üîo·pF|%6Bls>¿j›ÇúÕÉD7gÀe×3ªi³_~›e…€³•wžx›µG%]9áøi;lM ²jÆT>ZZÑ}8«{LéÙðdn¾ç*Îìè²qö—ÌÞèÐñ´+¹÷êæ,yeÿëMs8âëþ`×uB÷¾ŠˆÈ2‰ës ×™€Y”ÎÖs™öæ3<øJ]Î>™x ÜP!wÿ×Ôïqþå|zÇ°iî§|³£lÞ¦*$èà ³{ökŒì þñØ<öÔsügÆö*Ïò¬ð}·`+Ÿ<7žO3Î`×]hOˆmKW³níbÖ-ªb‹""""""ÇŸ£GÐ’0+'½ÉËò1æÐúékéxÖPZn.®2ä/ãùÞ`Ežƒ¯ýå‘Ç’§0þ©9d6ÊCÿ¾†öyóyþ‰·Ø@gn|ê.†Æ%ÐÀBÇ-9©2_ƒX, pï>òöûÃݦ ;“Èø¿A“c\r¾{‰½½‰"¼,ÌÿŒéÂÙãY¼ù›LÁøñŸ’®ÇIw<ɽÓ®!|²9•p Hݹ—|Ý).G"º£Ni…Køj]:›³—=è zêEƒe ÈrMšœ<†“ü6ëe^ü8…°÷G¶ýz4Á´ý¯»‚Øò'7ht˜ë~þªâCv]7²`·Ö¸©:‡¢\“^×]ˆä·ø6)béqRØ3Ÿ<»ùA^ã¡açŽËßâ£ovà6ÀÈx9ÆÏ ‘¶r 1×¢×¼÷XhÁèÛo¢í¬Ç™°ºj¿ÔQ¹ÙÉ^ÌÓw,®R""""""µE\ÓúÞö4o–ªaK[;"ŸïYKRÁÏM*ʦÈ;²œRQ6`Ú„58\Ç9„ró ÑmB äí7£hÖ¾M½E¤nI¡~³ú¤mÜ]¼B@ˆ½÷àŒiLƒæ±˜GZxÈßG® `( SáÂ"‡eÛ}8'× ræU×3Øj„˜]†Ñ¿ñ"¾M÷Û?ùì\ñ5/½óù ýòŠ© f³ã¶?ò¯¾ìIYÏÚ !F^>œùÓËçR°q*¯Í½–ëÿþ$7™…lÿá]^Y[@U½Õ<7ù “—]¸,yý¦mbX±´jŸH½Ðn¶»Fsm\~Q ·/a³Ó“nÎãÜ.«yo}>àKΟ¸€V¡Õ€z8eH§rO¶cäÀ¦|÷ù>òÒó€8š´m„wi>!o F\>šNáõL›±§ìt4`“w¸ëþèf(""„Ù·bϬ˜vàS›'òקK¾°éí¿óoæñòCóÊ8OŠ?ûëúr;y¬Ÿ5ûgÕL¤*<ˆˆˆˆˆÈ/P€-_ÎeïÀQô3‚ÝóRðuÎè^q¤}ù$ ’Žw|r¼8YKygÚ<|q{Fß3ž>7‘j@‡žm‰ÃfËôiü”ï^2“ßÊ 3oã^ï÷¬·Ûsæé¡h3æ§Qd%³Óˆír ÷ÜÞ‡}qÝ8¹M%qBaÀjÍ3úòÍ*öi•93¾gw1!kÜÿ[Šåö¶¹ˆ'þ>šVÃN%ñëìZü5?]t==Ï»•?F/!3áT†õˆ#gî&…÷¿îR×”oÁ%ó0×½s‘ZIsÝDDDDDä)4''|Å:OOλôBFµËcÉ´ÿ0þíïàä8 ’<ëiîy~&K’r©ß¡7ýz4ÃN^ŬWÿÉÓ_¤œ¼Õ¼þÄë|¾6‹f§œÍyCZ¿a¯>ñ: ³\œô¼>y)» £hÛ§' ß3c[%Âïæ‡oדãÆ1hìPZùŽRºr‚°H4Œ¶@ΊEì,·hh÷R–dMsz+/NÆ&üû}~L2è6âl†u´Ù0çmþ5y=¡ý¯»ÖÞý[9Üu/""RÂèÚó$ýd9Žâ6<Þ!TZvVÖA׌©1‡ÞãÁð“Ðk ½ý˜½d/Nƒn\pý%œÖv/ÿŒ‰/#-tŒ"‘Zï3<ÄŸþ{øÝŒî‡Çˆ¢ËW2²ƒMò–š ¾’›G&hwj)UqáÁ›À#ÚQ´r2OÚBÀߊÁ=¢Ùöá˼øêËüwNÍ Ñ[áDDDDDDDDDDDä¦âƒ'Ž l’­##ìb5îL»¨}¬Ú”‹Cˆ´­ûpbˆóÃhEDDDDDDDDDDN@®ëï*åPñV¼R’¤ hß “ :t¡QÞf6eÚ€I½†1˜N:ᣰˆˆ=ïïp¼C¨\\Ö>‘t¼#©1¦iâõz±m›pX?EEDDDDDD$‡±¼ug‰¡CkT\x¦²lKˆßŸw çùvÒjt+ŠÖÎbwØG|÷Ó¸øìDH[ľ`%£q]0 Î?l%_X{¸®ËÌ™³êt‡SWsTܵ‹òª]\×egÌfz´ëq¼C9b®ëâº.kIªsý]‘ü¼¶&meÇÎøý~ÀñIDDDDDDDj¢Bê[ ã[3×®ëPTXTáó‡˜ñÇš©ÓXþÇË}Q7(\Ï»Ÿ%QämË´*G IDAT¥×žKŸ¨]|óæ2ÒJÀæ-[+÷ÂZ¢üô‘ºšÃáÔÕwí¢¼j—’¸£N…m¹ÛŽo0•à:niìu©¿ÅãñØ¢® ûÒ÷ªð """""""8¶C^nQÑQX–Ã0ŽwHr]Bá0E…E8Ž]áa€ð¾Åüïá•Ä5‰ÅÉÎ 7䂹—&ý³w&‘’¦ê«NÕ­õªÊ¸åëj‡SWsTܵ‹òª]ÜÒÙui½@×uqºØß³í0YY™4‰oÄŽÉ¥3EDDDDDDDÇ¡ ¿àx‡Qm‡,<àÉÞ—^öµ“˶µ¹Õn¸{íÇuËb¯«9N]ÍQq×.Ê«v)»ä£®(o]êï#„pl§t& ˆˆTO~nÎñADDD"&¶ÁñADŽƒC ‹Fízг]¢¶¬T8óV±· {cÖ¥;nË+·p]ÍápêjŽŠ»vQ^µKélêØŒêf m,-"R³ÇÇïDDDä Ên+"'‚C<4=ýF¸¸…= Ux8ÑÔÕwí¢¼j—Ò¸ëôŒ‡º¸ˆˆˆˆˆˆˆÈ/WÅ…oKFŒê€¹ý+^xs›2ƒ5;VUWêê:+•QWsTܵ‹òª]ŠãŽüSwâÞoOŠ:·ˆˆˆˆˆˆˆÈ/YÅ…O ñõ¬yç;6fÖü”(· e ×uqDZKÇŸ À0M<¦‰al=¨šå–»ý¶*9”ÉÅÁ4MÌâØ 9–äà1=5–SMÄ]ÖÿàÇíÁ0ŒZw‰ƒõ7€ë8ØŽƒë8`¥Ï×ö¼wyŽmc;`z"ïW佬Ûy•plÇu0 £ôz¬rÜ®Qg Uíï’ï‹ŠúÛu]lÛÆu Œcð~ˆˆˆˆˆˆˆˆœÈ*.<ØÙì̆V~5¿2GU¾lÛ&(" â:nñnœ^¯…?*ë þ¸åîv®Îà뺃¡0^¯¯Ï‡a¿ˆÃáEEE@Tt4–Qñb^Ç2n×u ‡CAl;Œëºx<>¿ËòbÛáZwùó¬¿Ç!  ql0°,>Ÿ˲×Ò¼·×[:Øë8Á@€@ €aDEEáõzë|^åÛ †‚ƒA<¦T§êq;8•~9àܾ—̬ƒçlµŽ§Iããr³3IÛ„¸†4kç¯ü&Ê.¥ñV©¿m›`(H(*.DX^«ôúÇu …BƒlÛÆ0 ,+ò¼Ç²ŽÚû!"""""""r"«¸ðJåûÏ6qÏ…¿¢ÿ®X¶/T£Å‡ª ØÙ„B&ÿð.¯_Ötÿ'÷NãO·MbËQÞ¯¦&‰K¸EÌv×ñÖë—³ãáøÇŠ¢>LJ—bÛvÜY¼öÑÝtËþ‚»oz•uãw8¨{ZpÎ-·pù™ýè›Ã¦…ÓyyÂLVeÙµ2î’×UÔßáP¤Ðão3’Û³z%R/«ç¼ËËoÿÀ¦¼Ú——뺇Ž{â\’ƒž²ãêò7>þ×0êSÈ÷ã~Ç#Kƒu6¯òÇÁÛø>ÁÿìGhá?¸úŸ«)¨bÜû-]T)~zŽü˜Û×;è³›ßΣ™ÙüœˆN|ŒÏÝ—ÐöǹmÃ:ŠªwU÷Ôp]—Pñ÷EL· ¹ãÖ Ò³1y;XöÙ[ü÷ý¥¤Ùb4>…ïü çèDLÖ–|õ.¯|´ŠL÷è¼""""""""'²CìñÐŒ^- Hvrø>\¸+…´œ"Âåï” íäÓI_°=Tù†«Vxpq/‰šùìMÍ¥d_ëð®L C6¡¹CÖˆŒ –,S‘åM\À4«±\IMÜí\|wm(hÑï¼1$ɸÅKÃœø9î?ðé 9ìr3G3î’ûp8†Óïq#c ï^ÏÚ½íèyÆïxº¹ÃuwMck-‹ÓߎC(‰îËÏÝÇØFµu-›ö ïùwñïF®?ݵ,¯ÃÇäÆ/&£8wÛlÃe· £~¹¶kåuv„yeÚÅK~·å8v¹e†Šs«jÜe+EUö „ÙIjaCJ­rLbbâ‰Á&àu}Þª¶[îuUéo;lCÃÓùû³·18*Lêº5d´ëÅÀËÇñ˜q¿m#aO{nzz<×µ…¼íëImÒÓ¯ù­ù#~?… [óˆˆˆˆˆˆÈ‰¬âƒM‹mhÚÃîÝ€Eƒ¸¨ý fâ­ê²éU¥q¬Fthjâ®|Ž›ï[H~ñ;@8¦(P„ë8¥k¼‘e0 ;Y>ÇòzñW°ŒÆÅí–û¼’Û&6iÔº'ýGßÀ=—Ä¡Òóþr,ÍÀµ äSPX³ßÇS…˜«·ë¸8a3áln »¦pû&²ÙmÇżžõÒØk°µ–Å ‡ïo^Å9 ´üYnùÛ·ì0ûðØ”ñ zgÄ/`J^-Ëë°q_ÎÐ7–25%„vh:üf®i“Á¦ìÆtŽÛ¿ýº–×io,áãABå–þq]Ë);Guð«>ã!À– p÷†’ó… eœÍø«K§œiLÞ›ƒã‚ ¿3—‚<#:Š¦½Ê¨jÁ¤lséʾLÓC“1( 2f=Äïž_NA»yÿÿ.¦åð3iýÆ:‚/å’¶À¦W¹íÎl‹=‡×Þ½•ÎçÿŠÎÓ^byn¸æß‘XÅ…‡@Sž}ú¨5\•;ÒÇÆ6Ó¡)d-ßMv~!¯Ïey°mZ_Ç”·¯¥åŽyv^'®¼¨/sÖñåkÏò¡ç2îÿýpº6ÌgÓ—¯1~Âwìq*î‚Šã®úÝé†aà?“'Þú =ö?sé&¿'rŽe˽”ì£Õè»ùãõ£è—ËO³^æ‰×±Ï©|E«:q;Žƒí¸Äö:Ž@ÚÜÙlÈ, l®ç£§fº×"rqKV™©%qÃaúðX>'Äâfû²¤‡Â8¡í¬Ý ÃcbIˆ5qskW^Gw³ƒP(„ãïÌÕ7ŸBÑçñqËqüµ7Åwö×¾ëìˆòŠr bÄæönå‚þÍlúš7¿ô•îPå%•˜(wò2rÄ t"…i«g‘œ½=¹æ¼›8·m3‚i³yw­·l_‡c=ãðx¼D»É,Z^HÒœMd‚9{ÉšºaÛ¤i¯®Ä»—®&- á½+X˜ :Ó±¾Ë‚½5ÿ~ˆˆˆˆˆ5žXÚõ;•Sz´¡iŒAþÞíü´x!˶çbÑ ¬-éÑ«+m›Æ`f°cÓO¬Þ–IH¿øŠˆÈªÜˆt ªì0MÉñVÃ6´Œ‚¨î7ò3{Ó1:›Íó>àÅÿÎdE°ÜUë_sç…i¤øšö`ìý¯2– i»òp͆tógîXµ‚~È«Ô>«n¹Q°ª 5¦‰§h5/Þ÷Q¶IŸÛæ7íJÎöËȱüù‰;‹¿ý%—”y¸MÓó‚{¸sÓŒû.»ÒûßV'n×5iÔ¦qä¦çð褧9­‡=+?åÿž›Èœ§ÖÅ ‡îo 0=.iŸÞËy3B¡`dæ†]Îö¬PíËëâÞ–^HØvI<÷&.nòϽ±‚œ¿•o½ö]gG’WRz!a_î|é1.O2“Ikr6wÞ^R$)û.ªJÜnI°:\+ê®I4ÈÛ1‘O³¸€“ß’«.}˜‹2ãFò‡aeÅêÎx¨J†KæÂ×7/LQ LtÓ.œù›‹iG€IRФSBò÷åcãâÚyìˈ¥Y´sTÞ‘šgàk~ ×Üzƒš–ŸÝÝ—!#Î'mÁ;üçÝÅì9TõÀGïó¯ç†³;•.e["<—I¯OeQZÍî*""'¦Ã Súœy&§tL¤Yã(BYi¤lYÎ7³W“¨úšªÌx0M“˜]hDwr%ë[÷£Û°›x*.Ÿ«îûœÔ’–ðØofæ¾6Ü=å¿üº‰ÍªgoâO3öÒú·¯1ñÚDZun„õ}.•Ùo¶ºw§Îdʽx¯ÚAɦ¯¿„÷|ÜÁÛ·ÝÉ«kt¹åüïòftìÕ kNV¥b®nÜ‘¸Lü1>š ¿Ö,bñÖ>œÒ÷bz8Ÿmx‡uµ,îR‡èo(Þ"X2È=€?=;ŽSýñÕ{ÌÝç”Íä¨eyU÷—ï1'5€íïÁ57ô!}êùtW€Á‘u•p§^g‡Ïë]¾K ÓèŒßqq4‘ïxŸõEñ\òÜëÜÑÝ :KÕÔŒ·¨)£G ¥;yë:ò‹ÏW?þZ~ÕÈ|û~·cNy’k›ÿÑsŒg<” xêà‘we°Èü†sSºVTäGa°(¹nœ…! ŸÇ¥Ñi5ÿ~ˆˆÈ±aƟɸqýùbÜs,ÌÓÿÖr„ŒhÚùk®}íâ¼8…ûØ0&“¦-co "C/½œ1'w ©'‹s§òÆÇËIƒÕ¤/]{§wŽÇÈØÌ÷¿Ã´åé”m‹hÒ`ÀÍš'¶Ç’6Í#%ìâ²›ù7qíà.e…ÇJ‡]~‡Êm;Œã8˜†‰enåíGŸfùi—pËè‘<ôt»®»(òG“×o‚ãàºü@˜¢E«£ñ~ˆˆˆH­åms·\ÜŠ%¯>É ›ò‰i{ WÞr ¿MÙ“ MN»ùÏ\ø”—Çÿ̽¸èÆk¹)u;ÿú±coÿ §$¿ÇS[Ý.à¿û¡=Á´6õÛöcPÿ> ÞصsÊ4U|Îï3ŠgèZ$¿kºG“»çøô‹Ôv^ÚŒ¾”Á °n M˜Çž’ÚÀú5,YžÄ­÷]NÏA—2fÎF>Lþyéʤ~¯‹¹þÔ8ë?àñ sÙ]<3Âð;t8+.²Ô¨¿W];µÏÏ'½²ÓÇEDä¥âƒCï‹.¤·o ÓŸŸÈ·IùÅkzˆíx&¿¿å.»¸;kþ·†ªÜǬ•ï‡ëº‡Œ;- ¦YN§wÃSÏ`ü'ß1¾ôÕõñÔ‡Ôà×üiMÝÊk¯ †iàïà„BƒAB¡vØÝïcéœåX=&qSëÓÖæM¦¦æ ‰iäÃqŒz4È!5×9*ˆõ;çêËGзUìÌí,ýâCÞŸ»ÇC\÷Ñ\Ùôlfºj6ßæÂYE¯ó©Ùt>ï*®ÖæÑ·sÓßœÂ÷»úÿÿåf/gò`ãÆ=Ìh<ùC„ m¬æƒ9»ý.>zø6g»°oo=¾†FV«á i²iÏ/bG– §3}èßùÕ ÌÚ±‹mÛÓ"&LV–C³ríYÍO­ðœÅþøÛáÆáï Óõøt‹ÔvÞDN=¹°‡Oß_XVt(Ú³€)Ÿ ã‘ ›sÊ©‰LONÞÖŒGÿsúSÏIbÒ¤yåŠ-uó\ÚÍGÖâùÌ7–+ûžÅi ‹™±K³DD¤bï¬êK¤_G/;gLá›Ò¢€Mî–ï˜ôi*¾N}HôU­á²è#ûpñÑíOùæë¼ø«ÆØE…˜ñ}9½5@:[÷…ÒÆm–=Pù8öÔ¯ÒkÌ«$–_BŽå+Ž¹:íUõú20M‡Ì ëÉÚ êF\¨b{2ª»ØËÆ´ƒõýñûpý)f…±£Oâ®ßL¿(‡ ¯ÞÄoŸüŠäÜ¡ŽëÔº¼·cÛX^ƒü ‹X¾rËW¬dÙ²5lFÚ+HZƺÌpËËÛ˜¦ÍîIØ@§1ƒiî6qAÉŸ˜ÕŒ»Ú±tjÝ ØÍÊì<œÒǃìËÞ tì1˜ÍdlŠ¢Îû]“Uþ¨Bxi>úo<ÿÌ3Œ¿¼ ž@FLk:5‘¶Ù÷Ó&ò€§ö¥‰]„¯Õ`†4²7²!'xß W‰ˆKFÜÉüö¶sˆ]>‘‡î¾G'o ÅE7suÏúXñC¸åæ!¾~‰{ïÏ›ÚpÁiñx€¨®¿æ¦^¾›ð¹ÿ)¦ìîÊ× ¤QÅIIÎÚªõ{Ö?…{_øOÝ5~šÌ¤Uùø;Ó¤(‡„±æ‰ç^à•gäö³[ã„ð7mCýœm$—Üxáæ³#)—Ø6ñø0»¾ÿˆ·'½Ï¬µ¹åþ"2ˆªðœA\À¬×‰‹3ï½ÇâLÝb.°RHÊ:XAÀ&s[ E@\bƒïBõ5£g"°k1?_g†¿%#o)):¼Å¿gá[ O÷–Q??‡ˆˆH9‡˜ñà%Úk“›QxÍWmòöåáx£ñUñ'[Ùûƒ ðX;¿_Hú¥—ÐëÏïòÕe;(jÖš&Èøì ¾Iw0[˜¥?ü <–g¿êŠišx̲sº•Œ¤üÑ•Îá€|LÌÒþs19†Ç*·á,.†ÇÄôû=Vù9 Õ‹Û´<„¶LçýÍçrÓ©ã£iבÓš„hÈû~ߤ9xbk_Ü¥Òß..M†\˹LZ^ô“Uü’p ŽÇäìڕבÄýñÃÿࣉr`Û6 /Lç±>…,zå_¼±)ˆ§AÌë¡¿óÞ’wù,³c;ÿw?ÃV§ ›îŸKUã®ö€·ÓŒ^g7[ ƒ”Ê%+m?z1¬ù¼vÓYl§5íê—Û„Ù­BÜåâ­ÚÏ ›]_Ï`íÕ7Ñãò—™qÚ6 âÛ‘¡ÕÓùvC(u*ÓvŽäšÎ·1eú%ä5J —ÍÓf°9dRxÞ9Ö ÷A·ÜÙŒÿjûÂÀO_2yþ©Ü3ª6 £MÊL^™¿ƒl²ø˜Ï†öd$àÚ6Žé'.®>ží;Y4q<ë¢ìƒ¯.''gÿº}9qmsíí×sÛðñZ0o\'ú½Îóã^¦ q.¿í7ÜVøo&äz!˜G°Ü/Á¼ ø¢9Ôýzþ˜ŠÎùã?Ë¥×åWÓsíD_“GÇ3ŽzÚRW9Eäþ8â|&~þŸ”‰?®> 8pœÇôâ÷ÁB”.ëZRtXJFü¡aÀò{~N""R§U|ŸŽÅÎlíu%îçÅ3Ž§¶ÂÌÞÅA éGÀu+ÿa¡¹ëá),HÎÁŸØšØœmÌŸüœ°Š|ÃÂç+®¥†éÁçõg4À0±,/ÞâAoðªGÙÝÎUÿ0 ¯ÏOÙø»ñËÉÑôàóy‹/>0°,/¾’ ³ZíV5n0°œ¼ÿ·¿ñê·?‘ÝŠæîVÏz†??»˜l£vÆ}¨þU6½Û”VëÇ7'¡yä£yËV4‰òÕº¼Ž$îÆ>Ï~¹ûÊå^[¯³#É«‘ßÂü‰ÿÜñ$ÓW§RԤ͋1é½-û}U9îj~˜õÚÒÚ„2(øÙsnp ¯ÿð"_¥§¨ß–¦,gÚÆm‘¨£½Õi»Šß†éÁÝ=“q}Ù›3ð·jG3;µ_Là/~NªmbÙI¼uß#¼3o1 ÔËÜÊÜ7ïãž)Û æÑ}?DDäñP¯q=ܬ”r¿„ÉJÉ‚úñ$$Ô#¶Â’‘8;ŸÔ¬.Øô!ϾµšØa¿ãŸÏ?Åã·e@«¨Cü!%u›Itóötj¹ÙË ‘½íG>™ŸKëþíˆrlÜ¢å¼?s%»óŠÈN^È´¯ÒHØ‹†áøbö»9ÏWß¡"‚¶gWtξtr%W·\ÂkÓ·D~÷©H(•å[Ã`vdÌÐ( x8}t'Ll’Vï9psòP;²€f]hÛŠ‘·Üq@Ñ,štlEE¤íÍ×Í7""rHFמ'Uð³ÂC³a·òà…mÈXý5Ÿþ¸YAüZÐsÈÙŒîÕmSŸäÙïöQ™í¥]×Å0 Z¶lQ# k%wÞîÚµ»Îæp8u5GÅ]»(¯Ú¥$îú—[D7Ž>ÎÑ9×uq—Õo®Sý}¤RRv•þ\‘êñû¼§ÜŒ?“qãúóŸçÙÜïn¹šÇûŒÈ²ä>Ú]6Ž{Z~ÊKÛÆp[ÇÏxà™…d;€ϨdÔº§yì‰Þ4¶¤äƒ·!N»Œ[/Šbʃ/²0GÓN<‰çü•ûÌæoOþH¦ à§Ó5çÎøxpVÆÝ;Æê‚Èñ cþÊßÌç±ÉøÓŸ[2õ¡Yí€Çà;âÂÏ3õô}t¸âAîh8™{_^Gàï|5ÿ<è9—ó~æH®ìéÁ±]\ <p g,ä¹G'³1pœºIj%o«ó÷Àh)`íÌ·™üÍ:ÒÕ´;£®¼Ž_u«Ëxþ¡·øé€J–Eë àÁ³ãÉÏuˆ‰5Vt#®?·<ôú9 yöÿÙ»ïèªÊ¬ãßskzƒ„zï €€"*`CDT,ØÇÑq|Ë`¯8ö®¨cÁë`AQé-¡ÒH/·ßóþ‘€$$@‚¿ÏZY+÷ÜSö>÷]Ï>ϳïÿ€õ.•äÀx±gkçÜ…;îòÝ;†Pê p—RX\Á\õXŽi~r¼Í;úsÖÙ§0¨Gkbì&®ÂLÒ–üÄOé)\pÍ©¤ ¿‘ ¼Ê3Ÿ§íÕ¯&X¶Ž^ø”°^HŸæ§rÇÓÈË*ÄOrœð²ñ«×xsQa-½@EDDö¶Ÿ¥–ÝKJ$&µ8’—m8feÑœìܦ›C}šjŽŠ»qQ^KUÜQ9mzK-­ytsÓºß(;+GK-‰ˆ4Ú–Z:P¶¸nôk]̪U;+û<qœò¯{òË£LšWؤ& ŠˆÔÍBD—QÜöÃii °é£Çxæçš+YXœ‰ô6œSúu¥M|8w>;RWòË÷sY”^®¢ƒ4-µ$òç´÷Œ{ÃÏ;…„¢%Lÿ©‚A£O!yÿÿîÍâ‡/~"sóFëÒTŸ\­wSÍ¡>M5GÅݸ(¯Æå˜ñФˆ4-!myeoZ¼ü 3¶xˆí9‚3“òøyC©Š"r R–6ƒg_ðsÃå})¬ð×úo\ГͲ¯§²ìë# ˆˆCö.ôev`,q ¾î&¿<“c½Y­½õþýèhZîÏMDDDDDDDDDŽIu-6¼ë~a]¯³¹åþ,[²žŒB/ŽØ–ô8¡7­œy,Zœ@ÿ“â?Æ_Èš%ë)8˜ž®u|7g 冃æ2¤Ëpî~è7~¸ì#2CïÁ ¾ü܉g])Á†?} ¡]ÿÂiö4R-CÛ#œ%KÊÀU #r ÷Mþ')Þɘ—‘ïhé×?Îã/¹Ørñ›lMŸÎ“¯T$nt-ìv;-â›s€ãIˆoŽaÔ=(oš&9¹»ÈÌÎ&33‹ÌÌ5öq¶L_ÛÒ-=Ú6„´4÷á ÿÀ9ÐÃË'<ǼBMA‘£«îƒ£-c®=›N¤püÐŽßk‡xž{÷Ú¶™¢YxØúÝ3ì z<“¾{‹ó[÷$Éžpº½‹Gn<“žñ>¶ÿ<•‡î{ƒùû\À–Èé·<ÌÄqHõS¸ñ&ßó0ïmJæ–Ož¢?À çù~Òµœùa_FCyÖL¶_>‹'§qÿˆ+ù$ÛF·[?çók|<~¬²ص÷+Œ矌ú=<:‰'Çt'|Év—Œˆ\óò]\yJ2žõ³xfâ¿ùl³ ÓÙ†1÷>Σ»çËfþ[÷pëäe”˜NÚŒœÀFÓ·¹‹Í?NáÁ¦°¤pï‘ý>÷òÕ=[¹ú’©ì@XÿG™yÛr.¹zçL~Œc"è÷åÓÜ6v"«z\Çã÷\ÊÖvv.|Ÿï~•Ÿó,G[‹ÞôYÃÓS^Ƭç£ûC§Ò"ÌBF˳¹ý9\7o¾ÎÿdÚ¼± /7LŠ{9oN¸+&h8i{Î<9a½£ŠYùå³ÜñÄ7¤{lÄŸô·?_hhOèÏ9#Ï¢ÿþX­Ö:÷ ,Y²„o¿›C³Øfµœ´=¹oó‘óZ®Ò†´4Ü€£ÃeLº,›'ýžÜ 8;_ÍãnâÑ'72èÖ«éJçG®çÕ‡Þ!³ÇüíÂéíaçŠo™2å[RKk ì­Çðàx_oêÍ…=Óxúá¯(íz½l½l䯛ûoMgUI§Ýt-ý"Ãés÷§dsú¹eõW{ †Œ¿–‹OjM¤¿€5_¿Ã+36â°DÑã‚ ÜzJ'bÝ™9ù5>K«8"Å:iÚê^jÉ“Êä‰÷sÇAý¼ÃZÏŒÄpмs:Eé«Ùé5ˆ8þÞ|`­6~È3o,Ä6ôo¼ùüRö?6ˆ9e"O]5çŠiüç¿?QÒñ &>:†Vf:Sï|T€uÏð·—RÙóŒz°ˆ%Ÿ¯ @WÎêa§ÿd(ü…¯6¸ðÚõëÆØ“\Ìüb5˾ø ÿI£é¾ûM qÆÓmÁ½œsÚÅ<¼æ8î{v<1CïbâqK˜8j8§]÷ WÜÅØ–6ìí.ãÅûú²ìÁ± <íïL1Çóü='s «ëø¶òÖ ÷° h ·¾CFòÔSg³ó…Ë|òe<Ÿ7’gžERÝߊ½O—µˆ_ ûñЋwså°î$…Z0Ë–òÔ„g˜_TsˆÚÙýƺßà’agsÝç1\9a8 pt¼’—þÕŽïoÍI=βãîá©1É8Ï9¤ølVÉI-ê-:X­V @B|sbb¢kîàlÍОÍßÊÆù«ô<‘ö!õàÏfÖsï°¶,Wï{UÃø¿ñØ8å!n¼íf›#øÇe=‰¨ãós´=ƒ‘¿òÆësÉÈõן@þgÿæ¦>ÎÿŠNàï× ¦™¹‹¹/¿ÅÒâMüçW˜_8°ã ƒˆÞ㸴coÞs·=ó¡§chóÊûdo1¥ŸñÀ-ÿâéùQœ1¶QxßEDDDDDDDDäÏ­î¡DK)½‡rþåå¶ ·q÷„ùÇå£8­W ì^.Wm?»ÒK÷{ùqÕrRW/â—©7Ó«à;îù×çdÂè{ù94gÏÜÿ"o¾ø§c=î"NO®>ˆlÜ9G?òsWl"Ç Ä$eñ»-ƒ2 X²ƒÍYÕe)Xò%Ë‚6úœÑ•Èè ï%óg±®â@¯½á=ÏcpÉLflõâN›Á¾AŒý½ò€{Ë»<ùÉj²wmfö‹Ï³(~$gµ¶c1ÀpÄc¥`Å{\sö |ºÓB›³Fÿë‹Lþ9ƒâüõ|öÜûžx}ÿP£+‰Ã.¦ûšçyöÛ­nâ«ç^cs׳éu€•Œò<~ÑxþÑGŸ+ã‹¿0wê$nšH­­&J~ãW’_žÃ²9‹ÈsÆfuÐqô¹DÌy‰÷–f“¿ù'^ø0S·=>Ll6[½E‡=wÄjÅf³a±Ôü³iwÝ˱ ÛwÇB–û»1´ÞÊCu6Z LÌúÏ™±*ò’tæM›CiSèXWÿWŸ|4µ™eDö=¶[§ñéoÙ”–eòë´ìl=€öáµÜ‹<Î0À°Ga¡dów<9ñy~ªZ+X¶’Ï~ØJ©§ˆËÓ(¶Gá<ôö"""""""""ò'PëRKöæÇ3îúKTÕ¾ÁW’OQ0†¶ÝiÛ}g [Ä;¯ÎòÂh°§ÇC­Ž?•~É'svïX¾H tçá9KyxÏAÚ7³Cà÷×®ÒúŸÈc„Sžµ’ú,ï>21Ÿ­2 ÿ0z÷Ž¤‡µœ_¦¯£Üºÿkï8¼Ãé3v(‰"øì׿bbàt:(=¿'¿.L¼9[È÷Wîmº²Ø\BB¸…‚îçƸ¿rã“_ñHôvf¿û ϼ³„è¤PJ¶æá/ØN¾e8ñ¡õ<ŠnXjiÖm%:9†¨áÛù÷ïÙjÝ@t¨EõW ›‡{#³ß}ŠÙï‚áLâ„ þÁ£Ï½†ó’q¼¾Ïþþ¢ òw7#ª–í±“Nñò]T¾¤4õ;¦ã ûÐC‹¨µˆpðû‡ÐáäÞĵ åá—Gbb`·Û¨Ò–Ðu©Ôø6F­÷;¼™ƒò¬"vO ”äRbG´ÃFÂÛyl\[¸Yûú}<Ÿ ²\ }fÕ±á„õ¸Š'_¼¼êÜ– €ï+Øq&¥Ë§ð|äÙŒþÛc\žÃ’Ù_òé7«)e»(õU0xš­ˆˆˆˆˆˆˆˆˆÈ1«FáÁíÀy7^ ¸"Ö|=ÿÍMc—·r×°ÇÒõÔó¸ôœ\û~žòK6¹±™mµŽŽ7ðÕ×sü©m ™¾Ž‚B/˜i‡Üƒù,üb <| W\f%Òµˆ/×”CÐØÿµDDo.\Â{×^›[* íy+><†>‹Y‡#¡=q¶Ÿ(ñƒšHûÈ2–‰l•Œ{Þ \óÑ“„¶:™›_}ŒgãálQã a^À׆ff1ùîZVÞ7,TöR6MH$²ÆýPšSDî×pö‹+ûNØcéÐ>œœœYÉß öŒÉ|wå ιä3²ƒ`z²Xôñ›||ÑG ëÆëûb©ùmñSšë&ªM,v2`Õç®hû+_R|•t¶Ã~÷mÏ)=Êùöéǘ™U9Êïh;–û®B‡ÐT6•Ó œ±q„Õ¨_¨(ðž“ ü€5*(³‚¯ŸÜoÿÍußþ¾·½5` šA\…å-~»^¯Z.ÌArR……&5¦—Ðqa Íð­þœ§æ~‚#¾'çßr ×<ÀS;¨ã³©ß>ãVNÍ)q%ÌŸü¯ÏNÝSt0}…¬ÿî]žx}1%q'1î¤xnXwÿ‚~> $* e,ÿpÅF/Æ_v:'žz!wMšÈ¿.nƒ»bïçÊÁâ–œuÍÜýÄã\™T¹Ý¨<)Þ X:œÅyšío¼…3XEgvFf§ÝË;ÏŒçø„0œ¶Ê1í`ÀÃöÙ³È?ñfþ6$…¨¸®œëxâ|Âò²}îcE!–§pZ—Ârí_{°×¢@–"CMvÎý‚ŒA·rÓ©mˆkÖÓoy©÷âÀV22)^>µnãé›Ï OÛÄ'¶gи›¸"i߬+«ÿxØ8}þ³nf|ßæDÄÏU÷þ!¡2)¾J‡^x0ï0„îž•Ìß”OQQ1EEÅä¦-`ÑS:„t—lÞ‡ãZEàŒéÊÈ‘m÷®X„9ƒdÿ¶˜âc8§gsÂ"[qòØD­ý‘Mnêd׊ùäu˘>-ˆŒJ¦ÿØ[¹g|wÂþðqQÇ]Æ7 §SŒ‡µòïÅT÷h9D{¬1ôìŸDpó×ÌJ«¨ã‰g“²Ôo™¾Å$i@wâ°ò,Í"?–öƒéÅóŸàú§¾£¢ßL¸ñ "{—›þö:ë÷j`]ÁòWžfÆ/Î<—øx+ß‹ÞñV(_Í_nÇWžžŒ}ŸkrçóÅ:K¿XI±Y™ã]»F$Ç_8÷O³Ù\}ÿòõL_jå¤ó{‰í_½Å–OñíOq_—Ü3á¤ûý¤úÿ)Í[?Ìcág÷ÒwñãÜóí.Ü›ÿËÍ®fÀ#Ÿ±ø§7¸Úúÿ|t…û {·NãùÙQüßÇsùùÝK©˜úÙïqxw0o] “¾z‰áåŸsûƒKèy÷G,øéCîíùÞõ%;pe@Ö—Üü·Édô½W¦}ü9ïóäy&Þ:©ÛýõŸ Š{Ýüß 9œóÒl~ûþNM}Ž‰ŸgâÉ8´ø –Z2BétJ¼+c§¯Úvw: 6Xè1¤Îìyüï·0ÆÜ÷4/Ü5 Ïœy¿ïëËeÕ¶æ\ûØMô-þž—ßßJ׫äµçnå,ë¼4u5¥0ØÌû…צ¤Ñî²{xù¹»ßvSÞX@~=ÇÖ}\€ÜŸ¦2³ôDîxæ9^~è2:¦~È~+ÖL9$F—}g éȵ]Oâ·OðïïwÕ\»~+ Ãoåþ³ryù¾÷H­÷‰íc˜-™¿Ü|*i¯|@Ú%š¢ÆžcñÅÅÆpÓ߯cܸq|ª?þ˜Í[Ó™úáLJ!P‘cß>wÛqÚÀïò×óÔsŸÛ{ƒ.µ$ÒФǃˆˆˆˆˆˆˆˆˆˆ°½ r * :%ªž‚‚˜äh(/ ü –½9²*›Aö% †A0¨F""""""""""ÔÞ…k¶z‰ês"Bëîàk„µghßH<ÛÖ“ë«s·?ÿN¦?ÛH— j(=Ç:âóüìÌÊ&55µÞbB `ýúõäææQXTtƒ9¶ÙözeºHû~!½OáÚËwòÊÔyl+ß{Ñ%KxkNÂó™óÝf*Žd´"Áår³zÝz[¶lÁ0ê.¦™¦IæÎ,òò X½fíŒRDDDDDDDDDäزwsiÃI«3þÆíg·ÆêÝÉò_W³9#"iѲ}õ¦¥#À¶™/óÒœ <ûo!rT¥¤$Ó»gObb¢±X,uî )**fÕš5dfî<‚Šˆˆˆˆˆˆˆˆˆ[j ‰ýÎbÜ_N¦SÔ>ï•lâ‡/>ã«åyxUt‘jj/<ìy×FTb+ZÅG‚›â¼L¶g—âSÁADDDDDDDDDDDj±ÿƒˆˆˆˆˆˆˆˆˆˆˆÈA¨{Ñ{‘ƒ¤Âƒˆˆˆˆˆˆˆˆˆˆˆ4DDDDDDDDDDD¤Á¨ð """"""""""" F…i0*<ˆˆˆˆˆˆˆˆˆˆˆHƒQáADDDDDDDDDDDŒ """""""""""Ò`Tx‘£Âƒˆˆˆˆˆˆˆˆˆˆˆ4DDDDDDDDDDD¤Á¨ð """"""""""" F…i0*<ˆˆˆˆˆˆˆˆˆˆˆHƒQáADDDDDDDDDDDŒ """""""""""Ò`Tx‘£Âƒˆˆˆˆˆˆˆˆˆˆˆ4DDDDDDDDDDD¤Á¨ð """"""""""" F…i0*<ˆˆˆˆˆˆˆˆˆˆˆHƒQáADDDDDDDDDDDŒ """""""""""Ò`Tx‘£Âƒˆˆˆˆˆˆˆˆˆˆˆ4˜¦Wx0Âi7`Çö¥eˆq´£‘jlu¾c8I9a$cNéN»ä,ÅÙl]7Ÿ/¦/"ÝeÁ+Y"ÚÓ¯}«7ÅqöÅ£én­à׌T¦ùºÒÝLcY†‹#•ˆˆˆˆˆˆˆˆˆˆˆTgtéÑ·æx½F× oæÆãJ˜ûÙ·,ÞR@0¦-Îú #â×óŸg>aUéæw¶fô„ÿãôðTp†Y+·ûÊñÚÃqÓùò‰×ø.Çäb‘¬ÍÜw£-y87^˜ÀÏÏ¿Âô´]”º\”f‘¶<•à€1œÆb÷éÜ{]"km£Â{Û±<°çµ…ÈÎ#¸öú«¹r왜Ô)”ü›Éq›ØSF2ñ¯mðÆŸÉß/h£ÛŒ‹[Ï‚-å˜Øh9êîì·“ùkŠì($´ÝŽO²c³W[ÊêÀ P’Ê÷sײËwˆˆˆˆˆˆˆˆˆˆÔ©–Vbºô *ý{æeí3’ïÏaþ·ÛëÖ…fÖýœ4º/W\Ù¢Y/1ñÞgù,§W\5˜øªcì-‡rFÌJÞw6‹~Í ²O'¢-€­9}zÙH[’…g÷ÉŒpÚôêA›ˆªƒËWñÑÓsÇý/ñ¿uîªÃhÕµIêù """"""""""rTÕRx°‚·¨OÕ”L¼%…xœÑ„ÖYx0ˆî9„¶™³˜±2—²²\–ϚŶøãèQUðnå‹i IÝYLѶådÅô¡S¤5®}›Y”áþýtζœwÍXNïì çÇoX˜QŠ«$ù_/¦ ¢¹ü*Îmã<¤›!"""""""""""‡¦–æÒAÊ Ý8ZEã4اø`àˆŠÁáÚ@y nïà ðNh狹ÒUÇÙ­ù¬wVÖ9‚eyù*Ol–naÉ®¿0 ]$Ûâú²y:éÕêŠÙ´.‹æ]’ˆµBL›d‡3c·ñkº§æ.!í8{D‹=/C[vã¸îIU×ZžÁYm‡v'DDDDDDDDDDDäY›'$>Xs³]ë~cuY2‡ gÔ¹Ã9©ÁÖ¥KØììE¿°Í,^¹…‚ØŒ¹h#zE±íÇ58Sü,_´òŠ,ÒrbrþEŒ;÷$:[R™ößïØXÄÕ‰!} V,Ø@IÕ Óã&vàZm™ÁçKó©±`’¿„ŒâX:Eïà›Y[HèÕ†p sÎG|WGtÆ7|š4•úê"""""""""""ÒxÕÚuáÈ1ízw^Ù™í³f³IE‘&í¨Ïx‘cÇQžñ """""""""""ÇDDDDDDDDDDD¤Á¨ð """"""""""" F…i0*<ˆˆˆˆˆˆˆˆˆˆˆHƒQáADDDDDDDDDDDLÓ+<á´0„áCûÒ2Ä8ÚшˆˆˆˆˆˆˆˆˆˆH5¶Z·:;pÕC7Ð?dŸí¾5¼ñf1cÆ”2ùéï)LÅÝWøyóɯɴuç¦ûOeþ£¯²¼¢áµD´§_û VoŠãì‹GÓÝZÁ¯©Lóu¥»™Æ² fÃ_VDDDDDDDDDDDBí…€@ ^{ÏÓ}{6f¯­ÌðQ<áUq¶fÔÍçôðTpZÂô÷q¼=G0¸'^ã»ÿ JDDDDDDDDDDDöUwá ~· —Ë·×VG›~ŒUÊä´l ÷œ%×_B×°:Þu<õ_6%cüCéž`§xó|>}+ ØSFrçE^ælêĨ^¼ñܯ$¾”óNhId°˜ s?æíY)«>}Á[ÈöŒ HÃfý}»=@ie¹!"""""""""""òÇ5L.s^ÿÔŠ­Lyâ]VZûpÅ•ý(šõï}–ÏrzpÅUƒ‰¯ªØ[匘•¼ÿîÏ”v9 :neê¿âÞ—Æ2d '·¨V\0ÂiÓ«m"ª¶•¯â£§æŽû_âëÜ•Û¬a´êÚ‰$õ|9ªêžñ`‰aè­“ºgƒ‡Ô÷þÍëùõÒ ºçÚfÎbÊÊ\ÊLX>k'Ý} #æó€w+_L[HjD$€a '&ÜƆm¿ðÚcK±¸ª­ãälËy׌¥SÕËœ¿aaF)J™ÿõb†wJlD/þryWÚ¼ö0o¦¹ÿà­‘CUwá!uzR IDATXÊ’·_gfæî¾ A¼¥åIõÒJXl8¡/æþIP9ÁÀnÍg½³r‚E°,"_åZJe«?brØ0κìNÆE²êçÙLŸ³×î•“ÅlZ—Eó.IÄZ!¦M2áF%¦…ˆ”¢ªb+ÍÙÌöRõx9šöÓã!€«¸€]ùûôx¨÷”A\Å.JVLãáw7à°„Ñ"9‚Ò¼$ƒ¹§ƒAh³8ü©_óÊ‚éØãºpÖ_ÇsUY&OýœOÀ—ÁÌ7^`Éð[¹T œ=Çsß„~¤–ÄЭ{V€Œ/yêÙɆ×"""""""""""RCÃôxØÍ°ê0)Zû+¹ÎåœÞñD„ÇÓsäuL׈W³Ùk,7]} ¢Ø­•‰`pŸ BH;ÎÑbÏËЖÝ8®{!»7´<ƒ³ÚÖ_‘Ãk?3’?ué1\2ñ¯xy‡)ÄqùØ[øwœ•’mKøtÊ|r`ßë y >ãÛsãCgà”’þÛtÞ[TÈ^¥÷6¾š¶”¤“ý,˜ïá´K‡dÎùˆ_c‡2(0—o¶{,ùcŒ.=úšõïֈؓ9ç×0$&ï^ý?äê?FDDDDDDDDDDDŽˆ¦Wx‘F«a{<ˆˆˆˆˆˆˆˆˆˆˆÈŸš """""""""""Ò`Tx‘£Âƒˆˆˆˆˆˆˆˆˆˆˆ4DDDDDDDDDDD¤Á¨ð """"""""""" F…i0*<ˆˆˆˆˆˆˆˆˆˆˆHƒ±íDDDDDDDDDD¤q0B“èÖ9^r7¤±Óeí¤ RáADDDDDDDDDäOÌpÄÒª]sØ•I¾5"#Ë#¥™IîÖLŠ|*BÈ1ºôè«o‹ˆˆˆˆˆˆˆˆˆH5Fh"]Zö Ù¸÷A5ÂRèÚÒËæyxë]µDÑ¡[sv­ßBqð°‡ûÇN:u!9´žý\Y¬«‘¯áˆ Yó8b£Â sÚ0€ ÏMyiù» (rù_ìÒhiƃˆˆˆˆˆˆˆˆˆÈA0=…ìÌâ?é6½æ•Ð¢uÖ:w PœW´wÑÁ°Ù¢m"°`º ÉÜV‚¥Y+’#CˆŒK$2.W~&Ûwá 7K” """"""""""µ1lD&u }³pìrr·o#«<€áŒ!9ÑÇæR7^œÄµlMrl(6ÓKIî¶çúiÖ¾‘6+á]Û°}Ã\‘I´IŠ%ÜÄ]’GFÆ.Êü&`!¤Y mcpš. òÊ ‹5Iߘ'$‘Î)AòÊ#IŠ*gó†<,ÍRhÕ"šPø]EìÜžAǬœ¡Ñ \Ädžb¸v±#ÛOlJ1N“ò¼t¶d•Ø+A öÐp"VŒª-Òl¶fäã"”æ-Ûi ¬Ž0"B*(wû0 qm:ÐÒYJÆŽSädº‰i׆HËïg÷äeR`oAÇN¶lÉ¡" âß…¥þ]DDDDDDDDDDþ|,ÎbüY¤­]ÏæBñIQû<Ém`J&9¬Œô´u¬Ý’5>™8»—Ü-;(õ—±=u;%Öæ´K §‹ ‹Qs?ÃbÃf5ð—ïbsêVò}{½‹3&{Y9%~Yy"ã·Z‹Âlò*|¼¥äd—ï=+!PÆΔ¹ý½…lÝ°Ü2@€@ÀÄbý}ˆ×ô“[Tyâr/îÂ]{øÊK¨Xk‰½ž;Ps“%Œ„f 3s) ˜}.Ž8’ãj–|.¦é¥hgîˆx¢€4QZjIDDDDDDDDD¤¦ßËï«Õ¶LI $ƒ-¶Ût¡•ÕKq^6;sKñîÙÇÀê°àwûÙÝcÚô{ñÍb€ÃB Ä_uv“ ÏCõ‰L¿ßžþB›%Ó6ʉ%èÅcZ Zïf3 zk3POWë`)Û7l"<*‘6IX%)¥9îŒ\F(ÍZ&RÙs:HYvÙ%”ûøòtl™@Á¦Ê]»È*£õ¾ÓÅdx0 ±É-)Ë¢¸ÎNÜr¬9J…“€«”úš¶0ÂBmí:˜é÷à ˜`X±;ìG=ž#­öüxËËñÏç$""""""""ÒÐö?Tn`uØ1K³Øœ¿‹#’Äv­híÝÀ¦âßÏð°…Ø°À°9°À4 øL¬N^L ,vVÃUK öØV´Ž(eËæí”ûÁ×.Q‡–ßí¢"¤²`a¬QItìžTcÏ ·‚r—¨ÈÞF†³:ZIßšEÁ¶MœBbl8KoYYÙC‰oÛ†D[!›·ã«qV9VÅ¡ô½s2÷õßÿÊ^ž¥Ïs󫩸PT5™ý"{řݢ±ywðÓw+ÈÔä±a?ùÛZsé³ÿfløV¼Äÿ½´W½ç9vØ¢[Ò!ºˆ-Ûòqïûd®aÁjOq¾øD"=京Ä$Åc+Í <Ä,(Æh—Hó¢øChÑ"k£l†Å‚ôã‚a ¾y(V¿ƒú $ûa8ˆ‰®g ØBTB ΢\Ü&`z)ؾ ‹Ö´îÚ•øÂ]äd²)Ë‹Ï´âp†ך®Í# h'·âj¶ÃŸÉì‰ 9÷dÚ8ÝlûákæçÖ3Uá˜c£Ùñç0öŒh(_ÈÚ¹¦ÂÔž¿[Hûö£ùó0ñägޚݱ}”îd{‘°PRá U—¶Öog[¦Ö­:ÓÂfâ.ÍckFie/‡Š¶å¶¤uû®$ÊÈÛUŒ7®öe¼…YäG·¢kÏ$|®òòváNiIëèr¶yk9ä€Rð°k[:!mã1 2É·¤Ð)¹r%WÖfvøãhÙvmË«,:ì9ÎGIöÖDߌøÖñ„9¬@Ð禼´˜œMÖ·ì“ê.<vš÷ìG«¼å¬vãÔSN h›»E Cè7 †Í ×°«AæÇd1còçlªñÇaâ+LÇå.¡Ü6BÂÃö v›þr*\L ìa8­•µ½ ßƒ×ë#01 «ÕÝé¨\3 À à)/Çg‚a#ÄâÃëóšvg›â+/ÃtV ɇ7`˜Aü>7>ŸŸ`LÃÀb±aw:±[ owЇ×ãÅ4Á°X±Ú8»—-2 ¸KqÆÜCm~;Ƀ/àÊQèÖ>0O[–Ïå‹/~dõ.¦ÀãOæ¯/?Ĉ((šóϦä¢3ûÑ-%”òŒÕÌùôf®)Àí cØÃÏqmÛê¹Yôô¼¸¬-‘F]ÈØÓzѶy8w;7/㻳™·±˜ºêy¦ß…ËåÇ‘<˜‹ÆŸÍ Ûå§0c;ëÎä“ï6P8ü¹û÷¯êÏ FäóÀÌìj1›øëÌÿvž_ÁÕ—Zzq%…ŽÜöæ¿耜Ïçs$—èIŠ=Ÿ Kçðþ»?ât)WìO×ä0Ê3WòíÇ1sm1Lžòús8د›ˆˆˆˆˆˆˆˆH#e oI×Ö±)“’@ñíÚѬl i9nƒI“UÇŒ“ o÷ZBÕ‹•E€ Çƒ¯A¾ýÜe%”UTßfÁ݆%ÀÖWP~òI„;:rB++R+ðût:¡V€Ò•,H/ÃãsÐyÜ2™¹Ù{¯“3èF¹gÿ¨–Çqþ?cqßû³ó¬nXͶf½h PÁŽ ©l/ñá Æ0膇¸ýĈj·'†”øªGZ=3‰÷וS£.cðºDw ONâž7lĶì‰va`ÿ¯xôé™lqùkîö6£¹ûŒÞ´²kLÒ0°9ëÈ¿¬þjS‹sïâ_öÝ'M ëKy¨ÇHŒØ˜=ñE¦ÇØ›#(¹ç9~ÌuX9šž%""""""""dž`y6é­hÝ¥6¸Š²Ù–çQÑAš´:Ö2)ߺ’Í»—>ò¥óóÿþËä)3X°s÷Àu9©«²ø£K‡í­w½ûÓ>©þó>¼s?g'XÁ°âßþËÊÂè~|ÓOÀžBÿn•U‘Ò‹ØVîÃHÎõUƒÖ™ß¼À?o¸‰xßÊО\2®/ÑûfaeýWoóä¤gxeÖöÊB¥-§õÇ,eÅ”çx}aUúò•ü÷ù7˜¹Ã‹×󫊹³_æ®NàÖ‡ßäû<€f Ó—˜ÚV zñ;;rñ UEï&f¼2‰;îù7“çd¬íÎåÚÓZ`=̹‡uéM‹ü,þåGlsÕ,’Ô™ÿ¬±eËãÇ)/òø ñkaå&kl åË?çŧ^àÍowT^ÏÖ‰“;F`úÿàç'""""""""Òdù)ËÙʺ5kXµf=3 ÔˆYš¼Z†pt¿æž½ÿ2z:<¬|ï->ýek–ÿ̇“?aC œ®»‡gGGÇáÓÀâKgîòÊ)±½zÐÜðc4ïIß8€rV.HÇ4hÞgmü«˜úéb2 ÈY?‡ÿΨ\ëÌÙãD:†î] ®ÿ€É_,fí¦Tæ}ò!K<•Û#š‡ÕU™‹ ‡ÃV9ãˆnߕέÂpo]ÀûOLâ±'žaÒÔõ”×r¨iq´ÂÀX“´Þæ³eéäfoå—ÿ¾Ä´ìÊýZêI3ËáÍ‚ïyä¾gyåøruqÍÂÃ!pýö!ý¼ŽuKfó¿Ÿw¯f·OßÿŽ¥ëWñý´™l®Úê·ÁÍADDDDDDDDDDZ–Z²`¯ÖLù…Þ=S{Lw… ¬jƒ3Û!?^Gsé`™E•Cá†ÕÏÖŸVR1d0a-úÒ-êSvuíG @ùjæ¥{;qíšUeÖ›;ßšZóR¶8’#­Püû¦²œ‚ß;²]”z'`Ô=ÄmÁR±žÙ+*ø[ß0œFpíí#¸9V°xá/Ì]Xˆ§Öâ¤3¾1ä°zcÉïþþ\–­*æÂÄhˆkIœr‡/÷Š +ÙQ{‡¬|WyU¿“€¿êÞb Ü•ÙšÀ>…ŽÏai¹–[iŒj)¥iš€̧8°ïÉÿÀÀ» èÝż'²¹×@†îÏ€ã;“àpÒ¢ó@FuÈý¦0ñ……äï3À0,u4‚fU¬°gBÊaÌÝï>ŒÍšÍÚÎlÖq½CùüDDDDDDDDDD¤±¨¥ð¤dãbæäé<¸+]íÖëBî}ò\Ê<¡D„ìÞÏCúÒyÌ]QÚËó˜~ü5b7°Ú¬Uƒôß6æ®pqÒàP:œz*ÃÚØ€ VÍ߆°Ø J2‹pp¥ñÑ ÿa­Ë×å"–HëÄÂœ~òòýiyÓïÁšDëæN¬«ùò??ñ±é¤YÛž »ð Fu ÁÙs(Ý"ñKñ>wÈb'ŸA]ˆ!ž™±³¿×…×’Âñ½+çBP˜A¡¿ñå~¸ 9ˆˆˆˆˆˆˆˆˆˆüÙÕ±H’ÖÃGÒÕ^m“Q½èà¤ÏÈ´°Ò"hÓ¥+=»ïóÓ£;½»µ$¼ê!xÃêgËÜ•¸{÷³é¸Ö1o«»*+%«~# ôx.8½=a¡)¸ü§yzÒý<|uo"ªE@å“ø{f!8à ³asÛï:žxìa&=2‘+·!ÎZAQn&黪¦€\¸µ<ßoX1s~eI€…®—]ͨñDÇwà´«o悤ÊÝ2®"?p4s¯;ÿÃâ°å """"""""""GJCÈ>¶ý>³[]B÷ŒÙÌÊ?Ž«FwÆ ”.ý„÷ÒZqΈh~{÷g²dÙ›ÆÞr{íoU,æñÛß&ÕÞ%‡Vº1¨ªâ^»€­{–h2æýÄ{?žÈ§6§Ã˜»˜<¦Ú¹ü›ùôÝ_È=Ș-vÙE@ ØzsË‹O³àÉ{xsíWü°ë†5â¤kïæ¤k÷>.{Î,Ö—×±°P ƒ/§üL聾³+Ü>‰ ª‡ºuoÍÍaϳýG)÷ºóÿ/­:øsíßáËADDDDDDDDDDŽŒ:Ÿ]7+¶0ãùǘX¢ vŽîL;|l[ºšõë–°~ñ¡\ÖÀI¨í]7ö~a1s˜¿Öà~NÀÃÚùÛ¨¨¾K°œ5Sãþô±\<¬[Fcs°mõ/Ìøâ{–çx0 +ÎððšM±ëÜnP²äc>=îZF÷nŽÃSL‰Ï$X–ÊÔÇŸ'sÔ ëێĘP¬¦‡’œí,ûá+>ÿqu6P0)]õ!÷Ý»‰ó/Îñí[’ (+Ô…_óñìµìµ¢ÐaÎ}jÍß‚#<Gõó6B"ÂØ÷cµ8#Û½ãî÷ ;¡á¡Ô˜0s 9Dè""""""""""rd]zôÕ8®ˆˆˆˆˆˆˆˆˆˆˆ4ˆƒyî]DDDDDDDDDäÿÙ»ïð(ªýãŸÝìnz¯ª¡ƒ4”*\vņ¢`»öò "ŠWåÚðÚ ö"ˆ¢Ò•"H¯¡…„ô^·þþ @²› ôýzžñà¢Ø`«6|¹P[r+Nb•À©ÊýÃ¥…J+pÉäg”á$VœºÜ'lûµà—Ýj6âu2‘|u2´íØÕuhÉÜDC¯¬æ–ƒÅ´i¥s¹²÷¥)³ ¼ús¬)úñó¹Úk;‰5 Võg<Í ‹ŠR´åp‘+;]û%É/H‘QAÕ_m-Åý=à¦úÇá(îW0ÈhòãYÀ-“çÕ&vÓùêgëx…š%9J”±cµ~™ù«V¦–UæøGó0Õ’Am.ÑÿÝÑ[Q®^¢}ÕÛqõø(«=®.% }Bÿ¹<¡F]ó4gÂxýueqU`µþ¿•ïá£ÇRçÿ+VÙ¸”_Vµ®&%^ô¸ÆwúULZªÜƒ« !:óÞ‰º:e²žZÓWO»‰«1f žz¨±>yâSí°zx¯¨Ú/uÇáˆØÖ³Ÿ¸JtfÖ^µöt.±ç©–ŸJâ+£¶Üƒ1H-úŽÐU;«Ub˜œ¹©Ú¾úW}1}Ås€1J½n¹[7v)Ögã§Ê>âNÝØ¥XßNÍÔùÃ2=÷¡ú h§;ÿ{¯zú,°*wÏFÍûê3ý¸µøÔLÌÓù£žýþ Z×ÑùÝvõ9joQaò2}ýÁ7ZZ×9Á­óž|V×7­²ÿmoëŽÿ¬•±mѧ|q®6%觟RÿÕÏêÑiûd“diy•^||€ÊgŒ×¸YérÛ-MuÑ¿ûkëŸú?ä°ªçŽPýkü3º6±ÊêìŸôø¸ï•rpçµÔÃS%“¢»Ð˜«ÎQ›«ö­ýY|8_;Ëœ^¨®LÖ}jÎVjÕªÉëõM‡ÿ››Ð3·9õÆø*u¬dIªòw×RWÌêw€†Ä}âÁÒB#nªÖ’¤DuîÕ6ˆÕY\¢³ª•%+ÿ¯ú%ü[߬wÞ¸^í )šýò«ú|é^ÙbºèâÛïÓÈ¡Oêòt]0þwÔa)^ò€zŸk>”x0¶Ö-oÿO—l™§îØOc„ú>ù™Þ´OïMzD×fÊÔ¤».¾ëQ}÷e[ºöe­*>wzv’ÚzJ:ÝDgôÌЯ‹Jk¨òoÚK]M)Úk줾-´u«— =Ws_zQ3Rª|õwÙTfHÔ—ßW¨ðcT]Úf³>›]®à7ht¯}þìCZ[¡Î#îÔÍ7v×ú—«ÀÔL—Þš,}W¿[¬¦ÿºU£G¥MÏ/UnP'ÝtçiÆuÿÆ õ;V÷^°WMK‘Í`Vlû³tnŸ~ÖÆ¢UßÜâ~Ÿ9?«¥©†ªÄ€?+ œ*Ú°P\¤ÓW~¨¿Ü´™¦}̺ÊSÒá “èåЭ¿9¼Éž§ß&¿¨i{­2˜‚Õ¸û%ºsäͲm’fgü~Âbâ Uã*1îp•›˜¯­ýUºç‚Í|õ1-Ë Q÷«n×½Wî׸OvèÐX×ñ‘Ǹf-xE¬2zXŽ¹ñ`Ý}Y™–§W¨(­®¸š<ø6µð”t8(þbuô‹þø!µJ_¶+cÅÊ:¿NX¦…yÞÃtšÎ=­H+¦íWYnÈëáøU(¨ýMîã=Ä IDATà6¶õé'.…§ªS}˜ölõ*ŽÖÌPÿêçFcˆ:_ÿº¯[–fñž>MΗ_l+õ¹äjMx¢©^xvš¶ºÔ££U_?õ²—´Ó¿+_PÑBù6/k[®æ¾þ¢f¤Øe ‰QÒYê¦TФIúz—‡)øþFêÛï=­3ÆöÓ=c»kßÇ“uÏ«’.¼S·ß1X»'ü¤¼¶Î ¦p5 LÓ¬Þ֢ܭÄi-P™œrÖãœýaðS@x¢º »Q—&”ëåÝWkæfj)m]¥µ9:º#o·JœuÔÃÃ:S“azøÎAŠK_£y¿«÷¹—ëQSžœò§ ]î^gWκ%Z’o9¸Eu8S" ”^\ÿ+(ìGõw·~ÿ+@Câ>ñP±Eoýß“ž>]§¬õ1F©ÿ}·¨½!GÓo¿A/ίüÙ®u+×*ó³¯uߥ誯Ñ;»ªŸºlÅÊË«\0„ªÇ˜'tß—ºeÂ|e»üÕ|øúÏ«kL™’LÕø§¦ježS2ø«ù°Ú×ù·»GÓ&Hßmé¡›/l'æÏõÔ”,]4nŒ7·kíG鶗WVK‚XZ_§Ç/*ÑëWÞ­·^.œºO[Öî}ú‡wÙ7ºá¯õݸ]uÍgJqHAgNÔìû×èšQ«5ü­gÕ;"Dg|ÿ’î¿ì!Íót÷@U~jÚ=¸~ÛJŠè£¥{UxD2È_-Î=]ŽeèKÿ[4æœæ غU^M=¸œª()RQ/â––=tÕÅùzi}ªòª­ñSD§á=r N3)gÓ\}ôþL­ËwJæxsÝ-ººO3…Úsµá§õƬíª>ûŒIñgŸ£€?ßS¶Ó Sƽû¿ýZŸV,SP€JÊmª(.“Ã%ù7ï§^Z¤É¿nW–]Êž6YODU() eou(]¤IKö*×.Íùn£Ž0«é¿FªwþFå„Uy¡-M¿o‰Ó5]õnIþ‘I"?ƒô¨OL:˨ÄENí>"æãa“T¬ÂÅ?ëá¨}¼E?ŽI™Á¬„³®Ô˜+zé´à%/ýVo}›¢3漏!jó̽÷I‰.¿x¿^˜8O™NÉ¿Í(Mºb‡&>·XEMGhüueúiGg]Ñi«^šðƒŠÚy+®’ îb`ÍmÌMŠ?½•´á#-ÞY  èÙË4ô¾³ÕÔ²£òŠÿÚãã)®Ž²|e¼:Õ§Á7µÔÚ'ëÀ¸pq5%(¾o‹zÇ5´oÍùFU»“=kµ–dUßNZ¼8ON”ÔK­JVkú~»LMªÄÕ¤¤Á7èÖ ;+Þžªå vÊ|hOúžÁ¬ø³®ÐmWôV«ð ¥ýõ‹¦NýE[Š\Ç?“š{ŠƒÍ}ÿª³Ÿ¸*Ô²¤þg°¨Ò……Ä)¿Ê]¦ÄAº¾w¹¦O˜¢YoÁÊÎÒÞä49ž~H#ûoÔ¢Ž·èŒÐ`uyòIõ.WëÐ@uyì9?ËÕð sÜ÷¡/W*Óæá8ñy‡ÏŸÅEZ5ó]•ÅLÐ]´Õì)ëT"qqóþùÍF깑énûíÓ7IKö¶ÕÐ^ÍdØ3_ÍÈW¯‘èÌx‡’~G“§mU‰Óýg07¡§o¨Ð“4⼊±îÐì7ßÒô¡:¿Êùã¿WЈ›½Ôï%ÉýºÀfÝ”ö“^[‘ªB§ô×쟔rnµ ™'‹‡¶˜ì¥FyZ“’¡ÌšwRÖÕkã®MØÝÇÑ’TG¼ês¬Ç¿£ÕÅ.I…ö¼OO±F ý4¬kŒl{þЗï~¥ß3lry8˜›Õ<§¾zßÒl„&=yž<] áÕ]7<>@綴(ý¯õʇK•Q¯ñùêmÀœ ÆZþͧú:Ã%[Y…œ•ÿ:Yš»¯‡û:šß½‡”§_Þû@ŸíÔŽøÿhlÇ>jð§6ĺ{M)¿~®wî%á<=vö™Êúuª~¨y[ƒ$ÃÔñòt_¿ÖŠ,ß®Ùo½©é[KeŠ­ãç­ô¯3ü¥=_ëƒ?j|yªØ¡¯ß]!‡’4øŒ¨Êù¹k¯zìàqzõŠ|½~ÏëZYä’¹åH½öDW­™Îp»¦º®Ó+ãú( ë$)°ÃÅê´ò1?xŒ¾ ½^¯Oj£ÙcÎW¿±³}ÍXõ ¯:'‡I ½ú)f݇ú&¹Æ%å[ôù‡;Ô|HwEº;º¶]zì8-Ë_©û/~°þII2û+:²þ›+"TÁæZÊý›©o§ -_ºKÛ—®“£SoPËv'‘1ê,ÓS9ÓŸ×]÷LÒ·ù=uû­½m0(¤óUº¶ÕV½;î!Ý?y¡_¥¾15Z‡1B§w5iãÖB9å’5k›Ö&+䬇ôîkÏè>ûõåWUì2($±©Ë5ð¾çôîûSô꣫©\v—Q¡ãdÌÞuè¹&å»”ÒTQfI®"møþ½;õGm)®Úr=íóÀæ&ƒtóÙ©úì»m5ØìÊܪè­\ÛÔ/fƒ:MÌ#J¨-æÕ˜ÑæLu+VZAõäž)qˆî¾&A«ß~RwOøBÛ[]«±gÛ4çåµ±x«þ÷ÄÛ•YîYZ Ñ°?ôÎÛ¿)3Ü›q•‡xŠ¹]ù)9òoÓCmÃý$cˆ’z¡Ä¨FŠ±8èµÇ§î¸VVRáÝ.× âõÃÎrXUW\ãã9JÕÄ´Q@͸:²µjq¦šœÛ¡ò\ –}Z©tÕ*¥U «A­/Ó¿/ Ö²7žÔ=Ï~§œÎ}•XÙçÝ÷=É”0Hw_—¤íSŸÖ÷¿ªŸ]çéΑrLñ«#nc[ã)›bfþ{‰Bªø)ªCg…'ÿ¬…i5­{5oNªºEjÕïëÏ‚zoÜÓšøÌ»~ê -Ë;üæµö¡s¢eòpœëä*ÓŽe[åhÚVq&Oqqÿþîÿžàß¼Zný@<ü²§»G7Ñò—ÿO÷¾²\a/P§`ƒÇ¶"IææÕ×:[Ï<ð˜^Z¢!WvS„#]?:¼£mIWz±ß{^W¶ñ}=þÚ Èíؤµ"Ëö+«Ìê±-ú…7V˜_”†Üó´^{y¢ž;T#Ö±®¶x$w1±xˆc]ê>Ö5ÏÕFEŸ9\­¶LÕ¸ŸÓ§{Úꦱýoò|ªŸÓÓ«ô3[Ú¯zééçô̻˫$Ù«‹í;X- ¶hSŽ¿Ÿ}Fž|ät™µ©ÑL‘ÍeSÏ{^Ö;¯¿ª_¾G&ÉXG=ܯ3)¢i˜¤íËsH®reg”H¦%„úÕë³É¥>7ŽPRá"½÷}²ÊjùÓhŽ?K=Š¦ë©{ÕKKÃ4ä². «úÿ¡½¾ýãèÛøR—QLÁŠiÔH‰«þ4QÛÞ—ëî±ÃÔÒ¿®=Ôö®þ T’§àóÿ«_ÍÓÒÊŸ…ŸÑieù*—êïöË©¥Å•úïÄÞZ7áa}¸½B’YÍÏ¿P±¼¦·íSAÎfMùSåõ¾R]C<­;°?{ê¯úè—½*ÊÞ¨«Óµ{Æ'šŸZ¬Œ5 µ®Ð_áUkâ§ð„`•íÏÔ‘rpª05C¶°x…Õ5ÊãC-û¨CÉr-K·Ëšò»ÖØÛ«¯·3¦ jŠ¦¾ÿÖŸ÷þ«û:»{£¢º P‹]Óôͪt§êi³”Ö¬‡N 6È` æE„U˜ü«^ø¿W´0§ÆàS@cuŠÈÑ쪃†.þñ‚FÝõ„^_ÞH×ßÖWq~~  PPËn²,š¢ûï~Z$·Ñ¨Û(Ád”9Ð${©õðʶYþ²øyú¦ïiŸ’L |C¥}õ61 *Ù³¶«0¾½YŽÜ³×øEëü'_¯ŒÇ½z_•þ:= 4WŸÖZ¹b©¶,jѯ³l‹¾ÑO›³U˜µI³¾Y¡B»ä¹ï™ߣ—"6§Yë²TR¸W‹§ÍUQÇ~j¨cˆ_q¨Ã‰=žF…Dª"7OGœ×]*ÉΓ=8RÁuž×Ýõ!—Çs\}8KóUa •¿ÑS\Ž½;²ÿÔœU™*-Ø£¿¶ç*}é\­Î.SÞöuÚYjV°Å¯îÏPºU?Ìß©Âò—Š*òµ}ÍV˜Ãäïáxê'åð÷S-É À¤¡º÷®JtóÉ•2GùÇ2&`MÓ_©Ò9Iý•øûÝÜ·ê€C º<ú‚U¡½Éyµ>ŒÐÔQ·¿|ŸšþtŸFÌÚ_¹IáU¸+óÐtAöÜ=Ê1Rl EEn×Ƚ8+ŠtðYÖN§CåE•wb8k¹Ý¡‚ô¶‹SA5®p3*$!VæâE*rÄÕ¨¸±~_¶=±U('_j\ß+¥ó‹TrÄ7æ%ÛYQM5aÊ0¹dÙlRé9-¸i‹¼6{¸#W ^{M³Óá;UQ`•kÛبàè`u¼I/¼v}åq2Êbܧ`—ŠÖLÕ+¡CuñmÏjTp†Vþü½¾™³^eU®¼4F)Ä–¯R‡$”ØRñe)Úk“³,K«ç,Töø.jê¿Hiv§l»fkÚÊ49¥u?þ¬}“¨mè|m*³Ë/Ð|øê`s°,.«¬oçqÉévŸ¿ÉÕã: Èž¦g6ËUKìœÖ"•š£kOVÙ\Ú”'õŽ­e]mòœÚ_Û(‰³@‹§¼¬™û’Ë¡²¢<UŽ°Ã0)$&@%; *Zœ*Ýû§–I’§0ƒ¡ZÛvg*Ïæ’äçå¸zâ)æ¿)³4KË>|F¿ì/‹Á*GÜPM<#T%V£º‹§¸þªýy¦0 j?T½*ib+å=Ç5SùÙRl£º>W¥ìm*«%®ÎœµZ¸ÿBõí©•™=Õ¾âO½|Ä ³Ÿ‚"Í*Ü(¡fÏÛ¯BGŒ<÷=“‚£-*ÙŸè¼à(ÌT¡¡›Â-:¶øÙÝÅ¡î‰C<O™•e’šº!¬É¬¢ê{Wqn™ü›FÊߠɣ£"d*[_vè®™Ô¼³»ã,©¸î*Ãåo-T…ÓÏC\,²¹éÖ¤;¬Ño¶RY+?·Ë锵ÔVy÷ÎÁ¿ƒžúse=Š³Ux0NG-?½Ýïëf m£á£oÑЈ­šñòÍÝ^ù€nm±"ù+=ùÄá}d|>S½'öQ‡°EÊÌsÕÑkr×&üÕ¦—»8ÖòßÂçÙºŽõ‘ìûýßæªÈQZ©¿b‚ÍõˆëÁsúÑ+Í+–C’ÑZ~èºúü/T½ ¸T´ê ݽêàZe6;Cÿ׫“:D}§éÇÒP\²UØ%™*ï&3Ê`’Tªòú|VCÚžw¦B­ëôÞÊ<·ÇßQœ­¢*qª«NžúÇѵ;ð-÷‰c„z\<@‰é»™›åÖ%:ϼ@Sç¦Ëܸ§.îïÒ·oÏ×Ñ^-I²îÖŒ×êöÇ{kâó×kßýŸh]áç04ú¨^¹.^Ê›¡W×2cŒÐ¹NÖÍšªëþó»ò}Ós¨0½La­b m²J2E5W´«@9å6ëŽe–\»Ò_¨ì߬+[ÍÓ›Û«L·ÐV#on­Ý߬V®³ÓdƒA’ ŒKPèñ~Yt”+åÏþ¯ú=ç!e¶Šk~Ï ¥IK Ü|Ù7)¾ïͺÛôýd§¬’Œ–ù9­²¹œ*LÏ“Íè'¿ƒc £ rÈîrª(-SÎ~ÍiZ¯R»d‰m®ð¢½Êõ8 éiŸ5évšâÚܦWÎtÉ`ð“Ñ(=ür‚fNš¤i{í’Køjq¸ôÛJ§F«ßs’—;•VÛ؆ˮ’Üefyú •å[*“²e•AÁI4$a£f­®±©ÁPY_ƒü#£Tµz.gåÜÛÞŽ«'žb.Yš Ñu=Sõí´*tѲ£¢ó7*Óê)>ÏkŽÛ¸$¹$cˆ: ]Ñ‚e*«í|ëÊÓÚEéºâÜ®:=­¬¾Ycš%Ir¨$תÐ&òSå´%æg“çÙ[¡àÄpùkŸì’üÂâæ*U¡Õ  Ø£Ÿû8Ôã x:ží P÷‚ú=ç!7(\EÕöãPî¦u*¸ô_ꟸZ3÷U9Ø–&:ïüD¥/Ü®ÂÚ2‡Õ¸ëC›µÜíq®Ï g ’z·•ß¾O•iw(Òm\lnûðÏéòÜoëäðÐV\R°$—Sž?ñ˜Úͱ2´Ôeݦ>Ôc¯mT~•s£û¶hPh«:Ýo‹þ88Õ“Ý*»Óy¸ß{j‹Gp×&¶jÛ8VÅ:γG› 0…'(Ü$•Ú%ƒ¤Ù´«ÌV¯¸:-ïà%f5v½F4ÏÖœ©³´¥Ì¤à ³$›ÊíÇZ1»òS ¤î‘je‘ ×(D²ïÖþ¢z$2ZêÜŽþ²ïX¡d7w;H:Ê8ÕÑ?ŽªÝ€o¹r0Gë´8—vÿ8SóW¯Ö¼_7«,Ð¥ô­›´jÞšº¶±.=¿¥ŽéËCû¦=®'çç+èì{õõ’_ôÃçS5}ÎýòÂEj$IamÕ«]X ú©Ñ…Okòðl½ùäWÚc UXXØŸ£öýü£rzÿ[·“¨°¨vºô¾ëµìk­)¶jÛuÇRɺýSMœ¤»>x]÷ ë®V‰‰jÓó=òÎÛºY_ëÙi)ª(Í“£I? h¡ ¸³tË莪6Ñ1@¡G÷ønÉ©¢?’µ-·›æ¦êÏ¥5r N:G*ÖjéŽåç(?¿@™[—i“¡½ú%U^Ön0Ê?8HAA‡üN5äiÝ1s*û¯¥Êêp™Ft‰WhXcyÙ}w]É °n#õðØAjá/‹ßïÜ®#Tβ\›#ä'I6íÿs«üz^¤I Šh¦s/é«àMKµ«Â¥²K´-f˜®ìÓTáaÕsÄpÅ'/ÑæB§Êw-Ó¦àsua×Xù5Sÿ :ªlÕŸu$Ù<í³LëÞ§ûz\=ú„yé'í/Ù¨·ž~M?¥Ü0XBlÏ­œúæH)Kmú:§‡1Ǯɿ;ÝN Q7›ö-[-Gœ®ÀˆVú×uÃÕÉRy5­Ñ¢ £œåÅrÆtQ·¦!òh§aÃZ¸M(y7®žëî>æ’½¸Dñý®Ð£Ñ´§®¹´‰öÌ_¡t{¹‡øØ=¶éÀÀfŸ–…Z}p€² Ïqµ«ä×w´'£®Ï%)c¦6ÍKs3(ëRÞúÅJir±®ëáЪ#¦Y’$«ö,\/Kß+4´]´BcÚë‚ËϨ¼jÖSŒìJ_µBGhx§…6Õ¹—§° ´£üØâç>uÏÇÓ ÂDmôpß!¦ýâÄñ´§ÎÓ'Ë4âÁ»tùY­•£&íÎÖ5÷ß«¡Z¨Og©îáHw}Ȧ,·Ç¹¶ã'K`‚‚‚ÓL]‡Ý¢ÛÏ*Õo³¶ªÄå).îû°£ÞýÖ‡‡¶R•çïö{o¨ÐÓ/Tç<}±0S–¨XÅÅÆ*.&LþFOmÑ …¡ëo¿NƒÛÇ),pWDò'n×Ëc*äÌ×¢ WëŠ÷èáÛþ£›ZÅȘ·G«~E×N™¡uÅ.i×4½òs?=óÕoº{ïb}ôÁt%_TùzkŠoJÔs?¼®ÒóïÒ/õ¹âõ ò­}o‹,£Û©E”›mò2õû{»•]ó˳!P­ûµ•uíëÕ¯Š.ß«eÛŒsNK~!ÉÒT#'LÖÈ*›lùßýúÏ÷ë&ýYZÿÏP gÖ½95FcFŽÓ”h£ò¶-ÖÔw–)ÇéqágšÝæf=4ù"YìJ^ò…ÞZUãêØò4mÈÖi‘&mØoWùŽéúßO×êšÛŸÑ5V¥®ùES>]w`þÂÕz÷xÝzÃýzu”QYçëÍ÷ÿPŽSRÉFM}ý7ÝvËczë6‡RVLÓË3SêÌwºÝ§S*ÎÓÁ¼Ÿ©TvG¹ ó M#bŽm¥°ŒMJwÓ—\åN½õ–Uac-:?ÚMršð–MëëwÁ·[Ö=³õÚôktëÝÏëÊàRíY6Mo.É–ÓeÒºÝ1ºåÙ»T>îS}»ª³n~â%È\¯ŸZ¬´ÞµïÏÛqõÄcÌs—ëýÏOÓÝc&jˆ2´nîzu~¶’žâã©­H²$vQ ë.Í,8r𫮸ªl“¶Mú¯LݯÄ87Ûdý¦u“>V¾‡+j…›´`·YcbVky­ÇÈ¥²Óôú7hô]Ïh„k¿–Ïš¡Mý¼ÞmŒ$¥ÍÕ”O#uë¨ñnÕþu¿êõ׫ÈéRÉ1ÄÏé!u©³Ÿ‚µ*¦™,Ù{ÕÚ]S1EjAL#eÔ–+ukÝ'ÏjüîºzøhŸ.CQ†¶¯š®‰3–jg™KªÇ£pÜõ!›ÍÃq>âÃFiðÃ/h°$É®ü½ëõóä—ô㮓òØÝÆE’›÷¯p.®w¿uÇS[ñøL{[fåùã½ùôçšÝf”×ú½{~Ši¨¦4«”ïÔ[÷¼¨ß=´Å¢¿¦ê¥˜‘ºé¶'um¨Uû×ÍÓÿÞûýP¬êìÛ5¸kvqL?Æx:Öw©üÑ×µªèà¹Ã¥Ò]‹•Úe´^¸.J{~×ÔÿÍÓ~»ä:Ö¸žH5Ú@Î’ôZÌ 9¨³z5*QêêïõÙ'K”}·ÉØR~Ћoøë¶+û¨Çé6¥®üFïM]«Â:÷iP@|KÅÈ¥Íé…õ:y®Hýú‡å(Ûø’¡mÇ®µf™›èòÇïQ—Õ¯iÂ÷)²´×íã/Vêk/ifš]þ­®Ñ3c‚õñïiÃqtÉO1ýÕçS.W3ër=:ôÍÈðö ™¿Ú~P½¾¤¶{xâ‚9@z6Q›ÑŠ‰³È$‡Ê3 µoUª¶.ÏSñ±_ö~Š2©Ñ°ûuSé{úÏ‚\¯OÙqâ˜Ôä¢umîÛzi‰ûy¢%É`6¨g/“®<ËO§Ç(—r2œZ¼Â®/—9•ú·Œùß?®²$(fàÅj>àlE&FÊOeªHݪÌ3µ{Þ•Z}:ÇÉqòVüŽ¢Ÿ¸*”X’­ŽÅ…Š·Ûd’Qe¦ í ‰Õ†àP2MÉ) !÷û£èÛ †A¡=ФÞsôÐ+TæëêTej¬‹þÝ_[ßø\[«ýËÓÛ€/œŠíÀ?™û;lZ¹:OýÜ®ûý>Ò”ïÓµ!3J—^1Dó3ÕxpåÍUÎ èt({ÁóºfLŽZ¢ä’SyÐí²•kÿÒÚ¿t‡¯kÒ@Ø•ñÇR•ê¬˜E ”yª|+77ÒÙí3õËùu$¸l.-_dÓòEË ƒÿ¸Êš®ì9o+{ÎÛ'£f'™—âw4ýÄà¯}!‰ÚRë“ìqJhÀýþhú6ŽCn¾@»pŠñð€›öþô¾>Y²GŽ°`™ùZ5c2› Ðõ·\¥AÍrµhÚïJ?îûËÝq(gé[zøñO´¾˜ÄêÇ™»BÓ·uР¤zÌ‡Ò Ú±¿V΢{@\OmÇ?Žç?QÃì÷´Å“©a¶_ Ý8õ¸ŸjÉÝ L!ŠOŒ#g¿²‹âë8ÈýæFê{é ëQm#—½Xé{ö)‹¤¨Á}âÁ fgôÖÀ3âd9‰§.÷‰ë^ý8}µJÚ Ó6!ž I2¹]cŽQûÆeÚ™£!w<©s²S•–U¨rg•m¬)úñó¹Úk;ñ Ÿûă1XÍÚ¶V3K22%É¢Ðè…VÝÆZ( ·B•ºP± IDAT€J†¶»òŒhàîïxAFƒK.S„Z¶n¬ C-›8‹µgë^9kYþqjI<diÔCW\3P¡?¿¢wÒÚëŠÛ.UÓZ^lÍ\®ÿMÞ«¢Š^Op 8"ñ`Œè¦ÿ}…ºXÒôK¡£²Ô¦Í_¾«_KãÔª{ í¡äéÿÕ‹²Äs¥ÀA5 mV³ó.P—€}š9yŠf¦L+8Tš“¦më–ëÇ&kÂg›ÕxÄÜØ|Ò+ ®êw<˜bÔ¹C¨l¿Õ’ýîîe°+kÕLÍèõ¨.ÖZ ÞߤÒcy<µ1P§ ¾A· i­³CÙk¾×[Ÿ.Ó~»Eû\£±#º(Æ/_g~¨÷KQ¹¼TΣ´8aªßñ` Sã0);9CUè]5Fë]EÚ¶>K––Ôèozðo9Bw *Õ7Ï<¬»ø¯E]¢1ãd‰ï¯±—†kîóëîñ?È5l”†&šäç¥rpâk.ú%»Õ¡ƒ©gÞïúÏ}OêÃíUŸ í”ÃêÂXcõ}Û€p?íZ8_órÙ²´î¯|E4‹RLÛîŠLž§UYv9ò7jî†uë£h¯”GÊïØŽ¨‡ê·8J”S"5m!“òeuû2‹¢›GJe©*u¸Ýȧ V¢×V"º›.®í_fÊÒ*P%…•­¶+‰‚âÃ^æòPù)KÇTeP§ê‰{¶6ì²êœ®çªý¬=Z[Rû !m4 s¬;7)Ã~ïn Q›ó®ÖMÛ*uæú`m¡âZKªñ¶£A2x©¼II-©úM7Ö¾´´cz-¼ƒ4 ÄÁ÷ˆAÃ@|4 ÄÁ÷ˆïƒ†8ø1hˆƒïƒ†8xOrò._W \õă«T[]ªìÎtãèéý©sµ1¿jfÁ sL']xýµê«ù?o—›ÜD=Þ9Výn¿_꽧>Ò¦|»$ƒŠ3ÊØ!T&I6ù),>P¥ù*(õFyq­w;OG¡“ù1hˆƒïƒ†8ø1hˆƒïß# qð=bÐ0ß# qNŽ#ž¶lKùUo~ ®¤ÛÇŸ¡mÑ®Ô,•˜"Õ¨IsuèØT¡²jÛ÷iÖ^÷“1yfTX×+t‘é{M|õå:–»”¿u .».§–ă$9T´s‰>}e©¾ WLt˜ümùÊÌ*T¹³öW«¶ô nü¨öµû—|¤§–Ô,µy©œ(n¹ä(ËWƾü“SpJ3úºàïƒÄðÀkH<¯!ñ¼†ÄðÀkH<¯!ñ¼†ÄðÀkL¾®ðOm+SçÂÌje«ÃâU`ðQàøx|(ÈnW˲‚je›BcTàf{hèH<>dŽ TiBÓje[€Tê£ Àq"ñøPBSÝ9:´ZÙ¦)JÙåôQàøðpià5$€×x^Câx ‰à5$€×x^Câx ‰à5$€×x^Câx ‰à5$€×x^Câx ‰à5$€×x^Câx ‰à5$€×˜|]hh6EÙ+ª•eX‚d7píPPC£ŠõÏÝ[­ì»ø6Ê3ø¨FÀ©ƒËu€×pÇÔØ3Vç i^­lþ§%ÊË´Ÿ´:Ä[Kdr¹-—ú™”g⎠4|$ †‹S­­ÕÊŒFçI­Cÿœ;×agP„D5;©uŽS-¯!ñ¼†©– ê9¾‡"ƒ_+¸Ã¦3K}X# ~H<@Ô<Ö¦øHáåÝÖ¨? Áj[’[m9× ,KjêƒÄh°úäí«¶¼.4ŽÄ ‰Ð`4Š©¶l •¬>ª ¨ Áº÷•¤j˟γkå6ÕÔ‡Ñ×$€×x^Câx ‰à5$€×x^Câx ‰à5$€×x^CâxÉ×0†÷Ð=wÆéëf+Õ.ÉÜR7<ÿˆEÜ¢@ &=¡“¥Æ}®ÑØ]ã—¯3?Ôû¿¥¨\–£+wùðÃð7ç»Äƒ1\§¡á}ÏR{çl}]YlˆUãòEzæöϵÃzxs¿„!{i¸æNzXKm5æñQºí9Í´÷?ªòïöÙ}òqø'ðÝTK.›ò÷¬ÕÂùë”W%`Šj¦èÐ$Ý0áEýoòú÷ðv 3Ѷ»"“çiU–]Žüš»!@Ý:Æ(ú¨Ê#åç³ Àߟ¥JÙ°F+7¤©´ÊôGF³”¹u•>îÿtϳ߫àÜ›uS·H…ƪ$£P6I’]ùûK®ð£*%ñÀ äóg<ÔT±ã[½¸ãàÒý4¯@ãz6–®¤Ïg0 ’á(Ëk‘”Ôò˜êÚ¤qãcz¼‡4 ÄÁ÷ˆAÃ@|4 ÄÁ÷ˆÁñ‹+“TP­¬iÓD‚ë÷Ê10™2%9-‡††())ü¸÷ûOB_ð=ïÄ ½ÚRdd„’’B¼°ßú‚ïÕƒ„F’òª•%&6V‰Ñ|kõÏC_ðžää]¾®¸–x0*,©‹Z”lÒúô ¹ä’Ãf—ÃnWaF™;„Ê$É&?…Ū4#_¥GS^,G-ïz<…Næ{Ä a ¾G âà{Ä a ¾G ŽÏiá~’,ÕÊRRRµ3ÝYû jq¼1°ÛtàŠªŠŠŠ•œœ{\ûü'¢/øÞñÇ °ÚR^^¾’“³ŽsŸÿ<ôßóƒxË‘wRSÓ”¼«þwP?ôàäðÝTKµrÉ/¡¿n½y€N 6ÊØBýú…hó²½ÊÚºFIçêôƒŒ¡­Õ¿£]k7d+ç¨ÊsjM<8±š”éÌ‚ý‡~ºføºJNvǃKy| ÷ÒØg‡(Б¯ms?Òû[JewÎ×›3Fjì£ÏêjC©’缫Yûìr¸Ž®ÀÉ—PQ¢ÎE‡¯H²ý´&,Þ‡5p¢ø<ñ`Oý^=Y¥ÀQ µß¾¢µßÖÜÒ¦ýK>ÒSKŽ·ÀI¬sÄ¡E‡¡öç­8õù<ñàïQºnPÜ¡åâriƸ2ÖÀ‰ÒÀžñNe$€×x^Câx ‰à5&_Wî].;lÕÊÊüL²È& X¸½B#2¶U+[ÕL;ƒ"|T#<ãÒyà5ÜñЀYBÍrÄ&T+ vHE>ªu ñЀG˜5ú¡æÕÊ&|fÕúÕÕÏH<øPÓ²" ÎÙU­lv\’2,Á>ªLJă™ÃÌ*±TP´ÉßO²û¨B'>”Ð*Xwn[­ló” ¥îrú¨F£¯+þ>H<¯!ñ¼†ÄðÀkL¾®ß–µSf—óÐò®À0­ óaœªH<P”­L§ãÐr–%Їµp*cª%à5Üñ@}ÆuT€Ùuhٸͨe \^µ#ñ@-Z*$àðò†‡$«ÏêàÔÅTKÀkH<¯!ñ¼†Äð. œ@Óv«ß¾uÕʾjÔN%~ÕN,îx^ÃÀ ¨’âˆje&³Ÿä<ð{‘äå{ªÓ•:’¬'©†à]$€¨Å¡ºá¾¶ÕÊL,WAžK’”cÖÊF«­/0¬‰§*¦Z^Câx ‰à5$€×ðpéã`¶Ùj¯þŸ"“ÅGµÀ÷H<‡¦ûv¨wú¶je4éì£Úà{$Žƒ)*PÅE!¾® ‰‡ãÐå_1Þ= ZÙ×”ù¨6ø—^Câx ‰à5$€×ðpiü£^”¥0{Å¡åB“¿Ö‡Æú°Fpj#ñ€´fe…Š·–Zΰ“x€ãÀTKÀk¸ã µif…^Þ]è'Éê³úÀßYßÛªM“ÃËÛöI³?¶û®BpŠ#ñ Ð_±íáhyoF–¤-¾«ü…„ù)&úðÄ i…NI$àX1Õðîx€rmý¶ÃR­¬\vINßT€ã”PQ"?¹-M*0ø°FþÎH<@ Y~!Úج]µ²×jI6ßT€ãt^ÎnYœŽCË[B¢µ,"ч5ðwÆTKÀk¸ã4X5§=K)õwа‘x ÖÆf«-ïÛ¹OR±o*ê…©–€×pǨU Ã¦ Gõir,ÿßÞGÇq–ùÿUW/ÚZ-ÉÚmË‹¼$vìØ&Y ™H$Üd†°Æ¹a ÌÀe™É à 3ËåHàÎ@K ! Ù'q'vìx“¼I²-ÉÚÕ›z»(îRÉ’%Y-UIú~Îñ9~Ÿêj=Ýo¿ÝUõT½UàP6`¦ ð3P}¤[…C‡MŸ J̳ÑòH—Îé9f‹ýhÁÚQ À)f&£ÕýÇm±£µû ÊÀ\Gáf 3ú;T5ζ[ý…s¡5*œWf¾œ»ç¤SZÓ×f‹Ê/æ`)0Af&­szŽÚb/…ªKCáf T0 þXÆjç̳բzŸn¸Ê>µÒ]/GsöüÞLJkûÚm±~ÓÏÁRf8 0½ó³õZ»Ä“mo?ÖÃ߉;˜0qþ<¯RgUÛb…é©×¡„@NPxŽð™úØ—Ùbߺ@/oN9”ÈÏØ®xpБdî9Ti‹u¤I ¼.çxáÁ:WŸþd¥~ñOª%)Éð«ö¢jÓug«ÜìÖÎîÑoRL9ŠgÆLiÚ x| ×ÔÚcÆq‡²`òœ›jÉÒš«oÖó­ Ù°YµQ›®é‘;ïÐm_ù½2W}Xï˜ïÍYLç ™„ºmÓ“mWWòDÐPÉÊ *m|T/µ'•êÞ©GväiýêrÍËI¼TæR\ëÓÚ¾öì¿3ú;¦à]\½pÈkû× xp/çŽbg"jÚñŠŽvÕéš*ªÌW¸µW IRRÝGÃ*¨ )ÍE<(SíJ3ÅúH—–Fº³í°é×î¢y¹xõãÒŸ èÅšu¶X«¹[Rû´åÀD¸ïôyCÒ°û0#wñÔ×/1¾d½_噾l»X^Õ÷Y IRÿ¸žk$¡š¼“bóçתØ,“$å—úNZ^UY!_}ѸÿÆl· ¶vìaL¦§MR:ÛU__<îõÇê‡ÒÒ~ +¦Ç3¡±‚±1Ü~p}àôƒóèƒÉ+«Ì?)¶pá|•%Ƶ~.úÀëµ_¯ Ù¶¡òò:% i穾ž¾Š±0yeeaI}¶ØD¶åÇêƒò`ZR›-VQQ®úú‚Q×)--ab‚ c›êïÔ’OR¯-¶xQŠÊ'#ëÑX¼É„td§-VVV¦ú:k¬˜ÇvIiëtÜÁ}ÿ¹5– c[±o›¼ k,ôÏSË‚¥'=®±ñÀt¦…Èe…‡”ú[£Ê_”WRB¦Š«òiíVO$ñþ¯vm Üx£_Wl(ɶ[»2úö×­Çö]P1îçI­·LËUn‹µ´QûÁIR¨ªP«Ue[ÞÚÖ®Ã\ñ0_t“—JÛw¬{zûÔØ8±©ÅNÕ]+}úu“J§é·)À{êôƒóèw œGLN"X¡¥²_íÜÔÔ¢žÖð¸Ÿc²}°*Y!ÿm¨¾¾~ÛsÆb =7‹Ñï#à=™œÎÅ^Iö“â&úžžêñý¥†$û×ööãjl´öÞÏÑÛò®®núõ4ðžÚT§vŸUuRìà¡Ãjí¸ï?÷>sñ5Oƨ|©ì¼øŠùzxÏpZœ»ÇÈ2êÞóŠzê/ÑšCžàrm\Ô¶ÇÕ‘“xǸ§Y€¹äý·/Ò­ÿ°,ûïÍï®t:%ÌP.»âAJ{LßûÍÚôùoèFDÿ@¿kN*•ÉMLÇ É–ßêoþnh$¡£ÏÜ«/?3ü‘¹Š˜n{"AÝ×ȶ’’u,SÇñƒ¬í¼gBØô©± dŒG˜¨Î@H­uÖ¼¬‰xJÒQ瘤ª°®nk´Åþ4o‰šòƒe¸…I—3x£¬®”O 'ÀõªVõá»Î·Åvß= ¦]ÜU ð é†OÔH’¶Hë§ß‰;œ Óci¤[5ñþl;îñê¥Pµƒ€Ù€ÂsTõ@X+ÃÙvØôSx“Fáa -Žöèì7îqÂÏ[¤¨és(#nLØÚSqéP6˜«*.Y Š ë~l…‰Œô´ƒ ˜2Kn9[¾!?3}G$mI:–€ÙÂÃÊK%5o b‹y”q(nò¾c»mííÁJÎ4Ç´[¶Â§k.´ŽD¶vet×Ó13p: CŠøý¶˜'`?ìwá>åYížÍ)iËtd`.¢ð0…θ²R~Ï[ìÁ¯Çî¢ø€Üðå›úäOÖÛbß(¡WåŠΠðè/,°µB¦dÀì@á€þp H~Ÿ‘m¿Þ—40ú ˜´Û~´ÆÖþé£I½øP¡l€Ü¡ð@Í –Ë°æum;zTR—s ˜jâa­ímµÅž*«SÔäps[à´˜*JÙ-ø¼EgЭ ×öµ©&ÖŸmÇM¯ž(«s0#f> à´,>»PuãJ[왯ÇÔÛ5s*e‰˜æÇ­ÂCØô;˜ ³…0gU]¾X¥V¡¤0‘‘žv0!f `Öºº­QUál»Õ_¨+ë³í•«¼ºbƒuϻ֮Œîz:6­90ÛPx0ç,ˆõiQ´Ç{¡¤VIÃãPF¦Jé…Õ*4V;å“L3÷€‰¡ð0 m±€^8ÄYÀLS–ˆje¸Ó{1T#%`ʼùíeZ»Ä**n?ÖO¿w0#ÌDÜ &†ÂÃ$4ú*®Y2,ÊD€Ûùª‹ÕWfyÒ)åL>w«º¨J•ÁyÙv8á‘^ÿú;R•úÎÀ [¬/³EE0³…sΙé–«Jm±?|1Já0¢•‚'ß äfÁ€Ñ0)È  g(<€œ¡ðr†ÂÈ  g(<€œñ:गÛòu4eŸ{¤#-)î\B0ÃQxÀœv°´NáºP¶Ýžî‘Ôí\B0Ã1ÕÈ®xf9_&­k[÷Úb¯UhwÑ<‡2˜z¡DLEéd¶’¡cB3æ À,gd2 &l1&åP6Ócu¸CgôwdÛS?­]í`FÀÜAá˜åL¯¡ØRûÕ ù¾B)ìPBÓ êü U†J²íDÚ^r0¡)Ð1t´+ck3M4ãÓÝGÛbûÚ%w$€YÎô{të7–Ùbß(¡MŽ²ÀÌ·ô¬"]}¡™m÷Ǥo½u0£Ü{Ì·B¯¹ª¯GÒv笴} \ßk¯ÍÙó'e(V^n‹ÅMnè ÀLGáŒ(az• …Æ~ À§³…3Lµ9ˆGuÓ‘¶Ø–P­ö–:”€´¶¯ÝÖnóçëX È¡l0›Qx€ zUú–ù¶XYOtÌ¡„$ÓsÔÖÞ¬¤ð€)AárÌŸoê†?¯±ÅšîŽ¥Ê0×ÝÓ±L^¿‘mïvK:ì\BpÄš¿½ÀÖîÝ•ÔKÏ8” f3 À,—,ʘÙvÂq08圳2¶öîÖÌ(&‡Âƒ¤†ÖÁjïÑ^sŒGNÌžD™¾×n?Ë)œÙ-‰*"r#-C¯5{l±Î˜WRÒ™„0c=ÒT¤¢ë³ÔГ”Ôé\B˜±(¤Gþá=›X«[¾ôa½cïßëäÆ ÅÝœtîŘG *TPW“m'â)I›§íïÇ ¯vÖ­µÅZ·6ˆÂæ×¼euš¬×_|õ›*÷õj÷c÷éÞ‡öÈ·rƒJ§—Ú“Ji§Ùñ^Ý´º\ÏÆ&/ÕÍíJ9ý"˜ ÂýzKÇ![l{q¥:|ùe„¹ª05 ÏY0’†GQ3w‡Å"ICG»˜fNp]áÁã“Úö¼¤ßýäOjô®Òÿ¸ã#ºùèz 2_áÖ^%$IIu « *¤Pt"ñ LQx`:ä›)Ux¶XЗV‡Cù`m¿ SÖÔû JôDY]Ξ›1_… †EŸÎÙóÀLãºÂC¼á—úfÉÖýáÑ}ñ¼Z:% +C2&?…¼¼<Õ×/ɶƒÁ"Ûr¯×´//²/—d[^QqòòÅ‹êŸ78ÝS¨&ï¤åóçתØ,“$å—úNZ^UY!_ýÉÏ;W-¨­u:×3}'îËÊÊT_o}¾Lý>ó¡â í³œ—×)ÉÚ@+,(P}ýül{¹)Õä['é ¨½ÂšÚ ´4{Ó–ìß³•ˆ¤^Ûc–,Y¤È€=¯Óe¦SZµw«-ÖZ³Dm¡òœ<¿0Ü~p}àôƒóèƒÁ홡†o”•‡¯¢%K)•܉(«<ùlì… ç«¼hðj°úämùêš*å'Cƒÿ¯ª:iyEE¹2õ'¯wBii‰-G¯×´-‹†m£ÙŸkøþŒ .OjÈT³b¹u–9cA*,è’϶?'Öû2|¬ ßïi¬Ø–0V†î÷ž±¦XÿŒýþ*ÿú`©ÌCIR èäÃ+m’ÒÙöàX eÛc•±öýgÆ‚´ømÊ3­Ï‰/š¯¦ÃÖ¾êd?'Ã÷{%ûX) …NZ>‘cD Ê’’ŽÛ–WUV¨¾~p æbß.`,HÒ1[kð;Õú|µýqBcã©I³†Ë ן­Åá×õÚ±¸2Ê(•H*•Lª·5ªüUAy%%dª¸*_‘ÖnõD&ï?åÕ±XÌ6h*Ï ¨TÖFT2™²-_pn‰ eÿáºÜ(¯Qì?<V¤{p£¯Ö[¦å²øli9¢öƒ=’¤PU¡V˾ÃÒÚÖ®Ãí§xs_t§æ ˜Z¯ù¶Xgg§›³í³Ó5òÈúaééí³½¯±X@’µŽDÔØØm¯JtjE«õ|]¾<=ß˶ —-Qõ±’J§mÏ¿¦Ê”d¿ùâ‡ÔSNåI?ü÷…¶Ø·îè¹Í³ë³ÃXpúÁyô;ÐΛë}P²f™*N±ýá_¸@ d?tàÀ¡7î!%‚Zªy¶åMM-êi K’*R!­¶-ìh«Ž4vJ<˜Z¡jÛòööãjl<šmŸ#û™±]]ݶW%+ä²ËÖ××o[¾(TPl{øþÌÆÎÃZ±¶Ù¦_?¯9CsÍ\ áˆ_²­?üs2|¬ ßïi¬ ]>ÒXºß»¢føàƒc¥±qp¬”´f’c%™ÌÓàÙ‡ƒÇJg¶=ÖXk߶˜¯i"Îý`žªJ­ÏÉŸ¶†ÕøxW¶=ÙÏÉðý^ÉþžWžY¤âI#êçéžCö}û[ÚÕØ8x9ûþsÅ\|ÍCÝ}äL[ûõ#]ÚþÆËe…‡ŒÌêúøeUúö¿ý·¤é²ËŠ´ë¾Ãjï|E=ï¼DkJvé¥Ôrm\Ô¶ïWGb"ñ¦Y¬ãͤJØÐ÷{Š{ÌQÖȽKo[¦ –[8û¥õëoÆO±¦Ú²w-ÐY5Ö6ZoLÒïœËpú’SáûÙúQ³w”G£‹•Û \qŽÎú†q]á¡ëùéîškÓ7®T~ª[{¹W?ÜQ2ý˜¾÷›µéóßÐŒˆþ~לT*3±80Û“zw[ƒ-öDYöœ|™'æŽÚEyzÓëd”Ö®Œô;.`깬ð )Õ£m¿ü¶¶ýrø‚„Ž>s¯¾üÌdãÀìâ-0®±ü¾¡Ó¸À´q_áÀ„çô©Ï®´Å¾ú³íÞš»‰Åžo+Ô”õuq¸#)©sôÌYŒ©¥tê¬ÊvŠÂ€‘xœNÌ\ñÀõFûtEÇ[ì×U+ÔåËs(#nq¼ßPZ™l»/n8˜ (<˜òÊJÕTÛbþ˜OŠ9”à”jÌ>)˜È¶{l¶KÚí\B€Â÷«¨Ë×Ç>²Åžþf\:–v(#À©ü݇£Ê÷gÛ?}4©ï?”8Å€Ù„ÂÇ%3õÅ2¶Xf”Çp7 &í™pµv±J=’ǽþît¹~ìYf‹ d6KJå(CӅ€I‹ ”WžŸmÇRa³pÂï“˵u ,ÛnOôHÚî\B3PÅ@De û æö–òh QxÕ¢h¯ÖöµÙb85Ó €Ùƒ+F<«\ž¼{pŸ3¹0SPxÅŠ5ùºérûá“»o:” 3…0%RC}±Œ-–t(ÌmáÙ>‹q>ˆ0¥(<€)Ѧ"ýسØkNï”ÔéH>˜»~i¬U'mV»¤ÝÎ%³…`†‹Ë£Ù‡rw"-)åLB(÷¥tqªÃÛê+Õá¸Ï¡ŒœOÚÏî 8˜ æ À ן èÅšu¶X«¹[R»3 9 xžO·v‘-ö¹»tx×Ü)¾ ÷”–ê §"ÛŽqI[œK¦ÐÊ°ý*šN_žÚýeƒ‘'ãš—ˆÙb‡òŠ•6 ‡20•(<À8lì<¤P2‘m7çéåâj3œpå­½;âÑŸšJ#z륺ý=%¶Ø;¾Ul”Ìh`Þvë"U‡¬© ¶0ôòŸLuÃ'jlíŸ>š”š£<0Õ(<p½pÚÔkÍö³W4½—bÖÖ´´ÚÊá@8%‰‰’€á(<p½véÉÊÕ¶X_f«¤°3 …§TmÄ̤²í¸¤Ã*t.!®Fáæ ŠˆÊö;zî),s(€Û}âëŠ f¶½ÿXZúfÜÁŒ¸…˜ƒE{µ¶¯Í£ð€\ ð0ƒy3i]~ü -¶¯°Lû JœIÀŒa䙊ÄýN§¸^S$ ÇÌaѨ#¹0SPx˜Á|¦4o~Àëöù´ŸûíÆëjuÓåu¶ØÝÎÁT`¸æ@…vÖ-}Ú‘\˜)(<Ì`¦ß£[¿±ÌûþC ½ðhÒ¡ŒwJe¶£0»Ô§ûµ"lŸæõ©`­ÂrÁ,ÓQX®ÂºŠl»§5¬‰ö ”êî#¶X"³WR*'ù ýËͦ-öógSz|Gf”5L%~S¿m¯T"žmïˆôKêp.!Ž(,ñécŸ]d‹}õgzmkn0n±æâný`êÖ¯Çîâ`'0TÜô4%VZ{söü#£Õ+ìÅíÐk媰`b(< §ÚÊ*åñÙv_C³(<î³'Ô} aѨ#¹`v¡ð¸\[2O÷5Ûb]©.IÜ( §¯3RkÝ‚aÑ£ŽäÀXªƒ}p}Â{p—W{Û=eàT(<.ñNº‰x̳]À\QPhêúwØb/´ho;S)nDဣ SZë·Åæ‡÷˜£¬ÀÍ(<pÔê5EúÜŸ×Øbýo=:p,éPF&ƒÂ0Ç}ôì¸*ÖAþ–¨©Ÿ¼–7mß›I©Ò±Å ¥§íïÈ- fœå‘.…Ö=¯¢¦O;‹ÊÌSauÿq™™L¶ÝáËWK^‘ƒÀìµá’b­]bݨyó®”ôÚ€ƒ˜É(<˜qG»µ0Ú—mwùò(<¸LG&_ßØ`‹íIï–Ô>îç¸þ]A¬c`ÚÞnêÛr” #źçP™-Í4Iâ€-€Ùç oXJik²ØéTàrÌ8þÏåZWoµ[Ú ýúî„s aJ\xy‰Š†Ìòѵ9%mã`.Ü%jæ)\Sk‹%ÕìP6ÀÜ•Ìxt_C‰-v8–ÔëLB³Ôm›Ê´v‰G—Üu:¸…3NAУòyf¶Ý›`hf²pÚÔkÍ[l@Ƹ×OÉPkÝ2[¬wkƒ(<ΠðÌq±„¡¾˜u_xÂsŠGç^»Šôdåj[¬/³URX’Ô#¿î9d¿ºèH²MRŸ¸…`Ž{P+´Åʶ’v:—Ð0ÉŒyÒ´fž.‡²0 fœÞ˜GG»¬³2;úÇ?€©EáÀŒó”·^ …eÙvOXÒV瘆OÉŒ†ÂÀ•îéX&¯ßºše´[Òaç`Ž³¦äzÚéTàr0¥é”üé”-Öïõ‹º(€±$‹ƒ2f¶ðGÌãEáaŽógRZH†’†'gÏÕy^½kƒýù>u¯ÈÙŸ¸…‡9îŠH‹ ¬*@G~Í«ÍÙó†L-[™g‹žhΞ'«Í©jAÂÛÜìs(s …‡9,×Òj늄ͻRzôn.G˜ÉòVÍSÅÒ [lóÛÊ3ÕÂXŸVõµÛbO•Õ)j²9®M“™IgÛ‡óCzq ÐÁŒÆÆ#¦Tc´H÷5äÛbÉL\Rzä0iŸR¡"§ÓÀ W˜Ðüx¿-æa;~ÚÝòKT4ä"òŸ>šÔ‹YW4½)Ó¥üt2Ûî0ó´KÁéLà$渎~Cù]ÖMzc¹»¿ƒ$uû‹ÔZ·ÄK©-§@îU­+ÑÒÅöVÞf¿ÂÜßÙUþòŽjÛUìÚšÒWÆUìÀYæ¸ÿ¬R¨ÐºL÷ˆ·SÒNçrÇ[ò™V{k‹©?¼žÛB'üÅŠˆò<Ö™ã-QŸ<p0#àdÑPHÝË l±ô‹]’#¯0A~3£«VÙ¯ ØÓîÑ®cFNž®xäh‰Jû­íÖý= IÇK@0If&-3c]1aHŠ{ÌÑW\ê-—Û.a?þhRz=7;ÕÓÁL¥4oÀ~úaŸ7 Æ#¸Ò»n(SU©upõO[Szðg(Ã]:½A5Õ-³ÅâÆ–œ=¿ÇgªúÒŶØÑWú¤c9û³Áëå²M·+Õ,é@¶Ý^>_UÖÉdí¢ðÀ Ád\Å)k?:%CÇÜ“˜«(<Ìr×”öÈ2kK: —z N±ÆÄ\RÔ§Ú„5ïkÊðèçñšœ=?€ñ)ªðkÕÅgÙb/>Ó¦–ƒý£¬sWµ/¡z_ÔÛ+R4Í•nÀtJe u-¨³ÅzwDáf¢÷¾-_ï:ß*4ÄâÒ¿•<Åȵ<¯´¡Ð¾{(îWKŒ“1ý(<Ìr Þ{†üCz9Ò—þ”» ùÄ¥gÊ·*4$‘þ}wΞ˜.÷t,“×oyºwฤ#Î%4Ai¿OÕå¶XæÅn‡²àfgÌKéÊù1[ì—ûóu¤ît_³&Owc±-öÞ¯Çrß«©ö“ð*0ýÙöáX‡¤Æq¯þ¢ŒjŠ­“KbIéá]ìPçìJÏ“Ñomc%i ½B SÏSÐÂÏ]b‹µý¦Azá¨Ca.£ð0˵Í_"_ÀÚ íî=Ûjéü¿ßÈhži]i¯bÜ f¬Ù[x0üª½èƒÚtÝÙ*7»µó{ôÃÇ››¾©{g…óÞ±Xój¬ƒèáÞ„»?w—É-¨iíyöyéŸ}¸Y=]ƒ`¥å­[[b[þúë=j=68•€iZr†}y籨zº­ƒ'Þ:߶¼íp¿š¬‘õoY @¾µAÕq4¬}¯϶W_X­`‰u&W_w\;7˶ϼr‰ªY…ƒx4¥ÿþ/kŽæº%AUÕØ /nnÏþß_TåËlË­[$ €M¨$ ²jû™`M½oÌ W•úÊõöqõÝG ½´ß¡„f¨Ë®Zhk7êSãÎÙsïÒO—]`?qâÕ=q<e‰›LË;ä|—hBj s îRZâSýûöÉ®ý…Ù–Çýž<5Õ­´Å"Æv·èïõ{tá;íûµÏ¿SÓs½Ùvõ»WÉë³¾#Ã{ÃÒÃÖ~ëcåÊ/µië”´3Û®;¯Z «­å]}im>Øšm¯>¯Lg.³ö‹’Ò®Xï×JÝ_¸Ä–ã€6ëÄÕ„móª´ïmö« ûwm•–$ÕÖtÓUö+2ùHT»ß(Ž”=ºõ*û!¬G·¥õÂnÆ&Æ—LÈŸ¶®rM†’ÛÀT˜µ…³j£6]Ò#ÿp‡žM¬Õ-_ú°Þ±÷ïõëf~”&¬ª`EY¶h +—óóy‚~×ÖÚƒYÓ=x‹òTyÅ Ûâ=-;¥7 Þ|Së?°Æ¶üåß4¨gÈMs–_±Ô¶<ùD³­ð°à¼Z ),¯¶Û Uk*U±Ø:‹ªý`­ð`VU°Â:ãPÝq ½9dÉŠr-ݸÀ–ÃÐÂf‡23©€a¨GÉYû눊•ezÓµö"]ë?nQ²›³´1·¬¹ R‹Ï´Šî©¤ôÐOöæìùû½=g?¸qÜl“Ľo&¢ú’ŶvWªYš@áá²K+ ZGÝ{úRzò©Üm?˜™ŒÌaS^ £,/£úûvóž.ŸzßøÊMçùØhßK·î–”»Âùï]®P™u¶îѦˆþû‡röü˜J«¼ZzOº¤öï²Æâ¢3ËT³$˜m§R½øÇÃÙö‚ú –¯.µ=çÓhΞø_Týö«>ö}{kö$¢Â"ŸV ;‘ªao¯ºŽ&Ó4´ò ûÍîÛŽÅt¼ƒíXRã¤ÂEÇ®’¬ÂCUíþŽý‡'vÜñP¥üuÖ¾OkX’Uxè,,Sk]M¶=8wî®´ ùÚWgK½ž:ñ»7}j\wžmyÇÁ†œæ€¹aõ›¼Zq–µ­{ 9ª×¶YLj–¯,R`ÈXêéI¨éP$Û®^X¤üBk_?MéÈ!k;y~}H¥VA:™Hi÷ËÖ6\õâ j—Ú¿÷·>Ö’ýÿÂE…:suȶü™'Úyãw%gªrØ yÇÛbÌšWš¥GÅ •¬Ü ÒÆßé¥ö¤RÚ©Gv¼W7­.ÕÍí3hö^3Åe缾!ÔÖ‘Òý¢-Û>£Vš?dŸ3žž2§ê›Wùµn‘}~ÓïýÁÚá åª.´{íïò(—'ûWÙÿ~$‘Qß}Þ¡g…H?3䤩Û$ xÜ3u›id´*Ï~ywkÊTÛ€•c ÒÐW2 ¥¦ñì˜b_F!¯½Ó[¢¦¦óš%óísy÷ö§ÔÑcmä¾ýl¿†l§«-*=·kú¦ÜK^:©y û xûòçgÑä6rý9y’Ê“}*ƒöŒ5—¿*TÁŠªl{pÇß*<Œu@y,ÉŒi») $ xº²ÿ÷HZâ·÷éñ´©ždîÆóðï‹Œa(1ä=^y~•æ/³¾TãᤞýUô/2R*4ìýÔšök¼ªjãÕö÷`󟎪i¿$© È«×ÙÏêÜõÒqØÕ¥\1ϬQþúöH9,<,ÞP¥³/·Ÿñðv(Ò3Ø·y‹æiéÍö@¿¿]:8¾)l¼>.y‡ýùìîÑÁ½ÖúkÖ•Éò±éìÐáƒýÙv,R Üºª"ÚÑ9®¿ U¶*¤úúêl»§5¬ý»¶fÛ¡º]b}Vñ”­ðW^¤Ê7/²=§ñÇ—·Ð¯¥ï´ŸåÝrïÎláÁãõhÍMkmË_þMƒŽwp0¦‚gÝåû¬}_ã‰fiHá¡þ+ª²¶?¿Ú®¦C»³íå—/RíJ«H×~°GG¾¿=Û®^S¡eç[EºHwÜVx(]Òò+ìÛ‘C FiJ/©·'½¹#[Ð.®.Ò…·Ø7ž¾w§¢{ØN‚ûÌÒƒ©¢Ê|…[{5x)©î£aTeŠÂ€Ü~†P{ºG’Ux(¢žöÁ³¤ŠB­vmïKmj;e?Ól×Íêò9ñ½}ò†|Nôj»´küŸ“õ—T«fõÅb)=öëƒÙöʵeZ¸Ü~†Ð#÷[Ë‹+½º`¥ýÑ+O´(þƆzÙ™•ºxØÁÔǾ¿]íoL •çëÒ÷/·¯ÿH“š÷ PöL]s›}æÏÑžç­+á.{ß2™~ësÒÒЭ=/Xg %®¶ òIDAT:[cÚúŒµþª÷¥ºuÖ•t=­a=ümë ÙX–\P{ÒÕA¿úÊæ7 “gLó•Ëm±áWŽåÜ˪UPhSÚEõúVëjÃ7__¯ê!ŸƒÎÖˆý…5–Šj‚ª8Ëú,G†]m¸ð²E'•ŸáiWÚë•Û¿OR¾«á5\e_nîí×LbøMùæ æÇ8é`í±ÞÒÂÃòkÏ8é;õðÁ˜ùŒ•«×Í»xµè†¿Õ­é»õ·¿lRB¦*ßöy}®æ¿ô…{5ü¼Ëúú%#> À®±1wS±cvš¥W<¤ÔßUþª ¼’2U\•¯HkÿˆW;0PÈYzÛöŒº÷¼¢žúK´¦Ä'¸\W'µmGÓ,0…féTK’äSÍÅ7jÓ5+4"j|øÝýD‹â³ôÕ೸ð¦Û,j 8ÂÈ  g(<€œ¡ðr†ÂÈ¯Ó ¸'t®>ýÉJýâŸTKR’'_K¯ø }ôÊå*ñ¥tü•ßêÿüt³Ž&†¬døU{ѵ麳Unvkç÷è‡7)¦Qâ§^ËMæ}¤rŽ±à Æ‚«0ÄXpÆ‚ƒ ®Á8pcÁ5 c,¸cÁaŒÀÕ¸âáOHk®¾YwüÍG´.hdÃ%×éS—Gtß×îЧnÿ=Uv­nyk¥Ì!«šUµéú¹óÝö•ß+sÕ‡õŽùÞQãÙdÞGú ‡ Žc,¸cÁqŒ—`,8Ž±àŒW`,¸cÁ .ÀXpÆànNÈ$Ô}h›ž|l»º’'‚å…Lxò1íìN+“h×öW»URW"¯·JïüÆ]úÒyÅ*Y¹A¥ê¥ö¤RÝ;õÈŽ<­_]®y#ÆKm?88Á˜øûHL Æ‚Ã ®ÁXpcÁ5 c,¸ãÀ ®ÀXpÆ‚+0\€±¸%»25íxEG»êô΋NÓêÙúÝõFË;o½®½2¤}ÿuD‰TLûëÚÜWÑ5ù ·öjðʹ¤º†UPR(:R<(SíJMû t;SE•|S‡éƒ©ÀXpcÁ5 c,¸cÁaŒW`¸cÁ .ÀXpÆ‚ 0·£ð0ž"­ø³è櫪åïêGÛú•ÎHýí­ê—WE†¤as½C-Ž‘Mô}Ì$éƒéÆX˜Œ÷c,LÆ‚û1¦cÁÝÓ‡±ànŒ…éÃXp7ÆÂôa,®Fáa,Þ ]vëgônÏ“ºûË÷êõîä°¤ÔßUþª ¼’2U\•¯Hk·z"#Åû©Žh2ï#}0- Ó„±àzŒ…iÂXp=ÆÂ4a,¸ã`1\±0 ®ÆX˜FŒÀí¸ÇÃ)yT¼î}z—÷·úú]Û0 ¯Š*ª4/_êÞóŠzê/ÑšCžàrm\Ô¶ÇÕ1b¼ƒ/«e&þ>ÒÓˆ±0} îÆX˜>Œwc,LÆ‚{1¦cÁ½ Ó‹±à^Œ…éÅXÜÎX¹z]fì‡ÍÞùïÖWoIé»_ý½Z’~-¿ùïõ¥KŠlézâŸtdžõ¶ÿõ%ýÛ/è[⪾øFmºf…‚FDߣ»ŸhQ<ãS͈q‡^œëö~7«ôNú`Ê0œÄXpÆ‚“ nÂXpcÁ-Nc,¸cÁiŒ·`,8±¸…3Lµr†ÂÈ  g(<€œ¡ðr†ÂÈ  g(<€œ¡ðr†ÂÈ  g(<€œ1Ë+«¿âtnâ «¿º}½šžÛ§¾´$ïڋoÒg?ý!½ïªóµx`¿^;Ø«¤$…Zÿ¡÷©jßµ&†¯ëÕÂ뾬»>û]÷îk¬g×ãÏ6+žqø…ºXîú@’Q¬³®¿UŸûäzß5—imq‡^ßuLQÞÿ1ÑÎËixBZwÝ&}æãïÕ»®¸@ËÒõÚÁ%éƒ1ÑÎ;­>hlTá[>¢¿þŸÔ{®¹\çWG´gg“ú3§X§D?8/§}å9qJô;ä´”¯¥W~tÔþÁÈèwÈi?x*uñ‡>­Û?z½®¿æ­:»¤C;_gŸm,ô;LÅﳌ<-¿áKúâ¹MzòÕ.¥œ{yÀŒÅ'xBZsõͺão>¢uA#6«6jÓõ!=rçºí+¿Wæªëó½’$£ ^ëÒ¯©!^<ºI5ýúËúÐG7 þûøgõïÏÒ3î`‡b49ïÉ¿ä*Ý|Þ1ýè ¥[þúÿjÏYÔûWæMûK›Qèçå¼< s£>tÆn}÷ wèÓ_þ¹Ú/ù¨Þ»ÄïÀ‹›AèçM¢š«¯Õ§.辯ݡOÝþ/zªìZÝòÖJùO±.FA?8o úÀå91 úÀ¦  —\7rÿ8õÝŽ>p‡œ÷C•BkoÐ{+7ëÎÏ|F›>w·×Ü k—œz…îG¸ÃTü>>± ϼ^Ÿ¸¼Zì­§Âà ™„ºmÓ“mWWöt;C%+7¨´ñQ½ÔžTª{§Ù‘§õ«KeÊPAýYÒöýŠ¤GZw(ŠV_«k2éç¯õ‹ºÃ(¦¢RI¥2™¦!iÊ£”)N8%úÁy9ï¯*Îœ¯þW^Qs<£tx¿ž{MZuv…8Ìw ôƒóN»(UlêÀ“igwZ™D»¶¿Ú­’º2•º.FE?8/ç}P"ïˆÏ‰QÑî0ßG…¡QúÇÉ×éfô;ä¼JeyDwÿt‹Z)#eÒI ¤8z1*úÀ¦â÷Y’'t¶nz_±žüãaÅ|yÀLGáá„LDM;^Ñ‹;Ž(’=jª¨2_áÖ^%$IIu « *(ÓÈWýÙ¦^ÝQfÄu‡ð-ÐÛ¯«ÔæßîP/¿£›‚>8üîݵN·ë.ýà۷벃?Óîãgã”èçå¼êlhWhÃz-ÈóÈ ­ÐEoªT¨¬€ƒ|§B?8ï´û ¬î­?Ñ]¶(!É;o½®½2¤}/µÉ?ÚºŽ¼À‚~p^Îûàˆcm¿ÂŽ>p‡œ÷C³ŽÖ?½D×£Üa ú¡÷ØníhIháõ_Ô÷ÿýv]zô÷zè½0*úÀ¦â÷ÙS¦ oºJéßþ§žïd‚%`28‰`,†¤a;†Ç‘¿DëÍ×ô«þ±ö<*ÙðN½©ùA}í8_X§å´ûÀ£â 7écuOék·=¨ý™ºò/7éü³¾½¹‹+O&Š~pÞi÷AFÏÿ‡~\ûçÚôõòvÐöÊ%ÓßãA?8o¼}à)ÒŠ?û€n¾z¡Zø®~´­W•ËG^§~pÞi÷Wàæ }à“íúgòèw˜ôwRB‡~õ Ýòà]ù™¿Ô'Þ¼Wÿø ûlB¸Ãi÷CLåoùˆ®ì¾_wnïUþ¥Óž90«Px8¥”ú[£Ê_”WRB¦Š«òií—ɹ2·ÿ^c×JuÎå•ÚýóœÉtZ&Ó>U¯]¬ð–_i$£´Zôü³½ºj}µü›»›ÆW1óÑΛÜ÷‘Ç›PÃßÕßÜ—TFy:óã§åÍ=ÜÈuÂèç³¼ºìÖÏèÝž'u÷—ïÕëÝIIƨërjÀDÑΛL 7èw˜d?Ð?9@¸ÃdúÁ«W~@ú•îßQ:~LÛ¶÷éòE%ò>Ó¥‡_ÙÌA¸Ãdú¡P«×.VMý'ô­ $#P |óÓº³èÇúòÿ~™YL€ bª¥Sʨ{Ï+ê©¿DkJ y‚˵quRÛvDU·Î§íû"cž¥ê)[«‹B z®™ieNÏdú`@Ç÷¶)tÎ- 2|Úp~™Úw·sÙî„ÑΛÜ÷‘oñuúòç¯V}!o幺úŒ=»3g&Ž~pÞxúÀ£âuïÓ»¼¿Õ×ïzxÈŒÑÖíà€÷„ÑΛL 7èw˜L?Ð?¹A¸Ãdú!­xj¾.½z½*¼’¨Õ9ë‹tdO'ÈL}à“釰^ú×ÏèãŸúŒn½ív}ñÿPûÓÿ¦Ï‡¢p:¸âa ©cé{¿¹Q›>ÿ }Àˆ¨ñáèwÇkuƒÿuý6<Ö·ŽGEËÖ©¼õ ¡<}ÚN¿2ê|þÇúñü›õ©;¯T¾×±ïÓ÷Ÿ<ÎÓ@?8o2ßGñ}¿Õ¼¾IŸþçË”énÖsÿñôH=p:èçÝ~UµTåg­Õ¿þàæìz]Oü“îøÉë6³;w:èçM®ösödÐîpúýðmýÀ¤r>p‡É|'}îç?ѯÿ¹þúÎw+߈©é¹Ÿéÿníå™ ¢ÜßgÀŒ•«×1È ¦Z9Cáä …3@ÎPx9CáäÌÿîB7Ò£ïÎIEND®B`‚suricata-3.2.1/doc/userguide/output/syslog-alerting-comp.rst0000644000000000000000000000601013051004444021121 00000000000000Syslog Alerting Compatibility ============================= Suricata can alert via sylog which is a very handy feature for central log collection, compliance, and reporting to a SIEM. Instructions on setting this up can be found in the .yaml file in the section where you can configure what type of alert (and other) logging you would like. However, there are different syslog daemons and there can be parsing issues with the syslog format a SIEM expects and what syslog format Suricata sends. The syslog format from Suricata is dependent on the syslog daemon running on the Suricata sensor but often the format it sends is not the format the SIEM expects and cannot parse it properly. Popular syslog daemons ---------------------- * **syslogd** - logs system messages * **syslog-ng** - logs system messages but also suports TCP, TLS, and other enhanced enterprise features * **rsyslogd** - logs system messages but also support TCP, TLS, multi-threading, and other enhanced features * **klogd** - logs kernel messages * **sysklogd** - basically a bundle of syslogd and klogd If the syslog format the Suricata sensor is sending is not compatible with what your SIEM or syslog collector expects, you will need to fix this. You can do this on your SIEM if it is capable of being able to be configured to interpret the message, or by configuring the syslog daemon on the Suricata sensor itself to send in a format you SIEM can parse. The latter can be done by applying a template to your syslog config file. Finding what syslog daemon you are using ---------------------------------------- There are many ways to find out what syslog daemon you are using but here is one way: :: cd /etc/init.d ls | grep syslog You should see a file with the word syslog in it, e.g. "syslog", "rsyslogd", etc. Obviously if the name is "rsyslogd" you can be fairly confident you are running rsyslogd. If unsure or the filename is just "syslog", take a look at that file. For example, if it was "rsyslogd", run: :: less rsyslogd At the top you should see a comment line that looks something like this: :: # rsyslog Starts rsyslogd/rklogd. Locate those files and look at them to give you clues as to what syslog daemon you are running. Also look in the *start()* section of the file you ran "less" on and see what binaries get started because that can give you clues as well. Example ------- Here is an example where the Suricata sensor is sending syslog messages in rsyslogd format but the SIEM is expecting and parsing them in a sysklogd format. In the syslog configuration file (ususally in /etc with a filename like rsyslog.conf or syslog.conf), first add the template: :: $template sysklogd, "<%PRI%>%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" Then send it to the syslog server with the template applied: :: user.alert @10.8.75.24:514;sysklogd Of course this is just one example and it will probably be different in your environment depending on what syslog daemons and SIEM you use but hopefully this will point you in the right direction. suricata-3.2.1/doc/userguide/output/lua-output.rst0000644000000000000000000002623513051004444017174 00000000000000Lua Output ========== Note: this page new Lua scripting available for outputs. It will be available in 2.1. Script structure ---------------- A script defines 4 functions: init, setup, log, deinit * init -- registers where the script hooks into the output engine * setup -- does per output thread setup * log -- logging function * deinit -- clean up function Example: :: function init (args) local needs = {} needs["protocol"] = "http" return needs end function setup (args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) SCLogInfo("HTTP Log Filename " .. filename) http = 0 end function log(args) http_uri = HttpGetRequestUriRaw() if http_uri == nil then http_uri = "" end http_uri = string.gsub(http_uri, "%c", ".") http_host = HttpGetRequestHost() if http_host == nil then http_host = "" end http_host = string.gsub(http_host, "%c", ".") http_ua = HttpGetRequestHeader("User-Agent") if http_ua == nil then http_ua = "" end http_ua = string.gsub(http_ua, "%g", ".") ts = SCPacketTimeString() ipver, srcip, dstip, proto, sp, dp = SCFlowTuple() file:write (ts .. " " .. http_host .. " [**] " .. http_uri .. " [**] " .. http_ua .. " [**] " .. srcip .. ":" .. sp .. " -> " .. dstip .. ":" .. dp .. "\n") file:flush() http = http + 1 end function deinit (args) SCLogInfo ("HTTP transactions logged: " .. http); file:close(file) end YAML ---- To enable the lua output, add the 'lua' output and add one or more scripts like so: :: outputs: - lua: enabled: yes scripts-dir: /etc/suricata/lua-output/ scripts: - tcp-data.lua - flow.lua The scripts-dir option is optional. It makes Suricata load the scripts from this directory. Otherwise scripts will be loaded from the current workdir. packet ------ Initialize with: :: function init (args) local needs = {} needs["type"] = "packet" return needs end SCPacketTimestamp ~~~~~~~~~~~~~~~~~ Get packets timestamp as 2 numbers: seconds & microseconds elapsed since 1970-01-01 00:00:00 UTC. :: function log(args) local sec, usec = SCPacketTimestamp() end SCPacketTimeString ~~~~~~~~~~~~~~~~~~ Add SCPacketTimeString to get the packets time string in the format: 11/24/2009-18:57:25.179869 :: function log(args) ts = SCPacketTimeString() SCPacketTuple ~~~~~~~~~~~~~ :: ipver, srcip, dstip, proto, sp, dp = SCPacketTuple() SCPacketPayload ~~~~~~~~~~~~~~~ :: p = SCPacketPayload() flow ---- :: function init (args) local needs = {} needs["type"] = "flow" return needs end SCFlowTimeString ~~~~~~~~~~~~~~~~ :: startts = SCFlowTimeString() SCFlowTuple ~~~~~~~~~~~ :: ipver, srcip, dstip, proto, sp, dp = SCFlowTuple() SCFlowAppLayerProto ~~~~~~~~~~~~~~~~~~~ Get alproto as string from the flow. If alproto is not (yet) known, it returns "unknown". Example: :: function log(args) alproto = SCFlowAppLayerProto() if alproto ~= nil then print (alproto) end end SCFlowHasAlerts ~~~~~~~~~~~~~~~ Returns true if flow has alerts. Example: :: function log(args) has_alerts = SCFlowHasAlerts() if has_alerts then -- do something end end SCFlowStats ~~~~~~~~~~~ Gets the packet and byte counts per flow. :: tscnt, tsbytes, tccnt, tcbytes = SCFlowStats() http ---- Init with: :: function init (args) local needs = {} needs["protocol"] = "http" return needs end HttpGetRequestBody and HttpGetResponseBody. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Make normalized body data available to the script through HttpGetRequestBody and HttpGetResponseBody. There no guarantees that all of the body will be availble. Example: :: function log(args) a, o, e = HttpGetResponseBody(); --print("offset " .. o .. " end " .. e) for n, v in ipairs(a) do print(v) end end HttpGetRequestHost ~~~~~~~~~~~~~~~~~~ Get the host from libhtp's tx->request_hostname, which can either be the host portion of the url or the host portion of the Host header. Example: :: http_host = HttpGetRequestHost() if http_host == nil then http_host = "" end HttpGetRequestHeader ~~~~~~~~~~~~~~~~~~~~ :: http_ua = HttpGetRequestHeader("User-Agent") if http_ua == nil then http_ua = "" end HttpGetResponseHeader ~~~~~~~~~~~~~~~~~~~~~ :: server = HttpGetResponseHeader("Server"); print ("Server: " .. server); HttpGetRequestLine ~~~~~~~~~~~~~~~~~~ :: rl = HttpGetRequestLine(); print ("Request Line: " .. rl); HttpGetResponseLine ~~~~~~~~~~~~~~~~~~~ :: rsl = HttpGetResponseLine(); print ("Response Line: " .. rsl); HttpGetRawRequestHeaders ~~~~~~~~~~~~~~~~~~~~~~~~ :: rh = HttpGetRawRequestHeaders(); print ("Raw Request Headers: " .. rh); HttpGetRawResponseHeaders ~~~~~~~~~~~~~~~~~~~~~~~~~ :: rh = HttpGetRawResponseHeaders(); print ("Raw Response Headers: " .. rh); HttpGetRequestUriRaw ~~~~~~~~~~~~~~~~~~~~ :: http_uri = HttpGetRequestUriRaw() if http_uri == nil then http_uri = "" end HttpGetRequestUriNormalized ~~~~~~~~~~~~~~~~~~~~~~~~~~~ :: http_uri = HttpGetRequestUriNormalized() if http_uri == nil then http_uri = "" end HttpGetRequestHeaders ~~~~~~~~~~~~~~~~~~~~~ :: a = HttpGetRequestHeaders(); for n, v in pairs(a) do print(n,v) end HttpGetResponseHeaders ~~~~~~~~~~~~~~~~~~~~~~ :: a = HttpGetResponseHeaders(); for n, v in pairs(a) do print(n,v) end DNS --- DnsGetQueries ~~~~~~~~~~~~~ :: dns_query = DnsGetQueries(); if dns_query ~= nil then for n, t in pairs(dns_query) do rrname = t["rrname"] rrtype = t["type"] print ("QUERY: " .. ts .. " " .. rrname .. " [**] " .. rrtype .. " [**] " .. "TODO" .. " [**] " .. srcip .. ":" .. sp .. " -> " .. dstip .. ":" .. dp) end end returns a table of tables DnsGetAnswers ~~~~~~~~~~~~~ :: dns_answers = DnsGetAnswers(); if dns_answers ~= nil then for n, t in pairs(dns_answers) do rrname = t["rrname"] rrtype = t["type"] ttl = t["ttl"] print ("ANSWER: " .. ts .. " " .. rrname .. " [**] " .. rrtype .. " [**] " .. ttl .. " [**] " .. srcip .. ":" .. sp .. " -> " .. dstip .. ":" .. dp) end end returns a table of tables DnsGetAuthorities ~~~~~~~~~~~~~~~~~ :: dns_auth = DnsGetAuthorities(); if dns_auth ~= nil then for n, t in pairs(dns_auth) do rrname = t["rrname"] rrtype = t["type"] ttl = t["ttl"] print ("AUTHORITY: " .. ts .. " " .. rrname .. " [**] " .. rrtype .. " [**] " .. ttl .. " [**] " .. srcip .. ":" .. sp .. " -> " .. dstip .. ":" .. dp) end end returns a table of tables DnsGetRcode ~~~~~~~~~~~ :: rcode = DnsGetRcode(); if rcode == nil then return 0 end print (rcode) returns a lua string with the error message, or nil DnsGetRecursionDesired ~~~~~~~~~~~~~~~~~~~~~~ :: if DnsGetRecursionDesired() == true then print ("RECURSION DESIRED") end returns a bool TLS --- Initialize with: :: function init (args) local needs = {} needs["protocol"] = "tls" return needs end TlsGetCertInfo ~~~~~~~~~~~~~~ Make certificate information available to the script through TlsGetCertInfo. Example: :: function log (args) version, subject, issuer, fingerprint = TlsGetCertInfo() if version == nil then return 0 end end SSH --- Initialize with: :: function init (args) local needs = {} needs["protocol"] = "ssh" return needs end SshGetServerProtoVersion ~~~~~~~~~~~~~~~~~~~~~~~~ Get SSH protocol version used by the server through SshGetServerProtoVersion. Example: :: function log (args) version = SshGetServerProtoVersion() if version == nil then return 0 end end SshGetServerSoftwareVersion ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Get SSH software used by the server through SshGetServerSoftwareVersion. Example: :: function log (args) software = SshGetServerSoftwareVersion() if software == nil then return 0 end end SshGetClientProtoVersion ~~~~~~~~~~~~~~~~~~~~~~~~ Get SSH protocol version used by the client through SshGetClientProtoVersion. Example: :: function log (args) version = SshGetClientProtoVersion() if version == nil then return 0 end end SshGetClientSoftwareVersion ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Get SSH software used by the client through SshGetClientSoftwareVersion. Example: :: function log (args) software = SshGetClientSoftwareVersion() if software == nil then return 0 end end Files ----- To use the file logging API, the script's init() function needs to look like: :: function init (args) local needs = {} needs['type'] = 'file' return needs end SCFileInfo ~~~~~~~~~~ :: fileid, txid, name, size, magic, md5 = SCFileInfo() returns fileid (number), txid (number), name (string), size (number), magic (string), md5 in hex (string) SCFileState ~~~~~~~~~~~ :: state, stored = SCFileState() returns state (string), stored (bool) Alerts ------ Alerts are a subset of the 'packet' logger: :: function init (args) local needs = {} needs["type"] = "packet" needs["filter"] = "alerts" return needs end SCRuleIds ~~~~~~~~~ :: sid, rev, gid = SCRuleIds() SCRuleMsg ~~~~~~~~~ :: msg = SCRuleMsg() SCRuleClass ~~~~~~~~~~~ :: class, prio = SCRuleClass() Streaming Data -------------- Streaming data can currently log out reassembled TCP data and normalized HTTP data. The script will be invoked for each consecutive data chunk. In case of TCP reassembled data, all possible overlaps are removed according to the host OS settings. :: function init (args) local needs = {} needs["type"] = "streaming" needs["filter"] = "tcp" return needs end In case of HTTP body data, the bodies are unzipped and dechunked if applicable. :: function init (args) local needs = {} needs["type"] = "streaming" needs["protocol"] = "http" return needs end SCStreamingBuffer ~~~~~~~~~~~~~~~~~ :: function log(args) data = SCStreamingBuffer() hex_dump(data) end Misc ---- SCThreadInfo ~~~~~~~~~~~~ :: tid, tname, tgroup = SCThreadInfo() It gives: tid (integer), tname (string), tgroup (string) SCLogError, SCLogWarning, SCLogNotice, SCLogInfo, SCLogDebug ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Print a message. It will go into the outputs defined in the yaml. Whether it will be printed depends on the log level. Example: :: SCLogError("some error message") SCLogPath ~~~~~~~~~ Expose the log path. :: name = "fast_lua.log" function setup (args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) end suricata-3.2.1/doc/userguide/output/custom-http-logging.rst0000644000000000000000000000444713051004444020771 00000000000000Custom http logging =================== As of Suricata 1.3.1 you can enable a custom http logging option. In your Suricata.yaml, find the http-log section and edit as follows: :: - http-log: enabled: yes filename: http.log custom: yes # enable the custom logging format (defined by custom format) customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %{User-agent}i %H %m %h %u %s %B %a:%p -> %A:%P" append: no #extended: yes # enable this for extended logging information #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' And in your http.log file you would get the following, for example: :: 8/28/12-22:14:21.101619 - Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0 HTTP/1.1 GET us.cnn.com /video/data/3.0/video/world/2012/08/28/hancocks-korea-typhoon-bolavan.cnn/index.xml 200 16856 192.168.1.91:45111 -> 157.166.255.18:80 :: 08/28/12-22:14:30.693856 - Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0 HTTP/1.1 GET us.cnn.com /video/data/3.0/video/showbiz/2012/08/28/conan-reports-from-rnc-convention.teamcoco/index.xml 200 15789 192.168.1.91:45108 -> 157.166.255.18:80 The list of supported format strings is the following: * %h - Host HTTP Header (remote host name). ie: google.com * %H - Request Protocol. ie: HTTP/1.1 * %m - Request Method. ie: GET * %u - URL including query string. ie: /search?q=suricata * %{header_name}i - contents of the defined HTTP Request Header name. ie: * %{User-agent}i: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0 * %{X-Forwarded-For}i: outputs the IP address contained in the X-Forwarded-For HTTP header (inserted by a reverse proxy) * %s - return status code. In the case of 301 and 302 it will print the url in brackets. ie: 200 * %B - response size in bytes. ie: 15789 * %{header_name}o - contents of the defined HTTP Response Header name * %{strftime_format]t - timestamp of the HTTP transaction in the selected strftime format. ie: 08/28/12-22:14:30 * %z - precision time in useconds. ie: 693856 * %a - client IP address * %p - client port number * %A - server IP address * %P - server port number Any non printable character will be represented by its byte value in hexadecimal format (\|XX\|, where XX is the hex code) suricata-3.2.1/doc/userguide/output/index.rst0000644000000000000000000000015313051004444016153 00000000000000Output ====== .. toctree:: eve/index.rst lua-output syslog-alerting-comp custom-http-logging suricata-3.2.1/doc/userguide/output/eve/0000755000000000000000000000000013051004444015152 500000000000000suricata-3.2.1/doc/userguide/output/eve/eve-json-output.rst0000644000000000000000000002256313051004444020720 00000000000000.. _eve-json-output: Eve JSON Output =============== Suricata can output alerts, http events, dns events, tls events and file info through json. The most common way to use this is through 'EVE', which is a firehose approach where all these logs go into a single file. :: # Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: yes filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above #identity: "suricata" #facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug #redis: # server: 127.0.0.1 # port: 6379 # mode: list ## possible values: list (default), channel # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting as to be reserved to high traffic suricata. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entry to keep in buffer types: - alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) http: yes # enable dumping of http fields tls: yes # enable dumping of tls fields ssh: yes # enable dumping of ssh fields smtp: yes # enable dumping of smtp fields # Enable the logging of tagged packets for rules using the # "tag" keyword. tagged-packets: yes # HTTP X-Forwarded-For support by adding an extra field or overwriting # the source or destination IP address (depending on flow direction) # with the one reported in the X-Forwarded-For HTTP header. This is # helpful when reviewing alerts for traffic that is being reverse # or forward proxied. xff: enabled: no # Two operation modes are available, "extra-data" and "overwrite". mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used. deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration. header: X-Forwarded-For - http: extended: yes # enable this for extended logging information # custom allows additional http fields to be included in eve-log # the example below adds three additional fields when uncommented #custom: [Accept-Encoding, Accept-Language, Authorization] - dns: # control logging of queries and answers # default yes, no to disable query: yes # enable logging of DNS queries answer: yes # enable logging of DNS answers # control which RR types are logged # all enabled if custom not specified #custom: [a, aaaa, cname, mx, ns, ptr, txt] - tls: extended: yes # enable this for extended logging information - files: force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256 #force-hash: [md5] #- drop: # alerts: yes # log alerts that caused drops # flows: all # start or all: 'start' logs only a single drop # # per flow direction. All logs each dropped pkt. - smtp: #extended: yes # enable this for extended logging information # this includes: bcc, message-id, subject, x_mailer, user-agent # custom fields logging from the list: # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, # x-originating-ip, in-reply-to, references, importance, priority, # sensitivity, organization, content-md5, date #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] # output md5 of fields: body, subject # for the body you need to set app-layer.protocols.smtp.mime.body-md5 # to yes #md5: [body, subject] - ssh - stats: totals: yes # stats for all threads merged together threads: no # per thread stats deltas: no # include delta values # bi-directional flows - flow # uni-directional flows #- netflow Each alert, http log, etc will go into this one file: 'eve.json'. This file can then be processed by 3rd party tools like Logstash or jq. Output types ~~~~~~~~~~~~ EVE can output to multiple methods. ``regular`` is a normal file. Other options are ``syslog``, ``unix_dgram``, ``unix_stream`` and ``redis``. Output types:: filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above #identity: "suricata" #facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug #redis: # server: 127.0.0.1 # port: 6379 # mode: list ## possible values: list (default), channel # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting as to be reserved to high traffic suricata. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entry to keep in buffer Alerts ~~~~~~ Alerts are event records for rule matches. They can be ammended with metadata, such as the HTTP record an alert was generated for. Metadata:: - alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) http: yes # enable dumping of http fields tls: yes # enable dumping of tls fields ssh: yes # enable dumping of ssh fields smtp: yes # enable dumping of smtp fields DNS ~~~ DNS records are logged one log record per query/answer record. YAML:: - dns: # control logging of queries and answers # default yes, no to disable query: yes # enable logging of DNS queries answer: yes # enable logging of DNS answers # control which RR types are logged # all enabled if custom not specified #custom: [a, aaaa, cname, mx, ns, ptr, txt] To reduce verbosity the output can be filtered by supplying the record types to be logged under ``custom``. Multiple Logger Instances ~~~~~~~~~~~~~~~~~~~~~~~~~ It is possible to have multiple 'EVE' instances, for example the following is valid: :: outputs: - eve-log: enabled: yes type: file filename: eve-ips.json types: - alert - drop - eve-log: enabled: yes type: file filename: eve-nsm.json types: - http - dns - tls So here the alerts and drops go into 'eve-ips.json', while http, dns and tls go into 'eve-nsm.json'. In addition to this, each log can be handled completely separately: :: outputs: - alert-json-log: enabled: yes filename: alert-json.log - dns-json-log: enabled: yes filename: dns-json.log - drop-json-log: enabled: yes filename: drop-json.log - http-json-log: enabled: yes filename: http-json.log - ssh-json-log: enabled: yes filename: ssh-json.log - tls-json-log: enabled: yes filename: tls-json.log For most output types, you can add multiple: :: outputs: - alert-json-log: enabled: yes filename: alert-json1.log - alert-json-log: enabled: yes filename: alert-json2.log Except for ``drop`` for which only a single logger instance is supported. suricata-3.2.1/doc/userguide/output/eve/eve-json-examplesjq.rst0000644000000000000000000000265013051004444021524 00000000000000Eve JSON 'jq' Examples ====================== The jq tool is very useful for quickly parsing and filtering JSON files. This page is contains various examples of how it can be used with Suricata's Eve.json. The basics are discussed here: * https://www.stamus-networks.com/2015/05/18/looking-at-suricata-json-events-on-command-line/ Colorize output --------------- :: tail -f eve.json | jq -c '.' DNS NXDOMAIN ------------ :: tail -f eve.json|jq -c 'select(.dns.rcode=="NXDOMAIN")' Unique HTTP User Agents ----------------------- :: cat eve.json | jq -s '[.[]|.http.http_user_agent]|group_by(.)|map({key:.[0],value:(.|length)})|from_entries' Source: https://twitter.com/mattarnao/status/601807374647750657 Data use for a host ------------------- :: tail -n500000 eve.json | jq -s 'map(select(.event_type=="netflow" and .dest_ip=="192.168.1.3").netflow.bytes)|add'|numfmt --to=iec 1.3G Note: can use a lot of memory. Source: https://twitter.com/pkt_inspector/status/605524218722148352 Monitor part of the stats ------------------------- :: $ tail -f eve.json | jq -c 'select(.event_type=="stats")|.stats.decoder' Inspect Alert Data ------------------ :: cat eve.json | jq -r -c 'select(.event_type=="alert")|.payload'|base64 --decode Top 10 Destination Ports ------------------------ :: cat eve.json | jq -c 'select(.event_type=="flow")|[.proto, .dest_port]'|sort |uniq -c|sort -nr|head -n10 suricata-3.2.1/doc/userguide/output/eve/index.rst0000644000000000000000000000012713051004444016733 00000000000000EVE ====== .. toctree:: eve-json-output eve-json-format eve-json-examplesjq suricata-3.2.1/doc/userguide/output/eve/eve-json-format.rst0000644000000000000000000001210713051004444020641 00000000000000.. _eve-json-format: Eve JSON Format =============== Example: :: { "timestamp": "2009-11-24T21:27:09.534255", "event_type": "alert", "src_ip": "192.168.2.7", "src_port": 1041, "dest_ip": "x.x.250.50", "dest_port": 80, "proto": "TCP", "alert": { "action": "allowed", "gid": 1, "signature_id" :2001999, "rev": 9, "signature": "ET MALWARE BTGrab.com Spyware Downloading Ads", "category": "A Network Trojan was detected", "severity": 1 } } Common Section -------------- All the JSON log types share a common structure: :: {"timestamp":"2009-11-24T21:27:09.534255","event_type":"TYPE", ...tuple... ,"TYPE":{ ... type specific content ... }} Event types ~~~~~~~~~~~ The common part has a field "event_type" to indicate the log type. :: "event_type":"TYPE" Event type: Alert ----------------- Field action ~~~~~~~~~~~~ Possible values: "allowed" and "blocked" Example: :: "action":"allowed" Action is set to "allowed" unless a rule used the "drop" action and Suricata is in IPS mode, or when the rule used the "reject" action. Event type: HTTP ---------------- Fields ~~~~~~ * "hostname": The hostname this HTTP event is attributed to * "url": URL at the hostname that was accessed * "http_user_agent": The user-agent of the software that was used * "http_content_type": The type of data returned (ex: application/x-gzip) * "cookie" In addition to these fields, if the extended logging is enabled in the suricata.yaml file the following fields are (can) also included: * "length": The content size of the HTTP body * "status": HTTP statuscode * "protocol": Protocol / Version of HTTP (ex: HTTP/1.1) * "http_method": The HTTP method (ex: GET, POST, HEAD) * "http_refer": The referer for this action In addition to the extended logging fields one can also choose to enable/add from 47 additional custom logging HTTP fields enabled in the suricata.yaml file. The additional fields can be enabled as following: :: - eve-log: enabled: yes type: file #file|syslog|unix_dgram|unix_stream filename: eve.json # the following are valid when type: syslog above #identity: "suricata" #facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug types: - alert - http: extended: yes # enable this for extended logging information # custom allows additional http fields to be included in eve-log # the example below adds three additional fields when uncommented #custom: [Accept-Encoding, Accept-Language, Authorization] custom: [accept, accept-charset, accept-encoding, accept-language, accept-datetime, authorization, cache-control, cookie, from, max-forwards, origin, pragma, proxy-authorization, range, te, via, x-requested-with, dnt, x-forwarded-proto, accept-range, age, allow, connection, content-encoding, content-language, content-length, content-location, content-md5, content-range, content-type, date, etags, last-modified, link, location, proxy-authenticate, referrer, refresh, retry-after, server, set-cookie, trailer, transfer-encoding, upgrade, vary, warning, www-authenticate, x-flash-version, x-authenticated-user] The benefits here of using the extended logging is to see if this action for example was a POST or perhaps if a download of an executable actually returned any bytes. Examples ~~~~~~~~ Event with non-extended logging: :: "http": { "hostname": "www.digip.org", "url" :"\/jansson\/releases\/jansson-2.6.tar.gz", "http_user_agent": "", "http_content_type": "application\/x-gzip" } Event with extended logging: :: "http": { "hostname": "direkte.vg.no", "url":".....", "http_user_agent": "", "http_content_type": "application\/json", "http_refer": "http:\/\/www.vg.no\/", "http_method": "GET", "protocol": "HTTP\/1.1", "status":"200", "length":310 } Event type: DNS --------------- Fields ~~~~~~ Outline of fields seen in the different kinds of DNS events: * "type": Indicating DNS message type, can be "answer" or "query". * "id": * "rrname": Resource Record Name (ex: a domain name) * "rrtype": Resource Record Type (ex: A, AAAA, NS, PTR) * "rdata": Resource Data (ex. IP that domain name resolves to) * "ttl": Time-To-Live for this resource record Examples ~~~~~~~~ Example of a DNS query for the IPv4 address of "twitter.com" (resource record type 'A'): :: "dns": { "type": "query", "id": 16000, "rrname": "twitter.com", "rrtype":"A" } Example of a DNS answer with an IPv4 (resource record type 'A') return: :: "dns": { "type": "answer", "id":16000, "rrname": "twitter.com", "rrtype":"A", "ttl":8, "rdata": "199.16.156.6" } suricata-3.2.1/doc/userguide/userguide.pdf0000644000000000000000001724522313051004530015456 00000000000000%PDF-1.5 %ÐÔÅØ 1 0 obj << /Length 843 /Filter /FlateDecode >> stream xÚmUMoâ0½çWx•ÚÅNÈW…œ„H¶­ Zí•&¦‹Tàп~3Ú®öz¿™yóœ87?ž×Ûö¯nÝkõâNýehܤü¹=77Uß\®;?:׺vÜ==¨ç¡oÖî¬nËUµêöç;O^uÍû¥u#ëÿ¤Â½í»O ú¨Ûû=Ù˜‰a³?¿ûkLy 6FÑæ/7œö}÷ Ì½ÖÚ–][öH<Si£¦cãݾké¥^Ñ90¡j÷ÍYVôßü¬H^œÎî°êv}0Ÿ«é‹ß<‡ÒrLŸ†Ö ûîͯ_®/Çã»Ck¥ƒÅBµnç«øy·§¦Wý×øæãèTHkÃý›¾u§ã¶qö{sÁ\ë…š×õ"p]ûϞќòº¹KÏÕµÿ u”/‚¹A² )`JbD>`´öØ2ãš™$`¤TY'`”(ZqŠÇÁ¼BJÅŒ )KÒÌŒ%553<Æ,£è(‡hþl™×wBš6„‹0¦Ða™G„+L¤gıè«cŽWÀ c œrn œqœø9çÖÀ–ã°MÜ—8%Ç àŠCMq.â†5„Sâhr›ê›®®AƒáúI‚Öå皎­ú\SåþÈ©¿ÇÀ á]8 é`Y‡7ÑŒ1OÊyeäµñÖzlÃë,d mYĸ”S£SJfß-›1i‰:C&e c4ÎRÆÄÉ؈ËÄ$D&™ Ë Æ&+ü¬bLõÉãaÉjÆ çÁbôÍy°üœ£‡+çÁbèÉYB¹ü‘þœõ§Ägý ñYJõYŠYrÖŸb–œõ§x(rÖÁèœõGT“õÌ›ËÁ`F+ƒÙ­L ,C9ô²â?d+þ£¯ÿ¡ÍŠÿÄÿ1£ÿ1—ÿ¡ÓŠÿðÄŠÿ˜×ŠÿT_ü‡~+þCg!þ£o!þƒ_ˆÿàâ?ôâ?åŠÿÄÿ‰/þ?ã«„°øY ñ³â?^ŒBü‡Ÿ¿\–jò‹UPñœŠ{Åð¡âxᇻLöó^U}9pQãóq½÷›Ë0øO}cèÖÇ}¿ïÜõ3tìÈ¢}¿Æ!VOuðÊñË· endstream endobj 3 0 obj << /Type /ObjStm /N 100 /First 802 /Length 1146 /Filter /FlateDecode >> stream xÚVÛnÛ8}÷WÌcóÐD¤xPHÓml.FìÅî>2m ‘%C— ܯßC…j½X„`Ç”8gfÎœá0œR”&¤IdÄ2Œ>xÃ1…ILãkˆ'šXFœ)✸0 žWxÂ'þ¦€¦?ŒRàRA¸T’àØ0$$~2 9‚f ‘’ÄžP$š¤2+•$$)„–‚ÞHIJq’†T&Hf¤YJx¡…\¨”´‚µ"á¥&“`„ƒxÒ‚Œ™$“áÉPƬ)0ã”étí p£P Ð2`œÀA†:$€Æì#:cØÏP†üÁž1gÔe܃‰q.,I±0Kà’#&óULýT›¥ÍÆ‚Kå]aa¼„ßw&^±PÒ{Å"ƒgŸIæÝ)}À$øŒê©Ñ+¾ µG,”Œ²ˆ]™_ Á‘A¦5[xBLŸ<Da†˜»£}@xÎPjqX–ú¤`—ùT!˼ $âI’- >Žï_P†œxâË ©øÈbñ×ìxíÛ3_”sŽÈ ɹ·Î}ÎŽsÏ ÒñÔó‚Sžúœ!O}ÎP§P‰A>.¿Ïb´g1ÚÀ³ð(È%ç‹OŸèbE×ͺ¡‹¯ô!ßÙCïÚsvFŸ?/>ü¹³=•­†¶ÌmoÏþè\Þ—M}Î&ÈåS3ôÔï=\M7õ¦i÷ÖÛÐÊåðÓé[3ÔÅøîìÍ ø«»›ºëmU½aú1ìoD endstream endobj 358 0 obj << /Length 586 /Filter /FlateDecode >> stream xÚmTËŽâ0¼ç+¼$æÀà$0Š ‰Ã£­ö ‰a#A%áÀ߯«›ÀÌjDÕå²»«ífðãc;ZæÕÁŽÌ«Ÿ¶­®MfGÑÏ}í q•]/¶ìÞ­ÍmÞ¯¶o⣩²­íÄ0ZÇë²è^œx]fçkn{ÕÿE+{*ʧyÄpg6;5’PìŠîìVž¤pH8$hù—mÚ¢*ß„z•R:")󨺠ÊÖß3‰qŸûX”ysO'Hî)-ò"ëî}³‹³‹ÍÛ[ÛÙ˺s á3 4†{´¢p¿YôdšrýØëKæ‘+ˆ™ÇÞ a }ÀõàíÑ« W€‡Œ{ Fvm734…4˜‡¢´A­«»èGÞÿc Ú¤Þ_86 endstream endobj 359 0 obj << /Length 770 /Filter /FlateDecode >> stream xÚmUËn£0ÝóžE¥Î"±y$UÉ6 É¢5Õh¶)8¤"’,ú÷ãc\W³Ýsß/.7?ž·3ÑôozÆï(yѧþ2Ôz¦vÇèæ¦èëËAwçG­ÝŒÒÓ=yúz«ÏäVmŠMמåMW\=jý_Iê÷¶ó*ˆCn_õŸÙÃfö ¯íùÃ&1yØ+ü­‡SÛw÷$¾£”FÙ5ª? ÅS4¿†!ó1ð¾íšá‹¼!r3Ò´õùŠì»>˜Za¼ý<õaÓíûhµ"ó#<‡O›ËÏhþ44zh»wrû°1p{9?4B“4Z¯I£÷Æ‹©çqwÐd>å?ñ¯É»Ü=ûõó¨‰Ã±K«î}:îj=ìºw­(]“UU­#Ý5ßd¦kò¶u¥Ñ¥¥y že¥ÖÑ*†ƒx12+ƒ¹Sx¦æ,öÌÒ09Ì9Ô)5t´J N¦Š'†™™{fSÉ –2Œ¬Rà̼   KÙÀÒV i‰X¤¤†BÆRs>–^ÿÝ ×.¹¢KäCc†2—ÀÜc4‰&WÀ©o"²¦™ÇÖîq¼ð8^zlã p5u%†=c¾K(œq/‡?–xŒQ±Ôcøc™·/€s/G|¶°£•¨•-mõ„¥•éƯP/S8+8èÂÑ 4fÁR§SYZ"?.ì‚0»1Òшŕ[KŽþòÒñ­¾õÃúPKS6Ò×0ÃÔæ—eÈ;UŽ†}Z8~S›gÈ;­ _™õÇàg®v»ói;K¹æÊcÄÌ g‡ÝÌ­oZ ÞÜú¦ ú¶ø’'ü êê„LÄá^ î¥àá^Š$ÜK‘†{)²p/Eî¥X„{)–á^ î¥(½ߎ‡¨> stream xÚmVMoÛ8¼ûWhÒCj~H”\HÉrhSÔÁb¯ŽÄd IJ!Û‡üûÕ¼±Ã¢ØƒõøÞ¼!9ÔÝ_?7¾?¼ÄûUe¿âép»øPßgwwÍ¡»ìãpþcûÛÛÓ·ìçxè6ñœÝ×Íã°;™‚‡îýÒÇ[Ôÿ…ø¶Rêd÷ÏñŸ‡§ï›…ˆçÝù}z“³ eÊäõßq<í÷LUJM롯{°<Íæ×JÙüVûu7ôãµ\ö‚â3m²~ׯOòßí§v1yóq:Çýãðz˜-—Ùü×ôòt?„Í—Ùüiìã¸Þ²û‰Ïô¼¹ïµ35[­²>¾Ni¦ž~l÷1›§>_\é“}~þ8ÆÌȳ&±îÐÇÓqÛÅq;¼ÅÙR©U¶lÛÕ,ýï g¼¼^Cs=…~úk*[4õ¢^Í–¥™žåO×mT·I:/nYº·ãµž1ÚLs*J`#¸lœ ne¼ÀÜ¢ì8W—Ìi+Á‹xAì€=±Ì ÄpM¼n˜?¯™SbZbÄhòÏ`-؃6‚+ÔÒ–µtΘ¸ 7 þÆûXøû €ÉßB[Mþ98hò¯ ›&ÿ ýjòwÐJ7Äà¯É¿”qò/1n„¿^ –ÑÄÈi 1z1–ùMN þ¦ F_ƃ›¡þ¹Ä ÝHþ±ä÷Ä’?K|M,ù愆fý[þ«þÐÜ e‘ÓRÿ©Õ S…xKýúµÂ¿¨e¹‚ä‘ýc­Ä íQ×Rþ–ú+™ëe¿y¬‹¥þ ëhÉ_Ë8ùkôh©¿G_–ü=âsêoSsƒ¹9µµ¨›S[‹<9õ”^rê©%æZ:ä¬kÁ³`Nø‚<åÜ'{¸à>© [AžkZ§&ŽûÜ#¿£Îùä· 9%F-—ËÜ‚µÏ©ì=WC'}•k‰_K—óRV³ᯌÔõÄèQàV ç$¾!–6n/xzjgÿu › endstream endobj 361 0 obj << /Length 1026 /Filter /FlateDecode >> stream xÚm–KoÛ0 ÇïþÞ¡@wÈbK²EÉ ‡=°î©­v;p’C¿ýLÒ2­b‡ü™z”é¿n>ý|ܘnxvù%‰¹óp[·)¿íOÑÍM5´×£ë/ßë\ç½ç¯ñÏqhÝ%¾-ª‡þpù< ~èÛ·kçü¨ÿ²îõÐóØ'¾}r6ßê?›F<.o“‡Æ“OVŒîßn<†þkœ~I1=¨û®Žå9ÚÎ;Å[¿÷Ë¡ïÆy»ø6Rw‡ö2þ·Ç)]˜üø~¾¸ãCÿ2Dwwñö×ä<_ÆwŒæs´ý1vn<ô¯ñíÏÄ×ÓéÍÁÞqÝßÇ{™–™rú¾?ºxË),Ž9|Šž?½Ÿ\LœR`íйóiߺqß¿ºè.Iî㻦¹\ß}𥹢9Ï/íßý8Öß5õdNœžrf=KâʳšXÈÄxΈ—ñ9ñ²¾&^Ößázz_/ë¯ëe¾%^æ—ÀI%À®Ð®s°k°‹f™×ûyé*ïx•7²`?¬Jö#+® rÆuAι.Ț낼㺠\dÃuA¶\är® ØÕ\°Wyã¸UÞÀb•·^å¼:oäÕy#¯ÎyuÞÈ«óF^7ò꼑Wçl8/a9/Qr^8®â¼WyÃù‰†Þ…lf™`…;%»[ mpŒ$[MyX[RŽÞ+Iù¨¥¤ÜL6§Ñ`ÓYÜË 9HKvvI6ä)+²K°k² Ø Ù§šã‡¹Šâ7ð+Š¿€¹Šâ/°×Qe\G…ñ›$Ÿû@if¨Â<„¨½¿`F¿¡ñ‰÷[fô—Ä©÷WÌ诉…÷7ÌàÏ0O‘úùæ*’Ƴ xü÷"ÃœE)=+b¿~–ÑúÊsN~¦‰—ýv¼?ÆSðþȆ÷G¶¼?rÉû#W¼?rÍû#7¼?p>çïãËSfôcÊ¥~¹dF¿b†w4ψ}}òœÇkf¿ãþGÁýl¸ÿ‘-÷?rÉý\qÿ#×ÜÿÈ ÷?°žó÷z¢Sfô fˆWKfèUM}k¡5õ­…ÐsßBohÍ:¡çï0οÁÐÿšò¬ ÷4}{ÆCùU¸NµzŽçšVcC6¬¹û ¯&á9&ýà¡öj¯Q¡öš,Ô^“‡Úkt¨½fj¯)Bí5&Ô^S…ÚkêP{MÃÚk®©MCíµ"Ô^+Cíµ*Ô^›…ÚkóP{­µ×îBíµE¨½Ö„Úkm¨½¶ µ×V¡öÚ:Ô^Ûð·µLøÛZ¦¡ö–"ÔÞR†Ú[ªå=™njó îlpÅ\®†íu§[#ÞCñW¿Cï–«êi8Á,üá×ß™~4Ñ?„ãªs endstream endobj 363 0 obj << /Length 263 /Filter /FlateDecode >> stream xÚ½PKOÃ0 ¾÷Wø¸IÄØižW$:± b-§i‡²†ib;ÐQ!þ=î± îHqìXßÃÁåÌr0x-‡`{,(wÞ B©rô;¸~®. ÿzÿ™š@E4ÎŒs¯7t–ÑÁçsã‚äÔÅÓÅç×öJÖWyÿ»¦¸­JÚ ž¡y…’J$qqN£fMëY=ôûmûÑΕöaö|JýT-†}—æ›f)*Ø ÃšQ…u@A@d¾³È*R{J³Dœ™îšéc ØZ4†'êãC]ep„µz+ÃJ=ú8ô&Ué¥ÚþKœ,ÍØÞL…&ö£ÈŸŸ¹oŠo¿­tº endstream endobj 372 0 obj << /Length 19 /Filter /FlateDecode >> stream xÚ3PHW0Ppç2ÀAc(á endstream endobj 412 0 obj << /Length 1171 /Filter /FlateDecode >> stream xÚí›ÝS«FÀßóWìcxî÷²jÕz«15tÚŽ½VÃH r3ö¯/„…ÞxǘvÆ} C–¿óµg<.zPoOüÞÑ9‘@º’cü@=áJÁ§ž‹¹~îú§7Cÿlè¯þ—t1ôt‰ å/õ8ÈÊÁ6NÞ^”CSþÝЊØjì‚ÈåHŽœòÂþïÓ p˜Á~”×Ûñ"‹&AÔ·Õ"ʉ Ë?Ãæï» µö¼Z>(\ …\ɘÔ­¤"¥ Ç÷éB‹ULU½s3WI½w™<¤Ù,(¢TŸ«I)tñ\;ˆõÓEÖW¬=ÆÝ€pÔw+Ÿý6TÊýGé<X4@M{³¶ êJJÁ—\WsÁZW.“¼âxËkíh9„vàV;Æé"›¨îkðù@°ÿ‹ízµÊ‘7ª\yy,Ö`O¢$È´σÉSð¨òî­'¥1†ÔCÒ¸îð›ƒY?H&*lÜõKn£2ZdÁ½; ¿'Úߟ¦³YhŠWQÒâŠdþà H~K"øŽ€}•~‚dÃÁ»¨¢< *R­ŠmRº‚~»ˆ»²RaˆhóÓýÔRŸ%YW@Ú*`-voE–†‹É6÷Æ…g5l? ÃUr‹ö S¼ؤת¹*Š(yÜð”që-Å’J9h›rü¬‚Peµ5þR%ªš>/ûinà•ŒX’û“ÄÐIªIŽ2õ„8.Jœ]›Äžçï5½«ðsxYƒ·²Ëà9NƒðõÖʉµV8‘1œ¼ñ»¾?z=G&­ušÃÉÌY§Ð8Ïã´Â¸|=R¥u¿¦Érn,Ùõ:d£¤Ø°Jn«¦ïj¸\3\©ñþqmÖ?ùô`?„¯0gt^e¾Q¬^ï”…G-\ãT±9ª¨¦Z•t sš©|šÆa”<Ú ÒaøQsüpÍï§áx‡L‰Zk4Õ\) ‘êx|uä_íÖCÈ¢üP†m¶‹hÍð: ï û‹üEŒAa)š€i.·E¬ñ²#bk ƒÓ3Wc@¼Æy6¼^îR6"Ô²Ü"1QÔ/T¢²hR3<žÏuƒ@ð¼Ë" ÇȲ{šÁtÕ«¡]-ôâùx’EóbËTãs­°¼³+eæÒYV=°qôOÓfu²x¨ÌîAe[<™e¹=s ¬k:ã$Ít Ói:›EtÅU sæ–Ù>èÄ»“˜îNú¯”s$Á£š©n¡½ÓžäÉC´'±µö¤ VÇ˨˜ê6¾(yšù–¥v&ù§Ó¤­ºcj:ÃÚ¶£ãpUä[øÓAUn´ÐIÓÍ2y±»­ α–¿=‰Ñ#fu«ª&†-“i×WÅ“Гsíɯƒ§Ö>s•äwû5Rú g=±ÊŠ· J¶£/½ºaM4¡EU5-•­’¼*õKºŸÀtï¿ùÎüÞß=TîB€€À€•¹`2ëÝ}… ,O©’X®.šÊKA ƽ_õ'kß¿FF„‹  ØE×wŒº7ü^yµé endstream endobj 204 0 obj << /Type /ObjStm /N 100 /First 854 /Length 1729 /Filter /FlateDecode >> stream xÚµXÛnÛ8}÷WÌc»ÀJâ‚iÒ¤Ún´‹Ý ò Èj"Ô‘ Yj“¿ß32l/¡Û…ó4=ž‹ TIX d”IXÍ#@¶ŽG€l‘µB¥„C…R ­j%œó3…b oø' {ª(ÚDNµQ$P!ÅU.®ÂYîè_C¡H‰á>Â…g+¹•ãžƒ~ÊqÃ1g®¶q-¸M ûp}47¦g§Žƒj<ÂikA_*/g …9¼±Ö ºgPÏ#˜XU¤­ Ã#a¸í;Õ£5h*4€¶èT…™Ú)7ÛÛ£üœòãî}Gù!=[ÕÕÐtmæ3óœ^¼˜={;.††Þ×mÙV÷ÏþvíØwËeÓ^Óiß|nõu½¢ýCÝÓùPöøü£º)—pÈÂá¬^ŽCɨ‡ ™X;ŸœRÊ-ŠèÞ6W}³V ï~^§2.éäôöMÅüNÚÕP.SWÓñØÌÓQ£²oï1½»M$f7ëoÜ HïsSÒ‡¶¹£ó®úT§êbV_;ôÝ|ÜÖMv“Úü¶lç+jZB^ЦŸS?¶-Ç¿í’ÉÙMr Pd¸©©ºÓ²ÇJSÞ¿*—ì^Õ«ÕOE-ðrlsºïÆžº/-U‹¦n‡„À.V¢lé´¼Nv¯Ûȹ©zÖÇeY}j»/‹z~]ß‚Gª…ã®ÿ¦©êv•äñ°é¿û@Çu‹ÎXP\,qzrö¦È}vý\ó¦vÛµø< Cß\ìöû»®åắ€ë¬ ©Û©Á-œúZ4´íØWužž§¿™wØU#‹˜þ$þ–áT¶éúyýýÇé‚O.Q~Ô —츷7Ëßß/kʹfùA‡TQ,œ0ø¨}6ËÏêÕDš‡äzèm=oÊ—Ý]°8®¸ /g€è1~aò‹ðÿ û×ßÿà”‹®Ë<ÐÚq±¸|Ô°8~åszÄIᔧp¼^'ƒó°²›Ì¦ã˜Ÿ^0+?Å:ÂJHñðˆò÷õÝ@€?ÎÝÉïrwÅÿÍùnÍý’izZ|GO‹_£—ï·m¨‹é Êôøº¶6Z­6¬­/¢ÑÊhU´ÏG<ñ|ÄóÏG¼ñBÄ /D¼ñBÄ /D¼ñÂOE´"Z­ŠVGk¢µÑºh×xß”`Òk–ŸWÃôŽÃߧYþ²ëçu?I]\æ¯ó“üàBL/\œ õt"+Ñh“ñ­——LáÀoŒÎŒpÛ§GwÅi%ï„…7Yàû¨™áë†(²ñœáNðC›Ñ.ylÔÀÙØÚén˜Y,y#‹Ì*ŸTCî\ Bæ$_C¡Jp{Ç…Ç©¤ò ª¢a@o¸á¦^PEø-<ž@g2/¦+nÆ—zí5ª$·ðP;ïmD°‰€.ŪÕVfÞèdw¨Ý«®ðÓ?:ã½N›"s>$ÕPO°V4ÖF½J ¾Ä^¥¥Ï‚Oïz÷j`mÓ_%ÿ¡¤qæ "½qè'X*ød6 a™NàÍKFlá±û¥‚^&ðax7ü?PP(Ò6=vߤ8¨ )°uh~—üQ†>ÛôØ}{(ãqj•S8þãÔ†¬Ûô0»ç¡qSܧøÀðc8ka{ßÂÃnxü üD§a endstream endobj 465 0 obj << /Length 1446 /Filter /FlateDecode >> stream xÚíœKw›8†÷þ,ÍÂT¡e›[ÓÓÌxbw6™.Llá6 ÚæßWAãØI#šL­Mp°céð|×WR€µ´€u6íÕA °€ãOþôß*ä½›—g£wóÑ›S—ZÔ¡>ò­ùøõ<‹@à—Xó…u5&´'ÐÅ`|Y¥I¶ˆJûóüC7œu5 ;öp@Ò¾zãéB„Ș’{·ÏX~|¡C1ni"EsjC†ÝóÑy¦ž*脧™¬½…féM“ÔEÖ\wº'Ð Ûà CmnÖJM3Õ#]fb«©gâåP<±6ž­ÖtQÅ‚·]/‘]RÊÒ°îšn{Z"¤ì+&Ú*TÇE–ç”1-x­b|á²c’T—QÙÜ{#¢B…YÁ Qå½| Kï ¬Ž©ªŽ/£¼(Œñ …1í ãó© ò̧®Ž‘‰C™ÐÔê~»ú<åJ›…ÏE¹Ûâ|÷‰'mL}Åýáa3ü,¢ R2ø¬¯çÓٞƥü›rɬÛH¾¹ …Er¦î«P~· •Š"[TáÖE§ƒZ?øÅö§ë´‰D©BýQ–$,]¨E®Bº ñ2±ËBcý[Q¥?ŽbÖ§û­ðA ÈÀøw˜6׊•*¶ÂDÁÉ‹,ÉEÿÄ4Nõ -OŸ)%`²¼ãFe¹Ó_ &¾49Õã¿«x¬\é6«Ô¬ÞíñUù\ó(íyEØ0ü)†ƒn® ÍÐLÁ›Öe[F»;x†é“I[1u=”9ÙñÂ%ÔF[¦®'óÑ#(_ ZYØsO¬0]}ÖBÞþP[ ¬¯ë%–çK›°bk6úKýÿ™»Æ)¿ÂCkƒXç÷F•£}ÞÓÉ endstream endobj 475 0 obj << /Length 454 /Filter /FlateDecode >> stream xÚí•MoÛ0 †ïþ<Ú©¢>lëصkÐb(¶Å;=¸¶Z‹e̱×ýüÉV’µIÑ6@6 À.)Éâ+>„ÈàÌ"¶)g90*2é¿2O¡ó {“_gч":¹)hªSžBq‡ e"ƒ¢†EŒyBcñiõݵ ²øaiê{Óׯ’›âj¤”©Ô;Ó1¬¿Y Í„#Õ¸Q ƒ‚O¶2ne^‹*Œzr!ô£û)rŠÈ ×à^k ˜\±xvý-!|4Œ3]¹ Îçávi«`¯u>•¹ š‰˜†›¼¿Aj}´Ãvò’ñ쵃 Øo Ô Î:Sö6á*þ™ ŠM€sÖ6MëVÁ9íûÎÞ&œÅCo[G®[7®›®²°’²`\ºÞt®÷]êã¥öÙ¼eÇË›y›­Ê¾ ÷š·CWmsWïWu®ÞoUÿõRÇã‘“Ï‘;o«a|¥§’Ý“À²ÿØþ ¯þJPR-åºÅåᥫͯ—ûúB~,¢z“Ž=[IÊÓ ª&ZÜ0¨ýôÕ(Dçð0mj@¦^,a} m_<–¥ÒT#H>5¿)¦µv7æocj¼} endstream endobj 479 0 obj << /Length 113 /Filter /FlateDecode >> stream xÚ3PHW0Ppç2@£ ¹ ´‚¡‚¹‘‚©‰ž‘™¹Br.Wt¬B PØKÁ@ÏØÒB¡¬(WÁÄÌHç(sr9…pé»›)XêYš™)„¤Œ01Ò344RIQˆÖÈ,ÓŒ ñ‚[åÂß‹ endstream endobj 485 0 obj << /Length 873 /Filter /FlateDecode >> stream xÚUKsÓ0¾çWèhÏ`!ù!ÛÇPÚÚÒ˜áP8¤¶’xp¤ Øtà׳ÒÊIš–áqÉjW«Ýýv¿YF.'ÌËo’Nò˜äœÑ,¤ÞLî¾0Ò€ý-a´,yp^’ŠdGæ““WÕä帗´± Õ’¤%§EƉ(cÊYFª†Ügo¦7Õùmø¥zëÜyJ“TÄÖŸç” N¢8¡%çè~}un]'çÕãâD–ÓŠj0Î繬!oÿµ÷Zµ½6­Z¡.ÕªU’†Q&Ê`Ö?.Mo¥ÂÓNËÉ]*€ ½Œ8§eæ©Ã8 ”´uipo‰ƒj­7›RÿˆÌ ðFimþÌXÜ£ÓRªYô­V/åyЯ%ú^c%à3S®9Ö ¯ŽðÁõEȳ`mŸYÆ®gó œúG‡Q€à}P#-¢ï6 ì ,Θf¥«Ílè°`uÄd”E¿ ð×À.=1Þ^>! ¤O ZƘ}z¯‡ ‡™à€]p\TË0¶C;ሹï„Õ.]puù•>a*$!iî׫r úø†ÃéqÃÁpÔpV>m8x8þ€\ 84X–'´ y¬Â ÈÕþt‚нÆÛ{ uh»Õ=•|åí£ûnØnµéTxŽªhä²ÝîÐ2;RY¯•îôª•;´tíW»LÞ{dÍ‹ø…뚨î;ÿ–ô¥[O«Œkö? q”Ü3$¡…ðy×ÖRíäŸÆ âx¼YvÌÐöÛ çZ7þ䦲Ã4 j08iðˆ«av8F0Ä(ô¥íŽYaQå)ü¦…@À§FLîÜÃË«áR*i*7Ã=”‚çç >Øn;[­ÇÚ]©ú‘kë™e?€´ãò Ç!ÿ3ûðÌHÈzø Ápg@^­> stream xÚ1OÃ0„wÿŠ‰¼ÚÏŽ¯ ¨Ô jÄPu°C#µ4©øû¸5ABb`ºç“ßù>K¼Ab)nƒXÕ’ÕM1žÒ!Å1•ƒ&&UoÃJÜñ!T~LB•pCN:ìŽb³•è³¿‚$í;|^oal—õ€µxò»è¬¿²ZClÿõ'«É=T¾†Ö-µÎ絫y·ïÓ ­¨n,sõ²Sq†±èÏ7]˜ç²™ý ’ùQî endstream endobj 498 0 obj << /Length 1497 /Filter /FlateDecode >> stream xÚ¥XK“›8¾ûWp´«YHˆ­ÊaòÜIe“lƵ{Èæ€AÆÔ`ðò˜Iòë·õ€L¨É¤¦jR«»õuëëÆØIì¼YaûüoEà‰âÔ FÌãN|Z}þ‚æß:…!wîµÔÉñ¹€gîܬþZ=ß­¶¯Angz"•&VX–(¶¶vôåÕ£Dš¢ÓæÐ*¶€àÆì<›ñË¥ôW!Wæ{²‰·]FÍùI|û¼ÎѨHº²—wÄÓ6çÖ2Ò,6p±0g3ÐÜEj”ööŸDèúX–ЉºÙn·%ñLͱ'ÍDy6MÍë8â3æ|(ÜBèº@ãÑ>—nǧ¨ŠnѸ[¬  ÄÁ8/Kå ^ecʧSö]{H,‰Ãô¾k|`|ЭIÐQ<ˆ£*éš ³”YuºuPûu½ÉòÎ p?´r*qÒé2¢D•"/JíöÃÈÒÐÒë>ɨ°z{œ½?—U£`2Àï™FQÛ¸¬SuŸSú¹—}GÓuE¶tÚ ÿ‰&àèöè&×=Wò}I[?@‚ö7ú™ÎۥດÂ'‰?>šm êÅŠ¼ô´š_ôHTì¡‘}9à Â?sË–1QNCO<¥þV«ú‘dÕÜ}&ðE5(dŸOÁå‚ç.ú¤Z#"{d”SÄü9ÎVº–aƒNÔ÷Å6½ÖÈyäƤÿLà"r ›ðÅlÚs=סû`NMûft‘ýºqî#¡òTß,Íá?‚…ˆ26…MšHó6úYò|¥wZ4Þµˆº=+Ú™ ’ÈFÆyÔW2S¿žBÖï¾³ó/¹þF–×åüØÏé¯̇,6K‹¿Æ0ˆ³Õ¾¹ ±ŸÞÔâÿ endstream endobj 416 0 obj << /Type /ObjStm /N 100 /First 912 /Length 2450 /Filter /FlateDecode >> stream xÚ½[M·½Ï¯à1ñÃ"«Š$ °-( ‚¥ClAE$‚]cw8ÿ>ïõÐÖk½2[€°Ý3Ó]ýºX¯ª¨ÒzH¡ô¤8ŽrsÐTq,Á´à¨Á¯³Ð„×yè–q¬AD”Þ‚äl‡Ò;% n‡HÅïš$ˆÅIR+*Azj8Ñ“ò ¿áÄC.r~zVå5-dkrP)ÄV‚ îªÆ“„<]ß´šp1 5üðÚ YZHü´Ý•ñwe>8CrÆóÄpMæÏg8,süÉ´â 4ãº]i¸^ùM&|’‚4N$Xié %3(L éИBV¿±` ˓᥇^pÒ‚>§ôàê¸KSp£2¡,¯E@‡¡2±<5ñéxpåÅj®¯ªòéZC5¾;ZÐjã#,…Úù“ÐR¯Ê–Wq^rLC3¬Œes®—yhµâ¡ÐZëB%µÐ_Ðzè²-J ½Pm°†Ž¯ê´ª×KèÎGT  _²7€Ó¢-ÀaRI”`S)7^£J\JÅ« ´ÆUY%ïXÇê´F¾U-Ž_ŸÞÞ…WÍ"_nsÛ<.&º¬Z”f¸ì‹ðäI8¾Ç¿\¿¼ǧáO·¸ñÝõUÔXÿ>ÿü€ëpdà€Šj¤—Rb.m= ɱ$Æ&‹ôÊ’%"ˆLpôå8ro‘. C‰´h`Š%O`HZ£y¤cÂ87¹×X|¦‘õ@*ì"Q!+ƒ>¾W™áÈëqxŽÕHL ¬÷f8Êz–à'øŒ.‰Úû ˆ®RZ¤ß6‰Ž —µGÓ©Bl=Žì…ÀBøs©ÑÚT¾‡ <Â0¿œ“-‚ÕÌp¬¨9åX+ôá-#.ªS…¬©Èf±"ÿóØa±9I¬ÓÐ.ëcªÔMµ#µ0£·«· ¼0¨V‰ \ !& ÷˜A\Äkìþ«8ÞþçÍw§›¸Þ_˜h;y¼y, ~b[¿ÙA Ö〣$pÛŒÌë ¥¢ßO`¬ë’qƒk‘ÁO¥Hìm¦Ž²Ü6zÈý›“°šÿDp¨m׃¨}Kö¨bëfî·~ýøõ4¼R¡à¯ÃñŸß|‹reE…ïåpõþ‡^ÿæuÿÒýkž]_ÝmO}†"§€ëoW?#ÝG9qþÀŠ5?à®ãó›ë·/Nx›p|þôY8¾<ýt^ßWÐó7ÿ>Ž_Aøéêî¥Ã&‹j¸½~óöt»ÛWÿ8}÷îÍ—×?…MqŽ’”Êxþæ÷V>Ûu›ÎoñTV—ÄÂâò|lã8¾Ïieó8–qÔq´qôqòò—‡¼2ä•!¯ yeÈ+C^òÊW†¼2ä•!O‡<òtÈÓ!O‡<òtÈÓ!O‡<òlȳ!φ<òlȳ!φ<òlȳ!χ¤[f¯ ouP¥µhŠ ëC:Ö$É6¬¶³ßžñ”>ÓÇú°n‰½‚ŽÔÒP1ÃNÅ¡Ÿ™>ÖÓmHñx>› Æ6~gKÃ.zíú ¦@S™ä赜N€ˆøåXÚW:íÏÊ@Ží,†  6ã=±¹¨‹)8?X§_`§œ9(E/Òº°ˆ¢ ƒçNJÛ¸ dðr$EN\¿*¨™Ñ85¡8Œ©Êe}¬¤Èe‘éà ŽC ÀùemäKß­‡ƒ€š2`AK&3 ;èD”Ë’AÀŒ“TäÔ§YŸZ ˜h.l:ÚÖ-~£SèzC…‡ÆRP1TqQ¤”IøØA¦q°#Ã2ž.Rö°Ô„Ïùšâ3w :”Iå ;ÌqÀÁØ€r!Î zÇ:Õ9@ “-’}!0T­iª‘9`aÛx¾Ûê¶w…öT#¶Üe²jt/[›Ü+G]4ÚËýGYï¹9#Ó³!Ò¹ñ¤pn1I1;̵P»ù™#ëÖ&ïÑmQwéÓwt0 T#¡¢K2ñC£)w[K±g=Gx*d}§ž±4Yßce+ú ª‡vÙ>Ö÷`Þ‘²Ÿá°âH4õrÑ€ºbAr=÷\Hcã’ÄYÚ È£œz^˜R‘丗ƒãµ©FÖ‡v¡#¦²baæ°œ:²>´"$§Jé\R$Ë3 ëC;x)7+0Å8Bj1ë»…ÀR 3?TÝCã€mRÁü¢¿Ï¹•ë|¾õ‰fWõáìª~ôìÊÇlÆÇìe V³—:f/uÌrj^9ƒùyþ˜ê¹×º†´•3˜Ö'¡µ-·VÛ"=Ø27/:™ÀÅÍܪ82œ%v ÚÐ\¶Ø¾ÇDʹƒÛVÁà9‘™Õv}‰J©Ä6¢™À.Œ$¥©BvI1ãq(7Üj‹s뉪 ó¢iE+ÍÜUr1¸¯*¿ŒhõQí~û0¼­ˆhýaD«Šh¾W{T¤þãèÛÃxÜ~_<Öö ·gÛÒ8[hˆÜ·ŸQsrã· ÂâüXZþ„‘ek46¬R4¶|ÓÖ$i@—ë£" WºéïÛsrïº_Ùsò‘×X•éô2-(Xà®s¼çXk=?°Æže¼J—OìK½=DïëK}ì3é¶Ò—„m¡zž^Yjç°Û´O.{ÓÒl®HrXCAêüß8~NO&ãÔ ÿçƒÿòlÇù endstream endobj 513 0 obj << /Length 1550 /Filter /FlateDecode >> stream xÚÍYK“Ó8¾çW¸¸TaE’-?8l,°U[Ë2à 8(¶âˆqlãìì¯ßÖÃŽÌd&d†ÚJ¥¶û¡V÷§n v2;Ì^^Ζo¼À‰QÐÀ¹\;!uB?B~ì9—©ói~ÑÕ2á-_¸4ŒæQ›ÑLÅÂ%xþÌ>ˆ\ðF˜‰‡("‹/—ïf¯/gßf”a‡á> qè$ÛÙ§/ØIþÎÁÈ‹#ç‡þjëøAÏܹ˜ý=ÃÖPŒ؇ <õu@œ^?ì–DŠ£ýšFØ Íš^‰J©()md¯ã‘/°ãRä2ÃöfAؼTëgxðËÓcóÆÐ’r[Éœ·², áºìž.ÀEynæ…©µaë2ÏËeó²È )—«š×Ê6=åÅŽGZíàz`ù® yYmEÑšÁSQ[NY4-Ïs‘>Ÿ¬²:°¸¶Â%!Š=»ß ¼Jxõl0¥Jj±›my&;ýæ»7×|›+5Úgb/¬·-˼_km?«Å·NÖ÷³œ[~¥|mdIbŸ1Ãý¦%9/2 3­®27)‹ÏÓìvÓ'Û¾îú½\ Þvµh¬xÞ”v”žèﯼhš²Ø¹¦»I&J9ÚŽ¼ã ‘Ý|£¼$mß;Iö’~X·GPà[Ë>®Ï»¢í–¯ÄJòâ>©Þ?e!·<ïý ~ÊýõP"Ïa ÇÇ!ìÙ¡Ž3EGe`Çc+8ꦙ˜vHi‰“Œµ(ºz(#+·ÎúFÁûÑ€ÇP'_¾…+F?C‹;¼jÝL@‚xÈi3±ééMgnºÊö)⻡¬:™§®h@ ÉÇbxe¾"P>Ïׇ*d1 i<„¬Jv»tàׄA‹M¬µ´v(¤ “ñîÛAžjtƒx ;šGÔMÎ=bÌ÷‰¢Óãã J•„$¥“ž$ l´†ˆ1›5œ [u4¥§dŽ¯žÌ?/s àüˆ÷ŒÏÀôø¬ÔÙ©§Žü0¹ã³…ý¡ð?ÌB´d'ô×$|¦Œ,²‰bCÂf~K¾õ{Hš×Ÿzn}ˆM(æ›ìQöi~r0戠QðpyŽ}D Gµ‡^ÿÓÖ¼/‡la!«–¯rÑ,‹µòÛ÷}-× Uˆdµ®/OÁ0‹B%|>@Ýþðï@N…P»Ÿ#5“£Õ~|ð /ûêë(<@¢®eÞŠÚýÖ‰NLbuÞ/÷-[^f·„7 λ#‹5p䲸šJé©ø¼ :}»£DàãIx[ýD³µ§ôÍž§ª§Øž/eÁkݨ^›Þ´â‰*l¯¸ê2ýf¯ <±ŽušX—аĽ úg»Ì„g{}ã_o/ޘі6À¿¾…2÷ï1¿PŠu ìô%G¤Zl­¯±¬ÛhÜ1 cª¡Ë~ßnxÛ·<ʃ?ÔüzhǶ ÖBS,ËfõØ6O_ ¾û‚“Û§{ã"ÂsÛZuå“í)H=ƒ.ç ÅŠ0}äÖb¤å±Z êaÈ˸ßü´4à]««Ð°UÙȶ¬¯mõQñç¥lÖËâd–FÒƸÚU)lÿ„!Úg¸…uɽçAÛÉyN !ÀÞ/B¶É58 ƒáë¾]¹…–·öZÊ2êñ;¨g¥˜ÞiÙ³I\v6q˵½|‚Ý´pdà©Ç+Òì·½´2wTu3܉ÉárêИ—<¹ªÊºmÐ-#$xa9ë²´Óò $B,8ï†!¤ð}üØmÒNË£uIÇ(ðm`ˆdc³ïI*Vf´iÛêùr©(Õ{„ ¶X¦v»Ô'_u츫~×úFBOÌð·½®„ÄH<¥h“%$ý²)»: ÊeÓ¢t9HÕ{@ÜÀÔÄwUz¬è™ÛÞ²¶³@çä°9ÞP•4ñOaŽ}N®á™psï[øÿLàƒEÄYf{¡fE~ÌúJá÷ 8½ÿ{EàWJƒ´ëÍ%ùºÀoÿ]Zæø endstream endobj 522 0 obj << /Length 766 /Filter /FlateDecode >> stream xÚ½V[oÓ0~ϯðc"QÇv|ËÞu7M¶ÂË4¡Ð¸] MŠ“2öï9Ž­]GÙ´ U•O|ùÎ9ß9Ÿ‚戠£èÝ$J3‰rœK&Ñd†2%±à)®1Ï34)Ñe|±¶Õ´èŠdÄ”Ž?·Æzëh]•&Q¿ñçfaŠÖø‡ 3L“«Éi4žD?#  ¢H1çX…¦ËèòŠ æOÁY®ÑM¿k‰¸Ô0.ÐEô)"!Z‚)I0“™Û-)²°°3y~Ÿ¥8‚¹Äœ[J0É”ÏéД-úðîð{ß³ÿÎVàRcI3$sŽy–ï ^A~JÜ%°…¡)ƒáLïÅ .x-Eî¡yBÛÙð’cBé¦7ÏU†s¥®5hö(ð=ÛcÏ©dHC¯H(•Z`A¥e=KF’¸ªÛ®X,üC;4£ú1w{I<ÃTëç3¶[7@ Ï*Ûkõ-Q¦=IçÇã³ô½©»[Íçò 4b`EèÖ„Š¸q²TV·ÇugìÊV½èàù¬ª×¿½©üPÔ¥7‚Ó͵î:ŸyËšUÓV]coý󴨽ñ-l]·¦Ä!ô'é…r,rõ"½ˆpµ¿úÀô%‚Ùp³)˜üJŠ!KÊz»^>¢³2‹‘ W)íš®®\äûN½ŽÎžÏôNÁåú?) DÂå 4!(&ƒÒÞ–N4¿æ405¥+xΊ®jê  §¨û’PJãÂVͺMFŠÑ|ÔÏÌÝë0¬ÎœX»«QUÏÂm–Þ::™x£W¨ÛѸaæÊXð1ooÛÎ,ƒ“Âo,‹ªîàoÊ°ÐøÜ0£Ž:÷¾ê ¾=Ÿ'ϾÇú[Ëç{Ýu«ö M­)—€‹!ŒºªgMk¦³f]—}Úâ¥:ž§+Û|7Ó®M‡&LoªU:|7|ý+éÃøð Ap(÷“?v?c‚ÃuWGŸ ¼;0¨„±'6 3Ì¥ ¨?/¶‚†`ÿ"Ã#ô endstream endobj 528 0 obj << /Length 212 /Filter /FlateDecode >> stream xÚ1OÃ0…wÿŠ7&qÏg×NÖ"¨è5SÕÁj ”hRñ÷11˜îîéîÝû¯ ¬ÅʋŽ¶hdcÙ¿À1œ©¥i4|‹]±½^ºCCY±«‹ç!^r·¾vm,+EÅMžbÃó %KUîýFÜyñ!TzFPÙÜHG‡“Øí mÒ7 ©›ŸÓÖ ÆÖ©öØŠGA?AçúËki$Û[ýÉjRNÅÕ~†¶”è—éloá}œ¡Y–•e.ÎÃú>ŒÝÛy¢œã%Ú/?¥Nö endstream endobj 532 0 obj << /Length 1495 /Filter /FlateDecode >> stream xÚ½XKsÛF ¾ëWðVj&dø¦¶“vÆMäÖiâ8±ÒÒL‡)i§©ðaGÿ¾ÀK‘´j×Ê´-bñø€VtŒµá?O^¿L\XÃ5bψ]ÇýÈXn'Ÿ>;F ü׆c wJjkÑ Öܸž¼Ÿü´˜‹^ˆ–7‹” Ý™±šë¶’ˤI¾›†¡YƒŽÐ1—åv›)=ä²Èˆ*w,‹ú{£NÃóó(èq Ëmá{¤ÝÚŒ„y-@Ñum2æ¯d½Ë“=YLh¹©d¶"²­“µvgê†æ-þdխ̦^hÞM£Ð´òÏêl¢—>{ùÛ‰^2^͆]boj€‰}d·5Ê'ø¶¤TB$YÀ!‘»¤ÙüøP‘-â`Áº û8‚Rg¾øÃq¼u[%Mròì×O…u13«›£ÎœàÀí“Й„­½š':+’›<ãœoËj˜ô›²–ÍþxÚû‡«l›]ÛØSËwQ`·ËyӶ͹ËYk#·ÚÔª¬¶yZÑWÿMa}h.Éën™ì:XàBNý®§lË”©*KRY¬û%§ã¯ÊíXÕÉ5)ZMV­’eöÔÐÏV°ý tKÑ b )0÷eKÄ2)H*+Æ;“ܘB•€+$¶Lªt¤âÊ6g~.ÿBËÓ± k²Nb@-RåbEì]²¤mMM „KÔóáHÈztZ™çˆŽjø=šj?ì(lº×$o<Ù5­.émÖlÊT÷}kLdŽ‡î„D[ªXî'ÛíYédúáEšÝJÈõ燒mÁýB„âX¥ûU:¬W/Ï®ˆÂ²FüœÐ¼X«(iMÕ¤B“¼¹¦uWÑ@“i–‡óG•ðâÚ ÜFa»ýn'b;8î8ÞèÚ‘Z¨Î–œqP[®F^ÝŸÀ¤s©*œ°='‚¦ ‡ë «ô”ü&+ ë6kŽ$9 í8ôŸšäÀ±gÁÈß¹júxÜC½úž§ð@æáì¿­UÃWgç^M…gžMÇ|ùë|Á; zýFíW¨’Ð T•à;¬|ׯäc• ¿Æ!³ô<ú‚’ïsY7$Q²¦ƒÞJm_q…ŒÏ.ªƒÁÜ* ×л“¼O¶œKYS.¿<Þ”¿´Y f#Œ¥ß0“z×ÙÕ(œËó÷ûÇùÇ91Ø&’¯xõŽÏð·ú¶ª zt4öPªGi%s¸¥l3»ja|>¦ß±N¥ºz3Æ«¦µëÿ@Óü‚Fµª Z¸(ú®SZËu‘à!ªŸaÃðÌ»\n´”j @Ýð¾¼LCt§\ÄPSr ±sS…<òE#!,Ù ¿þ¡÷uI†ÕÚA4C/zßáp}ú¿ä;è¾ë”Ž :è•A/zàtÐûx›€rþºÌ¡µ©ž¢.Ÿ¹ºw²ªJ‰¬§0°«¯ÙíÕ(#vúH:ÚdNÈXþxÆRYA{+«ýéÉò݃ÚT ,¤U²ð¥JrT²ÃûtjšíÐ$ˆ‘—ké<¤+¾Ì"šÍÂLr¼:ïidž¯N˜¡{}3S×l,0bþSBÁzuœ10šäÑ> stream xÚ¥ÛnÛFöÝ_ÁG (rx/ì<´i‚E›M\,IFâP"Lq¸¼ØëE?~Ï™3CQ-GZ0‡Ã3ç~yÖÖò¬7?Ýß¼yÄVæf1‹­ûÂJ˜•„©fuŸ[_ìÏC[nxÏWKRû¯N´´ú0”¹X9¾gÿ@ŸD%x'è%p™ë¯¾ÝÿvóËýÍ¿o| æY>!ÝÄK¬ÍþæË7ÏÊaÿ7Ësƒ,µžÔÞ ãž•õùæ7žfÔ›2‡3†}Ïõ‚„vÞ)ºæˆ—M Yèf@Ýñ}7‹":ñ‡l÷¼ªžWNFvYÐóY¸ív¨iç  |“õ×Òj#ëNVôÄ©]ö´û° Ñt/€¹Ù M)rwåDYdÿkåÃ)â yMPµÔH‡NhnõF!5VÙïÀD þHÊfhÙ‰ÍÅ6¯s\„öÓNÔ¸ÒãbSIeHø Øh𤋮s¹b°XÅ‘­‘Lœ@º^¢”x tV—õ¤ XhÿZÌ(•"Ü1ÞÑ3|/5ÄW/ò†pѧ‘2ó\HÙô¥¬áŒ¯¼ÒWúaq‚;ZqµkL°±æ›‡m+¥0 bOeUiXA‡ùºÒ§{IOeµaðŽöÅeöÞ•ÙøO´­J¯h[íòžýÌ÷Õhn-¼vwt‘‰u?\G€¼?.¨>ųóI¶$m‹ÿ»õÀ±þaxY:Z’½,š,,Qr0PÚ)&?vÓ$10˜ª%`› RƒãÇ©‡Ñ±6Þ£fU‚2ö²Õú+ë €6êiM¡xP´V`'9¿Ë¼‹VÂÿ0­¢ádóÓ‡ë‹:8Úa:ú[YÏÌÉxÌnZ¹]G»ä¡¸âEOK~\ö%¯ÊÿrJGN‡öŸ“lÖÍP°r•ù(§ „y¡XxÐ_†£õ!H¾”©Xæzþ˜c:±¡G²8Pl<¶ZÊ*sY”+çj?v°ËhŒúnzçîVÁ½b5pfèÛ¬¡‚©Õ‚À&ê é9Ù2–ÀKFÐêÍ- p#™ š™)F¦ÔÐ ¦Œ`ÖˆÂï1eÀØ©)€2e0ú X-MTãr¤œ¹}ÿ¿”ä4eŽÙòõ®éÕœºÜ2µe¹„ic2Œ‰»¿¾Ó_%}T’@3£zp癹dÙX)=6ÖOË!­,U~¨kÁiãÅÈȆ†Ú8U7ljÄ ’Ú$Ø,0ýv3YFDF½7<Ÿ@7½Ðêgà?ñl 3#GÓ¤AÖÉØ4D:us±× Ô…^€‘‒eÛ9Œ1Õ¥£ç/ÿ)5ƒOÔ ¸*°ÿâe5˜>å Q›:½Yo`† 9mT’ç£È]¹­9Lâªb£‹›“‹^GÞ…r¾›VDZ¨Ði p ¹Š¿aß8àrE¹½˜38:¯õK©µi4{èiΟ½!åìXj_Ö\·zÇ)â¼â5¬‡²Êìg¯°OSñç‹ëƒv´¬òåp:Æ{4>™38&n~hÌÄo¸­¹°—Ý¥RþHfíX74l{cY P¡$³#9Z*šYuWóÿ ža¼Ê»…ª‘fneðN5´›îñïÛ<ñöl_ëÄ¡›DËÚÆ7õx Ž÷L£/ðxìHÈviÖ9gœøû®Íì–‹«ÄÛ€×zæ[°ÒÛ»ÛG^ â‚Î9žô`,T—ê |{Ä{4ÄÅ:Lp†*†Š¾é‹"6¿ зA½æ]¹9ƒ¼á-ßCbU"Ö¥96¥ùô”â! ÇKIˆïÅ‹DuÅ9Íi›¯·§É*Ø`B¿’[3*µöeûü£V/þá­þ`j>º3ÆIÞ,?Ha|ËÎÞ'I4ÞáH}fù,rãôìÝ3@®—1·ðx£ðvº3!ƒó†?%ƒûaç©AÜ «XÄ<¿ê>¾òfÈ)¶e­Æ_È8óOG/ftñÒnAϼ,0ª è¿Ìi=¥hÀ²>š½ñþתü«Í±üÃüìÛõo*øiDZ”RFМЇJÊFSi`O¤gl“^¾J>hŒn6jÓwrÓDu¨ çúûZ˜úzù‘ºç¿þD¡Ëâïþñgñש¹¾¯3z ”áSfÿ¼ãMo~š @y1 ?OococÿlÈ*3>ÿˆ`Þ endstream endobj 572 0 obj << /Length 1779 /Filter /FlateDecode >> stream xÚ½XYoÛ8~÷¯Ð£ D,©Ó*ÒíÆ Rt»YÇA t‹B‘ä˜X]•¨ûëwxÉ’¢8QôŤh3ßÌ|œ!6n lœÍÞ¯g¯NßQèÛ¾±ÞNà#ÏõŒÀ] 7tŒub|5/ۚƋæ–,Ì«&­eﬥI:·6äÀ*ÍÒ¨I凃lDæßÖfËõìÇŒÀ‰Ø F`Ãæ. p`Äùìë7l$0þÁÀÈ Ƙ•®¿€63.gÏ°’÷¥öÝžÔ|O‚v)°eµ½·š2þ7e\˜o÷çp~›‰ÙoŽ74Kß QõKØ[`y6Z`Û°A¡çÉuWBS;4ÿÁØÎT?jd˶j |q¹ ç`3. V—™æ’ÎÇ”¡¹å`ÇüëvN<3­k@¸·£T…ô$ƒPúZ)Jåjî@ Lj<=µªK~Æ-œÈh±ï$ßFØ%zµ8.ó<*’‰£|‚¯C¸IcFKµ{¹œbXÎ"D ‡ Áx¸.7m©¥VÚ¡‘¥®`Ù. Á·, Ðq´?TqTY×íf“ÖVCÿK'œ‚àya°ó >o¿W,lä‡C¹/ÁᄬÒ #Ž=¡yÿ¯‹?Þ]ÈÞõÜÆf»™Ûž¹á%´õ0–]K66q!0ß à?rEÊò¨šÐÞ ÐÂî¬ûõÍq’ÞÒ8}ûm/¶BâXÑ5ÇvL@µµúàêó¶Ê0£91µÏóa×lZÜÈŸ–ë?92bU!ÛÓ:Mß_ž¨ÁZ¶iÑÞCÈxPçjû¢”-P“ÍÝ;Nåþ´‘ãM[UMà,Ç%Ò|<£ ë êövh„§â¡¢›ºÌGUðJ»wN´Í|ˆòLýÕȶmÒä ×ÞÔ¸ßaR᳧ßWçŸÎäGílÈ¿•½9‰iJ)Û¾EÄêðéc?`X=<Íw4S _§¿d+ÎÚ†…ÐdŠ@Hˆ<ÏÖ€Ód?{„.òáª}†>x«óåÇùÉ/Є=T“dèäᎠù´ýÚì#ÿpe„í©¿¾×e[$ð{M‹£Á¢ï`l§ä.rw NZPNÐJ'ô6­™U•5Û«»Â`1«¶ üŒó †¶»8ý¬ G—×½Â+/“ƒn¹$šâÇC ßßi%Yàc‚*áS$@žŠ{ùg)¯1ùO$ÇNæ.6ßñmü¨NMØMÈMDÓÛ4USç±âXV§Q.ÿSNFzƒ|ÏBjh E™ëÙCíßc¨ Âi•˜žQ©¾òXÛvzüÚ…ž«Èo½ÕÄ^V;FÊ£‡!!²0>¥Í­4Ý2šk­’.‘ØA3œÿˆ7!?{UÖ}¸šƒ‡¨ŠXo÷¹M·ò‰«c× ‚££‹OúPIøRzùñîâü5òŠJ¾ûm:¬çŽgB}qöE™KH ¸˜lÃw‹âƒâV[p/>wõÿL3uí÷H¬ïwœz;NãTµsÏÇê#v¹:íçò;Ê_I¤ƒ”‡Ä=K‹†vÀ×i\ÖÊÿ7eGì…ÄokÔ !~eѪùiWðÕ•¦Öj¿£p·MXu[ÁHgD…5X¬ô@ŽÆÈö^CùUƒdWg²l'.r\°{_Ugv UZP&kñõÜT¶W_`;V ¨÷-bQrC¹Ç˜Ø@ª¡=¾,²­T0·Ü?"šíâ…n¦²µmÔhÔpÉ ŽÔ©Ûvìê§"­N ÔÑs/V}ÀG'¥æâÔIIÔçð}i¤.;¯ËªŸ×d*µd*»u…CL˪–é‹\˜•õÃÜ÷̽~;ÒËj_JX]àvaØJWàC=+I?Þ(S*®Ò-Ûè="6eC}ƒÅ%PZ¦o/a·‰gŠ€ g÷ 0eÓ©W„ÂY©Eûcªbˆ†rW“iºJmz¤f¸Oΰ:- Qž°N½ä“Ý‹Òjy¶üòL†…‘o^”>óI:~ Ÿ jˆ¶K$ ÿP¶2´e†#]fý»-Õ.âÑ¡¿›r>¤\a·¬×Q¡xCø6Œ—qßÖŒ¤²J Í‘ì/'&©”~ …¯¥Ó5ç²ZÕ^)Â`¬:à‚ä5ýÐÃ^FÅ‹€ˆ]GŽâèK{Jf‡ %“›2y€ýúŸ4kwô<`·¡ô*öëÒCS’°Ã0Èw´æ}ŸAÖKG5y…Ѷ ç¥ä`´:œ¬¸„j,ºyqövB›*Ói÷±ÌÀeÆPù¯û†"²=nåŸ~Ç~üÚ[¸6"Dݸ‚|ÆVxêæ†íläú]bŽ¥ûÊÃ’ endstream endobj 592 0 obj << /Length 216 /Filter /FlateDecode >> stream xÚK‹1„ïù}ÌÀNì\Ò´¼VeÈrŽô#¿¡¾i‘L0žíÜŠ,ù#<>Cà)\1ƒö ÙîÊ诙´ÜW (]D­aM~>‹Žú/kª˜ÐoG½dU±' •c,oÑH:?ùó0’J–åZ:ïšÆ·e2¿ªö‰ú}ª®í°cË}q%P¬ endstream endobj 608 0 obj << /Length 1040 /Filter /FlateDecode >> stream xÚÍWKsÛ6¾ëWàVrÆDÁää¦JšL;q%º;†¢%¶©òQÇÿ¾ .(‹´£‰=õL.ìãÛo]ˆ‘5aäýŒ¹ñŸ‡‘N"A"Ψ 5Év³«ÏŒ¬`ý#a4Ž5¹í¥vDjã–,gÌ~Nf¯ÞxLc-4InˆŒ95Š Ê™"ÉŠ\yo=¿Hæ ÿsò±ç’†R +QÅ"ˆÆœ£ô»O—½èlžŒÁiÑ(”OwäMrM¹"š‡T¢³ååâÃÛs?f^bÎý@DÆ[ø‚y—¿Í—=F9ǨÐ!ü†š“¨{°¸x?#A(¥õèFÚ´è¶yƒ†?”mmmW«.k‹ªDû“Œ ã4~%Õ2šÆÆæ>þÈ€ßÇê”Ç1Ài,NYaf¨æ˜Eyœâ(¢¡! ¤4.ÁUÙæeÛŒÂòã#5 ^‚^À#‡NïZ5¦€ f,¢H¯4©ž..¬u ÷Þº¡˜úáŠ!áR&| åHi@jGu@ªÿ¤ýl@zþÝ Ô ¸—uŒµUVmŸ íeùZV]퇑—å˜Þ´\ád•7mQ¦Ïbóe!_øî{ݺyÍkQìAäøÉ/E:Ï~@–í•G"«½…7.E£Jªô8ýŒR8*ÆV=üYÅx@À¢¡ÙÚuhF‚˘†B‘:'7cŸŠÆF=PB¨ët°ñ×^ÀšêõÐõŠ5µ®¶U2”‘·ß¦wv¦½þõ¹òòú¿Š=‘iÙ¢L]Y®ûÇeWYÚ¦Ô4³EwUÓ¢@•eiÓ§¥ßØçÕ~°‘ÖnÒ5E¹ÆýܺÿZرÆÍÚ–ô¼mœ‡dã”zj bt̺&·+–½}ìâ‚Û†-È“1îœMm¿EåÍwyísã­{ÖT²©ótÒåÀ×ÙÓí‡LŸ°ß»¿¨«‰# §/°oKa–_3&êü'_)¯yN˜Òûsákûú™EÒ9:»õ9Û;\k+\,ʦM·[\¬]Ï…iá"€’–ÕÅ—!E9üÎûîòÐ_íã»î÷{Z¦ë|—Ûc)"éÝígŸŠòï]Ú´ÀïèBÑ=FN®ýR÷/5é­ª¬»·®IQº} ÜN¾T]‹êÍáZ½£½Må K^/ØÓ#äxœY¿º¦í»À#‡8³ÇÁ•µv“ïèAȾ¡B÷„À}Ëÿ«\ËàÂÁ%r§º9XÂÉMµÝ"@8¯-èDHÛúñ«- ¤}'8à „„Û²E¸ŠŒèƒ‘EÃükºÛ ¸Ã™âpˆéõ·Kº}KxŠŸ~ŸüãeÚÔux(s(çS—ÿü} endstream endobj 510 0 obj << /Type /ObjStm /N 100 /First 870 /Length 1641 /Filter /FlateDecode >> stream xÚ½Y]o[7 }÷¯Ðcû¢+‰"%A´E¶P4°-7¹M½¦v`;èöïw(;Kb;Õ­× h*^ûˆ¤ø­ëXŠqÆñ¿˜$†]0ÞëJÆ3ceã‹®béšLHºfC^×bˆy‹R˜)öÑpIXÙé*F™àLò„ÇdëšM*ºz“ kð¦ø8b_Œw¡àè"‡"+8ý€Äã( D†plôœ 5ÎYLD #†Ÿ‡ÈÆg§ß€MŽÓù¬» ›JPüŠ(‘¡¸žŠ ˆ .Cf„">øãÓàUð AÕ‰DT‚AT°1(ªî>Ñ9à >j\Ž!*æ¥óˆ|RÉø|²“Á'ëù|Šž¡aa%°½À,Î#%<u-NBÕ·Bê;±Dê5aCÕ½7VÿÂDT,p4i$<]]Ìàa6Nà¬`8–De%0”$# Jº‚)év¨KI·'0Ì*+aÆÎ`X4``#HPª–¢!6UVŽ R‚ÕW,ƒ¨XQ±ÉÄP±De\L$'BÁÅ›Õðº¨v䂯¸ÈH`ü(¬_AT®`ˆ(øžÕžˆ¹UDœ–ÕQχ bõ¨@Q׫—D¦”2:8u¯ÌIÄfgÞšî×ß~G þ“ÍðÉôúòòtôüùn\À?×ÄÄ⬠ê[8òÎBÙ,ä`ý\Œ–pæ&ÎaÚÎC®FgÇÁ B¬‰ Á&„Å=ÜÑlº4¦;Bľî8Bjb}õ ‡®´¤ù›Ä…‹õüº7óÙÙq¿4'¦{óêÈtïú¿–æ_Qïþ¾êñÅø¢u/!¶Ÿ.Iº}Ô½í³ëùY¿¨å¯~ôs>¿˜ýeNT¸ ˜¦N!f<Ç^„e©¸Ûk½T÷q»ƒjƒ¼´>ú&Ž¢Xï¨sbK,MœÏÅJ¡=¼vë¨}}–o‚û&ßt‡Óé ¬NŒ61ÕeCdý~Ô½˜ÍÏûyååN»»×ÝK< Mªô3¨¼uNÃM͆’æÅÆÚ+ábVÉÇ×ï—`Ùý4™~ꪀîðl9™M»ãî—·¯õïÉÇåòjñ¬ëæýùçÉ´·³«~:™~˜-ú³³ëéùXñv6¿è®æ³?!zÑ-®ç“³ñrÜ}™|š@Îêé×ÓÅr|yY7<Å¡îø0øaqx÷@n`D²uLMº-TÅͽœ¾D{ÇMÞŽÙ7§Ã€F±ó\ûjOÛQOâžcÞÔžF ˆ„ f"¥ d9µE"›¬äØÆ ÙTÚr#‘-Œ›8­k«Gˆg:š8 6äÒÄ…‚Noâb¶2ç³Õ¯…ÃTmsHmúHàxÍgÙ£=ܶîͦ~Ûî÷M!ÞN!þ¶ºÓ8â×Ǻê›Zöw÷_núH±zéÈÞê ¯3`:Ã"l¸vX-wlºfïf&‚ÖP›B²þ©¹_èy`zófwÖI†ÉJú6Ž£ÕúßÄaÜ9slàpmDŠ·a„PÎm•d]l—% Ú¹£dweÐ&Ì%K¹íŒF‰ØÆÅdõ^ÔÄa$I¾mŸ,Ôöš¼»¢màÑ[°‡þÝähjü.• mW‚´w3M³-md[F'Jm²(²´q¸¿*M܃ٛvôñ؆!yyÇ5oQÉ$ç6ŽQùÈÁÙ2À,T0¡KÛ,$«m„25q!2Æ öyƒgËäú„ù†Úáâ!·¸8è4°~­)?t!ß7/Ëv^–½ó²øÿwD·uÁ'ûÎeep}ÁµZe½¦õš×ëj‘µåeí}³µZi½®øé›Öï8·x‡ò^ô‚dõ ›OÚ#²=ÛüWç–xnùzà:`ÿÔ$ž¡—'(† ¹ðnE®ßßÑåQ´¶‚bæ¹XAO¸-°¢Lxe˜j¨`©¾HEåæA¦¡GІŠÍ¸˜ÔÁ7Õ²/CT‰ J(6¥l<®Îç:@’¤ ?‚6^ 8#•0_mtb¥ QFT¦ýËc* úû"4ý•e•?”ÙR)ßö"ëY×}ùòÅöŸûùÅdz±ü8ïÇË…öËîéþæhõGŠ ìãwÕðj>³g³Ï7JþgÃwœ endstream endobj 630 0 obj << /Length 912 /Filter /FlateDecode >> stream xÚ•UK“œ6¾ó+t[¨2²€À·|d¤ÿ;¨¬JröQÉŠþ{ò>ú-bèçH”’æ>BÈÌeÊÊ‚2Æ]¦—·'?O.žràÁ¨(¤ËZp²@‚8ï.Ô9§Už‹À=˸,‘ûµí¦ÑÓØpÀ–j§#©È cŽÞ$<'§PÎâaZ ZÝØNË }2ïXŒnÐú””l«ã¿,YnÐ^ÁâT°Ò!Wüo$uí¼sð€Ü/3ZT@}Ï'€RÅP濘åœJ¡¶Ô…W ’ IR®h%ļþª‡¹7¯.í¾´ŠsßtQVÐô*´J`«°ÕóÙŠS¥f¾ šØc·¢eœÀXo[2›¤Í ´î§¾IÛ&S×&È<ëņ^¬Wµ…¡¿wz®GAJZA“_—D°x²S=õÿc~H´(â¿~ÏöñìÌiqLŠf 4~®ÝèíÉOx­éûWvÎÇ®>¢9/æ³è­§±6˸Ò$•yÿ‘pWõu¨Z§ÉŸqØyoìÙ˜°ÐN§% 2Övã&R±­gŒø“å Ž$ íµ+6ĤvÑm"rc¢†XÝ”¬ŠOÍì,ÓÕƒKU©XNŒªŒ»ªd¹WV k+.¶þ ‚ó“îûô]\£×ö&ì߉QºÁ*ŽÖ8hgômú…2¯ Ë㣵s€ÜÚ ²íCG>L±ƒ=Öý©1ë3-¬kØ‹²Œ×áÞ,P£]’’£žË4 û‹ Ìís|‡A2¾Mnç œx0Ö)­A6 ‘žçÞ‘Ç+Ö{ýèoy0÷\K†òÁ–]„º n[ô?úã¨Ý‰øâT7¡î7éïæYÊøÜÙ#ZØM0ºÑ5¹ÿœúé†Ái'‹}O!bÐx¤Vü\ŸJ ,Îõ¼4Î<ÓØ?n9làtmø·!:ŸœgMŸÈþÛ͹Ý×fžÁÍóÝïå7ô Þ4.°&‰Ìà¶RO÷ûOG=ÛíiÏ ‡…WOÿݩljÝ#ýhßW endstream endobj 605 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 312 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 38439 /Filter /FlateDecode >> stream xÚì]|Ç÷ñ„!¸;Å­PœB)E ¥¥@K¡ê‚»-Þ–"-/±K.»»û%—»œäüvÿ³»wÉi€–ʯÿ{Ÿ%ìíÎŽ¼™ùÎ{oæÍฑŒd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œô<„é½ý§³Bþ$Iû¥ê‰ò¦é¶O0Ý'j1 {ÎlèĦ û³ýÛù¬Ë4ÃyjÜÎÆ?œ®ÁÇšU£Á%Ýêë ŠŸ™´Ú ÖÖÊ^´š0 û+jå¯jš¹5”wìïi®-8.{9qÆþà[,ÿƒÀù›8pȲïmR¢œÂòd€ÓÍÒö°™®a`ÿ“êïówï™Á€ƒè«!“>M)[¸àÀm)êé°ÜP0‡¨tñƒ»‡5¯)ur/-Ø?îó´¶ à[‚áŠRôJ+ª>»jï=Ô‰]·$Š¿O:l:rÖò‰—ÀÄHn/û&–|!ŸG´sÛõz“óÄàZ“D…ÿMÕpð8£5nÿÒê=Í»1!Ýh>ß÷µ»ÇEC FW]{ÁòÒ7W ”Y”ˆB¾ýKc[V›IÐý¦ZÞåÃÌ€õI;ɧ‘µÞ-ÏÁ’æ.°ÇbØSõG£à»§¥ÄMü_ ï½–„¿ü´zÑÈ¿ß<’õÕZmÝvð_ÇU¼|(û5eÎè¤óöïà15å).Z—Ïd\^Î:ÏÀMúR›#¿km´Ñm¯èI‡NþJ8‘¥ÿõŽ š$&p&»¿·îötÜëÄSèý=U¦\PG›z$ ¼E5¿™]XΧÞ(œÎ{8ø4¿ÄÅæðƒ%\-R6NôG¾¡ëñ!æçb‰öùÖû£6F>/”KKÌáZ78~7MBe\ÚÒŒÒâhSnÇÓ s¦ð~ŒwÒ›†éç;šõ‰yZ$d³=b› Á°^;;io 8xŠŽ³‡ÁžÝq Ôsç›:laõVëá¹ú½—H=Ù9ëÜämÉêa¼?¸Ùé£v®Nˆ6µþI_ÖDcáؾ¼ößu‘ñîÔÍ°$¬oœÊb)¨|³"R`ЯmiqsƒiŒ¥ƒ + †Éç‚ÃG~Üçhñì^pjJÿ“ërÚšæd³½.åÄM’s€í4„+cNŒ¼Ø¬WÞÓ#?gõiJ\2i‘¹+*ðgö2ý¢)ÖQ¢>Ù+¤ÿ¢àyß8ÔÓf»Ã¶&žáf/@ƒ`ÑË’mÈϽOˆ4]úàS¢Ë<|ô|n|Ðf"@ÌCÜpKKÜÄ£üt:àŸÞÇÇÃí;ãCá™zfÎN=: µíù‚E³æí‰ AÅúê­bÀŠÜ{f¥­ývßÞ óOîé|‚ðË.²püæ{·.Eˆq‰„C¶©Цɗ†Æ\ŽBC«zòþyÓÁþÄø FÒÈÝÕ .íºßH½77¢¨–w>Ó†6#Ö1ž—gÒ€Û>7|`¸•”:ژ±hžÁOSoúÃاz!_ÖÌÚ4ÿ'€“h¬ŸùA¨ÕÊhR0˜?õþÉkÄàË–püC‡|„ ¦°Ë3GLD pÆЈ.ll˜5ö ôþõ6­”«Ð鶭ϙOZMòF-­TÏEhó¡>9üZ2Âìðùnö¯Ðý±X³y;¯½a³>±ígMbŒ©ÕR…~´Ù‘¬!=®ï¼gý¯<%ÚX9ÝÝp£Ë²*Ñv´![6àÜ~z“Û®'CV©jíEЦœ.A•x¾ Svu´é4è^ýåì¨ÃOÕë}ÇLÈg LNœÝ~³„ kQÃHöŸ8âª-þA4*ðRÛíïþؤNÄ{‹Åêñ0r^±¾C1u¤78Þ˜2ÌÂf¤\(k¸8)h ©+|XFf‡í4ÜÁ”½«²IF·´xŽóp·œ·ÿiÞëTÅ1?€D7¢ËTÛ_ÊÀEÉó¾¤ÐfsC­áò6ö£_Ž¿BEŠÙÃåÏó qS[mÂß#ð'[@r,š¸Ï§B÷Ylâvu7¼ßå‡_ ‡Ó|ž œ¢¹IÖŸ>fwY¨£-åÒÏhä¢åÊ{î`õX¬‰³†·ë¸iúµ£îì¶Q€D›óÉõééÔÕ@»êG¡Í­É'¬?(Ö*YCf:X“ ¸!ÐæFÆ?˜í«TÁnÞëõIÙ»v´°Ä»$™•¥º ùXGhsõŠMÃŽ¼}¡FK¶1ƒcXíñd3Ejò°!´AôàÈ£ù¢¨û•V»’h~’ØwÓI‰ß„R©cçç\© <Ï>úz¤¡AG‰¬úµ³n!´ßìV^/RÀ òGzÁ×¢zuÊ1eÝ‘h³ìç’Üœ6†4”ÖˆÛ+7åê’­Éñßó´¥\]´1±¼šžÙÎØÌ\¶B…6»ÒÛ¿•U˜ÁÑÛ*ÙÆô ê#c¬^cpµd\Rk'rÐã¦|”V“•ò­ 1,„jB*RôÆ»À*¹rf°}ìY2þ ¤ÝôŠB>Ž3w†<ž^´Â?¥BT¬÷˜èn~&[Êâ ¹„çŠ>GGÑ5zørêµeLŒÐfe#—›ÅÍ"®–Ì2!ï¯BDLÃ7_Qæ >mÖâð†2ÀãÃøȹíydß$•Ž·;áÛ+6{áÐ WGhq3B›8$ïȘVp8ŸKlk˜©—®›ðSUbc8ìÉÒî$^׃úv>ebrÌ/”J(´1‡^½/÷V]ÝíÎY Bhƒíprä9í6À).ós<¹mĸh8":®hœŒájhóáRïÞ—zõR^¶Âå¢ œÄWË4ÑÆŽuëy¹-ž^½¯æ¶*žC¶!Š,à´æ¦VGFU\˜æÐg'Ùú ¢‘Å¡˜/â#ˆNåÊñ†”.Ù‚eKáàÕrµoÀ HýÿËöGˆ,-YŸU·ykÓ¶ÆË•²Í)+»‹½ÛJÑóûE_¨e›>è rê(ºhƒòÜÎ^—lúÿNÊO¢qpÔ¼û•þý‰«w”ú©å{2”²-‰6¨ÊÙ4/0}ÀÑ@,è£Ë¦+3©{gžXv¼†l[/†6è{…H€P˯R¢‰6`zº·Z†­»‹ŸO¶AQ²xIqU±)Õ³-÷–’hs6W¡¬¹¯88¸4ââZsp%"U~â£MQX’4»:Õ¯™Ap¦&—ü¼q¨#\Qu*êí1"¼²j7Ðûsë¹²VU5Û¹B´*Ç×" ?6†„ m¬|zôöíÕKyÙ-Íðý ÑfÑx|×]••¸P©I!´éö¹òáÏ_à“W·‡ŸÚ?Aæg¥~H¥UñHù§UÚPO?].ÂÕ§´™‘ªâwì¹S®g"éÆ»·®DË“îúB§²í6® `Q––bY›”Ö¤*ÙÉ W¶ÝX¼½€—S`bÿ «.Û¼ &E  ¢ß÷Ý0-ãþYM Ñý÷ÁæòÑ«ÉÎ.9ûÇ9ôÞY¡B›{JqD$ Ц…¨úÙCOœ¡7Ë2R¡¶‘áî,lÎv²9=ÿã•yÃåÂÝK‘šv|òјÎÜæA“|⵸ëIÛ«Ÿ¥Iá?.¾Ò{[ÖÎ¥—瑬ÅóÒ¤v¦*_¼=ñÜ»§òÛ¢jCDϽ¸â@6?J‰6˜\fkyªï+7¦N¹=eÊ/Cú]°xåá‹kR§)´bz»!ö _Š&%—N19i6âÉÏ÷2ܼó¦ší;B¡Í¹ Uy£œ ‰þæ¦ c7`BT¡ B…†¡DÀz©Ú\ª+¥,åmK”¡z»#´!>+kº?ÂÇè`â1²@†øcêl’¥‚zVŸg¢ÍߧIÚò4üc•lS“Ü.Û´¡ÍïGñsÚÛçÀnøí(•lóHù°Á‡.¸D¯lòÃÙÍäøCÄ¡PPhÓßOU†:k8êËnÿ´Ä-z»/ÑlÚvœczY‡h#ÌŽ8Y)аÛü0û¸Õœd ÇÛÐF”˜ƒƒý8ó …ù“hC$"a÷£ œ?6¼a°ÿ¢R]ÅFêmRO<´^çrøþüÅZ‰bG„._Ft­Œœa]Ï!¾ýäß –*4æ•Ò½˜„ÐΡì61<ûM B=ÇÚco(!Y¡j‘6ô…gãäêÕ°Û_3sŽ:U(«¯ mˆ_ÜR 8qß# h#È`üTÕ¬,£˜[ߎܨþ#hCÙMv>½Ñ£q†õ¾?‰6‚ª<$Æp”S2ö6Œ6MqéÐë6'…bšp-k÷^"Uo{&Ú(›¤BœV¾ è‹p¼°‹ ÄJ”qþø²Íߊ6Œ8ôUfnûx•ÝF…6èyK!·äR¼H"î‹J»ýde$K;ã“.i6Jv'8IÊ›Sož+#îŠP£:—F  !ºç‘Uãðº9©—GŽ‚%sðûëoÿœ†§Ýóƒ®??kN ûtØ Ën·C˨ײcnƒÉùZ¹rNŠBÔÞ³?bm}¹Šlåêh£N {†lƒ¨4( Ì¿ÆœT›PgmÄ3aÏÎ iɃ{;Xm(6Œ6„vßÎt79-éhâ‚]XÐsŽGZQ‹Lß´ †)fZœ|õ[¤¿‡sRâ%ÝÏ»ÔlhNŠœ‹líazôQºRŠÍ~~«õ´éhNJÝJ|ïóû&ãÜqÙ‘Ç᧦Î[ Eh£ØÖóĤ+Lõˆ~ûÃÐy¨fÚl?Çb˜vÙ†4”ZÁY 8ØáœT;BBaC9ª  oo}hmzx']Œóô¢ 1M±ŽŒïyúv¹Ë ÀÅ"Ee¾îmbÅø©¯/ÎPæ–Y¿ èo¡Ö?Ú¾«$tRÏhÚ`ùLWv^´ùTgNJ­I½\´!£=ü.!æÝð_܈Ôk‚—â°QmHvÇû˜ãffx§¡xR'4©/~ÃÇõ#>½çË5AûmÓ €#ÓÏ5`¬†÷¦^BƒX]»ÊRjR3?}ó¦¥Ù è|#0_¨µ‚+âaDO“#äÍÁcʈV$,KBOXjh“áÌÛÚ†÷ëÁý¬Ž‘+^N®ü"²¤Y¡ZoSp…‡€ËN–#ܨ”Þ„#Ç" £Èù÷b¡Žúµït(Ë€lSp©±½^äÛGDùd‹©õ6{t¢úµ­$^õ„~ôÆšíc -­Î­Ø*.Í@.ü¹/¸¥B>z˜ÈQVý±Õ7º-ò{våv¼ê†ÛüÅ’äê‘㨳|z>‡læòIÄš%­R‹Và«íØš­>?ô3]§ù·Å÷xéXÛö³*6\'ž½ã–!põ‡=ŸÆËÔ*?vÌÛI´.^a<Àoâö¬‹Þ°Ý ݯãÍ5‡ íâúœ p‰ª´²¿oh½ *oªZÂ6\Øþ˜œDŠ{ä­›áe»3Úy´×>ûCuúpXqãˇ¨áu²¿z-M?ù;jðדßÊT¡&õ9xð±*Ó¹›tº¢ÐS7ŠýðV¥²íñS5Eœt{¿©ÐÆÂ"„.+ÿ:v uÐz†¬L}£‰ã4@·Y˜rÑ%wpÿxºúœ”ÚŒw"Òh\O!VmžÍú)¸¼DÙ¦£å_˜þIvL…6Gâ;^r£oˆÁ(´±˜•öÌLüºæƵÄöµÚèE׫E¢]k‰1Ã}Xï²äŽ#Ò÷Iǵ ž–V†7Ž=~€Öò'—@¨r"è3Χ½ß<ïW:7š?Ÿ‡±,î€]zV½cÏh„:Zw©öÌ ^\ÓáÒ2b­º}~mÔwzó]Û|¼gjòD}Yuk|HÄ »mÞñf ŒÉÊÄ „fõ`ØËYgóˆ@›¸?ö)…6Ï,BeZEY³âŸ*ÆçÄÅVÅÇWk\qÕBé?Ìû¤ÈÒ‹ŸÝáò—Ö ¤á1Lü?FRQ\Œvõ¡ ­n–ÿ³ùªÌ«ºIP?4ë­>Òøi°Å—5嬛ï‹êÑ5l½WCðÓâÝàb+ÿ`ÅŸ§“«ñ‡yìÓb7¯U»KþíLÈŽ=ïÁo<Ô¸Ü/eÿÃÍuçzÇÕ³d“Άšª§ÏÒ©¾ùwa´þ³ù¢ÿè³t =…c°úÈÇœÑ êå/ÞÒÈ‹ö,‰zcUâ±­2ÜØHŒd$#ýÿ#ž”Ãѹ„ ŽÉZ$ê[rq»JNÚ[e<¦¥U.ÑÒ]¥r>õa«BM÷ÃÄl [ P[`€I9¶P!S3Q(ÐW M@–+„©¶å\(ãäºålIËs¹¯a¢f)ÿ9ŒbC¥6l0F2Ò³é½ðÁ}üúôõëmæf^½Ð=º®pšq,ÒÆúŽ4]=<覟ÖT)»V>Û°„›yÙ[¹¡W&s³½Õ=ÂbÊ7÷òë „Ï· l⊿7s¥½{*Bmh`u°¦dåè+–\£ÿ¦Õì³öŸ©•óý1fËsqi¸ÙÔô†µêhmëb­¦Éå]¼,~ç6+ÑGœóqôKOËNÞ¾*pVIDß ,þÌÎügðÂtòó'±-cÕJ/9k(ŸÆ±s×qMjê—s‚µ§U³&ÚdÔ¶ð´¶ò´¢.K:"o1ÕÆøšË¡{ðwvFÈ´žðù¼?cסeMï{AÕƒâááørøºžoèï¼e(Ý>qŽ(W ¢¿Åñ ÃÜ,!Ç`€æà2C×q~¢/¯.Æywà‰½Dï‡"oøݦñÅsÄȶÆ=-¾g4xòŒ=õ¿@ ¶®Vnð_¡P¸¶îP(Ußt§xðƒ±V+sâôI O:#xó 7pä¢Ä*z=…[j ×7w 8ÚeR³F æl: }·„š‘—d- ¶µ ù@7÷‚­wW®èáeïÙ¾£ª¹«!ì tSÏ~ô­ÉcK>€§¶)*7LLÁëêbzÈô0Ä2Ž°¸^*|–P Þè _3©3£K;9÷aâø– 8Ý¢‡Ô^í¯»ÁAŠ„¦tH q=§$´‡×·i­zlϘAk‹îvtÿ“uy…+ÎIðXŒéÔ༠8W[j¨¢‰0¢ õg=#Wz¶”ŽÊÚ9êwMÎHæ¸[•ê“ [Þ0})é°É Tfpï_Í-¢µÅb#š<mÀi¸Kų Å*>*Ñcí7¥x ’®íCöa¹’M…68&gq…wÊrÚ£8sâà\!“17° ºy=ý†N•«¡#\ÕØÄQ6‘׉Î[þ‘™ï(MͤäpÎ ®æöêûÐߢâèmRª?±õ[¢Þ–¤jV°[.ý5LN]Šú¥›;q£wW¤³mW$Êx›l±àÙ÷rC¡²ry³:£‡ýï–ʈ¡‹S=B¯ŸMÁ¿ç k+êT-Alã®-/¥r7˜E³þ¦4”ZM/ª{Oü’1 |—£_x°œ<#Ö<Ú8’î¼Q˜§.Û`͇Às%ÙH«z;Ã~²ãg-úraÚ`|TG³òS4ê]@·QäÑ£s:˜G^&_)–xÁ—U øs¢ÌÇÜ <È>w6†$…v¼¯=ú·?là›Eʯ:@›ÖÖÔ\‡Åí+“Š˜Bí€bÑâ^XPI(Vs-j²ôŽ–wãÇîiCÃÃ+®h²§D¦R(.ú¾ø¶B{äåÏsƒÓH¶QpÛÐf{ô°añ'©>ô…é1-u+Aj£ˆîáÓ§GÐòžkå¹i^ýƒkIÇ}Ea/'ø¶žI"–§% RDŠì¢ ÀØJ¥”3Þ<ò>Juq ­CYLY<Ò #«@̽.]k$Ú¸À[Ù„˜ÇåÓnVLvRÚ<÷±r¿cò”¼dr¨ª ‡Æ\ 3“ÞÙ ÂøB\mƒj™MpÍœ[@7m–lXð{=“8òR&ŠA£’¶l#‹§®…Äî7x§œj¥¥#Ýá`mƒ!¼Aèýq5©ÉaÍ]= F(Àe¾¨E=áWÚp¼z f'm|!ÿí&b›8Ï‚õ}Ã?V¶¾–#@›†Zü‰¸ñýböRH¹Â f•BVó'@3;SCå /ûþ)›mD›çD›jÄJ. Üû2õ¡M ëø Võ9WJÈmÞÉK8i64ÅÓêtšhC("Ù×éíìPChÓÏ 8sgGÌF×Ôà¾æî°"ß›ªù-Þ0¯¨â™%ç?3Ë©´:@bà“VïI˜‰6ê>Vžý¨v-¥¡Ñ™I–¥¨ð Þ§ƒ\V¼*vÅŠØ•c|l‡„ÌZ»bIüg-åH~(Ö4tl—W¡Í)>[ThÓ<‚¿q•n 댩ÇXV`éÚ£Z×V~1-íÂ/Ë"¾bÁ}X«ÚŠÌœªã4¯-êµþ]wÔf­ïé%Ô¦ ˜BNFûf íÉZRHÀ22†zQM¨ ³;¤ŠdÚ8,SZ×…ÓÜà˦f½hcq„JKÉ”&åb—«*å@xÔÌdä¼c½£3ïÄ¿†4r2äÃXS-Ù—E"´)@ j º9W¡T/&ÍŸ|Æë?öƒWÓ+«AA¬M§%OëœtMõ¾u¬ Ü)dïm6—j4­^H#µ?…C°Å¬RÄö(<¨kËe¹„$ܼ \&±´2âÍó¢ "·¬Q=tÑ&«ÞÁÒš–Ôz0ÎÎÆ« ¿.ðtú&ÚD •µu ¾óÛÙÁ†Ð¦·#ìgåpsr¸Yvp¤>·­GžaÉ¡šÇ±aºÕ;Ü\Ù-T¨ð²w £MÛg²fqm|Õ~4¦_ T¶â™¦]6$n@צÄàLõ‚¶D[Éì劾¥À5Ÿ›“Å-”uÈ\·hœ“ú|¡‹6H’(½Î›ù.àa-ÆðÑ>È—ŸK½«ºéqÆàmLyyÍRÛx/uf•|AéeÊËÆ¢nP¶É9¦ž]Æ1Þ¥ÜTThƒ$±’éÞæf¯Ì=y*ÿˆ¥› mè‹Te”~⳪j´ÐUžBÁ:›<¥bëÓgy:饢i·ä›NY¨‘+gÅçS­œ BªdsxÞ`ChÓÄ» }E*7|ZÖ*ÛØo IºbIáçQÃQ–ºù ÙV‰«•új¦€@Ÿ/Ûöfü.ÖÕð Ž%²%¨ gÚÓÔ>A÷.fB m<7]ãþ0ÚbKUw¸!àtÖD›òÆ›à;\iiGÛÉ × ˜çÁc·CÙ&òùÐF¥I@ÂjøÜ–É•¨Uö¾¹ÏxM»ø˸5Yš]}„78³9TSk˜ûOÀÕ¶m¿’4³O1þ7‡FŠ5f¥?²z/) õ#]Ừ@Ÿzò ü lЂìº,ÓФ:$§ž—ùGѦ¦¿ 8¶*ÙÎl¹nâ1@‚áw£{}W—³ÄÂex^í©!±?Ÿ‚K|¶ŸRqÀK*ß@¬iÉ£æ¤hoPoÊêOõó/kðx³‰¾3 ÞÈŠ&»¶`’¼]£&Û8‚s? mÀÂZ•+LvÄÀ¢ ­ó XöNðˆ@›2ëGð½@MQ’™9Âù†*åP%/Ý;‹XŠã„Z³7’5bÚ+ñîÄ™éÜö„Ïó\Ú‡XŸó¬üÆŸ­NUÆŒ &¾eIÉÆ®`ê3b_ƒè& žðTSJ“Ît‡­åz /íà* A¹ª#ÏsNš !_(3$«5s3I•iŸiÙÀ~î¶:ËT¸Sà@TÌD‘H@ýz½•O¿î^–ãb¶ ”©6÷t… ™wȯZ¦;x/¡¼aJSFn­C?Oèá×ß”o¦\AÉÉAÓ»€g·Þ¾¶à3î—¨"÷Ì·ÐPÒ7ö®(šÐ ¼ òp¼¡~Ep'TשõÁsé…”éƒ ^­H¿K•zªœ¬.!検•Ww´¯Øùö±ó„Áa« P?ù€cW•w?nïwYĘ\º½«ôòëkâk3P W{ÒÁÄ˾gÀŒ;…“q=ÿ5Ì b©2 7™!ž¬)¯å4ßé ½›»Y¼•q»ƒ9)ߢmÝQñûvò€q_QF-—‚mÖtèMœbñIž+QÁ KÁãu)åd0Ñ*XÔŠôW’øVHoð´ëáeÞ3dY¶œL“µÜÞQ uòmt™“oD›g’Ó߃4×ë.^зØC{ɬÆLu@ƒzgÖ]êkȘúk‰QÃp—Ae˜Ú¡Wú`Ó»–Xß‘ÇØó,‹ÖëÛNÞT2ïb¦g}ÆÎÀn˜þh48 w½Æiæê Ä:¨2%:jÙíè¸vÅÅž¹–ÓdÖÁ‰ÞúìoªYÓ²\ñ?¨]oþ;nÆìB€é[G­Y:œ/ð^PÅ2¢Íÿ7:ÿÊ’lüŸvî&š¡¢n žˆõ¼ &'Ü5: wL…%Ë][žÉ%‘ŒÅ3µ/ ÷ï̪súœJ7Vèÿ3"ª{u \kþç×¹ßIº(?ÑègþWÓÓ¬‘¶^¶Zf䌑þ¡ÿç‡ ûc^‰Fúƒ|~¡WF2’‘Œd¤ÿ¼î‘P}zjÈ+{**’JW¾‘ôƄƺÇ'<Öú.¥låüôàXh)NÁxKð§5)Ý´„M»‡Åüð÷èq/*ÏHX‡‡DÿOi/.~aZS$‰>cLºÅgä.™—„ã… ‚Gí)V0Åo0FS~¾5W&Ç·¯—Â>Kxk*cê‚Ø<9µÊla²ÏÃ_;ÒTÛ–Ï€¢fDoÖPT3ÖVêÇg=ûùßÉ5¹4òÕÐe¨•nîGœž†á²¼ñáËЛOæ:-S+öÝøXD§¤Ù‹‹ÔøÝr!só4Æ«Ó"Þ+þÙ häÐXÞøs× pÎ¥›€+\eÕ¶Åq*ÖÖÞÉ?2¬zeS‘—7Þ´¦ÁÌänÕ÷ø•ÿÜjbb½ ëS¸+RB;ȡ]¢ö‰þ[*á¹Û:ÓàôÝwUhC”.¾îáÁ¬Ý‡ò.¦ ù¨9ÝÍÞ«Z”…ÿ”¿/€SE5X¼B m®U°½eï9]üˆò:)e^t(ÏÊ/?øŠ—Å‚Ämë’hDÍÝ¿7ûÀýÚhŠùY5·•“.+ß™}Žjü‰õeïÝ—s:”«t2’‹3.çÚ›µ÷FU¦ª?òLÎÞ}Ù'‚¸Ä:²êÚ«¯tõÞ©r7 ùûx‡‚Zie—÷dí9VpƒrÒ[‘lÖOûËrJX.{3wœ(¼Ç!ƒU6^:S]á[vvg)  æoE§vgí½\æFö¬´òäŸN3ã6«CïY܇œ=û²¸7•t`Fñ¾Ë÷D7!•ÇYµ :T—“»,ä^Ë?²'çd(—: (Ø}¥¡^·÷sùá§söÈ»œ/U ‹ŠæÅgPÞ.–¹Pè-å=ÙUÓ"ˆ<œµãPÞ•b.“5îLèþÍØYC²‚É =•³wΩpžríðõ‚ýyb!½ôÌö̽wjcÉÈù‡2ß÷_gì(W(~ÉùÖƒ‹jL¾Ó<¥XEÑÄ¡QÌ]^99«ô±6éRmx­àABEsÂÁ3s0 ´I©Ü ô bmvK»¾ÐOÁ¾ÚÈä5‡sq;ñ`²ªÝ9gq¼þ|Îî]YÇcZªYo‘SéEÔïÔ(Ï.ü­è@"¿úzÞ®»ä!IöÕ¼ƒ{²¹4S\nä†ï/ø‰h‡òLp™Ž²3Ö|I9ä÷ŒAó‹Êp ¡ <¨üÜÇÕ¨v^ÒEÄæ)tX•ÏPo+c®7¶¡ ¢Ÿ“§˜36‰ÿs†¿æ{WØWá•()ÑÇ樓1œýSù“s?pàIV£òHW,©‡—õ¸ô_ÈW`áÜ©ˆ’müLþðfÙU¡ö]à ï•ðÜA£]ÙC¼Í·äÝçVK¹ÁÕzáÍ{e×›MÈ!¼WBò6MNý™”Ç#Á­7Bªü’7!`ÞÕ²{7 t%Vù²å¢dp†/ó®>(¿ù~¸]Ï„[(xqý9 Ù(ºs§øh\inâóæÛ-J>Üœ­^FAÝ*ðÛƒnv†wóÙo2ÞG‹¹B/Oê+gïô·RŽ‡7…3Ü:”ð›N+k´nqò¾«Õ(òÚ±ž07yßïU? þ+„SsØ8?ëµY—-Åõ(o‡Šî<(=?ĶVå⿨aø|…nÎ%Ù÷Z±&ãä݆Z\–aêfú¡`Oœm¨A¼þ1fÄê’b­Ï«š~F,Ý“õlÖ‡àd–BœÚðªÌHÜõ¤êÑ—±“ÀçM jÖM‚ÏÌ·¾b°bO§Ìßù8&|Z¸Ü':ÖxsxvÕ>p·?ZüÛ/EººÂ/\bØ~5Ðltà´cåž‘õÐàÛÆV “x–¼´QOj}ø¸xKhÿsäŽ<’F)†)ä--r½©fO»×áµ}iðC‹Œì.zÐ&8µ‹IÀA…Þc>”hS]Å<t{F«Lg\*cóäR\!n"'»%ÒÜI¡“™r¹¦Ì•4óISëÃh¥»À BPT8o] Lˆû짒K `j¦ ¸$Ô|dÀì-Ù§¼Ø-‚ÖÔضåþð¨üòOø°4Š`~õ>ÙûåL ±p›-n"7*á¿îaD1´yÜ*þ2Ìîõº!Ù†[·hØú!Ðæ§å¼e´Dößœc¨è”¶H¡ Ž±lè$Tº=Ìš2"bûŠ¹ïz†³+—.(ùÅÞk9ªWVóCðŸ®Ô¤h¹Ôj4Y<5 Ç”hƒ¢˜áky•ß“J>· {¿½ŸIVmˆ~>fÇRÏybf‹\^K8¡¿¢ -­»µ¬ó‡m•Ê¡dÍŸƒÇ{¨[#úlSy+è ä57øž­Ü«š_!Å0½Â ³r6ÐFp”rB<<… žY:ÉÜk:µD,-w!ïP õV®ðDD×Ò ÎÇjˆ½¼¶øÃêâRŠ öwà2–ý,´ù>¹÷ÈèíÔa4¾ñ¬“|©WuáÛ"'CS-»ƒ`qq•ÐõÔ ?²ªò WCà6UÞ8Hp½Û*ÆYóPåÖ- õiFlaïúrJ˜\ì‡ê”yä0?ïM¨µ¿dþiy$Õ3<³úô‰q$ŠÃ; ´yüŽ¦ÿ´ArIAý!ðš€mNÀ Lê-‰6+ Ìið~Ï3µÜÐæ®’T¤Úü&Q>ÞÖ÷ÝB/VÝI42*ÉÓÞOü5¹e ›%¹O©g?EÀ°Ì4•Pv\&6šç"¶ qß9ä=‰6ŽÅÛ:] Ó‹6qyïCðGŠQÐÍ6f ®f¿ð„øsùŽÚHÁÕ¤J®ô´)ßeò&.+ºêïC»fÂðŒ_TD¸Œ«ÔѦ~â_Uby¤Ùs¡M·×Ó)ã’l“É¢ªâ¶QÛ°5ÑsÛ|ó‰p?%ΔrQ•7ñ;ž°´ŽB›Uh¡ƒ6¥½ÀEgÙóŸD‚5¢$ ›W(ÝuÐ&£d²‰Ç| ¦±S<«µJ¡B›I» —yœL][ÿPÏ#ѦBåjp!fÂàŒß"‹>é±A‹·mVP¾´„fô9ÛÀü퉀LÒ}½mˆÀ+ýàÓŠÒ3Á:vîUpì¯ÐðBá +ÇvR“ú¬ø¼É@ÂR`ÿ9¼ÑAœ×Ū“gJ0!†h½iyCç—{"µfõWS’?íí6LÐ6'Eë×LiR"âg®G“*ivó%v„ ϸ•ø ~r0mM u ª„¹|å˜ýÎØ„­ü°ßêëT‚HŠ¹“ ŠîÓ`X“Ÿ¦¬6Eiéi®Bu­6´iºSáÝÖWzÀ16Ç Ú¸öh l}bOp씌k MYñJðûXÙXÔG3 !­±mšÔw!°('‰b`KÝp[,ÀŸmðèÔžÀ¸Jµò€‚-ýc¿6¤IƒIé *¡C¡½•'7”>k•!åuàfâ+–F›e”&µ&>/UN"ÉeEÙbQGhãö\š"&kïîF×F©´þÆÊâ¶BU3/­[ ¦='”¿<ÇÕu´KbGšÔ)ÕüÙŠÐ.[K‚ùÌ à1Y9O-‹íD·­ÃÔÑgbGWåª>šSiˆùH&ìæÜ»J9kß.Û€¦Ëà1ñP´‰Ž•ÿ$D|ª–í¦Á^p :MmNŠ0pï üVò_3Þh£ *\rÑ wù4ëȺȉà1¸ÔD"3Ë1…ÔŒLLgWù‰ÒR> ‚·ö |í`îÞ1>0&á{\ m6ûu² šÿQÙp \MßHølWÆÖ>Þ¦Sóû›gúb»¸Óm² j^©ƒÌ¼{mNÛùUÒ[¨µœojáò¼À^‹Ý¼;ó«~Ö“¹‚; Î0#þÓ©ïÛyÀ®zBÞ>3ü&nÎ"ºê¡@x5¿S“mV@ïàW·gîY5i^¤•Ó6úN=˜³wœ ‹9Šk  áݽ4м/cáÑœ]c¼Ì좿§bù.¤·yÀŒM9Ü'(o‹SvíJ]eNƒG-Mø‹  Ž1»ºCÆ’ ±¯¡xîó>Š“Á¦¯æåj}Î庣¢×­  N‹¥H"“¯ ¶ê2÷hîžñÞ–V'‰ôô¡Lä n¦«ãVgˆdMM—‡ç%|ñ]Ê[:kj0„6¸ÌÏŒKcW%ˆØK½aw=×°&E9–òz» ëÌ€ãÍ\gT¿v¾ý&0¦ õë ®æ¿²µfÀ©~)i¤MЄ ±$½›·]L®-Û¸Ù¬0ߘqàƒˆàdOnˆ„Œêbå7jsòºžžðviª¦lƒKĈ¥£¢6ìÍØ6Ð ÄüfaÝU› 9Zò»î IÄ6ÕOu´!²y-y¸éÌ€»,”-ðS/ûaAÆ ²pƒÕ~Ž«ÏI‘ðÕ:ÒÓdLú?ïô÷RIÏ m"ñ„-ˆiaRõ[+Èo d%;Ç’ÖT “F6ETJ)%V‘Ñ’ÁS:Í …Éá-M-ÂôI,;‡ ÁÄG£ØÐw²ª¨Æ°±X«EXÝÄ`4†§ó”ã6òÒ"ZH…‚ÒGõˆ2^zx#ƒÑ]*RŽL"IE\S£‘‘ÜR¤P5B‘¤2¦‰Ö‘ßÚ¤ÍÑ“¡|eV?¾¨Œœ=Ïa‘½kÍbÇ¡H"YÉM†gÀ ´ ºÐ".‰h nÎSæ@ar»ºÝ/kÍdÇ„6†¥pKñ¶cªdµÑŒ8n•á˜F”7T„Ö´!…$7˜E䶒“ÎonBåM‰¬Fct™X)åÔ^]P¬+á‹%ÑaáM Ê9e³cQÞ’[ŠUS8y!,Õ–Ÿc©Be5G1£¸äFqY4‘áÈÂVå†<)ÍU¥²ÚÜš×RG¥˜ÇŽa4Fp²ôÆàB±®ŠÈ‹dÆŠ4æèãPmòÉ6Ƈ³³Ú"oÎ`dž7†Ç4§5Ë媎¦HoŠÌ“ˆÚ% '”ÉÈÜ¿J¡àî4Õ‡6v,\œÄB-'ºV&UÍ€Ër9qaD#¬¢f±#KE‚váHÎLd…£v’Á«¦µŠ+ÃXÚ+©ùYé|Õê"Ï rY›´%—6 *È•­µ†Ëg« bòbnjDcxDS\©ˆ«âFk “Q§h/´\œË`†°åFŒÿòÊšä(î`Ã`%6hsþåÖ1ö‡^©S`ΔÇ"c­@yƒ)}¡ÓѤÜìÜ1Ò_LX›Ù¨¨µqÛ€¡Ã‡i\A‹Ë'‚<¢´œîï?X;­€9"ñË*ÎÿçÚÖ5àb{8Aƒ‘=Fú·ÀQG!^fjZ¶1Òä9f„h#ÉHFúÿ­ÿ*ø2¥g$WÒØ,S_Ñ‚µJ˜R15c˜„-n¬ÕÕ‹˜™ö1²B)³^ÜhpäÆ°&Q½‚ ¯à£HêDµ-rÊeFÜ$®¯5ð享›¨íÅ,q Ð"£tŒ+ª­¡Oš©Õ 9·^TÛL®¥Q(¢úzQ½nÅ"¦h_^…IëDLbq°¨^Ša+°?Û [-<µ¾ÔŽ]Z¸à˲(m5C¯3»‚káa’&ýÕXƒa\¥T2ŸFšm-ÊÒrWŒåÚ|bžúiŒu„ÜØUÿ $k AýwTļnáó¬èàÊågm.'Í‘x¢íŸœ¡R¦l¿ì¦[à?74»oÏ_ÝÖü{jOkïn}é0Ê»ø}‰ .‚ÇÛ,E¾j¼Ÿº/*Z Á»µZhbÆ`:LÍ2æU타ŪÌß÷E¤ø NkȇW00=šÊ@eÙ;àµN®%=("ÁyhÛœEPñÒQÉíëïÇüªÀÛÒÜoD_Oèî·˜£†6Ad7/«AS_ êiémŸ $Ol‘gMð4³öŸ0;l4л^â‹ÁN'ÎBJœc磶ã ÖêÈ¡àf·<~ÓØQ–L1¶U˜€dH¤¤õ÷‚#§Lùpcôð¦:ãoeèð²0b,¸›;Ô«€šy@®+.ÛÙÍË|Xèì¯J|î§vs Ü»NÏŒGaÞC_õ[5Ý ÞÏ÷'eO.Çòì\ÖË«׬°ñ(ž÷Š Îókß„P‡WC'•ñ͘Ÿ|Ij˜?YÒM†Ìëßµ‹ÿ(y세ù‡®tè4Æ–Óbâòú‘ƒÁÍ~i컕¾%¶”\7‘à¢ÂV/xµâÛ£àÝ‚t¯ÌE¨^fÇ®ùžÍàwšª(¶4°îƒ×@úb ˜&ú{òÿ %•½=23´²zÝÐô€ghRâ¤`é7jY܆[ÕAjƒjW©¶NàG,¤âMw‡c-:¾LòŠ^îPIú¸@žDª†6MÃàF{pÎ<ÕÐ¥0zl'³8GeZ"_P…—ªË6Î#Û—X`²Ói[VÆ.¼0ŒX;§5X'©ÐÃ¥‘à>š0â(8&tÈPém ‡B!®l­Vh?Åw›¬tÐ~Ã×tO}ÎV¢M.óÊþ|WêÕÈÞÃr§‰ä’¯l"”çÚ ù^ßW$¢>Õß")q k>“Gœà‡ñŽ Ù±0¥` 0¾¢Â§O³Š¸…bâk65›¦ÀÒ‡Ž¦í“ Aæ}ËΗþ^&Q®D•´÷7I»M~ogêdXîJÞ˜¸•ý5’›† ÒÅ"¨3ÍÛNýãìmsÔ"Ñ&WTvwo4ßèôe qd06ù)¸¢º‹«IµÜ‹µv†D"XÝ(WüÏÓwÑÃdý¦ÞŒ~`XöÌ QWã•Í†K³t‡`>!«ƒ §º y’Éó¥’ŽæBÚц¿€ÚÝn*z:C´œÓ÷)qv'º¢I YküÑÌï¶gŸaJó;;šÆ¶kRof½¤{Í ǧQw7xj‘¢Ð†×¨Âõà9ŠKI}×””¼ Ú4 aì_£Qhƒþÿ5i EÐj¿¦¤<^þÓ¸Þ’S]Z&É?›ýå|Æ0x Ç}‡ðRð(;·>n% &[«¡ ~*qèÂt'1?¼FQ) ´ù½¹Š-³ö”IÀ$ë O³é«´/¿$¯oÒ¿B›>Ý(lðµY¬Üi˜šMƒÏ›Uh#5Ô~ ´¾×ªƒrxù)õwÛÑÆw»Ržºƒ+6¼Ö§TÓT”í/Ö£¾kN/à\cÀ„6I–N/Å15ÓŠ´!¼äº÷Oa èCA6±ì_m¨âtýº,ŽÃ¼A«Œ]õG¤ÑoëC?]Ó@Ø65Ë›x¾m@R±Ì!y‰SK«šU³óÇ&νNƒ™jñ|ío:£8Í áQmðÇñæÃRÔ&¤’¸½®¹ÿ-&‘”&p›”#1óøÎÃÕì6„îÀ:KÈØ{îcIU‰&Ù8‚¯D«¼u64È!ÆiÁk4`~çúÑF¿—1ö±¬ªh Þæ2=Cù,J“B¢È('p(Ë»=¤{gm„R&K¦ò„ážçá\…¤JÔVÊF°Ÿ˜@›Å­Ô9ŒM—ÁYDÉü1±TBC|áH}•Fé‡Ýƒ× û_ÃMûfF© «h‘¶jU)6mhC)bØÃh;ÛwåWŠl Gp–´¡ô@øˆ©yJ•­¨þ$xDM*²§â!7<]åCs ñ»ƒ —Ú¢M[ó4EB¡Ír-´aó½ÁsXcí;r–*€ mªÚDÊ•™m¬Úan¤|·8OóÐK£˜óo&Á—1sܸb}vã‚ 0*þD>¿(Ÿ›´%ÔÜÚw2—ì+?¦ÎA®¬¬RAY1/Û!~ˆ©×ÈF~8zôèôëê±HP‹rÅÂ𔊓Ë3ov Û¶\~‰;x³ Ê9£½L>«ˆÕΓà:8™úqJª “½`sq2Õ§Úí6ŠH••-˜n½c¹…e‚â¯Ãì!˜2€(n$½¾¿¦AÃJÌýüרôý²XRüUún¡fcŽ­ø¼‡ä¶V–òbÌÜÁƒÇj“m¾ð‡©Ùõ¢Ú¸ÊoV„wƒÐÃÍ üiöâ.!T «k…U… L¾ÀåðÔÄ™]Z+¬-aÓÀÕ6É:ü‹à2(]P) ŒÒÒUÞ`ân—¡‚!¾fà»4£µ)̘E‡E„1D.úÝÔÜÙ…uÂڀ à9á¬PœóUÆ1µ?£ÏÒìßêÅ¢ûíhƒJådæ®ìÒzQïoZ†®ÁÛì6bqPúkúy½¤±”ã1ÉoÐíKÄ¢g£x¾'l)MlÕº~°,¼“UÌ=–?3Æ.ò« aMzÝpë[…ÂqÏë°,Aâõ6%Úà ¥%¾p™£4¿)Ñ«ïëgYeUʪiê à6¤\5ÞEí8ToìÏÿnâÌð‚+¬V–ÑO™ïõöélï;t{W;O¹¤éáüÐ!½»tóöEÞ#JŸâ w›yš„|„Ÿ à ÉYÛ9jw‡ši …Í ìaë3ä|}‘ÎÌ(oUõa¾Ýìü^¹Í,l{¯gNŠÌCvÃp?»Î^ÝW¥_Sm_¯Øá3ŠÊÕÑÆ7wý’Œ»*´i±÷éš-Ö†_¾0ÚÂÃ’£±Ï6é]ë0ÐÛ¶‹ßx'.)¢°Àwz!çÏ êÙÙ»çñšb¯œèßu~.ÑÇCJ·öíÔÙÛî­”Sr2›žß¡;yuº8¸UNío²žÑ×ʳwŒ¼üŠ>°]Ó–*Ò¤<ØYG ³ò궥У-'2ßÜ ^6^6³R;ßr}ûðÉiA)÷þo«W/»åŽ™âÙÆP™ p~p_k¯®ËÓ¯Q*¡ºÝæTÒ +O›7R¯!¾ˆdçû*¹(ÑF„ä‰liYÀ ïo×Õwèí&–LšÜÛ§ëú¢6Ÿæ}ØÝ˺È’d 5.[ÒËʳoªÿ6¦Û×%9T ɹ£»zÛ5É•³™‡â{l*L'mkŸwõT¹nêJò¬‰ÇÛæ+oEtµO 1öçÿEMJGÀ5çh°ç‹JßA÷†5)½'¼w¡¶sRNƒêôg^ù;³vßwÔ6$ŠpnŸ×:˜Ó\Xƒc­s<{J:Ì!fàŒLÌp‰t×Û`¡ˆ»Ïà³ú¶­ ´qlfjåA_ÄXG©`úªŠJÑ‚Ð&]$ê¨%`nh²]F›Wš —ÚÙ¬YxLßBê~7\eKÚ¾Uˆ­®.3öh#uDÄZâá' NñÅè{EHÉ©YËTk‰es¼`BÔGžìƒª£„‰À­¬îÊ¢À.À¸ðÜ°,­óÿf£€cñI¶=)뙚l£Ž6/—¤Òªñ³µ2Å¿v¦çjÎ7Ãý,F']Ug‹DÊc˜ÑÉÕH‘¼.±91¡9¶mþ÷E¥³rN\Bsb"»€ryj•T'5Ljž1©ÔÂOJd§òŠóVŒå¼ôdNv«æˆŸÉIj–Iÿ¢ A|sRn+ÿ÷Û‚kƼ8ŽWÌÿ¸O” 1ý²¢=K|Àðçp£îhÞMßøŠpÄÆY@_ª<ú!Öf]^”áT0½Å×u"ƒ FÒz2ŸÁÌ€ˆ¥·Þñâº3ƒHß.r³÷ /âøÁ˜A}¢”/ïû}*–{ÃzM¼L>«Ÿì[©óÄ®@³H" WÞy«,‚ˆÕMå5ïƒ×%<æ.‡ D@a8™í-ýÜ´%t9it·0åi•›-m’¼Ôò&Ú ¯xÂ*¦Öt­‘þ)¿ŸO]òÞÏ)ÄP ­ø$r¸x }Ú\Žž|æGx 'VQ4b›”Æ_†y› ^‰þº–tOÉï1žïw‚pâxî&®ÿÌ[ GðÒlÕ¹‘Þp«.òF¿ÿkï,ࣸº>|"¸»C‘w—"-Å[ŠJ!¸§P(¥P¤¥8¥P(_‹»»»»ën’ÝÍúÎ7²»Ù•Þ¯o{žß@fgæÞ™¹sïιs…Œg°ÿ^¦qJYlæ÷.yd+'SÝXE­ Î;Ó™Mõ}˜ù3@Lî à½Gï¬&ßqaMÓ }Þ° !š%/©”²¯É]áRbQ}µaæš2OXIFØÚq¼{ñMFmȸüsŽµ§gx(_¡™«OT½È­3¹±·×§2y½b¢VE\èÆ¡‚˜†_Ðýš ‰;XuÉæÿ܇G¦I›'ü"ÏÌC¹dê õ¨•3º˜Pt­7—z;O9]Nß+¦m·PÇùdÂPM˜œÒÌÈ8íGºð}ÀÜ  ³FƒãEêÄüÀ]Wò}ùŒOå'29ß!õ :Èhw¾˜ç)ò©GF¿î#””Ú¬KäóJž´£ûŠRú1°ƒÛ¹Ï»ÙÀ§™¹ä½äžêH§ó¼¨›5L?}•àbø r ¹¬LxÎ|ëŸnGGk çkˆ¼¯:Ó·ßÇsebýÖje%yê¸jçiô”¦³¢n3M¤²´ >Ék3´{—- )*8G‚FtÏÔä1C©ÖãNÙWýDr¦`̇]dè,°*˜ù[;:}JžŠØ¡+Ýk˜6éâZ™ø© ׈m‚]4Oªæ{°[IZ²µ™d,R–¾Úxä\w­‘2qV/»Í2­¢¸¤|ü^ðÅ{nµ!ór; x)£J¼1Û¦ê$™OfÑ ÔC­a-=¡¡ ïa OªÈd¯o çhÛF)º Ö-éRèš²ܨ1XR²'»[Ý¥…P8›ÃÓêˆâŠÀi#¦3í×6àfÆœò¸ ŒMH ÔŠ‰ÃO³cÈ-%çÁfXA$î1´Æòï†t¡>qV CodÓ³ê¨jZ±5#!P/>?ƒåI±„"̽ýî4gÛŠ×õà2:wòï ܉2êó÷œLD/"§‚û.úö2:YÀùJª%¤Îö2}"»ôKàögrÞÍÑmÏSk²2õL’©&÷’Òä•\*¦:[¹¥mîæEuåóÏ«K)6Ï¢gûì¤ö¦ î f–.EÅ°èOÎC^FÀ¡fè.Ι®ôH5—H-ý"‹šFJ&¥æ,W©äå{À²{dŸ'¤¯€|MÏ‘½D®±mºwdº6µÛ…RmÞ¦»µ6tÞÄxÑùÛìG2í/øõïFµñ~;u¨ï~z›rÇ`s1=ˆ‚ }I¬ªæ2ý¤¨'[°œöÖ{㫪 ØÐÊÿ.ók!ä—ªÂþ–°9ŸžWáßÉ8Bêy©ó‡úžg”a©±UUYý–;Š“.0j hhÑ2IÛ1ª ò)Ø ϴƾÕç…©ÚK>dÃ^>Q]ó›!«k\"W©o‡NvIwi ÔFïDÊ î0<9B£5µ¶ä›ˆ|¾?Ö©äQúõŒ¿ø©iŠªS`9¬˜éyTe¼.º=_ŽYšð‚t?æÙR]ƒÉ}Å£åÐݬ:Ù]^«ŠHÍžh`¿éè͉šÝ6ø‚.'Œ·ûbêÁMq1ø:?†Ùê”4°—ÿ#•"ÆÈ–€‹6¹%J²ŒË·ÚÁ’B]÷…WSôªfÕÆÈSÑœ'¥ºàfünª&GñK¿ö2ÿîs“ì­Ñ`ô ÜDVémp|Ow2ò’TuYT¾ÇææëæÖ 6xÕ&žQëŽéLvU¹‚eë4º•JaÑ5p™En:é “²u3QǵziJî)úºíg.éÿ >±æ̺@`¬žõÕæ2X*Ó8%À2Œ’+îúõëg«¹#þ+`õ!/«VpœqIhµi¿,ÖŠ9e^îpýFE©Ñ—ÙLOÙ&,/ÒÍøä æ]H‰TÑ6ŠdEÙâìÇ>†½b½écY`Ñ'¼¶j;`·wiFR5pÆhµq¬ÕôØßÐzm’oaÅ#°¤;ä€÷;ëÒìÉvʼ!¾_ÓÉ\ÝšyÚ1˜(mcÇòæSã”*8¤gkOSN&Ž]oòLóx-N”eêòÅ;ØPLµ·Nüˆ2ðl¡µë‚½9&« s"·„©À6i=¾µ.ðMõ|ujƒžÔ[Qö"Fʳ+oí\hkèö-™5j£V®°kA=Pf¯-Õç÷T ¥6†îט·ÞÅÀIõb°„Šù´ÚÀõ"ÍÌk.Ƀ{ù=TÈ8`Ó®´^ 2Á8k¨ÿKàéU×5¯6­ÒUÍ©bÏheA†¶–ø1ùþRò©6°³Rç ä°‚‡b"¼àT—™Íä®ê)6 ¯Í\B«MwMkd•'XtÏ£ÿTTÒ9¬ú¡^QCd¸'éá§é(±×½Ï|ÝÄå’@°íÖPmX35ª,[ÃH¹r—[÷3´•À°íÙHmêêm óLÁå¥6®pYcTŽn”Î.2Â.upZm‰ýêJêÕÏ] zÆÔS2U2*ž &]Bv‹Žc©ÁÁôÓ‰V›`í£9ØvM¢obñ7õ2ƒ ˆ~ ¯6RÒrs>§×Œ\ºË£U ÷µšˆý ,Z%©Ú6«íZn-JÑ·möñ ·¨~­üîÖÒg */ƒÍÈ¢flúDò#ÞíÁeCJ#&¼ØS¢5ÃÜqƒÕåøYêí©ÍbFmJdñîÙèˆ:Ûæ+£ YI vÓjsɯÂM»…_o|’Æj£”‡‘¶M¾B¿‰½äc¬+k¶[­’jAfizÛAoøj£Üçh4™öDÈP5eWIÛ†<ö3,(ÐM¢ÕöðdDZñà8Jû‰§ÁÙeŸqay‰¢áµýŽÚ(I‹h^AÃÙÆiµÑäío½ûLâ2oRIs¶M#µ9ïÙgtŠf”!I5X½ÿ¤ÚHV±aSþ”e#­àëJÍ Þô0j¤6ÚÜ +òÍ"}ÆIål›újã“[v†5Î :µ± l¹¶0OëØȶ¸ÂØÈ_Uużv …Jm½ÍæŽÎèÕ:t×Ì©M>§Ø憱˜[*jµ¬p€%iT7¥6ôW½†ƒÃî*ôôd¼ƒž*2/?jÃ[Tê9䶲„KšÒ±?xÆã²=µ!Å[=–ɧJ‘Ã8ß-r}µ!c¨¾ –]™êu¾©÷¼"ºc#µù™PKû°`o>ÿk¹äëÕGMø¥Îjá¬é~X^zi|ð÷ô¤¨9^QtN‘vfÃS!”þ]¬Hµ‰kFmÔ!…Ï|è#“SFƒÝ æúmð»ÀD^]TÆpüHóM^Žké¡`÷ª©cÅgáUÏ\5Q! }YäOn‰ÌXhàøÆ+ÿq\ày5ñ»¶ ‘·ìf1é!<ëX]_mr3æo)cÁÝÞ¨Þ¦±ÚÈsÒgoó‚¸þ.So#œ›iÄRò¦·vÕŒ9VZòÍ„`òQM–g*™'Ëëaí"èŽ26¼ê”CY%_Ïþ^[€_€9%A|QÔËB¯fÔÆ‹'XÀO|ÍÆ/§[ó©¯[œ”ïx%Wú² ^®éèô(fÊð òæQŸî##˜!Š§pÀ¬„î"±›ŽÑtšÚ'-7v]A®¼ 2nï}ž Å/;–ý3ê^8.`;@÷Ú°I\Ðßÿ|ó߉»¤m£‘by`™g¹B…"ñÆ«™º&(|þ£QÐξ»¡-Ì ½@ûá5S-àXµæEðSìZRü»Ùw0äöþ>ŸªÃIÊÎßé‰SæÁŽèâÐX-Í’YÌÆð]&«;$toãEe!IõËqä;…m ìŽ_çúÓ¯*Ñá™À2îfߺµã8ÛªbªJ3çpÞa²Ehúf°1ëi2)àà¶àösã‚ E éÐ¥jOoêÇ©ö6Ê5¶0#-‡ÎÈâ >ƒÈ·U^ÇoÓŽ€EªbH-=: 8zÚ·îî6ÛO¤é·žY|¹/ZpÁnØ3>5*…WÒÇà@ZUK‡Î–Qwû6-F¾âSãâR0o©é³¤r…ç-s˜¯*…—ÀasÍç#–Ë »}[c»!©~ë„sbV^÷µ/bÙ.¿wÀÖ¨¯ÓÀSi·Oªî›Tõy°¯U›bÒ3 ““ÅLjæ7lÉ gÒ~b<)B™Ú‡úÆdè]K˜ù²x/—˜;NÉ3ÆÎÓ2ÐCÙTžN¥³]«6N¸Õ”^zdî2°þN}Føï .»,;Œô£W8SNЮ܄u~#€Ý’|ôÀí¹˜òe‚ÓÍÀn<}ïUä1þZµÙáKãÜè/wßµ‡öö=Șç‡_a¼¯üŠ'äÁFäÕZõ¨Õ˜‘¢áÖ”ç^·Ø¼CõISçmñÌ´·ù4á¡Î½±OÛߊöô»¹¿,eªÙÊ6Œvk2ç´´ïA)u§¾™Ë4±Ñ1€¹1™úSlêŸÈªWy}9¹ì 5ímÊÚZ‚Eã¡n‘¿þQê5 Nô›‡4Ó"E­&~?†&zø6Ñð¤ÉvžõŽÍ€ÿêú‘…÷W‰›kÐòGÛÛ¼îìõ;A«õë_ªA[_µJT¤ýÔ®»»¢™Cëš¹RA4G)ENÀ jæ‘6z:Ú“6ŸÎ È×Ô]¨›š‹’>©ª¹°M5Âi²{ãˆë_U£ËhêTêæ³{óÞzýüù,p˜koßáaÔÒÿ…éæÕDíx˳D™ß„íã½ë÷>‚¨ ñ]2ÈÓò$2ÈÙÁý}÷áã~KOgQà1&òÉÐj¢‚o9Õµ_gû^+cnà{+¤œÿj duì?Ñ"‚ ‚ Èß±f(¼ë:Ô$Æûïo±oq›irÿCžÔßÕDðç|4½Q]'zyR¾±¡qèÞœ;©Ö±¨xËôĈ?XÞÛu– êÿ˜¨4—¤«9°(Õ#FÈWÿÅþ×Ïœ¹q?©ÿŧÐD"ªÖö¶Æò¬3ø1ˆ*6o‹âM<8ò8‡^gŠâßè«F³ºhÖ•Gœà®øß«²Ü²À û2ýO Ú|‘ÄÊå›oÕ´ÝrË»µ;jçѤetF}•ðiLݹ7-’î­“õSÒ³ÈÝ·ó5íÇòJ¿=ž“ÎÍ8³-Õ—ÞPõ$í¬YÔ®ï2­u™ùJâžX‰È2íÔÖÈ]·ò½u¹Û3ïξègÒ~é>eJ#¿Û·#jÿó2Íœ E|Ç=‰×è ’/c÷åÉ5ß‹9–Êâ1ÇåŠèÑÛs ÕF.ßs^Jàò->ºÀŒ{"“gî‹Ù½7ú,='!ªbuNÀ´pTäˆ9ò<éø3¦/u×÷™žÌ§m¿Ô/ª,Ô8…uæ¥Q;Ϥ>VhïÊ<ý‡_a“vr{ÔÞG%Éd’ÝN<°=ê°¯û2Ë;¶3jç©”ûÌGz¢ÖóóøG|¡ãö˜StªËï%3‹Úï!ªuÏ9óKq¡È7‹>Át!;¿'K.þ-õØ‘»îkO+»C9à%–:gõ´4Ç)i]g[X¹ëv•V›­UµáGcvŒ¿B÷«®¬¸z03Á#ç»Ï“íéˆk_e\ ïå|úsÍí© ™$Ã;¢vŸ¥™Ü!9óÐ0»VS?>›çE1Ïø– r(ñJ’BÏ,8u¹°0²à–Y¤ÙéÔÇRíùÊ÷S1»vGµhÚ#_]ihÓv}¤™“”jbjÀjQͤ“"ýZâ—;¢ÛVdhoSr‹Ì~Qýjܬ“/J³ yƶè¯pFÞÿ Ç7~±ßÊ»9¶d¹ø> OgïŸå[_ŽY ì!)J"¥Âz´ |œéä!(%T)­a]ü5›ü'K]Ûÿ‰Œ )k¬Ëª¢ÎÞ+L þ ;˜~ÒºàÕŽ€Ñî›™I¨'»u1¹”ëTj>Øv”ɬs/dHÏîd?Úø¸¬SQcÛ%J}h™{g46dRx3KŽ  æÎnºŸ”<lç8¾–~³\U_m¨É»+ Ù-§J½ðÀ2ºKÛÜ9¥f༧%é¶.O£ßvËkt{éÒò}àôeFêd~JÇ’?’ ÝÜÐ*†s 8B¾¶Qx³›ñÀÝ–'ÂfƒÃB­{:ôp)ÏÝ=ï:5zƒÇÈߊý2·5ùY^zµëë¿õU¾Õב‹€gRD†ÞÎ;‹¼æßÉ~¦&œáÿm/ó_¬ô5ȵåÚ¤PB¶™ÂùŽƒÁ—)?æ»–üÖ׎•K µl 0#ƒ,w1À¥ÅÆÔÈܲÇFÖW ]¢¤2Jmì¦Îö_õ0çé®À1à0ƒºÓü™àòÑáGî懑W°Â F‡²*°8bÎ+¨ÎJÊ°––°1þ‡W¹¿~âݳ«?Õà°²Êw¸CËÏ’î‹ÊNû´´ÿEžÅõ„ÏÁrõL n –Î 7'? ©ôYáÒbT¥WÉ…çÁ¶Ã…Ìçϳ.õ´ËT;…ð‚£`Ùõi‰G¶‚(«ziä°†îð”ÒÅ>»ô0ã»w8°#'‰PKV;°ÀݯòŸàö^_g£íé1„Äl{VcAþŸ ê˜·‰d^ñ"`wÔ53óí±%ÕU¯ç‚Ú)´£q°­Ö‚ ‹Î)TÏ…Iœ‰Ì1 ©‚û~mÂŽ6àJ·C›âjl–í˼úìâ{÷ô©R± ]ÎLŸÄ?²!RI\õ‚ ‰šÐ’Û`5®\ÏSj¶W¦5ܪռWëÛ6ä])Vð îÓÓk¾ïl¼/æ³Eñ”öÀ–U®shñ#Ÿ2`V»ïMØmJ÷¾ùÍ–”J°M“óotó_7Ó…”¥²ÐÈÖ X3QPô 8ÌÖ%ä(;Ãû•Tlû;¼õ˜>H4Î>*ªd.f"  ‰òŠ_Àn¤.ÔçÖH•ÝsczDv™<XP¢d†g¯Ç‚µÉaúj3ØÑðhas¿FuÊ‘Éb šÝËG³`CJ¡Êjke ó¤,{å1öX­;Øôª ·ÎÛ¡5tkÞÌœÝà¼ZwUýÙ`.ŠÂ`>ÕÛZ©VVVÙëúÐÍujó]1ù˜$³Xp¶\3·E‘(_®®7m /qpw·Ï™sʊ׀5äÈGØ™§é âïÎJÊ,‘™ƒÅÆdtï7!•š¨Å'b >fžkzùó½I¿Èé17j4c¬•gÁöôXT›ÿ1µ¡ç´¥Þø•·€m4Í{½Lïo×êÝÈëú}À?¶kÑÊeÜtú€>“I;ä{ÓOê2“©¿š fÐL÷žÚÖ6•Q¹‘î'¥é¹¢ín6­ë÷¯šb Ý™³“ñ pÓsß_Ó<¥Ù^™DjòÈÞq¤Â¤´å.VÿÒÁû 2£ö´6NSY©ºÅ8‘E­g–PhÑÆãR÷úY&(©‹Î'ÁNX¶<)è·ÐŽg« aÕp©«kå%o^çšäšÖ… ²©®ûÚ¬Ob|¸^£¹àilø¹šÈ9Üv¦ÚP=8&)ö„ø>ØŒe&èÕÚ«{µ6eöú4TxZ¡ñæ^ÄöüJ(²vO‘¶¬›ù4¥6ºz©/Xw/"·Ìç“Ìí<ùì{jïŤ£-|T@êŒäûj¶—¶¼vmy­ ì4ãÛhÕ†ðÏ>؆ à0êl¦u®TÔ ú‡—8°àsÍŠÏ€» û[AOSMóVÆEJ}µ©&Œž~—ØáÒeff½+j~N?©ö67zÕWµ8¥&9¹&9±&G‰åúo«6Ú>ày•÷ ìÞit„P§6Ÿ;/l4A˜~ð›ÁSGßm|’&ú€ËÜ l ;A›CkfÙÀžª¦¿€ÔSzÛ—~¤8éû»ç#~©Y﨟 "·kdµ4ìÞ¥Í3/`-”îv,}YïTËc€ÛŸ©^8åÝïLQúNo¸'$â Oö svn½¼¨D±SêÖN>›ßlµ¹&¬§6¡¹'Z»Ío†´ml'ˆ4jc ¬®:µÙíM©¦Jõ9£6b+`÷jƒló~½Úøè©ÍY¦`šÇ~Ô3èhƒ‹²¥Î˜Ö8éFÓҩ汉Cö[ˆ—Õ«Ú¥Ô&àY}µ)h$±VmäbOà f¶vë:)ÍK¿»¢æ9púêÔf½g}µQøt·ëÐÉ®“wV%–뿽ÚÈj#€Õ¶@Ûï$¤Ô£ŒzË×õŒî—µ¤‡âÐjS”½ì×hóò\™z›Æj£Vñ[³ÁWÌLY: Hˆß º±4³Eªó}9zßœÈEÜŠÞâ:ˆ|1÷÷ՆΖªnØî=äëjâדž-gïh®q¸°ÍoìájPî‹Þ-ä~ÝÞï7Æ!¨*X7 曡œÑ¤þID^FöIW(I¯j¢ºìpÆéF9vÊwbf ½Úˆ–À(ÔÖ{ºÔ¨Ôúj#—§° W® BÚ@›ßU›—rYéI*·4e€MÚø3óOm*‹Nw¶R;&ª}ž³\Mœö:%I3*—[êl¨gÛ$ª’YÖºúøU<8YQúzµ!/n»;¬Lמ—!¦3­6ä-Eäêís‘yp cÀå(³ž{ªûbBI^¨ñ1ûÚ4ïIáÐ4wµa4›ÜN›¢,óÖ}¢ä„¾Úëƒ8ÐÕcÞ³aö0(àl}µ¡bØèѾµóè½1û¦8µû¥ò¦Õ†43Ôa)³ÝfiȺw ûù¡24†ôÎú¬Þµ±)&ô(.‰ßµpÍ7_»ƒË’_r™¸Œžî×壤¨fÔF¹Ýgä1—tؽ+Xƒ;ýJuL_lï«5ò”W_r—ÄÂ'ûsÒ‘<^¥ë¡™Ø‹݃OÓ¿JZg =Zoñ;l°ª¦º _ îkd?`GÌ9®]H¹`F}­ÚЕ-C ìzm‹>°Ð½'ؼ—­Ô³m¨ÚQÅ~hÁ~(n_Þø÷ýÚÿ®Ú…}¯3´´q8n_'ÞÄy¾í(µ!“­¡‹Ç’-™É¿§6ÔUóëÖÂq讘ý3\:Û”4®ªŠv€µá¦ØS Ü»®N|J&Ô¦ø‹¤ íríjè4yCÒó­žÆGìŒÞ·ÂgX·(T’‘•gÃ#¤Iµ!sSµà ùˆÇ|¶+|y[6œ*eÆΉïfãü–÷fÃç¥Rm‡×ÚvÐÉÕdm€ yê+|ò!Év8A+»Q_ÆíiÏ›2ë5Öÿ¡Ìäkl`ÞÑ…¢äÐÊÐpAœ@ÉL>©Lá(µûU5IU!•!ñÂ\f·Dš^]\×’L-K¯Ž&ˆ®N×Ö‰UáÅ2]U]£é1Y,J£ŽÌë¾€++b¡!•¡)¢Mž“„V%j I¢ <¸24_&-Å¤Õ µ$„!ѾÊR«Ã è…fŸ›­™+@,Ž ®ŒaR‘È‹CøÑ­éS[›@î’Ò»¤òÒ~T­žû–,M«eª4Õ¹U!UÌè5²~P¥æ «Ê®‰#¯6²*¹VÛQ;G™)aš›©’øaÅJ&ñ)[‘¾ÍmMªÂ»YÂÃßm)«Íñs™@ÒÅžˆþ‰UU=Ã}ÌÃjºÁ•Ò¿£¼Âùÿ÷òªþÿmØüŸRPz}—t¦Ú‚mëíi¼?$¯äj´¤‚´Ù‘îøO}²ÙÅ—úp y›¬v{2Ü0«#È›ÐÊ?SåÙÄ`RÿÌ”ùWÜ&‚ ò¢¬H—6xE¨ÅbþëÃñ¥9eŠÿ^åœTžŸ-þ篲jiN¡T78?‘/Ϋs­ÎmzûëÞ»”$Ϊ”fˆË¼¥²ütq¹Z$J§ª— U(3K”¥[ $J­Q£TVf‰ ô¦²"䊪Lq!¡­&­”e‹²2EY…z¡¨ʲ,‰°¸6[?ff©T**jóõ·äÖ3Uëuc¤ªå’j¯8·\&¬g:¨¥Ùôg‹òôÍ ¾$'«¶HÿfËkó2DÅ*½fR"IV¡ü5&¹¢ zfB$/Ó¿ÂqH¥\_›2ÕârW^m¤ùü ÏÕKá|I©~ |“Ï-¥ÿ‡€»ºA2×.—ß™õ~ü*ùïUƤ iíóÛ~º{ݧGûhsXm7$+ß…ºŸ½‘KàÏi !ëÅ‚”ª{`Þ>B]o ç;MLq%%s& Ž•’Z'i\ÇŽ÷O.û±a€Ÿ¦q]yåQ`Ö 7³è*8N¤‹ƒb‡ÛhœÏüٞﲡ§×v ùFô[˜¿'`Ô`—!C]ßiÅ‚–ö‡¸ â2ø~åAïa†ý'Ògã>¤ÇlWi‹3¡LŸjœúwå¶4`ÁبgJ] T¦Ntê7й³!§¿´nœêªélV8½rºÍ}ØÀ­Šº6š6~01ë5c€t±O1%Gì” ÀíÀ\á8‘m¹Æ`Ù:X¢Ñü¬²Ș[p[÷uêÝšcVmœ„¯©#Nín =Ý&QrØ’à¸IÔŒÞÛrÒ—}B7·@þ jÓ¤3¬nfÖ{êùÈí3·qCýéÕ Œê ÓÝÜ«…ÞΨMó.{“cª7ëøkþ /‚ë7oPýú‹j\{Àü~.gÈ¿ëÜàÓdߺaÒÕ9Xà'–„D§6#¬à@¯å­*¶§œ®T½^m$âÇ`Û¥TgQª³YÀQ£ždgà*Ô5Šöµ²…!ãZ²aA5±u­$¼#Ϩ»ÇÌöߦ®ÕÈùfX›ñ‘Ìì'jÛÀŽëó ¹s?ÒHpŸ6Ãó`w}DÑ… ŽÕ”m“Ux‘¼†¡ÞóðZßÏœ ®×ÈË;8x]ÉÛéÂQ~Ì äjNp×ó¢Éµà´ÏÀu­îÂR’GÓ!Ú—h^mb%>Ë-ù=µùl J‚CKkQ ›Î%u>ŒbcjóR¿ýì "=(¦d?X½—_.qÙ°ì“£×ϲ´ê¾AmClói³15¨¸ì8ŒÑI©6§ c¶y·Z•Àc6ýeµ¡&ÞŠœ>çÉõÛ½{®ïóÈ*e5ª×«M­îå èÁ—^!²ïÀ†®n3çz 6²ëá-•åæ~ÝÓ¾å ÷{RŸêÂI¼V†N£øN¶ñþ|j†÷ÈŒà0¥âͨüL·Œ%ä‰`cà&W×,§SÔ2{›Ã&W·`C˜„*»ü:Ï£²ex·ÞAO˜˜6¸uÜ’žºÑˆêùH›<<$ˆâ®Ö©™µìzêC!êg AÔÌeÄû®­gx?˜G5Žµk=!5+5m*¸ìcF±©ª¸ì±µ”Ú 3dw®¤/¤ºô0X(ÖË—jµ¤,«èÂ¥mkÕÒKE¼4êø”9ä3÷^`OõiºÞ~R”] ”¹R+åFšôbfw"Š¬GŤ¸©»ñÀ‰V›õ.ðIj(}þ([÷›QÖÓ‚™ªuåõÔµttCyà'ÑW“Ð͈5m‡páb%S¹QOmNêµ¢‰ÊÙVCU¿ëIÉOúuV» ^3'ßË’«u²#*ß¾õëC«ÍŒäºùbÇ6,¸[M¹½êc.,Ï,ü3µ„©]ÍasÚ32 =Êzp2rywjNg¢x¨%ü ÔôVÉÁƸPE|áÓk=»RÓÉ fo¾—ç(Aêm¨ g…¶K?áÂÂ"A}µ-Ô$»Vmª.€+3ˆ œ©jXKsÆ–¥Æ‹Ä¾Àé&ÓÔƒ(ìr~üæ SÒ2™TÂb ²ÉñygÚ{~™6¾{õøT¢ÌÚšºÜeærB¥*5²íøKð #T]LJvmŸ\éíý yž_}Œ{Äxi‹•Š/1õ6->ш‰Ò^…(õêrU¹-Y c:A+í³$)Ufv0?OÀd!˜i`·QOm”'œàju5ýM<·F©É“ÙE{ZpgªëÔ¦f¢-\h ø/JmÔµ™µºÊØ’î–”éuÚ.UñõŠ‚t ö–æÛ„+t•)MÕÛP1'÷³óÅHêKá4E°<ˆÛËkùË3yËšôBo·‡©µ‘5¼(Íes“×w¦‚®·^¯‡¥Q¹âœïùPR!ßfn°S¾·¸uëò]Š(Ã#ã àL&å "s!p'& ³3ªÇ¹µ{=µQ–° Ë©>ËĹ€¡ƒƒN¤S 32nG½×Ûç’žÚçB òÝ'Î /¾×Ë¥-åI)œÉ·Þ‹ŠòvâËž€uǕȘEÊzý²Âòvpß5²_ ª¦k‰É½éÛ€7¹R£ùÊÞ}gêT[};zØt´¤_ÇáÝ–6°7Ý6®:1±:Þ*õ °jñXLħïZÿÁ¾®–˜ŠJBišŸDÊüŒÈ9Bº“«F b"ù~;|:ÛõÏ’“:™3œsbž$|¦²`BB8]—ÕeVš«þÉŠKÍ€=I¢®Sƽ<ëaì¿VKLÉ[_6\*fLåß®`mðS¾g´ Ú9çéjmIw'E¥_—¥'T'ÄWÇ…”<%ov7ý^ã¤|ÜÂÙ4Uœ“%Œ™ÍÙiqäÆý¾ƒfD^Ë—Eæïî¤Øš423xg¬»U¤_nùyÂ-ÔŠÿIÙ1ÏSł߆8vèç67˜Ö‡šâõÆžßÑ9æ`?G¤Qé@§ž!’¸w¸ãŠô¾q–Ýáؽ«Ó˜gÌFúàß"ßà1C[…Kˆkìyîbßå=ï•ÍêÐØ1í¹SÊèŸ÷M+ûq9ÚwˆZì¶Ð£gûÎsCÏ0M7’ǽh›¸¾‡C— ùÌø–¥÷º¸ÏÒ}”¾³¢—}çQ~[²•š/õOb>èáÐuNø5Yå~°£j‰EYT#vîí´†²ÓéëµHÙ>ȱKW‡~Ÿ%0­ê‘.Ý<…UÌhŸ'‚&v¶ï¹%™[”3 <îQÝÒ…ÎK¼†·3Ìk¹Ÿ„Õº÷r\!S×7ôåñx?+©ÑOìåŽp¡¼–¡Ž×ùl•Lß-ØçÕvAäSÝ;4,ÿòD×~Ýú~ùM…þ ÚÊ”]!sz;tïæÐoiø‰|Ê–íqîb#mðæUìq1ü¬°®ÝËé“RYúgä…jçl&ÕÙ Šœ!óz8ôèí<âp:»Î‚’'®öÞݱÿ®4f°ôÂ÷ZûŠ$úÍTÊò^Ž½Â¤ò/}Ç^(ŒÔÙœ2YRW‡žŒÙÓ ÅÃí[ú×R²ï˜¾kTà.}g.&uØ-*צIAù¯s<÷tì1ÑC¬TþÚ6™£¹í{:ôèA/ïy½o[Íô"§BD|;̱s§w/æ'0'R mÞuì8"è$ù3±ð»1Îݺ9t›z¼†Î½ ¹§Áe1jò*…žwsc˜ o ~ßþ…HË-yåLaQ?÷7èŒ û†­ë¿°y×æM{=I“¼Öã“B^ƒPìEÚÛ#üÖ¬óKº ¿ñÿÊGÌÔü#` ¦AŸ-õ¶£Ä‘TþŠ0(Åì¯ÎœM<[9Wý纇4įàÚ™†qž=›éþf¯^¥’Ô(e8Ý:òš7UÏ'/N¦<÷¤"Yí_yÒ‘TKó«ãjR+è~a˜çþÊÓPäÆUÅÇW7\äÿ™R*Njg¬°AiÒåU«ë¿ãnlä«ÕÑ9æMö§j2x½³5çÜ«›º¢·÷²™;m6½ùƒ~*X·ªþˆŠ\rcªÞT)SñφÏ'·“ËPß Y 9Sö²+ž ·£›ƒÚz!à3bQp½7‡j&ÚÊÙÔQ(Õ4IÜØšmÐŽkÜÞi²%5ã-3IBþ~ÿ~ð’ô|úÊ*«©N-éV¦­·§Ú눺 EXÂðìÌ·(5jáw‘K™;à½:Q*Ñ×–¸Ümà¶YM2äϼµë÷€Öۥ̖qº²^ƒÓ—±“Z»-cÖzuƒ€Ÿi­ˆëf Wè1„ü›`mLMû¨ðha 6BJ¬Rò¿Î@ê;rÅ°Ë´“Ë(8 vc©ó(‹È#çÜ4´l“ªSEš±9ìɧ翓ywµG•íÊOyÂx{˜š›M4ì„Þä=ª›3T4ð«›íÄ%y¶¡ÓfÃy¿à{¹~äêo½Ú-ÊŒÂì„ ¯²Ð߈^L5>·…É!ÇtÛ_Cp Û¶ùe'× ¸½®xkÕ†ø-p0xS-B îñª4ˆ”ë³²– ’2·ƒÇ&MäjÙŽÁ‚²À˜IÆA?h7–öµK)‘0 ¼j ¬„ VÔÔ± ee a€ekÚÈå…÷3щÈ\wãS¹̤Âܶq|a ­6äí ·€ƒ… ‡ƃ[Ù;ÙÀÆÌ\B­tÏ:Ü–EY_³"¯V©ˆè´uà°Dwp@tgp%õ¤¢Ë+ø¡‚ª^Ž)|h-izañwë}ADgîÞ$ÍE©bŒ¬!G•ÈÒ,Aq3ü¿fÖ¹ñczY“®I.¸ÖTÕ×Á¼?íC¤èšÍËwÚòbQlÂXð<ÏŒŽ+²Áªkbó¶ ݉.°+NÆ1?C²ööó=ÂìµóƒiùÅDóõ´S]àj!3coÅ(fÈz!W^›ŒÈ/úœ©é¹ýbzu sjªæG}Ù¿Ø-.Uªˆ&&u`xŸ¶áÖ˜¥¤i­Ñ+›iáÏ1ãÛ»ìÐzRÂgᳺ†^`Šº\–ªµmôý Å ¯V݃~”êY)Y;Ác£®Þf$ÇàvUEHìT£@]½Mqw+`ˉÏ[-ÊKÔj‰`¢4­6L/Âö¶`-(Ô]¶™§v F4¨¡®n4w§´Ú0SKV±aSycÕÍd Î I?[p—70ª(Q½àÛ©­ÿE1A4S5£ö éÖ)Š™ Ašã|èìÃÙšîÃ)ù[íWêêm„ÅÁf(ýˆH]¬«·)­ õdQ~PÆšÎ^[uro+¸\Nu(/» Ví©éh•þ­­ÀJHõ¤‹ÉÙ œád‰õ‹îΚñL¤Õ/ÀªCt]9Ž5´hS¤‹SU2– ÷ªäÍÝ…=eÛ”0ÖTh©S¦LѼÚîÉ3[»j†b.,:9<ð{æ´/cÞr¸ï©ÔLï=¹‰S­ªàz/6uX[—YnbÆ<‘~>l :Ùµ6â ¸’OÕ«—™ib³dâ;9‘_þ³æ§v™—h©#枺ö6µÃ-áXQÃéF8À·)»HUs"tu^žQ{çé.ÂJÆ|©à¿ ½ª¡ 1ZÍ+mÿ®UæŒb-«þ¾j¯"¢2v‚ƒ¶Ÿ;¡êÃvM~”B?âLi~¿vø ÝF•º¹Š ¢©¶ÄM5€i~|û¦"höJôWÈUÏÄÕß ÔÍÙä}5º@M¸þ¯&¯J±Ús6óCVs8S«Õ¨5ò/â`øÎÚÿʉªù¿mKõ¦…Glʆ»5B4ly«ø§ÌžçI Ö ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ µúŸsAþÎÈdÄÔ©ÄŒoq™2…ÈÈÀ”F;ååÀ[_îÜÁ”FTTAPmAµAµAäï¦6jòÿ»w1¥Õæ¿`Ûä;ZŸøøxL{AµyãKÜÎvzðx¼ððpL{Aµyój³k—½¨6‚jóOU›òô@/j­ùFÍj¦Á3ýn‚ODŠs‚ Úü (õ˜5éƒys<G?Tó&oÒk.?ïþîE*æAµùSð£¸&«vdYo³‹£ÖX7Ôr‰¨²¢¢’_%§~©kJ¼L§lÍTÉTD­_-’3ÁÅ5Uôa2%Z%/¯j¥ ’Ú,–)1!ª ƒÅ¹Å_\ • ÒfÌšS-W1R#Š³œ2ÉdÃî#›?š5oÑ.%!te—É”¯ýt/OA˜Ÿ[¸óÇhò°¸'f3gÎüêâ÷;V/?G9¹I3vÆòŸ¾Xpë™åíÓë'û¨Pþ: A‡Ú¨ IÜÌÑób”-óÕBÓ !•ÌŽ¯>™üƒ}c¼ì_4ß"[F¾˜4y‡ˆÞD«MŒ²&ßtÆœ,‘‚ rq÷¢3?{ÕqcÇÍ°.Òœ`Ç&1˜ä_®6¤ÅüüÂÒ½W˜ŸŠ„Óç‘R«EËÇŽu+§*uêàÔÆLOmb«³]fÍû@®R3¦‹ÃµÃ+Î< Dñc¦|X®uÇ6¯šiZ„ùAГ:½zê¤ ã'k˜4Ítjli-Aä}0z¼ŸÒ‹×¨ Ó~Ö¼å¤ïÅÔö¸ýxtÉÉÛ„8~ÌÔ+µPmÕ†”Eü³‘“?ê×ᘽ¿ê§`reߢ‘ý«h­Q;ݼÌÎ’ =)Yy’ÉìyB­$Ý9¾öÀ<¢&ÕAPmpïè§Û®Z×ÛTÊš>~q‘‚ô°Î™,Ýäìàh~sü”¥¥J‚¨v3·íî] ÒÕËÚ¶tÍ©ûaQÑ^ì{¦& ÃJÉÃPmÕ¦’k_îðN—Ö9KôßKg¥óÉ•Ì@Û‡ž8ƒ´k¬oŸ?pàXláóâômv&ÀõåÝ/B¬·AÕÓAPmPmAµAäXm Pmyë(ÄèÑÄ„ uËĉ5C‡V ü¦–šþý==BµA;MÍbéÈuu}S ÇÍÍÞÎÕAÆxzzÚ¿MPmAµAÕA¤ÚؽMPmaðòòrvvvz›„„„`:#È¿µZ­R©¹\þ§Ž'O¡Vãðš‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ Ò4[¶°·oç½½å³ÏؘÈ‚”•‰Î½ååìOô„q‚ü›)/œ§—oÞÚòõ;¡˜Ô‚jƒjƒ ª ‚ ¨6RmÂ0©Õæí«Í¹Ó§9qõ)//ÇÄGT›7½œßµëW)APmþ©j£¬KÝàwÓ³Úü¡ÕÿQxAµùÇÚ6±3†N ÖýVŠâL'O(ªýë1Þ?:ûð½XÌ6‚jSŸ¸9#L"Dúj?gúTZmÔ ­uF ùS]<ÓŸO,8ú ®ap¢áa‚ ÚhÕ†¶½µtÞ¬åË?œ9gÅo>ùŒ¶TÅò6,;ñsfÌÜýí#&T¾çƒES'.ýhÕ§{®\:±˜VB˜â°ùÃY,_1ÃdÞ¹'>ÔqE^ƒ¦®uùaóŒù‹j”¨=òïR›ùc¦þlçå¦ÅÅþ×YŒÚdYMšøQ -;ŠB¿i¦³ù´>üøÕ_ý²è°’SÇý”¬V+ÅógÌ°MSÛªBÞŸ8öèƒxBR¼`Ü4‹$ }¤`ã¼1æá|¢2hÜ8“Ó¶™õk‹ùW¨Í‰&[vïß«c÷Ö™Ó(µq8g¶èä½Ò‚\’ü¼´ÍS¦?Ï•Ó ¡ÈHŒñpqrpv:ùÁ¸ƒÜJ…0fötÓ ©F>~2›vôç„ŠdÇ —æj(¸±wã{„ xÔ„ 1K!zRzžÔ¯_~>ëý¥«W¯bXûñÇ?ÄPÖËÑ•óßßtÔÉ; 2&êÛecòøòJŸ™ÓW)4¶ÊƒcóŽþœXca:{î*-kÖ®Ýߎ¨ 9uu5f)AµÑS›€«{ž~Jh>j«UJ•š”uâ¼ñSRDÌFÉñÙ£òHÛ&a¶©I™DÍÔ _údÂÑ Õ>¦ ?PiÃÓsc¤'…jƒ ¨6 Ô†úÏ=Ù!SFn”WÄΘ³¨HAêEÙ²icòäÆ€§çW/7Ýú0‡PIÏuÍ»€ª  ûu꤉T-±R°vâÔSv9t¬ò+§?òÊGµA±ÚDOî7*´^{›˜ÉcFÒ5¾‚ÌÀm+çM51Y°â‹Àì*æ€dÇ;3§M™µ`¹Up~Qø‹1c&]‹•Ö‡o\4}Ò$ÓS}Ÿ[²ûGª‡©¼¦èÛÝkM¦M›>çƒg^‰”ÝSá?`ä’*ÌRòïS›×¶%V7 ÿL®’c:#È¿œri9°àí.¶p'ã&5‚ Ú›Öö[[PmAµAÕATTAþ®js9úrI}¤R)~GT›7¼°`'g'O.—Œ‰ ¨6o\mvqwý¿ŒK\^”œœ¤%-3G¬¤¶7gT©ÅEñ©…oð4öý¿¤"#9§ í9Õæ©6¿Ù1ç£5öí%Ù½kû²¥‹&_R(R6w¼2êûዾ}³×pdéâbz%ÝfÇÊã^¨6ªÍ?TmÌ6]~©gf¨¿þhÁ'£ÈŸ*•R¥­8R«U*•ºÚ¨é­LHµ¾Å¢·W³ŸÚ¢¤×ɘ•Ú‘½h̲"òtjÍY˜­t`¥.næ”LhÝvµæÊê³,‚jó·W¦”»ì{þ9OríüÖi×XyÌÖ´ß>1Ýí^Om*–L7]òÙÁc{ÖÏž;?±RÚ  Ç?ß;ÛÔäËÓg?]8gÚÊSBrS‘ÏèYk¾Ý´ðê½_¾úüý™sÍjÂòÚ>“Éó¾ºt5H@¤¼X7{—3‹ÀïÇY&S¾8tz×ú¦/Þ˜OGXã½oê¿®]·ýÑÓÇë—ÏÞqþ9eЭ¹³¦ï;rbûšùÓ§­Î’¢Ü ¨6_µÙ|ͺîwEÄ’ÙÓÌãJÉÕo¶N¿Æ֩ͺõÕæ项ۮú2{óØû§¬¹]ç}© EeÚÔé ÒEš’xãìë6QD©ï˜±ÓŸ¤«˜›?˜ó,4—L½¢ŒÞBªÍœ]Îäʺ÷§Ú„—0‡q/¯øxï3rEpØdâÒRº?™<ÑjÄ3råÇ&\ŒÕœ%ÌË5»¼s,‚jó·­·1™6uÂDŠÉ&¦&ó7¼tÓ”Þתhóä1ûîXYÐX½¼f:áýb½~¥% œY‹WZ÷Êâ+³O®Xå~#§¬äk‰¸µqÙ¯"±?©6%új£Jž?irºH6ÍçѼ5fŒÚLúè–¦»ÄyøÔ "2ûÌÄYËO|w;(±°ÎDT›¿©mcŬWÇ¿4·®V«¤Ú\שͳj#øxÜø¿Ø0jcaiiea]­¨‹¶0ÆrÎ’OU!Þ7»>üöQá7rÚÇ"­Ú<üü£õ¿…6¡6Š˜9¦gI4a³žÏ^µI£6«îk #­ÚPÎTr˜Å“ÛÛÖ̱dC\‰])Õæï^oC)ŒòæÆ9«Î;1ÅõÂvÓ«6YLáõ:>¯'uaÙÈsN|­)!ËUúÅ\˜ehBjFjâý½ ¶Õ‹UM¨Å'WÌýâ¦CFVV¼ÿËY&sB‹I÷ÇwÜ”Ùw^IÉÈJ²š1yFb™ŒGÏnÊŠJͨµ!/ãÑ‘ ËÝHËÊNöX>iâÃHI“j#!d{fO:ýÒ3%-#5)vãÒO}²Ð¶APmþžjýùõ‰_ìëT‚ âïï]±ñ{º²Utÿìžµk×]|â!Šº¾ñ¬'¹[•ôèÃí4)g¿g˺O×oüÉ¿A ³n~ãìúO×í<ú]¾ˆ2hHµ9ýS‘4ýÐÖO×oÚé_(eöx|æ“uÍãeYvG¶|ãÏÄâgykóúO¶ì<!d.Lueí~ ÚTø¸î˜˜6«}jýúO×oÝË*&PkT›¿«ÚüW¡Ôæ f)AµAµAT›JYy…=AµAÕATTAÞeÒ2cŽqû.úK{Nûöì7¶´d·4ãš¡Ú b™oiS`£[XE¬ó®çOòN6·œâzÍÞÆËqÞqO{OTAãéYOÞ8¨6‚ Ú ‚jƒ ª ª ‚  777îÛ„Ãáa:#È¿µZ­P(jþ B¡°æOBžÇ¡CAAAAAAAAAAÿœÿ7þ endstream endobj 626 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 148 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 35313 /Filter /FlateDecode >> stream xÚì½\TÛº'x_¿ßëéž7ÓÓÓ¿žé¾ón‡ûî=ç(*ç*Š¢È%'É "AÁ„bV0Q0!’ArÎ9E…½g‡ª¢ª¨B=ážsO×wŽºk￵Ö}ß·¾µjHCÒ†4¤! iHCÒ†4¤! ièwD€†Ò†~Iª ÿù߃·?ü61@Hù£ôä  ”è{¹ˆkÏò©€j„Uù^UD`ƒð#¸ú(&«âØ—‹(óÿ§ç+c È_%öjøj~Ê•}}b¿æ€_(qYÞVû1ôÆüÃÀkï~ÆÊ \ }Þ=óã æÞñD,Ք͢Óèšéµ&ô^0ñ„€1®…l/Î":H:Äj‡§³ÁHŸ@&虘96Í£¼N>% [/|’Ïåu¶;O}µ ?ï77Á’)t9bY{©+^çë þhRöfàZ}ÿyè¡©4G"ʧC%à_‚Y{Ìið/OÄ©è—äW]¿0˜l(ªÂŸɾ68#:‹Lb“1tc˺qøKÃÓDìºZ¼ê€+]¶zZ©o@)(¹YO=nÔe‘JQ)d"‘„F!Ó½ÄÂZ††L“KˆFó¿>EŒ°äÆf\˜L$C<Å3$^R°•Jç["+)¯ÿ#ÖØJ®è|O†¾.Åoq ‰„$Ò±÷_Á•NŽ®>gÛ ¹7ËÆxýþ%øéö© ‰Ä//…6ÂC¶°Ñ_T?´>Œ[ý«¿þÙoVÿ=b€½‰Ò ‚‰Ž›cß®Ž6^Å J­|³Y\xÌ­áZ_¥QÝ~ÿs kh£,V(ƒ!üø¦%;— ò×£¢*TzÕÇ2bvñÀ²Ä95‚Žâ³úl7mžRæòhó¹$›ê²z f­iøè¼ žý"jxš®mÈx> —U8YLam£í§ÄhÑ¡¿&·’é.j‚6V¦¥_ æ]¯3ÙVAXw| ?Šu0zh~–ÊÙº£3m üΨÈB…˜¡šQ*Å65%ÜO=;¥>Ä\ß 2Ë3©ŽÌ®°ø„'m7Œ™ ÅI¦.{Tö—±êë:'´•§·¼ÒåZœnxL°t[û-ª¡j‘ºD*JeÃ=PÔ.û)žûlk„ûÄGÐæ5…±Ý‚‰/n]@‹Í¨!pleõ˜):B¾xÊŸò|BR/@¸ƒJ=Q5ù5hÃÆÚîp"8(åÉ2‡d4€ ÍÝØ.G.nÐ|?Ä}}Eó}ADT‰èèOiÞæ1TÍ€²ø5r©Â›k3‘3·á2;À±¦<:ÇmƒB^w%¹\ëûyd(ê|¸ù¿À ó‡ÿž³Z“mìÿø‡?yžð›9¨S¾1A‚ýüoZ`a3yyþùï=@ŽòéŸÁìòÉ×'o§Ò¨6Î.‡ ?3Φd‡B$F&Ü…¾N=ôÖvÉ ô dÒ™gÔ(2³ƒiH‚ÏâC²ß-‚b!_³m´é»¿ƒÌ)jU÷ŽXÚmOGd›b5|›5ëqÓúm¬ú×cw†(C›OÛ¾’s]¯3,Ý’ž·³»‹¶ºÚ8ïRUœnc°íþ¸Êoµ×³ x;[<Žyèz­ÂIGoyz„zcÙŽo'…Ý—|6Û&Ébe¹iùävªkãO³íèFÞ¡1eŸ×wÙ™žª±3ôâÀl€Â1A›ÝꤥâxO³Àp¦gÄ”ÄÐXmÁÒU mÚxªÑfߣfù7uݲ{P´!`ü›ÂXG<åÑ¢}.쬲îÆüãœqÒ‚}Ú06[µw–éSç%R@›­‡.¨+<ÀØtú-Oå·Çia "ÙÖÖŠ@4M)†å7QuÔ_Ï% ܵ{—‹}®˜ïÒ6À­J°¢ÿvôfÇÊ;ŸKÃ7M¬À?»óþ3ôúé °]ZâóÞ¿€ÐÛ¨Æo{æaÁþåKc²½‹ŒŽ¼ BÚ!i¯+žÌ´³²Lºpq“Ž N´Ô¢»é»¡Ehp¯¦_…’þP˜Y;‡ ‰«z _u!m½Òù³ VþÿðoÀÌrp¨üÿf m|ÿþÃ?ÿLMùbðßB`ò¿ƒE5`s%ø§‚¡ ê+cüÉ*ëËÀÿôàþOpE}MéO¶Än3Ùá-Rƒ S¡|\x±‹`ˆïDšXØQ¨ƒušR,Ú¹ýÎ8ÎÖPO»c7êDÒQ¡ •d|íÖÝ;(ݽwîxFà²3Æ&µ] M{^_%Û¸KІ¼kàînÚ¾{è×›‘œã¥ƒÞÚ¸Ÿ<ÿäÑC)¾ªV6™[ã@`Áœ€+ä)É6 K¹t”Ö‰¿mVÇÂÂêQÙhaéu,—Ys\÷Iàè´e×s$¬ðzï‡EÈ|ш5´S'kJ;Rã«ûüìhV^— ^,¬Š×$\ ßÊd:ûp¨ªºeh¡ ÓÊíécùZ|ËZV4dN²aâ3?Ì)Á×z´aè²ï=]KèQÑ2 A›ƒ%k=yuø=Ó€xg” ¡$åv¥¾Q§(Ûàj-CÞõ´Õ†£N€ÊÚß‚6›Ì Ž²qb–\‰vÈ™ò ‚cÄïÔvû¯½†Þ´Ý¡²kA›dG©·Ekóˆ8ÿ€…D­(Uc=Ú0ˆ¡k)EÆŸ‘ B¥Ó`bÐHXšÅÑŒb©ÝFxô÷a,?¯®¡ µ<ÆÁì„DŠ¾c‡0çÑîk‹}Æ8ò«I%ÙfÛÞí\ÍÆ—Š¿Œ6ˆ lnàEÑãük×®^Ì Pis1Ø«E l¶V k 1—?p‡LtáÁ‰™2; ­4þÈëvCòbèî÷?Rë™î4–·AmÉÛLŽÞ‡¾ç„˜˜ù{[Ó8¹ ± ]vtË­D Äï©Ð!Û/«g„6:'J®•÷¾$ü¥ÐfƇÿûO’)ヿ"ÚüI¨¡‹ðû(©–ti/ü3èµmþ7©|»«ŒnUhÓgªeøzNAÕ„ÐÆÀ!Wö˳é|÷:Ó–ÄçÖ‚3ŸnQm–7´Û”ï¡0‚‹•,JE‰Æˆ E¨I­Sž´v=ˆw: ÌËòhó-šŠ6pV{œXG¶ŽÜü©š0ßÉÐ2 :yéCm}s[½I¯vT„  wÏÙj4Ìly0ÁéÜO?çl&‡BÕI÷çT¯*J6=lCCC-CY6 “COrc‰4×#=Ó«ët’˜ÝË৫´¹7Ò¤œ:ŸŸ%ÛíXªOÃá]E ˜öMšTÄsÉ_zÖÏ!èìZÃËÐVO¶;„dˆFj¥²ØŠCes¹–YrØ,Šï7kR(Ú€àà«“ã`ñÏ¡I‰†ÊÚøèô;µõŸ>¼€ÐfEö1É\3[¡Í ,i¬šÑ)ïG—Çìåz ”N{º%¬”¡ )P Ñy è¬í¨®Ô–²ÍäØ}4Èó« žnÎ ¢‘{ôeHhMñ²ÛuKº¬@]Þásˆ=µÛ|"iÛOªGX¬™¨Áê2ÞÃ*3âbbŸP)Ÿæ±ÛÀ"¡Alå¬odh§;êlh”QVMàØÀ-Ú’ŠÅxɵÿ²‡þùÎ…6pâ+¡,rLyŸ)óѦ8õ€mDº¤L#  ¼p™`g‘TwÐ…ý¨~JI ÈwÇú>þ:´VVø²–q¦Qov/>ØãlŸþBb”m.Ò£:,«_Èÿ[Ûm’aˆÐò/žÿéªÐÝþüÀŸBÀÄ@øáT¤K hó o˜~þGœ’…|›)3ëÃT™«‡},‚Ï@ï–Fj1ã!¸ðb'‰D(lÄ`]þQC«P®ÌW°°O[fŠã‚³Þ-~È?B±ñÞxM š3²¼™¬YyÛ¸P(\™é u16q• Ú@´Ã k`Ž R´;¿H(#P¨®ÖÐiÁ§1ždÅÑõ#>Á9äô²Xt!È‹·œ«=ùWúa)ÚÔüUÏlZÚ\¬MƒîÔ¯OÏ“q ÈÀàíÿ‰õ“ M÷}"ÅE›Ö/ú¡;p÷®v± ˆT®ãí#h#¿¹vjKÓ-»{êPMJ´ÜNÄ/*ÃïhÃeìºVO|$ë«—1;~>_¢2ÔºŒ¢?Q´ùuÉÉGZ/­ÁhãtI½¿äWIl`æ»e™3rFßêK,—ˆÒã×3h½‹Ë:÷TµLÝ ¤š¸€ ߤ¼% DßØŸÅ— ¢DJÛ´xŸ¿KÞ‡WEsl胻Ž™ëC½K-°þظœërVá§|Cómœ "²bõ–TýÖ)¡rP¸™Á¶ôƒ?~S”†4¤! ý}Ššßø Ø@–×~U›Ô>€êßÈÜ0ͯ­éÆ!oã’†4¤¡¯Ö„úËÿõ;-]EúîÏäN1X–s@KO×!}}=²iÚÝ×B@bâ.ß:ÍÀééèèÙ¿ƒ}áe#yµÿ—tuutõ˜+rVðîFZLOùΦþEßuB¸†7œþX¶¤8» ÿå/O¦^­”ïüÏØ@h´÷|ó—uuF[G¿wYø¥p5øïÐÓ‡k­««géú¾kfˆZìošjàHCúÙ¤‘Iò^@yGl‚N­ýžoµcÏ!ãšßçŒÓqÙ;|Ž7¸Ù²)ÛÏ e¦l4ÉÙTª5Š6ˆ‹V±{ÇÉ­†ÉukŽÚÑvæ6-$ó¹,Ö=ƒðŠeÅÜËùÁ¨tFuÉÓö0]i“@Õò°:K"Óú¥h£vû-POÛD-ø}È&3Ø«ª’EfØ?,àoÄh¯! ý=p©B›É±<ÚX“Þïo!…Þ†žïÄo³ :!¯Ï@²†³±Qþ›ù4—FŠdhÑíã …-c­<ËÂDÛšÔ¿±1Ô+ì#þ:´W*÷ÿ•›"‡6žL;a• Û_º+}mÙxÑ'2sY"ÛÀh3È7Áj}YE -ìùÆjADêi› ’õvP4Ó…!±Ç%\\>B%â),ËKÏ[ ß…~Fd •L"hº†4ô³  :oŸp±r9_=D˜n:Q0ªdÐÈ Üb—ôD=Úð<‰› {p®ÉÃ•í¬Ž¶3½V3Ø»ŸàuüÙ\y©e}VmxQf˜ «ípĹg4BÝèŠX ¾¹Ípß»&ÛðÄIîVÁ·jÐD^çG8¥ƒëЦYê¨ö"#€e>ïw6óM+A1(žð§jEÜsÖÊ»™U±F°Ñ†~Ú¥šZ†‡í†)4ÄÞš«‡q„a`Á÷Ã…FeÈ«c^”Ý×T¢ 4'ŸÕ±•l³ºDðLoG! F›ð"]„öâÎô#ÐæØÏWB˜.±’M£!vÙ5Ò€f›È5B9Mª'׳ ‘g€Žì&©¨I™àð8,‹ÅbŒŒpdã+¯úѤL zÍÓb4ðûÛG­|Ž€À¢ ò~N¤é?ÒÐO”m̼Â;ÛZ ªÌöÆÓw.JÝ!÷³8ýdRÉ›óÊNW˸‡êd›ƒÞf¶¾!q±§OŸŽ ó`˜mY“m´áµ?ÐÅ:Œý´Ùkjjj¦kH+“OŽÙrI$!‰ óÃæÌ»§%¦ðÓ 8P¢ÏݱΔË6-RwŒ•Ù~?ætÕ(¬£PV$~œíÏÎÓ]!Mƒ6ÒÐϨI¡^ÖÎRb¥Dº~ÜÝ~wŠ¢Ýô²Àç¼ìÏ<® Íà#*Åö^­bèÒo?¯(C¨¼ì‰5†\8)6ˆÅæ„›kLÞÓÌ·¡M8Ûïð­ŽW™cO$.{q½n+måäÑæmüvû3O^_ØœôB%Ú4Ê™Ë?5¦l=lŒA炤ÎuM=öjd ièg·Û€ð6ÿKxCNϼ‰C»Útcï«€œl‹%¼^+<)ضmL¾7ªXUo·¹ ¯IÝ<`m¹Þ‚½\kHõ•€ÓTýÎý‰B…5)Õ³¨Nî\æ›…õçº*¬I¼~w.¤¶<{š“ŸIÎß9íŽJ¯E‹ÖxJÅjÖ¤4¤¡¯G›ÅÏý 9´)¿ÁöŽ–JðPJÚnÊ Î¡ç*ŽÔ†¸él204ÐÃÑC#’dG*}|`BÐ×Õ×ẄôÀÒÆ*—¬]X?.@ÖÊT£¾frÜÏ¥]úÐ'{ßSžª£«\®ìoÃún“ž¡ŒLŽäWîý&‰Ð·„`üx…Ìm¡è _aŸx€L¡ÙÛYÑܬ‡ŸÙfFß#ó·‰ßiË LTÁ –¬¥#ÀZg¤‹cì;™r@Ü_îmÅ0·sâÐÛe#%] µßlHõ€_І4ô´Î xw_Pí^¢tï쥪=³€êüwŒ«zÕdª´GvÝ… òeRg8éE=*J¢2P…ô¢t‚F¶Ñ†4¤Ds3S÷ïáiö$hHCú%)ÌÅÆÊ=|”§‘F4¤! ý¢*#°±Ò¤! iHCÒ†þÞ©¿ö¶»OàˆÜl?ú$m{|ëÄëËAç›TG›m²÷ã«Ióí•àƒYM_“{eüîÀørá—×=¼¼<¥´ïXÃÌÚáŠÈif‹W’x{yyoßyéQ5¨Â0 ÿlÌ Û“ß.½q³ ‘;ðou®ÛËÇwI(±&—ä¥øxº{xEžÊËM w¶89=hæÿéçÝ…¨Ò"öú9øƒ`fˆíõzÕw,BÁjx»nÊ~ëê±}Zü·¼Ô­*£æû{B>(¿«´ñŒ`gá^ÿØ*•‘;Š"‚O½üæ-t:º‡,¯kSPsÔï…:_gIDŽ{’¬M®G²"raØùüúCëŒêh“ÕZ{žš4Ç ˆ-Ó_“ûÓ0Î)xøÔp«À˜æú:ˆjkkžÝNÃaˆe=³h¡Fjî1qFA±ß¼¯z[QºÓ öš(kFüá'²/zš-ÆoæôÉ¡ º•L¥/ཟ»íˆ~‡Ï×Ö765|º›i@²ê•sÐË ßâfk¿5梺!úÅþløœqÁâ*fÑr ™èqÇAð”³Þ…fuÑVB(›ŽÞ«ëéêÄYã«;ã- œp]}ÁÁ2|äàÓÈÞBœï{_ùi\eAo¸™~sif›u – ŠXÓ™šúüÝ¥Y ¨Y‰üv´©-!!!åéû.pÃCã{ëÊÎ&'&¦¤—×÷ÉBÖ•=HJL8—{s=`¾;öìõÕ™†„ä”wW“/T®]Ôúö^êÝ—°Ó©xªýrFrBBjY½ôú©é¦Ó™÷—F«ãR2!†|ÊOË|Ö§‘¯F› —^ËÙeÙA)C›¢83·ãˆÎ²ÔLÖ'$\¼Uxó‹¹S7µ†6¢qgœ~.re˜¬íKÌ]ŽÂøBÅN¢mpdÒõæÖ–Ôð­f!g7m”Ðæ¢7×2é Yï2¿Ç{-Êî¯ê`ÿÅ¡÷$¦•9²~CÙfÄŒ ãå’HY§€¯Ð»¾³ ¾¹ì¬?!âz§J¼©»q"$±ü‹S XdQ(mð]$ÀÂ<쯸²ç¿ÐÿÑ;h¯Rº= eNƒ¸§ÕÍíR´‹¶Ñw––?¾‘Á0ÄöU±§,x âs®‰G ²é~µ‹¢g¡Ìý>Ñ…ƒè0u¥aö$\~Y^zÄßÎr7ì ø9/æºÿaÉóÇ·sÙ†úZ—†ªï‘ wß×ô,âéJ}m¹ü‚gÅ…Û¬(û/Âœ¯ÎqdØï>™Uô´ Øšìšð\&Û@ÌkºìÄÞ ½8’0‡Ó¯—•=;wØg ;Ó~wÈÑsEO ƒmè.É°€ÔWqCâ^)(-ypÅ«« qÂæ7™¾øàEÑ]îÖxªÂ +£=þÖQ™u-=³ŸR/Üyú¢´Àdz/_í¥ÉÓ/bñf>w—Þpç`ŽBüºéÄñ,*{™Ÿ~Kqìúît•.É|·»ÿ݇ õñXê.Ä)–Emu ‹&¡–ªÀéÒó—Ýu¥Æ• bàh±.Õ.Ì7äþ£"¨3•ŸØz¥Y#ß‚6ñ›Ïle^­——m¤h¼ÚÇäž©CÇ㧢k¹ÅÕà4Œ6+àê~s½#…½Jš… m+Cq$ÿôk÷ïÈ 4©1- Ÿ`ª«-»›‚Å3jFàÙ’wëzô‹é*ÚÃvN—C=Ú@†ßÝðt²ÔÙô½‰ƒOƵGÃs²[7ìèyo੪«4›â²G1a{sSSsëý¤½>‘WZ‘çÕ$iÑi Ê¡·“*±uó‚F÷$ª,K5©kš~ÕRy%ÈÞ7q±û)À¹¢°°OÍ8û¡Q?]sºu·üÔÞrÖ”/ù-¢è³>ƒà•­ø·$ãbiv–'üNš.« -ëÂH |J!(‰ûïÅ·GÑÆÄz—¤°Sw1›Í†ÅëÐF<Ä$[g$¶© Xö‚ÐÆÄf/QøîÐ&|,[”µVb¹Kø qxãCPg¨Kð%„ä¡Œ™mn@µ^PdbVÄ–¨,¬rÝô¼²»%£CW µí'ÔðýY„“ýÉu·BþÒ"_(˜ëÂS+Ò){l\~ÎVkëRËWP¯pi˜¦qX¼-I5Ü=äùzçJO.Ë×3ò‡%·ñgZÚô*¡¢çªF£ú6´XÖÏÆ4N•ÑFxE‰z;¥d·Ñ!Y§‡2X[Ï­ç¶<Ú`$×È‚C÷¾'ø­¨E›½4S ÔL¼ÅšI1ß=, ÎîÛ'õí£TéÚ ™¾‰33‹ü(yµ‘l#+­øã‹{·;Œˆ½È†Î¹ç}JUÏèàààDÿ[ºéÙ¬|&3»<]<<<œ¬¹ls{èÁÍsûȆ½¬2”æÝú•Re´5Ò ÐŒêTŸ_ä0¶€ü 2•‰ çÜ9Ïz–÷ØѪÁwûŸ~%_Ðt_Gší–€í0ùûûÑ ±é] hú­“Kbv2óV×0bŽ“CP0·ÓDapLM9,&Ãï‚6»dgõ™èÔÌ*£ ”k^Ä6*V×Úk÷ÃWµóÈž»Mó-Ö!Hܲ74°óòG µ}›ïV<–½ /mõ¾ 1 ÓMJv9´Yð208×%«dÇ@¯a^ÕLôÙÏÖDG;w¡¹¾%p¾¿˜B¥nÛ†fîoÏ5Þrâ*¸ðQ k;#2=¸ûÁ•¶×êÈe¨Û/úa ÍÜÑ(Ûü=°Ú¸æ%m~À¹.j€ã§É6ÇëS=±ÞúoÇ(¢è(—¼çå¸ÂÔ£‘ÃK"ðgB”ÚÏ»`á<é0IÚN³ñ;¶ÖâÂQs&ázõ |R-ù®&d}ÍßOví)p/”Nw:•¤6ÖEÇò¤ü}B…»©&aPøf \|´¤C/´—²Eël7ÊhRƒ³Ìò,ÑaòÜ(O‡×U72®×¤@'6¦¤E²&ø(ÁÁ5Ö8z¯¹¼ šŸ†ÔÙ²¸m§bÍÈÅ„Çn‡jÛÄKMZ¼Š5„W>º±$”4ÅýÁI÷AA„6ˆ1BšżE¿žÝçH÷=Š ÛÜ_RÀŽL}}÷™uvñBgÞãvi-&ì´ðïVU  T˜8O,¤€J”ÌÅî¶1x­»-=ÀÀ#C2«¼¿Ž¡Û,¬qפì&Ûz-Ì'õðAKjºô§w{&$SU˳ à o”D¡÷ó$½´¥úÃô  €691 ž]>JÉ’tÎ4›¨WR5z¸®™pÐFMcjè+о‰ùóeŽh­h%Í™RHf®;·;ctioƹ5) &Ù ov˜/'øüD´AÆ­ÐÞ˜õ¤CòS8µÏ‘De›[ÙÛ˜šÒHØØÇmJÜdÛ=º‰d Ò _˜à0lSK7'¶1ƒL÷˜—,ôˆö;˜P¬-ÞÁÞð'–Ó‚œ¯8€!…ð¶ˆ.í$êzËS‚Ñê /gp©øÏÓð›†ë§©ÞG$•¯8R(¥#ÊÓàlÇKª™£ø+Ðf¤äOŒMÙ¿ÝÇrEâçªètº÷Md€‹šL°ÎûÒÐre:QÜs%ŠQ˜“±±½w|üi.ÙÜvo¨Jr¦1ÙQÇc„ûâõ1ÅÝ°8ëi¨gáW<6R¸‹Haŧ¦má’ïÝÍÒ1`'ÝYwÁÎØ'‘i˜’t”Ž;õ¤E…•X0¡‘m½CââbÝí9\¿ *Ù⯫§sÛuèTLƒBºÖŠô)g:ÆÎcGt¸ŸãV ^¼„égféÃØ]SLj3çùv¢ÞsïÉ„c{xƒÂ&uf°çö>‰}òdt(‡Oy gÔ–¿“LgEŒßãe§µëäëÑæV¨3•ŒË.•¬1 g»¨8ÛmûãOFÁÕܲm˜XÅWk`ä+iuyfpxJ^Þ였=E§†'¥›KC}½}sÚÑÀàÌ"\íòÊGGθ,‹V—F B÷õ M %‘ävû™‰Ñ~8­¾‘±I‚nóÃ}“ÊÈ°<Ù?0ºð¥å'ĘUVæ&û†'ЬÎÖSHœe! |½–h1ÁÅ|Ýt(éíY€J)ööõ % .ÍNöõöö /¯ŠÑ¢á£/úûæø(·ÑþžñiTf!f¯J8¬Ž ôööNÉîÞj ¥%7»,9-ˆ??1abfÏäÈ ôqb6êO AŸZ™šâ/MAï‡Ç`C0œŽ`jGØ»inh` ^kV—†û¡0ƒ#3¡d‡×øÆŸêéŸDë+XžƒxÕÛ×75·,mäe?T¨‘U‘°¯w9¹DpÕ‹Õ3‡,‘ yƒÐÛØØ.æ/ÀùôõO/ðÕÚf‘— 3ãýpFý²Œ`ëÍÔün`hq»‚ûpï H® ‰—&z{z–…k·v«‹CpÍzǧ$é—ºû†¥ÝX©sNל7ò¿"uÜÛmâŸüꮧ e¸Òcž®ÿ(œj¦[Ÿ5µ6âNßžÀ"àG}úy©çšßÝŽ9M“ý¯×Ea-é”;þäÓ®_½0õ·"hþi šË­@+þ°úëxÔ{˘͵P".çóÿ·VR ý®û)ð«C)ËÖþ5e }[›}S+ª[ë—Ú‹+ÿæ#ô·<òß6þ"À*wâZ/‘?ÅQÅJŽÒ™Ê.Uê®~þvuUÊW¹Ž ð¥+ïU44°®*¿ç!Þx° Õˆ@L¢VE×üHʤõ²SA{ûÿç÷ˆ5ís[¯ø+É 3ô8]ûSÆ. ¶¶ *·ÐDõýŽ¾üË#‡pvhpòÛܾx/‚ÿ_Zü¯‚s¢Å‰ž¡™o®ãÜÈÀ¸bY©Òý+j{Wì¿üN×ïOœ­)4À“) ‰Â˜Ö´W†?ípæˆ$;¿øʶåz’wñ1™(Šÿ^ÏÝ.»4\E¤Z‹´yÛ޲׋#Ð]„»°4¨£OŠÙ4”>Nߨf/ôFms ‰,+÷ÒŽ„™æ˜M}ðÌ•ÅL†ýñ& œÌè$ÑuçÉqÜíÄ }ÑÛ‘ˆ–n%’ˆàÊà‡@GSžäqŽ7};ŽH¦R( iTÞL8Y» k /ä‹WsQÉ$2ÃìÜÓzuR¸ &õ;‹“=UWM¨xš±CyŒ” Ïw<Î?îcà_¤µ:ÝîiM$‘,\w~žƒ ß™¾ U”L¶‡¯rhyšÁ¥AßéÒŸÔw^ž,`/£¸¤ø»5ÛLq¾™ðÙì#ïómŒ)x*÷Ò«Nt€E3þº·`r=†eG3H8–µoõêLÕ:CyH¾‘™óȘ}ŸaeªþAü.¨|f[w,‰‡n1$@íNæxÀ¬ÄB^Fäv ™Ä¶õ©Dfá²ïi>‹£o9Ðkã •CðÔ~!K„“lrr±õ †ed8Ê¢ï„$Œ]ö”÷sÚÄøG_ÜC5øÖ˜|ˆÕêÄï,Ït½½Ä†‘íøj€/å˜è r™»™KØç9Ä“<ÇÎâèÇ£ž¦ä=p!ù#µ![Ì’ÇÞdÔ{P¼ÒAÁ .@Ý|Å…êÉTW¯ÀÄÁÖL{ßû°÷æO›«/ u »%R¼ ´u™nÖMúÀ—G°›i©uCókh#œ÷§b}Ï7ü.~ðŽïwÖ>€>A"Û,½£kc Û—áPÍM"Ë‚M™Ä6ÄÔ9ʇcm‘Ý÷íîGAÆ»žÁ²o¾oŠ/DA,­ýW»À¥! ÑxJ ˆz/aph·±ÔNx1.x3ÝDd²IÛës¾€J6Ñ™“‡Þˆ‘{ÐÅbø°Š¼CÞûó–z_á™ÈW6‚Ù…9º*Vi¹BÑF¼ÒlF6(i^/ú)äˆü|}#ûY»¢gqsÔˆñíb‘h¦ó–fŽêù‘Nf;s* J¾½¤Et £í®Õر~š·*ƒ+ïYz˜ç] P§úTG³÷ƒSÎ\ʽ¸ï¿Ð:šïJ ‰Ò¸,FÑ&£¬½ýÖq¼KŒ:´™©¼´™¹]¬Ú¦ £Mé¬8Êër¦øý.0ŒÔÝcXûÊiRKUia´°L 7€Å-F„‹½‚ËÆÉïá n'‡Up;=ð4¤‰‹Óm°9="m(yµCh"Ðìfp\AÑÒT¯`p;ÐqrÀTko®dÿŽÆÑE›•ÑO*û£ÄQŠàô#¸Z{#þ¤Á¢½ö–©¯¥Qg,7“>ÀÙú$2;Zù†r)Ú< _@߉EB±ºmËÞ¤ï3¿'¼æÁhcᕾ:ªÅ>ñôF¬ç®XøИÅá*ÓD–èù=nQ—_‚Ó¯7XI” ‡E®‚ØÓ÷9ΩP°ý*ÖA›«ðp‹ds÷>ThRËËcu$:kI¤ÚŸB •Î¡`p8Òûå/Ž;ÕjfKÆ&ý­“’F\ò4ÄgwA•ãô;æ$Q“££gÛïz²mŽ£šyYŒ÷L±4‰[âžõ 6aõ‘f"ô mžÃúÑ 7ìÁ+M*Ѧ£0箦ýº[ŽÎ?ãÓïxOù:´á]Üî/»ÚRpÈöf‰÷6š5Ä'šõqp®‚ævS¦KR»ME×Ú"MÎ2¼Â@¾2ÚÀ­>Öåk©mDvpñ½PÚ¥áÚ@2$ð¹òŽ-M—Ì4õôÝÓ9 ë)KãmÑ~VHDŸó%°r»ÅŠH&“‚þÕݤ•Ò¹ÚÀš”`&÷X®ÆÜnËásOÕN mÙßÓ÷JÍÚ‚Ãl T}mô,’Q¿ÓòœÃÖ¡g¤¡ÅIv ߇}rh3³EGÿÊ€ÔÈtBêÀçÅ/¡Í~“CÑ[øÁD|lÃ×lûë6Ñ2‚í±r},jT¥ì±Y£MPIꮹXîz,y×xR‹}Tm¦: $%¬¡¾õñëàÜëM8§EÉp›²ÈïåÑF-ÉÐF̧âIï¦Eíëd›Õ™."•9)¯3¯R´aÕ-õ>=Ž!Yw/ÿ¨±×’ñ=〴WcXFáïxàj Õ6¬xlû]ÿ{h©>N²NE"“ô6kŸV¿ƒ¬6ƒá}(C›•žgz«!Uh3Qž£ÍTaL‚“è7×Ò‹}òY8ÓBÔÇŸ¯_§‹øëÐf¹ôd°ù‘+Rnðð¸3MPõ‡˜x—®‡‡¶e@˜³äGµê|Ï´ •X‰¹ä’¶I”qîÄ™m‹^/Û¬qO°Ðô¾˜#¼Ÿ‘ß)Cé79Xv%B¸ ±„‰Ç¿›\÷·v»¦|žÒÆh#%a_{}#íصêd›pÛ¥JËJwºaFË´÷ÖæDzË–Áö³é¯†äІ·“ ß(…2A5MRý¾mÐ=¤Â3¦˜]ås_±z?eo¸¹lTÞ–)J±¥ø=¶ÝåfýÇÓ_@›¹¾—ãuû£§~"Ú û¼ž%˜…5¤x[¥–)ØmD‹6Xâþ¢ y”o(M¹÷V¦Iñ^ß=âBuˆ\þ“}KÆøi£ó±Ø3M« ¸ÇkÔ³¨`ýEÐæ>úóÎî-Îç+¿¸j€Ra01ö“Ä>(E8pi²·Ý»ˆÊv^#u“áÅ@~Á»îzòÝÚAT“*BVgšîaYõóÀïoÖ¡Í‚¨%O×ÈqinÑD5ŽHE&uOsj “uþ;Øw+Ê|wÒ~÷s’Í¿6ftÇS’þœ¶ƒæ[.ËÐæ*ÆÀ†a÷®m‘²­t>ÒýA>¼¤ÑÖº„J£MZódÓ°#RÉŠ÷¿ÙbJ0ê!›°}©¤{+üêŠdÑt¾=<"ÊbBºä¬ùöªæ~9MJ»3¨jBÒ‚W£=CSŸ¨C}Ãk ˆÔ¶ÐN Ò;àÚ@e L_Û„ˆ —NÂ4#‡cÄï²?£ Xçdœ&ö6Ùëš)¿mÀîÛ;ÈÖ’ó|b}8™°el¤³ud^G{°öd!»Ñ 3mí»càÄÓ½XN8n¨,MÇØ_ªC¯SpÔ• ¦!ñþg‰ÝãBlä«öYuhsv¿sT¼-ZÀ›oëèÞ@¶Aña—i§¹Ú@}EÖœ_.Yäª/¶%éǶ)X‰ ñˆ›±ÓÁ+Z2€Ñ®Ö¡9Ú@x³ ™4f›ñDF7ÂWcrr)bx_j$þE¿’'‡6¸ú)]ŸàŽî~—{÷Œ…÷‹ùímí‘¢ñH8nŠeOKáH&ÛÀµæØ{|˜ëפ^fáv/š$Ç4”æõqÏڧ׬ÄèÝÖwÐݧV‡Ö›¡šÛxŽ+úlBÕG²Ks3è.[i³äGíh×yº×î‡ïŒš‘l|œ¼I _¶(Á_UïZÊa{{gK‰ëv¾ó{i@KŸ4 ÷™aG¦™Â¨K.D0Éx;G'“â¿?±œŒÓ¾ûã‹ØkâÊAò¶„O vÏvgÓÔÉÁÏ0?[ ZiÑŽ¸}_ª,ßH<@¡ÐœœìhT㤛ð0Ì·˜ X,NïœøÝi?}ŸTdMªæ_õL¡inâu–kaã`eJ³t éXP«Iiq¤pß꺅bhŽœ'¬ ÿÎ8^¶ƒ¯îA—N‚P ì£×kÑ>W}帞!Î&8¦öû:ÑÌì¬9ÖîÁýKBu݆÷*ìϦð"Wb(åàù:©½Ep,ÔÛ€À` }b&àa"Ú‹ûÿöÜŸT^®«öµcè&d<þ@Ü-ô}jÔÛ|«£%Û|KI3ŒÇ5—ìØ’hõGþLŽ‚’l/Ê644²ò„- ó 78DK{'6 ï±; †ƒÉWÿ]ÇJ†64¢áÛXƬ»§oˆµ81ÛZø=Žµ¾FånÝ-w€üÌ 2ÖÐ,éŠ6á„ÿýBbÑj,Lw³aÿðƒ–ö&-–•KN‘D¬]ì»c„á"þ6HW»)Z;Ò_¨ïÂâhâ¿ÞSB-³È”}î.p#í‹/DL‚®'®fd:Û”@¢Ç]ƒa³õ¦3Õ붬}î§GÑ(TG'{…{–sļ6ýMíŸW8Se¶ýÖÄG&úßbšZ²v^èhu¶ž¡oŒFOC-)Ñeð[rþˆ-›üÝ÷Ú›жr (iG­×}ôÿ¶éáÔšé8e‡•‘óáyáïnQjÍ/C­Ç‹²×ÂþØÈ•eÃÓ?¾ÊßF•½ÞßTz;‚ìŠÊÕߨ·Ïܯ:¤ª»Î¥¯Ü66ô·†³|@@•¿ÍhÕÍ#oùàOð·P%76ò·ù G#@U™Û­|û*û«d¢*'äÛ z=Ýôèà+ž²Ý†ñ-þ6*[Pé¯ä3¼¾Öª¢Æ—XïK ÀW(rú-ÑTYüùÒNõÍ€bÁ¼*6Ãhó³¶2Šø*󵨜w(xVÓ¨jèÞ±À©õVbE´Ñ†~U‹U –Hg)“Fxù(Mß,úgžSÚ³ˆK93zß¼@Ó¿µ×7?¬aƒ†~[:äýþs奕¹ÆÕœá©! iHC‚('jgÃ8b nñ«UpY‰Ø¶õÃ:šŸ]ß²Ý××oß¡ø–99;)|#B·»§Ï±¢)u3÷lçÃÃO%‹ñ1»|}¼}ç!¿D™'¡4c’®®÷ßF§ª{™§¶ùùF%\ Yu_tõôöõ •\ê¹Ú¸Ýã$²„±<˜|xï¶ÃÉyBÅ™núUîVw¿¼—Ÿå…‹ý!¾½ `Ê¡m«§›K/ï˦»|vì}ƒvVî´ý”ø'ðÿ8yãÛL>ä÷èãÄ/-{ÈË gl+x?®2\|”_qÝ”æ6ðß¡ô9×Ð57óVø±¦ w36“^)lÍYv&i=G®¾½¶×œît âýÇOu5¥÷ÎÁwvw­_Ð\t’iéOçn[ pöåûná𣠲•ÉÖ7<âÂÈ*¨î:•8Õ‹a·?çcmÍý´ ºÍže±âš°´Ï–fq±º¦æÆ w²UÄ"|îä@W[—ù«“Ä ÏzGÀ¥S#£ØëÏ>~üpá¨Ù:@~áH¸8Õö憡՘¬÷Ctü–¬ySÒ5Êo(HÞ²+œj#°Ì¿=úîOñý´v¸íû°ôsbÍbï[ŠUìzMCeHõy¿4ÖˆV†0äpÔhU÷¶¤sDõ‰ Õ¯KzÆáÂL~¼kî{^3H74ßôðО\ÅÙ=àtÖCèU‹6¢NÆwÄ÷¢µuówù— > K»ÿC?§yšƒ¡Ö.+wjñÂPÒ©hÏ­æ kσ'’‡x`ÈVú*øüÞ•ÏÅ: 7Ù‘ÝÎlòóN…XzÞàX–2™g›5ö^Í$‚B#\mŒ6€ÀF}ƒôÏ‘W7\.—H ¼aC¼qŸ2 ̻鑤Pó¯7^=¾™QݹØõ$Õqg.8Û¡K4Eë~1#uXÁéÙQ<Ñrõü¹³ÙWÚ‘;äÑ‚³œségÏf½\! Ô^^˜Ÿ––vþêÝ!éjvwí‹ìsgÓ3sÞ¶ÁÁnœ±&R¢Ó »Æ.ŸKY$kûKƒIé——Å+™Ù"pöÆ…³)iÙÈuÞ’[&Þ<¹–vöÊÝb‘”?CÕÏÎÝ.Mv‰dr½¡’@ŸòrÓÇfF®f&UuÁm3ßû17#ílzöˉËTýógà†—çÓϦ§ŸÝ*Yó)½“Q7°\õøZrJÚ½g•m#Ès_Íó¬³ié9ï‘{Ñ=µeYéi9ù WÂå©Äؽú–¤¤Ô91øôvfMÏ쓬øW½B´²Ð¹ç3úD…ùu= Ë]ÕvysíϦ¥eeŸŠ¥<ûwîôï‹Ü¤‡ š åþ® k8Ww9ðØ)Ïðspÿtª—m–‚éÚ‰&—”G| SÓC]Ž7ôü!΂õJÅi5¼Q¶M°¹É2@ehÓø(ÍÔ/J–V¦›éÎGmòq'ZŸPÍeSó©mv‡n½CBËÐF£ÍزÄõ¾»¡:®[þ™w×GÑÞ£wÎr§{ÜIˆÁÊüò*ˆggÑs!^.í“ îVË#oŒô()—nÞÌM$èÞö/¡hæxã -ã‹· ß¿fE2¸ò¾úêÜ“­{ŠJJ®¤Æèj³æ„ÀdéQ‚…ïͧn_r ¥¼ž«+1&P.>¯l‡9™$–J8ÐQ–ÍÞºNIT7[¯â·µoŸæRõpåýPµV“}Ùö¡'Kž?K?´c¹gQW©ía–סP0w=ÅßÄrÏë7ÕPÁ-¨¾öÞg/^m ¼¿j€gçÜyRü0߉¬æ9¼å!ÌtéŒ<]åguð–y÷?¼}Ñcð¸^?ĶwÞqîþ«Æån4Ãc¯•/¤¨¿\Ÿæ_ð¤àF6ÓÐðÕ¬ŠW]ÜGµö¾v·àÜ‘@¬ñ6> (ÍÛK¦n+¯xu¦ýž¤ eS“<<æKÅì Ž3 ÷ âõŠQáìع£¶n1ïß¾¶%‘ ¤Hýôô—“7 à¹!Nñϧ5cøï‹úûŒóÁ{gÂKÚ7B\®õquÄèn"qãÎßiî—Íb·O8l? ûɯÎ6PȬEòñPÍŽg7ˆÄ㥻.4Ê£Íëü#Ž;dÁŠw™Ù¯QP¦ڱxÖ'TŠÍ8[PväŽ~ù<7ùÚ»N°ÿŠ6¼©Þ6ä¤ ‘H\w|+ûľwµ®4K””‰!øΨǻ,]ÒŸ£oV—ùBHÓ´ÀQ>"šÔ\q¤ŽåiTË Ä,˜ùÚPn ¡&+0c¿KhÚ㥺{zf¾²Ryré-òV´öâh³-‰èO'+ú™ò‰¿½½ÖÛÃ’ësÚS°FžËrh³0ÞÝ5ã¶H$z½‡c™K2ÇBLög•¢Ñ[ò¶°ü*Í&3#ý0Âb±èY ÙñÔ,b7¦Niz®ËJFTdÕ4%¥X(þChs¾th±¡PßÔ-ò»#fÜU m ‡Š«»\B`åβ¯ä"Å`+ûõË š£Æ4ôoÖþ†:ÆF²ÍÚÀmûðìPˆ`”€n?wqµ óÛgGGGÇF)” M³jsd›·7ÛÊöVƒƒÌœ/}Z™ï€¨¹5 l¸¼ÊËÙÍ•Ê4twÚ}å•<Ú¼{tŽk³Á7y‹« è|žÌ]o yœèi˜20+äOT¥_Ú¨&Þ&¾U¤Òn#X<èÉ%Ó™l6Û˜Nã†}×ë$±¨xh–¿\X99LÐüFwK–ÑøpÊÕÎadv–CèóÊæ²>!Èk&ÙÁ'%@hC¦õ,K2-:jqäJÛ£Û4hG JæTr¨¢L¨€6–ä¢ftÄ”“¶îa©6¿‘ŽÃŠÖІ?ձ˙MaÀU`Ѩ‰ðÞcAÌÄ{’Íq÷½Œ¡ð‡€qy´1À–Ie°XûÌ( ±.¦qI Ö¡ $û-` n ÁW•™“)53«*ÑFÌ¢‘ñcËbpê‰5lU3j'Ø3ÀÝŒ½?.ït=b‰Ñz=@óÖª@ ¿ˆ²X²[‡~_yœ@36•×”5n¸š C›®g{dêÿQ“/û Žî41åBéì‰}¬1Ò“{þy»ÌnÓ¶Ê;¶Ó‰h…n®òù¡ÙVÃ)Ø“ Ê}óÃhš…ÓÃú…Öl{Ï›’{~¿mVÂÈFÇëWK´×Yl´b%'ù4žveÆ<”E[nŠÛçA&“GùRó³pîaîIÁhïµE´¯îó =_Öý0É99qA›Îe!ŠO†Ø»ÚQ”fâsPÝÚ–2ÚXK[P#ÌŒ«žÎ•)ð¯ÔÒ±„1± mÄǹ›³$»&ßï75OP6 ¿Á jh.—Æ †dšýÆ?DÜ@ÏËC(v0Úôrô êæÎ W…6໼ǰþX%…¶åÍ:´7ÝÇX0RªÇ˹GÞz¯¦_ÖšuºÂåúáœwß”…ª?ç§C ƒ„‘²ó: ÏEpm÷Kkº‡¶]:ôpÈÙðÄíµëœñœ ×>Éß@Ü•¡ 8Sc`h> = Ú”ŽoSX€x“1{÷®H ÔejhÔ€ÊM2MJ¼êB£¾G¬Äe§ƒ(Á’q'œ23"åŠã¢¶–˜Vv(ŸÅjÑF&UvÎ {†Êùa®>9åààm~FFŽ…Æ °ã˜*„ªWPøRU°—NºÔµRWvwdNâQPs?ÁnG(†Ñ¦zIzßØ“Èø êÅV±mH””&‰µäTˆEtN¹°½H›æ—óý‹w|‘‚ö*E@mÀ lð¹FôýìËýÚþÕ5MjÖE× Drš–“1Ã<áÙFÁ´f¯mðh =¯xÉ‚B±Ë€÷*úš"GÀ§“… 2»Q´9¨„6+}ïñæ.c¹®Wz¥}c m¶†ä¢E´$b³]Í°5 °ªÑ¤~û4Ñ\L³pV©V‰zœñzl®…§·§¥ÇP—õiT2üov'ÐX¶nÛÃv[š›bô‰u#<°÷¦ŽŽí â¦¼D'¶g^4¥ûÐôn6¬¨—m½ö7¢ð npè..›æ“Y*ß<ØÇfšZìß·“CÅÆ"×Rª­Ä0xys°ÆŽ»vr eÆ:MéEäVãÈGòVbä6SÉJ‡ZÙfÚŽE¬U°4 æ{ˆFx;¿=á~öF:̶Y@f%~“¶…fj›‘‘beL®¾·×gsù}ëIOº™ƒ[\BÒ>'"ÑtQ´]ÚA ²‹ ¥`±™ Y !qÜw½Û!áè8kÉ¡â¨lãÌØw")&ÐÙ@Ϭ ©ëƒcN4®Mlbrð3}¢/røéê ¦?¼ð=T“G ™DEEBú‡<Ú,÷¼ÄèãcŽì¦0È™2Mêþ1–õÖÌôD3cFãÝÉ)¯nêdkC´/ì5ç8xež=Ãåp›ny‘h®7&'Ê18JàÞh{Û®ËêÄs ™¶wïžÁeÚÀVƒL#&ݸ_z”³ mŸ$Xæ1GO ç Xrh8¯\)ˆãl0{ŒkÆòoŸ„+óݽjåñêð@ogggOÿO$]TB¾ÌMŽvwv@Ô }BT–剡Ž%Ç0@83ÐÞõqGÛ O¼&…&;3:¥‰Þû¼n74\ ‘þ(ÀðÄÚêªJ´A¦×•ÁÞn(pßà¨Ì»7Õêr\Š60ÚˆVºº†©œ?Üß9½°~û’èf·nLy N¼2×1¡³gýWçÚ:‘+fÑ`o×çŽÎÉE()QwgÿÄ<ÌÌþžÏŸ;ºzú—¤9ÌN Ã\ì쟕ØÈ„Kƒ3’•—+‡=d¾’d £ }ˆÏìé„’™YÈVÀ'†û¡dºzùR¿¢åéÑŽ~ÄŸH,ì‡ØÐÙ j_OçŠLÁK3ÝPJÝS 5SŠ6_ýpݺ¦a3‘°§«spve|¨kbV2eðçú»fÀ@¸Òw‹®Y¨­Õî®ÎaÄBµ8=ÚÙñ¹»oh8N õÂUXà Ÿ’2|i¼»«»G6Ë õuÌ,"&qñj_TÌ4·0öõCkÂ[Ñù4›V5ôe ÙJ{P7 þ¸]-’(ÓfÚtm‚¨ÔÜŽ• R›,:Z†ºé›QŸÀ¯!±9ËþozW’Õð ²!÷óªÔA›ÁÑ/—ã.{ÌÕW¿Q9eþò§‹F8÷Y¹[_îÄl­YÕhRú2ùÚl3‡?ÒS´íá9®¥™Ö&º 3úò,FkY¼±jêyÞÐÈóHÞ׎ÃuG—ü hŸ»•.ž}·z`­ ü)-ƒ~žèÊÑÇ3ñêãýVûŠhÑ‘NÕ§;¾â)òfWƒ†¾r_÷ü­VnT¾© øº×¿Ùm€Šsœ•õþùsüÍòDͳ†4¤! iHCß(<Ó#}ŸW„âßxaWÿÿöÞû«Šmmýî/wŒî}{|_wŸs¶J†•s$çœs‚"U@ ¢¨&¢HPD ¢ˆ ‚(9GÉ9çêVZ‹EtïsöÙ}öézÆî¢VÕ¬9gÍùÔûÎù†…=C ⃿Ý}½=k[ÿò­˜[±ø[¾Ý;\¤ûûzV6Uë÷÷¼Þ©õˆõÉî$0¯`|x »»çÇȤx;níÖ(´#Ð3>‹X[ ·/Nõtw÷ÿˆ¥­hrd°«»{`hL’—¸›ËÝ=ç6äBdã gdrn¯d;:Ø?0½„Mú?‚TX[‹½$ Í?ìÌðÂæOKÿ­ÿP¾Õ¹à@¶mñÙ”¦‰µñÿQà© ›ñüzRXëÿÈ4½Šü©Ë§~Xïøþþ°ð³çäŒxÇù}Š’„Tß~Á–z }(¼pƒÅ Þp×623¯ë_F«xD¢‘K ¿³ SC‘k›b”,.{ÚXß¼wÏÝŒeáq~ëfZ<¶¡­“1—D2B¬Ô>Ýö£3˜!aDŠÎé|øe/[«ýï¬oиxIK?¼©öÊÛÓÇŒ œM×9î~±Tžñùg#{Ø:Lqg1Yz¡'\W6 e›/C¦¦AęӚ$‚Uøs„ëfß_¤“ðöî^ê,²Ç…'»ä ]º®MDˆ“@H(„ã«oÌ(ŒT7­+73µùš¡ϸ[¥eÞuPWu<_Hºèi0 #‚<DâíwÐîRõMcíãY`‡{§4R‰­.CËÌÙÏAß/$L™dV®?Çšêå´7Å*™_ö²µJ¿wÏÃœeá~ šN[cZ<¦£Ÿ» çRr°#`e¦ÓÏÕ€§a“p%] ³ÍÝH'] 'c I»,qå‡*…Ë™aeo7º$væ€/ÑÖ7ÄÍB—aàw¼¸6цJdøž6ä±¹nÐ Ú˜èô4fs,â’7Ÿò(g¿ [=Q2B”éeÁ×pÛG+û[÷2™öˆ“…`Õ’Ïe™¸‡tfÉù !Öûô`2~:îRñ08ég¹­8„›ˆ dk<†#±‡¶€ûNιm’—8k¡¨V4 ¬ŒWÓXZ[;ÌÜ(O§Ä\`¬òÅrKòš´¹ä(X(Ÿ,ÛˆE‚­MDÓ~õ ÑvU2H:nÚ&~n¿lo„²ð ë/'žOaüðû¢&Ó’§çŠOú¼®^ÙYMsÈÁê‰3×çÕ rKÏ÷̓;45qC¤ªwîPAé1º Ø IÆL÷l¤™K_®)pOA]³5ÀTd#ÖN›MqTŸ¢]ºeÝ-†i<È&AZÜÄêR> g½ÔÌuç0ØÎÒÙZ[+ðRNöãG=}rGC‰˜7 ¬MVƒl³ÍÇ-¼rü'à¯g§^ äé{â-“ö )3eª¦’–_ðø^z$fÙض%cG _¯…Fy¼îDòɧ?í0êkzqªoñì ôtð~ûìÛ^ÙªîÏ6¡Á©Ÿ‘úïÕ¤¾=»Ìw‹@ž,mò@Ùfr#û”½Ùµ—Ò5o¢Z|«ØlaâÉãë²i[·w„/ótC®=y ÷LÎm¾"üÔBlCaö¯#ù¬;GÙ½°ÉÙb{Q×C¢5¨†gofÃw=ËIgË“*W@¶±Ð÷ÌACFØéz>kDfÀV_™ÕrÛÈô[“´ß"j~Öª“a‚W~Ë 2tLEÙFZÙ¿€”?J+àj5Ä6N¿iQ¿&^%á.ú“cO¨ù@·­v^òwvrtträ“”²àœ³Ý¥g4Í.CñfêÓqDž_x\y]·ì”mø1h=g?Å›€üÂÄ™Ç܃›¶=….O…B«möƒl!~äÈIoœ–]Q*Jô ó½ç¡€âšÜë5RC#ÑYÞ‘‹ßij˜l7)Û4¦ŸfrÔF²¯¹mpêÇOï'X;,nIë·›móW |’7Q yÝW‹Z2´÷·”m0ü³ØÆ8µ…‹3Õ²ˆL-ÌÏσ_PPж(Ë6]|UBÊ“yÈÏùEo*@ɞä6L!rÀˆž’jì×’ ò_¼x%@؆‰î HØ&I>W· ;©ëóÙÆŽ/ §çV ÌÄ6˶ Q¿Ý°¿lŸÅêxEm¯Cl³y÷¸­ý×Ò•Ã ºJè×M`ý+ǘؔìgìüFéò¬cn¢UË/È/è\FÙfuåîdáöǶžæÐHïÊËØêîYœ@Sµ^4×|úY㎑-v³Ív¿¡ls’A‰oˆ¿°Nîf™Uâm¶!rÇÐuO•xãI¡ô%¾*y'ÞšV'àÓ^|›˜[™÷åÍjÜÁ6Ðó‡;^>Í pÐU£è¼îܯ bÍ‹h=g>Û¬b_2Á#åÚt¸í£ëÛl2¿&<¼,˜Nn%ûèjx][–¬‘%›óO¾é‘7æ}¿ä¯l?hþ”ÁëR¾PÂ<]/B™Ú~…R= ùñE -ülSiÄ -–¼ñÌ4heØfË’)_Ö» ‘`u@ÙFÂ6@€úÑ›ÕË’OËÆ’9{?¶yåIÕNøŽpÍ@ué“ÊƹÚ'ªºH(cèö™ñ™]ÿã5ýàHí:“äLÙd›ïû² ô!s“hî/Y‚žäÐAMj½)Ù‹àym¦`Š§L}¥`žãÓÔºæ,º‚·n4/n³MU¨6÷Ü;é6êì ¼rñ¶Jý™Úë¥wÍÍCê—,Û×Ó¹ò©êHU–Óú§l“iA´ÍFni¼*Ç?…² ¤I‰Ûlš1äßõo"½,ÜZiecª‚FÕZ‡… @ت¥"—GÒ€ØÒ¤ÄÓ#½B‰VQ’`”¾C\ØÃ6`ï½zlrûM? ßËßšš_ß QU÷§áÒÈ7ï@¨æëNÚJ-‰ïÙV~êê'ézeïû‡Îöþ‘·Öf¿%C{+£egÝba–†úí–¤ßzÀ~C4Ïoϯ»9;„$>ö=üë,ENŸñvtõˆ“¾®£+ÈMÅw®d7“öN>Ó¢íÏusi–— ø~@ÎÌÖ?ópuò Š›Þ«žØÚ¸TÎ@¶V‘¾`¡¸7/3.»9;:¹ûeW"ö2Âþ¶QÅ0Ûtݶò¿/’°¢…c0úøÉú3þ®ŽŽŽï¾Iĉ޷7\\\\Ý<>Ï¢S½ùÉU'W7—m¸¾EÂ…Í$Ÿ;áèâ•UÖ {pÈýÜî®ÎÁ17—Eã¾ÍÙëQAà°9vqvÉ–¿¸Ú9‚E¹»»»¹º¸8»æK£}Ü ?P8Ú¹}Ý™ê¡ÿAdÐ3DUÝpâŸzÅ:Æð+0_q"³ê_¿š¢Ù–ÛYo>«Ê"yýô–õ‘ÚÛk ¿=+”êq {Ûÿ T?Ž„‚‰aápˆÿDÉÎ6mõ˜|c» ?"©|úð¥H¼ÛšæsZ6ž'ÝÍHµü–eluáŸ0‚0¿r ÿ†¼ª¢ëëkk눅ÛO8b/+ÜZGn±9 0üæïï>:Ê¿°ôûoø±ÿ‡4CñŸI¯”ñ‚ûwk†_áú´…ƒ¥®Ñ9µþ/^ÕÏ,U­sÿ ‡Þ`áÿóÝßEâѵ$[m}¦Ï£à÷ªK^JÒï¹1,V žW!öÅ€p¾O…Èûõ-²;ròV;6Iÿ$_Mñ!¢ßŒ•]ëW]¿'QÌwámyiÏ£Ä{¯”q"Øõ!Ûÿ¸ÛºoÛA¼o™‡þ´å|×oR ´ýj+>T2Ü·‡w)hF, ¬è©#Ÿ‡ï­týŠ~ë{ßïÝBQ(LUu—÷mþ¡"ð!mï÷´)aôÛmžÓÃ}ãßï-T,a²ÍŸ o/±uÂËM™DN”QåKAš›ÎaÑ5Í}ê‡V7&Ú9<NÕÔàµM®«Ãýmh ÂIɃ^´p]MYþcn|ö2Ⴕ%Sµ3ÊPûÕ»§ˆ.q%þ.vz #Ϙ©–ž–<2Þç â™Ìu½s1`Cmdè?ª‚mìÛnü^xnœ½Šºø×À‡{<œ"‹­~úÆ[OsBZÉð£è¿)˜á¸ÄÇTßf8Û˜k1I6AéˆÁÈ÷‚«tE.OëƒÏ|’⧱•ãF4 •Îeó '!¶ÑñËõ2g2È8¶é§AÈl'Á]õÔ¨ßR g´×±,:ƒÃ š¸ŸéŸÛ‚ÞÚÊD¬¿ ™Â`ÉŽÁ×–aÅS¸X.ÿÉ°¸àz8F‡ ÇØ­vdgª••'¶VÜv²1Ó¤œÂ3Þk,¶Õa²¹Û$¯ YÓŸH¦ÑX®ÍÈóâå ZìwÈŒY8Ù`¥A¦)|Ó—õÔpmꜻ¡•¥kêÚõ9ò?¨CJ¬«rHF'6‹ÿ,¨É´`ðÌs,aO&h0 O»ixGvÉ£Ñõ‹ÏÙhú¤"y«ÅÑFxˆ¸Ah!rAFˆ…Uø=ä8Õe’ÔϦœ’r œÒw£§\™cYn}Œ¦ò}‘+Ï:rÎÞ«VÚÇHù}ð©Í6Q©cJRÿ¡bdêù€³Œ÷•m@dÇšœLƒŒ 'kLÏÓ‡ë#l¸¦d~?Æ8â$„}ˆ1={ÆèD[_㕬Ӏ¥w T(- ˜Õ!3Lé´Ø„ÏÛ”TØ Iú¸1ÆW d ²~è‘åÞ÷ATö$Þk†´K¤I£œ²~Ó“WþÎòÕ–1§I‹ÔÅ'*6Nl?(+o¼ƒÒ܈–‡ 8z1LƒÃ¯¢È8•û•£Àpɪ=l½¼@¡PM/£9"½5å3?ΉG?*(óêàŠ4exÒÈÄÚ¡e`½§`†¼Öïlè A¸_ªb¬•ïƒi`¿DÊ™úGå;!úKMúI’cxP÷<ÂýTª°pŠa¯¥­Z¼¼!ØŽå®·DM4 Ùú·›†¾wÈëcx<Ù:àÀSÈÿ¾,~§£¼FR’.gÔ† ?)àÚ ã‹9pÂwѤ¶NèbE§&„;¤·PAÙ$¦Ê«F:vHšø-cMÙúÖ\9ΈzØÍâ? ÛdX:ßA¤Ü‡.ÚÆ7Þ¯,΃X]êÕ?F|¿*ë¹0¡‡“+ï[‚~ž_l,OQ78 ye²h•£ˆÕÇ¢-þHV rÁÂH[j…ªhK£ŸÚ@Äí…F9¼Þ\7 y•îHÕõ&nåµ¾< H‹wm;æp Û„ižºR¶¯8x0XzSÇ3<.p£½žœ ³üÁj…Û‡<®þñòªAd—ãH-¥q yæç ³ü ÕÒ9`mô;K7¸È“Q ¥í×PÕ¡úÀDó ª–ÑÒRÙ¥8{£³Ïk!¶‰ÕñŽ?\àK£¥´ ö¿€ó—¼> ÿ}ÍÄi é¡ù…0Kﺡ‡G”­ßÁ¹¾·4ž®´OÜ´÷² £uÍÌáÁºVÐÝSr“e'ñ65Y0Û,”ãLg$š”ŽKª66—ãFƒE¥…k^.EꙨƒw-@š²±ôý ½ ¦žåù©®–†ÚÚÚG\íK°T¹ü/oráÚðW…õ¼®nay}f} Gd÷n¡ –¯-=³b¨åé%¦Óéeø9s³~læÍ&h$úÅ<„ _ê~O7ô€îÙèf‘ð°g•¤Ô`ºBl3ªâ ¤ÛËëKÙ¦G°¾8Ž`rÓªþµÙfÛ+ó‚±Òc80¸&;c@–m:Ô‰$6Gò3—«cê‚DœøI ëãp,™ x|}(÷Ñ~^™tÊyÔuÏ/“é ÉÓ¡´õ/;Î6‡ù€‹¥o8†=8õ(üM@dÄ"mÞf”’ŽU`¡ZåÎomª¶èÒ©³[€“ù,¢<¿dqúÁÞŠh«ÔÞ•oÑfw:ÅMñD¯liѵ÷¡Úr¤µåºg¼GØÆ÷J-|‰ÀF»×ª>,ˆmšŠ“wµÑïy0üðª/Vh²=—©n'e›ãÖÔ½lÓ»ŠÚüŸñ`_+èù–wYÇõœ¤^"me/Ûè—¬Û4ÇÈñ¢ ¶ U»…ø—møRHL¶¤%.‹Ê¨˜>g’¹ºwžU~øp×™‹ä—²Åéc¥Éb2ðjüê;WŽA¶!qF$«½~¶ŒÌŠáQdS¶í§ßŽÈ²M]N€U ô~ÅËŸiîì–ìúÞ¢­’Z–$aÝfM¸œ^Ê6úÛKAu •ê±…±ÍŸ„mò¼uÓ¿ìº@†mæ Ç>Oì\©ÛᕹæLúåIïžåÃýØæ®É>wùŠÞ&õ—gЬ|YD­¼¬eV‹Ü2ñÔç§>àH4Ô^uµ3µÀã\WNùP–š”M|†‡{Óöc g;0ª&úøjfˆoÌHÅcÿ¤\gÊ›@¼9@ç†?;a’ôv›ý¦[ßP´Lööçál3ôñ1¤èÝ{iÛl3×[†È6H+\µT~Æ6ÝÝoÒed›uM&ñ7²(͘à^´+cÝ‚²â-ôUŠï;ðw±"‘h¥!§d1÷¶ùљᶷǤl“ £ò®Øál2~tÑ'ØÒõ º"(Û üÓ›j'#ÛtCöŽ(˜lóç`(êAYÝo9¬v¿¦h»¬ïô¿à¨o‡Ü{ahói—øƒsö†þh8î÷‰6Z'‹ò_ü~…J×G¶hCíXg³ªî1Ü­ïÈÂ粉.¯~dk•EùýsÐÝÍùÇ5M£‘bÜu8Jf·b›Á÷¹wŠ›‘“U÷|t=Ì.µB“ &Ì:“‚n—¤¹ë¹ùÚ&A+6ËUA¶ç¼øgKЮXmaqtŒ¸†°K¦H›ÍÔä¿AyÀ· n%Õo[“: ø‹•H<(¡‹ §Ž uÛôŠAþ1\JrrÍRŸûi`Q–mDKCjF)LÝÙAd’êOØ&¿®”SQÿŸûrÕ†FÙféþˆæدb`îûu*ÓYä¯H"ƒ’’ø4íhDTÏ­¾B+#&#¸–)«‰¿ð ï]¢¡½$@z÷eGP¸ozóYÅlJÉ-¬£¸­ˆﬞ¿}:N 0 Ϭ¶Úptkd¿äZGÃÿ´ì³ÙþL^·©¸¤«c‡,ݯj`ë6J|LÓV÷z!ý³÷óSC.™D"ª›zÖ@k«ãUJÊÌu!âõ<'Ê“D$HÔSWžBŠµp¯ªX¦ÞÂÕÜkAd,Â3êî"Š¤9ú¿‚Ñ¡7ÿíü‚'“¸6?‰NÀ©¨ÎÜ,FÒ9, ÷5ç“È K/çc7ü™Z2<ò_nCÑuÑúôGm‹kávúGíùÿ`A‹™WüÉ'RÐÀ˜ƒ9¦ OÁ»ÊNêý³Ú˜k*ú_SÎEBÌŠzÈ ¿ÜúØü4]›ó?ÿ¢\ˆH3›…£÷¿mg—¾¨û–þIDÀJ3"ýEÁ ž«ÖÇþKBå ¼™Õd§ Ö–D׸[Ò„,_Ü?ÃpŽýŒ°³¢âÍTÅpRý¯Oà­Œ6ù[ªƒw‘™:*; Swÿ«‚Ó¦D©©Ía«*‘™š©%]ÇíhÛHö¤€Íyyyå®”mNÙªÅç@Á{[^ß +*Òy>jóaM Ç»ðÉ«Ýþ&øzWå’‡¶ªáÌÿG ‹º@H®“îM7§ói2‰`àÖ5 õöT[©6U…Îà„Þ,Î|¦¨(y=‚Ör¯ûhƒÅ^û0]˜Ê (d¢†åñÆ1¨C¾Þ =bû¤¯üõnHÏÁÅP9½ZýŸïÿâaÌÛNåæ}éG6ŧjàåÕTu·ó;ˆ–‡#Ý q85º¶Ý§žYäíŸwÑÁ‘¨æQcÃåaM*ÖUÛ“ú³`5æn ™¥?1p¨†ÄmŸ ö7”ùUö62/ûîÈÖ§-ñ¨çµW;[$Ä»Ìwþt@Cv'àܮϾµ•­Ï~ç÷½K¶N"Á`÷¶¹š›–bAãòÞî–m¯X°ÞÓ% s'Ðdâ:¦6÷Ú ìHï²ó½ïµ›Úu»x¿7~ð»Øa$%>Ø@xïKßNL±çùk³ÃC[¨{× ïýlWÓ0`ø?‚ÅæâÖÑ¥?¡s´­ëªØ„]-}[~ó‚NûäÏšÞ2åD—÷Œ½U^^šlIµNØüwt ª¹)¯ÆTXò:ÿ¯ô¬yç0ücÒ&¤4>HMÍÌ]þüË Gâ\zr'966îvvñ¿çÇnÑDcYb\llüµÊö9L¤Á€ ¿nÝæÀ“û­T2ÁßÇ×wׂø µª¿ëi»Vw©ûÅŠÅûö§l÷u?úû_„X|ðºÇA‹-ûøˆíÓÀ]×ÒbôúŸ^±þø+^ð“`ø£ñnÐû]'cÜð‘{Y*fêåéæ\-GJþSÕ|ë.f±Äãoúw¤æDòC gö^vÞý¨ç·~Ò‚påBô_Y2KŸÐÿ¿_´üÅ ÔÜñÿqíË:,™SÀPàÕð–ÞÑ èþMå*Û]vÊ´Þ‹P¶ŽDŽ—'ÚN»š‰D<êrúêØʶ·tã= ó”&"XàN¨(Q*WærŠ²O´ðŒì›ßÚ®¢XÐSùØFƒÇ㘚æ÷Ë›D2ä¶ÚšŠózR'½E8ÓzLAÙøz‡Lc;ØG\“IX ^¢ª)Œ­Øc/¼4XçËàÃAþùíâIîa©së" {ˆ—Æ:"<-qj8<…žôlY&{?Dši«áÑ‚èêÆ%-âƒ.†Z)Z^YÇèèÁ‡T“°Ý!|·6×·¢CȦ«ü¦©÷­?®–£åG(¶ÿ8ÛÂÍõ iœý%{<»w¿qxxóÀ˜ºªé °f;šT¿ È|Þ-ti÷?À¦/ýHjÝ”kX…Ú-@sdÀ›DO%œ ’Šr°ê"GÓG–mÚD‘c ê~ÆS¹oz—»Šâ•vSèC6N1(àc‘2!B#+ˆÑ?WlU ×;7Å’'–]óQ  "ÓF”™J³hYÿ\›lw2b³mB¤ÓJç-bÌõüžÕKkÕðü„†M,­'I÷Ùº4U‰D¯fUºÕµÄ¥âÇÖì²Wþúq°}0¤yD­h¤"ߺ㧥FrE¬óâqÖ•—ß¡dó[ W=4HöeñA"KŒ¡_v5´¿'¯ŽÔqTq¾y“ûÒ Û~ä K?c›?ŒmLÃ+Kn„jkk»…Ý@Ò•$ë]Í€^ôG§ëïïœÕÒÔ°öŠšÛD%Õ'!¬óU«ÈwñÎ…mM÷°”1ÐSx]Ó+^ZøP¶;×í xUUÎUc=--=“ä¼pÞEéñ³‡Ñéìm©žõ¾ù`&3²àY÷øÒim-s—SýpâC˜m웵tÞm앫Ǿd[ëki›8W!a÷ɦ×V†Z†VÇûçu5Œ&DÀRe(Ëå r‡°»€` <Ý%.`å´.ÜAš=X/©`Ùu¯ÊˆÔÖÖr?—!¼Ï4½ §Õšº䪡©iêà_7‰zî¬}8Ï Í_ßð5ñMØ®Úd.Y‘?åN¶éÊHþ_æ‘ÔªÅÃÙ¦ëm¬†Ái`{K]0<4º'êM·àyÆ2*Æ2È6eƒRÉb›ä®-™' ýYG’ÞCöTcu×élíU¡¬²¨)˜þ]–‰cÌõ%lž\pTÅ¿˜Ü´!P Ǥ.†¢ù‹'±š7ŠßÊ6¯fdµ¤y]ŠRÝ08àzuå®^”Õ’®†©]:¨XmŽg×H5¨²s\½¥h–ŒŸ¼m 54´OÄ?ØŶ/L.Î`kjèCFLKí¡Vv¾çúaÎܘëÐÑ3XÂRôþ^lsØÎ3,hèMrà°O@f` >ŒXØ¡9Û†®nô¹w|qq!7ІØN›¨ªÃÔÖOh±ÖŒWÝðTÕ9ÝÌ#ôºMØ°D¼éÄ¢ev,ôÜñ¦{^›ššœ½èBóHok¹kª{¡¶¢ø¤ejfóž"Íjã5@¬ÃrN­˜˜ši}ÁÂSê§ ÙF O³ñKŸèk|A%Ó¶dçBoe2g302:ÜßÈ P>.S%d9raóØÔÄ@Œ-‹ÊPÇòb¹Ÿ’Ù=ä–÷·B}J6‡jI ­îá±É‰ñé.ÊÖžïMËšßUFgÚþ›éûbjÌSÒƒlY£ŒU#s›&''Ûª”•ÈãðP¼éa|³2j ¿“Çé#¦5bñ='MãÄeû¶ù¡§pñø8„m–?)h!©…›{–)ú>ÞÖs»+£\ü”m†õŽ"ºò3'5½³_véUÎñ]BvLa Û@4^÷œhàÕö¹Ý6S$e›£º³€èWþBÙ<Üú€m„_Ù*ŠmóÀléÕ#,?á~6?âeƒÏ%ù.×ûuqøœ¸Ž3oè*Äʶ¡©é鼋> È.½±(œ«wnffüŠ˜3Už×ô‚o¶óÝÝ_HÖ ýVÆ.]¾º.ÄDŸß‹mŒt­bÐw·TJ–çîd ««¨ÄÝpáï<øÞ×›s)¶ÐP\›l$39›¨ïÜú·/P~ž;'™'Ò¡À[KÝT”M>5ez&¡b¹P°%/ U0x>à;½ïUþÙåÉÑù‚ñ:[CZ½äãfÑ«±òcŠ¼&ÔTLìÎe]ª•i„è’ž|pš£³¿±¾wv½öª+(»+CÕ ¿‹mâlñ÷;€ùŽr5Žá •P¼±)aáemÅ€Ò%¤ØOÑVòzP 6ö± …¨µüúê:2æ­xjߧÑi²µŠWf?,­ò„Ɖ5Ä‹QÊ66ªxûÈ«I0㣬µ©ÆèjÒ!lÉ!­B\•ãhzhDܤ ï=êó† _ìa5‚ݹ+Ò'ÚèÐ n"Zc$OÙ»xwâ¤þ’›cŸ}ÙÄÃ@¶ì!Ü¥Si«pús˜m&`¶õ…2Ó|ó7Ê6Ú ª~ñ)H .„ÐU|Ó!¿ùÞ9¢Ý…ß4¤clŒˆD‚šÜ‘c6¡ˆÊ/~éÃÓºüêÂNæÊÇuàGe4×Ѥ–u(jŸýõµ ñ¯Y•Æð5)cÄ€ºªbëú¶Ñö‘ø5´^”ãœgcYú ßËÐÂò|ÿK:ÇH(Úap<ðö.Ó2_ï{ìÄñyÿ4—ᡤ¨lêà•rÿ5,ÍÒiŒe!pÞ”ûiXlŨœŠSýÒZ§;ò(tO ^Í(.˜,?B¶–P‚8É”ã˜/»Š»`£¤’ñcÇxìât½P2ùUÉül#îbá¬áeAÙÝ86îßÀ2*>mv!–°Í²“ŠÚA´ØÍšsÇ´¡ø*íïÜMXòD®÷©È×ßÆá…Ô*#DªÝ |ºË4p‡t´êH/Bbk·C¶9žú$''çiîs=>5úá'é—z *þ`¶‘žÜèiùúèZ Š½ r˜0ÀiŒïx«ûÈ6~)ÙÈ 5¨ç²>H`o+Y¤öíšYy×è¶û³ÍÒ7š>úAÁS9O ôà’!©lƒ8l> Ö2x€lCùÕl#§™™Ö0'û>‰D{ðuÑ„†žÇÊë†ì·!%>˜mddÁrA’Ó* ¼>B“T.a²è¤vìfÿ6ۀŵ¿}lÆU#°tÃ/~\ƶ²þ lcht<_òîÚÙJ„Á¶Ñò‘ÌÙÖxmÀë¢MUŸÀãnè=­)ÉnÏŠÁ _‰Ó%¹RÉÅÓ"ÙQÑQ÷ÖßšcýÈeÓZ4öø&ðê¼[RIw”&®d˜ë-¥ó ÷®Å›¢GbQ”çdé€ÌÏkÇIò ­;Jæq·HÌEF¬p®G²ƒmfJÔƒnÊ>a²¯éÆ9'eíÈ­m¶Yó%©\íBãÌÈé$Ê_jÿÖ³‚œ¹`®wâù7ðàcf¸º©ëõ«W\»xOó^•a¨ÃW†ØxJÍüÊoפ`/Þ ¼nØ2¨fßáJÇwxY´¿züuhñçë6ðM‚©NUª(²\3a»ä÷J˜jÊD^ñÉø¶A¥š™ÏoE©’ô¦0vø'¬Ûpµl‘®ž, Ub@a¯ap,P ŽÈ:¬hu’N }…¿ê‹5ªÿ©Ò ­—gùî7ÊÉlCD£/H‹ûÐ…‹š^\Ôƒï&Š}¬ÓÓÌo‚×lÔ¦X…q¹P$%ÑÊ( Oÿ<Ž.Näg¦µ‚ãu¬\AÖˆl¦®i±(P@áP_ϼ°û:ZWÿøCä–`MÂéâ®É¼E½p¤MÑd¦†,ÛÜ>myù9äÏ8ÚXQ#jÈ zÓ2ë6y>$ÓÈJ´X %}P“½p.eE¢ÁyÒÈ9C[:ì·=s²¼ZsÍØ ,ŸBå,mI‰xÿu±n®ñèÎòÒ0 O¹W݇ÒÄT«9S1¥ªLŽeuI²¥¶¹ÐkÉT|ðe©2ó¤{|åÎoýaë6кœ§¦Ó”ŠE«ºT|hÖ‡UtýEðõy¼"^»EÔg92uOÁ¥¬™k’Ÿ@ò†(PSþRÉ”Lìb¡.›ð±QV¶1\JÐ`Q ¿uÝ!=[uêùWhÂå‡&,¾)tYx°¡˜‚'—uÏ"ÛÈlŸµ–¤’Ù`+Æs}Uu¢^Xj|,O±K„ØF/ À gbr$kPÓ ¤Ok â¿5>>!„œß ‰šZ¾Y\¾©¯—#…ÅÞ1zœ'åücHUi~d¡î) ×ßû7æ™þ¢xíÐí½ï±²8>gjiN¦±.6¢Ÿ¦Wʪ*ѵÈØY¬NãÑðFÖÎÎÖ$¦nA?¼)²ÚN%àý_#¿ýÚŠ vw‘2'*5[WOC6YÃ, â©¡7¿0loúëºxûêQT ì/ÂcfÁHñ?ž4­C ’+C:êž¡CU×èø4CÖC,9 Ž¡—“…[H žÌƒØ¦Ì[ÎZÌq¦+}œƒ¿Â ý†Ú<–ž¥‡«Æ|EŸˆõ _Ȇ&øÊX&—nääm£Ã.Î;%¯iR÷£è4º‹»‡±&ÝÄÖ_,ßñ±‚þÚxƒÇ=Y&3L7½Èÿûz-doc!¯šÜ-³J<_E—SÈnE9l­÷…‰WQ GÆ)‘Yêá·Þ£—m-ø›Rð*|m]u&‘ÄäŸJƒ¢¶ž×UÈÙõV—Œq+²Í²¥¢jR§Ì*ñÂ'†œÂÃæeT˜Xﶳ0 ª*’i4œ¶ž]í¨Þ’™±Õ×R–WSPÆëÚ_«¾ú5ý¯8›…­À3=n¨ wQþª9.)D[.| §zÛ¼ôÕæÆ gðþ¢X$kú4ð€(¯Ú0…ìn†Úsi%œŠ‚O×$·uñUê¼¥ÁÖP‡@Æ«°4 3ê— w³`ê˜ùyÚ1iœÛÐØ[¬ S¦fóBà´» «åîá¦Î¡»„߀åœ&UiÛ“ú= Þ?:¾xÏâÿn=ù€¼»/”‘úwݻӯz×ìC*¹Ç=|É«X,HgÛBŸUcug-±8Ð1-V$Ü6»Y*=-o~gŸšì³Ž¸]ñ^[bñV¸Ù‹Å‡9ÁïsÞþ?ð‰Øäò¿ó¼xo¯î,ó×Û‹÷ŒÁ¨Ë>`¸ŠÅ?Ƀ ßõІ½,Àd ‡`ºŒþy Oõ¹º^ÇÎBç« ¶†›v>¼°ÂF¬gÿ¾Ú¾ø‡Þ¯XüO(v7„+£LóL²ÁðSŒ~/2æщD²u@¢à7{ËÀ— *3ÎÒ D"‘U…eÝþûàeͦì™L;ùñ*´å²*Ž´·ØÑUÁïÈ’‡Kg0ì?Bþδ¶?—Ò1üvmýïÏÃîÄ^ 0`Øýi­ºŸ|ûñœp{Ùm}²5ýêÅ‹‰©ßG·¤WN´Lº—˜œÑ·¸½ XWò4>ö•Ô{C‹Bs™äK åC+²«¥ÁºÔÄø‹—’Þ5Oìú,v~̾’‘ýÏëèŸõ¡7®ÄÅ]zZÞ°óéâÉÏWòÚ±O* Ï쯎O{µëÜJåI%ã[;çàÖ-omŽ]hö³Ü”óžŠ$³!x×g¾³”¬FKÉÌyz?™¦¨ön²Í,½Žcedç=L;OPã¶o@3öA ¾wTÙûY—I8N lM5ÝVnAWÑ£Ó¯6ÌJŸ4P•©J`§fdgß»ÎQQM“˜ÌA“~曆ªßÎ÷× ß¿uõò?èä¨*F\¾›sßA›æ”P¸«L¶Ú«îyŒo0`ø™N-îm®+/+«øP3¹ï{.ô¾©DÓ£Lö4”—•W7ö¬WJØFX_ñ¦{Z°5Õ©k›ùÁ³ÌŘò° 2`¸åOLG2}3E¾jÆéà»1»IzÔ$›êú¿ —™ Êââ ɧ¸!©PR¡ç~Ö s@g›m@Ü 2¸”7€Ü>™çˆ×M’.Øž·ãÇ]J¥Y#l#ª}÷¡c·Ý×LϧêÎÅŽº¥u°=ˆh¥¡æCiiy};TaÁÚlÅûJbN*D3]ÅÓôþMÓ(ddØu×Ý$¤í®Î‡¿àA©ksqâmå'tó½'C‰é¿Œ­&bÀp(ªn¸°Lœoef] óT9Ê\‰[Óá@ž)õ÷•ˆü„Û÷“Îz„Y¨˜Ü†ïX6`f|]Ý&,xŽÙéâ !¿ÄE{U…g’ ëM gÕRVk\FOŽ5å³tñ–.“ünM(iK¸X8$‘„§eØf—™Gw¦Í#9Õ–ªr£!*a›W'MlSvµñÛ=sžc‚¥×™ä‚^°NŽ|²åñsܲפÛÄ[³Lãëjó"ÚÝ4Ô˱¦ìØ· »ÌBÖ¾ß>Æó"\o•Ž…³”]œôˆpó1ºÁ€á lã*^mA­LGzÖÛl“b®à5„L·/Me˜mv[ŽÁÿ6gxôÏÃ΃ü_È5ÃZ±p„CÆÍ-~¥ãÿX-Ìw¿#k@žPâá"6^ÙãÄisÝ,8SfécÛÈRÍúT;žÌaƒuïÐÀë€ÅÎÖ>GØf¯‚†G6|‰½Moº£ªÓ=ô‡åV5Í(dê_AÅ9]•œ¯ó{öåocê•ü–]™jÀÿ2|-½aWG 0„þ7¨4*ÇÔ=§¼qSv“°ÍšƒŠ’ÔzþµïÎuÉ‹Jc-I,·ªEýrõºä‚­a67¿\O;Æ“zíÌuUP4A¶]4g˜ŸÍZˆÇš^ª«¨åwKyv³ Âó}•j$Öó~Ô…*Ø’÷°Š;!e›ƒ¶TYéx=GŽ¯Ùpl<#ÂÂBCC#ƒx8Ræ°1YA£˜¬|8ñL纴¯á´hÆB“~¿ØÇÜh¿ẩÈņ ‡¯Û·6§û¿Å˜Ó¨”æ‰u Û¬Ú*)ÝEÙFääë0¶It­p¥A!#¡GÁ³…×ü̓Söeȯ³¹Ç6…}Í%+;«3£´¿Î š»ÏLN”ÒQ–mún:ªØÝ•\³ÕÒˆx[‹ë¢urûì4U?n»o+ú,\YÇ °3, ãÐó1ÚAïr6 0`8‚+öTc¿»YRãƒIJ¸–© éºM_eº I=öú­ø`—ÓçíUŒn!k¡Æœ{õk+C58"3<6îŠó¹µÐÌÝšjà+«zž‹>íŽW&÷À!V:ó©fЙ˜0?ÓÚ- “œèZæ.7³&E’T¨%ý€páZTdÌ…óº ºù‰3àAî×ðö(s¢u@¬äIÑ177d|W¶5)@\|ÊÌþFãÁ² ÷Ú–K´ò?÷èaV ƒ.Ó" ½h¥ŽÅÕSU”¿ÚŠ·àÅW@îÎïÂ5)û 11ÈÓ##6…ÞúÖnRR;ë {ùU6ž0`8X“‚Ä„¦/^½zõº¬rxÖSæ» J¿! ·|)..þPß ,¶U´Ã“KPóº°cR°1?ZüúÍëm×÷M"óY¸2ñ¾ìõ›²J$»âÄ»<ÙWþ¦¸ì]õüÖ¶HÐù½ºøÕ«7å•£ ›HĜҗ¯À²Þ€€Ëü:0 –W[Z´ãI¯ÞmÉ/Óƒoªj‘ ~zfœô}W3gûª*`%NDKuÊŠŠŠ>Ô¶ Q/c觊²’}RõMô­äÅ·aHÎéù€ÖAÑË7S`ky4ØTWâó¾¨GTý>%¶¤0`ø¿ãoBï¶Ìý-ô¨ë„"\Sè`tþ5Öù0üß$ªý.I5­Pˆ*f½%D ÛÙMÌg ë`fÄ0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ ÿüÿëF endstream endobj 638 0 obj << /Length 1366 /Filter /FlateDecode >> stream xÚ­WmoÛ6þî_Á&1ËWQÊ>u˜Û¥Øº,õ€©±)6Ý“­T’“æßïÈ£dÙqŒ¥i „y¼;ÞËÃ;F>FÞŽ~šŽ^½‘ Éh–ˆ„L—Dš„j¥‰Q)U™$Ó¹Œ>lêbž·y<&þll³·›baã1gÑ .\ØÒæÅIåñlún4™Ž¾Œ8Hd„#€¹¢†2_.gŒ,`ýaTf)¹óT+¢’Æ’|ý1bAÛ/#‘Jª‘K©ÑŽYÂ9Úñzu¶’äç NིÁ½€Pg’Jžâ•ÎÖ ¤fQ{]48³1×Ñ×|uSÚn+Lj»8ÁÙUU.ÆË.œÏí×nòºÅYÇ©?xSWm5¯Jê­À(]‰t—M8©á^/Þ¢OàZ™ÖÂ)ÏÈXJš&;ªM ̓¡óõ' Û´Å:o‹jƒáölì„YÉÀ‰Œ`ëYÂü¾Úàdžû]åMS|”gçã|±¨mÓØæG·”ÁÒ­ „^Ou›&ÕêªXÛ°ž78ÞÙ²®¨¨±`̘Gyk4K0áǘƒµ÷´eS­m‹‡oc¡£¼.ò«Ò Íf~í ánŒæÄ{y:‰~ùý·Éßï'Óبˆº%}bš½q‘PÕH³ªj‹[ÅzYÕ+´®ßj¬ Ž,uÞ3 þ«4AÇî/zÇ‚ƒ·Žàl’ãQ­‹MiÇ·Î,jŽ9P¦4‘ª;æ,%²Ѧ‹¾Ä™ŽA ®Êñ'ÆDVѳ@‡¶ô×hqeèVÜZ¢ÌиàÜ6h_O˜{}!®¸¢™4»æžü5\¼¥Ž^ÿêÍ=–Ì`œ¸ÉžÜÒôÚ:‘,uÚALnpã®p1ãfWÇMcŸ»k»Æ™¿cØD.mÇÐìlj[*¹‡üŠ¨Tx£º¥‡bip`˜|~!Xšu–fÑ*ÿ×ù6 ƒWÎMª%Ž.Á„”Åò(_¯;Q—8Ìh¯«tD暴ˆr?Ÿþ1¹Î D—Dáqé@Àp£{Þá‘rA$À­2úF ¼2šœ¸è†ÐíáÊ@LFçC1n]I3“vŒkK–9w™µ?ú—#$…dKTx9ToSh_pFyÅ©ÿÁë'Søt¸1¹µõ=îžãò ?®6íÎY8Ã{2©,H¸ 'Cr1‹Çæ[E@Ž)ð²OÉÁí>ºWÇŸ)‰.xݸ=â¾\F¹ñàç1)—/Â]_ô²g.óºë÷®²®Ú]þ÷J¨NXXÒ3—íAÖ€ ©ì×¹½ B< z †“J£îïij٣Èìä’#áÁh=šµZIÊÓôRîAæ;Â<)ówRg¿è’FS®Bêœ;4Êïšò¶µë-Z¶Õ^ñ´¬Ê²rX}±vzéΖ=иÛ>¾ ¬û‡0®Ÿ„…*a¦ôó°ÐÕ[?î΃Wå9X¸3ÄÂÀøû`¡”Õ]ÝåÜi—”÷‡"}˜½2€èhž÷O6ïC/ ž‰ï÷,¡,؃vX xär“»ºhCÐçÛJ o7u_)x¸uÓ‡µ”ïKì<ïˉ"°mZɦK¦!ÿôRA ÈÆû(Ó¾êƼÏ"ÅBÕT‹D;X€L†MT_ÛtÍ…fGJ¦.c÷Ípºm#µ€Ü@µ­LèÕ‘k=`€£é³<¼Ý©Õ÷›]­ ¹ûß½îÃŽÜÕPŠx¥!LÝ«!„olüÎÖ­ï«ÅfÞuDé„fBtm—ûjþÚãȶ endstream endobj 627 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 145 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 33688 /Filter /FlateDecode >> stream xÚì½wTTK·/úÝwï¸wŒ;ÆïŸ÷Æxïsîyçžs÷V‘ÔÐ9ÒM79§&'É’%QETL¨ŠŠAQ‘ ‚äœsΡÓz+t7MÓ ÛíßþzŽ½qõZµjUÍšõ«Y³jÎ9ÉINr’“œä$'9ÉINr’“œä$'9ÉINr’“œä$'9ÉINr’“œä$'9ÉINr’“œä$'9ÉINrú: ÑÅŸ£<»Š'. ÄM‰w•{÷ uHç±7Cd—J:+`ïœ~áýßµ¹eqxwâo}]DßÎRѧ²u‡¥r—Õš_¯¬Tn‚_,î‚ߢ1$ñ[d |_×ü–XðùšÓïÕÀ‰ à0XüUY¼¾CÂài‹%iš¼ï-ÿ¬xeP2ሆâÿjY@ø¸q>Ô‰†CVQW<¨È2´¾Y5%dØV…²¸X)ùfÙE[RL²å ŠRÅ`qÛ„Õð¿¹Wx‘(4czc[2B5þín/tÑSy …Q—ȇA¡zW32œ;V]£Ž†.ÑhRéâo &ûö è±àn„+VOÆbÉêÊL}ë^¨<ƒš«a%XÅÚ\ë^0 ë|¥^œiN”±‰o0]¯¢‚†Sa@B^SU3]ižV*Œ$+:6à‹k#Ðuš(ŠJª†æ>£P¶ïnǨ¨a²9b@¨ $Y ‰E¢ãnì!E…“¹MâªÍtÜÁQÍ¿…!‹}÷Õ1˜cÏ'Åwú³}iÇó!I¸®‚AK‡'¯ ú¤ Ñh ®J•V¿ù›´W{~€†ÏíÞ·9 UhusÀgbzøÐFUTFK´/ƒö}4ÓyÍ ù©¦†QS‡[ ‹>v£â·ƒUšnšë½Þ=ìì9 ²µ  *øÛø2ñTðm;ÉB;VòŸÜfþç¼8uXµTT¿6$™lTKípÛt•êÎ4rKš\æ º?lF®S] žg¡³ý®5…ª‹ÈÖtq˜¢FÔ–Xz8\ ”é6«À¦È`B×i%@ÿà¿Øò¿C:éÿ€@Æá,ÐÛ (ÿwàoÿ˜”.Ø­ãöêfÞ6‰ù ¢AaÙRYÍ7=÷®ˆòïePÕA´i¼Šq¹ 5l-|"’Hë<„6ªÎce xoáüèfýBÕ¨•Â6Úx\Ì{(¢‚ù]ã+û MÉÈÊô«D+xm—nCѱ(|ôp;«’fÁ7 `¬È×÷ Ò«.ë…_/JÓÍ4= §t) ª0¥‰Uë_„U´ñçŠØ#k{›HàVJîe™P0Ö¾1å };‡?Þ -’±«#‹\XÝ-âÙ–êäí'ÛxøxEBé»nÉ$b}³ÞHì²ÐÆÖ$ðä“GÛ<-ÿ4*BS‰W×Y1ü®¾FÐÆ%"X裨íiÝæV0Û;JV’qÔ>:ç;t* TŠ8FtÉÀª”nôñzºÝjO*º_CV»î…f!×-­/Cl9ª«ç‘,ì¼Á$‹$hÞwÇ‘l{«¹`E»[3,6>‚iýø*x.)€»^Èóa¸n…xÅO; ¢¶žcy'€ÏÏh:õEøõ³ qckÜÙ§ÁÊš¡ˆBŸd¡ªé7—`²·cd»SÀ¿íŠèó¹…ÛU}\´ùû¡Í"[åà“qaÕ«’Y"´!6,lÁwÇuT^–·ñYª¶K$Œ6l¦ÝMÇ:¨*ØIE0ÎøÛÿ@£î&¤äüçÿ  4}°ÌChóß…o—¥BÈÕ¾»³Œ´T…9³´Y ªäÜ·ÝÚ9~6ED©çâ(jJm‹@å…`j`–´&±ÔA$‘W¸B´á›fêè/ >Âé$c­¸À–¥ÚØGœJI9#¤ÓIºæöGð2ÚFãÄã/RhCfžÛÎèÌÉKåü¯£ TÙñÎy9×3.]:íoOrKÐ梱sl)òtîµ'Áê&˜U"›WÚ)½É^>™/÷™‹Ijûuy‰•v=o­.vÑÑÐ×¢(‘ßvƒs£!íÃj‰©âòŸIIçm—²îVZE5ññ© ÈD} V$_/lƒÑæ ‘ˆGˆ@¢¨¨“½"2VàÌ…hÊÓƒ ²%ع ´Y1Å«ÔO#Æše´ÅÒw¡ XÀõº4òB%цabŸzv»ÕR®× ¾®Û@Iú+ïÞȾtéR‚³>#ê „6Ç4OÞnDßx—mä÷ ¼àO¿ `M7 Q裡t&yÍ5ÝpgŠÈŒ6Äö%¢ô‘j Ã)§+nà"À¯OYá }Ÿ—WÎ Uñ§»uHƒ®¾÷3Ù¿¯}ˆ®Œ ?uN\Ó䳫¿ÚLèTy=/”Ɇl1Út.!xÙ£qX½}M8iì(½Lµ÷ƒÑÆŠéS"¶·ÑÕ”úWe¡`B’ÿòß³ävmþ§ðúýu(cµ 8%{å¶óŸï)“¬xÀæ^3©©g‰™¡RîÚ`>‰¨Íá ÑT®‡²|îxd— a—ÂwΤ`´Kï‰J´.ΘIÍT$¢ˆ&÷Kk:»{ª³Âñnga´1rIx‡$˜{íE`Ch#èÈP$‡¢ï¥ªÝQá…þ¢C‡!R †‰F5~Wý›`MªíÅûïd®Ö]´bô®í¢1Áqd|Ÿ™”`¢Õ¯§*jvt˜_:“é6SEx5ÝÁ5!ö‰ÐFðWi˜Œ†•Ú:‚6“CTQh:ƒA§C0(åè'c߇6 °Ó Éo¹ôkfRPß(D3í‹ÞÕuu÷¼Š±Öˆ†Ñ&˜‘t¯I F€oD%¾ŸXÌñ0½ðN2“­Á*Eš° Út m Ú0Ç`ì˜~sAȈQšà©MQ3ö9³ÎÎÙ6 ó.ú‰xd´ùCgRnøŸn·ó‘æ¾çŒÞ…6k„CH‚Ê;!f^)ˆnÃ0ŠÊír)NIk†+‘ë höi|àŸÿü§ÿ"´'yúÚÐ}d&5ß¼í ]ßž•,Ötù%§‹^Z’ Ûm# šwo+ñ !êà•ªi‰®ÄOµÄ„)Ú=wÕØçO!ô¿m ®ZtÚË(öN¼©â¯D›c­ ²äúejÉcO´ÉZS¥áS¾šIòžæ~ضù©ä–oé\Ó¿¼;A×½H¿‡+/Z!v›hEk0%mà…=K:îvd-m¸³€Oœå÷ÙmÀÔwBmµ‚o‡‘nÞ_+Å⵪Žk!hãeªq¹ft{9éu††Mðw¢ „›í*èÒKÁ¬ø_ƒ6\".±EØš×}Ìé1{¢ øÕ¾«6ÌÄžäÚ¡UÉA‚?ùéÁ‚ÿMh#X\˜¿è Üê\|hf”þaÚhiæ!š_ÆÒ÷Ÿm€»‰ÖFn‰SSS]µO¨Lê.´nF8§OÏÎNÕ›¨)g7l"vC¿´mxfz*ÝAƒQ¼#Ó³€ün -ºþ¿èÀ oèâ_DºÍ~™ ÐÍÿüOÒ3 ^‡ŽºÂ•’¦{±®é/{îtg9±ÏšÈÕÎéXUt|NéÀà`_×—({š–¹³pŽm ÈX]Õ&v ÍñòÎA ã} mã;K‹V£ ÝÈelxGNK›Ü¯¢ME„ ÙïÖÌÜlÿÇ{GmP!K\AÙEcº ¼Ip$cÕ3JÚ÷mØé˜37¸{¯,pfޒѪ¥Ÿ{’ÌèïZ’uÍ ÁÉ+ë*¿eB²ƒ#ÓÈ.¡Åxˆ sŸ#ÑçÂëýgRgïï`ÅЦ´•XY ÉŠÙoG$Ñ1ßó`à)‡ÇCÀZ%I™0¸.6?€^ÒabÕ:„6d†ùÐ6³6¹‚¯ê6àŸª³"N?Qˆ6^'&F†$˺Æ| mÝ(:±/fff:+2ŽÑEÛ¤-ñ€ Çdé6p‹0HxuràÆÎÅH€;ÊP$7 Äv›}Ðf‘­ªzñM×äÔÔØp‹H¨Z´_F)é4 MÏNvÚh¨Ò» ¿,3éþçåݺ íº´slGóŽÏýNhqŸ{;þ¨žžQlvÙØ›û˜W Ú˜™šô®pÄèø>?ÕÜPÏÜÞ»ºO¸öΤX~寯ÆxÆds%E;fì¿ÿò¯b.Tþ'ðÿþv]b&õ?€±zàçh¶³kØLtÑ¢Ó4µc2 ‘É»§¦nÞ莙 ­.£kITÐõ‰Ôh_###3¶KNIÓöx¾Uo „è.ï²O$ÝA–†W¼è†ÍPæ3041ÞAZL·ù=8ciöf|U\×ÙÊkZ,Ö?Ý64‘ÊÉ °U¼zÊ1¥ÜmåÈ´Û\ ?¢§«ú>8ߌu5qKÌÿã|AØô U‘ÆÞ÷…àÉýHT õnî·•àk+—ðó¹ÆcnÖš’ŽžÙ¹ûȇFíYº;ËolbÇ{b¬k4¿)±ø>_§M5¬Y‚6:ŒÌ,9ºíg$Å}ËN°‰Æ_š˜ºr%„eø骞?˜ÓÇÇgƒ“o oÉÔÔ$ dümœ“I‚ÔÆ  $ÑÔ'ùýBï# †éiµNÊ^ò[.2·=-iÍ r4rJ/‚Ä;ïÌ®V3®^7Óº—íý(O–~+ÎÇV_Ïèr8Ø,úØÝ­ËId§v!iÚû¸Ä–‰S‡êiÆT ì.Û=ŒÏ=xµîzý«È§{MhÖ“0vÌÖÜ7 HF6.œð2000±ó,ï]GjÒú"ËÌPÏ1èüÚø«Ÿˆîpy—l˜aO§w}ªÛZWgEÜÒ¶7¡E98]ÿ üÉBß²ïB›þ–„¥)¾·ëWÿ î·ÓàÞl]ŸêdpúåÊ-ÃV»}†ü%hŸVûÛLøiÞ4€_HüµØû– mõ}’%Xè¾ÿQG^¦cl¢¿ýNh³ÛWáw¤w…—SÏKÓÕâá?Rn'JŽÚh£QÚÃë?ôþPÿôðÖ%é6K=—ÿ~æ,Ÿ“H"OVŒí•äícö¹ºïÊc«Gf™;†ú:`ÕQ×jþB)â³Åá}ÿû[ÀÆ柼Ž\Ζ ‚–¸þÀ±› Ë=‘úA$«Ñ69\þ«rÁ’Ã…7 dB>8‰“¾'o@Àç e“Ëþ4~Žr’“œäôÇN(¿ùÑ>ž9ì¹³`w†R¼»œ©¥KöÍ—Y^8^…¹1²ÝáKƒu•UUÊzæÅÝ¿ìj¸ªæzGüf¥ÞÚÙ,Iý”Sz·´ãÖð=£ŸÍ¡ÕX}†ZõÀòW«¹Qt@?ó«È!®2JRAáŒÝ“·öô ¦ŸŸ,n”‹œäôKu›ÙÏ…XWÉgA,ú‰êíÞ´9þž¦ ú ¶r½J´ jº ΗŠf›˜$tRi÷N%aÃâjΨXCài‘Ñ5W\ñ~Äy–_‹°°pDk»‹‹RDq~&6ŒŸÕ*—d+!&Z¸möÒ¬„6ªB/K&©í¨²`Þ¡Z4*Kí~^w5xØ6üÆ1@ä$§¿,À»H¡Mì»É;š?Ÿ-_:T•)U+;:ìâ›8E”íNkø’¹m@ZkHVÓ: “ZjêÝBÏimÂ&?¾æMóº€øü~Ú€4òÀJÕ¶Pm€/Ncµ\Ç×Ad™ q4%2Œµiæá06@hcreìYØOZ'Ä%L5?pXv•áªÅ˜*ž/ž€ýO¦ < Í ™º¶># çz…J2´°ŽyôI.–ùËÐF_;º1]‘¦H´›„”'Áq탧މJHÄ? ´€H T^Yšáµ› ¦*èõéòŒ (¼Æ)]…°baˆNÿMά¿Fù4JNrúqhƒÄü*<«È<‚D=Z­a’0n‰9­]-ü Hš†#+P¿{{9R…åØØÓÿür8NŠ;7ß~‹¤a¾?üg¡Tý ³Ÿ¿6BŸ_OŽBØ6šÕò»E4<ÏÙi·¬ÄwN8fB“²âT¢6»{xtl¸?ݤ½m·A”“ÖÜ,Z=ôb…L´ ¼_Ýß× RWKµSÝ?úJÏÛtÓ¢t|l¨Ç‹ªðRiÂ̵¢sߌL.Ê…GNrúE4ý¥ÄÜ+\òN’“ý…bçe)Ò} b·CDòî¦`[YZ²Òï½Dûp yÓÓts3·cg`jþ=Oý£9CR@²ŸÉí×#µRbÒKij1>gÞÒÊ*üµ”ãꈋ¡1ø!Y˜ß, ±Œ€œ‚½œÍ?"ÑB8Ñ6Ì«¯!xœü\èjmbniU(Œi¶YZÏ+Ot L·ÆLíªŒ{`•¡/ÀdçâóäÓ°¨^ÀTc¡+ÛÔÜÊ)ï=ràõÛ[šúeVÈ…GNr’“!èÒuÿ#à’œr’“œ~CZ¨ñµÕWCi6.Ê}ä$'9ý¦Ê€’@î@-'9ÉINr’Ó_x´ÿº#¶Ì³øöz´}tÍW§*_;ÄywÙd<’‘ß¾UÛÿ(CÁwŸ -›3Rlü¢ù£EBÊáìšøê£oþœœþšTtñJ só˶#v…Ö¥Z¢c®ê“íaÝvÛœî½G°Êþ‡ÿ§Â7…Áïy–®nu ¼útDZ˜0ij(©ªëzÌo‰Ý<À¦âÔUÑʇ•ºfw›V¥:/”n¨­i?ÇëXÇH~襯=þ-|9h­ÁLÍÍÁ 5´-˧$;ø“€RfÄp~ÅTk¦ýVßYØø­8E°£¨Ù#ª:oÑIÖ3³h/ûIëìïÓèŸ/ºwíô~ÃóœtpÚ÷Á  »Ü d¿’ƒNÀçñØŽ¥_t4À{³bTظ‹Ã.{Ã.§¿gz‘lÃvT×ñ÷ß·~D·âÉ‘ywÈQ¤PÁ.}@°Ï -u¯·(g 5Twnè&‘n3Ì\Ëåf-ò+ÓOKß)nVèýøHU W¿$ÝyC ToÖA›Ÿ?FØ—|T ËJ„/Èr6‹Ùãš{Ñj Gq5‡s\è'*¬´Õ«×dŽµÜµÄ¬ Á׶×'õ­ÏÕÃÉF((› pa)×ÍïfrÑGÂ1 âé¥ÊR‚dÅ Ú¥§ 2ωÞíý &â{e¶ü³à¤–÷…F©w$wH2|íáQÜýŠ$rÀ—¼lOÈy;&YÁÍ‘b¦eÚ/Q›²4Ûo9Z]öÙÜ{3ð×j¿ÿèhs)(øBÑošïE¡#¶mª2´wdìÄ[=*MK„'Äf’q‰¹],åÃÏ[%â¾þ‹ºt±Üó¿PÌâT÷€P'‚¹KòÖN_hsD²E?ž°"Âá÷ÇŠ”Ò¾lHð-èmëÞàí8%cù}º²q¬pàÞm2í¬O= ŸÔ Ë‚N|=¼ZŶ¸ {Íæ\Ñ$mÿ “Ð!+X"}ÊsýÖÍbŸåÞ˜ÚZnÅü‡a¨dbÞ漫³ ‰Hpqqì,¡ Pr%‚F&ÚÚ±)xÄ»uœùV–·K\bpà Î \ˆ² öñù#åW~¢ ýd—šîšÐ±–¶¶Dur@¬Îmu{kÒõÌLõè†GÚ9À›“x<ÑÚÕírÛ:𣼬( ] #–†–YÍÀ:‚6ŽÇ² è,#=QǺ>ÍFäÙ µP½Y1ðÆ‚,u)ZÆFÚ$]»Ëðé$$béíhCcJIÛ"tfpM^ƒB²±µ$à˜ŠúVwœ ¨¢¬lí ìb]í(hlLtXš2)w¯`0iB€®kke¨¡múªcfO­s®ÊF›¨of¥¯3°™†Ç¢º‚Óš¢­«yö)„¯ %®(Ç&tªNÄ {íߦ‘šúT À„x8ýñ†¡ÖÊÖ– N Éxák‰:ŸHÀá³ÊçÆkîýÉTŽß‹6Á~§Ÿ³_°*ˆ#¶mŒµp ·D Æ–rêa,º*ĺM1Ú,ZçžÝ1=û‰…¬VûUT°I•È Îפ »æ6÷ÔmŒÜ%zì´=‹xª´š–åŸT2ûj-²ÃíB³Ë¿Š6ÜÑj-¬‚¾÷¹KÙUM½;´…ÙÚx”Òµ÷x%Q‰£ ·Ç±’yÖ×FZ»¶œ„£©t[K³ý£3Ò%§ƒ„c‚IyuB݆Ӗ§€¶Gœ@§ëQXÆÀÕÁ8Ð-[ÅIW³jŠ¥qÒ]»ÂY[ì†öa 6f¨(›1D»X6¦©Vö¯~:Ô IxlJGÅ­¼Š!°†:j¤6¤UF‹Ã#…5zÁ_Vü ’ôé&nH¡?^bŒÏóÛhd‡¿ýnªëa ÃOxâÛDýý+O»„ÇÇg ÏM¬î…68"ORÆ°¢Ï?DŒ'­9ÇÕíO}µáø«e£û¡ÍÉw¢r®¿{Qp.1ÊL‹¨€b\~Þ‚øMÜq¦¹ä ½,#ìhÙ¯û$”› «N‰D$áñð®rhiç±ÖåÉ7Eö㯵€h¢W„6¯ÓBu£®ˆºÞš+ u±(9J‰ù° ÎT’÷—ËîI%­Ð©ÊÊÚ’gó. ¿&Ðï+ª 0ÒŽyѺÑt…¢Ÿ½–Wß.:ö»¨­Fú²%l—¾úW™Î%&&F1§x§Ãº¶{\ ­é Y›Ë—B›‰ÍÞWXBRÖÚæ^±ÝœIµ, ãúÙ‘o¿­¾Cu>ö±.Ðûr36wà¯!áH+\aÑý-0’º ¤WœÐ2OysFŸä]:)bÅ ójl;¢`äi´ ÉüòݶA!X|ÈI Øû#Ÿ~_ùÚR—3"X« @k% c…/½VW2ƒåsÜ@W³Lµ=#0õj„|ï¥EO¬„ÐÆ•–ù¢C¾oâÇ¡à/9QÔ2VßH£ÍSAµ~î“"Xiϵ&âPÞŽ,ëÄ’ýЭ%>‡D›ºñÕ½uáÝá<ÞdŽƒÌ™Õš¬Ÿ°N«²K΃LQwk„ëOcõm£%ˆ§>ºÚg«%'ðÂ’¾»¡FÒ†œ¿¸‹H!#„EcqÎdè0œvP¢¿eñ¥*„b–Ùý}hóôt€EÂ-ñì-˜¨ÛÈ_ëÌ"9p;ÓtO–ŠÈÞ¹@[6Îý¢dV ýψTf²ˆÎœM¹û B˜•±–¬sñÎÚÊXƒ7ý›hŒgPúˆØ‰O/N\~òUÝ ˜ UÓJšGF†K®EQ,}á›<‰…ÇŽA¬"t© â+ØG¶³:. Ö…[ÑÆ6§Ÿôu·TÔÔj‡7ó¢íM/ôöô¥x&—üSULVMwßÔÆÛH#²ÏÕáÑѦ²ÌcGÌTõC§Ö¹õÈÚ¶å-}Ã]á:ªÎÙñ!´¹S9Sq9XÓ.º§oÌö^¢•yà}YhjVãÖ8ÕøûµCCCõ¥7¢õVà=ÝNÚ¿ì²þþ¢”£ &ç ùüËAN÷! ©=Oc¹÷õöðç^U±ïš{F†N9êZ%?ßkE*Æ€äw¥.N·›19»¼DA;*æ^5øé†×w©k-îD¨¥¶¨tk¢N¿ð|óõ]’Óù ;_««¢›§7v  AõÇÏeËqãû¨2/%ùF…x|ämÎØÚÙŸ€M»þ¶ÍckŒÔ?Ër´f»'Žq ß}E!î§j¾ýyÄÃí>8þV߶뮚Y{ˆ#2x¸Ú·Î¬K~zø]žm8Ô¿&Z¹ú—¦{s£ ­ÖÄJwájr¤³gpQýèîiÌléY”õ)!bÂêž^uw²³wt»ü°JrIt¼¥<ÂÏÍÖÖÖÙ= à-d+ÝZì²stÙ’4KCyc®ž}â×öŽ¬ÙU A©†« l‚„எb‰«»Ž¹xyMÃñ„tOYïv°u[Ѧ5ËÈû¶°¨[SgÃ}¬Ø61i÷Å…oÏt·aGl½âóõx›pcŸžÚøljá÷᥶6ÖξQK|a´ç‚t;¶µ½óå'ÂE–©×ìíìμ‚&D—OøYYZg¬ØJôsºTTžî’Z4öôB¸•µ]âõR„Ù›ŸSMý¡ð )ávÏë Á¨¹äº›=ÛÚÖ!õÎ+ØnÃur´X®€'G8>¯‡Ej!=ÖÍfûÆ\˜ßžÇ.ž rc³ [—¯Æ»?þ¡M²1¹^å,GºÙعq 8Iu¡Vl‡ŒÂ`ß÷/%ØÛXÛ8{=ú$Š]Ï_Î8Àf[J…y±ÑxšøPrUñêq'ï”I%ï|´µµ«ÿñ>á9Û@jŒÓãZá\o¶í•¦‘ƒ7þÁÉWóðý¶Í?Ø”‹kC†¥AÔåØhu É”·Ô^T’R4û•ö|×£Iœ1;‹@ycý#¤t¨VÝJIʇ¼RzÚ9êL²Ô\säÒ—åMèÜÛk}µî.Ž±é 0@WÞòKÊë)µbˆVŽ¾@=«² ÓÍÅÉÅ3 ¸ÙŽÎ9ïny³úf_Q„ojŒSmñǼcSïl]&¯&…;88úFœî»gÎ4Ÿ;:¹íá¦J/ëi3Yúf¾§®JVp®2Á9î-ôÂFÿé_GG‡ð¤« ü=[5ä¨ÓÈÂÔ©`7;·ûµp-l¯ø¥¡—n~ÈÐóèr’‹“£whÂÀ tc¦â†¾‹©kêí·™o)pströ¸UÚ¶V×òðXh总~ÄÍ}u¡ÁÃÙnhõjgº;;žÈX@6×~tò —¡l,vŸ<æíàê]PÛ/ú çFJ”££SÀñóȦjnëUÛ¸²‰¦gnNvžqƒ0¶=´ ã‰lÇÌèse·Ï»:; ?5¹)ìwO.zÞ®šy~)ÚÖÎ1!Úcù9ʼnE&™ÙØ'T€ Yp¶¬áµßOp‰{ŒV)ëº hCÕ÷¡aOU 7XíF°‡úPŽ—›$öBDЫPwã³jHrºðf7 T&Ø%>jà6ÝÀ{¥€?'»››[;¤˜»^ŸasüUõ=[Ÿ°”QCÏ·¼ðwsrõn…Õ§ÍÆ ‡¤wïï%[GÂǪò—²“ÂœbÓò lxqYØÛw‰¬` h ÁáWð6æ§qZ1¯À‚®Ûª«šrñl®è+ÒhãŸï`é:‹‚í s‡‹‚_ß@›ášx²ÎðÚ_ßØÇ]]z~1B÷hÂÔø$°"Ôm¶Æ_àP„wŸÛûûº¬I¥‚æ«Šˆ³Ò¬‘ m »xó·tð¤Þ5¨Û`5ô®=ëîé¹å@t€†ž§IZGR×Çۘꤲ¾±Ù ~{¦“ÆÑÌŽžÞîöÏVT¥Ûµ`Ãpïć&¤y’'àq¶¸<@ÀßÜäцÉŸ«Áã4çà-A»ÑfkªM¯5+Û÷ÔmP7€Ó Û“Odh ÊÃÝâðøŸ·¹méÉ0:¨F2”ÚÅùxMfžÏ795õêrÆÚK<òéžbö¹µãˇ5uJÏ WÐtÃ`Ÿ¿û²½õ¦ˆ¨¸¼ª¾ç—éVÐ×8S'bc—¡ÓÈ››ÐVlÎÖ&¼jÉFM„ÖmQxQR,p^w{dë6 >æ3 ,ÝqÒ£èB›Sù MDŠ^û<ÿd]¡îN¢aKdIˆ6÷pf—»…°ò }5 ,*ÓúÀfo¹¶Kä &u Bª"Qñ QU³^î´o!þ„ÿÌ¢¤KN±·†^ô¡Tllpù;†}m*œ1žÔ$ò…ÙØßäûPž/úK®­¬¢\àŠ·¾#ò¬áVª¶Gó['lÂ/•KÕN„6Ë,œúë¾ á¸¶)ØmH9B…‡g¼âoK ‡5¾ §È¬ôâI¤u°3œp6Œyùä%;-ïž3<ðdVÅeäNÝr¿/Úð@´!½˜F×M uˆàqªËʧ8»{%DO9hÄ>CDwn¸½¶¥¡µDMÇZœÒF¹Ò2´%F»®"…+þ ëuÎC…ê¼!‘ F“êmzºŠ u+N÷詧BcB¾µ¦[!)Ö4rùØ*°÷‚6àÍçázQ/dê6‹}•Ø/@õ³Ñή懔ñÙµsßÒõ:ß<}ñ²BŠ»Üº8EU›E!?aj·€óƇC_.#y¶¼{ݵ°4'(«Z/õè}|ë"vûå¨>n»Áù±Õó#Ül#D`«€!Â{w¡ ÿ¬îaÏÜ ™3äü“>övt•ÚǘEL)´Y~D\Âg±IaLGE¡q 8ãN¼þi³þaœÏ厗ÌN7ñçëé°D%ƒK¢v_`«x<µm@ùžH °;¨„¶óº]T/ÅaD·ºáýtmÜ!ªŽylRÆ8o.s2 )˜þ‘I• êÂKH¢k"¡þX,ú¡ÿy¨y}?´¿ó¥ø¦E¯i¡{fs¯Ö5ÑÆUõ »«²c™!ç•ÏÑ&ˆçñÆT9‰¬iΰÞ?foš^*6Ë6J*ׇDNX›­,f~ëkhC$õ¬!Î?4ELÏú×­7—Ž˜{äÖJÞ鮼ư:*ƦTÚ‘¢ =Y™(ô+š*ûc·.6œ¹·$"QÈD&“ Ž2O…ìÖqí°¬䥾BGæ‘’h³ Ñö¬Ò%ª½\Ú…6k# j=ŽlËI?ë°Jìš…®çªjÔÚÙï4`@ÞÚ)¢7—ÕÜÝ´SR¹1¼“«Í ‡OppL ÃQ¨"6hª)(&´îi¬­ºéžô ´‹ÙéJqÊ’©ÛäØ([ivD£ÝFš…×ðÒÚ)G ›Ø\àcÚ'YØ€·K"aèÒ8Œj[>^‹òÏ(¿áA|:Lµ<Òõ{úØ•p¹—ƒX‰•ÄR LRçµÒh#áGÝ\]l£9÷´]²b´Ahq¬+'娢†¿ØÕA°:õ2ï"F2IZØðéÆÙm„ªÑôÀýKJûå½tmBy÷RÜÒ‹aF‘™ÀJÃA´)ÒÓ6g?Ét¬• ®øX;]«@› _ìá”VÄyüX M]ä|mz…h3¦¥ªÔº$ÙC¶Þ÷·²¸üVRv‡jsÉf®ÂW‚(-ZÈ›qP·Q`žÜ m¸KŸIÚîÌw Íã_Œ6à3¯N¢XÁ9aL)»ÍÖM “ÞÄ‘\ë}õ ²g±Û¼‡[¥­ð„:Ùrn_‹é^1«A´Q F‰X>kª ølV€—h”m´9p¦újŒnäåoì,)lTn?Ò,"Ýþa§¹ß=ïH=$…6­O‚ézî;—-7sóŸ/8“²;• al²JL^Ó?ÞìžIõßuÅ› Íþ}Ôtb!5qôÕÑÇŠn6%±È02ÆS—EkRhe\7¼d±Þ|ûÆnYd·x‹Ú(bA+$Ÿ¿wß»dø3VÔ³ m”ÍRüíLl Xü™¼ZØÃvÚÝÊEÒ¢cUì=OA.M±ÿ¡!ÖÆ·9±4ÁÚÖ†ŠÃ‡¤@ÓIþF—²ÂéõcÅHIË/U¼üeqõI"êÉy/CåC?×Àhã‰þ×ôOB½G°Öïéd¥®|H¥¢‚!»_@Âåw³ˆ¿µ­„¼¬ª¦Þ4Ãù+ƒD¼Ž]W;Òìx¾C•ì\FÁÞA©¿å4É©þî"î0û €Õ¡ÊÀò`Ÿ3böD\ÍàªÌšÈ|OŠ‚=|£öª”@j¿@°›çÙF²7ŠìÈMVøîÝEÜ \V‹È}/™L¦•xW\÷½#ÿÈj``×8; ¹'g $v½T©Üel߯Mw Y=ØçF cm¯­;ù¼« r§—¿7z™ì>½o‚ÍõåÅ]´¼!€Ðf`ùG¢9w}÷‡—V¾ñý­É/.±År ÝÔ^rÖ.àÚ×ÐFNrúãéÁK­]ÄŠ¬vdëÔ ¯üÀñ>'2˜,©1L½åMðë@\¶Û˜B´Î’óGNr’“œä$'9ÉIN¿»†ºæÌ4j§“4ˆÖKVù¡W×iNÑBõus"1ØM$–AtZw§5,7Δelϯp›Lƒ…Öø——]˜LMMS'äóΆ°˜š¶Gã9»Ï‚_\J9æÂÐd¿†ãi …]“Dñ@L-]¯¯jRHÑ Ö‘ê»VzšL–Á¹Ÿ€ÅK²%ëYùOIäf߆X¤µ¯¼ %8Ü€] trJŒ‰z^óÆ·²nªZáÊýõ³ƒg$üE;1 ?Mÿ.Ó8&ùë@²sÌ’UeY8%Õís~¥œþ4ÖZ<º)p§0`!·|˜ÈǪ/J Í`I>¶{}¼‡§<¨œŸ_˜›¹äÁIJÂ6ù€Bÿ7“fþºj÷FdHJáÃb ¬bîsGj?öñ‹ÒÌݓ߯­®/ÝŠbS8;?ßÿ:5šáî\àN£Õ‚n7,ÌϽLaÓtø€³±Æ›«@+ÙÀk§ú‡PÅCë›< £(‚¬ÁK7jG&Ú^m•,ÃæÆfþi{·˜"‘æÕ'”ÍrëÓà nM2•´g ÊXéaÿ7³oòÝÏxî¯j5-œÃêlRé ÷ñ4ŸžYÙàýÖƒY–)¶þ aµ Z_›˜ƒ@ž·>ˆ×ˆàÉ{æ_‘–ÆÚnœ"àHÑ)Wšûg÷A›Þ7ÉZÆa²XŸqÐÜÚ±%‹ê›Ç-²› Â-|dØëú¾¼KdcˆFo?Å D/Øõ›³8€!16D½ÁÛD#¯~DòʼnO±Æ.Â.#ØbËðw›5møÝ$EcÄ'³½ôþ›!!Z­Wú«êœ•ZhÃÅ“T› ËÈÁæ‘HÙä V?$›?€Uúaƒˆ4U|mäá_q7:[>/­hM}Žðv¶²wúyL mzÊsŽØZÛظÜ|Õ+Ó·F΄{[±­|£R'„{i¹÷ÎÇX[[;y…ÖAQ ø>&D‚†™±yáÝ,Ûã⽈@[¾¿GBÅXQ¨ó¹–÷wN±­,ýŽ_Þ© ýUÜØöÎGËÛ„«É[ÃNv6Kž(CÓÖ àn²cî»Þ8O«ÄBh;âRûË£NàÇ3Ÿ7ò%†Ø–~™C˜_óà‚£5ÛÎÉûù縅¹.NvKœù“þN–ö9•ý»”ðÏê…XkkŸðdHf¹Xî‹t·²uÉ)‡Ð¾(ÔHƒ@4µ²NmÙX®>iZò!-È5S|Îð8Ù!9¯«á®Ï±ŒfÞꄹ…‘Ìd³­lÙ–#KBwÁ`©žm,ø…Ý"§¿£Iøÿó«Ìò—†GáiÎÞh³/ï¨ÅZ-Y‰PZßÑßÛjÇR¿\Ú+F›áª3(œygïÀ@o‡Ÿýڽ檩’ý²qxx¨þYÚÏDgðÎ#šÝÙÒ¡¡®æjuEÕ¾Î|ë55”]Ïä4°ÕA;„¯[ž e¯†~2 Œ?q&2ôžÖuÍÎLß0£úBÛPßߊ¥šíèøh®®r¥:CÀ>Ÿ°Ẩ2A93R›¡ïó®­glž;ý%GÐúÒÝ?4Ю‡³Ï€ÇÇ ÷ ÂÖ’ OºuØÀà`_[¦2®r‘äÓi$=û¤þ‰™ÙÉVCuÅ×ýœoÙ­tüI=øVSq2šä¸ Š ¯C[[Ù6ÐßbŽ Ϯۜlg¨‘ÞŽL/l K½PÖ÷€…b´’Ñ´IÅïcÂÜÞ¦é[ÿðy=oN5GÆgÂL˜qåÂ9‹Îû9'Ü“Õ(rú»"ÞJÁ|°Ó]¹Áå|o´¬"Må?ý|ˆ©oš8´.ěͦœCTdˆÏ´FLHϦVºžÖ}áAá{I´™iË¡1·×…+£,õοÝRóͨÃä¢A¨@›½EX"1áÓì´Ùú¬ªl±}\.UûÀŸb§»6Yµ<½`â/ܘQFçh14JŠÑf×À-=)Ñ×Mý€Üœêkmꛦ*´án,¯A;\ùUÇXúiõ`ÉÌJ÷? â5hÒ™fpÈãŠ0vßÆê:´ivê!JÕ™ø\ Õ Ï‚ø³2PƒÑ‚œ»ÇŸ9èÁ<¡£ý'ÂA*¨QyR.öB`¼æœ–EâNSÒv†YQ:G“#Xžaªìþ`R¸ÓoæFÅhIm6V!=ÏÝälåÛ*»=œ‚ІJ,õs̉tíÕàNñ¡ŽÏÙÚäðW´ñʽ ‚ÏRB…ΆËÓýu­}o–©JFfR Ú€“ºè ÔŽýEéDgèø!Ú€uo¹@`DÉ9 gT¨aÈöe¦âãð'ˆA-§_gÄ“ì\`<D›%Ùh#nìîæO·N{«¨jöÃÀ”jiìú ïÞ½{ùi î #·}¿²6sÝ©LWq²ÇÌͳ?t½y”v1=ýâ…ÕP‘ÊÛ $ÉçÈôP骄n3ÖZædb|þyÃ- êË…I¶N;j Éßd¤»u`8™Ú°Ç‘úàjÊD™tÒD+¨¤G¦Ýf±¿ÌŒ‰³s÷ ÷4 ê¥B6꾚BkZ¢ížØ0¼ í¦Ÿi q28€"¹ X5( `é>ä6„vû×^spHm¢ƒØ¬:®£r¨cmÊ@MªAGˆJ! i¦{¢M+öÆjÍYu©G¼m·›¦®:ÆÝF›ŽŠ[L ÁõhPDd„£&Æõþ$Œ6„–9¡Á<Ô…š]60ÔPvjš´¼â&pò–qÌE•`FŪö,7ƒ.¿Ü¹: 6`*“\LS x¡é¾‰ºe¢ H¦t•êÁu`ø±ŠN¸¼«þi­’¨J˜ÚmÕ%?7á_;7Ú7° HîÙf5‚ƒmŸ® ætö­«Ù]ÏÎ`ª‘ß¯í·ª F›õéfœ†¶&bØ:ç*z:*že_éjiÍή ðµIÄö¥m»ÍÜÊäíSž:~ˆ3/§¶´dpKìÏÐEQÇÍìôìÙ®ÕÔÐ.ªná,taéfÈw¿m®ÙkÛç·íÀMmÀÑ”C°mRüXº©Û‡çn-ŒßNVÁÍHÌA>–?¤cQÕkÀ´ G=/¼âóñ5G, È¡i¦û{é‡Q}ÜUK•ƒoVd®ûìFfì/H)BIJ'xÂVåÔ“U à\F„6«Nê?g7妹Šmš·Ñ†£Í›«PÓd?*þ²Ô_ŽÝ\³¡…WÑæyŒ«QÊ“,’…6Àz5FÅjÔPd!ÓÝÝh&{ií|íCqÒ‘ã¹å]óïTfǾt É|ä ‰Ï:0®7²)‡Sžö×OÂT›“ ¢˜Å*Z¹a|«ñJ0Æõ¢dïµõžò2ÕÓÒ9±¶7Ú€³ƒ5‚ú5dv±EC Ý9ÇÛ¡(¯öiYöÃnx}å©êtwwJ<“âµ`» 4Y`«ZžâÚ|/@…tŠÏ ð;¿|^€]í¾¦²¡ƒä†ß'ëù=G`i´Ì ÷M¯p%U£ÅWQ*þH÷»jÎNȦ+a´â”ëàR®õ2ÉÌħ50(]ä?8¡uˆðek+> lX¤où³È9 Ú(‰]ŒÊœs¶—¦u B"Ž†LƦ^W €)S=5ý/ =ÖÛ^f]/„;÷Ö@ÿä¿,‘¡ÚuÖLç äº!Ó m•!ØžI-²•Á¡Ë6+©Dœ}Î8È7i´)í“dÐ\O1‘e\¿¿äIÀ ú—ÁéOÖa¬=²¦þ沟tþøS…ˆ(XÛhÁ¸´“1º!¯ÛhÓšF ‹0¬ŠHsµÐ¤|z¿íj9ý=PÓøƒÆA²&V`­-ÐÉTIá°ª’Ž®Ÿ|ëð>-Ñו¨®D¤jÔ•©º°ø9ë(^)ëÝö­f샎Ši–¾2ýtã>º d•©µÖ%©45¢Ö¥·Ã»¸FRSbÒI S—6Ñ©©²¬Äàüiðˆ¡‚†„QÒ4¶¯Bün×Uþ¿çp`R±•øŠ™bfŸ°ÄËež?^ßõY~$îŸü ¤÷¢\ˆôPÃ’5Éh]Ë€QJ&ÞüsPú‡Þœ§a”lu,=—[2ÑŠ˜CWã<ˆ$Š¥¥…B K ŽÅ3j&Vº ‚­GÔ&„<Ól 5"Iãm?¬–ÍÖãUãJ…+Mnã|‹mdbgc†¡h=þ2£^»»™‰ed¢Cײò€×mø]J‡~†ý—EéÇ(W…ÍÇ] q±$똱µôØn#ë E;VÀæd§nªNö,†®·WÀ·?%»à¯Ùæ§ÑU›û”N°‡»`O®ïç,Ìf¾‡·F›ÇRìØíݼ3Lœl×l™Žê"´ì/,{8† öZåÜ«‚’•Y£Ý‰#mi÷?Lˆ›RV£ÈINûQQš…[bÅÂÂâ÷½¾¹¼°6Q*ÚÝ7k¦¤ò mvŸ]jáAÉ ²º¼x㸅gÂóo\Ó(<å¿ø{2…¿9=9U#.!Œ6…¿ÑÌü„-CéEËÊŸsg~fª>7D]'fK¢Á~ïF‘Óß?•ß8jddhhëù}¯¿wÐÕ7ÔÖ Xåpøã}CmVüã‰ýßJqÕ²:³ü§Ý¿òÑ€¡‡Ì[Åß²`㠒ߨ¼îl—˜»ü?ë‚rˆƒ¥•GìȽä$'9ÉIN?Ä´ó•éùŸ£‚ýÇüýWá·z÷’&YF'@v”½Ý–´ÝF¾Ý1ô¾¡ÅòM‚¶>pú±ðæñò’¦jž{Ô·×SnýIã‹ò*x²)E³¿dà¿_îÙ›‡¼ü€ðÑ%3ðÖ™ôe.´áIz$“NÕ1uªî_‚ oùb¨3…ªq$2'|zíõ­Dj`ãÛ9ËA Ö§ã|l(Tšµ÷‰y!þÀŠ¿Jã˜=[ÛŸý˜g¦E£3ô/<þ H¢g+(*ª/&äýü÷•½ þe¼›~Ü=Îææ×%êY‘ϦøROôî‰6š’û°z~vjcë<Ïó¢°CŽï²^üÒ/Êlȱª;ì »?kÄBÁôêIô °’q–ºÚÁ7VVæ:ŸQ””‹zAtÙf(û]ÿ¸º²ÒFÓvAáA€Õ+caum®íî0åó*XïQôÕúÙµµµ‰–"Us nÄزÃchŠ”nÑfΖ)-³Ñ¥Õ¥¹Q+,ÖýÁˆ¤Ä†X‘(•çr´ù½('Á:§¢;ÚÅ$î!f½ïÍQ 33ÛëeÐ6ò¾ì`&Fcéj;œRóW2û™˜˜ùÇg!£ÎRåq‹“§†=…lŽŸ q766‹8ŸÈ¹€³dfiÃL…±26±¾÷iB(ÿ«Cqþ.&6™O¶ãϤŚ›™ºÆÏq‘DkÁæ¬]è¼1i\‘ ú¹šuOŽÅzXY:”¶ÎlŒ5¸²­]BFD§Bó'>»Z›˜X]„Ï éj¬Uþûî'ãSO!„¨¾hffrþ‘ û²±W.øN¤ùë6hßí“Ö9ï§ò“ý L#/<•gùÄQÛòÁ­Ô0û¢ÖÙÓ.ÚdÙÀÀðÑ$„6ÆÁ%÷O›™™{F¤Ãˆð2«ïló±Öð ZÀ«{|ÄÚÌ‚íò¸nR4Qág'[˜™:x†õÌA¾– j2™Tº¶W˜&ï|XH¶³oåÿßÞw¸5µmûþï}ï{ï¾ûî»÷í³•BzO!!$”Ð;"(M)¢ ¨X* *XQÁ‚‚"bAšôÞ{o”õÖÊZ ¡éöœ½Ï=ûÜõûöÖ˜¬5ç\³üÖcŽ1G¯te=<é~¦xèÁÉp°‘dz5ƒø<븣­»ÿþŽiÙ†ö›..Ù½ _¤'Æ ÍÞÂÀñ`nRö—ùê{¡?2tŠE!‘ú ï” é؆ÑøÊ«1ûÏ¿^i}®ÏñBj”/Ñ)´šYpd¤EŸZ  >º4 Û¼ËJÌyĶ—ì¡X¦)Ô\ó6}æËHÓ_a¶™hzc³# %„?¢ùláîÊöž‘iùxS>…ÂýÖÙ7Ð×Æ#…ÝoW,ÌäìótI»;59c“CUCCCî§Ð„àíKö’¹ŽÙ¯¾ö tY™e¾l/(<ÎõŠ†*X™%‘¨b¿³ƒc““#õ<¦zX(Z…üÍòÖþ¾ÎDwr@j)øÒ‹±¼Ï¼èjû˜K%›öA>÷ËWŽÆU @K¼ –ã{ªns÷-Š?”ÅÖ‚aa{ ±³{A±‰l3ùõ‰`ÕÚ3ÐßÝä"13CÙaž 2óŠéì®s'.‚=5”`a”?(dîf”È[ƒƒyÑtþ·aißK¼¾ arvQ ² kŸ÷¡¹¯·ûˆ Õú2æçÄâYí«ëìž^j¥Ñ-½:úû»ÝÄc,ºÀ‘Y‘Ý?ãëœ95=ýlÇ!åEßÀ@w{-ÍبfdQ»{oÓ…;júƦ'‡[cwæôýrÂKl—×78ÔSÿ„mBú8ºZàä¨.­„ÑÉ_µ]±TÞ>ÜmÙU‹_ RÅ»5Irå'E¤Ès€¼Žnl:¶‚¼>e%¢Î‚ê‘@Ϥ–êf«ˆxê¼\£!ujØf÷ÎÓ¦èTòÏ™2º8ÅÂXÙf®¿þÈ©Ë(!ü¡È8(:þ@5’Šó¶FÁÅê5ÿ oâµc}<.@îçD·šq”7ÓÀrå>ÉWªº¿:c/}ŸÆóÆ\Z#‡Ù†öQ-/xØP׌5\‹¦_€¿Zš¬i씎ÖYÇQX(_l§Q) rØOêÌ2¼S1 ,|ÆëYª5)g¡Û ¸Â…Ò c«‹àu»œYéÅßà#M·_@b€¥¶«t³(ïÓ,40òe© ù2¶¶AÄ^r5Ð+"¼ëªk’ÀTº¸´.»Óí£–»à¸r ë¾;Ë;”ç˜dœ& ÿZ´ÛÁk¥ZòùÃ\Kó†þÊŒ²³‹‚¦MéÍç°s¡ò¶ÑûÁ00WBÂØ̨kn½{Œ¥Vœë|A××c0X ¾ qYKîêÔ–m4µt=;fLpœS îb‹T)ͶQþ öþØF;:ØKe0a°X4Ý_ ¥«lóöÆ"ÆbÁ¿2±ú¾,lƒµ:K§9|Itºæ£íº§ÛUlCfô,#ƒèeK}T=^p8Ð9åÎ9¤ã1™Je©+ÇcŒÜn~ÜŠmz4l# ¼iŸ‚¿ÜÀ6ËAd±zÄÜ´ü!^¥I ðt0få@uÍÊ”ÕCh¤¤š…Mû§úqºæ©A˜ì}Õè,¢¼l‚ã–¸¡ÂÁ†ómäÁT’VOÒuþ}{Ýp*Ü4)>EpÞƒ½Ñ,é»×³Í³¸,„ï¸YÜ—M–Q)"©¹e·#yÛ8Y…=C˜¡2+> Ê.GÚÝpbÊ1‰±1‰<ƒN1²@íæ¡`,Y¾ÿà¡Ã‡DƒÇ-+Úä°2Ûïo·Cvõ ¹ñ¢yeîöQ‹tdŒúžì`{Þ*T SýÜ$œ±eüuíÇ믲Ýn¨ý!M9Þ“íŸ «Iy‰’àš—Å% qwÉ°ü‘‚±˜T;lÖf'š†Æ¿ÒÈÜÏý]LõTÓL(Ís—Î5l³GaZ !7``á¹Ê³»v]¬„/ØÇúåÅ4º/õwc›ÕèàtÃä–õhئ&?»çèº_¥ ÛX#±ÉʼnÖi×Û!¶¡¯e›±7'ªy¨™¾³}eTSËÍ÷\¶akئ튽†mJ·dY U¹·bü^°.$ÛLK0:/†‘j»+³Ø6;Á‰" ½žÒn¦æ–—Ø^ûMÅ6pœDÿ¶Qã">­wiÙæè-˜m–ö@*†ßð½Wœ6a›kkÙfú#b*Uªî›lÂ6j+14(j¶ÉGØfÞ»ýîØÚ­4ÓHäQuh£uû:¶QÃBÍû">[Ü>¹V¶Ñb›BÛ,73äå VbMÏB©‰ª”µªþ]Ümn{ãf Jo]ö!½¯\v#S BgxðHØžY$_~Ê®€”-Eçx>ÔÅ+Ì(aï&7aU±ñ.\ÿ“ËZÓ‰I6b±Ø,ôB¥QIÉ÷Q*øû² P}ÕËÔã„Úèq+áJ…R‹m”e#~=rÐíllô‘9¥Û(yS¶Ρ^d ÝûcOÉ`»Í:¶ù:¬hÊ50‘ôªæùÇìªÍ`e‚aL~Öˆ"é‡c[F—À‰ÔÓÖ2#…î->cï¾I¾—ƒÛšm”ݵŸ:Æ Uó%Å‚íÐw@Â3§ƒ’¼9‘—Ëá//ïfºDýžü²8þ2Öž±/¿ ¬º±êãÈœB9V…54ý‚xÉKEš\Qüˆm€¾‡Ád«XøžÅ–'1gŠ×² ðp/Õþ`ÌŠ.,ª‰ÓØF¹2E¦PjTZÊbCg¤b›/øíæ¿m€[Åîqw‘Y’q¢ ~£éð‘u·‘q†š¡G+¹¶Û:¦^vxwH«z+2RÌÉü*­²ú/áÔíÙF (¬©¤Ÿ2'ýÐÛ–i­ø8΄šÎûšîË©[Ë~=| ¾° ÿœi*$ù˪+£í˜Ñ·TÁt²~G²Ñý敉¯÷õYŽj~™³ “ ûWCÊ8:4MLoë‹,×ÛlÑ©Ê6/Uz³li¶µ£%„?gÂéû/©ýä‹ñî8º™DlλÆý~”›ãidמâ1ˆ6v‰þšØóÏhvmŸ_K`Ò(‰ ÊJË­€eC ®KÍ6NØ{_ «\ÑåX*‘`Ʀq¬wÕ©lº6OÂ%ZÚÚ±ˆ„û¯ªŽh˜ÿúßoVCÍ˜í®´4exí ôóyþ(ÐØ¢,ØÆ%mÛ$ùáóZA–8HùׂQèìÉ•q_s"[`Áã>}ýÿ˜‰P;Çë|myfb{¡)Ë5ü8r 8ê…!2™Œ“ïáYˆ:æítþÇåO«õåy“h-±cIáÇ‘ÐH3ãâF˜mú¨ÿb\§bιör6rÒKj„/žjjgmÁàÛ½h8$%ˆrèFb­opäÓM­í¬%_Š‚`ÙÆÍÂðþç1íAñ-׎½:°ýÃÅ}]c{''—ðë»ÜèÛ‹b Ï8û~©*ËÚ<ð1Â6à ðN‚ëee’W1€ îB_˜»5‰-°¶0å9Â)Gö8ã¹b'‰(:¯öJ¬#‰jñaèû˜Ãb„.{z_ŸâÓLDÖ‡âê;=ã´&xÎ!N@j\cïCW’ÓMèãÎg®*_,áR‰.A'áˆUƦl •ç¡ž)C†B¦w¥AéÚ‡jY±I:•Äµ{Ð"EÈAÖìhN QMˆŒ¤ÛÈ9ÆÏN‡±H[; H Oº¥ÒhoQ‰$ ™`ŒÅHdcÆWIýwª®…L¢º¬s1$þËCTÝ×aIPBø#}?¾¬•y‹dÓ뢼7 ãÖñÝ*Âw«Âµ}=¿v¾.6y¼îaì{)°Å-›9¦~7G9ðý<ÎÚ9¬•/оI»FÙÒܼúÈ›¾n„ÀâME»Ç榧4×ø‰±AAG¹YúoåÆÐû-úüG±ÛÊïŒÈfܘE~ãÈ*×Þ°y­­C¹1²~Ó úï>Ë標·ªÇœíQN@ñSxœºo澑­/âðt‡Žž¾žŽ‘˜Ýüý€fèps6>äÚ›¾þþú§ÇLöà ԰ù{B:X½÷d)j-FñÏ'S‚4_r•HìwÜ­~äˆ ; ž¶“ØúîM[R¢iÝP @Š¿ò=¼ÑJó(,üY‚ ÿ~õ§ ײ|ý×h«¼´ÍKÈ!ØúoiZ0+¥ ýŸ¬ûËΈœUþ•Õp\Ÿ—$ÿùàw[áë Ldç~ù­I‰/Gqb²šÑ¥ù'7$lžà+:rG)“ýøEúþ'7뽕ũÍÞÕo+*Ïú~RuKÃ1=³DùÖ=öÇKuÑ(²ü{>­v“"c‹¡ßlŸ]œ›œ_D³-ü)q5Nrões”›0öä˜1ßöÊÏÙZ$²Ï,jÿÙ–Ìa1™\ÇYåE,Ÿ9 ŠbÎÂá»3¥ÑV‡*îßàš ýI!Þâð”@.²¶[–íõ´±Jn~@¦ùlgL€»ÐÊîtÁÍÛ./í€X$rß yç©<ÛƒEÌÂ&h;ûiªcä•V¸Íý÷Xí ~ðq±lï®ò°6{ݾ>|¶ÿ­Ä9 ®«;k7Ï*æj¸“&‰CR_Ù7 ÖnWàÊžE9'–U8™;Œ¨RˆÏTæ°ù~p&€™î6AÚËåùµd[+KGïЦ1$êêå9×ø;]Ù‡ü,DV‰7Adn¿Pìôº{Ù¡•%‡í°ŠÂ’‘Ü}ƒ\Rë2£<ÅñKmOyž£È%0qnº†köÁ‡«ž' Ç›‘â0‡äêO·‹-…î SH2qeNR……UÊÝ]Å|¿y»_À¢QÍ…–Ñ¥C Û蚪+t²±´÷mUmÔ}¸â~­ùx€½û©FU6ó/a^öB¡õñÜ÷šQ(½‘,YZK<ò+¡T§JÅœˆO¥±ø\~ÿ ðñÁy‘ØÖéò³šuo¨é7û­UÖ<0<µ L—ѱ„Ê–¾±ÑÑ“;ÅÎigá™æžñ££#ÃÝuæF¤‡£Ðª¯9C ML·gGPw¦ ‚ˆw#Ef¯ tY(¡°ÌžVu‚,JôfC±–•·™¶þ£c#ýÍž$LrżVS`ÇäðL}9N¼sˆk68<ÜQóˆh6 –êÏ1üÆÞá‘þ:7[¶!Rç/E²¢¯¡šÔŸÁÇÂñ&gmŒB_,©§N1ë1¯¹ÐUœArÖÜè„#¿FbÀwÁbÃ× aÌÈ›êßgzÔ¯êðOóJíðú«è!H ¸tv¤±½oi´Z;<ÖAp±|ÍA|[ŀ߬Þ4ÊO•hF¸? ¾ å\’eö+U&™ [+•z`I_W€å¡j–ÕžÓ"2”™W1Â$˜ÍÈ;!v‰OëÁ"ö‹™y·ÏíN{ ––.Âfõh^ä#v\í’šwxǾ Ï!i猵{dœ`i'‘œZ÷¤Ìš¬÷m¨9ì’f] õ)ŸeÀp±wMq¤½Å‰7pÓ{‹Îé²Ö²MIE €…°ú¸îä>ämùmÈVøEGcmŲ-…Z1…hRøs°Ä2ðìW¢'8L•×­<Ò`_Ä{¾L‡›šŒÞ5D(äjyIe?‘//J—ò\ <àà¿]—ñ”PPñ©Jñ"{…µ3…\&S(ײM(Þôr4QË…mŒHðËPÖ¶kj³ñ2K•ZWS ˆ ãww¹<’³ýl• ÎôÒY_;"UäºÓs;á>©ËÑ1ߊm”hìöŸƒmÖÅ€Ó0è_ 6Ä€k~§ëø¼&<û€/‰FCngÐ >\S8cèvãoŒzîùˆO4Ó/¨>²¯Çο&Ÿ`øÐ+>ç ïHÑt{é)甚Ž»Þ‘esÒo)T¿‡ÐÑ Ui„PÏje™GSïî1€¼—L­Z-¤Ÿ™Š¦©Dœ±`†Šm¬v$Á~õ+»ˆäÛýˆ½Å†¢W? ÜMØM\íº‘Ž^j«ŠmÜsá®9éfö ©¢÷ɯÔëÙÆ%éÄæ“:ìôø:&ÔYY*/Zod›U»ÍÈ‹m·%ˆmìí#U~ËJE›N¡©‡›AÕù÷mïg€ÚgØtZPTlÒÑ$?”|-9Ì禆c -íÜÏÝ_gûÙ'¹ŒÐpÇ¥môpp`m°«“ŠF%ÌÖ¸ò O Q…(ŒYéŽi{ú*¢8ô¤ÏH8”²îÌ6nœÛLÚaH(¯Ð\/¶Ñ®D3 6­¿@Ã6µù'¸»“Öýªþ<)Ð:õÁz‹àf1à¥'ÂøqYÚ†Êß=\u(e ÒrN’åeëgr|ÍŠ È€ž¥õÙ9×èìG¡tp1- ½c¸\+ `Ÿ«‡gíßĪýõi—ãùÐÑTqOG)×A+Ù½¼‰'ÌmèIÛ”oÂ6d½ú  $-L”˜·îÛ j¯úÚìÈûwÉRMÞ6ºß–lӳʹ¡~ɲ<_Æ03Û<‡e“ÓÖ´ Òun׳&Û³êf½b‹ÙÀ6j:l©ŽÞaæ¬xl³m–=°ÛŽ¯·Qk ì¾ìtÎþ¼°·ýz‡v0ˆ"YHß÷v¾eæyÂ6³x-¶‘ݹ{Ľ}Ëè:þÓ± PsÝÇÔíüyüÓè oµcÀ¡wƆ¼ä ©™¨ˆØÙµ1àŠ–[†&’x»`¾sïþ”`ópeËmcë.Õšøp=Œf¬L01äLj—Õ§èjn˜Råð~~ÖÁ-2þ5ˆõ½ðŽª÷­£Pr[¥|Ñ”B àP[§¡éèeÉqw¶È¯ž†ÖçÄgšÈÑ-†"NQ©<+ exIOô½N,_7§ÌWýàçÜý‚ c¡»®uBGCÔTÖ@¦ ùâ;ä„ÛÜ“Ÿ×ÿˆm”ÊöC¬u'¼.–zã’—ײMN€±%­|)ÒÁØt×÷Ùü|ÐÁ$ñ®JKYìàbMʆL-…ÇèÛ÷Ù¹o_ m+ O†ØÕÅH÷n—jñ·¿dÓInYƒ*¶¹BÀûn§D©ÌÞfE8‡eBZOUEÓ°tS¶ ¿%òL@®éé©ãwµ Œ÷0¿_…äè̹¼Ï±‘^Þ€²á”Õ5¾7ÚU`(H@í6jœÙK‹ÊÔÄ€/ õÆQ9ÖB®©wÕ4…îGº:œ~_ü­è<ŸIY[ÓI´C W’ô}Ð6óÓš°Ú×ÙÉlÙÊZD£™ž¹û –m ŒL41àŽc8üÕÃt"žÃ¤pív7ª¡™ýVàÀ# Ä6 "10þ&.úË»ñ¢ ¹ÞÏVf W¿Ýþ~~¯bÜ ­GÀ”´ªcÀ}qGn©bÀɪpÕ[ôº£‰K•GÈ ü²×„YÊ£˜a;ÀçÐÊ"È‚—L‰„V–ßùË`¾ª uNüªC¬€zBžÂúEx"4Eßk/“k!6¥’ÜÃNÃrÎÓ4žK\Ì6žúFÙ½Ûðþoí8T综ã¨sÄ4*ûä-h'n艇‰ýMµ÷Áò!_1‰Á“XYçݽ°]¥I•¤rÄû!ílü¹7ÆæÒÏ Çþ1B…-?Pðæ6ö{Ÿßp†ØPÜÙç cLu¿P|;üoÔ8„m†Ÿý‹žH”ï3--CžiäÆ‹ !D ÓZÌgòížÕCbLù­ ‰àhoëyf¸ü(Æ€tºv÷‹é•õíS±«Á6·´4gñìük -GKüW—-”èZ j5Ðvþ›ì†º`¡7ÒË–Ä2·ä±„n{»aFWÈdÓuþ߉x£æ{BÝ­°d‹:ËÓÁ.æ4žÈVlýúIâvSH“:LÏlDWîŸÿ”1àcµâ?,ëa¯mªvK”J`‹§XsךÊ-“\+×Ý´ê(»eT8Ò¤•Åñd¥®|»£cºU?kJ\šÔø¼Œg;¦5­É¾É-ëÿÞj¸·èià{c´y#7 _óÝÖ§t*–&ÔNs%‰zvé?l O<=}pöOHüÀX¡ñ¯ø§_Zº»:â}ø'ýðžÛGÝÍ_ˆdG\‚mºù¥ b›;îÆV1H>©é2¬lFZõ!¯Ô,ÜŽ Íø'›¢SIý‹ð!@«lÃ×7ö;˜˜ BT¨/‡`œVÒ ¯Ÿ-Ùbiùƒ >Iƒ§ˆ%ÎñžÂïðùשZ·ldGsÏÀÄÃPuñ1‘NV\–},ìJ}BDôÈX7òŽÜ6ef¸Ò6hEz9;=#Pq„E8ÙÌ…N@5Û@çf"`ôybûI×Ь?œmöqb ¨›G›î1øÎkd[êãµl³Øñ–jíjº˜ì_<ºfßžž ö?^X÷0Ö.èªvE³£½ÅW˜aà,ª8•ý>Õ‘üvè«Ì±|tÍpwP,6ÐITÙ+ñ6œ“:æZ@À§5j_2j‰Õû2¡2°D2JoC&hw¦Ã:¶9 Ä k±“|¡áókS"þÝÈ’´a›¢ã!¶Gsá'[øb@±Z\­QÚV_iË!Ü®È?h›œ¿ºç*Ÿ°Æ_Ì~tÒÍN mÔ¤ Ê¿fù3íhÈ$ÙEäýEkûvÂÞPÿb+ X™¯þT h'Úû–¢K™<œ)Õ¶Ô¤ ûÒP%Þ€Q>…T7ñá…n¯ÐP™êÏ#”è+•ý__•7Âò€tŽx¦zi’˜†œÍyöô „§ÅÉa®>I·µØº}äõa"?´6Õùg5)¨“{KL 8_æTÕʦ||éܪÉ|è‚ w>uÿØnûI–û•@Ð9«ŽçXI%ó¥Jm¶A0ÔÝtb¯•ýÞ[(!üÁšŸë†§PËçäò­Ù&£º:?Ü=ñ=ûbÅžIY“e{á#Ž Xòñ½íês{w²©w»æ5l3ýú„.+f˜g'wX6K€<ÎÇWmbÌO¿í;hy½´O{ÞÖÞð¶¸H¦ ä«aG›ØmT1°óŽ$Ü¡b$™ÔbU+(m‡+P¤í! 8ÙL—‰ŽÉ駚”Ù²ó!¶lp]H+LÁk·ê¾g·Q~%˜m…lž+—}M±îQçG‘-¸ÅÜãÆ\ï1(é­—¹›*+úT™Dí€Èf€M2éš‘iÜ•Všê]æ´eÕO¡Br ‡¹äÒOÛm@§û™y?÷—¤šà˜wÞ!Â^ý‹«#“b$ñúælsô묖O‚“ÙîÓà‡'Éö’0ä­÷è€%; æõqnA›À£s±Ÿ"^ …‡…nÉù­£¡}t e†?)¾Ø°¤{‘XhÆä:…@!Òò%¬±Q×4Éù˜ûUÈ+ãÒ~úÞó ìmù#€Æ!í\ünc…ŠÃx†¤Í*åc¡cÀÛÌjùÒ‘½žd:ÛRhN4µÉýŸW ó$ýb»ÿ"¬ì4ü…!:€¬¥žo1ÃT`É$ýb®€£®l/øWÊÎ{i66b2w(³Du]fû/ýsªˆâ‘/»ìL‰4&Ì:[‰ÒÉVOƒaa%±s«-†eW¾þýÏ7ØÄ! 6Ðq| K“{\K¥¡ÿfv^¹£\p8ªµíÙ›w TšÔȇëVléÎÚÁTœè8äôkþìfé}åõª!B1áAÚxå«Zf˜:BÃêéêcH‘)ƒ p–áƒ~öº¿lߎ¡'^ÉJùå¸ÐÈö‚bEÁùè{ým¥§L%É«Ï?SAÂYœ¯Øj¾-O7`Œ±0ÛD‹8w«´š7ìˆûKdî7¸žº§—Ý­Lÿòm¿êŠÝƒJZ¾ãB£ô%à ±8<ØQ{âºfTeJÇãœi\¡ÐŒå|ñ|s"H×o{ø 0VµÓÎŒÎ1ðX\É®OЖ—âïÑé”~w(·ö&¶Ìõ l•ªH¹!¼zSEX¹EöÚ»¿g¬S®õaÝض•…éIµæÓsÍ™ôb“Çü®'­R&@ŠP W2$›5cc/lÞ{k?lâ[¬T*Íòn¯/t³¦®oϱɇ-z`óíïxMoæ/ýÛ}‰7ÿ°™ÿô–Óxë¹½™»øwžBõÅrÓ®'ã(9 øè(I2&ÛV7¶4ÖVšáñwÚ~61¸˜ÿLÙfxåUu[kó¹H[û°‹h¯þ\.O÷ôôô®C_¿òo)sev“2{û¿kÓrc†~b? Åu‰ "œ7ÙþÞ^;v†À–áŸÝk€t¢ÑƸÐO/ŸÔ¬"t·â§ÑyÛÉÅÝs-<|öüMÙôú;8¯/ÓÓÛ5² @ŠßdÉQ~ϱ©…eíz3ÝY¹ù—ë ýQ<ò÷®ùå¤M-xÕ(Püó£¿ÀïùhÝ:HI¾Ó¶ŽE&¾=–p)D5üÔÃeµ™S1ßwp‡5ž@ö‰ÉXF.UÎu•¹ð™"óxþ'=ôÕµCl Æ´¸ò¼Q³lÒa1ƒœPÚ¥½¦¿<8Å¥(tÞÙGÕÀZ#u-×&ãÍ×òYøqHVÞ‘R…6ÿL•¥áœŽ)P- Š¿úu.—.I׫׳5ͶޤÑÝs+J@mÇ$ÂÉ>&ÝHºé/¡p†Š¬03 ”Íveú JiŸ¶Ô#ìÌCoA›Ô¹‰;#U¦WÅLÓ(Huny_Q"•Äõ3ã$–­úq=Ia:…B®¼ v8“ ‡HÎ!ðö,?™êYúe”Ÿ5Þò.KÃÄÇP|_kÑ1*›'VÏvÿ¸sÐ+èâ+tΠ@ñ›ô&éБ 76‡cãG3 >ÞÅÝ]»Üòw`±ùJºÓC¶®)dK|ÀEW2^¨“z7Ð'‡.AIRpnG‘/W†Mèõ  lÃ:ýòåèC¬‘Û<ÄÙcν‡×lÍ-W‘Ïuð÷š›Ù Ï%ZóŽh±Í‹k)¯[àEÞTàÅw¿Œ,vEÓXü.ÙË&fù~ÉùòÙµ(ò¹C}oE\Ú×~ÈšX™Ÿ.2ç¬\ŸCþ]ŠL'Rð½Q 9‰ÙÝóïÒBÌ£ G⥾º” ·‘ŽZž"ƒð˜ˆK]Ýú…†„¯ó¨tƒÅqPdxòE×ìììpK™–ò@ÿ}ŠO!äriËÙ—ó~~n®ëåÑf›Ùo§/ßÒæ+ðÊG]™¡ÐïÂÔP÷dMŽ6Y‚©QRýÊ^:éL“fß`B„Õ¯™ÛåpðºêE4WºÊG´Øfeæ²³ñÎ<$o ^Ü>Ó”æ©fÅãŒÔ÷]Òµl£à°h—”‘É)™ÈóŸši¬Égx±VÑWy–c ÀÛ£cÇY%ÐQz/ãqÕšgÉf²Dg©tÃùŒ3§'—}×ÓûćoT¢¦(Pü¡¦:ñwêáÏ+Ë+J5ÛÀ—hÔ5‹øYEÛbàÜpÚk¦š©ò³Æ‚žyhõåöÛsê¡f™fX†—LzÉwVÔ_JíI:ªˆ–¥$/!–@"˜{©’H*7cíêÞgÒø!ð"ïÉ ´H€|öS¶Ñ>Zs-ÛPŸöΩ¾^p$m/W‘R_˜$ñKLHøІ{þ|÷ì†u•"%/X±(ŸÇ×x»©þûté ÅÁLt"¡@ñ#Ã0;Xáf®£Ù»úÞýiFÛÈ«iÆŒõùg)»ëì6ðb|}&D—êÑ9ƒ„IÞKòYMð-KæÆW-’É—Û4"Ç´N·zHó¡¸ö¢ÅòƒcŽNw-ØFU‘"#XÌpMœW‘Ÿb©ƒAv„i§3ÝKrå°¥×±‚äÔÃ’UŸ€×MIÄ›P¬ýÀK²ÝðÁÏ@RÁg[&¥ë¤èÀˆÞ2ƒ’ó±wËzœBØ‘‚Î%(~È6Èéì·÷HXz“\Í6Ê6;€$¸˜¬aøè˜Ô$·Ä-ÇËöÛG¨§Õv•I¡ùÝ"ðp'É=oùrñ AO<L‰ô ËfÔgë6>¦ 6gÕœðf¹)Ð)´d˜“ÕÇÐRÁOÆö§¶0L©Øff› ±±î×ùõ=0Ý’K7P Ü&0×׉F0Ùò’Aa¾ïš¶8wrðÁ1’o:—P ø–[}œBÕç”-ˆŒI 9¨5)@È!åV« ÇC%LŒÌ6Ëó5ß ˜µ¹Ö<"/hýÚ“µòŒÏ»!½©óåY2×ü°ØU@`8ÂGFdí•8¤B'…‰óµåyš³©ó*]³5?öqT³ÞK2ƒöçlõ§¼lU² ”ºþëЬ|k¶âܸ{/!X/2÷Ÿ~¤:Ýwe†A¦ß `ǼAbÏgÚë;U õÙRée#ëžr¥®¦F*CvòKÏEÙº†N%(~ˆ·yǸ4‚9ŸOg°â.@Óõݱ3t¾®£¾7WyCÛÌ>ðd\0;^eÓ¨Ìû$ ðÃ9ó_ŒŒ 85ôu9ý2hõõ|zhÍ"âð&¦ÿÏ£ˆ4ò<ó0Ùƒ32ðKžQ6<ÛUéïȧ±ÍM™T‡€„^¤RYáMÀ¢ ŒŒ ±X|³V¼pÿŽ5ÑTdB7[“+¡>ÑÞüt ¬¸ùÿÏ´×3ë؆hbX3¶„¨Z3-‘^b “kJ§¸„¤¨ÕV>ÙMÖ30“"AìÅœtw@™Zî§ýj€%à5O‰Ïê:DÀèvL!Êã1NJA#j%FâGªÔ÷R{ÿÆÐãuš™rÃõ[ø¯/ù·gÚ˜ÆÞ6j¼—v©ñ{™¬èլݲ­œ„Áo³Ýxý *ÒŠ±°G@ñ_ ·Ïž–þ=êY‰9þ¶Q§ï$?®G(Pü¡˜­ºéwô€r (P @ (P @ (P @ (P @ (P @ (P @ þ?A?9I endstream endobj 634 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 145 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 34496 /Filter /FlateDecode >> stream xÚì½\TY·'úÝ;á¾ûæ½yïÎܹ¿™ßûÍÜïÞ;Ý*BåªS‰Šœ³’ƒ(&PT  `mÄ,fEÁ1¢"H2)r•ó9¢ª¨ÂÐvÝýÕj¤çì¼×þïµ×Þ{-²’•¬d%+YÉJV²’•¬d%+YÉJV²’•¬d%+YÉJV²’•¬d%+YÉJV²’•¬d%+YÉJ¿;uÿ3ERA3¥Âž§ß€Ú²Ï,8œñÆ\j曜­¡¦ü¼û 4¸¹–¿´ØŸ/?h9 ÐÒ{аôŸf>|Eù Ó5íG‹±Á¯¯ã÷âïÎ&úÆûæª?£L`sÅ¿0r¾W4*…ú› £’BéžÐŸþ„üü™õÉ‘—›þŒüùjx:Øü=¤ÖW@.‚þõ z9 }ß}A›ÔÞÞé¸ÿòæïÿy¾ä¡ `øã|Úbñš6£aþ ÒX_,FÞln‚ÆÌ$õΦޘyÿìéû€äóý Ûº"†D"“ɔд‚IÒ¦U…i²‘lk; çlžÔÓÜöºrµ­{ºLÔµG2ŽA&à€k|HûE#š|"ì}ÇÝ’B„sE þ¿‹\í»Q¬Pu'ò=:UÓà^)!'|¡?@NØ¡p‰r¼œ—^hü¢¶Q"g¢m§a{“ºÐR÷BCwç;MÞã쥿Xÿ)†œ(ä¶qÕ/v·óÿ&¼Ñ@GÂæ¥\…¦s1í?2yT -ò£ÍxM*¾ùîgÕ«eÛN¹à÷™y5çâè·û…ß²GGbt´€ ý-üügäõæ—¯G¦þ÷?Aÿî?ÃÁ^“=Õ áýÛÿ§}f œÙ}IûçßyéböjßüçBþºÌAžÿç¿A4*DÕý¬y`±€o˵Ñm–i%«ú¥ÈŸÍÐD£¶ TÚtRž !ÉíóÜ@üãÿ@ò¢P¡šÑ_lÀ/™‡Vú:æU½ýôäHÌÁ¯¥¨ StvcFpÎN\*1 •IæùÑ ¿ mª’gN6Ž×zÔ¨ÁÂ(•Cþäù×;EÚ( Œ6·i8çî)¹aR2%ÒsÛSÂm¿¤QH1i­eÓ)G^ óÂãS…dÍ#0W_á«eôÔâér$yeG³q7G´p—'××}ù¥¦/C›Î$ Þ‘Ó®Ò˼"wªc‚6=spçûÕ†–Ê•F÷FðÞ…‚kc_Ôà/ÓwY‚ã\Çä/#ûÛ³»!èübrÎc„6ÝÒ³õ*™QÃùb/”jQëüÌj.ö^¡Ò|+6œÛ¹¤à ¬y'Œ6ð›—'¯:ö¾2/-²äLÜW¶:#<"2kî)ÝtùÓú¨ÓO¸§K²BÃ#s·_0açGyA®tÀ/$lÍUdâè¼,)&baúÚVÚÉoû-=>Õ}7!2$&~Yä‰`3ˆJþÔ­¼XÍ¥BoU³¢ áþùºõ‰ö“ŒýÓÿ¼9Ùõ hcç‚üžR"Å¿¶úÓ‚þÍmJ.éC›ÿë?Bú÷&j™¢ Áb›?Î@ÄVXZ’¼¿{,%&*2rÑ®K Øëקàîè~y¶"2<,måæ194ôâbä’|½ð¢j=‰+SZb©wµ¶wÎös EÔùä2Çé#õÕŸˆ«„BÕí‡Ï¥jmBs÷š—ŸAÉZwûÄCRE2×}f,póÈ6w{ÕÓó‚6.\…™âÁh“°»Æo.ó¡g_Ašêd^ÌÒ] düÖí‚Úm°»c¼²¯´ŸÊÍ(»¢Oá«Ð†BL;´15hͽlcˆ6Õã–‡Ž²ß…âØ6©1;ª¤ƒMë—$EDD­Ú¸_‰­õ;ûg—r_¤Å†EÇeÜëE^7Z[rQqâ^^pf•aŠc [¨nk”hËî/ˆ­z6|²83,2¦¼ê5©w¯M ;ù°SÛö“MyK#""–ìSió]ÍOq1‘‹ó(§^E­E šË«â2ŽÁ’‰4ÀÎNÕ«©…-_Òtên6Y7øߌn·‹)ô×­ïëb<íÝ×Â/Ÿ aú¦»ý¢ù#RwøJÏ?ézßu¯j3Ì“#íQœîÂôN|ð®{¨ÿcY5°ô‰a²â¡_8õ¼uX zth5;8³¡¹µþîYG<«ƒ§ßnu¤º¬,=Ó?Äm~tšHråJÔÜ*þ=<`ÿT–åÔN'Š¡Í–ýz´F¢ü½»Ñ*³« ï[Ëßȃç!ä÷½AäS úÁ²5F›Šë_º`ÅÐ&á0òû\˜¢ ÙbRÒ‘1efî¼³i9°þí»öÖ¦TsýÙzD8ÊàÄœ{Ü2<[M~Dæañû+$ÀO DdH=Ú …à¹Ñ›G•ŠÖ“6ÌÅ·¡]¤¤Øn”!˜`€6î?ânJ-‹Š–Ñ?§þhðΛŽŽöê=™€oŽŽõ~Í}MyU?w¤õq™è4!Ó@⧀ ë­«¸2Ç•¶õ¥¡¬«ÜäŽ_÷T»@(Írw ]Zÿ¾¿¿ãB J{ýa`¨­–>ŸùJ©Äƒl"ñò£×w*×Ø8eÀ)Ž½ÚIÄy>zó®õõ­”wG§t=¦y°3osÍ'øI.CŠ¦VÊa9kºìë–çÜŸ‰6`Ç&íâ8ª•ƒÚ÷/ç¶aïÊ0ÀµXŸ6íL%$íÑÍhò8ü‘EŠ3œ3Ë.i‹2z‘²Àw\mˆ‚’`¸37”:Íinå9¦°}r¡êÕ°jÙ6ÏÖ§G›¦b!ØÝ8f<ÙV£€ƒþü³#tèÞ4Úýüm4?™kŒk׎¼ü_ÉÐø5ä!äôþÍCgÆÿö'(}ô/ÆhóŸþoèŸþiúg–e †6Ù-ÐZäáîôÊmþ4Î?þ”x|:î¬h#Œ U*Um;RéËaÝá¾Y;ßíø‘¾né‡Û‚|_D»HÎv¸×£šEÔÖAúi͉Œpw×Ø RcnRŒ´®H 9Ø1ÜCŠwèch“I¤p4×)OeŸFH„ý’Y›Aj˜”#Þ«ÐÊ6þY…µW«aºrùâ¾òU p.\‰m±%:‡o©3YIq¯¤ü·£åQ¯v³-y$Ä”Ë_‹6ðàùxw7Ñ3 4–m8 pxœãt‰Øì¿õé‹d…ppa•J%å}è´qX>ìgÄÅŒb è-28LI2{}%"Ä*…}T }cJû¨v§BÛÚ¥Y®«¶ßAŸ©}Ÿ‹…ÊwýaË[xBi¡Î@bM¯9àZ)ô/  ÿú÷Èð¼2©EŸ(~´h”„*„µ²Mòin†±Ü÷yé^EÂAù?"ïö#¿_(¡6F›ù($dúgTò´YÞÉÇQlù7èÉrc´ù(X—NpTvë ÑF4ø&ÙŸáÊñ ôpfgÔvÇŒ÷aï`),KˆºŸØžˆPñá ŽS¢1æ›îÆu?®{ÔÖ=nÈW½í¯v®O¢xdˆÌÁÑDëEÿõg‹V&;ع÷Š1Ùæ°yÙ™%Æ8xB^zkæA©¬d^¶š—m"<"âׯ…iÝâ(º×Š1ö“m࿸nd‡'}Ò=Úhd±tÚòÓ÷›Þ¼yÓØrhS¢OlÞ·É6èàÑl‹¤&ìm„ÛÕP¶¹%ÿzÙiþžœÕ%îÅ :>&EÐf}¹vµ«0zÓù}×*ðÈ,9p;ù¼arª±Và!Ö ˆÒ%NÇ1Ŭr lÀ‚môø±ü5œ°úlÑR&~ž{hâÁ3µÜ)ø$ƒDØÒ&Ó–«ëô@²j6µ *ÛÜèúÅda"Î~k&—BâGÅsœuh³D+Üž^T~AÇÊõ®À’;ýèJŠ™_Ù¨-Šä5Oé•šE®¿ýüš´ Ð2X£æ¹™·û äG ôöÔöhÅy˜éP¹e=T6«Þæ¿¡ûS“Ø"ͪœŠ„Ï= õ£z›Ð‡Õ$ãþô'G$€ Úl¼ø¥Í†¡Í tãã”/òœîbª·±$h̆6ª"×9‹~j×.rw¥Kšt‡mà™o%“¸¯Sv2Á}ÛÃ÷&ìqleZL,L‘[N …èýë›!t¢‡oر»&+)µL8ÊGàG§·R8ìª†á ›,ëm ÍéL†Þ]øÏT¡âZûge›ÏêmàTUâ^6•ütH‹ó:´AŠÚy8Å!¤¬ÿÆv mÄCÀ)::&%¸¦4Š×{ðÑQ„7R¨ìOR±íçêmêŠâ:½(î¦Ñf™mèZ´«6n¿3»kÆÔFû„#Í8ÀÓmZ±/™hS¬E- w¼X¿8ÒÑ5^©—Ñ›ÞJ±¶U6Cÿ<Úü¢z›#±ŽaeÚôÏ®Š™ï±Îˆ½Ah¼zÝ<÷5X!Aù  ! P¼Ø5¿’BÓW 84€JÄiõ6ö8·@£û-ÿÙFþfΑ¼bãÖ̯ÌÃ/i4`I^™ í'³hƒ,>Ý^€#"Pi|rY QˆûtÛ"³Ê6*•h€J¡ùÆ-Þ¸±0ÄÇÉ+y*ÖQiôäœâœE^6.Ÿ¯•m4G"Y¾[Ì¡QÓaT7,ú>² ¶ âõ÷÷N‚*aïÀˆè*¹CcbƒíNåøðP_ÿðÔõLq£øt—pb~?2!˜ÉÉÙÔÀ@ÿ0‘Šå"Þ`ÿÀÐ0zjL{°G )ú¹29$çBk …Û¡=˜ñz¡÷ï!™0ØÝ }ø¨?×…NäãÐÇH°þ!í©?¤;EPg„(áå"êì„°^ïé„>¢’„h‰bòÓÕcq ËyH"c«úOp”.ˆ'‡Ôr¨kfR¦ JG¡®.h˜g¾74ªQ.ÒT| \DÍèÐw|JnÐb ë#ì0F¼\í}¶‹g?ó‰~UOŽ¾¬Ý¹ý5wtëáäXÿ€ õó„2˜a‡ÇŒ¢«%}½ýâéžQsû{%Jƒs°jÉÀŒ¤ЊðG‡GøbCè“ó†{ûGá“Âì56eøiœÛ?86©Qˆû‡ŒŽ-ÂLªVôõÂyN g4dñ\(ëïVf=9Ôßߧ@"(aŽ7)q_W5]kÕ Rm½…“#}}}ÃãHáEãܾ¾A•\×qH œš“.Öëq¶wîÔ˜Qó¼œÎŒªÄÊÏœ`,Ž LɵŸêåɘ¹hxpËÜ‘ %¨ít¥h~ÅãkºNÿÈ\ŒE  ñd3Ù`FÓ!$Vêۜ쫡_`´):Õõ=š!)Ô? ý)žÑh¦?Ë/Biš®ïv)•!Ó|·s_cw+nA,ú ÒþúñÖŽNÒó‡û“xr#_ùm%y±%2V+sV—&s2·üN;q]œÃÚ#íßØÈM%ÿ¸ üͳé·|úuHÚáAÀÝ6ñ¾}AèF‚§kýüügPÀHõ.Ùx-Ûa¾kdN¿Ò"*J:.,pŠ’h¾¡?AµxKN<Ì`Óˆ>q+ÚÆ5 øûë^ƒÛpߌ迩럿·öÿ™ÛJ¿Ùf¶BÞÊüÙ¦•Y¬d%+ýUÀ¾ZÁãñM~£„Œj¹ñë)äJšá¾‘F- °O™ÂI5J1M$Ÿ>| ‚4´á>¨Fç'† xb¥ k¦&y2í¼¦å#;¥…'} jaH“º‹$²/™¬ó†•¬4 ©Ÿyypü`òõ¢€Ç~ôò kAüç @)ÜE¥RX‡›eØápHÕçMh4–›— ÐéÉ;€#n¼qœƒ,½øF/JÇà4 ì5²ilDãˆpôa©Zùh„íšg&‡8GýmpGúßqÎ%ÁIMÜLq =ö%cý CÖÝÛʼnF#'n¾= Ìtï:^ßge'+Yé‹Ö¬êAŠcÏhÄÑéþRÕTóõrºGúBèCY¼¥Z@HÂpgÑVžo2Yæûy.Ñ¡ Luë]‚jõr&?Gîá€Z´Á»s(ü©;gw–±\6>6‘môuGÌ·´\µsŠÀZBÒtÌ—MòŠñröˆZ6A퇲Ù,zH\Ò¦óO¬Œd%+}+Ú†9¶6„é·„ÀÚ%ÞÌÕ×f¤Ñﷹק̢ }ªÛéÄAoMNݦ,àôiWN0ÚPŸ‹¡ñûqì þ×­¤ÙPBd˦hzÆÞûHÎrž;‰r±U{è±t!uéÁVÙF‘À°9ŠZ€”wР½±b°’¢»;UÓ‘ý»ãÂÞî@!SÈ¢z¬5 x:ÛÕ'¹A–ÊaŸiäZe+Yé›Ñ¨Ñ‰HŽÍÈûˆž 8•Äñ*»3# ^eþ.¹´Q•ø,X}[{dtYã§[ÐŽ Í ôu~´sö±ç߆6¸ÈSGÖÆ]ÆÄ(1÷1@§?®o@èMÓ‰Š~ñ WRW6§F­EŒ9ˆúïÐØ rãrÚlÚ\SYéÆô¸ðå§5ØUw"¡[¬ Üýâ(Ë+~ìÍ>õÒª·±’•¾‡l#~ÍtdÜÁ í[BíƒvC&dO¶¸7•‚6žK. h#ÓGvóòò@È“I€”íº•†6 Ä»O³c7H¾m²C€¿»÷’XÖ‚¾ë•œš†RjzFFö¦=†ˆ{Ã΃ º .©—GLZcz%¥Å Í:Û´ £ ø9ÏCØÚà›ó€‡Ÿm¬d¥ï«·y~j=30Y«¤‘¯ù·G щP³u‰ïòmç’p_½’òEÀdU~Õ!ÄØl¼€ ¹ö®ˆFÓ5Ú“ÚíPTÛéNtž0½yk¢·A>U¥’|W×Ê>¸•Ú'µ’PÇÝ2gŸ øA›W}ÄC¸V²Ò¯6ð8-cÚEíhÆFTMÑB<Þ©òa<ÕJñÉü*™Ô:¦@q©ì:¬‚dCœ¨tûi0ØÎöP—ÑpܾÒ/sóêÑË%ÃÉ‘É$ÍD›\e/¤™&ÐDoƒ¤=ö€bC¹2ˆÜMbÒ“¾À ÅPRw¾1Dø§óÆ>*á¼ šhÝýDJ˧§®ÒœèG0&ËÇ5ñ§‡¨¼3– Ø->υߦqœ·Ýï´¢•¬ôehÓØÏm˜FÞûÓ8œ»áuO^ÇÍùŽ@£¬àXç“¥1¾Ž8‰½fÛÙ)©J' hžž*¦9:Xþ7PWí'×ÏñX»â=ÜñÏÄ“‚æ8<5¸Ä<òìØÛåM.¨Žxÿ0‡Ÿ&\ô6hòÑŸøHa ©]8Çï0–x[uù|f˜=È·'7Æ@ Ãmו—Ø×éÈ¥ç~ŸùŽÛÞ©gËCëŽ# „wÄùÆd=ïÑ-Õ’Ãi™8ùTÞiǶÝGí$ã|rNXÉJVúÖ˜ÞÅ0ã8 4¾šcÁL dÎØ©¹÷ ùHn…˜Ýê1½©eX*s¾Ì Ö Vñ»n‘Ü#¾Ükh¾v_×JV²Ò_)I»/ØÄ&o½3h]þXÉJVúIܺ£b[mýGÈŠ5V²’•¬d%+ý±gJù¼?wè3öm¾Ìì—gsmΖ¢å¢ZÒ;™56ò3¼ª•ü 5< ôEÁ~e61Ûº39dfa¿ÙÒÏ3 d¥ß(½¯Ûƒ§0_ ¦7Ÿx/Îàýà‡±k‹lƒ-î³$S7œè4ÿßi‹g‘ùRÍnŽ]øqähœ%ïóz¯R2¾cm*@¡)Ì´õ{F¤ Y4˜úxŸÀò“`ŠsÓí6C¾Kv/{…ý1þþIfŒ?’!•½¤è0_a”RU,ÁÑþÍâçàÍÔãm¸Àõ*í˜Q®bË_öH'¦ýd1ŽZP´ÈnöëY?¸WüjpjTzKéf¾Ëyd2¹}ÒÔ»ÒÄDÛ #ðÆrÁ©fã>;è™qõ e–Á” …~~Çhóø'*@g°Óäº ŸWŽœ‚B09%³q6»ÄÕ$¯ù"¶ÐìõwŒ>…œÛ›Åû€&Ó-¤ìñvd¿@½¤s\6ß5´e ^\xoy ?õ^«°£ù?íÊd2©D\™å£§óuG gX  $Ö)áøËÙå–Ùf^ô[õ¦ÔE…UŽlõNuòÆ/­vÊ=n)ÒðÛ+4÷ \ª§«m¼·þj²Ë»cë2ËoX  à½c&Úèn‚ˆ…<±ÌñØü.yûµQ¹_´@8¿)`Qþ ÔP¢L |Ľügõ¦žy”PKE/jö3åá>Lf–í¿Ùõ¾ëÑ…r2;˜+…&Ÿ$¸Å¼lnëhk>–Ëa.»¦O•f¦ç4² \ÊÎKm÷*Iö®M L¶8Þ ^·´6Ü"Î/½5fˆ6E)@qÕG·‰BbÞ©oêìh«Ù™jPŒ¢M8Ó3vÛ…ïÚZ*’|]–!sÁpóy ‰uïUKW{sn°SÂ.Ôs±j"†EXyô^×ûΫ۲XNdÙf¬ùÞÞ¿¡H¤gû1bË.´w½o~zž#]íPX,øxekiï|×ô<’m¿ý UÒ¡ÎáE§ÛÐ&e˜OF1WqŒ˜È5/ß¼Qß$Øx}À&#PžîDÛö ÑNq(<õðýû®•y¯E˜G›’¥nn¾™Wž5vH@5¯07§oE‹hã„œÞ?¿ÊŸ³ö¢¡l£G›î ›QyZAQ3rîìU)Š6›Îw?=°„¹¨ÔtQa€6éQ¬Ò‹ Z'õç£i1g4–ÑÆ’÷ù¾{•΢ÏWf즭CȤ:fA˜êÎíŠô¦ÿðãü€¨ä­?’hÍqü÷d¢S7júôÕö4æÒƒ&ÂüÃÛ7nÞ¼}xÓ2¿EoÝDhB¦še‘ÒV³Û9z¹E²ñû¡Æ‹L¯hDHx¶CîãŽÞ õ!óã}sŽ>n½´9(¹ûé`覯]ÜÖ*!häé)Vø2ì?]؈G;£ ŽÓ‘ç}Ç×Ó¢WëE‰ ±ôs`mØŠ­7ЂiF‡‡Ñ/Èì]äñCñc)†6G;µªïÎ ˆ/ž6Ÿxí·ˆNþ\]Ò"‘E›0Ð-˜·lû‘±.Øî»´‹:ÛmòGx›@.Ìx÷Hν̰ÄÓÞt%Å»Ž· GL-=$8yëbСõQ‰§,-ÕÚÇÒ*ëR‰B >ÀÑ9úÇò£–”×B’O8<½–§méÜp|ù5„-ShcL¶ìN#gL3CÔ¢'ÌK—¹§—žŸöý37þ:Ðîúýù&ÞÔKS´©©XÓtYî´pQÆŽï43¶N Ñ&‚~ønöºïZ<=ê˜e´1ï}ñ”üäÔ×ÐÌF‰Ñ;éëCs]³ Ëhs)^6ºˆò‰GµU9i¡óøt ƒé]m!Ë#¬ñ BmõGÉsiõF~oy%¹Ù¹¹¹™ñanþñ¹(½Ÿ’Ï¢á½8KðMøÂ6/Ï—¹Å®Ô×ù\vœ_é9hðÎ3–†rÝ€6&Þ‹Þ(„nìMM*{fXÖkå+¨ÎÓÎ.ÙdbÂ)xÜñJÓ#pö¶Qi9—ok/¤éÐÑ?­*§ÿàðˆpWŠcá„®¤Z&dXZ®îdEeÌ@XW®I¦9ÌõI?~éΤT ™s+ wT,ÎÁ%@[ªðð@Ç9ö·&¡Þ—'°ºc(J¦[B›žúã,¯(,$üsWŽÛ²2Kh/­Oq·!°Wí|Ü„°"Ê`è=vz:Ñ9˶@ònG’s¯Rëù\Î2ÄLÁ§+¬X„ifÆÐܽ±Æ eàñËî"–ŽJ—:çi²"ÉW¡ <ªû/çÙ{gs¯ƒ“ ÑæÞÎlÏå&Lq†«[̺• ÏêYdS´9®ùÜJj¦÷yhò%θ6b´O/èâ9 טç¾L6«|Ý–_l2&Ôå~@Ô)äú¤DÀ—_J ¡î®iƒW#Ù,ûÀè¸h-Åúy0Wîzðí+)â¿:çÄ3Ú4]Þæ½tz"Ί Ùr‚„‰DF›D@Ü„*èpFбúÑ?dz\#ü½»#›“³ÛR^-®, v'%µhsAìñF*ÀÔù²-ô˜£GÔ“,Òfo.muŽÉ2‡6Zêmz¸"!ÈÁgµÚ<Ú(R v;g˜èè{UÅð Ó³R~ÙÚô¿>Ãð ÑoIÞغÂ{åKh£[¦ò¯+w§-(ºøi¨á,Ã+Â4¨øŒ6*·ŸÇ!Mx²y[µ26lGíÌ,`´Ùp´ÙŠ$_)Û J";=mÍm„OöÍc&b#_#¨'ÛQ5¨Þæ4Ì Ò5n¤ðÝo! z›o@Œ¦½ÏcŠ¾õž,×(\oàSˆ‹_g춲ÿârœD/ÄÛÑ2Æuù‰G›i½~Ñ(fºÏ_­“®1©?ÒÕñäÓaãE;V„Ü€WGnn³óÊš)·_Û¹æªÑ¾\®Ö`›Z¹\¡µ{ WäöAFDÆÌq V*U3öíf¢´­ÖÖ»§M eì¼Ú?Ü)õZ|¶†q®ßdíÚÔ­enôxŸòâæ±’t >¨½+TB]ϯþ)Ý•âB£3Ù.^7W@ŠÉ;™^ œ¿ÉŸf»í©¾T:ÓË7ãÆ¢Siy—ßk· >Ýb;˜Îî )©1!^L:-l\§‹|£²Ž«W&bpóv5«MxY£69 "ˆ£Ù~h*¤c L&sLgEýúÞä(tlš ƒ2oû”SCŸEdŒlŠ`8{–V”G{8Ê1{ì gÉ=ë>*Ý)ÜðĈ5Ø1#ŸòG×Ñ]9›Jâ}Ù8z OñžZ€£Ä.É-ÎÏa3”cvÕ–/#ºø®ÚP©yl*-dI~Éšd÷Ì}Ç ¼=ý’o~œ„e›’XפU…kÓ"p—bÈœ–¸G %.ßXœïãÎ D7úg¢ æ*^'GòŒÍÚT°ÚI\}3é¬ÚI`°½r×å°i! Éî…'aATs0˜²r>ùâƒcSŽÔ _íK˜ÎEe þž¿åB˺’‡¥t{u^ñÚ%1Dâå.Dnk<’ 0X« 6eFú8ÛeÐL´i¯ÙC¢Ñ8+ïè÷.7%y3¼‚ŠK6ÆxÒ)n+0ÿõFh£ò ›G”V`1K );i(xòGú‡‘Yµx¤oX¨Û„U õ÷÷NjU…“£“Bíá7áÈ@߈À@jEü¿csÔèð€Þ”R<20,0Q¿LqáL³xŸ×KׂÉ1Ô]ýàÄ”2wÔöLQ@Rñ=ÝÁD0B£À1†ø"½ù/ä«Z)Fj„¤ÆÇ è™Ú ˜ë™|®!5Ãý½S(ÿiT2¸¨Ü‚,øÒ¨vG>˜ ÝO&]š0y©’‹†ÐÍ&éxïO_`ÞØ0\Ò¡‘q&ìH.pÑÅZI@÷À³®<íS329Ê…ãrG:»a2!õNß?:1¥ ¦– Àý>Ž”A‡? (5J&ìëëçËÕpÔ zŒ;Ð×?À˵m(íè˜éD•TÀDRÄŠ&p‡Ætݪ˜êÓ®…b,äè¤ÔÞËGd†‘!$sL35>4!@Ä̱¶{Ç´"“pi¬§&FµõRƒÅ³èÈ/ÞøÚÑCS…žm“£hçKˆ•FH£„™Ve0wJ \÷ ™ÞØ?üJ5Ž‚¡al“ùÀÄʉ†QU%º¾S[åOˆÂgøÏÿmœxGªg‹\6›ýzyCx½Ôºyñyz¹+êθæs]~ç_€eάt¡uOꯆº®—‚×þdYy÷m:Û¿ShÖ¿h¢u·Ò¬XñyÌxu2ÅùF.ù5±ÆôÁJxùæןÒ,Š6VÞû•AiV–°ôÐLcx_ÝÑfn”Å ÿå®ýþÆ/ÿAî;ëkal§YÂdN°$û™$i†©,Šü‹t¢ykÆm‚Ÿl_Vñß))ùë¢\‰$R·ZèëpøÞÀ7¤ahXO£ÕÑ?ú#…D$Q|I:ëã×ÿs×/¢©™G{ï–;»,}ø+`7¨Vò’¯ëmWyè/Å‚)¡æG<¥4îòîç•—±ps›Ç S’çâ|?i¦ÏÇ=I´ÕØöœf‡ÇÜࣽ؈Ҩ¤·Žltgpx¼WXÊÃŽaPë.cÄãÏsôêX¸ÈÍ's›a¦ûS‚’v_—¼¬²qú•ñ¥È‡•SÝ2Q½É68G;n¦2óŸBP+c΋+ }ǃø??@Ôÿê|ú¿$_žÐ׳ïíèàˆ§º¬ÝyA ½Üú‰ù?ç^ÓŽ2Í—^xö÷.Û 7]܃Ô„ÝRB©Ç~ ÏzN™n_µ\*GÆ}óѵK*n|+dJ•æçUH]èÌ4„¡VÊd õwà ‚²_ÞvÓ5ô«ïn+ä2•z† ð+±Ï“'øêXš½”×b£WܦK.>9(õ¤ãºÐÙ™Nœ>åûéÀb—¼Ú躓4í„÷‹[7 Ti4êþW—œ˜@ÒlOÜȳOI¼¿÷Šý&%7víñ:eÛUR`Òwùg$@ðH¼çŽ‡]âº=´¤"ô•ªÌ‡~­g Fw™„wy,ž–R"è6uˆã2õF7›ÌkÚ]`ÌwÉ‘Gˆï•l¼,Á™BtêA ôxÌÁUcÑ5Ë|\ƒ7^û½‹¿ü×WœÜÜè –OX‡6È©[ÑÎõ‹}}}#SrÚy°XÂ_ìîU'Ķ^åqa~W›¹Ø¥ã®‡>aþµO¶?8êωLÎýˆnµLÞËöȸÒwz-‹Åf»¸‡g¬CnôåŠÄpNJNW$(›h œ@O§ìX¸£º~ô>\ìëã“™¿‡¯Æ6eGKWúùúF&]kÓN  ìÈÆp9c3ò%H »œ™4ºÇgS£‘€ñüðÂE›PóS­kÓ¢9΢¥…%EÓ‘šeœÜ'okvp<Ãâs> 5š¸›í—ÿìúÞl·TÔ7–i+ASoªÙ®®t¦‹O°HÏ[Í9É‘ŽozÞnѬbpNŠßÅ£Ðè —¥¢þ~~\ÔOÏn õã„'­îcœ&Lös¾ÿA>sh˜„DÚfFîò—›Ü³®Œ4WGø{†%× j@Pà ,W÷»Èî7$z7=*ÐÇ'¨âÌ ,õ‡¥íÿðäX‘¯':-Ÿ‹÷9›áÌOŽOîCîóí+Ö„_Ž¿«8E¨t"⺥ÐÙâÔœ-Çbp{ß©±º›E›ŸG°3w.,4#w6l9#5F›=©A¬ô=Ê#®® bÃézðÓ œ/êïL=éïÙ6¦üLoê¹~¨8س¸ •¾M»Ø„ÁÐkêaι5\Ms:ô¬[õæ5=/›`4ôœU+Ý>²ºªØ-.WßGfÐFúÜÉѶ¶Sb°DÒ”eç¾ìŸÒ£ üfc¸»ûêsêß¿J#—6Þ©dx„q¹\•^¶G2‰ËŽ>éëïÿúƒ@}Ê…¯`¬8=ˆD™¸å¾ç_ÜBÀûòQÙ†êÌ)=~«§··fO6Ñ+ÔT+¤˃UóÔ¢~™|·¡£¿¯·þ\áf*Ü1 aoqñ&!z;$&l P^¶}èëë©;¼Ô†³þT•Áˆ,¿ÕÝÛ÷©«É‡jwæܼLrúþûp9ÛžÈNÍ(5ÐÉu ý2Ë?tw7Ý;iOò@âKw­k6Ýp3Rôtfî`S>‘á¶åÔÃñI^ËJ+@iÆÞþ„wŒîEð~°á$•êòªýS梨(÷˜-È|ú¼2Œá~«éÓÄÄø…ܧ%‡‘r 7»è·>qyRuûµÊM'‘U*¨QËÈ1H…9æ{vcZVÅõ‘—ÇÉ®‘ØI³hë;r¿ßÈBà4ô hslº°6ˆ-kfÚ@„Wa äà4¨‘+ÐVóË 7 ÔŸíM8¥íÉþùG>v÷Ô_Þn „ñL»˜oÊ`H¨/—¯;ùÙ冻½Ô¯V —ú!aßMšg!ºŠo¥Ïõ€”YN¶ù·xh™g¢ ؽ7ÊƳLcž)`´q¬åC‡3}Ó÷+ÿ(ºnýáUÝJŠË­;†C/\cÕ+Lð[uäQû•òÀÔr4¨ìU£«K< ?9ÉŽX­¤¤¡Ö JŸ« éÊÄôQdýýbÙD+™æÔ2¡m7‰XjÒ‚ØUb~ÇÛ·Oª})‘ gÉÊ<çeÓ^z’K$ðz‹ûø8Þ/Q·4Éoã™zHÑÉ°sš¹’Ò¢šË¦ôh1F,”XêÉ[)xJ’X;é yÛ/CâÇYxÒBÚ2C3[©ò>²l¬Îñ ÛŠ\XãÇ@¯6 m2áíH9;hñª¸m&ŸÏ·g=Wb™Šƒ›»=ØQCuýõšNƒd\j3!šÍým-!~J+%}p » %:sŒGWRàö@ÛÌkBÝâóqžßŠ6^‘[´-ѶãGú „ù•#xzƒ²äÙÂЦü*rB8–»«Á‚l3D½Cf‡Gíð)k—Ì_@X~¬ñócÎÂ-l3½9ãÒ¨+UïùTù¤¦–Ç »Ø<ƒ™ï„Þlå$\D¯ÏÃh3Ï~âµ_Å~b³² ÞÈòafW[¨I—->yE’Ír~õ§?ÌÆš)Ú<yu¾Ì-núÒñùì8ßÒs÷!Î#æœlW C&zÓÐõ=‰É[^jõ6A‡ô’“m ›g¢ ¢¬Ù±Î™8ÏÙ?zëþªžI¹I#ê.÷)Ζ¬`8Îñ ß]ya]Sð{'…¸Í#8eåUÜy…\xy®œÂdÁ‹”üYbpÙyHÕ5 ÚÀ*K=iv€gXéîãí\‰¥^Äj¤û&ɤØ4C¢ÇKývccþå¹™­tvm@pSgÚÙ½ê:—…[nè¥ÏÚØütÇ‹ß±íˆÍâ/ÑÞÌi)÷·6®µ˜…Ôïƒç ®mø18G'omƒp옓]=ÐÝFÔ]=0@‹¤CH%ìHä6¾ªÛ Ú(#Xv^ó74õ¿a´qŒ\½O#mu%Ú}Áý6u–¹Þ„‘/ô^ÝõdÜÅæÌ¢žG˜HZ¤Ø³màç³Yî~yÈu×™hó2Ïßqáq ©õxÛ:$o:£˜xà¯u ¡?ĉÁ™hÓ|e;;j‰>ÀÑ¥Ña[.ÂýJ¢·ˆTÀýÇ2ƒ>çûà.ŽèzÓw§nê$àì·u™ ÍMÃÖÿøfsN¼;VlF¶™¾J<Øö|Ã’H{ÓZªÉë'¶ºQí× µVowÖ™b˜&Yçìh£-âÀ»]xgrþäl×Õh*ÞÑ~K'ÊŠþ{1P}{Ùl+MË6{¢¼bŽÕë˜æp|žåÁ96DÙ—nw‡/ù†Nù,)~Ì„4Ÿ;‚6ÅFh£4DQ:ÑnÇŒ«Ùf/:} Ú ejÞCŒÚó¾2Ëe½éJ*+ÊmÉž[Æ£Iñ²¡] kWRF¼ÚK˜O­ë—~ð3Û› ´™E ÷HŒÜv1<f2haw@1ÜDtÐ] Ñ¢ z#dØ…JªŸ”F1曬¤Ô­[qóÝ?ÊŽz¼®ëáI‘;­spWQî¿¿ oËnTþðfÆJjHÑyÓŽ¨·þš ì®El‰ß+÷I;y™¨áß\Ÿ\¶É•™ˆõàä­TÎuS^Ž×ã\ÚAC´ _¾¹_,á¾Ú{F7ØφüÑש¥R)ÖàèUâîÉ÷WëM |rÇh“É«Õ³ö¡%Ë߃>Þ¶§Œè$ªGµµ\¡ ’ÃhÃÖµÅBÝëAÑ扚ײû„ÞÔ0?jñ:Ï"’p.ýØ’kìnË;ЀAÕÌ·RsõjÏÐr¤aO¥ÚrJ0 ‹†×F ±ÞÉ,NPæÐJä÷ÝÆLð‰Ó6ß"M&•Ì¼9>3$×lîo7˜GížTí:gÎ #ùtýaëlhƒ£¿D»D­KåÊYdììL¨­|e”Û ´<,ÇÙÏ5O`ÕÒ(eÕëüðnÙ"c-1üññŽLz²ú›íž‚F*‘hŒ˜éM ¢^òe“¯5c}85ÿǽÝF]¬øpË ƒA B*‘«L Ðu«WÒ ]ÿêeTG]½ç¹>ÈÅaæžTF+$ç€\w½W8ÒÄ(‡¦µÄ˜„µá6ìÌ Íï~A£ ÃmŽ¡;àw¶ÄÑY΋CœX´˜rìîåà› d*mÅ#”1ÕMn8|ÔÚýXDXH±»ý< 6ø³ áK@WÈon[I`{eæn#,Ý#<)/o­¯Ó1b3G:ú€QÉ´–X9ÚB&Ó81yëW»93 +â—óýèL֪ܼ¬xžþe‚‡»+{ý†…žÏE:m*‰ìÈòϽР?Rlj;dÓ² (ñsc¹Å®Ï[æÃöˆX>ËlHŠ¬ðõð/ظÁEËØc2ñYj¥¾—')tVzzOf…¹»Æn*Êu'ËoÍ" ÏD˜­/öP¤àøŒwŠ+'ÍwºF†ës!¡¥3sŸ6ÈFŒ¦Í“B Œ»Ò"ÑL}r!QÃÒòs—9ÑIù§ë-¢ $YN'Ð|.?Öv¿(–±o´Ñóýa:™ê]06Q'µ‚Të•R"…F£Ñ==Ýi@qO—Ok‰—ݳ2Œ“3›æF5èJq|k¬H7Û›pØÑ[T):e±Ÿ Ù?®pf›c0Åz¶M깓|«’‰Åz½¢%ÖÉ=ðñÞ.Ü´AgØÑdÐl76•J§3öjÍzè÷¤´´6ÖÇ%cÇï]¶Q«äü)íi ¡€JAUè‘€ÇãM DjÝ¥cP­äñøríÄ ù<±T{\-ò„ •\Â×EAt4ðK ›®¦ø<¾™¬4*¹þ&c7wA’Ïçc“‘DÈ— §›ÔJ™€ˆÛ$h‰4b´H|þ”L©ÖŽ’Š„ÈË)¡R{çRÉÄp‚"9æΚðÚ(¤SS"Tµ¯R±D*ÅÅ º§\¥–óÑıJoJjpogf+!õð‘B"5Ò¨„‚)8€P,…fÝG[^7Ô$oJc †TÀuA  ÒÙùÑ×ÈdÜ$$zùÛ4wP%žœ’è[j88vÆG"šBzV…ÙùÐvH"Ó,“ ¦Dº=wµt’/ÂÞ«¸…2•B,䋤3+%—E£Íz¸å§ÄT‚Ò)v’ k•B ç Öã:dÖLMòôÎÐKØrÞ$OªšE¶Q_Lvk6¾…m¦7u}!—ˆ ™vfÏ`0PÌŸÊMN…"O êgÒ¨UR„O”¨Ì$™š颣-®†©ù”@ªPéòUÃ×g‚T\)…+.W[oaüv)Ø3i²D1ËðŸ4w^ñ—£/?‘>{¬‚R{©ÈdOê×íM+ýU2žé®¨™Ækéž3ÈÃ7¬ÿZÌ¿z¿syÀè`Ž™ì²ïÇY»|fÿ½i%+}g‰â{Žkð»È6Vúö^¶6²•¬d%+ýU’`b3Úá)¹¡¶ pû†§´ðA•ll1A90049Ãn§B8ŒØ–Ô€–¦tÃŒ³•ãZs|Ô®ãð´0‰§&à˜éKT5«èð[ HÑø¨mLl§X*˜D-… $J“B Fú¹ŠiwâÈñˆ¾ÁaD c*ÔàÔØðè”X#ö|Ídªþfäï:Uš œ×;8ñëÉèo„mFÅæÊjÓ©|Èjˆì"q"ØPµ~Ñ‘w*Z i¤áp°ÕßÀÊÇðCè¹é»:žåî“™µ,.ăP×£žyuø ,óÂ3À­>áç3R ] pË®£w‘Cy7¶§“®‰i©l&=´ü!4ÃjN_õZ …¾(%À p F½!h&íßíç\~ñÅﺇ§²ò¶ì(À¾«…xÕ/">Ì×™ °F[ ÍÕ»c\¨¬¥7õ^cx¯Î³£VA*ž““Ó{¾ê̪è•÷åo/ý¿¢!-xÍþZòg}ÃÕìoJÓÜÈU¿Ýnë¹á×a½4íÉ¥®ªh§ô›fÑFú$×!Û¹†N$8uXìïk&k—‘(ô`?ÿèÓRÍ‚6»ÒÂn»¬ÿ ãÞ$ÙQºEÚ1+h 9ywŸYHJ¾øÙŒÆA™ @oÃÆæà5;\Р“„ž,Òó±¡}&’rX¤[mX©ÔÛCRÏp±eIe(ÚtÞ«ðˆØŽæ^hÔzGy²Ñ“ÑÄ·¯°ï&@OÕ¹ nþ”’´mÚÙí q§ž©»®SBR¿PƒÈZÓhÎœÆMU4è;s)µŽñrSåÃìÖwA3(b”>Mƒ—j hYׂf ŒƒæÔLæ,b™ù4µÿês¶ ̨h>ÑNÞñhó rh™KÔÖ´>ºwß–âÕ>þ ·?™Ú³Qð»ðÖ;Ô;PûéÂÐ܃3ÑfVR—shé7úVòiÙfâÓËûw”lÚT\° ÓG¥AýAιìàéú–úT²ôü˷ꆅZ×°†  ž§ûØ^ÉhnïXŽ¾pÛÔÙà}Ft`x,+&|kõ‡š€Ô‹§Qzšå¿xÿM£Â¤ù¼2”ë™óÙq~%çt‰)sœ€ì‡CÐÛ-Z´AººïÌáýe¥%%e¥~4ÛÃodØŇÉžÒ¥Ny•3ÖMŠ‡Õ§·UlÞ´iS–?à»™± 65ÃÑêQçoW6ð§ÂxNÑ9Džüøx—“bÕdmäÚ‹·p"›Ã]s.#~Z/”ú¥n³ŽâßíªJ {› ÑFóS€cäñÞ™ËwÉûÎ4‡G¨J‡I¥PœQrqu"ãíª[gu°c€6··­ Z³GŸ|åBïĪƻ[2çÌ·µµµak-p>8÷SnÎêÕ¯ûê÷¸¬×£Í–šæ½q$À'Kò³¶”“õåê"™ÆTkP¿ Ž@z; m_êY~}ø+ÑF™í¬~4d¨*Я¤Äo::ºì½p¯½ë}{ÓcmƤˆ’DÐÛP^ä9ßÞùê»)4¢êƉKÓ1‰ ó*ՆȀxÀëgX­RðÃØÀí¨3mÈAB]®rrJ/´^.§»ûæ®YÑÚuë¶_«Ÿmô·ŸdFEïÐZQmæñ×zõh£æ¿gÙârvžmnëìèNbÎ=Ü(7ñ,YºÔ9ÿHsÿËcs‘ž²ý‘¸–šJ¹róŸ¾iyÿñùDºÏŽFäúÃ=d¤O2‡6ü[áÈšú@nÕuä~ûL´ADݶ]¶À ¸Ÿ*¢»›TVeÍo\ ±¨ãƒÔ[èþÛ_LTp=)ûÞÃ|$?Vž×8¢ÆX‹èçN»ÜÄ…Æî9Îsÿ`JÕª˜í¼i!#´á?ܽÀw…¾\1ž ô>¬Q쉑!…J«º<»œ½»ËX¶nyrÖ>Å´Cq¾¡ˆ!F­B¸<žvïå“mdšjøBEZ”hÌ¢yKMॆϮ7ZTà´½ï0´á©eFGïÒ^KõÝÆÐF!*t×|&_”ÓÈ‹äj•@¤7ª1ÅÁS«GÕ† z¼Á5xoÇ"wú“n!†6ó\[u÷¼Ê“‚3öß}t”éV!“kLζY@›g›“èËêtÂòØõf jÒ¢MOýq–w”®ëú‚ðs+Í¢‰lƒË‚ûSÚ[?%¾€ïN8€"‘>§² ³kw½ëæËÍ¢ Ì ¡Ž„ý­x¢¦@6‡6-t³¿S‡ÈJ±ÜGVú­p i}ñ³Få4ãw\h„ŠË R™T<Ù·.šéubYjÉ'¹mX(•J%bauùB*Å}@UoÎä,ßb4B‡Î9ØpºgÉhmí¬å.¶KÕËeÒöKk¨äˆ µéøb_çŒý÷•Jeçí=öÌ0¾Ž¯¦õ6wËuZb(=Ü)rÍ!©B.pWz8:gV£• ³~”ë´Ä¨Þ¦ë cX…áRh¦lª…GÝøSõŸ¡ã©ƒB¥ZV–ÂN*¸®CųÒdrÂ5¨’ñ{Ü|èæ)¶$$–]R+år…²éL&Ó¯šºG¶qk“ÉåréX;ƒÈBl*_&Âí&Õ`3¤coƒ,‘hݵ×ÙãÈËÏÀqTâ._Ú‚‹oxf ØŸ[ý~©rƒœ?Aô6’±÷ŽT!…Ó¦©2B’¨†ļÆÌBïjœ>[-‚~Û—nT㧭yøÖH0÷WžªþÅV ¯áêñãU=“²ßr˨&^8q²q@lÕ [ÉJV²’•¾Rµ~n-þ[*ì—üÔü9mþ3£ÿ¥:ÎÜe+ ÷¿¾°OÍ·gç h•›~Uºs o7?cïïáÞíðƒ?Û{[Ö‚²ÇËÿì¼ùwÑì±Þv•÷¿Æ-;j;š/Ъsðûnv·e‹dJ¡Ö|ß N§‰ÜæzlCCÖJÑþõId"žÊö9ù°C·X–žØ¸˜BÄ3<#ïuLèA@Ðýx!‡åˆ#¥•j]€õçBÜ"µ¬bT¦óE ªßž/°ùW É4†L¶Ýˆô ;:Â2K†e^+ѯgŠÂ©Á ÖáÿK‹Æ4†·¹ÔóYÿ‹[1¿YcFþl÷ÖßN‹Ï2Ý*ä2Õ×Ü÷A<•·Ýt ÕÖ.=‚~ønÏ,ýü5]¥9C¿Ó/ü®uŸN.IËÕm¡‹Á³A‹TtMAêÑžöv%uðÔ¡ÚD÷^w ~©|À´!]Eïl€’g ¾®9ýw©4‘³ÙASv£â=úDÈ™íÆó%?ô¸#¤L÷v^XXâf¼ÒÙkW ^dˆOz‘Ônˤ%µdÝ^"‰ê•nE…ïHÏ-Lß×±gEŒ_~ò·t¨|e‡ã›¶n'zBLqgÿ{ïý×T¶Å ÿ#ÏoÏgÆ© ©' I€P’Ы ½ ˆ¨ ÒAQ{WìŠ{¯ˆ¢€»"½ISÒ{=ïi IêÌ{ß¹÷9kf>Cö9»¯ý={­½×Z@@PÀŠý°}¥aôYarŸ¶¶áZBßÅÅq›Þ\›¸ñAaï*Ë„iËk¥–8êb×6ÜÙ½ŠÏ¤n”aÁgÁ¡Ö‰‚иì'H0*8ÑIvMy¸ÏÖÇ0WŒ_]Ppc‰±§œ°ÅF‡HñÒ§ŽhƒTtgO TæâÊõ³+Ú µžZ!†DÖj­GÄFùŽ²ÜÂõÇtviäïoVgƇ¬ÞÞb¦š¦”8a×øhUVLPHtÃÝP7±,)œ·WŒÙwÌ^?ÙîU ½25¨ÈÝÐØ&j«/¸ U¶2+äBûTK{CJÎþÞÖcÕB?!g͸kUëÑêÐaöšóÄUnxÕô§[l??ËW ˆT˜a´9þdðBݾ tIÍ1´Å™‚ûŸ ãל›=›h±ƒŽ'E† øá•î ¹îñ8 ˜_ÐÔ 'êWfñ‚Ø´e“&Ô¸”·ñÝëK[ÄÁ±©Å=2KH…YlcS&|-ðð2fÍc•I+­¯­A‚ À¹ÎmI^uÙ$`\‰þßØ™–PÓ½XãïWù›aõg†§Ë ~¬Róïb}·»zÂ!ÆÍò¿B=óŸOµ¢Íè݃϶¼Ùáî8<Ã0âXoæµëg鱋єG•)ëîàpñ¯¢MC+8ãbÇǾ1h9÷G<7]y5::ÒÚ´Æ‹S̲é!žžMŸ¿OË Šá[‘Úü¦{tdhWAtè*øÝà•dFPòɯúF¡Å5žJN=y}w)@N À3µB?éñ—‘éïS‡³xAU°µ`ç¥õÌÀ”O½}Ýï[jsÏ\Ùõ'×—\û_È=³È+ó™cyèB18DŠŸz2{oó !Ÿ’Û?<Ò÷©#:Òß]_{q¡àÅêì©gDn¸¼;•Î¢–mïïﻼ6Š³Ùöò³YöŒíE¸ÜöyttøTM–z%Ê›!Ðnœ}}ÙäEf,J[;:5=þþ$É? _”; ^?ýÌÝ›š³¹»·Wo7äbŠvŽ´]ÝîÇHƒ­–° SH$nf`ì7ýÓÓß›Jâ8K ÄWJ謸O}C}šcü=x¥Ð}p¬€±v±ø^¼ë˜rçMÏPßû¥\Ϥ#°ñ~N<›'\úìsï˜Øùl~ëÜéîøª«xh°:]˜Y¶úÛ@(œëì• +…„ÊÆŽáááÏ/ïy¹z÷Jí.l]MüÚž~š‰îl+ª@ØjÃIEÖ2EJ-×+`x–Ú¤&lÁª+SŠÑ» F˜Òˆ™ÉtÝÜÃN(€¬ÌXûÌêSQSÄp­ëµý'I´8Ô:ãëã¤Àd[,´¢­ZvŽñê¼/Þú޾²Ӳö3V´ùpfû†ó¯q¸ø â䀈 ô õz{6½à°õQ\Áv»ž°%ôÊÉDbü «&á3}¾_/_Kcpò H ½çjH‹*­%¸‡žÁªƒ³µ‚„åÇÐãiýóÒù~ë¡Ä²€?ja®j>´Üë•öŸwžÝJNÑf&R¼Ù©$e,æÌ«nÁ*z½!vF›Þw,᧧/y» ›à@óÞØÞÖ Ü½qO6sÙ|=—%ØùÁòsÜw 64›Cg:¿"™¾…¹xííG™YM›ß21GðzqÛwŸ6lǤ{8lBÕbHŒô«h_-‘OÛgÀ¦d] nbfHm›³\x°a‰ ŒHR Ù5ç^ ]é;$œA ˆ]Õ؆NÄìÙì#IDˆ N?xv%i 2„ªH¸7 }t)€ËNÌ TÉ”Q)‡¯¥2Ê°h–Cç~§¤@`ä´"›2AÍ«jR•Ô\«Ïð‰[ A¨¸ûƒ‘¢±Ô3Ú|”™ µ$~´^\7or)zÏüí^DZ€?›H |2f»;°ÝÛÌldD"XÔ½-è ‚Ê»q5ZøƒÐˆ¡ÍÏáÂ?m¢ùØ öƒù‰4_^¨%Î:ÝËkɽQ´Qe“½}‚„–¨ô¯y®ÇÇ[xU ^Ý´œÊæZK`xSNÂ~ήN_׊MÙÛ*_ˆµDa.îg'ìöáseÿ1ÚØFŠw†6“á Üa÷0¨¬ßRŒHRÓPígÆ­µð<]ÛÅàóóu¼¤¢9†J_Ę|´u¡¡Bïî[º´  ßûŒÆZEÎ'ßÁl)M±t—Gcs¯—¶»x‡`KÅü‰íJû¨ÆóåDì,´‰,±ÌE¢UB[ƒDw¯ÃÃXãëúß9%Žhc£·Aæ¨%º‡¸³Ùü j¿¿Í‰`„F§¤¦&†3“+ìÑìzx2šGõ`òË6îkûòÝAWW”xÓ&]œGNÔ‚F§Ù–yyCöò-62™æàŠP¿Ä*’$í¿È`Ä«-*ê{‡€˜lh:ò˜ÀŽ×ÖØȆµ¾ Ê_¦[·üÒ»¦á×›«Û‰Œ(™³½U6þöñ®/ÀØwÛrsÒ,Ðý¾ aÑ_œ§Çåâ(ó7£ÅølÑ¢èí7f½bEí*aÍÇǶ ö`GqðJ'P´ybA›Jm‰^.‡ìxÕivÛ©þjE3hzàXÐÆMÕ ÚLǹ/8:„Ù4}¿”ë‡ö6²…ž6µ›?qݼ:åÐjÝÎ^¸Ä^sk­Ý°>(|,™ÕºŸ Óàõö!¿»}ÝIoXMow ¡Íu{´Ñ¦=võa®TªçqŠ6ÇÍv‰NgÓ°-Ø5¢³xiª%':¢ Ö7éðéå‰ðæ»f.f@ÐfôØYEfÛ2‹Ã çûPO°0Ô”‡’bJOY§^óý-À`KuØ㧧+CÒ×£Jæä¦~Ëe*•|CÖÐW<š°Lœ2ÓË­þ‹3´AϤ>^¾w¾H­³œ˜…ij&þv´1ƒÒ{kçs—cckÖ]9{¹üoEðåf#ÕÂKÚ¯WouØ1Äö/\)R GÝjº†ÆU6Ðûû²è©µÑÄá¬ÌÆWÆÎÃβ›µjêM|7— ÄœCöÞÚíÁŽ7Î6f³I!—£>wë¢ÝóöBŸo‹pÂ'÷fÑÓêžbxtµ;£Ê¥ùrÛ6Ùn¾¡üæñN õZ¹°¾ƒq„轘&Ç0}ùÒ#Ô éGhóuŽàõvh£g»7u"ý6KÒiÄŸ¢ Ô놅 Û?¢i»Ǹ ’ÔªÀèM¿†6NgS³„æ½î5vƒ 6WÈL*·¢ÍQ¨ÙèºE¸4¬ä{ß}‡ƒÕÊeèÍFÕl3S¦ñ5àªÄÀt¹-¨°wfP™ô+]˜3êêHÏÕM°\¦ìÜ@d¢ø­ý”§?¬¢9“Ê ÚØjÙ"usP¯ÎDÓ‚Ðæ¥Íš!6ƒñzR?ûˆ%õ« ô¸<šŒZ 6§¿koÑæ¼PÀOP¶¦"šKeòKHÄÚÀ–z:±Éô O«,/â1H¹›®¡ $œ²^Åh¬ŒØþ%kÖ,äÑÉœ|4òl´fN7ò„êMáÅf& TRظf®ìê|ú¼Ê»ÈbÔòXÔåµûŽl-NÏÍ!Уt³Ðf>Š66ÑçGñ¦ñ‹—'‡0·Ês Ú kUFŸDJtnéšé åÎ.ÀÛ›LVÞ’Å,&}Õø+ß{{?YˆzÔ/ ä2„ •kVóY¤¸e‡Á_@Ðiðz´s¿6Õ›Ä-^[pæX2ð3´ÑB³òá2…ÎÌXY•ÉÜ¿¿p>·ö>óü$•á³xqŽHïˆ6@ü1[´™k6¿œÉfŒêõëY”»·zx°Öj‚üš5(¡°áYU:Ï'@XR^‘Ëc0ùb؃¼,‘2ï²i°cD’R‚Î+‚-3’ç¾þ EâODÆÄÆa“W;ÞÑ ^à´ðØD›&\¼5èŸê˜ —Ã'“h_! © à0‚ã2++Šƒ˜ä¨\x«¬jŠ]F§Ñ„ÑñÑÑ w¾ƒ—3KÕøPl¿'¶êmÌæ[|Fñe.þE²)œÕ•r8T=‡Y &™X¬³uš:4*½\©FÏŒZ¹D¦™¹ j6©pŒu‰Ln°„jÒª¤rö1”"‰Ò¹^ &‘`_Æ9²›‘qŽZ ÇŽ—)L&ƒX,sˆšô"4Ñ}Q½j”pìx™B Õb© «]¯»"‘¨´Ðj_l†¿ÔP£ä KuP‹aÒË‘îË*“%‹T*Ña &™Hl1Ï2Ë$"»ræ¼n'˜•Ôp¯%*½ùó‘( ö µBƒ”e;GPûEÚ~ƒF5E¦Ôè_ÔýΫFÊ2ÁM—H¡JìØ6Ä:G6‰ÎfùO!ƒ@©u½J™D*S"ýVK$b™Jš è Ћû_ˆCD½´gè:Î*2[Ê„ªËÂ&ƒÄž¤rl£¥Ó(¡7Q¶œ¹`l6‘HÐ,Åje¶s³œÚ¶L¨í¨‘Iµö·Mz Ä„è ™´£‰ë¯ãp“Sr}þK5 U'Û‘?•IyÝ˟ߣ{wµ4>mú÷ŽÜˆ…uðIÿ÷1ÓØùÅ{Zð‘ÀÉ){8þñÏn¬öë«%±þ$*“B¦¯Þyþ§Ç °¤m)N"’:‰˜°lã„ÊŒŸœüÇØ 'œþgØøW¸ú§^Êp 'œp 'çßPÔ(Ä£#ÃSRÝAs ê¡‘qÓÿèT˜Ô߇Æ$r×4c-kÖN}™ÿ6¾øÛ¥ Ç2墱ïŠ_>w6ê†G¾âaëþËåRsn WHTÊ¡ëÃ?g•º øÏ$8 µ­n-ñ ßýg <‘ÆA7ÀwüjŒÇôÁ°ä£v‰áo?‡2ׇxÿe=¿´‡Â ž6áËøËØ?Ž>>—FzxöØZ¾âå¾ &)!3/”ëÃϬF9]r?‹z43;ˆÕ,"mCã#~T^}m “Í}2›R‚²î¸®Ohrö¢PN€àÍ|5îD97ny…柺õ=ê ây,^Xz|HVñF¢7{ܪ[–ÿ_„¿=™G‹8½:¢¬v󪔦o*=ž.¥yÓs²Sü"×&F3Ž¶N\«Í¤’9Å%½Zðm•{ØæÒ~|J’Ñ36F©k[å–°7/”šS ý¸™Ç ¥-Î!{Ð>¶nIa’è)™Y¾tFD1|§Qû­77-„ð—//•‰^ÆpèÑ)‰‘dÁå{Éò^7ç\YtñÚå9aTŸ„^dügWd[æ78xa}X1œn6(Ò¢øt^X$`ù'}FnÞªŠ¡y‘³²Ó}CV­È÷_sü3(ýâæÍùŽ’ú“môyõón@Úº`”ýLå3ÁMááÑ‚\ùаX¸ tÛ~À“¡C¯Òƒ¦‘YÖ>çNŽDÙÍ<ìClî…Qâì†ÐÀ˜ehãY®Qû ?Ž.óK­}ˆ&. aÕ?ì5qšÝ<=>*ABê:·Êl- Ù= й$¥ìðöŠ…›oóèŒt_æó˜_äR×\éò'ø ÷‚hnFÆ¢Íwákî[ùa»»Á‰FOV)ÜÙkvpø"¦z)05ØóF—½ÌjÒŠü(´›Ý˜±Å–,FÞnØ/²µ€ìÁ›@J¾» =8´sÙü„£ð½šãE ×`Áp»O碶B/œÙ‹.@GŽ¦{ kP™¢íä**+à›É&¶¨ÍͲýÚg0…O8ýô›æÓ WZjk­ê:åãíyìÑWÐØÇrãôYö67J3‚ÆÉWÀ_dBÝiÏY7‰»iDVÛ$Z­©(†\{¡Ô‹·¬ÛØ…´ˆãˆó/""õôË ØBüquJèFìž­äË£7¾Øm.”ý"­ªs QG¬½0dvZ‘M™í*n¸×ô~_œOê4ñHi|zíEpò êÛ4É0z“ãéV}ªB/ª?.Iý£ÑÆ>ú¼ï’õÏŸ¡a뛓 þÕ”­Uf©Wâ¾{è㎶+~ó)÷ˆiLèô“Ò¼s%+i©¥„'¹¾å×߃ˆåBZÕ}Lˆ€öóÜ*hA${Ío°·ÊlÞá<»•æ²'øÖèAp.½Me°ÇÉaP+úø—vnŠÞô §"=Ù_@ðB:µò$%ʃ¤Ow¶-ªl„@· <C\«¤ywJÁÑ憨Âc·òYW§ Åù™EˆýnÙ·+Æ Æf´½Ï­/¦À‹6¦îDÝ?=;³>$Ý\™_— ƒê!€•&]VÅúÙþø}»× ž­å§”^Cp̼?1(åÔ T1L¾'ÐüÐÆ…(°åÄ1Þúxe;7q©µ×©|âñGc¶ql¡‘_àƒà'TZwH$ÒW ÆC_;ÏÓ}±ÑòlÓÒ¤„²ƒÈwhøLÃþº µµuBè® ð듵 ÿ hü¥ nÝÁÓïûœ3HEÈNÜPÀ©8ün|ŽŠ¬eB{®d*õ%Œ'ºr¯•íJÛb¡v2ƒb¬ÒSYœ·-Ú<½zþL'¼èÁø? m¬68ó|£“K-aëËÊ˼vð8±¸{¼juɪÕ-";C¼«›–ùcJmßï}Ò :·Ÿ[0Ûã„óì?E›Ú€ƒ·öddn}3ÖRµ¿œ8å³ìØwš›1N½ØÈʼ â_õŒ º‡Ä F?ºk’xÇŸŠ®Ô/¬¸«˜êX¶ë‹âÁ v錙¼lä&À`­´ŽHéºG1´ ?€6 B›°Œ ÚT„ h3áá•XX23’Å«t6£d6¯\v饚n/ªŸ#ÚÌu¢~$†_žß˜\jm[Vm6ÚÌh‰ÖÛ%v£³ý-­ZURZZwü:(ïñq%¬Üqöݧ/£¬?ÓŠ °¡ÔЫMUÅ  ܹW?JíõF³bøy7ì´"[´9íºݦA\WûNm«›l?Æžñ\“ôAsË‹‘GæšSøÿÇ¢MǦLÖòC3*;jðbESC qQãˆUѧÕÂ_,[´ù|j- ù¸Û—àmÀUÜ?ª)ÐÍÍ·þ/½ß”]βÛ~'ÇÏ'yÅŸE¿øª×0bŠ6°ÙŽÓ¼ä²¦$êxŸ­Ð.í-É߃†^ÚÐÃï­îh`Í\äçÛòúº_Ô&4c÷ÅÙ‡nV0ß›¡­Ñg€[´/)àHÛ µpÍôG¦µ˜jØhÀ,‡~†6¦•Ü?j[Õ–¾™P3+[´9“¾§m†b •ð~‚6w‡únícÄäXÒ´ñ\Ï?‹6â®û_¾Á2zl94ØqÜ'x¡%m8‚øÇa{´Ñ©å:6I¢öMtJŠ]ìÑÙhsø­ÔYE¶e>®N*hx€ÎáhBÜñAt(äS#Ÿ‡&¾¿¿Fç…ZùpIàœ’®2þ§¢ ´¢^ø¹yùM§ÕIÇ:É¢·™ñ8!út”Aã ˆ”Z­îËÕp²ôvhc]|wÏúæQ­V«–öqéÞÍ=Rpð–#Åìð ¥N«VŒrèWÞOΑÝpóÈî'°nIÛ½›BˆžÔ˜ fÓÑòh7~.´1Åë*ÊF¤ˆ4£ïåÑ9|v */,÷ã ÙÇÞëu,à´Î¯ð ºP’¹ô†•ù@ù}.?Ú7ñ¯eû€ƒò fhý±êâ+Ÿ ¸Ðæù²’v?Òêtƒ¬,Æ;g×ë_@ðɉRvXšB§Ój4·$ºEn³%³¦½ÚÓ#¬[n4ÛÓ}èÌŸ¢M?8ÕNðd^ÑhµšëétD’Ò÷qÐîN5zÓÏÐ I•’{â-T„A/Êâ{­kêºKfŠÔPµ²Ò<ïúc¨~ëÜiRqszXzÝE£b ý›3ù¬ZhR>]9„FEw†6¯AóìŠ`©-S¦3/Ž.½•£{Ñ»ý;$Rê Êe±ŒŠCí ¼ŸFNvIt:]ǾBƒˆëmþ+È!ú¼nêÃÒø …Ê‹Îy=…ÚO…,Xp_„}‡¿¿»Í(òÂ¥›&çCWQâNX'Ù (I ¥PiܤÖ!ÌùBc5/y-vŽc~]þ •ÍÁW7³©dªà|çøÜÙÕ‹Éÿ·âêþÅ|qÓ€F ˆÊíxîFBÀ¢xœçÊ߉5`¢å7bˆÒ}þ%úüáEÜÀ¥èwînEÒ<¯…Ó–}yëJO·p’¿çÖžDÿ›Ú‚`÷´Šã胑wLÅ1Ó$³Q×P•Ã Qéœàƒ·ßaUP“„{Ñ&==]-HÁô6¯Jƒü7¡ŸlðóÝ},2FË«9¡48ŽŒHǪ˜oÿè%=c½^¿)ôL*p+²ŸýælE›Ì(êþÛ°ÎdòÃõ@:‰Æ ½Û¯ÊŽ¡{댟Ì÷&Ó /Œ‚o*~cWYЦÏÍ‹5¤C¦Ãšo³äÛŠ’é4*Ã/ì\[?Ú쎣%T*Í?2§G¤ÕXíîN;7 š´â…Dñí“èÎÖ/gÓ)T:#{Í~ ²½»W‘DÎÙƒUD`YÏ©Öå2Ëu:­v7€”I¥RÝ]c6׿¶ä³è$:wÛ•WØI×ð“P ™ÔôVT›Çª>Ý¡+‘ŸIýciVŒ3'· lÍÚ—Ú_b™³çQéí¾M sôÁ滚¬Ñçí.êØ7Ø.¤Â,[N_ÙN:ýÃþÚÞÞ±hþÁH¢í2ÉÇa‹Ô~}éí¨™ëUkQzÅ«ŽÖ¹®W?ªìnÙærÔ_˜>‡'?â*³Ù ˜ÎÉìÏñ2"²jÞ½xfM]Á_°ë±žpúÿHÿË£Ïk»9D¯üª-§íK2¢kî‚?ñž+k‹ƒÝ#sVž<}¢(3ŒW«ýß ÓlŒ! S–?uª|IQ°L‰‡Ç §¿Ž– Aí¿N:­Æ`ñð® pWêg[C›ÍƉYüOH¹˜ ¼7‚µ| ºÁ.„Ò§cq@l÷ôd]:s|…²çÉvpŠÉBFÙ@v!¾»]¹˜ï»ñþgÛ]H‚ë_Bõ_¬ucDv~Ó£ùN‡zPÒ-K][Ê¡>•™ÌÈ3èç2Ö¼õ­*´ è…mY±i»® V©¬÷/‹z ó¸;ÚqŒJg–{¤ƒ{nzr¬Zì•W†­Ãƒ”9<ϳij¦e%IËS’ 6Û q;—L÷ö x§-þu<šW·lμß@ KGû^"ä-»ðk¤Ù<ÑyûP¨šÎñóâ…æõ‰tÐéwùÚÂugÀ7 ^¤­ÕÈ€˜E/1Ü=jÈœ2.°œÅ(ÀHýѦ¸ùñ‘ê°azñV ‚1m É)ëŸÃ·…Ÿ¯ç-½<ùîJ\hPxLæã¯&d'jÛêèKö£%L¿¹˜"ˆJ½G91®‹bnkUZg³(MpæéWÐ(Ù³&_ F.ÊmTàTŠŸð­fE£j2<<üézª ¯ ç^@ög·”††â2Šº¾ëP£iøî–~´8-JwüIŸ“í±¬wM^’ $¢æÐmËÛp ";88tCc›¨­:¼à2”´2+äB;¶Z>ŒZx 6ý{rn{L¸0$£Š/>°ß-Ó®k§zg«Ë-ÚmÝÛü9´¹øƦ‘pßýªŸA?/mÈg,Ze'¯IÚK«Êˆ6Û>k­Ôþ\Zzm;-#Ï–&GóùÂÂÚ£ÐzùW ؾ¼72'S åXí³éÇ¿ˆ6»Ãþ‘G›ß ìÍ e¤Ãìñh;_¸YtoÖ˜þõ§}‰ßß;Lö C­ÅÄl¼_šn?@Bßtõö}yÌ$5¶OÝÛ¿$bñ6¬tù}š+o·&óö· ÷|h<ÝŸ+“)ÛîÁñÈ$Ýg}ãâRÎtÃï‹›ÝI‹t ¡Tè“Xmpd´çå‘Ë=²nà‡/{ßÝßÿ©Yàív¨Ud§*0|ä{‘^§úòÑ¡ûÚ¼½TÇŒÊø)Úô4U»¼Ý—;fë.†;ŽùÇï°‘~Ž6[â‚B¶Ã›[QÇwv¼ÞQi5áæQ÷ÁämÌægUQ¾kàøPGVùeo~†å†ÐÆ-^Ê’é®»ÛUÈU¦mÀrv ¶2ܳêø'gÊ¢9%©…^¤Ýƒ–_Ó/üÜH× _¦©Û€'éÆ‹/££#ë—QË¡B†žÕ‘©Ù°ÈîlŠMg7–\~¯Äq㯢MX@D6­šVêïŒ7F´y[åê*EùNÞëIñýŠÜzM$<…?:ÛÃ\ó®ˆQžè}ñ¸½gÜÐwÇ­AJ|\Ps¶?bÿQq³¯T+”s[aƺsÐÏŽõ»>|‚ë ‚ûέ .Ü®ío&qÖž¬Z”_w”w{y3®[‚Ì«JI*?lÛ‘7Û³é¨_þ¿s¿¥áT—‡Ãh *ó’C Jã·d¶z|¯0пÈRšI¯…­´1±¡«E¿Œ·‹B]´qì"síË¡nê@vbf°µ*’¾ôúÂÅ"fDE :Š6h³—é+<Ññ]›Ë^ûšGQýÄТ—·Ž&‡øü6o?jQeí®!7 ¼QÆ.º'·YyNÐF°¸¤ñ$Rå±#Êsݽx¦àé꺹‡™1‹AŒëx ²Çg£ 2Æp.õögxV&žžôæ§Y%)m ÀpË~‚ªéOïm¢Vn<6òhÃÚâ4wJø¨ bM0oÿ3ÅŸàe %qÞï,ÙŽÙé\ÍflìÀ8ß0Àv¡Þ–‚Úî=$*IgO±ùgІÓO%)Aá«6&ÜãËS¶hSéâ·ÎβúBkŸS©y¾KÝ=÷öÛ>ô§¶„í¾åÚ×GùÑîvÁA$¿¾¹ž(d- òŠkv´¼ƒ%%ãÇS„èÕÐ4f3}&F‹5¬÷­Š\ÛØ=ÔqœÆd†`êˤlU=^ß1ÌžlÞµÊoéFÛŽZ’¸Ý>š¡ùÛ•öQ5ïˉX´éoÝÃKD<*˜F×äĺº’òKÎßjCµÄ´™ sñ¼ô “‰T-Å.Á[œö‡‚¼“ÖÚ o8n”·ÐúR| ¹²;õX3lцÁ Þ„ÐÆârdçw½åJ´´¹˜jEëÎEòüáµu+]ÝÞÃþ†¿E9öAœ Mprþ–Í›6m®_Îc®YÎæFöžÙkYI]H[°ü¾ÜéÞF×sˆî;ÚÜÚÒÒÒö¨‰íN>:€´Î‚6ÐÝ©Œ¤-ОçÏ¡MøâUõP#ë·$pxÑkU–^çûͯ¿9iïzñÇÇLÈÞfÈò±9ü‡°²y̪pË£¸V¿›A³³)Ƴþ´É»laྫۉÚ8ÚñžH ÛŽ:µSæ’Ýj?˜üI¾¿ºŠ·è€Yò„NŽ†ý5ÍpîÄŃë|Hn·aÅüúÄ}ßXh+PåûpHšÇ!¶HÁÑWç˜AqN´Ä¸v´¦Û[Wð‹¶Ø>?Wœ¶ñ¼=çuûº“ÞZ¾„ow ÐæÂr ü©­FÐøònc¢),½ ΠÍ÷Xw÷FÌ;®Yt%Ï…¿tÒ#±òÙ cm“V'ñj›Þ~¼´É/q¥5Ñ™$eFdRQC‡U|X)ô/hzc³¢Œµ ±±Á9=¥4Øq~v4}×µº®ëä°ðghƒJRˆÆl”C¥<VbM˜|æéÎ~,³9·†þ7ÕNðàw ksS1Ø~„+(°Ap}Ø‚å'QÉßTÁs ÙA¥cîõ6U§­Þßf»¤w×z§ìØE®¼%¶¢ƒS½ ¼*ß7º¹óàXÖÈš¡£YnÔÌ1Ë)ºd¤ƒFg¼BΣóy –íi5Ï NÇp<;$OŽ®J*¿a¿Íÿ‘ÞÖó4fzQÒ%Xø`ðÒjžŽX…Õj4¨ëóx‘¹ M@¡œùCŒið’›ÚÂèeƒt€1 Ó[lè@ÍèKoO ÉÉ3{˜>O¥«üÄ¿ ·?{㨜B ",ªßœ$¸“ö¶M°À¼º‡[Ò<|²E?ÖwÍ„ ys¡ž{÷îBÌ~ŒóG›ÝˆCðnm/‰š§™›iµj•Õ½N–møgìx‰5Õ%¾LrÅ©6ð‡h3¤S”~¶F â/L ™–Î!‚>£g8 ~C €O"ÌRgOA ‹ë¿ª¬"/1˜Fæô#Ñ¡ß_ÝáM¦Ôt"Å«žpÉäœ=7±óâÓK°´dMf„?Û«‡ïÛh¾ÛSX9++óã ä¨#òy öŠ9ˆOÕdòßàüœd*µ«æìûµ©Þ$nñÚê耀3Ç’´™P¾½DÎE»1Ò´‚B&§/]]²4L¢×=“Ûj‰{ïíñ¦°—Vg„'ó\ù[f÷áåA—GFW›éK$úfhl’æÐÃt¡.!(¡Øúsï’HÎñòcÑ€Ussó‘f…ÎðY˜”-äB㼨öÕS㹿üŽehJ bço·èc5»² ‘§³yA¾,:@ÏÆεǮ¯dôÀ :R°í,™6&1ª vè¦-ç²®N‚z´a DøKZb×ø ƪ[˜ªw¨õ‰ Ðé@`P@Hœ¤Å„Xoà ‰ƒ)Ö—Í QèûÚЦiã8¼¸ìõ•+|IÄü}0烊š˜”Ô1nÚë„i E>¿—]Ç79õò‰J*Stj$~½\…nXuj©T-¥Hª²|­b±Äh6HÄ2“%"¢UÕH%±DªE\B¡/ÔPšÄ„èKÑ+YJ¹ U½fM-” ÃÎqM2‰X­5Xí†5J¹ mo@´Œ&ô¹ªK¢Ñ£hVIÅ2µcKƒ^|ÑrÔ ¨^‰Joþ|$ È…_ä2(;T¹Z&ŸY†•‰iÑF©'Çà|+`T‰†'Ä .Ñã„ÓŸ¢‰Çž¬xC¢³8Mú±6†'É7 :9: Ï¿Á.Òvž-¡29©9‹ý8Laé¹$^¨aù®Û°!>€ëÉ_:°0kE呃±ù匥±QÒÃ!Ù~©qÁ…°ãv·˜cÞ›@òòhû…“I³õ,íO’IóO¥±¸¡i ¡•¸êÈ ‡B ‚Ýu*pöÁ §}²íå\ç¾´œ¡Í¾Å´¤*Ì7ÎðÉL×  ðæbú¹! Û•ν9M4 Þ_@‹°º}².·ö\çùjÇĪS°]sujD^Ù¥k×v®Y½ 1Z·ŽhcK5©~…QC-óɼÀ²ë0FÅXÐƨSŸtôü©ì'i+¯cæyëS|–íÁ¢é½Ú›HK=‚Š²KS/â5F+æÐ×ß5°[‚±Q…Îq—t°(,± ÙiÔ[n=9U–±ç*œprJ÷ë’Ó5Ýìþj±kAÐÚÔñä¶<ì<¦ÿž º·q"‰)Ögû'•ž@ fZN”‡Û¬¸Žº nYã‹3Ž‰¥Ç!`¸¾«,2iÅî½{kŠSóVmžÒZ¥'hƒ<0ì\ž»µ››xq„ŽF¾6YÑÆ9)û½HìnZÌdÁeãå6,èý½4Ï of°¡,>o3ló%é9Cg¥hLÎOÌW.ä-\+svº:Þrœ™‰3N89ÑÚ ëåݽÆÕËs\27¶hDn¶ Zï%-“üñG.TG´íFäýY\×üMW­:Ÿ×·$¯¶¾piurÌ–+]Wf%Ö_’¶÷ä§[K«Í¶ú,uD¸¡ºÉåÁî)§±ƒ+íP‘Üøº÷ÇŸ»ß…ÑÜŸ~—èçD²¯%>ì@°1}y©%èýêÒUeßu êù!w~!ôøR=íÌW'¸j–UE“# ÷éæ¸È!}yœŠóN89ƒ“R1sŒR&(9Ò N`’TC,uô3*=ˆ_œwcD«@{‘B7‘ÎXP~¾œ¹f *?\õôM0Y$¬¢…ÜW?jf'^ëzwi 7aº¡&FmnrŠ6ˆ_é2Ö ®˜±Ì׶¨¸„…%$,d´ð¨ÈC¿Ù!©ÚX£QkÓóÐ8à¨Î 6ŠA¼g’½®dî¸ tŒE`ÒT ¼’·4ƒÎMµž¢„gàl…NNÈ4*X@:öA¢Ñjµ:]~4wÛ•wV´‘>-'{ $Z½Q½)ËŸÌŽFõ6Ÿo7žh†cÄŸ©‰H(:£Sc¤Ri†~m°g|Ý(eøÞ’gÈÁy¢qø‘ÁçRŸ®\5Á%i‚.H-_Î6<ÖiÔZ=œ¿õ`Rà¢=š™ºÔF;4™‘¤Ôßû÷9mt²·±¢ xn}ŽJ‰Æ ×jU7Ö½“O¢…ÝÚ“Á_Tæ+\iÝ…C»ßŒÃÙz/ç1µ µµ p ª©C‡Ž(õØE¤ççjù©•8[á„“SÒŠV¥EÐ âðwß|'YϤÌæG‡Ê™4ŠohÆç¾çîžÁ$ñ\Fs5$:é—°PàñyºrúP9Æ ß·:J O/SXV¸³Dåäç¥ ¨rvpü­ˆ;JMËÕ zôrÖîPæJ®]]^®ÌWvW‚LÞ¿=CϤ>ÝñæðϤ”}nÖˆ~fKÒÑ´ÙA¦ÑE[/jM˜ßpÍ—›.®ž+[–ÝŠ,Žø<‡ø-ØbÓ‚ð@j¦ßÑ`ÒâŠg5ÿ`~Å'œœ*nfkr~»ÎüÓ°n¶íí¤ '‰?¨ý'ÍŠœ ¦ÿ¥*1;Õ*ý¤fûzçn€a¥ŸŸ uð9vÛ;íá„Óÿ3dT‹Ûßý‡B]™ êgÃhMëÒ6ÞìÇ768á„Ó¿•4CÏŽ^{âXƒN8á„N8á„N8á„N8á„N8á„N8á„N8á„N8áô¿Bÿî˜äÎ endstream endobj 646 0 obj << /Length 1305 /Filter /FlateDecode >> stream xÚ­WKsÛ6¾ëWÀ§R3  úØÄq“™vRK=¹š EA§©ðGÿ¾ ,(Sºq’h&X/ß>± 0²&ŒÜ~nÞ Eš¨P‘ÙŠÄ!‰¥¦2d¶$Á´«ó,mÓñ$ŒuðWcj¤î»|iÆ΂kd<˜Â¤Á? )ÏgFw³ÑçeŒp—4f1ɶ£Ç9#Kà ŒŠD“''µ%RiX 2ý9bÞÐÏ£P !ç4Ž,˜bš†‘źy¿ÈÛ v KɱKQ*¸F—fkeÄ‚Ú,¯‘ZTÅr²ƒ7if–ÈÛ¥u‹TÞàÚö—¦ió2móª¤ÎKF9èb4TÂ:£8©Áî3æÃ=†H¢(´Æ12‚jåÃýq,YPÙƒºƒù7‹XSuõx™™¤åù+&»~càûÈô…Œ‰|,Æ" êt5#ÐàPÀ‚¬Ú«]ò /‘…jXWý§ªk‘Õnêª[o ¦´ OSÁÛÜ!¯LmÊvð·mRëÒ—1ƒœåeùIÙm¦FÔØ'Ä›Í>Z×½+Øc,ä×t»+Œ…uÚ…\¡Ó6ŸÒ¨®O›)¥@¢—q9·ª±”Sc «~Š¤‹Ž%~ŸþÄ6ýÇÖ“ñ8]ãqªÕ)‡ìƒg ¤ßTÛmUûÝSÈ~vfÇS^H-ü·Æ´Gþú$§ÖÆ‚Oii³ÿ´IÅ!Ž¹ÿ⡘‡‚5/¡DgJwãÁb_Ð* vuÕVYUÐ<¿é­ek™(À@Õæc¬¡p{äÔ‹ÔÅjëí8ÖŶ35Ôz¹öJöMk¶ô’»S(Þ6ÇŽ“ oñ¸äþï]Õ4ù¢0øW[áj‹¿hM}Ódµ1%n©J/´ñÒ½k–~ï… èh‚cu¹¯:$²ÔKö%ì®ñ„­¾3Yž5_—(õë“) Û¯´ ŠÜ#]pœÕù¢oc颲I?œ2Ëò}íºcËAÚÔ«„/=þ­o%ög;šûA;êêJSÅ‘qD9/vöšºû†æ!‘¡¦‰ˆ^Â`DFÐÍÁ‰ýmH€m眚„2·j,_Æ‚&±îkCV‘û–zºº‘£B JI?r¤R”kŽ9¹‚#BÕš¯™ÙÙ†}Sšµë܇ 2È`‚Ò·^ÎÃÚ\xœCÆ”=˜2KÚB¶+™A*ƒ\# .Û iÇšß²0Ee ·¯ ”y}Iݵ·§1°ù`õŽX(‘ýY>/6€ˆa’¾¢ØŽ²uzAà¯bý½ÃÑñªâgœJ¡¨øEÒXë—ÃÃÝ,â?Rü5Ãâ÷À?§øEÒˆûqû¨Ù5™æ=ÎÝÈfîrƒCÂñŸ%quswô7›³Ã ÙíUjúàNû°ªíXA¾ÜÝÀû`ÎB顇ÀïhVàÏÍ KlòõnhþÔ=ßbþKÝ•µ-î•Ü}1õþy¯?°Ý!N/Eƒ3v}•$Ãc0`牦$Á:WÑ-ÍòL¯îƒu É»z ¯å|~Ñ0 ÿܾ¿¼þ œW iýÓú‡`Ô©£þ£ÔMwoóÓÕ]©íÆÅ6ñ´íjßpœËÃ×Nbß8 ƒÇŠ²XùçŽÂçÎóiðÈŠ$<:¾ùuñ(á=ÉùÃ¥K¨€ðë8†}Žûf“îÚþ9(í6 Ož‹]·°ákœûÈ/u! endstream endobj 635 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 149 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 36426 /Filter /FlateDecode >> stream xÚì½|TÉ•/<Þýü¼þÞîûÞ¾·»Þ`{ìµ=à PnuR+çœsB„"ED B䜕@Bå€rÎ9v·:wßï¦nu·Z‚afì»ÏO?¸}oݺNýëœS§N€ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠTô"±XñBE*úA9®+ÇÀ=ã{b^ñg³.ü.;/%ÚÞÎÁÑÑioÚ5ä~n®˜¼RÙt·w{n¿÷ýýÃÎËLrqrtpòL¾ø„/)À\ÏcG'çgcÙ¯Œ5ݵwt©\†dÇ„_’%{Û1¦p½>H5wŽf …¨çÂ΀+UàEí“SöNN²YÙ[›½è?Kó@~:A„>‰9ýèÇ3+Àv[àWÿ üë#è}'5à÷¿—ûûõ¿m<à7ð›ÿ2ÛááÐüø<ðôðÛß+¾òïÿ€ýs ¿&«_WFÖ(ð›/WoþîKÀÈA9‹…€Ú€/ÿxÙ‡~…5üúKÀâ¦\á}þüþwáÈêþ»À¯~ E|RÝ{o¿ú ðÝUj:üÛ¿W»Ùàß«Xl¬0ü ørM5ý@ ûêÞB·£ûŠðûŸÆ[»ûÇb–·£Uß"ðèxœƒ“ü(°±ø°œŽq]˺éÏê¿kÕZ3¿2ˆSœî>w²Ë°Äv~nIö9bÃO>+Ê=ä{òMNŒµÓ1:N…ºúŸy.ÛÙ†9õ£L5?¡ãuBŽ^©©ol¨{Ÿ¹ÛN›dRÒ !ÌtÛu‰Nò»%[“=*R¼ ¯ÓýÝe··6K©©©™»~ÿ^ ÒÕÓ 9öDŠ7í©.–' $|s】kX{‹LVsl`v¨­ þ•áD6ß¿µúFÏÈÌŸIb‘F%ô§Ÿ_|tMêÐÅŸv@7Iÿºþ﯀?üýûíí,°¥üøůÑLƒáWN¿ŠÏ_‚ÉþüóÐÿø-ôÊþ2AôAw¾üƒLVÿ܃Ð}ðïw¿ƒþþï/Пu|@,þñï¡ëÿeˆ~ˆ9ýÔ<¿Z5N3šþ‹ŸZîËÐo(‘Î÷7³3º§×Î%§f<*û°*ÏÀô*;ÑCŠOÍx<ȶ”?9‘‘váú3D˜©É=õx¨¿úYzjò¹ÜÇ ùwAI¶‰>£ðLØi@Ä<™u‰%ØmÀ!àW‹Îk–dO“±{a´¹F1ÙK&ǘȼ Š;ËmD‚m‚.z³]õMJ;E×"•Ï£%—Es¿øõ_Ýö¦Øf5­×üÙÞkN§¥¿þ¤¹Éï{šz£‘9Úp*=ùÄ™+,°øâæ›'³^ I_ì+¿˜u§Eižüå6º­ï…»hljײìJ4jM—€ç\€ö¯À°´ùŸÊ+QyzE?àÖ÷𹧗5¡§oÇVï@hó÷ÀÜš|P´Q_½s7†»(mþáï Ÿi¯ ®Q@nÀ‰o䟛Eo~Úüâý=°ßQ@› ®ûî +fK”ö£piä楳éé¹^"8&y™|¥’7×q&#ùø©K]KàÍå¬ÌÔ &Ì8?•züÜ¢H.«æ'M¼Ž"¹^:w|’ÁxxédÊñÓo»æ1#ïlzZæùÞe2™,4dŸ>žžqüÁË:i_¿~=--ãá›Náð‹ã¹Õà­ÞÒ{'îBÜ5×þoœˆydma—äv0wÖ=k­å{oâ»àÛDC®¦®QÞãÂ'×OÛl5†FÊësvt—¸=é—V‚<3nOÔÞr©¤´(u·§žu´®Z€#ÅÊÂ;'¿ª±ªÐª•X4%›ípõ‚åÖ›÷ÝK‚£ž†î;o?|œ¹Ïk¾ lš‘^«À=™7š[G8Ò}Sä ÅõÒW?rû}ã‹3;ÌKï‚hx¡H6]®§‚6‹•—¾!{ódgphè6Q6i=™Ð†j{Ò‰–þfyXÿ€[tn°NŠ6¡9ekd¿Ø‹oZîÅÒb‘„²hc¸~V¡ Àë ©«'ž½^ÿ$>ÀÒxûaD‰:f‘ ™ Únß…§û‚ …=ut=PŽb†aÕ/ô(仜ñÖôý»1º”ý§ot/¯©Z7,xà€ û€ç2Ê£R´‘jOn¿þîgÀ—°`œÕ4ç`i§´Omf×d…¢Íx¸Á94^ƒEPmHÀÿøû?AÖ¢Á/€ú ì|èþoc>mܳàT‚6¿ ¬iÉÅC3(ÁñçÊÆ倅–ÚžÌÜ‚üg‡w8¼ÏÀ·:kzEì9R×ÚöøB¬Ζ'¶Yëg–v#/Ô\§ZøËwŽ`ŸþæŒz!rËÖŒìé¾ýéÛæ’¼cZdÓ¤¿²º–¢K‘jzA`p{žëêÒ/ÜzRøüÁ^/šsæ[ð•üãAsßùEçìÚã¨çq̨!/Å÷ÈmèCBþ"ƒÖhiq  Úx½¾ë~w´ÉvÞê‘=ŒäZ—¹íãðºü‚“™Ó^¤iÛNxiù^B¡’?£¯C,œƒFh€%áÎ;¤õÇߧQi¡rš·‡²•Ö>-ÒI:s¸Ø¬ãQ{jÀèc<Á›#Fòl&~E¬áÉÕo¹í…«­™®–¦¡ãŽGå !‚6nºzmYÂ`´i¼yŒàµwMå¸;H_+cAhc/èÍÒ49ʇì7×y<#\E'="‰B^%ŠçUѲMœß¾óशBÆ©˜“—mb‰Ù¬0æ üO”mV¦›ÛF DBc¨k`"¨ù€º†ã,*VتgŠÈ.F˜ç-Ð%»»HÃÈkcùô㬶Ædó࣊&†‰Jòà°a­jRÜüéOèŸV˜ P  é )ë¢ÍÀï¿ZÍj“¹Œló{ ¢¨¨ŠøЧK(Úüáð,ºã|X‘A°+ÐOr$T;¬ÔÌÂÓàg ÍÎÀëß¡‹†YàýMêO’bÿñK YF^mÄœ¹æƒP‹‹Dœ…>"‰¸"K× µ-V£H?²Ætq´®hþiÄVë4¤{îî&çÊMËÕZ[-Æ%¿ìÌÉ9ÕCpoNZmVG-gÓ»¥ih¿sŒæŸ ·æ–WÀïS7åÖ±át¢TKœžç]±‚eU†ò‚õˆDYÖÅ9œ~Ÿ² 3PG3³ ý.¿. ѤÊ/ØÛE ÍxÚÇÎ7§\:~c(ºÑï n pÀ_«EîÎ÷õMx"±´aÕtÉ“\9»Áè#œÛ5Ép^ôÒúæâ€#ó@Ù%Û¨“ÎæÆ:zžL!"Û+•mÚï¦ê¹D­©+ûuz5AðsŽZU#<`ð©–UXÄ@YÙæJù·’m`´–K dƒeX^¶IúÙJ#¸“†Åà¨QÈt3„6ûÕŒŽ¢ÎèTÇOÀ™U$¹™z ^”d‡y'ÈJæÒÌ,D K+²_à¬,¿¾‘Œ#ÚM­Å"ÁbüïA1„‰ ÍÏ€ÿü5ð_ÿ…þ}鳚þ^8<ÁÄÿ0äÛj=´ù÷ÿ\Íê?(2hóðóŸ?‡ã‹_yuÐ'´ù#lþÅþøâ“cr²Íèç•`lx«T>|¦l³½Ôbà¯ã€ê9´ùâÈ”ù_€øgGxh??·«ƒ…û‘J"‘ç¹"m¾¦ÄО˜;¹ ö*Ë¿¹tXM³iQ·ýþ&j ô§)¡¨™jæì6é•0ÑQkßÚ0¶ØÄvs*£~àTÛÈ <õ™¨i¿]F9cè–‡,Ú¬%X¶¹ñCÊ6Ì@mÍŒdý`WûšiRåçíí£ ‘Yþöž—^KØŒMÒÝS̈́цW>‚ðÞ\Ï ’¾©r´Y©'cã”IÐÆU*<̹il¾<$5"8Y'j·áÚSH¯FWNo[×n#èºÿ–Õ dÃÅ*ÑÞD©ãÚ€]›¿Ç1ôzM~zhäPÎ\‘E›og·AÑRžì$ŽnOwýîv›ªC®ZÎèL·2R‡Õ—¢Í‘5h#”Íuk7Q·œ%æO…ã¡©‰à”¶'chŸ»GØw¾@HÁë…q^ª³€‡L –%^dX“(+èÜ{Ø~»xÍ€kr*ÆzšÔ¨`»Íô'õŸ¡ŸU°˜+‹6Í9ÐýßPäÐFûç«òò÷«íŸ6 ×…®­ä5)Òºæõõe›¦3;4lâ‘.ã/ ¥hC]‹6@v¸Ûîì’±Ò‹–Çòa7ÝV3 ‘E›âÐ.¨ˆ[ñð¢!™¤ lÄTM§r ­Áà ·¢Ím·¹ì¬îrºa–‚$5“´ÈÜât Çì1¼.ù¶Û8Q#®¢¶ŽþÂ(šQô:šˈ‚©[AVZ# HWG ´ÁãY"8ÏÅ íoèm2¯Î?ÑpHP+ñ æÛPˆUœ Ф47‡à“²xœºÝÊ>ê4b%†Ð¼¹\J0ßfB©t‰ïŽ6P£‰¸³D"ñî¡ïÁJ|Ò×.äZ%ºÈõ(ŠDßm Š÷18}<…à³H&dXè™úTvMð"%2[ÍAhÔø]³§\ ØúY9µ‘•Ø䟀/~ŒÂùüæaˆ˜[Ív=´™ÖEÄ4ù úù/ŠhqÛïPHAÐfù1tm Šqƒ0–/a½o@ˆ¢šÏºö–õÐàÿôsHuÚØn#Íh}´É‹öõÊ|ˆÚE_'’6D`ø¦†IÂùhZF-G±”£ù_ãÜÙŸ‚6³ÀDgemÏ šÁÊ{¢–(rQ6åÖ"š?É裚ÔŽ6S-w41Ô¸”ÓÉ1þq^[éqb9´”L?¼Û®¤›×/ÙÒ·g‹Q+1ÙÇÁ5lÿéœÓG ô0ZYòÏ:oQw>vþÕdCvÖÀúPú‰po šC "Ûœâ|"¯]¿hK± ¿ ß›‚H[²±ïîí^¾û<ÍôÜÓAÅwãp!sd‡¹Ž¾…Càöððí¶&D#ßÃK°Ådm@IÀ]_J²hãdàì³w E¿Ÿ`|mP³UÁ><ž`{ µÛŒ-岊Ž¼YúáSÐf6?Nƒ`z6ïöÁp÷ð´Ûº¤y÷¸ ”¢ ´´WpH[GkÿÍî Ö·EÆÀØÌz †¾hôhàüóÿþ¿….þùªÝæ—ÿ/ðË_Jþþp±¸ Ý78Š^–ú•ÕÇ5©ø¥\Væ1KmJ´€ÈråЪê{9´ &A×—úV+þÊF‰b 'µ·H¿õdW~L¶™º8ýʪ&õ…L™ |ñÎÇe›¥ŠŒ­zæ•[)1þ~Géb É®±ÛN*GØëJĘ„ {ü5nµY¯”‰ÞßmFJÏnÁÐãSÏæ\<íigàœIùiX§sW¯Ç:?jRÕçb­÷^V&ÛSm\öɳîËŽ‰ï m`ö›êª/,,({ÿ`=/®‡ßTOEEÃø*‹ uoJ_ä¼kꑾà€¿÷~¼³¦ìE~a}×ØZf^i*,,lLÃõEù¯Þ6°%v¬Ï£ùá…àÍÊ®ü»ð5·µömNj¤û»oëPÁ§³¦ò]רlá{Þ–VôÎËN9=-µÅEE…E¥M#Ò"qû_¾jB–¾Gš«[úgL«Î/œàÁë×ïÞ)Ráðòº}Mï»'dE‰²’¢òÎIÙZ ³*hê–ö‘x°ª¸¼{~=[noÓÛ/^T€”ÂþÚ×eü¹–g¥$–µ¥¥l©”¨§f1¸…éS\4`;P^$y;/E’Y|¸~]þïÐ7¼¸\½ «c£ð{ ãJÖ¸^@)'e°ºá¡’¬JêÈ»ä=¤5âNWò€›7¡ëÛ7€'­«™”Â/¾€Wp^Ü®\xrrp=(lXý@î5ùoåÝSÊë¾Ô\ÉjdÖæï^®å‹gfM>×Ü[€Ôl:ü ¸–tŒ)íÇáÕù/^¼mì…›+ò_”r:Ÿ¾lI$΂— ¢·Žø‡¦>UZÀûIfþ)èZLù«¢ñ%¤‘¹åÏ &еQYÑóy”`q´ãUQ~~Aáû–^)ów×Uäç6õÏM>òÆøBv§©¶š¢÷J\áú›ß¯eÝž©ei½ºÊò«†~'ƈ6·ÞN~Þ»ÝÆûÁGGÂÀÛ[ÇŠæýeû¥È|7ÑÕ+õñ÷–ïl70Ìþ*‰ÕDíbcåþöDýì¿|?.·˜bˆÕ‹JfHr®Ââ-ŸËtO.<û55µÅo2òí@/K­ëo>S¬¾ïªézGü r×_ph‹z®+P ï,ï/Þø¢¡–dMCÛã|¥ú‘Š~”ê¡…!f•ÝFE*ú~d›±'Úꦸ¨êô6š† z¢0—s§ŠHXÒ,WÖ$£ laUÖÒÅÛ»¸8999;;Qñx‡‹ˆï4Š6 –&h;Ÿ6~†XIŸD8[‡Æ>8boF14±¥¥Õ‰vÁ*Ú€¢ÔaKÏebö H™—™\£I!·» Ïâm|A@ ã+¥QÁ˜oÒ:Th£"}Ïv›ûÇ‚ÍB£bÌØ]¢®^îkuåúé2Î÷xõè\Rië‚nZzû ãa–xgUùZ}JÄ™/ dÐÚõÃ&UO8‘·~KÙ†”ñ s¾é&ÙÙød‡¥õ©r´xâÕµo)Ú,5?ÅXù-¶ž&¬Ý@!c·ABµ½ØBtdCûå .×{$æœaÓMºgUh£"}Ÿh®I]µØãH¬È3>4Ùáu/Ë•w%Ñ'ŽÃ{ZÏnw¡úB¸4×tGl8ÞujiÔΠÂPŸcJ!>ƒ6T®Ê6ŽÍ¿§õIzJÐFÓ@ូݲW] 4´ ‡ŸÝÃi’š`nâ=ÉÈn^m Ø»):NÆ´‚éµ\ ´ÉèB?%ÔÔÕµòá4kG.ZîÅXAÀÕz « 7*Rѧ¢Í(ö›ÿn]E›©Ö SžL¸ÌÁ×YÔ0"èÃo,¾æjJüFm‹º6qoÚµ‰e*Kðç³â|Õ7mÒ¡9¶‚z‡øõ^£o\³å£¸öñ×öç ]ã?¨ÒÝæXe¸é¿{¯ e¹HKmËV)©mòÈ»ëø•-¦r»ýÖŒÇpì?k¯Á×öÇ*ÀŒúßÝ·£ã±8¬¾•÷«ŽiäãÔÍêѬ; “ìDÀÚ…í§¯¿Ùª¡¡ ‘††aOúõ96* 5å_0¥ð8œÓ¶C <0W!wÚ‘¬®¡Ih›¨øHE*úɺ+¿±Æ·W™/ñšÌ€õ|`Ýz•xù*õ%Þ¨ìr…Zã#ïK ]´ð8Ó¦tãíz_Qæo#VøŒŠT¤"Ii¬·éÑ¥ƒšW†ª-T¤"ýT|=%:þXKµZE*R‘ŠT¤¢¿6RfKY»·Z¼Á‹Ê®ÿl¤ë¥UjÈ6,˜äBñ¹äÊÌ5kLUß%zŒBÁ×D¬;Êüä¥=ð){ð?7Ò}®¢Ÿ6Ô_Õ74û°²jð\¨¾CóŽ/&žQŸ¬÷â6wý{ïÖ ÷:øXƒ¾]ôIßç„hæµò€áG ÒQ2Ð7ôLåÊp,pÇbC=覶Ùð¡çbeÖà·ÉÎ^çk•rª¦Y—¬k3°`¯­ƒ£ÝAÉngºXÐ<ÃJ{dp Øf&F–Ç*¿Ó(²¬h­3èÖ±¶âó6¾‰gʈn0µ²nÛ”_=@'áS.<ÄÐœY^Öª<#ZÚîÒ4/ ¯hÉ“ˆ}Šœ’¶ÚðÛÉ_jP¤‚rë«zý=r%J6Ç­]·¡Ÿ/ï[g2]r§¹,~‚–šêm–ðn£oré®ÇÞ‚¶&f‘tÞ?}®@þ ᡽!4Á?lÇÕ›· hƒuoäî=ñGÞö̃Ír-.:_²áüfjÄåG ˆPWq|ovÓBó̘K¥Òß8‘”zaŽæÆ®>–uöFtvJYž«½¥‰µ{Ì¡ãHžs2£""bdtLó \`´ã.\LŽ‹ˆŽ{Þ0"‹6àÅÙäèò6H8\¬:•uë¥mâsš›ŸdŸKÎz -ÕxSÑþ½Ñ{÷—|˜$Þ ¬Ñ¦ÃqÑÑqÉÝ + h³2ÔàïJÖ· ßÅ+ÂÊJN ß‘vé¡`]…ž¦xÃR“vïÞ}øDî”P’’Ñ{æH\xxÔ¥'(3OT¤'\ï-¾’q¶øL춲A!rÄ•XÄKˆÝÓ5 mõª}‘–yßÁòÎE¤ÌÂÞ;R †ëïïˆ?Þy•uèÉ R6D›KtëC±XŒÙ(|ÄœmÆyc¼ ½áIÆÄž¿_QVëJðJ+—  8BE—Âmœ“nÊÁ{ÿý¯ˆ¶À_&‰în»*šºzZJ¬µ·\ý PØ”´>Ú0ƒô¾Iª€6Oöœ¶Õ4=.T&O˪Zó=%º½†6’mØ»éj^ Gø 3¤¯Ív`H´%xöY”†ãñušmÉ…ä¸ø “ž¨9S̓Oxg±!%ŽÉdÅ븓¹ãÄ3…Ô}¥&ZÚ·ª>ŒvTHe›ûœ }ãÊÞÕ¾)¼i¢­•ÓÄé̲5NF†;}ªõ6xG‰mƒ'5ÌrësSvŸCNâã¤{Ñbμ«­}–{C´ëeœþW ý~QùûªŠÓ‘–ú‘÷ŒÙô=Nž;O´wö:d‚ Æ5þì›wÕE·Òu´Í{„ˆlCr±p»_XöêùUC « ,Y´ rÀÝx3Åé)ÒÕ3~P\ñ¾ªüd¸¹á^H?½×ÔÜ& 9÷ieyQˆ!Æ7ÚÌÛpçÖÈõEyõÛ’GvìFX~æ´˜hi¦Ü,®}Wv À†H’C!‡ùâòN}ÓȦæ6€×m†ÑæΉÐAŸ£ÏýHv»_¸óªqúìÇ]'òQ!}òAÏrQT_‰Ç›ûV¼¯,¾g¥£yµ >ò¸ó„ÝcOLÊ«Ê:ð×Ë#a Tò1´9öUN˜µÓ±|YÙFŠ6}y{t|#]*`vŸÎºÁ‡Ñæní\aF IØIEARmHDÒ(z f¯Aø©úõdwMÌž»U0U¾)ËØíŒµØ wªø¡ÅðÀÇ­(­¶™¸_DK²ÚˆöTëîOÝ-_éÒ,ãR/T4öK«)ׇîuÎcÉ»µdH(kËžêjª©­mn*³Æ[¾nj®­­iìœÚP†ž°P×z·¤à¸ž~ÂBC»†jTïQ´/µ[§[Pw7ÜÌi¿`¦O …vUšGúEªã ÔÒD¢!“¿j„Yj+Ô4t”f}$Øâèíú±W—ñvÁ’H<Âe&4kßMõ IBÑè`?,:B½wÀøOÉUD<1§ t'ÍÏ#úü´™,8Gp ã®æ }ätŒiÀ~ôhé…ü@M[È¥<ØpóµFIømÇ1Ô}àÖ¬]˜äHVÇúdˆ§J“ ¬šTÝQg½í7ÑÖLh^Ì­Ó¢q=\ÝÊ ³‹Ð uádÓ‰)IЪ§f2²z~ ‘ì‡H e§·Z¢gÊ¿ŒÒ·:Þ VÇK_íI'ê+¾\ o˜ýè>­¦fÜÈnÅS¹U|ÚÀÇfÛâ¶<ïd-®A›[±ÎÉ7×Ømˆñ»¾Òu™YÛÂòhÓ¶€òàåD“]™Uë¢ÆÊÃ?¤À@#.(éšDH—ì v)¯²7KZ&5¢·6´ÛH <Ðü&=6”Ž×‰¼ £™hÆ^S'åíààÀÀÀÐXB€MØ)¹Ó9 „ùú…ôÑ'Ñ|üý|CŸoÌ^ÔM:?q×æ´Y©!éÆ8èѵo¯‘­=Ñ ¤7Êîíó8órüj¸Á­1`¶é4Åóš¬õ¹³ô"Žªï¥Å5õ.Øν¬1š[}“^Õ¶sa;ˆm }¦«ä2UghljfnFÅj)g°&ÕÅà#Íý.÷=$q Ú€:õâ~O+]MußÝûËê:=/²vVe¸¶Õiã,t´í½Ðrùz;a´ió|àfŒ¿Kê‰]za]´€ 7«ÀëҾܽdí½ïÙ멲wl§`¶š¸„ÞÊ; UIÁ8z!_ðÂoÕÎÑ&€àš+B9jÁCKãé˜vÞKúÀÙ°ÇDWÇQRfoO,Ö˜%€ÐækR$O"ßmÀ¿¾{4ìÌÖßS@›‡IÁ¶‡òLaNú~ÉgœÂ²‡ýzh“¢Í»ÚmÀ¬zîØb¼ƒ-…¥²(]-hÏèj´@ñÂ`/[ ·¸SO³=*9V’WCÚ„«aJ6@HÒg¨«Þ<NàB.—' \üªÃ›°! z0öþ¶IßÂ%K S-bÀ’à§iR0Ó7ßûÀýL´a7Rtq#¨lô½É¡Øx59dNÍdm³Å½êïñ=Ñür7iÝŠl^=å—iöAÊן ùÕ}g ºžÿeYÙ†Ïè& = 4Õ!Ó¯¥hÓ¹Œ†{“³ßxûehƒRcÉ]GslPÞ:h3n±U½rÍzÛí}ŽÇn¡ê'gv´9ëmí•ûVRv8^;¾ž½žÝ µ#vVÅ9èѹ€8Ž©V4ÀChã~]ÊLÒÝ—,õæ“ ¼`4ÙªÙÀ]Ó– ÚPö¨¶ÿŽl÷Nœ)2|Á9LmfŸÜd´‰~µ2YA"™±V­ÄÓ>˜-ûžMËõîwC¤$ÇüˆÁJ§0KCâö‹o¤\Ä™iÄɯ'åجö²£éögÒrì¶ÑŽ»øVòŠ¸êˆ†~:Ëý¤͇!ž×Â7™B#èj°žÛÑÙ<£Ì·dL­± È£Œf´Æá‡á¢÷ÍËI¥kZŸ Is*æM?…ýåi'[ÿ‹àÅôÃ@ï›/L Â!}ª«ÐØ5ÌK›É-gs+5ˆVË’ïµV×,ñ©®Š¢ºy´¢ä­Æcbm‚“ Ýôœé×D¼Ù²~>U‚Ý¢~¤Œ‰hR'[ÐÕÉËIöÁIwѦrf²£¬¤aÍYÐLÒ0TŽ6@”½vÆÓA¤TBÖ`÷4Ô‰½W¢4œŽ!`M¼Q°ÛHÐæ((‹ ]Øb­££KmZ'F«ˆÑwóE—ä×¢‡ºnÁÐ’fŽƒÃŒÀ¿üî]‡Ú@æXç]oöëûÜBÞ µÒÎ.C¾É[îïA9É J“ú–š,®¿ÐÓÔ3ðP°‹=õé¶û¢ ÉøÃ¥²+àŒî—[õL:2#ì;¢ 0t¤Xs áñºΟo6%éê›9¹z8Xš°Øó•cbùέϣ™‰%KMÜÑr#MK[Pøµ43ÒÒ0îšGKr=ÖK¡Û{…DE†ÛZ›ëlÕ)ê\f+5¶Ò[r’Lé™=FÛ®eä…ÙyY¹êY¤³Ibõå0ÕŽx<ƒÖcá™ÎÇé5ï×ß©¿ëòÇePž¹ƒ%Ì<—æƒ![ C×bH!Û/B¬Vº¦^H©KÇ ¦’’t7’‘å±ã§¢ýìÕµm{V€ÅÖ'jZ„Àèƒ'2ŽÙ˜QӠţWb±F¶û —)XœwLÊ©#&¡'.Ä[9ï.„¬Äû] ¢gŽðÑÖ4¬ek­Ä‹÷Àœƒö:‘~ÔÚ”âšY¦T¶UÛ¥†k:š¸ ˜cé÷p—‘P"sž [ÏmG“"MÜA¶é†Ð† ¯y«’Ù¦ZnâHqq1óèÑ\wS÷, ×"nW[SsËÀf¦§£yF"]Ot4´ö/¬v8g¶¾¥V^---,‰¾39ÔÖ?¶¬0l{šë§X`AWcÓøªÛœmWc{Ïäêo!{°·³¹¹¹µ½k–ÁSœG@e9ŒÃÐF„€Ô_XÄcôv¶57·tô ²%±z·æƇÚZÀÌšÛ»ú–¹ÐöÜXS{Ÿâ¢sº¾IÞIPÍõu´"-#jmè›E×›‹“<íSž­MÏžéðŽ:·æ6¯­± ²ð ÍíBI½ç'†Zš[Ú:‘ðª°jØñ¡ylQHÄ#mm݈7°0ÔÝÒ?%mœÉ¡ž¦¦¦–¶.]îç,L´µ€÷šzÇQ¸°:ZšZຠ–'Z›Áô=!À]žillž`ñš[Z„¿·½¥±¹ur Õë8³ÝÍ=P•{;š§a9„½0.É=²y|àÃàSb8îojG‡/{qâCK#ÈN#ÓËR™Ïšok{·ƒÁhiYØFœŸè}µ… »7z>475·ñ„bú:?466õ M®+N ± 8‹Ýí­`‘ÚºúÙÒp£¬KcS÷À"±óæ{Zº¦es™úÐÚÞ)Z`ÏùñÍ`™[Çf™èGÙãõ-Ò·&š /v« åo‡š.ù›E<ÿœ­àïÏšè¦kKÃzŸ¹çÒU}”v9y ˆ>ßøÏ©×t]y0¬:xão…àÉŒi§{áÍð 0¼ÃΘ#}JŸÉÿ¯¢ ±âãÇ  C|=ÜÈÕÕ'£éÏ]TUŸþmñçÄX§ÚZøh꿬l£¢oÓUŸ ÎJÏ›üöPÿà ÏõÀlüO å×n½_ÃòËvJö¹+Ü^sˆ¼"k‰ÿÜÀ¢¤âO©¸‚À&Vƨ NòrQþ àFÈ:`Ãaû™@€&¯|üs¬%9v”…Ö(;ajY5˜€/ü„ÝtbÎ,F7Àà\{‡Ç(î _™ÔÆFØŽ¸Á>ïÛrEËeRpá_Š—ø<þg|ZÈç)tiÕõC‡…]‡ñí¦OÈV,ZXX~‡V…;ˆôx²œEßSI½”‚Í.*}ôÛgi‘ÁRþß;±íñN ßú-Qš9¡]>lFë£ãNÛO˃x2mEv³Áâq‘YÅÒï¢iîwz´ÙIú:ãäfÃ_ª7¤ü^Y^áp˜//îÓÂÏ6sa†*âRÙ<ᤧ·ãf·|xhöN¼Þ[.ÐœbáqwðûÓ>Òþœ’ŽË „[l}y¡ÿ%Õ4l’N–`Å÷\z%Mû6’âyÚ?UŸµ‡œ†ÜäÍ×Ò©„€Ã×fáŠß V<«•òj” =¦uª¾¾lêÊù³²ÄEŒö×–Ö–$2ÍÅÅy%Ahµ‘uþp”««kpôaÈ‘˜ÛiëÚ ‡_ræ¼¼¼jfePþë¢9mŠêîŸôpsÝ‘p>i ¨»±}GfCÃ17#2ÙÂÖ!âZxsúCþwW7÷CY‘ÙŽÇçÜbà 2¼EOï1È#h.Ê ðrsõð={¿yV÷‘¨`ggç°ØôiÜ›¹–¤þÎNîɹ% L¶ÛÚYÉFŽ¶Nã9©ÉÍÃgŠMš ù—ý½\]=}³½[—ß„l?o÷iÆÄ¡ÞNž šáâ-yzz-Ì6¹Û½é<@+oy:»¹û^|†N¬)ÁV<ÙÞÑé2¼Ùèþ¹C®.>¡{Þ-oÀ,=#üC:¢·¹6õvFûÚŸ/…V–—; vøº»úìxÕ‡DP´>R8·Vüž¨½âåêYï ‚‡3uqX€[Ïp[¸·Ý*H(cö¾Žðpqõ¾˜ß†4ôXÍc×í±ð 1¬£éÇ€æ[ ফ;gçsšR8š^/ºo¬-Ÿ‘œö¨mØ»¨z'ÞËV¼µðô‰ÛU²hS÷(ÎØuš÷#‰«öµ(îJ}I.ÉÐv``¿*ÛLècv],îîí­/ÉÁêé·/ÉØT˜Ïý œœîÃK-‹¥ê_š¯:“LœO<(ëèl?fK „\F+NYZí}Þv7¦œ/¬™\`1šîëÒÞ·vtw¶ÝJ²%„Aþ«ƒ÷ãNßA0O$2ø£÷öáœ÷5wtuu4§’ÒAÎgÛµ¯¼ïéé~s/}Ö™¹nUS4uî—5ôötž w¶‰Î™ ñy‘Þ;0Ì—™yÅ ”K Œ²…÷"ñn PÎíÍGýˆn'š”{jÙúT’‘þÖÁ±ñ¡êÖÃù“ ØD$£«›Ù@õ­3φö®îö††:Ùà,v?ÑÛj\=:¹Èåíw¡»ºÑÑÓÛ^óÔH[ûv g=¼i½â@Û[Š¥õ®WuÍ£óÂÉæëX¬Ù›ú–Öú2#<æaý$ŽFæ¾WŒ8Ô^˜I »Õ4h|W€ÓÅ¿‘M4à„ÓÚ³¢§··òñI]’ÕôŠ軨‰7ŠI»=:9ÕVy ‹¥/ñEÓÍ—u4šF'@`¾û)N—TRû¡§«-Á™îw ˆñ&Û‘láõè]ûääøåV¦qP—1+)š”Òþ±¶¨67õðÝF¸Ñ\äÑÂá@ÞK‡]-²^÷½ËŽÒ÷;¶ŽlÃ,ôaTÈP Bâ Lt&û§å+µlñ¹ÈaFÈã ¡gC%7bÏ*Æ u¥Q-·¿ï™鎷ÖöËî€cµ™ja.¼oÿÐxÀçsôxÓÆ”lc^^ß4¹$­½ŽÃV4¶÷t´DZÂr!¬›i/M>‡Î`Håq9ð—WÂpøFØuô€“Yö›ÁʬpƒÀÔõdþl—.A'Rbt‚ÑfoaÏóLݵgIü×´Ì0Óþœlä‚h0ÚLN¼ÎÑ‚ÏeCZ ÒÉäà“–ª‹1¾‰‡jCºÅ‰æ‚%ÿ¡ïö‹=PãƒhC3Ù…¾Â­Â}Ej¢hÞò7¥Þm†`¿ÿÙI¬ývÉÑ ‡'wŒ Š6‚7I.†»³$ø>ÈÃSXlÅ0êÊÎ\b‚ž…­ÏtJÂfz8 Ö§®Õ¤¤hSko-™ûDPÎë£ ñFÇÂà•7b­}‚%"xghqŒ2Ü”új å„‘\Œ†=´™õ«f6 y¾µáH”%Ê*wÓü=¢/¬×Ú€é<ì(©­žwR¾‡ø×V^PÖ>ºžµð ù7I%Lt“xþÃwC‹=×´=¡Ý!¹ÓÈY “À@ö&u»qÔù~@$u.ñ€¹'Úꮈ&•íªá[r$:¿Rg³-p•—œ,<3Ðœš}MK€„'ÞMÚ!ÚÈB ¡MiˆL; µŽŽ+Eæh žbÀ¬ãOí¢h“B<Ì6kPŸu³?>èÖÙêJ9Ó Ým½H&{ƒ3Q}Š')úRö|ÏÃeÚ˜‘ϼ@*•a«ñ\r(ÇJ¡öV×¹õÖ¹@²N×=ÆD›‹åÝ dF×L)žTŠ6Œ¡w8ª!K(VRqm|cˆšjî±¹À_ך¦"Ú¼™®¾yÌ$ VÊع!çJ€žÚö ì '„Bs2u”œ²O¹×Ûmœ ‚ŸHZeÆAcÓƒ©µhmk9¹Û£¾Ù90âÎó2¶¼žT¶%Ö„@Ç­Úþ»“ž¿®G®âsû q[)V§®<€Âoò"Èxª…£££ƒƒƒ““îfõœÑÑFˆGc¶jèDxQÞ°&¥O%ÔO ¸Øöâ,Å--‰¤VtƸåfõ§ÓèÖl€ßNÓÑîe­¢ÍâÀsÅ‚ƒÆdª¯6Iø8ÚØïÕ ®eMÍ3½ŸÔjê·&äØöþ¡0û$©B!Ê°¥ù>ê/}EÜ…šàA9@úÖem~:ZÖps‚íi£ùÕÖâ% 2ÛÁ6Bõ«3ce/_mÖ% Ú3Ít¨¶ ehÞjÅ‘ôçáŒÀÚ(nMW/1¯ºûåim’Uû3õ‰Pg•Wh°¥áWDŠØ/§ýìýsÊRÚ˜ ÛPYp×Ò¤ÛÀmµ†µÆWêÕËë~¢ãå « \¤Ø´¦êïéИÊÐfe¼K¦/ •UFºsØs<€®½ûRðWu-Ú4ÞK7ð–¶À9?;ìW`û»iÓû–Gô À´)ö£ŒP}ÊEEÿ;’6·Þ²åżR´‘ôNÕ‹`W3¯l‘üš”mÐaRSxÝÅœlûRúæâPsjL€ÚCtÀ··FÑuó#h#Ñ «óóœÍHV‰¯”‡R‡Ñ¦z”‰ aÓ“;!„6’=_3Nê›oJ˜…Û@ÑÖXYE›åá"ň- S~)ÉdÛO@ƒÄçeVýh«P~ÊVúö¢·–Zv?¼#Cr+?e—El–¤…ÍhÛ_ô!hÃS‚6n0Ú¬ìÄj¤õ+æ.‡6Ÿ6P¡DXÆTïÕW´Ûpg(z„K²(ÃgδNKí6½p{¿<áM6ä|–­4Ô…]Ü´ßâ@>‰j ¢Mn¨£Ë¹— Í ¢Mq‚6Œ@-çÇ•¬P+¥»ð‡«¹Ès ÚÀ2ín}›Äâªhš¢Ý†3IÂr:X²ç1¦[‡¦a´1ØWá•xì I s¡vî¯Äp£D“šà|xº…è,±ˆÝ,‰y•P[ÝÜGϹarL;~Ý?îÖy¢1:_ƒšUß=Æ·ÿÆVuûI@mîÀkRƒõÏŸ¿“l‡æÖ5-g„€H(àñ«hÃÖä_kF7×L¶Þ¡‡ —:/Ü–†áZtWÇ.§íô<óP–Ì×Âh“F4ˆE`E$à±áÈ´U?¿Ú>†J,#õ×õÍw¬‹64Rla**¤8ºïÊøK2h¤yëEœoD®§ µi±ÐmL‡ÁÎ'È‹èà>±ÛhWjÑzìª m€üšÙîÈõ•íö®'¡ÍV1PÈRvÞ Ø.N³£„ÜoaWœú†¶b±€aH!” .ýÙÊÐæ©öVÄŒ\šD7Þ%‰ÕÃ)­êÚmÚDèR8O Ü@¶Ö–qxêÕxóµkRmç\qº† IË3RÜtm‚/ËY‰á]¹)özdïs 7¥ˆ„|._qA2Ôpâ1*=¥š&™Lß‹Øl’„Ll£u70TG±Ú÷£(ñ’u¥•þ²úXËryü54f®a*/•m Š/öaq´«ñfkפZÎ8ã1ÆC‹«?êªk¿-WÖJ e]}C‡`ÔÂÿu¨TkЂ…§G\É&GSŽ9éSñÞ'í(:Ááö×Âî¬r},vÛEt}³é²=Õÿ,ÅÄ+99É„‚Ù“]È Mª½1ÎÌ}÷©n×M¬KHô„=T2)(r,oÌ=€÷L‘mÏu1ØÀÝñI{¶ã°ø¯ÀÑÀ¶2$›8ùÒ<ÆìÌÃ\„_YF’p3³‹\ØÐËšï/­ÀN8ŒðÇÔÔüi>kijq†NMO `§16s N5½È`#¨.pæg¡{3s «G-¹È͹EzÔ·X¼Ý™ò·oG¦$0+ü ›±ˆä¼Ädol·ižb.Íi§—WxLOOóE«†‡9å4Äu44ðs¼· 7kºžž‡¶-¯?3ñY³Ó KÅÜìÔ O(Í_Ä[ÚjzfE²ÀÖ_zeÇóŵ⽀‹”d–#8 Š…K`w‚-³°ŒÎ‹æÄ´dŸ>X—)´.ÌE¨£Y°Álä9(£©…eª#2gg% ÅgLL/Š%ÎT`²ÅÁ ØÜKJZrynfTY;l½¹4ÌÂôƒ»ê: v÷Ì4X¢éÅe™@÷bîôä4_ÆaXÀšŸšœÚÈ#K0¶ëÈ´Áç•1 ÖX@Ù þ‚ˆ??;sŠhà/hIBÚþ|6Ì\`k¬ ·È ùóV–çVÃs-ÍÊW\qõÜ Ä!›Xuç¾ØhcÝ'\mš&W¾ÇÂl wºJ~c¯S_u¢ÒºÄ|wrlj%hS6®jý€ô)µø k‹5dnæžR§«µ¥~ü{>>®åvÐÚ¯™:ïüvx¥Úfø-{ÜË\-»dTÕ<*úQpçwIñç•mTôÙÍ®jc©HE*úÛÕ|fódHœ˜`òåO5÷<\ _òéäm+ªñú§…üH=<ÙÑÚÊÖÃSê°ð6@›ã]wê¤Fjs0xs®]Ó\¨¸ˆq¯8nîp¤n-ÜT·¦ÙH®æ¦ê&‰Àr©Îá·ù²½ºFû±`©6o‹awο>³™„0›€5H#`ûá•Aq¿Á7tøÀK^™T4‰=£¨Y£Ž"î‚W;Æ”ŸUq†¤;}‹èn ë,+³fšVsp>HïLÏzQÅkñP‚6ŠÃX€]å• !/-Rÿ\ØPn+1:É}nœ¾ÕvY!eÒ“\Ü'±’â‰?Áô´F(]{9´O]Û’ëÊv¢v‡hÃfQÙÁ~² ¤ÔôÛÑñÎÑ°Óû†²MŒ…‘WVÕZîC®NEšFgÕ.w½ÄÑíÄʸ›5VŠ76Ž};AÍJÐF˜í„~1*ÉiÚ~‹n¾¼8_™µÏ4*S2tEþ†Ô[-“ hãO&•C¨" 8<¾äû|:Ó4¡à"8jNº£ ˜fòõ%Ó@èLíá{n:žÁò”äW€ï÷¼/„ö@¢köäƒïn´ð¯íìîJ Qßy/‹6=7öRõpî~A–T«`x炈Ÿèá€7²  ˆ1g¡ú™¦\Šžg@ˆ‹)‘fì7 /R‚qXRHtÌÍžeªnq'º?t¡­XKßR(æP‰z™»Üƒ£ÄosƸ·ÂÍǬ¿`FÆxm·¢Q¬¶¥"•â/·êhlãˆÏìóÔÃÐÂ"÷–ÍÝ·\H;ÒɆöñçÞíä ™²mÇ6:ç¼ç8–EM¿§îC*XžáCÆ|i8’SÂmxV¨Û„µºçw$u¯¯ Å0hR~c%XÖá'G©8¼³o‰¾…wrð «î¢1Q×ÚÙFÄí<|`N„Ùðf»wÇL‰€ä|âÍç‰Të(©ß5Ç÷§ÛÀÓ#t§¤÷bþò¾0G<Ö8bï~w'bRn#Š©‚iªžz×¼¨îÄŽÍNTƒù'A‡Ü‰·[Wv[g¾YØm8Å5K·ÀýÇ2Kj:d`G šõ7“ ø7Kžzz׆׸µóœÚ£|‘žØ4Å“Anp¾Mê½Æ¥mJn’›§ïÕtÜ'E-[:%áeïZÙ¦lU†Æ>$=âfüV¥Pqz6#ÝîEwiÜIvÝ“ Iò#¼°>ä3 ª±f'¦–¸²-bŒ1ä†y$ØN9^Ó´GŠ6bÑ¥ÌÔ·#HIxá„Í™D¼Å6"AÍb¥ÿÜ%(6™ÈX¯t¶8 à=øÔ—D´@õ8uÙjXt?‰`ZŸ„­cŠ›3¿2ˆ‡;a>ýpJ7Zâ;mµ0éR“º:6£uTóµÐ¾ýnF¡“ožOÙ†œ£%JÐßšíhØQ±›aï8N·¡&ñ- `wœÂQ÷!•O #']ëk{A0t@&)^MúfÚPx}–lâv>Up$G»œú&c\ã‘oÍ•Faœ/‰ /Óùñ™EÕ@þ 7Ðù8ÐyNB.#Ùæö$*µ _=»“q8ÎÁ”ô5ýv rÿí‰0£è\tÞFrÊ­‰~,fAŒÊƒGWÑFÌñîtK·ÚŠö~}轂ÙpÒW_Óoÿ…ââ‚”('rlQm@†žk§èêȳ8Þñúâ…³Q.a §VO’æeŒ‰C*â™/ÜIÖ-‡±Am6¤¹î"ÝB(’Ó9Ví6â¹Ç×/§§$KIö iÄ-pãHÐÚž”YP^ËÀpíù@mºWÎg#óè-n?UÚ 9n-UÒ ©— Þ:Ør цFx3ŒžÜüìÝ=œ? /Y\ö¦ªsIÛÂRåʺX¬³Å…Á'¾dû³ˆ>R¼Ó,ö¼¤k„±F”¨’a E‚6*ݼt¬Ä±”cf¸­:x ÚlÑ5›’ôf¨+érÉÀÅiéÅíÜŒÔäcÉÉþ†Ú¡fnUWo„ ȶ£õŽº—·Š6=€`ÖB‡X¾¥8d³÷&$BKÑF8­‹ ƒUé»­ÚtñqyÝ Õþ “ˆéˆ%äôÈ¢0ÅD-ôѬx‚<^uO$ŽÁÁñ‚ìH ÛÀ¤¯OÅ“ð+ÂüvWe~"p¨FêÎ ÖÝreX´óõÔ6åUÁÓâLvÆ¡¸„ƒe]ËÆ´ÜÆq)ÚtÎ`uµÃ/ÕÊ¢OûSNU®1&Ì»‘u(»Ÿ …Z&Q¨ê“ÑfªíÙÐA(–³‘ h#­8âtƒd7|èÜo¶9¶Ræ­sǶù»k«iÆå ûþ:ËÄïÙicˆ£Øíì_É  D®g ºYMwpN‘P±A´¡êÆÑÄY—Þx!‘DÛ³¡¸¸øä‹·7BïÛÚÜI u<˜+íâ ª÷£> õ‚6‚…N²šNìÙû­]£ý¤oP´ÁXHûi›+)§t¤ö桯ՠ~Ò1>$„tœWÌ©º–ŽþáLÛ­¡gV5I‡2ÎdO8U‚6P“jnÙ„¹v$­êqá:h·òZrhêM©5ÉRçónËê“@œç($Wýù(¿ä» R+1c¸G5ä X#ìnnZ!hS!\~KÂPgùHúy=mÄîK²á…Û@øŠÔ(XÌÕy9s§}ÄéçDZ§dÏÓô£XÜö+O{F]íFцF|Ø5‡4ÃÛ›‰>‰¢…v‰¸ÀC-Ñ>²7KüQ´i¼°o„å3/…|¢vR*ÛôWåÒ¬¼%µî·ÔYmd~Eׄ˜;ˆ0Ú&èx­Îyt#Þ@kÓD›L5FmØÓ5D‚Írcš–e:RH´aÃí½Ò‘¯cæ7V¹ßho™ìi••øGK¬©¶øƒ)|eÄŸ,Ð'`Îä·°VXŒ™Þ]D+Ôreo†uŒîŸe¬¬€Ïæ.îµÓ7q㉀4K¯‹e²™¬4&c0þ ‚ÒWz+éÂÓ dhÈrû :/;§¸äbÏ\GžžžË$øšÃè|¨¥m? ¬8iêž«sàðx{½ “oÕ‚aÃ-øüi>âÁð `ˆXÛa¤• ´!ãŽ.pùBÞt˜þ戼~°íÂ蟳å.—Ï[Œ²Ó‰Ê¶- ¹3—.f/ƒù°*p_4³ÄॠڀšZ£áí¼æ%.—;ÝvŸD¦N­ˆD»Í܇=‹—Ãa'y{›Ñu.—M‹C`ƯQÒµÖ½à\¬·3Ù9½™'bìLœ=æò¸“µ·¶`í@]ŒÙy¯ç9·íb•  (­8ˆ±¶´“oÐl¥h#½¡§á0¾Â@  üc-#­F"€OÖ¿¼øPué—æ»_bȆ\‘ÒeD±9°?Ì€ÃRMì/å7ȃ«œu0¡âp8²eJn!¼3wÚ»¥r€-+/‰Å#²î«ÞåêS‘ï#iRÈòÂ|s°!GMÊ)Q²’ Ëï<Ìix"yßégi±• ÍÿßÞwE±mþ óëü2éÍUÉ¡sÎÝ䜃€d‘$ (ID1 "æœDÄ€ˆ" ’‘$HΙÎ5•ºé†Fï½Ï÷æÞ÷­½k5§ªN>Ÿ³Ï>;@æ¿} vHd ÷У¨%oǽCæ.ñÚwR“Vì^UfƒùžæÞ6^¾Þñ Š\Ÿ*]ÈŠt»ÈÎßwØrúE¶¥MüK¨NeÙL™eéYÛ¿¯;ê{dÉd{Œ—5‰Lq Ú7 y ÔhæQw5‘D& ]#æåï®$Q+¿¶l5ªÑ&Ø…|©²oÝõæЫË\:™!p~Ö>7ÕQŠÇ“5€  ¿šJ%ÎaÍS°Ãvùrˆ5O`·ÏY¡ääë(óÙ™ç€73ë[@yç'™<×4ä6PïÆ6ÇÑß@^ÜÎÊã,+u©ŸÎÄâ7xœÀèïp’Ò¡Y¡ÜœYUnˆ7¦3ן¤Ö=ÕàK‡~ËF´y1¼¨RL3C(q48YJ²T>ín÷¬fæ›…“ƒÁëuLÅî lè³ßÉÎoғ냵ÅXÞø¼Œòq0Ú|^^·5lÒØŸv¦UEã©ß¸û~r*Q*55ˆ”Ê “îdmQËZ>ët*tF¾CÞ¿JÚY0¢¡¦8[Öý@Jl„³/ª(¯ÿ³Û':êË‹¯PŒ°ÜFqÏŸ$òK-}ß¿ÙûÒ™ÁŽYÅÊÌÃ[gèD\äTêwAÃ|ÿç©âßìÔ¨,ÿfŒŸ¥MÌeõ‚Dy›_m¢®¦™†§‰;(¡¹åYÓô¦(=Æ‹" Õ¼LöôŽ.˜¼£ÍhåÛƒ{îݽSÕõ'Ò‡>Vß¾{ÿA~ñ:ÏŸÜ©ìøñW²ÅñÛw<¯ïþÚf7•E Ë^‹5¹…¬èQÁÄ’ô_TâÜ—Š{÷̈ÿÊýÒ\[Vð¸\%„Ç#Œ0£?$ÚQþì8þ׫ê¦rå߬!êPðwsê¢!–ÑÑ¥NU¥.C,å&b½Ú ?”ê@bôGCM ¶¥ÝíÿëWµç®“±{þfI¨£ñé’oý†¼>Áa„Wý¸€D®Êq•ßàs ôà#µ¿ª2’ù ±ü/½¥é ™ªæ’÷©¦Á· Sõxûn/ S3s–߇Tz/žêJð±21ÃÙø'}‡!n…ßœdÌð$vni3ê#\±Rp2–FÄ‘Èì×_JUFzrñTŠK蓼†-ò•ûÇcHæ&àçǼÓôFå4þÎôý#ý ¶ôÿu|‹®K (iÔÖÌàÕ¸î å'9(•›$+•º6VÓ:·ìÍ6©¾|oŠ‘rÓm ˆö¢œ+Øì²ìÇ[ £v?¾5ӽᮿrRêØì• ™l“®ÜäªH) Ó£Qû•aä©÷?k@Ç «¦Ð¾îFy5¾ª» 6éçM«Šæ)Kâ0ÔFîWmÎUw²‘QF1”<óù2`Ö5-€I/‚^ÖSh§zq˜B´šƒåU¯Ï%R\¢`‚9*5ã-dH‘íê•v¨tK‚c$»[þr—fLŽµ : ®Å~wk‹hȦXîw27 }8¦iu~h;CÄjÑ+ŒÑùç©þŠ—ï©–ìHWab5¼å dDxóxÂÀÄS°)žÔÓšC£R¹\æ»Ð4˜ï¨ØálÉç[ºn•Ù.Û„8X§Ãvsó_“C<ÀÂRÏ©­ wzñ_wçÆùp¸Â¨C·ÔÃZr>ÕZÈs Ü«Ò;#¢|xì´†Éõkðå·°óÝÏÏ& ø|·à” Õ˜Ž5<ò± …vÙ°Ó!ŽzÒèT—ÇÏj†°Ã‰kþi\±Üû>ëÌ}*íøÔ▉ѢæûQ`SHÜ™´'Ý5ÙnKý³5óHùË­9j ˜Ñ.“K¯¦‘q« %[{²§¤h`xÿÍÚ(®ÊìG½¯}¾í-ôº Ty¯¨»”è•~ë’Ã6m šr2ê‡$Vüóôé–]´ýiSÏ÷‰%p ÛšŸ©l_x„*t+”K³­&æÏûçV•ÃŸoR(ü–¾¡±ÑáCÞ"Ïãmòó:/†6¢4?ÒátÁÞóÆùC+"a—cÕÐ?4± Øˆ6€dÈܧžµÖ^Š¡RpÚ(Ƽ¨ø¸» £ccƒ­¥L<ñí7h:u˜ØZžMå9ý>2:<°ÇŠ| R¼¥r>N/,‚§q‰½¼ž_žá‘Z&…Â=ÜT£ÄwVp1•ß-ôpoÕù©ƒI J€‹Ñ.Û=B^Íõ øÝ^sTwO6ÊubœKÞ¦>WûQ6l¡†HõqôŒíVÚ,ådeöÏ`V~5ÞöàÙîCPýãÉ`Zì õ°»)å# ÿ¾[°óÐC„‹+ ¢9\T;Ê`Á]-/ÌÚàb±¤ïÁAâö4èù¢=™úŠ½.v§^|‹z§XY\QhŸ’^w²õ?ƒò&M™[X÷¿ᶌ•¹ûr9ÎÈbMV[©ˆ]0xÝÛéü'íÙ$Îy: ^Ýëvì¡úaq0Ëér34Óc¶ªrUH‡Ø$óoâñÜgŽÊ¢“p6;k"‹ÚhAMíÕ8¢ \¢bÓö8âo|€ˆ¢ v’úµhsË]RˆtéÅÞd6×Ò!ÁØ8ö ¸¨ÐfÞ×Ì”!@[Z þ^Õð"ÏÁ9¾Éí¸—…ÃSç€74Ú×MßgêÔþºõžoÇpG£›R¿­j¢4†A¡ñ„ªü…&[ôÏ÷ÿ´ `œ*êÜLnóõõ%¶ýõl‰ö$Ÿ«n||’ç­žE÷b¼ìŽû©›ñÕAÝójþÛS**B›fÁ¦‘8~I(Úx¢V…G¢üÓQ¸~Fv¿îÂÝ"<Ž«úL$dQç•@¸íòs¤mKAæ槿ª$¦­ç~cƬC}þAta-tá#J EÄNz®Ú¸ÇjõHëÑFCn#~glyB›nòåF¤«c7tõ¹~@:õ9ÈžnåìèjKßžª6@GõWÁ„n™qª¦cz¨çÕ9GGÈLmG·Aþ¸æ\LMYks†gðƒ¦E ´QÊãEôʾYTÆ–6ßnKˆ;]Šü{;%( KmÌ®¸»åu¯UöÊ'•6¨BÜË"↤À‰@nÐá‡ÐÙL¾p5ÞÖ!é‰Bo£†ùt²Cü¨•ÖQnO‘ÎÛm9úõït±÷·A›ÐÇHæÇû¸ä”mxEÍÛ,ï"žØp1¢K¢÷j½ÏÍú¥€hs{ m¾¡ÛTh£Î‚°7¾‚šH¦Z‰†‡µ¨{¾ñÂNLŽJ(/ä2r?‚ õjyëƒ>•ËɉR2ÎE [ÕÎ#‘]Áà;™5'Õ…6ðçñm£ókC,gÑpÖ6övvööv\ …!²Ù~¼Ú Ú€gÖêCz¬HÔýråîµüèZD6Àó ‘(¢}>×VPñY m”ÀLé}~z—/ܹ^ˆDVÕ6€Â™K¼÷1©žtÞú/=W¼pιè6¿:tçA<5äóóóÓ~(œzáºå9„ din Ž¼ÜScJ³G–ëJ£Áð\ù ¬ï¥1ÑZZ±Ý–|¹ Z¼ùqlÇ„b$õˆ kÇõZ°|(ȬX¡X™`©u*{ÏÕOš¾/?G Î…tð*˜ë{ó¬i\m€¢‚M:*r¿ãi(ˆû)Ú|L·"‡ÞGïʯíñœ´!#$¿ m€Þõ]ýdxâèøÔ:Ä“¡â@¨Ý7E6Õ@Ü{2÷±êø"#)¦''Å°g#Ú€/ߊey¦¡›‘lòóã×ðHh£Ïyñ·{d»9ŠË»­L²žj{™ªÂ[vÀP'™î ‘©óP­/ìu É,D^)Ù͵̬G׋¦wý#ê‰q¤ö‰¶}Y‡dÙ­WrãF^ßô.Ü€ì~;†Xš* óó2†:¿ mŠÔ]íBf‹âlx¡û!øvØFhæ/ YÑét{ÿ=±a *ùÈchêVåÙ;Ç?[»[ ´'s­ã¬h8»€l”·q¢Þ~³†6Ü€`ƳoŽÓ‰xgß@ Á%ñ£+ó³æS,Ü¢xT|ØAh:‰g¿ø8þKëýL3šåÉK×’ÃÝ.Ü ÃùB/$h¡ÅB›·üðÁˆÑ´âò:…ĈØB¡ûùx³Ï–A˼ælFOJI¶¥ÑØAкƒ´0¦ZÙ*ÃÎÇÂL!;C“|5‚ôäŠ9øš#I&F&8ðñ .x­ŽW=ÖÐÆo mHî·!´‘u±[ß]1Ážd¿bú öÒÐpGK#ï˜ šgÄžGfÞÙ„mª“”E,"%NÓã©Ñ¦ÝǶ†Ap÷µ÷Ùãg»+1Í>I)?r©D7w÷úQm»NªÐ¦.ÎÈA‚6ðîvµ€bá†tu(ÜՃűtqojŠ€A®~q×Ô˜–tܤét<ß5âÊǽ ¾u\B‚§-‹oí ‡VŸ°2ßRÑ-AÐÆAm [Ÿ©f>‰ÂqJˆ ¤Òh—Þ!Ví³Á3ºµOŠ~FÖèzpДÌvtrDÉÁ>ï-ÔE¯.'‘È4g7'™‘T2ˆBƒ´Û“N ³¬m¹6ßi ®J[~‘Hò ÛèNfð ú 1Û™Ä {G‘€Cc²œœ‚­Ö¿¨lÆK¼)<¤n'f­ÙIyšûAz¿»}¨ñ»i\ÛÃEcy›\'ƒÔwˆ1å°‚‹»Å&]L()þ´àR$žÛ¼ÍØ/óü{%ˆH*Ÿ˜¶$·Âa³{«.›˜QŒÁ-Y©%¹M«Ï)«S.\6Ã10a—Byø iØWcÿ|ˆÅ‰³}ø‹½·†¹e_¼à/0sŒ/Eê–ìDØ'&D0̉ç ŒßĘû_òr=ã/‚ÿ^ çRHìݱataœ§ ýÖëa`èÙ’;r ‡A΋v‹H;•jF°¨…c×T¦9’Ì)‘»£Xœ€´}6Ñy_>_I¦‘©;“÷ßnšú.ê Ⲃ…¾¡á–d3¾Å.ð˜¢l:lè’mÇðÜéÙ?Ë`Q;ãØLŽßa4toª•ÈŒˆŽÒèÂHÈûêPkd“åœqà¸x¸THÆ»FîôsÄ“EeÚ,ÒPñ6v@N¨å‘³S…t†ß,œéì@““ÇÅ‘SÊ ð~u…îŽ|—Àãçïm) ¡ÿiýI: ™$‚×{ÁÊ1VÎÙ3¹6»ü¼ÃRðî¸X|¥g{[Îqj¼íÉâ¹# öâ«ÃìH$Ò¥r¡B¦vCǬŒÍ`…ýªL+‹HÔraêåACþðqÕYgžm ’8S¶×P€Z.È'¿àIlÄ: À•rµw{uH Øý ,Á™C(j„£É¿Ûá©Ïç€Þk¾x·\ÔÈ ã¡!Õ} V-›™™Av.ÝV™A|·}—‘Ähóñáû°ç„O¾ç.°¼ò 9ÜóÂLä3ÓœCs8×{É!%ÃÊ ÒZ‘Ï}#ÒYKr ÒŽ›ÿò¥Så–sÒé8dÃ>r+€•¶¦8ýæˆ-/µœ©9fÀ…-‹Ý¦f”«]0Ä-TÒ ¶å·A"¯ùÞŽ5¸^¦JâŒ,R°[²±æ$Þ˜}LÄ3Úa ‘åŽgF4{$`“ô{1or§fªÜJö€ÐF!á±éIOÚr¯FÑO~‘/S)Ô–iøÐ4ß 46ÑPÌÛ¨ïçÈIÊPð¤~aeˆB¥õ-HΓÆú¤WpHoù\?…ÈhœBÏjɾÔÌ{m€tîrÞùA4mί‡„¸é®Læ;B6ï´Ú~Õki{UõyTkz=Õ×#å "³äÞö.ˆ?]1 ù¡á¨¤“<:±¶¹±ß3ê(ÂÃ\Úa/ˆ9RV½PR\àˆ#ïfj€3íækÔcžÊ*³eŽëYÖ²ÊÌÞ,)†>/{zG`@x<­U[Ýh³ƒyìÁ' ¸°_«É–ÞàÏGAœ'ýÓ¾laŸh,:ê~I±øJå.È€×û½OUvî·g6H‰¶|†Í~…h=åã~î%X«H¶ s¤™a‘ò=çæ'uH©•(²±oN¡ªC®0ôÈïA¨]ì1!ð†HùŒ-Ì.lq9ÔHb ÁcÒY+QüI¤—JKòí͉—¿)@´1b¥ °ß^qŽí®>•øYãÖ£ ‹R;ˆ†2ytÔÚ/­zyä•&7ä“SDmd³Öê»Y‚6[H¡«H¯Hf)ZËŒD›­¤÷&:Š),N:¼¥ûÃ==“/@fÛNìO‰‰ŠŠŠŽâ ¡È¼ÐY±ïxlÔÜû<37)ëôˆ.`£èn¬l ÎmAuê´PžuÌ>;Ãð‰¬(E z¼ÅÈx Ù’\K÷Œ: èêÔ*Õ vh4lcdðbRˉã?[ÿµHA²ñfS²@mÚk ‡(çb v´ú+¢Mj~1ÂK}öÌi„òΞ{Ú·¬åqÂÔÔÿ@.úøtܱ– ø o;ë°Ä¼\ugŸ}GÐfƒU&äq‚‚xœPÇ¥±LŠkâ‘Ü\Uþgμÿ=hÙI}Ý„·QòQŽ7 (ìäÁ%àpè~«âf,}ÿË%@±êA£¶Ï+w9Ò^…Ƕ§WÌ×° ,€åá³%æüýÀò[ŠS<ÈÊY’yb@&d{ÀÃZÀ‚¿¹™ßþÓšÒ¹„¢ êzBN·a(P´9ìbi‘¬ÙKχå ÚZGøº¦’SÏ8uÈѦn5Ÿ…Ð&½zq°ŒF³_VéןgoD›ß¨‘(“"™¥ªÑ†™ˆØfŽ¶äS™‚UcÎäåÝxZ£œj¦N=¨êî™ñ¡o[‡6½[ã•3Gƒ=, Í…E­‹Zp¢ ÁSmjn ¡Í\ÑÁ]\÷ iv¶¨}Rm¾•Dˆ4À_ôòõMkæM/²ÇÜ­w=Pù˜ë4!j¡MáÑpcŒˆÔpÌ’ò¯ˆ6*ŸN…Pv]TË~qœµf~ÚÁ0¤`Lõ‚|yš¼šhS›îÆL|¸–Ã,ªñ­Ë|ZD1þ<&C\@6>/ï\PÑlOQ}®\\XY'tL R9¨ß/ú©Ç ¤…!¤Ó-ý4z8¸³·_ŠJ¾V¸ÏCŒëöñ2ë{¬)î ª W÷Œ;G£´ kRéI'?º~tGÔ¢;¾”çß?‘ñb (;çlpoDUbyŽg£Íèfh£^ïs`'—¨›9? -GYýÚ|{uâà¯zaÙ…eòS´O4Piô)*ÝM°0ÔF¥Ö”ÚìAÐfqðÉ«J/CÐÕóö*ËÖM“·Z˜é=ìj¢Íâ̸Ú¬íIªÐ6^óBÚ´ÏtÝJ%l? …Ùä{mŽ”‚=qLd^8†•$~ô­w¾¬"âêŽW•“Ò'‘öÖÇ«ni¾»Úœöƒ“7Y´§S‹¥©ñÙ]SSS}ŸŸ™Ó–ešh3øá…Æœx~2ÀÀî€6Ú(ñG¾‰ñ­Ú0‡®Úúxþ$"·Ù€6`Güí¬.ŽONv½¼fHrœçÙx9Ýÿº}ü¼¡àÐV†Ÿò:ròÄ©yXõâZš—WÂùå¥Å‰&Kï_¼Út<ÊËC푇ޟbyXdÁŽ¤Æ‹¸¶B®ï^ôð6x›ãæÇÙýwÔ3X –…›zž sâòx9¯ Æ½ˆ· só€Uw>½— AÐhãu …Ó68:59Yªo}÷´ÏTïy&&÷ß÷‚Íìx}K`1£‰6»ÐB1%_ÿ<<=5‘ŸäA§ã~‚6i/邃|¤¼yffºú\"“GDä6ÎxÒ…†os«@ßÑdS–£tŸìÊñÉ©©±no®ÑÑâo³í•8†¨bzr|8Î'ÈF€Ë{Ú žqº«³Xü°Ñ±±Gnèé’ÉIð›©Û.®ÑwÁ¬^ŸNNËoÑÍÛ´OÊGs“ƒÅ­à'ß;kpæ„&ÈÁ p'3Àk÷™™þ"M$V ÁƒÌŽoÒèää·–fDN׊BÞ’kj(z?8=35xЗM¦cr›¿ }¹·Ý.ªdÍ|¡wo3‹ÅvÚ‘Ø‹jó8’¨ *à3­O9­L|‘§nÊäÃÙ$vèq¤ÄùŽRo[.›ÅÞ•ycéÃ¥^2ÃZu’ê˜X"Ju+Ã_XvRäÊzº9Ö×l¦GøþaXØ"û”Jp€=½Àí\xë"b³-ÜkÇ”ÁÎä;oGá¦l?)Œ6Ö"·!Ôeë“SÎÁ_Á-ët0¸¶›f®$qbÎBë}¤úŸË ¿Ö \3áÆ¡\›tŽËåµÍŠ®\SaŠlT\ËŒäqØ;¯§_Pyï—™Ç~{„øt'“Lâ=›”+Ö,ŽÀeVÜ=‘ â±Ù|Ëý—WlÊûÁV6Gj`lfÂðWûv±åTuNC=»2r`§‹Í¶ó‰nŸGã«(F?8ó.ÇÎ9P¼½›%b3ENÆQYXÓãl‡aë›84ó :IÀÒ«œÛel9ÿÅ•m´yN]¡X´uK6>×– ê¦32˺è0èˆðhGxÑÅo–9 l 9œ¿®Jše®‹è²á ¥1«;ÐŒRg¸4MÛYi6dó˜/Èé›çU*¿Ûrw¦AE×*°A«éF!mx]>'E•oÓlõ=Ÿ]×{kÍÖ•¸Éèë<Œ(0£´ºTW_ëŒø³AOg³0s ¿6P\ú[þöǶ–ê˜Ïaôï#ÙüØÌ’äïyr‡ºcžx¡“÷©œS^ŽjÐ9ÅOZ‰Ñ ¢9L ‡#Ù§Ã|í¶»$ÿ™b È9« çŸs|¿‹è«òFý)žâoÚëkjj>6uÈ”?7+@ž÷´~®yóæ}Có¢ô?Ö0bo–&?½÷¦æmK÷€YÀc„Fa¤Sn³IÜŸ~øïÚU”¿è`®•ÏOcÐÿÁât‡®ßDR±i:J×LQ*7+÷ÏõÎ9°±š›)^/Rê˜HÊŸé,dS)‘ÖºTg»”?"ŒþÝT{šO *[7ÅéDnÔëèÎÞ†ø¾þ÷¸&æ¿Ó3ÿù|Gÿ›Q¨úß±G¾¬Ì_›)öúïܼ?ŠdÊ®Ûzv»¯øê wWjÌlè®g/ûxg7Kf[Œ õG¡H_HÿøÍÈØ!CC·ðŒ¯S¨.OÕ¥PŽS’fÞ_ÎïÞŠ¦(‡ZªÃÝ-ÍÍq¦Æ&–ž‘oº&Ô5X¨Œ$í}ç†3„ÉÀÐüƒI?©¨¹ #HÏÈ-ÒØØ”"È)¨‘*פÁ£_?î q540ÐÛfäà_Ó>¬¹@C­i`f[ÿ~ÉÔZÃoüöÿ•ÿiV½ð%£EÆúçk¿«+¿üíÃ6<]¾ùJ/Ù)ÂÅ!"ýqÁÿü‡¡º[ôõE‘ïz¦ÕØ53Øz0Úì¯múF¶¾1h 7Ëw¾ÂT_ÉÌÐÐØÞ?áóàüæHˆÇº'Å&üëèÃQÔs{ÂfqäáuÕAÇ,èº2Ðzí眆æ-Ò&^SàIêöm³8þƒ]m#¢ü!s†DOQŸ«®’un÷›ìº·ØÊ온•MH|k¹*ü“v>Üjn? Ýæ·Ó©ä1mZ™[pšq¦îïu46qŸ„3zu3ÖÖw¿fþ­×’‰¾à¥áx «²¹ÍÚ66æ7I‘AQžtåÝû¬6¬r¬ CŸ.¨ÿ}xd—K’†RÊl«¸?Õˬ½€#³ (½ñD¿;}šõÿö©àNuÛÐÆ”=,Aß—~6! 'Tþ(g›FfrmÎ?mÿ­‹gS¨àl¥ºŸ„jÒóúº=ŸpàÞÜE8ÔCçƒ#8—8 1þ)´¹èDe Ë¿Ž/..ìuÇy@üCÅ1 'm¤õ D2åþÛ>±XÒSu/òE¾Ê°ç>lyþ8¡ÇžÅ¥Å™±.•òöûê鮻΢Ólªñ4*¤® ã'McK‹KãmÏôÍ…sÊUÜ= ̓ûB¸¶6Ç íy¡nÎó ÿÌ76yðyliy¹µ"‡&t’‚ ©nDͼ]³¼´Ôþâ"že·¤Íà|,Hã؆Ï-,ÌMã1He­ÀÄs¢>ùÑ×…¥ÅÙ;4*©axI ¢ Õ®ŸïLµ9¶ÒaTÔW¯½ÒÀ\0‡ Œ6S¯Iú¤óK‹sw¢DT ¡¶oaðá¢ç¾ÅÕå¥Å…êÎä'p=ºYfžHàð–›ÞLûcrTµfÚ·íj›ü'h³ZÃ01þ2ûÞfu¢ÅŒ@ñO»2#[¿ó*æ^9©ß?G›ìNvG¡Å5ÓTbÊr’jv)ôƤ›‘áÁ&ù&h£|Äv¹Yšd†r÷_ÿ„| ¢ ™²KL9QŒž´­@ª|ÿÚôYéo»úLtà© t(6 ñ6å7´y›ÊÜ–Íä÷;×´ÛË+Ë+ ßÃé†!7äâ•–¬ë5]©|êݼåöYpx>_Ùaë N¶¼Î½]†!Æ?‡6Ž|»4tÈd©[ÈŸ¤šh³Ç˜µŒL½éz=¼5Ì4HD4B´R¤Ñ¬-9 ˆ­0üµcdA"ù˜³³ž ŠóÎøð-^²¡šÞ¨C9íU ÈVä:ÑÏ~‚R⬘÷_õH|ò`;í@ÝäÛ oNj¡ª‚2w¹bB&­Ûghâ1‰N­c•oš«@¾·5ã­y<ÚÓ54'n¼¼v=°I†Ø4Ò'm´yŸÉ/'ã²ÕäÚ;Íê­¡Mó­Ôiè"TŒóè Ú,v\‰7³šS‰‚ €FJ`æi/ñ:ò¦d¶›H¥®‚ 0Zœih“ˆ¦k  ÏÈ|gê¡Lˆì‹ QLb¯¡ñæ~€6Ðh åP´ž•-ðð +mEj×™cï{¿G³O6 M$ËÁ3ë Rfzh€›±¨e˜þ77É6žf‡ü€@/ìþèF´®¡%3,*¹ –5 •1uÞ§>Ih¦vÝK4±Oþ£¼£¡™×žL„ÒöÆ8ðIŽ±— hà‰É[’+ÿÀÍÄü &…ln‘‰‘¡)EPØk2“–$Ã÷#({Üûú8[ þ ¶bÝ©‡nèù×*6»:tv’ú'©ˆrUŽ9˜l-žÐBCË語mÐÇYë]1QŒdÁûàˆžñã @ËæXÝAÑÏï”sÝDôÔz ¦T~htòóh·™}ÅÜW m,á`þÕ> <·YiýKŠÓ.$:ƒ¥"3øw Ò÷ûô„‡Unjʼn “Ýu+í˜pÒ7¾=¬5‹Eº¦\B«%_å²ÈZh£œ÷"Ѻ`6»÷]‘·ˆ`Bá‡D'W6OhS–ï˜pZ5Ód\Rmß<Pù§ ÆÛDžé‡/"j¾¹;²‹;TÂ(Ùak®bH¾CzDk¢ Ç*¿¼¤GwðÚݦQõd~uD›ŒMÐFÝDÙ÷ž¶ÒY8=ÜùK€RÊ¢~˜Ð´cÕ6~1å¥ÅÅ%%7÷;;§(3ñ±ÐœïºA¶†×OªYÕÉÛL¼I§Ry—¯ß¼qãƽǨ†¸ûߴФ}î”äŸ$ßÿÚ8˜%Þ«X\RúÔ†OI¿YƒTqe´™@ãLËÀÏà×ñ6j/Óýõ8óËí«€ì3Øܽ‚Õxë*ßZ¡T£ ´-”]ʤ›nåÙ¸îMÏ™–a—Y¿Š·qêËo"}ãêm´±X6Y–!EÈñyÎÇlÛµ>4Îûš˜âØ‘²šÓ\§4ÍÙ *½y cõƒ9Ê»é$ÿï•™nG‚³:ˆ*Yì¥Ò\Ä àî.W·ó/×Õ ÂØ`ÿ¢–PþQ¦À{w¾biˆBå-H5GbÓ“"»µ§.½A×ë|;Ñ€’?¤y— È_› Ú¥@KCÍ<×ð3÷Vv³ÌÃå¨(7>ØÙ#îš&Ú@® ¿–šã¬[ÚÿøI júøó#†d¯!„‘LñÍIkf4Qfe¢ëneÃï‘Û ôf/ƒR(»¹f&­óè¼j¼Ã¸(µÐ¥‘îÆ3É>&VØMÕ¯’Û09NHg.¾?¥÷›~„6S€Â—JmœZEåìN¶ÿÔ/Še’øB!ië}¼[Ü­@Âþw°ÿšùÆÔƒ÷UÇžOSB)¼ß¸òÉ1ÞΞC;biŠ(õÎ1^b ûõ!z8º%)æÏd_Z–Cr3bÝ$z™‚dz`?+²¾>Ø2p/ï’€úÜkEŠ|Ø4[qÌ@̵ñúst Qm¾VeY†?„¦ñ|“Fõ½Ì%Skh3Y•kÀ Fv÷éÆK 2¾öÛrM~nì B­ïOH$où\%žµWÃ`‚&+1?c;/1 3uÉm`i¯ÌK9PÚ…Þa ¾#˜Ð6£G˜¥ñg†alyú8†NrÉšQÍ~åêX¬¥qÌ­þéæstÏkÚ! ~$·šú橱ݷ}Þf{)®íCˆä XLð¢ûì» H§é¦øsuÍÕŸÓ7wŸ„ÜSÔáüE…Úã3°ÒúĀ溤ÍÛ@Ìá /¡ýNÊŸ’Û€”,Øž~ùÝ_ƒ7¥¿jRuKg¤¥q@Féyö„ÆmYÓÔ÷j?t•& ]¨îG’ S-¬v惕 ²bß„½5¶¾¸qþQ‹Š¿{C2²P²•…±ÉY 1þªÍµâ„Þà𜢣‚i4ZNÔÉåG{!÷hÒñzÂc*´ù¸ÕÔbte˜Dâ-ÊÐ5¥­·dÓ©.Ö 3 ÛÔPîæš±]UW Àî;Ç",<ÌšOs JFÖÔ½0;cÓzx{^Ÿ37'ÝD—K^âv2ƒ¾3L@ÆyDœ‡$¯ã \ND¸X’Í|bƒß!Žñÿ}; …¤±Óí6\IàdË2ç[Ã.3Å©n *Í:2ÌÏÊ?›Ã¢ÀRâÜÿÍØ >»êez¼ õ··¬ž­^ äŒb¶"Tßá 2Gx0)‹¨¢íÙ.¹¶oaµ9ŸM#Zºù‡îðÂQ¸Gk¦[»{_y»îÖôÍ>kss“bȪJe¶B"ÀhÓBÿ‡éÛ·»/õÍ?M Â‚‘º+<†±)‚3&3¹ ç^¨dk‹‘Ž¶¼)ÏÂÆ’GÑ~{ þ­8”˜R¿´NêrL¨X¸¶Ú ²v:ÄçhÊöùŠœÒïªo öûódCsoF¤±CR¯£·r¯óD*•€§0NAŽ;ªŽX¼/hó´âxƶ˜Ò)ÉX ¸S¬†]É€5ÁœÊýmÊw;0“IÝ„íã+B’™W4=£kÍËHVçF Ø4#c38]èì‡òt”š¯¢ð<¡$‡n‚#»øÅ!•¹% <‚#}ì„<—`d®†¹S…¾€ÑZ‹Æsô öÃSØÉO ] íö»h 1þ4)uªn¢ËªÔ¡`¢[oa}ºµStZXëpÛ¿¹Z¨RS½GGM ?üê•·Âe’ÚÆW5od6‹l¢ÔÖÝ]Ë?•8p LxÎá-£ËX¯þi`°0¨ëˆB¡Ç¾ù§rO“É”õ¹’I¶š%ÖüãAŒþ‹ï¦¿`¯û%™`(‘ï/l¨0Â#Œ0ÚHË£Å5ëý/ >©¨Ul81/ŽuW?+¯xVÝ5¼¬ÙBÊÚêkÊÊÊëš¾€Zü'mù𺬬âCK¯*Òq©SUZZö®±KµÇÁßÏô••TŒË´Êïky^QVYõú;t¬µm}k}Wõ¡é_½1÷5×W”—W½®›“¬óü ^ñtzUm¦aôÇh⃓_ÒzQèÀã-¿u‰cï.›šRC£ö&EûSÌq¥}è ìé0k¶ƒÿƒûÝlXÎ+Œ:èÃç;fLs² {x ¯Ë9W6Ñ'&íæµóv\Vª 2ÜôDÈaPLéo–Ö ¦« GDïI ó4Ãqæ5.”–›mñ&°”ߊÁ†0°òˆ'Yà””¶?Ä×^Ÿâ3$Ó¸ÞP{˜!y ŒyÇ£mÙÊ•¥ÅYææÅ2ä’Uˆ™xyz²¤6ÊÕùÙùˆíHò¤œ(ìAV]Ï%g¼Ãð{yóÙ­äUDÃMôÖÇý‚ÞfðLø}ËÀhY®md`õ$òuNW…‘ ¢IØŒaåóm}ÆvÔØI¹jË%WvͶ_ßK <‚"ðJðcH lªXªÅ *ÅÚl}¼×Ò«+(CÕû+OÒ°‚M*Œ0ÒMM÷÷˜Ñ­¢ROÔ´¨|¾ÁhžiRy¤ØW“ÈJ’uäo¡úIuI4dS-v<ê±²N$åL¤gÔYµÅ_ªÇ½þ£þIwÕŠýŠ›îx¿¢‰r奜}øñCíÉÄ¿¨L`í2TÚ@ç­–&‘~§a A¥}.Œkõ]¡Úè&m6Ù½:ŸBsÚ~÷Ö „|yìÄ’V@ÑÊÖc~ßP,zÉO†ÅºN@OñQScá‡áeje;¿ÝjW`“ #Œ6‘Û# nä:1©·¦Q© mÑ4RjÊqRï£RbÈSAs —BºWÛ§>%º} zEvPDÝûfâ~”ûöóÏÔ U ›°ÿ㳫¬rU⢎pmÍeÍz´‚í>=C Y½èBí5§j“˜~?)*z|=#Šêð´ì¹òhãr‚gg’¸ža%E…`*züøuªg#™ ׿.$3¬$ - ¤£ªrcŒ!°F²Î‚v[è]ü€©ÿa„‘N¸‘ ­Üž qŒ¿úAOR×݉¿"ç—Ò}f€TÛ¶Fúý ‡Ì¨è\Ô°÷ª³ ,÷¢',ùJù<%ž-ÛkdM3HôÎeÅ%?·ó5ªµ¼„7ÏlëBøüòå‘éØ:%W—5ùþZö©“Ça:éG³q=yú²Bt¢Í@ÉI3çÝjxœŸAüœô–ŸåíHo¿îi½ï jج‘Õ×â ¼]Ô¢Æaoƒu’"”þÛ.ìR #Œt¢Í´ÁdÁÛîÞ¾îÎfOåêË^`B ä(âÁ„ÿ¦©³»³!ÆW`Æ@¤ÄoÎ8UÞþJòfÆ)hoin©¹å+ìãLocz¼°½½õÖ~¡ÇØ««$BdºûLI{{ËÅ$g›€cnãYs#^q}{ßë‚lSºĵH&[š›»;^ð ·ê»š›[`a‹ÔžCÉ}ü¦ -«¹­ë›f;4å6õ—-îÞœ·|ûùÓÍ£/Uõöõ·¼jnJ¨ÿ¾¥Ë{DdÁ.ýŠ=é|z=ãä"^6ÝnnÊxÚÜÑ‚Rsï0dÙýìäÞ o¦TÌWký‹›Ua¤ó$²‹§Ó¢½‚5À¾•ÆÞòœv!‡¦Æ‡Ùnξ»2g'?YØGÁPEþ.—€KÍ 7ënëìì¤&»àE²Ñ/]J´wtI9]€îý°™¼äp{G׌ Åj†`©·v÷O;;û°½§&úŒ/5ÂÞÞÁ;|o×â»R~ÌË38JÍ¿¼?›ìœ|«®WöÎ.NmM<¶Byy;ÛçÚ òúÈ£½¦ž'°I…FÿuH1V’ôüû¿§¬wç«ÄÂáÎÔk¯†°Ôaô_‡äâ%™BùïYõÒÕ%D¸ãR?á.€éc„Fÿb~ª¯§{YŠÙIa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Faô—£ÿœ_ÓA endstream endobj 642 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 159 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 34324 /Filter /FlateDecode >> stream xÚì½wXTK·'ü¾3óÌßÌ|ÏóÝ™çÞyï{ï›îQQ ›Î9wÓ@“sN (‚"æ fŬ˜Q1AA1 $çLÓ@ÇýíÐÝtDôxâíu<º{ïÚµ«VUýj­UkU€…,d! YÈB²…,d! YÈB²…,d! YÈB²…,d! YÈB²…,d! YÈB²…,d! Í’TêTª_E9´?UÓ%Ò^ük\fäŽñ‹ºùÏPS“ŒóP™ýþ×ÖòWÇj“üœ¾ør…ÍóVeö¶Q{rÜ°³kMÃÆ™˜+ÓÏÙ|*ã~¯Œg5ÀU?o_zºüß9{¾K'žj.ôºåÛúÕÝÓN 2‡µC¡ƒ«‡ÀÛb·ÿ°J¯Wê$ì·Ÿó¯wÛÕ¯(F›v¬Ž!¡çÛØX£ˆœ5;2Få—›YÿøºQ—õʆv¶Ö‡JÀ_—·D/@é;"Sš)ÄkÞ|;F„B§É¢HÿzªhŸýßçXÛÚêæD[s_þbç<+ð|‚ÿƒ C Rüä`£†Û™Ÿ¿ºzP@!â0;[[÷ˆUŸÇÀF¡¦äƒv…s|Ö_Òf:ðâˆ5J8 P ©8ø yoÁ܃1`ôóeMÕd3ï‡Ì7¯ÐXB¨ùs^‹ ë†á\ÿøÁ#餶˜Jù e=$®ÈJ+F˜|zð("°˜µe=³aÊ®P×¹6¼êÑéæ»0'ú¡¼ˆ£‘ jÅãŸæͳAj‡F«+3çF“â'i3iC.šÞ7©üÞÌw}(ŠÃ¸œl¯uá-@éUÖŽíÈ{mØj+‹\ÍýR%ûî¸W¶|µË!³€«3ÍÐåó#Ë7ž{a ¤¦pÕàÖŸH~?¦E]¯ dzý×Bì²#kÔm…¬UA'ô5ÕØgŒíÒ´¬ äÉDç¶xwœÛÊ1(ßV Ç•m_£BJýuÈåÆdœxÖu¶]K·]˜5šO„âÉažÌ¤ë Ú4 ¼y·Z!ôs½9j–Ï/®}âÍ3ìËs? 7ó©€/N„ʱÊÚö™’ÈÚhdV« ¸²Ä³¼¸²9Äi)ØúCî °WGL“²Í‡b—ñ¬Ê{¢“ƒ&æµ)u³^H™{«mú•±–t¦—©òªòòZŒµ C ^6Ùc¹nJfÕ’³R>Ĥ’‡¥jIUùé ÆuÍîPÜÞ2±úÓ*E<‹±¬À,è@ŒŸ·«½ÛòSZ®ßZˆ]V ¡Í !wó³>óÝ`MÁšz¢š…€h ³‰èÐ…J5!"ßÉf–lTFù«Ìˆ¤:÷¤«™Ä—ràín§èàï­þ.É·?š¯ì¤ɶyê;Ë6PåâƒËý±dš³otÕÝdmÖÙî8•/$X'f¶JÙíhd2BLÚÓ3ÁºâÃÉ?ÑJs¶;;ðidæéÂZ] iÍZ§P ¦gò^°äW÷¯ áñ8ãpnˆEɸz(ÅIȧ2s+:ô‡^ m߯noYt±RH%£P'›Ex||¡SØz]Iü+Ì‘p¼°, ÏÆå\ÆÂèoÔTcL ;Å]t\ƒ6þ›NÏša!8jåhƒ@l+ê¢Í¥.³o¶=É${/6-Ìõ}¸ó€?üú³€bºþ_IÀé$øþÿ AS€‡Ó(‘/+àGvf?©ˆ v%;…Þyún\n ê%4‚›.Äy°ÐeÁéœû‹<Àq·ìÀ­ÎWW<œ¨8Ò‰bX_PL ¥P¨)jC<«í¯® (·ëÚ[>:ï-ȉ÷ÜÿsðØÂÊ Ë"ÀµÝZs¸J‚ MâµJó|ê’P5ƒß]ÄÞž æ{¨6Úý0x±3Éå½¹Y›»œãº¹¾·Þvºjºêû÷C×â"…Ý©ÔCÂŒ5¾[Î?/ž‹…ï@Ì‘E.l+_§âíP÷ê'! ýtφæ-Ö/Rb°#7 yg¼ÿÉ’n@É6ÛKšš5ÔÕùÖ;A›íóÁ¾«/,\L qH» 2˜k%¨ûüŒèŽ<)]ÃYU²ÃO‹6 žÉûz:ÚZ5ÔÞ3¦š m(/%À‹~ÔÅ•ú²ÛìÑ×]­:$‘)¾Œ6 ‘þ?àÿ|è¶zA’Õ(¤Àý#ðßþ ‡ëC?jP¥ä$”`C5Ü;ÏB×ÞAlhÝFÁ6Ÿ¾Ó;,ÖŸÉTáîQv~[a˜/£ùã àŇ´ûHʼ=ëÎVâ6–qfií…¥"¶°„SÅËG÷š‡Z›—¶Ì ÚÄœ¼ßÕ>Ýí»$?=ÚÈ6qЫʧ¸1»²£Mjg"Ó©§03d›¸¨•O'Î È+è¶ x º4ã?¬‘»b„}õ´»c«|6ž.笕ôù»«`vjÛíõ¶¤x5[a_k»ìNÃ1òâV†»=“A§ØnÝ`£bð|'-¹ºŠhXŒ6“ Ôù©Ï§ *ö4-’– B>׊ªôË(øÛPëÊ“8´gƒ²¾N´YFãð]œ§ÉeqÎÑ$o{RÞ‡>]´ñ@aN:9‰„eŸGf!ÛÀ_]Ý@i Ž×Ôhó‡ÿ Luø ð‡ÿ@F•>(Áÿ&B õø_Ðu¿L×NjÚìÿýàXŠ5ÞwÄèÓE—Šx J´¬¿7èiT‘'õCÚ¬¦ZK0XBÐÎRc³Ÿ1ÚÐè Ö:s<7Ày…áˆÜrä’èlîé—ˆ\¡ x¥è«Â’Í =Ù¦ñ \øQµ½e%+|O%ܱ¾m 48ÈÚýØm8B'ÝZ¯Ï¨˜…llJ2ÚÖPûîÝ»›I.Häv'ò¶eV ¼ÿ˜(Œ¾&ä3³j T/Ùµ8ôàm½|d£ 6Ð<¡Fõ¤0æÉ‚Føõ!÷ùø;Ș7²bh ¨?‡æG×uK&¥jA¿þMè¡ÍÍ›‡ YÚêïÊ8L·±È1~GÉO6’ öpƒº›N–­Q£MwçD­ƒh{t‹kS3 ¡Í\z¼f“mäá’žO˜B›a?[» €îrƒâõ¶ùš_’XÒ‚}µ&Hþ–…—ÞËkó÷Ø @±djMê §õâõ3í‰ø@¯w`Ù†ß5wÖ¸Æ^QŒ7ÓèR% ƒ6_«I©ÑFññ(8úã5)¬ÿ7þé߀¿þYmhên(àÿ@â øãÿ à¿üø¿‰95–eÒÙ‡ízxz¹L>vbM0‰L Û˜iŒLà¿™±î „þâì*´ÓrA“!$ž1ÿà ,ýþ€À}&•£†•3›ž •Ú€ôáÚR¾Çf•ÚÄùsÜ<ÃB!òõrfº~ƒ&…  0\I°å¼‘ÿXM ¤ÏÓ(Lîá¬EÅÅçcE‚m0Ú,ãî¸\£Ö® £¯Cß,X†ö:^ĺãî7Hu;¬r²ŸBci˜•Ê8W„˜À†<¬ˆO$€VÌš‚ìQ¦‹=‹N£Øû¦€°«ê Û)R›[€ ùKhó‹hR²\tʳID¶ù|<ÔÆÕmäiTâc±Z¶™,£Ú°Ú¤°lcç;¨ƒaXâ‘O&eùzöüÍϧÆ*åR™B ¢ÍÂbÜÖï6{Mg=¡·ìR„êÚ@v Ã~§P΀6¯®m`{EéÛmdþ<»œ—Ý œ‹ b°Ëvÿ|=Ü÷4”ùFèSÛC\–]«Hq˜ÿ£Ð¦9B˜ˆ]Ðõ‹‹úhC56]¯¡4O¡¿_Y5• ™š U¯‰Öçþ<ÙáÊó&£•kUû£3»ŸB9dÆBv@ÕÀšï0LšCrv„®È€šéÝEÏE¡—á7Øm`óSËE*žÙ=d¥FØ@<€#ªêcÒ`´Ì'Ìwl•Hõy¿w¾íÛÐÊþõµMŽak.!þ8´™ˆ%bvT©k}-Îm´;аí±¼ ýÙQ95H¡1úAf©f…6Z¹êú®àÄ“#Ÿî!² òÌ‹‹ýU¢ ðæl Ï9Y#€1Ôv›i´ 6²œ"ëÌx7æÊ\Änc‡¶Û”Su²Î2"7¨/Å[íŸ|´¼x™½œç˜}&„Lrd·ÙFÀÚeW@Ý£ûÙy4'P§zoÓ”—=Ê©Q9w9©$×Eà»3¬IÊ‘x–µÈ;±Ö³UCun<ÁòLD«Fм}ÊÇesZ`#ž.Úl=?kŸiÙjjU³3Ê¢ µhsmÈlFfÑF| Â8-•À?ÁFà¿ÃãfÐZíþúà¿þw(å”j¦õùgϘÍ-}# •éÕ@ióe*•]'.Å{<íž[A\ # Ú\0aÍîz|Ô†9¦ÎJy9†"\–§S“hãinM ±#…JðWÝôe8‡B ƒK£‡eÀÙXoôB½®{!Â)`?Èm¶WŽ~iéSO¶Œ'²ÐBªvMjãÓ.³ýÀ,ÚÈwðm£ràÊt<rgQ—Ý‚–ÚM  ”Õé'O{Æî;FÖ6Å„ˆB{1¢^ØŸ m¤ÀÖÔ¼jä½Ûéa!+.cÍvxæcx>zŸE%ã»MIþõú…I´Yž÷Á|§ÿIж¨K´Ãü—vV¤ý¾üä–(Âæ 4cJQ~m/‡J"‘¨ËvçŒËa (Û°+0ˆx"÷ze·žó(4¾»AB-à†m«\xf#у%±Ï>®Ó@²ó¾Â ÛØ4‘éVÜ0b0d:ßÝõÒp$ ƒñY²½c l±ë?æ¥2ð·ù“Ö߬Åãì=ö4, ¢;ø]}òA¡VÞš‰"·Â/ôUeâñÈÝMNÌj›(k ­Oz'Í)žžslžé˜ÓÞdÄÏùÇ߯7Ãþ6›ƒÒÏjί1MÊ–‡§¬BMçš AÇÿ;P7 ,ÅB×Çëáõ&[uþß ŸZ›Kåè'ûülnÌ!'ò´ùÅu.™@¡âИà•ú »Á€ðïslõ+òÓòZæÜ.¾UÛ—Á?Sýd[Û“UÚa>ékó§‹5ÓhƒøÛèqe½<ý.8£pÿüCf§NITÌܬ`s6àþDë˜.·òR4ec=¦åÚý£¨A¬«kOõ¼Ÿƒ¢ôª,F·À(ï-fýmBwæNÏé#õóæÛhým j=ߊV?­´âlæu˜Ò¤$]o¼Ø8 …‘rüJüžC-<_¹3–¸)³ IP}у|I]èþ;4[\í¨ #Û­hZp–ÚEm±—]F!r=(øW«Gj´ÄØ.œR©&zw&’‰D"™»íì '¯¯±1(2Óñ³öWJ„6¿ùÿrè¹Ä¸Ìky6ú•µ¶&é `mÁߪú¿¿l3ƒÿ‹Ê䜈ülº4—±Ä¼ƒŠÊÜ,ƒ Í|‡]æ‹ þu{SøÅ÷2—Ÿoô%6pHP}ÙkÚÌÕO5 ?V}ýÅD:½;¦žê|EýïzXÔé•ÿøÆW‹¬ÑÎÅ-J“ÞUæ=‘T¦Ymäô;M{·î¼”T3 íLð«R}Q2ª;ŠÊDëM7=xÕqykÅu“ŸR ½ Ð\@¼×-§¯Ìzø@9+eõÕÓháÅA¿h4ÑT³©¬QSþò¡ÍÒo+ŒÚ˜¦Ñž¶¡ å/R9Å`u±1=­øåÙþú&°`.$ØW~ÇÞ0ÔñY<¥~'¤&{Š6_Q‘XúKÖQ>ð6;c'Á–R3 5=­@îZ—˜3o¿¾aATšÜè†ñIØt#÷Æ–e¾$ÿS¿¬øñ4\}üBÁ·UGÙ]–q¥ü×\9YËýS§ éä…¿|ÉÚßÛRŒ«¿ª™çWG£uÇN5à©Œ~‰ü—ìT}åçÎe~è•3Eá©.ŸÍøúÈÄíºøε³gÏ^¿óD|ïP+ YÈBú Éœ_ùh†˜YsÖÁ¼&‚DTfž˜þ¢Ê(¨õKÈ?«„3Új,d! ý8E_Õó¬QHˆ2J:ç´&%p÷PâÊ!4 Ïr9WX…X½Àñ79ÒyvG‹²±±åyD濨×™ƒ·QsçÛ¢lâvhaA¥âm wt §•õ׿{.Ó][™ YÿÐ>®WÈ·ùÛ©®†kÇþü9ŸöÍ9ÿb4¹³x?Ï>±èK©&¼æZÙ¢á*£liö>WŸ~2¼€l ¥wtÒÒ‹,d¡¯”múX‚®ËBaÆÏäÓÆ–žW&åô{$0ê½³á4â'3XS äR]·jMèH¾ONotON×æ0øt=#<ƒK!vŒkMíí"4‰CeÜèÐ"ÕŸ‚íÔ_²«º¿_¸Ü¤¬´æÎ¥E+ÍH>ºÂÉÓcnžkJu˜x&Cq¤#ŸÕ?Æk¯³1óóª'LÉrÐÏû«}O7¿‚,d¡ßîH[YbD©‹6I{u“<Œçr6@Ái1»nhQü[.þL¥1jÅzV¸‚ãëÔhI6ÒÅTÊåVéFwÁž’fM’vþDzW—®ašQ?+´)“SÞ«Eêïo¥°}eP<‰ìü¶x…Ä´÷yT£ŽýÑÆk]ÉÅ@;׃ÓöK<1Ç4ëä:Š'¨ÒbÐROü™GȦ ª—W÷p© …¹îD\|Hó$RhT*Å{÷UKÿ±…¾ÚÀþWªe|vt^(æ„°Ü|3ªãyáM2‹s¯×$Ú@šWÿ[*“'Uªdïv¡Yk¤Z´±â‚rÍAo»…p@ÁìÑ&Ú›|ýeŸmº*³©|w$2s¹#7ê$~H²ŠdYäJxÜ Ñ—L Ùæà'µ>¨”ËN/ôÞžm°}µ[íЩ”¼cIÃr ÚXÈBßY“‚#¥Ä.8òÁJuÐ϶…nÁ{ó§í6`iJû0&o|qò¦Z¹t•÷J(ƳýÅ!6?âÃ{5Õ½É!£„­Ši´DŘŽt±E, â¾ mæã=k×8¡–ž®‚ $m`‘ˆÃFËTÓVby‹L.óRŒü-uì6p©†ï¥Îå®߉#YªQ§V =¢íÅJ ÚXÈBßßn’¸&“LÂ;©zÊ8vvëå#CUÖSãÃr]s Ö‹;æ{h›-Ù ÜêÓoÁ‹Íöè¥y}ºk?K|hÐ6žÓ² $•Ô]!±¼dhã¼rf»´ÿ=ÑŽZ ï’âG§ìxЄ$;±aafq‡Ú@eØêÆZÀßz5©£Ó{·+6E:»®…bÉoïôXz¹›“èÈ^~GÙmŽXÖ¤,d¡¯F›f¬U·ÚÜ=´L“¦™å¡Ñ´7€Ìˆ9„Ä´¼Þ˜‚¶¶²±¶&ó<Žfª¥P¤9“J±µž»³éì$ŒÕ?ü;š;ªDW}rÉ.› ‹ü'B³V’€Ák«9Fþ6; lµd3ߪI ;,¸ô¬ò·A#…n{¸gÎmD¡RõU. °gpxt2eiêd“¯âý›±z¿~ï]Öf´(ùœ¥ÿXÈB³ÆšYœÚ£¿éÛ 1Ïú›ô=6Š«2äjæCF¾Ä3ùÛ¨ âp ÖÓ¢²gdƒaf>xÂ"ÛXÈB2 ¹¸½òÙ}2–ún`Ò²rm! Y解±Ú ‹c—ÝÌ­R8k¡¸ìœÍÜè}ïL¿Ö”ý´xs]#Þ—x±´{—'Ñçì~6N‡£jˆB¦E¬ØׯwB”ª¾è‚Ÿˆ >t Œ}Þ2l²kÊÇ›©TÖ  XæÁßñ°V÷õ=Žó—ÜèG:võýÓþ".…Bá9ùe=©Fhmn¼ï°óõQµê2 WßÕ`Mo©ö¸Y¥™{åÕõTfå¾\k‚Hò³À È…BiÖÖ?у%²úŒÜ–2RØ+OV#uÖ‡q“oö=žƒ÷Ÿøú:ïU —Ð2BghC¡ÑìÅ ÍÂNkÖ*ÞzÈÉD:1:>af»³w •ˆG¥²Ùôù æ¼=ÐATãv„ƒ'¦`’ʤW7¢‰½êYor“Á¬êœœl{}‹Ë Äžyn((%TúCxo´DOû]ôÐfŸÈ:áf?[ºÒ/Z50>)iøS»æØcmºÁ×;iÞÛö°©Ý¿|ô¶zµJ¹Ñ‰qô rúä +ŠÓGð«Ì½5‚Ÿù“\1PeCr‘ü`ÈÄõ4þz…y´Á“9Æhsr5wÕ©j@¥5s¢h_ÑP¼iÏeƒe:ʶ±Ü·#¹›E¥,F»Ü2hNïíjëkz‘4™I:Õ0µ˜ËºP3`’]“ý¯˜ÞG¾Œ¤ârQ4zÒ-€1„3-€¸ãµ‹oˆÁ_ëÏcÒhBGáº}7ma´Ajyiÿ7gŸð¥¯;@9b4^àø|z$ïvqóz/AŽG: ›²®¬ËïÔ mcuQþn..>ÇaFˆŸSíi‰"‘($~Cý8 n?G£sœ„ÎCpLÙ•ý«ÝE^ÑÅu#Ð 0Ú ÈÚÃ<]<o}è×C›±&K‚Š¹Ç6»»º¸ù†ß¬ìÔ MÐèdsŒ¿«»Wðý&©º#µkcœ\×½…4#,Iv¯ˆôqvñ»Ó uÓC›ñ¦ç\€Î乺ùƒŽ¬µ,>ØK$r]sð¦rF¿ˆÊÛ'ü=]\<|ß,×ö·œôu 'ƒbÖtH`'«Ö{œà´Ž×çýc²b…I7{µÙ­ˆåWBÁÅ ,äéìîš[Ñ£O7:¯{’h…ý’ àÍ^¬ÏÆ,òµ² Ïe‹b¸’JáôOB‡giÑæêþâý&%nºJ!8Ô4µu´~tdo¿ëÕ¢ÍPí]Ð1©×–øS²ŸB1S×w¹1œÂÞw Œ÷ö#œø4ƒl£6M¶VàÍÎEâB¶>×3ª˜0¤kYؽUêhÌd›ûËÙL'ß·½:ë­÷=‰Å³*\Žs? 46/鞇•³˜ý‚wj¡/ÊdP„™B.õ–ÉÁÏÛ÷1*Sâ& úFÃèXç;µl£R®ò䇦ßëêíín,±Çcî5çRXk¯B#zðãE^PPôm8*­å´ ”™»6?o…ªßõ&‹Êp¬këêîlMv .Éø/D+¨éééùôìŠÎ:ZùI*»²§:4(5R’v|ÚYûnM/“@² Dsð\ÝÔÖÙÑð„OÀXªî’cqt*^O¶Q(^ÝH±÷Ü600ôߣaHe[{{{2W‡p㎘c|땵”ÐÔ°&Ýí{Ñ©m­ 'ì`aWOoë»›L"½zäÑm‘—œz©³«·»â K¸vÄRâGdÇ.%Ptj-Û/±­§·»¥:„d·«\ME¯RÈ\¯³÷+:zF@†_Ý·ùq½e/µo@›ÍàEáÁŠ\]ÙFƒ6ÊÌ@BøUõцµïë{GA´™ÃH˜|Ãarß( Ëi´Ùí±6~ý¢H~™J3h„!„lÜ·¦Ýi|Ä€9på&þü”Ü/˜Q&Úñx®æt)óhÇp];&¢ÚÚ`IáÛ_WhòùngÇåAHÃÕôÉtê¥x”y,##ãèþ t^ĉŒŒÇ5LÌ€7—¢D‘9ïÍ)búµñÇ  Ahø‚6ŠÉf:• lj@ 3VǸ];Ý;hO7òO×ÖP]!<|ºÉ?îÒ+¬”ûÝlW<Ôؼ$÷ ˜ðG0Ýæd©úh¶É‰IÈüÝ>­&5.†çh¹T¦’ïÍÛR<€² ‘^¨9è=5Ü=ùÒsc´É ºlPo/›š‚ì@}EóQMˆ#¥LL¡Ò$ŠG«Üöj5ß–»ÀZŸ‘¹ŽZåÓ›‹ÕE 7}AMJ•Ã|£f›ì-u.ý­Ô4Û+÷-¢„¥"b°J)—)T“ýïÉ,ž6Ážh]yo€ž»VÖÂ&µþÝM¤°záþŠ7ø»ìy2"†9/§QÓ6UÇÙŽk¡ó+Ö`ýó‚, Õ·¡ Ø5Et|aÓX»!ÚLÅ‘»ª¥v[ª›·=Ö?é„qž:²(v·º› Å‘}O›C›@ !éäÍÜÜܼ[ù\êž¼7ÚAyØÛ&êH±«±îˆ•÷×bhNrMó›—m¦;ÈÄpOÅÓ‚XO®5ÕÅÅW¿”ÒÅl!'6ûNŠ·rÀò]ÍJ§;./nÞ¼Þ6<9ƒxS½Ý‹¿íñìÁmdC%4Š½D¡Ž:/Ü›ä°áÐ_†.„ÎA¦qF‡ÆW‹Ý˜EõºÇÿ…b1ðQàq9Œ?ضLm•÷ÃD;ª nŦ’:DtѦ c+™Â‰_ž²~ãz_†Ý¦ÇbmÈìn¥š_W–¹ºo€6¬#íÜ‘4Mð\r2÷•F“ œÐXí©Tú§qåv/'*S]&.—m;g~fÐSsé¨m }»Ú(Wó™«Ÿh†ü쬮w˜3™K[f‡²u ˆÜ›MÃÍ·©tGC$¬Wúm ïî\RؤºrʳäÄèÓþBÒ“ÆQhwÁá4åå°˜T ÑA´(]aŒï€6ÐÈ(ÚŽå%|¼´Amä[y¸eãz#¼é’5α òm s°¤×¬l¡Í³Y¡F“sê-ÜŽ¦‡÷kŽñzz>ÞÞg¹¾5u>óú˜NÃËjíhNÚÃ3¶úŠ¢/UêvÂà@o-?Åäû>™ÐÙqø !#sà¬4)¸Ò<©E߆6òÑ7t ],SÛ7®o‹÷I[dj …ò¶¯…"ÇÈngZµxÈÀë‘ëΰSË)6û›LF1ÖSpåÏk×C›n<ê¥f#´T{«Íj´a5ËÕL:ëqºÈÚhÔتò{ÂÁ»µ@¿Ž•X6Š3áN7 ”h ÿÓº½»¶O8àÍ¡Í~wæ¢ü6ÍLÑá4U0`l¦ÙÐTõ|u„½ÿº|IG ãd˜´D›píšçxÃy 50úˆD ƒ…¼!»ùÅFK Ú8°,’}'Ù¢uAÜø/¡¾Ý¦ö\(Ýg'’`«kiö  Ym·i(À“¸M2½¶þ1hƒÐÆAtzÚœ8ÒèH@/=zWŒ<—ôŠrÃöKõ5)žÛ¦^:FŠ¶£±ž•]ê^_v) Ëò5”>2 sòqö½ÇÇ“ñž«Á‹½èÅZuÁ%Ô‘pãu°<Ù÷ç´O§ŠÆêªAø”=™d¸º¶A+`g-E]«2à¶R6ÙÒÖ¡úÚ¨“2ùN#2 •K<ð‡î@[[¦{‡í<èº ø]WÂS.ì¦E«õÍîÖæQø<ú²ƒ~Qjsìã­}Ù¯€©Ú•+iä°QO4é‰FYß·ÃÕŸ꫸L!`×ßS &EMÊmFÞ‰p!g>m6Ò¤TGÖ¥|V×ætràÊ3EàŒeˆ6b¹øÉf4'A=|‡?nÛ›-Š ÖcHÜZ8©¢-ŸCÄܯY jþXÕ ·tÃÃB¯íPÍMÀ9ªÅ°žâƒÖì˜)39ÿxjÞ+µÂX}w§(8°pÔ‡­êÚgÜUÕ)ÑCèpj ‡FÉ_å¼è²z[€}1¼„Cj¹´©äÜéŸ!ã¼Ú¨úÚš‡',ØóuÔýþ,]¸~Z ?ã°üµgÁ_—70#w¿…î*§Ã}04€ŠqóO†–Z³þB\Œô³7§£ ¼™Nž1žØ %蛓&X´ý©mFaÜ3 Ð&ü·eÚxÏG¬×±–Òç[ݨU/×U/ öÆ¡`°;"3È*ÃpÅi6Ñ+ DH#z-ÚU¤+ÿ¯v:j°êF4m‡®”ª#w‡ªÂ\ù G/?W{®ûBdïXùËd+{íD#ÁýyÇà €|…뀉£L<2U­óÌ 3“ñã*Sž*3T÷Îl|‰»žïbºn›~ÅlMUÀ¬}ÙµÆLÉá‹‘R*ÉcØÀ|ÿ8î'T™ÎD÷_“þÅ:X¨Ò Ê×5Zš8ÂÄá_ªoè*_ô%Vé·ŸyWp³Û€÷>]Ýu¢J1“ýu&g'ã-¾PHƒ·TfóÑo Дðà¹Cþsâ& œc1îC‹ñ¿äJrFê:!-ãý ñSÙà'¯„«–¥Œh{Â2ñb*Ÿ)2ïýýi_Ò‹·Í^¼ùT—Í”þÂÚtýÅÅ®ª,˜òÓQÿs,‘Î2 :ñùg‰…7úÙ¤ }-è—TN-Îí?GK›št,ôk .¿:~×PtBŸU_[Šï;FÅÁÅfíH¿Ñ1o|ª»©V˜É §oR™êbú?æzNÿkPcÓŸ¡ûŸ© TFlùýc¦t°žÃ ¹…õË>áiÓèWg!iGáÙ†FŠ§þ: Ê¿ómÌš+_nÒÉþ¹ Ð]?N úp4êƒÄ°¡Ž.ÅĬú©‘c²©41íÖ×±íQ쟹‘F/ß»°þëÝÔvÆ'ëÝP¬ç’N×קûñwÀ'ÊÎaÉtäã$ mvÓ}´.€¹V}¾ê@M¾³£ƒF‘É,‘æé—4¥6{¤ÿ€y%V¶ÖÇ{Èd~縮%¶“oEm€=žó÷”Oýlìšì/%“€Ò‘b[7E÷Œ”ç,ÙƒnÖ(†(T7±Ùê 4dq”ÿ8üjJ]™ñ_ƒ"QˆvX¢£KD#lôyqu›0lpVz ½Róå¿O¬ š½et/òÛ]H.k5^ÏѹÐQ´È,éÀ’yƒ&µ è}}Á#朩Mer1h†]…u drÕ` ‹Rcz®Lf21Üàóææ妇GBR®_±Yé…0SÕ7Y8§Ïf幓@¦|6™À·5ÉF…(™^A”G½hw»§º/E{Ÿy¢ ‡èéN:ø°©5ˆ6TA›Ç‚¹n‚S $[âÉÒ&í’£‹˜$×­ð"óG–¡^kï(?K¦ðÇ DGÜíì{Ád!þdƒá^Ùf[ÐD;¨ff»^÷VÒáw4z8º0±Ÿáâ]Úº5ìkîv¬õ‹˜‘Ç>hËéM³~ £Íú¼£Sàçã]ödÂÆk¯'Õ,JrÓÂl Aè~y}»S¤ÚÿdO„«Óªlåïw›ëÉξ~^t#""²_®EàÖ±Õ,Ýßß›IåíºòF6\ƒÅ³¤ ˆ e[˜Ëoƒùö.w·Cøv`B›Û‡ãE®®44Ê7fdª«;ûoĸñÖç.".›ã½pÕ‰Õ±–½¯;…%<]T¦útçÐ^0Ô¦S( ±[¦Æ*"\˜BW/gÍÉ/© œÙ”#[úR¸N>žÎ{ïmð‘sý/ºó®>,fÈ*h>-M ¦Ri>¡鯇tëx"‰œp´PŽïˆ $s}½\È|üúaÓ Ãbq9;ã¢âÂ\.¡›¡t÷ÿNÏJqḂ~}ÎCðð à’©áë΃ysÇÉ‘Ãå»Ä&o¥¹õñ!®Èßˉçø¬uÄœ\,)Jø‡4±&·ië*‘´õz Y¹Ð‡Ä²ç°aK÷BMÀ¤Ç‚Î|mhÿɃC:9’XçJ¡¯Œ4.öwf8xx9óEÁK;áñìÊE_8°máâ„Ø`†óâ6¸¿ÑL¡û…G«übNmM¤±þÞ"¶½Wa TÝÒCŽ+òƒ£—'ÆâY¢{Ÿ¡.±}±+‰Ä {:,ÇüiÑÈ;éÃõŒf‰b²þÞÍ÷]`“Ó¸ú‡bH¬º ´9³Á3xÕ)=}I5ü¹sa0ÚH€Þ·×©dî›>…V+®ddO@ÅÓï¡B)pÿêx°A7‘òÉ¿s–\¾41Á…MZ±ã:&Sµ7½ùd£#™Á?v’uóR9>«¯2ˆ´ }Sß¡µq¶ƒŸ§#Oä÷ì3$`µ<9;‡á}U:q2ûg:9n[ ±jÀÕšQ=Ú‚'²à¡26Ps-–ë¸ÐñÿSc»B6ÐÁ‹Y+ý8‹«~Ïæ>¬3~º²ìÝ)B—"ï.Ç’ø=*¹ ¯ïĹsC½œs?@acm^ éÀ(‘§Þ"­èHÌ.oê/Ìe%Bˆts¥w4ä#§˜üL£0Õò{ÿË {oBqµâÁúæmITfL•+½¬ör/ºr ÿeOïëT¯5<~ÊÛv ÚI у™vC󘾟Q fæB¤½•NÙgVs’3j‡ë )NAj ¿éî–ã%¦÷,‰i4Ú¢,uŒÕÊú¾Ü@‘­ áà3ø´*é(O¹Ó„ˆñª(g\ÆCHL(=¿$låeð¢ö|8Ãg;òzÓÕÁZ™9Mª$ÙÆ=¼ØºT(ŠÛ‡Ü|q4P{¹Žr¤žªè¿ÒÚP72©Ôm7•bÒžH~Ð £ýíŽöó+Â6ßT³n‡-øXG7vÐ^õÄéá¸UÀÒŽ0 „Å£%›±‚eˆ3^÷“£h‡%à+/Ïùs„È+'±WaÖ—âl¼áµiUwÓ§îQ…ˆÖÑ­œÁqvq•sض|s²ÍjÕŽü^3c DRáë"†ü MaÊŸGïðÏ`k}Û~_}&Ê{9ðt¢•L`Á—Jw:ùF5ìŒ×WŒG9€\(8âÅuB^ê{°Š(ZtΖ»;ì\×°sx}S›ñçÑ"7¾цΚïÏD±‚ÓMË6à0ñC{îª1Yå—×Ó\¢Ö?ÞÍpŠÿÏ°²0Üô¡«I}¿³e±KêeMƒŽG`°‡ûñ¬õÐpRÃÞ]\½*ó)øj†Qát–ÈnTª™ux¡Wäù2 1 A›Šk˽`Gz•BìAíÜ{æéëêIcJ6ÊŽ¼uhš÷…Ü‚Omê=U¤ÝoéXâÎ3×*>hg±Gœí¥â7 ½~síø:Qð:@%v&Ò^‰ Û F›òÁOl>õä•—ï?)Í›ga´¡“!uÉYí·÷0Tl…qGTʼn¾ç4óà·/¤DȃFÓ™¸ÐYK3—üL¢áÞ'Ž5¾jüKhÏÝ™] §ŸJ¦Ù¦U©tý!M–S6ú†NeJäº"ÿh(Ö*ó³úçTÿcÕ䳟 íîµ—tÖ6‡eéÏyˆ6àáxÄ—ç¹7÷Íkˆ‘Uï xV¤çSÀ˳¾ ¹È+²ŠUh§ýÐ0‡˜×ÀL] BhW£ÑOl,­tÈ$Ú(˜ó>3#î}àT{Ϥ….Þ«/|£±´þü<8R™â‰¸Õr@ZË$’ú§ô÷Œ ”Ÿ[9ßq5|üôÛôS— ô(Uõa|Ä)ÍïiÙ.C¯#ƒHÆ£õÑ‚¯ K8ò²===uÏ®s©„µ™e€Îš‚B;ˆ!Gd¿_ÎHs±Ð- ¹ðà•7Ã:õHCJ„7‡ËÛ|R®™øÞïòfÒÃÆàˆ¾w™ÛHœHd]G)ngÜ&'"Ýí¹öž·ká¾Ýpãíä ·‡:±¼b þSy#ÌÃÇå†,Kím7ŸŸç%Áh3Äá;öšÔù+<ž£û¡¼×j}þþ o'/X²9C³ç P’½KdÏ8yf>VoÐý$Ý^À_žÓvv?:ªä3ÔÑ.l­?åÆÇgüD|0—ÅëL*ÍPË6í£MKý8\QVy+ܧJqìÈ ùô̶ë–XG Cÿ4:°DP]Æ>Þ vµçòwf—æç扲u¤@(Ö~×rÑ‘üzmŸí~‘í!äó `jË&çý„ñ´~jKXŒàe»†åê¯Ô=<å!yâuî1²Ä „û Õªu¹œ]^«Ž¾„Ì×w·óù‚µùо£ªÞŠ¸—É^w ü©È Z÷P6•›¨Þ‡óéåÔ…,¶}nýxªˆ¸ú¶±~Xo÷í×|op²: hS’ºÈ95_ˆ'C¼œûEÉ;úÚÑúÉÇz3>CÕÙEööžR³ÑOÊ3”€SÍh3—½²«á¾§íèñnd:63kg¢=ë·µ Ç'b¶—jåyGY´#—ËßrF‚ì¤óâÇ7Æà“ù"÷ÞѪxƒþDûO:mRw2†M§¾‡ÖdÉöØSo¦´U®yì.ðý£S>ö«Ð+òözÇmÕmÓw‡¸s¯~§«R*c·ÓáǺazÎù3ù¨ÏšôQ©ÌúÏÞßÆàΞPï±é8_óþ6j´i‘ÈMz™|Ï âü›ým "èuŸžKŽ|:<³+I•É0ü¼›Ì½˜ió F¦¿ò5¾Ä&B³iðcöö*™¡Ý†™¤šµ¿Çd•éžcÒû×D¬Ê·øëG½X"0~K$‘LÎÜ`wrÎ4 ŒŒœâÏhóÜ FjŽ;aü­±Y;NOH&,Ï$É'Ç•û‹¡…,ô‹Sow‡µw NvvvÊ¿ïƲ±¶öv£OµË•–1ñÈíÎ g-d! YÈB†úµnÀ«¡¦«ç´`J³þ‚ºmê+fM3˜@ l *ÕlsS©ÌO îÎl40]ºßªÆýµaûß­³Íhг Êß3ÎltcyJ¦¨¤Yñ[ôÞU¤;—Á»ñC_ÈCÙ…"Þ啹[}a´‘|¾Dí„e&eo{ë”R]¼ü4û°m¥U¾”v«)“äS!Õ ‹k¼àŠ Ì€ÑåËÈàà†¥uü)ìþwâ C·ýÒ«û¹T"_¸îø°Ú€#älÚR*…Æ <£7¶Ãn²}µEÁÎL‹E¥²ö\,…:ïØãIe0idÒµÇÀ3ÒÈT:O`¿ýu+ÚÖºE,GZfðᮿ°T}ÅÆx>»¾ÝÛÝ…M"¦f–ªÏ¼¸{Ú‰Cg3é¾KÞt ¾ÄŠ=¬ðÓk?ì Óh/êÔ# åÊŸéq÷,Äp!gNqóÓ…n,‡K¡ðö_{eUñŸÑáHÕZŸ]vg‘™,&‘î|é9™XsøÏÜõ3·úy»uØ›SaÜ‹ždïäRHL:ãQÖ¬öj¾}rXA<Ÿ´û2(aîð§‚uärù§[€ºsΘÛORX¸øÛÚLV:ücs^÷Ýmt·5Ïâ›N£2ìí0¶sŠÕ> ãÕyÁ»lÝÏþwazƒk~‹t&šu³q0œ-„NV™m }© –)ÊÊ/®klO)ug¥¬%ž‘g S].ï^¼=Ïø+ì/~è‰Ø¿åéÑJ ÚHS('´Ò¸?aÞÃÝ÷”IAÙ-êo Ü%̧#áÓhÓ|‰æ´cz›(åøǪª¢«¸Âð:¹á˜°ý–ú„»g—R"á“h>çÒ£ï9بjË‹?õIuQSññ8ž„À݉NÑ©ùÀ¨m$5Ç}|RÔ˜¶*$`äC»–;çØäž42$¬[ª|œäàqLí¾xyWô¡[M ®ÊA±šáõc/ÌQËcéËÜ·]| ô–Ú¢p)7@çÒI燎æl‡w/\¸Šm}]ŠTÓB¿9ËÍTO8TÇ»û•3Ë6ÈþQÏn,õqvàãíЋ¶fM©m6“n LEÔûuyÖÌH™‘ /ííR@gÐAçÝO£j*”D¹Ò®Ѳ0ê¼»-zEo8G!Ð*;z{;<ÈÚÛq=´©Ï]ÊŽ¼4­ãO½v÷ötsY|Dn(¥¥EúïWﶷÇs>ôLmf¤KQÎþç_ë ÿÓ² é«{_YVVvsS8#ÚpãH8Õ3ñDgOŸDª†ÃÚc íø‹ß7uŽˆ5+ëà YꆮË$| c:ä‰#¾‡TOé|Œ³Úª£R®â2Ö•õ__êåºïÎèÐ@ÿØp½³±Dÿpò¥ž¼‹/aå¬ûÎ<´'bÁk/¥rìUÃú¡h¿˜sO€f5ÚÀ-9Õö¹¡üYÙ³òÅ®v@´dÎ#F©Ã7Æ›Pû^#ÅJ19ÒT[ý¬¬ìѵS$¡xïyqAŸ—&Þ“­…:h>rdä×BT°o™_j ƒ6ãÕ)œÕ²‰’¬»à]R¢IvCýéwDÒ:¦åÙ¤î.±ý2¦~Ha¨é+†B™d‡-ÐNSV‰T??¿€:³£D<Ӫδl#[Á œŽ¾òÂZ¿‡Ð°4Lw@ñ{_d{;;y†¯–T3­mMÊoÉéÂ¥$;l0vä ÷Š:d¬:nrÄìT5DJ0‚Q³G›>N yÕz Ú ¾J'Ó8.ä–={~sCcržüzzŠ½€O%ãößS¨)<çå"dÑIÿµÃJ´³tåSž¶Œm£-;ýî)µ"ûià_¹Ï¹ð^wzˆƒËw€I(tp°^l3‹6Ú"ó-Û@û¨ìõuÚ÷rg”èâ³.mæÛ9¶«ícŠx&cÇ«‚_ç}´cãý´5h£ÒE›ñÎr ›¯Ð™w/ôJÌzª•mÚ*²Y®š½vUÍ|¢Y´Ñ¥Ëk£|÷^WËeon!´2ý©—š‘êȧ&Ä“R“hJÊl4°ë.Š‡”ÐmÀd­Ù)Ì•—s÷„oÈúhñóÿ-Òäðç=Ž›Üûå¥ DžG%I=Ùñ’Ϧ'\ƒ^ûÐИ´koÔ“UÇK™²¡d˜¬d≚=àP´·[øŽLܾwÿa™±÷¬ÚÈGÞÒhô8æw]ˆãÒS Ó¾ÛOgÀ½q(Àw¶´Åm$M5Vb Ô¾xl{TöÇ Ð¡©ÐN&Š©¾}ûLÀÛLg'¤åAv›‹[Ý6]ï@ÊkF¶Q•çe¿jÔC«îk;êGTöÆò–î.@ì6 Úœö"{†÷]ï+ wcCA±ªÅÞ†UŠ¨1ª  íér…³ýÎj‹Ùzï¥;oŠ.ž-µLªÅ¸V{:›Œ÷@¾ØSŠ²ÃGì.~×0h”æ10tŸ†"UöALþpÓŽóGõáÁÕÂUi™—àPI“žlïÎáŽ#¥–ÀvoùG‚uIó”ÖnÓ_}Ÿ$ð@ ¶ÎÛIÅ}û@Ëù™Ñ¦l÷jìQXJíŠp(Ô3y®YeÐ)ö*éத`2‘H 0V½… äÒc‹Q|ÒÍ.äýœÃO«R‡4)jàçš<‹ˆ'°¯Tv#å¬{èÈ ð¢dä$khýÎ~è0ÜWz”€A»®¿ôßú³­¿1åã=›£½ÈdÇ9äY# ;Z+1 ¸` OúÆ5È.­ñµµa¶VŸû3&F6â†ÿX@ï1”Y%{âÝ18bàòýÅÄ/ Í> |ÐP|–G!bô}7^!¾¶%ÀßùDü)Ó~°º®Ä[Íù¡¸i(ànËs=A/ æ‚ýŒÕ/í]î±A{8»ò°Ã<¿ŒÏÉæ·¯IÍxdöìrúr䵎ló ¾Ä†² ˆ6­ s‰agµÞ¬Bd&ø§iv´0<™Úȵ¸êÖ¾cõ3UEeÆÿÕìÞS*ÕÌÑîȵ/UÑ©ñL„ì6þ2£Á¸T¦ÛÂp¡Íˆ·Mj»éóÐu^7SSÕ»•Éˆ~ýô‚ÙK’슺ün\+<·Ý[óbÂ2Ž-4;ѪÒç˜WXPÑ6ùMï+^=¼45ÊFÙX-žÄ<}õ–ØLxµJ1õü dÄ(¾wÅ…¾öºw–q Ÿ?TþœÌ«TÊüË™KƒA» §G·Ú|G¯‘šF üõZ_‹ó¯¤D¹:/;¥‹€ýu¯&MÏ~²IûónæݼqýI÷yM(JórróòŠÊj‘.×Rù$÷æõ‘É™ÏfSÝ»u³ðÙGÕ¯Ö U¥,ÌË»_\¡·kÍD÷µ["þ‰æÊë7ò{'~µëÊe…wî<|6¥²Ø„-d! YÈB?zš5o9ùuÓd!âŒ}þíN›7WÇ”©Tfv5̆j™8Ü`† U¿­Nòû&åä@¬+G¦öL)~Õ=x²wîL·ùC”ߟr"GÞù•w¨§{éÔ˜G_1ÒîÚÏ=pøXÉÿë þN%©5ò\Èz?5v תªyGðR>X·&ÂŃÁPíOÝ þ‘–WÑî4ËóYò¾Gãñ¥>¶n!ƒÁQíÏ=B–бæòOÁ ²Ý.—ÔkCY~uϼ¿ÛäNcÈëÛ'øD;´{Ô†ÆÁ)ÝíDTòA&Ê60¿Ë2ØžÉÔ4¶Ã?ǚўæÒ«¾¡™CâLm)3ãYÌ*“yêMQ“} »G¡27‰U_ð,-P©L¯mÍÈ µœy4ýÅE7`ÆëÌY™n =tŽv|fEðŸ}ûš O×”3]D~+5+–˜b‹™Šk¾[¼=jÏÍwÈkMOOºÅœw;|r6?6öÊou§V]^v¶å¿ÁÀË 2ÙÙýP„“÷Ø{PÖ䆱»X¯¤}lRŽÚëªÍ‘¼àìµ;Ì~Ѧ¾hâÍfÎ5G‰a;la¿¹-Šº]§`Êœ¦Ÿu¿˜éü }ª<î$X_¾ÜƒI]yÆö×9±xbÐòô!0ÞPfG¤Ðh4 …ÖÊ6 ə͋©d"•ízóe3ôþЇÿÀ Û^ÃHÃr%˜àô¦(Ç5÷•º¼<êษâüæ:ÊñˆmGN•RI¯îK¤à±4{ÿ’&ÄAKÕZ~ÅK%âI±iÙð9ÀÀ§Û‡­ ø>¥¤ÇMÔ€IˆƒÍµ—P á_XKßæýÿí}‡WS[·ïqßxã¶ñÞ½GE)齇$”@è½ ÒQ@D)*Ø¥¨¨Ø¥‰ØÁ ¢i ŠTé-ôšd¿ÝBOùÎ9ï;çîß8“ì½×Z{•ßšk®5çL0àØ‚ƒM‡m ž³<~h‡ O¢ùì;÷áª#Ì6*å’üè.W| éõŠÏê>¦¨-HåR‰$†äfM¯Î(œn‹t5'S¨&Ž¡rÔzÀA¤ÿøM] ­˜Hf¤¾k-·³htãGh¬`´¥ÌŪL·Ètù2”\ÍÓýÕa2k÷ðkååD™(´òïh/ÿ¿úv`ºo2ÄÂ/ Ñâ¡ïƒÇçâùSäX÷ Ö¢+fÏF»âIT§°ããµ1z¦™ŸN¸‘è ƒn“˜L¾ÙBqèéyeɧ ô3å¡yÕžŸœòn${m³‚|û/Œ~‰r—R(T‰}pûºØüðœ)›–Ó)ìè2$½ñt&‹N§‡¿øôØÉŒK¡%ötB?¬ÐɆŸ¿¾°SI”°tô¨ÒâxgŒ—%…J5¶ño…Jþ%ÃÁrÊâ PeE‘¬”·ËÊåÙÂë× 3Ÿðc‘^ü¬mCe™—XtÄ+éŒGà ë-Z2 ‡Ñ0NÏ.îr ?ŒµX¦šx(nV¬Âwý`Oimé¹½>QÍ6ª‘· ª‡Ð>Ñ_ GpŸR3Êhs>Ï2æU(Ê6`SÛþ›N„ ¿Z ÝX<«nDfÈÄ1‘ó±uWX.P(Ì©Î'l1êd)Rj¼ãlü±ß™¢w¾~˜ùŒ#ÐÝÐðCfBÿóoà}N½ p|Ó¦®L®iùªxct0;ÒÑ3é4S ÔQÄ=0ûù“i:—¤(ÎÃ8òo3ÙÛ’:=«œÙaBM&~Ö”;oÇÁû†8ú¾¼úd›SQ>oÀSgƒHØPyð9‘ˆë›QW¦^æsèl[siœ±õ.øÇ9þ¼gju’[nmÅç5Acs¾û“Éš×kÞöbÁ4RAļ“Ë ‡{JXlw±û <³ ^:ÔäųÜö@UqÓ…Å·ùo,-½=DÄY Cï«ÚcÏ" w@±œ²eÑí/¼ÙÒn=4Ѐ¯7ðN)“álá YúÆf0IÎ×À|ÌÏ<úˆÈ6†8²gdw¯šjd1é#ó  %…Lf¾ƒÇÚr§d+>÷4ü¿=f2“KJ ÿ: 'E<¨•g†Y…¤Âo=kNfÂñIfM¸6È¡°ØZd$ U®a¥ˆÏæ†ÜB¾ õr«&•ofÛgê`kñáçlexzèp å‰$6Ê°g2¦+0ÛжUöOÏÅ9îÉÒ¬ã³mi!/䀪‘e(ÔÄÔúZ~ŽëVR8—–ø´Äxµ€Âì\µÉÓf›5ÙÔdîâ‡g¡\3ßÏ#ƒUS¹Ê6ŠÇ×;'V0fø#ÐVè.²9ŠTþíK«ìjõ•“Íô÷+ÀÄ×2¶Øn¬oB ®G½Sý8k·WÜ%`߆ÌNª^ÿM}ÃÃ3‘>ñ—a¶q1ó¾€´¶â]œ$ lfgÊæGßPQ^¡9B™mCÝ~Os¾…µYØ­ÕM6`›[ ,‘åÕ:l3ëNÞTØ…v³g±€Ô†b‘Íb¶L.-‡õ‰¾Èy¸/2YQšÈbÝèD=Æ(ægúûú[JNS`ÊULlójÊy3ùbeϺkg˜m˜ß8TÀá¼Ã7[{+.34÷„ ¸—àðy‡,ŽC¦"3-÷Ùλ֮³”^–ÜýÐÕ{»¼ö]Ò\,p§yõó/içæý—éNáÛâX“ŒËLTÊ¥W½Z+ uØ2¿«8…34ÿ¬ŽëZÅ,ÉF¥al%õDzM›$ú}ÈÞœN§QÕÀm3ÌëÕb›¥·<Cs•L&‰…v² ê‰rñ-©}Q”³³yÈ]´?ì7WÙ¢­„Ú5Áç—C™4­Ì)†[ô_iÙ lÄ6›¨ž êm¾™èá+äh.MyvÛ̾aR„“˨WäÊœ8Q$8ü§] qzÖïc—©Z/N"#`“'o[fÉ{Äïˆù&jÍ"Â6ßàà×@²©Ne^éšAâ FÝ\$[Kö>V‡>뽿‰á£Ã6«lTøvkÝ”›¶á ‡ÑBÊË¿gÞdÈ6Ûl5NBD×××é¼HØó`≠ƒ´#öXAQñå#ÑtG¶Gtk˜£€Lc –÷šF×nâ(E<Æû!t‚9&Ù¦ñ^úÚ\{´Ùæ奾GkWëw¥Ý’OI/Gmߟ]#ÛdZÓv¾˜”kd›ö2P¶‰äm4¶hh’CÀ ÂÇ‚{µFãøP—mÀ”ËÓ|õÙ^½sènVoÍ54rÜ›ìOƱm©?“mò,.¾Ó¹a•m”½2¾qíå™/«l£ìáSƒ‹ºY¬Ç6sŽ$D¶ÑÌ&Š KJÐùwšQ ÛŒ€l£ÑÛl· ©Ùµk^m&ð›KûÑd^Äp ¶YüÌ¥’¡X…ð·ÓÂ÷ŸI"Ž³5’mÖž¡GĬâ<¿øï«îÇlsÓÏÜ1ïƒÎ#0Û UqÖÃÔ§µyŸ©½²…íûc¶Q+”mYh [[þZ¶i½{†ë½G§H9^®çÕ1Ðñ0›úÛ ”°87ø!ohÖ£#Ûè²ÍÇîç—ØÎÁßW—†m’Íq%CZÕK& £'m«>p˳ɈÞ’hléÌòQe–´õ6OrCÝ#/¶qÌ\µü\_[—‹Uë° œîî4÷4ØÖ m×ëQ4<Œ€Jg‚Ò‘‘gFÛ€mÛ~D’öÁkÖå®gR×=+Úl>BvLA#ÚK÷º¤ßíXe¸ ½ø¬ØBÔE]ÖçŒ{ë² 8ˆŽH½Á»ÐA7¤V/coRèBwdÁÑ_˃AÙL¥ýîqC}}Ih0ýêoFÏÛ€lƒ34h_÷ÿ+5V3x›¹šB/Bg‰Ï!Nà§>n7£28»±ýã=öLCÓí `e‡½¶=/´=¸ÈcÒ86ÃØúF%´ôª/þ‰"D؆JÔ¯@ü_RBÔ”£­O=ÌÙ,.Îf•¼E­OépÖ¡éÈý £¶ðx àhj˜ì®õµäÆŽ¡# µ 9yf¯l!­ó6¯ ìél.Fç¥]y ±âtió60E}ÎȈp¶KyÑJ_ßp5½MÔwkNõÌÇP}Þf^fôŸEMØžÔï_ Yõ³Ñ”7¶ùÕQ/þüy›µ¹otEsjDûÇ+Þ柧¾Ët½##ÀƸµ†ëp¯‰—½úÚ¥ÿþ!í• “_ûP©`¡þú6³°ïÛe­Í50/P¯5¿œ¶fF½Ø 66úqÝY§f~ ¾Pýì!¨ Nëþ²AKZ'æ×/‹ ±Ñ{¬ûÖz'É¿¬ã ¿ÊÓçÿÓG RãO zÄ ¥Ïkß¼ ²eïÊyö³Ï´í?Ø¿Æ¥¤UÎÌ. #ÑZL|Ð<ú»Ðžjeq~ñ÷Si¬-'ˆ kâƒÖ_êÂñ^ ß!¡)ÕÁçëº ‘w’uù\ f}HwBec㤲VäRúvNDê}¤ _på®®ógЭ#÷“Ù>ðµ±e&NAÚ œ‡çªð©îšFÞ´ñ²«ëñ…‡…apj),vàðLrÊ?¢CL¹µ/@(:øÅŽ.Ã6YÍÙTœw%)L;è”ïâD«·ØXb_5¤ð²×ôN«š3 –‡¡<‡^“Í‚–'?¸J…Æ"«¢æi¤/.[J2=£™\÷ñ1ð/ØdÀt^8JÏÛO„9óùÆqçáȶÓL‘ýTï}‘±ñ(|L±,7ÉL$0³õ®ê˜BÍ–æ‡býÀrÚoß=ÛT~»µŸÎbs¸<›ð°_œŽõ…à#O;çuøçÎYì®ÂÃÁ<¾Ð3â¸BM‰Ï¯1 L­=ž·M€,bÁåäsÅÓ+Àì³xaÇùÃS"¾™cP£š}šJÒMÅBû€”ùá§Tã0|ËÓmüŽÖcã÷¯…O®l±KU×ðøô°X+Àž|œšš¾s4D˜yh,e‹ìg¦§Á>—æ!³O*OMMö×I FÅí*ÈœÈrÛ™;6EÚ=âniŸ\ßPkNÀÝþ ω7\XÆ–Mƒò¹¹Ù¢¦âh«÷Vòë°ôÉIyÏ»;ú4é82î³È¬O}£““S§ý­ìŽ@}oìsuú¥ÛÀ†vR÷ I¼ÝGK'&äÀâèZÙP¶œß*K‚?Ø2˜&&¨—+óMaÁë|é«…±È̶U\š`SÁV„\Z§:‡šî*0Cž€Ú«>vû*5T“æ)³K̇ßô-XEípìË[®l‘EÇØÔÜì”…ˆÅ6 _–¿ãoeÔAƒrÒ—EºÕ$Ÿœh.d1xs* #O¥^©˜O =5«f`R>~-LÊbPÞ~›U6œÜ$:e;þÆOõ;ôpfvn¢ÿ=“Î[P]WÈÛ¸µ½òéɾÝlß ,÷ç' |ó„©i(®¯£%kôeX>=ñÕƒ¦wôÙ$0×'1‚rFÇÆÀ&;±ÝÆ6á:ô"ï- F·>«€å‰!.£¦O.—ÔeS)¶ã @©PeîuØ}òÞÒÊRž%àRƒ\>9:ø•I$|[c¬RzÜŠiâúU>;77}Ñn“sÎ q’íÍ•OOM 6Ú /µ@$Ôù2‰#‰›„Ë™ám™÷2Ã-ˉ0óNOÊû>½0¢ŠzÀbÓIŠ‘ÉçÁ‰©‰N_kNQ}š‰{ò[lüþµÐVèn,;ˆ ¡²h+³“oÔW[8×X. i¸~õið²Ì0ß„ÀìC<· >$¤áÕ+ûG§wú¼…°©Ûd–Z©‹Ñ79+ŒÍw;Ш+Ým­òÕU7š{¡&¸tm‹ù€–x¿¡ ¸¾i×ú6à*(¼/ŽÕº,|}.v9a΀ì(ŠxAÕ'Ä›)©WYîÉçw Ä£à„=ðŽ%pÌväe}€Jâ#äg'ÄæÖ€…uU”g‡oßa‰ÛYä¦8KIô4¦w4ÿ§¼6`´é>ÅÜESóQRáÅ÷}@ç9=$öÃP} ÍÂM-*LˆÙäµlS­‡3íAM¼—8lf‹|ùq´½Ù1tu3TuUŸ±Mÿëd¾…z%eɾ\Û‹$yy¿(,½dS‡zÊS »Õlñ"7ÊsoäLhº¼07;¿$7¥µC"Pn¼SL&”×IK=Ÿ“/‘G–—tÖ3¥Ç-=÷ä#9N<ñ§Ø_iVJÕÿ¨ö*X—¿Ï1²»©;ÂAWR€=»:Yæl¾Ô¢DVt½Ÿ[Ç•7<¹ŽW>#ïØ~ó žpC¶Ál*ÿÙÙ¦ÀMâù|ØÞœÎBÁf3õÚrñ›¶ ø;cõ:Lø@lÀQ½Àâ[í¨à þ‰j'uí¨Uæ7ÑVü÷6à ­ÜõþÏæJ-Íßd âfWÍÕ—ôËlûtÕ=¦jn¡é0Ó²ÂÞ!£¾ìTÚ~ìÑÈd‹Ì@çãHiÜk û͉y¨êYViÀà]AÐq`ù3…f»ª!ý®*ø¾ Û˜†<@nÙo)9ñ ‰^ÄÿtéÐ^™Ke2ÙêLj††^Í@×ùÍì„·>¿<'r ×dbfLÓa›-d;Ô J¹Äe3›&–OºË‹ޫ燗[èκl#]ÕÛ\K2 g“¹n#²¥õ•ü5/BäyÆÀ\’·‘ï”r$5…GÅC‘yµØfa¼=ÁßZOwô Ì}ܦ£¡*=fáw¸7õ2„jw¬!¦É…N!±ìCÖ°ÍÌS"ÿ\ æzFåÚ[ŒÊçàu¬¼/W6qÂWÙFµèI%Ó Pò0WŸ¶QÛ€_Þ.õ¸õQç-ð¯<I7`¤¶ ¸¢G"oŽž ø¤-^ïɶþu%Õ„Y½ôÝÓ볯Œü³6àà§÷÷¥?¼²ƒY:Lv=á{^¹ëÏ=Ó y¢yãœVÞ+cÔÎíOsÜ<¾`O¹5ˆdÙË¡ºwïÈ—NSöL§®æ»&µ¸¯¬ŠñïÊúc¶ùV—϶ñÑm€Žs›Ù‘u¾¾Â³Û¡¼*S>õ;¶±Õa› ;¬½¯Õ",µ=Ðcºê²ÅzlC© u ˆ„áµ%h¸M3qT›5¡átØF] ³o‹èħ=kbã®Ç6}"¼Q·B·º4ló)ÝÑ÷b}6íFؒߣÝ1”©–ÜðgÈ;ÎUÞÌÛ¥Å6Š'…E [Gg±áü—a°)«àØ~“È…ñ¦è ²¶ ¸Ÿžù¢ Ý‚<—TR7¬cîÈ£gW N°JÏ&Ýy; ¬Ç6ཉž‚ˆìpoëm»= |+ÝI³ˆC]M~-Û{ ’¸–fÆ¿tÁ1ê—ä ûÂ,3ÕbŠÁÆl³\_W °ƒ¾>æ¸ø9œ °õsC ¶‰vç^ú|N‘ 1‚DöÁ®¥½q; ¿©˜hmZÚÓÓÁ¢ƒAáW»!‡bÍo? B*g°*ž¯VÅíÚ¡Ÿ“m”ªÉÏTCNÅ:ŠR÷ïëœXÔf›…î×út)2CUeÓÉ?Ã6ã‹}Wp‰HŠ7=ˆw˜mRø¦û\~ŽmwcÆ©òvtñ{!¹°zx ¾eîŽüòôøvÿîçã£Ï< !Æ?¢[m²S¹í°¯4ÖÕŒÃúäïÙ,ž¿9+µ5¥|~õðµ—P›Ž¼MåCv÷¦œªî)¤ê³vJ|!.€¦e†Û®~S~:iMwA=Þ ´2cz›¿¬–ø†=Ç»PóõJj$ƒÉ±·³bsDY¥ðø—‡$¶º]ÚSînÎYؘp6~‰ÉL·ý—>Oc®ì)s3ƒnpè¶~Iˆ ÔpÙF臊Oªw{ÿ‹ Ï~çm%¤rE *%æ8Z€´(?2Khoæauçd×Všþ“±òè«“DªIØ®].'\­)·ª‡Ò3tÒ¬¤ôqÔAˆmÆ8¸- ƒÈêd9¹ÉÄK–Â(š× j09kCÙâœZ€ ƒMëXÍ´{w§ù–Mį°)pÕÅý›ôµØ¥Håþ·4ó+ô®½êªàª«š¯ÙòýPgY{ÅÜ#ÈçHæ¿žkFb_Õy EfçÀ£Rüãò ’ùšõï¤ÐõfoÉA/â6²³³“w|¡‰1½d›ú´gÁ«úO}©ÚÄ{‰B"4@êÙÅ}>æ ®©ƒµ,ûÒÙ­ðJjnè-—j$’H'W+c¼æ¼M^ÚÊ÷Ù¨†t)m§IµA¼ Õ:ëÛu*p7ˆ7¡Ú ¨ßuŒå…)õ¡¿Åºl=óxÖ« þ|(|‚³þ‚f¼*`©ÏØÐ(íÉ—‘‘á†âÇkFùã“ü*`¨¿‰ú¢m`tlôL”[Ìù¿_s®|=‡ÛÆkè‰q—„g?ƺ8 ÿ°¨ (†cý]LLM·G¦BZŸ›¼¡•ÇÇ2/;K‰DŸ}ÿo8ÝòÎ`M¾‹L*1‘¹þi0`À€ 0ü3àS¾Ÿs|…ÎéѲœ‡½?zlð±hûÑ?­ï¯úx%½ùGEò…Q©í¸R-…w^6¸ñýmc妡÷­¨þ(Ó+æô±­ÏÊÚeNßíd–Óðs¢ ûLÝ̇HL--ÔÊ¢R.ΪU£{§i'[“`sö7K£­Â}ÍÍ¥2דמZ Õ£‘ÖEE7„©% ™L†|0“lW¬4Ù™™k2´²sÍ.©Ô:Y$…ÇWŽ;ÛZI-lv§œW®QqÚ[[€éˆ¬º´¬ªÎzÉœ·k—33ÜOh¿ ¥ù½fœX³¡A÷ØÇ'f®þpÊ8;KuH¥–Áq§Fê] øæ›l­dVŽÉ9w?<0œ»7ÈMKêàü ~hc˜ÏŠÿh̳—„=Ñù±¿ëÓàÄ"°q;Uçì M¿ÿ§²æ¬µ,úå?šŠr¹åc늺ßsK)]ǬoEÞÙÒ1ñ+“^ 1[U ²QBõ‚vßí!L¼ Žî•ÝÜÍGªæ`Î@I®èìÑÝÝ™nEäù#ù½»+uÙ¯ne¼/:<0òæ Ž"¾û¾½¯¯¿§£5Öš$qMW cfÒ’`Ò·¼ÔÙÙÕÕÕÝø2Ÿf,íîé¿tvõŠwlú«ö~$ÇÎÖ:?¡sØe”j”bšÝδæÏàÃ%QúfVå¸fÛn §{ »ŒeÀøº œ+ßÄãh9³}u¨¦yÙ‘(¤ƒùušQ\è…‹zµ¡/ñ‘ÆûTS$$¢2”ÏÝ]òþ[/RÀ®üÃþx¦#b#²$o0åÓ<Îjïèìh=$%3¥“NF ³Ç±›ƒpZ_ߦ’_Lë›Ö#ï‹-|Ïc ð'³IøÓwÏíܹ3%«9´uãTDñkè¸ZÃíø÷ê 3ƒ‚Ó¯+Õ3K’7ãZÃ<ÜÛ®JÝž™±Amf\ÌÍfMâOÎF¦´‚Ý¿t244$"6¥r¡?¼Ç?r6­ZìªÙDDS.F„GCFÉóݧ“öíÌ.~£a«=ïng…<|¶XÇËÁò3‡Bw†¾ñLsµàtbPPXñÛ¾OÒŽ]oûnhxô”Z¶ñ³ ¿êYT“—O&Ç$ŸîY„Š!¯9šö ÙÄžh«ˆ‰Ý}àÌôâppHâøÉ3;CCÃ÷¬†ÝCYõ–­ C m¥»²Ýê‰S,Us¶Rš [íU¶qÅSN^Ñ*ù¼;}ó͆ù³M~êßÄk€f]1ö¢ªfŽ ­h8M ÊÕ<2ñå9M$[MBñŽµÑ¾°:¡O~)§[ ßlùÖÉ÷Ôe®¶=S›O°ôC{ƒb° è!(˜8Š Ïàð*}Or(ÎPøìfÛÂn¢æW³“Óàp¿ív ¿üšåÇÍyPhýLã®?kßëÉWqÆÉšˆ‡m4=qÄ66&¶±h!ÇŠ)f£ZF7ã÷fîh1TÃ…÷UÀœ5m[õbJ¬ˆøÑb ¿¿ËäÐS|[/Ô¢û§åÓ*-¶y“âÉ-B’í¯¾nÄqgü ¶8Ÿ\ôÀüüôÌ ,)ð¥ÿ°Œœê»ìIsÈjCƒ“„¤e«½’"g݆Qxëjˆ Û,0Sõs+)èsáiGæO[ ì<ƒNçL«‡¡ñuß깜ïÙ†ƒ£åä—‚Ù•”ܾ~1Ô¤±†[úÌ¥‘çtÂS(RÄÛBŠ†¿gháÕóÄ€â€ϹêI÷¼Ò­^IYe=™pÒ‡ƒ;_=þkÙÆëhÞ¨BŠ nìõ‘²öt<ÕõšÊ7Ó nùóÈt¡ÒaШz?mrGŽ"«†p%‡ëÐþ3ÿ†¼‰×ª^_s ‚Âӯ̶Óüvµ±×ìì‚j-Ÿcø=õ6ÁÔߺExƒO ZlsÞÎ~O9rm©6/…tyQÎ'J¡åR}éI‰÷^åðÝh'HöÈÙm²ïdû0Ó÷ÆÇÖx+ÅxwRÆ«fh[ª9A <M£l×å¹V¦Ô†TÖ·%U¢LÌ’˜[YYÉd2kk üfý‚h%eQ®Îä«€`Ô¡e÷éI¶±KØÚ×jãÐÛÕ”’dɶ€#Îâ‚PIÚž_³1¦ù²¤ô‹M½ÐÖ°MŽ¿càåJ4½áš­4[pš\žht6Õ#ñÂŽ?¯G"3öˆðÖ ÍÙÞ{L&ÞQÕ‘‹#û Æ?kÙÆ#æÐaGR¹ôÄ+•š^ýC¶Qwûù±Ê‡ù{ümpL·ÙhE§jzùžm¸zLr*”ã¾P#’äY×´z‚à3ȽS+k‡óâ.†þÞsëÊ6¥éæÞ‘5U••¯^•çÇ3¶ËJm¶^_&ˆ¼@Z.ôülã¾ÿTGmLÁ‡ !k®¯žÄ1Y\£ÉUýX± É6—_©ßcü|¬ßç(¸Fß#`ǼÒX†Ùé•iØ:ô\z"†GÜ"±óκ|{l^‰éŽÿ@¶ñ+PwæÏ|#bûòFl³dh2•^ÃSߧGY|÷]€N˜¸'ù®ƒ¦ì펼<þàê Å°¢ ‚C¦ëþ¶QØæ|Æ£s½ Ž()œq|·±MH‰º³}äâ(=ZÛ_+.qü×NEBCRÛš{~4g-Û(ÍÙ”N-+ÝWNÆR¨Ü!-¶É qòºðy9Eï«­t»U½¹jêI~¦ˆnXô~x¦ê Oü¾uÞ‚Á|:²’á*ÞU¢1¨_g%ÞÛyk¯qø´ºàÍŽŠBµ©ûb ­Õ)Èìzrd`zEhúÃa3«GnY§¿~È6ê•ôXn×1þŽzà*-x¬s¶¨@I±€ãXz:ÚÕâYúÌ(…17 Þ/":Å. ƒù ¶­P³ ôÄÅþö“w¶~íJ r–X‘£ÏtF²]báéÚ–W‹Eá¬ûÐ3þóz8…å‘6< zØœ\6 N£_ºÍ lB‹mÔþò.%ÒÝÐtÏ2Æ ØJŠ't@Ö%Ó¯“ é! ÀÙf©šÂܵ·Ûr×KŠe<»Í÷Ü××ΠJ —3’y¡§áÞ>sñä)¹ºImD'`mñì]{¢b.B\Ÿ0I.ÊEW@ZƒÛ¡Fæ)¨–r®çJ>¤õ­9g+0ñ@GÓ‹}8æ®È<|rxR›,÷ÕQ̺‘ðåezœÈFÛ¨´ 6]^ê”á×®¤&PÄ)ÐíK½'N\Ww­y/"åÞø*Û|=HpFiäÕå8"\I)¯eV?pÚÏ&¡´ùÖÏ” ڶ㢋ql™„Mé+Ô<¼¾ÞÚ´ráE{‰îq÷¿'xOºQ+üÙ±O&áÑGȦr¯Ô èØjH¾©þ,:½gNo'.m\³Ïû½ ´m¢âYUˆV¸÷V8ÁPRß‹º YY 2v[y„Œ£…¤ ñŠDCJ(KöÞ;f Û£ÝyR-þ–L#ÛÀKÝ&*U”Âû zH$Þeâ¶÷ ò¹9×›FTWÈh«-Ÿ~§él㟻êãë«<*߬´®‹$» ¤ö¦ßæl¥û€¯²C ¤™YªI;¯9_ñ™»•ß©K ò)Ì…ÅïŒúsV|ÿ‹¡}TDƒÍ¹ZM‰~Œc·a¶9gc·» e›š(#³“mçý²Ÿk™ÀbÐ<<œ(,á…ædÔT Æ 3ËúQPuÆ›E§øïô´ðmFàž_‘±ÛÈîeßê.’Èô+ßÐ4÷xZS…²ð<5ö,”×ëÓRq@.[èµkÍ+øiZªN„½!T熰T Kpö=´ŸüætÏ ŠŒ45õÈ9nãsä-0?D rA¶©O²¸ƒªAO„Û°xÆ!;wÚ˜²­Ü#à•”7ѵ½Ó¾R¦XæâiÈ^Iµä±i$ßÀ>ö"6WÚ³ Ÿ®YKªV†8 *ÙýŠ–8¾Éþé04úæ\ŒHÚZâáû4=\y/úËÀ›s"> Ob°(8×ø@a zÛxƒƒO&Sd6¶".…ɼ ’ö²ܵ6`æÄ—gš-'˜mÞ2ôhíZ¢`Ëí(¶ÈI¡.mev¤€ËÄ‘h&•Ì`{„g ·}{´ŸÏ¢p¹t°Âó›  ÊÛYûÏ¿^ó¦‹m,*qpHõ°Ì|²ªÁn*EJdåØæYb°M—ðj`µB¦Þ³ôq[PÝõÝ/!‡a„§P &Wp¸¸áŠœSN4žP*5—š›sè$O’ùfѧí°3çÛxF…zq¬ë5{ŽÊ< ƒå¹#T©šµ23æY8‡…²Ùìàlh‚ë|i ÄøáwÄzJ0•jøÀFÁ™¿?Æ°6ÂFü×3²^s¤kòl\ÈuzŸR¹ªü,ÜÇß‘ñyb¨6‚å ÔœTõ¿ÞÊrZ¯ï4 ë øÎÆ|ÝKªõÆÑúQ°7Ì]¥cὺۤ[õ-ªuÛp㸠ªõÞt£òlêûû¦U­ÕBµQ}üÂμAGÕq°~7Pô À(Ã/Á³P$²¶¼³ú`ü×'1OÖ|‚÷~gø[x'`µúÏe¿Ã^ê7]úµ˜m*ð<økD ¿ ŸCg_Ž…;SHd–ÀúÎÛþß–NgÕMs.ƒL¦zÅdÎ)±cî¿ã}i4}-¦ÁÿP¢}÷ôÈ:iÒ(/ ß©ýX’€aC‰û·t›ß! L¶ùÝeÕŸ#Û`À€†¿Õ”Ô[¾+é–ÎSõgãÎT«t§§¥ÒK§âââÓs èÜÝÒY÷0i\ò±³}s«^"«Kóâ÷í;q¾9k—š¸–™ºwoÜ™k-}ïdó½Ø݉Ã+kæÁòÙûöí;šuuNkƒ8ýè î˜2çž_3ãR‰ŽGÓ¹Ow÷œº‹Íª0üÆñ5ò>熮ÁõÈ_Š{ÁÚýˆé( šãîŒGfìó ›ú/ÃaÌZnì'I¼o?|R|1‰D‘¶ÃäRºÏžãqàaù“KGv0e‘PpD`Ð…EÜ¡ôm]MnrÃ&NVY”¾WäâÁ0âw.k2Z8äÌ3 J}ðøÑùÃþ8Ž³| µRÿ¿äB&‘O}þù×úM«!ÈL3DBòˆÍ|\öðX´3Ý*|uëN-Ãß$±¨ã ~ÉʺåÍÓׯߺ}¿gIcyÅ豊®wϯ_¿^öæ“ü‘†mïݼÜ-WÎz$ó9€&¢˜c2Ø-3³8ˆIϾL#£¯8ÑÂ7å¹JÞŽ§‹4v=Û-Åïg+Nn6GŸÀ“ù°aâLìÑ pÄÝÆQ³ °ÔÿÁÆ#LãYÜ\ÈxÑ9‰¤5þþÏùÀ»­Û(—åùùù kØ3=WŠŸ-N´^»…Z¸yWqóÆõâ{Oáò*_ä_ú0¨@ä2•b LA¾¬üúünQ5t q¦¾ÀÒ/-çâ(™Êû lþö­ëãÈ÷©Z AÚƒéu0`ø9Ôe{ñ]Âo—\<¹¿™òE¾¢jÉÚ$ˆ/µ•À³,óŠîæ¦Eû…YSQ¶™Þé }ݳ¬á+èXÄÒ(ÁXGs‡GëZ@×TfŠ}âfÚïqL]4 ­+Av~תÁ†$GÄöO1ú@Ï­ØÏZl£aYÌ!5Í#w]„¬7“@ºt3Â6+s=...SKkÍ G^곬#\Ü.\»>ó4ÕƒgïëÎÝÓÂð\!p#ÙaG"ï~~ œÉ’‚ lD¶Ñ9å]¹)²ßsú¸PE×7Q÷¾Š+t§c ¹BóU«ÉŠxg³c5DÍõýD sÇoš)§zJK!¢Í6šñý½wPfxIþÚû¸ë:”m6:T6V¹u«r±a 1™šÈŽ‡ƒÌRóëgÞÞ22GO>ßË—kÒ‘ýÔ¹/Ÿ á»x¤sÔ ü¯öZŠEØQ¬3aÀðcL|.1°HÆö™7ˇä°{(”mf oö£#w Øk­ÞF=¨W¦Ò¼Øö§Ð±¹TÃ00R»ƒèy‘Çt oʘ‡hžzëd™þXüdBÄ_¨„¢IV¤R˜Z§%tÙ¶ œË š¹$"Œ·øñU–Œ\=%ÝœÑþÉh±Í²=¼ŽF^°˜Lÿ€@A¶&B—£ ´æIÀ݆ ¼ùd¶– ¥,˸0Ý"ÏëŸyvžâ¼ëK0üHo£þ œì:—È$ÕôΪÙfÖÉÐàÚ7ô¦®«Î:lSÍ°/[?0£Rëça ÿy}êmqª¥ÿá¹ÎçL‰&¿“žV{o7¾<auð’:¥Å4âá–•uÙö0alèxàžFÞð¶a9{ø‡Y0©fî)ù=À†lã€Ø-Ž½b1Åßßòô¬·Ç¾GS_rÄÞ:| 5}Lý¨ µUâxå%¢}Ö0`ø” å%…ÇTÇœÌ=û|DWRG­õ#®"î’©R†Zo£Ò„S<âDˆ¼Ü¢3ÛûÙp¯T¡N–Ny£¯w ƒ 2·•]¶BeÇüÛœ½ÌÀ²³ÂSózTë± ôã%?ªÛ±êÂ)B+©/Z%ÓQ×jØF(—&@Ù¦s¥µ–Úš‰EȹÖ|ûsŠµoÅ~ÞŽÂa@ë%‘Ûâmp‹¾èæ(¢øtžÖ›0`ø1îï7çKö'Þè@ÁÑ;&½MÏ«K8 Çw¼¯0-Çêz ñ¹íÈ4*ÿºÒ[–I  ½ý|}Pl¿Û {Q*çS©î~¶f‘;Y»ÿÍi‹ç(°\O >&ý$DS[÷#©ÉNÏ2b¢þ{`r~>NLÝÅ{»»[À§`¬é>‘ÆóòÝ®ÎÈûäca-Û ZâÙ¯|obQ¹l¿£pƒÅÝ›x$ÌÍÒˆd ‡€6Ù#¹x×lLÍ)wÂmM!åR{Ñ!]ä³úš¾ …⨇Ò6Š²Vá1¯À¤ÛX_€áG+)xrž™ƒwsTKÓ}C¨Ã“YùxiT>£Z’ŒÀÇdåÈ@ÿü²jynj`p ¦—Ña¾47=48042¾¬\æ¦ÆÁ{FÇ'Uš,ÅÒØȘþȘ\Xš/Ok'8Ð?2ÇÊâœNF“ kâîN ÷OÁ‚J¹|Á…#×Ù“R,ô zk¤$³“ãƒðû.¬(5˼|hhXãÞ ˜’C–fä:¹Ï¬@Â~¢Öq$èÁœ7ÙàNÖ›0`øŸ´.\š ò÷®¨þ„­è>?tæšwWö[„gc•Ãÿ4Am͇?,#Ó”…¶¢Àuhs—†?–wþ$~À 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0üñÿ¾ŒQ endstream endobj 652 0 obj << /Length 906 /Filter /FlateDecode >> stream xÚ­VMÛ6½ëWð(—ߤ‚¢‡ Ébs(Ð{JsàJôZˆl9”œíþûEʱe×HºŽÈÇ™yÃôˆºÍÞ,³›÷\¡—Š)´\!®–B"- %GË}Ê?î}SÙÁ. ¦MþWï|”n÷Mí%ù«¨¸w­³½‹Ž¦‹ÏËÙ»eö5£p"Aiàk¢QµÉ>}&¨ýD0/ zWmPÆ}ÌþÌH²ökÆ Ç2âPŠµ `ŠÌdÀº¹Ûhô¶ƒѯòÈ/X(K8‚šèÒÝŒ”$ÖM%· 2ÿÇnv­{5ýsQð®Nª‡®­‹Õ<¶•«£ngý¥ ê°q×ù! ˜‚!3ѧŠ"N)ïo#!à])% –TpŽJ\¼m¼«†¦ÛFØš™·°‡ ”qÏ2ØÃÁèú°yœ®mû(6Iõ´nªuG7ŸÓÒ ¢o·vØû4]Û@Ê|è¢bc‡j…(Iþ‡³¾MnÁdþ-ÄØùç+PáÌd‹õ¾ »ž’ ÝÌß<®‡tÔ2ð ®ÁSÑõ³Û+6ñÔmƒU‘»êKpÓ iÑS3¬g$öv“¤£ð…ie“|Ž„„/p;~ÀçIò+ƒåHR\•W/€†;¢åáœ`Ê0SÀº‚AãXI ( Ø°í\stL‰ ¥ÇǽЗÚLÀÞ¡ÕEä)1çãx3CüWbº™„a"td¬ïö¾‚€+Bòâ÷8֮ȕ”ö#ÉAYžoùí–‚2ÐüM$yè½ãÿ‰Ëô±L]òâ*›RpLùTœe„0 —×!æqÒy±ƒú‰µ¡1>ïbY{ý*d £zY† …9×ÃB9&%{Q†~?æ8Cð¯ÉP! V¥ˆá´­ ?dÑPí¢@¡Ùq,Ò„°$qH9)±Â›81ä…I÷ÓÑ=' hì¿&é˜ÆåôhHI+$M5µÚ½ëû©}Ž &Cç15¾¨ÔcË=Ý\éé”Ôÿ@K?Ôtï¦B߶ónðþÙ£²ž:ûjÞ¾÷®0{×tÎ×ÎßÌzÇÙú}n;[ãC}ƒPrv!”Ýêb3j¶'¶ì{}òN˜¿Ä¤€ÇÇ?ÄΟ‹#éPû’¡SèÇŠ±ü~ߺ>¾ﶃ_00¼Þ.p¡ Þ1ÐãF*çfþ &Äy endstream endobj 643 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 149 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 35775 /Filter /FlateDecode >> stream xÚì½T”Û–.zî½=îï½ñÆíÑ=îíûÞíûºû„­’+@å*¨@ÎQ’DŒ€`DE%ƒ¨HRŒˆ ((*¢b@9çœs®\õ¿?TUE¸ÝûœÞçtͱ7þµþµÖ¿â·æœk®¹@CÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCú-XòXüï\Ž ‹×ÃdOë!J¿3’ËM¬âbµÕU÷B.X©ÅÔgµU›ÿf[[]dÉÃwŒÑÏn^…ÏËÚvC*ån#ß_eõùÿ6æ¤ø3L)?‘øáâ‡Ið5êSÎüZÕ)ɺ²øƒ­ .K;AÅâðF†X”Ýίj|ÁñÔÕ?W³ •½ý¯‘ÕHÇìÐÑÛ±]×Ö#øaÍ /ë ‡ÖýGƒëãü³Ïž¶í¬è÷ŒõŸ¶ë¡Ph9ÂyS_Ä9Û?í0¢ûˆäÆ@ý_lŠä®£§«˜•¡…ÀŸ@ë#àKèYO÷bñ/1V7§p»¥òÀañ†( N_Çkßé5ø¢…²]K_±"ôè÷à‹Ìý63d£×”£»Ý¸mˆñ%±Qúh}Éãñ‚/0Ìü£ró÷ßÓ~}t^ƒ&À„Çié¢=vŸá@9»j€Æœ7++éÌûëúŽ{åÇzÇõC?íø)&¿}}䯼Aý„ænÝ23í¹`¢ÊÆe! ß õ,½ Y0óuòÅEéëÜŸº³©„>؇’÷("3äÏPÈjîd”U1ðgÈž³­s£ŸßkM>ózŒÚ¡ÔMÔ£O–œZúPUQÐ_8|Çæ ð—Bœ°öÜvÓØ­Ö ±JXÛ°^p\ЖK*0På©$Xn'àYcBàÑa·ÀûìP¢ý!àúãñõòó“NÒ>ù™‡|!Òì;°(i…ϯ`ИgýkàsN„©¹ß™rUma0]ÈúÖ£ÐYGmÌéï]|`ÞÅ€äJÙ¯KV½s–Û3Ú "ùáS;Eê—¡ nû»IÕ „XüL†ò.V›k~U6Åݬ:u×1vǃa,Kðï ;£ pþ¶oÃÖ U¶É¤¯1*îi2½mñØ[uÓòŸfoà_"ßM#ÛPÏWU,µOÌ<#äÂV£|,<ÎÜÒÔÝ 0=Œ°¦3\1R±Ù· žaò9„Øã3㣰§×ƒVÞ ŒGx[ûÙÎûd†§ÚddU„ä¿P[Œs „zh¶Œˆ5e«OÛzí(ùÀ•ïZðÅbÕX/(Vú©¿ùF YØ#ñœ„Š÷b5ª\˜ Þ÷z^4rÛÏáêgèeü„þÀS[!átÁ˜õKxðÓ"ÎLlˆ#šHµvö«y~l‡„6·#q^1¯ÉÖé:ðgõ£4…@¥’™vþïÚgàªHØ¥Oòv9Û2©D—ÐÔEÅv ·ÇˆdÕäú °:ü%ÈÑÇQ¬}+{æÀ·ãlŽ¾Œp·¶4%Yûկʞ7WIÂ;€Ýý Ôµ¸… ðÙË|ð=G-Ú€HÔ„E[Lð×9|ðOýGú)„6Þ1)1X’W:C’]2µÌeh“3øýÍ6ï¬GnXì&áú–H–òh“ظ¬>í’3nGY¿Pe_æûÎ9ãð$"Ž°÷ü-.ÌÝîuÐNÍ}æ·Ó”NsÚ?ÌÃÖXè{Þº„Ô“7Õò']ì”@eï‹¿d5#ì=wµ©wBå()M:äyê6˜Í!¦ˆ’ÂU„hѦrIõ˜Ylaˆ7ïã#Í­?Tœ.¢t[”oá¸ÚM©È DS÷0ùáÛs' µó‚6 ûØ­lϾD>ª€6àï©Ç”ç°è¦z6)­ÕÏAªù™G‘Ž'Š‘ü”Ðf–¯6mMzyoªêI?Û˜ë¿ûôŸóQ€¯;ZàO] ýð_àð°ëPÌ,èyÿ=IÚÃÿýü6.Ÿ›˜=EÆQú9p&Íþ_úÉwyg¬ÍÐFf%óY§ÚÛ˜‘LwÖCcby´6Ä™A¤Pñ8â‰ô§WSt„Ò561OyTËÄé¾éEƒU—Ÿþ1îÝ ø秂Ú9â¥ê‹q¯Áu³—¹ ýj^ýÀ¬ц#úEŒÜÛËΖñ’Å–®g=%ÛQÌ}xçµ\ÆbmÆáù1ý-M³gC½#´`Qà „Ù» îg+V@ÞCm[¨ìüiS=\nÔy«_®ì@{‚pSšbKf: @ï­`-‹|# ¹^¶tS¿Óg}lî~š”®àÚÞ4Ð߇Ððp{QFñ«ý Òá—Êp¿VK5 ¯9‘ÞgïWgxÄU­Aù"'BÏL m›‚6N:˜äOCƒë40·ÌÛ mt‰ àSœ3aO®hoõ²M.¯É9ö÷  HyIA¡IçPâÉ*hŠÛmJñ<‹>ßGd© ÂÝ’JÀöÒ“¦;/B«¨zŽ³ñŵÖLª™wy}ï O¤ÐLï(ô¾ÄœS‹¹5Ž4´Íd¶¨m\¾MØüõ„uwIöD¦#GiiV‰6;P×ê²Zb ´1ó—/.Ñ7%hc ‡ ÙàmÏ’"o}îv€¥ß-pEŠ/xï:öàx*ë8¸L9SõKZæ”x’!£±wx½¼C#ÂïA,þðwÿ ¨ " ô8þ ¤ý=ðŸÿ/àêi Àÿ 4ë×€ÿãwÀíá -Ãõ_a1˜i@¡û žíÏÑ×ÖËm†æÑÈ‹P"ΰî«¢Sî Põ/Zm?úV2Ò"Êšgþ§Úº¬.RfÁèÓ¸ ¿½-ën.½¬íè¼æ ùnZå U´áF’µÎÔ ^lªðàó8¨ I6Þá÷á™/¾ãÃrÊ©‘a·“6æÖŒ6L⳶)d¨5=¿ÌÚyH!ãå†Ú6àj:ßSNd˜ áÉ •¥)VÎ!¹Ò–m¥éàZ×”™½7y¬è2™ˆ£;ÖNò`´Á›˜š[ÈoKRâëžLÛô/ÊúIî Û3\ô>u³²÷u–¥'¤•ν%˜€#­—*Eg} ÝÌÂ\F¦ôËÅ[¢ XRgS\aÝ„Ú˜°ÀBJ³2c„¥VoU›»¶<ÜÛÕÚÖšçG´O‡4AGŒ“ ‘¶zêKö¸ ÍùÅ2C-XéÄ?ÇÔÏîSlj+hs…ó]ûœ©öû ”YkÁ|Vô~ ‰66Ë?f‚£6S”!Xs¹Fù:²"KÅŸjÄ`ñæGJÅÊ2š ´±ÖC3ä›×Œþðó(Œ6‰*ÍÉ!{Oføð¡ª"hfÏ©˜#÷AIª•×ø0ÍÚN õ’”øÓQ3ìîGJ¼h±Šbd4Æx›S7*^eéåZt5Ø÷Ý2´Q)I©WþÉÐà7_FÁÜÚæ’”\V›ñ6ùçqL»k¿*}i'Ñ.Fê¥'ÝH„ágþd;‡éE¼ô´_<ö ÅÜ©(!͘ÒÌÌ̘f½rP3ÛYánA!ÐLs?ŽªÍÙ™B@t҆ .€•’”XÂÉ°3uŽu1 ¤‚¾%Œÿù’”X$­T7@{NI+!CídÄÖ-U®KRóeñx²oàîÀÀÀÝ»}©†ØoW~màç“þf'n|\­ßT’’ëÂÍxƇpãïþø—†ÖÑ柤Lá(üY/ôü¢ïúajx\BnÑ…ÃD"‰L&ùF€1_gwO•š°›£JIJVï_mØaDí³uB„·»"ámäÐæ®ËñšŒ·™'æ­a oó¼]¢¬/I1uU‰6 =ït)oÈó6w%ã\XOÕ&´Éñ6ƒoîdÖ-IЦ\ÖF͵i=°‰Þ{@0Àu.*èm>œ4E9]ç¦màÅúžÛTqš-Üm¾‡·ÿ÷µ=û!ÅAëêm`ÂNWçñˆdÎ^wÙmzïGÑf5Ÿp‹*WÔƈfgç šGt9eWO²hD[ߨΉ%HHŸ¦Ÿû4-Aèå|©‘a0Ø8êô6 ½Ê ¶Þéú‹IDú$[^úcz(ùI7 ¿+/•ÐÊxþ-I›úöu!Þc"¾/’ú±ka©åÒ§¢8–Kè¡ ¼)WEÑ"½üøò—êmÆoCèA†—ÝÕ¾­Ñ$ÔïRìüWôF]ïç FÄ—ïE :Ùk+{ìM.¾h«½sŽ¹÷¬”·á˜ÑŒ~m~]½MY‚µ¥g"òìoA“èmdh.ßméX¬ÍÑiD(öG¡,Zp®Ü©F›{RJZb(·ÕZ–AqËšoõfl ÃÌÌÄŠÌ›ÿF&§Ø’½$èÏB;mÒ.€ÑFßxþ;ìBäyH¾¹|ИeNsYGŽúá mVJ!$ùg0;  ÿoèù?Ó!UŒñß«E›ë‡ ® ÉÚ˜ßÀ«cûÑw¡Í¸;ͶR:9"w².N&4ÑʯabMɼêcA ‡Âˆ†zæ^áµC †°Ý¶kù¦`o¤û¿Â*¹ÒTü÷3¸Ÿvhkë`öKm›”^¤ïuŒÈ,‡>!ZtÖÞq{Yü: þ‰8 ‹æÿúG-úãÕ3;sfÿŸN }0¹þ‡ßÿþB3´Ú»lÛ¡”Õöíø–õ´‹fÛÿŸ§½ª%©¦Ò ²!ŠÉ4 ¿XÄ(Bkë…—‡»£ %’ì`‘«ží5Äù3|oe°±Ùö7Ο»sÀP_O$¡õ ‚Îd/B㸙ð‡?i+Värå ûÍôþxùíÒ_ˆ ņ°#öi«l§4…þ{çŒ?^—x*",ìhÁ‡ Âh³À9rôè_,Ù?œüž¤è^ ‰ºÝèÛŠ;KT2±y†ƒ¹ïÓ㓇‰zú2äÌq0e8xœ¹þX3Š4¤¡_ m¾Ý‰&ï: >¼ %˜„_ "¹Õ&I ¢ &PÈme¡qïG¡Ôß6w£èA©WÆÛ¬47Œ.l€d¦ŽçFhRþËÊšOï‚Lq‘÷jd¼Í p'ovHÌ.?^?aà‚oCÝfÔ$m‰©º{XŒõ¶9¼y oéS^ýíˇRw‚~tÙgrpÿNÓãi»‡&4£HCúa´¡š:WT¼ üû¼0ËmYÖr ñæhŸGãJ9,ô¼Ã›˜sU¡ böåÂ$>m ‰ûÊ2 ®¡2I D›5¨ºiìó³xy´æ ¼Éû²?"¯²Ýõvß—Ú5-=5Ð󘓓¤F  ³;žSNiÕ«Šj—&K¢PA"¡µP„¢6ĈQ´›¾ãÆ—e$òJS2ïr<§ý,/×k††4ôKІDcíƒ)ÄÛMt«@¤ Q¶=Ê9«GI}1Óñ‚À0ç«ám„£DŒñ§ÖžÎÎÎörª6þÙŒÚ/ÜLÿܳþÌ  ùâAS=ÚaŽD²[Ü…60uñBh×.WôÔ§%9½h–NDuÍ €¹7hÂî ~%!ÞFfˆ?ÒPffdPÔ¹²o¦Zæ%wî3™@^hÐFCú%)av›¤<“œ ìÈõ$› ®kó6ÇÁ•Åy¾±¯ž²ÝŽº¡èª+ÉÌÎÑIJvV ‡}÷äÑržÖðÈ€æ:=ß÷³Ñ†@r9õh‹Éñ<ÄÅÍJV/Mù|ŒxmÄâ$WÖ™—ÝÕ©ûö]~lD©ÞFòõ$k}·ÒÕy=#¹3dmQ¨A iè×ÔÛ€P°\yIËÀ¡~/X¥’I*†%vÐbñÚPÆ€pkÂ%+á6¬A¦?è0ÛAƆ=I!»x²£|+]oQÆö<Þ¢’³–V^±ÄŸ/I ® Q‡F«¨‚‰’HŠÝq‰Úà|jÅ=©þ«h›ä`G£W£7·ÑF,Èv£P@gT#1IÅ’Ó»E{ˆæçAÈ=ãg™RT³^ ièW@dBfDÚ;…JÚs§>S‰š±‰³‹9Ó%^z#9{2õê4O²µ·3&ã¼N@ ÌPI~ŒÈ_y°JÔ?R±"6°6¤—Š2¢˜lD›+ª±›”\ìß lÔãÏÏká½'!_t]”‘•OXÜÙ£,Šád‡ZŠ6HÖ6TC÷‹€ Kš&& ëäíïççç»ËÃʆ32]ò_nÈ⌂O&œ ó'’È-°û£›=pf®Iw4£HCú‹ø£##|9›:>{qt|݈BöÒÐð8_vÚWÀ™™Ÿ\á𥌠3`nÓóˆë¦ÅñáñeGìù±Ñ©@Ä™ÉaÚêÌèè蘟Àc/ŽŒÊl@^቗çƦ¸€X¾‚Ký7=:4 »óW'Æ ¨3ó+’² 9C#Rç0À)O‹ôWªƒ ¦“}l|rš#d¬ wualdxdt|ö¬  ÖÆFGƧ4£HCÒ¢ú”æÛhŒë¤Pc¬! ièÏFÂ5WcŠÙþ}ÿ’¦14¤! ý¹y›ÏÒ†4¤! ièoƒ¸«sýƒ|¹¥^°270ýrFÆWT{_‹‡û×xªë‰Ù3=ƒÓßÇjûû8Ðݼ¡¾¾þu˜˜Y½}Š¸+c#C໡‘±UøÓbUœËìHßôªPÀž“WËð×û‡Öýå.ÌL @›˜(º¼kÞ×Û7»&ú%Üpu¦odFZHñÄ@ÿWĘT#ÁÁŠìÉ‘Á¾ÁîÒèÀØò_†õouY8gadpã0rûú¡» …«½Ãj<õsg{¦~ Ë3C£Ók?«ú« ®Š ‘àr¥EvçáTY)º[¹ëù¡r5h³™§PaC*Æ.á»>/gá ZfÀaÛo¡‡²ßÝ’§£9Œ ¼ôF6Ò¦Ûc ñt&ËÉÅÑ”AÇè“·.nÌo©.Wßò ø0Y“J¡úñäJ?^ýÀÐÊÎP”âE%QM|CBCƒ}Lhd†½ümÔÀ‡‹axq÷éGêaa+Q Žn­³Áþi&!·omàª?óÜ3u‰†J’õqÌñ™m=©»ŸýŦÖi[ÓQõo[r]M‚_(f±Sg:+‘xÏÛªSv¤l7>!øùåyš`áyö³Rà ³±¿€ýórŠÅ©üûÑ抩ãq‰Ú¿*¹ÒZ†6rGÉù<Úlœ{ëί6wº¥„6¬mèRù;ì8_éúÚðÁöÐgŒ!åVûšÌÕvÏÓDmŒm¯rö¼`šÖ½áæh#œyAĘN­ïÉÏù ôc¾qdq÷™ëÞZ´ƒºKÝLY©ö;ùxË)èÌ×¢íùFaºáåw¦è€]ú[UŠ#èñËhë0èˆh×}w)ÚˆÕ¨ÄòžÈ7:olj±xã\‚ãŒ[è˜O¨ê$:‚6Ê¡R´Q××PÀ´QQ#UþÙ”ÐÎ{Ì\ÇbRÕ´þ~/öâ #Pãùmƒÿü-ZRôNÔ5„ åÎäž{»I¶ñ|ä:w)Ú´ßq&ï–,jqûIt3_w{#²åÓ ÞæóÝ3T‡ùûwµqbDÃâJ£6Áúv¨åÙÔŒ³!6’ǘÒýÛ  Àu#i=mƒ¼A”_t°Ú§ÈQ W–×”®›|ã%á©6AÑÜ+²!a”³E‡où5_ÙNŸ·ÔŠ~¿¦rÑšïyiì~uK/€àÿ¼Ð' ¬â‘ÚŠYžH0ÝV;ŠW‚P¿{ªPÛÙªÂ@7Gc[çs ¼MÌ>' Ó*2òÓÈÈãdXzf–lZ&ëê_,ÀØ2ÿ‡ñá+Žúÿz·˃³;Y Š½ø^ ™Z ßvÝø8†J!… ó0'Ó}Aè~\–vøô¹7S€ˆ?kgÉ0wñ=°Û„'ÞªšFІæAfûˆÄ³÷>Éó6Ëåûµí¯ORCÉÆôa¡NLœ…m(t»oGŠŽõÙ“>f»‚‚XF(;wÉv:ЙhêDÁâç¶"ÐŒG÷Ž´6s>}ÚN‰·¹»)ä» ÷Q$€ ‹taPÉŽG—Õó#­¥ 4 1ø`˜‡‘f¼k Æý²Ë{)TZxd8Kp> ïÎl-›§](;CNÔ_s ùÜ—€q‰?]màì)W&êâN¡Ð^C‡æÄÀl­6É.'€ââá1µ&úpÊxUƒ'[¢…k æí$®ÕMÊó6¹®Ô 2è”ãËSz–§$—0½Jdº$h³Öÿâ"Κ¯Ðå‚Úøm¬³0Ь§Ïl‘øñµÆ|žVËÛü„~#‡YïÒ‚µQðr¤ÚhùelÉå¦p:yãý–hJR7#ì &Þ¾»“¯åÌ äW¥ø›÷ û šž%šzT]<­0ñº¥v•£Ê¼ÓA‰hy~v•'R‚¦¯7£­Ãx›¹ç'´[ë…##j+`Q_vÍ‚!ÙGmBb¢¯A·€÷e»˜§Ô@±æfa=ð!ÑÖtï$÷™wqº¦·cT­¬~É'_?Y§Ò#m+Ä_ÆÚ@ùå¬RämóíSÆ!q0Ú¸Q¨‹°ŠŽÓ˜­mà:%6oè:ä€Mâk¤U:+‘¤ç?Zkבb {»Î4cˆÌ910ý$Tßê,Òϼá ¼¬ôáXPÊ»Á|Ư­ÌÛ°?j[ƒƒA´4ˆÇQ¤—¯EùR£rªÕÈ1ü(c­4)û[þäÑЗ×ò@—à1‰DΛR>¬7uµpO‡ î`OÕÉôØý¿.k‡ñAðKob­-"ùL•ŸÕ3‚FÌb8¶S¾I´püÕ¥¹e¶O¾ mÀæê+0ÄÙ€+þF´ÉÝë²3óµ"o ¡Íë'9²[ïʆ‹ëäÐFk>%MAnä[ïÕ¡¥‹F¡a"°{O5N ç Dñf;‚ ×[Ôå îZùØ–h#6ý­/ŸÜ?¾ÛP{›µOÄ„¤£æXlr˜J8HBÓ»EòÜûên²"<‰ÿk„~Ò8¹I‘&*îà]B¾³/>]?c–"6·C\\Ó_Iሽ=ÛÀnˆuôÍ«'«Õ¦»ç=ËljÁq&éÙ ¼}¯çsùq LeϯS´ˆõ|àõ_#–GRV^Ëà¼$Û•O ÚŒI;÷ëó;QG"<ìnGñ9#‘¤ÜoH‘qÔJ[÷ÅôF´®…ÚÛû§Ý|Ø3¹¶®·!æ!_YBчø@š›©åñ+¥Ï R•>/°6À݃¬-©XÜ[ÒÒ…Ç•õ6+U Ú€<âl×s2ÝJ(½WþYR¨Ýñ uíù>-À¹31ónÓ€„|Ÿq‚âôò9Ò*O|é´èw}Àà­mX‰Å¹ˆíE">„F@ÎC/A Þ‡Óõ»òDÒ’ÏrÈZ¤F„6:ä®UôôsÑ> µ×Ò;åõ›t%´¹àäwã¢`+´`ÑôL<¬éø›•#J ®€6†3ÒðÍÑämÞJ½?·'†Þm–}¯èÅ.øÞ&:"„BlÑw«%û#Sõidª7Oº­þþ˜‡³Ù¥J`_‹q'ZD–ƒ™»@À#‚H$"…rNªÛèh7þÁDN5º o³ø­m½û‡Ñ&ÍÏÉïú;™Vê ZµÌ<ÂX&ó/H»ÀŽeRÄâ%2‰¬èÎtÙòÉD(##3+#³†®Ï/Ӓθ˜á®ÆV„Àªm 9ëª?Örÿ‡ºöá‘Ñú›§q»¤h³G¦²žv2Ø^4¦m äïKRbŽ[clwŸ^(êm¤hsÞÎÔ!ì\¶´TÙÙW?‚«Ñêg2†6ΕÿqŒ©:´™j{Da8 ¥*˜·—"Y‡S6ÑÞö|}u%9ÚÕOwÞ;´ ¼¸Iwõ¿–%i–ìkWKÚ§Á›?‘öËÔxý·½(‡@OàIÖ{=]¾ … ˆËZoÉôÌ6Œ6†Vsù!Þž3–Ô½œTRÀ)y´ùëM½‹Dá.•½~‡HRŸF8‹_oÙv¬*èÇ~m¤z(#v ƒú$]íFk¬Îe9 Þ|#CŸP»¦ÌÛä”’[M¿àɤ Þz’’dkßóெ¼øcy-Ý&rõpš ËçŽrùE¾×²¾ŸË(%šØ ”n9„ô6¯L<®©ºãQùΕ¼ºû 7¢Í§/bXž$gѼŠP8 N_=‘\œv4<Ú³Ëv%•÷WÍÎ q/ËE?àþ˜´TÂU6 ¦§d½qd%¼jÖdhÃ=@Äo’ˆ/.$ù"hãfl%Q;ó¿"7ð6¢`bj}‹p™t§{I%Ú¼?j͈–ñÉâ¥ø°½`˜ŽGõ,JÚ9ÅQ_Y’’¢ÍêÈWÁ‘ªisNzÆ>P£6ÌL­‹í'ÝÌcž6'bÝËzjin úgàæOÄ}<™v7@54™¨¹¬o‹¤½â¨T8)Õ… × Sbmf•tÝ-ñw¢ ÜÔ7O`ð8VopkM ô¯¿m¼lâ~ì §%.M az—ŸD¿mœÊN{é;Åò$=(ºf‹10Ê}ùµ§··îí&}ø’òVò…ýŽQ·*¤R¼­õÍö~kéêëë)J=¨khújª£pì ÝP/>ïMßÀààÀ@eqš¾å~¿X8QBÄÒ'¸rw° æ­ŒùCÊ·–†?í9Q,7²xWÂ6CóTÈ;:Ë–HUyÑöADE©ÑÏÛÖ¶ämÀ–g ò>õMMM}¸žd³ É÷Œ—5ƒF½WåÐúø u ÓîbD ãäÄG׎AS|¢ñ.‘`ÒÐ;41>Všä«çÎ){]Ô•÷cã#ƒ=ö&ÄÇM¯‘²XÚ39½Â¸›jz¼xrzª«òæo´ù¾Y§5×Ì°yRÓ=55yïØNrÀe@…Þ¦Ód»áƒo}ãC]µ4©fŽ«möÊ  ºsrb¢îyúv‚#,¶ŠwÛÑ‚/?¯)¾D¥“`´W]ŠŒÊo‡¸ž¼TÖ;9³´|Èœ¶ûjÅÄäähûK&û¼G æFÞ '=Ô%pÐŽOŒõ:3‰…5 Ü3¼‡:™_–³¯å=mÔ0Á–GhˆÅ!æ´`kfâsÉ‹#5·ˆ$fSß0Ø’Oã<õ“àCÈ#åÄÕ<Ùœz«¯ï L“_cÌ# Åfwa mÄ[d϶„ù8›YÚÆÝFl`„;,¾ ­ÀIø1.ăךdy /\`þv¹jºSÆmFì¶~P©x)ªxÒÅܤcD›!£|^ž5ísa¤=m‘-‹í¯ù¹ZYZzm[ÝÈŒ=:Ý•$¿ÿÛúꦋ­……íḠò{ ü‘Ô¨ý¶Vૃ§.CZKQñ^KÇ„¯JíÓ’én¾;_´E+rŽX.WAË´`¥ËÖÒ|ºôúPªöXÁFcáiKÔ©ÊÇÆkò=OeBR´Ç6ü•d_è8èfjfqà\ŽÄƒ™Ê‹ RÜC‹ýͬ:¸HÕ–ö˜‹[¹’õݯ\,ÍÍ̤ð~dOƆ˜››[»ø=i’̕יa¦fVŸ—;:x§™©E䣃sÖßÆ=4µóŽ·k|SÅ3Vf»BSDp©–{LÌ] +zŽS}!¾W0Ûq"ØÓÌÜÜÞkﻟ»3‰ö±´a0ÌF#‹ù–ÈgSS³€È”YI Ðè¦,ë Oš¿ÞÛ_ ¾yzÀÚ,NÂä¼L ™õr·âÂ--Ì\ý·MqÕß}ˆ93ñ‡ÁÊZ¹ø7LK.%Â,§K@d'¬¬†îã­ŽòåÒN?5¥Ó[d™€åÎ~Î`VGSIÜ ,µPL=döË…ý”ý74xò‰¸»)ZùÝ¿nVÔóH‹ÀUõªâFÔÝzq Ï–}µÅÝ›/Q¹†_’úTÓeÿ¡hþëM}›°ßÀ>ôýH[ƒœ/ª­ú×–—EšÞÚŠì%©ç¢ÍhàÛ£èzþë¿èÊÂ]aó„šý©ÿP‹!øÿÔ@ÇIJàß½(ÂåÉŽþI@3þþü´4ÕÛ±Ú{F4-£! iHCÿ!yhï¦êInFFæ’È¿“Ù1¶úÙ´¾¿YøNY¾þ\zíÅ×)¹ÍÁ-—¨žÔ¬Â_ÌÛlü–xêë…k¥ÎJñá{z@x#'kl‰÷ïÅ ?û$¢ÊT‹·R3GD@]þå'-+¢µ®«Y™} Y$þÂhæõÛÈÞò‚k/©^…7Ùù(ïfVVÖü'Ã˲£ý¼ÂôÌ“|Ù[ß\½["ÿÉš§O¾vó†Òï>ù 3S·S3†„@cÁåâ&ÉQýÇyY]ÓÂî//¯dßãÈ€¹¯On¼6P–GZ3oÝ—6ô~¸¥êÎkYÙW>/³BþT’ÿ¨º]Vkþà»ô‹éK¼¿y¶õ…‰•[X´*Ü­ñÏf~ “â8ó]1_”ËïÅÜmÇ< ÀT/}‡–b¾õHt†ð—Mžñgñž'‹”ÃGßFÄÞÿ5g¨ªù q¦šõ©'E?ghˆÅ‚„Øèyî–ùÿ9°¦;Óï̽o?7Õܧ\sÿkŠÁ3öºäÈ6Œx»&œ-£ 8Ï‹²-ìáZÓ ïNy“tGåí;´ñ¡'¢S/^8‚ÖB¥¿BæÚê. .¥Eb$Ð[~‹³¬UPü><ê}äv§¡ÐÈy߯¹ünÝþ³Nz¤VpØï3:ôA›U+#ú x™}܇ñMþ(SQ÷e‡°¢!‹ ‰š"œ…›4sÞåÖXc»“çR/$…ºè˜}†Ã®ìóðK“€*wâ+Ys§~éoCç/ͼ̿H5wklh‡»m ½CÁ`w{CCCkW?¼ºpZêšÖà­Ooµ¡±yUbÏ/ìl¨[BÐ&öëühoCCcgßÒ2ãýÍ“ìÙÎjñ~u]ϴͼ27ÖÒÆjš˜G²˜ímk„7ɹ uMÈ€œío„bµN-I¦¡ˆ;ߥlè“mp VfÚšÁxÍcsÐâÀ™L?à™ÑÚ¡x¹ÞÚDm3r:H<1Ø fÒØÒ>ǪëDñêDm눷ÐÜP×ÐÔ¾+Ä+#uãkó#µH´ñÁ°Ím]ËЉ'±½ô¦8…f^WßÀk=í-õõ }£bõû#b±¨¥¹i…+¯Ž×µp–ÆjÛ¨“CPþí=ÃBÄö‡½ÐØÜ*RNå=Ò× ·Ì„lÝä,L´4Öƒ-32-¹«f°»qr‰?Ù߯«²æ[î8ímw,­°½_²G?9ØæÓÒÑ WH ðëš»ÀÌÚ›êš'á‹'xsã¹ÉaN‰Í-퀈ÝÜØËZuC™€™–%m@´!0£|l‰Yo%‡²T¢ÍTM.žU-g´9[}•DóRD›™ú\¢¡qÕ¨H ÞD{½ÿYØùÄÈò1"rš›¹…8+ãm­ƒ«àȬ¯¯oíÊ™tŽõwÍÛÙ/®ÓƒÍý“kƒMõÝ‹PˆÝ×u_Ïð2NÄ"XY62õDSAV¾ì$%ªª“¨#ÍÐ2Â|™°ï, Go“2+*Ð*Î:aèAórÀöù’—¹C4Omø³-fº¨ ïg¿¿>܉îÔó¦åÝ»wWÄ2ÞFœÄ`9z¦ge†8šéša"ÈTûI74Ø&›ã)ÆÉÍð¹:v¥‘žÇ„6–^§XvIñ§Ì©F'Š #™ŒÃ´ÈœŽîÒl*žtþÚ·Ë@M ‹N¾sŒN"¤ÖBãìY„»õ9Ø¡Áhùv‚;nïÎŒÍÏ¥\Ž‰4Ô!¼« m”ç¡3W.%:Z3 § ì÷†ºØ€cI—ã"h†/»V;?ïÝeéâw´ðé;…)Ù–ý“ñaˆ÷Î=@2µO¼tåô~wÔj»:ÏÄ7ué^Á.ÎÏ^¤vÅî„´Îm—ôíŽìs´9™-ëïS\)L«äô¬£®:„C|PX»pÊ‹jâ}ûN>àî2'ÚùÌʺäeJfd¨°Ä"˘P7º tçèZ u´8™†ËðûåtLŒ»5Ååè-HVéýH·ræo`´EÙÒ­ÏÇœµeöÝ€hÏ5èà÷ŸI½œpÌÉoFlt°‰¯Ï!ÿÓ9eï0ˆ¸ uËó5e;mé»#ãW@·ï½Kõ¦˜Ù^ÌÌ qµAÛ„$ê™J’ÃYoË;OÊnÇïAi1†9ÀÚ@Sd°½µóKÅœ^K¦É tbS<1 ¿\›]àAhƒÇïãöäè;ÃX©mî7ٹ)Ú°¹#/Œq¸ƒœ â1ÀŸ˜]æüµaØù›`­ß‚Å]VàŽ›o9Svž¶ßWZúx—-Ù/‘¹Ä/c-ìÎÅžs4#\‚N¢ÆZØùÇYzH|"$Ï›I²ö ËNO²§â¼ÊØÆØšAë_¯,{~l–qJöš%¾ïÑ&2ðÔÃŽÂ4ëÓÈ‚¬ mÄ6¦„û5ÃJ.‚Ñæ)ÀísÃêžz<ü7fž9ÐѱÈV³uÕ}[K‹\µ†œà:QÉ:瀞t-r^ógº Iôids6éåá‹`¾6±ŽAcÌW×5]R¯Õ>šú•£†u—¡ÍÀMí$äNrÁòD™`#wB {[8ׯ)p32Zë*×7vA±‚;?°ib\õåö e[û…Áƒ©Ïíg'HÜ{îø]Är—˜s«õ)62]¸—ñ•gíÀ\µ¶ùõŠd¢»Xà^ÀeYA^a¹òè©4!`´Ù Ö8+ÌÝ7¾@os–µ=,B¡Mbe%ƒ‚»VÕ¿õú.V]˜–\7š‰·ñ4_†ÙfæÅ©AS¬Ø’T]nÖ^}B (ÙÞÖ7 É 'à µKzn¾…1U¥ž“þÛ3ðÍ°¢MÀ‰{€hÉÝŸÖ´¢†·™5#¢jG¹*+¢Íž´ëXz^a7€¿9o…ÊhÓ¸ð.ó„å¡ISŠÅÉN¬€GmËe±ÆáàÍ‹01àÌ‘È.1°ËúÚ›Doãyòµ´ºÍlh,~bb6®Wî•I½Ëȵ¦”·YjËÅ)æn{• $þŒ/ÁÀ„iz*õÖI2»­çu,>¦øØÃÚ ´é~lH¤Úì:ô¤²cã÷åÑæ'Ân)<ã¬(Á¥ƒ@oú6âA$pºã ™a'I. }yá°Õ‘´u´‘ÐÛÖ÷vµt8²Pgx[¢Í6ÜT–G^“)æl!Ò›ižÛ^e™¸†HúJ6é £ûÔA€¸ŠÁós{Mâî·JŒ^íÁ»BǺehÓóñ&n*i͸x_[sÿË%ÀBõ¬ý‚ôë;mˆk'äÐF-ÉЄJ'´N~—X%Úœ3Ý~èþ¸Z´Á¨m©htÅ÷Ç&t¤Ô7_Ö2özZ%“Àà×<ªµ§b£E‰Ö¾§_#-ž`ÏbD$Àm‘ÍÂàsÕkñxdCoäø½m ó\¯Id:Èæ©DóÍÐÆÓcxçm¥­žþ±'ãc'¯6¢Í›ôãVaI²%ã¢3Ë;¿ Ú©Xo6»o¹ òu@"ñÄn&˜úY‰–ØûìGi–½L½FUhm€q–‡{š®Å…èãÞíUhI)Ú@KáÒ\osU|˜;Ö”÷ ï"ÞÄHÿã›)$,Î>ê(.8ëê¥QÿÀ–¼ 4 ¦;jÊ£öØÈ&ÕlÕ³DR°„ñÖ”ÀçÚP"âMµSö²“ȯ/F˜E¤Ê£Mª§ÿ]Ù¹BN8ÑàX wK´‘ÖY~ ¢ Gˆ·ZÝZ_fÐÝöJ ’˜vÚºÅSRï~Ü&3ÈÑÆ8þAc#Út¸N³ñ”6æààèìÈÛì0t¶ü!´ÚÅ:Ì4nD›üSL× «ªª(‘¤!ôíÌÔ7rìáýÈ̃Ð&ðñ:ëï(ž¾äÒ¬½ Bÿó1kÇô¿ñvdHÚƒ³\µŸ˜~l–(Ñ´KÑ:ws/ˆbS9p}Ÿ IÊŒxëÓ :IÊç$î-÷¼ÑESKÆÿ¦y›†Ù‰²Ë:Ö‡dàÊ¢Þ¬…É3.Fïç:„´aŸ£X·Êñ&QÈì(N°rð‹—ð “ym»iIŠümhãݵÓK’›éæ»T“ÑI œÎÝÍ뇕J’øœ¾-œë«ïåHG4Q¶@‚³Î‘üQiW­Í¬@e¹sÖãPâ3ù„äA ÚˆZd9_t§3Þ¿›}n?Æ"¾ïx‘N¤™œ­€ä]^ïU¦©ÿ:é¸%Ã!$êʃwoJC,qYÕ€ mÄ+ž(ôþK÷ž|›,Oò£9””½*->¼‹¹+¹lÄŠ”ˆ½Y•2ÞlÚ+Þd·ðó%/^—ç9Ñ ¯”LÖ=ÐB›åêΰ;Š°dÜ´†eptñ“Ç热Ì÷å(ð6P^ÃVF‘n½yóêò ”é>èø£Á~»†—„òÍ/â.PH¤Y©g!Ú ¥îÍ?lˆÃ[ŸÏWâm@ŒºtÀÖ€bu.éòÕìÌã!;µ‰®ðEÖ2´Aà÷Y¬§‘eЊðoD¢ZªOͼƒ<ßÌLnAt‚œÒû9ññ ×” %ü°ÖSu>öò0Ü®báüå I­“Èp öéÅU³M/óoW"íò¡èbq%48W{ß\HIº÷ óíUÏ.&Ç'$]xR!93ÞP}©>Ú¿Ðq6ù&Ò—%÷’.¤ìÜE¾Ôû)û"”pûQ¹@ګõ™©à7“K>¶K:hm8ûBüÅ躄š›gm/ÂVdã•Ñ#~YÁM0—¤KWëFÖÔÝîÛ¢âp3Râ’/^€i`ªâlj‘PŽ¿¨~~?1!>-çÁ4G¢RG|^zrbrÆ2O ð& rÒââóž6Û¤]L%üÙOÑ)¹ü«žå%'&\½÷‚ gÏžé °6ç«Ø½,¸ž˜˜xçñGYÚ¹îê+Éñ‰)i•®èEþ¥W5¾|¹ý~òõj˜™h¿’Ÿž/Ù«|š6NjæíÁeXg´Úw.ñªÌðìFVJãм4“ vÎ]êbr¢Ì½†ŒD«mÉÉù|9^ ¡0%õJ¦D¯÷ìöÅ'5Àºu_kîµ+)ÉÉWsMse«=ïNBÒ›1Þz5»cÏǽêWk)âM´" / •%©½¯z«Ÿ$%Ägæ–råvÀß<º•”˜xóÑ[¤ô ¯3ï¾èYoTÞD~Îåøøøë¯%Çç3—’¦V*Ë[î»’/”êÚ>ç•ÔÈ3A·3R2_@êÇ¥Á†¤Œëòüé`û¬´Ôä”ÔûO+dƒ£"ÿæÝ÷MòÑ®\J½U9hè·Móß.]¬ŸßÜPM5õÜþ‰²ÿ/vjò{—-θ=s7 9x¥®…WªÛ²PI’Ru=†4ôç™Â›Må©G"T¤G#ßdý¸÷×E±H{:ê„Ò·Nœˆ/ìÿÎúl]ÿØý ¨j –;NÔ=¥š6ÓÐof€þàûŸõ­_·ÑÐ3šÖ†4¤!ô!žy¯Ò½‘‚ð­œBK¾)_^¨_åe›JÄbµ¿UÞü¸1±ì$ž*;ºŸy®[ügáŒ~ƒBè¯ýÍ-{\ÃþíáÌå@ëânX«/˜fi£ &äµ¢cÔ;V ïõr:÷¸[cðk# ÚÜÁÿó¼üxàûšèj“üV7Þ,+‰3ëH´u$é£Í÷í .ïá¢Å(O”‰IF™;x -+ÄCÒƆúb±G1s«€¶¼D¥1»êèû"ç¯î3íKFÁ:„º`&d,ÁÄ<³¬K¾8S¯3l¨$ÓàKrƒšÇ0 r?Å v–g0œœIœ!všý½Z±M"`&Ö~É̲g÷GÜþª³y¥æ~ú£ÚïŒîÉúcÖË¿„7ªª´ˆAäõë=ÿœ¨2Žðëé¿G…#Ï_2÷ 5óõ¯žß÷ Ž<àj{$>ÅÉý X²BáM* McûÉ2mç,pþYd/%øã,÷ËÄåw1†þ ~† ¯g7.7N{‹w¡›^Š ³ÜWt¥j›'#¯¾=gî<‹<¿:·“ùP)íøý(fbRóà,Ù1TòbµÜ£M}»1rzª6ÞÜÈ;›½O/è2DÊ+fc»‰ì¸¸hꉡÕEÙX¬Êµòˆ¸³q§îZ– ¼–mB%6M²UíFæmãÚП¹JŠYŒÌnæ€WE¹ÄJÌIÅÅC'r>©ˆ§âºìuÞFÕKñ–j)±* ˜JÆuŽ4¤fíSŽ[‚"û·j ôWÁÛpfê­éFí.ÌÛ¨E1wûaj}pŠ†é1wÓÔÒŽæüX3ÿ³*?Ôøô’>‘žñ ^=;/è˜'À E1¦;ÎTs%ŽîyŸˆZfC <…8ÇÝÄ÷Q—ds; º V,”IÐFÔc¬k…\OÏYž‡¬òá7PòÁsÃÉÈ]j‡ôGíy‹Ð2h쇹êÆ?Xêýœ”]Øѧc`ïlûmÿ˜Y½¢”ÅËÛ±ÆD™€³ 85ÀäÐxž}Ò˜@`2MˆÆŽùß`ÇA¼(;²1ƒA%Úøëƒí?^dŸ7¦RLM™DË›¯Zøc,&•L2¶¶tªJø“mœì[¯ã©ÇÞ/¾Øý‡ŒÔ“!žn42õòÃoHK²ÏSiæ,c–}@eÏ2bÇ›a®?S=–ŠD%›0̼#ÎÈ6]êۇ Fèoƒl`©÷ä'"É2¡ì<3£­¯•öµ×¯pe<*Ä@¡3(§ÝÇ‘Ö·Žâ½Î–íó÷ótw6d8W/o€~Ú©=$•iLf9îþ2Ÿàó¯ÇÂã‰x,&àh˜æfO$[ØÚ'6¬­½ÝûÏôÔÑÒsÿÆ8$Ëéã1ô¾Ç¢ú˜ÿ‰‡®¾Ç·³÷t£¡|ód_¼ºK{ç¥fÁj—ζ?, 4Óù¯‚®›ä6Nž°c¾Âõ¼ 0T|«·ãp|ÎǯõÃ’kˤ—R ZéøPˆb·tMÖGá”/ƒÞ¿$"y›éoë“]×U˜`G³öC[“0Ê,(»#ÇÃãÒt•W˜C|ÚÀÓpŠÍq$ÂYÆ‘«`VãÆz4Ätx­"BÛ6l=½ÇðA·-H¤w£+¢ú¤Ÿ˜gñ—¡O톪ÕO7Äv-ÂͲ҄Ó3‚n«cùüUÉ¿†~«Ü˜?=yí˜[Dî‰WÏÛÀ:ß‘p$ÈÅÑŽJÀàèžßF$×>çH;ò\"agxÅT+rôðM˜sC’ÅáIEÞfÔb;þýºÂcÍ¿ãÒ]LSIè§5½c'|hxâí‘u´Ž×Wb@ô”Wš\ŒÜò¶Ž>Ok7*"Ø$ƒü^È<•¿2ÂŒ%òh³9Ýßcãr­JA³*ÇÛØó]­**Þ<{@¤š, Ľ·êÑv}êœ]”xw ­¨FIǧfxÒÆžøG1;ƒàZf„Û¡4ÈÍétëSª%dÝÇ®ŒÐ%EJ .ïÒG¥÷Š®Ø“ÜïÔÍNO´8×fµÝè¢Ï×ôHçã™o´1ÄQW‘ æ\ÐÛK]­p§^’pKëh›O4}û\QQ‘wÈÖä„KñVgÊ$®,¿Õ5Kl`nÖæ'Úê¿©J.ÅïŒ+ÇB…~XV}xý Ú´‹äѸ{Þ98¶ ªæä{ÉfEehæëS[áqb&Á^þÚ§ZÅi&ð_7 g¬QøÂqy´ž o?õzi£n¹<=Ôˆé¡%‹jéàä¾$w[ ŠµÛÂô:Ú,xè¢ '×='X£õšÖ–½É2™L¢°Úá Q—ZŸ{ÚYZ9û× 9já*92´ ì)ŠÖÒ¥=ëX–×FHžæª1Úôf‘²:aµ÷±®ÎÞ;c3_ã(!eH¢ïG›W«½ù5 ['2´™xAÖÇìÉy_YUQVˆ  ùvxàfkJ£(¦£dˆ&Îïwc˜c ée h®Þ7·‘÷‚Uq†¾·òu¢¶ÕeiýØa$ݨzn„1™Ê`™ÊˆÁº=¨mð´~Òý¬¨ŠÉ>#¡d´æDë¼Í—Üp¼‰UNaieUõýƒv&'a´‰³ Œ«D²ÔÑäÁ\I†`7(Vý`oÔ^&¨‰9…«ªŸ_:Žw?"Y‘aB3Ga0¨B›…ÏwÑvçÏêÓLûKÐÁ.•hÃù½Ãô<˜Ñå=ø¤keÍ_9±Ñ!¥³ë3SÐÉØŽº?¹ o^å×Õ5ÀB½š3~ÏUÊm^ˆ`ijý›…u´®yê(œ’8¿2ðÅ6‘””\¼ ÞhSv õ6óŸoè˜!^j·¢Bó:—¤ æ=ôu®o€£Ú—>€rŒøž‡af—„_ø~´yvÐÎ"¥ù‚X$äp¹´™âåEøº$Jø‘JÚÈVÿª›{-Ï(@÷äC-“ÞŠyÔJûVM/k ‹¬ÚèâJù·9gÌÍ!ñ²Ç½néOQ‚Uƒ6KžFÛ z$]É)"âlWÖy›Å]zi]’Š:©C¡\7£à8xørS0Ї÷ÑF|ÅíÿdJ"¶ x_%Ú€õAaËg—YFÔN¸ªÐlÝiºŸºkð?žF3üWB«“é9wUîïN~MÇS˜eÈ„ÎÙejæ97 Vl±Fv9R†èÚ š (È‹b­(>÷;å3i¸ëÇrJ~ÛóÜ›o:7G›Áª[8SWDæÄ ÍS¾'WÔwhä8«~cw‘<£_ÊZânšDK ´g¹à)³pÝêïÑ%ïDfkKñµÜ£R-1b&¸“T}QzQš´~xVÔ;+P Gîáô)M°Q@ñYKßl©Þ†ûölù@66‡,è$Š1ˆgÜíb·J6àîî7sMæ< Óƒ$0·ø«Íê…Z>‰BÛ/ûÎ盧ML˜þ)Úà0!eÏl}ŠjVœÓ•CÀ™ŽÂg—[Šp房²ž¥oZ¡%#ã¨[èÅçÐÈwu=žƒ<'9‘,¾ÉémxÇ)ÛÃUÚèK/;*>ä¾:´‘ï¥l{œC:|Ò–ÝêoIÅÙC÷ NTÆ’Œææ¨íÄõJ@0h¢Cú¬Œ6ÀÛl_Û}—©Œ@¼±Ž6ü†.±Jz¿è˜·%Óx_¼Ä齈¿ü¬äÙ_s+ào—&êm34ªÙ¥¨/ó·§ëêê ‰¬¤;/Wø’pÑÊĸ0Ö…F¡qÆ'/?˜Yó;uuu{—øë«+4›¶ébGxâûÞTtxñfhï¡4–]3ÁêëEßzÍ­õ>æÅ0h–S&sé¿qO qîò67Ž‚10ÐÓ³ð «^BÖÄ;öº¬¸o²=)g;JQÄ™ø梣êøÛõ¯·¾)߀ÓU‘gN6D¡±þQÙKBP’ZâtêÆ×ÁÌ_3”!Ñ!àØàû¬ƒ³™9¿ßod„Ãã½".LÂ÷Wæ'³È`€ÅÒýY=¤\¬ŽØtPêà|ÈÓÊØ¡ŸÑŠXÁ¼CFIöI2Îhñ´qi𶷷-i8<ÎÐÌu_ÍÐ"RÙ,+]âYH¯>[“o¤»ƒæ '·i¡z'ð°[Ò»ñˆxH=‘ù¹KD&IÍv¾±&È´°Ë%¢åV×#õÕ£sTSï‘êó?úb´Ò>`¾ÃÇ ¬#É÷dögl—±>ÓóX˜ê‚$c€2ŠÊ.EÎr—Æ{ïÐEÝX{»÷™\@ÆÌZwùïÿ¸ÍÿáÒÂoçþ wD²+—ì«¥‹Ìí…Áù=e‡Þóig¯vc ±CKš=©ß®nXY³p6QùJI'¼Er¼ÍÖ¶Äê"Èó6:–ªUEÒ+ä…-!´±Ó¢t¨)á¯ÛÀ˸}‡U䩺Ä€úfSÍ«(¥Rž·­ØÐb,ÒÛØ\ÙÐ(*l^Tv¯X)™*ƒŸ½n„ÛïÆÕ™UË’«>ˆ¤ÜGª{S•­ d].ÿS¼ÁP|ñ}²‘G‚üg’mL¦9šY­¡Íô6ú&‡k¦V~Œ·×7|ÈÄbaluAûä­×clu Æ?Þg ¸S½å¹çtˆ¾ß]ß“Âçé…“=ò¶ô¡‹‰QzùÌÆ`Úüº$úòñ™5aÇ“öoV"Zî)/É£>—ó‡&¬åäÕÈQÚŒÆKOŸŠ:þîÿoï=ܢض}ÑãÝïÝûÎùî>Ë@nè¡›œshrÎI‚dP@QQQQDATÌ 0'TDEr’$çÔ9Ô«ÔM“t¥½ÏZûÔïs}«¨®š©æüÍ1ÇcÌo¿ï¼HÙ³#û“SÒRÒJ3 —F¾d¦$¨ÿñk3/.$&e¼ï›ûK«—>¦îO¾]÷ME´‹z®%{öOËRšw íø•·À_¸]¤OÒRÓŸuΘ~ 0üÕÎßƯùgÎË?ÔRý•êñüoxK¾mOvò–ÚÖO‹SØîàNþ“àþ¥¸JÁk_TXPü•q,’‘v¹kÇŸW¾éÙ3ùµ½\8G¦Ð†VÄ¿iÔÊå2t€Ì¼Ü…wZý“ÈLsƒ±ÓŸ“¦"EÈ}jUŸJ‚͸_^>È¡“™lËâ'ÊÇŸ_<À¦S8–žoúW”Ü ™m s2%‘™ñ÷”“ÈlÓ]S&™ÌÏ­X×Ëe —cñZFãâuj™üzÓÞF¡°N?ÚêYêÎaq¯µbÿŸ&ü`61Æë|ã‹%²ß›Â¿® ùQ¬ô²î° Žlø—aùŽ3¨\6;;'•ÉSZO¢M¯7Ž!l³‡à¼ú[3ÝáiÞÄWºÙA™üϬvó¹˜äâZäš?û‰¦ùÓ¡.þ¹‹|ÁêT»¥Žî¾ê9ð×ëöÌàÓËÁòp-Sü¶ý$ýÆdÇí“¡àrª»Cªb­¯ŒJ4]à ¢GGÂ~Ùt|ü¼Gß÷КŽñ¸‚Vú_Ÿ¢˜|[X]ã­ÄÛ[f?Tmœö3., Íý:Æ6>>•‡%]é/N ò< ?|?žîâÂM9yîõ«>\•æàhwý$Û,t=‹öwwãú•½Dݯ¯æy—¼øv4Ê#ºôÔ‰;ĸ¸¸ºô @ƒÕó|¼=E GãýÜÏÜoP’Cå© ®[ü¡K<ÅXíàáææSò¤ ùü#ïor£!_r¹Tàã1 8Hìá ßìkƒ€pÁÝÓgyîk€»CÃø6l¦:Ûö4ćëœÜ;9†#q ¶Ókψòkš|¼B¬²ÙúüÊ1o®KXò‰iÙ–a¢ÉSiQà+û–);çÁXîû¾©Â¤@'®wÉÓ^XÎŒðrá¼þ¶¨p‹U䧺¹¹…'[’Á}f’?×{ßÅ+‚“É¡ÎÎ^7&ë¯'¦_ø ˆ–<<½ÇyÐX~’û“öù›GãÜROÞPP…´4'ÆÙÙãÂÓ®ÑWÙ¡¹ošò<Œ˜ K;Ç}WÞó¯ö\Vä3ûƒ=<<ývBö™ò¡G6ág¦Úo:ùD"tûªâ„—»«oXRË„@áë!<Ÿïîæ•Þ;'†Ún°¶µ¢3¹‹2 ±æ¢¿—ëéwááçÍë™±—6y2^w”‹›{`MïZTÉܹ¬X·¸ÜbÄc¸"Řc`dn”í¬õ–»9_‚¬›ÎçîoþŽž‰ÙzÍÃÈíHEf ½¦ !’ÕûKÁvб­‡,ô÷£½ Xm%kBvì¹ÆÌx…ÏÚäƒ=8§9°>‹ß«;&I]ÛHÉ6ŸÊ>D²3_ÆS|NáÜW*Áñm¼‰*ÛHOù[Ÿ|³ˆÅŸ‚÷ÅŽ,«ko¾v@'p Xãµ îè¿SËtŽœŒ‡ß³uIo»Gy@ÿ› d¦e}[O_Ws‡wÏ%›r¬Â~jíã« ú8ݯú{ÏÆs­bNÁR/Å [»gt O}ou'«ûÌä‚t{ƒ S::;ïñ%Øf€Ckôó2Õø}sW_wkŒ5ò ÄK“-/RŽ–ÀlÃã°(S¨Œ\–È 9Ý ˆæ)š³Sâçæ–ÉV¶‘óÏi¤ëï;zÛGZQFÛ¬}Ò×Á•¿hkz+?†ê€ÆÉ9fçœRÔÞÕõ²,SK_usì‰ÃD¼[ÀW%ÑlB¤ð¸ã²MÜ“ÛG&‡¿Vé©Þñ}£“# —õ´¬F¡ÑµcL>SÓ7Ðÿ©ê4™n5&:~_‹lw²½³K&—EÛ2üÞèè»u$ÎØŠé¤ÎShŒ¡Uhxì0äØF|虞ø–n ¼Yüäš9'öö÷?¾xÈÂÁÐ,æ%滇 ëÜãÏS kÀÌ+-¼¾PZKGwã› ŽØ='F+µ(æ±I…í=r@Vhm•p¾«o ãã]Ž.©zŠ.áC׎)}ÖÝÛÛô¬PgÕ/dbÑÇÛ‰,“ÄÁ¡ÑoWc)î™m=½½]­½©^§[7´ód•&–zqtbj ¥†ªG‚Ž^w§â2®¾íyùŠ™7_"//d[Åçßž˜‚ø žA®_‘ujׂˆ.g{A#C—=)BݸF>^cÚA&ëYfÌôZ¥¿.?Š¢qzXj=G4BìT{ïæ\’×K'jT²j`Ið²ë| !¨½/_ 1¦>ù.nØoª`Yeö¾ÊÆŒ(þÔ]t6sÊD†ÓçÃîôýw¿ð,p´c÷ GîƒÏh?`±7ó•Âùxéž®Ž7ÈPçSÍüÒÊ‘¢#XmŠjì”mhU#èáSS8‘'øã_‰,CÅy…kÕ·ï/À1õ¸Å_{¬«é6¯"¢ìÀ6 ÛÜC§¿­²Íû\FâM$þXž±ÍëD fÊcÅäû­Ny ydÍp¨¸¾EÄdWôüÖí!›æSA”hÅIô€ÄŽ@}3Éa[‘½wg-½|ÄíºRö¼™&Þ•éÚ+Ip4:÷º˜|´WÓ†û Gô)„ïkHà*I¢‘ƶag–}@j7xǃæŠ7KVdú ¤œ²£V: Û€Wfú7šÐ•Ô^MN‹ÂúÎÚ˜ò¼{ø~s¯ºQrvÚÚFVNØ/ŠÂ<⯀í;3=³:T¯ý_ÊÚ Œ¾;È2?Öêu’­Q\‰b©'Š7Z OVïÑ4û†ZýIMØ”÷C+Ý—ˆÊG\i´šQh…w"Ú.ó"òBºÐOd™I¹ê ¯åÎA=}?HÞXxBÆÙ/(ˆh¦éÙÂ|)„Å8ß2­HU–k¼7­ê–·³ýp$¦¹‰>ži×6¯êlÞ¨*Û(3â÷V“p¬Ïc<¤y?_ q̬¯¿(Øf‡j~/Û”8ÚD£gŸô²§™ÙÙB°³³!këd6 TØf֧ñD~0×Ú¥Ó%Î'ÇAš$ t¦©•âk½½š†Q¶ižA‡îåLÓÈãõ³]wé§ö´U¼n¡õ‹ÖW•YeG¶¡2º—Ñž´•m ýü.¢§³É—Q½ÍAãˆûë“#Y+³Yð>Ñõ˜ÛŸ\s§š •·µ¡èà’>A+”07úå׈…ñ W“øPáÆÊ¥í}5|º‘Gfé+Þ²eñžkéG»‰«J—>ЈÆób4Óë醛ÙÆyêên9ZåGç–²v¦­_qRñÇBë­l³‡¸®·±5¥>íœÙfÉù‚™W ÕÚmi6ƒí–åñ¹t¼Ó…ëáíãÍ!j]j®³ 4™Œe;khéúD¥Þ{þy³–n²¬º$‘ËÌ8Ô·ßV+Sƒ(l#eõiºº1¯'UÙæ{C)ÇõœŠU³¼êd˜žiè0iå-g9«`µ‰/w¨Ö\°œÑúÌ“_”AŒ$i{sšå¯óôLC¾ÁáRÞ]N#š‡‹¶“m”TÓóê’:ÑüåÐB&kß^Ò8¨ÁvsŠ)÷f7¶-õOa›˜äúR°½gÙ§-J=%Û,yãÔ¯Ìlþý|²Q|!uAzÈœóni³Rp¶ù¸ÐWCc[Jer•p”+zEã;ïJùªls)Ž¡d›ž•Ùæb°#÷<ê¦-ïÑ¥@lsÊÙØûz‹"ý]í£]r@ÐÆ"¾óU#d®ç^¹ÏÃ¥p›º³M˽ߤÍïL<ÜMòDšCºü‰N4˜¡9•í£oe›‚Mlôh“zQÞ2Ú†mÛ± Ùi;á|=b°É9nyä=‘i¨d÷pÖîÍl£%žUº[1ì2^n’m¶²MÕÁP»C•[MÉ6Õûɵ<åöÅ£ #ʳP釄D…b ýÉqSh}$¿éÃò¼¡áLÚ¨Ÿ¯iúÄ´†UÅW[pÑT¯ÛŽmà”;«LÝGUŽØ¾Kc9:999;;Y‚ýÕÔÆ~ß5ŒþYl#æ«ÕÓÐÁ,[½SY#ÙÀ6@y4Ó3•¤ íϾ md`ð"WÏé,jÞ/šº{¿V¡·ÙÈ6ùu²ÅA2™Õ‰È$²>Ö?ö¾ãw÷8$?EÇùRד:H-“ˆÖøðá¸R¡‹ú~éQ«Q¬½;³\°º´*€ÆSQ¶ã1¤KÔ—‘Æ ÛŒ] Ô²Bc@I'>jã‡à[ꓪ;pÓö»)ƒN[^ZÇÚÒójìx´2þëDðüÛ|D}O5ÉöÓŠ¡úô΃YžT•mdâ9±mž‡Åvºš¿‚mÄ,횘dSîøõ•Ôõ¦ñŸ³Ìt™M§Ô)"|vÕ?ï˜Íõ=¢ AŠ€Õ梶fi£e³L0ýÚÛZÑÆë.rl È䢵•¾x¶Yâ½/ØË Cß‘‹î]À‡Ãnœˆ±Ke<`ÆÇS°zýIFà¹MýÓ×’Yüviª\ÝÈ (”«°-_—±Œìe¿»¤c É$åFÅæãÚ^Ú¥ÞMÒ ²Í¤‚^绪u œÛl©¢hO5åÞîCd!o ‹øÏm@dúYSlRR“¬™KŸãª² øAd³­D²¡khò¾`:VRÿa›¸Bå6“ÔÛÂfá–šgB'dÝÚÊ6—2L@¶/º¯EЩdÿÐ%â D2²Å^C…íœÊ QN¿‚ئ¯æÞ*é÷"Mð†Þ¥å¶IévÁí°Þf+ÛÈÎÛhÛŸEéš)ÙÐÊ%2ÀÙÆ%ŒLæ ñ#œL8ö^ÒãØ|Xaº{õ"›F"rýCÌôI®‘Š[¸ÐJ¥k£ávTŽErj²-‹`ìré¡Ù†ð`mö¼‚ƒ¾>@c0ã’SÝŒ©$vø¢ ’mv¶¤¨¦D¼aJfš‘¡×±l”m¨tÄÞf+Û€ <ËöÂã â32¬lÊŠ¸Û¸™ã Có‹¯7°ÉfÙ&¤ƒ 210&)ØÅOsè…+þ4›F·NJw±Îª>¶ÏÌÒ>àÝ °0PM£Óüý|[n¤’ïðø„‘vò3¤î¸êÍ6<øFÁ6îJ¶1…ØÒ ]Ht¦˜$¥¦8èõmÒÅ°†æaN„ž¾…·«-Ç)Pi`¯O0·vpBáÈõÏ„$œùצ4’¹­‹‰>ÙÒ7U)oñ´„z¢½)‘@«h‡ª%]ë34`˜sƒS÷GqhÄÐÃPÀɯE¼â`A£Rll¬Ý;eÀ1+M&ÇF‘‘“µµïЛù—ý&®Š=©$Ö/ ÊŠáA*„’õõ¬\& ø|¾@MÝðJZþ-SøOˤèg>_$F_ F’®/ˆA~B(Ë' €JÓø¼BÁ(‹„H^J‡b9˜>ò:œ>¤•ˆÁ'ÐìÁâÁ¿Š%àm88q¥ñ™X b“•ïŸÝ¯!oÉÀJÂÙÈdÈÈJ,'t[(R”1å U«ðOt½'—‰TxC,E4ÃrðMå4(äó¤2Tg*Âi „R$™„Ǫ:n‹ ’@¢ØÕdý Sݪ•[Hié$“ùàD‹Ä‡K~¹æÉ_à}Hi¸øå| ¦ ™î¬gŠ6µD,âÃÅ’HeèÇ•ˆr‹¡ôa3¤ÒByþúHJ°EHܯ 飙nh4!Ú‹Ècp:à'TÚ!wÖ!"å”J Ï‡” é‘HG…/’H•5’);òM¡;¢M©Jå`koºÇßhM$—‚I+Ú|ðYñþ—«Q`øÞ¶ûôwè#r¹ÔÇÆòä[x=!è0Òн5þó·öû9dT«WÙ¤þ\æúüÏ™P‡lO Æð¶ñrþ¢ào¶Ó'’ȚɅšæ_Q;@<ÛçaŠ' dýc•ï°Ý“nGÂÚÿM‡þà΄ó[_Á€ 0(EÉ™¡®º÷ïFg…ýòvÖ÷~ÿ÷ÔéÍ74tÏÿ¦§*úôw|_ýó:ÅŸ,QmJse¢µiˆ÷k3¯¼«kÀâÿ}HåùŠ9]/,!£®ké÷¦ð¯«ÂO|Àÿ&bÛFüZ|¤á7q”7¡MÚ‡ìî Ó?\Ùù[3Ý E.äž?»ê‚›Ò¶ð2_<ü«_]êµr\Æñ_/’ ù¼Å%äH™€Ï[[[ã DÈ^£h­“­Kn›Šà=A™T̃~ç)ÝdD‚5ðZÀ_[ZÁŽ;R$tsÞÚÿ”)RRôp¹Hȇóªì€‹ù*éËë>ž™þÀ¬•qÄ´÷*—Ëe2OÙÌ6ro‡îÄJ%à“2Å~+R )ºI+…¯Ñ­q>TH!˜:’†T>*Plǃí%T$"!œ_"EMåÁš@" áÛЦ°l#•&tà×DŠV°Å©€·ºõ¡¯ƒ-#“ ¹Co`3[0}¾JÉW†ê~¤b蔣¬´k?ÓÆÞ¿´ ÛHÑ)3•H¥|Þêêü±d¸ñ•ßHŽ”¾·þÅѨƒ³•'BUF?7Ÿ/”É7+«¡JIe"Áz¦ŠÍw¤Ñxbtó].Yª£èùLƒCgL 2H–ˆ!"\$ÜPh€º(|G,•‹p© úò0ÝÕ_µgmÍÂ/RØŽ…ÐnH–Ÿ5ÝÌñ@Ö~àyä\.(<‘Î$Óùس ̵±ñ$s︴Xo:•R[–Æs¼Ãьӯ}Óǜôó=˜ÍÂëe@“)8:xLít°eâÑâ ¹á8Ãð<ÔUF§’C£"ÙLJÔ¹çP?Zê7$’MÈ< ²î³?)&y³Ÿ”pŽLeœñ6pñðh™Ü*ÛˆíèZ_g žøíõe]½b î±kµ4ª—³‘Î#ød½¹ÞgD2­°¦IMÝ®£îÉmœ‚ì‚ “ g2‹/.$xï¿¢ xŸÏЉ„ÀøŒ`Kª¹²Pá}ˆÁ{žñ Œ½^V`¤‡‹+¸ÅqMºZzœI§~øÍÞ²‘L=‚CpRb¨e0° í}ô¸à —Ó5ÓÂ…Nƒî’âhW°O ŽÉ÷g¬,â!Ûlñç$÷”—«ç¥ë×Â\ l½²aNœ2cÓm}"£<ÍcSãµ(ÜUÉüÁ7ÕîÈ‘SKrm bcÓ†N±a^³¶q¦%…Z¹\x1#ÌXÒh׈ÌýA "þj=tÂËêÐ{"™î—îN'j¿AåSœLÆ3Rò ž~†™pX6^ééÉl²çþâM½+Á‡ºÏ9úè•¢<"™yuª©°¥”ŽÇûĤGxØÒŒáÓªÄç²HxÓœ#'ûyÀÌ×»†Îû‘ÏçjÆfÛº‡zXãñF¯!#;Ù­H*™š–È`øE„ªìæÛ4I星ö_u9~ȼ0û AÃâ2íɺ$63aˆƒ#÷ÃC¼,’á÷yqöù~³CRÈÜÂ. =ˆy Ø j'¬Ñ$9A«/8âDÞ{ôî3´Ø¢Néâ ™¢?ƒgva« Å¢[ÜIÐwÊ|…<¶ø6SË(C [÷!âÄ|À³j'›[WRÉÎ&eï ð)÷ÛGŸ·ÉiS-õ6:üþB‚KîU(ªOC™gdåuýxh+yö^"}_9ô35ͧ¡IwMgFš|†(2ß—ÿ‘¯8†EjÇ&Vµ!žÀÃCÖÎû!¿rá§x=-›¸ž—Ä3P_¿;PОƒî¤´+íÈÍo·‚ÈÎÀVˆ÷7ôÌEsžï£'¡"ã¼4ã˜m, ¶‘5¥á4 aj”×iPlxÐxÀŒzyåñé8Û üŽ MǨìTäsŒ0qIBýZÎØRü¡Ral¿ãè!_µ9¦†Qh\)Þ×ÓêÌH0‡‰Žç·ª‡2àu²£Å±'°lÓÇÐ4è‡8ú˜$æ’táå«/›|¯öæÝD3=gˆÚÇÓ”pµ5*zsÊÑ"â$ïL\Õ…Or‡(ýœ[Pä­0PäJò»†tΗ%I)åsÝD{±"ä}5ÕÕ<|³d-2Æ6 ¶q´½‰ˆ¨%†!iW¯”¸R^bC Ÿí«øI-zéiæÃ?—•U\ΣhéÊ€ó)Ʊ'Þ!z‚ƒ&t«¤SÈW+Îi‘îΠž Ó|$—K™&‘Çëç{«éë^™ËþxMŸ#HòeWËR5]*Þ,;³ £uI´mÄ ðÖ·â`Ûã`'Gè›|›í¦›†ƒ·³¬Ù7Z&§î4J8;˘ѵ6Gc¸ƒ+–Â@»“Õ{øY.® -µSÍr{Î{f=‰bÄDËblݸ̀„?^\—·üXf¸‘}Â6Ú–Rø±×rìCŽ e©ãØ5À”½®füé ¤š—Š²¨sP†‹÷e¼× ¿$ˆ£éå´ñ‰_wr—þ¾ lÓ˜¦a˜#Aê·Ô¬7ù.Û”ÿzyEÜ}oÍl‘ùFmRzƒÜ«Hd `úHq¥2(8£èiB/Š¢ã’]Š”êZÅI†:Š7HoÊðñtwuuu0Ñ7„O愽 Û@¯ÉD¡l¼¥³×±â›ãk*Ê^%Ûøƒ•êF2­ò…¼úŒ¸CEH)?}8ÖÀÄzkbX8í£k!é!sFäÓÕdg{ªè;eè€4wâ¶YkÙ›3‹í¿ Û”8ÚÄ¢çÛžò±³K:þ¤ú‚êšš¦9©jÄ '-í”+ÑŸUU?ªZÚà•)ÙϦ{å_­®RN@úr;Å5íÕä‹Xk£Àb-𺴹˜·ž¶°E –ß«V·úé«÷(ÛX"êmBŽmd›Q -\Þ'ëÍXõd–xfa‘LÀô 5—w^ØÅŠÝÌ6&y¨¡`°å3ëAF隸oa›u-ñ:Û¸Ñ/½D´±kxÝðâ‡ëÿ¨jB \14,è›ý˜é¤Ÿ²mÅNóÇ—EÇ2˜x]÷ÔÍ+©m\Jåíº¤â;5ÊF{òìõ¶™|3Fœ§¤)FŒø×ßU÷צ;ï0 Ý”^0éØfþ‘Žšº¦¦æ?þƒñ ÛM¶Qxe6õ D^UN%3ð~«Šx®µZÒÃYÅL#^…”–ªl#£oœóQ‘‚lnvy‡ˆu‚ñ&“ÃGõÅÂçÎ J€“7'GHŠ—yâ G%Jl¥u•‘ò]t~q)©›Tqé¸ßh¤Ü ¢W ~$³3ÁœfC(©ºkX>û&žs³«ŽNâ+·eØ—¹PÞ-‚#[lCw,=\\§ºbLÓi– ZZ‰h ðÆ6@„ážóu«Šfò`ß*¶‘ž±Òö»7‡Œ±Æóñj†q?e›«îTÇÒ^Tœ{|Fƒå³ÍQ*'UòC¶)EÙ¸â‰ãS4štq™ÅmÐо<‰–4ÏË’“v_Á6lh%%\êû®Œ86l´›T'üÛ|ºfí°õv’ð„ˆóÔx…®.tþ`se®[â%¤Å^FdÖ"}dº»¾ìÁ þÈ{Š¾±-¤ÀO_C•m¶?¤Ã_‘m䀬׊ }ôÖÛžžžW7Oî%X-Ê7°Mïëó$†ymc{wgëÙ#ƒÈkÙ¯|fápWž}êíé~X§a"¶8v•LG‡Œ+-mm÷áH¡#ŸÊHÎ놶ž®¶âX z„v²åyÒ‘ ˆpcF‰»ôrrjâã­FÆ´Ó];Eœxê“~ÕŹ³ô N}€¤ó©º,3/[ßèÔ÷¨ ’ibžX©£E]'Ì<¬]ÎÖ¡­!Ÿ¶'QŒXFB¸ß&¸›2 h‡ 6(õ:ü ôSÏålîìélùf®}¹ó×°M]EÅÌóSkgw{cž7Õ:ãùF¶¾¿Ê"’>·õt|© õ1Óâìû)Û¬5àqæošº»›_E{šê²ðj_‡‡‡gþ•WH–#n{Äf+v?dz¢ü\\¼®}«»–}¥”€¼½ý†×PÛ®+GüÏ=Ÿ»eë|áB³¯Î;8†š]áR¯¯oÛ¢Ñô.7=pt ê JßÉ_·ë§g¾:ävL¿Øp!ÓÑóQARêœYƒFª¬¿wÞß‹ëþàó0ò¢¸í¤sô „mš—Äå–#Óv"8özúÌÈç;a¾\Oo¿â‡_‘;'2üoÔŽ*屺ŠàEsÍS•B":‡ú¾"AÙ&øþ™x/*O3óþ2²²Y’çOq%âõÈlû*ä7@Ry8 œÌ9VÞÍMwÿc5X·îKZÜ;,¾8‰; ŽË7WrYT˜Ÿ™{l÷,Ô'Bpa§ #†å2aYV€.hdÐÝ\ñÔÜ„ÐéOô² Q¨D2ý@ésÄâY8ò‘hÊ…Ü[†epMÁV¼!š6ý%¼­¤Ê6æ¾)ª}¸»(V×ãèOØF&ð ÒÎ6Í+ç¹L®œ!F.y»×+ßY|G10®'ðÍp·î“ á¸Ä.tõªȆèÝ¥`#§h`cT«|/¢WêCÕŠc¼Q¶Îûáy©÷G…E6QåJë7­q©‡EÀ÷, ¦à¿‰m¸ÙeªÍò1Ùš }÷X )ÌÏ*k¶ñ»ß å?bô;¸:!Öº_Á^n2áãâ :‰H%“¸±ùk’™ggq$ X Ž%ô{^•[²i`we™sŸµOws-jêêÓ|)ƈmÎØцýp+¾ÍóT·„¼¹¯gpŽA(–߆S‰ø¶y¨'L¿<§e;¡Ö[ëå‡ÚúçÁÖìkƒ2£iUžcoÿup~[lx^¶6H£ÑISÖb/— è’,s¬psŽµ!óÙ 4G=/°uÏïXj=KeØ g“Õ—$QÜ“a¶q;C3l0úµ8FÍ8Qºq¾‰¶æ$T@ )ÿ ƒ7Ó5‘$ª/b‘âÊÔãøƒ´Õ{Õ…XƒôÐâx·#·;çî,=Ñúö•[^œcÅ_€L‡îÒôC¡iÇÀEB¿ƒF˜âŒ¡³JØA©µ:×~ß#¤4¾Öú…¯{‘úß±¬½‘ël“ªú!N„:;ºö3Ùè<çIÒÓ>zåùäÜ‚":ÞâÌ žö¬›&nË6OוŒ?¤j›aë+µøËß~‹p1e­¦[ܵ²£åné?ÿÐp=šc…0†£/hfa"(ÆÑbUÕc(ž†?Ä66–ž…èG”µ0ÕH­"U¶‰À›BÝ'kvÜ@AE²úF7âAwð»!‡°)æËÆMƒtxðÂI oŒI§Þh—Éd ¡T’g¢[9ðÈNÏŽ¾ÓÊIñtÝ'ËÀ¢ïƒq¹L&•‚Œ2h´‹ .úÛ¯¸è[VtÙ^ö½Ú K q‚fÛ‚jI¤…vÔ€ª1df›{{a/ÓoÛrpµsÀbk5Žfö~”'•)¥R²$ßþrIdª*o>ÔK+ý†g…èue—§Þ™^Äà˜¼¦nüV`¯zm)– Û¤°Ý¹0Ü\4*æ6ˆˆ„?`8þðÇH73|‰bd1‚.ŽxFTê}4ne3-œ¹š¥“F£yŒø”ñchj)µ¼M}cèy Á:p'¶©‰¥Yæ ŠŽP+ÝËµÓ Ùbn¦Äkõc¿‘m‚hFfH³¸¹:R¨T²AðÔÓÄQÌ݇_,ý–•Ì”–.ƒ‰‚AgÄ¿ wKQ2K-ùƒýTÒFÆ^Z»x^‚Ä*¹tÁˆA¾T; ŽØ™ ºÞ&árÌZèì}»´‘mì‹ÑŽ2õd7Ád›¹¦“4ß»ðèã¨é}ZÞ4%ŠZïF¥‚¶ÛZ&hhþtk¨‹H¡±Xˆf²óvun«lò#¢ø~…w Xý„Ó÷x¸¨!“I0Àÿã4´+Æá•TPµ"£YGÝ·ÇTª!ibhS¿ TK"ŽePs¿(N9y¸›ê½m–Ÿâ R‘ªMu½t5KÇ`³Ûg*l##w(†aÅ.z˜ >¨íæÑ‘ÄÔ7…ý›>ä—›Gõ="·g›å"žì #ÊÞÌÐ4¡hÛ[ÎhëyÌÿFÙÆ5³D‡B¶_  Ä Ût9öš±E—Ï?fx%¥8œ œ*<­2@ÁiÉUSçÂ2¡1°Ï¿™W² ´øÍwE»rd°»šUÖaÚš?O¶±¶¬P´g§¾±Eô#¶Ô=Ò±6ÄÅrÁQoOÍwEp)…T>Ä!ívSÕI¿ ìjÕ/%¬7Tà´,†ÀN9òiÑœc~òÓY²£y´¼¹dZ¶KBȳÍá¾!¶q:§è²ƒF{tßnmÆŒñZeIž95êÕ4Ò!W?]ÞÃðUe›ŽS¾¾E/6tûµåþ§Ù8¼ÏÒ:Ûˆ³ pœ0‘¥W'v³"Ö‡\²´0æhwûëü‡2CŸtÕÔŠ"]ÂKÞ¼+rŽX?Ûz«Þ)m”%'¢ü£â)^A7®vUeP˜«i• ‹Õ×U÷áР mÕR‹Î\`¼ŽÕO{»áÜ»õ6ð‚§é‰d1)DÙæSeÛ6`“Þæ˜ÞïÐÛ‰OŠ¡þ­ç£=ü  òw=Ë嘅¢˜|ÁT£¨² ¬ù ² /yQä¬þ[õ6°:ωDÉz…Vªút”>7~£Þf5Ê7bPð+ô6ðãó2w±÷ƒÄ“@WKÿ$Fey3s/±E Â6ÊLÈ›l¹«§eÜ‹ÑÄŸÅ6…v sdRî, W3Í”?b>°Ä!²ç3N¶¯©|à2 Ÿ1ÔÕ­š‚ãÙv=DžÂÊß•¾.^‡}«‘´‡}>Ñ,‡ÂðfQ{ç¡•@–Ÿ‘g„kzdo?]›Eæø HÐ[mï\PuT¸Òi,ÄènÆ^vŒ™FîU=GúG+¾ütµÚIV'¾ç½Ed«l$Û#Áf›ô6±N÷¡ò5=<’zU±kz§á4¯¢·i.°d:"NÜ@š—¬·Y ´p®Sp]n€eVeÓ£ãÑE†ÂP%Þ(<ÊœpõÛú¼­–೯YÚ„—ßDèþÈ“L"Óþ˲ßÂ;¹Ï‰î…¸‘ ç ´tà ª”ŸïAAŘ 6« Ö§)öS-1B)™l‡œ§hi…S^u·ˆ#ÓèÏòé/=coðñá×9–üÞœ»¡Î¹§ƒàgIÔ׌{<¯*X cÇŸ~«*ÛÀªûsÃÁ”ðû´ÄÂo·(xýþEx#ž?ìFÞë;‰¬zö¹XEɸ'uk]O%Lö4³I†¯+ 0rC7ßñÓu? é KÂ\BÏCóûG×,År¼›¦Æj—2ÑêǟŘÞæáñAºQÜãpW{3ª)·núÞÉtÍ*“ºí~èùœj0=0áhö͟ò÷ê›CKù<ßÆqÿ3L¼Á€aH²8êYoÐnK3s"© a:~Q×¾pY+t–&íåÄÉw0 ~[¢EsEN5J°0<úF©B‘²Ôˆy¹Ì`µ)O4Ü“U‰*…vx¶•7×O0®ŸP1ØÛÀ6€*é<Ï÷dzœ@l:ÛîfZE”€¿|N@ÙF¾ÉÊLÂd3ŸÔ‹ˆ]áÛD}N–"Œ¨¯a:µil³Ÿ{!&šWVm‚^‚ ´”êJÝwþÓ† ˜ð¿¡ú¶˜ö†0ÞXiÆ¡é² Ê«Gg`O@”m$á$½ÜV4œ´íü.Vì¶áò¾Þ<¨IsjUÄ«L¶4Ê}Ñ£xDzÌL3áýJ8“q¦iZIqi{ršä ­åx†uÓ(&H+1¹i;È6 ö ®%ZØ%®ÂÖÇÒ©z2Õ ‰ðÒhì~³ ØÙ¸´p¿QÂÙ/Hî‰4¶³OP „à`?š–^ùÀŸzG£X­,6|E‹ÊÛ¬ µ1`AŽÎ´ ¥È•î×cG¬GaÀ°½ÞFI ‹ƒÅ9a4¼ÖÓ®%ÛH£(zšÈsÂ/§7³ <®ïð"ÙÇ­ª ó[ÁæW,{êௗܘA†7g5ôª€,!ùÓŠ¢ ³š·&·gØAˆ—f®kwMé¤PšÈ6±õƒÁ5d2¼CsíTSmöŸG‚±H2iñï6·„”oÉ }šVƸF\~³MC­¶YQt žôo/¼Èµ¾Z¼¡Ö©0`ØÒէ׊ÏøئÜi†ï‚lŽ¨»~x³ƒ_‘±öìp¸ºÑÆ•t—Fè:çJ6¨VqÓa-Z,¾Åx£Ã²Å•)zìtdßz¥ñ†¦!&´Ð–àZ>„ $’vÖnâ«åõ6w¢–é/d*[p´-õàJêzÛƒPa #ߊè{S!­Ô×£§å¶µr¾Òíi¬óvxcÄe8·›!®òó “a“{ÒTÓª¥+Ö§0`Ø ¥†V‡óOfíó!há'ÅJ-ñÚØ;<‘Ÿ•ê¸/Í_S?Ö¢J é>K¬9°IΞA(ÂcSÎ C0‡kÌ2qŽ‰ðg‘‰9O‘#Ò :ÛÜ-&Ô‹Ž×+ümi &?ˆT‚ã9ö†d×$h[|ºõZxDDd¨B ‹Ú×+{^àÉÌ ˆHEV¡g}Q,”z0£L ½Ov–m¹tÙŠF¶ôŽ9uòˆ«)Õ!¦}ˆßfÀbk›– "9jM¿5 ^×p Ðm£Ð„…EÕ΃MÛ°i­ShŒ††; VDZ…Ãö+)x‰ò}°¯­­­½³gŽ+_óÍhýé‘Žö¶îQ¹x±¥}fùDw[ß4¸Â÷t´«¢³k@až'èikï†ÃÍ¡r€x¸¯Ìf|nU)ˆWf{:ÛÁÜ¿N#ºVáÒ(’ZG”z[KûŠ¯-€©©æ58©Ê'òÕᮾY4ÌACyvÒó•M5é™Z[—D$k=m­mýÃPŒ<9z¸‚¼»«£ozU™ìXWëÀ,ä÷;?ؽ!ÿ¶öYHa$.÷3lž–"[ñÉl­ü&1¦#Æ€á.Är›ÿEƒ^lª°ÕhíEší>¬ñ1`øŸ$­ý«ÂVË×OŒ”Î4š2õ?Ïþì´J 0`øc¼£º.Å€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€†ÿQøÿ§Þçƒ endstream endobj 648 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 348 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 33552 /Filter /FlateDecode >> stream xÚì@×ÖÇ}yyù’—¼ÄŽDé½ H/ ¢ˆ¢XP{AÅŽ¢(öŽ" "ØÅŠR,€J¤é½÷º”í»÷›Ù]–ÝŒ1&A<¿œŒ³³3Ãîνçνwî &ó[üÓ_ã‚Ÿ ÈÐé¸AÑ@)¾Á+‚mË p>|@ ´4D ô]t¡ ŸMM zû½~Þ¼áXd$Ç¢¢8ƒÞ½ãXl,Çââ8öþ=ÇâãQBÇ{,)IÐ’“-%/á–žŽþŒ |ɵìlŽåäp,7 ü||‰Ya!¾,*B%%¸•–¢²2ŽUV¢ª*Ža_¼º_Ö×£†Üšš8ÖÒ‚×µ¶6>ëè@]]ëìä…"hT*§nbÆ`p wDúø1úñG4dZ·=|ˆ{ƒæfH¬€/í[hüx4l>·#ШQâØرhÜ8Ü°='Là˜°0Ç&MâØäÉHD„c¢¢ë±)Sú5qq$!!hRRHF7YÙSR☲2ÇTTÐôéHC7MMŽÍ˜ôô8f`€›¾>21A3grÌÜ™™¡Ù³‘¥%š7·ùóÑ‚¸-Z„–.åØ’%œ•+½=Ç8†UI¶mØ€6nÄmÓ&´u+ǶmCNN¸í܉víâØž=Û¿_Ð@‡!W×Ï1ìÀÇ‘›nGŽpìøqtêÇÎœÁíôitñ"Ç.]B—/#|yõ*òõÅÍÏùûãË›7ÑÝ»Âd¶¢  ÜBBÐó總x9lã†7ÑÑxp‚-¼qKj*_°Á6vPÁkX\Ålc‡Ø B`NE`†½ä ØF"õ\ãÆ ¼|Y^¾Ä½&RlÃÜVΞÅ#LH¬€? 浸E ì[°ý«Ç¾û·ÿýßÿq짟8öË/è·ß8†Å0lã†.cÆôÄ-XpÂ6Þ‹1¦NEÓ¦õ˜´tO¤!'Ç1ÞHƒmjjxÈÁ 60Ã^êèô„\32£^35Åc,ðø]³°èÃæÌáØܹÃ,t±²Â [aÛÂ…ÂÜ/î‰jlm9†E5vvãF5«W£µkq[¿gضe Ç°xfÇ´};¾äF5{÷rlß>Ž±ã¶ñ*X”"`Üp¥Oc‡4¼†mÇôô)Ÿ={†nÜè±ë×ñåµkx“ »mBc+XtÍ Ô±x†Ý>‰üܶMl3GG<ƒ`3Ü„K4°Ü‹d°%»¹[b9‘–À`–Fa†åSÜ@E\œ`^ŽÄañÈÃ|#ÛµbîšíÏ1?ò7` Ó;Ü«ÀêH…Ô>æTyC8 ±°HÀ°xF †ÁÂv(ÂkX,!0¾[Á"ÞÁK˜½}‹GìÀ'OУGøà„€€ž( !|}ñ%æö¹Ä¹s¸9ƒ7‰°ÛFر¶ûË/x 9–)geÁ9ð 5S`_çY *íÆR¼ß~ÃåiØ0¼ÁvÍ<ûëêâÛj€é“_ž4ë“ ïIàú0`Õ*4ïg\¶ ¿¥Eà]ð]óºaÿ+CïxD$"bá>罉¥ÄÏ T P(4--ø¤Þî |×@I›øV8/ÛRœ–hºú†£Îd-5Õ tÌ­Øû3Yÿ žŽÉd”gEyz=$vŸ¤ €›L< èëÃPü!}·ƒñQÿ0lµ«³“FÇ÷è%4}+¦Pز ÒSWo}wÃ\q¶B6 `‰Â– !Ëgë)k¸‡¸"uã-"e˜ê‡f¶³µ«£®èئE* Êöü¸n1Zjrlm?Œ.:¿u¢œê>ÿ7Ønùž›Æ‹ŠŽ=q¾ÓÑü.ø¡€ÏÓ)|ñáñII1qÛuNönVÿ«õ‘0DÏ݃‹T$êz/*"؆íÖ\š¶\GBÝb…««Ë,… #Ôì*‰Ì–Ê Ué Š³–¯ÚîrÄeÄÿüßÚÀJRaü§¥RÒFOÒ Úið+ðÍ¥ýõs0™}4.õÛÞÄdòîßס¨Ï³ ªT·µÈ~¶æ÷çl1©KõV–7+"—¹¬âˆ”˜È$\¤hÏX¨-ÜÅBAL–/´/ ¹£>K^Bx÷¹öfÏ­j-Ÿ`+)¡g¦k9tö÷³ zb UG[ciqaaAAIyU‘ÎÎ (ÄöêòRlcQIySÞÞĤ›šÚÚZ«ËŠÊë»h„šâ²ZÞ^…7ZµÕWW6´ÑéØjSmUQA~AQquC+ŽŸ­³¹¢¢…ÒÞXUZVÑElþ¶!ï¥ñtÓG±9LÖ0VYQIkÍÜëÀ'RÔÎGM)US«Ãnn..ŽŸ9jç•Ý: R€B±]^ä‰Õ“•¬‹)øzvЛÅv%%?òÔ1šœË5Ý‘á /©¹é1"g¸,ѱy™VÂJ:K]ìƒ{æöô@ÕG±¹ˆT1süеW"Xçføl›#g¾³”€BOèŒ'zàf™1¸ü-ë{Jãæhi¸‡¤±·QšÒׯ´Oª)>°šO¤˜Ä–SVÊ6ÎW»¦\8¸/"³¶­:©¦^"ujº–C‚æ>¾]•J¿uPYAaÕÞsQiÅ4:ÐIBLâÍS›”ô­\Ïzœ;{æœûå-ÖÚÅu*ºr·-P?t3Žëžï´’Ó[éÛ+_W“ Ù5”ú„[B#Go;ç{áìé —.ï\i=zŒdByKÈ1µ‘Jºd ÞôÕÓun­…¤Úœ{¯S Óßl˜;}’Á¥h¾›ÿÔ7iâø» mÑ>¼¸  <þ w`AQ®ßÁEÿ2%ª¢£µ2MEQöB0G¤¼vh [bÿþñaù¹Yö¥‘à›“)|Il||ÝiÝJ 95ƒ½G½»ÙsßrÓë®Ý ¸u“Í­‡OƒZ›“7Ùš{ÜOã*MU¼¿ÈTµø²¦3[—o<÷  ¡œW'…†+\~xëæ ü°7ün4QPÈ¥áfï^ƒ&‘b}©ìø¶%êJrò JÆsl3èˆTàîºÎ78 ‘2,Ìg½Ê‡ 3(„ ¿cønòr²êf÷’KèˆÙV›·|©Í½è6ö9]°Ÿ½3[)M QoéèVH\é'À'¹W ZS}McK[¡µº²<åéYq1é;‘9w¯³ÜîQNF4*…B¥7Te'$æ1[â7Úš_ Hãh ›+ÖªNs:rÜÉÎúî»l{UìµqÃÅâHQÉX^ÖT[ž˜Ž¥Z¡Ý"5(FöøFÒNhmm%¨4)¾Q"¤Ζ+®f´Üv‰ìd!£{ñY»*Ý·Î'&³pÙRµ ?I™íÀǘÕÇn]fîÝ-Rìs”澕öãÎ3·¨ø+|TDU›ØèaŠÆVsôE$ôžg”aCÝi&ü Å ÏÙƒíQÁW®^O,jâ ökrãý¯^ K«amcÄùLþ¬€ p~ZKÈÝkwƒ¢Ziü¹¤À§åQ} KizyîõŠ­sÌÞ'ìu “sF©¯¹œÀÌÆü“J…zÏáݳÒÓÁò©)ÿàÙKá€ë a¤ÄDøy€X¡xå‰HDïÞ!$$„V¯†d ™Tv626Fÿý/ú׿Ð!è»ï½=ü<ü71-ðE *µ¶¢˜´gÆ…‰×0‘Z¹ß­½ ìcÖÑ | \˜JJPV:yýü³ 6ñšÒÓCšš````3ÁQÁðyi–=ED “iصÖVð²À—Ñ)=z„öïGË–¡É“?VêÆC3g"}}000°æ(ÈdȤ€/ R¼E¨­ %$ ;wÐìÙèûïû蓲±A--¨´ ìcVVÖÇ=,ðÙÃoÊRCJOGOž E‹øDjÕ*øÙøœ¾”`q¡Óñ›¤š›‘»;RQÁs+,“ø ßi’…-ÛÛQn.ü6ÀÀM¯ .¾Í€o&“É]aòoáÙ‰gùy'å;-ßÖ¿þöúì5ÞÉ÷iø>h¿ß«×Wîçüž—è³Z}¤ºýî9¹N†³ì¯Jÿ=¾‡÷Oó|+^—!èÇôëA™ƒ¶°ðh ó£Wÿ3J ÏiùÎÿ‘?ö¥ËI”Ù—Ø0Ê@¯RÀì[ËþVå€Á¤SñŸáyú¨‰½*þ_ïR™qµzÕç—ýȇì~Ÿù¯;ÈJ öYÆ»ð„J:ƒÁ ÑJ’£Cž¿ NÊ&÷ó›|¹=35¥°¬‘/.`Òê*s“Óò(¹êóF.̦ڲÔÌœ.FO^Øý} eÙ/CCž‡çUz¾'«”±W)Íå‘aÏCž¿JÉ-§õR.ÞUœô.»´Ž *Ÿ©4õyD<•Éª‰ÕůŸ‡² ‹|_ÛÁè‰?µÚãU6+9>¯¬ŽÎà;¨©º8&6£½“òw8U&­¥:/8$ô9ûë= Ïi”Mü_z~Ê»à˜äA7ËdÖgq~Œ/_¾xG¡÷¤^ÔΦ¤˜×AA¡I¹•ô‡úêbw‰4¼)TH8j(òï‘LL t§‹‹IíGgÍšibh 3Cûø­7$þï{û˜’Šª ]}}éqC‡ŒÕj¡pþ©¡ìÒžµFúF††Ú³<ï¿ÔÉòY£9~Öu A#µŸ¯nh·£¾­³±¡¡±¾:úî¡ÿŽp‹&v»wæGUÌï÷dR-y—,<îÉu©Ïoîµ^¾¯Yàp£WP¹<óc™ >1C(?ÜoϦJS„ælu­`ðØY_°ÕRÅÒáDauSSMÑå5Šc•7´ñ=¯Mºãu¶g–Ö4Õ—_w[§¤¿4ºšÁ“Aq?)éºëJ¡ß~vôxŸH×’&™´²rŠ¾û”ÍÖ†ç577Ô744¤E>R=bÙÑ\ÏÃì3Dîc;aëSï`L¤x7Ç>8¯¦½úCISoßÃÿº7Ãu}iÖã=†Nl¿³o¹éÒ-ùõÍ•åeU­D®®±÷Ë}|zš¸ÌÝÈô榆×wÏJLSò‹#ðê‘Ð\^^^SÕÚo£)·ÆãóGˆ¯®íWÓ± |ŸÛJhuß4ZX)ªn0L¤ÆñˆÔ¬õy3òy²¿èlŒè X,/]“|æànÇ-Ng|ÔQÏöŠwn{¶ï>x:&#Ïeý²cWÞ²!ÀãÈG§[Áo⃎[ÛºáÂ)×”ú‡Gç¶}ÎÚ‡‘þæþŽÍ÷¸ÚÌMWèÔȇžÛ6­Ûwúz;^–8ŠðØëèÆ›Où…¶“8׬(ìèö½çªoj…ÿ“ñø¬ó®³´æ:à)ü½òä05‘)g£[8ÛC…ÿ3ì^¯F¶2ï1§TW§‡j\ oè-¦ A‹­gËŒ›¸Å#D þˆH³EêùUg•yÛ’{4„qß^FzÎ^:O®Äò1¤»oÞ¸Ñå¤OYSgOˆËl¿vÒyÓ6—Äì„]‹çºx±2)”ûêÚ–M[.Þ v状ޚœÊ®ü°ãŸ”Óë’8‘S‹Ÿ¾<å•ë'§]‡£K¨øfÕàœ÷AÎÛ·ì>_Fêþä¸ÿíŽëw¹]nb°ôŒA+ÿð|ÛÁÓiåM¼¾…ÜÑz|Õü[½Pß©þjßRíU~oE%E=IÎmîiAâw#i¾.fk–èC¬¹´ÝÒÊñL•Ý”™$:~Ø©f4xûÄDjæº=mÁ¨kö”ÿ›±1Š÷4%Þ‘Ÿ4ÝÀláK5yɹë5°üu´¸ðXu½™sf)HN+oqîz,Bm›-'ÉjZΛ£§£*®®í°õ$UÌ6ÑtXb5QRIÏþ:Vðžœp›6{Þ|ãéRB²s2‰X‰h8b3ILÞrþ|m1á[ªI:©e‹‰œˆ¬æüùså¦[:y4uàÌñ†âòsóz5÷ÑÈÄ®¶߃öæëöôˆkrg[^N^ÞŒ¿lÞ÷ówÓÞóɽ¾ª²…Ì9,?Ì[]Óìi>E ÔuÕd¯™g~ùÁƒ…ºêŽC@¤à3EÊrkb'›Áþ¹j!*gu€? lÛ¨#,ª¬o½`¾Ž²Ôm‡DNó]åŠéã'Ëi[Ι¥m¬=yìDW¿˜üé [ÈÿC«øDª'©ç\óæ„ë’“FëïÌ­ ¼)Žß~%e YÕ7#$mÁ—×[®>JEmKf(HÀgŠ”Ï^5ëÝ©mœ·büv7qóÙ@nÄÿ^7ä2VœHH›£¥xãu2¶þØ^k¤º5«e¿¸­*2~ß·maSÇüâX…Hª:¶Ñt¬¸MA-ÊÝpÔ¨W’ð,ŒVüÜz–ÑÕWè¬?ë·HHrAISõ6 í=¬&"´_c„ÉåÒ-Ö‹G—vΰ;^ØHãæ ˜1Å®,¦IÊjª ›| ( tã^‘º`¥ô¯Ÿ~ùÏ÷ßÿç?ÿù÷¿¿'¡qôq+îNOØÉ0ÔÚÚZVùÈËEMöýrìÂÝ­ÝAB¬=Iv35}„¬´Ô_é@c Ô¦ “ f:ÃDÊTGn÷•(<ƒ§S^ß:¬ fäöîyHð‹°ðS«çM˜QM"¬Ve¼þd|fack'çêW'ÈN±ìà¥mD*Wpøu‰_«z‹O Bl,òu]>â·Qs׺u2¹_ïL%ÁW¶ïÚ¾ÀDsîšcù-Œž”œÁ(I 1PÔx˜XPËbm%ÇK¡ý~ú)Zø½Ó“ÿoÈ?ü‡Å÷¿Žµßu®™Çëv÷1 -ÍuU%a7Ï©ÉŠß|›Š9#Yáåƒ8»ÒrW˜Oßw+1å®í¯clºXGb‹Ðënòê¶ùµ´¨óZ¿ÉbŸ3þæy-}ÏÛ_°3‡†ø(Œr5³î´ƒátKûÀ·ÉÍ즓öÊü-3&;ìNÍkh&pZ$Œ>[ó:Û:Ì¿x?–õªnÿ|éÿ“ßAæ‰mQG¦‘¼¨qt1®tÁçÅE%>ÈG¼ß—ým[Ò7.²tË À–\8ßXÏÚ~£«ë¾9:JsÖ­ùëÇL LjËQA?Ïঞøÿ„’ص–ºS§L“SPT–‘‘Ÿ¹ø–ìæ-n^ÙIb bcΦe6Þþ÷¬æLß~9’ÆÚùüæž+\1‘2™!{èv:žŒÑH!WG˜ ¦©¡®¦®¦¦¦¥£g6q=U~ˆ0S‘—˜&&DŠwij)7ÌÎDv¤é÷ß—Ž­Ð:ëjiÝå°«&}¾ªä!ï—Ü]è”NßÝZʇrŠós³±*³lÏÅäÔ DÀlîÃ3©<ª`õe2»Û6° ·µúêA۩¢Rr  r&߉JGÌzU©Ñ›½òº«w£ã|“Ãw’£ÎÏøYí<êÐp^U{U.R¿°kp¨ßIñácTÕÔq°¥ÖL«E·j­2içb#YÉiÇL˜i ·—’ªÜØ%ªÓ¦L/¶êØ­ªfêkàDï{²Ú MúyèCÞábäkõI+o²_Ûšv/еÛsš(˜E¡äæf ã*Úy”®š‚-æ*«]íÖÈjUáá«N†¢Á;ÀO°Ojý¾oEãün”µšbzÛ¯ä–×a?½"Ý~¶Þ2LºKŒ•~RÁù™Û«’ëiø¼Úh©7ïõn·Þz×ÕÒlÕqŽHÝÂEŠI§„ß8¨c¾†{šËÒcâ˘äê¸÷x×ZSúþÅ•)Ãþw ™Ü”“P€m¬-Ëå¿{‚Th^åGoÐ)îûĦò½¶ú¶‡úxŠºb—Ì´y×Ö=æ³¥xÃÝÝp;¥˜4R„ïjss3}]=Cc)“„%T Ì•wû€?*RÜ>)Á/î©àm¿I˜¾Ï«ÄLÕfØš¨ù¿NÁBß¹rì}Ðíÿs—™ªï¿Ÿ~ÍÐqs¸CÞBüʨ,Ëg‹”Ñ]öƸ›§M-V÷TØú¨·)䎴ä´"•L¨ûãh&2NÛ•Š:Ò±ºß^_‘õXiìçïœ]-ùOŸ†sÇRtä=œðó¸Pïî«ŒeVÞHg¿ ´7î^0ÃnÏy²ÀÔÕxeÏB« n-T¾,©®8ËZ[õÈÕgÜ-»•Dtw\Bƒ·¹ïÊ*1¦þø}R¤ö3óTM×îÿèíßÍó¦ ¯½‡­“šK/îY.ªh‡ýºôÆ’²ËO$d—6Ô–øº­ñý¤ËÒSýw KëÞ~W×Ü”z}ÆøQóÎ"Tn¤%íz3 OјŒâ„ mé)»¼"Û™‘¢CMvë£4ÆyšH RZ«ã´'Ø{'­1ùò¨2R‹‰$ruÚmQ…§ÙåØ'©NºíyõaSŸŸšLðsµŸµfw9;ì Ôø_:ÿ2‹Xõ!De‚°ã©€°çÁOž>yô0¸–˜”Î÷á¾Ld¢ÖE²ŒöøeãCЫž]9¤¥ixómvŽŠä7Wüê:y'Ú²J;¯Å@s|ªHyÚü{¢a [¤|ö(ÍqLhè{Ovuº8KR|Ö\R¨­O/9Oç÷I½>¶t¤ˆF𻬦æúPOW ¡QÎ×ßtTÅÉüïû ¡u%oVÍVbõIѣΪýbp‡yEÙ˜horõ.©mn(Ϲâ¤9V`™¾²‹wM[WWKµÇV½ÑÊ»êkRMDÇï¿öªµ‹Ü^Ÿ3GfÔìpU+Nðô(¬#ðºÉ†’pé‘#ý#k›« ?µŸ.?÷H'¦LÍùW=ýJð87ä¬ýdÕ%!qÙ͵ÏoœUWP÷z…ßm·¼ƒâkÙ¤µºÐÞDmç™ûì¯O¨Î¼rùRZƒÙ^sÌÁLÇÜ.:«¢¥©>þ…·ØOÃÜžf¡Á{3¯Ÿ£áT«;¬LªãâRýy[0ú“dÖ¦×^NR Zó¬-\h³ÖÉy¾‰”ÅúÓ•Í̦ˆ¹ŠST´ LML̘Y;^¼‡ýÒ­$äÕLg™Í47_¶ÞÉy÷Iªškª~üÞ–H1iäö@—*òFfæºjÒ³V)%!©íÚþ%âRŠ3Í-ôÔt–ìέ%R;jv[©ŠÊiζ0×—_²ëRc;>@4þ’ž˜¬En_M~LJû­ãço9PÉþVIêG¬½Y[šì.üÛyUUeJ²R:ïèXÜSwj«Õœõ'«ˆ¨<áž®´¤¶¡é,S£éšû*"âmæ¿*+[Ú鬾ñÂÉo"0_ñ¡¦¦¶¬¼ŽLet6甶ö´wЈ™Qo"ÞDÅæ–Ö³ÿµ‹Ÿ‘ˆø&26§¨ŠÓ$Clý€û±ð¨wñE5íì·ºÚr JDJ?eOGí,ÈHzû:"2æ}aU Û¡QÈmù9 í채ˆÒZ“ú>&"âurf!u« “N*+Ê+o ²¾,“Bê,.,jêà ¤v¶äåä4u2ØãûÚÊÞEbŸ1!=·•ŠíÄHýL0Ûçܨ¿ùûÏÒçLêýìßSPyÿÿ‡éc¢ò¾æFb~d¦J¾[Å™Ÿ2eQ_³ÿ_†gò\Á¯À'Õ´^sO÷ëª>>5+íëgu&¿ËböéP>²±?oÃ?×M³Ü"Ái·ûrz¨_?Óç¬Ý½¿&¸È·ûhGëwóøSý%àLÁëÄ{†/ÿáø»}O?Û¿èáýS̾üÉG  êûâ0™ýL;üÙ¥E°í´Wç³öh&“_¡8› PðÕ»ž´_(.îߟôÞ We@–ÜãgÄ„?ypÿÎýûFÄg“x/ݧ¤býf6<= z}UrbeGϾÔÆ°gî?)j ±”‡=¹-=æU@@@pxx†‹xa4?y;¨çÿ€o…ª¤7÷>z€;Ÿû÷Ÿ…ÅvPŸÖJò;¾§{„~¶ÂĈ»wîE¥1xÂofWMðƒ»O^Ä4wÑÜÙ8c–(³3—••SÇg$RSUQ–“SXïvµªƒ›}ü bgg‘Ìüý€‰qiƒÎî7uœSÒ‹œ«àSÍÐÂ.²”=µUÓÙm+T•”4gè`KëGª»Kû4Oö˜J)­ê@šûàkö=ø2l×ÂIÓ¤9s©ªÈHJ™®:V×þ‰3¶0I˜çùÈh@„^xlUSPÓЗWÝvùe™å|Ú“—ë))ª¨***.Üzºª™25°¡ï%­¶çIAQ FYIácO71Q¥{¯Óú΋o•m¾´ßéˆW ¾Ì¿WWí³;WVÙ˜‰O•ÚÉ™§Ä{ã|³µÙ…ÅEùY§6›³ž„˜xdÊxõ€¨´Ò²²ì”Hۢ뎰æaGDOÏŒýå'™åípÑàë'tÃÌQªæÅU5¥˜ç)¯øy]WJØþJ ™†˜}iŽÀÆë{69_z@bô™b±ý{kªÐ” osêëª_^qSPœþ2­ ËÏ›®j±¾´¶¡(-t±¡ÚÎ;10|{€‹ÔL ­ã±´îkM-ŠY¥-µß7”} YW}qltdtlR]+'©ÌOH,í¤·UÄD¾Ë‰ ^>wæ»}iõmXÒC®K‹ˆx×ÄÿxAföSÓY³fJHHïe‹Tkº¡ºÄ›Ix“‘yWNÅ ¼€á»Ú`šÃÍ&"žŽ3hÄÇgX®)圪L_jÚò}«¦LY"ƒA¤6ÎÒ\À3§,ÃÕN_~®{;‘õX zkj\ô›¨w%uíý ä½~ÿïHLJÏÎÜ3OŽýö—‘ÉT“ÖÕSZÛÚãwªöû_™åœsWGšj*\NC “F~Ì~þò;ºJÁ­¼ —cà‹µû1ʤ¼h;u L¤°× /' 9bÔˆ“Ô-o¿ÇïÈövÒÖ>8WAh¢˜¢ç¾ÍÒâÓ¤§_ O'!T÷Èüßÿ £õÙÐH +¥F;½ÁÏ@Èx©.9ùvj +Cb”eGéȪ^N®/Îάj¡±†PÐÉm7\ç,ØΞÍ묹Òlק5o·›h "ƒQ¤èVèÊ[\h'1(5IŠãÇŒ%4nìБ¼ŸÅ໥lý¯Œ¹ÇR©ïǨ[®:m©..¡¤²rÛ¹N:³­ hظIÇÞñžŸ¹é'!öli­ñt¥ïÄ5e<4bè㎔½º~\AÎ"«¼ò¨,Rγ¤4¾,.-Ç)É¿~|ÛDÕGÑ9¨õ½ÄðÑ«.¼bÅ8gÖkÎs,§ n Æ~äak{Û™­«Op²°Ö²´ôœŽ¾ú4É="Uñþ‘¢¸tHaûÍêüäYrJî÷{)HnoŒ¼sDrâ”OðÙì³QµÊmGE/·Œæ)hG€¯Y¤FkXÖ6ÔaŽ§ªº2úÑiÅñ£6ÜÂAxiéTñY»ØSFŸ²› i—ß@Ei;þõã0#§kì)4=×Ø:ž `i“N"dgfq[{¸¾áôR• ê6çΟš­¯5Óîhm'³"ÎgÜP±Øî@:‚¬~Rq x’ íà"½I'M›6•Å49Õ]çî¶!”qÿ¸ð$•B*§}7%쎶Šqlnóæª9ªÔQshíÖc7ØsG}Dt̶ߟ*)%;o·O> h¡Ú?Ÿ.îÞøÞhšÂõì:”¶ý»ašUœ­Œ «®9|•@æ{*n÷˜d|IªÉ9±eÁt=c ‹Ù:Ó5ï¼PÜL+{w©÷ݽÀDJ7±Dj`gR沪[o¦øÁ¢°¼žÝ§~uÛ¤I [§‡©øm ùôa™Õ7èOZð”£pµ˜Hm;zƒÚSHú*^‘jI U“»—QËjbd–çÆê˪ø¿ØD}× jmÂä±CÝßp: Îm’›µ·¤ž—c@gR3%´ÇRé½æ ®y;mÌpGo¼«ˆIl:»užºå–r2º±_oò|ŽHáÍ}k—l?}Ÿó°¦‚ggÏ^+gô‘å`"e'-´ým=§€ÙhÉÌßÇ*Ôëû­UͶ´!tÎÁDkýùÜ’²â"œÂ¢ªÚF•ÚÉ‚H¢em/¼ ûÐ4\9øºEj“Ù­þð˜-(g‰ˆíe š¢·V[‘Ý@Á›û&Íé)Æ9{k‡Ãþt–³!·{y^‰Ï«áñ_èåVíß$fç±ä¨£ ÜPZt·¶¯³Î$Û㬭ùö&›®<ïw20é¾™wƒâ¸){Þb"Å7<ë:Fy‹Œ.«¬® =UN{ö‹,\b.n”ø^ç6g7Ró…=¶?þ0ÒùQL'&kwu‡ JåiXkäŽÚ9Ãþe÷‚SŠ¡h‰¦ä4E M5yY%¨RL¯r—LòÝÆ Êâ¿?ýj²|g=ÏGζ|ÈúY|Õ¾_>Z¬4DLÂ#+ÜŠM¨Œ·–þm¤˜¼š¼øpae Ü©ÄÛùNÔ½cÈþ%âFÌÛÞNe¶æ=ú×OCÞˆì>ë)u„Š#v:? ‰ª««Ž9Ætý©Rü¾]D¨H²”šª¨!+6aÖ²mùÄžÏ @b2©d2™Š?óP ‘b½É wÕ¿ }ö22¾‰Ì™ùF%“(tºšªÞ<N/«£ãO $‰$:³Iø &…„Çè>I§“S"Ÿ¿Ši¦±ŸÐK§P°Ãù S(Œžy™ :•D"3aÌ|ý:EÇê;™Â÷˜Ãî›j™ &¹“öìeTy};Çõ0¨D™Ùsg/1!òexl&ŸRN$‘¨4ºÀC™èb}AÒÓÀ ô‚RÌ•°œ ¾ v´Å†¿Iø@ ²º¸p&…úœw±×¬ã}?ù«÷£û8ÑûÑ€¬"Êèýø°>&˜íïó€NÀ×Iñ&P½ž‹À¯6ݽÜLž·™|8чGás`|a~Ù¯¾ ñ—*fŸÛþfð?¯’ ªhÊAý==WPz©\‘n¯cùÎ ÎþA˜L¦À |T`@9ÿ¯ÈíƒBƒ5V„jý6p÷Î'Ož>sv`Ú©S§}}¯ÕÕÕAkM¤Ñh *uà…B§Ó¡?9yùö»7yF:zE9zE@ÛèñzÑ–ãÞ‡‹ ÖXÑÅõðÊ»VmÝ·j«ó´Õ[÷-]íèåå"ð÷“_X´ÞÍ÷j:ò¨v%9{=zú.0X±]·Ã+]ËB¾™Ñ®e£S¯ê·ow‚+ü"UP¸öЯ$t%y€šg)èXpéæÍ›)rmmm l¥«« ®"…‰ÔÚ£·-\àææv WWW¶HˆÔß RGƒŠ555;æâ⮃ÎÎÎ×®]ƒk€Há"uì–ÍBë#GŽ[¡@¤€(R¬<³vî#WJ¤î9yNRÛÊ%]Máîz™W"ãRTÓÅX"¯lHß®H±ë Mä­=ëÝûxsj"ÏK¬Þ…§‹ŒúÑîºÆiÓlÖà­ìžïÉqï^oHP¤¸u˜]Mà [á”ðÎÜR¹I^#|ÒzvÆDjïiw=¶Há§JáÔ,ÁÑWCZUGÙxÅ:ŸL¿btäÔ e驧(éY8ó“pHW¤âZ–¯^),c¹óaË|äY £ ª´Øûr\ͪ}çv>¬¿U‚ž4£e ¿Èí‰ ÈG®ÞþŠÓÍ4]ÏG¾±yúŠÒÖž…‡Ý= ¬òWšaáàž‚lX%R¶½×þ¸Ö {7Ls8KõI¥ZLW5Ýüäf`SˆðfR)è¤ß¡c§/Øáäûn÷åûr 2Úvw<ÓÑZ;ÅŸ&.Þq+nÿíh+“éJ+Ü=°Ã3К†T7ï¸ëì}]NDÔdo¨WXºØ˜ŸW¿@Î.N2ZóÖúçû~@ë¶,QXáèýf¯ÿ[ÇÒVÛ6_MhZhf(®±Æ-¨âr dRÀW RKW,ÖXqötÞß꓆œ7-˜¤¾èRòzO<”»ÝýÁâ5ÂB#•œ£îç7ïÙ¨±àðùäÃj‹p(=Ó¹ßÝgܘ‘"âFˆkÆŠú™GwÇ ª8k…ŽùB‹¥jªJ¿üðË®0’÷ûV3uãõײ;mA¤€oW¤üïN±¿FðÏB~Ùh×®­$õNDÓÏ>Ï>I½]„° ÎiÍÂiÖG.½§ù¥|>Æ.r#ßÙå´·íùx\¤ÆþjìtAXDrѱ(¿Lt-©VeªðÜËÅ—b:.½ë<ñàýŒé3¬\ž]+B -$t}>@ŸðuˆÔ’勵ֺŸNäÔ—£.v”žŠ¨o¥9^LÙh¹ë–[YKÕ‡Ë펾ŸÕ¶~ëRÍ%g0 óIfz%2°rî—Fß{îòÄ)jë}Þ[š©ŠÍôöLC'ï\?rúŽ—MGç¸=Îu{’$0ÿb<ë[¤ü²à>)DŠ›IÝ$:mw,òÅ¿ äuíâxQ…ƒ/»®&–Ø.š:Mz’Èä±C™¸à¬G<ójÈ%¡QÇ’‘/ëÎD¯V¯½ÃÓ§?Um¶•†ì׳Yèjä;™iB£G …-GþË÷Cfm÷½’ì­gKèìñNƒÑ}À×!RËì—ÉÏÞì5ϤRÑ*kC #ûýWoI)Ìs~M½™ƒ®—¢µZCe1‘Ê£mwÝ£h¶ýx<ޔ훃œ6ØÏ;ÿáÐEOYƒE‡Ñÿë"F­ô­¾ôRtœè¦p|@,–|ãpøÅ¥D:¿HAs"Åɤ&‹LuŠ@¾©¸H]¼|z¼˜‚[ÕÚ`âÕå«Ý#Ï$0Ýv¯]|äb<Ó÷Å¡aJXu»ÆºÑÃ3ªþdD»wxÆ”ñ¿Y{µº‡ÆˈM™$îÊûä©£¥œâ‰· Ñ­Ü°ŒÌïòÏÁDÊ¢[¤øFªƒHS¤V¬]3|¼ìšË1çÞ6Ÿ|ø|Ê„‘¦»Žú]“Ó´q l¼ÕvþþC¡‘r[‚®g S_)KÉ.8üòLt»{€ÿèaÂv×Ëž¿$5ÃÚ%Ý)F+fë —_}>ºQS]JcîÁsÑÑ%³t%§.~ê•ŒeRmæêŠ:+}<“^Ð'€H±Dê”ÿÝ ã…IfÝÁA_±bÙdä\‰Ÿ†Ù‡ ÛYÈ7m±Ÿ?ÍÊíRíZz•êøa3=jüR™¾ÙhõÉÅ=_¥‰ùÅ!ù'´¬Þ¸RBí±W5z*Ô·&xÄS½èGo‡)*jÛžJ¾^Œì`™Ô.n&" p‘²uX%;ÃPVožŠ®éT11½Õ×<òÐå×EÖ -e5-ô,mÕçî²w\÷x¶o&iÎtQI‹ƒ[/?·ßyXMUZHÙÚÑ7×;írÙ(J¸‘‡®$2®¤"ßêÑ{q{î^ÍÂ[ \oD 'bêZòŠ®u¾u$œt3W™«èf>kJ–D†w2ºU„ndâwd\K¥¹ÞŠvy\u5¿Ï—=·˜OÕõFŒ[Hw A@¤ØÍ}w&M³½b0{¡¶ùr›1WSñ†¸óAQ3­–M7žoºÞçȽ—‹ì–¯ ôLbú$“7íÚ¡m¶HËl©Í±¨K‰èJLõ¢uÛ_ãžÐŸ»soz¤#ç“g -—j™-6ßtÁ-‚|- ¯˜n=0±¶Ó6Ûy&o·‘´HÅ6/\d©aúl2ºöù¦÷Lº‚Éoº–Á™ã+ùWS»'HeíœÆÙM`Î>Éø Ø°sr»Ÿ8§ý€OCá Í}ˆT·H‰L‘vIAþ© ÏD¼r±«Œé¥!Ïx:^> 﫺!öL}Wi^Ø .4L,仑– vµòÍD7rñ“_ËBW“éØ®r+,vÚÈ'‘ê™(8ш0E*´ÿJÈ¿”KI}N Ö#@¼JÄ^÷îžvÌû#ó^&uO¾”̳?ÿ©´H1™{ R¤X7óžðöùí—ÿí|Ïžy¯¿Iü˜¼GñÎ釯óÌ‚Î[[yŽê™Ø¹g#åýS"Å­ì¨)À)¬¸âCXéÞIð<©~`0W _0“Âêà{¹ˆâˉèÏÌaþ=OJ@ž ‚_N¤økóŸÕ©ÝÜ÷ð!*/‡” ø+DŠ/¯ùŠDŠ›1ñÖ,»yÑhp­/ÖÜOæý$ç² ‚$%ÑéÓ(;‘Éxeä!†>;“úºžÌ+PÚ1£RQCºÍ‹W“áÉ4 /4H‚Hý"%°ýͬ]‹×>®‰Š¢Û·Qq1jlÄ Ò+à[)Þ:ˆimm¨²%'s´‰k'â²5Àª "õeREE(-íï¶Ü\dmÍW ÙöÃÈÀ?ŽÞ¾Å#É>CMd™…‚RS¶eÙ24~|õbìX”ðÔÓO4LU17B§Ci‘úKDjÞ<$,üwÛäÉèçŸû¨Œ¼fe….\@wï¢ÌL¼AD L"uý:jjBÏž!oo´e .C© ß}÷TÒO´I“²´D]]PIA¤þ‘ù±øg K¬¢£A¤€Á&Rþþ¨¥—§ßÖ¾ ÃtŠ@€Ò"õ—ˆÔÅ‹hÇ´sçßj{÷"yù•yMMäå…^¿Æ›(hîgs_m-zÿ ‡U‡ÿýmÛöwWÒO·­[ñF2*)ˆÔ_"RXÑ"ÿnÃXµªÊ8i®˜˜0aA&Œ¹¾‘>)utàC†°êêxϬ@½˜0µ¶þõô­«‹3:‘L£û֬驃¿ü‚\\ðqMÜè0¢øFDŠ÷Þ(¬ðc±¦GÏŸ#ii>‘àCС¶\‘òñJ¸"å•@_7`§EZ½ƒ·r„…A™þ¼Hy' DûÔû¤‹ ¶¹º"¼ãxà‹0ðÈ+(´ßwé|t—{L§{4Ç.¾ëºôŽxñsíÏÛûT¢;\¯-Z¸` ÞÌÛØÈWIáÖ]àsEÊ3‘y5Ÿ`yšo::Z®¥ùÉÓ"õ9éDG4¦0ÀËOiYùší®ëÜ|7õë6»}Kwž_¶ëÂgÙyÛÝ?÷Ø>lÉŽsf6ëìV®8âæ6°DŠ7byþKVmv¾ûáà£Ì?°ÍõqÖá'Ù‡s>Ǹ~öøÍíiî6ï7šÓ§ÿ¹ûúK¬ ‚ …’ù!#üÕó×á/¹v`ÿÞÅ‹¬—-±ù<³]ºø³íÃ/Zí`ïâââÊÃÀšêðçð¿yïð¹«GÝýYæwòòÍ-ûNXÛo±¶sü<[è°õÏ.hö[æ.]³dÉRÞÖŒ?ð¨P(àÏ%S½ ÄŠ¢Û@«ÜÚÏ“ ££££³Û¨Tjxxؾ}ûö~.Îθ}Aœê |Øu€"  Ž-R®)`p3EŠ)੃)D D ø6[0‘zøðáϤ°úûúõkÔ·|í"…Eb9P‘þA*)) zñ…xþüù‹/Í«W¯xŸ‚ƒ¨b˸¸¸ãÇý¢;vì ž oß¾ "ðOÕø¨ðRSSÿEI`ñOˆÉh~~>ÔAàqû¿àõ74 P„ @öµÄ´À`…w,k?£Z™ý¾óÉõ=Ê—Ùýp6¦ÀGbÀ³CŸ™Ùkk'¾r¨¤Î¦f…ÆDLzKcCCc7MÍ®ÃÿŸ-)¬URK'E`;“ýxk:±©±¡©µ_†xÕ†ÑÚŒ}¦f*ûE¯Ô­[L …Lh'Âe¤zÌ0Þ’P@DŒ²¹ª2¢c‡>bĈá#ÇŒ—QÖy–TFc`Àü¼tŠWß²Î;’Àÿ.®P„T/y‰Ñ#GŒ3NmÁÞÔb‚@ºÔX”¼ÕZCxü˜#Æ(¨è?,í•Hu‹±µn…ú®Oà²ü³4 ñ5ÜõóVŸwÖ'Ý;)©´2&§ 1K¦ø—c –\ÉZkI‚½©Ê4‹í-XbògÚΘÔúêŠÄ â¿ 7òŠí•þ¤©jêäKC¨>/ÁÖ`ÚÂÝž îûˆZãïÜñËdµâvŽJñªn}îëiGHΘ½Õå6” `0TpžHìwbÕÏj‘ï§!Ÿ)pÒ>z™°ßOÖ»³ ïžf`P ¶ 7Ý>¹UaêD¡Ñ£Ç‹¯8xÛXço´Äfƒã&Ñá?ŸyZ@ë¬<è`6y¼Ð(¡1ò:‹B’ iüC!DÊ1²ç­ª»ÛÇŒÓÊhhûÜÖ>¾ò}TñWËqï×Ä»àI`pö8¶Mu¦}am+w‡Î¦š—d•Õ²_æx¯6U§šÜ«Fœ DWžã±Ëríž›P>€AQÉ]­ %eU$¢´·”æu“_XÜØÚÙ· üD jg}eann÷yssZÈ=íçܳ3Hm%Ø-ií$÷T:Öÿ4 ©Ubö²íÉeM&–¤ü—«´:v²Ä4œ)“&Ü(àσ¢´]u¶S‘—•’S^½ÿrek'o ×R™½D\HxÊÔiS1¦ÉÊKüwÈõÓ9Ü}js"7-2“—“‘•Wßtáq= õÍäQ¨4ø²–¢¬ÓÏ„¬RlC}u%Œª3žjhÜy[ÄÚ±Üè·ÿ~ËICj3Þ< #t‘y IH1JfL6UEÇ@_WOW+“*zsbò¨Œ/÷à™HñÞ£·{X§"+mµÖ­°±» 0ù†¿?÷;·a…µ´¨´ã¥ÇîbÞ}QBÅ*¹ øš¯ž¹ÑåþÇ3à/¯ž}ß%Ñ»@öwÿg+üîš³œî‚Ì&Töä‚„¤Ìƒ× ¹XÚ“›“øæáR}ÉvÇ‹;þT0Výx¹é Ç™é©)É D^iÅ—Þšô7Ff¦¾yl¦&±úÈ.FÏG¦’» R“’Sð£Ó3ó’îï›,¬VÞÝØÑ™³ÚT}î–“ÉÙiQº~s¸ðZû¾!™"Ö†ßu_±ÄföL#³nnÔcJ”vßÀÌöé;ÖSt;BÇü:9ŒUŽyÓÁÝ"¥%ô£å±À ÀG1=M+iú‚Ï0)n*E.x¶b¦²‚îŸaõmÔk6žOEœýó˜ "O˜Z±Xm‚¼ÕVÿ«^îg[ê+̲õzžÒÐÁ€Rü³:E'¶¾~ró¢»ûÃ×™ìßV›sçqP]}Ý£;EÍø®í·|.{úÞùP†7‰0z:|ºEJg>K¤ÎO•’K®$pÿÄû§gĤç¾Liþ3É^Jÿ|Ó…)5Ä~¥²üÞÄa"OJélÕL ðF sÚ{×ÐÝú²kýbQ÷}"„xOUEÓ¨œzö»q»U'›îƒFŽo¦0HÄ®ŽŽŽ–úªÌÔ„ˆÇžÊSœ½“[òžb"È)”8íÇ1þÙœ.jYú³çm$f?Í}ÓG|·õúÝðïOŠÿ s-¥Et×¹W4tðþMF·Â¤…/±^QÝ-Ìr?Œ8•XÇÓL˜6ÇØHWO_OOOWg†ÔaQQñY»o5Ñ¡&ÿ`k_G}ÅáÕ2 ªzZ’SÅW¶W¤Þ—““[¶Âv”Ôü˜ÌrÖC]EiuMm5uÝ9OãŠù -ŸH]˜*)û¾¤™»CÒsÏ)Sf>O¨ÿŸ“vï„ÅœÕÅuõµ5M¬Ž&ƒÁ[krÏ;ŒR2êc{sCcs^/4ƒ¿q…ÉùHyw¶IZ®#õ|rþ]y%ߘ2öŽ—çL’µ9Á9ŠÉ ¯=»|l†ÅºªVNd©*l»óika¡9W¤ÐåY¿M³ºÀ^¿~t“Ö<Çš¦æ>)nŸÔˆo~Ëèp}W÷Iuœhüÿöή©lëÛÞû¾÷ν㌅^Eº ½KGl¨¨A)¢¢cq»X° ‚±€ Ä¢ˆ4©ÒéB'ÞËùÒIBÀ‡÷sÆÙÏo&&'çœì½Î¯uö^«­6õÙ›a½&>LFͤ•$Â| R“^•u#ë‹–k(OæÌç€= Ÿ&©VØGeÚ{ã‡ÔW%p4‰3îí¨ [ç¸~ûU•F¡Ò@LðíÌ“V[˜do·øqŠ@"ô™ª:ˆÁ*üWBqóÉ›°A4DÃltV³ßþx12Ü߶ÂÁç@7Ä ô¤Ôµ Z lÂÁŠÝ犛úkÀ@ÐW…ϘÐÐ/nìš!&¥¤ ;}úte¥a©w#›G»|æZ9®]d-+).!%kí±ë}NàšÀ»€(]jcp7·ž!¡ó¦þÑ^Çì53·r÷ X½ÐFKoiQ XãøŽƒ}¹é…¢¼¾ÃÆ-[™))é»ä CU÷-V=Ê`wLO¡õ쟕ûz,VPP>ûä‘*Ð=JŽÎÒôÊ­aˆT‹ÞS‚3©ÿGmŽÐü‡ñ…÷ìç91‡žªSÒ2ºüÇŸ¦þcÊ(²6>Í= ×µð§H{?fxJïÃ¥fÈÚ/÷ ðpš6]" â [Åžßüo¥€Üï#HXØk¿ñ“ë_a£ ¥O Õ4%æÃYsÚhT*ãêÝQ~Oy®Ezù3З®)®ûŽ9_ŽÙQ:_gñÍ©ÔK†JÿóŽ­üóÿ«ëâŸÅ‰0|m?'¢Ò¯îwöÙõ±•Ùž²ä£ ?xÜ ñ]!îü²NR\ÊqK ’1¶l/÷¶Ó\³çôAPìX Ȉ 7¶ÛÜ6€¦ D ±I'ç[¯ñ ôY¹@A}þ³ª^âøÛèëW¦brž&FFžN~S.˜ /ªLžK¾s·±)tñ\<‰nÓ8­åıyM¤O¬Â¼'(XÍݘ¨¨˜„Nw였¢×3ßÄ6™w[‘÷#·*ŠKÊÉÉi˜,I©è£±DJÃÀ>·‘Ù=Ñ•‘ÒÊ«{ˆdˆåzðzñá¾ȱŸEÿ*OJÈFؼMÆslCNòïõlÏZ ùÎЕžyû¤©£oYbŒ­Žìõp ½›Çº<ê&•ÇÖ2\ZÆmvý-Oé9ËÛþmÂ}c~e tÁäw|]ú ×òÿƒÎ# ‹¿åü‚û=—èo*l¹À7):ŠCö"ñ_UôîJøªý0«dÐ]q_ÃÀ.·‘y)'4ßš-5¯Íä@GnAéaOêé -½Òöahò,–B&¶5ÔvöÁy[N9i›çߧûv¨¤¡3’_)Jˆ²v^SÔ1"dŸ¨Š{NŽËÞVtX/D¸±qßÁn,…ý‹(2”S½ÑÃ|Ï– üdìï.èc|qùúŸÿ[‚ÕꀿHÇ%–>;fmïQÚ˼iDèOSúA*µÕSy_Mß6‡%R­×M[Êãâ»A‡ì¾±~ފ͵¾N!¾¿®ké” êstKÚ‡'±„‘ž°U–VË6Õõ£ñ8LguÆ\…ƒ eD®-+(¯ifNâþ7UW¿ô¢p…EõÕü´tIÀ¡><½¯¶"ã]‘Ên(5íâ>‡Õ›kqìË …<œ“‘Ù0D)O:cjëz/³‰Áôw¦_ ÒÔ[ÙŒ¾ñЊÞ×Rìi«g¶`å¦Ð MuŽ"H´Îò{š†ölOŠAEÚesMÍ•ë‚Ö{»Í3·½ó®ŽoÉ\Ìû>~¿>w”¦¶[¤&åòÎvÕÚ‹SV9Z.Xê¾!8ÀÁL×cç¥~:„ìÜãaç³+ ÎRÌÉG44 Ü}=W,²t\ù¼´±ñÑ/‰¹ÎCì)O„žÓÛÜ,²P_\a{ÃG뿼ÛÛÈbþºõÁ¾K´µÍ¯½©†@¬¾©H1£êTRG]ɽ;q1±W“S›†(Œ7pXv^á†5·Žuþ\qûƵkq·sJ?é¡j::ÜYŸ[X†"A¸ÞÖìœÜ‰>‰déTociÒ¸ØØëÉÏßÀYw”(ÜçùeŸ›‰Tö^´¢Ì—ñׯ޸ý ´ÆÖWXõ‡ô¬B"%v$lCEádžN2'34L†¿KÏøÔÅ9Â0,;ýÉk±q·ï½-ªÚ¾½ÉŠ|É»WÌïý‹Ì3ö0üéej¼ÏÝ.0͉ï8Ûdz¦Ék¤Èóó·Qä}b¡›Æ³8è"²=½« üßÄ3DöÀqö¤qW粟ˆœò!¢Û²Ódpë#B¼S€þ ø+ŒÊ„Æ[BŠ%l:ÂÍéc/óthÒ<‘õpø+BÂ*ÄwºèQ¦àâ/ýeß»!|U=)Ñ uÇsyDâ˜&Cc Æø“×ù§ÇÖÄ:èÇ;[yÚ5såS¦LÑ_RÑÏÉôÕQñÆ×QïßÿúÇ?~ðÚƒ DÐeÑ?NѨžü¥têwlOžÆ CLd¸èim¹ü¨§Ÿ@"›žÍùi†Ó5NÆ Øë+&³gŸyUAÔÓ+T¦kmÀ14¨£bÝ—MçFȵ󕩔˜áÖ'£Ò‰­°×Óø÷æà‡&ãú1æ 4Ö%â+Æ…€ß-QÌ2¶©¦² à}ÙÇzvjbz ¾µ‰B~*+ 1g„Ò#ÕeEE¥íýH¡¥Sd ¢­®vdÞV÷±°  ¦µ×idlsmeÁû÷•µmìEdºµµ¡oÓü¹¢m3ÜPæjaæ´µ±©‰Œø±¶ šÂ7¯ÕÖÖR•wb=¤£ÎïósXw¤ÉZ]Ol6’Ÿzè5¾õ]¼±é¢ÌÏœ$~#%Ç¥§é”sNE¹¼Ýw‰·ÓÏÿ"LÚõCdö1ÃT:¨øÊQ¾?5öÐ{KK ssó°K)Œë{WIÂÂ5«·í ³˜«y=³ƒ†ï¸æka1ÏÌÔt‰ï¶ÌªN2ut ¢òmˆ¥úZÿ ¾n‹­Ì u,V$f1eˆL¾xpÉ‚yŒ-æÙœˆKc¨ª³lƒ¯¥Çöã®ÚÇS>ç†-ÓRQž¥¢°õäðD®‡Á2Dï°þ4;Vî>¾Î)(2Á?*fõ<õ€ðÇýµù§bî6r3 6§––4,cíÒ˜vÜfé/õåQÿ"üŽ( }¢ûÅl‰ÜÙX]\TÜc.Ñå%¿À¡*J‹+jÚÜ)ð§üÚ_ÆX[<Èú0‡W¾¾®©47µ‚×¼\i'ëä¿;#¿te[,cêWXèú¼m™­÷ähZ~tÍûzbªNž×÷öt=:î1U~^œTöô¢¾uìÓÂþÁ²ôXYÙ¯‡¨ðº+å–ø%½ÊëÆÑ©„Hw[›I·æ½uÒˆ“?Øêæ°;ö–óq«áŠÍQüv—>]¤#é¸ãÓXº?z-Zx&¹’Ò+D øm:E¥PiÖwgÅG·Ž,´·2·°°wv»žÝÉ~³¿±`§ÏÆè×ÌÒaï…ÇÀ›|•«u=‹2ÕRÞ|<®¡©;-Õå=X¨·úé‚yæ·_³VuC]‹$§G¼æäÉï­ùð<#C­Œ‰þœïg¢~,9‡{ÞA?éë>$ pÛ|‚—ŸëÀr³•§ ˜æ¥º»/dñšqÑÛÁnõ /‘À¦†œÊ¼ØÆË®=áŠ%q‡½±ë¦ÓœcàõoÑ‘Y¾ûJ+†‘àŽù¯ÛsAcH×U±ÿ˜·~i|ü)ܘ±7v'pxüÒ2¢/Ÿ‚HG<=ÕöCãÜ1f/’ªzgge÷°¨¤ôöñÀYZpˆ†î?¼dñªÀ´ü²÷ÏOÍþIùf=©Ë¿Ó˜Tü³+‡­Lµ5”g«šœOùÀôA*Î_ì“ZÀª2ƒy%7}ö« 4ÎÔ>Tu^°“I\F1o‡;rÆÛS®†¹oÚ‡73ïÉ6Wíþ#è– žNGXå¥Ù'¸À©UÇc‹yõ¤ˆð¶îö[.=@³¿l£ë¹õ ã¢á­‡­ŽÆ\‡Äw‡±d¢Õ?µ2µ‰y”×hÊ9*1ÕðmgO× ôÀ_@§ Ú`w{cC»ÇÒi4ÑÚ #SÈÝ04Ž=©ßÞÒÔÔÒ!°Š5ñ9,4*©§½ Ç°‹¾Î††æ¼Àm¤AX[CCÓŠ›6ŒkiiÅS!x7 ŽÄ°µKö$¾‚ÁÆ/8EF$ ²÷ÜÅ)¥8\­­8ãÀÃADG…³…iÔ£fö^7}f)z<#CÀï¶nÁ¢Fz»»K_ÆÌQV ¿ö Ñ:ZôV¨ö£\R '• m¸½¤ì#–@æ]çgmó¬€×OÍ›êpêÝí_×øîÆqÕ𒯓±K(Ó¼ÁËùÈÝfÞáB"5q­Ì‹8¾y…ÇÞkÌD_Œ#HðùÆ ÏVB¨æM®zn[OµaiœeSÔªœD±ÿüÏô™bâ3gŠÉÊJÏ—tŽ,ÞàOé Cøáî3[–‹Kˆ‹OÿYZFj݆•Ñ;+’ Œ6ùM™jþª¸ Ì°ž«1ãç™â’bzŽ¯*ºù=0,¢gƒ©Ê–#å¦Mûñç™2ªFoû™iñØ3A6Ò3§M›.1SrçƒÏdDî/ÒÒPÙ¾ïÀ¿ÒŒNνeŸ†Œ´¡íü}çSÆu¶¨¨Ç7™, ma%¬Ð”þáèk\WåKKç§0ÎQUCÄÅ]HÜ ø½~ýñ…ýV ëºàt:B!ûÚhùí}8Üü’¯2/tÜJÜlÛ}öóGÚó}:G³ý£kÞûÏ[¼ïf7–Ùû0¯ËMS¹_ÝÿæÚ^C¿í,™"w:jO_}¬ŒŽ¨ ){v¸[æì7yRDy½ÏÜÑ÷s³ŠÍHíU ¥g#PÍËXs;ÏŒ4B"²! &¹%öË!ö•Ì𧦾$ÅT×ìa%óêž~(@N×a˜ Á*“~øY|ñƈ†AôlµÍ|˜¥1èØ£^‹CN#øÆ{8d÷Rñ)†Ž5Ì è(«ÿèlÁÑéõ ¾bJ™-̤CWwËÈkWt£Éý…’’âÆ®¥Üºk•U¯T pÍS´¯7ÜPìëhî³íHêó'NV«Nà!¨:;ÆÌƽŽoÎ9/=]ÿ3øE¿w¨Æèµ¥Éî&JÆË‚¢¯Æn[c­©mœÔ!êž-sI+a_Ë!d[š¡’¬£çöȈÆsf¼£Œª"j!/&-µÔwë©C¿h+Ë9{†1Þ…×æûš©š.õ?¹`Î,%³Œ~í­þe½Ûé¤6Þ`/~ã2mËůò«¿Á“Š²U\WÊyø°m¹‰•OØý;Qf²rËNç1 öMÒ!•R³gÏR䢦áð‰ï ´Ž8eÇæßè¹ßrIk(I6Ó·¾ôºiÇ’X® ÚQ~_I›Sô6øVKBó’s@wSyüýÔ.âèi°˜«²DèÝnÎkT¥¾ÄÑM„mú³ÖžyĬ¶:«©SG,TRVŽ}ÞÂ=³FEåìû­@™³|‰ƒugv¹k©«iÏ«¦ª¹ùj‘Lúøî’™g)·%­ù—¤§Ï­ç<À?Æc_SùÕÓ[·l=u£¢“9ôÁ!º ŠË{áì¥KÌ(wouö™ÃaÛv…ßû‰S}š{yG}ÊÝ´Ôòêý¤G×NoÛ¾'6!Áí‡è¡–»ý²u{T\òs®8L@V•6taxßVp,|Ï‘³wÑ¿¡÷6椽oæ}8~ õ΅á[vŧ氎&ö¶U¤½H{=JFfæ{þot\Û«yðÛþü¶I‡ˆèá[Gƒ-Œ œ—øï|”SN¥Ó™E ís›˜&€©Œ”žµªLf0šêk4(ér×S8Ë–Q‡hÍÜþ j¡ºÊ‘[¼±â~3µÕ·KiÃ…**ª‰E<‘Ã2D*jT¤D@ÁEo]a¾(¸å4á;ò Ä~Øxõ=£‘Ö®™ÜšQõÓ,;€B~·#õ…¼ãO1Ý©àÆñ™Â&âÌŸ"°mâp}‚$N_ð‰èô±y©þä"E§QÐðξaÝõäÖ僿¬˜1M£N„ñ=lŒW’²¨àª r°3+· ?ÚÇž”›ºôþ 4GÈ- ?Îí^«©zéW3F|tT·<ùH…3E*¡€ RM†Eöw¹ÌÛ}6gáÇítý µÙYXß)áLOÊ´fLðuB5F†~kÑCN=ÍÏù›[ÞÊü0Ž‚Œ[hO9¾B=š.Z¶€¿6¤ª·]=¶7²§) ?•ü—djª§ê¾¯žæ4Gfíù·¬=ˆOφ8û†·RGM‹ì^*9ÅyÝ‘–qäÇþ$i_‡‡ÒwÍS¶îeíØ‘uE^V-£nÒ_¨ª¦–XÈ)Œ‡’ʹ’nöRdɨþÈ …Þ»{Øʈ¨µ5sÍñ4ÊHG€³ièɇ¬½Z—+ýø°SÐß ÙZW=€!4`òƬÇþÆü¥¦ªª¦ Ö¬ñ´P•6[wb„Hm-ºþ£”fF '¥]V¬®Œä‚e«Ü;èÄeÖñâ°ˆnwõͼÖ898º¹ÚKN“;™ÄOba¥Î³ç{¹/Ÿ%¯|úšD'õ¼û׿ˆ}‡ç5 ÌH\Ëná‘èÇã7” «zíåbfdaïî¾ÊtÎ,ÛõÇÚ†²JþzÑÑD{áÊ5Îú2ºnúIt0Ž|“ „@€ôA`’DŠ¹âƒJAt7¼II¼{#³ôs?Ï03ÝÑÕÍ.]È*'Hê‡5=ºs=.áqu׉"µÀŽÀ<ô#?¢+²Sb¯'TÔ´©L§ˆáa;Þ§'Ç\‹/¨¨A)¬ø"¾££…§:b½5ñ×bÒ êEÄX¸öÏ Kuf½x{ãMqí ŠÀÞ•F!v֔܋¿þ8óCÏŽ·\#Hnè¿¥¾¿* «Õ—ª~݈]²M¨°ÎØò:Ðx!Mþ3Žî1îGßÈ*Y7§hTVv"vhœ¿kóbÝ4B¡sžH]`EÚX;p&Xp+Шœ"j,²·ÒX»L˜·ŒSs‡ÝHˆÎÿÀ.ÅÃWŒcÌ"h42‹£Ò¡‰æSUÕ„è2‹%P¨4FOÅa (\øªk>§`ã?1–@¦Ñ… S1 Å 1X™*|£‹J%àqh´@Ûð"¯:•ñ-G3§P!þzlÀ7 SðßrYuz‚!v¤Û]Oó|³ðPTðÌ_þôñFmÂc@a%¢C Pà™ îÐû›îjÊYÔáEö):Ǹˆãhc:rIÂQEMÏ܆Gßb4ó_brJ³•””f)ÊÉ+¯Úq¾¦I£}eå(ªjÁ<q)Y&ò Z&{Ózø›Èl=õþy¼£¡º´¼úÖÈ»½Ïj°°Ï›=¥¤ÙgPPTT˜9CÌ%àWÞ‘Qý7k«((Ï1Ùwñ!Oƒ>Àwæ“¿à/9Pì¼-Œ4"ÕŒ–ÿìVt|*nÌh­,é´–‘ÿû:Dk³”úÁ=:»¤ 7//ïÕã¸ùsdÍ|#q¤?b!Ô¦cýƒW便¥§1þó®º/(côÊäuÕ9ç“ߦ߱ÑRò¿”…§Œ¶‘‚CVç½|ù2===ñ_j¢­¦êÞÙ<:¿Öb¶ÕÚç9oRo-2ŸpäôÀŸÐ«ÙøR$BЩýö0¡V‰,ä-ÊïšØq=¦þí÷#ßÓ𪫡òuzz~y#®ï™‘ú|¶Hô4½{“‘‘™Ó1ÂpžèÃ=5»ý—;-÷K)ª!Éü§aŠ”1K¤èmóÄþ¹½`ô­ª«Ûg(:6¡¾Ê8 Ô[šbªi_Ú‹Ù«™{‘žŠ>G_²7”?‹^¿/§@ã„*o‡Y{ïà™×àëYòJwŠÙY4éqû]ü«z€!þTÆÊaŒÍç5þå›þ„è­ààMG˜èãeS¢ó-¥Fcj& l)Íþ6ÝžùX˜½ÐÖÂÜÜÌÒv~Ⱦ6&KÚ¨PmV’—‹­¹•õŽ'5e_ ÷ ,ÜÝRÆ2 ‰ûÚó°¼ä#zúÆfFzêšjÚF6»OÝ AýÑüLy†ÜöèHK]M -=gÿˆ v<›ŠòÕ6Üò\ðÔ¢ä–vNÛvíÛ¼xéʸ×Õ”É „_ç x°ž×½Øþ_éª(‡…F%>»}îòSšÀátƨ-ïÚnu³¥ŸàPûã(e%¥ý§¢ãâânÆÝ8²ÃŽŒâ¡ûoq ŸÊáó"Íi[²û¹ºÃ='­oŸ·Í;¿ë·nE†)k:&ä6ð JÉŒßof¤0úÎ¥pÿ9z·‹šobÓyŽdÓëc³¥$Ý*QŽ¿ ”Ä3»ç¹5õp'7'mP0\ÑÔ Û¶ÚfÑ–Ó}Ì%ºT4|EdŒa’.„ï97 ÇÐFEŠÖf3[Rbæô©?±øyš”¢ÎÍÌjõë†jœC2oFXš:>+©íîé­|qNSAiSL/…7<ûy†©ÓºœÚ^Xõ[;ƒÀ;XUh:ß]ή‰îaw!Áq¢à®†²RBA'ó(Ø7ëY¯,®ýðÍ=)Ê`Óù_<´ÕÔN½®{.>;„!RTìÐý¨íFZ*zVË3k™´¼ÍfÓ¤$gʯ îá÷ŒØ"e»Š%R4´ôJÚ‡yÝ¿8íº®ŽË«âž?ÒB*^÷!/÷í[•™»rû…b5OCæ«œCØÓ˜(eͽ ±£ÇqµóÄÄεq«8³d¦Í …qr¯ñŒ•ºÙEÇuëY{ Õc @¤þ>àcŽntðØâL–ë);£¡åÒ€¥“ˆŒÁ¥¹2ÿú¥.sÅôÖÄ2ÞeˆT0W¤èã…ûÄÿ¹5‡>&´øµk¤˜ÿP#p4žDã,Z¤ä$2™ïVÃ7žÐ_¡'7#¾—ó²ã]¢¶ªzV;B8r‚*6PW¿™Ý**x}5\EeA7…Êþȶ‚ôÆfÉùA¸ðm Ý[¼HGÃbÉÉó‚êÈhiKil¦B¸{»¨è:FFÇÙâöÏ´Þ ‘àUï¶ù,2µñ)lë#N(R¥ÜÔäîÙõ]ÊúkrjÐ_íIñ-š\i Ï'Rœ(âÒ9‹IÈî˜Öó}ŒzH¼TKDµìpÒ[qú%…Æ‹ÅsÎ_“´KÕ< Z+)‘ú;Trï¼±Cza5HÂ!ãüæ©Z{U6}Ú°rÙ…älÖMU¨æùY¹å {x~·ÿŽ3cŽNAgÍîÛšC›´V²_Ýmì¾Ö:„%‘ˆ#}mgCç»F3>ÞÝÞÔ5ÂœIABxÙªzÉ"S)4 ñ^ämCïv4žBD554Â14ö™êŸE««T Øç%á±íÍ-("½!ýšª¢jježá°P¯îž51rÎúÔ $ ðÍì“%0•™´tevr6†[ʈ©oÁ úô÷Ü}ÇÞxl£Çù†sD{p,ÄeÕ!Ñá>ŽH]ÔÒÒ¾™ò¦ˆAáûÄ ásgNß2üµƒ1]£öºéË Š_¥D±«µöÊžÕ2ú ’ š ÑûVÜ£‡a1{}奦‰i.ýÐ6ÌØrî¸u<7жH«„È-VJ³ŽqÂ}`ñ×ß@§˜1¼¶Ó–è[-ÙwäDØfo³ù®Kì\ëá#—wyèY8î=ydƒ¾æ¦ËùŒ}_Þˆ°²r¼ü4G ñwÒ"5ô×å×2EÊlú”Ðw4h’nè°OÒZðÐA_wÕúm'#OlZãbfï‘ clÇ Z éÇP/êSNÍ´ûÐÁíþ&z¦‘/ë)th°î±¦‚ÒyŽØB‰G=g™î!Ù-ë¬Èv˜£ý¤‚†N‡¬Ð1wÙwøä¡°­&[Ï$ “@|SȈ×–:úa™ó¡îáÚ™*›È>a÷ò¹¦öÛFÆÝNndöT ™˜p8ÈÙíUHAøE*5ZOSÕÊa¾‹ÅËV½þtCk)þ)ãøÞ”˜[=u3g¿Å@ñn¼„ˆm«­ÊJº|žc`4Š95‹{fÚÐÿ'Ÿ0£ùôk¥Y'îWŒIÀwìMîĜڵcûþ£QU=½ïî=`Œ¬°]ŸïFŸ`lܹ'üÊÍöÍžæªK·»ú‰%òøúêJo%¼‚ÁÉyÿrTV'}R\þ!59OO ß¾}ç¡“çrëØw‹H…i÷cŸTáˆ4v¹·Ê—7Âvíعg›r ••hb¨îjôåâvŽáV¾y÷¢ŽLá8zÈÞöÄ«qê:ØÁŠ{×β¿ñ8k˜Æûh`€oi$ý´³sP4ïšß˜*¦¼‘}ƒ8õFÔ®_6®\4ßj‘û½ì6:•Ä)Ê"õô‚º¶~#š&ò:ðG¯ø£"%t&TüÞ¥³ô¿ÐO!-x哧9¼…—ÄÚk2?häcFWbRÛØÌ^ä°ióæÐ`5yyK§•çbïÀÉ_ëþJ~ÔèH†F¥ ½Ç¾Qi£™»§@Â/ázФq¸Y*¹Ý•ÛÁ„ëtE~¢btºpæ\áw9GÓè‚Û€ ¾‰Šž„ØøÖpúÄ Z3ÕB‘¤žOÔö³Ö*RÑ›\ôÍWDÒ!jÂáà…+ ›‡`¸9q‚UÛš89ýœÏ“âåµ?Þ¯jâ^Ô„ÖEÞÔõþ§z fï¸^П.KM5,ÇŠ ÓYœš˜p÷nÂÝ„XýY k¶žÌÊ+ÂPAù›8Rc/æcTF8%˨—1AôIÒ)Áš‹Bš"˜êvŒ6¶z]hÐÈ—‡VÄÑÀ7CB½ ÅKÕœå—ÆVš.!¦º‹éÒøÁÒ{_~UCqÆmS¹ºž,„èäÛÖZ8­o'B4~s óã´-WTáö'çTÔµŠùDj2¡ö¸Î•ÜžÓÇ~Ñú1ÅÕuCV.Ú¡œº™ŸŸŸ/ o/ïýî2g¢ë7¬t<ô¨‹F ¶–7ZùKZ~YNê­å†ò¶ÛãñTLz{`]hx;Šÿc`ò²ÇîW!àÿ§H±g ̾ïno¬3w®‰Ó†Wï_¬ö>ÇРƲç«Ltut ŒÌÖL`æC¦Q>¦ÅjÎRñ=x¥o QÉÕéqÛ"ÚPPþ“µ~ëk{Ñ“"`+~ pUìG¶RÛ«_xzlËiî¹~rÏÊå+VsYáºbç©8f­_Lã/k]§ÂÇ÷5¾÷s±ÒÓÓÕ70\¹åtC§Ñ©RFܱ »Žt 8¢Ëú{ôlñòLxSÏÓa R/»ëeý9EŸ Ìxþ!ð—÷¤¸Å hT‰4‰¦n$³ÊÊðªCQH$ EÔvHD¹¨É Êð§Hú¢‡Ã7íb§“IÌÖó{îïЀ™»€ ~´@ToÒ¢yÂqEÑUmD;õ¢í”|æHÿâÆq*掾#`dth²—‡ ÊP ^MDÍÙà.þ> ]øÓ@'ù;š ×÷¡¸K…&ºþOšÞ\_¢ÈXYAnfffNAl™9þ¢àÛ>¾ËÊÌÌÊ­ké¥OXÄ U߉ëÕô5ÞT˜¡_ƒ3b…ƒ›>åÄ -g–…È!ÝØQÓ§·ÏŸ½.‡ÆõâYùPP‡ƒ—[Ú9­X¹ÊÙÚpQÀÁVT 6+ÞÁÜbñ²eËÙY¯zÓ€ ß“@ ‰ÂpG²‘¦ˆ¢‡lyt~ßú½ç|j2ŽK%:,-rç˜ÕfÆKN0Ÿ‰,ßËÚRöø¤ê\çŒOÌåQ¨º×ŽÚJ»uAP[è2KŸƒ·XsUá{Ô­×?+à;µÖ¯+zøÿ«y‚­Ì ËÛ*Ürþ*Xÿw÷ËßCÏÇö^?¼y¾µ¥[ÐÁʪûæZŽ $Æ{ÈgW-\à`ë´üR 3 Ief’‰–º¦¶¶ïÁ+pžwLKeì]oÞ¼8¹Í×ÎÚ:ôøíaîÝMdgÅÁMk¬æY­ùåd «¢f ñò売+‡¬ºôª!/|¥¾†Êl5Ãm‘p!ßïåËè`%ë8‚Ä̳B£Ÿ\¢àV Uܱ5·É®íbïÓùr›¢ÞÒnœ)À÷i­´ñ‹~s¢ =s›IhÉ£ˆ¡òÀßÚ—"Ô\;OÍ1èÁóŒ—÷ÍÕÑ°°[ÝÆÜ9¶iÞÂuw½LOˆPœ©rä]„ï:¾ÅÛÕ{ó»Ïídòh*TuÞséŸdŒ÷Ÿ½õúUò|mu{ïí •ë¬Ê^l¬vôõ»·‡¼Tt—”C®çÓŽuÚJ&ŽëƒC³?÷ ×o]hjìRÙÐA1Žâ¼j̈ÕPÓ¹WÎô¤p•ñê *—ÊÑ5÷Ï™Û/¯lcÏ·…F`´äMÞÁÁÏ øn•ÝòZEtÑChÒ]ú×æóùwÌ'÷Nï½U‹äEQCí—ö‡¸¹¤Õ2“Rs%TBÆíH/·eþÛNôàiBK»‹Ÿï »Ô;‚àõ¯‚¸:ú Jê˜U*¨RB°½Š¥{mWûÖåÖû#{¹§B<¬ft/‘¥:Ð5ï}5%מIfeÛ"ÃÏš1+®–qe§¥[hu?{ø‡[i,¹xWݸÙEÒkïÅ §¼ìV?ˆÀéÃww­øñG ©Ÿ¦ÍôÜy‹±%3清ƒççÎAöŽ#9†Òs“ºÀ*tÀwk®õ¯Â$T6REéÃÏênª.­h¤MæÇR«rsÚ†±7ŒÓj·»‰Âî¼~¶="º›‚œt´-\Ö­qŸ*{:“ñ cGbCl¤•ô×/·Ó:Ëá}…oÊápävWÕ¹ží( R.¸KG7Ì_s6D`{ã•ç4´v¢Q{üfÈk„¾R׋$q’݉®'Åð¤ÖÛƾ,äYλiÇ3ã÷¯ ‹!q=¶k.†.¡hLˆÕvGn~æ9ô‰/qßë8SMùÝWÓ‘ÔÛk¿ÈÉëE—À‹o5wpÿÔ1À©·ÒºOºH¾¯q$Nc–(dNjxµWœSô!J̬UQ¬YMDÜ­~ó]÷‘Æœ„JeVdŸ„½(‰|c?¤PG·Ò™û°a=jµ¢â©œFˆN› …”‘®”¨­Æº?ýƒ[ôNøðx§žõºO¬Æ÷¶{(š/CS XAœœšqêvôƒà»HÏÆóo8š{û”îô(ê®"ày)Ì¢‡Nþ‘¼¢‡ƒw 442^2¢ýW9+JŠ©9^ÏjÏ“bˆT£IÜ«b^§½½ZÎdûÓka«7†ß¦qÕèÑ/®Ú üGÐ-¼œ$´ð)¡ôG¬‘^6K¦ã¸ï¼Šò2_´1?ý¶í¢ÍœzmÃõ×Õg[•cø¾ð—6PÖ’]TOÃøóûÃöÆ<*,LÙ-ÁJ0KBõf<¼±ϯGÎæVw2¶4%^â8OK×)þu1’Ï|ˆ8äý¨-͉Ñ'÷„¸ýì=’U¡K]eW£Ž……í¹—ÖÇ3v§¢Z?VTÝu1·¢© #ÎBQ~ið¶;s'°+BO]ò¹ðƒaºÒ?²DŠNA^^¥º:â瘖˜ébÚ%„ª{Ç,®n"r6'„¬T±_ÃÎU=ÔPàë¶ØÚÑÉp^`[?X0€ íñ¹ÝæöÞ ì‹;Tq'@ÑpyÝ0æsyé Ž“Pùñßä×2ºMò¹½!a‡!ˆÿ(ús¾¯‘ê¾øLÎ)ñ]Þ*Ó‚“*“¯_ÁS´Î:–k.ÑÁ ‘ºÛÌ'Rööî‘‚!•êÙ½Ò.èâK^âõ´èP¿–ÖlWKË{ï9zWã®lå‹?)à;q£X‘ŽÁæí¶ Ú–žÞ^‹mt5LLXE‰ONú¨ªêxz{»/¶š2Õ$¿—ÔñòÚJ+—¤¼J4Ÿ `FºW)ü“ûB{§^+5dgn¹ü†ñÞpcî"ýY.+Öx{™*Í0 ¼ÇQÉ}ù’b?»¸¯Õ³_û,ïsYî yy·má_}˜(ÜÇyŠ\m¨À΂Ž…wúëªìº—ÃmÇgƒ¥®ÔŽ@$ì0Å vzýíæÚúG1¥˜ ¿y$(0üzÂí3&æë€Hø­]“¾ÔLÇw÷ɼ²ªìgwæk«X.ÿÔÞèb²(hO^EuUIÖ©6Z BL‘Ú¹Ô{gE’Ê—2]S°Aw†Ü<·˜GYeïÏmq’R¶¯CS«^ÄëŒI©þ\ù$6\^Fõz †îN$DwRÌѵÞÞ¾¾¾^ž—’{XŸèútzWÐú ›6¬ ;yµË=tmÀwùæâ ‡u§Xã7fà¼:qÍLåMdˆp{§®±UèÞˆ‹Wn7±'^ÑC¡zRØØJ-ÙˆÇ,(ÝÖJ?ýšÕé©¡´ëzÄ©mƒ ÖW yXI…*«¨ÞÉáÚvŠÊÙ÷-Ê9|"…jvÓP;ø¨€{L—ÕTñÃ¥L«§ñÏbØšš,õ }RÂ,9L.óq^x¿œ)aÙw›X† YÖM ૉê©«©i… 2ÃÝx<³ßÒ©ÈÁžúÚšºÆV«Ä!3dMÂÃÚš;{Yi-é\‘Ê q1»õº9«­­ïBº3tr?¬­¦¦¶³„sg–F%ð$2_Y( ¶­±®©­[„'Å¿z‚Jbª¦ 6@¢Œn'aÍõ5õÍ8 z¾/HÃi§8_†¸"Õ¾Sô‚Ê™|p[€Ý<í¹Æ׊·è¡ÐÌ!ìH×j]…È:®ÆP‡µfnOú¸P]åP|W¤ 0S5÷;hÃ…**ª‰…¼È:S¤¢FE ú"Eé ³P ¹ö†+RÙÊSg=lCC|Ê¡ÕJÚ–§o½@r*Harü§LùÁÀÒÆÜÌLWKCQQUGCíXæøýt‘)' Ñn¶p ¾—¨O9ó od”.êÂ/è"kYA"vû-Ûéü+Ø€¿¼‰â‹í2pÜPËÝðr«Ö µÍHRïéÃ'>u"éŒ%nh›«¹õª4fÑC†H¤ Ú[ª0-ä|çõpÖœŸ§Åu’5”[‘È=q¥…ªZTvu°PEU5¡€À/Rç ZSì¿è!‘ú«µcàEö;„—û§)›v`¨=…‰zz&‰y]üÇQ†ë²sòòrs‹ŠŠNîö×Ö[ò %­qÆœ>gEðÒ>á>~µb?ÁuÔÄÙó¶²qùàO}BG%¿ð‘Ž•86B|/†Ù]W¼@S!ðÀíÎ!Äç—Çå§IJÍÙ‚Bõ¬P‘ò=r³o9ØV±ÄHfá®—D¾{(ÀÁu§‚Eö¸JL™kéü¢¼ÞS³ÛYUÒ.‚aqi;¥dôoå7£}×wxI«ÙÖàÉý*ªj|"…ñRž½ïy%D!Y.øDŠÑüƲ§ÆÚWÞ¶RÐ]Z–¾ÑˆþôLˆš®ÅåäIî3¸—˜’QH㻪¤Æ„š±îIKLž;FÏÛD¥˜ÖD)}|Î@~¦œ¼ìÒvw_Ä«hmfl­Í»©'7]NAQVRÜÐ+ÇØ•J.L<<õ?3Üvœñ‹ÔlìªÓÌf‰ÉÈHÈi-®ïcÞþ¥’‰O¯Ÿ6CBQ^fúlëÔZf¨ŸÜ_¤9Gë~7àK²˜¥ ³,äü—Líõ0QÙ›ßÏ©OF§œß!;C\NZ\uÑ^8™J£Ro„/’’•“••c!#%fàJá;ÇóëM­ÖƒuR€IT(è7À’ñí­í£[ÙIü褎–æÞo€ÈøÕÛÑ GÑDªËCÖ•n†Ü!Û:úøÆ“¬gxxKŒ»‘WV‘5iµ–Šñ¼«­¥‰ÿrCùƒ!Ü—$¼6(¼‡ðÁ4n^?»þB®Ô˜àhù[Á]EŠë3ܹDY<²QÔØr‚£-I:þPtLÑñJ¹ð¾`Ä ¡#â·NEf‚¿þœÞ4ník¾‘BÑå èÀ÷Êÿ×™èŸ endstream endobj 662 0 obj << /Length 1210 /Filter /FlateDecode >> stream xÚÅXKsÛ6¾ëW`|©4!x“´omj×i“ImõdçSņ…¤âúßwA²HIžÈišÑKXì~ûøtºý<½>ç %8QL¡ÙE E"Æ"áh6G7ãëu¥ºÕ“)‹âñ_©t±Îæf2¥düÊ \™ÜèƸŽ¦“³·£_g£Ï# ›Dr#¡´Ý|$hãoÁ<‰ÑC7«@BÅðÌÑõèÏñ†~±˜céôP…™´Êá8’V×ëË"Ao*Xá\Jú.ÉXâ˜ÆΥˌ”dÜ.³ÆIfBåø]¬r>y¡6óWNº«òùt1‡ujænl¥ëÖIAÓfá<«MÚfU‰;¦` ÁLqë­¢¨Çv¯.\<(ʼn”ÌZOДs+«uî1®VV}ãÔ{˜žÃZ&@±tkŸ0é|}|°ŽTõÜ›½ÔFÆ_ì'o¿vÆxU]èöÔïfÖîF÷¢¬b¬(G’B1ñl¤#H†Hn¢ÝÓSˆ‘˜röœ˜Í1I˜WA‘ýmNÛvG¶¶I0¡t{;."Ž“(Škƒ{5Ô‡Ï.C1B‰‚$Á’0‰Ræt2U¤C¸ÍÊû欃vß&Ï‚-Ç4Ž_€ÔnÀˆÀ çǬçñ°èD¬pL¨ï#UaÚ¬0>á²AÝü½nÚAYŒœT-Ÿ> stream xÚì½wTSmÚðû­sÖù÷”µ¾³ÎWÞw¾™yß -¤÷!”¡W)"PA©JEP»bCTl¨X° ˆ¢ "Eé½÷’½Ï.IHB‚>>ežy&ײ$;{ßû®¿ûº®» Nt¢èD':щNt¢èD':щNt¢èD':щNt¢èD':щNt¢èD':щNt¢èD':ÑÉ?LP|ú½ÄDéŠü -ºŸÒ–Ðú®Õ{¾7ùg`5’?;¥ÿ€ÜÖž×ëÄû»k ðS4” öB•RP¿ã'ÄI­¨î¿NøµjˆZ;úð©(M=Ðw8ü25‰ÄÀfG]©“9ƒD"‘鼓åÈ-Œ¿½˜QºSÚÉÆlj˜Rä¤ñÑ+6™DâÙo-ýØ'mÊAÏÁ ’BŸW+WŸ¾¾À3 fê1•H$+ ‰€ÛV4¤-‚¢‘R ‘p¿uRqe¾å–çš{F#IÊAñ^ú.»Iðe"è/óÐ_›ÚßÕ DCÂ\‰D‘Dñ‰Î]FžJt°$’”ÓA&ÓY àÓQïM̨ùU¶®uÄp¢LÜ ÅÔH&{,à[‚ZPÚ´H JkYìêE*k÷Á«Ë4®M&úzÑÇ_)ÅRÈ%è·Î®~¯8Ì'3LáHÈ’wÿèN›í¿+g$5,#ƒÌŸV/ˆÆ©Dܨ ª‘ch¬]²Yú;á«$ Ž¨š@2#˜–þJå&½Á¼Òö+T‹a«¿a^-ƒ7¼ ¼¯Bß÷ð¹êeÍä.+<6EV‡å)&©Eƒ’_*SOCŒ ÕÚ ülÀ16-d釢1öê†ë5¶²´ÓÔdnqÄ’M?õ¾[M6à*ThÓÅÅ6N£‰äáYf~_F„BáDÛkS:/,M– †`Bc· ¥2‚`×Ã<"™áà‰Ðæ ǘ •D$ÑšnÑèNÀ»NHeY4ßZA²rAhó‚jÌé™[Q jVDð§eÑ»c»èÁY‰áoËâ_]qYèýfŸ`Ž9ú¸ããŒèÛCOy°y;¡¤'»X‡_y#/+R±¼¼Œòe‡EpÁôÙ¾ÊlÇ^q\"FØxã0Å= ”ÊÒ =áetö ” Jú‘±™\; ,#"\˜Lw§P¹ÑËpÀÍ<,3«YVD\hAÁ´ÍÊÓ²ÜÃ!šô Å¿S$äa^´}ä¡ï£M­)Œ3¶l^‘…/M°¨¤1˜6Mì„W r .‹¥Šv¿ºJ²ö\A T(ú•”Ó®Š Ž}šø5 YOcj3>ÚMx¾}ß+0¼Y#©—5\(B(GfiŽ¿ŸG~†zàgb´,¯ÃîÃ×çžÁ´®Úítûmkœ¯ ¾xúºÔþ,ÌÛÙÎÎ)ùäC4¤36Î~+¢ö°-{Ï’ºaåP¥âikcmÁ¯‡jˆpø`t ½£ËþÓÑbƒì^· Ùåk#p:p¾\M={vr¯wÜ9\Þmj"Á馗_‡ç×£ ÔÓÆ°œƒ¥*šÞ¸K/û.¤M91ožö°;Ò¤xôh0# 5K D›±ïnúm(œ½)îÁ…Õ2ÝF•6C"­ÏÖDÓC³µÄ«+YnvN.¾—+d”HÙáø´y¢0%ÔÆÖaOv1rmÂבß2!AL˜übi¿uBÛûÚÏÿåÿÛÿO<Ñ¢ç´27ñ 2®¿u0úî žVÝ$Eh³£ø½æh®ôØ“ ®}œ'¿ÌÊ ©r¨­·s(»”hRX¡!nm6‘?/®FK*ìfQ‰½³+mè†î%…‰ûºÍ*m 5÷YÏ9f¾ù½C$×XmÈØm…YÛí÷œë6J´Ù@x7§õÑÁ·×I6[´•à×G§½ÜÞ–)N÷Žlɸ;ðøxœ@`wlÎ-ÑgÓ’&‘¬%KnÎãK«áˆúy8F-raùC¦uÌ£öWç6¾»³!¸’&°³H»º‚Võ•ñ£ûÂììì·Å|œeåPÍ]7ÏÀ}ËãŽvÞhõxšìqjk+~8*¤÷¿LeÅ×­ ´Ùyç³öÌZ¢m8ùIô‹®¬ ØÌygWo_KÝKk[.Öå"t1!Ø”k½ýUS[ÿ„x®ã&GÓÐÖ×ÛîÀ‹8²K ÚøåôôÖY“ï4Ì*ƒÒÁ÷GðÄmC£ ´×™HÈ~P×ÙÑzz» ûuè¦6Ã&¢±t|¤;Þã¦E¹ÌÔ^Ö#r¯T|Šæ™*· ÎßqïU×Q3¼J›t;½¨3-jm©ø@°uÌ1WN´“­4*)!PXC¡øW¿8¡D³%mfˆFÚPwâvsáM?ÜêUhƒ1™Õà ùm@°$Ë×Ô#¶³»»ãK5Žtµîw¢|M9öŸzF&Çû-‚‹aÕ7ÞÑ<¾´}êËÓsçX­ñ•,ƒïŸ–›Áÿò_ÀÿãÿÙàǵ\ÚjE L¹ð¢è`ÜÃyÅEˆ6Qw46(èïpEÖÔ'e;àxZO¡‘6Û¯½×ÔÚ€3 ad €i³Ñf …2õ3+f‘UhsÐÎ îÑ šaÒ¨ÍSËèã?6z.‹à¬7ÕàÔ‡%èieÚ°6ê­V©VÚ@ |’Š¥º4·uvu´ú›3Ó6B¯gÚ2ù>¯[ú&Ƈ{3í¿ƒ.¥lóJ¹(Ãè`)•ì¶(]5%º+/±‚e ©.@çž+«›œšÌ䱬}o}êž 6cdWv#6/.þRUOOOÓûGFúÄþ% 8t‡¬G¹SÓÞÓù9Ö…CfX!M¬+:v°¤ú Á:§tE´+O0mbµi÷Gý‚´Y‰dý=ûMjeœ…1B›ÄntÁcÔcwÉçtª]V©„ïHgÖCjÀ\;Ï|µ +‡ü÷мû*W÷Y<1jÂmÅû‰¾©2ïŸx¬üy•¦ #óöGôÙþ÷ùl³¥ hy}c›ƒ)ŽÆpö 9Zô­ÈX¼áæM›å²i“> ‡Ah3@Ú˜]£ž!õçˆ^) ¨Pœ9´²^¸Óª>±{[Ö½–ÇG´aÒ(£UÑÙM¬¯ÛÐv@Uü]AÍ7[M·aQU‚ÒÇrF¿G·ÁÅÙI¸‘Xô$ìâ ;ýú4O¾¹qünHgÀÜ-DžÊs7N®˜µyø®ªñ0/üÓÿ «:•ßEc­‡â‚HX#¶¹}\Ú‘þ”66ª¹n#‰álHz0¥\õ¡/îa†f@]&D›Opüþvzøè§H;½°¡ìèë6´HîKÂùØì‡]K¿„nÓ^YlÅ¢8{m r3£ÙŸ€ó?Ê›qòQ'zC[‰—‰ï5´t71¸ÿeœ®ÁSœ—Õr2†5èAÀj^NwƒGÀ¿ÿWøºDÃCëãێ<ÊM Å‘ì$`Ê:º N~¼J1ñØçkvâZýÕ¨Û„kÑmØRRNA$‡R°ö­¦Qy|d´äÊv®sJ¹²nsë°¿å–ðåO`¹™B6掊~606ýÛrÞ¿„n3ÝõÊÓ’*pó ò¶61Ý[Ó&ƒþ½Aü>ÆÈòšýû “Ž¢ cP (cûÚ.ºon+z¢žEªÑ×Ý?bãŠF§&ÖÒ&V“º«o{XQ i1©¹¯›Ç¡+¹^vaWßÉ]±Í†$‹éu3ã7Ôm&œ õ® È2³·Ð]¦Û±ßüŠ¶­8&.ºjA~k=ƒûcmˆ¦}RY9ÅnsÊ,ÒH›—ÇbÌwQk¿ÎÔ Ï»ÐKÃ7fÊUv¸ãË(Ü„d~pò&‚]ëøm®&Û¹l?®Lp蟦QGÃ~ˆ6p—=eJ"÷–áyñÐÏŸUhóý6m —Ì~¼‚¡ytuTÿ\¿ ¸àCúûñ*¨n£¬Ò¦L6П» ¾>¹¿”¤¹Å\T)+´·í`D>(¯€¶82ÿûÿ òÜÀ÷ÝÊ[4=Ü2ç ì·¹)tËŽdڛɕ­~HYueá.WKFëéxÆÛ‰oê6ßôÛÀñyœhÍô-Ti}”Ì÷²ˆ”ºÙEK*J›Q‚qðžø=2‰µaÑ.}ü1ÚÀªÝh=…Ènž›þ¹~PœÀÚ|¹ýRwÀ“§ M¥,·å´^Óp7ÛbkòBç}†M‚PQ‹¢h[µi¡MŠmäâƒ%gÒh|ÓÌÊ©mö~ß *##Šå7ió›ùmÒœ1»Î6¢VÕ^sÖU6àÇ#vtï èç¹÷Ç7“}ᢘk7ÆQö¿‘UµžìŒâ•ªÔsO„T"aí…ͯqôñŽ;Üyˆ6®l¯ƒ%èU'=Ì\Ž(÷Gé¡GžCu"škÍàÓ}X;ˆWÚǤ@aÇs†|òMUˆKŒðVÍ0µ´:›ír奔ÀQU£Í”öîL»nƒÔDƒ[$ÕÊY®ÛpF¥Zgeh§Í°­¾QbtIg»¹4ší±&m´c6÷ŒÈ ÙëE+î]wÔ°í Ì™?ÿ L·¥š9HT¡}j{yÖÔyúø”¸Ùü Œ6¥ÙÖ^rÚ챰΃u›#:Û4"j§§€mfå)„gnLy[R,ì}£ü¶F¦aÉ2KêVŸ}{m´ãlÍI,ŽjY[|XXµ¤);Y÷Ëè6ª¡êÄM`­ãDý6*®T5ÇËúÃòN”¢7ÚÊË-)•;~x.1 ð˜" ýö\J-“5¹ô=s‰|›H_Tü©Xç„s~ö\VY¸èø·Ó±&Éë'ð;¦jkðo+JT[Þ|UÖ¹¨)’Z~Z jðÖ¯)Áš»ì·ßT#ÜuP±¦€úó«ÕLûLcP™ .h4¢ð…ÚcþÍúÿSD]YC›Ÿ$j´Ñ"â›G­üƒÒüÐO¿EÄâ~.4ºÿr±éûXVòiü—à]‚àÈ;άyEsTšnï¶ð=þØä¾þK4¿±Ïj¯F›XýÓ—Ölë_7“Çôi ½ÂŠÁïêtÿQK‰DÓT*M]¨$ì–xÞZ³™ïzæ~Áð{é/ß®?gˆkJ‘Bjýc#V°ÇCâ”ÔkÇ‘(χ}»ûÇÂÿt¿À”B à öIýóRø§.XàÇ"®]b÷{NàïU·ùCÂá·Ô_€ßw þ¬U™]:щNtò/#’ñ/7JnßAäîݻ臒æ°·©úá¶LîW÷üqeë*°%÷ïÝ_\§š®•V¾—û_ß|ÚòÍ;G;ënß•%üîýGõãët1€š+M':щYé«ÜŸ˜””¼ww•ÁJH‚eﾜ)|T°‡mëvè`fFFfFúþA[0›ˆU½ ¨ö÷îjÊ&CŠ_Èö„„øðoc=£¼GÍ«š! 9•žšš´ƒdHmXT¨s¢½¦;Sê¥æÕ½>=8L¦Ó^)šlq"kgžZ<Ó<js6©xwTxÇÄ2ØœÿwvÌ÷´öé§!¥îÚä}I:ÃÂ.+JxÆžˆ0&Ápÿ݆uîá2úu5I':ùn™í~Cáð”×Ï?*ˆ±ÛqPÙò;êÌM‚', V]2$[¢kTÑÎ]ü¥˜¬ox£UÍÃÞÈÜLBi]]þDfYŒ?ßq(Èïûtÿ g2ƒÂhš“M‰û^ÚÀÀ@ÿòŠT™6át_߀‰Òâìd_oÿÀТHæ%Ci³43Ú?¶ê_Í÷ Ϫ´±ðŠQ¤màBð^š\£“NŽ÷AïC÷î™~ofÀ«é*‘Ntò‹ÑæU’'-ò2ôál8Õgï}5ש¯øSª¡®Ò’·Ç¼åPµ¤£zå°íøÀý( 7Y“øýºˆË¦|Z\¥xÌ‹ˆMz>“Yd"%*9k§Ÿ3ÑÔyBY·i=¥‡÷›‘ÑC’/À†?5Ò‘Ú,/jøUôó[¦™UfvöV+SC^4”²§g÷±œÌ“ç>Lê*‘Ntò3h‘¥ø*ÿÀgáN=oAa}cÊ˵% SÈÞû´ÐÞ²ÃCG—[åo± )®•[RYö~Ç@é²väÃØO±¤Th]H…žoF D áY‹luHÙG—]÷´>lçž®€ #éÄS¹ÓR@6TS³à HxS×]ÈàBã}¦«bN©§ ó\e'¸XMÔ³AÝ‘Ntò3h³‡D!c±8HðD*ÉdKY]/ò³0‚¶1µbA-„ú‹©d/Í´žê¬<Ƕ—Ï2)Âa<§”ibì%ÌXüÚl2ßw2ÎÚgŸl•=(nàIY¹9°ä&ìôã9oWöۼδÚ/Kï©:fêrTõòB´á¹GLŽ@ÒÛVŸìmÎ Ì“ÂKNrL½¢äpû¼/TBmt¢üÝF¶¢˜úÀ ²Û§ÑeGà™0òÖ„Gj½ùÅýÞ±'V½*ðM Kê¨gdˆE‡%0׫‡•hß^¼ÃÜ:ùÉÈ­äŸJ¬±¡ßŽ]ÆdA—l‰ÖG&ŽúôCc=*Ÿ?7}mW¦ (üHÛ̃n>áŒ?Õ.UÓJ–”ü²Ô×DÿjõÜÇ[‡Í|v+t¹3~v.g^éh£ü’~t7Ñ}vtÏ#¨¸çÕYCº5²¼ZΕñ7\#ƒ¢Æ%éT«9ßi}jâ&n£e?JzžàlÇ”^÷:ݽ³PY·AÞ2aEÃ_>ÍŽú‰–†À«“á,·=È  ãC"Ù¤ÌÅiÄR“:ÁI(¸Kæ8®Í %¿ :yQêÅÖ¿ðj|¢ºØÐÜG‘ä ;“œ§_ÁÅwD=þ®éD'¿md¼YpäàsŸ¶£Jo6 §;]|ãú™£H†Ø䢷¨Ï¤ÀÏ„æ}íúÕs²Wö3èÒýcA¡J@Á-½el¢Ô.(ѹÜu+G$YD篡CtÆí›7drû¾Xã%âìHAùp4fl£;oø¢òEÙ 7¶ñ½Ê´7Õyu·Ûÿh­¿¢ G°åþ=dêÑõËq¾<² j¾k>Þîrömõ»Ç÷á8ðÂti«éFü‘›Oª»uµH':ùYkIÜŸ¾¢D›ú§EÙ…¥ ’i4üülT\Á¼¼s_ì©-ÈNKLLÌÊ;ß1-Û´ýéþÅcÐõ3·ªPþ&EÞú´¨6îZ^ü7½u¥GN>V¼ú[˜˜qõ‰Zôîæg'&%%*dÿÁp%-5±gj쵿íД0.‚Ó›*JRâR2_EC^h8›ûJ¾,¼—·‰»º×8wÛßßMHJJ@%1¥ðÖK@¾´JKiaÞÞ½{Ÿº¦˜‘Øðä\||Âý¯KºZ¤èDÅCþm.Iãø¥èrC':Ñɯ(S¯üÌð$«·Ó¿‹£*u¢ü±uÔ¡F':щNt¢“?bG¯á¢µ›=jzNqð=aj}ýúj†êŽÀ:¿~*¥M¿¡óü íGå½k"|+±ß™¿EÑ•5Û¶®·™çOLð³ó^'¿_yrr–xü£HQ¾íÇüXIסWc°¶qï4?6Û¶ ÃÒ¶ShïU›¿Ø\ýžê2ø®Ãu‚k×ôc2Kg0aèñì|ž É÷ÁΊBW¹žcˆ£r‚wÖX'GË÷ãÝ-`¢åÎsÏ”«q‰7‰›ž¥;“æJ!Ì­øLÆÄÚõÆW•M2ó\0†V¯ü9ë>\Šã…Ë·RÖô,fAПù7¾jÝýô|¤ј–ù‹#v/ü&›¤à\õÅKO¿h½aèù_Œí„k.ŸØE;ZÎwÿé? †ÅšrIq“e–ZȇmãÒŸ¢óš¶û¾q“ÒuŽ>ö£´‰ L¼zÚé“[楂6Åñ§Äj43oäí¥Q(dÞ{W\ìJ» 7”¤âXžs«YÝWì¸É©™ŒrèßÌ’JOîõÞânF'Å{¨Ô¥JÓQñjùÍw¿#°-ÑÊjÇ ;_µ 4¸RöÕ¶HÕä9ZízŒ^[‡6göx{¥\^SÝdŸž qŽ¸$|A£ÚÂçeh¨AÒgƳî™ošãõ¥$ äì!`*aßY²ö6σýþBâ«ÝŸîÅeR(¦–V~©Ï((m M}‰õÐX¦&LºÏžÜ9(BàÙɆ»Lþêvù(I7äV”í´Ûä‹^'›ùX3¹ææd2ïØ=„ Àôñ=Û(t–™ ÓÔ)¸n\Ôu6ŠÊ ›py>‰ðSÏÎØ0H&\.Ä=r·~døåfšÛ«ë©æ\6Vy°-"mæ{ÿ®‡YÀ宽[mèlS6â”2%¡M峋Î|3¢¡ž ]%?ßñ|›€…ÄÊôð²nb~ Ú›Odóî·vnV¢ $•ñ6gÅßy Ò¦:‚œ¨LSÃsgÖ ]ÿ\êØãÃg@Q¢‘Cö!'©ˆú«BLMxægÿE¤zL5üÅýîB‰Lº— Øäºz®ëe_CËð¡ZegÓ9L&Ï”Ås|ÛŸƒ ˆf _]ÚGÁ–]úr%ùÏÜL¾‡6[c¯H§ÛhDZ뢊ns{¿™O:¼X{úM É$ U$ò#­ÜçaÚ@õg¼î2ÕÔ¡oA¥ ¸åMô¹ ï<‰Ñ3ºT·€Ö3"=½"]G·Q>Ôïå¹(&-Áe{¦Qù—¹oí<ínL¼%_ ±mJXçÏ«>tõªö}ÞXƒ¢>¨ù.:Ò¨¥}‹µ²Ón¬ŠÅo9&P:daD­\T?²dyz¸êÃç5ý©ØgP2 p¥Ðmö¸›î(xŽÞsÖŸa¶ë©¨!ÓØþ2µ¹ÊÜÑÝÆÆ~|ejæ=³+“ï¿Àw/´3õH×ÛÐËúm(zåmK·Ó¶&¢¡MUæxí+ƒÕ†pAfñG¤)ŽxÙ{¾”é— &›kgaÚáü£gmÏØ°q÷ÆWi³Ð‡§pFW€ò( »<™Ñýê|tÂù„64«²Í:",ôSo ‚ÂASba#:rÌ…¾ùÆ'ø}2¡tÈ–«l·51´9¬¦i¸³èχae2Ýß"àà=ô§«a&Ì°Rm.¿Ça¦Ž'ëd•üÔ®ý—›AñŒµ11ÿŠ½Y?Ž^þ« p¾ÕKÞ–nJÐÆ5$|žE{»6ÈÈn‘‚󵇉LO4WºŸÅYù#Ø<ƒFsH–ML]í®ªkÑÁäûhwômýðöY+h#É·§úßïWÑgÛ1d³þ¡ ݬ{^¢ÖâViÓqj)Ýv ŽȬ¡VÚ0©dž…%,V–42ÎÌÆóý<ð¤5Å ªGô 'Êt³ÉB±ÍÌ:´A6¶™>Ÿëêì`Ê¢²o×ö¡¬x’‡u-½ì)ÜBò¾ª¬7O´<8:AbJ£[ œœl¶$ ׋“4—¯ýFø}E1ç‡3¸6ËrÚŒØ`7WŒÈb0öõ:ƒã,ƹxö€ì-Ù’s7[@o‚4‹ÉÝW¨¤ˆu¿¾HxLOŽ!2y`‹ÝÞâwsÕ—1dˇucS«ˆe†Ú¦]y'?ä[ØÛÑúöMå›êJª^Y»¢Í&c+Åæ„œù¡×k×Ò¦åD€‘‰M[ßÔ¬ˆnS;!Dc,Ætωc ÷¨<›ñq$RãSGÃ<"N@ÄFQ7¨G–ÇàØ°MVªìJE®,úãH™œpÂn„k"ûùþû4ªÍ¢D3nšó|1Ü ºö¾©9Y”æ*iLVÿ°ìí—RB¶&‚‹­F8“6¹ŽãÍ=zÞ·¤£âŒ‰ÓvèÝÇn…µ“Hœg§š­6’^.´RW5¶¤Ûiä‡h€¡›~¡~¢ë„mVv±iûÞŒª 5̵cñM!²àM‰µÓ†)3„£m:—ÖÓmdÆÉDÞФzQqààlŠ»];ªÉ@^}¯x°ðQxcø ¢/¼PñoeòsjÖšìÃo ˜$lý°éèÍLÌ,<Üq³§’p]3µ£Ù`[ÌõzHø=ƒ.7·a·^~6-=|Ý<Ú ÁéîrÛT €~|úë.ñ©h‡UÂ×ç|cžÎ”XeÔ+‡Õø8ŸÌ`ò䧚››Ÿƒscº³ÒßٜâVŸÇ„J´ hoˆµ N{òâÕ»š*˜60m6’\–äy}ÎÏÖélÕZÚÀî¯g¬ÍXt Û&|TnI5ɽÄy1fmú>\¢(g ÅÊ/÷)7}ÌÙ^YY.¿Ý·IÕ’R¢M'w3öÍŒ,C–ÆÞBêÓœXë_Óãó|3&lb9.§»Jitúêæ枉àR›!§¨Ü×bˆA°1u!€yc>Ú„Á„LMùCf&Ü‹½2Ú4ýt¸Ž62Ú@Y8x‹Š3«>®JéE7šËå6™q  E"ØoC4íÏöYãÜŽITqó£´Aý6ðso.Ƙº„)n;èeÇÞyE.’Ùlǘ¥~ >`j½,¿éò.oó„ËJRñV&#ö%de¬¼(>Û0©@üߌv¿yœ{EÜÀþ,¥2‘ÄZšìyܶVc9éÊzþ-¿Ìöw5¹7ñ£´™´'l*—wå# ˜¨eWí³KyÖÎaCzþHm‰ÿ‰c6ä²Q•V7ð¶˜"ðÒèÌD]Ìã•H„­‹J´é©¾Ì´Vœ9;& lFi£¬Û$Ù[î¾óI#mà-;æçà{H­="´©j~LáÙ®I¸p}sRÍ ‘îS[7kÕmf݉nuÊt¸¹ÎbÈšY’|ÃY ý{ç°kбå‘*“½¸¢Zó­ Ú ñäÐZ¦[ˆÆ6È–ŽÒK[˜îWZÔÇAt´ùy–Z.'} .‡ÉO+QöÛ,5åQÈæhuΠᆤ?D½ÄˆÙ"ÝjÅŠ»ùüÅh#ÛE8lx®C¦ƒˆ:lhX—éè ýÕÅ\&%éqJJ–û˜Æ¬f‰¼R̾1Á`“®¼G¼–äAÂs&–á· °\#†ä£%o £IrïXz Ô<º@¥¼O5&…Ì««ËÒcâ“®U'ÓÜ`sÞ™ƒâËÃËçʃY Áìéî5þ˱®;*¾ƒ6à?ŸÌ[èXM‚Þ%ÿ “˦>al—L$™_¨,S¦É"â1¬ýð‚GQo3îðtÓ2±¯ënýLiÎŽ­û®È^ö>OÙ)7Ãì÷ž‡#3R_J2³GÍ tçÐ1÷šDàÈKC Î']à?bI7®hŸ]C0ÆÞ*ëIú쳂mšhS®ŒYàSŸ¡§¶á.¬ °—©<ÇÁÒ% ½èjÆDý6Óò ï ù-vc2Š;ááºcNnû. w¦ ȶٟ´A&ÊÚ"çeúõA®¯køYP:ïŒ#í¹+‹ç>ÎÁ[í*´AäH„u`PŒ]Œx¢Žs"·IÇlC Ñ"`T×mf{ï<{¯ƒÉ7åQ~„ËŽsJ:À0¤ÏN(BƤȎò1©O Ø$<Ƙ°;§>›}¶õ¯›³2áÑðÏ,½ ŵãÊcR‘1©¶£ÿŸa œ6Ã6·©Òf êê&¦-2hS¦ÿŸÄ¥¡Ö‰æ» HMòce–g†ÎgD‘õõõ ­<¶W!¾PµóÃϸ`ÂJ§V[ïPSJ¨‹‘¾ž¡qûþ3ƒ³ò1eÉbùÕ#–L"Æ‹1&Ä釚ݲáO'_Œ¬ÚkH;åþv§nLË0´<Õ×6y2¬ù°±Q·dzàÈG ÅzT7éuQßÌcMQ̺þí]áøf}L':&%ž>“H%“(4΋/d+íÁéï!Ç¡&þ•h–€v9êo“sq¸i§‡‰L!1ÌÏ?m€ó]û7¬cWÍU+6kL>ö MIÞB`v8ßû7dLJ:Û›ìD"‰dʶøã“"x¾¡¡áçIY{<¼¼#Ö –'Úb}øP¬ˆ4î‰ÒZ)’ éòä¡0G#ÑÜ%´÷CúŸÈ{¡”v”5* 4ÅÙ§?…t‘KéáT‰Be%žy,ÖnÉJfºH$¥€ÄSSH-\âhO"“‰vvq%œŸs_þ¼2¬¤ÿM”þó_þšõvQan·¼¼ÄgA!Ì]Ã?öÍÁw‰çŒ ÔMȬé/WR ìwê`òÍI ÚZÐúÓ9”ç«= h BãäR@»fÍ\”µsEÖNo˜üz‹ÂõQL,4 \i›¡étu໎õT9^%EUçCl¶_Vþ"Üíè©-å+çÛš ‡Ty»æóè×dÈz³µµÕ™oÎ%V›XhŸ4./\¹ºé ~cJ9 =–k_¤}¾†4€æW¬©ÌÈü³íþÑ:žüK¡ê»òýMô€ÿøósAÉÈ{öx¬mJâñö›ÏÚuÃëËòpã½Êîoå¤Vu}xÿaÔˆ$¿]ö ûj½ï×è¿oÀ¥Œ”„Éeé?<2ÎxðyFwŒæ¯-+í×Ðc•%9yZ$ÕeŽNt¢ü«jÒ©±‘Á¡” ‰Hÿœš[R_E8:2´$?§ò{ºx©pr`töç¥F³›eyntdr øÕóò;œÿ gu²ƒÅÀw²ø:ÖØéäÏLÎÛ8Λ)uî}<çb½»øešèz-´á€Åƒ®éŸÞBE4ÖùŒZø¿AõB^!å1ü`euÏAmùž§ÅÁm“Ò©ÁÙZœŒptÞ‚R2öð6\DvÐ_ýDe0gň™#îõ² 3˜,ž•­›M§RânÈV£uM½ ˆçh´°K Ê93úå.Û< …<®cø%såø] %âËfÀ)æNçdSḇ&ÁΪ“Õåx³"Œ‘²\Z¼!íÂP-•ÉYX‘yò«¯Äc‰T¶‰™@Àg³D’ýÐ"\i¯$¹'Ÿ—§zÎB ¿Ú þAüAp"oe[¥ e*§6·? 2f¤T(mú•»?¥!Q+}‹1Mmа&RÃPÓÚÁ@¶kÌÚ‹Ò4ê‡5MCëšôïÜgFí]R ]©ì†83ÆSdýÔwïhx)>hÍ(@ËV3Ê9ó)B¨§àƒDs´ŒÜÁ'ü° œÔ†õ¯[ž­îYªÌåì·T] ûd¼7²L´ ¶£¼£*\žnaÐÈ·Z&Th#]bQ=óÞ«]Mµ—s,âPdN'ô-jRÔBõ‰*_%RãcJ·ˆLH5+`Û G¿HŸ…cGBÿwVàÚÅ’iLd·@3m@pø^’¡÷í¸\I”®”B´¢ïXP¦d.€Iñ:^ €àÆõ7õ¡ÔßÙie›˜zH¤¤Ûdït£›XDí 7%’¼î€Ò 6߇´âÆâL}CêS¤¶­Œ=!·.Á´¡ÇFE›˜9ø¸ÚÙÖÏ‘îÝžGxÞ>õ@ÏŠŒO*ç¾^â1ˆ>AáÞ6éÚ¿JœHÿ-—à¹ý‹/£6ZÃg»<.ˆ¡³Ø¡;v8˜­íwÁsºÂ–N´ó ÚbG¤[#g}ƒÂºS<Á;$Ò‰Çáù$@!ÔœÚC§Ò‚bâ ?©Ì©9iËÝþº!Õ×™jf·cG(—IN¾¤-[*r¬¸Ûòxî¹ÙiL+÷)<•ôj×=ò$‘fZ÷h^†¥ãÎÈ 6™²çÔèJsa"‹A÷‹Š9]Ù t>àÒɶÞaÁ^öL ‡¯B­l›±É>õ/{38ê‰as±Ê–mN|º…ƒ›5‹Ærm„&ÍáýÍþx§z+˜i·1e±P^q-‚Pµîrª7ƒÅŽÜÁ#’ì".Á »ñàfûôX?—CyùŽ Gïý Ü¿ËLäEïIh‡ÂŸi±ç0Mœ¶ڳͬZ¦a¥‡2Âwf üö=˜€§›•ô |‰x“q‰µó`ý?=/ðÌÀ×=SKÀtçëÏðh}zÃÒ,L{;.ë¼ÖÐ×f8©šf³S3¨á §0Q@³K}²¶Ñ‰Ç_Tµ@ðêù d:±Øÿï™ÏU,qÑ»$}Û„°-.Y¹9Þ|Š[ ì\ÔÅÚÓ&¼½§—Aò…Ë¡R_Jèus¶™Ë>xÉçý#a &”;X8Ê–Œ—È‹gì ÿtù¼ì«µ~ÍR߇úxIGë…ÏŒb”6Ι­Wüiv™bäEi³Ãƒx±TÞÐXž[„g±!´9…½Ï–êx ü„4¡ %‡Õt›Ù§)zìt{)`¦…Hd4 A?3fy ;X§­(˜àZe_ÖN —(Ùi_Mùv”Àcõ]fPTBe·´º+‡<Ç'ìõi 8Z±Ÿl†LÏÔ@›)îøm…Úª&D›-©§CÌ-=hÒKÕôUX‡š™[P‡’|<`¤Gz‡æÅb7 ÇøˆÔ>7.ñF-RÃVzø8ÚË9p¼<˜J2CJtùó%}ê–QÙª­a6ÜÏâ“N Wp)} ˆwæå(JsÇt(ÓÝè”3Gµè6"w†Þ­Oš74€hãqúDï•þF&õo*Ÿn²L^¥Í”øj¤‡cÎ}yb…ádBꧥºö~EõP^ù0lÛ¾>µðrCá>‚Ë/b ýؽ/hLu> ³ùbmàÓ$ѳk;nÇaèöiÇÎ×´ ­5nä´Ïï°ìü_¼Õ>"_½ûñlj?˜ÿ²¶UV‘æj™Rш”å&„RA`Ö†D{;­Þ$e´W‚Ì®AÑ—n?®gbTØYÝ—u7ÏÀ¨z¼‘aí—P†Lˆ“¶ãl»Õ*Ï¢iOCÃSÝÈ{ý¼~jØÖPïɨ,u‹ÃÏhTÞüÊ·hcs¬ påùr\³=¨"ó8½cm*3èeEZÅÈã¶gJ~9 ¶æl¤ïB&p±Ç˜hÒŧ¯‡B4Öoœ^Ô¹2YnÞ˧q¡ÊŠ4M:_‡æÃxyÙù,ܘ§Ê°ÎëÕ)„6H»ßiEK|Ю‘6¯â](Û‹´Ó&œˆÇÈãb§ßÏýXÃh#O5¬ ï cS>‰@i+‹k_P±&ʃÉÖ9hP~d7ÓkÇSYf”z1è™ïGÖqã8á-¦ä´Å×$Áà²FÚ,¸P7—6/iLÏ•ä"––gŠ!œ­™ÿãáf mVN»yŸPœ('Šgã"*çÁ±›8~68õî{{M˜Î t’JgÍ#»DFxRO=éE3g¦çÍ]K´9 |~UpäÀ“læY7,VÆ‚6Ô¿¸“•kÍÆÙ&-"‡êÍö7^(8äi­olVÒ0¿2óšAaÊÍ;†H~þñó7‚ÒõhƒtKâçw.%ï §c3´VõÊÍÎrù·+Ìæ×3mø镨¥½Ï‚õ¸KÑ䃛3›•iÓÍÛŒy=-ós Ç«è4Ú¬ø[´‰æÆFÕ!ñNeŸl–õi3åf`t®Tv-—ìwL:«hp™|ú¶}0mX±²|AhÓ¯B›QG#LXfš™ÇòòòŸÀ¬“”‹ èCãO„6àÔKš1§C¤6ã·#6Q#–TÝ‚ŠÅÂìcafN~.2Æ3>NÿH݆iÃM‘«;˱LãÝÕBpåCé‚Ê;FC´!¹¢wÞÍŒ4u 8‘V­¼ã'N”¶Îh5ZOa=eG»Êi‡™jå“]>]~l­%å/ æÝÿª±d¯$;ÄÖÝxÝec<óÓ øG×mDïúQv\åƒtÚK¹ïŶ" 0îäîŽ> o\çD+oE·JG»ƒ/fêÕwhŽÖgr¶JÖê6€tz\±¼¿%8óºrÁÉi#[­[Þ ÚŶÙÅ©‘eùæ·í÷›ñ£€åA•Ð7/E|âed^ÓæL•Ö)£ÍÊâà¸bÄ­Çd#ùͲ6ÚØ[º¤Ér`ñ%y#»P¢ ”m7㦽–Ý î`m¢<Ÿ“ÑYª,ÚÊÜÛøH$fò¨4¡ôûiÜñ§ñsêÑê<ÞñùYM“6—ïAëÍ‘wÆЫï^¼éšüzqÁGy@äJ£ŸišZ‡6ˆú$XlL}6+}Eˆlz¦6.“šV ¨Ó ­$~‹ åF¢½Á/qŸ YÿØ“.¥D‰vñ0†ÕƤêφaInc¢õºzM^b˜6zF.c²¬˜‘®@ï±¢Ö­ Ó?j•~™CisA*3$SˆÞ)ŠXÍNÎi ^˜íœx«F•6èÝÝV8ã¢3Ù4ÿd5Ú<Ø`l·kN)Ú“ Ez$ßi©Ê˜ÔÇS!X²û„ø¥à¨ÓfrÕ™cŒ/VuŽŽŽV§Ñ¬½ÐRHô䛲×ë—§ÂøÛBJe+1#¼8t«àú¾‘ÑáΞ¡ï)Ø­*£è3cµ¬ct|v.˜ŽO(y?84<44åÁɸöªeÇöÕÎ*ùmÚM7⯾ïîm«c“h5“+9~|ïýW ‡‡‡.§:;G^ƒÊ)ÝÓJq`xdx 5ÔÊ(æâx‘/|ümûÀԆćw”· ´‘Ž=Æ꙽ké…BéxW„%ÚjÕmè\AYC÷èÈð©`+V8ìOV¢ d<=gbðOz¡,*É çøÆ£c–¾,ZÖãúÁ ÑÝìíf>{GG‡û¾úÓŒwÞÁï§ (*¥áˆ ƒArFñgèÎW'ÓÎW©ë-å9ŽmKOoÇ'ò¬m”¶ pƹå­PÜ꟧šÚΊ°EmÆn“ ùõ=s"°îîAš¹K[ÿÐð`ßÕh JÀe­´Y|MÙÈ~Õ=2-?ÊÛµvXG·Aö¡ñ1%5Ú@?4^O#í:v«­££¥á]ˆ…‘•C4ŠemÐ&Ä—sÍëxM%×'¿hªé6x +ùÔãÑѱšûyŽ#Ú½ä;ZFåõ 5<>i@u™•iº90©·ê†GFÚëŸb°”VØg.<“™\;¨®6ûX“^vQ¬Ò åÓù8<™d¢¦ÛÀ+Œ÷¸qÈ<×òÍíÏ®dbHœ õSÊ#àèØâaoK¼{ö2ðÇñ7Þ;îº Þ¼XY°µá·M/#æPÛÞ@wž¹Uxêi™¢€=—w±˜ýˆA2Ùú‚gåض"oÜ6óÒº¡ãÑ>< ë„“èÚdÐÏÍ⢂>=±ÓÜœ_P Ù¡â‚侕¥¥ûùgèž!+GœXQ·FàJù6‰ágµd²m_ès ;ÏÐ]2ý£ôdŠßÂÂÚ.íücE§pÿd²­•¹µã–Ûï{ИŒU·á[E]i„:ÊPSÃó5p×]ÉÇ%¾Þý±åi¨§½…¹¹gè¾Öí~›ãÛ˜Š§{¡˜úìÊ]@já½£;s«ú…tøÃ/ž9?ÞJÔ\Ýß"äÏÚÞ³èM¿vSX|³ésút&Å)íRƒ¢ÿv<ós²5·v.¬@7Ø‘žõ¤{œíYë,x{ÅÅÚÒÊÁ§¼sA–3K©Û½Í-,ãrd'¶Ÿ¢ öËšÊR¿©¹Úníp33³­‚Ñ~¸áignie½ÿÌÙBïx‡C×e`&+v[n»‚"¤(-ÐŒÇ/iYÈqfE” ¯IØ”/Óú‹tUë~t؄ùŽ˜žÂñF¾5À‘,ë9dee%pñ»ò¢U‘Qwröd^RÖ[|]¡gßh¯ÈâÝ<£#¯æÕh³Áü`ßç;Î|ž[HÓüê §m,Ì]öv!”ÉWÑפŠÒÜé Õ@×ÀØÎ%4¦sAÔÛÍjÚpŸÇwJ®|ô|(tõËU.šýÛ,càÝ3Gê­líÑ­uÐ6>¾àã"à[Û„íËQ¨ò%Y»ƒ)¥ðr¶ ?_ êäw/—bžMjUC×™ûm¢_þ¦Cƒß!#u2WtŪMîfEÞU·¤6òèrF'¿,Ì/¬ß‡êoŸ9»F®?{{Úþ—¦ ª8szíÛÎ-ˆ¿wñ xqN€º…ÆZ‡Ö·Ž6:ùÕÏÉîö5ÒÖ5¸8ÕÛ34ÿ +0‹CmmkßÖþGZó{`i´µkT—:щNtò/Ý(í_¶vÄOyp½ã¿¿c;8År•o­úYç-ŠTî´ß¬%bêã¸Ïêþþ#âý¿ã:ðÛ%acåu*ƒNþÙëXÕ¸iñ$,7bþ»þ‹%å»–ìôÿǵØ-¿<Õ–¾Ó‡€'PÈ$#<3æà¥YéêþœRñ$Þh³¡çùµ^ù„ŽÌ­²ÓÊê‹<Œp,>ßzR(%#‡£¶`1X,žšz¾LC$—'òöcŒŒ£_CF6¶ ÌØtœsÈÄ?2éÌ¡1YuýBéT{r¸›‘¡ÆÀhÛÞÜ9UJ^ÚÎÅϾ›TÔëå÷¹†žàäëÿçÏ !Fàõs>Ï´vÁF}N.WFýOfÚÏ,Ž‰×?Kà§ËËåß¹¼ºÔã¿2ýúu\î®þЂLÓüüÿþ«q0ß÷oÙ4ˆ,IXêxS×9®k­©ŸWNIrÔ;} #ÅÛ­=ZG¹Rë¤Eïâ7[ekè‹5®ÎÖ¼’¥ÍRÏ5ŠùdœèkmšËÁrׇâzNmøg¤ùÇr·âk(ßøé Wþ»ž9¤ÛÜÝaW5±¼ð:#ô|^[Ï“Sc¹ª'Fºtýp‡%2mnÕ«¡´E3güIx‘@Û“ÿõOwTúÙ™ˆDº™Ã­d)§dþdB¤"IÔ¨ÃÅb, ÀSht*•þ¨Þ™ð¿®š“ï9×»ÙÛ½,5§nzòº"БG!’ü’΋PÛV8‘³Ë ‡Âä½nCÛp¢ÖÐÀ`RºâÌ!Ðh4¢1îÎ8øò°‰eBU¸ ùº­¿öž3N$’,\·×Ã@š)óû³…lmχ»Ž\ô«‰ÿgäWàSÆ¿›§5=;Å7ePȬSÏ»€5‡¥·¾öⳈ$ÝÜíU«lFâtwõ6O 8‡gŽ ¥-G¼ðd*J±‰:Î5ýE1)ÀnîšF×Oƒ Ÿoþ k'”ŒlÔlj¤MéN t?•A§šù*Ø2Täû–‡ jçkôßÒËgtmùŸD¤×CY·{†mènÃ/ú¢]·oEs©tÖõ—‹KB±DªÜ«ÌõUÒXæËl+0 …ÎkèëÆ-™[Þ—¤d–ªÐFZÏ0àôÈÑM´<¡òªŠ¢²?ɯ‘ŒxC+ki³uV .-Mt½ãÙ7{Dêê\ÓmÄ5dä|%pôíf²ƒpMo»0Ørýþ µÎÆzxÄ]€?-ôP(ŒºY‰‚67³ý<£Ðe_Ò =¥j>{‹¹ñv »…n&ÛrL Vî±´Ì{eŸ 8ç#L] ­j ¶¤®ïõsN¿†þÚÿî0Ûj¼¸žÏ"ûÊŽqÉ÷Æ»¥½¥"?:-òºÀaЃ´)¯&ƒdy¢äæmxåòô}¬¡:[þÃEW:DZ-´á’>­é8ÆêoÙ–Ðc³åá†ŽÈ ô¹*ªç ²’j©¥J´šƒâÞ~kd”ÿ ^W»L®QoÅ}“³ðjÿŽÚ,VõøŠ™©3¯È\kµ'r]ÂÑ@Bx,"–Ý»¬B›©·‰$»üU—‡¸ÍDߘL¦ùì9º²FÉŸhyÄ0÷BiÒ[昋xŠ4ÑÔì;÷"m¸Ù%³[$++RP²¤§ÒÔØàà`i0Ãö(|ÎZ ™QüÅ÷J.n :Ñg¿oF¢ä6—,ØQh¯Ñ%]S°z¶èvyãŒOðEG+ÚÕ÷²&ù¥<Ÿë´˜k¤S)Sò…ŸONÄxîVÝqâÖÐÝž£¦ÐÕÒ-EèƒWóô{òØθÎtKViƒÚURñðÐ`w#“JZ‚í ÛdúÖÒŽÄîVÛo\fIG‡‡†ÇûTH_¯e0ý÷ɇ¤++p‚Óƒm2Šª•hοރ±ÌBqìOÔ»Ò ‹«´Ùçc™[ /{}1Ìaâ÷“ rˆŒ!¡ÖãXtò{5¦”f53µÓFÑèVDÂÙéÑKfâWœë áÈ^‘1ÑÄìq´äZ+ŽÇU}‘¢ÕjÕm¾>¦™ÛÂ&owG¯$d^¾èÞÑ(,gæÒ3\I3´d´ñÙsõEœ%×dË Òæ2Û^ºR)i*V÷H^žŠ2·´‚ ¼kÒF³tó6WL«Ôpm^œÝKe™f䟽V\œîB·9Z‡XW]Iþ6<…kn›SŠØ„€øéùýT"ŽÉázm?Œ¬-U¢ &ù’ÓKºÀÉ/x&¿£%ùI³ÌŽí®ºL·ó”Œ?£Ói$¹ðX“­qÚiãb½½½œãcïá•ÂÃË2ÞõV¸J›å¯.t’¥Oìū׊®œeÈi³±S~"ážÄîZ®î vƒJÉÍùDÉ°/›ÁpÜqþrÑõ›Eæd÷àÓ‚8Û¨CjÙ·–6o¬¨ØÆq©ðÃYë]p)i¢ÍÊà;=šRÃFï™$¾Ò5Þ~uÔ×Ëÿª´µð‰³Ù°rÍUTTªÐ£óÌã-Ó øõi†©ePSc*m wizìÑz×J~›eÄo#E[oÛóýf‚DP2ßÔKýçvµYûóÏv:œ~›Ý—ÄÓCE»¸nGÐc‚Ç 2²ûd‡KƒËSïèT¶Ú¶Ë£Í«¡ ÒD¶dJë"rëO ÍŒ;nCIÊÁqrÚ̺b6¶È:ýb/JÙMâž/• <õÝÜêøûôÄH~Œ½Ç΋ t•6ÐÏí%ìàC½‡¬Ân ·:ZQo}DqùõY‰c°t¦žN¥-¬3j¯N›û2¯ûg›ìGrøÎyãs[V´y‘à ;( m¹‹©6ƒ­_Rjè]h-?ÅpðWd‘5 Öm>]:À LRó!k¢ ˜én‘õ¼ër’ÇîüZhi¾#fßëÙ0Ú[ù&H:ùýËì@KYEÆŸžæø1lCzQõF2¾Ï×ÜlûiØ:|‹Ù@8|¯^1|“·Ó…” ïÝdb°óþ¸rJÝÆL<ÙÒ¦—ß÷,ëÑÌ仧¢mjb ŸùnAM3~\ì‹*KÓâÅzÙLQ…%%ìºLæ¡~ È •'Û¦ææ>{¬Ur]òæñýndKÍ‘¦;Ë(øZßœ}¾œ²ši³<=ü¡þ«ÚÅì+ßTtߌY>s½W(–ÑfÑËxã9dE£d ÂšGçî¯%uŽQò÷%{åɤ4-ÐçÆgÙ„¯/DÙûçB´iO§Äè·'sí8Š|uä³Ì". œ¤:Å>%K¶DrÎKÙÖЗÓC vÃÆŒx¾¶¦vPO–b7 fÔh€+M'Œ°ö¨g±ó1Žj2­ä·©<Ë–Ѧ ĆF%C”éXKKªãù9šŒ6×÷n¡‘0ï 4Ž¼Àê±-îÀÑé›1^¦š,H¹ Ó˜’Óŵ)Á'ýYÄ׈ ®L›x«¬{ŸeÎáè< Õ](öZëÞÌèÖ‘ý®¥ézæ߸>ZF©„7râMÉF†VôþÓ3ò!ž±†²0Ok} …L4ÄQÃã΃SuÅ6æÏ©n‹Ô~sÿš…ÀñßÎô­§ÛÀÇ2Â]!C ‡§$Ÿ.]k‚Igº£¼ù†x*KO:õD*ï*×z‰¡ëó]ÕážVúXÆÐ1 N¾˜wÉó§‹ÈÚp¹—xÆÞu_¶Ø“Ò7_Zk5=*Øh楞E³í1[ÆD‰@L8z†Ò›ÿÆ‚·øp+‹NÄÚ l½¢s–Z qzÆÑÛŸœO6¡‘Ì-,LV\ìþ]j-ó¶f²Lyf:KTrÈÝ} I.GªÐÝËÞÊt Q¼×Ñ’Rx*×E`cJ#ZúÄ£{­ôU:pX\ …ì·çø¬l#¯šM›6ŽÁg¯Ï…òI†Æäóu’êÓÖÿÛŠÐÊ/epY k>¼)oñ[ØE´jI-´‡Ú³É\ƒÛ¦™&•ã8öùè7•Ñfip£¾Cyïdu¬7Çá ì.TOd…ÙàIæçÁ¦''-é8‹Î´Ýöqç6\Ï440²H¿üU!OZq nÂx–…·Ð¿Ñ“‚>¼˜l`€± =‚ÐÜOÚZ¤¨Q"ÌÿÈz>«kÑÿέìk¾h¿YmCûo¾HY·QŸ|¢5¾ê/]¥M÷5ŠYꊦ›!Te︉ì&>Ò Ñf—jhZ…BüJÉ[|ÖÏ¢Ÿ:Ð|Öúœçk ‚ÈS Šüp´$—™QöÚœYïølÐ2gö½•‡ ´Q¨­áyûiiÛ[cÍ÷5'nËŽ•×|š¹j¶@$6%3‘]¦e›…7^M;Ѥ;S'ë D^àõ‘‘QéÎM—NŽOÞ>¶Ã¡x²ŠB4kî­h --þ°>m¬,+ÏëäwŽc,u¼ˆ?ñö7ô˜ª»wؾUYcDh3õ+½Q81P–`K ¿ÿû­1ÒåÞ®S»,]cî*3ëxòþ%]sÒɺÒò 27¬ùü áuL ÛmMml­£Ro¢þò#Q6Üýßpô^ ç9z„ü¾àÙíëൣ}N¥gØbóºíךÆV—åbkëìV÷{Í—¥& /ò`±VýU':щNt¢èD':ù‡ 춓Ü8åâh×4"ü½ÇV8îäâ9"Òj‘‰ê[þþs}¬<Ö1ú1ð“ÊIéTµ¹~é²-Ž~ùÏÑØ?-ÈÕª…HÙ‰Àì§ð¼éл]þžÎΞ/W(^½4Péçáâ¾íƇY}„¯ÿÿí½‡_TÙ¶.úg¼÷î{ï¾sÏÙ»U2•sQÄ"çœs’   *H” (*bN¨% *bN€(‹œS‘cåõVª¢HÚ½»ûìÞû®ï÷k»¨Z3®9¿9æ˜sŒ!¼—goï•Rˆ\‡/6gÅÙØÚGœ,Ø@ ‚¯¨÷ÕÛš9¾]QjÐ ïd¸S™;5ì÷Nò˼ŽMý?•TöTü/«¹½{M(ýiÿ¼]4\òú‰Êìé«Að!NÅ4ï¯ßç‚ɯoZ&~cãçhä DMzå˜Ñ¡üÆ?ê5¥r©½è{’Š&IÔùqA•Ö"û«hDÂã7Íím--tÓ 3z~çS*…ù¼ñ{{ëgkùÌk$0±8ÕŽêx¼¸£³£îrƒ´ Li¯%¶¶eppðMéi²®N¥ät×Þ™«M}ªPt­1 ¨”¿éèhˉ°7ð9®Ü9kM—ix‚Éá\Œþ ¼)Ë­þ2U~)ë\õ|°8v¯0/55ãásÈ®G87œt,’ÎÐM9•20 Ýnl}ötZVNAÓÐ*2l¯œÏš+ÊI©k…ÌþÄÓí—Ïd¦§g?mG‡÷B÷ÉÜ[€læRNjZzÞgX -=ºq!=ãtYC«b-úòž#÷H/ŸÍÍ_ÉÆ^&ÖÏðêSr¯â™ílçÙý²$#=ýòÃѧxÛð»ÞœÍJËÈÌ}ö‰U@¼Pv½ -ãô£WmÀ§[k#_.æf¤gæ½lç£yÏ4<÷H¼Ô“š|ºà&¸~Îu4d¦:w½jCž\6×}5?+-ítM#1¡¥æìƒ÷SUWrrʡ袼wgN§ç].Ùͦ§_cñÛÍŒ-в;þêäÅgâEÞÙÌ”Ìì  h›ûÏf§ç^,^/g¦ç/‰W2’#i4Ë'RFÄ ÛÆ\øÒÓPœ–žYXü )´üzVSßäüÔ;o`£ì¥¾ëç³ÓÒ²*Þ÷*Z:ñí9ôêÒsj›Ð‹‚µqzDf\jFňع})/--íò½šÕ"Á­K™=üõç÷ ’SÒ‹ëšÌÖù¶*;3-çÜ•¾9(„“dŸr<ŒÆ°>y2ePÃU8KèBóåȘËhª® û~`?Ü §øæG­í[sÕéÑ`¯®}{ ¦ë­ÈßÙ^Õ>³\Ÿ¹ß4 mˆx…Ag4Aát%— nÝi¥‚—³l´<Ù/íú$ÿ½*Îlrs¨¬ÙS™óu£¶‘}(ʸØ0‰±Ä…«‰\»¨S—‹Ÿ}„ú8í“—¼n¨q2t>ù­4Ô\¥3ô^½û°$Zž"éÙ߯~ñ¤ôŠWÞ-PÎLW+ß ·|ÌóêZÔ‹÷k^Ô–º°´SkàË·ü×êdð€è­ï«/Ô¨Ðýù CòÁôÂêÊÒpªßùàW‹b¨¦žeµ UÅtñ¤§ãÛ­z`AÃ]ùõÉH㪖NÙ§/ý ‹\<.íòƒ†ÏÏó Ù&nH~l{»€ÛO?w|ip¦i¦¾‡î?Ëôe9¬|þòÑ:ýqŠ¯ÄQhÞ¯?4®I€…qiåÊ7pÒOלP·I¥œæ1…$6j¨…ÿ¾ |º“j’¢x/…îÆA¥­ÀL¶–åòèj™D\—ÈSÎX©¶QrÞG&ìªRç8)‚Þ?l]Ü:]vŠ#g›êï#1–ø£pý¤™KÔyd“ûö¨'I²Gø Æ‚Bἧ3L`Or2o=Ւ卑àìûãtãTP†u±b§Ô wÏ.¹jÜ’o¦îjhûB—;gߨ¨sZä×ͬŒ¨Ï»FËR´S#^éL?]$„6l×Ã(WôTG8žURvc›u` HEE·É|·T–ùð‡h4É×ñ¶jæÛ59Z3ƒTHÜ•KÄ»“t°8çž…TI¸ø==çªòTkÕc•r³ƒÁ‹ZäphÛ2^¾_Õ‰eµ1þ˜Nå,‰àÔ·³Â!ÛÌ;ÞÚ.—äA æih@ÖdUyÖVÞ§V½Œ1ÖIzÚÿ¢H‹m¿®Ì6W¨š¡÷Ù@É5¸.ùhË8òåÀ¦b<˲¨ï+$RÂÍÚ•$÷Ø"´Ì*?m›+à“ñúáç«‘×ô8˜d•×Öjù¹¦šÝ 8GùC}c°Ÿ ‰ôK²ƒn2|åf£‹¡¦Û½#ª3¸Œvÿ,aÛvÌÏ‘QñÉÿs¡•ñÁ'2é¼.Ð&.û9†CV'ëùdf ²“Jõ¥5mÈMáû|‹½¦,ji3(QŒï'¿XU”°lMVy7 Ô]:ìtèœâÛ§¦ç¡K×-¥©xÉÃÓ•¬¦÷jNiøÉ6[d^!?ÜŠzòn«<€W Ã$ìü‘(Û(SF Ûç†å 7ä%Gõ˜ºöþ½éø›cÊlÓgLÀ;x#¿û{{ØSi& õ¸XÒËš†YtÇi™¸!¿û¸U‰ßV ¶9@´•:ÀšK«íX¨H ·Iº¼u´ë“ˆ.>hþ.ÖLC'åß÷b›}´ƒ(îÂ6 .W†Ñ·úò°ŠÈ63æ*êÓr÷ËëßXD¸o{˜dŸzk/Å­½¶¦Ú7þþ® ÚÐÄ6¿P}Ò3Ïh—uX¹5rÿ$=$®5_‚¶‘«Ú!DUü‡U *×Â=ñ92ŽS­ ¢kPó+ÙÄ[ŠÍ6¶ù…Žš ød*«gUšçb~ðjÚ&ãS§˜ng%½ÍêÛœÅ9°Rñþìœ2¤ õ2ÁÀÙW^+O²*þé ˜ï;ä¨Ogs ôØLýÄÇÊlöøÅ0^ÝÚ'ªúí·d›ÆÉÏž~ç-ºÿj¹åd\.[ùĦQ=Ñrü]lM œ#·²Í(WËbJiF/6ÒiÌËo{„)óĺM–X°$©|äÏ.uˆP‰*šØ~÷W†8üµ·ÒþôÇœÚP ƒíl¯&ýN”„¢—¨6Y¼lJaw/CIÆKR9Qg0’ù“Ø&< Æ'I6fz5³í%¶æªk6í¸¯ébA{ÔŒ ™e_œÆ…ázÁÝئ6+Ò<þÂV5)OW“°ÍÒ[ùo²l ÛlÎÇ]ØfÑ]S½°uì>_® ±ÍœºjÉ„Ü»ÆZ“@“C,O^ÛZ%Ň9' µâ™MÙ†¢Ì6®[Ùf=„¤•½CÇ ±Íñ—HA6•H™ÒÑ׿†mòÝ̃ŠÑ$Ó-¿–müØyå¦G;òff¶Aħ…F#*þÆûQÅûí¿é@Õw †áemF3²9œ‰‘ßÉ6@×+‚Ç]ù;Y~ÿ¡c+Û-pŸ"¯Y°Ø×;+ÜÊ6ÀêýɨP,™üÖ ýîd›öÙ…ç9ûõÂ¥Èð›~Ë`pÁYæbˆ/kæ#ù/Ou.Š·œ—–ï£x ž“¤‚aü+ØÈ·Só+ìC2¸êmªníÎÒœpq7P—£sõQÖpˆÏ>IÛoƒTie¬Á2ÛPÊ©À—r¾âÂÑöxøþ„m€Ú#L“Ø—è1«túKçø6¶ygˆA]:{œÓ±ÿÛHšNÚQàû͆‹¥Ôú¯bàÝq]NX-Z+Ùlã7P$XrÓÔº:‚­Ÿ¥¾Þ±G ¶ùR4ßu·N¡Á˜²P!Üø1Û”ÉdFlÒ§Ô}ãÔ@ÛØŠT.ÛDƒCçê!çÌ’¯Aæ:© öàªDy‰i¸àb|IÞwÙçß^à¿ÕÔ6Cí£Ö¸,â—1ÁÇü(zp.šVºáF£ç~ßÉ6p¾+:øZØôCÙ&K‘)œC¹{-yþ(¶d«Ö,ª±ÛÁ¼œtCª}ÔÕml³Ðt…€£Ħ¦%„³h´âžµml#œi¥hì‚ãsÒÙÄã¥_÷`èL'ÝOŸcî¥Ë¤ž‚5ÿ3¯²‰DúÁc)G‚hfå(tŠQbažñ ™:!¬N‡r«Êoš¸qXÔï“{±Í²[ûiDcŸîh‘XÁqÉÆÉyþꦹ•uTà4É¡Çs²Ùd›QT;pÒSO×ÂéØÑHƒšñZŸÄ¹êÇ—By½"jœÃ’²O5`‘r_þ¶-ôÒµÖq¹™'Ì8ÄÃ×ßma¨Ë:õ¨$ߨäôÞ~!‘šÔŸÊ6b@ÒÇ¥â=Ã’2ú»úDâ¨l¬¼gQhaߦÎ6’µqžhá“{:ÙR’¹¸©M·fÛ^(È3Õ¥7–Fi-Š^‚Ðœ³¦†…wT棯Õ! :';ËÍÖÐвs_xÍ20ÀžBw² $ WÆSh옓§“½ˆD½WpÀÉ\ƒÊˆŽ‹Ñ!h½D%LÙM"SÏ1X_ߨ~²Ü¯ibåânNÒ$µÎ Çæo¯ÅØÆ¡a\=¦Ç9D0ë­3sôÉÉ=íc©Gdú®IdÀ⇃þ¡!> 2ÅÎ/$((´vBò"̲֘  A û´¼eFŒ>Ph‰¥·Ý˜Žº1–ø£0;Ñ;2½ºIá’µ¡>^WW×àè4âÏA*Záñz¥r“ßõÅéžî®®nÞôêÅh°¯{aM¤ØwH7û{À ºF§'’]ý 1¡¿·{i] Ÿn‹F{»º»G§€Mך“¼n0ûþÒâ¦j~¨·gb‘×{º;»ºûÀ9×ßÓ½&’‚s°7‚®=R˜RÕUú8ÚöIŸYª§†Á*÷NƒŒÐÙ‹ú",ó{¡†ôò—…›'àRáèT¥1¤ò`ÚÑÞºJŠ×æá¾éŸYB+,ZhïBöRñRw÷ â£W8?ÁAX&\€º¬kdÍgqºoiîf…ÏëêìœN<@µC5Ô58;ã·w+Z'îîæmÀÑy%ks`’ž1É|›:Å‘2ÆÁ~ç­‰þxï(úNÉÊhWß ¤O_ÙÆæöP´<µ¿kxbV.z‰àWß=9?” övÀïemn¬»»{|I,ÝXè…Úß?4.‚ÕòÁr746à« ¼¹” Öæz‡Ñ-Ô~¡}ó«B4Ê8£¡!ÒÝÕ 1 ²êíâuo¢«“·&E4*«`¡PòuÔÞ'³ãCàcCc3Š&@¼1Üß V¯op ­‡xzÃ`¯ñмg²¹¡žn傺º¶nÞ…ó“=£¨ß¤©¶gWú1–Àðc¸{Nÿ+x©•Þq°?„\týRœÄ± ûyšÑ{›0äx¬»*eâ½î? ß‹<«'EX?`øþ„ûöR=¡od„ƒ›]UÏ6àÈø×h Šs¢©$².›¦céój@ˆ)þÄQ„šcø7Ó?úóJ‚ 0`Ø\7eËsÓãccñ_Þ £T26>!þ·\ë%ÂÑñIéo{uJáâÈÄÜÔ/üþbÓ‚ù¿hylú7¸ ›™_H°Éú/&Îï6€„‹}T= 2ºŸ¿ñÓþâ6àý÷°ç4^è$±-—cv/cØHÜ—î¼ýì8ño-t§gŸ¤†å<ûc[^Æþ&Dó¼qÈ)çñ¯OëïÀzÜÄÇfñ_žd6ǘT$ÙÕS¶hö3a"Úñ<°Ãe·T,ÙM¥ ÛÃeúN·Ø;óWö³-ûAZô§ml³õî–R¦{¸ßúÓ¶„Ê?n y¯œÙ¶»7üg¾ß-~ÂwI¾G¡â`2­9 †ÙF²W¡2Ùîç÷pƒÿ8-$îâËÝÛÿ£,ÝݵÃwE}´ù/É>Ü›o&wu¼.ÛÛ3>¦¾úëãr,Ç32ŸÌ0‰,‚nØG¹ZѸöQaÞ 2íÌ“AñÜÐáè :ƒŸpt`NŒ<3fP,<ú:˜èZº ®ƒ ùt„?ÇÀäæ›9`mÜA_—eíîoÏÒÑû8² ‚é—û™ÎEæ)yçŽz°uýà-ÁÝ/“ååfObr‹!sr™¬·”K'Ùù†{XéÙÀ!Yd·ÝXŒDh%wÿ€-©€Ã$µM®*–I öLûÀx@ºÝãÄä««§H„ oº1qÚ¦|x¯¿xÄÂÄžfî Ó’ ®¦†ÁL©Í¥©Ögʼð¡O‘CæE[ºfP>nfÙC‹¤EäÆqºŽaTT( Oõ?û ïþv”ca‘ÇrŽ:èÙû½ÎvJ<aÃ`¸Cjöêr$‹ÉŒˆŽä¨öÇápÀ¼ËÌŽžpdÚûª—lOÅQBÃuŒŽ4:~³˜oW#"%[‘óøƤe'㨦pœnÙ› W Ž¢kp"Á,êÒ÷ÏÓ©ôࣉ·Û^žšé‰$o®»¿ŸQÛÆý$˜fãm”¶×W#]û¨BðÏ–»±l5,ê‘fWŠ4ð|˜)‹iÈ Ð<ò ˜ÂüWwmÌu-ý²®”O}8¯Ë¤ø…†»šÐY:îc¢-S~¡>à{ËÑÉ÷lA¾1ã`|ÿY¼êeÆ¥›» vaÒYå-LòúÜ!*™šp¼˜6FhK¦wÃ7&.3i/O2S¯ºd ÕåÓH— 0K}ÃÒ’ Š{ ø¥»±ôó 6—ÿú¸~ÒÌÔ+ùU`ªÏ1“"«´ X{Ÿ§ÆF.±É–z(æÇ-ØU÷àù:˜á&4´}ï"Ú¼Æ×E@Ä«Ô Û!u”.pÙ¤÷ÃËÀÐ °CзâåQ*•Ù¹—3ûF_K=ùXèР#lcoÎ>x UúðË%í‹T0Ë¢Ó¾LÃoi±ÑPS=æR˜¹ ñe•m4UIÏGáÀ¿üVÍ`üÐ|”  sÀðk-’ـܺÕVŸXÓ> ¬öåe¡WWÚ˜dÚ¬b“‹qöñÀÚ§¨§·£=ÝPQÒ³5låÊ›p2Îp O¶âýl(¤]Ëy{–ÏUä¹·¹jú‡ ß%ÓÚL4<Ëð¼d@'ê­Ó¤Ú!$",¡2=ÁšFYâ²Ãf[Ò9'‘îm¸<­(eÛüK°Í nhz=,µJÒMV)7jª«@Ô=¹g¨FªšW¶\3ëgÞ}ý\Uýàú)&ÓAÛ€ßÿ„¸­‘Ô.V!¨«.¤©²xØr`½ ßXÓj;æŸg2…­2•Dë>C‚VÁƒ$ÿ›çãuý¶l ö²'ú¡gwÓÛœsÐ>ß ˆ–»i‰ßÏ8g¼èb¢Ák|Ë“Þ*$c ˜Îk!G€k÷Œ&|B´ØOc‚­®·»üa0Ú˜Ó.Þ]1rÍQì Jâ|tƒŽ=…ë[]õÈL=×M·`'Æõ†aø©%G5â£Yt£iGSý8|¼‘°÷ARUUUúêëÞ ßÜGðBîø-¼`°Œrï,'܈ÛÙÆ”VÕŠ^]¬/°r8\+œýÀ ê.É­Êr}ÉÛˆg Œ&…Þ†…êEÖ†´Iº#`»›ã5t‘u¤­2ŸfáX‡Öª:ÄÌðp)df¾Ð÷.=)!êPdDx(‰Ì bí€chºŠã8dÜúÖÏß¹Ùož/A z²è ý¦¶K^RÌÓ'7X*ÔO`Ÿ‰&ôµ™­pUžÆÚƒb~-ÉÖó>È=QÀ˜0×Ðx9‡6ó[Ž)Ýû‘ÛÌegæåååæžíÝÀ¶UI¶Q²ÕcÚÇf^(8àBÁ…Æ-lÓk¨MHȽˆþ\p¡ðòuñ;©W--ÿ´ çOœ+ÛØÝãÄ£´0Û¤¢-Š Y›.œ|M^Pp¡èú½l´“m~aDüÀ*³©äˆcÒë™7G®üRfX Ðv™ìYøö¾H1Žx²ú%Å2¿X®¥{å‡#07¬;Ò½k€Ÿ)­i ¸‘èpæÝú“zÑOõ½åiäyIÞÜ‹—.Õ o lsëb1´ä¤F¬žWb›i ¡(IÇÆ]9Õ£ö)m~¡… q°ŠÁ¶S¸eÍaîd›šïèR^_`íp¤N0]O§š¯ÈÛ}1Fg¶Qh‰a¶…ÙFÝ8IÔ\–Í2µ¿X°Y«Òæ¡õï÷µ´õï<û<8<:<ðµm`C®æúóÙ'Lh,Ë€¾ù-Š;ˆm¬/¡í€Ùf’î'ò•GH÷ê¶qãRÞAòç‡{i\ÿc[IlÀ@…ø õ0 ©“«–tµ·#b4f¢D Ú¢˜¤¼‡¿0üU¡Lº¬ËÜÛ\¶©–\áÕ³¬ƒï»QëçÀÊl˜ÑngDÄ_†v"_iú.å¾Ì p/Hœ™V¯&¥¡ÙïãuÓ¾ôÒ<`¨"30õZ0…¥ì{¡õüAjȦx¶8‡6ñGlòJÍ9‚ý!Eª¥ù%ØÊh“mÖ&iL Ú‡¡ê?c›Zñb;ƒF["yJc¸j ¶i^…õÒ{²Íi„m&ßÝÅ›{+‰åÈ»bev´MÂtK:^à¢lS±Í °n³3SŠÞHó±H¸ûnÛNjÛ€ãé–+Þåú ¼ùÒÕ5Øx f›ïÑÔ°Ñv>{qg(_VŸVU‹€gÒ¾Çh×Ýõ¤ne›íÚglvÿ…Ù-¼dãpO¾ôNNN¼¿{r¿Ž¯h« xYzÇ-vhbrbl Ç›j–Ø ÛÊ6ï ©,nÛàèÄøhÙq;¼ëyDù°‹ ¸´Ç ¯™úèÛØèÐí#ÆÆAwÁayí°»APú0”ß '‚K&X1YóݳùO`ãeAG•ô¨g~aa¶¡ A'·íi¾~2< y ¶ù“NY’é\–Þl0éd¨£Ï¨è—!aÅí(T.Á‡]K¤™éšê\ï"ã[8|‡ãà¡Ÿ»½Z|££¯£k IV’ÑCáüu) í¶ÀkæÕ´NNNv¾/UÃspÕ?d0ë 7*îÈO““í¯‰8bóøÚ&Û€¿‹–Ì䌚¯SS“™a}òOÙ¬“ ‡z²ôÓôôTíÙ#º†Xo³hƒ#_úÜ?:»þ3¶Kåû1‰¯¾Ÿ˜æ}dp/z–ûK3µÍƒÇùü‘žfws/:ú‰©~®$¸{&ò'ºÜ ÚOZÇÆ'ÆFÝL7 /å¢Ë1þ7›WveðÛž2‰þ¹{prb¼îL šy"leÊ7×$]kî( ×9ú](d®T|ô­O££Ã)¶,—0«œH3—槧Û^›ÙéîÍ6þŠ¸Ÿå”PøeS^iŽô´ár¹!I‘Èõë3ææ.r\à[õE{s#S Ûóå¨û¸`³'­3Š=ÑBG•—‰±±É±ó$Ó¹O #¹ü x;›5tÃ{ïÕ‘cA.Ʀæ ç)Öú÷sm̸¦V×êÚJ=:ähŸóÉ}¢µÒÁÜÐÔÊóý„ØÓÆì;(Û ß¡™' l³1¦œ€ØfÅ­YËC•žOb¹¶ ÈyúÛÓálã(EeÞ$™™›Â?5%±¹!roÙ ø´joezó+â–P˜dÃŽHœgJÖz­L¹ã+ð®a}$9ÌË5v;xrL~åH ùÃãˆ&Í}Žæ(õ5c5Ï >OÏÄÛûÆt-òÇèšYœHq+v²04s|Ú/Èc%ßëyg„±ý\Íê;QeЛkÞþÉðô†»ZšÚWt,_‰ãÄB¾‰&^573=üô_¦[B+¸>ªÏµÙæ[šŽó©âÝK×/$†˜˜˜ØzF´Î¢ÆÙO/Äq` §:ÕßPßrN?õÉÅÜÐá ¸]Í9 &1µó|Ј4YxÂ’‘Zµyõc‚÷M”mf^ÐŒ‚õš`èe “¹1×8:ó®@þÞŸž633537+éäožh‹æÓy™˜šJ¿%EŸ\Í‹ò026Ï,þ<öÈî ½‘pOãê–Yl.cøg!ÛË¡eøW¦eRỺGórÅM„¡Já§ÕŸ$‘‰?<{4³†ÒI¼‰Jö«åË×ÚÛô´± õ]L±½ÀÆ:†:VVÖÿ5÷í6£:Ρc”rÊÁ€ážüä’6$=?nFcé%¤¤ºØÒcø·T[ô=>¥Id„ÆŸŠôµ¦ÒÙsbL9ƒÃï xÍLŒô÷õ L%?¿&‹üΟ…“Œ $ÿ¦7káF-ÏN‚Í^ÚØb 0`À°}­ØÅÆäW8Úb³ôϪçïÎg¯Vücq„d»´5;à‡­ÉvDçÜÞÙ»ÔH&Û­¿µC~d€´=ë]ºM¶gn?)?íëÔð¯Göò0ü³p.‚˜Û²íË`óÿL¹ßÿƒ‰%ëTÁëþwÚZÛ¨Ÿ©üýùX2ÿãú« ´ ½ªÚÌ]A.týÿ¡9û›'tkh…¨¡ù:Çù?±B@ùÊôš‘Uk–*ÿ×½°@>÷?þ¦®¥ƒ¡q`ÛÜóÑ'´uÓ´pŽ"¥Ò‡Ÿ^Ú§çŠ|n~ÛÂC QH8M†±Ó­g­Šræ+CXÉ ±ŽujêjjÈGÕ”ƒE‘Î*ššH‰ÚZj$Ήóåð&ôúԧʫn朿ïSÙ÷w ÷ðÊσ›3T¼ÀQQ³<ð7üˆ`³b’T4I“âMSÓÊÜð_Ôhµã›TЕåH?^ºwlj‚´ÿϤ—ÐÍ.ÁD¹¦†º6Ú+Ú*ªšž‘é«Šn<º’nÂÄÿ²ÿub@lvç¬lO’•ÉBèd5M-´±Úô˜¬[‚=†4óe?H1:ø“q9N7²àû€l¯Ucèc×óÊŽõbÛBµ×ª´›i6 û±¬íN»X;¢\IÙV³Ýí…·ÉHcÍ7ô].í½bÊv…ïÞ-Èß“µTãt(ÈUåI÷K Fç2h-¿ŽUÊþÒ.mfmTñ·•|$tUfj«°›`3£ÉÆ\&ÛG™mF®-ý¡™¹ÜF¡0Q×ü–ûÒ³y´ éöú¥_Ç©òŒU#ž ^óñÈVšõK]VZú tM©?JdÛU}Cãœ~­<Ç"ªž{Þ·µs[Zì1¼:HTÓ‡ÑlÏ{CŠ\k/Ñ30ᘇ)RõäûpÓ+~À6Q¬}ioa¶™ª¢‘M”–0I~¸™¾õäG†¾MXëÒ¢õ«I^’î´P¶—ÐÃÕKx‰Æ€„Cn -·Âþ]‡ œ_;stw±HÙÆ¿›m"r_¤Ú‰SŸÄøbÍ!õÌ2hi{wÖÀ ácQR›ÉືN¢±ëÇ0Ž‚†t}:=Ì‘DÀ±Í}>¯,vÖí#é‰åãqúQìÿ«süãÍÝt‰B&Ù_•–²uΫB²ºí®J5JD^èãH+gÈžQôôÊ |ž©™wÑîô‚’×qnÆ8Þ12L´åå/¶ÙêˆD«€“«P¤kcÇ<µ¯£†êª[]8ªÞy‹ÞE¬‰c%¼_— çs£Ý(`åÈŒ£*!Qg‘÷_ªÔ9xÅÍw[±´ ´Cy__s4‚Û}¸o¥O'‘ˆúÖ~Ñû4_O›×@9Ÿ ±wÏ­TTlúu"O e¶Á]Ýæ/’³/÷ÅÂÙf­÷ì´¦DzR±¢#D\& ƒ‹&”dqÕB«6=h]‹óqK¿«<‹^2b†-Ðß“öËƶ°ñЃø}Tÿeå^|¤ËÙÄ—²f™Â‰:ÙnM‚>W[}0õn¢>¦b©ãob:ÙxQ¼9µçÛêðz¶P8…¡›4"_Îv3•ìAôÕ]¢;‡¢«¼ ª Ø'ÂþÇh`O þcÛ¬v?§YA6æ Q:§ô5©Òæn“mF m h&×=µ­ã@¶™ÖaPïË5öçz¨:¦b)ºõŠ±ÅåTB¸6þ…Ì2X•Ê¶±ŽëäéÃÅ–Ë ‘ʽvü€màÒD%ù l:…NgÐéºg*Pžü–jT9üˆm|\so¸DOwg‹Idù/ÀJ«Æë'¾‰;†Æ†}‘òÅB9Û€M\l.V7ðE¾îȵ¢†T*±Í}ðÃût¦ï=éod&î†öŠ§™!›LÑ…ÿ’=ôfžúðÙFŸF£QaP(çÈÓpKdw¼ô¬/‘³ô¤ÙÂÃ`ù{U'Ñà…i.z§¼ÙÇvR¤Þætèq#"%¶¹åd**]9ûYGÀ7òúF„Ç)èuHßÐIz³"@ùBÀï¤0õÖ%²ÙòH¼7š¹ÿS™[›ÆÔ1µðÃI¦ê^z½ÜTrÔ·°¼.ÌïÑ”¬#‹èJV8<´­A@"j¨¦¥ÐNê“!¤ˆå‘—tG äkðãýt®OüÖ–  ~\Aë6\æ¾m>Ç8%½†MPY@"غú>G`»Ûˆ¿25ÙC4“†³æÖq4¾<ÖhÅ$R†6Õß!ýËèû,NÀcE…¾\Žež?|*°Õ(‘;!T’mÔpç¾ÍÎÌÌðçæM™Y°dXO6ælc›‘†kJlƒÒðÆúêD{G];úá(ôx°é_gÖÈ6>N'Š–çøüÙ¹…îLÃ#BùÁÜð£l ³¨Cc ”mJ‡w•m€IÖú¦ÖGÇ€8éE#úaëRÛÈ„s ½nl£÷·É6F“`·ð§›n¨ª›´Ë5øM‰†Ú®÷vÓžýh'W×#ä¤muùLswðcW7ªVa\»BVMkÛdØLm8%È Ü€ëše•·c‡Y¨l£šö }kkè8iÙØ|.Í\ë>¼õ’®u±É$H—£¤âd‚ƒLÊÃQQŒ­ÞCÊãam‘ßtÿ0žŽ­–˜àüškÔ' ÀÆl3Ý<·2Òìt¸)[ñ ì+Ý^Ïhfnéw$·ùþÇ ¶•²lÓ]]Àp ۪òÒT}ÊG‹oNÑßÆ6ÙVZwF”KÎó'O‡€ScYÎ6²^]Ž·ŠfRNÙF>OÖ—ÞßÐÖ4³)ö"žéoª¨¥<jóÚ’…6õù¦÷ƒ;)8Þ&ïQS¯}­ûBß#KlºEå„{ÇõÝ!6˜êiy=*TVž×Ÿ·´ º)ÝgP¹ËbåÎÞSoÝ/Y(§?Í¡óu¥‘º_<¸Eo3Yqb=xiƒû¶| ³úš¦¥7V_Ò®§B)ùÖ×.G(W÷T}ÛÀ¯©é …åñõ| ÑoÖÛ@É‹OºZ†ç ½GÇS—þ¯¡ws+£~Løs½ ü¸pâ›ÍhŠœunµÉ™jÆFUûæضA“ˆÖÇxŸtˆ´·óbŒ%þ@½ ]7YvÚ¶2àGlˆ[IT1zˆ$²¡Q3ê`~æö/Ô/ðËŸ¬ Ó‹l@dÀÊwÅ©‡³«å§¹wqZn ÏT ÛÁÇZß²¶-³éºl*râp5ÖÆ1uïÖWqÊ/õ9¢·áx¡ÊœŠX–ïÈ)AËëç-ðê;ÛDTaTõø!w¿ªÃv$%Þ‚ NE£z$â¶YûF¦8C+§Tïêúd´e™¾^ w6Ù¬ È×?Â:˜© œ¶ÍÑ7Ã]¼3åsº¶_§G8§C4ZÚºÔÞ8íö™Ö*.Y=ë¤ÓáÝ Äsœ¿M¡ã_4õÅ¡_;·ð%“éÿxë ü-ñJû Ép|UŠÔíEt&õ¤=“â½¼Å!©]|9¬w2~ÑÊÂuuÉöš–gÀ=ê§Ëñ4ŸSÊçKÏb5tb7”e8ÛcV wC³Œß¬%†’¯÷›kje¿ZDj˜êÂÒµ lFD‚Û§p$+¾è×I@Õ™:ÇzSq47D³?õẖŽ(¬-·¡ÒBáíc‹‹uø´¼nvdê“i°BâÖ¦Ï ëØ ùïÅÙ`œïÉrw+ #ÓÒ·ÞÉrÐȂϤš®˜³¼åK[GÚÿ‹l«Ì2 ÎÙ+C/}-YT“Ä0¼RÛŠžù §š*ô¸:tú, ÆØQ:\C]š±Ke'²ØK‚éÿÅõMF>ŸÐÑگ³ñSa®DšŽ‘ËÔ#š· iç‚,TÓÏÞr²07Òeè;†Çd‰ŸF(:ƒÞÜ0gãYl&ÝÔãÕ´Gç·ÖX2I:ÆNÞÑ-¾Û8©Þy;Ó÷ø´®ozÜVîÌ¥ëèééÐmüâ{W”Τ`èÅU}¼¶¾©¥GÄéêB;ë¸7€LRp2”Ngp ©:ÆùZË Ê\6bùëýÿúÛßCï ) â«Vªÿ¹ocô?¹8¨´)÷˜jügZ…\]µØq"ÌUCEEuÿ~–™ëõšÅü­(Ì0×!iãIDœ&ÍÀ6¿¸üòŠznûÚÖ+Ifþ>å›—†.E8Ùœ¸¡¼ Ére0 Åò?ß><çdÌüÛ~U•}Lœ‚Ë?¢çÚCïoY²ñjê*Ž¡Ý‹ÐððÓÿ{ZI÷Ö]Ìš1þ•_­Ê u=|kS˱ÚÌÄkè&ÿè¾M0îGîÛL>ÒPa*Gåî}ž£Š×ŸB 1„wÏ0¢kÿ²ï€Š:10>w`}ï­”LÊ ¨kãðjjö~±ÇÐ8¤eI¶Ž©±¾¾¹G]$þJÖLi «sxv#EN64â²X¬¸œ»p zÿù¬G€ÑÅïÁî¾öwÜ{Ù½e{ `÷ѽ€ìGá¶^ºÙõùŸØ+ ÃÚÒ¬BÎnÍ5eÇ~Ø¥ù»æ¬¤\žßtœò8–áœÛ½·ª@¶£+€m´õî÷t v÷P»¥Ý«Kw¹•½gã=ãJìT™î:¶tåo¸K¼Ë…ä½ÞÔžûG/h—° ?™$2àIŒÓÛIŒ00ì‰k‰Ž†^IC#£}moYÚ”Gã¿5|<4\u¯Žò>—“4XoW±ƒ‰dY$ë““S[199¹&ø]ÛéÆüÔö\ALÿÑïHv$î’{ö^’Àž]I¶63³qô«ü6ÿ.À îe±23sð{ÊîØùÄ?†‰§}ó­03Ö+mZü=¹.¿9bjf¶=[k§u¬Ã1`À€ 0ü·CÒ^hàu~ÛŽb£)Ã$ðöÖM´§¨¾|ÊÙÁÎ30æëø*¢ý…~šÿ~$ÀÍÖÞã¼ }r}ìc„·³½“σÆIÅ—¯ïx;ZÛ9xݨGŸD¾/É ˆÉÙR–`$3&ÀÖÖ!:­H´Mí¹úÕkräÏT;Àȧ‡~.vŽÎ>Šª*~®Îò8^2`^þ1`ø­Sk±ïÕçžmß­¿Q³8¿eÊDéÎFz!ùßÚ;›j Hê”'C0«Ì|e“ðï¾vu~óå2Ý‡Ì øuT*«¾¹­£­Ñ†FɃœóïî$êXu÷öó¾‡rˆ¡÷¡B%SÍúL{S÷øͲ¤Ý–$µä›õ]]7R|˜Vr€þË 4 ãð…ý¿R ó¨yßÝ8N2pøÐÚñ½ù¥)Ž[3¾%Oá„-Žü~Àî¶cÀ°÷ìƒÌëꊋN¥¦fŸ¿Þ[’H‡ë’Π—ñ:ë痢¦^~øRøþ°œmDO¯ìX—¬óCƒƒçåN)s"tcÏCæ /“8ÇߣÓpàŽÁg î†Q|ϵ¡®ý¿çªÓ£Aù$Ë];¡x I¾ö6B[ïøeéåŠÖÙîº|ãM¶øõç½’Jä’Ì Ž¨Û'Fy£»ô„eìõt³ýÛH…3Ù™ó:d‚ù´¬<áZOvzòÐt¶0ÕñæLfjFVþgØjºõnÞ™'›ÛU“w¶¸M&šÎÉLãÃTW“|ï¾›EÈ„_@äfå<»›~û%’dìm.Ã2~W0`@p>P×96¿¾¡áá•,õýÔ±U‰äKÆ>èÒ]û“ Óæñ³—•wÎzXhZ!l#Ì rºòyuÛ–*Þ^+³z ä®H.—§˜ì³ÖšêoW„>8ÍcŠ…ÔP ߶';x/G¾z™l¡ì…"ÏoÕgŒ•eyAÐ=ÿé¯8ºÁ2Bg¢Ót@$þaÉÆx ŸßÌÚVsÝõ "…dëQ\ZÊ_•µ—g86÷k^Ô•_7Æk=ìÙz/j¼‘ðÞÀ¼;^ûÚ H\£Á¾Þ+’mŽwš²ÌÙ1ÏÀ÷²|ÓKQAo}ŠAaõC,‡Ñ  »BBS)lA£ÌMòÅR™XÎ6©¦ûcÍ"s­áˆ…ºe°Ã1%2?…“­á väòÍ qBÚ/ÆûÉ/6ùiÙš¬òRÞ̆›RfNNVú ³@¡’2d+Û(íY¤ËÉgß!å§Ø3 ßCú”mvø®D±1I$ÑïO¢T` r§õU²Ô˜B1< ~ë §ù¬ Ú -¶Vj¹o×ÚÈë6ßY«Iä ¤;|`ŠŽë““›—±!…Ã^h­Î×g‘(Æ.—<Ÿƒ.‹›¶YvR׸9ŠL*Ùr}äV½âŠgšñÁÔiî’“&éÁ„b®¯{RöÕŒòÍë6/V,X’T>ÎÏÎsÜbù I ùÇt]òÞî!Û S^²:jA MEücȦ_œàÜA~M1ü{ÑàÞ:mÈì~ô"Ù  gçåïÃÇÓžB1E¡»Žþ—!áªúŒ‹gBÕ®~†{_ÝP!›¾žÝ½ gdÇký؈€aw½b:Nu‰÷¡‘ ¼¡|'µâ¢¡~µá–ÍVocøkq¦]?ø¢ds‰grµâ?oÈe‘>ýÔ6)ËRÍé@-é7¦gXuÖT-Po ‚&ž1!Øm`‹›NkªFÆãN´dé›Eóö  2¡‘LÝýÓJö8—Ù†ÂBÙfÔD]ãÃÚŽž»«N “kî8\í"°ó"þç;‰Dc™½/Ì¿Œ¤Û\èÆ »C4[þè…œv$ Ìó_ù2ùN*ÇF-äj?bì]èf¤aµe'~|‘`È9T.ݺÔóÊ‚tìÎJa™(‹×°Ë€6b]m‚o¡Tè…ó¾ 4A´}g@^‚s? âLfÅ{émÄ>FZW^J¶W2%WGÈNJöƒÔ&ÛQÖ¸3ÕChè×¥þ>ÊqÁÆ÷î_'8€í›²ñçùšÆA匷[I‹ìˆ!ϱø°0쉓î,#k§ŒÓÙG‚ìÉxöôºT¡%~{M‹ÄŽ;æÆ=•ï¯a~žW‚#úÚ)Ï—ó4ÃÓ’.`¤^…¼ÏÉD‹ÞTœ¡©kˆ—5Iÿ¼#6ÆìñšÆ–Ánf$MÒ÷È\²³2K“Ä MHÏ8­Ë ~ I&eç»:˜³ô ƒA¹%,E$šN{èf!ÁHI!õ3[NZbñÚ€¡®ÎزdoÙXj¹EÐ&ûNI;Á¦Óîv£^.ëÒBi4Êá¯ȟÒ>#shÌJnŒ3±ö V45øäºh<Á>Xˆ’dÑœDo˜Ã|¡`À°ÇN v1><ÐÝÝÝÓ?´ ›LËÖ¦:ûP{×Å©786fºúc7éXOçÄ’D*Zëééá)ahœ/ßam ÷÷òzúfWE€ÜÕ–L¼6Ø×Ãëé_€÷""ÁêüT/¯›Ç뙜E§üôè”WO<óPLZäm-kn«³ýɾÎYDò .»°ÆV¶ÚúIE<^¯Pºi¼±ÄïëËíž_C+îðVgºººç…òk9RA/{”÷vo)¿»üZ¸4à}Éqeìe&’Ê°#) þ7T´Ä`†oü·Lúåw§!šmIž=ýxý Öÿ0üï$«Û´.zYðáz”nh`¶ 0`øSY牌 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€áøÿ©N©Å endstream endobj 669 0 obj << /Length 1475 /Filter /FlateDecode >> stream xÚ½XIsÛ6¾ëWp|’f";Iç”EÉ8ÍâZêLg’(¶9%E• âúß÷).²jYNG@XÞþ¾÷@ìÝxØû0z³½|Ϥ¢PRé-®=æK$¸ð| 2o{ßÆóm‘¬¢2šL©ŒÿЪ°³Û$V“)ÁãváJ¥*ÒÊþaˆ"2ù±ø8š-FpÄñ| Ä9ò±ï­²Ñ·Ø‹aý£‡ ï®:•y\0¦Þ|ôû;i1" $FT2sZ¯€ÁâÕN/BP(5Š¶#Ì|«S¦o¬˜ß±À™Ò:š€7•6 Ö¬ä5k ¶¬„½)åÀLXZ‹ÛJe<þËÐP"Æ÷wfš1lÈ°æ ’ ãŸæˆÒn//Üõd}YT&ùÚnEË|[Ú½²âk:¹YG嶾­ãÞM®u²LëýT%šL™ vr~ǘºtç£Âñз¹‘îN÷(®ÒH»µüÚØÅÀÚÖÀžx'œá¸(íz¢íÙa rìÌ°vú Ã1rœP­«wER–ÊLܸÝlT±²!gèÞFE´*U¡Q#¦BÆÚ~‚sÖÌvU£uQÅðÜùÞüLˆU?«NËIÂ<É%ŒÁÁXö!Ü}ÑÄs‡F@¨'CŒÌ8Í©#A<óÙìd®´Ø„ÒfcÖ¹ÏPè5áBy×{)7é׫$“Ô -$w9&™d(›;ŸL%Æã3gÊNc¥WE²1N?{Uz˃¦œ!O°ÛÐ}@‚УÜ×Ñ¿ FÂQXë?û'Ê6©:.ž°@;)œD@[à 0î”hÚqi“£û<Á$B‰Bì‚éìõbñúíoÓ«Ùüòë—ùlnCŠcf'ïób™Ä±r‘Uå?˜ [$f {vöç姯îÏüó›é;GíÝÛÙÕå[;¿\_ÚÉ218kf P¶)OÝ£4ˆC=_ä ›;c?·[(ên¦¦VÕ0º×õq‡Ã»:$*ž-„Ž5¦ñÔJþzù­¨Ù$|ì×ûiŸï«ºµvj…Š_ØÙ2Oãéue€•Š*oÍE ííšZþÃù]Såd.»Næ¡\Õþ’—VÏ^0Ðq¡~ÑLSÛ$ë›~½u²okg.Ý%ûhSk¬uÕ0öõuB@ú·„`Æœ×R¼rC·³³½6â!FÂ'µÑ©%Ißu”ó$Þu”.-'ñ“ZÊCY¡7é·”UX6+Å}/²+JwÔz´n«b×·-š¯¹Ôÿu•µ?ï’ò¶“>ëm¶„Üb||ÿ¥wœŽ©—ƒ§Èi“>bDþGA!û‚S*f‹M§ÿ²„Ÿ§d² ko0é9¡ìÄJu¼uN2$ñŸ­VÁc…ètYEÓ!€· Ó€!a†n Ãr[,ŒÄ//2‚½wy©}a(3 @ÿÇ¡MžV)òhüêƒd&l ]f^URþÜá—[H4Ôø'A—”ÎÒèY,­f0Fi–Ûç¨?À.Ø.“Ì‘ŒV«<ÛDëD9ÒKw¤pפž)¡Q‰Z•ªíM¡4´,Ú^+k#ížÜÒPûDçI t/®(öÜW÷¼‹kÏeyœ˜^§qxãJ‡˜Ø-É+ŒMÓnIMÖ«Be K)ËûA|t°Þ¼œ«'±ƒö Üa}Aá1v­ýå@ÜbóË€˜zr쀸P?Ÿˆ·ÎÐI@‚Ò§1€Iû%ðºz4ì04@ ‰]·/K±9a lTÚy…P>»²_¾*ôlÚö­&ÒH÷Â<ªsÊ!ÀL–el? !®ÝÈì-9ÝÜ9Xvj›Z|¨ýèï¢Ã¯·¦%¥Pi]1jô’ÒñgUFS­ÊZw]!𶦴ßì_#h(4 endstream endobj 665 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 147 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 35678 /Filter /FlateDecode >> stream xÚ콇[TÉÖ7úG|÷¹ïî—Î{Ž£d:çnšœs–¨‚$DQD1+’%ˆ¨(ˆŠ *b9çœsÎÝÐtØûîÐÝ4MƒŽ3sæ„^Ï3㦺⪪_­µjU*IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”ôƒ[ÿýóêl6kl«/°S*¹p™ìÜZPð“¢Ü€ªý-ý{³ú'ª´ÿ¿&ûÝ“ÂÁ2Ù;ŒK…ú·×I®ûvm;ðwíAøƒ2~¨vaâïZŸ¾‡ÿ›pHô;evûLÔÒO²z-î°C¡â t¬º‘•ÛÐ üKYö9½ý'eã¾ seGf£\àMU{8[a5Tñx¬ºÁÖÉ·uF€2t²ùó5)›öuŒ³–6­‚%2iÚi“ˆCÇ*8ÛñG ¿Û ùœu:},<ÁãqDâfFŒöåÏÜê8K4 ‹ÅcqHAD¼kXÚ¿x»½…¾÷Vt=cCUKbEäÔBá%™Úx¼ 7HxmÍoC|Ñb³ªZzÝ(k걌Raë--8>‘€Çã hKµ´-&ðùµ ­­Y0˜ÖiöêîS#ÓY(µöÑ ¬îTL õÔß«ªëzZ¶¦Vø¿UÍnV›·ÐÅhl’…›-œ0ø‹jöÄðEPEÓÒ²»ðBÀ_j½Â‡sJ t‘«0‘@žæƒÞ4¤]D,4’pâ¾×³úõÝëkNNÑ…À˜]0¢Ü¬{p„xä43Œ÷ªbDÙæ²CsÁÞ§š²Šü®©e:&ü]án gÍOôô.ûÛýUS-+žB@U©²A£•Ù4‹ÃÐÇE#ê2fš˜FçC–çF›xÉBðU„§á…\xÀL5±µ1Ñ9ßxè¢Õ‚øuŠu×:œóTKM×Ì<ÈЂà0GšŽ‰Q… M°žÎÙoã?"ÛÀØÒ™MÓ?@À³Æ¸BtJÏ}½Gv …Ñf0F³Ú…Û‚-n|Ýiß_4ù…w1cíU^‘p·Ul#BG#¦rä7›]m—è{ö”Nƒ_DšŽVØG#ßÒ4ŽöƒMé>8ësk²ÙW‘ØF[–ƒ˜cöá·.lº{0_d|‰Ã«Ó¸Ð硶¾-ålÁ˜´™öTÕšÙÍÈõñ6fÑ% q`I iÛ¤Ù^íÜÉA›ÕÉœEÌkYAÓ VG©4ú*‚6©Çܼ_ï27 láwˆ‹D¦™¾œ§_8èL:ÍÔýËܶ+ÞZ~r½\]mÍi–>íË[XÛóùŽž,*\0¤N¯ Þ ÚÎ]Ц0ÆÙÜ뢬Výï¼íHL£ÍãÓ4Jãì:úÛDqªYÀ)OM’mNøA¦AhÃ4>WtÎÞ 8•ü·¢åúÎKÀ›£FW?*숕ö"wSƒ­G!ÑBn=ù«Zšß^&ôt³1 ™yGσ g¨ì¯ZôI#GsCþÓ,r‡Ò„ÙWÒÈÔsñ»'9Š† Ç£uj7·Îô,Õ¬®CRŒ6f>Q; —¼+“#™ §™€¥u.ñe³\ø¡ _f@hc{2A!Úèý‚ù°(;ˆ×-¨åCP éî3l,ÅÒL—$Ójm Ì7¦ ´i5\ð¶³ÎÑÝ’ Ú5=êÞÄâ-C„H~rhãûb—Äa¬½Ñ¥k «~Ó€BÐÓÓ#PŒï” ÂA·ÿëäÛôÓî.†t‰[Ž­21{¾ô­ ÜätüO¬þúÖ|.{Ó.çõÀ _›Ü«Ž-r倇KŽÈ®z—ééáÌ$’ß!ùs{B÷ÓuôXT’ƒÿ¥Idàu¿MÔÑV×Ó7ò»ôü˜;ùús(«`Íÿ×íÑ”gmzTÝÔ*¿ëåüjmžLíØÚÕ±jm )ø{ÉVCO¼ÈabÝ'ØNK/’mšs\è,Kó„íiZ‹!2 ?b)zsH¸µ Ó ìšðÞ¦Ó™÷[ý+VÕ49}TUê{¤E+e7TqÞ¸’jÄ´?†FnJpÀØÜÊÂçê-›dáÁW—Ú88+Úè9®¯©®B©º&ÖÏÁA›óú¿{2-;— Ï/) ß b´1‰l½ecW#né1½¸â~'U¢m§¿ij¨S]]ÇÀÂnhcÞ†-C» }~›lc\Y[/¥ÚÆNá  DQAÞéeCÈçò~-´~hh¯1è4›kßÐg¬Ô/¾„TþE#lðûyñRëfÿ¦]ñ¢#žõ‚‚ô+¶† «Ãç+[ú¢-1Û^œÆj‘2ãôO¾â%|{iàz¤¥Q¦-À´g7æœØ]\äÛI9øR„6Áf¾­2YÕµ(ÚìÁ”p6ÓŽW$â´ô†aÙtHw¯î(¤M„›œ(·É6cµ&žpèP&–x`YÜÐ_6$ugH†ºâJ:~·a›lãn'[ᆎIàGІÛéhîÞˆvöÊš&ejËp–¦ªfz5²8¬hô¹ àIµMl1šès†¯Ã±Ç²Æ$èÐÙKk A¼‘⛋ŒŠ©§Dõ}qaý}¾ýÃÐ ŠüÖOÇ!£MY˜|ýI7°2‚ÃÑßOÃ!3Ÿo’´5“ ¡ä@o]Y¤Ê“ 3í›eº§vfeãCaŒÉ÷ÝÚPneÊ/Œm²] ’ÑQ“ìhS(™Á+nZ¸Ä^XÙ²6¦¼lš@»ºµ(IÏùÈ–Œ—>bÕl 2Vó”jጎ}i¥Ž³CbŠÑ´Â¥R*Ao/?K^e\5dÐX4"ÑüpïŠ6T¶Á~×M²4Ð1†Ðf=ˆ¼ïB¹Ü¶=ºˆwŽ¢ (èahÏ@° t³±ö\縉6l}+{W 9;ßü¶;Ú@³v¥ä¼ ãÈÊV´¡Ò˜Î.›dë¾ö}´A`ÑäÈ`meyYeùicµ…‹ÚPkgÖÐј¦w*¥E tdLchÝë\Ù¦ŒÉÊ3“U¹ 2îÛØŠ\„±ê?{:‹QÛw!§L£Í9ˆÏ®›ìp±:˜"”Q>^µ¡QéMsrÍPˆ6t}cÙ¬lßG²ê3ÖÄ° ŒQÒ£cYf¹-è:£Í0Äî$‹L­œãË  ®Ú¾Yb£™£¡¨m ÿuh­¤ÂÁšx³AÈߊ6Lc Ù ;Ë}mP•Œ3ÐÝY^úíÛ·l2¶gAeý‚÷â °1O$Ó»9p¹ˆ¨f6gºDÑz1³µß:Rö0CÄ+„6$FÏši`7ójÛ™3TMÔ3‡~owÓÒ÷kì]\Wi¡ïU×T$É1Ð\ A›hÂBcî(ÛZ»wÍÓÚl@¢vTD¢í}„Úmš³üòÑ*Ç{ÙÈü"‰Ï ch¨‚W kCRq×":zKîÒí¼¢M÷×t¶DÏ” M+<£ ®6Ò‰„Þv{…ð¼!u^¾ŠrÑ°‹ÙÝno«z(©Sn‰}ë¸Ñ±k´9 ýæoÎzÙ2Óu?Ìå2´ ,ɠͯԤ´E OÈË¥¿U“‚uO ]¦}àËwÅÕ•á†j'ފѦeNŒ¢Iaú§R`}XŸ£Pè½Á\ÁQVÄ«- ìôW:BÝã’)xœO™Q8Õ`ÿ‰™5¡œÃÜj­Ù•°e¨g•/|ÝI“B’ŒÕæçÊ/H^«Â-÷ë4©=˜Ï\ñ 2¢S³»W$u£ Œ«ßΑèþPIeÑx…†dã"ž L†Á¹ü_«I¡hQqÚ €ó{hR+mºjZN!·>~ùVVöIŠ6{(þbPÞ˜'‘é=XIð³§Þû<©3ÚVGäûÓUËKà&Ú0‡x(Úõ0aõ Ÿœ¡m j.¼ce¢Ç ‘ôìO.ˆÀ©ö§ ýýR´9éAÝmþ¾š”ð–éÀë t(͈ÝË C›Â0gÃK’Á¶h¯‰ÏDe곆1t€4Ü0t9®m¦ê_’L¤£{ƒÇ`ÙF÷صwhæ•`¼$ØLZvïbV·E›ihvlTÕvE›ª'gX6Þrv›c&QÙ›h€ oŽÒO}8ãIyÒÊûíh—Á­dªŠ “÷ÿ6´¶2µ }bÍ‚JW9ñvi´‹- e9g ·f¿m›ÛºÄŠbBí-žò´ S˜Q÷> E"9 hc¦'êâ Ħ^‹Úmí¯Jwh±ÛŒ<ÑYôÄŸE:”'ÛžÚ܆…´î]Bö¤rN9Sïî.Û€¢¦ª©ÝÑt pG]îçÑ~’¢ T-k6CÛàÒ„-hùmâ)dex›éf C—ÍöÜmOJšÏβ͘A³1ÆTÜ21 ú=œEŠe˜©K5t† ï²ìâö²êcë\Ú9±Î)Þ"ᙩiE<ëÍf×Z@n³9q_~Ù“º¨0Ç8ÒþKÅ„œ0 á?õ,J1^!Ú؇§ìn%Fwê¯X3 #ŠÀ­² üÃR-“®C#h"h³è‰Smà˶9ØUçÆóm^,ý@ÿÉÈ6ð|«LbèѾ³'%-pG´éÊO Ú¡ß‘v¦t2fÌ°B´'•5•n@1jnë¾¹7Zêó?„6ÀQS£¤2ñ¸}qÝÍ-4 \ÁàéïdîvšHÐFÐFÔø>¿v„§m¶ïIIëôû¢ ‚'wÏzkcp,纪¬ÿ©ê1§áž9Õý©”ýÏlôhd2ÙÔ%¸y‚ƒVÒ¤^xsÀJ§¥íy6c]Þl ºâ­»O“TÅ]­÷±bâñ8=Ç£°Ö¤NĽ w·$ Fg¦y¢->rÿKÎM^‹H¡jkh<—>¿sùkÖiºÄ¶ŒR^°=%üXMã/f^Ö#k©©«á™f·Ÿ}Yˆë4ÑxKEñ!ÆÝàøƒR$õ¢éÿ·¯ A"NU} ©¨àjwQfÚ2µÉÁ2‚ª/{ÁÞžný9êò¤b듼9ûêPνUع¢ xhîþ㯅ó²:}/]ãoÙÕÐ5@ø¯„™6¼3þå/ÿ§bzó¨nÀ£*8˜ü¿˜!Ð"Àþßÿ©&S &`EP±ï™/n²F좥¡¡‰úÛÄùتÈWXíÅÀ¢4qæ¿ž.á*èAÑjRˆƒžbâàÓ4µžèg¢®©3Ôšùjböðæö©jv®Š…ø;§ÜLBâÖÏ—±/§S·m}z¯Šö€m:µÿÓ…ŒIÎ@Å^" Ž:ßæeA$’ˆ$ò¡ÈÔyDh©Ìaj©“†· ÚN 'Áh³¢ýß<²· 1crLƒè/1•ú¬ŽV¨jãGÙf×íy@AɯÚ”t/í´Žìî– ÛmîvìT iÚ(ü°éI°“‡ÃûoÉä梂FòÌQ蟼Gw‰¹«×( À2ÕE>y&4ll<~ãjƒH)M—š¿ÛŠ8 qäzóû ‘q8‘ïU~, ¹·[/îæÙ¥¨/¾[aÞÌŠÓ*˜2r>Ìgißfv_qÒ»ð»[“Èrlû–á¢H0Ò/õ ƒÌÔT.ƒ;T{7z…ú'‚6‹?—B›ÓwÛ¿;šj7„ZCyó½Û©µëOæ»h½òóÇ+þFŽQï€ßiÂåæÁeð_Š;ÞØ  ×¢?·f-µåw/xÒ¯Šv\ëg=ui/{7~ý"HÄâ5ÔrJùZZúèV6Ûgî+~;]‹>Õ:Îù¹´…÷"³‹GÿÁ8[ºBÎÜü“«%X8{ìøõôðà˜Õ?4 <;|\¾ÿŽ‡L¬ þÜz%_<yýΊhÇ×FkODÇÿ¬´*zœr#ìäÉËq÷ùþ±G%)IIJú{K›¿ò§ÝO…|O‡ÝM¯ßå<µâƒÛršÿ[¾c!ÙÅ)WIJRÒo°p§ÈJt:ý XÅpuø¹4"–erA-(9 ÂîÓ÷[ѨT=SÇ»oä&e´Ÿ Ê G-˜Ý„˜å¡DœvI?O <ó=¹4:£JÆ+u¾ì!Å5X®ž'½• ´1"î^ûþÂüU|éc€¶ÃýïGɽH²¤Õ }‹kÙå"p¡P‘’”ôcZžh!wÄŠ¨úªmú^X\äàÊÐs*Õ|ja ¥…Ñf]ͧ£ÉÒ™a´ô_×õCñ§‡šýmhzv‡dÅîê2Ûe´W;vS<8lÆ:íbì–´y¢ B*•J¦û¬I¬îóeYämhs焧û'r3Ó“°'IßÃ=ô€C-û{?€6gL]_AZ=ÝoËbXßü²sô GŠõ¼r$)II¿‚–mˆ*ÅÛ.&ÚXHüÜá9:úùÎÌ úX~J!Rú—E2ª÷¬‰ºÃ…²­*Ø„É/ZùRÙf½‰®­¿4[ŒW³™”Ä›ïyÌ09Ì€z¦hP"Ûü(Úœ8âU7´*‹6œÞÈmÀm•mÖ‹nkèš‚’O›ß4Xc­ãõ²\R¢’”ô;jRðdVý„ìrìW¡º6-.§À€HÊéâ"‚T·ŽNîÞO`‹•xÊF[Î…Ðekò›ý›v ¹èc ê—JÓ# ‚.‹3DçMX…ýJ´Q’’~_» |a[û3uMÃFäb'‘`ÉI9Ÿß*”M\èþ¤¥E}2Å0H÷j`?a`ø•†º ¤qñf;ð4öœPìh_¾]š©¦ï»U¶é’Ûß÷(M1Ú<ÝÙn{{·å‘ìE¤ÂNøgµâÛÆ;Ë[Æ×À­{R¯¸>zjí»ÚlÞÊ ¬w4>÷®skªÐ=ÄÎÓÂU=&¥xxÒ¤°jvsRÛ–’”¤¤ß†6(½¸±ßÄM|§(Èi3Ò¡S)CSsB&2S˦Qgœ¹OQT2ÅÈØ€J&Avî¹èZ_“½»*î~ßÍ:Á´þ?÷…Š!èzlפ¼Él=+K”,,­9"mˆ²VbˆJ/›ÓÌ/ pµ:‰‚'x >à€§U ÷Õm¢ ò»^hjcdöo‰’{gÉ:º.Î9Ù˜²©Tªû­OèOÙgìú¦/7§Ptƒ"¼²$`¬=Õ®*Ç’”ôc$ZYZäË„¼¥¥Y\‘`cqiÑz;©ÏY…½R–—Wx|!(sR•·ÆÂW8k¨¢µ¶¼¸².º’ÇYZåòEP)Ë\Y¿àµ•¥åUùãWëœÕ¥­_¾¼ÄŠ@!oq‰ƒŠM$u-- ‘ìøë\$âòú†øŠuŸ³¸ÂC…ƒüvŠ†Ù„"¿ í,Þ&N±¥± |½ ÝläдT¶)¿†eTvòlTûÅè:ü5óM…î”èkx#5ó‚Ÿ)…²Q¸e|ì€6pþJJEßv ugžÉøÊ>7ø¹þpœn“Ø)žé;£Í£3‡ ŽÄIF¥ü‚™á†±5kc5$ò4’‚A$¸aFiúÞ©o(ÝrÅu³x4ò–«¡úêšuتå"÷`“0åf 9wñSÑs©l3’’NžŒp7Ó#ûC3Fø7”M£TH*kB¾ÇMUè®Åiئö‰…?[ªÕ™ÓÁ,,Á/ n8 ›MÆ{…ú»šáñÆÕ\°&ó,•D Ž¾’×½ Õá°-KßÂ94ø0 GÎêFÑïšh¥£pÔJ{8ú‰¬lÃ+Øk¿)V”tŒÊÒ=æbLfë‚äéŒQ3;ÜYï`Pká|­U€­1ÍÌõL˜?‡¿ü¼…ÊOç,I8fXD8›åtð îV´áÇGzñ†‘®öóÁ§ÑÎt¦Î©3§-($–[‚`gÉâ’—-ÕÈ&ìÔ s6ÑÉÿ&ªºéÑ­¼"BÑ „ô’(°æŽ­A`™ié›ÐèdFz^'všj* ÛA–¾]g’ñþ¡§ŒtÎè8ï}âÊ È¡3ͽ¯B‚ô†á/é•%˜üÚP‚ø xÆÙ0<»BV¶™}sƒ Íê×X5ƒã¨Þ2^›®k*£ÍJß낙ϢhK¯oTEí5FÐf¾\Mœ+~²^d¦K(XÙE¶‘}®2=ȧŽÈ)|wºJNÍÊ®"+”Â9–òEòtÀnšÔúˆ‡–®oææåwÿågÁ¦qÒuš*ŒFø(ûZ…ÐÉS A`¬9¥S~O¡‚\2Q!~åÈÇòÖ–9ëÛ,“ÆZØf.ôo *Ûˆ6YJõ„‚oê†Ä~î,¤k`ñÉ4ü/^•¶±+{#õöܪãÿXWŒChÓ´º‰6ë³e4 kUò2dIj„ÉÑkÀXÉЪT®·NÑè’Óh¿Ý;ãyö™l^™‡íõÏ?ú$77÷ÙÓ, ,)c˜/ÃõCÎÝ,©ïã¡`ÖKkXwPç×Üã~ðru Û£hƒ1º.AÖy' µ{ÃÛÑ|zΉbät1á~Ûèò¦Ý†~b-eµW¯ WÍ™æÉÏžÀµzžwW_P0r&¾Péúk’mŠho²¼Ýf"Bˆ1e™ç ü£Å5DÌØ…};q3܆nât0.3oTŒcü³l¢Mt&Rxt–*ñ3lxèdìýÕÀÕÏDusŽE#ÆÔŠu7_A£Pîg#iž<»pÔÝ.$AO†CšH ?6 ø>î°¡"¿¿Xmr"9^Í‘Û²6ai°Ý¬ É)ð Ú;£ ÞF*Í@hóqg´‘‘mV2´/œ‘–hO¼þ¤QÑé›å f;±4©½óf€}PŠì«”@¶Ó<©AfѧåWëPq5Èk5!¶$<KD% ­ò·!Ù¦Kø]ÙY mT£?,ÿÚ¬M}¢R 8ñ‹eå™çuÎCSÞ§3 ˆÌèdHê‰v7xÝ $ø’ê6d;!ÑÛÖâØ…ÇÙQÊÉy\9OŽù¦'÷“ý\Œ0ó=k2hŽåŸÕ »×wŽONõ—½$ŠÑFÛî®$ãe/ì¾Û} Тîšâô¸K¶ú÷ã+|Ñ+1‚6“aÈt:—”ý­Ô£ìGÙ-ËàÊhn¶.Q±/ùÒvB›â´3fG¯JÙkËvËëÚy¯MXûùMÜåÓl¢¶ë©Dh€£‘ܯd<’–þðÄmL^I±#d•ÏN|Ë¢:ÀGƒy³%4ŠÎÝâ4ÙÙÙ/‹+Q´azä*¥™ŸG¸ƒ½Z×3ŸͶ MÇPœ×M4Š€;ñ,ï%¬I‘¾ôs8ÍO°8£æ¥-bÏO£ j·ëÑýOÑ‘\tõ%‰ßœÌäž©ÍTÁ{,ʬ.À2,Û,HÎ/}½@p»(MêúŽÝFÁû››Ü8«·'¶A pOkÛ®³<ÚðWû©Tò,O„&ɹìéqú(ñ\ÏÂÀ0}SOô!>*õ2ñ…í¦XäºáááªW·÷,V@àŒ5 ùUÿÀÐà@ïo½S©å hÑZ Ÿ\ÖÙ7µV{Ãïvix|¼£â¹·ƒ;–nÖ79µðþ0YÇ$ùeéÈèè‹d‡Ó »Íˆ±*&­¸yph¨»¥‚I ÔÍñ¶Ë6ð­Š,míg¥-ÃÃCÅ™gT؇àB®³18³x` ÿm\C‡ £ ðâì¡«EˆÝg±¨fXÞÙÇ厸R°‘ÏjGFFêÞ%‘u,f×ï‚«åø}ô·µCCCmßc f“аœþDÃàÞÕv  &ª™ž@9ÙyUL¶‹-Í°ݲ„×ö[œÎìè®wek\-Ü&Û2.†—ð”`ò}´™+±±ÚçÇaÖN¾°9_fvä•xî®EzXÚØ_Îü€Fõõ°®è_F’o¸é†f¶læ٧뙆l ÖéY–ÞÅpÈݶ´o‹‹Îú\»­ƒ#¼® [ìõmzÖ74!oÊÞζt’+]Ëz¾äöp²µ³9Ÿ´¬h5)9ŲŽm7Ÿ¡¾J»èlgmïì•ž_½i Á©öâ~Ö66vNÞɹŸÑêo£÷©{}ëZ%òt¶*\Ú‡}ï3­üÏ£ó=7Àî òÄ9ìfó-UÃâÄöø¯Ò½®l žò41o‡š;S¡k^V‡>O}ØÅÒÂáQÍLÎuï¸ç]ðrãÉv»7‚vFJ¸·¹¹}éˆ,Äžòƒ ò‹ˆåî,P@™ò†+Oø¸ZZZzë”ÈÞÀTu°·ƒ¥…å‰ëбÖö"È+ò£lÚ„Žç’eåÏ7éÑö6–vû}Þ·M‰_øêxüµtu 6ÄdÔp•`òïCP×ó;iTÖ øó¥Zd”^ñeE?éVPAû¡ð4e—íN£Õé7;Dßc3ð?ýî”uÚçÓ¼R“ú·‚¸·[R\ Ï~üÓ•h¨.#ù‡n(´" ¾P©èïN‚uјCÞ>½›ºîî¼WõGo§ìËK¼mÿüΟ^å •ní8Ÿ'F†·ÑДÒ×NIJR’’þ­¥ºÂ‡7¯]ê=ŽýØð3>6HÎz7(ø>÷Ö»ºYð{§Œ7ë2öùBÂëßÖ@¦Y2€Š;‰Ïº€?œ—?ÚÒ-KsMfÜãö?CRÌ«ŸJµœzñzŸ¬Ïº’]¿ p;ãbntÏ­I#mÌößHÎ@¿Ûž§'uHÙ´2Ôp?51&&æΣÓÒVR£¯Ö.m–˜?9õU­L‰Âç±1_Æק>Ý{Õô÷äÚXëçÛY¯Áõù˜Ø¸uôbÿ…ª«÷ŠAp5íò•ÌͲýŸÝŠ’.>o“9¸6Us7ææÍ„”Ìš‰_¿ÿÖåØyd Wâ¯\{Ù¾ò¯$ ×ÈDÒœ¼IxÁ—~íÙÏ(¼ùWŒ<.U˾˹YT sò¾¦ù£Åçâ ~cs>>NÊo9–¥Æ=ù}Ðv3%<÷ÄTÿÊ­‰©ê;1ÙíÀåÿûbÍBCž®kò¯MµÚÿh"·¡¶è¨InÁ‚ ÒÑ+Àâ…Lp¼&ÝVãô—lѨ…Ç,õ¢Qo àæa-æ™Ë7SR“/„ù©«³kЋJ¦Ì÷a²'Ä÷KÊQª¹ß,_v .‘s¹Ã ¯¼û]×Þï0¿ëCª¹çe3J¡1Ð7 ëâüýR߃थO36ó8ÈÜûn0Z_åXá"Ú€¡/™uÍC¡ço§Ä\Ž4À«¾žÇ^/£jÐyh¬õ›>Æöaé?±üÃ’ˆÏ-ýôˆFbüV6Ï“¢ ܺÎ把ŠÚ¦ö5ØTÇ«/«DÝNÁZeUõ²Ý÷5W–-0Úx^®žl¯¨¬lîF3h¯˜^ozo¥>.­î\€g~¼¿ºª¢²ªfhZ¼‰=ÒXÕ0ŒW´Ï•ží­®,¯ª©Ÿ\âí2„9ãM5í°‡LS]å2w¥©º´oÞ›å/×AŒªiZ{'ˆÚ«K‡Û%…q˜ µMkR¹j}¡¹®º¼¼²½Oìü¶2ÖXß·º8Ú]Q^^×ÔÅÀ¹±û·Ž[쪮©GãÌŽôVUÂ<_Bý …ëP7 ¿µ®ª¼¼jp¶„ð—gžeDê[‡UVVÀzmeù2|,kÝC…zýÃYÆ™„6dÝoKjÒ'ñÊ¥mŠâÕ(–í‚Í >úú¼ŽA༠Ú@Ô^pbà4Ó›t¢TkÜûiÞÜ‹ËÛðqݵّŠ†v9Þv6UN-óú[ëÊ nœ¥˜ü•¶†ˆ¹ƒSð Düªªj±¶ªtv®ÐÚüÌüªºñZ½ÙÞ–êNøL„fžñ wO¤ó þ0WæÓz(ŸISM£§)˜ž©Òñ)6pÅ'ti¸ôò‰M!˜Ók¨oQ¹,’¢ ÿN¨½ù‘›à¿ÖmBÞòÃÌ425#ëáئl<3f[8&ßÉ8án£B?±)ÂJíN̈¥ÁT–Nt ‚ëå —EX¶11q9mâà{ó‚1ñ ö¿½ìG»üt°óÍm*žvóÑ“òÉõ¦d"Y÷ÜÄØ ¡t1« šH¢ûž†nwàƒÛ¢æ¸=ºg ñÞ s—øÛ©ç‚\´TØc\. jQŽGÇ&Þˆ2d®”ÃCrøÕ9"U7:.íBð<ÝbT?Ò¥Rϧ=(éÛâCؘa£wäì<Ã$Ûú„¥¦&û:¸GïÄ–Âë&z¡.áÉï ólõI'žÂ®)q!ºÎîaö‡NÜù0%Z§ãÇ£3RclYx¿xØ©§(ƒA¤^½Ÿómt­çéIR·ëx<«jqG¼ézèÀð…ßÁq4£†89:vòSë*gè«–&épøÅ3ÎZjúëЌ懚Ó+åß‘.¼„#³O]¼´ß„n ¿«lÌ°‰„ýÁQi±öl‚×Øcªó‰ ÃýºmÀµŸŠ<,ãßSÝ‘GmMl‚ž>‡Ïwô>=Ab^IL ôÀ²'áÕu Gbžw5N{ööyêiÌ^ 4¥6f‡¯†;ëzü¤&lõ­ÓðI²™ñ hæ­/N.m€Ú~µ4­‡‘cf Ñæ–?-ðR¡,_d”4mr&ÁÑÊ4 Ût†¿}ÖœéQH‘Ö槗apþt½_Þµ)Ôádí“]ø$M"ÜnFåN®‹ÅÎ'øjdGÌlá@J¡ÒÎÙ?Ý5µ±Ô”‹Õ"_LŒ‹¡ðµsð1·’Ëþ¦ðËÑÂõ•‰ÙU¡FG'J-ša ¯ I“}Œ^áº1…òrhM±lEÊõТž]~6† ÍˆÌôÐ=x üW¼8G¸ÒD#ê."Q´Yë)Ñ`XKÎ2€¾v: z nø‹Ió=§SïßQÂîÄã9Çu#àóSùWÍL\BÅÜëŠÃh8-!hséqÈÓÕb´!KØsÓÙâ•ten|bq]Vˆ•  p’¡–Ú+èèæòÁò[G¬Îg‰eèõÙáhÒñÍXØòAñÖûxG§ h͆Jý2%¯I!hS ‡u𔱦³ÑÝ9¸“3ÇÛsS§“âÕgüVͯÄSÆ.§ÄzGE›T$Ž0ùF]~¤Ìãhupþ"[¶öûŽ%”å™æ®7w”Ì´â9[2Þס÷b¥õ¡‹_’ÿþÄò!pûàDÈÝ@3¿iõ¿¡0ç§K_gÙèÓô="vâÉÛ›&NŸ%õêjk´Âh£w:=BÎeNWJ3Ì9hî{4"ƒ6ÂV¦&¾‡+fàPå#º…ó÷ÑÆœòªq [Ú¯©‘6[Ô …C¯F›UéI mÂÙÔЯӒ ®Zû2†´9'ÎBúV´Y­¤˜mCRfNÍÎò ‰9Ä €?…6`dzh¼]8¢z;ÚÄÓñ|ªhJ¡š”öCÄ`\ë@fz/‹~Æ78Ôšô¦Íqið=•e¡M¬«ÙÁœš-B‚6K¨lÌLMóIû¬”“"`ÇÝ9\ÝzK€màsdý, ¹—+Ú®I;òÑ&ør¶6ØàI4)j·¹äEs=žöo Ûô¯v¼×Ô±“ ¨º1…ðá£$oÒµüWF^w .š¦W‘Yáhå_5µö¾,fáX&VÝna«&ÕŽ–ƒm«§Ë¦üëæîQŠ4)Acýæžf”•þµ/ý³ýu£óè˜àb÷S:ÃC®30uãb þÚò4lÛÂhóuzMnv¢h#Z›*mš“„ÍXªà¿pwÔ¤Ì]ÏmjRªV¦Ê  ø)˜®^*Ž0ÿQs¬­@hc„£ÕÃP·aÉÔüÚÏEXýÈ×ÄùÚ MmÀƒ)=h#Þ\=h•ÝmîÂ1…‹,¡wQ€–¸27É…M¿; MA˜‰KÜhRH­Dœ GÎÝ!ÚÈ¡ÍxIª ÁðëÜfÃo.«h:NoÙ“‚¼ä@Ó÷Kv»·lGMêXê;4û‰Ò(†N¤IµÝtÂx=@ lytö:(\•Að¸™jüÇYÉÁªå ó‘K’Z©Døp:°E¶#ÕÆï§ûdø˜jÊ[‰Á9=:áòëîÍÜV{õˆ„O³B™=)h@¸U¦Uÿ‹½D´Ýn‚¼Xo]ë#—Þ}üvé˜6ÛÙ$«r£Él½ï‘ý£‘ûzfzžw+ÑL^^6ѵ »•õ¡(ÿ€!>àA(EpÁNMëhü£µ³/í ÝŽæ¾|óúù#sJxN4ŸŸô8þ¤_F¶Ù8nŒ=xöæ«Â¢§÷â)ÚغI^eÚ1’‰{Ö³W…OƒÝôöß,ƒï”Hô#›{>zYøâQŠ›\6-‡Høƒ—ï<+…ôþ){½œ®Ônp;ñ¤‹ÉÞ¾-L¹|„ €·£lcζ:zó>ÔœƒF„ƒip3¥hŸ~\i¥jb¯Þ}ö±èÅasúÁØBdü­ºjiûÇdåUMK¢Zxç½ý˜—ÃÀ’?ŽŠv·Ë¡ÍLË M õÖÝœ¬ä‹uj¼É%¸ìm“Û(UwCñNw?K:ïe¸Bp»˜Ú˜‹éO>¾Ë´f¹]yî€6µÏ.0L=òž¿€–‚÷×ዦýÜœºç„»È6°Ü_ŒÑÄ1M·ï€ƒï“ŽíÓ ?{)11!2ä Š¶Þ‡®ypëž2ÙæÙÄ ´¯»(ãåy®Áò]C=X–ænW2òÞ½|hCÖºX‚âÀ˜YûÈ¥Ûϲï8°ñ—_n•mÀÞ÷ ŠQêã‚7ÏzãBÃÞA•)‘nÊ;ƒMç0½U)ùkS¶ALj«!ˆÕÓ¤àëñ«S´T]üÃbã®×Á©ŸËü*»Ž¦ç }Ák3ë9ÿJ*•ˆ7žŸ‚Üþ ~x–TÒ$öÇûZsëÖ­ŒÇ¯×@ñ]Õ¼ñ¶1·bÿ«´¤ØÖqô 8Øôöv^Õ|ëÇ'·nÅæV‰€¼Ä ðÒµÐù!!>>¿¾â±ñ˫ĸ[·n7 ¢åWÜÏ,…7‘ñ¯WRŠ^¯={•žö cV<˜ûk?ÜŽ¿u+.ñõ·éºÐ[ý>)îV|ò†Á´&£åÉ qˇáMR?‹”j¸úcU÷R_öÀâÓ|ONF2Ü®œW ‚]ì6&®ª:JònÅÆfå—¢¥¯S +Ç6óåþGi‰1·â +{¤õYíÿœ˜ŸW7Ö-16&1íAÏ —ñ2]—•ü¬úùáÝ„¶±UiþÜẴ„ظÛ÷úÄwq‰2­ãʹۥù¾šw‰±·Rî?Ÿ—ª«C9éI11ñ¯ËÄ·4Ï4g§°» —¼§çι)zµdÿ~ $íŸxAýûËÀ΂ Qþ5¡ùQ|àµJdNij%Ò;¶Ü4~Iï¯þyˆÝßëãd†%Ñ-,-ˆ8Œ…GÅ‚ì”ä914Té~kÛ1Äq†LÍüÑ¥²ÅæH``ÿ‚ä÷ûYèã‰::Œ­×1ÑÖA<΄—­™&žÉÄk˜ÚúÎÁ›–¼„“îŽÖÞð±@´ähL³vñlàmô[é`H,^ÓØÞc”¿e`¿¾q˜©… ÉꕶþõYýð,pâíÙc"`’öý!~ÇU+öå’gãl¡·º]ðÛzbc¢9ä‹߷»2CÚV…?u¤è¿ì1âÿñnc¤öäôâkNóoUë #Ò°-醷vÒ#”õ_‚ø·-œýÂ8t9ÁÕqÿ"(p¢!OuÈŒkÆ*G^ÌBSúŠÕ#qÓûÅCD“@é´XAô»á‚M)]ܾ&õw8sÍÚÒéZÈA—ÈÏËå' .â÷ÓÃí¼Îç¢ß‡N·åOõF™˜øŠ},3Mb?£ß ùì|R át‰rÝE 1U »/>–•¤Gz''°V¥ê[œ–fž`•òNzá†à† ñã‚hô—ÝÝÚ]„+¹Îù`²‚ÖN²™lª&ËòàÝ­ Áwvµ€íåm•0ϱÉÍ¢%™Z;ý*¨­âš ¤%ÍývÇ>à¡âßäʵÐ4ãʳ^ÒF°Se”ô)Úœ>w=Œ…×Eø%og´bÒÏ}Ù&ëŠGøQvÚסê;áfGãNÏiajxÝÜ6x¥Z‚ÐÆù’Ï‹²÷y¿xÄpŸP)[ï{]¥ª^kGçNfki@Ÿ©y…¢`â9Q7Y—¥Ùi®Äe$Û‰èöXn¶M4=Ó3?%ýÓ•‰«_‚Wöÿ®f áÕׄs}<€Óp?½ÞEmÏ:÷ôË·e®ù˜«1™Æ RXqËdцÛ÷퀕>­Ï P}£RÅêçzßI7S(P—A¶:pf>"-xvóÎ42Ô¥êYçU­6°tè †®††Fï²øôü·´ÿËð¸=ÿ©N+ypÖm¿«9ƒày*‹ÖD°œîK¦ë²iþ‘ÓÈc6µia5 ‚>ÞŸ0!SiÆ–V‘¥snFª©I‰4¬Æ¥ü)¿{Ú‡DÓ1ÖgšºiFfóèûÿ®f—*Z»v“JÓÑgQZ‘’Ÿcu N¼?rð€»›eþ®kv»&6_—ç¨O×Ñ3 é'óÑð•®BW# ƒÅ ëÛ4Œ¯T?eBÍdêÙ»ùAL àÕ¦W¨ɪ˜EÛ»>Óª¢…›l²jÙ(÷Œ ›D¦›˜YÞ¯¬ý›mIc£¹¡5„þÅü?Þ¦”3ùŸ…Þ^ó8û¬åž¯á£.ÞnhÍÓ x}G£S>WÔO-nYU6šXÚ4ø¹^N-IM¿S´MºÙè·Ôs)g™žØŠ6½:{)M_Þb+J]Ù"Ћ®™¨.ˆAk$ ¯ÊìåmE›ÉDöÙÍDÀZ]yÙû™úÆ®•óòzÄø&ÚàR!Nÿ Gc÷’]¶ß#êjî‘ËḭNäcä8§›‚¡Õ¯‹Ñ H9ó•¬þdÌåfxª~ 1±N{Ÿ~»ÕΛk%ÑÙâ솋\‚’¡²Ÿ·9ߤ”îÌt(öÐËŒt8[ ®ôhc‰žwÅ^«>øÔ°<ö)é€ÉA±ÃIa¤=~¨wuj º•Ö6,ÔzÄÁ××™mà›ˆÆ¬ÎðÖsŠ'ú¨[^90^¼—ì ñp±ù¶»×ô×Wч¬#aq«êžƒmâvÚýÛR˜¯wN ê<ç ¡"ãÍëi‘ž÷Ã|´=PÓ²Ÿ†²Ê9êpÕ¤ tÈõã¼—g8\z‚fÒñÌO×憹>©¬oܨĩZ! ÿb‚=úVŒr†q¯Û <ú*{g6”³øŸÅD,\^„z‹ÏE<‹w“müXê¹îïhgÅ c :.ÕÃ+¨u¹ô¬¹î™b4ÁÝ£ÌÀ„z¹#hÐk«°ŸèÊäÜ´5Óö°º$òÇÆr„6K[‡Oק«d¦IûàèèP·‡¹I›Þ¹¶m^SögnÊ0‚1;'G;GŸ3ƒKòGyç»?ôœP?ꦮ>P„6;Ф)Fµz^VkÙ”m –N÷U—}ýüõËkm¯Ø¿çŽŸ¦ŽwUÇàÜ’ø® Áê(›Bºý¦f|jNúp}un°µ÷m8‹‰\"ÖinÏ’ Wñx¹GÏ´îqsKxq4ˆ´/êËôBócïɪ†“²’œpÙœH­D8àëÄH{׉>‰s’¦v¦šŠ5V¦ ±…»‰6 r1HsmeIIɳó‡¨>°wPU¦ƒÅá\ñNBëEH1Y0Úß]ñíË—²oGõT/~欌|¥²ô"@–W_9øel¢Íœx®ŽÙg¸GÈÚ)RÂhÓ¿®|Å©Z¢²Ë\s2uaפ1†&û˜’þ)IÄs¦Ñî´Ë¢è²¡Ê±WsÛ­Ÿn‡ôìà7K€ }6ÝÄÆÎ !KSCzyÅÎ$#Û ªª9â1Þ|ªÃtÒÈT*KÛ.–Ýï’-ŒŒ|Ï®¯×QUL'%š”½_úç` ‰æ¼ÀdÕ;±ñ¶$‚H Ø¢—!1*ÓHÔy>`Áü€Bë¯@›v–¡#{{S¶¹êmN·:˜WT\Q]yÍRÛëñZ›®’‡öL:™i0…NiÞði[]Fƒš[="‹6P K}rqÏ"·<–x9y ¡ Ñ`NÒ¶§½Ì®>…€ÓQ[›­o(!#ƒ^îhãH{øÕ‚—]5´o÷KƒQ­}¥s›h3YzDcÇe½,-¯Èö¥øÞBÐÆÞâX¡8Eëe³øÈÕ5ê%Š±{´jbÓt]O¼þø¥ª®ú˜®ÊÅ/ÜùÞ—tkmÀ]Ñ’‹,ÔS+9ëƒå¶øh•<Ú@ÝË›§Rè]«‚¹‚c¬ˆådýç'A¤Í5»gsn G U1C H°’w7e•/~9kܨ†Ñ„tí®dÎeEŠ‚¬æÑønK ڀnjT2kÄÞùs5—©ºðÓ®š—H>ÅÂ`uG±ÅX"Û ±6´#Èa+pú”·oËš»æJidå­-œÁJ‚Ž)AKxö8zžéW Í‚AåÛ¸˜üõµ ‘mõÕµªÄPÍÖÓDÑF¥ ã½í¼c¶˜`‡žcö m¢ ­ùº½ñò”›8äòm´p:1&ú9ºýê¬0æÞK5Y„ÝbÑUŒ6üóºjÇK8bÙf£ŠªBë\£…ÐU+h†_o£îŒ6PY’N@n-G›kÄ\ò^H¶áŒUQ˜lžåÀ[‡%J…hS’trTvÃc›£/£ ’Å×0¶ã½þPvaëœr®þÓˆ0üÙ”¤ÛK<÷Øñús(dÚãtš,_8d̶ Dìÿ<;ÙìØmÉÜÝ9í̲ð†Æôcª÷³ÙLJn»X!§áYúò±ÝÑæKb0ÕÙ$ÍÛPÉq-ò[¢ y'ŒìÃP0±fãŸ6L‚rVâñgD6j%#ܨûO¦£3/f?çŽ4R›Û2É—ØmàÜ„m× ÞbsÁNh³<Ôš_\#¹ßÔõòsDxjÀbXmB)Ú,ÙàUÞöÃvÆZ™Qmãa­à”éµwâ=÷Éì§/´ÜÑ7 –hf¯4U­ &U?=aárYRH¿!M—Ž·EçÙ2l·1=‰>#¾äÀTÏ®€§`yÖq]û 4AÛý ²|EÃ|SÁgä>@áŠò‘eÐlË?Å2;„~? u "g'Åh&˜b3ef©ÆÓŒAp¹²ÚÈÙåtH¸!DS,Š;a¬‡ 1Á†xæ-<–+öi»@ñía°r«¡ Ú€óŸ úO‘ÞÌ‹qSŒ6œ2ÂÝA œ —ë #ÞuQ¼4¼{^3¼®œÑÿÈ$ävhªìZ*Ü<šèøêïh¨¡¦¦EdE§À·Î¢Û™Ü™×NÐñZÚm ‘ÿxŽ ðÚÕ44G¸Y9Nÿ—¿h0 M<ÕL“v¡b7´A.iùx/š¬¥%ꤼmåáê>ºä«©‰ÁRŒ}í’ŠåÛ÷¤`YŒ3tÚKK]CK çugQìo³f‹ù¿èM+1éH¼V&ž€àÈÛÿ¦j±ÝÛ¤ýa”ºM¨<‹xsñ'Ý0ÚÚD¦E~-œÃÌ+׿™gBÅ´&S †ŽQ«æù¶\5U­¨ª%`eøÜa;"D$òˆäyøYÁÇûÑl D"èXzíŸk lí½D¦i^Ô~sû›¯$¨×£I2ìhȳѧk«cÎg}¡5m|ºM#`ÉD¼ó±jÓÃ÷˜E+[{'HUCÛ%µÃÃB3£xH²‡Èÿüð2“B"ɾç37›1$šo¦ÅYG&Ó|¢³øk6 ‹ã©õwLØ>âm&°éìÿÀ… @yýô[æYžÀÒ·zZ5ÚöúÚÞ½˜ô>ˆUÝ!.8–eåÛ0 ‹LÜ‘j–Ö^Û^ È8Õê±-ë²£:ÆÄSš¥IåKlè‹ó3Ú§Š‰ù¶‚ÜU(ôÑeyç´Jré}6£œÑÿȦá-¶½í¿+‚ P‘Ÿ  8+yßÚí ee@¡“ÊÎÒø2²M~|Å©Å*<ïûf ”•mdrÛÁu¹ø7ÈçÔ.­À—x{ý¼Û»­+¼ µ?üÿí}X[–®úu÷Ì›yÓß›Ø3s[%‡“9'É9+AÉ("Š 1aÎW ¢˜³  "b"ƒ"HÎ'§ýjWÕ9’ÞØ}oOýŸ—[§ªö®ÿZ{ÕZk·ª‚6¡z›±y]ÀnG£Í•‹´ä Þ÷p9Ã[ú…’kôî—zmá¡´È0™=Æ” 9ôPbÏ&µÂ)pw÷ã“9/Äœ&ðy-1Íy[]}=_òݾ+È[›Ïï‰ó@ÙF)|Ç °/?x2!ZÔn¶¬èr­¯åÅžxG»¸KßÐ"Lô¾öúÓžß«ù˜R^[ù`o’«íê¯g¬îæ±Í É`WQþc›àŸðâ_T}ÿöÖ•ÖÞ›ïhºØ<¿VH¬£|‚Ö ›6f¬MI„ž ßâ#ë×gdì;~íuõÄú´¤7ŸÄŸOvsoJÖ¶CÓ?e…tgFFnþE¹æ›]Ø¿vCηËõô«›Éi™7ºí"ßœ²v÷Ékà,Œ&øý©v”_X‘ÿdJú¥r~Á3ý§Öàß³˜?‡×þ,ÕÒ¼FøFº¦EÝÄf7Âb*ÇÙ?‹ìNà÷‡;GÓ˜dÃÜK=?õ±+g0YS‹º/‹kÖjÙïùé7øíÖÞ›j¿ѪUÁÈ_[sÆ㮉ˆ¿qÅüyÎh­¡CHe…Œ—䥘²f6W^à#M©žÏ‰ã°˜ö¾«ÛGg¶±m¾íeÍe²-÷AŸõey6&t6ÇjÇÅZ e±l_œ“Sè&M6¹zp½›ajåv±ºk.³|ºFÓÒ¾ÔGLú_0XxX ¹tou $RÅßRÊ?hù•’ &‹ý9¶y²NÛaïOê½¾`‹‰¦‡G'%ߪòÏKÃŽbì`gÁ\Œm¾U7¡î$vœèí§'9A»®4aÇCï®™;oBŠ•ájm“tj‚/˜èzÀÓ38ðn3±Çí°áÊ$Ÿ?\š®gö2=øæƒkÞ16ÍçODÚ˜­+ƒ~jw%Ú¤‹ÄB<Óžéy†Ê—tÞ¶$Ñ"â×8†mRW(ÇÏÉ"öÀ¸@0ÙSc©g[%Ð iëÆb–lóã`èÁ†Ð=MåûÓ<3P pùı­)>¾~ÉÙGQ¥­">ØÝ„Étó\‘ ¾qI‘~~¡§î¶`9\Üzü^×Î5‰§Q»¾±×›âÃ}|v¯*o^¿ )ÉZìå|¦¢—`•¢ã9iþþYËÔ2m÷“’èßÀ˜òúAlTï[ºîU­è¯s JSS^ÂJÿ†Ð}Í5îЧ¦‹^a‰JåÔ\¶Aó|V°ÓßÏ/yÛ9ñÓtm{œm:FúøFœ¹ûnæÎÿ°=-Æ7 $¿ôÉlú…½Ï/Ç„ø¯ºT‹í”­çÜ’ FZn{{F¤lçÐrý ¯Obö×U†_ßZæïYP…GäÞŸx­®#k•ÏÖ2˜Ï뫃ü²Ï‚‘îÁÛ‘f¯:½ö´$™¬Þ°­¶ëñù ?¯ðØÌÎi<ÏWWò‘$‰¹çÀð]÷]#¯®Û;Øryvaqe›Úþ‰“›WûúæCç/¥hÄ?(œ?ö<,Àó jæÛQU´*Ø704özã°úCsÙ¡Í~¾!QIUíSТE<âïãÆbYx¸y´‹AGMñªP¤"!û Î]ƒ >u Ï⎄0_?ÿÈ-Óø ²‘C›}|üÒvœÆnl?omfjëä·†©ÞãU:¤TŠ·m\Û7…ï‰Y¸Õ!<óº|´•ÊæM)ðÆßëuvÊÅ•ä£íøóߟ1$… Ø`¼®·YÔ$Ì7K¡Ó\Qã ´ñò.‡PõÎeò¼¬´Ž)vç­½®ÞñÅêÕýœèSɼeÛ_„FŠĪêÃèý(–]èÁÒûMmÈì 1!­=u¿­½õÎÙ,ºMP¡ì}ncd|õuÏð”üSC!n^Yÿ¦õmcœ5#¡°ÉáX†­…cÌ嚆–^¡r²ÖÄиøQ}{뻫\Wl@mSEƒkEÈ–æ÷}}]ÏŒõ®µAãX Fò©»¯_7J²5<‰ «ê3™,§ðo[ß5>ö¦æÕB›®—…û7~ ƒ9È{i³¼ÔlãjE…“¢§PŸiŸ´.¿éM³R¶€lóúúF¦™ïËw­¯žß÷ö²1p‚A0j.d²ìƒë߶´¼~Å5Š+@-f•ÎdÊþ«OÞ¼®ßìÏÜú@s_W”ô ¨{Óòîe?Ýp{5j0ß~Ða‘sêîÀ`ÿÙµv&®Gï5ö÷÷&¸ð²Ê¡ubó|º™ëÓ¦ææWÏC9ÆoCÆÞ°ÒÜÚ1öƳÆÎAéPí^ Ù®æå»Wµ×C|­õ-×èŒoƒ­¤øUk®‡Êª> \ß›Àö…ûw÷?Í£Rž Iž] ö³Ñ·ÊYéþ—Àm>ôB¶±ä¸8…Þ©mzÛpߤ“WÍâ!íã•ZÛÐ0-ÇÒÙ®+ë‘vn¨ô¤î¿qm ày®?ò¶¹¥©ª˜©gòLˆ,dä핹TzDswOïݽ‡¨ú7Í-o_î‹1sÎ~:Ë\fø‘™™r¨»¯¿£é&Ë˜Þ ]Iû|™F›Î?joo½v,é%S*%cCñ>Ö›OÝú44ŽÔ/ŠÊz-Ÿ«EÉ^¡»þÊÀH[9ÇÜG¡Òà<Üï´ñ$Ó¡ÆF§?ªÅ³;#ƒz>¸–{£—¬¶rÉ›±ú~qi§Šm”sÔ8û| â Tú±$nÂ’k¸¿ÃØF4Ú±nÃf Á6?ÆFÓ˜¡ØÈE›ÉÙêK>lÖÍ|èél`\‡Æ‘Ùë¦u ¿5ž4µ\¥žë¯Ž¦rã‘܆µiw¦Ô‰+èZ›üÌÉ\kk3&Ïw­&³h°Í¬UJ¡;&ÉTl¤¹Ñn(’áló%ÃWßm¨+Žc³èʶÏÒÝ ƒ+ÛØ8áa¿ÛLøòñËîîúK ^‰Àñ ëÄý˜JSšÄešØ9«np6^®Eƒš».fDšî¾ÔöêÚ^Kÿ„ÙeyoO2¶ÁS»¹8Ûsùfñó؆†±ÍRz¾3ãl3î§opâ>`•©¨ÞfÐ^KÿÆ0î°)ŸnàÐèCp&)ÈoÏåEÚ©×ÉØÈZU6W[C}t…h?´Œ›ŠÍÁçyv¸§ÒÛíþ–[¯"²¢»‘¡¥“›*™½¹W2£Lw–¼Co®¢’÷¶àV¼Ü¿Ôlí¶1v9ŒWyàÖ2ŠÈ£(äýmx»Èò–òÖÏe ½MQ®}dN%Â6TºI\tÙ‘I¶êvv²&‘ÍE ÐP~˜KgºzúøزHÉèN²j¶AÞ¹±¾†úúþÑi¥·jæqEØf9ÅCíÕfoÁ|Ô1]É0·R'¦‘ñZtót5Û¼º¶cE\Z<í\†—©gú¦‰z}žk¦vÆ}žŸl‘zAÜu(å3Ž˜®íš1Pžão½{öèô±x'çõåÊd5ÕÈK¶1]’pÓeeãÉH¿øž> ¦¿»:LÌÆ6'±ñ|oO²cÆñy·¨Ù†EÖ;4ϱòx†UÒ,–¦l‹53ù©p®^e›îYlÓÚzû°©wôlñvÀIO·J´úzÛ ç\,©*¶‰/Ê6S!ÆzÚð˜#Wbt ÛŒ¯Ð×.Qy¦Ë'kØTòÖ½”ê²­h¾ºÓo¹ëëÜåÏ+Â6&j¶9§f›78ÛLøèÏ3üEØfW)¦õ%0ɹ¯ñ¯-ÂêíËxóØÆù&Ûˆ€b ƒ´ý­ OR™½Ìü›²MÎ6ŸôtŸÍUBXÑ Ÿ~Â…—½ŽZóØÇËG—‚Ýx¼5å³&ãl3u5k¥Ûö’ùCNÍ6'WÑv¾©\5ä¹>l—ä“ê1Õó„if+W¹8œËÚ]†Ü¶ÕJwS óä/Ø:æý€ï¥¯siHå!iâ*'ôÙlƒŽƒ½aöqùê8! ш™êíí…ÀÛNjǤ#¯•WMñÉ6J ¨=®Í WiùÅk"¹Rs%U¾ŽçºßÄY9Ù|ïy÷l¶mG<)>Çñ!+þtõV-®·™Ã6¥ÍÒ·út<8˜®%-§|DÆ¡-ëîg7Ý÷¢¦ x¹D$” ¯ò¡':',Ê tZ±Œg%jJ NìjÀíó³ÑCõ6ÛiÉÇð“Åt»äãw¶j™%`\ÙWޘ톌F©?-‚ô•DO;'4T5cz›Ï³ 8ÍŠÜ…¿4¥#M¯úg³ (¤:lÁ• G×øêY§žm”EPœs^`çÅxéÙà+)÷ˆÃØ„úÛ€4Oê6\¸“Ÿ?iŸò×\CV7J+²ÞJº¡QâUÈ’2„mè±Hó6Ý¿Pñ )&ºÊÙ¦!2%P7ÎBl3ίܭe‡GÙQŠ/_¼Žé@2‚íö\}‰,=­ Fpm»òNº­UÊìÀï’Q+:ëaÖ!âp+ƒóµ°R E1Ö¾{0®kÜH_u#kLµrïãCƒßr‚Fq—«¿ŒïrËRçZ±ÕÝlõ¹Ï̈DîW×Ç°ïïr¡PH˜+ÿH² ‚³ë½˜fÖë6dxðh&éRåŒlýŒ':Ì©ts¯U©1&,F~E'Æ6‰(Û £FêciÆq È\ŸlŦÄí¾±Ûpw—¡~w·?‹cÅb³²nv cû:›Dq ML f°ÍnÀˆ3àfš;ñ&;e;š{§œ;{ÄœfgÍ„®ÁmÂç± ß“¾üò8yFÞÞ 2Xž‘ñANì='bõìò:Iºî1ITßÕi1þlÓwªÀ7ÙQ,s»è?{º:nEØð6Þ…Ïþp)›SpüÚÕ¡L6÷ò{¡ŠmRfØÆv.ÛÈž›¨¶þqé‰H5Ùçߌj² ôHxÊf³ƒ2b<¸ù‡µ¾$Û â¿¯É*8qCô “ÃG´PÙ¦õþQ*Ç,zu‚Ìf›œ¹lƒt“´í2R·ð¤”è@:›w{žq±°ö_µ9-’¼å~þ ž…ïå.ÔñXô€€ÀG¥ÈdªïʤuI«htÖÆ'®¬v宽¼Û ù îLs»ô nfTs÷,*{|@6wñww°ŽÌÀ©HÖÇã0]Ü=½0xzÄe‚LØ|Á„Í\á`Êaún-Å…Mùx$—ÆäØ{ÛsèTn êðò¡â8™Æô‰NM[ÊbsN4Âv>“½ÚÃÓËÑ΂cjæíåé´omMèN®êE¥˜3#ÔZâéÞZ‡' ´Ä? ýƒL8-̸`+"¡`zzš/*pçZzZ® ›¯”KùÈïéi¡XŠ¥’ˆøBñÌŽí@! 7Db¥*Oä§z.N‹¥rìyس"‰Z¬•KÅhêi±% ¦…ìX©¡WùR…yŠ )–B:5-T—_ý ÊÍÁ—Ûd˜ä, áS„b¥\<ÅÇø©Ä—È3_À•r!Zz‘çäõÍ©”$2 V6V6(É‹§¦EX† ¹„ÏÇW‘r±€/RicÔ©Tyª[—ä¥"´xiýž¥Vð-ŒM€>öŽªÀhMø³°$"‰´nçR›lìMŒuÒÜHÉTsÉ öά.Ðlg>ÞÎH29ZN¾I«Ka ½.B9”!==u½DÕ8ªj*dê²Aéël8 øà µîSHñ|DÕúFQC ©ÊÖT?D« Œ•ø›é;ø:Pë(¡£K3×ùBzÎŒNO©,ˤÇ|xÄp_„¯CèèÏAÑ÷©j‹“+®-?çô‹I>Vd9»'aÇ{V¹î¾Bt÷ÙD'Íf«RI¨‹ |V`S~Æ4ú'UNøò?›K!ÓidRPêÞaÑܸP!Dx&;šŒ& ^»TD¸Bÿ8}3ï;$ƒZ“'è$ @€ !GN t¿x^Û=øS¦TÈêëë…²?Âp‘J~ß³†ö＜ ¾klüAd •(õŠTsë¾oêüÆûÐ)§{ž5vóôçF*‹):¤¾¦†A«Rn>þ¢xÿ÷ÿùö‚²½ÀÔkë·Ín%Ïf=h- 0+U~f]öm¸ãêJz½ø‡¬³R1E¢Ä¨³Ì´5¾6úMÇ’âÝI3ß]ÄþyŒo¹T"UÈeRþ´u2©T"‘H¥2œ?”=ö†¤§£@&G¿6*äØO2)<–JÅ|>º«R!EoÊp븧D-å4bçñgÉdêð×HQ°üåªðHÙ$ø÷b…X"UBärB.–È©F$)¥sÙæ&Å¿‡*`ÆRì*þü’Z"Ö¼„T)€êIRX6-Õ¢öq­ZUoX0U#È¡W!~¬PÇ}R§Bn°ŽHM|Ìl`&‰T£šXaÅóM"ÑL¿Î·òtúT±ªÖR܈©¨\´îô´û®¬ª‹Æ×yUw`'Ñþ &3ë¦eRÅLE<ʹâr ©¾º‹ÕyÊeXžR9jƒœÞc°¦¥èwû©§d“•*aU>g0hVû‹tžX"#&òÏC7#˜+ÏYñìC¶@K¼Â¬@–™UFæ:K Ý%zžØ»ÁŒBNÌʹU?¦ÞÛ2˜–¾qëÖ²YÌÇÝÐÂøHªypÌv¦¹{Æùnd(ÙY˜¸„lH[eB!ï½Ù…z. Üc«¬6î=¾g­¿±±C+Ê÷³Ù¬èèH&›³ýŒÆ üp×”BqL‰sçXØõ£üFŠ3á<@=´˜3~RÐs¡m t]б‹ÏtgÇ¥Ï81ú¬æ‘Í _.ÅØf˜7÷'z¸ú±\B0Ö8dA2²Dm Á£“ë‚Ò¿. 1^soMØoϢğ«Âd|V£†ÏrF°ËÖ#s}‚)™²úh=f¶cÃcl sÏÜw*%ÐÕ48ãlŠóž“g׸ÐL‚Ïb…ß»‚e圹!ÙŒL F-EUIäc+¬¬‚3 ™ëž ‡k».%šclcÁ|Ü9 Þûýê=ÝaÀ°:ºÊ2ûà©]Ižd’Ëtï `™˜Ú¯K^űI¶â1ž}’xrwÕMB¶1 =ÆeYÅÇG™°èëÎAŸú+ÛìÜcÑÍÜŽASÃÕvlßÌô8.™œq:ÇÊEŸ,ÌLœ£Sâ‚ØTò…Z(Ü>?•É¤±“sv\îex;²í<×¥§9ðè¾ñsÍä’ƒØɱI^k¶Ü¿™L3+E÷%½8dB#‡'¬u³e;G‰ mÒDNšƒî¸%{²~j/Úêµzs+Ÿ,9 Ð '.æþ®ã•¹~,®™ãÚ¤(®]Š9—YÿI |¹g)/ƒ˜È? Œ?ŒfP­Qß\ ¨;©cŽû׊‡¸,æë1Dà°70Fc€«éné¸çÂð½õ¶Ð)øx¦ƒsÔìdû1ªÿ lN‰ßê2ƒ áºhBeîkÄwŽLò¦æßü(íª0d¹a§Cw¸¦p÷çL_z–j‡ ¦ÓÜàó èoŒ›-殫M»Šzo-°’’urõm ;´\dÁæÄX›ÖöÀåú­i3×·èC%[N¬ƒÅ£vh »7ÈxGµ¤»r›¥ßq ¥1;àðQ3OñOÜv×Ø>X½ºœ ç°Ó/ÈûŸÒì°H1¶–œíв·fÚ:;j`¶r~ ‡Á“€‰»Y:Vi˜ L1öŽBãõ*€¬n-Ù€Û‰ZùO¾(Ö3óÇÌÝe\¥º ²ÍRS”mø]FÆÌ£ïp3ÂJAõàÔó=^–'¿³Ô„A}öaL=$é¸bέ¥&¦î´íFog.·ÙŒ\ßëjãåÓWa䞇‰Ò÷wõén0ØOåI4H‚†CI¼¤ƒhU‡¬ŒÙMèîædêG¬±åã7oV͉bŸn¾­;~–go±æ>ôçQ¯6á»>l° Þü6lk>„å´?Év÷MèÑR¹ÙÚ.ívg^”ë†Ò:þ“ÓºæáXƒO¶]ä0iýEÓÞ¥æÛül؆ê°'wò’M|W–\,¸páBÁ…sÞlö¶ºa ?©éHŠ^ÈnxAqASפC}ÀãwU`¡ ²¬˜.™G Ñ[JŠŽòtiw&pÏ…N1¶A=.µ¶Ü>dæ 4w ý.ÆzéG.¢Ùœ9²‘ÅtjŒàÅØf9cÈõ6Çüw¿VJ§›™ÖYïúo½× À+}d@Ÿ !ç4ÊâN¦Å†–áÊ›èµÕ·éAÆÿນ#"¿—­²¾Ô:faÑ®/Js¼¾Vç|8ÈÉjMvZÛ‹…§ìhg{±@̪îI´²Ÿl—ÒjD¨û xЄIóñ~¼¨ôb4Uaá ýp‡ a}^VîúâVáé*UŠÜŽG›Ã6†ó>•iwŒ/çäýž¹ÖQUId6¦4È6“Hº®C*½ /è¾4n;°Œˆ<ëú'ÿ´kXìÎ]næv©yhÏ_(ºxÂZŸŠm÷àÂÞèÈð   _gkîÊ<”Œ¶y —ÝÊ$†½whÞÉ’Þ)Å|Åqj(wy+VζÒ^p!¾1£‘œ.D{¸p׆h[ßø:jlƒÒˆÐ—Ì~YOÏ0ÜúJ®™mõ©,»¸ ²S2ç2eÂ*à'Ë6*?©òíñVAkÊŠ‹.¢()-}üQ0+â„¡ášÃ%q_,QhzeJ“M™ÛN©2(*.*†»®-qâú^ ÿøÙ_7ÞÛgŸ¹„'.*.-½¬tñˆŸñMW3Ý×ÞªHõ9ûŒ•³WÉ1Ñ-­[ïe;Äߘ¨Yïq¢ LÝd…Q¾9CF•±Š©T“XaFï˜{bÏ7IOÅ1·?«Õ—;}ÝÒv•âµ-*))©ÅÙ¦æ=¶ C؆^‹Î"¹x²öq\uIª´ôÙ²]Vµ'ÙöQ›ÕÓÆÁ‚>—m¨ýª2`lSsv³ctŽjžÉmyôùl3£%nË_ÆAÙ&Ï)pã#,Í&s¯ù%Ex©Š‹‹_Og»½©.ëZº'3"g³ ºáEå͹ëM)Fþé‡ç ­ÔP“ükøw4È6!…@ò‚Ka½P¬ÅWn?šÅ6g½¶a2Z8Éhw‹Bó£Õƒ£ë]v«T: ÓYlÓ|÷À/[Ž@‹‘Fèq~úlÓY¼…ä·I=ÿGÆpÅ…Ê|Ÿ»nlñ€Ê§H6úòh°òf Ç~g½*Åø8ሥ-£ÏKŒlT#iºèìYäÖ(Þò3/*ú‹@s?Feo…ÃC‚¿¸¤Ž¦¤EÙF#æž°«ŠívÞ—ñh )­Ä‘åyjklæ™gp÷¾`Zû] `Ý@V!2w¶ÛÙ¼””ƒ•XÚŠ4NN4²hé8—–v¬Ð—bÓ¯ÑtÏ6{pRÔ1N•£C˜¤6‡mži²4틤ǜ˜iäA¸šÄØ“ã:nbx¯QռߒMùÛ|è(ßÇôMR%é3gSUlã6üMØ(+Òly¨ë26‚ô·8šNÍ}‹‰.Ì å¬ÂØfÀʘÓ$ˆ¼ØÕ§ŽÁñÉZ‹V)üÛ€ +–áëa9&ÑÊÄ|ìÅ j>@ã$#Oº»9,åV$pÚÛÐ÷8¥¼½òFy}w[ÉVÐz¼š²¦l!ÛülÙ†‡óc­ûº¢³««¾¢X×Ó=-Õd›žçgèL‹'¯[º:ZϤ80ÃOÌf {Ì12¾\ÝÔÕÕqã@¼®M‚,qâ£QÚÎ0ñ Œ ùpNvmhí s¦—¿áñßÒ¨&Þ4¿zbá]n£µ,=ꩪæîÎæíÁŽ6ÐÛü¼0ùt“ûê…zI#Û—ãæî–°å#î„=áäòš¿R¦ZïF®p_á‘sò6z‹÷„äž{5#ñ7¤Eùº¹¹¥î8'Âò¸{øõJp¶Ù“áwêvª.Øëáá±vW¡Ú¼½ò|ˆ·›‡—ßÑòz,Çʉ¾Û®aÇS=5á>nnž¡UŸ”©‘ÞOº¦@ÿM+õØ X)òòöîñþ„+-¯¼Å-8d­ÚŒ…;xº?ÍnÅzªúUÙž¾~™rôRÝÑL»kù*©H.õñö.ïÆtBâ ?ûm§`nÁ`£§¯¿@Ž¾žù›×„ •ËÌWí¸äYß‹E_ ³ôx‰¾¿å’Q_/11šJôq[r„››ûªu»QÅ2½Úå~J¡z+ó?>‹ðq÷ZÓ*–ô¤šE–þèCØãä4¬b›¬DŸ’šP:üð$ÜÇÝ3(¾MlÍéµ=°×óSÆ*~+뾘~[µ`=gí“‹´Ñ£Ó+Sö?›YÌN¼ÛˆÔ%aËq| Q¥87!ÔÍÕãàÍ„À·¬ò^¹ù4žôòòÜ|½Gò¾:5*ÀÝÍ-")Ð$ÍÞÞÞãè›eÇ:ßsßcÏD °ö:V€Ç÷úzºyú‡_®}m{Žð~Nœ?2\£‡UVGp°½»áëéîq§ugâÎÇaÞn^!‰"€¬¤^ö •Íg¬÷™À{"ý`LžŸcÑÅ£WJÊq»mň%“Ô2ò%=„xärÉU<\ªlÈœIéûcT]ˆ†ÊŠ¯a¯…ø“)“öaRN upH5ìV€"žP¶©•}ff:ËvØ||ÁH&É f™Y;ff®33a;n}þ]—a5·°x6Î3ךš°]¶UÂC›ï3© ~]628Ð××782®ü:OU’þožägÚ2J…t­æÐÈ8„6˜ÌYÌu¿urQ)uÆ"Oùû-ç÷|•ÍÎg‘}è5Ï+¿MÞ 6¬æC¼uvÊù…Ò<³@Êïã’=«”‹ŽÙ½¬á®\´wæ_úüóßl\¹X/}¶ÊÊ/ô? >•y/w=7§'ªv2ƒo/Ú?èy ²ö›‘ß_l‡ìã”ão¾>Îìÿ8[ÙÕB>Ú¬Mâ-P‡¡ç÷Ôéo©TPŒ·ë›<ͱֶÙ)š&?²­Kv½Š>ºö¿†^’ìÿú‘1=­e¶Þ1¸ËÈå=!öaÛ4ó®Lw7\y =”Ý;³ÍÁ”Fc°È†z6^«î·Œªo{Å /l7ÒƒÐGþé ‡zÚZÆ·'žZÚz†Æ$cc‰d ³œn¹âô­F‡Lß—iÉ4Z®­­¥KOÎièÍ0ÊP‰Á2-]}]ë•[5†€Øœ¦£í¼CcvóÝ—.×g…ˆ3TeöÏÛ_.:ÓÇZîjS¹˜ªw½“¹Ž¡!R<¤ˆFº†Lëí'o©ym´ãiFŒŸör-m-º¹Ë¾³7?G8âJ²¶¶ZY=žKPqõûÏÐÓHmYŸ0 üÑ1p-”ê_´ Ü²ð+ûßt5Í4]²xwÏŠ?1÷ ÙAó þYYc÷næÙ–Åß_Ê…ä„/ÈH :ùyoÁ˜´óªŒÿî}qÚÒÿ´:cµ@Ç3\~÷>×£[¡Ûa~² 5"s«Ã|)©ZÃä¹òp¬¡®}?zæú¡¯ØYŸtk¶r¡_jçý#Æ>=ª„ éZ_YtK±êOøS¹Ý©¼iË ¨ C¨ô=m3Wûžœ¡ê³îŽá®í 6TÇ€ôNÌJH vÄÑL›³÷ѱ Ή3±&+Ö3ÂOû˜<ü Sµ?€L÷vä$—µ©Smw\¾÷õ¢l3Þönn±Í§øÒ”||bÁ`o…Pô?254ZŸ_Ž½&Ú«ü¬i¹÷}Û‰kXºuíJsh¦Ö’…ºûyÀ™Y=®Xðêg„+ß…m.l‹cÒHL›€Úð•þdŸgå=¸9Úد¼Î=8—mÍ3a°­Këp[ÚŽ#žè†Dòés914’1ët¹¾O)í§è/Çæ´yuéßż¹s̆ˠÑ(¶>«ß ŠŸŸÎ0Ä-í¬¡iGa_oköÇ['å#™V_ÜiƤѩô5»J„rœm2Ž<ÜâD&“œ£¶ŒI”s†ÿéUŒ‡%…BvÉèAwlQú2ƒí ÉŒÀÔýÄé:ŸDxYéTãð<™½ñ™X!޾ƇF§Siì Go”Ãõÿ¡m: 0;è¦`[&‰ÌZwì~ñŸÌ $ãæ{'mMaul¼c_}Â-tn¬5Éx"D’¬s2+Þž]iç‹z"(4Øf™ñýq͹,p`<ý þ<ÛTœMq Íž¿àEŽÄïSí5M{Ò´ntª?‹¶ÙÑ4K^˵]žX;tºa;ƒn3)›€«4ŽmŠú¥ªs+-Î6hpäs“Ó¯F¿Nò[uð¶ºHÌcoM)ä¶q\¾ûVl{á‰æÕ²@ŠÝ6¸úzÏ×Õ †kºRõvÑý¶Ñcwá1T€l Éi3†µšhxw’?F¥3y; #ÜZI¥³Ø,3² Òâ’=É,d,ÐèÁk÷cدF˜Ä]"¸âaƒzï=|ƒ4]Ø k‡P|ígÛÄGÐضa=dx:;ÑçE†ÖAhÿÉcL9OÑYv0Á#0«ž›h¥Ò¹o„`½=oý,ó«ûB’ÏJi\Kì…<ýl¿±S6¤Í C' À“ÁrdÑ?NÃ7Kn´ÙîëuEéŽæ‘;ëÅÃoé&f= ê9lÂŒ]ŒÌ±šôe®!9tŸ¶cAÆú{ß(`›‰™^}ºÌ2¢µó¿ ÛZïR¨4﵇?ŽM‰Ä7Àÿ5\Ùê•zMƒdÍ>Å-ÖÚÇaÍ”×Âè¦ëjæHŠÃ-—Y1ØßÓ‘Í¢û¦žÆ˜c¯3Óû|Çœ1Õó”ε*f›Ú,knòCì8ÅÍhÿ~ôÙ8Û Uõ´¦–¼èÿ–lãÌuZ5J Ÿ‡Íâ:¦¡t7îÌÐ}Ô)ùß$Ä5ft“ƒmjsòºŒTöXP ZÆqÁøÅ•\ß4 º±XÐË«ýt²žeDPc¥ü²RšÀ·XIù¨ÚqÜßxÙéžYl£k³²cÏ´ÉÎÛڎӼϡtÐi¡müdÌVôY†ƒ Qý={l§$åPk…Ÿ5™¤6¶Þu½p—ït]ýuïPÓa›Ìçâ›Vm½ç ]‘åÕ¤—‘ƒ†ˆ²(ºKõš%p%µáô[ìÒ‰z>ª¹öõíÞ«g×샵¹JeNü±,hÛTŸKôߌš‡É…eûÒ(d²©¹eä†3ð~5Ûž²H–C*/ÏÂ,ˈ/#li4&ÇÚÆë)ºö¬-JñÎÄÂnÀ{ï¬ó°Î*G¾N· ËÁCÄh²ÅrRYûÄàààÀÇv&u UcãùÆÁ…Ø&éü,õ”R.˜žl¾“Ç4"ÝiY› Å}ö.å °MVE÷ÐààðØdr /éÀmÕ•·"™&©çÉ6å‹Ê6’q.ƒé›” ‘æëjk³z—j%…± à?Ï3 †L|KÙ&êØ­ñáÁ¡Ññ¢-.Žj‘Ò›gxùÅÊyª¿ÏÉ6ݪ"D2Œ7VOqÛˆóQŒ÷SûÓœ!Hã¨Øòä‹kGx #6—çÊÿý}wýÃ6v»Tƒ²Ï~¹áñ/°ÍÝÕì¬g˜ÒaÜ“´üúG,DÊÌ0ØhŸ{»­pK@¾ûš%š{{k‡É‘Uz*Ï8Eî®Hážù Ê÷ÞúÇ{cŽ?@JjŽ$ùÈ@oz°eJþ=0¦bñk íî&Ž†“Q¶Qèé±æ»yÆ^ˆ“çfxîƒZ­ ¢gl]ó>q—™ŽI½DÕ8 èmà…G[è\ïi•Ú¤úÜfóà͉ŸîîsÆQl¯«|51+’pŒ/'ÿÚÛѪSa›À—ØÓÛÀnýx‹ªÃ©ÅŸ8ýj/ƒf51[os=ÕŒôõDóããå¸gåõý)îI{áœ×ÇØ,M/Q´¼ºÉÕf?i² Ì!7Ô>ñÜãýîÚßVoŸ?Ýi¦K;ÓŽ'ÌôstÎ*›¥·‘Xµ._(ÿ²ÞFõ]ÏÄtå- èä‘Ú§ðŒ^^ßm Ýí…l£Ò\ÙÌsÏ%$š”m˜z'ª†®Ì×f‡ˆÀçØfˆíéÔÅvCN˜uÄŽrì+¢µ¡AÜSÖ°›uh¥å9®¿ñë°øc*=by¹t#œ|ÍæÙšZ`ŸAVXò<]ÌË^Áépm(þ x "?t#Üizw¢µ©'¾§dÅV'ªô[x[{¿·?þ†¦ÃºÒªë/_î2 U‹Ôu'Ÿ£DòÉ’FÅ6‚FÝU%‹×ù<èÃnç6¬Ê-›a ±àÒ/·@ÁCÖ}›ed¹«aäõ…8U,a5e¹Í€¨Nóž³I@z/5:Æjåö™S i‰1éb +ôðs|¢4˜ès/Õc‰ÞÝ=Ì4Яì‚Å9›lkî·nH5Å_^23Ò½÷\Útìõì·ð´ÄåÛÃÍ7«¨Ežä@uÝØ9ÏækGÓ¨¦­b |s€B¶ê€+ I²9ùHÒ;HA[gp8ž»ã¦lë5UoA3ó²£|7-q×Ým 3oÜ3øÓ#SCýÔý%Lu? µ¥D¨ü†ß¤Àø[9õ.\Ûú›³¶ÝÄùs³9"ÿ%P]™¬ÛèX=Ÿ°¯×ðªÞŶHB–’ã]o^v\ñýñá‚»~HiR°—‹³-m]X×ïOö[š¬ºÙ¦.ù·œ-ø­ù·å–½#/ (®˜Ó4QcïüíItBË–COÍY'.ÉԌ˰ö¾Ó5°ÃM7M¨fö.^qõWÃ1¶ñ¶Ö-¨긼Ý"ç±úBKº¹•¥)Ë-l-T/ ×ÿV—‡ùA·\É310´qr Lü»öÙíIdmí¥ÚA)ùHÛzž|¥Ïê×\Î ÕGgâLr÷eúUÓ3çK\¶téŽÏÙÛÜÓ¥›b¥Ìp6?S5SB¥(ÑÚÀiã ìÅ6ÒR‘᥯µLGG‡aáš÷õ½ÏéRÄ):º$2ÙHßa™•_„ݯ證t3·´säq¸1Ùg0õý•õ¾Z4Ï]U` 6ÒÊmfikefêö¨íJ(‡’Hlü}¡\Ð6u¾½R ±o™kŸ0û¤R½Ë˜›X¹ ‰ìÂ÷/lh:û) ˜ô 7µIË›ýŽ&)5 ä°…ª†R@9=>c>w"–wòýġæŸ\ðò\ÛyªÈ …>×_sŸ¨©Ð˜³ËBÀ o+£¶^xÀÌ*Šr¡ñ2ÛTy‘ñ§Ñ_°Lþ¾¶Äó§:oå†ôš›ßÿ  ŸÁ×Y>ÖÁ™ý=m/Lé%=’o™xѬ°=WLºj/’õÌž‹¥áwL412£ßçU WHc ä:öCo(ö±tí£ö1B]Là3ròçöÑ v––öÎþ¥0œû·÷•AśÙÑ6V–n~±u="ÂÝ满¥$ÔjÌV$|Ïl½ìæåjiŸYG48?ß|Q¾þv™dó-Ø¿|éäúcdKà7K• žWB%~lý°d ŸÇ)þ ž-ÄNw PLÀ‰Š™“O˜8€Wü™“¥»,½À{ùŒ3f}°`c2ˆÍÅïÄeHàAÛLòÊ€Nd68tgæ$jŸ èú€B?#ÿIzª×Ɔ‡†®…–ü-ø‹%ð`%4ħ“áñ/ÿøz²UÒ¦;Âã¿û-øsää¯öÁçzç¿?kô* žì­ËþÍv (mÂt!=ó7à£çýOÏ”áZ"~sÇÔ7ß¾'ô¿,¦R%w?­¾ïmB>];+O¥ €NºÓ'&ø†…g]óc“6lÅðó5ù`c©¾,惌àqÈ^>Ã6C#µhÍɺüõ2<í¯ÿ ,ùx µü%; üÇZxüw™¸Âƒ®«ð${|„îÿBYý”ö;x<Àžÿžñ ÀJƒm„àKÀ¯þÐßþ,ùG¼oàmÞ+f±ÍûÐÝ7§ÆW u–ž>øà5¼M1ÖQ|öø‘£'«ÞB›–†ǯTªožjºt° ‘šŠç¿Cw¿¿+tÝéVÜbåÙFmf2Â,c­µG/ÞÄ’ˆ[Ž“xk„JBÃC€À<4ì…3T— ÌØð€OîÔKþ`–¥!ÚðüR2ø·´›a§ßÀó×ûf;¯L_þ)Xb ¾@®òBÑóS¨Ôñ÷@ñDa†¸=ðøïàáZx|nU,þÞ‰`•{JmfØfÖƒ$à¯ZÓÁÏxýü»xž:‹mjúÊœê†{pÝC·ì;ú¤U0ÝSMÑ£d¹xµä´;Ë ïn;¹g ç؃ï;"Ï´e¦?Døj:ÑÛñ~‡dVT?%è+‰3ôþÂ+ =Wç¨Z G3z͇)B¼!@`.ÌÐÕÇ'ÔëõÎpàül¶€_/ÆÅoþÇ%3l³Îê€'Ã’Ò4 ý Ì­à /àæ))Â×8“·àßTl+í1xü·*A…ôñ{ç·ÎHšl3!`ý ž?ŒìÝÍ©z¨JžÅ6žÖ#E"5ËõÔßXå¹°ŸÅbõã4HN¥¨‘Mtš±X÷ÚFçšï)•{<,“n´#‹¹xž¡šæÿ¬Ù &%³ØF^/¹©\’³–/¬·Kˆð4Ÿ¨ôw#<¶ÅÉ{ÿ>ü›|=9Š²Í¿Â˾ðØw=¸|üõð‹ŸÉv>ÛHFÁ?¡¹žAO‚¿ZBP?¬êx¾KC#=žì¯+1Ÿ©’¡CØ ñ4=z“Ôå:FB7„ÁêL¶ôW•wúS=•Á9Ý0¼òGù"ÝÎvG1²˜35п°-üí_ œðÿf±¢žtÄ·zéÿ¥b›Ù“LÑU7Kþ \ÿ¤Êu üÙÀ€;}ù8šóWpõ„Üæ ýˆ¬žü'3dÁ~ý °ä/p;ÏoïZ˜m£p}´äO@q'þ *¶Ôøwºa®nJƒm.T}D§ÃI{Ûæ5ÈDÉe€Í–Ô}ïDóÕ\£Íe 6·at1ƒUå«lgó,ÂÐ93C ò2·ŠLvúÁ©úNs%%†+)\=2 D-Û¼®7®ƒQÔ+×ñoÀ’?õ³],ÿWB$4Öâþ%X¢ B¿^UC¶ù%ª%Æ"êmp€ÇçU.‹WìàÏ+oñŸÞ©¦Fã«Sí% ’“AJ*ð6†7‡Çz”ôޞϗmTlJb©+¶Ö©ìÄÆZ{ð‡&m¼ùŽÆ1ÎÚ’°·ŽÎ1ïæËÁ<#õÏ«ÑÖ^g‰ÁE€À\œF?^ÿëoÁWÿÿ´›­· \ Þð›ÿ þü¯€—!Xò €E6[jZn~§¸Dñ«_‚_¢ÿã:.Áƒ?A™dÉ/ P—þÕºüåïð24€?ýÀ¿ü*ð˜À“ëuÀ?üø«?‡gþê7à7 ö\ZàA5êR£±’B€¬°~Íþ Ûûë)z¤ˆu;NÎó²¦ÅŸ¬ÆÎwT§›ZóÂ.ª¬~&#l97[!— ¤òìÃÖ¯OÇ’š;$ïï² IWSN„éÙÆ>bd 0iš_€K—@I ¨¬ÃWH­w@é% U}¯¼Š/¶Aðþ (¹° #Ïn€â‹ _dà°”–Îü»XˆË?ଔ߅ۇ×àR ¸ñH4¶ZèoWÊ`*TÒÈËk³ò,¹ÞõÌ{PÐ4å~ON«Ö8Eiàצsj\ÿìчa¡º0J~ÿÓÊ÷ï?hjëÃɆ:¿wÿá›Quô鳇wzaDlÅÛÇ÷=z¨Æý»•|´G®ÄsTôšRù„¹5ÿ“°Ûð~Ï‘÷ÜóX…Ç׺‘æt¸žh{þgáî%0¤øÑÍì4òﯻ@vŠ–* ¯@ü¨¬³Øn} @€ @€ @€ @€ @€ @€ @€ @€¿?ü Ú endstream endobj 678 0 obj << /Length 1295 /Filter /FlateDecode >> stream xÚ­WKoã6¾ûWè(6Ç^έM=èÆEQds eÊVW–¼¢×ÿ~‡J–'H‹ÂŽ‡ÃáÌð›õ¶õîg?¯f7w"ö–dóØ[å^½$LI¸Þjã=ù]Sd²•Á‚'©ÿ‡V J÷]±QÁ‚QŽŠ/ªTR+ü#',x^}ž}Z;ÏlF=†ÎC’ÐÄËö³§gêm@ÿÙ£D,Sïh­ö^§0–Þãì÷u~ŸñTý0pg1Œ¯›‡=cÞ¯5,Áœ–Óœ¢4!‚¥˜ÓCQFÔow…FI,òÿ‘ûC©ú)'4j3Gi]—›E@Æ2SÔdÓ¢Ô{- xä¿qä[ J„C …I8f^¹½R~¹Ç#aŒ,£ˆ›ø©·‚¤±;’ûbƒUþJ#ºmNýº; ªØ€+ß—î¢àŒ‡°S„ÎV&^Ák¼á›IÑät4bÝ؉ÔÏd…k·¤ÓÊ­iëÞ & ‹Í¦È*WªZô³m \ÓuŽ£.¶•l»F9½¬j¨dƒúÈ^Œ'Yv ý˜ôËÂ…‹†UïÍ–‹(d#›U´Ûc}2u2±µŽ± …gÜ•6\цûÖxxp…Fý¡ÖºX— µX áïkHý„ho,†0s„€™7»ÙÍ2ÓÓ™·ö€'YXkÝNiv˜vM&(4î»Ñ.éËž}“»‡dn]×›Ÿ!ûÒ˜¼ã”ÄLx> stream xÚì½÷_SËÖ?þO|_ϧ<÷ùÜçÞs¯G: ¤îô„¡÷*U)PT±÷‚ Š °‚H)R”&   ôÞ!!ewIBPO¹çÜ'ëÝìÌž²fÍ{Ö¬Ykµ¤%-iIKZÒ’–´¤%-iIK¿:IdÿKþ0UQz#)‘ÕP"Qz#YUóÕï¾Uóò[j²º\…9­ÁSÉ¿šájù¦±!«¸nõ5&ÐÜrÉÚL^³7¿›«jZôý(ùúf}6þÒ¼%¿Þ0ýž›Îýƒ¾ï×jSÇåM¥s?öíÜ—\s&`ëâHbð¨$‚ÛžKHýAdr|Å BBÁ!¶ñ–Üq´å­/ϱ˜4: 0Á¹æ.]ÓB”§ŸÊ $bÀãÅRʯº‰ÔüI1ô|~‹ŽBe³YrbRéF…*Ømi`Ìp U|µƒùÏGŸ¡ÿg#³iPšÑòlþ? ÙþóüקòDºY@÷Y£õ„þv%Ó=©”‚)øÅ… ·À«9ß ß=æXËH øF›¼êaìŸS´ñÂà.~kÎGèOÚp¿]]ÛÕ²z}íbm¥T~îâ˜d­Ù13fÓ¦SOAbá %ºä‚u¹ É`+ãgÓªEµ¥/Ÿ÷%zÇç Eó71‹{›˜fm~²Há¸ãúJøÕ=òG…±4P—DĽók3Yúýà£PÊžç±Þ¸‹E£ L¶áîzöþ[Ð&ÚÆl_-yÓy9+wÓ=RQ´éáþŒÍšZC†8DÌÇu¿H$ßÐ Ê›òçŠâ œûB'¾Ì‹ÔÉÆ:CR¢¶Ã•^M9a8} ø|7× ‚ІŒejžšú^ß!8lþaÝ*yyº;ÈÅœbiïdo›~o¯+z_|ÎÌlw–p"‹¡?soų¨$G' ‘uàÖ´Œ/Ìöý×=¼‚< æCKŠ¥—r#€­«{\V 8պ݃G¤s(x\øÁ;B¨Ðš#ÿ͉º~`KpH° ·ýà‘D‘ ü½d̉·P†]V;ÃFÀ— ­&´Ùæ̈N©PaA°#åpj ‚6WÌâìIäúÑE”ãƒ÷¹Þa¡8¢m.g}3çzØ:ܶá÷X»_,-Sm.´ñ5»àGúùn‹úɪún,›€·±µÅãûïVï†KþÛÄîõÝ¡Û·yñÈv~G¡0Ûüôï¦Öó².ÿ|g‡ŽËMüöé%[Ö7<® á‹Z)y´ËÓët&.[¸@ŠhÆ-ڔϨáôG¶1þeŸäa„ƒ]LšÊò&k‡µùñ|´Qî8yÂhóaQA|%“\2öÝ€`M&KQÏÏ‚ú°~¨îf”ùÖ³ òíhÃIkì ³1=ûòš¿"Ú˜ÿŒÍÓüùòW6óaBýÿðäv‰bkÃ#,ò¶7Ÿþ«yüƒÛ¶îØæÈ!FÞ’€"'šÎ½7ƒ(ó–gz0Þ%Á¨»`Ç,BYçg²óÐ]¿ÍÛÜ,-ܶu^ÙæiE· 9ƒ°gùv܀ƶ··&ÓÌ.=«…Þ‰ã;}¬‰,ž%ïé‹„¿ºCr¹0T­««;´ ‚&¾{oAÝ–w­dDÑfP Yè o‰.•{ÔÒ*0 }>ægm`±z¨Jv£±œP™¶$bì;Q,tPIø¦qX]8²ÍŒ½i?úá§;þF–'—•¦?‘ ”ŽÀïNq·_(D~Y´§âŸ~š†”(c}ã{MˆÚ!™dĪ¡ÅZ U\4Ñ7:xþË?abI,ÍÚÍ ©y¹9(åå½ÜÂÀ!h3ãHÒ{Õ¶¤4Àà“H_Vô)Ú8o»äÄ;]þzoŸY|vo – Gǽ§Ê^É©°ªK3v÷p6²¡éüÍiWÆæÛâUºMøÝ\…Œ êÛǾ m»¶x‡¾—þÒÊÑ7®ƒe¢ÊÐÐtßKéúq×0­j¯ ÎÌp_á4:È÷x°/e·«Ÿkd(ð¾05ÌÇ–Êó¾ŸU:¹$VbÓ@±ÎÐ?ê°“¹cÏè´ìm KÏôÒË2ņ ͬ èxm"È#°ÜF–”US htåéëbyV…ƒ(ÚzdEF·dÀšØ!‚³“‘\§Ê)&œA¨F‹ }&Ä7XF¾mîT÷ÌÕß7&» ¯Òm,t1ÇŸ—*4?¿{dþ›Ðf¼ØÏ3ÅVá×l2CHg¢‘æQ "óÂa ṏŠr"ïH5‡Â(Àé’HAU%Ó&„'CÒ"Nì´° >æj}¿5 µ:ø`ôîõKãÍ$ C*;u¡»/@Kôw—hΧÐwGý­0œè¥xyîýû¦e±ª B Žþ$Oa —,ˆE´YÜEÖ;ø^„agòüÌŽÑæ¶ oÓ ´ÝѾ¼Ãd¸NbËa99J¹úFZ×…Z –Ö·¤±hÁ úf¡–»b6¾èG$AÞSÍç6 ”Ùt–÷1€Èתdªý h­7Òñ?toI&´V^¡!R ¶¦´é·2Õ}ݧÚõoŽ’B®¢hÃu<.wÒ°æCz‹?rL¦A‘Ú¸³í\CC‚åä·÷±xM´é†EnÆŠJÌü4­„6Xœ­OÐJFAÇ’¾mf/O·4¼ÍÏÍÉ-ȶ!éçu-Ch£kb5,KâN¹‘ó±è$Û:y÷…‹e|⃵Ë%•eìpƒ—%~÷ÅrÕ$’éÔ+ñl€ÂLhQðÄ×Â1ÆynUlHÕç)9D g>$2Ù'A~ÚXy¬p7hËî3¥(Ú°ðx‹ƒ„åÚ¹åö.¬Çd¸Æ9áL«Suh ){X›OW¡KŠïB›»5=Ðsj¬Sdš Úð L\š¿Å?³¦ÿÐf…`vø}M%4+¾|v PFÅÚüLYD,ÏPÊ;HÍæWSt˜­Ëˆ–Î1IêT–ŠéÆDΰHú׉0VÜ­tn€„wÒ)ìˆù†ÓuBáü—Œ?“öºûë _Z)ÁAvoÕ<ÚÅ3¥—7Ò‚Ö°BhC#R‚z)$lHø+¢Í¤§ñµnB¼?»¢õé²"i›§wB†ÜæpÊðËì…ÛB=„X`æ.¶0pØÏójѦ›«‹)žTÞeh>¿±OÖO¢Ó6€ßË^u[cŸ»Íl˜¥aÈ•Vˆ{šWR"O¦aZ͸Êü~u«‡ãÉô´‘€Û­éï†>=ŠwŽ†àtAQ·ù®•:`ìxÆÔtÓ̯²’šieé»ï¾ðº¼²¶¡ÊB›ÏÚàì&eIBÝ)7´gºL ¬ÞeÉÐã`v|®’¸/60È1€¯üCÁâ\ëë4€Äq ¨ìšU·11 ÛmÀ[ÁlShûa•ÔŠX3£™ƒ[ì‡3›Uìßµ’tÉRmE4Ì$Ͼd¹­ÁdP¼4@æèìŠ Kuðû•‚6p®•jL)+÷0~ùJJÒ—A6Â…ŸH.¯¬®(΄ÐfEÊNi¯#hó^ÔƒÇC™±wÅ#M& k¡ò*wy¸ K±+ý'v0¦´¢¿@hs£e\mŒ…‡¶{p9,¬!áJnĶ SÜ…v™ð9u°ym´ùWRK{©z1ÕTÜíÞȉQA›¢ƒ¬è»2ÕŽ¿…œ¨gÚ#[û.Ë–Ú…d,gH mæ}?ßï@³!‘/Ch³³iR&Š[)À‘ÊQ\žþzp,ÂõO¨Ý¦äÎ>ð;k¢ x2ÐÉzŠrw-º³Œï”ô­  ¤}g‡{sŽ·ê¡^˜ÿ…hƒÚ%£mÍ"2›#-t!ÚÔ?=ËöÞ)ß‹°ÁéiF¸äW;È>ú¶ñèùí«Íø‰Å00ˆù÷xP ôè½¹e‰Ì+`%ùÍøð÷°äÎJí6#âvlׄ6ÕÞÛƱ„3Y¬ç`J¿ ›?d·?­¿D¡˜O P+ÞL‡kN@ 4ˆeÒaìíÞEì(8Í´ ¨aÿr´¹îízæ©´³‡kÖF›Áì³D¿#]y»óULj¢±V Ù|VöA›–µÐFnÇ,Âé° ¸9ÌÁF¼™C»{,ÿÂFzð¿mÀâG®c¬Ô¦jÇ4Bí6r´š9ò¯K®@Z¶e_%ØImþgý]èdãWíËà¤ÝZ±÷¿h<"~Ó´d g A¼ çyÍçù%¡¦ôµ±‡:Hj ë6g¼ÙfGß ºM­š8Õ”¬¿Š¤ ¨ºËAF6±+ hs´nJM^ VbdA'ˆ5'Z)[ÉKQ Ó­¯†óª¸áméqDÐfOVÛºÎ7Š+)ä÷Åh6ÆÚŠê)ߓڀ͙Ó줢mòc}©á7ѾÞmÍÐf ±Û¨C(· _2ÁÅ.Ÿ[Õ7ü¦ õý’TxÖB›zñxó-.o—4ƒ©7&z\ˆOMINTËôÝ^– Ûm„KãYY9KB‰´Á°'5_ˆ6P6Fz"ÔÑÈ„À±ók«¹ðc¸>å‰ô€g+C«æ¹ š¶]`ÙGYC¨±WrözÛ’‰xŽWdß¼H˜% ·vêÛˇŠñ[0ÆXýê˱^Im4‹-}r’Ë ›“®æ|PÙ­Œ<ähŒ12Ç’Ì®d¼E²ä{ì+Uô™D~òz9†öÇÒä×[Çw‘0zúúd®óÝW5˲|;ŠÏ‘¸RP½ào±íZò8ïö“Î+D`NxYëè(‘nRE—Îuáÿ7®KGJOûüãoMé„ÑÆî§ zúJYél$¼_iÝ‚³îÿJj\VÓ¢Ù«{Ü ñ€¹½Oy÷ü£^:º¤òŽêÿ»%×]|¬ /¿ê”¥_ô€ÍéŸÖžÁ×ö ƒ,OÞ=†Ç¡Å—1.âü㔺‘øÓŽüý'»9°ßÆà³¾ÈvnaïqÆùy"ÏñY÷J¡ ¸ãTx¢¯)ƒÆ²àÁ_ôš¶$³xýŸŸ7¬ÁäéOEÿ4"‹W0úo¡·òŸ„!!Î ë*v¥)mQCÃĤ7]ò*¡ä¶)¨wBí¿ÒSnÿO7XÑmzñ:o«éGþ@´C ØùFtŒ/ö aL-F/ü/à ©â ˜640¨–6;ÿjÓu«Ú:&»aƒ_Œ 4‰¼Ñˆ~``p©QªxÅÿãPõ2(^ιÏ$ãÉ$"ÕÒýÅÛ^¤’Ó§·9˜àIVnÛZkïþ l*íI)£ÍÄ+Œ¾J‹õ °!rIýœ“¨ÃqÿÅÞ_Ð[½«¡T~!´9üࣦœÖðÔ• h³¥yò‘?1{¶ò•æô¾Äèž…Ârc- 5©ª=Vs«FÝFÙËbÝXÙKO©!Ð,5É%ã{f—©W§4[áf¶Ãš"k¹W­áX%Y_úÔ¸ ­Áduü’¬å²fkV[××ð%–&SL¼¶ÌHÔõ£r½’Ù»|V[ó™Î§Dú&¾xUׯr³Q[áåÙÑÎ)ZÌU\Õ³ŠÐäK¶®ìšÝ¶Z…6ß#ÞêÜÕÑ|mëø/# ¸4ÚÞÖ®JmmS«æ…ß›Dóïk+ÏlåºÈ•üjNó¦š:ðß Á)úÔ®†ºæÿå•ëéhʼ¶×„³mIm'ÂÈ":ëÃ>’ÝþP/7ÝÔ7 g¼®®¯-²£D\/þ“öâÓ¡Éù_~PºRݶ_“üñùù¡§·Ÿ¿ ùx´Îý‹+Æïòô9péø³ú£Óò¬¿ò ºØò/¯ÚÕƒ»Bwí[Ò؉Èë¥ð@ïΩïpA>©{±+dK@àÖ[¯Á?D¤–´¤%-iIKZÒÒ¿‰¾–qyv9::¢Ö–.µ|p¦7 zc/#gw¿›YõòÅ#â|úù\l˜ƒ½½“«ß•´RPYK©O@òtˆÏnYY@ ¦¡<½ª0fiåtG¬°,}¼s¢^Å_el3Ë2]Å„3RͲ †ÒM•FY„>ù ñS*µÝÙýÐÕç’oX°huT-ii­Ÿn|ßØÑ»B&Ñ4ó üÜØØ:+§ºÒ)^}ó‡V„ÞWåyÓô½ö¤¢PS•oj€;t+ó]cc}MYŒ7féÒ3³©º<ÛeµÃ’³ãéŠÓþDó5’Õ.*Ž%„ýüMñ„ 8èWúꎻ~T¥ ÚŒØéb“¿ªØ.ÆË* ˜Ï ¸Üý–±þ)ÛÞÒX·ßß‚å½o ”)Ýkž\Õ«'-ié›`g•«2âìæE2½Š/‰, äL’FŽ©á£zÄËE†çüÌèÛî© Ã¶æ2´ƒ;NñL×̘Óî×õË°eÆK)~}Á”0%óûV´™éK}o„'­HÑEý«t;ùÀûôc$»0y²o¢:lIÏÊž’ÀÄš¦¶ó'Ûªœ¹ô÷ž¾ëÔ ’–´ô£hÃkùô¹ ¡ŽÆRoŠžßÁ\hÈ= ²2?Q°z™bGÐËíhÐmÀªÛþ<ß$x†¬LŒ+‡QK‚6ñké„·£âE›Ñl‹…Õ¾ˆ„ØöÊˆÌ òÕEoÏÝi+h‚< GÒ`\Ñü  )ŸVµ --y<ž 5a:½ŸB]©f¸“úi¸uã“íf¶±ÐóãAí­iIK?Œ6…ŠŒ8Ïœ¬Ò+»Ð¥SÆ6k–¢_º”†¬qz=" h3älˆIl[˜…h~)ÖÏzß­×+º ¢åÞÌ ¿úchcêvÙÉ%»U¸f¿æ`{øN„vù{Ø[øìU´Û|xp˜çûöÕåªHÝÆNÆ AÑí&¯¤ùZª ðuIzHr_}Å zÔ¢–´ôë­¤–÷Yè…ÝlE6–$Y;ô [gUVRÝI&º_dãV¢Œ6½E·LˆYF$Ù˜¶¤Œ6P)¡\ýK¥cw= ¾mHD\Êõ}F§n$Ö|¶¿€BáNóÅ"9‰Å ’…§ÛR‡T#íq)=ªQ¯+m—)<©Á8ûøÉ|Õ„ôeQŠ6_ëQ,µh£%-ýŠh›DÞ?ÑÃ[uJÇß¼Û4ö~-¨`%ö·aÞ„ÏhJ‰µØ¼ÿŠ7›xŒ+epáµ`Rà©j…E!,Ý«eSŠhGþ¹ªÇ ¾µ“òÝ+)ç;ЋôøNÈIèA8ÛGô4W8ÛÁžÉePmÀÇÇ·ÄÞ'Ñ-—W®l%†:n¡ï|êƒD2gN3­ù²€rámŠ?×ù$º’zøöËouê¾–´ô?K·ÇÑóƒvfžÐ?fºJÌñF¶ž{cDEl·c㜣n-"GN¶dèâ·îŠñ20u\„N4ÑeÖ ”õ1--sY,·Á€Â¹áÒ2U@4Wý:'555íqFCÇ€L @TŸþægi©_äN û:#-^U*—Š†[’æ AQÎýÔÁå•R–Ç?ßððê½' /ï=HK]¡GyïÀ¥þ»©YPº¥žÂû¯¤gVÌ|¸—ž.:ÊR>xô$£sDêÌ#O‰L¿…>åÍ‚¯<¤íi©PJÍ}]#=l¡ž¦Š´‡÷Óž½ê_K¦:ž¤>̬h× ’–´¤%e¨ƒé}ú!¦W¬–ZÒ’–~Cš|íaNÅÑœjf´ÔZÒ’–~sÝÔžÕ %-iIKZÒÒ¿ß,¯æ–^šâ£sW®²˜¬z„±¯æ~êôŸÜ›š>ŒÄHÑ° 3ÙúŸ?aF¾é4MñEK]—»°kÜG ‘D§Ó ¢D=c‚»ßþáÊá«Ù—öX³ºFúºzÇæàµ\µhPg+së‘D²ÙŒr4?öÂqNÖ"ϳgv¸xS.ÏŠI2¦Y8Þ|£èž'ÉÞÁ402Êþ0ö‹ðfö£“R>( ÈŠaàÞõ%oÅm»®é“¥Á&s™kïô)'ì'멧 NŸ_N«ñwþ‡k›P½¶f<Û_×þ6ô°×õçÈ[j¿­L²ã†dü@¥Ô ØÕøcÓÚAû§¥Oå‰ts_Îl9j†Ššt‚Sò-Y=ÙÉÎ%^­(¾¬¥N!h“h‡ñzûí!w¬ä­ü ´ ïH•ž”[•Œ';VtH/õj-vtÂ+T´‰ùÎBÅq)'ÔŠ}²Pñ¦ÉS?€wΰøâ.ºw´ü(þ޲˺Å£Ç"÷PL0Ȥ¢³Ô=Ï4ñm¢»þUE÷º:Aoî9¢Kò—(Ñ xÒ5=™É N™g:²¨©ùvU§ ÷_'Xª?I”&€Ò>¹¬Ò*'x¨ÍYñn²•z«»ÐSå¥ÊÁ×ÈÓdžwß·î” «4»™úáÃÁ$åg"êG-¦–C ßûçJîÑSu/( …XXX´çFÈÐ|ÿÒÓ‚Ì`³I$ö™ÔJˆ}ôþzýT‚3vÞu¶®õãàè¤XiÖãDZ0ñÕ°¢ãk~,½^­1æcöEϘWšÍE+”s»ëÖ««kû±²ð}ߢÊ|8ÑšI³Ü=ªdºÍô{‚1]zaݘUïÁÛÙ§'ƒÎ½ƒ“u&Ùï‹2ApoèÍjKo]iu'rUÜT%Y‡ô Å¥¥f6Þ ahùãƒxràQivÅÇlÂà[oǹïM(Bؾàkçøà#zÕÑW[=ÃÔmzÐ-ô«8'Œÿ‰JE´9yôyº£ϱ“ök{ªù¦ÓÈÁkî*·ñÖ¬¿jà/Rw3ÃÑ”Åg‚Içüd‚¡f¡·'u¥CeÝZïbõ]à»#—¾Ò Iè³ól½ã/z5(’».†[^H ×ö{_Ìü ò- p—jÐ#‹F½):×*§ÁùÏ&¦$·#h°p7Oûz.æxd  oÎÂЫ‘ëÔÄÃe׸ڟØiAwÜ#ÅKeÅÅ3|±XÖDÉhÆ.]¼¸X6µIû™ÛŽ©è«Ú}Ô|ÊÍ$ôf‹ª&«ˆ6Ô«Ùí¨$ôdúR<î‰5¢;™cîì䓽)žÄàíœF¢!z‹nã¬ü×oLOú’ÿ’L8W£Í3€w¦N ‚‰«·s¹f4 ƒaÖèþ¡¢D“¸%ã¼Ç¾bôµnþ§ëž˜| Tj@›šô“\ä¸ ´ÒO÷ùZKÞ™RÜ$ À‹ô/€aΔ׃`ÚQëˆG}Š<É8µ‹$9‰`ÝòkC¦“´x¢Ð.3Ë hé6‹›™4²ÃöGÏ_¼.eêz-E›ˆ•ʽ%óÍ#dÚt"c³n³=LÈ$‹üöqU»MgâÏ@´ŽñÂ`à“‚þ75ÄæŒ=Õwé¼Mò¾9LÑ„6ÝpJo¹éªäò>vØ ÍË9×b)‰B¡¸†] Ÿ“ÙB"ÚDœùÝ<ë«Ì45øê Î 6¸UáZŸ„o¿¾Í‹(¯4ÂÌ°x†:ÆŠ¿Ó¤E’ïBxÄŒæ“õÅeY§-ŠhS—´ŸzTeÁp$”‘P2Üø KµWYK¬…6)âõì6Èά3žW$;÷\ôÅJÏhoö”¢Ý¦§äNЩ'J: ·f…Éa专…ëõ E[g0 ØY•%ª/xÑ>£TåêÅŒfPÔca@xôq¤¥‘Ñþžn¯æ[ÛËÏèÌoÙJÅÙþ0Útd_UT.†@\z ñí¸6» {,ŠÁ‚^—óÂR@ a¥t»ÆaÈ_˜kόƑBæ¥hïñÍõgZª,‡S~–£M5|“,bøM=fá¥m¤Ÿ-- Õ\76´ïW‡6PÑ4ݸ:ÕåÆàûg€¹<"?Ú £Q·iÌ€t‰¢n•¸žµV4?7{$˜v&k¢9‹ÌµSM:ÿB›¾•ËÒì Hu ³–8jblÌ‹ó³<œºº-Úü˜nÑ‹cKkº«Ú€C&ºÔä Ì‘ÂÃ:Æ>³¨Ýæ!, ¥71÷ íó¿ mPZìL'ãŸ&¥§êuäœÆà3¥[TM¯&Ø«o†”wd íGe‚&h¿ƒÇÐV÷¡ç^À™Pk.úq,NÈêû¥"™jdPÔ+ú˜{•h¨hL×Å:¬R”[ž° ªðb¹øÅãc°° Çž?Ï\JGCsæE³M{VƒÏõoZ—ÖEpòA‡”)=ÊtÈÐM«ƒÑ½ö~°}ôQVÄk¨qc‚ýŽ@†=z瘝¿©ú]b”}Ó¥äI¿]ÞæïQû•ÿüüÒ;ÅŸna1¾Po^qßqú%<æ+ s^ºŠcP°1Y³ ¶ÛXÆJíTÇ–>þZt/ýÂ^ï¤ü/JhƒPÚ!;ï¨T3iG~ylbÀ~+Ý—˜ðóöþ<#PA‰˜_SY9«µÛh Ž×çÈæq ¶Î!oŠÎVSG^xüd-Ý“j-¸É£šP©dšÝæêxŒì÷1ŽInC÷¶q ®¼QÜ“úIˆîIùÚ%æHMœ=ÏÜŒìn(÷„è<ûö·á Nz[¹Ÿ}¦¸ùx9€Ið>+ýÙZx?Љ»áŸÞ kåµýU]Ϫ­FþŠîõÖ•·­Å|í::ºzº[ãjûÒÌùÃ×í¢âŒLñŒ¡!Ï=ôy- JñvÏÔªäeö÷Pg5¾gÓ¶þ¿K•°qUåV÷Gq–GËVQñ?}îô«tGÿÛT ÕÖÓÊÂÿB;.{ùØÕŒlγ$“ÍϤנ­žl/øy£þ…vtû£ÏBço‡ÒÑœ÷¤>•ÝwdÙ\s2‘zðz4˜$í‘$ ݌͠Zûæ~‚qésAÆ@Ÿí²¥Ë‘¾ ÛÚÚæä³Æê{ôõ‰IÍcFFF¯_p¶áÑð&.;ÎL¡Fæ,ïŸxðÖ^Œ·Ñþ»AþäéÈ™Ê5c‘Ø)¥ðdôæª%#ð¹LÚÎÿoÃÍ|DѸq8 O¸lÛ! ô£Ô¯©éÉ š±.ÁÞ™BÛw³BÄößmPþ/ìq ëáÏ•ÏO}ÈÞÄ£p--2û`rÑ›ÎÃué®f$ÛŒA%»o;Ü‹Ø¿g?æûÛÒ.…@Ú~$~7×ùü—å¥h¬öÑßÿùÏMÉ=òn®ÏºÆc9\3`¹WŽ¾ßŒ‹Lz'[f%ë¾\Ö ¨Á£TçÓ«ü°–ƒ®¢ÃͪÌ“i¾Y~m×åU÷¼¯±ô&e·]Èenò…˜F÷ Õ¯¾Ñ©U­S4ü,hãÓëø«a ¸xQ² ÄÖf>¨ìi£ÄZ嚨s,YíQJÔpa=ÉÑ *k ˜duX®ÁkÍ6½]»nšÝm¾×ßF¢àΤ"’5™ -+ÕϼmJk1þž xÐLËýœþáòí÷=Ÿ¥~¯äì®1m—}½½¶ã«\wÓG°09¶šÆ'_\ܲëŽPÛgÿcðfaà-ÇÊeéP™éÊKt¿3 vsôw¡ª[^f«ˆi·YË|-ý†pó]K‚ßX·Y ¦¥_Õ&ð=«,-ý«†„âªúG;ZMDùw úß.ì÷Püoï¬jïX-jÌ6‰z‹D)p^³HùÃá £jÃQß³«lƒN6X¿áNZj¶ “Íì¿.€þ¶ØÛÅý?Éx¶¿ŽÝmF ?qú¿fð†ÅBÓ‹ÄÇuß’Ï^× {5„;•_í[õ2ï(‘\ô;`·p¼3úسïýÎ…ù÷ëùýÿ*8±?aáû¿jM‰ý¤¼^í­MÌ‚AÉ<ÓT¯u|x0ÈC¸Û"”‘®«A”¨;È#ûß‹Ž¨þ·O¼œ­Œôt1Cc<Í?ôдYÖ×»ñE6ÐflL ½hQ,4y»ËÖkùKõéæ›~g|9íÈŒ{Õ:™}ÊÈ=}×qÑÖó>$ÀÍt]=ÞöÅÔŽ¸ŸJ` Q<í§àã2èX¸½…EÂnÔ7ÒÝh`î¸é^-jÌëfüU÷Ù¨ pFKØFz7JºÿìzÍL»4è¢ RJÉÀËý.ÔÎ2kÆ+f(ÖàÉ7GòBÿ†â)_5Ìjöµ¾Y-—¬7¢o¦ZŸqÝ.©Ë[²¾n³j¶Tù^¢awduÊo/&þbu%ªÛÂnwsäé{•ÆdÇm:pÿ°ý•ÒÁëÐ(Q¯­ÛÅJz˃-–‰å‹•W)Á¨ï+?”¼»……³v· &”MÈ7jÝ)ºe°+‘訙îö—h&‡|X<¿ãÒ£<²¯Œ s`ìóŸ±(ðÌ·Xa_÷€ràÔÛçI¡\.·{^Ž6àPÓ+/K€Îb‘Èœs«! H%èø‚,è8Hÿ§;ý0Ú`=î\‹ÝÌ ‘Lˆf÷ŠaG 4„üËÃ(ÐèLÇ ÿÅ%)§XT€A§R¸NϪa¬^ªÖÑÙˆz§HC‰AÁ««¨”ŒB³ò.øwÒÌ—š G…Î ˆ§Óйx¢ãõf{&TO"À»•Ë~‚7™H¦°Í¸G”¦ë‚“4Æv8à®öÙs@§Ó¦õÝüMœHuþÙãáŸP;k€j–R k\c™^:/â|-Œ\Ϭæ$ Óõ$ @h\sû91Xùô—Fb0è ÷µ_×P„=Íun€Eÿ…±­{¸Û”@蛂3Ÿ…8áñ<™}-£õ²aþó?žµ,ª 5)Õ”Î/ûo‡ëÏ÷»:ÛÑÉäªAÉ‚“9…L¦0iÌH¶Åü§—öC-`PH.[÷NÃ~#Åg™ìÈ×Ã6;:ض9Ípw< ¢ ‹ËÝ÷z0o¯ÓÆMpXåì—º½‡ÒA‰(z×΄6Á‘—2ϸBo·¢ÕT‹6û“ Ÿ<¥vªÌrEQÁðœê9e«Sª/½1gd”Õ³Q8ø֔Ƈª3žŽÅ “kCÚ¦Ã4Ï¢ÓA¤Í ‡êd7 Ýíµî»; \O£ì³ÀRšŠŒ´×•¼ë^­T¤ ?ýR0ð–Hf"n•jÑFäÉ0H«™Ð0–´éž‹03ñ¾P¡nÄITt‰x©¤°hzI¼noBi}Y”£Yȼ9\…ŲÛDÊ]<¯NÀ@qky~ã_UM‚$¿9‰ê·Ptl ¨¸8{ƒª¥ªh#‘¼?ä`葬Aa´yÑ?¹…bšÜúocê–»ÊËÐfèSÎUÀeE)MvÛ ß4÷]Ž+‚Ž?f_±8†®¤°ÔHÙ"~ÌYsóË ÚÈ#þ–gzéò½ŠÏK|]T™(%Æ“™MC‹|¾<”ø®?žtef~aY(kázn ùKñ—ÏoqÙ›\ :¨ÌÕ¦)ÚHf¬èø„¬&>T±d Ë,Ü"ú~Ù9é®¹Ñ Î•‡a)‘ü•Ò•¹tvìoʈ´p=åûh Ïör©Lg½1¸‹|M½ C›*=c®Ôñ²6Ñ­E/C^Û ª&¥úÒêQö,¡/Gý^h$ <Äbü‘8>š]>»„ȇC³ÛÐ îÍ÷¤ëèOp7ÜŒåasJýšæmàP²úG¢g’H=ÚL9ô²Ûù`xÄÑËf`çd¿Âujz³”:™xL׬ßVuñ*ÓLÙ;€ø:tú‚Ñf‚ô±8³mA¬m²Ã­i‘šŽHêá™@Z3—Ã`nOý»À*Ú”ŽÔª :ž‡ƒŽ!ÕÆ›ô)?ì“Úmœ’eìXØAÔ‹o”¬BøwÁDëW6‘dnjM¿Ê\/î›íhG%‘ Ù²°YäŠÒOï$I*ÍïÀ#}J1À™H$¸ž~ ?®6°”Ï}Žòåá¡åÀNÌëÔ¤l ·ý®´(ŒµEŒ]":kªÍ–£DrÄÁb+r8BüýLlXùܺh£‹³“º£IšéøæùoXª¯N©©ôƃºœ#R°FÐæ 4åh3 ‡f+„F›`r&Ô:}/ÚHS\2ð¬s¶ç†š•”7Çø^ÙàêÓ‘GìõŒ–LH$Ëž\zÀµ7?f»XÝ›%’ùJŠ ½_ç”»X€iÜáá™CÒITŠ6}z¾ƒj ñ|5Ú´ŸsÕ³½¨aÑÑc¡cp¥~^"˜ä‘€°ÇÁ ¯­Uh3ô);Q1èø’,èø˜6g` »ÃAÇq^—óß…¤·ÙÜÁ>$ ™pÕÃÜúª¢Ûä*rKÈ_iLǘR®ÌªPâùªkƆ+»5áÌÔøVgæñôºîÜk·PÕöð;ÖFéM°4ÖQH0b¼_Ö<2ãe³á8Ô"T·‘‹b‡z.­è6yvWÊåÚ…wþÃÒw  8lmªW>¬W Éì£&¥úÒW£Í²"Ú¢iºV…fÿb´+5Û’D$97ÜØÅŽUE›æ{ï*¦Qÿ½ƒe+1¿×šjšÓöÃNMoºM íœQŠÜPìâ9jL“Íyös9Àõ‘Å”HÑN+š÷"/6{ÓõTí6“9TCLyŸX^3£}“*¿(Z‰…S­42ñÑ»á¼Yµ’'ßáuÈYÒÆ)² ã{Aö1ÇX»Ð ã ö;6Ë‚ŽÁ‰¼`’‰ÉÛQT®ž‘mí6×cÜÃøâ‰Üýd'{/7’t­hàÏTW× äv8”8Ñ/LvNøìkÓ’ žû[™‘åh ÕûàLY‡˜öQŠ¶ye½ù©zTYü¿ ?ãiß´H†6o„/]ãdŽå_Y@ _£|B-ª†ån¶ù)Ô¢ EQ„íµê¹Ô”eî2)lºˆ1uèGw¾3GfLˆ×µÛ(¢ ¸Û‰µõr"p, 6kª¸°¡ºrlAV§\VWº¤1^ Ú =Âê¹ ZWÍÝP¦K¤t¡6Ùië%‰&´›cÈå÷&>·Ô¶õ­¥Û ãè¨ ÝÕÑÌâ€*Ú€µ\ƒÃ7fQPh¶Ü=“(ïIÁFø–T‚éYÓìË ‰˜_[U5'¯Û›PìÅb#Â2ÓLÔ×Ï+wñ´:Åõí#ªg¾nûFÖ¿+º ,…½™dª-‹l´zOêf˜5ÙÜ-·YzÚvFÂNŒµqdim–W]Å™0*z—þìë)$èØ}öæéß(„Ŧ¯&Í…C²´âAë“©Õ(ï'ÚóÖ18߶tì(Mº‡šîºÑ+õx˜µOd^Õ ¢!ä6°¬+ï:ÆPŸãºbü¥¡@1çrH ÞåŒZ•=)y(ñ‰=~$€jÎe“Øöɯáƒ÷;_ß´càYfæ *Ùo÷éDÎ럺›“Ùæ´çÌäðZˆåFCbÐýhĘÿ”Õk…§Ì¯¡v$ŸŠ B­âš‘éf'S Ö˜ MØÿO «zDã‘p¶‘j¶ºÞD®²ï¯ ufáI<™yéqåê.V'`²=)%ÅÓ¾7 ŸKšŒþ“9¨°,L æèüãoÅð+Q,é¿žÉýmDYɧìXølظQÇØgç‘ÆQt2ü üŸ<Y) ÿBð¢ý‡©?õ®”¢{瑼àšAÇjã©%êù†.ÖtP€ºü–s¾Í—xý†ké¦;w%¬}ü½hiz|5ML©Ü]òë »œšPWÚ ÿWlÑÿô.—,„ߪ›;´ãTKÿZê~À^E, ‡þÂpŠï#ɯ<$ÎvÜÕÅÑwh;â7¥‰ß 7µ¤¥ïÖ6¾m¥ù«”ö‹j¢¥_ÞËZ&kIKZÒÒÿHz}ÿ|^'b ÎDEå™Uœ% OîäN‰p(*bçÞÈ=Ï+Qo=aöõcP†c‹ðÞBëëÇqûvGí?Zˆì3*Vòõ…°}û¬HÀùO;÷Ÿ%óPåæDIg¯å¾ãwVD¹ô“éòôyßÜ/<œö·8†âûòLOÜ—^6ø;hòZ¡¬ÐÀº+'÷¾n™Ôxr¬–þD´ØÝ;¾8¼9õ Ø÷© úÛ n´Œ+JÅmgŒÛMس~²&ÙC=yãa^~AFú]3ŒÃØ¿W†3!Gºôn|ý‚ijl€ò¼´¶µw¸³¾LÛí§_åd_Šõ¢»\¨žšó0ƃì¸íiVNʹ=FD‡>8ÁRScónOÞ©'ð¹ ixº}YmuùQìƒÒ^d=¹w‘jˆ½T«teýhçû{‡½Ž—E2¡ÿòú6Ïÿ(^¼}ûöø¢äI¤wäAsÎ~ów ôÖì þ/.úÄ?¨ýuGµú<5ŒÜÒ—·Ëš'~¬é}p Ì¢œWÖæËô›=°gÐ[\›vÀþ™W·³ooùy8YqYöî¾;΀‚5Ð昿ÃÎ;% Ü Süydôì>øÉö|Çu¦:cyryÕ^¬JAÓâmZÇaþ»Û:´Í"™ø;›³[”Î'ÌìûéµÑÏ÷ÐœO¾CK8µÙE›öÂÓÞ×P%'.Äóí °>%;‘\’ÅÊr>7XJ¶ðeU|rÌa×£~P$(..žHŠxxP%îÌÆÚmFJ_,)ÊŸZ«ÎËK£5eÅù…%ƒ3Jh#pk¢öMI~~AUÃ)^•á·ÖUäçç¿~S;!›Æ§;K‹ ‹š:a—Á©–7»Ý¬ÃŽ&äçW¼•—&™lUÔ âæWƒ’éò¢¼¼‚’¯ÓËòó@$óCU¥…ùùE­=ãhý–¦ KÊÅ y–¿ëÿT^Õ1Ýñ¶4§ÙP-¼¯.ƒªô¦®E(kׇºâ_æPÏ”–ºÊ‚‚ü’Š·[`~.Ïæ•A y[V˜›WÔÞ?­Þèµ×…!2xYÝz^ð2ùéF|éøjCøÜ®¡S@Äõ¤«Á.xßëŽ û2­½ƒÎŸ;á`FÜù¨iîcÍÖM–žÁ^T ¬û4†¹3.d4Ks/Ô3ƒ°g‹ñ~ÅHóËK$ÚÅôçµ#BOKÚj©óßpã ÀܪDq¬·íá\íˆþƒS„;§|,¹¹sß“þµÑ"¼Ì)d"`HHù:µ B¯¸€/Òn!0›‘eÕ _žßÝêu ® Mê‘P¿ø»r´É ·¶¹Xª¨GHÀEWØ.õîy„Çæù« M[Áq Ÿ$˜is¦S°&„ÐiàªÝmJ¿>7¶Ù‹`šm4-7³xÔ’‘¾lÌI 9x\–¡Í|_aq½)”?ù KpH'Î [ê«.éjýÈŇüe÷~Šø_F`sYœŸå™§ð=ÂOÃÉÎÇ¥¨ëgmú´a.Ó7^ÈÎiˆõçH£¢Ò¶âOHï6»’uMg•ë/ϳê¶Ç:­ö×»ôìŽJ™#œ3€Läò;)Ú«ÊJ¤nœâ`ê†{í"pþ3Öx2$UóoÝoWíæ¥Ñׯ«…¨F#7#·OJ& ô­wKy8_çá6!Y9%@ÆyAGÒvBÐ4›ŠC³ýðõXÒøŽ•P8Iï-?c¯›h²Wñ,÷ VÏ}Zúcê6LHäþ£ÐÆõF—Tr%bá² ÿCåé¨ ‘L¶‰ECôêžœ0Û$µ‡SM \FV9^*¤ Û¤UB›œpkÛK¥*•ìHÙŠ'~Ûw»ñï=G˜¼ÍJhà 73Ú›=®¸úâ/.t¾}ÉÅ‘£^©Ú<Å‹#$"ùù{Øôýæjä–#5¢z0"ŠúÅ[ÑnSýø—&% …2ºϧGñÕ%$¦øýWi6³µxS¦¥Ã¹»/åârd…o’u€¿œÊ3%l… —éâì&dЗºÇÇþTóÙS#LjÃG:ql`@,S^â( ‹UÈ´gî†{»Jï „—ŸÍmy} º 8ÝžåÈa¢­ ãŒo½ã¯„Y!9œc¸ýn5wÚ ®YÊšOÆ›@Ëâ¼ó{¬÷œWAƒUh±®£ @å áŸ5suhшµ©AÕ|w³¹«Kk<þ“’xÉ Î7(šMDgy˜Méý ³‡´kE‹#–Lü«V8¬æ€­‰‰±1!,‡I)ýº–·‰Ú¼IŒâí9/Ïþ¼›åÎgÍy'·m4€Hj‹žãNötwM,¶å4GÎXCÑæLfcæa/CÀñ“HñtQi-gº^€Ý¼HE]^4§Ønê™û“®×,|/ÚÄp€éaÎÊh3)ø˜aÀÝñuznaqqfÒm´Azzl¨¡äù67ÃÂ.Í}íj¾}j¯±qËVEdÅ.XRΘ¸4Ú.]ZBhƒ·ŸV@Û“æ6ã‹1:RÖÛ#§îž9¡F´‘ÇZÞór?ÿ\Þ¢£À–W_dhÓ5ßSI 1ß~_XX—·1–£ü[Ú,n€ûÊ@'¥æë@ö9Cú¦Ï“³ PûǸd „6ÙçvÛì½ ¢!ªCðÄVöá‡íã­Ù®'šTÚ€§ícTŽ½IáxFkGíÞX£Iï”d„P)wV~œé ›R áë½—vzò^µÎ‚ G[³ñÙ-cÂæ:8OÅé´òÔfêöà ®Ú?Ü×!û dõr`ãå‹&Ù×âì´[C3èåà’¶Æ9“ º lM}{w‹E( ØkO&ÖŽJ³›ë¸lçEJ§û. ×’{V,­Ðˤ¿k%U¾—IÙ]€¾ì«Ï‰>s]º’š&móôK”Þ=õî’m–gê›Wâ Ù@bÓøèç÷#3Ò“Ãæ??ˆð “2œ}Ö€–ÖþÀ—½§Ð‰k‚-ä0ÚèÒ ¤ìŒó·ŠBŒö·}Œ¼¯|’M‚¡ÑY•»dy*¡ÍǤmFžç¤#^²€ôOS2´é˰ò‘þ:WÊ0Ô½­m”(ãÔN§˜Dé=)¶eLŸ«‚6=ÏO²Ã/”Ÿ²ðJlG“+¢ÍGY›„—N=8hy o”|÷¥ŸZú=iâS©«oȲº}IPÐ 9w¾÷ðѤ 4ãÀ#Ð_KnÆš²O$&¿ÈÌLpk—'ÓÌç ¤á߈ñØwGi„.UÓt•3 R@¸Ì«¡æ[¿È|qj§70¿êÞ˜›ÛyљٯÎGúàíöˆeÃiµ•¢k{¨ö[î§?O¿—h‹7ˆx€nœòc•µY¼‚ã‰ä´¼r‘°ÏÆ{àÚ£Ò²ò¬´ëD,ñÔ0û˜/ÃmÇËü×eÅy‡·Y9ÆfCí:`ï²ëTA9¬Š,Ït“HDœÝ!ÚÞá2C<Ë×-8¯´"7õ<Ñ€TÕ¿Œ„_™“ç¼)-<bɽ]wUPø>´ÒÒ<+[kïºÊÐÊoЋf²ûbjUÕ›G¶âmw,å·v-}­12æ•—æ>Þtx³+içÉ'ý#Ýë¢ÍpÑ%=ªCvyMÞÓ›.›O1h„ké…‹¢Émæ8ßøëùy¯âýYÎqYPIã¬ü¢ _¿Aá<ôú³-™mOçvÈÔT)ÚHú­u1î½*j•FDo·Ááh›feµ—£¶_{£Ú@šùÒ}è„:ÿ´‡Ù¯ÅíŽ?z®¤¹T žì®K–¹æÁÙ½{CªÛ|ÿ‹Ç###ãN\–ÆšŠÒÆDî‹ŽMyY)­çøû£û#&½D—g›H ’y¿ —éÁáó‡¢öŮ雗«™ÂáwçEGFî»õ¬}µÒŲ<ÝÌí.;âvý ˆ/Ý»tbodTÂÝL9ëäv›áºç1QûMžƒýuY»wGW Œí>4.[–¾H>˜VܽZ~šrnGî³ùÅÕÝ»âzà“}g\9 uñ'¥ÒÒg>ŒŒ?—Šç9_|÷à¡„ÅøúÙ˜Ò°*ûµêaLLLJí„t!yd‹Ï¡ûò©1åˆÅþLíÐÖ’&»MÛ¤àµ_Ù'§ehó±ø<×õÄê%"%î (GŽ«›íyPB’o,Jdæ8(ø]£þѲæ¾V)æ3Ù4?\¦Kp\øí E¸z(€t4õóÞ0îM3zÙ»rº¤ïé¾Çï´KKЈ‡ºSnôhî,‰Z¨;~uÙž\2²¬ŽAë8ÔI4‹bžÕâ½ö½…³VÆ&±ÑxÌ¡@º~DZ(æï`˜FÜG¶™D½D£+ °8.÷g‰–݈d¾K=ØÂa_³5‡M©Aè¥#UÉÆ,äHE+SJÂót®ù­,’xªú–dÿA»Ög'MÌ\7D1Ù6LÐ?—Jü§ÂS ‹¸Ší6Üv8´p¬£4ÐŽ…'ÌœB›a/O62Ñ4èB ô燂ÛV 2‡÷Ú}a‰úiK¶Áï,õ63ô¯ šùR¿ÝÕœ@$2¬|«»¥Ž¾·v.Ô'ìñ£Ó¨TëÀŽ1Ä—OÌÏIŠ!›b±VR^ ºù¡îóEýÿù våúzÏé'ÇTi×÷æÿÅÀJM‘^zY ázŽ§À™J´ñŠ?~~‡3G´óü\°EP¼”“K!àˆxb`Ü ¾ÔOp¶ÿýVgÊóþ<)P‘´Ï•éŽ ‡w >üuVˆ2‰º¯+J‚-p8b䵂éÏ¥›ì8x,þBv+úíâp{¤5Ô(Š™[A «5Pôÿ°ö]%g±¦¦}³Bátç.Æ”´%>ùSv°‘cŠD~í ŸašÇV߈ a2¨d®Gí8RJ"œ½åÁx^{[®þ—qèhs†1ŽHÈÀ™• h“U}d³-ƒ±ðÙ?[|A/sÝ”9ÖÝw¾ªéMømAεý4g‚óØu~1Eg㈒ÿu‹½•[98Ì°º[òI÷:Rlq;JROGp˜TÓ¾ mÅ›Õb³’ç}ø¼‹þ¸+­ñò|ֳNjBéFÿãSv¾Q©O…:±$=™­89Â%è"”gÞVªÝ•&)¤‰{¹z@lO°#lË“ö×dµÆ¹uöó»Ítˆr´}W”Q7"‘©ZŒÅW9è.4™ãmê*^ÑÛë$’ÌÍtÃmµpñ ©*Ù•ÂtêE·ƒæÊiz¦9=0ÆÏwed2E8áhd\‚x§Œ6$4kä:8ðõ¥]TßXè¡÷¥@µlœD²à7±u°w›‘¹e¢œÃ´Â·Ýƒi'ìÈ\·ÿ¿½ï€ŠjKÓ½=Ó=aÍ›÷Ö¬7áÍ›µúMßé¾*© rÕ©¢ª€"ç$%‰ %© ˜PQT0+æ,‚Š¢€äX䜊J缓ª¨* ô†¾Ý·ç|‹¥U§ÎÙ{Ÿ³÷þö¿ÿó¬Ÿ+·¹0¢/ÁŠEÙ¦aÓÑÁ‚uå­h‘ËåÏ®¯Fme»/ú›¬ÄS]õØžp­Så1,–ÙÃæñÅd›¢î.!˜•ÜCÈ#9"~:ws#¬ý6b'œ[cÏGÍÃæšÌõg‘6·_ŠÓâÕ‹’´ŸcÓÌÚÑ}Zíµl§ lT;Yó,Ö#w¾¦Sm¢Q>”Uó Øuð=KÛmõÉ{^`!!j¬©úÛeÐÈ #f@:ÿ|·Yü$ÇôLWfŒÄ8 7…×ýB/€g9„凣ÉþˆôR‘¿Rè°½zÚÛ YoAÖèÛ­½pG³(_s†e4j<îu¡Xe"˜‘¾f\×­ØŽHgoö½Hç ‚0ëº [ƒ<6åa"¡;<ÁŒä/?ùËÜ5l%4hZ\wÞâ°ÙM“Ÿ´_Ûaì²a±ŠÔÊ„Ñlfâ>¦-gMÇð–çTÍMtÞåp󉃇õ˜OQO%'+àÆû>ô¢!=Êù^L’y²õÊDp™ùlù‘¼?Ü}óé§Ðh¥>É¢™ÔºåøÈ¿­Í6•¶A'ð™Ñ˜ûÿ¿…§¿å¥»¾åDìr!Â6ʼÀ(Ûø˜î¿‰Çói»îøž âå\Å‚WèêMø!)¢PÌNô|8¹•áŸ‚Ž…7(íF<ãV[®;Ž«† …Öæ N{ðxhÝW¾£À+‡ÎŠÔËytÀlu––¹=Üzå&$ Àèç³Î*Õûþž²“L7¸ãêŸTÎþ`Ž­Þº'HÏ¿¾˜ÐèL&“këý¶_¡&{é`$Dʧ«#þ£A¼Û;ÏEYlFÆØ°ŠmˆÔOÆ6ö1·±ÏGWû1X,†&FF‘Å]jl3N§²˜ø¯L&Ýà»Ýèó;‡íƒnf'0Øó%IF~h|›¢í¶!™xnð}ªžy*Ü™Nz¤Ë}z€Å._šmlªŽ‡ä‹êmúàŠ.á³Ï7 ;©!ǤK½ªÚÛ­Lô+G ——²,Ö/ò¨¤‰<É=¯„Ñ ý¬zŒmØ¥õ˜OÁˆÛ úƒ |.z¡lƒ$¯g³UWQLHN;Š ‰*=š#>Á<–‚°Æ4]ðYÈ6Z¹qá¾ð547CØ%Š{¿$i³ ¼“zØ>O¾HB%øàq\™£«7» ±†‹Ö|úšä¬ã…ûƒØÚl3;ø9%ÄÞ²uò̹öQKÕƒT´òbìº YIû*Ɇ‚§è‚)k¹´â[~› šî®z‡ŒêÁ’ ‹<ÚÕX}bÒnÌ-t)¶'îÀKª!¿¬χ2“*šÆ5Ùò³¢}‚*)ç:m¨Ô/² Ü+—ãØ.ëqßà ÞVF¨ÞæíVnÛ¿Žmtô&üÿf®qÂCLƒ2ïeÆöMV±Í½^ ¤¨_–ªjv8ƒ„‘Õ¾|!š”ëd›i]ÉÕË?¦˜&Èq…¾4Ý“•z«EcŒ*ÄQf´´›(±ÈD«¸Æ¹¯õDÚy™ÎtëFù®lgÙÃT–dav\)"U2H¼WóÂLŸår¦*V¬¼¿”ÉõÖÞWÍCüöÛ—m&E­Í¢q‚.~$*ò…7U_ïÙÌã°=}¼y FôVlØ Ø-[V:‚?‘¤® q…>^.žeÞí÷ÈrpÃêqZåNSU”iÁe¸ûø´U‰Ç0ê:—jî¿ Â¾Ûü-°Ñ)O4‡yÚ‘¡€AòICG«ÎËgƒôÿu=úN ÇÂÝÌ\Woˆ ÉÌÙ±ÂÄ^:§žF­°>€7 ¯ìw${ä]š¬0ÑG²ÏƒÐxã' ÇÚÙÎÊâÎíõàg"'O´FyÙóì<}\¬­ÝWÕ á®ëŸníd[{:ÏîtbîÒxçÀrVüÞá ŽÀÇÛËáo/|†É6ÖAup±Þì‘kN7ò °rðj¨bjB Ø’ ßËéh} ÏgÏÓË{c¸l–‡—·µ°2j«éµq½?„²h †žË¿5òDnVGEp[äh™|¦ yåÞ¸Šm¨†B¥r¹%Ø®á¨qÔäÛ '‹Ã£ÒÙÝT 'ײY&T.›Ê³ó+Ã-k&6„{|+¸..Ç,=yÓ*i>f \‹L!3‹Éƒ·ðgÜIdWU‹É¿¥qz~–ì‚¿“ 1¥Æ]#èâÇ`ÅéiÖuf‡¿.Q».»Vݶ:_›ç]‡E jÙß ·þ4¢€Kÿþ•ö6KÙ½hGw×|Vó‡¡Å Å•âù¸&×—øb±>R}‘KçT›“™§Ëvêl›†½“VQ zs=í—µ£¤Y¸Ø£Ö5–@\̸I‡×צ=D¿¢ ]÷ÂÉ!"«XlÌØxdI~!­Ý`´ã ¤IF[„dVaÛ—3ß½»g* ™•H¤rÙ:o«ØcD2ñ?â`ê8rµ¦ïÏÚ{—ÀŸnx@:Ä©?ãÆ‚Ó‡72¨46Ͼðq }…3${ZÂ¥3ètî–cådáçVüÅ ã¯Õ_v~ @€è\C!¨ïsÕÉãÇî¿þ4wºóHáé_hWH;-ú~™ÁA¥Fù§ÿÙÑs功l\üä» í2ë*ŠÖ}µµ‹xøxáùBÄûeïKçVqô¢Sö—¾üòPùSÊóhÕ䀽?_'èz6÷©0*í{Ç÷>ìJÃRH"–NòŸ¢ûPòã­†ŒDéOÚZen2§”L|µfvº'61yBALã?_ÌŒv‹FæFúº›»P3P6Ô×ÓÞÞ!êÇ$p¸÷­£ ùR­¨wóÅ›ííî„OÅÉ„¨kH<6 jîÀìG#ý¢ŽŽŽž¾AÕëçñÁ® éÔH_{{{Oï*´£tf¬»³££K„¥Ár.,¸\ÑßÙ6„¦“Nô¶÷N*Wú™¶Nâ4Õ×90ÞÜ1 >×b›éÑÑîð77ÜÝÑ9ˆÙÃK§ÇÛáš»û±Jd“ƒm½X4…|®³³kXÔ=4…[:Nöwt÷Žb­™îë™T—&Gá›èìî•â^9ò©¾ŽþñäpG{{wß0rÕØòTÆTäâÉž.øF»F&ñZ§4.u¶t#¹!¥3ã]=ý2PÞÙÑ%!ÅÌ`{j['ƒï½>EÔÕÑÞÑ96ƒÅ…@¹¤y Ý32h°·k|V6ÙûΉÄ-ƒkžU`l#…æàS:»zfPv¤Ì¾ÉÙ‰Á–<‘èøp?Ò¬ž>‰TeNB;>8‡„Rqmù ŽùÚ–ö¸aâ©Q¸©ð3ÒV"É%íÝðîC†Mç0z³Ø ši–‰x?¡˜­ÆŸ³dJ„<‹î‰YüNáÚ‡<¾®I 86Ø=4>WŸ 'd›?c”q±Œ<ʳ]™xqÖÛfgjç¹k÷vGÛ"î ÜuWOî² PÖåäÝ®Pˆ‡l˜,kÿ„]™ëÌhÆé—‘5³õŠ?7¢@hã·ñb>“äεtÈÚåÆ7BŽcÎåçÓ­]òmC3¯_9c%`'ß@˜Ì¶=¦˜Ð="#=…TÇÔäD×åâ8Sýô‡ˆ…îB?)˜ÆE3‚ºØ:Çd]…F+4Ø„Š÷0WmÃÆýW€Aö¢ïÅŸžÜääÁ2·ÃÆçí-«ÈÆœrÔ x¤þÇbsíoË,ìµ²x=ßØÜ6È9!.;Ñä˜<Ðuk#› lÌØåíH³Æìˆ'ÊVÓý÷ùG%ݸœoK3ŽØyÎÂ/åzQ¾9‡z³±T–õT²IT·¨äí›#¹tòý„¨Ï§Z¹EìæÙn9ÕAÃ.ºK`ÌÖ„@WŸÓ¢_Í>[¯g©`¨ÂpÙh~ðÜÕ£ÛMô-›I,Ëò¤„®;27œP/wÓÓå}•gÒ˜TnÚácz¤Ðûm$çŒpáÚäd ¶À*áêW[Ⱦ»WÙ[Ǥ!¹T>œŽLùÛ²v9ZӜ֣}^Šáqyö)™~ö– ¯T˜ ¤c¢¬$?Ç#÷àñÉ®»\cêªø”ô¤8P3¡!°Lµ˜°Ì÷­2Ûu¢¨0+ÚXŸÿ]¦V¤^æ¸ ª;â‹æ&“Ïôò™,û€ÕñA.#ÁsÄO~lƒË·ß¾c+ã)L;ûÿl²͟1* ¼ày„uÑðÝd=›Í2\jÀ›YÌsá1º¢VfZñVßÂ=[.ëÓý&cõ`pÆ2ÀNVÕౌàÉEȾûÙítt JÇÇë9 ¾‡‚ékò±tràŽ•ÙšÄU:/eR©uÆ^$âD,,ìÁ„…;)ÙGŽ¡#RŠdŒðâmÏ[‘õ÷@€Iös‘ ™û ½0Ü…—™y±ý­Øj¶òB4^L¥¯AŠª4uñàš£wîoaô°CŽyõÈgú¸ðqoòéÛô‡ˆ@UK5öEëãÂ< éöq50¼Ð«¡\ìrl£P8±”8ôøDBÐöçw×^AcwÙ!gåµ…¬ÀTDœû˜Ïñ=-û´Û:³‚>šZÆ@S tVZV°ýñ'½—3wVJ‡ß¶Êx;t%Ò6û‘ªäÉ®b€c~ë>þHJJJË*ßâlã’³sèNœmR0¶p3"m+z¤z%Å%£ ÚSÁnÖq×”L;Þh´Ðf5§N4ŽDgõålëÀ$UÛÂÜ™:ØF¥%FI Sªq°ýÕŽ…ÓU³JKŸ¿û,í{Ë¢°/—×ö‹'¢øËO¼Ó`¸çÆEÏKod$ëé³Ònuh*od /üÐ¥£¢2ëŽPVbaÁf£™ÔŒ÷³ê/­Ú_žæÛ©jÈçhÊ6uôï~¿bÅŠßýÁ¬‹˜á®lóép-ô ja3}ÞüR0Õ5·a^;‚åêlÓ~m‡‰ç&U è‚t¶¶Ù®Hº9ˆ­>57Î]{ßÓ}]Çåê«Sÿµ@¯óØ’5QsÝÀÔû‹l_=ùþš`eB;ëÅ$üMâÌq+ÌILÈE¼DeS]l¶Íå5¶'*Û‘UÒNp³â’Ðÿ8vaÏÅÿC—×››·Â—·¼È,OaÑ[‘ªpÉh çpmêÜÌ$¶‘ùÛ@ÛìV$ßVÞ›tU~ª³ÍíÕ¶Ö»ž`Ío*¥r,¿À6%í¥Ç˜óèÆܸó;©Æ¯c›Éæg¾­LÙSccð綪S<[ü˜ô•±^&ÛŒõ·MÌ*½‰êO²¾buÏ©…lSP3Ý¢£"õ2ooòM:‹çò¾HuÜû {]oŸ)~1^_Ì´pP^-áhÈ6_~ÍJàOÎ6ð”iucÒÎ?mnn~YrÖÀØ´uBªÎ6SÅl2ý΋÷-Í7÷FÚ$hDœ@óׯâ’ãóKšš›ß•ß¤Ó«:§u² <¢ÞßÚÅ0s©zÿéý«€ÁzÚ:¶ÈåÒ“©‰×?"«›´«ˆab󦵷·»)+ÞÆ_”m@ùPlXp˺ö*º˜€¥À{µºa¥ Ï‚s¹YÂ,˜ôZ4»÷­ýABO›-ϱÈV $y)4·5÷ÙŒj:¦Øl€ÅjBÞÝIöFûªž†@énûõGë›?×V­² m¹Øô5lóñÞ>ß±²¶¡ùó§ãñÖ@x¡æSTC³{Õ- ¯“|­˜_f›Vhò“À˜º¯ø]ksCn´·@@GØFÑi¥G=ZQ× šAâ˜-Å6H@ÞžGú…ú¦æúšgNéÐ#ÑTËs2KðâSsSý»˜_'Fʉ£høÃQ6Ûë]m]^¬‡ãšìO Mõç·{ÛDœ‚K«>µ3zï-ݲMÁ;=D‚ê`eÖÔ7øÙÒï! åÑQ×v“IaÜ}ñ®®ö¥¯%}ßÍÏXdÇ d\­lmm*Ø&´fz›_j®Ä„§?™_‰æzs6F¸ºº…&nGGÜß#«+Çq9VÑ[•êíêêºq÷ùYôèñ&ïÄÛóvùøám±nnnk’›¦ð«î Ýœ÷¯¥>×& }]•Vyºy¬.ïž[üò¹t/«ÜŠIlª8¿ËËÍ9`uúÐh³“[4܆™7N‘xð@hèµµûj¤aò~>í}?n»q{‹KPx6VÜ«ÃI¶î›¦”Oàã@§øIÔU»«â’£G˜HíùdE9o=„±±âF‚·³ß^´D&Ý;¾ÝÛÃÕ+ òî»ì~‘&E_ÄšôöÍG±[¯ÛR€G#üp+ÂÏÍÝÝ3«ð!¶k<%ú\Zàçá·sxªÛ˜)R@â×ÙÖá§QÉåk¤*ÞÊÖxïKåȦAÜÿ6ÂÏÝÍ/êýéÁ:†Ç©¿³ËÃÃsgi?Ôkxg›™.'7‘íåAL¤¼t ÙÓÝÍ'8öy Ãj+9ìéá“>,…šKO8:xÞëCÒu¦„{»º¯ê™ƒž]Üàåêæé³ýØm¬ñ/r7y¥^TVЧd›ü ÿýWê°bµ+ñ2=<<œÖ +m€ûjyíïíêtùe'vœnŠ ôrñ )ïwFsÓ/4C“mN«F ¶!ð³ž8ëlì»Ä¿P¯]P1Útáj6u&[žÑv_ög—ŒÞ»qKºbÖËÔ°¸iî/³weÓo_›Àmk«-ôŽ½š!ÆKVu㨫 Si&$c÷ð-5¢ù° µGìŽ|0Ip}0 Qì¯Í^i¯gd„Widh̶Ú{¡L ·n{û(>ÀIOOù2}û•±ÅoZÕ§g¢_ßÀ`ùôÏ÷ÍKß ¿ûö?wÜîžgI9õ»ß'ä?S{žS,ýoÏZÐzÿðrs/Œ:âøl}#ÞHC ÏáèÍ— ÒCT2Ùsj÷Å@__Îw8tñÑŒ| ™pú¯ï ÐÒHFÀjÏù2Å¢1®k‰—Uur‚þ8xzÐÑaÝÍ…b)ÙFùR²]Hö^|5—ÔkH‹c‡G nO»øŠ¦#˜ÝÂ[к»ÉÎû€uºlñµr1QÔqþ ¤™6CÐOSÛ=hÞpຄ‡ñóÌnb=Øôü°À.Xí”±MÞ笴(;ó¬‡õê5\]Øæ ïÇkÏ$“,Û•qJs‚õ \EXŠh&–Ãz§äeéw»ªçKÙîv´dþûP½€•]Ò€}k¸¿›Â¼‡gA©»Ø”i[X£yÓ£vß_˜/#ÞK»š–1HR%`Ø&¼ò•9eÉ2iœXt¶?<Á@Àµ$9X®»3ïâö23ûD-šAÒæÅ4ðŠÈFaNTèhjŸ·øŸð5¡TæÔUô–[“õ7Þ„Ú²v+Ñ5ü¿ŸÀ×°Mbéµì€Í´óßÔøA÷ZÛ$"éK枯Ó÷=Óô¬ÐŠÇâð®šÄõä£4þúB¬„æGù¶¦,:×öt9Ü©Šõ‚ß'ßUuH€IAY4Õ•éÁd²L-Ý.W÷BP¿>¹5y‘Mv3™Ìb< š8Š¾â|¤LÜ °Yföþ-h ”mzFjW9ðhL^Îõê…b¶ûM¤»ÅY³ã¬ "5šæD¥ksïô<Œcúœƒ;SO•áÑÞîµ ½ÙŸwóP’€Ã‚o2éà ”¦ä6ê“ÏØb,>Dg²}××íY!HƒGºBûŽH[P‘)#ë¹Ä"[ ÎæXÊiŸ¥ ë|7Bêl÷]¥>Ö{Ÿž&Û~‘m ·†¦žUÿiV"ÇJÖÒöòùù M0]¶£bVm‚ÞQŸBÏÖ;°ãQg¹F>y÷[©úþ§¿êœÛYsrŠl—©Ø„f+9ÖƒŠnë嬊e½’*9ôZ^’eäv%c?¶I¸¦îÞ ̶!¦Åg¶†šGd@ê)%d ûó®.DkÂÏ„¶¯~NÅG£YaÙØBŽ|¸ímÃc0X>qÙƒ2H:ÑÉF3ÖÑH”7ã:»X¶–ó_I·GÞølsÈàY=é‹çn¤ø’=‘tÌeûí6 F­`ÍV^ð¸E*•õ}¸KçÛcyQnûn#Æä¥Y<‹€ñé±xÔËš‘_Úþìä&ÇPe.ï¡k4Cd¬nw2Ür«C,ÏLö[”²IF8g÷m¤G>Z…„x"¥Aý÷õP˜6BØ̘óµ³b±dø•Ùèj“f2%ðÊŸž•Î¶zú{î‰4T3/øúÌ»ÍSâ¹™[ÉÖ|_Ä”wc UXö5™T"z‡eÊá#©ˆ”Yá“ù`:ç“|·ÃS°þ¼D:7'_H²rØòåBæÓF„mnìYiç³enN<5Ò`ciJrDüw´îè ja\y>Õoê Êœ-‹ÕÝؼ½» Ð>‹± ò[Õùm|ïÈ/²MoqŽ•½!ï®d´ÕZ~Ä*°@mñ]Šm°K¶¹Xyæ#y°âÉ|¥B[i5ìK2L­–éf¼Ÿà胸½ŸOw ÞVŒ_-©búÌ@Šxs½´{CÐ`,£z,¾†¤´[go˜q±E—²\‚m4ã¿Îµ3õM±¸"²Žs™SÛéË  ÄOòS.µf\*[¤‹ sŸ4ϼñCÙÆÙÚ=ïVY5góµDmÞo3`DMaãnªÅ˜nÞ…Ž;s“ $Ü|§þÚÒ)lLŒˆ:{F¦Àî2¦ *wã\ö—Á7[._“ÛÐJç$ *?¼>`²@?ÛlVØÜ̵HçNÝÙT—õy3% Ô CQFhäö+Ðd£ Õ´L¹ñ?—î³%_ýF*³ÃøNbÃN!›lmë‚gŠ#]åd°ѵrPJúÞ3Ìà©ð|£-{Õ.|kÊer8Ï6sqœe9oåX!•Û\õí÷êº#ä×Ü@êÁZ&ÏÔîõ¦ÄN8NóÚýk‡Ûä|á6[W‡ùÒH¬«õS˜Ì¾ÛÀè©{¾ÖßNÏ€ÄÚúÄ|’`ÓíZ<;¥RÝ¢q!Ûx[ø„¤§¢U¦$­òu6 »´£‰îf¹…. òíVúaç{² zÇ­¬ ™½£Õ—Œ-T;)˜mÆàÕæÍyžø{郎l‚bÒ°FnÙ¸ÒÓŽÄZ9<¡8Xž_9ý}v2~dJFab o±£ÛT]ä8Væÿ»¬ôèׇ`ùî0‹=¯…]Lì¤~üNÊ>A¥%p5^~}@ƒmô,25Ð6 å&Úï¸ÖÙQuŠ <%˜T²ÅêÐL“ âWéÏSvp£yœF¾¶ck|ý÷ßÔÜiâ°ëfñæ5ž÷Öb›¦'9–¡± ×ñô5$##{€Ìý°”’múœôLná «Ùò z¶{tßØ( ¸Î×Þbelò ìFÞPH–MÊ$vêlc*t»âΑ8²[ý ¤L§ƒm®©ØFù¼å3­õ5—Ä™¸•Ý29P,{5ÙÆ-qçÃÅÅJNlqäX®ŸR 1¢'§ÈÖ ÈtMý³²Íì»],:ï`Á©ÂÂÂ3…ûy&ô}µr¤uJ¶qaƒ•"ï}?¶ñÏ8Z 7²äáîX++L©ò®ã,õ²oö@ öKCpÉTn«Ro37q:5È:àe‰|`c™ÊIez à õý<Û€ºº˜x™õ£eG»ÈËÊÜa£Gz8¡Å6Ú~|Íy~>ùX2Ç™8¦~z\#M%¼J>Èzå(ï2˜Aê lüEñxÔ]ÿ F“4ÞÇþF¦ÅJx"æù˜—´„s/gà}ÇUŽÇ‚QÓ×Þ®Œy7g­ãú}ê¿_ßà°½Hsä5[Èï&ñ¼Ým­Å6ç#è;ÞjÖm®yžbe»¦Hm'5ìC28Ûƒ³Íà¥p=»½Ž;{¼_•­^ZZ]Ê…7ï.¥ÙàÁÛI!e§ú™Fí Ú>lv´ ¿ðVmFÉ’­€ «-ˆ¦³µaX¢1ò#½€Ü[gk¯³ÝÖ@_bl'…XÎ ZÒéEõãxF«©úì}jï­ai·ë)‰,ü$jßTŠeXì˜n›e&7•­4Åšššsè`.‚ƒ‡36YxfªË6¨ß[®¶bïât>RÏ!³ôâc0w»ûÚÃzHzåì¥aéWèmÐÓÅuwõø{¶z»CùüGýŒH¹ÍÛÄÍ.:h ü8¶9ì"za}5õjŸ>-púÛÄÙòï}Ä:äAºU¾_Ødå·qÊS 70L­J7 ƒ‹šÑ!ß•º_õò3ÕU˜UŠ¬g·Ø„îε[‹Ä¹¹:æÈNŽ‰B1ò™Iå½ÀPiщ—­“ˆÞ†ÊJ*Å£´þ†CO‘ »ÛEãˆcúù.=v¦Ïì¯.Ð'ÙÃ; _sã3•è2,ë÷¤S4ØFÞ!4±B‡÷•ÜÌÊV<ÔpÛó<ÝZu½Í./ã5G±×4Š{3#G˜åú´ïèQëù­+“ ߪÏñ‹Ý¯Ùþ´ìç3*vЩ·A„ô¶»TÓÒ^\©:ps£Õ»vŸ&íÕ7  nùš`G Ý~]5½f‡êœ£«ïg Êx¬)æAKP؈¦t^¶AsÍ2ÞŒMùaZ⦋«á=ð .QÖ|—mdœqí-î”27~a‹Ý~ý$´Ûhš—ù´ ™i‡TÔy6˜ì°{Œ³Mw v0›Hšòhô(d<ÉtZpl°oBLx~þ@<Þc#Œ*ä›»'ÄGp8ÀÞ;È´z²×ÆvÝ3LK¼Ì,MÅ6$ ¿C2nFguÎ*ßOuºXšÓ…®.ætžÙÊv1<×™Bc²šÇq}Â…4_ÀZãçÄ7·ôèAó†{yÆ&”Ýu˜^ñ5Ÿls 9Ûq?Í F¬ñr¸¶Ñˆ:xì3‰av*ÁÎ?"ÖφÆ¡3²l =ç#ÍØUy›V²S?/g:×ú<êøòH"̉Kp¶qºs1@Ù&Ä…vº¬oìuà‹Íõ¡‡;xLŠ{@DD ;•-<^+wR¶f´2ôTwåy.ð‰Š÷µ1½w5NßnÏÂ;¡hÑý­§«ˆ¶21±ŒTÏ2‚ØqHà¦g‡L­ÔÏ.>ÎwŽP\”Éè4&À “xöy/Fp%ÃPµ¥9Jµsr¶äÑY¦ ¨š7ÃÁðT‡V¤qÀï3ÕØfO¨ûªÜÛêZâhgß¾ʯŠóÉ+͸L#*  “~ØüÍãhù.¡)T&'õT"+qsäì&Ͳ!ûžn…Ù†¦ç5¦¢]…8À.´Û”§:aÍØhgwõÝ|#å³ÞvÄÙL üpÃÚÒ‚jBb,2e屶_º”½‰Ì6·¶A`M§RxfvE±a Æú:ñ¼×Æ„Àw–Z„Z7Í|°äÐ*ztZYóÿm¼E¼“ú!u›’,°·QO"¯©'Óiûªa¯-fI êÇ8˜¯½òŽx°?ÝêöåŸþTÅêDv¨g7ñNŠ€®ÅJ>Ù™îL¡ÐèLþ®‹à÷¯€ì%cÇR‚)dÂ\·ÿº˜ð8þØkÍájƒæ•ó#‹½á°°X:òÒóÀ–Dïø Aú‡ “%öYþ»É6 @à‰¹‘ò—5ò…«´"«†lª¿æõ˪—¯[Ñצ*WbQK]UUUͧf94¯ÏÕuPÑÞ𡲲²úCb+:o¸#«~ù²m\¢^$þPý²ªêUS×°ö²5×û²¢bLú³<ŸújèA1ôè)44³pß×øúc×4±¦ ðU¨²pŽÒh«+OÓLÛcš!ÅÝ7">‡K3.¬Ä³÷”‹aš9¬MJrw4ÆW,z<oiîä}ððáÕ^ŽækFУ’±Žx[2ŸÃÙýfþòÜà¶!ÙÉ#tm´?Ÿa¼ãz­Ú6ÜíiF7!UþQßLbüK‚¾ùúõß ÿ~ók¨M®åW47ðÌFÕ#  )C3)är ¹\¡T‚Á_ðŸ ú‹|žm°óå/‰b‡fU`ÓjðJn8PaH±íQÎÎ ;ʹºÊ[è±=Tv›an¬cû±6-ÑÚaÛ³÷?BlzËÏ¥:…dª~-ß"L-z{)Mûà¶sð‡’«mü"Nž;—åï“;3ºJ›mԱɟtºYŽv>CÔx*ÙF!“ŒŒŽk‹©¿GÈá- ÷µ,-û5ôwLIâè7ß@‡ºœgx"çìEC/=F>ŸG½ á¾ù7í-ÿ_N"ôÙü-òù²Ò锬ák†ˆáE€€:ž £˜{gç©iUΔmà‰¸Ãˆ.îÂ&¼í¡ËmaÎT®KôDí¾éŸžIv ÷Î~™jž|áõÅ­Ú·œ†)åì¶Èô«×¯çm_¶¡{V¥^ÕÁ6˜‡CZ¸•ßæÓ˜GDwÅ!¦çvLQ±n ló+¨kãG„þé·¯7äíý3*áÀw?S†| À%9ôí¯Ï -+gôßqˆŽR×n]ùï~ÇóT=1ºÐÐÛ@PSåý=Û“=¬Y¦N‘M#r%Û€ëùÀ&•K¾¨L©Í6Hh‘º•<ÃäO ¥iwÍõ½–T'\Ýà½÷Öç[û´î¹9\^HqS•¶;Â9þ˜*²6Û »"…†q¨ã'RÓL“™qòÙ›ŠŠŠÊ×åŽ,Òñû/Úæg›ß@˜ìQpÅ¿/‡Ö%@ññÈ_L44‚n|xýý·8Šœð‡d] Aÿªˆ·^P£m¼Þlnýš`¨ñ…|ld^ Øê´±àÔï¤Nù.Ç?aS{øe‘!ÇcÒÜOÌtú± wÝë€æÍ,¡Ùú;F•½m‚7ÿàÝɃ÷šjoìøÅCÊðÄ…q~ž9Wu² üz8’g°ùbª.y_uÄêØ5(bbטŒ€°ð ÃLªƒm`Œ!j–3ÃúX}n†0Uñ©“\D5ÀUÊc#Ðè8ÎyËPmÏå:1= CRUÂ{°$‚ã^PGŒ/æ¡9Tu„»ðÝ­ƒúp¶™|I'YNL nÒù˜Þæã‚|4¸Ð™G¿Ä³£ÃCGÐ`˜òlWš[ê­¡áẛ[é4n…îƒ QÂ=÷¾wl||t Î‘G=[Þ ²áÁÁ᡾X>þè3\øø4"®<9èm½ò ²*¸®a©›Ìï¤fšö./*Û ˆà!¤aíß„|ø6'“é׸êø›_C³Jöøð×ß"Ú¢?ý/È@Z±ù£ ‘ãŽÿ9~µS)…IÀžêAb|  ¾=‘M‰¶Fùp¹\S+—›0½à‰½*ª<“iÎãX{D·tÕÐÎc(Û\v°H¹ Ï©µdS5ÐÉV­˜ï¿bödj¤)—ë1$ÆÓ‡è8ˆd®nÛì×né²êI3JsŸ-È µR9«Ü‡›™a£QƒlþV¬Á6Þ€AZÀHÃC¦Ù‚¬ÙéßA¿ú;%Û $r.úÇ_C¿ù[hýIH==ƒåo ¿úÄP ãÿ¾þaò¡f#ò&ë¯ÿzþïŸþ9îõ¶¹Õƒ-ŸéNû„”`hn‡´59Kæwùrì€…Ê Ý1 –®ý Í„´Šœu€PŽ²t^,œ*ø‚î¢4ÓøiYÌz;þ¿¿ATÐèǶ«Q¬€Ó„½ ù»Ã¹Éº–¡ŸÑ”„^¢ò1â‘4ðX\‘"l‰  ðGÛßÜÞ0NøI @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€?þ?;ìâ endstream endobj 674 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 95 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 26449 /Filter /FlateDecode >> stream xÚì½gTK¶&Úóã½YëÍZoÖü˜YóæÎÜ;3Ý}»‘Ž’Á{ï Sxï $@B€,/á½7 ï½7…÷å«2óe–£ª¨B§»ï9wîéÚKKdefDFìØñÅÞ;v@”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJ¿qAîÿ ç ½àýB~Š¹„ħ:-ô“}%D\VB‰RŠ”_èžhÒoU )™¤OòRÏMäe‰7R –V<@Ñêˆe§À‹ÜÌ$¾'Ž Øš½&\ñM|&C’$â²!¶õÏG8w1™_ÜúgÏÀ‹$öBV«¢˜†%w´‹ZGR"Ѧ=Ç{«ÄrGLõ¿Ñ5 ð—Dq"À.' úYàr࿠ɀ ØÀ‰ùéÎg ß9ŸPø(¾«ç3;cõËϧIJö„Šà(Òðüw…„üaa4(ÀX‘bˆ)5^ Å’^2S‘VGH‚H Q°Ñ9-+ZAávÃ|ñµCîg š¡`‰Î!5(¶ò‚ ”9ÁªŠi¡ª‰+ÉJìüËpF8¥x^òX$î©8éy•DZ†ì¿ªœ?Wµaž,†;hÝP6©?8ë½%Ézòwdnݼ!¯ŸR7r&‚Gc–ÆzuýóðåXM’Šì‡g|V–[­”~ºråú „®_¿ÜÏà|i¸â½ÃÓw“‡so,ÈÁàÚµ›·nÜpKØ¢!Oé‹©áÎwoÉ\þþ{#‡'sÇÀùÖO°¯ü12×oÊ\ýÉÒçù r“IØÈõ¾wëÆåïþtWÝ8õË p¦?°K̽²_`p8NŽòùá÷øýÿø'ŸÆ%:ÀmòîR´þÿº¬áüuú„ÿîHù ø£²‡øwhC%(cÃî©Å_T·ant)_»÷àõ[[mÓÆ#îÜp¹ºªJíì!òÒJ™âµ{YKÜGË…–˜§Ë{´º—Žª:˜G.ö/ø9Ì”¡b7ˆçFerÎÛ¨„Ìj˜gtîZÄ4r¤ë±™†ëóÏtšá¢b÷bõy5ÆÛH ŠšMÔ8{]ýÀLxÅ»è»>‡ FMjˆªÕ“9<"?]iap[?f #‹I&#Ò?Øm mÒ5³‰$ÛkÖ¸òÿ2¤^ؾjyÍâ¾u6ËßÊÝUŸÇÀ_¤“IdÒ# ÆAj˜¿•ï#+Eåg Ó4‘6RñÎGß>pÉnç…½®cbÓ!]P! õ•GÊ«;w­3á/ü®j9ShðXYðÈHUÇÊÝÉåÙÛ<~­VÂoÝRnßA®g«c”õíºNÌ|ùØÕÔû-‰Î¾FËY|˜i¼/Oud1,&ƒ`¨llé⌲Èl»¸É§Z bwà²^Ƥa7ÆÕu‡ææëK> Öm(}œUßÓZ_0¿<×£¤ùT¹p¡2Æ Üq, Á™ÿøŸÿ}£ mhäS2i‘mì$FS%® y€ï³Tþ1¸ g˜ó­fûéB,\r ™sägx Í‹¾­l°È†¬¯ñŠŠÆíøò$ö“EpÍäÙâç7äÔ6iHXýôÐÌÌÉÛÐó©y€Î)s×üÖ-§ØRä¿øÄN5èmÎ1ƒ'@s:*rú:º¯§¹:ƒJ%S‘Çí±²·[Ø2²ÜõI^ý©÷h}_ûëQPúZ0¦–­Cóè6ïbü³¨é6€›–ÌKÞX ?lI6± žx£ø©éßiM±¯Y§[)‘.÷Õ¬ZÆ79Oûó"îߺlß-¬sºšA‹ €ý9€1×W }WÎÓTÜÀ/äxM¼ì=5e9ýV÷[´ÑJ[Œeÿìò/:os0ÑßµI¢£äuùhSaeZuBeȘaiîšÊyT›â‘X½Ç€ªëa‘- uB¹EŸu¡T=Ìó¹5‹Éd0YgªÒö`LˆkQ–Ñ“&¯e¾M$³Õ~"CSÛuzlgò¹¶Ë |Å•«óTŽ•ÂmBúdµÑv‹c¥2wj”d &HÀúDÿôâ ¯2µWoªâ`eض;Ù»vì@˽Së$žòøØæŽý³vx ¬ýdãÿü”ׇlÕT“Ú ‘é†òLng«[»ãÓ‹tˆñ m^7Ic«õ”“ý@ýÛõ\8]hO×ÔpÝ8ä‹@!Ž~)¨ëçÖe/Wö¶Áä fdYõ)…úö}h|.ŸcI¨Û†)“œ—éÄw̓Þ÷A‡_m,=»±Ût•LF&ƒÎ´îË-ú:F}K{°³X'ݽ“§ø O£ŒÆÑo¡ÍG»¨éUx˜c-ÏôE{˜È*iùGg̯ílcblî]¿ë:¾„ƒ?3Zymv;žÞ4zMe°`I†ê<@Ì;¨¿ú¿ƒ<#a´á¼œd§íòy¾ØßZÌË-Xà)Oa^&ŽOË€h­ðcL·£ 5¢Ñ3ë‡qŽÊö)Óœžsz|dg‘ØÛ]Íß´rë¯ÿéºÒàƒ¶·;ÕÜA¡ã‚­Sú9h+º)‰ï—¹jNæûP§à·;¸N¢Mî=«O±’}1É­Ó—¡N/*÷©¶.%¡f•Ó äýÙçîÆ/Óz9£«é]­–óhcbþ¥{R¢ÍQcý,¼“¿Ñ.˜·!8kÈD´ìóžÓ[R -üGÈ‚/ßúcTœ c¨!YYݪK4vÖ¾~”½£ØµA€ºc?m5.ÚÀJ/•”æâú¦©ð­{ð» ü×¼¼«žïeìFç¡ ÆâE¾%‹ßîG)èñІim\=Æé¡,³5=ÂÐÚƒm¸àcä5÷3y9ä; ¢Íjk¼žÕ£œ‚ÒìÏŸ2sŠºÇ8÷çÛ+ýœ¼G¶h½ŸbtÌ=ñÇ$6h€øí [-Ýô®™'³Œªv^ÿN&{!8^L×eYO¯îr,v*yÛE^öÝ<ç)kcyvpp¨èMˆï F9¿5ùöõû ^cî­/  ¶×ºØØUÌ0Aòar¨›_x‹WòsËŒn›¢>Ö -¥ÏG›“£aCY•šî³£éVcm­öù-Ö¹é<Ž¹=U¬`pH¡Clf’w_ù¡M¢Ù]³ÔanêAjˆ•䧅æöe•Õ…¹™?$Övžž™3H¯Jóô}]{ÊÑ·8\žòø¹h=½ÂFKêf„—Glnî£Ùp{Ðæß¿|êŒ O®>¥!-ü ´‹Âbת»ú¿ƒ¼"9º Lu¯Ÿ¾oZôIKÖFš¯«±ePé‡ÛÍ îýíÞ/¶æÖ£ó­.ªJ 3G¾ÑŽRì|£“àkØÒô ‹ëžY^ZhI Ѳ}|ÀÓÀÓE;Lj#mD¦ÝN6#ýB?”œ°_nO| îO‡˜/ e^òÐf°*ë]Qï!™%8Aµ>Xådk[:x m°}_1FÆIYÅ“ã#\žÄâ…ôpmR¾Ñ/h mž £‘ÕÃIÖÙÛc%rWo—­"FTQ´»}P,It:}ÛêŽì£Ê)ž"„6$ü¬¶Jú(Džkp´u.ëYå¡Í«ûŠ ú‚‹‰Îûzd\ VüÂhsÖ:ø´Ù47‰kš r¬Zs 'J×ÊÖ¹˜ µþþº&6¹jÇ9´YéÌ t±ró}ú4,8Ð[]]«jhnƆÂd—G/áö«K|f`ùè€HæöÖíy7]µôá½âOׇÏúf–VgêÒÃî^¿7E,ë@yº¡‘ËÜ:·uh¤ÃG2a=ù>,I{ii¤{WѤ°wñlêL`hÎOus°R½w÷IÊX¨Äý7>ûÌÏ¿ÂUE+¾EÜ„*•6ð]"¾Eí¦_ÿ¥b»Pzj“›€ð¢ûŠµ4T‹¶²K¯e²¸%" ¡ r [ôø’‚[ûÐôêêR[U¦®ÜÃøô®’$Œ‰¶£OpÊç세KûÏ FøŠâÑx±µµ×È*â7Ã_…6¬ÕÊÙ°>IÍ÷zpZëÈ«ï¥A‡)I9ǤŸ…6F±ËTÂvjµ­Ï»XG!4ÈþYuœßëF­,ÆÊ,ä5‹V9hÃ<9,µw‹xƒ´æv¿JÝÜíáËçå®ÝŽ­™çOž§K|´´R˜'…‰Ïí ." ›­2ÒÄLQ!€|úÒH&fêü÷çþt[¨‹EHJ o<‡6ýí5”¥—·—'B^žnAïºþ´nOWU4ŒÎ(ÈÍÎÊÊ-ª¨,z€Öv(‚s¤ö’Ùù>Ç^™ú]ô»nlÐdå=жåLtPÞ…z†},æ¤Ú(=„ë8QŸ¨§c=‹Ãdõ/­ÛH@›ã'–&Q_Æ)ì `1»>?×ǸÀ¢Ô[˜à‰eÏ颺 {væp;‡=á2™–i¯hüè"e½{öôC=|«éc¤žÅü1™£ÛnO;j©g®C”퉘'>6vNÞg”磮Üü¼D™lÈ {ö<""º¶g¢¿.ÏØÈavmäÎ ìù*ß|9Æ ðpwu Û^ñAOßfGæÏöò…ä¿¿±¶2ÖÓä1ŽÎ`Ñ‚œý#RùB”g§b”Ø~1ÚÀD<èÖ¾¥ÕÆÓHOæ:LtÕ[f6YàÙT*§» Ö¥[™cRK»é@D:§Û@¬£Ü¸sŒƒŸdì›G¾ÞÁ1ŸFÊÔä-;—¸&ÁLmôÍ»–Û܌̗>‘i{',Áñü/G›o¯;|møŸEÑÕ Âêh¸—KÈ›ÅCö§í÷¿SèãÉÌþ`½ƒfhºÎVQ-k‹6 âafgTÜM²âCžÆ$÷OÌ.bZk’ÍÍ]¦¸` ‚6œÏ±ÈÛIOݬ\÷/í±ÅpÓe”ÔŠ…Ÿ3$X·‰™Å.ǯô”:Y[„&Už™&’tTfYÃÖÖÖÖwˆ£nƒ ¼nèû”ÄĤ´Wž?üáò˪a{ñÙOÝŸ¾¦CÓ H¡Oo9猨ÓDm7`a´(‡Î·50Þ™é©éÉÎV&J˜'k»Ç<´y7!°ù&ÐòÁÛê“™¯ö¿$Ú®záwØ–Ô!÷÷g_SÛݧtä% ({íaj‰Ü yò&ëX@ÙË@€ˆ,ÜÍ4&©hêÍãÖ_?tÌEšc­,^ÙÐþ€Hâ`3~¥FOÕ|ÍD& ?ÜÛÙ3²7Ê\QŸ% =_RÒ3ÒÒ>wŽ/îöUšN,ïpº5ã´_÷–ú—êTOÛäÜ¿•]o_óoÙ´ƒf‡»ûÖùÍ^þÌYÅÌJb¸½¢ñ`ò¶JDÝĹD.Ú„ñ,)òñ–«²lÂ÷µõ¡]5ôè*Nhí uW|pru+lž`²„\VØhcÇGÞ2+}r°·»ohus+ã™ýã„â@²eÐÔÊ1§t‡Ë ·äÇÙï2—‚ÝKÛéÂÞ.0Ú¸óÐFÂJö9Kê¼ëƒðÍo£ ‡z«´ñŽ†Â3G[ho“½MæÙNàŽ±ÌKÜ_Óm–¦ŽS++OMäëv9 Ù$âQ”›Yè›rnÊ mPØ6Â虜ׯ>mßâ¡ bIñæm8úñ•' óàíÜ6wtíK˜Ì?¡ííìììl5åd•Í=S‹ºE<æ«>˜˜˜åµ 92Hš·A׉›·ùÛ,©dëǼYbò{Œmð;'[¹-ÿ… ÊâHÆ™› ·ï o­NO­s&‰ˆ~:jÁ K° ‰Ÿ)¼}U9£º¾¤¨¨¸¸¬¦,ÙXÇ8op ä¡ ²Õ¡j{Çâ¤8GG»_T·á¯¼Sç- ºyÜš©‰UÒsÇrf'è+ŽwB«w!ÊÒ³ àÔ’aAçò7´W­ƒ‹e‘ÖFn¯à¡¬.7ásÍçfU¤õ]ӧׇÇYÖ²»‘FTaç®doC å(1ÈÁ-úW× ôk]¿‘4ŠŒh,&HDf;ªÓŸ›:‡¯óFžh'uM[¤ÀÃõiúú6c8¤×Pæjo+ö,Á¦7H==>¡Ð‡þç(×]\cRNS›X‡p~–¼p6ü¼Md òæÆ&©#°2ùÅÃÕ»qöXŒ« ýäC KdBéÙÏ`†Oh·#™¡6¹Y¢ßTr˜ê㬯k†sø·?]coíVݵ&2óFÆmú£r»°g¾4âÖÁ…ÐæoÔmàüÉhïªÉ†þŸßAö¡Õ-èߧœN¨HyɛE&”‰äi£`ƽYùþ±…OìªwQ°xÎé3§Ëm†ªyãt?åb©ÿº¼·Â=¡~U&eì€Ï¿`'û¼^þ0Á̳v Ïìå´ƒÕÙ鉱Q„{{‚ôoÖ,ìì 9Ðȧ§d\AÆ~Ÿ‘ºaP“I´¤z[0(Ëö‘E Ž@ü –Y¬ëU»vãew1˜°:`®á’¶Ï³¦˜‡Kaª*vÑG§{‰Ñ_W³'VÛõäUʦ4Îq•S ¨â jœ‚e>w6õÏ<¢ ¢ 2€å¼±ÕVÐ@Y Í­ü¢FTwñK+Œµ¥¹áõë7u,¬16îupÛQ^Ø›ÉËkÙ9Úª©*[?ü¿¹Ù_è׸Æ.#k:ÐÉÞÖÆV]á®ì}Œ•Í×ɫ0Ë6]lP÷Uuœœí5ÕUäu0 øã¶_ûÇqü>‡mIÒÔP12³µÔWRQÑkZCúËBK–æMcŒ­™ŽÆå†]{'ç‹Š+13ÐÐ5Æ`ŒTåî(äM!j9¶³ÜAýš¢6ÊÚÂD]馂IÈ1 Ö'€õ™#=“ÆMˆ¾ÖëamxSNËÖ£¦¦rí¦A7{’‘EÚÊ‹÷¼OÝe (ó“{j‰÷PF¢©‚E,²Vx°6êamc)wûæ}=”µµ•‹¢ mδÂÌÒ2B›šèÝÓ±éB:>a¾IYî^붒œÔ.Ë*[ÚØÙ ²µ11²ªÙ¤ƒÄ>{C++ %¹;JjhS‹ØÊn\u"VWMYÝåîd¥¢¬ö,¥‰ÛÓ‹bµUPv®¦†ÚrJš­«ÜÕ³…Ú4SϦ™S>[(+%–(´9ÚTöÖ-M#Sc«ÌÖQŠg³I´a1 Dèßýßпÿ¿ðßý;èßÿúþDbueL‰™ù‘/ò?}¯©onoogccƒ±4ó{‘ÅÀ£¯Ú—ÒÐ15Gé(¢Ü«ÙàÉZóÐPPPÖ··³PR×z”ÌY±…ú²#õåoZ¸F„¨ÞÑ0{ ×nc®ÛÙÌÔÊÊTþî-5}#ssóغ ¶Eöê%U=söç¬,Ì_Þ8:[ˆfRH‘Ú—¢xªiY”§Ñã|< Êq”ûIFÙÊi˜¬Ñhûô’†´™ïýjª|OYSÛÌÌÌ”G뚉m¾nóÂÝÈ%¡IpMê<ÚØÊÿÒx†6ýM‰ZÆ^ƒä³Ái­þñ•Kò ÜWÀõZW”Ú9CCMUe%9C§è éÝUé·®Èhéêª)ÞÔvˆÜ%Ò¡õ²K?ÈÖoP„ ³%GIY}dƒ8RuãŽ/“'#ŒÝþpWõ?ÜTšÿe-)ÜÊd›ºaêêêèêÛÜ=@”Y€ŒïŽLb)ìY ÂÞÖÜÌ™3–Gƒ=ÝÜTÝÝC“sD€³š°752?ëš88¥LúÚÌøüò.o*Éj ÛÛÝÕ;0²C ñx à6–ú{:»{‡v Ïï›@Zhgu ·»»w`OâÏ’ö·Gz:;:‡'NitŽ·*™ˆèÀ±ÛŽFÜŸìêììé wä"vjN8¹°Aap¼÷X˃]CXd–zz45Ú×ÙÉå L½,¶qI<ÜêíêîÞÂ<¾ž®.<蔥Ѿv8—«]í_;ÖI,ëlmçò«»»£­}j GcsŒz¸9ÔÛÓÝÓ;·²œyƒûØ>ve×öOùÞ'»ë#£3$Ÿ'LâJG[/ãîöÖvìžùs,) ¾·?[· å~°´ª®æþ«,ƒZæ!ˆíkd¯CŸíöt´qySgçà–ç$¹5ЃðpwðL909Ô×ÙÝ3µ°Îyk| ¸¿¹ Ûš]]#ÓKij8%àºÛÚ¹b K`GÇäƃˆëêüZÇÐ4–Dcœé,æâ`ç"‘[§íù‰™ X¹Yæ72Bí] +œuF1hC::ëïí좞žÞÍC2nizdjÏ.èŒñþÎ…}¾öö׆FfLAqÚHoÇvƒ ð-êÉáÂÔ(RÒî¾™¥-ÄÉ„Ã# ·6ßÓÕÑ72M8¥À/ŸlÌuö0D¼|¨GCý;ê1n©»w˜3ØZÅvõôNI¿ä ¸dwx‰èx6ƒßp›Åúσ’Šß¯rÎ7ûüRø çùoù™ÿ|Έºëƒy €ù‹++±ú6m&—Ž@qîú‚5‚ŸJDÃ7*%ÞV·ù äð\!INùàß*çÂþù’vÜ hƒº'€6ßòê°ü/*«èƧóýK¸m¹}”¸×”<% òãÅsAl÷þ%÷KIéï†f»rl¬ìCBžÕO┨ۀG9)Cüm Ñ/E}‰û^é8Ž}S>q ý•{þO'N–zšrÃTïë´ãN¥ýOJRúK‰ˆßîo¯¯©^%t!ÔÙ\ßÜÒÖ?¸ òõÛßÛV_WÓ»Bùmójwvìký—––®}*SŠ6ÿ’–Ô…{Ú¿9„}[wüV>ì‚sq&Ä¬Ó êƒàùbƒ’ç%þÞ4ÆŸY_‰0.!òd•Q”Òß@dâÁæÖ.Kdü:ÁoîX,ØØcnom“˜ßn&õ`w|Jûæ›LÚÉöÖÖ:Ç'j}wÀ™]æïB ,º^à!‹IÛ^ß< Åþtoc÷„ŽÌqvwöOÅÛãL:\€S KÚúR’Ò¯I£_Ò=|ÃO„«é†8ÛGùG' ˆŽðq®8:ëï hÌ+îÏÃéô·QUí‹"ZÄy¥ép©ÕßÇÝÝË×ÇÇÇÓÝÅÖÖéõ§é,Ä„¨žÃ ¶Ô6w, ©àñþj0ÆÊïEÚìÑYA:_:†6®Am(ßßëe“ÈÌùK9\õàÓ:Mú9ʘ”¤$¥)jýrO }$¬1’Ög—pt&Q·5d’qÂZ¦˜…=`·7Ô “\:q¦–tsv@-‰"¹›ò¥#ãˆÇÕP]aŠ…¶njí”DÍœŽ‹yü¼´Žíeyæ´îoÍX^»tWYïuAJÊí¯™äÌÂ?ˆ¸Å…µCq*2tº;­¦¢XÔ{,¬(KQGJRúe©=+LAÍ’ Œ6“5‘f>Y‡DŒ6:*²)MÈŠ? ·îió&ï+²«qgò¹·µ®ž®ž‰]iß*‚'¸¾p?§ŒÂ†ûôúi:ÛcdÒ‡’,ç šH¸Ébù[*<ŸI?ÿÚY7äãWÎÏág Cc ÷æé}èt#÷‘™Ìù[w"ëFØ›&xh³9í¡oð,"ÜÞη—ç@RétÓ,o©YŽ_ØfáaIB¨‘¶ŠŠ®Eq7¢ âf´4TKú´9˜ïp·ÆvÌ1¤H#%)ýªhÃÞ‡ ,ö¹h“Ú¼ìÆz¢_$Âz yÜAG>ª¤{gws®Ùì¾ÂÛA2t4ækŸ×8›ùØœpBA¼ìèÔ G%…Äæ9A{F¹›* ¼¬ ”ëëšV #¾Ö‹Ýyú*ªµý³»»{Ëãåºò*ia©ÝÕÒòcÎ×&œ™ZÚ8ë×öNd¼ðñ|‘Ïqä㢠@éø€Òó)‡12/ÆÛ>èãøúáÎX­œ¼b~÷uF›²a2msâ•á»Ü*2 ¥ó€R’Ò¯­Û°Ñ¦(PÉê#žƒ6ª²© kýL½cvØž}qNªÞé§ìMv,ÆPÉ#=‹8u2Â×.½ -g+*YÍ þš¸¡29U=v4¶³`Üd©¦ªüíÛ·eoß¾yýê÷—oEd|áØfŸýM "ˆì(^ %Þåö(x8åggŸS5,2£“–AÍøÞþ`¥©!ºu+ˆ6 fÆÕÀB›‡¥Ei7ÛúÊ ¿ÎlRögµµ4ŠZæÒ#œ½cò8û‰¥f””¤ô¯Ž6ÚJ·ý” ,Gv¸àIÞNʺf>>>¾lr°1·px°v4ýÜ×.µ ™·ya%øEW¿q2ò©àÍ　nßMÞj¶ÑV L¨„ Zˆ¹v`õ,g±ˆÉ EzZú„îïÍøÙóÑæÌâã MÅ l§ü•·ž* †UhcXµÞÛhnæðufCONq³šŠ²VVÎÆ΋Gg[¤€#%)ý뢦ò]-KϤ('+ïלÉä ok“ÐôÅåNdÍÍ-üÑ1} F›rd/ÞpIŒœº™vä¥x«ê£9œeΙ·%²øÝ{²«Xßسo“m«ë]:Ea?a2èyÏÜ0>aø}Q´á[Rl´aLj;šu2ROë^©p¾%ˆ6;ý–¦¶ÍSëÀcR)d:ƒ´7+ÿŽ•‹w„¿íø|$Õm¤$¥_ mÔ1"^¡#0Ú`ø–Ôì.ãxÑËBçij3üt>UÈÂ× gcºwpá:8Cˆ8i¨¬\ö鑼q¨(ÖpÑFuúl3>½.#RÏüÁèTí á•|ÀÙ³Kßh¥î[ŠŸð±±Î«ã¡ÂÙ,±³¶aå 7ÄDé=Ç׶·Ð¹l´I43ò¯†v†0ÆïË8±,eIoÊ–¨øYMõ/ÓÐÁB«¥‘qÚ—q@Š7R’Ò/IœÞÕ”øÕûI9y™™ŸaJKÿ4¾ŒëÍñº¦·G C”Í{2~W» A¬…¶O†(̧Ö¶öÒÇÊ72!¿°(7ûó{tLÉ~x—Ú=@ít?''kz“­B‘p5YícËt©g±”¤ôË«7=ûæ·Ž¶„ ãç®zþiÝÜwöIŽ÷ÄŸ»!öËó9ÛQ¤ðç”ê7R’Ò¯ 5bº°…DÅɆYo¢­ldºuJ‡$s-r_ð ¤ïòK RRq’”þíaØ áh{{çð˜Hµ)IIJâT›‹¢À‰1k$œr‰5p. ’&&„/Þ¹ ˜ !uëoòœáï3àc²‰èXçm´ ó9Ç`ð¼†&Þnýy•9Ï]PÌ'ÿ‰ù—rO:ßpâ™,ÊŠ¿•5yÙ$šààñô. ® Åiü;ŤÓÀ7*̉$Ëb1 v|H8ƒ.LLK¤³³¬b0˜€À1È  œƒgÏÎœÅïH x&NÌÛà Á¯2xŸe G§ã ŽÆ‰.|^Eô¢øš È@ªŠ„À`W›Á«,û‹ÉDÎ¥ãî?@\,vI:Ñh4„³p¶@j@C0˜,Þy•âdÆ© Â4ð·õ'$3·´lîÁü¿0Š‰Dþâp7œòÂÉøÛ¥/YL¤d,8²`q”ˆóŠ%i"à‚ñ/v`®±ØÝV\/àÈ&K(ˆ*‰‹ä Ë;·þ^ ù“¦©ÿ¨ëç ülK‘™™sÍÁ&3ØçÞýû*ûLlPjHGxšO(–U߶•[µpD:7$!å uÔ•`ùWR”¿}[VIYEYIAÇܹqpñ›Cˆºoôì„LÿùsªAã¡LÂJ‡¸h`âÅæWÔ­V§::Çö•kïÄ5‘E¢¹¯Åæænµ´ òT·ôíi­ ´5D9‡,!»V{ õîÝ´ Œihëèë.N{e ªàŸw@°ùh”ýø ô{˜e}æÇí‚ѦõC€¡ÃÎÙÇ…±~ªFöyuÓ³sãC]¯-î«Ø,œÅî¢DºZ{YȪØèÇ üêþ„vqlAäL½Éj[ÓÎ šH­}q»®G¤“×6wº»ÛÒ#Ã#ߥ×6Ô¯Îvæ•´Ì,Õ™º¿š™mêYAzSáGSSß±…]¾Ožª| cóêF¥À|¢nÅú˜Ý×@§Õõö÷·5T=¶7T5pl_£ÓrQ¾Ó8~©X,–¨ÎŽãÁâégç³XgáÍF_××¹- moõ•³‘CÐ˵}u¡½g’Lcò[8ËäL±d œEx8Ñfo]Ú†t"ÒÖhKïÒÙ'Ø炨a §çç Ò9{n &ÇÞÜâÚ5õâþ9öéÕ‚è¤(%âÞ÷tù¼GænÓ‡ÑF_é^Ó‘ ÚyƘó/Í”;ÙmΛÀ+Ÿ‚à3ñ‰Ø*¸£ˆ^$ø©àZñ?´¿±82<4<2V—ñ⮼biçäèðàèÄ žHÈùŒ§H#òeá`¦¥{V!ÖäsU0˜: ž7²€B:¼àÒ x–pÕĉ B¿Þ†äùšºÞ N|©l›íïhni¨.*­^:$±„•m,`´ÁrÐÆCÇ%Bhh0Ñ6/Ø ]OCyÇðÁ§Kãm/ÞÏ­ 67t†’{’Óÿ¢âú=͌ϡM m–ƒ¬õ"k&²<ɈŽiXåâi±ÅÐÀjt¬Ýøþ½Ü‰Cˆg|‰ }2Z.©yQ¢åÏo9úIù‡Ö".Ö0ÚÜ0IGÄlkéu¸§±®²¬’Ž‹Ï£öúܧOƒÐº*7î*ÙûDd”ÂïL6Z¢œCc·dί¦·>*ê–CGqé§ÙQ3ËG(Ë…¦–~´™j-Êɯ¬ª..*çÈ:é`«­®¬¬²ªª¼8¿¬n 3 î-T—””VT–TÕuhL ·ÔWŒ-ó\L =….ì·'jûO‘ú õéžâ¼¬’ÒÒ’Òjì:©ûñfgCUQYEuEI~QÕä6 ¢Ÿ4§¿4Ò1‹ý»ytBXë-kšæl>ÙÛ\T—­²¸´rzm9¨e¯¿ ate¸©¹µ½éKeyS÷lÊîJyqáÒöÁÙL•Ž2bŸ%G8»Dæ“E#?¿‰ 0FÛf6Žq âÎŒ¾ò½fÎ.úñDw}IiyUEIqyÍâ ®rkaœ¶‚NF}çtwkkGÏÞ "±Ô]l~nÞûü\:™8ØÚ<:»I?Áµ×•”UTU——Ö4nÒ ¶½Ðû¥®¾¯¡¨°yž±wOA8ãd½,/n— Çn‚i··àž¢ –?öc¿v µ5–çL­!>c㣠ªªªŠK*¦Vw]7\^?ˆ¨ˆHůÖV••–——7ôž :Þâp]E÷ZgKC[{[mYaëÀ,]PD©øò ¶2H=9l)Èìšc#«§¦j|÷ l4Ô”–”W–—W¶¬í“%ˆ ôkšrI¾2w]¾B¬£ò÷QÁ9Å°|z«:'´žÐ„ls!´yì®ë)øt±9ÇÌئnî”ÙõêÎ]Ôä1]ÌR´ðôéÁr«ªœ;Ì DûÚ3£=´­ýŠ›úW7w» >x#“QRñt¨+ÎLÎ%ƒ‰?$­Ñ¹õ }•ýñ‰®jS3û.öq¡ü·Øh“Ê°Ùö×ñaÎU}‹ˆ>t8bo`ÎO˜ÆóÅ¢‘ëG¶ˆlú9¢ƒRê©tàü¤+y& £ÍÌDŸs0Ð{û&¯ ?&ì!ãÒ¿HXmbˆ…WPBFnîç”0_̃„fˆqXãŽvôÏÎ+ÈLC飫G7 æ±®üwaÙË«™N&úξ{§wð]Ñ×U¼6öÈÐш®vÀËøOÉ>Ž–¾Ñ{Lh¤ô…¥}ìÇO9!î–Æ^ §Lz]R„–¶qT\Æú1 [æðÏêqtx¼P««¬ö>©  ?ÌËÎÎ/jÖ‘§žýtO?"òUÅ—¦ŠìŒöûzÞO–†ÂƒÌmÂ8Ÿiö¶·+Üc§ªê8Ì“…ãÅ3^…¼Émj-{¥ªïµJ¤ñц­ÛÐGkSì퟿K/ÈýôØZÛ,(ƒ 0ªÓŸ()é&×tLT¿µ±sk›@öíŽ=»¡¡éÒ _ï­Lºc,Ò˺«“B¬]¼>däåe¥ù™*ÙEüïÎó¹$£‘^=I[Èg£ ¢í&?±¶òy=ãºÑ™ £Í,Ï6WŠ¬ì¾}ûft•|©f”·³½ï³Ù}ˆÞô'yÿc F›ÖO!ZöÙyÙiñh«Uˆ•ÆßÐôˆKÊjliN{õÄåк) ´ô-åëßg Àà lÍ×ßÿ§p Œeã&ÊZ ‹ýyÏÔu­“>åä}þèíbÿèu1\î/"bó¡éWž¤þ¤¤á×±éÁêöþÉVŽÈ¡âqª$´Ézâ­l`ù!!!11ñ#LožÛ˜š¸‡¦ÂÈ1“à×è!Hæß Š[¨âÐBß}ÝHÎïo¡ t¸½T”noaŒ¶´q÷ò {þfˆ=j ÉÇlÍ3Û‘]ÐÑ€ÂmùæU¦ z¸:Øžÿ)5+7ÇEMÎãI|æçOÙ¹ù3§â¡†³½bºß Êk8§ÛpÐXéYêj_¦‚жóSÓ“°”™XÄühìÍy`ô+ûiL1ku<´ÁC”Õ¾Þ)Ž>}°6`¨ß„ûø¥˜ÉKé]ƒ‹4ÜR´ñï_8÷Ö±“ØMÄ"¢µo½,݆Èø7Þ6/ÒË‘1z4^Aÿ!î˜5kyË2‚SÚ£ÝÅú¦v<‰¶‚›ßDz2¬¿o÷Êß•Ÿ¤B‹#­¶Î]“È\ÓJ•ç £Ø(óQV{ÈÕ`»C.¦fé_ç ¥··o¨4l°‡æIÕsCLHÇ>'“ÈL&Kh• 7e½rô‰ØBj ³ÒxT0'¬Û?ņ¼H­€ Óxuç˜/\K Öm`QÃÏE¸™Çd7ñ¸Ö§xùþÐ p°Þh e9ï^¸§Gf3²Ÿ7ÅM÷UûWÃ0ddkuw÷mêls23,êážeLœútý'­I0T(g0à ϶SpGÉb—IÍŒ°G{¾Ý ‹¤DÐÚ®q5P|[Í=X¹ÐC^5¨ˆsMÝó°@'™$ EÉh‡a´¥ÙÑÅUŽ®FÍ}áiû<BµíäÔ\9ñ%‰ø ´v|Éšà$Ô;kuï÷p×™(yª£i÷ðáØ>tÒ–ldåµsx²4;6‹œ4 LJoU¢©ß<¥˜ ‰ÍÀ¯¬ÛÀh£Ž ÍQÚSc¨vÎ͉ÚPe“ÈÝ#Êh£b` ÃLrRRlTÈ­;rÏ*öpKÛA1³²BšFWŒ¦‚g-ÄE›>3ãìV.Ú€ìXåí ùhÃé­K3cÝíÍÅyŸŸùZ©xÖbír¸.GWG7!#§©©ékc•¡¢¬ûûzA6.÷}ÍIMÊÊùä¢qß5(æSFÚçì\ŽŠ{~“Ó–”•±hGã=âÑY¬àÄ>Ž³xpÎhÜ3Ä¿¡Ûà±^Ö†ïJz©ghsÌ\´™†u…ì˜G6nAo?$¾}nmhW‡HÈÆd[¨—½¡‰™×ÃÐôÜ:Û<˜j-ð°E›Z`C¢«ûÙ[ãmbJ·ÂvŒæy"óô‘xyý‡§ô}%ó¸R&¬w<õ÷yþâý‡Ä¸ð‡*ªjÃGÐ|=íÐ:¼ÁGHñ–½áW=Ë-<°ímñ´¤‡<ûúŠœû‹}¦(í°9 ƒyX$fºä¤Ýˆñ5²vTÛÜÚÚÞík~_Ï Yj8+m’Ka™£-5Ü’Õ¬ߧí"ºÍW"t4?ì…ÖÖ24qttrpptóÀüé?ÿ·'Ã'‡Ë5zšæìX"ùqþž Mhß\Õr“A²ÖTé"Aã¯=ƒ?M´V£LmGæùûì– /ÿôq™9R„özÉ -¹]¤¦i`uùG¹–9ì‹Ñf³Òήy˜s¦6É]æªã:÷u7&À&¢ ×}“‹6Ð|wù#§¨ø¤”/ŒžexΪý`©ˆÉâ|èpwÉÛÞðuþ¬ þ}Xé{Ûæ%,T‰~vQÊŠ>TŽnÔ$;gºØÊ`C°Ó“ÈXXxòÀÅÔùÑÈ„›i›_wQì mÂŒ=¢;¸hSªŒŠ¾m2ƒ<´CNOI ùxwõ‹¶Sd÷=l†’ŒbåoŠ•sz,ét{óTx3RËSen€PúÁ¨¥~jÓ '’L½:ÎåâÇY¨` (Lƒ¸¿þÖCÑ6¸îùïÔ•T-¬‘#œmmmÍM4ïi¸ À“N£ÉÄ|oªð¡nŠA£R(\oœ'Gʳ>çbò¶¤[Ú€V»Îþ|m ücwkû¨|•q¶d2qÄ$Ïæ˜ZúŽ­{£ldQÁË«›{ûøõ‰gæš/k¹‘ÁNqË+3Õ¹ úšèGYœâ¶fFzÒãžh©*¤ÔÏ@La´I梂6ŒXCÓ¸HðÐLþ©‡¹_\ vmgo¥¿ZIIy„ m¨Þwd|kÎÐ&ÊÛüiI7‚6 ^G ¶nI;lúˆ±>CÑ×±í(Ù+úh ÜjHÓaP2×î5. ZRÚ¤”rú~_¼Å-ã°#ò†!msƒ–¨äìâõµ%„–WWWpdÆÎ|µž¦Å¶±Š$+÷„–Hu—çÄzí`’9^mù¢bd©¹ÔÄÌvx~Um.',1F*‚ͽ_qÕúíb-åû¨Àd?ŒªM›É€˜YÕóhckíÜ2¼ÊA™«~Mhão~†6tÄ»©ÝôN8<Ø?>=ÉŽyhö™6 6¹ghcgøº`NhD'Ô¯,œÝ,ôÚŽèå93 ›â»ÅÕÅG÷¶ã›ÜîàßZinï;°/Alþ- Žs“·è°6Õe©©šVε;b<ôT < •Þº4C ·¾YÁÅ/h4Íèž £˜„çvNá™D*F†ê¥sÓ% Ƶۖkmlß;»s–#À|osÛ,´ Úêö6G§•ÒéT›ÈäCO¥+Ž s±Íï%6bÅ8fRËÁz"vä©­qò—~ –”>=î[h­–?W¹y+cä,¶åpó¡‰JÐÛfêZ‘©¥ßôÆqŒ±–uWýÛš®“‘Õyß [R”±ñ9™Î]²ßoS¾ª9H'†xÑžSÝ­"³@A,Úȳ-©©z?Es{ÕxOðƒàÖásì~î\ôp¾·¼’úZ€ÑÆܱ}t›6 ªó¸-ï]Î[žéòFe–ÔbüO h ¶H9jx‰Aû½§@ ™Ýp°õUìtWé1W/І'ˆ4?ÓÛhß sCÕf˜mûÓánè7 üQ; ã!kk®J_Ër†sŽÈúWO·ª¾¯¿Ày.|öÒ°|leݸ@§k­ ›Æ°¼•Œ„/é-A¬þA´)¼§„šÀP C—¯†Õï‰.Ñm *×÷|ê¸&'®ßßÊ8½v’<ɶ¤}DåÒíj®ŸÇr¢¿¦Á“ü=mrÄ¢ ÿë/­o6ؘÿºË‹bãõÝã{Æáfš×øáZ!ž#ÐÇ-I6jÖO&ðÌ™©yA±Qºª1ñ·9&ýºhÃÕ8@êQÑ»@C×Ð…C&ÛŠ÷2¾SÃòuò§¼œÌçNJòjŸÇD–ü7öy7·ªQ*rYyÙé Ž:75lžnòfù3£Üe•Œ#ßgTVW—ävÖ¿£e7KaµÇ™8…L0g]*Þ¸êš= žÃíÁ’σKüR/Ž>ó÷©îe òº‡…aþ8§Êàâh»±eMÿ¢d´ù}mبùøøê•kÞOc³sóÒ>Ä¢”o¢>À ¡ÍfÖÔè2y!Å骚u]WsUž¿‡S°§¾ãÓlëccéRÙÐÖÙÖ`¬îð–t¼dªlíÓÚÕÛV—«#wçMù(Ä8–¤Ûlí“!`ÑüÞ눴¦úÊÇÎh»±DÊi¨‡…Ń˜Žîžœ×~NnÁr ©Õý-ðØ+Tl¥Œ6t&@ÚéT“¹šQ=ØÓòNåórV(ç_‰E›“¥¡° Yb8Üž3×ÐL¬ Êr¾ì%ù^2‰Ñm·Ž†r/ÿ𓊆f {žc¨:ÉПYÑÝÕþîá5cöÖÚ5¯ÝȬYÝÄÁY¾ô²¿óÝ“{ðpzÒvÅ?_FÛ{­#ã$³8þÆ«¸¡£«¥ÂZþšÓ(]E‚hSpW‰½Ý©÷îkµ­ÐÎà  ˆø ´)\½ö©f ·%Ê×ÆÒ;jábôGÈptàÔ]ý &,k°§éUÔK”±™•oýµò½¥¢´áÏ£7¥Êh¢ÜRú°ùêd!§š¾ˆ‡KÈòÒ“A=LèïJ}¦oêah†)lzæekå}&6jö¯alÑ9ÑÒxŒ]Ô Ä"½ó OäKëkï$ü1UÐN\ê«÷ó k[A°±,.Ü9äÇ¡‚Œ'ØþP TJÍÀëâE v&FƦQÉ‹‡bržîcQjwóÆ|¢ngÄ™™¢ÌR* ®]ÉM1ÓUîïle`h`dbû©–Ž,ŸnŽòÿTÊÔAèxºÎÔÆujy±waaø©·{eûmÖÜLµ³F8rÍè©ý„²÷ŸÞ‡$¡Í7ýÒ¿¥ÛpËC]í{öÀÉÐÐÐÜÞ»´“;ÎR+¼ý£&°ÈàT“¬££ç×;TcfjUÑH´Š”æ&ºÆ¡ï‹9õ¤v?Gûj«ë›Úå÷®"g‘|LRêq—˜˜Œ°Œé K·W¸Cò}òz´¯ŽžqXb ÷”Ÿ½‰(-ÝW%È$gy„“¡}à(‘Ñ“¥¡¢UÜ]i‰2ôÌa0‘ì;£ÐZºFpv9}m)UÏêÙ1û)H'tç¼B>z<ÓíåâÐ1±ÂóVFjœÜGpšl~ø;½ÊçhÐiiÚ›”‚*O…ÿk}nljíØKä¾²<Ôäç`¦£­õàE.¥ÚiO^ˆ–!¦¨iÙÙü03Më™dãra¬ñðE¿“uW¤Ù˜èY¦r”^ÖÉð—x¿çi\‹Wkfí»J$#ÎatjQµëóÏç­¡*s+›Eþ ãnó£ÀÞ©-~™ÝáGŽh-=ãw;lFQzÃ9³Ä®ôº¡u ÌkúW ý™'®ŠÆj??À<¬â|‡°¿þì±ûçš%gÅã±*C´uÝ,2€R¶æ^ø»½+j$19á¿ÇØ¢ô Щ5u/ñ±£ML.ŽB®NÞÁ¿Úð=ÎÖ%P JƒÀN@ŒÙ!Ö;äâ(É’ÿ“Å ä?±rM>çÉO€bf—Ŭoq³õoqû.öp²¤à úáò»G–¡i="9 hcœòmÍ“ýt¤>Ïíwm ]ϸqÎÿ_Ðë܇@‰î© ` ÄùðŸåÏË^&(Þ »ÅCb!@¡ç€€£ ‰l,áMƒàì0Gˆøœào8Ë Ä–AøpæŒ'dUƒ¼é}QæƒBÜÚA(-(” zMÐBAPüyÓG­O®k?…uègl‚3<«ÍW…6’€?Û2úõâqc[¥¸gbŽÉÝ)ÞOúÜoç‰0égcÖ: œû®à«b2’ôQt6ÏÍyg¥Æñ‡ûîå ƒë4 ~óìS:yv¤':ÈSCÛml~GpçÂT¹Çm5§â–ž…Òy$ñ®¤»ä'‰B2žÛ žÛsx®P ¸h$ tảøkqYŸ«(N'%·ø¹âˆð„@‘IÞñ+Ø„wœ«°èöáób Bç6Þ®ÏôÇØ«ëf±=º%«š’sPè3bß÷… wJÿòps¾þâ@Àzy¬91=÷˜u!âþZ¥‚?J£§¿{ÙºH?Ï"üdÞ³ˆ°Ðç1åS” 2(„¯YƒǼÍÛÂÏÚ”EÃç?ŽMïÁ )ý="ãM…QOŸ¯à¯ØáÿÕk~á>Z±ÖË_Õë% ÓF®4ðW.ˆ-ð­y‘|@ðg‡øÒo¼Ï-âß:-ö‰‹‹‹Ž‚):îmRóàK 3ˆ ²'¬ÿÌ,I@’º(1q¦(6­ace("8èytòÈôô+AÍÏo#É’T°/ÈG 8—P#:þ=)6íYáwåT#b`À‰ Ęغ‡M±7¯Iœê…HÁ>/WŽN~–Áɧ£ÅøÈ=ãkbX,îõÝ/î7_“·ÓßF™èaòª‡þ)Ié7DíYOåUÍw •L>… ¿ø"ÈÉÌ-z*±k“'t”§©âí@Ìú2é1ßíhé×4°"£8+YBï×»Ý0@|ÏV‡ýݲ+¤%%)ýG›³³29ýЛ¯§aðuQBv{R ok™`LuU-½#'qpçÇÆ…8ËÞ’·´¶K›!ƒø}MyM#S}eCŸ®i®»/a蓱ò-E-µ»·ÜÃR·6?=¶’½«h¤gZ4‹‡v¾Úë©Ü×2Øj«ê;— pRuÄiÞ¾…ÆØ¢ó2]€o·ÆÝ¥h#%)ý†Ð†¿7ïi¢Ó2ôÊ}w#¡Ù·Â8ÚŠó6 z‰<ß«ÔP´_e4 ·Rµ|”ÂΉQ™òÐÔ+vFÆ„ú5Ùˆ« éïn¦óyðhé«-Ú­wd‚Níï;¿eïVi­YOQ¶È’òF¥±ªzöÄ» ¨;·Umã¥h#%)ý¦Ñf÷‘¹þÓ†ù´°Û:f[‡¸]ÜÁÑVunœkØ¥ê ÖÓøˆµ¬í»×#4Âþ.þÐ^šmjh;0·³Ñ~_M{‹$Vwu´Æ åÔ:²IÝèQ¹'S9³·‡ÛÝÛÇ ´V™k›]9žÉ{£ƒñ\Ý=à”bî=ê&*FŠ6R’ÒoØ’‚Nì ´³F6jß<¹«¨bkckÃ&+´™{LÚä)nrÐæ¢ö+]ºj`kÏyÃÚÊíè3µŠ)}¯ aºKŠ »ÆF›öÑ­Ã…/šÊŠ¦6\²¶²´õ i[9hO‰5°\Ûã:¢ìÖ¸ÊI-))Ié7†6VD;ÓeñêZ˜É­ãÉìð›:vç“Ð׋Õlæ`K XÕ»~)ÿ@ô…õúYe 2g…ØZ˜ZXÛ^›ø‚A9wŒm3·{dïŒÐDS }ŠÑ6÷ÚØç‚ú_Ý6“ê6R’Òo mžÊ©˜-â÷÷¶7Wºk?[£ ƒÊŽa4Øn×¹ïcýÈñééáîryvrQ-h‘µU©~ߨevõ€DsUÓõLÝ#ž’ˆøÆҜԢ&d*aÜ\åÞ‹‚ŽauºßÇÜ(®°wg¶ÅÒȲ´qˆNÆû¢£ŠpGDâÑ~g]ÑÛ…'ÌU¡´t>Õõ×gúÜu”1±R´‘’”~ı›ZÒÿxEãàdo‡Ä4röðOʪÝ#q7ÝŽ7{y¸¹¸8»:;†D·O"a*!æÎcC]‹—;ø…ø'®NNŽÎ.®ž!ùM#D*{Ö¥³ÆÇÝÙÑÁÁÁÙíybÁæ–ŸyZi¨j¥w®-tG>ötuq„³õ x’×4@Bö£RºJ¬0ÖvöΡ1I¥iÎ×ÕŸHÑFJRúÍÐáöROOwOwwoßÀÂŽÉ#6í.O÷tuööoâ9¡5¿ë•9øæô²ÅŸz´9ÐÓÙÙ݇ÝØx)á?¸•Ùž®®þ‘I•{TÅîÚBwGÇÂ’i NÕÝÓ;¿†;Ã>ear¸«³kzu"¯ö°hïLJÑFJRúm¨7’ï‹ßÏá†&PÜŽQ·dqA {£ ýÕÑNnÙ•ƒÒö’’”~SP#9Ð(.Bò®‘Mð¼dü£'/: Pxë7}¸5GöÒŸ~ÿG¥Ìò~q¥’’”¤$¥0=‰Jº‰QJRúÍYRçß¿u\ËÅùKIô×”ð<ýEÕá‹sÿ‚ $}å\T*è‚xgáÅr˜§ ž¯"$Äèpði7p êÉÖÚÊüüvi•shéáú2RæµMšè¡ë“|¸„Å.oî‘ö—gçæçç°ØÅÅE,·Jó+tž0ŽÖ–çææ°K;{‡œÃg@¹¿åñ`»±ƒ§±Ï‚Ùß\†3>¢0%œ²pë‹K«§ÀYÜ4éx}eÎfy}‡ÊùÝ•F"¬¯,ÎÏÍ-¯m"gÑ‚üsþø L;=\Y\Ü#Ñà,íôhm;7¿°‰;dx¤9%ì//•\ZÝØ!ÓYÜ?êéÑÊò2þˆ(V¸û;ëË»Gp}¹§æ2);ë0çç—W‰d4£y'ë2¨;kË»xº”RŽ–ab±ë;x:/P5r²±²s»¼F qOÝb1¨{ÛKË—q‡§â@U°?ˆs(øÒÑ:Â.aæ°û'ÈÓ“º»±Â¾·Œ'œ‚˜º€,:ncyu}›&ØßÙ aö.--üÇ8Ù[Â. g`‰ë¥§;‹ ‹Ç̳X‰LygcmféÊÆ)É|ÀÑþ6RÜ¥•"™F¤@Þ‚…ÛZ‡Îc—p‡'ÈwÔgîn,¯o“X"€É•&€IÛÛFÂòqB¦ñÎ\‰»‹7–pÜJA9Y]FzËÚö>ƒ}—F:Y_˜àèÒâÂ2í/ÇNm2‚åU××? uƒÖ^úûüA±077Cè¾ÊÞ£"@|gìôöà˜* Ó§Š}¬ƒJØ"¸ÿ¥²ey‹}c˜@ q¯,õ¥9 mjjddäñaƒÈªxâbgktåŠê4A±dêã=ïª{GeŽå¸hê£Ñ¦Šw®ýùÊCSS”±¾¡×. ‰º<ÔäeŠ2ó4A™X;ûf×t‘‘Crqÿß?ü¤¤…±´@›™™¡l=rëáïdGy©Üõy×"ª- 2Gn©xêeò¿ÿÇÕ/4î=ÊÑVÞ»P 3´¹¹©©Ù‡Â.:åð+Ÿbž Q(sS=ôËÌZ"„ÁØ]šÈýðä§ÿöß6/1nCÊÁjú« 33¸Øh[ÏêÁUîNÇø;XÛÚ988Ø9º%µ1gÎປ³ƒïÃ}n\¾úì]‘Àˆ*¤Ø ]ccÈIíòwžI‹Ü@Š¤–¬x´©Ú 漩wxÂâî±P;íhýK^JIFË5b‰—3yáíws3s˜ì]½KÚ§YÈyÝ;E‰á6æ¦h´9 eðârÂ0ƒ²Â‘÷V—„óf»ßø{…=­i¥n µÁ粩4:O ZcЖY{R¹žÐ]˜  ƒÃ»'ÀLFÊ]ŠŸÃ/MP^ñˆ»)œv²Ç[>ÿyé÷¾îW=¯óƒrk6uŠ=`MGØŸGÝxJ㨚y_j ¬Lè; 'Ôܪ¨›¦}½ëy¦¥jŽ NVcr.`×.¾7 ƒ¯Õöµº_°Ç‰5õ¾½ïr5ldd‚Ýñ:óŸ->0À”CŸzúÄŽ®ƒX½‚}uÉ̆¼~ ½5wfeñ­¢WU¡vŽå¤e ”×P!puEŽ>)+Æ­.¾ýû@¡ì,ó¿ìU¨ Z`Ž5{z6 rtf¹LR•’’Q˜„ÁÜ«úxÖ¾€B°×ðân€í¥€²ú%.”®aý³½‰Ý(ç•ã»ßØ ü{qfzeWIÍÙærLBvqEq\zùŠ¦ý¹(ë€\ÕµËäܽÃÆv”SŸ_yû‡Béu”;#póf¾[lÑîeoÕ± ¥¶°Ì.‰\¡<ÃâXè}ßÑKZÙâž"ÜN3U8ãïR2 (Lžr볋¥S5 ZöÜå,”K|yË bù]~Pø— /ý}bÚ:·>Û]²k¡ª`VÒáå™ðP[µí¡oD’Í/ÿlX=É’ùþŒ¸¤Ê®Ø9³–mui d¼/̵¦d`çnfñrÌË â¯•‡;] &ÆRlÍ”äÍ04ºÄø¬¥Œ¨€gÆ¡vn_ñ¹õв÷§¾¢P±«^`|ÈšQ‘ñ÷g¦({|P ?Ú¥†»Û?ù&wÞü’]pa}„…Áv‘Åï¡u´ûûݼ7ŸÁ ßÎÇ)ÈèühõŒ5”^/­1àyu2«Žò§·kšîx9%t«Ðû®_´(;žÇîTós€@<"ÖgDÜxú8;ºòãÈê·—ñOvAÝFÑò¬ :&.ïÖ­ä„ćo?ï|Ïl¤ßm}•”÷aìhþCZø­JÁÖ»Ò$[×Ä´Â;ùQþ×넪*¤¢ïUIÙw؇Üß î6%:Ó¦swY³´EÍ)ÚëJN͘h—3õ2@›µ«&vÄC]àýø,; óżŽXþþ&ÞÂ)†)Ñ•üþ¯=ó[‡Ú M-òÚÇ¢¶Ã\à$ç‡ëxÛ‹þ[c¸O%Ó¶”¡8þd­AqmIBtÅ{–D=1yh‡¨Â.àÃ:mb|f^£ X[9àèßbÔƒ:`B~VJX’@¦ âÇyå¾_ä D v >ÕÜ2Qlgy4 ‰xÝÉÐ…k¹\6?:±¿¿WTVÙ~ºóD!í||³à]YƵò*:¤ÛˆV)_ðšdO"ÆËÛÖžûô6?3)*ñFų·s›‡˜£6â]ú­ä¸‡oqRð¬ÍĤú ÉþÀs42å¥)•›ß‰k<%kºÉÃ#‚¡-eºò‚¥ß†F‚,¶ÄÙÞVµOÂ$Ea¢{'¨~Vç yFGˆ Ú佺^ÄòÀ³ŠòÛ97s+^Ñ6y'ÐFÇ­´ågbÛÇ<Ðe#´Q¼8ï•Sž–ìÔmL-ó;§´OoaãàòW0{l.Bºž‹Qý¶\4æøÓ Ú(*Rƒsj65×¥g¢QI'l‘wùf.qkûå)¹ ŽÒ<\5h£<ÚÛL‚_ŽzÑœ“š’yí6r°(|œü¾y×ó¥£83=«äåꮚ«.»¹’TöªýTOw‹–V7ÉžySURIçÊNˆê­ùP¤_]78,Œ!lßĺÎågb\룰¤ ÛÌzübÑÆQûôxô’(Dií­9ò6µÁô’sïªD)Ú}÷8/4"½µëkKÍóàˆöáU…~¦m¼*PÓlwGÕ‹'é 1ñ…]CT¡¡»LCOãÒJû:Ø=ƒty𞬫¡ñ,ŒÔyzF£b·ª ))¯°µ«÷CýË” ¿JµÞ{øÛõÈ‚Wréž¿Õ9}´Ñ]ŒK?]Ö b’Ø샌þ¦1f¢aA™€2?÷®ÈÜÙãAqAJZZB|Lþ£6ä¦Ð$ŒQ—¶µ4ûæÅÃ₼¬‚»¤9Žöκ•Ù^$,H‹6.«¯çëÆX!—õg{8ÆÜx–“ššž_õéPîzmŠUpÌ«Ü”äŒì´¤ØìòJÆžB:ÙŽ*LKLÏȾ™“t³›¼©ç¢’Í¡à¨æ¡%…B¡øÓ–”Úô·–zøÅ4b ýýx\σ¬Ðs—¼¾m •’½Þ'DüsîZzì ä¯QÖ®…­š1Þ~žþ¬CÊj²·‚T¢G.¯roÅaNtûGõ\)¹»’VÅñÖd4Ü»kóÝÝòÑþÏ9×ý=\âo=ßAùõuuNvïåóæäm¾.ÿ ´Ðñ?ƒ*Ž7¢ô¸Žƒ¾dS^=<@ìÇ÷mäé’ùœÍÝkü­QÓóæø=çêq¹BmÀog±unΰŠß;çægß?Ï„;Ø$•ª})Ð[3=¯à-ßi2Ðã§<éQQ£Rq¸Ç@™üGXƽ)úƒ>S’‚L~ÉAÁza„“OXrANz°ÿÕ{ ±ò”­ŒƒÓÐFõ„TtÔx'&¡¸øH©Ì‰*yEçÊugâhm<-‘õ¨…+=ÕÀõë¢lÄéœ=–«ÖP…,ƃxDaÕ{miì‰vwË+mcÐûJß ž”yëz„ohÆ,W©ã¸5àÍú]¦K3n¸zÇbG7•Ê“ðt´A+‰~Ü„Ó1²  Û™ËŠðŽ-x£îâ‰Í(…TmT ˜îxäà蛑W‘ ó½6Ì“Ï|zz-§‚Êtµ}K5ڜاSè¡ øi›>ãç›ÿbfa¡§é^»½c`*0¿C/o^°…=l&0K”Þß‘ÞWñ“Rƒ¬rŒéѲÜh_X`L.uWªÁd¹.Úè`D7„Û]viÀÏ,--êË<=ÑCkûäGÉ&æv%¤ù…Ê`ON¸w^åWÎxWË•ð¢êÊì;%Ì?ýÁG@®ZR¬–[næ–姥úwŽê6¯Q?»¦öênêx9ÁLì¼Qá¡¡¡1Éo; Û‡"u¦4¹”ÒZba+ø°m8’'Ð(k߉ð°w‚?ù8ö8. øúSmG‰%vv~ƒ³í~üÉùÓC›£Ýµˆ+&ùíj3ŽÖû»+̟νMq‚ß xà%¯‹“ýÉᘷŸÈ†¥6r&¥Ãß;N…³5ù‘¥¯7EJíòä³}í­2|Ÿé××G%ÍãË60K©jÕÓK"eoÔº ¥±ÈÒÊ¥~b] ]F²E§$¢ŸY xB‘¸éAâUô]¾\‹½€„"%ù¹9¹¹˜Û…¬°ŽQAȮ̾pÉ<$ýѶXOKþ™ýÞŽgÈô„Ñþ˜¯£EBÙ©\¡¿sw*Ú@{yƒ¯\¯†Í07¸í³É ü#Šæ—§²£c:ˆ³*@›&ÖYezh<±13p+qÅƹèMï‹ŒX/Ìm©B1Qkëƒa©w]¤/’1Q¿uìŠä'BdÑÑá¡H,~U| q÷P¨‚ô3ÑF!“vÄ;¹&<Ö|±s ãs»gžò$ég—ȵH‘ tüt­pÿ5îõet^=©\Š÷EóºM­ë9ãûêó`zü• 7}Kª$ þ6M¢”K%Ie2µY¯B›Ì]´ÙÊÁͽ~Ñ4h÷uQ|ò“VáF£3fqçPmøé£M” m8ÌòŸwÇÊ1ð’ÆiÃÍ–,M“ÞìãiêhN wN¼smÔ[±üƒÑ†3XøO¢ÛA]´Q=9öþ†‚*Ô >øRžÝ2¶ªòÛä‚~…"”QõŒäh=ÔírQóÄ>_®4H£¦‹6Ú_¤±2“æÉÏTšß\÷ÀQYgG×è£BÉçîd¡í³j™ªÇ– -î0ßõ£Åà_ΕPÕkŠ·µtûZPiU“Ä`–O¢vmÊ$Ÿo^ø·ülaanfjjfjnvÙäæ!ë;àx,àÖžtÍj›vJŽ“h#Kpþ9«vª°–¨qHÿ×ïÁ8ð‰úbk7 ~Ž%S—#›mñõ¨Kšùð슓ç:O¦m o—MþF"’H8Üð|n“Ü™€F˜]¶/©îXÙ䀒ÅЫ,ãa›î`âŠt:{¸Ð 3?ÿì+U©Óý@…m´p»+²]1éG|!$ä œŸ›ßúO¶¿þã׋¦ffÀ˜™ZXXššüê~kâ´ªc´9¶¸Ô,Q|Í=´ ¼=ðÜÂÖL[mzdø£öáqVнÍ馦[š!oxdçÈâ ÿÚÈe oí¡‹ ¯%ÑþYTÁ÷»ÿnGD]ùho-**—¶<ˆè§©T&™Œ‰¼hRµ¦.jcòK<„8½¤ŽºPü-hSŒŒSy‰õCI ´ ÖC›|Ρ|³9ö'Û6Tû­?%È·òUÉ®³vÂ,ìpµhã¢F›ÏÁ¾˜Þoê´˜m÷­<3|}ü(RµXÙaoi‚:´ ŒôÖ:¹#»§÷Á^J¶“QQÅ ÝFÓÒ¸‰-nU/ªäãS=Ý|—CG:Y„g=b ¥R©häû»f掟¦6t½Ä†ÂœËì³1ñÙPê\sý‘It–Š@´±ÆŠAˆ·cºM½7³´ ôhs´Öâ¢Ë$„#ía~ÈÖáMÈÑ+‹ÅÐ.¨|{yq•Ãƒì™Œe⦺»–—b l©TÄo½Ÿ‘͆’77?¹îpû@(+ó»/ÆC©Y«³ß£>ÏßNcÞö¹­E éÎ@›òÊ6ìdàËÄG‹ ‡"=—,íuNüÃz¦ZÈn%:œÏh^ãÄ`;¥P–ÛCöæ&˜CÜ©º­PòzÛ´)bÈ!6®¾$Ü QpôBÌ뮹ŠŒb+(íp¸?vfY"•ja|•J ô„¿&°TÚqsE¢=ÖŽ T°}Ü™V„»Oç$0¡û1–²;€Ñí1«s‚boWT¥cÂï4ls‡,¶g›Ø†j5øáåÁEÔ•£?oD  ¡í^Xê]†Ì`T´‡«ŠŽÎWKÆý¡rgT)gDÇ¢h¸‹—Aa îšVú\ ›õ®ÞqŒ]H·‘‰&ë"}’ -~rF,ÊË þ°s^TAoÿé¼I` I£o¥ç½îåŠõØG´³üòò’µK*æê`jƒ™Þúm4´î ÍWWôvU†çW/è…s±ÆÂ<¬¬lÜ`î®ÎŽ—,ÜÞo@,¾ëà\òyòT?w@Ä–NóT¿|x^^×ìïèèx5“ÔN *÷¨7cì½Ã¶6v¯AÛ^z´ÓR–díì‰Á€o„†¢ük'6rA™§Eè3ðú ù±ÛiÑ!!@ÝüÐ!A‰9  v¸=—åmî÷G |.Ù"±‹›@ís].ö¾¡qù¹Wì⊫7 ü Å\ -JdÒÚÛ/(8sñòñAø wLãã¬Íºõ&{ª¶0±¢Vµ>ý"å²­{xdÛéPÚؼXw»Õ€…L"x”Œðõtv÷D¢£3ïm°Æ^Ot··u¼ìçà…ªéƒQÚžx:ÁPÁ¡jB£óî7ë¬õéMkGÏ”¬Ü$Œ¿…©kz ·ÊTŸ’Éða{í!–ßF×NÐÌÓ${GÏðŒª/¨Ààìû5ÆIÖÈ¡¾nõD]Äå)ÑA!è@„·³‹›?*8>÷îÔ ¸__“êh瘒s;#ãìæ]í W+ÛC;›7C:À.s:ÆÍí>\£ƒŸêã#0˜¤“£½ {PSJvÊÍáèà Gë’¶a¹ÊÛ®-‘Ûœ¬­¾îvÑ¥‹›àº®AÙ8æv€=t¾Ì¾daë‡DyÁÝLLá_ “÷×¢‚ƒ}NA…&(Ë<:ÑÃÙ¶‡Æµ1‰¨ÿ÷K§ 4ÚÝÑúúý†œÉ÷¶¶>¨0´¿›wp<ÆŠ½™„0Ìöµ³³¿ßAÓö´ÿUaÐ×ôÙ_Úô¨d{}~Œ2Ï3 v–‰ÙKãdê†ÚÒÛ™'ÐD*Û[©˜üÚÝ36»¢Æ s`Ì«¼X²æøà¤Êe¯`-Ïẻ砑”ó'`®ôoK5³&š›]Þ–È M*ùêì8®¯o`„¢ (`§ÄÛ¬]½hÛ¿Á×}™µ4;F]>’†sKi“£ýýýÃ䉖…Ed"iŽµjÀ!oksÑŸe0†ôéñ~ð$ ÃõkPqñÁôè@Ž@gñ!½;"æì|½‚ëëé›có€!^$Œ/ì}´¿=:„ïÃâˆDßÃa¾SÔ!’ñ}øo[\ѱ;‚¿5LÀu÷`'hL™¦ÚqlÐbä‚ÕÞ¯½@MD"‘@À÷v÷P˜ §CzÄ âYGz#x°27¹°Â“@%,Pú‰ z¨ý}=½ä…UàÅÕÉÁo³,°/2É䡇Ãã†ú±}ø!2O RmãO ±øo+,òË×èsxuQ*™˜S-‡1íéî# mkìÓ?ŠNÿƒ*R!nx€Æ:»âÌSHDmÕØ>ìðäÊ¡<><¸ÊR66@Ä ÄHD"ðqdbçP½W¸:?…ííÆâV9B¥JŸy鬳-ge¡5Tnuß“ vès“U7‚½Ó)´¾“Sb‰OwK*ÀÛõEj«“|Nq‡pkir§•´ÁÙ78ø¤VåôsRgmŒA‰oØÄæbëd¾òDŠáJÑûƒ! tÔÇàËJRž}î茸\Å¿|ñûðÍQüxvã³CøþÕ‰6ÅôåÇG]õÎ:ü÷ãýú£C;ºg ÿTig]ársžõåÿ(â™ÔY™ˆD§UUÇ<õ£âÌ}ô¿¥ÕŠŒ‘yŒd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHF2’‘Œd$#ÉHFú?Iÿ Yúµ endstream endobj 685 0 obj << /Length 1317 /Filter /FlateDecode >> stream xÚ­WKsÛ6¾ëWðHÍX|z&“I'­Ç™6ÓÚÎ)É"! S>Œâß]¤%YvãºÃËŇÝ» ›€W³_îfËßDä$OxÜ­‘&$Žâ 2å"¸+ƒÏáíÐéB9_ð4 ?õªsÒÕ K5_0^8Ū”ì• ›½û0ûõnömÆ`E° å‘”¦AQÏ>¥A ú%"Ï‚½µªƒ(Éà]·³¿fÔ{ûm&’ŒðØšp&H#ZLP2D[^×Lï[˜äBËBÓ(ˈ`™‹êº?cš­î¤æ,ÈzW)§¸o'ôÊk¶íœÇáÞ ŠJö½¹ßùor·S²óXÚ£÷zÓH3tª¿—S³õJ9p«Û†mƒ£GkÊ“ ²R!È(Ä¿`)É…ß wM VÝQ´ë³îŽÊG/öŒg‚8ºÐÍ-Ý2ƒÒx¤;z†n!(¡ðþYº§H;Uz¶VmU.ÖsH1Y(OÈNvƇПãC´4Í(aà %<˜_ :H¥GÊ›+WŒ‘<Ž9z A²Ä|£¬ªSM¡´OÊ“¨a4vóîÐ1ASˆhí'Ûáß ã¿ß£Øveï¾”ºS…q²iÝ{WAðþûöÙ‚$°ë¶«mî¸orÕãÔqái[½ fÕS¶»®]Uª~aÌÖmU¹¦›Í¨ÂºôIÖˆ} .ŽZ7tßú+I¡??×¾Sèði<µð#ŒŒñ€ó˜d){¬9I@á X€øæðí±æ`™œPÆ—A}” ’§ÙÜ©`}y,îÓ·ír 2¨÷$ò]ŽóœdQâòaJäËù"¡4ºêÂIûýž`Å’¦²\Ÿ[õYöãH–eÿºÇ; ¸þ‚<¢à´ÑsšÂ­á¡Ï &|ŸGé¨Ï Æ‘÷e´p½{:¡ Z¨™…ÜŽò,|·6xйYÒ8©hmÍAÉ ²r`‡Ý>}¡1…ScßRA²>ΰ5`ç„¡­Ùµ¿õ+¥tz’A¨°;>µùt8ŒörJ½Æò´îú*FNúã“|Š§¿> stream xÚìXTG×€w)R”¦¨¨Ø¨ ‚ôÞETAé½)R¤(Hï]Q£&šÞL±ÄÊ.½©‚‚éuË?sw—¢h’ïKòIþ{žyxØÝ{çÞ{æÌ;gΔK&£‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *¨ ‚ *ÿ´H¤…¿¨ ‚ *¨¬F†£‚ *¨ ò7’öoƒíàľsâqëø“§húçPxE÷dÇÀôTóhZž~}:^Ö9Ùörº¸}ÕÆjOEOÇ{†gÿ>W¹khÆûv·@HíþÈzñ4ý#)²^è\­Ïí)ñˆ:TóhZj{Bk¯wâ;&´›ÄP…¬ò$±åßçÛwÎNoÁ˜cìq;4ý# ¨Ú¢äxfkQÛ8‹])ªy4-K–%: M?7Œn÷©Dµ±Ú«kùæѿà-ËRŒSšþ¹d]z"»µ¸m|Õš–%œnbÓý¦Ñ]~•GÔ<0Eš˜b5-þëìy¡jà ²NÓõÿ à ®Ôébîè–ø_¿«½W=œøiûz›bŒ-TÑþÄŽªAROÏ Ÿ×_Z׬KÌš#“ ÷p]³p-Ãû;Fç'f‰u­ÃÇbŸ’IS#‚îe®ÄÚ#@ÄZËM>ê›&“ËÊ{9\ñï#ºÁ_ÛRµký½“„éyÒãß^¨§<+ ‘Éc¼–%ÿc€Sèm‡;ýãèo£×~~&P¾PSø.´µ‘š[÷UüaÛ ™œe1ædñbs€²wõzà¸5îU‘å ’‘çç‰ãÓ„©y"øx`Ò$’g}H“ÕµN‹ìF:[ÜbóO%§·|éPŠ±¯ýº}¶õI7v!h°ðëÒo^ûõw¾\=8èø8”;?ž LÓ'ˆ"eÒœslè K$u´N‡_óy—½E·e+ëÁ±ì­?!ñ“ÑO]>ìоT‹±)ŸT]阮ª{¡y±n‹oõÑüN›ü¦uÎø•Kü9;‚®\ÅÍsÄÑÑv°]æ m°ºÞy$¡žÁéíEö£ZFÚsý =àßúý [•¥ôÉ$bMSŸZx5—_QA§ãåfû·ü_]yÀ)™ƒ:âÑÜI™]<:e•T‡¡õ ø/¶õÍ’{º†%‚+ç1—Zx^‡2ÃÛÃÓÃòþå }=”½«à°}È?u´ [¦6„ÔÈ&=ý¢s–0?ÿÅ/Ï8Jéñ›œÊ6-˜±~kÙv¯ŠmåL86·ò^å°¦;—ƒ/wx”8 _VlvCE=ÇàT¶Ù³br" ò%£=N8ûYÍ4¹êñ³Þœ.xf·òÝ^œ®TS¤s7¹—c3ÛæY±Ó³ŒÎ¿Ñ³b£ò¥=žÍµœ×«b»g9§sÆá} Ñ¿Í7Ç|8”?;1{ó^×±Œƒ¼Žüº ØšÎL)žÁ‹$´/¸ŽÑ¹l ¢Æ­îå 4Â8à¡z=*@ðzV°;ãç Iö8&p ,‘­@óH ‚¬˜ð[œÊ8‘‚`ñ­ûôù,¸fn^ùZ[<“~½~³žžÚÎâÖº–oó‚]†\‹ÒÃð€å¾Í³|¼žÁ¿>¶½ùqð刨;~½KÙG˜ÈK³¬cÙFä,p«œ.e” œËx<€ýÀBät¯ Ø½#~¥¨¼¼%Oø¼\Ë°‹ =¢‡È-­En’BZ`“|^àñqôÎÀÊy)7 ~u.ãt®º5F$ÏÍß¼R±ÆÏè„çvÂó8á髃ÛÞèA{vGhù[<Êéÿ:K{wżxÿ·S qÖ=9K&åÜyºÖé-GåVActÄQ¾a†^Áæ 5ª*“SÙö€º´>ò@Ë~hç_šCþÏܧtƒôŃn.ûRè™—pk°Ìm ªÂØË]íÉñ!Ó"`ðÛ"›¯7M¬Æ†'ão?Í­çλ¥Õ`¢_à·/÷„¶|ÝÎ ÷´ >_IÁ›_홟‡z§¡o?;>•ôI+»#^¾ ç9u…(t;ã²+u9“n·‚Z.Í“áV\õœÓô &¼gd`mHöRg™|ÿI7³U©XrÇö™y"i~žp¿ô¹lp%–Âð÷Í&W¸m)&¬£o è„øéGõÓ¨|ëŒEUJÝèUÃvÂqËÎTþÉÈÀT×ØàD`a“=Ò¤úÕzþ8Ø9‰¨wfî«G=Ò°õ´Ãm kºP2öj.™Êù¼Ï@£äÔØß>é` i}òŠ²ÍüÓõ|øèÅÖŠQ2yzDÀf.’ðô£¦)X¢dbQE¿6(S8Ò‡gõ©±ýj m‚®:?3{ý›vÇRá Ë~IÄ;·jä½—W !ÀŸj›OûÆH~„žô¨„3+ˆï¬‘Á>ùÄö‡} ¤ÉÏ:_™^¬F©%/ÒÅ´‚fn¹NUàÑÅ$ŽÍv¶Î÷Þ`/¢Âôìõ{]b~УÀ¸V{ýž`Æ*½Åçþ4ßù¹«Ÿ·¯·/Á\êl'IÔ¥seåÏU’žµÂ.ÑØ6ËbŒsÅ¡/Z&ÀOÄâÒÅdh°Ï·šý‡Ã”5fˆS£ÓÞmw'ÈsM}´`Ú2€ƒܳÊô“¾ºQ¨ØÉ‘Éó¶lpv(;ô-ÐÓìÅ;5àŸÍÀú Dõ$¸^\x«Þ ‡‚wô¦“Ÿƒ%Íܼßëz­Í ­I˜½Ñokà‰ÜÕ¡±9òØè ËÉ"ú3µ©µ°Þ”U¾ ûòùí3“2aÆ1¥ s®whšDœ›ú¦aüã'/¿nƒ°&t>ß`‡Ã:•›ÿQü[Y¿ûg÷G`uÈ-¬cðoÈ«ç“{žŸýô™JXåÑŸ ÀcoÑžgT>À=ç4{‚ ìî#‘g§î÷ÍÕ z4ïKêìž'Ç'Bouø}Õ×6CêhéÛ{¦ì} §¯p<(™›/gIä©ñ=î8Úm•b\Ë1§‹0ÖxÉä%!çòàr |Ò£Š~÷›=Å#œ‘ å» èÆn=xî}»ëüýá pÌ“îuv%ϺϞƒšÏùºÛããg…•À´ 4ÓÙ•œúdEüöI's•é­ç5HÅ/.éµ*hQºÔVùŠL˜áw)eì¨e2=så»g¡?C°ŽŽëú2TX|÷ |*¯|éu«ûv'hHŸ|õt}Hý…’ÑÉyÒäøÔÅOºô¢«¾gáÊ À±n•~O kš‡#?–‚ƒ¦>órDÉ¿õb;nfªäéØõ_ú?Cœ„öæ1¿²%‘1¨îè¶òq`B„?ôœ¿÷ò)𠦧,¢+1îõWZ`«TRÞx·çj=Ì¡¥þÅ6ÛŒs•ýÏàyçK{¦î—¦ÿ2Ô­s6:¯ã]ksãYÙ4‰L –—õ&5ˆ&>«‡O6¶Õ¼xGj/¸©ù‘©¼{½‰E#Í/f÷j[_n8]ü÷œòMéÆŒ‘ÔÕ9´Õ³Âçñ$™<çUEg[ð  Œ}™ÕO°²TÕ¿t¾ÖYP”L¼|»Ta•;@„–±¹ÇcßV÷ {T:ߺé›Èø®W'º ëˆ|•œþ¢w©0¼Óß5KñœˆcSsõãWêÙç…ÃXË]d2)æ‹k+UgjX3Ø Ž'¢µjú: '’¯ä×›äKꪇÎô€_L³NB=—+£ÿxÿèð?­éÄ•š}Ú>”ßïBºüåÆ ±ÅÞ\ àgÀ‰ÀkxðY#›k½kå¹â_¿l€Ó6\+}ƒƒ >ɵÐg[ÇÙÀIìÞäŠ[»¦uüðËbàNeâqÍ*1õœàà#¿™>5¹ߌ±­Œl‡®wÜ+«2ɸFÙˆ&Ð\hï¾îܬf\½åZ)s©q_HÆ®ÄìøwE]pÙ¹ê£Xü9 á(Ý›ÐQýŠ98n™P; ε߼š'·o7rG¶•¼„ö–^Ëà\¶'®­y’<;2q(ªz±Eú±ÂÛ> ¬ëd†K¹VngÖ“—ÇÎWÉ|: ÎÙ;´× 3÷k~<œ¼Ôr "ûŸ`\ª³¸›Ï«ŒÑ¥ÜîôC>û±“ÓºcQ^8C(—óÊ1&ż‰Ï€o6/uªC½·¾ï`nª%Þ±dHªùNyXü™Çã gðÝý§àÆT {_ÉÍZ©ƒüÛ)ßXNçS_9Gž›˜õ¹TŽ1-æŠm«!Î î¶/Qüdî¡ÑôR;´’Ó»‚ÎÇüttpêÄÏ”Ñb({Wó,G<Ö ¿Å¿F;«=êç—žN"Sâ׿ô¬w(’)\¸RÆ3дÏUwï@ºÃL^U<.ÉÌÀçæ§eà ŠR¦€¦Ÿ:¡ñ›ù¹µÛ.¶Ý¨oš}64óbÆLš»0'pŸ÷dW<@1ËO,øæ×=pà6͸—ÂêéRs¹Zæôä\ïÈ܋ѹ ¤Sþá'ͬΫà8ýÏúÀȯ¶¸Ñ¦I;Rg‰ÀîÏk·ÇíMîø¬i¢c¨qvp†ÔÑ_ÓŠ9‰Ó½ùÙ<¡óå4¾a8ôÆÓˆ9TÅV 1öéù¶S*Ür›H16 ï„w­¾‰<3·Ü•pÂÄ0»]õ}ÐÕžž»vµ|qÄÑ9ãY\ʘûÖÈ–œÊÑfp3óϡöI¸Ú¾MÎ¥rù½€óÚ—Ï ð²^6gœHZ/miVòAV¤š•ZÕƒë)jßþ´4ä‰}®ðÁ77< ’G'^¨Yâ—â0vU©Èݨ†*BL—<‘EYDèyšKžÁHhÄ-ÊâÛa7°ñÐÄWØÿ QχNJ.ÃqŸ{?uó€~ŠUÅUà…€~4€r[”ôŠ@ž.l‚Ó­­ŠØ3GÀ¿N[áV{o`<ÔÍ»Ír—-o=oýµ e(cëU…D ŽŒê0û‚RÈDà œìÇ°š|x·4èHj빧ƒàƒÒè æªøÂ:à›*¦,Ü sÄ1¸”˾€§t½’;[&u… ð5&ÅÊ™= LUtïtCâ™^U×[ˆË>!d ü.ø°[M4õ-eñj,"ÁQ¹¤[­ÂUFE0°2ÀRÞ„|SîøŸ–wDê¾kM!ðŸî4‹F×ËÆ4È\l‹iØåWAçˆ[ƒ˜V¥Ü¹= 9ªÑ÷GVÖP*¯EñƬ÷ÔŒn1„â‰côkŽ6i|:íVËî€jÿòé9*ÀK€#Êw¡9äÇÁ¦1d ‘XV×·ËYDãV)‘ØšP4òlŠbě߶39”.¸ÛŠÅfWýxa=Æ lÆcƒÛÒøŒTÏ'ÞnÛ^«óÅàNïx©h:x[ó°¢w à§êÀÄG%T€Ç\à4‰Áõ÷€¼ðLàO®#Gq0–%|LÃ8`]Sp8S®,¶m€¬ùÉÀI)Àpò‹·^ðí4€o´,¿3J$ÏÌF_Çc¬‹Ö¥¼ú'Né…YmÍìïŸ&Qg(IDêIĬЀ.8[XPÊÔÄ\XF­htƒìEXd/Ô³»â”?Oʸý”…2‹lE€£i•zà8¬k퀴„ù¸Â&z8ÏèŒßÛ*ç³®ù%øÞ¤ŽzhÚb¾åXGiâŽl+}+À¡kAïŒÇ"Sþ<,¨jZ.嬎*_¹&ÕjÿïáEÏ0ûRŒ{×P·7²$)!”?ð±M渠6Ø‹Ìÿ²ú9%úÅ0Ôÿ÷|až¤yù¹Ú %«ë?ûYOäW½!Ÿ÷~Ó ª+wæo1„r¶œáLc <79˜Rª½[ÅVŠI8àU€gÞn} àÏå‘nÔý^Õ!;¼É}8'`z|æ“Ç}á_ô\üñeé þðk·c±LáÐø=y»\rvÎá\ùæ°–*†™™«­ºWžU¾˜Ùu÷Žž¸X­Xð œ8=q½U!ªú2ˆ‰G1éÜ«’êqX|ŸqF‹ï}Ê¡—ãÚe[.¶ãáPº ðMÁ ‰ä1àv8žèfÿ;ݲþÀ/-Lën‡¸‰·ÚL®?+‚C->IÕ¦_aЛøãÃn½´Ö¸r8>Þ÷ì%5è¡T9 xP*à”Ê??£üÚ ´#W©ïi¡b ÂÃfÆÏßh³¦‹DŠþ‰Šm &¼­´Æ ½KÁ]Á£ßØRžµAµ »àw]ho÷°$*?W»XÕ †©ÍÁ‡Ç‰¤²Ònf›Re8ˆIÎZâóµt@7lòÒ…tsõ†Ph³jÊ­¾ÄõÎŒÎçÀ‹&t÷M޺߫t¶ c^,}yàÅ8±§ï%‹Y1èËgvüØ539OŸœý±¼ï«úYÀP8 %¸§wŒ0:9&@¸ã­€Ds'|oË-ïöNæ Äg½¯tks:gfæˆÅe}J‰-7ZgFg‰³³óñ—«0.ÕÅãýSĹybkûÀá„ž 2駒^îÓO0]-CóS³2à”éd•Î_÷—¾˜&fçí½£>Y , S£ßÿ8å¯uÉ®¸ökÇÚGççD¨¢¾É»ÅÏ÷y”‚¶U<¡½jˆÔõlp·8¸"¸tüå4PKÇౄ–ï{f&¦ OžôH'uÜëš~5C˜%gf OGüòa Ü®Âöëþ¢ÞYP^ ó‰É¹ÊÆ!ƒèjŒMɉo¦H„ù»¿t`@±ºV_i››%&fC€ï‰k/ê# ‚VvtoöWöÍNÀᄦ®±€¬:ÐzÒ¹Wžþj°cŒ²íwJl8WC:=5Ïå.4^oœ737û‹ÕŒžÁYÒâgì°s„g lÈ«ï†'’€”4 y¥Ô`,Jv^l{ÔKœ­†38wPý×=s£/Çõ¢ÀÝâänöOÍÎÆàaØÄ®Ìì“çŸ#$ÍÎ:Ÿ‡æ7²‚r·)a úiãDÿ4Œ7ŒOÌüZýR‘%p®´ùö}“ë(—Ƀ#¦ŸßëÚŒ<§011— : fÅÛâº+ú‰³3¯¶Z•Ð»T¸<íwK$vwÙ}@ ¡œú[C(xØÙ¹õ¼tdš^0/,¨w(ÅØÖÝi›ž$ 3ª6†=m#5¶ŠÃY(8ŒoÃåê±Î1Â<‘žå—Ú— Þp¯¥Û WKHþ¨•Ù–:βƭʯlòÕ,\»tõÓ&zÔ_½³Pi}yÜÖ:”–cé-ÇR›Î×0ÙÂÖà'΀ú£©-ú‰uô¶8¬SÇÙº“×Úõ“š\¬]g_vx…ó“¶)Õ—šci-Fék‘!r:·J¥¸¦YÍÛjKç\®Ðr"½yo9 W`½aF³Jd ÖÇ{®þHZ‹Arãï2@~fJµÄô&>ð r[4/Ô2Û•bÜj§4g4q9.¬^j<ÿùp:¸g±³•Ôàç{¸óÝKé­à,¹Ø&ƒ´–ãiÍÊ‘5p¥32=€Ã§Z;¹U?¡žÕЪfJ‹ajä¹5Ž?²¯Zþg÷­ÑNn>žÞr4¹I$°ƒR–ÝYඇÖ맶€Ÿôâx=‘ ±n[X“IF³Bd5²kS¹t|(zq?Ø#có©ÒLùÔ¯¥¬ò°Åí‡e®+{è”-ª°ÎåR—šŒ2ZäB*1V¥ŒgjgµjFÕ0Ùá6׃eÚ$ä[¾Ñ¿öhz«ZT u%&Ü­B.® ÜÏ‘¤ÆÝ^ 3dõ®Ö€åÞ@Y¨²Æ­B)¡ùXR# 0Ž+¨Î µYÈ‹² ZðP‡Sa¹KWÒöÝ*Ž+Gµzb3¸+ݸúõ -°£,h*ßÞd™Û"ä[AYOÄPgœÓª^ìȾL^ºYÒä€cö©9˜Üb˜ÞÀl£÷¬‹n0Ê}z8±QÀö·uÂù¶ÕͽŒf3ÀËÃêg¶j†×,[ˆjƒŒm<žÞz$ª’Ñ­J7µU'®ž²ã£¬k>žÑªßÀA‰4:â¹C­r[$‚«è–¹9àY<ª‚ÚšÚ$ì_†PVýfVKw³yc‹3{Ú—ŽxFïÚØ'ãƒã³y·[x¼«Ì¾}¼¾¶!_ä$-dHÉf3ÔöÔåð;Ú.p”üisç¨GR–×Q[–áD/l"GÙXÏñ}RÿÝͬžzA-ÔMÆðÔ§£-c¤~tXºþõâ³_¾ºÜnÉO´m Š`©nð‹…E½hÙbQŠÏqÉŠHÛ%™,-Sû%—sÀ/{¨¥Æ`‹[DsXZ¾´ÌnØ~Éí½­Ü—jìµÌañrKîÜi¥Ç‡q;ãzfæëj_DVoj+…KH7?DæäüM{¡,˜Ä¢>zÊÔ¥ÓÐQ±_¢¢¥ÿæ³Û/Ô»%ý>J¡Pk: åß»ìkSñ*9]øA œ½Jd¹œÍ¥êEn;-5¶wlàù'Zq µ¯ò~šâ¶ì_°Ù#þ÷õ¹ÂJrÉ?Þåy[‘ýqƒyÛÁðaWØ õí»ó9Âm‚Îü:—±Ip³˜Ùù¯ts9ãþÊŽÞŠøÊ‚ÿ£ä;È¡¬þWzà|3üZïÊÝçj…Âjùƒ«9<ÊЩ¤ÿÀÑô~&JG‡u.ÛP#V+ZÃë_IïøWOÛ@_è€üŸy#ÏkUê¶H(½Q€ÿ;“ãJÖîøWwôP€£G_©†M«4¡GŽ8šP€£ 8šP€£ 8šP€£ 8šP€£GŽM(ÀÑ„8 p4¡G p4¡G p4¡GŽ&à(ÀQ€£GŽ&àhBŽ&àhBŽ&àhBŽ&à(ÀQ€£G p4¡GµM(ÀÑ„M(ÀÑ„M(ÀQ€£ 8šP€£GŽ&àhBŽ&àhBŽ¦÷àGÀ-JàK]íÑôO%Ëì֢¶qV{<ªy4-KÖ%‡ÀGwúV¢ÚXíi[ùæѿà=¯ær8Üèò¼ýÌMÿTrú¨ ¨½m`Æýv7ªy4-MÎu§>èoz1üE¯ÇínT!«:¹û¬ñÅôßð瓤ÏÉ…Mäë-húçRa3ù~/¹ŠtÕš–§«Í䟑{'IwÛPm¬úôQ+¹g‚äïá7©c”¬ù%OƤ¢éL dݯȟ“1)¨6д<%’Uï’¿ï&sç¡æ±úS&ùÇ*lÿ–øùØ÷ð*˜<4ýƒ)“|⹸¼.Õš–§,²î×äû=ä]×ÉÔ倌òöà—˜+o+JJædúäJõ‡Åõ7E÷Ð>¸Éøë*ÊšÛCúÁÿˆáÑ,ê_àSôvyžÛ#^QÕ`}ü+ÊaØ”jþãj’²»CÛhFõb«ùIY£DæÔJ-@Êev±¼@½ˆ*PV7Ü6Œ) -Ö—¥5”´™cH’Ó2“Ô9.áðÝ¢ÛØdb  B-z.Å<(]ïy:X×h½¡ìq~#M)‹‡˜kdxJ­wðF¥Qˆ}ã¶1©û5Í6_셗攉`gi>Y3TÚPò¡P |Ìž¡¸X1Bø¯x>yMÄü6©k³ÍdöouŒ´ùˆ®€BÅÖí¶IbžcòG¹üoñ[ž°Ž°Nà9׌¸¾¨Í盼³ø­"…OGnõÇA ä—»‚dlæ0·w® E”€U”ðéK<çjÀ÷ŒqeBnjՌ„-b6Ås9*¨<â³=¸‚€.£g“wàé0«‹Vñ<¡­ ¬‘Ž?™5üKp3§C…­Ó¹Ã[@-=z|—o-¬ÝWɜޙ7˜3É+·Úÿs€SL7óåV‡K[. PpÍSÂ*|CTÅ,YÎËo›¿&ŸÌ_Íë/`ÇgÉïtc]Ò|Fp/g íÖÈÏù,£ÍÃì צŒ¯Ðý) ¯¹p—M¤U Ð?ŸóMÖ¤qð%§G¤¬úÙC®;‚JÖ…~µ×ÀHEو߹`Ã¥!L>%úñN›(XÜ–çùÁE'©,MkÙâœ(l!dµËísfà#€[@€_†wÅ_¾ÛúÒƨ®•ý4Ðèg´ ê©Š8~NGUE£˜²²µ¿ôÑP¶$WFªËœˆaDð¾æR%¯ÃEA«8~«(>§[¬)ЙŒ¿¦¢¬µÛó>¯Ã%ðì– ›Â^·ºÕëçBMÒG|,£¡ºëlRO‰¬‘_ˆêKè‘6ÿ›c Iõ"5÷:}ÎÈhçqM²5%FÀ>ŸãÒKJVàjGù]¾Ûî/xúœM憈NLÁë½Tlæàn#c1««}ÒÕmÙSf¨­aF'Gæ&¿/y] v¸äðY†ï8ó!‹sHùMÐ:vs`¯KöN‡dAëDžjè2€jHY<ÂoöLßq¦‚â® ÿ’Ï2”Zg#Ú(­}Bý6§DAËh`f‚6™ëc†ÁƒcS:6;+*ëˆZÄl÷½Ïý™€ýu–JÛ1Æx—ß2”ß&çö3€‡ ªÔ!û[ìç¾Þ霻Ëö‚Ýåu‰#´ºð/8}ôÇÊÊ*;ÃçAM¤ýYRWOE^›+ þÄ~GQÝfC|ÿz÷X95íÝ>8ßlu¸ £}bkäKØÕM.|TEIÛi§Ç]®°ßxCTuv!}á% Éæô SвÜî÷3WxÑFPEãM—F1Ý»Ì5ìxÎÞgM›YrUVý ˆy.{ÂKÀ;eEý¿q†ýÊëp^NËŠJ‰>îI­ã‚®wAV[¬íT4,6Ä Ó¥4Sþ!™Ãë‚‚šÖöÀzºÜ÷Æ+{ÝGî*gˆßHW˜úeÐNsùƪI‹:Ë€¸"[lÍ”ô²3Ÿ ?!aš¸1ä WðO',$cÖ‚†©xà^*j‡÷Fr‡­ütï³[ô9óË4›ñDREIÂ"Ÿ+¬ˆ+øŽÈacQÛÛt9DæˆÏ¤´H%°'¾`Hhâ33WQ¶çŽ®îC\©ØÁƒbVÜ瞬þQÐÈl¿YhJ0WúvŸ°6<ÏòËÿ["‡î³üÜ-à /€M}*pÜ@Â$y]âØÊ …žÛÈ&GwÃX–ô9P[éÂÎ+kZ­}´OÛxS$–ćrªJ"E°[—\/|ä¨äé¼ ¡¿­úžßÄzÿ© Ã„ëÊ*ªr‡Ü·<ä {¸ËÔ^AÛ‘#~xUŽi®p yšEtõ÷Û~Œ(m’ËÃOÊ4q‹}´œ¶;+ 0G~%¯~Œ7¨s}d—Ñi¹£Ü!O8Cæ3u’>Êš®+cú¨† ÎJiè ¹}Éuþ·­ÖŽÊš6œq#˜ÌÝ&'eûñ„ƒ:¾ë´¼Î™µH†íl¦‚ŠÞ.ßØc:Xü}ÔÕma¥Ìá›!«ª!èù'ÀˆWž„ÎQaO<ðƒlJkˆX]刮e‹z¼çºŒÅg¯·SÿÊ8ÄH·¨æ=Ž?c> ³ùDŠºåïUSÚ}ö9¦€Èå/u2)±eŸ¶Œ”}5ætn1—ûOœ”2¹F—Gߣ/'e’ÈœCéÚôî;¤%mBw•¼$2GdÖ\*g‹í…§÷éÚœº¸gæêüf—0y-?æôIhl)Õ’šzüî¡yäX£Š8#{áYIUb”öúµƒŸ6ž<(g˜È˜t¥óºøL|·žïÀ¦´Š9¾3°)üºhkÛ‘â{ŸcàÐËâvUR?»&Ÿ„ÉzÅco.aà n”Îœz¦Ó‚:"~,Áò‡¼¹’§¡ 7~_VM§=æ:(,o5¥í±Ó0jimÈu9mP%‡ÁSl>qXîø%úÌv~cÃÝgJ@άþ™JŠŠ¼±ð†9¼£•C^!Ï|áGM3žˆLÒ‡ÊJŠb¶w(ÏŽI}$©¡ÅP¹*§á½B¡éêyƒ••ªîyúl"6óåÎc'@·÷©œ–ÞæhPÊóœÞñò‡\¸2ÈtçR”Uò\˜„E RúqCÞs T€+jð»}«'ÐUâ-eYå] HÝ!-ôÑ8<\µƒ™ÁÇkÄmÆÆ Çã¨ý£ôjcê2§ ³”v„ÇÖVÊ(†Ú?QRQ†EP€Ôý¬J±ƒ‡„¼‹094€_î*GEFCÊ,}r¹¤Žñ.ÿnÌ/Dè zcrg¶Y˜Hš`?$sÛ*©tþ‰Ç‡[=³%Õ5D=Ÿ`€«¨ÙÔIºÒ#¦°_Ìýuž…—{EU¤÷ž).ô—>T–×çN@‚féUBÇõ…]~ Ë¡ÌVš]ï#ØŸ# øTàj|>õ´"á;j cÿ &w9ÀO‹¹2$¢$%îô%BïÅ: {Ó)­;¬$ ™™Ië()Ë „ÎÁP@ü=ðKCp¨=€p&­v¿ªŒhðÕ7+$opWÐ0âH™WuaMÖGÕY¼5U|óÈÿþ ¢F¦ˆ¹Cþ, µ{ 6EÓGÆ)êGѧw ˜Zð†´3\úQVUEAÛHFÇ’¤IŸgÎ@~Tg BZi«ñiy}û QåjòjŠŠª ’âŸc ¦6ÙZ©)åwÿŒ3¢‚íbÅ^  —Š·¶°»SU3týœ#ª†=è Myà½bÊŠ¢Nw¨.­¶Ò'· ‘SWTWR”‘´¿GG|=pjª“ÐÒòébˆÉ—=äÏ”Ò!db³%âc€‹šn}6a“[¨²‚ŠœÎ‚òdôÌwy ¼8ˆ©‡‘ÊÎþ´ªÜ®‹¯xNÙ¨)ȃºõú‹/1—n*Jï—5ŒÚt®x]l#µ‡¢^À»Ž„ߥ4UdŒ¢7…ü:Λ\/(´ß袨iÆžNX6ÜÛNMNZE圮õ–ðÎeÃÍ+6£éÏùŒNHÙÿÌñ¹‚’o"Ì„Í/CÒä"Sú ¶¸¬}-¼«‚ÑmÖÞJʲ4Ó9d${ÐhWPè¿«*kìì¡Ñc”ï°Ž¬ãÔÈÀ¿ Ný©sŸš¸„O7}ä§2‡NmL€å27”?UˆÉ~¹÷€¼O#øf‹U€’ŠºÜ‚–€‘Ðñ)Åæ#W;¶5t€ ðÂAeq ןi½ æ|µä”d‚zm"}ÈXZ×XIaŸœÍXà†‚n©órf9}âäûpeR¾Û¯“V»•³ý“;ñÀ{÷+Hïsùîµ:K—Ò±GO]QÇ™×ïgö¨¿9%)Áw<µ\RI^(|˜ZÊ…dNÏdÃ듧!ÀÕÜYÓ‘¾ÀkÿׇPrI iÂú&Û\“ÅŽ¹°'Ž`2›%ÔŒ¹#ÝsØ’+~“P"­¸Otm>FèdØRO‡!”âvßR~e†ÏÀHNß5}’3ðÛMg¿Ûð Wd]V£„œ$Ÿt "®ô‹*ï•p­D*À%}pBùö§’Šee÷ŠOÀË’±q¥â€Oð•´º†¥Ía`ºTÇš2J—ܲ÷°¦¨Ã÷ëÎ,/¯ ì]±$FúßWêŽÜÕäM'KZÞà´³”2Í·™ûî8û ¯¾ê~›Ï`çÈí¼ì‰dæBDíå_§F6ؼÝ4Xh8kè9e­—^±œÿuSÀwÏ~»1ð }Þì¶ãÇUt½ ®Ðd.ç@åCKN ¡lY ¡Lot V8ÍŒÔnÖù%+j™z¬óŒTR?Ì•HÊB—1¸6î)]>¸µ†²ÕÆ‹=<Þ º¾œ c‹ø‚×f«R¸1¹Ù)PQ7–Ç%TEýÃ5XïcîIësF|,/«±%a9w~³­‡œÙUìuäÙÒ5dSI•Ï·– ¢‚î½uÄÜý— b.γ%ì05P=ty}@¼”A2}!Ô'CTšªZ sü]9¥cÜñc@NʆkÁñÑŒ©5”ŠŠŠþ¶@ÚÔÜËR²R{¼‹§_ ëhÉëm úi“ÿ× m<{o»•§ª‚1g6Eµàq§oé(s“rg7¸Ë9w„WVôÄÓŠ WHïð~ç^¡œþ{eŠOKBÚúcj#R@bu6urMô§ Jº<ñDhÒWÉ ‘wä%ÂæÁÿôq߀sÇ - ¡1­û4¥%|º¨ýý+„M.QŠ§ÙÒfÿ¿|q z«5ðmÄMr™Òç@ïl÷qíýVÁbF™Á‘9/ t”u˜àÜ026½‹×1eKÈS À…ËÉ aOš‚3’J¤4ä$,¾ƒ%r™–@O0£^\Y^À©_Ù\•¥%ì‹0× ›C5ÝÖ¦Œbrˆô)•’ê]~E€M*••Û·çâ9d mt‹RPÜ+îRÌ:¶W>àA ÈtÉd䥅üª0©OEí € §[ŠÒAž¨!êœðÜ÷ÕGfÒ…G+êÚï;xDسvo¼ˆŸ¬’â®!ˆå°»rÇwÕÀ¡üÓÅÇ|¶yl‰3pÓ猪¬œ #2ú0µÙù¬Š†×:Ð,QþuòÖ'•uÜY2át¯5ì9¢£®íÇœ:‰Éê;¨-fþeá;w%7fØêMmt “;±6 ®£aˆÇ ÕQѲÙ| t®¿”UUÝãú ö¦_mv ÓõfM#Ài„šIè’j÷êëH˜2dAµ3Ä7pFÕ0f.{L­ ¼&­q\B_]Ö®‚ÒL}*|Ì]èÔ µƒŒ-YÎ*¨Ør¾ Î>Êžc‰úe·ÓMÖ4p'(+)I™¦3fÁÆ‹!òº¼êÁma­ÿžyà”.“Ù=/(+=e.âVN -f4K¨êóÛZÊ]“…”rܧ²*Ê{ÜSº<ôñ¸Ž—×& Ó1UöØ}Kä2™90BM^{KDµ—êfä]E)¡€ÁÅ: Š#ᑬŠ¬ˆK&·‘ßP]åp82©›Þ!pô€¸å-ØïCbà2FqL™Dd.ÄmY5­ÁuàF’T€Âx™ÍÅFU݉#ÎëÆ&>”Q”jc¸ø¥¼Šþ–h±Ø´¶fæ*Š²BgGÀa üt¡\zàÚ®qó˜üé¦&ªÂX\Ø”F!CC£\j†uõÿ—§ÌÓÈ™Þà¥%Ä-êò=b9›mm´%DDlï`3Eþ°Çà„”«ÈIß}Ǭ¤Žzó„·C€§ˆÉ½°Û:|™¿Ä!éãaœÉ¤eã¿°²o²÷”Ó6ÚgrVØü¿Ë÷ÛlÌ5 ¶ƒ®SðDzÊr2ºü ;œÓÏwÌ@EIcŸÃ7Œ¯¶ZÙ+i‰š†›Gnó¼&|옚’!ßÙZLÆS¾“öÒzVbFîºûÍ2™Óæè“ê$( x!F^0Ì{ÚBUíÔÆ‹£´iáïå &µÔ*)·CKJms´=úØeÔöiKfËFfÿf 7Cò°…˜ñcñ#–¢–ùkSfáTIgãƒJŽ;ì.Ÿ 5r9hÂç[ŽÍ]ü¿ j艃¥ <÷˜ Ûäòx¥ËjhI;Ë‘:¹õ”¹ªœ¢¸Õ¬é„µgs”eÄeŽð†´1Æ<Ó3<æ¾×,DÐ:–×­PJCQîxKêKÎ3é’zÆÇÜö·“Ò·Ý€òÈùÂi„À¹Š¼+£ª(êø¸ôk'E=w®Äå“9)žyòc Mi½½û¶]¦ÎæÍÛaá¬)¾Uæôõ%‹47;†I¶ÞgìÿQ›½62jŦÙ2IÀ2tïIOiíÃ⧳a·"÷ßðEÅ©*ŧ© ½(ŠûÍŸá7E(@Š¡ЮÌsødH蛊yŠ˜øˆ9-n–´6i.ä O8 )!nš"`²×ÄMVCGÔöœ£KÿÚn|耒sÁ’Ž*Ìpv»²ºº=kbŸÉ1)_A‹ˆ=fâ‡eô<×_DܪĕTÕÅc,Âöœô”: /q2‰%eŠ²GÞ¸am"‡•ånÓåò·ò™ØÈèY‹ºï×=.~*›)}–.µ“ß脼Ž•ˆYˆ°EÔVŸ»ûtTxnŒîÆdvëë)éXì±½Áæí¬¥dÊ;.Ê[$dh&eà.bê¿ï˜½¸Ñ¹ ûáäÕ³§ÉœZKøÚ3Vz¶kòÿ?xàÔ@%}j[DSêåKú¤.öˆ*¦äQZP‘ÈÔÍUÁYÉUË ×‚!ßgO³ÄÔ±$ 1Å5³EU²GV3SOY²’ Y MX]Ng»ø”!‹L—úŒ=¢œ5¾›9Ár±†ãóŠ÷¹GŒ—I+‹ÉrÛÕ·8·0{‚Ë-†ßýåÕØ‹_J‰¥/\²®üõlIoüDí°x[«Š¡ÏsBiuzà”Ýï…ÕÅÔT wøVQ£È<Ö°oùí¯ÓS&d½:î±6ûMó ½¡´å?Ó#£UÕN¯¢Î'yOÖ¾¡G¾*ŽìoÏt6LQí˜Øaãý6Ÿ¬É"/ÌŸ‡}gÊ‚tŠW\°ä{ÊO… 1ÊÊ—N1])ó"Ÿ,Nå­Djì¢p!|A\¬¿‹ßSÖþÌq»§8ܦ¿Œ\ë2 s•D;…¶RoኹDªÏ|™¼üo _"ñ .G3EÝ0>C=AûÈ4]øú­¶(ÀÑôî½PÈ”í^é£ï*©ªí ›Â¤<;xpW@ÅÝÅftî:©£¬z|¯MWDs°’¢*_p7&¯KÈÄLIÃl¿iü†ð²MÞ)²j*ÂN_õœ ¿Ò¹ûä11«»ôÙd†èÏ”ÄOEípÏßs옲¶ÇÚä1LîÄ6Ó*§w»ßØâ}Yì ’†Î%Æ2ã…Ÿö3”8±)ø7Æ\ò?; uO`0Ieâ:ú²G=¶û|Áã•%¡}PÖ( :„›¾¶šªÖ{Œ\vüÆü±¤šŒ”ý}¸±çÒÍÄ É,Njl)dÆèï¥tNoŒî¥èa]Ð2ZÅMâ¹â^0Ä– ˜˜¨([oŠ(cIÆ$UŠé‘:~–×çî6×)-Ý}¶Ÿ |Ûvò°ŠÆ)~—+;ÂeE¿§Ë§€(­aÏaCi“Tðøï»'ùÖ½P {LyMUQiWè8&£^X_ïÌoXdcÔÏ{ elŒj`ŒkÚìzFMNŸ7èñÚøn¶€L9µ{m²xü>æ7÷TTRßÔNé%q¸¸kÈéÛeðº¥Ij¨ÈgÃü)¿4‹É{Åké%§ëÄ™4NûDŽ¦wî…²XØdc¡¬¶tx §¶ZØʘÐå û†evï2R’=YÀHëóš?’@—ß/pò”Òw¦lÊÜ•ingoÙÃçX“§áU4€ï25³ù `×HUéøe øÎìÝe·>~“ýjCà=¶¸!ÊæuŒA¹JòÛcA†CÛ¬÷Ú}†Ef>¬ñwP×ð8—×E¥ƒžliDÊ»˜¢¾PPÑã ‚û¾²ú;kÈäIDvJ¼FÞàê®q ž®€¸,TžÓ%ª­*mú²Ii·€¡‰˜#²ñN.‘.³WT×@Ðå>%„²ÑÉEY5û² ZrëÆ€‡0ŽìÁÈæ› §†#¾Â@UNy[Ä8|¢«$öÀ|Nwèó€¼@ŸýjÇ) ÓDÖ4⪌/LóÝK ­PhùS›œ¤Ó×dÎ!³øˆyKyo‘ýlž¼Ž-|)äëÿ“×&)'!PK{‹m;ýÄ*Q]])ø!¿rF”¯wTR’ÝAz ÀÇ·™;I[Þ€§ìs’X'ª­±ÇãpÕ zê¾ÐäõžþjêáôyKæ^&oµrP“PÖ<,Së²¢¬†Œô®€&pÌ2€_^ð2kÈu-c—[Îý ßÇjN^ßp{³Õeu#ölòk¯–×’UPÐ:!{ÈrsT7­©ú›Vý=_hõ®’×ú„+Ë«ªë ¶qHQUE]Z@Òê'Ю!·]à™Ï·Y¹Èêyòú|ÇZÄþ«€®²˜ÍGX¸cüGŠòò¼I4€çRË \SF^AË@æ ¿÷cl.yt[P€£Úþ_œV5 ÚöikKšåÓgM2dŒ0dŒÒåNðXû*©ž€tÊìâ3ÔqøšŽê6;øÊëz³fÜDÆ ¾ÂNb™]ï›$§ãΖ8úFåKlÞ¸ºˆ´Kujôùá ¾YC •´·$!7"Ó!À#)·às›l½äM²×d( kâJ%Ô´ù}`¯¼à”+¦=–RQçi ÏEs ›ÛÃo`"s2.‡´À€Olµt‘5ÍY“9‹LŸåòº¤pȇ3ƒÌ椬¦³!™¼¸ã%x(Š®áÇœ>Êcï©r0„%}ê5)¤UBɺçðÑýV×ÒGh¶1²Å6y…ÁèÈ Ï[p“µðõÄ8q--AŸ°ørIØÜ!My1àç“"¿–S8OX\Þ”FñÀnŠêc ÌTR5]7€Ò8š~?7ØÏUTQÜynxñ5d B]¸©¨¢$àÕˆÉîÝi$¯r$† ˆØìA¡Ã*R¦c Ÿ šZ¨ªŸäLÇä°YÝ;L ¥LR˜Ò K1!À­?¥Ë#sÛ™©©y­ËBöO¸/+/%úœ)ô*øÖ$ºžÑÁgl¦¢(³; Ôè>^ Û}Ö7s‰‹1ðLòÚ Õ“Ü1/°ùLÞ{@š’Æé‘/` ü­§_r¸+pbM™\tí Ék#T•M9’§èÒžî;tXØñ ìUJÅYYÙs |¿ÀäK7Y“¬5Ù3˜üy†¤a=yÕCAëSȘ¸[ŠŠ*ÂnÅÈ\ÊWÛ,”¸°d‘AÌ(À4º¼¨Žª„å'ÈË ‰OÙbÚ©Ë‘Þwœ:§9øšœºoh÷â²Gð°oÉ©iìök€ïÄ´¶‘<‘ƈ´zŒ‘©ªÒìàñåbàÞèa@Xç{IYYEÄöü˜Ù(~PSÞ°ÆÃ/ÏqžIS‘ÑØ÷ ‰¯Åäì4;¥¤%ce8 p4ýÞ4Âñ–öÊg™ò–¿ýíúôn]MÃKôý;OI똋s°ŽÙ§{HAËvCâ<&·Cðä)9]_ }[aëؽÇN+ªŸØTC™a(¦«¸ð}ÖŸBj¥6ˆêé(hŸÜwÂCZ뀔Y6}æ<&¥NLW[N×FÐ*BâˆÏ™<9M }îØ>.¯ Š*ºâ'‚8 ŒÐ÷† y²_ì<íªpÀp¯E¬ ©»¼ÆQAÏ_°È܆7ŽÄÀ)8Ü»»vÁQ‰Ó×é(o6_\KÒ¹O]JÒ­“;´ûÄ)%uýýV·€‡Ï~&IIIYÚ(œ'¬éü'RZ&|–A’z§\nJ8 ~:sM6™Ý㬒ª¦Ô1oÑc抪G¶5Ó¦FÑ#ÓãלËUPÒÚÒŠÉÞhë© ïÇ™D~_š¹b%g˜×ÖKñ€?kúä²åóצwÕS8‘ :pXYYSÒä[Ü+ºÄGÒJròGÎðº_Ýaã­¨i(l»ç„•Ä©+\TT vû•2BsäUÕeõEN8Ë©jîu{DOFh §^!c/=ÐR³þ‹.çAŽ¦w<óåf·Ä]]KfÜ-¼F犰íL)½» ù½‹X¢~à·‰°ÏæˆCÞ1”Õ.dl$eþ=c\Ñ.›óB¶©ÜQÔ5zÙƒ[ÝâwœmÇ nðËÝTAyç&«—Ç=UÈ*j§Ï ”86|¹UÙN»(aëDîè0tMÐ&~cì0&íÿÚ; ð8®kñ§Ék_Ûßk_õµÿbŠ‰I¬­˜Ábffff­¤eÙ–d™Q2IkW,[2Û1ÇŽc¶xçgfWZ“´;=ç;Ÿ>i5;sçÂoÎœ{î¹þWhùï|˜ïVÍ¿“¿í7A;ñmÑð ¯ç?JÚþ¯ìßúTþ$ç2qEüäßÊkøÿÞ·ùò¶|¡åÂ,*]Z¦”beþÝôæ?:Uÿëßœ ë+¸RU¯Û7–Z„¯¸}¾RÍûf.µõÒa¢5.RT_©J9Šn.8è˾v'eŠbÞíŒ+¿µÖÿCÐ ù]z¿f]|ÏÚßm\ÞÎ}É~7«·ûY“ E9¡Ê:)M–RÞ­Ü«eUZÞšä'ÜU‹è•>Y•œ»&½Þªä*¼5‰PV$Á[“ fUü›|»±…oV\ü~ÙÝš¯¹ …·^¥qW}Ž}jó­ú|½žÀ[S¥¼73%/ô«Ê…ò)Ê~òýô#?,¸µ&}Êã¦ýIÆeÈ;ô¹T9úýõ8´þõøª=þÖ~/¹Ÿ“Þk“òÀAà ¯àʯ´üÏï–”­—Hêó±kÕj¾’à €Þo)Cxö»Å’ßÿA )çÙwJ†¿Wv÷x2UÙßà=Xö0Ï~§dô‡ãïpa>  €¯‰Bá½|kå Dîƒ_;Úmvê B,^2µj*uåçÞïùÂÓñU]ùŸ]òm”§ÀVL#*.{§òê„–mÒQÑÛ`ðCØ6  €¯›ÌªN‘{¿ŽÐ¥€@2NDƒ-¾Ízükn™·KÇ×.íò  $ÃÉxso³ž¼ÃšÁsªìÒÚâùÎÅ¿„KBˆ ²:ÂO"$r’>ýæ/\¢ÿä^ù+§ MͭߪÀAàð8AKÚ©÷-]~;ô?>ÉÌ7™ýø½¼‰ŸF©i[þoΓ·øþdm£©ëû«Ð}ßÏ;óNå•_:ÙüÅgß¿T|ô³ÀP-u—Þ}›~õ—Žž]Øï0Ic~úÇÑ…›¬Ò¿Ë¾™uè=Ǹÿ(Z”ç‚&VÐü4 €À×·À«ÚTôt>pÉ—Xò.üÎÊúOþû]îf¢aø=¹ãúãßÛèá¯Ç¾YÜû¾>õS§äñ!ìg¿²3ýÀIü–ðúŸllÕÌ“¾IB€yQžÌŠ‹}?6I[=è[Ä^‡ßN¦ièù¯â ¾Pˆuû¦ïµÉ‹$PZ€ƒÀA?ດßKåMÿÜÑs‹›èœÅŸ»«Zp“{%ÀßÍjÞ¢çøï…·ˆÀBðéÿò‰ÜbñmÖÍ?Y[lpl–.œƒý` àøççÿDÕûCܹ·²o–ß cñ³ì뫹 €ÀAà Ÿðß…Uìê>ó?Î^j.|à®Æj6MŠ¬÷—þ½Œ=×+º#dOÿÌ7FÕ:é]Æ­?Z›mp9ô`?ó ¡èçþ‹û~p¨ªEêw˜+£àpP8èçøN‘!ˆ™÷ÿŸ½ÓFφopeÀ×üÛ¹‡6ëZý4ïñùâ[œ¹ÿq÷ÚlSøMîÍ?Y™op9¸ÀcµÕC€“ûäîRW×üyæÕßZÿ1d@ž1‰ Dy© eÝ•A pPø?5À·èëjEã‰òê±·KOmÐ¥ü:ª—˜Ä4V]øÇ¿·ÑW·ÃþvåäïÍ©ño“ÇÒ‡7PTÿ6ô–ð*p% ÜÏŽþýØ$ŠŠç¿6(RÕ‰ÿÆØ@ÅØ[EßãÇtùÏ·«nü [ú¯tÙrþºØC²45¿S»߸ô€ƒÀà˸¾þûv9˜ºÿÅ.`‹EÅ"íÝò‡è_¿pT×2¯•ûÀ9÷þ`¶™bqÕæ.|/uç†[Ìüþlë­B1|ß•‰oOÏzß„²Åaàç~mGýÀ­ñ6ö­ìê*Ô2ôýEL'éy'5[{ËÆMî‡äæ·{7ºBKåÏ¿ÊÄ7&ûVQß{6N*TK MÝÍU7°R1°ý‘ÇÞæc°Ñ-_áœz›vé‡=?Ìÿý9éÇø×"é n+R Ì~7ýy_¾›!oñ_*®ÿ «ÿG™}ß+¼ò6›<æÙ»yCß/úH~~Îóo¿[rߣ–3óüÁe~§üm›ôþ+ÿã·»0¼M»öì¾oÓñ½¾Að½\É2ú”Õÿìeö£ß¿Sö¸Pà pøj€GL{;.e¬R£œHJ9™Wñ_ùnõkŽYÁØ•i©8 o e?u4W·ÌøŽÒ’ÌU—à¯QÙkà p¸†Èœ®<¢®µå=2 å•Z¶rò?üQJËoœ|5t]þ3KaÏ4à pпÕG?g~Xú³¬Û¯|¯FyBªËý½géO î)¼1Ð:pP8èßpžÒ¶˜Â/…¥\Ùò“@o8(ôq¡ðVåŒ}õ.ÞÊ”³Àp8(ôï³ÀAAàp8 €ƒÀAà pP8€ƒÀàpP8( €ÀAàp8 €ƒÀAà pP8(€ƒÀAàp8( €ƒÀà p¨8 €ƒÀAà p8€ÀAà pP8( €ÀàpP8(€ƒÀAà pЯàG°·èØ[Ð/Q˜íQ¬÷ö]6ÔèJebF°7±ÿ«…Úxãõ]Ö~ëÕÜý$ö]!öÓzì§u _’~OŒyŸÂ†îaÿQ5ºB ÆìÚ°îÛØŸ›±Ÿ@…¼áú۰àf°û/°«q’ƒ~iŠ*üîslz»5º¦oÜyŽ½˜Ãn<îñÆë‡O°g³˜Löªþd;|«ìÃX _žV÷aG/`wžbL¨ ЕJïÃöOa7c5ÃÐ=ÞxåIñ¦|u‚ŽHÂ@ýò ÌÖ‹ØݧW µºBYìÀ9|Ô×@÷xãU8„Ý~ÿÚœ#€ÀAà ð¿Yeä/\)ù‹ìËìuøE‡0þ0y]Ùê¤2î þ_þ¶Î¿.G·öåt®¢n—êymÍó¼êÊ'Ï¿ÔÐ\²Š_^y½)U ì+gæú'K8¤¸E ËûÿÐKïQþ¡TQ-J7Hþ‹ü¯ºay.}¸N³þݪTHî2HÿY®è¢ ôûâ—Ýÿ¥³ãfië=Ždýø’é²#WÊO¾@]ˆ'ýºœK<¶ø£˜`„¤Ð—Ûÿû•ºVÝ=·þ0—ʘJŽÜaö--õjÞÿ¸dÿ¥²cOù#ËàÌV¾\Ù³È'¡·¦óà@“,òF0Ñ8†~y,Þ—ZàC •­× Üâ ÐIä)Ô«™Ç?,9öàSš^ixÊ”Ÿø¿Ð½#´Jfim7J\,>x¥ìØÇœaL0$ã(žƒ_ÄãuÑ~³´íc¶ä%OÉLùÑ+e'^ð_§Aúf\ö²çø’®éÄ'W¼Ã«iè1:(SØ3òŸ/µ ”N»îŸÊEz©u1Šådo2L¢õ®}‚˸CXm×€žæï CûD“Øú&úË ðRËö¶LÖø§ÜæºÿÂ?A_—.dó'Õ s—l§¥ú_]þµ7«üµî%>¥æEù›?ØÄ»Ž›…kãKg3«‹7iz¥í{ˆX}žÏhzÙSmùîzãè^÷~K1ÍêÀ„ŠË±N_µ¦üÁkÛ³º1¼fÖ´&Q?£X¥€é™qœwfÙnÝŽn¹öÌ}Ï­¶ÿøg'æ­Ú Œ#Á[_xK 4ÒôcñÖ3Âå5†ÝqÁ'š[60/7·äf9^Ã̶^G MµÍZzÆÍ-ªjSç̼nD¥ÃÖô“u/Ä]ÿ•óqb‚™–mvi‡l…RQ÷YªÖ¯ôûk/þmýä%ו}Á¯oÀ‘ÝÂê›ãJÙ½/˜=/ØýóD]-’íÈAÿí}Áê™f,.a„¶óEÅ¥Ù0ýór¤ËB30ÇÂO5­82{Ø}3è ŠY`õN./† ìÞitiVßìR“±û¦Yý‹ˆW¬žçÌžù¹„èº9dñúgXøç»|>ÐM¡óÈϬè’yôáraäe[ ûg©ð Ëï€ÒWðyTèm¯±žç¬^Åm’–(<“¼;y‹,rzî‡D§ûäï«î#k›·Â- ø :•DŽt¼Šúæ—¾òO o_üxÔXŠû•ÌW”­¸:iM )¡•lµ^²c(F1`9$xñ›zA°@Ô<ÑÜèþYEÙеPïšáÊýŠÆ" ¿|Nézo=@y_E—jì’ØÄ&ÞM1öékvÔ>;H€ËVtE¼}‰ÍÈ|Œ•¡5Ž‘Åx]þ±—««®®Žú‹´ÓÈHÆïHxK³¢óå=ݵrwU˜4•ûô4½s;sˆ¸ä“ñ6zOkkA¹«ŸÂjÏcô]ûL¨š¦6zœáí>K¼˜•/Y`)Æìò@Û†³èÒ¨#Í¡)¸±€F¾•‘=AÆ]3Hå¾ eËr?_¤Ê½ïöýˆQó¢l\E§U RÙ2Hß@€“~6Yes³_NSFmWd‘((µ ý^xì1þœ¯:<ÏòK­öK¡—ì/:ñDxcìj÷ ÔP1óÊ'm›ä /=ñÊì¸_"ðM¦ù%–úeoÏ9p5Võ± !Ù¢œIŸ»ýbPze⎇Â1Œ7ð$›×⇎O­òMaĉ‡}‹‚ÁñÅe~´©üšÝÁÙlÿz$³‡>€¿–׋ü ŽÒû1ÁðBùÞþ°Ì ŸÄrßdfòöó,ôæØw=4«<œû¡ áéüºC©•þ©•>Iô8ñ“à?ÿôÙÐ̪¤·åƒ¥ûF| 'yûeÔÇ.Ä0}’h~Iå¹ù­8_„Ãy-ÀIK ™"i´Äºó)Õ;B²Ù~©ŒXÁ³Ÿ@ÍÀÓ\ñÀ”2T3¾)œÄúó\Tu’¹•tSs+s÷Ø€ÂZÏü²ù!Eò¢°þ(:¡_ ªÉê(Vge× Ëç0<óz㾆2ÙB¯|)ú¸úØdtÇ7¥5–þÎü#÷QU,Ø›»½3²HŒW~?cÏmÞ8&hðK¡gí{ˆJÎéyÁiöO*õŠ+ *9TÚñB0¸Pº«Ý7kgɉ¼Œuòb\1¯ÉdZPÑž‚¶Oðg«t‘¶ó oæŽâcsøë3:lw‹Grmi;~kùµ‡ðƪòMªˆb÷V÷.,»g×ø~íMNñ,º±¹{RË]Üæ'n°¼v ?†u uE¼ ¨æ6徿ÁU3L ôô̓‚+wÊ_µ'öSî¾ÕÕ+ëj«Mõæ3‰·à–$Àyƒ ôc“±Å|tw~ÉåA…»ó[¢áÉ<<¨¡nîžÊŽm8§˜À™Y+íÒþÃf/ÎTÔÜ'žÂ 8ûb8'éŒ~t80«¡øø²GÑO\ Éâ¦ï~$šX(kéͬôM©òK® -?RÚþŒ?†U7Ö¹§ï+ÞÙ–Ë L­ÌÛY|ò)þj&.ו¯ê‘ †Ë÷ô†¥—y'”ú¦rS›.±QGíû(,«$”}•–Ûÿ4O¼o÷4ÔîÌøÚq†=­æÒ™Bï‚AÔC¿è³lþÿ¢Žê¼KУAÊBÍê›X·³àØ'<©ì5™ÿý²-pà‹¥¬à¿~ ï^Ë=™Îo²¦ª˜„ÔrFÑqv²5ñHŠ¨h‰.åÛÛÛû”—öbÜc“a‰j[¬ÃxÇr÷]'ßæäPžKˆw7° )mŠ©¨ñòµ§X%–uËh{NQ m#Å×£D§=Ò¡KQs+¹Qw +b”ê›»ûåˆb*›B’“M¬Ý£D焃O\µU¨ñÌ$ñ©˜œ}Š'ý,ËͳU·Ì¬ÀÚ-M̬C‹ÂKêüc L]¢®×ö l0’Š& kêŒM,]Y±ô¡iY:ú¾Œ³¢³˜°õ°¡†GñÜö!'C¯¢n®t:ÐÛRß5#¢¢1¦¬ÆÙm«¡/· ٯ…‚Ô0V×Ù¦§£¦oë—ßœV{24.JÇ`kÒΨTù¦.…ê”,Œ£ï Š¥P,‚ëî‹FçŠÅÛ­­ÍmBJâ…=Õ¤·™¨yT3Œí5†¨’¹1•Íᙹ¦fV¾¥§9cXB$eƒO4Et°á¹Ðpë hìpz8™¸Æ‡•7G— Ü=­ô²iXqC3ÕPßtk|XÕÁ4ÁaŸ/=›è¬“Xmk­ººV¨ðO:Ÿ^^j`ìè•)Œ,bÙ[ëR½Øˆ09Lšš~pƧâÑ›>®–zvaaeÍqâ­v†^å´ÎÞà|AUŠª¾Oêži›¨Ìì÷U·æ´båÛ÷Xغ¸§°£+›Ã²Š,¬­½Ë$ÄSæ%.ð÷­r:Ÿ„…zš‡*ûq/|Þñ÷qÒßRÒK«qqw5rË-iŸ.«o65Ò¥Ú$%íVôÈøƒ_qìǧÜÞÞ%·ƒ¹·…ª©$¼&B7¥pVû%o/'C‡ÐÒæØŠG{ ½­i]ïôõÈäH U«`úÞ¬½7ùC kmìf²YÇ1)­ù"³_†þÅÁDg0dG!ΗíhÖ¡º§ï½KÏ´}§ ¨&A¼„ÇÛ- l"ª¢hÍ‘ù•ÖÖ–vñÍÕ#XEµ×_7ÙzgDqÚR9MöV†Æaœ!Ü…’œj¯ë\TÞ…ž&æTªUXYDI_x˜™ORËQÏ9Sê_ŒÂ¥õ—s˜t#S;÷NlõΔLC}“@Ö„xt6(Øj“õvÁ^'‚þ#â}4í*ËOÏñ†æBý­ \R#*šbÊD.®VúÞ\æ?­ …x9/f³–cBÓ ñ&¾ˆ•:mÔ¥ Ȳ*+)&éGž‰&ðIZS³Ž–qkõ¢Q‰êF¯ŠIL,ŸM“ÿä<õÐþµmÎÉú±×0QÏÅ8f{e÷mïi —˜º› €w!Dx–ßÜv ‹ °Ñt-åMa×°Ú‰ùüíy?>öð1ÓÒqÍëÇjÎ`ucüü\u¬rªF°ü"Š}aµKHÕr(¤I°š Œ/}“C‹à {ÆÍÌ4-ã‡DcƒÜô-"ê˜Cxák&±¸x'mótÚ8&>ÖjjFõ.ŸT|ÄÍÕÊ·LÂé½i­öK«òkÍw°íW0NÇåDž”¿„þ£Ï÷—¼»ÝÐP×4€Ã™ Æщv+K#ÿêQ®ô©§Ífð=¨ZÄg°ÚÑGžnfšæÅŒ³¿ÿ†¯¯»wéiþ¸üŠ¬yÑ9,;Ö[•ê^؇5]G/ȲâæîÌæ+ÜQ,)ÎDÅF,š$>í¬j׈Î>}ÑAëÏžô1Ô Û¯b‚ÓgãX§«û°’{´6zЇÑ%P{1ŽöëR½+$ÂãÍ]£ñ-NÏmkŠS~Ÿp«9Uï9è\^Ô»˜Çej›Dg_¨b¥«¨ÅìzZ7…ÕLaÌ=M:ê†Q;ï†æ YZ¦!é{gÈ2Ãܘ-:žyÇdY%yº61å¼ÔÇÊZºÒ¯r‡±õpàZï[æöa•MŒŒ,Øg9C €oÖp£ñʵ´Íãw?¬=‹×-ãp»Õ4Xx¾vüGkª¹ï6Ñù ÎkëBq·wpN?ˆ¬ÐäôpŠuBÞ)¬ö²àƒX¡°^Wß6zÇGâ³Rö½UMïR)ê Eb®–šW1‚ó𲜰¯0ÚÎCÎ.zT3c[Lj¢ðŠƒ9û;‚yyÓ3ÿŒ}÷H€Wè66³ «}XÉ,ÓÔÔŽÞ5ßÀðŠ=0œR3ž×4NèÆtBšÕ£^:… j­ÓN/"ë+5ÓÍГ†¬¬ÄXuÛbDûZ¼ë~™^»ýª ç‚¥¹šYìˆxð’çV›„]¬!LˆæÄlLŒ Õµ„. ‹tRßÚ¬øƒ¨ä]gVEçè¾ÊÿÙÓ.4ßÆ;-÷Ôdè©eî]ÔGrH¯ØhÚÒ§Ä# k¾YÇ#· «Ü}ÌÂÌÐÀÒÅ5‰Ÿµÿãš‹ò©Éõ+_ðœ^¬fôyLl„®MTqû,»ƒøó—P‡‰Ò¶+éš'm3NׇNVV…½¢¡»VTsïZÞ¹åéƒ×àчŒãgíMõ¶¦ïeŸÇ2€s¥‹)…9zvÑ984P¿ܲ£hØ%oãžÁ øLM5Ï‚þ9¾üýEaBÎ,ÐÛïíKeíò ×ÕRÑ5¶qÏëL­ðþGµ’3vjZÆ[íÂJ’¶Ÿç#3oCw;hƒº_1꓃ø£¡jÿ)#Õ ž-s5ÃOR2ݨžÕÕ<-uM³O‹Fˆ9r–­_&ê9n;Ì>)1×Ñ d÷³åS< B–žy`nû‹ðhgµÕgVàøbtŒ›ª†‘M@Z$GÂC¯Kñ6²R€óâ4M#òZgp€ãß„Þý<*!Ü$Œ_Ù/﬎‹[ µsw±Æä/C¯Hý–Z7oÚ¨²á¦ulÔRýÏr;ݽ ô6¿¯îVØZ‡ø²~”xÅMd]£w·Êý}>¡a¦VÖZj*F®yÇž‹†žxxèj»áÇ|R㵌ìsºe$À{ï{9Y[tòñyyÏG ¬Qœß?n¢¦ãOïæ(\ôÅõõ::F1'±ú“뼇-AÏŽ¹,ºÐÁÕJÕSS7ô­ÀC¡$2Þ öÊNqÍÁ«eXpÚ·«Oï/üš>©!¢)lS’4)ú)˜ Wpþ$î¿eÓFÕͨiÚD‰Î¡1Å`fã@ÑPÕ±ŒJßw à5ë\"ãô=L§ ì]=¨TÊ–(>4 o+ÞÖ¤g˜qà9eÉ:ý¡›Õ.³™y˜øGÌãmújFÑ{É>òåKJ<¦ ýiˆ—;Å2¨T‚]T0xÇÙDݬt¼ft Ày8À³, ·xúáÑÀØxsTx­-:‘™‡Ÿ†_BW%€£2º$6¦úŽÅn÷‡$À/-F†‡ëÚÅ”uÍså3·½Ý­M²:Öüµ¶À €ógò9å:n™­Ï2­I€'æ¦lM*è#ñлÒWªºU‚3Ž€,|9·?BÎU¡Z]ä /%w|]­5 ]2Ñ3´eï:çÞD/à|ɽجê½Õ»L4þä¼}¦nTpzÿgc=«¢ô,æý„G¸âbë5Ö¦†ð¥lùäøBA­XÏÌ+óسˆ—;Ï3éWÔiU6ø3G¾ò§ðëð²žÙÄŒ}ZY7FtóĈ9EÏ«øzß_8¯çqAÓ`vãPöiÁþÛÔ+†æù£˜h cõ<Ígª¾¯»çãê]&æ.ѵr€3´èëz!€ŸE5?‡Ž‡­J¦Ëvwnµ3sÎ:È“>ñð¢j[29çñBÖL.FEDh{ xQuÿ‹`{ƒ„Ãr7¸ä[*[¸`𪃞†Gé Χq0§é ­ý*<²™…˜`h¡òР»‡y £Z‚%ū؈„¤|h64ÜAp)ÞX‚1L4Š1;fÑRU7™¤~VÖ¸[_Ï>q÷ 2T€yꂱ¡KÞN+ ð;¬öa3Šv`ý-ñ(iüÌsžr%3Ù„ž×>—î£aâšß…£“ú'­tµœ8Äà …ô,M“àô½Ó8À'0ZEð=¯œ# ‚á²ð|éLÅ¡I_¯*ôêÍ\oÅÀƒ¸5XÀ®ÔPµŒÝÃÉt3øöKXZrŒ¶e@qÇÑÉ1öéK®–ö¥ýr€ûY8Üëp¼„}7üm3'…YS‚Àeé¥Ez6a™í |ðŠ…¦æÖ´fîY…Ž¾‰‡w0zëd2ï2ÉÈZåJ0î&lÉݤb–°óAå®ý¦~éû>Â.‘ÑövY…po‰Æeˆd?¡;é¯k]xzžÆ Þ¨â^Ѓ=h»èoV Ø· °À«ª¦ýíõô“ÚÐñkI9’çˆäK8§}ÄÚ€âGïaÉ} óyœr]ó°‚ÓÓQÎêöMÈÚÇ'1{ïGÄà.p©b"Ât=L-NÛòuf7Þ ^†¿…ãïà x"}Ïø—Yý³ˆÆ¹¬*M}ÇØÚkèͽ_¤ºÑ)§#D5®hHö\K.MiºÍêŸc÷/r{$†¨ï¸Å<*µ°°¤#œrú_dWÒ´5t¼h·ë§ž&–pbùcôîlô•ž»!‘áö‰Éo3-Š]òÑgÜ^Ǥ“³•¡+‹9Žå"€TK±ŒÂT5ˆÜc÷Y½ÓÕmçݬÌbÙ]gÍÍ´pøÄ£¨`S¿ª’SÏÑ™Y=Ÿ„R ܘ¬³X]W¯•…cúqÖÀw`º¨¦ÙPC+ j˜ujÜ7ž[pì!çVÖtˆªmsøN¡Wæ§Ru\ó•náSÑL‘`o}Š§ZºÀX`Ÿœ²³7 z4pÏ!Kòš··‹KöÁêÞYÒ •/ˬâùuVw=gã¯bS’̽ *û°Œ×-z©4ܬZd›p±£¨ØìœÁ˜'ÆCÓ˜™{î±ûgÙý ìöƒ ZQ{Tì[KÕ)³ã › %à&8‹•ÇnÙ¢åK“Tw=cö¼`v?ctj«n˜s«Þßfbê]#Yd÷>ɬ®ÒT·Þ-oÜë™~ˆÖù”ó{‘^^ihâ—wršÆ Ù´AÓ‡wŽ+™GpN/NVÓð)è_HŸ¤fºzVT`Y¹¡›´# ÚQIf«Û&mŒ­sOñ» xÌHíè‡>6–aüÒ“OÑ-0Nß 02 qG±¨D?5£¼ tfÉBÕ¡Qw3]gvE×"·s" žwä61Hi{én6ˆ=¾(úgôÁlxÊfßœ£38DZ*ž÷Ÿ6x–öaÜÓ7Bc"Í]Â=â˼b²¬<=òWá/kXåî*›M‹"XýÜå(Œß3À×Ódk{l‘W|‘“—›™oYiç§ënhTˆ‘}°O/8‡ë£¡¡åZtµþâ|rn¾™½·KxŽW|‰{h¼¥[dü¶Ë¡'žFšVi>±ù¾ÉåNž¾†æ^‘;î ƱœKUÓtdE ¬ùø»:FºEå:ùYx¤d|\×;HÕù‹qÄêÆ´}Ž.žvÞ‰enÁa¦va‰{ˆðUxÓ i‰Ts7ï4vp/ )MßÄÄ»¸‡ÝuÉÃÅÉÌ#Î3¦È+®ÀÞÃÛ&\\I¯¾‚0Bðú®cÚêlÍ”üôiKsŠGqG‚•·´ÚÙÙXäø$–:ûš¹$¦¶Éð9©O¢£uMœãØÅ'g–j^8&Ë©dšYnÝ’…jÒ#"ÑÒÉ7„1€lÚîCæzVa!y ôrkõ÷Åü³ëÔ”—»«jßØb¯¸B'«­+Ù¾ËØj«ƒ_šOR…O|¾µ­­u»¸«9*VÝ¢¿ÎD¯º–6öÖ~éî©–ÖVŽéÇc²,zÙÿô}Ä“Ó±‰ Æö¾îqeÞ±Y–6®®ÙððHôwrÌÅÁÚÂ#! [”ÎôuÛ¬j—ud:ŸWceïî’éWì™níê̞NJˊu Ìbv> ­ˆÀdiÙòkÝlÂüÃ?A4ÞÔXíWÝ â³íi-2,Ç^$d¤ã]±Ä;.×ÖÙÛ)¥¹ªk^86ì©®fà”\—}ôé¥á¾N'ËS{öž³™±}Òî%ï®@ú,&>dÓ¡îà "9ïǤ¦˜;úºÅ–zÇåXÙº8§4Ò¤¸O‰¶«Õ„¢eâ›PÙGF⑯0¢ñ§qiFæ6¾ .¡é.!)ž>TÛ P–™âœÎ!~FÎ1þhr¼ÂÂÕu­ƒ¸7hÍ­¬ìlÒ¼âJ<£Ò­]¼Ü³Ó‡0doÒrr ËòI©òŽJ464w.èæQ(IÉ6”­ùe§ã¼——#uk”[TŽ£—¯…Wv^ëSQϤ±Þ¨!’ºËXiãa{/Ôi½JÝ‚Â̶Ƥìþ½×5›S©¶á´àApV™µ¾†uyYç<¯÷²‡‹£™{Œg,>HÜÝ­ÃkèÒÞ(îà"ýðÉhƱÊNbÑÍ0Æ:Ú^ÑF |k½²Eû£Êj"ËÒvL±¤òi)žäy¶ %¼¸6eÇwHîg“‡£ô}’-ÚY*Š(DzOUt‘K dÌSWRÛ#Kjâ¸í´Ž{ÉÌæÌ=Ÿ W!þà|qsGLy :>ªrWîþ[œAbÓCGÛ£•Ñ>[&Š(Ýžµ÷&~¡!Yåîý1œ^„Ddvr:o¦±#ŠEQUû Û>A ôßId4$ï¸Ã'úmõѳ‰Õ ‘%¢èêƒEÇžò—Fkÿý ^KdYm,ãHqëÍ܆CY{>D×åôÜÍàîŒ,F”ÔÄó»*»f¹ŠÕŽ_üBÔÜý×⫶gì·psºïF*·%gß-±ä¹úèDBe]D±0†ÙZzê…b婬ªu*&Ž í§uÎ)×¼wªHâ*jQá#+3Z.#8,–ì<U,ˆ¢¡“_/ln‹bsG𯰺z(£¯Ä¡ûí•¡**ÚÖ¨g‘±{¯¢Rq £µüô,þ†uúLLeSA+'<_¾·/¶\V$Jªeâ>ðyÚ¡ÁÆñŠŽiÔR|étAý¼&K·¥l;ƒj€t þVud4žVYZŸ²ã§CY¾¯¢sQ0´P¶w }^"& …CdÌ`µ¹Xè‡ïœY8Yuì® 1Å-•¤–ð ‡{±h[DEcîñYYŸ¨ ­Q¨+–Ö'ÕÑ{ɉöñ‰Ø2AdåÁ’S³¤ùµ³ÀñÖ|‘ÉÝ›Þ|q)†5«uUQlí¨|ú¦ÿI~ýÑè2qdi^Éäð”âÓ95ûQÏI¨Ÿâ + O|!À|ÙžþxêW‚ˆ"q,« ü–?éÇ/&UoCg‹ç¶—ž¸—ÂÝŸ{è¡pc›Lªn@#q ¥aœÑñ'¸NlÙ©©Œmá…‘„ÑO¬†“Δí<˜ `ôá/ø en/¢1X|ü¾£ÿA2£.iÛþ™ªÃã UhŠ£é‡ŠŽ?#)jú¹â¦Q%¢¨Šæ¬–³…»:ãxzßN÷ÝôåAÚ]Õ³ð)ËÀ¿ö¹PÈà"ѸÒRÜabbWa…û¾ÆqŽ.-è&B ˆÏ…KI9¤Ë)–¿2¦H7DtáØò‡¨WÈz~á¸ü+"rLp÷#5—Ÿ(vàvyñç$¿HžMHUÖ8¼|æ¥à\åò…(²‹(ŸP^øAŒ÷‡ ¿t%æ üÖ–Ö£‹*þÄmryáåÕ¨¸kÅçü¥õõŠµ<Ê÷‹×ØÒÔÕ(FÆ‚¢ZB7+_n”U…>)ÚÖ¤g”yèã•WW”vxe«MC¶Ô‘–RZÝs” ‰:ohéFVv²¹Ñ ;:Íô=rºdü5‰Ôðɵå8@â6†(Z®ÏUeà)å\X¯Àå·#Y‘*¬aÑèKopÉãMV…b ÈxJ«é—ëyBi„®èròA:&onžR¿’×$…¢U)Y>•"]áÓ[5H'–ÇàŠA:¸z.Ýt¹3¬:¡r§]•§ëŸÎ…²œ`eºª•}I)³ÄŠ”nÊ^»e<*Ž'£”מ‡ûòK"€»»kk¹_ ˳:¡Š‚Z+¢Ðפ4YuÅ5éÚÖü—·òùW^A2«5)J^–½dUá×i®Ò*†•_QÎ4‚}®F!캢†F]Ó2 eEÝJ_V¼U™+–ÍÈå¶^“MQ^~¥ó¯.<ùaßãò¶ÙJy–”Z[•]peO­-ÃÊZ’}ñYø¾ ʚΰª ^R™+Ÿq«‡§¼«`ëw†•µºjr׌Âx_3‚6 þ*’W¬IZòò!¿¶#½ìÖVv³W2H!øYƒÏ"ÒãÓ$ÂɯC¾²7)øV¾·Ý%¢:¿íÑW^˜åg"9*ä-”HnV½½ÊÊŸS=°) —w<,j_ôšäü|E_c¢(Ù«_YÈ]~-Z68×Íî.Oa$ÅÝà5g‰7ë,þå/_«L2Ùç¾…5¦×JCúkðÏ]iŸ5§ôr½Ly¿í*ÏÊ[{öµÈèt…7à5ɺÿ*¾¼ÀYÉ“)Ã]¸¼/œáC/uùÊ]¦Dè¾òæÊN›pˆ%å*U8Ï?{²––<ÿr¯)áÿŒa_y$É…"Uêk”÷ù2(W>9»!¯@"l{yæâï¡JþFÞ1I‡-ÕÞ0€K—ƒ …Ã3§“˜-±Õ»’„§Ë;çD#ç‹#:ëø`<çxyûoh½]0 Ä‹/ñG¿Ð‘H:Õ{?Ê®=Oß•ÀØÀÜ›ÈÞŸÀÜ~§ïLÙ~†­ìÿ©)NÎz<ÌâíŠauTt-2ŽM&³vÅñX}ÏrêŽæüh)êëp<ÊëEQKWƒ¨4ÆTi‰¬=Äï-ñ¬UDêcå^þàž)¨?S}¸¨í ·÷n†à@óPyûtiK[zãy–Æ&ôïšÄ$ ]d õLùøùšZÙxZØ;™R­cZ Gdk Ÿ1õ³z¦I1©4ŒU×kz¥ìzNDw¬žÅÏGØk:íœ[gzwí¥â»/™¯\™2WÐqÆ7ØÏÀØÊÐ̆jd¢¥©­chmdnc`dfŸØȔȔÏÆ]3•)ßGlËH Ö¦è{Tæìœô ò¤P,­Ãj«NßôðÚêG澬Nd¼7Ð…"ø$&;ÏÈÔÒÐÌõ mMMmsCs[C3C»Äâž9žr(Â{VßûVÂãèéèZ%¤ì¼ž”¨«mlá•–}àA\’‹uävzßË&Á%ýL V3µéç¨e”¾ç½óÒê¶1÷­Æ·8äôÈ…Õž!ác ýY7‰qðŒúâ)lÛelÛ¬îz)–á¹îG±í—‰oÃ?o¸Hy‹ ‡žó‡ãË%Šï^Á¶]"³u™1†ñ‡fH&ð‡ñTÿø—É«£oáQÖèxþ|× ôbŽþD¯áDŽ}<[KQ˜† ò‹*B’Ð×gUµß®î¸[¼m¯–¦Ÿø§çNÕ©[ô®'\â<¢1¬á¼Jnرtõ¹‹k¸ŽYj›GÐ91Qç¸9EÕ³ùÞ¶só\é<ø1_l…JÂÃê/u2¥Ø+êMu¡,°z>©n¿]Õq§ºã¼ö_í »Ø½÷ªÚoUw|Ì"*g«½€÷rgÃ¥þPOÜ;ê$âËXfz¬Ž…OÑ(ÖtmÁ×–jU2ÖpnŽ?´ÈCapšØPwe×]$Úî¼"ŒY8èg.¥ÄêÇ®ÚXEÖsG—cÆèÇoUœ|„Ždw^óõwö-à‘YU%/üÍm’ŸE·"“ ©ºƶáÌ¢Ó˜è,Æifè˜úå¾ìl6C§äŒý÷ÈÈÀê†rsÿÔ=Ï£˜pà^Tb¢¾®®¹gk3Š[àaÑ.:îûp  mÒ'À[‰‰³o…„G$Ëã²õìòÊ:ž…_(®o2´Liy$À÷Æ]̤ÑLM¨ÚºT3ÏÌ̃sþ4Âh{ŽQµµ‚šfk‰u¼1ŒY—©mš&>janPÙËÄØ'Îxùyêèèè9øŸ ÷c|écK5MM--m}ªŽ®žúCW—b—_ÙyÇÛß5 zÏç0ŽÑv4Z[šië›:&ï uÍ+|¼²7à2%×]Ê_ËÇkˆÄ ø= olæ_9äícgY_Ñ… ŸD%Æèéë˜;ÄÖ—ž]Àâ=uÕ5)x­éSuõ P—ÐÒÑ£9¥´ÜOL÷´‹mÄ-pônívss¢èè›ûæy(å#ú9,ð0O[5„mç«»‘E4KºÈÿ²;¯xºYxöÈ>ðÂÛbÛ×0~ÛÓÙ–bR¾'ŽÖàäd­kŸ×‰ö3µuœÜ Žä6vúø:j[E´=Â](µùjz.É»g„ÒÛî.¶zvA;B’R ôõ= Û£‹A¡–j;…ç1úÁn#UcŒæá¨ìbC?›E4#;9—EÓ4M-mF.Ã,ª­§˜ø%6=MaÙ9þ[4m|ò›ã«›½üÝ´Ls|²Þ–”mw›¶V`Ól͘|ŸMNcúÆ͆V[#ÝRëòÜçv±ÐþÀÈ==ªzdN‰Eǽè8{`®hÇ;}Š‰wr,óTLNUKÕ¾°5kÇ$£ãŠ››•Où hË+MÙô¶S+²ke¢gàͨè™{ýgÀ?=ŒpµÝ!NäM%²ù? ©¡ahŸâUœT7…ÞA|í44MüBÊvÇ–ò­Ìt}i´žEZËi/7]S§Fw2«ÙÆX×$FœYÛWÙñILœeX]ŠÑ[vkmVµÊ(©wswжŒÊ9úðk6ý¢Pð42]SžöÚ:†Tó­¶YáÕ'‹ŽÜ`‡áw_ p‹øþ‰A#Š;ß]HŒçÉÿ$£VRÑ ö³5U6;–×£wad­êµ00 Ÿç+žz`±œ_¡mè“wr¡æ &še3Î µôÙà0àçf“ã=(¶ÉEí¸w¥æ›‘•¨í˜^Õ3oÇ#Å8³U§ó‡äN¾p25 ©,ïW,#êhÕÙ ¹ûA¯ZÓ$µ¤ýþÖ00_(¬¥ú$6&lÝFçGE Æz&Á5çøëùQ׸¦cúçè µçæ‚œ,u½Jé¼rÄg°¤Ôh-§’ϸoå8ãP—±ÆŸjfëˆPTBzÇÇôÞy<¨ft9]ïëðÒ àâI,))^SÏ&ãÄþ,>‹1YºT§ôÏøv–ô‘›É&ÃÜñú3äÖx2fçCôp€ÀA?Û…‚Ðw´•ª®jÄ¡Iñ0dZן“¥æ§©mܲý¿ÿ¦¿¯…cF+ÿ,&>q5i¿ÿW›d ýè€k@qîÉçµçpGç¸ÄHË(˜3Ê?Ä×VÛH k©¹ŠÇÒwíÑÓ2‰m¾¾4‰™²¾³AO‹²íãm±ÚÉÙ„Ô0ߊª~¹\t~>»(^]ß/ëèctæmW±”'5#ÿâ.¬¨FDÑvÍîx‚¸*_ŒKôQ¡ø%µ<«9ïæ³ýÞ¶KxT[ÃÈ”‘±w‚¿0?àL(ÞÕÂI<6’y ÝÖèƒMötö°L4þi÷©©ºí`¡¯çTΚĶ]ÀŠku5­â÷ÞæÈJ›úr÷ßYwÓ×àq1šúvy=D@iç5o˺¹­ÅcË.”uNøÀcãvŽ–1Ý5Ò«n^.Úúv鮡qT=uªKf~/…¢i`ïä`K1rH¤j«ûW•w¼ ®®ï’¼ë…xl6<.\[SÝÈ9ÜÊÊHSß>‚7!ãPÔZ„ç1Nç‡þ^Æê[]c ììlµ45½ªÏ Ï`Ì#ƒö¦«¨ðòfŸ 7ckgëÈÄÆâsXj’›ŠŠš‰{¼{x¢‰±ž†eTAÛ£Õ þ\ #TžÄ\8^¢BM•-&Þ™ž¡á‘9t#==»ZIßs_ ]«(. p3me€[û” Îb¬F¾†Š*ÅÔÉÎÃG{ó›´Ã¨Ÿ ÏÎù¿oÙD®ôyÃ.Ïl  pðÃàÞeHŠðÐN=mM=Û ïØ,{ŸÀ<†­µ±sLRÛlJb„žu°àVà#ÀïGÇÚ[†×Ñ0Á©AS#}-=+÷`ªöªOEYû4ÄÀA?G2+|¢¿ûÃøR¡o|žglq@¶éÚ ùnß“ VƒGxªgê¶r –Íæ„2&“˜Xò ±Í;6Ï#¶0¬º£ZŠïJÏßËPÕ´É8ú8%vÈ (ØWÞ9§„BÖì¯TaA+¾éRÍøB¯Å'6×+…—±÷6*€`p>Îò*B¿ã–jÿ£ÔJ‘gd–wš ëÐ4Ÿ@¬‘a M+t Ë cJª:> ʪÏ=ò\8ÖðÏuÊ(Ü[Þ9Ó/l_ÍFÛdPRYê‘y!¹êvô g¢ øÄ ™;K0Œç=Þ1¹>i‚ã3âÁGñå|Xfiß\r6-‚uš=‚±O^ I*InÅwm`wß‹/a'ï¸Æ%\è¼Sc!i%±%ÑÂá§â-$&DZE5¼‘—/“|œÓx“H MìÒ9î›Tž´ý#Á(Ñ4¨}»’ •)Y^BN¦¾¯™"ÒÊÐïÄrE|5%Â&ù1¹¯Á(…¢e¼û¡ø ñ•3J»iŒàG⃗x.ÆåßU,Õ$ζ´äsHqr²0ćbGñYüÌø‡ðßÉÐrûüx¥‹òÖËš…ÎŒ_tHÆ‘ßà"ºwôÉÒfCøÆ:còK ˆ­dÈšá£û=KÜ;*íî7X: *ª¼Æ$øÙðN.g|B—Öó=²ŽòÇÞP€[¡MâÁ!ŠJ“¡gS ñ ‘.Ÿ=!Û¯[òxN{ “ã|¢‰Ø;AàßÔ¯¢Ey%OᓯÃpøb+[Y뤓]ÿ_ë¤=‘Ï~òw—¾ÿ¾nBËþкùó×æQY}€|vu½\(¼ÏØ’[o#‰Õ.”u²Ú¾4¿lÝíLû[ Ê÷.ÖçyÆzc](ƒë¤^.rÕ+Ûˆ;¸zçšmD  ôïø‘÷5l¬8Pzj*\É|Å'–^jÞ< ƒ.[m>½ DËééVnpö·op= ð –®I,ÿ†‚Àào¶NìO$>‹Õ%f6_r˜«qÇ&‡ðyâéV8>#Ç…<É­Dî­=ÕÇ]£K™ÿ!º  €¿|oeå[å&´XzßÕEGÛ½M|níÎÑëx¶Ñï‚ž‹~Ö¶±»ª{ç]Ï8ƒ+¶âRN|§t*Âló ¤h«khèÚ†³‹ · Ð €+ÛÌBbG0|‹«qüwEܾ£–Xä(D¿HŸ§±j"8—ãòoá{Š_]ŽKñS¡ó |œ%hJ¬=ËÆXûª¿oG»€‰G—7 Ã'ªÈ€â¢.méH ïHඕœxBîØŸ¶óíPW,§§ªëYaËñÌ–ÛT«„ŬÛ­æêê¦N‰ôDV“ƒ•¾]Ê^f?± ÏàBO¨kèžÑ6]Âdjk¨nŸÇãûgXý³‰I𴎨gH1vÇÝ‚Ýg+ºùDñÎ:5”˜ëoëÆbJ–¢ŽÁ‹€Àq€PSŽ“ëEã½ÝL¢8YX¸±®uë±æQú±››ž6øE¬¼ù€±¡M|ó‡ÄʧÿyXT€‘gCrÓÙÕÒØ“ÇÁ—à z/ßÍ`¹ÕIjjA´3¸SÕv˜bÞrW0(cuL9ëqGyØr˜ ùvÀ8|ÔÚÖÑÈÌ’jáUs÷'ô€ƒÀA¿€ëPÜ Ïï„hb&"ØK7„Ï‘," \Ï}ŸØ¤R,½O¼æ"V\× OuMÛw‡Ì7˜ŽM‰ÑwI.ëºåìjnzƒ'èÆ£P–žC¼â ¾ ]08h¥å³OpFV&(Ô1 În]@ö6oyý£"Ê…ÈUÎxžYÍС˜‡ñÏãO)ÌcÀAàð%€k»äâ›æàÙ*&ž†¸†‹o¬8²ÀK¶5S “÷Ü"“q¦£ãà \3h½r€s‡×x0¸@ŠÇœä3˜Z›MÓNÏDxÙZ†‰Yg”W¸àû¡3;?©l‘ȓ°;o8™mMß^=M €À—N¥ê˜ús8D¼‡¸oÊÉÎÌ!ó"óJ€+\(0úÁ^S£ö„<ìpྻ³©eD£pôCG——|ÁÞj´_ð ¾~æÖ1;éX¯\í}Š7ípîÞ«ø ÍsXf’§ªŠºžc9ã Æ'ö¬)¯Û·Õ'"~ß‚h«ØÝnenhêV¶=º”ëìá¬cš¶ÿ1ü'pP8\ySÇ%ãXt.Í-,Õ1(+‚ÓÏèŸç a)Å™nü3D¯>ŠHOuÉÂ7±Å‡|Ç­„"†[Xº[xšk-¥ùoKn†¤eû p G¿ïV|AA ­‡Ñ±Ú/Æ$ÚdE F¹C¤~@ë/[> stream xÚì½|œËu7ì$MÒ~mÞ¤ï×÷m›¶_›´¹Y¼Ì+ffYŒ–,É[FÙ–,™™f&™I¶,²Ð³,Æ3,>ó=´«Ý.%7{~¾WóÌž™ùÏ9g©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*ú铸úÛíÄw’A ¿8®ðþ‰mV–Ö¶66ë·Ÿ‘`žÇ‚Lá¼äÉ6dïR%k}lkkW1&f ¦›ó-=‚×l±£•µbJÖ¾?Nfí6·ÄümaÂ~07ñ•üÈŽ2v:-! )¶mÌþ+˜ÿù­¡ÖŠ±¶0ý8"îz~”m5…³ù_ÁÑP=ß“‚ÎW†¦V6Òb3#§Zè,½nm«–µ¹É‘œ ø›­‘L¬q² Ú| wšã!¾†»fe, "Ée}úGùÂ7ß ó™“È}|wÁÙwóçT¼âÅis;¯žù¾_'ÛÆG‚X¸JýÁÍO ͹8ÚÚ(µ¢µíÝιï©qàaŽoÛøßCâÝî\«j ¸·Á`ëóaÉxŽ½R·µZ³køù&K+å~ke±~ú[÷[QiÂJù~(ÿç‹éœ-©Rø•%9ÀrÝy«<÷²åž7Oz’ô#&ï^óUÚ·ú䎺鮼Œv@ñx¥­>É9êHqyumMÕ­#×h3Ždbå?äë@'“¥7a] ­ÒŒ5—FаBûÛˆƒºnüëZyªoîZªx#M·è4*Å(fVÊž©†·dS'4Õ\†ãuE£|Rͳâñ®ÚšÚÚºúÌ+)æ®u°Mm³ú~¡D)Ëä³Ñš›œñêü®€3…—¶Xé9ì…Ûíx°‹Ëîä憺ùjÔÔ΢Å=nî¶í"ÎÆé|––NA÷˜­+X[Wùþ9“FÍ)E>jjf ÐZ˜Ì‚aGžjjz'àÉ€@¥Eß/jjl@¨¾6ýä&mªYÚmâ]¬ DݸkE24(‰Õw¾V7_5Ɉ…kGÝ“??ÕgžÐ³üÞ”¤ï#SÉ&ëËøÄ{rˆþȤÑ#o¿“¯}]ÃG’4Ö#^›+<éj»ïW¢¿× ñ%ßSÛ²Üvó÷…Ë廈;!¤M9s’Ñ :›WY/ßJ­C|áhZÅú§wPí>6¡êZÅÐWÖ¨)û^RbâÙ¯Eå‰Ú”?;v=—÷ìü‘ýwšÑùºïFò±„„ÄÔÛ¯ÄÒ¨WÎ$ÕöN<»tlO|Ò­Œr%9&ûÜc2=:>ñf#< ‚º¼G“öK½3‚v‰òˉ×êz+_%Åï>|úÚDIê3_I«FDˆv'(¹”šÜ;-‹631†ºÎIòc«9ã‰i2&|ÈÇ6!Öî$‹9·Ãdû u3mÖê&·~.Gšn2ÍöÑö½iÃ|äц®ÁZf.ê̺L¶öYª-FêsOØ·wïôœÌ»ëݹSÏ{Û $&ÄK¾5&‚ý$¯Žï¼Z6-‹úâú¡y‹f×WzãxñqXRÖl`­6ê úñ‘ˆ{ƒ@#“œ‡Ñ!WòøèÂá¢ô”ø½‰×^ÕÀ>onœÞ¿ïYI+_ÐÒ½{÷ž¹üpÂ9ÖWöêÐþÄŸˆùñIip=E3ÝìGàqÚf-ìn"ïª0ÚÐt úKV¸éÁQŠkä·¸oéP-î¾È|zó”_ µº)¢><=beà¸yç©kOŠx@ÒiEÕÞtìJvNæÑM^$Ë(1Z‘G–¹¹÷åWÅU%™Þz:›wË'Û[ú˜©Ë¼žWÒ4*~s$€ër÷ÑÓ”½tX30Œd¬'›zÄì¿PU[s)!j®X(ÉV+­ãÏ;Ÿ;œíkEmî+4ÈÜ:Ýo`´á÷UêÐôyb¹^Î}6:ÄýÕ³Úœ~ñÆC—ôëºd›9óÍÇÎ*Úœï]J4X môc%}ÏÈÚÆÍ“H0y´¡i°ú–”2–F8Ù†»kÔÙî>ÍxžîaDÙ~½ö¬½åÆ´‹ˆ;÷ ®¾æÀzkóèó@<ÛƵÚáªÇJC'{d±Ò¢^cÍÅIÛB4uô÷'ßn,Àœ9ŽfâÍÂ’G"Î3Fÿs¯Mé•w ‹·CX.IÅ—@ïÅ’Zˆ6Âí\Mÿô~T¶1?›ÕöêX€Åú‹È6Ü¥zœƒ…U¾)›PÔ95ý¡Cà¹ÉÊ4"ÍuJ„G m’Ê&—îK¢ €F‚˜küã“_½ÎHK\¯¥>{ç«“ 7ø…ç—׿J¥®!VŒôC>®ÑiR®Õp´˜­³òYHnù°=®Öc÷ö[8†Ÿ{RX]ü’KÕõ€‡^IEöuª«Lwç+’ήÓ×ß¾}}.>PÛQêgÛéj1“ï<{zãx·­6Ë.®p²ÙßÏohnhjb þ#œä‹Q´Ñ1_Ê"ò¡Ía«5ëoöcâ@Ñ^Ï5¦‰°çó¶VqX¿ª<à¬ëÏX8¨§C{>„Œêgööï°&*?Æ`ø ä»° K_‹UˆÄ³–LÍÂ.!Ö»’·oËãoBtuG±4%úk( mÊï+÷sµ%hiÐM½.?ÎD™£µ¦ŽŽ¶–¶Œ´´ºZ0Ú 5¼¤ê™%JãM|ÂRÛù|+†6GžÖ?9âá¿/ iH~7“j6+ùÈZ‰£“¦.™JŸ'*aÇùòådýXxÖºíl¿ë¶’láir)Ñ™ÜÖYɧexØvÖµ" .KZ.o£DÄÂ;븦› ¬«×Ÿû=ÎW<ÖB¦p»H²Ov|N|† möÚaXM";ŤˆGÐDÍÓuöæºÚZ†!wßOˆ1´q%Ñh ¹zPœ’ÅrV¯Œmzd:»G¤ Ê‹¡M •®À¢žßŒT¶‰º“_kV0UWÝ>¡ÃvÂD mμÇZ¿;IûLé”<Ú Ž”êj·£e¹jiw"|¹lãpæå^Nð•Š…² I¾?ÐÈα¯>G¶¥‡ÆzDÚ–H`n i«2;%`¸@MS"ÆYåmK½™ß+úøTæŒJ¨ÐdzÎÜí¯;ïœ%‹ñ¶sãöýV®¡©˜;ÖÒÈûê,ÔQóUÛ‹E’¹V™Ñ8†Û>yÃðŸ>d‹cµXk•]OPçú MB üh›F•o$ˤWòÝÊ6£ë45RÚñ¬ù»V!šÔócV®[pÞq³ô½R cò–nLá*ÛÐ.½Å¥÷‰®·t¦ÞŒh1´U²´(ͳ µƒÑFÓꌴ*Ó¡äµñÕÐÂÂçe†òw¶ÑT7kŸÅí6éò˜l3úñ-…k<'™(L2Òö¸Õƒ¡ÍáGåâ†':f~ˆz’îoqî`M2´e› ¼/“mÐꎸPÖ\¯˜š–—mÔYý_%Ûˆgúwû[R,®ž—ÍdîGÐ涻¾ß}s],ÚžDŠ6e˜ ~¥ƒïE¡WOÀ]¥Qm¾Ìnƒ¢ ¡íA‚¦UÌD{Þ·µÛ(ÍAÓtÎöŽk;È~‹¢M0¶þ1Ýõ„Nq‚s]ýv±\7… £®–l.—ËaÄ%gcüœê-÷5†ç+öñ‡eJÃ’ˆEb„E¸ÝF·e2ÞöÌž\ÆnÀùõ4—=YpЀIÎë˜ø”lói» ü[Wf²¦Þºie´AÜ—|IvûJJ¶Hц­¯ ב#%”’ÑüUhƒdVzØà•ÒÿêØ··Ûôå_×Ös”âäÂX³8Úä"3uýëFö›¡™FÅiR¢0UJø£lµuTðYh#¥öò7ë]Í(f> Ža‘÷|à M÷>6ß¿Ýæ„­šojÖÀ÷6:©™%*¡Mk²ºãI©y°‹B`OB˜&–†Ë~]¯c˜ÜHáâš”ÈVOçEí6þcõ¨Ç› mÚ¦ý"4Í©’:«D®šÓEçԌ 9´ sä^Îm_~MêY‹¡—™Ç=9ÆX§—¢ ¨|´ÇÔë ƒå%D~ø¶hƒ ÛƒþŒ€°}SÇo‡6ÓÝ£M8dØ`Ë \mlų zVZ ùþ`i y¼9›Î ³¢'Åh¡¡xèÁF û#rh3gɤñø'–B>ÜNd8¬ÇY‘½“@p”ÌØWZ‰Ñ_/n`د¿€UB&Û ÖœáF*÷A¼†6©«Ùþò#£îL°Žçɯ”mЬ½,)û·nd|[´)|ÔÈ=Oµ9•ª¥¾ Ú€éfɤ ÕÙóV«2ŸEÓ­œ‡#ɲh3+o½ÿV¶„:â¼–ðz <ô!™¬Â˜—¶CóSšÔ€6ù4IÜÍ{Æ…»ÄÆ{«Å+¢ \¨ocšcÈÖËÏz™q Ã.bBJ€#ÓÛÁÍ/öPÊÑÝzdRrµ’x>î¡©aºëÈóΦ;› tÃ- Â=ÌéÆÁbT¶!ÙoutöK»”lÏ5tݣĆS¡f,SÇÈè@ŽS¤»£…–å– É'VÀ!ñôa•kêêìgk®GÖ÷îðp)Ú@#ÕºÚD¿{X*óh㨩kå.Gë7lïû$Ú JÜ“MÔ$r,qÙ†M¢úoˆO*ló¼©dMªð¨ÃÔùâ•‹>¶Ü»—âÕtÍ/d”|¼»¸lƒŒ¬34²îÛÆñ}GnTLôL.½ ûˆÂ­˜–îëý]Ì=£­ )žÇb·áغF*ÔcCVËè~IRgf Î/«ïu6vÜÿly» ­®À‘ R3”­ÄpQËuµh×ÚЫ]Ó½06]®#hsb“epÂ]Eý¥ÉT]ã%F›“4Ž¡¬Ôa냳>Î~mÐæª/tɆ! 2´1ñ ’¯}XxôGá§ÑFБ³Vƒ²åØ…ñaÖÛ®³eo>ÐÞQ´8ÚgÀ`°ºfDŠ÷[Q´óÈ{Þç d®›J xGîLN9éoÇ° A¦öÞ×$sË3G·ùFF©3ÙF0VgafÖ?#^(Û0)ô …~µã’ä;D´»ô7WåädW6ƒÙÎÌwˆJÓßRô¡np>ˆxªª¤ ++»¬¾]5Àz#¿§µ²8+;§ª¹oagžéoÌÍÍ©êF„Êþ¶ºÜì¬ü’ªª»ý¥©‘Ž¼ì¬wÅ•3Šq±•Ð–ÚòçwŽšÇÞ*.¯“J³…o²º6R >d¿éœšÇê¾Öúüw¹9¹y•õmb9•ácYqsßJ\›;&ÁbLæ½)@û¢à}Vv®"egL-Á6ÁTw^~­D;+rß½GCïr”RÊÍÉ©”µÚÌ`gNqÙâ $®~Ÿó¹©ÎYRS’WPþqº·4¿¼¯ÆLÇ›Ü ±,סûº”àÉe6c@Ð'wX¢¿ò*?\9íµïIi5¾}®¥âCî‚ztñ[«JŠjÛÄ;²2rƤx*NæåæÌÉm$ši_˜Ô‡J8qynnã¨@~¢é­ÌÉ)h„]ï Ûd8 k|¼¼Ü÷]°¸,çuë°H©Úurê;&&[²É~Û1"ZÜdÙÛXRÞ*ŸumIN~%6Š% Kœ“72?FŹoZÇ$‹¡7˜è®Ï†{O)2”Æ:jßfæ MffË°ª¬$·kh Ý_v’a'†iÄ¡çDdz˜woSaYã0>Ë4 âœi+~S‹®Ú@Sý¥…yYYY…¥5Ób¼Ñ'{à~\TÑ u>ù†î‡ô~Áx^nîÜ‚m^` oAóòjdá¦z›s>Tƒ‰`´¹šÛûuqQ´¹ðÉ`“=ù›owýX\fB~<’íÓŽs íËéþ®’mνv$sü´èϾGƒ ˆ—? —˜(„ ÝÌÖÉed×å†Oí•ðã¸Q=u“ž÷οÜvô´Ðº˜Õó•¶éW~ߘ'ŽÜõãöŠšG[|WhÜÎüæÌD.YÝ}Ãa!ôñGÆmðS£ôÓá ÑcÓù½`ÏS¢¨D­°„ëKurØSØpK×È¿{úŠö„$3›ƒœH,#K#ÇÜ%«M ¿Èæ…æ¡àÛÄ…þ"êøç:-þðPÕˆŸÕˆŸžÀת®¢"©è¯ ø¿ô§yx\ˆ“rЩ„¢2;ÃbZÒR-RšEü>_ÊúÌ‹OªyAE*úv$n{Í sôõõõôØ4ÃÕƒÝ †U•t—^ Ðh8™Qˆ:L¶å‹ntÙÙ-ÔîmoL%ê,¢¶‹kœðð£ü üpo+WOL¥aû‹0tè-º­M$y¤Aó{~;ÌÔµ8vAò¥ á|s¯]i°W0VÞ+.ñßmú7²^7ÁÐcoñçÔ75–z¢â“Á΄­#sô,--,ÌMIZºzF¦¥CsË€ó‘@ï~UgR‘Š>S¶v°©Ä¹ ÝeX†nò¡ŸÚÈu Es.†”ˆSϦ¥ûùzê² òɲQEñ@D¢Ä—Îô»BÛp.K‡n0>¿à×a¢m²Å›\'‹ª·r!Ú°V‘Ñf¾ð÷ö{%–È_«°P>Á<Ò¶èm8Q)fQçlø:ïc¤_’ûô >wùÐèSVf“_©[«HE}BÎL Œ6“´1pË-U ÞÑ1^»‡^n$Ð|dçY°ÚzÓ_‡2­0äæeh‡-ÐÕ´èà˜!:cH¦Ã`µaÃ`µI¯ ßó™høù±ÿÁÙ+‡60f~4ÓR»”웪x|ÜŒCspr¤¹qWñý-0Ú„Ÿ©~±…®öLVÎMÆÿ½û©Â)m¼ŽÜ“U­n¿!ð!öSþ­½†L²ƒ³“ÄŒ<úöÙdA&3Ü=¼µz©è/m Ýå|ÚV'ïØqדfP¤$gHf«ØdÝÖ …« åd›·ç¢m‘òã5g)ìà9\ºé0X¥CKáq7¶O²ä d (ܹÊäÀ<ÚˆG¼kOf¡ûOº_êhá'ÒĆT­’î mÂNVÍôQúS"Të{¬AðPÚŒ £ÍÆ„œÌ7o^¿¾õ¬…gÙ ²§PÒ’®®iZï%0bê¼m‚"âËa•l£"}=Ú\¤1hØ‘7®ž@²÷ŒiAveŠÏØ3ìÏ×(¥ áwp©„ÆaÑh#Ü ¿ö~Šo̤½G€@Ú´!§B¦¬™äûÈ&ü¯B›=YñŽ¤Ø[øµNïÎneûméioiFi£‰þ^äP'†6•šõgRÎ×#g 3’‚|¥+Õål¸‡[tT$L‚ÜÓKy)÷t¬~ø_!(ÎÂ0âq-˜Î#ªYôªúŠTô-d¶L¶é{BÔ4®šÁU§ÂX=’ï}¥¹\<œÁ Ðzçä­*óh3St\S‡big‡ÝkʦÒLöåᚊ6Hèš“]×qmV}Ú$YP©d cvÄF,ë'‡¢éúFŽŽ9»¸ìx^?6°\ò2\Ç9#³ÞRçQ“XI*‘iR¸·¤KP¯l´=%3Ùœq3r¾Z fÞ©ÐFE*úí6÷÷âg'ż ¡~;‡„< e‘}{¥žÞö°hýg'wYÐLC›…^-E4¡8;£ðôŠ(ã5_*Û¬ÛñF2ÓÆfP {‘cYU—w3öÈŠ'KdVb m$ÂQ=:±§í±ŽÑî…úϼÝ7Ï™sˆYM“vÒýãñd!™â^5ªd©è;Dô^¤5›nwbWá¤ú’)æ/j±“›³i[hTz/z°ôêVºó&>£uéT«wöüh¢©žÙän îæ¬Ô¼fyÙ-G‹ƒÆ$k.Š6åüeí6pŽù d¢%V×æ*¸«µÏ—cÇ5‡Ì èèM°2´A°"ÙMÏJŸ~ðñ" âŠkRàÕÁuD-ý8÷éÆ*Â]ô$4’Ï&k× ÁL!ùnPnT¤¢ÏD›ºkWµMÈ]hùþœÅJ,·0Ü™“ò'M½üÙqSþ}O+ÎZu m"{ûñ;ÃÓ"|Ò—ÌÜØ¢³f ë𦱞¾Ûe»Òá˜ü`„ϺýÁ–º©¿'µ€y9¢ä¸÷Ÿþø‡›J·}@¥”•«54ç‰÷^X°é÷LDÒ¸¹ƒî°¿]0Í—MòEN`Mt•†8Édº¾í£ÒN,ë3I~‡¤ç¯yét Bíø";÷ŽدÕÔ’ÞEªë}¨cGº±¶¢[}2…b`ð¾7€§FY­Q×MÈSu$©è´àÈ´ØVáy´Èñø¥öº,᯸Ëe‘-Ê‹î%^´ìrI-½Õß”(¥ãj;úÁ2 *û/VúÜ/*R‘Šþ iº¿êᵓºôÚa¾ !T¤"}4Tw/~ï¾’>±JQ‘ŠT¤"©è'F’5€…g«Á÷ü,÷ãÒ¿-tIZt±—ÎZ4/h9V|77ð(±HÉB}¢9Àg³ðì$Š¶4èS…Ê湯`JöüIQMÆ1ðVnqy03™ê‰¼ÛÞ~Çìýh©öFn ÍYb›I׋•T·Ï{\ÍZŸ3 Aüóf4ºOL%ö(©ÔÀËhŒ u§Óh =óø”gè£ ‹ Ûúk› "ÎÁÅ管¼Rx{DÅùf_v€ªuÑÝÊF§é™ØŸyT¢4(’ÖТ¿¥ªu-Ö$4­ZšrGÕÀ!ëÕqo&–Š2×—eÆbPüînd}ØúCBÊ25m¼áÂô¢`–G¦²:fDÂâÝ+“Ù÷ä’ûÌ——g*+\Ý&y‘Bªðç/m(4×$Jv,[†6¢™!Þð,Xm–º—X4ÛË‚¾m¶¿ižš‡ibbâý½ƒºTƒ’iRŠÎo!hÓÞ/èˆ_ǤÒMÛ¦§?Ø=ö’¬ãŠ˜d„-zj Ñf%Š6ÐëXc㨎¡±ÉÉɉ¦`-·WplA̤°}6˜è\éËßv³LßG¯rðÐ%=Çï®î1Ô0á!ïsi,_ê‘zñIŠïͺYØêCÿÑFèE7øZ´üñÞ‰¥Ðf%iÝw„6Ð?ÖóÖïw›¯šb ?IôÏm^±ò<@'(U’mú2ãüâsñ…åÙÞãqQÞ¾'oç*¢ R“[=¼NŽÌ'Ú_èä‡Àöù0=ØQÖÐ*ë7ãü¼?)¼¼Ñ~ý¹%úžø¸³dhî“ìí.JaZ„¡ï8qÕ,à¡rÆOût L´ŒÌ)ÀNÖNg36ÝÄqó–—RÙ‰9Û’êçååwäz6üÙVt?"î VcÞÃxWï}Ø‘³ñö í@ØêçÙ>&Æâ×fĬ÷ññ ¹™×Žs¿tp»—·÷ú¨Ýå蜰'Ä‘Ie»º{ÜGï™æ½gpìÖ»y´ xVý"-À×;j÷™Qìõ()ÚˆjÏ;E\ÆD³['öx{{†o+ÀÞÆ@ÐÆcJ2¸#ÌÏ/ ôEã^ÉÔ•CÛ½¼|6'žÃžóÄš/ëÒ>o/Ÿ¸Ógs#”Ц(Ñ݈Á°s[·ÝÙ’w{ƒ¿—¯ÈÕ× Kë\èV‡÷7ûúø¿þF²9ïnX€·_PäóJü:‚ý[|ßÕµÄoðŒ;õØwC´Dªr ëØìÃõÇ)û}}¼Ã¶îT÷`SÌ¥æ›û£¼öüí tºS1£B•¥e›#îG]/ÈÓYäX´ m:î¸SpMªÝLÜwûmyiq’7Ãiç hmÄg‚M(´x׋UTw!‚6.ÃÚySIC{O[™Umÿ»i¥Çs—FAC+ð Òx77¬äl‘qg¡jüµr 4TàYm€äªEÏmcqÓàbV ±;wíƒÚYQW®Íz‰‹kÄG­éŸFdHö1ɬ†äóÙY>R.>ò¼†p²+6vë8_m&{·ÒÂï¾oí›ÝêËÀd›áú»D]æóüÒºÚŠ½^¦–±WA¾×‡\'&…–Ö£â~„Ùú¨{LT7ú˜wýËSd¶uöûªê²?¶îŽ'M°ç>7JȱGÕ5µ…oîi¯Ñi T^%hXµu ÁXÝ¥µkõ^”UW–mv3 9þA››® ×ÄKO*++NF8°<÷/ªI]\Ïvß{§²¦¦$÷M]#¯mFu’aPð–¢²ÊwÏR¨šäFä•”¡ =Bøé'uõµ¯®&ô݆PEþuJÛ*¸¬¦®$룋‰–ÚLu×Û°³ËzÆy—¶Ò̽ +jjÊóØÚa×–jáì“cïü²ªšÊ§Â Mâ¸~{&†a»¾¨¢¶²øµ#Që䤗„¸qÌ­6<Ê-níì0Ö¢½Áýæ_Ï=WáÚ&8r÷\­ª­Ëz–J6¬@'çªë.,«s³>4Àm :³5ôyý¬ U–E›Ã°ãòzû¤ yÙF†6õ)¤ÀSØèÏ´_»õD„¢ÍÍâ¡'IfÏ)K‘Šhs»a°÷™¸ïÌYF¶ñ;~óå‹ç0={òðP¬·wÝ(šlnœ5ôò'ë2W¶G‡» h´AÒœ>“«GT[£Có‹Ø~ãQŽPjšÉOPçÄ¢Ý_rØZ+üÑ |ͦx-oÞdf¾Ž0¤Ÿ{ð"333#§B¼¬’’`HÜY2±”ñWÈDÌ¨Û €•iR\4Q}W4›ð ·ˆˆäwÈ*6eœ‰ö<õçÎØk­U€¯­¦«÷åH!q𦶎?\¯õŒÕÇópµirty@sü®š-æ%œìBŸ8‰;î$’½â0´arÅX¨ßЊæA›mÜUqÏ;°”§Ç&DpÊ}OV¯5¨”î´4¢fÔ¶ßKÐqÛ%+¤¿1ûF9–&ŒØm2—mæãMô6ÝI=äfÉá8ïÆ|6Ûû¿]_]UYUûür ×È’»Ø´ûý³ˆ¨˜˜˜h.Ý?<v…nN,Ëጠ’Ó…–Ïk…h3å«£}¨^†gƒš«ïôƒœ$c¿»`ºˆfv®ô¨]Âm ieë˜+5úì´µLì]]Pru±ÑZ­Û02/ZéS´96IgoÖ`‡/äÐF4ÑífÀ14³···15dyÇáš”÷=)¸j­ºØ¾Úô”¥;˜2Õæ»_®h’Ùm¤bkcÚËÚ±'"©úÆx±\œ¹$bÐýj8¨•šÆÃœÓã¡Êv›y´é4Y£™1Œ¯-B³Ul"±cf)+ÌÀ.?{mMM¯ðÏsJÑûPšŒ‰+G<{' ]ÎBݘ)¯Z±Ž5Ý—O§™!gqSÕ™0D7å¤QXl)™°é¶qçQ´q3𿧂—/DdHµ^Ô´ÞÓ›{Q mîoó³I¼®4ºœ9¦AG.%¹[øRÆó¯EL“‚3úpG‹nÓ'¡úÓškŒùóËÉðŸá¦êþI…ƒš­©ÎÄ é±P¯¹šîå.ù G=tW®CñÔĸìøšVùZ‚Q¢ç|4¤1œ\Ýðêê̦qʧ$_©I¡”Fµ?×ôµh3FÖÚ]!”lÕZµý€WuGÏñpﯧm´q¹Q#uÙ®ÑJj„³†Úý%Þ£µ]8I'j•òfäÐF’l­a›×ºÓ÷‘<¤hãq]Ê…{uµ[½K¯IM÷Ü8¾…ETQ7 x VbmFß‹¶ØrvA‰ìÔ×ÞéÅ…w×wi´é³VW{Ì“N8Ó%L¥kvñ…6™»ìÍmW+=zh: VÆšå VLCÝ©mx‡O[3èùýüËaŽ‘WCe[þ¶µ÷BEA›€tÚ|¹lƒPŒsSX8Ãc“<ÚŒ<Û³Z?›Á';3ˆ$Ãéy»Íh0]cÃÍŽ%í6_Ž6=ÜndêvXqÑ.,‡ÈSR!Í´›°IóVm¦r"´,OÈä€Ûè&žgÅ|™¡áîn5š'ÜYçkIzÙàüt8RýT“i= Qû¬t½o(H&‘ ƒ­y ÄcñQ+Z±ÚÀ&à×4KDBHV ñY[BØÛ‘…A$-°m.¢I½ÞÊ1ˆx…Õ¦­Ñq…õRÉx+…m`Î(â!‚C¬ÞÞÛüŽ–)¥|Âz²T -Å @8pãÆKi®’8ö±â0ñ† fƒ²~.œFLªÀ…‘C6L¯¸Ý†á€¿ÝóHc­EÇ"v›©{7Ȫ}ÔÝ"îqèºm†f έfJy'Ézö»à:ÎjíÖ›í˜çQ{®¦] R±H ÉÐæ‚6`‡“nÜuì‰pÀ{Fànã/ѽëóÒ êq‰?”M#;Á… ±&œ~ÑŽkßÃu•ÝS hƒRÝ1û‹5îÚ¹ÝÈõG‚îmši¿´zåy¹ýèCçŠhs^ˆ÷7} m6õ<¦ê |•¬Ä Þ׈eb³1ˆA£*–_Ÿí,Ô$ë˜þÎd¼$iÚ”ãUsø§˜dEc°ØÆ&\.ƒJÞÿ¬Qy1b¦˜¡cÌJ!i¶Ï›©Ãâpí ôØD-Ö‹&üŠœÖÇ»h4ÇÌ>(8ÐÊLŸJ"ï{Ñij†lúékËx’}Y :k”) $ð%rY÷¾¿O5uľŸmrál¾×C4lF¤ç*?EÍ©e³ÙÊ¿/‚6¢‰v6â²ýàž(.Iëè ì¡jþ6.‘NcŒ ÃìvÂz"‘ñµC‚VC:©~ÉQЙMÑ$ÚlÞ»#’à ŸÌE†X¼7WÏÌfwBb„·…ÈíC,ØÖºZ¶A©“×ýèLî#‡¬õÈO¦¬Õâ&]Ñ|݉á}RÏÔãࡽbðÁÇ‹Z‰S 9Ffqñ‰1ö$mZÝ°XiCØq~“-ÃÐbOb’·[—<Ž²¡éÙQmË?j»¿÷PJ¦5òvÓý#$Ç(Œå;Œt+Ÿ˜”<~c:Q‹ä›´'ÆŸA¥ó–\Ê>¡¥Kñ‰Øž°3†Å ‡ÝETÚ©òKdÒºð»bàNǸÛ2³m Ù:=&SÓêˆ]¸„}Š“ýè,îÖø¤gS-’c ÊyE´¬g«z7©B•¥ˆ?3ÖË•7†Œðºzú‡Pƒ!¯« —,…ƒ¼Þ®®î¡1|ÀôuOÌâËDã}݃ÓócO4ÝÑÍÃ"öôtÏ %RËaoX©c@CÝ#³È’ê@w÷ȬH¾$Sƒ]]½#ó[ ñè`7L=}ãÓe¨AÎFô§5ƒ˜BF ðོ´²SÛsSc}=Ý]]]=½¼‰45‰ »»K(ä·CŽ>'’|Bš›êêíâMñº‡&±µfÒ96hšŠÕ–ðS]Y³JÉB£½ÝÃÈ@`¸¿{lJˆ×[0µ{xbVVëÙ!¸\ýXÂü‰‘Î.ž—š„=]]1¾cZ47Ù‹Ô²{x|—%¡þ>Ä«—7#}5cj¤öCVä¡!¤¡»F-æu÷ô Æûz†ù³ðoÿ0~éˆDÔÕÝ W šéèE»$†¹¤ÜÓ7…-·Á=¡«_VɾÞîi¾‹<2€”¡‡7 €d;Àä0\Œ.Þð8Œvö"¦_H8¼É/TªKÃlà"]H03Ž²¤w|F–}lvrmçîÁ‘ YHþô½gt²yÝXRÒv‡z{ºysòJÙøðÆ7´K£éLòz¦dyžŒ:^<§B•¿B6÷å$Yìþ9ì´BJ ÚgMMÌYø£d¶ŸÊŽ@ªõ‹O­3ÖÞrŽ¾ñifÕOß9mqwkU­Iý5ÑÕ-–>‡Ÿÿ9”$ëÌzãi‹Ì¼Ÿ³YEàKŽÜ5¥›XX)’¥™aVãôXXÕŽâ¿Úþ ýØùº#‰*ú­þcË6*úlô+GÇ¢g„¡/ž¾¡Ïê:_9îÿœþO•”N·/Øõ-¿ûZ^XðŒ)¤4},xEþ–…e °_ò©ú¥¥ HqÂ\„ÙÄŒqàÈ´>°Õ׸W2ðiÔ^²"x߼ϴµ­XëþáU‹ð‡äÜ›3›Í‚@UêÚ4r¤@µgÔ÷0lößß0ŽÈÇ.½?X‰ØÆ/ØhŸ¬’Öé¬Úਥ©¥©KÝ•Ò7‰m32ûêS-2„‘$øX„þ È5]E7ø{ßn–”G¥ƒ‹Þ¾+ ¯ È°¶þº3+à©âalI„Bt)'c³í¹Ì¦ÅÀYqšƒ€H(\ôVhñ¸¡Å3¥xL(Í®È>|¡D²hÊËJkKxÊï.–Ë)Ò=?îƒúÁE+»ôÐ …¢Åù²¸j¶lÊX9Ü -!B¼Œ¶NÍn‹ß®³d1úKÓM=N)þ2@$—J@I¼¡Ïã~ ù O¤µ Ëfe%œ6¦jDÛ¦íU Ù.K.Í߀D4}^ÍC±º{› ƒÉ¶žAÖÔ@J´—Ç[Xê}ïÓéܾ±|}§y FÌ;7=üþE…œ%›r)òtAaªôú^÷èT0ÒDaðÑ=6wxﺒc…½¦.ƒÎ¼ÒÊ—eŸh±êx ‚W]i6çj±DÊïîÕ%±>Ä6Dñ/oq"hQrz‘ͦökuS¤«ñû|mÌ£ÎýTÂáw7è.ƒÉ221ƒemàZÍ %Eú;ln™‚ÛwpÓðz„E<3`nn–Û‡½ø-ØbFOïGÑ&ðYÁõ$ S#×õ{x(BW_ó²Í©H°c1\}ÈÊÂpíSos8å »“§ÑWãÚ³¯¹oÀdW;ã¢6dí¸)ûŠ‹µ‰‰©ù–£·ñvŸíˆó042²÷Šx?(í-ÍqÁn†&Á;Ï¢ÃuÖÑBŸAgé±8¯jæiüð=âÕ[zßÃÎÌØÄ42ñ"ZR:=iròyGêVCãà]оm4M˨ßìjŒì„á·f¹Xš„í½ˆ­z¾ÛlÈf0ô .fßu/SÌ MLmÝ*^Nn¹K²Ø„œG»é㸿2%ÖC?ò â?Õândb¾å8þV`EÊVðӋÌc·º™XÄ{*Ë(ëê>kC3+狯ñC‹AnF-'c<ôô7îC6‡—ï±ÁZÇóºAH2—¶;ÌnwÿÍ“"$éþºe°„ÿ1ÐÑÔÐÈ*-ÙÖ7RpƒÎæ2X\s{‘„çdÄzßË¢H †­ÚÓá¹c@ü¢ãwóDŒy¸lR^m„¼' ’ný°hž?’©]á;Z&EòhÃûp‘NguM‰”ô¹¡ "# î N­ˆÔ$9â@‹IWÏ%í/iÖ‘ü‘bW #SÇÇõ£2êÈ»âlalbëý¶ ݘÑö€æ´«¿êš…#Ö ¯/&Y›Y:ødÔŽ`tƒýaäh|ã½$·Í7Àx«6ÕP„¢Mˆµî³VäÌ©:»¨ñe>)Ä+µÚ@MfêkçËÏ7%¾ªî•G›ÓAvœ3⟄ùO"à—¿Ha[zŽ Id²¤Ý¤»ëA¯¿¿­Ü!º´ôôÂÈ<îâRœ9aH7õ­éHógmCΫ&…rÍ7µvóF…¢ÞGtmJNMGÿÃÃátçXÆûõ˜× 'f¡7©1»õ}<^OÛVS’óÑ’%›áãµo˜ë‘WoÒ=ÆëÒ‹ë»&¤ÉJ›x6»©§§ózŒ¡ÿe¸ËufßÝwåµ²`óA“x)¿¹·§ó|×,ô6\õ³Q®æaGzûûy]u Ð]pP;ÇaKóÀèÄ8o·™Fà^áÔX µÞÉ'ïáÖ`t=‡z>¿n÷²;L³lîø:´u›¯ ŽŒôW™5sÛ…H”q>ÔÂíÀð<Ç'Å·"M‘M7BdôÁh³ÖiÌ2Õçâ'a¢MÙnC]§+âë?2BÐæà½ñÊ» –aí°,xŠ¦!2…BtÄC/Nî¹Uªx¶û…†.Õc뭡ѱÁ®2} 9œ@å“},cïÖ®îÎæ2’Q? zÓ5ˆúaÛ/uw÷À<<îgcµå|Oÿ@_K¡®ÖÙJdcŇkÇO¾@u RO¸Èrô¶4&ÑÅŽ!5zœv¥¸.KÈ6ÃÏ÷­d….z­†6©àN¬3ÍózÀOÄÔÝQpmí'§I ·=9FpØ(«~¤­Ñî§5…ɱ^q×àÏâ½Ægëêè&‰0£šnÆ[ÆœB5)¦A~FXTÉø†’?‡£ œÄFƒÔ·HõÝÖ1tîÅÕkhŽ/T¸¨G›©†KÛHŽÑR£€„h|7úÚsy}˜×ìÔ ÜµÞívæì|"M@`§K{;"¼[:Z^ ¯vBÑf°ëå]sŸa©F¡%ÑF?$ñ>ÞÌ#O©Zf0Ôî‹0 ?ø›ãîùÒÍUà\5³WQ^#WYˆÖé1¡—là¬<^0÷“¾›$MëAÉ'ЦåË0 Sê.n¡ÄGŸh8ïÝ{éIe©üD=" )æäÀ’ù„ Mím»Ë÷þ(“ãsÝÓŽy‘sÏÊ+Žúþ`W˜­þ…D“âÝ"XxÉ’=h³Œªi4Hû»=íZn7ì(¹iåyJa5@©R(ÚÀ`ÔWtYKoh Ùæ†;ÕtéR3%ÚÛÒÃ]_{•ž]ØçÒ/LÏ‹Õ5R])ÎÉ,ö.ŒüÐ.ãÕqYøkÓÍï jûÆAßÃÕj†õX‹z¹TN鉈úç»M],©kC`èA¸I"¶ïA›j¸±ml2¥Œ7»(ÚT¤Ä’Ö%,¥s8hèúÄ­ÕÔ Ø¦·ërê%ŒbѶ¾“ik“Ä5êäѦÛlµæ³!©©KXÇÕÕnšú$Úx²=ob rw÷z‡Ý>§/nôp?š®(³V³ÕIµÓxîãíoèlý9xÚÒoâ×-ÖÞr3ð»#6åQ˜,)?MaÇnß0^¸†h#;ZîçÀ¸’Ý)‡6K“m`º°žëšøvQ´yÊ …e,µ¶£ Û> qh꘿¡Yع¯\—éy±Šì*;µy9ÈÎîl&b]QÓ¸Þ«ˆK½W’<° :Ðd›F…5nŒ ¸ Š¡Ë2öÏ$£k…]¨G¸¤e炨èY¿…hÓv#n­ÅÖEìoè!a · A³ YótV;ø©¬ã/@›‘¢Kñú;e-ÔÝÒû2¬¨Ž{8 #íd=gØ÷˜“~fûh0›X0)µ»_‘ν<›µê÷E©l[W”°ÑUÃi'qÓP?Û*6ƒŽšknwÜœ<÷ž¥Mn›ý ´ñº±ñÕþ0Ó­g'ôÅ{܃­>V‰7C¶ji–á¹4?b°ÌøŠhS³mê_žå¸nX°ÂW°†h­€692´9ý9h—A8ÚÈ 1*'§iÊh3^´‹¢k5"RX®ÏxÔ)µÛxD J‚W}RÄ¥÷_80ÚìǤ<éiíy>ž |uלþ¨øè!Œ6dO¬• ™J:þ9ËèìcÎ$!§?!9Ùý6#žÎë´ ašTú¶ æ*y-éUóäOohRƒüê{j'é´Í·3¢Üý€Ü ys»ñúÓi&Ãì¼}ñ(Ã4—3o¸2ÖØÅ â7×jÙñÀ<ÚD8œC5©®ò'ç5Jçß*¦ša»ˆ…ü‰Ééy´i™®xuù‰tPˆGÞR ŽÓÓmGO>.Û6Ð)W[gǞǪlÁ]I¦n\º, Àh£¹C‰ˆ?4Œ_Á† MÑpsÁ½ëÒcãü÷4 ó¾%´›C mBð[x/#uQ°ˆ%‡6 )Ù…àxƒA~ó“µDKÀÑ&}ø€7-â4¾þÛv7X×x|6Ú@`ºàôjº/&Lµ?Q_ËÑÜÌÄôœR_ŸÈLZÍ Áª<\{[]Û/>¦¤”7íXw'ôÜRàd—B›Ô\m„yZ$³vi)3îß퀑Â%ÑÆã8ÆæÉñqуÏr² ·×“̶éÓu•ÐONÆtýéÓü˜Wû‡ûÚd½ÒQ¼•¨Ó 4âõ}ËjÐìäøŒ@¢„6k×’S뱊Aë,ih}¯D°]w¾Äí*6ŒÀïOŠ6ˆEH`É!?ªÄ Îm¥/ó?Ž£GÖ&'gÌQCOI† R_Ú è$®>¯ÉðŽv%-\“J2Ó· œÂtj°Îš¥sôa•¼•Žóá|ìŠsëìOA¡’GW ÊCd<=àÍdëm۹͌J3Øp³$4¼JÖ%’+Ñ^1WÈ%BS2¤ûm˜þç¹ÛwÄè3H[RÞâVâPmÎ;ér,®‚÷4*ÍÔ5pStƒÁ JFnrhy•¢mºG}2,ÛL—_'“H¶^¡1A$*kË3¤{oõ1e˜EoÚänÍ50sÇÖm©úæ›bc,K¯#(ü´ ¬ìœïWÍŽÔ½Òe›b}ÀÛ†|»`€ßüšB¡X¸oŠ ¥Ò™á×+—´‡q¼¶±-|¶FR™œëuÈBF‚6Uøb(zZê;øîˆ eI;oT¡}TrØÑHWÏ.èÈ Ð—Ã!‘íƒ6E»29ÜŠÁÙ%§§¦«b h“îÉò¼-*i[œh,n€¯;™Î9]ŠŒø÷GBµ=,LàH„•màïíB¢é¥Õ"Ãe¦ì“HôŠØânÃ4±ã¡‰zØÐæÑ榛¾/²Þ—è Ë± Ü‹,Q½¿¸I§…ÅĺÑ)úÁˆ`T°š06¾ô+ÙȲTë»KdÓ/ pVÔm ³:¿sÁ¿§¨9ŽÈ´#ñ¬›A!ÌË6$Û@|ú—ô¸ZÐ(D“M!™zæOÚð‰%%ÊsÝþ[ó+PÕgèºêï:–9Œ ÞÃýSÀ>%´Qcº$y°7Änw7$SÙ#¨š#î/ãPilkgc ƒîÌãò̓oHR š*:Ʀ݃£‚Ý,I,›R†®­ãpve*A\Å^sÿû2è±–¢ ^‹mnd‚¶m¨Ú bÒÜÁ@3&B 3éD"ÉJ|P[‰Õt’çÏ£ƒK;=èŽDù² bZ—nö ‘M)ØVü~S ºyI"à–$ü£X‚Ÿ„EÓHÄ"i óD£þLI$¨ %ÆegiàŒÐ•,AÑ|0|«ƒ÷B•®€Ãžóå”v8Ô #:ëf,’V »xD¹KÛmv\ªÇ¸ +*œ²H,‘‰Ï²"‰ÄbÙö K &Ë eÔÒ*$Eè%$h~wÞ púR‰}&<êÀBÓ¨|IdÉxˆV’gþ+Æ[É|ë M%e¨ow¤Ñeå–¥€5–Ý% $‹</ÎáÑòˆ°ðÊaœ”6¸,}”á"¬FRyÂB,ÓŸy%÷CŸ)¡ÍJª]·b=\Ö‚Ò’H‹…5„L|’ã!Þò…Hÿ–»Ö‚+.‘¼ ½ûk±´oÈú”áB±XÖIÄ|ûÊRPÑŸ) x¥ »ãËí«[Z4=Æ‚Ñæ;ö¯úIžF36¥¨ZvºeÛ Q^“ÂÐFE*úÞ„¶Ï:~´=È”³€hAwö‡èF%×|ÇEjJ!SYÊ™1HÊ'¾Ãýu·ùbçºÿË+Ú¨èÏ¢s~z|§ð÷-d}_³ŽŠTôÞÁ‚=üG¬}U·ý¥QOSÍÀ4¶z'ª.-ëWxÌêª*iDovÄNv7ÕV•–––WTw L(‰ ÃÕåUµËLÛ-Uå“ØQ_Ñdé‡ÒïßW÷`«6‚Ö†ê¥eÍ]ƒ ;–EOkœoíÇlO÷ìhoÉûeeåã"¬h‚¦êò÷•±(Ý­e¥¥•5èUÛ ß«Ê>TÖ·‹år‘L¶•5€éžâŠ¸Šõï?ô ÀDKEU×Ä—ññ›`Åß}Ãí;NðKRV‡«¶â‡‡9äˆHÖw–Ü{ ¬—í몦¢ŒÄs|1H s|ØÍÍÎɘ5‘z£S~wtÄ\-ð6rá°¸/“E"Yºø숋 ör`‘‰ñÝ`þzŽ© L.S¯h±Û©%"äV×Üšhf–&ÊttôS¯_Vì¥Úf¯Ï5wÛ³Á€I»R”/ ÄÙÐ ,¢·l¶5aÚïD¶~Mt×^¾œj@fN"ØXxÈ— ïš’ž ¾kÂ2²‹Šv²1Vcxñ$ò½OòèúI ºæQä‘|!"?ÖxKfh¼ÄrJB.µ&_N€Š½¦v©_hÃ!þ¬øýw3ÈÄ#È*ý^½å ’¸àK¢¼¼ Îßþá0f®)!¶1³÷-8Ÿº—fÅ»;àÂuÜÝq‰¨²×üYÒÀƒP ™lillnmMàºM‚™eÐ&ÖÂ(æa%Þ1Öüͱ˜ÂÁpþe’SdÍGƒ¨7 .†õi®t͂Ͷ46Ò2Œ jµHø¸³…qê¬Ø9lj_©6ÝTi3çtS¦&ÓJúZ®ÈSoíJô4:4á¤KÃÐæP í¡tä4ÜTkYÏ’/¬XRÒ­z¥¾œ¾+pãÉgø‡DàÌ¦× Ì!KÑÈ«p—\&-)ŽÞÚº”)[U˜:% ¡Ègehƒ-²‹Dȯ"]”!ï)‘³mJÄÒ¤Äxܺ'(Ú !‰#?‰æ“¢ŸÏZŒ:D҈ؿ…YÃ¥ÅÖsÅ@øXñ[0ƒm‰¡©¡ÉBŠõÂÒÄ¢‹D@v?ÆÂô±èÈqE4.æ¿èE©1^~‰DÎS‘“0gŽ€?ÈÐE"uˆ%ø-(¸¿¯RH! ÿXñîb¹À˜‹Üí/Q©]?†:Žm(i°2Ñs߉¾+^N¶Ùimlè4*)^Ü–²Ù(ôøû¹¾R*Ë`F¤p r¢HßÂ,ôB>ê.ÃÑ‚n˜­»R"Mi:ˆDHmSØÓÔ–w…eë#뛇7ØoO{‹W@tC&º“S4•Á&{í£Ïû”*þ$!8âäS¼¦Û™ÛI1TŸüy㦭¬x >¯¦}:ªúâM‡-ʧFƒŸ!€ÿûõ߃² eÙÆåßÁ/VàVº¢^"@û{ð3©ç/WáSp÷[ð·¿Â=þs{ ¼KÃ?áÆ·íÿ‚¿ØfÄsM¨ÚŒ8 ¥ nK÷KûÀϱè?¤¸ç¿¯ÿ‡Ž8V®˜OàÏ(w`Žb8`ýóšâÞ…n¹y挸ßó@ÍÄñ[-06Ú? eø_n·§±ˆÛÕzò7rl (÷'ÄÁŸ¿ú$ð*°…ü;æßAÚÿù+dä6Ž‚é òG´ ¨>ÃúG°âŸÇH3ø㟀ÞDêˆ1@$w‚éV´?/+À` ø¿°û3°¬jL0#Cå2ОÌ@ Ó2Æx8PÀ:Sai'Üxn„£ ¬ûýføÇ5xÃü#Üÿ†¸=þI©Ú øÍß"² vÑççà—ÿÏú?à\þˆª„¨ªÅ¼¯ø?†tÅ2¦¢OÊ6èÞЙšÒ‚ÛNøج֠m<ø óÏ=i¿©:]¸‹l¼G¸à.5hnÉhN /ÛÀˆ178)Û.9g£üRq_(˜;äA3öŒ¼tíjl€¥›……÷¡» hÃïv`¨¥WÍk`âé¶ÌŒ—gãC­ìüªG”W½»ÇkÙD¡ˆ&Iu¤^jSF›OP Òcu}ð¯‰0<¢,Û´e‚7`o´ÿ ¼÷­E?û0±IÉ@¦œ%è þêà 2¥–¢W‘ˆg1ƇQðË€è —QVü-€[¬E›u±ê‚CÇ),zrÅXZ tœny¥ •Aðë¿A4)Ìnòo¸Î‚Ð{$<#Ü•|êÝT@€\¸Ý‘ªþ °µPŠ6«ñ&_§‰ Ïš‚¯/òÏk;úÃ$ص88;km~ 7ñl<å©Q0Œ>õÌBJ…WšGv™"þ0|ò+ü ½§€6°v‰¡ &4>Ge¡t˜‡mHv7¾_󻊾”$ã¶|ôÉn¢¡ÚúÇÃ<@ac î9Fý8ôÚP[*‰H bD£P¨„º!þrKršÔ)W“ é2±„¿™¡³¯š¿Û°rÕêÕ+ÿ{ÓÙl¬™o¦¦¤å7MžrÙ~!K†6ESsîÆó°4Éb÷j^Þáá}A7›ÛéĤ¹lÐ ‹ÊC7¥ÚˆsnÌRî´2´©½‡ø£98zØiàhSÓK°Î üóßã“øÌrl”µ¸çÛ/@X ƒÿ &{OË;ˆ†6ÁñÔиMàDEÞ;Á®]ø¿;UŠÕ_ˆ6°C¡s/¸Ö{ð½…ÈçÚÓ hÓüñü/¤jÎèjÑ6)ÚüÌèEÆÑæÃn©jó¿EòŸV€¿ù-ˆ?NDt1mPÜ^­¯¼Ž´ÚÔÞBܶéà¨â¨Zm“T'æ_}À}KÄQ6¢Z«úQ$ 4&çItÌšhs°HÎØRCW§=‚[U2‘¸9 »ŒZzËÆ(æCuçÖj¹Ë+?§õ<.–+ÛmEõ\õ#zž—®kµP ÜVE£,$œ©©®‘–\âe¨q{´ZN“ ·'§¾EÈúªÚ¸†Êªy7!Øn{²’…·ìt¸arÕhó–qvJlq´YüZà ðkX‹áà_¾¦À€‹]ehs†5¨¸è¥‹¸ËÀT?(–@˜«D<±¤®IM.žÔ~ ü(Ú¼ŸÂËP ù ÜVü ŠçÑƽo qC ÜL»lGÆüiPüŒ '‡Àº¬#ÁÐæpá CœácàoW€ßá…ÉŒA’:P®€6©¨bXŠª–뙈{{1˜iCÑÆ@mú9Ù…£ÈëP¦‘L~ƒTÿïW€¿[‡‰p\èÃЭŽÚ Óø˜ó×W e´ù; 3ûí\ƒˆþó` ÷Î0!PÁÀF#ó÷ì]ô© Á@–!M'éFV[[ÛÇêwÞ&D—L\I¾öÚ¦5Í]]]íÍu‡7˜Øòá™ÙËÚçœâåHm©M» èȽ‘˜¶Œlƒ!š+KãHzqOOgj¬½mÀaåpϨ»óAyww×ÕKªÇ ©n¦`·Á¬Ä`²Ý€NOËìèìj.{dDÔL~ƒ ÐÜHsDäæ)TŒy"µÛ”¦9»œÅGúR²M_Éó}çŸ(û®×GÇŽ±A›d›7q¨räN„ÿY‰¸é^àñUTÿò—®‚HsÄunkP H:.œ¿ÿ°âÿCê–µ»Z€Ãoñ1ëîoþ€ß_ƒ¡ÍŠ_€ÐƒÀŸ !¨¶"©B ¼¿ÇÏ€µ?GÜõèç¿F5„i"ðÔ* jùŠh@ ò“¶Ø‚8þŸØ«å2´ÁlAk¼ÀéHð_ÿƒÖÈT×}m TŒùÛ·¯"Pó‹Ÿ!¼Êë‡×!þ«ìÀ&T«òGGY n’'8_£ ÛÀtÞ——’ÊpŸy´‘€ú5*ÚEì‘îB;–Ó¤0ÕLÒ—â¦od¾+å _6’¹­þNFFÆ›¦ çÆ,º&àÉѾ&ÆÆ6nAo‡°ôfx\6gL ‘[“âÇ™êçKo2Ô¥,w-,iý­}T·‹pé~"ø×ßú(59êýø%6MKÀð¿6Û/?2øÍ?ƒb>èy ¿ûø¯µøv5ÌƾÕüï¿ý-°“X…gò· DzAßåhd˜üÿí½XU[–.úÞýîýÞýúöëÛÕ¯ûÕëÛ¯ºª^w%³7;GØ›œsœ%‰’T’(’ ¨EQTPň (¢I"AÉ9gvÞë­´7›èÑ:UuNÕß ‹µ×šaÍ9þ9ƘcŒ¹OÆbÚå±VÀ?ü °–™e¤€`0#A¥©ë3²oùûÿü›L›x üúŸ€ù Ð(•¿ÿ7@!@xvøí¯ügÀ%fõæªÝF ÄÚ¿› l ø‡ÿ(ûüÝ?¿²DËÔþ6žÔp øõÿ ü–€øW üãÿÂ`[Jy6ð›~õÏÀ+h/@%Hå×À¯þ/ ½xf üÃß[Ѷ Ôÿãÿø+Ú1„Û¶{ðwÿŽV1Sü?ÿüó¿o¦PYè¿Áh3ÎGçgEð_ÿwÀü ?M ØêLÍ—nš¢Vº©3ðh³^eß´–M˜}½lc}¬¤Aá<±µBÿ¬ìÖ1áÃ.$·ùÊ÷¤äù¶j:|ñNûz“]è¥?ÎùM†JæþË¿¬þ‰ Ï¹Í׋uµ¬iÛæ€tÛ~QþÚƒÛ0TÛÕHTgì™8Àªóâ­º†\N4Â"bøš»Žÿ¸:‰ÁÀß­õ%þžÖúÈðÓÒq<§bË©*ŽM.¾ÄgŒ©êYφ~¤ÍP›ŸYàÿ% Œ-€¿ûïׄ>Zå£-ÑæO@ÿÕõ[Ó_Ö†ð»ÿ øo°Î8£õk¢ðÇøïo‹ÖÄI}mˆ“uµ6Ê㤶ìšêšÛû¥¿ -О& ¼hú¼få_ì^¼Ú‡ÿ ¨©^V³ü_Ø®qõsàU0º¬ðÝ°NŒ0£¿eÓŽôû¬ ‘ÆnnrÙЗ_JG¾»¡¿¬¤.[Ú·8BwÓ¾I7sä­;Uyó×¥›]c’ÏŸ›.Ü¥®¬”XÜ÷óo*ÿõÞe$nó@iË`ßË_¶œùŸÊîß:×g?7 Q@û±_k"ä“Šøµ _~ÒÔb€„7×ÐÜ/¿±Ç\åÊ á?ÍK¤i¨i¨ª9‡ŸYB‚=…¯ ÒxMœ¦VXzñ²µæ¯L|Št1ÒÄkÑ _|B ™øTîe®Mg0è:VEU]rèh¯¼SV;Ѻz¦×tW•Ÿ¥¶†&ŽÈ±¾UÓ³¢Û ƒUþðŸ½K÷ÿIä–MWøƈ‰¦ZÝòVl[º ´ù)<ëßݸ” /K7•L6_ 5ÑJFÇ7é„ŒÊNšØF¿Þz³LúMßçkÒƒô»>ÚW~“n(AþË #ÊÄW¿3c3\ôãû²EoÇxãµ ýC›ØNòUÜã[÷ÒDÓ]§3²¯ÔÍÑrš€·á,3¤§¼-¡Ð‘Í-NÐÌ<¾r4ôÌAìÿ3^D•%_ Ë¾»tbã ,·ÒvRÏFdå]1°$ÆÎÌ5Ø—FÍü$ƒ¥FöNÍS¯ O QÏ]6Aµ~dÕÍ?ÕJdÐI„þå­¼:1úz˜¬ç|¢á ‡ ¥.iÜãdL&SíÀg;óLØ:ƒN#ãâó¡‘zWd­Ç ‘‘¥óÙ1û´†X'.=ìTÂXóÞ]&` ¶»¦e9(BW^uŸ u ShvA)|YÞûYØ"ÛÔ½zI­ðÞí¶5_ßµ÷øúöˆ¾–ReTÛÍh–}"êµürÿ/Šâtü2?DØ°9Ñï…ïbÖ¢ r¶ØX„³‘Ĉɫ|~ÚFÈo?7a7“JfrÍ.¿ø$ç–™ŒØDªö‘«åuš÷%é,ðƒèž(ù€v¢ãÒôö},Ñgizö­³Âæ;é\&…k( ûδ=r6Ö&“hG P0(°cï›d©å ù™ 7–š²É «òÞ mrÅ—9àÓ…ßÓ‚a÷ !<‰15Ó`« –%sžäO·»™°ÈdN^õpF¸A\AÛUgMpM§ÑhÁφ€Ï;ØQƒOÍt(4†þõzȯOøî°’ÝÙ7×jøp¢¡œ?ªcâ\Ñ9…+\èt· Q)çª.(æk©»O¦Ñét²uX<¿|„ˤRé¬}Ç®¯Ë¾LÖ*QÌ—f›\MÙãèM4í•xe2m3•JÕ·ñk…ø}æíuMX&ÎÐ[óeÑÜX(z´ñþ¥ûM‹èvvç)Rø¹NX)ï8ƒîzOÝ%¨ÚO‚’Éûb-ùò0I¹Y'h¹­Êñ#ƒ‡ 3ï%8i%M/ªÁB£ÈÑfe 9§ T>®vÆ äÐ4ä´Âƒ\baÿ´.ß/²Ý³4M|0¬øãéÅYk†žsëì O x5\uüý¶Y@øùÕ9º®9 âCM­wÓR‘èyÉäXL-ñøá… Ó8ˆSª.Ø2tš§—¡øµºj¸Û­3` =¯/Ð9Æ+ðI‘ÞzTËð9‰T,æ_v&Zœ„´ÎÛïŠÏ 3ݯqîgpb-¾ÒÖ ”™DÍŽ3L‘ü ‹ùçÏÀ%q§$Ô•tùÕÁfБ ÷NZ0õÝ;ø`6“m$®ÆÚû‹êÄ`E­÷ÉD„6Rq 1Çûl…P(ó†|è*áÅp2ŠÑšçãøŠPÌ;îÃðˆ{¤¸4—¤xÅóEBþòì~}Š÷uxohà††þðí/"‘¸»ÄŸÁÒ.i‹û'÷Ø„AÍ[ì.bÙ_¦–ñýÔ@®¤èõ—z0t,+{¦x|0VFT¦?èåóùËÅa† ²¿í]Ú/þÀ …‹12™¦tcÊܲ ­têåÀÕ%ÓÒ«GÁ»œ½d !¡ XÔ×b¼›@çêteà ÔýÙÏ„ÁX[)¡3Í—ŸŽi‘uNÞ¬ðù€tÉŸE ¼ú/à‹fÍñj×?‰á„!žxºvlŠpè1]™Y·õ¿¿2‘©»,~ÊÞÍÌŸRÈœl¡út_Ë\“&žlýœÉ”=]õN øþ¨ƒ–VliX&oô—€¯†^z_fìtl?øÇ)Oóœç]ëÄѪ#Nìý… ®Ø¨àïMʇaÜLKµz¨»}ÜÈ=V¾¢<Žu·8~\˜lÕqymð2(øÈÅá>LÊ]žÑFºVîק¨7£’`sI¤AP±T:/G›ÙÏu9×K1¬øã©ü¬¹k:2å±Nz‰rÏ|‘3úp ¸!#M­ÈýNœb¤öR.p6ÑvôÀë v&NÇ‘*»rÉCø%®$ÚýahôÒNº^‹ŒòP©Å”çm(JÏЈ§Ñ¾ÞYôá^SãS¯e¯/ÛhPË×úàl…6öþÈ!Ñ›iRÂ^ þóêñ•çM´y-YéfS } h2¥÷%‡ €ÏÞöåXæ|@úÂ_œUtýZv§í(–Ÿ)6uLôX„ÑfÞqWL<¡‘ŒfDÐõðà ªÛ~ðöE¢[‰Ü›¶Ÿ³ƒÕ¾TêEçF‰X­ÜV@ ª]ŠÆu™¤uhC¢0ßÍ"ϧ#8‘g?Ì}.§rŒD¨›t„6Â1<‰[5)%Ü®Id•çMR¨Ìöy!Ð~BYÝa.h¾ÿ E[WÞ·{'½ã¯A.E|ˆUyK‹+â•@íypê‘·ILýx° i®»h™íCþ¤¨^Ì5©á¹í²Ci÷¸0²õ U^%[yÉ9ék}è:#Öp;ÂdrÚ&`¯¯Ÿ’§ƒO·}y§fÔ9–Õ«·ƒúz58xÉŽ¢ôb¨ºgé"¿û>Å‹ ­}Ký¯¸êê*¯¡™S9¬ œ®‘mäÕwSfìäD9èÀP× JY+‘¡ ¦Iý„h“me:oŸr³¦0L”8Uµ°7s h3çŠÇÑd¿³Xt¥ßïx<¢Å^Ô7ÓÛ~] ¡•4éÉ:s]¼FŸøRí/@»Ž*±qPÜ H´4¤*¼®©¬Ó ø:Úœ0s/ßÒn³XÍ hòÑŠž7ÑF4SI'q&hTéç——˜V® œFë³#žõlñ©zLújë¨Ê?hñ ´ùꇴR0ý‚Ft€} ÑÇY—(p’RHòÆdÑUÿsgîŒ6ÎH”ÀÝ”=v±çÑÖJ„ê´a}^BWÞÌ(½ÈìúѦ,}‰Œ’˜Ñf3B(3CP©ÌOsmv² 7Ç>Þ5Y³˜d^ÇçÈzi~N8¦uLBbê±T3ªê%Ø $G›‹Oí'h¨X8LÌ®³ÖÌ5©ä½×•™ý°çÃÝ“d…Šˆ8 ‹”›kÐfþ©–6z"<Ò¡çgB•h®íÓHKGÍwòŽLY”«&wÅɦ‡VEtP•J¾ UÒh†¡„f¼ÙA;¥ðÝ°Ú@Öç©F=RÚízYÕ âÏHD ÚL`ûR?9ÚD¢iOnÙÚŸ¯ÜðˆmVöQUS78ÍÁhƒ&@+Þëh›õ|c- Úœ^6ÃÆ8Õ7“ŠnæÒ\WC·ÂÖm ¥%q:(ÚHù' hórK´YndɃ+h-% mÄ ˜dʈìfë“ Ž­?¸XgÙ°Ýn¶+š<*Ÿ´ÑPz6¿Áü´'ê"ޯ߂Ñæ‚6OÓÃÍögÈŒâ|}mò¶h£™]7Ñz‡¡g-G›C΄ÍÐ&|S´¡;2etŽÉºV|@æ˜ÉmË~ŒÐFÖþöúcû¬Ønç%ke› hÓÝùäÛ)x£õ\†6ÒO§l=òäߺì„/mWÜì*—Ké+%ÕQcÎÊ+ŠŠÉ ®Ê§À'‰#o¥úXÆ\«i,NÕ÷>(·Ë»íí³oŠ6àÏKƒ5†d­‚×}ò9&üóï; úº˜´t:›IyØ4¡ÄO6R`ùMŠ*ÝwdÉìñ”3 ÕEŽ6@ÅI[=oÔC^8øúxnÙ´çBÍqUš÷:MæO¤œžJ6Eè¼{KúáHh᜽úÎìNþü‹uí=¨ò$KK= »‹‡x°ÁùÉikÛЛÈïç½MT,Ïl…6‚Å©öÏðD’,ë³ÈÚàR…=Öx5m¤ž1RÜ„rÆÙ ¶Ë!$ÇîkêE!üZqaÍŠŸêëì‡fi’§öž Tˆšj*ɾû±Ûl‹6Àçk^«dÔ :Ýšz:}[m&ŸžTÑÝ8R½Í`RI_A›¬Záh3žÆék>áàQMJOÇÿh#$‹CL-ú³^4aÙµÌçF›KzvèŽÎƒ$ ^=·Ѥ’™\(³Öý³GKëGQðm¾L×Þ ËüpO×ÐÌæhSÚŒÔàqº 2áäZVzóà,ÛD;@)vë±^}™E°¥·*‡bºnŠ¾Éßkà’„j|ÑÖ1÷àNõàÈ÷>Ãí_ì4"á+zE#•y꺻äÊw°•ÎáÛ òrBi”s_ä9éË%\¬]Üf?”msÌ…Ëó#VüVâL3‹}«a°¹ñ~4¦¶·¯—BôŒ¼ ßÔSѨ[€ñŸ?écmBÒµòõpd°¹Ê;ÁŸ+ÏY˜„ÈËGvÓ˜lo_o°·°‹ÈêæJK¿Ó‰î0=ò$XC ¯D]÷Ít¨lckMË5vL𤰸>>ž:TrÀ!$·ÿ[ùw¯z Ö™nÎÑf‡Æ'Å;å†ïÐO…4‘4#§øÕûÿS*ª÷éy5}Wäf]v·qrÖÓß•qÆÑ"‚¦¥º\#i—w€µÇÔ;F cbü ®•›Îux ñˆä¼…–vR ¼ö×Øé±Ù¦NžN }«W£pÌTÿµß½P´™zFÄÙ hóðŒ–S8b9ÚçjCÒ1õõvaÒ™G¯BÙ˜ûﻑò%2‰>Ù]—BÑßíãj¹;GѤ =© mðZ— mN‡k‡e¼[u3Š¨Fóð5tLŒÕ…Ð$[kkÐ}Î7ŸOÿÔ½2´™$)m Ú|:öôÈU~{}ÚˆE´w÷±âÒ¹ÖûFà­nGc.ÛÎÇ×ÙÌçlMNŒ5›cU6, ¿fÓæf-Ïsõ™$c;WOgk"Ó(· ÂÈ{!æ„à«0Ú4îÔÔ“³e°5ã4èmwë2H.Þ¾& ’±Ó!810Òx‡J!Z[ii2FÑ“Äqœ¨ ]®ŒtË.èËÎÅ:ã5éº4Ms×áeÔº;ú¡ÐMáiQµãn!‰Â¤dŠ§¯hê ¾ó>™Ò™º\D¦°ut¹:±·?|)>ªNdèéÉëÒI~Ò¶k$ól-õ>̾Ü?­là…aÅOåo#]<²‰oˆt wšS‚TÑ}fK·“M^—® -—~¥ k ziîÎým¶¨|óöK¥ëÚ»I²b߀ -Ýô-éºsÖ #äw MªQ2¦èÕ*]ãs+­î?ö$'ßZwÎú²ÞÁXúãÝx¶›@RéÆ©°®©? G l麴¥{Ò)Bú-¶ÝÍ\ˆQ;|’†6mIËmwm#~!‰’f^’”éaŸ´‰×i‚é”èk¯Æõˆ´Óï!I_Ò{¬D¯Á¼^ÿd´ÔT¸+ÛÇhËUjƒ÷gM#Íe¶zt"‰d켯{úG¸¶2Ù`«G"YFίڱ$-Ø\£o˜Ï[ßø)^Á#Œ0Â#ŒE†>V\­éü8ˆGÞ\¹Sÿ×: ›{¾qôV%Ÿ'Š:F"qLºæÿ?a™r#ö̇kO?þø×ß>+ªíœÃö#Ëo>u–¬iêûŸzÝ:ó½%üùº°Ñ»ï—7›mÎ!t.%´´ö? sr:žQÌPï7+zÑÛám¾Þ7 ^¡«VÃO}:Ê13r—¬åï:í¹Qóãß½š¾·¨rãåŸ3-Í Í ¦Ç†º‡s„“c㓈?–db¸ÖG,뙂OÞ‘ —G‡§çÑØ•å™áÑYÁ X R‚hjl.aF>'Gxâ¹É‘þþ1¸d„©V¦‡†FÆRÙvªD09:Ü?0065'{[4<п"„®§†FeFTÉÊTß0TXÆÄœ`zt°ghqÚH§‡gùèfñÌØÀøÔ"²C½8Ö<8¹€î5/MÌ [³¼™‰Ñ™Ùñe4ŽJ:<¶‰T ìŸ(@ÖýÍŒœ‚>”tbd¼ž_Êweç§'¾‹ámV± pX"^ì[]"çÀR&f—%¼©ÑyðɱÁ¹eh¿Š7722#X™›èÉvœá;#s€h¡pRÄ_~Yœlä˜480$…ѦøÝð\ìø4*©Ž ðüÑ¡¾ñ™5ã;5¿"&Áâ tí ü¹ÆÚðôçÝÃPºÁÄ(4gÀ–$ë7¦†&æ…K3ãàÐŒMIdMóF† 0»„~Íű¦êÚÕCãS|èÝæ̧ŸàñÔ8ø…‘6#¯/LA½˜Y”ò§FæÀ[Óãƒ3‹BŒ£Îôì´¹±ËØ-*·ü3ÚÙ@ÛÂùø±#&4ŠÙÁ‡R@T›ªC Ħg¿l™‘ÌukãIfÞûSö°‰šy¯¡ ”WY–†»Ï²Œ]#ÏC1‡ÜØæNÇ'šÒ¨ÆQ÷wÙpwVOˆsä™’‚L…v® òšš~AТx†îw3g±õìÁV\kÏãi‡Œ(DÇ£/†0£á^÷CiÓ8©Û)Æ–þ§X¦îÑ—Ûë3Nïbtm.!Ž[óÞLMK?øüG©x®vr°97ñLæÇpqÚ\'¤ AöI%u™öj‰Õ0s :uY´ðÛp¦ é± »MÁã#ì¯Ü_új#=X~îÁAiW/¦î£²tîÆš%æfF9©°v#šLK~¥}(õ¸§¹!Ñr?ÄØóíš4ý“t¿ À¾qÓÕý8’vXB’«çü_’3äè¸wõÜèH¬úËvŸ³ú.Ñ·ïÙ3Ï@þùÓex2Ã;êHˆ=çxF° 'fyªs5×À#ç|¾BÆ‘½¾†v~ûƒ=¨dÆÕ^¨±vÆ´w'Ë]^7kf%s=:x’©÷þ´„Pp|/VBÙ®æ»_áˆt}± Qþ ‚ÆíFhÿ«þF ĈÏÌyÚÏ‹´ÒÓ±vONMr1cé[G¬›`·’-}y'Þ¹•oÀ¡ÅÞƒ"S„ƒo¨»À¸¤ƒþL²Vy7´²T\Ž'k±Ï^¨6©G0W‰+Qæl}ãýQû´™´C¡´'ŸJŽjÙ{â“+W“Ù }Öa}-R"!Jyï«Ö‰·[X¸B®çžìU6=á¹790 ÍS4_£¡›Gž·ÐTu¼à7¦݇fFm¾š®/â$­44ò%ÈHµ´Ò!ø?œCÇ;ächó A+ë=weú‚ Ç;â¹³ ;›aA¡hYTˆ“Zô'j8Ê> Ó…œd†*õí 'ex )áR€ƒŽg˜¬„L+*-­Z¶"=Y§îv ÏŒ>ñ£2{ôÔ5kçÖ8ážr0Ô ˆ=¿žsîŒ ’ýy£ÛV1àÎÐD4ëÐÒ|$‹º4RßP“µïàåÚ?Vé,Èï)œX%|uÕŸŽýoò-‚o¼?lpdQ•à6z±µ”béÅŠ:0+Æ—µõºÅÀ›ü8ç¨byùyŽ:û6ö7Ê ìo\ÿŠ·¹ Õþöjÿp¥j(¢jsÑïx6'ÔÕÚ)î°Ò¥IäöŠ‘V÷©i¾žE )lH.ëÐÆÑÀ¯µµ|ÉÙA »î«¥‘õ ^\,OØ¡·m¬è7ªÑà wézChcF¿Y‹œq³¸›¤áŸ%ßp|ß@ã.ÌO ·±²4333æ²9áp‚@Ž6@‚½¶¶¡ÅþÔœö1TùRT¥n§™º*G“56%(s@ÔqÄ«ù$å ýÏN ª³¡ìF+r´‘\qãdC­ªrã ‚Žk¼‚GÌÕ4žN¡§ÿê.œ½ mnõõ×ùøùƒäxŒ‡±÷Ï mbÀ3<­mâ²ÞVUV@TYõúuÛ´b~›ywœfdQUJ•••b8*si{ÖÏÞ*úÌÛ× %L €ÍcÀ;9jx°XÅü”)6†N)WªÐ1'Ù m–Ödœxµ…lMÒ½FÚÏ¿¬$úhwwc]sz:²,]o@™%Îí³?~·ûIºM|±+óvúîÃ$$Ètد? ðuéô)>äfxû“(Û‡|ªA$7§žó··:xZ±¿áþ‚hsæœk BÊ~Úè@h3Pw¡kQ)ûŽUUUïÛº¥.M’ÞÚÝϺʤ÷²í£[®› Íî»h+P´YqQÇ]’%úקþÀ݈6r+1„6Þ0Ú˜Òî5 GçÎ{à5#Š*ÇwR \ ÒÑ÷?×7<>33[ŸæÎ[‹6pz¢/ëo^J7×&™ûDKÖÚ›A´ñ8Œží%C›ik5¤{ÕŠÍ‹VÑF*æ²ÈŸá³ŸÊsbŒC’Öîõ*k½’í>M”úàì¯ÊÐf ¥4QY ¢°^ÄØûgŒ6Í'ÝH—åã::€¨9«1àœÔÝ/É#ôEÓsÐZ¦˜q¢õŒÑï†6E¡[ånë2‡R–}òa¿ ö°%-ìŽìuéèàäº=Ö»G¸N ï‘›™žJæ[Æ€+lðH?g;†Ü³‹a3 /tmöСÕÎ@0ñðˆMÒ…x=í.(¡åƒáêl\ðeÚ›AÔcïZhz1à¼ïÌ Œ+(¶%˜+ºí¶fx}Ïoìï:´¹¾m¤‹=ÕZlC¡ìµùi8“Ëb§Ú,î"ï¸Ó…žÝyÑ‘öU´ß;ª§´·l y§"É[ÙÒ¤j!´ÉDØ+´¹‹¢ pq—†[n¯Âø.ƒJ¦£ªæÅtE8ék¥!GV ØnÁ\[|ßyÎVƒtz­&µ Úñ¦Jñ¥“²±̯ÀxmÀ5@8WOcø­ÀY÷†gh˜‡Èðk&ûÄÉ€ïEýáJ+*츱·Ô¤0—ÇŸ/Ú€£ÛmEÖ8|µ¬µµõét%-#ØŽ±Š6ã­%$ã~åûÖæ¹QÖ8éŸÚ€ƒÛcCш¿ü,áYÑe¼Á¼´mÀr¤ÐmCÞÔ6¼¸•©A2o ?4Ž½hmmy”wT‰b íÄ3‡#B?M@å4ÞK`ùuõ v6Uøzš«YœÚ mÆêK]CÈöE^p,u÷äÁO pI&KY„ìµ²¸\Û=°ü.°a1èjšÿè®:Í4·µ;Ïá©û\CŽQuΛjóòöŸ‡ /½¶²þ>/û«?Êm>oñ’9V/44·Ö½~hHÖ¼ôzl-ÚYa–~G[Ú>=+<íæküU´@).#¨Ú®ïš>Ö½*Üík¢¦iRÍ¥‰ÚƾõuµÂ6m·Iúý h|/î·%»œ€ä77’uÌõOŸ>ÞˉL‰´Ã™DujÌ„…šVÚÃwZ^”ieoZZ[ªJs $#hZ2èî܇{mDðn[Y‰eú¼æCKcmº?Goì/éÑßIÈ.ÿp÷¸“ùéVÙŒ÷ãüÓo×׿?·×È0¨¼u%ÞÞØ5¦¹íÓ«ÛÙ~&˜Ýæ—Bu%Q2jV%Áð™CûÜÝ="³Ñ¼ØÀø^÷öety ¼9ìåááy,¯ ጦ»"OU+”0š™–~8kR&Tg&úU¢YÔ¦Þ&{Ç<@Þýð(×ßÓ=02éËŠLá_é=âîî¾?%wN¶Ÿ¼ÏkWã(r؇è^fœ»›ÛÁ“…Àð]§=ÐfDåµð„ ¨GŸ°õœÃÞkÚXºË…ú¸=žŸµ ;ç…a®Q…r íb´Û‘Œ{HóŸ põÏÊŒ>‚É.w/ÿªiäY^âî]çJ <¢+S}ý ´,Dûv8SÞß,¨¿ƒˆ½3ÉÝëéºÉ{*ÀöQ/j¨z›êíéá];°gêwñ ™”ÈE2áÕ”wŸœÒ–‰î$7Hä;ï}û-”t´óIlhZŠ6Cwì|O m~™—äåé™p5ý]Ø6Ë›ˆ ôô8°"¢|Ÿ· ÒW÷³øà£ÏÁbÂ}*Ú§å[l‚Áêƒ!Þðø>‘ ç¼ÉäÈßâ÷ (- ó=pJ';\}ÑÇÇûøÓAÉhÃÑÈ ÷=1Ç PHµ ñriŸ„Ðæe~Ø‘‹h’iW®cP.bTŸn+ ßíáéåuó\8üøè´···¯ÿëIÁêŒÏŸKŒŸL>ÿ@.wßïîáQR7ÿÌçx¼“|ó_ aÑ_€„}®öa¿Üæ7¿*©hBòVIoûÑlÏ}úê+í/¯ÝGoNù0CóþZÇöÓ›»Oß#`.}Â6?Ý€ÍwŒþ‚$ËÖòKÕÜû¦â÷Ѓ~N† 6gZ ùê+K52ÍÊ',ÌךBÐ|ÖõW›„bäe6øq\BºÓéôá%6á1Âè»±Ò–æ§@šžA\‹¿bòD¼®yKÓð;K<á_­•îyý8 €Ùƒ1Â#Œ0RP7–‹ínnùâŸs=û Ö°uy-·Šdþ¾ê¶>úV^žØþ»­M⩘¥tõÖÆFIÿ¨˜XÅd¤Ò­gÈšßbÀ¥[N‰?m™ øÚR`‹Ù& }óŸ01è/G¥Il£ðWën^‹Ô0ˆx³ý‹Ž,¥ç½â?_C?ûµ¦·ä/g²þ_~«5#c ^Mº†sò&u^ýûÿ°ø¶îAáƒË õŠ,Ÿß’‚WÖê{;ØHÃ+$Aø=øb Ü44Ô4ñZ0iª)ã™&éù/P™-Uú_¤ö5ÕO²T~W=éG C Ñ»íµ$:¢N`†½4'FâCÉÊNßyÃ[YEM]]]U ú/ô¯ºº’²™PüòÃNYx5¥ÆNÁÝ‹r”/ô¦ÇÓqÊ*ªÊªxFè¡3=³âUöì¿ þ¢®j¾?[Xø†T%“# ¹˜EÞZø8«Þ*¿ßwÝéò`›èõEK•ÿ•ß õn¸1WMC] %¼²Š†[hR÷’ÜÇ»u.ј©õÃ¥Êx·=‡ë†…Û wNè. M¸$œ’2Î}oâвhÀ©}x{…?=9alózí‚°ÝJ„zË ¨Ô•Mβ_û°ùR¾Y^sÅ„ç›%¦ë¼ô3DºõʵñOéöÂüã·#ùµÛ¬¤›„-d!ÁXEÿ(È;t¥ë ™¹&\âý¦qF°w®™G°›ÁHjXÚ el"5¿ÞÊž+#íät®A›)cªú»!ð×å¦Òžœjù}3jÀôÔŒ¹îÛt³“rL-¿H±Qhf#s'I1eÌˬݚj&#B$p¡Û¯ê™9‹žÞ6•嬩ã8,A°#·o'ÛÊ]mvU,Å3×Ó@ã^—P–·B¬Í²7c{ž~&ËÇþD¿'S[OÃ%gÊÎ"øDÝÑ–«LŽ£ÂO‚“A&úö1ÈG™ºÖ!#HP‚°05@K“üynËÐï¼^®iE²¿DÑ6jXés :ìÔƒ¤;¾Å¯_À0úhcb{ ,+Ü…LÒâ؆tÁùŠciV1ÎÜÏ.%/®$ês˜T†ÁÍÚQd$† ¼­2ásî$üÇ9Ñ4^‹¢{©¼œ„ßä¾G=Ú…³$œJíðòLç+ ‘DbèZÝ|7Û ?`—·™ºâßí Ê¢†Pk]æûê‚ìôId ÇÜ«~vUí¼´ƒú±úŠƒ€'°/¾ü,]/KšféÑIšZ´„¼gÈü›ì,7gàI$vzé§C¾Œø«­ÀTãïU˜ò£LpeCÀÊD{„« ‘L&Óu3|€¸õóUwDØ}i¨ÖI—¬E`Êsí¨±sB%äŸ\qÕ”C#“ˆz¶þïûQÐhN7õ½¹|äíw³O¸*ÿÈüæ‚Ó |Bš"Ú$¼U‹ «Sí_Aá'픊…ÕŽ‹ù9 ¼=ªòlÕ—÷Ë£³Û@E´a)‘ê1Á„¦QÝ1ï“l_CçˆUìDέpÒr}¨ØŽ‡P´@¢Ë:_?~+ÎË3E>¡ óy_‹AíÉRÏ·¡Ž½PA圬½£¥á¨ï OíYTÌ»%¾–™·Ížˆ6»ŽæË»Ói—†ídÖÌö¼óµâ)¦CY ä“fŒ£Ñéùx;8>3éá® ™D¦G¹ {ÿH.™)1Ôa ñýh“nAcé·ÁŒÿô°“š%”yéÎQ}çDhÅçׄQˆ¸ò/Ъ½‰ÓÛ…¼uÀŒó ZÙmæ…„±,êP´ÍÆù¸& Í7 0CD€Ä•©t¯ 9ÙµÍÖIí ©¯: t%/rÃŒ½=ƒJ!ÖQ·;H[8Jøëp›Äã/Y$­nPžï¼¤‰Ãg@'YhfÓÉ£+k¸±.ÎpBc‹veD‚`¸ØMÁÓ¯vAs¸­ œHÀ¥ÝúL·¨SŒPW{a-… 6H5UŠ~Š ÔÅŒõøã4Ðs뺗Ê÷² K§Ÿ†}êžµÝ'?¦Û© Ö,Œ¼Ökšº¡p0å²'…Þ Ç€ýEjjý2–ÀŽÓ‹õt%BA;:„ºTÍ·½Ë¯–¬b;[KŸ0¬2? êX¸qèÙfÈ9ñÅíGMXÂù?mL-ܳÐÅQÜÀT¢4 Ñ&\S'†Ì¢éwÊD3xƬÐ(½Ð¤åÓwœiAÏÜ øBpò¹®Dñ‚yF|Æœ²÷9ȧw®F tì$è4×;ÁfÑ÷ œǬ¥UºŽ` wŒc}jÊf¥É[n sö]?Ðui§ºÕšÀJ¼‡ÃŽ-W<°[œeIð)Gí"¡@$oy@3°”+3ÁFêkÐF ô_Þm} Š'=a­æw{µyPŠ6¼©1#@€SlÔA´ÎtRèÌGóŠ=N¦± ùbôÉ#Nøè(XC´<È¢SzPi ÚèÚ»úø@γž.vlk2Ù¶hVØñ2ßJ‡H¡ÒXlm·¨X¥xCõT=E=`#Úpñ;_¨Jo'+}&|ýŒK”GkÖ÷Ð÷ü"ÑÔk+´©M4`î{†\vÀ%Ü€5bm å#Ú‘›ßü­hCg²¼¼½áFz™"1÷”ñFzÓ“­ŸøæÑƇB£’"‘ w…ö-B«^ódºÇA¹LxÀÂ`ÿÝF`åˆ6°× ôù&Õ9‡ Eí Ó¤¾mNšØ”Ÿý=l¦©ô|f Úh˜ž–e¾«U!˜‚È.º®ež ß1WÖ([·QúÊYõBÉ•ÎçC ´<ñé »‘jdj›ñZåÅÍÇ´<¯@—ãH†lS µÓ£¾ÜNÚC–Ï2¯©áQÜ|¾ô#H&1KNÛè¸ÜTt¯] “×ø³õÔ\Ö6ñ–3_œclë¨w£ZÊDK#g"]Ôp$}c‹˜ pP m‡Êèt‹%1ZÈÕXÝÝ'À"ÇÛ_º’ˆ4–©¹sy$ ½;Éò¼%ÿ­EI h>÷{msÄh3Ö MÔ½†¡þÁ‘ñ“¡»ö^\µ'Í=ѦkÚPP´‘ÏvÁÊÒäXßK=@(÷N{ÙCèÐRé6š[™ô¸c´¤Ž:‘q¯oI^àQ£!WÖË6 %'YŽ»7Gþ”6…æ¼÷@\,Hñ^Žfz^ÑrM AÁç;ê8óþo–m¬»û 6ö–§«¨›wˆÐ1|£‡s¹±éÞá6²sRìiñLw)“ÌêZÊ2˜…¦É_Îõ4µ½ðà½GÐÎ-¸\r*Š …×Ñ7ò?x^Šíeý4hcj|S6^e­ZÞvhΘꃺO‘ §E_âŽìvØŠ¨0E_œØye ä>‹d‰âO‚Å®†ç,õí¬b‚I[e®eX6ȃ‰ú´Î•Qm‚å´x¥~zÃ&Ñ¥n²íñA}툧Š!x¢4|ÀÓiÅ)8X_Ì4²—ÏÅHüZ´á›Q©K 3UÂëïj¶ãR.Vu=%Ú,½fÐu„ècYÞmPâ-L5=ÉÐÄY‚jÿMRZ3• Ä݆*”ª%‘+•RØ+Oµ²‰ÝJ:ñžªB»7,G’6®ŠZùú'œ´Š©¡Õ¾ðæF«ëš×°[Wöœë\rÖÊì*rÞÖv衞Ү粭åI¶ŸsÔ:»M†Õ5îñTë«Â—¨Òw-Þßéðeðb¼éƒa_õ¦¡º·÷8ªŒWKŠh•p?ÍÍ:ìì«Ê·kRÐëçöZ:D_BǸ÷ Oï^XÓÂÒÃ!eÝ _·ÛÈ^²á6ÍÖ]>¬í/Gª#6FAEµrÙFáJƇzŒ<ãJ0¬øIì6l=D@ﻩ¬!¶G‘-Þ6ÍGƤ ÚÂv*Wûp´’Ê¿À|þ‚`èyÑ’öæ²ÅZoC²ŽdÊ}hsÔñôpK(‚s?æ9ìË=¢ùnÇMuƒ:Ô’+Œ ÛÛ9ÉÑF]—Yì]Oé2IUý`‘¢U/û`J÷­@ªq8¢‰œ³´;xû NÖý÷m±1¡µV“¼J°È€pûC\‚»e‚DŒ½þ±Ç­@/Š6âå1 ^5&†gûc&N}wzãlû-ÿðK²ùø‘±“Ý)˜æô¦×®³RllƒNSÙæÂÕ”a[Z‰ë¯E0Œüå\‘â©ot墕¡,ãý®·üñ–²#¿Z®EŠr£>§ÀÀ"š­Ë貕ɨìÇ¥^nBê”ÎušÔ‚R®Ï£=X.:¬É²ë—}O£)LøÓ¯Z€¯ˆN˜ã\/+*³@ÑA]§e¨^¿%™ìªývèõ¹F]5­Ü$3 ïÈÒukB„XÉ“ÜXMMnל`´qI-\U +ÏQÕ´š'%À@™†š^=* Ò5^tÎËïI;uûàYšèïû Õ[gg÷؃k¢tª»­s;”ôûé^Óh_‰½™¥ƒ…cVÚ Íÿ›ñL›¸wÐÚý&øÜã(#N×üNYwhá3g€hÐdXè uµÐ¤è0ˆš^{ÓWдá@²™Š:ÝX ã¾üc¡,:ÍÒÊšÃfÆf ¼W•âý‡ÿÐ(‡Qe¡ï‘¦ºÆ¥O¨#Líí,²…µ ‹L 9R(‚4¯¬ßj‡^?âaç`ÇÂkøÇ]ƒµª;¥_¯\‚¹E˜æ…#1µ©x —ýýðFͳãe¼ƒƒsÄ•ý:0Ú4ý§º6XgYˆö¾Ò¤ºw…‡ué3KkCš“_Ì$¥_ ÿ_œ3Üqé»ó‘œ•ƒ£c`úÙDP¶. ÚEeq­­,¨,½¤k• ­÷ˆúÞŠX%Ðë(Û©¬l}¼Qa­†S¡]5²j Ìx2U]2Þ¢Vüy²6âðñ†uc²½òøÑC‡=ý0 ¬ÆB Ë®OÈ),¹‰ÿ¸ ;.>áBñsÙMðÁ©Âs'bbã3óïËNCžfÚL¨]XS×ØÇòc‰‡=þ¢ylÐ1Ö|31õ¸äO&vÀ›D7Ξ€;õd]í‚¡º¨¤ ØJŠFßL3mDzŠÖçvè+ùæ)Z‹5ïÇQ Ï]-*¼œÁÑÄ®Fv|$).lËà”;÷Ùr½N `×Ì#ŽL›=iàÍ£¡Öú~gàc½Gœ˜Z‘תª^å Ô2ؽ ŸŒûáÑ#=}"­drµ®Æâ£8†éùüâ¼Sl üÙº™UAzá³^•­güU´‘J¿Oº–Ò![šF@|æí’¢ƒ¾æLǸՂ׸Ô].I1¯vŒ0ÚÖ&!éþØðêÕ«Ê7ïÇ–`áeyôEe‚6 ÃU¯ÞÔ~õÝ“¡´¯¶êmÄì)&çŸ#\7qÛgx|€W—­Ä” \(6fSÞô-ðjÒ•tBQÁEÊ×gRkG–çËâw'¢Í-2èŒÚq(ÐòPpä°â¨ªU¢à ‘àkœ_9†Ô5TäL4=#–qú…PÓ}'oR¹(ÚLw5V4®ß¦l¨©˜˜[¨SÞÔï‰ó¦ê«+_¾¬hë…êàMV¼­“ÉV€dºëY%ä¯Ûþ¦¼qÞ¹¥ïmêüg‰Û} AMeùÄœf¥_‡ÈlZÁæFmI/Îx²Ì3s.$Exáv2>ÎJ€¾û;hn 3ñ'k‰ZDJfvò^o_{ –Œ6’~¦»²×BÐ]àLv¿^==¶Ç"î‚ìGÉ1Kˆ²ž§Gw[ËÈAJ6a(ï:/*ÓümIºÈѦ>3Ü ìÒºnzÙ0<½öFß}?+œûÂP×òˆJ»t.Õ”¦™PÜÌÄã¹ò(È{ñ^– `kEÇm˜áwÇ×8|€X4ÕªIÕ›€àxÖÕˆUÕ‹:²¾O7Õ /ÇDŒ0Ú‚XªPp L]Ÿøbm@Î+ ¦êÆÖ ~ëõ$UÑG,ä¿‚™Ïd*«v Šºíåw즜Aïùq­/µæEº¹/¿yÛ“mwµ ¼zp|7•c·_Ÿ@Ú_Ü¥ æ¬AÅy‰íÆyD«ë·Äk7óåzm¶Hæã z¹¹~A7Œ‘e£¸©‚w¯Àïš×‡Üó5Á]{;½Æ-Xáÿ‘zÖ¡Ek|Ü঺î3µ„ÌzƒF›SËý$iìr·êÊ90Ú€kx$‹]3Üwí {‰6±h ½U$ 3ÿ#¡Mš< ‰ô®×6o=ÚÜòd;äƒhÓçÈÐvŒ<(µøÀr o¾çИ’Ž`ª“Ëf€‘ƶž·:›±‡÷˜Ý`ßAM;êűôM63ÐðÆ?RY:‹" l0Âh+» °<7ÕÕPëgFch¿í[‘£M(tH¶-$îÜmÀ—»_ž§0ôëF—Ù.ÓË{ÍcÏË5©$SƒÏzË“,å¹ìć YqC/}MdÙQ‡~¨z ØB¶KnœAb7Nð1ƒ÷>M‹frâıcÇ’â"hl´´cÓ+â-Іž_È,í&âc^ö ¢^@)OVFèdvOrw¯÷ŪÍ>Ô¸ŸžfHÖ É¶`Ád…©³ ”`ó #Œ6!ñJó‡Õô'Ý-×@´y¦Ð™`šÞ†pz[QŠªö:M Xh,&±¬ÚgDŠ12¢–KJt_,¯‹\;´$j<«ÄD_—,s™”¦ þ£X/½˜|¹ØȢǽÝm PàÚ|‚¶}לX^—p²£æÝ»˜*Puôß¾­Y–1ûzMjm€;Dóä&Ù3‚Áá¤ÌÒ fȳq{]­×½k3.ÃWáVÄÃ…õ«%¯Ò‚Pl¸žÆæðĘlƒF›ÒÂ>}¼ßá3Ÿ>¿_”«CÄ?ù4#·/tiáXg¯ß½{#+ÀÛÇö‚#ð%¥±~a×!µ+܆ê¾7íFJW îó`^Ïô70öŽ»Qx=Æ×ÄlßeD":é­kæwèFᵃÞF–2ù–‹'Äf\}þâYnZ¤Ñ|”Lx½7®^-¼qÞ@‹‘s,¶~f‚,¨>‘'®ËêÊ¿V*P`kEMªµ Å3ùÖÖ² °4ò–¬®•véæ‹gŽø›p|Ð\:+ƒ÷é†.²ãD¹AN)ϧ¡ìy¾8šËÕ¢BYý×ÚæÁ®.„{9Õ ¡Vâ‘ú,–n¦Ha„Ñšøïʃë’’’RÒÏ5 Á;¸SMñiyˆBÒWóàXjòéÜþR÷áä‹H.è7Že>ëþåIii©rJJÌ\B³"ˆ+Jò’SR î¿V]þD/o^LJI»^Z-» H†®åœ>z4)3¯d–šS“RRSAý)»¬ D‚‹Ç“ªJMNÊæ)¨,‚é¾ÔôLmú^ä›g®ëiþùc5Ó«’ÈlGî™T°Þ‚² PþQþÉãÇ.×Éå+qizBAíøÀ‡Y© ]MIN­ž«_Ž³a¾è ©~¼È^ؤ£¿!ytòÁŸ§ªP ‡/|kxo4éV+F…FSâðç`z©â•¼Ã6¸“ÕKÔ`„FRÜþL‡Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fa„Fëôÿ`˜1ä endstream endobj 692 0 obj << /Length 1513 /Filter /FlateDecode >> stream xÚ½XmÛ6 þž_á ÐèôbÉrº`[۵Æ®Íö¥+ÅVã;³å»åß²äŤw—ún= ’‰¤H>$e¬¼ý0]½f"ˆQ,¨æË ¢AJÆ,˜§Á§ñǦÊeÔdJ#9þ£Ö•›½i²TO¦_8ÂkUk·`ˆ"2ù<7z5ý3" Ä1Q„£ ÙŒ>}ÆA ôwF,–Ám»k„B˜G¿°W·¿U«ÀM>¼éq ‚ˆp$‰¸—sÂ#¾ç~ÄCˆ˜ .ø}§’!îÔÆ& ‡“¨CõÕÛ áÁO%¨vV¥0Ž¨åTz[tðÈê/@nœJ§/<¨Ê<.'P~@ÛªÊø+ÔwªÄdeÖM0¢‚Y»ŠÖѧDpq[ DÈ©UÒ"cH ¯ùû*+müx;ܹ-LfSU{dnb8o»³°’ãk{‘öÚ»[;-«Ômƒ ÔµÛs›™µ#*Gب"U¦¬vŽZ4 ¥Ú-n&”UÞhv%þp¢ G«T±òÊ,«rãˆÄL›ÒìŒÆ&ÓPòƒê h¡«Ú-ˆ;gJ· ÷壵š»´ªìI—µ±³BÏè›Z§ ‚G|ü± µÚýä¯ÌÜ•°ÎVkÛ€ØyÏ‚°Á%aK_xa]e…Kù cZÕÆ s÷£-S§Ø1WÙÆ‘ÝBü™ßÊj£ò|wî–uOy*€­²…âÆj¡Eå•VéÎ/ÜpgWf]•ÍjíI®jÏËì¶T`"µ3Ol=i' Ï¿´²œÀªjò"öVtìýγñF#ìÕ™8áx/ÓŸ[Úû/myÎ ½û´8¼¤¼±X ±AåAfÂ’>wyë‰y¶òÆd„BhŽì:#/‡U¨Ë tê'I‘¼ŸÅ—*Ôãso÷2é¥_kxšHêmò«6*µO“ÇçßÃkÆf-@lYuùÕ¬»déá3ÜB¯³"õ)WwG­Ü61†wxÖÍv[VfÏ4ól¾âm¾JTS{Ù™ñ£?ïJšÙbÝS3>äGÏU1=ÈU£Vmî™ó}ÚáørŒb†4ÊC0JcŒBöP“D‘ÂŒöÄaÔ1~ŒÒ8D!ñýÀÆÇã µÿõr+8˲ LþO@˜…¢*åâß?CÙë¾ü⠢õ8°ÿØú Ö¢ÁJúÞòýôú‰e§+'ʘü1yˆ÷úÀ¶C5þ)x¾$÷zYÛ'ù3¥“µN®÷€>nÚ·:Él¿“¸õÛ÷þh¶ÑSSNóÌ6ˆûæ„ã~ÇØì;èuçÃÞÃAu}wâ´7O—g‡'B8ì©KBx‘Äò$ù4Ó“r”fZ¾O“eˆ}UÒC Í¾q=øwÃ2ÌÅö9õp`qüdoUBc€\tÿg˜‹Âˆ’1F8B‡Ï]®zbž­\ð&‰âC <°J]nœS ŒùWU)?}aæaCüÀ|ö xH¡xùªNqÛV1¸°Œ"8×R\«­éjZyOPzç[ùx‚—°à.-YØ endstream endobj 689 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 141 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 32986 /Filter /FlateDecode >> stream xÚì½w\TÏ–/zÞ罿æÝû¹Ÿûî¼™;ïΙ3sîù©d:çH79ç(HT@‚"*H0‹˜³˜PŠ%(*9*(9#’sè´÷Û¡»énºáüÂôúvｫvÕªªo­µjU-Ô’–´¤%-iIKZÒ’–´¤%-iIKZÒ’–´¤%-iIKZÒ’–´¤%-ié? ¿ú•K¢îŽ¬P€Bþª)³ô–Bµ€•Ÿ4WPÏ%•„Àê﯉á¿>k*ÒŠ¾ñͲkÎ Ðt_á‘êšQí£oÔP“ío¢ùàÊ^%7 ðÓ;ËO¥Éç:v×€Ÿ£ G>ï=™ÿã†ÀÜ`™»›mj‚#³°dÎþ È“/¼×¹ûUñÝ®Þ_+GPVŠ³ŽDš³Hëõõ×ër­]O>þ còóu:të%Öwg` ¢O=…~µ¾:cŒÇk ÷ôó’†~dêêÙí¸&ÿ-Œq˜ñ%ú†X<~9#<ÞõrÇhNßÄbqèô€c»íž;¾ÑC g­/Ó-X4—#3,›´š)èþ>7+#œ7ˆ 3Ž7\ÇâLzfÀéV¶1æzãtÛUô5 Å¢µÃ9…Áy7=C#^1+êƃÐ'ÚßœÃàñ !ªž!ÖÉ{{ÿ"\¤Ïãˆ)åsòÁÖ•Fß®Xð'¡ cLíð‚¼‚on'ð6îZS$[h#¯ny0_vø[\•¾šzAÂa‹‹ÇïÌ›zÞ^µ‚x¬çδ_¨á>gÇÒ/ŠþÁ-Œ¡b/·Î·¤:1“  FàèèaðJ­cu¬~¾$Þ·>·ÜWIŒM"à罩¢PŒëM`Åœ³"°*ÔÃ#õ™v×Vb´ZÈV¾)ÜÏ7:T: MÖ‡ÀÉ:úëˇaаڀÉVL7hÓ­…¯²œ™V[>}™Eô6r)Æ©/Z_C6ÆL?sFÉìr¹Ó£\­L,bÎåA×m¯Ï›8lY3š7qˆv.|Òµê)”wÁ“Jž€Ñ¦‘±Ô¢¹]>ßL¢…W[k`%ÓÕ„O@±€êgÁÙÜ‚²UÅŒ¹D£œNñp}fð݉‰Œt)SBð°}ĽZµ½äI’7è<šÙÅ-\¯ýO_)Û»ÑdïS…ó>Xâ¹.5\í,¿Èµ V¸·˜ìoíyðtÕ\tÊÄb#f·$ûh÷õh^b†¼’…Q:•þæ˜oéò§ïì³ LX ÚDrY‘><»Ä§rö]sÓOªAѦˆŠãÏiN]ëdvôÕZ›oñP½œ_,Ö’)–3k«V+ #kyVxÍÓQôæ»›\—=èuõ™@Cû£¸Õ °{Ÿ¢øÀgª†æaðý£Ž°´9ñ&‘ÌB{åÑ-fÑg‹Áñ:CcBĽ~ômG³æQ¥Þ˜¿kD8‘v‚·=gV$ŸG¾Xëb<«*“QUÅNB›Ž‡Ç°N;V³¥ñ†bø#C:¬OÝD–¹)ÝRõ!jøƒœC¡r´aYzÖÖTË©²¾]² ÚèØA v9„pâ­ŠlÃÒ'f½®—çSU]»(ù6Ú@tå`ıìäR´…ŒIi‚KjÁgÚí—vïƒ.òC•±ÄEŒ¡7c·¸9þ¡avœKå=?B¶yÒ19˜»ßØrÇ نFà•/÷ƒªš÷¢5  D»7ûg¾GeÄÙ@ÿÞ 4&ñxò¦«ŸÐ6ò rÞÍ||ÊôGïLT¤X§ˆ$TX×#¾œG­”€9é}éÓ¥$}ÝÝwZá)d¨˜Î°IÀâm–Žç«Ñ”EWbSïµ3}zZ‚”âkI g|³*‡¤­®¢k\´¢´ótqi/ßU+4ϬPò £Í\aÃùVi{®¸¡²MlûxvrW°›i°»JJí˜zäO 0ÚlÀ8ŒÉ1žÏŠ}9 ˜oíýmþ Êžµ§çQš[Çêô°æƒ2§¸X†=hT&’áÆÛ} èÆèmH¸ñAî/6X'¿ @ùÒq†ÚÔg¤mŠ_Y5WŠN.l~ÑBó#ÄË­p¿Jræ=|?š½w³mhl^`À2y„ž­Š68#E%´ábIž›–sòÜ2$Z‹l÷¯Î–²W%…ÅEûì0A÷`û”úªK:_O2‹>Ízàø‡K v¢×ð±ìnÁ k¸Š!írô «&¤²M;T»ÆÓt»ÐçMHfÃbð^òæ©I!hËo¢yö{áOÕ¤ J °f9oyRô¦¶¾î¨qà}mL¨å=Óè 7’ÌQ´“Рh™}Íåï/TÌd¼ãD†Ï‹“5 0?5œq(Kfyl;¾¸b úÓS™œ5ŽU±h¤Ži‰FM Ir?ÖÕþ`nNª·[ôeeþû4);Û/à°®_ÅRì’¡ |½É’yêuoßeMªèˆ5ÎrBÈÅÅŽ‚3xÝ+øQh€c%D}^“øgФ þÀ¡™oŠ{^ZV÷þ]$W'õí<Œ6$΀XúF˜'FHž.iÌH3Ú̸‘t6Ãeíèàäþyý%›~ö†¿THým€©æøWcc KÜmdV(÷·aÿ¡a£EÆƾ È·2âüÂOÀk¸-/Oa1X%2L¼Qªg0ÿf:¢°Ló0Œ‚12DümÞQuõU2ÂÃäÆ’ú‹;0~ûÕfÚWžÉ¡àilËŒ²¾‰–§FF¸usªñ›n)Ú¤íbnI-“2oá°¶>íX‹gÃ*Nb‹ÃÍÛ}¬°…H°ðŠî˜€Áy¯³…‘r0bÙ<mJs>ùFVi8ÓçÇ]Øv1òÜ w:SvÞU´›¹èè©pCg¯ö·9Cæy+–¤ñJäßÞv},H1uMQ¨ÂœÓˆ—ýˆçþÇ–k]*(d¶ádnïÛ[ † -ˆ1Ôkª•mB(„‡íãò_«2ÖéèíªDÑæ9ÞØX¹¼Æ6ž©ò—sÃ-Éyjý$>楈LS—’–ÉOù'uuñ7? mÐ'÷ËÐ&ЗV(õhy‘¶òRÛ6'ôã‹`G hܱ(Æ}èbxýÿ3®Cʸ4Þn„'Áš”pòxŒ/…D PèÛOÜ_Bršh+2'c tó;µÃ^4m–ÂqÞþtb/Z™ëtTZGOßwQö¸íÉiC»-¿ŒØjPk~„І²Q¤ÑgÐôø×X.É~AsZéa£éÞše3Ì÷û+½¦è ˜Ý*¾Ä«,õhvmÕ˜f•/®ê6ŠP.øŸ†ë›ý4/i¦ýUé~·†¿Å >½€†ÚiÎ Xé>¤ !Õ\|Ëwk•æ44"¸ª/ñ*-¾†æ”›¾xÅØr§_mÛõUÜd:…¯h}yñWñð Tø¹AnÿýùúO>΃€zn|£¶kvÏþ;Ñ ´ùBÐfþ›¯IÆ~¥êàü@~^þse*ÈÏ›ýšlÏgß¼ìÌÞ|õø3y“ ¦¾N‹À?U–>W¥‚×ÆÝRµÖäÙåOæŠ48ÈBrýù ÖžÜÁïçÜRÝñ6þÑ·³2ãÂ\ÎÉ‹¿Ä~ƒ_…f{2I~\ÚÅáÌì¼ßzÿži»•qç® ee N ÍRIæs2ïæ—6ü†æß$å=¹¯Úvwï<(ûú벬¥öEöã|HÉÓ¼Y „S÷ï?ø£ñ«^æß¿wïYQùðëoxÔ’–´¤¥_G_øÎG«ì·ÕdÁШ鯾'W¢¿jžk³N}k¯/°Fó–´¤¥ïÕÙ?Ýûëz¢?ü•=€w÷ë#dddˆcZ_Í'¤ãU03”q|'o¨¯¯Ï°ðÈ*i+Ì…&ì_×èã(6ŠŸ‹´7ÖµˆZÔ€$ý8-YÆs–ÿ*]#X¦&ìÿ\÷Vy¯Úd®÷ÿâ_„.¢\ åt®Aõëú«qô›¯ ÞàttZ9ìz?0» ,Oõ~š×¢‘–´ô=² 0ù‘Â2Q|ö05Ò-áÊò Ãuf,ÊÅÄ_h¡Åoè}µô.ôV9X°Ù‘b¹I‰9LSe¡÷.Î26ÆÖ(ý³Döžd+‡ejBßy¿AžêŠ«ÞÞZµõ3{=¾rF½çO;û¬GeAp2׃!óÆ”j®Î/NPAÓg É~^ˆ¢˜:ª•æÐí)æäbPkEÑ’–ÖNs_j!´YT8dB—¸‹ŠÃ«$Ò”¹ v•?ëá¸{Ùqùÿ”‹ðüó˜bžCMwåhÑ¥­î;n–¿¹ºÓ=ú¼,Km˜/»«M±˜ú šÓZÐþÞó`ûë h¡^¿•æÈÛI(—ÉÏ/¼¬ØD%dßM© ‚6£‚*Þ¸wZº}Yø9û¯E%Ù¦‚f@ï^’‚p Ú€b3--ìâùø@™ÄàÙß«€¥©tO#*N¡Pbʧ´]HKZúYиc̹›îÁî‹›9:i¯ÆTdƒ#.nת5£Í´Qï-$4Œ¼5ÄÊ|q´Éíž®Lõ§n–ÊQkE›Â0#—t´™ŽàîÊé…ÑñŒÎIT›ücáÜ͇—eL²æìx!õ³zt2401 \6½2MîÁ!+ï#(‚L9¡éµP™AÉ 7E÷Ø‹1P0ÄÇ0—@‰V°Ñ’–~ÚD1,í#·ÂbmÁ3&ûŒ  Æ]ðr:TW¿ó£lØqùjÑ‹™áFîR‘æ¢."½uH‚ÑÙæbƒ¿\ÜóãÐæRqßI_JèEë$>L¬nÙ‹½ÜuÌf`Y“}>#‡!: 8œ©ŸÓ§ªIqÈd&Kbšß«B6° ºXüàœÔ×*÷l´ëö³ dB›Bm÷Ñ’–~ªlcq¨·³½½½£øŒÝ4V U›€Ö†«o§”ü…A𔇕Óå M²¿½‰SHÔþ}í rá:‡,Ë60Ú€s× ‰^ã?mMÌù&†ÆÌÂ1TÇp ™„™LÒûaCÖ ¢Ý°1Á—uÍ‚-Æ{TÈ6}2‡óÅÉN/ædƒ@2SF#šL¥5‡8! ¨E-iéçÔ¤`D4c'{'ݳs2ÊÙ=éÖ²Ý9Æ–K|òqD4Ü–õ¨}íËûÛ,SdOët͈—_&=«º¼ÀÜú|Zm‹MŒSÐÉ'Þ߇6¬í§ ?Db+­ÁàË.áwÚÁѧfLÏQç™ÞjsÙFuaƉ=6–6áq'EŠ§V‚‚Ú<« u駘upÙ•Õ.5N‹š¬Ù.ã çD{ج)¼8ø>ÿ¼Ÿ›x¡€eî1ûwÒ+•Ž…\IEç<¶«S½ÛuŸlý-»ì¹éPÚ„o¯û|ýÝ©¤š V´)¨=öãBÕ)d[¿ãòÞ×v6À<%ºhéÖpVçª'… ¿®åOàþ&ŽÍØÅîú®·ÄKÃý}0õÖå_&¥H&P¡š'bˆÉ7 ºº»Û?×EÙâL¬|çDª€3Òx…j¶Ƙál¢Õ°ÚLw•‘¸–ˆð‚;ŸõyÿàààÀÀó+qÆTûn°Mð6s±ñJ}¨iˆ~³ÿ#'>»cI¥3è™á]LcûiÜfmÓ¥)ÑŒQçJÅÀd£éÛ‘ .¼ÙÁeõi~œ—j齯Rõnû­uŒ8Ã׶Žõ¸XrÞÁ=®ø»‹óõõ²ë’2ÖÔŸ :t¿þe‚?ædN-þ´9à~ÒKo“N9ÚÝØyñ)– Tíß½5&©¢wNmÄ_ #·l›.s¾øæ® H0»¯¯Sv§··ߌ;xqRÑÆßçè]Å97Ën~X{ìð:g_*Ümóß\ýeNi„‹ÇœIäôèÙUÐføÑû²@í’ª¼¼Ž)‰¬ urè_†ßâõí5,Z½9½7ãÛý âÓôÄË14®+¸Ð{þ`\XXäùû¯å|+Ê:½koyŒ7öø±HÌÀ°ðl$Hòhã󄘨­[·]Ï{/G›ªª²ÏEDF½š+-” mÞ?NÜŸŽH°s­'öÆnݺõðù;s2´ñLxÙZpJ˜|=Š.@]^ܶ­Ñ1‰¥-S²ÂÁÑ÷…»¶GÄ&Ÿ¬VA›Þû‡ìÍLìÝý®Â§Æ› ÷lÛ¹ãÎËÍ߬/¸¹=.·¶Gþæ‹Ûg##¶Æ¾0‰žðµ28þòTwaxÌž‚Ãá‡^,;ufÊ,wøÎu—ï‹ŒˆŒ}\=€Vè+ NÎúÚôdK,¼Û·èPäÞǽZY;Ú¸‡_|›ÄFe´¹Ç8Ç•[,"3sŠÞV”>å‘ðOGäh#™þd†Åw/‚ cóV<7ü 1m0/€fµñ£7½}=iÛœÍwÜÒ,Û¨¢Íakºk:Ü©Æs×1¢„+Ýt”ݾ6>¦YûJGÄ*h ²É¸ä´'³€ªNý÷î¨;k7\÷}~””œµxóúTdÒÍÚoO} _iDV'gf~>&viaA €-o#«¼>Ô]e‡1N¯jh¯—Ë6—"ì-·­iøP]r—‹Áç´ƒEûL6^AŽ×˜+çÛÙú\A6¦ÍÕ`±nó ˜~¦töö·›ãŒÏd—|x_ŸºÕÅ~Ç%Xñ9ì`u±¦¾¡ª4‹1(hmzD2ä½jëYg;²ôôÙy¯«ÞÕV„Ø0ïÂ[\óŽÙ°,}NÜ}Q[S¶Ýšä’úV.Û@_²rŒ¯„<<îÖ³× õ÷…;îƒÑæ‚3ÇÚ?%#NhCu= çV±—jå÷º¦±öÍ3;œñ T©/¤3‹ªk_Çú[áYŠh³4:ímþQ÷—‰Î× tëâÊú†Ú·!\lD†FU½ëvÍ'¹¢î]]åËM¦˜CyPŽùð÷\©ÿ¾äÞq"Í®‚Å¡|ŠeÄÖ}åÕõãïŽQ8B˜wÐ?Í\]rÝ<8P›E$óóßÖ½«.õ¥c!¨Ò›iH·ß›ZQ‡“.9ºí@nŸF¾mÂÒ ùñ”'=1¡¬@ ÛŸèvµCKž¼xßÂh#ǼÙÆ·j'U„J9Ú|ɤóc%èÓOçÖ1bÄš5)›°„ùÏ Ê}úøâ‘h#’uï<,=Õ#ÿfE*omrØ’)ÅÍhÏiïžEnrÒýáolk·½Ç.×uʃZ\JQ;ìÛÜš}„ê»Où ¯Š ‹ŠJNE{‡ì¹TRTTXüfiµ ÷ñð{ß-hPÄTplÂÕب*Èd³m$£*®kZŒ&y|*Ð+&m¤!“ç˜ N·¼÷½­â˜&@ êÏ?Ã=¢˜WÙN²<VMŽ‰vÉÞ0øfƒ´&3³BøÈzfý¨°87:ˆÄ`‰Ä­iÛh‘Q´±ó= Ífø.ÄÒQ±*Úˆç:(TVë¤L!œ™GÐÆÉÞ_*¿-”FX†.‚8:÷?Ik=Yw”a‘,À—±¶œ¤B”1£Õ÷ô*,Ýd}<0qÈF'öш”}× ÆΓô˜g¡<ûCOÐkÑÒÂ’H2ÛSãXË_Ø»ÉòDîpø¹Ž§‘¯$‚IÒƒÄ kI¥n¹]µ×Û•/S‡3±„ÍpÝúîèèòZUCiUªïBXêf -ÓâvU´Y #XR±ÛèQc=‰ÖþçWr[ m¼³¤ƒ¾3m=-R mø®~ÉI‰‰‰Iaž\®Cü¬LFh¹eèrTíU¼ù$Žíqô“ôÞjvyi%ÍÕ%ÇBñ¤;-p¹Ä=·¨xvqe]uuõûªûTR‘b0Hpì`B|BBâfwÇበq )«Ÿ¢õ<˜àysbö ´™«¤Xcé®óº»)Ü xH!², ñ‘dI?)ñ5§7Ïû½ö¤T,è>;S†…­³³3/Û kxµ\© p6Õ%pw8[öÁ´Ï´G¹qM,íÜ=<œ-yì­PMÊ+ñµ”Ñ’VθcNmÊ!n>L‰aátÌ\Ò²ž pí6¢Ú݆Póõ[áp–ÎHog;sÙ\€).a?È–JuÈnÐfÜYÏðö€,¨’èë×`5unÛh§‹!‡î>RT/s ¼»Ca0œ¥w6¡’<Îä£Ï×½æ¤IrÑ•ófÆNöåBž'<0Æ<;4 ”ÈÆHß»£Í:rð¢8~ÚÀmøñÂF‚×ù– !æGÑFÏÆ﬜S2‹ èchG2^ØÒHW&UF¾2Úd® m¤šôÁd•Dk˜’EO–Ñöûy¥ÐZ}5¯g”v_?ÚÉô:Ñ"-ÇìKª!½gqYEi~DãÇ$ fÆæEŠ°õ椅]ÐM¨¿v¤Úû…Hi³§£é¦„œ©I!TFv¿Öý#Ñf¡‘A  /I+]~{¿ÙfHªì`kg—T¶Åá~ãH [2¡Äÿ3n¦›Ñó W,î€âɼ[ÇydƒŒÊ/ h#¹hgd—"]`j¿C “¢gÜ )›ÄYbÏ ´‘›x[köFz™E Õ  $çŒØèW®ˆ{ÚÓ2àNZ@Qg¡Õ]ÚLûaô.uÈ:  ž‰%õ/j^hCô°7¯ÚsñÛ®}þ˜Ã°t_a”†ÐÆ[.zŠ:.á¹ TË1äwÃÓÒLVÿÆð BJˆ@ ?Q¶AšÉÍŒšãjy䩢ݦ>Õ†î{ mÅkaŽî'Ÿ‚CR»Í|1•B\”€?Ú Ôr}#‰µU ÕÁÀƒ&ÖAæR”˜è­¤Ph%²ÙÒU×Ë.NÛråÃÊÛœ|ì‘Ì–+ž=îsŒÊîìµÖ3OžZ^N[<í…÷<úN²8D§Q{f¤ö!è³3  8>⶛Ò[Òkº·xjr =¾O¸075+ï¿âÓ6¸媫6±pv~áÛh ,˜¤WÒ:ž‰2‰H-‚.šoxd>¥¹^x3UzúËdZ¥ùÙE!\¡{› mŽJ±X0œiUKÙiç'ezlZ¸ûÎŒ·àRYב½„1 âÞÔ\$ٱќvѤlÍ·¢I¦Þ&`¨ +ì6‚‘úÓ·ä«ä½¦:ô&‰´¸ïA>x·IZÛ®ò²VXútÂëu½Ysç †í)€wòŠ'e,…Ð&õ!ÜŽ·#>^IçºÇá8ÓdMCþEÆùöQ)h•ÝJv: N¶H& ÒžXòøñ—‘Ú “_t"È|.zïþŽGR‘T+m(¬C€Y m¨Åçb-Œ¬mÜÂ./ÏõÝ7édŠÍQD¶ÙÍAÑF"œ²æ²iVÞ6L2Ѷ}–mÖQ|Ð!ûáœ;Ádç’ÞÜT@šW†mÖÑ"V  ÛZ•©‹ö,zLn— gwû˜Ò©$•EÅl^ƇiPÙnÜSu›k¿ý'}mÇ¡HTS‹H¡ÚyÆËE³]n6T2ÑÌÎÙÕÁzÁÆ^9êºçK5Û§Äp~+E7ùÍüê+à¢Ùf*‰0<w¹7©áÄ “Ò Çxxzý‚ªÆ7X~ÇØÔs%Ú¸"hÓ¤O„ÑÊü剸ug‚µ)Ý9=\göË[ …U‚ž!~ÏÃâ¡»ÔE¹º>·ÐE¹[QÌœvíŒ6¥BöÃ/ÔœßH§Â¢cC½­È$.7r‚áX{¦Ž÷?ÛΠã“L蔺——0FÌ}÷Ë šÛ†œ¦™úìÙNc02>Ž¢Vâ[¥hWˆ¦-xlDZ±Ûx†÷¾;RMjw‘ mvš…¸#îÊg‰¶¾[£‚<ÈL³RéÖÿi73ßÞ+ÄÛ:(2Ò˜ì1L0õ™L¡Œ#]ê~|Žeœ|œnæ’)öA1±a^ »qL}(H8F}N,•ˆ÷ÛèJ 0¶Ãù´>ˆaÐÈá1»<Íè$îxéîëóuD¯…„w‚-IDlÞ©˜l5¥P¹.Á±4:3«i E›–ÑFrÝ cu¢Y #kõ$‰â¨…£w'€l®GïKä.abä%@öHiC´<YŠIT?.ÿ–r1–Ë¡ðÅ2¨šæúhXN§TsR*³¬€,TÂò}Yùå¨VdU.WÍ-ÁXkƒï©.…èèF·•ÙÈ )ûär†²üH¸ H–ÛX~P­ûŠ;€B‘ßò§Àr~I!š»­ãr+¯lše¾)rT˜(Þ–“I2½X“h»\låò¶Tg·U~å=@M‡dE•uåªÉ"z+§N·xÞêÖÂÈBjÍÝeºñø«{]ÁŸ_ØÁ"^mS³Ñ|±£Ðjómmc­Bâ…a’ùAñ·6é?êÑÏKuÇ쫦´šÔB! Ö^.ú·?ìúÕ “{ÐÉåÀ @‚Z/Ôo`õÚxÔtG ÐT‰úe^ôwìrÚÖÔöSàW-†¶þ=[û×”m´ô}m¶âê;LjÚ•ß=Þ~±úÛù«UÿÝÊ!€&®+ù©o@OVtÏ’ðw®ëòw•*¤\kÕ²iÞ ¬¨Êù@HÁ—[bê8.â0†ÍãKßÝ âE<Æà㨲÷ÃXýÿø 9ŒX|ëvÑZ4Û$¯uQ—>ý„ÞJ'oÞ-Sm¢ÞÜÿúf¿¸l €sMµ£ß•hü±ë?s/þ*sÌbgyI}ï÷¦šÿ\TÑ¢ÏB0öÊPßJ‚˜/ïíY§O+ú² µ;X—ß¡ïn2ú—U‹èèúøâ–¿Ý:è_3— ûo¤g;Ô§á¨òq÷öúNc¦{ëÔr£Š&_êY@½Íû—×}¢¿#×Zð!öƒàö¿ž†kJf ©K0’M[odÕ·°Œ·œþ^ ÿ¾ëEa.“AP’uÊÙ”ú7¨Öë œw¼jC½>þeÝ«)i•}/‰ô2ë†ÿxrMï«kŸíH+.°Ô–‰%uçúÊ/`\ŽÈâE6“úi\ “Û©Œµ³Ât·ÚD¨?=XM°ï¥ÁR¶]ÊŠ2«—mVÙÓ·ú›+Oº@ï<Þî’VÚj8 cµl•wª®üÜŠITmIÔ-Ó€¦ùñíɈ¤›Õ †#¦ ¥Í‹÷>SТøIáô{%ó®ãÆI0çh„……5×e§¼™Þ%Z:ß@·y BéëÏ×ÂÓYwa –À¿[&E˜æÂk\¬î™býÓY¦^RÃÌãƒd®[ÏœR!ųid!zpêÆAuÌ4´«ֲ֮ʧ]ƒàW¾‘Íp3¾ GfG›3Ùn— 7vYó=칞‡žÊ¿}×ÇhÇ[mñ,OT¡éŸñ£ð¼J[¥¬Kn$ +ûç`—Âõ¸·ÓpZÁp[{£~ö§Ž”\ÅS4:ab;.ÉÐl)Í´áP¨T ß1¸¢kjq¤ÒÀÐdQ W¿õò–ý«Ù’|è]6†í‰ÚTV>q·`b¶½ãÎXãŸuXSÂQ&B£Ò¨DZçøõc¡—‹L¡PÙV·^¶" Úƒ_÷o†áê`€ÑÎkPO•Þ:Ä¢‘©’…Wt ìV~m*ò¶FZÞ,‘öö¦¢tkJ&9%uOŠæ;+d Fg2Mçg¼¾üÿ©g'‚+»vùÙ©T"‰–”ö\¨A»Z,ÝùgóÔgWöXð9Tšé½Jx|Íq7)ˆóân„ÃÊôÕ纚BÕ¢±-¼ ›à¹¾éˆ‘Jc0îG²@p.óh…D¢Q¨AIW¦Å€¦Ž3‘»ñ?,¯Bázgo?1ÃënÏáókI4"ƒ£É|TE`ðÉÏ'U‡ÆÂPj´#srë`–¼Î:ʦ’ ¶8…$wM­™“Ls;Xq(—ÏãÒ¬ýÛ&…ÝW#ñ*N·†Áyaèã6O *Få8<­Cövdþ eKSÉ%G+>D>|·úÚç>¤Ž®{Ó¿”\þÓ û‹ý¾'% ìÓµ><¾ëüã=æØø§èô¤m„Ã|}Âê%E塹üEcß„"Ú ”_¤°¬ºfT†<( ú‡¤åÝ›}:`g(q¨Ñ?Æ<W|gáåö³<ùär܈t³ìª>ôSâ©ÎÝ›lˆ<ÃÊ· öñüÓ6©ÔÇ„ÈÚcïçW™v&t ™d·)®™@燫tô ¦…PçÃ|v/€àõDß—`DZãÊáì²2yÚúÑ…lûyý´™)£¬ÇB\‘kUП‚¬ì¾é%)ÚÌ@bÛg+c£¯FÿˆZ\Ÿî—×xcE&Ûôeá ¸Ÿ§¶ñ÷Ù8–͸µY/2†÷úÚÚÙYd"Û¦Ê.8¹¥|€:›Å ù¢'Eá†IŸÁ‰dk8îËD:zð‚$¾þQ'Úï-­]áÆæ óó§áÒàñ­ŒäÛíSÍ/æRw”é7G8›n@AŒu;[Â!+kød*Qg:™dñŠïïî'»DÃèW¾ßDU¶zmÑŠÔW2Ü‚Ž ÷vÚæÔª—TÅõ‡qƆ÷ßÏ 2m™1Õ*çôë0*™ûÝ8ZŒ×¡½Ft&ñH9…F†žÁÝ^fWJáêåÝh·-˜Ä¥Gäij€Éç[Œ]áÕð¸>Ó%½Ùöl7Çu}¬(×ßÂjj s?«ÆÉÛéj“Žœ?3TaŒ3…Þ~“Lãx¢zkåùH#ǽÐÅ‹³Nt¾3êcY•`EŽ„(Ÿ‹qÚwI+²ÐÇŸ­Aw¦´št+úà—džFûsá›Ký.Á¹î °:—k»sÃ]ù/+Wp ´‰:–»Ðñ Ï´žÖ ÛÌ÷TaV‹„m¼'[r(dF׬Ô$(.v€wŹMCJ~£âÚýxcÃœ&¸RKÝ¥FTk8D" r§R¿‚ç”Æ›ºXW¨ ß^ua˜¸¢ûÝ€Þ,žß‹ØZr‘ì‚ᬖ&ò …Ë.N²ïöXÎòc—5ïNã—îìdŒC¼Xƒl3½_×b·†Ž¡ þíðWO¢nÒãÞ?ðêBë‹Ë<ï´>õ´LÉ•5夋îz?xÛ‹~ÙåB³~ykoÌù¨óìbâò§PMŠV20ƒö„§'·;í< NÃh5öRëy"}Ú¢­±‘gž/ –D`¥èŠ¢Í|ç[•WØ:¾¸$?ÜnƒÝzªN(–&¼îÅq»ùA$X‚u™¯#׈ÀÞÒ½\ÛCªm%C›¼Ã+ernA(¯b9¿;¤C–3ãcˆ½ÔμÞJdÇ££½ü\,'ú´Œ?K$òñðë;=Í.}†æÕòúóMRýOSŠ ÇÚ¡„¯gÀÛ>ÏLÕ3“¿6²\–‚(wÞ‘‡ê÷q#²MˆlÄN¹`¯ôÀ² ÁYŠ6çbÙQ§düYô'‘O(Ë6[ÈëÏ}”Ê6’ñ*ÞüÛ²Í2Úˆó ¢^ÎÊWF%ûݨ5^¯fDnF‡Ï'=iÌ‘•í{=¡zñh3ܘKµtQÍûË㟆6p‰FêÏÓ9žuûlUí6À¤˜5¨8Þ²†Ÿ¡b%~}Äà žø~+,Û·ÈqÒU{­’mÚ˜Òè" ç Œ6÷‚Ì]®Õ¯ÅÂÑ{ãLÙñŽ2´œÛê}âi0VÕn#næëé]ªYì6÷".”÷É­Ä°ÖýKæ¼™üO"Û,ý÷ðܤ«Ôeâ96ˆ qå0ÜM˜o:á‘ui‡•G„ÇΧcR´a18‘Ò=•‘–ûvèUAû%Þ™xk-¨®=ÒÖ›âãh°Em¡øùóe»MfקçGÝB¤ÁŽëÆF…‚F(a·toç´)ŽZ> ZÓH$‹!dÏ5?b9À‡ûõ¾9À1‹•Ú†ËžÞ.j–£ .ø²Ìr¤'øšyX¯ mpÆF7«a}d¶%C·‚zÁ2ÚÀ; ^tho«¤p°„B¥Nˆàòïô²8þÀGGýì¶Hä¹äÇ5‘ôµ¡ Øút'Ó2½ö·¦ž+¨/ÉkQµÛĺ˜žFFÊh-ÖõQŽ”í§r¼PV•ž Ç{Á§Y®DX“‚æ„Ë%H»|áëáOWIM!îæ/šÇ5¡M’¿õáGðs#ÝÏK«W‘m-E¢d ‚½ Ë5]uMjôÃ},‘]ºO¼ôÚ¢éYç¢Ú G8úZ™l>®æ04¾Ìkþ*PA<Æ(³n¤éæ'Æ [d£«ÈJÝ•/Oˆ>ß×Õ·îWD”t¥ñüÄn³Ôñ‚m·e ±Û¼xQ"RÚ.€sŸˆTgù"—mÛDÅØZPV®I•_ÅRx^HÝ×Í RÉh<»À2ä¬?(§î¼Fúúf‘—!>+5šF¡Ð¨ô¨Ô; º€|M*Ê“ú@vÖ. |v9Áa0Äý׋óž…A¸=R<¥º&5?xx« ‹#²lrªP¡xu”C§B_÷Š>68 36÷¨‰}Œt… <üßð¤¡ò›8}ÎÆ$xÙe°!ÂéS$ªÉùÇ5ĦùO:.2´™Ö×7lš‚[µ·ð¬±¾?ôì@iÚßN+ktwߦ ý—&fšpF–—Q`øüóñJ©¿Í×Öª]Nº:ºtŒ¼£7‘ýÞ_wC±S0XMm25pOÊXE Çÿ¯Ä¼ UÙÆ:õñ¥8¸I¼ìê~éšÔDÛs<O3÷,m…ÀWgÍÌBså ?§[² NE6±xÛ:*[“ÒGÖ¤–©«øÓ%Aþ3‚IL¯ï—×z¨úößÖ鄽‚ÑæŽ'‰qHîo¶Uå9ñ×­×Ñ5 F¼>0‹š?áþùo/§–mtÏ’m è®ãK,´Qg‡Tãu £[ÉQD½ƒÊZ`Õ75ÔHÍW¾áK xò kXc|zòLó »Ùám ÑßFƒc²†èòÊEZ­Ö*œY“/±ò`µô; ©w9}Óš› Gêëêß)S}}ÝLÕÁ ¦fLŸë«¯WýÖ»w ¢5‹Êų…ÚFÕ@oݬ´›ÑrFK¿úúzÇ®øŠßÕݳóè“ŸY„ìz°;nê·“çÄÚ¹ë!I÷“©¹Z>hIKZÒ’–÷®®Üߪ¨w«S»5 î7¿¢¢Úƒ«<ÁŬ«ÿ‚:ÊÍÜ;kB'‰Ds§€¢Ö1@ÁZ*ê.\§£|«T¿¡l+N È–n"päQId2+l'žHrÄá‰Î›÷Ž/©Ù8.˜îOr"‰Ž!Éc ð §·áHd>c`¦=—Ž'R£áµÝñOEÞVlŽàºï |NûraúoEâe×Ê‹ˆhÜ°t53z\?•w,Òe÷ak‘>Ûñ;øøéŸÉÀOî€D<;·øóŽ0áÂì˜V%þ{ÿߡˉgQ³•‡¹ÑÚµïÊwÿ…{éo‚ùm ƒ?Íw<¬ìK°`õNO]¿[Š?ÐÖÓj•ÑÆ‚bÔ/±VFþ¡è1Ûý’I§>îXvHÊ=íçâǰݤf,Í·¥Ý«ì«¹¶ãí|í“+ ÐÝ‚öªm™Û¦(º‰9°ƒ_÷‹ƒ4šý¢XÙÀ¿ÔË7ÄíÎã||º…ÇyNJˆ“t²uxÈé ‹Dò…ψûqû5¼«rvžx}5–fí©Š®So:2 LTÓØÛ…Ð…`I,ËÓâƒÜ“ô”­<¿ƒ‰-iëX1ÀOp¦·œmwägEñ!sjË !Lý$ÂÅ¥¿Ã1’ë®”J$ôÂp µ•¦ýÉIÿćÚAú‡!ñâTÑýË\9jÿŶ/SàR£F´Yª§®c6òPÚàhgç¬4Îìnà¨O,Ÿžµ3 ”̬èÒQ[í‹š‰ÍÖ¢ºN(mà é°N;¤cA²äL§Î)&¬¼G±Û(,–´üæQD¡ 0ïN¤½Ÿ‡]#¦Úß•|ì—ËG=¼ùjÇô™òUåöënž°|´Ù“ÿüÃdÓ­=[Žä‚CÕX3x/ °13雫ˆi_ª2ݬø¦vKºçUЦæ^ªßÔÌîdιôØ\tÍÙÚÔÔÜ*éâé͉†h?'ç¾·oœë(£±9t‹Ïç›ñ¸ðµVÒ[DàÌ-õ³Ì\–æ›|íø&|»{õCò’ôWÞõ°153·¿ô¼½U~*Æ<æt}ÅÊ ÑMxüýïæì¬Lû{+œÍ…Í0oßçžw071³p8û¸e¬¨>•è,õ®|uc¿5Ÿgfát©@êãíË+ùüõô6o×tû±ûjUÉü‹ V|ž¹•ëÍW=ò`ß⡺­Þ&f¶§r˜¿áL&Æåñc^lõáç5Lt<:É ^^ ìÍ`ùg êSH®ç‡_œ¦2XLÇ!0*Ëœ5 -1ØìR~×—·YHíþ])ì@Eªçù²jkÛmÈÖÙÆUd›¶[¿èæ¡•Ñý×ñè8Åv|ª½êa¹%[e …~L·Ùzì9åBo@¼ÇähS|1Îy§<¯ä‚3=¬H !zË2éNþòom³7Ýÿq³Pƒ6JÖ˜'Ç7³ícÁ•hc€¢ ¼¹2’N­›ÁÄÇ–”Û0JÄ"1,9 E¨æ8yêøñ å°Y]oÎ0¸žý_‡¿|fÓÈ/Û'P´ÕeÇÐÌC†GGG‡7²è'*áò%ÿÑeûðÄøØØpv‚%/ö%$QZÓ°Eú [mEçÖÑ 4æî6±Ý;99½ÓŠ›X"=c¹øÊmÁ¹.,bš>>533Ñ¥}þ öw÷8…iµqpt|l¸?Ê„ù¨ºÙù2ûT6ìW&ÿÈ2bÕNÎÏ E<ÝÂu_Ï×áEXp1ÚÄcÛÈÄøøHßv¬oÌ aÍþ æðö¼sA<Ýccc#_:‰”k­°›e¨— ÃiWÿÔìüüh¢¹~Ôƒa•éäö>O›Í)PG>YaÈYýÈYæóålJaóàØØÐ>JèÑWâéAk2­¨w j+?{òãºQPø‰µžV-@vH™´ô–)QU’Ž%¼;æÖ!ŸÀ¸Û³³óãÍ·é\1ê;$®gèòºÄàd{ÍÑËw´cøweºß»#Àº'9Cs’ÕÐ…s#wÎî¡®ÃQX®>Ag²—Ïe:äKÞwî·‹_ߘfK+,€K?LƒKm¯ÚgÑæÑñ¿ÄtyqùÓÝ3:”pj² ¯OÍD¢Õý…L:%úaƒÚ€óæDú'LHÛå¶AW‡Â÷~7±ÒØ8éjˆ­B¢"ˆgúÉLSÔŒ E f…,$©Öú1…³h¾ýŸ?öL,ÈeáÒœ©ùùù·1¦Çà˜’­·öà£fäJ„fà—B,h•ŠpK‹ð¶÷®—I<X“Zª?Œaì@zw™é§’€³]<³jQZ¦cN‘é¥XºËdÃqù>Œ‰GDbÀ¼¢Î(èe²Z¨pÚd·M ›ÍC™ë/ÕI={çÚoP)çäh#X˜“ Å\XXxBqJƒU±POÖ™¼&” e—ì£ TzÑÒR±`ai1Çë•Ÿ–SšàÊ?P€ro~òKs{(žµ%ÑPMJŠ6 xu;+ò<ܠ™V5#•R´yp|ÓædD“NqIôºi8á‡s›­öç|¿1_K¿´QOÐÅ•h3i)•m–[vb¨çíól3<>ä:Íy¤€d@x¨ÊÑb‚ó¶kìÏ52E4…Ù.cO~éý>v'žBŠ¬3Cg±¥Ä¢ë®Ã|U<ðUmØÔš/(¸ Zê=“®? &ªéTúŒpm>_ã3©A‘;7[Ò.¬õ ß*íCs­¼æâ•+^è:~ ¦#§@[ûè,›Nß½31)1ÐŒŒ†A?îm·ùŽò¦*uhÓûò:Ã>اý–wk\ª•h‚Õ‡-ù ðæëPjî‡I­¿í‚z-t ³üòEïXLÛ ¸4;þ¹{P¤KÃ0¬8™î'mrÞyýŠ”.‹¦ð¢E«ž G›Žœc´€½Ò<Q “~»m¦îñÝ+W!J+®QÛâmI+ø4&·Ût€SD3t9§­öMmü¤—Å0‚aÊŠ3Ó"-ÜìžçEÓ’«¥ZášÑf1š¢wð½<.Þ2Ú@c)’¼>á…tçNq„™yJ™bÊþ–º£ÛY¾Wä\Yë˽¾Ïˆè8¦€6ÐÓ§±.~W*ŠO„n¿øJŠ6Dn¯ÌÛ=-ÔÃçâsè®?N'ã+¨ÕÕ M­m&Ü7Üï“–}i¸ˆFáωäh³äOX¦J*"=ö£jBÉBï5¸®^LË…JâŽÛñQ:EeºãP´ÉØìàrù’”¨m ³ÏÌõI"ö£_Œ#'ô®@8Œê\3h²¸øJ šÑbÍfF›ZÕ`ºceptÕKD“§¹œtxkéÙŒ¬Ê{åa¸ç/†ðLv¿€2ófêÝo˜‘o­’,M0hÔÏÓP÷µ5}œ^’hF\hbÒ^!+ìóÝ¥$"gbI¢Ô™f;,];Y{¸îžì2&B·jÉí6sÎ2+qUÊFŒs:Zýe$ `²·µupFf%¦5ÃÝwÔÇ–Pµh¢¾Þ>åÀ`IŠƒE°4¨qŒqç³Ï`+Š6‚@¬þYtçÎ|·ŸÁÛµÒ¬ã7_HÍ­“Í·hìÍⱊ˜„L9™êPëEÚ$ólöJïͽ¢²ƒ½ÍSHM!M GÞö]íýmÉWJàãYqVqR›íxcöéì÷pü¼Éá¾á)mX $·DmÀÓ›¹¡Ç¥ñs_q`nº%Y¶ÛÌzêeu#iÆ>òY4«“MjÑF™O#†úùˆ±mi ŠM£8_†³˜}µÏ€±]³|smÝ%fmHÒ#Gä² ,ßî5÷?U@a; 3œÚø'Ý—Ê«€$Ì”žiy¿M%Z˜îøªË¿}ê,º¢kâ¦N±‚Àb|o+ cH$ pToÿ=Ⱦiä$ü[­L¨FD:ŸÇ2ÄR¼c G#Ïvþ@PÏ,¹éC3=R SÝ?çµ V‘m Tm¯®ñé$¶ Ï´ºR7½ò労:ÞÐÊœÃ0wzýeA¦÷©µ">^L&3ê< ¦z^ÑÉX;ÇIäÒX3æY\m(¼ÌdO?K ÆÒ#q-Élw€ƒ…ïàíjôp-†ù\œä«ï{Rö90 )¦Y],*¾YéCB¥¿÷²21uÞèiofå2ŽèTrMêEÚ6:°ÑÜ=|²êÁˆv¤ll‹ ñÆKi¤†ò4{«ðÇ*Œºw,”Êdû{YoŠ.ÝC0fž¬}8D¤0lL™LsŸ:ìEç7šë“x›Òš}l°¨¿ <‘}Ì×74°?üN} "þ¯<¸0ÍÏ.` DG¿hô+3¯ãÉx\óˆ×z /ë˜újÇòïÆX¬É‡ÐÄXu;¹¦¨Šhjö°ÒZ«ô\m´FmÔ½ŒÜšô½\‡¢½Â ¸úý¼ ?øš ÌIVá¦ï÷P« ˆ°2ÀD¢/ÿúËi6°Ý†?±¢ j¢<(4‡ºvA ±!D0Úùf¯Y…QßìHš‹¤b×Ø£ÞŸ"9ž•(¤<èç§ÍZú&AhSØ4,þH2‰H.~fë¢kRK4RJõ¨@¨Ésh¿ê÷¦ …}Ï0ökŒÙHf-½Îˆþ¾œYZ\è|šhÌŒž—¼hóó’D¸Ôz=ÔÀýÒo¶·HÄ‚¹É~.özpVΕùÏÏöjM8Zú&yXsét:gûí—¼òL ‘J'mPù~i¤Ê”Ngl¹zªþÛÛpxÚ¥¢–ß2g6šrxÎCó r¤I‘A´i;ãI$° [Æ~³#wðí^:ƒ}³fÔ‚‹–¾[“ûiqH×¾+SƒŠö›uÒPw¤’¢vô‹|ó[*Ñï¼·hé÷ ßÖÍ›½óe€ß_¥~ö†~ŸQ‹6T¬/€û'ðOÿô/¿³²sþüÓ[í…ÿ þéÿü=ÕhqiüOEª–Ãp>'É™éçž2à ­p±‹EáÐÑ dpÀ„KËoN¿ÌA–ø´yùfûsÐ’ òì@dLêÑ8ÒzÚ‚L¸[é[ǃAL{»|çÃ#ÐŒ2xàÙgª@7ùd³A’¿&~6šh‚›Ø8úiËfÿüÓ?­öBø_À?ýß¿+샭­`Çà@·ãcÄç§-¾ö9û³aLÃ8Ã…_ Êôÿºí“^J‡g‡I!8˜… îÿþË/þj ?jDnþøÿ|q *Q™ŽÜüïàù|Q…xætÞƒ¯ÿá€>ÎÈÓÿÁ‘@ÊŸ‘Ÿw=’~ñmrç¿€ÿ ¹o›ª€~ àÿƒÜü“$ÖDƒIÇAÉ8Ÿ¢+¼oÉ àcàâ;35FÁ,5ôcÑ©p¼zŒ¯ËNÔl¸Æï'çÁcIà+dNé¯%‰{ÁÙŽÝÓ{ÁýÐܦc ‡¨×€{Áý)`»BèÇÜ[`bxô<ˆ†Åƒ=‚gÁövpq³)>qñÓ›~ÆI0.<[–ÜwœQ6hæ7O»Àê!0êߥhƒÞ¯{&'‚{’Áçïd= ¹_pLHœ§%+Ž[Á¥^ðäÁÿ¿½«¯âèÚ7Npww‡ˆBp-R¬@Ñà…w/Úâ-…–B §ŠSʼn'$ÄÝå¾ÿž³³Ù{/I€~•ÿûºçɳswfgggÞ9sæ,Äé["ûäZ,ásäM˱l#2È «—bívä(ÏJöÅÆTêû{¢ÔW«±ôdEbþbpØ#^Å҅ؼé1˜3Gv Y¸—§Ì Ì›‹;ñ¸ö ½ø?¨<@Ð5úˆ›>Ez,üè8RžcÞxúŽƒ§àÓ«ðÛHéQ;qï,•Ý£|Ê K±ê(ü/c¶b‘ÿë—aá"ˆÐíÜø‹G±h–¬Â]VÌ;°õK¼3WN`ÉB,’zÒÛ”Zòî|켉ð[X²÷ Û «íÄÂ…Ø"[Ìå`Íl˜IcÏÉž;]`a‰,À©$µŸu–0¨tÖ4NÆr¦›¢¦,Ý™¿5‡µÌ“§ÃÒ ¥ÆRrFºósFžOÚSÚ;ÇÜá>'§ M&Jê¨r™êH¬rIõûï|“ÍÌLE›„j ’/M¬Ë pÓÁª¢²1³-uu—~hRzÒ/QOàîD™íá>RbtÏ WÀ þ°Ð¡>»9Ý™nèP•þ]y?½Ï¼P'tu¦›$£Yr„}YÔ¨ÄËAÑ€•½é²±#ª— Ä‰@Hƒ©OMJ÷€Ê–ÐU‡RþÜNÊìþ-Íñõ)}ƒõVCPºÝ{H}F‰JCÔåÆmx ¼YƒÁÓ UÊ¡iE…·ÑciOʯgûZü %œŸaéÒÉÅt4¡;W½A¿VoþÝ(1eeΫóP5ÊQfµ±¨^åyvžÄmþ‰Òu\З»n ³èc*ª œ¥oa‹8=R¹f]q´mƒZ)Ýj:2¢8Ó“î¿=ƒÒ:BW…y‘]Ï‘›RoªkpÁ–S‘àWî4;7Ì=†þF-\i§YŒËÎã½C Êzrœ~ªßoxRbÓÊ\уÒî=ÑŒ÷×S°ì-¶Î í .IiH€µÅäX1¨W=G ô"ÝÙ_¶/¤ôBŽ u÷;x´ÇÒ[ù¢MÚ3ÁG°“Š§'ê)®hZ1Ú¤SÁ"}D~ÿzt)1¿P¢ÁBÎ}€FðîgFsljŸ(›j–:ǖ滌Wk™(fMé³l"-”–¹7¤ai%êèÖºb”[™î¯ÌÍ~ŒT?0Vïç)Ðz†ÚxÏd(`UðÈk”¶u¡‰ð&ƒÀ·~ÌuÌ£´ý4æ…6q~ º“ªêAéŒ ®³£M!^ c–:X+‚/§*´‘hÍ\¬ÚÍ°æÏ8ÌÁžšV¦‰,ë$ÕÕ¡L-ÈÞwlÆ@"£¹¸¬`AX!uÚ)%½Ëæ½ÙW)}æ r–GÉÑãx™Ø`Ħ¾Çc¯ËL‰Yä·(&ÚÐÓž.ƒÂxiË÷ç ´ÊüLn+F‹4×\R±ÅmTÊBþkN ¦ËÅMócˆ6}\Ð{¶*¢M!ñb¿Vú_ù«îLùÑÞ”ÆÐ\ÒfxÏ6ßÊvOL+‘þe´©,zh Ur? Çè×I‡Ö‘K«M‹{¾k*&0D›g&hã¤Võ"Ú¤ÿÌò 1¦Õhð ÃÚeC1’/ïáÜ –µPݤäñ²—d´á©'ÝÙˆYšP^;JPCšÞy”ú]F[äj&–ã‚AT žËmðJ‘Íï^¤)5²B1JrÁð“*ÚÎÁÕ(c®æ4§X–hÂh#Ëm>)~2/‡;˜•ÚØvýÙ´‰_¤‚k‡™>Ëë8²~ ÄëÞÖ åd£o]f‡sE2ÚØBŽ…ÓÍŽ.Ãø꺴)i-Fã¯ëxÌŒÂÏgа0¥c”F¾ˆ6Yñ¨Áí¶M䜧Œ+=£Móÿºã½mŠ*ÀG¦‰Ó½1Úx4á!g\‰Œ6çd“Ã^p=LÔ\žh²€b,¡Í‰w=ÍcI±LLKEZ&®ñ¼íyÞgr›2Ú\£+ßOÐÆ¢KAR⌠tÏ›»ÅåØJmBXê8ý¼È_Í#ÕS\XË\Š <•[hpD$æ… ÚØ q„Œ6áÜþNr'dSŽ¥i)B›âêeE.èO¦üu¾h³äˆ)ÚT.Ni?.rÄmNûšJ‰sd´©ª M}¥1”_´¬q+oñÞE"É~y ð&eSQ®¤ØÕµŒ6Åû‰Ìf•ÚlÅÍ36ÝMû^E›»Gi'›+qâMâ„=ÊDÏB™ÏäÜj‹/+í1«4;©BVK;צ([Ì<åa?êbÞh“„B:ºyÿQªéòÀáä<ǪFy¡  ÐÎ×¼£X×:ybó!SÞæ³,f~ò·ƒè?‚Vm#´‘ÆŽæ¸|Ò·#Æ-Èm¤UÞVº¹¥ Sõ\Ë' åFq“|Ñ­'Žß ß£ñå—¸ÆÖÚÑ=»ÉKö9Úœ]ˆa#Àø@ƒ§!W.óB<&3bH©k,X ×Ä`Kûøg¼=/Þ‡XýŒ_)=h®ãÍAXóÝ9wˆXÃwÕ ž$½ÓËÐènAõ?g!眷1t*Ýl‚6#xcµŸ=ìöh3ŠwÇ{¯Rþú· І%þ mê©mðÔ†Äsã' Àð™ðã#žÎ,}:=™wдÑñüÇÔ¡˜ð‰øwfF+ X1ƒ'«¼ ÚHSõâvÊw]Aoà¸õéÌÛ ^ÌÃÆ %EÃÖºRþ"v™“Ct‹ÎîÆОK™ÆY†Ö”>±´{Jzs©åÌÖ¾ÁœÏl…~–Å_žˆ«hÃíY†÷³ÏÙ©ò +±jý­\ÎRâÒXÎò‡ã_âØy T^·á¾ý’×[Ð7’×C´‘¨E)ŠÂÌVðo£,Ö°åmòwAù£ô&Ñ=Ö…`iNÛ3Wó1A![’#I¾l~7;ýøäQü“9lÌ0ì-1½SÚ¬kÀ³›ßq2Ë­mH@:¤%Á‚LçŠ|Kæg~ùë:ˆÆ˜³ìTžq<…Åô·Da[JLÝû ¼4ãXâa¦”ZqÊ”·¡õ1œ¤ŽôŽp²e´! &ɦ䂎<­ì¸©ÉwÄCk¿‡àͯ„6Ѽy1³‚-Ës>¼@ã¤W^ØÕ{‰¯0ù±¤Kê¢}°ŒO|¤"¿Ý8vãéRDˆ}òCšÚx“U˜»º%ÒY²gÁ¨àÉåQRÑøªÀ½jfsþ£|²äÍ”/:q:–ôHdÊ4Gêm!±)Ä參†l=>p…¥¬¸6sKz5¯cÊ–ÐàAFåå6%%VÐC•|)2O}ï1átÐìë”L‘“N9á)Êk‚¥RO&Ê%‡ÒeJ†ZIj<ü|¨TL’¸'ÈO”-[žúðÙß!ž˜œ¡2¢Ï(Ó/™Ê¡sj=%,Eˆ'FÁç)‰õxü!‘Ô0éƒ#ÈP?ÈÞ{|i±KTš@ ˆOCì3zýÜSéøHøJÍöÍÎ=–•ã„L¾ÌLÀéõ#•þIA€=úyŒ2I¹WeG[ôâOHƒÚã ¥2“áïK¥Â•pþxêgô-rÒ¨æÀg>ʧÊ'Ð#,˜J«Vû±Ï©y!ázÿQ5ÉGý“nõ7¤§Ÿü”aô ¾<À =,e$SIeƒž‰C®¸`ÑæÜ:Ó¨©†zòÆ|Ê^8pw wÐ@åßNÏ®ªZÿ-ô`Jǀň Ã@fQNÆ¿RÁ‡+©à› ©à`fŠŽÇiCàï ÝÑ{©Ö ÿvŠ €_äŸøn•—àäm*bëÉ×(¸zœ(h][Nhßÿo¢Gw¤×¤Äý÷Qñÿâ‚iôÏûGòÿÿÙúïYkôÿÂîÒÿƒ¥5úó¿¦> “Yq]VÛþ/"g©ÍVÿûŸè9–öŸ"ŒNQüþ“y³¿Ø0üV^y²­eŸõÚôþGñOéÓóÄw—þ×lÀÿ7(=ŸíÃ÷·ÿHÙ{£X‘.n ]‹?³aÞ Ts†?——)¤ÃÎË"çÓ9âlýÕ)é öíÃM_mrÿ­”¨â^"£ G0IIDT¢cÄÑsvžœ'´pѬæÏF\ ݯD¦K‹Cd$²³…ÖXËLEtÕ“ªhÞÆJu&PÙé‰ÑQ¦ä£í$ñÄŒ,uåJŠ§Ì˜Xn/a9ÙHOG·*9–ž˜É'—Ù锎O¦Ê¥VŦ"9‘±y T³ÔªÈh1bc#ù­9Ëmˆ6ýUVöK•~¤_#”_ã •_ßOÐ#!Ž*Œ÷g&Ñ=iYÔ¶Ün‰¥JÔêù÷[f=¬~/w ôîÒW3s2¨òØ$ñ-¢¸1Iܪä4¥îÄrÁ ƒ‚ÉÏÉ‘Be7ªÓm¢ùsÓì~‘¤$ "V´!ž»+.Aá~A-¤¾B¢¨3.õXÏóy´èœ¤*%µ!5ÃtË–•J­MÊDz2ל¨Þ–,J¥sœ_é+Gy“B·ß#Ÿ5³%ÊÚ+0Âj–3üÎLH&OMRç¤g‘Ò‚ô¸ÄT þV_ VÕ0µ:i:EeáÄ$¡4e¦ƒ-Û†ÜPt³ÍÄNJÖ—5º±ŠYíŸÍÜ–Eëš™±š¥¬dÕ´0 wňf¢¶R-E./7Ëf˲½Â–î¢Ò¿ezˆ;eí¾¾?äo¿³`+l’o£GWÖ £IÇ*d:âäʺ^=Øž‘LNY©L‡½lêÉ-é_‡-žh–²V›ÛèÎî¶Âú&4&Ù©]Th½çRzìT匩 î®W:¶©@¤Àú-€Ñ£Yaë†N%…[°¥”î*Zå…J^Äw”ÙˆUg¿a-ëãTzYér`iµ` Â*ª‚ruB]B›öhSYdÚ³½gz,›*LG)KaÔЭ¦úvÎ˹ñÑ("«Õq˲bdS­þ§XÑÇàí,ñØHmþ»é×^ïªE0ãqyRJËrd•,>”éHçÑX‡Vý(ñÅpƒ±T ²ª×Cj+X%ûì}<åÎñ‘+É6àö³‘’,,ªsØlö Õc%æß(=ô[Z)>ìGiŽ×Œ£sI‰%AÑ%¶n‹DflZèPˆ‡e6W¨c›Ù|ý/¤ŒçÈÊ·¤ —"fä‰NZµÒXc¹aGÄÜ¥DVsMfàlºu~¥{~÷rð+ÁHNÉ{'åÍzé7#ðð}·Ž¥Ñ~ ôlð^y.f¥èøì"UêåÐjôl UvüØf긒)k¿Š¨?‘ØB+ ”­òù—vpw±¡MÀg¢=÷ÞãG°žó"Ö±uEZÚ”ezÖÖk)õ[=Ñod^Á–Ë-¸ßf|Ô²éD‘NÄ&²¥¼¬™lˆ6'Yó¹ÊhZÜ?™À+Âb„\aåÞŽT0é¬Î¬›ÐVmO ƒàmt8ýˆ,Jê±[ª,ŠÚ+zõǧHNŶVXÂÑ?/®!ˆËÄæ¡°kŽ+!ôþ‚•dNChöV@:ƒi9é±—€ìxtïŒ_íÊy)±©I:Ÿá<d{©T™¾Ì¿ñÇ­=šü1¥?½ÂÝÍVÞ÷ šU”‹õEf6bO°×¶o££®'î«;¸øö†6ÿÚX ü6-‡5P³-ý X ÛÐr¡«ýW¬Žê5P‰9]am¾a_ð&‡R%5ª —#)2Ú”=0LX.¤ð4ù¥"H#.÷»^)Y™ŠKÍ5S©‚Ѧ)r£åæ!·a“‡O®cv”€=cPÍ©l]øÙ3Ò“·ÒaóXþJuÅ‘i(ß™áÌÆøÅ·ô:K`ëwÃï¡DUä$PGmº£>a=[@—­†êR/1˜¿óÎg»tþë6ö]@a.±—ÙÂ#÷„™˜I¿%ËhSLlÙ~a{Õ%ăêÚæ‹6?q婼ö˜€+[تè¾(XÏV MŽ/£§Ü¦†HÏõ o–‹6u8 a¶€*ÌånbÇ G¢NMÔªEF6ì¼"'M ,·q-Ï•á9×BLwR2Ú´›eP°,²d7%¸OjKS‚-ž±EÕg×(ôûÅŠÆu~ÇU”ݽ4–2…{¹F"óD—Ð&-ÁÎŽþ5<øëÑF±—=N Z‡+—pñ"ý]¿cŠ6äqB‡}Å Ò_@Š@›óO列Ìx·Àµ_Å ~Qxe$çÚIű…òįƞìqbö\RqÇ?´‘Vºý¯j.?¡Batÿ íKcôÜÞOÆGGˆ×Jà)]»:lEïòè¿OP眡ֆ³¤y¸­ÄÐÊè4AçiÑ|ÆۃȞkØ—ÔºŸÔ.z‰ûŒ6sØÌefÒ>eÇq_vUÐFî·æ¦ýÖ ß~f0›Äeƒ"ù¢Íx—qY Í%ž\³2ÝÊm)ñ{ÑF1ÿèB—;/¨oç—Ä®otøèîß#ç6/¢ôq3pd'Ú)[i÷eyð6]—³•¥\° ÒÙ`ßcœÚ'—¯™¢ÍÞšûÒ*ÊüÀÏøŒ9ŸJMÄÕ¹~/ M¸Óh þ>´‘z^Z÷+çt6nÀWMÑæ^Úv²¸¨{Øö)¢_°—xiå¬üã Ø8_´‘8 ‰—(Ö_^P¿ ÚõE1{ÙiR*>ØŠßx¥ÄãÞ=‚E <}¤äWû°›ßô8û!œ–ÖÖvÂ?Nì¤ B ¢Ôoµ•~Û(úÍmî±'½ºï&ÍZW Ú@A›qx|Š]ÊŽž¢¹ £M¶C\Û×@›õérï¤R|±íDd£ûÄ£bÑ™Úði‘>û>ÄuÅml¬¬HRôù^ì9¦¢M—åËІ®°Äå*‚»÷×â„!ÌîûÒÓ:Â"ÙïYy|ësÔ«‰‘<„Êë`VFÔжäKvRšðß„6ÜÏcÚÐWpéŽVìúà#S´‘†S1v =`KvÝ`‚6§ØUå6èÉˉ‡òG©nŒ-ž¨Çb̽wiŒy² ²[?Ô±bZ˜x’ö`N2Ï#iköFرË÷y¡Íjð†ñ;Þœ)Ö2™‘ïUŸ.\ñßY ~•M‹ÚqºÜxÑCW¹ìÄéâ#(]ÉŒœióŽ Ø@¾ïv]Xᩯ„6§Wr¿µFOöÜrÐmÈãA;” µ3íJJؾÚ´ó"¡w9¥ ™9J*;)Ä «ð½)qÁhÃæåÙZÿÍ„ººª„´.ìåµÇ”*‹.î´7Ÿ´€„r²R÷¶ŒAU3˜—ÄaôÉHþöÕW„Źù¡Ä-gn¤™'Ü›Râ}^þÒø½lkbø.ô(–òj•‰.#Wˆüc`ôxèe¥Àk¼6¬þ)ظˆ:mÙV¥aRå3à5÷#Œ #±„ÝÜ¥>À„ñ˜2Ql$.õ‰ô¬‰SqôWQÛŒ‰Æî¢ňQØ"‡Pɤ®5KH«.Á¤q˜4 ׂTöã“•4?ý™¼m?¦æØBÃfÎDg©céôz…mÇð GXøá"¾ÇÈQØ{^þµ"ZpÿÛÙä´prqæð)Š„]£ Q‹Y¯V0‚ ¶‚©àu*Ølú¿åÓV­ñ{RâàÈ<§O’6!4ú éñY¹þ¿`³ª3 YˆÝ\éòðO}UQÃê.°µT –ƒ_ê¿BFA¾R¯¢t ñâ…ŠcþwÚlÐH£W˜;ú?(ÕüÃÿ7;MIÿè‡0ù"¯büÿÁdøO~´Þ0¬ÂŸúÊút ká³5úÿA3ëúBùýªÁ¬ÆKÊN¨Šj ÿ6çd¡t1X´ûsjK¸3kT&&åQVnÉçæÖåÉSú ³S«‡‚Qëà]½MoŒ”ù×u6ä¹÷ TÁÌsÐë_‚ÒúWðWZõþÞüWò{ÿéÛÐî…˜º¸À’™tZcø?6™°6‡ÎáÏ©-í9&MÁ’/ÄðìÛP=©‘ÖÍÔUä)£œÈȨo säçUà#þ( ½-+gKèçg:D /º9ÊQgÒvÆÆ©_SmY ¨RVp‘Œ¢0fí·‘­%éó¼—¤ª2C^x¢5ÜG©°{]ØZ)ÕAÏwŒfsÌ—jÁCêð(¥*Á†!q†±ÆKÙFjåÕ-Qzd¾ýVÏRx†öƒi#­ ¡ß*QOV4ê•Ìé¼»8V|[Ðçhimú¾Õº°jþ –ú#ŠÕ3rJ¬ÑŽ6²Ù¯Hçä³è‘Îf)c.©çŒyìôÆ¿ =Ðç“Îë~6m^c“¥×¿dõÌm^ƒ²¨7;¯ÆêݪäS›>Ÿúª¢æ8œ]Æ&T_+µ‡8Ôg…´EÉ.IE›†¸ÿàÞ]´a5’•7„TE/õ);8€ËtÖÜè@2»~AÈ3ø?FUxáÍf_ †UI?ÁÇ䆽ªMá‡té„d9Vf}ÜHO¼ÎŒŠK¯²+ëA9ÇÍÛ¸}ÎX¹ë õ³¨©=9ÜW¢ëÂ9¾ÃèQ´Ú›o—|G°È©iƒr£óýŽ l„~ ¬³]ÖZ(ýݽ…*,û=ô”­[b[ﻸqX¾÷z¾Õ¶²%=(¿pøùáéCxpä…ŸBóâp”oêÕ>PÞY¯ ƒ^mJaÿ41Zö+‘g!hi1®ÛÛÄ¢Y˃´¹¤®ýý0+Pq'ûÚåE )ÇMª³_ŠzXÿVâ6³b46hQ‚¥æ°®—gXåwxaaX=­¯°ù-\;ù\I M{ôm%âtÌûÄtŽGCƒªJ0Ç.bIÚ7Žc¦H¼/ÚÖ"»‰ây^X÷㥴óX­îÖר^ZÔP«%B¹ŠZÌWô¿:A!i´³ Ϲ"xY;°±9×[I‡ ÿ·†£¨á$GÂ:ó(/´i¥î–~f[ÑÞ+T ÚŒ(J]ñDù)ÔÁá"ÖC+”¬¥öOmkÕfM¢$mìÔ'þÂú™]— œ rÍám6âŽ2Ho7Uцºº±j ±Ôჿ6¸­ Ù:acýë£MÅ^êüþb}…kl?^»¯„cñÜ (mŠ©ÛÏYçt0›{<‚C}ÅSA¬?Š%8w.Ú|Á–KžŠ!]Ì\ MKŠ[7ñ]8.,#¤±_ÊKl qu/Û=$1‹Ä³9} j6Eã¿®¼¹ËE›\ÚÉh3í°˜`Î`hÔª(JUnKÖ÷I̼Íô~Úÿuæ½Òv/³Àx­a#÷ù÷óåmd³¬‰lepyïW–…i·µ@ye‚잃¦õÄvFW©,ªUý?ÆÛ ÑÁ ÷ÒèŠfW¾)¨Ïë—Gwtç¿®]ðu˜‚6ʙԇÌÿ¼÷»Áôa`½Ç¨I™ß^qW\¶/—ÚL©+ü ÊX¨å bom ‚ Ëƹ:gd±Ž7”󑇧Þí ÚHu¦=GwgTV6S³j@ò;)yí gW!^‡ó@Ùó‡Š6Ïy±©QüM^äá”…±ƒ0‡Ów¹¶³,Þ9Û‰1j¬Ã3¸‡æšºí-@n#ý­g!Æ`æ 3#Å„ºÿ\á]yÚ²Ùõx^ îòæ¢#<þ#,=‹”ÃÒ%X¼‹—¢´­{7m¤'¹1&[Z½¶ÜFjäx·U¼$3On[ÑŠçÏ+ì÷¬Ã{ò6h“Ï2[ú”ï}Dþ)ö¸¸5@A›B,̦€žáŠùCYsè<# ‰‰äÁUãmò£IUhF+ƒÝÛŸòŽx9ÚI‰äg9rKF.Å0OÿÆVd)Î?ç®'g§äèò´)a…¾û¸©$É,Z _ŸÄ—,d°p5âm½Eøïµ[QC§Èm2i¬–®£§±Ÿ=_eƒôÊ…Ðe‹ÊfûWVü#ê‡ÈOJ,Q#>aùO—V´eë7‰ÖãÅmK |»Ž°«%ÒÒ ?«Ê4xU´‘©)Ÿwßaäz²O¸T-V%•hڧ؀Ý÷¤"E—Åéì²ï‹z:m0*ý³‰YÏn£ mÂÅÑÓòOó@~Ê7óDK*²;/lz_0o£CŸèÛ½»‹²½øÓdñ‹ÇXlz‡ßºŠÒiÌÉL]Ja‘‹KàV_À!6ç×9Ðk.`Ûö÷ïk ’/¬«ªHE¢°.ƒ_” ڽʋC–MÍ`a«  kV,:ˆÃ‹h²Ø|cf_ØX¢L-|ÿÈ`/_ ––hºN½ïô&”/ ÔwwnœY¢Ú*^Vô¡æÜ…¢n¢e5r6ë<rdòœt¶FéÑøñ¶@M7q>²º©¦D*¦åë¼hW¬ö^Rt@ÂP§ÌŠã¨:”#‰1¡Í=ðƒÈ[!3¸­ªp p#P²¶Åˆ%â5›—P­§Ÿ]CYªŒkq¼“bÄË E¯6äÕÁ¦(&¬SkÛ9ƒNgG –Ö7ÐÞè\ŠV[ mýéhÉÒQÝ.Ýç… ¶âaææçh\‰º¨j¼®ÀòÝ÷¾AËÔçVE1h–`'jëÐä £^¿ˆ‘“±¤`z¢Ykõ‰Yà,u¬ d¼Ý ÖV°(Œá ø+(g¾O£zqX˜£ëD!Ó˜fOµE3ð%œw›ÏzGP¬‘úËô&0·D%¯|Çg“¢bÕ eŸ±Uû¨ }i.-Xm”²ÉÁèéHïnY3>z‰”ر8ß)ÿY R#|uG-rjJ†e!¼µ@Uxˆ=‡âÖ°)Ž QÈŽÅv0· Ÿ¡ ˆ–Ê-ã3Êk òJJ)/*“éÀäqkÞê1òå‹Ú¤ùYëèóÑŠÑ¿¨Æ¿bƒ¾@ÅZé*+ kaøZ‘SN‡âóx¼‚®©ôRÎÆœ½òt¥õ´êì—hà˜œ˜äÝ3+ ë ²xzEu\ÓÄë?ù=1Ý*}>yuÝÝ<4“_¹‘¯;ò³âyYaú§¡׳´”¬$~ƧeË£k¾~òÔ– 7ÖG-_EØ(ûA¬ÖËœ"BàçÃ??U6òÇ(;¾~ÆuúÃÏW¸aüÓéáqÌøXû’©kÝÓû¸z×o""é-€µåàÁ\¹‚·ŸùÕ¦ÑÿÈðÒŒ­4ÒH#þÿB´Þ¢õyK^°á_õÆØ®l…_ÌÔç½5Ïë¹/ù=þšU`oh šFýʼ<·˜Ý»&™‘'†Öïý™É”ŠzðíÛ=ÜìZ·jáÒõÃw•™˜°kÑ„VÍíZÙ·ž»ùK‘™ºzÊ {ûÖöîë¿‘Í-‘=·‡ËŒÓä?|íÐN#6°"‡9·Üú[2ã;Ú9ô‘uчµkôÙ’²~5»ûðwVsvÚé«žo™Ò«ÿœíòü^ØÛ¹÷†;¹­ømï¬Îºuš¼F'y/éõúÌ‘›t»ƒSÿÛßîqŸ¸\Æ¢]ëzš˜Å…|WµÍ[¿Ÿ\Ú©=éí¦Flœ9ÔÙYzßnûÏ=”~ßнÖÛ»ýs–žÎõŽß‰»µc^ƒ>¬!;-þÔ‰“¹;¿iÃ<¶ûXʞѪÂô£Q2Þìî9ñm,i¤QÁ´¼Kƒµ—å=KFßî]Ç¥gÝ\Õ  Ù;±¬Ïàé;ø§Ô.ÎÎmÚdž;y4 6ÛH“ò¨½“c@™ tjèxCÑO½ëêæž•þ›kóNaY"3ø×nÆYËßðœyèNRrrrÄõî.×U'(é&hcð¨Œu½ZN?-l‹¦õmø·Èˆ³)h£÷½pêÜ£8#©Kô…æ-§o»ÁWÙcÜÝf’µ=#†97Úv=Íÿמ½'N%`}ëщ@ŒŸ÷É_nsE˜…ôtlqõ9!Ì­o¿¹ýLìõrw·qœª &4*Þh7dáW99Ù99bª+h“9Þ±ÁöGŠmñ¦Þ ocºíÊN‹ìèæ¶ó7ŽÇ¤à^ßýE‰O]ÝÜÒbvjÖ;J)~ãˆSŸQŒE{x¸»»·uq|ÿ¸·ÁÆ&´‘8¶¼×7…ÅÜÓOÆöXEþÙž«h“E_lÔ¼›ì¹)'퉻S›çÉÙD98½uöˆù{âߦM‡`~ÀÞ‘]Çõ;òÜ]êStn»æÌüö£aìƒS´Ñ¤‘FRVžÅc[;:·m×~ÎŽ‹zmbz7jqøÑùl^š7¨ëw¡¦l݃K?>d›Jú!ó¾{«vÒ•v(¥‘Fßå¯úut–65ÎnËwŸÉâ3©Š.‹y úÌØ¡…ƒKÏ!“þ<£~·¼x'ô¨[æÓ[éAç?­×¤¹]K…š/úV–i¤³e^›æÍì[¹¬;pNá¶/cߢEk—Î{gF¡¿Þ½­k[wG'÷å»Næ¥?vª×Hª«I³fÍZHÿ·˜ÿ½„©ìj·h¡>ÉÞa@–ÁÄ=±±¥ˆ0ž³­sÝž›E+‘?W¬ß5×Þ&'öñüѽ¤vrtywËÑtEVôÓ—ÆMš†§ ßP7¶¿S·½óù©AS£×œ¼ó:“j]yÞ‰hg§&ÛØ­q6iTàV*_EÙ4Srs ®ï…ãjÕ̼­¥6šìõFÅS½'•Ç}¹šÊy©%)'<2¿·•²}Ú¹á®^ŽO1²ƒóŸm4i¤Ñ¿‹U;ûqd6þóÈs?‘†ü°ºÃˆÍÙšñ‚FiôWRNZÔôÙóÓ aFi¤‘Fi¤‘Fi¤‘Fi¤‘Fi¤‘Fi¤‘Fi¤‘Fi¤‘Fi¤‘F¯Gÿ5%L­ endstream endobj 703 0 obj << /Length 1189 /Filter /FlateDecode >> stream xÚµWÛŽÛ6}÷WèQj.I‰µ- ´è&ݤ/M\EšYæ®…êV]²ë¿ïCze¯ÖhšÌEÍœ™9<”hpÐàõêÇÍêêU,ƒŒd’Ë`sÄ©$"Aš(’dq°ÙÂ÷S_ù˜Gkžªð·A÷h½žÊŽÖŒ†ßàÄ;]é|ÐxNXôqófu³Yý½b‘,H98OHJÓ ¨W>Ò`óoJâLvU$RÁXïW¿®è Úl†Öøb”Ð8E ?Œ:ÉÂq¯ÑÐÍöFAŸîŒc…Æ_à×ááÁ˜mï9´EÞxo£M}îçSÄE˜W“»lÝÒ‡}YìÏüX÷yã1¶è©ÎÇbO¢uL³pã½n¢X„e­×c»®Jâ“A¨ñ‘³˜; °ê²Ñƒ©6”jÍÉ„Àš R%!ÐcYç^äu;Y$`ÛÚ(ŽÐÝÅ¡Ë ¬Ž[ˆ…cëÖ•îúãÖT¨Ñãz8 £®!­„¥áí_VhýI)×ÕÎyq“ƒcK€¨¡U&Œûó@çÐöù0ÖB\(ÆNcßšzgŠÎ¤+ºà6ÿ¥‚sDãÈm@‹ Sû¶C£0u.orÛ|¼}Õ·“ã w €q’€½í Óvìóbt—mãžAÇ/;Ùl~YÊÚBB„¦#Ôç¬XØM}×Ú«œÅ}âa­‹}Þ”C—~‹Ìê¬Ë¹ÎpÜJ%´¿)Îü>Áu~†ÖÌÇÅ%ÌsŽ‡Më–àžcêªÆ†VM9.¶Þt¡lîqUmÛ ä¸,%Yì´îæ1¯»Êm´SÕ0†U 0–UnX00æ8ôS¥¯ŸD«˜+q23ê%¤$LÄF ¯nk&ƒŸZ#x„¾QÂeldQ² |6ùnIÀÓ8!ó¹íÚn´ÂpÔÑ3…ðº:ý%ŸGÇÌÁ(ÑØ/I&,B©»fŒ½††Ú§Ê;œrÇÈÐé¢4 +|!Li7—ydpkµÝY 6ˆ… n{ƒ³ÅqëàN¸Qa‰eÖ<“­E~_6 ÒÁÄœCËlÓȇþˆ˜IwÂÞb’†&Mu˜‰¹Ÿô£'“O ìΟ# Dƒš=Ù»¥¹7`g¥¨Ï«¹£á4Œ?p渶z†Êé3<ÅY$'gÂp‰ E„:4E‚.žÄ<¡Ä“è•AÜöµ-þÒF:Òiy/];šŸá¾ýßOÞ$¤"’Å–‘D%ß&RxáHÅñâćb€)²ø’Xšqç‚æØÐlÏgfa2B›‡1óI“,UÞq¯ƒ»EÏ~㞶 ’ Ú ßΉ€IÛ,óu´–”†ß5y­¿·•]Šq±Ö"‰ Sê?êy¿ŒÜ^vqÞ¯‹o€,ˈ9œ‰…G‘ÕóÏ!ˀșü"B±4% M¾6¡fa¾¡˜bk²@¨jèûo¿ŒOŸ_§ç휊ÿOj›^z˜‹×‹ç½qþñ#àp–ÿúÛgñ€Oàʹ'7èºä<üYç;ÿeö_^QR¹‘Tó¿Ã„DH’q1¬ÎÎñþC£`î endstream endobj 698 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 92 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22971 /Filter /FlateDecode >> stream xÚì½wPTÛ¶/|Þ»_½Wõ^Õ«÷ýñUÝWõn<{o™Î‘¦›&眣dLˆ¨@AAE0gA%) "JÎ9gš¦¡ÓZß ÝM74ˆû÷9÷Ú£öÆÕ+Ì0昿9æ˜cŽ ‚*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*ú#ÙÕïMØzÀ&Ø8‡-—pÃ76ÊùGÒk`MÝäê¸áÅÖj°æ«¿¶Ðds™Q`ãú:*Þ¥ŒQÆå7·È$¹÷ô»ª«B‰¿"Mýýw}çcò}aåÿœoþ]rÞ©¦¦X`-¢ä3ZèOu Mui•ÎÖý`$ù®ÃÏ„¯®&2pXM-muu‡ #}‹Ðƒ›_¶'}]’{uy·Î¿¾âJk-(Î?kÇ&ÿºmç¶ßÔl¼£ž× ¡ï5'ïT×L¬åÊçÓð JMC§pJ]ŸñµY+!Û~©êçoTF8AML¶\afÞÝÜiä‚4m‘®ºú 1<ÓÄ)ŠÜ¶Cr*„~ý…9(R!Äï•%e²5õÒ_×)Pþ|­Ü= ·º\Ñ£8:o2ʯ¹Å±!é<íô–œ|Æ(9¥«n4#¯Äxy¦X|CÖÔ›PVñqþ®ÇóVoñ‡|ÌiᙥÐewu&Uß’€1Ÿh‘ç –«u躥cæ…‰+çÈê%è|$gkŒ0Ó"[³©gjæe\Ž5Úv¹ ú—çK ¥´ð7iª½ôß’ë·¤ŽÊÛ@¡¾¥‹#m- ‚Í”ŠéÆç¦=0ìõ;yà•½öVáéëÝuñgšyòh³Ÿ®±§B‚!Ya–TcïÊ®yôçû»§(µœêèºõU:aC69"”Ôú³­µ ÐŠgàÞ~1ÌÕ÷|áÖÕ(A¨A‰8«¡¤Ag?Þ'Øî‚ŸÍ—‘µ™³7§±`ê¤4“ÍTº »ðw£“þÁ 0ôŸ¨úæI™€ÃàÂOO,¯A;Ò¸ÇÕO è[ú~D£ûî?“ý:ÊNë¨e1,<™B&“lâ³åS¶3P¿õîóÏâÉfqïÒcç´É0t8uÞ…å’Qƒf+6pOÙãq±¤³$m-“ ïBÆŸºËÈ4CŽ@¿—G›¤º™¿DÑ·%¾å)}¶4ÖêhDÀãÉ Ëïû[ÃjZØþÞö†D,~WB>”Y¶ý“”FÙWüu ˜8l õ‰ßßI6 pX¼CHÒ8Ò}fŸ{íðzRq3‰Í h&>M »1Zê3’º†ÞþYSoòçÓm8_RÈÇ9¤w¾L³ð?¦€6ü&öNìÏ°Z,žªÐÇé|cšÚ¤ÐÔ7h vW^w¬AjKÂý°BQ–fMÑ7™Bž4ç„«™Ç¯Ôp–‰Ç¾GWÃîŽËR€Ñ& Ò:Ä¢U2„\ž6 PBmé¦G ×I¾R´¡Có3¹¤DhFëÁ!ÅÏÎîÔ=m.±­Añ¸1Eç]?OQ·¾µÃ©CZ?§ avÀß¡Ûnׇ4ÂÛ~dÓÄ÷à:Ý&ñã ¤ößBÁ” ž’Ù„LkÛðeÐø°õ*’á÷  }ðìŒkhf?fmšµ-í=F­fZ¢U^‹gz ÌI”âA¸¶­·Ž†§lÅ, &{ëw;ê{çŠç|ÎdF|™B¡éé[zïƒ[€ãŽÁ°éêb š¡hs/ÜÎ0áñº|¸îäí¹Ÿø(8ˆg+É8yDÝvÔevƒâ]«hã¾FBvœ~mNAí—=µíΈÑFL–— ŽÜÁmmä»OWqÎÂA›HýØT™­SÙB=AÐzƒB„K|ÔPãB«~:kóÊP¡ï»çHFfÖÙ!$[´yzzL&JIWKÓùJ%8ù|ÞeQšÂ7Ð&ÍÜzo¹Ìül«½ýáˆ1n}‘p­õsée"Þ3dÇx¹Ÿº­Ts…þçÏ5ëáqU7£p¬Ý k­ JІ¬©§Ô²ƒÍžS]m--­­•™^XJðœ$‡U´(К’ú¤i©á™l&åkͲ ˆÿ²}ñã=9»þ˜xÃÄ6Aáh‘5ïŸq)+-n7ÉJ‚6Úç%7W¯Ž5Ă"+lqË<8X¬màóS‰…' 1^y¬*½‚WÔmª3°÷¤®ýh¬pÞ•»U´±° ¼#•ÆÃÚer NϧÂ/ð2Dj·/}ÚÓŽ¹«Øm`™/„?ï‡~uff¼ú¦nóM» "W|g:éD‰Do—¡ ô¿ã.V×òSýk ÚÌ¿¢i³n?/~ŽÐËçOl ä›=Ü߇6¨HSR+{Ž™íø í6“­…$}3Y]Ãi¿}ÇÛm~/Gž\lÕùͬÕê—Ê ^¼xñüE ‚À`KÅýÝ^Ö–c^aåôòÚ®Ýýîå[®ÄnÃÚÃaP´™Ý¦/£Fÿ²¨`·™,<´0¿ @[†›yêû‹{ŒR‹F¡RÉ£Í÷ÚmС\VZò0XÛúšç¡Ýê>ɦx·«M’×*óð–›  Xëà”^þ6;Ê÷ø‹ŸmÇX¸TÛàñfS¬åÑFÜóDKÛì‹d˜Î‹ot~E´ÙmgñºsC»Í9+=[T<'JŽï$ÈÙ¼Ú ’kì.>ñ„η±É˜† ¤Ûx$ßSZâWçüî ’ì¸õF:˜M9ÉW®Û(]$^üÆ+8MƒÆ™µº D·â-lܨVÚOBØÌÃ¥òé´g9³D’E®[[%YÕmàŠô=$íÜÌ02´9ݸ¼ñRÒ†h3ÑüŒÂ´–ô¯GI$¬Vrä+EØLsÐZÿP€µÏ¹ÂM…D|Ç›â¾ûpqmïF5zuÖ…éu šÈœ·Óo‡ß\ÔfAyyó5©dC#×ýíËóÀçb’ö¹²vUè6d9è¹"ËŒ hã“þ üÖ’§2ݦkì­í\iv«ºÍÔÆim‚6I†„ÀÇ}(>'úR,¼7FäUÓèÞfthÀ~JŸ¹ºKl‚¦›·¯‰©Õ»¯X¬ëžSϽÔl®£üxwó(‹Jpr÷`q®aà>0úì_µì¥‚WpÔ_KµÉ”OÖÉXçÎ;ÉLÊ4øª…‰—#ÊÌíÉ Œ¾}:š†ÃPõªž•›L3#Ü´°X^Žpºg ¿N¼ËÙ†1ë‘9€`ÃDM–Ûôj’sÚÿ^Ð-6¯Éº:X¼éB Š\Ûïe{è²|O>bÁ : ]uVž×3="[ÒV-²¹3(œ"à1ý «îaPo\î"cÔ›§€kû}ä‹ÓÕù2º‘H?ãßÈr¿s¹jªí¸Ô £‡¶Ž6§P{õÃj¯å‡þõhOÉòêÊŒ¿ ÙÂÍËÉ"$ëÝÃw"ÉøaÇ„Ž.¡uAR’œCLßã’yôÇmí⎕M¤ÿ›^‹ð}ÁÌ>OG] ] …ªOÆR ­î„àaÁq§ÖéF›hÂoaå2›å‹‡XdÌMŒ¶ÚN¦™ãù%¹¹4•eˆ2ù ;Û54q½Ôu^LÃ{.Ðq½„\,mÞ¨Ò¥ Êo³ÀkQl¼´)!at×H†.SvF>ÜÕfZ)_di¸lHÐtõö55µ|óå3u?Ê­ ÝatV"‚³u¿j°d‡}Mh¾§ÁŸ“åg­4Àfþ6Š>™ 2‰ÝfåÆ™H~u—@ºÍâæR½^þå½S•þÞÌûa}'Râµ²aG¾©¼lúxÇÖåøÍ~¿¶ÎÊ9£<Ó5Ð!츂1JþäH’ìy;FÛÂZÖ—/ñš÷å ¼>Á-ê6`+²É›ßî>àšÒ'ùŸ}Ò®òFþA´m”ÓxkUAãâ2(‡'!ò+´«Kµâ¿ƒqF,\™µdRî7Œþ­¾™5ÂýÍ(e·Hü7Ÿ·TŒ‘’㚤 yÖü0*N60‰*ߢŠõŸ¯üôHëHÛ-ço^°¡ŠÃx>­¨üë¹´[Ôö~u^ÑÐƯá6«™^ü·ö¤¯ØSI³]ݳ&ü0DÿŽí™ÿkÿmcÈ߶]ÀÿTÞó›îåú›«¹%Q‘Š¾»?*™UÑTd¾åu~Éç‘úìà—;KA`ånþõ©%‰ÿ$w´­ðÑÝüüü; š‡d#¬€ÓyóæÍ<)=~Y±Hzև狿ôm˜ËÐç¼ü[K Ûå'š¡›ÝˆSèhÝ«üⲌ–FÛ_<º›››{ûÞ“¯}Ó²þ+â¼++ÌÏË»y÷QmëȺÑÕXß>ÈÍÍ/ÿÔµ®ëË«s«ë>xÝý®yzÿMûørï§Ü§å[‚—5óÿô¿•¡Ð2xë2xòøðõæê»/kÆþR1úã;’“÷ÿ©‚ˆ·×è»+wß*oq ;ï±`ý€Šäû†xŒM¦üþô×äXí®!Ó;ŠEvïÔ¦GîM8~4zw UggÄ¥2ô奡'T²^Rò™ÔÔÔä AÖŠý$bt<åi]¶Q.Ýo3IšÉñù›/âX4 íù8,ŒÏEƒÎ ÷G*ÎiaYq'._ÎJ8¡Ñ:ö´ eÅ\G)§iãp îÈþ¨Ý¦-縼ù•øo—>Î)ðà…ôdgŠÿù Pqh±£ oz½îºäu8F¹ª‹–fQ¯¡;—½Í’^6-VeÜlØ$bø§?×ë$wN1Àÿ®%¹Þö?À?ý‹=]ëßü¿ÿ þktò{Uöüx¿Óua[WD^þ±¦þ¹¶ÀÈcË?>Ÿ›n˜zÔDwvÅÞRþÒLc@d"²n¾ˆÓñ]R‹²¡3Ï—pë+üS¸Ô?4ˆW†‡GWDÐ%ºHÅ—Ç™šA¶#ݘ™œá, ¹“CãxÇîÔØÐ$¬´ŒÕ?dY'€À2›Œí[»W'X5 äÀæµ¾Ié˜m(ÓY¡l@ckÛet}mª/é›DRHì9th‡ú.&Ñ0€NY‹6×KJoACVÀyŒÔßwòDŠ²hËľY+7œqíMôsªºåóšz¢cš,Fó™¨×!šLË=ñ¸oîŸ4r8±ˆ7=vÂÛúHNÑø,·:C‚6CM/–w>_'ûÆAï/ŒŽÌ*º± –Á†Bð¿ü <û ™G[Àÿù'ðÿÂ] h#\.¸Œ0«$™»ðµÕÿ€¯{'J¡~‡/RX°‡«&ž™ƒZq|zX‡6³S𣡑±%¾t/hybtx```t|Z ÅÞÅÙ)D†ç¸pù¹ã]þTʽºö‰EÞÄPÿÂ2Ò ˆ‚7:<È]ÏN Îró“°¨ŒMÍɘ,\æŒÀ Aéðe:áôPÿä"¼5rdx/NŽ Á/¢ñX:¹P¥ Ô…ËC£bô31rl*äÈØ$RpT‚–Ç¡’CâÊá­`Ôƒ|qnx®ÆôŸé¥øJ¶(Öú–%Þ|Gß$”xg{ÄßÃ>”½çʽtV•Uy´AéuC?ø°´1´ŽgPuHþ;J3­¼BÄuºÍrèré“âª(Ü1æ‹w«cüæ•Å‘›L‰/92žÊvjpƒñºr΄¼Á¦ý¡¶,CÏK™¹CoîÚ™é{…ÇÝ,ùôá’Š6‹Ã]S‹+àÊlg?„°â\g‚Õ¹&Euð-øÿFŒø@v<øo‚¯ÿô_ÀÿößAžÚ|-€ïã‘qÖ_B>ÿ’_?‚ÝÁ1ðµsÙEèá[:Ópßþ(¦)æö'9´^6#Q MÜå`N0ÛñêDž4 Û)ðĉ{cŠu@2$S—ûMÓn<8l¦Æ:«4Ôˆ–¨:eÉÖ·ñJ:™ènA3°Üƒ·‡ƒmçâIÀÑò»kð†ÓW¥‹§xFÄÝDÃj徃Ç<Á\'K´ô÷0×Õ4¨_ko%‘ñÔøó™E½\Q]â6v8S¥†±G²Aðù!OÓ#7Á©ÊD;.°”‘èGÄ[ž=Ÿ5ÒU¬¦c5"•Ÿâ}öæ§ ]™ê&~Bí†Ûrž@ÞÍC›aªBMö õΚ/¢jj¼†ÇÙ¶2ÛB€OÂ,½r%QP';¿öÎ‚àŠµžNq ò 0íÓÑz ƒ˜P(ŠÖÙáù»hÛ/V.€øËÉ¡ útÁ§úrf+º Û&q¶<ë-ÙË™á‰KoZ ¯Gpeú •HÐÓgY¹øç¼IѦ<ÊŒþð[- ××;ûaP¦Ëœ3× {Å‘¯è§Ñf®’âq^&©êågRŠ DB@$^kõi:£ÄÍO ðõ?RA‘HA·ùò¾¯›_3ÔàëÔBt¾Nƒ§oàõ=ðµC©|úK_i2Ü$³n1Óy@†6bAYÁ£AjfmKªðç›h$}É æ¼÷v²l ûª%¨F»;GAÑ¢-™òjö/>£i>ìõ…7¡¤D²÷œ•ÈAóYŒ®nV|T¶$ÌÎ\ù-ÃT‹ øB8ª…؈–RÚ†d=hª®S†ÂÑ‚~ç› 9´†ØX|ê^ ,¨ª…t°¾+îÏëhâíåÖ~Ç×4æTgåãb Ôן Ñß ;–¿Ü¯gÿN:ÁÜ™UŠXÚô¯HÉ„µÚÀQYR,Õ" fÑöò1ÃÞz?ŽV@hAÐ…%„¡e9çªz]bot2Æ¿hš“Õî'D›žJ”Ya3CÛ/˜¶×ÕIιŒPNVI“ѵ"?×[°É%­èžÑ»¸B Ân”íÅ ºM¤¯™ÙÅ¥f·O §Ú²ü4‚­ò#Nïœ9àìhoccci¨Ï½)§!x­M"…¯øÚðЦ¥8™mw1<Åé¸À=2´éʄеÛt–\Ò³BÀ´ O\ø¹ÇMg-){Þ¬¢ ÞnAÒÚ "£® m`õcj ¢èaünw5 jrÉÈÿD“Ûaý9ÛvS´ydT­ñEÉKpŽ Í ÉàÕ»50}lî”5úÐæ8ôޣĢö÷Y{}A’£T·Y39šüüCfˆÀ©Gj„ÐÅ53)1°f&•f­Y$³äð"‰:gÚ„c´±ÇÂï ¶7°å,|}oÃCïn&úX3ADÐæ“hi˜…Ç]yñqtbjžÇI2Ý¡ :¨4ÖV^=—À$`£Ó$ªÈPGÙ³[1¾–ÚxöíúyÝ¢¢Œ`‡ÝWÅ‹½¢ñ<¢¤„ë@ÔmZ™ºZ=+c–šÚI^K¨¤¤¸dN°mÊÚÐÙ1„6ø—R\w£ìP@ÄFÓöù]~æis:Î* ',X¡O›åÑVÌy§¹}ÛŽ;þùWK(Ñ{{ ˜>i#ÓÓ3 é!¤`m¸>ºÚgÚÅŠ*¹´fZ°DÃ,Š¶tËBt¡õhoÈêciÒêVÀêX“ÝÛ~r;ñÀ]7¬ÇÃ-¢ÍôH7O i‚‘÷ôþ0jŒ×ü<)1Ÿ³Ñ•G`ÝÚpC~¼&˵_ °D˜i~ªD©ÝFF[B8|y&Î-ó #é)¬}(A›•™®Ð  9é¦Nøß¹m<«ÎtØŒ¢•RØ.WrQ´9îÄ‹Vù¼†ò=ñî×$ÅŸmÆá †»ëD™¹¥£wy™œy´!Úl¸ñ§A›»M«hóÈkÑFÀûúAtõ“]ð;G"ÿ_wÍ!f÷y°¯œY‘×mÆÊs´Íü¤%ææe\„A›zîP…l²(BÊôYë¨Å–rÄ˳òeŸa“ø×\p|pÕr^~%ÚÖÿ4(†Ñæ5¢Û@_ ûËuô]º_F˜’ŸS"XþGoK²»ƒ×0ŸÁ£í§_ÍKë/X„Þòû¡¶Š6¡su9lÁ^ÿx¬ÞoBÙ[ˆòyq¬5'oMTYW íËCN\ÙãBƒÐÌvÒrÉêFïvW¿¸ùºÂhÓ¨8“‚ +Ëw¬vÁš‰ß¿¸mˆá²M³§ÍlOÕ˜Q³…íc?Ú𺯉»¸R»Í¦hžó6rŽÍlníèhoÉŠµ±º}µÇQÏïxnwOOi^Š­«Š6_î]8z£Réz;$›Ú8V^AùÇÚÚê×…»m)dc׊¾åo¢óѬ†OµRªã‹%h‚~fxŒ#:CW¦ÛËÇÜÍtÍC‹ªj¾|i¨©.Ýí@³ 9‰ÊdÛ“’¶zPbÎÛªË_ì2Ô4w[¯YŸw¦kž¸Qüõ˧Ä@×½×ÖøV|-LÐ7 lnj„€9ÉÇrWâõöÞ±·R+ñ†Tž?”Z4¸öö2úߺà¾<¨UàëÿúßÀðppYÞn󾯅Fq‚ÿ1,oÿ7øïŸÝ$¢|-þi[¢Ø“ú8ÿôçÍÍMwŽØÓ\ω¥º`¾‹DÀ?¯iéno<¹'Ü“ê•XÚÛ^ ¥Á.©ùÒÙÙññy†.É~ï7‡ewvvÖ¿¾Ã±D°UŠ©£uùù‡Öæú8WŠÿéÊ5]<Ó g{äQOO×›ÛLJÛk›DõÏÌO6ÞÂãie5 M ÕÖ |Ϋ>P}[$eìHÝ£wèžsjþ)·g=ÌJf ´ òu~׃vÌùݦö•R{|Œ‹Iõ(N7˜;/¡S–÷C¼ìíí}#Ž6ÎHj²a §“GÆ“kZ ž%ó&‡zÚÛ»\}!×Ò±`—àã°U™Óú2ÈÝÙÞÍ¿à«$VÄ@ùgg§c…ýâæLcŸ ÉÂ7o’ÃØR©o²ÖÔ1ÕÓb|líÜjG„HC,z`‰¨Ó…d2îL øA‡¹Vmâp¡ü½ö«ºWZ‡%Bç©ëžÛ¯òcÚ:qºîûQÃÒœŒ?…Ü?Tž¤®´.ÚûÊd2•®{µågó0u›þ÷D†ñ²h5Ê|íýÄ+ý?톩;Bq;çûáÑ2va‰´ˆ¸ãnæd¦Ù¢ A¾‡D+K"eq„þJV¹w`tò_©7.zØ0 öÊÛ'~B´y]ÇöQ‰”ôO‹òš™'þIå‹øs£=#3¿ïkxf41ÜÝÕÕÓ;ÀYÿ¾³NUôÆֿÁšëôhwïO¤ “#=c3Ë?W ˆ–º::‡ÆçÀŸí¤:©HE*úûW}”]ÿ—ö?èHüQ1%þØf•ÛD½µ–ú}Åûã[³²[-*°õÖWVÁ ë¼>‹õ©æoEŸnÇjmSg„—ý‡è°>æjçŸÿ=Xª¥Þ3ß½¸æ]ݵàhõÑÊó„ºÎWÄ ½ íc?’ ¿æ´ºëZ R°úé‡Ý}Ô^¨»]ƒè÷仲J Ò Jk€.æÛÞN­ˆ~0ÔÀ­Tu?MÐøõ—_)¦îÞvn½ÏÜ2ÿ'“µ'tLèØÙ³ÿþÐ6‡¬Êû4Ù°‡ªX°”çO!é†/¾H"lOxé×Ü?Í¢i,Û’NtM˜úòÄш†%ÒäH<Ð1?/)œF&PYÖ÷Þ£* ï®G? ¿ ê.üwœƒÌžïi¦_5 Ž¾ùä0Þ˜K àû¹ëБ¨ÂÌ8•H$Ó"Nå£ÞÐŽ†Új$hßpÉŒ»y˜jÝ«hŠõ4#Èû3ùȶh\þw££ýu7 iÕøÁI ¥‘†'chäôõémÍù3{_ÇëT ݤl•D¡É$‡d…CÖøo÷msÌi,:¯OÂÑÌ}{xâÊœ8:•ÈvŠF$æS–9% ÝÍu/5’JÀê™y½B¼Ë#wºßzq1LÓ4D΃M w!Á¬¶{\+QçÆ>?´7¢A¬°öÙß)q”z+®›3H<Éç`æ,2à?ñÔ&S¨¨] D*(ÉÀ%tl¬LµG¹›ˆD·¨´y¾Ä™ÿíí“L2žD¢Åœ{¶ŒÜËŠ¢Df7¥G8A%qÍŠç’‚lq8RdÚSYø™ê–Âó5Žl2‘ÄʬŽñBÑñfR÷¸CŸë›{¼ë†0Ë^ƒ KIÛv®/p6f@¬¶ôÚ;Œ¸Ì-¿?õ/z’A€€C!bGy(ÚÄä´>òÖA?÷½÷U¾F"îHì.[@3°}R;,¹°È‰ýølØ7M°¥ûs  'G¦ÁúÕ|Ã9Œ–Õ4ê¿ð™ø®pB|ÚÑðDÍêQT—¬v†=Ÿ]Ÿ ’ ïÒ!?2ËvkœB<׸h:!ABÄógðx’×K#/¤G¹ +kI ‡6ðgÑ–úžg^‚c/¶“ÜG‡«lXD‘™ýF•%—3â϶˜ŸŸ_àrí£Ç—–òH"äAî&_kå.p8õ™Îï†g–?Vœ~H¦›¾l„ 0h«­›P2ÄðùãXêØyo7Ië|»P ƒÜJ†&¦¸“#Šº+2)æ°Aó ^?íQƒP €ftJPn½@(/¶ØcÔ/}†Y´PÉuIˤH$îƒ5ñ‚›~è.Y‡Ý>½"gh0ÊXßëÂk¡H(^êuÇk$UÃCEËó›·ª±ìy±ƒâ*C?küíêIpæ–.Ùmß}¨=”ê6_ÏxÒ#¯Š¡P$(:i­¿.73üãZÉ2Ü×Ë6´Pصu—£>Þö>+ŸïObí}Ë^Ó]L\þW‘PÈ›i§SÈËàÒ{†&ÿ+G p_ÓÉÄÖI>8xKK—ö âŸXÈ÷5Ö˯éËoñ†ºÞ×,F÷vÍ„do³\©zìªÑE‘̉v÷> ËÞçlÔC2ÑËÒçôc±H8×U¡M0èâƒâÏq8+»¤fµhÚž@Ü÷´*¸ÜíHTK{5Ë®'ÑY‹Ë|¾`¼òÜ6Æn(ïÁ·)TšùwE ½8Dp= "q$N›‘÷—‰Eॎ{’ ‘PqòÓb¤ŽÏmäðù+µç]uŒŽñAðñÙ`#ýB¨nüåtW}æ>Ø·0÷˜ÍÒ‡+†îò,Ùt,; >ñI8d¯‰½…Ž6ÂO$"²oh±…¢MºÚº(ð_!âta´¦Üp¸}»øPùfkM1O»Ä ÀÕÃ$5p…ÔM`~£TMŠøá`Õ Í Â›å)¿±ãdh£O'5ñVu›•iK"¥b¬üVkÑ¢5‰xòMÄ=ñô{Æb1<ð•{Ù&IelaVËýT(äêëÑÈ^YËÄ¿•öÚ^i_ ¼¸ê­ï~t%Ú`WrÅZ­R4`ªŽ¿? ®K°*b›uë“H({}'ÁnB›ÇžX÷ûÐçÉ–î±WA‘€7ÓˤÑ0ÚÔdÐÆäIÃ_Eñ%o¶åÑBT·ÑÔÅÛGÞàCÄi6!k?û²0Þûµ¦ìÃ"¶öãÇúºB먌úÚ:…ìKµŸ¾„9;”~þRW÷>ÒþöÃÇÎélæu0žº{z^fÃdRwÙÆß„fˆK$­‹Èôº(ÆÚø´Ìz#pÃ’ Fù`Ë©ZΓhغ¡÷$º¾Lj˳÷:‡_‚.8•á¦ôö©·;qÈž8º­t›Þ wvx|FÀi£‘SÒÞÙô<ÉÔ%Q^ïÝmÞ«i1¿ˆ6œI}00Ï€Ïñ:ž³È·Óm%D–‰@ªûÞ;ä¼÷’`¨Ce}—ž©  è¬…–ïÃqIQEMz¿+`ïaŠ9ù@%l®É:è•úrM1[ïž${ªÜ+ƒƒÐ”p%ˆº-½NzÔÝÜK¢ºá|ø¦É®øB48ÙA3vô‰:qÙzgôXz‡rwY§Áªã@UÑÒ]6‡ 4ÕI/¯}@0u’å{ãwx*¤­bèžl\AZL°‚ˆÔ"‡33Ú )dc\ñ7ÐF8¡MåäòšÙ ª¬,-. yG¶+‡·XSè¥r Œ6”'íÓhí¿¾HaÛíFusùfF"Õq¿xM”è©ÏNt\p¼[g}‚N;ŒYBí¢ÑþE± m]ÛîuILµÇL¾9“ò‹ˆ5§:šîÐ*˜”Åäë2ÐÕø¼æ1 N­AëgÎ>-=>ÇvÇžW0®ÅÚ2|‚µœ†‚4–S¸Lè£ÜÉé…ƒ­¥—ˆr2ƒÇhîIƒfœ2´!ÖúL¿„¤IÇAh3ʯ|/ÚÀƒ?}·—Õòà‘㧒¡îªyô5â‹*œÎ:¤©©mnï~ì3— årQ'Z Å¡b ™ GKh¾° ï/-•è°#üywiR°ql–Ô,Ž7c…=i†t›ßˆ~ËßF›)ÚäË£ MmÀ^¶®Vý¬¼€Ñ†ˆ~;Úðbh%– ‹Ò÷šï>)Ëda¬çqæM’öQ5÷}X–6ÅÅÍûcßF›ÙñÌ £ŠœvÖÞž×'-à]ßÊGÐ&emN­Ež™Ô…tëÖâL={?Yƒ‡Ûb!ݦ¯2—fíµNêVu›gû]õ#¯Hðv©wm âÐ:‰·¦Ûp†«HT欴2‡˜Û$h#Åò®/o÷z²œ>AfRäªþy´¤2l|Ñ—BŒ {ýŒÏË+ Ý·üÒ_€²¨k|*˜­£‘(Ðü[~ÕCŠ6#æšjÅ’û]—lQ´©Í‰Ã’(ò¤cpžI%™šz&öÕçbpæÃ<1ªÛlÇÚÎJø’¿ƒ_öƒ+ñ{Ùúq‡c<È&Ó£ŠN~:Ùý1ûêµk×®^Í{Szñän'Cÿ½Ɔï²wŠ:tðÀþáQKyaüNÎݧu?m -»ÿ•¶®q£tãÛ­KéÃKòhÃ)× ‡Jº¨xîlòEŽXE¨Ý¹#z8rq$‰ª‡—‹¾LƒÊÐf âò½ £XT¨¾C´Œ‚fÖÆdâ½Ï’ ŠŸ‹®=úÏ%¸ÓccsÈ‹“j:æ#ècn½ QãöÛИìë„Uðáù„Ò&‰)oòËu #*­ -»¼¹Ç‹ahIÐÆIß6öúf]¦ ÉÞ· ¡¦övÛ ZkC:©¨{–ÿ)K ï*1‚ Ç hØòž9pð¶Ú3ò>¡…ÆzÚ‡ç+ÝVÑô1!¥>Cà{õm AŠ6PcÍv0ô÷“¦t%Èù<Õòìhú+)':™Ûi_°&Í^Ïý¢dÉ£2]ê…Žè«hë™"ÙÝ9;ØÝ; #« í¡ƪ©Œ ÿÉÎ?SáÓ·õýOJÖI›¯ù똟€ø³)ÚpÅ÷ñæ’C±—ÚK4HæýèÈ4YÎÆj¤ô“ 8]ýš)‰òøìú…÷] òhs+ÒÕî¤ÄÒ^”ìF¡'Và™çv¬7*g¼þ—t ±YmDó–Êëi4MñPWû$˜ï/¥ÐLÐÖ­¾LÄhÇCœä$Æ}—è õ›º%€"m¨>—%üîę؄À1kÒ=YaðÅ!kì‘ÇÝ2háó¸žtQH¬,A!‚Ü{ ÈNLAëÏÛL®Úmv[aŽßAz%XˆqþÖšT"¼ÃôñªÏy>¢Û¨«ãÎ|”oð4'].ƒFLþ>WôŽ™Ñžeþ<…Ü^ ñë®û§ÃÐïC›²ëËb9×}*Á; Èœ†7t8„I Ç©ï’¼¾×›Dgùp‘9p©›OüB= ÓԧߦÑpNÞFt=ó ~¤ô oB4-.JÑæÝoÚ&hçñ±ÇÑØvf ²¾}%‚Kõ—Méx÷].æ,º©O;‚b7œÉ¤ƒE(3.ù1ÉFÞÉÉIf6ûlÉ7 þ%¨c*C›`|fÄDñ)æ/ÎWà•š…·Yœ¥³Ÿ‡–j”õîMõYQXŠéÑäÔoÏÜ4¬ö•÷°ßÝDíM êäÌË玴2*ú ›œÎb¬:ÖcמCQ»ôpZ^K¢"Ìv©ëÒƒö õqVÃ;"›ÑFl;ÏËW¯ÅºiPÜùß\I6ÖÑã&;¬<ö^~ÜüÎþ醇ñÞûñ?,×O·ÂBÏ|RZmλD»=¿7Á­òµ‡‰)ã€m"ý’Þ«Ðæ/G2ÎpJ äÑÙ]¶G÷‡kêÁ>Tè þ;Ц©8…e®®ŠŽ{’H×$§ƒ!Æ5ÃðkiÁµBל¥rú«²a¯½ù\³¸ ‚b‘€»W(  ôÀÓ ‹¶E®§Fmâ,uRËÐN:q×OÍ·r>ˆ–Ñ‚Þ\*Þ©*YV50ÝÔÎDìÐ?ŒAÒ:ß*-ùíì/ÑÐ{ ²¹ôô40Ö‡r<ï+ôc…ËYZ\EÄ_â. ù¼¥Ù¹%´ª+¼%¸èK •|y= . O¸*XÂ.Ä@dñWˆuè.3„3ü5f8è¯`e‘Ž%8;ébï2ò튬ʠ U»"ý.žä˜ø™b]VŒ¤íx0[ O…"ñ m>¨ úWC»ä'_o¶p¹Jãï@›öò ª‘­HNпÃ%¡È^+tƒ ¾"ÓÎuÈ5Üt9C¢Óédß”F¥Rœã/+Ž°‚p+’¡¥û‘aú†>Ð _àSY±*Í‚§¶<Ú@B$–y¤ô^qÓöº ]dFé…¦7H¶a–Fî0=ƒ ˜H,F…ä8´ƒu’3á@¥ÃAq;7L|R'šÎJÑñ 'éäýN( ›‹køÔ÷ЃœoÀ´ðK‚½Ü “}(z̸£ñfdŠ~¬¶½Ì>nŠÃzNÍx ;Sîq2¡š9abqÞg`¤å8 ëžîcÊòÝ{Îw?ÚG#“¢ãŽ:1)Ž‡`v/ aIŒÌ@ø´œKGýut k`뺻›J"„…±õˆ~ wàâ®ÌÚèÑGÓq˜ÔÔ3V|Õ‘bxò=ô‰]¤¸¼^´äSÏü5œÇG^ªé{¤:“¼ƒçEëÐF<Ç&c:‘£;Š²t±”|4¨Ãò{ÁÅËLçj Ì?þÜW:…t´DÀAs-ý£~Ôà’C£œ©ºžÇrQT¤P údéW¤››ÅTB©ïµ5¡™9:kÃ&ZyµÙ’` Ûœ5 _x›B#àbâýÌ(fžˆã1ð>Å Õ‹‰?jglŸ`‡¢Í|qÔvË ’Z,ôbIú“Ò6fFz‚ðdÞžÖäÃ!î1gr/ÇônˆTò3)jpxd„Œö@½È!´9uÿ#¸Ø¬·“\4û»fRð†×Åd:Ʋµw9•uw„+ñ‡Ä"¡hÉÀ)ƒŠAqŸ·÷Ah|)¸Ä‰¡Rî³…·î‹O8YÔÍBùè 8|'ZÃüˆX¢•B€Õ4)³Ô¬Atž9àëè`ëœ8Ê…‡ª•Ñ:k*1òøùKgâÙýê¾EëèeF>ûƒ5÷ÉVaÆ /=AßvÿœD½eY9^¸œ½Ï×É*ø z54(/ñ×ÊáÐs? É 9Ãk¸©Nu“ªøNÆĵ£Xá4¯!+ð÷üµ¬SÐA@4Ù€%°E ÐpXGƒÚ€HN¶ˆÌŽÄ‰;)@ï`v=ÈÆáÉiŸ$ §b®´ŠúÉ$z;zä­ Õoðq¬I6× ¸‹²{¹ù¦:Ùs-9‹jeòh3 £ÍMd:[ª®N¸Ú!P:“‚2b{ξ‡ݹKõƒöyŸï`l#ÆjÏ0-ííNZ˜DÀµ^¡P)ÓËbÙÄ EPØÏÄQEFÌ)~ñ†¿m`åŠkB'–¶Kšda·÷%pé¸òNtÇ'’¦¾9ÚÄû1³+¦@¹0 ÞöŒ°LI,¦ÚsæzÁÅ*Íæ»Ð†B`½¬|ÿVFï> çOHÐÛžŸ Xÿ¾™ÚgG{Û*‹ÆGúꨩYxÅJök¯4y\mDFý~ñO”Ùzy{-,Ñ_NVœu¶ŠÛQîvÉQé¯Ì@úÑ7ÐXþXYõòá5s¦yr¬?ô¸ïè`Ÿ_PúêÅ7sÛ³¥«ó8`&ÈA/âb)*îCÕ·tHìÊqÉ¡Â{]qW«!þ]Ûçezª¬üÍÝŒX{;¿¦¹ Uë¡ç¾d›‹(Ud¢Ú{?º¥3vÜc1§yuFÚ3¶,“˜3îÁOïß»a…%fv!û¤hP¸þYßàÎ4ûñ!nÑçÀ•aA¯sIbÚÏ<ÈŽH«™ë~Ie˜,‹äý—yÑÇyèÇ\aªžÏ*”v#´Ù®k-;wmÝhLvp½úbK°žq×xÕ8Êñ´£Ñ•ªÞ™² zp|q¦ùÃ×”j9€¯³öy~(šj%Ñx"°ìÓù×]‰¶ô+àlç#Šñ¡œL‚6 („hî²+íêƒy Ø®×m„óé$BV>ÂÁ»÷.$E°,‚€¥Ït,q€'I´4‰½)ÚÌ[ëêw 9¬¢-%¯rý¾ç‰'Í-O¼nBE¿o&…  l«1Æ(n9툠ʹå¯ÿ¼¢o¡s¡˜°Ñ&åüé'ÍjUð`¼®DSÑ6ÿ3ïžIJ>êç}$%9ùx¸›•OÜ©³W–¦ËÕvÀ ÿó6§ÏŸ_Ÿ>uÄ@Ï,9ùtò™=#Ÿää¤w¿¡Yï(áe‡¸¸Ÿ{*Ébev´YUtª¯Æ†”‰p½éuÒùþba§A¢‘­L68Ò4NÝý ›úÍ~¦cà,7A°()Ä"þ*§á!ÖÈEƱqž^ ·6bõP¡/Ù5Îâóû™Ž~7o䢔—Ÿÿ¼¡_mŽš³ìö'ç˽P5&\Ý• ádm…iz]ò<÷F^Þò÷0Úõº—$jUæACm¦ÛS–+"ù—ÜÆçôUé×¹y¹7Ö¢Íá|ÙL*`mpŽœ Ñš =Å&‚ ¯ÉŽ¡Dæ(¶dà'Å  ™†sZg&4œí±Ò«S|  þ‹9ŽDjçhI®Ÿõ=X0û)ÍÌûÞ¨|Ú’™\aMÙ“3Ç÷3 :.1i€2´ÌVÒˆô‹W%¼q#ï΃B€óŽŠÑ–ž‹^žf¶ ÚÍç°^’™»<Úܬ’øö<ö‚Ð[ðÛ~Dòß~cªå/E¤÷MTpzoN»(ÑmÀ)[âŽüO󲎹P“ª£e1„X(Ÿ§F§ÉY‰Á™±ÏyóÓÏ‚õ½ã3s‹ç£½^ qgfçlª¼¥žÊ[Ž§ëfffæZ¯|P³0;½´¢0vT÷¡Eå %.öШ›Ì¤&ýÙ¬Âi[yKÓ ô‰œµvæöÉ̇_ºŸ9¼u9´3ʇl€‹-xm–Ô¼ ^ÙëæŸòx°ò*ÍÊ ”®…?<bu0c¡R)Úô>IÁ8DË>\˜]@îKÑ^Ç3”Ê™›†»¸|ĉ…®Jœ¾±ÌL¹ÌEf†¼õhóay´ž@c,ˆPÍFXñø~÷2xÃM×9»Gúµxa·¦¼'ɇ®w¢øÜxÚZÃyc´‘ß4Šì)”—œ€Gû¾”¢:25m•³Ø+>ÒÍâÅøé¤sZQ‰-Ö Ýð_}@?éS·1ÙÒ°ÆÞd;îNÛG#YVXà“ €;4!kå)s Âó9p^mà°aËà 2¶k^rÀ™H°,€#Üô3‰:³%ï’“Š6ÜWÑÛÍ΢ò'›q&„6íŽ=ýüM´Qé6ß7“Â|êèí–£ž>Ø A†6¨Aôi¤F¶>W¶~5´8}¯6ÙìÙû枞,ùD©dÕ¸ãu‰@Ì-ýÔÛ×ß××S|5VK—Y<[é¦è‘ßûvEò••­îщld´è»ìXÞ=¿.º4Ž<&ì$Üû40:Ò—fL¥ ºˆÛßÛ;<Ø䤃MÿeÚ;Å…Áôúa{}«à¶ÞþÞîÖýDF4*7ؘ¸ÌÝmDq‡±âÚSçÝWûzûêé@0ƒoNÛ,v÷ t~¼£‡Á¶-ƒ3- ")ýUÓèØØp_½žnÆKHª.'eWMl¬ÛÀ337¢îÞ›5Їïi8Ý¢–Y9´:À;–Žö·íãcc_J¯îÀ™LCýfmà]08<üñöaMF šëv> ãÈï[ûÆÆF+röî0E—?\OÍ(…í·wOxÛ‡¦ÎÏÏõ7ÚY²µó7ÖmÄ·\¬@c ‚I¾VL}ýŒ·°h¼ò E€ƒsŽÄQªúæ~=g×l¤†ƒ× ÍŒÂÓ%S»žúŽž¬ÈNN=FÕ3´Ex5w8<°~T(CÑD‘®«ºµll¬·¾‡5êVÑf úaxB&j÷;ånn¾?{hl|l¸+ÖN×óL-tÓß’öªõççYztÉ øtQùax~~nê^’™Æœ‚.Æ„ª^‰´U´QÑæh3Ybj¼†ŒLÌA­›áyîi½f/9[»e½Qê}1Ýñ&ÜËÞÈÈØ#,®iFÊmøæO~‰ ÷26224²ˆIº<…º÷­Ì™º]BzÅDxü¥e{œ<ˆM†›ùÀ¢r·¡Ì M,=*æ%3©ù×ÆzL#¨(&&P¦ªB;0øánŠµ‰¡±±eÂå"±t,ÿp'ÅÚÈÀÐÐäpF!R~¬%Ýý!ÕªK yù]~"”¨•[È—±%‰Ó:)ÒÛÈmá´ëU;j‘ç¸2מ]2Rnäo5£`æÌ^_6ÛÐÊ=¬ŽØ±{XÔ›CRcækŒ·­GDÒ¨±º4ž Ù¤Ê-ð‰oœØclÈ6µózñòF™ló>žm®%ظ„F?_9jÌ6p KãKê²ÜûÚßÑJ?äÈ©“ƒø–Ÿ©C:FiþL„‹ÅMʶ¤ÒÜ‘u¢Ér<ËG†6An†Oj¡&'[a‚M2x{?™lß…Ì7Wfš F¨†Ãéÿ[Khúæå’)Û¼Ÿ)íÌÝOè#±pÞÚÜ(û#:œ°¡¸„ ¡'] H¯{àáèm–³Óáwðîþ¶Ò`W+¨äö¾1õˆ»ß|y4ÅÆÃÖ'ç ¼öË´Œ—š[8ä–µHµ¯™#Ž,¦qÒš¶§ŽûŠÑÝ럥™2̓›'¦ÍØæã¼.sº÷¬t„ûšçaS]‡xß/јûž›ÜU¡Íi3Wµ‘$”DM·pgƒíôk·ØlG¼<¨mœ/ÀŸW´Û¬}s}$p³#¿Ào¾ (DPø~ªùÖ±úeåén!¸‡²€-¥ Ïâ ›@Yhpm ¥ÜVˆw ÷JË˳ç:Ö´°îˆ5å)mnbÓƒZ”XPõbƒ¸ ‡[X(CÙÁ@ªÙÓψœ›¢ÍLK3£üáñ‰þnˆ35¦ò;QÑO„6bAMÍ_%õ*R‘ŠT¤"©èÇ*ë /[9S~Ó û†¶@Yż“Ei8”c¤(3Dm%®æúð;?z‡ŽÒ£pTô³ÂÈŸì™ä,ïWoRGCg‚§`¼ª¾„WÓÄxÞÛ¨ÿò{èQŒå¤ZÔP¾ãßÕoÉ9”7—y™Ò4µ´iÞÒƒÚÊ}ÍéšÚÚT3×m“ŠÞ<ØÚ6¸ÉRÂXOÿ»ª(ZÆjýVÝÃQìšB:agYÛܺî»Rž½÷×Öªä®Þq†ScHˆx…™‡èD<GÜuøòO>ú0^š cw” ¨GE¿kð’vu`ƒåŽ§afWßö‚ÖV>ŠÏ÷QŽ  0Ñð©»Êw/}½MÖ¦L:jh¿Gvÿ¸»±Kô!Gü™ëüükšºNþ'Øç~²&‹JÂ/Š@N]Mû*rÆ÷l}•ˆéÊã˜x©“Bæ+ÖX.ÿ• khCj³CêžB3â›ÎyP!8ºÀ›I IM3V'½“;7ËÝ”vqdOx0ŽYðêùaG‹ÿ¿½+ÿjêÚÂÿK×{¯2©9¹7d‚BJ! *“ÅY@¬Tj)E£Ö*h-ô)*¬V­ŠT(ÌPŇËÊ$$!A dºïÞÜ!¬²Úµº^×;ßOäpsîÙ7wgŸ}ÎÞ;×u–Õ©Oç1ÔX£¹í'LøѾ=ò´B;c©táÈb Ò}Œ§ïak *¶È’?Æÿ¾šÏÙZé#ö¥]‰Oßz°LŒÝÈàç4uÖð$1ëEÍ}wS”Ÿ–¯uE"-{Ä<Áú0v8_÷¤:^Ãâ¢ÊfjGu¼»6I.‚a8eW V:ÌÕØ~<&£nl®)Ÿ®©ùñB>+± z‚°ØnZ2]n›ìݵ^ ñ…;>¿„ç+n¨±"/p³­­ëÑ'Ó(¶™~V¯­n"tÇ6#‚y:óÌ‹‡Ú‹ äì<λÿÚdyÛÇ…`Tݧ{†7Ïi6Ê%^íQ1Ñ¡ñ8Ü’ÿ8ǘ ¢u¼YðQÒºSŸ/”¬zà²m,Qb¨u;ô¶÷Þ‡R¾@wë•Y.á¸Øy}ï'/ö®]‡¶ IXn¶qÚÚ›Œ Dï½ÕIÂu•è½¯œ9úrÂJ„äÜÔÀ*¬*Ó¯wnOØÖš’hŠm¤õØN¦Ö—´_”‡Ä¿n:É–ÄáGſÆ ‰eêëXåJçµ HQÖI]g¿$&¯± I¹´®1ŒŸ+4ô¬³ƒÄ>t_i s3jŽ·×±£Ôd¢´!ùJÆØXô6qùÂﻆçææŸÕe(°\4VÝU^·m`Òd27^(d«°åŒmþ]fŒ°¼þÙü‚³çf ,MÕ§†Ãk"aŘL}õL¡â·)Ãô´±÷êî÷£Š\w0k˜¼góˆ½ëc$;UÛjœ6Û-ú!}ÿã ,'ÉBgDór÷¸Ñ¨¯+ˆ¬+§v•<Ù†|Ÿ=ÙÆ«F†m¦â20ÛÆ£Ñ1?Îñ´m°ö±Ö#,hÇä vâ¶ãÒ§ÂTlúž¸•³ZqÈ‚ Ìਾy í0ŸÕ–½1yîs9[‹T’jŒ&ôÙNnO:܆Ø-‘BN Ê6úN»¦Ï`2›O¥ñ¸Lœm¦~iÑž¿ê!…Û8½NÏ8¦z¢™ÌŠó>öRÕzzBE¿›^¼ÙF÷S݉«~5ƒ/¬bóÞ4Œ(—~¦–%_›6›MãÏ“è+´Xt—Ùôx½ÃuºÎ>©Gë0œÑ–˜1:i¹´O²¦ï¬.?Aþi-‚•}~üLÅ.%Û¢÷U4ÿÿìõü)¶iÈfˆöóêxà Fœ A®¤ñ'»‰WÝ1ÈrÕeB²•Â¯ýŠÏÇ+Š“ž{33P…N–“×C…±¯É)Û²€9±Žt0%qˆ+Æ'duò¡> ûÅôÝØ¥Ú-ÐŽ/‰õŒmºçç>›s¶¡ÆëiÛ¸‰hámŠŒ[ô}?¥¶.kÇ.ç^ïóY Ì<ײà\ yѱTh÷7ÅLÖ+“Ë/ñî)+H¦C–:Xèü!m?G|pجv‡“`›Ù®ò=ܬC$«˜¥|¦÷JŠêÐÛ¶Á1÷ˆþÞ?V¬ÞZZã³Àyz!‡)ÐÌy Ä‹m–:Å7T¹"H>àúŽ}n0œC%£á^Ý;$/Fœ Ñ"Vc?ƇºÆ*Nl¦Ÿ'ßV‘«^ÍäB\f¸:Ç`Cœ~§šOäÊòO=X&ÛPuÀ‘ÉÆz¬ArøDÍVÜøßÊ Þßíð`›‰„ÐPX$Á!¾€EÉ Ö*hï‹bÔ…Né\AP}÷Ke™—p¶ ’“F†›m¾ÎI]säÊ¢c[Û`ñBÃOâŬ’«­n%EÙ7mI¬ƒÕOüÕÐÍ6.MµŽw…†…¥T ºF±ÍRþkÛhi^jðÊÐøÔì/ªîà+)Œm†çk?Û·¯œò“~,Â6Dmmóè‰-ÒòjÉÀ {Õ¾dVìnìðœ‡>¶Íâªü' 7’¬úF>+?™æ0è༱M¾æ,–§ëß{#7o÷ñØÝ(No¯p¥—¶?:¿ƒ÷©ÅïqŒÔ1S‹üa¶9ÅÙx›r”ׯZuü•§mcÊ ,¸M®¤æn¾]¾ç~µ„¬e±ÝØò¨mžHˆîAáX:ôÇ5±9g~R,›m6âü`3uÂLžÙ߉?YGch,ÈHtÜaõYÖ® ®¡" tQ!!õ~ls­ˆ™Øಠj¤¼>¿ŽöÁ1ܱüzw%C†Ç¡mRˆÎ»ö¤.í«÷Þ$¼·í¿Çœº®ï¾¸ò3e˜„­ã‘¡Ñø¶ôRl3ÓTÈÓàÑŒÓ/k‚‚ÄÒzÙp&">Ç{¼¦¤`ZÛéûv€q¹Û'bs*ED¯jóNׂ8&GGLLЙ^-‹·ÃJø™¯…@kQ•¬Ûw¸Ám›ÀÈ!r¥dÐë­vÏ…”ýÚé’„_¥÷‡²È„ijͻ··?’lÆYdnø–€ÃÀÙƾ0§7zŽçt«…ò=;G%ÌàëÝDŽ±§UÙtºœ¬?¹³Ò 0t|{Dž¾Ÿj¶Îšõ¦Ù%ÙKd7 ³¯÷aéýOoÔ?'ˆ#CöÕ‰ƒ°æ % *²+½³½P´³š(d`¨¦ËúmˆÃjѦ)î}|2/j7XI,×KL‹« ØfMåRe›&N&ü`ýÞ¼Má ÖGU]ø‹^‘ÊÙðÙEäÝK9 ñcÓr¶f@|ú–òÎ:ÖCñé9;·@0œuâîlûE(9—Ðö®Âq1Å6ŸiÅ]„‚œÎOäÀ‚ô5“'.ïÁfàŠÂ¬¥R)äAR©ŒŽÑÌNþ'‹V)£Ùl¶ Z6–÷Z§Ò8b•JIBq®g²³,+Ì»ñlJ–ïÒèï•4b¼d3¶ˆ V||B×èT¶ °ì'³kRŸS é×Fõq* ƒ£ÔûoŽ#Ž!-¨í7¯Ó7ºÚ<ˆE[—µ}kF%8ÿÌŠ®¤$á,ÌKŒØ?IDŸGDvæz¾t[¤˜Óð ;oóË/WK×bhèr¬B¡RD¡RHb”1òØ:÷\È…¹,T!`ÃbEÆ̈”)()Tñ»Pê(ËICŸ ºzåÁ0*¢"6{ÖŽ<9¬ M9êç%þúŸì,jí3Ó¢qI™Û5j9[øaç[_”F[uàÚYg€Ð1‚‘ñä³|ŠY—½ss*óKoõ¢c­5«*ê´RévEÁÙ&à%X°äà·Ÿû@zÈa'Õèô½Àéöj:<¾æúèÙ·ƒr2’#N§oW5ùÁ³ç¥›°6çb_Æïè-Ñ){€¤”Øß·6Ë:ÆíÞÆ…·¤Ô>OÀ¿ÑçùxvàÙ'µIµˆ‹?ôâÙmyÇÿi=l"êÎ^òwqºÝëÔ/ê+*ºo?±VIš6#ŠÕ´f#P#€?ÏÅóIîìÿüÌ­¿[¸÷BË_s/ËàCÑÚ³8×|»'9C{¼&Þìû{Tÿ+‡éáÉûðHhì^³D.ü5¬¨àïÿ Á^k endstream endobj 699 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 307 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 31145 /Filter /FlateDecode >> stream xÚìXÇûÇ)jì-½›˜X¢(p\ÙÛ½JïM@¤wé J‘Þ{?î4&j4öX¢ÆÞ€£‹½÷^° Rnÿ[îhbóù Ì<߇çnwnvæÝϾï;{Š‚ ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( € ( üoJG‡ôe[Ç Q[û ,Щµ]ú¶isóQëŠÊû;n x%o»y³¹u0ŒèM•¹óVý•go›6׶R“N(8W |Ùm¼Ö2(F ô¦r­ÚTÿð?  œvRÁ³zà˱²ézË )ÐJÉ«ú·@@ @›·& æ×)¸I8m°aºa¬DÁãÝ° Íÿ„6.• •x4‡½v¯R°'Þvʱò-^êîU#³îß{ÜZuâÆ0É[§ vÇž£s"&²ÇÛ?ž UW_Ü}òŒá]õ‡s—(§Þyð¤õøÅ[#Üp€ú9m\*yÛÛ°]u×ñɘv«÷g¤í{*oÍ ©ùïò32Ïùý|~¤—£ÍðÔÛ WŸýVqeè[§DÁ»¶¦§›=ÿußuzXõ[wæ7l<ñ¤ñÊ#5ï¿‚›‡drò™€UÆáö‘(%Þl¼ölwýõá€6@ýŸ6¬Í/°]‡+®á´I¹A"æే[=Úu®åe‡+/ÏÞRpékš`é¥×m'wá…Dx¶ãé“'“óŽØ¢à.ù‹=%¯móMh³ïF6¼S§­¯{xðÒógmRⱃvƒˆš®öÝþëÝ»W¯ˆ›¤Ëúû¸T%kokkùÖ§ªû¼®‡od @›wˆ6Ï'»T`—=¶wTÜy 8(ÚfîWÕÇì,AÊ®®ª´ýØ£¥\›TO·*“_ïo;öÈ:±þ»‚+¿4<Ú$¹Ã[ˆO™Ñ'×7<~(E±é´çäãàìÚáÉ7öœlþiÿe™oãVõyÒ¹¢ŠØÇ×UܶJiÀsøL¯Ùñà÷ƪ’é…W6{´¹ò6òú9õg´éXQKŒ®JÙ¿!«é%6¼æ×qœâÁK­åêëm­VzµÈ»J¾Ì¸P\ñ`{Ó£uGo›'5È€uÀ«qÁ¶;[›ý&¹k—qŒ JÕTáÝ'/6A+oï?wï[ïºå’‡{NÝWñÆó0œŸïmojöÈnü2çÒŠúG›«ïê-Æý«á¡ÇWÖ?¾+E;:Ú÷Ÿ|WT§wmß©æµWe¾[Õ‡±gràöÙPuÇ>£ˆ‡dxÚõý§¯ýýŒBÀñŒ#·5=Š,=!лM›é•² 'ž¶aÓQº`á+7t÷Ú„&ü³›_¿õ‚pZ=°‰\é±÷%öfûùçh[ëÙûmD›íÜE5c¢OW^{‰OøŽŽ“7_ÄÖŽÊoÆ;výö{øM¼úå>Q·íäçZñ&W¬:…Ç]":Þ†v´Gì|Œ}úq4é³gŸ-¨î;0ùSÚ.©“E2:þ|îà´júT*¸×•^Â{{öêÓÚøöí·Ïˆès„E:¼B+3_MñÍ:¦äUcVìÞ½û£A<ô®Ó}ð¸õöãÖ»-²/S,[q »±êÿx%jõˆ ×b7]þȽ:ï6~±ŸÜÒD,ìbwÞcøTh£‡JÜpÚ «VŸÁï­ÆÏ·ñVÎ_æ­BN›§Ož|âû ]´q¯â¬Ä«µŸ¸ªàḨšR|ö£ë~i”ÓFš—ÓHÞ¯‹ŽcÝ––ÊßþsÚÌoºHÐ&7¾&ÿ&>IoŸº›¹ëVöÎ[ëïâIžÍEµ N•>•ø®7žï¼á%:ó! ,Èri¸}ºhãV¥Zzë©ôVhÓ¹&›¸döol$iÓÒòäCOì¦P¥u=ùÀÐè]Ïßkn½éqÛùËœ’êˆäIíê;­ò–Z!ÏêMÍ8möŠëI¤(¸×ï}ŽAš‹ª] Úd.=Iæ9§‰‰fïÜTpø3Ú˜oÀè;‡.ÉNÕ¡7ñÏíØvBN›ŸÄ2tÊhÂB©(÷ÿI‰òâ3D$ÕnX½šjZ[Ún‘Ãon½ó¬ýÕÄ!4®¸ÒúäEGkI`iv!¶ýÄâOlÏ®kåL‚6ûŽ^‘z}Ѧ|íÒ>_ç^Á[}p§ñëhãZÉ^~¯U}8mª}ˆÃ×ì;©”›îIó½Ñn„ ~;m€úK–صJ&ùtžœž|‚–|J;>½:îN›+ûNÈ|Ïç°Iø¢M-¨ŠômÖ¬‘ù6Ü_ð¤Glj+ø½ûõ´a,'Öß/^—û6uk‰P᧥õ´™ÿoÒF‚…Š&[K1ÚܼƒÁ-é N›Ó›Žá³¸]…¼ b! «Y©`W9*¨þû˜ãú?ßÆÃ8iëw^õ{{EçÕ‘™äYE—^œTEú6{^þÚü¾]æÛ¨ oàÀ;wãÏ}›E×ð¨öÚm¹oS»O¡ÛWÖ“¾Í“æû€6@ý8KüúÏÆâËÖöí% ‚æíÃ/ýG×îŒv“çmî=T ­Ô¸ô<žÜX¿ò4>sƒqÚ¼|þ‚Q?ÎWÒ#K¼è a‚ö˜¼cëhK øHŸQ½«þUÚHóD§))'áŒÓów‘Y\4ª° kçã¥øœíhi¦†× múñBËù«4±YßPtºåêí‡Ô…µÃ}kF6mÇ&3Ú¦ê]9çÎÕúÚŸ×}•|‰ÌájVüÚ k,¬ÐsOÄïÜt·ÿ9<ÞÞ¦»¤~‚_u·¼D!ää ܱêH/jÂì£&¸Nž,–w%  Ð@¦ :I\÷>&ÿmN_4?žJÌ&‚6èºS8Úˆ@¥£½ešp5ÆsÆR @›65îNwÉGY7ðY*•¶µKñ&¥) ä±þ=Ú`ÍcK;ÈgmÐŽÜ’FY0èZ^ó¼ûˆöﾈïr«ÒÛðP¶½]¶k÷ê㔎ÕãkCÒöi;1Ðä¬gY$õç´ÙqîY§}Pô…F Ñ—úß_ÈìsäCz¬IIƦ\}ÜÝ>(º°€  лOwÉ'Iç½¾dšu¿JCNø­¼<åùñs-ÃUòMâi§å—¼ºd]xj,ùÀžœ6Ye'?L8ãþÓ%ײs_ίê|€íã%§¼~¾äµü¢ú¢š!‹Îú®¼l_zR™Üë^56ü¸UÙE¬‚³øìÔùS¾vÁE¬Ÿ3‚kÉùËÈ?ï³â;¼ö Ö¤ò‰d1Ù_-:‡Ág´——ç©Ü—eþÈQç}‡*¼Ž6BtxT"›á5 ¹Îæ͘éw”×T]5›_Á¼´ùÏicÏá¦(‰eoÇûÚ°5sdo mìY0Äfh¢"0ƒf¼d\F3Qáå$CX{Þd—´ïp¥Ov ‡©ô¯Ó°hëªMeZLsÏ%é'öÞL=åÎØGtU®òCÔ…ìM†æû©Iåc§L]OÜi!cŸ˜LÓª/Úx÷êÃ`Ñ„ÔûÄÞ¶/-m!Ó¨®£ ÏS¨3§Æ½Pˆ/ø Ú`§²@Bc¨ªÛ¦Ë‡–ªª­G7‰V©@›ÿœ6\Í\ŲNÚX³µŠ–6vtÓY²óXÌ &©r†¼˜l` é{|å]ú5.ö{=13Ë uÖԸDzL²<û|ž'dà×Eñ­YŒf-¾«½™iMLk&ÓËŸÚû@z¾]Õâs^C"K,Ï`1× ÒP’9™m_›Ï¥›ÇvÑFtE>mÆ’g6G4ŠŠ«èkÙÐJ¿ò²$Šmþ´ÉéI›’L›îYâ¢Ã4êì™Á— Œt|hm›ÆÉV ð  %DæJül*wººßEÙjrÇÐìëCŠ;Æ»±´‡ÉסŠ«ê¤Ä'x$Õ6݃m»ÎjÃýr›¿Î×Rij³üOíxßÞ ÑPê\ó*Ü©Ó¾LkWˆ+à1-Fæ½$S¾CC#yˆCoÚ]QgN›ý¼kh%m5€6€6ÿmˆEáq±¬31ã%¾%íG…9)¶™ô.F„Ä2Œ”‰DÇ^îÛnT!¾])®ˆCá~+UÈú ¡Ð¿¾«°÷”&ºÍçpm‡wô M©T1¾”Kã}Q«&nýAO›Ížû´!ú6*<¸%”H[ÉR‡¾Žo!½²ìí9š>Êd²HƒûQfžS£SŒ ا¡mÞ‹NfSm‡/ÅOëwfÆ Ã(EòÁÑãé¦SýN€yhóÓfŒ¿5Ÿ“ÑI› >f<~á@¥Í7fVáÂ.ß›ÔÅ7Tø ȹI¬©u|6×’Í4˜a9ÃÌñó€Å|ºÅ{mJQ嬣T…Íä«ø_TÈ“Ì40e!:&“¦ašþX´ùïŸ%.iU,îvŸ-yÙãíÀúæ‚B11XAÏÇûñ!·ÊžŽÃç8Vç%®’vyè!%a%ÛN¶ Êþâõ_õ;ä‹×xMYÌ"ûÛ!o³­ÇÞÞ'¢õµ}+íëX‚žÃ:ÜÙ8Ñ7ùö^ýo• |©Ð|s|+ÐÐÐÐÐÐÐhðÑÙh4¨¥,ü/hóèúà9zëÙÀ×ͧhkÇ )Ð?Ðýço6O[ÑuÇтʯì#èý–A1R  7Ua%zñáA›'ÑÒê/ÌžmÃH€þ.ÚÚÚÚÚÚÚ PÚ$ÒÔõ5I[šýŽ6iæÆ㱫jâVV÷RîᎿ;üª—‰kªÓv>û»õñ¿/Ó×7Ä®¨ÌØý¢û®œmgâÖœ(–ôþHÖoµñï—Ö¼®M)öWTÌ N›6k¦aPE?¤M»§“=„°xZº=e¹µõïÿÈ-=º]ÊÉ¿ÝizN±ô¬\‚–Þê¾+dQ [Ç9§¢gý:ÔǃɴÝ^Zÿš%hñ¾‹:z!9õ`Öõ3Ú`¾ v-;†.=Ž–7¡¢ZÙM³×vq]çö¶¹Ö°Q?¥³¦ía#>®îÖàN9LQZ~—¸7!TÔ(³ƒðèm=]Æ«´éÓ\ØFìXQ‹ƒÙ¦¾¢Shy#V­;m‚غ½hƒ¤ü$ºü”ìã]mbý©'›z´xçò-<+ë!˜;@ý‚6ĵ*ÍY»ÝÂDbÐaž…wñ± ‰4{ÍSc-¢3ÙúI{ «møs#‹«úúÔ¡k|–ŠSv“_€7›Á°ŽkÑI2œ¹îáfàÓÙzÎ!+N½Ja±ì5[;ÍeŸ¸»°R*l@£œaÖÌd2Ô]r.õôm^¥ îÛx»3˜s·¾ vj¶˜™è0t&“oñkA…4+/…Fc` B”y+Ÿ‹jÀÜê7¾Mîúµl u·¢cY;of¬ý]¦jSx»üö []Ý¥¨)sçͬ-¦È,½…‡°íýß·‰ÃÝ.#芅HzDß;jÓõ¼ý’ËFèôàµ/J«ž;ÚòÌÃS¶]ÏÞqÙÏ×aR_õm ·¬ÆÌå,7—2K7ì ¸-Þ7È߇m䞶óNÁ‘öRÉ_ÓÆׇÇv܉Ѧp»„Ǥ¸5f¹ýœó\˜åº]PÝ_°˜AwKÞ÷ƒ˜8@ý…6X€`KaÍß³ì*‚ˆchJa( Í?†ÚÓ!ÇÕelj™X‹f-]BW›“"éï´±‡`ˆ uC¶ø±s$ŽÜÖÓcY.Ü(ÄôôÀ9>rË;Wrà¼<ÃYØLú0Å{k±Ô{ÑóaÂ0s9¬ê4Wö²Ì\ɄϳhaÛd~Aeïþü%mr×mg1Í/0j kÑ’Šgù‡^`îVzyƒîò6@ý‹6e wÌjܹÁŽ±öþ1öþq6.ÎLšVüÑgV0Õ$]RV+[XÉÛº­A ÞÙÿ#)›ˆÂŠö’ʶ.UuàcÁh£Ë´Oj }¤ÂC5ùLלÓE»öpÔ)A;eZÁ¡›zÚ½³ÄâúVÍ8­²Ó\ùÛvæúÿЦ´ê¡½1É„ùsüýŠ«ŠÈ  Ш¿Òæ¦)MÝ Hš·>8—PÞ†ÜMy’‡Í<«›>$Uò·íâhÌ ü}àæmHÚ$7ÈÜmÎîØÉR£…ü!OѾùêš”¸þ¾%“f–!é2×öݘ¹¶ÿ¿hƒ5%®kM^±/ 1×ÜL‹ªÁw*¼$j´꧑T›‡ál­¨ªòzrýTa÷z)¶}¾)•ô{YÔ Ù«Š!uýØ#ƒ6§Š÷ÖiÒð\Ó!¤Nks(½h#jÀÍÅ ÜÖi®œ_J 5½˜Ãÿ?ÚT¾(8ÜFú3â&tIj “îUKІá“Óf P¿Ê×¢©¥±]wñÌÏA—žDƒ¬¹N¿ Ž¡ÙË­E âtٱǎ4Ä}vc+à¢ÆžYâ&\´{|Â%Ù.p1ÚÚ`(hŸdiÏbÒ©îµ "ùF:~.²_Õµå/QSŠŽZTˆÀ3a®ƒ…½€aöœ±Ù- ¥Rp1ÚôMlîˆQ…r¿Y/%TÖó^.ß."'1›°bB=võ ÚØÒµœX öÇIOd}îAbK™|\â¾Ç5lqKƒ6uÁÞ!EDå2T9ûô7–º¶Ý¸¢iÌNë•wa hðÒF„ŽóÖç¬!¢hò•jžò^a;>ï#¢V«irXLµ¦ynRÜAÌšVí4}eç±`bMñ;¨XŠ¾[·õ×ÒÆFÍFü¥™dž‰ÓësOßfhÊú,ˆŽ0Y³ìÄ# Z Stk¤äá,-- ›üãÁ*”ÜVãQTí·ã¯“–iRY–ìœa`³˜ïðqÂmg vÚÑÑAö,˜5Õ÷¨rÁ3ÅâÛS´Tè.ÕØm}Hò2˜ªñMÔÕ!ùÍʹÇg°fÓö·û¶é&šwÎÄ”›J…-C3«©ˆê´€ ýÄ·™«>§L¡ø¢*2cfà œÝi“ÿ¦>#° ò¼«“õ8°i6¥ÎP¥œ4Dõ»k=èŠaGÐ6ÉÂ2 VÄ^§ýÊa@ˆAæ{…-Ê…OÆ{³Ù6#ó[Aœ4È}›ÑÈm¸ˆ¸óbSÏÛŒ£#RX†~jBCæ¬Ã£"¤À¦š´áRM2e³¬}²¹¥†Yš¢ ¿ÐFŒ½çÃFÌGæ·uÑFŒŽw°âè.ê  2—³Õxä÷hdHÆ~ˆ1ëËĶWÚ1ÑÉ­í¥\BІÎú*î¦ /‚:º}RÜmp zÚØs5sËä)S_¶V¡Bù“0u¶uç}Hú&òIAcDÝnOç,ût® Ó(H±DÚh£ nžÂ§R]vc8•û6­ßÓ­s»}ä”õ‡ï:º7¢œq”Íú:öù+aQLJö®,ÝùJ$m í‰éͲ]â{3˜³f‡]ìá&ÚøZã´Yúd&“:+°¦mv1é³?Ë$i«ÙìœeŸÙb´ èg´Á¸‘¾‚è_Æ?oCÒæådcÚܼn9£A65¾½{#Šù—¨\ê4ïªW#©)¦¦TÓ8ÜÇ#h3!ýq'mf€6@€6¯£ ú¥>²ß* +°H*&—E5[DFR ³’®HÊlÕ,©ERD¬Ôþ¹Í<¦QÄ{="’’~0×’eÝ•þÍÙ€¨#Ÿätoï‹I¦¦ˆžÿ°âNÎàé/¥Œ4æ¬iñxÞ†óYâmy$uŒ¦A›{ ÐÐæUÚ`o‡Åd°¨ì3ˆnñ½i| ¦í6y–X a›ŒÍëÀßžÐ`©Ìônê?Ybq·—g!ª >‹î@d‰3W#êÔocžâãµ}m¢Ï2ŒïZïTÑqUd&Äsy?õ¹>r±bÁ ë岇vpÚÐÃÅrÜzc}±Y¦£ó^€ëhÓfŒŸ…+µ“6¼øœ,Elº•¶ä“@g3éšFL˜;{^¾2N„ ÓŠõªŒmhZú,êlU[ñÐ~²þ­‰1Õ¬¨çszÙÚlæ<BtL¸ÂcB|CˆÍ¡˜GËxÒû9â­RvÓ·ös¶&e&O}:¬i;Ù{ƒ²@îê`´aê|ꛩ®mLãk²`½o*ÁEžîÃÝûÎU”ðdÈYCl°‰Ñ®ø‚ÌÛ8Và5‰;{'OÞñïI‰{=³'œ¯û³‹â¿1®N»•É?Þýù=‚6ã3žvY¯T žîß\xcuÒ|+óu’Ñæ ¸°mþŸ´™a A±?hózÚü§q&ÚÚüi#U,y©XÒhózµ+·‚Ð ÐfP˜ü  ÿ)m®?E-v _þ<ð5qzúá )ЛêëèΫÿÅïI=zŽÞy6ðuû)ÚÖ1(F ôÔüâ¿ ÍÚãhAåÀWöü·2ÃH€ÞT…•èEð˼à—y€Àï€ÚÚÚÚÚ¼K´H¤¥uhù1´¬/•ÖໄXµµ *¬CÅòã6‡Àz.x AH *8ò((sWaí@÷mêÐäXcʬ™TµYT5ªÚl UâõL*Å2}MÙ´)Ô¸]Ïþµ>H¤¸ò¯vötE *“ CXËÚ9q{‘§Ʒȼ¹àÊ,´Áo²Û³`Ÿœ¹PýŠK0`|›ZTT«¬á‘Ö¾éQ[ž”ÕöKàüyÞFXsÇžjYüPX#Ÿ›Ûwš9G¦í)ÜSo霼ë^Hd”¹Ã|»È_‹êÑÜ5Ûm]¼,\"¯¿-"8€«tOƒgÐ"s_Ûâ”=m¸3Ó8â»Ì=(Æñ)Q]{|éïq[ïhœãè€@\c_ñ91ŽAéâŒ+§ùŽîi» ¸wTzèš­‡_Äú{‹-ì½ç†–çaw‡-GíÝ}Ì‚—ŸVãáa|Öb˨ú¼ßöÌuñ2söÔcãñлF›¢ßOÏsƒèV~E;ö¶—lXϦZúçøg®tóõaÌ¢Î_óT00"©?§ÍÆ©aâîÑžCL&bbæ꘺#Zø‹G•ë\hê»øÇ£~ÁŽªm ”¼u[a5uc¯´€ì•NtØ"v_ïÙ-®¹l ÍÐ Ú˜µ÷™ó ÈX•8bÉÁ{áÉ ïÂßc¶>׶øÌe2µæ¹Å/_Ÿc qœVc5žçó`}óù¶q›—”o2Ó¢"Ž…sœB.=áKÕ0Œ=„b-G/1cø™Î +;´0%•C£Ø ®‰jÁœzÇ"©Z4½<ŽÁ˜ODRÒèE ØæþEUäÞŽäU’Ôƒ‹6â=‡avÈ«±Uðb„¯ŸJD(¹e MuX-Åb"/;Ûe‹ Žøx-êå©Ë³]YRÛ;Éøé'ˆNC8<ž®…}äòä]O \ÚVÎP5'#©ÒŠ‡‹ ×%l}@tb1Ìâ'ì‘ ]àóYs"6 ‰í±¹ñ0Šü½£Ӟذ§ÎYúTÜ€FÇZ@T½¸C²ÎD§x3á9€6@ïZ–¸M/#hSÏ‚‚5«XŠ¹oz`ÑÞôÝ-åMøJé`ˆ¤ºÓ†É Zq R0b„Ç,fk{çVáéôÒÚKöÛòçeõW©?.ÙU¶g±h÷bñ^_/ß)»²L‘ððÈâu^Éf–f4•išVÁ1Ûã‘A›d2ESƒŠ+o„¦ƒãíýbla7fGNÓ-÷T)Ñ™A> Ù¤6¢NÚSL î‰1ژѵ3Še”K]ZŽÅh1ûÁœzwiC¦%‹w7Ú;Ùò4µ`ˆªí”ŸS9Ÿ·ùKÚ„¬ºMn'h³ LÈÈiS^{J—¢ÆÖ2ÔÔ•KÏXÇÔ%óH_Ic2‘[ƒç¢…O˜ò`ºµHx¬;m°ˆéŒƒÆ6]PøGôO‹RºÓÆ=ÿ,ÙA» ¢eŒ6Ž8mîÊhc²L §MúòŸˆµÌ) wÙ·A…µøê öWpôYÖÖãf†l“ù«z%?mÊîš3¦Z-{^Þ@,6Õ¡X8#®ïµz%ÍÿýÔâe’näÁ3º9w Ý'»QF2’J–Â0?vJFLéBñÒƜ΋/h”:IT 3tâ9ôîѦ<ŽAuËnÂÓ˜‹R2ÝRªð”f>}<,õœóKmzЦEØ€ú{ëÁæ95„¡ÑÈl_Ù•ÒšGIK PSÓ Zu¹”0&F$Á‘›Ö,æ¼r·Yʘe”ˆíªC“J0¬“p÷Ä’‡®N‹»S*:ü7icÁ¤" ·¶aG)kBƒü ä‚z0§€Þ¹g‰s7¬ç@tm 7û¼«yKóhT†¦¥}@¬…¥D|}"©Þ´©FKvVð!&KßÎ.0ÎÄ€Og˜„ï’ «{?OâÃÂ74²u74Ö‡±7,“ø]¸IEGkuhjlc«ø ÑþzæÜXø¸„Dsºoîz&9.ŽÞrQóïù6yº‰¾¶M`ÊKC]ÓoÓSQ ˜S@ïÚ³ÄÒRIk\ùö¼M1Ûð…Ú‚'—lÎÛ*Ø›ºû9¾†2à²Ä¥ÕÏ£ ~]²½ ¤‚ýg‚ówäi¹Zð[úîr{Æúª°’#E2ï®-ºhMìÎ6Ò'¾-Ú†*¬tÆÞç¯|%O×ëÐìÍÇ"[Cò7…l‹ZÑTP…v> “¶zhþ¦Èu·°jE;O„n Éßš¸ý)梤ý¼38{sÚþ'áÅ›·6Ëî ¿7…ì-¡/Yµõ9¾cF7[Qtäú¢Â !ù[â6Ýßß“ßÊü÷UGÒfyi#˜D@€6€6€6@€6€6ý_µhêÒ§øŠR´´”´$ÿ—8ëzü_b  ×è?ø¿ÄOZñÿµŽÝô¼0Ô´u Š‘ýý¿¹pý)ª· ¿tàk¨=ñ`PŒèM5qºý ø­Lð[™@@à—ym€€mmm€€mm€€m%m¨‚U‘¯¥ø_QOa{K¥}´FVv«Ù¹ñ­HÞ7á[=    ÍÛóm¤]¸<{åâìí”,™áâP¦Á|Ûo‚Žô1Ç…ÍŸ¹„ÐØt“ÍD˜\:¤n=>çmö¿ä¹÷ª]%öZ1½âŸÝŠ`šõ{Úȧ•¼³wÞµ_ÙŽm }oï?´™àâÃÒñÑ&u ¢¼_„*”É4ÑÓ‡£Áú<½­ç§:&:9rÙÖïg´*”5צé#,VÀPÒ ‚n6ét¢úØÞm iÌ^o{õV,ûà˜€$H'CQÔó¥õq  w6øÛ11 –ñ‹>÷Žzû6°òa^7ê–u|¯£Ù–ÅJ2½˜bd¬nU$Ÿ×xMåìËc“Ï+• ¤AFFý2ÃÔŽ¢o?Õc Žrú‹Ñ‘?©ÛQ ='!ù<<4”f¹' + ¢Zm ÞJ¿™g?%àÜ'naT‹ ÅÒÖïæÚOñ;=ÚËÁÕ‚YºÚV_,Þ«fd7!³]Æ!:lQ$Í8WI fP ïéÈÒtýÚýÇ!«§XZpXNÊÚD/?g‰h:|í¿éãÀ¥³5a†y>¹„/>µ5‡µ'-Xõ…gƒI™p²Ç ·¿Ò%ùð1…i±³mJÛ?™çÀæY{FIÐårÈYÝ>Ñs>6˜<ÿ×B~ùÁȈ­ù^1þ© ž¾lØp²÷OŸÏÏUçRÕ\÷bĹÀ†§]€£›0þ˜ù–<ÝròíTs¤©b›þEð^ q3  Ù®õCR$Ó,Ì!¾ß‡‹ Ë»¬ÁB¦ú•Zôä;>]Õ{|0‰€ÞyÚˆ[¾ã©Î ='‹žŒ‰;¡T"UŽý™ kNL{,»Mglb3øï§=RJÚ†À¬›Ig`B@2Õ8jhÉ€  þ©Ã43?|…Ÿ¿3ÑB`aÂóEŸ-®S’ÇAŠÙÇè,Ú7áWe†Ê?IgÁß„œTÈ¿¢ÁQÿ>øi¨a «iÚ^£F›): Ýå%m\ê°ž|îäÀÐIW"rÔc\L¸ºi2×(}7v.>”Ÿ  wß·ãÈô~pÈütÑÑ!ä½»¿ ak~¸ù“˜> [N¥3¦D\^„ Zc PYÚAHÖ﯑“Áœe?Õ>fª}ì´¹A4X…nY¨TÚsD$F„ÒáÉu„®þÎ.˜Ïä@Z?¸nS¢ï%¬g2©ß/ØBêãÐÕª,ö,-J™»!šú'YhW~FŒ[ûOiÃÓ°\+Ï÷El{Aªþe:þz\` Z  þ“·¢##WÏ0Gãkq44~ðÙ­(@ß÷Y‚ \Šþ<.ñŒrIW>ghÆ™ñKbÛÇ&_VÊŸO÷ŸÆë/‘ŒÈyòŽ>à÷Ú MmšרH.'Þ˜utXñ_5EŽ®èá¨Ä:Ì¢Œ‹?ö^^‹ÌÓ ¢œsyÜ’C£K<«TÚe(國ã—ž]9*ãngSC²/Œ>81ê舜ÅÜc/‘Ô•X16ù®ü £ãŒIk&üÏæ11‡±úÃóÛɽÃâòÙ×p°ð ¾¹¾•ùö„séþ÷:ê*'{>hhóï©øî$ç8Š—ÉóZ$a   Í[ûªæÃÏæ—}°yx˜2@€6€6@@€62Ú¨®E ²Ñ†{ƒc¤@@oªBtãÅ·N›{-èíôòã¯KÑÖöA1R  7Õ•Ç8þƒ_¯Û| V|U¡ZÅH€ÞT¢ð˼à—y€Àï€ÚÚÚÚÚÚÚ ZÚHU%U‰{+`¯Û»K€ïBK%RA÷Oao{VëªO´Ó—¤Ÿý†#‘þé±ú1´Aïø¸ð¿U—™âßégß=ÁB¼@ÿM›Ú¼ó´‰ v£ê8æWà×Þ¦•LõÙ & “®6Ö4wHÜ%ªA{LmI«óS*UAÓè!:3j[ëkø€–¾ç ̯û7†³m…Glzôwë× ùB/(¨°±çįFÅ57Ý=œ8L ÂÕæqY®uXô|â­œˆz4.š;•[z7~Á/kcv•€É>ˆiCÎ,a-*ªÃ%¿ûHÉëVHlÄöÊk¾²»WJºnè²vºê¿[´‰^èzÈh³y ¬ŠDU åM¸–6¡±É¡ U¦÷Ɨšîèhuµ£íœZ†U;ÞMM(^­†4n|¼äÛ´h×Q6ä™Û„Od™äÆ?… ÷4Hƒ÷2Z÷3‚ýnÿñ£6?êmdyS]'‘ÜX‡æ‹ýÔ8 ‹zQ¨=ÄE—®ã•x,Öÿ²ÊKÖ¦¢½0¿Špü$½Î8yf{n¯‘ŸÙ¼Ãä%Ñã-ñBf‰T؈ ïd-µÈWǾ¬TÞŽüòÀÿ’vèò€&mˆ3¾·ÑÙÍUSÇP×Úáš»`‰ÌÈ202ÒÔ54ñHMÜ'¿ÌjÑ%Ùù†F†|3ÛÈõ% 2:á—Êón^^Zºúúv‘±»Ñsö]¥Í¢}ò ›­ ¨‹é,ŽûÁÒº^´±ÒrL,yžµhrq<_Ó=µR6Ñ 4ùnK El¾6 s¸|Ç_ZD¸^†ÆÄéèkêY9§Äæ æÿ·mãêÛ¦í½»Àß‹¯­¯g½Sæ„”VÝs÷tåkšxågmÞ.§ ndáá«Þ~~ZzÚ¦n Ä1àÊÛ´Ž•9OÛÔ>y_~Y´V=´ÔÕ´X¸VØi»®eüñ D";³1¹…†ÆØ™5ñkI½ìV"¬Gc²s ø†vyUøiÅœ–GŽÃzQ£Ì‡YcÇuÙ&jBÓóçsÝ6eþ² » ÂÖ¶%gº³ç®žBc|X,ÂÖäëèóµ´çäÜ&éŠÙA°yW×zÉÖfMì*-üý0¦j\±ô@pB ‡JóYuOÜ€ÆÇ82õ½ wFŠwz¸ih¥ìkÕ¾ô±‚õ\ý wG ³£˜ÇäVàíž6bÓŒý ÂJ¶û†Ò(üŸó/í'´Áo¬Ü­ÔXN»°éÓ‹6ÚN©âF´ìX7‘˜=zßÚ€aºx»»›ï9¨E§z®xTzàVX‚?ƒf»pU}Úvq]³û\-ŽUx°`ßâ¢5fÚ¶§c—hçotÛÀÔs~ñÑäõ 6L¾sΩHrËVŸªiµP|0<[hacÄD´d¾ÍÑ &< =Ïœð² 3J´h³çåÔcÓVxà6m¶YÈÒÈ¥ü"–ÙšP5½âÛ´8ÒuìCÙ;² å„ÏœXT#ˆKü ¢òO¥:Ó:§¦¼þ¹«!O'xN' JºßšÿYêæoÒ†Ec:ø[:-°t^`nçÂ…Tt<ËŠ»/*É}¾UPÌ Il—*c½!¨‘Pщᰖ¤”^!ËÓvÑF" öƒµŒ}’I ÿ˜‘ÏS§»¬~¸ô­t:æ>iñö_¨4ݘÏr³`¶~Ê!â^/AK6¬¥CšmÄuÏœtÙì¹aò“µÂ/!V…C÷¡fºZ¾¥D~Ÿ¿ÙÙ®jÜð^´aQM{ÖÖ31åÛ=‚Â5™3è°æœðm%5hR©açø•²3›.Ô…˜V™Õ9«W#t8j/yZe‰)<¶z-mÜ5X‹ò ¾†6âºGöš¦)GË°¦îg«ÆV ÚÔß0¡Qxn–N¾„,ý,àS&kÍ.Go_Ccúl5Ó_ *Ѹ¼,á˜8,°Õ_0Ç5ÐUx¢¼þ©Oájü6Ý-?ü®Ó†Ê°ÌrY˜î–îQöÓElúôîóŸämªeËåùkÖ0hT-ßÕD&íE›@ÿù0W×ÜÑ·Óh–Îþ>¿6—c´að#7ËÜ ñöÕmbw>ÉHF8fiGPÒëlÝ$£Míã¹|6Ûpnçɲpò³tð]´»ÕÑ@G/ \D÷yóÕ8½h#K/Ë’º˜÷R–Ÿ@EBˆfÌï/Šò˜cÜuf}ñ3+8‘µâG„΋9@vFÚ¹ØDÐfeŸ´¡h&5þ™oƒóPJABóŽ¡ÉK¬Yn"1î• pÚˆŸ;kÎÒO9V^ßc •ˆždWiIekÑÖí, ÄoÍ­ q9Œ°ãötwΉ¿umþ6|¶—°ó²é|Т?ER}> ò§´ÁVõÏlõTL$Fº4Û´³‚W|›%‘!°CÞÑnF#l+ÞÙ'mZ’ òa6/q?aI š¿|)Æ#)Q]Û 6ÏÿçòºM k[}mô8ù"±Äæxr¸™:¯wÞ¦äÈÝ…éåx¶_Ò™®AE;7ÓiÜÐõ÷2—þŒù61»{ŸÙœµ[ÙFØ6²3Är@U;†—ØH#ªéÏÂcDº»]8Ÿû÷iƒ™¨äðu}–ŠÇO×Ìx,âs²Ü8ÐÀ^“ªCÓ¼èl÷äÃxÚpéI4&#Á&ê ¨æºÝ\Õ÷–6áÛ—UŸÖ¡2|V^í­åÑèv’¥Çñí¥»k¬]Ããw<ÅŸñ(‹¦RLïDË¡e—ô¡Ùs’ö³¼MßÏÈWÀÉÖÊ;…§gkÚúÛ²,KêÑÌ’TdžxHŠÍÓÌåI ŠCÖ Ì{D¿­cª!ÞËo’F+Ú°ÙÒ=9ûh»xW_´Ùñ´xãƒåS~m±æ¾À×ÉÒÆó6x¢f •j± OSc»2„ù–A¿–4 ™ê]ÂÜøâÊkÆl˜ªÕ;oS²ïŒC]ϳ$G¾è_^÷"x¡/„è'ïi-ÝÛȧÓmSŽ–“gvOƒµkXÜö'¥ÎkÃÐœè]ø¢ÿI4"Ƈ¢1/£MÎq§!ÁyM„t¤^Ÿ®B·þ Ú¸ºZèÎ+ÀÜ!üª´{»ÌÑ4ta2L“ƒüðàX“‚ñ£¬ç˜ÁlMs— ].“kºå™¸MLòA- OKgo.‡¥es_$Í)Oå2ic×9N®˜¦c›W ‘¥ ¼¼m&]ßÊ‘ÇÒàéÎÏ8ò?»Š^K›0o†›œ6«™³™‡6.sç0`˜Ãã÷”¦OÙé¼µ›&¼îE)±¤èÁg˜Ô¢ùÛþà#T¶¶…UÆEQ#šÆÁ0ÇÛÒÎA`󀵘eÄ;·Ðh¼n´ùEƒª³ã©¸AêiĤÑt¬=õu`ÿPˆÁ•=ÝWƒzû8 ÓØ1ÀÄÌæèzŠÎb“WTÿÄΜͤÃ&ó<4yº¾þVHAï5)´hý/º\.“NáêšéèëÑi4Gß}é=Ü›­Es—¥cg–ŸY7“¦m“Od¼óÊÓñ¦uæêé l0Ý3숅»ju5™Ú6ážQY:úžîÑ4‹ÕBŒ6Ån^B7ÚXhK‰Gn. ‚`DÏÔ:tm ¶·xeBáTˆêÁôDÏÛ«Z2·žK^2yÓùœýÏeÏYa—Ù®k)N&o8™ºõ:6;ë*Ø{3uãI¬~ÚöÛ%Õ϶aWÔˬmç±ú)¿]!ë¿k‘TÁ®+É¿]&c¢’£’×ÎÿË~J¤Ù[/$o<¼áT/åx^°ólòæ[dº‹ŠÝOY"ò¤#këY¬Næ¾—d;yÆ<•±ó¾ †0ZÅ£ä g Ž¶ËTñ iÃÙ òm[~FN¥n»URù,eÙü#m²çm$­ÙÛ/bFNÞx6kÏ“Rù¡KŽ4§m>}$s÷ãÒ#·’6^)yõ1άÚ㌭çSðþŸNÝr%ïp+™Ì'÷î»Õyf‹å‹ãäO!Ž˜½÷ig:®`Ï” '’6œÉ=ÔV´ïrò–ûXÍâý—“6ÝÈ}ÚÂ=ç“~»+[oªx’†5ŽÿxùÑCl5~ä/„`úƒo.€oe½•oNá‘&æÏ„Ìc[-)®’‚ü0    Ð[Q SXhf¦ÅP× ýùa@@ ·§´5ûB ·%í|&ÿ¦°      Í?§ÍºøLðÊ9ŠÓf0ŒèMUT…^|û´yð½õ ÿõ“¯ ÍèËöA1R   ;Ïþ‹_¯ƒ6  %ƒ@ùè±ûƒc¤@@o*ºü2/øe^ ð;à€6@@€6€6€6@@€6€6@@€6ÝUôdHÁ‹AAT©ð‰rÁ3Áÿ´o)þ·ø…rÁã!ù͘” [þÇ]’u¬U9ÿÙ%¹ž(·uõùŸA¿i˜ìƒ—6"tÌ|3žV‰BÙ` Mû7æÖQ¸¢àŒš¡)ÛUõ YD×4e°h&WÝ4þ½â:©ÿ-åí`Rg±“Mˆ…p©ª¦Ýñ„ÿ¨A1:Î+èý´‡ÄÀÛfiM¡Ù“}PÓÆ׊«#”ÑFˆ_!¸DÝîMbùv¡ìêÚø¿oN›I–vt“È>hƒ ¤Ï±—JI+uÛ%Åw znï4E¯íäm½÷|ô{:Íæ'%¬B9ª°UNÞFgRfzï!,ÜWËÝ“û ²·'¨óoÊúÜ{€¯ÒfSúiÞ%¼c˜„Í_[›²é£‹Ð>¬ÑÙ·Òž}ë|»ôåããÔfÙ±fˈ "¢áŸZO„öhPb ÑFú¾_š»©q4LÏjÇ+ä628Ü£k§ëkÁs~Sȯb²5'ÆI~Ðå1mvË.†þNâú±LMK fq5ŒÃÆg<–SÛûâ3·…t6‹ÉÒžéøãPù¤SJÛ3ÃÈ fq˜|›I!5SF1}ÿÆæX;4ß“îíôêÛAˆ}–öL6  ͼª\Ü.›Yù—&Û¸Bl6Ä5™â³[‰€¼Rt2‡ã>´¸ƒlD9*šËõÇ.…$›ë0,c¯¡ázïFáíI¶^›i»}Œu@H´)Dß‹Y=[GF¸‹˜Qy/d£{…6Ÿg£]áO):$e7Öø,~áÍol=l6“c8ÍsÙ7Ÿ"Ûvx~«ìbŽÉà°]‡–´L×fà? ÈâP­Ò0ßfš w¶s fê¯lu¨N£Ã‹©<6“¥7ÅïPpJnO¶°Y<õ99Ãrè,­âï> 4Ú,EÇxÚ³´ý?Š<:.¶âSÏ…< î¸Ì…ü&Ì£¦iÍÿ:ä‰ñ70Ú 0BÕòù*t÷Ä„ÛÿÐÁ~·hƒ_ä燳™Ú_„í_ó±o‹Îù"ÌeÝýÞ€ ™Æ~°¤zlìïMMí€a…R¥Ô?˜tê÷¾[ÆÅÕL\´^£ªæy ŸÑñkašúbûYL:ôU³ÞV?žª©/~?á*î?”ÉFÒs(>¡Ê¦PìË&ÄÖÚ:‹£Aµý « ÏGœºh¹˜ÏòQÆ^§•s!MuŸÏÂ÷ŒOÁ yyR·/}?úȇEƒ6iáŒ,aAš_„î'ùÔ#œ›¼ŸÕ·oÓ6x†Å¯‚!õӈ㖜SáQ5lK&ÄÖŽ‹Þ1CbÌ)Âi›Çƒçt£M vZÜþ^ü/L:2)ìÐÈôm¦1Õ%8mì `-·ï½7ŽJ» 4Ú,C¿Òe¨»o“]ù¶)—”°k;ÿF›™>;dwŸ<Œ6ðGÞé0ê#©g*ü™ª'å¡AÇTS=ŠY!VmX¤hËj‘… ¹»X4äóĻËDoLž ʹ·‡åµ`ÜøÒD9w?Î" øÐc¢™©$ê·Qʬ¢èÁL >Û:á£è¦¡ù-d$;Úm¬Ô%%gs)zã‹_O›ô¹Tæ7‰Éí#ryîÊ%¤ËÔö™Cð4ïÍ ‚dzø**>çåXkŸn¤¥j»±ÚP¨_%=šsw®;ÃRÌf«0 ŠÈ!Œôñár=†t†:Ö3oƒWhÿÖÂÒ÷Çã2¢ñç9 †ÁŠ/: ©k|•ÚNÐÆrN|û°(âøh32¢ †ÙãòdÖû ðm&mÄw§Ìû*â’|™ò¼MŠ<7icC®;Ë„çX¤ß™êÑMÒp7{ñuö Ÿ&ü#Ùû`*crøyÒ,#CRØ°ÖØœ¶qÁijfùJdý¥èÇn^0/LY„¾ïåÊâxŒ,&¶/C?qóSq;¬ êy®c‹¹êÔ|þP¯€+䞘¡ÃaÎÁΪŸÇÑÐü$]¶ý¡½5G3kY!MÌÕÐP@®·NÓÓæð¼BT!ùG6…õuÜ#¼YÑÓ™ÚLÊÜ1Ÿç{l€©Š"¢câgß[»}|ö/²ÄøMç0•®ª²à¤lñ1©ŒMažü’ìÛDWÏcáÌÕ*ÿƒìvrE{²‰1›ãŒÓ¦°¢ÁŸ¥4ãõÿmÓö°˜ð×—ñúËЯ­Í@ÞfÀ=ÝgÎÓ`çˆH¡BÚv³Mœ!6KÃ(dæTç‡aÚ× ÏË/¿JÄèÇ´1·e3éH·ë*awÒŒ½¾6SÓVÅÜ• ÁÖbE2m%B‡/Lf 4š¡×,#sáO[P‡¯ÂdÕPtô¶®ª©§ºa›|I®a^›ah‰ šªf^46ƒ©é>!í‘ã"VÛG‡¤Sù|ÆÐ4„XtÄÒÐ÷ÛAîýÈÝ‚iꦾj:zL¾Ù§±7ñ–½üÆ„ÏfYOqIŸaj÷…0ŸéŠ'ZÓ–òizcs厙0?‚) m+¬ÆÐôS@7s¯:_›Å6™mæÆ€5º#hïä[ÞXUíó¬Ï YÌ¢Ò?Jm!ƒ¾‰>¡L¥˜ÌWÕ3dr ¿ÄÈ€5RÖö¥¹6±œâœ1ÝÜökßPdý^Q»‚èá-ÖQ·JDZ hêU8mæi2M~í¢Í.Ý|þVÔþñ<A1õU×ä}ïšÎ‚Ù€6é› Š÷ÞËy"ëFÁ£aÙ·på>T,‘=Í>,û¶r‘üsÁKì­RQ{?ýæ‚rÞ=¬ÿ=”ó@þU‚gCs°-·†æ5+ z<Å'7Ëí!Ï»}õ«ßžsW¹ðe·ôï‹!¹äö{2»õˆYdm*>–}<û¶üˆ¨<^kWÎû¿öÎ,Šk{à–gŒæ½¼”——Äø¢ÆøÆÖ<Û‚/ØM¬º‚Ûváo{ Çm»1Nrs2ÿ’ÆMÑUüŠWÁÛ¿ ÎOªÂ>2±êÂ+‚›C×Xy[ÑÓÔ‚ÀÛ‹ø·pc\é>Iý+ÿ*ÜÝŸÊ„OeB}Î*:û±K´´3Xº§Bÿ•BÏ¿WÀž´´úœU¾áë VQ Ì-˜âÂðÓ£w)¤ ¤ ¤Í‹«ê',ŠzßH?òfÆÑ×J.ŽöM¤666P¡ŽÚ7ìø%PÚsùåð*ÔgU1ZwæO§Íõ»è{èÍ»/…ÞïY<… õ™ôÖ]ôÚÝ¿â×ë6À~»jÌ«ÿõº—ÁS¨PŸUÅɯ×Á_æ… *üpH¨P!m m B…´´yfÚ´ÈÚQÕ1tI/ºäö¯² ;.}ZkÒÖEºä8 ^<«%X˨ê8~¹hÍqTѵ#ýŸö0@Þ©1éG•ÏÅ6¬Ð ÖœÚ6/%mð‘¿dýG'Y—BÔ¥±Íݳ· š4 ‘<Ç?pã1 v¡ÑáT‹õ²ž'^QT¶ªñÞc®Øz;G²ÔÂÜB" :Lc7ž¸]Ôú¿ï¢.ïBÓ£m 4‡Øµßð÷žš¿t•¢k]'mýcÁCëíð|eB1LÙv©|Ï9\Ê_ºZYlæ¿\üì-ƒóåW­FùjXµÜ*Úvº²áœ×6Ã#j0ƒJ7µÆWmŠlN^ÖY­ž`Zù)]¾#¦¢6N´¯pïuE;v°hõö„Õ—Ê67FW}V}Í_±5qíå’ QÕûD-£=“jíóq³7t/Ž`ùî{Eí~ϘҒF´X±ÊÊPßÌ+7F°µ²-Û°+nÅ9ÁÎŽ˜Ê:þa´dÝÎXÕ· 'ÂÒx>C± tWÒÒÎj,QÈ–(¨4ç$E¼âÈðlKÙzÖ”‚8—­éxpÅŒ©wöq öVÞohŽ«Ü#¨K[÷µ´ ç[;ZU·?JrL}9ð¶róÞ(Ù ÷ílˆ–“>_¹>{ÛM̘£¿dÕì‰lJPµT¶ ~§¨`ÇñÄêM1[ÒÖž±™ì‘£ Ù8÷ðC#!--–Ƶ+?Ü߉ŒÊÚÁ–Ô5_ Ù&Üöy”¸}ȶê­õQ’É‘Kñ|&Èß’²å¼¢ùr|u]á£·’%›swÝ*¯mŒ­Ø[½»ð@Ÿë Å%ëb+7ÅËšªZÑtùÖŒÚ ÒVˆ‚±Ût E’l:…bæ“âž ¯GÓ·I‘ê2$’˜>ѹv6†d½ˆý`´GŘ0Ü—˜šÚåšÐà`.Ë]eȵ° )©nîõ´¹âïI7÷«8Ò7²Ӊ旗ës˜FQA™K`ðgÙÒ\6Æú6~ñÅѸ8#šãII¾7Ი†ÖŽQúl*Ç:MÔ†¦ä¦1¨ˆup^(ÿ3É°–W؈^ÐYLjšÏ€ºr’žêN£P,s<ÃÂÙ4]®ÿJ,éD‹ ]tŒòcÛ òíuÍŠ^´ZN4Kõ¶¤š»øE¯üUÚrÝÁÆ€Á1vŒ5Ô§18å*dY4ÑÐ=Å+,‚MÖÕóß,éÔ$;O£ H¯rS(e ÷m99~T2ÙÜ/Ë+"J¦Ëv“‹ðSÎ÷Ñ6ÈÕ$•hY™»Ž_Ú|1$.ˆJ严ŠcÖU|ÞÍdÐBU?Éš.™˜Ð,\ÓÙö©‘ë]\)ëÜ#Xdf„’È sß4gw{¶q„¡ Ý9û¤Í¦²çŽ/w¡uÕ™eÇQE'ªh8ÉËZ-hì/”,žß‚Tv£¢•QàÎÞ‰Æ$ZÓ³œxqµ 0g°l þ?µÖQQ%–ìk³1Ò¥°,l|ü²WgmþYÙ‹ÊÕUÓ¶vf§”=Àeàif¾3¤—¼ë>p Ü…Õ´‘Ÿ@³Ò(fEU ¯ºPÅÁF‘Z{eiË 2¹ú¬²óá+‚°¤¶–C]@7trLå•l-Ø}CuL“ ‰k7PI¬¨µTÝXkU«dd²~Ú®ëò'ÓF´<†¨Eò[þ øRÝhI±/‘ÏoÃ>®l _9²n£”Íç£3 ¬œÜ¹F\ªî–MBæÎk€Ì™ùÙˆU©&º¨éüÞTG×E‰Mð§ÐF‡àU†'5Š®Ûþ&nê.·cT½Ø2PéŠ5t9vÃù²Ý?ì=a… Î¥‡í#b›j:Ber Ùú†lð¯“H¤XÇå5á5äªJ„iPc›ªóœ%‰èPuLÕõÚS?[NYl©©ÛŠm.›™"NéGpÖ ÈŽü``@ó*élã†ìÐT˜% ?st!mÆ|•XÚ|-17‡èÐè,¶¾m°âŒúxÅÖCöÖ‰ÂäY«Dx0oN·_-¢M¸ÛµVÚñí·º¿ˆ›nW¾á ìÄ-·ä#iã@1—Jº¢M͉‹–D]GÉiÕÃ.?‰68p†ò¸~qã­Êúoœ¬ŒÓ A3š˜–È0tç7ibBU÷Gº–yÅ©šž§Ò†]…÷¿²óÍ*ï0fxTY ”Ñ„F!S5J"tŒSwŒ°Y]%Nûìš þRå¡aá–ˆ^,°øœ^’OgÙ7jZVv_uÕÓ5)h­é~vÚ˜Ð\²;4×=ò£Í ñ¾}ÌÅ´øƒ½„F´ãUbl)‹gÀçoë‰L£ô3öÝRt`9”ê82å-Œ)~ëd0Ú8¬–¾˜´‘¶Þ-Ýr¼¬ñ¡•ÅÁn ÷*Z¥lmT'oº0µÌË{ñpÿx7–8<‰6’¦ëE›ŽUbÆ:Åf¡.Á$óó{¹ˆmÙõ_jºÎZ´dgðØÆùmºÐ¼ ëGi£èºåmD1Lý ´P1hÉò•t*#·ßSÔ‹E_KO¢€#JUÃê6xZ·û¨™ä!èV¶c£"WÀGX†‡4¶©ºÎÛPˆ6]À¶òro@é mŠótŒŸ6õGØ:Ú‘{4@–9oÊ%BÚŒñLêè…¸’åå‡4+•ª®Ìu ¼¿–­Ý&úzhÁ7>)šmSÝþbÓFÒô“k¡Eô^ñ°å3Áº: D®8¯Žm’w>…6Š/Д0}’¹PÜ­Ž.ÎZêÎsRý´´ù MØÊoשּׂ¥Q(ÁŠÓ*´­÷ c‰L—Ò#}•K)4n궫jFI¶¬"‘ô“v^üçWûé²Óª»ÕËëw‚Ìu–Ê´Á(”d¥k%Ô„:—-«’VÅžƒÊ“«ùŠ[®&Uî4ö?}M ãFA×> §±pcÆŒ]wQcÛŽm2+fÃÏò´JªÃˆ®Ôï^¨ E×´BMª–yžÚÓÁºÍhs\Úø£)s3ÿGuu«¢v‹ë6cœ6ŠŽÛ<:ËÜÃ'£&¬@éìaOe¿¿T.ÒÕ¦Û…•„¯ ŠO#Á±ôV%~i3¢‘"iMKËÈ!À%ªÐ7¾ÀÁ;€MÓ1ŽÜ$³²í–‡—aî˜!,>ôxÚ€ôA´¯ƒCÓ5tK̬¶·7¦q*ï«Ú´$j뻦¬>@Ù€¼ý^jF8‰€˜»…{Ä•øÄdÚ¸¸Sµµ\KÚð ÒÝèk„ëä—·&<·Â„Mäø-ᱸ¾MжKX“¾ô€—Ï!Ô‰h.“?LÀ4iã·f’¾CD@¦ÈÙÕŠL¶.¨¿'oïÏÈ Ó ¤á…JG'sÅ-ÿÀýßZÿÞt²e黊[Qyǽ„hGªžOÎêˆü*s*ÓMX­Ž[·éZE/O_vÈ—æîJ0.“CGŽèii›‡ð«{ä‡zžJ›c²Ö¾°k ÃÆ7{Uhr²¡‰¯>—êœ{ÒfLï·Aåí}‰%"'ß0;ï”å%G4ÛÒª6ïó ‹³õ ³çåÄ­þ^…×mÒËÓã륃{- SœS^œL Ûˆ"9p24­ÐÑ7ÂÞ'Ê5ŠŸ´sM“eì>èæj˜SÒ€Hól#w U¨2ÊRìeø[ùç'cRì|@w­,oÑtEÕÆÎ~aÎq5Ã÷Iñ]+üM q¾‘v>1žIŠœÝwT]êD [ϨT:ù„ØùƇˆ:°¡u@½7¦xy­³oˆglôÊ…åÖa›¥ÇPñ&™¥¿TØ9,/;ü]Hb¦½w¸kœ¼¸Q³¾ì,ZVëæ¾>¯ôuKGî·)]·ÅÁ;¥øá¼R°b­wBÆîëà|`[¶x™³o¨­O,¯²IÞ£± P„¾®~!6QªÓ’º¥VÁ«1,·£|¾½o¤wE·âȧ€¨¤õ—eÍ׼ãCŧ4Wiºè©Äjƒªž{‰9öÞa. +*šo››R\òNÂ'Ær•øqþhö¡=å þbÄÛ¢Jü¤¤#ÿ4ܵŽÿvÏüÿöT>‹4ðèc\OÛ$<¬Ã5§µ>ÖÁ'ìÛdžÇuÔÐEkÛðãÒG_´Žx{¿põþ´õÕoÅÏ2ù*¯BÚÀ'à3àPŸ«‚©/2Ü‘H·.ß–(ªus7§š¥óÛaÏ@Ú@Ú@}î¡£Š4³´ÔÔÌRßØÆ!ZQyôAÌÒÒêsS5XÚ± ˜vŒ®½è6ðÿ%†ÿ/1T¨/ÊÿK|³½r ýùúØ×s×Ѿþ—ÂS¨P‡^»ó§Óæ§h\jºsì«Þ6ô̵—ÂS¨PŸUÍv¡ çàoeÂßÊ„ þ2/¤ T¨666P¡BÚ@Ú@… ióÇu`œt`œ Wƒb/~ûøè Ú$`Þ’AUŒŽ1 Sâö<åOà…ô|_²aþ‚¦äøÛüÈ’ÿé—ÒæI¦–öNÜÄ^+Ь2ÍwŽœ° tš+m²›#£.¶¹÷÷´ ML™d]&Y‡I7œç·z²P3ÑÆó¿šZzåeóQztÓÉÕý#ÿ¤@§†[qEžb +®ü#ï;ìuÕ×ù㹧°ƒrôõèla‹[ðz˜‰½ü÷4ÒæO¥¢š92+¡WývbÕÅI•wïyÑ-·Œ>Ú ¼–Ä¢þ'íôá‰Õ7&–·-ähÓ rÿnôòþ9Y.ôÙõ˜à/Ñò’ÇÉÂÇÐfJ”›ž Éž½ÙWÓ–ÑYéƒÒ¾I& û°ãÊ+ŸÒ?ÕŠújœøÞxÑåW*n–ûĸ3MòæYzN‹Û>ÇÚ‘Á²œîâ°ØUún”‚ÈÔÖvßõ±ð$I Ìò/ÓÑ·úÄÙmP‰Óæös#DÏrŽoå'6îôAæí³Rôؼ͹ÿå­{7¼šÂ jùnÅnY»>µ±FèÎ3yKÿYö=‰M™sfœä滑"… ã.üOLóß#œÙ\‰:“š˜»šN$,fùè²ÙLnú$üV2ËQŸf%"8Ï÷”@Ú@ÚüNÚ(ïÌÖ[´(î[l$ƒq%<3-rÛ$ÑýqÂï? ½Qr»å)Ð×Ã2èzöX}Cü Af&TÇ3Ú,A§ÙQé«0¼€ãâ‹iŸŽÊL Wùŧ\"“n¨cá?×WöVîšzê\[ÈåÌ÷Û¹¢¸PgEÿm>î‘}ÏÕn&€{ ÒÉöªÍ&p|rnÝG[&à½4®æú'Ìù‹â~ǧÆz3 †oVáç‹ZÈDm²oƒº“ßòDL#&HžÛ€÷6eëçMT÷§ìü<¦›[ úùÕÈ@6#tŠDcÕ?B¼ØœÌ  Ùìt=]Ê̼›˜JôÕpOŽ^Úxüãÿ AØ™ÀëêoqÚ|ƒ×ɯ, .š›y˜ôZ˜ã mú>1¥\¶©¿ÜqâK‹ É‹|›1Ú¸˜ÒØ.SDj{ BÚü>Ú o{X³^Ó’›_+þq‚}€é¯ÿÈ8ünìÆi‘k?t ¢³­§€ôAt £Mb¯:.¤Í•´O&_À†"ÞÂt{dTÆ6øšŽbà„Us"›Ú!”,ÄfzÊ—˜å’_pÚìR‡:o†82YÙÕ.(/,¤ÎÓo›RôÕk…@¿~/0 ¡»¾ŠÏúI%'ÞNÚù~Ôº÷c6,Ð[DàSxjŒ›]0A]iQ|§K Ìʾ ©ñÂF¼‰O¡òæÇ2!h†¼?_÷3ӱ͒þY† ªsõ«3N¿–½ ÑaþKˆÑ†Cõš,×dC2b9HØ$N›à`„ånÃi£¼ˆÑ&ã hümÄ'äyóNM-T·r¶µÉ2{¼ ålH6“‡¨´ùƒUbé·"JIL2¡Ó£Y _bE_h#4†¾ÏŒˆÿNØñg(ã)´QÙ´xNÖ/šŸ}ßÓp”Æ6CÕŒ<÷ÇÉî¾ïÿwþGhãÀ4”ŽW» 8­KÖ¦#T:mHÉ šÁßEèk‰…4„¼Ø¹ü½¸íï$6_o!!h6œŠñjÚ(¿×%gä^T05è·h£¸²¡, ?<ÔŸS#]°ºÍ’;óXLBf…IÐþ°§ -ð¹&;žhƒ—¾Ÿ…6Â&2…8¬q*ƒF¦‚0L hÃ%ÛÖÁÀÒæÒF(ÑIe§Þ Ëd’9oóo¿‘Ï`š¿V…ÿIF{ÁÓhSsaåÓÉÄ6v”QÛÜ™šÓ2E8|k:®ª¡#3ã{G™†6Ê‹ ¶ù4ý¶/E5¸]LOå/ó‘ù:¼.ì5ð})ú1{!èË?L›ësØdÝ ú¡ØæŸ>Fxl3b¢ï–fÔà–ÈŸmD_Iófã͹‰g66Ï6⟧K§ îÞF¿Ó&gä]}#4 a;½*ROÒ[ÛZ zÖ¯Võ? ÍÃu›ÿXèÐlê4oÄ'´©£²n#>§ÃX ë¶u‚äAýarÆz¡M˺¨¦Í§¾;5u›!Úàó}š›n¶d‚b°´ž¹÷­0UÏi‘ÏK>«v|b¶”NÒ!~fë£ ú–3‡eįÙÈôó|†®ºn3%ÌS=y°Â?¡¼íÝÔ/~‹6!+e¢âÿAYß<2Áu÷ I÷ߎßúzÙ-HH›çCEßözˆžÕ'Þ•3+™šÑÙúÇla‘H‹‹§WèêëM)a“ó|$SªAO¤™Ïö—L”{Çc'Üú¯‘!]ßíc¯‚©UÃc|=ºô0L YDÍäÉæÚy2(ÌÙØT}ÇÓ‚Á´œÍ[ö‘kÙaéÆt–ÿ™ßM‰ý´‘¡ãÍdš6Ñ<ü#¿m›O¼ÝÙúøšÔ¯óŒY4®ÛDzÜãÈ âÞçëžDÐltáÌwIÿ åØoÑ}%CÁ$tì2fðÄó-mÙDÓ—öAÚ@Ú<§ý6ؾš7ãW~ì™9Ç={fèæÉ"Mz5)wçlÏì9^åo^§ê+¬l®kÑ?„è„âý³=³>XÒù·#‹f‡kâœ)éu³½Àùo”õ½–"û/¯é98ŸT%&Uy?Lú±gÎÜkÞ,8‡QQ½ªËo™úÁ«úU!:5M4'àÀà6iõO}T6×=ë¿~²7Š¯h”Üx/D0×-ã£Ð­ C&–›í•;#¡{R¶â¿ÝÞÊ/ÍtÍ~»ôšº©WRVÎ \öèšÔ””süÄiöÛL*8<Ë'wŽGá¿sÎM(\7×wûxub%ùõHÙ¬9^e囹±°dÓ<Ï%›_´nžç ͮхé~ùsÝòßÉ;;Ë7÷ßYx±Z~mºGú{E7ÀÇ'§‹>ñ¯§æª_Öþ!8ß=svЊ©•}jØþ+ªô£°8O!màS™ð©L¨P!m m B…´´ ÒÒÒ*Ô1@ÝZl&Ž}­@{.¿žB…ú¬*BëÎüé´9=uí¸4öµí"z»ï¥ð*ÔgÕÎKè÷×ÿŠ_¯;ø-övc^×G¯Þy)<… õYuó ôÇkð—yá/óB… Ò*THHH¨P!m m B…´´y>*mEÇÐ%ÇÀ‹ òNtɉaÚ‹ªzÀiÏõ¢Xk5 å.T 'TH›—†6òŽþh'Á6K޽͵u“0ÕÒÕZÈuNNÙtAÑŽáè÷_¨•u Å«ÍX#ÒÃg™äYŽÙ'ÆÚÜlëÏ^Ú\ iió8ÚÄy™"nÅjÚäÉÅ$·•´Ü*mºâÍ%éX¦ùcTªì¹é¬Çʯx{u Þm±ù…¡ª‹ekvøDgzÆð“k/*;Pyûð¸ä°Õ7äíƒwÞ½ÍîÑü¢úÛO§Mž†-Ø|”·_´dÏ·Ì8õ°%r`ɪ]þ±9‘ùÁüý¢.Í,Õ®wKÞ(k;žVè‘Ç+Û'lC%W‚âbXd¦}Xv ¸Eqô*/µ nÅy̤.´jkcPRGdn@~-¿ •ãí$ËÏ—¯û xä]ž´ágฮ¢ývzõ ï˜\Ϙ¢ðênŒtD/õ yª¾1¹Q!õâœ-Go†¤çǯ9—T(pKß%ëÄ.-Ør¿t>8MÒ©î̇Ü£+I_\] ÃùGw¢…Ë·ûÅKGÉ»A6 |îìô £S¸N‘yaë°€baŒÅ6Õ»1(D·ø€ ¡£³#1É=pGÞ‰–‰|Èæ©NŽ¡•»ã‹J˜¢sõ—J0¶—¥îEƒ#Aüy—>Q+¤î…ˆmú33‚ $=‡ˆÒÀÔ"3#=ŠM¹›æ¨‡‡žžCž±GV¼¢>$&€¼‰Ù!7$ÌšeU&̃2³’éFnê˜ÿ7iƒÍ\iÛ3³¨fiû°Ø } +ÓDfÙGUg•™s$£~3öWѲÓÑÞÄл`K_aÈ¡˜†­–µÜL*H¡Xžy«ל–7ž36$»Ÿ³»DRBÔ![†ä í,Mtï¼Ã(˜ãÞ>úl‡÷ô8y}h\y!5jæQxˆµóH&dqCÞRÙÈ@¢/)–H5rŽ©LÎ5æÐ×¥bÐKÍW--èÆiö‘YŸÉ»ÐRa6Y—jÉ+ Î,13`‚άl{Ð3˜v¢ùüÝÐ1º‚—^fiÁ¡sC@2ú*3ÓŠè;ă’3¹t]ýÀ b0–ê¿H ¡ŒýK7¦î¸&‡´c´iG+ëöçïu‚‰ƒªzïxs˜•žRõ å’’–^R=v¸g&›-•²c ˜¹lÅYèPrV=œJÊ|ˆf’ç_ ý3b›ûéâÕ1òã`~œbœ$/ Ù„™íém¨gYÕ¢ŽanÙZ¬’:ÁŸ¯”RF¹{î¨ûÊÓ•aÕ¸!ýíØf‹ýÚQECGg®[ÍÍáÕ ñîN6ƒâ/<…} ´¶¯…E§Š{Áü¯L#h‘ý6ÜRt`p¯/'-¶ÈiFUŸoGd6ôƒs¤G4´‘¶Ü²7%˜GŽ¡ hó/6–t«ðÍà­¯¿1Û8XpT}Ñ{ŽÖ$óØvE×Ekê|¯Z„¦Øu¾JP´KFôÞÑ[‰Ë“V‘ã½T¹y¸Ñ$R5_·²Öãºe‹±€ •úÞ˜Cr)ì–á—–8¡Ï¦ø ¾> ”=·}¹‹mªO/éÆGQó¹DѪ¦~Ѧ:•³î¼w_´y=…ÂIÝþ+æþV YÛ©¤k0‚dC´ÁBú´|sKLé ^†8(Gfk mÚ¥<hãO`¥U«1Ò‰ <ˆÅ¢l²D„yéÙ$ [À ýÕMä.>®lÇ«QMlèª:îä.ÝQ  ʤ³©‹ü—aðôÔ3ò¯“´ã”héstdZDÖ¤¨Ú¾·Fˆn¢^†È»ôu™‰‡~«nCÕ,Û#Ø4"¯Âö©¾—TÔýKW¯£S()û4†);®:²æ;mtˆ.%­šDLÑÚk µÐw  Í6Œ6xÝf6_KwèÎØ<ä`ÏË•ãšâë§ÏõªÕxÔ:àêÆ2 ÙrŸ OCŠ!/¢z_nÝÒ.«X–ôà»Ã.ªj¿ž¥Üž¯½ä›Æ ¢7ÝÅhcÅ°‹Ý­&måö=,²¶Ÿ´'{M;Ðœµ¶ËøµòáÓ…¦'¹‡ òYO‰ZQÖhvY ÂÒ[Ú©þlþ†½ÆD²§ò4èdqÐÖmÆflÓËóé²eHU‚t_ÚòƒnFZÜÔn5mtõó0¼à1L‘ÀSC0 7ªó¼úÛ’º­Tº~ÎÞ>Yë II[îz»ÚÐôÌ}s×%)$‹ÖëSú/¿¥¦1o:Ù´q´‰Ø/Å/,v×5,•ô¢e¥^T7‰¢ë¡dáÚTÒÄØÁÇÂѨ•gl¨ä¸´cämºh© !ëgÒÄHŠÎ[>¦ ƒøZNmZ€ ]S5U´}mB˜ëº¶¿æq´‘<ÄÔÒØ=ÔòýhžÃ1ZÜ hÃáúíÔx¤¡  yÛÍ„ÌtŽ“N§Q)&1k~Ò”ï†Ìk¾â`b@3p ,Ú”¬¿ a›”6?üY0ŠÚ!mÆ2mTÝm)‹íª¾ªéƆ–`…”F$p’:Á·ÿÄØ_h(’gS²m¯µwGa5ïñ´ùü[›±ó'=Ë—FÔò]z ØÿÄØ8ÛrÇÃÉÄÔ9¡dŽŽˆâž^%~Ò®ÉÞ=:Å[pBÍ=ñ®Ct„¢8=X·!y.½¤ž§y2à€ <° Ñâ¤5à³r¨nÓzÛÁ‚b¾KŠ“AÖtÞ„l¿«Û<†6{d‡Oø%(+Ž¢ ¼&£hlb-¢'|ȼŠÍ[DzÒ~¼—:îÇÆ9#btí=ùÑa´iE¥ gM8dǬ&9åjdî²¼=·êœæŸB’Êò÷ÞV»YÓù­©.‘·á’l너XqV}\vø›ÐìµGúdjÚ,¶+êBÿè%¨£0“êB3Ó¨Ç5Qìáï©ç·$)ÅŠFwRôVHžIa÷,IýI‡N1‰ŽÊ…ƒÇgRG¯Û˜³XfîU–ëôÏMM\ÛèØmw¼½ž@õí^’F$¾»elßý=´ÁÖ¤ÐÂÒh2‘fZêŸÎeè.2õ–6Œ6,wWK†MH‘_T<›A²ŠÛ (¤jÿÒDgÛ6Ò5k§¬ù¼fMªm b©„¬C2õÍ L-4Õg“MSËñêôãiÓqÇÝŽÁäš»D•xG%ëë39ÞÕøšÔ°€äÐw\=„cË J¯01¤»æì`±3·”¤¿Z[ Å6Øùå²\ŠÉÈ#Å/±À„E¢zç7<Ü9]h\ˆ1©o’ïŸgjÎ¥s½øGú ²ó¨T†e@®o\†‘>…nšV‰/ÉIÒ#èpcÜÊz‹ ÆX•XÖv7µjU`š0¬bŸ°}þmh®4BÑ#¬ÛìŸw@Ò©YºÔnÈ?¤yÛ6 o»îhl`“T'o]õá§W‰%õ§¢ äé℧A_ºrG@š$ù³»iBe¤ô”TÓ'ý ŠhÅ×ÒÁt ¦å({=ú³»ŠG¯Õ>PP½ŒWyH†Ïk~Ý^æRõZöSŸwà*ßØ–- Ìƪºd]š„ «ÛÐyUí×ËTé’HQ³¨]³q¥lÝÎà,I„¬[Þr=²@’¼îhu¢ÂϺ"ó¤éâHáÁêVM;i"Uøà&(ðñ¤JE” sP~ôjªh/S˜)‹‘5 Gî·Á.$ÞÝ‘+ Ì%¯ÿIÕƒ*7¤J2öÞ‰-•Å/ÿa¨MpéÊím¹âÀta¸`Ÿ E³ÕgøÖ᜚í!YÀMqDå>~ÓàÚD'Z¼¶>4KŽGKŠ:Õ™ öñlÙº LIÌêsr˜O½Ü{‰‡‚Ûªí‡X4RܶYë Ûü^gûsRÛXqË_á,F$°n5 Ÿ\áÁ¾F^R–!‡f•Ý îP£óÁÀçõäBþ²Í¾á!ÔÅäÐ5¿ÊÚþ g!m BÚ íïØhçêW´_6ŠëxÏ‹6É%EöþIq.©:ÿ"gÅ›—YùWVCÚ@…™ÔˆaÆôS™-æþ !>íŠí¸ƒ õ…¤Mí l&Žy­hÂhó2x 곪¨=óçÓævúÓ5 kc^AgÞ¼÷Rx ê³êw¿¢¿ÜþsQ30€B (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ ”Ñ ÿŸ…v endstream endobj 711 0 obj << /Length 1319 /Filter /FlateDecode >> stream xÚµX[oâ8~çWø1H‹±;qºO»¦Ãh+u[F«U5ª\bJ40Ih·ÿ~/$0ÕÐvľ~çâs¾s€ DÐÅàÏÙ`ü1ŒP‚“ˆEh¶@1C1—˜'!š¥è6¸Ù–Ù\Õj8b± ¾Tºt£‹m–êሒà7·p­WZUÚMBÌ0~}Lfƒï ¢œã˜Äh¾Ü~%(…õψà0‘èÉžZ#Iø^¡›Áßâý>`2Äž( 2ž®©D sS°`…1¢¨„Ë‹×?0;"1¦ÞêJ­u¶±4À…¤u ã€'Ü…ÉãŠ@—ÏÃQÈE°QóoCð®ÍœKU¹ åæU±-çÚ-M¯F*MK]UnOåiçlª«:ËUyÿŽDÓÚmÌUî®Ü{èz©¼õÒ/í%srkYÕ?æ{eªIo³)ʼnðfwtc‚HJi€ÝìŸ!'AV/ÝÌÂ3AïÚEç&ã¼ç'3,ÊÔm<[7°VÙÁRƒWí0[8$iåÚï'ͤXt“ñæjVõ7­Ñ¤¿åÐézÛ#‘óÈîNË5àL›5[‹¢\›‡9®ãÏ8'«Î|pš sûÐîä[$q!-x‚#™¼˜s1¤e,vy×Á”!Fpáż…Ó!& ó™èæ ÛáJKL‚ ¥m1fÇ!NbÙ—-Ž"7IÚÿ¶‰1$!o#î]p‚ã(ngúïÖ›Çp_ô¯à!¦R¾Â9‡oΟðF#;ädŒ¤“Èåä?µÞ¬t7âÚ–ùSî«Ü®ôÙž¾[ÔË`èœE˜‡¢!àä]8L8 ¡f›»M9d n]œÀÃ-Æ¡Ì' ,šA²³VZA Z©›Žw`àx«sXäàÐ1,Xôy±òâòžü}=-µJ¡ˆ aI2‘Á¿À˜ ¿/u[éHîʨQ:éû­íú@0ô¿4šzRjIosmc³c+7°ëDRÞÃ^«U1d"xÊò‡®¸“+Â"ñÛ‹Å“¿œ“1œåÑ[«%¦MXø=+Æ¡@ ÏYžŽ(Kç—~\ša^ë27íF³ó"¯KŒfr K=ìË7àHPäf瀴£RåÕ:«*[Ñ°®š07`#a4ëÒØ#~ùÐ º–Ñ\þmäC©ÖÇ4áÍŋ뉿x¡s]*/øºØÖ6¦Ìd’ÏÕ¦Ú®\ßÑF“M6¹iÔ°wÜõ=‡¦¶~ö&©çU¡R7±±nÓ«Ç蘞¢ñýŸìAl!üóÚ4É;Ÿ}r9ÞƒÜüR6Ï 2GîM©Ü=ïQŒ×—ªÓÓâ ;„¾täÿ.¥ :+øIà;ï†dÆÙ˼0¬SûÙ*«zÝÓŽe|ËÓ@æ±Eú•ÖŽŽ0£¦8qÐ ,ÿØŠÕ_g¢[{qY×›³ñXçø)û–mtš) ÚR<ŒÍÊø/Ðí®XÜM¯î¥îÑí2f£ ÆI¾P¢[eë„" /l‹4Sîk4#®F} Í#ž]vmª©7Þ†ÔU™©¼Öý¾µédʃ««Û•Ç¸×§”ÊbL8}S  ÐrÅâW·¬{)¿¬c¥ÐÌQš´:#Š³«éåÛ¸àdÿ¾l A_Cû_ö­ bYôÓí"9W1ç*Æ,á†`¯Œc¸gWÏ—jS7ÿcpèƒ"Æzÿs\Cnuóø?kPq endstream endobj 700 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 108 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 15597 /Filter /FlateDecode >> stream xÚí½\UK–.~ß„žð^OÿgÞ̼0©§ûµ‘ÌÉsÈ$ƒ ¨ ˆbV0r4Å€Š¢$Áˆ‘`" DræäXÿÎáproßÛíô­ïgØ»NíÚV}µÖª°€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€ø¯¥rúÿßÿy¥ÖÅB"k†ÌõœÆ Ï£òkåœå©ÍòF¥:›s•waŸ«ºæyZ¹ðjü#ÈÍB$A#D9G+à¿h„+gi² ÉÙûAíµð¶€ø~ø\ø[’‡haU®…¤J§÷ç¸ÿ›õ……[Gˆ‹ËÄœAepÉzNžA“R$ðƒ…Ž™Î`Nazy¢ánÅÜ]„<ˆ³R5Í€šÕ"ì¹DÇâÓ¨T …Š?I¦y(Avl¨•ª‘“F2ºüZÀ¤ž!ÕÄÌ…‡A2 °WoNijvrƒ—%³Q¦ÎÖ”@Îþ«¢6bÇ4ÐáljHÞ^GËë/VË­VËtM½vhʸùoN7"ÿ‹Ö’ÉF4ºfñY« XãÄÁŠÆ “©d A;œ[ó ’ù{$òcÝÝs6ÃÚÁ†Â¶2¦sî¿FÂ+³#MÝ6iÆl¸s‚ê²FýTãÝSN¶æúzz4*IŸDwõZßÉS`/v]®GcZòyP“ ›aD"ÐûËåÚBb||î,ÊB9,#c曥º0¯v²]/×!E§vÎ’³5ÒçÉ+ð BE¦Ð°—ÐͶ+ ÙüŠÌ´€î»Kh>¢Ù†åLÍc²’avp¶ÑvÕzüÎvWŸØ\¤ëíV"?F:­ºÚ@“Ù"ãÇÂYŸ• â¬Ø“§’Àò-ÖŒÓQx’æ½M3$7~‹ë®“³~r•åX³\}/xç@¢Ä¾á!×)½Wy¹2\v© Övf½Å¡ëêÈ=YëY;óC]Œ.UN¨KzÀÅvóW «ú6k#« :Ô¯Øg½øì”mÖÑQ¯ÇçO㬖m)ÎR«3ÚG9»²¨œ®H(çWø›«ËÞ™7ÊÄ*ŠAV‹LØ]æšÚ¡|ÅüÝâŠ~P•céµE3^cá)¦GžÎð£cF:ìëOšˆßDC׎x˜úuI›aCFˆãjoj¬¾H· ¤S×âlc±ÈèÁjžR¶Õœ»ÅßÚróEuù+ÃÌ<¯Ö#Å©»6ÅÎÓZÏøs÷Þ˜WWZ€v>õ¤ò«JÚŸ$^ÞJ´bP¹¦\ ËáòTò5Ø€ÑW°8fl{{Ò ¼gºš-=!c¤UhfÊf2L,ÍlZ4Ú½?×û7öh›*š¯ÿ ÉçéÍ£Þ®–tRhL–hzëœ]ë¼éBüu¶>h|áÜd¶Ø¸ltv”9ÒŒ²êÆ>Ü<@rÜ!ž`sn2mºx#lã²=y.¶I¬&¯™ÞúŽI (ÛlòŒ¿ý$Â…¼ýê\„§ØF‰ªt~VVÃÈýø.áçÕ/¶1[j[×õ‚Ì°”â§É6G_ôÏý¬<Újù¦¢‘Yey²©|­“Ó„Ë ±¶%dâuãi±ìlFÞÆ_G¦cPÓ¤¢!Å÷wÎ1êÇÞÆZé®Éœë}ãm/ƒ}ìéÎë²J_ògïÔ}ÎËŽ‚‰öb—“QöÊçaöÜð›5꾇ÿìL;z­aw=ö£ŠHºïe…ê§tZôƒb†šm /|`E؆SÔÚºš«Ÿö´OR“mC"çyúÑA?nXƬ)ç÷Çló£3L8 ÚŠÀ½m#hÁ_Ÿµ¡m¾±=ØËӕζÌxØ"úür±¥_¢Àvâõõ_“Dà焱 [®Ç;œDÆÊXºô6áÛ(•ò 3öÎk¸¢.\Aö=ß‚\­ñ05õ',^mÝt¿Ûx]C¯:óôôŒ¶dvà᫬.<ìÔdyYÃ%†þžÔ‹¾vÞã"±*&ó¥ÆWßuR£­u”'Q?'yŸJ£;™³è÷ÚZCˬlã°áPw‡Fb}JÛ$5ˆ4:j«£!%þ½c¯#Ï-÷ÉL›>¹¶n#xÆ¢™"ù½o¬çЮb¼ïÇ6K,º9³2ÛQ0S·Ù™[ÝÙ®‘åž åØ!m«67|oC7¨ê‘©ÙF!j6¥6 IÄ$²öÊ ³õq¯qg§Þ­Çëi¨&žnºW¢¥xk°Í§• ¥®ó\R¤~g®&bÓ©v1¿M“µÉÌÂr æ&—î·k<'óqàR<"d3ÙÙØf+2ìh¤eI·ß'ÁÙƘÌutõÀàêhE¦2V&áOaló¹xëÀ^}E1mÊwšX&XåøZÊÖ´?D·YbÑVò)›ñ¸kB‹m8šå·0·ß£ø:Û:‚XÈÿü©õc[ë)7ý€ë¨äÉ>[ÒŒGè)YKuOGR;¹Ã}kr!"è¯a±&e`.‹ ¿UWunbèrŠ÷èŒÝ5yÎ\›M16<ý ÓmbélÍÊ77åšzbl#oµ$ëÕ h÷¶— ¨ÇÁa›×bâm]Ž*KUYž[3E}ej¶±Õ76.$©…¿Æ6hg?½ÉÄ?²|:ۄѧ Ãn—xAº š™D4ØÝÑÜÜü0&r uOeùr½Ï¤Û}{Å1ÇjÓ™!ô a0]/¯üŒÌ(´§¿q¤ƒßλSP˜mA›Î6ϸLM*•BeZ‹•`3ãqžÆWÙf1ÍO­=ÜÚék{k¶2±ÎÖ[.çÅzÐY[ïðµ¤Æf#GìïÍk‡Ø‡Gƒm¶,ÑŠ3»%µ#y¶´PÝ&¦zP(à %ŠS;ìüv\Rw5Û(= ën·è“šmxt ÝsÝÆP›WºÙ›zoúÁlƒÖá£}$æ&–%õ²n'ÛlƒùÎ÷{:PlV]ÈÌ.*.:`o蟉’}óâB«ì+]Gu¿€èkâ·g™†"=¢.ÍÍùDãô´¤ÇœQ8Ù¥—Рѹ½,ÅmûYùlýnìSñŠã¢þ—¶t½¬j^u.bImnI¥¨,©IG–Áƒ&ž–n“±sµíÁtD•ÁÙFù霡Ùa䧣ö†7¾ÛÌjIÍÙ5ØFÙÿÜHßüDË’Šš'­yt›÷w"Y&&ѧ¯ä¤o÷am$ØÆtÍmb€ø’³c…dœcBÝ×½K3ô8øss—Äm¶Ú’¤v·XSõ§±°™K1î˜a[~/¶Yb¸b@žäpªPÓÿ›v¼ ñ Ìoó(”ZçòÛ }½.lä<€ <ã¯-u³Z§©7?ÌoƒÍT±–Qot©©Ø½|•Dçø¿;jŽ±Í§ŠDŽi@ÃmM¶:´;#?mpýr³-çHÙ‡H‡¥¿§ßF)xgB¢~TY9ɶºó° ’ÎNóåéõ#+iì&‘V/Ut7hBñ¡o­¢‰–GÁ>nÆÜs…/ÇEZ‘ß^s¡%çÑ6Âo“¸Þ%úæë7¹óùmB-WŸ~¤å· ´3NÊû€úm0¶Arâeaôøi®‘ÊZ_e›è6è{ª®í°ðÚS³ßò÷ôÛ d¼<ºŠè$/ãC!s² òêÒm>—ê¯ï_y ãÍÏmÄo1ÛD°Mf˜'“jXÓ‡TŽÚo#[ÉaDäÕ᪮O{£Ôb›× tæf-7½&Ûèê‡åàc¸Ä×Ú8íþ'Í „Ø°BO#Ûù"·ù‡=›sQÝf‘q…tµUÎë´¥’s> ˆa%û(Ù5îÔ’?+Û¸í>µ/qMf8Ó&P1Ý’ÂÈGîÈ ð¶±9Œ°ìˆµÞº¬/š GÙ9†ÜTbl³-÷ýœ3Isè6ØT~9›nçje¤f›˜·¼¹§çfa—Lý„ÍVõ<Ï0ãP=Ó>ÏÍ6 âÒÇU»ÊyW´ß?ÏõÛUüì½|®yŸ®;Fº¦eŸDÒÞng>Y—·©Þõê‰êÜùæ¤Ä-¹L=RÔårBMöÄnq¡ºí›À¼:*¶E{},M·|¢Í6‹Œî‹¾>Í:‹nƒÄ‘07ø™y©ØÆ94nž9Û¹Ù†¿‰¼ôÈ l¼·®v2a¬=²ÍÍYÙ!§Çl®ŸÛâ½ü¬f£ÐÒŽ¾õ·e²<Ý\Vœ}1¼ÇߊÁq~[Wüoz.x3*>?\aʱv´3g;øïjÇÀÇÎ0]¤¶$£õÖ }6Û´¦gŠò}9]ÆÙf©‰vÒzOŽ¡®OèIžÖ¶‘š-+ŒŒHt‹NÒw_·»O„4Q#gÑR=CM,Yf‡ öq+©®a·5¬*iœ7Õnw¶Zþ?ÜŠÓsZ¯Yʬ¨ :†FÓÓ ËGÞ}‰Nô;ÞTf#&:ÞÉO‘ tÚ—þxŠ.Æ+LHfû2äÍù¿1°ÐœDF”þÆRŠÉ¸„Ù˜êL½ËȘ6 ”ÏQû-ôc~Ò`¤¬Ã~Ë/:…Nˆ‰VéèL/¿!©l@ݵä‡X¿º32›A™¼;€Ì±òvwŠ¼þùáC]ZlåD€£QZáøê-Z¥ëp†˜®bênÍR.L`æé 5ù'8 ›Mg°õ(ÜݧQÇÈˬ#,§`ÍhõyɆ~êR÷¼.Üà·BoÙ}} wËžä1b–qÈþ·Ub,Öh±áTŒ¡ñ½Åº+1¶ùÈýÝ’BbÓ5·n³A¾þ¾GýjÞÇ›F†FΗj‘Û‚ã[ugIС›ê§ËÃÝ©Û.ΚpcI—¢ïååiï2ÐVÂÖ7ð¼ÚrÃêsƒ`›î¬Õq›T‰Lˆ‹…EX&øùaºô(gñ’̽Þ7fñQj.ÑìÌ[L_%óê[ÅzŸ¯‹ôœëoµ‡¢…,UΓšÖzê™Yš üª{lη϶hyž­òÖÎUùµáE{eÎh ƒê<±€R,hÆÑüú¸œé^@ÅιrzúZbŒ@•S¹_€|e-ñÌEÌ_’yÄI[žg›‡™žçÎìÛU}p5òŒmÄ_'*¸~ëO‘Ë•RÉlÊ¿Üɤ2qBˆÕúˆ»àÇ}áÈǬʡ?b±²Y«\ú líPJÄ¢ÆÌÍÆæû„k~ tdÿ‡‘—øëíðU=ý¿&Ý(¤ÖæLú ­¹ýÇÏ\ßMŠ®^HB.ø·Yý^;~%9άpŠ™»ì^áÒ~KCc3Ï9$†ŸÆ14¯ãîO½ø ¶aÿ˜™ûSâøù­På7# P±€ø£ŒE?×ÁègÚæ ápÞBéOÒèÂûÙybÐû¢à^ý°ŠÕ¥õÕO ïÜ)((|V]¯1-VPPp‡@AQñ»Õ|%)º•×#™« òç……y¹DŽdä±7e%¹9åØü…²¶$»›Ƈ¸žæ·¥Ewòóï”=z1(&†ü'ÅDϳ‡÷ —?îüÉŒDJ-óOû²‘¢ì¢ êÊnWvÍmIÿÙwà»_Aû9/Š3Áœ7;~š&÷7¤<ƒÊCæ^­È½x°Ö›£oåìµnÓ¶Ðõnö¦zæ«Û&ðíNâ ,–ãú‡ŒÇmu×fëå®ïó ˜:nÙ™µÆÏ]™Éë>‚¨Ú*.èê‘ÝWúoÞºe­ŸMß0*¯þ§QÃß¾?ç1sã  »ã§³”škôÚÌt­¾ê«øÙÜ[‹rÀ­²9/\ð+*ìÙß&ÚJRØÄÚr¥PÀ—+bä?¾@ŒÎ›(EصDFlÃU*dBÂŠÄ Õtª\*F# ÅJ¥ùSHˆ=D´™Áh 1Åy])¢¨(69Gå}ù'¶y{Ä·Q£ls¨¢[Ý‹&:Êlöºç«lÊ^o˜þdJ©jIc1ÑwÖfY5{1­R05›n½§ º8d²õ‘…s£Mª¦—ñwItËWüé6¹€T_ ¢5CÌsJDB,L(SàŠ’¹S¨Ø©$¡[ä"ñE2™D41ÁÇ{©D,Ä«T=C­®g‘D:“Q¤D9ÒLcãbL“cÍ„5 ¡ëIx±:ÃÖ’¶:–Íb…XŽ£T=%–(§ûðê2b­f¶>úf©P –#ù"ã DJ…”ÏŸ ßÊÐe€ôjr“Jf#oL`ër01xb “€ÉIÀã…ºØ Àç¡¿Nò.‡è¹#B4D"b삯"4ù0øåwà߸h"X)€P€=; ÄR¢”È»¤R WͧãoDâ„@ ¦yX _8U1H¹&‘ŒÉÐp$aRä0¡½AȤ@&ƒš™ˆq×=pw¯7[ú¡uk¶Äœ‹Þ¶ÊÄÞãaŒëãç#Ö;ÚìD›S6À1á¬Ø»g‡%‡t]Æ/åµYš²BC¼­vÞ£Oó࣒ÚÆ1Ö}Ó‹nšl}ƒ\%ì­o•ˆ_Å.3ð춑a…ÊŠÑdô'ÙxiÒ2.YÛ”¾Ïc®!ZX~Úy½î±É2ǺM…ŽÎí&™Šñ¦¦ÂJí¼â¦H§“hÔ\Íf1BwíYïnN!;â‹‘ß] fÓ©Ûö\egN± B„š×Mc°»&‰ÕF×öpP5IP±Íxõ¹U6æþa)ÈmõP²ÁÔ„¾)©}­xÔÝŒkât`÷z6™§UKj¯²ôØœJåºlJE—yt0±v:pp=b˜†Lô*áwûTV¦ÐŠK­ù"ÊMÞL1æìM,ëESÛîeÏ´õ<¸oט²öØK œöŽ®Š$}ãŽð ^Öd²]5ÒŸd#þ&Hë¯FZß‚C[…®|kÏöcmÌ´4µ 8r Ý[Îõ;éK÷[8$¿­i@rÒûñÍ!ñÛXdÃC3V‡ÿï_€ï~‹^ Wï¾ÿÓ üÃ/Ð äù&<÷`Ñ?€ÿöøËø¡>ÏV£·v®DøŸý¸‚íóúkULäOvr§nÿòoA-¶°(a%šàî×q7ƒ_þ¥*ÎF°Ô»Á?üùTà¯=N·¬_‚¿&ƒÍ¿E‡”àý%ø•pü_໿Õ.×o¾÷Ÿ[´`Q5c©E“Jš=9á×°£çýöÆ~˜íƒpzeIV7ûô˜aêHȤ¸''ÿ ÒO÷›q6æáaù ¡F¦+…؃±ÑQdˆ×Òö«cׯN™Ý-?mð'ymw˜,Ö¨xAºMA'o‡=½bIZ>ÙÍbr¢÷Ì¥3ÙT\عԀêîã¿'&µòã:;IöËζÍ6‘F˜ëÄ©¶0¾~t·®kRÖ÷ŽD1oœ t€ø¦›bKa“Ïj¶ÙK°¤*ÌXŸ]‹•E6PO¡šµò°7 Þ˜[¼•‚Êä&x&u×u˜¾Z{nÄ8Ùxoǯ‡òw.·#6r{8 Æ“¾äUÂ"‹ýj¶±6¥Uvð€°’ºÜ§ò/7×8ÇâÚlà5‰jöYªÔhY‚µÞ‘wÄmí³Ò7Ÿ&ÆZ0Ìœ‰ßÅ_rîT ¥ý\´–I·#Xd LG‡zºN8Ó‹‚ÉØ|æwÿá–ÿ‡^ŒÖ½»¦LŽ£_¢×HU’ЋØ|Àã'gÐëæ }¿jzý÷0: Ú*±gÿJDüWèõ¿™fÿÝwÀ2 i}0Ñ è$˜Š¾ë 'ÛÎæýwèõG>HÀµƒÀÆ •òŸhàëI4°$X9ƒ1ÌcÈùÿÐpRhlD’Ä2ÿð‹´Ëõß‘üü ä-Èë.,2Ù¤{Fn ¾ÊqÂW|³‡è>Û¸¿KoP(ø=+Èú»gÝ}2F,_ïãöUNâ’%nÈYÊðÎýº§GhÁg‰…ØÝPg ‚¥ºzT¯!•%å±õ@\,Š£ûwpŒôbî4/ÌoúÓ:Ú˜¾Ó. =¡ô󓳈žP;“mpã÷·•ÞŽ;°ÍÌx1ÛÎçQ ¢)¢­–®»ÚóUí÷ù™õF¦^‰g¯½m%ö›vVf²lÝÕZÒƒ³ûm7Â/³²´*L—³ïéÝ5Y,k7…RcÅ,îb¬<‘_Œá~Ù Ë唂é{nDÙì+ÂÉ!=h…GJ™Š0¥áf̺e•3Ù†ø/¶éÂkÉãpè|Y úŠ{¥y®$ÚÙÖi¾Ü7—C 9îq§3^ì#D…×íLÒÚuäVñ“qÕ‚„mÎ'‰»ò¥FÎýßKþ´ØæÏÈDåGø¢·‡ß¿À(¨GŠF¨êò $ ‚mBNãÜþ‹VÏò·èÅ¿[éÿ3¢¢ü5°uA'7Wº%¬Û Š^Õ˜í‰þ‡> 9§"s~¾ûs0®JÍü_¡ì4Ç‚vLq‡3…ÉŠËì€Ûä¿ÆåaJN¿ŠmL¥7â×ãÙéÇ·o0Zn°óL ¢³‡P(‰u*¿FwÉš—pnMj(o÷"ÖÜ!;ÕŠ—Æúîj¶ñ9t"ãÊeWod×á«øa!l3” æú6ˆ´Z‘ ‘¶®U·ÑòúÞÜë­ã\dmg8nÈšåèó‹ð?>+ˆ9ænCgÚ¯k­Ï.rìýp²Aþ¼¼t”Ds³M"ÞCÛ_]6±õÁu@ÕxA$c¯]ÑQ8¢c¢c*†´ØÆvmäSü:Ù×yMú#µNkÇ\]Ð!¯ÒdÑ ¶‘í³â:…„ǨÞŸß!Ѫœ¶WÅqGÂ=í˜4«€7}øè2~;ýÞú»ÏÝ#Øfå5…Šm–=&~¶ùDø±@ŒL Ï0Þm•àÿ Œô·@$'Ø&, wÄ],Úë±ilƒEúxÙ‚ÿG"M7g¡…¨MÀx)á¯uÞ\Çwª.6e†üù0!S±Í?Í’yˆ…Aú.mwËÙF!ŽñU£šø5só$Û­»;ˆwÌÞGçuØ+…Úsšw+ÈKJ>Í-WýÅl£öÛLÇÂØ€3Û-öœÌ#™{bâ9 Ût?Ï9z©\3²ê#K¨›^kv‘̵êhÕ+XCÕ/ìÑXü©”ó&¦ºTê±Ù ÅsõTþí„`Ïm§»a›v”mÐÀÓkHl“€§8ú¡œbf'!”7½©–ƒsîþ7¾¨½µB¡D«"1¶©À¯îó4 ÏR¹¯…¾ æ©7ƒòêÄEf{ˆÑU>aiBEÙ†§feáFs»¤çêW0/«É*x“SeÌ8è·fï% Ž«[1À±^+0¶ñ¹ªÁ6îãóÌJÏ4Ÿµ-©!<$ÍÑÛ[Ã@ëïuøá#èõ_ý=) ¶q?„…KÀ/°hŸå*¶1ÃF1èl<<Ï|̺ùùH0DzXŽf¬¿´‡éSAh„ÂI0ÔZT{üoíA¯v}?¶áa>mè%Öêþ¼g”e6íj¿ÍÜlsñè|~’ÁY;ʉÅb~sŽ¡áŠ¤‡æ¬§3‡…|4|%›ÌÅü6ò±Ëiiý<Å̉ÒÆœh‰žþ@  ‚º‡×¬Ø”¡‰àklcº„TÖ¯ª!–ÍÊ6}Î’HG1«|VÝf´ÌÜHÛér¡X$ 'zëœÌÙëÓâ웲ŠI§² j:‘7 wTû[9ûžÖe_œtÈéïG°ã eû×X¼ð(†¼(´°ÂO‰D>YçBZ~úÈÆ]Œ ïä2ïCÃØ8 ¡n:Û(|؇JÛx­I­³$n9}õ¾oϳ˜æ£|‰XÒRœ´„³ZkÁŠÛ(ÁÄ}Rq+_"‘~y}ib6(T€ÑRÊRÓÉdM··²èÔo#zÍ\Ì~> ÄHo*21$?ù4Ždx ¾XŸfÑ'ÓèŠ7=ò™šA¬Œò˜v;Ž?ìzzœÁ  ­ÏkºehèÚÆ6è)R£Ï_*¾æ·ùsà ®B¯ÿ ÿ’ƒ]/×2ùÿ¢×[1¥gäO\Ø»½ø§µXŠ­˜Cø—à"Bí¨7ø?Ø ô!ÈJÁâSQŒÄâo®Bý9ú˜‹8á:xTìƒï~¾(€é?avÜ%ðè>ð1ßýh˜ø~lóOÈ»þòËL²_ý˜Ó³¥qN Á6ž‹õoõⱉñïiõȵ¢þnŠ£)J¥Øúl~ýE€KRVä:…ì¸ú`O[nI)%­lƒe¯{e3F9ìÄ¡¶˜mTc™D[µåðû®QaHˆÉä½>Ï–ÍZîr=²èÛŠ4Ùf•’ûŸYp_F®ÂÍå;Òo¬±¡Kkö»UY„ B6љĢ(ŠµÛšÂ7Ÿ•êµ}Jyû‹,?GSɘkïsëéG…R{µhäSØô0C«ø[/‰½Ï¡ØÍ>tÕÔÞ·¼žx‘ »Â©.7ööÛ;É+¼ŽV¢#ñ«í¿3‹QkKȃG7¸Q)d;ß-£x){kn»XÐ)²çƨÏíòÚs¿CSþ^ûó  •æºîÀ>Qç5yI&T’‰…kAÝ =ÛøI+Ú_r£VS÷£ºèDëÃG.Rö¾ÛF´çÙ%ãŸ÷­sGËȶˆºö“E]Ñ)¬õíVnyÛƒê°]wüŒÝ.RÒ_úŸzN³²ŒßÊ¢‘š†fìUú{¤WþëÛü#H A/þQ´«täÞW@çŸÑÀ_ý?€vŠq,Î6»Ò?æFfõÉ—6`Iý+àÉ@5 ÿšà%¯pÔCBNèmh.½ Ü‹ˆð¨îÇU;H˜Qÿj*TIÿ+ðÝ/gÉüLüÏïÀ/þ/ä–™¨Ë3óß´f¥5wöÏ»ÕN<Òùâ=q€Údõu}›@0§%5gØ×R˜5!¥r†wejdš«ezÊ úΘ#3³G˜%ÃÊù?p3m-Ü´Ôgo1GVÁì)|õÕ³½bú³~RP9Yæ܇•)ÒÞü³ÌéMÅÙævà« àl³ý*Xˆ ÌA9§`Ùšs.a%roø›–Ôl+8ìÉJx<ôÃê†×^¤£KOLÏ*ÌÉXiCÙtú)¬Tm)“‹î”Õ+æ‰A°ýBSœ‹m¾œïB®™•od“]Q±‰â°Š{d²åù©øØȨø¼ŠîPøtÿµ äÔBã·_«Wƒ[¯¾Ññmó7{&Í,~˜?H‰”ÿEG­?¥1vÁM8»(¿÷Þð©´d@#õ¯¹ø¾w>çô4Îö¢YŠÊ9NâývqnŸ]øùúß›´~‚ó †*)¦^“ßÿ¹ü„qÕ?¼0 ±‹ƒùËö‰oŸ_êÎŽµà0®?ü“{î™®,$æð;š™ÛÌ©±/…ÁÜ \åÂ+r¼Ê’L;õQU­cõakÜÌÌ,Ó'ÕÎk=ì…úo‹™}þan|y@2ÐÞ?òžfêªõi£Ïo2ÐoôYà°tÚ}LM#å£ì­Ì¼7Vv‹Õ}îÁ•hGks['ŸëO>}û'b¦ìänK­ý½G"ÕgìÇÍÙÀ‹åT§Ðç³£¬}þp_)[›ÑŸ¶M|3¤æ’l¥¸…K!=nèšȾÞDL9TÎSŠÙúfÎbê*þBbJyokgþsž?Åï–rÁò›dF3&%5a‚J+’NJauWWGvR0ÓÎÝ©+«s$éDÝxÞÙÙqïüvº©Ó¨øûlU¾©mÖöœ¼Ñ¥Új}K£åA¤©KD[;Î>| Xqk‹3+0©¥óóÇW7é:ìòQ´RO¹²"šÛ;[ßݳÐ5:ôhìÛ!ì³&“ùWNGEÇ^¿[9“mîÝJ‰ŠL)¯óË›’˜ˆ#‰'/aÓ­²‘c±‘ŸÇµ°½˜ýásÏåä£×žb"ÇkÏHMŒˆˆ¹Yö ËZ"ïdÓÙ{z\Š™¤¯ö\rLdd|Qe!ºSΔ~ypýÔÑËø×Ó„¥7ÎGFF¥^É#–4¿;”t (Ï&"M—ð¤eLE ŠrD¢£/Ü~ þ ²b¨ñüñØÈȸüg-*öR<=wªœøvUóÓü„¨Èè˜äò÷ýD„±æÉéÒ‰ºØèÈ>Ê u³ã£"câN9êhdÂÃ&¼N:Æž¨róøöy¤-nܯ(P±ÍDáÕ3ˆ¬&¥^þÄŸÁxØëoîw»tÜy)Î6_îDE—?ò;ÉN_>X~rÍ¡l"P:nÂd½èA“ë«.:›5#IñýÛ£¢¢âŽ§ÕJ‰ÌǦI Ixœ•rmx°QÍ6—ã2ÑTêr7X¬ËÑ¢1¹ Éd´Œ_S~”êëœ ”¢ðÍA ý<ðýeO®gBh-…c¯ÿÑ'‹Ñ¾³Õž¾öÀ±¼œ¬íž,ï˜Ò)¶QŠcÜŒWl:zçnÉÕ“ûÈí÷…Sí×fæådØRvä r%ó3!mI+½Wš³UÏØI ”WF’ ]J^¾»yz“½‚ªÎ»ô ƒç§W°‚÷É}ÿþuLˆ“UðIœ®‹#Vr½6å—g‹a’8ϱÓþÊ£BƒÏ<ÃÙFj¾ÞÅõbVþõ3ôåäôWü}¶z^;ã ŠK.&ì4 {÷`c|¤;Å54ªô~yâÎ`Woó™lSkm^I¬Í{wz‘éNôJ2Êd²‚¼Wg?¬~û,ÏÁH/õ½TÅ6è~¼ô®î{Ò‘ˆ¢—;Èv<ñ¦¾áæ±mTR@ùç £­±çïß¿—¼{µ¡ÕFL9zwŸq >Û"ÚeJaSMû0ºð亀ƒ÷º V3\·ïNÈx__—ºÇë…­}’öû¯ü8c9ÜjWöJ×u±ç2*yÒ±z¶¾ááÔÌû÷ò·º›{¼ä§®™Pè9÷Ÿ~–Õ0Žgäß+¼ékj¼÷jKV]ôàzØsöÖÃ6dÌ[ÁðÞXv¿ìÔ`#›Pt•__‰ÝnkPè“׵ϋNÓ–’ªP›L”äoê±=2'7ç` µõ¦sHÐø§‡d=JÂÅœ²»·×XQ·¤=Æ1/|õÖkèìdÅù­†¦^™ùwïܼ`I2Ȯnj»¡gz4›­^~×nÞƒâøÕTÛÕYwŠó®Ÿæ–u¡fJsÉ1c–cZfNFÊ]“úAÂ6:Œ;×úgä\>¶‡¼”Z‹ôÉÁGº4ë-kBU×¾,Ic,3ªèC¿§¨G³ÃGô›û=8n Êî_JÚçì„° ¸ßƒå¿÷xɽ{'é.avMÎЃ$MÙ¶-2o»(©Ikí ֑܉B3P!øÂdÐZ±­âå—}w&i%yy»­Ó¦¨¢’{7Ï'–=ÿ,Ý÷–Ò½A=¦Ð’®ä•æg„ø:RXö8ÛTž;¼&e³ê ®Ö{ª»šk_¾ªú4ÀÇû-¿÷1‹a3.#¶¶?¿Êq ÐR‹÷›Ú~\½M;è“ûÇ·†ó"ôÝô.û¸{gÄ°šm²¦ú÷èZ±16‹´Ó™Ì•)ûôâZÇÀKÓ̇ºúŒª½•Çwº†Dß qcm­B•Ïݦ¿;^# 5ÒYlt ?V퇬uÎ6,&3]y‹þ’mí¹¯`ló¼“_¿Ö|!HâÊ]†^ÃÄxýÁ€jÑ+SÖ%x®¾¨Ò÷Æ­iÌœöI làê:õ g~¢qŽÚ›¼èDûT„“Þ™Øâv0±“øóÝÅT/þ¬j k<¸aªAêÞ6†Õ•3Jð†¤gÝŽ}+“CbwbuxÒGwÃeÕÇÜú²tôý]°&ÃÇÌf.¢_rëºP'¾Ösåy(]¦cZ%'zY=ýþ牷yúÞªfèÝ·9¼] .­6X™Úªò–ééy L7Îú;ÚûÐcË ùÓí–6IØn‹á:ºÌ•cåK[Ý—aÔç P*Ê‚™Îi¨R½Û~yBù®ÙÞ8võM7èÉY¶Ü䩘èGÞö´[¯úÀÐã府çR¢ž¶ø0N~Ò`‘[§°ø&åu_Æ6“^d½;„ÒØßÕ#‘kyi•Q.ÌÓÏÑzÃÙfÚ¯JÑÉ`Žß¡båÔ×ÓP¡ÉØa±bûmÅœËDÅ[˜ËRk‰ÕÑÃ=}B©g¤Ýïo1áì‚'5ô®Àˆå02½å˘S)´ž+ýý|˜FËdÖ c­7™ ?¾Êx“O³uÓüDWoåu]ºkß4ûÙ“ê¼7u.¿ÍPmž=‹Î`²0¨¤=÷0{êÀeR8v±i9<1^€³›<èT’K`XYM+~œšmNvÜQ?´USúÚœ)EŸ¿8»ÂzÃUᇽ –^ì]÷ž¾uÇ. »ƒW{X¸¬×öÛPìTÝ°$~«Í®ã¨ÄV^·¤Ñ˜x>ɆIÏE£Ÿî²Øv|QÑ7bºR. š—mXï Á¸{ÌÉ3¬!4k3FzDÐRzð¤ªÕ¶ÑµM"¤–×bH1ï”(“½í×\~¦ö ¶¤o*GwNìs3¸ÜòÌV_ÿœá¿ûn3PÔ± =ÇfÙjä6¥½Æyé!n ·0ÈÖk·îÆ*+,l«©!õB§&Û ùê»lÀ߶‰¡K}4 j®xYî‹ì#™îáD”].¦œk/ÀP鲧ÚEìÅJ»×Y[xÂÌkãtö 0Öw Þ¥J?”¥G)œ¾W]6ü!ÔÝ’ Ë:ú!Î6ËHêÝø’þ·ëœÌèx㱘Ž'^#íé°\¯pp:Ó¢·]¥>çÇ×™yãY7Â6KÉ.jŸêv“ãyÍSl£l4Ó#½™$Òù”éƒ[R… ¡t:ÅÚ'4÷I½?MQcUöðóHº_:Þ *¶!Lsåx¸Óg[Ð\”®äÇ®6qZ?w~“ÃdÒMV¬½Z\ÅÇ·øl£ŒmêăuH¿{Ý3!ÃÎQ[Ì·$ãR6m>âlsÜÇ!`Šm$‡,è!e¨a—»aGê˪³naÏ`ò!Õ7cüÉ1³ÍÉàû³ê ìÂmLòž§ý©Úâ#Ú½Û ûèé¥6‰ù@*e›à|¼Ô¹G7:íIQˆ§’Je ¶©+sÖvÛ(ú«‘ÌÌ2…­žs_MZ|º ú+Y ÓQ aI5?J3s!„6&ÈÈ&¸Wú}œð K*r™ý.U®>¯óñí’alsº~´õ‹í,Ä|®@ø†««»§l1WZÞVðˆãoAWåE®U°\Ðû¨¦O•¤ ˆDÎì–ÞL#ƒâä!a‡Æ~w;Ô*¢„XRf¶›ˆÊœxh¼Ø±…¤È×ÉÃ_ c}ã²éûQKÊ€U4N䱤6Åß鮼̱]E8™'³u—'½ ê,ì@cì[á»Lg±¤ž·³ÝvéÖŒ½K,wÏ«ÛП!6Ñø[}ƒ o%s±MC²·Áªó*KjÌ‚Î,ìDd~UšEèÁk“hÍIÙΉ{׸òî«l£œ“mÀýL³=ÏT)miÆÎ<Ô°¤R|õ‚ζ¨|û‚Î4aM¶éÍ?²ÜqZ”ÛZÑüf²Mé§Éwùº\•0¶ÝÓ½Z2Öz%©ˆµw MŸæê°^jø`’è/k¬¸Ö13Ù¦Ùl©J@øQ½ØLÇ“¨ï:ÌQçhn7žVöÞ#÷š@ï÷g pg./jGý»RQKJ>ZQÕ¦zBfÁ>^Õ£1ù(ijjú€á㧖½VË÷—47w£gßÛ%6jväo¸;y_F5˜ãÓü;ùªò½úîx€søç § ·¤ŠƒÙÜCOñ{kn±µ,)aì*ÓªSPF’›T!$%ã0™ÕbõÐÉK%%%—Nì'Q¬¹uØP—…{‰¿?Û€‹;œ¹n²ò R#¶mw£øf!ÚˆÕxGü™»%%™iñTjÃ0"ŸÒCžægŸk¯äRùm”u)¾Æ¬U®f\$pé݈¬5c“Íóüµ«ªÀ‹U½|•—8qzJcÌÖN.¼[’‘Â16*ý0ªöËzK©´Ø´9™g‚}œ©L»áé^âæÂH=cËØÔôŒó'<Í(þ1ùx¢M·÷[¬<žqüð2Ë=î[>jcBK½¬ÊÒåëwåÊoÅKŒÏ€ç^J‰ŽŽ½VHôÇG·“²¡ådÓÄØèøSW†Ä`¢ëmTTLÙ´{UÝ»›Xð´çNåðÇ+§“###»Þ) èôaÖ™ÈÈت/h—‘õfSi¾ã„×ag›mZ*rb¢"O^ÌhÌ€¿{“tª²?Abj\9úñHü9F΋‰Œ=VÕ5NØÚµ%±ÑQIg2'å`¨éiDDL:ûÁ¿qîXdD\yÃPKÅ…ówšf¬YQV\ŽŠ8zòÊ]ådÝáø l9>>þó$q]íýÔ´œz žHŽm$>S–r(9烬=ûÈÉ2‚%DýÑÉÃ2l¹…¤?+íDDdôÅœšêÉË‘g.•à÷ò/Ž¹†ŸZ3R{%îÂ+"ÒDãÁè³hmÈFv80Þõi³Íå³ñ/›G¦’åµ]N‰Gª=ýöC)Þ’žÄ¨„a•ãTÒûîLRtTTôÒ<¨óeÚñko5܉Ââëç"#£’Ï^ëßš¨?¦^uv--¾¢aWJož‰Ž>ŸU®1^Ÿ†´EdÔµ¢W*ãbj\9ÖqîX\tlrURŸ¼³Çb/Þ¯¶CÑ©|U#(†šN'ÅFÇx×+G“I±W_|B©²áarLTì±´œøÆÞˆ¹¨>ç'=5®ªuðšEŸQ/ù»u)áþÛ>Àë<£žW”ežŒŒ¾qÿ½´=/&í9Ú^üž›Øj„S›§üÜÇèGÚlsïäÌ리¾r,.?¿ELLlE¿¤îöÙ@åh^Þ–º­Ü¬-k²‰üŒ³è1‰Ç΢çÂc3àU3à=oË“â¢S¯Æb¢+§Í€£n™Ú'‘®“Tðü#Ðè,m•%ȃ'ÎÝÀ'½•ÒÁc šYŠ‰OLG¤²­ø¼ýÖ4ð§•ò&K o-š:& õÛl¹w¯Í]o²@ ·^ ÜEüBÆÁ ec?RmO¼ö[÷m¯¯hKJéÏ¡ëÊNyÙ2ÌmÖ‰§¾^œq¶ÚR»Ò\\£}ñ”Úþ·~»;|È$"¾@€}ÐmjìK‘ ö%ˆoT i@‹âG¦EIz´‰¡¾¡žŽ™{ðã¦Mn‘õ¼2grjFþ œ³ñ“²ÅüŠŠöáá³¹›zŸFSMœz°©Úçöí´^Ðõü2ËfÔp ~îøpá7æ;['3Ìyè:4yÞÉpƒÂ0±9S܀ܗo·¦mÏVGŸdk°ò:î¿N«Â¾ññävæ‹A‚L†ŸèØw£ËEºMŒ–UÁ?»&Úcb_+†• ñ³ÆçL}#ö¶Ä{1º¿2j¥£û‘2¹T*èÝÈ2ÜZ4xË-Z¥èS€|Ì…ÊÈîà ξú¾O¦u´aGi*ÛG©”O^9ŸÖ7I¬´m)ÙÅuŠ“ÃÚ†€øY³Í%:vm¸M¥è±¢ê7¨TŽ5\`™nA,¤õ®´ôèjù‰Îçt+¾L©uf+~!m-f²ò[ÓòÅwG´?fr¬…2¸V âgÍ6‹¨kˆµßÂJS:Ã5ÅÁ1aè°y2ð"a½íþ ä÷Ê7Û]åZ§?§ùŸ6¦XÕöƒYœA@<ÐHgsÇ$ Xß?k¶¡­!¶ JMH3>­ü ª¾Ûà¯4¦–i.QMKi2ÙÂûj;*€l1Û`çÖxZP/?%ŽÚèo,/yÓÓG„/92-‹j 2Ÿc£øZ`Q•eûE<ƒ”Š±ÑQõúahIA@@à–”P¥§^ŸáPÉAÛ6¯ñ ™Ø<"èâÍ•c²ñª¸•ö2æiüÛóÕèžèË^† Ž½« NNžÇÐ9)S²nÍb'uKÉn®S,ôC@ü¬¡òøBM§¯LŠå&H¤øáIèd”R.E†“+§9ãó°]•’i‡·a¸¡º(òƒ­^÷Ëñð½\ø÷"XÙ?:” —»…‡qM÷Ë«Lë`õ‰©?×LéJ²ÞJ §zî\€€€øiyG› †ÿÉšý¯ endstream endobj 706 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 110 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 23318 /Filter /FlateDecode >> stream xÚì½XTÙ¶.ºÏ=çÜóûî{ß»÷¾wÞ~ßùö;ûî»»MÄÊU«2©EÎ9g0€f%¨ˆŠ"DAQQ1JÎ9‡‚Š¢òz+UY$ÛÓÝûìîÞ5ÚÖUsÍ5ã˜ÿcÌ9ÇAéHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Ž~ $­þØ$ÿÖØ*ìÕ’P¥°»º®K¥kÌ_Á2Øü¾ulñ/–…¤ñ݇Q (êk¬iBa ¥¤¿³¥¶¦æö‘üË‘` ü¨¦O ­ÓZV¥t²æ}í¼âȩ̈îí¨ChhîJ±o±ÔUÒþÎV(ßµŸ:zG”h¶j–…šjk[ûµÓ\œ†Ê#Ë´yºûSuïœJÇÏ??uÝ\Oñ˜ýfœ”pŠ¹±ì´úÀ&‹}¿¥ÞYʤ¿Ê @ ߤ˜‡J´ºï禩±p ìJ÷aÆ_ÃÂæ›=Í)t“kigcÎe2é®Có¼}ÙR~ 3¼|ü|ýü|<\Ø,&ј[=ã‘tü1ÍÕ°°6ÿ)gíI4:Ã- "&<€ÅbŒ-k&ÕU[ì °¢BùrÌmx&\jæ¿ üRq•¤ÝšAÓÝzµÚ£ïýe:@7ÝS¨=‡&ðÖ©SèÐæ'3àŠ!¥…6ËG–Jµr¬•ŸÝê·;©œ£Z+ƒUCU« mÕÚø¦Î@µjŠ+R_=±è¡úzÞ ¨xt(¡zPüÕ8«·é×ꢞ ¿½.«7—jIº+»ùg1˜£Ÿ^=ûƒP³j>kd¾¬†¢-å­»n‘tƙЃG N¾½ Åd…T|7Ù¸ÌÈP´9Çà¸ÎkRPŠOúX›m»üƒh‹¯/ »ÍÇJq’3×j÷U¤P‹|ÀsGæü¢ })$:2S4‚]óöþ§§ÂiQYš6é{Ÿ Xl³ä®½×´ãjh³ÚàY£Õ¾a"Sý #ýÚ¡F6ݽ#Ä`™Z›sè&NW«Æ—È6PŒùîÄ Ë–Ç1³ó/®À<ðfû­’îìw¢sÍ+Nmfs.ÏÃ'L(Ó’§«âÿ_ò6höR)­™z‡Ž¤zyùû{’Mìo¿éY6¸T äÜÞ`ameA¢˜¾W¿˜í00Ä^=äíL4uyÚ%¾¾ø'¼Õ” ë ñÐGC#ƒº‘EíÔ?FyÛ +S&ÇÚëÁg!Ü—Ÿ’ÿÀÞZž¹=,<ÌÓša涽O~8ÊÛàxNÃ:Ý×¢¾³Ü²v«:˲lh¦®á—ïWJVCcTg¸œÁ¢ÖÖ–D’Éœwˆr:FÆäd¦øû»¸öõc¢ú¼ïŒX‹ ô;ét'ÙxCyç¼vjÒñ–­ŽÛÜÊœÍ4wÍ}?…ŒÏ´?P_]ÛæmËa;ƶKánñá®Û—Û®iÛÎëœÎ4h—oì~´¡ÃQ¬ƒ^mþ£õѼS±‘aÁ4cêÖ+¯^dí ã8½¹H+žMà²Ö|>‹JÝyAˆ¤Õ—ÌÅšYñ½ãª‹#¾3?È(²æŸ(û« ÏŠÎR‚â¦ü‹¥uЋÑòí¼CŸl ¼«”J ³ hã"ÔRÝÇrÿçîR|Ú´–Ÿ 3æVLAÐ_3Õ†¼±V¾Ú ûÛ§”*´qÇìhÀ½Æ©†[‡XŽÑ*õ·0Úpw×äìÄYmYP§¸m4˯³àЭø|6•è{jiˆáç—œLè kS&à¶{h®Xm¦µqhAâö¨ˆ`OŽ}²¼ÿÌî˜ðˆ`3 !îÒ{L(üœïkÍ0·±ãÒ~;O‰~s€óþÞ^¯€dLzzŠÎ´Ÿ•/‘mRcì£Ï ês÷,ý`¾n/3Ì¿`oÄ•C…•Lš°¦[0}³.ÙÖÐ7 ¡ûMq…ƒh`å²Ùþ…¥¹W\ßîqkÿ{‡˜æž08õ^3Ð3Ž¼Ñ…†Ÿv3p=Ù=1<ÐÛß÷0œirà Œ6w¼¨öi2$ÂXÓ-€â0&Gäð±&&Ü2 ¶¥Ñ¬]Är<ÒTàHýuÉKðÛ²µ<=gÆ¢Dí9rérVú‘=4ö2´i²"(2JЃþúêÚ¬£o;ÚXS.— ¨ß 9¯ËèZjR|äÀ!9‡î¾™u93Í”lX F›ª^Ì\=û"Zßü(Ô_òÉ&2@¯^ûãX΢¥&x\;ÀfÒã’Nf^Î:·+œjƒ¡Í÷ÔP‘:Ç̽æž{žBÁÓ¥ûÖóâ¡Ï¦žÄ#n-«ÅÌ@Ux8¤¯„†ï_"à3#¬8Ë’eßL”9sÉ|ÿí—._¹zÑŠ¢‡¡ ‹VôYéû8 ЇŠùAƒRÑ6 Ž¾&Òy“å²ù¿æÁquóþ¨.©‰Û¨¦j´!yiĈÇml¢ P“ëåXÀ9ù#ô°Ã“z´d\;5…x‚Ç"•4ΡaÚ¬cïÁÔÕ'æ:NöCÊ\w¡Öï¦:_Ǻrô 4k{×C7ªáQS–Î4óšW`éöçû9mÀ²(. _ÓAý==­o,(ôŠ^!j%¦Ñiæ<ˆ,x–ž!ñåõýhCü ÚhWpanf «>ÀŒÅH…¤x–¡{öj‘‘ic¼’lDößu0éàÁƒI‡¶Çxw@´m`qñ´+Çå„b5M zÔîòåéá(–¶Î{3dSŠ½ñlÇ#gÒ³®\9àÌ0MÄІ♋öÑXó]Ås ù±8Þ£Í øææ @#«‰D"èm$v-ü–Àf.š¼.æþ6²Ÿ¬m 7Ü™Xñ]„6[ÿhCK+jUO³í– n kÇ•²ÂÛx©þ9iCÑ/\m ¼¹ì„ßiys9ÎqsÎ ù| ¿.¹ûj 8hý5´êDÑ¿Ú)IàÑrj†–ÕB4Ùv¡+WóÑÑÝÿ¹â莒1}ß™+õý³+l¤ò 'À2±P“€+u£ÚŒ/Cnšøe¾izpÈÜÿ‚Rµ¬.3!Äu;Š'±ŠUß!}m o{_\ÌlCÖ  $Û¸IW3‘þÚ¨&ú;Úg—~Sø{cXàœ¯?E6`~,±“/N¶¤ß~I+ã¹Ö¾Ù×0ºž}É\x7 6ÐwJÑ€ ‰t£y2Éz½6Ú,±×Igj_>r6!È©v–ÒhÌö9ìMq(‹{`%ÚÜÑB›fT¶ixp†açû,ýõÓ„¯¡þñ”É”¹‰.t¶Ùøâ»Ío øX¹œ:¯d?’¯†6~ñ7–µÎR» Ë=ñ:–Æ›#›ŒÝ—ŽêŽ\JäýôÇçœH*Á¨ M.¬…6 ´;‹h±'Ö…–ݽÒÖï gp 3)IOÄðé6^ðÈYmÀ‚3A6Þ‰4À|Hüu³œò~8‹cíœr£bí¥pi²53ðfi¿GÁ\©•€ÒµÐGr‰&Ûüè©­+Su7Ð?…+2w9ÐÍøsˆÝfuÙÅ}vFö~;ÏóO—'&›³3nVõcKÇ_G›FP<üúÈù2¥úëCÎæ;sª¤íeÀ¤e1ÈG|©Dc mTbá´pA¶RÓQ)ÅÁöL‡Íg'ç%jn¡©"›@¦¿ÖÒ¤„«mðBѦEºúb"D× $—“SMˆ¬üˆ·¡ý„e‘N,ëÐäÑYL  ºwÙñ#®BuŒ·Ò‹ÍîÑîïÆ“vF®Ëd-ˌؑ‘N„eš”RP{ät¦Â.!)÷gÚ šÅR`ùT³%‹ÎM€mVM?„6òî2<ÑôÃ86ªFJ ªc+àO¸3˜œ¤#‡L©gï?'“ÐI ·4h#í( ãˆæžQön5g½wÞX&Û@í_z:ŽÈ2‹Š‰)Ö’m¢ýƒL#íÛƦS¶gV.+Æð£-Ty[âÑ07³ Ë ^lgï˜×=}«£ ¼Ì(õä3I.‰«Néñv,3«£G“,¤üÇwpôÍI§çÏ­Ž6SváIf{ßü k6ÑþÀ~Á³Ýd)zÿÑ+ïôO1>\[—ð²î öjhƒ¤éÊ"ÛmU­6—Ý>èÌà˜%=dÃ&gã @äÞ£S­ÙkiR}Jw¤Qˆe-s+R“§8™E]{¡±Û¬6ß_hP*'øfL[÷½ûö‡{ð(Dv-¼è"9çJ¢-t0·¹›hŒiRòT[‚eÊ»5šn<Ò‰ ÝÄŠÏcÓh•ÉË©™^kMJmØŠßNM¶Nq—µ¡L9ßïNÕÚÙÓÏÛ•"³¬CmkWG:0¡÷ÓÔ”Éh‡¨Tè…¬öÄC§^­‚A\oŽ7(î_Š6ˆå,ÎÊB0^"Û øêgÇæXÚïNØícMÂOû*Ñ°“aå¿ùHB “çÞ[…Ç[¤|èÈû:ÚÀéÕ\ §Óháñ [](€Éýžß”…´¿«½¥¥eh6— :[šÛÅ ‚¦Ö…ºQe"¥¥wh3+ˆGšÚ”_¤bQW[Kk{·Lkß”r~¸©}H…¢åjÅ€`¨§¥¥µ«L±tÀ¢Ï£ý]-Í-=C°Ö0?>ÐÜÜ*X”¶µµÍKÔ›4æš;FUê%óOÞ>µ±|˃l¡·³ Êktffô¾öÖÖ.¹x¼©µOƒ†“C=C³*t%TÙiaÈ|3£øæZSžY>íN ö@u週eajªË¤XÞÞÞ6£žú•¢Á¦öa¥Zø?ésªtu³´|±nýÖaÌ{“ý--RñÔAšÑ93ÚÙÙ?£ùtº1ÀÚ1·ÚòéÂÛƒúìíØÚýÖA趦öõ¾¶¦ 1ÒÒ’Y$÷–¶Îž™E¥º”Ï4·´Ï)úîxz`Ë‘ã]­£¢µ7ãÈLJû¡žhmmëËTšæÏŽ·µw¯ºsN)BŸ´µjQÏØò>QIG{‘8mݽƒ"™šG0#»ll°b¤Ö¶Ž¡ñ´@³CÝ-½cËzú¯§³utzQ éÏíƒJ­.• †l]XÁµRQ7Ô#-­ÝÖ!ò¹‰v¨4í]ÂE˜»;Z»†¦$Ó=­=˜ÑW&´A݇6¥L M,Ç ;5ÒßÖÚu|füõî#ý+b‚6YÏ~±[ j{@%ðçÒ~MW¾¸°™íºGõÞ·ïõ–0ñÜwŸº·+½rb‹%ñÄÛ‰5–oT[mIÉ]?ž‘‡wÇn)ëEgþÅ|rЭ“ëè—ƒ6Žæ„Ì/kR?ƒlŒ(&i¯ø’õÜt3§˜Î/§ÿM³ØæboDfŸ(iýYÒ»ž²•àÝCÈ×€N(PÑñÆuhŸUüè\j/E²IÆŽ^~–\š­Gð´D ê¦`ýbô5Õ7lÞþw'‡ÈÊ?gÙþã‡ÌÏZ—eÕQ­)Oý¤îP-)µ:/ØèHG:Ò‘Ž~I’ÇZSä~°êé@í4¾)Ó¯ž—üVcÅ_‘æÛÀIàáÜŸ¹?T¿X¡ê«]÷—ûvEë$ª_Ô¨F[«âýˆ<‡cZzd—7È‘=f ƒ÷pzz†FèéYynyÑ6¡ JÙ쫼³ö&”Mz› ‰ì¸”ëƒÈŽv¿ßË(±¤Ï}ã&}C#c##CCC ×61ãÁ¼TªEpeÏÇâp7K326uzð¾G©e ×ÿ×÷zËI/æüEÏ?©[ÞyÊ}£×‘¿~Ž=ÿ·ÿü½ËÏ–`ãéÿGßCüs ‚R2×Õ;ñ³I•lŽKÝ”ýbøÇ|+_° oÊüiKÏNpðÞuXó+4“ÖõêøP®R5ÝQjʤœxÝÐŒ9M"PR¥,O5"òÞ`‹œ‚xž1áúºS}¹8Ó—äÃ$Ø&4ÓÏ ßغ”’©»Ëº@œ†XÐ}ÈÏã`ÑúŠNÒ,‹;„èñÞªkT€q·a D>€…!´u‡^ΫÎo¥KªÑ۱̭é¿ÄV*á??5§O ÿ;øꆉóIùÏ^cù¼­9åÖëÑó­BìdIÉ®ú)¨<Ïg…=֡ͯŽÞßÛË1–iiO]ÕUõ}“´ikKö²¦<³ú ß%§·l|§Ú­4)6¦ ;ý¼ø:‘rmö”÷hËÀ×÷ú±\· Ï7:‡žÐRßTÍ•Ï[FµÏˆÏCh“\¥²Ààí8[¼•waþ‰á~å’2» Lé4Ã3Ÿ}‘½_瀖F·ÿxÑ ¤à€ <,0ýXRh`ÔiÔ6 ‡ÌÔ>|JÃbÙL½ñTg¨$P@ûT°»äsAŽ-؆•J<ÙÚ:!_¡¨ / ŠKL-C8Ç/Æ„‡„D_,¨Õ´acEÐÐðãY…uà‹»éÑá!!á1óá•f8ÚÛ096~ÁOrÒBd`IÂsLs`Xl·Hyá`èõ—cO3“‚ã^S¨{A6ž}b_ppH|âÙAºä¤¬<¹#ò\±mò? e$‡†8wwA]†™æŠqÑÁÁ¡ '²æUØ®¸aªïCŽØràÓ¤Ìy5´.9à—ˆ T)%ûâBK>Mƒó}aÑ“‹s×m÷N³Ù‘ ”kØL¼PùòEÎéš}|˜ B›øð31´± ;X{ºx÷iñýHkªínø4ëB‘ÑFÒñìåOÏíöÆ[ïAw;/ôR ©'sŠ^”?ÚécÏb‘W¢M÷uw÷[ùÇ™Gºþbœï Pé>n!w+jZ>WEZ®|ÒFAc<ê„õ÷3ñæ¦NÑG²KZZ›/îñ¥ó£Qq³¡0Řlš•_ò²²$ÁϚ哬%nfF·?ÁÛç”Â×<ž¹óÞËè´³ÝÍìh^û§ën€CÔžS9mmEYû Ʀýˆ·.Ñðgâ{fthóãí6ÏÏG[™2 6éY{E]-x541‹ŽmûU÷Ä0BCC×¼q/dû©(˜¾.ñ±`õuVìAËÅœTÔ¼¸m`R´ñ6³zQvPÝI àqýMúÎÁñwË>ŒM‹–š—£ÍZç%e騄GzpöóÀN0 Ùòš†„‚d¶Â!hЂœŒ8±AijV6 #ø¹·~þoÁð³¿)IÃeø9÷8¦…6#1„BªvÉ ~Þqo-Öä³mgè,:oVoÉРM[]×°D´ÜÖ‹[)~{¡ò‚LÜÎkPudlöVacó¨ SŠÐ6|~%ÒÂÓ¤²c»„*4÷+ÑToäþ® ŽÏ΋ØT²øX”Ïͧ] ½R5…<k–T¬ÝÞ0Úð±W+± ¡lãuæ ÐtU×Á»ª ÒÊÄC<ªÁsd¿yQ…±«S:¥}–tü7£M'…dÕc'ÙGúëñÓP´a‡+æéÆéj!gwð\ÃÏ`ŒÓû`#ÙµXí´Ùs­s 7û†¤Ï¨˜Qòç'\…%À‘ü€˜ûìM"¤ð—sNt£ÒQ°.Ç`…Í£Ì5ßG§/;…+|-êèÇ-¨ ùâÌðãœTw3ÐN=jDeF¥`Ô€éj'yâ0æú„‚ p ˜òÙOL¼'²5|5´‘Ö›n$ßRÛ‰U*…\.ïÎËL±cèLv^ãäWd›o¢ÅAdàÿø÷®g‚wª±’-Œ‚6ðŸþüÏÿü;>O}A›â&ø¹.~öEjºüO¿ÿÁ '1$ùGäÛüø9à((X6t¬ íàŸúIk•±öþIßWªD¥øvxt´îôµc0™ ˆèt–Ïnx,•˜QH,sÛä wƱÏ&?]¥ÓŽÇ¹›%sꤴѦÿå š™í¤ŠHëØ–¨{ú]ô¸´êÑ3éÛt¨AzÒÅ’årøì‰áàÁ¤ g»¨#+ì6Ôk•}ê»l 6Ý„ qŠ»'6sÑH¸2H]v²È±%½Ø4$;ZÿhCe¼À|M?4àWÀhcË ºébE;™ß¨™pÎÆ›&½ÀtÅÑâ>¢õØêég÷k–.¦Ã{>ˆ'îlfm€K~Æ(é;äÊ|4 *Æ‹ˆ@<Óu7ÜÏìäŽxAžµ tXñs@ ¸Tk/nàl£š”§S½ç4;ÂÂ$*SóUB¸;o¹&¥Àb†±ЃÒ+5)páÃÕM$»~å2·4Øã³C¶6Çe?màœ{Á‹É ù; %þè i‚àÿòk¦‰Ú×¥);ƒôô(QW>/AØ3`£=ì›ï¾¹‡†9 …Ð&þÂ'uq¦ñ|–¦8óœögÔ×~ü€ÐÇ5ŸÛºW¢MΫ!õ,ßkg¸!g¬H°ÆÙ'¶O…³3“=–4#mD›r\YŸfM F›c]•×o„éß¾ç/G›Em´©ÄŒx_Ð&Õ â%xá9¡#Úh“ü +"Š6pÍ»¬7ä iMEÒßöVJßÒ‰þóÊqÀè暈gtf8Ù§Â'sa´ñº‰Ùýuhó³‘2?)<á^–‘=‹ûŽ9·ÔnƒÌ ]ÎT½C;Ñîýpm¯ËþÓŒ6X-î¶'m¹Rû«±&e}[†6êh²ä Kë”á¥v¥UNh`è¶÷FN¢äÑf-MJ8>{ jœbüŠ÷døu³É4NÚ€àø͈ùcq,­‡…àèJMê¿‚è²]I ü34g-MjìÕ <×¾y±tUݺV1 ¥IÉë8ñÏç°v»¾ÓðÙƒÂH¯Xª®¶°„ú=»AŽ õ}i¯æ+C‡1m\OiŽ(|Nsäì}y(„{äÉÚn»‚ØÁûnbš”´†µŽR8¾ÝgG‰ÌÒ˜êæ…ðálíM.ˆ&E?ú «Íl1ù{ö'…"ŠBÚ]…-TIúòYD£gðÉQåUW¢Õ™ì[ÙcMªï–‡r–ñP!´ç࿆6&û=fn‹¹„…ÑæÐJ´‘ʬßýh Ó¤ëY›hGa ÙmC¸ðª 0Ý5õðÓT›€äDsڃƱµÑF§IýTª/: PÈ‹kFÇ`ê¨-5hÑ—ž­b%Ášë‰F\·Q̬ô”?‡ˆ§]Z;<2ÒÛú>ÖÚ˜eÔ)ÀÂv€Æ!½£Í¶ü‚ñ±ÑÑѾöÑV42Û§^‚ ¢Â³›It“¼×­h*o’ ´ý%ß®I©ÂK§YêY¥á<Ò¿³oå0ÁAL>¹ZlÿŒ ÌÞ4Häù&´y¾ÿðZøg$ê¡%VbmþîŸA–x9Ëë ¼·D*á~ 6-x‘ ðC@û*'žk3<>.AÎK¦¹•@ñS—]A&4SÏ·ý“ÓÓÓ…‡ƒ‰¶±pù^óŒ O”´BiMŽ´¸q ÷Ü„šEÕpÿrêƒ÷˜lÃcÒ¬c[&f¦—CÍiÁð‚W®ÀÞž'œ›ïùègåÎao¾è“¨ÀɪD³—]“ÁXþ^:¸mæ[2H†üÏ“b‘h¶:+‚N%|m°5)Ñgkñ`ÅÈÚh>IÛƲñ˜˜‚ꘗÆtAa$/%„ãäiwéqá&Θݳª¯È6‹S=gÎœ›WèpãGkR3½¯ãƒœhd‰DµõŒ,iÀ¦§…¡ÄMôf±¶¶¥8î¤ÇrO•aÒŽ¢»ê–Ÿ½)‘H¤›:œË'A¼ }¸M¡‡©Ý}qx¢Úû!ÝÔîDN¥X©^ŒEâ Õ?‰ð´¡Àïi.AÛ_÷Ì.={3@üŸ‰¯ÖFÙ YïÎgñòŠu<7ý³Þ8lÑ !Zƒÿ ùð\)8× þïÐó?ƒ xôOp̧ÈéÈZÄn~³ÛÀ)˜©•Ÿà¿þ8äO u¼3Œ,TýŽ¥¥IY€ŽÀõ÷ÿ7X1 ^<ý@§’>-w6%_˜8ëN%¹öÁUýÈÂ`Óù?ýÐÊŒ½¿cæÐè&GïAšÑÄf>…e*‘-\=Ŧ‘(Tš{trR/™hìè:•L¡1C÷]€ýûÁ.U™8"Ù´n ñì©’l³4õËøâekW°óâ»kVL%›:Å4N+Õ¦çº8ok2…Âà¹Þ{‡jÁÊ»Á¤HdíF6Ëc?¬nK w$S¨aGF‚+ÄcÛ½,D²wüùy…òÁo}=àÁl–{qe?‹Jd˜8=l˜ð´ _zÚ»LÞƒâžÞB§ØîEÍS^–¤ÌgCà|Ž@Aì6HW”‡®79 õŠ3ÆËÓ7èSó†Ñ*/îco ™D%êšl'’Û ¬-($RY+Œ6Âî—T­iB¦ƒŽ 8?xraµÝæ*Õêß.9]¸öy½nBÖ,ÕŠk’VMêr }éèšYü@಴Uk?«¾zãôŒiR&«µ‰üˆ5·eví|—UwÅᑯQ­º0¸üs¹€Ï0~ÖùåVmvd6­Èäk"©ÖêQÕZW-}Óbª¯öÊ’kš–(u˹tiV»ßiÙÝaËZziUWìë%ñ¸="lü ¦r1õ£_ĈUÑ]ó¥\|þWÁeS5o_4·»§íf}Úèèk$ŸL¹ôR©kýhü)ø/ÿ þÑëW°Ù*G3«è¤lÕRá$e»óÑÛíº~Ó‘Ž~õ±_NqVyÖVÚt¦#éHG:ú[›¦­Õ…ïw/þb ¥|Qö¨y`þ§%ò³OîHB²É·%ž¿ýŒÞЀf ›ê©(yüèqISÿ4øÅ©j|Wù¨ àyuƒÆí¼vxÅÛ/á?¥X¢É®â‚W}¿MEš¬ÿSåãÇÏ%J­N•M¿«|ZPXTUÛ‚_ÎiBáï_@áªjÚ@­e‘–šâGŸ¾¯Ò蘋ûž†’¢Â¢'½ÓZp(…ïž—½ùÔ©És”>ÞZp¿¨O²Dî•MöT<)zô¸´y`ü›óvþ5W™‚†Çx }óî}:f¿eøªþ#ØKîmKI+þ©cçã^Öµ÷+ÛáGWA>ÛcI$šÙxnÙfiÊÀ9!i‰†Þ‘H€s@dT@ŠzÑ… iV8‹ca³5.ƆCåú§É±mÒ+,6Ncû¥ÊU?Ьꕖ5Ý’¬7™Û…&gÕ|“ ø+c~ˆ$…' 6ƒé¡¹:C%pæP¸¶^Ûãb,¹€÷)õsé¤+—ʵõ܇{@·¨Þgn`t\°«Çm›–­#ã¯OS)Lß°­QþöéÝr´S<âI&˜ò}âã"ÍÙ4·“/ÕÇß•cõ÷ÍØt ŽQ µy~à b†À¨È …þ¤áobTªµ´{mæýx‡Îu’€«Äå+µ*åJŸØ«-D~IMµ¿¯\„]êC›þ•ÜÊd¿’õ.ú½Æ‰•È«Z­Tk$¤ýëåas‚SzÙšlº‹Í >Ï|-&™ããÔ¥íy~>½ ú¬½äÝÒk½‘dºyoâù<1w<½D·ð˜•¢á-{ÏMË”à*kÐKK¤PªVõáÐ…P‚~ÆÀj­¡R-OG¹V:ªµf)pµWéAÕWú\¶Õá+>úV4uõ>ø û]6] mêŽX:žC!C¾ÐÏŒî7ÁÂù§£Ö†ŽgÑp…xÀ0º×¸(k ÀóÔ¾²0–c²¯tyUÅÃæ à®úBÕú3xøæßϹATë£è)éx”Nu<›ˆ‡?SØAcóm6ˆZh³˜h†/Áéª8—Qتúú0ü­Páaö–B;Ë$ Þ>û)ÇÕœfåäigƶ Ø2º¨œz‘ãâlOg0ý˦AÉä¾P/*ÇÚÛÝ ™'ç!ÛáºsÿÕõQ¢›Ã|ôi” ö‡yS9VÞpœCw±@*ÎXТ ÂƒwîÞéhNõ‰>ž)l*7Q~ȇN§;xøî¹Zö9Ó†UèkÅáúÁ'»$[Ò©–Ž®|3ß3¬{Z†²xsî^`ëîãìà\˜õgVⲕ÷ùñÁÁi)6$àÛxµ£àÐsÕzrÅúwö.¯ãõ+;åÆnS”Ï+‚%ÑÆÿâqe¹×»W|tB&Ìàï ¥Ç­Ùd/oÝsûY$Oåñ­>\2ÙÚ;$èP%8÷9ÒÅšfæàédÁ±pÊ{?V-Þ“º÷ ƒÌ°Þ ï‘k|tʆMvöô6ÛN¡cs—/1hoŽ«gØ®Û8læÞ´'hòÎlcÓH|¾%™cs¡¬ì´½‘ ×ËËF`oͨBýIî÷ÔýØÌSÕ—ì9$S+•¶ãÔ’[íõ¢Ó>kÜ þzÇt˜Áž^Þo΢ÁÌ@¤$®¼‹Y%›€`º÷Ýu-´‘±¥ä5i°r»»Åþ+PÖ²³v4ÿ; ´Þéi‘õjº¥ s‡1(“wgâŒü&—6õL×s:Àê›Wg?ûœ®gÖ‚)<ýˆÒ) $m5a$•4ÃP&[D¤–m´Q <3¦ñ+0¥«èÜw$Ó9ùoyýišƒe‹ùqšë03$§¾Â®¿cÎÞ^¤–mœQÙ¦2=é¸ bs­… ­\Ã÷õ Ha—±óêb0Ãaš¤¨ý1•Bi‚àë,W:Íd‹Ê±Z*@o—€ÃeD=vº7oôÕˆñjT¶]Áòª°ÎžŽ´0ˆ»Õ u” ·¥®mCÓ}*E´çnÛ@ †àÁÛ>›œ¯jÐÆ—OJ2¢šé‚”—ì$¹Å>‘bhw-+ƒžœ7ÿ|Ë šÖ£3›lf[ppnv¯åa>3à:|¤r®ŸI¥]y‡žÿù²hüS_Ùs8ü&“ Ø÷‹À‰W9ž}iV’µ) gŒóŠ;=Ž´ÎAÞúm«#Ü\ÇݾUE€¥h£Ê ™©ÔˆI›]̓N܃~ÝÌWh·¸[Ï“ô¾¢Ñ.!&™KêOõ9Ÿ–n`¬»nSšYC1`CÜT1.p7 dukúEqӇ阩}ïê´«¼F±r*½|a¼wüYÔÅÚâôÈÇOMŠß´çiªƒ©óY”)ÞÞ¢qÌó-LvæS mU`ß››&…\œ*Úlˆ-›\Á1FIÔthîy°Ñ׆]¥(Š§oˆ~:¡Ž3D¦¦~„}ØVe:³Ý/ÉQfBŽÀ¼îÕ]K¤»G aMèþÓ ’„hñÞñÍvÉËí6öÀ‘›ïÕ\×l¾Þøîøªh36Õú„0ÔÊñçC¼M|mäýN-"üäzÒ,’%_$YåÜÌTgKãçúúÜ`¦ rqütw9FíROmÝέO­¥ŸŽ×æáp܈q°÷i&Dd£h,Iq%SBïC ojȲð@÷å÷Vˆ›¬Ö‘Ÿ´ çF'?FÓyuvÃ/N‚Æ-Vß?Æ1€”ÄNtJ9¦kÜ^Op†ùn˜õá¼¥zô”5Ñýú'Z’ya‚oûÕ íb¼Gc›N..õ¶1VjŒ³BݼÌØeæ¿z}/ÆÑlw¦†î‰v>ºjS,Ep±+ 0"Ü­žŸŸkzt Ð|Sàcæ’î+€þÎG8¼¹(‰K£ù½ 5‘¿ Ã9)oV$šnreqIÆÌKW!úÞ]h~_.%UÛ“7>é°×#ßýr&EUÌ´>]¹ÚtgàÉ@äF”Žºha+>–Ÿ¦Ú›‡>@ç°–g¨@Ö‰h¸W;§6#îÆÆTÊ—(x.ìQ8ö`ÑQ}Ñé¨ÇÒ8>¤ A'vÀ]luQa´Y(9·ÝÂo¸ÔÎrÚבL¥jR ð,çðåhcGI-êUlÝÙÎÕЦd|øÓ-°—aYJÃ6Ùœ[64ØÅìs¢¹wúµÜûîŸpg˜&Âh3ÖœPyC,éÒˆ V'W…š7—¶QmžaÎÞGž_Ãsì`› òVÐYÍ üÝo¶ÎÿB—ú«™ >ñ=4׫˜¯óMׄ #)øïÖôx°#€¹ëR-&Žî%ÓhZH °íäZh£¬ç‰ZC2Ò38‚ˆ?ûBYÛR? éÜMŒZ–™n5§‚І½ùì{õLw=Ñ B›£.V~i—)”QT2$Ó~á<Î)%O;FÇËLÇqF¶äÐô†›aPÌJ<;î €*å /ûeÌÀv‹þA´A-m=/³­™d2À=rçã ?‡ØÔ"4£ÞW7lð÷?œ pŒ>[ % cÉá8#¼CXâðh%}“å (Kôà;CädŸVÐ0öb$ç/þå=Vxý—Ó³>†ø íšåZÅw¦ûµwk¡Íð³Ëx®£Ú…8Ùv ˜Hþ6Ðæ¼½y†6}¯o&Ö+¹µÐf>–²!áÓŠÃÚh3¿…ºqOÝ*y­†6¢Yî‘K­ˆª»1ÎÖI7¿bÓFdÚ©¼µÉ°Ójƒá­1m¼79]Å$%PîmEL/ozHL`•ù¶3Õ~5´ñÌAË6ÙVL£±ºÔóÚÃ@– ‚6S%t*½G„eÙ³R¶A^T¥Å¬Â›&$Øl•£»DŸf=‰  }ÏèdNŸÌÜ ¸þ¤6´ŠâÜÞ·0Sfm\“ëÔá Ûé¸=jEbU´Ù} kîgG£L¢’W3åjd›{ã ÷ÆV±õj£Må©­ÜÐ}+óZmn[£²VIRx„ ¢Á¯ôàÐû»Û|R²Ôz ‚­e'¼ª¹ ª¡âUGu;ÒÁæð¯/p¬†6Ë#ÚÑÎu­TÁ‚íig ;— ŸmÖ³:Eþð´ôLe]“¢þw@ïb+ª±»$=GhÖÈt6ð¹=¬6…Ïù³è©/;WGˆ:ëÑø9Æ ÓÝ¥tŠIÿâßÚ¨@åd=vn¹}´é›U´æ[¼™@’”´[~¿îB—|ñõQ=²W‡º ÊrÓ ?Âî"¦Ç‡'„j» Û>. Sæ+“7½ ÂÊ-úÌ]èwÊñJ ŠAú“éh=•<ïET)Ť/“j`‡iRÎtúÍO£ËÐf¢¥ ™ !æ éÈGK³v•)t0h´‡õ(ßÌEr}þiĸÐÞÖ.F––¦Û HL§ÞåÌ3·Ë¿õ6ÓÅÇœÉö§ ä›¢šz!2¸¨­ˆDdÕ!Wä4?>C5ñ•¢†¯b‘Y [žU‚‘ÁI‘|M´Q²ú+8ÛOBìÕ‡G™¹/‘‘¡Ap'#äX ¶ú4Q“röª|A(¦†8›šil`ÖgåTö¯…6ÂÒ=›¨½h¹ÆÊpÿfX.»rƒŒy˜_b¨å.Ÿ9]?(‚’ž."ýÐH'÷êQÛœÀ—°qßsx?ƒr²‰0î÷°NÀü‰^%ë‘}ºÔ³éÍ´¢ZøbùѾöþ%ë‰Ãu¹t¦§f9yæÃY+ï“èÏáw—‰DÛ6¤_„ÎYyGÃGÞg‘üV(|q,ÄÉöI3b¹“…³ÉIeË1Y>íÇ!'ßGûQy#‚k•·dwù!2;eaAã# ‰Õ @_ànˆ¿žPüE)›ÝÁÅÅÝÅŒœE‡(Žg Þ•‹ç‡Ç”¿m»Íy;Sµ&sГ}Ñ-ds¤¯#•e‘ß>ƒÈ<9ÇAˆ´Ÿj¶ÛÉ„Cµt‹‹áß“¨y†ï¯'8Œi:çzM¹TÇÚû¸D…Ê6Ž,5ÚÌw‘)tmà™4-„I%y˜0È‘˜nr%Á`0£¶Å{XÐ)\¿fäZˆG[ðþÇQ´ñ²¡l‹ÞβòÛÁ Ó\GV=äCnf·ÈÏ6ãE;ÙçC3¬âvhÌŠÙ¹ÓÙ¢8?\Õ¤@É1.Žeœt³%Ï“ŠiR (s4皸ïÙÌâûVÄŒ9ra{Eé^{2äagÂʼ¬g}Ù>QM#j‡¡"*ÓìôhL+;;;[5‚×hÀ…‘j+†‰³“iáÔÛaà}5A\ êáÊ'‘(~‡KÔkÇÒ H¸»«-î{è Ò~Ò8àO7–ßâ´=€±ëb­æç“3¡ €¶9Þ×–Kf»~ÀÆÞt^/AeO‘9•ÊrŒ‹ a”بr&„0·žÿ IçYj8 †ÄÆùÙ™’ÙÎÕÈ`I gÅžQëƒwÖáQKú‰XgèCèÛ/#†Y¥$ÚÕšbb³5~›“È´Þ> ×A~Þʈ›\…Mùv°¨¯kǙè₅DÄ]{9ª‘P2w{ Vô¶xws€ÂõoE<,•ïpÄùŸB˜Ay8‹okgÉãÒª­­¥…Ë !TQ€“cááhEc™Ýj˜À¶7¨áps$Ü4sû6_¦‘ðvnîlÉ ^Ñ^9ô£%|…mfkÉ"pÍEˆd¦%º@*ËÁÖœHe(ÅÖYú_ŸƒøÀÞ–G¡P¸Ö03¤”µ"›¯^ó fà;[›2˜<çâÒôI†Ûv^þ[F‰hZ \ÔÞá°(šLA$˜cWÑ)¤â)Á´R}þ^%—ÌLOMMNM ç±m®ŠEè—BK,W)$Âeq Ñ²ð%/P)‡ò*”¨$-š~NÏÌÉÕ÷LCIÌ#P¨D†¹î•ÌÍL 1éPÄR…xŽ33+Rj¶nŠçPÆ‚i©„-båš›LNMÍK³°RÈ ÊNÏŠå‹3S3bÍî…‡Y„oòȘ¦ç0ë1T±I¨’Ùò(Ìn£’ÜðfÕׇˆ¦'§–ÒÜ"f?”-ŠÐ4$Š/6U•bvÎ-hrW‡O/ o}x6ìárÎœP0· ÓÚؤ!me$–Ê57 §&Ôb‘î‰)MâhA tfE2íý0¢9¡V:ÈÇ‘ªSO '/GK«Ýðí†HÕ3³2 Ç!éb,©†ÙÄó³HB™ò‹^Ešœ”*Õ«Qfª™A®Ä0C:¾ EÕ,Z5MNN-*Ñ",¢EÀ®çP«mH¸@;í Œ…s Õª›¾Tš~fPejµJŽVvV´¨‰)—Ìý03HêœæOzòºCk¿r’Nm ¸ñÂä vŒ€«ï~zªÂgÚ(æú˜Œ¨Õ_|_ÖÅ­žU:ç*ê¡?óüÀ–´òßL}d½¥\ûd¥Jç†ôWO½…G,éx3¾““ì3*RþôÍù§!ÿ“{l™‰ø/8ºTêS:v\êRë7UØüú»Rõ +?.IÝàבŽt¤#éè×'€ÿaêÂ_¤ÔÛÒ‡ÖaÕŸ$°ý Þ·~´@¸äï;²؇òŠZ¬Y¯µ\b«¾ÅÁõR5¸Æ‘ÕUSù ¬«íàú×įŠÙ¾({&gx·zòW5ÌN&Sò»~Eeõ|ì›üY Á§EZo<õú›ÜtÝ´ÿ“UæZoc¾ :ùù§§7Çú÷ÜôñáãLç+è0UûÛ¢Xo›6®ß°ÉÄ!ðvY­B=„ѵÃÑp•/\bÑÑ'oÝçÃÖ7°š’Á…3íØd#œ±‰KTußœ&¼¦ø2ŽãºD½EîÚv¿06úBÆ8ãïþ?RÝŠ-ÁʙΔ-ž8}#\PBúز̯”<Í>lΤÒÇƯðãÀò‚NVþÛ÷”vÑ*ÇU&[ªÒo;¹Ùxæ_ôÜ~Aãñ›¾R¸ãϾ»ÒwžL¡Ó]ê1½Ðp†‚£>鄳i»»ÍX߶Y¯7ž¥S‹‘ͦíyqÆzü¶w¼L>‰§]]9OчôÐù-,“øˆDOEæ2†ä;ÛQÈ k‡¥K>œª2 šw-(V4²ü„åµ@öÃ*ô«åÂ÷´@ñáí¯,æ?~29±g»~M\½Cº*çÓ ÖŽ·¯H&LX@^ÍÐ ´±è—ÍŸÛhkçwü6œlʦ–|ÛÍùõOÎxn¹ÒU~)Ážoã¿ý,”l{qš‹=ß3t_ŠR_Ь¿zuô¯.Þ”ž³gÚÇœÈ.|ó©Sƒ,yQ)ok?¿¯|èL4<ö|œ›xvëcý¡¡Y RÔåQŒ)Ù_Õ®¹¸/pÜ2µå`¾>Ù,Èsë³/G„ª±ú|Š1ùZÑK(Næþ`š}ì,2¾«2é6þgrËz*o#‘,†á½`Û¬hA)9oß½»{*Æé=sÕ€?~*¯®þóó{gévéÜ7³SâÎ?DºIêiMºøuT¡Z¬JüÎd'ÔÖ½)Íá‘îw#5•†šâæ|ª¯rý¤«Îí:(~MÙÈ®RKáõ±Ì`¾M¤m»Ø¬”LÚÓp‡®×}úTùøi“aQ3¤\Ì%{rø[OW×Õ×¼.ö¦ÆÞlFZ²™D¡{8DT¼lU äû:èF?ßC˜f¤Kûƒh›!F~¸N Z<û©®æAêÖTT«|‘ïºåô0’þ==f\MÐE,…À–ip¯A¤˜j¡Ñ€C¢¯¸í¨¹©…6²4šwî'œpÐ×6òÔ}¨Ò¯œZMx’¿]ĉ{Ú ï³t=ý~…¸\:­I±'„Âuï*ÝO2Û‚íxO#jF–Ë6FD¦¯KÀýò7ï«û†7áCcS-OØxú­wõýBÕÝ#|–]Pnyí@Ç>_&Ç5öèíŠþþ¬}^×$ùÙì|t)öÈÕ¿:Ú…2¤bÎÛ„qååò‚÷‚ñœ„×Ó*Åî¦Ì”ÇõÐÈ4Æ׺Åh>¹ž8Þ‰Ïh¦’É·€ôð#²Q_2Íc‘ßôËA¹¸£­ÙÒ ÿußgÜ$5YûȲ˜’`r½É87ØûÍ¥@¼ÛÙf´iÞÆÞ™0·#hÓ"6sHÔ—˜óP0:±(W ›Ÿ&C"šÎ\ía¼‘ šs-$2Ñ0…–Sƒ6žÎçÕ5UY’Ç]¦ëûé®1 ˜YB51:…º<DKzq¢ªr· )àÌWøy²|»1k'2 ȳ<®¾¶s)Ú€—Ü -÷¢g»Tó}<Àç0Ü™¼=¨ë#•¨ß‰xÊÖ°¢¢¿ OáOªÖ4é¢P3ÕüOä¾ìbS@¤=ièïAÖÃEN:¨–¢¡1=wP7\q$º!7/¶™3^ `hºsÔÆÆã$º¯º*7‘eã‰úw«Ê¥XØ/@póËÓ¤ž¦Ú›ÝA»·­"“ÆdmßÐÎø-A»iAmÆ}p†6¡Ûw"1v팳¢Òv–÷‚£6쇰šLøâ ­CãÑ8;¡84Úö§Ý z*ӹljò´]¦¾qËf‚´'º½ÇîXI\ø<Ÿø¥=¸&Úè™’®a·ÏÕM¶ÑZ×,ø1'Ñeç“îL·­!Q§×ƈۺ¨š.ÜM ?»˜³£wÎôeÞƒ˜¾€HßÁŽ|º› PZgÀº»‡âŠz¯xÆæAÒokÌn)Ô5´dß\ÆäÂpÎ"pë.¤F;wÄÛ2葹ÕÚø’.`ü¾:ÚÌF’ð;_i΀ËO9™º],ç>“¸3h]çb(„ýo1¾jQÀãPP´ ¿(aèùxÛ†MøNšíyšŸf0Ì]Dr¬ôí×ÝP»MËÓ4–¹?l9˜© Xv ¯QÙTÉÏÚRÉDkß-÷_4.ÊàÝömÏ3&öBægU"xÃÂ? ´¡0ß c¦o5Ú´™e¤e= ª7„C¦RÈ¡»R>tŽ)”(³ôóxÈ­WªênÆž'VµW  Ë¢n+låR©L>ßšAÔwìGV&Ai _mÁHà`BfóÂBýhtVœ«½ßQT…Y t4¥°-ÂBýitfœ›ƒïá\M"÷O9Gç¨íŠ*©dÉgQ&ÿâ#½ïÅe"÷v&,ŽÕåPiìGŸ!eVVy#‘Jä´M+VÚm:ÔGMÚó}ÈΙŠehsØÊ!¾ ­üÛ»GÌìãÐ#V‚ê»ds{Ñ´ù¥¶Ç‰¶ç—è\»–ž/Ô?MzÚhãmh¸¯²oPapp\$[z|ÂÇÈ0¡¢wi)¸†m¶-5)ªÒí2&†¿dhtâ+h#®Jü^ƒ6Çäk¡ œÉ|$“þ¤Ct1ÎäÈG…jâÅ;[ÖšO¶ö…ݦ)>qðîŇtÎ%©Ñ¾é©ŽŽiÈuöª…6½°eöêN³¤wrpê1Åã²¼óÙšV4Vli¢+èfõR1_NÄm-jüÒ&c³b m\®(¾Š6Ú¼þ‚6§L3Ê´1iJÕˆD8øN6‹¡MÛuË“°L5]ÿˆLåT¶,,ˆ¥JùC<A›Æ’4¦…«mÚ²]0+ñL•ÌnHߥï0NDSÆÐ]l™«­|°ÅÛŒÎ2yÞ)iGÐfV6RÁ[6{ëцU3ºm¼!&yÞ»œ‘vãÃ}%·ÒmØ43¯­Põ_'1•VT¹gS7¸ú’Ál×K*@ÅápxŒp$2.ã ]GÖ×700Ðß`’µºlƒkd £CƒƒCB±bŸeBÖ Œ3¡ða,ü€ŸÕÞKÏ5«ˆ€^Z«&Éi¿M6@2Š?WŽ¹8;¿Ïv®«K»˜hb´¹LÃϒݬؼš¯X‰¿ mâ]h#l*%0Màä1‘K<‹œÔ֤λ깥uh´äá¾1Ä'æénú.çÛ–ÇYÝãÄÜpÑ)C _µ‘P~/%©°_ÖxÆ×Ø;E#ûÍO $Ë4äž6äŒ'h‡v\[o¾ûÑ­UÃq›èª–â¯j֎䛇¦È™xúÅkšÙ^¨›&^]±pß“`NÏÿ„Ý2Þ|Ê6"¿2†ÍCE‘#ÃþÆõcüÈÛÚê«ífĈ\õ¤;v(©U ÞÀñŽÔhÊ0Ò7Š¶ÃJ´¹úªs™X}ÛošôN£Iyš2=ú kR_ÐF‘agè”Õ‰f*›ùÄÅ4)ñ>é~/¬X|*:˲ô–`^U&¼iDÛ4ØéÁè»<2‡7#Å×®{bš”R®5¦tø uÿ=Ì3'ªI)Å“ ¨Í¡ýNñ×*šKˆL“á&u oì9 ®…6`ª›¾kjû2&ŽuõŒ«ì·ÛDÌWÝ åïÎ~¥nOA ‰ïÁ|m LÛƒŒ} mäùIºsšvÓ•ìvgE¥}›Ý\èÿÿ¼KѸÍà^3¼¤-†Â+4áö4ý»Mê¥îÁ›úFî£jk¥¢2Troúÿ·wæ_M%Yÿ?æœùµid Ù÷„ €hƒl²(­ˆ ¢´+âÒb#‚ˆ *Ú‚ ˆŠ¸¢È.*k@d_C yo’¼—¨=Gì9=÷sœ——JR¯Rï›[U·î hš7ÇLÅRÍ#è¯]kÏ »Qýuj#Ö¨MùÈŸU›ÿ™‘Ô‚Úhgnö­ã¸Å_lí”ˤM§©ìm·MÔ¦óõ ‘þ°¦¹K.¯¸›jfÍmš5QyåEŠ-íAu“¦Leaš™5§Irùø6šï<˜e»ñTQ«TZ–sÀœ*ìÓ®R5{×Æ\*í”ÉÛ›ËEl‹Ø«šß¤>/ýÐ¥¬Ýmrðß›984Ô#}ºÑe­cüÊjƒ”Þ~ݨúò¸!wÓìáv‘=Ç…“T…OWÝOÝÆtzèÔ¬c“)t*£mL¿;ÏsõämHÄ ïòwä ¸+´}ïÝõ“GuVÁØK;«µ' ª¥í’ÜýëÈžÇ4c¤5ŸnM¸YZ/—ËëžåXZRJ¥ã¦j£žå2vdÜëìêSŒˆ·†‡Kt¾ cmy4+R~¥Xck¾Ê=Ff $Ã:b¬6hwÉn‚ûËfYwgÃÑMŽ :I«65Dºãnüà›*çeƒ´[Ö~þÐŽ„(>=8ûãä ªèô ¶ž/é”uVÞÍptçÛèWÀÇÅ™TvdOC*ÚÄdH¦:ïXýÈ)¬j–Éå­ •®LòåRý0çÆö9ü‡Æ4îWP­"stÑïWPYy–¦“<¬Æ:ÒYM'iV=8As¬·ËeïKÒlˆ‚Nå¼Èx§qÆp7w½ÊæQ­Ý¶/«©«_wõX”9É>ûí'TÝ*0·Ii6™n-$ý‹õrr‘h:OTÒÔ,yžŠNw¯l75ŠÇTè\O>ÉŒ”ý¢¡­åý1 ? °3ÿ¡€lFºò¢¾M¬=Ï‹ÌÖ‹ Ú›³ÝÌ-a%×IÕ„œM¦ž+*—4ã46µjnÿ¦Q6¯Òú6¹\V]|‘Hæ”uj;Ãô@cTx¤T3ªZImTr7 Û“OÞwôÏÞJú¶üINâÙ[¹mó$ÍË9âîB¾/DuóDŒ‡Áæ;¹ü›Œèª¸ÁqðŸÇÛt¬¹(ÀƒÏ`0¼·$J±‹é»kAõ0G‹ï®Ó• Ûß®_Ú(¿(² ¹­W›&“[Ñ¥s R &o÷ç°˜q-cz žŽòe±X|wÿ‚Ú.¬~Å»ý™ágôCŠ®½nt; >m¶ã’%7FSÁɲV®' j$dž½¯ù]Vçmf³÷<Ô×nz£ mGÊ=ìѳAV4ÿ^|ý©¸fKáôbï¡<. 0]“f®l6À•}"{Tz4̚懅¨{~d cóa¬•=•Q"W&›²7]¶EÊCö|‹·#ƒ¡¹ÌúqºôÎfšïeà}¼&Ó‘MsJ™¬å3iµ½øâétûãP/'ÍÅnÜž<¨Ô VFßiŽ’qCôÕ“sq|ÝÙo‡dt‰G¹óf¤ãY–ƒûÞ9ŠÐ˜{˜ÇaÙ{¾NÏ~ªsá³Ã2_hcÆÄQ>Nt:wwæ“¡²x²w&]mvÔÉëy춡·$†²vej5d¸¾(ÔÛ™ÉdÚyl¼UûQßyæ²þbÇfð…Yõ^Cbƒ_÷ï=_<ûXË}}GÚ/Õw’º‚Óžl“éWׯžŸ¬ç}û;3!Š¡ŒƒÑö<“c™˜¦[ÄD%yÉdÁf%jš*&)|ä•É´mœ¿“­…ÃáhþS‰Ü"]$š<‘¦]xûÒ‹çŒ|€>ÕÞöuµcsíÎ=œ3¾5üJ J^éæ—½ærØÆPNõºÎÔñ슯6ºæ2ãGqG’‰îr‹þ¾.'P]:ôjÓVHeaZ pÙ¬MgÊ óÆ=ÅêQ•—ì,ŒÇÕ¦*îì¥%Ÿÿ‰ŠÝ oÎî zïú_ñîÓ'-[Æeh±÷Úç<Í…mÊË”YüYÈg\ÅVð([œO곩LòIio׊ˆìêe–L“´ØÈòn‹ò¥×·ÁWz÷-i“6-︸jŠÁŽÒZ|¸§žéµ£Û¼*>ÿÅ­ÔþË4àâœSËxø/ëÝgúE/Ú€ð…Yé›EÑ/ì\@L¬˜¯ßmñ™ ÈçÏM¢±Ï7¹ÉŽŒe ]¶}LýK—Ù¡{UWXh |ªò:†gþÆÛùG%·,ÌHÉóž<º—! m89Á Ã\v[é“7½Ð#€ob¤j§ñÑžèÈà-GÏå©Ñÿ÷ͨðýyZq¿Ò4çªûñ©¬“½îó“’ é ¤¥¦è1°TÊŸŠs³ÓÒÒ¯”`ËŸS%içÒÓ•¿¼4;ö7bLu¿»~!-55½èUã’s9Y©ïzƒþ2ÿ–×arRY•ðw‰6Lµ_¦Qœö8ø«Ž}{%º„²jE¯'à*ÚrðÐþMBG3^tÿ<:ÙÛ°?1ñWœ Ñ"ÊÆž/Çê@ÐÿrBçxXvÁÜ’›|îjVÊ{ªÓÖ¬…U#Âô?J¢xD;A°*¿üÈ"ôç Ç O©ÍBáÑ7‡¬’”KÞ¹éŒûZ·”ylN5íiOÌ(îX,1\êùÚ>ãÏXR=œ9岸2bTw_úCe.ædeSR-¶NˆtÜû‰è"Sb/Uʤmço8R¶BX8¾ Íŧ˜$Q@ð7.…+Ķ2'·¦6jÀÜØÍ°% ƒ"ü×9ž?ö#Sun°ÝÚÍÚt“ƒOÃ-¼®,1DPåäèЄWõœÈ•z¶¨Õ¸XÛÓcd—D…ÎÊl|`aeÓ>l©ìUª+}k¾—+ˆLÕ<œ¬Í°ˆîþ!þöv¾âa¥¢þú¶®ýú˜±Ž—$Q2ŒÔ_;ø#{=¦'ÂÈ'êqCæC±™­K·Ö j&Øú·0…‘Êl+žÏ´´V¹öš}ú‰Ï&_×Æ~I ¦ý’Ö„Ì 8äÓñM‚ ž|sÇ̶ûÐÑÚ­ÝØqUD\áËf²ÜýÂ.–ˆÑ%Gk/ØÚ Z&QÃøEºý)¤Â>¼à¼bB,iS.ÉÛUuÙ‡NsêÐy™"29ãžZºäàzr°Få± ó8}ˆ¶ªÌ tŸóÍRŒö‹ÛåØÛuWüáÄqȹÿ¼¢ìÙ¯AÂà£7°lnÝ­-½có¸'!Ò鶖œß;VËá,º÷þú6ÙÐØBSÚ4ÏÖqV•ÃúÝh¹ákx{MæmZ²Â¼}B_¶kC¼)8Î ˜åÔ ¢ “"hoÝ]kkNn˨Ak4ï¯íçnŒÿâdLÕ%o¦à$&ý wi Æ»Î}>öhͧš9htð}nÕí„ÎŒÞB´<Ý¢4)*Få©ñB‘Ÿÿ?Q`au'ºŒ7§úŒËOaŃÐ`5çnf c1h4:ÕQ3¨Ö«Í¹–ÙOOéVÌÆ)\&å{–Î/v¿Wðxëšá1¥¯'XQŸ}4Á%'Ñ×&þöÇ/ÎüV]27ÝÄf‘å5Wi‹!Z‘^¢3=ohtFûˆjªöš%O¤@Q“Hù„–áÄx=‡+¨–ì×cËLLçn¶öÊh‡î«¥4 ‡ª‘ÁþK‰Þ<Ϥy½m£©ÑØ6Õø(ôe¯á/²môß&£NÿÙ}}2¾Õôuê6‚SPëˆÒÔ–˜­bÿ›ûVõå cµh(¢1ØŸæ–^ÁÔvõluÿÝ“Âm×PÓ…%¹»™ùÕ>CáñH[‹ØŠÉ¥ŸuÃÏÂ÷Š º¬ÊöØÐ}¬Ž†Âƒ ~ô¬aÞF9êÂ!¥<À2¤¨c\sÇ,6Åx¯¬ýÃF£.x›³#Îã1VÞº0­ÏkC¿Ìö<¤ÒÖ·LšBšÿã%±?ð÷›*ÅDk›t™yƒÚ Úy>œ^Šåø@û^gíMÃ#õßÙÂŒËÛéh}± ×ÅØ@«´Kw¨Úéjv¦/}xF±d”|RiÛÅ}ãóúœŽc¬ÝW3 =VG)!,²_@ÈÏÞN$†s–n?|B [“ªK¦Û\E›ÜíYWÿˆYCß©3.Ô¹!ö–AÚ5)D! :Úh®N|+S´7W'#ê+^¶®½½Þ®‹X‚x¤áˆ·åÆSÆul|`eK–Ž˜®IUf­§nÈ1èÒhåï.L¢³O`€€Æw¿#ƪùŠåZÁnƒZÕ_?dÆñÔ%;@ûkríØ\ÿ° ?&‘ˆÅ7ž !üskÞ'|õ|¤’bÅ«ŸFÀåVk$¥óQQ«pÔxXT{F{¸èŸUkçU˜ýÔǪ6z}ä…S ¨ÕFÅMfNTÙ~lÙ¸ét ²PÜ.R«ªŠ‡bÐ]‚Jµè=]9C05Dm\C¼ŒøfÒÎÇ“Xuën&q¼¢ÔàmwæÞ‘¸{¾s<ˆ¢F<ˆÑðf !³AZËäà{|¦a7Ä|Z8ïç“÷QvJ°êªƒB0à[ð'5+Á endstream endobj 708 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 94 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 18874 /Filter /FlateDecode >> stream xÚí}T\É™îìzm¯½»Ïïyw½Á>k{írçÜMÎ9!‚åœH(‹ 9‰$„„P!9ç »ï»©›î¦‘43š±g|¿£#î­®[¹¾ú믪¿ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€†¿YHÅb‘X"ýDÏ ¿*®"‘Hò©`ø¾ª©_°j¤ß]ÕÀU/…£KäMüO 6,àƒÌ J†T")A,OžT ýôÄ"”›«É#èŒäW‚$É>ø,`:ˆ¤ê)ATb„R‹¤HÄÊ _ P©C‰Ôø’~rȻا}¦οT©ŸÊ󎔿,ðcê©jÚÑ3U!z6&Äß] ý¶«ñeó@ýISö±BY‘ ìÙäÈ"ã´ð‚¶&Êvô=8)k@õEçI²‘1#CK—daãÓ6ý&+&¯¥½^X1²×·¨d²ýÅûJ½mâ%I×ó˜‚ÞÅ‘VÚÖQoá߸±ÁŽl*ÞÀÂÎÁÊDOµ²îåÉûñĉ-Î*AC‡¨§¥Maùí–õ¾öÂp¼±#f²ª„£D*ÅN¹!›¦¥G¶vØÒ¿¨òÉäz]™m`bblblÌ éPØ&û¯?øZe¿7¸ÿkŒþ“¡¾–$õì³!Ŷ[sˆM#›ÙØÈ ïTä§é'qfú <ÍЈ®Ç44¿ß¡*:|¾¤ÎAêëH½Ý±Ä&ËiV¹ÂMôÖÍ)ý*ý ÿeŽR5éXáC垯ðþÁL­šòƒúД0[^öDø?Ë~ù´¼,%GÑûòOW Mª"À,Ï ø šï7'ÊÚg?Ú ÔÚJ%©œÎ)/<£^ tÆ®³¯„†Nþ”¯ É)èBç¤ñ1?ØthƒÞr&½7w/²×/ñŸpt—ƒ¡ã±èqì.]›U¿2Û Ö'0ô=˜T§éR…¾Î ¥šm ½¶‰¶ÅÙÅ4‚OmÑ$Žmó¤õÇô3"®ˇ%Á^G†™Ç¡ÆÁyäÇ‘æJoC-ëÝ™"åÛ‹"Éæ.Û¨£c0_’…áØ#>T0/¢½ß‰¶I$ÖþoƶîW©ëíL™d¢ÛÞ(ðûŠ, ÏXy8Ó÷Ïüï2§ ¤ñ°‰H&©~ÇoNð ³]¾tK¯Î8ognÈ ‘÷D•8×õHKKûõOVºGÖ—!9J2jcŠ7m]Ò¯ß%XiøçF07dâ(ï&kÒ.ÚYPˆô¨ûÈW¢º‚HK}…B¦ÚÞ(kFJ²óIª9E‡DfíºVôôÎz-ûD؈ø[ã+ïÀxO{úôÀx鑽YP3î­:A%›t+ŒøЄ…·8/KÈ6,#·9…^=˜àû•Ñaé'±Í-gŸÿzýóùÝòfæJ:”—C#¨²ÍÓôCú¦|ÅK D îm8E—þrR!‘`ô?/«íK?È6v›… ý³+Òe•Ù¹ålsüñ b¿;ä¨põ- æ[0ÖĤÚÓ´ BeÕÿºØËšE¥Ñ)L³Ë™Oàšân0&Qé ûŸL‚ñ„3[i$LvÚrúÝW‰ A÷ ˜ï¹@ Ym¤ÏŽ;1w\—{Ê:ïïàs ì¨}í­`É£A4\üŠê3ûɼ#¤5¬Rd4YÁYMÊW’m$ùLmRa;T?ÒÉÇæxͤ·B@0efÈd9FûÅ`2NËuD™x¥¢E3rb$È l¢ð·ª¡g©pÄž£s_y†%œpd1æ7ÀMcÖŸÃÚ] UkŽ'J¾× 5þd³PÕ!z[t•e꺀´Lñ–Ñ6©Ú܆&õv<Œr-5‰ÑíP‹Š>dI3r‚E“¾²h¼‘ó¼HرÞî@ú!ï)kÁ+ÁGZÊŸ¼ql“N³÷91ɲÁåö©õÖž'‘çÜ°Ífn{!?ïÃutô|®½BzñA³5þ ¯ÖP‹P.›…^Ûîâw"]‰ÁÄ<Kƒíñð4A*Ügkâuª«Ê Ÿð)ÒA†vê+°ïrÓ³ÐOÓIÚëúd&°÷l!.¼A[SwþF™ø cê#9›éTRìývˆù{ré8£60Ý\FaöΉa£EgÕ.Ãå-úÍw\¨Äà‰dú¦|8 ñóÜÄ»ÓËÇÜ<_ž½et ˜ºŒmÚ*HšÕÖЖá9A ú¯z'SÇíΧtšØÍYÝ kM—¨•ØF.Çî4ÓØy«Ýì8 Ûh /¢¯%Üz˃_z½èk‚{¡¦î5,;a×?;ÛàKˆ÷’P?‚ÝN‰úrUf©ø¼›•d±üçúä3ÌuŠ"”x¡ßÏÖ ,øn¦RR±€'€Âå..ð$ܽ†_®˜S`I¶Ÿ¾ÙùJ¹ÿ¨më6ŸÎ„Óf†Œˆ²fÙŒ< d›aU½Ûzë’7O!E-•†zØnº©¢èãòø°ÈÍ]X\x°MßžïƒlC2>ÊEò.#¥e<æšXxfÕÔþ&ÞQ9ÖS|©béH%".j¸îOÌqXëqšòF4uÝžŒ–äH…&Ѽ›/zîèhÛw#ã~ìvýÍ¡ÀGÊý‰?7ñú~º‡%Ãi[†Š DÀ‡å‰p~~¡«àÑb½b›ˆUºŽ=²›8ì.Ÿzﾊèæ×ÓµÓ•'Í`‰ñxpÛòæç矵gl‡šïý-:Œs°_°™¬·¥]Í ÜÏNèR‚gàoK·ºDU+·ú§8¢Qóœ•Zó7ŒOó‘½'†7jçÁ³­Å~SŠîãa`òm1aXÙÅ“åK ‘‚ÒQÕÑW^Jq®zÛ,›Ê!ºj¥ksõ­LÌçGÚ±ek ˆ­A;š§xò™”üƒáÆ;6áHò³Og)Ðj¦eøƒŠOnÚt:g¾+9Û@jŠþæË|qZkHtŽ³Çɸr¸·J]ÉF'~¶±ß*ÿ©÷U®9ƒx¡¸i9Ûœ©•‹ ÜŒÓÞšx§6P¢ÙÆ–y2©ª©ôÁ±õ´­Wäe[¾ÍÜí ¤Pžº+c›GÊšÛoèKXËYEÎW›LU¶9ìh¾ûzÅR.²Â(ö>hU ›˜ÿû¥†¦–åÆýÜOÖF]ˆzOûÛV›·o¶ j,›U`þ#6MßÈL o²5O›Ð2ŸÊf¡gm›(‰¬-Þ r1;z]I` r/ Ù|‚ƒƒ=͘FG ¶!:ÝDû²`ÆÜ–þŠÊöq C £<ÜÝúp•TUü˜ŒÜã¥G6ñ ؼ}›#›àžØ ±Íã ǪÐr«Ô"šur¡DvÑ H‚h`Ÿ;;4§Sy˜¼*ÊHLJNNJÌ,®“(Ð`¼=5öœƒ)Ëçt™DYøi­J¶3¤:xl Þìî@·ZχÙæ+Š¯|–t甹îbÐw_Öam»]P€õaz6¡ªy‘JÊâN1©L÷M›ƒ‚ƒ¼­ôÙ2¶Ñ¶¸"F}‰7Øѯæ¶Â/sŽúÚ‰/fÞˆZÝ9«˜AÛ]]ºÕ¸@Œ¸Alã| Iü\1ç8¿ˆ‡L©ºÕƒÅ—Æ6£h m÷¼üàí(DbáûM=÷ËËáI”­L¶Y©ëõ˜{dY*,Hº}ãÆ„¸  »5ÞܽDE+d#«u¡7Ë ýd¶‡¤„}ÆžW@¹NâcJHk¦:Õ²ÍRJûß7ä%EXP‰®§r¡|P ~9êFÕ¾§Ì6Ç)t ’n"‰lbë~!¹J¤úͤ'A–9pJ Öæ–ƒÚ'áaVèfC‹,nGâ¹æíè’Œ®‘ÀË;¡L/±"Ûðkõ5 •SòlŒyáÖœj~ Ûœv± Œ¹§0§¥;û) ÂÙ¢Ë[ðÆÓßÍ"KÙ>‚ûùû>ï”ÙFpΚåþFõ;Ä6Y/†¾Û˜…É•«q~Nv'”VI:«htúë1´×>Ún DÎ67–³ÍÂà}†žé€t>€By0¯šº†„#8so¡ì5Ö~­Û$½¾žR¤ZÔüéF*þ^O&¥;ÒƒålsY¤Ê6ž4iû:Ó©óï‹hœ-³ÊÙá·ë2¬&ÙÆéÃlƒbº÷Mĉ­4ñù¯*ú ‘Çny}pÖä£ló>7€Bö+k®&D¦Œm ÙF¢N¯ø‰lΪnÒ-7òûR‰&ÇÁ’QË6ܹ™Y¡R¢ê}«›&¡±› cÓÁ_ªMˆëÆßt ~Do£¨%V¯¸…µÄ¯¦ÕÌÊa¶‰*î@\n8[¿%áqÂIŽ“¯’l#l2ÑÑ.dË£ý.Zš—Z?A¶¤÷v;˜ŸH–G]tu§µ÷)@Ìíëéç£ vð¿a'-ÍØ®ïDMáíà–†¾v$’µ´–Î(êmÚÂ4®Êן¿ãJÕ²ÍÐÙ¯cÜŒ¬3J%N‡¯W*zn̤Ó,p1ðÇí8Š²¶Ä‹¦Œ¸óûén»–+î^Þmæ}-Ô±‡4œ{bÏؘ{Í$™VŸÙ\(ùX³™ó·¢Óô-®—5‰Õï3‚Rm±V/mÀ­c® ë³ Pxe½UÀ-åÍ„j^‡ï3pœw\XÌó¼­ 9ÛãVf¤:RôØÁùgÍ ‡Uk|´Z‡dÒ>/’ëm>Ä6CÀd׳ŒJ¹†mq‹zñIßpáEœ™§@V¾þͤÑ\Ÿ!›ó@qUkî})‘³Š–xI¥÷ÉlHû‰úQþœcùõÀ lsÁQÛ|G¡D!-Ñ^«MƒmL"š¶7¡o8™ª°Ä&Œò¡1¬BxŸ¤·ù”´ÄÊ[wØ$­1Ý+’5鸃–N7¡”Àl{m2× ÍîD‹ùým «6àSØ4^ÑÄ{ŽÈjꈓ^ðÍN)¯Õœ¤•Ù(Û0^H^E/ûNÔÄÒ±»‡4‰Fçn¤Å†íµÙ™pj+ÇfýÑ}|?'Ù ¸xÂÓˆl³i×ÍÄÄ3;½utL UÙ†÷Ô@›°õhXBÍÄJlC´Ûåå¶ñú”íî:š¦uSJÝJ4õžJ œ¸–vëš«³ó£îzŒõiO[»sW`°Æoxðº{o4-ïî u·×êÐD&%„Ÿ°õ=•bζÚQܾh¶€{‡ Tr)¤Žþð(Ím){VÖw»60Ì=¶§¥%º›FD^ÐÀé_KÊâ6«gðßBs‘.‘BõN—. TÂ7e¼ö‡¥'Åx8ZTÜôÓ";&Ý9]©žmÏO{ÒhÛ!¡JxþÔG¼ñ~ñSÙ¦¹XC›x$,ávÂé½>D<ûý” øÒÖ8lÜ—œ’°ÉÉãäI™l#w3ڜܥVÓ5ÛYeFÕ3¶s ؾwßέÖÙáôÈçsj…𦻳 ›Hõßsp¿ ‡¯å¨gxãD!êFD+± ˜ }M-›užûŽ9ud“ç:= \êK”æ{Ù2tô­œý·lÛ¾e³1•î¸„ÿ‰ZâoÏ6PãÝïÄ´Ú¸=)%åÔ¶8†C#º³¤ÙBCwã°¨ŠÎ¢=çXxBRüE{†Þækåªqúùé£GO+^hŽQDTºÒ¾¸ÙÁÚ˜¸bDÉÃz{}žlŽ‰Ì„#‘" q¢²0#.:***&5·d`Q¦!C7ÏWßËŽ‰‰Ž»UöôÚzŸhy•ŠðdW]Åä<ñGZÆbfDTE÷¬º’§%ÆC¢[­ ÷XØŸ-øL¡q/;ãvÞþž‹E^§]åQ³õÐXùí*ýZ2¶Y_;²A¬Ö²ÕB|1$øæƒ×bßÍèë(o .ÙëxÝé0`øѱ $Œ=¸î¿Îˆ„³h™û ¡eÆžu¶dÙñÿGº$C¥{}œˆ8Æ­ág^E3—Žî75 ¯?rûâl×’wô7ú®°,ý½‡ºÚ1Ì]f±Ópþj ˜h­mú\¡M µ½®o]|–¹eç»·õoß!ëߟ‘rêjë:‡¦Ï"¾Juu Íà”d¥-ˆkë›—Csßð |äOØÕÖôŒ«±uš'¾«s50`À€Ã×ÖH? .+ž”ªêTÆb… À‡†i1hiÞuÿàJjÙó2 ìÒø•¿ýÔ©Ê7ýÃ+ïë—ç·ùö{êÂ?¤¶"©·&Óôe00µ M¨åBtÕ–à‘„,hŽl SYŒã¥þT—wžÅ1Ê홀!w5cxwÞ³ëöŠÑ;¾øøBë/Þî¾öW×7?ý9ð+W%ÇèÀ¯~üËoÄÚ%Ç'·?ÿ;ð³ðVÀÀÂ7˜ŸIÓ¶æìÜ—£ß>Ã?pÖúL]iü™eÑ1+ø&ßÎwÝâi÷Ü_]¦dÈ ±t<øè‡QÒ׆kðáÕ­MõÏËÌtÌן‡WE—,´]£`#®zD™|^—æBdÓXÙÐÒÞ”|èŽó48œ²rtB ¿û‹å÷¤ðůóÉìkÿß0I~üÜQÖ`$ÀzäòËÿ~ÿt^ Kó€}þø3òÉßOf¾ÛXR³ž~ûf]wÁ3ørù—k¦[ÊHGøß2 ±gz£ö³T|:×I§3žtÍ~JQ'âC£øb/ƒä?ó™J)í¤‰ÍÞª Û¬ÂçŒ-±-wà ƒN®íç©°Í:=ÆÖ6gï-•Z_6ÝÂ=€NƒÙ†LÂ×‰Ñ ãÓЉ˖ÒÌü—˶3 &€ðà t̨I""€PS\‹r«>BøµÉ@ø5`pxY’QŽúggñQ@Ü=`qÆà]+Ü!àÎ (ü„t`˜‡¦øöyàç ü+pù*Ð8.yw€ðp 6h_JÀÄÐÛ {ns™À@þm¶Þ8ðOü³1ü²üêïŸsÀìÿù_ý;€Ì }²Ù+%úû€Á±e­>àÛó¦ ;##÷^Ç$_‰màýõ5åYéÙ¹ÅïeMXÚòòaVfFFv~m›üd1ÿMMEFFFfnqS?¤vªÎÚê`¾!øtnQI[yvÞóyœÒñ†äÌrž„_›5<Ç­«,LMK/©~³tÀG8QSV˜–žq¯ê¥HV,áTaVZ×”LggçÌ ¯¥¤¦—>z-VØÛýöiNfzfV^mJ˜“-%95C Cïr3R3³‹Ú§ÄjûyOã³Ü¬ŒŒ¬œšzø(zçë+g¶1 7%§¤ ÂÕ5ßßTœ›•žžY^ó­¬ùÞ´œ{R€_S’›’šñàE‹<´¡¦'Ù™y%5 £µzd„m ÷™ž†"0}éY•Ï›e¤Ö–šw_ÌëÏËLico{™“•‘S\55ݯ–m†ßåÔŒLtÕe¥¥då– rѪDrÚßT}'·©ç–—y™é`­<-”&û“âOP©. ©é͈ÄÄ}X’ŸžžQTQ3·déè|óLfnñƒ1áR5=¯CV^qsÿ¬ ÛŒ½­É¸÷ø‡Ã6Pí Ç[™ úÃö¶qÑ¡W÷=dkÛvÈt:ù'6m=sc3³tbp@ $Üñá)°¿KÒ6ÚºLNh„G|]èùÔŸ gÛ/Ÿü ðO?ƒž’?”Ô(MÈ øÿ?ÿòsèÙ ¶0 œ~ýSà_Œ³_ÿS ~xŸƒ ¿ù ððág@Ã,ÔßWý•7þß?Óà°üøúwÀ¿ÿøåO Ÿâe Öÿ{èõ |Žoî¤ýåJl3¿º‡Á¥&þðoP8*Âȉ5ŸKÈiÄèù§ìå#à@Ùy]#àà™#Aîx FQ·X’m„·|(,Óu¡W#Oìö¥’(¯†!ÂyãO3¶ ¹yñø} %ÞÂ}}·ËÆýbDtè>_ŠùV‹`¸&ÇÕÚ`ý–cY÷^œÔ"øŒÊíƒÐÍF[BѤ©ÝÛÖ1è|RI^²½es4óFìdkïññÞÖÆx—sÈY41·Ýшq¯MÌwÒhŒ{¯¤–å'š³È{P3ÒQž$†Ñ‘ Ñ×B÷Rp—J¡ÎmYë)<7í(¨¸uħiÖÁUbö—¡0M½víÜKêöô·ÂþÆ}ë˜ì ·Ó‡øÀT[‰.žê¿ïtÄ•Pg#:g{6ÄY£÷µ©¦§<ÌÂòî¦]ãHa/ ýo]b´ ì=gï ruu&ÓŒÙføeªŽxølÄåÓv²ÅÁ{PÿîÍÔd:žrÔßuàÀ‹NþxcŽ@>~1òÜ^;k'µlSwÝærxÏÞÂÒÒ ;pz=ð| =ÓƒêuuƒóúãW’À×· [ðýýç"#/6¡êM«•Î]ó%“ìã’Ó[æ oÈšE¶Û´#îzL³ÅZææ~x+ÄË(/*Ûtÿ©s;½¬qºÖ] IsŽX1MlÎEÄ;°…N¢æ¾ŸUd›†Gô=ý@ØÓ†^ÝdÐhí3ÒelC«ší]Ï<…¸Hüõrûf}ñäì¥M’KŠÄVì‡Ø&ä+è–u›àŽÿðvqº‡5𠸹AàŸÿzí†Ùæ_ =Û_¸p•kƒ?ý#кˆÅÀëhè§ø=(wÂ:8ö?ˆhîùÿ ×›5€D L´ÿðwÀÿ vF àÀCš–r4 Ì6ס×@ØŒ‰T ¬ù/èU~¤røå/`:º&+•(ƒ?×_F6KÜÙ¼^ÄáÎq?¿ÐT@(cáLiAÞà:ñKu':Ý;5ÿ [3ä-Z¶³#ío»ÀDOo$iÞFO‚ƒmƒÐÀyÄËü`b΂ëi¬s­W‚Égrzþ„©!sGâ#49±zv]ðêœ9Á3ݨ,š_gN‹¾÷ÛšÊBF½ÿ-› / ›X jc3h÷[ÑㇳÕµpÁ(;r½ÈDÇAäüoÜTŸ’ûJe6-Š´%n/CmaŠæûêZ I >w/Ëü$2oœ]\ž³èzÌ Ó;f¥ÀØmÚ6tö˲g6øpqŽëy´>ÚËã‰L„m›«òËšJOåCçþs45)Q­èT+iÞôP ò<ÚXHg¨a›úg*ÅfùB8ílÀŒ(‡6wåo$Ì:aIL¼8bÎ&e¼@÷0ó^žÑÔu‹¥á2ˆ„ø:Ô\×5^"Ó3xÛ³NÞ®‘Ž53éôg=H¦Ù™„U¾4dëÒ-{Q±°9݇ÌÙ·¨À6Rȶ°ø¯œmL´ A{vÁÚìEÃãÂ'ËØfBð>a7Ç/n™qxë°(”Ùæ£:¶ …ÙæÞ;¤Â€?ÀâDæÈGØ&¾ fܯ¡×¨^Ûü#€›¨…ÜK”O _ÂL7H>õpì„õ6è*¦O{kaÉçf¯ò  žm:b¡× h”m4`¶y-ó¼Çø5È6?ÆJ6 K•7 ‹[Lu´‹GE›ØJz›é·çîò÷õÙä³ÉÙˆfyéèö8v«Óz÷‰Ë/–ä%îw$9<õømŸÜQÆ6°­¶¶{#à Éc†žS7dlÂÔ€–ö´_6l3×ÒÊd¬G{ZZZzZª¯¹‘d‘R]@lèê˜FB^x¼MÃè4ØóÆÞ0hlØF2q~m¨…+›ÙÆ“h#F T8cnDK{¢jd·§äŽlt(¤àáky ÉÙ)œÊ”kÛ·lÞ´iÓFW:þnB ²Á´:ïÛúÈò ;ƃD²^WãR Zƒâ¾j=*<“‚×>î%\ ÞââåæÄà .H@¶Yƒ³îAO±LµŽÖòo%SïÕÊ6õ·œ(±²s]³67!lC°¸ˆÐÂÐC‘Ò°d“µÅLClà lÃ;jHñÍi‘¯rÆø:9œ¾3ó.—A7àŠgO^¥‡±l=…´™Lu1HœáLoc¬‰Û‘”áVrZnóW¾&µœmI£¹ŽAHô28´ù¶lS݉*]ua¶¹Õó¶I}‰ú×ÿWè5´UÆ6@½ñK!÷?Qe\!þf›¶Ye¶é@ÙfTŠz£Áls©Y}ì*l3\ ½z]DgRü ôªbñ=×rt<ö¡Öhâ+¦Eõ$Ê6/FEïØZø½WÓZÞ÷ô÷¦x’,`¶Æë§EçO\ok …7Ï|ƒ¼}S‘qæègsQß­_—d°B²uuÀò}{ÉÁþB€² 5çÕ¨,îNÝÕiƒ¼@*É.èPhÈgÏ‹/­]Î6:QMçÂãí Û‘³üT“~>jžµ˜ë®Í:Ïò g, ¶n¾{yÕZ Xㄈ´Co^;{tÓ:Ë5k1•]*²MÙ¹u$sÿ¢êºŽ®î–g÷r¶!šuËN׶fm ;l3`·V'®[–Ú‘'r-qÆ![šmpÙÓz0ÆŠ Ûha¢ƒlœu×Ò=ß„Ê9ÒÙˆmºÅør ”Ú?jzM#lã‘!ë㢫N1•(Û8Æ#9ï/aX-‹²ÒºítVßìQd›…í ÊŽ{íò‘(9ÐÅìèÍÉ·©tºù°@i#JMò}{?‘ m¦ç>“LzÇûáj‰U Žm å±Ç¥§Ljíˆd%¶YÑøÀr¶‰†Ô ð ˜mjxaØð¤ýïÿ½ÞWe`Rÿò+Ùkã?ãbÛü€ û¿Ù¦~Uÿx:öN€€p¹Tµ²ôV(± wøÅÀÿn‚ËpøÍÏ€/p€°øÅO -42æ e@ŸÐ· #ðË´ÄcΔ57HI-LŒô£z›Í¥QL§Ô, ÷´Â62k~0ÞfïeÐý¤—·´æ’yÖËÆí”TY¶qÉ]w[f‡›^_…ØÆSÑŠzXxÈXMkàæ:¢C\ƒ¼ú„¡êu$+°Ílw5ƒF…lŒ#žÇ (kõÁ±IÛ(Ë6R ŸÇ•G1_w‰ é0¨Ä6ãž::g…² N®"Ût©²ÍâVÚªÕ<¤°g ñtd&5袩uEÖ¹»Ý¢q–³ ÷gíæ{“È·ÜZõ²M‚3ÅðjXÊ 2àìÉx²Ê6¼‰ ®fPVså´ÕÌêE`¦á’ŒmÄ·])–WŸ2³–ÇÜ­ü/åq;‚’ÛûiäCéÔ@Ïà ¿ë^4ÙÌ >L…6ò:†Jr^¶&%ýk>QùõÙfèq2‘Ư»éJ²ô}eîÝ×C—m¾ø%PðAŽ9J*Â6_ü H¯"·ÀÏTK,g¤ 7Ñ¡_W»÷Kú¡gkÄÞl+*Ï\Oº’#Ðó¯©@Y%°™ „Æe «—/Ã"n}&pþpÄþv põ*‘ WXí£gèÁRVP<4ÓÃÿõKCàaÍóþ $çÀ¯ü§ÍòeÒP[ëÀóˆÃWfà¹ÛŒ<¾CÑ7‡;[CN˜‹=‹¹@Û¬tØ™]hß}‘¸•n|DºðØ@Û´Jfž9ñ¸‹½O4üÑVÛ.Ê#lÌ¿BcShþˆÁ˜mX$‡ˆëî~-{Èxàd}•¨_;Žv2g$VC+_ÑLavVïŒd%¶DS®4Z`Âs${†ÌÐvˆ³xăŠx‚öøñG'ôˆiÙ7Yœ`˜bøÇ9kÝn­QеÅDd›Æ1 0®†mÀ—;'¬Mí"Íáú.K a›Å=ŒÕ~éðRéb³Ÿ ‡Î2„ú”ØxáÌ2Ø‚(M OÚ¯ ·q¡SÉw[¡Œ<ãЉ¥ÍÓJlÍι¾FìMWQ£I·¬©þÐLv¶)œ¨ãŠ•‡L¯ã ^#Š®é§&D´×à:¾ŽLó‹ƒuG ÝFLê—ý¯ÙD“pª é«ó‡Íð–a/µÄïže•>ýë–m^þãÏiê•%¢3Ìÿ±ˆE4C¿×(ãÃmtÐqÍšhÔØõ´ëŸ×¤t.ß; ‰1ý’u쑪óÌt.#g›ä[ÀŸÿzø=h›ú8Û\Š´=üx àÂ9XÃü+¹j8üîøÿï@È%yëŒJ8™}c¤…ÿ+„¿ø °9ZòF¼Ña?'`Sº'ÿ€~²ôïx°P— Ë²¾*­QÇŸþp2 @5 ÓËÿ5S³ò»Ð~`£®.§GØu!}ÐøS âÚ”ša@Åf±Œ]R¡ŠwÁHý~/ Ž@ ³/¦VÖQ€™Îš`c‹E§ì»–Í…P8åàãó0ÿµ6ÛÿzwO)ì{V÷«‚7…ý+¸/³ ,jóIhøPôÛcMô›¦XÁaÀ€Ãb!ofzzz^ðד$©pajfñ[Úñ•J?óÐŽžhä/BÅ5=³ÈrežT¼07 ºÎÎÍ‹%RÔ†üoavfv^Y–.ÌnÜÏ”&)oanzzj‘/þñ5N¤ ¼Å°Ðgfù"@Ag+âsa÷YžP²T岺˜[àJ>Þâ<Æ,WÈòˆ Ê…ä‹$²Ú’ÎÏÀ.Ãì"_^‘üÅy¨)€•ŽX˜ñ§U1#ÆD$œ_O£SLýCÿŠt&¼Ç{¿48&ùvª°1ú¹ì˜ú¬m¦æ‹B¶óÞæëÂd²¢ËÚ‘˜Nù9SH4k;k<‰¦ïu™/k½cwÓ¨d#«-ÉR“Î8¶ttÞ~éó”ÕØ;S}¦•ƒsʃáeûœ}~Í„Iaê››sˆlCã{Í2»(CE6, ÓÀÚƈÌ60{=ŸR‘Îx:H,G<…pÝ&Ý”Ħ‘ôÍm˜Ž‰E5t¥È²‹±zr¬X¶±­•!YßĺuÞ2!]ܬÏæ›Z£°ÚƒœMÚ’÷ÐÉ[{2ž¬¿á8xL4—›[ZY/Á¯iÒ&üñsˆt¥%@Už·žÆ­ õUé²åWu~V ¤jM¥ênàõ š}« ­¬Pš\¯#ëõ¨J"3m¹è¼3?´ÍoÓ“.ÕK|ÒwØì¸S|ðî¿ DÏýÖà`MÂ6<‰Ü0ÄD3YW°ètb¹~× è!¾¯5‹A£±ô ô·@w` 7”úÛ0Ùl Õ(4ùR4Û5‚/ÝsfÉÁÐœ‰Öª@g#ØÁ‰%èÖÊ®´ßéXµÖ$ú¸9˜pè&zyð„B0™tn•DÂãˆ~ÇâÇ`+oøú‰-4*E£8o=Ý:ÆGÌ3ÿéßÎUÍ#l³ÆìduöYMWSokHÊ|`Ù˜ºêÆ}t·ââý¿!í„…iaÁ$Žchy!«vƒ¥ÞÉ;ï„£ïLôé4ƒÍ`Ç4Žt5r3nâ5ܯB;¬î'†˜ÐÉ ƒÌ´¾^Ö,o%±‡h8=Ž¾é®ðòƒ~4ÏÓÕJmL¼àh„O|<)³6~å+¼'tB»õeUü«ló`‰} Ýø¢ºî9ë¼ÛHû^A'ýøæ%¶Géçé_jâzg•/xëHýžMCÁ ŠžÆíšipÔ¾Ÿf¦³t}+ï’¨ýO>N¡±8 :Í€C¿”?°Ø÷rï :“E£²ö\ÉDjyò'MÊ‹‚‹ ½5Dz s¤Ïs£l L“aä’ù>¼6Ý´FS·ú~NàgscºµïkÈü(*ðŠãs¨$"èÒµ‡(šË8̆ÕÜmûøZ1ð‡ö{‘_êÑ'àÍx¯ =- ™fêšû¬[²ØCÓþsöëyÏ 2ú_ÿXèÐnmQ¼½”º¾cJu‡ gJøó5•å1vØUTwx-eÛ$ѽSõzTFlóåÔÕ&-âŽw¼Þ,ã<ÑG“ƒ·"Þ@oX6HxkZ\P¹Lo®ç)ƒÎx?- p²ˆ²Öò=´ÏeÒœC+n˜T!ùîÂ’Û함ÚýTŸAÐw›F­HnZ®ÒÚ^øc–oÞ…éêRwF£gýrÃ6:#­¾>ý4ÕÔqšRN{á´n"Gçk ÖàÂ_ öNú}éÁyP“>`Ì0@w‰qëŒ×âÎU#…?ÈÖöIƒ·©êèlN¢Œã]uÌC  ó¬·™ÛaÄñò}Û-É`”ç}ìl·£}­øŒ}ý~$èÒœôæQÂ6xœÞ¶(Ä2ÀèFÍí±RÑ‚ƒ )é:ÊpþÊ y¢|'NÏá=,¯> u¢p—rá=ð=×qzÞРÏ5ä0Ùî‘VÚOÓ³¬G6ôOÜe®&UÀ›Iùµ¡Úæ¯`eúa§tµ^iü“Jnº8ìˆ<îb\€½Ó±„¥¡òx6d­ÌV±¼Ï(³ ŠŒãŠlÃïÎÎ-ZTº”Q ÊLÚºÇýè½Z­¥gèlÛA8Ù i ¹y*«¹îû Š dðAÔi«?XØôžÃfD§hX$˜®Ã©¦IH8S 1T¢á¸EÃ÷ ˆÚ¥B`þ=…BcmE΀¥ÁlÊ6(ÞwEGèì “pºJÎØ,ÏRÃÝkAúv›‘ÂlÊ £YÏÀ)ŸlÍÎ/áƒjæs5%¹ rœ}q]“`Ý.Î8›ùGË̵ ¦â4lÁYèbÛ-*Žý ©ÒÉÇ&Íœw‚•÷£Š’7±­B¡aqª3ŸN´î_š¤Œ8Vgr7“Hç—¬°Jrƒm-CekÙRÑâÂâpK¥]?ú™ê)õÁ7©tšÓ˜œƒ$}6ü!p"5bȦ敔ŸÚ½ÅgËÎÔêvDSìG\—Ü|/z?‹Œc˜ºW´M ûþÀÖtÒ\+ä•üÂGigU~Ñ«þ5Û\X­e߉ÂÜfúª¥Ã¾#Z”Âat §}ßž\ døž”û¨Í>id}@±Áæã™H¯z}ýÍ}ÇÒ\¥òËp¤Ï*ÒÐ3mâ£}ïÅ-Gº;Øt·0Vz&@\‹sSs€tО´&£[F‹Ñ*æåóšl£ãÒ+G’OøÛœÄêÙæ† Í!î±tÚE_aQgNo#Ôøc†úêÙ„H«ÙééÙ…ñÌÕ/Àè%9[-Ž§ÉÛÌ;Ý kõËæ“'6X€²"™L4ôØß»°4+€›Øˆ«cÏí§ŠôÇÙFýL ,ÒB ר.Ybªé[,ßc/ `1"A›'§ÚËTã^ÐUG1s”kŠçÞ'Sˆž0ÛàÌÒ~DÎÅ9ßË#9êhv8ñ!°ðžBeÜkŸDí VhšBÆÄΙkú §È%"îø8Yb®:þ\žŸqJNߢbÂ_Eî¦{î—eM<96¶(YÃÞØz(Úådqd?I‚Õ>n©ÏzÚ슼»’ZàÕ­xüºxõ`¼9‘Jp]*¯Ù ÔU M£nxÊõ&ùÒÒªýöÑ·é"Òªµ:ºÄ û¹RÕIMÏó:ÍsjÉm‰²&í=8!覑ðVþ§Þv´¼(2¡PmCg‡ãñL6#óY×ÌÌl×Ë4…r·iNf˜¸w™j¿YºLÑðc^Uwá+ÚÙd²Ý‡cpdÑ 8ºk5vCfu—ØæöžMd&Sn5A%áéV ì|ÄŸ½3rÎlg r?L:E§-*ZK´”µÁÚÄu w°–»,×ê$©Øjà¿2!‘XK)ak}¹ú|«*Û¬Ò?,’uÀÊ«{Ùwµl#Üͦí»'ÿ^âmOQÃ6lZA½lÈ[hv2`š»ï;xøÈÑC¦d­ðç`—…:˜yE—ÈÓpÒ¡Ä6hà ¶&í»/D„úÔÀ)Y"§ÛÝ~(QnTŸ"Û¨ÇPáZ¢ÍúáØœ-/xA[Û#ñÅÛðgiç(à$K6‹¦± ÷nf’þÛ „Ðç¶RH4yéëë“tulϤ¼v •ù´µ>û0HË$f6èè…6¨¬uÙãôò”pô44·?Tº±7íèf«à³Šä ?L{R4o¶€Rž«)9áÑ l“Jc-劤§kq0VÕnX§kÜ1:N¶gÓˆvKÓ¡QâêôÞyùJí’lS°ÍÖütª¢ªH¼8žyÒ…î&DYá節¸|±¬¶èuæ2.P:`KX›Û}((ØNîË ¬¦Õð$g=Ú–"Yò$ÇLbKåY Û¬¿-¦áok¯Ä6[e£Î ‹öÚ[jNh.±MÞQ_óÝW–ûÙfWÄKä¹üÒ.#ÿcjŠÛØ,c›WݵámÊ#¸è©ŽÎî‡T•Û0wqe µøüNŸƒ*²Í\ŘmÄÇŒiùrÝ‹ØËŠ¨–m Q¶§x²Ar%¡Ø›±fñ5Wsç«…òsd=IE¶Ͻâè_ÌÉf :jjÄÂBÚLk± ™t± eùøõíØFNà³Ad­cj¹r¶y“{™e㩦j@¶!ë7N"lÃ=¢OØV5©ê œIlÓ«Â6¼í­=Oæ”°a7µ±ƒÒ½ß 4 8(8ƒþÄZçu$_8\J#8öBùâŸ6¡Üíû@Pð#ÿ‚—¾éæóŠMfq¤ŽM¡@÷fKÑULæý7 Þ‘à™Ñ![Kw2Ûu£Rº0ÖÜÜŽÜ ïx£¯Kx9Ï¿¶=hˆÝ;î”5Ïw=bЙò¥ª¹ût ãF¡²zúÛm­»&cxbLß^.ûErÓÛÒåJ¾\ä·Ò"UÌýíT•³ ·^$'h ˆ§ËîÖˆ º\b›é²3kY>ò#ßý-/ßò•ØF Ì=ŽÔ`¸ËÊq´³®¶ÐµÛaˆî§#ÞŸ'Ÿ¢[m?+ÂÉÔÙœ`è~Õt^-Jà{`A¶ÑZ˨­^‡m³ðÞsÌ©q¥È­4ÒòÎkÌ!K¤÷·±hÛóP&›¨4&)̤t½ÆUÙFxÚÚÀï6ª_šFÖѺö*¤·çœtœÏË)Ñž¤ ³ 8ñ „ÐEÂí0'k羓t3ôÕ´pr#uààâ©]†y• ³ôCl#…m¯ªŠÙJlÜ=ÀfúçÊ”ÍüŠÂÊyøð°|&Å{W¤G3kŸC{ÈÂhS]÷ ¢·Q` .ÌçzS,S|W—TŽs%jÙŒ«h/‹á›D:ò6‹H0iæšÙå¸ìÚÉLYqµ®5©É0]~~-sƒŒÑ†×k­¹Ô ëpª£HÎ/ΘZ_E¯æ«¶:NQ²ÙŸôiùƒ‘t¯€P @v.Ý?lJó‹WmÛÂG#Fl:’5\^‡ÛYv¬ØƒgïCLHˆ-X„ÜúùáÚl ƒÝ>‰®ON×^ êXµ«¨‰yÃ,úç(õ½ µ!úB xº»œŒ#¾G ~êÑQmgp„™mÏ á,‘…H©pÎÍŒy15ï(x~ì+Ö.eÝbéSò·!Û@a¶) EpÛv":₧5“íx\ QbÐ[d9ËÒ9ìZÔÉÞd;³ƒ§,Û@á$í³ašÙ‡^‰:³ÇŸNf$!ÆåÕ± ØŠ¦ê3t´InA‡Žíô¦é‘cjg¡E’‡Wqº”MûB£®„:›RœvßDšóF#rü (½‹öh[nßîdw"p®¶q54ŠIÒMI¾Y%å·Î õÖ4>3L ‡DÚ´ãTô¥£†&¶tTK;OÚfH§¹ 5”¹Ö»D-‚kð±èˆKmØ ›C\XsÚó莱­ë4L±8r«1ÛÒéÄ™Óì8Æ®G$hã™ ã Yìš~tF$N¬Ó§š¹o ŠÜåi«¥çðíÄîúÄ”×ÜÅ¡:ƒ¾Á?x—¬pƒ‚Žv´1Ûx›A¢{úíØæmOÔ&Vu/À#ÖüN3š¾¥ûÞ½Û­Œ™ëΕ!TëË Zøï ôuåP§ ß-_£Ÿ¨£QXÞ»‚¼l‰ºÔ—ð] €„¹‘AÓ7ß¼óÀ¶MN ¼ND|ÖX"ˆöaÓ íö>äde¤mq`BŒŠb-Üô6\U_’íoj}æÁ™m&_ßÉ~(T(OádgI~fzzzyÍ™;·"#­yN.ÁŠj*232²òïµ §¼Ÿ?È}Ü0¢ åJšžUB—uä· Ì Ž Ý)™Å r™§¥4§¬rGZŠr²2² ÞöNÉåäÙæ¢èÆ’ª—­´–J2S† tñ{ªSî½•ð†‹³Ó3² ÛFd¢<ïYyAjjZÙÓf`®9%·µ›ÝÛ›™ž]X9#|ìÉW ú”¿ytLæë¾™üÜì®q¹•T ùiyzZú½‡Ð`4ñþUZZÖX?¸8ÚQœ›•™•ß1„la"l3ô²ÐeÛU¹¸ÒóöinF:ìã׈ÚYÒR–“•µ„ÌŠçÍ€TPš;fCÿ¦§fóæóÓ2dncFZþ´àMvî·3Pa›…®”Ì» Š•r‡*ïæ‚ÕW\ùlAæÈ›éÍÉ*˜¡Y{_W™ž™Sð¦Sfþž?–‘™7Á/…#¯.-Ã)(«ž‚÷ÕÂé¬ìœá9tô Oîz‘Ÿ“WÀ+¨MÕ”¦§gä—<œÈ·ä,Dn4N¨ç fsrË,ÆÜQYf§úš s3³óKº¦Å û|_TgdfW½x(Xnhzþ '+3;·°¶uXa/ñxWCAXxe=sŠ³' ùEUN&ømqcï¬â´¿¡¦ lÃ`uðÖ&GžÝËz¨2镶•Ü´=sÀð¯§â̹4T=5ÿÎ’¤“û^ôíƒ=µaPäI ¼˜ÿÝæa±ÓŽ³q^ŒI]ÚÛ´ÃÞµŽûã)©WWO•¾Ç*ö‡Ý*¡†9åfÉÖ·pܳs+•J·9þyöPÉÙfÙ2õgÏÃêºçï£Rl¤˜ÉˆKEÂsëùÁ¾ÞîîžÁ‘ ‰ôóTêøpïÈ+` 0`À€á"Ñ©·+]võJ2ÿòí‘êÎjíì~oÙÔ&›¸`Àð½`¢Øg•Å5UWî‡IºÛ0¡ÚmE ·O±id†¾åÅÌ—bųҒÙýîF6¾§‰iðiŠ«9›L¦»‡ ÊL勹ãW÷mbÒÈFö>U]\éwÜÏ‘ ‹#m hdÝû@²AT!Jñ6Jh~'Æ80|§Ít7¾]Î6†lê=%¶®ÚmÊ0Ùq½³°§¹Ê Gð¿ƒnɬŽ5&7¸»ÙúŸ‘Ðñè•lþªcp||üYN•cÙ=+D]ë$ç3ù}ƒCq:z÷Ç…ŸÊß” Â73 ÝÚ{ú¢÷¹3m7ñÄRùÙI(ÔÙW–ºìê³LŠÃçšMŒµ¿¸™y·† w­ÅÖÜ+‰èÕ£ãc"coe ÎNrP¶ÌõÅGGöÎHø½/½|Çh¯ïÏöÒ5<ì£}p,øÅ ¸ôò.k¶ÉÝE5<ðšÛϤ3Š›'J"ñ¦ë2꨹`ÅØ.žnu#‰·Ì®ÙÛû7R¼¼{çR2jÝëÝ“Ò¸¨ðèøÄ:ÈD0\W•œ‡dëh,&&¶k’?Òð(êv†¶´’qvOJƒMÉp•Ѥe:#}/þRÞtÛ£ÛôÝω¤˜tƒÃgàî›X"Ž}0,:ñVŒ¿‹ÙÖph&u×o­5ô0õ¾§í={ÎÅÒŽÅDÙfq¬ÞÉƲnH¤B\ ÑöD¯dE‰£ðÂNE¶yïÁpGï-5Ш´—ý¼ú´s,G‰L[Òÿüä9Õi–ë|愪{¹óÂ, ¼ÂÜüö]J†<¸èA7u¼|=9êì~—÷n.ÑÕ1}+;=0P—Jgš ó€ÖÂh+Ï`¡ê=K@gy4žã›DœqfÈE˜JÒÿ˜ÝV/ÄÄ ¾=ÛÜÝëb*Yö6ÛØÔ-Q`›L?‚ÁLjŒ0×ÿ„M§Àl£jý5ð×û˜Da?m8_Î6°½…±í4÷-!§˜’¨»’› æÉm–݈ŒUž…;P)–ýU5ËR˜—í Ì7qὦ¼Î‡Dºaëñ5T¬kt d³'­õ·Ð³…ûYÆ/×Û’ù}ëlY,º±]@í¸Psêf+…V;5 >ƒŠ¦+¥‹wñˆI½;-"dlà ¦èî2ƒô CËô6KJŽñ—©l*#¾nUq¹G‰mÀÛJœ- cr«šjcŽû9®‡$AÜfÛjÝé —wl´¶Ý|ˆN±\Ùàzá%sŸ$±m•×ilýˆØë0nÄ^;LÕ5læïÊ.0¶@[ú…M&:ŒJµ¦‡¥â®ÖÖúg÷wo°u 8"’ª™2eºë¹ÜnÃÚ  ß^oö.ÞDgNRìÁ`oí5zÛ®)°Íœ·îT-ªÄ./g„XÞæ_"ÓÍ2ž«RͲ™”謥†o¦üô¢›~¦Ùª-zX”Wü´c¼1ŽÊœ>À6Öæ…Û4—GÓ9¦1q2Ä_»1À§iM4ãí(¿»à2Õ.@EBRµX,í³Ç“âZ–ÇUD±¼øk*0|{¶á-Ìð…²~8]Jù’ùL$gi¨©–Gf?Ò=“­ú Õ™ˆ‘ºd Ûüù _­rC™m¦üðZÇ^ñe¤Ä;lD÷I¯¤¼ÁAùªwñAŽññçj&>Šl³µa›ÑW¹dŽñOngM$#çä„öôC÷ûã÷Yø+‹ƒ²±Éî—æ¤wøÙ´ ‹B²ÍzL¶Á€á³Ð丫¥jøEøî–®¶}—‚ÞæÍoÕ}V·–œ¶§Ó¶„‹#iÉw†ç%Àl›È*ï_P¥1õlÜ=eÆ4Ù= «‰g»ªtzYë$À}k¤M¾XGî©ŠÅÑÍ[!s½Iù‚ekRKlÙ˜r#’ý®#ì$-9aƒs¿½~FYæFc£+mðQîäì{ðšp5ØÐÔnÛœ’ÉG L‹(Rñ£Ì„Ê6yvf)Äs˜Þ†ÏÉ|ßÕý^4‘J!8ø•7AíÇóÝ˹ý*œ½qx#‡cèÛ$”½bãµ²_Af%æŸè®þÓ£qÏý«5µu°vµa§½FZ૶¶¶–6äaíWŒF ÌæGäPÈ ‰cé‘û¬QÆ[î{˜Rôôt ìªÚÆ"鼩ɱ™Y¶&•ÂalÌ–» &ÛÏlu"“I2ÕçHìµ!"M›P4É~äÖ'ÿ’n͇פċãw¶‘t´uµ´LÖ=x‡ì/âçgUU Ô©Fï±5) >—âf™ÛÒRõ}<ÜãSç¤ölH猃õ¢h…˪d–Å—Ç¢â.SÎ(-¥©=¹ºµ‡|‚®WßÚ¡ï†í·Á€áÇÅÖR¿%ß³åÄÇöN |4_g­Çz8‡Õ ?~¹ë#‚Òw#ëÉÄ"ñ6Gê™üŽï90`øÛ›a~ÿT‡ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ÅÿvœÊ‡ endstream endobj 718 0 obj << /Length 1952 /Filter /FlateDecode >> stream xÚµYÝoÛ6Ï_¡·ÉÀ¢J”¨t°­[ç¶ÆÁÚ=Ðc ÕG&ÉM½¿~w¼£-ÙB4ü@êîxäñÇ#í;Çw^_ü¸ºxñK;™—Å"vV·N˜ÄžŒ¤“D©e¡³*œ÷îõ®+s5¨Å¥HR÷¦×õ^ïÊB/.ßý–ït¥U¯é#ô„,þ^½¹øyuñÏE}'pÊ#/ñ'¯/Þÿí;Ðß8¾f©so¤j'ŠSh+çúâÏ Ÿ½õ½œô=‡(NŒ3⻹¸Ðjà{~˜PHËÂxfUƒt6’öK2IÂ-"ß-‡íâô»ÃVcG¸eA„ ˜½¤»¿ÇnÛ0aš¹ûvG¢¹jH¶VC¾%ZË$EM§óòƒï‹œØË?ˆ¾|Eí§…®ªvÚ[\ÆQ䮬VÖ¢ŒÝE+këNåäåÀÆ@”8ëýÄ‹mÛ3C5fŠp.‚ÀË$ÏEÙä®a8Ø"pwýNUÕ?|÷ÞL’ÛFŸ’Èì½A™a«â”=QÖºl6DW 9ô} i87(†¡‡¡3š(¦(jn;µ©MÌÈ<Îdu‰ë€2Í®^CfKézsÿLîgÓÉYèn± §Œƽ Wæ[Ë(ˆs¿Õ ‘L!iª Dçm­Y£õ[›ŒòCH€Š†Y ¶·D¶e?ç¥/ú'LSme5±zU3iùj{Ì»–Âj—k]í±4{_ZmÀêt®KLV²ÕÑPã G±‰ÀøØ´8辧Ïûmiæ[ŠI¨0p­«Ö$jkO´r(r?fxòÁ—¾YI{Û¢Õl¯iÒ0(Þφœ«N˜É 6l6=„ÂwÙP˹ ½œeo1ÒÛ^3‡&ÕÇô5©æ—vP¥ºÃž&}ƒVß”w˜1‚~'^ òû\›¶«­sVEY\10âñÕüS' §^„N šÈðA Oëyó‰Ž4ŽÌ/…D{@H /©üoÔßÎ)#3™çÁØ Ò£$ô²$µŠ;íÜÎj>œ='­9abá¤pfÄŸ0±xi0PWߤ|ÿÒLéœò'YF¡¤éÌÐÙB¡ŠX&OY¨I¤“Ó"•IæIa‘ñ³ªï*}šHÓ} ¨év•¾:" =I®†Px ê( ½4‹ÐÕËZΫ½yÞÙùÂóEDþ¾Ömy÷„㟎Ø”3ðRøÙÜ™O2ºQëÊlVBÈÀlBÃ5x .dŽ ÖJßîº\#Œ©[€*À¤²±•±5¤ÑtÂŒ¤c Áº(:Ý÷Ö5³N@nôÀ|œÅ·N°2‡%CÙ’ ´½ÖS¼ÀÚ]3t{NF‚ðž±nµHÁ¾å°uu¢³h-È•=;2ªK =#a è}÷‡?–Ó¼|«>×%VcP Ç í›A}ž4‹ÿp Ch}ù,piàESn}{™x8ŽÌŒÁ‘p EæÅ)Ï4Oæe U]ßabaïÝÍËòøƒÙ¹ðº¶,ýÓïVôÃù(î,ß=Åê͵Uôƒ¥ü6ŸžWÍþÔ<[ýòSáé©q–¡¨B$ÙW;‡½ âÖuË»Ô\‚¨jNð✵³5Ò±–i«Š*CºŒ ¡•jX*ie ¢æ ‡ŠêRFűe¿]ÅV•c•GC×OÙûP{YïÊ»oúI%<Úç°7Ùsg5ÛíÿŸwä—7çžäìYyæÐø”?Ø×ý£=˜µH|u2ÎÖ_lã÷äü?߆ "¢/¸§œT6 Nùö‘ù2·­N!ªð-v\y>ÞÌIQ‹5*Æ>5°.Oô?öaKÄ1C.Üèñúh4òüó–H,ˆ‚Á7Œ„ü€[·¡aΞiÅ °µ)𨒄T¦º£÷¦XûÒ¥8辌ªÙ«Ž©Æ…v«UaŸp.C™pEœCH35î|-J·ßòÁFT˜í®R¹f¾¹<üÂÚhÙ”MCgLùˆ²$Š÷óš%qÍì,ß¼€¾Å>ÐÖmQÞîO,N&Êé|«š²¯Yÿ+¨ŽÁ‹™€»v7ðû;(bÞ÷jCïg¨¿­‰Î/yÒ]6ƒîz³q¸–´ÅÎTéðiœvIpôï!!—þ¦ ÚÍó]g)æ*"Lc~߃ù-7}Ô°í-{X«Ïe­*¢Žt̼hõå¿8(¢BhÆ÷ C G¡s×µ9̙ՄžÂ¢Ã»ŽìÍm- ­®‰ûcUk¶‰ošÔ+™s|ã \¶´¢Ç¶( ¸v5}˜õŠøzÎÚ14;>WU¥g_sßfLâ= ²¨SM_Û{ÚMc{xV½]Ý«Àœ¾íË`ëÑOûó—uá#'€¾w áþJ{Ûüµð½bÒŽæF,°È7!F¦è`Ãhá©¿ÿJ]i endstream endobj 715 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 182 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 47835 /Filter /FlateDecode >> stream xÚì½wXT]·'øÝynOÿÑóLêž~¦»gî¾÷~PP9QäœsI‚ Äˆ¨ ¢U@ ¢˜ArÎQ‘œsNÏœSáÔ©¢@^ß÷ûîgßZ¡êÔÙ{í³÷Ú¿½ÖÚ{­R’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJ‡!H‚OÿªíØ2ÎašÏ9të9T³õÂß}µï$øÇà ÞϜµîàš9[â%Ú2ø*ñI䊤rñîà؇èCñïg)ñ)Ä –Þ{È^Ümt xÂæˆwm¤wèÒï€æR½µ.UM[—H ªâ Ì]vÀË#2òh"‰Œ Ucrƒ¬wÊÉ^.Y†‡¶*ÑGóÝ€`{uÞX,ƒ%’)àG’–é9¸ãe­„ÇSµ‘ð¸ × `ñŽ¦2EKK" 5”"J]Çæó4WÄÙ­jòŠêN‘³ Ãê¸Oéò!^ŸRSTR¼[Ô‹¶^µ’1{¨N¨ÉŠBcq¾Sðææ” V±gü8m*+Þd"¥ ¸}Z ~X,Ž@æ=›šû:û¯´D4¹¿½¼âMĵuµpT-e‚jÐÓîoëNJè‹U“ÈÛóÎZª†¦ê÷w1#cQòh<ê„IMÇÿVÌ9JQñN9­{rÜpx\jëø¹ëC<#‹’q\ý¾M¥×ÑQÚ^qÈk‰ÆG‚jvÀÅæ\ÑâL‘;(D"Ç“ø¡Yµ) ’Á»pÁ•t1³W"&ï]›&kÒ´m’7óþÖDÙlﳚqö_§à‰•hŒöËî…ÐÑÜüe¤l—Ò cÇ”žÌJô±ª‡ŠƒI&ôe¹3ÖlYy„^Jøó±P×Obñ‘5SÈ›óm4ÂÒ þf¬¹h`íƒïM€]Á“ºžrsu%¸BÞ×[îf:ú¦>‰pS`É‹‚³V!¥·Aíéþ˜@Óq>¼ ÐëUðævºøè3pßÝ3—9_»s°Øðh½¯˜ ªµsèÎßGuѦöj}¿Ív¼uÐ¥H$Ž‘ò‘÷´¾ug˜i€ ¸ÌÛ¾mã Ãħ×ìyw‡:‘}C ’IšŠÖø6¿N6cÙDƒH$’©dêƒAèJÓë$]*ƒÁ¹G|ç Ì/E³‹Åa^öúºZ5³¢ÖIÑ‘ß>GÆÆ7ÌÀ¼½éð;kc{}D›”Ñ}‘óUˆ>éäCØ:­{Ò!Z';Û¬»N ml£3÷C§›yHq™©ÈTÖ´Úå¢ IÖ¢½ç–¬=Gçð: ‰6 ×ÄáÕ‚8À¨ñ åws°¸ý&´‰4v½›}ZO7ì%ïùÄÐ&ñ々䯾ú¥‚ýäsæ5 "ŽD"Õ-_µNó•T=¯O™±çL uÉÊ޷̱ÿÿiñ3zöOÛWï]ê+·7Ó&šxU¶­Ò9{öFEQk˜ ôJrJ‡p`yƒÎ›  ÍÔçÞd–!´ªÀÿ—ªîÉ( rxhcw¼gYðˆ+í$»ršmTtw¯àÑë rö- 9XUÓU.h³ŸØðh¾ó-¦µ¼¿ÙŽ7ð¤‹äM:ðo_òÁºöW¥8Xª0vÁ¶ À]{ö\°3Në¨Õã_U·ÙÑ%¨¥õó`bÔTN9q€‰Ôm#Ï(•fîDgL}Õøæi&°X­€Â›…¼áÕQŸuF×掸n3Ÿ«$g·ÌcÒŸŒCéã2iN²EiD‚65L—¨aÆ›œÓãeUœ6D›6Vè‡WÂ¥¼kcîÇÖª€ž}m¤ŽDÖYØý5-)ÈV_‰v±@QÍ/]¹u;ÁM]É){6ôó꾓’¼œUr°Rs£;Á:$ÚìžW§œ}#®{§^Pw¼ OüwÌñË]IB»ì`ä9ö½å¬¶²Ad h CeLK^SÁkýTþã (Šó´ø°HÖmì¯=“X¨Û˜Ÿ‹ki¬©4ÙCNÙv`Wð›m@È9ÖÙµ¤ÞÞv¢i'r)91šŠÂ\mÞýí–m@ºè@9s»‚³%bIÝ>ÀûuÚk .z$mkïq7oÆ]¥áP•£´¡{c¢Í"4¹Ü0Éý€í¤‡Ëk[Um¶R#‚ÃA ýÜ=…t/4¾zèjcˆÖtÝ`ìõü –&ÛÜin.I£¢” º6xºÍå‘…ûÕ9[ž%õÜVIõâ^î’3êø…º>Ú¤”[#4¥o…>÷ç P€‘hCÓq:„çRm@ú’á†3Œ¢‹ùm$‰ \Û¾hÛtÎæÈIçœÍG›£Xx›!!HÃ;¶ü0œá¬è ~hIµÓªÿuÄ£5O°êF°¿<ÉPVm˜ Æ×—ßÄ‹-VŸÀèMŠ MÂþhümL¶ÏêÚÔ ö!ïr;cuB.ñ»°4kw£¥¾– Õ¬½Ù®Öœ­¬ìÁföóÛð´ñË8÷‡mýâ§g”.êüI¿ ¯¢oR© &>Úð~:cDˆ(è|î(/@›q[eTЭûwø”è¨jz™ÉùI´ÿl÷½Â(ë´-.¨¯ßìÝt;ªføKس é6B´ÉÜ‹6ýï“TŒ½9ëu¢×²¸µý"!BÕ»·kû 5ƒµ2ZzK ƒ¶÷½ø¶®_lR¯}máj}ù~›kR«öÛŒ ÄámX"~›Ýî§'õzY€m 8ˆæòbäæ)¯@,Þ ü=~.Úp2Nján~H±’ýý~›ÑêL¬º1<é döAuÚ@+, ]¿²áI ÖoüÂ[Rý¥(:v<‘Ýúö– „¶Ïœ@úm&²NÊë^ô #/3{z±mt¬âÄ=ï39J'¬x*òHº“¼ÎežáµÒŸ/wœ:ÎRÃu´Ì½yu°^È+ê!AµØ‹S&”|WºE³³à•¡¢@%“˜Ñ&mBòãT§SMO±y³Þ®¥„½ß¾†h•d´±»úô‡^b°>zgš¢œzù·:„nòbõ¤+¬¯zQxh3œ!§w¹#¼3Ú€!© ]ÇE›‚…lóíÕm ¿n‚ Ù0”FÄÀh“4xÀ.ÒhÃŒ1Vsˬlû1¨ŠQÖþh>ü€6V='Jß+ïËÁ5UûTž¨é–4Ï”¼ã3ší"§µ ê„%÷œ3§ö–·)¡hà{Rôe ‚×ÍW›t¾Øm­L2#»De ö¤øhCŸ-&ééSL‡¸zµ˜nÃ:¼rƒÐmÀ§`´%)œ.ºa´ÙGl8?D›¾Ï©ºöLþ¤{CPR¶2±?Ú@Þô1<ãD6ñ”´Kü«XRg±›„%˜ø„G:«{ܬK±¢P,Ò»×/¹‘/fðl–¯…IÛìbä%ku³(r8ÍY.l1áZצF'–¶‘]°<3µ·¶‰ÉE°ŠÅéÉé¥5äLaí¬ ŒmƒF#ggth‚üi{uxddv”.ÖÔèÐò[l¾í.M O€V}\¬ýûšU[k SKÈãÇ[óc`wíBðÉœ”Ô«ÛÂFmÌNŒÍ¯ï·˜/ÏM LÍA®Í­¥™ááÑ ( Ó£S«|†lúÈèØ‹?_Æêb z×è‡8¼wàQ[žDŸŸ™)Ϻf›Ð493ÏäŸ$fO‹ €@É›_ª¬Ý…Yîx/,o y-ÍLίlñ6"–§Æ—7y^2öÜØèÊÔ'»K{»kdxšµoK·G‡'™È!ÞZ‡xn‹}ع³6’%ùÜ4Ò‰L:ÀX™‚Û³476³¸Åç½[—3ù…Úü+ˆ6ŽWqãÒå°„ÿûóãÍÝnècŽ4ì“?ÒgؘõÝÜßÄÓýö¡ù+7/õœ©}dŽ4~š‘¬#êÑáy6þG õo®În{È5òåßH“#<ñeßè§$þ®˜£?tÕ‹=ã¾·÷½NÏo³þ:¹3I$¯ivv„p¤šÍïíóýÇù5t›¿µþ/ðp¿†nó7" R’’”¤ô+ü_>Åêü)œÔp ª$º(B‚zÿÓ‹Ë! r8‘sö¿ùàÖ’c\˾<ö8{9ÂÔd]{‹ºÇö‹?(ŠœsÅó¥òçd^,?†X"‘}¼7 ‘È\ñël`¢àlÃ\úeUÆÐ[,Å´cá/d¨Òƒ‰Š%ËnÕræi2^F^NA'ŽþóÍÚÝ–[Z¼¯rrò ‚ŸþüÏ䆈,mNwFùÙc1X‰¨¨¨lw:²kE8ÄmïÒÜ̵Ž=vìèq²ŽåÌ$zÀ·Çîÿü/ÿ˜Úƒ°Iÿþ/(÷M–ðÎú³8»5bOòùñyYÑ–Ë¡H“;œëŽr`S¤sEÜåÒý!VNAž÷«œ¬¬Šý£÷_yÁœÕOeñj›L~dsmøÎå³*˜2²²ÇŽÊÚûd—÷K®åoŸå•&6 -’†Ü¨‚úQò2ò­+^±8â‰_*sâtÈh4-׌L-åþ¶n+{BNQ ,¨¨ §€¥º×2ÁJÙÏW’“=“&â^óÀþ—¤¯ü>®/ô±ÓWÆàÈD¼¼2Å÷Òƒ†È\+¼@á1¢ÛŽÑeqĘ}s^¯pôØñc2J¶Þ+¿ó6Ñf ÿùˆ~=§£PØu@«ÆÞÜÅ™{í³^턪·‰„A°žÕW&zmr÷i›³Ã•ðZ÷Þuð~oÌ7VÅYߪ@< û¤ùê9¢Mâ§Ì°&:”Ð×ý0³¦u“dq'vEæ%-^AQŠtѽ‘Ûs€^ñ¥äŽŠ–#üµ£à ‰ˆ\†`t²þNÃB°ÄÖw;¬Œ…[Ô„`b•eF‘ÑŠ/:%ì’¯|¯ R¨S\´i.¼¡fä ÿ´=\¦I$\=»²YwMVQ¿~ž7›Ëu0Ç×®À†žp¹qQ0V‹B•dpŃй¥­É׊Q‘Z1+æ3êG÷ñ>NP1¯à˜”¢mp†ÄNèL‹}¥K@1Æ›ÝÎüoÿð÷üIi?müoœ&JCp:×y§ªõ4ÛßÜ  °š¶Á3, &íLÐ0÷à/œ÷.iP Åóâƒ5~ìõîë¸ÓDÁÀ9|fªF¥ÇÝל7Wþóƒ°;ÿ$-·{†õ%KÅ)„‡6~ÏÚûîËÇ›ºï£(u©'”¬ û˜Å ïðZÁèÒ:.w±b)1»³)…ut›Š‰ †óì Cü{aª¯)c9•–™:Û:Ï/ºÚhZÙ«¹ŸµW¹U8p€xsÑÆ~‡ÅæÒ‘Dnåú Ñ nz«YŸFZ*àŸ™/_’’ψ£¡q”¬>\å r4qcò{ËÀÜ9§íÈ× ôAÚ\ªG¶<ÍךèÏC)(몖O Ü(!ÚÌæcetÙB£lwm¹ïµá–/Ñý òJSnEÛd›« V>vêø¶‰UÚÄ÷lÃSŠµ=§IÅ–|]AÖ¢ÉY‘lWϽÐêUà‡ÌÍüV_C¢úE(U×ödû;}<¨az²j ­<´ë=ï ‹Á‘YÓüý·Ù­íìhwchX;âl(Þ÷–×VW–+n[+ØAH•©^*ê®óK«‹ƒg,(X ®LlfÞŽigpŽ™l®,1™ ÍÑÆ¿ ã=ê ´€[%u#Û’ŽI1Kþ]Ì1ªë¶DóY0y =i†w ìoc Nç f甉,©ex ¯øì7¢ Džæ¸‡o¿>OŽ¾q«âÛÚÞuIL·iÌ Ä\yy¡hi*çu»K¢WóCÝFmjƒ)Ê®¯÷[(GÊî(˨µ@ã$‚6ü‡ÓäëôñÐ{ŠlœR‘‰x¿È«¡Û¬[¨aL=B{¦¶~è8Ù‹6œP†Á¤Møã´Ù™×¤`ÊúÖF›lW”æùðCˆ»ºŠÞ鎙¥¥u:°Y­!ºW5¶²²²0\ª‰QzѾ¡ DÖ ˜[^Y½ ­ ÁK+1á„GŸyÖ¶¼²²<^c¬¤ØÆàH’SQ´XLî)E6‹¡ûóã¸ç-Ëâ½Ðè¡·Íßã¡Ïÿៀ̧À‘¿þîO|´o„®ÿQâ‹›Å÷ðˆ¢Íhyî휲_l6zqZ×_ùlΰ¦ß䦾ó®«»s¸ þø«[xîš[ì§AóM°dïÐÁ‚Œ‹jÇü?®ó¤eøÝ]yŠå Btö(¦ Úh`ÐJ ú‚ïÎátH1Øš{–©Ž>.‹Â[8z^¿ó”'‚/ -÷“wèdñú8H¬ƒšºÔý£¢¿Æàøå£ ¸ZÛPP÷!³a?´–ã»JJÎ`l[M^Ó*õùËÜÌ»”‚wrÅÝæ.DÀpIQNV£ú¼m‰×RÚl"ø¸Âo?cì^LL<—bî½aüKj¢­H ‹K锥þyŒÌ1yZFoÕG®ÙH=ŠÂC°¿Æ*¢hÖHKŠ«Á¬Ot%\ôÁÈþ Š êäp/«”µV¿m˜Õy<›ÚG.¹–áÎYϹâ¨@<¹ rИkIÝ:EJÉog  õP?}£€‡ uWìq§îÁ«Ï /SϘ\`kO g~]â‰Ë|Ç="Ö|‘ ÝB›­øÊtC§‰O$†6ø%¡  ÿèsêWîLšþ½m6çŒt ¿CrLj¡Í/eI1&ê•HÚó»<Ÿˆ6Vªî…¼²ùeœ¶ùyžv9ýæ6Î’«á3‡.¸™ËË+:ø„濯ÞæÆh[PLƒ¡ö­ Þlå W¤Û¼êþiÝîصé×OïyZk)ÑÚpA†ýЕbzµ\T·V8Ùßö$ñŠ‰*ÎÄÿ‘DÀß«ÛÜ4’±¾Õ+Am€þ›·QTÆ(óž…Æ‘¬=Îu¯qÄêÍŠòÆ°(Þc+¡µŒmï¶ñî uS¹”ÆŸ°‰®æ¶ñ°@¼ ;©’쌀–T×K ^\/#ˆcÛ@Ƀp¼Šª—Ì-,ô5id—ߊ6û’mvÿõßCŸ[¹ =‹.´¤¦=ºÍ/Dô±Ze’ömÜ`´‰Õ¢Mm Sãû'–zjØ“ š`'¯ð`X ñ~+”!˜ÿm~ÚoÃf1@Ëž1§Ë(H©[FóädT>/#v“!Ívgdf‘¿µ­© cljbb ‘‰‰‰¡6šï°‚ѺïŽ#Æ&¶¾é‚æ¡,)Äû“aÒu,wr_¿ z®ëÈY?³¤’Cõ-½îˆa/}àŠ¡Ípà cSˆ´ ‚W$è6o€oo¬­oïÂóùùyW“‹ 2lîõÛôÜó”Õ eB´|2‹_Uˆø–Åc\´á°»[t¦È¾@Ïã£ÊÓ‡³¤Þ&Xh³8ȱ–‡ú¡€8H·¹ûý;ø nc˜ ñžP7jDz'ïsª§…YÌ xõÉv1»ÏC›fÈu]\ýDÆ«LìÕ).ç3w~Ú€ðÂE›šMnR¾]àÿøûx‰}´–;P8õÁ ¾ÌümØíå…ãKt¾ï~£¬  Ϊýã'3'ycY›©¤òCKêçÑfìõME5‡eLÀa›ë"(³ß“¤iäÃDŒÕë”Ê9PóØì)R Î"æ;cmX•„k×3„n9–‡ËÚ— ë·a}3ÄcJ©»XÝ ò2†ßòCjLš5çûV mÖ[Ÿ@Qvn#·õÚ8Ë‘‚6£ßf/½ °¢ú=„!劇±Ûõ¤nÃg¸ÕeDUº‘Û І÷hý)öÊfq~¦J<´©¹ ¯h˼õ¼4÷!æõäöáÐfë{©"†|µlFÈzwL_—ø᫘ßf?Úë· ‰6cÞÇõ#`‘pT»ð Ø„ü6q|h-9G ûmBiÆÒe©¶› šîÞ”l¥ü>K ¬ÿ#ô9”ëÉŸËÝ×æ¢ÍÎ PTT ìÝŒàøÏ Ú(/-“à Ü8£±©›‡CNåu+‚¶yLRjfÊ= uã¨wÐTz{…׎{ôìA´·ŸßI‘§Û,y©ewìHÒm4´½.…‡!(äñˆ£ Ô¥»)¦Ê4CÏ€°Ø¸˜à³^º´Sì&wgƒµ1~ÞKÐ0öð>{.àŒ±º‚êÉ!®7öåM;ûëÈsj`K" i®éuàó!Ðú¹ñ‘+‘D2Ôp݆+öçM±ªFÁQ7.‡x«*Ë]ݳ¿¢ IE#2ú H—#.œt0WP$¶pÕxÚp“m?•EY:º_ôó²0P“¡Ø5 -¿m ·PŸ)IÁØÉçÚëÞ'­åäµfÀžÙpÇŒ¼C®]¹ué”›EéD`ògžïaIñfÐŽ½Ž NYoI1ç½´ð4ë³.ÇÆ\=íå‚WPˆ×'qYÞƒ6ÐÃÕéŠòŠ&¶.þAç|=\Ô°òçW0÷x‰Ú@êïY#’™WH΋ì‹^¶ š^ÐNúú0žHö37 ¿•šyÿºÀOÈJõ×U5wMNv÷r MÊùº!šÆž~ózô•«ÞNæ4p@#£îˆ9”ÀJÔýÅ\1´Ùîà"Ì¿þüÏÀŸþwà-©ÿ&ôÿC¤xÙîàÿü¿ÿú_ÿ ,õ÷ÀûoÀ?È;ìÖ{Á†~í¦ýž¹ŠÿøÊdG^fß”žì­}š[Âëçõþú”¼÷¼{ú›>g¤<|ô8õ]e; ªßëÞ¦HlR猔ǩiYß÷®5sƒ©ii)|JÍ-*™¥AOÊ“:q|wcüÓ«ç©))éOr*[úöÛéÙYIMO_çB˜ì­ÉÌ)b¸¾AuoÏ(È[•ÿvÊœé†E)`ÿó[öôÅ«ž±5¸%Œµ¾”Çoé|Xëxû0ùAë‚ð–öªOÒƒes Þ -Ò÷³&êߧUIXŽ×Ç?B›™]Ð5º*¸¾™÷àQÝã`Ñíªxûüc­ÄŸ>¥—·Ï±×Ë^?øðQÎëÏyÑ;½±'•>£ J°×Ò¸cúðAæ’8Úp>Ý<ã¸×>Q„…/j¹in ÛˆŽn$`—ß¼„ÄrbˆŒîTŠ—jÂ# Ÿà?—c{ª¡ÐâÔ¯±%òÝÓÀ¡Û 4û?©Œ 6¼HÌà»í/ŒÅ¹R’Ò¿mªÍ Íû«pš~ë•ý õÌÔ˳h礟{•"” ø{HÒµ÷>ënŽÅ ¯ÏKßC*¥ËÄápþJÞ”_-—ÏYœ›Þbü||c{mnvvfvnecæ‘’”¤$%)IIJCêßüzËÁ¯Gòúq.…?´a‡kî~Ü$%[àü7þµT^äÃ#wu÷y(ñgãü(Àq?;@R쯄ö;»¸ïGâ·ÈNbm‡f÷Û îófp‰)C$û9vû¶ÿ/D•·50ÎE’9,uþYFùû*ýÁ´¥þ2w#š"JIÅȹ¢ –aM–¢þûŸÏÔ´%±3ò^§,¯0ÇNÈÿLê€ÃC ‡µUo¬A†2 `ÈÞ‘§7˜Ÿky¼M¯äV.¼ÈÚz•BRRPBáübž¯18A§t`aimû'Àt~zV,áÈ÷ª‡Ê:À±Åü¿Z@™«©WËs}²ª³ ©XEE´çå´_^7&ZÏZk+*)kYŸéž–ðê#æÆtB€ZY‰¨aYØ2 úöÜ× ÎÐ)hS†a Ûýì¥ä°“Xe%<ÍèYÕ   «¡à¶:N ¥DM~¿ÍÞ øœÉ¶×VDEeû „¹m¾org¾/ÜÕ¥¬L3v¯\’Ànwùñ%w¬2 §bY1 ˜ú¬¦ÂD œ2J þþ[‰ì¦ÚßXk’@v¶ñ³Ü|é¼ãU=%iºDŒ" 㛳ΔPp¡·ÔY_,hê5¾Æ—|ÆêØÓ– Ð‘uì>vÏH;Öæó8‚2 CÔLz×%8*ÉþZš¡GÂ(*b|ndIb,ö—»¨( ”M<"FWép3†ësMhxE´ëÅä%ú_ve¬y`¬zêÃ>ÈÎÚÜÜbÿ!`·üIUQþQÕ8›Íš®¿GA+A¯…Eä#Šv$ÓpئІ•ê i‘øºŸÌ;»ý—ë–Bo2Z?dz“Éb2™ôõ{î4%òé=/qê%“µ=u4üŸVÁÏçbªêµÁ»«~:ª:Q¯ÿ‚úTG;\L«ýí`³fA0ËH>Ñ’«¢yUOm¹PòæÒF"†«3 4Íï«ÐûKž„;è;‡qKŒ™ãdã> ±Y¬ÙÚ¼‚j÷¦X¶°Í jŠ–1e {wì3M÷”¿k3çD9ŸóìÞÕö‚,¹fE¬àÎ5=¬Á¥×t6‡>Û¬%»ßŽªL Æ»/±8,Öîk]—˜çâ‚6XL!'ÖÁ*J’|TõNÒ!˜w%È>ës­3 KªXc·c€× {IçpómÚ ¸Ä/tÕ> ú,29,6ã’½¾ãñ÷I­Ž–Q‰øÚQ(Ä¢<Ù—¦íÄ;ÏÙSt¯i2±Ídì»~f~qbŠ cµMzݽNùμP2Ùt’ýµ³T9§Ä:“µýýY÷rF¬Ìvꪾw¹GUM±„+ÕО{ï‡ûxuƒ±M(ðA€•‰÷51v¬NM¼bAÇÈîËËpÑxŽ«DL¶å©´/ Ûà½ù×\µ­üÿXõ† ØK7Ã|Ý3*GZ І5—êìììq&¬r˜»H­ :»ùLn‚Ò7{ÎÖÆ…O®înNI¯GyÓ\”êãæìæPÔ:ËëŽÉ¦"W¿ºh‹gJ’Ïs_:ɃS[rò‡>vkŽxša)#@fâ)ËøÒ%d5‘6ª cKëS79Ìq>Ú€+ûúøíˆ@Wßó×úæé¼×zJN¹ºy_øº Äœ÷zÝ c¦)*𔳳ӹè{c»ü—Ò„»Zåw‹žHdÍ™*žqó½ð“#pÖZ[;6ö`ayòÃ:'ÆR÷ìSø` #ñrPÍwÞ›GfË%œ/7¤Š]áæó¸u？i}àéêâTÒ'<·ó9뎧«“›—n5?çË«ÄSqES͹ .NŽ§ÏÝâÏür×SW¦cdáÎ=?¶Úæçèèrév[ pµO΄>é~›|ÒÙáÔÙ¨ž€ÍZ?ãfE&Ðl힎€M› tµ­fÎubh¡àtqQ—}=#‚6)®JŽ÷9¾ÖZˆ ê_èÀP²“²ó=X°¬Ôoä´ o½-OQÕÒ/ä¦cŸÍ¦ž)ZDÂc|ôn• nÕ`(šs»¼BÀ——gÉú1๘÷³üNšÌCÉ[ˆpyçO0¸Ö̯ygDM©ß™ÍU0 ƒÙÝ:cè{Cä ÕÎX#–¬6µÅâ±ûö&¤{ ül$ýf†Ïnú%JÞLìôÞ§ ’nt£€Ý¸†\9 ©Üq6 ¾OFø—Ê1r:bGÍ#5hç?ñ‡›¹jJ!öÌ­U%+h¹ ^ÚÄÚYø<Q×Çi$\Û?éÏr}´2å<ø嶽¢WÚ¿ËÕ8yío¢ûÍ-ÑZÔ wÝ{ÃB…”Ûõ\¶Ú2¡‡_p£‡¢Hkßäü‘‹!kÁGSÉåJzcsSvü#K mÀ‚MpןÖ54”¼Ê$ËÉt­Ë=h‚ê¤ãítÔÕÔq©ñU FŽœÿìRV~˜-Í.¨¸¦±úÓ SŒÂZH@§Û>xG1öqhð´o#ùÂN~Â`­H¶âLÃhó(Ðå^Õ2ò±W;"ŒÔìⲿöCÁ¼<´a˜¢ŽÜËW”z…1àÙ‹¥Ty嘬 ÕŸüM ÕTqåSŒÉ&" ŸR𩱡îùÀx+®%¶íãò¦W4¢`ܷ¨»^lœ?ЊçýǾ!DŽØ ö¾(çdÞ…ògÎ=óí.ŠÃó?”~~óL§ü¨œÚôd=-÷KeuM5%ù–x…‹o ¬)é‘zª&§ ª‡‡Ú«Ø]‚ºr¬ï”¥¦ÿõ'½ßFY«j(Åkoš›ëEyâŒÎ®r»³8É”jìŸUò}h0'Ƈ¨ç AE¼²‚qYOß4ˆìù Þnµc ‹±±)ÓÛ›¼¸ m s·lå¯vÓï9껥”¸™hk~=‰¤-¹±êV~€ äd°2ƒ¢k.ÀYÖ‚÷NBJHì=ÿ8ì6X“AÕ²Ûañ Î÷½'Qt¶Ø#z'”>-Ãæ‚ êijI¤Â¹î‹SŠí׎ÝËèàêÅ‚ .–‘i0»²ÛA:¾×ìFŸQÔ­¶ì–‹É$Í ö˜Á ¥÷Kpý‹ö(ÙŒq$»3¥ëpˆ ýª&°bzë´¼BÖ4|çºæÄm‘¸„05|X ]Ì;¦T¯—½uÂt="àîêz™@³ôB¶s}â3§=EçßÀXëPAF™K6ò O„°»îƒ=q³)«»—4!eðø±’,hî/ÚÀY妤˜(|ûêvE1¢õtP,u¾ÅÐôÖî˜(pÑfÅ +ŸÝÇŸt+sóÛ LÑF€¶ìUg!ª « QH¸î]ÜqE:·y ß·sž¦§é‘Âu{ç¼:­ ]Ñf÷4+ÙFÃ3‹Y[R»+_¾rg<ÔŒ@Õ?Ç4@°_j€?›Ão³W‡ˆÊ(ŸžiÊÅk˜/ð%‘375guÄóß‚Ü惼¨X…J¤Óa±e]›¬ýœÇH´šÑzŽZÜ¿´…` Õ— +Zä]mÈ{x7¿’¹ð…H"ö-2x[jˆÂb\@hθ¬oîžÀ¯àûÓ#8ž—$ÌQçrdI•háÕ‚Š7Ȥ׽Z–Ü3Ó2 ç»&‹e°FÐÕÙJrÖs¢ Úóx0Ú éÅ}X:9nêÊú|Z7Õ{.|iíeGÕàGÈòeiaúvB·)¯i¸ÍnyXú$Â×;“Ï‘EßÚý1^Uç4ìEX®&Q¨«k䣴v¡†¹sš|$¾¹ŠÏšÉaŸOÂw°Ó-”ìs'øÙxÆ 3w§^ ¹„!Ùõ•ÝQÑ8¿årc¼L"-­6SŽP[„ìvÏPŽÄ´"}]s–ò¸ì1x©b?±BÛfƒÙ«~„P!œµÌHõcÁUHÃÍKHî„ YváIªqrë»?‹Ó·à›F?=Ä9 e©?‹ˆµY´“¹=¤Sì]è×8B(Î=ÖÍcåHÐØ8‰'&µÂ±³ì"UÃÄjèmãDZ¯…Úd(çöfáD›¾Ò‡TИå=EÅ-}ž%õ:ö4‘€S³ðÌúز±Ëõˆ"Іé®DÍÐ7<±\ûD!}‚ÏAäï†W¢ lè+àl&z©ª›\Øf ÂÞž§¸eó:ï1ˆ6ÍŒý·¥$¡ ´½ŠWÁ`IdˆˆÔÕJ°ÓYqÚðôgÙèº ¸.ëQX´“ÿåš/ãL&û€³Xð ƒ­÷¢ýÕÕ¨ò”Ssl‰*Ž6¼²³¯Q8Ú“îà ñ˜‘¬\ö”È ß^“ˆ Á_¿¶f«(XÂ÷] #RÇáR¹ÀÃ’{c½$‚6[dœ¦“ïyî€ê“Hï!Û§$ÉDÏG°0_.‹ÖŸd#Ðæ ‚ÑfDïö­Ð·Ê¼¡-ëWºzÉT'$[è2ªŒtTM±43.ê٠çr ZF ÆrÛÓÊ+^øáÖûATO‘\R=Å·Uµ½é‚iµ:X ¢ÍÚF å(µE¨‡n"¹ÝÍ™þrج1x_ƒýÈLÙ©pòá;÷BOÇãPÊI‘àÊþò$ »õÑ:2‰¼¼Ñ®r”Ò$4²·O“ŽÜìD‚Û‚µöÉ0|;Õí7 Ö§q_*LIÂW=Z‡ÔŸ×OâIíB´Éu¡š¥´¸}ÖÜç&|ÓЇd‚±#òñ–^qV‹Àcn~WÇ¡ú—¿kÅ ³Ž1"Õ× §â†;x§ Ö~Ønª&À›4:Ž})V‚¾œ×ÇÅ?mz?'Suma´)»©+ðs¶7׆:Ê#NÄW]k´á&%xqGóYeògÏÚø'2^µ{jy¦…Åý‚¹pÖWeyé%C –3ߊǒƒ#¯\½zåÚk*}¿Ë1Y=ûy‰ÅÑfng8ªÃØÆÎ.| ö9£<´‰1×öʬ¢>m ®ÌµÕźwO­u©ªæ;×sI6 ›¾b®…}Tüý0º X¦=÷*–ªß:¿üàté˜ñ 9- À·þ"QcV€6ÛÚàxhqÚlQp~E_W—„²ºÃä£Íé߉6¾8Ùø~¡Ô»¢P¾3³= mî}„Ÿúñ)+g†€W¾¼º£bá ›½%É4½“ Öü6ÌÙ(2¾íe”·ypÒdoxNÖ4Û˜63ÝùdŠÙ0kŽ:Q8 Ù˜¡ŒÒ›E‘w¯_TQo—ùMæFëJI”»AX2̮躟‰ÿ-$»©Ö’šÑ&6Ü^‘H&[À¼%êDžÐ š0–Uz5/Â.Ru¡†•­@öj#¨9®œDË>•CeŠDà1âõp~Ÿà8z„%äý@GF¤ºkÜ]974­íÜœª¥àUÆw–Ôr-YI}Øò@ËÞ¦t^pG¥‰ÄP0n|ÞÃw0.몜{Ý 5˜(w­ÖÖÖ¼ÐJwzÿÈ·£Î·¾Âªêmò­NŒ>×’b¬´ö»ãŽ»™oÒ`U¨ÛL5eZ›H§ú0•„kŸßç·¹¼Í:àu*­ñ>ÐŽ³½PZVQƥʚª0=·Ç%¥­Óûœ6Ø‹6ô‚+§ã>® Uy™kUPö’gtU. ¬¿A]*£bz{a¨}îÉy+yLÞ¬ä×´­ÕYÚØÏ0@˜Á†c©y\<,騒¸ßf±* M³îY` /`IåLð®v¦D¥¼d/ô€–T¿À’Z¬‹À`Ý!Kj´‰ÎäZRþ$•2˜Åè·qöKF›™Jò6‡¶¤€‚MÓsyÂú €‡Ì±µ’ó'4ÂX‚§s5À>ø4‚Ì<Â-‘ÇêÏÂnÏ0 ÃàÈŸZ+Cñ†ß0bƒ¿ôä ² {¾SØæwu¬ÕÐpGbXZ'¯Ñ;5±ÇU|ÅÔÐJSÕë=@ÿ¢.‡Ž{þ©µ­½¡ò½!“Z>"Ôm6ºÌ ²~÷K[ùÔòeT˜þæ4§ UMm­ mp&Q}¦³Ø?ü:C,)îsoy¼ó§ºÚ2uÌ‹5 é%Nõz\·Âù‘n3QsBÅ¢¢­§¥ö“›[˜‡5Á-úõØ:›3’ƒ;AJùÐÐÙZfk¦¦ŠÍ¬˜,»/‡6|]ZÛÞÞVœ‡ÆNB ¾àõ¡Wâ8›qnF š.O ßWVU•¼/ŒpÓ¤šøMѹ&öy{ÿ,®ËµVýùsYYéiM‡È{ÕeÕõ]àL²Õ&ž‹{VYÎÒÏŸkV¹>Ÿê[çÂrĶ\G“õŠÊjjK_é“1÷>‚€FOò4Ðõmêèn®*2Ç(\-tàýÐ溳¡uP|sk}©†RŒÏ)îèh÷4NFQ½wqw_´Ù(#É3>×wNìì…HŸ†qÆþº °6\£ŠV¾ÿü]Uù‡S&¯X^À>=Èãö¨²ª"5ÒŽbº´ç}Yyç‰ö‘%U¯…)cŒ¾2x×Ù×lÉFgï–WV>»á†×ò™ÙS°øŠÖüüÇòª·™×•Q-\/Õde¯‘ýösù§—†$lìë±nwù›>VþFjaueÉgM«s™Ü0yvŒÅÀïÈ.;Ö§á5µ‡]éuŒÙ9Ý»§1ÊŠj\t˜ªy‚Ç©>{󹢸И‚½–ß*ÆŽ¾:hˆ“¿úø%ÈîâI-‹€47Ô{©ç=ƒO-øXYúÖ”‡ä2‘ ÊÂ2oCQ8;§ºª4ÎÏPÏýÇÒ|uT\¯®¨ÊO D­¿³ÅÚÉi¾ZY×ómi姼Xy§qHXî-¦¢±ó?T–½sÑ#ù'‹±X‹öT… [ÙUUeñþÆ:®·¶yÊÒd«&Zñγ7UŸÎXÑ\¢òþØã¨P‹wÆ#|-Ìí’‹û‡‹#œÂ?ÒÇ^è½v¥¥íÉ3oº¸ž¢Õskçñ óË k+˜,Î^IçoLçÞu²1·¶sN~ÕÌ×ëò­ÜüDwÀÙ/¹YÛÚÚÉêz¾xÞª\_½ønÞ :æus™‚1´yèzé 7ÉÖ„µ­}ÿ"4>õY×,-,ÝÏÅ­0ÑêlS3›ŒïLîùls;Ðï;€½!>³R™æZ_ž=ikiaá|£o•¿ ZéewlïuÚtgù{8Y[[Û;{'çU§¶^xëÝæ‚ÆNŸ£‘ø0¶vv¶ÐÓY»úDs˜3Þ"ÏjfèÔË…©wç,´¢«öz³&ž»ÛZY:xu 3igÆ9X™Û¹ú¾ná›;…IîçÉf>èZ¬òvè'Ê=lÍ]¹öþrWÔWs ‹S¡7'‹T]ÖiÏè2~g.5XxÍr•ž‚[6›6öô)KÃσôÐzòÕ/aÞN6.ÞwòÏ@M]O¿hem›¹»Ï¡ÖÒŒ{+¯ ëƒðü ñE|¨µµMÀ凫,Éë^Üu²¥)²g™w‰»í;XqÖÕÖÚÁ«€›v•³÷$}øŠ¿›…µcÂó*ÄVèN^BÈÎ?ê(*Ù5ä'9ÛZôèZâÕÅMñ7\íÒÖÚÞ3¯yJ2;Æèµw]|v9€xCáî\[°§82Ë¿I.È™I9eaeõñ@x`›õþa´µOH<¸HlgOqÆI{+'ÏóuSløc¡#ÄËd—^Ú+™0{ç‚7È.:ù5ÜN®QÒáëbaí|ÿu3üÁGß%»~|BZB={ná¿%¾€³ÿ±ÿÊ´‹†$7Éu¿6²V† ß6 j\1¦(¼ëÛ9øÅ‘œÃôÏgÑ÷<¼vé7ª›ÜͱÙ÷AEßá\ܧ¡¤‹Gt8’P$AR/‡±¤ö;Ï‘pnð +œ]?¸àÏ„ü;àw²;DAÉøÃvJªùçÙí)øo0ºzvl„ ?o?²ÆÉJ6ÞÁÉ÷oÛ›j½R˜\ðÀúôà6ëg‚¶f7è¬_*5‡m¤$%)í£u¬µÉ¯ò²²²ß—5±iFŒŸ#v[Ñ‹¶éuiGHIJR’’”þÆ×~‰þˆ¿bp=çÐÁõîøKÆòK¼ã7'hJKÌéñ³íäÂ3ü(ËǾí<\Öˆƒß ÿ‡³~|°Ÿ¼ü6Ù¯?9ä‹ãÄÝV¿Uuæü†—ÐI8Gñ Ùà?ï’#ôtÌüj¹Ñ‰¼Ç™h-t6Ó×Ñ·züy`Ï£q÷;‚\,4µ />x#xxîéú¾bw+Cm]³;¯Û%ÖûÂ=m4µõÏÝÌô8x[O¯ûëéêغø}… Hôªì›f:ÆVû6à‹+¥ž;Ó„—-’Ùm|»äe ² Œ}ʲÛκ²³õ ë_bIdWû"ÁÜ@ÇÈÒý}ïº@À ÀÛ—w.êéXº¶M3Ää—÷¥ãÝ#k#S§ü6aºpút£Ÿƒ©–¶Ñ•ŒÏ{ÛÉ=Ã1sÖYK[ÏûÒýmìõe½J ÙY84OIf×õ1d§oê˜Û2h'PœvÕD_ÇÔΧbh[bÏ Ö>w0ÑÓ5´É¬ŠúJOˆ›•¦¶AèÝ‚=2ÍeÏ\H õÔÖÑ=»°Ë¦4ã:ÈÎÄÖ»ìû–Dv# ¹Ž¦ ;ëôŠa!»µ¯¡îÖ »ó ¹€¤~X‹÷ü@v.7æv8°˜ÛC—}ìÁa=s5)± {==ÚOWWÇÞ'rd ·³©0ÉÒPÇÐÜõ5ïh÷žv.|ýèfi ­g–ÈÝôä—Û¾âë ©­çýXpž~+BOýwÃöÍÍ`·¨4`u©ïˬŸ˜‰; —q·ys\€~Ô“¾_P±a=õÑ¥¸Ýléêiú˜‚—£|äž|ù’‹Q1)mêìl«µ¥²jÄŠmL6©bÓßÕöôtÄŸ11ôŒes÷GÊÓqDõ÷umÝM§ U|n¿D331Ö¿éâäoç–÷ôt¦\²Õ° ç&¡_³$§·wuWç^Á õÛ¶Åv´ØE¬ð6á=-¹9Ü nPöXõS<ö¶¦µ»³Ùׄæu³@ŒskÐ'w3§d—e¯nÊM:ˆ±&饂ìjò¯a”ôZ¶ÄÙ½ ·ÁY…6tö´VæSåpÙßxgÁ™É'ÕÔ¼[»zêß$bÔ*WÅ:†Sç…1ô©mïi«û ‰Â$7Aç$—ú?S0˜çŸzºÛ¢Üô¬‚â «æí(ò!Éïº{º ïx’u½ ™e¥¸kмî€ìÞÝÃÉÓÊ–ÅÙU'œFë{Õ´w·×ÒVÂ$Õñ¢íØ/üHNך;{š?gåˆo¦˜bë|[Æ%´ºMEKWGK¥)wµZ¶»41 ɯªÀîJ ¶ÐuŽfˆ‡­ûj¡Ücò»º»>¥à¨\>;?Єèݲ+}F’#¼š ‹±ë̺ŒV³,oéêl©² 㣠  ÖÝå¯ÚXù¤‚J]ò+m‡Hºø‘’ͳ:J.×rAv%éA8Šíïˆ/cÜ” wåIqOOWö šIàšxÁÝSœÙ…']Ý•9¬q7tÚˆ]íŒ5 ¬ïèi­y­ª€Éè^ëСϱ$Íõí]úT¿$è_kÊ‚(•þ d÷<ö$ÕÈ’¢­ 2º;_Jnžq KÖF¨$ÂÐÚÏLEÖBOqÍa$Ê“rþñ—_ÎŽbŒ×)4§ø‡¬€ÆdªÃð“¿újÞ ýéJ”Á{ˆ9?_V×òçŸ&V¿°´¯PÖ Æçw¿K-˜sc-hÑ~Û€ìžÇ_}vfÔ‰¤š±õÆ2*.‚wžƒ´\¢>‹ŒÅê‘HjŸå×å{(%‚~Ëwê.ÿx'0œ/‡¶;&ØhD<™ÃgG_Ð$ˇVwZRd¨Ž»vé!:öáŸDØ­OI„¦IÞ¡'`²ðJÿ6ØIôooåˆFðÛ8?ÆšèœÊCÆgp˜úª˜7]üä7ë¥çN¨Gý’žjÎ?M ÌÕ¡ÑÚ#¢§çÆŸ8 ,+>ËZ‹ð¬fœ9X,OÔ_°+½e®éþB„{ÛHó²u‘wÃfyˆ¬ê¥]h{½M  mòOÃvg8¬RÄVÜ“†è¤ãüíøæ2¤3àÓÖÅh«úñ›±1DÁQÚf9‹oeõ.ÂP`M¾–ÓÍ^ø‚!P¿­ñ÷úúž9ãÌŠ¥ó2F'@Ñë\­¸õ¦ á4ôú㛺ÔS…|v[c4<¹I4+Úòûó²:¡0»óv”(nàü·‡æX‡ ò³®O%¼ëùš[ÇU½à­Ì„Óê§b«8; j\ùwþáÛ…÷~òÚ1b§¯:cýõðÇaàÙ Œ8–ƒ)–h»Ê´eD#¼ê˜E¢MãÝÓNaÏ ¬2f|Xh}þ¦T N óZ¦øÓhª¾àÅËÞ–äÎòx^Áë­‰º§ÜSj _ß¿¬›[iÏÍÉÊ}ù~|‹×Ìõ™¯òr^‚Í¿âÅCn#w+?¼ÊÎÉyó¹–{ïÖ‡¬çªõž—5 òúo¦­üumsu,/¿`ƒÎþëk6ƒUéAT&!ÒY@V1ÝÆ Þ/Àæ礉œ¢hHÈf Q!º>s»}Ž¬Ýê¥sÖŠrÏ„q… v ò"!!;‘êèó5°`Ð/kƒ?Vß Ò9}„Ô¦_Ör: N, ~"“´æèppb5£>,Û¡N€õ Ø-9*ʧŠ„„ìFkbƒ*àðÆrЇÁúäP-¯H˜]cÖu ;‘”ÕÑR2AcZ´»XOA«‚#ØU˜@³ð‚ ~+O¥ê:ÂQf*µÖ¦¢LìÝÄ8Ð{T½Ìo¬\|?ܧ±Š7¿"OÙ3ïšÓ< ¨þîÏ={=·´ªÁI*&'9‚£WC5O(Z¶;,!;öf'M ß ³cöª+àš7@+8—¬f²!ˆôYxO"éAÑ°ŠÂù®£ T¹ÇbŒêÉ)Ul°C©¨‹Íð²FÃ^¬E*)O½Í¬ñÚ`ÁÁΖ—Ÿ¬|)$Ó ×ìVFŠÉ9:òÐÈ®ªtf7f ‡ú¼Æ §)_h€_ã¼{I¡r)Ÿ9g¬,ñÚàׂp7sèmÂŒz¿ð,f¬Í· YðÃ5ý x¤Êî…êz]f.ÔQ°*#Ûü‹¬6¥w )Ø3–Šr9Óˆ˜&ù¬i ΀tú ÆŠ7S÷yÑŒDÆúÒüÊ6ÀfMOΰ8À÷¢$MÇ@±éÖy]W+–g#l‡©)“°š\ ï+¾¦b|s£6ô¨ôv¿¾\;¢ý ÊÊ›ç¬${(Ñ°à©.o~28#=ÙJÛÌÜ’Ê×mX‹–ª8 ¯àŒ'ivF²*§—ஃBàÞÙû k*ÖÈý¯7=MÃÕ¬UéOo°þúºMÇÛ8u}?øe ËßJ‰TÕÍu(–¿Cú[žÄ#‰"ñ‘3f'°Ï§à³š œ § Gõ±Zx—~^åhD#rõXqPÆ?îƒÍvŽ=Á"³7ÿŠ—m°ð}/ã ÜT0Mwf’Hk<Þ]ùJãGWzÕDbùhGÃê‘:üªŸÜ«Wì\'²YZ÷ëØÓVgïÂ7 ¾I$˜D²›ÿúŒˆ·]°c¬÷«á•:—ŠÌ‹z¶Âxᙦ|”3A(­»3oŠÆ“ðºÁ™6ÀÊÖÍŒëCÆò³néž8õ aqvýÔT®•ôÂß?úêÜxßžYÇ2öÔ̵¿&¨ën ^ÁœOP0 ά1VæÃ$ð­B4Šy¼žL"M 3€lUkô õ5üÑçß¡(æas†%Æîù Òmc&T;ëc/g¯¿‹$YÚ|7‘·â[åÖ®•.%©x öIˆ±G*¤ôuÄš]ŽuP±âE»jÈå!òjýõ}ÌíobÔõÏ0…hS¢ÍÆZ=é¨j§$¶=IGEbù§MO`shóÈ åôýnh°„háh@Nÿe{%|*mž;,2zó¢=í‚“hs‹`é)‚6é$’£m–{A´Yþ‚["sH˜êÑ0‘XþUG4þQœçL6Kízãc}6¾iBW´ùò”ˆ·C ÍmÊ3Âõl/"ѯi°ÍD ÍtAÑd RöŒN¶vzLïî0E;Aÿ„ׇ%$Úøª©Ü@ Mq€¡öõ÷myQ:–¡´)G›¹·x£ ¡Íãd>LýåwU4¼vD3´ˆ Ífñ¸f?bú;âæ ,X*àž!Ð&Óc›ó‰6—m ‚Ò„6BC¬§Šÿ½é¦TU7Ú´Rˆø¤í½]M<¦þUÈnÓ…päIÿ¢".6Ïl±ÖÏD|×Ï&„¿6'œ¦žŽ‹Ÿ$›…9^CZDÂ@Ÿsr‰È„¿öf]!ÚîŒå@[[ˆ6cÚ8y´aw¨!× Ñ†~NåÈÕ¦5ùv=¬4³ßœÒÐO(Ýmö±#8ì #²Rý0^ûLÓ)¥÷®Eø[p Ÿ¶PTé¦;50Ú8¬Óù)ûÖûÐ8ZÏ2£ ÜÝ $ ƈ‹Î.Ú0¯Ò\ž5ó9pØ 6ºvÉŸ™_^ãôlÁ5ðm°EÜ›¾'Ô°‘Ûu´ÛÒ¿ÞqRȳR‘FÕµ‡-©é®—dã]ö¨¾<ªX˜mÚLNáå¬Hš²³xŘ/0Œl‡P”#›V ET^þ…ðÎEG¹ÔQKê" }±vÍѯh?VÞÔ÷»ë½õÑšŽÁ"–Ô÷d’îCxa¾–‚Qã,Ú(Èg õÞegE¹G#"ì"Ô°ªáôÑŒëºdÿwƒµ÷BtO]†Ù5gßP·õ±¤FJÈ­YᶻÔ@A« í·T-}à‚ÈÞã[R«-*Ê”~®0¾ª)à¾Ð·=•å…:ÂÆœbL·ˆ%uË„æ“¿G˜ì çšRùý}"ÍÔ¶¤†kŸR4­E,©všéë–€«OCÛ´Œ7?'«™oÂÙçx½‡4mØß´äѵk"¦MÙ+˜¤ݾ!4mT±ªf«v†§™ý×°üäw6Ê\î) ÓŒ×aKjTØ{‚^ý®#¯\¹ ³›0’Sü´ÂŦ^zv£ÔqçË&òùì´•m|>üµ0ÜÝ4ü!Ø­Wµ A%p >3Þ˜æ“׎,øQð]x¤*î_ÐñŒbÎ×P°ªc‚ ìÍvéë&R°§ÍååÿöÞÃ+ª-Ûþ'¾o¼ñîøîíwow¹òÞ•©*(rÎ9DÅ„ `DDŒ˜sEQ@P‚ɹ ªŠ"VÚßNUdõôë>§Ow­Ñ£îÚ{åõ[sÍ5ço^]Px h Áítt{ªãÎæá¥5‹OR?wý«Itá¼yrÊcË=)4R†•@]·‰ÖÈN·m<‹qDÄÑFYè´ka;Þ ¢h£H±d‡—-Às|­NÞ‡ >k‚yŸ ±ö@µ×\³;FËCøûîý¾WRs=UP0¢Óçû±=rῶ9˜¦ßéÇoµ›Ï$K?}˜Ä²J©ÂÅFY3Hb5¢Zâ4BLa;®¿ê¾fLpY*µ}8lÁÞ~ÿpvˆ€/{eòªÓ†¼Pkn‚UÀîû‹ë•’.:|ÅÃ÷Vl&Yß?êGÜœ÷/®÷–±™ãÐÒâê3¬˜[î@Z_~ xÚ)™®>gh¨Ð¾Y˜lã“X±¤¸É>&H«šÅµÄ÷¶-ÃeÏ4W3&uZâcnV!—˦j¥Ü†M|Ð,Ãi^ï2f%Á^ݸ¦i/èEïÈ~»bI=¿åzüóµb¸ÂÓ,ªìV´=4¡Ûêèžò\\\œF=mÏ!T4J±äoö1fÛöz2Àé™Â=#¾”ƒN§•Keè ¡Ù¹#¸¾çS–52^§šóžãÕ˜êbS5c3‹ IFÊ·;Ôvx²–Ô«G¿Pf§NK|5ŒæpB±´¸pÓS‡qPlË0´Ø¬s#;¾Í""í©fVÄc+»pšhÑÓ8S^ê2’Šýž„øbíýÈ·+FäÞ¡õ”#5´/N5åÀ®×­‰6kœ¤àmÙþÁ¹ð–‡rNÚî7Š»n-ùÚ(ÞBut¦ª(!¦%¾¿™ÇÚuW_kÔQÖæ)eˆ¯î0jÖçKÀ{ ¡Á{À²IÊtá\¨êúžÖo!Ý(ÏzÜíÅã“ò±/whFŒ[¨`Y[°‹(ôë–ÊeÒ‘`kvìù§Ë>“õT2ê³–¡©iyÑnw¡Û.̹þëÝSd®ýW‘L.Ÿˆ÷„(]vÕ;/mæfe5Ýð‡÷²8›‘›h.Yhì‘öH*›ì{}šhȯ^q^ƃOˆäÓâooYfàÅ6d îx˜CæØ´ŒJårI’¯Eàž¢å7àò¯€éå·ß¦¦äN±ø‘r´¸ÝV&®ÀÅõW%òÞ¬¸¿i fÁÅw¿çÀ‚)¾:‘„;¯MLʇkKɬG’åòò½Dw²ûîùôÄP‹ ¯Bd»ÑÆ» ù®{ljzòÔvÇô7àÃ.tÃÌ;MSòÉEÛh€Ï0¾Êã.d‹ø2¸¸‘OåCÖýñåÅ=Lñ"»& ÃÅ ·YàÑ—˜¥Ê÷c²¢óÇåS¢Ö' 1½l`ù ø›[‰¶ý“SÒñ~O›¥Ó#µ€t·¡zZ^~Лo»øJý¯4˜mWX39)k½•B2slG2V°™çÄpqmÏé&`iïòðwÙ±Dë>Ù”tbÐGÀJBm*fEŸÌ­º^¸¸›é¾æÖÛg—_dO†q ¶çUÃŵÝÙK2µoÅ$¨¹nÀ8ÿE;<¬/sÂì‰åÎÄ Œü2ŸÉd²žgYD#K”åO}s»Õç< ã}Ÿx$àlýȲm¹uŒdîØ&–MNŽïpç‡FuÔÊ^;Ð(çéש©Éªó‘tf xé ø²$þRyºèÖ*?Hîs­œù¶‘Ø¿b¼øN¼C¨žè»h3õ•7—šày>Y›¿…J%àZâ± ¦éN«dzzføK9“Fûˆš:ô¾Éàú†³w ÂÌt'‹0Ajz†œwžÍÉ“Í©G9}9m3@&²­}Ÿ|•èÌ®šŸ]ÒI$ªù±Šúå®Èèß²î×~VLS"°5£tn‘¥mwM¹‹B û^¥zµg†>„;pM‰ÔݹSZ¥‡fvìT¬™L²tßòihŽQZq7;‰A!Ðy.7>êªÔûñº.Ž¹¯øåªÅÍ×F:™ÃÅ%Ÿ•+ÔZM‰8;Þ.ÎÂ5ºnpzÕ~¹Ÿ³‹I!€æÎåu#ºâ4 Ù…=aT2‘k\Ù5¹šý§æUÉa•@eÙ½éÑ,Dðyâ!͈`ü©[ŠÕê©œh‰÷¶2#R<·¦Íàà QÈ/¦FÐàâì_uÊV-®êÊ.\ÓúBe÷B=U³åGc@2iéu¿y|Õ¬¿wVÉ€ ûa³îyÿÛ [¶)‘y p±\÷•ZÞ½/Ô‘@";§ôhã‹iTs7ŽÅÒ)†…Ç/âU‹k|˜kIÿÔý/º¦Þ…ØqàâÂS ¦U«ì·jyï0'"‰l˜Ü51¯Ëmn¬a‹«ÀŒHõ‹?!_å†E=3rl›'‰L²òŠiÕêb4ª'ûàé pJkV­ç·wWm™d™}¨ônFÍ‹·¹[À£ã{lb+nM´i¹|ÐÔ6tåÖ§(Á&·Íø Å£]>1rÀÜ\g^íøk/*º™9_ТM‹1õó8”U—…t"…jžý¼7=š»å$ÏBÒö,ÈÞœL¡ÚúÅ~McÍŽ5“ˆÄÌט0£8"00¤Åa"¸õÕ’öõ÷íPµ"}âûÙoPVž+á#v¯;ørKröZhóªtï±²v cüÁ€~ÖëÓï”æ{«i\›Þ9Ü¢üÅ!˧þk§?#ùüGlëœz¶w½y¼rk ‹ÉÎ> ù G›’ }J nºÐw#ÑvµË˜‘/7"Bïç”sbÑè˜H65·m¦dccðâ©9¤5’”Ká‡cèC­•šz^2.K0ïùÙ‰z+CnH*SŽÌ(4:Cyéø˜lZ1/‹¤óóÓ²±ÑÑ1ñö–ÿ¤dÉ~\¢Tã|MÓã"‘lE @ÕÜèظF£!UD*£QIÄp~ðßx|ºqñØ jþ¡VÎŽ#?ŽOÈ”:Ò)µB2.“LNC«Ü·"!Ò 1ÚÖ‰9åÔÜô$R¦·õ˜“´¸˜Ð_ö‹$3JH9=26¡V+à¯j¼ÕZ,B¸OËDã“óˆþXËȾI2‰´~jœT3£bÄTR&‘L«ô‹BŸþa¹Z¡Phƒó@oÎ:°ÊpífˆK7~wÿÍjé±ÖîOô$ê•<7öY‡6×öšÛ%¼ÂçtÝÙHqD-^¥ä¿žªœ\¶šÔ ©»ÐœeãáçL¦™¶Í-B͇,o ‰³3ÔÓ–inÙ#GÅóÜt&s[BR¸ŸHVÂ5QÍnµЭÜ“Ý,¨æüpxé^ËÚB&2w¦gVtÏ„8G˵Ǚmýåvèc®èwÜÆ="ïB~°håº3-,Ù벸‰{vÛ1 ßtÎTÜAÖî‡Ëûkìµ!`}:HpäÜÅ^ö,¯í÷SíöŸ.8nk*Ø,Gmêì”5cÐl—+•ÆqNNŠ³dS=6Ç2ØéoÍàYE…ùQAVÆ‹Þ•#R´…GÌ·'ìtpYîq(àB²êS‰äèáaIƒ«8¢gÇQIôØ´#e_DPûÅ_€€Yõ› [ºÉb¼lë.¸‚4á(¶Ì&[˜$ú«ÑÙ™·Ç @­;»2ƺ§Á½©x\>·¼›ÄUFÆÀ¹&Ôöxþg“ADYÞE”õ9ÚPo|÷>/mýñ¯æ/_¾ ç5z}‹±õ^ÌNzª­„ú ,%fzNgéÅÛ5½\¨®®Êׂ|ú!nºÍš™ö R¶²XX[¾^\ \dWƒØÇpWèož·<îä€í:Ò­¹E’ù_Ó?(´h#R ¼çš™Ågä<®ªÕVP•ãÁ÷È} -“ºäœ©’t\)È=š‘žqôˆ'Ó(öžšo晚TO@Z “&m>aG½6m`4S÷š™ù¡Žn²:åLÒ] h#ºI0pFd"Õž‡–…ëJ@^ôŒZ¯<Ö§ßjóÁ—ÛL€‘ýè«vú·[l"½’-0˜¹›nº<I¿^¥Ñ|¾ô õöö¶}x £M};B›žá°)¼D«}„÷\àñš&Oò(*)åíز•†£ÍœØ™LtÙzøÕûº¦Öæ Þ›8À›òìÐo‹ÌtØÖ!Ã>œ,:šäãîM}w!= hƒ¤œë€}O4óã|:µ~Lƒ¢3pS[êl —öDt1Æ!´ BShXhüñâï¢ÕX0ÚPiõÁI¼EhSƒ6p¶ïØî-ζf¦IyÏa ÙgÇ+~³´ícž&ëLádb\ZÛ ½7˜E¼ð¾®¡¥³5¿!ö¾š~Ï4¦ÖË!Íâ ¥ÕÐÆ_É¥“ÓÝoÉ %¸Ym`Ðÿp`##þäV#ªB¤_úô€ ² öÓ†Œ¡JµpËIpñÙžƒ|ªÖª€c¶4°øË(4µ Û Þg¯rIöá²æl’çE¬u\@áy¼žã>¦ä£õÒêô0Ö–,Œ§V«—¹°ü-hóa Ò 5Ä¿ lb¼ž†nGXòÞÅڮѨdR‰béAóeÞžoŒ®'éëcïK e¿5Ùàq/&hæä²ÉYÅh]õ >~·±,’P‚å½m°^óåܬoäpÞã5›¬Oúô÷RÖÌtÛŒ‡ýËCÌ?J1% ~V¾‡Ê–Ÿˆ†-±Õl­p·ÖñÅÆ$K”…@Qù ¢]´übvôÍ!*ͺ]&/Ž{‘©óZ´™zÇ ÑPöD¨ëé'[;å-}±"Z½Ö;ä&ºø%”ÊZ ùüh­Zb ׿ŽCÓÕ´u¬º…%#‰¢½¬X%­¸¤…êmh5£Hå¤M·Étn÷” l —4c= ÙéÇ?Xƒ¡æ[õãgC£lóQú¦$Å)0ÿm²†jÀ®›‡Ôùd#æk”äà[Ù¶Mä¨e¬A—SB°¿¯ï¶àË‘·cøÞ°!˜tàRϽê„æ[Øà+Œò«m’ŸK$Û˜ÝÖ”K}8h,ÒÛT×YèÈ|¯'ùYðxG ­owý“Š½3úe¡Oÿ ÔÿæÒ:#3S]2!RÝ&hêZV<ÙÐÐÄÈ4ú@þøüò-oº¯ÖÐÈd‘C Ådÿ‰¤`d1®­ßÍ··¤ÄÞø¿VÜI!š‰ûùûé$"™HpÝÛ‰Å%xm9Ý©çKÓ¢@`aµëü㩶R¢QxÑ»îÊ"gÎdƒp¼o1k¹–Ì©L `òöçÝC…ev„å:CR`!~œª+‹§³…Òy\XANRÁeGã-x,"‘•]Ñ€5éÛ»k^– ƒÍ¡R»²+f1‹•iìåý%zùŸëZÕnû­¿«ežÛFþ÷V#hÃ¥m¸R= ÍŽÙƒ îsûÜ{8?Àû[ÙH¥’yî[ë–k Q!FG:Kk§ü—ݵå)7Ò>Ê!iÛ¾HgS‘HM=wå÷P—&8­7$ºŸxµçý/Ýmýá#ž§Z "çcˆ6;ßbT)ŒõÄø Tµ3ö±Ñ(óÃœV’Sl%þGhÉ^²Ñ§”ló=Íñrõβ#˜îUHÐ *3¢ Z&Èæbÿ­ ®©Ñ¬VcfY)/NzÙ&¿Ð=EÐ&èöŠÊ¬~rcÅâÇ‹Ú~šéBóæ}G½¶fc šf)qܺ%ý)›‹ˆæQÊEOz_$Têe}úCbYlÔÞ©ß©ì©IYOUѾgÑrÄÐF¿w«Sâ~+0£¬a1à$G­‰ú¤OÿäRÓq³£ï%¤ñ\^`á´u¨Í³§øßÒ¯¥ÑêýT2ù@yÝâÎùgð2Ó'}ú#BÝ*G¾¥¬húÎô×Oú¤Oú¤Oúôo»B\Ü__ûñs—ì´öw|jë›ü;J£šüÒPÿñK/)›?ÖÖ×iSmm‡Dõ-\­lüT‡ºÁ*{Zëêêg”š¡Î¯uõ µhìþ;©’t|øÜ÷+{è‡â¥šýØر¶`¦ìmoÛÒÜÞ«ÂN~jEçzÉŒòâܯäGÝ/ uQM}ÛÏ'˜—}¬kœSÿ­KDÞSóé›z Aôgê®Ñ¨¾4ÖMÎÿì%çŽeÓj›¥‰•½zq‹æoÏä·>+ßΊȪû˾N¥1wdT@н)ÉÕ/3QðóÏn˜û‡ݼä ÍAý÷O“Ù[“SGf Ó1ÞæVŽAx ŒÉ}ø“½÷3ƒ(¹mƒ0ó×Urä ™<ÿÝwúÊ÷·[­hd¨(!ȱˆˆŽàs·Ý—!4|†PÀ}Óù=–( ûÁŸž¨ˆ•ÆìÆî¨+4æmUþdóÆÞQ,†æÿÖÈ)û׳v®ì™Wq¬gCÓ?Õ½ª;õæÇÑnŒÑ&õ o\g(s76¼#[d—«×Èd­(ͪWYz•»è59ä—¡ÍR†{Í✗¾´Xèg~ÕåyTHÙY…çN·°Üö¹5u&k˜|ï:Z½©ø?†kŽRý‘°’—ÓøIØôH«ä¼k×a‡+KÕ†HXüxj)Ú,ŽÕ¬&$_¯Ó-ö¯:“tŸŸÚîRÔº8]VcwS7²Bqg98€e]=½ÖXTá^ž¡ã2CJt¢®Ù“ÍgˆîEkE¡[}öŠthósˆ%-ÉEÅò¯Ô[ZµìÇøÆ×¢Í?­Y¸¸nƒóNš“\z3)dû¢üh+/7[ÓúôÃ$®\´‹Bqð Œ9ÝqíøN“ééíY1gQcÑÇõf¬»i¾Lp¹Z)¤©Q¾x&,ë3p^…Cáÿ]¥Þá ñÛè,Α«ÕX—œHé +›nåûda‰ä1>Ž4ž½§“Wèz·aé@E'ðËÿw³YÀ_ÎZoò£ƒi$í&f¤–±Y¨ýÂÿ0o¦8pù¼&ÑJÙF}\¸>æ%6éT{øëè[0Ɖªü] $’9hÜhðMÉÂ¥lŸóØ`TÞÕ›µ ƒ>ÙûÖÔÄäø;,€ìdÁ¨ e{%ò\}}㊡ÙO&dËQ ôµ ì¸ëeÅdð­ØTbàÖchX=¨©"ÝŠItöô¶ Ó£cïja²?5Ó/bÇæ@®WÍÃ|¿ ÍÛÂ<Ö^í’9,ï›aÔ%C7Ž8X æ¼Ðˆ()ˆ¹¿ôÛ²ißzÁÞÄ÷ÂÖЀ˜Ø{%lgZ¼­à¿A7RìáÞûKH¢†pwPààåjͱp,©ìÂÆ>=mP„®ÞnNN7.…o²BÐæñ-ò%^DÿË_L¸b%Ò˜{9‰€dccI1·/ªîm~êìÀ§ƒ߶¨ãõ;sª½«» ‡já¼¥73T0‰/'¡û;0¢BWóR"÷ÀÛLJÂ-Né°êìN·ð½× 9lú²M õWüÉññÉÈ蘸(/KÐ*µŸM ±£P˜Þ!—Ú¤LšIÞ¡…ºó|Ôd%…ÁSÑËÛIanÍ|¨ÖbÁãmŒ]¯¡¦ÓÿIÄcª:ñM2÷òŽÛNdY•Ö"Žó’Î`W †•“—‹mòfTKL¶y~q¿€¸{{DFäQÄFt¼å®)§SŠÄ–žìxN2%׋æ–É6…©—Ò‚lAÃM6^)0¨V¤xÐÐÅ/pÿOÐ賿„wŽ„mKpà²ÜâO}*ŽÝ—à+,Ã2•Kduó?9Mÿl² $ûL Ò¼a®‚PMAÃ1Ó/ˆk/é1² %n&Fè2©;fJvùŠ™€);­Û RHÚ`F ù‹eò.?”锄 ”¢%D†å8•,+Ίë…oR·÷lÆ"<ÙIänÁ r[Ëw˜±vÀ{U^œƒã6<êqóÕݦÖÑ(ÍËÜçúº‰4²Þygb nè«‘vRÆWmú¯’Ê;W•m $Žçvº_R1YÏÊÑÅõNo¡Ç\øȧ2>" {˜â±?Õ:³A¨öë†æ~jhÞG¿]‡È¨_ïïôHOç%?FŠùH  ÆçÕºýX‰¼¦îmBãçŸÚãh%°vò=uõÙ;HD.RðÁý " ¹q(窺¡ÁgfÌ{ÚPØ<ˆî{â ?ŽcâìKO>‡à•…½nEÛ|m¯²Ç’ÈíC¹Ë>•ÒÉ61ž`DÒ‰`7;¾¥m|ú¹>Ôý[™HýŒáîT'*û&¡þR¸÷v–ãÐtj‹Ð5¶û»óFª+aïnÚá[Íb‡óèF¶HMž¥[p¶Uâ-¨4¢Y+Õª¦\3ç¯èZ•×œ04õ€×gï˽ ‹}ØìIáü’ª»îŸO9v­ 17¼Ýp3$A*‹<ÙN'1ß‹çNm&ûï×uä‰ήð™k^ÌaÒ*ÛeÐè##Câ–²n|ø˜úoAÞœ¼KØä‚HD*¹¥9Ó6¾—ïǘ!¸Kêd >ï@c+GìÈŒVÉ<Ô”ó =“7¼8­g°w[»yåÁ-ž]êÙVÑø½CüaÝå4º{¸Nª¾zÈÜ) AG0ûnÆìºÓÂ<ùîÿ<œæx8% w@¡Ÿñ(…j.îçû'`/ìs ‰ËÃ3=àmCòD–jg™7‰P«"˜ÙN§%<í®À½×‡—-ö&¬Cp:µNáz³+Ã0Þ·òFoExõú ¼7Zg®6šŠxOË=–DÚŸ¤0{°¢sƒ®F÷àÈä´n—×|:ìê{ =?nÍï´ `ÐUuaáPïLW LŒS®5Œ}}’Å£NÛŽ@Š´ÙH°Ö6ºš&t{¸Äù] £ xå}/ú‚â¸-Õór‹vvÌÅpY;*¾ K¹³à8M+!Íb´qÏÞÿŠå¬ø°‘³¯ºÁŽ7SXóÏLh¡yÍíx/^üií‘žÞâ´cPÛÑvF…˜c½—sà“%R®­¼¿<âíbÀŠ¾žÆÐÆ€hÙ³ôÛ¬#ÞãŸîäþõÈGå?½ÞE2·MŽõ¨ÈÇÌ •BMz?¹m”©¶Ú¢7h4ªGÖMhªÑ”lÞ1…©ÓDÞf¦Ë2I®‘£hcY—Û•÷ %`RÇ0¸Ç]KëôÍÎŒ°8²)ñÌ·ŸB›udOéztBY€`³HS¸Ë}÷mñÀ“íEPw±m2²`ß&SÂ+ M›÷‹|›‚Níà%–#úEus¦©¼µõÛH`E{9=8îèuº}ñµ„m–9|}~–ÁwžYt+¥–U1LÀ¦©%ÜÓs)¿x†¨éîiº‡Z£ ûÛ²•‰Ü÷q´‰€ÑæüÇë‹›ív¾Â²ZŒ6KC%6[l2º>Š  Ñã²!Ó¬¨¾7: Á+ëÈ^ÚÞë°Ü`r}DW7‘ŸÙú#ÍFþ–a ~ÖÖYölË«h3ˆ£Mv¨«×‘«Ë¦Ûb´ÔS×2wÀM§ƒŽa(qª2ÒšYþ_/ïR,xŸÃ\ÙJó<ƒ÷óTßÇs`î-þPv0Ú'!w±l³‘d¯[leiÖ®ñ–£ ¸Û€žÌl£ÓâŸtëεÇÙn…ˆ°Õp+Á|Ë#d£=§}Yù!q#F›Io#ÓÌ­®e´Ú˜b9¤€îNÁÅkÄ>þÖ7Ó¯ö¶¨WQ©,Õ8¯†6$ë!\ =`³ŽòX{ãºÓFÅ mf“›â«WÒi/È6ÅÇìË—.F›ÙDÆÆ„w«pr¯DxW8ë@u/nZª5œð#®Ëéøž6ºù¼1à†!ªñ6Èü1Ú óû²7-§q8Ö‚þfšýX¦½ÊŠ M¿ŽHÙ3²Ë—{G·gÃÿÊs£?ìì ¦Ð·ETâ²' j?Þá8ÅÁ¥ÞÜb{öiã.ù±ZmÐI©ÐáF×Û":Ï~zÑõ†z¦O4®CeíÃzD¶‰ÐÉ6ï®4wŒ@e› M†Éy- ëÐF£=¼io`zí 6]FeAšvbOoh;Ÿ!²Í"´ûÀ²M³N¶é®7-‚4³Mæãj1žc×Y·ÖÚ“ÔÖ×X!ŠîÆ€5Œ6÷à->9™²R‡6‹ÖšrB4’¾ÙÚ3¦P3?£°Ú¦µ?K^¦Ž¢¹V–1¿EµŠêk_0=!¿ šýMh£8±B¶‰¹õQ¹šžlEeˆ b;`_=ƒe0ÛöÄ@d›» ^–» W»‘»3³3w›Úl[ŽpM´¡/F›á´ªsN»ð5!mÙº}÷¢·Ñ¡ 4ýþ°1Ù£÷7V¥%Ƽþ*YŠ6Л†s ¾Kš·nß#Áô6+Ðf9;ï0c†`ÚÔoöo0v‡Ï»çblœ¶çb/Îu>ŠN<®Û¹Ö¦/ÒYäÕþ‡Ñ$s¼ˆîg™ý;h£kùð¶ 'û’½Ýe³û(ß: eŠ‘ð枎¼s•ã¨……ÂS{»¥” Û¨¨",43™áœª[û‰>\¿Í[}ÒkáÏVîvKØÌåaüë5•¯†0î hÓ_YðW¢yÝ.ðeXn¹¿<þíKU=zf×(ýø`âE¬Cfý™¦©Z ÁgÖÓ|R§º}Ò«Œ6sïhÏ)mEÉ6¶„¿ì+ÿ‚½üâd¤7ZŽœ¤|h$j­­ÛD#Þ È¡þÅhÚléžP„Cĵ½†æÁ—¨fΉG9r‹k1ÄÁõ6ŠüØŽ¸úâ}Q"™e;®T+>e™ØÖ¡jî¹–¢f7©`´ÙMçÄa*ò­¾[Zµ«ëÞ‰(‡3ͧȮy‹oZSÓv§˜ûîŸ Ý7g{a_TçÌì`ÉBóC´ß"¬·FgÀô"´†îƘ±"pýŠ¤I3«ì’A³Ÿ${ìá÷Ñï{)\®ÎôøàX¦·Q576±­Õvå™ý±7jàU•n³vM{?9¿™ïs3EP6¼y‰³²¬6BøH¤þ•h£íhêýçs°•6n2¡Tà[ÐüD| ‰iáëãÆqG±ÓÊ°ý†õå#øU”¶•A§{ùúšSHî‘Ç‘3’ôÓFcz;Š6h&ãqp&–X&ñ™w±¢2¶0ÂÒqu4ÔyîO&ÞØÍ^ZL™Æ°µäÐø®·»ÐIs˜³5‰cëëéHg Ž_¯E÷¢NúúÿºÕ‚œñ•S½¾vl— m»â"#âÒ(DÊg¸oû.ÿcÝEçÑhZð*BØ„¨b|þ*»y$#Ï£×±Ým}ãFÁW¾û߈¶Ù°Îä¦7œªfl>}_7÷_‰Ü°ÞøB/~*lp‹ÁfZoã#ÌVó¸¦1O1ƒ7õíƒÁl²1›Ç'ˆnQ©ØÅÕ³Ô€M.¸ w¾õº Ì­9TS TŠž_n²¤“½-èL×m8W¹§5ñÌ켩ŒåÐ÷Þù„Ÿ¼‚ͬs>õ—ïæ†Ôíýï ö0=wà —Ç¹v|º)Ã"òíÝŸ ¡Á`Ù†â—îîäÇ"˜úÇœGJé-{Oª»º5:X²m=ý=l¹ûk†±½¸µì‡BàÛ»ÚXXTTÄüÂ9Oÿ©Áz'K¦ot|rLЮƒŒM¹#(ÈãÛ™4’½‰%ÌyŽH«ßžshf|¾EÕôâ| ‡Fpñðq±f³…žÏG ŠPJÜÓ¾Ågß7‡ü6nZŸPÚ£lʇD+ 6,+–¢m@*áU›yðg#áˆîk?Ï~û]´Ö£¡|àí¼ÖÉ¥n×ê.ÜÓw2Í-ƒ¼döödröÝË¢»ÇáBé—Ó"aCà&$æ<ÄÅGEMìŸÁ$fF¿ÀÝðm­¸I‡ÒLLؽ¨¢þþÙ:ÕÃÇO@#9„;½¿ú‚)ÝA4‹«m`IwÚáΖyþGü=tÎ~Úý¨±:´ñ¶%¼ÝÏ‘S>×ãÐ=HVùW#¾ö$Õ/ø“É­…Q,ã¿Òj´±d™]«A°ÿ[˜ÕüOgp³ÌÞI³»ÃâÍúž½Íw3ѬbXµ*wĪ¦ËL¾Ó–åÄ ˆhºÿê2ÍŠz/q®ZѨ%$šÕóѬFH±D–^j)ôsö6KÚ²ºÕг<ÍRK•UzDoãueõAÔhVD½ÍuÖ´·Ñ|×fd5–UX5VN–ïO€Uk½–qñê¦\KgïÒ±ÿ™†/÷Ñ[uÂh–öóʬ~ Û 4=Tã[ÚéÓožz‹üO=nÓ÷ƒ.­D}úKöØÕÈÔú~ø­…·_ãiòo’Ú/ÙÿÕôs^Ÿôé·šŠú¹¨Oú¤Oú¤Oÿî»áH8û1×ñm‹ÿ¿gûƒ Øß©µô꫶rueþï~'‡U]ó ßØØ ”‘L­j1;¿ñz>Ùìq,¹ždëDÌÔ¥ãi6…f;>·ŠÁ„>­’Dþl@ûtÿÍtCîËqH­xV”Îc€ €&ôØVÓ#‡ Y+&˜l¦}â–ØúªÔÍ‚Ag0@®ëõwèÈŽ½ÿàÓý 8“ü×zþiÑas$ªÐsû‡^œa_€qXVå¾Í6Ö¶Ý-Ägš·×[0È$É1b—¥QÊÊŽ%0€A£¸FèÏ£^tÔ¿üÇ ”q¢ñ´à¯®×ñá•´m40n…ZÏÿ% þZ"‘höit%Ú e‰¿Üse“( Û'æhu‰†6ÐüDqú6€Jc€4[ÿøÚ^>íå½Gwx‘ˆ$"™™Qòz~™®˜(Ɉip%©žÛ2º% ä©j–KÝp©¼"ÚÇ…Ç£2ƺߏóØtë}RJþ£’ß<ÌDZGu ÛÛ:†´Hú0è¿] .ï÷6âx(!HÖñÂÏ‚F 1Ý#÷uWÆþ‰~.ùv*F«ïÓb’ÚË–~îa»øÃ5 ßaN…Ûò|}~„e¾eN5¥îÓ¡ÞÕ´PÏmg>Œ÷ˆCkåÅ}:´SÅQ'—¤—Ëpïe¼5/õ¶næìõ²J*„ߙϰ0‹x<Š‹bÔ’JŠLÅfãÿÇ»pP5ß“YQÆ «­x(Ìæ{ûèænhÛƒãTžÝ4ât v31¾q ]Œ€ç˜€ä-hø´kaœ Ò¬·•c™|¹›Jç¹Ob£/‹Êw˜Q㌀Г;Û/Ä;!¾S_NSöÝèT•åJ´@|“ËÓB>¸ ûøH$èˆnîòû7¯÷£Vk1NSƒ3^¯.Û >îÃ\˜U‰Ö^ÚÌ$IÞˆÕß•C~–X°˜}.ÎÔ:ÑÝ,BŽ`+RsZáë®ÅÛvA¢UèìÁí=þôà4äµÂÑŠm¾•%TRƒnd•Š£NoÈûß#fÊ÷ND™»mÅ>|•½@ÿž«‰#éçŸ#« †,g>#¹9ª$Ít*`â¯è~†¥pêzùí¼±‘ñ– å”:Â|CÚ=47—ö1Ù¨¦©wÄ‚úñ¹pÇ`Ü äÈ!ãÚ6¯*3ÜØ)þcâE$•Âº^šP«ät 2;mÍ´§9žBúðNv¸“?Æ‚•í ¶8ˆï ÁÖ{ò«L±?…Ÿ[k󂹑ËÖÝŽ@>à¸{ø鈩â¨8Rs­ûÐ91ò± 3‡§‘Ê=Ë‹´8‹}Xž~øå2–Q¥ô Bx;5Ü;εRjý|àd èRrˆgòy]éõ…{™qº.C›L» ñOú3c¼©$3+¿¤v© Úî ˆ½²pê¼ïfu>w«²Ì|Ë»ñG%v¦ˆd¥þpÿZu×´S¾—dŸÍˆÌ×8±Ïü~¾AôS¹ö·q7#êíaÅb¯ÌëBá‘Gº¯÷¹[§”T¡ŒÌJ1fv=¿·ióC„ØÕˆzgqjȊ凥ÞÅÅçŽs¿P‚à—.z.¸\­VÈåðxM†ÐÖÿ¼pàýB·”BqMÆ Cá×µORÒîW öOᶘ¯S¸(ÚÌ„ë½›ÃOšVþ:Òõ1„¡Æš¼éq?~Dš’Ï(sFJ|(ëòt…A_Ø¿°êU(ÚÁ /¿¡ šÝÂdìz„¿tÇŸày¹†hp]ÚB½º,×U³Ð|M¼YÐ8F*!oæ’ÍêÇñ•õ&‘gèpfÚ¬3sÖÊZ©¬ø3u3ÃïaaéÛ$þôÉVº©âèôàL˜cÐYìÍ#Ûyáû*ð%Ûvæj<Ø’Q¦ÔÍ“hÑSCïa‰Tžw~à•à%F®#  ž™‰D_.î!»nÃ^Ød•rþR·*Í;u M})Ú°våVá ñùà/ô¸7OÚ™ùßÔ…?ž $ÓŠQߊǹvþÙX;mM.~[6y¯5L{„àjÍõ|û8•ö׉֧4–ùÄ<”ç´·XWzÛ•ƒ4Ïmk "Y`̶tèOÎÌÎ=ÍÞAÍAêXX´¹µ ÷{³Çƒ“Xˆ°^îK,Æëçë{© =åe¯^gü³h³à•)ö13@<Ñé€ñÆM±ÕË'¨àB"Ù.Ç'ÚµŒ+3‰{§cœÐnZƉk0N,ÎaÓ_ÖŸìü)´YGö”¬6#Í×@ÐZ¬Àgnûeô$Õk½Á¸tP7Ç }¡âˈZ;¹–µýWk"qQ%iÿ¼.¯EKàj5¶‚æ¶1Y•¸sÍý@‚û%xô:š™-nÁ_×g|EÐf#ï6 óâ—t3óo¸ï94þ0ÜÀn9ÚüB Öú¾(N\v­¬ë.HµѶ®ï†ß*h³XoÓ™ >†6Æ6'0qn¼³‚±h|A€²ñ¯Æ­3Pãýl‹·ûÈÑÌÔH/Àm9ÚhæÇò÷G› ì\cSNάÐ`ìðg¸„û‡BMéëÀmjh.Œ´Ð‡p250 ¿ß³mfßP)!òEò©ès…E;õ° ûç§;Yæ¶Ñ:Ùfìó=€-* âÄ`¯]‹e›T¦ÿZ²f¿`½÷±f-V º™åv©öÚ â¯.È6÷aÙæÀeôuå½Ü’‰)Á=pñîvít݈H~=ÚÈ·Q RWñåÒ¡*ÇKàuaÅ¥ÆpùVŠÁ¾–Õ.‰Vcœ8bE ¸öu©zmÔÝdÃ¥Ñïi£3N¨':~’qBôõ.äŒj_×e QÙFìi²!» ׆BP¿ó&ó0þ)¾ L_-qïYT‡AGã7'VTòÇh#ö1Ýp~pyç hÃ?ˆõ bâ“´Nãåöä»Øÿm>Nö>¡S9ZŒj9eûkÐæ$†6²ÞtsbÅ, !ÿ²ëNÞÔuõi‘l³E]tÔ¿N´¥zž]Æ9²ÃŸ¹ m`I0…mûnrxÚô]Š¦éº~´ö*›Æ,­ÐÅðûrªÀi^RÛ‹,/jV5äÄ2POUìyÙáp÷m§×:In¥ymÒ:ðɣɆéMʧ;¬…i÷t3sŸ·u|ÁóÃ6hN£× OéŒþz´žì²‚Špßühqá 4bÅãÄèÍ›Ìwj}OÕ·KJ»Çç—1N<ÚgÉ.Öf2R\x {±mà©Þžëil“†Iîc%†\¸œ¬ºÿ§ø›“m—ÊÐXÞ•L"™G…æž›$;|Œ6Üø>ãĬT<&EÔsc­ðZÝ‹®%›éLos<ôÙ÷ûJ^›»‰ìŒÆAQù )×1rWÕ+jЄ0jR<:òÔ¤úQǵR’æË7«p½ÍÐʉfºíÂ]Ë!ù·âÒ'ê¥h£šµ`î~Á\ä'£8 ñ ½Í ´ù ”t2Aê›´/U¢ €l掬ÓûgÃN¯r'µm`èžæ´[ 8ÖK¿½ºó>& »åãí˜ßfE×êöYïÊ}·´ìLVç>‹Æ[Ëi4o©RLOŽŠ%k¡ Œ2õ'ÈîgðÏT²KW'QîVmüÅÎ~/áÉ;­øZVöÙ3)å K£öÌtHÀív¬”ùãžß\”Iü˜l̯‘`"‰à§?/‹Š÷ }’ŽÁ÷Ž1-'Ñù4Û~ÛÔT€ÐÛt˜š¹uÎaÚ¬n+p¯™9/ŽºÇ]ǦwË£Ï{%?˜–I¦æõ®I?‹60„«eÝBd:îݽӆI² <Žž¿q´ÁöÇd?+o»kÏO@dE «–È6h&ß,i Ë1hïîk&É6è¶ ­Êo£ÑLûXsé–NÑ¡^T3ë2%”½Ï2ß3jOÒv™ªj]–dƒ{_ ÎÜD#—AÛ~ðìÅÓ»]Bé £ym´¹¿ÅŠ¶£¢U—Gs©fÔŽX{sþ‰¼’'Ba7ßýœN 8†'îKŠd‘Ìö^mÄ"©:A!’m}#¼­*Ù±™kóx†îyÈÂStÜ¡›‘,¼·ìIÜ¡“cÏ>[„6ƒßAÕà[‘bî¹79†O'í-[*Û Lû×bl‰$óø}¼„ÜëW ,ÛÔÀ…pÉ$~âþý.–å%Áf¨lSwý(™Á‰ŒŒ˜þ±lƒ²÷€²ïæÄøHUÚ‚,äK{œ™æ–iiûxtÊ㇅Æ&Œ„¬<…ºëGäØlM>ô)×F¥„mOJÚB¡€ ÷ñ£¡øÙ!|­“Ô,Üιq.‹në½gO’›ÌqLC#!|ºuŒÂ`GFú¦„*œFó8Æ‚DzxyzàÉ-ã&bê3R›Ç¤Ž¾B.ÍÂ}¨êÍÅ$*Èððóc3—äBtüçv‡øº{xÚy 6ÎÂÙ9¢™û3™Tà¸RXÖ3¬È‹ ¾d€ãåë €ôsÕØØ(§úy×ÞÃ×ÑŠB·x†‘Ï@ŠDöºˆ+Ãzç{I5×ÝÝ;¯^Ä&¡˜ìïéîîkg r «kR©3™ê‡_èFÉ<4jvY&8“>$“Á…L ñÑÞ‘qþQò­GËÕ¡œêïíîéŸÔIȪYü NÃ")n–£QôuwÉçqïÔÄhOwWOÿмJÕÛÓ3«„·RÙ·îÁ…âFz‡ÇíÙñVß”ËÚæ©Fûº»{F%ÓªéÑîlóƒ« E‹ë“L-¶ä™‘‰àÇ=}ƒÓ¸j@#êë”à:kþU÷°X¦Ñ½ ôõÈðHjê‘ÞžñiüeùP÷ t^Ûë“è‡Cc,"ˆff´«O´˜C<ÜÔG6'¾¼Éq¢”‹ûúF§5Ëz>!÷ŽNà;6Ø×ÕÝ#žRö^õ2ñ¹6?ˆ´¡ñÈ*C šéêŸÐ,:*NIÆzáÑëéËpŒF5‡Œœ³1 ööô ¡fSðdé@_‰h¤ý GXNŠºûñxy£C½"©öÐ4'þÖ3‚×_53Œvbÿ°[dÇBëÜ ð RË=(îëY’ºG$8âNM î™S/Ðy *=Ñ0üÞÀ°H…YliÔƒ½½K²èêÇaå:1àù-z¨ÆGá‡CcšE\*dÜ{zzû$ò9]§})ÏŒ¼=¡G”ó$~œ´ïZýÉ.A­ØqþN–šêȼXûãÏ”S‰‘a—?`˹BjÔÍNýèÿf© Þ§jJß ÿÖéê4ò⌠‹Ìµv0)Î[ÆfÔ?Ó€¾G…tßÎÙœAõO˜Rjô¦­¿é4Óè/Àõé8wÿÏ¿µ(êôIŸôIŸôIŸôé;{æ¿ ãÄ¿ÆÈüßËÓ›pMWÜÏa½¼÷OŸ ’Ü7¹ìyÿªôp‚_Ú‡íqѨç™f*x1ôk?”ÔÞlèCmT¦º MÞþ=õ›Ý/® Îýý-O¤µ7?õN`£ÑÌY’7¾èUýüç×’M AõXó{Š?Ô žÓî&¯Ž­¾5üQ'VV°<8‚f™À°‚/bõ_µj~®‰+·]ÍÏÐPü¬ü ­ÖÒ¥©È—Sôõ§žî¥ŒKcFÿ°hf r+ä™úZ;³Jw,ýbÍð kuÅ%ó o{°lU¯©ôØ©Õ3VgäÐË6¿ÕQxCw4£ó¯cìÓ-/+6… $f£~Ü3.2âÏC%ñc*‘˜‚Cu;|l)TšOLÇê¾;öÁˆÂî¸g’_‰d2ZË$0éŒ\;¼‡Ãi EmWFÐAÀÜ>´~3JÑHšïûÙrÉ4æ–ôËZ£¨õIž=¤RÛ3oh­[º„wQ뾦\{¿ |úH;H ulúzáNäÈçB€JnX…qbj;Õ8û+nò‘ëoÊw>‚m-7²LÉT€îŠY“Ê?ß5$0ßJ±ç›½y ˜òûÐzÌ6S¨Ô›­XÐ)å1¡qòÛñ…Y­š-:¸…R\»ü§møÔîºö Ýwr¤ÊÏ ¼üç3Ãõþ¶l …}öI‹îË'¸t*%Yõ©¾R8b9#îxåƨ4^Á›+í=S^@j…ŸXú¹õn)rb*?\?ÊgÒl»²܈w¸ñ¾#—J-¯Ô‹OÆZl9]û(œ„x'4ûä³Ð|Œ6õƒýCíHdªÇöã³è‰¤ÅäÕïte1ˆ¹¾JÚs ÒFxAo;µV%ʉ¬X_xèLaæõOX3‘ÙAW yÇž0*F7·;ÿ´e9‰>Rx≯Û=-á©´;O'©ÔÞiƒ ´óÍD2Q@=ÕçA·±Éäá™8¦S¨ ³%Ž‚B¿æQéôÔÔóôPª7B× ¸I7f¾ø::!•Äš³}ÏÃô"/™ií×/šH&r·¹ ·"áýìܱ£­"dJ®î•ÙWjD`ì(!vb+ý¤jry»Ð ©ép`°,Í­1›½â}þ‰%TÙ%A¦vué^s/¯à›¨=ðøK²ó„zFÈ¥¼hCŽ}ïsøþþîçQ˜©¯Ù¼ wÙ@\lb-Y^GïMH¥’áæ@ªIüCÔ`莑)Ù?ã¹ljZüö„™î»íœT>53ø±‰ù D;Ÿêlá´ûÒ„L*íŒf¢Êxšeé¶ ÿWÃbé,4ñ†aD>õ¶Ç6LŠßÁ÷0Ú8[R®¾EÐæÛ-e~óý·éé™®weT†`tF< (ùµ#’‰ñ»ûý:yû™F¥|ÌËœ™ûôóÌÌ"ÛÐ@®Íö¯ÃÒñžž±ã ÄYãd‚%Sú¾O$–ÍAš6g‚éž[-ðxˆ;Y˜™]iÓ@ª™sjÔ¹Gp•'†Z‰´“uHcUã 榌ƒpWªvÚ%—·LLHÆEý>|ÓŒÛÝK¤>”¨Ä"ì¼hrznVœ*4𿀈.×Fr=bFàÂÆEG|-ö"–™ ¹È‡ÏÌyÔ€Ôš‰e¿! WëƒëÕ3,‚+±Ý™}ô%¤žµg‡fޔɤ]õ÷øBÆ×q/ÝÂ*ö•m~Ï„0NÐï a‘™5' Êuî$cÖÆàs±r‘Ÿ”æy¼5;åŽîëDW‹Ce5¬Ñ”À¸;¢À¬î9]Óm÷£p&/&T(Ú‚v]Å¥Ú¯9¥†Àâö­Pº0«[«ÊÙá/ß©!ÅîºÃouÝ'p½ùõ’]q-ð æ´£WñÊl½ ²Â§4ÐÔ»ëÈÔ£Bà³ ®³*†m|uPµO@½ð‘XÎ3ójߧ_™ÛY澉p£N{ðÒÐx¸“ÌÏ451ù{á.ÕßÞ:—@iÇK “£sã¯?AeÆ G”Ọ-¿âˆÔ&XgR2€¥†3~ÉkfÅM €üMkä«é)$’B¥Tžngçsû¬ùòŠÛíY`~ß`ÚPÍg±ß'ÛITÖgñ\Ýéí´@yæt×FH=ãÇc½íÂOR4z9· …yÙâ^ ÿuj§¥÷¶sØgŸscÈZr8•ìó H,Ah·&P!G­T¨”C)6¿Í\Ï”ñ ü9ÆØ°÷V;öÕü̬R¥^¶Ó™™¯Æqcá7ç8A°7åÃX_ؤ}Gùš¼Á1RTϘ*;Ñm§ ³G«jõ>ᆭw%Xu}®ªkUMw˜SM?Ž`]ÍõP¶¡ƒmþiІÌmÄ'üÌL9¶Î.hruu¢›&×,fœPí·€Ö®Ø.Î*Ù-ó&Æ8Ñ&Ƕx±ïÒL¨F¦»>®É8Çv<ú¶´N]öf¦|m„ †9ÝKÞX“q‚ä1±†Þq9œìc‚@· ºw$b[nSK¾{ÂËQHþ”D …iO‘· ®Þ€#Ý]®g¼Áy¨8Õ+ò†’;[Á8*'AÞ°JåÂeÔOBo.mµ‹}¤›À=.tº“³ ÜxøŽvf¦¬á9mÈ.ÚŠuYü•V©–(Ö/¹_ iÏ}Ø;¹`½æìhe²‘Ü:•¶v‰ˆÇ·ߧ;‹äƱWÊ6÷‹øz–w’©ÌO¢ù«»B³u_ §¯‚6ãã0®%î¼éGuˇ39Ï ;Œûœ–$†R¹|lÐáZ°éü x¥¿+;ƤvÎnž^žöÐæ؇¥hµ<-t± ËÄÃg+z—kM–:ó¾¿àÊ ¸$$,ð®puµ7]gxux Ú Ô‚6GÐ);ìj`”³”°d^ôŠnÆý6‹7Yt7ó ×¡MÓÇg/àôüÕ»6½åo6Zpi8Ñ(íëÊ—Ð昫À¿èýÊãØ¢i# #^-4åJ¯LxßOáíKÕwN†WDßÓF/aœtPŸbœ€WÂnXÑ9¹Ç¸ÚMöÜ¡ú•÷^‰·IBˆP”’74zŒ¤é+ÞÇçwòèÕÃÓ –¦eõº‰EôzM± €KÍò²,þ Îv7;¹¨¥õWélåJE1Š6ã‹ÐæõR´™ìJ§°E+z FׄÇX»ŸœJ° Ý£Ã3[è«¡Má2´¹±'Ì>á”î«ý´ÕÑfG›Ž h® Úgb“xfYÝfÅL€R=€+Õ‡Q­V  Þ~YÏ¥¬8ÙðÈÝžµ§ ô¾C›N¡¡Ñ£ÛÂV±€6÷rÃ*ÆðýÑtSfëõïüxƒÀjŸÁ›vЉGÝ~9±~¼ljDÝvàô¥ÂœP'¦u4º±*ûül/¾)Ð"žRˆôSW¾¼Wäî‚Œ–µ'ž%{Z%_Óî³U<×*©›À!\6…¾c÷Ù꣞V4¡°õ ¼Âå0=”讶K)4Úþj@dÍÀ6 åÙ††|øô[-ðP¿Èô,]3Ï]ÌÍJµbŽ¾ø´óÿNáØ¥e_È?•æÈ!í¾ÝºmEŸ/eƒGøžÒ˶ÑQ‚Ÿ@›HÙáJÚä»åÀ•’óÎVAþm4Š]”pºä!¤èÿÚ k6ÍŸ#ðŒÈ+º”™M0a?잇±šI!Eî;}õâ)Oßç9Îdó°ÛŸàã’ÈÛÈØuÇáœ{ï"­(î±ù…Åg3’f&Eà>P] ¶r=þn-Ù.ºïÙIS3FBúÙâüÓþ64O”‘®s¢€i$e3ÃÎW£Ý~&Zî‘¢R2Žˆeš‘Î×LÀÛÆ1oÛ6¸àréî£Y>FKORúô»¥¹‘sç/ŠçUº5Mvß,)8wîܵo´ˆ¼<'§E®=Ψ¥Ïn]†_(*¿7†òâ@³p&Eã8•–I—6“·:j¶êGE÷ßöáÿ˜¨;•w ÿiªÿvéÅsç ž¼oÓ !3ÃMW/æž;—{çeƒÛ‚T’’¼³mb¶}«yœwîl~IÅøü|Qþ…0e_NŸ¿®‹îóîaá]„ÕJÓù¸Ð~çemÕ”eÅy/0‘^Ór§èlþC8=QsãÌ™Ëbœ5còÊ…sÕMÃZÂHÞüüÌÙâ\_=w»ðìƒJÌM[våü™/#J¬b­ïžœ?wþBqÍ×¼9ò¶ìóeZ€™¸t*¿G[ä½ÂSµ£¸áNWý˼sçó «>÷c¿6U].Ò¹befèJáùœ¼Kߦ  ‰l¿ÃŸà•Uv)ïK26­·ò®}Ò'Îç]žBŠQJ»/äž+(퟇Ò#é19Ž©ÇŠòsKÔ@jY~þ…ÁIü@4Þr3¯¼Îäý“¢»U½‹ÄÂù·¯çææ”Ü@6¤œ¹þº¢‚óy…W»$ÈAôòÅü›5ˆ*ë¬,ÈÏ»ñ¾~øôöø«ó¯4ôc§#u]y~q%ÚÿK¦ Ô__~ñÖ¬þÒžúËÎÁß=|£#ð„4¢Æ¢üóyyçËn¾…t£WcøKé…¼sùŵ]ãÚçªç7/åœË{Þ0({¶É!¥o«ºTò¸[6úôMŠÎKq«þð͘ê:•yf$Ñì+ÂXÖzühî¾ÆÆÀMÙÿÅ£­iÔÊë'_6ã$\—CXöǪô«@Ÿ~‹¹÷/ä0•¿…OÛbwð9 AÈŸü*+ÔœÁäÄÄÆ°™ Ë­ÙÿcÞ”A&‘}¢bÿÿö¾û+ªl[÷xc¼1Þ÷ÞÑwœ{Z@‚Ê9PP„¢ ÈÉ IÀÅ€s0u£§is £ˆ€   YAÉ™ÊiïW;TQ…€œ¾çô9Ýî悔÷ {íµ¾5ç\s͵чÏbsঘPƒÃÚiòl™š›˜œQk×»6G©g&áTS³ÝŸß.Š¼Ÿtnzlttl|RªÔ‚˜1 ¾)(§ ‹+$š¥^NMÏJZÞÏ­žT=ÞXÒðù÷®ðÂÇ{%5ÿ7 @«ª(/Aƒ C‡½V?.þ<§ùòIImaMßo(B;ÙT\‡ÚZç?÷ÔV–•?zÚõiʨå!³n_{cEYiIiù‹ÆvÄxnªÖV•—Õu™æ<ÜÓ\TZ)5™¶uª…²’âyCÓ(Fë˚ИÀ3ƒÕËŠ‹‹+*kÞÌ-)º·µ¡.úUK—Ƽh@§­|TVÖøÑ´èþ·u…¥O&Ek$“%eå íÊ„v¼¢¨¸ÄÅ…¯{ 7„ý7Ðÿ2 úÃʽN;VQ\Œ<«OòôE#ô²häOŠ Ìé@£c–FÒÚð¬Tÿ\iÙËæåŠòª¶ä¼F[W^f¬IIiiýÛÀW6ÃÊž>,*E“èËyôöý(¸æìÔ#õ÷¿û¶ØfºÅŽÂ-bG·xŸ¼×¿zҪ͜m•ý¿w…?Þ¶ Jþ!l£š ôzù~_:õ„…Û«XFÃ*ÙìžZôŠ¨ÝÂÏ(X¢õþ>™ã•²govl˜“HÜS†ngc»üÈtž³w@èÆÐ ¡€cO¿Ÿ59TñNÀâIÞLFLeÞ •ìq¤Á8ŒT³ýlùƒaãDi#^–—Ž£ðbÒöìÙìEµ'«CÕeƒi"“ïâèêÈ$³B?Ë´&sQ—Å'ƒ†LŠ¾y ‰L!„œk3îo— ¾¦²¸“Ê•G™ò%ÏžäoDLD^ÅgP§ˆá±ý#ãÓÓÓœ¨^1Å ®=1<9#-=-%1Vìʳ¢‡~D{î˜yýýn5R!ÙÐ3gš=ßUèëæÈÆ9„÷J–D0B±8ߤg#e2‡í½%ªK|D €MòÎ*W³ø {ÛØ‹b6뤧mŽñáPÉ¿¶¦{šÆµ_2…U§Zºžø&ÙÆÄóÓdË>°rTP3íMg¼‘WÀü¿#B,\4G,èféÒú€«\X)ðÂ’@RÒŽ3øÀ«Ë½.°z>ËFဢ˜÷gÒëôÔøQdeñýb#j¸B¡ &àÕ¡Kqt¾[š\cØýªo¥°ñŒTãß¼ßMpôåÑfúå.c­+Þæá¿•Jg½G? Û zÔÂê…(«K`¿>´X·w¥'i>ÈvÔœ0ª0hVg”lÕ—c¨‡mÆðµÛ¸¢smAÔÃ>‹¾¹?.$˜Æs £˜‰¹õˆlcÅ ¼ºÃKääÊ ±\¢:4K?æÜ«\&ÑÅËÏN Ž;¢‚ïžOõ èÑQ¡N¾{Hæ'ŸnÖOPÙFf(Odî®UQÎ\¦«tD0•ÉÝZ<í¿áoí{yìán*ŽµQ J¹pÊ×9 Д¿'‰ÉæFDG‹8D7¯´q |¾ÉD;ƒê> €î–6û_(–Є»6ë9Us‹ìoÖ”LÎJÑ®§œ0è½s]ûèÆçôlã±õ§0ŠgŽnhSÙfá}  …÷* ,¬Ï Ñ HC†nÜý³µ¿^nG§^˜š—¡EKúXdVIJél2;ö°±Ê7ÄÅì¾õò¤/;ð,¢ÊüV¶Ñ³âœ#‡Vó^úuª1gä¡4W«=÷F–°Í§‡q |¢ºé4¡ÑË)_žmç=ðû®÷¬mœÚuà wRìmô€’wùá4ߋЙòd‹«†ãÙo_QgcÞë ý?“Ã=£MŠÈižG^ç38¢¶‘¿JßÀÝ¥B>FîʧÝk„Þ:/€p²ºüüìVnLhËnîõ~{ÖVxPÎn¢ØŸî„ZoÝ=þØÛŽÞ©y´1^Ò³jðCÁî°Ýw"hecú$çÆ°ZºùÎÆV;Y8°ÌkšÙm¢ÏÜ~ÛÔ¨ÇËêÒ8ž~rUOa¯ ö;ÖÃ)kÊ ¼©ëý·?„8u´Ô çÚ1³oq´ õP‡‚ Xá~€Øf=%µ@ºƒ>®/U <¾Hs÷õ„ñ©êæ!ŽcŒòO³S]Ï6d~?l%Ö7ÄèÛût6oVgÎ6‚Ãè¸ÓÈÜ ¶,’ÛüN&ÍcbêT3®Lûš*YG‰=W,GG¾ìÆ‘Í<—A#‹“ÏBí¬w¦3º¦óéâCóŸ*3ü®¼»sq>úQ L¢‘™\žƒŽŽŽ›‹ºÁÁÛ”€C_i¾y”éiúB3}…tŠÓˆÒ¬>W·Eùf]0>s ¹„mÚ‹~à¦T" ÄôûšX_'›‰Ç±nÀá4lóêúAG¿ÍÆ| »èÙ.döâ®.—C§’Cv߀ÈTÑË%:iÓc}š vÒéôž)ÕTÅqKF˜Ä|!ÈؽuCµ8<Õ30888((8ØGìÆtpš…]ýl£ÇÉ4Qø¶«º9ÛÈšé$¯…%y2­:ŸNe;Ž+´#7·®c'*ÍìW‹Ïi{ïÛØSÄA!HÑbwg¦ÐO ‚¦l£Çö‚䥚¡ÆµhR¯•+[ìKÉT Oi—|M“2T²êÇ4fÈK4©™l33‚¨)¶.¨¡ërgÑX,åÖ¡Zj%æyÇÇÅꟘ–Wòök¦ÈJì %ˆIܼ½°ášd´Ô’(6lêt·´Í2Vf6†h™ýг•ó1ãˆÉ‹Š~,ï,:Aa0}žÏç»xɵ"¶!qZæP ÿX™Éñ‘€«³ÍØxíŽw*ª#\Ìb„oEµ£ê èNvÜ}[ósœ(þš‰µ²šÉe’-ÁŽé§JôÏÞ¥œoMⱚT l´î´¯ü@d2tKsVD ½Ý·Ìš”û'C}zy·SP†é}ép=“Jé[0©^*8°IvÌøÌ6/ܶ¹àm—Ûc6©UŠ©¦KvÜzÍd›Y^£ãrÞÀ6È¥‘Ì XÇ‹Zgn°ÜãtÈA·ã}…¥•Fm jù0ÆxÜ7jÚ]¬¬3Š¦Mí6€´Ý+lÇ„¬º²Yà™19…bnº/„@>‡5° <$¯,É×;‡¶*;ÅÍ2,»w=¬|iVô|;žÈn˜R‚ª×|« žJLí6òÑWžÑçðÖ‘(qÄþÙi´è…éNo[âÅj¶“Í„¾D]¶kæž'PL90¹^nìü×Ýcìé."3x!víhLDDûj·‰¹ŒöŠ½„ýµú¤ŸŸ–5¼‡×µgDdJöƒ¸ÂŸ vù³²š#d¤"OQñ¶fl#{K'‰Ý­#éY¹O Ýä ɱËÔnÓUdE4Ê ¼óÍÙm&ûym1F§ÙìÉ;TØQu!Òï+äuUï m×÷Ýl0¶ú³«Ùd"cŽƒÜx=ËŽÄ;óðµÁPSìDŒ<¥W[$›èV™å3¦]­;?„䚣2—m L vRy^ *ùƒ üu¯_™·è9æm³¶¤ž(j3>Yv~ ™.˜¤'¹‰ö4ÁOm†•²{>|Òe}MfÂ(–GžKL‡[]®ÓûŒÆ\¶¡À;ÉLG1ƒý[Ö¤”Óvöøü:Ä"¡=- †æiWÖ¤–”7&òÊ¡x~èNóp}•5ÇÃX,÷ˆª.4 ¥äsëþDo<7páïZ“ú:–®I-ÂŒmÀ‚l·¨#è¼wÐÖ!DÚmpW[Ãä„c_ðjœoc­'_j4¬\œNÚœÛÅbüÔ]ßÖ÷G'`¼aŽQqi«—ØÛ•Cãû§ÂÓ˜æË̃,±òç›þ›¹ÏÈ6\:îAÛ`*ÍòÆè"á¾-:©×›øN$¶Ëù’7.V3-mÜ’Œä\taFŠÄ.Í;⇞xFS pìׇ.AŠ½Ž¤ï-ÜúQÏ ï@Îð‹˜TæÖ㡘’]¿~Gò{|.ÉÛLJO±FdÑ0€[‘¢Î#õ‘wÞq¥SÙT9}>¼Î¥½²-¿èãçžU°;Åbå dû¨}n°ôÕs3º¬0ô*ÆÏ™Æxz¸‘Ù®ÇîA aý×½,ÄHl äp,ÁÒNìë˜|úú)±6H^ÎIaөZHâžiÈ`Xüjâù8ø² Ê×yƒ=ƒÉÀáìɲ6Ës™óat…rqÎÌ%e—ÇÌ3_¥PXCÔ*‹~w73YâýmÀŠ8&°‚ßÒ âú­®´Æ²¢ÓÑ*ßXsÑàßYô²4aú}À¯~Ѩf¥³jÐÓƒ–¬Á+ʼfÀ–à×ÚøKmp_=¾gUD%Ôd&ï1ü!0YJ²¢ßé‡ÔuÏ5²%½zþ7å#meÚRs›áÄ£ÕÌõ䂬q×4Nß1“î|¼¶ªþƒûoÙ®ôs/°>öGAý=o…L&Ñ%ÍC¿ý»÷Ô„»1I$…-úåIçl‰ßvÄ:2¾í8"Ó¬=“í1Ëfâ4ú/Y›™xf‡§~YBø/¿'¯ÉháßfÞ]›Àþ{åóçmþ÷b ðo&Ûÿ&²  0`øߺF6· _zU§Ÿ_Ð.9ʶÀÊ¥’yý=‰L‹š¹Ó˜V&]Ð_—Ê•†g¡[J¹}Xgî2sóÍH’w…‡X ª‡_ƒN§ž0fRŸ¿ƒF¥ð… “‘ûòDŒ{‹(DrXvˆ,‹ËÚ™42ÍÅÇ•N¥±JºðuUœ¯+‘Æó»’hÜœšÉßA¼~}m—¾Î®±já¢l8€Ï#9b!H¡E®2skt•»„^9¥XÃðÍ*Û+^Y¢CÏ·(\˜mX¨Îþ«/¡@5âï`›[ùùÎ4ÁÓ£Ga«žlà•BïšTs¯¶¬GŸÿõù-BÜÖ»ÃÍ餳o๣lù¨öT‘©üîh$+ŸG'í’À!~ÊòöOËCÊós Á/[ÿO÷¥@;×]Hˆ†‰w…4§oN·Â%ðC°bÄ “Ü€î³á¢M§+ïžâºÅ© ®Ÿ•9BŠW²l¢¡ÀŽî<¦Ìeå!Žä+/'1ñÃ7È5 »uô&ƒéÈçÒ8®çîAþ®òêÔÿG…\ßuª™œ"í&ô<ñs>‘Š° Øq÷è_ÈÎjh2ïm@ƒ‡Obëеý‚’ßß:ÑAÈ8ŒS/ún¤,î@|’·U²Oÿc¢: µµô´‘mô¨=çëœþäK±+†nq¾U‡:ëZyëõjð´ˆqÿZ ­Ä‡Í¸Õ¢ç1ívÂÿu;³ÔSS—õŸ‚½rBHlÁ”R JúrR à|6Ý/qOÿ¬f¶åÎ_ì8St£•äC¥-á£Dûdwèÿ¸§#/5ÙÙ«¯ó»Š\S¶ëjzûUÁ¹&Þ¡S¦¿'õ·ü?[ §‘ÜÞ\HcEç`]Ã7ˆÉæ$º²8ñÊU3‚ŠçÛÖ9A»ƒ[óC驈îTEc: l#ýð¸¦Ng.soDˆ{¤ TÊñ×c†ÛÚü`fÀÕwOgx&,†Ié)>K‡÷!XÂ6?ùlH(êÍI ¢lY¢˜—ýˆäÒé`A­]ÜG#§®;Ý ^ ¦Š/4£‚‡NÈaî*뀎‹zVñz`É1(ØygK>xUîö„¸e£A´înõelº‚ ñd|Nêçþ*?ÞÁû˜FßV½-•õfûhÚÍÙÆ´5Ú§ 7jàs°«Ê»ÆÑx¤ ¬†béØŽ‰6¾=̵—è¼âŽiSÃÀ6ÀAGÛ˜Òqd”(?5h“lMñzõY®°4v@d•Y:‹õ> ßÙ,ŽùôpíÝS<¯Cidõ.íº/P=Ü´T¶Ó4Ü`SY[L£Íw7’}ò:Œ¦¡H6ã|ݧÁ{‡)~‹v›G—6‹ÂrVb›’Ý\׬zŸÉÒi¸=Íúñ«ŠgYä¶hÑà5š×L vã¹C;ç¢=é™YÑ b›Íh¨ ß·¡æË–€|‘×8Vt<.Þ|U¶AG8›HðØü:¸aEei¿›EVÅ<Öý0|k诿yðÂ3ï1[Rá$¨|Úme²Y‘¨MãͽƒTƒÝF-_›„5¨>/&õf›|‰´³Ðv–@ ‚™i®û•Äþ0£¥Í<½¨^ÁÒM$òm³Ë§9àQ.O”hüùùõ5 C ëF ¬·Œ@à¶ÃN7ùÙÞIè^ïç§â¨¡‡ ±«þ”{d.ƒÝN’XÁSpx°¹ñá)©fE¶ù É“¶-ïªB<={µùôV47»(Sh—׉®+)ç§G'ÍÎéyrë–`ü9ÖR@à}qB 05:<§0ª[óQD« °³1|sŠ”z´…Çañh%Áž|šƒ«¯Ð‘ÆVM £ÝËù‹ÿO—¾vÇ‘¿ÒS•†ÐöÜæSÉŽ~1i at&ëTYÊCÀ;oë¶ÝHÕ‡bív ÕØ×™k¨s ^<궞Îv5´…H(ô¼5 /GAúïì²Y”ˆÇ ím> stream xÚµX[oÛ6~÷¯PÞ¤µfyÕ}èÒ)P`s= C–Å–c¡’åIr²ýñ;ä¡/²Ý$®øÔ‘xîùÑ4¸ hð©÷~Ø{óQè !‰æ:N‚˜±4D&"Žƒ«ðë¢ÎGi›F}›ðÏ&«qöi‘³¨Ïhøƒ¬ÈÒ&ÃA8aÑõðsïð÷o10T.ILã`Tö®®i0ù瀑˜àÞ}UR‹àkïí8šl9Ê(¡"FGÿŽ8S-ÀEÃQ:ÃI™¶£)N+/j§N&UQTWá}>»EÑMÞ6oãÔySß8|ꆢ ÑL1¥Ä€+…CıZ…ÔÑa´Ž‰†ØÑA! TáU°ÀþÀ7œ€o»’ 3 ¡Œmš±r ’Äf©¸Î‚É^ÍË l®"š*¢¥¯ˆN8ÑFaE¾D}MiØÇáKUg8ûX§·e6k›gÐMD•à¢‹Î¢‹ ÇYÕv×î[:è,dЫwÙŸÞçnÉÞø­³’‚0c~¢H;½bUHyH«<ÚýZ&DPãsmÛ|ÕÅëNÏ›u_o!ãÆ£ t…±³fžò(å6kVpŸ·Ó§1SVc\U-)aR*I"ÄUQÐÿG!gm¥ƒ§÷DÀŒpΰ˜¯¢¾’tµwÙþµµ£«ƒ¸ZMòeÛú¾Æé¼X48Kg~5,«×pãDqß7¿8¡$†”1¢´ÇÒ†é|²­mò´/~ÉòM†ˆí{Kܞ톛nbµEx[G@ýЦÚmmЋÓA]M4嘮SaUC¶A›Šaó“þ´)-±êñÄ0Ø~ Ü6ÌlÂÍ+> Þ„¤˜ÄŒNàPqÿÕ&úpð0!¢’Wg×çW_.×ï~=®ãOìn}5dIêÓµœTPsŸ ÿ¥å¼ð'€…¿; |Öð)÷§JŠC½(²·kÈ ¶»5 9ÄlÊÞ\–œ•õ‰0p®…õ^»tî ? ®ø‡`žºWˆ€ÞV“ÉrOX†¼/lŠàО¸üIÈ}‚r܃e.`Î>§Ï½üf-d‘÷vZÕc|ñ`™¨]åÎ[+ñÛ›V3|·:pG(Ãc™øpg-¥Å"kðc›÷ xx±ðwœN–´Õwœd¡;œ‹1‰úR«ðrÒñ‡èø¢¯›³Æ\¹±ÏM¶Ž£i6úæESÿÎZ©›Ö>˜•C ¾s=cŠC“5M^ÍìÍ!ÑèˆOÓˆSˆ²Ù±gÂQUÞä3/Ü®ƒ•Q> stream xÚì}XTË–î™yß›ðfîÌ›pïÜ4oîÜ{ŽŠd蜻é&t“sÎ ’³€ŠY ¨ ¨ (*¨€JŒ`"‹’sΩãÞo‡nhš¹žsæžÐëóÃÝ;T­ªZõתUµV ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©HE*R‘ŠT¤"©hm4^¹cT¬å]P¼@)½»v?<ÎOˆŽ‰‰Ú’xèu¯yÒ¿;8,&Z¢z§%C•×ý£öË2…þ§Û·D‡U OnAß‹A½ŽÛ7€5r¢bÒ‹Úv­ Îýiô(JF1qÛ³oUÉx›N‹ˆØY ^,*Ø{3%>ëÞ’ªo Ü]Ò#óÊ]©H:k ¾]AÁ»OVr¹ÔŸMzÐ]´½)ŒVä<:>û Ø[¹X^Y¡®¾nÿÈR–±KÇ÷FFÁ<¦^¼#«Õ‰Áá7Úçåß}œ¶'ñjúüáTgÎéd¨Ub¶$^,~&‘“±Òó)aa[ë…K2O½ŽÌ­øýœéºeYÅœ(^™Ó‘ýÁ!qïIäê¿5gçηð³Ö1ËR‹ÍxŽ×‡EÉÉz™y¿Z-Jh B oÒ'”¬Ij ö€uBÖ …óƒuZØðùoÁEMv˜¾‘÷¥Ü ž÷¹£[tuð¯úg¡Ö6U× HÎÌ<+OYcó·âTo¦Iø%‰TtùÇ=(ÑyÐÏW·/¢ïÅÚRìƒ/dÁ_gdÞ€’+ËÚN3¶9»”r_ôB ¼ÌßKåX\¸x ¡‹é©Iv4m«˜+"˜»Q7},£“_=´ ‰ŸŽ{3·œ‘/»‚}d¶ì>*‘õ @²ÓÞÔ'íÖÚê ÙLKGbÖL-ÊûÓªm,·5wŽP˜ÜÓg–pžó¤ûÜ=þ8—¨·iw:úèióÐÿ”òã…R’Ìô:’´ƒ·§îtrK8éÌäl>€Ä ƒæpíŒü»9›,Œvç¢IÖßLÁjèxE$?•‘vô°Ÿ5 käñºO„fšãM à<Ž×Êg\•Ä%“ˆ{saùœhͧÉéçäkìÂjÈßc£­‡ÃãË{fêÿ]"—{¤~ö.‹B6HÍX"‰—JkÁ™®3épýge²$éºn=…<9ó ºãg*H‰ç'»;Ú[[[»ú†$(R,¢ô…®Ž¶ÖÖ¶Ñiô;ñt_KÏz¸¹­cª¯u›I©⮞þ…„ÅsÓU÷O’¡­m3Hç”𧺡DÚ:F&ç¤ÃvWëØŒp¬¿«¥¥µ«wX¬(Ÿ“›0ØÜ^èv·S"ôûÉ6kŸó5ÐÎÝ {®Syi$cMdâ¥wƒÐϺ¢ƒ8#—9@^¿îFY3b.È¡ Ç>Di׀Іeá'’ÈAëÌ ¦¾zYtkÔC¾v:@Ó zBÆùR´3Þmª±ý~·1t§aDÎÚé˜å¦ºbìNd¹È£ ÝÈu^¼š’êBØþ^°RÓÏŽ ßÚ>06³ öt¶N̉Ç»¡véì„4\áìxkG§zŒèX€XÐÖÖ6+X1ãÛÛüv_z046½ìô×æQ(P¾Ÿ²íÖ tµ5{?(^mæ‡ÞRÈÄŒ§Ýòi¦EZ1í‚ÑëÌw'ª‰›P€(·‚~S<Ù߈½[†6$¬Qí=¤ÇRÇ à´·¶é¾YY¦òhC&› Wù|v3yýîŠÙ•ê~bîX­mý#S 8=ÐÓ62-šîmmiéèîH@1¦­­)Rÿ€¸£½mrNô#èŸxØŠCáÚznKˆâˆ†±% º¸«Œ®‡3qÜ@ÃêíÈm€nÎ=ÔuN5cøGïøXrÚÔî{æꅔ绶GØ“IÖo›EcM,™cïän‰Å0¯´Á‚è@vw 4 Ü—“uÒIŠ8ýp)wü=mÏì¨UQ´T•n] mÐÖšlÌ"cmý•jø« “¹oƒ6puIøÝ&Dí»!•mÔEøhHãÊŠ>þÍe Ú ¸þÜ’Ôsžl1dm—ÁËŸ‰6†˜ ü:9ëeÇrÝæ‹Ñ*Kwiª.–â²%>̃‚ÕM)íFñÐËša±yÿÕKél&9æÂSpô Ë|;.Dër¢µœL¡õ̬2G¥DbñD¦ċQþrÀýT ¥Ð9 >8£ÍBÓ®Ž6¯“yXã}ü…E?}ŒS'^”¢MTÒig=rù¨H:lÖR‰v¦»¾m,Ô)¯çÄÎ<êáÂêåºÍ£ ÄÛðë\}<ÙqsôÖH_*F7!·­ÿšWÀN#ÏW/Ÿ73¤l:pœm§(ÛÆÑ’óǘLÍð£Ónø=å'N£Õ/™¨eâ05£KÐ&ه⹿ }yúÝYM’Ó «¶èj H‰´ãÊ#'TðßîŠÝDf*èw¶q Ãn¢/¿ÊM4tJ„¤!È…i{Rª }H×Ò²Q€É¶2¼¶®© ÅØ£¼¾[–r«™†®]H|Üm‰ÝžV!YFÂx œòp™œ+G²Iœ<ÅokŸ hc` ÿòåXK œÿ0Òc ´y00vãÕYÏgfRp¦[=²’”Ó´ïfYù´Á©·)XŒÒKІLgÇl‘g}K]ÿÌšthŠQzùZiz]y,˜°½ö¶gzîÉ‘š-ŠB7˜ì.òýñܤ7ÒL·§–È›’”Î¥ •¸©êŽ ÃâYºüX2È ®Æ[`(3#†[â•AáBÛ :ê`x›CBB‚edÅaðöäÂÓd3]‹´†e¹ÍDR6ú ¡hrèvíY{Ö–Çè³›1ô [ƒx hC%RBbâåd'ªôýÀgÐf6Çj™Ö —Ϥè±r¢ýìãèštl|–é†t×xe/Ù!½ÞÀ± 9"íqe»×³" z)`0 7[r½pî—W©ÿêD æ·¥ênꡤ‰‰Ûbiý—="9´ésÐÛóø!BOËó ÕqyC0Úl$EÎʉ°cÌSœüv–ï"2ã»ÍT^cûBßr"ï¾ðV&›í¦êšW{—‰¬`èù½s&L#s&†`êõª±Ûè…§]ÎY ìììbéTM¿`§V[×?¹xhC7±ÏΑK/çÊÀ¬A›}2ƒG ð!;ª‡øH;ËК8${¸ï•GT#¶Ãkç·Js‰qbìÎ~ƒèÁ_‚6%yz,R@*ËìÂ%yÖ³;Fç×€6¨*Á/»qáàÞ݉‰‰Ñn÷íR´±¥+h”¢v÷zJ$”âDË 2Ž× §4â‹ÃJ[Öt wŸfmÓÐáv/{¡ûÛ¤`'¶¹ÆzõÍ;sæQÝF㟜uE®y£m M`´0Òs¸Ð¼¬,ÂD5Ïìm‚“ŠƒïÈxN7$óu,‚’${î®E» óä…+r5vámóØgÑN<ÊÚ*úì2ÝÆðÌEyQ¼ØÐ=µ&Ý®ñ³›9‡öïê?Öבlå>ÚêÏØrªe°9mÞJQ<òªÃü‹ÛT8—Ó<õc´ÜtßÙªOäÌ»_ÛÐX÷®‚EÔÕ+6-fºzv~ÁR ¾Ö £šÁ.ÑZÑfØE[çp£hÉZ„6Ž¤¤¼O²[½¶:ë϶-[ÒBx´sÞýw-ÎTÛêË+Τ¯Æê®âÉ&/9ºøK³KÓú³gR‹ºàƒ1–p¾~!Á´@~‹5wêíDˉřToîf=ÇØØ!*‰DrÛñ…3)éòÖc†ùVßwd·´V_c¦CèÝŠª†ÆÆGn hCN-ú$³Ôï^O…ÑNZ0Èùoúfßçb¸ž€BLM5mmmMmbÕ”l™N8]ÿòÞ&3ƒg¿7óŽxé‡&p?9dç}>8UkBÓ/x3´úLª4”@ô¾¾$g8©6suíCõb)Úì/Ù 6åâëÞ×’L¼“ äÑæKfRóHž3ot —›…ïyßÝ/ÅY“ÍýŠË^Ö7~xš‘ˆ³”¡=.ã¬ýO®#øLÃ{šQOÜþ(l/ÇÒͧ…øã›HÍoa’‚K¤¢5?üŠAP@›Һï… tb ˆÅð † ÍN¡"Ú,)ç“´í3T÷)’®H æFFÇ ‹ gjÂ)©Æ ŠÞ0ÖãJÇå¦x½µ±Ñq°eLf%æwçãp›E`ÏŠVbxÎò‰‰!]l„ª»y”ıœÉ«œßÊnÓZ–L¦öÏJtØâýæ ™À}‘º‰‹ DàÍeî)|/¼:—»Á/Öm z”Ãv{Ïú.ЦÙD]ëú€´ï—îßLt_m 5ç kGéíT·•K!\±î$bþãK»ˆúxŽ™ß‹®Ùå!^_ܵ·Ö(P+1#¸¬Ó?¬Ž6£ Y<¾zP$Ÿç§ûµ.S2+1Œ6ÐðV@ŠºJÝ[M_¿´A*ãfÍйrÅw6ÝVêšgd‹T•çw¬VC¨ÄÍé>äð oó#¹±~|HƒÌ­3¬ð&*P3IŒ‡JÄ<‹v›+»< ]cÑ·‡Ÿe¸›f–¡M¤abösºëé>Ñô÷×b(“ÈõÕm,‡ l·axhK<;ä¡Î_Òo„ÖZº§¡dG`ÝF¼Ïn°ë4çâ®×½4¨¼Ê9bHÐÓÃñúºDc—k/Ú‘‡Üÿúf÷»iy´9çÊ"Å_’Uæü£¼v†¤o6lTÛ iã÷ð}×Bÿ>d하‡¾˜äÊvÛ—N]M¨q—à!uüSŽö²ûÓŸØ­+¢‹õ;Í—ó‹õ?×]¦¯­ÉJ‚UÓ®×éšËëÿ&rªYwÍÿˆ/S>“úøø<¯Åb±]£ŽŒŒ5»Ð´©\¯iŒtÖ M•Ù%šŽüJÍqauüÌg–[ôªðøCßo³Êø Ë…b¹äôÙ–]¥ÏV<ô'„6ò[ÖÀ͘­ÃΕ ’à P€¥¬kØ&¿Kg9ƒŠ;¨åZžËRf€MN+±°P$øl_^b¥VN\±E¯Ð¦–Öi”9åNÇ·_ YH¸"%4ñ¡P.Çå ´ôŽ’RË?YÆøÚÛZéí/ªyæ×^ÿà’oò?äÇŠ»øœ©¿(Ahs0¿y /N•ÜzúÓ® ÁÜôÔršœŠrˆ'ÆF+3ýõ9ñ3ß©¬w¼~ð¬uþ/^>!FiýóE’FýK ú¯½­M šPaÍÑ&[ìþÜÏ£ÂrêO’.î0!.'œnIÍcŠ>ßl ­Ïvˆî™ªõ_¼i·PRÿX팲‘Dý MqxºeàÇQ± 7¾H•>cŸû9ÕÅjOþÀøQÕ¿ŠT¤"©è³Ð.š¨ilþÞ`Sø©ºvÌõ|¬kAѧšÚ:ª­›G»ê–QMuãÜÎæ?ÔÔ,mNðÇzÞ×}‚‹æk‰h¶¾®fö_|”ÿª¾¡k`\6® >V×öÍJVS†z;êáošÛ{ø‹¦J` ©¦i^nèo¯_ÎOmÍÁ¶Åmuï»&ÄßIƒ}üP74¯4ͪù4¬øªÑ÷.5àÌh/\ÎΩÌ€ üY*TˆOêÆùß-ÃÝM“ÀÚ¹ý™é÷ Τí×Ú¾7ëÈ„?S0¶žt§oÉÁ1=,ÍÔÒVŽ¬Í-Ê»Á²¾èO.›I¢ØÚÁ×f›:–ôÑVs-]¦¹írêš„^ ¤hºœnXP+YÃ&:@Kcçê“›™1“B"Å\Gw•ôÛjêm˜W" âÑ=ÎT2…Jçp͹F4ôïƒÔ5@|ÚRÏ:£ºÊÛçrcĤ“†vÛÖ¡ƒKl6²~GÙôwÑÑ…ö<ÂÅÇ°›Gkž+Þ=_ñÎ"5‚íÄ÷.5¢]3×}Ö^€¿ÖL×°ìS$ÀkRìbN8{¿ë»e#w·¡U\9°nCŒxþÏi€w©~Ì k˜µËQÝwÈk#[høg³à@îfã}×à}eºØ¤w“«döæD$Ñsû |À>àYÝÊùj~¨ƒgVÀ0ð&Gæ´L¡PÕcµQ/­y±ÿÃAp„š!ñJhÑi:“94)}$Î>8l%òšf– Í=ÞîB ;µÛ2´€UL²•úG=dyW†6òë¼ò/v)¢ °b¦J”•¶ç’è b«­u{fù÷J6M¬4€ŸW ”xa­\°±äˆ©GºÒ´•-7H–¡ò”•Š¾²÷y´‘oG¥¾dÓ­EdöŽŸ‹=–Œy{6æÊ«adÌœf’´O:à½)ÔÛÁÄÐƯîa¦·Oà&wkš…gû¬º·>϶æy–ÖÆt×1²ÁåžG< –ejmnfûâÁ–ÿ&ÆAjüdÇc µõuð>sIYfZ¯œo*¹ø¤E›ýoVq…«ŽG=¶­ðð3'j/‡ãŒ‚fÁ!šþΛí²Û=Vêz'dÓ èŽxnˆCÇß©QŽ6Ð,¬)[SÃàéÔ¢( éMÈ{r+•¢Í£mÚœ\íEÝF\µõÆ;ó‡…ºòH\çmC XŽ¥Ý^x»ÀOŽƒ7¬ÞK‹dáñæV–DuóÁ\ÝæÓ%K5kØ_{¶«ÊÀʵ¶³2KMÛ¥ITÔmfÊ6msòÌ΀ðP'c‚µwÚƒ/ÏÙ²ñ&–¶\&ÍÊkŠÍ]ÿ±,ˈñµ3¤˜mjà+ÔôL„¯=€7sp >ö~®<ìkëciÁ\:ÏaZ ŒUåÚ3˜&æ¦l*ÏiSÝ€Ž¿ÁŠò2ÇÓ8Vf¼­G/áuõžuLíWÿ€³»›fL¡¸í̪¾æÀ&˜—ª´}¶†4cK #†¹{ȧQX«ÒyØÍ7£üCÃCLYÄ€mE8pƒN7vuõƒ/òóDk{;2–r¤HÖ‚â£QNÍÁÎÖ9,ÍÆŒ¤ Û½¿Ñ¡ ñòÛìmgBµ¨Auºé›¥!ÍÐÌÜαt{ÒŒºôƒçö‡QÉ$#6bê^Ú1»T·3Áy¹_÷?Ý •ÂÈÒÒ˜aæÜ4"˜ª)µ03 “ØŽön5SàÏă·ˆÚ¦¤C‰fy†4›Ý…hï0§QõœSÑØeH¿×½¾¹nû ©†pëTôÎ uð;‘vç¢>AãVT²o¼—?QYY5+–­sŽ@h–ýèuå«zù¾]²f´ámÔÝy³ê•UÕõÉm²'¸°¹4’eÔ)¹1hmP†ÄãµL¢þ‹Žù•t›šÓQz61ŠÃdúX²·^‚®¾mÀú$uíãϤxàk¤™|{h´©˜L4êŸG²›icà(e=ÓàÄs'Kï7Òío­VçÚ— MËU'}g‚2£Ù–R‡ÐK[]0L´VÆêkêäףŜ·bjçVŽMT-™7Òw3ý©”MpC ÜÑÒÂø_”îOHsÓ±;T¿L·µÕÖ¾…¨¨’w[õ´ñgŸK׋m 8”÷ ½>áÎu< ;ãWŸ²%šH#Ü=èB¦P^wÏ€}Ešúñ¥òÝÅkh8|)Þjiäô€€DàË¡Df¢Î5àÍ­6Ä€spë\q¡h툛š¨ç%ŽÂìš‚«©ì\ ¹ÒîíW1šìÇR‡AO¦ú¾Ûð6ø‘Û¡Zo4ÆÄôëTNWq&5ø\GïpBêãV¼Õìz½ì䈄iLÑüxwÓ¨XÜ+vèS|ÐLÚ ¢µH!“R´îw¦»î¿HÈ߈žñDÚq¶ÛüáÆê©ØEf'þ\t¨òïúkš—ötm8¤«/ШJó¡têÎÒ&ôI©Þ&³<Ç'eplbŽ/ÛÊÿÀÑ×~&Û˜ð)ÅAÍxߪu7⢇eóLåˆåx\´f´1ÓÒcså>æqM7åÊÅ·» "°zºhà/@m¿…©³ñ™ŸÝõ´pe»MYrÅkërýé~¬ q3¬«´YóŸ”ÉX„ÒAþ1•|«6ùvU]¡°l¦Ð‘FûjkêšêCXjÛîO*C›i?ÜúýÕ¨C8ûú¢:ÉNm•±)ÑRI@âhNÊ(íèyy•d`2%s(¨Ë!͇„0ÚlÔãvÈ<½‹˜š/ÛéÝk££]8ˆ¢Ív5=Ÿ1¹iÇÌäX[SCuuua„-âÔõö²u7ßDá_0Ø@&Ch3 ¡š¾e¯4Á6“u˜"Yx˜XÖ7_‹E3õXíÇsÓ0ÍÌ<"o`CBYsÙ‰b“&B?œú€ÁÓ«Gà,Í0sƒåùV¼+2EŸA¿»°ÍÏ92 dι²-ÓJ{Pà`ˆYŽ6ÚVõ´¨:«.Qè–㈠ÌMw~j„ uo¯ÁcTît[²Ã…w 4m¬ãÊ®Gr8—Ñ‚‰gÙX­‡ÒRðGËÈ °õa"™½õçc·i:i­ï{\@6éÆkøùátêáÇÒÑí¾?ÞA@0ž³/‡ÃSé Ç dx(žzNÕ¦×ÍIÑyîiÌzÃ=ŸAh&õv|SÏggRç»”O£84B¯Svÿ¼Ž–±œ‡l%f˜YÛÚÚÚØØ8ºùŸ-y' † åhÓ’§É [¦ÛHRÜ,L÷]…$í[¡ %bAÆ"=h;³à‘´b Û(é1tQCµNFâ\;µÂc \¶\οqóÎM/šú¶ûSÊЦÇBM;k¡NÚ —[‰a´aï– ‘8™“3J;›¦:ΉÑX*àXK)…D‚¶!´ÁZ,™ºyÄÌ,¤r·2³²²2·rm‚¹_‚6[²ºJÞä€3°L=¹°¨(ÍÇ„ ¡Í´?›ôNÖè3‹hƒ³•L‡É:Â#™!(ÖFáØ&‰D àH[Mëþ8‚6®—¥£äÔ,„6ÃKÐæT€žD\ø ‡Åp|!‰%rY9/e"#q1#(A¼Q_:ë¯) Ó˜#Bðò.ÃèPÆ¥‚¢¢ÌHg’'„6‚h&%¼¤QÑJ¼‡G¡1ñbèeiü1ñD“DT(ŽџÚ´œµ×vË_mž(¢Í‚b>Ðݺw³‰mÈ`¶š¥«_9!í”=çÜ7íý<Ú|vx|n6&Å^‡à~j Ý>Rf¬ƒ­Ä§Ú”)•ÛmÀÑøõØÌO v›96îÄíßÆn³Ú#¥D]»Q G‡ùy|7)˜á¸0ë ¡¬_mÆÜõ6–úŠƒ³U”ë6 hs¯½ûy‰Í[–2Øp•L4(C›à"h\yýâÅË—/_¼¬‚—¡TÙ4°õtïËÌø¢¬¨0ÚðãézQ£h5ŠF>®„6— H4]ÇÂèV/³Emnnq5Þš¹ÜrpÂÞÀ.ý‰L·® Û4ÌÊt›Ê‹ºùÐm¡£žÕ(… ×Gƒ ž»¡rŸ²"Ûg½U+s÷s½RÇû_²ñ¸¼·#°Íj¶Á@_çí²Im¶ý|ÐfúE¼6c;h#i Lh—ÍyeDr]ö‚’Kæô#´Éf}Œh¨ÝF"œmiiå+ñôÑæP\y!ë3h³^7{…Ó¦ø’m¶Ðuñ@€~È¥:»Í2ê·ÕÐ?¡Ì øf’ Žj_ÞÐ'¡:R#L‰V±£ø}  Tž\Ü¡½{h2oú;ûƒØ›¤I”sc8t¿«¨Ýf9Ú,kÈ•ÑFG¿Ý4Þ`gB£gÁ3ÓÕó<úJå¥(ÄnóY´¾‹qW®TI{uÇÉÒUÐæ^F€©s2,ËÕ'µô¬jd<÷Äž‚J¸@m™®ZœXtAt²ú¶Ût/³Û|/HÇÖ‚íÆTGhâÜm®¥yµ-`—Ÿ5“ì{ ÷‡êÐ7"U3ô*mÃzãnt&ÿº÷>;A—åÞ%­OnÒŽËRÏîñê¼Ä4ø$ ÖG;ÈŒ(àça¸Çý¹¦.¹z Ð0kÌÄ]¯BNà‡‰ˤqNJ}ô-ÎÔ@%G|hŒ«—¿›!‘nv½!^œ#èœ‚í¹œû…ajÈLj²³\O[³~hyqÔÒÅ!q“#2!)ïå•)¡8×ø•Ô1îF- iéçʵ†ÁÑçtß Á…ˆ3Ý(­Ç­PñzÌÖi¥®€6ÖêÚò RÆý3bûD¹;½ $  §¯G :¸ÅNJ=ñI3-óÓKÂä>Œw ŸX m6þ¸í"ýuûþH ]@›pWÒösïP†Ëvºkik„žûˆ½`Ï}c ÁÈ-ÈÏÙÔ+íEÞ2™w®aÆΓUÇÆl¾l§ípõ÷Å&…eélÇ£í<” ‰1Wðð¼ŠZÇØ! I$±çâOß…ð»ïî7$cÝüƒ¸l#ÿAôÔþÛëtMЦø0—X¸m,4Ôo hó6ákjÜÂLjÇf; ‡äÃä:TÃjÃŽçS ¶&4C+7? ŸØˆn3ö|­g%C›vÎ1døMÿïýU0¿¢WÌD+7_Wk2‹{å5\ðêl{‚SöÚèê“ß#hÓtÿ,4a±±±kž Ó)DOÿsÞÀ*²[¤(ÌM¢²Ým8Ö V¦ÄÓw;u¢QfŒµ½»¿»›È¶Ž`SF¢…Î  `˜~z“ƒ×Áûï„ÚØà€'3ì­¹8:÷Ü»QíYæ±Ò8ÌéáFFn‡!‘7åš3H,K´&9•ðè M]d,gúàÓÏ@ÁA¶X1ŽÕÉ£«‚ïÿ*ñ€en&î†n0KYeOÅç=õW ñ¥'À•‹°"¯²7FI‚kc[ÁCLá—B¥}Æ…g¥ý6Ë+b¥#Wà ¯a…o•uPPÂ(™lƒÐ¦¶\’ÑbÊò ™Ÿy²Zq–7Üç„jð¹Þ¨‡/Qò5Ë0 ¤) •,ßÍö3 €_wFŸä?þ¥¨¡jŒñ¶M8/]£Œµ6ðIªHEK©ïéo3º¯¤½4‰„ã ~Œ.C}‡Ú l8âÁÞ|üKјùôÈ߆…%1(x¬gÌÁÁYP¹v«h©2ˆfN&nÂãˆL*‘jêq³þ‡º¡m üÉÝ|Ul‡ïMÖ¢‰®aêòm’QÑÏDÊ~Øb¢$£Šþgl:Ë«}-mü9f–tÉA…³¾{­ri®À*5©xwv §æ¾í„_0 §#Xf?ÄðýñéïeV8wj-Ö `Q:¿ŒÇ¿¤ô®Õø“§0OnÖÃÞ%®ñ“ulcÛÖÑjÒ%éÝákgbé2*’üpäÏ“S~S¨³•¡c¬®î â2/<ü³ågµÌŸ«¾Êpw[c®ÕÞ,©¥ë|¤OTÆ]qW×ÂvhnåÚk<~õüïØßm²ôát®T*ÞŸ¨F²ÐVð¿$‹£>à¿ü_ÐÙåòj+ø‹ÿý_Á|¹M 8à¯~þãß‚u«%3Û[îbiÆñÏúÔ™Ù³ñÞ"Ññòõ‚Ž¾ZmZù¢÷åw ‹*Þµ(ÔápåÝþFn!ÅÅ·ç$@ùý¢–ñ¥…7_Ác™xz°âþí‚ÂÂ{_¢»5QÉ×OîݸQô¦eX4XUx¿¾7Ûãf©œ~r»ðFÑ­ú®I¨¿xPr½àfMûð—S½M÷J KÞ·J7˜L·=.zÞ;;ø©¤ðzÑÍÒv$¬Ñ»{™\}êñüÂòö Å¡à¿{ö°° àÖýòÁXÀº_‹²d[G'•]É<@!±²ò®×´ÃsŠOïžÞ¼SÛ6´P𩾦R”‡˜áDÿÕ¬½D’T]]"ñasòÁÌkŸ¤Çs/VÔÕšõÖÇÒî2øƒå´ð{±V±eàÀ;]çþ˜u¼Buw L»´ˆ67ªÁwÀŒ °è±´ FÁŒ3àiØuÌ=þãW0ÚœL;M×-¯Á‹™ð ·ž,–«¿ìí—æ%O^pѵ‹hó;-ÿ E\&zŸÂw~û׋h3Úvwƒ(Ê¥S?Ç›Ž÷=–s­´¡éÍígÆkÊïä?BÎìÏV•ß/,,¸Uúd`Z¼°ž.œì{p»¨°ènïXÿòîËú!”Ï®Æ×%Lß®iƒÛk¦½ Âàå^»^û¬âÄîpš¡õõ7ú¦€É>Hº ö.,¯j-ȹ`øùÃÛ7n>~U‡}¶³îÄþpºÑ¦ük7&$â7óŸ·)8Â!VA{Óß|ìS€¶óŽzö§d¨)²7$^ªè„~5Ü¿QZ;ú2Ì€‚Áz…Ü9 kìíÏ.éÌmÈ–.I—™µjZâmE8y»K<5xî°?g}6;B=<ëÈfžoôîýñA4,îÈû% çð«[ñî¶l'¿¼¼sècCñq ¶ñ>VÕá°C×Æ+üĉ_c=Û}ˆº Ìô"R í’Ožô³2;tÜCÏî"\ñ#/µ ìmNæç ïŸÚêe[f…›¦\¾•{,BkÖŠîÞ|š¦¯K Ú‘ròp§u¸>©ïŽÎ)ÉÓ;ôæƒG'¶ºèk› ˆÁÊk‰úÔƒ¯>n›PPCözÐ9Ö®igÎÆû:hâ­ëçÁ®²«A&f!;.ž<}úÔn ‰r2ëRM· *+ıØìdrb ‹OyëzÃÏNéëw¤œJÞ ñp°¸˜8{з9›Û ãÄ\Öž@ gî¿·¾{D MlÂj$\àd:¯{°vV8Þ?25ŠÝ]}ˆb(Üc¸>°¤áü¿ÿæÁ}óŸ ntï[Â×,äï_@#Ã_ý øûßÁw~Á~%êÿBŒÿþBªÿíàW¿YD®øWÿþâoáë€Ëƒµˆ¾ƒ¯µû_ý5ø¯¿LOÃ?ÿå—ào_üDÈôO pÙðJ üÚþ–E´1Úÿ-G¶ÕÝØ þõ߃´_,¢ Ñs2—Dȯ¹“åJ»ì;{õÞǬÆ<¯f.a»/¼æ!;­t¬½žH‹ô¶Ó7p“(6èÉвt 9uâ€!ÍÕÃ^ Gs:ë‡%³·'ŸNÝËÄëe<ïtTÛMa°Ï_Ê®yöäP|•ÃËÎÉé~{‘ MÚvèÔñCö<ªãîk°õpñ8+ÿ¸³).FtŠïYHÝ›ë¬ßã@gy^ÌΟçã¹ø-%#Ëu›²‹{MØ4<׿¼¡sV*Âdsʦ‚ú…ò„3×ç,4­ιҜN5ü¤”ɤ;‰|§®™;ÉVQE…$x÷ûl] –c#OKmàÎP—‚Á£3)=}Ò¡×RÔ}|À˜ê{SAQ¼»/Ð,êzÇ×é•tEšÛøÇ‚¢r™2>aOP»ÖÌ÷ÕÉ”ºAt,˜¡àô1w¬R[—r­$I+OC;ø.š©(Ñ`ö×ðPãÇÓ;T$õ}¾?²‘;V–úcõ,{¥V2ÛÏ ‘ž|šçªišŒjþRm‹¶od/Ì‘ŽE™xÄä@ßezp=ÏÀ¶”ÉÎ2 ƒ·ÇßÁÒÚS-BŽ÷·4õÀ{L7™ê%HÝ„ÕÇ6ü 8›¨9‚%†NË)3 ÐñºÈ†¡Ñ™§î~€OüÜ€+^»Ä)‘¥¿ý%\ev›™8DH+e®ÿvñ=Ùjºd+k}ÂSxÓ`ëÙ -+Y@6þ[ž¾fLFd¦êî÷¤>zcct°þЮWW(¶¨1òÃSts/>Øáa±ã¼ «GÞ׶Cÿ¿ØÍ!ø]—Îáf{Xòƒf8µ7×£XæûQŸteM¶p0ÝWhA%‰ÑðéÌóTÊ¡òÅÓí+@S‘H~jªWÛ Ýr ÌçG± gÇX$«> øêê.žw:TT¥h£‹c5±DનÎq¤8_R˜ß.A{Êá¼Ú…êþð8;ÀÃÕÑ"{V;»F4ØPD¡ ¤]¬á¤å"Ú` ÛæÑC·m7b¯ÉFø£¦ë#Í€’FŒvlêÅóe_8LU'Ü„ÑFÏì¸4„I#ßk‘GyÊ÷áƤ,Ìþ¤Å±=cW@ðÝÕX]’‘ôîÛÏeîQ’&úÚ1r<ÐÔ wÆåÑFaÂ.:ï¬FŠ‡Üx=þÖ¢gªä¸™¦ÏÍ¡µj¥(ÚœG,(Ú8í[4b\ÙÒp  þöÿÀ_AÚ?ø+D?Aƒbð׳m.>GÙ¿Ff4%CKÐFÒ&Et¨Ø…|òÛ?‚Tcðt!¸ÊÊ%JåÛà÷ó'Ñ&¨ ä@üü!);Ü-eh³b:rh³ÓÄ1ºxa;îøÇûá>žNT9:pˆºá7ájÍs¶ÙµÀW¼3.&£a¦·ŒŠ#7ÏÈVÃf«:ØÊIeh#E%4m}g¿Ìk¥²¦œ¦è›Ç¿˜7wVÖ{ %¡ôãR´YÓB䣳ñº6à؟B9R±à- ”F˜î¹ñSµ ;.`LÓOH<è—/›TÞf†·Ü‡¡e´1ø$³Wç8Q\VE;ò±tÂôoÕ"Ø\/×ÙÝÓ?ÔåHÙ˜]+î¯Í¥P,GdVçŽk®ºö2´ÁvH·tBhƒ+ZŠ6â÷l=ìÖçÏ"tæìÙÌ3g릴±8%eéshs!ÊÓ2á$(ÜŠŒmt·P¥h#œSû4ëÔaC-ŒqöëqP\ÍÑUä¡vJ‰n3ÞYq` «´ýXE„cÞºZ'}Òg¢H:»ßÎ~9ÚÀ¡´¼‚HðOš/x" 4ø møà? hó& µç÷¿mòß"ŸK@mdŽv­wE´ÁJ&ÇT]©i÷«ÿ‡V=îCøËß/Å‹hðlÚ_„ûÁ“»^´ø÷ÏY‰åÑÆØyë#ôîÔû«úÚô3%ÏÚ:»LJ7„—Àh“¾ÙÑyÿå…})ÚLwÝ¥à˜íó2œš¯1ÐÓ¬QŠ6ÈbÑX{ANF|ˆ—ƽè3eP3mÆcœw?wVJâÜjZÚÈt›éžüôƒæd-»ÍÛŠ*êáˆ[&ò1+$n\÷ôû?I¨A4õq.qóâûpHÇžlá¦=xìŽe£Þ˜rhs B›éekRÚ’C¦îéwe oõÕ³kEcÍÉjהּ= üÉ‹ºÍ´Á*¢ 8nORË©ÈFCÉÜ<ÌÕŠh£…¢Í’ñòuJ0ÎcçÂÐ|y¯uÀ!åº žœXŒÉóúj Ë0TN8Õ.Õ d»e¤ÏÈ€UÐFºgàöÑc¿m²*êvÁ¨E hso›;+꤬½h&U/­c1ïÄÒ˜¡]98M^‹H¹n3?=6·plÆh þF”µÆ:}1JÛÌÔ,úÆ›kR´Y©É¦û?Ùé«cúGl™^l݆£Ä€«Ò_€ÀŘ’YÖ²ü¸áŸÞ@achll¼‰ÔäzÙ0ݤÑÐf¦)§m×-„}þ¿m 9i”5qì6+œ´´å0ôÒJ¦{˜òѲfP"ª»EeSôׄ6pƒq2òÛ%$"¡ðÍÙ@5£XÑJh#h0P'މĒ%=aö…ºÞ‰ª ‘HL½³Â¨z2¥mÄ­f긌w£Ð›b,Jv1q†çž s6òÝ!@xx›¬fUÍTÃ)¼®C/\I‚ã.ÖwêFæ°{we‘fP;4#ÄçâíyNÛ•íï“<¾œ~¯qúóºÍÚh!ö™ÍYà¹Hðß _s"Á!!ø<¾þ›ÿff_µh·A÷Û@ÿ’.€þ Ä°l«h%û¤ïìI[zÀE­¸…`Å#Ð|#¬œ¼A ø¯+Øm-à÷]Ÿ/EÔ@Ø3Ú —Èb5»Í*hSŸ½cæ3/‹Äâ´HS¼çÉb¨N«kj–‚"‘ðéo"I?&£”̳ÜÞ†šS,˜ÜÁ#ñö—+Ømz[¸ï¸ J N¼NÑÖs¦ò£õç(8ÊëÞH &:_ˆ¤—]pë¼+ÚÊ`‡LÛ$…¥—Ò~šSègÅ1^)%5KŒ8(¦ÛLIÚgž´C%¨Ë‹&`íº‘p¶ïnd^{=øÓSpªÚÿá„R]¸‹«óu`R úÃÁPãX1¼pˆ&xx MìåÇϾÙHø0%E›·YºV™ hS’èet½váéÈÿ 3µîó3ÕÑÇ›ºE5 oÞ´aöB8ÙZfCÇêái1ÇKÚŠ=õ²‘Ñäù7’Û¤{ú¹ÿ¹1OV÷IÌߢ3iÉüíô­T¼‡uŽHîD¸ê¿åö ç˜ m†qúÚ·ê`ë냣ÞZ:úÎiU åŸì¨ q0Â4c§¢Êv´Ÿ²§; H&Úïëj’ºÊ™ê©‰p3ÅãpX%pÏù 4´…dþNÆ6ÊCxrç$²n-ó7ÁAÕ•S=¯|BF²Î×7¬è8m\PRö´r-\Iü/ÿË}ŠhÃE”–t$Äæ}cøÚ=M*¾õàú€ï°C¡žbµt+Ýñ4~^«ÿ¤hs±$ç? ÿ_hYÃÈ„sâ=ò²º4Ï›qRÀ¹ÙNuödéÏ_k‚·ê¥C1¼æõ÷JÐ&áÐ9Ìý±Âí ˜×+<øúÎ,|Íùø cC@R¾¨rh.·>‰H{6ŽjuOÖ]ç.ïôÐÁàYæ-“M÷RÔÕõv¼„µÈªë‡ÉºZD†ùåÊþ´hD¯øcÛ}Éx,ÌJÌ|8Ä_êxvQ—ÀE› ¾8EßÀšI‰ {©x ã¹F¾ë‘j$/sm9$,˲ðzôqÕÝÃDM=jÝø¤¿öo}r•‰A¥N>S]•Ö,m]}kÿ¨iLrŒó ïHíO käÇ[Xc  PêO¯l å’0r»û@y(@ÔÓÖ´ð¤j7›óTþPàêËb«n•Wˆ¶!_9Jçâ_I`YåÑ>ÞMÛ^%WJq¹Mu¥§ýÕàõ°iLj þç¯ÀÿÍZ«ˆ¬!ÌÇŠÖÝ•<”7‚,ß|>›Uê6¢àP³Ò\àO~l^DéhK­]ÅCÊ?,‰ ±¤?Ê,Êݽ€Ï¶ïêå4×÷8èö¨¢ïÖt$ž 4ÔwL3yþƒ'›Aå9xQ(”È#àL|°ÇßÁeyå,ìúÊqÓ·H«kŽ®gú 0MØ{0ÆÍÈòlJÑ,c«…Î d`H6q¹ÈG¢ã&š´]Šh“À¶Ü|ŠMáxy9“ñ„à½yh¹ŸœaR©fÎ>ÞŽ<ƒ]T3¸yÛ°™<û`?®]‹¡mJv2YáϤõÓS®Ž5HÀ†£ë #ÏDZm?p$Á—K 9× ÐFtԃˋÍ€à£ãŽbPÛC]²ñ @2ÿê˜:Æ®Iê*Ž¶Ç…¤¾~µkžó;õžÁ4r§êaîn%²ìOÁ+ÔÛ7ò¼v ßŒÞÚ¾Á>C;Z[§ª#HTôã"á13¢{Þ¢—Ù» |GØô¾òNqA^~^ª¯1=H"šé³¤b#^©ilž˜“‚Îxe6C?UøäCk_–’¨5COÏÙ@3áK%¤VÂ{;›fÐÍBDðÔ_¯ï4,›ÑÝM‰5òI€}”ÜŒMvdu·5‚¨¹e—›Õ¦äk+Úm¶rìC®Ê6Ž 8hhmB÷D‰[j«îÞ,ÌÏË?bCö; Ý9È%x^G]D!m„C'¬m>¥­ÃzNÈæž{ƒ™aÇ^ h£ÆM®*ØC°ȔŊ ÷‹ôåñ×ÚXöÇYIQœ»alÚÂìµ )”·y/8ÝÌÀ³ÚæÀþòóÆn‡E²ÎÀG(Nàð-}Û71bN<—n/m>¹ï£Úø¨¢-ÍEÒÉ‘w>-šuåÑì )æ^WJî?{þ<'ˆGƒ—S=éfÀbpø€äÛè©õÓÝ•¡®¦Lºž6éTiÓ´§âMZæð‘UÃÉAp‡Ðf9€/Ë»"}+Ý=„ݖFd¦‘¡”Œ=^^m œw<—ýš ÄoŒƒƒ*€É›,I\çK…÷ž>ž¿Å‰£ ?ŒBŒ¹ß¾ÄJ\7ñ® œÊ‹aEά‚6Dÿ…xûäЋÃQh 3¯y‰´n ´aû^—jã¯u°ìO3’Œ g»çŒeeÇcÞ1Pý;|äßJõÙt©—_›d¼ï8x[ÇÀý|»?}Kú[i®Í§Th£¢3‰3m‰Ögß.qÐþ‚ Í3_ÍZ8> C,¨Ú,D,œnæ’ÈÙÕ‹)"!ªá*Fƒý^¼m$ü~c’Þ»ÎjÖZªÏ@º®,rXt(œçÍ$y~&¦‡J–™˜€•t‡Eݦ×ZM7óÑXS«¨Gú΃^$X·9lJpÉmDK)ž`ÓðwkGÅüÙq„ÆÓL`´‰|†¾#h}¨C⮎6i è˜ƒ®qt Ê„2´—n÷d„§,ÔpîžÍû¡ë{!ì]÷êZ@8"ê`QCž_?lå/=ÚX…6*ú)Ñhy¢>Á® ±e´'¨é¸. ð“‘žö}¤Ï}åö\*1àüICŽƒë^YÀÏyg*)ëýÐí["Èünæ^‘ÔoD ¸í¬¾†ƒ4( 9êjäjͳKC± B-MÈ+h` ÊJ/àÜ…õizºÜ×ÒÏ$ÛƒÝrŸ÷ÁŠFmåûŽ‰åv*Çæ2TqZ“lx;w[èª_ù$íﮦT¢;ì“Þœå¤ÏE_nʦqw—š~zÞƒe•„^—g„âé¼ÕÑfƒ1œ²hüƒ=S5°Ú€-Ù:êåÒ`}#Þ,õ„\Ø2#ª?ÊÙË3ÞŒÌH7ËÅÇ2®p¥hHæß¼|92«²Û¨èÇD¨Âpn87`R(¦÷ÛaChVÙ4æ ôìÜîÍÅÑÎÚÚoëtóU²–ŽÛγ 0»?Æ›L¡š[X0éÔMqGgDÐÔêífS"ciÁ#Ðö\|€(:]ÎúzXJòc%$ §ðZ'_ÍI´ë«±¯ÙdggËÔ׶ðÙ3 céöÙ]l*ÁÌÒŠ†Ãû%d"®þ¢£¬uøíOŠp2kuÝÅÒÊÎÖœ@bÍ«D•‡kÇ"I¼£½­¹{äHk ]GÇ>òNmõ³ÂàÈ\c£MÛ2™ÂwK‚s õU»š1¬Ýü‚6y>™ª¡Iíá‹ÁÇ~§í¾í}‡/>à ?a¦,è?i»P•f¬âˆ†ëÅø$KrÍ•bÁXå7ê¤&$–Áó܃&t‚µ-Ï=rC6w±Àn°ˆ:Ž¾žámþõ:Æ¡TW‹udž—…Èø˜ò;M8øŽ ªõÍMÕš”Š~|€®8gQ!B¹Ó½²sïIšÏë3"¢uÂvÊf¡’¬•¦¯$w¥A€åœ¯êç§qDi--IPRQ€r·œU+M! @QÅÐ r?î†ZÜëPé6*RÑ ð%žr2¡¤”ÔƒKÑF ª ?·>ÅSÆf 3ª`*R‘2ª¾¡¯£ŸùX$?d×þ•–» m¾PUí%V‘ŠÀ•§f ÑðT½FE*R‘ŠT¤"ýETw øóós"ñI çù‚Õ8Äô@– IÄsóü?W\Z<77ÿžÁ¨`ÊþÅN!Y±ÏI”7 ™›Ÿ—|Ž4…ÍÏ ¾…pH»€€ê$HõKM4??/Z¹Ò±pn^|®žù²D‰º†ˆ/Ê/ ü4h¶³’I£X88=®ÿ±}e‡e\ù*-1ó$|aÒ©%:ŠÿS3úç ׋ýÎUãH'z¤¦oÒ#þ.™z{ØåÙÀ,ø]ƒÍÌ›«~ ù 7N»ê¨‘Ì<]gx@ñå‘÷ë5°McüÕ“LwÓOªV~²Å­½T¢_)𥬎—§“" ÐÚÂã`tu.Ô‰äàÅg"‘t©nÅæ—[ÿ"Y5 @2mJÂU‚àt›³![_jfDÅ)A)Ï@àÇ7JÂþ+9ˆœjºEa˜+ýDÙQJVÀ”= $eÆ…p÷ y\ÝűŽ¯Væl¶<Ý›·ÒÙ Ëy[å'¸ÂJ¸²Ó€Õb%MX¹ÒÁN@)šL|‡jCeX^¯dµFW¾X¿Â¾èÿ:áÅ”’R­~¶ÅŠ<Ë’}{i‡SÄUé[âz6Æj ÔŒ®”ËJÕ‚¤ÐÀÆXŽ(Ü\¡DÊÚa©¤ÉïVÁk||ö—ƒ€(ÞŒãfÊqÛ~I.‹~w2Ù‰FÉ®TÒ®ò9J€U”ÆøÔn…;yTû$tm¥÷I¦.…;$úÑè6ƒ…N߸^9e­cèËàÄǽAö$ F&ûl;9— ?:Ga0ɲ!›QôfÏ\KM Q( *ÉÄ!äyëTc¢ñ¿7Üq︯>‰Ñ7#çûNmó'‘¨ Ñ>hOór”¤˜Ï!©»Zêålaf‚7t®hGÝ#o¤ÅS xãz°=Îr¾_.…Ýp ÐÈ1Ó ÿõïn„¯ß§r¾±—— L¶ijj¾éš[®ü^ßæmn,£ý Y’«ˆ6ðådÓwc2Žf`í\U¼APÌ¿‘¶N&14†‰SÞ³6i/Žgí!âñ=ŒÏÖÓCâ¥çŒ’G9ÉFt ƒA¥»¿•:aÜ;@'…=سÉÆŒ£ÙÜm:dgmJ¦™\{;‚²ñáñGc*ƒÅ$y§o#‡šÍtkkiÞËM¥ênŒÊî%sg¶û`08Có´‚ ªžÆ­ÚaH·ù½šªÛluÕ 8ü0>ÀÓÚÊ Oç]yŠž¾$ÊÞˆÕÓ7à˜Î}Á¥hfWfx d ‹c”û+ÓÀ›UWæ:ðX- cm=Èhïo®žRÀ#ê±âaÇù–gù.\ƒÅ"LŽ¡‡<¥~–D L ù'¦O"NèY>4ñMžM4=ô±dPè ï“pjX²ôDþ(Nocaáõ 's®!‘ëù¦9IJ O&S© žý„¹˜æµUGÕÍ’KÎÄ0È:úÑ)Å|D·ùf£>ªÛ\ˆÅsÊv‡ûÛX›“(iÅ5hÃÚﱌ5Ó½Ø"hÃN¿„%¹NË j°"“nçF!]BÐF<Ól‹‰H¦‘†vAÏÚáãQ…/~¥ û‹f™xµKyE!žÎæ¦Æ#—çèÎwðÍ^cß|Øé¦óý³·]iòã/µõÙs?´™,Âc©W«-µ~€ÍïÄôÑIw6'ñt1\[DaX¡ÑÊÏE0ÌýQ}´¾àÞÈnãƃ::„ÄË è‡G¬­ÂSÑëâDw²w2ÙÚš2Èî‡Ñû/·›êù\„ûÝÍx ËUį'šÒíR!5ÿØfkK©WX¼Ãƒì½NA4y¯äfÿ4,äµéV/©/0ÕA&SÞ÷Ì‚ýÅZÚx—=eÊuŽ&´¸K/QÕƆIÕ2=óPCf8¢N£µ× dZ+r4ݽþ»xôë#,ûð«K€ºò(‘dÚl÷±LÀ}…+¦âŒ=•ÊBêèÖ1g‰ˆ$øüÂvŽS8|5PDR'–t ðPoŽS;÷fœ Q)¾Ò#/» 7a îèFçâm¦dáчq°ëŽ:Ár )RR¸ ™ç…*,mÙqZæÑ0ó¥áºúöÈ eû­ILÞËè2Ò¥¼š–ê6Úº8“@ÔßMœh¢au–áh6Õxí%…ÉCÝQ†gè°Q5àB‚[XÊsˆ‰DSVè•Wh²sµÉzX¿1¨¡›pÂàƒÅSm,äǼÞÜéIöÚŠ»©$jý ÌàóœóˆË“uH#–ëÌ' …„ÿœ„ƒÃª hsòIcŠÖ¶réñ¦ç·š…ž¯ !IÑæÙå ©D=;˲ €†-aÕžuÌXä¨`¾¥ â)eày‚ Æÿ RÒ "ùY÷”ÂJnCa2ÉÌC?ËÍTyˆ6.p)¼–‰×«Y°ÍL> ª›uB Û»ë†å$Ü}æ¢hâž/˜é¬5ð%ÃØxhƒ–}¯´.m±®,žsXÃXG+BІG>}Ozn&ÿU´st±ßHsÓt’ˆE|>$ƒvØ —S¨e®£¿Y:áVŽ6}77jÖ‰WœI‰çš8X­§ÒÆútÒQÍVË÷iyöËTñ17 á@%$sÔõÛ^PÞÄ"!_ oŸ¥šë»^ë’ýäo¦PN¾„Ž8á"=?´òÆ‹Í"DúKÓñžPb%Q¶œÄœE{B¸Ë¦}¹ BòµZTA7ǹæ}B³Œ·0)ËÐ&Ô`óÞ;R¹k=»çÉb¦Õ6³RÊ°`ˆKGÐFÐj¨Gy6*Τô8u2§‡ÒT3£MÐË1ÞÌè£wÑK·¹±bÒØ»´ÍÇ#þGÑdž†‹ýHƈï(èæbÉúàÞ¶Ç\ÃVfi€eÑ!´a’󪺥šÒã@McØU6ž¡ñdÁ cØ^ _Ð×ó•ýnΡR/à#ÜN©©M]ÏsH¶õz¯‹…wJ!8Q·ˆ6L-.Ig:ýw7bÌz.Be)ɶ†réºÈM¼ÊÐ&õnc}ñaŽõVôN3]“VX@¨áŒg'>Ü<3v@SÚ@ú¿…19ó‘ôHâ¹ç vCuÁï¯!Q9ð¦ÀâDz¢2S_‹y»oe;Åm4M’Ñ®<ÛšMI2"âÕþ¨V>.6½vºº‹/ˆZjê[ªæÀ‡Ö‘C¥¡¦$5Æ8¬Ü;„ZŸÙ‰  —tñ‰´{ŠªâÔ˜Û áu×Ñ=P»ÔåGRkŒULálçšÐF k=´²ÝF4^AÕ¡ÔÍH[gº, ±ÛÀ<ì¯^ˆÓÅßÅÁyÝ„p£Çj£öÿoï=œ¢Øž¿áÿâ}ë}ªžúÕS¿úÝ{U°lÎ ,KÎ9(I’‚’³d” AE%(bˆ˜@DD$m–Ì– óÎìÌ. ,ê½ßàýnW]/ 3gúœÓó9Ý}ºûœÛuä¶t¯§­}àêmŒša×È›†c›cðnÇÔƒ Œmrݬ±› ôtŒC²1ŸB"¶ ÁX/ %à’^ ÕÝek•°ma…È ¿cv.¹õÀâ6´¹» mF*½­2n(ç± ØöHÑcþ›2‚áÄhöÔÙ׺°c\ø‘‚=0ÖYat(üí´=µ¹ò„¡A¤’¯ØÑíÓ°Y6pó0! iò„+ýÌ#pÉXQ Ír(î÷°›HyþÓ hÖ÷ѤkAØØv¥+è8¶ ú<'þåö¾7Ñ”jÑ‚WýtQä8/®=êߊ6@ÝqC³ÐkŠ„WSÝ (ÑFÞûHGü±²NDO™ýpñÆsÄo³mÀ&Ÿ¤™Ý+`åêã­l¼¸ØsÄG–½ÜÞ‚L2?7·!ÿtGnx£­NÁÍÌÇF"é[h³¾8ËŸÀK*^°¤\x[+ÉVtm¹ßæiºÑ±}Äü·XéÕ$†çÃi–áHÙÀ{§Bñ¶×eu^ÀŸƒ¦þC©£ý)Dò¥ÂÚÊZÁŠøИ¿{b/å°@Áçýú˽¼Õ­h´£#¯fw”’wúmv  Øî&Æ©Ù5Ó{žŠSXRz¤gpÉãï¢ Xzœ¶—xhR!ÈOëÞ±W—8HXC6l>“‰ÆéÏ´1 >˜\$Ü¢ÜJåñ 4ÊêàI°9p¸¦æ„»¡ 8JMñL#ÿKÈÛÖ'kª®Ãñ@—3½\C¡ 'ÑÖ†U‡aÙÑFW ÿÙLÞ8`Eʹþ~‹ßFÚÄØž}4¬Ü&>ÍÆz§4„àßF˜Qúm¢œðg”‚×{ñ:,º"Gc\dˆXÉð×É:ŸÐ3ÙtT$D2qÍHB²oTÐfîËM‚Å1C¢‹ÜnT¢ÀSG»à<ú’Òc6$S'1ô-| m@ÛLÏxLQ«müÕEÃeá;{šÿÖ–”2þbþyv 8æ~Âg^Œ©¢ ´Î >añTûC‰q‘¦dûÃeÛtðQÿ5 mê<˜FįlSA¶*Úˆ }cÔ„L&Y¸xZ£1´ê~hêDŸ·´U9~%+F˜ý‡ Öfº Éøð´’óÅ V¶þ"ñ-W¸Ú´§ûxÁq5²Çi®¢Oh¤«¹¨:XË$œFÉ2לB6q JO:fŒFÛ&Ü–Ê;²1ÞIÂ੶އœ˜(Ãf¹®ÑnK®€¤Q´àbL'š»$$œ°£aÈæ'–¥?¢Û@”lC ›DÇ'zš’Q¤Ãâ-º x»x±Ç„Š·;êÁrI¤©±¤èªhóÆ’@Ñ  kå”yˆf“hÆ$@h,!à̾ºœ)YC°1¬z7´û-0Á(¶¾‰ñQfd´ÕÁSptܳ³‰hŠa`€'…~;§ׇ¡:顶†Ç“S½M D_ÈPšÝmöXò6–̉è7[ê-Pt±4k¾ù„a´\dŸëAÁcA‚B'a¢ÊÃ2]ígƒÒÓ»¯ÃKOh´G"„„Ýi¦µ g¸ Ú¢Y3ÙùÌ3` Ú-¹®d*=5#ÕŒŠ½tû–>Ššœ'èHÿÚºëð¶~J/Cº…6™a㬠GG·Fî/“k(]árge*¹²8ÃaŽ±óBDò×–ØžDQAA&Z玎MLÍJ`ån}v„=%U1y6Væ¹ì1@¥B¦êç²V6¾ˆéŽy/Ø ¼›3³¸ªdcG ÐÊXáÜ{l”ÍI¤\6{uC ˆ—GÆxJwò¢€Ã›^ø²ƒBÓš—t–Ï›,€"1ªäaC8ÁeŽÊ¯«ÄIÖ!6Øœy!<§²å)›?¯ô;óyð)îÄô†¢ï+ó<Îä2ÜìÚÒ,‡7¯K<ùlð8ìñÙ%¹Ïsj|fê”ü)ð±¹e¤ìŸÇž‚‡TÂá°—×ÅjO1øãr‰BÆ_²6.€±Q¨kð’eþèø‚D´ÌåÍnHá-8xi†Ë›"ý ÁáÚ®±GÇ%[­Žy>‡ƒÌ…|f¹œ©$²eea›èÊËÊNŒŒpבÍñ8{T0ùfA‘VÆ6ËdÓ\Ž¼ãÐ#³<öÂ*ü')ŸÍ^”w\s'yàüŒ × Âþ“œ1PbWgF8Óð‘?<.{qUñ¬NCuÿ—fy³Jé挂r2¶Iìy‘&Óð߈„¯ò³oÿZ†šVÝ ¨$ w5ãt÷©³Ùx¼ðØýýzzzþ Å3ëð¾ÆFsY ¥«§»gâr±m¾—û¶ñ€Ye "Ç7Jþ¯C”ÞœÐÿ]w öWú¯çÿ¿}ÖËÀßœd’U’ÞU·MüY”Z|Öñ ¥–I7X­³Ç~"® w<{ÏþéÈ*“¬76vHtbºÜy˜‚#›Ê»Fœ"ñc‹b`¡ü»^æ]yŒßJfoøõÉ-G¨[Ó©¶PÃz4iÿ‰7jµ©-§ ¾Rš™ÚJ[OK©myû+†¯üw[V·²íVÙà»ÝÂ0ünÙNC}y‡ï-Ie`¿ûWÙîo¿ëšPÝ(ôÚ8ßhm·*»•wx’îYüX½bÿ]žÕ €üüØå>1| ¹A”lN®{ËU«Ã|o¬þ¶hóüÕ0Y1òÒu?­ø~ÿÒëkFv«RDÌzoÅRMâäá&Ò·÷Ÿƒ•`J†Ñ’‡²ÎíÏkÈ,LÖ¡´ÁÅìKkuÕcEHÃÊ( OzÂ^\zUtî†rÞ.¦Y:‡Á‰ÕBòž´û[ªuÉVùt ±»ï…+uä4q"ÎË0Wsä”<µÅZ¤[ë‘HÐÁººŽP™lm¶(ú …L2¶òº÷(ÙáÎßbE´Hƒؤs_ýÁg,ÜÃ>M!Ù3³­¨ƒ79¯¯XÉÓÊç<˜séÆâ©h_*‰`áq ŠÛ— ìf na}H ’jWŠqê#¨}A/–ÈžGb®z*ìp~P i-¤üCŠ‹Úð®mAß[É$ûyå» G¤Þç,ÂáN§, ’Û_™êS»Wáíªe;c\~Ã{8“õf )žHôL8 3̹ºåÌE&cÖ£×2½å[k¿äÄ¢ ÔðÜz8öeõÙ±ý®U¼÷WX<ÉÄé%wyªç¶1‰Â°¾7¼ˆ@—d­&5œ˱® 7•@Š«ýëjD9Öþ*èèdB&QÌ®öÌO²9”ù¬Ù±ð×^ÊS„.»’#ž¼SÌ¢¨†6W{¹^{éaN%™Õã-§\btÅáÐYÉ&a † ¢Í•ö¡K‰Þ"ÉÊ;ž/‹é*·5ŽïªŽó@9çÈ…PtéäQ…HgÚ_hS $Î&0)$"ž{Ö:Þ'šaå;G¯±$Ö˜F"QGN^X“l÷’£´°ªÁ[G¨d¢±Í¡® ,’éÑÞ¶ ?6Þdž ‰~}6 ŠNÝ̤Âq 70èHW§³x‚\ØøÆ.)2‚U›3ˆ4¦Kw=؉VÚ2ÌÂè³ë_Õf-†Aˆ{¨L|’^ða9—?ýÔœgh,U¬jüMDk~C9›hÝ |EÑ¡ö­*×]žµ¾V3Ëz"dwà‰ö¢xÛ¢g¾çÈ 8@T››|÷óÖpë:…IJ=ÑËæ –$âéG4=ÔÕ—_§¦§ÞÝ)$P̆—€õeNQ/áov|vü töÅj|à¡¥¾^I7$bþ.4†EXçoœJñK}ìÛùSSï/SÑy6 |Š!1òê:æ'ŸÒÐèØá©:áÈ…öñ‰‰î¦<-¼-…+þ`¥¯“u«jáÍ°…P ÒΚ¼¢ÖmÐÚ&Ú”Û`A¦hE¼)ÕôÐý¾QÞ´Ù¦Û²e‰Dè„„màa¡¡»»g­<¿Rø‰€6]—²AW>…ì\1ÿ¶‰““M¼<ïX²êhD¬¯JÐ2€[Ê>`C32<ýA%7TºzB5{¾óJÑÈþÓØøòl”3 jã], Kʺúfaq±÷¢–nšXzkaqiìUÆÀ–=?aBrÏ¿31559Üé‚ÖIy aEö&Õ,àÉ8=+ÀÌC²6ºøÙ0rüF’™ŽóËy ¢­ F›ÑfoÝäÂÃ^°å¡W×ñxÚ肘ïdèd?àó'[rÃ(†‡¸¢åùW扒; ó‹T¨„Jgú<àNðF³)†Ñ `kÝ—\HL÷ÚÇÝ<þ,E›SO6@ì¼ñÀèÆ=„öF®7Ù2˜Í›˜œÏð³vƒ¢7„‹±>fG³o‚}•fM ¯çƒ/ç5$[bÕoû<ÊãÌH¦îC ‹ OŠŽ`í䃼ÚÅÒÓ-}Ð?555Ð^MÂÑ^Mh,~–ŽÆÍ-€ËàÜ×&¼q’<—‡s€ˆ‹¾ö†7>þúJ¢É]¬v»—x³‡ÇŸd—˜’Hèò{mÐxÚßm–} Ä¢WJ5Uv?ÜÔääÝ7WY'”µÄæ>?$PèÓ›E{¶è6’霶¥ÊYj‹n¸?j¿¨¨…ËÃæøc{”9ŒZWSÝ©®©âm‡ÓmC*©ôåŒjM“œMgÑ!cjYÛ ¨6E‘t3?@;Ò˜­o¤¼¡ýÂS×ÍDÈ%ÖˆðzZœàBn˜æzNcí+À¿V"[á+’E¶h´‘ê®ÂâÃfÔKí\³ÕÓe9!¬{zºà´õò¿Ò÷ñ&!}_í ì3†D^·ƒ|h)ÂS(nîH—ìÍ1ã)ÎÎ퀟«‹õ³‹.V®¡”hãv8‡,J«<Ðêx1*¼WxÌÌ?YùÔÅX†´QMæ}¥×m@hãJRa|ZE “]ì¹8ZèÓxë€`à©·™Æ4µ²¶¶`2È®ÛÐÄ£î'Sm=l`tæ£WE;œ&å±Lï”gŠé¹þÚ”Åd #’¹­BÜ™$¼cæ•­h3€'¼œ‡Fôé¹$#·ð­Ë¨8ÍÊèðå—Jyñ°ÄmEÑç÷oÞCônzùï>â ¢Oý'öŠS¬#ëº8*H–EM°‘—çÈte‰z´‘­eè¿œU¦²tÓ÷’ºä&‘hò‰1Þ ôÑðÇd&Š©Ã ¿(þîþ m~†êÖ⸰û;ÝnB%Ú<*1ö=±³mòo ÀXQzÀÊ¥¨e§ëOÚLôµQ,ÜÅò,A¥·÷Œ·µËéÛßð‚nC›÷g¬´‰cz%·}máK!d‘} -÷’TFCßR‘³~!RlØTÏš·2Ž'N¯ é~GjÛŽQŽ>‚œc]WÓ¬ÏO5r?ÿ&ìqÖ ’ðqIUÎyöÚZ5ãÛÇÔmþ`| m>Ý+¥˜»íXmBò‘dÿúx?ë¨ÓÊÏ*/ˆ¨mª¶¡ÍƒÓQ,¿DåS磨ßA›×*hãqnm¸½†dd·ã$†µPú¡UH=IεT´ã´A¦{ùQ]‘ •DoÜnIAhótÚäØy_|µS„”h#{bÀ°Y“çmu\H¥»#Ʋâ£;icä_Û¡À6‰»v+ÚLùRˆÆ ^Çý;)7Ó÷Bu’E°±1oFEßù8L½ÔC U뀦( 3Zõ𴔉‡±ôÎøfî…ƒZvyÐM Ã&dô­SÀÖ¾+ˆVñw$ªfÓ7,©M´º’Ðë•»$½]½òʸ›h3÷´tÝS¤¸cnbdz}+Ú²‘Jï}6'•ïþØ¿$ÿÌÔ M;o¥÷–.Ù\ …‡« 挂>ÑØYŸ}6™›-ôA-l9Árî“žÚ7ƒ¸Í/¸êmT+6œŒ°9ÙIîqPõ›árèóU–XG¥ë<ןpó6É®äsöq¡MPìA¥OžM¹ñµgîtÊ–Üü rYÔPϽnB[m;]!ÃYÇ¿´_ÁûjoÏð÷Ñf~¾§KbAÕ¶á]À%Þ„P² múÊŽ¢œã=á¹`µ~m–F®e ¬ƒOMycU,©š»•EÚ†6«#í(¢!{E³'^™‡&uÄlÞ "{ÅÇ·ë6²ž­ kRxÖ§õ,·F¡m>Úïw.U ÀÀû¾ùS =yh|8hнoÈ2õ*…3Ùç;j´¨ŽB…Oᘠ­|Höä(“q™{Q î[–Ôßf‹Jn؃™hÿØòòâ`W#«¨ËðÑ^vÍò*(­È<îƒ&ÚÊwÈe€ˆ]yêtii‘#âžP^Zr®îø‡©ö2,Æ09»¸èd4N[¿¹ªÝÒI'ù•”)A¨ôg‰?o¿3·¢¢¹X\}õ,2‰åK»ë6€teÈ­ç_ÐÔÜXx¯ŽÅçÙ U´—³Âƒ†ÌWn6],Í4¢‹¡:Gªh™õ&Ç°ÔMÍY1úû)÷†VvApYY?Ìd¸†V]¼”qÔÍðÂ-°ÀR”-Üý ¶ iˆò<„TõYŽ1ÔvŠ){ýþݹ“ÑGí°[¾¡ÛôœK4FÊ5Ÿ>d‡Çãr^Éõ"Aƒ!l”®Ä¤'gcñt#ßSò¾¾36ÀÐŒì…bX"§}ph0¼ÝúáVÝÂ8ôãÄí¼aéì#”'~ó:/êéâ“‹/47\=ákFtL”üÚ€`v9Ê’ætþZcÝÙB[**¹et Ú€ ¬öZék%–´Üª?dïíåEßæ%V‡6 €è«£ÁÞƒ1…-·ovñdÂh“wÀŠåq¹¾I*m €¹gG±÷«¾Úxµú´#+OKrÅÙ¥ÞmmN¶/ÍÚ‡±¨üÔ8J;»†^¹vµ6Ôˆétîò†kÂ<™Vñ·Á¶8íW-\­Ê5“hI¶”ïF3p?v²¡¹©4=r¿¶a;¿ö ‚ãTõEk±ûÊâl«…¾4¦×ÑšÚÚä`;¼Åhj§’uѱço]¯vµð45Áÿgøm`Ü\jª.JNɸÐôBuè÷ÑõÌ´”¼ÒK¼5…v²6—”–––‘‘‘žþ?5¯ô Ü`ðeáÉÔôì’w0\IZ 3 {6©uhžÝv=9Mõjj~éUxOê”IÊíh#^ÎÊLïCêÂÉY]ã^:“›”””_Q7ÔZ¿–‘x›³¡Ðh¤O®ŸKMINË)z=<?uþLÆÝ7›Z”t¾©¦())ùäésà H´õ/—ãò[‘oAºq:/½sp^W_¯JKIί¸&*<ÚÒ…¦šâd¨…ª!¤éó39MŸFÅgóÓãâ’;G—?]N­„œÛOoæmü¬Ð);cÒÊaÁ{|ÑÚ;îâÌó ±qyDë^©ÈŒ¯»ûIå±2Ô‘”Õ‹øCÅ 9qyemJ÷|Ï¥ÔôôjX£Zâ}HK?98}‚Ïí©9§äŠ½ÜÑÊ}S’v¿êFÛÌúØÍÙȪ.úš—W‘Š—óÓ¾. ëkgË¥ô”¤Ô“ùOzc¬õrví½!å ¼>ý©039)£p`(9JñËÿŽdQ^j×Wh]ð¾*¥ä­h.#=㋪˜!Y.ÊJMLËû0Ô':$tÉ#z Ò“²Jëd€¤¤ ½ñÝ’‘úج› «œ—eR3öͽºŒÔ¤ÔÌ܇ï8ÈL/²+ò3’“Óïõ‚KšËOfäœÝuŽù¾ÂŒ¤ÌÓÐ9,/ï\ÉLMJN͸Üòž»éOÏSs‹Dr¯eÛܪ&Å:5÷úDJé2oÓ×Ï‚c˜]rž³ª;“I®—礤¤&'çJTMlɽ+å LžªjPÄP‚OmÙ©Iéyg'¥€—5®òÁ8°2ž’–5)Ü4ô§s1~Íà?1‰p©Ãçhð«y¸4\SuUQSNÊ؛Ѷôý§V¸µç.Í ´ËÚugöo?á’é÷åUw%FĵÄëÜiàŸI¢ÿÌ|e™dcC,ýÅÁZïSÝ4có„¤ Å+åðR¬Š|I36)ÑÎœAv<"ù˜óEžiãš”pœA%1£o IÖ׆~n ‹amès_wwwßÀðšø‡ü›rÛW4òåøÔÇþ!ÈŒø›gª*¬ùµù¾^°×Ÿ‡8R@SDCÒ†~&ÊnûA¹àlÿéÏþÓ—PåñÖ•Fwï‘ìûÃñmnw¤éœß}Ù· ¨KQü“å ÿÄÔþ0Û²ÿ{¶¿9廜®.[ög},;Rbw}Ñ÷SVÕv÷¬Õ_TÿÜñÝcyfûÕ‰¶½Lþ†ôÛÏž6 ¿6õÏæøëÅÿF» Rc‡ÑW7GÌ=LI¸­ÆK)y—õˆ¡Ú¥?ý…g-‰üCŽhÜ¢õ½k¡Ã†0uW´«|1+qÌ?Ìâ #ªc|7ŸÂbl|¢»§=‹ºÔ@³€TuB([æv'»ã±8,Ž{zlQ¢Ì\l:…2u•ÈDö&Üv˜ØEIáÎñVš›ž°db¶±Ò‰lž•‰V4ý¼¦ ôƒ|!´ßÝs^?fyÙª²í˜üYQÝüt “£pµÒ*@¹[|„j‹àùØCVÁésÓ|˜T×Á0ŸÈ£ý®¦¶‚Cq¶bMëÉÃ(]|ú¥'¼ñ‰‰qε¬m}|Ò-Üø`sÖÂœ4âdJÀË·2°)|.3ÆÌÃ`ó¶6Õ.°DÙxSï‚ú¹­lϯB8°ü¾µß°}ÁÈÚ8o#ŸD´}ì]’*çÏ“““9~û1]ò¨â`W—äs;}7W»éí'j耸æŽÖ$¸é¢ §Ûà¼÷•'°®‘ì¯ÌBLò»š‰$Ò›¯ãrÎ&Wv] ¤çqæ§^ÿiiÎ25€V­bƒ·á€žãù]ùX—s:9öù) ~Ô‡pÇA}ºUHÀ`ƒ ®pÁ뜛á:hZîK¨„ý½²hc—Щ)D^ÖgëaéÍl!ð ’m*ç'» O¦žÌ/럇/ý’œyׇW²ë;çú]IMIÎ+©@*e²O(‡8¤•¥‘Ú3ù©Yõ¡ã‘‡W2ªšJ? x›Q…\ˆ'ê«N§¦¦æ–Ô|~_8“”Ö»Š€tcyÚ…†·°ð=¾VpE~ÒâòHmi^JJú¹›mHƒÚx®sÕ§O¦eæ=èáªUžûŸ7åd¤fÕŒ®"eëÓ5Å9©©ÙcÂáU§/CY¢W*3[ßLÃ-Kº ôecFjrvaÕ°zWÿͲ“—Ÿ*§B2ò86ó*ú¬ñ|fZjföégýsÛÐfSl€¦š"P>ëŸLßúÚ(i}ö# gð^y $cN¸½‘ç»UÇöScrÐ (z D÷cª2pÕø‹¢ Ú2äà€šº«¹1‡ô´™ŸAÀ™x¶g[RÅÇ™,çȈüº·ïºR¬Œ½Òàï%Ê—ç±®™`0ÁÉ—jʼÍqK;~³Ž¶¹2x÷ÙÙX#p¸d+îd´ï‰¼†¦Æ3:¿ú–|/½È[°å2ì@%XxGÄÚEž~¶!è¡èè…g–ßn¾åiIôÈY“Bh£E° ¶³<]}¹ª ž¼uöꊋZ(Û |‰fn¥5—ŠRBu´ ? D€l*˜¡å’ÚÐXâäæbn~J qÁŸ¬GNQlÖǾ.ùc /åq Ú¸g^Vïl€þ[J°&z—´˜ê^+»£Š60ÝŽ P¡ÓÙÔ¢Mo–ù~ó\鶒[Ž¹>&ãíü¡ dþ¹ è V ´ ¬nS5п3áLtpÕ3'"¦ðÑWåkUСsþhË軡M{< íP±½RØÆ'#-Ôé/⟅6-V4ç˜ÐŒê7ïßžŠv'±äð~N{¿#[‘ÆÔâgøÆo"Ã9äBýÍ ¥éd=ýû#‹J´ÙÙZ¾;ÎÄ=âú­Û§âC†Úè;]øÓh#ænEþ†öSb³Bm`êLb Ü¯ý¢hƒÒ5€5©ÈE;Õð7Ѧ䄩c@¢|®ùç /7ÁŽøsPdå›d&.ô,¦¢Ù—>¾Q3pÒNëð•qxÈR\ôŽ^dKV ÑxÅ¡‡2öàðŠx|6Ê.à,”ÙÙ™â˜YèCµ…O÷3Ò®îÅÓ+ÖõqžôxlD›}ZøZEjá|k÷Ì->–µi&ÙàñàŠüsØ( :PÚ>:ó¨Lé!A¾‘i_¬ö±‘‹¥—öæ‡uþûFÝZ?.Ýn¢tC`AÒmù7.)p4Ö2ÏïËdêľ@>ëË‚‰9yɧ¡‹ºæGà‹…þ.8*ÝÌÌTIÆÖ~³*ß–h¶ŸL"èÙ¨bˆ6v›}[î·ÕÑ;ñ|aÝFRéLfåì`£À\ÏöLÿ¡ (½úÎò£E!´1ÃÑ UÙ6´XVa{yø)‡C»ŸSeB›ìºÍÞ˜iéd½©·¤@ö, l+>îü.“ ÷y^äü,´i=mË´:†TÌâ>ÔÂZÈÏÊ"M÷&·"SqØB7çœæž®öéå @uë¶/ΪìÝ´Y›ì!‰ýÓ"جrÄêý´€Ždw¯¼Ýî‡ÐÆcmd«lw4:´…ó‹¢Í~V¶"ZZRàdâRö˜VA›hãƒiO£ˆ{õw´3D.eêZŽÊ/јx¸éó6@~u5ÕØA^³bþZÛZ^Bœælˆ§Ð¼Ž¤>…CßAY}_±ð͆á¶ùw¾ÖSky býgphØÆ雇&g„(++ÍŠ@Œ{2Œ\úí¤pro®eSí}·ÌæÌ ²ñ³pKmÑÕÉFîG•÷ÔÇÑ·£Íú]Ïbkc:€¬O¥†&êá ±±J´‘,vQõˆŠÜ@臕þ0öô–@f9ùU7·o(þÇy¡â.)ÐÆÙ%éìÆê² ­¨~*¼WÅhГ^NmŽäùX?…Æ„ÉؘJD[„–ÃO©E›²Iæãh“gªgW1ð#h¾¸!Ê%¢ô¾mL–Þ«°½´¼¢ê×꽕ŽÇÒðxÆÀÂ&Û¹>ŽD]É6rOBÖbuh#.²4°)ù°ó»LdìóºÌûihsÊÚ<¸ I­<ÓF³ÆäSu;?Ì6HnAóëôuÝà)¿ÃßÞœN§Óh4*™hž×¹mÆŸ›HDcþ:‚³C]ôœþ‚%¼JõÐ÷ÈÝmbðd*S1š42Žâžµ.•ýŠñ€ßƪXÑsI‰«‰Céƒíh“þ\áƒÐ\–ŸDž‹×Z4ƒz{`ÛŽ©l²…cMlÈž¥ûZÄ(÷ $cnו°"Ò-\ú§Áµƒm¥o4&–0Ã=à=M‰Ö9}üºCÌ”FÈ Aë¾ðøÕË—½ì|õêÓô ä·Á¹-*Þ÷þzÙîÀ‡îtEXTxh;›Àô8¾¹¹Î܆6³÷ÃHÇï(ú°þåãÛkgó,©3¯#Bɦn#YxAÖ¥}Rœˆ»ü(ü““ðK&†;7%‡ºhë’ä–T¬'!¿mnrw¿¼×DG|Àµ¦8½r”Cy>ö¹_ìç¾^ˆ>~æ 6wu–Ô`‰¶¡<£_µu1ÛL[Ø»ô}´‘?vÐS× ƒõ®~˜ ñP+Ãx9#­ g2W+ÙÎõq°Îÿò飜í¾Ñ‰9%Ûj-©·YLóñvKª±}vTúóÐÆÊ<äò 9Ú°á…a¸q?Á –#VNò’Ú¢ù¯Æ8té­×Ó3s‹Â¥;þxÓ\5h3ÕwHdAª ì ¸âúWÐ\sÅþ¦ë2¾»%eèàÿQ>–àh±ù?ðo‰6º^ÅéÏ,FÂ7[,©hŠÎYjîC$Áðîa2åÄ=ÄÔÚ˜¾Ts^©ÌÒb[ƒÄW A¶¸Ê'Ðr!]_âm:ÒÃY´´–È:ŒÏz?dLôU¦ÅÏÈ&G³*Ÿ|ÿtÑSßúTŸrð“òc£‡j÷ì7z-F¼µ,ÔÜ5~Ë·%dõŸÁú­ì]ÃåÛ}ü¯7óp¶M‰“L·YRâ™."DËÓ£|efÜŒ£>öÒت¬;±¤V‡˜çãK-áæû̲å{[›5üï¤PIq }“Å×®h#7÷Ò<ÈÞ­°«'ØTÿèÙ.$Ÿt‡ßFIê½Ä+ÝF˜ýgsT#Pz®§a(Vsß÷Ë‹^ 2P¶¤>Àî^bùËŽX㎖·ÃåN×Íhè‡ÿ²Óo£$µh³6õœ„EÕ¿ŸQun?-‹Àšý;²ø–|¶Ä™ž¬°BŸ?Òû#=ü2 L·tqgÚ‡‚éGe± Sâ´Y§‰Hø>ßÏCáœûFx ŸìîÛ8FÏ’DªÐm@{Ðß–umfF0Ü}×ÞÉp¿9hI ÜôõRšßOòÁ‡øSÌž[éLBûV*ÇD‡˜Ó•ãâÇF9¼°ŸÏ ýP6Ñ2>,¾½¢a¾Yø.Ú›ùÆðçÏŽŽN-B›©ÏK"Ð:è•·¿Ž€×¾^Ë ÔÖ'Ÿz±¸u|WKjþa8ሢ ¦Ü’òʽ2©Êöè(oú$oÇÛaݲ$ÿ<>¥±é_¾‡6nvQùÊq™Ê´ÉZÓ}õµ0鵆ÁKÃ_j’|ym²—H$•tÂ^/q‰5E=±ªX?—¿Üó±fàñŸèÏrÑ<·‡°2ÿÎÃŒŠ#æ\Gê«Ü9îB,V, ²…‘4ŽfævoÉDž|hË â)f;'[óLÍ#Û”‹ÔÜà="ÑYQ¶tèÑY'S*ȧ©sГaÈM±¹'i?ì(7ŽH;Zмü"òV¶¼‚ÓTæ/ ‰H¤Ç7€-]8hšrýµ Ú¸àI[‰ˆgZ&IøÍm½¦!©j°Ö³ o*ÃwEúm´ Á©6†E]äÁÆüÿSj˜È hšR9µ¾©ç|mÄÅöä’#*hc¶ƒmœ£oÑúð%’¦}|KìµLg»H©ìÛhã®Ú £—| ª²ßĺD"™y,»vncÓ øÇ¢ h´M¼Eã^W”Ùpk¡•D3ql왕,|4£}Ëž=È3Ýf€KW†Ã]Lp8rxAãl{Œ¾m™ôÏ£ üJ±pòt\ øÉàÉŒ”Ê9é®{R¿(ízÊÏŽÔ¤´{8ü¶{e2õ‘Û*’m}1°ËùPßî…LÝq=òæK=oß)¯Txé¸WŒªµ¾Tq(í{5±€|¯Ÿóí kw ¢Qíûä'ªéήÁð»6¸K ¼šŽ¨»°ýסŸÁö.‘±²’¦Fædß‘ð¯ÞÒµíÝMVÕöB}w¾÷°zο—¹ Ó¤mþ:° H'üiZî1ywîÝ;—{Tk1¸ñ—Ú‘I+CYd»€ë-÷.Sôö×¾æiÆ÷_<¹baWÇËÎÔýõ_ÀÌêÄËv5ÌtõOi¦ê?E"!sh±º %,4ôDêéô¯åu"Ìk¥GCBŽK¼ûaÐT ø—“pÔ?08dùÇ×ü+|­¾~‡w2×®™( iHCÒ†4¤¡ÿZ(8v<.v Eä?ûw²ŒþdÉ–oÐlïÑ'¥;[*Úf•P!Ù §3¢£có+®®›Þí®[bcRsʇ6/.Žuå¥ÄÅÄ¥µö {pðDÜΘˆØóÛ[>Wv<:¾ºù%°Ù²ènmI쉩9¥Ÿ§•õè±7-é 1±ñi7_ ÿp/âÒé¨èX ˜¢—uo9 k¦½âxÉ@SîRC…¦œuPɧÊÎ(©ôLý‡íßÝ¿Ôañ*šZòxð'44÷)>íÔòN´ùrî7‚ÏÚÖ>KW¾Z`t¼#2jjÎÆÚígòåUw2ÜqÖ5µ§ÓBÐÓ~ùþTçy¬>9­°ò|E £›}K^ F&yÕXlbbÌ0 ^™ÜlY´ðÕ\_;8>¿öBe ÃöÄy)‚å47Š¡{deMMnB€Ž®ñÓ)¨‰ÎÊ£z$Ëœ¢Ê³ÅƺqõÝ?‚Ð}Ê$\+}|rqå¹sU­º;²¦‚üпqöøÔ†OšÍ ý´qÚoÛ«¦†Æòìøä¼h~zb˜#O°”If¦&¹oœ¿"’*×ô¥>‡ÃåÏ,â%6w >ebœ»"ÏMƒšž‡ô‚EÁ$›Ã™š]Rî[Ë6Vø<è†Y$NF¶>Çž˜¤ë“àeoN}Þ+SÃáLکƾ@®HÖ¦&Áf9ã“ÓëH ‚l†Çž^oÿܤ"jh‚¿*ÿžñ ‡;!QlÇ ç¦ÁîLLÍɾT#h#OpÙKÐqà@‰ѳùÄÄK&tü×÷¼œ8ÜM66 ƒÊeDycϾ…{¶þ"ëZÈ:tlʬ³kä20ë¸uE¥dN×;²[ œm!›íÇ(kËÏ‹ XAë æKBHî'îɤkîÖÔº—|øââ­Ã£á{–ù<ÞŒpç”ñU§ -ÎNs¹Š)dÂéqÞ̲r¤+³cÜièðÇ îøœUV¨hzÿòöm<ÑÒ,g©nŒ\ÓÆ:ó5ŸŽ†~Ú4e™±‚«É ÛC™P¤ýå0C"Á("&ÖÍ‚I²:çõ]ŽC¡‰Þq>æÄâÊ£û(a"ù«v¦„¨ƒþ‡’ËË3ÃÈ|]Þç°ìš¢$"™òl Ê”-|5#éŽ)q¡4ß‚—ò/¼p/ëH–I~Uma´‹ž.ëõ:Ð-LjJ:_ÕüÌyS)kÏøÄXG¼!+H^[iã8õT¿gù±žÑf$SûØ„x/ ï2~¥¼GZ8 ¼˜ûA CòŽLˆð6‹ŒõÕ&ûÊцca°§N~@žL*•H‘x"™hÁ„oz/ø|«ˆlë#Sd<ÜQC6tÛ&lõµ&hÐô±Ú‡jšQ×5¹mÖé:Ç_*Ó¿V")¸´èa‰DªDʲ(†gRÄ…D¢|ÝʳÈ? pžz/"9æζ)»™iÊ >N™_&„¯Ï“ˆ„ˆøok‚¹7@ Žî¡D­)Þ}7ÎÓ0¢l­Ôm’%žœ§‡eŽ¯I·7Ðw1Yß2@y¡ôÚ»ô‹FµÑÐ_@›ÓCjþpû”-ÝÄC‹Ô*¯¢¨| qmˆâè{¿€*È\/ù*RÞ&ÝÃj?3B èlA /ƒ“nD¾Ft£X8/XVãBô¬ƒ¬ŒæãÃupÛë£P8ãQP‹´ö௳)ŽqEGW5/#ÊùŽQèSn#’Œç‘x5aÃÕ†¹u(~ynfi}KĦdõ«¡æ#’S)¹sã{n]mâQÁÅo\MñÛÏ8$‡Éüì̺xKZðŸ¯õºäàYðôB"Ë9FiBL÷¶hÆ«Â.òÔ·›'®&þ–Ó£ldÚL9i£/Œ)½D’jGŒkÝগ JR¼„Òc½n‹z[;`Š?ÙüQ—æævœSß\`Ë0õZÇ}°EcÚ·€ ËåXËÈV( »¯î3|F­ÌÇ[|ÊÚ_]˜]X`LÂk×ǒݬX4ŽDw Š‘;¬ñšpv~óШŽºd¦Ãq©n4ô'ÑÆE¥¯£­¥¥ “–––i1T—ïv•¹ïE©BØe‹C—+ÏdefdœÌô¤ëºªÒÃf:ûïL#)Øs·c~§+Ž?ß&/\*Æô¤Û=ðËž­J»@› ³ï`Õ“grêh¿c§‡-û²|-þ {pI±€¦ÓŽžîÕ}mj^@Ñã’%Ž^ïPLvÓƒvþ²äÞc™d:–7(¡¾å gFáyØD›q½5cHuµWE¿“|×vqPwÔ&é ízæ¡×=®Ž5s‰W¢ÍÌÇ»xš‘páñwƇMKNFþíäñ.h3a«½ÊSš*²Ë®§ ýÊ×MvÕ“ ( œ‚Í å2!7Æ“æ“T'ú¦»¤9ßÊòP-Œ/o®d,ŸÃCüìÅ¥¢Ó„§¼`›ày–ÙÜ}‚®ùWñ–ܘÈÌÊk} e4lÌ 'yé~µâ/š|vg긡 ýÝfXnS`eÖË“dò%y¯~@ZU绞ÏC©fûÕóÙÆ^ܳEä~iwÎo”#J´©}ö„Ð&ýNïV´™rÕÕ³ôôSR``PyŸB|àŠ‚ÔÃômh#gf®*;ÚÃů¯çrIy ­:Z¹Vœ|À݉ŠÓ·;RtÛ‚’ý}çÆ”¿nC›Å ý‚¾U%4e±°¡÷¼òÏJôÉæ·Å P2ÔÔ{wÊþ ¬fà{žÙæÔ…Í/ZÐß„#~”ï°u]8F º@ûi³m$«{}›)'p6L½ú~‡"ã¼z𠇧F·Ñr?4܃Ê|‚ŒÁÅhk§¤§ðlÞÌv¶ +#âf²V²Áç­mýPÍ™¥O-ZÔ«åæì7À͌޲8Ú{ûñ+åë» è6R͸†þñÍþëÒºÕ MC&v°I”Mç„Øëè,3›â;ý_îejíÑk›\xènŒÃÒŒìÝC>=Íø]aI±ÈZUaë@‚3ˆkB¢DzkÓó;ä°r½(–„ÇѨ$ª‰Ó•6¹«ùsîÿ»ÏSÉJ¬7* ûØÞ«²#ZZûýs@¹˜I%à¨4*jœQÝ*wèŠBPÿËïÒÄVÏ®´¹2Ùˆ„¥ÐhD2-¦ð*äæáÜýß{hÓP¡ `…û6Ä¡‹%™;>}Tô_{l!`‘Ž‘þûÿ©y¤Üì÷}ûõõõ”¤u ªf°>ÓÂÛBO_E`7v*táµ¼cmmÝýºIeÓrÐXùT¨¯£>¹ÄtuõôtC/½„²ëf  þQÇÂ;ºg²Ó:óƒþgŸ®ÊûtŒœbdëÃ$½ºº›W÷üF| Á¢ô¢.ªeÛ”]O§Ñý•0;ð(ÐŽN¤Ð8¼bŬ"éyöÍÕÿþŸßÌO+ë‹óhÿMDŠô?¨q4Âè¡Pº(bÌézXåë©8¾ÇÔOù¢Ë±Lû4P£¡?E»éäÛÓöwYÄ„ J-X¸»Ç"q[ã[J8¨ÖØÞ l› 6_meðÚØ£ÊãÏVÕökËêS×g`÷2;øÞeô¾qôáÎ2RG€oŸ8XúüS¶Ó%Ûq]Mõ 5#Œ„%xû!¿¯õ0u)O—5_†Ô“dcU¨ŽDbé_*ð¿ìK ¿Ì¥å¥Å…™Ã6ŒâÛÿ’Þ•GM©û¾þÆ4Péó`pöŸÖå…ÎÊÐ<¸B>p1ÒÕ'ý Éˆ×Ð.ô¦Ê¿ƒpû³šÿzL¨\ØV/gá 0X-¡ê±ø_!‚2åÙÞÿ1Âÿ3sÇþ” “-'ôÓE¬ÑÐ÷„sWå'ˆá÷_¤¡¿ i&ZCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! iHCÒ†4¤! ýÇÐÿÜ+# endstream endobj 725 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 152 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 39148 /Filter /FlateDecode >> stream xÚì½XT[–/~{ÞÌëI=é?=áõ{3Ó=Ý&rAåUäœ3ÁpÍ‚’ƒ˜E#E%‘,*9çœSÅý?¡ª$ÈõÞžÑ;µ>?;®ýÛk­½×:HIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)Ié¿”Áº‹ÿÎÊHªÞv굪ÛIüù|$¾´ê©¸Z‚¹®Îdããí´G )×íÔ;]ôUp¤;j¸jô›·b‹×Ö²ÏV} ø\§mœ)_Ú¥‚ÿÉ€S{M{·IÒöÓÏÕg½ëÛØÙRç~êõÕf91ñ$¢¼£B:õˆçÜÂüídääW“ìÎßÇ•/ò–†mˆrûbò?±ë|‹©Ê.;ï–˃¿CI+'¯  '|]foÀ–ö°{Öä'/'³GÿJ+”OÞ£² Ê*()ËïÞ©fäô ¸­f˜“ÑN9RR W\q>wJCþßÓz×´&û0y×î ¥ƒ«XkPï·;ÏVMm¯;&-÷ÈìRÔoœùÄÒSdªSlèg»º¤‰,g¿¿¢#j)ÔhaÓd•®5ÏýÁˆàs³yØœßZ‹†#ä18 ^-àÎKôaF¸'IÏ•·æý^ÿÚ @_œí­ <êJÆÈì‘‘Ù½GÉÜÕ?£z-z~ÉFoçNù+Mü5%ö'avìж¸€äÚÈøÝÆ®ûCÒ»¥ÍêˆݳÛòÔƒÕ {á$£{»ºh+¹ uóÚüä•töñ‹ú4%aþrŸRìÞ­ÛËûŸ"ÇH¼óîŽÎîéæ«Äú›é^’ª6`õˆ!ÎlD2æKP6Ü]rcÈžJëࣞß3°X¯…ÃFÖN@“Kw—Ò­¡M5šE—ÅÜ{¿ˆVãÎq mÇÓk³e;wDÔ­)èKÕëqµÄU§èîi5Ãý«oƸ+ȲJàëk†‹Ît™ç {Ï6&É>ë[Õ£Ó T<#á°žÆñ„UÙ YÈ«\ªÞÞPM9á:4»3Iâaš®NÁ³ô¦a´éÔß¹Ö¿ÕûKEd µŸ½Ù2-a$6£5¯¯56þäÀÀG°ù°CIÆLÈŠñ¯'ùcEzAïÀ`M{§ðçWüÔ-½×¢M¿¹òÎËï‘;ã¯u1òÖ. ­ V’Ã<Ù›¥}hiûÌ™t–ŽÓuž)¡?üTC:UÍÔ1ÉõƒÆ̃‰ pð&^2ˆ,:Žz¿ƒ+N–ë·Hü]t¾¹J&Ín9–iN4àÉEIž’»mÀ¼¡øï_ù+c!¾{™ :KË4öy3ZM1Ú <ÇK‰:®Í¤35Mâ²›Ñßß³a/{uÕ—lv(ÿñ1¦cw/j'g¦G‡…Ü'S.ÔÃ,Οj;ën­ªÊ°ö ê[†ÓÌæù+Y\žéÍ5×¢SiZa)Õpé#k½– ‹ou§ÀÌÕV;½ 1N„6ñüÍæBÅU_]W¨Ùü »±–í¼u#:½—¸3¸|yÚxÜ+•ØK0Ú¸.óWñ²}§oòô#ÆÝÂ?â¾EÙ;£[$Û¬AˆêÒBšîÜÙ"ê.f G\“Š6¤ï Œ®Ve5ÚìÆÄ´r·xâÃ+h4Z§ø›)…¥÷ô™ªtË3à¥¯" ëߦ†ë0iLMóÇõPmÙ§µå=“G?Mþ'ΣÈÍËæ?v!Hôów‹6U7+©{´Û`A%G7 º1Ðòn¨­ÐFÀ?m¯¯w8zm¶ü¢³¦2LßEm\LüüýU¨zc+°•ìºÚâˆSwªýÐÒÞÖík®¹÷*ŒäÅ™P´,ogWŒÕçÝ!`© äîQU}/¨C^;Ä æµm->u4Þ öVV¤ºzŸ¯èž[/çæ-ձΧn4|©T·zņÐFÃÚwm–Ó–0ÚwÊLUñÊ‹þõ‹ùJ™Ún¹;ÝB´9Ÿ­‡¹P>.¶¶[ÊÚá×N­’mNþ[Œ6òv3`Ñ%ïù¨H’mæ¶Êo+´ì6c%™Ã yДüX•¥®ˆ¿û©Ü|;™DÖ¶0:ÜsÙž®y"’ãmp„ðJ¡”/˜)¤Ê2!ðë”mw©§« E£sÜša%«Ñfª.]™¦1.Ö+Û¯(`öARg[ªo3†.(|¶—13ð~ùúÌ1r–ƒHî‘Ê!¢NŸ¹^;VÊï‘Ñ®ñݳXOmÓcܵF¸å¾j_7[‚¢,–np6òfe:£Ú å1X~5Ékœ[Y5²œá·"c{K’H,m°Âê •Éú=ðD†Ñ†®mY\VþæÍ›òò7%/Ž“¨–çPÅB¯à ˆoì×Õ;zwlwOs‚<ÆÅžÆûç‰ÆøÂ~øáhÓI‡Y*µ®“mŒ7vˆúÉåmÊ6PîÃÝx*ñø#%÷q,ýi6œ2?Δ¡}|­ïB?FzÞ0.è/ÅáÕ&àì—{+ðdFÛ$|Æ4#@'êØs–Zd-瀙µ*Ý\SÎAGs¬‚^ÍôR\â».!8<¿rOį±§ÉÉc1ŠÚð—š´°²É­< }EÚyúÕ4@ÐæÈ弑²@¤7øÉg‹ú bŠÑFWa}×)è„p¶–mì æŸmÏ `èïƸkÑæ…BÄ­ÎPEÁ;ªb›² à,tuö ©àþOwÀèǽƒ.tI”Ûµ(;/Ú©zjyë%ãT°|¢Ï8žõ5mzÊîi“‰$ & YëRáj´i|~…D£ô9,$g¼<©t´¥Øcâ…ÂógÑFÀs61 ¸»n⯼9¾“vD<#ªQ íØ<„-þm›ã§<¬)RœÈnsc` Ù¼Ic%dŸ±QÒtéâ­A­KŽš,ÏXV£ à·ÄcMB® „ÕÃëÛOƒ6H‘õ÷Ž)xåœfþ$hSpã4Ó܃N Áˆ= «½%Ú0_tZÑ4¨<ÁÞ(ºákÞ©x¬LV+yß5Ð×îwÆKg7¶Ì«O[‰§NèÓ ¾Oèèíïën¹êÎ 8ßZ6ÎQ}w{{ûø«¹b"‹¸›‘ñ±¯gb°ëŒT|^wvu]÷‘§;O ²árôFW__k±9NæèÓþ5\Èkµ&Ê9¥67fiî¿ÖÑðÊ «à›) íz»•.ä~hnú¸Š>ôC3——xEqA˜ •s>d°ô—=KŸ•mö†?èhY“cSK_‚•XPpÑINÃcll#œCÓmy$<– ¬£ Þ“IõH|³f&rFÌ(¤‚6m,åUüS«ZÅÍøðaj‘÷Y´A¹¼þö1 G×Ô¢ÍÌ™—ë:¤ghj{h³tP]Î-¶d` ¿!7þ€–¢YÓÖËÞm :ä3&`•]N¥ƒÏ,§ÜŒsGs›&·8ùækõ±2~W_Õ•&jú§µT¥èb/N~̳c*ãtçU|øø±¾ºø{;:Mˬn„Õ£ ÄžXe­}訯F­Ý˜à¢µ=÷ñÃÀØì¶dd)ÐŒ@ ’¬î‹ÑF§´¡eMv[¶g%î˹ªDÓ©níèëºàû½‹ä’0º°´Ú ¹.PW¦µ¿æS‚ÈÑš‡ç4Šš®íó÷3¼ÙF,²ÍÅ”æDs¼=º¼•¤`5*‰Ê`Œ{¾‚4¨-ÅkvS<1îkRp,‹Ãìµ=¯ù™ã ÔïŸÃüÉo:êhH¡PL\ÏtÌ 5©Ì3#½…VZTH›~Z¹vÕCs¡7Ì×™©mu¿¤yÜn¨ LYO„Ã!Ï&jã(Xrõˆ`õêùîÁÁbðÓr3íHܲmÔHë3$Sh‡´aŠÑmÛÏ@ÉÊ÷¼îaé’±ºK Oªã0ŠÏúÁ\ï:™PÖ½¼n)oŠ1’ÕÀJIeMyxå”w ›¡3^Œ6‚Bít-!ÚKêϳW£ …JmæK4̵ÙêÐ)ÕÓwË 0ÆU“@ÐoYùqÆj.«Ð†.F" è»”S‡?³²Å‰ßÕ-˜j:çnI‚f…¬aä˜U7,Ú“ò×°ôY‡6Ê»P´A³m+Lt4Õ$“ÉjZfá÷ ¸üOg"ö™"hÿL¿àæpì>Z¥—1GC‘Tõ7vñôµ¼-І `?¶ª3²ñD²Õý"+ñzÂã4k8«Žì¥k¾Ø¬·Êï§Q)LÇ‚¶ùåÑmUŠcÔ3°ÜI&S W¡Ín:ªIÁ¯¤yhØúnó˜ýŸX𹧂M÷€äs¢‚É$î¢Ú÷<ÉY¯Ê9õÞ©›%Ú‚É×½þ€™àóAIžk¶n×ûG$zHêóÍ lY ‰þ[z^¬O±Õ‰½ÍÒ¢½¶ =÷Ü .Q?áÂ/Ò¹êçªÄe~©ç‚`cûÖ8Hö)Ù–X i$¶7¡«616M¼YIm÷ÆYs¥cÃÿ£ý>GÑfÓqâÍÖµŒüÜûf–áîæÆ÷멱¡¡‚ým.ô½ÏM»EP"d6Œÿ´FIîÒx]çôW1œ™÷ ‡âýû¦vþ×3¼ÅÚ7¥·N[Mάð?Üßjkb¿ U³ ãI;b]=gc´ õ4/¥ }=•,ºÜÄÂ6¥qæçÌß#êZúÇBÏÆgù+Z°{ô í½. -ƒ¯[‹új”8i'mOE|m÷•y‘ÿÄ­übı4ü•±‡”¤$%)}= Þð&¯eŒýÇ+££¶òmÛ€`e¶´¤xzL´”””¯¥’ÚÀ_*-Þ/AHô°†½»ç+ ×gPXÐ5Éã³çJJŠú&ž"ðßÎÊüÂZxo}]¹e•u£‹|a"Þxi^ñ(gÓ¤¿ãã›×¥P½ªë>ΰ?uÝDë»âÚ&X1zWX$¡îMƒk +³#%%¥óìŸf-šï¯)¬Fb[°g‹KJ§×¹Y¨)¨êù/a#N[]EqQáÈ,ç«bð*B/¿Í¯èúÉë±4ô¶ ²k{})øUþ–°¦÷‰—²uè±uþí&îQ‚ñ&™Ð0*ž’¨t K«Udépò&àŒ¹ÚYC·­­-Õ)$²º¡µ5üÈjï©Ù5¶¹69%5c‹Õï[˜˜¤¾‡Tjî g]"²W‚ŽÚBÃYfâÌRñô"‰Fßëä ‘£S¡"OËéB°c±„ºŸ7-‰Y9£ç,ÉP…™ZúfÆújªtErJp3º,Øàpº˜)63…«diaL%uŒÐæYÆ6¯ÎpüýKäÜËOc¯j{d£dq¾šþ¨ª¦QÓ·~½+ÙNÑìÎ+ æÆ+âiî~Çê{ÖÌôÿÖ9ŸO®¾O7‰Ø~wg9ËÆÿä5Èp”3º¾ÍÄï/jÅå·þÜØÏ¢K‹€ÉíZù,WHÜÍÛU#È8bê—¦Úhdbó<(ÈÐÞ»¼¥zÓTÅ0þÝ&aðkÝ›¬d‚™}º*‡/— ¿Vütä÷F  *ž2´–Ä9ñ—cÝLT„m6]ÞGg蜞pkïzË)1Ò‡Ö Í'b÷èâeÓ;$Û7>¡ÍŒƒ5¡Íf{ºÑfóW Qˆ6³6Ô¹95œaz`[FŽµû韱MI8^!È„›uf}ò%]û«›d/áÇF´Ù´Ç6>H¬¡`5ÚlmøBï\ЦݫüùYÆêbMIû¡×£Y¶°¸•ä}`ß^¼éXReÑí“û÷»ê‘1V'îò‘^+¼ª­FÖÒÕc±6ž!Èš1\–hªŠ'«ëêé›—æý‡œ%rsPû÷ÿx:º´f\M{Ý–ÆCƒÃÇ8(Ú8,lµÞðn˜¨ƾÝlIßÔO á»™w JªcàE€=Åæ±Xà"G=”+N_~Vw·U8tÑg¢JRÕÐV£’-ÝOõÍr×È6“ ²ò˜r$˜ÃÛ‡çT1ŠšzFæŽ~Ù÷6Ê6·õä\Ò£DåÚøÄ¢Ù -YûŒUiê::êt={ŸÊÞ¸¹¼CUÙÀè$—½Îûœí 4õ˜ô·kg” ûî –:…F333)íâ>>Eaø¾°Ó¢ì"à‰VxÝŒEa¨k³hd3·ã“pˆ.ä°5GÒ×Õ÷ Îp4Áž¸ÕV&hx¹˜Ëñ..n暪zŽoª_»;¹ìs²¢¨é&W Ï¿%G¨‘t H8†oTZ yÏ‹©nŽ.®û©4FÀí"(qßãó 5Æ25¶n_]¯­µÈšztÕõL¼øtÜûä‹Le% =#3{¯œNrd›¦›Ð(܉8áæäì¨OSÙëwå”Ѳ»VštKKN6rô}?ÂF3L;©FÆAb0IÛ6µ¶­l#xæ†Óñh›…ÏÎ>Šü^NÓ××!4/>„cž¼}šÂƒªùšD2Qo`=g,™Ô+/?v¯µŽÑ­wèHñŽiÒÜË× ÍÔ‰ZÕ;úshɽ/¶h¨`•ÌÖÕ¡5.·¸-w*7©b,êb 'ž #ž0‘7¹/1|¶-AvçÑû½ŽÊêxó7¬çï“Ã&BÙ&3ÒˆB7hYD%½a{ãø7Bý3jŽ×`,ízì¤LrFc½»îLPQ xÐ ØÓºtm¿»hb7SuÖ~T1{zÂQÿ,…ò»ïãäè/„žMC® 藺à¿OƒjäVlAG°íª7É êgAŠ‡žú™ârs¯Õ±„#½ø;3|Âó…•HÛ£bЋŒ@æe=»ËP‚ò˾‡#â{*¯“IŽSPί®5 fØ« Ò–3Z/Ût>µÅPýçE-Šv6³:Ÿ Fƒ¹‰ÑÁÁÁÂFdOÖ Ö£ØR±žÆå®Æ0Úßè+»©¢jÔ¿„‚";Rcó¸S\Jwt&àOY3¨·‹Ûfvv{®2Y³oN¼BYm‘=]EÝŬÍoÆŽÄÓc¤©ø5kÑÈroàMx‘Z+ (2ê…“šßµƒìº¸e¹åOÚ{9›[-¶£I]ïÛä}ø/?Úžl˜eÊ"¥¾/O/)$†*Jj&¶îOŠÞs…ñ‰$£M]¨‹¢É÷’d›³”Ÿ@¶±ÃšÝâ‰^ƒf}ܳ6(ûÌt£¨bxÑ5!»#NXüé‹ÎªáÉ€àÈè(#*ó´D´Y.¾uFÍô‡/¬oçc h“l¿ªÜe =mj“ÈdíþQÔIÐa ¸ëvŠ6¤¨t‘ѲóÆNœÍìØàìøñcGO…fpסM„¾æ4aÐ0Á|è~eŠÞ‰ Á‘Q‘ÇMŒ£Ú,xñ' Ħ7Á~s¢mX¤¤×(Ú„ØzF }Ð:®ù!)”h¢M “Ä„SQ©[BPáïDó«æ7”¹GE•ÝÄhóè´;žüéM"++ƒïZUOC躋ÁÀy¿èõ'ŸÊçÐÆAþu{m³èç;v-ÚdlD›—AYûÏm|±>=Šªm¾ Š>Øo,' m”´Ã8"Ž¹¾ßÂðÔ v1…H¬¹ÔTž2#Á² 7LlP¹Î ¡ Å4¿¢Ð‚¢|ö*Ï,ž¤c¼‹gÖWˆûó”mÀD• NõÝØ’X“Úmx¼©÷ñwKÅ“üÉW‹CWÀò>Ué~%ê*ˆ÷´T`@ÐF°²¼Äá 6C›Eþ;YŸG›«›^Œ°•î7 ã¤k “£ld%^EÚäÏHxãFWÕö›*j»#ý{yÆ‹ É{R?màìÕPŒ¹ûË4žEªÞZxƒ¢j2‰°;¶S—FU;™! m&Kï(Ñ „²úÌ1U v›h“ÕÆûH'“²?•¤‰Ü£2x×q°)Úl¥I­B›Þê$2Eo1bðŒ™tU?XzåI"û‘„=üR«°=´#Ýw3ýÄ›* —>ƒ6¶QPe^_–!Y ˆ†e¬£¢¢^]¦kR”©ZíÓ(–ÌŸRÇËo´Û<µÃ)1æ„»’ûÍèǯM·gRðêíK(¯OÚéªÑ‘¸:­±æ²:—„+ÃÒ[Úïe2'QM ¶ÛŒL¥TÊzá)Rª«ly]´Šó ³²ûf¸(ÚÜDÐægäµcÊ ‡‹|;.¶o‰6\g„IÒµr ‰ˆ:wx/^s«vš~÷=µ°ýóQ±þöaáî²TT“ub(G–ÎKDáàè´šl|{·o·‘SÒ´vt^ý¾£CäƒRÀ™µÑ¡úÝ*¢ø6€Óm§¬àö°ë³hÃÄ`ì?eéâsN@ceøœ%‰Dgê™Xìu°ÑÕb)ÉRÓë…!þšô+娑LÖ;üÝ äÖá0x[¿À¸°“šú– ”pFñ¯j»žl°ƒ…}y†¦É¹‹¶zº¢•Lo ¶6ðÎÀwQõxpLèio:N1¾ üh´áM6“°x«Cçâ#ÎhjÖ?uSPÑÉ(጖0x‡ƒ§/£køXšR¶‰6Јž²eÒõ,‚"£º˜++«¿âo6e÷ÎáéÇŽù5Mpœ0¢°tφDõq&(wߣ«ËR¨±"et&ðâ^CÀgƒ8ÁÙgqÎÆÐ$ôJìa-yƒ†yÀŸïg’fß_ÐVW¯Iö‘ÃhG>y!àMÛi‘Y&ögNÕe’ög®Û“*6Rd™„:gaÀBаr‹ŒŽô°Ð’S±l‚§Ëò ™jì|&2ág&ݼ¿eM´¿'˜Á²”—B‰ƒ7šõ4{B$~”?R?†nsŒ–¼LKKËxžÛ:¼ Ö/^礥¥—¾ë4FÿꎌóbAÆÓúA 'KG:ë2³²2×RjÊËUÑ\Íyé9Ç7©õLNjÚú÷3ÓËßõ,6d¦eN±×óg{ÊÓ“_@ 3ÚY÷ìeG¢/w(;=cuv/ ¹«N†t¾¯~ñ<+#3«àuÍ4÷“J5\ÿ:£hÍÇܹW)]3’}…—'û ¶Ï q‚¦;‹ÒóZ„åsó_e~ìA×ÞP]JJjÝħó‹Ï3Ó3žçõÏA8ºXø23§¢i¾³0-‡V¦ ºÎ#½Í}û<-5£¦m”;R•–óa]Ufº r›W—û¡g-¥¿©æYzjzÖ‹½³¢~aNæûn‘Ø7Ûü4½pãY©ñŽú繯ùH¦=9/^w‹¾ß ¿áš?Ëí~.—¼Ê|Y Ÿ¤šímx–‘šù²º}Àœø¸ðV^eg¶#|•]_˜Sö^xz¶©<³¸FtÐeé]Y~zZZÖË‚Þ)áGeñ³Ê¢¨3‹=Éé9óè9qÎtáóô´Œã°0Ío®)É€~=ÕÜ?-Þé‚…7ùÙPU6 ÆkS_6ð7ÚmÌgº_d¤fd½êZûØ£-/²ÒÓ³^uNBàÍ~“›™_ gÈž|“ÿ"==£¤º]/zŠSr›Dl³’Ÿõ¤¦ÑÛ9åÙ©iiÙùo¦8ÂãOµdg¦½(y÷s‚¨áÜ…>æEëÂûu øœ”[‘™åB®(v¦:]R’Ò–4ßñ20ô‰pp¡Ù'ÿð#ç«­-‚6 ÒQûñ4’é§dÀý Õtç 2oyÀï ƒ.‹¹S9#õI•ÒÖ:ùk®pç)Úü4â D}m†ç¸?&‡é‘¾–ææ斶䄿4Œ„”>Ë4¼Å鮶Vˆkºz‡x‚¯šiV¦ºš:'¤ã&%)ýü¡Ib0Ú?ÒÒ+ù§@º‚þqyeª³gˆ¿j|ó|“÷™!ãO÷wwwÍ-U‘ù~XðÄZ·<Ø×ÓÕï{v|¨§«kt†ýC˜w;¡U~en ¯§»§w|Vhɘ›û㢄-¿îgAE3诿€~þD&€/Àò3🚀ÿ¹ÕoyÀØ”þøÅŸíï›õA#‰òdY¼¿/ò¹¶˜çÙµ+øº/£vç^£é:H\ë%zè ¶ ¶–6~¥a‹Qy±êæÑ'þfŽÿW )2‘#“•4,mP2dH Ö ¼ªOK¬†]Ùó݉Yå×½PO=ÿôF{ú% ËnQ^œ¶w¿”æXdlíÔæßt˜KW¡ôlC-ø 1…yÑ!´Ù¢#kî19pWòôX›rÝxDèìqN¢ÉÛ˜ü}rõª´ýv$Š  £¤LÐœ)Ï»Ûiçš4o¢— 6UÖþé;ð'ÿ ²Øh9<ßÕâ7Y)›³Bÿþø sËÚN ÜÈ–ð¨âÜ^²x[ HÒÞ\óo†feÿ=Rtì"Òà÷ DT’™ly&¿G­»:æŸeÍ¡;-ÑNx2™J¥kh6Æî¤ì¯sÏD‹¡,+£ãtv`í¾e÷•N¡ÕYŒ¬†åg(ÄCùG,Y ÆgaácÎ~u‰J&íý"úçÐeŽä‰Ã`Ô˜:+¼¬qžÑðÉ NّߨªL ²15ÄbˆÇnæõ¿¹çbk¦FÄZ»ÆAˆ3ù ÌJ¦0(D-‹ƒE­È†Ö[¿Á˜6ßt±1ÓV£¨Yúv,ðÆ“I2M®ñnv-,ðÙÙ·XT"ƒA§0 ®>«‡î?t¡ÐHª*SJWSW£IÐÕ©»¼™Ö³nÆD2•F!jXy•£'UüÒÇÑzª:ƒFV5M,‚ÏÀ¤{Јd2Ciy4,œ8`…§iE$>ož[ůӶ¤Ý×Ð~€õe éÃÜæ‡ÁW Y¹2åï}¨ ãù×5ÿSáðšù6]›ISE+F;z»s(Åò÷Ö÷ÏZ+Ñ ¦9|öPý)WS«e‹ôs$Çìöë8ˆ(tu–^÷k.<`Ê$ÓèdÞòà¥nDùkH øOknÃa¦8ƒÝrQ‡aKEJnáE%­3è÷c¡#ù±t3çÃtÊD¶Y©UÜñïÙ-kóìD–xHä€ÿA ¾0¾ þ |÷/p‚çÑà7<ýØl¾pVÖ=ÿú§ðÍß³ÀëS🆀©0ýŸýœIŽÆ§R¾ý¿…è¿yH{äÿUøSNT ?– ž†Eÿ \BvÖÃk²ª˜•`Ÿ+8›³n‚ßýHš¿¾Á ¦åŽ‘ Ÿ#'c;/À×$áC?à~¬|{_xzIßðT%rÚ¨N‡ÆÒ§RÛá/Æ‚Æ$;’ÇKÐrm'ÉÅŸ;g¬lQMª-FAAÅòx r{ñ˜ºŒaØÇu€ßüü $Û  ”Õ”BÓ«BŽýs&¬XÌó™hLþ Cuç+°ÃËXÎ!Œ¢q3"¬VDÚâT”ŽÝD¼ƒåäÏf#G¶Úo*+(êF¿*Õk!§ß —õ8À…eáƒvýÇŒP¢šÎø2ô?–WÀ¼Fë”`«¤~^O o{h˜…o\’:sO‰zˆnΟ¬Ô *<¬š‚.£ ()pP‚¥ÁR*Nµ©a†3N7\è?é§lÏšš"^½9ž(/VW‘MþÍî95¡¬ëÓµ2|å˜#ƒJ2u¿Ø22ÏêÍ©eìA|íEŠ³j²>¥së,MпöÂôçµ뺚=VAS¡7#½;UäŽÃÑâs»ÑÇš:~½~raŸ¶Ãq¸uïcåeÔ^"§&{ž)))«„§@Ø!M"]¯éÞ¢k*TÍv$àgv°–š'ì{û8ÈÁlÿ-´ÜsZ;½3…4/B-5¼_†Ý)Ïò8üõ‹ïm3Ÿ²y!Ú( §¦]UeoN–kGõ<®½ó¡ wi2#5upvíTê| dи˜ÞwRkøú/ÿüíÿ2¦ / Q7~>ôw:|€ŒÎb‡p²{\÷„×€v"& Ê÷ìúgøZiZ{5ø[H¶ùSðò l0IŽ)ïÁÂø«?£ Jß‚’4ðë?CAx.N#£ Æ'‹RÉ÷°ÁçM$|ý  ª@¢êë»ðÏ?KŽzKæwà—HÿôßÀ£7€_!²ê›Ã/¯eY·þJök°ÀùæЦíe…¸h§8&ðÖ¹× gâÊÂtcÁC m²Ã‰g`.Ÿ´‹UÿÉ–ÄÔ•qÎÝL_§ - ½¦©ÐÞ#µ™.ô”Wq¥áp†²g¦gš“.` \¸@{Úî&Î1ÂL^ˆ6>j–âÈrC抸ÐÚ‰Õhóà’½™ÛuKçtv›}TÀçñù[ÿ¿g¯t¢jQŒ6ù£ì'§펡JY¡’fˆÑfSMŠˆÌ¾'J–"–Û?PEð<Ƨ„ºOsüè?‘!U÷©æ˜0™ïm.™Zð¿¾ÿl,Ê¿¾ÿWÿ `~€_ChógýŒwk¬IÑá º`¶ üò;ð+%PèÓ‹³`rF™¿„_O\h'Á_|öhÀµ_zßÿWšÐn³<:;Aßô¦ŠÕÌ8xq üÓ_Àr—~‰´W¸¶ 5ÜI¦ìi]=€ÿ­©T0[½ÁS4F–@òy'ÏkÍÙnö µ€]GÅjõ/óï%£ÍÂ'+ñˈ,—'[¡Mœ±ªÓQðöãK¾‚ª³‡Ÿ¿Ÿ›*ý„6ËGh$¿çMâ×Û’Äh³ƒzX$U·iþ˜/’¢õwz¼„Æ®E_CSc¡¤®ÎT–•;˜7ŸìÆšŠ¿øþ¡ Áv Úm&œ”0g*Ån¼[.º÷aÚ€6ð~Ûbw˜ß^99}K§‹·GaÿG8tY•É£¨süêÆÐhf»kcƒŽ«3hÇ®V• ÚnZù§-• LÏ‚í~ÁmÚÈjsĦ¶G‘4’­«ç?/;²Œ6W÷[Zž½%®IúEM!ÚxÑËE¼¿p‚®´ïÅ D´’Lt”ù9êïRÀ[:{]IxÆÛr×í¡+.àÝò*´Y­IŠT{¨Êƒ2A·¼mÖsªmÆ>¡ ã¸pïf²Pv¯Ñzþã,šçáë}EÆh{mB@G<"Ìø‹×XžùÓ¿“Ð’È¢ *Š·¾‚ц‚®*àŽ¨ˆ_‚:H¹yð¿¿øÅšÒÿâßáZ-®E›Ïn]Ue ð„ó¿ …´µÇ Þ â“ê·¿ï4”Jx5¸|Üœøhð¦Ëú‘#U‰TÃýðÇ”2´yŠ&˜î,$“H•¢ýó꓆dï›Ðü:Å$y¦÷½·9îÚP­F›¼õhÓk"/swlC³ú¯F›ÆÏ Íì!¢¢Oá¸xQ¶ú¦Á7C±ÒPœæa«£`|  ŽR1‡_oøNý§ÐÈ{¼Åîåg\ ILýÃoŽ6b“ID·­àö÷™Éa{8_ˆ6Z¡")iД°'²@¨ïô§« ²MÂA+ãS×Ähóä8]ˆ6Þ ‡3ù"ÞŸõ&b|‹†7CÑL™-I»n©MVõÉÜbJ•Äù§ ›#BÀÐQ¬žó5`\Íô¾¥/AæYáCoü­Ú”ú mòBóŽP—éZÚƒÁdø‚pP4Ù'ÁŸ}þ÷?XsÜm„rÔ ˆ>È*ˆâó—`Zþî—pnµª,D:à¯÷ÖÁòxH‹ÿô'pâ_ýLs¨ Ù!Õ¸‚TØ}û‡7¾Zj¼j윜kÈp…m¼†öÅ?³Ó¥0ï¯E›6Ãï“É­ÔZÉ·ÓVcº gr€L>òL4 5ºX¹m£ 8o…q +ÚZ(ͯæBS⇡ xåG%¸¦ å/î‚¥.5äI­dMŠ·Xúìɸ8Êr CF­€×gÕ°{‰t1AmiÅäŠE›[%°Å˜3Û¦­J!iY¥UõŠ÷pп§ö±<ƒ^¡¿¦J¯)¨ZÎòvͶ¥I}BNS—+Ú̺|Ä”bì =jŒtÁXœåØk•ÙmÔõíO ÷¡fß’1Ôçýó’5)öHfzŽx+±³ì…æ0Í—¬I­­¶mÀÛÔótëP&Þ f’¥­4©Ï¢ÍÞßÁ?‹\ 2@Îäœ@´ª—ˆ°± ýæ<øÝ_ í6ì ð·4òå¥|_øþ¯ ®Éæh3Rìt@z½°>® ð[•ø¿ð…3ª¶m-r‘m²áûÿ¢ Ð¥u²<} òÖ!ê¨PúÕï@rÕš-§ø¾m \–Å¿Áס¢wŸ?©Y°¶õ Ï\Ï3U5–ÎÉû¨~ÒJŸ@¢Ü@#5®B›ÔKî$M‹˜ËQco£v~)Úp§ÚÈXìþs—Ÿ&Æ;XæÝt’#˜'Tr†^Q”ñ>ç.?¸m åbiNÙ>ÚŒTÝS’ÃyžNJ¼yÈN[…up†Ãß mª_ ÐuÃÂC? ¯œå±wtŒŠëÉ°'î±7RÒ÷ŸK´Ûp“}Yª†6aqwîÝŒu±`i¹œ{iÕÄ*[yILJ¼à³WVA§ršÜ‹¾ ¢–“ì½t>o¶¥¿fºZl®¦¨¼Ïëä¥Ó>Lætj³¤EŒŸzÐÀ*¢lÛ² ÇU`ràdò“DkÍ›qö(³â¥¯,|0V‘±;xáу۶†{ýýuQ´ õRÕ²ò·ò¼ððñýÃ6$-ŸE$0‘m^D&±L¢£"çfOã =®Þ¾wûJ1‹àr£±Þ4°s_஫÷r¸–ÿó‘µ² àÔàqxÝ0ÔŒÿ m–'›¬ŒtËzØ?@¶I8ˆ^~vÿ€EÐæ»?Ðð¢ãüÝÿÿô÷ÀJ¾Ö¿ç–yÙú{°ó÷Hú(—mŽ6KC°µ’gdåÌNø­ÓBÞÿø'ðöÓ.ð·ëA¯Ç•ùÿ JGAiüó·—Ö¶kœ‰-}’ÄøÃ_ïü òWÞþÓ“¿ƒªñ÷`þÛ³Ãß`Ï^‰xQƒZ8­Ïï] ¿' 4T™ÄFûa¡÷vthXÔõ©Þ¢€ð¢Ð¾ ©øÆ•oסÍPcqôÕD6r·µôfLR8øÀbgYlTXxôµwCдXz|=2ö,ÕŒ~(Œ ‰ˆKæ?{âñÛ’¾º•*êÖѸ -¢ÐÃEמ|ÖbyèÝØð„”4²˜~vkV4zƒµwÃo—ÃÕY™¸v¥kš¿~!íxt#&8$ìNJîŠpè¹×£žÔÁ'Ó–§Ú¢ÃbDõAUnJtxHhxä£ì2ž=–ûSîÄBÕˆ½ótpY˜-w¨"624öAÎÖªûòxsB\dXd\Ñû¡MfAåͳzEëî²g:£C£ÑɱÔöôR|O¼«?Þr*;,º¨‚e~áý˜°ð3\°2Öt-*,$"þã&š,8$iîȧ“­%)á¡Á±·SÇE²Ë‡¼ø˜§H”ïÅ„Ë¡aWGø€7ÿ*ùnxXhhä•-hÒáw…áq·WÖOcg]¾xÿ-j†š½Ù2‡î~sžÇD4Œ¡‘Øi—£JÚaÃ8g~ÀOŸ”×¹m"|Àþ}à-²Øt$€ýûÁ•ìOõ$ <‘`Åƒà~‰h>¸{Åà5²“e&îžJpòüVÐU0DÇwà„ ðö3f6¯ƒ :OT)<<ÁAop=E¨ù™M‚ËpVÇÁÀâ'‡·épb¿Ó`xtVσàBž„=)‰'yàæÀåóà ˆ~V;‘ùé€_ü,r”¾ˆV«®ÝÉrÔ†"Wµ$í–õÖ¥ '_´ÿØÕe¦%áv²H4eèɺ=úŠÉ[8À2j^ú)´„¥Qp`/ ÚÀÐÜ% ‹œ‘ iü–Yé•Âpð7¿©ÓÖ¹WŽ×³v¹xFWƒNs‹H#Vl îÒ,‡ÇÿѳxÔÇÔ5¹p)ÐÆXƒ¨ç4ÿUM'ofnIðÓLL8€˜tþü¯Á¯£¢«dQâÛ¢oÜ!_ÌaðTšx]›ý¢¤²a…/XñÇêjįv¶úuAvvv~IÕÄÒÏ*ô­=¥¶$%‚ûI °jõ›j’àÖ\JR’’”¤´ÆePðMTW°îâ Þýqëû7ÖcR’ÒWD#¯¬Ý‡ ·/ÑþãÊêõO½mOæÙ»üæ[:öìYƒ‰·¦Öûºç8RÞ‘’”~ ¼”Ãëô-ý4N¦A:ø:ö·¾׌ˆŽi_ˆ6ï‚wP—*áY­Ól)ïHIJ[Ë“#ím­Ý¢¯‹ÑþH4{¨¯« zÚÙ3»Ä«|ö\oW{kkkgÏ€–x+³½ðÍ®ÞÁeäÀöXw‘®ýùÇŽÖÖ¶Ž~ähºÛÄY€n,qýmƒS왑¾ÖÖ–Žîeá)ä´{®.¢­wh\¤¥F;[»Æ–$¡MúÊÒTG[k{gÏG ¶§ñ–fz»àÒ¡*±ùâê Æ{ ›=ƒã¼w!Ñf¤¯­olYxâ—=×ÚÖ {7/O¶tôAµïïjoiië™ÖëÚÀŽ}ím½ã €3ÛÒÞ-Ü¡ž(1Ô q°£ÚºûGcœÞÖÖ)‘d43ÐÖÞ9‚n>ñ9KmíP·ÌŽvv,/ÏŒ¶·¶´µw£ˆ’Lt·vŽ,J9YJß5$ p{ݽLÕ ª,· ÎÙ&Ú…N¡hø?a­§NÕs˜~ĶÙKP5u9uú„©‘©é]gþ¡2ŽiîzúÔ1CAËè4…S£}ð*Ô£!‘I·ÉáFE¨1PrŸÀÔ™â‚ó®4£½§YöÇïÞ½i«G2° ä"8!˜ü C"3L]ÏŸ>ÄTÁêŸÈFpˆ¬!§Õ°mŒI{ãLÔÔ<|QqDŠ3ŽÏµÐ¦jØ?~DÊí€ðÛa•öÊ*Ô'δQ?{ÉI–.m]ˆû"? Ѧ7W¨=°À]÷öÐm¯º1OGݺ|X˸ױ²N¶iÍ"SÔ;¦¹`ø•I÷ê~×®Þ‰>…#Ò®ÔÂxËhÖ¤Q™fÎçÏ×#âÈ–áÐkÑf²^9Â/©d*É&Èaf0þ!‘@p‡¼ŠÖ§ïOз8pçA’ÿ^…ê8ãÿš¡+°BÊÆRúê%Àí-ÁcUß Ç¶ùã{i„Ëe=`H„6³a—®ô E—•Sª²Þù“ÐUû³+d=ÑQjþ̃;I# ¼¨žÂ›ÜñÄ;'Wx`©œ,ËD¾Æ>¤.ãŸ.ôŸL0Ðõ…ƒ¢\ð`iÙÉ% ýõ8<ŸœÐRßWèï0ZK%Š:`G®¹ñ‘‰ g¶+®›’ ŒÆ)Ø#†Lâåg°ãÃb÷Ë $ahA·‘²Ì£.HÚե㮋ß8`"ÇòÞ.Úô&ÉÊàë…Þ—9gÔÈî/W¡ w ø&…ªQƒ"Åhž‚á\ð¼ÐÃØÃÁ³ÏhRí¯ O‚.tiÐð÷Þ —Ýóf9$Â==žG×6r¡’+û`®2XK+ þ`h^œ)f:Ž¾6ÓN£ ZàY˜Ÿ“jpRú¨ùEnj·¹nLÒ‹•É 0Ò°»"ü*ýX绬äG·nÞ¼yëšQöj5{iô CE/ú+¼ú~íà¶ÑæÁ.eãA‘®Wwß’hq‡‡¢ A½áÝ -*3õýœPaÍ“SÑlA£¦@ší¬¤ už^ÆWøµbŒáÚj.·‹2Hª¦ÓБrÉÈýZ±?3öŸ;BÁ%wÉóbÕìï¡^ `i€N#g¾•2°”¾!ªI £kÛÂÍ@Ú ¿¢Ë(™ Ï)z]UW}NGÎún:Ix3ͧ˜«3Uqʸƒ—s8ˆ¿ÈÊXñ}&ÐM¬Îïz쟷 m@ÿKœvÇo®è¢²å ´¨ û©ÂÅîúóG© ûó ù§Ï\IIUC[Lºzz¾i [Y‰RDÕç^³ÕÒƒCüW„°d¿°»ÅeåU%¦$™«5œ…— ½qApÜÚK;¨ž܆Y0 $ˆð¶1¼µhÃ_6Xsñ$¯»oE´¢ KÄ’TÉX|BãÒ'´Áju, EÃÁl%=m&¬äƒÅðƉ1g^~ 8íL£yJpÊâðÓñåÆ õ3Ù`ºL…¢;|·"/ÖHÍ%YhÖZ`ÐÈYR´‘Ò7E¹·ˆêúÓl,>¥DÑf™ŸrÊU}ÿyñ¼8§&ƒ¢˜xœ•Ù¾*ŽôøãØê›3]ÅteJVïÜ*´³¿m«äœ2ëe|äšðÃÙlãr2C$ÛŒÚÊ+_¬† ÒÎcoØmÚ›È6á¢ÔìSzê®×_Á5¼óƒzQª!SÜî«5쥱  ߌ MÑ#ídÀ²ÍìøØèD£ãsBÙ&âê¨Çny®Hú Ú(áTó;¦êîU`9¢Ÿ—ÞmØǨ{¼šÉ6˾ªž÷J ë{Ø«FŽjRŠ!ÝÓ¥Nõx[”À48:ÄHÑFJߺÝŒ×Rä‰WË¾å ™àB‹»„v›eþ‹³® ç³hÚÆä`:k GJ}ó$ÄëÌQ.“VbBÃDáó~Á™â©m¬LxÜ1 ÊÈ»éÕ"ðÁÚ[$õ}$õª¡(uÁC®ï„î©ÌÕ?ÆXS+ÏB¬槄š•¾Cž^C°wí@Ó»–áE v<ù-8ŠÝ§CW¹S¡âJºŠå·hš'ß[“q W ck3ÁiÂPGÍ4Ô%Øm¢Žè؆}+Œ÷ÁÑu?ƒ6Vl%æÝðÒÔpŽbɲ ô£äŠYÿZ¢`¼šATÌj€«>œï§w:TC÷)|5—#öׄ1› `¤µ¾i`NÊËRú&¨/7T—¦ÂÔ5¤TìÜ.ÍCó¡?{‡’z/¤I å«‘èfNŽVúŽ!ÏÞ§xaiç_µ‚Ñ·6ÆZd–žƒƒº*Åfÿ)!¸½¥úêdu[5:ÕÁ; >0sB$GаFSéÒ)ªGžŠK¿°Ÿfã}EGÓxŸ‹‡?xþ bA€…>o[,]k¯ƒ ƒ@pò»ƒLOöyòoUCêÖ5¡4J·ï‘›¹‘ã>'VÑt_:ý¦«c4 Æ®–Æ:çžyé“©z÷;xw3pÊêF–úªIïÀº,l€á~H®`ÐÝüO}ï³÷lÐ9EŒj÷<ô&þVÁhD”ìí]Se“›Ú”ìQ¢·L¯À"ât»Uùlj=ÏÝ¡Àl¡ÍÀ3‡=á°•wiäð^3ª¦Ñ>'*Žáq¹-‘=û^«`qé‘Ð|ín¾G†òBä­­Kqx,B›~›QU„£þ{Ú¹r)Ké‘oÖk+‚Ïi.ÉúÌMøš;iC§<­—{a?Õ=²ncæ‚-¿Y´>[‰5Üð9¥MÛ $x.¶è,@‰j°ºØµ7š±*ÁÚ°ßkœïÖ½Ö~hry¢ÁæZƒ”¥$¥uS¹á¡Ÿ2ÕkjUÔ„h#¥Dåæé³Ò~’”>ÑHšV§±÷õȇˆï0ŽA5Òîùb_%òHIJRZ¯¦lô»–N)IIJR’’”¤ôß$™|KqÞ¶¾F ø&ƒ¡ý4b¡à3óu÷ÀIYâÓ-š¶ed¤³HÒv@âV…à³ÜûÙ1›l¬|‹€3û.ICEQYÍjæ[«>·êä?)ìÛÚè²—Šö‘¢on`¬™¿ó½ÞôøÒT)ü,7èºù/;u~Ê3‚ÈŽYuiÕò§ÉmÕ¯…ßÑþD£‚¦uDTÖ9R¼~øZþá·ô±ÏM~b‡óM•ü¬óé?þ–пÌûâ®àw¿Ü…Q›bƒk‡¬wìT¸ü‘³Šfòñ¿ûOǽ9ç%VÀ:ç¶,EÀ™ÓÄîJof>»0)L¯¤  OдzPÒ¾®Ì‚õH“ üDW}ý€Ç’BÁ6۸ëólçæºê­]˜”xµ;hÞì-1ÿú15óSe k@âvügwË…/}®»7[ŸéÌÏ/Þa§Hôù}d á‘ÁžÄ]X˱-;g³²‚ÍÖâ!=¼õèÖ‹õ ºäþD_]ø¨(>ª§Á ÒÕµ ¬.&|/DˆÚ‹÷Y›˜[œº’Æ^5ªõéžÆ–Ž×Ÿ¿üðfCŽ™›™Ø¹)n›>*ÒµòXZé>åfehf•R‰Zwιë™Îàˆ3«;ïíddlzðtÌ4þ}¾×Êʲ¥»ÑßÁàPB7œ¤áå{33K×¢~núå¾QЛg½Íc2à§+Õ!Úžw¹3 Þ¦FFVQiÕâe"#ú˜©©™çùötµ¡ñþî‚—.•DÕ769_1 úwá¬&ÀlС½Æ&'c…™fwøNëý=Ÿ{è‚ûöÐ@X»Ü+ì7´6ÓÇÙÆÄÄÌýDØè2ìú²2ÑniªG!Ñõõ ®´ ÀBs°¿›1Ä(.‡^5O­ÃoÉËÙôåû‰Ì(ccc'¯€ŽyÑ­å¸3Þ¦&¦Ž^§ß ŸV]ñ³Ó¡!5?] ûžº¨i›ê B«3eUO"¬ÍMÜO6¢ç!{³µÌ=§ÓÉ¡vGîvÕ¥DZ™Z9xõ }[3 ¡in)؆u.çÓ‡×{ŸÔrML”꘹±ùpé¼¹û¡Ç-ÌLl÷ù"®÷éç½ýâ2Qî*¸¢e´¿SxŠ¿W7ö•7Q½ŸÁ­N8áè¸ÏOfvÍpEŸ û pûO^PGÐ.a~ ü„‡¹©‰“÷ówèG¢AvÌ^— *8yï3m›#<Áp —½¡Ù‰¨'âű#ÑF;9Rû (4M4:œi}ùf^Û×…6“Êxš½±ÛãìœÆÞeþ|£®Šâ±¸”šÚê´ëgpDƒª)0ÓÙpÑRÛøÄåæ¦h’^9„W·LÏSõ&ÿˆ©ªé‰;p> ts/×c9ùù“‹ «ô6C¾^P[]íoG2õ›A¤Èú$k’žóùا­ÝåÏâò„ò!ˆ!–âÜ´õ=r‹K³Ã1ŠÔ¢vh@—®î×Qw=WP^]–›lŽW8÷ þ†ÚÒDÓáƒïGa´iO°³L£Í~ÜÅ'=ÚèªSL ÜLUöqš÷V‚l¦‹YŠJgﾨ©.¿zÜES—‚¢M~üa¬šiz~YMeià>šíÄ]4çÄ(c5’²òJò2öi«¸^._«tÖ!Xºþ¦º&?%ž‰Á'5#ŸGs°´½ng«š:ë^ÜPÁܬœÒÞ|èh,4&àbßÀgóýÅ4E¥ {Ïkk+“"|UTíÚ %g¡›J![ºÝËÊ©†~½bÈcÎß}QUQ|ÆÞBψfæ. ¹û0;ñëN)ÒŒ¼ýBÞµt6×>3ÀȆ–ÃÜ~÷{ ª¾kîëÊ‚ôëûôT¨fc|~×›8¬¼fvcsÏ,|4Z§±ßÎ9åUqÉ«GæxyÏÔèŤ†ÉáK7S ªÚ¡•ä–§>ÓéTþ›ê²¼T+¢âÉø0átóùÝ„øԼʊ7÷C(©z Á…Vs•M ?´öO›‘1'âR*ªªò2îÒäånWL¬}Þ²…>M×Äý~^íÿßÞ{¾EµeûÂÂûí~xï9çž{úôVÉ•s"çœ3‚ä ‚E ¢E¨$*b$)"%çœs®´îJUPµwï>mw×xöã.ªæšk†1sŒ1Çs ¿;ÑË€ã Ë£C6t¬ûµÜú††Ù±T¼ò+]ßï’TŸ¶v-ûèF¢ÖÀ aj°:[×é|R^ÍÇšô‹nxšÉÔè$C6™‡ÑæA¤ËÀífþ›þÁÁçéç‰d© h§ÛK¨Ê`e‰ÎêæW¸h°à²7‹|áU/0V&GÖ›„îÿ˜ С˜ŸO…æ·$EKÌîÜZ«8§`Žô$/Ô‰ª¢ñV×?S•4û!yeÊ«Ü ˆ6®2âõH—Þ ‰vùgDFà›'ñÚ¼^sü ›ùµuŸß%ÑiSÏ>¼¨ªuVÇ‹å‰G‡ÀêÖžþŽZ7Ž¢ÛCD$ÛŒP!vÏKá@%n}DŽyþísÄZ¬Çâiw:P`¯a“¼‹¼ì¦éuµœþLg=«8H½ –Í8 iµ¢^,¾ÂÊkuCú-Zæ«R¤®_5•³O™NÆÔÉôg]\·å[Sè®ËˆV´³¬§FÎz?¾9PC¢3»ç‘›µy¹A÷jz7;žãj㢠yí1ò¯Eɶ6˺êŒà¼š£5)áçCœS²h«å¨Ê‚hîž'Ue£žM¡¶RC’c¼Z€ø5ÊHÖ%s )?Þþ<$2y}6?”í/§(þóK®]ï:'¥ Äz³€dœ˜µÆÜŸ¡1­eÎTƒ´Ïà‡‚r˜8î@è¢ÏŠyØl 3èô+o‘{Ÿ…5AZDû¢ÖŽÛ’eí.Þ‹6–pYo")ñvÛü\¬Ú2eâ«V‘-°6õœËʲºbMJFŽñD4¬µ‰:»B°Hþ= #¼öÖzÞèìU¾vÞǹ.@Wè6}‚Æ] àóæ )2E=ðEÚÃ÷°Š¶ ”¼½ôU™Hþ0[,LM¯íËtÍß²Ðg†f¼Gu¶›¦œ×~[¬‘’]²¸TÎ%3cÐýã˯I²š]ˆ*Ò›Ñ8‰T¢¡eˆîõ;ƒêx꽶`pm²/ëj›_ä#ã3ßB °& P•Ú[†ÆÉ=°Y²ÏÒœ„cL6ªItv÷<~† ÍHþY9ÝÓâö4xPub C]N±šy±b²ÓT¼ |MÓ¯)Æn <Äkº5 CÍ/¡Ž'Ï=\mˆRÔŠAâãÞ¨¹ç7·•Ä h³½ØÖÚ¯/¨Å™¦r9ƒh3Q*+ÏzµŒrA{¦)Þ<[ë&$ºêø*_ÂX.ÜÌòWÕpÍäýjwghCä4B¹7!5%„CQqð½t1"¤ˆ{M£Ó×AÚE›õ/jœsÐÅp˜.Eq0¤ä>ˆ6ÇÈnËè^?jU0ö+€ê¹xñ¼.•v¶šÖ¶<+²y&*ÈrW 4¨÷ÞŒŽÔeÓ™ZSÛ·å|}y›Êd‡\@[~Þ›¢H¯Yù9´Q£Þ?„ŒôahË·Ò¶ˆ+«¾·O3Í.|MMNññjPׇ^!ä3È–£¦òòÉýû âê²Ï8ÐtM#ÑA»èïaË`Ïq‘¨L­4¿Í’–”ÒŠÚH>xRu@<\ö a5Ý‚#áÿ1Wå8ÄÛ ÚОErªÆ©9¥VˆUÎëî´ƒhsŒ~fSÔªôóêæA¯n»š<þÕʼo92“ƒhsœ`>-z°!Ë‚j™ ²{~”¶¾w)²–{>Ü£2˜A¢‰ˆó¡(ÐÞC7ýîä^õdÓht˜¨¥‚o;{Ñ,k«A¦R ƒžÖv Q@´Ñ¥ÞzÖ‡fí»sŒh"_Œ±ËÂYÄ„ÝlŒÔÍ}¡´H{ЦòV€™g RMj²ÙÙrQÅë!l‚ë³`hÚDjù#¹ÁMä+‘Ìü4º ¢±?üjÀyw1±½>?ôcéGC˜€¢0?Ø™ªc‚ÌØž/;:Ã,c…‰¨Û„ýê,¯¹É:ª²Ýª(¼zÊ:ø1ؘ’ k˜Çb´q ɸ‹†,ÌÓ°1®Æ Öðê £Q´€ê ]&2–t•lšÞ³mdðc|t¦º‹l Æ©à_ýïï±5C¶DìïÆE{¶ºYøÿ×;÷€ÐF¹m‘!6β(v‰ÅmM 566¶õ IÈ6럕1Ä{ÚvË ¯ A´ùê%Šm6‘W¼ð¬©QT¦©©©ºñF‹,t‡¡Íð§,:S{j["ÇNûË[te½ÊÏ»ïùÒ¸À=€6–b´ºîA›ìÊÑ£e^Œ©–Müñß·ýa´á¶ªÊbžÎŠqdÉ“(w:½6’“¿=x¤m3Ëß^ãThkÓnK›šÛ È0Ú ¢Y›!´ImÛ‡6K®¬Çƒ-¢^665}ž6!´©è@cÚ/뫺Üݽ?ú¦ó´aˆP´ÙiR–%½[#úòÁÕwÚìZ‰÷ –þidyÝÒé,­wu{'¢Ä„ò` œñ垉Ùå••å¥q#šü>´GŠ?>Ðùöq–§‡ÂÖzúuMba´I.Ý5,B›«FêÆawÚ›w¬åk·Pm.;Ó/<_£ù9ñ‘âÆe‚óÓþýhs¦•±Äh3R†ã˜mP3oW®=Éä%A˜Šbäg˜‘Eh“ä¤~ò¬äü¶n òÛ¾ÆgÊ6ëÃÕÃÁ¥1mNf náf¸¸&´÷ÓêÐþ¢hî»êº'¿ZhË#«]ßñY„6“¯â•È:ï:†––7¸[Y &ц`0.’ »‹ì@´{ô$JÛêîÐ.kòNi`œ®–l}Çÿ«  PæAg_x%Þ…Ö–Ë×÷  oÖˆ.—Õ´):',-ÀʳÚ.hp/˜ífÐ|Ƈ¡ÍÐj×[2ѳÈG¤À¶Å/ÚF—šJ ,µÉM¡hCä®oï s-åMî‹6ýmu¥ï Íž]UðÜO—îŸ!šAˆ–<¬I-Ù2NÄU® ]ÛjfÉR‹!s4ÿœÆq·¼ äEkS= K÷ÞGñõŽ7Î"D|ŒÀçnlÃùO  eƒÑ½Ù*–š–æ–`i~/ÚŠO©©†‰Z»á­*÷hS'LˆÇïw ã×ýèŠѤž‰ÐFø3h³Øþ’Ä`­ ı¶‚þ²+þú¨`ªŒƒ“ˆ Í„63à‡íå¡ÉÝÜ ×œ O]Γ4­Ž6ÕçtÉ^÷ÄL¸µŽ\œ#–*@´Ï¤&Œ°*-<”RCÔ âPMJ0i„£Üjœ’ФA›õæ¬p§kˆÉzË\‹ÀüÚR¬D·D%h‘&Õ‘vk¸g~7áù–>gÓõ‹ÝTn–CJÐ7zÁ×Oºx3èVõUœ~¿(g”mÀiHÅéG< S| ËQÚ@q”–k˜ˆ &ÉJ¦w{ˆ6  çI"½YØnÍxª*ø¥Výºž6’h³3ù”­„Íþ<¶ººº4ÛmÊV Ëï–@!pÛÇJÅ>d,±²òåAðq†Ýò~´>åGÐ9º]“ `©Áº‡J¢)‚6¯Á‚§*ÓôrñÊÚêLƒFƒƒÄg=Ø4‹Ø²•õµÕ•ù¢`ME‹[pZ†‘;IIÃÐá È8‰DEýö%îÖÖFÇ£346ê{²ÍÊõ¿ò.¨§üÎ[8zÁ·EpWn¼@¦+qF¨ƒšMÔèÕµ¢(7†™'ÂÑ•Y!tƒÞ©…µµ…Žö©° #µ¥A—w -¥Õ£ð°}yuu}u*Êš ~ö5|fóc´™iˤãÉSà+g‡ë9dlFå„$Ú[õQJroÇÖÁ9yuõ$Mø´p¥_òØ™Å>K&±Û¬¾¥c¼˜Ø7Q`ä‡hå£÷Va˜F•À±ðø¼Ž¼IøC†%Qåܳ­¥‰oÎÚæª,\rù0d˜™|H<¡^·Ào{€—×ú8¼¸²²º´0íbÈŠÈø‚Pmê¥ð¬ê£dH^Yý ®¨xýuÿ Ä…#:JN7àðÆqÚ“±õ¹ª¬u¼˜…SB4i*•ýÓkkëme‰$¦dïÿÚÔMr“ü”ýò&vý&®Z,gSssßØEhªØÆXŒ~+<¿ÓѶDÕ€W0îöè’éÚTJÕ4ösÕÁúîæê§S¡É~çOòx´ë6#F1Äá9&3P^Ë]´ù–ŽÓ²Ÿ^Y[[[ÉŒô?eËR| js¾‹6‘|%uwhªN±¡éFM/¯,ˆhmë;_¨;.OiïLAäÅ®×.FÊ"‰®núð# ütU£hÑè ¹o2/*Sp$"ÁÂ;ºÚ#ÿ ã²¾ÇE§ëMº‡D àµ,}ëÇPo²–F wÅh£ÁĤ”÷Ã|7ŸdGÂaÉÇõcð7îœw¦’ð$ Ý':o RN€Õ±Z¢¢Ì‡!.lRãÅzQ‰ d’_?åmF:ÿ ØYR¡+e¼Cí±ü/áÿïú´!áXR5šxªåÙ-U2†HV¾QÖ“¡¥ëóûáÁ%U*‘H¤º„ÝÛÝó›Ç©PˆíÌÍbdkkypQŽc¼ ‰âÀÖL×C‰Df¨Eç|à"–Ÿéò?ɱP´Y´>®pK”mï­³’ÊõJd´¦šJ¬µ‘­k÷¶»ëƒxöÅ×9±ÿImn§Dá>jžK äØ]†®´vÖW<— ÉÛ¦Ç{‹¯½¹}–¡ïWÍåÚÀy[ pøL=c';ÉLfá–çœ7SÄ\À±Íüw9±oLý=Œá]°Hv8GÝã©`WãYJw¥A¦y^Î^€û¿³<ècÊÁâI>13[¼§QŽ22¤ HßäFT“W$„>Ÿ¬Î¶ÔbˆD2G'®ô "'?°¢á¼2‘z T1ñ{D®{‰ÿ&g† ìÚðg?+M"‰Dá襽lû¨_²V‚c£töÞû]ÕÒ gzµ1?ʃNÆÓÕ­@”‚±+÷?uæà>Ü?ÏÖò*C»³Ü&§Hø2Ùkt‚ðQÒq8ÃæØŸÿ߸ƒŽúÐãÿRP€-Û[³Ý᧌Àù%ÑÕ®“*üOY1Út˜Éi'¿ºînä}[ô’pÖŸ±X~—°~™~)°ÙçžýYeõÜîóÿA®›}IZ„?çÝHz÷}?ÍÁ¬2Pd—=p´·ÔánŠÀáÞ}-9Üìð¤7ûFKøýüB°ž²±ÐÕ?'.pÉBÁ=sôÑÛïœ&œï›%ãZ«MQP±Ù’tË;*]ä‡LÄ\áŽä¥ý¼w´7ãQ>–ßqÞöñ@g„‡/%=1¢=ûüN/&éà*~ä‚xØ â%+<Ê—ô‡ó!¥¿!q¯\NßþGlødá˜RÂËƾ¾ÞÚ‡aœ^Ó»ñX²¿ÓØ·­«··«íŒ¥²uÈý_Ñr(%)IéW‘>¡Íi±ó‹©6‹Å6vlØü©- Þú_ÞQc2™,Í°ô×€4³‡”¤$¥ãÆ÷¿ø¹ç¤X#%)IIJRúW‘ӵř¡ÁáÑô±“mO ÷÷ŒO/ˆíP¨w}°`^Œ”ßY_k™_ÛÄ&P!wvrt```xtbƒ+ĸKPáÁɹ௶eA ¶Æ†û‡&þáöoÁúdïÐ쿈Ø!ð†V6y¿‹OEL¸5Ó;8%øCÛõ7ÿ$Z_†½Ö?8*øK^$XŸîšþçàÙúÛÊ4²–‘µ:•¥¬Õ¿û˜ðVüuT‰UkkS"™fëÓî¤lö¸ëR(zBûòn-S/uÈD¦Š‘¥“L¤F,ÿ[H­Mi^8cÈ·váeÀŸ±V]è.bo4xéOF¡É ŸF+0Íö]qr¤­áÈãÑÛF ×’NQ‘ŸÉ·sHÅÓ <‡õ¢µ§%ÐF"KxDÝpЩ`_òº#=:Û›ðg³ø}Ï â»RÂ÷/ ¿Ó‚Æ~S„6Çèþ[G ÅQõ?-ÏB…xØüìOËsT¿ŽNŒ3¤¢d)¾÷½äš‹å…wÂ#Ü*¾—éßì6YCVÑ[ÚF}FxS%d9ýH1’·-AGHÈ 5Qº÷îñöô:(/:ãðbÙ†·>¨IVz5,DãùMÊÇéÖµ¡öêÖañ@¥]Ð2÷+nÿô~`A€†EM=–Åh÷ÁIOQÌáT–¹’(Þ—ûｦ⠬ì­×ó€ÿ.纛Îf³h“ìÿa¡+“E¥38*l£@H‹[î‰ñµ¢Ò˜lÕÒ÷jï<üÝK§ÿ4º]뀣©Œ®píÙÌ+¾tàjYúVõ¢}yFeø¿»yÎÛÌÔE¥†Ü~KK½ïÜM8d2™HSOxôv–ú*}-ÔlÂô‹ÍY‡}¶ÆëòÉÈ÷,@ÊBÕUæq+W…Û‹Òñûïg€¥9y…—I,¬¬Còàzåé}²ÍìקòòÌQximÏwND~Aô,'5ëk”ÿ ý„6¸ÀVîϲPö*èrö•Fª<$'“*Š¿¿¨ù_D•Àm$z¼>W^Q{†»g-lM¥_ô¤Ql:E×6àÓ ¼&Z¢ÿŠkó³ëö&ÙózÑtc¾›½…:“bè»&€‹·Z”xžM§s˜4e½“ϯőgÿGA¹¡8’Š‘‰z2#ä¯ß wÁãð*ªºWr?Ùéb/d}6§È8™GuPùÑBÓ?[å?M ³23R£â.d!Kr¾­ÌFŒ§qô­¼º>]ù79‡…•~mU•JWæ¨$ö@ëÅãÊÁõ·õÔYX#ØxøÜ dýn<3bHÞ/!üè~çm¦Ê„gÇÿFþ& Þüõé¤s.4 I§²´ìž¶BŽLËMO˜L8¦rÉ„ðõ½(UÅf‚/¼|òé•XèK²òŠÏz9Xéëj4¬ß÷" „5…‰zÊt6‡MaÜ­€Âv–† Õ°"eÕëß –8g€I]2Õ¶ %x]ÊBÜžWzÞ9ë2p4¶Ž©KËǤÿ8n°Ê6ï}þáÌ?ôû¥$–£íº)ê‰`«W /_¹°l¯„¿Õ!–+¥>Ú{‚\À™Ü‹6[3ohŠê»N «^Ôc—Úöaò´õÄÕ›û0»>-ˆfî”Xí(){ÃHfx›|¬ D6:‹QŽŒ£P4»`wQþô{U¼üÓnˆîà{©ø^jlÛ˜Rt1˜3NÅ@ü|£E£ž÷Cm5ìBÏ-/SÔ W`”{ž` ÂV÷ ôyk´T›Æ·ÍNMyR\-Ä™‚éí_ö.Û_µeqpîPB ×&%A‰¶6æ‡J—­Â¢oê\ÊÑžì,é«’òjfõ>•¦ìp[€jRûÑXæÐi5ýÛóÔ—=_?­³YP ü]Êݪåæl;º\-oÈ€L×£“ßCœ<÷ÚãP˜qI×&ºvõÿ¨¥¦­ÏVÞ€ª¯I5㜩Ü+d$y›é¸^F¾¨Ë¥èXo³Òw[ANÑçá<ÜqŠXÖI$§Ö¬Û‰¸ïÒO³´þÿ”A¥ÒzùÀì[%,Yǽuø±;`9‹Ç•Ñ¦d"6¦°ØœVçP7@#9ûÚ•ŒÃäÔ#Á•+–,ÙÄ·à¨.¨0‚³`Í]0e¤LSR?ähVÑ~Q$Û`18÷o™Ù“sâdÚø鬳*]Û÷ØlÕ”Á^zƒÜkºrNorJËS“맩‹^Ä<ò!ŽJÒ‡Íç¾Ä¨g@yiù[9™ÁA Øž0ÔTyõmARíûËpÏDþª Õ„¢ºÛîP* ˆæò'-¼Lv+,Må`å­PÕqû#àˆDÊF:èXg _‡ØÒž‚G–Çõ2¤ÍŽÚtœŠ38È[ÕÁ¿©œÿ'@›š¼pÿ-ÑúpÇõHråC£Fò¤Ü!qHðC!'øþQh³1RDV0Ún0ç· ÊÍ=¨²ãk¡l–'ftDdœÿ‡—W~1Ê=:A4(~=‘UT©C‘› ¯dýpTüãEsí³i¯Áïã nù°9ÛÌ!aëw¤‘õ§‘l×Ê*ÙN¢•/ØSŽ%´‹ËL›(KÇ ?7P³ºÅCš½>H§Ó*:‡_¥’5 ׸ˆ>"XšYÝtÆ’ ìw¢/—Œ³Ý—!ó´é§QéyÍãÀáhe™¸cB»ô R _ŸaÝíê7cÚ‚\ÌÛèWÃqÚ6ù®—4ªõ,XoÂÔðx讞PÖ%tµ¢žÕ×U­fÊ3¥ç̓’ÒÉïÆ@àâ^VŤôî œ™¶ ¿Û-þsT_–ò¬´ÿÎ1¬ùÚ’!½ãØ´´u™&²¥ànža¬[È6NR¨©õ#ÀÜ; »ry÷–>Þ2§SdÃ_´à(@7EæÙ5ѾãnI‹ÈlßœþÂ!á>ÏŠ’=Þt<®ì]¯>˜ŽU´›¡Íq¬Í¸ˆ‹ÒÏ©˜…’÷žuæxF– olϹD6qÙ•G:³ÈDð­|V"ØYZZšüVÉ QÚàäÅSuW‰ÔÓà0-}{E ±Ÿ|Eƒçy\Þ~‹.„6ôÇ_qØúpœu¬"Í”`r7MtÜ)cϘbèÓXVÞrAælwµàtx¥‘Näv£ÚûæêÒüÒ:³G“ ÿ|íX_f  ëŸ m>^åh{ì‘múµ òïgç­©]»²ÍS_Í‹9GÊ6S/©ŠšÝ»Œ¼æC=ш&ãØžiq×'ºGmíæË…CÓCeˆF]ó?0O>‘!è ‡  hNc+«ˆˆ„QÒ ¿¿m–‡Ÿƒ¸ˆª*[îOÇoAhs‚†Ê_Âo:x“#.ÃÁÈÈ®‚Zòü¦¾ºÛct<6 z¯:–>ç_eë9nñ%ÚYqû‰N·„æËþ†iYý.Ú¨‰Ð†FÛ³%Û€[m™ÕÏfhÊC›@ˆ#{XiŽÆ[Ü…ªZQ¦“&…uùôÃ>nԜӋ|Æ´ÈôúÑu`¤Ï6\ãþfç †:œ*ê6jÈD£ù½ö1^³&ÀÜ(ŽÒ Ùàúu`àÎod'Q&¡QƒcÄ'¢°‰sYû"p•˜b0tŽ¸ëÊxLJmÀÂ;‚Fï:2U+^dbXÕ˜hÇáŸ4&Dxñ锧#ü~ÛêÐs^­g m%·þÒoL¿ƒhsŒqF,%ß Ó0 | ¡3ð6zâ󸳒³C“=Žû¶Œ5•XhlO ôue׶ ´ßY[ ÏPÀ24=/–~Ùo2Ñæ} GÜ/ÁÇYÁ`ÛT²Ù»ƒŠmê~7$ÐFȲ҈~_£¼UÏ‘#¼]”à(ÞR5SÑ°.JVó5ùÕq/ÚwÆîݾuûöíä;é#¼8´yŸ );"»Í\9U^³DfmE·Ó"#¦oꫣІ»Ú­NľŸDj:4O‘ì#Û“u&$ù3i÷¬Ã±iI^DÝ“}›?q¡þ:´k4L`ÝÁãˆ1Ú¬Ž¿gâ©}j…ÐF9\„ˆòryŒ6¥ûЦ­8Ž¡c¹É“°¶ÖÜ g[xm•D! Øe¢mÞõ~m€­Á~bäIÝz“”FœôNi}ãÇ x‰ÄÉnÇèÐ3ê'3¼  p"øÆá.Œ¢2 ç`•/…RµÈuÓ¥”ͯIÆic¯ã9ÖAítk+È?;˜K²ïö>´y,B›lmfì”d㇞n¾•'hö¡h³È ¼A—ªà:ê~mÖF+xV‡hÅ­VÿÆ:-Bû=hã(Úœ½Ýˆ|ùáv¨²­ÿÁã`æoÖÉßP–˜hd‚6"au²ëþõ³t‚ÒÓ¶¹ƒ²Íû^ ´áüó‚÷Û™C¸A„6î²> ÿàoJ O§€½Ùêy+ŸÙJäËè2ÚúxýÍIm6:ýÝÜ<<<ÜÝýÚW¸ÿxÂÍR•Àú0ŽæŠ¨Ò"œ*?|+t%i\F&”¿1¥ËÂ?ü²¸‡U%ÐFÈß²×cB).q±0X^Û^>îZJÁ¹ûÖ`_^¢¦ÛÊaVýCìòh|ãœÄÑè‚ú!è®lÃ_›ÔdÖM£eøSuýhWbŠõ¼Õ*ªgµêmr(yÚÌo¶•`hšýkÈün„«}Ÿ÷ñ³ä醓"›ööR_Çø* Ù‹¦»Æ$ËlZ Sƒ†û.Úìí>ÏQ›w]Û£üiùÝ5=—3ŽF=4SP©B'³ÛyÎ,#DD÷ÓS¹™Çr{†<ü1N×õñ{ åÓkP¤õœ&]7"Ôõäõ/’¯ú`ƒîwˆa¹úC³¶Ûüm€‚þ¹*Ñ‘ÛVUÅG(SœÚOØçÐHmÁRµ:Ié'Ц…»Ð­JÿêF2 î¸Ë«9L¶ù.ÚÕirtÓQþºÍ…ÞÎIpè&-ä•{Q?±¦|/•Ú 縆ÑÆœ¿…Áº‚×bU};\“ö¸IâØë0´[ØpEk%6J6×ÔÍn E²Åe$”žÀ“ZØÈ4þ½âÆiµ“çî´!]áA=Šyù!NŠÊÿLšÔíŽÒ0K÷lXT¨—5A‰Ö0M£`sÚ‰ŽÑ³öºf¥Ç2 /Afˆ;õárDDÔ¥PU2ÅÌïܥȈ[¹ÐÁ÷rë:Žê~:,2È•¦¨”Z iÕ_bÌ1ƒ°+Q‘]Œ¸‘R*Vì5ˆF¶~—Ðo#Áú>Áùá7™:V®k<ÁwÐfg±K³ðËÊΊð²‘SÔk‚’=î¢ ”뎪~îzjfZ¼Ù,4GR¶z=Y{£@öŠˆÏÎLõ¶T#ë®óŽBÈdR¢K×±¼Ÿêf‚Åë÷QðóCôzÖ7S³R®…é0 ‘Ï¡l33íåÆfÃËЀÍu” Ìø¼^äØYªpÈ9Õ3ßA›Ê‹j¾©è"òµ"Q(¡ˆùk»QK`²aÑY@ëušL¦ú©¤ðÝP*›uµ=žùöˆ©¢¦ý^ê;~ºê$"-6¼¿ê©áu)6ö.£Dõ½”˜}ÿŽ‡™2Ã$l[ðSh³Ôõ‚ s‰Í~p/ÐQ_ê8¹!؇6kO(xê™Ë·²Sct5OèQmšAmᆕ©í˜š“wÅ×òJ´£’m€•l%’Oxlö§%àDz t@÷ P‡©oŸ–u'ö‚6ƒõ J‡‘ Â2<™SPpÎÝÄ'&—D¡†Æ¦õ¯‹=iDÖ¹¨Ø¼¢"9ªçùè̬¬˜snEÒgÈ ÇMµV¶Ln> m¶ “Ùa= ÞÄ=43ûÁ%?{yEÍšI¸s›µÊ x¯È›¾æjÆ) âu×SzQÏ:{Þ“¢@ÌleÁ]MŠšUrVÞµ@›°p'y†Ó?“Ýë/wo&ßÍïyÐ ¼ÏóîÆÅ'Uˆo x3Õ q7’’’Áÿ%Äß/~‹JIÃÍ·nÝ«ZE· Â´øD¸JàÌ? –3oI|}3.±¾Šc±»ÚÉÐpuß øÊט›÷–ø{ô”ÍÑ’¬;7nÄ¥f—N£Â ¿2ãVaÓˆ¸£­ïSo€-}ü¾ q[á ?¾]ÎÛ³ãÍ™wn‚õä<­Úcoå½ÔÂvtGÜY»Ù5µŽŒG]ùÃÄ›qw2‹'vv‡®áuqbüø[©•mhšô•±¶Ä[Ésä©®ªÇ q×RrÇ·€Üô¤ú¾e`{.11©w5Âo÷=ŽNy(™}/Ò ¼n"mYn|s-em1¯<%övfµ`·ùü‚ô›…¯‘¿Æë^\O¸‡Üùª­ÏÞ¾•ø¾|„ïÅÆlÀî~‘—_!®ee¸!#ùfܸü²¨š9W{5¡@äͲ”ß.Ê’Öð 6¯h ]¹i‰7nܸ_X±ŠÔ¶Ö{ífêÜή;údë›äøIw s1&ǃZwÊí„öQh‡_ë.¼–^)žìâì¤rÔï‹[žŸv#.¾¤²KÐõgV2ù5ïÇÅ%Tôl¯®&=+Ÿ_¦f=íß÷¬àÖ³ÚѽŒ]ÿªœ²ø[iÕ_'Ð/·—J2ïܸ÷¤Ú¾¾Èº“Ô³é9eÙ S%~™n·ä¦ß»–œQ ²®ñ«îÆ¥¿‡}Bàéë›EÑŽ?R\†6f{òIN*ÈQw2‹Æ6„â•ôùùƒøøøĤ[“«{7ú©o•) 7oÞºÛ8,ÊoÞeÄÅÝ,¨hºÓ~£9CH7PvõÎ iÛL[ÝV:®\Á¿pV„ÙîWÿy!Ö‡kîÜÏE•­CªB^ûO$üàoWfÔu£çدXÓ\ãþE&_(äW>ÉzÛ4:f¤ø’­‚¥¨ð·mÞÎÚÆο2† ¶×·vøÿIh¸+=*tŠžë•ÈPueçtÎO (ä`PkŽ%3=C/‡xZ±rÙõóÀ¿DZHjNqU$ÐO]:ïkCÁÊŽž¤)‰¤$¥íÓà,ŽÖ~xûêUÅÇÆðS¾÷H‘ᎆ×àco*{&×€™TH7'zšß€}ý¾st ¦ ‘’”¤$¥ß‰¦À>=4Yë!ÏŠ‹ý½š-üC²®î„#Ã'÷æ%øKß»79íï)|Äcûb/¿SÕ¡£÷Ó'ü©é•L»¼¯ÁG¶ýGYŒfd¾Ï¢?nì_Ï<†ñÐ¥ô£(Õ#Ûè0|§ã¿t"âù&# §Áåý7Atz›¿þáÓ çlRª–ÿÍ*Ö²\ý£j›ªÖ·p¥ëø[þ.毺Ii (Ò²<»þ»^2]}Ñîæ˜ô60¶¶’ ýŒ/üÍ g[“ܪ¡=iÔ…ù~†Æ!Mwu¦•µµ¥ˆ=ƒßõ,¡œÇm±Ó2ý°t8ã-~{qÆ|ÄÎÉ;½ôã^Îoω1? Ö½]ÐYC„|´43öF’ÈÜ`w‹g_w¦¾ÛXïk»••×pàºsC5­Ï/ïY#üÍ!kƒÂúiX‡+Spôýô¢\àmæU—ÀØC¨á_ç%¹9ÚZZY{_…ܤwÛνí¤üòªzpÉÎê@ë ¶Ž\ŵ×ý¬/åüQìdu£°àmø¸˜Úïà·Õ£å”|Ôùµ`kÁÅñÁ77;='O4_¿àŽŸµƒ[BΞhf‹®³«……ÇÙèö¥¿ËîÿÓ4S‹!«v/î?,˜lztïq×`X0%°¿ìü=zדqŒbý‡ÁÜJ_ʽ¼ѽܵe‚Þ ÿ°~Í5'g”þ®Kz馤ä–Y( å°·•–ìRÑ£GíSÐéÍ×Ü E†M/z[Ð÷: CÕê]‡ÖV~“ÎÒ.x\öìÙ³§OJï'_¢()ÅÊ;ŸXÇ eó·ð­û!V2òÌK é ‹r2î¸è‘膮­Ó<„_¿$!YúƒìüúYiqIIiiQ°}ê2XIqqaÉ›uØÇœ¿5¨Š×î£tªÊÝG÷´½¸ôe¼”v.Z3LCòD(·oËÔ Èƒ|ÕF³Ž¼Sþlû³Ò¢ü0,Ûv>ÜwZÃ&`_,tsâX½:NÍÊ'íA~QáÔëç Š׋D]ãFªÊØåC'æ_kžÃM¹îeEѳ+…[÷¨°lêH×~aÅYSšWÒÅ>v´ ôo€`çQî½æý{àFÕ™cªB!oëåxðhST+²ì…g¨St[yƒc¾ÈÛZÞG»cMŽ@ØÛ$ÙKfÒ´%!`Ûj¨¹^E>‹ÐfóíW_íkØ⧢ Ù ¢ ¢3¶}¸ü.©diд~{v¨b:»…8Ahð¤}ê±À’1…ïV? m Ë¬#t嵄{´~O1SI1¤éç.Úˆés¼/ÅæìϨ?b´á-t-¸«ýÐŒõL/ñ4‚í¾®ŽÅ­Ý«{ÆzzG–¡³„Ï»z†×wP—*m„ü¾î¹Udf“Ãý]ÃSK›ÕßA›=Äϲ kÇÕH¬Îú%2+·cmï ^wU·ò„.¿{ÖÑÀ7v¯{׊Iö+þ•ÑKV¾qJCÛÜÅ÷”•ÎŒ¯‚`šîíK`VkÄQ8 nz®a·²S¢©4Æ• ÄÝZøÊWÍ?J»'à­Øë©°´Œ|=œ¨4úù¢V`ªCTi]ØBÖ£Kƒ ðr è{u™A£œò?äeG¢0¯×NÎ>%š¸#mùZ‡'ÑãÚÝaÖO)é]F^sðD5ßÈsžl<ÎñÆGØ3C–iïÄ0wöq³Ò#QT †vö­\ÞÜWU]ÅØÞËÑ”Hf'7C¢ÐtC!™J7u 8í¨gáH§ÑkV€±ry²öæ&̳&^«Ö›ô°U ·ð°UŠ¦QÀ6È\÷ŽSlö ¾J[kéìe©æîH$«v-mËu:¼š¥GxX°ž Y×ò<±©y uW8ñÑhƒrÌv‡¡öÒÇ¥¸SF!ibèØ‹6H_DgÀ7Dx[ô2!Ÿ¾ñŒPFr°ÇéåË?6ÂGvä«UƒßE´ò‘šxE}tæ³Ú b,¢Á_ïE”²½)ª^Ð…ž‡ Øø|G¯×ÃÝ£Àž%Ú«h{ÁÈÿÇ ÍZ•¢Åµ`;ƒ[Yy7Í0Ššµk ll[ëR®~½|Í—v<è=8íÛþ¦tŽšaȹPC6Ý"”·W¶á®k’2ÞN@õŸ×!اÃ/2U¾é(«þ;Ѧ BCÝèÊ qß›PŒ-{Сî$#¸_Y“Ââ)Ιh,[ß#7²÷Š6pŠ˜¥&<üÕªúÒÍåLa×zÞ²‡ú¼ ÚȺӭñ¦ñnõ哉&ক¨¯d—ƒ^º:’﨨]¥­&ôõ¡]¬Ê{ù Øn +j!Ù*î_0t½Ì†®måW*Û@´Óöâ ä‘Íî§8P[å‚h#'~‰2ÛÛxS²Fä>;ËÓ ªžh®•¾·×@!ŒRN BРìÏùhtFí „6 b´ÙìQ!³»¸í.2-}Ѻx³¹YÁ½¬km.Zàck‘ß_$ú’™=KܦÔ`¶š6Ø™ÊyP´ <åÉv†‘ˆ×ú‘<Ö"ðòÕ+»_º7Änº¹€JUÆ«{ŒlïZ!÷  ÊMOÂNRlCŽÔ¤€I3ò‰¤O™amð$ñX`ÅÊÏ¢ÍÖ :…Ñ>½…  Ê ½´Ûö¨Ës+ú÷€%7ÓKE!¸Ä”íÙŽwÑFôÍÜ)Ò‰“¦ŽÒ¤S‚Fžûn›?öV¤QT´ç ‘ñA›ÍþYú[QP]þtZTàœ…²o2òVnc² º2X8ûñZL†h˜—\Éǯ6q¢ wºF¥½èD}^Œ GNëÒïBáeÍãñ=G=°ma\3`¨F¾ø¥5)"»nfBVjX Äšµ½hÓŒ'±ë'Ñ`ÀÕjY•K Ønδ1IÚ°@±uEp²¤gŸ‘²ö2žáøÊiéJ%$2½‹6Ǩ8<×98µkj6ÄDCy‡¸Þõ†é>ݜٮWÉlÝsB`Ü {âÂÓö˜:Ú+Í0¤äoË@oÆq¬ÁhÏoɧQÕF$¬‚Ë^D™Ð/Û’ÖœV&º5cr'[@QmÚÌ6–ÐTìVùÀZ[1K¾”öèSsÇŠHÙ#ÛŒ›+ɤ¢-Øîz‰¥ª÷,í¬6æ’±Ô+÷ŠêZ:WwD¦Ž}€®Œ!Cy¬]HTtôU1E\/æî5Y ½£‘ÈDÝÓãÜÝƃhCgéä—>}Òã’”˜38<#«räH´ âO¤·4^¬û0ŽùÏþ Ú€ïžoAcY.ÁÕÀh£|!*f·éW.=xÞ½m1¶%ŒWÒë}hcyçÅ3¨í¥…9ÞÆLªiŠu(ÚT'R-¼rëȇ$ŽÖôÿDV¨8nå¢Û3^ï3Å8y}¤cÎÚˆ„L`u¢óYaÁÝ´ÔôŒt¦Ü™²Åh3=ÝVJ§± ìPpŸ¦:S‹ü]h³sNù¸Ãý±£ÑÆIÝÚ³ æpX¯Ø)2Œš&Ö];1ˆ6$•NØJ ¡ÍZ«VîÕÂ~´išF’µj_YUmFÞ] ;?FfÀ›J ¬ØwþÆ[Ó ã^÷moÔèÊK´y÷”fp b9Úžm EaUe¼ñlÚ¨ÇïÊ6]š'pE3»N’*ˆ6Ék²é¬³±º*§H>pˆÚ©##×ù³šÔÇlOÕ€ÈçïiRpKfÚ‹©4vW{EQ:&–à ´Qµt:´ýt`JQ­¸·‡¢ÍXa¤¼²ãÆ–/Å1 #8ׇ6*‘b¨£ øÙDÁ¯zvœÔ“k 9ßéÉ¢*N…§¾¯ùÔÐòÅ“}âÌó¥h33ú%›FÓÅrT {úwÛmn;`5½_ öåsˆ6tM=?_tXcî<\ÿµ¤ÙæÓ4 ļ…wtyzÃöÐì~Ž îÊÔ^—¬O0½ß¶l¡:ÆD%¸ ¡µè4Óº a¯P¼³½ÝòÈŸ@:V±ðõu²%ÍÃ!ªó<{Vvý·@:ù-´ùÍÙ~KüvÈ™ÔqŒþ HÔmÈ¢QtÇ%Vðfã„çëeIW‡9gü‰¨vT¶Ùk8(Û\ÑVJp2ás·W‡>0±ô²±õ=šÔ„æÄí~´úõ¯Ï`Ùf[â©þ š£bf§ç®Ÿ®oœˆ¾c%†~Ή´Õ²Š€ Ñëz ±Ÿ6w­ÄÊæ¢èTI'ŽÃí6À5wSM÷Ëûì6}™¾Ç.K?m%¾®§t»—÷C´^±Ö®E Üj„ÚQŸA×0_ÜîZ‰Ÿ~=ÔëåP» °QÏ9®t¡j}ŸÝæ†5VÃë©ø[£ ’í휖ÍEÞ`ºÉ .^¢•–ñUQ¶`Íz,à´™šiB§Ñ¡ÏpÓ’-Ž«ÿ>٨ͽ@WÑßîµÛt¿H¶ É÷>P“2”´Û¿¸ï1d·!ǼC{k,§}• üm@žU!¨B¹àtAeþ8ºý¬_ïü7պ䲵™ƒ©&“¡ëظ U=¿%KæÌmÂG“ëã>v&Xª²®ƒªnñtZrsßÊ ÕjF6¶Æ:Á1éTD“}q £:ºÁ﹆ãr=Ò®²ÔW£©éÛÙZqX §31ÐgGÚÿÅ™#p4V“«Å¦jšÛ[h\KN‘!MŠ7ðÆLW…¦n>Åb2]‚ã…À² ^©|^,- ê—ň¤½DÄž È[êd“q7ŸwˆÎ ‡™4†wØôÖç±$šá¡ ÛvjYr Ø=u’ULVàð•Jg[’’¬"Ž ('¯ªgÿ´C¼~Ž÷ÁûìE› "çÒKñß}¹ç˜vçÅÆÈ—t"¿¯íX¼rýОés‚b=$>ƒò^6©àŽ§V‚;ÈÊI<Á·´íP,‰õÁð{†‚¨‰^^ö.%ÄH“-+'O àpTs[¿†)¾È8¸Æü“eŽ„M£î†'ÖÜÿgÐ楿Á:¶Ø¨ñþ#L,h†¹PO]­K4RTÄb?ô¡b ¿ï¡.¯nálkªãŸÝþ4ÞŽˆWIh^ °ÆŸIù ¢®2&­Àº$ONIÓÈ\GCëÉ“3¦‡üD¢=~†1F-¶j?ˆozØ1IJ'dåNÈ©èš% üýÖ§ð¯øUJÿêG }!nf [M¥iÙ4-ÿîªv&šO;èãi*ªLÇÀéYç¦t„!š¬ÐÓ36;@Æ'Ïÿ}ö„•nScÓƒí1³>9½!Ý¥þiçÚç~ZÓÒ/0ÏgÙF(•m¤$%)Iéï½1'Fÿãwù(K8 üõîpSêöñòž¿3þûïH|ûŠk{1“J¥=)ý7¥+ÊËIЉ?ÙÅ´þjíÜüÜ60÷‡Tµ\fóÿaC~/hŽú_ò¶›–Ûà熫@dG¤¿eÂ\-I¥*)aM<";æÑ Cûký,Õ±8<–ª÷¨zwInŒ§ÿ÷`ß¯í­œ÷©0I“JPÂ`8&îï{QãÒÎtK¸«FAAIã?† ‹’th8E%%<Û0íeûÿ€d^™"+/§$" Ž4$áÈ <µey¤r…Ò)ý˜&Û²¨$­‰(˜Â£X8üá! ð:…£ϲ…/ÎD<øtTmGdi~ïTýÀýy¶¸ßhnûMÀ å,YÅ+/a/½…Z¬¬cX~Í›jx ñÎ+¾â¢làÆ…Ü^Æì 2Þ`—è¥/ºJøèFhqîŒT«(’Φ§)Ë3ª÷¤èoÈ£ÒÙð­jï£)N'X#oÒG´¸Š\I¿ê¯Éâ„@¹f“¨$Ú›A¨+mYl¬l~Û–„|q¤yàû‰ýÐsàCÇöMº‡¦ãý£jƒ?­^P£\~7"]JRú´¡‘´†¶2#?ÈÕ0¿ª'ÆÃÜ4ª€bÁ‡£ÏºZ9ú¼l›³]íƒ(3#‡Ó±ÓëÓ6ÆæãÐújËw³ŒiéxuÇL_ÇâTðІ`©óµ³…¾±…KåȪ˜Ç?—ܶ7746µ½S†º»/¾Õ,[©ò4Õ¤ÑX_àÌÖ\+ªŽ]|nÅÐpÖY²‰WÈ•ÔîÁáÚG°VÃp¨VA°ÓâôëÚ†úêrge¼G t;Þj•7^Õ<(2¥£è[]±š‚BæWÞÊP›£'àZ^wïl¹ªã½n<üü¥¡êU‘.Yþòsè¾ÎöÑÞ×îëÅXQAËùe姆ϵ÷#¬”tCÀ…³òÆû˜F4¼h¸×\Ô5Ï×64U½ÌsvÔQRö€Ñf1Êǹøëp@Š³ÅX%K¾G[÷t×mx=˜¡R·RzÁYß?N´|‰æ]}B<¶ÜfI´Y8…SºöMÐÎO³Q·J~¹-›¯áNÞ= È­šräÓ«Õr9ÊÏåñ× Éé8›1w§XÒ£šKýÔÐTù잯m˜/Ã˨}ù×vTÜ`°m–xÀPå#ïsÑÛ0Ú\T3¸ØÚÝXõäÉÓmC"¡Hð$Ü=¼ Œ„¼ +Mêèâr)ÜHéGhCVߥ)C¨³£sz” „§,9®1(‡o-´·CqùB´Ñ¥ÉXŒ…kwÉBÖ×X}.…Ž¢M[¾5…qq_éHÑ—`ÛoÆ€$ódØží`ÒHµ#"GïÑ y« 8>KAÑTÏâH;Ô Â‚¯±ÊålX“âê0Eý胫 óPR¾Ãu'ÁSom½ˆ¢?yÓS {ц·1¢ESzüuM§yÝM†ã¹¹×´+©v4?ðWPvƒÄ‚­ú1öçÝ€K~’®¼CéTº¿mhú.štTÐèŒÝŒ’ûÑfH_†X0.vu¼ôÖP‹,Ú 5 ]"çuÏ‚¤‹òNé–mÒÎ>'ð}›…Ç5½ o´è‚¼¶§ø×ÎǾd(pÔ®Y*:¦¡YkÒp¦‰ûsƦûÐID²‘¥óI NÝ÷î¦à 7,?Å^×öf©t5IéGhó€A“ 2N1ºnBsú¥-âlü=oSµè4"…dqÜÚÆÍäÓD;ž`¦™De¢h“gE¶ÊA"èWÇÊ(ÃQ˜K…ü%cªlÉ0×ý”A¥ø††‡Át1ü4M\<‹DƒF‰s¹?Åò»ùIm Ãß‚D¡jÙø<|Óʾë³X©G!Ð9j¡×ï , &1ÚlÍV1±”/+h·?GÿFwÛ<ÜpÄc­D0kAì¸ÛÇXŸvÓìðoêÈ;=¾{ÆÖF” Ò¾•ƒh3x$Ú ÈóFwÑ晧†FT±xV¥cì¬öÝðvøûí$w†¦ÿ÷–13úåœVd‹Â=¨Z†è`‡x;Ðhº\àsA”²¾×6Á•õöës£½£sÛH,î+JÏ@UW‰·µ\4fœN—®&)ýŒ•x\p»ž2§]ÉCs@Œ=‹V¤ÖôŒ-.¯lò¶ïšÉÁh3l$ƒÉsß|›$Úä"µÂhc4ŠdîÝE›Çt2»¬®­YD-ÍÍÓ;0Ú¨]¯¤ƒhƒgFújÊØk(Êw?.ué ”c}¡³µî~\K0¸½m6§ß10´¦Uôáú˜ƒhƒ$׽媅3½8ºÆ‰ÆŠ …Óâ·.{0W›V_Eºjùň5©‘/ùtºþ´8{ü~´Y9MV¸Ø"~!7ÎDÍ9 ½ÿ¢òvŽi\5¸치TÎüôFÁÙkß1ìî¢ íj>:}ÂÝTíýÛ[ÄcÝÒÚÚ]=1UC ©õ­òšÒB”íC÷Ûš%¼Àÿvbµ)V¹-_×gErM–®&)ýn» (ÛˆÑ&ÿ‚›®÷ãØ-2A´Ùð£ÿvöݤ _ËÈbMêGh³9Ù¤ëv“ÖñVV¡z¾ƒ6Q90ÚpWÇWÄíÌs0u»~¸&%.N ¯n‰¾Ù©cÿFy¿¹‹6;+]êd…ò>Ò†ÖDD“ÚÎXpÞ”s2zG¼á‚ÌðA™ÝèxL¼#ÔºÖùkïcd9.âqUIft«Œ]5o?Ú/.pÔÎT /â-)S²àdÑcïâ*VMÓܽ~ÎùzÙÁc¡Ã5©=hÓŒ5ò€·¹…Þ;Á¿cB®š»|’ô ‰–ÝSÍú‹Ì»µ³â÷,ÚÑ©á=àHøñœ'8Cºš¤ô‡ M[z0VÇyzeuey)õ¼ß)¦Zð[pa^5UÖñŸZX^[»bϦý$Úôƒ\½qÞH]'0eauuyi¾"Æê„ö9îQh#䚪{ß(Z[YåO—‘Ž³_ôÌ--//--„:¨zD=+|ŸXð^²;Œ”í"s—!Z«º‰!XŒí‘m„üM#Ž]xØ«ùéceŒ Œ6Àjvâµj8;êfÃuYŒEÇêúœˆæWÀ5Ö–{™ lÔ:>»¸8í®kìr ¶ªn×Q2 23¿0Z—M’g=ž†º½µ¾ >·<õ#G{1²V²],õàP …ŸûÁŽT$9ÓÙ.S ¾¹ø•Ž§6 .Í‹ß¹BV×ÃSxNÈØÊŠøÛå5D—[ÏNº^+9…’hjAfxŒ×ƒP4]]žºî@âœ~ Åt},Åâ¢6Iç«Å«©¶ éyð>ð Pƒ¡æÞ79»¸´P–àCUÖîƒÚ"¬Íº™Y3 ˆÌÄW͵<î¼”®&)}Ÿ&Zîa8ƒ‡¡½>.âA»h×Üytù$–@RÖsüл<ûµ”ˆÃ»ç6‚ù[~fD"QÛ6¸k¨D5)hóny`¬hœ… ÍÊèÌqíÚhcþ«°Þ¯y›âü™d<‰Dq>Ÿ6 gØ_«tÿ¿Œ1Úœµ'¹Ã9Ö>¥1p LCÏm¡p¢ñ‰£ ‘H"15¢r> w¡¼=kŒ³Ùß ÞjÖo…@"‘ôìᶭ¼:õ¬K¨Áe­?ÄV‹'žŠ˜íHÿ“"rwÕ„ü\…rï Ëüôä0ø=„cª¹ ÷¹ôVçè3‰X<=(ùéŽH"lNß ´#ð=§×ÝHŠS èš#y$èÿ„ˆJÔAey°ò¤.ƒ#ÙÆÏmB]™¨{¨„Åí}¥üqf‹¸©!#ù5Öñ ’.lƘð[BÕê¾3);=ÜÅìÝÄV; —²ausGowGB€¡Šeä†ðï²Ã gß%æ}ü—Ü^¹±WïmÿϾòóýˆ‘-8¥ãæ° _Ô»"l¤„Rw ŽÄ` ²iÄ_)ÿ4]ÓSUf²Ôü®fóé÷¯E9¡z B)ÖHé‡ Á_¬å<.YJ¿¤&.u)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)I韂þóG£ÿ endstream endobj 735 0 obj << /Length 1190 /Filter /FlateDecode >> stream xÚVmÛ6 þž_¡Ш’lÉöíÓ^ºî:`X{)Š¡ëŸ­$F;g;Íîߥ¼ãÐbŠ¢Èç¡(J‚-™`o'¿Ì'¯ Ëyn”aó‹SÃu¢Yšd<Éc6¯Øçèa××e1Ó™J³èã`{’ÞîêÊNgRD¯HñÁ6¶, b®¸œ~™¿›¼™Ož&" &YªÀyÂS‘²r3ùüE° ôï˜àqž±½³Ú°ÄdðmØÃäýDx´‚K)¸21ZÉz˜¸R~8ò’’çZ+$†a¥à"N‰Óü׿ æÚN¥Žž÷S%¢®Çÿjp¨¿?ìE.›) rŠ8ا3¿`_X'àI{|+Hck· ­§èV"ØŠ,Ê¢%áÑ’ån°~ªnISx_õ²-Æ]ï]Í–+[®Iµ€8¡ ©akËú_!TIj—6kgÛÒGlw›G¨ ­#>ic¢Ÿ¯­t°r+j—ddí6ÉkŒ*ÕÑäqUŒ(ŸÄi–¶µ}1:Ž0ÜöE9B}6Í3)‚}_´U·!Ý£Ÿ{ìÆI¶­¶]ÝŽw ¿˜>ÀsVvmkÁuש$OýžÀlÙÔ¶ý‚¶ @-¹‚óñ· œRô¤QÙ[`ArAŸ“|ÉCVw¾â8‰ö«ºô‹ë—v á¾&¯&êZ{®J¡h”Ž<¤gR=>‡È!¿©#€Õ ´n&TÚC êágpÞ ‹ö*Ë£ª^ †…í]ÞPå* JJ´“s­0×aí1ŽBi ¼*¼ ²såŠrÝvpßØj‰…âfŸo$÷ß¹Zyç»ïõÝn¹ºEóÄ{bžùFãжUÂ] Ü@Z¼=ëÀÏ• ½¡˜‡M= G<÷£ó•¥ä¤,pH5€ÒE ¸M–>»Y¢®8T²¨°\Œ<¤=ÏC‰$ÚÐÑ Ã'oe›í@:ê\v[·KïŽìšD—w°q[ã½+G”¶MQz§ØÆPUÐÇF º¡y¯¸3(„¦k—ƒw¿8c“Gÿüu‹7ô¹¸@ˆZPåÂw°# …ÿÊWô…sÓÉÛCÀè°- ;–§¦ØRûÁ»ô¸oÙUt힢Cx`Ûì¼V†Z Ǫ`$ùrÊóØ_íoþ+6ÛÆÞù› x»¹Ühg7·É¸‘1ÓFð,‹_¼½S¸àS}¸ÁÏ|dR1¤\çê%`s6äB2ü6Ûµæ$LÎ…”§aPŸ¤1ÏÓ,8î-[Üô|¸ù/¾îYaËàÒ6‰UhÈl÷hwâ'—Ì[n_L¯Nb.³ìrs½Eà"~ÙÅåq<{˜ G•seÎ*æ¼^éÔc•ú3á‹öðà¸;>UsíPdà>‰%7® ^ßoTÂ~ëÐM ð6yúH¶Øq° Çóñ ¯Öº·Ãªè×xD(O«R).’ Ñ=Mx9LÝä‰è¦´N¹"^qzJš(½ÿŽ·dØãÞÂÉ5)O3ù­ïæ°p,f'4®_ý˜Yx¬ÃÁt‰…g(tN£Tô‡-ªðÚÿÓ]·Ë Ú,Ï•‚x΃ÒÔP¾™.äüÐ endstream endobj 731 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 118 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 20166 /Filter /FlateDecode >> stream xÚì½\Ûš/zæΛ9gfî»ïÝ÷߼{ÎÌÙûl¹sNä%IF*ALè6+¢¢`3‚b@PT²äœsê«^UWwÓÝÝ{ÎÞÛ³§þ?CuÕªU«V­ï¿¾ï[k} Q @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @âkóGÀ×TžÏ\&Ù—&ÿ1á ÚåÑz(° ´:Éýjþ¢×ÎmaËæüÐzþê¾»ÖwЮ6½´Ø½‹\ú’ã/¬D”B;írY.[ïÀ¯žp„/"þ+ýÒfÿ3ÖÝ6«Ð?(dí­=Òÿ\›Ay}ñEWÙÄÄÄÈØÌÜ#ª¬c º¢˜zLX¹ÚÈÈÈX †+¾9òF¨zÑ ‚Òη@–³cd¿](´¢š"‰¡[5w¯ø–X$AÑkòŸW.ÈsÇãi(§SÑ^kŒMÕ064rôßþ²y)é»)†Æ¦ß¿èÒ.þã€UV§?jW•\8È!8ìPh·%q)ö_¿»2ü¥µr4Ìí;#Fá NÕ¦›ÿÛúb>tðúònCcÝw066!0ûEà`¼úÝáëHC³ Ó?#|žÿá‹Àlavª9k—Ötmôþ®™ò┟‘Ñú+ï´ÓËxÕÔïþwN›J¬¥³ãŹ\ÌIk þ±m£š§Ž5\43\ãŸ~sþ (Ï_Øá½r5îÎàtÜþú˜‰‘‘~%¿ë_¦9×0ÿýOx»¡bž\&^ž_MdŽÀY8}«ß´Œ XéÁ¦œoWh>‹ú©F†Îƒò_¿z3[ºu;^úÅ-’–VX¿ÁHùmäõÿ¹Â >ØoÆr­Ÿ˜½³;`çý‘š‹‘¦&®Ÿä bº˜¾†ôxéB¦€Ë¤èÊ'®&åt¨p¦áÕ„üln±J&‘ÌÝßäH: ($ÊûÄrè>Q9kîZ¿B™dR9ÒƒíBEbD"ÁíT?S‚}9,âàÇ»û)TãÖ ¥âH¢{Nµöë —ï%:§®·0û¾Eë¬ø-{%îÆÈ—ÖÉéÍD …ÁŽ˜TÌ?ëˆóꘗpQʯíeXx ¤Ú¯J)“(_L,©¿–I²vâÎ!¿‘Jû™•–å5¹Ê}.fn “òÙ=6´’NÞÕ:;j¾a:œB¹ñA‡møu6Xƒ«H¾]aæX*Ó·´múÖs‚Éi,ns>roÎgЬÌ SbS¶‘0 "‹È~0,‚~t–Ÿ¡’l›¸rÝÆ%V,Wäz,‰L?VÞ§95õ&—há0 ³Í)>¡¤ ê´-¨êA… 9@Á>+CÏœf…L‚|&àW¤Ú(ßEô$ÿLjRbêÞC+‡° œb¶ïãéƒ{RÎßz¡ºM8¶wo÷Hÿ¥ƒIûn4ÛÃ&06íN:ý¦c^Aê|¿c[…l»=>¡ _Ykrî£+§R““Ÿ½9¢¤ÅÈÇ„½Y³²é'3â’N\-š[ tÞÚáv:¸—¸ëÔ@ä·s³ëÇ„mŠ¦—lÏå¶ÌýF •k¦Ñ•ŠKÒ¡«˜*ov¢o:®s'Ä6+q·F¯.ˆmì×'kŒä-㫼.t+ÙfÓ1-ÁßÆ'9OS]¶Î÷ZávÞÉð³ :%Ք燲MŒOXܱ*>é~£æ¤.ÛøL,Û[´Ü:±Í¤H±T³à¶–8–””’uîúø ¢†Á;Ó³AýdÆ®ÝI§®Špªííž}Ã…ÒÎ3(¿µ?#ûƒbÉ‡Ë "­6]~òqi3cn·%sÏÝJè“ì³¥½ì”Ȧ{ÎåÞ€K²<Ûòó›Ü¨k7Oêæü6gnÛ1#Q²M™»9€_Äo®¥ ¬ ñ!xŠÛØuˆ~<Õ[9¾*=N ¹ª­Ç6É¥ƒËæ Ùomà•Û¹LÏ^ZpqoRbrJÆíÒvÍÉŠ»ûÜ©+JOŽOÞsðu'Ô /ŽÆxÜ9ßô&jv§döp%¿ßð÷»™Z®8}éê™C‰,¬Ññâ=ÝføÍYŒ11fßé›ùç7¸Z}ó fÄk¦Ñ¨‘ë"â÷g?í©(H'š±NÜ}ô¶k^‘‘L ^;‰Ç¹]}ô´az[Þîµt‡€'ÏžÝê„£­ž•ƒ½L‰ìP§Cy…¥E·ýmI^©·ôÌÕ†+IX+ú¾‰; ñgæÉbº˜¶†T"XFS禺2×,¼šâe.ôZõ’lswjñ<cþvÆj¿+ýJ¶IgZ'ÈF é&Œ»½Ò…º tÃlÃmªuÇ´„û>Ë´ëãËTùü`ÝÆ7d÷ÍÙÚï±&N•<Õë²/wY×Órl5ÌÆ{¦¦¤˜Ô#Wrsâ‚]Ll·©Ô€®CŠÓÎun§o?/+¾îÁ"l¸ð·Y“¨*4úh(Î`­ty}¸úѹOGc’ã©;/ûÇy ¨x¸Ù†š1ÆŸ„ØæµÆTl{»Z÷Ã5Ú*ÙF!žò´ÂíÍ­ÓÉ :”4Ùbˆ)¥ýÛñ‘w.$[y¥HT­B´ß•yìÁc#¢6ÛôÈo¯Þb§N &ú[$]CÒê±MêÛÑe?Ërl2;„Lµ÷?v!÷‰t[’ñ– *º¾“éÀðM Ý’ñò]ŵ£›1«¨¯&Áᗻ͈aÃjÊ­ÉßG·óãIÁ_L_?{üddù”À‹-v¬Ùºl£Øî† ?^§* ¯Ý‚NÍÛ Zé4Ú–kjÛy¦ˆl`‰XRÚÂ8S{‹ Gh(/ÊÐn»šXG7Y[ž­š`(?¨>Ðu³Ú®^®gÀË.ms€Œ:•ä¶éhã˜9 ± ‡·[ëë£çµ¹[*èt1§â,B…·ÅÙÆÒ kí®“§{XÖœF· KÑNþ(#Ø„äòiÔ° tø";–i:-Ócøá·Ùxì+;½X &®dàÇZR¾Á»ò@@‘ê²6öøÝ&B§¯õÖz/èÌ׊/Ôm ÂuWÜ+¬S‡Iʪ¬åûô\20 ^íSÉþÀ ÿ5v‡á¾5Å·þªZ1Þ³Æ2Z´¼)¥ê¹ ÷`´‘LuKmŸÐ5ÅÓÑîlè³Ó©Ô¸Ãׇf5­ fŠ¹µ££Ã<ì¬Hˆm¤¼;‚á¥:É÷ªø ­™}Ö5Û„s'^ãHv<¸½HÆ›Í)ÔOüQC Ûœ¥Q©®^Z-ÁÛ3p÷ãeý(0ÛÔBõ4]Ä\E¾> oIùšá˜Žk}µ³ôÛÐÁ“|¡nJù¯‹uŒªúך#(;‘ã‚CÎ,óõÓÊÂRž=qÿÍNùì sæå¸Ê×Iõ>XÿËù•þɺ#É»¢6FlØ°ÁߎɌ>­Ã6ògŒQôé‚ÛJÜÍ_G§Å敃³ÛPo~P›¼ól£ -¶‘_ w³ßuaòyvíhŒ·¬ŸS|«£¡áÙîE˜¸»9+ÊÛzm€éª5Ž©ƒJ¶a“Ž=*©…gošåÚŽ£Ñ+2™H²¼Õ³ðõgŽ.ã~Ù«WZy–ÖËTlB$Í`p42amØî *ß®†m@q»ó^«6Û /H4>X«öG=ÝŽcíâ!—~ÛÀ>Œ·v¦¸ÓŸÄzº íü°äµVż(«¾Œm.xwïüÎØMp³ØfN4N%”l³çÚ+S½÷uÔN2$œ²©2sâ³ Ø9îžQ°ØHÑ"lƒ\¯¼aMÅfÝk\àÜ‘ô¶¼ßdI÷ör14À„lÏ‚*¿zöÛÒWj¼~QxÙk³ ·Þo˜Û [(«ß;šÙ¨Ð° TS—üð½Ð™¶Â”›Ð-¶9C%[^öF»_¾ï¾„m@°äÔ&ªãF®œÔÕm"NÝ){=߶^¼*ãJä_Æ6Ê'ÏuœNOÚ´1ú*.V4ŸmÈ÷+8è`t!P6çïBÝkw²ì0G÷ÄlåÛ×X[~ÿ’~iÿ †&,õÜ»êO­m­÷7ÙP£tÙFZm‹ÁyEÄƨ±eÛ¶C…µÛܯ]¨Û,Á6²£.îIçÔƒ˜À<Ûmš¦ÄêÚìr7]y¤e±Ñx¥ß&áé(ï ¶ÁD¨_Æo£ºQ2´‰e{»£üâ&2gý„¿Ì’ZÆoã¸!Mýk2À‚¼ãj¥¦³˜g4œ%˜Ø~èXR#w6™Ì­­,•°°`“¦7jù?^·Q>ùã$zÐÄ_Ðo‚oN†àXk³ ^44·´¶×ûÑV§¿V³ Þ}@-ʼ×ÑÛ Ùf/Vì÷e€tÊ…»Ù¦ÐëAß榬QŽ´¬0rš—%¹°µêeb°†ér²{J²pàñÛ”ƒ³íOØTâƒÚ‰åý6rñøZŽYÆ­N}K ðÅâbŸvkز GªNáé[… bŸ5öB+TuÃ:lóÃý6j¶@q·“˜ü MðîÊ_Êo#Ÿn¶7Ãxo=\ú±®¹¥åyZ0ÑK‹mÖßQ}K%Û(mIè3Ÿ6ÄúB:AïåõŒ¨ã¿ìˆúëìd¦£?_ŠBv5Ʀ§Û€#¾„•‡ªåúcÿüÊ6Š¢8OZäM.RѬH¦€ÙË~=,TAB‡¿3¦SÇùé[¯)‡–”^bxPâT¬wЮ˱ €¨—lÛ­<¸ìã[xÏ_¢Û|±—”tåÒ q7;U$¦Í6 Ë pòL<_º•ê~AÉ6ò¹Mn–Q‡ ÔcòÐ]¢TWk¿ƒ7ÁÿŒn¿Çèz*eëƒOg¼ ÿBl3‚1ÙY6¥ªHy·þ3lÁ7ý’mg1Gä‹OGQCy¢âÖ‘L¦»å—u,Ôd¼ÁÌ1M°—Né%îƒÀÔz:íÜ«¶Ïy‰¥{üœ-#öéL±Dýåy,ͺnlN›m‚¡ à2Æ|íŒDñ—cÜ–ËTSÖã'7ÿRlÓþ:‡F³êœE&—E)¡$ïϱ ¦:Æ>ÚâÌ>ü ó—“ª¾²lã%DZNc»rBÏK|8ÂÑ~}†êA{°ßº—­ÓúlÃ-&¯bUÈõÇfê²°F>ˆÝ¨hÍÆ®a^oW&š|Ï2Å^n˜šbˆ6ñôŽø®æÄòõæ–D:Yì†N>M I|&¹5ÞLƒÝð—x5©t ™.ÜoFtªT;•ç^± ÄKoGµÊ·$Û<~žmOG¹2}ê6JB®t!’ü<k•ºÍÜø{ ¼é퉶X ^%¬Áù*Ù†µw_°(k~Žm Ì»î1©Ön6øy¶±\'ZnÆÂòlÃßAYp ñú*Înt£“L’ àrlKƒ‰µ–•YÒþ¹v'¿½Á& étuKŸ|©¡pñ¨/™¤œ“iG{7NT]c±/;…ŸWŒ¼rÀ®Ût°[Ý’‹ÎÚÒLü½«FÀUl—$ÂÚ‚ÍtÝR ¬]¶!Ú/[‡Ë° 2Å++ÐÊÊΞn©f|ÚÇ™es\Žmúß]£ÒØ­H#}ãï@'»o—c8Û·—i–ÞT¼kë/èFš2·1ÌÍŠhãèãæžÂk,1¤ ùzÀ³¾ež¥ºWé·i–,Óuhn|ÿhféKYTú¥R+'ú¯ó™e /.:Y}‘éô‹M¶×½ø\ù—ÖEŠöE/¡]¶Ï¿éÂĺ C}ôü\„¹ÿ%Ù_¬m"¹JÓáp™¦h?z廀¥ü † Ëœ‹¶§å”˶“%¤u±Ï¢×æáã¹³l€ÿ_aÄg b›/ò•Wäeå~àÿ©2ø«YÓ¤*J÷ŽU4þ/˜äfj\ýˆôëzÙuõi?w3ü.)s ø/O6`_ÁŸYÍSâ/©¾ÏšÍ¿2œÏج @ÿ'¾®‚Š{‚mMðŒ½—^þÅ™P{Pò+i±>>Á Þ:&þª>Ëdõ1Š1Ý!üD±ÌŒ ´fþút›¯¬sÿ©[ì_‹n~-±P @â—éE: \¨KtŸH£IäöCÀ²Gô:ÅcÑ,STýû—x²°$‹ ` ƒXFB»3_+áL„[š¤•Lþ”Ïñ¶ñJ¾ ú,±+óê W1Ý]¹gÓ:2‡Å`Íý³ ë% Í\ãNÇk°8<(…[hbÕ jPøSáAΦO¼œ È/s3ܬP3,þxçŒT#‰ ëÿx?ÊǃÁbô¸Ã-“"m„cÑLµ‰8\ð)m©fŠ¨«ýîj ?Ðy:ã»}A9F½ ŒV“cÆ´²•ÌtsÌV>ì‡r„ZR#=нeÚ÷ÇíáAÑKñAl¯-2ý1ê™.üJù‚gu;|cp©ì>lè¾mÔ(¾F3íó³‰:úô'öžÈó¢\#Üg‡é¦÷{`ª)L_3%ÆyÐÖÕÓÛ×[Y|Õ‡gRGºèv3Ä$7 @èëí¾‘hL°{1 OÑj(>J£9÷‹—1ŸcAT’󮺎¾ááážöã‘6fŒÀ.Õ ¡èÜ3ÚÑ;¥Ý½½=Ý-Ù»×ãÙ‡Êǵói{¶‡ì¸Ë…J¼£5Ëà>·À0«âi Ýç£)Á»²MŽ€#à·œ(Ò(#Rn-ÙäÉÌ6Ì7Ÿz¬G&¡´•ñOàþ«Éá6;²M}íÝ‚gaIÅ\pôÆrp Ú´Q|…˜j¾F&º´Ì)—. ¼¾t¿”ŽÜ¿~åʵÛÕ]°8U>/¸œ›÷´¬I®˜‘öª‚yWóòž¼ü(Tº‚bn¢èÞ+W®蜔”çÞù¥—‹' òsFeðÄÝX»scVD£¢qPÐÿ’IÂ{Ú©cÌT¤îL.ED¸ÛÕ“YÃÓ² ûŒÌ“?~–m`Ì•ÒÿLzÈGÈÉpê|ZZ±2DãLSªÅó~‰¶eV~v£Wèa{po¼¯³ÅÊ&! ç”+›+Ãó†—ãpØ—l|¬JõÏù‘]‹uÙÂþ+÷—à².Ï6]ól¯e]ÛÜOgI¡@ñUc¶öšÝ¡Ÿ'Õ°Í Z¬ŠC”ls¥KÅ6oÕl¡¿òAT€«%ÛÔ˜q«R\.löwŽ9¨Évè~Ã÷Ë{œŸo£™x\ôÂÝ€àÅdOO ÛcìCc¶oÛ aÛŽÝç æâ}‰nê®~w>r"y(×íó6sÞZ¬Xb!Lw#Ì°$'7îN6T ¡ ñóh± 8ú˜fL¿Ý#éÍ^žmP>·ÙÓ<<£à÷ªØF!ˆr0ßtòѼ¯Yé\ ¦¬LxÆEÙů ’¦[&û®iè_È6*o§xvª6oÄ)åCÌ7$i¤¦rÅçtp¬6›†Åõ(ô¦­d'γ lIÕòõUàKt`º÷Óƒï@ÝýDr’­íÎÉ@ðÁÑšµÇ”V|-è?A_©{hêÄ(ò™pkf쩇3c¦Æ»"˜ô-×Þj³ rkÙåítË Êó[)Añ˱ „‘Œ5ÔüÖ!{ª)Ì6 $ÓÃÆ6á‚× ž³V›\„ãÉ¡lƒâ×…©R"–ýnDÌê ؆—µáú;uD Y¥¥p˜~”¸šâÕŽÈÅL½=‘`¢ôÛ(äs­“úM)åT&LõeÐÃ_4j,aYÁišqıŠ¥¼ÄººË$¸„÷&ž¥­^Ã<ó¼Ysqºý¹'Õ02_)ÉÓõ>T#§È´ºAUL™¾Êæf¾i .âv½bñÏ:ÅÚS¯‡0·ñuuøâ¡ný:{VÈ2l£*Ú£Ãë)–~,2FÉ6  " gÈ<^Ô¤Ò-g:’ֱ虈_bÛ …úÌ6±wj—|uõ ÁpwSç ÚÆQ|5àÅѱñêXÜŠê„oÉ1êPRƒî+1—;U¿Ê73XIph£¡‡Il Îfm`dx0ÎØñ½òúÜ6Þ”¹1&ÚÁÞïÙÝ0C¥%%™©g~söÃܾ‘ÙC±¾æt’†Ä L0K{—Œ›Uj>êr^e’Q½øŠ²†¢,‰H¥34`ym“ëŠ^é…[sº žæàìÄ¡áH ‹ð=¹šËrnc°·3ˆ12ÅcM(,‹ðUïç™6x›Œ9½™ÏŠ7ÜŠŒR0óŒ°Ê­O«0âÖl:ÀÙµmÖ™n6ŽÎ“¬¨Õƒ‚Ç›?PéFe—SlÌéƦx* kF :¹nlçª.]I ÑI -Xl†JÈ#“±*S}’N!ûi[XÁ/v¸ºïB›8Š¯m÷¢p6™ÈÐ NÍÔ"&çMψäª_R—+TÙ-â9!wO „õ|U·*çqg¦g¸"9ØwÝw{¨ W I_¡ ¶UˆfªÜø±r´Ðd8==+[<Ü“L27£ž`ÁT~@"šå!¹Ïp…s"M0ÕÃåR!Ÿ§¾*ÖèE³Üiî¬l!9 x3üY) ÌLó´˜ ÎÏáò†üSð§gÄó¯ç"ÎÌLOKä:…är‘7P½.òþ"¡@ÿð\‚g§ys‹•‘m‹DÙÅרUËg‡Ý¨¸œ²ÁÿÔ2©‰W¡~Ñåª lüÝöä€ì ´zYðßL¼¢A”P|M¾ËÂÙ„õÎýÈV‰pÔÍT_:ãdͦ8xöA?º.ð—ìG>·¸Š_B½þÍ Å2ÅoÙ°5¡ÍÍ …ÂÙÙ9©\¶s(P @Å/ Ø€ \ÂmiüTÛÜ ÒæÆO£3âŸòiŸUî¿(MOû§îaáפ*:[?õŽÎ.o×ðÆšê?5¶Œñ¥Ë¿¢Rßœëln¨kh•@oǧÎ!ð—/¶ro jõŸš&¿é…Lö€u•`ù[ðS;¨@œï¨€þÚp;œL"X¯O¸$—Ù™“.<øéÚ” úºµ×Qé²if^p Ë^v·e`«e“z%éWÁ6 iøZrü…¦eÒŒ8É¡’¬½×ÚÓ(dê£ÖÙååú]²Ç Ýž>#ラWÿ ܳ#âéW_6OÌ|>þËôyâqð÷ÿüÍoà?óß@»D®Å_¿^ƒtm)LÓJ=avÈÎœ¬d›Å7cÑÜ¥³\z±s‹n ýÛp'ÓÊëøIT§ÊOǹE\Ö.á‚rh³Í¢Ë9p_<·¥ã.¹EÈ" !¶Ù b›%â íñÄã%ª}‚^ìó&øeè=Eo E¶ÇO½úuÄ6GªE µø<ój }Fwƒ=-æX!ò«åÖ^ Ç{J¬XlK—¥~/Q០Y¿@oÉq‚yÆ;üXšü>¾0ø )Z(~*¤¸h*Á$8%Éq5Û€ò™ŽÃÛüHDLr ÞUÑÍåß~wcHuãQ—ï ‘\e;SëißMƒòÙ&ÆŸÿõ`©j$å7ýX$ •H¤D¤^—íÇC±$ J£‘¯§@@>÷øl’…H¦ILçóO?AÙ~JwÇ‘á4 *§–Oúxÿ”‹TF*•ãqõU‹®n7ÅéŽòí~vP2™¹5ëÞ” zoYG&“©’…džg Ê`XòéüÌÍt :I·ñÌ-iQ(÷=@ÿÿ å eåýÝï˜$2…B [îË}!SS«t²%=j-LOK:W(Ðaøú…m®Tç˜1Øz?k… ¡cZ1X’Mä8ŒÕR6û‚¾’ýV9É©17ù[œùØœŽ6w-ú.4*A³ò“ñj¶‘MuÙæG&È‚µWLY—jYÇø§Çë,ˆ"Í5xWwUÖW¹)wC§:Ëc}mÈ*™HôˆÜÛªÜÛB0XŽýîyu’¹Ñ: 2öi7²g7*ZÉ·z`{jº¥ØxÕŸ [EúÑSÚ™¨”Àª-ÎÁÑ:Е :Ï ªôs£` IyþÿO<§Lk· 09Ü™ "óšþ]y¾Zù¸†­ð1.ZUW™›Àm[Á.>*­ýàïfbv¼„'Û€sÃ*¶‘Ï„Y±½Sóá6€%Gcð6þ>¿;˜s¾C9A­Ú‘α£RkÆaÑæ¾Ùnèt N,›¾›S7,—‹‡ÝiFgßsÜQžŒ1·{ ÝXbãyq ¾I%˜:~À½­bà.}ù®R‹ÏNôò;'CB…¾Î¢Ùï‡ÄÐ/éèK;¬á±bÝF\å`d¶ëa\~ÙD‚ ÉåÐ èôãŠeÊcÄ£2úlïfÔúk¬#ì ¤„Í÷p$«Æ)x²\ͽËw>诺ÏáV1ŸŒ èx¶„ãÍJ·Œl4ˆN‹< ?E!r"Å@OÔ°  ¸µË—ᇼãLO]nD€`ùÕ4–ízxR€J&¬ÊT’ÓtÛ‡K×ïÏÉô:qÉIOŽÿÉ'Hrn³?ÊÙ%l¿\ÓdEÞ.ÃkX oxjA¦î¾ï(áwxXÓ°æáÊõŠ»5á×zŽ{wÒ×Ô3ÞÀT8ríòåö)p²ýcÓ$Ò(s©æF‘Ïá°¦âéþ¼Ü«}3z­\ý;ðoÿ˜û,}ýüÍ߀ïG@i‡Šgò*¡Wÿá7à7öª;b•TóÏðî p¥2ÍoþÑ«Àÿû7àßý à€êvdÿwQ!|¼’ "3Kÿ¤¼ôj•Õ¿~ ¶ÙùJ©µ"lS2$è{Ç"ãžuKU–†´Öb ñb—¨$3Ò%" jè3ÅûìÖ'Ÿu§ä¿‡Í®‚PzdÞ{íLås}Ž³ÌÇ]ª6*“"câGa¶AöÅ”‹|eW&‰¤àl,{ÅŽ"ž’m¼=ÂÏ)[¹,ËÙÈëJ¿&Ûóq>Þ1ç Û@õñh‚×Öù]ÃyAeº±ÃÞtVÓ1‹Dp”©òD7œÇÖaõ¬[ѬH±´%HgyB¸R±XÊϸ®öºÔ k …T*¥fL¥ç ·5Ôµ÷#l“x¥½6gÎykPÓÙçÙ;Íí7 çO7ÑWÄ¿-m£HÕl£cIÍ xÊâ+D"ÑXõcHO¬†ÞÝ 0Xm\U‘> ]ÃBØFÇYx¬Té©Ö_$™¹÷ÌO|Pw4ô½Þ³t©„0Eü?•Êµfr.ØÔÎÊÁ‡™0!8œS¥ò2€ Ôxàÿø ø·ÿö*‰šÛ‘Šm`á]ðQë¢ÍJ¶ù?@U`¥røç·XÛ<¿>¸N z~•l32Öp›†gÕ 4-m*Šh´éÕ4XskÉíÍÝ~‘Çk‡nœ} /§"QŸ4Lè '@Éù=l‚Í~WæÙ75È5m¶‘L·¥¬w RÍ]ÝÜÝ=ÜY“íÊ .Zl3ˆ1c9¯õñVÁ†E3_·M¡Å6—·“ØêëÞ^žN¦«0'AÙtÕ&_3ßÈ7—"c@ ¢75Ôƒ`²ÆÉocöÂNåÒ’Žéè©~XÝÙÕÍc­‡¿öÔ´£,‡JµéšÓÝD bOº_ðfC õZíØB?Æ«KI»üy¹ž '¯H­\fÛÅÙ¦÷}¯5•cãÕ™«“=F‡žÖøô$é6,Q=Uú1c5YËÚY–çãÈ^ƒcFí>PTV+Rè¼ðxó52Æ©}Þk/9`mü`p¹‘£V*=úcî>PÎ?µ~þ¤æÏAˆµªáƒüŸà4e”Lÿò[5Ûh£Ku ²ÈVò >þŽÊQ§Í¯žm†Ç› hZ5O5 µÊp¬Ñ–7PÇÓç…áÔÍ*b×’r:A`º„ìtxnè-•fÕ%Ôwr"?…ÃMÙû")8ŒwV­.Û½ÌHayš5Y[ÍW.`›ñ0¬É®wÜ%Ǥàú®ë )K¸s!Áã¿)Èv¶b‘Ý·‰5çYý«;ak!¡µïäJ–’¬âÍ&n{4³ι¯Aئûm.jÞ.ToQƒÌl„ØÆ›Cu)Ì 3ÃùµÉôi¬ùþ÷T+· ±¦hMv«ñ·FÁÂ65 0îÏ4Üz±9Ém(¦Òèuc`SÑ)ÓuH¬Ê[ô6m¥šm3rÞÀÝ3) 2™{WÇŠîÃÂáõ&*ôh6«vf©Q5Svƒ áàÿú'EÜk³7Âo/¸§>ÿÿœ’)ž&Áßÿýbl#€U (¥ÒLOÃÇÆ> õÿêÙfP<\Ǧáï×óUæÀÔ3‚ãé(,˜·ci»ÞÔ;Óa+ø²ì/?8Cñ¼ '^rÁPyí¼¡]‘¿‡e·ý6Á6žG”}éäz,.±\í-½Ã42ˆ{ÊUùmÂÏ#þ‚¼P3Îî2ÍèÔh߀P¡ã%îÍßnh.7„ø£3"ÈÎh««J4¦L£Ý*ƒIp å}ϸL-ïãÁ8ü‰š±%ÆÑD‰¶œsEª×šû`mj♳ ã5…J)íR_¿»txÛáÈîR{‰%é¾Vö›¿×ËPÑ÷ KàTŽ©èfæÑöÕì˜Y½¼Ï°M-T ÎÜ£UÚê›;©tˆm€Ñ÷·(tVˤj§ç‡» ÙJKJ2]U=pCØsbdÛ¢¥O³#òÙân¤°ÒOù¦dû.lÉRÍvƒßﯫ=ÃÅßô|{>øýTç/ž'áàï!ù-جôñŽ•€«±¤°¾ ¬©•&6¸ëOp—•¾¸èoáãMêh´ÍU`U(¡ãá¿B¶Ç¤D§"]9»*ZZjÒC-BöH•ã7ÍÏ2]½-¶^CnN]ïhîbµ¹xZíÎØ[Ü! ×O<,khlþTûaW ¹ç®ûžŠaZ…¼ýX9!–ߌ QC³;:jÊúŹ“|’öñù{C,\6}¬ªœœa›Î óýÝÒæææ/o[L÷t뎀÷G[<’skškߦû“YQW Ή·!¬K>W]×ÐÔX_ta+–éç"9¾;ßUÕ775–Ý;FÀ™WÍA¥~z`Û¾{ízùÛ=nf.[ª[;ªË¶EnÛÁb…]îž@5v(À†œü®ºîCé};>ãf¨=&%¬ò ™m¿‹ùHí³IicÊð>âÝpnq/Þ},~ÛŠ@Øwë#"ËCïîÇ¥âKŸ×mÓ㈣OÚÚZ^Ý:¸H¦åWófº=¸ðýyÍmmE—ÂCíLYa0ÛH›\MMã/?…ª¡éSÍÅTO†ÏQ¤bÌt¤ìÜþ~f•ÊÓ1XŽ÷Ã×Þ>s¤%_CbH GwíjÕ%ÿñ7àßü#¦ì×ü?0-<‡Hx 4R“½Áh?øà÷Õ-ûìáŸ÷-þ=tð·j¶‘‚1Ï'•úã`…RSúoàwÿüÔÔÇ?+Õž’aTVl“lIJx­Øžq¶e\z¡2Û_\ÞçhÎ`²­w|,S€Îö¾7ç°3Ô ’R~$Gwo’¨ú@ù\»;ÍìÌ{¸Óæ·½ˆ pe2Y,k×ÌüR$ÅD] -Æ°}Ö%Sˆ&ö„»ÓhŒu[ŽÌÈÀæGÇ©TvÊ›1pô­%•Ávú0?VÜój“¯=ƒÁ´õ /nFæž;‚Y[OÕ«Ôñ䙤 lÛÒ!-ç¹ÑFs—÷o±å0X,¶ÿæŒöÕÐ3ôR®VL&“á¼ û •ú´Ö&óãKLv1 à㸳mJ>ÙRdÉaGæ¼AhµàûVL:ÛÖ+¿¢ñÛDù2“.5#ï+½ÄàX}˜ë*ÎfX9ôp‘ªŠ——Ó,æv>yï‡4jCÛÃ$+÷‰9}¶9³Î:äLò#1Œ}¬JÏk|âçhÎdZ$_.‡Jx-n-‰`õtTð›c¼liL‹ØÃ÷Eõ‡WP×+cǃÒÉö´›É4·ÙzàʬReŽ|´£ šT±ÂZ^\ò´a3ÍŽÜý¨±˜¸¥*±¤S¬S+Ð%IèÍû[ðïþÄÚu<õ-˜þß‚¿û0(S㾃ϧ¸ÿð÷à7t°q ü×ßÍIýËoÀÿóÊ1)$Bjˆùø÷ÿZ†ƒ<­y\ÈHÖë1TVÿڱ薲‹L ´1j»CokY-kyÒÎDônZXýXd°Ä†¿‹Î'„ÎÍt>ˆ~Ø»Øû‚_’ ÷â‹>}AAù¦S[=øÒ¥¿Ë3åæÉç:ªji(/ÆØyÛg7>D„ÖúÎ0‰§Ù™œþÂ6,ùµ¯H§ÁQ³ÞÈKW7<’»t¤¨%…âW€º[Y=é/5O~¶­äÈÕ*ÅÏe#-1®[¼¯®}_úÄ…=õ üϽl¦7ýÄsù_öUá1©ß-æ%^¹Ñ }7ÚJQ øjTáÙä+6ÇÒÆ=« ü:s$Óà·¿óÍS¾ÑÅWd/m~uFÉ (Pü¬]œËÑÛ>ûÇwcð³÷·Úê÷O]€¬ê€‚Ç™“Èц†(ì·`.¿üKÉbö¶ˆNÅÏX~THùQAISêœÛÙüTÏ÷Vø†žüòd€xÒÉìAÚÐPüWÓcñû­Ùä\x΢#Ћvä‹šâÈ™iŒU¾®|>´èCtÃÇKDV×3ðaêPzSPz—Ðo–Š,®¡-ò¬Á·—è¶û–J¦½S§ Ò)WÒñG=‹%\þ‰Àb¯°ø¨;,9®¼\T(~Jˆgz÷oò"á0D¶ËÕònåø††m@¯÷àfOÀ‘C³ÇÕ‹q$ÜÞƒ±¾‘@$¯Ûr°—« Y"å^Ý¿‰A!‰ÇÀ¸³rј ¯ >C¦Q fn;5"Y =®:fipÿ}Á!k‰€£&^|¡±1$3½G¶øQI…“pþ929 ”uÛ­ùß{žó‘¢Œ5¿ÜànI$@i,S/•Š ·ªG R©Ðóp©‡Ü‘Há÷Z¡26wµ âq;ß-uƒª8E¯cþh™2ÜxÛÊÁSwž)sÛ“B]ˆD’cXú°r7ŠÑÛ¾ÿa—ÕýñŠ³9•€#…ï˃ÊÓ“³ÙO¢R)8cÌ]årŽ‰¦ç×ZAU@·ò¼^Ö©š$ãæï %ðLŸ[­‹± v䃱鬹f…_~fGn×»m~öD‘Âv>ÿ´A®®¹–gg]8d Žä{x€Ì³†k9± DÕÜåÌãU=_eB©o­Iu¥P(L§°Š>$Â*7Øìß‚¯¢tQüŒŠ¼;€BÞœûŽËå·•±häsÅଚmd“RPæM>¼/Ýdf¸«kÔ!…²7<çs;üf†Çãò¦Ky¯q΂N¾ÞiÉŠ½8£LÝt{× jêÉ{¯ m«xb…ðƒíl®:éDÓ%’™'$r ¹^dýؽ:áì¬ÛÂ1ŽÊiCvæ "ãCN—rù|îDwœ5Ùó²TL_:vðu—r&0·„¶ÒôpY/z¡7<9íY+,d™XlpX&’+4˜“eW’iL‡º¾qŸß\rŠFf"Ó¨5I¦¦3ïù³sÜÚ\ ŽÌqNìãωøƒÑæô-Wà)ÄÜg±RtÖ ž`V47–ìlâ¸ÞŒ»8{#Ã:a\8'@ÉðcŽ)æì›^.;ÝSâ‚1Ùû–î{Gƒœ ®±>æñ~O*¿Û Ý3ÅÒÖꛚáÏ)@~©­‰iFaÇ ôjƒ>xãm…ð|Úæâ‚Ýûî .wêÉG3Û$!<ãú×S1Äåòx£}ˆr•›yN–ád–Öˆpnn–ÿ0Î…‰t2wO„—¡@ñs¡¿ðÖÂeRŒÌ¿U||t§¤¾œP±B6>:¢ì%R©¬ór<Þe½^0%Ýk±*èœ&¦B8 Ï?Ï÷ÁÙ%äi4O§¸G0°kVúm.l·²ßxIðp3Õå{xÞ†+^8bð¨Úx¸–fç/U€7÷bìæ}©£yõݺ»åÁð¨rÏ<…\OÈéðÄ6^}»^cw¢*@ |›x‡õªÈ»š5ÎÀ&GNÒE˜I€ÚäUƞݪ\{Ý ÍÞªæѾÚıÜ{f›ç Œ][ÔºYÝã4e$ÿeW61lR‘½‡ïo °’ŸiŠü2;Ší´OJ¶±W„ßž@î”ñ»ì¸EØfø±)ýV¿y³—qV¤˜Ëš‹m…‰$Vt툋ç…•Y¥½síîÞ £Pãîi,£çÙÑ,Ëht8YŽÅÓo¶Lª––T¥~GŽàÚ¾mÔ’Bñ3áUv2Ë)P}­–ßfðãMw6…Ê`q86“Áp[/R.Ïì­¸ì`É0¥XîÈYaX”fr=Í\ÏiXåÕ©x†{°H>ÈÜBf[lˆˆT!Ÿ`¸0Jƒ¬,/†%0Xl¨„,:ÕjoÑÒlÓîffj©ÉÑžAóNÏCØfm³z‡!O|®zôw[9æÉ7¶YÅNÔxƒ»Êr©4Vûœ6Ûð·ÒILwÿ¨Hþ×y8ÐÍ× Ý®†Æß«×}¢IWkÈ’êd³ÃC†! b#œM£*†(ÅŽCsòÔd¼ÎD´TŒ­36N«ÕÛW¿A¿^¥!áO¿§šÛ‹”lCd¿íSë0 +H¡Sh»GñKàõ…¦£?_¦»TEÅ6óýïÍ©ÄóÏÛÅb±D"éÌÝsR²2©dN0Ñßt5+ž€%Ù~ÉÜôhïÃK‡-¨ó€D©.Û€Š>_,)»nl ð8Ã6B ¤m¶ò}qb'Â6na{FŒŒOÎcbR'|/´\ÜnÂòi™B”ƒŠâ $óÔeئÃÕÈ8³jzJ+ËÁÜl#X„m8*¶2ë|s b›‘ÛÄ1I!—J…3óùOMAªT§‹‘†m¢ +âñG3‰¦¦fff&¦”’a!Ì6xÛ5Û¤9p¼ÞÔÎ Ê R€üMSªgu=Ù‚Lòz-¶©±†mÞé°Íz”mPü"*:eÆv!¡Q€wWNŸ/®ç”–TéØPí5*Á¢U¬Ò·s¨na0ÛÈg»:ºæs{DYÉ©–€ƒ]Í"©š´µÖ+‰÷!~òžZØ•Û.d{Sbçì¶]Ÿ«2%`KŠà?¤Öê/¥ú;ø&K°ïnº©•¯`~é xš'Ò[üyqk CtºÚ"_Ï$Y¦!lsƒ ›˜gûV¥%±Û~upN¯Æ‚SùX¿Œm Œœ>©^ug'•4XR¶{@–O7Q)[ @µU(Ì(×vÏna®»¥²¤¤Üf[vQKJ‹mÀ·»mp¡§5ÖŽLÂW.{ÚЬM?‘^?>ÙH#ÅÜÖ¼WÑé0¦õ6°4Û –ŠŸßK¬è c’<3î u×—0©” %]j/ñˆ »œIÆ_-ëššoxz8&ÀËñî›%M.Ff{ÖŽŽ½¿ãl€‚ †cFÇÆÆÇFÛŠ3Ík» Yã—ÐWR®µŒŽLÃý¿hºÑ†N"’<;Õ…€Ø†Ì0ß›S2>19ÚýÆhwCéáºCéŸÃOFÆ'ÆGûó·[»€ÉA1uþྒ˜ëNo1³ 虀R\;·Á‚à†+‘ Û. íJû'Ç ½ÿœ¾’z½eldFö6?•B·zÛÒ?1>ÞYý„‚Ã^Pº‰¿m°$zXRþðØÄÔpý†g,õ7âiŒ –Á®?173ÍzÚUÌØ`s´ƒ©û^8ØÝÃþt–_CïðøXÿå­4 þøÃÏ° Ècgf’x«®ä‘Ž/œÅ6x+–¶’, ú¤¦{ltðÁœÃHÑ‘Ýg›`ΔvOLLŒ´;cMŠ”*Ì’ºèÆÑ´Ûµ&Åì"èFÑx7“M!Pè–·ª¡žt—+ Ov£M‰áH¦®‹=Ð3ˈlnüÄîP O$ã>ô©öFª–°îÄ{ÄHp·uK<¯ö¶Â–Æ;¯æÙ;‡¥¥ßx7_6þð±íTžD¦GgäM‰‘À3ÝÆÿ‘V‚HøVz(Ž@dÚúÞ«“N|°¥bb¿åüx¶±)!þ1lN]O àwòlM½ºèfAÆãñna%­*õGQÿ\¤šm¿1ÊiW¾<šB¿¦²¤lö÷4Ý÷° `1¤˜#w‘XÒ‰FoÆÔ”’W«^¼ÎWÑžð8…ãtê¡zq·læJR0‰€gØø>¬ë÷´À¼Óº@Ñ,ø³§IÉ6ˆÊ1;PàU&‰i“™÷Z¢@ôE÷ë‹.l Ž@^·õè°PeƒN·>ð°"’HlGÿ»ï{U–&ߘËzÕ¬R¿ç¦þJ¶á…‘¾Ýxcmÿ(~VõFï7 ¶FûÒ’w-¥“ëí§4 ¦}Í1ÙeóQÓa¿gîbeXÛ[)ÏL5=¤‘˜½K÷‰‹l²X¼`©½Wí:—GêgY"´Ë½×¢À¡C¼]_¦[øì†)º 5ûWPÃøKhI‹Ê)¯³˜dînK4>Úª_ÕÀòw/ÇŸ‡Œïí@:x»SGáAnuž Þâi¼C>üÖÃÞ¢°Xqà Œí*2ñèÛd±ÚÏSz°Ç†ê´Ù©,q ®N¾?²T/µEТoiJ¹ïp5…@9ÿZ9LÞîÌ<ò|JïIƒW—^ –þU£÷¡)Õ¡¯ó¹' r^­˜nψö¥Ó¨{Ÿkåð$±Á{1$*J£‘0Çá+ã )áki4ª…Sàý*UŒ”»i–6É•×ÒB0›A­{xÒÍ’N!3ÂS.ÔÍ©ãšnãáº;V4 ™µ;»DÓòÚŸu³dh»NÜ—ªWc ;J¢¼ìÈš£_líIúæP4Á-RªºQQw7ËÕ’I¡Ð\ƒãZÆ•ëždsN„¬‚ÚÝÞæÄHxq´lv(3ÖA¡Ð6É9¥rµ€JÇÃ<èTŠcÀŽÚIe[…Ùƾƒ7r`£‰Lu Jìå+QØîGÞq¥ãÉñm…eé~½F©ÏLT‘(ôW­ð¶Ârao| #‘DØqb꽆m@pvðh\0ªV¦Å¶C×feÀÂèY©ogηŽof­8ªžú7ÝZ ^u‰õDY1Õ˜áI¥Riû}—K¼n¦Z˜G?WJŸŸÜΦS̓ŠÛ&|¶0N^užñx9ÕÃe“j=¾ª{@ÖBTœ¸Y®‘þ÷¹ëHv™Ðãûê+jÇ$šÔ1~ô˜Ã¥ðj—Ìpœ{ìÂÐŒ=7×aÃï×ÜO#1¬Ú'áGªn:™“É4Ï{„Ð×Sœv3¶;T¥a–¹Ê Fd§.¡¼òL<Á!@(C6 ÞHv=)ÑëÈàý¡HœkŒºKîµ"m¾[‡ ôWѧfxº›ÇŽòOM=cbPÚàI49_ÒÑÝÓZùÐkšöjñªŠshdÎ붡qž ~t™Ä_)íêéi®¸mÁ~‹Ô££Î4ûÐã7JZ;ú i¸•²žæò¡±½§«ÞtÒ5rJ)1}ƒˆl‡ÔÓGLJ{Þû×ì~ ‡€xOfz¼©ilo­Ë ØDåC‚0úéÝ —S\ÝÓÓ]Yx’ŽgÜë3i+ÌMʺ„HJÕí]Æ&¶Ïª[ºº:_çí½›e {0-¢îV|jéåÝ>D£°c]m ï8ÔÍg‹á›EU®8|âõòÖ¶¶9»H.m<)Ä6&8º›kdIMKGkM¢3Å|[R[»Ö[0‚|hŸ˜øxï{‘ýiL>Ï6’¾@sbÈëݽ½M•%ÞÖfœ Ûô%x¦?híìêlo<kNŽ¼½PAzrt½Eøy”E1æÙF8Ü´'%¥e\w ·2‹=÷²½³«½¥6Á‡hŸZ®Í6¯/o&‘]ß|êèéj¾´ÓNÅ«ÙFp!5îJ%\¨$'ƒ¸b^ùÓ[c¢2ÏHô?Èñ…@ŒMf¥^«é+Ë&PïwCt>¹˜x,o¡J1\J°ðNȼÒÜÚ&’5I$Γ÷½=Ýϯ¤’èNUÓ`ß›ý‚ÿ²+ÞH_oç›(À®—7“ž+ 䇚yç w¼¹—r¸a\Œhš]…—Ž^Ñ°ÜÄËíÆŒh¼ž¯cŦfÔì.Ò“U¦9›Ó\ì,ÜcÆC_p¤®€F²lUZÆe»ÌñW4i>æGQ¬÷BúÄ“c® N’‘\<âÆ0:ýVmJËÛ­p´{-J¶ 1Ãh‚~¿…å©7Ò-Ö«cn#=ª`¤êà¡sº|ÑßÔf­æYGbœü¶_×sËòÇ{Û”K$är…L2¾–²ú|*AÈZÖú´<•,Kg»::”±ïr…¼*Åyv\dx`©³^NO{Ö'‡ ŒLèù}ªýìøÅW°v#ºÅ®0ŽßÖlUòéO*íIý„šmxo“è¬æ R°Êƒ!kXÊöÏ¢®Ix6¤.·„+ºf‘¬÷>‡¶¶ -¶YÊ’’õ»LÎV«dK&òæ$Zl£H¶Yµ.§É@>×ëÄÀèYRPG³ŒÝcÂ"vÈË»´+ÜˈèÕ8=¯q!ÿÌÝaÌðÎính¸ÚÐÌòj娿yªn?VfjâÔ¦ÊJžà¸&ä’&Òµ4̵'·B1ÓeÍÀ^ÿˆD’ÄØm¿«·¯ü ‘{ìúÀIWò¯¦m]objUÜ'×›BOQçWY˜žM¡³¿j¶Œ÷Ê1$^Š$ÓÍšîæ—¸;^‰Ý[6PÖÍsÚl3—dÅ`z…&%¨ÒD¯÷¦ÑäP×ìÄô»‚ôÁ’©2 .`‹*QbÂv[%®¨CÉ6Á&öG5ØS;-ݶ>ÁVGãó=ú… řڬߖ *O¼¿³­}H‚ÐÙõ˜;¶Õ—J&S• ãLÏTŠ@X·¡%fWi’×ÞvçÐ)TX ’‘gyÛy¤_Õ—e¥ßFã%–¼[E߆,¡ÚÊŒ8P®z>¿ ²cÔŒªØ¦MØTx’Ær©r½Ý»‚¦²¤Þæ&¶õÉÊ}ç¥V½ÊJ2} îåSó\‡£ÚÚö‰Y5Û“é°Íl¶‡Ø¦O¯ ˜F彩¯/ͧÖ.=<L¡žì™àòøÜé~¨É©ØÆš|±I3U}›L ç¿nœœæòü)î¤õÛÈyͳÍ|®*/ñRlóv)¶ùôø{ËyXºYôNÍ6Êf†{ªÞ<Ù¿=ÐȈvúƒö+4\‹$±N^È9þ|vÎiWªYà¾s—Šz–vîÃåïï¨x~'1ÂÕÄŒ¶ãf·Ûô¸gµ.Ï6`‚ƒÁú‹eC–íoíšyC¹ðD¸-Æ5±“+—ˆš~aë:§™Ÿa›Cjáow12I|T[£Õšzá5¡Â7‰æÛ!ͬ`£Û¾› ½Å¹¦6éõš–ñ4-‚²káãÒio¦ÑéwèÈÔW®ÛhØ(w$n81?„$!á÷´-©§›Ø´­ùš^V.+Ûµ6ÛÈç\¨†ç>̪[*03ÉCÑblé6³ÑœU›•Z4”\"zXp2ÊNy9oÔ8fyÈ@‘öN}ƇÚUgdÃO̱†Zl£r¾ÍOgØøpeˆ°ÈØÓ`Ý,OpÅk,)ùLJwÞÎB–Ôa›Vþ`Y™Áî˜QÙ#µYëU–”\4<:©©rnÝi¢c§–LµÞ»'5Y‰”Ô$ÎgKrÒņ¥F¡©p`tÞEQ}3F š™g›Ù­Œa÷&U–Ôl¯3s¡%f'¸:E^Qü‰¶9šGŸyŠ\º²Ã•¸gVç±ã;,Ò+ø¹°ÍÏ>bÏ2£Pºl#Ž³\qsT“;Å•«rŸ $š^jsf“òÞŽ >í|>\ '9©o<³ÕÇ=êÐÂçÊÅCnä5¹Í T¦ÿJØꀋ,ŒL3ž H¤R…Bp6‚NZ ÐeÅè=¶±Ù‰ò‰JÃ;HbÅ<Öe˜§­w· ŒH!ÈÞæš‘Ø•C¥غëvæ¦ï23$·íIŽ¡ÖUz”F¤¿êâA¹HfûmÌ¢NÕBåéÿPtáF¡’ç’, Ü×Â>›éö ÖN Ìþ‡Cr™8D‹mºŸž#²¬šÇferEÇóc|ÍqîÉp¦žp M÷=„Þeôí‚õÇ)ñÔmZ¹ ·žC¦ì¼V ÈesÜ^_Æ\É6Â7ì•äÜFø-¤  îz4ž¹}F¹oEFJRÕ žò¯ã%Mö\¼p±oFgy–lèyµyq?PQ¦ïða»ky‰ïôb²C†¹BR¼ÏBÂPé6s.ž~Ö nÞÇ«X2ûF툪“—§dâƒFø-g?î3ÂúwÊAñ<`§PQ¦+…èT9ȇêj²åÅ4îT½ÀPÅ“ó·ŠåtøbñÙmt —ΩY¨=ð«,h¸ÓÏú‘K“½¬Ó¨DßÕÐ8\ó2;ÿTaC6ÆqgªUz‹Bx÷@OdpìÒ®–)x5Tc†S$TòÁÚ'AtKµñ-øØ¿ßÀ?¬d4óTe—Gý«I$ìf³·YÀžRÛð>ß©Ç߯14}Ö»:ÇŸøZL°D§À¸îÊ#\ãè4ý5C]9D" ª4ȽÍã°?C8ôŠ3¾]¯dXdúÏû›T?&› qxÜK­p$‚ESÉeoþLÔݧ„p^ÝIÄ*⇎oõÆ`°T¶Ó¹§uk-L“s‘¡ŸÕ¿ÌW…µé«ºïcI211¡;†}BœØò|Â*CS3S LŒíû¤B%(ÊÙÃ!ÀWænçU"LRšìkè²yábÕᇾ¤î•ÎÙ‹Ên²¢Á»ÿЭÖæ¿nU¨7!›z}ò›ïV:œœ¿~›µiÝU ž'0Õñf£ÛÈÔ ÏvÏ{ÝŠÌlþÿÛ»[–†¢0ÀH‹Å "¦™‹C1^´j4ØŠ`Z2،ì LŠÑ8,Š "ŠC™œùÉØÇ=sçÂó”Ã{9ç\îîÎ÷¾·´>3Mê[åÝÜà䶕M?뢦JãÊ6š׸±¯·¥E5…5'¤u™Ý×Z€¦Ûo4 §5ù0~@syŸØC­ùÕ‘ÍDtjõà½ÙLñ¢½¹ÖPj'¦Æ¯Ófé%„ŸROx§äÿÞçÇçÓòÂR4:þÔm{R_h{Õ_ìølª¬Ì'ßñÕ˹Ñá­RÙ/RUïËÙé|¥cÌËÕÙDnç¹'nŠ«‹›G=¯“nÖ’üáW¿§ûc™äîU*1¤/¢ •_Åôý$þ´ß÷¯'…¡‘ìùƒ]ГێgÀ€ÿöáO endstream endobj 732 0 obj << /Type /XObject /Subtype /Image /Width 743 /Height 458 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 122957 /Filter /FlateDecode >> stream xÚì½\É÷}þœïy½¾ósï{Éöùœvíµ7(&r"DΈ$²A!HH"çœf€™f€ Ä!9ƒBi÷±ïÞÿLK,+Áíêλ»>?µzºû_]]]õ¯oUwÿõ_ÿå`o *T¨P¡Bõ]ÖI‚¹™!*T¨P¡B… ÕwY´é¡B… *T¨P}—…@‹¾*T¨P¡B… Õ»JOWSC]™€Çàqò V‹‘Å`d±X9V–âuŒxýÕ^Ø[dq¯ïÂËð  ‘€QSU„8<-:ÚjÒ¥¥©¢­¥úÖÔºšŠ¦æ7´=¢´4Uµx°–ª¤Gë­GÂaÊš*ÿ­ÉF… *T¨¾×6PR$lØX[DEF$%Æûûy«(Sð8"„‘ ˆpHH°RâU8ÆÌÔöðò°—HÀÂR…„Íq7™‹s_¹îUyÖBƒ‚'1R-ÀH‡IU…zòøç Ç?Ãá¤y€Ô”H³–Þ¶`Ò[T$á0…rÈ1JÊ – ¶o£ •€ÁbÈTã’Ê\GmòÑÒcÚØÝf@RWS’r¤Š²Úýf^ÐiE¥w»dT¨P¡B…ê¯FŠT"™„»t1üj\Ô•ØK ¸¸ÈøøhK  ·``ikcqõjlG€#/œ\!H¨Æ@‰0i»m¹m±e+1¶¶d*…ðæéh(:P@'O|‡%]¿|ÎONö8#«¢L>è`²O `…DÀ)*’•(‡%[qÆ9’íDl!‘ˆâƒ)p¬ø'™B‚ŸêúÕtÆÔ„€Y•j¨DxóÊŠD‹k-3ÃņŠx]S甄p-e‚ëùä±ÞFuuË%Ù®z$*/Ž“ˆWV~yv™€¤B‹Ân²{¼÷‚>üÄ+)ÁYÈ`»ˆDä'‰LÿÄUÊ…¥a6ü”좠B… *T¨¾jš¡áÇÉ;;ÙEE†]ºr>"("üÜ…óÁ°m1¯ ¬D‰ï …í°ŽAöÚÚ˜Ã^ ÓwVgÓ_qʸáKÙô£Ž»`¹¬«MžyFZ€g”‚¼Œœì‰êò¢Î¶zV{Ó9?ïÏ?ÿ„BÆ¿y$…„³¹Z8Þ~—BRïìsÐñŒ¼;Ô]¤H±h ×Ç“ˆJu,öÔY™ªNÆû_»34Ì…ŸMÙµ(·K¹¼RuEí*¿$BÿÍSPÈ8ŠÑyáD¯—.álZ‹hrÐÁ€t>­¦Ÿ–J$îçë)ÅW ù}¥FŠ*—3KG‡ù=uw-Õ $’ƽê–É‘^Nýu Éœ=>(ˆi§µ‰BÀý–ñÞ§.ÈVKQͲ™Õ=5>P›y^-v^—ïŽõV›«)dÂa¹„ *T¨Pý kVîܹ³!Á~!Á¾Aç|@ÁAðÓ74Ä°ÆÁþtX¨¿‡»£®Žºž®HU…âGÂ^UfÑ‹°ê&Sc.“©ùQ…Ánꃟkž˜³:Ä7ψ@ ‰ˆ=P@,Y‹ÐÒÙVw%æ¢ÌÉcDæÍ#a#NÓ{`¬ÍÝÄJ(^p¹RÀìºk#OD GÀËc°DÍSŒÉþ#Rìƒrƃk$u+Áˆ ôŒÚù\†°ÞŸŒ•O-aÐr|%¯â`±qÀ($g$’Ô»‚x»jnwó ?ÑÛúVKóucy¢Z‚ô5ªà¼þ&`aé$šlÔ#ã®åÒºxNEŽ·9¨ˆ_’'šKFZH¡ |aU8£€Å`U44SKkZ\¡êxŽNtÛ+c0x%€f}Ëä(ÍG ‰9,‹P¡B… ª¿N‰›~€–@o?2 +yGE,/Og?_wÀÀ7WØëìd K8¤®¦ë´¨å—>[²ÿÃ’ÓgY§©—4e–ÝdÅ?íÿªsÀ¥C ™„ƒô¸ºØ³™´Ò¢±w¨;ÆŠLp‘äÃ(y,VáUæ`=Ò+cjS±øS]ƒc9TŒÂëЂW0t8?=ÁÍH¸}É] ƒW·‹º|-=gj¥¯qº–k-—• =&„줿œÚƯA Q<ÒRzÁ3½ª­¿.…JÄ …*T¨P¡z Z<Œô]œí\]Îxz8zy:y¸;ÀOG OÀ+(R‰ÎÎvn®ö*¾gÝÏú¸yz8Á§ ´a/™ @7ùxÎü߆¬ÿ8oó›y«ÿ0þW#ÒÉë¼Z¾Aú÷tàÆEzÃJjü_­#°ôúI¥œ‹øÚ–“÷zœÒS… *T¨PýÕB /ž2NMUÑÌ씥¥É)m"Aá«yZ$ëdÖÈH×ÊÒÄÜÜPCxFž€“GÚVXRðò±ÊèýÈþÓU©HÛÏø~¡*T¨P¡Bõ׆.’épqF$£(˜=&A¦˜CöŠ%™nnÿh‘ˆ…$R¼rèX -¨P¡B… ªï…PhA… *T¨P}¿ ‡•G… *T¨P¡únjZï<ºåúµ8T¨P¡B… ªï €Uö …ŒŽ;¡B… *T¨¾“JA¡*T¨P¡Bõ´àqò'O|þ-g,Á(ÈÊÉž@3ÿ¿I·òr'ÿï¾FVîÄñϤ—CEÄ*””ȇL ƒl¡‘BÖd৆©µ‡éÛxr°U—‘‘9M<òbÏ;*ɇÃP)ïëNð pá°|둱7/ž!ûÓÉÉ•9./‡ƒ{¤üæ=ÿEKe*Aœ xŠF€ƒi_òðpùJTäÏ\ªè›ùZ‘ßõ~Üî/?ðó«¼¥è\9M–!«˜@yÍýþÄH§n V11ýÊO „)/÷26Èp,Fök{1ªIgÉ(´ B… •ThÁãÉ·è}ÝM¬Ž¦ºd?õS6©~jœFQé EÉ,1 )Í(Äp§ýe M·ÄÍô@±¹3’JÎ)áðê—Cm xål&]_Q¼ý°x¼³i!d–ZŠ}Za±¡£ÏEG%d¦I2Ä“Ø@ {[θ”V’ ¬—”SÄf6w6ûZQˆ¯ÒË·t¢©±ùÝŒ–Ž¦¢@3äO#É!çBòDòS<ůQØð€€‘ÃJR¸—*d^=«#ž£dÖ>@·#Ÿxu"±V’ÿ/Ï+ŽY¼î—YšàJ…½È­¶Oû3MJþPõ¬+šº­µÁd 9«‹a¨,Ĺw^”Ê丟Ÿ‚¬r*áœ!ùÕå@äœj^[ ^|°Ž•ËUäÔ’ÜÛ»)É0:Êêlfóù6ÕYæL=Ž{eKP2£ßq¢ì+‡{×µ—™X¼zYQ<#»wwög5×ÞÍÚ+< )å0µº¹‹IŸcww6ç&úíM2$ri’[S˯¸«ˆ\ï«}X´æ‘éå×Íõø¬2Õ“û+—8{·®ù¢…JÁS©$*Y<,`”Àî뮺„=¼Ãb£ š®YS%†Šd¬²W:—ÛÓQzMYþC¹[^?ÄïnÍUÄžh©àó‡ø= ÌÂã³}Ä£ñ9Zç«÷xýÝ-·ü Â3Qw¸ý=9QŽ{£IÊþbrq\ÀP‘ YÌ<Ÿ›n7·£ÄYK–HV̯oâ¶Ý0|-Êî÷jmU ÑÄžKÉs²Oð{ %ÌŠÛp€ûyÈ´–Ü(2îÐ3†ß(J6W “pŠT<¯tŸ;÷ˆž@Ö4¡sz†ú›ÃìÕhô°$P5Ì[Rmp ·+™C¼îŠË8œjO0Ìïi¾â`äV¥§V?íCïîâµçkä#Ò‹†¸Œ|¥Ãt™„7¸N‹rÖ‡"¤@Ò¬ wrÛ 5äö §jØÈêîo˵V“#©T¶Ð†ø]%É~Ù-µ=]½Üž¾ÆÛÚY¬çÕ,È´{¬q 2x²fIc+äI}FFP]“¬“%¨ô´§ZYÈxE=óvš& ç›ÁãvçD;àäeàNy\dqº[òbˆò'h¡â1jÎâÌò$ò»@Ëç'ñ÷ª›x̪³z²òX-€2ç|ý>·¿«¯½Ä]O}Z„ *Z€–6VaöíÜìÛþvZ:v¾¼T]¬ZÈxb\mG • YݼƒS¡MQ8ZhÌ‚¬ôœ¬ô€3:ŽaìLw}mµ ä{bhÁk5æÅ#-í–ºŠ*Tü¡éTToã4۪ʑ ìY©ê$ŒÍ…ä² 28ãÚÌó*D¬•_r†õz~I˜®Œ²{ödw2ÄžX^y´ÈQÏ´—Æ"µYVæ8Hù”;/ÈPGÝ3êFcœ!éFAžbÑÖ”¹ÿÏ=cˆ÷è´’ ^³©8ZOSÍæl$-Ý ‡Q+l,ÔP¡*SpΑ7 ¨pü’Ê]bB+ÃÞXMS™dàJ‹?MÂãb3ó"õePBº{ÿ†Ué>§ËNƒ'P“Z趆jöME×ÄPpK¨:ùeŠ€–D7E}ç«EgU°j¹•÷ID …’_滋VŸ®LÄÚÞ¸kG:ìŒF.!í­—mÉhý•²º˜ÖúpxP¤lRYœHÄZü­”U‰T-+V†=Nù½ñ…ˆÓTÆcñjy´:uª2ozö-NK§WSšjm ®¥£Ó j¸E%´•¤?ŒÃê]£E:ébñÊ·ë›,5Šîõ¥ ´àðj™UåzTŒ²±_UÖEƒ3}9n:Z¾WÒ¯`qj©šªFgïdšZĵ¤ºêhª_Ê.IóÕ$«™±òüt55Î%ä'êϨ« 4PP1tc&˜HIEÇl„ªŽ—7õŒdÜv×ÕR¿Ÿ¤-O2£Ƙê©ÛùÇt¦Yá°ª-’bCO›«.QM•*%N€n{QÞý; Fw›§ 6¡¹ë¬™YÓŠÎ,¢$Ђ'ÅÑ8–業¥*XYÔw¡B… …–ס¥¾ÊBGÝ@OKM‰°Z(õvAo]Qfу{î¥h*þx¨¾ÌTKUOWCM‘`–qÛä8‘ˆu¸”üuh¡©â¤µ\DÜéĪŸSgBS2°9ƒË½m¥Pª›šIhj~ŒMdmÛ½†*7Kû†ªë$â!ì¡ä@/%IÞHQñN¹ë¨ïžzÿŒ¸W4÷츪tÈ;6 TK€Ò«'8%0å~YQvuscã5= N³!/”JÀ•µ9ŒtœjaêäH€–¢@ñ /¡¥¥ÃD] iŽÙìŠLäÎ[àk¸‰VQ­¥·Îz»]Ì¢Ýö3Æá)IÍm†ª8¢amMFÉ´ 0»(?›ÑU­‚ -TMc.=AÕЯ*;œ@ÀùÝ(¼î÷WÎàJokñËLsU‘’íT€Kñ­· Ĭ.†©ºø©š¸Ö–݇s±[nR$Ðâe,¾#´»ž^’›h£†ÅªäµÕhPÄQ!Т ^yÍûåã9’RôÍŒ‚Ì$O#éðqƒ=hÁ©Xöõ”ˆ“Ž@ ^;—Ï@®%ëŠ@ ûŽ™€Q2wn#áUËŠâávÈíkclƒóãO‰ßOVóIª¼íÐÂÈÕ˜ºEÖ:Ê„ÜÍŠ²5 Ê;E8 ´xÇÞO6È©ºÇ6æbMâ ÄJÛLØwS §"y<„µ>w¹°àÞÕsgH‡?þh©½åzÊ@t« ÒKKµ{”[#©\ùw¨$íWжÑ%𸀬:k¢ ê»P¡B…BË›‡Ô^õéhÁáÔ Ëo’q„LVO€…"‡ÁaNH}E–×­˜`²»hôâtër! 2­›Vdªtè‡ShB'«£CË‹÷R!au£ÙÝí w5δtvpºÛeqTFÉ"¸“ÕÞVxEQÃ’™aOP·©¡µÂ‰²/ÚPˆX3ßx»½&ÙÕÔ[ -·v—;Xz‰™OsG[³ñÖY2QÚH‹n<@‹d¦†‰S-]\xn›ÈŠùÍavTÝÓ^-ŒŽ¾®æ+Þ-#]L:½4I_Qü"né>h!+ª]º[Äéî(NöW§`IjfÈH‹Zà\þ Ù]ÅRóZz’ZHT•ˆ[ìîŽò´ Šx0Ðåb2“ÕA+M1TÆg§”EÜ)­éí¦Õß¿¬xx´¦-×L^AK©êIª¦EA}#T®q¶d<>© *Ù[ój¯ÖÜϪOô3B*T¨PhA'—û–Âà_>ú‹§D<ô¤D5v¾}Ñþ¯'ÿ÷½«!£ ¨¬}3=øî»yixy<„Ö2T¨P¡Ð‚BË{¯œíDù.@ |+'ïF°õ¯(ÿ53# HßZêy91>æßÙKÈ>iFêx´–¡B… …ZP¡B… *Tß/hÁ(È¢B… *T¨P}7µZP¡B… *T¨¾ËB¡*TG×£‡[‹ós“㣓cGÕÔÄØêÊ2b¾ýpkavæ趠é‰ñõU4çQ¡B…B *T¨Ž.€Àzkãܬhiq~iA¢Åµ°·kF4ÕÞÖôdw̹½ìV'`ÏKs8LªùâÂüôÔ8­¥q÷ñc4ÿQ¡B…B *T¨Ž¨­uF{ÛÆÚÊÎöC ÐcD;Û@$ˆ`ý+“WÇ,/-vu¶o¬­rºY›ë«ˆíÑÍg¦§F†ÐüG… ÕÐR[Sœœô¦è´¶¿’lY[]ùî$fiqq|lL(ø<·¿ŸÛßÜ~¸…–dTÿÚÜXkknØÚ\ºûøÙÓ'Ïž>•,Åzþì)¢—[`ßÓ'OÅa÷ÉîãݺêŠõµ^?çáÖƳ'OÞb.¶•˜?yiÞÇéAóÿR6û•–šúßþ,rû!z#PZ>þøc555•WAYYYI~ýë_#˜™™YYY'´¬ÿ÷+û·ÛØÐðÚÞ‡[›?ûÙÏÒoÝ<̼¨°à·¯Âo~ó›ŸÿüçK‹ _áÄÚêO~ò“¡AiÝ.hÄËJK*ÊK+ÊJêj÷—|8{yYéæƺTϼ^UYqà.è0‚9Dòæ®ÅùYð´ƶ±¾êééé{˜L&—Ë]_[w$ß6 Ïb±ÆÆÆFFF.æX»Ü<È>ùxoo/DB£Ñúûú¾Ëe¬©¹¾“AMímRXkeiñù³gÒïÑÜÜììŒheyé{äÙv¶·VÓùaSy!«¼ÖG›kïd>Ûxgà‚âàÅê@8e Œ,% ‚I‚ â@”þú„àˆñl¯.Ó܇®˜oÎßzðþ‚ ÐBkiØ\_{üxgqqþ—¿ü寥p#?ëÑ£úš—вµ±¾»ûxrrâW¿úÕa†Pña±»»#1ßîïíÙW ¤Ô—Ñt[[kCCýÈðÐÖæÆ;å0”Éɉñ榦ææ&Xy×_C}}kk $ã­µ{¿~ðƒüB~úÓŸ"+à'‘ðÈ’Éè|ÓP4= \÷ævEEÅßþ¿þWHøv//¯S\T455ÕÜJûòÿüéÏþOÐ_þééó/Ÿ<ûâÑ“ý«:::ÃÃÃ-ÍM‡Ý…¿ô_þQø'rÇ . *OùeåM±ªo4Ü{[zždÝÏdu1^»‰[ ÂûvãE~ÛëKoš¬./Iw[»G‚r7Ø–)윱ÅÍ-”Ž¾ßÐ’““SRRòÑG}ø*lnn666ÆÄÄ ;vlbbü°8ÿñÿoSSS°Ÿ‘¼¶wp`àŸÿùŸÇÇõ–D"ññ«°±±±µµ¥§§···¤¸ðI8:"å¢Z››øœnA_—ÝÕÝÙÞX_»·‹ÏイC‹€ÏŽÕÕÖ€^ÛÕÅbÎÍμ´o ×2;;»û*tuu={öŒÇãÍÏÍJ¿A««+@&t:]$]Ì;=½=¶æ º^¥Ïçó`Éd2¤GÙ•˜˜øš ½™–&=¿ÞåÙnèŸ ÉãyeõÇW÷- N­„L/¼½Ù¥··>‘„MIØÙÙõ¥¥Åo -==ÝÞÞÞwïÞ©­­v-5%å_ÍOŒ>úvƒT¥¢Éñé áQZ·G[ëÂt¿ùû¶+…ö«…gV 'Òm¼Ã+¦£×M·è!ÛÎmµl6únÖùlÔxmT¹¯—»ÌÝ1kÊ=b<Â[þ+en«¥.¼ µo-«;;ÂÃàzÎÏÏ/,,,---//¯¬¬¬­­­¯¯Ã]†jûðáúºº••¥ñSž}ÐÌóH^^Žßo¾ºººgþP|||Ä™ æÛG‚`èþ_¸pahhhvf¦¨¨0$$ø裦ࢣ¢ÆÇÇ&''oßNŽŽ’î+ök}m5èܹ¬¬¬™ÑèèÈ•+±·nÞ<:QCGú2l6»¬¬Œ# µµµÈJKK , Æ»B‹`jmcûéŸÿó?×·Ÿp'VšûD匉;u|]×(±¿ÿýï'Æǃ–íím‰2(ZÛÚyþüÅ—£³M½¢Ü–ák%5«ääd¸e‡A \u 3¡ªŠ(ßØ6®|èZå0HØ®º3#ÖãyË’¿>,7êkÇ5¿0Oo§}uD Ñã…zñ˜ÉŠÈw…–…•u¯ vbÍd|åLT±+ 5“^œ¥Õ ”¾¿Ðõ®££ÃIÀ™@;ý )q¦¥¦@Õƒ2Ïb±b^™|…þøC)æ-ЮõõõÁ©¡m Àb±§N {óóóÄTs¸9­µ…ßÛ3+šâsGø¢É‰®NúÞƒ-n߀€/¥£$ÞX[^[]ÜX_™Ÿµ45ÃìÀèìX^Z|«o߯ñññ' ì'³SS“Û¯FÒ`0:¡?Ô!ųA Øf``<|T¡íôÆy᪠èz•.ôtÀ• ¸<)­*8ºˆˆð˱1±±±«ÞõZ||TtTxxxggÇÛ‡z†âªFn6Oߥ‰n·‰Ò[¦ê&œîô%ÖM¤7½¥«Þ××K£· Зhéh¹y+õ@ ¸Yo/¯ù¹¹/¾xñÅ‹Ïž>-+-¿zôÖ®havfaV´4?3úíÞ”X[Y^˜-ÎÏLOŒ½5+ý¢{®ó÷¬–ò¬ZVó­—ólÇoºýtëã¼¹æû#I.Ów6Ï­•Ø/º „ªÍÔÞo-Ü^[:bB%‰ÍÛêkª¥CKsc=Ó½07ƒ ,@óÔÃ쨩ªœ›‰DSR ˜dqava^„hiqv~nº®¶f~n1}Wh‘<Ù:6&Ü|#´ÑZ!«¥ b ŠÃ·œ–ésKedéÎ_©]Ö–YÝž ÐÔÔtè@Íʲ»‡Û¥¨‹çücãb¯'\›žš¼‘œs9&0(à⥠ÎÎÎ ósÒz峫Qå#™´™øšñè á¥Ò‘¨rá•Ê±´¦©ÄºÉu£Ò XQQ-ÀWU’ÝF(N-ŠJ”o-à09lö‹Ï¡I‚åóçÏàFÛÙÚv_Þ$ˆ|~vzqN4'š„âñíÞñXŸ]˜†'„#Ò¹e‘Q7_ta>Ïsò¦ÍdŠùJ®õÒ=Ó‰8íí•…#ãÖÃeNólžÏfsØJžõò}‹å\«å|ÇÑ«g.Í=ÙQÖ+y6‹&=ÖŸ|hTÛÚÚ üî~ܵãw &wª[[[æ¶6×nn4ÖU!в¾ºòðᦜœìúú:xð3………ÅÅÅ%%%¥’ÍåÂÂtX¶·6sn[:´À…NÖÂÂ$úñ\WW—ó ¥V ÷’Òïµ¾ ÕÕÕï-\A/½³ås™ãÓ ëÛOYC h#ºWýü½À×7Õ|~ìs)Ðòøñcè.Áy $ÊÜÊÃá™âv¡ÊéÀììlèCMMMÁí; ´_A‹°6<3ÞåkÐ’òáa `sºz8]LVçÎã–ÖÆ©©‰Í™¡Ö-a©e÷¥O»Ãe&ë_= Z Ma9Ìà\ž]*Çù&»Ž5Æ›~8¶ø¨¶kÌ1 Ïår/=èz§'z¨¾;Ð’‘‘¡çcèseO:îѺ1-Žz¶Jr 2‡EØN§EeôÉo £ô“üç@ kw} 3 kwƒÓžFR %88˜äƒ>07321Öópsü§úûñ¯Ìœ4Lì5Ά»’H¤C_Ÿhlhiªïïañ{Ù»Ðãz´-èãtw¶×UWuw±í@,R ¥¼¬´¦¦jltP8"æÃrV4Îíg÷twÁ?Äü]¡ ]Z{#44Ö ­¯úŒºœ€‹Uue·ðœ‰ ö¤{ç¨ ˆ7šM³*nÊ@zdR\qrR’“‹“—'(:&ÊÆÆ–Þg½à§“³cÁƒRû=3ûo6O_­÷ÎîçN,sÇ—ínr¼³x¡CŠGŽ-À'ߺu ®iùfÐb` /ŽÂ^1°<öDò¢æÙ³g玆àÓf¦&æg¦€XÆF†à _“t¯õæñk«ËSã£À,§pxPJû¸½ ZjÊå^\ávlL‰’O-¤éŠ®iMõ…Æ5aÿl†ãz]àj‰ÇJýR†ñR–õRöé¥\û¡ÛÇGö·‚ V@,ó©ºÝæxWh¡·6®./n®¯…„C©ðÞñvyü5¹"Ú­*ߥÑhs³"8xkc½©®–µ•%ˆGNVvccãúõë ‰‰‰IIIÉÉÉ7nÜHIIIMMMKK›™™Š¶ˆ9·#Z 3®¯¯<œ’r°AOO(âÙÓ§þþþGÚ‡[›ÆÆÆP¢L$ÁÃÃÌíííò€ N˜æ_~ñœ—Á`ÀúÒâ¢Áß«ù‡ø‡…Å%ð´Ë+«“’ð †ît!m}s y¾ rthüp³v ·¶÷5ùñ?|0³ü9¸àrù–ÑÚÃÀÞ×TßNåã?üN ´ìîî7...NOOÿã?þãàÔªþ™èz ïvvv`E ´äbpÍ*¢=Ýó§Z.§úá…—pc‘ø‰HÂÌ ãj»ÿ8ô™2½uT8´²ºÔÏãÔ—t˜ªÎÕÅ‹ Ù‘ŸvE(L5Ü”RÁtSsËfWlRX扬Ð|Á_þÉöÛåfÏŸþôgÿl.l´Mí2‹k˜YDgú^BËÝ»w-¯û^ɽ ‚ªdìÐå£h àêá"Zü"ã¯]…åÊ•«×®¦ÝJ5·5±÷Ð=m¯â¨o­nfnöVhqws Ì͹÷›ßü :\8Ì ’·¥³¿mXX¨hij¬ïíb‚£MŽ/ÌÍ€Ÿìê ·67³·ø¼ÉÃßÆhtvÐû8l·¿¾¶flt`b|ttd¸—Ãf1;aïaì0héïï_U\+Š®¸þ•ÊŸ~¬ðòTqìôƒÈ‘z:Ðy ÷E4r­jzµêû Rkuóˆ****++¥¼S$?/×›‡«§·GHX0,Ý=Ýììí¤‹¸³6¾W5[9V0°´&~“'©f$ºl4ªl4¬`8ôÁPVÛøÑ¡Ú¸ååedýCK`@@QQ!t%_—@L»Ð4XŸ>½ÿmm)Ýáéq!à `cjldR¬á áðÄè`ÌØðÐáÍ÷˜ÌLÏHÌEcÓBI$£ÈŠvMOIÈíÕÅíåÉÊÒ`°Ú|’ÆLœÊÀy»#ÖÖUA×J©×r‘{¿v%טGà‹QZÊ0j¿´„[-¤êÍ]Wí2üÝ7–¥¨VPU¡û³]réQ‘X;bEîG>.Žz\µ[Òú„Ð233½±¶õqZV—Ö×Wdee ÕË–„IÈËËË À´€ bþVhùž=[ZR%§½îêêúâÅó……y›#vŸœ`þÅ‹_|ñPÇø˜ÐÉÉé(æ›ë–––#ÃÃÀÒ€=]]]`Î`tzzzu¤åïÿ¾«<-x –Ôü»Ðä¾Á±o-Fvš73S‹K‹²îßSUÓ¸v+GEMù´³¦o ]èEOŠ¾¼ƒ“½th·]ª‘‘‘è„Ûrª©©)‘HY:´\rŠéÈlCt9ò܃pÜD㥶DŠàjÃ>êüý‹|iÐ"füù9ÑôTEeI–¬² Zc¥Öd ö³žÐc•×w¶·ÞZüI×t†ÑUºa|»E"Ãç^ŸYóB^Ï£§_ئ°`£Q<Ý-Á¡Tð}„–;wîtvvJƒŸŸßÜÜ“Éh‰uQ ÿÑÁéŒhù›¿ùp;ÁÁÁÑÑÑÈ'º†ÚZ¦Dk=âWcUt–¥C tÆeNWWS:~ìÓ¿û»655Qe>U"}jªxÆÝR%Z:Úé­Mœ.‡Å`³=ÌŽºšjvw££ÑAçó¸Ò¡etd:4<À;ô³¸>˜Ï™L!Ð"œ~…=ØBT#ü·¼ü°² *Jžm*äºçâ”æ¢(ê\séÔýø·>ây´µ!ª¼3S1q?nñ® Pß]~…Çš¼»>Êû{kË¢â”Ùú<^€áÂuõ¹ KïÃ…öÚɬ¸­…™#BK{kÓòâüÚÊRPP ´¤ôðNZP;-¨ƒ 굇tv„2@“MÓíííФ®­,¯¯®4×׈¡¥#6_]’•‘{KK oäµ–vIø÷ÿw ãÇÿèG?:yò$œ1Úy+´ô÷õš™™AÙØÞ~ÌHôrDgXRRlooßÚÒ< ðãj\Ü?΋‹×Äî颻»û¸©©Zù’ââ#žý'?ù ø=Ž@üÈÞÒ&æÞW ï -6êY¹™€‚7nÜ ¡Ñ‰Æúª†„ {½È{ò­mOKèzÁÝ¡IBäõt]]]ä½#‹$#¾}G„–3üã5ƒeg;SÔ£Nt¦éI‡–ý*N¨*ÌL=º7ä³Á[~oJ=Ðu´öŽºÝajǶèƶêÇÑ âh§®´Ð³=ð6Â. &¥‚ï#´¸¸9wtt >„. H¹µw²sò²“!¢£§%Zþý7?SRRrt>óoÿöo¿ÿýïtôµ~ì7ƶ*Z†jvÎÖÊúÄ'NH‡Àø¥¥%999--­ÙÙYhÚ>ûüS‚²‚¥…­›…•••héîb675ÖUWÑš[›ê«*Êëj«ûz93ŒÎ¯tdX ´tv´wu1Á9ÀÁP%{Ù]åå¥>ÅdÀ¥ ¼•å¥w‚p}"n×ãáÚG=){Óu%oÓã6ê#ÖJý—³—Ó,WâôW#Tx>”G¼Å_4÷÷C¸exx¸‰Yxš\æyA~ssóÈáãâ¡ÑÉ //Ïó"œ\@aá¡Þ>ÞR¾áz™Ÿý³7§"KF :¦¾îmo¿½ÿ² m=]===­}ASSSCSsqqöB{ׯ‡š››\\\ÜÜÜ`éåå‘C‘èå°ßúêôÙdžÄŒ!ᓱáAø ÂA Çèðà¡ŸÌÍ‚ÕÔ×Ae|D ²‰¦Þâô„©a 7M³Ýº ?^¸DZˆÀ1u~7~³N¸äqÄђ颛‹)ºs1džã‰£Wö©‚pêÕ"¿nãO£) á8¦Ö¯Ç<1‹ä~/£ÃNý:´´5--Ì­,-œ;-ézÿÆfÿÖCÞö6ÿÑ#ÁÎÎÀãǃ»O†Ÿ>yö|õ¸‘©©q8À£¥¡V-l0ê‘9 EÚ>È'&&^…ÞPnn.òÞ‘¦…äd‘$”””·ìììZOµ­÷ß{åšhmòz¥dæaÐÒÉšÅ7¨EÖ«E5hD7iÆ4ùf2«`~ÂFµ¨zÓøúž!Z¾—ÐrÊ^ËÌMÇÀ”¢©‡UÕ’WÕ”ûDîC£ÓTG;%¼æ±“²Ç¥@Kp’…«¶¡9UC£®ƒQ×VÀ*~n|FÙÊUÝÜ^IËŒú¿þŸÿ%ZŽ;¶GJÈÇ¥¥¥~ú6nš–ö*ö^VR^Ä—ÕßÏ¿½Ò!þbÔÖÚëLf'ld±|^¿´wZÊKÙìnÈ…F§ƒisEyi;½ ÌÁ¶³³Ïã¾ë;-Ð(OtÓwz 6*×ʼV –ïŸ^H7˜KwuçÃ1‹~'–]?áXüñ çìbh-Ë’ŽkšËɉùùyø >ŸÍfÃ1Ý]]R¾Ätwwóð³w8²¶9¬œõõñöö’þ¼ž3ºx¾h$$8¢ðkMùÆæCÞøÊêÆ[7 ‰Dx2ùä×P«Œ¬¬P(„½Ð±ýó´@+׉ßÜX_\˜‡–ÅÈȨ¦ºú(ï´Œ ðÆFÄ€1,à>ÚÞúJ·¤¿Ó»Þ|§eya~DÀhìàykÛ4‘}m*”²£´|çÌb°Â¢¿ÌŒ¯üÒÙ“"×£Éç-S…i‹WÕæ#p<ëÏŽ^ÙE•YAÄ¥HÒò‡ÅPìb€¬øÔ~2³ž²ÝŽ -ÍKâIøýwww·–·®<Ü^{´³ÍíOžn?}¾óüÅã_>ÿzåã£K‹óí´pû8`·  åÑ£GÈgÎÈÌÀ0$0¼°°ÐÓÓeÃßßqa1?"´@ÁX˜Ÿ’ŽÞÏÎ| èþVxÏÿ3;³ß<""k___ˆö­£yëk3¢i°sd.Hss3mmíÄ„ëP\¥C52Òò¡ÅÚ×ÔÊSßÐ\QÛÿ³ÿ§þðïŽã>69£lî¬fzF §qì£ß(Zž={|²÷ŠQ|||RRRº$ÅAG ’$Z,â¯!º˜ƒ]î½·ÉŠÙìŠÝdÆlt^`¤Ÿ-Æ…¼m‡åÑÑ‘Nf{CCm®]pÃÇr œÀ\sëðáÐàebf꟡|©†z¡Fñb­Ò¥Zu‰`~ÂF•ÈZå€LÑüJßGh18£y9ÖÃ/ØÞÇßÚû¬™»›®®5Õ#Èè´·îÅè0KKKû36 UU•BK`‚{pˆµ·Ÿ¥ûY+/?«3Žú¶ŠþfvgOùxCïIG[ú>ÝÝ]B‹çù3†:8ãST3SU Km’â1ʧö^ÚŽfŽNAAAÖ§-` .è@hà°{Ø=Ý6¨‡Áèäèééêëã°˜ –þ¾^Ÿw ï*/+s賃­$±yw³«‹ ´æƒpD £C ÔîÁÆŠµÊ˜¹kÊs×Uçâ•ç®(ÎE“æÏãÎÉ.ú[vùê͇Ýzø 6ôU¡SÕ@è“‚7èëëb÷€×ØØpð«›«+nîn.nζv66vÖàB‹ `im{~:»8¹¸8ÏÌúwmcËõnŸ_öÀÅ¢‘Èâ¡vÁ[vúxÅæÃ5³_®þ¼Sñ"tj ³sãƬ¬¬ââbp u’>üIyyyiiéƒR™` éµkñ–VV§-UX,¦äƒ&4ñ°ÅÒÒ"**ò-ƒ-Â%ßû|à–¨’Ñà¼Á€ÜȲ‘˜²‘Ô†1š`~KêÌ÷ïßGRˆ„’ƒÂŸ>½+´ -Ž—§§©©)ä–”¯±^Nš:59Äïâõ öõß¿ ÀÏÈ€à&ŠÙ~8™•0æpbÅí“Ç?Œ[üaüæåw™×w27e)HaÉós®þ‡ï0Ÿ^7mêÁ-¶Ê°Õ§«îŸÁ©'-ÿÐm 7y?u®®ä0dz Z:ÚšæDós3þ~Ðlµ¶¶–ｚB£ÑÚÛÛ‘IWfgg¡ÕŽx,-η6Õ!Ðæs³¢“'Oìîî6‰çžýš9l±²²úÅ/~ %tpæf§s·ï(Ð…y~nvrb|ddX ~„Ê…%¬ççåéêêzzz"Uà°éAVW–çfg&&Ƈ‡‡ÄÏ_yÜÌ“’’À<88xp`à°B%ð%2 "æà+FG†ÃÂÂôõõ¢££D‡¿§ýÞ¡ÅÔUï´½º‘)É挊–.F[kí®épÊ£„W×P ¹{çÎÐ2777nñ3IxñâÅ—_~ù§?ýéÏþ34°Ž£@ËÔÌx$]ãÁªCQf§Ð¿ç/·*:à6M:´ B·btd`×ÞѶ竷76rM½ê?–çjªô©àWiï4OËúúºf@Æ÷žœß}9¿œð¼Î³m°?a£nÐMÈy ¾§Ð’”~Ýû‚…‹¿aT¬½«ÿ©°‹V¾a&žA†Ú&x‚Ìq™Ï¤O.çàccçh{Æ㜑oˆIÐE {_ŒÒ§ò¸8‚‚ôÉå,ݯ\sò 2 ¾`y6ÄÔÙÏà|´µ“ŸÞÇ'#‹9¡®¡*}žà>¯úHâžVO—€Ïåpºêi:;Ú¥O.æÐ! öÝ’ØzššÀ\ÊäràWŸ‚ïxc; ;ãÆFìéUÛWí>\µùpÕú·k–¿Z7ûå†áÏ7 ~¶ið³uýŸ2(¿>p–SS3¸^‰dbbâîîݽ(àŒÈHðŸ>>>nnnNNNW¯ÆKñ¥W®ÄZX˜­Aº°d÷ô@ÓpéâÅ·~仳ó¨Š=í‘Ánq»Ís½Íó¸Ëμ^=:·,m²PÈÌààs:::@û‰766ÖÔÒ8p–ð<Ïž>}× ×âëë ‘8öšægDƒÞö·žw|dxtpàáÖ;Ç3S™7lüÉ°áÇÓ…ïj;]’9ëôÙ²óyÆÇŽn5ì®´™`ºyÍd3ÎhõÌïVm?ÚŒÒÛŠ1ØŠÖ›4ÿl}XðÖ‚@ËüÌ4ô‚/]¼]ïahÝ%ã${o§Œ#m.lŽŽŽ ÁÁ‹ós­Mõ’ÇCl0ŸMij¨¥ì7 …ˆ9˜I8me5#šDÌ÷CËÊò¢”;Ⱥ´âY™DÓp.Ñ‚øyÖ"´°P6ÌÌL¥!Àž¥E°˜[Ä?–—–îefjii…„KŸbê,˜‹OþÊ"ƒmPiÁ¼àAþa¶|ðAQQ°=tLÇâå_Pñ„ȸ=onºvÁï’•K€aLœƒ[€aðy ¿pS×@5yyüÉ㲟K™\ôÛ·…O>ù£”lhÍM"ºÒyªxÝà *Oçb¾ZP©vXåù¼þÜv‘‚ÉÅÃbðÛØX¯©­|Í;m®¬$aMRþCŽne7t!ìÀùtàáFôqùªqÇœ»¥s¿)–[Úqç5ϸ~þÜ8ôï¸}O¡äê¡ïØZuéJ¼C]qxlÜ™[iî§LG™”šèæôš(0ÏÉð½sËóò»“ ¿;ÊŒ¸¬îÎŽÚ0/ËNNvMLp.˺k÷»O~}”q‡†¦'Çx#Ãc£ÃÞÌô$p »§û­3⊿ŒctŒ GF‡¡‡Ä›š‡åôÔ˜#ßI–ÃT™ÙŠùU§ì¿vžüç¯tâŸ^S¿›éOØŒŒ©TEU%%EEe%% ,©T% E‘L¦’ÉX"Ww˜žžšêëë‚^¢dš\^o/èÜéQê©hq=¦lÐ*Eü×:‚òù}3Ò í}´˜}ÏÈøÔ²°0ŽŽ¼ß¿9699ñ}ùkD[³Ó[3SßÀp{me Ä©[ó“…¶Ú£[ F¸0ð?íÄþ['æ_òÿÒ)û/2Hü§žSø‡K GÈÞµZóÜÌÔìô”hj¢CòÚ½­µ½­y… ùIoki§µºY 8lV4µ87ÛÖüZÀ|fjò¥y›4s>·O4ýÒ\Àë;:I"oAÁ†¦jûÕ«J `‰·Nº²g¶¯™‹¦§Þ:«ÿ›æ{[—jñïUÝ”¢õwûcUçLÀ‘vÔÅ€®xrýºcr’‹†¶ÂWÒ¡å[Â|eUEì•hDæIZ¥þ‘‚I$Áò2ˆb—[ÕyX§¡¡¶¤¤:¯Í‡ÓÓÉð?¡–BÒ]™˜x§$AîG<.ªmÕö¾ò±qHïl\Y €vÁÍE}¡÷¤¤Ä×D{5>ôÖ¥G[UYù¦9òw.Ào¼u¶¥Ô””7Í‘]}½œ·÷(%¯¼¦—Ý[Ñô·1—2º+½%68LP+¥¸2È+¨MÐï“¢£L~%žäáĆhÏþ”1d´<r½Zø…þýÖï£Z:i-³¢IÑô¤ø.MŽMOŒM&a)œš”hB89.|¹qràdfzj~F$žÿm…×Ë›OM æS‡™‹mÇ ÷1óÊ|€ßæÿ»ŠÅd¼éH‘—ö¡~3oö?ÄóPÔ$¯Ù¿æ£ö€]R|æQ<áCñLËÿÓžÕ+´ B… ÕëMÉÆz7³¨CÂ-¯Øc|zJ².‘ä§Xâuñl{“3¢©©qa?»Ú¡~N7ØÂFÄ|Zª¹xÄæ‘¡‰±Q4ÿQ¡B…B *T¨ŽÞK¨`uÐB`å%±¼®±W(àÇLŒt1ÚŸìî‚ù €×ÇîB8Ä||¿ùô„øûãnfÇîãÇhþ£B… …T¨P½ÛxËÖæêÊòѵ¶º²ÿiàæÆú;™ÃÑèè=*T¨PhA… *T¨P¡Ð‚ *T¨P¡Bõß-ÈWïQè[Ù¨¾×Úûpõ;+¤~í}ñ¾"|ï׎N ª÷ -ଦ&'ÈüNß>ŒŽŽBl+ËË;’¹ÂØ]Œö¶&T¨þRêcwuÒ[Þ*n/{C2¡.4µ,spppü;„B!ƒÑ)M#Ó©ut´ŒŒ|Ë89löÀ€é¼0Œ¡¡¡÷’THÄ&&"Ôå¢B…ê=A ¸ƒ±°°03#žHrf_-À‘³³³û á'øÒÍ5N7kc}íÙӧϞ¡Bõ—QCMÅÿÙ _~ù'Éÿ’hÿv(¨À×âï\ÁÌAAô—oÖ/¨­Ð/€šÛN§#¼Vs¥'õÍ뚟Ÿïb± Â^Hã_û›I…®P‹‰Ž»¢B…ê}AËÖæ“ÉœžžžššB–HØ¿.= Y~¿8«òòòõÕ•Nzë¡ ÑÐTWõ^¼x©/¾øò‹/^Ûa}meccM…åî㵎Žvh¸‘êåyÙ}¡—^TØ=òŽVHý‚ÚÚÚÚº¾¶ZPP„ýIEþþàäûÂÕ¼á£E"„kkk3^‹ð(×>.ìO>ièëÑB$333à п݀ ª÷-t:Á•öÔ0 [7?qð¯g”ç䎎œ÷¸QÁí£å;¦±†¾%ùk­{+àåÀ£Ð‚†ïBhi¬•PÉÓ§Ož<ÙÝ}öä ¬ˆß³’l‘hW¼”üIc€–öv:4Üâ¿\,ä_²7ó‘Ô‡ˆ[5¯þox¬¦»U¼Á¡a)ÇV¿ ¶677cäççONNŠÑbx°½ânÐY/O/ïÀ ñCà ߈»‡Gˆ¬#B€DX]] ˜°ÊððPé`s¤þ#\¹p˜éí/Ķ3ÄL®…T¨P½/hÙX_£Ñhà^ÀÉ´¥„†§µ¾ì^ ÷Æy{÷ òÏ»'—õ±[óNßlîcÖúÙ››Y»å6²ù]¡î¶FFfqå=1vFyðWà‹ŠŠÖV–PhAÃ_<´6Õ?Éî“Çâðäñ€úææƦäï¦AØ}ü¼bx4Üâ6w„{Ñ;„/ù N(-J Œ«ã ú[cùc£±Þ¦&Ff6®÷j{x|>-?ÉÆÂÔÌÚ½³—ßR˜bgndåAïáuÕå8Y™©cº›Š\­ ®Ø•ÑùŒŠ»¶×˜`H/»ã`ahîPÇ€ÚÖ—{ÑÝØÈÈÄÚ5·‰ÃãÁ~q¢@–b€€ô466®­®äååCRyíåºúÎì‘i¡P(‰„Ãg#îp‚~V½¿£…©µkN#‡Ïç^ð²622O­äñô‚[ 3+Wf¿8B8DXUU˜Š©ƒ×t>+к²³ÎÎi+u°2524>ŸÝË vExØ9ø_îdó†º.yû r\œ"¡oÃgÖZFB<ÀTà PhA… Õû‚è^µµµ{Øšjjåà ál"g€}ÙË›ÍãæE¸'•pº›sì“Z¹<þ¿ë’ƒu#‹Ëï*w÷Œäµ9‡döòÀ‹ðºY}ü!p­à9 WQhAÃwZžŠ‡X?~´-þªws#+++ùeHÚû£±€,/¡…Fƒ†[‚}Θº¸¹A…È(oêmõ³± uµÏiîãqÙ7õK[Ù._›p­ŽëP:ÊîØ^ëä÷ÕŸõ½Ô xÁ®u=—ÖËëIt±naõqi÷Ýýcúúúú%û* è} €–Õ•e€¨kTZñ5‡;.‡<, û„ßáö3.9œ®grPUÝCaŸÏô3¢\é=}åW/eu  Aõ+ˆ 0c@šo†Çdwž‰uŽÎÊLËè¦þþÞ¢ý’[†ížAiœþ~VCΙðB.Ÿ ÐÒËë‹öp¸ßÊgÔf:ÞbB$(´ B…ê=BËÚêjKK t¬À6'‡œ»VÆf³9Еâw´t÷÷冻%÷°ï;¤t°{{y¬êÓ†&1q× $ßÍýÿÙ;°(²tïßûíÞÙÝæ 0`B ’‘œ“ ‘ 9IÉ  ¢’slr7tnrÎ9C'R“$ÏwºÐquÖÙªçÿðœ.N¨:á=¿ªªºyÛ.ºز²2`c™vÕ˜˜˜~ -ÐñåL.‚,c££4ó“ô½=ÝvvvMK¯A¡ÿÑ¡0<è¸éÓ5¥öz&ø²òÒRÀ 5åå¥?m9kLiUEyQ –8€p2ÎA+µ¤:á¡‘sD!h¸ÕÛFžŒ#(½¨“êöÀÚÌÎ/.Ãgz8Ú˜Ù¹d`Š°‰ÏTÝ uøç÷\‚m§ÄHÇ WUê}[5'¿¬®qï®uiÙÒZó/<ªAkÍÊÊ¢R( ­3Ø_eßüÒeoõÕC› Š¢L% )7zS}Q‘ŸdfnõÈý‘®²:¶¸"Ùí¾cD!ˆ°ªªª®®Â`°ÖÖVpïìõÔ­Ü|=ÝÊÈÜÊ(¨À¥¼Pr#€K*Nö×4~RS…5°~Q RÌG*«ÙW9—T”FÚÚù'e>3/mñ´´´ÄÆÆBÐ ¤Ï-Ôœœ0&¼‘ãgaéÐR\\\^†h`PPVe{Ç5S˜­h‡Áኊ°¶j Q˜üü¼¼üâÊÒœÛvQEÀ¬—!R“ñ¥ `T£££©´@ÇWp`‘9ãã€Lè«BCƒCƒ@m­­ÅE…t7ã$Ð6>:J‡ tÜŒ¥™b;½ûè¢"ýÈÏËŽÔÔuLô6yð$¹´´ PS,†Á£3ìt´0% .Z @Û©/ϼcäŒÀåäŠJÊò ø²²ÒluŸxA4”œÇº®/`˜„§ªîøÚJ„¡‘}6GDß1 (®,ЂÈ+©.‡h)*À¤d¢‹‹ó³RÓŠJJÐÙiH|1À À™™™ 9<<´5ú !CN\=.…ÃáÐHdUÚÀ̧¨g§&™Noª„üâ†,KÇ´âb‚¯ž:ª 4é‘©cx`!hþàÂ@„°””ææf:ÆF»<Ë/((ÈÏ‹qÐt …c“ŸËÙÁ°x\Œ—µ‘/¼º¥gâƒÄás“Ÿ«[G–Uæ9è` J꫱–fŽwïÎñ455ñ - AúŒÐ‚@ À˜Ø.„¯¹…oV1ã(+Źèä—”T#ƒµîº”–<4P—{œ\ÜX…3R——vx’QQ‚¸mYXRRZŒwP“ Ë,dÕ¨¨(*…A t|yhAå0^õ:84Ð?4@ì§0DXvÐ_Ï2ØOD!‘ ã PUYh§""Æ<äï»ZfV·TU–Úݽ Ë/ PUW–“RH.,**Šw6rË+b¸äçªÒbâ7•PEQÞ& ´¬–EnaeòKº[Ã4+¿ ÿTÕ Bæg„©ÉˆÉhçV—–¼tTàø¢ª²¬{Ö•„HU³àò2¤±†6®¬<ÐRçQ¶¼¼´ÖŒŒ ™Úhqååeí5H-11quCûü² _+§°¼Æj‚±½©ÚfÔÕ”:¨€ Ó¼‡+,Mt5}–Xp ˆ4yaJrrcc#¸÷t… d,Ó4•DÞ²ôG%=QÖ“–ÓµRV]SUŽº¥¢®"+.«eŽ/Á‹ÒŸY©»c‹KJb¼­´m¢KJéã—††0~ $HŸZ²³³«««1¬b¬‰«[XH·ÃÀæ°Zà$p0g§ÁX¸™KçÀâÿ3p0g§ ŒŒŒ„ :¾†‡Î& –*¥ŸBdÃAf8H2hÀÃè( @ ™ ºZæŠ c¡déX©çô]&åEšâ)èÒ•Áô_È8Àæ^:ü—•€à¿àüjw)£O_i_Ì&ÆlD ••fÅôÌôÉ€úZkZZ`ŒÐÐÐÚÚZp†>ÓÉHtuZÌëYiª+Àlą̃@(pÜ]AAˆ099©¾¾žÙ„Áyæý? &)H鶜ÑÆé—T†4° *[N§ßQE9*7ËÍÚ2¾ „ÿbŽ_ h Òç‚–~*%33X-¦ÖrZ ?âXñÌ<˜7`T#""@A t|ñAÒçY¨ h¡ •Ldü%®fˆ þ ep€>ß‚ÌÍevÜLxo‹(.ÊÏ òFà‹ ÿÃÇ{Ûh­0ŒL"†„„º`¶Ü•KeˆpuœÌ“äç烓“’f¼÷Þ‹Pé)ËñT–ç…Æ V%D¡Ì_¯èLú*8˜ðA $H>'´ôS³²²˜s,LS³bÁQòÁã]? 8sج•J.Ê'ÌÍÍ-..B]'t|©3cuh€‰% Qߺ—4ÐO­(-%ðÌY‹ÕÍá#[Äç=~©}ÆÈÈÈ “I ññÌ™“w[î{/õ½2÷Ï£Q(!<;›™Ä§Þû/]*ø›ž–A $H>´{KÌÉ–šwŽÚ5ï;€¥ÃÀ¦ÆF5ÌâÐ9ðŒTx&$H_FHDV󯄮*/¥¿mžD$&''Þ–ù|ñ'µˆÏ{¼·}Ñ7œ¤§——•–ÛÒÜ ƒ¥€÷^Ÿ!ý±AÆ"ìééNIIfN–~Ò½¿7fOJJJOw7- Aú\Ð2ÁøfbSScýIü_ÚÚZ\yýÅ«W }1}d d¼§ô°d±´¤ä³4‡Ï®Â‚ææ&Úð0sÄÑÑÑ^TTôoÆYW[3<4ȼ÷¾Þž’ââÏr©%ÅE=Ý]±@‚éóB $H A‚ Ò×-K/ׂ $H AúBZá“ñ±ÑÑÚèÈ0ø»òøh!“ú&&ÆÕT–ÑSÿ­’ƒÔO¥Ð ÊŠV_O7” ¯úšÊ/Õ¨«+J { ÒCEùx&œŒÒ†«*Jz»»†ˆ½=í-MÌ%æU3-Cóós¿j«~³´ 1Š{aaʇ×àÊ„WscÝ—Jº®ºÊHþ*. 0öé —æÓ†‡ÞLM1Eîêh[ -´¡ÁÙ™™ßFZ~³´ 1¨u~nʇ×`?Ê„WsCÝ—J@ ”ÿ ý1Ä„–~JOg'W¦&'™ ‰¸Z†‡§«£¾¶jfff:~Ã`êÜÜ” ôS¡Løø@Ë—J@ dO :þZú)äQ €ÊØèhvvö«‰ úd ãÙÆUÐ2€æ·Q}MÕ?­×«¾°¤ÑÉÉßìJþ{ÊwvvʇוükNŽwutN2Ü59± „î{îéhgznÄ¥D¢;&·•¿¹¡öSƒÐú{ÚÉc“Ÿª(Òó9ªwõ-ï·'Ëz=ÚùÌÝÙÉ'’ÙH¾n­@Ë8}. ‡Ã`0$Iß“;<´Z†ú_¿zÅÕTS'£¼¸'GjÌœCÆ—Î6Õ×TN¾~ #T¢×C'›{Z ªzNNιµMXtáØçNÐà@?‹.¹»Ê-ïÛÚÙ;¸Q' Ìy¿@«Yv¸éªÙ;9=ppxäÒH¤} ÔäX›ùÃQ†»«’_Oý çGck¦çÞº"l å÷›]Z˜R%BTÞÐÙÅÉÖÆ.<«|â—ƒ"=]²z^}bB¸g|á]«ÏhaړׯÆðöŠ)ùkƒŒæ;ËEç”wõ^A¤¯[«¡ŒE¦ß¼a ¸×AËàuù9#’©Ž¡©‰uKÿÈëáªûNÁ£ãcÃ=eF:Úz!9µcÿösÖZ^¿š`º£ùÔÌ=8^uÙ[ûÐƆ1>&jjêê· ž>qÓÖT׳{Ò=461:ŒŽôº£©fdçG¡B«’¨PîLwCÎCÛì–W¯&&A¦k½¬ôÕµ´}’ˆÇÆ ãýìÒºÆÇÇž;§4÷#¼éeaê—<2LδÑÒP³ J£Q³ž=ÐÑT³p ýcæ•BZvSÛ÷ƒúùj¢!Íçžc=Óz«=,õ5µnå4ŽÒz^8khÞz˜Öòj¤å¾¼”¦¦¦}VSaèÃG)mcCmæ·5ÔÔTõ,½H´QJY¼Þ-P·ïâ›É¯FÚ­äo϶)åñ~¶1Íãã£ù‰w4UuÍ6’'Æ(!ÖwTÕÔÔ´qõį9»´LŒÓßË×[šyÓ 1öjâ¥X[Ëp˜Öçl¤£¦®å%ш5næºZ·ýaå´±1|„‡”‚¸ýj"­— ¯¥ª©k†­ë¡W×ö"[Ã[jZéÍ4Zo…£ñm mÝðj`|°Ï|³;W'  ˜†›†³SLÎkï.ÏÖPÙ¦ló8aht0Z[DYMCÏùm¤þÜñ–†ª©óÓžaȆ@‚ôÕi´¬Ö:hÚØèCDSÓ€öªle]w*µâ¾Óˑជ â¸âð@§®f3ypÙç¯óéÈ•ŸÝZÜ`À1Në°·òˆÕ“Ì­ê%V¤)k=" Á|¬çv v Œƒr‡‡Ê³üpäóþÛºà©ÉI¦{ˆXo¨¢dáú¢¾g`ld ÈX3.¿ƒ6ج-Ž®é-ˆó³KíynoœÜDzyG¡ªB£ÑjÑaš%ƒCC##´¶â8ÃèÊ¡á¡œpWïâþ?dŽQHÄe7@ it”þÀÝP½ÉÛ5à®z&èk)MzâòõåÑ&®¡4Ú0 ðÛp³­™Óà x/yèšÜ:B©ÑuLõ¶$ÕÕ­2>:L&6b4Ý1#´V‡{V Ï£¥q¾61Mc‚¾c$eh¨§6WÅ6Dëq76§Ð†ûëcÌ}c¾æìjj¨cdQwqÆMÓLj?‘ï­®ÿ6ÜrÏ>¢T›@•”âNÚ`ïsm©üF".ÂÃ)½T§±þ*3c'âÐ0RkdêGìvQ‘-n%ц@ÞÜ”$е}Àø<ÖU«ëëǯ>?Ö×&±mxh0ÈÞ(©¾÷¥®bu½Äóœ½J—‚Wg?¼ãÄ,‹Ü†?jŽ-·ˆ^#»¾!zéË××Ðßßcª®èù<œžÑÑÝd.%ìEPvm ÞÖÌe€0ï¥ËäæaR¥®sÚàÐ`c^„iv7쉓ƒÇ“—O<ämáÃMFVLÏ%1>6QõÏ좰àç@W­’šKÏ@—»‰%uhpŒZxÿaðל]MõµÀªGgaš¸Ší‹°¤ôÜÆžþÑÁF£1ô{¤v«¨vÒkZ…¿zJI 6ÌÍ9½Ô4Z ÌØñ)=žaÊ#ËÆžj i#fRƒ†˜BM/Ýø`<µQ-DT ½OFÛꤴŒ,Ù“~Œ­B¶¹!7RçIÍÐÐ`Êcû'Ž‘ZêˆÀC-ÂÝÛ Äò Ê d Aúº´-õÕUõµ`PóúÕtW–—47Ö¯y¹±o°Ÿ 4Ôßabò˜Øß?Hév3TR´{ÑOí|ª+‡,o®És¸}§¹R_„-­ïbúâ:^ZJjåç¿€–áÁÁ•ŸíÙ÷]c¸¿ÑÎÒ‹Òß­+™SÞ=ЂTÕ°ë£P /Æ×÷w`oY<©jliki¦€Ëûèä {»Áh”é&µWÕ64µ5×Gzšxãî$åµ6”¹ªÝÄ×v×e¿Ð²‹mimõ±ÐO¨í~¡«PÙJ¤—.JÉ!¡¾¹µ­½£­4EÙ&²¶¹µµ¹…úÍ1RoÏr‹èr¾kQ×ÞÞ\Wéjìò>H%†[Þ L"´··66tÚ[ZÚ:ªÐ’rŽ=”Vç{fÕÍ­Íí}øN. }åºÎ0Ku„“¬N'cýŒÊ¶ÖJ”Š}v››¡aÝsoa´—ud\b`é[ÙÐT ¹ãŽÜM,HýT)ßôá˯9»šêkèŸÏåÁnÞÏêXj¡Ãýµ÷¢(ÀMí‹²Ò J-h­/vQ—+lì-Šõ6ñGµ7×SújìL,‹j›KÒŒmŸ‘)>·å“1åm-M]=]Ïõe£sJ[jóunÕw“±Oí¢JW'  exp€á&£lâѵ9áÚUýýÔd?û€¢®ml5½4;+ÓÕì"뛚aîFAÅýe€é+Z¥pÓo¦&_¿žã¸~j!»Zˆ½=ˆJnµ¶ê%‘€{¸ eþ(ŒL"Ž v¸šj)kê'—t‚óÉ>Ö)ÕLÿ¿Bu5•ýTÊÊ϶œ [op ]ˆäžxåÜŠjJWÏ¥›HÌuóJ®§úÊÓ‚n©È«ê˜7É¿:õÿNõtuŒÐhK^§§®(/¯dzÚ@÷SEU­0|;…L¤tƹ+ÈËkêYÚ»ÃLnU´ÐëF?¹(oèN!÷Æzª+ËkÜuj%Sþ9Ö×ÓµÔ"H>Æ*òòòÊÚ÷â1ՠ퀓´®;}‡¦>pR}ºžº’¢ŠVdA'ÈÀâôyyE«"|˜‡WJµ§ÂÔ#“D"ÖçÅØ :ÛòôÔå-_ä“ɤªœ f³gØÂøÇØzÐÖja:ªòºÖ~]$j?¹ÙÏúA/‰8ØW`ëñ5gWc] •L7­iªvpÒòùr­å£x"ÃMìò·ÕSTՉ̣״î 绪ò :õ=í9êòªúvå­tŸC¤&Ç{êòJ¡¸Î‘Á.÷ûÚJzIEtãC®ƒ›ÞwZcOª+ú)ÌJ؇u¾•„­¯Ë¹÷¢dfÚӇϋ»b åqÕ] ãÖW葉$oáEè‡Ì$H_›V …FfBËøØ(``^Úš›VCK_O7Z2.¹ûz)Ä%7…ØÎ7™ØGf8~êª+©+I€Øú1¯Jšž(ˆ9uzr dú™·ž!}¼º;ÚhCC«Š•ž+…H^U¸Ë?‰L”5%õ6ÿÿðeÑÛÝõ¶E€;%WgÑJ¦1ÛšÖÁøI^i9™çW2u62}¾7c—òŸö+Î.-ä··O\ý¯5UhmM[s§k«Óê*Jy'ÔZ{R±’3y9»–2–D|[·—3² }…Z€+Z¦˜ÐÆŠdbgGëjhééêìéìømŒ ±§ç7KPGkó`?”þCj¬«îý mÈ;ö¤*Hþz -““ÓoÞЗ‡ÐÆ]k¡¥«³­§»ó·ÝÈôõüfÉAêhk¨ åÃÇë·l5hùBIÓíIo7T ý´v¦åÍääkú{äè-½ë ‡B`‘pH A‚ ¤/¢<j ´0fZß-U•´úúŸ!A‚ $H¾ˆŠ «W e†-ããcËвæ+ÏyZ^ÞÏþ;´ˆÍ¬1»çãìUó•_çS·Hý»¡©XúO¢ÛÖÄ×ȉ!¬÷IÀNyÚ>Õ7ŒÍÄýÊ´™]¶Ï(„_ø/IypßWß(‰§_"±ðÞ]¿îÿÐã‘Žf¾ú÷ÒrÉ!SJŒ }¼Ÿ·zT n®(Æ5C¢çF¬\jnýyÂ\¨? >»ô?ñз ÿY“†EèëûxEQWÎäD£¼Ÿ“Þë‹ ݳ«Á>ùîRžD%fMA éw­|Bõº™–ñ±QÆ>ܾßZ,ïîÙðI‡Òwúš×¦’7vl=xC+ñ+±ôÀe×–ý¬ÜÖÉ9sxd¿Ö¥3Û·R±ÄòÑ0ìéƒì{Ù%žÂ¦ À2ëëíÜzàä 8z o—>wrûVVcï&à3åeìÁœÔ Ëœ…êò•ž}È»ËØ«‰žY{~1;<éô¡#»vŸ¸åÑŽ',»xìÚr€õ‚EbÎ܇"ÄöIpÛÊrSØ7 5íõ‚uϾ­ÛŽé»VãóÓÂ’ØvÚB-$cf]ÀÜÈijl¬?l„cAßácj´sû¡½G$Ÿ$L0ºSWì`Ù8†ççwÔø rr¦ÞE x\ÞNþtøë_Ý×dDÀj–üRð[ûª(xÎ$Ý~ÒäôN¿H 3‹G h_>»cë!E3 ÿÆQEa÷Ž½{I?I™"|ÆbYÚ²áÒ­¸÷zˆqvg—ÏÉ^JnÊ’s“[H 3‹Îî:udÑUÅ ,~ÖKSyÏŽ½{ØE¼^ÿBrs—/ÞIÃ-fF¥Ù}h‡ÒËôaÞ^UqçÖƒe‚Ѹŗ6Žvï߶ë¬ÕÓ^Âç¨]©A°m,»ÿü͆mGu³ ?ãQdùk—·±°òHÇš ü“ÓE˜õ–صU2ñ…©Ñ_þ±sû¶]<òÁÜâË€Ÿó36Ú·s/ëE} ~ñ#“Žò0ÿÓVƒ Ì¢£Ž²aìÌ»†(Âã9 ùŽ L™²ýíIÂ륟¸¾ ’qŸ»ÑåćHÙ¿5€ð°Tgÿž÷úÄdwk—0É¢ø‰/ óþ8ïÉÊûå¼½»ŒIȾAúã@ËÔÒ#Ïô'žßÙˆûŸ„–E j"ÙG[úhÉŒÍÚ-›‹ž¸#ÀŠZ Óu™S* =ýR確MI¸«×n…|zL˜K,õJ}ï·.Á)þO¶Ÿö NòZÂÑ“^²ìö/‰^w´x «1hÚ±£jɨÉC¢Ò_ÇØ^ŽƒêÃD¿ºs|ëwþÿøaë5™ð<Â| É½›·_Q ТÏÃyÇ‚„Uÿs“J:ªûêIaP¡z|Šfùô®„0›–>²bÏQˆá¬ÆÈŽ0GL ÑN—6Úõá0oèi4jàø‰;˜!é;BRÆãœÌO‹E0{ÒÌôa,sJ;™—³‹ -˜vÞcHìl’ƒ¢¨NzZHææ›þï¯ßoÜÌŒœuæ?ñoÿú×nÙÁv?‡>u0OïÇèÝY”“Ç?løóß~Ú¸U8ý3:»ù"ÛÁlOÓ@·5£|ç§{øÕ°øÅŒ ˜ãû÷mf9ý(riçsÒɹ˜9´dï¶fÛµë†Nò:ó–ùþ»ï¾ùÇ–;´304)Ö-ßþùO?lتj‹ò|¼]6TK1náhô"kÜx¬›Ï–sÏÎ|vúv9*f25}œÁE‹8ôDf•À[hy›'Õd¿ÿûß¿ùûæÛÕS1#òì[ÿö§ÿ÷ý[åî!¢|öÞ®Å`§Tùø_¢ѹ¯ÐèédÿÐïO>GÖä Ù+wþËQµC§´Ó04¹}›ž%ŒÆ»Ú»L@V±óùä _[‹òƒ½Â¢§PèiDjËÛìÏ1'C , =»8œs°sŒ󖻮uÌt.b"ÑLàð.~—è†#{¤ÉÒ¡…S­ƒysóÄqoôéã·sq‹Dùu>TfÅ1‰`8ê ý†@øxh±b?°ùAÐÀ´`¨2ÎlÙuþQÒ4ø¯¾ôù,œŒ¹ŠªzáøVv¥ × S±S¦¬ßJð mÞ}Å7u@Ë¹Ë çíå¸î™ƒ]$ ‰ÊèK7ãܸ¹ø•Í÷iضétå8ÿ5‰­;Ï{À $Z>VYº2ï@K‚ŸŸ}¾^ˆµŽÜݸ5 —š~ŠG×CÏ<ÜÏØv{Úb~­ªº0eA!»ØîCÿ·ÙÞÜÛÂ6xÏ6ᬸÜŠþ¶zÂ=oË=¬ÑUqË“ÐÅóáñ‰-cc9ëehæþÐó$÷}¨>,wÄÓF,n1ô¡%åÓœ2ãF>Û¹ÃWf?>©ërþLJ¹§©{á¼°ù³Aºgõú¶=¡hzéa õ~ifaß^XvãÁr5¶wrô?Ìq ë}I?ñ¾ž¿•šæóPX÷¯p_Õr®û\k"8y÷ W4½88¿ý[@Ê4sð’d. ¢jzþÜmG ‡|€–Ó•xÌàŇm¢† y8¢2§bl®jᲂíaåWRµä>+•ŠYøXhñ´¹ù Zòvì-1¯ôx¸Œ}[3Kvÿ(CHæ]ä¸Ã2éÐheÍeX˜™\rd¿8 ;erèï>ªwqdLÂaûØÜ MpÓâ7 ê{¤©"`R˜ÚÀzT3ósv4ö/›e"Ó_Á³GÖf×bä]Q1]tNö@Lॎ«g%â2†}o]Qµ)zw¦%ÙAGävÃ=#t^ìQ8žÞ›† _21ÿ¯lOQïÌ´àqo¢âzáÙw%®EÓogÝLË| Ê ŸèaúLïÓ]²™Ý¢<"Èκ®iÏ#·r…c„AË¿ -Åæ÷luä b×AKÚ)ýÇ÷]£ý-˜Ð"þ¸S÷~®Ê :´ü¿ÍNvÏœ#ölÊŠÐàrÿi¤ZDÔ'¹M¡úð.´${ë<%ÂϯÈϯj=e#) k† ˆÝrø~ZrÖÉsš÷ÂÛ0¡åCãkÜ„ý-]9Ç6<Ã*"³É 'xÌ3²j´øXºy¹pœÑO· -tèÙkO£»œU…¤1ÿZÖ-î,C .«Šåÿ6_ºnGñ¦ª7C½*~éŠÂöƒnIãa.ÞçÎKð]“þû&YvÝòPö^å|Ö£»zJÁS -wD÷èßGh.CK|@Ÿˆ#ê#º†5вV¿- !{„ƒ££+np‹†æл­ÌÔwc³ƒ" ë:#cY)»p=³¼\: haõ´òrôô0‡&@K²Ýý0?k5Í -?#2‰/܃\öDàÿãТc‡×àSˆË¨=΀–îàæº ®lJߧãe­æ×­y]Ú)q&ë¥ó!¥LP>†²1S-Ò¾½²7ôU•ïF ŸÙ±ïÜEFݾ“’»Zì5,’éù#|Y @‹)Û· ¯‘‘ûÏûh9/âËû9õ…·àƒ:bq3üì%VÞ'YóÙѸײ޷x´ˆNÊà•¼!ªÿ0|›žÅuÅœGGºÝÐŽû´ÏóX¢Wo¯úhÁÀÛxÅ._U8Áz$0÷CÐhc,ü8Œd¥m’§l8·º„¡ã³buBAœ AÐò1 ñsé~·¥l qø…µËC™{D˜Wº×y‚ËCˆ´žÈøAzLJé¼Ä)ÇÌ„Þ¹¨j]îê¹G©¾ ƒšPÛóW×ÁÔ€gÛ9=1¨†S—¬r0S¾òì¶/ú¼nk^6ªÅbF9Ž©&£$íɘŒ{pK*ªïBKfdøYm8;‡AMbð ¢GOÙDŽ£³Zw|Ç‘Ùyõ¤(‚0>y³ay(£ùÚñ»v‚‹ôEb&tníÞy`÷A¾a4:#­ZBÁ*øOž=~Zr;›}#nxÊ‘=ìŽ+¾H›&æm•@±òH?GãíuîìÛy`ûΓw=›ñŸcí íyêŽûþüÍÆÇ à„E<²Wæò¥í;_’ ‰ý ´°ãB;·Šf3–B¦M¤$vo?xZð¿ðIÐB@w]ÜøOÃØidr?çé]{Žq‹¿D¢{…8Žoýá»{9”l±èŒF£ì{I:¡ü.´pž¾~öðaöówÓrçP©åü'NìÚÁ~ûa ÈŸ@K‚³ûÁ£ûðÚ„‚â˜÷17ßµƒíÀ)èL:táÑ4þ“ÇwŸ0ÈÂMrŸÞ³eã?78y^?»ïr’õèž}ýb‡Íöí>ð¿Ù±ÿ€àóìy~ÆUáÆîÝGeŒÊ°ˆîË'Ïqœ¾Éwå"Z"=üwngß% !K?¾ýÇo·í:*eÃædÏsîÚÁ*ª“€ÃCÐ ‚H Aú —;CÍI«¼tÝ mó€ ‚H AúZ…Íl¹$xúœœWÊ H~ÐB£Ñ† $H Aú"ª¯…fZ A‚ $HÐòÐGnû|óÂ#VOÏËÆ­lý60Â|\ Ì@ÏÏ'¸ïPSþÎ!zzÞ¶(üba&Ü3R_Ïÿyì ;a£ï¥§ç dj™ƒ%ü ÇßÓóyà×B4ƒ0þåô´ciŽfc”€\€êÃJ¶G›©_¼ªnd—·þ9/$ñy€¾aPxý! xr‘ž—Õ£2ô‡÷ïá_û8†èéû9û·‚âÈJ¨¾ÏKÏ (6Fßu™C¶¼çsß™óÎ;ö±Y­OÌ’ÑŒg^Òb ïêyšØde¢…E˜æ•rd>Õóy|ò¬œœZ컃Êhå-©¡X¦O· Îõ9OXÌŠ)45ô2±ÏÆ}ôËå² õéúyóPsàîRâ[“b£ºÿçfõÙÊIƆFvâ mÆ hù•Z|¦rUö~Åê“ÉA>çÍ«%qPµM}ÏL3®ÁÁbîOò57ºê5 |ªð]÷È`ú\З”ðÊœ'd¤œ‘~ þ•è,­éÕd&§z]éÎæ-¬¦þmô÷Dç^5)=w‚–å^x!'£W›}³Í“ÎlÄ$ÑÅvTÎÕy“÷j4fÑ_Cø¦iqfDú&î—ÈìüSgÔAÆæ<1ÔŠc†¥ n •=h'-.éؘž1Æx¼w@’õdã‘g,êUD` «zNjÚ0?ë)sZÙ4ÍQWç¼t"0eb¿Áq*>äeâ˜óØùñëô·Íà_Ýfý äó‘ç¿}{ØÎ-åâñë0ÜhA#†ÝoëñZÔ¦¦â ð´6¹ƒ;ƒ¢‰ät Í}^Eš7Ý–ªåÏIÞ[y°ŒgEXÏE.?òœü"qã!‡÷¿÷ölÎòËåÀЃÿÇ¿xÅL0«D’¹€ø5IñÛa¬²ÇäÞ>ò¬|öÔÿFáýÇSsç/}Ï "bïÉÙsH@=ÿ ÐâtÍ¥ o¹zäB"vá…ÎK²þzÛÄ1Xü ÈUlÞb–‹ÐmÇJtîès[•Ûž¥i LgNÉ$ºqE^>DGvÓaùçÑíw¬š}läèý´T÷ÆeyÛ–œÔŠí‡T]ølýþh,zN—ë¬uø+lfÆM*i˜Iµk|÷Ý&âçï8×€€NgþzXØ+,¬Ôç%5#­ÿÒ1~¿jü ¨ÌðlŠ–à £bdà4 ~™oИG˜~ É¥e›k§¥È§ž•ø@HÆ$øÄÞ‹÷îY‰NDYè\÷züè9Ëq'8–&´k»éÓ“«'îyõbc *Ö9ié#xZ AÐò«„É(=wÉ4±æ»{ñÞæBŽxþ«&–w”u¢Ö¿GÞ¨¥nyôà%ÿø ·»Ò~Õ'¯z* ‰X%ЇÉøìÞKúXÐgÅùó*ûª\½ìc$åT¥+Ê{^#33½ó8»xxz»l*rVâ<-ïO ,Ðfç1!å³'¥žOF»8r_ÑV’R½¬D¦¤žäÒ4»ÆéçiwE)˜1¸ä¯¬ñ%¡ý_ö®D›ð$‚õ’{6}eg1Ú÷™’˜¿F":»òÀO§¬Äxïšy?}‡ùâ/—œü»Ð2e&'-¡êtåÔ%Û§Œå¼§?õÄ%% ·þår8xÃÞo¾ç½¦$pUhßaiaÞÅäÁuå3ì=’ÆÑ©Õš2:ü×dþ±E‰¾D˜ u‰ŒMgBË61 §ÛÚ‘ëßföKïiñ6¹%åßÀyÕM]\Ì<žQ-‘ÝÒ|rOÒfèžñ“.i+ôÉÍè´u©Xy Ì´ÐÔ£ùûÓ´Ùh¹eõã´[\ó=-ö ñ_“`;gŸ;÷䮸Sô°½œœ–ßPfí–óñ0Ò=‰Ë®iû†¥hŸûùLeøx¸dB ¸I}Ç<“¦±Yõ?þ™+9°ZèÕÕý¶Éó.z‘åvìýÓ·ÜW•®‰ìÜ#‹]Ð"¨WòÞ‘WÂÓáë*WÏ㑉æKÆ­%0£Ç)»˜áe*q;3>0øìýfLJÊî-ì Y \¹tŽÞvfÎ}ïñö}ΧDÃÞ~mmZ²_FìÙ'rÏ2 †xƒË*Ûûݦ+| 2_g=«“è$îÚ%!l”|ØŠ,züÈqE~ÙMÝ”>pó¼:o1ó‘’‚ }ͤûQ9dë AÐòëO.¿rB 8ebÝyXpÐIýb|Þ‚µ¢àCÆ@‡™F¢gWMÉ.¦;Ý”1Î °6çz@!ä-(\|œM÷ùôŽ´˜!ý•’„lÄi1_I´¥ ®_«…ìMi0øý™ïg(ž›[hËÏH="@Uâ=ÐbÓ±š°¼~!zô´cü >·gÇwÇ#a¥g9•ðÀzj‹Ü†1<Ì#‘oV(‡žBaæ–‹ÆwÍ`í÷.ŒÈî:¿ebñò1#ó< 9õ6’ehÁebOžPaôæ.<2ÿê¸y häë•1øjhaý3eù¥sø´x.éÀlô¬Ï­KnIãwoy´b‘{÷)3^㿈A¾b¾†t5´Üþhh r°9cG¯–ªü‚¾Ù ,M톬ùÛ¯÷‚‹œ\¹~<~69½R ÿ;fZ&d·û0lxZtjÂ+‘Ë/—;&“• Ä2v4eÆÀk".k'b~FĆŸÐÎyõØTE;âõ'Í´äa$/$"'¯¿…–óÉÈ!‘+·0y 0ë«:ËÐb´-û¿9—óvP¢#/iÕönü„܆s{ÎÇfNeúZ\”ŽŒ÷±Pôj@b(t•¾§Ó) hä "”5MI¹pÕj•Á™uæúéIüÄ*h E¾ZèÖ2¥ÁÎÐì€?*«ìÈ>øò§—$\ÃznŠ™'<‡±YEOðº'/ãž&sQ Y¶§ª¼1ž-:®´@‚ åW Kb;`ìšëå•?¸fúÞµgóGĘ_ßXy#..£@UÍûÑø Û·{wæDçü¸‰ÿ¡ƒ'9†±ÆÁsôr@&ÓÎL œ¼hhwjó®ÐÔ)˜Ïžc·½C÷¼Ÿµl ™–_‚ ¢sÿ®Ë¶ž8ÇϋVÂWxdŸº[;ÿ°Ï8 7«w[Óquß^ÛÃyx#.¦ƒc—¥½ˆ“³'=í›Ø¦Øß3ÞqÒŸ÷Uå–4LVà½(ïÂœ?yûF\|N¯·ƒç¦O9{ä {ù³òÊ¿u™CÆû/ å߈;ã!uBX'ê±Gô-íP|6ü‚Ü‹¤h܉ ›´‹Kh¸5…¹9ýí©w߈û·oØ»§ðœ¸{gí/AKNöŸ?^qvðâà6Âà'ÎoÑx2áñó6Ü߈› «v7Q¿%ÈXÒgAb 3JWEücÛåØ~Ôf@KúËÇÜêqqɃxÂl€<Çuõ—þ^ñj*O±„_†TûvÞ˜dŠÏ)néÈÜÔÊ]£Ã³m8ʬÏ:¢—vBÓ·ÐL*sŸÓ²Gz;>¶ö,}Z”/^Ñu¯IΘ$f3Óˆš|!0*=›ú4ã®}Îsï £7À•LÛ‹žºi˜ì÷(\×0a´Dšks\¶z˜+'l›ŽY-¸äÐ ²Ïb“û¡å!H´|²ðSÑaµa %§­ßå˜ÚVŸ’ùjy “8L o›JŒiAbûé1Â|Vr[XX}ãC¨y„¹Ø8ÒÊ3d%<¬.6 Z(0—šÐV—Žx³’PJBgvª+ÛZ2ãKOèÐ7âF„ÕFÆt.™ˆ‹j oÌDÒ÷Êbriô"\þbÎTTTïÊ<¥+‘ùün"r¹ˆ3s§s³(áÀÝÜÌÍ„ÑuQqÄ¥€„鸨ÌÒ§U×6£p‹ÈlPŽàJzPXæµM'¤ÒV:5DjojÎòò"a69ª …_\žóöi{ðT\T=¸XÆ+a1%®9"ª ë@`æqHZtD}tlOT4ã.è{’k³ bˆN&GEÔ%®ÛˆË¬`™”$øò ÛŒÁ-2s’Y-ÓáS NƇ×13!2–Šg|{()ªåí·‡#aQf'‚ÊîfúŒ‰'ýÑ6âæŽ0o-,ª‡QmÓ’@æ9‚Éê¤gýóšSq©£ÈLr|ÚaUµ„E7ÂPAÁ!ÒzûÇ ½§ÓŸŸf\-"vŸŠ_Ùˆ 3“jEjjÛò5LÇFÖ‡Eõ.mÄÕ¾!9}TzoJÖ{?xKOxDCrJg"l„±·-"²5>a©>ÃÓú¢ã©†´(Ð "šŒ¾73¿ í( eE%Žðob—Ú >…CŽÐ÷Š‡5d-·XúÖñÆÔ¬×x75“’BÁ Çb³fô¸tC—<Œ'ÌÁ»éÛŒsúR3™8G¿£È.h#.$Z A‚ $H¾ ´TUÒêê~† $H Aú"*.üXhél§Q)?C‚ $H }U–CÐ $Hk„Š âápLë^>³XçêÒüéQÍZßÜJ„²¤?´GÝR‘¸©x‘ûfBÞØêuÖÕñ_“•VTD\jØACIBR²Wà ¹ïµàQ¾ÛATòt„±¦„¤ßeQçd*±‘ &£*#­|aÇ?ü}qA<—¥$%u½ðä¾!KI …‹<’!˜¨>ÐÕ7òDTBûâÍPÌ(¹gìŽðu)A¹Dò"ÂÏúêuyiQ)ó¨.òÚ€­Å…\œ×å•„ä´“æb®o<MVFZ# pz]ÙÁ7„¤Eø¯i8ç’úhÖŒ"àá‘x¢uWf+IƒÂR:±s¬q]À…dS¾3{o½¬?›‹ò¸¸Dä¤ää ž’¾dŽ-¶¡Â%ø.îb“é!.R‰#ÖÊ’’rZ×.ËÃ+'K²“oܼ.cº¾S<Íns:àT< ~öÖשßà•TÔõÂ’É3±–JÂ’š"W"Ú֥؆M¾qé†ä a“ЖuEÐPwS\NLXTB' ôÆ[[UXLöÚe¡Éý”¯¦‚=3P•º)ýŸNÜ”V5õ©L‘Ùâ“Ô³b å¥Å%UoJ©å×L®Ëçü0kanV1Ë„'õ¾’ß±FUÏþKŸõ˜gÚ¡ +©w–# †ÿe(r{÷¾ï¯V÷®œ™ÏJ¯è%}ÂRºˆÇ¾ù›€¨üua娂Wï\²»zpÃd© AÐòegZ(ä…Ìûü:n¥«O–Äš©„¶óî¥u-«}ñ=¡H³ÉÚ6/©äùüÐû~ÞwD´,Û™’H¯¢±D2ý'©£ë*ËáÒÖ9[EÑGù 7œ¿xF®´{)Î<·[w2 ú°Z„Gš‚z™-%iÇuÒH”9_ ^Xë¼4繈ŠÙÞú† ;4ëûÖ”!Úݺ–H|s[LÛ  e³í¾ ‡™ÿïÓÄyNÚåAhÏ]^õ¦›ÔRÍJ¸›øž¯O¼s‡-™þz·ÒGA9šË ";¿l^«rŽ²Ó¡…X™Â#h ê^Í3ÉÛ®˜e¯å. Wô½'`˜­Zìõ%Ý QèºúÖ)jï€2ûÞÂÆéš8;^…—ë‚<”à6¥ö6¶±ìVªéyÏ“{iª|¢UËÉÕ¦G~úq7ù+ªZ¤.Ê!îG=Œ>¶ ZHu‰7tž’—/ÕISþiÙ4…²x늨uàL7ÒNÆê߀ò\ê-cE)¥‡ÕÀ(tøÌeÑ“§xݲÉ}ñÓ7x.¿ F¨³ZZµmÿQÃyÉ:%]à8ÆÆÁ—Y1VŸ{ñ$ÇÁ'íÂk‰M—ÙóÿþÎzø„¡W5¹kçì÷û•A%'/v” 9³²sùå RˆCŠ\§”x÷² æÖ¼Y-aA7ÍÕÀ‚¶sÚw“¦-®s©Ž¡}-.™“É‚Bœ×n•Ôöƺ+Û7û–Í~%ÐBé¨á=~½¦kÊåÆþÆ‘Ìÿö–&\½iû^x[g ¾}gÕ"ƒØ¸Œ›‰‹Õ¹1Û7ÿ´áªqf]îó¼.(slâ@6ϯ›½©ðáßðÃê.Ø•‰ b”†8ñèâ(¤añG]Œëÿ7¡…Ò=Ƚí¾%,lÆ€V«ö¾Æº-ß]«í$ Ÿ¿ÙL\hM3¾ãzw¦¥ü±Ò­%h™ºÂ¥TÔ6Cìî#.z§»{f‰Ýç¸õjûÞi™‘Öe@ËüýK'ܲ‡:«Ê¿ß$S×=$Ç-ÜÜ7_î+dñ¤ò½ÐÒWÙ»ãRsÏBO×bß,îo‚¸v¦e±¯ëu_ß|#ÌQ@32Y hùÍ …BškiŒ·–ÐvÅ®3ö½…F»yD˜i‰Ö̯Eœin DñX>¯2¹z꺼øµãÛœóEO‹ÝÑJË v=&À˜›ó¸%QCoéÄVR˜ÿ 7ï$î£Wá­ Ò›0Y#/,‘ Õ‡•âxj$cìyR‹pöʇgV…Ú˸”Îõ6´yyû¼Üù=wIçhA…ºò:6Ôõi‹‹&7.V+:~›q×;Óã y9çùMJš¦ÉÍDš+¸å.Áœ„xrÃüû'í—¡…Ü3ææ­#-R7ÿ•@ èGJsPn.á~:ŠŒîµ¯¥^HXYùþð ´<º%¬KõV–ëR\Y§ÔQDq?!Âñ’¬Ïº Z<ç\aõIUì?Æ­åFf¶ÔW4ªŠŠçu3Vâüíe Bû¾²ºýKИ&z]‚+÷¸uÁÖAn©:'Ý’enð8ŸùßZZKóÜÈ!*qsßþË D-G<3‡)]½Çþ¼«°™(#¢Ý®­2ì¦U⇠…<À#ìس²Xãf!¨æà~€U¶¢÷¡…Bš•9q.®z–ÜÑsð»ãE­ƒjBJ}”Åæi¿â÷BKo9bÇNÁÖ¶fI%¯p'uŸÌî5ÐÒ7d*ÄkæøÂÇBá²â‹OÍ×ú¿wA¶‚–/-äža$²©¾Žm!¤`±Z Kˆå„¼›¯2×ÊHÿð0l$w÷£Ñ-uµÄPýów}ó»Zª«HÅñ×”ÝZ:_#2««kúáAN»¸ô~&6ð]T`n*èk¡–‘‹I§„´g`^æüw"«ê‡ÚÚß@õ.ÒtŠ§¿n3O:kKXùK«: /ö,öÔu•V³B¼öIDÐQ„ô&ÙëqQ#½GÎ 4¿ø °©¤%x9´j¯­®¡&¸›’Œé£û|éÜHd Zˆûº¢¿±iœDšÉxlůRY·T}5p>Ië•m*5¸| ræ„Loçx~°šš/¦­ã ©ûU^ © ‹¾qYªá‹nt¤ôMÕaYŠV×’H uemµUVü¬.±ííÕ5"'£s;G™·Ÿ‘º´M¥³m$ÀDÜ"‡ÚÙ3—áaÌc”ÝÒØË{ZSÛÄ»ý ¢t(?ÊñŒ -£PFŸyŵ0Ø/ú®¨‚#¦™±ƒÛ™¾Ã“4 óòÍ« wʵmeäêÒzÙËWPóEq~×eJ놚Z^S¾â™çêƆ¡¦¦Qro?"·±¡¡?ÉQÔ, Ãlà­Ë:œ›âòFédØ=Q•d"vïeKÛ¯\ Á›è†UCác¢j‹y Īú · ›õOµÆ.òuv®Œ²Ála£€B๩ ^ÄÙÑ5MY?Ó2#~Q,Gj©'ÖwLÛ*Jùæ½î©«Ü·G’-}G¾?…oš&“×Í´¸Iœ5 ®­D¥ÿpð^SÏš°ò/BË7›a…ĈúœªÉ=ÒFᤞQ×ëۘВê«k‡&È-5\ûùZzæS(ó*|´LªÜ^ظiŽýØïW ›·¾º YlZ¾´t¶kòݲ…圄cÕÚÁ;±£_üôA–}ç|R‰Ì3én¼ŠQthioTä9µeËy¯†å­)Ý%ÓHJ悔¼ÀNv.\+=Bœ·±œ~iQ‰~rËö#"¨ÊWÔ®ŽK[X¶0$¡ÕººÚy—óDR/–JžK°×Úµeßm<`º›3ïd9|évC×sç¤)çÁ˜ü!Æ®!²ài–-»Õ2(Ä [IÞí[XN\7idn®èëWåäÎë¡»ƒ¬î0ãß²O¶¼½çÊrr74¨äÅlsISÿš•ëA¹êeô¹áöLŸâÆ!½ m¼‡¶o;xñ‚úes¬ ç·sé¸ ÚgŸ‰naÙ­â‚ï#ÿ vYºÓÝüy]Œ[ЗS²D0Éq3þ»M/´ŠÒ;l'ͳeËN‡˜zÏU™/ÙvîØÏ)•^É`éÞÁS’eÌñ{/UOàôÎý¼¹µŒ­ªÄq ν¡h p—eGÛòe»Ù“Bp^á;3õýgºH_´ôs‰0¡%S‹ƒy‘;ØÎV5õh œúœäƒÆNúìYì9Ë>-f¿PÛÊðyñ¦í¯K÷±7®aŠ>öI 9¡…y,tô² Èögãëæ¨DŠÌÕK¢Çw±ñYÕt-0Sc—Žl9¦ÓÔ;nʱTEqkw; r®qؾïbnõD 6í<ë>ŽKwÎðèUõÒ·Í œ”wneÑp.m.AØÆ xЫl–ÜÑ*wá讃¼éuo¨Dš¢€––8m» ŠµÐB¾´cç–-Ûµý‹b³Öò×ö¹lk#þ,§Ž¦eÅÇwlÛrÆ®4ðÖÛ·ÿ°æm9©;ÑŸ”oÄå~þŸÿùù›oÿò×ߣ~þË_ÀõÏp]†,6-Ð#Ï Aú㋾§å˜btùÁ%Š¼„.ñ¿æö™Ð2{ôä„ÛïQ3\— h ‚H ý×@ËB^x$®vyQ˜ô*. Mþ/ƒ–7RÊ¿Óëm`A -†–¡Ú¢Ù–2H A‚ô{ׂ?èôÄnü^¯_[\ÿâÙSPQþ·©®ÿ‘ÐBòÔ³€ $H_T×Ç,ÿÍP³ì[éËCGX~§™0}~/¸þ¹]?~Ôÿ1 ªù Õ$½üZ ÅV}¦ 5a·ö¤•è$1×V<önêb“ØܹöŠi¸ã˜åÒÉWðì7)¶c‚°„Ù–Ê™âðqkúù‰ø°Yàí=f%0îo7]W6׌žp» þ5îï:ÛZ9Cð_‰ÒøSß™–Š©hcúOKáIT6(‚©È;ôœ öži¬˜­N·{ÇlÚ*¼ÉË™mÇLØ1Û—ð$9×R8é/AL/œ(‚õµ¦Ëf ž¾[¡~3M³uYN"ô‡ÃæÚ+§áN_UvM„0ò¤*eÜ–‘'¾Ö³à"sióÿÙ;ë¸(³ýñÿnlwzwÝuÝU×î@D0è”FBPi$E i”®¡;†î¡˜Nl§{ð÷<3H¬÷Þï½»ë÷ë¼^Ÿ?&žç9ç|>Ÿó9ï“!«ÊŸngÆZ¬pcÎ}P'Má [&ßá#`€pr®.½Òã4» j2]d‚ÄPîxoB»¡N¹qž+º V®ËÒCop†:9 ’Ú‘—ÆGôqÊ\ÿ\u1û$ [îDcf„èaC®S®ŸâŒ€¿s»Ó)^*ÿýÔýmy“ƒàó[’@Mf%ƒQb _%ÔYƒ¢\uÓn¨€1äA ojSêCñ0âÌg¸3úßH.Љß⾨ìei4Ϲ¯7ÎrúRþGþ–ÀƒxSë‹kY;3õœäßÛÞHÕý$³µ”æ§BñÐe·Òµ(¾&ÌŠ6Vœå ÐrãÖÅoaÆþÛ™I½ÇíNåꮨªVÒü4Á¿ül9ÃýüñzZ Oejr  jNÝà3-3¸’Ûû ¾.óÌL°¡ç¦K|cºšÅËœ3ÒÍíL¯ô¿É“\ÙÍÔY-Z¬±f¬å Ѭ¨‹~åüß°`·×ñõ4/à«*=?ô‡öqŒ¢¥Dñ½ì"0 R£orFûxãu´ÀS”댲|bS YîZÌ:¥ÝœçŠSÌþnf°¦(`FWϤz)S‚/r†zø“-Œ{fw}Îd¿¸°Ü¾„Å­Þve¨äsXâ f ½€cü/˜#ž7ÝÏŒ6}U£—•ò]Ì+Ñc ÙýíÜþQéN1›jøÓ=ì¢eÑæº ½®‰æ¯õï{¦*­¤L.Ùzi®ÊÊç«<¿ÿ™Ðz ô±‹Ý)Á—x}wE .««|é`¬ëç×ÒtÞ8hq×e v (Sô›‹x’Åk¢ØpFú—µh´hGZkb†u_Ô"¸r:úxP D«Pã\h!æŒ2¿ËânÍ›,§ú1ûHŒÈÓ´èkô([Ú=þÔ€”xÑ´ FU#§ü²W$j¿ãJϪâ–ß¿Þ¹Ëk £X³G†ÐS}èw­i™‰‚ñ;Ë EŸqß…ÿN¿ Æ|zóâM 9C»¥TCÞT ÍßÙûc¶øFMæ({†QÛÈ­¾º,'çh·-hIw…ð( š3²|hA¬Q ëÍ›£.‘NÎÐ$ Æ ¦Ëž€Ño›2ЬTkZV¯Ê…èÀ©[êÀ NªD:™aD›Òò²ø רÆToõå<ÏHr¢Ý¹ÌÅ!©Êôû^ôpkZZ¬`"’â¦F½eL 0eŽ"X ËbZ°3=3?^~¾y7ZJõ7a?aDý™ó;M >'À䀅õѤ•vsëB¨ôdgÊuÞTIzy+·øw¨ÁNÂ0]ßS¢ðâD 5§e¥ÇýV;Öþ`Z*:H0‘ ÄZˆ1O@%3*˸¥aëBõQýMhi c–$0ï;5#?Š‡Cqê’Ùyç(>6¬† !Á®N¦ßÖ£Ÿc¦{²Êè‘æâö…YÇ*‹¢ùª¬-ñÜXùfW€­ãµ‹PÊÓˆOì¡G¡…;->g„1[ÛXé’ÊBK‚¬-Zòcf¢5Ôž#rŒÛYIÌlWPnZôì{¬bfŽ÷ Ý:Ÿ³ìž© øKRU„ðhà.Vÿ#þ,í¶¨œg¢ˆfhdƒì[´;Vô¢<ÁÐM O$Ò­%‹@¥ß9EñÖMìÌÌ"jK¡åÖ!¹š×8÷õ<«,‘Uà»-¾¬"÷¥Eð>ÍHñà?Ÿ¢ßPQ¤0(£®Ž× $wš7UG»mÞ"Ò‚th±®ôHZL`2âvŠ‘ãK 2göŽp (îô$îÔ0ã–ÄXôœ$Þðû®ÅÝ”‹ê§ùë1Z&Ù¹ŽÔPGzÌYZ„'ÕŽœˆ RÀ«pX”+7.¬˜`Ë*¼DÍ«áT^¡F†°«’i¡z"+0ÓÜ™xfšÓ ¡;Ò•QÜÂIµ¿Fø ‘©´PG.¼…â¦Âèűr¯Ðr2ø}¾wFš+-ÔžCb1" –°sä#øÔ+Ïtý!ÅüœàËÌðaUÆÓ´—¦æ!D> …^àÂ;—êÙGŸ`ÁFáiÁ¦T?zQ·ÒzËŒw–âeɧã©@?7È›©ZZœÛgia–´˜<ñMƒZz,;ÑG[ -‰™œÜó`g¿Áð_v£§.íž3dDèQ~œ ñ§,Kî’àùãÞe.bXü »«…>?˜ìç,xÔ(ï´ä{§5/ÎhÕý$µÍοJ½ãÄR{=´P#¹Ù6œ¡Zª§ÈÖõ Jã ¦¸ƒ¼ç…W†mžÌL¿D½¥/²ˆ!w¼…~Ç’Ñ4ÆJ°¢Ð;M‹¼è¢†¹ áÄŸ¨‡Èzšq~bh‘TÕü¼FŠÏEÞÌ9ÉG6Òµh)é\h?Ím¼»P¯"^ Èñ¤l¡¥Ëmeå^¦xZðÙiw¬©A|L¥ä¯ð@þtÚòé!ZR7Õ€;YšyñžãAdJð¾‚ÐRv“5ÐC÷S¡$fÎ×r[T­tøOà"h™ËXn6¿Å…r+„×B µ¢eÖ³æ†I½mù£É ¼Z×Ê)’ðg¸_-~Nì†hza-×5Y½PF¬khœsznàÔ„;Q3ïT¬žŽeN¥Â¨ §¤éýŒÖnV*x#µl„•.Š ¾gO;©¾†ìñQêuîÄÔ|‰è¡Z"÷¨C =;Ÿ“xŠjÌêìfèóèOèáVÔ»njU+Ü4™Ó4Æ]ý×A‹§¢œ~û ««Ÿ~KƒÑÒÅë¼K ¸, D…/øCo*--‹›jB 5aA;˜·–×>u֚ꪈ^˜Çk𥅘RÀ¯ªôþ€Ûi¹¹ÜZGJtÁ@eÀ‚ÙѳÓx-7ß,hñ»ÊÊúŒË¡ aÞÌ!s†7Ñà Q]Þµ§'Ýà=ša„ëÒ r™aš”»÷ %Ê™Ý×Ë-Z7=îd#Å›‹HÛÂ]—M|&2–2 R/dPyð>Þhž”UV€O}ñ‘ù;Ö-1§9 :;¯ƒÏÓ6‡t!Ý…O¡€Â¹“ŒO.á=Loñí9ešÙÖËÊçO—¯-a™5Õ¼7É/A>¼ÞÈ7n.ÔÉÕ[•rë&¼’Ù7LOÊà6ܦÜ:' 1…L3È XâÀbxq Oè·u)xò1u+–Ž^QÁ…8Î%gÊÁ i¾sm}x<·àÒÊ›‡–몬1!ó)·£™“wõM#>—E÷W]€ ¨B&ž¨ó», ð”¬ËžÇmjøe&´…W! njwuz;ž•~–QÝÊ/?KqWãŒöÓoˆÖܾôßàI5Ê-{þÓgÌh½¥#-PplŸÙÐ)Nî·¡%RPr8«µªJ‰+<e—øýÆôдЫèZŒÆfÖ}JDreZÐxÞH³SøÏ 0‡-#‚‹Bñê¯PnÇ yl‘ ˜\ˆ+£©žu¬é66ÙÒÊ*Šáã%ˆXWËŽÒ\-Œ¦. égv0〘sU8èûêôÐ,ŸËï¾ÊBÄ+|–@‹ÏîX˜±Ðx^m8»¯–žZÂNÑ‚»>‡(ªª’ImÞ@Ú|Uƒ¼î§6-:ìQ#Å•3Md&ŠÉG™c%ÏMcù{p‡Vhwص̲*Æ Ž‹`†¨-~èŒÚvß›/‘Ä=æ ¥ ‚kÉëOd··3ÃŒù 2«¦„S. ‰WMPSøP·å³<‹ %2OÈaþ0˦s’ -l¢¼N % üA…–á&ÙqûSXMÐëW Žð`÷ö ๢ð•ÀÎ8Çlo`¨,2d°Å‘Q^Ækñ{³ Å÷«"‘]‘, >dg¹,o)š¬þ! ŽzjQ–ŒŸg´rŠÝ©q·ÙÀC ½|”<ÌÃü…ä2JÐ^SXüäNº=йc¶C™±&¯„P jf>¯#XÊ*+@‹$Ôk1{‡EuÄÝÛÀ¥SySï•FvZÜt¸Ïé !ü®^ôR‚Cy­Q  â«8ÙÅKe(7EsßOÈT ¾%ñaq’änžZ<ºh*|Ñö@#nðÇò©Þjo–®@ÔKtâiÇn?ˆHQ¡óÅaÆϵѧz¨îoÞBÜGZ¼ôÙÍyœÞ6n§dJ‹QQ&¥Üpät—±› €Vr!€‹GZÜõؽÕì¦îD§ÐânÌèb×gpÑpzˆ½¢JHê`×g²«‚D D³‡ð§;PGº¦%"Ý=ÊŸjaf]§xè°ó8=PnOŠhå(ºÔ^ÅMq·ˆó”ɸ#n¯ ÙõÔÇÜædB¨™EÜ»§…[y4Áx7h ‚^L½8û´@”iùåÜNÀXÝ’Žª‡ÿéˆ8È3+³Ù-¹œnƒÅÃœûä §)Hcõ樋Ù?Οªé䵸ÐLf€¢Eñ·å´åsz¸5A’‹»úyÍ¢‡y·ÄL:aä$p ¹œÁ~N…§˜^X¨'ì\Q|ósR¦Ø ™ìÚD ¶3»ùÈF0¹JQw2ÔMø¤z¡•÷°Æ“ß ®Â ¾ÂÃõ±ê ¹âYcM®æµ|‡2ãA(Í_óõ qç¡…^ZÌ…&²2lÄÓÌ I Ö E8ÓêËç dËV‹ Ù5Iì¾fvºñë %2D€-åu7ç":€Êêéætä±[óè^"h R¥Ü<Ãâþ&´h²zëÙì¾V.Ôl\º¡œ¦tvs)#Ü”éÏC6³ë‹OÚ%Ô½DæFZ˜Y@U—z6ù Î¨mඤqàÃÌ$ ŠïÆnÈ玔™œ$ñG«f•z€O¸ΟœŸšW¦× 2çâ95«”Û“0!+‡¡¦æq[o¯°{(6Ž?|O¤Rkîx¸¢f`€Í`Õ%K¦‡òÏS‚. žu-]}äeÊnÈ2Ÿrš©7tÙ3^_ 1fîp6p°“-à¡Û¨Þª@q„„6Q¥ ¤xœæ<¢p Yà•÷ÏRÜ4˜å÷ùÉÄü_Þ=ÏM·¡xü›äé©EϪyÝHËk…7Q·2´ü/Øò,é–g©HE*R‘ÊŸ-o=Z˜-ÅKõßKÅ[—f#™š”B‹TÞhyÔVÆi+–ŠT¤"©üoÁ19ðDÜ“ ÿ[óoª æ×V©)ß6ÖHß=$©HE*o•ˆß=Ä߸•qáúÿFáí9(}÷ôÝC´<ž!“ˆø?Zf‰8. ‰4»è-í¤Y"ž‡ÿNš%øxã‘_&ºRü…Ãq‰ÄÙù¯À•Àd’•<_üï øX.(/›û‹€‰ W’–%ñÖÈ,™ê™@ΛÔð0 ¢ß4Á,4O¢:ñ"‹É/AÛa¹x<ÿ·l'úkifæ-.vqNð€¥HoÎ{÷–êDìEâLŠt"vKáò{_Õ p—Ä Â+ömà±/ç“ùö+¼ôFð™bÅ.OîOÔØ|e™RøŠƒ $%~Çýn™œ®[õ·¿©;ÕÏÇ¿’T¦8uðó‚9ä?D-@¥“D§&„iŒÊÏÿý¥NÌ -³ï¾7ûþÿüýo¼wߟûúç/ÿõÿþ*|Í-ï½Ëúë;ÿóß{Èëß¿šÄKÛñ·Zt:åù³GÉ,´°œo M Méžæ/Šo¨'ìw¯ß™:ÄŸ! Kù„;™ëõè#.~HS~š‰ƒ¯×%ëC§üq$nšéóË‘ÞgMŽ9Ö“‘àÃc-v|™Òø¸34,³cùÝ2öIâm௄«:²ª+1£ƒwÁ+£Õwlkþ½ÐÒœìå`"«çS|E uí–· ¹­|ÌGš½ëté¼K°£‰Æq¯ž%&ÀMš˜]úåÛíqð‰ߣj¶¾¾w#+ž’ õTýï¤íZ—Óòdqr‚ò›úúïšž<î™;³$3Õ±1×½îºØVpn `Ñö§,}üÂå·í©zòæ¼,øÎE§óׂ/kœðÜ’b£aísrûÞŒfJ7$}Â¥»¾*Æ~ø%7Ÿ:êÄp÷†¼Ö'mÕ|WL¯E-I; 5·rõv½ºg¿/Œrqqp ¾d¡uÜ­•€&Æ‚器þÜíî%v„CÂlM5öœp%÷ä´¢²ßÔÓ;פ×?ü5V‘úÍÏÚ¡ )%8L[²ìqó[N"1øGr»N††Å˜^ç“?õ;A‹Áµ,°éÇ<¹“pUOqü5@íÝ#Œd/kESŸP_¿ø¢áŽ´ð¯{„Ü}2&øÔ2Vpη`ü_¹r°"wãõŸÿArLs{á_ñ×oúo õó}¿~á—uë°}ýËÆߺž÷ÓÓï}Ë[·èGæ?¾F~øÕ³o¾Á¾÷}íϨ¿üíÉ×ß>üðÙøk¿Ãµ¸†ñí'O~~ùEÍ{ÿBË[-t*•òâùãÇÿhh9¸îª[@df?Ž¸Âj'@h™ Åýe™Ÿ+¦bˆ+>Š®+§ Ã1¼÷~–T÷h (úW•Xñ3 #{¾—‡!3DFÔU‡š\[ëð–ùg:ii%wK^R¨;*gû´€‚©u?-‚X‘›i»)¦ @Ë/Š—Ü|â:G¿‘ûæÉ­HIE@ |½ãæ´H'$J¬žƒ(â#E%g ù%¢3iïåròï -bi »$çÐ.6Ç 9£)‚äwZ~±h'‘_ú›©Øå>]‚Ù×ÌŒ M¬lÝ'0Bxs¥¾†±¥™å©‹H'ÃÝRÍÐN_i‡Î•šæHUíÓ&‡©ê¨j…ur†ËRô´ÍÌŒLtÝj±ø'F»¶89{©î—Íi¥´•fÛÚ#ÊÎÉ#µ¤Z‘Ø×Í t ¬ëvŽ³ÊÊÎh}sôÜEçÄñÅí5ýÔÑÚÎÌÔZ[ß½lÐf0?ù‹=gìÏ^;ç‹(ëæîÞ—±çØc÷ ¬ÖÑìÝ2Y[¶—ë»Q=eö<Ø)“»ëñZà³ g“ÚT°÷@…î9šG òÔ±Ìû³¶l«Ö½üÐ`Óý-;b~XŸµeKƒí ˜Ì¦»ëvçlß–¡pæ…G0ÍÍ=ú½o ׂhžÁ/œ]s6m“Û}ô‘{FG!yãά-¼¿Óx\é¹ èSÊwœ§z×nû¥Ôðüw¿"\ œ1Ó¸óó1Š“a¢‚pÍ´æö:kOàÕùâºoÕ¥Ðò–CËÓÇSp2‰ðÇB ¯6£¸¡®]gçž™˜×B ßÝüÈÏv¦·½XÐÈ$a_A°ö¹ ˆ$y»7müy³BjësñTBKjØ®«ƒDòKhJàiß.T¹Ã<´QãJºþعçä{ÚÜž$¿ÝŽ1-ˆ¾ÚmÇ] ò‹U~]íÓÁÕE`çøÛ\ÈÆ“É¿ -$4i×Çï[Ü(̹íúÃÑ(,wÏÉxíú?p„M/j[‰ðmÿئ¿Ç èÕÊ;,ˉ Ø^éç_~®&‰“# j8QÔÏ~£Ôè$ËÏÆ1—@,–;isëÄƼžÚN©­9Ñ?k„çdí[½6ºŸ¿¸1âE^4úyýƵ/ÂÜ hVi_NØåjè•€|¬©PNÁ'žý$rŠ‚íÎ¥#Ä:A µí5Ïį”±h!ñã\,֮ߴz·}ÿ÷ 2ffßû—óæ¡Eá  ¤꡽ù|êÐÌ-Ä‘2uçùßhù^-©RytLêoI'뤂U99>Íb‹¯™Ö¹øöªÊní‡rÚºm>‰Æ϶˜jÐrïÔƒv¢¾îuh~ªlÙrÿžéUeµ»>ùµeü¡ñQ]4yv$^ûÚ½Þ׌´áµÇ¬£HäÙ®hMŸ|8ðKÙƒ¨•jŸ` c´ºª×ÇJ±)\-I_ËÆáDÁ°"ÎM5 \yÍÌ  C@>j¬í/M\µãšÈ2:yÒŒd¥ÊÞ¢ÑÑM@ã$äÔ¡U¿f•tW¦‘³K׌*…Û8ô4T GfÙ«š‡Œ’0Oü¸¿~R@Æâe>ÙÒ'ÊFcú åÀ 9/[Ÿ¦GÊk6ø#•9í Ç,žç…ÆßúEç~¤\v×ÁÌöÑ-¯ïEð}¥[vèáaéJ׋€kê" |ªÉ ÉƤÐ"…@|þÓ§ÿŒ…¸³cé¶z—s_?ÒB" }]Ÿ¬2[櫨Áú=šãX! e?ù¶ ÆBvW®_o€ÀqžwÃH© |{ÕŸ?üäóO?z÷Ý> ©Ê.ìðU¸z¯gî9\“ãÚ­¨Ù)´ˆ @AäÄLG'.ÁU;~ A°kG/VVš_€ì£ÃR<È%ŒõmúÇ‘‘¾¢“Öáx[ ZÖhÄA*`£S,â4\ -˜¶Œ »Ïà‡ÌA‹þÍ)´H¡åÏÜ=DBã““jÛ[‡lå½~jI#ëE+©@Láø™IêÆñÜ¿÷·ùL€G 11ª¢W7–ïئYX;ÑÝCÄaŸ®ú0${¸*ñÖš—€Ž®¯ôÈQ;q…Å hÓS”áÜ3f•8‚„~täûMå0Ž¤±nKP±ºKz»½;ýšj¯î78üŒ„c–õWç¦Êî=6E˜­ŽpU6ôné@u÷>&’Àáý0ýò¾¢Ñnoç”üÆÝñµh$ž“b¸îâݦª¤ ú£Æ[öËZ6v¡ÂM7y<Ct[³Šq28NdÞÑù50g(ꜶîMѤ~ÆÑØ&ŠEùe• 㤻_n¿6¥ø˜¨_ŒhêìDO2ßœ…¸Uá.*F>-"(gOÈ¥ÕO»ßà—…ÄM’”—¥Ü9xòR4~RèéÑ º=¼y¿œ “;&›=³ÇËËêÇ+RnoS¾^Iâ¥^°¸W0 ‚}â€Jtþ@w7C˜­‹ñ<®ëÞ šà`ÂÄØί·õNÍ౦ÆÁ¢iæYGaØn9›ž^2Þ&sȸ¡ m±Ñe‘þìé!’ íŽ¾šmTkûxF\/™úSÿ­é!"ÛùÔ1çضî–ΪÌüôÐJáuÂ`ˆ ûld@n;r&ax˜™7†"ÛìßZÜNô>%£-‚–<ZL}@h‰ $Û;í^ëGDf#pO,ÕÍ^…x­¿IP=Ç_šsTÁ¸º}ÒíØš”Æ™×@ ¼9V/ŠƒÃµ7þ²´Üß`×#.QyÆ*y¯Ö^BqZI/â™ÊwëËY®_n …[VÐÂ\ÛýQNËó©ÎáÜÄhwë>å›ü Ï£¿dôµõ¥¥¶ÐB‹Ó´¨Êè‡õ4Õþ´ãÂ0vvÿÔtõWPË®+\-½¹‡É„t£Ù~J›ÃËHµq>®-ÛìºHP‡oþp ¤aÈÕà¸að=¼çøÅúÖ17ÍmY=/¤Ð"…–?ZÈØ™àË—MŒm=£Z–¬T!á(WíϛۘŸÏâÇݳ2³±²÷o‡h"=ÆñbÓ(¸  ’'ºÌÆÄÒ7‹êv²q°²¿Y;Ìjw^J@òØ¢U£1°EÀŒ!ìܪ±DɢʶXÿû¥¸·Ü+zJ"ÅÊt È'á·._4=ãšÓôh ã<}$z¶MF€ÜȈw¼P7Hcg-þËøRé0«ãEKû›Íp ÏV¤Æ™Û^ðz0…Ã)¼»ÛÜ1O<‚@\>cÞ#Cð½ƒGDŸ+R­ÍlÌm¼†™3ÌeÉóm¢ ¿9 qc=¼çu‚$¼i…ÚÛ^ ® Ç\9ccjë]ÓC__uïNpÒ ¸Ã^‘êÄÑ;k+l.̶ž`íÕ,R&-¹žWSËР~Æ:¬ÄÏ7snCò“núI’³IÐÞÞnãÓF˜þx¢“cܤZ°Yæ¢+-­¦qšŒ$ 9÷t8Fðç*„{qÅ»rn>‹Ÿêobìp3¶“@¤úúæáÿ@h*ÉñI@Ì-xžò¹èhbâTÒ:3R_çtñЋ¹éiblïs¯Oœ!Ð3‚}ðu=¸°øxG³%`o{×–ÁòXèÈ‹ˆHÈH[§gÙ 2þÅ=o7SŸ¨6,”D Ï¢êcSK‘`õÁ>ó:ïhâ\69Ø’—ailçV%€£O]®—C ϽvÕæB@däNÌRhCÛ.Ç¡%%"rjîZšØ8z¤Àñ³ðú{GŸ€(ç|‘ŸtÓÄø¬ëíz€‘½ýWìÏ:)h7pSw‡ó&–— áˆú¨ªÎG‰QÙc…3MñQn·î™š;K\}v²©¨¼ñ…˜"¯þ~”•©Íùë‰ø—¤©I·ó—®ºظÖáC ¬ªÂ%) YTßí|cÅ—•'Ý37¶ó¸[‡ÂI¡E -ÒsZ¤"©üDëÎÖ˜yC§9Ԋ†ñ‹jÇB«)RmÿŽB|vîÀO¶ZOI¡E -Rh‘ŠT¤"•ÿ´`àĶVxÏàS"Iª ©HåÏ„"áðM*R‘ŠT¤"©HåOØ€t¤E*R‘ŠTo0ïKO+k€Qç‡PÐýÍÝÏÿýG 몇qÒQ©HåÿÔôÐìD'tÏ÷¼óùÆ(mñ.ƒ§¶ê‡>øëwâqKnœýæã÷>_#_9ÊY² V_¾ãûßùøÇ›éÃdÒ,¦#oÓ7Ÿ}þÃôn¡/å›wÞ}çwÿö—w|‹§¡·¯üåoï_å¼Ê€g¶¦û}ñáû¿È;  ÁãëÓ¯êòΧ†žÕoó1þÍÉ®?~ôŽŽhË3 GsRÝýÞ{_šÝ¨[vÇí‡/>øl|õ0k‰ pÓ:‡¶½û—µâqÉøg–G6¾óѪ Ù€®™~ôÎëŽ\A –n í…nüüã5ûÏö£—ê¼2ôÚ?>}ïãU{òº_ôÔ“{ç÷v {sÎ+& Kîƒ:ùéHÍ(›LžmÏûúïïmVÇÍâ&Q»V¿ûþ*·Ä~ò²mGq.&€NÖuE Ú"ÜÄnyøzáÒmËÓS*;~x烯ÍoÖ’ˆ³‘>k¾üð“Õ2e4ÂhÃZ‘oÿý¯ÑwYr\ÀìTuÔöï¿Ü&>—4{ßÓê£wÞ_sè ñg.Ľ° Èð;ÿ,í»{ÍÊŠ VÝ-ÀÎ+3Éý̧ï¼÷ÝVµöÖ’â´¥ºýôÉ{nyÿѲÿÉæ?Ú->ýàõ2Úg—2¿zv¼,).ýÏ×#0¿|¦ÃÍÿ ÊDÿ¢ ÛßýûßßùàÑ-~vù‚Û«ä1¾´ñ’ŠZþ4h!<» r¬±ïñäÄcäâ} d¯§gqLQ-³ÓÃ䱉Ý¥yí¿·äÜHĹ{ð1|~òî–zöÇwRêg!qkößÄxH GŸþyuÓ0zÛå„Gïô4 å'a×è™`4ßsÔ¸XŠn߬ygd‚|]ûP3úí…Ô¶;×ÉH-ÕÁj7kÓOn˜(¶bf;°‘gÝåùŸï A.ÝêÅìèD+n9B ‘­¾>èÁè$üÙ8‚GFË«9O é¥W·†,9Ž•ðÜißOEmjï:*Ù,=zbôáèø‹Á¦ºU2A<³³Ÿ|~ßBæ|XåÔÉè³®²ÜÏö†"±Dý#ªÝ”|§ÃÎ÷úŠî8é%!‘S3æš½ØÅ7¢‡åÔ]”8o»]‚l‹ðTpí»åÒvû¼«‡Ã8ÊooEòaÝÈÁ‘§}µeßîõŸ&ðQ€oO?w9²3¼zI ÅOâ»Ë¢‰¡=zôäy ¹šë[ü²ÆþÌ õ(úäèô:™ã@a1œâW …8V¡b41ED£°‚Ÿr8BÎ_*€ñÐc˜în©‡¹+ÿW=ÏêÌC»ô—ŽÉ€CŽŒÐó—’‘âÓY§û»µ)÷J^ˆ0;˜ãl¿òyqóÐBÆ 5Ž×ù¨üx·ýfB øb&#òŽÜºïS›`õr‡0½©&þU·üÏ =ûö׳¥Õê²h"-[Ã*ž’Ñø_Ó'jžÅL×uÏ´É«ûοõ£¿,ëÈþý»víÿx•v?î7¡p]ƒ]290 ‰ÝðÑÎΩ¥'â.‡ü`ÃÚáèWM4vìØ¿uíWwË1‹ …Èξi·sû¾oüSë_>¯˜¿âÁ`OˆË …З¦hf ÌÎ$´é…É’gû¤+àÔ¡8Ýï“æÞ¨øBKgñ ?HeE÷5s­¤a^´ÚFûÂÄÈ—?8ˆ ªÐ&½D–9Y‚Œ4Úœl•4²´0åY Íâj¨—ÜÏ!â©;6ÌAËÑÁ …áÐŽˆ&:~lôóOՆЗœˆ»Zóî­– DuÆš^Ï!‘ø厛æ åLÂI}ûÖkNa…ƒ).GŒ¥Ð")´üa q…eQ^ûeŽQËl|¼hHóÌLS}õW_l> žÐÏ :Fö°Âþ}G¯§MÇ žZÿôEV¸¤¿"ÎûoŸürXö˜Ü±s=^MØeÙCÇd*9Ç€+;ã\-3ÄÏÌ v?x@aÏ.Ÿ™,¬¾m'{HNVóJË8„g¸ŸV?$sDãLá-~ËsëOÙ]?}»v»ù•"ú™¹ú‰ýû[xí¯›ÊÞUkwÉÉ“S Ï¢$t Hýf\×›³×õÄîUkw‹u2…„]ßwàØ~Û–Qfpèøaù}{_‹n¯¨Œ·8¡á(¢A çÓÚ²rÇed4ë©9aÞ [î–ñL-Ù%q|®¾¶’èÈðmý†)¾öáoÖì“S €ã_ŽÕ~¹ÝI˜sWìØÏk Å/AÀ4ßSØ·åÓ/<¦rè°»™ë–;±o¯rEÏó7 Z6l; GQÍttbÌDù¤¬œÒAÙS 0p«.Éíƒä{E 6ºr½dw­ýö§m¦£ÿgéƘì.Ûœ²íbW¤Ú–ÇNÉɽ”Š$âÉÚ{¶k<±wŸfU?x n }â°¼’AÐ4ži®§´óǵ[•ÌΆá³Uñ òÇ•ŽT Pï‡9®wÚäü¿€ÐŽ‰é–WÔòKœ@Àú 5uWÿã—“jf™CüñÚ¬“²G>æþE"Or5æU6õˆ÷/Ìâà@Í*ËÈj™&ÌÖ—´ÀB2ž]šU5<ͬ,UØ»áF bùI˜ÇÅÙéÕ-ƒLò¿· ̪šԴ 2H6²‘¸-ù¥ÐQ¸ÿ«WTUÀ%ßø©Gé©`Ió*†·ë„en™ßº%‘Ó\Þ˜šZVÚH ^’°ÔꂪÔÔªÞQ:Xœ TvziNñFtŽåX,#¥¬:Øhª£_¤"HYÏJ þinzóÔ nÏ» k8ðšC™åYUh ÒÍv6vf¤Vôˆªg{M«ÄiS›„—8ÄÃœ4H^)²ÐcéSV{ZIüöê Dµ 2X%U2£~ É_°r#ÐÃð«xhÂÒ³¡¨Å­ÛHçpíˆäа¾æÎ1p‡ï¢Õµ‰V©±ÓEmbUÛÀs2‘É,!3»Od7–5™,k".{³§p°²vùïSF 6¶-´o±EH³cõÍóU>5wg6‚-¤¬ ‡›"gä¦ÂZ]Q3¸¨Ù%"gJók22 XPE³oКZ?PWÛi¼ß1|dQžQOœ¯…Ý-#>Æ¿"&ù~.4ÒÕr•q-~±ª‡ aIuEÉa÷Û¢ˆœl¿Ð¬¢6OSåýÎ}DdÃùм¬ì-ZÙGo+ªˆNo,Œó^{"C÷“6ûi~ñÅÖìj¤oõ6«šæ^Ý[:°o+´àvšvYÅm§l5·ààæÃh¢0PcÿéåÅQž¿Ú7› ·(åÝn­--²;Tpü,åo½î5ÖÕ—mÏs /Í ¿¼öD G¶UµJ/lµ”ßvúÎ$ ó¨¡p†NùÝK‚–ÄÞò»ªr6 <“V•÷îVç––VÅŠ}¸?Z¦jÒ®]uܰɨYd âØV™’æ ëÝ?Ü-{ÔT˜æX˜ë»~ïô²àd­§à×Ƈ©úÌ5k•r˺RKÆIêÕ]_…åÆœÓP:W±$Åîhû}Z7 "]7ØT.1ÁxÏ@hbmQjÔÖH㊎UTz½—ù‰-N}oÎK‡[aÕåµ?n»PQ;ÐÑO.wÛzÜ©¬¢ÅÏ9ƒtä°EmCë‰ïlÈ¿´l¹ØŒB1±XÐ+Á¢™Ž:Ú£L4šO&ò§;Ëwl³šD0 !‰ÀÃ`8h/ÚÎD Š‰F±–UðØa—H\9V ‡FÖ)‡T×4·KötÇý°a‹W3uOm©ü¼/Lco:Ü|‡ž9~tlj³±3d~¦â§¾qÍ@Ý­tðBð3¥Ô¹¨NܺfçQ§d²è'×­¹Q“Ÿ\6%4=x ¡›ÝxuÿÅjq´Èqô‡,…2‘å{ðkÛ[ʼ¼‹#Ñe ŽÁpH‰Ã°Ðh6 %8G˜h:ç——–°ñ»-C(ЇÇjò~Ú²år ðíÒ¸[×TlãAZƒ7×£èÚEœ!²®éÛD¤Õß8£²á|5ho㛟ÙõáßÒ›ž•„\Ýh”-KÛ§áƒÅ?µüñƒÛ¹ÁgÔO…M‘I, Åå”É­Y×3É­÷²T¾RRW;Ð=ÆX^%e—~þ쇀&†¤[c£A£óÉ$1´Ìql<~Y·‹$ìˆ>ÿÍw[c€È# ñ 6Q“N5Ú? ¤USY¿éˆ‚À‹6ÛáœÜsAi§ã},9S†¬KyÙa¢p$ûÚΣg‹ -‰@Å%ñ}ŒåÌüKJ²ò;†Y¢}sA+ÛÅÎ89þ·FÊËLeï ¿Ã3–ßçt·¢øAþ(b0ÔDx+£ð&žÀõ5SiÅÎbЀ+rÄ HIJ±"G]æ™ãõ…mbJä–]§QD~W3 (Böm¯5Ú²ßÞ> ?§pë{Ío§,áºxõ5Å]/摃ˆç¢çª Ç'‡',õLT_÷‡_ÍÍÍØwÀ`q¬›ELÕÕvÙîþ9§¼·J¨ŒòúIÅ¿¾®Ë÷=[ûÉ^J@oÛ¿]sI)-ËÎ×¾ýôðYÍÛ9S¢îÉÑáFzàiïæ9ä@‘÷ü¢Ò:-˜!0îè+”dzhH å£ [jXÃWrìW¡e¼­ú°g«¾Ö9  úJ·YfÏ÷æh9çî~Ø$9×s_ZpÏÕ¾ýöAÛ\ËEbž×Ó÷ K¿¤¹'µž+NÞ!kx}Õ÷-mÍû÷ËŠåÈ©‹s‹–Ù·Nnm™äÌà^µ¹Roî B‹HÛEçÎJ ¥î£U;÷ËéÄBN5.ÏþäP Vò*~žî7w 1—Œ¼¡€†§+”÷þúɶ~¤pº:fã¡«„ÑÂ#N9@ ªÔ¬{XïeöÍÚý‡NX70–E†]ì¢íë&¬JIÑ ,*ýÒ¹€7hé€Þ­SÑ÷<ÖåÔ|‰<ó‘ÐHã«×ÌÔDÐ":rá’®ZÄ­Æpæç¤~2rüȆƒœQ¬dx[ÒdC3¨x”rANÎôìy…ãf›<Ý£*§rFý¤–MÄ(FXù®¾Bq¦‡:heI#U|y—C ^§®kyZEùôåtä⣭‡ 㶟Ùôõù»•—ÕÔü¨¯nUV²Å“gŽ6ôÏŒÛkW=V•0_œ1¢Ãšf1#'ŽMÍ«qÉ0®Ÿ;W³x4>‹¯ ¾ZH¸š'ŒÃSÎh*7Á9yçÕ÷kûä$E°.¯K›Oî˜Í†¬€#Qh2Yèo¥š6¶¶ÙÞ Û†E¯é¹ïe§ƒ”00‰,ûMiµ/ÕOÆ2”l=ÿL­A¡‰ãýk>CË·{3Pªè˜¿âêýW EËEUñèõ,첣΅ƒ¹þ†Çt/¦ˆ"ðu¹xTîDhù#±ú«rö(]g„UñÞú*²6 4ÁYW¯ošky „ê¡Éñ“úF¦Jj¦ o5´(}u«Š!¬ÄÃ(ªZOý\Œ¿¥k 'ÏËö˜öyÇ3V_½·¥uz‘g"”öÈŸ62Ô°F…£u]ݨwÛ­fåñœL`e¸œr‰ëÛ‘„˜hY@`’SˆÓ®ÛX%áWl³æ¡5ç´åÇmé/ÂŒdOÛ\·5ÔؼÇÓ¤í“vFÝ$/ÞáB~ªg²¹]•µþxbqõ'La7­·„¨X“HBÈY—¸ù“yçTö(ìÝ ç­ãä¹Á'»©ÊUõQ},ÕW„2ö‘隯«˜Ä±¶Ý¿*Fën½uKAÃ]rÐ9Ë™$2‘§³}…UGEÁg?Ù uüøÃÁâVlæU¥s·[ Ù1†!0ÀÊsÐ"ð»vQQîDHÙ#|ç½ï·èWµ£¢Îì YìùØžŠÍ;vŸð³ó 0U3…ž¹¶Í´(]¾ÃOL·ÙeI7ÐÐà‡ñÂCÍZv±âh@šÖ>f‚›Ç¡ȶÃNÃKß`»ZPаíÇ-°ÒS¶.|”w^Ó>M˜&¬Ûye E›O6ú¼*ÖÑ"o蘺ÇMGý[Ü×@ zhüª­®Ž‘ÃÍiv0û¼{ÖX¤£…W ˆ|4o‘á)ðµÈo.´8L~Š¯"ÌühMÜÃ>üìÔ(N4î‡å,~³ÐNýdõ\Bµäþ¸õ"†ør¢£AWÕr|Q·E(¿K½©½vë–€|ññÇÛu®ŽÔÞÖº Ö²ì›ú>+¨ýmÜ4ÁV^&­œ4kŽW¸ Ž´ÜwQ)‹ ŒÃÆÿ±JΠ&­åxY~Ù¤ìõxš©F÷Kj:¢¹à›_/ŠÞn9‹ÇJÞÍM&rËãüŽ9׈ûYxÔÌùcrñ•¤¹–‹rú¤ÞüŒ‰ÀÇáøäeÐRàjúd zx/ïM0ÿ|øèãÁTkkß  çÕS«lw~U Ï}u\zZÂ/è[çqæåéà :`û¾ß;†â:Ò(^’LC`%ý£KÇÄ#-ø_V)ŠFZD&X4*%¼fp¢ t`mx-yâMs°WGZ̾_4ÒrDÖª¹=ýûŒsέi™ 9§ÝŒ‘@K)âhÙnƒƒ–®#@gðúi¨p¢¤±¸ØXqÎíéÅð9;1ˆÌ¸~òÀnÓ+‰CÈ_¾Ìµ”/ždë)BÍÚï>_µnW5Œ=Cbß3ÜZЖ=ýÆ)à¯Íëþñé—?ºAž‹ =ÝðàûmW1Äß„2þ‰ýÆ6mÞ¹yÚ¶…ˆ^È6«œ…‘™‰3WŽnMo}F~´Ì5ŽƒÐ5«TG 1ºŽÉóÕíîE3÷z-*GŒ[ u›7oËž“6ÒìHS‰–žË¤(®Úé+EXÿÃßü´-¯›õ*´ÌëÁU_©tKfðYã+ñ˜ìíÐWÒÍ-`#bp$ÓPI|7ivzìñpuÒ./Âhþ‘Kâ‘ÍÀº‡sŽôxã†S}‹_{1ÚYýóf 3?ü" E rMwy¦ ç[d‡‡BR’7è%MãùŽ'æKt9¦^ܬúâ“õr†ÓXáh«/þdÿðe"ȱù‘EñH ñ…ú1³A<ÐCá[ïÛÞÌ "0>ØÒÚßrXÑ\¢Ö¤{53cÎÊŸ|ùãõ9+£ ù«7;¢F ‡-#€_FŠ.ÙÄ÷/êß¡à²_o8:dwÆPUËsf)´œ¸žó0‰ü~£S$j¾8‡,ï΋-tÖ;Q.j›ÃÎj^©?Þ Õ;a4¾ÂPÞ"hAÔùXG¶ÏûCÞy§t2IZ¿ýBgEâ|rM²þµ‘–ùºcyüDî˜ ‘uÈ>c`=ˆŸ…ÅÍ?ó˜_ß›<Ò‚üÇ{úQË&‰¼öæ!½ÃûoæŽb¸žw2 Ú#\¬Þ—œg†ðÔ~ãêœn™ëóS£2  aë6é ;Ô_Òîi¦ü«a‡•Ýy,¹¤¯¾6äfÆÄ%d·æÝóYµëÊ$a–Db¡¤ø`ˆ‡è«þn—mE]»ÁÎ %Óoë1þ„çW®óMi®«ìꊟÆýòÓÑôü"Ù-‡Q¤ÙñÊ¢¤ìF“ÃÇCGD‡?¿°qU:<·%óÎÇ}ëä6¬Ÿzáæt;¿¤õ‚¦Ìßqp$?c°qG³(¼ÔÅxn8âZ]3øÿÙ;븪²í¿7aNëXcëX˜H—„4Š(JIJ#©HHZ„(ˆRÒÝÝqéºôåv¸êè(vó;ç^@AtfÞ›ðýæ¬Ïú¸—³÷^kÇ÷ìX»ª–ʆÏʬ=Q‰$×Òyݦ[q^ÑøêT3)óÞ s•·ºAê¥f]<¤å™ÚÚ}¯5çÆÁ3U•µ²ÛÊiç´L¿[™¾n­lI%‘ŽÆ'ægæn^¼4¾ñIgaüóJñUÕ$Þèm¢vÈ¡÷=mCÞ&û-â;º‰Ïº’/­´m¨*ܴǬŸqûèêoÓ{ÂmÔÅŽFrWR›Ú¸ ×f&¤é›vz“q1úŸÚü]d%Š|…‰Wâê²c®mþQ¡ýòú>]×Ä°µ 0üq.ÁcÄ|§í …%ÎWYÀÄòП”î»Ðâ­§q: dqP R·Àq<é)B€¸˜Kó¿“,­¨ÒíF«ÏŸ+¨£ßp8&íÞ?ZFN[˜'Tlöè»[÷ Í…!ÑUiá~ë7˱¸×… ]MîE÷š‡È—ÙݵëW)’¸ƒ#F?¢W¨š…C¬Ÿ­.gçãNªî?O„ß?ÓÂlÍßÀgIcB¼œ„Ä~$·~SXUvT\wOKTû+JGãw+vrC Ï-àcM‹¸ÜÎ8?›E;ÎÒ‡ª{…CsúË“n&VÑ[bý×Éx×e-^¬Ü·ÀÑ …Æ ÚЖ­ê‰]UUýö¯t QúT¤t¤>jn ÖÁ³I-ø{U¹Hçœ|åìþ£,èÕMÝ=Go!Õ²AlPy¯øœŽªÊîÒsZGwplÍÍÓZüz¡<Ö™ž•S­)´Õ.ã.~&Â'™Y²o͆6Ò«˜Ð踬†0§C› Ó§OF¸Š»‡d&3ÐE3á«9z—˜Ae1èL$oy¨‹ýòÖÑgcú8ÐèT‰`xb,ð0P ïD1µ«™àrLÚ.±³‡Œ® Þ:{ȳûÚ¿ ÓÝé×i+·Ç&¥–¸i:&r?«ó=(mZ8×EøÜZnïåì÷ýk\#{§¼¬‚x™ñ“ýItòÐWÚ¨ BO;ä·YòSřVë^®¹ã­-'k’ýh!co;——š€ËŽ Ý´I¹Ÿ 'Ç÷íKê澌³Ù=R‘è˜Ø=@y1ZTVÇãjq4ˆÅáûQ:®d0ãzXþÀó·¡e`zr´ŽÖ…‹ögf% ÍÜÓ2Zr£ox߬©ÉÏÞþ£b3sf?•Ù¹WÊð‡ÛÞx‡™÷«³“—,ÜžY:DÇ?*ha€ø4Ë"‹̤‚˜˜œ˜˜‚fÊh{uK|lN|RÍ Øà—Õ©…}4Ô ä>JÒ­œ˜Ø"\×ÏÈ‹<®¨&.&')½™„¼²±9IèÍë <ëoíKD¿YÜñÖ®ª‚ôô4ÚXZ“›WAùçžgN˜+§ ’‰îrǵÆÅäW4ßE÷ó;'e¶±x±àW5©¼FÍžWå”ÆÆä•6€ø5® òVLNJN×IJ5ô¼4µ‚·ÿ—κvÞócâèÀÓ¬ÉärKiè±Z\MÛ›8óÄŽÁ”\ ¯ëÆãêyß̯¦!u£:¯qVq=ûï]û€Hĸ‰"TP€±Žª:¤¦•4ÞAòLè˜(i\5ï,¾²±¤vbN©º°‚÷i%Zi_âÐ_sгQãŒAjâ­Ü„TÜ ä¡§¹)8Ú¤%+sJãâ+‡x§‡à×u©yxîQ8Ú =9©Û…èqøuqR!ïù i}àÇ-ðyFiêM°¡¤±XA†_ôAââÝ̺{ÈÛz[M …ëz/%1&'6‹‰v>ðhgEMlLNkï\LÐÞ3•HoŞ´´ÇßÊMJo¡ã¿kÆ2åVnÌ­\×Ã7$ÓÖÞD~ÍMššZ¼Í$™TRMGº¯:´bç¤æv³ íiA2Ÿ^‚Þ¶†4Ãê<³Œ´Ä¼ø¤Z 8^™[ÛMCÞûªÓ Ûž½ZàÑ„[9ñ‰UÝTtJ“ÜMN¾•›PÙG~xª:§äVr£Ì>½ŽéÛÝaÀ«Û±Eý“oÐÔîNîé¡_ºpMµ’J'0c‘&PÚÜóè6>&¯¨%p<®ùèVR-‘>c–u´­°‚ÄáÚ‡–RvéÉÛ«›~)»@@¨®´ -ar²‹‰³Ö´æÊf<—ñÊóʸË­é}Œd—_Ë€¦<{;9675¯{¾r| ²ª±kx²n?-Í,¹_Š§¢y öÑ+%eãé“5ñr1×Ë ƒT‰;¯HhïÉI+|g/ßX{Aé ýu]kIãñSR,ÏbùM”ѾªÆƾ0ûIJzïŒ}k´z2:ÒÖuÜãõÕy¹ø‰ï°ï$Oš½µÆïcø‚‰~#£±zh+6'!µAÓÚ–úžçHWŸžÙÂgV$|îVLA]Ǭ¨0Ú”_Åä‚u€•ž‡ä¿ºí.ôp¹å¸YBÆd×Z6Äú¸ SL1ÅôãQZÄ/19eÞºkË ôO6Ýÿ]ÿÕ_Sc o•ÑüÓ–èýl¬b`ú¿§…Iÿù§»¿`Š)¦˜bŠ)¦˜þ-ŠA ¦˜bŠ)¦˜búÿ Z°å!L1Åô¢ùÙVá•ð›SBE·"³˜¿ÿQ#W.§þíGò‡²h§ -NyÆ¿9%A,ÝkØ¿»c] >ÕÃX]Âôÿ_ÿÛð«[gME%E„Uªš~ÊàþÉ#šË¿YÏ‹ˆ›à")&%$¬p>϶»ï´êv¹“7'";uÔ.ÿáZ×Ô_¢(.#.¶oË¢ÁÅ,\ ÃwkÅÄdÌ®7ß>wL]HDRpŸ~NÛ˜õØVWkå·ë¢ºGþ¹µ¼ï¥s€kƒÜ¶§0ûÉÙ£*Â’ê&× x¼1!HRTFRB9°ž±âOÃ÷( ŠKIȨ›^aB#)ŠßmÞ)!.&ïW÷|F• R¢{EœÂšað¡Ïq 49)ݬ–'ô¶41ÔYë/Ox9£Ì¶Ü´Ì„{ä™Ñ?¤**±OBFÕð"ãïÆ©Õ Š¢»Wr#âÞ†ž\²Ô•—·À ¼ì,Ï“5öÌ}g×ßØeÇ[~XÉ;ò ’èNÚJB"Rzþå0üºð²b:1Å+ù3÷§1Úk5$$Ä„eÎçÌÜ<ØX¿_RJHPB×%„^^·1‘S‹¨zøñlϸxDFLDlþWëDÅd <›r´—†dMÆ¢žzšèˆ‰ÈìSÐiì{6ÃÎqnÛW8“ñßNO_µp[æÀ¯ß0PsÃìÖT|q ®<¯êö¯%£2×-ÛófûÇhZRó÷ÔOÜ1gÞnA)Y Ë’îï:.ûÒ‰˜ÁßÝAÁ4ªè_;¤’~=Ô.y1Ã7£Þ Šì~ÃFî+öÇÓ)oª÷@qRÛ»‘ß>¨aŽWíÞ'.¡x!±÷Ý‚³o2 ÃFm Zþ~haÑÕ÷ðX¼ñQçœ_‹Ó2Nnª›ËwqæË <Þ›ï}ñ‚©Zà1óCvÆzj´L´Y&¤²|m qè,¶“J}úvh‹†K¦òæñKµ”þÑÐ2µñ¢±¢E>¹³”ïD6Ä Ò/¦Þ+œÐõš=0øÝKÂô“µ ;üi0ñkU¦Àšï¿ZÊ_Ô5›»`á> 4’ïuüë… ×ìÕ«ú•PEÅ)«T¢wM`ÿtæÅ/W5[·dñQ÷\ôò²È÷BBÂKW &w¢­õmha5g,˜?ÿ_ÛBxï펑ôöù —™žÇÁàéí æ«dq‹ T˜ó9’±/ì ¢Ã¿Ütš7gî­ŠÛܨªÃ>ZB_ÌûÖЧ„Ü_/#§øõw®5ÍD²0Çc•ÏoÃäøÕÛX#5MýåÊí‡* ¯ÜÅEóç~úÙœßm¨ê{ÚŸÇ·rѯÖ_+906”cÐòÏ´Œ^óܶGd‹Àñòîg„–osÕ»E£jîÏ|ÍooR ¨ðçBËX{˜þ¥Ô¡óSЂϋ[}(‡ ã³²œÏ…9ëÉÉؾ Àë}TÑ=ë6-o«—¶‚göíž‚s‡B+mÌ|oøèžmxé$½÷Lµ§,eþgÛ§‡²a“X†"Ûöìá×qNáÑŠsÎçü¯’99{l[v[’¼YÔÔÜyý.é p^VU0ü!h¨©ÄŽÝ{øÙÅýíçy§ …CîÚ«>À|z„OÅ1ib‚_,¯á:k ý)h 0QÞ&ezÙOPÅ› Ž5§_ݳGh›ÀÁÌÖ1q=|*mû÷»«I3#âöÆïÙÉwüÌ›‰Ì‹¶ša øZ8ÀMQ~™ƒvÑElþ¥ñ¦—¬c z(¥æÍ‹zú_B ‡uO~µP®PUà -›®0{;¿_th€«ìUÆ3FzÍì®Ô¿;ÓÒyU×tZ^*‰i—âÒÉ÷©¬×lòý¡Ç G@Ò~xw¦å•–ª%ZF½¼2„¦ºoV2ïÞ§¿nØïv³oVhº«×¬”!²FûbП¸ GWÀÓgZÆ)½•þ¢#ñŒ’Eî‡ËžpʯþgµòC#´,Ž§/Ïèig=¿,ò •ÞQµáGc 0>c¦…ÙÓ½ˆ?” -#™Ö¢2é´Gý?sàÑþþû úã[¹RÂówgZ*·Åq¡¥5/j§S-…rßNK©Œ†@Ëj[$R}á·‚a3æ & …ó‹Ñ~±ˆöW´^6…öŸuYX;!“·gZX¤{ÄÇ´AÆv'€ å´ü¥ÐÓ)Ú’òµœl¿ãºîži¡ï”'F¬”¢N¿É%ú´š‚‰‡¾ì{Õâ˺W~¹ÖÔÖS–“Ú©P*¾iôŠõ¡ëo¿Œ¼Þu¨…Fgͽ`cz.jôÄ µÉyk3ïBÄ&}%‚qIq•±çŽú´Ž0»;=O¹:8ù®úJ¤•> Zê’CöÚuuõTÕ‹'ÃË+S¿ßæúîò ©½IFJ¿Ž»À^:ŸÍštÁˆãaÄžÙ]0--ÙüÖ9$uµ‚¡ÑZq¤&-Áê¤óe?ãcgÒ¸³ë4mUƒœæÙ÷§ å¼‰²^"ý°è¾Œ.¶ÿö¬ZVñ5g9ƒÈÿb,)ìŸÚ|=¡yÛâ½µä™!aÆϸmåCmÜ8~u‰¡ZFA¬ìUô}ЮÊ/=¥±+¤ˆÚäEŽSªü̓ë&ÐÿZ¨­ß-—¶9å´‹o?D …/°è>‡ÁÞñÙêf"¨­f yÃÇrËü´Àw%U}X“Ï,‹8/ÐÒÑÑsåúÃ]ì÷B Rɵw §õ¼†i¬îj!ÿd¨¢ pƉ ‡C[g…vWùªU d*SOóˆ…­§¹ê!EÌiÐ<ô×S50?c¯//}<êCe‡žÚJo69å¡üãÏDFg^†ÓC0ŠÞõ/‹,¹U3 S‰üKöö1ÆÞ -ðsáå5=Ï&—ˆêŽ[Ùy‘Ý•Þ÷!h©ˆ9m–ŸûŽ7ä7„—=`wÕ~ý£;ý=Т/+Ýñ ÄP阉«ý õ ðth) =§¨eåxêÌÒ5G»±³Ø´üµÐÅv«¨Ï:RœM#¦µ_xŒA{b¬ s£e€ÆzºÀ!â0¾²xÞ’cè Ýð˪”|^p9ÚÔÞÆhHv–=æ?D{ÞÙÆ@~uÖ‘õ.fÐ8DÂ+ŠkñæUˆ·‰Ãƒ]Ý»D,€‘ê¸ËBº1ä'L&z‹%“öÄF}ÿµ¦aú§—ƒGªb/ éÇòlBëiØ¢qu€x猆Xs ÜzØ“°B6ípàWÕ)y=ܘŠùWO)^#Ò¨l5eot¾èjH¤áŠ›k"Ùܯ$¥ŒÂí£¨ø.-1©š¾4Ús©O¹"r<¢Ÿ›·>àäÔœÁ7Áå’rɼèR ëy{‚±qX#“õº"ú´\p/úÐõèþkkøŠÜ”·u“&ü†Ç)„;ä¡»Á‡ø¡ÑžÁÀ£ö˜J}T¦w*¾ñ¯Hž–\’T‡v>ð‚PàªéÏ`¼üW<“Ü o´ =ÃEóMÏÂT6[\nj­ûúÛƒýtXi‡,nðqÓõ£Ö!(#’µYWHLŸi?\Òõ€Nù™ÊqÓÑŠh{Á&Q6o8„B ½åkáfÊëÉyÂ73-žŠ{½Ò„¦Ú¯W 2ïªê½Zæ,-ê¼_xåì6Í8f{ÌQçdxzãð´ä›_h| Aã0±[x£™5Vh&uŒ -ð‹‚ÔÊ;Ws½e²2¦HÁ›³ý´lc;òâç†ÈíµdЙ–³Q½uù«6¢3-·ƒ*"‡¬W0·|{¦%ËFô|úöx°ÿg:.È8¤f?<§²-×õ®w¼˜\vk¦%?r§S :ÓrH±”:rC~cxùû EǦðÞ@G§”¸^7‘¼û[nÚ(îÆ™íò\hiS;v„ÆŽÚAC#¦ý%£¯oÍÚ#´`Ðòw,¹~9wÞÒ­ê¥Ýϧ¿6ÞÙ½jѧŸ|òùœE>MÏ/™i~»`î7+Ó:Ÿ¢0xßxÍ·)­o¢§2kΫMnÄEß^'—‡ªL¬ËxLòµþjÎÜ9ßñ%×Üæ0È»>ù÷çsæÎ;o¿á-û‘ئeHrŸÍùÖ½ñå?´V0H;'m¢`¼!ÆÚüjÎ7G=J9œqBÎ¥_Î]¶óp…{øÀ|Í—·êïrO0u…ÖÍŸû¥¦S  ;Èn_0wî!#<òr4ÖüXË}ý¿j§óïO>Cž?w‘J;…¾g29É£7oÃã¶ÒfÚ¦òSêþƒX0om%ÊUnÎçŸ~úù9‹€ žÿqþÜ/TloAëˆÌ¨¾øÕœÏÿýïOæÎÝÞ@y}ÅLjî¼/Ô\Š˜àxáõ3ÿú7·¤ß×1Ð/ß4W³™Ø=uRmûçŸ"•m¾Ñ͘Á±“Û6wî‚S‘«·¦_^úåÂEë¤Óxwð±é«¥ZÙ¼™I¦®àº/mÏíxÄuÁ°õšyå(µäß\õõÜ9ó—˜_¨äê˾ýô3IJó¾ßêB‡>^hùìsÔû_.ßÜE Þ„a“´m/Q\jà'_hôq·îÔ„š7çÓO>ý|—¢ã–î%åÍÜ­¡-IWWë”_Uá–X¸xctû À9¼OtßÚ/–ð›óö´@Ìûw.Ÿ·V—À¶Y¿`ÞçŸ~öù¼u»Ž#nªÊä_ýÝ‹¶ã‡J“·,[´Žÿøº­ÇhAÚKŽ£Ò—óæëx´ µ”.ýbÁ§Ÿ~6oþ’óm¯Á¡…­+¾ú~{JÇøahùlÎœù"Ú¾$ _Ø(íù~5¿µ(Z†škV-œ?o«3|sNgñ’´uöËò `Šl7 \íy#U‡î6û; ûLëóâ×è8¯øzþá³9Ü=-K$„÷~¹lgRw<šâqdî¼…Ñ%PÎy‡ùóæýë“ÏçÏÿ1½¤Ý5Ú·mî¼ÅÆþõaÚ¸tƒ¸¾ ZðE)KçÏ›¿;ÎÕW,˜ûÙ¿çÌ¿ÿäu˜õðÜÁ½ ç~¥®˜»§åТùéœyßo–ËÀÝãÀ#ÕFK—¬P;¤¸‡ -ð¡µÌ¦y߬¯ì}Ú_»iéâM‚:+7ébЂA väSL1ý?£®²#¤l2À>ÈÑÑ´ÿÇ Åª ÖuJÿÕ“by‰[ÎÑ&`´,‹Ç=ƪ¦´`Š)¦˜~¬Ð2ZzÙ¿°crç?4’ý3Ê>ÔÜv:ã§Ihyï}º¦÷V%0ý-÷îý<2ò ¦˜bŠ)¦˜bŠéߢý½ØL ¦˜bŠ)¦˜bŠ-ýFo+Î2Ð3wºPL›¾ïf?½yñ‚‘žKiô6<Öœžh~⤩Íå.úlG\á±¢`ÿHÜä"õÏÖŽÅC£¡Ñ\Ï\UËŒ¦;½yܟͽRzos^g»ñ>²Êîy ÒïÚ£¿ZžãÀÿÔÓCœñžŠl›'ƒÒz¸Gc^Æ_ôÕ×· Ï$Þ†ÇÛ r­M,Ll.ã©3ì@ô»Ažç õÜZ¨c¼ƒ >z†§bêÐý¢•É±'ôNžòÉ¢²gžÒeiN&V¶îÉäwN=´çfYŸ4²ðkzqzšrIOï¤[p%üxVÆ[y6± ÄÓ¹AÉ‘úvÒùr%BC:_=㬯ïZ ¼û¿åI1¨Mü²iì±¾Â\^µôHìšiXæÝ ®.ˆ%¯g‘8ð/íÅ…6¦–FÖ:ȯ`ÊÍDÝ6Iè˜áGfG­«•½k@ï/ÕiñHr¶^édÖØßh±(‡‰ #zæj?M ¾ ¯gåÑA¼N¢·p¹A ÿñ'˜43Côù¶>q“½ÄðU{ÛÌÁQ˜„·œÌUT>‘·~TpÉýB\ËmÎh•×DËq÷›OX·ì±*{É)5,²™9éV2ÅÅ!æ÷‡Çÿ¥:é’˜UhC÷#îªÖ‹ÇÈÜ!žÇiíMŽ'­M,zØãažçËG`Ö°·¥SmÏ3R{ßYSYï<ê,û¢ICg­íN˜¸Ä”ßÿ½‘“[sÓm\¢AhœÝ×íåàbn}…ŽÃT’í¤1c[nC¯ËožÐ³-bpÀgþÖ¼ŒÌ®# ™ÜÞédn¡gæÝIz}©OŽ<¡oîÙ4±zütÎÒ¹‚4v¾à줧o˜ÐƒP‚_åG„ ½Á…L <ËiŠ­±ëÝ ¿¶>t?k\èuuÜ Ó¶ñÄÉ/àË‹M-у_ç3†¾D´ûz~fbÔÈë}ͦ€¾Žz†ŽQùT¤7hNO27:ibs©“†öý 8¤7p¹\…ôd|ÿiK+½®Y50÷˜d“¹‰U@ÝÐÈmèQˆ›«ž¾od;{úÁպ̴Ðú‰EÌ‚è« è~þפ_ë©}Cg¬ä\&:àžÿ)sû«tßòxIÜ =+ëíïÔÀѲKgšžýîö…xù&×Ë…Œ=dCXÀT“׳O£3ïß8箯wÒ7²™ÖÝcâ¸-ñŒ?œÖ5uZŸ40õªë{‚äùãu`ÿvñš.NàqQç(âôîúÑõ9j"â¼0þ9•E•i!ß©d¾z‚Ù×~ô°”âäé¡L_û;ÑÓCÀãŽVZksŸíže…mpÎRve­­´^âÓÛœ—¤ÖçVÛZÖ›HãS jl¥uàïü“¡¥«8=!POÛ =ä2„KÚuôJks—®ŒÔ0ž“’O :³T5e† 2tùj¶à|B˜#¥nû9ÇÕÕö”¶>æ°hâ¢Gë:XU–^+bM¯ÒÏCnöKéµP?äÓ>³K,ª+(ïÏ‹º¼\1šÉ‚ƒ|bªëû-Å6¸Æ?hK ŽN)À§º.UKeÃæò±dW¹ýRèå‘çvZåv46()ž ÎèdXT1QÄ&çU–…—°CÝE¬K'«å´o²‰=!7˪Š‹å¶îêfŽ¦^‹KÊïʼæ¹BùxÞ…Ô튿Ú.¯$Æ ?Rëó£‚]„ä¹ÉÑ¥EÖt°ƒÕ_΢þ*ðŒæúÖ5»p­´žÁ'ÍWu”ŒC⯰»R¦Míäpk©ÃÁ-øÕ”Ö–U¢›Zi]=×…”]öm¹ >íD-9tVlÅõ"4È!­³ñðaIµSñÈqKb~XzÒK™3xo¬©®@y´ì6KNOÌÍ.#sà±âŒâCR¢.aYÑ4Ü ò]¹T"<2«ÿˆÖKK.êL¼•[ÙríÙ²ócãJZɳ¼U'<š–BbláS—5‡Ñ3YwŶˆ…fà«ó+ècº"B‘M÷nºèêàE_ħÙøåSß9°ÿÄfÇrϘ֦ªÆkI,ä9änRbLVRN/,|^]›Ü˜žÕöî4˜F³Ó‘Þ¸í2Î2ÚÃC.¯^.Odߟwµ!Ƥ^Ð8G'6V~ÃgQYY­ ©1Žöw1ÛZiÙWý~4®¡ÇƪJ)íõe¸AêëÞ¢„"–¥µC¥µ  y1’xÚdófèžÑÛàý¬¬¦úÊz-¾ µÏ[b=E4 ½¥×=WK‡Àƒœ \}u³î–ﲚ¼±šp‰s„–œÂFü=/¥6ÖëŒä¼èÄf^÷ÛW‰Ë)h‰Éo%Î<îŠÇÕ…&6Wå¦ &B¯ÓMvš”¦^8µÍ¨œ=T/.cÒÐNq_œXûÓ ®»©º:·õár ¶tÇÇdg—’`x¼¿¦9»°56:¯yp&Õ›ª¾åzYõòô·'ÔÖ:d-¸±¸žÜÞu/;ÐEÔ:µ­•×Ì"íúfke„/Û˯N¶Žò¦¼²¾Òäëkö_¡Ãc³@Ë‹(´<F …óWÆié)5„á±¾8cEóÈw¿ðVp¹q&m¸àºçF“ºûü9ìŸDùks|¸GžÇ!2^ß+ï툸Œ¶ª%kORÀq\°ë¼ù_Îûnk|ÌA Eháüù ¶«xô1h¡n\üåü¯V˜]j€ÿ¹ÐÂ%À 7.´ôä¸éFà9ðë«&‚×z'ª ©©v‘øMÆ;ÜÈF”wŠ#ÐÂaÝ“^ü£šœð²R)Ï9ЃCŠú5Ý€—ôÊtÜýéýQ`éV<á¥>FHæÝ£¬ã,úpubàý\`2tOŽ…„ýµþÍbÄƪoÅ£è„ZqYS6í1¥ÈYÛ55ý¼‰uÙôú¤‚Pòàôñz ©hPÛ xJ¯Îhø¹ñš·Zn‰)g¬9Г³r{:£¥£e¹ÄUž æþGÚ™³ÔX 5I\ -ÐÃ#JǪ»!_ée Õw?’#ÏàgÕoæf¶N톽+#ëÈ€ÇIQE´,ùê«y_¯vkçpÆaê ±íÕ$Ÿ#(´ðÌE ý°êX{©À’bM¹î¹Ð'µ`þü…$,ºècÓs5ãi²dÙÆÓ7ZÉô—3: jgó¢E;c²ÊUøň\O¹ëÉ£N| ö5lÛpœG-)×ç-Öè%C÷ëö£ n;N^(o.«Šmzñahé¯Í–î;¦fÔÂ'·¦ì±+žÁu…³«š 0;´¯úþz1›Á|…Æð‡jîSN, >¾98Þ°NÆ»6#hñbåÚê¼ òtñve ÕÕOOçã;Æ›û›6®àBËÄ<ù‘ÝÚ­Œñªxåx˜N{qÞ\5¢w”7‹uÅR-‹4Êd•E×-Û$íÔC‰r·:lgþý¢öaˆ1ixÜñ‹õNG”PhA<ììÔàÛŠ Ðg´45 ´¿Y´î|6mF "øÌu÷Ú[±ª'Ð!£)z—˜a9nà¼c|m}P»®©aõ£.úk_ÍS%2Š™ˆžÔé³K¯I=ÚÚðBjÉÚ¥%‚ˆËçL@‹·:jì:à30 ±葽œx41HFœÛh\ U‹Ë[p{·ÌÉoþ|Hú¡ýM¾ =E×<…,kÁÀ ~àðÆ¥%ÓNr FoVO9¼q™ùå[e5&—+ô5Lx`l$-ipcW¼\%¥'Ó{ª8«”= ‰ä“>4À¼/ýíÒ¬öarGÝ‹n(›‡ÁðhÛ%A›¨Ž@ ļÍ/x4§ª×IS8¿ÿy†•ª°v©½v­rLoÞ¥©ä~s(G¼!^¾0ååiúÂsßö>&ú÷$Kyß6*í97¤Ï«h•eYš®»IZ7t^–˜zæǘ3Îf 7å\ß®“Àžuyè-hAö_·<= 6SÙ¾[XA]QÉäꇡ¥<+ÃAÿàó½3 ¥0üœkî:7N ̸­µs_ÝÀ‹óoAKÖåSǓш£u˜@&à»w Y ã´þÛÊp†›Žª]2¸Ht+YþF&-yÜù–ü®;wŠKJK{5¿æÏ-å% ºžp8ï…˜ïþb^h£¯*cåFC 롾²ºç¥›»¶ä6O«H¿}˜¡¬P ˆ¤Å»ÐR›—}ÆL[ÅÇó8_%v0 Ÿ1öQ™ fòR…ÝOÁî\ Ó`-‘¼TO »8b nÇêM»vHòïïšþ>>ÔUÒðBl²{k^Ë€öˆ[-{ø…Mûf›¾Î¾ätÀ¥„¹ 1¯í~‘¬¶až Hµj¾µðl{-à°±ÚK‘š;6¤ÕßûX …y[`ÞE}¯§ ElÕ²Ý{6¬Ø”ˆûãÉ ^ û(ÒR-Œç–Š9ORß‚–Æ´õ0"bɬ`w÷‚;Œªs\h§÷ÃdòpQˆËN­„w‚³(÷j r÷lÙr­üÁ hÙn”rƮ٪Õ0Z¶¹"éú™èµ¼ì‹3Ù)zØ7¬|Ö£Þ‚–±\OÕÔö‡±G3"TJù7Þ~-›„¥”¶ÊûMÝá5+´ ùgôS®ùû«í“Ôòíd6__±dÍž=»·¯W>_uÅVÏ­ú‡3ª$u¬ñŠB&s•ByJoŽµ¬av¿ZhMQj^å04ØÆ0£_å·õaÿæWÜ•‘yÉãȨ ¶Ç­Û«ßM|TEÙözóU{5×z ùþA)ÅÂnúA~¥vÒ+çIhaá;ƒý}„vÊ÷P_Û(óì¢ 2vü¨ÜH›ÖC”5|N:KOñ¦ëîv£MȲë~X¾:¾5 ›þ˜uœÃ¾ÖÈðb&sòí†ëplæL ðààÒ/3Úž}M–ïhMØoŽ. d‡£¡´ à‰üf±•W¯ë ½&‹¨]à-ªRÉßÞ ’Y+—«v±~ÀUÉI6>ÿ¨lÅaßs32¼”Ú„Cë–•<rÆûcõ ½‹¹6yEg<6UV«¢óúI:mÑ`WÂ~óè˜ #“ˆ©u±—ü[™Ü¡:Ìdð&—*oøèÚFònCà°ö2=á—NŸ¸N|r^î‡ôÆ©ù«Q ù)ü´€øTYƒ äz©APÝÇ\zrjË‚èò»SвOòdGÿO³Þ•ùÇé볇$KÉOÝœ^BAhƒ°¶R®;-·£Ž€NnäEú¡ý‰†àú]ò·&ì ®o÷›~ÑÕ8.?ÏÚÈD[çdPLiúf¡É=-ãá§Ôª'¡%‡ò6´›‚–5&-È“=ôònénê¾`}Ḻz?´p˜ÎÆz†6'´du£éÝ5›5nLÝæ£+,Õú ÈPÊ+€?-“U¥¯yÝù–D5³ð©úæ`h_ü˜Ãyµ_ôHcG·¡…WÍœ®Ê¯ &:qTíÛo7y ]Å hž^–[Ê[zhÌð‚9£Ç2I觅¾¦êgÐ"$Õ]‘2Ò‹í .U&ž;©sy”©¢Ü-܉1ÚïÙ°ZÙ6drá`<÷¬dXÃ=¿£ò98ìÇ’DJ§ßâÑ]ž¸KÉùGi1Ùòh¾¹°ó©ë^[ªÈ%ouè¡d„œ5˜,ÑõòÔ; ›ÌÍ3³ö&ZºcZ_Ì_é’JåLƒ–ÉÑ3ÆFÁ8éôJ®ž1pN|û%v߯ÔzI]²ÒHoÐ}ÌدŒ>Oó6³¸PÅF: ´gîÒÊÁ §fýJ%òé7\÷Ë™¶öÍaÐd¯R #œÔ= pÐ÷öLh‘?v$ÑVl¶ë¬+˜ru@. ¾Èñ73÷+aA¿p€GÇV/JnzBo.Y²†÷¥SU¹íõO'~Zè¸à#j¦êC†•¦Rb¼q‡u®l*9KŸ4\fˆ€ñ²ç¤—ß-SmÇDQ!¹ P…uoêiŸ$@ãC9¦<â7±[ f>ض^¹•ùQAËhþµ€óþ—öìLk{6ýÍèÙ­ëqRÛ·œðŠ­%½ôs8ëîsÍöøÁÝF…¬ß—P,¦îÏûcÒÕW¯«ÎÊò§²A:ÃFÏáü…Pá€üŸ(íöN—=,w‹ëÿà塆Š‹öJj–·ÒÛ!ÆCO@7kC%{¿j )¨z*(0:(¬m¤oEÄ…÷Ãonûa½•OB3u¤9ð¨šá9 =I‹IWQòŒÖÙ»>ªD+^IÊœÕNd´™z4¬ˆÁ`¨ŠÉ{Æß»:|ÆN¹¿Z8ãtÜ ±ýÃNÙ\eèòóOK·§&Ãþtˆ»­±€‚ÝÔ‹ÛÔL ¹6}Ó‹·y‰Éiá°îZµö Uß'nŸOŸ` ,ëxôÁ¸o %ò´ÙQ¯ÌŒÝ2A£©mÝ}#¡¼³ï)-_ü°ïb`Œ’5­=ïr>4õ¬ñ±£!4Îû¡…\“²^ÀÝÄÈ ©Š€g'÷‹ê:ûñ-¦ {Z¢Ú_1úû7,“¬äE¬ZÀ'Ž Üü#ÝÌŽóŠb‚ÏNª(ÚûÝ ôt‹¯dôäÆì3 8½ôµŽÙÏø‰™ph0äœë¢¯·ø^Ê@j#½³á»Åê¼ÕVßßzIïsÒªlnd˜ã²Š9w>¾ÀÏÃSh«X#áEof°ˆ´qh€ÇPê´Í6£iÎ2·¸cnQ˜§L0è)••Ñº–äd{]B÷´ŒŸV0¿P=mrvܵPËò<Ò²¢’zxo†ñfZ@õŠï¹/?ýÁãbZÏÕZß 5¤öÝ#µ–~÷ƒ¬7Ú<ÓØ#þŽgݽ¯ÚêÚ}¢€œP1óº!Ï·;©~—zeî*€ËÑA¡yDöÓ‹Ê;tO…z˜Õ‰eô–ÙØøøŸó^ÏWØöpúJÄc§m_‡7ütYWQÞ²b=,ίUPMÈnÂÓÇÞ†–!pÆéÈO–©ù_Šº’CÆ:¯+뺟Ò=t,œ sFn^¼è}ÆeÍéæ™÷ƒ¿¾©¼ÄêÌUÄ×¢K!öeQ…³—â|\Ý Ÿ¿ -Ó7® ^ܾA õ²Š{–æðZ b®›¹„„øûK˜t³ z~`×YÓYY"üO{]=sR—ÿHÔÔv37â>{ŠüúÓ¿vyˆ3/™Œçl`tæê$<Îb¾@>b2^ W±_¡?3'׎áq€ùz‹.èØoæd@ö+Þ§0ð yøD‡ ¼žx4Ž<`¡Ïg³GÐ×dx”ÅK û'_wƒ\;3ž³Xè}LlÄLÔ&¨ÁY/y1¹+à.à¾qà1ï#êäWî?¾äºqñ«©r=5ʽìib› âeîGÀF]ÌsÖ+×YÜóSÏ£ ´Ì´ ùdMÔ(¤h“ùçU?ö«ÉÌO³ÉTµœø&<²¸6çnGdNFÿ>-9¤Î³X#oª+šâ« ÃB¯'¿ù’›Ä4üsSH»fLÇã )Ñ 6{­lHöþ¼t¡7 ü A¯@^/Ž°ØÓº Ä€02ÕK¼©¢¿µ˜chŸÆu4<á´n0yþB<‚ü9’™–”ˆ=¾äÉŠ=Ž4@´ 1_ͺ³îÍLËT†¹•É'ú|n£ƒ¹á6C´…ò¦)f‡nŘjež¦~å•ùJUNVhAûL´¾¡I¿]KÑ>U-'J:ivÔ˯¦,ÉKŽW-åV†çÀ[âuãHBh‚Ö“Þ7¹NAŠ6c¥m <»MÚ‡7pLT0äi¼®žÍáL·{²{™jPœ‰ÖÄ-ΛÒÌ·FéŸ1H½ÝÀàd{d¼ä™ˆç,®ÇÞ.ÝÌñ‘Å}2€tc“ƒÔ›1ǹùœY9§'ÇëW_Lv˜e¤C“›°·ß€×ÜÚˆæI¹ÉÏÒfxùQäVÑ ›p €£œ‰¾îå¬]:ÄMPÞÚ ;Zž>}òhøá½»w°8-˜bŠ)¦¶¤Üà÷§ÿFZ£ôQ⠺ߡTZ=>¾°•ðô?ËáýØ?˜~TqZž<á-=žX¢S§A þŒü†)¦˜bŠ)¦˜bú·h~Z ˜„–‡÷Ñõ!h°¿÷mhyðàç_0ÁL0ÁLþ&ìG¡å®*+~úø1 -†¾÷ ¸šJ Z0ÁL0Á“ ZîÞ¾«©†!á:…ÜX_ƒüƒL0ÁL0Áäcƒ–G?|ÀbÐèT ›Éxüèуû÷0hÁL0ÁL>BhyñüùÛŠA &˜`‚ &˜`òqBËógÏ?zÄSäg Z0ÁL0Á“Zž>yÒÞÞ^\\ÜßßÿìéS Z0ÁL0Á“Zîß»÷âùó'„gÏž!?ßÿé.-˜`‚ &˜`‚ÉG-?ݽMèÎež"?,&-˜`‚ &˜`‚ÉG-Ãtw¶Ã 8-b¡gˆÞ@Kow'a SL1ÅSL1ÅôoѶ–H}ôðJèí&ô÷’‡ax4üðmhÁSL1ýCé[ýéîí§OŸ€lÖãÇ0›`Š)¦ˆbЂ)¦˜þ±:üð-l&ýåË—}ݺ`6ÁSL1hÁSL1hÁSLÿЂ-¥aŠ)¦˜bŠ)¦­þêé¡»wï˜`‚ &˜`‚ &« ”ò1C À Ð˜àïø¢ lúHÌ ,‰ý%ÙaÓ©æGSòßi':•  Y‡(TaíL0Á“ß-OŸ>Z¨íÅ;&dï%ýã’ÿùÒ®Y?<£­‘ÜÎàk4oSµ{DÜs‘1m 6UMb÷Q5ÜsÚ?€TÏÝ‹ªzïK-%èT>õ¯3/­«LÍ"õߌ»:â”àž‡œÃôWª«žü~ñ€â¡O-ô6Ò¾Þù¾¤˜Í!nA)"v°HGOt±þÃJpZOµúÏEïxÖ€5LL0ÁL~ ´èèèdggŽŽÎ€rcú'Ë ›ð===½Ttf\ ‹¹ìnïä9HcfÞ°±¶ó‹ÈcPfl Ÿ›SBæMÏk6Ä"wœ9åèØFže0*Žò>|\Â!«u¶¹¼Üqo„Ü6bæ~ñímõÝ4ÔUSM.kloª!љвókOw7‡³Z) »7=¶¤ù3±³äJIob¨¯‚ðææÖÖÞéL¦ô6x8X;{_ë¦È*Ž¹hom}!*ëÝŒtUg8ZÛx…fR¨¯6Ïëf¢«½md~Ãô¤qžgxeÙTŸˆÁ®|kkkû %l.IÐûZÜ"Š/¹;9 @@cV„£Mp|ñ‡Ô]rc¼KmKGS™‰†[CÒÚÛ[šzéïBË>û kk›ŒúÚîïuñÌê Ž ·&YÝ.¢`íèM! ÇyÚ9œ.éF®·±ÀÉÚ±Xå]¹Q—llN…¦Ô#y~ÛËEI^¡áŽööéµxŽ?kiºìëUú–ÖÁ‰Msðr|CÙÁmT„EX‰Wƒ³#|m¬kºé$|­û)kßð^:ô´`÷Snçk*q¡n‹²VwÎÄ&&˜`‚ &¿Zôôô¬¬¬ÌÌÌ@œ -ß«'¤gfæ”ÑвÈÚ5ç3š†ðõd-#1¥­£Ù[áû¸Ê>çã²!I 7Û¸iÉ]¬î÷QÞ’U[|ÓAFçÂŒÔÝfænµQÚŽ³A »5à¨O"w²¨¸jƒŠºâ^AIï¬Nv_œ¸˜¢„à^q­º>Ú hqßò™I`FÆ%AíÝ.®íIÁ 7ÙØæ!äóW­d2oƒà $PÕž¨Ô1šÞ]õÝFÝúÎÎÂâ¢wòÑ«%)‘Q×xVnÅ…ôf\¬×â=C”NEƒ!pÚ”HÊ¡•Qý½tBËfÅ‹4&7¤|!ÄäâÅ.sÞ7ÛÓp½m­CùÛlª›œtäsˆZÿJ»lºßX_T`ï1§P£GhÁRU¹½BÒÝ3–‚ ½ ÖŠw¶íÐé “ÎÈln$0rÜO„ ¦®u3<1ñLG•c·ZªRÖlÒëa2Ok '7àqù‰-ÄÐrl¥œnhm¼–È™™\/û("^î-¾xr½¤#ƒÙ+#£ßÅ„ &A`í¾î¼›Ú,fÀPª»tÞ†iFÛ¿·º^AîkÀ÷vY+‰&Wwd]8jàžÐY¶BÑ«ºðúæEå“5f¤nu@#«]ÿh¡ž0A_º!æ øÒ¯Â+ÌîüE_It7o”2f‚1MÃ<4g´xìú¦Oˆ%b{”@4’”HlmRݺ—ÀÞ†6>añ¿þÍËØ [6¥kï7 DT Sªzgd艑?â Á½ÚIß7{Nà\ƒú‡š§­†@äÜã^7ãU7ï.Â%«‡V ¶™-‹ÔâyKEMñÇ?ûä®Áæ|h½*ÁGc7’ÚÜßѺõóOÓIô¶ÄuëPh:´j†´Bl,!ÙÎÄ¥:[dtúS ¨¡Í€–ƒü+?á–üßÿú¦°yÝNz1Ÿ¬×ÍÒ™ËXëæ¾ï û¦Œ{Ù‚çåûg6_´T iCþÃJAúf;ëÃÐb&¯Dá>œÕ½hÒìÛžÎÑq¯%!¼ç ­Èƒ\¼OâÖ01ÁL0ù-ÐbddÔÓÓ366öîòЧ«,ÉofÈûºòöŽ]á&Þ46P綖Óæzu­¥«53í¸¤ /çë¦Î¾K!9úÊÅ‹ï‘3;Ó:4s?€=臞Õxó’¨z »¿tù—ÝEûÔ-‘'RòõŒ‚2gδìø"¯…ÄÂ' !¨õ†¾‚œš€I o„G %ÈýâP±Ä%à­MŸ “Ü\W ½_4cè&åȪ[€04”ªm˜‹õòiBÆ@óàth!JÁ‘ã2zÇTí_¯ê†gBKÖŠ£iÜ‘îÈs?xµêmF`Ó)Ò,{P‹®Ÿ éBþì¤-ÕÑxñçÙm4&>}ÃZE2{´Ⱥ–"O8,,–ÙϦ÷Õ¬±–Ñ°âÚžQënàz÷MqˆÆ73TÀêiÇ]ÔÚâ•Ð6½<@®ÁZ¿äFxÊËƨ—ëÏnñÏ@ å¤È©b‚KIeô\h‘jfðÊÒ.jʆh A´X¨ªñÒó¤DNU¢²(›“…fZ(IOÌ´´GîS°Æ&&˜`‚ &¿Z^¼x1ëFÜ@ DÃéhññ=wDlÙ hqÍ(¾l¤vä„¥¹‘“O̬yxßL Êi¦ )‚ødg•#†Ú*îùlˆíc¬~ØÐLaïîLÜÀLhÙ6Gù˜É±ò¶áµÈÑÄ—®ˆèäÁ\å&~ÔÎ=¸€±=Ž«ë™[˜ø†gÓû[ŒMÌm­ŒÕÚÍ„'ˆá}BMÇÔBv¯HvñЂŒÎ?nŒ«-åûæûš^ZS~¢›ÞœUêç‚ðtðmha‘»´åö´:a`VÍÝÔ\èo¼UÁxZ¨]eR»ÅÍÌôÛ“°3ÖRICWWCAÿ| 0syÈp­°º•ž²Y a,€vZð{­s †!–¨Ê«žñ ¦€>ë¼’¢¦­­…ö17›yÓÕØÊþ”š„TJ=i&7ö窫8immårAòòR.´X¬P±¶ÔU2>ÏMŽî¦*¬kå™Õ²©Z²Ê®ç¼5…7΀bEŸ>¦¡onaª!*ŸÜY&)¯çåé°}“ZjCLø–b L0Á“ß-Õ‘ç #­¨&ÚñˆEÂV=Îúèq餦SÞÐwؘd/±bª†þ¤ _´Rïú£O'ƒ§N˜ÔP±3Ϙ`‚ &˜üïA À¤RÿÅXVÿòåîq¸ßdâû«!»ß šÜ¤ü9ÐQ¨t Y0ÁL0ù_„L0ÁL0Á Z0ÁL0Á“´@ ‰ŒmD˜)t ©¿€Êþƒ LÂ@ÿàå=áî!"‘òëÑü!ˆA!nÄ|ˆI%þiW*@À@ì@ Îö‚@ÂõÄ!6mˆÁ±Êù¶¥èÄA&ú ) èÈC¬?`9¢R(ØU˜`ò—AËûÂø÷V&ñMˆ$/š³‘ÙD8 Wýˆ=û¿Î @j1"³ŒÓ9Ò¼´õSXÙ|â7¾„ŠÞ?3ÞÏœŸo»ÜQ;ý?Í D±‘H.²ÿ¯±Í´ŒZ™³üß@gK«žSí,Ÿ,Š¯±Êö‚go–A ËNc2zÓ7 ³ˆ­VG•vòÉU‘&†Ú ï#íBŠÊ[ÞÓ¿²%¥Mú˜Al7TâÛ»/ª–2È (К²—O\Í¢‘øŸ6sæ·}~Aûïßö­)~ü;dõ\¹u¼`s"±— .˜`ò×@‹ŽŽNVVÖ»aü»òÿPŠêB£ø÷3$?»­«×j›Yº„T@¯š¦^¨·£ý¹›d„ |y7ü­,­“+;Ñž‡Ü{.<;ÄËÙÉë ‹9p>,ÒÏÕÞëj€Æ“§${ZÛ:t@ÎÙøÈsW&Ï`ˆAìÏp8 cžØ?„¼»Cýí6ëk:ñtÖ‡¶é‚„ä}ºn­øîÚ²B ù&+%ôbî kËSå4€6îãliã”YÍv2™:Ûû;œV5vИ@_m®Çg[ë›y8ÑÖÒbí’5:æ–>7ëu”%;ÙZy…¦1¸H‘vjVhé*ò•°¿ÙÓÝxò€T " ö#v-MðÛf“Ç}åédDóPûS3rö®ÝUˆ À»ØßF‰o•ˆ¦ñßî@RÉ·# ™‰ðq²ó Ý%fÔÏ¢^ÒÞ”ZÞÑÚÔE˜%µ‘®2žÕèD0`(#šß‚ÕÝér³º«øú·û<ÛZ+ȪâySèT*7f@5eþÖòçšÑ®;h -è¬P4ç^1©d‹Í{Å.Š¾hëäqÚ@–ÊœÌÒºæÊ´ÀRçxØd" @ªŽw–8›Ñ‡¯×UUîb!níCì}͉ߵœk?†”Ž %lRWZZò†oùªxY¹ÞrKk›øep?Gì0q Hïõttt¿°v¯MöЉ,¨ëhiè!qKÑÔ4Ìõv£¨³‡O¤µ×åß”ÑE¤uø:ÛÛ:ž-ég}Ù¶º2ë·ˆZÚ8¶¢Ô°™Dò¬S ‹LÀ×E ŠhñêWôų6§N—÷1€¡*Çšß}󣙥ev%îFHø$ÉTŸJ,u²·qrÄÓAvÎŒ*ä#æPMHN‹N®K¿ú ÿå®223λFœ?kçÐJ™YsÉMyîNv¶ž ’vyB•¥•GP"‰C‚ÚÎ%&Z[Ÿö´uöÂqI±»&ËÅÖêôÅx —iA€…”Žût°3?ÂÞÆÚÕ7¼ôN1yÃüº–Ö–æYæÓ@zܲ¼V”…zkâ¾—:ÓÒZ©%»¿“ÅŠÔÙj{%¯,Æc…R(÷¹o¼Lìn«jlk¯Ï’4 °©çå–eÖ¥ûêï³HœáefCfrèò¯ûóºìÚZßGÌ÷V9ì?½-Cĺô3Ž¶ö.~íhq‚è‹H×äšNáµ4MâÙ¾¹®nnv®~ÍÜD&Ûr*¯-¿åe°)óš•¥[@Ô¤õVî3/Áµµ´¶ò|€O?'f’b“-˜`ò—@ /Œ¿©©)3 e¡˜gjzzzV1¯ƒ<.«X12¬WbÃÖðüŠ3â_ÇWõUE8‹vuÔÉŠÂQ‘F]»ìû-±øîöfµiÃz…šþþÓÊ»[¨¬,·CZ§£Ûê³7ñëb@¡rå7²„÷ (U^G”§nêaœßÜ÷kóü)[DÕ,³¨²›@çvzt‹]‹Ì®•“ûšºú¨Éž5Ï¥´5UäTsûAÜ–Õ ³¿!1¼Å׶ÑÑ ãÏo9ÆÙŠ{äêy—:2Ûå7´„Zî «ìù´´e:j±Ùä³[®ày++ÜB2‹wÿ#0h´æ›ä–¡Éy&ºôæ½(´ðÆS}©³y“™Ùx•5?òRÈò6²ŒhÌ:·híÑ>bÀ÷kì—QŒ­î7!¶Z>84ÓÀ@†˜”vgE^g¾íAû+¹×Ì53ú‹Ë›ÎèËEt£žˆ2–U<=õ‰Þ¿ZÔü±ì¦…VT3›E²”ÛÙ˳Óï„l1/~.»÷Èš¥döä0Ø»ýûÕ¼'UÝT19 Âjß·fw—JìÕ¸ÄVÜrþbÉ ¡DhõfuQQ•Ôï»fŠrI¿ö"uVÛª ­Ü&J‚Ñxf¹íÚ37‹Úk‹òðhq˜ÍÁª:S_nHöŸ³ÑúžÊ dŠŠh! —h%sÂ'©©,~Ùzý>ÄîËݺñú_Õå d7w âSÝ%-²Zn—5´ç^±æÓM`³»4m© X \ˆÎ? T&|*‰–¤8ò}XÒ]è{ä ûÌë'ºó³*ës®-—½DYÅ 1-]]Wõwž‰DÓAôêÕ«5{دóGrïÜ93Gßsž3Ï3xäÍ] Mõ=õI‡ës¨†9*ŽÔòZbc›>}— --ÁZ>&»ÈWO:,˜×—ù>•ãôDé՚ΡÖëïH]¢CÌš¼Üá‰ÑXݱ¥WŠ¤ñ²¿}ÊáRZÂ÷ÿÎ8"¯*Éé Òy}TšÛ—“ÄRZ95}…‘ü’WËìöœ´þ‰©LWð†ñú qm-±Ó'|iÜ6ÀBWQg°µý— …çÆÿñãÇ[ å/¢êhÛ EYˉ9 M¦œŒ¯ 5øÝkýîwo$ÐhùB)‰ç–E´HaÍB~b5XºÁ™Ï׎|§|Šù“C gDÆô_p3øðÝOz8Ï›4'qo,IçÎ%m|Bæz1z#´lrã¿Zèí®áÝÏk¯+¦u¼ZX”Üo¿öÚ»§d¤Ã¸ ÀÆÖ ”¢³y32çRàµKy´l¸fo=ÙŒI§…ÍQ3 _þí³I“Ú%¤xnû„šËe¢Ù\êÉ’ÐIÖ9YVà¦ì[gh^= ¯äm.3Ä\ÍaC¡¬C y°xßÈ~´ïË“…(öÆk&ÔZÙ^n@®û²µZ ê˜ßg]3TxóÝ1pƒ‚üáµ×Þ?.,Ïõ.ÇF—‹ê¬Ýù¦rx´l(KY1„Iþú„=fºôËÝÇDiö–5ãë¡"ÛGÿÐâ¤*7@Ç–[¾ÿÉ!û ÞûØ[ eóe¾Z †üþ¼¶ÚÚßkÁ²žCË,|9@»fªé“=)~çȸº°OÞþ3räÇÇ]éìqVîÒÀ˜â®ÝCÞ&hñürœÈ$Öyɘ¦m]ié¾zäŸoq²{_c†„éý‘›¹yXÑÚ5sKŒ-ï_kÇC”¾ãò´¾ù»ÕN)^²ùîàÁëîïý?¤¾~wR=’Üîñ•Q* †Ë#d#{·¹%Ķ~ôÆ©iîÊDcº™Ii—ªŽOˆƒRD7Zx×þöÆ^±Ÿ½q`‚ã—pcñÁäéÞÒ4~*±{ß›Ÿ'Ú)^å?v–-›{èh!yÉíO®h P;bs±es{€ mI{ÿþWÎýüÝÀ†.{ªñÊÁ=½aÓÝ!ÐràOUCdˆÔ&¸Wײ¡/§¶o)‡–4»¿þþuä$²–)Ã%¶_Ù!—wÅ]*qŠ‰½ãÌ~Q:€  ÿ ´˜››£ÑèínühyG½|#PJÊ5SV¡…»§žJ@ %ÁQã¸Þc©¨î}Ú—™«“õ€U2Ãú‹#Ðâ$s:±çyäZþõ®8–õ£¡b3f°Ä¯Ç­éú^uÈã휢4eÍâ¬xthS¸6ƒ1m„–Mq¹Ð"ÙÅÝÛÞHVpKÛRÕiîÎm/˜a6ƒAöW?ÕÊ«Ï[I4¬ÝDÄ lèÕÐ2ËÆcVmáf*1ÈRO£©£Š_~9MaÑû/ É9lÏ<Õ]קÆ}âî‘=­€ÜÇÄ%5ÓàüŽë‚ Y¶“š8o¹ƒFÂáÉôíÐÂ-vƒEPá )LÅ͹†$Jo˜aBõì,3^ó-0cÊQK%§ ³~wd ê¹])&É^A´“[…^:Ú×™aýhAÚË;£«ŠTÚ“Iÿâ¨-–2 wT9­3DÆ0ˆw¨™ŒTÙš}ˆE%ሴB LSk£ SŒG_6rªƒ8Ð’ ¤ðAT†¼½õAl&gy`2W@H†˜†ü‡3‡žçÅ–/Õyë3ÍWƒÎúéŸ7RPÐkÆNœ|ëóæi ¾%ù~Zf'ò\…Dµ>×ÊâµÖÐâszωEª÷Þ-æ"B×zñ4t×ß>Ñžž.––4&3Ù£ rkКÁÙ«æ¡w“ª§Yئ½ÿBfÈ™…nlÃl …áx†Hݧþy|˜À@—x ¨E2ÐyŽW‘3TǨvà·Y‡FO¾õé 7‡þòȃ¾íH£òÖ­!Rí~t©@,~ócCÇF³©–y¿>{F¤•ˆÖÜõNÛ4 WqHÊ—‹ Ïky#´°±U'Ë"uDë×ñÙØ—aEïXá0‘2\ñچ؉l *“5y’-ÈÐÆyæ¡ð¿/豦ˎîW!%+¸¦n,‡õZ†ðÂû¥1TÖT¶¥œe º3å¸w%rä5_Åó£Üí^S…Çùõ™À>ô_–¹ñG å_(ZZ!rªBsúfŠ£†Š¹kdF´ZpÝr¢²Nú†®cŒ—AËtÍEyGG;m} 2q2ÐÖ'÷Úºz—µmÞ^ C݉ž§öì>¦êÝʆi=,Nìz×вi˜I;Püö?õf¶ÓµÉ@KÇÊÒTFD¢CÝ-³³ƒ•ñ§åtíílã³^f‚i)^‚»ÞÒ5±¨íÃn…˜}ÞHFÓÚ=!o5Ïé(XØZš—`9Kô­YÄô\#Š¶ìx`Qжæ&:jÒÊ6ÜGmº¥‚TõúÓó›<æliöñ»¨š¸4q‘êEæ¡ñªD¹³Öaþ¶î1˜a³ëbLu-5eDý2wð­7œ"äTÉVÙ×|õ” ¬ÄNIU Qè3½’GNšj¨YEðJb£y(;ÁOîÔ§t,/7úJõ ÏÊœrL®âÞÂsó›ÑQ×÷ôÚ÷%-ñ&"Ÿ“á4œsÉœIlƒyˆ424ÒV×vO䕃†˜lÓzØë æ!6¡ÏÑÜðýÿ÷¾†©kr–›‡† ÂUtíƒ,®-óOïœéIúò„!MW?éàâf&ÿ/.´À´aÙÿ~q„s{SµYFge_û‡¤¥_í¥Ð’顧ïèàjü×µÐä1[uùðps¹¯-xвÉ<ôž¨š‘‰–’~T¢™«ë˜ÙX™éç¶m4Á,¬¯ÊiÏ 0GÝ3§Ô"!6Õ\AÊÐÌTFBi‚Êھƙ­÷yI/Ç$ÇÄ É?el¨©l€Œ3å²òšºÊòn…\‹àóPeF°ž¡‰†œœy‚¯9È5V‘–©ÃÂÜZ^71QuöÆjoþéCC ¯".XOR×Êñ¬Äé «mÍC+&[+šºúØkÿþCj;Á‹¬?\0cÂVZÈø­•Lnô ¼ò|ûG˜‰b@áüš™¤AiyÆ/­¬é¨2ë¤êßÞÔ E¸X7“²hy¡˜4˜åGN…Tô›s'³¨DƆ¦B"XÿãeÀþäN鿼²†a…ñÛ›¼a*• @Ë/Z˜‰Á†çjÅ/@?ñó=£·iCkê.ô€€€´hùÅfRÑ(žBMâô,†Ìü­~Ãl†ÈnÕݵ¼¥ÎYÜËÝNýj åEnü1í…|< ›¶ gÌ©b#óðÿ”½â¦„Üø³Š,E‘œñ EW£¡W XTCE“ѹm‘AÁ´Wkûg¼z<§MIà;hà—ñoy !ÀFãè~aî»·0}¼BMä¿ˆæ ™…”Ây[u¾ý‡´=2È[‹&w$(ñk»ÄòþŸnº*-pðˆ˜Ö8‘É&8¨ óñ)ëß>sWÇØã;æšT¿uú†ˆQò||ÔðL;\¯.r„ïè™Äí'áªáŠ·+çÅOªÕBMr?ŸÜÇŸ(<ÝœtêÈA ïæ,›>iƒ\É!”úíÑš¯y Üï[ÔÍ»°þ,#ûåm"8‹QÕê"ÇV(›Üæ·MJ±W:À'pµqlÛWK¥Ó|Û_(cBpoq‚”À¡C‚JMDîï†OüKj‚ö c ]$„4°#§ü³z¶ïra¶ÕY³ÁW6*ˆrÅËàÀ~>%«ó8&gßPE¤ÅQ¾cÞéMjYc€¼µá@T”ŸžÄ¾#žiÕ³³¬*“£Üžv(°c«WùáÚ+²‚‡øŽI–õaŸeù:À'o†aÎâºbðzè~²­]®»ìyúàÁ ÊAÎÍR§ÝÏ í? [Ô»s-g¬ÖòXc¶üéÃ|ÇÄ ;9Ω˜¤¹y¢¹/ûÇ;iØÌ)¾zû›2½¥ŽññQq$² ƒu‡p®KÊÒoëq,\™"ß#þùTöìd[¾¢’XNËD•_qøõ‚·dA«4P=& Íuã÷…âã“3ÂqÊQzÎ;ǃáè·-zzz¥¥¥ÛÝøCLúôdïžãv£3xf7E»_Œ‰r<ç׉g³1µÎ†2Ÿ|zÌÎξcœˆÌëU—‘¿ó[9ó “„ J-¿äî”ÀdÌD¥\ ÷r J,â¹ñ¿`ïèZ;J„ˆ=îfZoþù_f6v¹õ[@äŠÜ?ƒ2;‡[rvÿå³A Ý”ž^æaot¥Í"ÆûÛÙ¹TtO!DáccùñûÿÒ³²‹¼Ö‹LÐ]%iNv±ÙMœìf¡žÊKövö!)•È$†mrµ³ó9 Ï5ÿØkú¯†–òx¹°òiÔd}c'V›•RŠÜ’w$•ÑQ]áÞ.Ž®A£®¿Y}Gï“ZU]¯%*˜=͆!¦àˆ²þê”%.P3¥#cƒþâ‡^ßB0u´¶&ûœ˜–7w¢QQÔ*ëê¥2¡?=)¿r"fðÈQñÍs> ÓºW̾w¸ÛJêøЖ­‘­·µm|b,Fýk¯ŒÌxgysßpw¹Ä)yÔvzdãÏ)‹ó<’0 c¥%9ÿ…¯ Aä‰~V?„ªDîììî´ú¢Míª«jìì®NÛ-âÃyµf7;}qiK‹Ú~g“WÎ(ÛLµÛ îJ¨Ù”â„@{;»Ä’6ˆ>ãgkóÙ‡ŸêXÙ_ê‚6û“ß|bIvÁðøDœÑiý°zâDíb.ýÃ]¦R‚#ŒÕZ¬NýRË›ª3;èsól,fDMTªÎÊ“x3¹¬…Bo_íh­«ën¿¾ïŒžE*ÉÌO´”P÷«†˜4 5=Þ¦#(HÚŠðHWma¬ªýu+6\v ­AOvk+ªM²v¬e1^-w6Ô¶÷wä²Ä±HÁ’Ÿ¦×éÈ+¢ 'ŠXÅLO{ªñw6ós\ƒÿXÿ ¡Ê_Ò8¨×Uòk“(¿-ÂUZ\=2ÒçvüÍ”šñ±žæê¶þáÎBþÓFX ‹Ü uÅ][ûbßØf`úË “ynü!B‹øÁ >ßSÖ2º×Q~H°  _´¼È?÷±·ÿ´'×%3ñÌ;6k‹Ã?×Ìeql_•vâÖ~Éó´YüäX·Ôžÿù²Û&§Ç¸nü¿”íšÁø*rÜø—ùjhùfŽöTì= ÷27þ\h‰.¢a:¼ñA–Ù—äðCêc$zwßTç5߯UÆ{JOŠ"ÓÌ¢ˆì“èçÙy˜£ÇÏè4v·Y ïiDQH]ÉÇÎvM\ÊÁ3pŽb|y]ãÍ-.Ôÿph©Kó8aS×ÚM rý{±°û>Þ“Z7Š™è§³Y&â‚YMÃÕÝ3œñ¹· âO_¹¿ÈÁ»­¢(Z:G]é%Kÿôûã¼€0=Qù«˜Ò±…ú£%µ9ÐM_•<-e8‚gŒ•^Ôô(ÈŽU°ˆÙ²®0Ó¤SÙÖÜ™¢1²u–bQÐù9ºB'2Z0k 3¬!­‰‡¶/iTˆjoXWýâÍýh!vÿhÿ‘9|Ýe¿ˆÍÚjÚQäð(e‡å(L…‰5ZÚ²Ý$M EOŸ|Z¹|dç ˆ¦ *ù¬·«"OuèÖÕÅ·ŠPAÍèýóŽ:äq ¥:ÑJ;w‚ÅÄ›Šðen[¹äÖ²ÖæìºE\I¤ž£|ÕÖXÓ[{\؜ҬäŸÃdQ.ìè!n!áhK¥Øì|Mñز1|_õþCG÷ï?hš»cW€Ùäó»ڌZkW½Ròv«¾t`º¹ŠJm‡Ûyî\S-xX†Ê†z’µE CxßÚÈI¨…@@¿h144ä¸;wîÉ“'/…–¿euèC×wõB¦ÈÐÂqã¿*žÿî/•“×˶L]w.Çq㿪—ºñç@Ë.îaÿO9¼™ Ïö%9‰y´ð²í€nÎüa« ‘‡bo„ÖH¤v$Ç•VÇUS¯º©O5ý˜¾ÕW-t\Ûƒñ †?Z8Fê] Ä?â7$ ÄÁÂò+…­N_0ZXÑë‡o‹áA 'ÞJ}ä®?ýîÝìýäÏ|Ž¯ðɦ¸#–™;¾/º-ÌÁˆ=J>ÈïÇ2•Üò;;Óœ©´U§îwÄožòQ5.Z …¦ºv‘ÚÛà @ R{S¥Ê×»âk9&‚‚•ùý FwÈzø²€ˆÕvhá„3N1úóë¿Û+tFPÔŒ;ËÃ9¾ºj:vÜL²- i†{¼Û‘ßGZH\ž¦X4 ¸’aýÉÙ+ôÍk‰.*öyU‚º‰Æ2ÂW·yd“¦JÒN}¶g„Èàš?&t÷|Ô4¹êGšIWÉÿÐBm²SðÎ`¢¾øߤ´l‡ñðvhyIã€aºð´¦?2Í;è^®2ÐuN 8ë×ÃäÕò;H-ÿ?¾Íñ 'j“ß?a_W}MèŒzmue²ìüǧ·»Òè“/Þ*äúmãd7S"¬æ¾ö’-d$Ù»ó…®C ÓÃÿÒ›þvLP,y[arjYØrCóÀ[ø{f;·ø€/ÕJ*êbÈI!„«õù‘^ù¦°º‚o~3„œ¥§U·ú(ì;—¶þ²6ÍFR°›¶C‰õíw(çµYˆIr<þIj#``æXª¬YðÎU¶îÆ*RAî瘂”¼Áª§bUñ˜^°E è×-333ÛÝøoƒ–²»ˆ› EÊ‘wÇýuãŸðCÜøsWZBsû©´Õ ·/ÉY: “—Ef ±I 2³ÀúuDd§ˆîïãŽ6SÚý*4 מ—íœé‰1T<·jé†)GÅÙ0Lª÷P²Œæ|‚ËÑñ½ü|ýãàý%qêag5ɬ)6-šç× …$,l²q€Å Nïäà}3´pïÉÄTüõ3[„7úKc„5üqôÕ¯`ˆ9ƒY÷ûZ`RÕý ä ñëÚN¹!ÆÒþ\ÏüÊüüÅÓLÁ¢ÉtNÁG²øísسìkÁî™TÒ ~£7 x&[ÃÀ?fSÒ̯6íè½"Ô‹ ªí-œ¹‡I§\uÒK„a¨8Xß<0ký­[&<ƒ{¾h°-½¥aGÂû£ÎÛÈ$ ψïú´|ŠÅÂ4}ôÆá nL^šƒ÷âHK¹øx–¥&"ÓIåF ÀcHÔWø ¤ôaaÆ´«¶bvçÌ:õКmÒjŸ?°„íaaV¡f·z:—ÊñëË¢:«$d-ÉkÐÒEÛ`AÁìl|˜é-ä—´æzÊEw§u)AŠ=ÆT¨‚Û!8µ§‹œMÝ0£@ûŸ9ík¡®Y£‡?bì-_uÌÜH[HÚ°ËÀuW˜Y;Zj9ű¸ñ÷.ÉhZ¹ÆçösÊïEæ!Ƹʧï(p*/îZ‹ŠÖÖ7ЖÓ乘©:Ï©e ‘è& —`°æ»ßÉâ,˜L´d·¶4”V¶š¦âœÔÕŒŒ$Å$.ÔrdM*­kÈñÓýûW"––ŽÑXêäÙÝoÉé#Ù¿T‡\å`¢†¡îúåÔFÛ}.Áãφëaº²_’шΩ££{tu 4E |/í`¯ÙPËEá¦ï}&dŽdç5º.ÙÉi˜(JÊ$6á`6ÍÃÖD÷¬œ”/ϵcSÊZ-³q~ºRº–öj¢§"¯w 7¤hêé¨J+YEð0"×IYĘw€Ú~t×'šÜÖ^Ú9Yg÷Ö'‚fœìÂѬY6 }ø€òÀzÿÙìÆßÖPõ?}h`î9BaUÆÚššŠkÔMqWW8Á\‰ÀS ÐoZ€ŸžBMë  …lQwaŒ]%þô2,‹Ðwè vÍæÂO–·O³Ù+j¹èVË[VAI^AW@=hùíˆL"±€síó›E¤²~Q~ZX$ÚssÌ$QèLP¿²ZÞzù4“ È@ €  ÿ]h˜T4ŽöC¼¬³é$ñ燑A!NMMè?‡ ÂO#™£èl`¸âìŽ%I?aA@ –Äü%9ü‡!2v† Áÿ½’>Cú±nüa2‘†ù’Reѧ1Qè¿-05Lnïºä˪щ4Xnä]ùCÌç¸ÆdŸ„Ö{~Bo¾’ÐÑCÇe[1Ô—Iï »VûÊ’±SåW]-³»w•0ª'9å#|Öq†ò ªaôL-û‘Ó{¬»S[àôõ©W#º+óÌ¡ýGOË^mÁþðP­y¼*ÖõL}åÎöl×¼)Ê+ÏÙuÞ‚{Ê}¦¹ý³9ÆJù[É:Ë„ ý5ù8ßIšûpol&·÷¿O–…Î?µÖÞ" Ú·Ÿ–…Î3sån\ «p‹_T…À€ºs£„Žò8![=‚Gj5Zi÷‡sGHäÞ'eÈbS­¤…xçßwÀÇšeÌÔˈ˜¿YiüÈéNŠÅVŒoïeRò„>š¹bU¸© yí?|"¸xü•û-tÍú_IèÙçôž ÒóÆÀˆ÷ŽÉ[ÿ7-оòïôÊú µWõ!zŠ¿KÚšw>æèÙSBå6›1e${rï~~ç¸J6g&†/ÚdL¾ºe²0Z¢'=íŸ?ùí;a“"U Š’h«Ä—Ì#fÔZ«eIÓî‹fÔHk¥½Žº•b`6>ÌRy/߯, {¶8Á~µ…ñI·á&å×Ú›¤ŠršÖ ¿c{‡3¡ÙXgíÕïö«¿ª^ŠÏ;Ëè„noGÄž¼·EÑÀXǘj4QÛ»WnœÊy33Ë×ðß^YÓ s5$Ç‘½G\k‘RïÈŽá?pTT£GŸebÎ"7£î’JdͲˆã:rö‰6â×^ýf¢lDO\åŽ%ñ.‡öòIèbéÐhc–Ü©ƒ{ŠtLC”™µrP5|ùeF›iÎüÇ[‡˜Ä~Á£ÂªÎ(°× èÇC˳æææ–\Y[[ÏÍÍ­­´Àd,zzªïëö£(–È€géqI×2¢¼í}1Fqj¨]Hj% OÔ_L¹êdk“Õ4‚dAÃöú:Ù;¸ú·aY¤Î¸O—ˆ¸‹Þ΃$s¬ÀÆÆÆ+¾…×Ágë\ll=†ˆl¢W§‡ÚÙØD]㌖ô¾äȸÜU×p#ÍyN6¶þ‰eT6<ÕRšåbg{µn`Û¨N;!“Û28>Ð9Ff@LìåpO[{÷¶)Ò,D»å{)ÌÝÁóšê¸j©qô¨¨¢k8÷•gFZbZN¬ŸË(ž9ÖVÄÉ.¾˜Â½PTû뜡% f?žÌ VUNl…gYÅñaÕ—‘»pª¡&[Ýìl=Ã/c™¦7ËZóø¡Ó²6.!Hvàæx.`ˆ;1‰ãqþçlìÜ‘a–Z–`kã˜ß<ÂËÄNRâ•Ðц•¿Þ[Û?9ÖßÚ>H@>¾šv)ÃÙÆ.ªdØZ˜dkcv©~‹ï²‰šô7²QÓ#ŽÊ§ÜH}2ÒËÙÙ+Š»gº63"½èœMеÖÊÌ jâ{% Ìl|®r¿„é"¹Ã…5¹+žo@¡P ™û[Û&&Ç/êqJêÀu¯:x'faV±ýi»¨ü±ñѾiÒfP¨é©!û}ïôâ·óÛus°ÒIÞl ¤ì9ŽB¡18†g†úz†Æú²v‹ø‘ šŸÄÑáéij†Æ‚‰£5_K9·ŒŒ!G±H¨Ú«ûÝ›9Ø 3/[žjÃÐ^1çGH;ÅöÔòï®#Â,üÕHoÛŒ–qˆ<èa®ÿöŸþihi“V2²Z®ëqHhï.ÿüÿhB3'»Êœll|c ¸¾Ùí±.—ãl®5ØÙ~µëSM Ÿ¤Žµ¨$öŽÐrjwr¤{ø0" çÚh ì?!iãìO€àôp¡C_*™ÛØW2Ù¤+‘þ|]ÜB/a̦U&"+:g'JgãÖÝø#«O±´—ÐÈã–:-ÜD›ÿ0Š ±ˆÝýãÃVgøx/¶Ï4$ïÓ¼üò˜M±<üyLYÏÔhy9vº»ÒÝÁÆ=âœ0‹”{ÁËÞ+:$*Ã"Ä hŒ[{kN¤‘¥˜Cn'Òú[Z'¦&SLÍ£›¹µìÔ²ZËìrW ó챉±ž)*Ìœ)+®ðú ºd˜N%" `z´JJÍ‘±yQ²ü•£{ 昸~ÇÈ ôçeCx ‡|5ÑŸÊä"ãUT먧¤/!D`°7öå†AÌ*´°©é11<—ÈL*™BÛáî˜ø‘òâkÿýÞ! „°YiVÁÐØD²•¤šo ÛºOܾo¤ÇZŠµV”·ö7çÿ»h$…‰-Í/ •ÿÒëJ›Š+®hÙÇ_±æ¯æŠ¯”Ô©¸1Ö,½WD\wƒÉ1ûWtùÀHWS]ÇÀHG7XÃjô„TUãÔ—?çyÉœœ†ž/$uåÇ9ÚÚ&¶ ÕÜï{ÞÁÉ«uÕ[(D%ÙÛ—™ r¤äG å=¥Q¦¢¶¹`¥èßXiéèè@ð–±±±­Îå ü3žkc:Ið³ÏcÊ S½d:­¼°xt|(BáÃì6TKœý—R¾tÚ˜´#bXí)íî¨nF1ÑÙR®é×åùErs¢”s¦ŠkNùL6»Ò Ñ_±«G;Ó Ê怒ºqøq Q‘òž ÙϼZ¥Ýi«#ÇQ$¼á:Wþ÷,’›‰˜¡±©)7±¯®µ§ØŠë…Tq:|»‡Mx6¯Xs­ ‚r[òÂߎ¤°¡9óøÊñ¦Æ®‘Ჸ$ýú{«Ä…Uy¨òC fLèÝ›˜SÖ;ŠærTmv_ÓMÄ7tb Í‘‚’¦½££¹)Ù[æBZÞV/gAôpsi³¢éTå¹&WV$:®šŠàMw´ÙÇ't§ÈŒ®^ŽS¼ú$½ô±µh203Bø§‹u;,È„š8|ìÀa¤º ÎôLÅäç刟N­Gãûªæ?xà yH›EûôKE5AÑ âQÞðE«}o5nÛJ2{ªî?Z¾ê§¤|êðáC‡ä-ÏS8þìà‘Žò´;y·<æ,-Jnß±cGøeÌ;ÑŒ¾oq}]ñ3§T̃V#ÀŒ8+ñºµºíªµw#ú•Ð¢è}ù£'UÖ¡°"Ç•_-ƒ-ëâŽÁ#Ÿ½#<¹ÓJ -WG„Á£y«zt\_D°´g(Lå« Îª+CôÏ îWp¸©®!Žº³B2ëô´ÁOË–ß}ÿ›žW2\äÕý9%Oïò7õN_ÿ>ÂF­ŒÌã´ÆŸ]§ÕÉ8_¬#ö—¼¾Ûjhr¼®u‡%¬nü˜NsU£™ZK#´Àã5qÎ׺l•Es¸Þ é¨ÎÜ+Ñò" X®#D6®ùð'¢8&ôRh¡zŠís¾ÕÞ7Êâ8¬›Ô’W®î)ð“Èjëºæ·OóÂ@óå/>ㄧäzã±àzãÙ:_NÕ[š¹æë:]ïädMÃä™ÊÇVM÷—z‹ëqkÙ,Ê¢žåãS8«$pJÄ·`„÷p„\CŒô')5“¼Þן b»–L·×Pì Âì‰és ]MMW5ÝKy?kñçåFœ|Ùó©IÛijü‚væ8ù/ÖVžÛ—›»†hyëHpœ£²kbõêR˜Áiµs¹;/#ûÿù‡}C|<yªFµbÚ‚¢Ë[›ÚsC”ÇWÛº#뫳i«nö fªÖ¡¼!n£ƒ•Ž p¡¦ dÙGä$ž“ç@ D¶ÕÒLȼf%r¨zˆ°ÖšºDÏ­z&„iz j½4ø‡C ª#çKßÞá~; Å#]æcÓˆÒ±ê‹*dr8–…ÖÙýÏF"sÛÊäàá7vÕÕ×tÕ&æ×cãпertttssÛÁ#îfhWp£¯DÑÖRxýõ×_{=ª¬¯%ÎI!n¥uƘpßUÃwwó»DåP!#s©aÐÎØr¬£àDôÀfhs|åÞýZÄ/¥†ó,H:ø—?)›–t àÍКº¬`Â÷]ÌãK;Ó¼ÅÎ"Ùi)jlî챘3×Ö»‹²Dêf‘Å÷œhÂáœÄO1`˜Pn¥ë‘»ZÔäÍywʞΔÕõâd×éižûrh9òîï^{íµ¿¾w°—㤔î)sš7i@ø†Sûeèl˜9œ"­á¾ZAFóȱ¢)Dùê¯ûÉ8# ÅuSVÁy3—6N1ûÊ_殽ÿh™åF».M ?¹ûØV.´ ÈYõÌ_bqÆéòðŽ¿š¨Iûç^ûLÈ‚DG ¾ÿò ÄÆ6íýè –wG[(ø?Ÿæ6AË«D›éùè+cŽ;>¥£¥Vëð§å“ë_ÚHvqg>zçR…ªÿàM!Ç»\ŸnmZßéî(g¾l#mœ™É_ŽrF`ìxwΫ#féëÅáÊšî¹Ùæ{ÎÕB§ÍR©Ü2dÍTžT]?Eoi€fîø„–,mýk=ô¡ÌOß|_ÝÌ}`†ã{ö¥Ðr˜S´¯ÿY§ŠŽº.¥Êñ Mïö×õ¹„œõªä{•Ï#øl‚–—™‡¾œ 1IõÞ2¦i/‡ciy&§1g(ÛD±ð½{~ÿšˆšyy7zû$±Ñœ‹á•1:©ÞÒ0,—…kÚ§Œ¡±l•D²¦¸q²¾(YpÏaw¹¢þs?ŠöJƒÜ^’¦rê«¯Ì È½o!E•h@vª§Ž?Î`M9õ—ÇÔvÓ:[4Ž®ãÓŽLÍ“ÚÙÖ¨òKÿÂñ.N-×ðj9eŒ óÅßãq,lû[¿?:AãÄȪŒ:l›Ï\‹ ÷Õ¾òiÖj³š¸"­ëÉiLýÁJž±îzzõ9f6×9 ¼lòàþ¿|2Hz©—]š¸¬i^5Þ˜±ß§ á$¨ÌCœP$ŸhO2^=5o„äš™èÕ` èÚsZ Ìõì2¢´=:¹QY)Cù†¹<€‰éJ=nšÂXõ¼ - %ú…h™è,3B‡Y3 Â’ÙÕÕ–‡ÞÈlåï`à­|˜ÙŽY}MP°»ðªkÜ-u‰g__­É¿85Óev§4ããåïìq¡¼¸E@Äî½o|–ä vì¨:€ ZîÝ»÷ý÷ß¿Z¤Ïzó …=žªnNc±»}÷®BKüð´p¼‰âPc™žêª-´\æ@‹ÕXGá6hở™J2:æ•1ÈíGäáÞz âfheRZîÐ,Œ»®ì’^‹@‹ø  e–ÑwPÜ…¸6Ìj‰5‘ :þØ—b½d¼³„àfhqqŒ+Z‡MUkÞÂÄ*IU[Nv…Z¶q¥œçšÎX³Ì®ÍCN2…µºÊI÷Væí)€©=|&Dnò—ÖåB‹§uè*´X ìOï¡0qÝ{Sd’Nµ–‘XS™ä¨š‹EîÎé¬d7„¡ƒ”xöóx1 ‹}ÉŽ Æ`ªˆ¼ZŽ†¬F:n7 ­y´¤¿©œG PÙÈèΫüãïãtúXÉ?ÿ¥Jd!Ðb©Þ½ZôSFÖ¡¦âÐ$ê ÍÒ lß®/t×BØÁ˜|Cs©ë_:ÊŸn§P¬ø>¼ÚMfÍ4}ôæÉiZXh‹ÓGPtöNìtÝC‡ 69íeeï»>²öØHÃîÝýÜóíàųgÏeŽÖÇ lA 1éœçysv¶4Ð@%üùF©æ4ðÕqÉ‚‰Á·ïLX…˜™cº'©•³ºB'c{š *„Ò¸Ðòù;B/XiqNé¢ÒFä:Ic¤QáKŒLCs9Ð"õ~ÍÐsÔ’i{¾ ëQÖö´l€–¯MÐRB\…"0¹æ´^{ªñ>žÔÊ¡ë’èÝæekÆ/˜ŽÇP·íÆGúŒ«èQ«àظóþû@qŠN±‘_הּ¼±Ï½&Áð¬ÛjшX<™þJhÁWHÛpƒ5F³ùm³Ø³ìTkÁ<fLXŸU-êÃñfûáê$eïêZ7[‡!-9)1]©ºai¸ÁDIópäB•qb5ÌÄëK$sƒ5ðH.VaOTÙz´V6‹Ûi«×&hiËvÓÈ™X+VºÌg©Íø ÐÂ&`ЬmL‚И֮·Û¦i¸ºÈC’¾€  Z^ôöЋ ¦öëkhè‰ìÚ-¬Ú`SK{G-y¹èôhéÈOw3Wyoš¯_ ŠÎÈô1³vtR“¼ÞM LöšXØ[«›ø°`VmJ¤³¶ÐAý d2‹h¢¬cj!vL¨aŒô2h™…“\uäÎê›WL‘¦ªã%%”­ Õ´Š˜lÂhðµr²jÁ‰Ü9Ï¡ŸÂ-UµM-%Ž Uqö‡ÌÒ0"jŽ—¶>ApÍCÆ çЂt΂U#e1‰„®P¯ £ìOàÑ|?YyMm%½˜6„@š3Eõì¬-¯V÷’Fê„‹Yšé(›ó–ë/XH«›†¤qw;°g´¾ü¢eû#9嬦dla©&-ì‘Ò¸ZØ„vceY3;SÛhâNæ¡õ G—mTõõTåí. Ùm–±†ÄSj–žQùtøeæ¡$;]}Ceé3ÎWºX„ MMS#á"—¦†’5´ µU¤T¬#‘ bªØ)C yÍ:¤PU‘‡¥}v~ø‚¡:/ ÿ,ŽµÂëiêêk*ŸQ°ÂÓÙé!κ†ZJ’jž9tr¿…ªš©©¡ |q?‰AS=-bdj «lŠçÚ7 ¤¥ë×£YÃÔh­ã„Õ)’k´ÃšD ԕܸÁ’ÚhÍ5­Êžk¢eékëê¨ ‹ë ¹Ó÷Xiô1Û²U„†(û~_³mA¢…›ëê›é«Ê)ºäÐ!F”­¦¦±¥…‰îÕ†A|O¡°€´••Ég_I¿Ü<´Ú\¹æ!6±ÛRCÃÄÔXT@$¹zœAWFjYF ©eU"+«n¬­¨äWͤvص묱9"Î&1˜UæzòBÝêì ±I§Ž*õ®Æ²dyèÊkêé ‹hM‘XHó¾`,œ¿W ¦_8þ†_fÛÖ›càÓ›`pÖeÎ}ýf^7¡93ˆ×—3ªz×÷´¸¨ËÄ5!O"/4±0­¶Fš}í-c×^ÜÄÙOß’Ñ2B®9*½–Í šÊŠëêi˨Ú!ÃW”¶À—ü2œûqJ&QûE?þ»÷î2*zÙ”IsóÝü]ÁÀ¡n-dS2Ï<Äš6U”60·”=q´¸]aúîîÓfÈÏì#gX³ ÂÈ×{Նב³¦$??ºS´Pº×™õ8?3w‰Î¤Îô«‹›ZYÚôжAË ÌCH™ e;ɪ(KÉÆÖc²ý´Ðô¿&6¦\TXÿ·¦´ÛºFý„nO‘VV%±¶pª!PíBïĭ*m*§üÃßÒï.ŽµýÑnüáÔ›ºµ@©eøø;Ÿ÷âþÍBt5^núyÑÑÂÛ]?õ›ˆ"͞ΖÒð±'´ý7›F"Ó³wO§ÑJ?-,•ñ|œÍ 1X¿Wð?Z`ˆE¢ýX7þHu<߸‰œ‡ÿ÷}’üC ±qxòoäU˜E%S³@@Z€€€€€€€€~RhúÙ å§ÒòÒ·çW~²ó­,>¾ÿd~ ,ÐO-ÔÑ*k##k·ô죟ý^®'%Ñæ^yÔb¸±Gf5ŒùgË÷ã}ìL¬Ò«'–VVµiܯŒb»hÈ¡ïPCœL¬ÜF 'ìÉBÞÏŒŒÐw8/s´è:ú-ßL·ò ¸Þòle~4'ÒÂÄè\è•Û¢yjÏùÊÂÉçþÜ2òm_A4rÆ‹¸¥G7£UÅeµ"Ð2ǪK¯Mè?‡–åÇd_Ö7ßÞ ãnÜ{º²47ÕTšœÞƒŸ­,á*2h÷æïÓ²KÇWžÝAw•·g$'õ‘Ùú&¡7-99¯fèéò³ùG·Š3Ó¯äVÍ>Þº°@ë®)ªªºtùáÎÎÕ²g®$'çTõ=DÎøl™Qw¥¯£1=9­s«ìÚe3]Ý‹ÉWªˆKœõŽå§!²ZZ]•GI³÷î}û9Éòc:ƒ}û-ÍÅ€úÝ)/,² {ïÞ½‡s‹Ï–å…:÷áY·o@ß>Z\š‚|~ï6!Ø#ðéö³.?ºîg{÷é"òçÍ¡Jã¤ñ»÷î=x<÷leq–€¿qû›áâX»Äáå•GîWo#yß°¼²BnJ÷Jm¸uçû›ïW–¿û–“CU”KÖà-îZËÓ°ÐÄoÁZ Ð -+O™A.n½ãhè›ï—WžÝšiVv»ÎfÎx»Ü^XhtR`<š‡û5móæWžÑªâ´¢ï<™§±î=‡,Œ=I³w¦FîÏ?,ö5nE1ÝY^ª·dÑŸàê™Üüø.QÏîòwó÷“\­G™·j£­¯4Ÿ=[ö‘öLoøîûo)ÐC„#ýý O×~¹t/BG‹„ Ñ6hé 1¶±±¶v‹˜¹=‡üjþ­¯£ÆÏÙçÞ“%ZUŠ…•­™…m=êÆÒ÷8;“oWgÿQæÞo \LïØßàL}žriéöd‹©¥¹™yV3É~ee =9œx©kvåÙãPg+++K¯øòÇ Ëyç}|¢ÂÒê¦WVËÔË-jva•Š®ûôßÔôŸB g²žû®·&ÇPAº|tv²!ùiù°4! íöZæ ¾5h¹XDáýŠRÉ5—›˜—îcÔ…EĸÒuŽÜ-Y#wWzkÏ°ÆÜÜbX!©Õ\h‘ë%Þ_?x´¼J7z®Z‡Ô®¬<[zt7Öæd`rëñï«…‡³ÚFÑßÜ7ÐwX|öì 1×÷b9)Ò|\Zg¶Ÿmñö¹yÄüòÆ%˜§þŽÞð<-+0ƒ”~.¼Ž±öýbg„n?ëþµë„Þ;+KsÎÆöćÀY€ÊB‹ú×O‘éSÉœ­èÙO³weŽ’žÙŒíÈôëûnåÙJv”×øƒ…W¥^ê÷¨g× %´‚± ½×­¢ºx3øòc†“¦ùݧ;¯'ô'¸&60—ç¾µ:kC»Kôp Z~¶òh:-âZ+Zä(ÖNò÷Ã=Yÿoéáýû‹+/ÜûÍPŽu`ÅÚ÷+ã¹mðjä‚…G·t"ïãß•  ÿZæá”иćæ)èÉmÂ9·„ø¨Àø‚¹•å;}I¡Ñi¹iaêÛ eùéÍŒ0Ïؤ´„Ôâ{ K„†”Àˆ˜¤ÄØìò¾mÐâfî–|}tay¡=3<4.Å×Ù­|;´te]ð‹½\ÐBãàÐ ÌC+ówRƒcb£]]½ÛHß/ÞˆŽˆŠŽ uq ÿæÉB[ÑåÈóÑÞ.—ÛÉËÏ–FJbýÏ'º¹ÔOÞx¶²L/s½Ò<ó"p«¹à?âìiÁö•‡EÆ„ù»Fçw/ÎÝM ‰‰ñvuÏéf-}7q!,ò|D “OÂý§K(ÝÞ®>Éña—Zç–Ÿ=¹WÐŒ¸;¿vÍËB#¯k-@@@@@Z^ -.Þ Èg’®6ÞšiÑ.›½É¾„{´HË1½R?u›Mž¾Íq!»p³ËÝ7cý·s·ñò67ú+O®›ËÕ`nkâ²ÑË‹O†Ægnßd^ö·™}Âq{R{9tüy€Âe|¦Éõ[䯻Ä.åsÙL&&ÀÕûÖÂb«§ZRÍôÍé: Þ…Í8@l¼ªí|íÉü·~^nÎ=.uS«§öF¹¥ ¬ ”áfñíãÇ$Æ}dÚoÍ YÏnùñ5‘º)x'hÑ ÌhÄôË{u!Ù-Þµµ‰[Ǩ?¶–t›{äÓBcѼ:Wv„–BGøûUhyD+‰«_X^jO´Y‡–ч;@ e0Ï»ó›•g+Eq^#ß- ÐÒA~øh¹j•>ƒ0ÂEo÷±Û7s¨¹¹¹¾0FÏÄ} ~4ØÓ†ü{)Ü:$¿þÞžýkåÛ.ßäªQÎ_‹O??Ç×Θ-3­ÙçÂS³ªÐ‹K;KrâœU"®´žÞ£yعÆÇEDçÌ-/¾Z4ì’"“«ž./jc"âB|¼KFoqÍC› …Ð]à–šY9Í!—™‡6AËÊÜÍ‹.6—®e¸Œ°z\b2Kzæ–Ÿ‹{…ÅDø{_íd.¯Ìå¥]LNNôó »ûx; -N\4èÄ=ßÁ»0Û⸶§Ñ$×<´ôw1<<&:ÊÑÚuŒÁ©»…‡CTõSÀ,@@@@@Z~á"6fú6Ýúy|ËrÌC²¸oæ~èáp©•?’>Vn¦µâoÆ  @Ë Z8/S-,þX?-KósË+Àá?€ -@@@@@@@@ÿhYYº{óÆo¾_þ/Y'Væ¿¿ótaéE_//>½u÷ÑOe*Yš|ãÆïŸ.€vô‹‡–…[îjFhæ=Z–ç¿+‰õ0Ô3¹ÒÀ{1æÊùxÆüO{½Ë¬¶d‹Ýø?a)Û–ÏÿÛвx?/✡‰ æ'‹Å¹GäîÈë}DÐN€€€€€€~Ðâ©iqwŽó¾ ¡;×­xòî·wIdÆÂÂ÷©É†ÚÁq WkHÒÜAu”6]JHÈï"-/ÏM6&$$püê/ߘlJIL¸ZØxo~ù!¥ºàjZIM͵ô«Ð“­+*¸¾ë ‰)´o8ÞßÞ$gµf¥%U÷á84óÊÏHÉÉJãAËêDFRBFIçÃ…eÆdg#gK 5·8—º2ÿäÑÜü®Ø&óónÓ† ܲ¹ŽiŸ=Á'çõhúUA m´Ì$ªdCºÿxÕžrÁÝ—¼öÞ ­*NÛ1æî“y:û¡åš[JóÝo˜^.ጧK¬¡vÖ­;#EÙSwz½²»†ülÝú*ïmϳî\î¡[R?þîÃ{±þA÷çJÝ´óº°=ùçåmËçæo…û‡bX7G <Š( ß’¼Ð©ñ%Ü·‰W–ª½ RªPÛï&ÃÏ©hŠ16C·Õ±!scùhúõA '¼àR~r€†yЃ¥•mÐr1°ˆÂû»8Þ^\’'åVhŽÖ}EEVZRBÌ)¢êNŸo~6%6å&yж~)´ôd‘—Ÿ­$ÐÞ³R³¢?^~ÄèW²-Ä,S[ÍÁ»t9ø6¾AJ%è›ùWx@IõqºÞÜäžÔé¤cýn @ ЯZxZ)Ž÷kåÆÁ¹àîC|úZB+¼¿ë/…fañ€dù!ÍAÇéöã…{#™NáhéÆϦÆ!Ð2ôJh1̦¬BËãžšF¸ûK÷ñò¶åOïö{Gç?¿¦Åï ƒl²ƒÌ*GY¼+|úàÛG;m¯­‹q¿¦àæ fcŠ¯²¼Œc$}ã&_Eš'…¢QÜ•`ûÕÿälP¬”É&9C×D2tc¦3Yž÷•ŒF+íç)7NàBËÿlÍ‚H ô›J¥l„…tsæ¥ïýü–hÑÐXÿdKºAí±2´™˜Á¡†»Ð8ÚM˜ÙW’àë›[×Çù–>•˜–u±‚HY¹•³³¹3©s¢5å\ôõñ­ì™º 3êCs’/„%LPØ7g!&ª#., 82‰Àdß„(e—¢ýBZ§H[r§Nõ^¸^~!È?£¬ã&Ìî¹Ù‹¢A„á°ØJúxQLxDT\zŒ¿Oó¦?ç¼fhF€Ÿoy×òCˆ†N‰ ŽJ'#ÙÁÓ—®]/ññM®ž¸1 Ã,•J¿±ÓýBغPs}»Hä"±CýS(tOIòIÓëlïcgÛ40Ž™¡1XÓWUœÓ&Qèi4öLo­¨™˜FU]t×ñ¯œ…èD–03ä£*;F 3)D;3R¡ç— ± Q&*Íc˜ª ^)ͳ,*çHt·³‘9†_Tÿ§ ihyq $@ ¤ÿfB(e#´PI„YˆÅK|}hy¢qvý“­‰:è``XTU?2…ƒ!Ötk¶œSêÄä°Ÿ½m‘’c%_ÔZžä!¬~žÁœ¶?ņ˜Ó¹ÚÙ-£=¹ÆÁ9˜éA Ça21Nåĵ¶Éž«^¶ÑM0“l­®™Uß7ÖÝÓQxTÎ CByYÛX´<ñÂc²ú´R$®Åß),=TO®c´Æ)©´/'BDÝkr¼ËP×~ŒBH5—Énè﫸hhŸ³YFª682±oƒÜE_aŒ zƒ½õf!êL€‰Ewkš¡]ï“žæò¤PW§Œ6¦\W]ËÞÂHW߶E*Kô0ñp51Ò÷ˆÎaþöÞó«­l}ÐüÚÿ@÷Z3Ÿf>Ì—Y3=ýë^=ó›é{o•ËU®*ç„É`rÎ99ˆœsN&ç`‚É9 B€rŽ'hŽ¦L°+Þºö½ï³Þåèhýx‡÷¼{^¨]bß‘ñç­‘ò;æÉï«ØLxRÒ?ËÞ0¹k:××4Ó“bíö®åŠmpéGÏÿß9ˆÿô ñ'a)J }{ƒÍbž…$(å“ǹ‡»« ùÔ{ÿLµÐþó¿ýÛý¯Dü{òàŒÉ¿=ºÎ`LÕüíqÜÞþ¢³ù€µ¿Pò¼¨{*=àùÿu¾åÿ¨˜^K1¹5»¾KH¶ô.bîL=tÉa¾/ßÇôÛÿr¾åßz–V½{5ÎŲdj÷g÷íï¿ä€€€€€€øÓ‚°”¥egkãð`ÿ,ÎÛ¬Ç/þò±ØMp#u—„{µ®²ÎþÈXqüÿÞµ°½ÞWô—ÇqŒýgwÒÞc,éÇ¢®wQ.”Þó-™›)&ß̬Ñw’,½ ™; ÷L"6öÏKŽ²6)ß¼±Òåþªâ†ö’ƒì'軵¶_—õ/ïŒ×ýß„´t…Äd·‡Xoî-:Æ•G?ï<`î‡ØZ4ÍŒ¿øÿ¾Ýܽ(§?Ú2¦rêâ×}úÆÊê&ëZu+ãe¥%Å)^?<¶íšÛ>û#c¾ãÿü7›õÍ~Ë×̃}zw@@VCGn˜MñQB¸ƒYÓòîþÆ°•]àøòÖyQŒ7Kûí÷8ÙL»ÖÁdî³èSÎ÷n1+õ!¡E†WéctæþÏžÿ¿SüòâOÂR.IËæ‹É8‹³%ÏŠÇ.þr5v'Ã]}ü}íLMJ;'è‹CN¯Ìü¼¼Ã¦è»3•avNî~n}LÞÝß¡z;„‘)¡V)ìœÜov²´ððŽY ¯'›|3½º½ÝŸhá]ÀÚ§WÄy:¸y…oí¬ô9ÚÚû»{'¬3.Õ¾ÔWùCÜ “¹›h?¾ÃXiŠrr¤Fxü÷»1«ÁÑÙoŠC¬6óŽä’á¢è¯L‚ÜœBhô}úÛ²H@ïè” Â;ú£-¢+'/Š© þû£øÝý›™1‘cæH:ØÛL õñôò´·2È`2é$7G›çÏÛÆwf»íLLý}]ì’vK~ßü——vÎ~¾>”ôæ>c®:ôuHÁû·i>¦­«»ÆŸw{ Bl]}¬^Ù6ŒWaw"Ó&<§õ£'ÿï?@@@@@@ü‰AXʇҲµ±ÊÜ£Ÿ…(Àï¬ÍºøËoú»ê¯Åî0迧ˆHü!7Ä„¥|(-›ë+ûŒ³8k³ÐÿôŸTûëoÅÿóŸgþÓÿ¦øë_O!ÿÐý¯ÿ þþƒüÑË[â„¥|(-ë+‹ôí³àûú ÿóÿ„üÇÿñ¯Ó·Ä?0KùÔ³‡âã!þÕ¾ˆ&þvpŒ+Wë~õÛP‡Íæ‰eŸÚD)Ë5ŸÑIÄQ¡PŒÃÍŸ³´è„ Vf}»ük/`¬ê×ÍS‡¿AZŽéÝ‘©uŸØD0DÊjYû£Î€ö¨'³¬ïw â¢S‘ß­>ûeN¯^d÷-¿¨Åû1^¶&f¯+‡¶ /"|Z “¥C[…éQi]rÉ‹WùƒJT/dÎ8š™˜;õ,…(wZ}^[Fd·\”{8ûÆÒ6JªÃQùAZ £‰‰yÓÀ?¡´È÷Çž¾Nt+˜FÍ®‚5ž’[Ù%GÏ¥EÊ^É«Ó¢ò7-Í E´Œ²^‚ãˆ|´¾ 11}‘%d­ŒõjÏJÛžî ~Äe3Ñiï¥UŒ4%§f.ˉ߸ôwÉIÉ­ùî„´à¨z¼!?5·¦©µUBTJÛËsR3‹éT{4T”“›WÖP”š¸p ÔcšÅžª¤Ää‘õ#=®›«Ìh¯-IÍ*g*0”?™ébj嚘šËS^îÂÔ£µÅ=•Ù©¹ §jLÉß/?Âôøâp+O­*/©ÉÉ*ìî­Ï¨šÐè±!!õ陕}2¦Ç´+}5Ä~.³ Å ŠªöñöŠœôü5ŠP*èMÒ">ÚÚyKIh!~ÑÈWw¸G[1®.\}›êJ{³ÄZè¼çÙ¨ÖIW×¹¼ã:ÿ§õ“‡¢æúÞÑ)kÅÛ-J„âîÖæd‘/¥âüüÉè9ä GwÝÅ:ü]Y\HíŠRzüÚ>æT«Zž^8á úiþÑ•Ë¢‹Å">=ÖÃS }FÀ?£´,v¤Ï»Ù‘8\+¤›ÞµÙåì,-òui©zÓ—LŠÞ’¡zLèeé¾!”žL2DÛݹNI\Ö¢ƒWêö»f§¢mÅÉžP®lH ’`—¤eº$2¾v’{°lewª8&»ºlpNhn&´–µãÕ®Q-¬q»—®':]Ù¶´åpuà¥M:)=&¯%ÇÝ|=];ήpOïæñXá~$†RUk{»qÃèÍòË]Àq½–ÕKk½áØ0yºÍó‰SõRY@f;]¼?m]¸Fì]sfC.±±ì.§¸QZR_>Üs_¾êÝ<H³­ÝeNÖ;&µs¹‡1AQ;„é„Ϭ‡·¸þ‘ÅõÈiÀ ÛƒŒ›i¶2ßÌü´ š“$__)¢±µìZÜ^X^zôµÍ±3(¦ydÚ¹Ä=ßRyœ¬ÀŒ½_¬Ö€siÁÞd%¯Í?¿gîb{`tîP_CDV—;¯b² <µqö3o®Ú“Ú  àŸPZp´:1hO"}ðªsSÂ]é{¿ú¾14HËW·ng þ㎠#âŠ=Îíuí^9nÍŒjdšíoïéÝ9kǜߗÅÃI¡Ñ†R?ª»éíïîyº°1àI¼~ÒžÕ²¶ÜA­?Tëõh%ìX)r|pç[ã–wY3gÒòZ—ºÒä¨ ¼d %Óã›óBv±dõÎw…Z½Ù5ªíÓÒ’ëç¡Óãò…´ø²wÒÒD3H‹½{ãmqdÕF󛼓؈$„x‡ 7¢b¸·Ð÷}uZ´„´8„7þÂÉ=J Ž£é!Ùƒ‡8¦ ³¶nh©¢÷¾øúÕ¡ÃqŒ³Ôä’5¡3öŠ`ˆºØßöÍÒù Ý…´h›Òj‡¥œù§w]N”½;Û)¶~wmÐÚ7WŠâšÓ r…æ¼k¯¤½aiáCüóI ¦Üvó變H®—ÐÇo;6¿ÿ/¼AZ*‡W˨¾=‡ƒ´PŠ/¤¥¯ –¶(Ãõx˜›ß¶ThñÒ%¥¿ ?$œb˜‰ËçI©5g¥ä¸u1Ug?£’E?ßâuF¥­ems87aØsMš¿Ï±FúìÅ÷¼ÁU­fä·.ugÒ"$¤¥¿4.wEþ¾eV_“––ØŒ–¥%Ïÿ'i‘0çÌ3—P=REñ9“–½1BZ6Ϥ%Ì3Jë5ô‚¤¦wcµI醣;‡çØ7H *‰‘Ÿ“Ódùu-¡ÄiÂro‹–U‰†·qûa¬Á÷§=ã:c— ¢hs~3{€½¯òBZtüâêô¾)½û­Ù]PPÍ0œ¢PÇ9!*aÏ:æËß[Š–š¦Äà3üJËÉ-4sÈØÞ1ýÃs5:i}¼/‰š”œVr¢;ŸÓ"cͼ¶á+¸J‹to2À3 …A.Òáèxâ‹ìYNE¬3¥“m´ -* 5§\¬CE}á¡)©IÑÔJ ¢é-¤d•’=^f¶¬©x;^NÞ‰ÉI¯í}Oœ;S•œœ@Mo¯\’{9Â×?95%–šª»*-¸’ãç—SX%Pé>!-:Ç×Ñ7¿¬ÌÏÙùº´„ÛšQ““\ÜXRåÉF¤·_RJ2™š{¬»&-:˜¯§[š¹øU´ ÷îܵˆ¡ÆÇ'år´¸l«3Ø?$&,¨xŠ‡«÷]? ‹‹']eo—~ýàu±eJ_§×vƇ;?yõšVФA ƒŠ7Ά‡˜S-žÞ¡)ñ¤àÄz™†ñüŽ™(¤¡w…£ƒ7ÉuÓð‰þ)¥å NØ€T¥ÓÓH± ˜; -Ÿ+ˆìÐùù÷ß|û¸jtœ@Z@Z>KiÁu²¥æW䎕òOÙ2ÝïÿÑ*$<9òG!Ḃ¬ÐÂJø2¤ÏEQ VpØ’Z3ôKûƒz»Á î/¯B.´äQêõ3Œþl$©7š £·Ôÿ ç—H c¤öµ¹ÉK陵StdE<þ< ¥Ezųp´?Ô¼kë£H:žÍëßãÃÝŸ‹´'<S Ò²_UЩÇt[CµÉ ‰Ót½o f¦&eäמ3¸Ò§:“R³Ús, Ò‚©g;Ëßn/éäÜ¢ö™Æ"­¸åz/ÌHMú…´ÈN¶sSh%m|5&;ÞÎëËKOn5<‡S–f¥”ÕÔÓ*ç5¢å4’ÏÃÇ–ññ ël)!-Îù½©É‰ýƼú„sh• µö†ÉÉû”´5aâU©D+ó+< ƒê˜Ñ¶u]ZóË’Óóè2¯´ô3ÂišFW7&š#}Ì\CI 9í*CRam~zZN%SfHÞ¿;Ý•’SÕ©B`ú0üyÒboç;<<Ü_G Ïïe§EF¬ÉÑÓÙ!úáéÆ`©YÌ(¢Þ÷õ#Ó¶CßØànõúf÷ x¬@¯è}®ì>|ôzjO 䣗f†x-ðV;“Rª'ø[#·ÍS aRh„Ñ4ø½¨Ù¯KúÁ©Q‹ëí}OKÑS7Ú!kÍÍ7]Ž”£5ÀŒÖ²|c_kc²µ25ªböÌipLò,9¼&-/Ãózöæ;¾·ÌUhE”ŠÃ;ªFwˆ×Ùã‰m;\ã†Êæ€çofv÷f]‚ÊQLëí¹}*Ø[ŸWƒ´ÀŸ(-N®t:}c$–éÆÐoî|oäa5CÍ[¨1rïû;ß>´Í•ïUÆ•öëõØn™¡§¥6Ùõöù–OŽtjÃ4¢ïc3].¤9~øÕ­³·¹¥×ó·F͊阯J Û— ;0•˜ò`âÞ ÒRê×ÂÆõxL(ùäç&Ôˆ¹“mY¯“ûˆBcQ°½’Ú´WüÂØÓÒ±.Áµ§öß<9T`]yq éÙ‹M!ò¡´`òýgùÛÙ±¾pÖ -ÀÆÖ;ºíÝ>‚´ÀŸ'-­ôd“g¤g-1®¸Ý·ÜªeôBZ”Üþ¨¼vâ‹ O6¸9¤¢µŸÂÒb7ü1›­I¯Ú7¤šÇd«>Ñ“_ i1/Ù=—•4à©éŠP'\ïÿ©§Å3ãòœ– iÁÕ‘\ýÑy2˜ZdnâËÑé¹[CV%BÕµ]3ö´Ô¾;FåûÏ¿±ãª1Éz›¥SüóÈÁ3½a'µnŠÒœº}÷ˆùÁœÕŠx‡•A¯vùj¸ýà"-já~”—5)1–šÅÖhº’|“² ó’ÃÛæjPUqJ\NAA¨í]BZä¬ù¿À¤”¤J!ùi9Yîqô!¥WÍjqd².-4†OmÛøPZ˜Zì` ;0,&äw×¹ÉÐI¢>NñqÉÌÉÙ9–_•–õ×äDÇÄ„ùPªgtNÀÓ»Á±T‚ö·Ûפå•[(9ŽBiÙ1<H'ˆ7ý±iï|j®ôpÜ38.»r@aì·E¡áÑ ”¬²×–Ñ’“‚É·ü9Òò9£*±B­;^è0£Î¡öÀ ®SpR\%Zî(iù´6È— ܹõÄ&Œ«ÃÿlgANý~ŸØÁÀ`š €´ÒÒÀ¿’´h”⃃¾ü³\ƒãѱBóëæœ`:Õ_…Ø|!Ò"~Ìd†8›§F‹ºtjùÑf]R×ʹˆ(?Ì酅Ƕ𪠡J.-ÊûÅSljQEt\Š»¥ éD{“³è¤Q6ž{Æœ´Ä/Á.™MÓçG½7ækÿꥥç¶D]>t¬ÅtÊw§·{RTuìöÄ‹§†g À—!-VVVd2™Ãá\WŠÒH·ež˜@®ÒÄדÒ}&-˜xc #9!=·æ}ÿŽ„äÌ‘¾Â ŽGdõy†¥Ä‹Ì3§Ð(åÝ K€§ BâjfOéã&žå25¯µ¦ Ñã’ÎÎÉmL«XÝÜ |í4/F é2+ÚbLÔ= j¿þ$C){Þ6kæ,-ª:y'…ÅêÃäžN¡sû§‚c_d‡¸wìs+c<ê'÷ “jqt»ÐâW=, € ´XZZ†„„˜™™µµµ¡(zIZÂìjz vÄW¤…;7Lgs7‡ iüuê}ÿ€8:k7êù7\á|­E@­XÌ_eqϺ><žto\¯:ÝÇ©q>µ¸eýÈ~O-¶g%v-‡x†mÎSÃE»º҂뤾žŽ,®./M<ýÁUx5ƒ­žù® sþôü0ÙCäεÂøØU9†‹G\².';ØÙ;Ì×¥hùbÑ´f¯4£gîøR¤ÅÏÏø÷ôôôjOK„Óð&@ U]’ãÎW[<}ðã÷ߥñ§”ÒøïUZ npµÜy›#²79ÒOOIòrªêjÈrxd½-Ã0(îÁWõ ì‹ ÞK‹ÄíÑË7µÙ5¦?¼æk®–ºÓS·-0îº^úº…5YJ!÷Ÿ §mž¥cøOÒbçòày„ø}g "ì‹h˜û¾i±±±éééQ©T×^AJ£<÷?˜C¢ã$v,é/Òø‹4çiüy¡Y-ÄöÓ±Œ£-ˆFÁ=Úr .6NUÁUb¡B}ÃðPs´kÉ´P';zö2š¯Ã9‹UŽÁ…bä²´`ªëÃt¹’5ù£iªâZv9öb5eÜðDi\Ë yò´µw°¿%Ûſױm¼òØ…´¸wªÖZÃcÛ6ΊPm¤ mÀ}_„´(•Ê¼ûª´`Z^H`pr~«Õt'û&fä^¤ñ§„FÇ'E¸>ÜàŠ6Çb)ñÉTRRí„a´éãÃCŠ½á`Ÿ€ØðÀ‚Ñ”ÎÕ¢+Mq© S¨šŸO1yðÀ—”²(B$kÍAaAAuËâë½7*î–Ed·ÓËvG¼.5̲AxTg† –%†G“£)ËBUvˆ{[‹ªEÁ–v#»bâxÆH§˜¸Oà‹–?\&“étªÁègóL韘8ª®öZçkÕ»)ÓÑ9W†Âšgø’–Ò»¯¾þ. RûÉuã†ÿÊ”+Äö(iZà_JZ@Ziùuà8v|"úøø®•pää÷Ô )µ(\8iùåïíHjfœ¯ƒÎa¨õ8ª)(T}4í=~Po÷ûÌb‡ƒ™[Çòߣ=‚åZg³±ýg¿¯¶g™>~‘P;g˜o‹ˆŠ#œž½tZ9‘ë1E;-ôñãǾIMRîø‚¥e¥8<½w4?™!Ç„$eGq¹ƒBZpd¥2­¾¦sÎÌ«P¦S¬-®ñ„‚®x§Œ7›p«À—+-‚‰LRN»Û×5Ë$JbXY¬rö-4äjÃu]îwòû69³Mf1ãˆzÏ×?n—µþäÖÀw«+Ç9¥‹Ç^rðJÙšjq*Ü’Ó2eCbär/Íq58£O,à,rÎzW°Í"«w ‘Þ8… ˆp{ Œ”«Á´=1¶åƒkìõ!SëTBVô¨0öÅó<ëP»Wi”ä´5¸ztmqy¹›T¹)Ì q¯™gŒ/ì:¿pÜ‘cÆZðDÒÑC¸UàË•§;Ä'Ð.¦/¼®).¯YUZîï+´GãÏœ*{•q¥†4þ»e†ž–Ǫ̈F–ááA ÞÞÓ»s6ÙÕ¾¦ÅCI¡ÑWªP³ú,Ÿ½Š£•±%jü²´ªÃÔáîþK"׊|ÿÃÝ{žÛŸ*æ¹ÌÒ¢cUFÕ§eÍõÅç/ó3ƒÜËûú‚³GÝ_Ø­KP‹ä¬~ïäv-,{€/YZp5Ãûáì%®³CzÝøui™`žK‹Š;`”t!áñÀ·¿0–¶ Åõx˜›ßŽLdùÂ%u  /8ŒÒzƒ`¨ä¬õ1“ .íiÁ´C«æéÃÓ˜Yès“…ÓÇ–P™H¤ûH’• iÁU+Ή¨Ìsz{,ïHôÍ™à£J¾¹EW‹s7-Ë„*˜Ñ_¶´èqY‚ŦJ[îö¼t`_ÈZÍɦ=6qÎÈ.Ù‘i>”-¦*I‰ËÌÍ ³»GH‹t*ÐÓ/>6”R6¢ÃÑñ¤—¹sœJ²3µ‹}¥†ÓÉf25žžÙÇÀPYwIv¬ó½pJjÇÄšì`î›ï,Ói´‚&ŠóæÂC"¨ñq”ôVàÐLJ‡ÄÛͱA¶Ï,²Ë:p-Ž ‹ˆôËTè0ÅÁx¨·ol¸ÞÀ.¦=òòc`4™ mt nø‚¥¤¤€Ï[Zt*Ù¡è-FU’#®üË{|2¦<ØÛ;*?½•RÊßÛÛã).–2á:Ù©@¢ù`\%:Ré~öaøé)ýMg ÓÈO¤Æ3Œ‹y'ÈÏ‚!š#¡â|+³÷ö˜Ý'Þ† ¸\Ã븎ÍÜãpÅðQ>i{»FÀˆu3ôøÕ›™ý“¥‹ŠìT*^n°ÄþXiÑqÉ®–fŽ‘'ÚmW”UJËÔõÆ·!+òåc‹!ža]3c¢ÉÁìé3Kï5cÒÝ«(f"óÞÈ”ÚOïˆV­Ø™©È˜`]T!Z¬ï™9úpo–Ë]æ9²kNtì`.üi5ÒPÛ¡À~ËÉPÐ{,‚:ƒŽ¿©–þ\!já–KÞ$ö^Z”Rqc&¹™­û„xæÆEŸó ò7BÉUðQ>i±²²Š‰‰áp8×L@UáÕ¿Á N8<!-¯r†2’(o7ŒM®¤¡ 5!­€n|rV¸Wž™DŽÏÜ(Î¥UT–5r5˜J¸›H‰OÍÛ!¨FPÑ¿ŽéñÝɶ iªªÈNÏèjL,èUÚ`\-—jÑkm0®ë‰xU>¼½7Yÿ4°M­b×µ ¡zL8[:¶uB¼~ºÙ[Wó–Ø铹öDj\zAÏø¼}£ ηÛÐëÙ»ÛûG\ö樉GÙ ¶ ˜!W jCÔ•¹U< Ž#Òò„ ™í,'“ãòÇ•ÆN þN3mò\Z䛕d2¹oîüì­ÕS“2«ÓiQ°WóÓÈ”´UŽS¤“B¿ûêaD ¹}’i¥´T*™öæ,O¦å×ç¥&¤ä*Bn:kJ› Râ³…š«{‰ÉÙÉÔ¢Üø3ii­L''ËŒ[{ÛW™EìLÇ ›Øðà]35ŽL+mj1BZÊrR¨•Ýsgåô']H‹˜½F‹'§½h0Q V¤Siå¡‘ÆsfÈ1Ò|ÒbiibnnÞÒÒ‚¢? jàŠuw¨‹Vód©û–9u÷`3Ì/J‚hÚCÍjßn±Vz¬œ²T(šîS3±Ã?Ú>àËi± n,öèX<$äf2Õ²kùð”¹É#ˆ’åNDõøT¥ßºLêÔ×Qbâ×ïd6ËÕé1Eî‹[ý[ÜkÎ"õ}ôtx~yaaüé®D+Ü]—×1bkÊQ ZÑnRD²`-“ZkÎì0ëT°Ôšâ›={6DÕ˜|&-çšq4mOîÐà•¢ùéX)çî:T«0dsažËçöÅ›v,_‘bë“C¦\µãœ¾Ç\|vŽ#“îo,íñXKÖ~¥„#aÊ#“;ž‚ŸvDG K5<×GG’œÓZfw§[p«S"’µí_5nÝôîèÒy@E¶ß·Í1úò#MÏ{ZÚÄ`¾ñ"ñß•½o’Šù«‡½eÍñ…35¤˜Êeµpóñ3ßæAA¤Ûªq˜èBZp/5Äå·ÚŸÙ4Íši2¥vnX¿ði>Ciñóó³±±ár/Ù&žwñ&ã?IKyÙ>¦Ç "d§Vß}{÷¾K‘Zœy1¬BHË_¿ºõÍË‘ÖÐ$³Æ2žYyäÔH´Ø…´¼«ð%¤%"¸ÿÇoý’: iq¤>ºÒŸ›¼®þPZã¾·¾5^Éû~ùÓäÆcbC43zZ€ÏNZlmmûúúÔêkí8"ˆuñ¢?I‹qN‹QZ”b¿{Wùï=W‡ûD󑟤Å&¬•þ&4©u^o|(¡R&ž«"GVl!JŽkrªGi.gÒ²o–•Ñ3£´` !_}m +Ž©sm ÓeʃÉMÓ(¾Ñ•ë•ý̯A‰êYÛ3£££UAž±9ûÇ ‡GŽ' h¾òº´à:-"héXqó$á¤EI££ÓËã|˜á GÄ—kQô°Ö¡lÈ 'z[Êóº´ §±µcĉ!¿šãÈJÉ¡},9ª“ÛZEžIË‹;î|Ý ÒBs¶êgª1ã‡;>|­8)"îfiÑò¿yÆ”£ü¹¦ë=-†_4JÞñŽCP…J¶ífé/Ñ üñ,¿Dƒ´˜µjpýt¹žc8}%Iu:ã.ùú%\ô§-ugemkJòi>7iQ*?¶^§O4x„ÆDEµMn~(-,Æ­ ‰ Pȉ9ZL¿ÜSìJŠ§Pç„çsZ0u‚¯Ïà®x¥&1.!1< ¤wKŠ!ªø€€ô¼"’—õ Òò‘á!bO¤ë­A!aA +p)2:C¨ÕLzTŒíž ˆz;›ZûGåͯ´ìüLª£QZê‹ÒìÍž8‡Å Ê:RüŸX¸Ç$7ÊÐOJ‹^_ïmç›a¨[{’ž[P˜ò²Ü(-jɾ·wpb~‡ÕŒ—g%ú™Ù{Ç”×÷¡˜2;žœ™“ío÷œ–Õ®¢ ­07ã±I8!-8¢(°‹IH˜?V‰ö sh榶©Y+”7ßLë?@1ÉǤE£û])”dZ Éë!-ˆ 6?ÓÝúerVÎ8S XŽ!SÈ©Ms("­‰óÍÌ+¤Åº¥…ØE*5:(<ùl2g¡ÃÙ;"¹|N‡#c5©!Q±äXRÇÔŽâtÓß”›“amíÒ|nÒ\HK¥€q$3ñ&iVú³ƒaõÒòy5ÐçÀ™€s€´€´Òò À%<òG#h$§B…î×ì&bïkìw׌ñx FEàs’–O¤ñg-´›>xèHªÝôœšŒHòÞOÜAg:*$ؼÿy዆d,¸r·ÓËÚÔ3ºÈX•¸€äöàÑÓ°‚·ê+5bªLJ{¢¦â©M™Wþ"û©OŸ p Àç#-VVVÑÑÑGGGW_Ðr"Ü}öyÂé"÷Ìö%s)£¹#-Ò1½‹é¤ñ”—žDŤÕm`¸¾£&-&1_zžO^6P™?ÇäëqíDqJsi6%¥ø@á8¶>Ô@‰‰É©íEˆV-ShnîÒ@Žý’›º„k…û;³5®™Fi‘lnìòùœ·;}k§W¤¥Úþnqnz|F)K!Ü‘î%¦Þ©~¡f‰ßW›çbmâ“ûV‹ëåÜ%&9¯áT…á˜v¡£4.&¦´cò¬$ÞTi@ö$ÜBðùHËEÿæææÓøëŽû\Ó ò¬  µpÚ¿± ‰ÕÒÔȈ}µÁ$¨¾ÁôzZZSüyFiÙìÌqIëæ±W½’…:U¹í]5<$±¯4fZyövav°Û"‹¿9E-Ró¶ïZ¤±:c÷¼v጗g"ÜBðYI‹¯¯¯­­í•4þÚÃv×à,ƒ-µú¤6p:-« OynÏm0&Sý˜´´fF5² $x{ωUn/ØRj«Ú7¾G5ñnÎäÎé=ì禌¨×S²ºo”G7‡JÜË6®Î¢ÁTÕŽvL±éé†ã8Í×óí#ÄÎSa£ iAx¿¾ýЈgrªâû½|ìž0¼Ì>+Sn{»†Ã-Ÿ´ºÒßß=?®X÷tBõ¸x‚W1ÌYh¿Kš&$¡:)xÔ8ك괭¾AZú c3¤¸sóÛQ*«Ý^ÉÎ¥ÅP,ª ŽŠ‚ùZC!:µB QÞ¨/˜°?ªvâFiÙè- ¦uë®k¦ª´ûa…#×qÇ]Üiá¾Mõ÷ pÏ]>Û––wrã†òMÇgÄB%â±’ƒƒågÕŒxøfÂ-Ÿ´¨Tª›ßŒ#ƒ¥q¾aQî.‹l9g¡ãžSX9<<©Ò8:¤."û“‹Úè"¬Í£yÙ˜$Ò²Fé'2æt§/…_1ªÃTJ ¦“ç$ÅQ)±á¤L5jP†O éqy@tùYÚy-»76ØùÁc3Jb±L¶eóàqPT Á;:÷Š´TÙÜŽ õ÷«ž< sÒù>9þ~J-}¬Ö9˜š^9­Ã‘ùÖ¬Àˆ˜ØXRãàŠFÄŽ#S㢣S«Îž¡ÄèÌŒm¢Ã-Ÿ´üB8 ¶ Gò"àþlÊKõ; À5¢mRD*ò«ßˆUfç0Õ°æ¾Hi±ûÓ¥å÷¢c™~w·yž wüëH H -¿KZpÝáÎΓ~ÆÃBrÑéΫüEÙþQl-½á©Å8.9d‡ªÆ஀ÏTZ>‘Æ_¯;õ{bµÇW­<¦—G;?¼÷ ½Á‘á“{F^YÇ(P|µ·ðù½‡ž)ÊŸü!Ef Q½Óä»Yæ´ÍŸÉŒ>àjñô™™ÇžÉ ó=ÕaI¤Õ;¦ì·£N­Üœ(ÍüeWTÇëÉåKÈMÒ¢‘Kb½ý·Tp×Àg*-VVV$é†4þFiñf'Ðz6‡K[×Å1óàÅ‘>ÏïÛfXR©T&Wáê=/ÿ„C>o0ÉôÍòY9¸|5/óÍa:ÇÚ3=8±1ttðì#Wy‚¶H‡¥x;÷íŸEx´/]ɹ¢“s+²H$JÏܾGWªÓª«ÊÈÔôu ¡AÈÄ›âhRLnã„ÊèHG+uY iÁT'9IÅrBJACq%†ã›£Mq$­¼C‹âZÎq¤I•+gb%:\2TR°/;_ÒŸ­´\¤ñollü0ÿi9˜o±ˆ,›]ȵzƒ´ÜI*lìêꚤ«÷«³Û U¬g‘Þ,”E+I47]årÏ èÝ”FVl̺ S÷¸M\èIŠ×kwßÊõëÃOZ)ÿÝÚ¾€»O  HŸÿ£¬ŽUîJç“ÐaŽl,-ñÜ^òÓ5î‡Ò¢ÇÔmÁ/VŽâ•FOr;ŽkœcNŠ &çKÃð³O(‰D¢¦+tººÔÈ °033–D£b¹ùæž Çˆ7zL77ÛÍÁõŠ´¨4'©1Y¹¹)!&uFiQòwÜ=©¹]*LcH[¸EDɱm~J\9&$"U®E·GÚ’c¾{曞Q~ªÖ—%ÄRãƒ}B¦ -ðùK˧ÐúnþðÛ[wžT o¶T1½^Þd|¨¼Zæd!ðõ‹¿üÅâH…éqœ³Ôðäη-ü–yšßÚ2ë:=½ÝWüzaÀöGÊLîÞ~â©D°+/ž¬õ=ºõy@¡P‹ã¨º/Åíέ»Ùí+×ÎÖ_FºëÛò=ÃhEŒ0›ÇßÜ~Ü2sðKLÓJìÜs¥:YÕóÖ7ßØ…ñ5ø•½T0ížþxÿ…;C¢‚ñçßøúoÉl_¸²ÏÒÕrˇw<kÞ—® x³E2†ÝX»x*‹T0c(½7ûÉ·_ú$_Û?˜i~pë¶uxµD‡£Ê“÷·¿ùžZ;†_=<|µ#ûÞ­ïÜ’{Õ(ŽëDEAßÜzлv|ÓyÀçk©¦NT Ç×ó|ÿö5qè·ÃGØW7B•]ñŽßݺ[гn¼©Xþæšù1•Øo¶<\ÃMuùÝf³lþ%~ìqm§ý_¾¾Eœ±oLí(Z ‡oB¾Hiám„û„ŸÈä3™Ö5cŒ½±jË´I¹ì4Â/âD«¬|ýíÐÆ)óm™mTªe¹gñe’nŠùäøUÈOæÌ£šE2Aq„+S‹õQòúè|úäÝ×E ôòÿÙÕ X&—p"|"ˆªÖ凮%ÎáTí« –+ݘFv´¿òø+Kƒ´ BŠ¹É>_ÉËòŽï¸R»dk(2ÀÓÃ7j¯Òë‘™æL—(Z³èŠ1¥…L¥xD¯I ý-GË}î.¡) Rí•F;)õvw ¦«1TÍv-;Éd2)v¥ F .™r¥2 ­q‰·3ø,¦O"㥇øj¯¶"bÁéX]d…QZ†ÊãÒ§Nˆ“Çýdߦ<Ê‹öó‹Î1qÌ–"š£¶L¡˜ÌñI¨]¾Üp«cm¬†öÄ„’~gW¡BQ•J©” i6O&®x!ª'œåòÀ3iÁÄT_û‡wï9»x¾c‰®Ô.dŒy¹¹ä¤xҢ䮿Žk:çáZ;Žp£½ŽeŠù|§’þ­Ý±jë’ µZšä·wÅ1u‡ÞA©<™d(þåÐ6o¹)Õ¯dA);vñL\;2;%Âî\Zü3{ö•J¥½jLÇ+]bG¤2^bPÀ‘VÓèó¤eæðh¾õ‰W½ûŸš±œ „Ö gí…S–ý2¥Åᯣ§ÄS©µ88 _¦´o¼#iË}-GËñucok©ÉóìæÞåÌHŸ‘£#›¿Ý贶 WrÚ‚ Û'ûzwÞRògXŸ¨ât¥4²wµ¿w¼¿*¼ñHC¶·n˜êž6ùÖ†­ºÚ5!Zkͧ‘c²ßh5|‡Û÷GFúÞŽ÷š™ø+«_¬˜‚ýìk+cO ²Ô’š•G‰Œh_â]ÙLz°½ÇáŸîN=ñ¨QbèáÖºP"™-ó*î¥_“–{iM3‡ËÏì²”J&‰”Âä 7ºã*Çw¯ÔÌÝX8J6{2²ÞiØMön~‰‰ÔÀÀ¾úRËŠJÝ\B·ûjèó%¡iÛ£Ù1ï»z§³ƒ;Onp‘åöØ3i­¤RYˆêÄÛÌbFü©–µ?34©}õhµë¾Yšôý†íÏŠ‰ã+ÒogÑ»#lþå/¶§ÆÖZÅÛzîZ*Coh±´MA=-¨ )Œ„ÝÐîÆÙ[o [â\# ¦¹kö>!‰‰”ˆdùå­QÑ;ÏÀĵ¾&ÖbNli¿ât3À3$??ƒL»ª ·; ³aº¯‹5Ÿ=ºÓ˜’?½SÓ»îⶠ¾$¢Ì %nlÚ;¤…ÑšàíV2Á¾r<+}± ¼ŽÞÙªÔÀž#¡Ç½'£CCo‡^ÜwÿÖµ¬@ךɥ¦e‡göt9öå}ì=-Ñ)¹%%%M½«ÐÑÀ*-ü&RæÛòŒƒ¥œ¸êÑ‘jrÆÜ^zùÛ,’ïëÐâo›J:zÛl,Bä‡M!Åííåe[ãIÙï>QÅñbAlÿreykuT KýÚ¶©¯» qÔô[K–âê¾NÆÝYèõ Œ«¸v·õ·V´twZ>÷‘\ZpDZìgÞ¿´;\Q4qe³ÃéFOgGG»¯ĈtªÎÒk{G‹)õÓפåáÈ®W³Xq¶kž?yéd„6´q¹bí|c’“ƒƒ£‰sT£ŠYi6@4¨+o"j²Ëõœ«kø|9eeº48¥nk8ƒ:}PTÞݘÚÊÑ}BZ4ÂÝXO‡×®žS¢OýOžâ7%ÂPØÆ5Gj(Cë#óú´×†]Œg{¯€Ð'_Ûž¨‰ÓŽoõ&å-òn,ö—H *˜³·‰Òb8ÿmzTÁôñbžuá±ÙÛòÐ7'èå.‘1Ïà¤Éò”Ý…üèâÞ£…7¦QŒÝÅ¿pöåa,Ýq[PvCwyÑÁ|JÆðv]JPáÄ¥|>ÒÕuVx©LÁbfBmßÒÛJs«À]áù᪻÷^$ˆ/ûàrwJÂÒI^y_eZP;‹ïzïyw[]]G¯é}‘ö7¶Ö4ת¡Ñ´šwÎÏì¶d_`W‹±§¥m|ãààà˜'…ž¾Piž.úÆéô8»Á¹¤c³¿Ø©ú×ëâü™jYÚ“¿.)%k­æÞ•:õ¶[t¢ÇómvùŸ¨B³I›DõhK‚ë†m¶®jx›ß=K” 7~]b™¡« EÖË[SL…l«û™Sñõi3҂ɶ_?sjq»ËÅ?íÊfñž¾ "D+Ü¿ÿ,VÀ}’…á»% ¥îº´Ük_à¢âõ—}Ä‚)?jåÿ…Æ仯Ÿz‰5ªØ9²‘-ºdôíÖrKhþìr‘'QNÄÉ<í%QË'Ž×:Ìr×1=RBòÚQãŸÃ{ 0™¿‰‡|ªE)ìdëï•=–“Õî§Á-Š¼…(R̘ø«E… Åõˆ€jkÆU"¿YZ0Å®—µÅ™­äˆ‚i kľp–Øl´,¸ƒ‹^n!C<ÉóÀiõÉi[šnŽO\U/£xw_Ú\C÷ /"nª­b«ŽµãÉ Jdûqûy:G_ ­ô`kkkm¼ÊÌ*)9ï1Qóé÷L“%—‰5×ô²€AœöœpŸ]µªÀæî0]¦`ŒÜ³ÊU¡¿ªµF…¼óAª®¯Ü·\D~üÂœ,0œmLÆ;Ui/Žáñ~êRËÄB‰ê§î7O÷Þ0DÃå]ôáJ_ªÐÞX·N­àòåøÅ=È;UjŸ¬÷“ÚjäXu±%Qöýd$ Óòxì½´LíI/)6À"_”´ˆDü©&š“‹‡³o2[ªÓIÙÉ~N.N™MSÄÿãåô7w7ÏЉCâ[ëÈ‹qqqóŽ,¸6ëãrë¦S”Æúº¹¸’2[ˆBTGÓaž®n^í¢+mÆîL£—›«‹£#¥°[‹ãŠ½?¢:à·Lå•-u‚E7Ç[¹íè±%QMÕ&¸¹{¹¹xµÎ^‡¹Þ™ëF¥Æ}ÿ$V¤•T&FÆÓɯÓn–ÞA!îžSÇŽ U¥yøøO0¸—6ÄT}™¡Ñ)qÞ®‘8¦«I uwsóM•h¯ü§ß,utñtñ¦ìðµ¨J”âææâB-î½~¾º+©¶¯˜Ø»VŒmªŽýÝ]&èŸnVÅôÑ0ÿ ˜hÒ=kšTÅö¼÷íkW‚Ò¶«Ók…ó•Þn.ÎÞ!‹\Cïo¡ÙÜ¿NwÓÀ€j§ÜÓÁôî£á”B ѬDZô8²Ü‘ígY0êäÅÑ~îîn1yªk‚9×–k¸©|™bŒ³êïâìåá–\%¿ÚKõS]\Ü݃sD*T+ S¼‰ÓçX2°qã¦;}{6<Ô‘G%n0¯ž þ•ÊQ%/ÃßÑÝÅ%©|ˆ¸ý”Ìáw7w€¡}å¯ë`@Ž=_8³íºút‰äåâáêÖ0{„.ÿÅW]«ï‡ätLs“PÞûC›,ˆôLè»PÊ‹'òó~6Éá»LR$èùÕj•Z¿pcå{c5ßÛ”©ÏΦ*yõ·æÙ÷c²:–Iàé{ᘭ 8’:ϵ•$½¸¿ÀSž½¤ä->0‰7è”qxÈÚÞp¯„’s Wá¿°fêà€/KZ`í* - -€´ÿ”àÒ•º9:ÿK>lëmƒ@‡ý+]5t¡‰–UÑ'×Áš@Zøïš2ÝÎ&âÊØ)¾N.Îgq%K¥¾ö/=kÏÚ‹ŽÜg7ïÈŸˆ[ëëæìEk=›ˆn˜ˆë}}".wÊÏ0×%¥zälr¢údÁõéãnî§W•âGón.®^¤Åõ•×T{ý!vMƒKE4Y¯ï¹æ×ú¯ oX*¡á.{<{Ø~JT‡ U$¹çÁ?ƒ§¼:½–»Üêáêáê9ÇQãÒæêì_­¹a5 .Ùé|ô­éš CU¢Ü`7wjÑõ‰¸ØX]š¡:ß´c9‚*¹W77JÕè§Ûã¥îr/wWgg×ê‰}L¯-wüÞÍÃÃÓÓo†{iJ%ŽjJâ‰Ãvu°þÛÃx)òþ@:<êÞîÚ :ó WÙ‹¸ÊŸÌņ¨øñÞÞ^^1¹×'âηç:9ŸOÄEä'i†ÙÝΩµc×V¼%…x»¸¸x„ç •¨V¸CõqörqúØD\¢äÁ\Ÿ ¦Ú5\å åµK Þÿê‘qRÈ%oˆígÂZ¼vñôô®gh~ÏG'eE[þ˜?ôÉ—ÎgR¢ƒCbsº”—5C+áTÓ(Á!ÁáÔÂCÅÇïp\[M‹  Ì¾Ï¯‡!Š «[3,Åõ%€‰|óº‰Ø#‘å løVàK‘áéb€Y§Çß/yv¬b–<ûSjÃ&¤×l»’* KžólnɳuêªG›ã]7Ï–<Ï 4\Ã’gé ‹sqSQüC ™`q,36==)ðº´H¶Gí_ÜûööæY&Ž©&'r2ÏçZF\C{*X°|u.-y~B¥R­EnÈMc‰9´`BZp-Ã;8‹8:f¹yÓÜ¥,48"N4}Ài…³e.¤fD±jOí$Žn8ÝqN ºZµìÀÍ&ÁÙ™–㵎W9k˜)Žò¢_^òŒk÷}’‰ê«m«Çv7{Š}›ö”J•ùE9@åé+ÛT ª­ °çÉjî#™7ðñŠq1Žãs­ißýð0•lV{MZ0Táøíw÷ÉÓ¨fçì*/å]_ØŽÌWFþðÝ·/]â˜2Dr8êP8‹áhg†ÇŠúJ«{l\ò|ÔbXò¼;VeY²Gœ‡Ô ¿}Í;ŠL’ nñŒKžÙÄíçqmÉ3†jkã\¿jáz`´)ãU¾YZPædÄÉ4$Ë%¤åIûü±J­ù]ÉIpl°.§³#¶ð“Ò‚i¥Q‡ Z¥Ü®v\>”XDoEÚ¤ѪU'MÌ—"Î.nÜkJ\”kU¹†¸%ЩÀï'v¥ -ü‹K‹1¹\F-š¾”}–\.mv'ŠøÉwȘPþBZtœ¦â7Õ´Œõ_”\n1+£¼ç}r¹Úö¦Ä²¾›’ËáœþX;‹´úw˜;î#·N1[²‚®K‹N)J••ÔÇ/…'Þ~ýÌ~$?²·¿ÊÝ?ã“Ò¢­Ìom®¶7·z»'¿òÍ}2˜Øð–ÞSJH‹î´+ µ¬…Ï^KO麔“3lï[ ‘;zj]ÜT̪ÈÆábZþ»Î¸’Í+3@†ÊW…*BZŒÉåö’3êë®%—C¸}~ÔüvZk53¡yº¯$ÜÌ5ªãM…{Ð/Ê/Ùi (™DpÝTeNÛ›FW›®Í›Z4LYêÊE0L¾’$SÊ:Õ\•ŒQöº|p]¥V b§9¤Èp•7&ˆ«|¥aÅžJ£åŒe &Q­¼(ÜåµÃë ¤†+*jL.—ÐO‹XŸÍ‹.înNH^8 g´ÄôÞ”S?}ÎiëR‚òÞÎøe¼¸–\NÎîõ-QȸéŽfŸ–9g7¯ª¥23Ò92Ÿ°/zCn]SS¬¿SÂàéoÖáb}JÅ8kŒüiiQñvHÛCe©´úÎ$Çgö$ÞFe´LÁÞ0)¿©"Á3¬hã†$àì¯,N%„–µ‰TÄCéy¦Õc{Ô¨H _¨´Óøgn÷®ÐÎÒø§,÷ŽoeEú¼å£J rÚTع8>¶û‹Òø¯OŒÏ¾Oãß>½8<¹pS=ª–ž0W"CHñ¡É&éy…þN¯Â ê—G èoëý£’ŠŠ‹MÍCŽÄt‡gv›Ýó”–óVà¨=(¹vêR½ÊS«Ç¦©y…!nfÁ9ÕBv¯_JÕêø°`91£wõr“Ê|}ßle¢uî³G²ú°>´~|f|j¾=ºrç’*hÙ}ææ.E…¦žftNÓøŽ/7]Kãò‡}â 7Æø+©ÉofûK""F…Äîf„xÿ\Æ/>cÒ×?éTþ“P#r¯o)ßíuñËÅq\Çn 5äŽÃš\¯áÚn§¯f˜çYòÓö ‚â*3Æ(ùÓ—¯2"­‹LÉÊÏOô Në‘°FÜÒÚ8§ì’8Ÿ9É¥‹eLãŸDïæ,ÒøϾIŽ_àŒoSüy×µè$M™ä†y†ëSC çöÚÆ÷#®¥ñ.¦çO0ˆ²{3?¸v{jB¤¹É{qüdc~‹)0ü¬\öJ¨–*óÕîÛ\øVà‹‘‘€1VsïÖm[R½TGüŸ\VmsûÖ½Úqñ-(_${ë«¿þí+Û Š-4§þx뎭ÿÿoï¬ÿÚÈúÅÿÝ}îÒí¶Ý¶.PG Å!Ü­¸C‹×`%¸»w1$ ñd”; ²›„ÒÝ{ûýî³û|Þ/~ˆLFÎg˜óž3ç|ŽîÊ×HíÉñ½iq+®rœ¤Þia¹g·|l:õËæxÕƒ›?Yårf.jžúËÉÖ{_ßýå‰}ÈK»`JÊyÖ·~~âòa߬„n«â¦Å?ü×מo‰·üŸÿjqí'·„åWrÝ·Q{½Ø–wÛâºCL³ÙÍ;©ÞŸ{eyó‘c´HK’1R~ÓâFP~?~Y9P‡ïcxúÌJ `ø§Ökÿ„?aCùo_yså0S - -€´üg¡iÈùÝø÷ÿƒHý%@ìþäˆ,ãê'¤t©öÕ³G¹ SÿËmšúG¾ü¬ )¡†õã i wE¸|BÈ–1jËÿý+¾5NAÊÀÑ?5ñ뜢±V“ÿ¤ÀLZ3C"’3Ýí=÷µÚý%O{·¬”ÈÌ& W±B˜ ©i4ïâ1ª*ÁrÃ}ãRRÜTøñ:IÎ7§¤eÄ…2¢MM ÇÛÑQ÷y1/×È)JNËÈ óóÉé}¥w îMK9ÆÉþ¼˜€·!%=æK,µ–'§¥gFÖ-ãå¨|ÿë¢Pá¦)bÄcŸÁ±q!̼1qBpJSiN/Ëùf‡F¨KpeÒÂóHoÿš´(++Åm]™Û·*¦›š^d° åM+"-eáŽÈú¬¶¯JSåûÆø"+㺞 ëÌÏJ=2¦ëÌ×-Íh ß\V÷Õëªídþ·dŒ'ÈÌç¯W|¤l±ñù½Ç‡8¡X)Ê¥Èf>¿=°-½"°:ù®§+óc~ƒzl-mòûçYúõòT8o©_ÿ27óÍ rÕɲX›Öqp©´ j‘;#7?—éí/F Ùbƒ=8=60cvRÉy1Q1-_LËp³(0…(þCJvjŒ;#M÷¤EÙÑ©+±¾ô+L-Ž¥¹Ç§gedퟪMaÎåó§uñ@Z«ÿ4i‘Giô8ì„ÜçÐr8³s-Ùž ÊOâ}}ÖÔgµ‡h°äe`+¦žq©ÂOˆ…’÷ŸW®&I ŠÒÄ0š·g@lîy29R¼>pË­5«6H¡¿vÒKËù»%ÏÃzM:1ÊwÆ|ß;ÑýÃÚ~8Mà¡[ÿy™´œ®äxgü®{•W³/n]óöóoX5ZW'YßÜV©w­¬NG U‡^*-Ŷ7ü..žMs‡”´Ø»Ðü<=™ 27oi‘g7IKø[ÝÜ(º6©ëI1­}ÑùZý‹šYM‰³¢¦ m P±‚Q®®ÎT}º:jÉ@y¨¥ŒùT·µ(cÞW´"m¦ÆÒT‡ øÎ(:•%c>Av¶¹1lgTs×´°0å‡øÂôzÇy\¹íñÔéHk¢fØ—ò8oÍË;htG¡ŒÙ&w#¸¶*ÎmÝ´¶Ö¦z8vôöN¯‹Î‘ˆ¨'(±ÜLH²ä`ooo3~_‰.Ö¦Øx‡Ñ¼\bKûMfÚÑJfZt¸¶1ÑyYW¼+–¢2AG—MÊäèLI‹>Ê6wôQæ]DùÿI  FMcȉï%-]Ølº¹¤e{š|ÅÿÂr-]¼Ô™×K™Í3QïLùäjábÀ?NZŽV«¼ÃRYôW Ó9‘¥½=¥iãó/h¬´0Z‡áFŽ$qvjkI‰ò* Ù tÚÜprÚÐΛ8Ze‡}^P*•# ™E;Ôýžðô†Õ³E±î²Tú¿—Ü×áî­gî»*ÓÑ©ìÔÀ¢5Í ©p°ý–´à…¡Ö7î<ü"R‘å(´»»+3MF"§;O*²Bò+Ÿ[:J‘«¤…ew{Q¤F…=ÎîI”´¼ð*Ö’' -e늫¤Åï¦,ð®,øžfh@áoÒ`ò/Ó¬¬*2+t Lu×ÎïRd†bÜ.9ãªêL;¿†-T)rpn¥~[9©„NM»ä·.©ûZšu…õ¯O­Aý‹Ô ]cqK¶\à0¸.®Hô¹–ÝŠ·ÙË悉c:•Ry8‘˜ÞMàºêà—ׯÿä™Üj6–îê˜ÿ2`ou½méØe¢/æ]ñоyüQ†:U6ë]ÚE‹µInÙó$yêâfh'ù]´>ÒîúõëαM8Aĺ¾+ª*°‹`ÛZ¾ÚP_•DzåЬª‹(H2‡áT:&<ùn--=º&G™ÿ|§Vf|>,ÕºU®Ió®YÜü¸a$‹ªŲ̀ä\‡W!™ãÓ™õ0’€ž´ˆ·›=‚Ò¥‚Ýãù¤øê¡Áª¸øié®@šä5$ÁI’ÈM¯›Ô'œ8äÐóZüÞ°üɽ+6ÁIŒg÷-éYªõ×NÑŠ·Æ­ž'™wG1iiAtZÁ4Ûƃe’¬8–Ñ'¦~Œyz%}³¥C´ị̂׎±¯K *ó¼swlƒÏßhé!C¯’–Çû;Ç¡\ôp¡¤Å5‰CíÂÖhAì„ø i‘§Å`SÊ,wíô„"À¤·I:Y,{+ËjÖÕø¨Ûºüû'™TEÞºJZf絿ʖ¨hYíˆîLʃ­äy%È`Ê7¤eŽ£vÄ••tõú7ÞÚ;<°ºõ’®ÒgíÀÊchÓæ9îУD7ÎЗé–8fr«x½Á¯b\¥V4eùv^zëO´ù¦ÖMè_¡J'û¾¹´j7ü‘ƒSsƒEMó‚ÅÚÔàÏú -©Þ®]B£)¹ßâ¥ZÙñÉ#B’Ýí—÷ww·mî8ìj¾.-¿Eyâ"ÊßLèSùÍuÿéÇCþ÷ðÝ&‰]åfNPúØ[—g,-¸x€aoP1TÕ×:þyÒ"=ÚŒ¢Ñæx¢º€Çõ“|þ$û1£JÄ›§Ó£%ºÐ’ÁæJej;ôðŠ\åq?y?™(®Ø„‚?f\È=”î,Ïí£ÄÂôì._¸.iì»(‚­¡Ï5Ë¥Ö^'2¤¨5Ȫ½¶=â·Õ|Rå¼¹RZš Òr[ÙÆV~0„’7þÄ=m·ßp*-»ãíœE}r9”ïeu¯/¦?º[Ø¡Ïÿ¬Sîåäwœ•I.µV´·‘âŠÆ‚1WDþVÒ"•ºé.®ÑEýýt²Úþ¢hWZÏ¢ð“%ºœ–¡.×›ƒÕ^.îìiìê‹?‰-·ÑÜ\ü¢²Pb¨6×ÛÝÅ‹³vlÚ5WìÐζà;~¨hÉ‹ópuñ‹ÈÜS›Öo„ö (†á’_A™ÏÞXöéÏ¢2kL–m̧¹»xøE.iNɉeŠ”—õFÅ¡>>¡GIa ?]géȆɶÛã}r㼃S¶•8$åEù¹ÇucÆÏE qÙØö<õ§kŠYëæ&‘é:mG¥Üß´b’gÅ Û3'À wÕíèÖŒæ“Ã7nÙ5½èÆ„*ù©Þa²> [sÈT…"ô—K §..îéuúi‚Hl*›>³wé$ÅXc^ÑÜœ8²y´ÝWý‰E…€3g:/!‰£íE n.n‰%8UCcÇ¥ ôˆ¹i\- ŸTôa1få?Ó~"N N88?q¸-Ì„Ž3í!4Án#›çíl˜ ™Õ}Qÿ/4姖_œâ%Á;êsi‰vGg²ë¡ÔÕ¦)yIઠ49dL+d$ÇðÉõô¬*í¹¾5‰s+}=\‚KNo–ÛJâ F queI©b Hö\Ñw¢Ö¯ù—žÝ)ähQ|IëÒE[Np”òÕðw“(“ïäi®bÒÒH H À¿´ 9Ë)ô4HBq$är÷äô„$Õ’ý=.—/:B 7tJ)õö@ª&¿Ñ§…Ôîq÷$ -õZ+—ð¨7|òÌ’ArW¬üFþ Uí x<Á!Aí%‰ËŽD\.W$–_2Å/‰è—<8í¢ƒ¨dÔщ$*ó% \'äQå Ö/©?"1u@G2y9`:U˜‚®ŸßP…É×\vàˆÚPìb%¡ßMäP$ ~‡|s"b—ôëDõ=¨ØQûÌ^R¶$v$äQÅŽ~k$Šø{<áÙŒÐ_²þÜЦà@ŠéËöwQ6[¥F!áêO*}±ó'šl+y—î‰)©B8E®EIL{ äS[¸dŸIUó÷ôg#I’C‰ž¬)é:iP•€Ç½ˆòwGÔ†]ÞScuúÞ?eb»Ðº}~.€üÍ¥åàS°K§ÇçÉý‘m¥rgäÁï¾6–Kp>J"CÅy­Ý½™ÁîµÛä âê\ÙÚâúôùžìªl›”5¼µ~ßÔZëêÄDHr¾µ®±­«2+äMÆÌÿe°‚öpÍÖîi|ó—«S­q2Ò¢?cèUÙK ûÐÞÝáþìñçy“:Žä52ý“Ë*RýØ<âMòu.át¸þj¹ 2©…‰¹B·¸Ò¶Ì@×ô¾×xÙ:×µ6º¾v>Ö™Þœà’ʼnp|Ù0wŒ)EIiíž½š7–éïÂât{ÞÿuŠ§Öí/&¦¤ß»ñjCõìâ‰{ϸÁ†t猜P~ôxÙ86Wê˜R¿drt¢öXï¨O #Ëv¯\)±[å–W_Mjê£ìFE™£²IÇiBÕSZÔÕ×åú&¯Oˆ©l­ Qf˜ž ¨(ø½s÷ød”ݳžuùUÒ¢=¦øèüËà†TË›HNM¾ùà ¾Ù(fÊ=ülßæÕµvtõ`\Zm…çÓôšnvv„{ï{¥.AU’á¡÷g6ƒè_úßLŠ:¨(ü#Qià -^Ÿ#‘8!¥AéSSiþÝbò„HbÒæÏ2usõ)ïÓ§pù¨GR=µäÛ«vAtUźÑäV6GœmÙÞgÞIÁìg+f‡Ir/µh‰îZPø18*û'v›2sò‹ÒcBRÛöLoqUcfôæd|’^Z°¹š´OEʼnÁŒÊ±K®Ã˜øËKkÆïÚ7ˆ…LÇã1Ô=~øCË1žV+»û(L)›òŒ( Žî¨Ó«pÀxIݾïý‡¦Ze;ù~BŽÔÑ—x·ñ\š š#Z‰|2-4§õôÃ(w7si!”³^ÁYÔ’’¿Üöyý'ˆÔþžÝ7¥¥:Æ;FN ût®ú8ÓûPƒ/×ÇWN·/ )öÖ[jD¼òÓuºE:J2 ŠŠ"<]¦vŒ†«“¨Äïg‹å#D³ÓùÜ!I';‹òz½WÍü¥ÙÒˆ,z\íªd£Ù­tÖ8Êçå¿ßã˜y¢?:fBÕ¢áÖ úÇO~aÙ—å;Aeë¯ï{œ&à%Ô¼‡¯Ì¥E%ìc¤ä¤&×vÏZZÜméÑ3bi™ý&£ãµG4Ïàü‚¼È4‰ZòîŽõª ×ò†y©ú~ #$‰G:ØýµÒ¢²ƒuûy”ÅÆ#º»SNŽŒOÓ¬­=÷ƒ´Ìr²¢ {V’„+!Gi9͈[δ_ú-#î‚-£ü4#.Ib©Ñ¾¶ŽÞC\¢Ïˆ[ŸÊdÌ+#®p*;¦k*‘À©/Þ¥®êDC^°Ó;‡¦EÓÉ_¦š’¼‹Z»»»ãžì=•í ÷÷´Wg<~_d¢7+…)Íkš¥Dƒ´ÊÃÍþžîVV(-žóMiA{¾n+R£úå4#nUnTôÇšç–Ž‡»~)EŸ˜î»K™>Ï ÆÆk«WM±N%u¥Î®1š­¢°ºîfø'.oñØH¬$ãÎ.棾¾FBÅÒ‚‰8ôØóýæBvLíè—–ì@÷üÏ 6!-žÏí示éæ¬wn^vŽŒq®Ñ€b×2ž¿*/N÷Ke?úá_ƒïo/ôtwδ/ºH!r&Z|›Ýc§øe”VÚ¾ðSìV°õQ¹$ʘBàïëõÚ)pn_#ü’Ý5¤r„!ÊF--14¯ú¶¶TÆ› ‚JZîÅ|¡|¡<ɹlíF©sÙÙB_“éRžÕëðùµ _ûyFIKe¶:‰Ã¯oM2â.td¸èOªä`ZÕ¶ª!Ô!©°®2'ÊÊÒåýgI å¯ÊŠ3üRë Q6*‡‰†´˜ y‚Fyû¤å™¿çÛ œN¸ð7niÙmóL'OHÕl\bíèHmBÔ”’z›è5~~û¬ÙlµvÌBÄÝÞÙ-ÔW»ÅÓü+6q¸\éÓ´J-ÙSä×zx¶Tºqãv€Ä¸ÊªŒªœ¹‰)"îþܺ Òòú;ä™HKNøó×üñÚϵs›ÌGæ„ õj©wtãÕÒ‚i’ß=*M/ø˜ÜÇÊêËŠMßÿ•.;ôŠ+¥öY1œÓmô¨…Ôòœ-Ÿì«q—ã虆ˆZh%#Ô’3uLöŽÑj Õ’›#“úJ³ò)0½áª–Ù¨gÄG}±‰HûüåK +Ì£|MC ê÷6.뇋®¶¾Ô]3²]M.1¾×E¾²îã#˜|óæ¿ÞÊV<ø T>ÌÌo_4–·C§ÿ¾¾!ÃáÀó×Ú£nï,}”¹]Å_x—îƒb:Ï'®þp¹Ê§Ñ4Ê¿/ßã#±l*!©j’–[T4êÓC*¶Í&$‘²0—­ó'L_“Åv­{å4Ñ™æ˜ëÚ¡Dü‘#•{ݵ^0.Þ©ÆØJžQ“ŠJv|ÌŸºÿ XùçzU‘ñ[ƒIRoICŸ&’4tXŠ°¿“%‰ß5eœ¾#MVbþ•™]±äÙæH‰|mÝ{å„üý’ƒUòÖuä ‘tÚÒ’TSëí¡8ÿ‡ûý>ü-¤E*æ%Ñ»7’í,ÛÅâÅ6Ë· ‹ÝÎô$•î¸¢¸qim­>=àmdŽ+½¼‡çÃ^Ý_9Ò\± Ýñö“—Ó‹ã~NnrïüÌ™YZ¨Ëøù]©IÒ¸ý¹VK‡¤M¾`°¥…§–úÞ¹»t¤¯Š{`&-Šèt:ÙLÜöªæz[ÛKtØç$/O3i!ùÎlËÓ‡®+Û“eû»VôÏïììJä“ÛÔ¹\»øò¾þò¶Ys¡ õpï[\Ž~öÓØŽq4퉵)ê]¨O¢‡Õm¨ÔÁÎo|ñK ík¡ÚøF›ÔÙ}^ÜË÷yÉä“Êçî2ìšæw•&&uŒ—k÷âꇗ7ûÖIL»·>÷ÂòyÿÊ7úv9…–lMÕ½ kÐiùþ66ÛÂî\z`f»I}»RB ÉmhÎ~ôa‘Oûe`ˆ"ÝÁò“±´è3¿%?ÉlšhË õ*^&¥÷ûó(jŒÛdu5më›ë¬PÇТIäxçéY”]Í& ÄW¿ ¯.Œ»=½×»)§¤ÅŠ¾º³Ìððç›Íþƒz]½?œ5³`jîÊدÿýd|§5 TÅi4»±šäõvE%º½cm/tÝuÈ“—˜xµ÷書5¾`¸½…‹ÇK½3‹‹…ÑîM»®’Æcé¢sÍÞ©whAIj‡‡ójúö¶ç^=ñØÖÖˆñ´4ɹ:ÍÔfÆ Ÿ—„ì#Ýsóüj¬(­åŒ¨qý½¬`q¨ŒUÚ?Ç3¿KVíT²X ݳZâ„Dä5e%†W¬*L[$Ü… VIóÐ:U×*AùÙnVs¯nl!4“ìâÒ\K튔;WÆbU6vªÍúú⪾¦êòŽ¡N'VFÛÊ+릧[g·Í85åÕM}*Ã:Ö&.2‰)GÛê‹Yú`)PÒåžÓ(›ŸëcVqiÿ‚ò…`=ÛœQ”õz3Ê®©Pƒ•k¦;jKªÛ™A{”¼ÍÕo¨HTÖ]ß ŸaŠPõ°›Ž!?7i2€0)á!{ -ü»ƒã8Œ¤àÿ§´È…ëõÕ5íc›¨~B^ts¼£¦º~]xÞW 47r =h¶fØÕµý³¼«û´¨öçó&~ë‘@bËcÕ5uã\¥Éïø¦iÇpõPsÃŽš€HH‹‘´HøÉt'ÎìJÜëÛKÉRÇ—ÑksíNô>S;±Ú˜øäÙëŽCü„Ty;zôÏNØÜ[»rô%-ï²úö¸»"‰â„$„½É®AY‹+K#ëÇæÒò¦xyww÷H®>ýd½%ýéó7œè  -&yZÚ=Ò(=QNÇ$ÕŽÔ&FêR‘é^2‚ÐîÆ”ô'Ð)i!¤=ÞYŸ©¯vÚýKgøWJËܯ¿Ø4õõ¹¸`xŠ›KD\Í·ñÓIjôƒao;ôwzx„é“m ¼ø¢Öêt_.ˈ›Vü~å<#núÄ’Spuz­mï0ÍÃy]¬©Hô¡¤5dÄÍ ZøVF\JZ^Ät¡äÉXý‡ëêÛ‡iÍsû›£·„˜d§¤åIÚNžT%²w$Ù4·¥}u}†H fsõz1“ˆòx($­qr²!5°WBžÉLÚ´p‡nÀæå»$µxÈ3¥Zr£V}ù¬4¿IËËØnJOÆ>nhÒœ_4ojpµÐúç—\ãÎ*”´<ÍÐKKur`Ý—éçCmîÅ#K;ÿX™¼øk!tZÝÅùJ`¨V‡Á(€¿PZ¤ÒƒÜ§ÒžQÆ#ËÁ-…bkÐê‘Ïhoùû€¼‹d¯§--''¨¿Ó{vO·û£'Ü+gy¦¤Åê†uëÈP°³óNòš"<# G8ù–µã‹>%-?Þ´™ê÷t ½ÈÅ--À¿˜Ðý‰ïOnx¬£>>X_]ã*®Nû€£šáþÖÆï@?Ÿ I ÂÝ͵õM9b:&Qo 6ÖVEÒߦK>>àËP¨€¿ÝÛâ^XŠV~´É•Àl=­´@™ÒÒH H H - - -€´€´ÒÒH H - - -€´ü…Òò?çROÜ endstream endobj 745 0 obj << /Length 1229 /Filter /FlateDecode >> stream xÚ]oÛ6ðÝ¿B20³¤$’Rö´emжÄÃ0´}P$:bI®$ÏË~ýîx'Gv„ - ˜Çû¾ãñŽ’BE&"21üÇFÝ—ÈÛ›… €Ü,~^/Þ¼‹M‰Ì×zØ(°I*’,Öeð1¼;tU‘ùrÙ4ü³wA7‡ªtË•’ᄸu;—÷Ž6±ˆ„Z~^X¼]/¾,“"剰ÒE½øøY%à? _Y=W$&…uÜ-þXȯi>%…Œ-…’ËH†Þ­1 ’MDd°ŠШIb½…x’(ÑGÒ°ê 1L(M»ŒtxܹòÁÕ®ˆÐnHâÄÙ¹ÂUû3*ˆï–*ܼï*ú§jlå“Ô²„äêV÷Oƒc|ïš’´ß?]øÓÔ1—?!ä­¸Ö׿¯0°R"ÓpÑ6+†ªmdfÂ÷ ¬2 ë¶Ï#8î¶(òz"ËK¥C×=jÙN7ЭãšÓ¶ x6FûmÞ“‰œ?-^ÿJ›ORÆùkÚ ¾%‡Äô¨ëÙäÝß¿1'&Êëä}ñ¸jõ=ˆÏ„ÜVÅê):¬çž¶Çj`àtž¸ñ1Âz™@5w¤ ž¦?IÈogTaH@Ç(k(ütD°íJ">#Ü3÷¡wž”€Ÿ,OK_=4ùpè˜ohYÁÖa#¸i»QbšCè÷®¨0•0iɇÀl#³©u(N ­È∾ÃpڮΙÝ'Šô]ñMÄÞjÿƒ›|Ö2L*ŒŠEÐ6ÒWÛ†…Îbõ©uœéHU™Áª^ÓÜ‘0€ *ÀøFøö31“ ê'fŸØXd6w.ØÌj;Òåêûš‰‚š”I¸¯AJ„MÍØׯÔ>™sj_M¯Nb¡Òô;róòˆ@…4áì¼wëL‰$¥ßþ›×û{QBø; éŽÃrºWÏ(Jc¡½™‘FýIj…Ì2ô÷ÍûÌþÒ‚K³®$p´ÊØïðå¬Â;ú_ØÖªÎõÛ¼{ÄÖ~òs2'••B§¾à¿,D Y´ž8=Ik‹ñà>ÖJX=’0&K1}Ë]X«‰³ãUÅ©°ŠÏèX5e‹·ýø­6Š5Ks£„ý|/ŒŸÀÈÀ- ßä`›€Ôä€;§ýY[ƒ=µµ³}õ¶æXêgטÙÌ24:ÅæjWló¦êk’¶¾ûGÜüغvG<¾¤¼+÷3ÇÛ6ØjÏ]¼ôŒü1ðP`ÃøNð¹" CÓk2¬ˆŒå9OÉKÞÕ)ñçVÏÖ3K4Ì\ø„tý… yÝ`ŠÌäçÀÈŸ<ruÆéŽÖ ‡KLŽ­˲!ªKzÓDÏPìëh¢÷bä•£O£CŽÄfòeäøÁDZ‰@%T¤› €¯¸‘ƒšÇþ¡K®<ó>¯¡Æ°‹a!îôØÀ ƈï k8ˆœÔ&n =^'o©%ÌøõQ‘“sõƒ2›®e½÷®jØ7ä`¶ç2Ía>ŸvŽËO@«úê/‡Ù†•Àg‰â—Id|Æc˜€©ÅŽê±×Û|?Œ9 d^A·‡ë/=ýfïL1 endstream endobj 741 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 127 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 21467 /Filter /FlateDecode >> stream xÚì½TTÛš.znÇ;nîwǯßë×£_ß>}û÷V‰•s‘ŠœsÎ 9g €(  ˜PQ‚ Š¨( (9ç$9gŠX„Jë­U‰ tïsö>î½×7”±j…¹fú¿ùÿÿšóŸ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ã·®Ø!÷ÛË“xî¸_õˆè¶¯+Îñw}º"ž%ѱøWRæ¹Çóë2#J›{ø½¦úþæú¿¨bÍ{øHp(±&Ä*êp5î?ÿ¥ªä~±$¥ulªÜ_\ýÈfe1ôÞ)íÜÒ˜;; ç¹»‡Ïÿ°·?d^Ò âÑh4 MòˆÍÚdC©UßÄ¢Àsq dOÅ~X¸t5£ glî^'(NF`Håã» ü§ÐBðEZ‡ÝÎ 73ÄDA•û—X°`‡@"Å.bqdçДÑ56?§ ÏcÀGÓÊÅûXwŒÖ5î@™ÞǪ!åeóÚ7÷îã² Ô]Î5QlÐN¢Íú˜ûΦéÿÁæå,x0Ùr‡D®Ÿs%³¹6Òr(ŒXð/b°3œŸŸE¾‚âY«Ï“‰8(¯8ÅÈ;%,Áåis)9ß®}p† ¤~QÏvCöBwYˆ³ ì?(¼±shÅÀw]f­då¥NÒê·äkÄ\FFê¤Á/…kÎƇ{–¢:Hgõ)3)™SDß¹}„³ëNúý¹è©w·‚‘èƒ+êÔÀ¦ï£ü.ªmµûë!ˆm\Œq~·:¿¦LÂ*Üt"Òú$t#ºN{øOÎRÅ%}„^XK‹‡ùUeý9[ª²Yü: פÐJù =bhok›^ƒ8f­= %M|Ô·)È «Ã -ãù¸<\ç?ÒYóö¡™òº•÷dûÀø<Àå¤zYÒ,½[Û;ö¡³g‹&³è„ÃÛ%æ ôvóÐÕÖøéœ ¡à8ÄÒÆ‚ËåP±ÍTk&IÍ­ï=P?“«læÒP[Tžžj[Âi››U]ÐÅŽ®ÁŸµ3Kþ%"ÓK‘`sµg°ÆJÅ ±¹Ò^ gîÿDz3Öt`Q÷~¶1Eœˆjà³ðö£3ٓ؈´üÆ–¶¶Öæ‚´s22(›‹9Â×ÎÙ¡±D42èv»¸ž9]’Š@²¦£¼¦Iv3Wµök;Ð+ºz·YÇd|ÊB¢ä½’ÞŠé2»ÞJ'Î7AlS’FV6üØÒµ¯Ú;èÛÀÆL_;xÔÑÙRûJ+•×Ì¿Ö;8Éù%² ¯ð«ÓCMuµÕÕµm½Ã,>Û‹±€úGúêk«kj‡f×ù Á]­lèb3—[ê*›{fš+PeUóª:fÖEɳ6—ë>Ü!Éiå×6v-†ÙѾúšêÚƶ¹ Áx<ÐQÛ9ÆXžè«­®¬©k™Û`éæäQwzè „*SÚgYŒ‘Zg7÷î%ˆmð(ZãÈA³éŽ‹ÎnRvo:©(:_=ЯW‡?)bå_ ²ÅžƒØFÓ9Š-¹ûClãù¤vÿÐàuMǃ{ØœbÈà{LÑ*ÔƒœÕÍÖ˜À§‡öþçèâü¶ùü:§æuÒÅí—Íæ ŠÌ©Ð7ó¼s Ûàã| ©–!P£s™¿j î{• k,bí38?Ì>²B²n‡¡ÐÚ ô=ÝFœm(4«yæqIì®õé`N¥6ÿ²50óc¯â¢ƒwX ›«˜X·i¼çAÂaìý"ƒÜ̈XtBÑt¶7åÕò¦ YÓÀôrVëÍ Žh„BØÕkys{µ´8’tÖPŠ¸z-¿o<Óùà 2qò´Ö" Ú¥<ù¸àBV³U3ó¾óðAˆµ" mÚºu`œÛ<¯$cšÖð؆ÉëÐDz _Ÿ¡û©)˜]Ê[mKÅI+U.4—ÿd¶áwÌMê ÛÌ Û(†ÐûŸÈÊÑ>.ìHÐmx’lM´‹­eÑKù{¿Wtá¥Á6JçÔö?q”#úÌ ÉáÏÈ6`’é®ÑÌ- Ô׌DÄTó/ìÔÒ ¾á¤|îú½{‰¡<9æm@o§ ÷ʇ„<ÌN7Ó¿ÕxlGäL5Zk‘ˆd… ä É>Ewìwî`¡æylÃõ/²MŠ;QÙüæî!GÍ­0U}ÿ mPø¼ªçZRŠµ«a›NšÉ+¾è,&HÿIlc){Ú»ôì¼.Eï²Ðfþ-² ˆÂÌ+×î• 5Y¦('ÿjJŒm¸«÷ JNñU¿@céÏö“Vv†ˆc(MJ í÷Y¨}d#Oé ïë'ü»'Úd’ßíFŠqr¾pˆ‰wÕ4ðÎ…ü¢‡Š¢¦5]0ømºè<âßÈç|ë‚Œ”¡£»>•ú¨¤“%|È6D,åÂÍû·ÅþäÓ¾Ö[®5Q ªR‰)‡G°U×2C<ÑŒ´ìâ~Žm|žµŠ'Òò$Tî´ÒÛ%@È6Á ÿ•\µÀëž[–dIq^SN‘K zž_vQ6 Ýäð½Ì?†m"ïTÌeGÎ;¥Œ_>q¶!¡IQ©ûê'-«œùõlÃÚ¼“pñÁÛð|ºKÀR;x9g5‡I}JjôÖ«š§ÓÁƒ7Š– …æÊpHÅÊñõc<3"n¯L=ï—G»E7¸£ëõUÙ“Ò¶ž^*ze­ÃbŠÊŒ ­ïu+%Y„””§£ ßȪ7é6¦Duw£pªzÓ`ÕóØæQÛìóªv|‹€Ý^zánlNᤌDl£ gu Wä¼ûÌùÛätÌóM4úÖ§Ñú QAýZú]ñDï>oåüÚØFà­_™Ÿêikªª¬*ûT'ó mG\·©Hô%è[Í.𰸾PI;Íu’áôïe4:A/šÊBžÒí?ìܹ-/e<Â;nω'¨hOm‰U.ºS ÝŸ¥uËÙDËû²„î¸9|7Î_™H ’prXåǵc|¶!áI†f–bÐuLÝÞ§x0ÎÙ+È´òáµÃµpÛiæ≚;G•ðÙƇÇ)(i¨CÐÐРâd‹Y5ü§ùlJgePWó¬c?Û@9* TĹ?¸;‰£µÌ2 K?’mÊ¡£ÊËRh½¶õƒº G48P?ö×·¾–múÉÒÌxWs=ØIÞ?ºN$j&!Ia5…@;.o›ï|R1L™3=©ZÏkƒ–‡Ñí3«¬ã¾ïüÍYNñ3:t˜?tw¡ýZ¤ •@¤ÑòŠ&o{yÎØ ÑʺFV–â0!#¤yl3ãˆ>áñ–~¸l=Ù1àcã{b›Ìú‰éÚ,ÆhRƒ6B5)qO;×F ÅØÆ‚¨¨j±¯W¹ž/ý ¶™&rÏœ$ºOÔmÂñ$Sñ®fnjì•Ëú•± ¯ù²¢ÏÉ”¸äÇÙ9Y÷R”±²Ø&7ʃNjûË¥¿;u®Œ¤‡2}nú ¶)¿s–¬f1¿{p»x†dQ)<ÉÎõ·Pp<âcåz˜¹n˜^›}‡§|ØáYRÛÇ|å¼ 6 9Å7>rDQ<&õí£,)-ç(®äJƒt—Œ·«‹ósss³ ™²r”']‹¢LŠØrw”†I#Ìû@»SÄ6à-+]JD‚ŽµShH0ˆ°/ Öò~Ƕ¤ølâÑY%£øC–T3ãˆúù"Û€7qqŽ&ªúùkéO²s2Ή³Í ž«Â{J\O*EóxŒég†vºÞ%œ!ÚÝ9˜,³ßËÒ¢ ³Ûo:Åymc¤6Ø^—J@›…>Ü•Üæ\ÔLf–é±N(%ãñ5&ß’ zÝ»ÿöQ¡%ÅŒ Ð¿Ò{˜FKSȆóÛ€mF­!m!»fjgªYK­_VFÄÙ²¤ŽŸˆp Ûp9[¾fT»ˆ§-)U«EöqiþJ,©ÝÏzˆ“—>¬Ù•~CºMI¼7ÅÔ]³C?˜mšÇhºÓ‡u7Š±ï ‘n“îjªáyi_ß\™©«­Û…^Å÷ƒÝpÎ’H¼U:8^{œß¶Çy…âM€I÷ÐÀÙƾ<0ºþi~è†òxyšï$ë ÛðŸŽwPÔñÔ™`AòXR=ÅIœz|jZª·.¸!0cÛ@O0§ëh(̽ÖÙæR.¿ÍÚX…‘Ó-}zû«¯` *ÙjäÍÚnSGhwûYÓ™)É·@ÜL-kåw¾ª×ým´ˆ*F±·÷ñb”¸=7TÛÊ÷ÌÌ ü6œ.5RñØêý6YÑÆTuÎA¿Mœ3EÍöÖ. Æ6P}VMãÒ›ÁWþ$·¨j±ÍðÛðØzj£åF^¹|‘ òÝoÎoÃhT9Ì™üêÌõÀ!eï·nì=¶Y¯¼.×í^j[#ï?ðŒJ l£Ý{HSfÜAœ6â¿­4”*†øäÆÍ ¶¢X² ¿2ÍÀ}¯;²6ÜŒ©n矋gs»í¡ Z¥v´ƒÖA¶é˜côUp ª›å{‰·Ž0vûmÒny±uà>úñÑЮ¸÷æ݆-¹u÷y‰Á²²×' hxŸkÅ,)þUVßs$V)#ÜêϿᦵœb@¹x6™+úù¤7Ó¶ñˆá£‰­Û€Ëv’R ¸êFØÇ6›ÇLtùÛ, ¾"É‘+W„Ž¾kP=q<ÛpÕd´Æ«DSÕÛð…Ù4;ôu ^QÛ"ëãÐÆ°ZþÞrl²z@¶Ygq¹E8”JÓã‹l³ÞQ€ÇÂ7p¹a ³>çùÊHSžÎÀ~¶–ßS•Ü¢Œ‰Ö$³ ðƒ´1݆wϻ˺(K®zòâºÍë¸4%lÃÝòÐé[û<É}æjàt驆 ÞÎ'¾jrãÌÞ7)Ö“m‚ºqLòÝ{7¯Xi`µ½ÒÙ‡Ùf»Nõ´œUHüWûUÖµ e)„}Ø•”·Ã ÷¼<«‹UÖŒ¿~)È}s·i…§Û((›;?È~|ÞÃDö”JÙ,°‚-·ø²Š¢å¬K"†«“±V àhùmp$×À°Pq„ÝÊ©Ÿ¼á§«lÁó- úoI²NÅdt}¯?å·!ªé†„ìO54¢zœ.ñ ølq„”ŒRÁÌA¶á_­Ï°Çáð4žn3–…8E}=ÏÞß«v­4µn€UtÍÅŒ¤®/þ戔—_iIñ ÇM/ce,µç%ÆœÂÔχåîWé6¬µ1M2ÚÄó\^Î/KµsI·QX|À…›+ûhÝD~ …€E¦—L|q" {gupdŠÉ=Rnù³GÓ¼4°4£Ð¨5Šjt„6©Åë€_œoŒÕ<$ÊË©X¸zúyZkþžø°jTÈlbl°Cm‰Ú–¼oëØÆ‚¤®·¿S@½¢vråk,)þ«Øô^5<ƒ± ¢ì| ÑàüšÏ¿>/1{®+9ælpPèƒwÐTÌž¢Ûþa¯Æ¶î$…?x7.š.RS˜y.,84,2óU½`6Ìl‰Oh“#ê!/o…‡…§¾8ÀΟr¯‡†…§ó¾ñ’º648ü|bíèºÈoc]7Xõ,*40"êjãÌö±Ÿ‡ŽOã·è’In¾‘wó+cRÉوȈˆðý½•õ‰5WîP2µ?íñóa™•ƒ{úÝ\Otxp£øôY.§ø^rxddøAœ­Er--<âneÿ1èYBàÙ+… Ú4Ôµ%v•½µpù|äÅÌBðWwîà+÷Ù‡Äj³ñžWX*Øk_g\;ðê°/ŽÑ ²bÏç”u‹ËåJCN`PÈ­fH–GÊÏED®ŸwJÄØfón¤÷æ£ôŸ‘ª+Ñá!¡gŸ×A_ë'øET-œ¡'Þ÷DVìZG†ïù§»ÂÇÆkS0ÓAÖ—¸†ûusH¡ÛXÕ/\Œ P§*…F?)é>NO {Ô<±ÿ‰ù¤`ï¼Aöž¦´1‘Ÿ™rª‹¨Ô‡/çXâ/_I ¨˜çŸh-¸s5½„Í+Åæ|S¸â<¯W¼½s]B¯;˃ŽÂòàðê1ºx}N¾ºðtÊ[{ivDäáöüÓÞTYcêr˜_ñ0ëW4ƒXòB”£–§ìŸÊ•¸>è€F|X=æŸÙÆôl58æNÑϵP%Þ|›#<æÛÛž-8ùÃ+I^•Ã•pù°4í« ‰9<¢DGYRǾíë÷p¿°lçÀ9 ÆKam@Ç™v³{½æ¯|¿šéšp˜ãÏÅ“Ð"¾¼~Ý:©}$&ýÃ(SRq¿²¸Ü¯gc_‹ÃlsŒÒ=;:¼ÍúMÕ?¨Í–—–}8ŒÒ’¶‘Ío.¿¬µwy—üLQ›™mÎO°~956Îþ–d»6PV"©ÊJÇvaÿ¦p/Î9,½fð#1WalfisÖÆçr&¾¹ÜîNûÛÙ¹ø]ìZý²¢ø+úošHj KÓ§ +pÿý–|G?,Äo±Š¾ÖNüæÌqîo M¿XF¸[ÿ|òñSö·ÃisöqòÓb=î׆3ùB°#\,GõPÉN¥½`5’í}‰AX$¦$‰×ôQIvT*`|3`®öiáåÒÖâN9iü‡ïÛWèoNâiãël¾8°¶W˲â Tr²rò¬¥gTíçŽ@¸æÌOKËÊË#x—•!kÚäÔ ó?@œ&ò¿Hêg}j8»ÝeYŽ†ªH !R3v}Þ8ÊR4±`uæÑ•eRNN¯¤{ï-ÁÄ#¹pwÝôÑr †óÛl1‘Ÿ5;%õ¤Óè¾)lâ¿TïÌÇÚ{‰?hºÜeŠÅ“¢×çÊ ÑÐB4ÖŒá{·lÿ3[¸ÓÏ€fõ–&Êž¦tI˜¹h#+ëx¯âÀÙÊ̳(‚˜p’æèÞ†{8ŒoE±áÎz«‘Ï?oûéí#º7•;º±YVÑŸåÅ+àltÙk≪ï{GGG‡ú»]r@È¢½ÒZxY™w@c]2ÞÎMMŒóPW˜ŒÃbÏgñÖ5sZUOȧ °ŽkuŒÑiœÉ˦ɩ©©ÉI0—ÓÄg’™Ö|ME¬¦Ã¹êŽ‘‘‘®Ú×N4²ŠY}O%`=À)8ùi¡¢kÅg¹ÌÙ¡0H4Òñ\ŽXͱƒUN„×f›*­ð r ¿ã6=Ç“©Ý+à f­¨¤‡÷?³¡ôÅýQð¨¿"…€Qï‘0+rÉOpTuàlÛó«oðMwìåŠánãÇ™"KÃï_}¬ïdòµd«æCQÛøÖ|cQá‹¢·FV ¹¬­¥’¢KÑh¼3Qóüus‚18E›ž3~wª¶ ¼`-~xSø²¨¸m®‘–/^–Vul ‡zöÆTuYqaaáÛÒʉµ=5`”Õ¢WÅnUé›öaþ¼…ÝÆ·Ÿ×ÁÁ:‚(W<»Ål½/KÕ]„$r+Õ5Œ\دðW>IˆˆM–ÔðØÆçi³¸EðÚOGÆäüײ gÊ …?WÔ ì)3@ñõØ+Ù¥¼Ë˪§Õœoíˆg€9ãl¢wùqPµaçØ“®}èÉsEh^aì)7svhƒû HåÒQŽd"Ò!ÿ¾§-hV8'ÿ§c›Ï/°Š!`{eº#½«7ÀZè,yQҹˌ¯ÇàóhYÑÜ=ø|¤ ‡%{fóÂl»šÍ].ªX†åæ?‹pRCÉônÜe+mbHê'¡±slÉjѹ"ÿOœþ)ËLÁ·F•¯”vð%Íô'Ï/yZâ©*9í¼®>{|S‡*çó2赚2HS׋1 ÒªKÐ ÚîÊ¡IÖ¾‘!.†jzÞšjøËyü©ƒkA”Sfw }~v oɶé½ý#,.À}Â’²›&%NsáåyÛð1‘iw‚ê»ùµº Ý—‚WÌ=¤¸A?¶k.~'£Q¿)ÙeÃç&Î\#‘@ÌoZ`ŒÕ*…};Â[xqZæJ®™ái‘+B&>Šmßë í¬шw+ù¯ù©Ø† ì®Í÷ε<ùy ÑÀ¼¢!¥yµ– _÷¹73rÁ‘v§+•r/& ©än–ŠÚöçøÓë¹+ŸU©èÛe3àa}œ%Ò,‚Ë„Õ>ÿ¨jjŸØ­—‘¿§|†vØ© úŽð”Ï=¬>-J)B0ÿS¼ÅÒg—´Ý‹ èÚ Å‰û6ïaEç"—ÃpÓB¸$ Â8ô¾‰!cñOùëh8ô¹™¥MÖaqžúpKRj™Úc¿g嶭:ÞåÊ×[R«ÝÊèÓMSŸ€ÐÛ9¯‡¶…©q[ãíd4½¶õ·Dˆ6ÓÐœìµ` ê™Ô7ÂÛyóçëFÕ^mæòëîãuÂ÷ºƒ`fê²ÚuŒŸÔ’:ìç®-Ì,¬Ã“I`|µÅósÌ ÷Ô”—½È½§Â‹8±9ÉëJ&À˜PWÆßxÉ[¸Áø¨|ÿbº0^óˆ@4ÙÝ'X¬† Ä;ˆ4ìºÀxïA·“CÇTðƒ;|Ûctf›Í]®¾‡Câ—|_e$»Ý­-{úΈ ³VÇt‘ñO/Òð»tE©sŽ)íFåﾓ‘••‘•CbÈ%!±CRNW[ ˆæÆš{qžH¼âÃOc_É6ãhwîyF¼‡«ƒ !uJÃ!ª Pé™){«uÞŸÂZ÷í~™m@dø©QmS·¹?¡%ÆŸF6Ðÿ;!vxŠRÔõ{/ _dßÝc3¢Ïõ0&4 ¶¬ º@Uöy¼ŒVÖNê:êbÿIš·h•5Ä6ä ¡a² &©jDÀ6wluñÁOF H (+J.1ù ´rÖ«Nb_Šü‘[sjØ/² ½>MP¨\…ùÝÚd€`/V)!(ï‡lCTÓ61†`dbæsöÚçEá·™¯ÓmÄFx‹ÉÜ\tQUÀ[žOÞqûžâ¸Ì$í0Ã#÷Ž99Œ©‹‡§§‡‡‡§—»5AN&¼bSdI‰Öžs¤™xÞåœ/² wº =n_ØlÞckˆm*ö?³²Íƒ1˜m`ü°Ó«#*¾Z°IïQÇÊË6Љá’t•lãpwß];sJ£­oäèêîhcª£®,TL+dñMJœm4¥ä5lÏx¸»»ñpÆÙéVÅÒ´e"åq:Æ~ÁaÁ~g t4äO£Ô "&qw®;+Êa)zFfNÎŽ¦úÚx*òI#´I‰¿Œ¬ùàÁÏzàäœòz¡úc(©1}* ‹”=žmø°ÕšŠ’E“(¶¸[7=uå ʆævgœí tÔeO2ëÑ£ú+R‰x’µ« ˜ ܽƒÆVX|¶Q0°ðÖ€Û™3A™m‡U¼dc¼Ir,C0¾ÞKÌYx”v-þòÕ‚*H»*Ï‹‹Mø0µóìÁµçc¶Ù¥§¥$}ì˜õlætFJ»eW²ôŽ'I3R†5úââõ—Â×Ç'”ó…—»X“Ÿp7—É ³²:X›y3)>>þZÚÖI†È i*z˜x5þVVñ:sÍP såùßÛùâú¥û5‹Gº£`s²#ïAzRbâµ7óßU­²Dôúã„Äç­ãGTÉdzÜ•$ð1®Äå5®å—FZs3Ó®&\øôÍcϨâÿj.»{ë˜RÚýÜöq~$vuF\Ò‹îï+MI-iýñÕ¤úÑ%ñ¢,|ʼwùÕÈ!ãnûsÒ¥Û û-ÁOÁòÞ˜ÙÚSFê‹3R®%$\»ŸûzR,“sŸ®%]/hâõ”éuð-›9IÄ.$\/ü|(Ëì71nº×a¶ñSú•y@¡'QûÊ{ðåÚa°æ1¤ØµÄùSÖÓp¹œ®ªÂוc\“¸C ÷°u n…oý%×¢ªáIÅ0~2pvK GùX ä5º™GDu„b¬†«kFìsÕþ`½‹[uÓí$R1üjÚƒŒDk= Ñ9c^QûÍ`ösû‹7ŒŸ ì­ÔóaqÍ‹õq­~+!ÄõYçæî‹ü*²#ü½}o<|Ãà¨0`üÖ,©=÷Å1t#áøk7Ç%  ¿a:þ™ûÀ€ñË”ÖüäèÐÐ ÁÞ^™_þ)…äkÂôI$%¬­áááµ-Ö7W¥NÀï~üŽú…z€ŠÆF€®N Øægš +cw“>2<48AßXš\ý)Ûˆµ4;9<44:>½¹ËýÙ¹“ßôìå¹)0#cSë<Àøóc¢ ƒ!XÙ¼mgô<2>­—ñSÆÚØ[‹v&Á‹_ê왾Ö6ÛÇR3Ïoœÿæ*´Å b›¿×ú² d„þæ¿ñ¨é¯€ßËÂP`Gƒ“hMÀ!•¬Ï¾)NÑÆØäÿdrÎÍ:çBÄ㴠ɬ†™ëÂ6ççu>×ä_ö"áqšÆ $ŒšíĦ›_²^µÝÇ«> Vþü3=Y¦Ò·¹‘}±%¹û‡i a'%é%¼3k d´ËÆQ÷άØ!DÛnrm1Xj& Mó€D€Ë="y®¤]föÇÝëã¯_[¹lŠ×¹üá‹/…ñ-£Ê‹€À<ƒ¼ûq¥WÈ6`[.v»©`°X‚¢vB´wÍípŒ²-g»pv—̨§¬³øm¾Üÿ#…­]s T©ÿJ©e€)0&ëƒít0 ð¯Ø‡+;œÅ·åQÐûÐòˆˆfHwYmð³Ò¢QXœbPÊÛMÀbÌQ‘x"‡ÃY¤A.¹ìí7é‘*D …³JžÙbóu!Û@9`L·G9â°à«4®ä5ì Wd¾º®B€Oª™º—|^åwЩ¦<m§j&<¯çO¾ïÏ‹“Â),³Ú;ìu ˜§üøN èée ?ø¿þ:ÿïX a\‚nÃ^þ•÷àùzèçƒd í6@çMu¤ò¼Á[42ÿŒ—>‚'f›ÀTàÎÓÒ·»2¢MF Æ•2¼û>MWÀ6`>¶çÒˆh ‰5÷¹:¹)XMÀ\·Q+\Ç1zl´!åï‰<ÓòÜVW,>Ž ÖU ÿîî§Wd°äÞE¨øe^$rðSÉM×' älÁŒ2×úÕdþ3¦t•{ˆØ×?x›«£Á¶&(…$0„k6:Š\ TÐ,UÃ*¿~L°^‹³Uœ@¢­[åi¡*J.`6ߥÉ!1ÓÐúÊ@%‚÷=Qè)(ióQðÑ1]Ùÿ}µ ï/»«‹yg]MÝ'gç·8Ý<¿5öœ*#Ÿð¦{zfvz°Ê+e“ÖŒæËÕ?/B²3õR]OOÇś ÜóÂSÞà6Øav×ǯŜ¯erXËJ²þê'¦¦§§F2|Ñ.ÏÀ[{K¢»úÚÈUÊ'O‡=o˜žžžl³S"¹]EúxŒ•R)_XÙ‡×Í-e‡sÓ3Ó“O.ºµl§6÷ë6[MHYßÌš©™Ù©ZG¼œËýðtS¬ÎæâÐäÔÌôT{Qâ)…ö¹íµö—,!¿¦zffl°ÍVEÖ1Ú€x¾­ôÒÕäÆ¡…?ÚÿQÕ9àfþ àGê:£ýü &øï…ÉZUÄó×IñµØµñŠHäûE€½=Ÿ]úyë€V±»2¬O”‹Ío…šzb0Ö¯PÑZÛc²ò™Ù™‘–gòò—k¡%,y„ö‡ÞÉÙ™‰ÒkÎD2FËÿ˜æb_uì儉U0Œ(uŠSÚ;Q¶iòr³—EO‹*êaÀÂûKÄû8O% ¿möž%¹aÑy"ý¶ÿM0 aµ¬¸b°Oºæ ñ¸kìýì•EklZ›øÐ áþjßZöÖ°Z6¥Q¸™gguRf/#ÎûggehpŒ/K.§)Rër™§·¼Â¢µðf oŒT‘ èן…*»_ E|Ò<,ï±M}”¦œMÒž!ÐqEFμm…×<ûHDËsK,0ZrKVožœf¬­nî°Ž¶¤˜ÀõàÆÁ/'Äõ»SÀÿñ;àoþ?€om åX,àuemþ»6oè\&ʵ3kZä0+ Á‚€iÁÏA%–kÀ:ඦmå¥z¡œ',).‡99:¸Â[ªÀfsjrq$rû—ÞýŽ„Ç–0ù&G÷ó«h"È6›S`‰´:aÒ­õ5¨øû ½àˆ'œ+hýÞœi¦adžø|s¦QÎ2{—±¶ I÷­eT.í¥óþ–#I+|ñ­ïu’û…kÛvZ;°|iénTr°X¸Œ•^-ÌéÌ>Ø’úõ± #€„q|²×Of:ž“P¸PyNÑ £ì!qø‚zŽ·Âu(fA¯Ž¬BÝüþ5\΃ ¯`à˜ö¬|UÈâlb¸òž.•|Pã°ÍXÃc2w&øÜY¢¢B4°xß‚`¥EÈ6Û1:Ê$ë(Á-gÃÏàdo–ÖôkM<šHQò»˜ÚÆ߈ Ë5ãOÃâpX}Çàüݻܣw½åËà@ €øwðÿ]hær¡ƒßc¦Ð!Ú –Ï6üõ/ÀüŽøN BÌ n¬sü9¾­$° DˆSUFª¢:$’©-sÀpU&K뮆eÊc•êÆÖö\,¾®Cà³òÎ Å_tÆ"Ÿ7î‘ÉT#È6ù£Çx¯·’ì518œŠ©[æ«ÚMÁÚøY'¤¬ªS °]ιÛ“Œ–¸³6²Ò‘ 뢧“îÜÏ6Üé7ñrH•ìŠö™ùEú ½:BëpmF±”ŒWÞ PRVVÖ8NÓm¶Îk+iy_(/-ÜQRRú¾d‚÷ø6}ª®âmjl¨¡m<#ðil÷¶Ô<½ÃÉ€Œ"iÞ©9zËxF#ð× óÀ­l ¬ Àþ mZ©Lèà?qëÐ"xÛPOBÿËM’«yø¿y÷¶#îä=ò?€ÕÌ6; Ý:x¤ïµÂÑ©¹¥eúHÙC b›ÁÊ;¬f¯h-`žìöµÖ>{ìlHAÔÓ*D2ߺ¬Ž·¿ÿQÔú+#ï(rÄÊÕ£§Žóøl´»©(÷Ž¯º”5êÈ›³vòr)Ï÷Ú¥´ôCy%7;-s¾ecm¼³Ív’.Å2¥H”Æ\¥‚ ¶d^&ñ+´¤Y`£ßˆ,©ÁòËX¤á´Ð50 ùosˆ*k mÒYD ú>Mò×uÎ8°¬€ËÞ¡¯í}Þøp -e0"Î6\î£ Uû¶`ŸwæM[ ‚Ÿm ±B¶¡÷•Qð¨w#,á†n\ÆÏo æ%.öQ#x¦Š©×¬]&T®ë+»¢ÃY½ZòØ´¦)`wcecÏ9“l¦mµË=âÔGsc¨òCõÿÆ×mšFð7¿þáÀ/âB`a ¥Šùmt¡ãïy÷?l$¼¾ ¬­ 2ÿ ] äE]î¼ ÿ£_'„îYÛ’Ä63yD©aCPôΗ 2µuŽ;Óüœ„ÃÕÎ 4—™²t$òÛ°w6èbÅi©n¾½ÿEW´¶i¢Êø\à)OX?FµanÑÅ7çáÑÖ ƒ_Ó•ÒOë}Ed1wx­±FýÞ*oRXÕ»¡ZR‡Øè¿n gž ÊÃD±¿,1pþ&õkd›•–$Œ4ùÍ”@íT–U½Ä“ ö†»®’¶™¥ÖE^À“µ>eIK_1èµ@=`m/¾ÎÞ¿ldSuÂXè=ù~ò÷EPMoIDž6âkåcÏ õœùò:]•a¥OA›Dóôè·øïÈ¥üÑ9ïH!™œ{ÄOg­»€¢¤V9¼&î%æNfO¢nÔ 4ƒŠ+f(Ód¨\ó„ºy‚ø¬o¥23DE+@Ôo¼´õoT¹6Ö•_X¼¾³?B×h"Äÿð¯@ÛàCþúŸ Ÿ1ÀÊ€á™W¨3@éKàäßBǾOÄü6P¦€Eôñ,Õåj'U DmœbKá|^ _™‰²&ãÉ*u;5#”Õ}–„i'èiÛÜ`‚Õ3ÞUPøvu‡ç`Zo×FKG½àyjf«4PØóåc¼‘kÅϺfwäl¶%‚³êŽ-åéNXjØò}oÏã°*Õ³üÛÙIg”4‚ ¸o $^¼5`$×%'Çg›õéþ‚EK[¼ ;½†èÓA9‘îL"àUhªÞÜãB){_8‰WÙ÷œ7p" ,#`¡Wð-)¦ØêŒÈ‚Kÿ/€ïMÁSûæï ÿý¤%A^â¿áÝܱ"Õ³/ÿÏßñÜ;ÿ'ð—S3Æxü&+‰m&ÿð1ÝP_ÅPNó6ÖamÜ‹vÅ`0ÚÚZNa½“#®š8$FíÕÐ÷2Q#ORÕÒ3´*z}Uª-©Íék‘®dN™¦J%áMÝ¢Ûx“;³/ýAÕ½ ˆÚ÷á±¥:F#°ŠçÒ^0yzÖîZ¯’ôÆíÿ©`,FVR2£¤¢ª@ÆkXù•ïð?Þ7’gàIœ_xÜì>nº¹êÈçˆú9¦êÄ{ôÏE•<#‘§K¦'}“:°öÐ݇‹#ö‹ÃÜÝÛTý¹@¯Ò6½|ÅäF‰5Îðc¸yRSÂUIΉU}¸ænøQXR\ ÷òPë|¡Öm`ü‚ÁhDнú—ŽŸ ÐüßÞëO¥¿=a£«s6«V Á&ž!)˜Ïÿi2ÊÙYÒUuÿs—ù0ÛWAì -xr¿ï/î{dïÅ/€™?Ctñ驆*xœ’–:CÕ²xܲþmVQ‚;ZÙ«”ûó;‰aÀøvøS’Éô æò›áy0`À€ñ[a}õg©g¸–aü–1õÊaÌùó‹Õ_Bš¹‚ ?q~ŒEP{Û„dÿîo0~˘|a{R#‘óçK0Ãùv|ígåè?Ý­=*<“eŽxÖ³ðÓ½n¦$M»°ýCžªº¥‹´Èþ"ƒÁªŒ_‡:@A7×f¦&'&§–V7° —7/}avzbbbrzv}‹µ§4p™ô…Ù èÂÔòCtž±º&bvΛ™ÁY›­7–#ä4öMA÷N3Ù\QD.}zbf•»»>>9Ãæ°–æ¦ÆÇ'fæ—Ym„¿g{‘—éÙ…m–`Zsk}rrr‹)ˆÅem 295³Ê€2ÉÙÝžèË'ÊÔOÏ/l±6æš,øÌO`® 49Ìåy(óSÓs;l@0;† ¦±Â`m,ÍMŒOÍBÑ^Ø;›3“ãà«Œ]~~ÖÁšÚÙݤONðÏCÓZv–çò|uÎNL®óg 묷m¶¨~xµ ½yÔÁ6›ËSSKÛŒÕű‰)þî~œÝÍù~å,±¸{sŽm71µ¸²¹×4쥹þ«×xÙã—nnz‚¾Éb¬,LLŒƒµ!˜Ìe,ÎLÌÁóå`üÔÆÀ(ÔT ‘4Œ-õhh²FZÃì~݆a¯N"(¹¸»ë*SU l†Wvy}—ìH¢ݽì ih¢æýN¨».µßÓ$¡5Ìœ¼Î؉D§°;€õè¢CtôIˆóG¢)†èB{ƒ“ sÒðv/0òä4†–àªoáI¡}â ²³5ëi¢ƒWÒôñó¦a 4ûó|Bÿôÿ4ÆäøsÕ b©Nn†jŠÊÚƳÛ;Ó=‘Þ&h¤¢ODÔ“~zÁeW<–hç˜õ”Æ«>–$2ÕÝ×O_‰ªlä<ÎàE¡Ü]5ÓÄ8{]Ö?s.åj¨‚Æ6£)ÂÅ*æz²·>«Ì_ï}V‘`Ÿfen—tÍߌŠ¥X7lÓE©f*Š~pðÙ&ÞÒ„” 2‰ìæëg¤¢ d`7¸e•½3{ÆX‰LÕôóõT¡ÙÆÇId›×ñê§ö FŽ~K S-4šÓ”ðê¦~>®TNÛï—uÖð-E QÃÈÒ@MVO©æ->â2/x“Èdw_35²–eã"osÝRã⟨jâ}=õº£>IEÝ{ bAÎwÚ)ã³°8Àø‰õöYKÓ`A‡ï{$vœc›Ýál'Û0áBÿµ`Š¼ó3h9‹1¬‹:ýP!a¨49 Š¡+mþP¸óìì'¿àøE&`6)Ê+æAÝ€“l€ÒMªÜ0]€’UoUá9Œé A8ÊÕŠØÓ(ý~ÞT´êt{Œš¯pú =T_Þè ´8}wc±³³›?:s&òl‚º÷lEÑ06÷y³ÚÆïÈK™ÏòO³ºTåˆoG 9'3ïBäp–m‚é'Ì4g25€¥“¹fe  åÿВëƒGÉ>íà€ã沧®BÛžy—´ˆxÅv¡.mKÔõ†…^wP1ä/$?D‚j,ÇbßwW yC«0zn›ÈP|YZ­Ó•—AdèïS 8•Ê)Á2Š[¾Z*¶ñ‚™Á;¦T©ˆ§ È½h§dè'XA6ø2Te7S…^2X«Náêï,o„I:ô,sÝÖHQÅ*Œ¯ÐpæZHèœz°ÜÕñσS°@Àøi±;dˆüîZ÷>_î¿ —ÃÚ\£ Ž g˜Ê©]®â)ö ¶*먧ë[ÛLÖÞT´"O¢¼f`÷ÂÖÎ.s/ÔF‚ ¹d稜¤Œù0ï}UWÝ”máí‡s¤J§Ö…:Ï€þ÷² = ;­‡‘OÚæìÝÝ]öûÛaT÷î!_0‡ÅX_392ôÈ­-`g¦ÉK™ñ7-4ybaÿ"(®É:h률1¥Éä ×ÝÆÉsyl£GM«ãg£¯ü«?Ää牪ô¿² Û¨‘u¶…Ôðâ²’¡Ûxž`§bÏ;¿{˯_(xÅ.g²í!NZ$ˆ ¤AF(ó…AD‰ºÍû}<í‚0>Ý” êaÕ›,&¯v¶nœ15õº°FM‘'®th»d=ŒVR‰ÈÝ3Õú/¯Ò ¦ÅÜ°5 Þø$ˆâ°1 HÅß~? ŒŸ ›µJ§¹3Gz‰¹‹å¶j¢¶SìÕk)·R½ÕPjñÕ|9[¬‰tÔ>)‹RÓ5ö»Nçð],óÙWðò§IÊVv>o:° {kÞˆ&ób‚Ëe˜á³y±jA¶Á¨w.Š<¬³N¨ï}ªA›iÂRN‡ÇãÀ£‘rrh•‰®ØÕjG 2VÝ.æJRÊÍ-¬rôÛ£Ù†î…Çbñ¢DñX òäe>Òùlƒ¼ßÉ¢ÿck1)ð•s”…lsFv,‰÷ÇÔP¢®ù KœmÖüÈøý¯@}ÿ_R×6=±hÏçí¢ŒW¦hóØfû^¸o@```€_äÕBP¡yŸ¬‡·Fd·k#8QàpY²E w«Aù¤|Öô¦[ñ&à\³êad˜¥Ïo((ùws|¶!„f´ ‡€A%*þÎ{xŒŸ ÛZ2§Ó‡„NœýlÜ7FÜ2DçsÌdUl#gµîíccE¤Eú®ØéÑöOWBìäñÚŸ7ÙÀ¦ˆm ¨â9~&ºÞ×¹ëMJHAèGmP´¦9†0£fR§ÏAnÝQ§ƒv$B°²m)Xû„=…Á­u ÛlžWÆØf·KHó+Ùæ¢*ÙâK˜7 þT}û5¶8Û0bÔñ–÷k½b-”‚²Ò,úý.Z‘Ç6[é¾AÁÁÁAáŸ3l“%T¤OÞ˜8¬—öèÈœJù| í6Ï«`Ínx†`®û ûD‡ÙÆ_Üu³å¡%ë|­UïºL E,_±Ín¨2ÉñN© ;/URåÑjñ%Å¢Î{Ý!Jf¦3€ÐÜÞùø:q“%ìüÒÈûC[CœmÀÓ»Ê4c͸"@È6Òrø¸:¡Ž5ö@î”ÒÇ5èæç>8œó @8Ópj ktõÀŽuPì>Ë„g‚L®¶ª ±*Ñ,).Ÿm^Bl´ÄªJÜm6²¹8Ø?»)ðÛ| Û\Ò ‘Í„q€ë::VW@¦å±Íe¾ÚÕyUó”îŽðÛ+Ã}Ój÷Ú‹rÍž¦’¥%[Rû؈6“3Œ®„ë »ê›æ ˆb»¾º²¶Wšùm·9óI‰/]š.¨ž6¸.Ú ¯-ËAô‡œL_bx.'ŒŸÚMÜž%ƒ ŸO¾Ÿóð¦£6ÎìR±¸nÓ~ÝDZÁìá«’Âì›6.áOb4Pêþ¥C,z›2u&:1¿ðõ‹Üûn¦TíðBPªnXáÕl|îç¾x]˜5ÌEµ˜âS –±¾•ûV0Ü'Ú`‰xÂËÖyÁ¨<œ#ƒQ°Ñ6¼|÷yñ«\=¢²]_ÖV‡Ë(²r®Qɯ޼y˜|A…ºT ó³momlìÚf!æéË°=MÒ¿÷â}Qn†ƒ‹ÿÓ+ÚòÊïZû9‹o(§1!©Yyµ ™IËZFÜÈ{]Éb|6!Ê›øÅæ½É½›dDExe¶ü¶¹¨NÔótñ=_XüîѵÜitz DVïoúã©ú™™ c»Üía+*ÂÐûâóWoòî_7SB¸f@ÖÍÆp>Ié›–ŸŸfgeã®2?žm ê)OGH£Cï½yS”(/MzÜ ù®ºò/ÉÈ£nÜË}˜æ¬‹7Ž~^=FD„uXÒ›wï²’£¨Œú9à8¶áÖ&úX„߆åÆÏ@83Ͻ¬Í¬“žâNÏ}ˆÔóxÄ—³‚äps3s— +ÃkÀ.½ÏÛÙÚ7ŠãÄžëHŒô±´´°°s½ž].TçÙ¯î^v²1·°´ ¸˜6,Œ>;VqÓÞÆÒóŠ`Þl}^QÁrš)T‚ ¿æÐÊLæos +ŸèÛó±ù6Kmñ!gÌÍ-ì=ÃJ»çù™žm}ckkÛ:ÃâßRœeanîäw©w àlŽ¹Z{œ¿^É¿dai}éõ(DP5·m,Ü.>ä)D£iüÀ¼Û8ûä~ü,PXá>6©/ŸàF›žÚX…Π؆{ÃYëJ=ƒï·¡¸4<=ccjiãö¬iRðøÚ@¤‹¥™™Cñ Ϧܞ¸})ÐÊÒÂÚÉëqYÈ—;Z•çéheiå’Û´0ZzÞ< àðzïÚl›Ð"ŽXmTDzÙ›™™»Ŷó"«óS›o)ðu´Ûîꣲ½2ëC)Q¾NÞ‘e=+ÂÒ1"ýl®?ë¤Êwv°É¯…¶«©MðT°» ŒŸœnŽy$ùpÜÉ·ÖÄ;¼a)gõ@ìkÄ6=‹Ûû;&{\îÉéÝáˆs%éÖ}ºöï *þÄ6.¯8*ª•äWGß}xYôÑa©¸‡:jŸÓýñÇ€}û›²Ûœý“`Y€ñ«k¥¶¢4=ÒEóXïòØæÛÅa¶ù¥c¹!·¤e^!ãWF‡¡‚²¾}\|`+ ©šõ/ÿ2Â?¾L0Öñ7& ߺ“H¢•sœò­Ùp˜0`À€ãס—ìá·Uâ^E_{þ¸”~Üsßùµç…>gñ6}är\9Ü#~Æ^!ÌÛѯÞWXp‰z„—E*X÷-lÿFŠü!ESFïîG>úâßþSªbàPŸáì?È(´Ïmý@“sÖ†ÁëZm²~Læ_žCþ^'çðùì³d´íËü3Ùèj©Äñ„²¡CÅ ]`6®õ†9˜"¥ä‰´4FÑùR>›GN;CeÎæ:2²h"!‹Wq}ÉúYd›O-ŸnÑp²D2^Fžèx>w¿aÎYísS•¿òiÛolôþòÀÇ?s×’¦{)ç(—…¤$&u¤»cÿWÙƒãØaßÉh¦G(_8Þ&K¬€Ó °¦8G¾ùȪ<˜ÜèSiŒZçü–Dq<¢ÂY/•Ô•¨Æ|¶Ù·u×±ï+ç¡"‹>¨íÿÌγ'xßåŸËõ×£æ¦û‘õ\ù“Ž¶úŸÓPßǼ[¸L?‚ž>6°Ü’¥„>•RA?Ô GeòÈ–öp¸E~S/•_•Bi–L@ãsê“¡*ùIó°¿~{^àdU›–¸ppõo œ³.*!zÓ-I¶‰üS½%wmôT•”Ô¸aaš^¤˜kÓ”•5òÁ¡V–ƒšFäSQwl}žd¦­®¬¬jã}qd•?q{þ -0³7#ØŠds•_Þ·égõTU”•ÔÝ£o¯‹uüÚÜ«FÊJš¦)…‚uLÛ˜=šíyk«G£©h^Ȫ¼j¡‘¦¦Ñ46ÿø¼«Š²²®¹W%—Ù©2ªŠnÃoF#g)ÑϬ›€kó}ùblÃ-{xÙX›¦B£Ùû_î[;D²¼ìLÔe0æwÎá „º çÓy{Ç‹œÃ$½Ôía©¬¢¢¦kžò²Q¨˜«¸¿áßÓ[”j¬ESÕ4Ën[}«*ü|ÏÊ;££”ÉËùC„¼éˆH¨Ù»;‚ Ô9EqY5Ë‚|±·ÝLÉžq﹜ÝƲ×]KÂÚY6ÖŸ»×þjHòV° Ú9$ã»MqX£³ëSÅÆªÄ ¼Íz7F¯‡8«ÒT´Œì³«¡ùáÓÕ9ªZs,QÔ$lɦ™Rõâ?ò^ǹäªawšúÈçþ´¯(·6þŒ‚m¸°{0.ëQ’_ðfß’zꨠlàsçyY]/ÈÅñ.%ãÜw•õŸý-0Ú^“;ÀÒPs´ž’nàÕÞ®îM&0Zy+ƒ¾šõ¦©©þÙÍ Fã=o…Sjˆ*ÕÀ?:9ëCuàVß EáÕ¾*oj¨ÎˆvA*Û÷ðCÊô&HaiöveÍ}ÃýÍx,^÷°§¢cïøø)/%LFN±bpì§ÏÂ-ðZe5µåu‰¦aKÐ\]vñ%¿´üb¼K>#…ÖÎy[QW[™ë$Gvæ‰e„‹¢XºÛÏÊêzÀ¤’]Tp:®oÊ«j«Ëc=õqѼñx';ÔÁ_¼/ÿð6×Jáx Zyú1ݯéìWú©úýÓš´TD/` ½ ‡'è¹?.kê¿i‹U¶YÚæŬbíÈ:ÀžÖÁh»]úTßôñí{M IƒÇ6@K²ÖÐÿuyu}måƒÇSXÓÙíC¶XÊć=Œé'‘blÃm¿wÑí⽢äè`åý¯çÖÔ×,~fG“·L…Ö¯½»ªŽµƒ,¦éÆ4´ ñúÓ²Æúª›Áêº!Û°Ë®ø$CÇ£éÖHû«c(÷þ­”[·‹ë‡%¨HÁ/š+IE¿˜<‡áÊL¼ ±ð3dÐôä$ž9›¼{XÂ;c¥:.fîùoßuMì;ý–$yÛ ÷«?¼¸£+vû5Ñ„ärÞÔnˆqF¬‘ˆ˜êYðÅù‘g‚³ZyfÒ¦#M*îãzÛ‡ü›É7îe-0ù¬ËíÊŠ?}KdwnV†$¸/KÒ™aü¥梬kÅâµ.seX›*£Thðn ª“¥ œ¦[ÒLbŸðO_5—ÖºØ"J!ÞKÝØ+”™[áÊÚîëТ€Ã¢ÛÒ¤C²…K—™Kæj¤ó ã¾¤ïOR‹è‚n°úÞý”møœl!epV¨«l^;cw£¬—=Õ@%bòšWé¬5QФüöÙZúÔçæÆNh5‡ÃenMã¾On…záÙ3*:6‘‚x¢V{]ÿÄ4@r¸ËÅ$¶jš»3Û©BBf5¬ñÓê«xàâ³±1o2Î ŽÉÞ$uŸèp¥ #\~Û%xùÀ)Œz×â60Ég›•¶—x"éÓÐÿzÏ“y’&mvoê!í2EkÃwÇ'ÄÂñÕ1öo=‹0hyÅXV„ˆmŽ²èƒ¨hbùœPÄVfé q¶É²–%‡TEn+TùÔK <¬ÒU²µÔ#¨ø½êeGÅ!£ŸµŠt'áYï.j#µ/ìíÇ¡ûé«"‘r’ÁKž–vÔFÄzâOž$<¶[kŒº”éÞìåé÷~Ò„ 0åŠ *Î[`Ä-¸.C5œÜ`‰˜çìN›å,‚½ÔÍÜccΚ¨*JᶖO‡îÖ:x< ‹ø·Ä6NT›ˆb¾~¾2òNƒô½’q‹‡ŒôëÆD¢û=P`Š±Í¨…¼”QdJzÿ®4oK}53P–n…Ò4]rùƒ kµ^ )ë›.¸)-ÅJYÁ:†§Ãô%ž@™Or]r·!èÁìi©–š:iÀþ ´'³É8lX¢ ÛIº|PaçA'géa¬¿©¡¾m-"J&±º³®T«Ð7Q÷ßJ v52ЃîÒP#àqcÜùî$$¾Š~Эô1Ýkt‡)|6#‚¦~†·¦ d<1¿iVBf:_¥Ú<Dz £ïý-‰Ö¿)¸Îêy,Uçë6³57°H‚¡Kò£ÂÙ- ^ Fï9ª)¨8ۉݥu,AEÛ5äò»†!Ñi!Û¬xbd½ßOŠ*àqõÐDhN±ŸÎ)œEç† Óe²2¦Ÿ÷ñ+ÕOMqZssYÓc£}õ7B¬hª†Ÿ¦5ZzâO ÍÇK(ÕÉ v¾w}(ýz| N†Z¹ìLN«5ñ֙ݴб¿¾»ßõÂÙ3#ËX‡æ ,Ê­i+5RPŠÄÉ– OÊÃÊ7aÿ–؆bwá¿=éÃ…T4Þó\Ü%b.ÇÇß-ïÚÏ6ý2²æA—bc7ÅÆÅ]ËÈÚ…ØFEËK°–µòIrŽÜK*.þrZa•€mЖ3B„m¸—M4 £îû&Ö?$áÈþÑû²ô°ñÀfÔì+öJ$#ÿâêÖ¡‘Ñ¡Ï-†„S¶q¡XGUð_ÅÞšµSDë¹ÇUµtŒv—帊q`¦#—ˆ$ׯôTó½Ä";b·|!Û^4 õ >ÛÌ Ùft«óõ "I RmøB9˜+Qy‰?×¥']ð°7“;)ë|)k‹-&N[ƒ6däƒ7íM ŠbÜqZf•u ³+Ìc¿^í|z‘æg¤†—#<ëXc›;Y¹Ð{|N”òáeí eMÎB†»Ý¥)#9.HŸÃ4B«8ÄNq(W¢CVˆ‰ŠmtÖqý dŒí¼àÇF¨2™fívY؇bbbc/Æv€€½uFœ=j±. R+ËË^¶£ž +X™wí´´ÂÓ$½’¨~Òûù",ãßÛœÿÈ—ÇÍ™&Z:w€+4ÔA‹ƒÃëPâ–Ôš/é„GñÊÞ÷ èè&q¶a3† Ðßßhí5 JJÀ6ÓûÙTÄßøèÝ®ˆ,ŠíÕõmÖRw1‡ú0ÈÒ^‡^Ö¥yJ*E8°ï®´j¡$°ÍêX1EýnQðìD]6 Òm8«C±ò…ÂeçlæöêÚçG³Íc´"“@$A‹y .•&Ëø~0óì=a{G”">ÛØ‘÷U ™D )$üƒÊ%àK 4 Ùb¶XÑ5{2Õsum¶Ï)J[ä ˆh4ÅJî%ìÔG ¸ˆ>)qÖªOc bºtV]Z-(#®„mv{[:ò¿AñN2Slu´‚oõMJÈ66Â*cgÛPTÎåˆwt.çE¤ƒŽküvO¢4΃¾_÷ƒÚÃô³$º\©I;ñ¦ÿ{çþÔÄð?¥þà´Ú $y ÂKHHHHLA@°8¢ˆ£PQÑòж¢2CQ«­*e¬eê‹AD©R|R«"h ¶Q°&—Ë]zw{—ƒ¨ýÁ™¶Ìôûù)¹|³»ß}|w÷»{»ëæ¯[ó”hÞ-?;m|.ZÆq“Ÿ ²U~É9ú]vû™‰¿Mkµ]i,úƒ-TM©mÃþ~r¦µajEE¶>¥¨Ž3îb—õpׯo²6TÁv ?Pbf/~N–‰¶´Ý x™å²üz¶;ö?êʶ¹zR-”tßì¹2„à± Tt¢@SuKAõ9ÚÚTÌ°6Óî‹ñbá±»( ë2µôLê•‚q«:æÃí­(Š–ª¬HuéäÛ[›)ÂÝ-•ÄÔ´£˜õE©R5ã·ÁGW¤fìïáœ/{bÃbÚÒ'ž=ÑÞz`ëØ‘eyÜDŠ|z÷F÷õ;!2£=æŠàÎ’ŽÆb¹¶tj†ßæB­1J»¥Õs£IÎmȱþ+?"ÇÚd‰.|éŽ3(k–$…§mE'1¶lwêì5¯¬d>sDY«Ø#qpwWªF¼fïEú@õáW§T³¬M`º¯F$ÐaÅz›KMkŽ³5âîÁ¨XkS®Öµëg¶ˆ‘k—zï=AÆäzcID¬m€™!y†O/– j¿£J‘œ¼«»oˆäýM¿¤… šF¡‰Ï!ÊœR[eGp]•>é0ÆEǦ8l&µ,ÆUÖÌ”*Ö`Ò¤m>ÄvÓ÷W;Me¼Ýa—Š“s6¢ZóÙµ¾°_¢ëÌM7Di’9Tb-þü)ª·?™aâ­MϪyâåèv‚ïVÇË…‹“S”Òh{Á¶'LKÃnÉ6¨¥º4GöeŒªhãQæíM_Cb˜ °r¼®X%9ssSŒIõã› ’drCÃÍ?+så–õçX[Š¿¨úÈ*Wj–å¹ô†´¶Þ!Ëb¥VoúÖðÜ:dJP‰T†¥Hè<=F'³c·1rÉAk³g­&.¯…þúôªHýM/g4Ü-ï…k¯RÖæá©EBE÷}º3½´«P-Æ¥š“õšú½›Ú>úÔÀÈ©ªDUT\²)'Û,Wj */1¾3~¾¢¢#¤h(%çWÀ(I|?½löþjšó¸¬À¬P(-¶œÌDµBo>4H[Ýöê¸H}˃wâN¾9A"S›3Óõ™j«Ó¥ŽÈÓ”.[º åÍx_k–Q#ÓèÔ1Ñú gç=T ¿;å $2šG™³vïãË_™Sõ‹ÒXµ,L¬´Ö1C!òB¥u¡!ßóªµéßúN{ÿ}«]¯”dd;Òõ*MŠóÌðsnÀåÛ’´H ž¸6É ‘¼ÕªùÑëÚ¹!v Ü"‹ˆÔé4QT_ÙÊäq¾|ÉBãŠàœÓÛ·-Lìƒ5©¹„ó`ô}r|5 ü¸×CÃÝ›@Zq¯×ëÃù~ƒðcŒ×‹1#yæ&5ŒþFø5:($†aDp'9á{éáwd~ì¥ãâ!|L¸L@ü~?î{]’< çØlz0&‘~£>S¢3´CÉfÓã£oz qæ?8:¿Â¼B‚Î/¬©Ôïì.’ äøù ‰Sÿ¢µ#üüó "˜$ý¬’F?ðº0³Ó‘KÖOCÏ1&p%4£áN”//›íÅ–$ŸxJ }¦”fUà ’VŠÝKCÒ™„áübçÁ˜'F#%SdFážoÌ]öšpºÐ±ÙÛôˆ`NøÐŽî” ?°Ÿó€¤x}~~òNHe&ƒr“ËVpb{­q–-ÐÀ „«ûò{Çÿ^æy×Çú¯çxWýâÊÎŒåûþ“·é¦/×d­lFù35|^.ÔvŽb°·fPB·è¿ÌPäNâ1©AæDUfdi+¸løg áyæûÍOÂK ÿ þ-²{Ó endstream endobj 742 0 obj << /Type /XObject /Subtype /Image /Width 743 /Height 469 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 123025 /Filter /FlateDecode >> stream xÚì½\É÷}þœïy½¾ósï{Éöùœvíµ7( `r ç rAäŒH"+„A€„$ˆœs3ÀÌ3À⇜A¡´ûØwï¦%–•`„vuçÝÇ]ŸŸZ=Ýý¯®®®ú×·ª»‹ÿú¯ÿ22ÔE… *T¨P¡ú.ë¿$A_O*T¨P¡B…ê]¥«£¡®¦DÀcð89+‡ÅœÂ`Na±²8¬,,Åëñú«½°¶œÂ½:@¼ /GÀËC$DFUEâ<ð\´hk©J—¦†²–¦Ê[;PjªÊßÐöˆÒÔPÑ:âÁš*êÍ· ‡)©k(ÿ·&*T¨P¡ú^ Ø@Q°amež˜çç륬DÁãä‰F‚"òÀ!ÁA~‰ ×àSØKÀËÁ^" Ke6ÛÍx.Ömå†gå9su žDÄH´#&eêÉ㟃Nÿ ‡“—räRU$QL[zÛ‚ôIo=R„Ã`äIÊ!Ç(*ä1X‚ê¾ÊT‹!SJ*s´ÈGKIcwK¨>IMUQÊ‘ÊJªz˜¹g”ßí’Q¡B… ª¿)P‰dîò¥°k±‘Wc.ƒbc#ââ¢,Ì%Ü‚¥µùµk‘°9Ž¼x!p… ¡}EÂ|„Ín”Ån”ùn¤9¬lDÛب“©›§C  è@Iœ<ñ9–xãjÐy_ÙSÇ1˜SÊJäƒ&+’ñ"VHœ‚Y‘B pX²%gœ®/ÙNÄÁ‰(>˜ÇŠ’)$ø©¦g^MgLM˜U)Š„7O¡¤@4¿Þ23\l €×1qJŽÓT"¸\HëmTS³È/ÉrÑ%QÉxqœD¼’Ò˳“È$m^üv“ÍÙã½õà'^QÎB+ØE$"?Id¢ø'ž¨\.( µ†à§d*T¨P¡BõUÓ ?NÎÉÑ62"ôò¥à ááaç/^‚õȈ0h‹ xy%EJ„xol‡½p ²×ÆÚ öR˜¾sÚ›~ SnÄ ʦ/uÜ•ËÅ -*öÍ3"Ðn€+€%®.ö°×ÉÑ–p$HMUÖhQ%Ê-;~¶d÷‡%ÇÏ2ÏP/kÈ,»žÿ´ûCˆög”-dÒãâlÇfÒJ‹rUT¨ðó@h®Àc‰Y­œ¶ûi=’{ëÒ[]ÁZ˜—Т‹S:›04LOOIáNpÍÈW$ЂWÔìð/»hÝnÒ.“ååïÔô´Üu¿„ŒÁßiÌLNTx‘pâ3„òvfKsc_[®–_á@CGؤ‰‘ÿ´˜àqòN‘U¢IfqNF^NFJ´O¹~O0Äi«HV ¼|ëáîàéáèîf?ì­)d</¯@%:9ÙººØ¨øœs;çíêáîœÖׂ½d‚<Ýøã9³²úã¼õoæ-ÿcðìÉ9Óá™}¤F’{WhQ)Ë計 @]M©éÇ(™º5—ßW$bÂoÞI‹vÅ°$ÆãB|QZ$GMÊ*hk®i,¿ï¬LHÍOÁSU˪*}mUñx¢÷Õ´æ¦êV8æ°Ì!èú44—xkbáJofägÆúáð Ѩ¬±ÄMS9­¡*ÉYO€½8ëÀ«uõÕU¹~§‰D}ŠÖú’~ÆXâé’ÆÒsš8Ðì¶ì"çžØÒXÝV_âHQ·­o*²Tƈ”Ô†êO#§¶¦2=à(´|¢B… *T_k—%5c,-ŒÎÚZœµµ´;k +66æjªŠ{_ik©ÛÚÀ^ Ø+9ÀòŒ¥‰øShÉ×CZ„SlßÏþxÆàƒƒÍ~0`ô¯†¤“>Öy+´|ƒôïéÀŠô†•Ôø¿ZG`éõ“J9ñµ-&ïõ8¥§ *T¨P¡ú«…<^Ðý‡½§©üR ¶žñýB *T¨P¡B…ê¯ ]$ÓáÊ#3âHFQ0{L‚L1‡ìK2ÝÜþÑ" 1H$/y?äбZP¡B… *Tß ¡Ð‚ *T¨P¡ú~A +‡ *T¨P¡BõÝÔ´<Þyt#îê뱨P¡B… *TßA«ìA wB… *T¨P}'”‚B *T¨P¡B…êÿ>hÁãäNžøü[ÎX‚‘?%{êšùÿM‚¼•“=ù÷5â°²'Ž&½âqò§dŽýEf×y/ÕäÕ•Ê8þ9:G*T¨PI‡#sòØKÉ£ªŸ¶¥Êc“S/QŽæB¿ÃÉc{Û܃âHò8o§ÓD¬™¥–b—Zhdàà}ÉA™©F’ ñ$6ÃÞ¤3.¥•$(é&f±™ÍMÅ>–â«´Áò-hªzLz^7£¥£©(ÀùÓH²È¹<‘üOñ‡Á«6ä0²XI ÷R…Ì«³guÄóbMÛè¶ä¯N$¶ÂJòÿåyÅ1‹×}3Jã]¨°¹5âÃöi¦Iɪ®UESC£µ6=ˆŒ!gv1 ”ä8÷ÎK R˜·ÓâS•OÇŸ7 ¿ºˆƒSÉm«QÆ‹Ö¶t¾æ®ŒœZ’²{— %†çBXÍl>_À¦±:Ëœ¨Çq¯l Š¦ô»Ž”}åpïºö2‹W++Š#bNíÝýY ĵw³ö HJ9L©nîbÒ§ÇØÝÍ9 ¾ûc“̉\šäÖãTó*î) ×ûêF­YDZù Sd=.³Ì[åäþÊ%‡ÓªÉ½H_ÚË2spE… ª¿Fh©+UÇËQÈx2 «iåÁ¼¡¹-ÇNâï”7ðXµ~z§sÈbh©+Ú‹Zë9§ZQ‘¢¯¡bxînV€‰¥lKŠ‹¶†Ú嬒T ²ª)+×WGCý||^‚îñôºÚ}yeWf¼±”ôP´MGØ)jx9Æ7Mµ°;yZr$Sza´‰®š­_tgª%«ÐB!)4ô´¹èUU¨Râhá¶å>¸ bt·y(c㛻Ι*’5,éÌ"*A-xR,ãn¡®of_ÚZªŒ=…ú.T¨P¡Ðò:´ÔW™k«éëjª*öC …¢Ö.è­+Ê(Ê¿Ÿ?YCáðÇCõe&š*º:êª »Ðô;ÆljD¬ý夯C ÝP'­å"âÎ$TÅ{Ÿ>’œáH€-´Èê_ém+…4€R\UCRò¢­#jÛî7T¹ZØ5TÝ aE{zi IòFŠ²Wòý=·”gÅ-¸‚™Ç`Ç5ÅCÞ±‘§Z´^=AÀ(ÉÊŠ²ª›¯ëbp ¹!T†¨¤Åa¤)ãT ò©’#ZŠÄ/x¼„––c51¤9„g±+2K¸`Ž?¬á&ZF¶–Þ>çåz)“vÇׇ§$6·¨à䉵5éE“‚¬¢¼,FWµ2þ%´P5Œ¸ôxߪ¬0kè{³ð†;Ü_Yý«½­Å/3ÍEYJ¶S•Õý/ǵVÜÖ'3»&jâ{¤bìR[öÎÅn¹E‘@‹§‘øŽ ÐptþFZINZ€µ*«œÛV£NG…@‹¼NXåu¯—çHŠQ·Ò 2= ¤ÃÇ ö §lÑ;ÔSZ NvV|-xU»^>¹–Ì«¾-ì»–dFÑÌm¸=–„W)+ŠƒÛ!C´«¶ JÈ‹;-~?YÕ;±òŽ7@ #CR}Õ§C ‡S+,¿EÆ2X=þæ ‡9!õñP±šø)<†€“3q»Ü“lNÂË9FÜ܃A!¹­ÝX‹“—懱㆒[y5ÊA E^álGA¸^Ãà1²8%«êÖ¦î†pUçäjZe~°ÚáDÉhlÕBOÒ¬î(6¥H{µUYÛôVQy½—ÕçgB$“¼ã2ºº:²¯jS¥%CA]/>§ÜM¯¼ì¤át5«›Eïå´g«´t0Û:è=Í9VÚ$"krSÀ¦WÆÙ4Šj!úeÎjĸæ—ÐB¢*…ÜÊï馷W$¨ãó'+P- š¤——“VUÁLáFÓKh©©I§(ë×7÷vÓ{Z³ñòª¶!måñ±Xmo>'ë4YN+¤bb€Éî¢Ñ‹ÓH¬óÅDÈ´nZ‘‰â¡CŽ!ñ¬Ž>-7ÎS™„ÕqŠbw·7Ü Ð0<ÛÒÙÁéng”ÅRqEó NV{[áUu fºAͺ†Ö 'ʺdM!bM}âxìöš$/1´ÜÚ\é`urè%ú¦ÞÍm=ÌÆÛç´ÉDi#-:q-Ú™êÆŽµtqá¹dL"+ä56‡ÚRuÎx¶0:úºš¯zé´ŒtUt2éôÒD=ñ‹¸¥û …¬ zù^§»£8ÉO‚%©šv"#-hsùÅguûKIÌKhéIh!Q•Ão°»;ÊSÕ)âÁ@çKILV­4Ù@ œ”RP©·´¦·›VÿàŠÂáÑš´\7~-¥Þ*'©æõP¹òcmÈx|bAU’—Ƶ^­¹ŸUŸàkˆ:.T¨P¡Ð‚N.÷-…Á¿|<ôO‰xèI‘jäuç’Ý_Oþï=zWC,F^AI%êVZÐiÜwóÒð2òx­e¨P¡B¡…–÷",^))Ê‘ò]€9èvvîÍ Mê_Qþ+he„듾´ÔÒs³£½Í¾³—†'½SÓ Õðh-C…  -(´ B… *T¨¾_Ђ‘?… *T¨P¡BõÝÔ~hA… *T¨P¡ú. …T¨P]n-ÎÏMŽNŽUSc«+ˈùöí…Ù™£Û‚¦'Æ7ÖWÑœG…  -¨P¡:º:Wè­s³¢¥Åù¥‰ÔÂÞ®ÑT{[Ó“Ý]0çö²{X€=/Íá0©æ‹ óÓSã´–ÆÝÇÑüG…  -¨P¡:¢¶6Öímk+;Û@@íl‘ ‚õ¯L^³¼´ØÕÙ¾±¶Êéfm®¯"¶G7Ÿ™ž@ó*TBKmMuRR⛢ÓÚþJ²emu廓˜¥ÅÅñ±1¡ptdxxhpp@ àóxÜþ~nhhhpûáZ’Qýhsc­­¹aksýéîãgOŸ<{úT²ëù³§ˆ^n}OŸ<‡Ý'»wwvêª+Ö×Vxýœ‡[ÏžúðUØÜÜlllŒŽŽF8vìØÄÄøaqþãÿþß&&&`> "ymïàÀÀ?ÿó?ê-‰DâãWaccckkKWWwooIq1à“ptDÊEµ67ñ9Ý‚¾.»«»³½±¾voŸÇI‡Ÿ'ª«­½¶«‹Åœ›y'hÞ@®evvv÷UèêêzöìÇ›Ÿ›•~ƒVWW€LètºH$º”{fz#jlÍ t£JÏç744À’ÉdH²+!!á5z+5Uz6~½Ë³ÝÐ?œËóÌì«î[œZ +˜^x{³Koo}" ›’°³³ëKK‹ßZzzº½¼¼îÝ»[[[íZJrò7¿šŸ}ôí© KE“ãÓ£´n¶Ö…i¾ólV íV Ï®:M¤9<Úx‡WLGo˜lу¶ßjñßlôÙ¬óÞ¨ñܨr[/wž»k2×”sÄx„·ýVÊ\WKyªßZVwv………BõœŸŸ_XXXZZZ^^^YYY[[[__‡» ÕöáÇuuu++K;;â§<û ˜ç‘œœ,¿ß|uuuÏü¡$x{{‹3Ì·-ÀÐý¿xñâÐÐÐìÌLQQappÐÑGMÁ-DEFÆÇÇMNNÞ¹“)ÝWì×úÚjàùó™™™33¢ÑÑ‘«Wcnߺut¢†ŽôeØlvYYGjkk‘•––X2Œw…ÁÔÚÆöÓ?ÿç®o?áN¬4÷‰Êwëø:.ÑPbÿûßOŒ-ÛÛÛeP´¶µóüù‹/Gg7šzE9-Ã×K82ª–IIIp˃¸ê fBEQž‘MlùÐõÊa°]egF¬Çó%7}XnÔ7Ö"Žk~ažÞNûê‰£Æ uâ0“ï - +ëžé섚ɸʙÈbVâk&=Ó9K«(|¡ê]GG‡£$888ØÛÛƒ3v6** 9úARâLMI†ªežÅbE¿2ù üþð‡RÌZ ]ëëëƒSCÛäïïÅbOŸÖGöæå助æpsZk ¿·gV45ÄçŽ ðE“]ô½[Üþ¾_JGI8:¼±¶¼¶º¸±¾2?'jij†Ù;€ÑÙ±¼´øVß¾_ãããOØOf;§¦&·_¤Á`tB¨CŠgƒþ°ÍÀÀxøÈB›é ÂUgÐ*èé€+pyRZUptááaWb¢cbbV%¼ëõ¸¸È¨È°°°ÎÎŽ·õ /ÄVÜjž¾GÝi¥µLÇ×M8ÞíK¨›HkzKW½¯¯—FoA …/ ÐÒ!ÐrëvÊ7€p³^žžóss_|ñâ‹/ž=}ZVZwíè­\ÑÂì̬hi~fôÛ½)±¶²¼0'ZœŸ™ž{kVú;D÷]æï[.åZ´¬æY-çÚŒßr;úéÖÇysÍF§ïÚo4ž_+±[.tQ©½7ßZ¸½¶tÄx†®Ø¬•:¯äžáØ{whi\_]~øp+44¸¢55µåæÍÖä䶔ýÖ­öÛ·Aiic,Vss3´‡ µ•´l¬­lo?”••¯Ò& Àäàp:;;Åí2“ ~£»» ¼ŸŸ b~himiŽˆ¸üxg˜!''ŠGG{{hhè³åŽ$¼xþüË/¿€ÒõìÙÓ¢¢¢ôô{G¢ ª¯«ÛŒŒôɉ‰ÝÝÇ€Ómm­G‡ÈžžžÒÒR¶$ÔÔÔ +°|WhùúÎnî>}ñpçG¸\ÁO*ïW³ ‡®$ø§?ýéa‰h'\^^®¥{zjéá³ç_ŽÌ¬7p¦“+úeTÏ@OÒ) ZäåÇD´MkÇÒ“Cn5´vDb=ž3: Z m]=̾>6ô,ææ̤S°1Í[f¦‹¸QŸ²C?Ÿgä½´I»ßí /öÊtIíu¸NÁŠwÆà…ÂaÏ{]ÛÑñ–ï+´Ü¿_(æççç"äæfggCù„&222’Fkhhª!“ÉRâdôtP(Ð]‚JÑÁl¥w6··7Ñèm´P]cÍ~ô#éÐòèÑ£“'Oºº8~öÙ'÷ÂO£PIbó¶úÚ†jéÐÒÜXÏãt/ÌÍ  Ð<õ0;jª*çfg@"Ñ”h&Y\˜]˜!ZZœŸ›®«­™Ÿ›AÌÇÆFßZFFF$OöŸŽ 7ßm´VÈj)ƒØCCƒâ0Â-§exßVY:ÏŸ³ÅUj•µeT·ç455:P³²ìæîz9ò’ÿy¿˜Ø˜ñק§&o&%E_‰ô¿tù¢““ÓÂüœ´^ùìjdùHm&®f<ªBx¹t$²\xµr,µi*¡nòfݨôVTT€@ ðU•$@·Š@‹‚"å@ 8L›ýâÅsh’`ùüù3¸Ñ¶66‡Ý—7‰"ŸŸ^œ͉&¡x|»w<Ö§ÆFf§! áˆtnYdÔÍ]œÏõ˜¼e=™l¶’cµtßd"Vk{eáȸõp™Ó<›ë½Ùº’kµüÀ|9Çr9ÏaôÚÙ‡KsGOö@¤ÕJ®õbºqÕ'ßZÕ¶¶6CB‚¿»uíø¨ÉêÖÖÖÅ…¹­Íõ‡›uU´¬¯®<|¸)+{j}}< ø™‚‚‚ÂÂÂâââ’’’RI€æraa:,Û[›ˆ9·-ZàÎB'kaa*°‡¥¥%‹Å|úô‰««ëQ€Ìml¬ŸìîBsÌF/‡óôÉ.T£<åÙX_333ƒj 000€S¿xþ <†½ÝýøÇ?®««ËÎ/D©•ȽĴû­¯Buuõ;A WÐKïlù\æøôÂÆúöSÖÐB>mDÇýš¯Ÿ'¸ñú¦šÏ}.Z?~ Ý%8/D™[y8<³QÜ.T>••}¨©©)¸}Gá+hÖ†eÄ9 Z’?<,lNW§‹ÉêÜy¼ÓÒÚ855±93´Âº-,µè¾üiw˜ÌdýÁ㫇A ¤)4›”óMá8Ýb×±ÆxÓÇÕv9¤²aãùîåü®wz¢‡ê»-éééºÑÞW÷¤í¥ã Ðâào®k£(+/sX„ítZdFÐGŸü:J?ùÇp 0·rÓÓ¶Vv45wÖ¶rÓ?ãa(Z‚‚I>øà3SCc#]wW‡ú§ÿ7 à·ÿÊÔQÝØNý\˜ ‰D:ôõ‰Æ†–¦úþ¿—½ =®GÛ‚>Nwg{]uUw‹ÑÙÄ"ZÊËJkjªÆF…#‚Ña>,gEãÜ~vOwüCÌßZ*Ñ•áᡵ7BCcýÐÐÐúÚ¡Ï Ë ¸XUWæ~Ï™dOºuŽƒx3!Y4Ëâ¦t¤G&Å'%&::;zz{€¢¢#­­­`éuÎ~::9äçKí?>ôÈè¿Õ<}­zÜ+«Ÿ;±Ì_¶½ÅñÊä… ],9:´@Ÿ|ûöm¸jd¤å›A‹¾¾žP8 {ÅÀòüÙÉ‹šçΛ;~€O›™š˜Ÿ™b‚+|Mҽ֛ǯ­.O³@œÂáA)íãö‚h©)S”si…Û±19$J:½ª#º®9U|Ôׄý³éëu«%î+vKéFK™VKYg–r솢mÙß .Z±Ì§èt›ýá]¡…ÞÚ¸º¼¸¹¾¥ÚßkÇËùñ×ä‚h·ª|—F£ÍÍŠàà­õ¦ºjZÖV– ÙS§666nܸŸ˜˜˜””tóæÍäää”””ÔÔÔ™™¨ø`‹˜sû8Ò¡:ãzzzÀÃÉÉ7tuu"ž=}êççw }¸µidd%ÊÞÞÞXÜÝÝÁÜÎÎî(˜à€I`þå_Ày ¬/-.êëëñ½šø‡XX\O»¼²:) ù5tÇ‹©ë›[ÈóeÈ£C ä‡S¨•k˜•ñÿკå‡ÌÁç+ùš†D+w};=[åÿð;)в»» ܸ¸¸8==ýÿøƒS«zgý¡ë<¼ÛÙÙ)Ð’ƒÁ5S¨ˆ tu.\ ›j¹’â‹^ÆEà'"37ªmÿãÐgÊôÖQáÐÊêR?S_ZÐa¢2W-,2`G|Ú.?ÕpKJ?ÐuLÍ-›^k°Nf™%°Bò_|ù'››lç[=úÓŸý²¸°Ñ&¥Ë4¶afè{ -÷îݳ¸ás5t.檒‘O,@Kx¤·‚¾¼‹»³hñpŠ»~ üÕ«W¯]¿–z;ÅÌÆØÎ]çŒn@°ƒž•š©™é[¡ÅÍÕ148 'ûþo~ó+èpá0'ÔõIÞ^N~6¡¡!R ¥©±¾·‹ ŽN49¾07~²«ƒÞÚÜÌÜ"àó& ep@ÐÙAïã°yÜþúÚš±Ñ‰ñÑÑ‘á^›Å섽‡y°Ã ¥¿¿uzDTqc¬(fºâÆW*kàÁ…±Â+SÅ1Óù"ôt¡ó(î‹,ÔoäZÖôjÖ÷ë§Ôêä6$UTTTVVJy§H^nŽíYWw/÷àÐ Xºy¸ÚÚÙJ'qgm|9¶j,¦r,´``iMü&ObÍHTÙhdÙhhÁpHþPfÛøÑ¡Ú¸ååedýCK€¿QQ!t%_—@L»Ð4X9³ÿmm)Ýáéq!à `cjldR¬á áðÄè`ÌØðÐáÍ÷˜ÌLÏHÌEcÓBI$£ÈŠvMOIÈíÕÅíåÉÊÒ`ê|¢úL¬òÀÛ#ÖÖUA×J©çr‘[¿;v%ǘGàƒV\J7h½´„Y.¤èÎÝPé2øÝ7–¥¨VPU¡û½]rùQ‘X;bEìG<.Ž|\¹[Òú„Ð233½±¶õqZV—Ö×WN’V/K²%!777ïU(((Ð&ˆù[¡äsî\iI ”œövº‹‹Ë‹Ïæ­­­Ø}vrtdtv‚ù/^|ñÅ@ãcBGGÇ£˜on¬[XXŒ Kötuu9ƒÑéááqÔ‘–¿ÿû®þAð´üá1ZRòjlC’úǾ´ÚjÜÊH).-Ê|p_EUýúíleU¥3N>¶!—<(zröŽvÒ¡Üt©FFF¢âïÈAª¦¦¦D"TdéÐrÙ1º#£ Ñ•ˆóùa¸‰ÆËm êAÕ†~ÔñûyÒ EÌøós¢é©ŠÊ’ÌSJ‚(õ•Zã˜ÏzBNŒUÞØÙÞzWhað']Ò†×èqíæ ïû}¦ñÌ‹¹=ž~a“Ì‚†qt×4gX„RÁ÷ZîÞ½ÛÙÙ ¾¾¾sssL& %*ÄYžüG{dzR åoþæoÀíEEE!Ÿèhiš­t‰]ŒTôIÐY–-З9y\MUñø±Oÿîï~ØÔÔD•ùT‘ôiˆ‰ÂY7 H•héh§·65rºƒÍbô0;êjªÙÝ]ŒŽvFÏãJ‡–Ñ‘!ðT­-ÍãcÀ-ím#ÃÂá!»»Öö  …ÍfÏõî T=æåî òwx9;œûÛ¬»é)›Mñ›ÕW· Ã7o9ÆÙX÷‘‘áÑÑѱ±±ÎÞƨR¦îͬګ€Ëåæçç×ÖÖ‚s–>ô•™éàhïâ꼧´´Ûou§ÍÜÙô¶™˜Š±ú²e~e£˜5UÈ«„5µ´º)Åúeƒƒƒ&æÆž^öö–ææf 3s3Säs*þ¾W†Ž-cB!´•ë@,ƒƒ—.]òóó=Ê«°3S“@,¨¼Â•‘IáKb ðý,n€æ³@&S´§_aĶÕÈÿ-/?¬,ˆŠ’f› ¹.ĹXŹH Çž:×\:õ î­xmmˆ*ïÎT§O<ˆ]¼g ÔÁw“[á±&ĬòßþÞÅÚ²¨8y¶>—ço°pCm.šÂÒýp¡½v23vkaæˆÐÒÞÚ´¼8¿¶²-)=¬“ØN ì :AíÁ! ÐdÓt{{;4©k+Ëë«+Íõ5bhéãˆÍW—NÉÈ@‡½¥¥Š7òZK»$üû¿ÿ»ººúñãÇô£ÿ” $oamnãjnii)Zº»˜ÍMuÕU´æÆÖ¦úªŠòºÚê¾^À £³ƒÇë–-í]]Lpp0TÉ^vWyy©€Ïc1pioeyé \ŸˆÛõx¸öQOòãÞÔG]IÛôØúðµR¿å,§åT‹•X½Õpež7åÀoñÍýýÐßnnb–ܧ&•ùCF^ЇßÜÜÌ„êXŸ°Q5²Þ$®¾g…–ï%´œ¶Ó4uÕÖ7¡hèbU4åT4d?‘ýÐð ÕØAÙØV¯qìä©ãR %(ÑÛÜEËÀŒª®ƒQÓƨiÉc>7:«dé¢ff§¨iJý_ÿÏÿ’-ÇŽÛ#%äã‚ÒÒÒ?ýkW ;e;OK)/â‚Ëêïçˆß^é1jkmu&³6²X >¯_Ú;-å¥lv7‹ äB£ÓÁ´¹¢¼´Þæ`ÛÙÙÎçqßõh”'ºé;½•kež«…ŽËÎ,¤éÏÅ‹»ºóa˜EßË.ŸpÌÿxÐsv1´€–eIÇ5 ÍåäÄüü<üŸÏf³á˜î®.)_bº¹¹úùûÚÙŸYYŸAVÎùx{yyJ^Ï]¼P4œ7^øµ¦|có!o|euã-ƒЉD"<™|òë¨UæÔ)¡P{¡cû æiV® ¿¹±¾¸0-‹¡¡aMuõQÞiàˆcXÀ}´½õ•nI§v½ùNËòÂüˆ€ÐØÀóÖ¶i"ëúTe)ZqùîÙÅ ùE?™¹¥s'E.'F“.Z¦ S¯©Î‡ãxVŸ½²‹*3'‰K¤å»ö‹!ØEÿSâSûÊÌzœ¸äzdhi^O¿à·»»»µ¼õpåáöÚ£ hnwŸ<|òtûéóç/¿øòù—Ð+Ÿ]Zœ‡lG …ÛÇs¸e-=B>sFf6†y$á………žž(~~~‹ ³ˆù¡ ÆÂüÐøðÐü˜pôAV&x à[@÷·ÂƒxþŸÙ™ýæááaÐXûøø@´oÍÛX_›Mƒ˜#sAš™™jii%Ä߀â*ª‘‘–÷-V>&–zf ZúøŸýû?ýð‡w÷±ñY%3'U“³Š8õcýþC)ÐòìÙ3à“½WŒâââÓ$(:J$)ÐâoåtÑ¥lìrïýMVôfWÌ&3z£ó"#Íè\L1Î0øm>,ŽŽt2Ûjslƒ>–m àf[‡‡-3 T¿t¥Ë5Ô‹5 —j/תI+ð6*GÔ*ùgˆæ—P*ø>B‹þY+1î¾AvÞ~V^çLÝ\ut¬¨î†g¼t.E…ZXXصŽ¯ªª<ZâÝ‚‚­¼|-ÜÎYzúZžuP׳Qð 7µ=wÚÇß zOÚZêÐ÷éîî:Z<.œ5ÐƦšš¨˜[h‘ŽÉP>µóÔrð7up´ ´:cKpABËðЇÝÃîéæ°A= F GOOW_‡Åd±ô÷õ ø¼}WyY)˜CŸl%1ˆÍ»»˜]]L 0€#Z v6V¬UFÏ]Wš»¡2§4wUa.Š4·pþÔ¢÷±eç?¬ZØ­ûÑŸ`C_:5\It>)x³ññq྾> pïx ¿º¹ºâêæêìêdckmmk.´¨°–V6g৓³£³³ÓÌÌ¡q×6¶\îõùf \*‰(jÌÖ¾ñ¥ÜöÉBÆtÿøòƦ47Îd2223÷”~ÿ+ñù|†°©¾¾þ@Ë뙿0oeeuúôé¬Ìûoí»-/Î Fù-3ӓߦú@#5Àí…¨€[F‡Žô•ÊÃ͉ô˜1÷SËr‹îŸ/º|ºìúÙ„Õ'„°G[G)b*/eñ2y!@†kúñ;Ì*ópkº0uÔEf9»àþù‚+œúÓ)ÛO‡#=þ²è›Ð²8?³8?çïï qß¼j÷•ªŽ? ÚˆnhKãË‘0_˜›v…VŠ”d(ØÃÃ㣣À±T*CNNîƒ>PQQ™Q.6çsß-ÿ+ËK³3" Ž¡Áþþ>› õ=ûÁˆÊÓÓÖ¥Ü#@è’H¨C5½¯¯WbÞ Ü,9Œy`;ÔV`9Ñô@ ø™Þ^b~¦¦fLL `dB yÁõ½@‹¥—aD¤³O ­—¿§¹³‹¶Ž5Õ+ÄÈÊK7ôb ¸qK Ók×®½9ÿ'-ÏŸ?ÇRYYYUUU]]]SSS[[ µµAx<Þ“'O¤@KFæ½éÙ ÐäÌXD³JYÊ)QKÔ£ÁüGCù+]ɹ©Aè"Yà ҦRœ™æñ¹Ì®³ù£¶Õo â‡-5Wê*ßõë!Ÿ¤"ÅÐB\H >´ŒZþ màvVà'l„]A·ÊЯ‡¾§Ð¢e©bë¤ibN¶´RÔЖÓÐ’?ãªîpÚÖ[ÇÞõ žˆÓ×× HJL<Z¼®8™QµõqV¶ÊÚúX}#‚­§–“¿¾í9=C3]-MyyùȈˆ™ Å?ÖY]S^IMÆÈ”¤­‡1µRtðÑuðÕµó9­¤Fµ³?K&“|þ!#-½íâA’&XÒim],@ ›Ý UŒÛß×ÑN‡v´ÛtˆGiZim- 0ïåôôt³8œ0ç½B—£C Ts^YÎF¦ÿbÀ©Åó²â¥Ÿ °Ê’ûgËŽ¯X¸fúËuƒŸw*üâ@ä€N tvnÞ¼™™™Y\\ ¤NÀ‡€?)///--ÍÏÏO>d‚5p¤×¯ÇYXš[ž±Va±˜’šxÐÄà óÈȈ· ¶—|ð["KFƒrýs"ÊF¢ËFRÆh‚ù-©3ƒSOZü¡[_vòAÊ\]ÉaÈô´t´5/̉æçfüý|¡Ùjmm,ß{5…F£µ··#“®ÌÎÎB«'ðXZœomªC ÌçfE'OžØÝÝmÏ=û5sØbiiù‹_üJèàÌÍN#ænßQ  óüÜìäÄøÈÈ°@ü• KXÏËÍÕÑÑñðð@ªÀaÓƒ¬®,ÏÍÎLLŒ‰Ÿ¿ò¸˜'&&‚yPPÐàÀÀa… JàKdDÌÁWŒŽ ‡††êééFEEŠOû½C‹‰‹î;5C’õYeMŒ–.ÖÊMÃÙÿ´í9]kS ¯¦®|ïîÝ¡ennnÜâg’ðâÅ‹/¿üòOúÓŸÿügh2`:G–©™ñºzþª}QF$§Ð¯'߇[å‡&Z¡[1:20ÈkïhÛóÕÛ9&žõËq5”û”ñ«´Æwš§e}}]Ã?ãs_Ö÷¬ovXnç¹ô6XŸ°Q'ðä<ŠßShIL»áuÑÜÙÏ 2ÆÎÅïtè%KŸPc@-c¼¯úHâžVO—€Ïåpºêi:;Ú¥O.æÐ! öÝ’ØzššÀ\ÊäràWŸ‚ïxc; ;ýæFÌ™U›Wm?\µþpÕê·k¿Z7ýå†ÁÏ7ô¶©ÿ³u½Ÿ2(¿>p–S¸^‰dllìææݽHàŒˆðŸÞÞÞ®®®ŽŽŽæææ×®ÅIñ¥W¯Æ˜››­Aº°d÷ô@ÓpùÒ¥·~仳ó¨Š=ížÎnq½Ãs¹Ãs¿ÇʼQ=:·,m²PÈÌ  óÚÚÚ@ë‰722ÒÐT?p–ð<Ïž>}× ×âãã‘8öšægDƒÞö·žw|dxtpàáÖ;Ç3S™;lôÉ°ÁÇÓ…éïj;]’1ëøÙ²ÓyFÇŽn5즸o²yÝx3ÖpõìïVm>ÚŒÔÝŠÖߊÒ4ûl}XðÖ‚@ËüÌ4ô‚/_º]ïahÝ%ã${o§Œ#m.lŠŠŽ ÁÁ‹ós­Mõ’ÇCl0ŸMi¨«¥ì7 …ˆ9˜I8ci9#šDÌ÷CËÊò¢”;Ⱥ´âY™DÓp.Ñ‚øyÖ"´°P6LMM¤!Àž¥E°˜[Ä?–—–îgdhjjIŸbê,˜‹OþÊ"ƒmPiÁ¼ ?ï0Û>ø ¨¨Ø:&Ècñò¯¨øB äÜž7·G^¿è{ÙÒÙß :ÖÞÕß è‚¹o˜‰K€¾ª¾œþäñSŸK™\ôÛ·…O>ù£”lhÍM"ºÚyºxÝ]?2WûRžj`©Vhå…Üþœv‘¼ñ¥ÃbðÛØX¯©­|Í;m®¬$b“ÿC–ni;t1ôÀùtàáFôqù*î±ÇœŽ»¦s»%–kêq§xUØ~þÜ8ôï¸}O¡äâ®çÐZuùjœ}]qXLìÙÛ©n§ G™”’à æôšH0ÏN÷¹{ÛãÊUÛ“ò¿;ÊŒ¸¬îÎŽÚh0/Ë JJrIˆw*Ë ¼cû»O~}”q‡†¦'Çx#Ãc£ÃÞÌô$p »§û­3⊿ŒctŒ GF‡¡‡Ä›š‡åôÔ˜#ßI–ÃT™•ÑŠùUç©í<ùÏ_éÄ?½¦~W“Ÿ°Q© ÊÊ*ŠŠÊ JŠŠ eXR©ŠŠ™L%“)°D®î0'<=5Õ××;½DÉ45 ¸¼Þ^Ð ¸Ó£ÔSÑâztÙ e²ø¯uæñûf¤?Úûh1+뾡Ñéenn"y¿9rlrrâûò׈¶f§·f¦¾áöÚÊ@°c·Æ' mµG· wfàÚ‰ý·NÌ¿2äþ¥óÔ¿tÊ òŸzNã.-!{×:hÍs3S³ÓS¢©‰Ékcô¶Öö¶Vä2ä'½­¥Öêf1à°YÑÔâÜl[óKhó™©É—æmÒÌùÜ>ÑôKs¯ïè$‰¼}šªíW¯*€%Þ:éÊž9ؾf.šžzë¬þošïmA^ª9tÆ¿WuSŠ6ÖßíUœ7GÚQ ~¸"?øÆ ‡¤Dgu-Y„¯¤CË·„ùʪŠ˜«QˆÌ?´Lù"yã‚ÅÅ:6§ªó°þNCCmII!t_›§§“áwB5™¤³21ñNI‚Üx\TÛªåuõc#î¹Ø²7ì‚›‹>úþB 4 ¯‰öj2|è­K¶ª²òMsäï\€ßxëlK)ÉÉoš#»úz9oïQJ^;yM/»·¢éoc.etWzK lp˜ VJqeWP› ß'EG™üJ<7ÈÃ-ˆ Ñž;ý(cÈhx äz!µð ýû­ßG´tÒZfE“¢éIñ]š›ž›MÂR85)Ñ„pr\ørãä8ÀÉÌôÔüŒH<ÿÿÚ ¯—-6Ÿš@̧3ÛŽAïcæ•ù¿Íÿw‹ÉxÓ‘"/íCüfÞìˆç¡¨I^³ÍG!커øÌ£x‡♖ÿ§=!ªÿVhA… ª×›’õnf'P‡„[&^±Çøô”d]"ÉO±ÄëâÙö&gDSSãÂ~v7´Cýœn°…ˆù´Ts ðˆÍ…#Cc£hþ£B… …T¨P½— PÁê „ÀÊKby]c¯PÀŽ™éb´?ÙÝóA¯Ý…pˆùø~óé ñ÷ÇÝÌŽÝÇÑüG…  -¨P¡z·ñ–­ÍÕ•å£kmueÿÓÀÍõw2‡£ÑÑ{T¨P¡Ð‚ *T¨P¡B¡*T¨P¡B…ê¿Z¯<ޣз²Q}¯µ÷áêwVHýÚû â}EøÞ¯þ*TïZÀYMMN0:;‘ù¾}…ØV–—w$s…±»ímM¨Pý¥ÔÇîꤷ¼UÜ^ö†dB]hjY,æàààøw2…B£S$šF¦Sëèhù–qrØìÒya2CCCï%©0ˆMLD¨ËE… Õ{‚p) caaafF<‘ä̾ :Z€#ggg÷ÂOð¥›kœnÖÆúÚ³§OŸ=C…ê/£†šŠÿ³¾üòO’ÿÿ$ÑþíPP¯Åß¹ ‚™ƒ‚è/Þ¬_P[¡_5·NGx­æJOê›×5??ßÅbA„½Æ7¾ö7“ ]¡.wE… Õû‚–­Í &“9===55…,‘°]z@þ²ü~+pVåååë«+ôÖÿBþ¢¡©®ê $¼xñR_|ñå_¼¶ÂúÚÊÆÆšxœpeeê;Þ¬_€4msc½¨¨ áÔܽ8÷"VëëêßWR!•—£*Tï ZÀS1 ð6Èßþ6aBÀY•••­­.£Ð‚†¿<´ÔWKØäeøbÿrßöçÏŸï>~¼±¾ÖÙÙ±´´4ñ*ì/ÛñgCH’ ž´@R 7-ß,©{´@„uuµ ïåÚ‘æææÀ Ð‚ ª÷-à^Æ$aTÄÅl„›—–60:Zu#$½N02Èïì}K@þöô³JKK×VPhAÃ_>47Ô<öLºž=} ËÝÇ;kíÐp#ÕÊóþ²=úþB/½:±°{ä­úµµµµu}mµ  :û“ŠüýÁÉ1öÅk¹ÃG‹D888ÖÖÖf¼áQ®}\ØŸtáòÐ×£…HfffÀ »*TïZèt:‚+í)¡æ6®¾âàWÏ(ÏÎ-¸à~³‚ÛGËsHe }- Jò×Z÷VÀË,..F¡ ß…ÐÒX+¡’§OŸá÷YG"„ ˆ°ºº0a•áá¡Ò›Afî‰ýG¸rá0;ÂËO ‰m/fˆ˜ \ -¨P¡z_в±¾F£ÑÀ½€“iK Km}Ù½îõòêä]pK*ëc·æžÖ7022ºÕ6ÜǬõµ33µrÍidò»BÜl McË{¢m s9à¯À­­,¡Ð‚†¿xhmª&&’Ý'ÅáÉãõÍÍMÉßMƒ*°ûø1xÅð4h¸Åmî÷’W0_òAœP8Z”[Çô·ÄðÇF+b¼LŒ M­]î×öðø|Z^¢µ¹‰©•[g/¿¥0ÙÖÌÐÒ%œÞÃëªËv´424=[Çt7¹XB]±-£ó÷l®3Á^v×ÞÜÀÌÁ¿Žµ­/ç’›‘¡¡±•KN‡ÇƒýâD,Äéill\[]ÉÍ͇¤òÚËuôœØ#ÓB¡P$ ‡;Ï…ßå ý¬z?s+—ìFŸÏ½èiehh–RÉã èÉ6æƦ–.Ì~q„p.ˆ°ªª 0"S¯-<ðBf€UegœÓVjoibh`t>.«—'ì w·104´÷»ÒÉæ t]öòä8;F@߆Ϭ3°ˆ€x€©À Ð‚ ª÷-нjkk÷þ°59ÄÄÒÞ¹ÎûŠ§›ÇÍ wK,át7gÛ%¶ryü~×e{«F—ßUîæ>Èks Îèåáu³úøCàZÁs®¢Ð‚†ï´<±<~üh[üUïæFfffÒ˸÷GcY^B  ·ú.ž5qvu… ‘^Þ6ÔÛêkmâb—ÝÜÇã²o9蕶²yìÖ`':§¿4Æ7êA—Ëì«õ»˜Äáòûš“ƒî7Þ‰öNnäò¸}\¾ 'ÁÿzÖ¡u”ݵ¹ÞÉï«?çs¹ð‚]ër>µ—דàlÕÂêãÒ¸ùE÷õõõK÷U@Ðú-«+Ë-P× ©´âëöw9\9xX@÷»Ëíg\¶?SÏä  ªº…À.>Ÿ'ègD:;Ð{úʯ\Îì‚êV!@ `Æ€$4ß ‹Îê0 <ê •QMýý½E7/ù&µ Ú=S9ýý¬†ì³a…\> ¥—×ånÿ •Ï¨Íp¸Í„H&&&PhA… Õ{„–µÕÕ––èX?lN >½ŒÍfs +ÅïhéîïË s/îa5>°Oî`÷öòXÕg Œ£c¯CHº—Ãïoq¹Ç_ÖÛ >ñ«àTóóóW—QhAÃ_>КÅÀòèÿgï<À¢ÈÒ½ï·{wwvv’Žsæˆ`Q²äœ%ˆÉI‚H•œCÓänèÜäœs†N¤&)HžïT7 ¢ã:³îèºUÏÿá9]œPuÂ{~'TÕð0“Éþ$}wW§­­­½½}C}ýÂkІ˜àÿ£#´†74­QUl§kL*)-. RUZZŒöÕ–µÂW”•hŠh'cí5“‹*ã:…çƒVPOôW¹eèÁ:S ñÉ®÷­Lm]ФÂRº»ƒµ©­s¾€ðTÅ\Czv×9ÕvŠ µM‰Å^·T²rKjÊÑwïX—, e±ÿ²À£´ÖŒŒ Ú8CHòQòÉ-^ôV[‰7°,+HW—tvu‡šê³ð²ÜDS3ˇnu”Ô…e×{áù ŠŠŠššDˆD"›››Á½ü±ÓU³tõñp{ -}3-¯Œ˜ô\Ñ• .©á§aô¸ª‚ oõ¼¤˜‹QRµ+¬,°×7**+Í°±õKLjWÜâijjŠ‰‰¡,XŸZYYY`Lx#Ë×Ü ¥°°°´„ô@_?¯¤8Òæ¶K8>?;JÁ:O$lTå#Óð¹¹99¹…åÅY·l# €Y/*@'#HyÅ `T£¢¢0´ÀÇp0Yc££€L U¡þþ> –ææ‚|ÈÍ: 4ÄdŽCЂłŽ›µ4Sh«{WP@†ŽÜœÌ ‡/ãûÅÅy¢!H< —f«­‰/*‹wÐ’ÚNmiúmC'41'/—\PT’K&•”gº«yG£òrH ¡d=ÒqyŽÄÇ?Qq#U—£ í2ñ$:궩ay€tNQe) @KA>)WX˜›‘œRPT„ËLÁ fÆHOO§Óiaaa ­AS0ä4Y1µØt,‘HÄa0e8}Sï‚B¢­ª\D*ÔTɹ…uÁ)……d]5l^qâC‡°<À* BÐüÁ…‘IIÆäG9?ÍÍËËË͉¶×p AÏdm‘1ÚÓÊÐUY†Õ5öÆIÙˆgjV%å9öºúø¼¢ÚJ‚…©¹Ã;€ó@< `üC ,X°>!´ Ñh0&¶ ícfî“QÈ:JŠ‰Îzú¹EE•˜ Í;ÎÅ%yôEÅd! ë+ˆ†jÒ¢bRöÓʊзl"ò‹ŠŠ Iöª¡éùl£É SahÏ-Ø,Ö«^ûúzúý½t–}‹èõ,ý½ÌÁÑá¡ÁÁ~,:nåù¶Ê¢ìCîž‹•AzeSEy±í;ÈÜ|55%YQI%D~AAAœ“¡ShNë "ž©H‰ŠÝPŠÇDzƒÐ2šæÙùåˆÇ[Ý$#·÷DÅ•B榅ªJ‹J«eçW‘=µ•Q¤‚Š’Œ»úVåäÓ ÒŒ‘º±¤4ÀBûa8¡´´´Ö´´4: Úhq¥¥%­UcMyQQ15»Ü’2KmÇÐœúJ²‘:ÔTíÒjªŠíõ•ÁÈjÜ%æ'¸˜Üͬ¸Dš<ˆ0 ¨¯¯÷žj-ˆ °MACQÄM ?lâ3a%]) Q»Ç%•U¥Ø›ÊjÊ2b2šf¤¼ õ©¥š¡°¨(ÚËRË:ª¨¿ÔÕÕñ -°`Áú„Ð’™™YYY ŒakMXÝü|È›Àj“ÀÁžcIàf/‹þ ì ÀÁž60""†øø".tš€Xúô^:­—NeШ,å öÑi ÃÃL-L6èjÙ+2¬…’…c©žC»LJ ü5Ä’pÅK-‚í?Ÿu€3ì½(ü—”€€à¿àürw1«O_j_ì&ÆnD •¥fÅöÌöÉ‚è­5%%0FHHHuu58Ít²]žûz–šêÒ°Û8;* œw———"D kkkÙMœgß/ðBáJYmº¤Œ¾e`Ébr 8tGe¥Øì W+‹¸¼ ü‹=~¡,XŸ Zzôôôt`µØ XË%hÉÿˆcÉ3û`Ü€Q = -ðñÙͳô1XÐ ƒFaý¥®f‰þ ¥¿šoÁdg³;n6 ¼·Eäfz¡I…ùÿæã½í ´V$I£R‚ƒƒ]°[îÒ¥²D¸²E|Úã×Ú`Œ´´4Çž9y·å¾÷Rß!{ÿ<‹¢23ÙIüÖ{ÿµKSSR`h Ö§‚`ÏÁ`‰=ÙRõÎQýÁ£ê}°T`ØP_¢ƒY". •–ŒJ‡ëóƒÎÈ!âÿ™p¥Å#ÃÐÛæ© ‘z[öóÅ¿©E|Úã½í Úp’šZZRZnSc#™ZÜ{}~d„Ðcƒ¬DØÕÕ™”„`O–þ¦{oÌ ž¤¤¤®ÎNZ`Á‚õ© eŒõÍƆú<èIÜ]ZZš\zýÅË—c°`}6}d d½§ô°4*¥¸¨è“4‡O®üü¼ÆÆæà {ÄÑÖÖZPPð/ÆYS]58ÐϾ÷žî®¢ÂÂOr©E…]0±À‚ëÓB ,X°`Á‚ Ö—- /ׂ ,X°`ÁúLZâ“Ñ‘áá!æðÐ ø»ôø%h¡Q{ÆÆFÿU•—@©ÿQÉÁêeСB‡³â£ÕÓÕ gÂÇ«¶ªüs5êʲ"ØžÀ‚õu¨ —Ć“aæ`EYQwgÇ@¥»«µ©½Ä¼l¦e`vvæQ]uÅ–,¶@qÏÍÍÂùðñêïcÀ™ðñj¬¯ù\I×T–Áù ÖסÂ<2kŸÞ`q~.spàõÄ[ÌÁÁŽ¶–åÐÂ蟞šúc åK [€Zggfà|øxõ÷2àLøx5ÖÕ|®¤´Àù Ö×!6´ôõÒ»ÚÛÙ¸21>ÎvЩ”åÐ28Ð?ùGµÕSSS“ðñSgffà|øø£¯—gÂÇZ>WÒZ`{ðñulhé¥Ó†™L*#ÃÙ™™/ÇÆ Éֳˠ¥Í£ÚªŠ×,~Z©—=¡Á‰ÃããØ•ü÷”ïôôœ¯>í÷íhkg¹«²bâÉöÜÕÖÊö\OLŠÀµÿÇVþƺêß„ÙÛÕJÿ¡ "<ža»—ŸÐò~{²¨WÃíOÝœ½#˜°mëËÖ´ŒB›p™( ‰Db0hOîàÀrhèë}õò%K  í´ÒNàª2u ]8ÿÉT[U>þêp 1(ž­ïjÊ«è:::eW7pù#Ÿ:9X@ý}½`,ºàî(µ¸kdckgïȃ3çý­fÑÝ窣jçèxßÞþ¡op=…ùPã#-¶f†YîŽrrn-マÛŒ¬Øž»k UôÿÜìÐÂvPËÑ"rNÎŽ6Ö¶a¥c¿„ááœÑõò7&D|zßÕ±ü €¶=yõr„d§”Ûþvá\'Ù¨¬ÒŽ.êK¸bÂõek9´€±Èäë×l÷ héïc,>gD5Ñ601¶jêz5XqÏ1hxtd°«ÄÞP[]K78«zä_~Î@Ë«—cl7ptcž˜º%Ç«‘;+oæÈ ÞÛXUUMí¦þ“Ç®Zjº¶;FƆqž·5T m}éÌaøqõߤ>”;Û]—õÀ&³éå˱qé£#C”jOK=5M-oDÉàÈH~œ¯mJÇèèÈ3{£¤Æ^´T&¾ˆ¡AZZ€µ¦ºªM`ò“‘ñô¾¶†ª¹kHßð×™c :uÑM`d× êç˱ºï»ÁP¦uWº[èihÞ Ìªfv=w4R׸ù ¥éåPÓ=9I »Œ†ü“ZFZÌn©«ªªèZxR™Ãô’8Ý› nß!5Ò^µZÊÝžm’ÊJã|m¢GG‡süok¨è˜>¨§öЃ­n«¨ªªjk)_rvh…ÞË×]œ~Ã=òrì%½PKÓ`Ùãd¨­ª¦éG 2)U®f:êš·ü¥Ì‘R¸»¤¼*¸ýJ ³–¯§©¢¡cJ¨é‚ªkkÁMUMýÔF&³»ÌÁè–º–ÎsT%0>„§ö>™íË“ÐÌ ËÍ$Ú* rZ;K3Õ•A¶)Y?ŠîÒVRU×uzÎêE=s¸©®bâô¤k¶!°`}qZ-˵Z@§62<ÄÅÄÄ¿µ"SIÇÁ(»çøbh°ë¼±Ž2Ø×î­£ÑHë_ôù;Å~:rég'€W$pŒ2Ûì,½†ûbt%²+º)e)JšiHo«GÙýmh£ÀìþÁÒ ?{"í_¼†ÿ6.xb|œí Ô(+š»<¯íêê 4ÒˆÍmcö÷i‰áªºób}m“Û‡‡‡žÙ!¨/nËW´Ò™Lf5.T# ¨``hˆÙRkU>08æâUØûUæJYtÓ´P‡‡¡îjoÛô1þwÔÒA_KoГ«-2v a2™€ßmLû‡˜À{^ðDó½JÇ! ÔÛ¢d×|úèð spR×pÃ1›íïZ²<ÇúXG7ŒÐÉzô®êle+ä³ËÍÈŒÎì­6ó‰þ’³«¡®z„•E…i7LÒ½rœ—šÞæ`Ó]»ðÞAPmúô•“ Û™ýÝÏ´$së)ÄpwÇÔVPFz+L)ƒLzµ¡‰/½¿ÓYY¦°™ÊyCuUÇU÷ãóHGµ¦§ÿÄÞ;£myÒZ€9a¹¶ò‰ä–zlÔMÿòÁÁþ`ãØ:z¤–0¹àPkI‚†¾op 2#XÓÄ‚-,X_––C ƒFË%âðÙ¨ü\Ø·¡…NƒLd%:ýƒ}åHw÷èc‡ý”jUùÚðßÞl7mb;íów @Ë0°ð‹?;Ð÷"€c¸¿ÉÖÒ«o€­+­èlÁ©¨ÛÑúús^8º$ÔS‹|´í¼¢"#€Ò*ÿâ5ü·‰Fé£Ñ¥ŸÃƒôÚb‚‹åÝŒ†nsM R+8ÙWóX%.§67ÆÇ:¡ep ?ÐÎ0±¶û…ŽBeTâ¹ñNžÅ Á+3Üv d—Ev]ßךc‹-¢ÛÙжgª±C=¹zz÷{{»LÔ<ž…A9ÕI£“Bï[›fÖ0ûjmLûXs^8?Hl¤–ë8¥ôô×ç„›dv";Ú»?~ñØ]Î5Øß`ohÉö\ímY?XýÔ6’~öuT+ª:wõu¸[0úGù÷}ÉÙÕP[ ¬ p´ç§ˆ)Û<MLÍ®ïêî¯7¼ Ý#£ÝHY5¿ªie~jIEM„PW§Ô6PÓ˜MH#‡'P<ƒôû†õ]•êRêMTVÌÔ:uQùªnÈøà=´°Ml€wZËò¤´ -Ø“^¼|<¡±.;BûqÕÀ@Ò#»Ç…ÝZj(ÀC5ÚÍ…Ð ”Ò4ymz?l`Áú²´-µ•õµÕ`Póêåt——5Ö×¾õr9JO/h ·ÍØø¥··ŸÞéj ¨`û¼—ÑþDG*SÚX•cëvc½¶€P\ÛÁötæôi)IÉ¥ŸÿTZûû—~¶fúßsIŽÁÞz[ OzoO”ŽDVig_FEݶ‡Î ?wxWÛÛF¸iþ¸¢¾©¥©‘.ƒDéî£Q¶›ÚZQ]×ÐÒXáaìU@‰µ¿íŸ˜Ó\Wâ¢zƒTÝY“ù\Ó6¦©¹ÙÛ\/¾ºó¹Ž|y3*5b¤¢}|mcsKk[Kq’’uDucsscã+Í1jw×b‹èpºc^ÓÚÚXSábäüÕÏ „YÜ H$·¶6××µ÷Q[›šZÚ*p²]ôf§»¦•Í­=¤çŽÎñu}=¥:NHK5äpãŒvG#½´ò–ær¬²]foo‹«Aä¹;?ÊÓ*¢†I+Ò·ð)¯k(DßvCnÆæÔ^“škòàÅ—œ] µUÐç³{-9È÷2zûZè`oõ]ûH:p3z"-5“óšk Õdóë» b¼Œý°­µôž*[c‹‚ê†ú¢#›§4z»÷-9¾´¥©¡£«ã™žLTVqSu®ƒöÍÚNá‰cdñò¤´ ö÷±Ü4¬|®¾:+L+ ¢·—ðµó/è×&TB¥Ù^žªjQÛЀu3 ,ì…-,X_˜ØÐ(%ŸLœ|=1þêÕØèèÇõ2òÉ„åÐBéî¢S)@ Z³•U`7• ܃X³‡¡4*e¨¿ÍÅDSICQÔÎ#¼­ü“*Ùþ‡jªÊ{ô¥Ÿ-Y6^Hàè£Õ;;øSh]qÆJÙemŒ¬Ž®s'…’âꉨ¥S{JSo*Ë©h›ÕQh¿;õÿNuu´ 1™ ž««¦ '§hçzf_ç{}ÍPR+Fí§·ÇºÉËÉièZ[;Co–5Au£—ÖM sRQ3p £Ózòc<Ô”äÔï86Óè_eŽõtu,´j»·‘²œœœ’ÖÝ8|%h;à$³¯ÃßV䡉7ŠZ›ª«¦¨ ¬‘×2°0Õ_NNÁ2¸€êî™TÇè*3qO§R)µ9ÑÖèö–œx]U9y‹ç¹4µ"ë9ˆÙô)!?Îß!¦´µjt¨¶ŠœŽ•o•ÑKkôµºßM¥ô÷äÙx†ÉÙU_SÅ AF£9/EÅE]<ßG«¶xGa¹™ý~6º *Ú9PMëë,sº£"'¯WÛÕZ–¥¯&§¢g[Ú ù 68ÜU“ST!¶õw¸ÝÓRT×M,€Œ­erÏñ-{RYÖKgW‚ÓÍDBmMvôÝç• 3Sž>ùú5´<Ä‚0ÖèxZ:Ú[º:ÛÿAF¦§ëKP[K@U8>^d‹ø T å3% Ù“îN¸`Áú ôöLËëññWÐ{ä ‰–îÐBÄ¢ ,X°`Á‚ ÖgQû´°fZúß-åÌÚÚ_`Á‚ ,X°>‹ ó+— eŠ-££#‹ÐòÖWžsÈÌœœ_`ýwhž^ez×ÛÉ³ê ¿Î'®zwB’ ÐO"ºÓÆØÇÐ ƒ'¯ôI&LxØ<Ñ3ˆI'þδ0é6Oéä_ù/ C¿ÏGÏ0C‚® ÷Ž·opç¿éÆI˜>S½»)Ù¬ä0IE†Þ^ÏZ{Ts®.XÖ5Âr#Æ/6 ;³ò ׇE+=ý€o‹‘g7õöùùÌ°Äã{öoÙzø¦{+‰<äì¾eÝ.γæ Y3ŠÐ#~æÔzŽÝÇ„|2°³QžÏ9·íX¿á žK%)g>%4‘kóž‡UƒÓ¦VÌŽH8ÉÅùãzAaôÞ&†›7îÙ¾_âqü«ûè;zÑ™9Fdy~v[õŠ~^VÖÄ»hŠÍÙÌœŠzõ»ûš´pÔn¢_ ncwX‹Ê‡<Æoö ãðÓ$lŸÖ…“›ÖïQ0Å“I¯”å·nÚ¾ý Ô㤠òa,ú¡åžu«Îߌ}¯‡h'·½rY™ ÉMX[ã܃ÅOã2;®=²è’B 4í©¡´mÓöm{…=ã_ýJr3ÎÝN!ΧG¦ìߺg·â‹Ô)2yÖNEaóúÝ礃pÄùÖ»¶îÜ°å¤å“nò§¨]ÉÈ [ÿü—Uèd’!air—/lààä• Š1øþ˜–<í%¾e½DÂsÿ~·yã†-¼rAhâü[–4ãkd¸cóvÎszxÒüG&énö§õúiøym%ƒ˜©w Q¸û3$æ;@ž0áúûãøW ?‰=g%?u£ËŠ –´{cQ¡ÉN~]ïõ‰ÏìT7*b“9 Kßõó•Düûã¼+#ç›õæîâ½ü£ÓÆaûëë–‰…Gž¡'žßÙˆûï„–y{bÝ–Ó'Áõ¤N¯æ8Κ‹ c*g­ß«xö²A2a„óqþëk·^ôIžÐrê‚üé=Û¹¯zdæÉ8ŠïÉÕ?ïu ¦@°“Ï)Á·—k×Ù»„7Ži:½f=§NÐ0øáõxóêøÝD­€–,/…Õ«9¤ Æây¸ö¬Ýtöqü.&ükõ‰P,à½ÌrÎUkÿô¿ùiÇõ[ùDÜ$ï©Õ«wˆê¤‚<‘æ9ó-h«8V<Û¨_½v·_ dÆÉÄQ3±‹kWïP·-mÓñâ!þËâë7ŸvGÂ7X0´|¬2üu¤ß–x_Û+vyzºÁVÚ²wbßjPÄäÔ£¼:îºfa¾fÀ¶»ßÕõmVÑA* ^·éÜókí̼Ìm‚¶mʈ}Σàg£û0Ìã–ìƒ*=Qe×qß~^ï˜.Ž“ž¦n<Žð܃ëÃbG%óÈ)u/]“ oËËÊ¡P¡dW®çPL^\‚q¸Ê'|³¨¥]ßĈx `à…½ÙÞ‹r&xªzÏjn7C«NÞÜ'ôYÓ2í‡9xc ‹BÞÊÁži™v30ä¹¢tü˜ô£Øa–ÏÖ3 aK³îÊr Þ‹Ãá^Á [ƒ0³ ó$‘¨º¥d`®ñýR\\¾ô¤à¸“gÍÉä™è˜NªßBŠçiò«ld{,r #±bÛëL"´ ¶áLµ² %ãÛÆñ)tM!!ô¹9öÔؔ߉±0AQÛ»=.ª®>÷t„}ÛÕtj"BÖ‰ “Q>Fw/Ük Š Ò.mض8LN|ùgŽ{èE0À†Ø]]‚Bû!¾¥î›ø¯óz ÷tý¼-U5žõÂr¿gt‘ç’¦SͧZ!bi[»à âè;öÍßý“&Ùƒ—D3e“Ó§n ;à¹å´W/'áûÏíÚg9`ÀË™>mcxI“˜ôp'¿¢ŠÏIÉdüÜÇB‹‡õûQ·bîh‰~©Ë{Æȧ9-¡hëO‚H,ˆdÖY–'4‚–K«3ù鈢ý;Å„ ã=ÿ{çae˜³—`"‘ÐõëFHRŸ«&¿I`ÏC eãüÌä:ÎIø_2£]+‘ú•9ôvvÍGÜÕÁeeöEg^j»tR<6mÐçæEë‚wgZöÚ·òXî©ë§E†QP©Ý)hèÚ0 ¹ãz‚}g¦…D|ÛÊì»#~9 º3-³ʇ½£¡™:Ÿ'[dÒÓÒ:Ex…Ã1SÖÇVë¸Ô§<‹X& O† ,ZþEh)4»o£-«³ZRŽòê=ºçågΆ±Gí:÷²•¯AвûÿÖ:Ú>³w ߶ázF €ç{O"<ÙÐ"¬ê^¤|¯ø<-Å\§™;û¸yá1ëûЂðÒÝ}T˜Ÿ_Ÿ_Å4jÂZB@Ææ³nß½DÆ‘Sþ÷ÃY³¡åCãkâ˜ÝMY‡Ë*b2iáñ‡yÍÒ2ª´x[¸zºúsŸÐ{O·-d\—ÈÉËO¢:œT®Káÿ ´¬XÜY„bFÇÿ­=ÜŽÂ /2ž&rIìüEù{w»&Ž†:{:-~å²Ô?ÖÈ +–‡2·+å‚´ÞÑU šøhh¹-ü¨KïZcZâüƒ¯;`?¢kx ZÞÖ¯AK|@ð6¡ ¨¨²k<"!YP·•žÜåfdº[8~Egd$#i›®gšïŒ6 Z8=,=Ý>ÙÇ­‰Ђ°½êk¥ª åt:å¹[à® hÒ¿Z´mIêWäcÓª± åûM‰k"z†©g.šó¸×kZ±‚rÿi^ ÜòíU¿-xT‹Ÿè…Kò‡9÷dZ¬ä‚^‡¡Œ”5bÂúØzç°\\æÏœŽXxƒ,Z>fc!i&Õ÷–¤M>‘4÷öòPú6‘x þ¥ÎUÞ Öò:¥+"®êøðíçI¢ðS!·Ï©X…¹xlS,ÄáG…ΊDcÇT·ýÍ%¸?ÙÿéÆcxlÝÑó–Yø ¹½6Ï{9(ŽkËÞ]‡U‚X=ïòå!\tèŽ ›þü§¿oÜt95á¢w Ä°}ïuŸÈÁß·<”CžK K>Îu`ËŽ£2ú(aðÚ鳉 œÐí潟óÄ)^ÕÕ›!hy{yh#úÝœ¼’~ï>¸ñkÐB„ö‡Ÿ•Mþ–Lº´ê?ü¼uóæ=y½°\Š~x{óºUÿ~ý™ëŽ¿ay(­ñò¡Ã[6ƒ‹ôÁàÇ´¯]ߺy×ÖÝWî‡2!FZ¶<„E–ñ9yè¸ÄF.Uh#nXÒþm{wRxž2I&ÏÚ(Ƀbå•z†#ÎÛißÞ±y×ÆÍGîx4’>ÅÚAʳäM›vüù/«7ÒG‘çI˜né ç7nÚw^:8æƒÐB&Œ^ß¼^Ô “µ2i,)¾uãîã‚÷1¤¹ß-d\ǹÕßÄLbyüÇŽoÙvGì×}ûÐú¿Ý¼[ц€K«8°wûAÉ=‡•Þ…–cǯžÜ·oïé;)Ù3ØäRþÇ·lÚ{ëAÈŸ@K¼“ãÞÝvìâ³Å1ëmf¶e×®£ÚQét‘pLþ#‡¶ÖÏ Žð߶nõ÷«w9­—M˜ó >Ây`ÛŽs¾1fö;¶îúß¿nÚ¹KðYæ,™4å"mëÖÒ†%tç…#§¸ß¸rñZ"Üý6oÜ»ób$O“8thãOßlØr@ÒIȢʜ>¶e§ˆv<‘C ,Z`Á‚ë?XÄì hFVJùù«–Xx›,X0´À‚ Ö—*Bz½ðyÁã§d=CépnÀ‚õŸ-L&s~þX°`Á‚ ¬Ï¢Újx¦,X°`Á‚/}ä¶Ï×ÏÝctu=­]KVn#ÏÆ õu}½ƒzÞ 5á笫ëeã^†%Íç§Â<"ôtýžÅô“ cÖzžºº@&Yò/È0Ò]]ïû¾MУä™(ÿ$ð/Ç'm {üˆLkÃÀxÌ\–²=ÊTíÜ%5CÛœ•Ïya(÷Íüõ ÃÒ ‡,PˆC]Oˇ%¸ïß#½òvÖÕóuòkÅ‘_yﮧ®~`rÚu™E³¸ë}Ï“õÎ;ö ÍöæO M8Ö3/)Ñùwt=Œ­3Òq¬Â" ñ‰‰H:°ŸjAz?:rRVV5æÝ‹Á¦5;,"*å™Løyòá7â¦=‹=xDRB6ÍzHÇO[âÊ5mG¿zà÷ŒÕòitÈÕø§†úž&6éèò5ùÌØÓ;^.O¿¾Ú•…¨c·M]“Öv‘¹§nQºº>Ž>µ™¡‰FÎy¤œy¤ÿsSï¦äÛ§k`ûÊœ'ÏgDç›xÛe?úår ùzP„¾îO›þ©gT&8yäSÜò¬™ŒPìo¬xn÷‘io‚ÌX«ë¦|Ò-²$.0–Û:X0´üỴ䟼(Ú»MóAûÛ}Mݺ­b¾3N￈ZÑf‰Ãî÷_ïüÙÄ—’„øv‹òó'q‡Njg‘¦ã£ê#"êÝ ŒöJˆ¤îKNs/oYó$a,åñ“mû•žWy?‡,!™4õè¦ÄšŸy¤ÎÂõM,)‘¥J{ÖÜ}X‡½CVZOXhu\Òp;ˆð\ÕN‹ð úf§ŠøJ™÷”y@µ ÷6#_ ëiÖyaféqqfávlÍ­[OPÇ~ø›OÔPbùoa »ßÖ“vò¤½ð> Ç‚;"W®›Ö.<ºIVT†¾ û¸ÄÞë{¹ÅP,„Jç0á/2]s mÄæ3ãë…¯Ý#…ERØ— Óì‡=±™ ¿wÉD‡„µž!_ÇFÖ†E¶fæ ²Ä5…†ÔÄ#™ÐÅg3£"jBÃPXöKæI„)+’´ðÌ]ÊYááÕñÉC+zO4¢ÕFEí´>$¬‹@žI ÏÛ±Ñ- ,)m,=4õož=I8tB=‹øRGÜä¡_¡¤—bÞ›‹\ö,00Kf?iâûØêŽüå›_á[š ˜‘Ð "Çž»Á1"y.ÙMç0¿Ý‹àbË»¡1¦ß­•ˆÌ꿱eãæÐqH¦D…¸ÖíwKŽŽêeA&¾Šë!b{îæ3÷È{Cøhh‰òq8cD L=²ýt<´ý×ñQuaÍ"ô‘D… JÕ‘ŠG¥vºJ)Ûf†Dt‘™4êLDKTg~Á¦vÅ%ÒÃCªc’ÇÞþ´Á|VjWhhUdLž4 4-±94¢QÿƵü\|L;:9Þ€%Îã³™aUÑ=¬ÏÌ£âëRa!5I¯¢B«Ïpw|V™0L&ÿ’WÞBXx~×R…Èx 51«èðšðÈv aꈉ¨MèŒ o€l'C>CÃê3°3àî’⚣ëÂ";ÿggtÚÈJÄ„D´ámÆ°`hùšª|Iæ^Ùò“ˆ@ïÓf•À’Ø«‰Ø$¿g&„„Uçæ0ó£ú˜^ò>•¯\uOcûœÓ“÷LŸ%§%zþ•à$¥áÙ`*«rUñöÚuœ&~-Ð{H¢²/‰œºCËb/<—•Ö­µw­õãöLô8ÝÁu@ÖÅsƒïR~ÞO]è†IazxꞘÌÜ£'Ô@Æf=6ÔŒe=sQ³{Ïí”ÅiiAõŒe‘O»ðýäÄX0ïq™\ç1˜æC?s"³g1Ïž6c=ÞÛɳG8þÝ7â’FÏ]ˆÌžv•áUµ¯#^§ I÷!E×]ªå/‰^þëùâ ¬g…9OE,>òŒxž°zýû߈û•=›³ør90ôàÿ鯞Ñcì*‘h& vYBìV(§LøAÙ7<+Ãùú-‡r\öð3å[Å)i L§äÊè'8r_½|°¶Ìš}rÏ¢Z+ÖOÉGùÒ oCIÇ ¾Óêéé©í‡öŠ…¥¶JòÊ$c¦ÅOÃÐòþ÷´ ¬7¼.  t’ûˆä³ñ(gž‹ZŠ’*´0˜¤ä#g4L/óõ°½¨Ä÷1s—Öøq~/º—¢ÎyÞ-ZÙ™òyª(*ʯž€Ë,ßõóQKQ¾;¦î‡Žßf¿xÄÓ9+‹ô.´L˜ÊJ‰«8^)2yÖÙøþU¥{w»'Žâ’+5¤µù/K·NZH"O‡8GĤŒ²¡eƒ(†ã-u­ˆ•o3ûµ÷´xß”ô«;vÉUMLÔ,ŽU-1RWd§LAžIãþÎ)KôÉNk·q.[z Ì´qŒýÇ“”é%h¹i}fÓq×Ø ö{ZVí¼ÎYœë”~\öÌã;bŽQƒv²²š¾é6ëNÛÇ!©wÅ/¸¤|ì–¢¼ïï¼b"}…÷Œt™8.°ã Gâ$!£ö§?ŸIÂô-‡¨ººÝ2~ÖYvÛö?}ÃsIQà²ðæmÙ„y-‚ºEïyÅ?‰ºª|éäA^éh`¾¤]›rÈSºüçc óiž&â·Òã‚NÞkÄ'%m]·4+‹çOAmgÚñÔáoÞç,pT$ôÍ×Öfîˆ ³¡%óEø¶Âw-‘è×ÄŒ’íß®¹xTæ«œ'µÅœC:Ä…Œcû,i"‡öâUà—Yó·Í©}7N ãræÓ*ÊCk¾˜@½[Ka[ †–ß'¢ôâa ¤±ç‘AGô I9sV ‚XU"~ƒ›^6%;ŸêxCÚ(ÛßÊìÌ}:9gNþ¢à£LÈç“ÛR¢Ð+%É™èã¢> ’( Aßfs™RÞ`ðûË•ƒ¼!$ u?®>!ù W‰÷@‹Ý ‡Jòâú…ÈãqS¤ì®Mߊ@Ÿ<¦H–ÐCKø’åaƒy½DDÜ?³X”È+—õßþâÞÜقᙧ×íLDÏ _<âæu`ŸÇb&ÞD²-Ät‘ÃʬÞÜ™WúŸ½7g‡yµ4_-œ?KZ|é)%îŒT@&nÚûæy×ÄÑÛ‚7Ý› ˜¾í;”X¯ñŸÇc^²_CºZn}4´Ú[Ÿ°…ª¥ ¿ Oæ™ÀT½&cöæë½à"Ç—®ŸDšÎÆL.UÂÿŽ™–1™ß<\‚mûªø°rÌâËåJg ýÖŽ¦ôhÔ! ŒÀ­ü/蘰ÃZÙ ¯™(k…¿úM3-9„>‰³ ˜ñ«o å43 |ñ&>giuI{ZŒ eç_vÇf½ÔkËIX¶¼?9»îÔ¶Ó1éé>æç¤"â¼Í<[\¿íiÁ· Ú+_̘$$%½d¹ÌàL;ùùqÜØ2hÁ¼Z k™Tgk`ºGÀ›Q²ÓÔ⧗Å]B»nˆšÅ?Cr™SDó¹!qŽÄ”>',ÓCEΈĂ}mZ`ÁÐò»D`\çÚeä’íé™×ÿÖô ªcÛ^kû§‡÷‹²¿¾±ôF\bZžŠª×ñg7®7òjÏŠÊúi ÿ{n^3ðF\|÷Ž3®P#2Ç=lÛ$ÙÝ5ÚtÄMšõQá‘0@Èó“sfÏŸ¼y#.)«ÛËÞcÍOGÜó²0ÝWv´ô̽y[ÚðO åW߈;å.yXH;ò‘{ÔM­R&ê¬ìóÄ(âáUk´‰‰«»6„º:þýGÉw߈û÷oöÛ¹%ñ¾†|gí¯AKV,áûŸ.:Ù{róâIã†§× «?™ðèY ñƒoÄÍFVº+¹jþ$èkÛ‹‹Ë¤¹¹F¯Ù®æê_…'Ïg9sžÖvqEj)yEð¸$ ƒsíÖãŠÁ9¬W sm»hý0éÒ¾c1¸Ùß-uÌŒO˜4?»)ÈZÒãÆÈSŠ—„ýbZe¹~ÒbAKê‹G Ó1ˆ_-fZÜ,dË Ù¤âWB rVæi ¢^‚CËoi"*´:”%DêÈÊ]ŽÉa¡µIé/§Ð)Ñ ƒdhkÜDBtÐ Äȳˆ–ÐÐÚ4Ö‡PsÈ31±Ô¥=f˜ zXhMr´P2y&9¾)4´&ýz)¡¤øö,Â<\–¶µ¤ÇÖ£žÐ6ↇVGDw€.†„‹¬ «OÇ@{eñÙÌp¨ú¿˜3Ù½´ÀJêH`?A‹X,âôìÉì zxp×7{3aTxMd,e! y26² ¿ði•þ°…€Xâ<&”#¸’.,}m“ñÉÌ¥N Üœµ¸¼HžFD6`Ió‹s>£±Àþ/lžˆ¬·€L{I&Ï'Å6†G¶ ‘mhü,ÃŒ ¯ŠéŠŒbÝ´'¹:ƒu‘ †(-2¼&aÅF\vK§'¢'A¨˜F£Ê(èóš±ÉØtZ\ÊyYµDFÕ#YPAÁ¡SºXûÃɽ§—Õ›ˆšd]3<¦Dšˆ[Úˆ 3jErrËâ5LÆDÔ†Fv/lÄÕ¾‘: Œ6µ;)ã½<¥+,¼‘Ôž€bmÄm hŽ‹_¨Ï¨”ž¨8™åm'´‚ðFVƒ6âfãg—¡´¬È„2éutØBÛA¢&ˆ˜!h¯xh]ÆbÛ‰¶Ž×'g¼Â£:ÑØ©¤$:3“1E†6âB†.1H"Ï :¡mÆY=Ééì œî(¢Þˆ †X°`Á‚ ¬Ï-åÌšš_`Á‚ ,X°>‹ ó?ZÚ[™ ú/°`Á‚ ,XŸEå¥0´À‚ Ö[ÂFòò 8¤t.ž™¯‰uq nüíQM[Ý{ÔL³¬¯Z(Ão*‹ßP8Çs#>gdù¿Úkjø/ˆÊHÉK¨=¤¬ 5h¯®(.!{ö¬dFÉKp†ÖóJ_ðÀ•[ Úd¸‘†¸„ü• "N¥ž¬*­"-¥tvÓw~èž¼Ø@Þ ’ò:ž$ZÏ€…´„°¸ü9^‰`ü\ õôƒ<—ç9w#?Lë¹-tUXXRPö>…6öµºtUNJDÒ,²ƒövÀæÂü3Ç®*È)^—»ßJ‰¾ºúôei)uÿüÉIdù_».%ÌYÝ)›Úôb/¯øs,³³µ$¶›ÚTÉT¨“òž¯M¸}›-é~º7S‡A9šÉbÚæ?o^Q*²ì… …RžÄ+hê^ÕS‰[.øE¯dÏ •õ¼'`¨,Zâíô$\󱸚Úæ FwŸÒÞíùõ“U±¶|ò/Vy ÎcÃè®oáتXÕõž§u3U®ˆT,&WñÃñG´/¨jQ;è{xv±útä2h¡Ö$\Ó~B[¼TG ¹'%“túüÍ‹ Ö3[iËZh3É7¹$TwÀõ}'.ˆ9ÊçšÑOë¡‹ç¾Æ{öÐYUríëÐÒ” ¹gãOêN Ö© >ð,÷A.î+ée#µé1çŽpïÞuÄ6¬šÒPva﾿ü¿pî;làYIëè¿Â{ò‡Jõ ’ÓæÛŠ°‚Çqî=ã›ÕO§ (œ9ª(À·K0»êõJhù+®a¦ ¸ñ˜]'uÒ\þêî]ûyŬjÛf™ªoãXµ™ëÐþ«îmÔ™{5Î=û•O)y›,X0´üaÐÒQ’³zÕÏgŒ*Úf—Ÿ¯Á†í–jilÙ¶Ú¹`åਕ”´jÕêçík:æZó0û„‚±¡eæúÉík8ù Óì¡JqüómJX mþé9!‡ÂîjÒ¶ï¶#j’3½ì” Ï´¼%áKÐC•)ÖÒÐ2"z•ÍÉ“—Þ}ÑPšô·?qå´Ì½Ýõß9¹vÕªU ¶4Ú,ÞÍåiBùòaÏö÷ó»r_½A]ì¡l¤¯Ú¥/Ô1œùy“BíCÐBŽõܪœÜZ_sqãZŸ’é/ZèmU|‡®VuL8_ÛyÍ(‚ýßîâøK7lÞ oKÐâ¤~eÇIÕøˆ@®3F”ùÊìèk^µG[?µ"ˆ2Ïió‡žg•‚¸×pcgWÌÞ”yó¯úñG5gÂRžG:ÜTŒè¥ý'@ :"}b×®“’Þ m b;òêéÔA^±‡¬ëÿ¡…ÞÙϳá,©+$dÊ‚NËàÖžúšuß^®n§ ¾ÑH™kN1ºíŽ}w¦¥ô‘âÍh™¸xF± eŠÒ=ÙC™£vOvvMS:ÇNñèV÷¼;Ó2%)¤Ã‚–Ù{ç»f´W”þ°Fº¦s@–G¨±g¶Ôçºùãò÷BKO%~û¦ó]s]¯)=Óć|hÊÛ3-ó=¯zzf둱°É‚CË-têLSCœ•¸– á­1cÏkdH”«{¸©¦h@ÕìÊP”©Æ:z¸!¯Å³²@ãKG¯Ê‰]>´a×)Ü°ØmÍÌì —ƒÂþ¬¹Ù÷›"áUPK§4SCýž»z%ò¸„jž£S_‡Ëz(4¸>,ÇëCi#/"È“j´«g.*½"ÄNÚ¹x¦»®%Ð+ÐËûÅæxŠÚß‚lˆ ŸC~]M–˜¢~¡°šqqk¸Œ:Þ™¯ËÉ:Ío\Ô0ÉJn*ÂLIß5{±fôÅÅu³ïŸ´_„Z×X\`¨«{”¶”PpÍì- )κ:„ùj+°º×ž¦ÚëBº˜ò÷„— åáM!Õ&¨·2gÎÇ–´KàFö’ÃÎËx¯¢É{ÊY›˜V±÷çãÄ·¹‘-µeõ*"b9¬•8?;iýž/¬nÿ´°¦‰^KÝožuA¶Ñš*¯Ÿ’jÊ0Ó”Ëþï¿-ÍŹ?­æ¿±cç…: €–ýéƒôŽîƒÞ’ßH‘Öê×VzÃ2áCÐBëãrèZZ¬q5Tuô÷ ÛÅ)SÖý«ÐB§NK>[9MkëÚýí¡‚æ~ÕëŠ=ôùÆp)cßÂ÷BKw)zÓfÁæ–F aEgÏ0G5nïôη ¥gÀä:Ÿ©Ãsosù Ïaà †–?Zh]ƒLCm #Êüº¼UÚ hÉ/¢”’snœ»Ä^G(EcüªÀ°‘ÖÙ‹Ã5ÕTSBôNßñÉíh Æ™_Vrmj…N¯¬¬êE:n9s¿‹ú ¥.ïÊ9yö¦‚ž&F~ ­xôúýÊÒÓŒÿvDEí@Këk¸>@¢N&y˜òëD²ó¤½ºˆ“ß¡¸¢M_ðl~×|WMGq-#Øs‡x8„"Ô×ÏGõPœ`vî~~CUSðBHÅ8U]Yňw3Ý#Ýù|áTOa î:Ï5\Yo}Ã(•:•öÈ’_;¸¼f¡zªPW$¬–¶©TsÝKÙ2Ýí£¹Aªª>ø–¶×ÔΗ9EÔîÚɺϺёÞ3QCHàÜ-RY3L¥ÎÕ”´TW´[òs:Ç´¶VV s‰Ên¯¯fßBn\BxòÂ6•ö–!c1ó,F{×Lš»¯afS}7ßq|ußÆÝèâÜH‡‚6¬B~êÛÄb¿¨;"òø2LÚ&'h‡'uéé“S=uÊÕ-y%´ÊâZ™ ±í³±¾Weì‹kš^Ñ¿à™§àÊúº††aZw/:»¾®®7ÑAÄ4ÃtÀÍ ÚÇÖÄæ CdØ9V‘h,z÷ESËï\ !ë„VCám¬bƒéSå~v!ã{ÕúÚÕ½gÒJú3… ýó熼8aL[Ç$}åLË”Ø9Ñh"µ©–RÛ6i£ é“󪫦|Ç6 ZÚzöÿp”Ô0I£Î¯˜iq?iT]ŽMýq÷݆®U!¥_…–¿¬EæSÂïëSAt•…K†Q»†]®n`CK²Ž-fB™£5UÙy¥©k6ù¾Ÿü´¼Ò3ÿúw@ÿÐÒÞªqåäºu§Ä*Þ¼SÚzÅŽïæØqÊ;™Â>“êjΧ AKk½ïÑuë6ñÊyÖ-nMé$û)šDл‡íä6spì=£Ll†"$zÉZ’•È©G¶qlÜ/Œ-Éèh;¿ŽcKâ:Ñp}€ÔÑÊ·˜'º1 ÚL¼æ–u;n¹çÓݘ°o3Ǿó·ê:fØ;'MŽíŽÎ`í¢é çX·UÍ1N³‘àÛ¸ŽãðUãzö択^•c<9];Ðò6;þu;dJ[»..&wM=”A›Ï4“0ñ«ZºL ë!¡ÀnVŸf'Îö)fÜ]×·gã†Ý瞣Ÿ7Ç:ˆ¾›n'¯uú©¡È:Ž­ÊΤÚ/¨ ç…;ÝÊŸÓÁº=YE 4; ¡,ë¿tC*è݃¶R¼ëÖm¶®ù\‘þ‚kó¦Ç$SËY,ÝÝ%xT¢„=~ïfè ß¼“/»šµU•2j~l{ŽÜ%™·q¬Û°×ôq>8/¿/;õ'í;¨_´ôžögCKº&7û"7q¬hèÒ8 õ)‰ûõíÐìYòÇMv"=W]Ïòyî†ÍïK÷‘,±nû$ÖÄ?º~à‚ ðÆ]'ãjfºô¥ó"‡¶p]±¬ê˜c ¦FÔÏï_wP»¡{Ô„{¡ŠäÑê¤Ì·åe]æÞµqǹìʱ&BÊiÎÜçoŸàխ膶͠•6¯çPw*n,ÂìÚÀ¸Û³dšÖÖ,{öÀ–Ý|©5¯¦¾‚>€–¦X-ÛÀ²·¡…v~Óæuë6 jù±Ŧ­ä.ïÜÁÆZìiV„¦%…‡6mXw¶•:‹öÒݱsŸÆ-YÉÛQÿUfjÌêáü·ßÍ®ßø5iî»ï_é[À}üÈ3,X°`½»)7àúAoôðâƒKt9q œ-ÿ9ÐòËÿüÏü?ÍnÚöuÜ ¸#Z`h ¬÷AË\NX±zqQ˜ú26Gƒ³å? Zf·î³vý:4³c -ŸZª ¦›J`Á‚ ¬Ï«Yc=h¦åäѯæŽæÎw4§­ î‡US@úHh¡zh˜ À‚ ¬Ïª«#‚T¨/T¯Ïï]üÌ–Ÿ>êÆÿîhfûÏàŽ&Ooÿ¾‹?@U‰/¾h±Q›jÀŽÙ¾}ÒRdži)}7uÑqBöLkÙ$ÊaÄbáäKTæë$›sÁ1dütSùTaبt~,.tøÄyX ŒúÙNÖ”Ì4âÆ\o€ú¹L7—O‘ý–"5úÄgª©l"Êúi!4ŽÍE0qÊÉ ¯©ú²éʤQÛw  ü뜬éVü˜-»} “03Mùã~âPÀ˜ ¨ˆ¾ VtÐœ¬/™Ê{ònŒ…øN5”M×dŒ9 C%ŽBδ–O¢¿¨ì fåIEÒ¨ +O|¬¦ÁEf³.ÒZf¢€<Ó’7þDå=cƒ¡V¸¶ØaFWiÒ|U©á.Ü‘~ÁtóžÕË;=$),o0y ´xåTGJ“ŠŠâ@|ÀÈ*fÆ›þÕ‘ÄŸbÅYˆ¿j0 |d/+ÙFÜ™s†ºxCùâÒfµÔ fû9¥+¼Íu5FC =Xç·[¦:½¼Ì.ÍvùSA+›¼`èàYí€ëã”yQÃ/ñïˆ;}voåòA_7ÄŸ¬§‡è½uÐâ¥Ï†õ©3Œ€%ŸÑ:ÁøÑ#ÎÒojÍ?SG6f ìÊdFŒ¥¤a•'²¡±ô@µÕ %‰— ·Øí q ü.1Jù˜HýŒØ³ô»Î@ÏE#˜‘&¬ŽNv–´±ÐS!«A‹—ò˜•â@‹tdÆ‹ ã– »*••çêÁS‡‘w]ÌÊ÷[eXçŽÓß/$·I›jr”ÜÅf&£ßr•á&D–Ò£¬mƒlw“~Û†QZ( ÆDbÝZ³‰4ÆíÓT?}° ÂÝø°ÀóƲÒÎ1+«ùÍשžÚà•¡\–毱Zn^Qjù-¡ _/°¡)ìâÀ—ÐhÅ.õZ^¿3ÌtoÁóÆ UEJ"€"0ø@vgø3 ô[vœ=LžàÁˆ±£Ç‡ §3©ž§™ùô0KÖÀr‘ê¥ÅHuçÍŒ2oJ+‹‘ŸÊáÜÑ£z™óÐCô`fÛ4§À™é̈?GöᣛÁȉĨ Åü*§%Ðâiă—QCìÙ%—h…uÜê+´˜NM=Ò@\ËF¬L/$‰•éºŠëŽñ`–µq3À¯ÑA"T=Ò™‡h£zª1ðì‚+ôülÁ` ÕËŒ™éAtä’ÙÌh£eìÁ{Ä ?ýJšž =¤;ƒŸ“YÙþìê$zˆîòÜ£¼E¨ôÈ‹aÞ»ÌCŽJ'5zÛ‹Áä 7á£f‰{§§Ý=­£úqÇ›h^§huNÑUÚmWf˜Æë¡…Ê˳ãŽÔÓ|ÄuÝøRi\ô Öïs{yãêТË%PXY—h7 Å5bÌ›lcܶf¶L°“mhôÂâèqQ½´(Oá#¼DSõ`ˆ¬¿•™$iS-zÀoö¦ú»ðçfø¨iª™ªCOÏâµC„Y^ó—í:9Z8ìû9ž@_ötì‚ËT+ç1ý¶--:L€­–þu7T0›¹rzˆžËË0âM×A3þsˆLÉÞÀWZ ìá~F5%g±ü¶[âf¥'x‚C˃ä ÚÜ©7#øM´HzN#'y!Lêg/O{É« ÜR'©¶G‡¤ÐäÊiŠc”´€Ðr]›=ÐÎLpeL²âÏ,NÍxSu‹FÅîï–Õ+ÓCjÜá*Fzºˆ1Äìècg€7Ò cì,±g<'|ÚC 4æLŽÓ®«ñ¦fKĈÔ›GµZyEÜ”ÓôHSvO3ÄÏx¸kC»ã)¤ Ò$¾ÂS›5KgÞ1|´øX¦*·Î²{‡7µ˜m½üž;ÔËÂÉhjìÝ—ö0AÏÌåe˜Ñ#ÍØíݬ›+[Ÿ&{CóUÄ()ä7Ò#Ì©àWuÆÐÀíô‚^½35·ýeA/‚s`äeòÛÞ.h ºÊ)ÆŒ+¡ aþÜkŽ?ÕÏŽP_9´g¤Þà?šcÞÕ§°¢´©wî¿„–X7Îà¯èÝ xÓÝÌt?á!CR^úÒ3qe©Ò!"&äÊXehñ1䓉Xy}Ò*ð±äbÀ`çuÐâsFÈá2ïCH/ÑÓv@á¼éfºøŒe°,4-¤Î²:ØEI‚ÙÊU %Ê…UWËoò”þæψyëæò@LÑüÔ©7“Õ¬ÁQFj6¯éõæy!%b‘X+d™KtâË#>aÜÒ§z©ƒâc,À6¬Z:FUâ¼9‹¢.ôõw“xÅ—V°Eh¹®Îž±žòº[¹…Wßhñ6ðØŒ`õ—ÐBåíQÄ"0Bõ~—Õ Þ€’õ9Sã¿M»{™ÕÞƯ;7o ª—&£‹ÀÎ:ǬíTž£zipLJ7$ë Þ`Ö¯ð¤õ¦£àé3VœÁòHK;Ûg5õH²ûuh‰VÎîhbEªSK„Æ9åA¿2=ôZµÃŒfs+û¾5:Y¹òZ0þX«[ò¯ ¨zv4æ7^¡ÞJñ9â*`ñ Ì–Föm°¥ó xkJ°Õ¨N® 5Äç%´D¹0kk@h ö=‚ƒ]RB>¯õ6=·RÔ|л»Ÿ$qìvÜ™¾E̦åäóRºNÏÓ¼§xÐ$üí„"«­ƒ]/À7K±¡ž«½Z˜-½@×Ïêf%>çªøêôм€'’¾ÚË"HVø,ƒÿ‹¼‰ðÁ"“øõw9ƒõŒŒrNº˜¼ ¹$qS•Nj»ó‡3›ê´¨qŒ hÑãŒÃ™éÜY+EB>ªlø;m¡‚½y#…+×´pºëYÐ& ÏC ³"4–A‹ 4 f}?H;€í-–Hj ÐR\ÅM°æ¥pººXQ¦&…]Wέ¹+¤OHVMÐÒ“íž+gy–@KL¡ˆËìažÃà¦3Ûº9DùžËA¾´5z.„—êÀJg·´¯ÒY¿-`|8Ú›30 DˆÝW2'û<««‰¢¶¤‚¤Ágf%”ßôvAKàyvU §*MH{ÈÉu_ÙR½µÙC#Ò1ŽuYü<»ƒ[æEK¼Åi Ûá Î<*XDRÃnó[¢Àâ§Õq³Á««•`öJ›Õ¢åñ»Ãe¬² ´H]½k`TÜFŒ9MÌ»¯ * ^éd ÅS÷œVDÐá‹jx$¿#¬‚¤nž‹d© 5@<÷íu†÷„Bóü[ªž(Í.àôÒ袹èE?8¾!˜(¢ùi¼]ºuÒ(Õ‰o¶üð • ñ”°—6w²Wâ(¨¾zT_ñó‡Þâ·Çˆ‡œµÜRÓàãڥ㠪¤_We”C¸5Á‹Ù±û›˜ÑÆ/góÑO_‰_ÚÓ] ZÄùhÓ›p¬TÛ·Z®k± ,æ=“—Ð2 ¡ùëýÎPªÎ†½Œ™Üt™çõÒr¤UOsr/2Š‹xyàSqF™Á`Æì‚s¬¢7Fú]Þx·-ƒny°kaM «©—.®}vOë+ÐrYðZb…=`H„Ý×ɼ fG»iŬ„ðÛ.½Z¼Í¹)œêNs3à p<á•H ‚®Ëjêç¤[þ h‘úa!u˜z“ßùrݳ¡Ž˜“:ÝF»y–S›.vI(52ôÛMµ"*’uWq˜)|ÞOó·ãaûÅáÇT~g,=9AP.«`µuƒ“·w¸îåàÅÓ€3ƒxB ÷‹Wtxñ^ÐèAÔ{1BD†øÊ3¼©6‰Æ–@‹5„ýk¯5Œâ,B'½ -ÜÊìÞAf¸5Òk±¬L—åÐâcÅ­f„‰uëçÆïõ@¯cÅœ’ÝÓÆŒ[˜ ¿ÊŸª -Ž^B‹*³(xî(’ß–F‹ôç—‰gjòxõ¡ÔëÚÌÖnöç—êmíåد„VS-²•–\)¤‹×Û,…–Ž@ ´0|ÕX%I %ºO ÔxZè÷Sø– &Áèþ:ÜÇTÆ-j¤¯èQ˜`f¯;qÕÖ±Z"by/WÁ1Ûº¤ÐBª …»¾´‡\OZÒ=ÿªìA†ßë"-/WS2‚T©¾æü8î D¬¨ÈÅâ°’úhïÓÂGý4¯·o!_CNk!w “×#ÒbVA…câXÊ gn”ÓR ô’/¸$ÒâeÀ¨å´äó¦¹%NT/SÞT/§1›‡A0" U5"r7§1‡S&^ š$"˜í~‰:²5-Ñ¡œ¾qÁL+÷:Õ[Ó\Èíoçõ§‹WQŽ f›@íUH†Eܧ,æmImÌi| ¤=浦BË)å C8ým¼ê+`LöU€E2¢À‹i÷B矋ý*½¨’×TVŸt êm%x:&qò¬ê§³F€iñmÀÿñÇ[9M¹œÖXª§dzèw3ì;ÁÜÎBn_o Ôpk§5Ÿ;ÚÇ­q¥ú]ýID@Wa…_áãÙ%¼aɬ±6ßE÷]¹ƒC•ù ’¬ýú…¸‹Ð¨(㵧°³í$Ó\ì C× E4×Ïn(âç‚ËVËJ8u©œÁVN–éë %&Bˆ/åõ²ä!»Êîïãvr: ¾bh S§œé’R÷2Yˆ´°ªr¦ .õlñ@YßÄkËä"FY©VÔÀ³|œÓTă‚9MŒ×Ì®ðS¸wW0½85¯Êh€±ü9-·‚×_0!;ŒÃÐ2 y·VÙ=”(½'V©-o²\Q3<ÌmÏf7¤I§‡Š.PÃ. Ÿõ._}äkÎi*±žr[Sh7ô9s\þ`9ð`¬‚+àl ¬‡Û^ÌÇtÒüÔ∈âFJõ>Ã}Då¶ç‚WÞ?GõÔbUÞ<¤ðÛ3×âJ#-žFœ±Nc‰`¥œ¥¥§ÌSá`C®½+n°|L÷¶…%ÐB/-L¥Qý. ÓdäF±áD^×}fªóRhYnôä(lV0e¦ž§ÙóÉãœö*^/Ø{Òîçò`P.¬““nBõ9'xFà6çp²éáË¡eü·«¬ ²@™ÜñNc&§½„~Cc ´,YÜ°æF9í•âÆõ:h¡gFs; 8-åüÑ"‰¸84O<‚[>÷ É €¶à·q÷Ld"™ü)…ž#€XþÛ»‡’xYvTïßHž>:ŒÜº×EZ^+ü©†Õ¡åÿÀ–çÿò¯¶<ËD-2‘‰LdòZ¨~ô({ª¯úoËÅOŸe'š”A‹ ZþÐò¨Êí,“‰Ld"™ÈäÍŠÀÑeéeâ+EÀ_x|ƒ«JN ‰üòÝÐÈäôr<¶3Mþ¤åÍh׋1XÂ#…ݧ"£âÍŽlð/šù ÅèZ.ØõcŸÇßN¾j ´Añ ö¾1fš¯­’¹d`PRéhwæÝñŽ ;´ç$dBø¨e¢ø|`ñä¿s%¬ª`óõa<Ÿ”·Z´Àä>þÍÐÒžtó›c¾·ÃBìV…Nl~÷KŸÀ(õ£J5/H#ÙÊ×Kk¢ük)ÀöIåú÷þÉP×çjü爌I~+´0h4ê‹ç?ü£¡åІ«ž!19CxÒ*8i¨€Ð²àŠ‡ 9Ÿ)e`I«&ÅÐWЇã™~û>Mmx4\÷“Z‚$MâÔØÞoá(á‰{Õ©®ÀÞönÛbš®::i}Ò—Ô㇎+Øÿ‰#- `ë½Îˆ¡^êižŸ£ˆâœóRÌöu²#IZe´¨¾S€ f»ñ[Ïàø€Ð,ÐqáP*Z—8Nãæ¸jü’[pxõï~˜æOWFÒ [¢Æ[«×*Å¢¥ÙÍ×\:æÑ÷¶il¶·ã£aÈY¸²¢‘2?šfaP•jçÜÀÀì‚öÉêÙ¥…CžÔrt’wîçø-?*]òôOìcþJœ€S;;PÒ†€† ÿcgÀ¬X'dKoÏñòÞÊ»½9ò§ÄЂC«iœŸÂqËÎoº]Š|³º"a(?ɇá€Ï$ÆÕ­¦Ô.tv¤GJÊnXÊ/ÈžÔ}—+)¿'´H¤#ê’‚S—¤:TLfˆÒßhùѪ‹Lù%ØBÍ¡àé2̾fablædcï5…!Z« µL­-¬O»d£ˆÜl/k cCåzWêZcÔuϘ>¬®§®ÕÃ…¦èZX˜˜é{ÖãOLvouuóU? ŸßAí¬Ès8½Wñ´ƒ«wzY³"s®[éÙ;¢ß3ɆBÏé|yü¼‹[Ê$aióÔÙÖÁÂÜV×Ð ³"h+Jû|ïYÇs×Îû ÇFªúÀ•z–þ¢¨;ÖËÔÂÑXÇèJ:ŽLÞt²44u²0»8„¢û[OÉkžµ9w5¥{Ž,lNò×7¶3ÖÕ÷J›ÈÔTÕ59¼ÿ„±®n`ãó\GÍíJæfF§¯WãÈK 7…6Ó42²3÷œ"Š:â=TÔϘèœúhh ÙîÐ ¨ÝGÿ¸sVïÖ6 …c¥w¶ó'³–A irxÃWšÓY?þ§†–§#g2ñ…~}vYSC—Þ®o}r°¯…—åÑ6íÊê|±Ò¡QÈ¢ÁâpÝóÉd2àI ÷ü¼ù‡-Ç2:žK¦Ú2¢v_…‘€v‘z&°]é´-ô¤²~0n!"£[Ó”?·a,B r°~ûIâ¢2µŸÖúwóAu9ùÁvóʯB CÞýÑûV7Jòoy|{<Gäßs5]¿qó÷á³KúVbxû?÷FîõFµŠN+žDî¨üÃ?ÅÕ’%Ùѵª”qÞ*u:É ²s. ae §ìnªl.|à£ëšÑ‘÷ƒVTY~îþµëã†K;#~Œ‹É7¯?äGò¦Ú‡r+ó£.oÖŬä-% Çñ’ÙO·4Üá|R¢ôHç>ËÂjöZÈ‚Dw«õ^»Çqh†÷–@ ;·ÿý*Gù‹Ðr줪Ý[wË…Œ‘¹?ZHcP9M·ÅßhùF#µ R}|¯\Æ0Ù ëÔ1›ÊvÔä,ð-:瓺jªû´vÎïì;¼å†0ßb® @˽ÓºH†ú×Û‹2ä)ÖöÞÈê®Öïþø§¶É‡¦Çõ1”ù±$Ýk÷^i¡ êOØÆ’)ó½qÚþEà—!胡èÕZŸp¸{¼¶fÀßF©vEˆV”úùD¼ØV%zªGµW^³0 éâQšë‡*2bÖì¼!±MN´"ǧ9@éFŠâ¶ªFw÷1x!5sxÍO¹å}Õ%™Gl'²´c+FNýMÕ‡ï¢rÕ-#ÆÉا¿;Ð8-|Zš³n¨†ÖÙùÚ›ù·~ qç'²ì .¼>ÒB& ‘ƒ½¯±˜Xa«hXã^íIœð„òUg£úª7n4B?Ï¿a¢\¾£úûø³O>|÷Ý>¨Ê.êÙC7itA¨kÇ]ªˆ«Í¿¿„Ü£#}\ã'þçѱÁÒS¶w >,ËübÊÐ’u(Äþ5[†'i³mi•ÜVYøAbƧ¿ÿá ÿ ÿôʡﳚçÞ¢5-b)¼ªt©Ð iªY^Ù¢ÏV¹yäýÈì8±»ŸrÙH³±¤!–ªÚÇ:Ì0sN^„4¥}˜J@Ž©«X¡¤‹yªïùrªÀK«@XyyWL~îµÐtÊ*æa‚`2ßò\l×Û-„gŸ¾WÔËZ„ŃFE=ý£/ˆ¤ù?Z(ÈÞCJŽ¤W ej\yllšµÂØæg‡Ç‚/Ù~õõ¶~ï’žfR×ÄÔsÄÔ ¬~ÏN3 ^F2\õh‰3(衘šùu—æÈÝÅ©mW(ê{*¹’„l­aN Ì#² Ý¢{_-Ä¡t½+YÀ‡ñ2·‹÷G^-ÈŠ]zÁÝ°Ç nªÈ•Ð’¶Ñ¾,þ\jã×$yæçXýÜÖo3‡G›‹¿úÙCšGL‡»_øü£5õ06…ÄﯭrÔ‘ÛcŒŸèÿéŸÊ}cÏ€»ff´$T"/Xº µÔŸÎuÔvÉ$Sˆt¶–Žò_…–Êh{ÏJ‚$;4òñþµ‡ZgDÈΚOWƒ–uZ‰*øø ›4‹@ ¶3{Óž³„‘ ÐbP'ƒ´¼ÉÝCd !-µ¾«cÄ^ñ§ë÷g–u‚ðŒé±#Uȼ 'RÛ 'HyË](¹>Ñÿo¿>=$uÄ–¿­ƒ4x4¦`F÷žtiì˜ðÔÞžÛÿB-2hyƒÐBÁÍ…_¾lfjïÛ¶l¥ O½êxÁÌÔÎÌôBÞ¯,ñž…cp—ÄE“ñÎ.-ãà€NH¡ø2;3ë`~?ÒçjçdãP?ÊZ÷PazHÚÄ’U£=Ùñ°GÀN ‰·•üez©bBT«¿³‹µc@+ðÃóU‰–¦ö}Ì`AwŠèë³t.”̃গÏ:^ðΖúÂc_çð1ñçªô[ ;K;¿¦QÖ{Yš¾]ìƒÑ·g!n‚·ß¢NPÄ_Æ:ÚíLí¯„×HF@`¯œµ3·÷«ë§J®¯¹w;<&°W¥ƒ:qöËʼnZKòl€l}[ÅÊ ¥Àçjêg¢ÛF’¾…['J$ÍÎ.@wDW—'qÑùH®Î‰ÓbhÁõäZŠ¯´¶ ™Å‹ê²S으²Xá›UÿâŠ_õÂ|– 32ØÌÔ) ¡‡H¢þ@h)Ï÷OF.,xžñwq63s-ï˜klp½‡üháÇø˜™:úßë æ爌ìð@À}]¯j|²»Õ¨oG5#6XeBûØ‹èÈXgô…ð➟§™¹“l'ŽH K%RæÑ (°ùàžù^p6sŠC­˜l+̶6uðˆjÄÁèÓTO¯Gñã•ÐB&0#¯]µ»s»»Zí—1Ò‘¸uÉw¬Í윽Ó„yDc±£³H¬“[ž$È 03=çq« dÔÀÐÇó€NŠÛÀà~ëåtÁÌúrr Ù[Óó(%6ojx»d®%)Öóæ=sKç2©©ÏO·7©;Gâ7Þµ1·»p=eŠð yfÚóÂ¥«!v „¥Ð¯©rODI¡K·w‡ÀøfÉe•©÷,M¼ï4ÄQ8´È EvN‹Ld"“ÿpAvìúv…_ûï4ÇÝ]šQÕ4é¢q"²–*Óöï(¤gç~¿i›íŒ ZdÐ"ƒ™ÈD&2ùoA Aêì@ôÞ’È2mÈD&oZHÄgÀ7™ÈD&2‘‰Ld"“7"ðaY¤E&2‘‰L–n0˜ÈÊ„6Ái‹!ÌÐpkßóßž”¨¡v/‹ºÈD&ÿQÓCóS=í{¿ùàÏ6§·Ó—î2xj¯yøƒÿ÷µäDÜòç¾üè½ÏÖ)Vs—­Cƒ7Vîüæ£w>ú. k”BžÇvþü姟}{0«MLÿòwßyçÝ¿ü×;e³í·®ü×_Þ¾*øB4;²‚>ÿÛû?*ºcÀãë³®~üÎ'Æ>µæcü[Ó<¾ûð=ñ–g2žîª¾ç½÷¾°¸Q(zÛóÛÏ?øtbí({Yà§fõo÷¿ÖKNÄ¥žYÝü·k.æ=nL¾fþá;l8zy %\¾t }óg­;pn³\çÕ‘×þùÉ{­Ù[Ø÷HÐÇ@áwÞÛ}:bâí9¯˜,ªˆºêäû£uã e¾«(ñ}o‹fÄ$~?6Ú½öÝ÷×x¦ QVl;Jt7t²ñ¸Û8ZØí)1Ë#×K–o[žQÛùí;üÃ2 žLš¯Šñ_÷Åß>^+¦Ǜ֋mû¯ÿï¿ Ý—0?S»ã›/¶KNÄ%Ïß÷±ùð÷×¾G¾É…¸øÿ,í»û, ¥Fkîã•™êuö“wÞûz›F×{Yq:3<¿ÿø=-ÏÂÿѲÿéÖï>Ü#9ýàõ2ޜ辸z~ššXˆù×kŒ‘Ø?U†ãD…å H¿å 1Äïþõ¯ï|pØä&’0¿rÁmI„MÚ„@ÖyÉD-o ZˆÏ.ªh|<=õµt_…ÈïïÇ[PCËüì(ebêE_Eá‡î-;79Eéƒ=FŒ"NÖÁÑÎ}÷Nzã ’¸î@ŽÈG!éHæÌk[F9í·ÜU¼fg需4 ?´þ`ÿ³õž³–Kz´k‹öí±)ÊuÝí˜?/´ 'p}®&bh­×¨CÎ>¹a¦Ô‡õ ácÏú*‹>ÛZ¾Õ‹Õ݃QÚz„'Nsc؃ñiijI$Ÿ‚UÔp›B1*®n‹Xv+ñ¹ëþïK;ÕßqVv(^~ôÄøÃñÉ°–†5raH«§‰˜~~ßJîBÔÀÛ³åÔÉø³^hÁ§û"Q8’áQõ¾)j‘ë·{ƒ¥·] RQ¨™9Km£ÜÒ1£ šî€NÊݶß*GuFûó蓘åò~÷¼·ŸŒ˜À:+îè@ à}(ØØÓÁzèWû‚g‰4`Û³ÏÝîº[»¬…Φ }ÐØÃhÁŒ?uÈ®îú֠܉7¹¡͘ŸÝ wc(,–[ö ´&ªÔ¬Â¦fè0 'Œ÷÷¯D€!âÂ¥b83í+t3üA‹¨3@ÉHAÑ)7G\²²8뤤bV5)˜#>½fog«£®f=!Þzó*´Ì”¹ÊÉ)¦LI¾¢û;-5UNXµ3gÚŒÕUÖÉk{HBÀ5÷xÿ/Ÿî=¨è;FÆ>ÕU;)§(9h—ŒÆ]2ÒUÁ÷â–ÖlÚ§ w:M6'*>ªiqs-’ug2‘AËtNËdûί7›Z:©)žJ¬$®¼à•ÃåDy ·mÏ^Hž%­zþÃÔ€†¦+Š$ìŠw3±v³5µpOG’űىúâµGc0¤ù¾Œx5]Kµ£‡£:ˆ3ã ßïéŸá×E9ìVó¯ Ó¾Õœ¹xæFÿÏl‹‡Ë×E+¹W`1OÜNlˆ”z×ÁŠÔÝçjW½_ã}xø³5ZÆöúšºçîŽHlOkKÇË>šŠš­#KŽ©'ÏŽí^³£,)±47öà1—•½LyZ´£…ѹ»Ã¤…,nj )$¼m(OÞíX«•?a_¯³äº¾[$ÚMõÎEÒÛµùþÈÒø‰ía%ÖÉQí¶Qæ@Nªª®¥ú±Ã-äÕ‡ð(óCŠ8i"#µYûì ’* ñ»®MVÁì—'â’Ø~vVç.ûjQm¦¿Y]½<§…"|Z(˜©Sǵ}ÂÔö<šmmÔ5 ™©tÊMr˜$¶ÁÏÈë¿-ü‹3›v”Wfjß %Nc³mHûtoó.McÉj[×MršBµ<“WFZcÌíƒ%GPòªÅAgGû'§Y³}õ„‰ø.%qe¤…g y~’‘î™Ê;Ýíê©Èý|·ÿ þ‰áεc¬òKrþéˆåÐòÞ×MSüPÝwßšÁóšêàccä8Ë-Ù-–FZ„ƒU-ÃcÏ*#´ÝeÝ™LdÐòÇ@ i¬qóÏ'‰”_0 75íã^ -¿LÀYa?™—`Wô˜$ì§SÊ µ(Dfø‰o}“;ò"Üw¤‹7õ‹R<-ýZ_=ûµ§É^Ôž¸gûn]3£cž£•7ôï4úzĤ[xvpeÐ"æÓ/éܱ㸮¡îÍ~ä¦û»t´GЫ¨_9ÆŸ²÷£r»xxÛº¯Õ³(µ“fåpoÕõñÕKxƒ4 ß±fw¶ŸkJJ´ÜÑ +ÓDŒ  b·™¤cH@úüμ[ÚneoÛ"éþNEÝ1Œ€¯WqÈñpj(òÑ»”‰ŸBž9²ÇN•cŠ§’a‚¥}Jõ¤¤î¥úCbí"«³ï6\“CŽÌÈ V—ÒP’ÓYg‡út«H_ˆ0Ëw³KZý¼¸Eh¡`1Z'ÊGüÕ¾»S†y;¡ü 9—s[aÃ7-‰ðF…ÃNØ ³à©YþÏ 3ÿê§sŵšòZ-Û¢ªžR0„]× kŸ#ËÒ÷*z´)j.¾õcš{ôÀÝ»|´Fwÿ«Ð˜®Ñn¹|8ŸŒÂmúpWÏÌòqWB Ö´þ[%æÅU3­;l[ÿ÷;•Ø%ÐBâä8ìÚ±×æ¥Èº3™È å:\‹Ò:B º.PÓ!þõЮ…¿ÿ·S£ [NÁ XÉûÊ Ï½Ž~ŸÖ@_bŽ&l{竦IÞ´aÝ©Yüü£sX})ç0÷í2ƒáÁð>™$j‰´?åT®ÝaSL¢îZ¢D2hYœ!“˜žjû;ñó4JWÙ {V°p¶¹ÇcÂå‘"Ý~ýÇ:X˺¯5'zROˆqtªØÖ2<–ˆcŸ“ÁŠ{h¶qm÷$w4×ÿ°a’dÀü!ñ•‡!ÎàÖ~¥2ˆû¥+ÿÞÝ4áíª ©s° ê„‚CªÑÇSæû#ÔÃZÁAíÑŒµð`$=ùpçKìO9q.ì‹l­âßÿÈ<´Çd'^ê3FœFqÅ)ã­¹ÆöKb† Æ@I§k± Omü¬nx1~ŇßV@ q0SÉ* |¨ƒYdË[ -Ò$ånŽ©ÃsdvÈéÉúߤ.¼Qñ-=e·µ‚ ÕU}×,uRGùq›½ï#‰Sc_üõ IR?¨?Kþuµ i¼5Í&ul5ha)¶Y8ÄÃØ mˆK"Ðvn1Z€–ã°U EpñðÎèabü³O4F0—ˆ»Z`…÷ÖÊ…¢{̯ç“É‚J矠ålòèÉSƒû7jÏàD°t÷£¦2h‘‰ Zþ°…¸"h¬ï¹“å4rš/ ‰cŸYhk®ýûç[j&±Ã.œ•?rìÀþã×3gÀcˆOm¿ÿ<·\Ò_•è÷—<"BáÄù~,¿.ê²üáò‡”ÝàÀ•=‰îJÖÙ’4s½<¶w·œ:œBÕÞr?¬ ¯}¥m’O&0½Îh–;ªu6šø'~ËsÇùÝßµ~‡å•d晥¦ÊG¬|Kþ×Smßšõ»N(¨‡ƒgQŸŸûþãô¶Gb´@ª*(ñá';éåòõ™'Ž(µà•"_\5Õ;¢pòàAÍú!pGÆpuî»ë®Î€«bæŠcÈ)Ë)˜õ‰{^<úð:ű۹vQ¨ñ}ŠWàDôäÁÏ?Þsø{@bïÛ³×CeÏšõ{$:™!ˆŠ£®ï?xâÀ1û¶q.6ròˆâþ}G®ÅuJVT&Y©h9‹iøÂ팮¼ÂI99í-?Ê4Ë=r>©â%»dnࡵWbÁ^3 ùü£o¶}Ì°iFà¯{äËu»ÀìÔB„_&J¾Øá‡".˜+nâ‡uÆ’— `[ïÛ¿õ“/¾;¡æ Ø=-õ(¨ìߧZÕÿü­‚–MÛÅQÒ0Ÿš0S=%¯ |HþtœÃjHõüàCÅñ‚Þ_ùÝë¿ú~»¹KÜ/ßx³=e00ÙÖ´ˆí.½1[ž8­ üRŠD èîÝ¡sJeß~íš!ðü F刢²QØ,ci ¼ë»õÛ”-ÎEá‰ó5I¡ÇO*Ÿ4ª¦6ß:zÒàŒÙ…o¡Œ‰QTÒ J™B‡Œµõ×þóÇS9#‚ÉúÜSòÇ9áõM&>y´¼ûþ^¹cÊ:N•Ãl žd£«­olo£»U-CµÛöŸR³¹&ÐîØiië[5>®$ƒ™È E¶åY&2‘ɪ€kZvÜ©}±° œrFï.Ë«ÊÊ®mƒ±(ÿ¾ß&²jJê22«Ï ÝÈFæµU´3Áý_â¦: .ù&Ì<ÊÊKZX5 ˜åD<0Ë¢^Ð,IÜÖÊæŒ hE3‘Hþ…Œ£Õ×ddÔ Œ3ÀâL¡ó²*òˆ±âs,'záÙéÐêö9 Žfº‡Ä*‚@ûWë˜O ²ZgV1{þE}ãá×¼šÄªÌ­Æn¾§¹';£ª_Ü<»ê:¤F›ÑŠ$þ‚G>ÌÏ„V€. 31•%­ÊpO+YÐUÛ”¨~˜I›äàIf7N /k¹èaôÕNŠ¤ƒº°¬¼vôÒÞm¬g´~LzhØ`kϸCïbsmê_5jÜìCqŸXÓ9üœBâBr*%EÈÉ$8ÍÐ&à!¡-¤oöÁªë'Q¿ý˜2²ÖÜ ôíƒKk„í~A{Œ‡õÓzÂRU´÷D¥6”¦Em>`&qó‚"sK;}ÌU¸ ’PýN" só¶~ôIõ £³´*.«¹$Ño½J$– î'm ÒþüómycBôØàÚí6u­ú»¶vãþ¬Ð‚':h;ä–už9¸ùì=$a–ðã:ÅŒ‚âC[Ž`H¢P­gnT–ÅúüäØL\Z¥éïîôìhk“ß©6Œäª~å{¯¹¡[±y<ïn”çÝŠ‚»—׫„âð{u›¬’kÅígnO“±šêcèqRÜÕ·ü(QyÂÍ «jçRÁ3Ià5…ïnskkëPÚ©4ˆ“Ð2S—yíªó¦Ÿ€–EÁ"Ol“+o²Ýóí裖’LçÐ’‚„ÀûÎbV8‡Ø0[ƒcA½ ˜iÌY·^¹Ú›Q>I&Ò®îþ{TÑxüy-åóUËrì‹sܯs£8Æc“]õ²*˜ìŽL©/͈ݶËEd^ѳ‰ÍjôµTÙê:øö¼tÖ¯­¬ÿnûŪúáî!Úl¥ç¶“®Ðª¶ ·h,áÑÑ#VõMý*_Û%S~hÙêÒŠF³p8>0*ÁaXÎzºÅã, F@! f{*wn·™F²ˆD™ÈÇb¹4‹ ÞÎx ,š…A³—9UðØa„$òã,vº¥õ_TÞå|G@Í5‚.«ÛZQ~”$Ë»¶ëø¹RH[ ÐpÉS‹àòòÜ¢îQ¶xßÜC°–æÈÜüà[@'åk¡¶ï 0Þá›*îw½SUö h¹ê¢ý”ÂÑ,‹@äZ¨uàæ±À¹P$á88±¡®°L€ñ#>1=fëî3h’ ·!ï–ï:]5äèR”_²í½ÿWÔE]ÆuIšëÊz_,"‰ÀÃ,4ž+ÉŽ@\n™èÁ¾¿}~¼  {ÿA£¥¾n5<ÓPßk¿ç‡üʦvbu¬ï÷jÁ ½Þ¥˜Iøú÷ÁÑBâdçÚËJlƒ\v»öÕ'GÆ°àakoÛB\`œ~j¯fBð¯ÎiuæÅ|¥W¾Úñbó˜ÑþãÇÏÎJÿ–…¹î=ß¾à®y©k´J‡$èÁæª7Ñä_½í:^õ&JÊ´`ÇáÛ4Âè§Wµ$§jü™¥%ØZëJóDkÊÑÊ|š»FˆÀpß¡0>~bò³ÏNa—¨hú`^M6V3!Ðò÷ [å4¬B¦~u\óâÐá‹‹ã…ö[”ê¥Þ¾§|ÿaWÂj}Áx‘““ZFÊþ©•‰BÏYªëÁoXWDXÝö- ´‡ŠŽª»6žjhæ»pÐ …n|ìôØj#£ _ ´Ä_±7¼êwD^=¡=GbÜPÞT>@«‹tÔ¼ºü¤ÓK'…6ÐI³ø×(÷ WQv ¦¦h8½Ð@FÊ3¾8šùVÇ÷rË3‘jõíû9m ’ôHIÙ 8«Þô½— ¿´4|±þX@Ø-%yYØ^×g|üXxAgEãCö4ýîÆ Z%e#Sìö´ˆÏ7å•ëzÎE½Q:–Wbã£bSº8ËÈ3æšÍÞ#:qåh"y%´Œ®]»u¿¼ö­üñp€ììt#+ôŒ_ër ){Të˜Î™· •çxkI¡åÃMÛiÙ„#V3ìW¡e²³öˆO‡¡Îy  +¶[ç-Žæh9ïåuÄ,µ0r_ZðÏ5¾úêAçBÏEf]00ôʺ¤½7£‘ /KÛ)oz}Í7Zm­ÈKäèi—…EËœ›§¶µMsç¯Ú]©J²t¡E¬íÒóç¤ÐÒðáš]ô /O5­Ìûøp:Nú*A¡þ—wJ°Ñ—LüÚ O9V94þÓÇÛ‡P¢ÙÚø͇¯ÇKŽºæŽ¨*T+´áa£¯Å—ëV±mc® EFßp7Ü]׶Mx²’QTlÖ¥óñoÐÒ Ÿ<²G¯jðy‚ûéÅù="cP¦W³¯Yhˆ¡E|äÂ%} ´HzÑœ³n©CÔäÑM‡x²&\Ùø–´ËnÏ9ªæ PÊEósŽ´€À9”Ù~uµ³š§tì¢Ç±" –ï+ËñÖkYÚI•‡_ÞíÔFD4hê[ŸQS=s9 µôhëÑ’Ä­ÆegþÇ…;Õ—54üh¬íPU¶šû“g1Ή‹ÚçP;Q“¼X§xñaMóرa•£&3 ÇjE_2Nâ-´,þ­O“ªH¯2þ…¶ŠIèÝô³Úª-náͺþù©±mË&2³;aw»)7äh,†BÛ¨gN¬„mŽß±í£â×ôÜ÷u0ˆGI˜Ì —ÿ²¢—6˜$gI³]LS' 4irhݧhyëva‡+”œ‹V]½ÿ ´“nº«+¿ž‹[qÔ¹Vl¬uBß%]œˆ0ÐÝ市Jdå#I ÕäïU¾> Î8ˆj’ü ÕäíBšˆ¢›¾Áà,Ïú-DôC³“§ MÌ•5.ÎÿÔÐBF¡ 5mªF¸ðro“ØZÍóñÁÖmÜB_ûºœÏÚüý½­³K,9<¬¼WñŒ‰±–U8š$oèíîC'{Ùo³€¬ôç";Ûý´{b¿¤Éh¬™Ž.=…8óºM*aÕ>kZУã§511Q7 üM/¤û]¡eÿÐISÅ鲟…æam·lÉð­<ÜÙÚ²êáü‹Ðd£,g›=¸×° Å+»¨¦Vå˜Æ­’e¯ýb)Ø34RÎüþ®¯v6 –ESeaÆÚ§´ìâ=cç®™ßïeS(o#´·ÿý*Gù‹Ð¢¸õðe7Ýý?‡BпÃôPÃz3(" ±×é;|ÅЊZ¨Dxãîöx±-µ§EîpƒnßÃät Œ×¨lr>ª°r‚¸ÚX 18îá*§ SÐÃXbXFS²«¾Vã </Œq4«"C"M¡e´!óèõV —ö¼8ãˆTs˜ZDcõÝ=}èëÝ6Е9¾-ó5·Ì“:žÜµ1 ¬¡N6Þ:z³sñ2s¹Ÿ6nÙ¥à¿ÿ«B ÝD]‘õ+==«< a({Ç~ w÷7ÇÓ‘-qW¬/UÑ)ÞÉÃÆ}(lˆ8,ØÈc‰EuäÝS2ŽÄEiçB‹p]iV+¡|ÖÐP>¬1J, xèii”Ò#šh¯Ýuäâ0RЙ—¸KÁòòy×­ßmÏ~e"Æ±Ö–½VØŽ0]ÿ̳šf…IN‹ 3ýӭݘš¬Ø'ÃK›?q÷óFkbÂHÍ–LAÎɹ'.žlÌ?¯¶÷ؾ- íà¼r’2¼P"ÄôcOu…šAš¿µæªÐBÁ=2_÷Úai¢sÏOJqúÛîÄÞ<¦å%=è¼±K™BâëíXg\Ó]Uüé÷v#}Åß}{¨¬—sUùü­¶ö¼xã8PË Ð" ºæ¢¤ }Dè¹÷ÍVÚ.tìÙ]K-×_µe—Ó• ßs ±á[êÚ-@‹òåûxÂÔì×[ܧP´Å ™ ü0Yb¬­¢ã ñäÙQÝføEj‚l?â:ºü ¶K Ýµã¤5`6ª¶% /h;&bˆ³Ä »®L é‹ÙÁÇŸ×$8[ŽœÐôp6¼ÙÍ{ ´`F&¯ÚÙëë™8”ãÉó°¼ ^¹1ÎV¾utêÑbŒÎ€¯E~{¡…Ì}`ö}R qî_@‹xâ~þ·OOãÅq?wéë˜Eš§j¼º­à»m.XÒ/SÝMúêÖ“K†-"ÅÝš-]õÛ¶îäó>Ú¡wu¬þ–ΰ•åú¯¢ö?‹àg‰öŠr™à¤ùDkÒ±0Òrß]3~¤’: Ÿüç=88ƒVx-Ç/ew/›•ƒ£ õ¸!iKG¶ù“‹øí–óœôÝܯ21è„[dœE@Ï]8¡TM^蹨gN,Îø‰<^@Y-µÉF… M†:hÞà¿-Ð>¿1þ–akXŒ¼úËTî/®*!x¯Æ¥¡åîECÛ"ÀÏüræȱÝðýßì›ÀˆðÝY•.I§!pÒñÑ¥’H áÇ5JâH‹¸ –D¥D׌T Hð ³[ãkiSo›½i±øfI¤å¨¼Mkfö÷‰s.¬i™8¯ÛŠ•BKòhÙa‡[€–]cÀ`ðú½Ø~p¢¤¹¬ÌTi¯Þ­Ù¥ð9?Ceß»{êàó+)#¨U_¾,ˆ´V,›æ¨\Íú¯?[³aw-œ3GæÜ3ÞVÜ–=ëÆià¯-þùÉßyBžK*z¶éÁ7Û¯bI¿ -ÂÇÍþ¼e×–MëTìKí6ù/#-rSºç®ß–ÕñŒò:hYèaíëÖ¨µÇë;§-6·;.^ZÕŽš¶µ7lÙ²C"{OÙÉóc-å:îÓb¿ê`x (ÂÆo?ÿòûí…}ìW¡eQ†ÊU Y²ÂÏ™^I’‚Äô@·¡²|a ÇD XÆÊÚà›¸Éó³GkSwó%Ž½$‰´h‡6<\0¤Ç›7\úÚ‹ñÈÚ¶óíòíaùnŸtÔbì¤r8"=m“Aê,Aí¬²X¢Ëñ’¾`ÍçoT0žÅ‰–AËDcÙÇnƒ/AM,FZ”$‘Ò Í00BØîßr·•IBb7}°µc¨íˆ’-¸D­%LÿjNöB-üÅw×jÝ^´v‹3z rÄ:øe¬ô’]ÒÐ’ñ!ÿMÇ#GΫëøÌ-‡•ëù‰Ó¨o6»öBb‹sØúαØ"7•JqŸØuNûJµ$YD_»ŠÉä*¡¼%Ђlð·éZ´‡Â z®YŠ¼qÇÅžª”Åì™…4å†û÷"-‹mÇú¤JÁ„‡“wÊ;kd #ÌÃMÓ<4ø6GZã°~°w½b’‘Äïj18r  6Žå…øÜÎ.îŠv·y_>0ž9âSÇÍkóû@fn,ʈÍn/NŽÚð³Áê±+@ýå]>ª?—ñ8ù]'ÒÊàS(^N|br^Gá=ÿ5»¯LçÉ$! VÊJFøÈÁÚ¯wÛW5tíÚT>ûg=ÆŸøüêñ é­ °Þ¡§„YüßÏ**•ßzMžŸ¬.MÍkö6;r2rL|(ñó‹›×dµƒ'â¶åÜþèsC“Âχg^xºÞ**︨-w4pŒæŒ6ïl»—†xŸMG=jë`-H<ê­´Þ;¡È®gð ¸L·>TÕ6f±™ÔÝ Ø #™Ý˜A‡ëøåõžô–&þí€gcC‹òÖýu¨7#£5äÇý°^¹º# ¡™Ù¢²ÍÿX“ÙÉ„f~´Ñ¶¼f¸±iZÒû¤Úié_Jn„÷MØtÊ€!XC"Öpéh„þ´Ça óÿ³wÖqUeÛoœֱÆÖ±0‘. iQ’”VR‘´Q¥¤»»ãÒuéËí:qÕÑQì æwν€€è̼7áûÍYŸõp/gï½ÖŽïÙ±ö£«¿ Lë¾n«.v4‚»²ÀÚ¤Ðʹ–0s!M߬°Ó›LŠÐ×ppèÔæï"*Päk(H¸[›}mó ½ìW7Žðé¹Æ#†­©‡ásy%æ9mWp((np¾ÊÆ—‡þ¤tß…o}Ó™ ‹»€‘ºÖˆãIÏÄE_šÿdIy…^0Ruþ\~-ý¦ƒ®´{ßth>mi_°Ù#ïnÝ'4„DU¦^÷[¿YŽÅ½.éjr.ê¸W?B¾ÌîªY¿J‘Ä90ú½*@Õü:ÄúÙÙúrVî„ŠàþóDøý3-Ì–¼ |V4öDÁËIè@ìÇrë×8…UfEÆr÷´D¶½¦´7|·â`7¤ðìÐ>±Õ´ŒÍéˆõ³]´ã,x¤ºW84»¯,ñVB%½9ÆŒwmFÐâÅÊm¬1Wh¢ nÙªžßYYÙGaòJWiàNEJGê¥æj<›ØŒ¿ß^™ƒtÎIWÎnà?Ê‚^ßÒÛsÔñ6R-«qÄ•÷ŠßÌn¯¬èê'½ µwÇTß:­Å¯ Á£I×3³«4…¶Ú§ßãÀÏEø$#2Š÷­ÙÐJz›Yæth³QÚôɨ±‚€Wq÷‘ÌdºhÆßg5Eí3¬¨'‰à-u²_Ý>ºñlt/™, †*×;PLíl"¸èJÛ'tt“Ñ5ÁÛgyÖs_»à×az;c;ìäöØÆ ¡Ôb7MÇîG£µ¾¥ C bçïºH_ØÈí½œÕí¾kDϤ—U/3~:y¤< ”6jgÐ3EÄy­VüßFWr¦;è‘õú…—«ïzkËÉšf}ZÀèTárãCãqYÑ¡›6)÷qáäؾ}‰]Ü—q6 »G*»ú)/gB‹ÊŠà8òQ Ž±8|?JǤßËë1Zú§'GkoY¸hFf’ÐÌ=-3¡%'ê¦÷­ê꼬í?*61Ç`ö3™{¥Œ.p¸ á­G 1˜ù *+iÉÂí%ƒtp죂&ˆËf@³,"¼ÌHÌŽÎŽŽÎo¢Œ´U5ÇÅdÇ%Vð€ ~U•RÐKC½@î¥$ÞÎŽŽ)ÄuþŒ¼Èã «c£³ÓšHÈ+›“ˆ>ÑÜvÂó¾–Þô›EíSvpUæ×£§‡ ‘†’š˜èœÜrÊ?÷ôø$cÜ\ÙùLt—;®%6:¯¼éºŸ¿Ÿ„Ø91£•ÅÛˆ¿®NÉç5jð¢2»$&:·¤äÀopù·£³“³;Ç—­¡%)åܸý¿tÔ¶ñžWOžeN$—SBCψÕàª[ßÆ™'¶$çPx]7WÇûf^ ©U¹eˆ³ŠêØïÚD"ÆŽ¡œŒ¶WÖ"5­¸á.’gBGÿxIc«xgð Å5ãsJUå¼O+ÐJû ‡þšSžc Pnçħàx$=ËIÆÑ&,Y‘]W1È;=¿©MÉÅsÂÑèI±HÝ.@“ÀoŠ xÏOí?&há€/ÒsI“o‚õÅ5ˆÅò+Ù0ü2?¿ú§ïeÔÞGÞÖ[«›)\wÐ{( ÑÙ1™L´óG:Ê«c¢³[zžâ¢ƒöž©@z›*ô`Î¥¹-îvNbZ3û]3–É·s¢oã:½%™Ö¶FònÒÔ”B`*“@dRqé¾jÑŠ’ÓÅ‚>´§É|Z1zÛÒ «rq<Æ"0Rrãk(àXENMmyï«J+híþ^hGºj[ãogÇ%TvQÑ)Mr9évvL|E/ù%⩪ìâÛI 2ûôÛ§ow‡@<¯nÇöM¼AS»:¸§‡~éªÇ7Õ *ÀHˆAš@IS÷ã;ðpqrï£Øä}/y¢ù7v?©wSc³o'T÷£—ŽÑÚÛ–•UJâ Íø¸èÜÂ:”Àñ¸vä£Û‰5DúŒYÖ‘Ö‚rs˜kZré]¤'o«jDú¥¬ ¡Ú’Vt¶„ÉÉ*"ÎZÓš*šð\Æ+Ë-åf,§ºç ’m\^ šô줘œ”Ü^îùʱþŠÊ†Î¡‰ºý¬$£øv\ žŠæÚKC¬”˜…§OÔÄËE\/×R$î¼"¡­/.:;5à½|£mù%ô7}µ-Å AÆO‰1<‹å5RFz+z_Âì§Éi=3ö­ÑúéIèHWPÛ~Ÿ×Wçæàǿþ›4aö–¾w¾â òÇûôzÄzè¡­˜ìø”zMûkšëº_ ]}ZF7 žY‘ð•¸ÛÑùµí³¢ÂHc^%“ Ô~VZ|.’ÿªÖ{<ÒÃå”—áf9 Q]ké ëã‚L1ÅÓGh¿Ää|”yëª)548QÐøàwýW_uµ¡uzÓOÿY¢ö¶³±ŠéÿRœ&ýçŸîý‚)¦˜bŠ)¦˜bú·(-˜bŠ)¦˜bŠéÿ3hÁ–‡0ÅÓˆ6äeZ_¯€ßž*¼‘Éüý¾r9åo?’ÿ;”E;edyÊ3îí) `å^ÍþÝEíŒ÷©êÂê¦ÿÿÂøß_ß>k&*¡("¬_õÓôSNÑ\þÍz^DÜÜI1)!a…ó¹x¶Ý}§U·Ë¸5Ù©½Zpù×:‡¡¾bEqq±}[-.bá¾[+(&&c~£éøó9]u!IÁ}Ù­OaÖ;=­•ß®‹ìþçÖ ð—ήM sZŸÁì§gª Hª›^ƒà±†ø IQI åÀxÆŠ? ß­((.%!£nv… '+~·y§„¸˜¼_í‹ITćK‰Jìq k‚ÁG>Ç4Ðä¤ô2›ŸÒ[SeÄPg­[¼<­ÿÕŒn0+ø¤à¦e¦Ü#ÏŒ¾AUQ‰}2ªFç 0F­ŠWݽ’÷ôô’•Ž¨„¼¸¼%®ÿUGY®´˜¸€€¨‰gÎ;»þF/;ßòÃJÞ‘gDwÒV‘Ò÷/ƒá7—íÓ‰‰(^É›¹?ÑV£!!!&,s>{æ䆺ý’RB‚z.I ôꆭ‘¨ˆ¤€˜Zxå£g{ÆÅ#2b"bó¿Z'*&cèÙ˜­½4$s" ôÌÓTGLDfŸ‚NCïóvnˆu“ؾòÀ™ôÿîpzÚª…Û2úýŽ€þê›æ·'ã{ŒQpe¹•w~ý(•¹þkÙî·Û?FRk™¿§~ràŽ9óv JÉjXw½|×qY—ŽGüî ¦QE¿øÚ!…ôë vÊ‹½µõ^PD7ð6r_9y,ò¶z÷%¶¾ùíƒæxpÕî}âŠzÞ-8»áæ!ã0lÔÆ åï‡]Mp?öÅ™uÎþµ8-cäÆÚ¹|g¾¼Àc=yÞ/˜©ñ µ8do¢¯†@Ëx›eB*Ë×6‡qÎòg;¨ÔgSC[Ô_2“·_ꨥô†–ɽˆM-óÈ%|dz Îp¾xmäð^áøÎ7ìþïÖX¦Ÿ¤¨‰ÜáOƒáaM¥ ÆÿZ.‹NÉyow÷D„ß°g"€Iã;IÃŒ‰–¨¼[– ~("ncæu>/’œË…RúGŸ-©ä€ÔÒžpMëKu_xvTB¹øPp¹;Í`"•úâÂæhmXÛNz3˜ã'®5³—Ô’pŒ‡Ø¤¥ëŒûg‹g‚´f3ÕŽ‰äzó¾ÞÂü8=ìá ,è•£¦ð‚ù_ i‘Y£¾Æ óæ|6wÁÂ|.h8ÏëØ× ®Ù«_;ø+¡Šú‹’W©Dí:φéÈ[®j¾nÉâ£î9èÕe‘ï…„„—®Lê@[ëTha5¥/˜?ÿ_ÛBxïí®±ôöù —™ÇÁàSCéí æ«dy› žP˜ó9’±/ì ¢Ã¿Ürš7gîíò;ܨªC>ZB_ÌûÖȧ˜ ß”_/#§øõw®5ÎD²0G]‡ŠwàÇrüê­¬áꋦ‹¿þråöC„7îâ¢ùs?ýl΂ï6Tö>ëË‹å[¹háW믃Ê1hù‹gZF ®ynÛ#²EàXY×óBË°·…êÎÝ¢‘Õf¾æ·5)ö—ûs¡e´-ÌàRÊ`€ÅIhÁçÆ®>”͆Çð™™ÎçÂœõådìÞàõ>ªèžyƒ–©ê¥­à™u§;ÿÜ¡Ð [sß›>zgë_9Iï=“Hí.MžÿÙ¶†é¡lØ$–‘ȶ={øuœS@x¤üœó9ÿ«‡dDŽGÌÛ–Ýš(o9ùwÞà€KÚx€\¸—„u% Z*d&±c÷þCö±ûyÞIháÛ¥öª÷3_†áSqLŸ`ÇÉk¸ÎHZL•·I…^öTñ&ƒ£MiW÷ìÚ&p0£eÆÄ_ŒÄEÜCcŸJÝþýî*Ò̈¸=Ñ&{vò;óvb'ã¢fþ_€pWS”_æ }T!‚i¸å%ëØÌI©yó¢žþ—ÐÂaÝ—_-T‰+PÕðàBËf‡ýÌžŽïêgÀ*{•ñŒáîsû+uïδt\Õ3‡–WJbÚ%øGtò*ë ›ü ð ƒÄ<Ù¼;ÓòZKÕŠ -#^Š^é Bcí7«M˜÷ïÇÓßÔìw»Õ;+´]UkVÊY#}?1èOóÝ„£Êáé3-c”€JÙžpFÉ2çÃeO 8åW÷³ÚùòÁaZHÇÑWgôµ³_\ùÎ?™Jo¯Ü𣠛1ÓÂìîZÄÊ…–á Ñ étÚãþ¾Ÿ9ðH_ßýI¸\ áÅ»3-ŽÛb¹ÐÒ’¹Ó©†By`¯¥TJC eµÇm©®à[Á°sPãÐÂùÅx¿XxÛkZ›B{ϼ,¬ÉÔ™é~?ñ m€±]ĉ`C9-)´ÀtŠ¶¤|M'Ë{þ‡gZ¨Ä»e á+¥ƒ¨Óor‰:­¦`êao ûã^µ¸Ò®•_®5³ó”åߤv*”Š†o¹bsèFÇÔ—‘W»µ±Ðè¬9lÍÎåMŽž´ 69ocî]€Ø¤·8à@0.1¶"æÜQŸ–afW‡ç)W'ßU_‰´Ð§AKmRÈÞ“…D}Uõ¢‰ðòÄŠ”ï·¹¾»|Cjk”‘2¨å.p 7ù&g3'\0ìxX#¡{vLBKsV8¿MvGÉT]-pä#d©N·>á|ÙÏD÷L*wv¦­j˜Ý4ûâþ$´œ7UÖO@C£Ý—ÞÉ6äßžYÃ*ºæ,g1ã_L$…ýSšnÄ7m[¼·†<3"Ìø¹׬­|¨•ǯ6!TË8ˆõ‘½Š¾Z¸3¢C•y%§4v…² B«¼È1J¥¿EpíøúßA µ£å»åÒ¶§œvñí'‚´ð>à0Ø;>[ÝDµÕÌ$oøØCn‚øž¤ªk♥áçåZ9:z®\¸“ý^hA*¹önáÔî70õãÂ]Í䟌TôÎ1þ°chˬÐÂî,[µJLeêk±´ó´Pý1¤9 Z€Gþúª†gNÈK‹üPÙ¡gvÒ›MOy(ÿ¸Ä3Ñ‘¿áô Œb†¡wÝ“Ë"KnWÁT"ÿ’½½ŒÑ÷B üÂ_xyu÷ó‰e#¢úcÖöžGdw¥õ~ZÊ£O›ç=à~A'¤ýåMù ×K²;k¾þÑþh1‹jb¤¤kêzò¸úN…@x:´†žSÔ²vr=ºÿÚßÆŸ¾&7ænݤI ?ƒá1 á.yð^ð!>ÏÛƒÌAªþžã+Ø4êóñøx帢šñm*lÆó›.‡Ü«²€‘,?[y¯:õÁ~¥²®>‘Ûê{wå‡È»ðìäZÞ’h”™‚Ipç@cÝŠ=§ÑË(á×5É9Dt(aïö<" €&ŠÒŴѾÊtYu×NÒSúÄ°'´\H ШOi´ç0𸭦RW†éŸŠëEFü+†’§%—$Ö¢¼$ä»j:Å1¯þÃÏDw£›ÍHÏpÑVç|ãó0•Í–—›[j¿þö`VÚ!‹xÒxã¨MÊH„ú$­ÀÖøÓgZÄw>¤S~¦²†Ýt´Â[_²I”Í¡ÐBcoùZ¸‰òfbžðíL‹§â^¯4¡±æëUÆÌûFªúï…–9K ;\9»M3–Ù}Ô9 žÝ<¼†-9Áž@ÐLìÞ¨DfVšKér¡~™ŸRMyçjN §TVÆ )xS–Ÿ–]L{nÜÁPùÑIí™t¦åldOmÞªèLËÆ€ŠÈ!ë5Ìí§Î´dÚŠžOë§Óž ôýLÇ™„ÔÃìGçT¶ñ åš£þö—ËîSfZò"v:U£3-‡K¨Ã7å7^/{´èØÜïoï×ï"’w+ÐEÁÝ<³]ž --±jº@hé¨44¢Û^1z{׬=‚A -Çòë—sç-ݪ^ÒõbúkãÝÝ«}úÉ'ŸÏYäÓøâ’¹æ· æ~³B0µãÚ ƒLÖ|›Üò6z*³ú¼ÚÄF\ôíuby¨*ÀTÁ¦”÷ÇD_›¯æÌó_Rõƒ¼ë“>gîܹóöÝæ°‹mZ†$÷ÙœoÝ^ýCkƒ´sÂ& ÆqÈbÌɃ_Íùæ¨G ‡3FȾ´â˹Ëvî¤p¯ÂZ¬ùòvÝ=î)¦žÐºùs¿ÔtJ†€!Ùí æÎ]#dŒGÞÝзBŽÆšk¸¯ÿWíuþýÉgÈóç.Ri£Ð÷L$'yôÖx,ßNÚüBëd~JBÝ æ­­DºÊÍùüÓO?Ÿ#gPÁãâ?Οû…ŠÝmèo‘U¿šóù¿ÿýÉܹÛë)o®˜KÍ÷…šK!+¸qæ_ÿæ–ôáZúå[†òj¶ã»§N¨mÿüS¤²Í7¾Õ38örÛæÎ]p*¢aõ–´ËK¿\¸ht*ï>6]xµT ›73ÉÔ\÷å¢í9í¹.²Y3/¼ ¡æ¼[«¾ž;gþ‹ `HuÙ·Ÿ~†XvÞ÷[]èÐÇ -Ÿ}ŽzÿËå›; ÔÛ#l’¶ë¡¢ ŠK üä ^îÖêë‡æÍùô“O?ߥèøŸ¥{Iys9wkhsâÕÕ:eWUø„%$.ÞÕö’pïÝ·ö‹%ü¼=-óÁÁËç­Õ#°‡l×/˜÷ù§Ÿ}>oÝ®cˆ[+3øW÷Å¢íEø¡þ’¤-Ë­ã?¶n«.-H{ÉvTúrÞ|æÁæ’¥_,øôÓÏæÍ_r¾õ 8Ø­°uÅWßoOnÊ? -ŸÍ™3_DÛ— ôK[¥=߯混åAË`Sõª…óçmu¦€o²Ïé,^òƒ¶Î~Y´L‘ òïF«9o¬êPÍÝfWaŸY]nÜç_Ï?|6›»§e‰„ðÞ/—íLìäî@ƒG’=ŽÌ·0ªÊ>ï0Þ¼}òùüù?¦õ ƒ´{Æû¶Í·ØÄ¿!Ì#B—n74áA ¾0yéüyówÒÙ úŠs?û÷œ¹ó÷Ÿ¸³;¸wáܯ Îq÷´|Z4?3ïûÍré¸ûx¸*Ðxé’j‡÷p¡…>²‘Ù4ï›õ=Ïú b6-]¼IPgå&= Z0hÁŽÛWx´0ØÇ?7±Hýs€cÑàDh°Ð·ÐGÕ*½ñnOn:÷g ¯äž;œ7Yn¼¬³ºß€ô{ö&è¯V§Ã8ð?õôg¬»<Ëöø‰ ÔnîјWq} ì®gïÀc­ù96¦–¦¶—ñÔ™v ú½ ÏsFúnÍÔQÞA†p}£Sѵè~ÑŠ¤˜ãú'NùdRÙ3O鲈4'Sk;÷$ò;§Úr2-MN[ú5¾¼=K ¹¤¯Â-¸‚~<« c-<›ØâéÜ d H};á|¹‚¡!¯žq60pH©Þýß²ÄhÔ&~Y4öhoA¯Zz$tÎ4,óÞWÄ’72Iø—¶¢[3+c› íä×0eÐv¼n[„Ä·Ïð#³½ÆÕú¤k@&ï/U©qHrv^idÖèßh±H‡ñ #zæjI ¾` oíÞ A½N ·t¹I ÿñ'˜ý4s#ôùv>±½ÄÐÕ“v#0 o5‘«È<"oý(ÿ’û…Øæ;œ‘J¯ñ$†ãî7Ÿ°nÞc]6uÉ)%,¢‰9áV2ÅÅ!ú÷‡Çÿ¥*ñ’˜uh}×cîªÖËpLjœAžÇimŽ'lL­ºÙcažçˆaÖ·•SM÷sR[ïY3Yï\ê,û¢Iƒgm웺D—=ø½‘“[rÒl]¢@hŒÝÛååàbas…ŽÁT’Ý„1cšï@oÊn×·‹)dpÀçþ6¼ŒÍo ™ÜÖáda©oîÝAzs®KŠ8n`áÑ8¾zütÎʹœ4zºàì¤o`ßP‚_ç…‡ ½Á… <ËiŠ‰'ëÝ ¿±9t?k\èMUìMS£vqĉ/àˊ̬Ð_ç3†F¾D´ûz“vf|ÔÈíy怾ŽúFŽ‘yT¤7hJK´0>aj{©ƒ†ö}õ8¤7p¹\‰ôd|ßi+kýã®™Õ0÷˜d·“…­©u@íàðèqˆ›«¾­oD{úÁÕÚŒÔкñEÌü¨«õè~þ7¤_멽ƒg¬‘ä\Æ;à¾ÿ)‹“W è¾å±âØ›†úÖ7ÚÞ©#¥—Î4ö?ÿÝí ñò-®— 3zÈú°€É&¯2•Î|póœ»þ ߈&ZW·©C6 â¶Ä3þLpZ×ÔYT`erÂÐÌ«¶÷)’çZ8ÔþýÛÅ«;9ÇD#‰Ó»ëÇ7nf«‰ˆóÂø7dWVô§†x|§’ñnè foÛÑÃRŠ§‡2|OîØ)ˆžž´·ÐZšzíö,+h}Œ t–²/mi¡õŸÝἺ µ>§‚ØÚ °FÙDŸZPC ­÷Ÿ -EiñúÚ^è!—A\⮣WZš:õd¤ú±Äèä<|JЙ¥ªÉ3\¡ËW³7äÂ.qÛ¯ë[[Ó]Òò„≋­mg]TYz­5½J¿9¸Ù/¹+ÔRýOÛÌ.±°6¿¬/7òòrÅ(& ò‰®ªë³ÛàMþh e4!8*9ŸèºT-…YÈKÄ”“]å~ôK¦—EœÛiÓÞP¯¤xœ8£“aQÅDu›œWYv½˜Ýê.bS2Q-§}“Mì¹UZYT$·uWs$åZlb^gÆ5ÏÊ·™À‹N¤n7SüÕvy%2fø‘Z—ì"$ïÌMŽ.-r°º¬¶ør&õïÜPg4Õµ¬Ùí„k¡u tº”_ÞwÙBSÔÿÀt¶‹®ìÒ%h‰˜øΫWÂ}¾Ï@*ÀKß}[‹kÉ­-LäŒÒÓUYY'µCœŽ6äT"ƒTZ¨×"å4¤70Ý/[Nr‘^>ÑVYy-©©2;_È€>óØ9ß'¾§ä†çjé0x˜Ž««jÒÛò]fã髾î#qŽÐœ]Ѐ¿ï¥£ÔÊz“ž”•ÐÄë~{+pÙùÍ1Ñy-Ä™Ç]ñ¸ÚЄ¦ÊœAÃDèMšéNó€’” §¶—±ëÄeLëÛ(Îâ‹j~šÁu·TWç´<šDŽæ®¸è¬¬ õU7e´ÄDå6 ̤bcå·\/+¢^žþöD€Z[m7Õ‘Û:ïgºˆÚ¤´¶¢b›XäÁ]ßlm§ ³ñ¥{ùõÁéÀÖ^Ö˜[Ú[’tcÍþ+txthyù…–ÇC´pþÊ8-Ý¥¢¢F0<Úk¢hñcÒ†òoxn4­±ÏŸÃþÙI”¿&Û‡{äy "ã ¼r§FÄe´V.Y{‚Žá‚]çÍÿrÞw[ã*a-B çÏ_°]Å£—‰@ uãâ/çµÂüR=üÏ….–»ép¡¥;ÛM/Ïß\5¼Ö3^mH5‹Äo1ÞáF4¬¼Së¾ôâÕä„—m”JnÁR4¨î¼¤W¦áLï÷ˆK·â )uÑB2ïecчª·ä¡{²-%N^ëûØ,Fl¨üV<’N¨—5cÓžP µ]SÒΛڔ>å@oN(% Lï ‡šŠ†5]€§ôêôúŸ®yp«å–èRpÖÁš==+·§1>ŠQÚ›—K\å¹b>äßq¤9KZŸÐ=:¢¤[ÕùJ/‹¯º÷‘yæ?«~37£er7ì=YG¸WW͸™9FnIÞc_49‚ë 1Ò³¯œ 0;´¯úþF›Á|Æð‡iîSN(>¶98—Þ°NÆ»&=hñb嚪Ü òtñve ÕÓ¸ž–Æǧ˛û7®àBËø<ùS‘ÝÚ-Œ±Ê8å8˜N{yÞB5¼g„7‹uÅJ-“4Jd•E×-Û$íÔMŽt·>loñý¢'ÃcÒð¸c뜎(¡Ð‚<x1ÐÑ¡Á· Ïhijj³hÝù,ÚŒDð¹ëîµ·cTÇ£CFcÔ.1£2\ÿyÇp*øÆæ vmcýê-Æô7¾:›'Kd==©1Âg—~1’z”Ñ…”âµKÇKû—χotÔØuÀ§b9Ðã“râ½Ðø U~n£I50X%.oÉí tÜ2&¾ùó!i]B›|ã» ¯y YU#>‚—|ÿáK‹;¦ä(ˆÚ¬ž|xã2‹ËÙvÊjL.Wh˜òÀ ÉXZÒðf?®h¹Jrw†÷dqV){@ãÉ=Ô•>ÔÏ| ýíÒ̶!r{í‹ûëo*[„ÁðHë%AÛÈö@ ļÃ/x4»²ÇIS8¯ïEºµª°v©­f­rtOî¥Éä~s(C¼ !^¾0éåiúÒsßö^&ú÷D+yßV*í7¤Ïë(•e™ o¸IÚÔw\–˜|æÇz˜3Æf 5fßخϞuyh ´À û¯[‚ž›«lß-¬ ®¨dzõÃÐR–™î`pðÀùžÐRpýœkÎ]:7N ̸£µs_mÿËóS %óò©cIhÄQ€:D ð];…,û1Zß e(ÝMGÕ¾\„‡¤~ºµ,ƒ–\îü K~×Î;Å%¥¥½šÞpƒç€Vò’ùO9œ÷B Ì€w1/4—Ñ[™¾r£…õÈ@YÝóÒ-][rš¦U$ˆˆß¾Œ?ÌHÖ?(PDÒò]h©ÉÍ:c®­âãyœ¯;ÐÇý¨Ì3Ky©‚®g`WŽ„‚Y°–HnŠ§†},±·cõ¦];$ùwŠ_ïœþ>>ÒSÒðBl²{knóC€ö˜[-»ù…Ízg›¾ÎºätÀ¥˜¹ 1¯Ý~‘ÌÖ!ž H5áj¾5ðl{ -à‰ÚKš;6¤ÖÝÿX …yG`Þ…½o&¡ElÕ²Ý{6¬Ø”€ûãÉ ^ {)†ÒRÍŒVŠÙíOS¦@KCj€z±df°»{þ]Få9.´ŒÑû`2y¨0Äe§Vü;AÆX”ûÕù9{¶l¹Vöp´l7Î9£×ìÔª™¿-Û\týLu‚š_õÆšî=ìV6ëQS e4ÇS5¥íQŒåÇŒŸ•Rþ wÞBË&a)¥­ò~“wxÍ -Hþ}”kþþjû$µ|;˜M7V,Y³gðîíë•ÏW^±Ów«zÎáŒ(Ié¶1^SHCd®R(ÏèM1–ÕÌ΢÷A ­1RÍ« FƒÛ¥÷©òñ¶9ìßôš»2Ò,/y UÁ¶Øu{ ºˆë®(ÛÝhºzRMĵŽB~pPJ± ‹~_©ôÚyZXøŽ`¡òÝÔ7¶ÊüÇ;)Œ?*7ЦõÀ e ŸÎÒWÔá‘4½Ýî±´ÉÙRvÝËWǵ dÓŸÇKô˜É]¶†(ýZ*Fäa #ÕÌ+‹ÙÛ8´ŒRûïR)CÉ.š‡\ÊxONö²<êUÉ™¤ ©t±ð™’Ê–ZâùéšÜK=2ÔXÙù&ú˜ë(¯gäj¢{àlR©X½}W.\Ø°·®oZ°2_±}›þõp37O•ãœ™Ð"çœDêò-ƒÌWoDCïuâÀc7¬4íB[aæ]o×_p¶2>¾q±X?푵ªÄŽ]"jG•MÃ?-Ô %«¶ õa놵ºiwÒ­Õmb mØa?ÀššÜ‹’p[Ãô^•CÞ>¶ã^~´€´YÑ‘&‡Õĵ/Ñ¡±"oÛ˜î æzÁ/aö³ Q™è½cÙ^6ºJÎEà¯C À Qþº¸ð(4Ôftìô¯„ñGkZo÷ü/ô¡ s£ ò#B+[qL€‰‰‘¦ÈÚí27KH¦vȯ"ÛÖÊšúRX£w€û¦òò=ÓÆ‚W»´Ú&=»ã\ö‹šôZ¾H>ƒ–ÜÉÅJ:ýÉeC™<ê‡ý଱ÑÅ æÄÛ ×àèÌ™àáÁ¥_¦·¾z7,ßßß¿ßì:º4ibr ¥¯Iäè 0‹­¼z];é ©0XDíoQ•J~2u'Hf­\®ÚÉú¥W)'mÔ4ð⣲‡}ßÍØèRj­KVòÈë‹Ñ7ò.âÚä5ñÄLY­’>Æë'é ´Eƒñû-n¢{`ÒMÃ'×Å^Iðlar‡Bê“5Ì›\ª¸é£gÁ» ÃþÙËì¸_}ü:!ðéy¹Ò&ç¯F(ägð;ÐâSd ƒèùf†AµKp9èé©- ¢ÊîMBË>Éí}?ÍzWæ§oÎ’,!?sspBz ¡ ÂÚöH D¸î´ÜŽZ:¹‘á‡ö'‚ëwÉß®_°È¿±QÜoúEWc¸¼\cSmAѵ¤é›…&ö´Œ]?¥V5-Ù”©Ð¢; -kL›‘'{äÝ6ÒÕØuÁFW̱z?´p˜ÎÆúF¶Çµdõ¢è]Õ›5nNÞæ£',Ùò0ÈHÊ+ €?-U¥·iÝùþæ5óë“õ'ÌÁèdÑçõ~Ñ# í]F†–†\5wºB*»‚˜èøQµo¿Ýät3 zvYn)oé¡!=XÀæŒxSÈ ¡Ÿøš©Ÿ­G‹@®—TwEÊH/:ix©"áÜ õè{È£ÌånãMMÐn|φÕÊv! c9g%Ãêïû•wÈ~Èa?‘Ü R2ý®²„]JFÈ?J‹Éæ“Gò,„oN^ÇðÆJE.¾ h£¨C7}8=ä¬áD‰n”=„ þ½$nž™5·ÐÒéj}1¥K •3 Z&FÏh[“x¤Ó+¾zÆÐ9aê=Jì¾Þ…_©õ:e¥ ‘Þ 7J×į”¾Hõ6·¼PÉF: ´gîÒŠa »zýJ%ò8éÕ_÷Ëž¶öÍaÐd¯R #œÐ; pÐ÷ÎLh‘?z$ÑVl¶ï¨ÍŸtM@ ¾Ìö7·ð+fA¿p€Çº«%5>¥7/YÃ{ Ð)+Ýöú§?-t\ð‘ Õ“õ!ÝZÓ)1 ޸æW:™œ•O*.#DÀ€xÙsÂËɶcª¨Ô7 P¨Âz·ôµO ±Áì “qŒß­3n[¯ÜÂü¨ e$ïZÀyÿK{vH¦¶>ŸþfôüöX©í[Ž{ÅÔ^ù9œu÷¹fwìànãÖK(S÷çý1ñjˆ«×UgCeùSY a«ïpþB¨Œ€p@ÞO”¶ü“N—=¬v‹ÿàå¡þúò‹'•Ô¬n§µAŒGžn6FJ'!x쪡¤ ê© À¨ °:´‘N‰ˆ 3„ÞÚöÃzkŸø&êpSàQ5£s–ú’–Å “®(¢ä¥³w}d9ˆV¼âä9«Èh3)ð:xäÔU¹³©Ü;+ÙtÑÕ’ÍÜ(—ÁÞnÞWLŽì9–Ìdê[Ö8D!©çW±?ž=-¡zâBj6¾h¢b桸cO|í#fÁÖ%Øù¸º¼yoôy—EWUò Œ:ºwCt”z=ÔÅëªËqÕý¶Üh!ð+‘®¡0ÃêoX±RÒëbTPpR7s4ÜL~·‚7¹cè­5KVh&‡KÖÀºÕGºÞ°ØtÆdýVùаBƒ¡*&ïslïêë3vÊýУãnŠí7 ¸vÊö* @—‡˜ZºÝÕé'O‡¸Û™(ØO¾¸MδkÒ6í±œÊKLîL ‡uÏú¨O@¨ú>ñ“ ðô ÆáЀÀÒöÇ܈ûZ"N›õÊH/Ñ-4šÚÖÝ7ãË:zŸ!ÐòÅû.É(ÙÁ‘šó.çCSΚè ¡qÞ-äêäõîè&FIUü uç!­êÀæF†9&«˜=~çã«Sì}#tù×G—ÂĪ\¾šW/Š):OîãÍ´€]9v'ü<<…¶Š5^öd‹H›„xìÑ¥NÛl3’ê,s›;æ†yÊ3îYí k‰Nv·Ðå!tOËpÑi‹ UÓ&'Á!Ç] µ¬Î#-+2±›÷F€`o¦$Q¯øžûòÓ<.¦vRm œQCjPPá}RKÉw?Èz£Í3µŸ=ìïxÖÝûªÞ¡ÝÇóYðpÀqs¯›ò|»ë†p)Wæ®Ò¸šKd?»¨¼CïT¨‡Å1QFO©­­ÿ9?áõ|­¦¯DŸÍF_“á/-pôŸ|Ý9 ríÌxÁb¡÷1±0Q› g½â}Ä䮀»€ûÄGY¼¨S_¹ÿøŠëÄů'ÈõÔ÷²§ñm*ˆ—¹cu1ÏY¯Y\gqÏ L>ÿŒ|4Ð2Ó&04Œä“5^£¢MäŸWýد'2?Í&“Õrü›ðÈâÚœ»‘9aXýû´ä:Ïb ¿­®hŠ¯Ç ½™øæ+nÓ\ðwÎM!íš5<1l¤D/Ùì´²!ÙûóÒ…Þ6ð·¼y½8ÌbOë‚Àðd/ñ¶ŠþÖbŽ¢}×Ñð¸GкÁäù ñZðHfš“Ã÷ø’'*öÒÑ*Ä|=ëκ·3-“æVB$Ÿèó¹æþ…Û ÑÊ›¦˜Z¸c²•qxv˜ü•WvækU9ƒY¡í3Ñú†&=µ–¢ |²ZŽ—tÂ쨗_OZ’—¯Z"Ê­ /€)âuãHBh‚Ö“aÞ7¹NAŠ6c¥m <»M؇7pŒW0äi¼®žÍæL·{¢{™lPœñÖÄ-ÎÛÒÌ)£Æô‚Ϥ¦ö08ѯx&â9‹kçÑ©¥›9>²¸O®ctbz;&‚à7Ÿ3+çôäxýêˉÎa¼Ñ³Œthrãvàö0ð†[Ñ<##)7¹±YÚ /¿3ʃÜ*:nnap„3Þ×½šµK‡¸I£Ê” º3 åÙ³§‡Ý¿w‹Ó‚)¦˜bú×hsòM~úo¤5J/%>.¿sà÷J¥õÒãâ ZÏþ³ØoØŽ]ñƒéG§åéSÞòГ¡ñå!:u´@àÏÈo˜bŠ)¦˜bŠ)¦‹vãÇ¡‚€ hyô]‚úz¦BËÇ?ÿ‚ &˜`‚ &˜`ò7É@ -w9peiѳ'OPhy<ôóýŸ`ÀUW`Ђ &˜`‚ &˜|lÐrïÎ\u ·Ð)䆺jä´`‚ &˜`‚ &´<~ôhèÑCƒF§RØLÆ“Ç>¸A &˜`‚ &˜`òBËË/¦*-˜`‚ &˜`‚ÉÇ -/ž?òø1O‘Ÿ1hÁL0ÁL>Nhyöôi[[[QQQ__ßógÏ0hÁL0ÁL>BhypÿþË/ž>yB ž?Žüüà§{´`‚ &˜`‚ &´ütﱿï—UxŠü °˜´`‚ &˜`‚ &´ =zØÕуà$´p`ˆ…ž!z -=]„þL1ÅSL1ÅÓ¿E[›ë Aôñ£‡t*¹¿§‹Ð×C€AàñУ©Ð‚)¦˜bú‡(Ò· úÓ½;Ïž=Ù¬'Oc6ÁSLÿÅ SL1ýcuèÑCZØLú«W¯z»:tÁl‚)¦˜bЂ)¦˜bЂ)¦˜þ¡[JÃSL1ÅSL?ZýÕÓC÷î݃1ÁL0ÁLþVA(åc†€A¡1ÁßñD'Ø ô‘˜XúK²Ã¦S)̦ä¿ÓNt*@³Q¨4ÂÚ%&˜`‚ &¿ Zž={6+´PÛŠvŒËÞK8úÇ%$5þó%³~xF[#©ÁÖhÞfj;öˆ¸ç cZMŠšÄî¢j¸~æ´©ž»Uv3Þ—ZrЩ<ê_g^Zg©še*ë¿…!vUø)Á=;9‡è¯TW}ùüâEƒ3žZàm¬}£ã}I1›BÜ‚’ÿDì`‘Ž*ïdý‡•à´¾j+õŸ‹þ±Ì~k˜˜`‚ &˜ühÑÑÑÉÊÊ™-䆴O–5â»»»{¨è0̸r=6ú²ûI'Ï3ãf€­½_x.€2býÜœâ3n¹x^#°!¹3àÌ)GÀVò,ƒQQ¤÷ác™-³ÍàåŽy3 tàN·³ð‹kko­ë¢AÀ€žšjRiC[c5‰Ì„–_{º»9œ½ÐBÙ=i1ÅMÈŸ‰ÅWŠ{B}„7°°±ñNcB0¥§ÞÃÁÆÙûZ €@VQôÅ“66"3ßÍHgUº£­Wh€zkr½n%¸ž´‹È«Ÿž4#Öó ¯Œ ›êï>ЙgccsòB1›KôÞf·ð¢KîNgÎGÐîhoWôauß\'ïRÓÜÞØŠAf‚ÑVÇÔ¶¶æÆú»Ð²ïdmz]7Hmó÷º‚øfõ„‡“[mtE·‹(Ø8z“@ÈqAžö§‹»P€ëiÈw²±A,ÖNy×A`Nä%[ÛS¡ÉuHž§z¹£0Ñ+ôºãÉ“i5xŽ?ke¶ìëUV6Á sàr\9C YÁ­T„EX Wƒ³Â}mm«»è$|û)ßë=tè©Áî§ÜÎÓTâB Üi£îœ5LL0ÁL~ ´èëë[[[›››ƒ 8Z¾WOËÈÈ.¥¡+6d‘µkΧ7âëÈ ZzBrk{“·Â÷±½ÎÇdCÃn¶uÓ’»XÕ磼)$³¦è–ƒŒÎ…©3ºòÍ-Üj"µgƒvKÀQŸîdQqÕuŽ‚’Þ™ìÞXq!1E Á½âZµ½´Ðâ¾å3ÓÀôôK¦‚Ú! »M\Û“‚én²1MƒÈçá®ZIdÞÁAI ¾²-;Ðà¨c½«ò»zuE…ïä£GKR"½¶á¬ÜŠ iM¸¯Å{,)Š †ƒà´)‘äC+#Ëûz::è„æÍŠiL®OþB ˆÉÅ‹A\Ƽo¶§âzÚ[[;ò¶+ØV5Õ;éÈg?´þ•zÙl¿‰¨À^]§P£[hÁRU¹½BÒù]3–‚ ¼ ׊˜t´îÐi§“ÎÈln 0ú³Ý‡ ¦®q3:>þLG]ÛÍ•Ék6éw3™§5…“êñ¸¼„fâ hÙvÒGN×·4ÜK`‚Ì ®—}/÷]<±^Ò‘Áì‘‘1èdB“ °v_3wÞ‹Mm3 `(Å]:·ŸÃ4ãíß[ß('÷Öã{:m”D“ªÚ3/5tï( [¡èUUpcó ´°ºâ¤åÌ°†‰ &˜`‚Éo„333{{ûÉu¢Ihù×âCEEeµ .´ìS:5ñ¶^>!?çÓO?ýä“€ŒzWs½êæ¢UqévªÎ·S–ýë_Ÿ¢òÉ‚3R·> ‘ÙË®{´Ð Ž[„ /Ýs@|éW×Ë Ì®¼E_It5o”2a‚1UÃ"4{´xìú¦ OˆÅb{”@4–”HhiTݺ—À¦B ¿ø_ÿæel‹†›Ò¹÷›"ªFÉ•=3²tGËq†`ˆ^ådà‡‹9'p®„ACMÓVC rÎ1¯[qª›wâ’ÔCËÛÌ€–Ejq¼¥¢Æ¸cŸ}ò ×`s ó?´^Iíî‹koÙúù§© $zkºõ(4ZŒ4CZ 6‘ŽhcâRœ-Ó;üt•ªi3 å ÿÊO¸%ÿ÷¿¾)èeÞ°—^Ì'ëu«dæ2ĺµï»°‚ÞIã^¶äyùßþõE­TBZ‘ÿ°V¾ÕÆú0´˜Ë+Q¸guD-š0ûö£§óBtÜkHï9h+ò $í“8„5LL0ÁL~ ´wwwŽŽ¾»<ôé*+òÛYòþƒ®¼½#@çu So¨uÛ‚@Ëi ýÚ–’Õš ö\’ …—óuQgߥuåâÅ‹ŽÇöÈ™Ÿiœ¹À‡ôˆEO€j²yId…ÝW²üK®þÂ}êVÈ)yúÆA3gZv|‘ÛLbá‚ÔrÓ@ANMÀ4™7Â#ÐOä~q°Hb0eÓ'È$7ÕækïW ͺIÙ²ê– ¦h[¦ãb¼…|†1Ô<8Z`ˆ’䘌þ1Õ“ÇnTvÁ3¡%sÅÑTîÈ ·çº¼Z9•Øt 4ËÔ§DB:‘?;iËD¶÷^üyV+‰OÛ°V‘Ìž-†²®%È ‹eô±é½ÕëDld4¬¹¶gÔ¸ºÞà}ÓT\ ¼áí °ºÛpµ¶xÅ·N/c¸Ö/©žô² ê庳[üÓh9!rª„àcRRé}Z¤š¼²´‰…²a ÊR-–ªj¼ô€\)‘ƒ“•¨4ÒöD†™–JÒã3-mûl°†‰ &˜`‚Éo–—/_κ÷ÐÑp:ZG||Ï[6Z\sû‹.«9neaìä=kÞ7ÓƒrZ§)hŠ >ÉYA刑¶Š†{bû˜¨62WØ»;×?Z¶ÍQÖ5Õ= ow½Á!Z½øÒáfÛŒ”„øö!Ï’r­¦˜&™;|w–ÇŠñmWµ¼BB,Ò\í⺔R÷®!¢ýOï¸Æ=ŠÅ"Ô›«ˆòíOàîžMÀ{ñr"³6鲬ðN~©ƒ•½3÷T´þ3G¥·ïH¨X$£}"<3ð‹˜Ï¨¬þs-ù|Š ÜãdˆÝ öž+­nŸu€h½Û„m Lí®=¼oŸ€\r#PjìÓ~Õçi!ÖH6D·’Þý”ÕcéúªX}NyŽœ®ý,~(SS²§ýN€jˆð¯*Jçþ˜÷ˆ$úýíZò0ÊwdI î×´¦±g)¥ñŠí4 #Å]g7Ÿ _|5×|ÝæÊâÂrzï´ŒŽ’X9á|{öE·¡_$5hŠóï;xªçôôŽl}Õ}üÂG¸ZrCöòñ‰«Y6ÿÓfÒü¶ÏÏoûýÛþ!°%ÙO‚‡¬¾+·Î‚l'ô°±ÁLþhÑÑÑÉÌÌ|7ŒgÞõ/”";Ñ(þ} ÉÏÁ~ëêµÚæV.!•Ð£¦©êíxòÜ-2 B¾Ü›þÖV6IhÏCî9w=+ÄËÙÉë ‹Ù>,ÂÏõ¤×ÕT'OIö´±sÌo'$œ³É‘/æ®6±´Š/šÁƒØ—îp@Æ"¡oywûÚlÖWwàé¬mÓ IûôÜZð]5¥&òMVrèÅœ›>6V§Ê:hmຳ•­SFoØÈdêlcHìkwXYØÐNc½597ãílnåâ@FßY+˵KÖèXXùܪE Ô^šädgíšÊà"ENØ©Y¡¥³ÐWâä­î®†¤ÚYi ±kI¼ß6Û\î+/H'“Ø š€Ú—’ž½wí®d†ØEþ¶J|«D4MÎøÆs J¿ÉL¸“½gè.1ã>õ’öî ”²ö–ÆNÂ,¨‰p•ñ¬B'"€~#Ѽf|¨ÞN—[UE7¾ÝçÙÚR~@VÏ œB§Ré¼1ª.Í÷·‘?ׄ~pÃAK7´´¿£\BÑ‚{YĤ’,6ï»0ꢓÇiCaZ*²3Jj›*RWHã`g‰,ý©*ÎYâlz/¾NOU¹“…¸µ±CÖ5'~×2®ý@R:.”°I©©I¾å«Bà dåx[ÊmX,­mê”Îý±Ãø% ½+ÔÓÑÑýÂÚ½Ö6ÙCK$"¿¶½¹¾›Ä-DSÓ°øÕÛ"Ï>žÚV›wKBF!@Öîë|ÒÎñlqèͲӓY¿EÔÊÖ±e¥v€Í$’gR€Xd¾6BPD‹W¿¢.žµ=uº¬— V:×üî›Í­¬²*p7C®OLÕù Ô²§“¶Nîx:Èî˾™^‰|ĬÉndÑɵiW?á¿ÜÙOAfúy×ðógí]Z(3k.¹1×ÝÉÞÎÁ³žÀ@Ò.‹²¶²öJ qcBR۹ĄBËb›ÓžvÎ^8.)vUgºØYŸ¾Gá2-°ÒqŸvä…Ÿ´µqõ½ÞËz‡˜¼Q^msKsÓ,ói =HnYn ÊB=Õ±ßKin©Ð’ÝßÁbEèlµ»’[í±B)”ûÜ·^&vµV6´¶Õe IØÔórË‚2jÓ| öY&Ìð2³¯>#)tùׂ½ˆáY]Gvm­ë%æy«vŠ›Þ–!bmÚG»“.~mhqü¨‹H×äšFáµ4MâÙ¾¹®nnö®~MÜD&Úr ¯-Oñ2ؘqÍÖÚÊ- ²Ÿ Òz*vÈYãZ›[Zx>À§3±ÉL0ùK …ÆßÌÌ €вPÌ3%---³ˆ×A“U,Ö#±aëõ¼ò3â_ÇUöV†;‹v¶×ÊŠÂQ‘F]³ìû-1åø®¶&µqÃz…ê¾¾ÓÊ»›©¬L·CZ§£Zë²6ñév2 €P±òYÂ{”J¯#JŽ“7õ0Έoîýµy~ˆ”%¢jžQXÑE s;=ºå®Eæ×ÊȽ½Ô$σšç’[˳ó«¸ý nËj…ŽÙßÞâk›‰èè†ñç·š ãlÅ=ru¼K™mrŠÇŠê›C­ö…UtZZ35 ÙlòY-Wð¼Î•uÝR2“wÿ#0`¼æ›¤æÁ‰y&ºôæ½(´ðÆS©³¹™Ùx•5?òRÈô6”² oÈ<·híÑ^bµÀ÷kì—QŒ©ê{7!vZ>84Ó@º˜”vGynGžÝÁ“Wr®Yh¦÷•5ž1 ïB=i"«x"jò¼5xÐhuÀ!§dˆoâËAŠå'±Ò6¸åœÁ’råeÉ‚KW–Ç‹?ؘ²E==’l×|~µ°ùcé-K­È&6‹d%·5¢‡g¦ßqÙ"^ü\vÏ‘5+JÈì‰a°gû÷;ªx3Nªº=¨|b„Õ¶oÍîz.•ÄŸT;àS~Ûù‹u¦„b¡Õ›ÕeDDURê ¼ïš+Ê%þÚ‹päYmëR´r›* Fá™evkÏÜ*l«)ÌÅ£Åa6«êxL~¹>ÉÎFê{*#П!*¢…€\‚µÌqŸÄÆÒ¸eë zY»7gëÆCèAT—ƒ TÝÔ>€Oq—´Ìl¾\Zß–sņO/žÍîTд£‚`U€Tp:ÿÐ_ÿ©hZVâÈ÷u`qWî3¯ŸèÊKÈ,o¨Ë¾¶\ödÅG7wv^5Øy&=LÑ«V¯Öìfó å›ƒÎáEÑî?ˆ¹ÓJšyu-±Nâ~©è7ñe7箶àÞðÔÅ„Ö´v&zh+9fÓ›/íS; #&(wÈ–ÈœÙhAjÓŽ…Û¸F)‹¶=ß^RÖàk!µ°ÅʨÂʲâÔ¥ ºja÷Nñ2DhÊ»zZÑЗAmÚõÅò¢’ºÂÐ{uQªaµI#^žhOÀ@Éêo¸ÐÒCÌ•.ÝN9£³ß'±…×–·®–oçtgzd^usy¼ß×rá •—×ÒÙvùКËéh(ErGÆ¢Õ(—"Ðâ»í_~ 9¡¶ÛUϳmû¹mùªõ¾kåèKM}²ÿçx^*c¯7tvEŸ’×ó)ê(ô”Ö>¼OTðÿØ;ëÀ8Ž»a7i¿öm“4Mš¦I“Æa[f˶,Ë’,&‹,fff‹l‘Å’- -fffæc†]™Ù–…'{w’,²´yÛ7É<ét{;»3³;ÏÎÌþFNϋ©Œé2¾#Ê4&°à?$-Ü0þsssÛ¤å—jêë뛺(;¤E^ÍŽ> 'œŒ.¸`Ä÷›·Øüæ7ïÄöQiùú\7*,ƒÔÇo’À˜…ò¼ÏV¡©:g¾ZßòýÒ úO.-ì;2ª÷’³ÎÇù¼‹ý¼I±“!pï%0ÁñÌQÂæÇ!¤] W Fo––-aü7K µÕéÜóyëm¹¤¶×H ƒ4%ýõŸßzë/§$%‚8ÀD×ð§2¹-2ûPàõCy´l:f-©Ôq"§§fê¾ùë—ã:¹=L@Îqç\0–NŸfr¬'S@T#^ãdIž³¼Mdi”®qeŸŒ†¿‡±tÄ}-…M™²!-ÄþÂ}ï gúɾoNæO173®ÚÌòJrÜWÌù¸Ò‘G4x¾ì˜!Ã[ÏŽ†éçÿèwo½õáqA‘hNt9æt‘ °Æú™oɇ×I˦|0•:‹8 ’Ãߟ°FM³ç8 ‚HRúAÜm]D"{¨?PZìù£ú¨èRÓ??d˜Ê}{›´l=ÌWH D“Ùÿ÷·ÖjûMhÆKi™…¯øªWM4|þN‚·‰cSôùŸÿ€lùÙq'*»ž—Né‘ûtÏ{o‹´xð3Š§ãkÜ% “¶÷´t^;ò÷ØÉ}¨2Àò‚´þ'qã ‚õcæä[Z>LkÅB¤žãó 5ù½û›µ‹R4¸hëÙÁý×]>ø¤¼~sR9”Øêú­^"†KC¤B»w„%D7òΩINÏD}²‘Aq‡¢†g Í¹ÎiÁO¿ñ±Öwüòc츄›³&Nv'¹ò*¸’ñûÞý*ÖJÎïÒÞcçÙÒ²õ Ý$-wéýñeM¾JG,.7m­0®%nïßþÄ>Ÿ¿éâ˜Ð7%n>¸$×m9;DZü¾b€Zø÷ aš6]ˉ­Ûò¡)ÉêO¿}Ù‰”iÂ`‘å·VÈá]uà®ÄÞvf¿0H ð‘ccãéééaüiy_¹t³PèŠI7’Ö¤…3§žHäC¤%ÆVŵ¿qÅ’§:÷©_¡¯5Ö}fIH —ï#‚H‹äéØ®—+ï ÒòÏ¿ˆ ?ZZ &mu,Üœ¬í^ƒ<.Qå$Hë#NrG¶,·ÃD¡°¯0¦ÍÒ²%".GZÄ:8s{˜cñ²ÎI›Eª2Éžåí#̤ш>ʧš9 aåE3 ߺõS€ð¨iz³´Ì2±¨µ±Ž`#…ˆ>äÉ'øô§ÉÃrß|3IbP{/ HÛìL<ÑEÓ³•Âyâî’:-‹œÇXŠ’a@nÛuß}Ð,ÓNI„ÛÝA!`°DêNiád;ƒÆÀ ó)±•&cfˆœ$RwnLåì,=Zõ"-0mÂVM!«µqvDÔÔËq=$èkYávN>仫h\jÝ8;d”ö@I]î¦F’â%ëãC 2ƒ§¼RZ`Š²ÀÙÒTÁØ©Ñë†v5[ZbÎiú¾TPy EÜYû &Ý=0žÍ' Ct]ÞÃé/ÓbKË7ÊÜþ™Ækþç½µ/êÉòÉj5¢ÇN¾÷Uã$ Ûÿ9/"-³c9NÂj_©epkëfiñ<ýÝA¨õØ)-ÆBiÝXÊtÇ_?WŸœ,”Ó'Ò™Ã1ÒëÒ˜Aá™kÃC‰«œd öþ]`j8UÚèÂæ:ÌdP¦PìHØ¡óÔ?ŽâhÓEî|J¡´é>ÛkÈ*#ýÚ°;F‡†O¾÷E?'…ÞÒЃ^­H¥òP®Â“­~’ÒŠ#õ¾û™.Ž=F³¥”¹¿>F¨?­úéû-“LMÈ!q/Ž‚¼,åÍÒÂDWœ8,…”¥3HDÃsóµ 3HÊ<Çòñ¤Á²·>ÒEeʪ8éŒÁГ\iAnÓ(¯¯ !Qƒ†9¥¼1ŽH ƒ4¥*|ÖÀØ@JZ“{÷¥{Š»Ugþ3ÒòsŒÓÒ_ê©t¹¼ÈúÃic–²xÚ¯-Ï`b½»ßÕ—Ó?‚ ä|kpÿÇ™Nèב¡ýÜòš:UbWùëkº¡óFPHË+¡SpTp–Ù’ Я.œÌ ãi›ª cüÏú àç·Knûùå5 H´__ã “Éd ,–Ÿ5¨±þº—4cAÀOü|OënØTźA=¤HË&<=5…%QA•xÃ=ƒ†"ÒF½ß0“†ÂÓ@Xõ_v)o+s óú°“à#-¯ ãjÍçá"hŒÛq;£Oêÿ»æ€ëá3ÄíÆŸQ`*Œ¤|ˆW ¼rzà ‹¬+g0ü#§-ÒH¨Ö²uŸÔ7ßÏ)“þzxêx§þ˃< çk¡rt¿ çÝ[˜:Z¦$tŒWHµŸÈ@rᢥ2ÏþCꮩÄíYÛbdxÕ"¹Ÿ'®Iðw€‡ïZýÈŽ¯P¦çNó9 ãÿTÇ ÊKŽÆ¿ÄKEÍ+}¸«lï­×…ñçHKxñÕvàºÐôž8›¿R!P;{&ÚÓ¼¾W ì*>)¤‹4g0ƒ$´O´—;ÎC>~F£¾³ÅTð»ú)¡#þ8ßùŽ‘±¼”,, c{–'§cô²¿É¥Ú.-5I®'Œ#jš;qdN|/zßgß%Ö £Æz©L†¿oFÃ`[eç ûþÜòûo]^àÝRN˜#-4£‡®vãðýÅ¿ÿíáaî‚05VþÛˆâ‘]:…zÃÅÔÙÒM¦ ‹J óŸ×ÂÒFŠ/‰©ºæeFÊšDlëW˜iö—(oilÏ ”ÚÞJ1HÓy¹Yš'R›Pë"3¨"¡Š…vvi” ñ«oêWþúÝýliÁwÿdÿž>xÝa¿ÅzoÒ´­ÐáaÒ.ÝQ¨2sŽ´´d:‹è Ÿ>yÞ2„ 1›CTMÜ#cl¤¼j·uw$¹ªš–ŽV4é‰ æÍl¯"´™®ëiÑ2ü¢ãÄ5G"ŽUV¼È}‹ƒÖéf[þFi9«ê„üA(ÓP ÈÄ4&ÿõˆÃèÄHEK7·§Eæ˜xçÆà!cTrÏþ®Ww¼äØI›]n®ô’‹ohjìHö ¢hrKy ä÷¿;<´u¡DtgÁá³™™±ÊZDˆQ¬ÎsèðáçåK‡v_Ñ4þsžõªÀMY7¬y­ó­ì¿jø®ñyGòtmrØÒRk¦ž=Æ c …xÒwô\rJYmkrB²NB×Ѿm©¯ê®Ž<.hLê 8ç“Eg.ëì éÂo3ápÓs‘™¹®ª"‘%#ØžÊý‡ŽîßÐäBö®—Ì$^üëµÆ©õzÕ-.cµK¦+(tPv9—ÁåP•ü‡%ÉL¨+^]X7û­…´8Xµø5H‹®®.; ˜£ãóçÏ_+-ÍhÇQ®zÔi"7K ;ŒÿÜ0þßÈÇo—;mš¸\ŽÆ׆ñgK˧œÍþG>¸‘ ÏöÄÙumâÞÈ\Õ};Ù퇥¬hÎs³´0†BÕCÙ¡´Ú®º×LT¹)iGô¬Ýñ0•Ç‘{;­?ZV×ï‡K {€¡Z'‘Oxuqˆq0мç‚Öš/xZPÎý‡O‹áJ {½•ÚÐOÿ›¿ü}ïçàé#±c…7D1Mßõ}Ñ i¡÷‡|wÎùýHú9çÜöö$»CŠ¾-•‰ûEl±[›ü©*µ˜|CM«ÔPõË @4BkC¹Â÷ŸFW³‡  çõÉÞ%éÁ+|Bf;¥…½œq‚ÞÞþÍ^3üÂFœVÎòÒTºÔ¶ëd’ i©KÒýΣù}¨‰è•IjžÉA=ß«™!柟¿JÝÚWë `SÁ¯«/)xmG@&a¢®(éÔ—ß áiœá1Íï>i_‹#Í$Ëæþ@i!7XÉz¤Ò§ê¾þÝïÅÕ,ë±ðNiyMå€aÆtþiU¤™,´Ñ¼R¡£iç{Þ»‹Î-å÷‘Rþž¾­ëŽUÇxº¦2MàŒÒôzïÊxÉÅÏNûí ¥QQ_¿—ωÛÆNn¦HPÉeý%[Ø_O:´{÷ݪ‹÷=äjúë1þ³ñ;2“]Ê‚¦›ªÖìÀßÒ[Q¶åÀG<‰fâa—O è ^­Í‹\•ï *Ëzµ`·JÎ^âpRe³§ì>Ǥ—µ)bü”]r¬;ß¿M)·ÎBt‚íñÏë¹ÓG¥Œv/²0þ³P¡¿r>ÇdÅetÖ"»*ŠDtƒ)jÀ/_ZLLLfffv†ñß!-evà·H‹¸-w3vÿÚÆ?懄ñçô´\Èî%SÖÜž8{ ßvné~úEHËk‹ŠÖà‘›8IxŸHçÞ¡Ó%\®A³põE©Èö™®]9ǵ‘n˜Ô&zT„ ÄZ×s¦áìÿ`²4¼®¼ì`xÍ:õ°½’XÆ‘>Õ‹ëÒB4ØÜ À ‘'w ð¾UZ8çN§£ûÊþô¥%â½Å‚*>êÚW0DŸAmD‰})-0¡âŒ¶?²Ñèuu»ì¶@} Nd~y^ÞBöÐLBO©ìŒÇeðZg1g™ æüEœ=ÑÈ„ìæhðL¦ŠŽO:Ì$%ñû]kØ5z „«áWÚMZØmJí»f/  ÃPa€¶±_ÆÆ[·t qó²Ó`CZº‹ƒŽ÷ []´Œœùô‹Ò ÕðÉ;‡Ç8kòâÖ¼†šJGÁ³ %!Év2gÕ,Š@Þ,`p™_B¦M:©Ëe¶ÏlX¥ÑÂ&©úåà·sY˜5i™Ín‡Ùq}\_{…¨”)q]Z:(›FPP»>ÌtçóŠY r"åNw&u(B²=ÂP ŒsA°K¹¿œ[Ê›kÈ Õ1¨b_nêBñÃkÀLuäg'Ý9Òò29˜ŽòÑ’Lišäžv°ì”„E/š²!R2„õlßVÊÒ©TìÕŒ$E»vŒ^B¸:‘Sk¥ ÓÑ:bq5#HŽÁô‰ó_|Ú‡¦¡Ê}OÊr÷B£‘¢4TÌP6—2s¦øŸ2;çÛ|$‚6j®ÌéVÎ%E%â6VOhM÷“2%s*ÌÀ†êŠD•õ¯̈U9ä›3øò±[nõ£Q(íªjnÜUžg¤$JÁøð+–W…ñÇ5›˜è~ð÷cFÎ$h»´@¤^-!~7/ïž "¦3_FXÊÊÆZëÍaücd%¬m,Ô´½¸aü-øöZ8¸7Oí:<´ñÍÒ‚$'tJÂÒXMÑ* ¹!M|š°º¹s|þ “ÎIéŠUš Ò™„.Sq#+[cËP4ƒžá®zÞÈZNèlb-'9Æ”ªŒ¬­g÷ž_î«Å«¼K€÷æüèóZz¦âÊv3ŒÙ-Ò2;›ák(£fhmiY;†{Íðò8éçd}`Ï?ĵ­Jf3åaºº:ÒbÂá h˜Òuú³OΚ"dÕö³ïð¨šO¾Ðà,o8KíO2Uøì[^{÷ “î¡-§®o$qêtÓ¡#;˜ÿ¬’µ©¦˜†7{:"Dõ?þW÷+ìõã˜4œ¾äY-MIE+:ǪÂ-¿ A &¶ÉXUÍÐPï ¦ÉΠopTßØÔÔÊwŒ¾ÓZH~b(îR¶èvk?ÿîU§N<£#ÙÚÀ@GHT¾`ˆLG—|òÑ÷ZF¦¦æ=œ9- ñΟœòçvµä‡èÊí= ª–VNEõI?mh¬#¥d†eÒó=T¥•u Tådl3¨Ð–0þ¤á*q>A-÷«œs˜Rß›†”±d2[GCKO[E@@q„@K´úü€;ûì.³'uô<õdµ®/uÍ>üÅÙÚ.Òòý·ÇŒõÔ$t{Ð4Lg¹Ž‘¹­¹®š]ƒ³þÞ%=IU3§èì^vþ½jxˆ6ªðÅûr:ì‹Jk`§5DµuÔ¥UÙ‹\ÌT\d—²¨PxŠc0hã=ïç°;LÆš2òɘ›êJÈ›M’1vÊJzúzbgE/Us¶dŒŸ[_¬!Ë[óoß ™˜˜šÚ†£Éãç÷¼'­¡$w1¥9ÊþX]Ÿìé·úJ$„ëŸu׃4¥¾?$©žUCîÒÔÔQ•ÖñJÙe¼fS)~ð¥€1’œMØ êH±’V1“ŒmÀÀLŠ«¥æyiq/nhdž„õRfb¼5Å5M­•„O…^ï¬KPÕÔÓP”8gÂÕˆl;y!}κäÖ£Ÿ~®Ê©íÅíãeQVï}ÎoÄN.xš1ˤL> ß·qýl ão©«øÎï?Ö1v"1Ê#- tøETj&8½+ìÅœð R ð+§…Ë9¿Z¨!ÛèÌ°*ÇþŒ^†eàz4A¯¹0Gãe¬c@kö†R.ø™•ò¶^PB½»ÿÕ:PŽ–_D‚{ìl˜ <™ñ³ŠÓ P^Át‰Jåø +åí‡O!ЙÀL -@ZþïJ D'Oc(?$Ê:“JÀàÿûï0ÒHø‰‰ õ¿†°“HâST&¸bÏŽÅã ?aF@4š@ÿ9ü‡!"z† Áÿ W%u†ðcÃøÃD<ó5¹Ê N¢H`E à?!-09Hzï2ö¥?Õ݉Ð_ªçQþC†Ï1õñž1Í?vÿ¸îÜsG—jF‘_¿%µ+((­ú;$¢'J¯9™fvîvWB)ždçàyÛÒ¬†ÖsÑ/±äG6 Ì‘Îvu¾Ó×'Þ¬LÓégí?zZêZú‡§0ÕœÃ-bM·Ä7ÎühÍtÊ™ ½qŸM8»Üg˜Ý; #Ìd¿Ï™‡£é0®·ê û;1cOÎ ’Œ¤÷àõ,C3¦sO­×·¼Ö»eLç9Er&.8ÙÎ+¬€£AÙaGyœªÂ"¥~ng‡³‡iHöeûòÞ'nèÇ`’Í$¸ûßw@Ø¥ÍÔJ ¿QcI¼ÈîNž,Ýy@¤q±ÚÓô]«ÌYIkÿá…£oœoa£iÔûFC‡ˆž§¿#¼¬ ´¾hˆœI~Öu¤媬MõðmYU¢&hð:$­G磟?%PŠb2izR'÷îçµ*g²[bøŠŸEêø›k&U¯&|âÀÑÓ>¹ãÿÖ¼&!Tî€R©H±–çØ÷%ãDµÖKYÌЗó¢9ÔüÜÞG‹Q0d*¿—瀆{‰9[c½VÃx$Z0ã2ëõMLÁÙMsª÷±½õ éÐl¤½úÚwûßT.…í%5.ì¬Gø®œ? £þ€{m¢Þ@þìÞ½Ò£dö›™^ºxöJ¢èkKrÙ{Ä!¶Éõ¶Ì!ÞG…Uº0ÔY&.ÒæÔÓÊ%x³-ÔøöŸ³°÷ÁApr°§À¡oÎ[X”Ó™„«¡>—¼œ/¤ i̤”Çû!WxÖn–ÎÄl„ñG©M0µÕÉáä:%Ø@÷0oÖbàÛ;{GÛÌÎðp_lŸ©‹ß§zåõ40“dzø«ˆ’®‰áÞÒ†idÛÉÎr —4D8a!û’»µ{x`X<Š³ŠD Ðv¯íÍY¡z¦gm²Û‘맷©ylb<Áß8¼‘SÊvMk¥Ì,u5Ìéš Ãô™’ÂÊáá>O‹©d)î”|]†W(;+L>k©¡˜Æ„/¥’9=-Œ@Õy=½u…½X&q¸ú_÷Ö66qÓ›¸n/mÍ Ç˜/ïêñ:ûQlåp{’Ûçgœ‰äQQI3ÜÖ&F§°HØø_¹¯ª„ubýÕ/…\ptœÙþOÓÉ¥næ‘ìyJ³}ôÆ"k$™ï>÷Ïí&Mub°£*ÂB¥]}þRŸ],ì{½´ðK¸P F[–­Pp-âuN¼˜Ä7âQ#Îg¿MkL°Ñ ¬`_ð­®Á™ÜlÍ6ã×ñÏnÊ þ@0”Ä„",¤£ËGûê;†K¢>óîí®TäªÊ‘˜6¦}tolVI÷ð4dz J£ƒ¼ª^Óxl];×Ê/fØ=<œ¹­-D¤åÏÊ¥ ˆl,aT0™(ÿO§øò²Xû¯½é 7úì„æ‘ÖÑÍŠW§•<²¾š LüÜîrÍ.2 >và0_\Í»y&£rs²tDN'ÖNc{*æ=xà q`““þâ9%Y>~aÿÂaîí‹4RýÁwæ˜=qH멸ÿhéZœv‚ü©Ã‡’1½Hbdzƒ‡ÚJ“B¬dœsè³”0é}ÇŽá•4nŸ¦õyˆhkŠœ9¥`쿶ÒL‹2©Yo¡[®™{ÔO¿QZä<®"t%JÙä÷Že9ñ*…¢¦†Kº'8÷à¡/ßß­§‘×kC4\ÿÑ?¾W9<ª-Ä_Ü5¤ð­?»×Ž‘*üY—«ÌDÇ;Ýyɶ {Ú§eÛ ßeÿ»n×êRd”}Ø9Oíð1ôHÞø>ÄB©„Èõi•¯¿¼>J©ñ—´¿\ƒï-z{ÙÀøhMó.]X›ÃøÓPíÆŠz3Õ¦zliG«¢ìÓ:,å…³8Ñ ©SíÙWÃe„dÑœ@ˆLLãáÏ…1tèµÒBv;»ÏþRFkÏ0ƒ°n\MF¾²{(Ï[Ô7£¥#Í{Ÿê¥¾Æ+_v–½<%' 'Ïöör¢ÖÔÈe8WÓîz;;i 6//ÇPR0²b²·ØCD‹SÊF~dù<ìùs|§„¼ò†¸GÈ1DH|žP5νúzc¬#ד€©Ö*rmd˜9#áÓÑÐÐvMÕ¥¸Ÿû³&ÞHΊ“¯{^ 4¨¸•^RO%#Ÿ"-e8×rc}Ç "-ï ˆ²•wŠ­\ë Ó9­ä˜½{7¾÷¿Û7°)ÆS›’nX3ª%@6¼´¹¡5;P>xp­žM·e|{>i-ÌDOT;˜3À©tð¹c|iI}Ö!Y±Ž2liˆ–jª1éifB‡*p뵩CHÎq-2!LÑ’Uê¦À?\Z¦Ú²¾‘õêìµR‘«ÂÑ’%?3 )©¼ü±l:ÛcÓ{þQ§ïè™ì?üΧ5µUÕ±‡yµ˜`ð ð/ ÙÚÚ:;;ïw«´ˆÈ:S×ïDáæâ¿{ûí·ßz;¬¤§)ÊN6j¹!ÉIhŒÐážkºÙÃë–E†àé,É”º~+}Ó‘¶¼á}[¥Îò’þË÷BÞ UìgAüÀÁ?þN@Þ°¨m Þ*-Œ‰+²FœvßÁ8º¸=ÉãìÅ~$959µ¡­×s$âŒkÚÆeà /š8D‡D‘ïN4`0v"§h0Œ+5ÓtÍÞ)-J2ÆÜ3eN¦Kiº³“kwÓ Î~½´ùËoÞzë­?}p°›¤”ê&yšÛh@غSû%©L˜>˜ ¡â²YZ›Œê‘c ˆ4ôíŸö÷1z¢rCYyZØÙì£+s…Ó÷þC¤e–³ÚuqRðÉ=éF4s¤åˆoÖZdþ"“3vWwýÕXUÒoØgðÖ—&ê4ÿ‡_#JLtÃÞOΠipg¸‰¬ÏËfn‹´¼ ÊL×'ßê³ÃñÑHmMÕj‡¿)ßøÒB”¿9óÉû)-8ÆTíGï L±£ËÁµÉ憕ØÝÎŽtæ{þÂæö‘¯òmþ0ûŒí̺dvÄ(y㡸=X^Õ%»=Óø;Çjˆ´Y<‘“‡Œ™2þ“Š»è.öUÍýÒÒ—¡®ÖEHÿâÝ•\úfرg_+-‡ÙYûöD=+¨S×ÅÙ¤©>šž)È^¯‰}PÞ÷rŸ-Òòºá¡oÆtB­‡¤aÒë¥E_B†Î®Ì©òa l÷w¿}KHɸ´szg#±9Œ”ƒîÕ*¡ÖT7(›iØ'¢0,Ï eLp"üxmA<ÿw‡§8ݹÿû§(o0€[‹’N}û­Q±;ä=$K8ûf&ºiø°å V•V~ýšÚÎjç &hÃ×5l²Z‘¦¢“Û[êµO~ã“?ÚÁ.å*n)'Œà$¿þ[t=†n}ï·GÇ(ì52ÊÃ[æÒ×W þv_é$c­Z]•ÐtcW¦Þ€sn‘.ZZµYF×Ù¼Lbÿþ?~ÞOxm”]»¢j\1ZŸºß³… aõDeÉ›†‡ØK‘|®>N{sÓ¼YZc¦O¯-Ö0]í¨v9ÏXË*5Lݵ³*+i@å Ï Ç-Q‰Ç hkq‚פ¢L -܃£ÇÚKG QaÆŒ¬ Xfe¥é¡wÒ›9‹wаæ>NoE­= ÇÈZ]zÓ1n‘–šØóo¯•äíðÉ’{1´ÑÒ÷¿s ½ºF@øνï|g£àtì¨2À¿&-÷ïßòäÉ¥Eâ¼WZ˜£‰ÊfÁ³Ókïš´D®K ;š(fj$ÝMYÑ· ‘–+li1iËß!-ìÅîgÆâôŽ¹§ös®#â`w­Š¤~«´@¸q5hÆ\—wH®F¤EäÒ2Kë9(â€_¿Íø©‰ø7 *öØ7g»‰X{Qþ­Òâ`U°!-ªŠæÜ3…ñbŠ–ìäòÕ,£ŠÙÏ5í‘F黉ڡˆ$ÆZ/'ÕCV;§&w‰òð‘è±ÁGBûGZÜÌ/¬I‹ßþä.Óù×w…Æ©dsIÑaÊãl³ÑÈÙÙ+á,ah#.’ùr½ˆ€F¿fF­?QHƆ#-GóÖV:nõ•Ñ»Põ iI~W>G"3‘»;«ð÷¿•R©#Eÿø§"žH‹©Bpç&iÑNÚ˜Œ™&_9,MC÷|úµæúv0*WWÅ1qãK[™Ó­$’ÏÇ×:‰Œ™†OÞ=9‰H cÚäô‘)*s·vªæ¡Cy[‚ö2Rõ÷]Zl¤ ÷îyù¶ÿòùóŽéõ‘GýšLŒs”f?oÎÎûé(¿œ(Õ˜¤´vßF’ £Ðø3Ö¤¦g~×Ìî]¡Ñ]ùe/P8ÒòÕûc¯èi±Oè SJÄ1I}¤Ra‹ô /d³¥Eüê—¨" ÙòrÖ+V XŸÓ²IZ| Ü·HK~MZ4ø„ðð,¹Í[Õ1–sq»j¤ÔvJ''ŒÿšÈ5•]ŽŽ¾d/ȯlÖ<Ð9šð¡o­âòÖ3Îq9•:Fâ`õÞ=2¸µñ!˜‚™¡Ð^ÙÄ3Ð-{ÞãÎ’ÔôØhÓ2ý J°ð,U–_†#-;kX£,79?Ó¢&ý˜µìƚɚE ×EókDö”ò0Éîøq-¦ãÃß!C9Á"ZëÝA„Ñ2õËëÝnp’ŸK:ûæ«Nk1g¡*ãqÍl»î+ ßc\²>øS±(òŽÙøÈ5ã$|Ô, 2ê¢Ï_?’› ’,$E6.VDZÞÙçR£{Þy­Œ(x4–H}£´`Ëø$,û8‹5†3y-3˜³ÌDsþ",¦™ŸW,èÁp[ûÁÊ8>yòúe¶!-4\R| ’cšâ4ƒ’0ý±bÆÁȸ ýØJ˜ŽÐç,ÖÀ5¹HÙïÂJ6VkeâИݦzm‘––Lg•¬±õìa$K~™ØˆÝ$-Ljš±ÃISûôÏ-“LMè!1/H à_’–W½=ô*iɽÚ*j~þ¾ZBŸîFu€¡©µ­šŒtxÕô6iiËMv6Vøà;%/ïˆ)*-ÝÓÈÜÖNá¬ØõNi¼K×ÀÄÚ\_ÙÀ“3ªBíÕ¾ã×öŒ'2¨~ò†&g Ô^'-³pœ“†ôymC]ý² ÂDe´˜¨¼¹®’šo‰Û&-¶ZZJÉ5 –³FÎKiAîOÁ¦Šê†¦¢Ç*ØóCf)¨v!Q%[ß”íOœá¡M÷ —Ò‚\œy¾ŠzògEcª8ã¸ZYIyW¿hçzKɨ¨ŸÓŠhA ¤1ÝOXNËÊÜôZe7a¨FðøYS# y£n÷oí% eÃÀ$ÎlæŒÚ7_7í|$§OÙ+Ó71U’tM¨ß&-L\«¾¼”‘…•¡e8~·á¡Eú®XÈ*jk)ÊX¥ô!Ém“–‘ºØSJ¦na¹TøuÃCqžVšÚºògì¯v0pm&ªª†z‚'„®ÔM ÖÅ«¨ëª+ˆ+˜‡" ÄD¡’º*2ª5H>LU„–ðÜýá †jÜE}2Ø£uºPKUS[UþŒ¬–ÊL´×ÔÑU;'¦ä–E%öš(*êò Èöh¸ÅÓBz†:Rò†XÎø†Ž„DíÆjÖ09\íxn­‰$ŽWô™ê$}iÙ{\L_SILÕMaŽ—%é›[kè\(bï’s>``íœY5ºëðÐÆ^¤•’š¡™8Ÿ`av§´Ä˜Ë+9„¥u³KùÕÃCÛ¤Â7(ˆË¸ú…8Ú\vÙAXÓÆ=ªŽÁ˜ÖØ÷©†¡©œÀéÔ†IÂp‹–¾‰µ™þyÿ]úì ’Ÿ¦Øæ –äzsÎðÐÖœá!ÊH†¶º–®†² ˆÆ4§ù)?fY²¦ÐÉwßo£«vtèA”`cM-}#mEi9‡,*D ³TUÕ751мV×íÊä“033øò[‰×­UWÎðßiª¢b`¨/Ì'_9JÃ* "¥,y)exª$PJJY_]îœw%ÜqâÓOÏë#°'‰ÁŒ§“—jÖZgˆI8uô\÷ÚZ– WMU-mA!µ ©Þ—ôs7Öƒ©—Ž¿ãÞ²ýähØ#Ç´Æhì~ÇïßÍéÄ5¦ûs¯åÔŠî9-Ê’Q È“È+‡‡¨fK=Õ?½õ¾š¾S7fìüïIªé!Ç–\Í¤á ¥D4µÔ%­ÛW˜:ß7¼’ìó±‹'{…?û›çìR˺™¤qcã=ýMVǦf}ɦxîðcÒPNBÇØTêÄÑ®é‚ÿì9m„üÌ:t†1Kà }¿Wipc!rÆ„ØWGw[-”ê~æ3-öÏŒÂÓÉ3½ ‚"†f溺]”ÒòŠá!$Ï2í¤”täÅ¥"kÑ@Y?­´þ¯ÁD• jÿ:—…ƒI­–Na?aØSä+¥àG[Ÿ 8Qç§t©îV•9m(-ÿÃßÒï,Œ´üÑaüáD_‹šõ…R!Òàñ÷¿êÆü‹/„hÈ©¼~xè¿ DüëžÚ‰_Å*ÒÌÉLqW°ö$H à'h¸™‘ú«={*…úSÆiaÐÈ´—½àLÆø¥„‚ÿ‘ÒC ådžñGŠãåÄMdì¿“äÿ¸´Àƒ%þJ^ud"™6 iøI¥à¿–Ÿ ÖÊÒƒ§‹«?ÙþV—ç>_\ ÀO"-äá s==sçÀéÙgÿõs¹GYxãV˽ÁúzlŒªh‹/X£=­õ Ì’+ÇVVWiÕIœ¯ô";(ȦswÉv†zfÎCÐsæx>÷gzúvÓs»ì—>\p}ú>"-w&›¹ú^oz±º8œjb çxáêm¶ÑÌ]°febçùp…|Û“Žìñr=fåÉYo¨ŒfDZ5Éeý ŠðïK kŽèåàøóàsãþüêÊÂDC^b|r/~±º‚)K¥Ü_X~HÉ,Y^}qwº£´y05>¾ ‹ˆ´Ö7qÝIññ9Uó¬‹Ïn¦'_Í®˜ÛÞ±@é¬*¨¨H¹’†»ûœ}´Ì™«ññY=O‘=¾`Ñj®ö´Õ'Ç'5¡n•¤]1ÒÔ ¼µ¿Âîï`Í?{†xÈNiiv’&ÌÞ¿ÿ`Ù kŽJcÞ¾AIrÐ!?Z ä…– ïß¿ÿtaùëYÎû,ãö èÁ³å•ÅçÈÿïßƸúÍïÜ+ëÙuoË{óËÈŸ7ÊõãFïÝ¿ÿxnáÅêò,{ãöÁÂH«ØAÖê3¿k·‘´>f­®’Ýënݽ˼ód•µüè;…Š0‡Œþ[œ¾–ù  ±@_ ÿ¶´¬ÎÓýœ»G§¡;OX«/nÍ4Ê;_gÒg<œ|o/-ÕÛë£=[„{U-sW_P*¢ÔlÂï>_¤0î?‡Lôݳw'ú†.>-ôÒož¢á:3Ü/UnK¢7ÆÉ-¾qî^ËêʣŇqNæÃô[ÕáæWñ/^¬ zJ¸%×=zò€=E<"ÖÇ7¿þË•û!jD‰vHKw ¾……¹¹sÈÌíäW‹÷)=mUÞöž÷Ÿ¯P*LÌ,L,k§n¬<ÁXiz8ÙØû Ós|«ïŠ_rÛ.þökcè9ϱ¥ÛãM†¦VÆFÆÓHò««+Óãƒéá~)³«/æ.Ø›™™™ºG—Î-±r.zz†ÛÛÚ$ÕL,¯®å©»sØìÒš] ð콬€WZØõ£îª,]Y‰ÒáÙñºøÂ"òÏâß–Û \iY€zÖ¥å²_‰û+RmŠS6‰Û0¯g‡=©¾raôå…,lºÁùò×=|‡¼c&Žòuò¸µ´Üì¦W5ys²FÅ¿{i«à믩ۧ=_|àí~éæÂ\±³RÕ(¹7?Ì9©o¡Tg#ßÔssÚC¤ÙoÎ ÚHŽ5—¦!T3ï&-Z~©õ¨®B÷$¹å»Ã–QõFVns¶œÏ×Îé£ÂÃ…ÖÁu+«‹N¶þØ›wI3#;¥…µpÇLR‹ú”-]¬¥§W¼|fPµ¶liYŸL̪­ dK b)Ïîôv·Z[ ÑžpgÞÛÀýX €´¼AZˆ™îIUC¥>gED9ÈäžaÒ•U ãrêŸr–-|´äÙj@—žãò]Âi¹âk*&*zVTiüÑÒk¤Óžœ€a/-]Ps±ÙMµ•ødñ戼aú¶røú4÷êY$©´÷f ÅìœÑÝyÖò›ðÕÕULªkJ3´±ñiyœž–Zô£¥»3WæX¯“–#Iô­ùÕ§x{#E+ÆI×Ð1¨~Zaí–gŠ¸ù ÎÑC#i¹ãð3zµKìÒòBˆ'êþüp©ù ku•µð”ˆ÷ÕRhå¬b°ÊZ 36꿽 ê3€´¼NZVYä|Çز‘éƤ°‘'›[âgïMÔ]3ˆ_áJ‹çÕ]¥%ßV~²&-Ï(EQU£K¬•ÖX‹ i~º‹´ús<ÚמּX-ˆrz´„HKñé+¤åšYò â—=\FnßpUP…Ÿ.ÏSÌR8Òâ–Úqc³´ lJnîá½ù¥å]¥¥óx‹´˜G,½”–¨JÜÚJÍù¢Ã´ÇK·MMC–áXY¸{ƒšå®Mº·}$Öâ}i"gxë!} ±±±6?BËÀe~ÖßÕ‚|L 6Ì­½ÿœ;þµú Ã+¾b˜ý×òsWC"ž -¯–=5ƒèðPgï(ʃÅù»d_{ç踸KáIÌE­*1:>1<Ð/sð.Òš²ž3Ãm¯edÑïÎÍ¢3’£Äλgd—Î>ŸÛ,-‹q¾Áѹ¹Y^Vú\i™iÎt N̨˜^^yÚ^”e¯sµe7ŸâjåæžµÀZ~½´¨XùÆÇ„úÅW̳VpÕ‘¾!QžE÷8ÃC[¤×™g”˜^>É6× m‘–Õ…›—,RÒÒqœŒ3º|#Ò‹ºXóùú"îA!>×Úé¬Õ…œ¤Ëññ±ÞnA÷ævºÐòØevÌ˼K³M¶ësZÆ9ÃC+1—ƒƒ#ÂÃlÍFhì²[z Ù„UÎg–Ÿ9øút¯†[ÿزìá!)Ì…ºù3Lbyß´ÕÛÃIÍØ[ 2H –ÿ˜´°_¦ZZþ±qZVX« à?€´iøHËêʽ›7nÜyÂúN¬.>¹;¿´òª¯YËó·î=û©†JVçnܸñd~ Ô~öÒ²tËEIoš~‘Ö⣢HW]-À«uÜc®^Œ¦-þ´ÇËb´Äã^Æÿ9s@Þ²tñ_––å‡9!Žº¨[ì$–ž;C¯÷àA=à -nª&÷Øï»à:³ Çï=¸G Ò––žä%Æ모DÅ\«" Jswª­¸q %&&·ƒÀb-Œ7æÇÄÄö±ãê³nŒ7$ÄÆ\˯¿¿ÈzJªÌ»–TTU•–| z¾½GÓs=&6r‡ýíéMbFsFR\e†m3sPnjBVFWZî’ÇRãbR‹ÚŸ.±hãíõ˜G«/Vêʪn±uuñù³…Å]B±çûeöݦ ê8grÓ¾xŽÏéÒÀ/JZ(Ã%aEc(Âùµñ”K.^Äõ÷f(Qê¶÷ž/R™÷qMiÎ ÷îÐÝ‚ió+ŒVÆ­»C!¾™w»Ý3;¼-]úzÊüúïï\žg#¸Ü]\§˜vô½§÷#}ü./;«çt »r/ÊX–.,Þ ö¹€bÜÎs-è#-= øÚ¸O·%FqÞ&^]©t×I¨˜Úy6©Þv´‘ª¥†‘³–~yÒÂ^^ð.!7ÞWÅØÿñÊêi¹ìW@âþ]m-"ÆE¾Z t^U’=kRq·Ç«;›™p“ØoY ¿VZºt2ˆ¬«y1¾Ô§÷̨͔s¬g´Þs–¥Ïè%²g×Rð(D6¾­Wð¿³ø†(‰žv×\âÚí4LÐV€´ð •.«…ÑÞÍœup.¹xâç_JË…2÷ïÚ” èg\!a=¥ØhØÝž[º?”nÌ––Nìlb"-o”ÝLÒš´Ì=vSÕÃ<\yˆm—±,¿×ëžûò˜–Ÿäû[dú•3¸G8ÿøÁ³Ý¦×ÖD¸\é¿»òü®ž^À-ÎÌ -üò¤…‰j  ‹ öL|À™0Òr5Ø'"© ™ÊZÝ"-Oè#¾.ž±ñ±¡—ÒoÏ?Îr¼š•“joÿzia=m+ÈŒ´S¾œÒ<ŒÛ,-´ÅJcÂ¥˜+É^²–¥‹¬¥Š¤Ð áÑQá!ݸ٩ºÿœ‘åÅ;>a„G˯zJíòrvòLj"pH ¿iqQÔîÇÜ\ù%d]œ{8^ Þà -«¬ùgÏž=_üEF‘g­,#'·¸¼ê ?{iÒðk’–¥¹'÷ž-ƒUø5K i°ÔHSÓÈÎw ~öö‰µ7~iÍ÷‰)z±º‚ªH4ÑÓ2q e.°wü:äf®­iâB¼·ðbuU§§­éŸÙÊZ].Œ2ÔѲ L½·ôbåN3’]ô[i÷ËÖ>iûÌ.¾x [ëh9„æ=Z~q ]¨ÃýJË|ü¨§ü[Òš#x9øBwÞ¤ãn>˜ÁZÂw–ÄFÇ4Œ°ƒÈ±æoæ^Ï--NÍë_f=«iì_y±úSˆ†!ß5äEGÇôâo¾X]ÎO©+̈KÉgαcìÏßÆd§Ä'¤>Xd½X™ë*ËŒ‰MžÜ±ÞÐÓ›„´¦¾´ÄØŠn4b˜òTÜíùåG´äì¾9¨#óJjêõ²ÌØè Æ}DZ,“«ãb.waf‘.?¿SŸp­ˆÉ‰Ô£·¼ª±#1úrÁÀ,’üÊÒâÓ¹Ý/Z¾?’ãnïwíÅ*ë.<{û.¶«PÚ¥yqåQ”¿ßyöÎMæ³…•Ù±£àRøöÝÙ;VY “½CЭ;}¹—¬cúY+ ºêÊZÏgÄÕO„™ íJ”Œ™ŸLÒRÖ¹ÞŸK‹Ð$-Î…[(fÈ œã0½î=g+~N½B* .ç|xª×(…Õå !}~hh¨¯)ÕÆ9|ýôÝHŒ–»ùýÍ0‰|?02—ÕVNfûüꛂ¾1ÒNˆèäÔ ðœCÑûûèN A‘ò÷÷`,´Ylè1¦=‰upRèQá\~$qÀTúQ@t± …F ¿ZZ´l"!6-3#Ü×khƒ­Ðb|2r²“Ó YZôx¬0<&)=>ð.-(R“M¬ªË~Իɑ3–£ƒÂròrŒiüuç¤ÃÑêÔ¨„´œœÂC¥^DŒ‹ÊÍËNHk Ÿ‘L¸P˜[S”|•´TšyDçd'Æ;Ô(J)ŠKÎÊJ+kšÀ°‹Òò©é¡wG|ÔíSŽ!š¦üô¤ääÈàÀì ‚!=¥‰ÑIéÁ^Ë ‰ê”îé—™ž•Õ¬ÔIÒ-®{…222ª[æqqâLDä¼×=]Kªß’äÌKÐíÞ‚ÐøŒ`ÿˆ9†Ò€¡ôöPb×4QøíFZ>ë5œY3£´À™¤–÷`˜ÁÏâðÕHËþî“N»?_Ãûo†üGˆ?hüÃ?à @êá~eó€€€€€€ø·”¥…N£ðNO.‡"(ï³tú“":ê Câ/ øòíÏBÆñõá‡|fYX  4ü—–ü‘ü  ùW´?¿}hÿò¼(}|®l¿Cà–ò±´RÉÜÎå8“¥÷Å·ŽH!wo7Îm_ú{%÷aÙ›¥+KûLœnÌÔzF?½ {·Ù‹P6úKKþT¯Ö2~U!Ç;Þì_»'ì…¶Ì'?Þ 4 áO™ûó~6nÜz˜Û;.2±`“Æ:ÜšËh]æ°YÍ¥Û‡”ìôÜ„¸¤º:btN“¹åïì\”—]Of²NŽGrñýlšÇËá‘ó*Z«²щ¹Œ#~–)dö'™µ¿<>ÓRÖ…?e¬ŒNÍo-ûX˜oµ†[Ä” ,õWÿ›U!¹7Ò?²µ¹Zàð]aÇÂÞúÜØÜòÖâ ¥ç똹1>Ù‘ìuV,û`*ÞÏé/ÿúlÁêÌðsÉ¢í¯>zä³Å  ¿éÛØÚzcï“=À9¢íï’ö6§ü-­èÇ¿ @@@@@@ün[ÊÇÒB=Øc³˜—Cà÷Yr/Ï ¯T$Fv-Y>ðZ¡1Û7ÿõ^÷ôÒT_Ï6ƒ±ý0§¬6ÌÓ{bÎf®[ß±ßÚ}éù—Ž™­Éj‚Ypùæ|Ï«°Éö¢§Éc”ÕiÒþAA°ãÞóx¯Ó;"÷¬ü®T÷ ¼¶õ·ýwîúm,ûY˜-/G[\.XªºáQ´8ùúá ó5­Þï~FýÀâPýw#¶"¼Š–·Fßx罞iÊ°Œ¬ÚZënç9K>È¿ÿ/Å= 3µ1vñ=Ç,&ãmotÑGÍ$EÝû¾c•<˜n[1±;Ûq/qÅbÇ8ÍìmÝ»õ¢6ÓßÒ¿(âÆŸæHkN?üX?ú¶1â~ö«‰ù¶|³òµyG)2ƒu¸ùÓ÷wšÇWö7™L&›¾òâúý…Cæ•ç™>RÒùáé1m%ÔÖnŸIõ¹ÿSMßXÿ@ߟÿùÞ*•aÚ=J¹ãÍêþÕw[RæÜœCÉGÆÇŒù¢þ¦×éeq¡ÍCÝ×þíé±ÑWêèß\Gt­¤½«¢#Ñ5¢|êìñVw–u@Å/j¿[à–ò±´÷IxÏy9¤þ~xŸ%óô8ÿ:-'Øaš´]æp³jdk­¯úßû™ïÞ:œÏzðOÿüÏN1õƧô5w¿DópµÚ¼ª¾$Ú½`–Œ¿dmÕ9Ùy÷IL®íõ”Š†PgOüÅ£Ývïðœ³*,øŸÿë›ø®o¤ÖÊ!Še,Ä5¦¨¿¿Ì/î?‚d?çåýõ'ú?gþÛ_î½í O(´ß;\wK©-‰¶ü—w…ü¹êívþ“?MoÇ Ì=JŽôÃY¢oTáGM߉·{Fgîu‡¦¶ìL·ßKÀî°0ÚqjwóÑ3ÂÌ«$¬á³ÿtmÑ×-ˆÎ¤3׫<2j’lÞW÷ï¥sd&uý‘+ñðª³z9h#‘!ÅïŸVF8Å6ÌÑÉnwïe¥TÝøçñ·–û žÆ´0L[¤Ø?(ë[9ûàá\¡ƒ_:þ€þ6?<çåÞR×wÿj¶²OªŠ5óÍ›ª¿g·G7U·úÚÖ'ƒö¾ö,ÿeoÉ¿¤@@@@@@ü~[ÊÇÒr°G:b^Ž³>Kêáññ‹Œ½a'sëúÚšªL×Ðìæ±æyL¤ÐÏÞ¥½ÍzÕЗîgSývÿèp—:ƒ¶Zý´ªïm]¢Wt÷“Asµ°ÛY þéºyhUÁÑÕ·ÀøYR§ghæYqæUÓ»gé[]v¶xÉS™6QE}# 1]›GŒ½;ëeò–ó÷×{Vζ<ˆH(ꪊ°ß¥­¹&×Ô¥úÆõí0Ïv›¾—ÿäߧÖ÷ƉæîÅxO›-ðŽ,¸â¨·ãí,´ÝîÐÀÔ×;Ó·£»é J–Ÿõi—–éæD÷Ì¡j³ÿotuÁõ¹û>ý:\Ðò:'(²w›ùá,QÖžzÑ~.™BÚ\§_u’ñ ŽDµã˜‡M1¶ÉÝtü|ÒÉéÖ·‹û7¨+ÿóß½wh‡³my–¾¹ûTªqKÚN©ŸYiçã}!ø9ø¥á×zño§¦8å_ÿ×/ÇWsìs&öñ×]=îÚ ì̵?vˆ]&½;iG”Y{§02ýðËÄ︥œ“–Ým&z9Î.y6]ñúó‹Ë/ãêŒÉö®1òFž¿µ§_PHXÒ2…2—õ °uŠ4ÓúðŽÓ:i—–C:e¥êieïÜÎD³¥]¨¿«or-~ð:ðZlû\¦÷ÿ²ici´õ(w»°Ø”-2ys°Òõ…SXh —úu¯:Á'&)Ùçùõ¨Âžƒ•a«'VA!Z/S)«íY®În!ÁþþáÄ­¾ðø¢7Uv»ÔפjÒÛ.7ÛÐ` ™„KËäÚîþX¾¹{® ŒÝ1o[›¸Äô½ýsGMÛ$Ø=£Ñ)¤®Ð€ÔW´í9ÛÇÖ‰©)¶ff“;kžÅM7%¸gàÒ2²òÖíþÍ€@û§ݳû‹}îÖ6Á¡A>þ±K*¼òÔ»ú¡XʼÃõ{³ä+Nò웧۷žÚd–6mLVÿï½ííç»H¦’†Kí½’Ûûãæùw_ÿÀÿæ¾™‘†¤þÓC?ÿÀ”5 •:[èúä¯7DÅçQh¼ØþïÿÍb“L™m%ZZ9…x8åܾÿ?vîÞx!Īæ!e®Ä5$·åÊoÿS â÷ ÜR>––=ÒF¾b_¼Ï’¸»]ùîNPv×7·){Ëáž»_Ï^ý¯±@@@@@üÁ·”¥ewgózp9ľÞxŸ¥ù§’:Ø%!¶6ëýþûËÿþ?Vn=’|5{õ_54ÿòÿš¤ÅõÊæñ;n)KËÎæyŸt9„Þž†øìÿâx¹:_Ù< ~‡À-åKo˜˜–ñGøúo˜øÛ€éd'JþË? 埱d:ì×ÔªUHxr=ö[¦àspïjøF¤/Ç¥T­à¨#§iìK:{ÆkÇQ÷Ë«‹¥)¯Žt¿ô¸ôü¥XB f2ê`Mðö—H u¢ÙÉÚü™ƒÿú‰Ì€*z cž>}’Ý!½àY2iÝ·'ûT9œ¥ÒaZ|-Ò"œõ Í1JËaC\y¯Õí5g¥gô. TL-ÈÉÌ/k>QG$Èó½™9…ÝŶFiAÕK½uééS{ü-œ[Ù½ØZI$Vu\…™hÊû -²“ý’ìtbu_Ê8û¥ýÓ¥yYm“Ûø[¨ò¨¦0»¶é5±aE#ÚÈ%--˜^Xá·Æàmõff7Îò÷&nXçÂÌȱ^ÓdÑ0Ašy•yÛ­U‹ôÜo?âû‘–Ê'^Ä#æ¶W`ž5*Ggˆ±cãʱ &i®³!'®~éÌi0 Íô­ž8º$-Ï¢Kh+=·lKZQJLŠÅ8½!/'ð÷Y3]\Ó†Êö§o)´ÅV°:Õú{ÅîŸ h;+jø¥ÅÍ3†L&“&rqiYh¼þã-©jÞj“õã»·~üáÁ‹9­!¹fØ`@)µÆ‘–æ,Ïï¶|==4ÜTŸÒ¸¨Ó°CžÜ OLÅéžÚ¿$-Ͻ"“’ )^´NfùSíÝÒ\éÑŒoxrQÈEYS•‘Ññéé)…µ#¦­%¦ge¦‡‡& Tzh~ðûHË׆¨Ä µŽ³Úc•ºŒüÞ/˜NÁÎöt•hhQÒòymo”ßÿñÚc‡(®û½EôàVF…e*ÒH H $iÑ(Å ƒ/ÿ*/ŠÁ0ˆ£Ðü²5'¨NuÌWa0ç߈´…Ÿ2}K²Ã¡•}:µüx÷Ufßæo¹zQY”›…Ͼð¢ !J.1Îßâ‰ë¦Ä¤":nŠ·ƒ­áD{•³è¤q¾4SNZüI}¸GAÛ»£¦M:?fë»/Q×¥Eq´¨N™îí6E“"*Ž×c?žî1߆´ØÙÙ%%%±ÙìËJQëµÁãÈU£8ð²ûϤ“Fò³ÒóJšÞ§ñïIÏ*˜ª ±¥˜^6Þ\j¼”x~æ¥\£»âà…òˆä¦¥SòŒ¹oLÍëljÓ0 ©·wnÕ*¶v)¡Nn+b÷Á8«Ú±=êì+³°îËw2”²V^.žå EÔB7ÿ̨´ c}¨Ü×-rùðTÀaòÕú¢ïžCnC‚Ïë¹Cã¢Z Ù¯°ùE7Kà?QZlmm#""¬¬¬ººº9'-QŽMƒ£8”cñiá.“YÜÝ1cú08$™Ì¤Ä=½>Bâ WšmBšÅbþ“{6ôÑâ󤼟t¹ê¼·ÖUòüÚžýCgš]ë.ÌèÛˆð" Þ¥†‹÷ôÂ¥ÓI>™XÛÚXŸ}rÛSx1ƒ­þ¶¼`åôÝa²Æ’z·+Ò·ä(&žð(ùà8EáîþQ•.šÖÐjò6 À·"-AAAø¿§§§GZbÜÆwÉ8©êœ´`(w¥ÑæÉýŸnÝlð^Z$^Ÿ½i./jêµ¼íÄ×\,õ`(áÕ¾À´cÈNÓð&s®&%iø9íò­™Æ~–Ç€øìûOcÄïkô¡˜–Eh'ðMH‹ƒƒÃÀÀ€J¥ºôŽ¾&Î÷ð£5$:þHFϺáC‘æ]ÞHda¾ýBâƒÓl‹^£àïy†W™–ª`*±P¡¾bz¨=Þ³zA¨“›=‹çë0öZ¯MÌK×ð ±þ¼´ ªbûûãd¹’9÷“eŽâRv9ÖZcÊŒñŽÒ˜–ñøIçàèpG‘Gp¦c9ø•)ÐÒâÝ{¤ÚîŒNì"¡"å–‘ À7!-J¥òŸ¾(-¨–žUÖ©D4ýYå%Òø§DƧeÆx>%qE»Ó‰)iY©„ÌæYãlÓ§§‡´ñð€ÄèÐòI†NJM‹ˆæj‘Ͷ䜖yDÍÏKK1¿?½&ÒK¶ÛÃB£bÂÂ^mˆ/Þ¨¸{6±ýÔ £LÜwª1®²ÑóR=ÜU(:Z›ŸŸ²!TEx÷±´ˆZnë8AãÇ3Mx4O—@;€oBZ~ 0™L¦Ó©FãÍVèÒßÿ01DÝî·Ã×þ¢Oé¥tW÷×<ÀHZj¿ûþfHÙœö?'×=†¡(ö S®àÛ#(¤i€?”´€´ÒòËÀ0”s"úôü¦•°åý¯©A#:Vjøâ¤åË?Û“×N}wtYZUmÀMyí¨ê“iï1ÆkÇ_—`=-ØãÈö6šÝ­,ë‡ÏžouZ>²Ho^6®·Õ‹ªbÜÌž¹mžÈ ¨¢›ùèÑ£ÀÌ6©Z |ÃÒ²Y7x8Y–Eˆ"Ò…²ãdœ’Q .-˜~³!÷uS]zvɾÔ80r0ו–™ßUl‹K ¦—5''g­ÐŒõ‰~¦æ¬Àݹ7Ìó×÷`:QW51%-cŒfÜÉ­±òäÔ 2W?Öˆ˜i©Æ “sê¥ÆK˜¥ÕČܲ}É™a *¹\Å*ZLÉ=8˜+Œ.é6>Ó»†°xìºH{’P½\Gˆ­›çÓ—­ü*d:ÅöÚ6O(èKs˳ M¾]iÌŠ»½+Yf7$¹§ö±.Ôp:מ”š–]0DEYuQ¢ûÝ蔜žÙmcùúM›Œ<"±¼M†`¼•–舘Դ䔼Nã¤Ð§§‡Äûí‰a/ÌlÝŠj{0 ©JŠ‰ Ž*PèPc&Ò?01:¸t„‚jƒÿŸ„Ó5¹M¾aiii¤àë–Jv$ú¢‹ƒ•ä˜+ÿönŸŒ*4Ú©Pùù­”R>Fã)>\Ê„éd§‰æ£M0•èX¥û›7#ÀNOùÈßu–PìèDj:ؘw¢ÿ[… zͱPñn+ rX4]¢ûÌÇ0—k|Ó±è46W JÀ× -àSר‰^Ö=³xx²>`SÏ@¿ RñF‹sü(úÛJ‹Ž›äikå{¢½²WÖöÅÙewÌ_î|[ cŸ=²ã¯k¦Î¶¹X=1³õß6%ݽˆb1¶ôL©ýüŽhÕŠƒÅúüYæ‡*Dk¯?Þ›:¶ì’q\,£…?_`­oiîQ ÏÉPlÂzMƒ̼i”þ­BÔÂ=Ò9ô½´(¥âÖ‚¤v–î3âY’jÊ'È'µD&½„?%àk;;»„„6›}ÉT1~Ã$–XpÂæ‰piy^<–Ÿ™Ò:E2u¹’–òœôÜr²éÎ=Z!­® 3)­€&P¼“DÑPÛÊÕ *!¥(#%-§tW¤G4‚úáÔ€QæšX*}ÛËú¢¼ü±ÖŒòA…±ÆÔr©¹Ôcº˜çuãû´¹×OB»Ô*Ö«Ž1Ä€ —j¦÷Nð÷OwûK*B“›¦ð>YîÎHMÎ+oã™î7pH¥–'ö;`‹²xÌeíNšûÔ^a ŠÅ¤ú1cmzuCÉKžÃôÒºô|F¿Ô[—””\Ú:£4 jðÚ‰sï¤E¾Û””4´üîìm½NÍ,hÌuÁ¥EÁÚ*ËKOJÉÝbKQ#yó»1 IÝs,T+%æ¤&ßœåÉCµü×¥9éÙeG =.7½M5måÙiE­BÍŽDåÔ¢¬ÔÊ’´3iélÈKʪ’™¶Â÷v¨¡ß™žM¾!ãm{jr±¦[¨EqiqM¯-ÎNmè_>+g°*óƒ´ˆYÛÄ´¤œÊ7 Šé£õy©Äº˜ÈXÓ93æŒNi¾ i±µµˆˆ°¶¶îèè@Ÿ'50ÅŽ·O܇^ód½ÿšu*…±'Ñkº#­š§ö˜›vn…*)Šhš=àï3ø2\ZÂ[ëâ}zÖŽp¹™Ë±íÛ8:¥ïRÅz½’éME Ø|CÐŽLé6ÔSmÔRæfµÄÕPE‰Åµá=î%g‘>|2¾²±º:óä¶'Þ ÷—'—öL¼°d+­ˆ’“%Ø.Hm6J {iœy*XïÌ,Z:›¢jÍ ?“–wšq¼àœÔ£Á>)-x÷ßëг#R-ßqiT¡úÝÕ.Ÿ;”fٳʹ -øÖ'ýq…ÆL/˜êÀ;¨w$Tylþ£¯àçÑ¢rŒ÷5À‰L÷ÜŽ%ÊBçm¯WJ½„`ÿb¯Zȳo{{|î< ŠÊ·º–©Ce±–ïFZôÍá|Ó—Ä[ëÝ&ó·ŽÂ\ž>æ › jáî#³ÀM:£<ÖkË4MôAZ0/'"xóˆ·Õ“VжÀ\l³Lí?ÚŸ°·ði¾Bi rppàrÏÙ*^ñðOÂ~––ëÚCÔ€U¤Ç2d§v7¸sψ¹­H- /ø0­‚KË_¾»výY¶Hkì’™Óùfv>ÅÍ#-úAZÞÖâÒ]@ÛèsÉߘŒx>ÉTê(0Äëá³7¯+Jš{-o;ó5ª9¹ÿ`Ö4×ÒW™ÚEáq–² U}*ž6^jñèþ½Ÿn:G¾º,-:ÙQ‚ƒ UxU]¤Å`ÐPë³Æ·G*³wTLÛSuÿî½»·®ÕŽï}FZ´ä²ìÎEüÌ-—9¯°eÚ´­~Š¾»ÎÕRZ0TÿÂeY€ J¶åu{¶Rœ¤3`Ò™ˆš¡swrD•¬§ßÛsÔ˜t·×ú’´hO_<~—Q´Ç‘b²Ý—ÿäþ½{?ý”Ù‹K‹+q÷ÑÍá’¬õÇÒ¢ç Ý¿öƒé›¼TֳКÔÊÁ7D âa¤øê¤åÅ‹CCCjõ¥~\/Hôð"?K‹iM‹IZ”â »¶øï=SGÄóõ?K‹CT'ùMdfçŠÁtSB¥L¼ü2)¶~O¯d{f d”èq&-‡FiÙœŒ°2I ªòÕ—–°b¨ºÄáþ8Y¦dÌýd™«@0R_‰w\‘YP‹10÷'''G^†ù&r¨.]O:ÑJÃeiÁtÑ(yœ—°z•lßË6X¢Ñóg ƒ2ŒÒbÖ©Á mI¯ÙÆS1TùŠ¡3èz`Pú‡ñ´õþÂÂ} n@™Á¡ -À×&-J姮—Áȳ-þ!‘ qq]s»K S‡r—š£"bRR’2Š{´¨ac *8’–’ºÂ¾[Ó‚ªÓF)âͦŒäôŒèˆÁ=)ªW¥…„ä•Vü쯖OLá{"Ýé ‰ˆ kÙ”è„ë±ñùB­f¡Â§~šr& êý¢Ôæ) ‘·§ø啤¸š¤åue®³Õc÷¨äñ#YOvðcïDœ¬VòYi1šÓüóukOò¢KÊ+²#žÕ™¤E-9ô÷Ï(ëQ"š™ºÂŒ +gÿ„º×Cª,JK*(. v|ŠKËV_eD ±¢$ÿ‘y4.-˜^Q☞;²ÂQ‰hÅDkË9…囄·ÒNf ¨äSÒbÀþì”,b6Áï9.-zAsY·ý³¬Ââº@°5ž”’ž“Ó¶Œè¥MÉ¥ÄDÏ“´à»˜šu¶˜‡½Úãî“U·¬ÃôÓM9q‰I‰„žùÅénp¡¤8ßÞ>¤øÚ¤ø -!)åÔc œ‰4I³9\W -_Wý8pN@Z¾LÂcëëiäT¨Ðý’½@E¬CýÕ5£<ž…Yøš¤å3iü™«Ý–÷¸DWݧ&?6‰öó-wÅžz úïitÌš1 ¦¤ôúÙ[úÆWšª—¼î?|U>¥¾P#ªjr}@}2ÿDsöŠò‹ìçuNÚœ&_´ØÙÙÅÇÇ_|CËŽñ8ä *½ º×EôõüöžÜô”ž ª“–§¥<{ø8$.!÷ Å =M¹ eÒwùäe#  iËt¾ÓÎVe·×¥dW1(†¡;c-) Å̓ˆi C¯UËš«‡4ôœ ¬v“.aZááÁR“gHIZ$»$ ŸÏnòúqhûô‚´4:ß©*ÉK˯a*P=w¢n0fª_mZç5—zØ›ûÆ&$”Li1ƒœ{@LIÈ*m9U¡ª]í©INH¨é™;+‰7_R4M¾iùÆ¿½½ýã4þ:Îgh®Q^èÍ!Äöj÷u¢X-͉9TM"50œüÑHKgv0Ï$-»½Å¹ý<Ö¦«_–P§ª{q»Ä#÷äDV­#ZÉ —OHÛßAMÒBê+7óyuå ‡õ¬Wií ?ï{È;´à硽¼ÁíÎUrAZ쮕lo {&tbzžOüKŠ¼­ \85Þ$q¨&aAyöqaQ¸×“¿;R˜Z9¦æíß±Ée d*å]íÂE?ß hBðUIK``à‹/.¤ñ×u{†má¸3 §…½ÚkûÒx—çî’ÄS2ÕOIKgA\+Ó¸Aº¿ÿ²HñÒË‚%Õ©öÓú1D“æeãšÔ»@CÿÖ’õNvaÿÚ•Ò‚aÈîXµw-éâ*TÕèzŸ"РŠ]_·( ȾS j„£¯Â$F¤EÏ›}ôý&|³^"*~гGþÑé㬳"Q徿g44!øz¤וáááËiü1ÅŽ¯wbÀijIÉõãìÕî;„\3Ã'M‹=RÃöÕWHËpEbþª3`Q^AJe£—űì´‹E´bÁqe¸+_k,D§V$Ê+õÇ5Ï^)-¤ÁŠpb¿î²ö ªÇÛ›l¹Ž;ãá•ŽK w*'Ø7Ä»dãl[\ZÞÊMÊw\#>^ƒ •ˆÇÌ —ŸUw2áXM¾iQ©TWÓÖ$FÅy{„®±äìÕž»nQÉIÑÑ™ ¦Ù!ÃxeR0!£²‹Œê…Í¥D?ó bá$ùDF_ó L!„§ÕOêPÕÇÒ‚êäřɩ)‰Ñ„5bT†ÏL0yH|ÝYÚy-k01Üýþ#«”Œ*™lÏáþ£°¸œ·dîiyép#2>928¨qîÃÍI{øôÙÌû%µäéf÷ðÔ¼†¦_é, IHL$´ŽnjD¬´ä¤Ôäøøœ—g÷P¢ö$¶‘¡ À×#-_{µ÷EËñï|ðpQÊSõ+ À4¢}BLŽþm(*¦«ášgø&¥Åñw—–_‹ŽiyóNû Züq¤¤–_%-˜îèàà€ÎG¾âi!¹èôà€ÌU~Q¶D#£±¤WܵÃ$GTüPÕ(´øJ¥å3iü ºÓ Çv4¾ïåQ­¸.ÞýÁÝû!yzL?a~×Äsû‚m V<½ûÀ7»Gù³ßè ±…BÄ`@5e^¶Å]+gr #xÚ<1³ò¡)õÅQÁ“§:T#‰u°{K—ý}ǨS+wgk ¾lኊ³“U·®¿JZ4rI¢ðž Z |¥ÒbggG ®Hão’–`3GÆ8ú°;^Ú¹#–ˆéŒcÓùÞêZdJ¥R™\…©i~ÁéG|Þh¦å›³r0ùViÁ›eÜt2¶½o^xF½Þ8ÐÁsqŽÝ<â NX"šíï>txRãÓ½v|!çŠNέ/L'R– ²Ù˜Ûø²6)5oG‚k~öMUüñŽ=YK‹ÙY¦=Yºg_©F4íÄðG>øéZó[Ú9i1Ä䶌¡ýžÂ„WTÜ?°¼ G·Ä73ÈEiÁV;SŸ8—·MË´(H |ýÒòâÅ‹‘‘FsÅçÏIËث숡S5.-#;¢w/I¼ëÆîñ©š¥àÈöÙkM¢Ã3>81=Ù]èU«“S­ýªèiqf«ÖÛ¢û(ÆZH#E[Ó—EûžIË(Y~&-Š“aBÞk‚0êmÞKK[îâ»Û=#j³wF8!÷¬ ÑI…ì†p{–L{^Z †*¥¢¹b¿â~:H |ýÒòÉ4þ祅µ3MˆO*“èÓCî‘!5»J¡Ó½Ê‰ ‹Š²² fJ4*æ´W`ÉÙtŒ˜4`îÓlÉÐq“½ýU¨~´6=$"&.6yW®ÏöwáètJn°¥Ý,íÜýš´9ߨ´’’"/Ï Ò¢Òœä$Ä–”dG˜¿2I‹’àíšZÒ§B ªïŠ¶‰©3£-ËNNNJˆˆÉ‘k‘ý‰®¬„›fyùu§jÝLmzbjZx@ÄCÒ_¿´|ÝiÀýgCË ý\ò¬“0"\¼$ºùÖ²f’â?é"i Ñ*ƒ÷áµHÊ%-9û‚´À7)-ߨ¢ìùwùã:¸k€´€´ÒÒH H - - -€´€´€´ÒÒH H - -€´€´€´ÒÒÒH H H -ÿ‘ÒrĤC@@@@@@@|ñ±´@@@@ü&!‹¤1“NÓh4›kË …Î Äo - - -ÀÀ±H(“I…|œˆß\Z¨”›ñµn)põ =Ù\à+ôßæ¾ëV7uØTñBÖÞôôì©\såÛ:!m¿÷ÕC"‘€2Ó|ïÚ B‹T‡azY+áÅk÷šg¨˜CTϧw¿ˆa©PüéZ{îk?G4(öù.u²4ìöµÛéÍKø§P ;ÑåéOœwÅÚ ã“g¬üpíÇÇõã»Æ-Ut¿g÷Ú…)/V 9Y u²øóŸmŽU¨ÃØë-üáMÐOó÷ö̺^߇S‡Š_. èáD­ù]c•zô›'ÛC¯]·©j1 Qe{ýxíNQ÷æ¥ó…×î]û¡ŽfÜ­ˆåðèúG‹Œ/1T+qô.‘êd-©¾×®_wŒ¬äk° {© :>ùéž…7U ‚™§×|ÿ×?t¯^ØgéVíƒ}2šÞ—® †ø³D2Š^Y»x¾P¾€¡y°èñíϲ.m‡1Ûï_»aÝ(Ñaˆò$ÛÛâÆõ[©ÍÓØÅÃözŠî^»é•5¨F0L'ª ³¹~íþà6çªó€­4§Zº¥¢¶Sø×ïñC¿=Áº¸¢ìKs½yíNùÀŽ©Q1ƒ­>° ¢+Ñ¿Ûò0 7ÇûÙÍŸ¬–X2ì[ü³Ç´½Îþþ~Æ®[:¦hQ ~ ø&¥…GŠˆ>‘É 웦©´éFÛÜ9¹ì4&(æD«lpúaŒtJŸª}׃h™Þá…|™¤?ÅzŽ!þLò“eë¸v‘LPãI×¢C©n¥Cd>yîŽS¥9ÿvµB –É%였^Õìq»o}4ßü<¬ãÂ0ª‘n>úÎÖ(-zaŠµù!_Éž.ôOë¹P»do,6Ä×'0n›¯2ô‹íqÄvÑc2IKRjŠOHü¶Ä8Þr¼1êí™Ý"Õ^è„QÆD¿·gxJG"j–wb-G$“ɤè…>X/H÷ñ`Ë”› !¹­ë¼ƒQ³„!‰Œ—x¤½Ø‹ˆ§Ó¯bëMÒ2V—œ7‚ŸŒ¨°dîgÇ~Påqi|PP|±¹k‘T¯9f°d Å\q@zóÆùŽ[è`7FãJzÓ±^… *•R)Ï1.x.ª'ìºÐ3iAÅ©ÎîÜu÷ð}Ë]¨]Höóò(ÎöÃ¥EÉÝqJn;ãçáR?®çÆû‡pdŠ•2·êá=Êt£}5I­–f„Ñ.8¦îÈ?,‡'“Œ¥=Ûçm´åU¯*eßtÁ¥ó çÏeÇ8¾“–à‚C¥R©A.g³ïaâ„TÆË 9ÖjZw,¯t>ö{­Aÿοšéâ°ôN’„½máV(E¾MiqùË$é?c*µgàÛ”õ,qc¨ãx#?íÕôTsjÖ «}p£ 6`âøØá¯wfÆûçf{ím£•ì®°Šî¹¡Áƒ©”²Eægª8ݬ‰Üœ~Ýz¬Ir¶ïœï_0ÿÁ¥º84!Úî,#&%½Ñjø.7îML MÍ Z™+ôXQËì{;ÓH‹~½#'½°4%6¦{wa3)cŸÆæŸRæû4)QähoG(‘,ÕúU ’/IËÝܶţ^3ÇB¥’N dÓ¹BRrà åBÍ\Òê©P²;RøVÃjsö ÊÈH Mà«Ïõ¬ˆdÍË#r¨‰¼R™Ûº?Y”ðö¨op¡µ(¼÷ä ÙèN<“–ɆÔÔQ¦^uâoe³(þ\Ï:\™Ù½u¼ÕwÏ*Wú~ÃîßúYÎiIs´< öGÿü秦ÞZÅÛ{êY#C®è±´Œ¶°#-ˆ 3Š€^Ñï&;Ûïr„Éž1å Üíz瀈ŒŒ”ˆ˜,ùù­Ñ[ßÐŒí¡6æZqbÍ°ât7Ä7¢¬,?‰xQôÜþ‚–…¡>æbZÑäAkNDÙÂAÓà^´‡×ªøœ ze>!ƒ´?êìn”jgIlBrˆ¿Wõ,ëÂñlå'®òz—^æ„ }î>™›³¸ç-þ{gÔ C=›æÖÛF6\ÌœÉrôÛû³7´Äg—TWW· nÁ@ ߨ´ðÚSuùŒõâäÆɉƤüeZ^ÝT!!p„ydó×û£mÕ=ƒ]6ò£¶ˆªîîºÚ½™Ì¢·ŒÏTÁY+OÞh¨ënŒkbªâ^´ õ—·NZþ`ËT\üÁ×ɸ«ƒ¡ib×ñÆÃáÎúŽþ^Û§òOK ¦—VY¯SÆ«ãb*g/lv´Ðêëîêêâøýý‘NÕ[Nprvu±¹Ÿýzá’´<˜ È15Ëí¾{¿ééãgn&ˆc¤ókWZ3Ý\\\ÌÝãZUôûܼCÝ|ÓL•ï¬—==£WêR6j³_íç§.0*ëú[‹#;ÙºÏH‹FHIôuqr ñtñ}îòĈ yŠhÄžÅRãDÂY{[:¤½4í¢ Ž»;û…D>þþʼn?íØÞ`féïÊb¿DZÁ²³CœÅøSyqå œµRûŠe|³©ºÈ7'Èù!‘ißð̹ºlÊjY|Õàñê˸V*e-"(šu~KÇé +j鯫d¬dçï¿Ê«˜]O©[‰õô\ž+S°VÞ<´>Õ`mJ¾;\µ€r×"]|Þ7ú³Ó×OJë†rú™|Ï»Oû»^½ê´¼ç!Òþ½51ØóåØdnÓ[w3Ç=Ù78Ôbiéš!1 O #-|£Ò"<] LÖ0V‹{õ0iw¸Ê­‘tÉÁ¡tµ,÷ñ_Ö•’íNkÿzß+þ¥Þ€®•9ŒPøŸ©BšvÈC HGº'I´„Û7¯5¼Ý›fý•?—hA¤Ï–BQøìÚ<]!Ûë7s«º¼l惴 ²}'3©Ó±ú<‚s/l–æ¸*Òk…‡÷ÌÜ·¡…(†²:B²_]––»Ý«\D¼óìA€X0”Úpå¡Q9Å鉟Xƒòç«Üc[õ²5üa¼ßÚèˆl9”/ò$ÎÍ?™§ƒ„ÔºYÎvUÉjÐWüÔØg¤ÅøYTìEàé?×£ÔŇö²tzï¹3—–“­þ'áŠO|/RLý‹M½ Á zAê +®RÿwK ª øÙ¨ŒÞ™S¾ aN8W,á›MÖ†÷p‘ó=äQ„o4~ØÅ]ë íi[jüõÚÿ>ιÀ4dßèJ¼QíUÙõlsæêSb»ñæçëË9/Z)cooo{楕](]ònÄDÍ'ߵ̒œ?&ærÛ³r*~Ú‹£(jU¹Ãq²LA¸kW¢B~Qoyï&©úÒýJ¦¸z9ÇÂ:I`<Û¨ŒwªÒ~8j=÷óÀZ&JT?¿ñxº÷–€ê5\Þ‡2L)âKÚ+ëÖ©\¾ûÐy§Jþg+äý¬¶¹D V}دNû~1Šjy< ú^ZæiÒsŠÍãëá€oJZD"þ|ÑÍÃÇ=0‹%Õ餬¬ 7·‚¶yüÿñrò@€—·—oäìþ«ˆö”&xxxùÇ–_Zõq¾wÓ)j½<< x!ªã…(_O/¿n’èBŸAYlõóòôpuM©è×b˜‚6„Wç>EW^ØR'X ör½öç®^1{Õ|sº—·Ÿ—‡_çÒÅu˜;½%aQ©©É·'Š´’†ôÐØ„¤¼$§Ü+¤å¾X„·oý<Åôc/s}q‚g©Üs¢ª¡‚ÐȘøìdÏØV Õ5eFz{yùGæH´þÓ‘Fk\=|=üSøZD%*ŽðòòðH­¼|¾úR_<¿oîìY?½«:^ ööpquk™%¾[“'£‚Ãâ wí‰RË÷îNž>85]—× Wü½<Üý#Ö¸ÆÑ Þj»uð+ÝUªƒ:_Ë;-¢S*4x·þ i1`úžÂ°¨¸ø »ØòD'¯Šòöö I(U]Ìå®c£ È ‹u2öV°‡»ŸWTÖKùÅQ t°*ÕÃÃÛ;¼X¤B´rŠ?~ú\«GHW¶0ÝéÔÙôPOi*ÞÀ\<üHü •#J^~°«·‡GfÝÞü”ôño/oŸ±Cå/`Ðs|-ÜY¦~]}ºNðóðñôjY:ÆLWfñ]ßÖû)9ÝÚ<’÷þÐæÊc}Ó‡>¨AŠÅc’üÝ8›äèímól ò®auGÚå¼^½²rÚtÓ-‡ZõÙY@UÕÏÿÚ¾ô~NVÇt0=}/Kõ)®„ÞwZ„H2-î­ò”go)yk÷ÍÓŒ:eš²w6¶•È¤ã·¬ç†[ØÓuð‹À·%-pí* - -€´ÿ%Á¤›¯–Éüoùн©ý#}kÈj±°~H®ƒk~iá¿m+pw÷v;[ˆ+ceºùx¸Ÿ-Ä•¬×:?óÍh>ë/zJ<ܽüc+þæBÜÚÄ@/wÏ8bçÙBÜhãB\ÿË qù”ù ãJ\ìƉ³Å‰ê“UÏ'ú¹Ÿ¿ª;^iõòðñô#¬¨/¼§¢ Gø8>² 7]*¢)tºëm\_¼-¼âR wÃÇìA÷)^:VŸéŸ‡à|žòâòZîF§§§oì2[¡ú–ì(Ow¯°´FÍW£`’ƒÞ‡?XnËPD%* ÷òöðH­¼¼~•k¬.0—#×#Jn}J°§—WÊËÉÏ÷Çëýu~Þžîîž³‡¨A[çzËËÇÇ×7h‘{nI%†hª“£ñÃöt±ÿëƒ4©þýôø¼š:ü¼ô–¿e?ü[þl.6½ŠŸêïïçšPry!îJw‰›û»…¸zùI®qu·{Nóô¥+Þ3#ü=<<|¢Ë„JD+b/-r6¥ôeGCA¬{ln_ä–’Wmm‰Án飧·¶×^g×Ï0§“>/-*Þ¡w¬6‡øº7Óõ§EšäãfTK,ÐÆ emõé¾Q•¤Ï’€}¸¹6_™YÛ=-Rág !—Z6NÓ~«Y1¾Qi1¥ñ/Ø›:Ý$ž¥ñÏ^å ÎìÆLñ‘¥EÚVÑ»63Mù¢4þ;³3+£ïÓøw/¬Ï­^•Æ߀¨¥'ôÍØ[|dþ“y^iE°Ûó¨ò׊ó3Pä©×Áq™•UU–ÖÇb²‹™ãîl?i¥Õ;´à³Òò®8îËjž?W¯òÔî‘eNiE„—Uxq£5”ýrkf\°‘‘?¸u¾K¥;ݳڜÞZ~ãî“¥>zùzfqf~¥;¾áàœ*hYCÖÖ•å–÷Ÿä÷ΛÒøOÎl´]JãðÇ’+H3#üÍœ¬7KÃÕ11“B|wó#ügþVÆ/>u.08óTþ³Ž¤Æ^ÞRNô*Á0LÇêŠ4æŽÃŽÛW”ÞtEŽ²ÁâXâ¬1÷*ߊ&èíáéU#-ε#Û*µJ$cº£³oyðÒ·ŒJIÞ/"պז–;ÀÝ~Ô¸ PÊ» ÛÙçEËxÃÄPŽL±jºa"s±Ý"}F&ã&…F\¼›ªí"Fçvl(•J=‚n´çÕ¬)eOßô î&g G¿ZÔë¤e¾v¸´¼ÿ–ƒø·|~âG£ ¥r©€‘àÌÑ!§®L.'O6> êÐþ"iÁTëó«g éD|cÛ\éŒÌ\SéQ¦£ÍOpÄï'QÅÂü¶3¨ø”ȎѺ‚¦ñ…ªàGË4‰ÓìÍÏIñ Ššü|>m4¿u¢¯,2— eo-‰®°náŽ}PûñÛâ—ƒãôPØ­Y²ôCuKó[æ…Œ½çÝ9À´ûó³"ÍUÞ‹a'¤•=ºÀøX¹á—Þ(U(V½{ö¹ð«À7#-"uºéîµ/¯¥:üÿä²×ñ7®Ýmž¡â¿‚òµ¤®}÷—¿~gþ"Fƒ «í9?]û1€8¬ùì×0T7^zëÚíôW‹þLÍŽw1ûé‘Ó®øâ­_¨‹¯ŸÜºvíÆý²þõ=OçUÓCò„ýß,œãlbÙ:LÊZz~û¦…Wæé¥5Zó­kßÿßöÎó¯m¤]ØÿØÙç ?ŽHè´ׯ]ÏnŸ»zèEe´×ÿú÷5’;a%'êå=+++׸j ë#ŠPÏ°“³ÏõcZ2n[?Œ ~diL‹¶ ÌùÇk·¢Ê&uñ‰‘NFÙÇ,ÊMU†Ý¾s/!É;8½ G4§¯]÷N®1ëí ö'›¬­®½­”’¦dÄ:^·ú¥Œ¹nº¡|òî?XY‘çóÓ‡e.ˆ‹í®YYw/óÓƒDjãÜ~}øŠBq!¥å,Êÿueã YsM·¯YYÝzT?¶‹ëT%A¯®[Y=thñÿ8#¯‡¾Ç”‘ŽÞkb- ‚ 8¹ÃÏq‰šLƾÑÿM‹êÍ窌¸„NÙnÿóåcRŒuã”c;Òò‡3âšHKgôëxúäÙÏÝEá7­®;†•(þoMÅà{—˜ò ß B+Ü,ÍJ &Ô¬›õQ| gѨAá™Íš?áOØhqè«ç~,¬H H -ÀßtcFtãoøOÝš Ñ1ç?«Låû`¨:@Zþ×ÑÅÄ–Ètê+„xµñùÓ‡-³ÿá>qu3Í…#;BŠkyQeCºï¡²PÑjˆÓ“‡örT’—þûÛK‹¼¶TSö¤eµ>³xBÒ`&-Ç­¹1é¹^NÞ+GÍѪ“g^FlDn¦SÒ#‚S2³hþ~å“'Ä)V˜”‘áåF(ÿðëu‚Xj+ÏÈÊIŠ¤Æ·š&š@%{ñ1q÷oÙ-Éô32ÆËÒ³rr£‚Þ ò¿0:PççŸ!ÑûC… ´Wýnø]ÕéYÙo£ƒc›Ötå¨}óë OŽéLSÄ'ßSÓ"‚ Ç…ø)ÞY™éïj_Í1;5\UéúKz)-lïìž/H ¾Ø•dŸúqõ«öÕ—žãáàµy¢EE[‘^©Ù9%ÓW‹Ôp§Cýü³òòÊw\ÓúÖ?­¨§ªÑô—H©Fµ§š[TçÞ7ü|Yïÿ}Uƒ´ðÏoŸ’„Gþï:;ò}Z¸¤Ÿ$lªÎ òG*ìC»0Õ¼GBî_®xóaýªi’8"¯Lò÷ó¡%\$“#„[Ã?{24fÍ#”®zi¹øà`¸âYÔ€É FÙþdàWJHô‡·g <´[E±–¤å¬ÉþÔ]¯:µNÅH¡Úý|Í/(¤uxÃh *Íæ—‘=¥ê`äŽMÊÙŒ¡ÉúH‹ÒRîpƒBuw÷i[<&¥ÅÉÝŸäãœ"E,È‹|!5Ó -Z1+†àçãŸÏ09B½îœIV&¿Õ£´}¡­€Z;644²'øJÖÓÞÌ°”æ±Á¡1®LsŠž$¹»Hü°'>¶tÔ¤ZWê2=ž?~ü&]§BEQ.Ï£B(.®Ë<¥©´Pï!¥Ú©I½´œ5sáŽèɲ4ô¦±TÜT´w ëSèF¿"å®4‘ŠÆH©·Uóò3iÙ\QVD)2ž}þ0>+0•[ê‘~tc]n“†ßR´0tëÑÍEmG„‰´hD Î)Z¦5ÕmM¥«¡½®œ£RÖ½a'–å sq#¥EeÛÛú(³F/£üÿ¥PÍ÷§Ê¾‘Í—D9‡&ûx¾Nd,˜){WŒvxZî§êÕÖûjEEÜt© zZøçIËÉF_T&ò|yî]lå@eLÖÔ’?=+Ê¿×0©’ tŒL}U²kCK)ÿűô¬Ñý+vq²Áˆú°¬P(Æ[rËöòŽžO{rãÎÓ¡ÖR*ýßK‹.ÐùîÏO½”¦³S™¡e›êSBîì”ø5iÑ•FÚܸýà_I”£ÔñîÔ4!ˆ\o?®É‹ŒÊ¯}fí"F®’ºã/+|ÊëwóJ#¥Åη\Cœ.wÄTmɯ‚À5jYi!»Æá¿“’øî=Åq{9?¡q¢ë}н—Ñ«‹¯œ#…ØU k>ÍÑ!(o}¦ýþë<™Ž8œe\¿þÓ ûÈCK}_sUoߎÖ{Ò‰B݃Ä©f#?¹nÔXZ>)zÖé5cŸ¥ENÏÇú=,´ŒÁ·¥á÷¤…5è`Œ4è¶j~—@4èH’¹Š(ªäùa˜L¥ÌzpÞnN­ªKl-”I»C–)k\Pe?S´4£LoòCdgéÍ3 Ž6Ç:^¿~Ý-±M‡ã‰¯ËêJcÖÏ·ø¥ŸE92¯î2Êß‚xGu­œä}«òæK"¢ê¶qDæàšeœcïTÑ2¯Îx,-©$0…&ý¶QMæÕ"Õ¯_[ä d€´ðÏ“á^»wX¶˜{ YJK®©KJžpÅ9a¾£"AÃÅ‘ÙM3ú„ǔ—³?U±ï…\–l!)­m¦¯42zBFAÍw@pÕ«·÷án¥+JSûÛ9/ò¶¨.¾"…š?]DËh¾ZZâBÈ*À…½¡%½FÒ˜;\Çå ÝzŸTÿNágõä”"ü¦™±<ÕJ)Šºèh²4#i’†ÝWõ+coZ~ãS3®a¾{;dÊBÌå5²Ü£,ðQv¯ªrí- ¤Þžü\»±€ 5Ö¬ÎÀòa…JÑû>¨“¤{9µ®ìÙÞv>PYZ>Gyú2Êߌç—Pû ËÖ¿à¨ÂÉ5Ed"-µƒš|)õ–²½]“nmT™1ák mBÇkµm‘ -üó¤E|²çï¿Èæ7Ñ5Ïp83ŒGÔ:>{‰B‰aèrKjDƒ#8KUvìí»Áf½÷{<Ç•_± 9gÒ!¼”u,Þ_[R¼µ¤B¨ƒ;"ß•´ˆE¼e&ÅÝ#¾lH­_NV3Tïáîß¿Â;Ť©îçDet’·ë‘z_w¯ÆvõÍŸÀÖzÊü=݃âòOP|´±ÀÏËÝ78aS‚˜6 ò}ÿó=NË; “¼=܃brU¦ÏθFP–@ ŒÈ O®!Íçp2ÿìkq¹ &[N´û{¹{Å®œ¨Ï¾Ù™ÌWXê¾@…9‘‘9'Ia¼>+³r|Ûdß=ÉI4¿ðŒ=…GiÅeqA^ÉeLÌ,Çê|WúY!™µLT!H§ùEf癦ñ?=eÏ÷ø»{&”iq²ÂT½ïc=Ü=“;§_©ZI}f¸»§ßÀ¶P¿–ÐB§¯»{@Lþ¾Ô nöÖÔ,Ë Ò"+ÏIɉð Jªkqci9Ÿ=¤j«UDéÝC^U¦©sµÒåŠÌ^JËDYrE×ÅqLü.<ŽùêøÞ¤êäÿ2§åû¦<Ò€´€´€´€´|iAÕ26‹Å;‘ëh¸ü„ÇbÊÔè)A¨DG‡,‡‚ohbòWXE|eL ¡–²Er ù³F&b“¿pøÈÿ0KËø,¡BsõV8ª<â²ÙÜcœ+þC ªä²Y—Qþ&è•áUñÿþ£QÆ÷Jmz–ŽàÀw.-‚÷áî%ýïï)ûã¿=ö즻‡£2Z^ØÅÈ ÷ mÜ#NÑ·Ú®'ϥȻ ­á•Í›¶®F×`„ –ºšZ»?ÖæE¼Ì™ÿŸLVÐo:8>InÿtõfÊÍÎœ¬øGO©zU@3¢Þö0{½ž>ú°dÒÆìÖàôªšÌÐ ?EÓÝ*:{=~µ^æ›´Âøb©gRewn¨Gö €Ð©}ÜšºZ=^¸I´&'¤kOqÏëq±oY”` ~ZV‘ãÓWÓbóóÆrCÜéLŸû¿Î²UÚ£•ÔŒì{7žo+¿’žL8]áä“4Ò’í–3¬ÃEÞö­“‹‘.Í&9x ~O¢_Üû–¢X·ªƒ+ Åê<£ ›Kâ)q]<}”=É(wê£l2pWöW–}ŠóxY8ÈÔ7C”©¦WÊãÆœš‰s|Ú¿%»JZ4‚©1’á"·[#Ûb {:=3ýæv³Y̤{9¼*lêêýØýqiÁ55>O²˜Œü˜ Æá·Êˆ‹*Ec£Ã^OmGè_ú¿™à÷’Q.ú#Qià -"ö /5?%ÄÃaÙ­³³­Y!L!qŠ§û/Éñó&»9ãMö¬N6áÖLn¹Éðm\æ_Õ°n·yV-â§xw¾ß°ä|z'wáÃà^“ä^*þ*Å7²¤´(<._¢ÃÚrß—e'Ddvš>8ê”­¹ñ;3ÉiziÁ²Þ—•§†Sk'-܇1á'{êïú7ðå\—w›&ÏøѬ'Ù wòîÃ(…tÖ'¦„<»“>ßÒaã-µG÷på˜rƒáøx g7Uá×Í1šp«·ý](d!²™¬Èw]gÆyyšK ®Xð Ï#·õô,é?AÄN÷¿*-õ ~Åó2‘;ÙQX*I®ßkžZ·Öž\;gÜ¿€d8Ùôîªáú×)"é­È-)+‹ñqŸÝ7š®N ¢ Ÿ¬ÖNõ~ß3ç4­ô<Ê[; K³¥áÃy”¤Æ Ñv»gå‚q”/êÿ¨ß'4÷TvÁ)uãœé–Ÿí(Eïs‚¢ò-å;E¥[/î{Ÿh «.¨Ø¬ž›K‹’7HÍ.y—™ÞÈ\4ô´x9Pâ‹rýs‡LfÇkN¶ý}‹K #b³D*ÑëÛ6R†=vëA¬òÛuŒ„.ÖÙñ¯•}”mz.¢,4žÑ-?˜uu¡¾/ʲ±ñ9D Ò²ÀjÉ‹/í_Ç î„|Òr–·:ØiõsFÜejõYF\‚À2ã\üFYJDŸ·93˜ºôµŒ¸¼Ùü„³¡Ô”Κèò}J³–Âp××Îm+¦‹¿Ì¶¥ù•u1™ÌdªãA¥‡cCý=õ9Þ”™èÍz_iFû¦z5Õ -„âxg¨ŸÙEôOîüª´ òÃ@Oںب}9ˈ[W_ÔðÌÚåø 5(£ì}°×ÁjîÛóÆ‚±ýâÎó¶D׊¦J7õnYT3!8z´3©pEb$V¢)7wZgðÃÁÁjJÍÒr–—üfÇ÷KK~¨Wñ‡ÛˆŸgN‹bí\{ÞkO_GêË(ÿ?¡ÓPŸ=¯.ÏÊd<üá)G­;Ú[îg2?ä:•]¦9-Ží¿î12‚r*kì‚䵡% }”Ç-D“sC}_¸†.©yŸÞÅœ ÓG9Æe£ž–ßæîîLêË°’^RZî%|"}¡:%¸ÓÒ$Ûí¡J·ªó%„¾$-âÕÂ;/¢—¶7s–ä)-9¤ÙjEο¾2Ɉ»Ü›ãU¢¿¨ÒÃýëö”-‘Îi¥MµïâîX»KЖ´Q¶{^Už”Ùlˆ²Q=L·d%LˉS4Î/Ð -OC|^…½ëƒ{ ßqOËA·wh6qJ(’R'ÆSâfä¯Ù¡¾SÏê.—1Eújÿ“õáÓ—z”wõ¦GUolÝ·ŽW<ɧfd¯ž_aü ®}n3ÈA0ÙÎͽ>–®û¸Ñ8rT6\lœ\Ž@Ž]ÿûú¶CxÃÏ^ÄhN˜~yú(³>ÒÊ?±-ƒ|®0 ©ùx­. Õ4Ê¿¯_ɉP:›’V7BJ‹]É.æ숚=³E ¤*Ê}÷â Ó—¤E¾×èU;GFt¾=¡hK3šê]<~‚£2ß»6ËÆÕ;ÛšXË6êRQJ%ÎìýßÂnTãŸ;ü‚ü•0Œi"À¥§Ki1Ùÿ]WÆÙo„I!æ2“¢+¶<ß#±/l.¢,@ˆßo9R÷¶pKKœâ©aag=-i ~¾1ò‹ÿp¿?f€ïBZÄBvÅíãÊvº£uÏŠP¸Òmý*e{…éFISj%5å­«››ÍÙ´W±½:ÂÏÕole)êùýõõ»ÐJöÛÓæV¦‚\=e:]߇ÎùÕᦜŸ^Wš$;Zì²vNÛápG::Ø*qàí»«'Ú©º¤ß̤C­V+Oz˘DU,?'‘ûæëc&-8"Û_èxòÀc}‹`Òüš¡¥ýý‘Lmò˜ºXà˜\=8TýÖ!oÕ‘Þ^ƒ+kñOœÜ7^µ@ûmË–›Ó(QMÛ8*vv šZùêð‚§2~Ð&4åaŽV‹ìé#G9¬ƒ`gǶ¥…É‹ \•àëÁ\ÙxkspKB`šÃ­E;ëgCë_ÛyГåY±;ÛdÕ¢ÕpBlm§÷xÌJhnI{»^áQÐ5Ýžÿðí "› ËÁy¶³µIF\Ò.fÓç¶MwFú–¯á¸ÂïÍE”ÕÆ}2ܦ†î­-z¤KdÙ "Ùre³…uŸÆ6–§<ŸÜØ‘‘Òbu‡²±¿Fõᘭþƒp<üÞžw³`*Öúä¯ÿýxj“­1 Tɱw[ØÞHó}µ®Ò¦z¾‰¢ï-¼ë\(3®1áÆÀÍ—I›îXO !$«ó++¥ñ^´¶ƒ?×Hclj”þ…fï7{Åt yÀc… ƒ‡{‹Ï{ï¥/Æ8Tÿ¬Ë|ûó¹‰%c5!-¢øì\\'rþ‚«?]~‘\n “VÞ½fq燳®¡­ç‰qMsà˾勷u/Ô?Mˆ¢\é^Ð9cˆ²¾I'/¥x¬‰ôãN3~£Tì¯öÙÞw?=´Ä_éÈsOíÓW&Ì Ð8\€ïKZÄ" {µ†^Þ6²¡€£#måôš5Ž„À5s̶Êrz}[¿ÈÐÖ6§ªé•}³_y`%ðÃyf%½jbO>ômM÷WWЫêÛù*³[$îM÷’»`tO¨pBÉš®«©é`2:æ,î;žœÜâ“_¬W×ÔŒŒõ}3M(Š‰—+ég0ĪãæóŸé“«f½C:E_smmsßY#"Ü[¨¦WtLìš[¦:i­©lìWéôϲܕÑ*zåÐ"Ûü)Yy²_K§·04ø)Ȫ* ;¯Ù›v¶ˆXË5ôŠöÑ-²­Á•Üêóìg]ÝÙ‚«gzå• úUžO 1k±ŠN¯me«ÌÆúꔃmõÕ †6_Ÿè®®mš›ëZØ=6ïtêl¨®oTÊlN[Œ2)&º›Ëéú`ÉQÂåþ³(›_[“ôòÊ¡eé rîcl¶¶ª||ÕBh}œ9˽ÈþE=4p;[rw ƒUôòžÉ ò¢:œìíd~¬¨ªÝ›wÝ`³}Uåô¦®Q¥ŽPNÕTÐ[>NÿéWC¸¢‡ÑyécäåQß¹LÖ ®9ho¤ÓËGÈËûü¸%-M—qcÏ õŒï^ÆkŒÑp|±¸FÆ®iš<_ëœü¯1Ð6¹jyx˜˜µRÓ¶x~)èBsù:÷rÕi[ó|wFQÖëÍ£Ž¯D V®žëm¬¨ï ;$åm±yW $P)³¹E‰âúaÕŒ6 ¤ñà{“¨ø“qˆ@5ÒÀßN³…iøß”o«¹¾¡grÅõoÏw¦zê›·xƒQuÊáöV–aíÉî<£¾qh}õ˜åÑ’Káôç ¶6ÙWßÐ4ÅR˜|3ÝjšvL§moÙWá)i1’'âÚ¹°žôâ—ÞU‘hµ÷¶}üæb+%C­ÏÔŽo´¦>~ú¢÷XwJ(ý\¼‡æh¶÷6¯œ=DJËë¼ÁCÖ_$?%pÞ@ºGXÞÊúêø–Ä\Z^–¯œÈTgŸlud?yö²S¤Å$OK7-‹ÔÅ\BZÓÄxcj¬>!‘Mó–â¸æ ¡¢¿<…BJ .î÷Ëû@þi¿'¤ržs¥´,þz˶m°?ÌÝ]€é2<Ýc’Âl_zN L©ÑO†ýÅyh¬ÏÛ;JŸla'—uÕg‚´`)#nV}ø›õ‹Œ¸ÙÓ«®áõÙQþ݇ÇYÞn[BuMj)-¨!#nnxØò×2â’Òb—ð%N'›ßm©"dµ/íLüò[„I¦qRZg­êˆÓºôPƾ(ßßsõH՜ҀÙÚC¾Áiø)!Èj™iÉ §xz°ÿoŸbÀö7ë×i*á¨OF ¹åv‹½åUi>K‹}"“Ô“©–”¢mu–›]ûŽZ§âÙüdÏ2¬BJË“½´Ô§‡6m²‚ƒÈÝÙ=´v I”jÀ[€¿\«Ñ^^¯8†j´ÌÂø ¥E,Ð\+û'¨­GvåòÝ‘;&ªßÐ /“½žõ´œž¢!®oýL¯‡YW®òLJË6]ã£ánnÁn‹ñ‰-ï,¶önTßôIiù÷MÇñÙ!ÏÈË\ìÐÓü-Àx^]Ù 7zKîºV!`-¥´ˆ´ ñÖÆÆ>O¬3,g"æíoll‰ŸŠŽØ2Ãk•D°µ±É>–_öA‡ª÷yG»Û›l~=AGy;›[;2ÄtN¢”ìòÛ›|ñçå’%Ž…¶ø«!ÐÃ]Ö¥¥hd';,¬Öð×J Ô - -€´€´€´ÒÒÒH H - -€´€´ÒÒÒH H H - - -€´€´ÒÒÒH H H ÿ$iù«Ç‡· endstream endobj 752 0 obj << /Length 1815 /Filter /FlateDecode >> stream xÚ­XÝoÛ6Ï_¡½É@ÃñC¢¤¶èú¶K‡Yç=u}`$Úª’ëfØ¿;åȉ4K`À¤îNÇãñwÖÞý´<ûñ­ÒQÁ -u´\E*Ó,MÒ(Kr–*ZVѧø÷«K3šÅ¹ÌòøÁ:š½ÛÕ•]œ ?#ÂGÛX3XzPL2±ø¼|öfyö×™€y$¢L‚ò„e<‹ÊöìÓgU@q¦Š<Ú{©6Jtcý~öÛ?²¶˜Y‹ºg\edèrã×Öñ×…LcÓìÂc¿Â1lj¿¯»ªG™==õßS46u[¶¢ÓU¤ 4Q®‚¸¤aìiÔ)KUD®G;°Å¹Ê³x¹ÈydZóe. ÚÞ…ÙŽ—ku|Ýï\PìëjÜ4AsÀÁàs!X‘¦äÒ”òØÐpU¯×þÌ`¾|}y>Û½NcvP‘±B©¹'A~Õ»ÖŒ4÷†Á8NÌ#7ÂsؘHãë=N{W=÷àþXÝ:¢ÉÇwǘÐ9ÓBE:ã¬È“{q‘t²ô€#¹‘NsÆó{±Ò’i ál£ Øv—2[¦`\ˆù2HO2ÅŠ,Ÿ;­Njž |{ôÐÖ2ÊÚ: ÐÖZ2D ÞÕûçŸ~øü²ÛµWÖ½zá={j{}&Š‰<ÿŽº{^iÆrPõ€óº7–µ*X6øÍ7Ón{Œ¼Û€«»# »]cŸß¤™+–zCò ãi"YS0ùÇ‹VæÑÏ=ZÅÁ™Ô í×Þ¡w‰o2&…› †§QNêâõ‡KÊ€_¦P ø_ !È ·\1(X)=R”§ñŸ<åÝh]g1s¿î»Ñõ ±?Øa0kK—®û²oàA²>¥ÇÐãÖ¸‘Þ«0^\.„<ÿ",j‚T=¶Y«êúÀt¶©Í•?&`ï7¶›^"JÙ·6¼ãs$Œ¼‚Gøc]Ý­I´Â s"›áæ‘·v¦ÅM™)×Á;Jèx=S7 )WÖVW¦üBOˆ,}mBÊÖõ`t;½/KÈ´)¦BR=’TÕÛ á÷K/ڛź‘¸sm°¶ë[šmÌvk;Ø ”G¥d|…Ø…—6¶Ù§öë­ÍU¼ë*ë†R¿w‘Êð/ 2÷´8Ò\OlEeŠä¬³°(ŽñÅŠ˜tRuS×$„g‰ŒÎ–ˆwÅ,MD†;ò "cX7¡Ò‚$D Žƒ›"ž³éPçZðÜ|·šv‹T2Aó"žY4¨3-`/œ,Ž‚ýtĬêžÄ vê]!Tñqgƺï NKèûºiˆŽe)ƒíª ÿ-®Ñêéu‡PZ’&xˈTÙa¬;¿hxãä™î:gM¹ÁHñ­R×¾È ÔD € ­‡ÁÛõ»õ†ˆ„iËøp^š­)½³P˜ZÛ×^ãªÀ ¦Gø «÷Žx!`iˆ0É"éÝ´;³nÁᶚ)8âÐ2 ›~×T4§}a?â;–²šÁ. Lþ@½0¨Ïò¢S²ëªãœèBšz§òà[$˜…?¯·ˆœÓŽ_-¸¡‰ÄU‘êvÛ;8ú‘%¤[Øõ@LŸ7jè1äi ´‡DŒR÷›ºÜ‰¶•îü f,7Þ—@ Öû圳ö¡?-r~¢¿šmnæ~ØÜ¡tP½{C§<»åIJ¯îÐêàq3¹þÀì_;ëãb^͑ï.­·n"°#% VOx›P;—èéE?=á½9Ì}èÐÄ ¹žúyˆˆxØÚ²þ“sYÒóTïE|³Ö,jÓBÅR™š nÌ!°f•Ð4ÁNhr‚E}È7ùË2E#dãáTRÅÃDY®(-ÀX6ÆÕ+ÌÓWïáÁo2#ÿ" ~ú­ô:%4^S`„®®ÿóý΀ĘP7¥Ð+î']ó°ƒ5&eàJhÊSH?Üô†DùÛCñQêŽn2>Q„í-P¡‘ùïDr+¼›“‹|ÈõiÂæãoN\ˆ‡ÇÜœ$\7´Ìï¿@Œ ûˆ›Ól™ùÍ)(~š›4ß°¥yêxÞÖÝËW­ùöâp\p×L‹¹È§—ÿ¼zªÛÕÃy÷LAE"Ÿîv%“„ÉBŸ¸]-7u€¶GàœÕôý—áå ÿ4†| ÍÖÐçŒÓ·hƒ¨àB³J™Pâqh–P<îVŒCóÍ2GßHñ¡Yj&ùT_ þX€>Ø?w TèäéðÉá¶Îó{nÿß™8O~ê5´é;wúû€.Ð!S¦²|ú8P„Áè£O˜)Ä’þî/˜w¿³‚ŠD21}3€ÎÊ—–2þÅšjú¾ú+ݪN~Cˆ’T³BJXÃkÙQwûû³É^n endstream endobj 748 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 117 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22872 /Filter /FlateDecode >> stream xÚì}\ÔI–¿;n÷vïvvï>···áö¿aTrêœihrÎH’¤$˜Å„(˜Å,fÅF$J%çœ3t“º›Nõÿ¥nºIêÎ8;³×oÔùuý*׫o½zõêýP“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“š¾’Éd3O²ï@}æ«á"S®ÿì‡4ü#òœ/‘ò[ÅóÜå¦,þv‘jÈæ©®ìcºå£Fü;Âóø¼Ý¨Ú3ó5D©«Á"ñA~—}m­á÷zD>+Mçmø/ýÕÂOaŽœŒW“sÂÅCM_TH¿ðñ:Þn^i‹'àttôôu ÃbÎ Á5÷7Ô_®­¥­LZZÔ¯¡w™qžË‰>­S3üSvk»†Ži5œ!Èãjë@ÿ!´|™þ…6(Ójã?ýUCK%OͯþzgÊ!e£·†ŽŽ¾œ 4&NÁwò›ÐšÞŽ]½LÛèdñˆrõ÷›üOЋqå~Î9õç¿}…¾¯Ì‘ù©;õ6âëi1õÿý™b¿M(áÉö ë4mƒÇrÆÖxîo=ÜÚ—¸ÓpwI†ëü^ëW9øŒ+™,Ï]Tôè| ‹ÙòåË–ã˜6{O^ïÊù ÅìOÑÔ4nšTÁŽÁ¢zZË#âÀ?Ù¤¿~¥9§OL.\éjÖÿþ?}Vè¨h¦mýOâ—Óm&ÄÐÏFÓ¹#²ô¯>Wû¸WCEa#¢=3"ŽkŽÿ³Ë1* 1]¸ý+Ɔéù£Ì»„öÙœ{”â£1å¸'Hæ_7æ_Iæ„Jcl´<¼ ÇÍ#€!3ÚÚ¤L„3éá׋æo“d"̆í{ ›äC/™Ëq‰Be&kI;J°p¨$­³\¦¦cþ®ºlé¿S9äé!]]Nöüœ¿žL7&8´fºì¨ýòµYÊkÜéMvöqtùýð Þ݉¥›¸|,Ú¼7×#²hô¸7½Š,:S·‘<×!UfK .ô.žEAãZÃ\0?GÌ‹³d™ìätj|B,•-*Iˆ·Zh®ãMyÛBýœœœý¶½mŸÄx¶û•µ{È„x(qs€­SDtOÊž¸zzwð¤p ]’²Ë#".oaΟ°×áX9'gT.¼eh°XJɃÅ×F'ïÐÿF*^•µ|m2u´O©¬Z’žUÆž{ó‘mö:Ì{)>äÐ+ N‘vf“è̵¶–‘r´a.5º?øIÓ¨Î\‹SP{fÈÌÄZ4 mâ«ù‹æ0¸‚¸ìP`¡Õ—ß]¶g] ³³“wpTfë¶áRGWïîñÑó»BììWmŠï€ñŽbOWçÒ^‰bDÅûøl&ß’EÛYïzž•ûúéWnÃÙìY²MÙíX#‚éùû/ ó3÷‡:S\·Al³  ?ÿ‹÷Ö –eì5Ôµ{Z^Ý>>3Uù½­ñ›]9ö[Šß•CÁ£‰º¤Cï½zþh§7Í<âÔw½ñ¦®k·/¯m(yu…c Ÿ;ªÚç’½.Ž“ûÆêÜ=£•Âa´‰¸Q¼ˆ&¥æ~¬!Ã9#9o¾¦wc/„6É]óƒò|hÓëk´tÝS"Û¬±_yBÚ÷”©O¹ßŒí,´©9é£ïuz踺RÇa¿ìïF›¥œzØçÁðÜw­Ý,´¹Ø¿˜È¸Ú@o‡^‘5twž»Ÿ“›s7i‹¡u:Qú2tñ Ï°Ço*kŠ¢lΟY—#‘”˜ß./¥ÎVÛðVÏ4c¥¯ïm]í¤O´ÞâZý€`ꈶÚë»m»ÐÏ«vö‹Sam4Èb•ªÃ9ú†ä„²a¬çÚÏh»wÏÉþþÑ•–ÇPî¸ldºû-6QUj¦AÇ}}=›z¹ âÂn/{ïX‰ªßUìjcI420bÚ¹ð ½íkmD:ËÔÔd†8V%=“ÊNj…H"?®žË-ó¢­Ž>™i¢L4Û¨1¹lc浡¯¯¥Þ`s“Uè̆ÑÆ/‚ÚÛ{MÝ7‰UÑÑ(Œy™ÑÜDØ@Öê` s¾A†Öê“Ñf§z˜Ì1ÑÄ]mÏ’m¬uõÉ,Õ&Øm›üHÙ’¸moáhRxâî4ù[§ ÿ©ŽõfíØ‘ôàe¦û U vzîÉØvúVˆ®ÛþÍMù4›hÞæÎ":®K—ªŒødK¶“•9Ñq‡cWwpÑ…Bc<O *ŽL±Œ†f™ä¼'ËxÇí¹åÕÞ‹'˜: ¤ÚPry²ØUœÐt.ÛccX/:ìa­@Ž!•¥ÌU&t×£Ó‹Ë6ÚÑ{kmÃåS³dGˆ©”s¤[‡~¤l Äxga1<à2xD@‚õ2Ÿ;ÈV™û‡§$¿ïEG„Ÿ³ñoôH¨žm)+´ì =*}­m½^úØIÁö¿‰p·c³ÙÆÆÆ,:±r ÚHª­ u}¶ÇBèHÜ>[ySFÍÕÇ÷M¡™|ÚŒ¬6ÒÝòftÖ2ÖqÏGÛü°H^›Ì[®Á"éìM«L"OU9›9mô·&Rè17ŠPÙ&øì3Á8OA\O$Q:ë׺â &D¢ß©ÌyXd>´±Z¦_:¢”%”ç„C›Õ2É%žJ¥Fì9ß=ÉrÚ Ûš¼vÔ³¡Y²ÍX{:ÍŽp"L ë½Ö§ü² Š6<‹_Cw ÉdÊhc¾ÌàD%oL¥ “²CthrSØššÀÁ6¦ VßÄÐgVÛFG|*ÝrævH.U™é=†–#™p‹ƒI̵âŽiT~*x ûÒ.#œeý4˜;âÓeö–ë}-‰TÆáG˜l£EJï(š666’äcÎÙ ¡ôŠ‹µåæÜFÕÜ'p†hÃ÷§íÆ»¬…‹i½¨Ï é!÷´a.Ã¥¶ð•ûË›’} Úðöú^Š¹Ûˆ ªî¤õOŒÍÃTD´£ÊŸpà`#B'á<.µchCdäµas°l×Rr|&!is4Ô¼Ø'>d÷컡¶‚¾2œQô¹ŒÖΞÁÁ¢Xo‚¯*ÚˆËÌu ¶]|p£{iä´Œ€‘}<»l€ÿѲÍàJ½ÅÜYº,mlNHå¡Y§¶Ò]üh£ªâjsu‡•´Mi›´¨a“@´°ÞK˜´ÖÒ2+¬Ïo³Ðèäoh@Žá×÷[zm+±Ëè›K> eTK Æ2ZÎ=@² Ú Yu<Þ¦OðlDrNlÀ[úHU€îëh‰¡¿â¾t¦¾nj¶²Ì  a*Ö‰åyüÅo] mFŠ©ú´´ne7ÐHgK6÷ëÈ6PIý©$#FÆ™$omø[Ø´@ä¡fO£å@h×p£¡Û®ž¼hRÐí©;dƒM%#TNÈæc-“óÄÊ:ã³í4òˆi‰ÁðœŽgϵÄãy}ØŒnñiº=¡pªÓchžq°Ø•·Â‚p >-ú¦Ð‘©® šñÖå“ËomDû,<âïÈ[ÔHÔò¸¼(ÚÈ7óˆUððûC8¤ïÎø`e:•B~Û3·üŠŸ#ç¸u––øì&/¶û”¯Æê3È4VAǬ·QBÐ}·Ô¼jŽ¾/-!ØÌ~;:ÇŸÇPH&eCðœ¯: E 0Úñ†‡ÒêQ¥«?S3èd•JŸ J¬µµCÎBòy§›û¨jqÞz8ÄSÚ„]ÍŸ_f¬äÐprºäÌ,9êaÀ¹-Q‚›…Ðæt ø0ÚÀ¨"½ºÆç¼E2G¶#LUÛR šŠ6…×öR͹Ó2e¸ËMñ£šlžÀÐƃ'ýû€YhƒX+$yÐiÆTcï-qJç‚ç¡äª'™ŠF<ºÊÛÆ çq¢yq´ø(fdÃbÞªþÇ ¹˜_Ík‘*´ís[9ùÆB[{Ý¥RhUGd~¬+‹yùcNÀŸ6À3w\ÎAkÉm̲7c²WÆÈ»vmF*ÓIš®]<Âœ³ÑæÁÈ‚óÐŽ#I ±!3i [Ú«›^4ÇEÐFú Ôš| ýqiÛjGk’elÅ¢² l¤¶Ža`gL=“ÓôÝ1¶ҩۇŒð¶‰ùÚ#·§Gß:µ™ö!CYrë>(Žpèú‘ džJ!2,<®g7Àc7øêÏKq%}Sr&ÛâJ]¦eœÚ®ÌÜÕYË ©/[¦TøâR,“`„Ãq<#K:ÇÑ”®ó™'çwZšÐ µtWï¿>¡4/PV¬ËZïe¡§oH"“ôõŒ‚¢ÏtA3eÚš-×ÒÒÖR¡¿üÍuŒ„2´­w¥Ëäã ¯89†G_Ï@Iõµ½Ë)ÜiåI^Íúß¿hjÍ¢å&Ž±¤¤D­ º¬S™Ò6oŸì·>„•ÃûØ.‡$JSèuœß_þò×@غO´ý'Ûèe¬Aš_kkk½h˜*HÝ©©Ú m× ‹&ÅÿMªRF~­5AçˆZ÷•ÑçiÂ2kï£ e˜„ßÌZö»ä²ùe)ÉpY˜=UŸÄ°pðN+zw{§ærýOÛÀÀ£?~E®æÉÑ&;ø·ëùò)ó$1„fê0,-® ˜Ï‚zž}U/"ÜÍt I$¢¾.$&¥wBŒÔí±öï4g[÷¹P 3Ö}ÒÚÜ´5^ÖšššdŽËÉ/¹Bv·°¯9*F6¡C¾ZÑé5h&»­!G0ë>â_¾šÛ«b±¬¦üV¿H¨4"’öÔåÆÖ˜u2"ª#¼œÂÙ®@ývËÿ{w.þN«ÛäÁÖ%2ÌlÜ®æw¶dÕÑÐ I}ÆŠ¿Z®ŸÝ‚¯ìݦßh­T ½½±‰B1nâÉÀwÆ,yÖ Ïk7Ÿà,-à,[¤ùMñçZ÷az»¤E×tÅÏA·è-ü µNùI6«©²9äœûN&[Ìd]6¿uý¼†X‹žÜ,(S”­÷e8˜ß|áAš·—æÞmIÝiï´3Kö­‚(õ8xÇÍ׶¯{sA&óvÚn.ÈŸgD>Š©æg¤ʸ‹Œüü*q…éšÇÿ‡î?|Áhcÿ‘[ËÑë7žýßè˜{$ Ðwë \Oq_æ!m#—Ï`Ó1tíökõˆ|úˆHFŠÏéZUÔ£Bm7ÿÈNø(1EöñBÍ÷Ÿ:ïàÈô9Dcqê…ß¡z š-ŒŒôéNO*À7{—ð»6âƒy"…>ÏP³'¿C#"t¡“uÉV7 ;Áÿ±Û¹ÓQ÷ÉÇê#?fö­.ùßÅZ©Gä»<" (>çhÉf;j˜»—]dÅû`…ÕA~¬c(µ¾6›Ê>¤P¯|»ùu^³#©—µ^Š´ßö¨ës–2¼ÉÖájÓÔPz‚CÈN±|ôyu™{"W»¹¸º{øìJ¸< œa¥†¼‹nîî®rZ°æNA«œ“ºB-ìÏÕM-\œðP€¯«›šÖ'hí™Û™*JRI¥¿­ƒü=F.ÖçŠ'LzvsØš£7æäÙjmﮚÆÅÑnÛ㡱¬[$ª2ãy(*))2ÔeVI®®{ïA9JyyÞNÎè;·Q»ãó¹`{÷ßè´žÿjð|®`>@ýÏ7Z®Ný•ùIÚcÂ|œ=ü»&dUÏÏz8:¸ïÎí·Í\×óÈ&ó\l`ÔQ)nó²8W2¥žùÿÅ)ëd(Ó{ÿ'÷§o- w³ƒ?š±ïŠœ: ¯îôÖТî8|òêõë—Ï'o´ÑÂq®  •¨z~ŒJã\¼ýà>Dwï\8½ßÄH+4þbßÒæ ip¸bbáâø-Lì×îyüàþ½»·/;ái®Iqz\#7¤”˜jFž½}ëæ ÝHM-ï™äŸ£ëö3sòl¶×2J¸zG)Íë׳›¦¦Ûó¯§Þ¸yóÖí[ç¬IzA®¢/Ÿ½©†JÚïeo¾rÝ]•¢nÞÏ­ƒÑfô9C—°ÿÚ#¨‰·®_9¶ Ko¹ïæ3\©ª—'äß­&”JÉ7¶À æ_Ä™Æ̵yAJ|^7P°oŒÕÜI¼Vü5+#“Žš:÷Í+ˆÎŸHúb³Á1äyv¾P6äCZräNæÛ0T’pæÖÉŸo´ñ•Q0Gëd¹T=ûÿ$¨³Æ¦u"çh‚‘öî! övuttvNÀ– £=íýÃcŠ½Ïo¸»ŠÐÙ?Ä•È×]‰`¢§«³£³{bZ:ÅíëꟀ§'¸Ý=ˆ?Á.îÅÐ4?/žà¶JT~:D‹`›ËSYRoó ݉Þ\@ÐÆ¡wz&Bõ½#x›Øý£Ð&àÔåÙš¾ÓAG×¹Vˆ¡ñRÃÔyýÀ,Œ6Q¨ F÷])óÏ™ÑçTMÒkåN¯±3&F&eª®ùÒÑîl3mvf[OGGGWÿ¨|–BóTÔÕÕ9.L wu ã#í]=¨:6RÑp/œ°»oB[›Ló†ÒNmfÛE7wtN)!Ød_mƒzäNno?IJ¾žNîäôpoWs'jÔ!ã  #ß=2Žxˆ'úÛ{x 4š„x*j‹éNeBn{×q ·«½½£ˆ7k- Ú«ï ÜK{ú‡…2™`¸½gX*žèêlEÌlÄü±Þn˜#{ú‡ÄH³&ûÛNØÛm<Ú×ÕÙÛYh§opê]o{ߘæµwöIPÃ&™dt°ªmwßjÂù.e‹­_‚ HWYè^„íÂdü‘þŽÞ!5|kôn¯%)B. W^n²úd°Å¡SçÖ¯°cÚ{gÇ{nŽ;±o=…aœQ ËxuŠ) çè@¦Ò6$¡§ÒcNt:Ó**2”n¼:î3{5l\W{/^ŸnÞ3´¬õ]Á(„#c…¥u@&^åB ‹M*f ÈMtyÅ”Ñe橲›z$‹ØÀìÓЛšbž§¹Qô…÷ßM´QtEË9¿å´pžÜÈd”½Ax#ú†½Î Õ"ú È¥±–< ÷v<9`Fõ;îèæüÌ™unt # EŒ!À‘µŽ4:cý–­+,ŒIæÞõÓ`8÷æJ Óy×îJ[ŠÂ³[™TªwXTâå‡@:ígO ˆ!ÐmýæAo‹Ï­¢V®ÙîçDe™Ü*…]KtßóÖ°E/Èj/¬!à)®AkÖºP „½iÈ–øôr¦ßù³ûOœÜ·ÖÄ>[®br,l‰‰òÀ™n‰9Þ-eû5,Öžò¡8¹»¾¨šV[›±8vžÖ…0ñdsÄιæÚ~o3cg¯}»¶oßÅÆùlÙwàrh8»”莺,¹ëM%ü‚‚8 ‚ƒ÷nLt7”TwA/«K ú+^¹»½t£Ô ð-il¤#þtjܳj, þ¨ærBjÓ>]ÎÖÕçìÉBc&9S=Sr¡ùqÞÉÐçz-–¾'çà‰4hùi?ï­Å^òÐtë–¶ŽIøsD¶mkïKçXìIݨš‡Ÿƒ¤e™ Ú`ï«ï$°mPןŠ6ˆ Ùîcí}ÛIi„½¢DÉ©YâEÑÚIùÅžQN“|é!ÿÃhãÀñ ½x^)Ù¹³Uˆ)õ,´‘çq›ð-sBu#5ñ‚¨iŽøÛ›Zc¬±á!6aß]^ItOÐ<#Þ–Já´bÐ1émIÞ} vª0’¥Iôi”ƒvÊZÓçÿEò*Žó ‚iÐè;z1¯ þ)¸[Åb2LãCC}ÖÓV¬¹¥IÞZÆ›&`´ñÑ´CÐF"H>s= ½„ò×ÑÝ¡‘-gµ4q»_c"D~Œ©áÊ;³”6²Ö3z~˜†º8mMÜÞW诮·—w캈U_Pa¡§}q®x3ÜÙi72” ÇYO÷Š¿5ÉËHÚß&êàœkÐÊNVYRëy³v†Ð¤¯­{P ßñ¨TJz…|­©?¶ç=ˆñ@Ÿ»–ÑéZÌ­nNÕì ,ÆpÒeù?/©ëî‘Ëà¢Ó®ÆN #y6ÀÐ$üÙbç>¢v¢æÉ7“§‹,µ4ô`w¿†DNù¸X.ÛXg•VWÂTöòÎq¼^X|Žô£õ6ªhÏŸX?{íÉ(Ú˜é9ù)ÑŠð3ÂEÑÆAÛÀÆ+0X)‘Ïê}¼@†¥ý*•¢ž•õ/ˆ6/iK g]ÕÍ hšW#=žq*œã°EwÄØFšÞ‰Zb2ŽXÑNÈo#ˆyÙ9ï&£$Å›cs]*UÏSé}q:ØÔéðl½hÀ•NMÉjÄÐÆ…¶íTšòíå½[Ï)± ²‰<†áÙ˜Ú é;›jßd½zúôéõÝÁDûÀim–:uÉkÐöÐWß*aÖ­ aÃ)=_ÌXmÜR=—.%Ý8¯¿½´0ÿù³§O3ÒlIZIo!¹DšæäJŒíNzºW»UÐæñV_vØ>0ÇlX=ãÿ$ê/§QÉ9òY_ì+b€œ÷!´Á_jÂftN8„6O&ÝM°b)¨lÒ« 5K°Ãœµ*å•"Û;ûÌ>€6² o¶nôµf…9½XàæÑôØ¥cÚP¨g7”‚ÖlϪUø¤ût´XM*qg­=”¶ØN æÎOÜI-î„íSvRXŠªƒšÖu`A´‘´<Ñ!šÕs§ÅÕWõM<Ë8ÚXÒ*îB]^íÈÙ Àôn[Sr5hɽD¡³Ú‡6Δݗ0—žÏOo5v\%Px V[ê-¿Ú¥,Ûð·8Y8.'¯ÜNÏxzm'„6A(Ú,Å»ÈKhè§oý´˜PqªéÅA:…sêQzFFÆ}›C›ä0O»È£@}Ìý]"ñ@%JɪŸøx´Qw 3÷ÚfC×vŽ9»ÌPÈ6Vã?„6²=~¶V!‡À¬²ð‹éJhC¥;σ¿màtÜŽ¡FrÑÄw[o#=ékI‘ßùm` §œ V§uf vŠº‹ö ,Û8VÈ6GÖÕ×¥%àŒ­¦$ón>ÊïÓ¨42‰È2³2c‘Id ÑÄíy‹pÞ3©Yhã¤c@áXZËÉ’cz¥x|–lE€ ç\œY4 ™BfûËE)É[s=Cº¹•µ2Y™o<òAg"“e£¶´ô9Q@«ƒŽU©Pä…Çê"Ùfé\½ ‘il£’Ìšm¾ªAc#œ…#lÝçhkF"’¨LÎÕòa0 z‡7^jíq¶îï©>+Áó°â=$ÛÐ|­Íl·íÙåiBÀ“W¶ÊϤ…ØÑŒÍvîÙãeiJ²ôéB\º”Þ‹'Qi¾¾>/”/ïñc¬FlÇÐíñ V–m *:L%‘·îYçïB¥Ñ#g” ´‘MsWX³ÙŽÞ±{63Èäìç)zúÔð]GFkÏÍB=ëc"ÕÖÉ&Š-‰FNÞ»ö‚ú#Ê;©â¨Ð¨]ûüØç«Ã½ØVöi­Ó×Eˆ®îp¶ú!!–,‚…cä”dî¶J–ãgà²Yß ¿ˆÔ1Ù‰Íp~Oie³ÜÁÜtCY倊±ÖªšnŒ†ºÛª++***›ÚzÄòÛîRþH-XU7&wv³MÖÃg¦ü‘ÞÊš:‘da?ÓcíÍõU••UU5­]}ÓJ†dSÜžªªúéù°õåU•JTQÞËSöŒ'm¯­©”Ǩª®íèQ‘Bdµ³r@rin‡–QYwS=T!åÕðÒœBª©ëTª£¨±²´{\ªì¡«qvn•—ÕÃ>-ÅÜj¥Àº¦Vî”x}&òs¬¿ŠÓÔ‡zâ‡[²öÝz§h¬· NŸ믮,¯¬®ç Q!Ýœ »Zê¡«©oæÁ'zØKøM5ЀUsU}8I'ûkª*jš:¡…F¦s`Ry¼»Z«* üëúyË(k‰%“CugTV÷Áˆd=MÕ•uÓS¥• xŽ4•×õε`îm…jXÙÁ)3!b!îh¬-/¯hê€kb ½¼¼²gJ:ÔZ_߉JCÂúòòAÔ.kª¿¬²QŒ^n‘‰»[ Ö6¶óç?ú”ñkÃÔ'àß!ÄæHïü::{qgzTä‘,y÷jšÖÆ—£êîý ã… Ñà»T"Á²z|f»£MзêÏ­KûEMÇsßÓîÕ]ôŽLQ+“¿MÀá¿K60YÑ;-û»s€Ö—^¦Tºqøš0&j°C¦ÖÊ}.a43ÔÝÖÀ:V¨b(’gA ú¶½'=9@Æ“½Ï}o—ZµöøÛîuè/·¯£Lôw,·Šøý½Ýݽt¥ÄÏAâñŽöŽ¾!Þ¬ ×ähwWÿä·ÜåÛtvõ%RõŒU“šÔ¤&5}wôª2Îw]°üX²ß\·|”×â¯#V.>(ó4V¶H̯Õ)Ó\Pß»?!‰„@}ûgÙá||øüÞldóç “}lÎjú¦I:ö~µ‹-Ûyí˜ó6?v¿åsOáq0µHAÑn¼Ý^ñgÞÏ7ä\°33ãD<C/h÷ŽIñgê¡ê—[C}ÌÍÍÍ,ìÖì<Ñ"˜‹Bد‹;¼íœ"Æ$*áCåiÁn6f«Ð]§y ØÇQSTZ ƪ*«¦$`zr¤ªªj=ÛµÔ×@é«ëšyB8d¸±p•1}×¹‡µ˜!:¯¿±Û©ÂŠ²žºvúÔÔü÷½Ø:o  ®Feu÷ðä´³M 5ÔT–—W¶t ))©ÛTW [˜4´Œ+pB4ÞÒ€V© 1Gc¶ÔT¶ô«°»TÜRûÚÕHϳʲú´AÅt¶ÔÃVE°ÁÉ4˜1Œ—õµ5@97´÷1¯¢¢Nˆ~X©^×Ô>…åH»jÊëzclÙ°7²3ý~(ºYšŠó]±?sö|µÆæ\þ@]Æ1Æ ÚÀd²þT%&&T‘ÉÔô*Ø^h ¾¢ºSõò· ¼yú‹)™¼}òÞÔ†yªäåƒê!0< ŸXjz €@zá„ïk€Dé@W(@ fÐsp3Þ#I*Á8*NÜ\PTÁ`C!ü¶Uî:«¼—ÃÀãžü* ççàG¿ãsø5^ ..nÖ²>ð£%àçÆ~mFçb!h¼?ü ©B= 8¿´…Ÿ5‡A>ëV¹‰cÐ^ç.ˆ¤êñÏAÅWzÒ©A‘GO¥ eB_¹l3ð"†`„s^µy×–c¢‘ÿþth$¼šçÐk`d]×Ä:xùÕYœL¢D@|ÜWšF"“ËúÄ@ÐêA¢0ì¼wDïð¶¢ñÎ bPvu›NõØš”ú⮦[ qTШ-kýhF†ÁgàYóèÄ"Žº!öðµ|عBß³h*ç¾mKø *úU» ÚÈ€¸áÃÏY±v÷ÖP¦‘¡{l<§'+,'ÿÑÛÜÌÉTªW—a§•J·]±=z‡5•€s¨‚ÑKúhµ)>XåJ”L2uéä3#C¯G⯾½²Íù&…Ä^»y{ ›5iRÖ‡J²Üƒ+ ¨þ‘Ûým({Dê`NÙúFè›mMˆævîÄkÚG]|Œ­¥Sìb+o¬ds?Ð;Ó‚ÍߧQE(X"Ux¸­$‘i/jG F¥8ê3£U¿RùžVkÃï‰wàÈZµë›áç3õ ý8üð\ó;Xº8»äüÓN÷7Îêè©È6Íg^A~ú;0 ˆü$Kü‚|ðÈ+Æté¿Z4X@:~±|IÅòÑ_þå?2°¢Í ÿo8íÙ.UQh Îä…Q¢h8ν*º ~Øž‰ê À¯–ü@Ìù)|´nüü+K ^´º}^—¹ÿ—UÄÒ{Zе"d– Ù¦I&vböݬÀÄø·gtp–µ`¹>ùnkŠ™ÿjošI;rhžöŒ‡#K¦§z{û¦% 3ç2‰e#_\Åw/_(k2ž—1-ée=ZôƒK‰WÓËÑõ÷ãÈfÈGr…ï˜:ŒbôÞä`…1ž|¥SZ¶Ýߨm!„@I¶ÙäJ <ˆíܧžà‰ŒÒ~AýÃ_¹}ïTêù ‚Þ¢[dºÅ\ÀH»z±¤™[“ŽôŒÏQ’ ûh'¡ºÏŽÚLÔÞ_/ÿòùI‚Ç…·p='{­øÄ L`K w5d¹HdyûCbåbUß…³Wù°ß<Þ@ï\Þ«Mcá´ŒíVDn‰¾ú SñYõyÇkÚ¨ÌÄœÓÁ8“u£ˆ%òÄPßO Ò¦‰&ðÅÀBáŸÎð^Cë§àoˆm¤Xò Ð1 ZgÐfýáçŸQAyx~üš†¿Çêõ·%ÿ ñäØé8ƒ6‚!ðKHlø)x\F†@r üêçd$7-ðÅO@ãz2ÿK½ÿ´;¤ƒ*¨õ‡%à‡?¿ÿ ü y´5–?†CþøW Íþ ¾nÀhø§X±àö8~Büœ\ŠjûÀoÿþY-›à~þ[`c~ó3ðåRP-ÿDËo‘lﶫÁáóÐôQ;Zà•7JhÓ2Õ—Ï22x=€9:‚äf7-½•üÚÓæ!àO€Xq<ã~ åz=´ßá®#áïvªÜŒžjÉep[OÞ.­nQèWÅÃ+X´SÏjä³IÔX^”ñàÞ7Rö®'™Úò¥`²B›.<Û R)4ZfYcBíÆK‰Ox@/Gqƒ­ÆÁÌf4BkóÛFÄ#…ÝÂÊûT#â¾ Êk›x| _øE¦DÜÆ„¥U #¢é¢û} tN6«¢ ̳ƒÅ9™÷nߺyûÖ^g"g¼nNöæ1pù£è=0–¯Aq…ÐfðE¼¡ëøÝWU 3ZŸy>**H»p,rMˆ³©ö2M¯M'ûÒyg^´A%›œ” ú$·’ñE´ÄÓàO?K~ ?â–€_¯û8࿃wœ_þ/€ mžƒ67=ŽdüÏ/`Q¾¼[‡ÿ§.vÔùb%ZèÐZ%oç† uBp',ù7ÕùbƒýÉ20˜n@wž½Õ•ðêwÚQáK—ä•{ï UÐþ _¬Ÿ-ÑÔétjÚ«×Y·Mía§|JhS÷:™B¡Òé ” *|ªE moÍpxšRˆÖ¦Ã!(‹ô¶„J'(¡GŸ¡s]:Þ¸+Ø­’ïî[‚Ÿj>´áXèê›øl¿ûäyv^N‚+‘ ïVÆ:žPõÙå ›—–]«aCõ™«œÙ4•`DÝq¥X¢\¢Ê·‚±gÑ@‰3GßøòdÿÜ*c=öªÆéœÆÁÓíu=üïÖ'àq,XòsÐ× ~¶üÙ®×l´ùx(ñ¤Sˆ˜ñ€ÄÌi^þ¤ˆÒŽ[4ƒ6ïÁÏ–›ä­”‚ß hS4Ú2à‡-Y`3|ù?|ºâ> þ+Xò_@ª*§ÍjCY*œö¯æ´§|m¸þ pKàÿ­‰åsÎþó¤DÀ‰o±-Ûþü³E ~‹h†3y†Tìç¿|5üCd›f~¡1NÿU¯B¶isÒÔ«‚ƃIçðìÉ&eBhM/ ˜ì‚¦Çu§X6ÿg˜¤Ó“ÝIûn‰ÚL•qôôn5cÑZŸ$ÌA›®¢[«S¸ð™”¤ÍÞ`ùå…Å^±`¼³&ÇœLLÊlP©Rs¹›)9úbÞÂÝ2m$ϯ¥»…+æúE¼)‚6=ÙLCÜ®B¶9‚Ê63]<Ék{{—jHyÒª¢¹Mä?O‡6£Ê5h¹»Â€±mòcÐŽ/J bS#n¾?´óÂ3‹ÃHV @pã,¢´Ùˆl7æG ‚6¨lókmD± %IŸA›6D5ô•¿¼n}˜lß1€5EÝðK€F$Áê¿ÀŸqàg?šëfËjüNðð6H•;Sª½§] Ÿ1½Jg®ÉÑŒK&?ý x—²ÜC›—'àŸøx~p¼…ôõ0øåOÀ’?éað£/`9 ;…3ùñ¿>¡úü6M@8êÊ"î¼Z‚iü3él;ùàáA„óT§ã°ÆG0dÍ4Yîp¦'±p¢­­](uY¶|¬` í&‘É/tØ“EK|V‹¡®Aª“ìñçPLíàï7L3´i9ˆE:RÍÆ‘Ngbö?üÆŒ=Go‰Uô6`‹;Ã{×=¬œ‰æ½{âz&eoÓNì>‘)/]Á¦î}TÕñæʦØŠfïv3‹H„}mMtµ÷q? m­ez®ÇNxª²édÖNØ]¡x¼Ëœ;õs4æd„èmŽ9q»L‘¡§áBõ0|ÕÕÚÅϳ]EDý]—³¦<²ÉŽÝÎÓH¶ðI_å˜pæ:yÕ“'@¨$ëçœYCuÙ>WÃëiïžš³ã"z‰‚/~z 2'À¿._þž’è@| Ú@ô”äG )ôwò ÚGÀ—_À¯®‚þn°Ï ~õ[W¬+~¿‚B\v¸Â’ ¼EºTo¯«÷"Ï•Hž_€ä;àÅC@ýüó4XãàK$IÀðêX…G¤, ,FΕ~ò*AGðÒ…FCñ|~kaÈ2߃(pL¢n€Žp}rþ'L¶Ùî¼=A™úBñgCÀå|m¼í±7`/8Á$àí7l ÷¦‰Û®–¡KYÓëó"1à¢@– wÙ›ëéÒÉ=èö½¿‡ÇãKûÄ¢®"ƒií¶~ÆvL:ú¾A(Œw53 [DîÉ:ÇzÇö(•ú(3ˆ'ûDl뎮eàŒØ·a°xµ—EÂÙx‡­ñ¦R©;i„Ÿõ7&v&%i~À!“¨v¾QëCLÉ8û€¡ Ò4*ËÞkCäzW+†±©s#ˆzKÍØL†• T%o{fY€8~Ä2<=m¼õµh£‰·l…vRí"TûM¡lïÝOÃqúÆÑ×^@™dìôÀÒü7lñ³¦?µU›ï¤ÆÞœ&‰ÿÈ k¬Mi–ΫÇDÈ—nèK­ª°=já)K G Û;»Ú™ÓkçQÄË·9›‚7ÌnQ¨ƒ­­™)‹B![ÛÚY˜;gÀš†± –.ÃØÚN‰²š úœµÓ¦íȜǎ…õgdr1ä‡Åˆ9ÊÏÙX„æøçL´A^)Ð楊6·¢` Båc+äA~úÜ} üô ù™Ôàwz@áľd øï•Û ã°hémHCà§PMˆX>×¢ÀO~‚EøáÀW¾˜à6^ þãÇ3ù© Ð3óý®àÇòðüüZ;=/9 ~òC,ü'ÿ P× ãÙàW?œ98ûâßA–ü˜`ò°S Ÿé`j´§«Œž³öõtŽŒO£ì!E>Õ5Ä›R0,´ éììä DØR<-¢}b93C² ôVˆ¸É•ÆûàoutõôMÈÔÈ„<(Ï®¾!XîŸžì… è˜FNjº;:º!¹hzb¸«³³w3½˜âA?á/ ŽN »)¨­kHá°þØ££wpT2ÈC2ïèêíŸÉ? U©G^%ÌÞ†ký7Íu *îëh碭M´wö Ÿ¸Œ uŸÌêç‹L: Ñ3„mŽ¸ƒ½P-û‡Ç¥µ–“=xèÅø‰Ñ¤nÝ}ƒrGAÒ‘îö®P±åœžë‡2‚©k`hT$o˜L2uÑ‹‘Ý •$îéT¡ŽöNÄ’EÒßÕ¡ú¦sxRˆ˜6e»ÆÏ·Oìë„/´Ë×îÉ>øgÇV¤òÍ…ÁVÐئP¯1RÐÚ êXƒ]ðÛö Ã9ÔµÎh¢ø<ÐÒ¿mëÓJ7$SpÌÆŒ“$“pYPˆP†¶45€¦Î™øÜ8“†FÐÝ%Áòƒ+çß „’™ðá>$>ÔœÌx Â@sàK•*)Ϥ¹Œ f› a…Ò õ¦ÔôYh4kwÔ¹ì¯u !áŽL~‚‰+ÏãBèÎ’¯­Ž·q¨}—¡Yý­µ' »ÕƒûÉÔp,ùPo¤Ôô9»Oÿìõ¼Ôvg„7wó÷v`‘i¬³…㲯]3ð÷Öì›jÔÿEJ?^¨MûÔô]†,DEÊŸàq!âMÉ·™êžù^¤¦Õ¤&5©éŸâç‚ý?Ù¾éâWðC¥ËdÿˆµõŸÛÁ¢l^Ñåë >ò/4ÏËTÝ)ý-œÉ¼ùÿ–lšëlEM~ÖùMøgáêOVPˆßÖd†òÿ! ŸÝoÕ0ݶˆ£œ³›Mœw|^z„õŸdð.1%ÿä;#™øÞáp çW!ûz]ý/31ˆŒ³ªªŒŽ¨¿dƒ—-•ÆòÝ7À—*¥òÙYg3&i›š?—WÓ⃌mœ¸róÉPÙ&?*¹bÍþž ‰²×¯ê‡‰ö¦,&Ç6ñþ;Ù?ãê ›u0#&=íøFà@0TMįæ}¬©9îº!uîä^hHd£µ™ï$ßnw¾Ýç_• Vdd-ÆöÍå¯ó+áÃý–Û{Ì|“¤²¿ž-‚Â’© œîÑÇ¥ã…çß[ŽV˜àô“ž•5wO|&ˆº Blض¡ëHúfUJ敼Ö\œî‘ë/+*Êî &¯D¾L#Í=jdêõ²¨´ì]~˜=Ó{çE9bÁ'‹OSõõv£ÓðïÉÞs¼Î¾KÏÊ+Êž %нꦱ.vj5Žá›Yøþý›‡nx°-ßo`A5ÐV“—ý:çMÉâ„eÚt5TäfeeeçÕ¶Ë×FØ«M[MiNvVvn~ü &4+YWCenvVVN^Us<ÜCRÈÞé¹y¯_g·Í˜ä˸M/³K2ÉÛ‚ìŽaAGõÛׯ_¿y[%wäê^‡Ë‹óá„åõblúÈºË rËa‘ÊÜ+\‚c³²r'‡›^TI…ýùÙ¯Zú† —!i J*ÇE˜a¿”Ûø*·óÔ"«,)€*›Wð®o “8zëßÔMö7çfefçtòÄóÏe1¿¦´J››_Ü9¢ptƒÜê¨Ë‡º%ÿmïœv ôÕ:ó€ÍÇsó‹ƒ5¯òk H=ïss«»\+ãgçäð¥mÕùŵ#¼º¢k½¬=vdff·7TeW`ý!ƒ}ï”æ4tKÜüœ¬¾q‰jŤP¥šû'êJò^¾Åòïm®Îƒ‡© u¶› ¼Ê¸hlD<ñ87¯5[µT½Gû¡\©êy= ¥/óÊ1úþÖB˜r«[„D›Pí®Ùý0>89Ø^”óGêS”Ôä½z‹2†p$;'Ÿ/Ô–äefe—5Âq›Ê Æ(x_?=Ã{¢¦ÊwＫ™TH²éúŠ·ëµ ÂÒëôHϳ‡g8JrzNAõ2×…M•%Pò ßMJB‹lj°´âÏì’ª&é<(-«JÜ°÷V™løUS¥t•&#Æ„tGžBdGÚu¹Z_mØøä—òO&5\×ÅÛ¶ åX#õdÒï#q`´(û9Å7UQì:WräiDæ”TXiÊ?ç:Öž›[Ö ßYåõåæærÒï㾶ézOô rbêZ +£,/ÖÉÏ\½y÷Žõ+iFº1r?¢i‡ÉLöÆè½Û½ˆj\Ìo¯E‘©ôˆ­{¢#ƒ¨ÊŽGu’îª}›<ˆ»¸¤KIñÞóX>öI2Ynl = È&Ý­ÉÞîÁÖ¡nݸ´ÂšbíµOŒô»d¸Æœ@b»®:tp—-•Bò;…Œ³äö*+Zx2ôÔýâ’»=ÛÆ%ôTÒ¥ñòMÓ #®$ß Àç•â±vk&ÕÔÙïàáý^¦ ãPtî‰ßøŠº ±VäG9XÇ{bü,H×~Ä®îI¼5=0ÙÁ=ôÚ½{±6†º6µ‚¹¢’øÐ "i½uwÌ*;2ôncÁö{Q8#‚ghÔ*g¶¡.'k´òèÕ‹G¢hxƒø»ÍýbîÝ<çÀÒ:ˆyì¹°É–Ê4^»q£“™mµv¶&•ž ¢Phæ£cÖ¬t¦ÉymÂ‡¶ÑñøÍq'n¼†­­²¡šXî9x(ÀÁ‚`êщŠ{‹Œ ¦žá‡l·"é«.‰T…cöLt?SE›±HŠöæÂqE龍¸ºl?+*dòFy øéë«Á¶ïy1¶‡³Æ ¯1´™ØÊÐÝ3¤˜©}íמ¹é›tàk)b±H$K¤R4ÂPe:N/í}ïÀFþØÃ&¨Ò‚qîè86vqáv;àÅ4žÐÒÄǽÅvlyû-œåSQ¸Æzà™màÄÃo]’.V¸›­òþ•qÜ‘NséCK¶3Á%¿è™ÝocÕ'ëÄ*I´1ðº{““ðÚÌ©ÄKyXü„PŸ]W¡^r3Ýzž)ü\mt}DãïD(G^ßbÂY“=$E1í·ÂÛü Ñ®!èggeÇ\tœO`Þê:îé9†We‰htd5ÛVT%«<ŒíÃaÐTÿ‡7ÉïÄäÉÆÔ`‹]ð\™ª2ÕÿFºjôéV-Z€¼- m#ð&ÄÖO;Òèö¨©`Ä•MØõÆßÓ%Ùu"àœžèH§C@–7dËÆ}Ù#åµCýp1ë‡Ä0Gïè«@2ékNØqù=8Y™ªO´h‚½‘È&F‡ÇøˆÆ}ÇSb2PƆY›2B¢ñ‹Nl`x×Ô&²jS½»Ñ ‹Z܈ÄóU#€ßr&ñL“Üæý¢;ÙñìüS4Zbl@.DÌÒ¬Ób†õÉ%‚k[9&¡°‹‹ëŒÍÂobžÇ›-øË9]óîÅç M›½îR›â·,k—7#°Ê‰ì‰FKçlÃïfdÕwÌ|CíQ´½i@ê£W5-½3E¼Ù‡#­A¾~4¹ÅŠ¶þr.Ücã%ÆúæeÐþBrì•÷òñò××Û^E Åkø]*(/+}ÿþ}éû’(‹€ƒ7fÕÿ0„6Ûo¡h³Tß¹[&6ÓtƒŸt+ä·+›ý-CbTe0Ù_ÿèö³g’ÎœKá軦À×¢2ìX^—±¢q'KrBZý\‰PÌm͸wë\rRRò™HkœU<ìÖ`¸á)@*ãÍìªOéfºåä+U´ÇÖ9xmB5Nu:¸H‡¡h¥LÙéî²úÊPu/ŽP¨žƒp²ñíl\|A×ÂûbÉ*wÚæ9h«ß^%›Û½yû¦Ò²²Â«Ôåô|>L”Chó ¶˜•\ ´c…î®./EâT¤_‹¥za´±g:DQdª?EÎfV ½¯©|n£…OA>מ~ÌŽå­è®1G râÃ&n#ÔÄRÕ~ñÞ™éQ‰fR]ùÒAºNUq¡ ‘‘ÓÊCïQì´5 OÊ@¥‹öËÛ®aR KÛâk¶(y-ÅÆxªûùƒ»)ÉÐp&ms$›ì‚ †ŠYä70ó‰Ïxš™¬«©ÀZzÿìNÍs ¯4Z¾úz ÂeïËJ‹Â8ÆkÎ=Ÿ·{ç M£µáf—âCõ²‚½>ÔÕ‡¦Z¯uí[f6:’Cæþ µ¬/Ô‚t®N¯„6möZ„+ÍŠØ%ñ!dß­Pn™;Þ³šé¿IY¶‘´\§jzF%<ÏÊ+~_¼ËRÛõ| †6+ocœ‚¢Íƒ¦‘ÆÇ hgH¡©VåS2ЗÁÔÔw?˜‘™Sô®ø¨“¡ÕQx£ÝWu‹‚g×MEõh3ðä€|¡»ïÎ}‡H4î ˜5“ßc´¨xM£êQ¹Amº‡ëQ Ô÷rŽÈ;B@ÐF¦|¾11þüt ‘±VÉkƒ”?9þþÆzœŸÚ ©x¾4­såƒtJZù†6¶”½‹ä¹v»kéǾ‡øm2Š²|möÔ"ÊsÐÆ[Ž6ü=Æ:ÞwÚëÞ¹H_ÛÐXe´Iòµ±ÚvVqæÃÖ\mÒ¤Ó]Ø­ÇnÜÞºÒ$(ZÑØãÖú(Úp›3D|ñ PÁîùÑzÛᡇ¿×'‰ ²Œˆ{± Ú õO§Û'¼yk +àºd‘7 m07•7S¬Ü¦æh•ÐFz7ÜÞtËÜK©(ÚÜB“òß±qz™ó”8Ú4µ¼†ú¡HµDcÕfFÚz³ø´y¹ËŸ43Qzu|Ã9XþeiéE·¹h#Iõ7³ˆ¹>§¼ÂÒmÅâÅÙl´gÝ´ÝηÉOÛ%Û¼-Ö~$o³ è?¨aÍ1µè¯¹¢•V†8”ð"4ïpÚWŠyW½t’ê¢ØU¶AÑ° /ÈÛõ#|Zþb &J0©ÿþzý‚zˆ×ÌÁ>¬A¶»Ð]¶_‘ëmºGÒiZ9:øãuöL² âBmªtÿ–&¹šªûMçÃnÛ°¶lL® i¾j¤åØ ¡MA,Î(H!)^ÙæeãH¢ºôM£“vLŽ ¦)9¯‡7«BNs^q§8ì”'äÇíÜü¬öÃíjnèÄ´j‡Âíý· î•š”Ñ”¥øq6È=a øšén<_¡Œ6çý¬Í7ŸC_×=8L#ãl7-€6³wRiÛV²vamϽÀ¢MöÁß‘NvÛI»n¼C_í÷5±YsÈDÜ8OÀx"P’m z~ÈÖrÿK þq† 3híátrúR¾«Ûä3J4ÕPW?¦z0¡‚6ðÑ×k’åJ)Ö+)Q‡HUÐJâuõmóå—žßÞ>¸çR© ÚÀß\óf“ןÆ\Xˆ;s6l‰ã!îÂæA› `ªÇ–LŠ¾Žóì÷3±Ž8¤‚`KjÈLlöEnÚ?;ö4Õ¶#çz6@T~FWÇìEÒSµ–Úš‰¥#oNm¦9­FcŽV¤™±(ŒÍOTÑLÄê:½•/Šy×bc¯ÁŽ÷oFÛ³<÷Ë]Çr÷nݜ߈~˜kº¼(¿}dˆ¤#YT]³&¥ox~O÷jE€ßüÌXw©0Ú…¹"úçeBÉ&L¤Š^üâD3{´ÐŽ¼cxŠ[Âè¢Î×ëUèîl €¢³å6ª._XoFðH!Nêêø¢ï¥UÂPæS ŽeëfM‡DJ¿ªIX¶±5ÅÊè€FËßÉ‚fåµ&ˆÎ¶©/¾ˆ×'®Ü Æ•]ž4"Î;0$p…­Ùô@6¼ò½Hð§ ÝýVû:‘ÙÛÓê9<ËŒŠ31·‰CWӚˆz†ñ˜ÊÙI‘#"¶19në RH„À­—±ýþd‡¿½%ÁØ:4lµÙˆã¼Y]%©>Lý€ã˜Ø·ÞˆDõðôn+<úW£à «®éÑp;º™ÝºualÙzM’XéL âqMŠ1ÁÈÚ]ˆ·Ëžû¥©D#“ý/Ú^·¡ûÞRL3±ûu³µ6m÷MÉŽwDøJGëµ';2Öàõ™;nÀjInÞQS*žníjÃ0`{½‡777úê“+üC»žmø }£XžÍ@Åc"ÞPÏ}Æ»Îé 4ÛÍ0ÚäŸßƒ'‘\\\Kº§Q¥z˜«1Ù9J±Nö¾¥h>¨ÌB› gÒ¶s ^ éÑ.gïèiGf™ŸÏƒ-$ãåÆÚ†/G°üö¡U ÑwU˜‡%“ÂqÏ[ŸqÌšæsSe¢ê+VtÝÖ+,Ø‹N¡DìOCßµføÍt—½g^ÞQÔV®¶H?¼CðCÒpˆA¡Z¯[åà “‚£o åOEþd{™ÄÜw†8j¾mvX™¬IÂ<øµ]Úbä‚ôäØ*ÉÈÙÃIÁ»ƾCz³,è¶GÈÚ 73߃ٛqº´¨äGâá"†.!Ÿ‡µôâî:•¼ru¸›bæU„ºqæÖzYrð&öaaÁf$#K}£˜oŸ£á_b_@‰%B=8ææS‘ˆ7æ˜s8–g*ÑoåLösÀ’--MÈÆ›n`{X0õn¥ ‡gYÐ ) «{³-¼³.áØÖ£Ó(³ò‚]ñFdK+3#kÃ¥B…tÕ™…ⲬYT’±½_ÃœÏ@ÙHDz×3ý=µ·™æOò¸\o\(FÍ ¤cc\Á´YCcð»1üù ÙÔøÿoï¼ÿ¢º²þìoûÙM,Kgza†2ÈA@"`W̪a£¢¨±cE•ØÖ’ÄBDQ,| TDŠ)*L/¯Í¾>à ñãêÊÆ|Î÷Þ¼{ß}·œ9÷¼sÎÓ‘§áLú£CÔ™,6ÎçÚCéèƒF³•à$èc: ãôb½¯ðÒ4s !c·ÙWÒm7Érzƒ sñ·!0»‘ºÓ£8ó¦)bÛíªý5.ž{Há¢+¨Ûh :³u\ÂfaÚCgÓ‰J±ãœ—,=jô)z«-k'ûÁ`#\& J¢ÜhrjTöqÝ…SÝeÇ&ì·J &6Ý õð@7j`²ÿà(YagaÖëMVvMaVÓ˜ÁHpÓŒœ{:z¶ðåPúr:½*N`ä<Õ›,Ž8ï”´Ô"ß*ršØiÆTÈTŠßÙ––}Ïâ &°ž™êô' ÊÏ5ŒþVGv áôr`9èÔ¨[˜.¿5#—ù¿Sæ+!»…7­3ÿ"ä}é\LO“Ӊʦ7˜x§X#9—§]šËw?/m&I®Ölþ{ЊÏÈSõ¬{|Väñ«ÑÅdS,ê' ÔüÓ,‰LnFÿp=Œ ?QÈ¿…¡'=µû£T~òÐTzÕ¼n¨kÐ|h‰0P·áÈçÔkúú”™oQÈÁ[/\E§ûàþãDü!{†þ=û Çá]"ùQEQ›W%CéŸÓP‘›AQÌÕw€ÿÞT੬9Pºÿ]eo⬠Ÿ?Q–Iø)÷Ì 2þe– ¸À']¶Ñ¯‚Ž\óðoÉû« ÉóÝK¸mìøwË¡T¾ýL­}Ü2FÊv&ù{iž¹øD!ú—߯N–KDŠàÈÜâFþ±‚¥çöŠ8@([ZÛõÖ1IɃÒC™!2X´zo¡ÉC²d/T,:ÜH€À€Oc*hyÒ80â“ñôÐâ»"4¸*T¶ê‡ÖÎîö¦›³)t@‰­»:I-›“±VâñÌε'Š3ÎÝëèëlX"÷K=FEêu^VxåÖuuwÝ/Ú&ôÿ؆½‡¸ù˜,”«Ãö¤³3ôöõ÷ýÖ»4J½p›SÿbTãÓ9~ÂRê màã6MÈнW K+kz™ü$˜­ª¢¤õ%ãÆK4×UU×µ`­Gxi3ÖÓRR^iFÓã⨤tÊ#Œ^ñ£å‹§HÖÐ%‰'¹ßæ_ïD+¥~38iãÐßÚ3E™jåT…×WLWn&ÿü%/-nÃu^rd¦È–n¿A¹X5Ý)®~àÙôÁ–kW¼ék½w¡¬†ñ1¶W]).,¼|ïI#ín•üü°ßé‘bh¯>_N9Ê6WU4½rPÁ•ÝÁ AI£ŽÝ4uûÒwö Ê‘­/»pû9”Ò}m£_Øú1Ðnàc°ôÍ4 Ëöîß÷MêLßiª»CÔN*J#*¨"wRXùºðIxÖÞ¼MË£W­Mò–§2Ò¦£â¨2"æµs³€ ÏŸ‘º,̱å®Ò†h?3]ÝËÅ´´üëÒÓR’‘$^yˆ ¿¿w¹,y£gÑ.*HˆŒY³óB^¥.?Ð;0aÕö»3ÃE~q[«Hù·c¹:9³Œo§²åÌ&¿OJ’üidå±I˜_iÕâ5ì«ÄMu9SØ´dj|–ý<ÀªcºÞ0¥°èá¨7ðÁ µ\•JBz¹mÎ/·n<ë7rÒ¦yÛ,^xÀ攸œ•æ¥šÏH ±&ÜÍ ¬ïÒ*Eù5®¡$nÒ†:ÿæá•Á³bsŽÿ~ýŠ`ù̆—¸V&—`EÖô€ÄZf¡6‹ÑlõlùÃ3 QÄsF‹Â- µ‚ §Y¿q{g©¿0´e i;»Y¹ÈN¹ã:°Á‰D^Û­§ìRf£ÉÆê<¯ê 4Aªµ»änÑJ¹UL;,&ƒÁ¹6[6hÕ«ÿ}& |0èHGŒÄw^ÆŽ¢Ê;½ClÀ5'mG:*äBq“ŽMSi¾›ý¥4Õ3Ã0£XúÏ’¥ï)CÆÛQ<¤µ4/svâªùGöï\Ÿ^Ú2ìª=.ÉññÑ”·¿[‘xx&^¤ÝÇÔŠi¼²KêkiÔ—Gû s8¬ j/ÅÍ·”`i®Ø-S/ÅÝ“áM— ’“Ò²äçØ3/!%ïÒ݉ì@DÍÊ°ÍçaÂÀÇn†ŽnYõU„\0+=÷“6×_½yzI*á•8ð'yVbvaê{nÎfÐyÜ–ªÛNª÷âF¯‹xcŠ¡q¯wÂK¶%Xå¾%>ªøº¾m¿/mNÇ‹æžf6r˜®6D ÒFω¥‰‰‰‹‹ßuŸbEÿk÷R:OAŠò©^·J¬oš•AUg×ßMUÞš(c{óŽYâ'aÂÀŠןy 5Þ.V¯Î)sØYÝf´óºBØ0Âê6C%YSäi:y¥ë© ‘ø«9‘Và.mŠ·¦kn`öL”1åmÊׯšÚ«á—×ÅFÿku8Þã)%mâYiƒ[:´Ó.öL K_6œ•J“tcwD>Úç͇Ÿ—É•Í&—ÿuªÏ´¬_'HÖ®øö,Ìø`ºïŸŸžÏG)nK‰X¶«ˆ“6}¸®[%ï»Ê˜2[æEø©Y»etðQsokïJS‰×»K2îòºZêÁ¿-¦¯tëit —%«éÄâi‚¥¯É…ÿè„P‘Ö‹ºËCCç£g=ï’6”K?²:*(uëæ+| ~iúº3]—¡'L*Î[³,lþVNa"Ÿ=në§Ò ؆žÊ$‚‚Û¬g‘þá1ïP:-þ¢¥±k˜;Èá¹!I‡®:ÀL ¨Û8p}ï„YÒ °ÔùógkdšY) ÃäNjd¦Úïp%¥«4ä-ô×Ä$D†)^?Å?žÉ!ÓVœ3M4h"ZÜâ V;‘H¢­TPý¦Ô¨ µ:H)ä*òCÈÑVr%?e%*q) â´Áʈøâ6RyÂF|(Ró©”ÉÉ“ïnJ˜ùÍÊÆ©hÿ˜“ÎGb¿]KW C£¤Æ+¤ò•;Š¹gòxÑâ xMÝp¾‡öÝA“~Ç8M§Ö…ÊEšØyi‰Q2e覣LNZszà_’Oõ±Ê6£–\Â>\ÜPtpútìÎ8#% r…r8ù?ëøF…X¢”}˜Žµtƒ |DÙz`\Æ]ã.ƒ¹ŸK]‘¾”qý² ϶S!–(æ§Kàãâ˜`Lgžw‚.ʇòå¨Öð¹µ;K,¹<Âœ3ÒyM.n5ÂŒ€?³@ÔßÝ•¼þâäoaö/Ÿ[gf5›œXÉÊKÏa0àÏ®|7MÊU —1×])›· „|b¹óÿwNþ²-. endstream endobj 749 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 92 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16859 /Filter /FlateDecode >> stream xÚí½XTÙš.Üsæþ3óüϹÿÜ{çÆ™sgÎs[E‰EåÈ9眓"¨€9a@³bÎYQ$# QrÎ9gŠ‚Jûß¡ª¨*(°Ï±í¶Ï~›ÞµÃŠßz×·¾õ­µ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (Püö Kÿ/½ú©ß‹•.¾vúV„+þ‚´Ê^ø‚T‰×ËÚjñ/?“^Ê•ÄŠÏWÜyÁ+¾ú³ŠZü+µ5jR¼ŠDª®A±ba®&„k ‰x½äÉêt}!ùø¯ÿªa2ÿe+‹ÆÇg”Êqâµçÿ1ºðóq!wès¨ƒ!F£­ƒuÝ~zšÝÜok¤¥£ƒ‘ƒ¶ú¦Â^ÁHáµ šz‹ËóéÊ5¶ïÂB†¦ä}ÈöZ'•’7«+„…Á#‚ß–>9¤©££+KæMûÆ…<—…×Ø|êe½\rç™Z?ÖL.ÿn¾l£¥¾¹¼Ÿ'“=nßmuÆÿ‹rÒËêGû^ñr‹kIt¥ÄÞ/ZóS”²¯£©î{¤ë†­6|_G–I Fc‹Ù„ètZâõÞ}zš¬OÅCåNdŸ}Û'ª‰ü/›^ŽË¿:n­ö‡‹M²+ì*}égg¨¥­­K`Ç&=˜äJŠï]êŽÍ긧# ñ”=Ú«®‰ÿ0]'¸[( É–™íKªÒ8R—¾ý²mZv‡7P­‰#Í À*ÿLÙ´EIHai@ç³7kÉäJRà› ïçPfY ƒÙjDÛù/'@0ßFeìXTz&\â- ~¦Ô‰øã4ü»æ™'Cóg^'8³ #ÁÊ?êfpùƒLÑ€ !Sp-TÏ2X’è™<†šî«žåAšp'n¼YÇ—}+èj„ÒYù°$=cÅ‹=»PÙÇ¢ÙÎ ŒC0L­s¹L"«mÜ°$#ƒyc’vÝ”´¼S¦$êio¶ÇõYv¸ý/Èx£ñ/c›¤ g…ìsEv§õ¬¯þþûàE{ᆡ»Î²,ÿòi¯¿w”ä²é¦EâŸIñ\E›\#žæ Ûx°hh'äШËAÕÛˆy;¡Ð}9ën¼Ö)¥xèãp&oj†ÀßBÞÄÙp ™Ô8É`æ•X UÏ,ðž\î„ûŒ1l#{úqÚßÁ;ùŪB²*FîP(t<ÖaL(Éo°–ÄàÀlSÍØ„û8³BH$AŠEK=zDêQáz‘üš–Æ[ãC=,,,½Ã÷óDЭe¶ èÓã'sGß#È]ïÊ£]MÃOg›Q¨,c}£ºÙå`§óv>œ`:9.ÄÒÒ*òhBJïR\£ov¼HŒ477?ñ ¼óøø6cSËØsoÏoµ¸WØ%ÎÏÔÌ"üÈm‘¢N+˜* é:=UÆÉ°S93"ÞT^E øÄ6W2UýüC àU¸-þF±b+˜ÙæV½= +hj„²Õ:#˜mÂäuãþÜ4¬‘+Â6â¶Kñ¾6qWe!/³ ØC7?£Òœù£¯ñšvCÒü4¶ ´;uç¶öÍ6I™(±PµL7Ü?†°ÍªÔ÷ñž£¹¹ulÊsäöTÎ.ó¸¼îÂ;–&v.ÁÅC€h©ÏÉʤmB[ñ\¯™•C'WU·Â dëX»…–÷-ªb³¾¶{îÀ,È6àÏɺÜö±…µØ ´ó6GlÓ°,¢Á,¬Ó1Ä6;]½b°tS¬vƒMO)žxÒ2Û¤¼üò2Úp›f´5;èf™$W+ØFeãâ÷êtjÆD«·»±æ¸¤ÝY„S;”ϱó;¶ºY™™Ù_Éí³–èÌ8ðaZVxÉ16ÇîÖ}¯t³XËÚ¤~æCMGGGÙ‹CX’ë°HA·I‹r1<ÚÜÙÝ^÷ѧ}ªjÁ.LCóm¹5MÝÃóMY‰ÔÐöþÁE¹B|¤i{ ¾ò¦bﶴ4?ÞgKr8JÉë3Vts÷ÂæÞÑá'c²¡™nËÀX½Žp§6`§›fPÒ10:Ô›ìA1Ý—¥PS‚I¿ëüë§ÇB“ —µ*m‚o~T¥Ðó'êXJêW²û©%e‹Ájl³‰P·ÚÀ{%ÛÔ¾8Iµö”°¶×"0êLÔ¼\΃*°ÍMOœÛÍ.ðÂ׊x=§ùü'ê6ö‡î•µ½M$™!ñ˳ ÓÈS¥µj ¶‰¥þ’ÆÎÇš–ÎŽöÓvÑ—¡¤l#²ÍÎ?-/}zÏq»¢HÖ¾wÈW}å×èxuKtSÈk,ËÚæÈÖ·rMº›½ÒèÒû8J‡a“Q[bâ ÷i g&[ap³ä¦»a›œ*9à…2yÍ| jaëæ@¶Ùå¹ãò9KÝU\äÉÓã^‘ç>xi¤lcïw!cRZ…m8;Å uz8|A/D³ l³W!Rm TÍ6¯š¹I= nw¥ÏbÉî#à[£9šºTÈ =C£C=e&ºš¯Û€òÇûô¢¥ÔÚ ·™Z±|§j’X°0< I…¾˜·"o)è.³x̬U-5;LVœ"ëíÛdˆ++îf>Rá3µ§ 4å‘”Œmú2Ru­ƒ¥²1ýêÉ+0°7g,m®"ÕrÒÇÎ-éòÕ3w]ÏçƒÛø2·§¼•ÔÛØ3¢¦éPÁÔ6Ó’·;È‹Åè›»I¹>,BØƇÃjë,CÍà¸Pî«öËŽx<¶¸‡»¢¶Va=£#˜Ö–矇aÝæ8ÃØþñ£‡0\9{ˆ¡­”Þ)a/°¯k}wk –×mÄ€h¤RgÐ'µ")ˆzñÏIÙº*¼Ã6¸ ëJº ‰B”˽ÎœùÄ—è6 ºÈ™‚ŠŠÏ f^ÁY@IÿŽ!Ï#Õ0Y¥7syqšì8¤ºïøáCž|‰!z¸¥ìüáíT¶ÁóÒ~¥§yÎÙé“u)Làè¯K¶1ÖÑÕÜ¢¶Y 5µ-X]˜m§Í 7[WD4dBÔÌïƒlã¶ýædÕ9’éQ¸Dç=I”Ï|¾û2Û8âð B²‰sX°¶nÃÙ •w:€æ“¨¤Ûèbå…D[só½¢þ/Òm\¹v7gAV/êc¹›µôj¥%îJI~ÑŒWã°z]°w¤…Óï|ϳOsitqLGgg'N;¯G°Ì6 ¥,ÑÂÆ΂µ…!Ç™!ÎÔÔ·í’^eM¶É¿¾ßÈ/^)Ú7§-ãr%ÍÇ×>:-¹~ë£ëö¨b/jÂéöUÏÄê4Í­2+UµíÌ£Ø g,ÙeAé6!· W×mÀƾ0`„Áµe§Š”{³Õu›úÕu›ã4=³}{!ćÚkìJ‡¤&_)Û€ ð)g¢Ï¹ yÝæÓ½ls·Š²RµEכȧÿl¶¸CeD¥‹+nûº`ºe»3‡ehîäì Ž›¨¶Ûh›ŸJ«YgÐýX²g¨¿iæs d¬ñ¤â‰;Ù“"+¿V(G7 c]oî$é3·òºV£#Q(Çø̓óv LØ­AAÝ&G¡@øRÝFtÛ oœP©„¨]«ñiÒmÜ"¯‹,2±cš?_x’ìŸÙåäu›‹?Y·Ó²b •ð¦{iHA·©~ºn·»ëûüuq,'¸Ýáµ?ö @¶QÃYKa Òƒ~æd¿çGp¾Ò^D9²®çõ~¿s[57âu¬"dujEÖP`›ÅZß·â+m.¤w| Û”Ü9ÂöŽVšM„Ø&6g-¶ñ¦½[+ª cðm\9­zvb¶ v@°7ÒL¦=íâ)±ÍÒHL ®è[ZÍJ ܳ¤r £wF0I¡— ¾L·¡{º»n?q0†A!¦|T¨L!×…A¡1Íl-ŒÌíÝT’ñŽÇðœ”5ÕÈÜÅÙIöJ;Þ,Œ#ké!Ix}b+Ãc÷Úº Ggî –•CÌôjVâû‡LÜw)± ô€?mJ¦°:õsÀÙhc¿øŠ9æŽÙœX%Ù,@;Gi4ö{Ÿˆ×I!1,|N¤ɦ‡ lC¦ÑàsíKFR-w|È4öñ3§ É7ÝUצ¸xW•n"Þ‹A0 Öégós "±’b«0šû|™¤K´²wbSÙ~®¦.»sfp°r¦ªŒèD“mnë`nȦ‘IÛ®•"Èؤ%¦åqd–Sžm)†¦ Bâh+¿ù FRpŠ§ë©ÚxKÂ6ú:XS{E!±šüÝFÐôlw¡NdžØ;žþä`N÷ ïèÈ_U·\.Û“‰¸O]óß3ÙÀ5>6ÐÚÚÚÕ™@çÇú[šÛæxóÍmÝ"é ó“Ãím­­mcÓ Ègý=mã3‹R Šx »½µµË—sq˜ík鞊™h¸¯Œ¢gp ycf´«{H2Jííœ\Ïô¶öL-ÁvÊ©§í“ƒÐW½CÀJŸ[o ·çV¼ïž{Õ}C?°‘ž®6e´ŽÏ-N÷vô) ¬s­M­S˃QO[ó$O®Eˆ¹`ŽÑÒª}wz¤£»_ž6„ Ó-­ PFçZ[zåíÒ #m­-‹"Q_[ÓȬP©hëœñ§Û’ÜÚ3¾¤ªõuOÎËw¡ÝmÄ.ίÈ~[g×ð²35ÒÖ3¨b¤)ìélmišuWñHo{[G¯h~ ¥SRe`&Á<ÊjøÖÐãéëËÖˆov¼¯§ÆSß²½»k|é°;š[g”=AOkóÄ¢œÍNÀìë3ØÞÑ56Í•IÈìÄ`ÏÀR6ã=`íñ{ZÚæàŠ…¿R’Ñi®JÆäM¶w Šåg(ÚÚÛ;DPǵ°št-k°â¥Ž¶–ÁêL;;Ö·»Y»›_œoní’͇ ô¶Nó$6Žž4,#fP§¯mN=ˆ!éj„ì¿)¨;òÏ×¹ÿuíw ÛüÖH^ü«×m֌ﱰ¿z†”d‰ÊÞMu¯¯È¨X¬â‘X¿­X8¼æjk±J'Ú¯[xâoßÞ¾–¦¡ª¸ÄÀÏãבÒ/íÅ?[w)ÿöxÆ|_ ‘n4Íÿ9V;ªcžŽEQ ãDÉJ“¥©î„¾t2ªWÄ¡¶1ž¤pÅü­L:™"µ;ù©Ô¤‘µ“1¹VLzÛ“Èd:Ûôàå·B‰_2;Ô›°Ã‡J&“hú;nM ”k1Ö›EvŽ•¿ye‡·ÅuH®Ú»®†3c.)Ezï`Aš^*ﵬ¯9Úi¼ðiÛDߢ½‰êÞ^v1׫„e`ô¨ðkJ@Ós.¼Ü@>Ɔ÷×\-ôÁ'L}«Äûù¿h 0WÃfsô@œìG·~“É ßl–¢êiúqC«]q¼$¨mNëþM)ßGÏ‚çé~†Þe>/\j›9Ü‚æ«'à±äwrÇ&@Œe\ÝEÀà_·ÃËü[YŒ¨çŸç¦§@LŽöt&°Œw,B©jboÔUÍ6âOGì4™þ ÓÓÓS£={lq,kÈwü´ñõŽ´ûjÆèøÄÄø@j¤•.ŽýaPÎ=lò h€¹Û»\W¢}ðD‚[Ô²£x×µVÌe¥ˆï ¶Þ~jaJðÄH§›!ÓtÏ£/WÛÖe› ôoÁ6éQzºÆQ]#“Pé 7‡™h[û_ú‹• ä륃zÚa/{fç>eÄb #:†áún0Õ±ð>/qPø›iWr ij|^Ž|ÛDl1?«êéÂôÐðï/,º0 £só·Ä6` ߊ4÷“°ôáÝAU½ã×o÷ »‘ъʹ}¾Û^î“.uªKˆ‹Øsò¼ºÙ•?<4pÇ¡Ë\^O@ànÈáD4ì[?öó‚(‚v=¨x\¶ôxÑ-æ˜Í‰YƒòªsKaF~\¦0ÛìÎh“I`¦J!·M.­Ã6b¾7‹~®l@vÜã_-*ý¼y{tÙèªxÙ-ã½S;¯¦×Èb¹á蛚}!ØaëUY#¹²Ã}_ÊUKmìýni6U°Ýγ2zâyäÖØ=¶Ë?,†7ý9"Ø·º¼¾²Ñ¡AAÛn¤×Ê”®æ¬Û‘ÁAáiM²›µ¯.†î:~“×xõG©nóþVRHpPpø®·Õ²7__O ˆ;™6#½3úùíîðЀ€Ð¤{¹HöÄbalTpÛÄìÝ“»||O¥½Wˆ&­0¤GBYé-Lt®ßá×]ñ9ü~¬é]¨ŸOøÞ3³Ð_x?$À/úÐÄ©­/}ЉO’J.ó =†2ó)1(©¼ôY²ïþ›¯zÓHæîþž{å–ÖŠ¦m±¤{=‹²yS½E•µ’}0æ»’÷Go½ôü“,©ùφ„lymDÓŸé±ã<°Øù¶vT-ó ?ˆFùl{R¾\Vé7Nnßs²{\îPPhäütMT°wåà”—6¡ÊOr ùm~’tìîJVÊI;tøÒk^A¤Œmf»>î k1áâÄ͵ô~Lü•zñB}xApHHxI ¯÷ü¡þþAG/>•rËì`mK2AÊ>âp9'V#Â6"þðöЀŽIÁwN6 aä-ç$5ânðpÙ‘_Û^_ðHO rñ/ªko.¼Sׯ‚Ù&{ýEVEEÙ£¤p v$Í·±ZŒ‡Š>å< r4ÆÒl!ïÑèî­Ác/r¹Ðº$oQ }¾{#}Õ}Ù”ÙV»æ‡¨TJ´uÉÚºèQ0‡æ°­°qPI@&Ón .ÈÅ(VÞ›pÑš¡ù¾eßž¡A±–í³q%Ú}׿Ž÷'HÆHPªØÆ!î¢ìçÙ#—ãoalÆàéÞ¡ï³sƹ@ù£Cx¶]FaYEIn°>Îÿ"´åEùÃ8mšCæÇ’’Â,g!á ´ž¢5û–dñ¡¨üSî‹/S-N˜šÜ#V[“‹J+ŠsßØR5Og ƒÉNôÔwŽO-(*ºuØk Jêtó-[èO>|,/-Üíiä¾ÿ’MK#š•]XFySWkES+ê͘b&œpÞqŸ;'”ì(âê¦åáÔ§Ý=—" iŽÓÞuuw 0÷<í-ÖrÝïûVòAw†ÙQ/'˜ìK¼^PÑ<ÙSBÁF¿¬jè\xÅ• ç¹»²c\Ùr#l5ÇáŽÞzSü1;Ö‰äv,ÌþõhkŽÛÎ%å…™O8:ØW=p-õ=Ö „F&Ô·wÕ?¢jb+FDÀhŽŽå´¿¦¥³¹â[Sëä8¶pÜ•m³+µ´òsÖ£dN¯L ·G¤zÚ§geÌx°”Šø KBx¶ž|¨Tׯ“é–AEåŸó^ßrv7Ѳ„؆Ûò‡×žUXQöéZ¼=Á+¼ùî„‘Õî"±p¦¢ BùçÚ«û\éfáP{´›aµ§½­ú\~eÕa§^6ux›N‡TýËÑexOÀÖ¶Y‰ ëšúÎÙfjL'h®UG—òlTRÛ 6}7.¡Öþ4Ìf‹~È¿«wZ±  …5ÇÜè;ï€O[lö½+15]‹QcG‚×ɦ¡$n¥¼ùY_Äí¯ÄÓØsB±d‰ß©3M\`if¨£Ê·P(ȸˆ³ FÚ°•1-µ IIõ ;¦Ï3±R鉦í ¥c·¨ci!;¼Ê.“x>ÖÚ¢í>,µ¨½Ee˜ðàÅ Rüöªb›…¢H Æv\B싱 LBÝ’r}‰gŽìcàÔ·èRƒb¿Ì,AÞ¨:áBÜv)µ¥éÆs—î-‰ÑþÎYè±H$½ó#Ø\‹¢ÿÉ&uƒFiålNzX<-£ÖdWˆ$ž͕œü²c¦öÇFûõ=¡ÇÞ }8<å>ä/Vmž—$ anL.œGžæƘjXžƒ¤"ã"ÑÊ^,UÚf¸R¶)”5‰šÇ]£ZØ<ùi¯%æ­LúŒq”|@,׊:éÝP8¶¯¿=éw^åõMìÙOkòÝÈÀÔK‡p¿O"t»8?ž«‰™>Ô™ŒÙbéþ4«lZ¹¸J8X&aq_öf¢Í"Ö$‡ê8%H Nx(4ÈÇÇÇÏËA—`7,a&‹AÖðc°{ïª9¤Œ×Öm–ë;Ôr÷üGK=mFÈœhº´]ËöÀjo"»- ¶0Ãnçôtw÷ôçÜ‹a!æe)Û¼±r ‘Ø5+ìV©ÛHMÇâù' LÿˆZtðœ.‰Sp¯éfÍ#ÈT Úôµ5?M‚ì]dͤ±ôŒŒŒô™töŽ[ É{hk¥H픚óèá`Ó™ézocÌÔ¤H¹ÓØi&Cõ©l«EÅ…JBîÀ>_S2ehddÈaÓì¥lcD~]3Š¼ÓðÀ•åyO¤be¢»öê©8k#:Õz/ä.[{HMïâÝ:ÒôˆÆðYDøòiÉ+~ ¶Ñ2I”vë°¼…pª§îzâÉ„mz%¾þƒVêd<×ÈÑÒªZvëm ¾$ÙÖ¢þ„u;È6³^:š§›$ å•žÙÀ_fîàýätœÖÁg=£/¨,3hõ²eUtÝ^[/F²ÂHÖe¬õ2Û¼‘²Mý ¶‹Eü¥%Ùöã°ù©^ÏnâÁlÑg_•lŽºÞo¦HÙÆ,I¨šm¤1ÊÕ×t‹.Y?/ºäkå|áƒâüñŒ=E=­X2úË Z.³»Û®Î6­Ù—V>+L} Û´þ‡É>3uWÃ’J} n¡Pï59OœÌõp®‰Šº8Ä–¹ÿî'ÙLÜI[½€§ ª&ÍEcµš8jphˆÐ­!Fd¼…GÀñ§}¿q÷ãD÷…/a›ÑÂHý“Ü黣v[pY\à…Áðh%ÒŠ+Ç0ìU¤ _{\Évagd†hZti³®íð »"Öb·—à|„‡óˆþŽ4hTrÕ0¤Žp#[ù‘³Ô,EØàƒ¾†,'GŒð^åù2˜h°¿D^·edÁ„Mº°Ç‡½b\ŽmЧœÉ›Ss&ÙØg§½ Ú Ž¾ü †®ß0e³Eûþ°¤U…Ù²vÜ/.Øk8%7#¹È8²E/lÇyé/e\ÿ>y‡SÌ`¼Oaö"tLyt B‰¸c5²¿sÈU^·Yƒm溊‰týžXVz¼Þb Ù`X¸>Ûô>vÃ;ÝÁ_õf^Ñdº| Ûpû+ÈtN˼Hãâ`–Ìé_õ\óßlq\b9íÏe±Ìù‚F–:á32‚áI?mž5/µçjQÍf¤ÖY_×`î4újÇÞŒ ãÀË.zÈHj¸åcfå”ô“öfz“Û\ 07ÛûD.(q{ª“¦ãEéþ§ÜJù=¢A^”Bˆ¢X®·‰—¢ßÄH ’ó͸³’\¬©Ûˆx£µZÚ$ß.\8æiI·…6èà dðÔGRÎÄû†k“aÝFÔooÀ(묬FÂ-‰43WŸàÐs#u¬Þ‹ÏƒÀzlc¨©ë¸m«a;.Ê[ïÑÅÑì<âöì ów3¤n.TŒëž;PÊxÃLåEÂJ«ùÞ·klIžmàµxÅljx’qìJÝ&„nf·kgLLLtDˆ·¹Y?( \‘mÆ*îêh“£_¸pj§y³ê­®DêëÛû¥Ý¸èhÊ̹¡‰·NË­­¼«cl?pr¤kÄnO æ6xÖŒ­oåx29õÌ¡(š®ÎÕRh7ÀÜŽËýÇ|lÙƾÐV3ŸSÉú6—o\tÐO½rn³;åÁ+`m¶K¯èR˜.™ãà¿'>ÐÛ™EÔ¸^.¯Ï6‹cÅD<åÌW¯ïœpÇP–Öe8Æ’«áº$¶ƒW0c ›„ »\ 7º?S²©[p¡Xcqo:´'€¯9Å.$6íÒ)K+»O×I,ï'5CÀಠ¤)¾=bO3¶=uîâÁoý¢QÑÚºMÕ¥XýÐd¥›%×ctȆq gvØÆŸðÖ4OVò—ß߬CÛºçø…óIîvú&p—²ulñdÁ^røôY))竧¡y7=’¹WÄÅK©aNF8½mïc3l÷oòçGsòòù"±¼Û¦XÈÏËÍã »jËêÚ‡åûºŠÂœuJÉêmüœ³œ¬¼ªÆ.ÉÁF‚ÙÌì|®hùØîX×G°äròÛç$iãÏ—æfeåv€ìÀð‹k¡}(þ˜38-‘ä™ÞÒüò^ñ 5~¢¯­¸ ,½ü%]ÃÒm3¦3ò‘—gûró* -ô7ç”KÆ€ÃmÕÙYòŠ«ùü™Ììb°õ Ç«3 [¥Qëò²š§E+“ýíŸ ò$1M/«‡‚ÙÏŸ ²²skÛ%=ÔÜp!øbnáÐ4OY—ó¹w àõ¿Ï.“‘EiQnïXÍÈ.–Q[uY^kÿ,R •pù•Œ@ -ÝÏÎÉ›¬îÍ4ÛSérd¥àvוeee—‚b0Ûòác3’Çù‘0y`£(­nA*k¨åcqÝøB_YNn.ôAfv7÷ çªK Àj*ª¨—&u©$;£gJ¨lçÌ[‹A±œOvfÔŽ~ßsRÐ.sy’ÙôŸ«¦Í6ÜÙºý,RgµÐ¬‚(¾s,5Þ <úüWÔN… ftÏIÑoÁ\\{/‚âwaIô“³[Ùç#|lˆL#[36™cù¨f݃Å÷_ÛºàŸrÌë÷R¶žr£\(Õ @Å÷Ø ìUZ4km× 4ϸb- x½0¿£â^;§ŠPûgàßR³ý3ømí½P¬[~]c‚æëÿy“Ý7°t?¶ûƒ¡òô17oÛ†§•¥w®ÂÓ„I¤è1Hºö~Ñk,Mßå¤y±ñ{¢1£®6ÙI éY|èà¯%dáþ€{œäºö@qD?‡´‹Guàÿùøü÷;àÿüŸ6¢žÍÙ`’ò¦‚?Öºóηhqb`¾òaÂuèLU68ìüÏ1©œžÙû…ÉáÏRIز¾¹¿"j‹Z·»Þ>B*ï+ƳP°}‹Y²Òk1ìWrá³—KM«†/‹TéBâuúëU·RP™á•/‹WÞ”ÛKgp»²’ ·";ÔÞ݃·‹Q©ÃÉ>ÁÙdüünãÊD¬¯´¬’N±B ™IϨ]Ý@4º¿ùåÚøß\Î6u‹óÀê¼Õêf5Ýuºñ©žÝ¥hÖB±RFV‹P•`¥Fo;ŸÄ«$3v¯.âU¥X_ŠàUg¾XúÀêÚ슛¢9\Þ7¿¦ ¼¾°!²2*ËîÙ««%íh8ÁºèñÙX*‰HÀbݶŸâ¥)m-ÌÇ©¾î.L2)0á~gÎw'6q:ÓY<ÿošœâ'G]패xÏ]—æT·€á§Nÿn 6²8TbËÁ3õ­}ŠŸ…©ÃlÓò*éOdsøÅ1‚Vùˆ¤&›oRÈÞ b ð Û¿[ïS 3ÎM3^ 7מícA§PÉDŽÍ“bÈe¥õ¶¥NàÛÃÑÁNÖ†$–c~Sçî {Sº…OÛäãp3 gý2ÌËÕÞÖ‚¨ïÙ8ºzÁÃk©Þ]<ȤQ9l&…cq+Kâvž~í(›NÓcÑõ­ýóZfÅ—÷úâd#cóä[÷Õ6á»!ï¾ÖŸþÛjè<Í Öš¯'¤•Ü¦¿‰\Äø³Mÿ½qlEûw ²ñß¡ HëøøïÀN诓ÔgþàÐÏ«5€ùï€þ(¼ üüšñV€/I<ë)ùöOT ö âO®@Ô3èúþèÑ.øˆ“ÞãеûQè:Þps¦•×7 ‡+ ‰d2jpéU¥<Û&Úã숃Lt =8r0Ö’íeÁ`°9!ì`Ú$èÜ»Ç"É,>—wuCs•/h *•Ê46¶É?å²Áê¸,ºŠÃzš¾Çþ…õúÒ.G{ ·+å ¢w—?Ë$‘XL:EÏñyTòÝ·v‘¨“cnfn¬G£él£Æ9¨L.î !Q:Ù1ìP?¼øå!šÑÎŒ¨`{ Ó" ¾©"Ò×ÃÚL_ß%j Þz.ÊnËŽãü\l­L)æ~U#POrÒF$S ŒMU-Sñ¾VT&›N¦…¿-”rÅË”]¬‘‘yì¹Le¶£IíÁ³4Œúþ'C ô8%žN¥ë1©¦.á•}ÈôÊ ¢Ïž!ö:KF¦…½ ÉœXÀ l~þøn ‡«µ‰Ãnk—¤J¹VÿéLþì7ÕnÚîo ø‚)ÎÝKb!5ÆÔ1ò. ˜eШÉ?0WŠ×ÐBΚG_z꺕`–héà\ÏK¼¼vØbãoÖ¨Šgôµ¯¶ãmðâD¨žÏþÇÈM7MËRÂçG»s‹à3NyŸ(š=Ò–Ç© R¨ =LuÔæU*û¤î½Ù,ëknÖC-l~¤¡mÞ ¶›×>e®‚›u¶ˆªšìltÚBðñ3ª¢ <ݵ‰µ¨"å £µ$*CrÈp¡…s4øæDéIÝ ñYíͽˆÓ‡F£ãïÂ1$?¤þòSHtCÈùXú”›=4F5í¦»Ù#-FP7&6"Á|~nþüÒŠaÒÿ;à‡a•¨"ßýo ¥Lðû€?0aÆÿßßC$Ê×ÿ„Þù/:@a@üWXE¹×¥9t}"dy`óþ£:\È}Ð͉…¯›ü{àwròÝÿ üíÿ î}›`‚äÊ÷ì èºÐ) ïà£ÄÆ+pºŒ*Þ2Û¼½‡œå$º™z_…ÔÃöJFê‡#\ ßÛyH¸«áŽ©÷°ŒZÞÅØ!§(X`4Þ!Û) g­H”½³@}Š¶†Vb6²=ż1—Ñ<L6“_#‹ê„-F„-ÙícêâÌPnÁ'hIiÿ3oähŸ™:°Û2áÂòpc¯SÄIh“^c‘± IÉÓcžf’½^ïq¡„AÉ™³‘cØ]©>Óª§¦›7µzÊ—¦:òõ¼–yî‚PB ‚ds¼ûÃÖÅ.¯×f þípÙ‰ét»Zbˆè/×!ŒåS>f£Ix>*»#Šco<\¢Úl cQ/Ì6?ˆÀq ŸýÐr&ào¬Ó ›Þÿ Ò$ëYk¡4À½½^WÔMÀ^gøZI'i1Ðýßÿúë™5T¹K!·‰‰×í˜ä‹ZÆ6PKçÎöµ7×ÖÖ¾ÜaÉÜõ)—<ñÆAç'gçùGÙéÚ·ºd½7uCó\žÌëöÕN}ÛÈϤÛˆ$hÛüÀ' Íj^ˆëS6bܤ ˆöšê…?o¨¼´›¸O¼×wá “YüÃOJmVÄç öÖ×ÕU¼!Ó‹Pý]ŽsÜ–…?UH¤Gý̜?~cb%W8[LÝÈ™=óœµõÖ§Hqœ v:÷ ú½/ÎåÄ{±çó%åÅ+¥iQ!Â[¨¥¨s Eq‹-l¼NÕ,¯£ôé»$^ít3>tI£hq’E#­Ðmêí¢NdãÍw#HÚÀ06‹ø«4XîH)•LåI–éÖ¾;ñ ‚ØÆ€ò¼Jr¢oõGŽ÷Cð f°ù„’ûËÛÌ6ƒH9ŒXlÄgILY"'Š”mf²…’Yg¢8Ç×c›#5ôq‰ÏåDÈÛm`y-§j±¥ÊÀ.ÕÞÉ%@5Û´TÝ£qìøŠn–Û¸JVe\Øí° ‰E\² 4f|ØÐe_‘ôõ!+íMÏTZ?ø“áNzD2…Lâ\ÏU'ÞV ‘B^‡O¨çÇê3¶§K>™lÐ&ê+²Í¬{¥SæÎ %ª]ã¤UlÓsúiûÈõƒÙcPÊ6ÿHVÎ@£°ÿj&B2†’ÿ—¢¸ øZt3± 2݇®­bT¥H0•OŲŠZÆ6ïÏ…™†ÉiÓß½»hÊÜ k°"îƒãáD™J£zÄÝFºÒ©®B/s*™–§qVˤ<Û@+«.l`„y­# gf½uuå… §ƒ½Þ³JƒíM§¦ø’…®oRÍìa¶!¿«“¬ ¯¹ëÌö~ð˲ ˜¶3¬×ó~»â—°®~‡D‡Blw¯«ÛL:b6Þî’ô˜©Nʺ Àµ hõJöm­8EfDªãHu›˺͗³ ¨Ûl½/í¹Ù›tó§×±Š –Æêžc5ôà¬%Þç•=‰ÎÙ1ïÔ ¢¾Ø[¦CVÒm€{:î·$…¼XAVc7?•màq?ÿ¦ @öøgQŽ ¶ù€dó®ze݆«:–íèÉ uøÝÀ¿ÚªzWÈmftÛgä·¹KÙfÒQkË•ÉÝ7‘6¶‘¼%˜ž³g¸S´¬4òæŠÎjkÙ (è6ºµCó•ê;<ÙÍÖmܧ¥lk̉x^ÿùR,Ki)“b}s3u:'Ùžt~ DÛÄÀÒ5€ßp~Åñ¼ë³M#.õ£¤Ræ ©Z´vž¼nÓÆÆé´®˜nz²ÃÕôÈDN„‹LP·éŸŸŸíëÑ7Ÿ|*Ç6üC͈ü%â_Ù`a݆2ʤºÍi¶eÀ¯m@)ü°‹ÀòD˜åî^;S¿³°Ýf¶ÑÒÁ»&•#õf®³ïvíºv›Ã¾4ÿCȱï"&±Û,LôWH¾=ëmh¿ç¢têâs ‚šéiúT×µšÝ¦XähÎ~‚­¯½ï´6Ò«…_À6GÍhz6H+lJ WãìP¡@cµ·œ¼OH+¹º™^jð 7¤k—:xD€e3ôØC F éý)Ýf~eqá¼»ÂHõmÓ1??ægè  DnIñ'._µÝ€áoþ(,æ`ryq d4.–¼ ±ÍÀŸl€îÀ|t ÕÏ@×>g€®f€õ'àÕ ÊZ0Z€l¸µzAÓøT Ó¡k›ýÐ}‡ €–0ÆS°ÛˆøNtJÜc¸¦æ(긬i™nÃõÆlL®„s1Qâ`J#oÔ€‡±ËgiC9âg{£¨úÅñÀÝ·%·¦2t7™€ÊbíëÝúæËÇe\‹50±g›o—Øé!»ö‰ dØa:6ÔˆF²p›iï$šš8:Ð5«R“–fGŠK?ƒÄuÛÛÄôè;„ØŽ¸êSh Ĥv9Þ9ä´!ðtÍi"Q²¬ïáAgó “ÈõHn²]øµ/b› }šmróãQMË3P‡À«¥¨ÑáM1O6uçrÉ —ƒNA­åØŒuF¦ÈÛžÆ@v›þ#©e¶šžm§˜#òÁkyc볯¢Ášâˆg K•pŸ5Æ=©Z5ÛkK û§…ß”mZnþ/-gX¿^OØŽÃÈxŒmÀþ°íñgtµ5K sþYí”m,4ÿÞ ±É<ûÎ^[K3Š¶¦ëös³kÌI=sþ“Tƒ³íî&T,cláP’óGÚ!‘dNÊB:4œ°Õ £…ÑÕ%Ħ$ÑÖDK׎n'’(Fl†‘Ó"Äî¹¢Á‚ºlgŽŸKÏÈ„Ien;~ÞµNÄ&k¼’î7RuÃïx nó¶šH-ü–~>ò‚«œã—;qNqN¶ÛLÿñš®.bNð KáщªÂTéo#ŸtŨA¶q=ðé«ùÛ+\ fµ ÛÈ;6¬â#ß¹åÌêyÜ:ˆ þ}Ùßb›ß¢õümÅÐV \vŒBnËÜU C¥C8°º;Çjþ6€x¥«ÑðG"ÅNÆt݆õþ6b•G1Š×¼ZSŠäÝS”ÒÙmîµ®pù¯á:ó%~YJ~òë ›J¥ZUp{+IŽ¼Ùüýx0¯`¨§äÍLN­Äô_˜«ñ¬Sçß4E_¤•lˆø““ÊiïÌ.üYÚætÂ6ë¾(Zœp Mûâ8øÀÞHàÛ‡å泶ùŠzqáà»üB%äŽ Æº3#“󗯄ÙFôëk Û¾×|ŸØy`á;JîX™.ÍF‰mŠ¯82W€®o5ÿ+Kû³cf^GJɳ@OUJ9ƒFq9Ýüg±Mnú%lóÁþÇÀïÿ+ð AA)ø#ð·ÿôÕ–6ü‚kB‡2ˆäÝW²¤†óêú;…ls0˜}ìa€â›ŽÂÖI­÷ìÛ'}åŠÎ¯{ô¼Â8ô«&}ÕáŠXÅ ä;”ªUäåWºþ{\Œ µÈt<í½òÖšw§Ï=iQÅð.Iy‡x©ŠóRö’ÇÁc•ˆå{ªíZRÂÞ}o¼(øY•$àì§iG<™rµ}Bù„²G©2fÑ> Š_E/’îe+aóö¤‰mlÁªš/·ö: O°>)9Ô¸öõmî_IÐÅÔ,¢ÙZªîè•G9™éûl˜žGÖ¢HÏÄÿd®Ív£›Æß¼{ïì‘mšZì‚a}|©ó=f3ŒêÀ(P|ÛQòâÌpmUˆ–.É!ÚƒU-½ˆ:"êh¬)/¯è¾?%c›¥ÚŠRä<ø†)c<ýa´£iÂÓ•<;âéw:ݬõ¼Æë¹D¥™ü¬5€Îgøu•e+fho¬œä¶Ö–WµÏÂ^*ó­õÕ`2š»`¯ª²œË#.ÚbÁBEeÕ‚P<ÞÞð¹ za¾»ÂÑ+HvÜBJ5ôtpápceu7rš‘ìf¹ý:èFâÛa$¢ŽõÙq(éäAS9â~xïêNVàéjjneRÙ¶‰çÎyXZ…n7“²Í¨#÷®u q.x·‹p¿£å´—‰"Û@_c^m¥‡éX¦ lüÞM²9<™5éÄ&|hU^š°Û‡îã¹ÝÂ=,åõ¨¨Ø3Ȧ^‘çSŽYÑöûÓA~±Ð£<«F|&цW¶é¢ÈØãm°óΊ bm0žB+ôý8V§Ê–ôhQ-çÖU°P @ñ•PymÑ6™[þX=|‚Â6‚¹^•Ü2Žxôób˜[¤l#–ù85¾ ±ù" ñ”2ÛÐÊ££÷ë¤ä#Üïpìðn}éø»^¥ ä¨ïqàrÝpÚëuWò`²‹Õë…qæ¬xÉñÓïãYf{KÄ+<¯„ïmMõI执e+â‚΂õÖÕ½ÖR ß 3U&:Z¦6ÎgÒ^Èœ§a¶©™̦’92×øçûõäí6P³]ê1#±êàµF+ØF ,´í'FhxSmÃ!_zSÚßÓv>ÖÇÚg×6™8æ¡[UpÄ‚}T£°ý)IIgÎœII>aŒ%žmÜŠ†Q·|Þ©§E+]ÍKI,˜èɼ}˜A`=k­Œë†zàËqTP øf†ÑâtMyÁù#ÑZê8ÿs¥lS;×÷žB6œ’º®¿*í:„c^æ ï·eÊ‚Íßïduò­LѸæLñ¸#Ûósʃ½Ò¥Ò]+Οqì>²<š¿‹CõI}UVò AIIiû ôa 5éfÁPþ-šu Âxh«|8etle,ý0n7zQ@â©6#“BIÉ$©Hu›¥‰z*…4Ä•hGÌ4a¶Y¬Ôç=¸sç‚Ä ŽßÎÛ³d!ûZ0näK·ÍÇIÞOº$J0í®ƒ9Ñ '=l#Ήb±âs¥Š‡úÆB)?hsâå³½úAÐÆÅ K¹>?5´ò”1ÏûÔH³€ý ZŒ –êafP@âÛ óì6ªõÖO•5õuÕÏ’ü¨'2+±p!Àˆà}ìNMmÍó³{ -Y¶»ÝfúhLxŀše…‘Ôš—¬˜:ÙÍó2™*:‰Ñ2z‘_ÞÐP÷<5Ãt…nsGwFT ðUë6€x¶œ¥£}áEAcCýÛkÔHv3È.(K%,–ƒ͸EJVŸïœŽ»ñÀp`ã<^/üT’óú*[[+9£|«0%öгViGí´ÏGQ@âÛŒ£ fZŸq#ØËÅÅÕm_Ò=„Až%ù¼…,š:èääq5»­îe|D"²ÒD¸‹u~—EtÜŒ½ž%wc6ÌÝ®jH ÑtCVt —³“sôÑ«S’{3~úØôå9©³|®¦·/k"Ó#ýœœœ£_š’WNöx¾ ûªàLŒçñ—ÒØøWvy¸¹ù…íÌkGV`§ïr29^†pÍ\CºÛA€Ê 58älW=÷&¡{ŸÆçJ|ŠîÆy,E§¿Q øëÑ®¿Yƒ.-Ef4’‘h» @]ûP @ñ3c°»utV€r (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ñkÀÿðÉš endstream endobj 624 0 obj << /Type /ObjStm /N 100 /First 879 /Length 1795 /Filter /FlateDecode >> stream xÚµYïoÛ6ýî¿‚Û} xüqGA´E¶4Э‚&õº¬­8ÎÒý÷{§Øn-9‘â¨@ SÊñx|ïñx¤Øã »h(±aãKÀs1ÑgØDÎ&:“`Á„߈¿™”ÕÚ†Þ M˜¢mS2Òxc#¥À›Õ¶˜—ì“!—Èp C¤ãQ6äƒ6 ¿(L8ˆ¡¨£âÏ”† °§þêNI2ž ÜsÄDþΞÐ`4b4žØûà&œ‚ñA½GƒÑHÎøèÐ`ؤ oЋ‹öJÆg5ÆÄ|Q‡ILpEß(8D£˜?æ`BR?^ ƒ‡”Õ±¨ê°S¼É¢¡C‰7¡xàBa4XÀã Ô+ApÌÙ)SÚ ›ÙHkf“£‰ œqV5œŒîÜô J,½2É„ÁB,JhA¯’´°Kñø;Øú‚ÑmˆIÔØB[e#yÌD “¤ƒ †K€r"b‰ST= ‡î Ç)KnD“ iÝ ð0•¢o¢ˆ*¬¢p# «R&âÁ³W $m¨LŠŽÐbÐ7¢Ô4Ð1Q¢8£Ñ ìõMTˆ¼j³$Ä ÍqQ?ACJEv:A¨PSÉC|Yßb^Ðzj6 ¤&)¢«FNöö&Õëÿ.§¦ÚŸÍêŤz^ÏßOço¡;©~®«xÀ²8™T¯¦ç ó6Äh=¦$Zù$›0DcC)°;¾>[ÀgõËÅìcµ¿·×ŒPíŸ/.êYu\ýþêPÿ?ù{±¸ü±ªnnnìÕ¬ž/l=ÿPý;_TOŸ=›à_'¶¥_Ó8Þ*5«P“w– ªU¨€-PÍ×P÷ÍÞž©ŽMõSýº6ÕKóäjÚÄi“¥§f¬@„¬ƒ±Ò2B´ÍZ’`cŒ ã¥yË«3¯Lõæ?A=¸›Ù›Ùõ§O'wÚùF§}6 A9÷›‰ º1¬©¦±8›†YJ¶XnƒL™-ÇA– hçaN¡L~ipV¤ÀA=[4L`å$ʦÓ$’äò 7 ×Þ> ­'皸¨Žæõùñz1ÕÑËS½ž~Y˜“M ½û0T/0Òt¶¸Bziº«Ð®êëùùôªÙªšW¿Nß_¼{^14uw”⡶£wsôÅjXÚ5ª¾Â¨ºh,'ã¨Þ§d‘¶°€«ÛÝÉ:¤M$B›|Ø®û볕ô³%›ÚâGÚ$þ ;ìâ­Ã.Øgׄœý ZïcòÍogÿ(Úëð3ö·äÿð³Ö |?å°Ë/z©Ïꢞ£kS¨ÔG¬”Y‰Š-¨|[0D²É9ÝIýšý,ÅÒ&? Ì|¡Õ;Vx©x€#Gw0¬¢¬Æö-| †#wŽñA ƒJLÃÐÛ°SôâŽèÝXÒ i˜G~À’ï–Ü®€%؆Ý÷L´€\†CÇmò~4`܌ݮ9$ݪ^Ï&·¿¼ü•åo^þ–1sMI¶h†!Qè£ü·X}ñ6ðý5x¯Æ[†ÁÁ&Nà2^KÏÀ=a¤ÑÈØb±õŠsT|b”k¡' = /V‹Ä¨–ðë <鉂Æ'…‡žªˆQ‡ã8êq.ÀîÙ‡Œ² œPæ’žèQCã\ÚWÔA¾½òÀÜÄ­ÜÄ@‡^;–)8”>&‡m¾Ý„†óo,ãä°ÒÍa²kÒ_ͤØܺjÙDÙõûò„Å+#‚ßWžê D… 閤»R!Ë=i—{Ôݷؤè ü¾cYH¨üW>ð„Ò_Æ) sêàœÃ0œsnãœã0œ7ì€[)Ó-éÝíº2$½ §4,ÝJ§¸]!+ÓoÙL«1ku{퀕Õ{¼>;/É:_úípâÎ2ÀŸÃþì‡7’Í7ün¡T/xGIõâB›D¹aõ’x‰›v˜5*LO<¶îõ®7¯uß\øŽQ²ò ȾVø²¼Û^¹÷ß{BI‹ó˜õJ0ÔìÍ­K±1Å_OgöæâãÅ¥N£¹=Ö'ô½ZœÖ^ÎëE}^:]>›Î¯žnQú`6ìôþ&m½LjÛEò6–Ѥ~pk¡èw€õãõ‹GG6\?bì¸ÒHÝeݶ‰zԤ׎J€Öر·%¤‘Ió˜4Rb‰ïãw&Æ$Æ·AwÖDZS WÆãZËú‘lÈB§Z’0¬Z’NU*aXµ´iw‡–[6Hù6ö»"ìÒ„´>2ú¨Ð}ýØ8Já%±‹~Üý8ýØ‚,é'ˆÑ!cý®º†L¿´ŽY÷S^cn¬ïóÏiùÅ endstream endobj 761 0 obj << /Length 1464 /Filter /FlateDecode >> stream xÚµk›Fð»±ToöÁò¸žNJóR"EjWUu‰*¯m0à\®êï ³`°'Ž}ò†ÙÙy¿ ww^~›Žž¼T¾±È—¾3;t/d^¤œé̹ußoÊ4‰ëx<‘AèþY™’ W›tfÆÁÝ_ñÎd&® ½(&™œ¾½˜Ž>㎠æ xà$ùèö#wf€ãp¦¢Ð¹o¨rÇóCxfÎûÑ#nåL€~œI_!µ/œöï¾e’àŒ«€LJ“TGåZîp!ê]àÎDzÀOý_c»i½Ó´vë¥!€Ø4à§1øÁŒ…vî,Ê<’xE@׉åTXTLjm’ôç2¡÷×ÏÞþn/ƒ 6ž(©Ý)I÷Ý­ðb>`³½–›ªŠ–*Éâ²ánª;,C éB°H[Ó§ã¬Y †¸+¹÷#” ‰¢Pâ¤~X§5¡ÓÕ 3å /Þ/cKò h‡F f]w™Éé¥ñžÆ¥53q–®–p·èÀwŸÒ19Ï–±Û‹é| î››Ò¬êC–®7åºhÒWs«+Bo}ÁÈšòP¹[,R¶^l€¸;/ÊíD˜BÄ[ŸómîðC¹se“˜æÍR{PK~È|¡_ẏü?VO”\ »šð…t|1­å1ÜŠˆ€–X  Û>¦'&b\ˆ¾Ä{bQ¶ŒKãÌrîZÀγ)t_:!Ô­ïÙB÷¥f'z…~•§«ë›<þúk.aú$·×ÿÝ|¼^mò;SÞ4tõ8í)&Âð'œ¹S`¡ôI18eÐÌÀ):LJë”_ã|™+¨ ȶé2­ÚL‡¤3BdEñ©êr™êb¼k2ÜÝ&ò¢4Píe›é-©>%›u(‡’<'›5¤›ÐáñÉ|@œ‘Í=1ýl¶Œ/“͘Š¶³PªÞè3óót÷ìG žXAËOÍY(ƒA~þTã´46óbz”Ìön‘¡bºÑR7 ‰q°ÕGcž¼Îwž¨ïyû†§!ñ—¯ÿIg?·qx­ñžè5ØÃæí@A;í·…E – ¯+h2›|Á¡gSáÖÁ÷EoZâÉ:NH…š°$TÄ¡›Z…î—¦ÅXÚÔRÞæ¦qeV3í ÇSܤ°ë†”n^ä8ÇÈÒ$&íÍjÂÒt;Ç3:¶·…»µ–YeŃû4ˈ5"(nY®³Âl*ÚIú Uqn™§ö^UìHE–­¦ ¾#lî€âÅb•þÛ¦ÝöáYÛ~W+“ÔÕðx»¿t…“%ðª{+Li>C„ëá#IìKtÓñ¦MÅóW韘ßmú*€âô¿ÓÔãÑYÌVÊ åßË´|–j5hWÚLNöÑ~¤|lYâb_im2z”Åäõóaêò“RÒƒ19+%%lq|ôœÜŠy¼¤T ¶j9ÌJ~n:žìŸý0 \nQVÐz¹'~l9ÞO[E@)Cæ‰vÙEDä3íõbW™Ï'ì"Z;…ˆìw 6ø_X“GÓñnÞºêÂrZº ØT1òŠéŠ¡ gÔ*±¨ Žµva7‘ìÚ½Å8µXÆcÉíÐ'‡8V‡¿}t(i»Ë >?ßdàš×Ý'’oLßtdb§g5h6‡æÖ2Mì5»Z Øû†ƒâ³bµ°J¡÷î5}póàGŠïM,/0ßá $«8«™ ±P=v/ÝJy´V* ¶D ËñRþd/íÇ 8ø—k¨‚ æÁåÇðï»J>8æI«ÝÏÏÚƒŽùÃ_Ÿÿ·“L; eØ”—ÿ‡A÷ì³e¼®Ûåô*6üá‡ôw0 ª]Mÿ’Y|ç endstream endobj 757 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 68 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14079 /Filter /FlateDecode >> stream xÚí}TK—æÛùçŸÙÝ3»;s&윳;óÇgƒM”Pl%$rÎL2` 8`p§‡qÎGœÁ8‚ÆÆ`›ŒÉ9gº·“„$„í춿ãЪ®®ºUuë«[·«ª!ˆ @€ @€ @€ @€ @€ @€,AùÅÏðøg&®¢ÈP)Pé ràAŠ;ÊÉ‚Kçµ8Ž†D\,Ï/æ×ÖM!à’ÒªŠýC…_ªÔàͪ6ãâFTREð“Y/jwpñ­_Kóýºe~:£ý{h¥jõ¦r?öá õpªqc€“™™™ÀÌöÔ“4xÀÕˆýpP9b¿ ‡Z2,q~ääÎ(sSS3 ‡ïÎ?’.<èÉdyíSÍ¡Á‰ËŽ;ÿþÑVxÙÄÌÌÔl&\fFýÜÒ58°€ý·ËÕ"ZšòGæàŸ5v\c¥dÌLMM}.µ3Ö LL9˜"ÿ›Ú»Åþ†›™«ßEšàÒ›…m?#Ãj ¬¶ãòÕJá{¥‚¦]­¹«°‚ÃÇZ²¹ŽB鬥…¢\8ø<Ë7Ó²PÕÚ€av~¶£äª š,WÿGï{åz6á°íW'Ã?Ú¶Ù–œÞµ yïƒ0S~ß”T£øÁA—ð=ŸUì™<+ïQ倢ùD%|'äj2×R¹ °„|Þögcµ—ÐÒ90ó%¶r §®ó;{^A]³¯5°7µæk-ûÊ{­È+ ‡½éÈ¿Pi[’2:ºº:;šO®³¥³úçÑ ØëSXl›Q%®©>Á¤36Ì€¶ä3¶YÕ×Ó½€®®éù¥F®Z3’‰bÛâ•#p˜4!Â6•ÜÔ¬¦A¥„º&ÄÒéaô²÷åñÀ?~x°ùÑ/üÒlòÉ!xŸ7m퉗/Îùž©HOtçZm#Dÿ³’öªY½”œ4"ÛvÎciûÐÈ»_ @ ¬­ºÁ¡&úÊè=s²?2uOn«r½ö Ž¢ôžÄ³òíïëÅÐö!Ó’ipðn¦Vîd õlxa˜['X~¿C^(ÙŒ;‹¹Ã ˆÍêT¤ 5Á*pûgU‹è Á Ó}†å5$j+¤Y8£<÷ ó«Ú{• >"’ÍO `²ßŽp0Ùvk )Ѐp‚ (^Ë›ÔÍë¢Ö­ß|¿ [•mP» §$aËú¨¨˜´<¬]¡´ÓÑé%]g⣯…¬öfqlÂÃ"ÇÄ ©æßÙvôn3>Òõ—%n‹ŽŒŽÓ<†Ü­ =Î4n‰ ß°}ÿ®x²!2|ûdúlÕ½¸½w»ÞÝ>‘p:MªÚ)†ïóL#á‹#N¼úaÉDMvz1œÑÀRlAÝÎä•ß=íT6‰Sb©ÞÇ1£ÈZÏôb¢Íøay.ka«7œÀÙ†o·ú³k³–eàsíx¤SÌy¹m³À6mjÅô’OV^Ù„ì[ª $mŒŠÜ»óMÃVŒ¹ª‹Ç «ŸGG†ÇÄjAS½•ë·ìTÌy¤iÑ¥Kd—wpµ™kà­×uKL›zÍ—³!¨«øFàµ^œ½ýàÙœæÐlmZ¥H³‰{=ÚÑzó-ø"똯eÐqÕt§=hZOZâˆ|É´cuLD˜mŒm•“-=M <„±«ûMẉ¿X†k…‚màÓ½9à4×–lÄÉsÿ^lC¢÷ÙE\z‹(± “$/ùhfŒ³Y³¥š/ãêÑõQ‘1qûkÐ1nv8rãV;·amDtúXq¥g£׋±¶eâÍ1›Gç~{|Sû<Ñpy_\ôö…-ÍèVõ°²m#¬Ï ±d–åíÌh€E›YÚG$?y]Ñ<šo Ë8²²º^"[HóA‚YÀ~xBIFòéúÀí§¯ó^?¶dïõC#…º^äÖ3-íí¿se8‡ïLzØÞÙ±7Ä&ôH:üHá9'¶•ÏåÌâ¶ÖÆCA&v;Ÿ(K;'¬Õ§0odWväµ.Œ!ˆmóxJż²FÙF˜{q…q°L͇2ŸÇ^aX:Ž°•6·¸õ Û<ëE¹TÎæûÖmÛ6ûÐ%ý‹êж‡FÝi×kÄÈ`«Ä6l-jÃÒ%ÙæÆÝ^|ïØüâÒ¼Ì;,}Fþ$òœ´lÅÔ=áÜý¶ÎÎÇÖ³\áÉ׸=™~¯Oñê:÷ð‹Ùbºk nö7bÚì?“"”ª—k³)l_JÕ»«o ž‚ÙF‹Ö¤qâ…ü0¥$9Dc:ö©NØæt»ÎZÌ6™"xëNâl£Çü âìh1ÚÔmz¼Žíz¦~ÊA@y‹(ø½Ù†$«3!ÑóúP]PaÑÒj°$Û@Ð^/¶ëæ“…¥e9NZ4Âu0ÛgDcùúoyßÐÚXñÔXÏ `zt4ÔkËEÜ€¾höÓRè·çþö Œ!ÝQ"‘äo2³:V¤Ì6ç=ôÖ¤Êõmä®aܧÇZ„µæHùA–i¼Ú*gðÙZÀþd=¦7µ9ÖCcE+ôLq»gü%`ÄΣj–²— a…INæNq¸%"Ê¢i›öHUÆÐÎ7לÍÈ †gHÌg”mìõI:+uäX¹R‡JÒ/†*îìVm]Tè)7ºv:â~Ù†Ó ÍÛSYÕ³Èì8×ØG5ÂlCèFJXa»ô‡° lOµ¿I¢Y©Ù6&FåtŒ¨@‡ÒŒì#l32Ð5 ”Áãù-wÝÕ‡áÇdåqúFþ“˜Ê÷g/§ºÃ×ÚË^¼€ÛX¢Æo;ÄÑWœ fú®‰³áQ£O¼Qr“B⡺-á¾]®•×‰«wÄhåƒL(*¥ SY’…§¦‹’ô v¤´,ÊWmüŒ¨*µAÒÝ{»³m8fÎÙ¯^¢Èºý(Àr¿´mzœm Q9“ÄjŸ’.° ,ÚT'b܆æµÕÅ*1ë̤`¶)åí¹ÆÁ‡Ôl.“¡,¯>ÃqâslXÃzÐi ‘l·ù·‡ g¡Ù~2…ýf ×絞Ìä×]`{¦Í}›ì4u;ßð›œKMö”Ù²6ŽŽŽÖÆl«ƒùJl3éG24uöòDáíål¨Mn˜‡Žo2‰¿\÷…±x#›¾³Du;Z¤MuÂÍéw ²Ë$jõÜÛ„@Øæ¼£íúLyìN3C÷ãüÒ§].õ¶dyîNÃfRé*cÏ$fÛ4Ý?JqÝ´¨ÐCödíÌvÆ60õÕœs±=ð¾áȧÁÆ]Úw l#pû^¶ 2{ƒ¤GÜé!—j@UÛ¦éÙ6Ýåé¶\†¹µ£“£9›”:€±®Åa¼Ú‡ßhQ\`Eo¥³Xð4£ãÉ2AµQd-ï‹KMÏ+½?š¯)ÉŽö³rŒL‘-⢑š{Žq77‡ù&ĸmÓ²¤m%¬2_åÄ´ ™W¯$ ¶Í™NͶ À3Û€"r•5‰å[?.“'†³ |ï.ˆNQ¶mš_íçYxÔÕTÃh*¹@]ÁoŸûlWd¤©Þ‘¬ÞUÛfîûÚ6h„Ú—¸4†•­½£“Ÿnxà­ašq·œ¥£|Ø—_"¦Ú~GÝø£dÒ’Êj›“-ýð× éþ²ˆ«Íø@cn¡Â6Óa½ÓÝêÏÀl³ãJåg°d§)=úíˆJÓÀlCÑÀ6ÝJlc³ö‘¼ª›zU“J3©ÉÑQ¤ób~1$Ê!麉àyÓR^⎧:ºæµR•÷òÒºszº}6“â4!ý´ XÎ÷Þ£Ú…ÅQf›ïå·ÁØ™š| 1]3c?ÖoM{2´o–âŒ}ËCO‰m©± \áqfÌU“©k¬Žä¨q›ø ·« O÷—͈±:7=–ÿèLvñ /éšSn#Ù¼hx i"ÜoîVvÏÔÒ~5×Ö“\ö—Ã9;Ÿ~ܶù ¿ ,ŒÄ›ox5O¡rÛ¹%uçf4Ol0ÑBÙfn_ßÎÃÛ‡§yöEÃc¸FJnéû v—ÿh¿M/ŸA®âD¾Û|ùb¶‰”³MÝ‹SÞÛçûÞ°L£d ô[|‰>î­§ mOP:ë$àZì§<“ÊØÂuØ*Ÿþ‹Z jú±Í!– þN \ä·©s—TÕ7ôS6mòö[šD>„Ÿ8êÄkJÀÖÛº@8LaK{‰¡s¡l[Ÿ=RÞâR錗5'úV¤Ä6ð¿–öçž-G øI¶YºQØ6*Î{²œ÷q:Î6ZÔ¢%Zšm:ÌV’KP*ÇY$JÀDÂ%ØU¢¹µäÒZ'?66V_%ÓÈ)Mnâ™âs˹a"Œm®÷’ik6P><ƒ±MÕŒ&'ñt1ŸD*@K4Yè3ô*×Óñÿün¥¡[nÝ(Øù5•› k²)̳ÍTÃK=ŽË¼’8í×Öë¹YŠmÀOØ6no³p]µƒaî´À6’%Õ`I¶™+g“y¨d²îLª®þ¾Ü©%Ø¢ZØT›‡‰–›ßLþVßJ==èÆ5³9|`ÅiΈ¢Pm.|ÊÆØF:ÞÂ!Q-|×í‰ÛÀcÑNä´©±¨7 XákB{'¥‹½Ä tÂœ ðÖx[“õù壟eÛ˜øígYúïOØf̦ÈT™ÀÊf†¬(46ÇÊ‚Ãòv³eRIç_·ä 8ª;<Ø,›gnkmÂeŒ Ã™r]‘³ L›¯72iÔþPmlŽ³œœìO?.ûÔL Õgñ¸0ä~2ÅÊA%%g¿ýÒÏðÛl03s:´gÏ~uY²×ØónãŒì½¶A&4²Y>Í }ÔŸ™—-¹ ¹¼Ù»y9ñl½áº3Ž¸‰.Rú €Ká¨R.þáô¶á̬Ŝ;ð¿íy˜fJëš4øm¸6*Õac¿z@“—xwˆµOÂmUÛ¿hK'ë?è29º­¹¨Ê½v†+2»¶aðŒ]ä¹8Ú;´I>5“BSŸ¬eP¹Ö¸mÃa0í” î¸fûõÏðÛ€N¦»Õ1‰[CLÖœ¼¾ÛÚÊ~uN›fÛI'Á0¶šùR òžA& ‹æa­‘—c"ñäØðÔŒ«u™xv¾?44>…WÃÔøð„HŒOÙApLßJe z;39<:9¿—` EóRÌLÁí ÙÜ|>'™›DÙÆÁvSÎìÔ8üÌÈبòv‹:?:"ÜkÏ-lìŸaã£T808£2“ ‡± ±N551†”aX89=«´ÔD*ÆÊ ‚b¸ˆØŠÙ™É±ñ)$šdnzhä™.†xhP(Uu~)9Ú¯ÅËB³ÃŸM`Å×Ð@’9´}„s”Î#ÀT1?1(œ’Ï|æ°*Ebƒ|vfëø'—=€Ÿp Ë&ÇÇ?d÷;W=:6‰¯å5•bx”Î IdŠE¿pL)2-Qd!˜]ø Ž.Jf­:Éüô°pTYRX1G0Ճʷ&g¥àÄðÀøŒú+œñ‘!X‡ça½RÍG,]¢à ¬£ Ró‰ÆàZÁjxqÁGF^‚ÎŽ'g5V$2-EZo®é¼hppH$– )ÆG‡§çpêiÌÚmá‚ b1ò×Æ6ŸŒöøÀ¶žIéÏCÑ?èÖבj(ç X3#ûiÔu¸)çtÎÈokxÀ­¯$ÕL«9õn‚ š¯‡w'LxáYŸ¶É~ÆÞÝû”Ũ-¼7pŠÚE?gʼn‡-ŒŒLýjF¥?UøÙ)ôK ÔÛF½íÌL*~Þb¦4 QO=® àë=¿`zɶÍo’¾Žmýì¶ Ñvøyçç_-…¯UÎñκ¦ÁŸÞJ&jªdÔTóab÷&ÌO75ÔVWW×5¶ŒŠ¤ n쪮A—gÁ¨©éèÊoÍÖVTMH–Êd®¾²²¹c@µD¢ºêª!âÇ››ªnhUä"žii¨«ªªª­oNÎA¸‹mª¹É¶¦8óúÆ–ñ‰j‚õµ5rѤËà_sÒŸ ¥ûÛjÒ—gÐ3þ‰Fö´5u ª6ÖUOÌH~˜}mM ­€ T+ýÂã~wkMïÈìçÄœi®iQ‘f~¬¢ºù“òÍ 4(U/^À¦ö¾ŸLÕ§û*꺕UP&†•¿VþÆšÊɹ%|ç}ó tðé˜×§ ), ù\Ãœ*J¡‚"¨Kø³pÔüpµ!}ïöS+•d² yÎCO·ÝÂóþ~¢.™imïèïïcgcI5ÔKA€ñêRËÜ&*2F‹€M >›Þiæ/'ç,ùš¥ÃJ߈å¼F¹¡Çžo¢Ñi‰iÈ.Œ®77hAØ­Ùötiçµz{Ü67;ª>ýn=îl™hË¢QÍ­l¼|½í­-Èzô›eCÊí»vu`PPp°¿1“në’'ÙÙÛwOK~|]Ý? §hÉbðì|ÑË€¥]ênb„ûŽ‹jA^Ö­?pÍÆñ0OŽ­spA!‘s²/«”{BÙ‡ï·~NÌÎû¾@à#iúrÙ¶‘ŸôUueìÀÊãhj ˜9#Õwâž²Yðc )«Ib¹†/¦ªY$!ãÚxÀðCW¯d`‰´‡  óç †Az}¶1ZÿyvýËß!ñÿ7È¿W꾺BzÔ^?þÍ42Àˤ© ”É$‰}¥-ƒC°k{³ J¥XˆЧð8ðƒR,þ '/ÕŒP¸+z™VŒC¯ÏéÌ‹&檳Õç»e c›íö‰ Í.©åS ª%Ÿd3’M´ ýV/FÝHÐz{Ÿ¥u‚Û€’0û»‚AH¾,¤øÎ^3té—dª›ÁdEÖá‚õä&éÙ4i]ƒ™Ë¯U‹3n¸ìØ#pÅÈäõ#“!k°ª’-¼VÔÖ{5j ì´aཅ'k䙆­4² œ (oÍ…¦Æ•DY µæx˜Çê¤ÌÅb!¥“s,’KÉDUCÐ]˜ÄX|/…L¢ˆ'‰.° ¨” Ó.4®<ÔÄ6 ­C¤å+AÍ£ç«íž&»*ôyI[€„g¤S^o %—' ªÅÄt¹,}pÀ=ò ÒöSµs ¬¾|ê ¤Z°N¡Ú¥X ÉdxI¥ä§D)Ÿèß• áR¥åH sm0RD–É D"c >°G"§ ¾èÿû ô¿HŠ:Äã|aSgº9—lâŠw¤‚MdßÓ«‚×%_ØÏ'‘÷œ½eá³í≠®IË,"ü¾ ÀÂióÖ>Í+ 9U@2ÝÆ籃Ö9pN&mZÁÛ Çë|{dî…b¶¸ ±r«ÊJ`Ûép„qÔ ¥n†ê¡\%”ØWG{åuãØ'Ù†¯mùøÉ!—ðËò”»¸$×Ä0ŸEl#]Ïcû^ª–óÄ©l·¼Ù‚X)¨|úœlnn^“¶ª²x‚É:¦Ÿk=Øðµ çöDzsŸî²ßwîÊ&€áyÓ’ËÛ¼Õö¸¾Í÷À;HsÛ.° ²,·è,@5Zµ5ÜÛžnêÞµ¨idGsZn㸤òâ2ÆjùÚ ÙY'j@bêÇxÙVq["8F”Ý©õj ¶Û4]2t?i´Q } ±ÃënE±´5!,°ëars H@¥ÙlØìÂXô »«àqã&jä¹%ÈÅŠm„NÁì]t#Þæí[ù<c̶)K^Çb±6Çm· 3Íק`¾7÷…ÇÄù;š9á£Î6Ý/–3|àn½çûnêºîÊÕ$sVü"ê¢Â6£•º€ýi_¦O`иXVw9’Fa…nˆñ°1å¹oÄg¸O™!×-]×^I¾hkΊ¹ð ,¿»ƒÅálˆÝâgp8~“HZqd™`§¨»<ÄÏÚÜÆïÈ©«ðœ¥¸¬Sþi)\W ú.›Õ¥) Bºÿ©—Èu¼ô»ÿ‚üüæo 6…ÐÃV Ñ\è÷ß ß@ó;Èt/6i€þý¿á&ŒÛœ‡þéðpøO2²ÂzÿúÛ¿ƒÓá Ò?"á}hýÅš@ßüBOœƒŒýÝï Þ/þRµôÞÿ£øħt+I×fíŽGp¼7`]ê’+-"{6û,ɤflz-ò$Žøv«±`ãsìñanºqˆfKæ'§D‹¼ý²HÞò¯Ç PÓŸJlƒß—ñȺõ£²O³–I×d“àˆ­jo»àã~¹úb„g¢™ÔÜ@ÃÈÐÌÚ10rËã·5 óò¶'Ùf_ÕçU˜:Û c›H?þÆóè»{YŸ¹®þ†'ØD¬W@!wˆ éüS+×b;¥ÀÉVÛ)ÖhÞ(Ù6äoII~‹{žtp ½ªöˆF¶q²@Ø®ÁpŽÖ•Jd£lºÎàöŠÁ´µú1éÅ홺t—ÉE3)¾‹ï¦è86lˆ;µÈ:[Þ…w=ï.Ä8o@ð‘ŒÁ¥àc[¬ ‰<.Ó¶.¯6ž/Å’ª»Àò½†–‚z]¾ÝéÁk¯øW²ÙA€ ÀŒˆñ…+}%Ì6Ò®|ºm>€Ï9šÐ^5"ÖæÃÝ)˜™)Þif¤m˜¾ðCél¶;¶a*g–e§Ø„&jôôé§ä›1ž§%Wtc[Ò¤±\­ã•ˆ(ÃY¡Lšã4j)Ì[nŠ)°…³ò¢ü¤‹×OŸÌHdŽ.3Ù ÿ̽ºÖ+êšÒô ÿ_:?;9=³$Û”_D.(‘ÐÌ ”½¹¾€‹Ú}óåýçøm`¶õü’·Ñî‚9Ø õà3ª†ÅçÃ=ÔØ7e$Su•¥©—{Y2 hÆïÀ]¼êJr8ÞðcÙÆ›}%»;ÁeåÙ8¦h³æ ƒ– (ý»µ<ÿ ÷Rïܾ};åÎ '*ãtãœú¤VmZM ªä˽Úò“yŸ3“’³ ôè蚀]7‘ºü4×2Nç„»…å¦#©)ˆi©—Íô¨‡ÕgRž;N—(PTÙ‹Ï’¦>X™YóÌýzÑ“8‡ÒYfŽ¤l€ ÝI:ÑgSo#¸sóòwLšl5£¹’‚†¥œHˆ2wY/¾X‚)Þ'ãýè‡ï·7¾¼À´rLCeƒ£™ ¶<{Ü°³ÞÊtùù —d›Ç\ŸøµéÔrv´ø“¶ÍDÙ¼OnëB’î£ñ1ÁAV€áž×SÛ0Ü.ãÓ’ö«Ë˜kádsÏ„QøNñ‡’*ÚðÕR9Û¼¾³Mòçv?ŒmNçB{¼‹[£øa«cc²U¿ ¤Gâ‘ë"?ížC@I£uÝ–"g›9ܤáCÆ|èÏÿŠ\—ÊT²Ã,l€9€\«šË_x&ug=3èlëÛØœÄäƒÙÆ;?ƒ.+cd~ñþmæéq|É{Ëi˜@ÖÒ©Gëð· `Õ‰eümÉ+ÁŸ¶ùLžÚÁÒÜ ¶1ó^û=ÜäUvn:Ê 1?ö ¾÷ÉÆŽÛ¡É2:7îÆç±R¿ÆsoÉ<­Ëvƒ¹òý1+–ÝåMþà’µÿ¶a%ç`N]„m²p£g›”a«cïßMÁp7-­p@²ÛÔh¹––Öò?ïM-ÓdÛÔñt)õ"üò®âÛ,;Oép¶¶‚?¬}Šm$MuŒ‘]¥InF[sö:š»ÆŸ¸›*#õnõÄgùmPñP˜Î±³¨<5is7…o›vØëì¸|O=%5íî}HVË'ÓNÝ—<5õáÓì¹—,–Õ¬üüà]ÁÀáûµ™§96÷Rª(»qÙò¦­ÿrÙrÛócl㟂ßj:­õ™lC±’sçíºô¬£»O81ºÇRkm<¯ãeÌ|j¯Ì»vþ°—ÃÔmÍðŒLöcØæÌh êQy6«ú"ôhƒÿlÎB~2oCÿ‚’F7JÖål3ƒ³ÍáÐÉ“ÈŸc‡FRƲÿ‰DÀÆ—x4‘¯ê'ÎH0õN(û,¶‘N·õ*ìîAËÔ7sÐY{Ràü ØÒ“‘+ÌâwjE¿­LMÔ7õé“©Ü vàÞÈkWóÛ¨â³ØšíçÒïŽØnxÞibéÜЦˆ0¡Dᇠžl-#xpš*¢2¹] ¿È„Æzô²è§b›Æk[(‡é FÕ¨L“m#rbéä¶cG(Cn¶p‹ÿ^¶ \ècýÛ5mº9f%çÅÙñâ2åb€£ÂÉÏôÛÀ¸´Î*âZÙímŽ¡Ç‘ ãtw)…k.ÁEŸ½—|®És­ão'å­;?‹˜À³,¼.16ÈHÅ¢yäˆ:€LIp'p˜‰îáûm£ï‘,}Vè(¾ki>Xv©?ìn óK±ø=Ëèc²÷8‘VîÉY’mz{z FYðN•ö@êlBšZW݇€Ï¤²¡ähä"8•¤âp Ã°öÎCÿãè¿2ñÈihäkÝu¿äõ£SÓ(Ûl€5Ÿ £óŽê"(û-œ$ž…º»¡‘YD¢c4$B>:Ççüwè÷‘Û¤½Hé÷—?Œ³[uð³Øf¦„ª <ʯlim©xuLs€Yf w•îZÑÐÚTù*ÄÏ\Ï ™I ›òãžÓ¸°'iƒ#‰nžúâÝû÷åyÙÍ ÌƒÚÐm¹amòå·ÕårÔ¨L0ål7ôv>…ÁDN"ÒdÛ€²ÄCëð—eÕÕÕ¥¯m™þ;/c²eZm¨£wøú“Ò²²œô«|ªÁÖ3Ï¿çLji¶Aö_vºÑ öÜyÛÚÚZôìò ²™Pú©wRt3>ÀbMbS[{SeŽ=Ùà\Ù,´ÈKl¹§æÃ{¼jÞWHUØÊ»kâjés7÷Á„¤5«¬µµ%ëÊŽÆAbhÑLj÷ùêŠ÷å x?.'?\ q‚‘D¥-6$zz;Ü-g6Ûr<÷ݯ«¯´Ï—é†ìI/¹›È°ð~_ßÜÒX}8°Ýñ –÷ÎŽ@~ÀŽš¦Öæú÷ël #/Õ@ÒY_-2éySS㣃Q\cú¡û-pç_gÆ:þ¤©¥µºø9ÅR‚6ô}¾Þ[ššK^Þ±r2~ÛfÜ‚ix'·º½¥>1fÃZ äPŽpNۀи;ÉààãÂæ–ÖºÊ"ý]÷(g›¼[[,=b›ÕZ·¯(=îÔÝ¥½Ä½±|ó·ÐÆXôâï¡TÉ|ZfP$:ÕúWtÀäúw€báDße“£ðžTäúŸ¨Ðž-Ðï¾þÝ ,A§Z¼GX¡¿‡ÿ;è?þš„‹að•ü63my$¾V™Òê£öa7°ë‚»Ç7JÁâäïpÛœ‰è¿¸§tûÚWW—ÕÑ -òì]r‚§»ëÆ©Ò†sˈmÓWžá¶Y“1ŽëµY±k===C×Çe¾ïS„Ü;þ]’ÆE«]ðQ„\Pö±ôú[bGIŠ†Š½Ža'ÝÙ½ñ\&r,Féc·µqŠ\*³nEù¸»»„mzRÖ‰»0NOéîèPOÐ ;+ûf–˜ÅÎÇyZ>j’| žòòòî!?b¼£Ã 4¹ÎÚ5oZÎNŽSèp-:º5ÜÅÅuÍ–ÃCK/ܸî¸ýÅ°‚Ÿ ïŸöuwñ ^÷¦ib±DÏ“<¼”êÆË{R E®v/iŸÂöÛ;ºœ¯Å'-ˆ“»¢\\\¢÷^ž^4Ú^ß­’ zjcÉ”8ØÏã]Ç86H7f'{FíÄ$¼²?ÆÃÝmSâÕyyRÝÅ÷V{»¸{úœ{X¢¨öÒÇçü<\<|ƒïå·ÊGzá®HWŸ»£7†\x†º/N>ëæææ×8¥x.M=´ÉÕÕ}gÒ³éŠ#^±*äYzÆÂlÓûz›ïÖgø­Ž[–>4®‚*<púþcªÉÖ5t\Q1ÕéÞîÞÁ›šF¡ÁªçNÎw» ÑüÑp¶éy`é¹±€çGůsusó Þðº QYýU‹ÀSè[Þ®u¾.>¡ê̶çI<ïE~†Ê8èÏ‚næcg@!vвå¹4«4‘/½ Qõ ­•Pô‰…qûÅIhå2Èt4ÚýŸÿ„äÙ åCÆdèÛ¿Bè+c$fÍ è¯ßB!¹¸‰%k‡,hÐr=èÂë1<ÿŠ°MïW8ë<ëFŠy1òÃvÁŠºK¯?¨Äž«MŠÖ&AX Ic`Ôá_ªlcÛL…Åâ±&#Àtü¹¤%Óí &à´as¸¬÷´nŠP+4ö2© ü…ngz~ºVýuªq.L Š$? Qïë´=VirF  ðkãAõ øu³Ú—=OFò!•¯»ƒ¿Q¿põ~¡ÁŃÕbI~’êÓØm PÓú%Pµ~À¥•ç‹æ‹Zçרf¿"ÜßN2‹F¾³0ôîfÇO±—YEYæ»wZhË”,(Õ“³[uµõ¯|ÿeEYùVÑ9?N"YròsÉW¬Þ‘GnÿÆ?÷¥s)|s .߬ðþ¶c‰qk²ÅŸìSá:˜ªÌ(iþTj£ŒÍ>ûî6k¬ø®Ç´ÿøÇ”n5ý˜v`YŸÂ?êQÿê’½1Æ Ö~Ù_î»´HÎO“âÙC#²¡GÔþ)UfKŽ± Q¼´"ð_Ç혅“jÊðñC\A #†ÒÐ ™êeèr¯¿¼Z(¾Žq*€¹ÿ¬¿õfïdž=Mk¡×'l]¶¿[<쀚7^i¾ 6¨å±´á‚‹ï‚ ô¹ ø‹bqõj(‚¦b †qYFãö/Ѹ‹“}°Þùò»Ž7´Æá~ ›dÊŸ_ФÆzí,mí™z÷{TÒLÝhîgeìry9 öåèpžµ#+Óúß¡ZMˆ5êÆâ øØ::;òzžî¥XGb ’®¬·Ûx»S5õ™ÕJZÃaßüäx´pˆ+ÊZˤ,›½îEµ£ÑVâ}|ø‹C(#éë”æ?ð¶3¨ÔˆCiغ©™ÚhoK“ \2+û°¦¬NIüÖ<¾–ÌŽ#AseJl#k­A>Š@2º¹°sÊBëßT«¿ë—NtÄÙS)dŽm@Qû¸Û@Ó]¥!ŽNcYÞÈiD£Kroìã2i :ÍfUlë8²&b°æ¥ ŽðíRòÚdóÃ\†óá‰Ëv)ò*HàÑB ­ú«ÛÍ›‡6˜ ¸Lc‡—uÃØ7à‹îŸ° *5pûùQté`ÃãcßòÑU¯â ]]½ÚâûÞvæ$óTfmÕ³$K>ƒa’^‡l Íðû“Õ%¤U½ð²F…Øß-hÇò-{|RÀ¤’h[ϤϩOL ùÁÚ ^V4Êœ~\®à–üÔC\:ÅDß}å%ü;щĀKÅ}]¡£ß)’æï°Õ ^øþȵ`=û=Å·Vºß¯Jt¦2á–fùžL3ùöû½8©Ê¦©Úåý³oã=–ûœTc×Ú—,yL*p *lÃÔÆ~+òM®ñ–\'ŽÁÝ|!g{û0Ð`å£eF\ 4;ž×ºÙø[9Û 3­Ù–›Ê÷y;žCئæÞnð6yŽ2+§VÂ;í»Q®¶7Y­ÈÏJfjÝ-€d³OocÑ›(æä#1åÇÛè­¾±`«ë:ì)}ÐY¡=4ƒ4ß–UÆ—³Õ>Õ ¦z’ɱ¯0ájïï&Èá'dz^{JàÎí ùÈÁ¡»[ý]ÜÇîÖ<·ò> 7(Ëâm|Œnq2Üy«÷Y®$Ÿ(F_y‹«M):eý wÕ¦g—,d Â6ÔØF’ñ°gBªb—€R/8D•_Ñ&{Œ(ØF6ïaf~©µÃ¤•üåäwðC:ÅÚ{z8k'{² 7€½<Û&j˜» ¤ó"…¹íŽúºÏú°ï.ŽZ“€‚)h:g=ÝÈ° aª±’+9~³Ôýî ËÔ £Û}Œ7!j<ÙÛ˜þª•}šNÇЭ7)úº iÈg•úË“yÖþH:™k ÜàG@_–ÖsÌ ˜j曹ÁL4SsŠÎðÀ:ÒŽUœmIê“pW›CÙX:,µ ¢+…Å^¶Ø,Ò8tï$kb®4Ejj~”ÁdwÏH!iWhÂö܈èºÆ°Li>ŒÀt8V¬§Ù•·ÈŒÞ§2 À?’>ÓtÎÝ3ÞpMÁ“ÂFڟ톹l?sè6Ý.T¨x’K®ÖÏ ·’$}ŒmfÇ{?ËÆzîTù1š²,m#g=ÔÑ‚Ênž–Ö$zblÓ”~ðÝÉ?ãcÌ9P747ãa§Ê 9¬L9&«/a¿ µ ÅÎa€»q\ÎVC2¸ø¬f¼øõtãZ’‰Ç2ÒŸb§,®â¬È(. vŒè[Î<ÁŽì.zñ¢rÏb®’±Â¤™`‡/Ä6²Y'x3„¶ÐX&y¥JÒïLõη ŸÑäq€œž)l|z<ÆyËÙÑŠûL[ä{êÈAOÐw6ûžkzeÿi¶ÑéL#‡AÎÊ“¢PØ6è JâÞ®Ž®þîPžÖõóµ/ ‹|¸§Éçå@á›/¾EOÐÁƒ$-ç)Ìu˜GàÊN¯¨ƒÈrîñ¶7,3ä4žéÜõúÀ&¹¿`È^Ûð‘Úon•=ž%…$¬å&Êö5Â6¬ŠÑ9T³›x˳èvøö"š™½Û@!æ†Û¯æ+ #»ì¬zÐùq§«L*éïîììëŽ3×Ú›; WÌ);£°Ì•9Âl-SÇÙ|>'gŠðà\yPJÓ‹$¾rT Æ6ð3›<Ì.¾nD?ÎX¬äU#Ì%»æňËÖÜs\3µ¬O¦T·˜ÚÌ ËùnãLÂØF "s6¥yLª`Lìœ]fA·¯ZÎ6ÐLW‡tìÍœKÇ«ƒlŸ»¤kÏÊHoÂØ$„¾üBˆiálÿ&Õ Öšµîœ«9Hú™çù¾ÑªOO{ð(–kaâmµ4pN(Y”ƒ$†£u¦ ‡/Í6¶ú1Žgt@}…†&è¡XÛ0k„øÝüK;ëôä_¤L:•bä{ùÝOÅ6’±7ÍtB¢âPÛ6â Ý6ìZʽŒç^¬×> 1XŸínFel‰{ zŠ18Ó—îL¦2¸<³#ë”Ù™$ÖÞ^Æ ƒ/òŽÙú]éÀØFÏþ¼<Ç©`Šö¹Öù #2ž²a…¤Óôµõ ÆÔÙ¦q›Y¶ò–qQmº½˜fªÂ62QOB˜#&Ìñ'°K6³âóUv0´ܲ¶wpp°w K‚9`‡§ÕbÕåÛiÏž„ë l3·–AMTûį&¶i¼ÁAÍ°Kkè1¨svÛ ¸·ÃÄo 47 ¬ÑyM_ºG§Y³CUkœ¹4ÀåÚ¼l‘«M©¨7“Ŷ“oåÞÌRbdBtq•àh!~lr4ïÛGèåXë ®YîÞïét!·‚ºßûZqhLbL¸«–ÜÞaeÂÌkÇö®÷;H :M’cL 5&­ålBŽÚ¸FMíQ-—Ä—½âÞ{|;j_U*ÇÂ{qÇœWîÊš øáK³ rÄCÊnã¨3Õâ=ã_ÈÙÈïŸÆýùÇ69m>=òþ`ïóïâ²mD M8 *{{Q¶É›æL¾üËuóþôåÛà¹MO4<ÙA¦‡*6˜’¹¡Öb‰U2£lÛ h«ùÊ«Uƒ& bÛp¶É?'=h¯mð`J4Õß”?¯ÁÅû=Ù÷8ˆg‡Z CvÙtÁð½×¡lÓÌM¶·wtt´wt Ã3.™&ÿD•t#{9fÛ·6 y&T±„4° ²™‰¯cÒ;ÛÄзÁ½]Ì6ÈUO趢æd¦çM\£Ò âÙéÞâËz}r¶™*Xœ…mãd¨lÛ€’i’¡>E&À¢‘õÖ'÷¼ÙËÑ7Ä©ðˆE§­´Sý*1(6á0j…³K½§@ئ£Q0uÙµ¶Åž`¤ø}³XñÕR‰p§]Ó›¹ö¡F¶9d£•ðFDð×b&ð|D¡`Ý c/sþ›)Ôi'Eü6[°m¤Ð&GÃøkU¨³‚v£ïéÑÁžy­ˆLvä—×+åP Xª¹€ƒ ÉwN–¼žVóÛˆŒÄhgì|ª³œß,gñh9p13+ëØÃàJX÷üHÈV¹_´ó¦¡¾Ïül…‹U¨|tœ°$1ÞMC’¶ T²â3ÓPñ=f–Îîø)0ÛÐH†ùèáq¢«:,/XÛZ2bÙ6k±¼óŽó]Ø•_Vû=Øf®ÔÙzü­ó˜¹3ÏßCåxc }4Ü"ä@ºª+´•O1êDËY~;Ç&ïx†¸Èú²¶2Mƒ°îçkså-4_ÇÔæ"gÛc ÛÆž þæèív‘øÁŒ ¶‰ö0?õºEÞГ«™Ôpã”.|<o¯)¬U9z]Ô–æê#?OT`¤eÞ%Wpn„N´!ÏŠën†zG"=~z8¯¨\MÓ6ñþúxÑ\­ñ€—ÓEô¬ûÉ x~SŠz “ ÌãæÑ©dEÁÛ)éÒlÝÙíé´þ4v]—²ÕgWV9»ù[¢·ÙEëS2•Ÿ_ˆ}–·")Šæ‚ +à~o–]<<•‡êJK[\e¨—ÚO|Ýé'ÆãÝ€ý¶¸5²´tÜŽ`ᩉþÆ~[ðÞΤ2ÓNºÙY2ážs³Fë3ý¬Y<)ƒÆÚuþ9öAíª;{ÿbŠôèÞ¼=†$<ºéééÂ+—ÓGªiËWÂA:zzz†ÈÍ}%°þMYéý1½VýâîüG.ɤÛß+DtøÅAcË9°4IÛ ¾•µÝÙ—­éÇBttŒö±ýÑ~t&Ë„ÏeYûe"§C9·˜°h|à侮—ºpõÉdFyzÐôT WÇ á³`¶1pO:he!0¢›Ü~Ó‚ŸäÖ‘Í4:ÃĘmæVÒ‰(yý££áy¡l3¥n3~šÈÿ›T‡±Mk¾6C€TÑ¿?[#þÌW7÷É…ì¿ö+cÚ©íT2•J6 ˆ99*SYùˆô£ƒQdÛÊÊfZYiÊ–•+iÉˆá ½qx™D¥ Cã’&¯‹äTˆ¹–.56­a¥®A§ÿ6Mǽ]ú󟎾ÁÏl¿å¨ã~¾úpc§ŽŽ¾ÕFÜËZÿx K`Ê3ÍÝî®|^õ•”äÒ¾õ“)37Þ4(© ÔšuN@ÖaqŒWm»Ìúîv=úNêá_Ilµ®Fþ·;‹<1vؚǷT>9iLÑ¥SœBâ»ñoïˆìõþ3åƒúûJM'ýÖ9B˜óÃÇ6Rè,p\×1ƒ¯ÃèHÛ ÿ˜¼øócÚZˇðËÒŽn¤‘É¡».`¶nŠ;‰—ƒ[F]™:4/²ùi¡qáv´Þlgj ~ì<Ê6u#bÕ8ši|ÿÕ³pÄñþ¯z?>'?µÈüäœNmU"l㮘ä!~Ç ê>‹E«M”˪ôJ…$àGªWIÜ®·Ñ\NPC½h^¨£òùE+°ÀÂ3>® r‰à§×ì¾þqA>¾FZ9/P=ÔØjÊš£| ËÝ·&£s©Ü5Ê ž¨Vê%u«?(ù’~$ÄoÏ]‚¾ºÛÞÞÚi(ˆPL›q¶Î~¡¿»(þÊ…”L47TE»³ã®–+4sÛüÆ11ÜUöâªÅ^¨Ô9GÞžË(ïûålU>¼÷ÜWÑ °ëáîêáÔ™U, Ú´Ä⾯ã[B|¶uÏ* "²9?Ï–±¹ßPO{çfëx ¥@yœ)ÙgùÿшöòêVOÿµïG¾Î6®_ £ÜUŽ\C€ @€ @€ @€ @€ @€ @€ @€~ùø–Œe endstream endobj 758 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 98 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16401 /Filter /FlateDecode >> stream xÚí½XË–&øÞôÎîìÌôôv¿ýf·÷½îÞ6+‡7å Tá¡áABB#ƒ Þ „ ¼÷Þ „!<ï½-“›¦ ª t½yù×$Q™‘'þ8qâœH@ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (Pü´èM=¯ëTÄý†;¹\.ÿB ‘½erR«ytí§¨\"'?ì!SK›©£myéáÄ:”>Ô¥Ídê@[CõAá{cŒÉÔ®_àק›´˜ÌáMŽýi]äN&s÷I­Ê^ø|Š®ª# ¦óKðñ±Ö8°m>ôŒ­" ÚlÍz Õتaä/(‘³j¬­2¸ºWùþä `ASëlþ-P†zÆXßÒÖÀ–³¶ŽšYÈÎnPê¢îT:^D¸:h WXKþax~Sïy/©å’ö‹ËÜ Á·ÏiiikëèÞŒGÒC/[;ÇV Þ—pÕüLD=ï/è?¬ØûºLm“·ü"¸|á[¯9©¥ù(¿]¨˜Í÷†Z¡¹ÍTW½•uïÒ¥C«f¨©–Ü8ºÛÞÖ¢¶Ú($oCæû$D÷f0U¥¬ªµÛàÈ…ºª~õ:J*‡âcŒ1Å6ëk#ù›oOMëž$NӇƥ ÖOT½d'†šÃËOíYªN©¯¯K,&À\ýœªbÔÙÙµ‹ÎÎÎÑE¨CY·0ÔS³lD—.Ò°—âºÁôžàm=½íWivá ÈCK›àjÇeŸT÷v  {h |dä}8EY¿«›‡öúSŠø×d¨Zïh8œ Ñbœ/þ\Î ƒ ۷̧cμ!xCŸp¯bl÷]À ©tSç›ØÆŽH”Çȇ7ŽíÊÞ9ÌÙ<¨ñŸ8˜¹†öu ¼~GçÚ05%}üØᣋgúäwCoÜ941ÿSS‰ÈdtvN3ä|âÞ%û^vŠl|vM]Í<€ >§õì^ fõÆJùô"p‹ý%ªŒÕý°­­îgÅå¨a5 Ðo«åŠDš¼Ö¶äÖÞצðÞ) T—„(j˜ì’ñ¥Ã¥Ì—%YNñ_ˆ³3¯D”†fÑ~•ã²/j…%dxØY›ú££B/›QÝ—Ò½ÂFI…׈s]•¡þ¾^^þi•Ý"lI g%;ú…§§÷«„|„c8£e_ÍTx½èˆs×£’Ï߸÷²¼k/WÎÎãG~Có[È Xè©zìïíÞ·ÿ<Óøàq*g½/ÈËÝ÷ñë¹`u¨!ÀÛ=èyüüÀJk´WtÇTW©¯çÀ'o'Ù"B;o$†­fœµšjÁ¿S_=ꘅØFQý4gŸx#Ïúž¦™ûä5á©w…µ1–›òñë‚sÜ êQÙô™L˜ &â±*z\˜mðÄ+>W ¬ý2ùí°Ç6à ÓídºÙF×cYŠã:Ÿ/¾#ÛòKžbp'?oóÞK€mÌ,“–a„3|Ós˜ 4%úy{ù>­ïG: HxåÛ2¶þ.9ì¡»WDj9$©ÏÓ›wŸ[lŠô|VyXÅ߇¹hZ^K©è<”v¶Þ%tAÖ{vóAþ"gc&äUôçKlv½YÂîi?K(Ïæć%ƒM˜äKL\f/ z).$‡:Tœ=SÇ“Ï6J:¶ßat¬–ãÈŽîöÌs!ù¼F`ÆQÙì¹ÃŸe1pÒ­3œÛ›³2âåí“ÅF’¦jÝB3€­ÏOý=¼|BÇ·`;Êï^ÍgX †ïE¨_ëçåß4ßÌvÆŸTxŸ‘Ÿ•h¡‚»U/¬Û,Ù1°6÷Ÿ””8[aõoo€­Óû\RùÔ5»+I™ù³«´È ¹m#s‚+)¡~ZB –¿%¨¿ŒK}î)#AnÚF“ʼnZŽ×´tt„]ÕÁ™»^¹ÜÚÕx…©a÷|d¹ø"VíôÕÏZÚÛ£¼í±t¶9pƒLä,–wAÝâ.ÌŸ€|¾­M“«€˜—û=ئ`bçñE-kÿÜ}ºÙ™ÌÃtŒ/± $Þ>I9iŸ’SL’ÁÕ/Bí}ÙBñ¤á¹giï:š*Ï(É9æLI²’Ì.ÒzÛX·êÙ/ÌbÃïóoØ›I㵟ÇåM­ïçœU¢ôóœÖ’ç7=Š÷Ý Û\ˆ¨Ì,ÚšÇ6+-ib$ýÕ=½º£ê’r{9ÀZ9NÖ&Ñç¢_*òãöDNÅÝÏÚÀcmìo¢ƒØFÆjg½UIšX<%È6Gd ×Ïìp¶8C:²b×Þäçç8›aOzmAr+AÖ»zÑ¥¶µ³<%#NÚ^Ü0´óâÏ ÍTY…‘Í/Õ÷×¹ÁŽÞ¨yØœþ·wðg½Ù¦ÿõEi‹àÝQɤ ‡—€—'Ž+¶"*gÛT‘’Ù#¼’`7¦Øýœy¤RýîÇ5©ÇÄÔú‰Y,$É`Ö ë™úd<óÄ6¥22z³<ÍjBUŸ5+Ô¡¬ÅÓ“Xi),Ã,<­try a‰H^ÙrEà©ÙoiY—7û:ì¶Ñ”’Å“ò"a^ä÷ ¬¤>!èh,0$ˆ]ô¯Øe0—†øû4CG!Ý,pþ½¼´Ê|™zYO/°ø~ºÍè*ÀíÇWöÐŽ0ÛX`I$ª@•qúÁìoÑm@Âìïœ[»“IŠ…ŒYüg0ñÊiškDÒKŸSNaMbÁ‹«'±!9CP“-öcI´…mΤŸÇ-ìéà[v*$™ó>™\ágj"Œ´òr²šæ׳«[×8ÛèËc1²‚ ôa¶éɎ׳ÞWËKUÂ*f b™3;KeÒ8+¸ß¹([ëóÙæ1^XBpt›µ/ë62gÀ¬ª#n)›ÝÑm4¤Áz J6¢tø›t›Íù¶ŽA(7‡µ=M#È ,q€ÏqÇÅ]° r¹lM:¡äÓÂVÓ1ªí6²Üx¬¯|¯â·¾–b¯Ï<´cˆdPVl<Ù&ÜÁœÌ4¾zå2ŒKêD¢KÉ0ôò(áÂOŠ¿Ì6“zbI“€DŽ¥Á[ñ_¯&H3gá>YxŸŽÕ¶@ØFR+˜ßO×IR7ßo$Æ [{ } å÷+_Õm[¦Ž†6ÍèÒ¾ í ÝæˆlîêÁº ‘LåÙˆÕ•åI:™ òj ± ¬Èl¸(K9fLê6UÑwU̯­//-..n ÇaŽ« ±¿/Û€„öæ.Ùüæ ÛÀ7¬ T˜0ÈD ” ‰hü W,(Osú‘»¦ ìp¯À:¶£¿§Û0¿«ns&®õë4‰›9Ó‚lC?"[´þÝuèná«Ûx9,jo* é[`ƒlso³Á7{j3ˆ]`·r\”ùÖmœ c©vbMäÍs†›—†Rê7yÛOñ÷pVBlyÅÜ8pßþÅÀË#$‡íob›iIñر=é‚ f›Í=¶Ñ=€m4ñçåõËxiצ-AE¤t×nóÄEÏ9´rè» ‚á¸ËbêwÀrB,äÌ<*¿ªÛ|ƒÝZM\Q»óI„m KtO±¼‚æ{—m¶ÒdAåC2»¿/Û@ë¦+y=v0ÿ<ö‡Úm€ŠäÛšIäL+Ùýl3Ågp­rœÔÂ4ä&DšzýAz5>áçz+MixIñuIÈJj·«`» °³ '×Íïøn·a—ˆÉª~-¶›(AÌžß#‡®$_ >ó-/L¡: ±ÍwµÛÀBšiG¶œ"s™µøÃí6a×%µ·y† Y%âÛlŠ² Pë¦cíÅ^h#M×9¿m®ÔZV6¤Ÿ×&®Pm…Øf<þšÓƒ/'ÜÖºv6÷¶É‚؆{àJÊËHòÚë„ôß^4½–Ö L~md¥5&•Úæ IŠ\&`BÙü˜)¥|š-Ä6̛ϳCc½./Yý¢,öL³œ4¥pAp‚üžVbHëÞœÀ2‘¼vu¸ÅÕè¶á ²<È6«5/ŽSx²„ +천…ÿ÷ÖmÀÖ>f‹‘O¦Ü¥ÿ`+q‡‚¾sníiyìÙ¿­}Õ-Oׄ• ‘†)~A%ãÕÎÜï›Yæ5—ðÃoNá¬c¾•`/«áÉÍ‹¬/Z‰–òê&U£ seÝóBªÈNò™-9jš²~8Û ï–{OEål8„ùl{ÛÖÔ+šWÂîKl,~ÀNÖ¼4²JùìJ•xhRum’â/ŸÒˆzvG £[þ¡7΄o%Þ¼Ê$1m£b¢ï;˜‹cÌæ@eWm¸¬kŠ ÷BSd›©ÆI’³g°Ï-;1꧅oÑm0Ì«–câ\¬4Éš×7ÜÁÞº0ÉšænÎT#§k̤ÌG¶¡•I‘á*„[Aá…` Ïh\Ó:ᇡLúò½ ã-î®üÀ6ⲧï æå|+`á +qÌm-3Â+)Ø¢¸9©ˆÁ0r}ë@°#ÓÎ=QXþ¤..•5eH¢ÒoóK¹}óFVûêWÙ)ºÀß”@"îî€+ZÞ»sGðõ ;ƾA·áš«à¬nú%½}fjz:?„IѼZ8´uíÔl©mo%åäMVqÌ ŒÌ® n‰Nœ%c²œžùÅKÖ†Fîž6P%Y=bq¿²ÎÞ˜pÖÅ(h\¸â|ÓéŠ)S¯f7²*²ðRhÔô‘^`›Ç$šêa ‰,ý†•Ü¡k£9Çc5 ÙÓN"´ø l³ôò6ùñÃK&w“)ƒˆ¥¾„ƒÙ®QIúÄ÷7¾Œ‚‡w§ª0+))¥ynœºÂôìÒ÷Ë}EéåC¼pîFCY^RRRNqÍ")Ë]qiïv-œùîÌ´äÂCÙ²³3R§Vxnh«ã]Y©É©™ãÈ:wm .µ”çåÀšLMÌ߀[qkf0%·a ½ðåéOéɉ¹åKû4pð¿Ýï+SâÑmýóŠ«–wàNœèLMKKBJAiÛöl[ZjlÎäòçlg¥¦}˜ÜÕ58Yñ5Ÿ·f971Y$¯Äȳ:ý1=«ˆ#°%²³4–˜’9¾k"5±d[`<Í6夦$¯rvJSc;'vDFgSiJMû4˜aš`µ“ßo6_V¤¥¬îìÍ^ŸKNI+–ûïJö¿~ûÞF!·»0µ°{ñ@à,çd¤¤¤ç­€m³‘žZóy½¦$½c˜ÇÀëŸ+R ?ry<9 |Báýö¹f·©¿(zw¥®¬À÷Úi÷˜²ºä‡æ’üŠ®QÁ»Ksò:&)§§¹6#|ÙŒêÝÜ]½jg,%©l¡Äñ¹%íÈmeù¦¡él´}•·îÄËp·äé÷Y©))\K9HHޞ͙³–•š4»±¿ ”¡–ʤĤÂj¨èÏïKÒ—úãRËXü¦ÉÍJ™ßDîî¯ð£é»ÁÖcÔeçÇÄ6ºa_½³ÞyîiËïìݹ_Ýâùëÿ·ú•£ªß˜í‡Ä€§UË¿ìK}3aIàÎÙÓe_÷ Þ?ÛŸ?ªùì«ñ+ƒ?:SÝ.ïÃ¥›þ¿|ͦs éx‚’YÛÚ×ì»ýøK½ÔƤÇ}Ííà7ø‹ Vbðu2^îü½ˆß¥œÿª&÷¿Îæýõë6¿¯®áþÚu›_–ŠQ @â7Kïà¿m/Ο .ûIÖÉ,C€•¦îü&Ïõ´«øíY SëË™&v™\(ÂZKëÜÀq$ ˆËq31t/éûÂ;p×Gýn9@é¸ĬòóD慜׾&'uµ™'<^Ì˟Z2M¬Ø³H}jóô¸ÀÄ2[®sÍG¤Ü’-¤¾L£S!É ?âÔ¿^w_ÑòÍÏ2‡r3Ã9§ï•÷-°;“]ØÖ†Ÿ:õ°î‡¾Ìç-%Ú‡Åß!ÝìLdÉã,X?‰êØ’ìgp!d™²¸ m8)P4lKê[;;;j‹•åeµß"7 DXêþØ•àg/…×ýȆöÔ¯«(¹ävF5Ë]ùx,ùeACO_燐Ð+ºò ûdÏt½ÇP• {ѳ¦©­³£5ÊË^B^9ºggoD°úÕpôë:Ø;»yVÅ<Àp§ƒvêé¼âW‘¢sŸ8«ŸqèýÖ¸£¹ÆP‰l䕱_þ~ͺVqM\çÉO¿8b]ÐÆÙ<ˆèÛ®¯§2ý±–Z5¶ú£,Qf:²q4Oƒ[N[³éD¬ryO/X`wŒ§4Åtì—X/À•Ü¾§„͘b ¿:£æ[ðMlÓìuTùÞa¿.Œ47÷,pP•Ø¦ÊXœŒTíüï‹h µaý¢öMìV0Uû 4“µÒèõÐ/ôÍXé¯õ÷vô"q…?r:*3|½}üƒK[Gv'=≧§_EïÂPMäËô`rãÛˆzÒý™ç€µqiü HºeF0½»Å‰pŸlt?òÙŽòC ˜§C{¾Ì6 Š_]׳õæç a“Ù íßn{jcÕ‡@K¢ëe·86ŸºÒƒè§ïLWÞ'i{±ø2_sÏôBÀI,&¦—7)Æ6:=w«»îtDѪþú¸§ÿSÖzO ÇÐ<”ÃDGY°¯§oPá‡Ï»o×SèíåãRÖ1»›ØRëíåý:­j«êº˜6Â6›EI¯½¼¼ž¼ù´¸»¿–æíãŸ×px†0ßþàQ,À òòô ªÜkº=®:!àÜ[U‡ÎÅu,V&<óðòI,ƒ|uò£Czú6 Ã^!Û!A~# ¼öéÌü"{„Ëe? ö˜}àž–VzãÚ9²¢š§§çÄê“C[º*€½wr^¿nžáyÊ6—¤øûx…F¤íz>¬½ñÈßËË7.¯‘߉Ü}GW6 ¢Ÿ óœÿ£_øtŽL¼ öH¨›y¤"^¹Ì™M9« ©÷‹ý>¡¯÷S@OEŠ·÷‹¸"V‹ï>Û°º_‡‚uóŽH.FüÝ{Ëž=Mí¶¡T>¾¾¾AaÛH6Û“‰¯{zúDçÔò3^zâëÞ3ÇÞ-¨è¡}t£1I a›µÉnßGOv~û¶2èPÑZUmƒoçC¨:NέíÏ.i,î^¹ÚÖÕá{Q‹y jÿá¤ËD½‹IÙùÙÉ‘F4Ù‡“—åiBdž»ŸWTàvºÑÈï«à¡½ý+hpv6WÖÁågiRÐ-4ä_ ì÷AE¤b¿cmÔ9yc·†¯²Í§ü'24í²–aÍ}’%(~Üàìp%KŽüÏÓLövÊ{uŒD"ñ}„@¶1¾¾ÔôC2_…08Œm˜—|wÿŒwÔÓ¹›]-wËàhæQqqÓ«ÜÖYªNTzAAfŒ!Qêa.TÏw¯®Ê*™Ägæe&†+ËIgô@²Uå‚U6IÉ/Nzåm}AWŠ ±Í³ Œ“Wýò ãÃ|¤ÊwÌ€’»tM‹`s/8#-ÉјlêUpX†ÀT8AýòÙËïš:ª³ŸâN`[æDÔˆUœ¤o\ÅÊŽ¨Ö䨢atùen]SE* +ëhi]Øð¡0+IkÛ„½ÎPÄ7}æ åyªèÝûv´ƒl¥kùøMÌû¶¡ôH? ]»ªªjugÏí~îS®‘šQÓÉѹÜL7†ÅÕ„´Œ×3•óà{îÌ”K‹á‚"“ rÓ.)™=à©ŽúsC›¨üºö†B#‚”{5¤Œ™èPL mßäÖ¶7›’¥ïU@óMÃkg¼šY\VQfìS†œ\æ DvFT};ß—ÑUW¶V—X`ñ;ë«›PÌ´X8Üéèžâ Y‚V\vaÆÛG¶ç˜ªnR8ÛA”ÄE$äx_Ñ¥Ú†‚‰!ZšN•{¾0?D~QiÈ sŠ–=$Ô¬QMŒŒs`diq®«5SÕ™Jf/6nšà9 ­ åËÐmYÇpa›å¡†Óv—·–ù¾¼ëŠº¼ñý9ÂœÙ\’áót=Y7°“cÌIÖÑMȽÛËË;¬µ* ÷y… ³ÆšYÂèn5pèæÅ¢^,ïÓOƒ_Ÿjç¡m|~Ç6 ³½¥Äh]\îM÷+l—’ý芖2éøq û[YåóëP÷-Váè+¬ƒ#Làƒ(Ò%¥ ¦áiê¥1Å*¾‡¿’ºgl&ºé)ÚÇ´®Û¸à©Tu58‰Ãë³È‚tµGF–”8Í»ÍAõDpñOü('c®ÈgFºG¦¡#€8vÅešFtÖ‡ã˜Wá"rgÁU ˆmXˆ'ÂÚya¬³ãSÛlîD¶¯ÔÉ›¼2eRýó;ÄÖ7'm@jÚÒS*éç)`“å·ˆê^ Ë3¥9G–aJÄÚOç¸}Ü$’ZçuæÌ6Ó-U“5i²gf–vÙf×ñ}½?/©T‡›4ÜW#^ç•°>“e;¶Ï€fGk‚\d®á³ÍïkgªÊWMÙ©Žo›Š;B8‹(„œ•J‚¬þLCs5ñX=è}Þ1éT9Šºç‹¤ÑùUÈ8]A«.ìðš"ýCmöaÕ€$žÑÎÓfç»"˜ð‰ŠJT\@R Â6DQŽyUáúÓbXÚ¿¢ÛìuÅêxzD¡6]RžùqX®ÇQéK,Žàþ­ Fß±6¸õdkeiqii¶ý NÆye>Û€RÑKÇH˜d}]·ÙYŠt5—P¹ÉÜj4†>›¯†ÕÄ$ çø§"mµ)ÈÉ÷­›“­ç˜4™E“É~`»M0Å%Ó§xU\*p@ì6©dYÛ*"«faꟜ€ë:ÎD*sP†ÛÃí:ÏYé“ÞVŒd(†^µ¡0ÑÁLƒ„üi‚ø#Gåa­ÈPr¤)q/Ѹ5וT}Áv›Ô“HãEc³Yç¶á‘ÏH‹ïuSÓ0º]ä¨é ¤ ;eÈc›A¶©Ù×rBM÷9Æ\ZÅ%Ì6׿Æ69îŒ]¶)ü8w8ÛPbÒmÚÉ+)¬¥:2–2¹%´Y–q–D<‡t×\m¼¼ölcr(Ûp:iR˜Ž}6om‹‡¾ ÛH„ òUîÊ{ÛðcaØME zª4âi_ÝÆÑLùÖëÝØ³{¡z€3\ Qrtqvttrv¹¦DÀZÙ_Îxÿ»Ú—j‹0¤Íà~ÛpZ«òÖwxµ-û‘º™+wmHˆYFVRKgñ_XIÁ–™D'qYµ÷KB¿žÕ#ù%4_ˆþšnãe ïð¤YÀJ Ü3–uy Å¡”º*“ÍVöιÕˆšîl.0“æ|œqGÐzPs—I¼œ,¤ÛÀ‡®[jâ¼]]ÈV_`žuúùxhÑŒ0Û×µ%ý²F‘â×ëïÊ`í¹À¸Úq™â%¤XÆ4ª:¬Š83Ž=ÌA¦Bn”¥Š„.È6+%¥ {oª¯â^ðq©(è8Ãצœ>}†Æ,{ìÀ ¿Â6·þ¡Î,TÀf têJè…_g›MP=ˆœ±2Å¿m€H+‚îíÁ#ÎãôoWpw”(Øæ‰ øõ7n¨)¾b9*ï×ñX%÷±-Y÷;² ¸$Q–Éj[DÚ…½11¯|e›CVRþ:'ì">#™d¹˜‹©A+©å±¶â¦%¾ò1È8Njãì±MÂu#U§(A9ïôב;ÏOÙiiì(Ôâ6gffÌ/OëÄ úV6Ø¿§•Ôd[UÉf‰Žþ Ûps]5•õ-¿Œ|óÔWK{/sl#w]yuãË1 1vÆ..Z0Ûp3Í̓«\ï=»vB†duÎáÎÛìÎ(ãÄ-Ý¢–·¹_euëKwù¼wú ž^=ÿ1BÊÔú¼»¯Ç]'s]e²Ë"ÈÆY °UÂ(jœ½pÅùúUmVóò4¼Žw0R~Ø ¼©W”Ä4/ ° b†i “—ÅÒÏ`·QÐ2ôöôqÿÖucMŠ‚¥ç&²’`›‘²§2šwXLäS/:F*¾Rtîš“ôÏ»&Ç¿±4Ò*{i†¡ÙfuL~ˆ¾%KÖôyòÒÓéŒóÃS’: ì\ÕÂ_pzê錓”k†6ð¶ÜÌ(§/=}òÈB‹töYíf¶³_f°}ælé8º®™ó=_ïg­L¥$ðucë_eXBM*6*j«}/œ¿ª£w·á[Øfc²‰&.apÊö¾§×ƒ[§40Êyž[óø ^å¤OÈS[&Yë ´cf†S5}›˜tûüI¯ 19åðŒî7³ (JŸRîÊ“Õwf¥&¥¤ew!Ô€XŸ)ÌJKNÍìƒv?7ò2SË:¡"zJ““SŠëº€ÅÖÄœf(öZ]Y~rrrjváð‡¿ƒ³U_š—œ’ZñþÓ᎛ŸãR w]ëJ ÒzÆWDÖ5 .ÔÙø.lº”´¢ äXbX}­É¬ãY`85™íÓ¼I[n\oe½"/=>!¹ipa®·4¿n€ã—?/ðÂØ×fÒ³‹÷«¸w¹¡²( ꬌʆöme¢¿µ:-9)>pIz_ž—”˜Tû¢‘¶²Ì´Ì0µ 'mh–o9ï)Ê*ï‹òÒú§xqØ }%¥½HÁÓý-Pãg¶ ò JEiGW3½††ûžá–w`å¿kÖz2j9<æü”ŸŽ‡ä¢wMH#·åæÖN¬÷—‚âšÌGRbJb­d-¼+ÈLJJ*¨lÚáe¼–“’0¾,wÉ-LGÜB¶—GõT¶~/Ñ" A&šwóïçÜÇÙ~ôàvé"‡KT ¯º Šßî <ߢ­÷׳r᮪Ñ/qÁiÈrÖF ß8þýrL½§„—Ñ51W ÍPqEñ›ÂÿÿµÔçw³7ÅåhÔýlupó @ (Püüx¥üãŸñŸëCÅnÀÿñ÷€S´húXð·0îìWž¾š ªdýv´+ÅðpÝò©ŸßRàû+¨¿¶µÇokYñWvšSñ]à´%°°õ37š˜˜o+EÓ?Gø }é€Gʽ€¿ûß _ÿæ¿×£¾÷ÇpÕ#'“¹¿!IãÌÝ4Ö‘‘!Ñɲ*L³þÅÃ?7×òçÿÀÌÂ?Þ½æ³öcW&Ò㜂‚¢õ™SdyÊ9ßBÎw2ô¼þìÙt–%`­Œ]tŽäü, ?™îVGCl ¼s Ìû±³8› ¯½b}Ûíkå—þ?µà¿nšßö{˜•r¹ÜoMÜ? Þ5ºË6\ÁCâ€õn(ýŠËÊÿ]W¬˜¿ nó :ƒ¨wë·¿Ã_MØ|ÿÂÃåᪧx®È…îfŠ×b¹Sð¡1ªœ5W´ê_>ñïÕEPdw<ÃXòœ×ûÉDìÇÙ-€{°Þ³¯m 7òùûñ9°èý­ Ÿû0VDÕô)åk'¤’âž'(ÏM)]PT@o^°ÉÕøÃôLîWö;¼{—ëHÊ÷¿ 4 >º^)z®ÈW¥÷ áâ(„Wò§×•…Ï_ !ŒDâo¦JПà?„“À ìq$ þyh| §ÿ × Ä¸Â×ÿ ðŽAˆ–…þ|ùÐÅ¿Q™Ã‹ûpºÇ,ºf¯rpVÿxæ$ Ûl–¦ÀeøЛ’gPºÒ2 ]ÛÁ]sÛ0·V…|¢>Eh‰›¤ÂÞ-=wÎêañD,žê }Ï”]ëŸ5’BœÍ˜ròŒ¸–i?狦ƺ$šNYEÔü„!g›~ËþŒ‘¡QA#±z8,’“Ë)÷¢QÉÊÊŠ$šVD!ïÐþÜWž4*…N£¨œKÊmù7qRMŠ¹±¡:wÊåù lŒ¶(+QHDUºæðöA5ä[S ”±Š =cëš´‹ûO1Ú(søw£ð K:2:×!Fzwþ¤Î à•<£yßç]é+9£M!‘I†Azãôêì­HßëD…¡DU3ºPÝ1jW„–¼}áÃëçMM zd ÛÂyË@×:ð祎À”8'´ì5!ÚdCTdʸöîÖ„"žP1öºŒ˜T.|²õPÎU"Û ?šïë wû9´ ‹1%ÈÓdjzu‚xjå7ØY ‰¼0é¹=sgPˆçë}ñŠfÈ#ƒ…åÕNAßþK³Ã*\F1ÕóFÑvìÛ¨®¨X†ü&'´ËçïÅÁ,`ŽL[‹“ÕïEK]蔫΃Í&ÈÊØÀŽdNÉû5<ƒÛý3Þ‰€Ùz)iŒåK^°¶SÞ7¥ØTÆ·!~PÓ¦äãáuÐá1ý -£Hâäü“¢ö±±Ñ†ìÇ*úv«Ð2€ÓZU64/º ˆ¸e`v9ýŒ­¯Œkžúxl3^ëglƳ¼åùÙk_…|k# ¥Î¦ó|ê¢idNËyBfìƶ9¡*yÚˆDÖ.X+œ,›6§èRø˜nHX]±âÒº£ÐGB/Q5/ò¬ ÷%T.‚ï>nE&PÁž-|$®q•·œl«©ëÿåØf¿ÿaÄÓ¶ÚjwUf‚ zíÿíÐ=p#ÐþøßöØ&(o(þæ?›ì¯±Íð·0cÌÃA¿µ~¬¤@„ŸƒÒk?Í.èZÕþ°%Ÿm¦u䎗O /»|Ž“·àÛ§º(´Sð¦€á軤 ¾0Û˜Ptù•žd—Jš<ø Ø›S þi^Ûòê?È‚¬=Ø»¾¶bgc@ç8¶d xÌ$Z¦!•ÜêÎ#ž¶· 2Žªö>µaF8–5tH7í²Íx´¬ÌDòº îÓµoÁÊð´–¾Ì}¦^\–1ÀWxbnÚ{ÄL×ŵŒÖ×V¡Ê­n¾¾imç/¢Yw…©+Ð555ÔÕÕk‡¸ÜÃtì+Ì‘ˆ~á^âë6Ђh}y´ÿSKKKq°Þò‘+pT"¸Î.nlñÑÍÉ6Pÿ‰«íÍÏe¨ÌMAã!’ÉóÆ~éMc¼–DÕß`œ¶ÀcrVüHv–3r³t¬Ôý,ýÆsö&ô^«+‹—hÔÝØŠÝ5ÂÎÆÊØ`/XŸŠoœÞ98c£®÷:Ó,ï™ÙåH˜Lú”1ÒÆáþ[]ÿTõB‘~¬Œ©)¾vùD•©„ü[~öv”#É} :Ô%%OëÞáµv†ÏU=—Çà3>DeW0¹ðÁ5\>-ôu?OtG^[ì×m8Í÷Ä1öˆ´LµgéK++H÷%z_²¸ñr¥¯¨¤ºÃá ùö}%É˼ÏÊr‘ï½æ,‚lcI1x†œÕŒ%ÁžZ~9ì²ÍN14–ΊޱÍÿ‰ô2ðO0ÛL¯gj#ÿ°Ç6àÄ ·ðþøŸ5Ö×Øf™·d[…GìxìÁVâø›Pz!2×C×ú.‡½ Ÿmºhâ˜&‘6íò9¦tæé‰TšíÒ×1wIç¶1¦Xó£S%+¹c¡½‡¯Ù×\,5ˆ$«ø¢”›­K$<‰´JNÀá÷±¯S‰®ïøœ5Qy¯/Ì6Óú'd3÷¾î:£++V:{ˆV¸Ÿm@1[ì‘Å+ïps¯‘áÏòÎÔ‹á´wÕ¥\{U×—CeÏð$Á@w’þm¡èŒÆ9Jyñ‡òª6…œÑ·pÈ«Ö8.=+Òî<¶­ Ëñ|SPTœèî@8un,vqøE*X,Qïœ?Ò‘ÛsàòŠ5 R |0õÛ€ ‚Î7G(çAúðXÇ0 ú^'·-ðˆâMþê’À¤œNzëh%ò^³„úl¹ý…H¸Ö'5ø^ÿü¡l³^§H$ f¥@×eÁW©SHffX¾ŽØQ$!lƒS™æwXyè åË^‚lóúšåA5jÕÒ+0Û,Ú0( ƒ®¢Ýµp›ï‰1<qjˆ"g¢}Ùg¡3žB7d ù¬XÉÈ a1o.{4lH³¤œâÑc©G±¿ ¶¡±ü¯¼ôô§@` °þÍlZ„tÊwÐmþ²‚u›rσ¬Ä ÁDCéð^ïA׎q‡Eùl3§+¼xl/'hšû:Ûê6Ÿ5ɤNÅ6ÈÞÙZî+ÀH(up§ºXëLglVÑŠ¯Û¬·gŠ“ Dö’üuOÜÊ[æ™íæÓåÄ ¦o×m š¤œÅÙ¦MÞÐSJmžBØÔmù¿F8[›yÆÎÖ'µM¾ð"—ÍÍ‚3ø-ÎòP§ØevöËš öHX—@/ùÀl¶Ç‚Ì­jžÒ~° ï6ÎææfÀsö¾PÌÚÞ\l•‡pÐm Œo«‹=ÿ0©‡U†GÈ6G÷t›+TŠkùX¥§Šë›Ãßkû6 w¹€×)½ÙOp_`›!P·ù´oñüu¶áë6P_x^:y#TmJ=¨!Ø—ærG#øvÁþP#qø„Æ^ø(™¶™éÈ%2´D$~¡§„HSÝfs†ËöCeI‡âe~?ö«•Í]üÕ² àMŸû @.b>þt›?þhìì ë¿7ú&»Ml"Vušßÿü_t›5@üß*b*œ‡ÒÿÓ?÷Ü€?ÿïÐ5òikí¿G‹Û‡ØmT¬ýàáÙ¦cä³Æ·¾mLÉÒœßh~€˜‚Õaá^«}ñz†üqÄúH£¶r€¹:/ÕQ*v†Ë´L.o@ç[b."UŒ¼¡‡¥® Ùm€¶ ¢Î9¤V^g4,C !³ê—í6±rb»ß_É#)1'g‘èÒ™z)Œi=ºc­*˜Ù¬(žÀ¾hâ%OÃWÅŸí6ã)NbÞHâLÐIø¼Á¥Ãí6†z—[Ž Vÿ±Û€?T”8›óåN¯­6otúv¹3OÃÑnæÖw“Æëž[ó¿Y°Z%LT_†**ÐvK©q£«êÑuœy†ù¶@I©G%p|÷V¿ ×4µLdbÄ*y½|ÚÄ°czCÀnÃT“7‹„?eν¨C%hÛ!td£¦þÊ*ïùyã <5Ï–N½QËó >kã[Ãý¶‘‘Ãéy f[®ƒ¦Ô½hèsó3ïýHdxEžu` ì­î ¬Ë6 ’°Ûì² tbÝ8C̳þÁŽÆAýÀÖ]T %rúRÄ1@©;õEƒgghŽº-­™ha›_Èn#¸'µ1 è“ø{R†À4¼ÐÆÁÛOÛ ––qx ªÿ²çì²·ð0P–¾qOjP;÷' Áºø'ã=é¿ZóýwÀ±?ÁFér:y‰ÿ—>¿uøž”®Œ<ƒ%ù"Ÿ•owûGy'd\OvDKË›!l3ôÆIâ´o%e›x眙š CÖH©>dü‡åïªèJJŠDšæÓ ^`xÎ+*¯D£*¨¥Ö S×fÀu3°Š4Õˆø×âÈJjwO Þ´Ê uÅIH‚Cé‚Û‹eôÌxMìqæÁ{Rð»ÙªÉKHab[ás`ØƲé«Vþj¬^œ S•î«§©Š“°s{‹pæbO±µ•ª¤LÀ“7…÷¤ > ¨LÄ))Óˆd•à¸J¸ôMs©?–/¸'%%ƒ“—ø†¤CÍø)ìJZ‚m»Ð¥E” 3T /ÜŸ™éÐÂJhŸ÷XîÈ4W'Q•¨d‚Ù¯‘u€»³úÔí‘HTVR Òõ¢Ê>BF«™vF ‡W\„ys¥&.}§l•·ÝÛx\õNêSgM5:FRîAx9Ò>%QL%¼¢²2‘¤WÍÞ“Ú.ѧJÑè*'mnŒL’¤&W¡#}ž_—ÖpŠZîÎÅK§¨BÖ ·­™x²•D°p œ Ц‰Ç×!GX,éüó±Ý£_Í¥ÿ¯˜ˆm¤ñ*U'µÔðR’V·_!qÞ;Ë}qy ¹cèÚ_CPÑk:ËT!PÕõNµ”¹ü ÅS¤»9ïÿ‚ß;yim°âœ>B»ˆpÕ'v¿'e¥E 8%ýÔú!ØÑg;&À™BQ¤Ó(LK§ÖqHÜz ¤õùŽL£ñÿ÷1½UdOJWœzïݯÔ߆ËqQÙ»FØ&¶þùÛç/9lðÓ9P¡+,€ûMþ6ÜýŽ&5àòØ&ëÛüm€¯ûÛû\"¦+OàôÖ„O,=À³~5/ÝCÊz58 vE“„ëžßâe ÛmV¾î—"ÔZÀ!ž)Máw^~ä_ñ·9Ø—˜{¸»ÎAK¢Ïr'ªpƒÝ¹²ÛÐn}ƒ¿ ÷°O6èaÂýò{ 5ÂÂv›¹¯Õjë}Ù½kŸW<÷|¾æo#è£ÃKµyÛñÛsÜÏ6 z‚q @JJèŸ'€ñÉi¹Ô ·ÿãb¶"_krâÌ,mŸb§xlóUl6:U|Ý™—³52Øíª£i»çú ³ÍòÔ&únþüâÄZüädBqy^·7>`¶ùÕy‰Ãl3ûÛŒ9èwiŸÛøí…–—™ÿóO@ZÓ/ ’ýxž½©çuŠ„²[Tb¨iˆ@]ÕÔ¿óû”:S§ iócF£möèÒTÎÝ š çš5-Wß2f³5•UFW NêÜ/È^¿º±ÜC×4™GãÃP @ (P X´oï%ô¿¯/õ @ñ›Äæ\lbú¦ÈP\î“Å+O±Ži½¢CÂJKÁûƒ¬ùâJ+ªÝíÕ¬Üs`'À’a|çycskuþ[%lr/ûk£}_¸ì7#ÎÝŠªoŸS\V©$%ëQ:-TaÖ¼F®bzå(~6 3þ§ïR’“S2r{§a+æÖ|Rjö&¼ë·>Ù“•žœ–]º¸8,Ãg›±¦Š´Šö]*h{sÁÐ7ßZáxÑ´(qÇŠÉ$“yhŸvO¢Œ¯ó>pà¡vúfä`Všžõ~B¤V[#•É•#£U±Ù¼ïÜu7V¦$'eT®ÀÑ‚ï3c«†ö>©ØXšZß=¿9? }ˆÞö¹nÛ0ÎÛ¶7Å0Ÿ³`¦½:¥”÷¾•¦ Y•›èP(PüŒhzsŽÌ´ ‹Œyæ}ƒ .Ÿ3¸½ç¶ºÝCÇÊ]u 4ÓÓÅ“èÛÔ=¹¥w‹ç½³Ð†¡ê¬€%éhÑ>·ûû§•‚²ûàãB9ÿ»ŠA6øËáÐGœs Í‹úÍ®W]Źٞ¹ùÖ¦ÝÕ§´ŽŒKp¿rFZÉf Þ½<¥aõàùiŒèHILó=eLËmQoŽ­˜‹ŠPdn{äCíëÏ¥‰ËÙRWÄÕ¯ ê ?X>ªRn ‰° wºQCuõðòðððòqW#ÈÛÝ| ïKÁ7M©ÉcÚx߈VǪHdú*?¯1Ñ[å”Ë—ØF#ˆÍc› LË…¹Ù]Ì/ÃÑ©v gAÕF]×&¼ñüÛ˜("áÕvD_½Ý][é^*(PüLàlu4í};éµG °Äc›r'M¢S&2~{‹EVRœÍ¥¦æ–fm]-Æ$ñ—¥­S{®Wòà¬}xËẠÄ+ÏÏ«ªÙº‚&¾ò'H㳡ϷC_Á¾®L8I#$4ó¶´ª-Ï]Þ†É$ú®1^Í,ôedø3_-œ¤s<eÜxú~$¯B\öEUŧuè @ñs­¤ %¥(%ÒÇÇÛ'ðIu/Ϻ>îáûx V!f»«B|B£¦7Ö|ÍÃlÓ“ë+z~r”¿ÛǽØcnoRHpN·pA@YÚ[_o/ÿàÍÃKH tS”‡–o­HV¬ÁT'%U¤*+ÆÇÛ; ôußüö®rµPîëí3·ÅË|u¼ÃïÑ?^·«2#ÈÏÇ?0´øýB[£UIL;/äš»3©ˆÇ÷-°Ñ-)(þJ°ÚþÜ»jüg*lºè¬ï* 5\‹ÑöGâ¯F³ú¿²ÈÝ;Êfy¨ §Ì\gsQß>(Pü ‡R (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (~ëøÿ{¾ ¬ endstream endobj 771 0 obj << /Length 508 /Filter /FlateDecode >> stream xÚTËnÛ0¼ë+ö(õ†ïGz+šºMÑC÷bцKv¤iþ¾+Qj,Û0Ú@w¹"f†³$,Á4ù4K.¾H½f Ö V¬r¨¼„Ywéí®^Íóç<›ëÒ_M¨c6Ý­ŠM8K?ÄÂMX‡¼ q"Q Ïîg×ÉÕ,yJ812à`+´Ì¼LîîT¿†Ò;xéV• Œ£¸†ÛägÂzµ¬ûW/!&7Ó=TãÐp –ktÜœE¶Dnõ_ô†ã¤Ž ÔBàÕ™=‡ö#a1!aÇ•=Œó}š¶®¬DoÝ\XœD~3c»VŽZiTÛÊÖhfÐy»¸š—Û‡&<]²]WNa<êœV¹sï0è¸O!…þŸ>6*ýÞ™¥§Çõêw^n×í)Ô,Ý,bvßϪóêÝ:\¾Uá$êN†±”´øŒr—ô^|+¥€Ï’tRŠvM¯äGhš|Ù+y~݆¦§­Š˜T»ò1ÔÍ>·0=·t EÇ.X—õäò 9wä+·{^­ªå؇VŤ§•Ð{1߃¾ù¦|\U¡ˆºç¯±V(Ì?ßâã·† =tå:¹ %f#Dú5äÅðÆ|ϸNC;¼¾d‚öQ·cÑ´Ê@iƒ^âè„?Ôû¤Ø| endstream endobj 766 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 90 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 18198 /Filter /FlateDecode >> stream xÚí½XTÙ–/Þ÷ÞywÞ|óŸ÷æÝÉóîÌ÷fævP@QŠœ3’‘EAQ³´(&‚(bD² H”$ Y%ç‹ŠçüOª¢Š$Ý­ÝÞžóû §NÚqíß^kí½×A8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ_Í㟵Ûz€€þ/q{e*>áÎÄ2ï •Ítº÷mڽĄĄ„¤´æáä›å'·nC7ÄûæÇþòp[lüý+*òÏBJâõ–‘•æÂ$ìÑDèåí©ó8Ô^‘¸&½„{eýÐѯâ…HLº_ò¦[X6¸ñi5裰Èã’ËÚÅkQ[p?ñÁsäKìÎòdKb|Ê"{­ J¾u³°vkoŸÜÈíaCMÅYñ’%»ý¨avå}T4QuÑ‹¸Û‰m‹À× {¨<- w<¼Ÿ7ï”úÞäöóø„W}óâ¿+ʸ[P+!Ÿ¤Ýƒj”ò(«k|Y$˜Pkܾ}¯OL¡ÛÖÇ» ñíChËßY×щ¹[€øÄäIþªð|VJÂÍÁ¥Må°glÚLØÿMÙ¦#ÅŠäðø´``ÿ[RôG×|·4àæáÓ;Ëùr…\l¹C&«‰ˆ0PÑ:èJ”‘Éé˜ÁI‚¢±wÐÑ°U„阀äŒ{Õ^EõÐ#>&™À‹p=ºÅYhdV¦F…"OºšhSu÷;_…FCÔTûä,MU;$4Lç3»`®€¾RÓ9‰âdÐA7m*Á)úRºI[‚"YI¾¤gQH%@ÛÙ½Z§‹µ]¿•ªÍP+ž]­ÔTg¤7ºÍfãÕj*Iz. b„u×FÚ·’÷Žy(XkˆÐe“¬æÔ#Á!ÐÇà/:ê×-$äxÝÜÏA%’SÔÆàt?¦é‡B›0TÂ=(²{îÕŒC äB¢/òy¨£ÚákÂÊsS#줙N>GŽy:Û’de‚JÑ'¡Ö “‰. Äóm5¥Q)gŸÔ¢-O§* œ°È»¥[Ô2•¬œ#œÁ@wZ—"W3n&‡ïf6¶_=Û ƒŽÏã²pù‚5l ð¸È_ Ëá°y|—Ã^\䀬7Ê2ƒÈo.@ýB`ÏI‚‡d% ¥À@wáÛ\L<.rÍå£ÇçBO °²q¸””Pîi}•Ó…ï@pÖSÛú}u¤•zh4¹ÙÈÏ7-lXWþÒˆ† 5©ªú8Þòœ¢¬Þ7Ï[U,@°ì” Ý'ZR¢Î¨¹ñ ›øWp"¼‰EÙê1Xجå÷ÏYÉŸç ÉMŒmà‡?$¤ù^¯¹nªæ÷⇲ ƒìrÖOÝ$ì% œÜÅØÆÝôÐå-~½<Ö L%½›l Xˆz éŽX§pN@Á‚!¬*›eÚò46"¹”Ããb ‰dÞ‚«vzA)ÐŒuHCs4_óQÙú¸Û@?«…Z›¸·ƒ½š,»;—HPŠ¨DZ㨋µ¹“Šž*IpQy“ædš«¦Z”m~@ËcpZÛü˜*ƒR‘¸Žm6‘Ã-„M¼ý¡†å"£ƒ ?"ý€Ž)´_8\t[õ‡‹Éô”€}_)Ù dFÑÈ4 gw[CUõ’îÅ5ºÍÛ´Uš’§_ ™:SÃ.éLÐÕŒäNVÖó‰m¼ê ¤¨pìÄ qýfî=‘DoŸXZ@0Õj¨ÎT6´¶ÑW¦0ÌËg¡6ák‘Žûp¹x6ØYEUëÅíÛý'.G ªé6O² Ò«kºÆh[ûÆÄ\2Ѥ¸'Hšk¼XseË«°L¢lòí潌|½Ô‘H‘WR ^¨ž^cþ¶{›ÏÒ¡Êu¯Àl#G­˜e¹ÑÎ>lDEa•m}ö2Î?~·ÐUDahL°èÍÊ6ÔÝfýòŠjõ |4ÝÏÂ6šoyÒˆT;_{Smu}ÓEX¤ŸœÑÖñMÖÝ»ÿÚõ =ºã¡ëƒª“î•ö rÖ”¼óñ»M+ÀgÏe^?B 1 C['8é9‚{®úF‘O!Þ €ÙF bön¥ÛðY¦ZÔ˜œ¶U%Iõõ'e o³ÍÁˆ+æzíýn²#®ìrÔLïôO`=ë‹}OT/ ‰~.¶pÑK—A×ôñõQ#Ó % ¦ä´ sØÕÞïTÌÙEºÆ–)~süŽ“ ÷å^S4pøjµ¤‡·/¤¿z‡]û{&Î6üž|yÍšI¬ø1^ ë¨×Ð}O[5cÿ«X“䥭§×(Ès]$ªrû$ìKIÑ1|‚eåhâ õŠ¹¾ŠÇ•<Ô·UUQHEEäª1É3«ºze ªmƒuþÐK‚F¨”k(ʘ9{èjU´ö Gü¤œ¢]ø÷7®¯âÚý*ØLúô¤L1 HX?·nÈ6t ƒk±bÉ]¿1´ÀÅØÆØSüἋN2Šö£|D·‘£”NsYoäL:ùë,©™|š´<³®4ò•úñgIQw™@ÿö®Í8|y­%å®fîxK¬!®Ýº·lmø¬Øs§_uc6^Œ ÙùQ't‘yÙTMÛ-»%}cï–†[0üîbôëpiíSq}qC[Š=U™›f§AÖ¶r¿ù¤Œ+||ºÞˆ*k`ïf¨ªQˆ¸Âô ¶!›:}éÒE —¼,tµ‚`¶á/Ð"˽êáˆg ]Ž6?§*3ÇX0ÛøœyÞc¬sªýöÅ -—ô3º§W-)æù««í{-æmïÜÖl£kyÊç€#ì^ÕZÝfs9ü4ÛÌÔ»<"ô™v?€èœ3£Æd¸ÝÄŒ»–ïä÷=„rו:ø“Ÿ¸#zÎQe뼨_CŽý¶²øaʽÄÄÄsŽÚ*÷ÄÙ¦.9ŠfjßÞÖÚ¡µãñõP C_hèxZ3ΦÔc25ú@^ÚjlMÚ«l3箸ël«„Ú )‰fºÔdØ× ÀS˜ªJdAúÕK’YüôãÓ:FiÂF›v”•=ÛÊ]ë&Lç¦DëÑézªJ ÚŽ¯{0¿•ÿ±“'Oˆv1/VáæÔyY¾ÓÛe5½ˆb8ùq–™í4 C™¢¤`êàS6ÄBIb›²i¸À÷BMŒÂÌ&Æ6‚̺§‹Ñ,Æ3¼å /s,Û Ãfå¼*éJq϶Q5¶>%Öá‘°'jlƒ>´PóêEZòÝ;IIÇÍ(ú—á!ùü’¡ñþ'èª8^°[ÑpúÀªTÙͨ…ÉŽmƈ,x·‘«Fâ£hZjËúž¨@kZà­[vX(xxÝNÓS'Ë©Z¶¡ºùþ#§"O éa¦ƒ² o±U]IîõðÚºLuR”™ÃK0Ûx|ÂC'êC½ÇëÒUÔ‚Ìÿ(sq¶Q 9.Ö^á“Ÿdˆ)ùïRäåõß.­õÛl&‡Ÿb¸þ+“ 2ŸÝMº“”|Ç”*u½†³ -¯m}`ºØKNï{¨áꟜP7òã(/QJÁ¯Ó’‚Šj¡¡bîõ´ ´¶®.ý€r`²8Ûݧ¨¨šc015µq9UÐÓŠ~ùi'–Æ'ØfÈLJ6®W\Œ1¶I­B‚Ûœ+êc›„m´M‚J„Ͷp²çpÍŠäp@/f=uöBWYÇ-÷†2Þ\ƒ…ÅŸ©UWR,m®S•§¦~`’³ð¶¤Œ=°óoèòŒŒA¾0AÛà|“@{:Àk?‡±`yTE™®mhdnnfý53 e_õr~<Û@|Óq]AÆäãçòÛpgm(JÚŽ¡9¯*Þ4Ô߶%ëG×al㟋µØx!Ä6#ȇ7ÕÀuÀâ2'(!íã$ â£Æ!¬yÞÜøÇ‹Ì©ªöA1 <`£ž]<¤¡CI´û@hümaI ¸SúÊòϦ×hU=¯ãè*:3\”mCMï¢NØ8Ú›yYË1ú8ÛüK eÎØ9]x3ŸÅ’ô>¡îQô<W^UÛÐTgGßu½vajaÇ6{ËéGÃ4=Õ ¨¤Þ¹ÄŸÍ?Fv»üõz‰9Íj²òeXñÇ>ÆkئíÑEª…ûúßý¶Y ¤ï8RƦ-€ËãÛa›(C§8áH1—’¿Þ½:3ðWf.=< ϧ˜—\.%ﱘ—·ðƒ¼ykuÆ©xº§ì&©3¹"Ÿ ~¬ßN¡5+‚¡j¯Â€Û€à»gj6o.ØjFÂl3R}ž¢d7¶Âgc`7ÓñJ(úÑlƒÖ༳‰Óå']ä~:ÛÌõæÓÉÌ~–ÐEfBÚšmúŸD’íM7]%Ù& ÖšQGXOÔÿÒ_õ@_E™HÖO­èkT 2âŽvÀÌ"â%€Ü:ú.ý!¿•—à2Ô29õdß&nŸÓó¹² Ôø¡…·™á°ñ³° œ÷½ÑÅØÖ }Úg`›¤ƒvÆÇDR¬”vŠØ¦`=Û€àSO’}Jÿ½‹]_/Ûð{ô¤sû:,´2`P<ïHx‰çê»”nÖc–zÂ~ÿ•:` ÛŒ?TØi0¼f‰AÌo“í¨nˆÞ¾h`à~c[lsÆ€ÎÔEM×ñŠ8Yºñ¸¸ó($·Ë9PÁ}Ýæi¸-Ñé D>Ö²Äè÷«’E§L,.¬`åäÆ9’5ý‰O¨³¤sfC"‚äÏù*+ZE£nUK Y×[<¬®°×TUÿ4$ðìšò)Å“b½>)EtBdžJÒ_ØhsÑÖº ü «Õ˜L1×'‹ØÆ<èêËÐ[°Íâ`ƒBëEà2êr0”;“Þ!§3 I{äÈa9bFîì»ÝÒò­ã+p.+ã;Ë)P(Š„½ž‘½lX¢t”¥ï–¢’ÃöQR8ùÛö–ç°[çFjIL÷±µ02Ô&’T¯>­_#›Àxm³1ANžB¥)dÌ=CßM@D2aü§R2k uþyS_ñõrÌN¡ñ„,ä÷i*츘»êg(>j-ç|V¼‘ªDì‘]›Üw»íæ௎+©ÛŠ«=œ,â®ßBÒ6aô_ÒÅS\‘UÀ)$Ë˪ÀíÌü“ ½g…¿: #|cKþÃS÷’ÙQ‚Š6×mªdþ¨9(f{Ô$‡ìܹ۵f›ø@‡Ý²2’‰I+2‰f陋:yi©¶)ÁF{V®qR «šzŸIYl‹S”’óI~“sNMÃ++÷Xî¿íTöHA¬]Ël…lKÜ·Þp3Û|Ìc/AFŽL¥“ÒFNoú— cÕz÷ž â~ñûï%í¿$Joª³<Ì×AQz‡´ŒôyšÏ‘‹m˜îh횊6v¤½†ud*JmẌð°ƒwr]ËCøÓwzƒ›³êA¸²ÁI MË'LöìøÓkxl"‡Ïê·¶ÕöŸið0b4 ŒMÌã*ÇRNÙËÈÒ“Ú§H 2¹­Ø(›*pú/æYú˜;aóT¶copìf½cSqÚÀ•¬»Ú°¹€M­ûÏ/V?ÇlTŸ/Dnžà+ÔIïv|Â%óÓšøÒýòÅÄj9j/áðóÁ/”EcƲ†›d+ü¿´ôÔç}ùC3 YY99E»'šû…G–~¶Š € +câz´yd ùô•²Ãõü-:€Ïžy{T[™¤ ¨ DÓ ¿ž±ÈU˜í:àD”—“‘U0q xÝ=ˆ»!µôeøŸþô§ƒ©b²0aòíNi•¥U–ZNêÓŽ¥­É½«4ª Zl9‚¢™KpÓÐüg,ÀÊ„’‚Lѻٟeˆ‹ã§ÚS”T Ò_w >Ÿ`îõ@Kž]ÇÓzÅ»OÀ‘©Ï¤@™)ªA—Òfiaéý$:ãþUÆ’µÙ·£ÿ±›:´Âÿ‰\ð—­™dí³Oþ¼ÔÅg—Ü,$~¹YóýËÛÆ¡g§&“ /`®D[щŠzYo¹\›µ{€ª¤û¢9ÅÊ?fªë~+9o #÷‚“ Aï ¼kþÊ#þåpn¯¼–kÌ"›Ãåry‹ƒGLÕL£Ð5ß%qd ýàÕÌÙe6—·Rûø¢…ðô½øLæ íéà®j}Plö€cGP¨Ôó/ß‹r‘8ñ$ćʛ ¦Å4 .6Ë.¾µŸF¥vLò×jL?¶‘•IUejI× Ÿf™îPcP¢³[ø|¸!§» Ô•IWrZ>—²À[hV#*ÖŽñ×øºoÙ+2¬¢fXp÷q—ÇOY‘¨ZaË¿˜zl$½Û@×ÝTGÖæž®ù…ÅŸæd†ûæ¢ “B3½üüÏÈ.Jè²Ú-\¸Ü–ÛöÇž- Upuôðïšá²냼Ý÷‡4Ï`Ûb9#µ‘Aû]]]CÏÜä`ÚâLgYðwÏýa­ `ìÉJ¡^ág„y¦ÀgrûKhú‘˜Ó¥^N}UqºJç,_\ l*Ì®îA1JÁ”ÑPƒ=Þ·º>Í6ìzÆwÔRT{Bäš=7Tó¶9ô7`«(åy§M\æ'‚¢R—EýÇiÕ¡µMv©I)W.‰´&ÐËÞ> )j6ͯ±–m0U ,©2(EH,‚ƇA‡“ºrn„;„?BΈ?ïéæêíVÐ<&ªæ›ç·}Ý]ÝÜ}ã‘qÞªzâïíî}(²cr^Uc›…ž²ðo¨Â/&MðAlïÀ\çåðWï+)Å¢Ÿ,M ðrwuõŠNy%ªøí(ÏÔª©òäs...ÇcFÙk•–Ñú ÉnAl[Âǚʖx_Yo~øþëíEwÜý"®-Â[£y»9¹„nÅd7ß³>xc•@NyÄ¿9³ö{ö wžðuŒŠ+vr´¡SévŽ׳Vså¾ÓØEÎ_í>þÊDM}Ó -;ýÚ)Ow·ÐóIÓXÁÀÅU‘A\]ÝÃÎÅ- •O¤„mƒµOö»9yù†U¢Ûsíü¢AÁPä!'g¯Ä‚VQµ§ù{»zxz\…©÷býõd´*iUzá­.‚~IÍë9´*í²»›[ðÙ¤å÷©ßQ¶w Ý>ââêº?(²f™÷fÚœ<&9@æ…pg7 ž^ÞŽAÉXj3mÃüœÝOß|*L|åªmtÉìªþ±ˆªdñ*ÌÄà"Ê6@Ù¹>7*¾j²Áâ“NÚA·±M'åTÌBNÝz×ý>ýø^¢‰Wpع–÷Ý/ïJ“\¡–f÷WRä(·å¾®,¿wá€4ÕnÒÙr5YÂÉÄÌŠÒzÿ¡ëFˆ%Óú¤ª°*O§,úMˆùXrÈ™VS¡Ùš¸%>ɪk«-OW&RžV6ö³Ä䀮#mäýnh~±?nF·-(zyó¨=Qï ¼!|ú•Ò.ÂùûYåå%ñ‘. :Aèh„KhäqõÁ»îywN•ô&W°?Uš¬ííRÝÒÙVû\ONúÆ[x²|qÞjä–YTYúâ±%Yötnçºþ⊤9ΞòL^«æ•$RRµÊ)©|•sßËÙ€ÀtFt®»&ñÀ…äòÊÊì´ëŠ»äŠ>,ãÕ²día¶`°­¡´¬¬úSQ±OWÅò8,Q¬Ñ*†,áÜÝÌꪲ!Ëpï²c8Ä”‹Vý&èRRßsšOšê Ù¦â¢ÿ[•_¹vh§qê^ 6[NíÞc>€~X(bHJ'‘¥ìm’LÍ$8Pv¢m- ÈŒ ó ú¸™’÷á0î2 ÈÆdõnîÂâŸÕ–²žÒNWkK‚–ö\!Ûx&¾ý`öý3†”⃾O[Rðd7Pã`mF"HÉ3tÃ.ÄÕµ÷ Ûy[âBÌ6sóÁeäÌ0hßÂóód{.•¡=µHœx:Œdåï´®lÁ6T:U[G‚*MI†¨’щiH5IV*ê®l$†ÓÌÛçƒyáDÜòô ²š?¤Žô´÷Éóù‚Öhwª|Ä)ۃ /GKÈ™iW¡“Kº:_ [x¯`þ ÁØÈ$|Zÿ¸Ù?³èYGCÏŽóÀÙ‘÷=ðÈ…ÒÊ‹%;clã­á‘Šªhºô-m?gÝLÝœ~Ê\_Cz×Nu3çk÷sÞ`æ?f8’é~¨uó¡ü:©;(Æ5ÉÚ&l>° Ų̂1ég_a§xxóo™ ôŽåµ½Yp.ö{© Òr Ó׫[ºQGÉDÉmYí}²͞?tbhþÂPc|øE‡eסÈT :‘i‹è³óÝ$ŠrÄii»¤Ôªy˜\ `ºDU 8: ù¢ÂÚ¿¿"­è='Þ_°½%à°æÎ#“¨–Ú~7\Šé‚è6ÃúDù\a|ҩᱞ@È6|QríƒišžãH‡>÷QÒ<ùFhsMj“é}skFSþe«#÷aíàÆ6_v¡çói7ΆŠ7 Æ°1Ørj3ÛmÏ®¡íÖFÏA ¸SºYX#LúiR¨d%—ÃQÕïGð4Á÷¶úη D)º˜ÄÙf}ŽÑRæW„g¬xƒfdºªšššªŠ<Å~c=2…‚œ&‘Éd:z ™è·¡Û¬¶vw}ÑɃv H_7= ‰Í»;arF~k–›Äågº3FÖî_„ýÖˆ ‰z§ybU·AN<Õ§EÑL\ø±#Öè6{±cêûMÖ e 19ÕRsg¯ê¾Ô-ØœsUÅÀž' k8ÔNcêÌrAþT«Ÿ¥6…JCÁôº1à&Ù¿ K’5ùmøƒª$ …ìv©±wî{R鑾vŽ`i(ÒÝ„JÅU6qFë|Ü“|S¸…¾+ö;²ûâf É[(˼ëfʤSˆgžÁæÃÇgŽ$›d”êzjî(«º-#fÞd´¶dj^Ûäl#Þ}ýÍeç‚\”t¢v(¤–%FhØû¯+þãËiJ$´vT%ùÒ~VBË;˜v©‡La¼Y‚Øf‡’­ÈÃ~3TËùd o¶R•Lò 9‚ $Ø‹,K«eIô×öÐo²Gúþ V<~kªê·I:lG&+éØ|RÒÂæ"^ªU¶A¢¿µe“êaʆcøøt\¡ 9¬G¥†¾ º¾‡ /tCØ&Üî&ú_G]ù„ÒiìÄ6*’l#g´ÆÜ™ÉÑ’g‰æštuKH½d­ïz{õ€†«yK¶‹.è2 NsAPâ\ÄL¶¼œ•mtcž-ÎLMB˜šZXfcr¸5Ûˆ/< Óe Ö’©Œš‘%AKü¸á>sX*씈ò!E¢ÅuÛÀæó‡íç­¶òÛˆL³HCYû$Œmœ¡#´9{ Û<¤15@¶·–lÀÍ×KË,6›ÝvÅì± ;A(Ä\“Ö¸ÈK ð9SãÃé7õT¨šŽG¡/Oê3ÝÓë׬^° ‡dÎ/-¯°9ƒ¹±Š†«lsäfÃfl³áDÙ“æµKÙËÖ÷ÅÙ†µžmÔ7fQ´„ ØF¢û°kÎT“AÉmŸ©HŒP·÷%¶OåÇ åLOO,¯¬¬°YK£ºT91¶IlÄ6sëØFYZöqrD lÉþÚú wˤaMσ„ etuonª­*7ÈI‡¦Ì,ù°¼Ê6зSuªDzz×’°`¶ ÌïÅ 3:::Í’°f÷[2mzØ„©dêŸQPu_IaÖ{¦¦Mð ÜÃ~:$«“÷ëž}ïKP‡Ý2ÆD›ãÍïk‹ÚØ©)+ÝxZ =¼}¶2M ±gXT6´´4Ö\tUV=pü„n”}äÄãŽ5wŸG»Òµ*ß¼­«ÈñrÔ“G½ÄsÕ”Ýä[Ùå-­­u/´©Jé5C¨n3Â$™Q¬‚;»Û›¼mj_€ ýt‚||Vy[[ë‹ûçw4?ÌA̹æ›P³æ¬ÄªßóøÑ亯\·L T°‰Ä>¼»ªjy½œF3 ‡^Œmfö™ê4L  ²¼ìÌŒŒŒœýOµÏbdÚS‘jkjhîà׶zì¥\…÷%ðï{;ÞlÜÔµ2ÓqéèsSó½v'¯ÞŸá 3 ¸äáú bÃ=a—<œLÍVaj¨óôí’dʼÂähk3§ý)…Í«‹]ȬÿäÆi[K Ss«£—“…;"8笘ÁÖ¾£f*ç(so.ùêšÖÌñVÇÞÅÆÜ%6w­fõ&ÅÌÜÜ…‰™û¡oÆ0ÓÿíCëÃ9b±‘ù©—BÍ ­œ¼lŸAï­ôVzÙ™›˜Ù$¿†J²xÂÝÜþàyèù¶ì›¶Æ–ûüÇ—]-ÍÊ‘XÁ]ÅInÖ&ÆFFÁz…ÆãDSˆ‡‘‰Å±«ÏÐ ‘7ó1ÈÕÊÈÈìJfÔ2·Y›YúBjUt˜ÕÙL+{ï1MŽ,¯›@îàõS‡-¡†45÷:|ªa›…ú_û>Cë2Ðøp¯õ‘äñ¹–c{w6òÆŒþÚÇöfF¦û^|äÜ>nþa7ȳf›Å6+ónÖ‚Q–ënguŸ•ƒWBfͪi,X¼ákjlìti„‹Í ñ'| ô ýÏÂQ~#XGË¢t)á~!W°LL÷6³À‘LU£ƒ¢ášrÞþð•*ôº.#ÖÎÜÐÄlïù{X¬HñþZï|x¶__;êõ:‡—ù}0Tl×à+Ëc¥ÚFиèœÁÚ£>û ñbáè›ÛŽT²AÇÄaœ+ö²435ÆÅ4ÖÕÜÛˆh×ÀhM°»µ¡¡¡{ðÅa,$+ÒB-å ØÈO|Á>Ûvy~™þ÷¨¿Ž¦ ö4I*þóêÎØo|(X'¨£Í¹ð¹ÃâîO4ó±ÿ ~ó Ø2þç.Sð?„oÁûDöˆna…¶»ƒqNãø…¦ $¹Æ¬öf&¦¶WŸ5€?p;TB“솉Ï3Ö~®¶[û ÎÅÀ«7DîU÷s5î´]Q”ÕÞ¿ø æ%þÎqQ¼ÏúžHÓË(~]UQ`Í$‡Ýßòpët?ØÕrøàŸ;JoôùÍ_ƒÿøðÅÞ¨-øE/²zÆáUä»VŠ3ÜÏN}O:«ÙÔ6µ¶4¼öÓ¥Ú_ÎÿaIðÙ¦Úä‡Uc?¹0ºFÿÏØцJo‘]†]w;ýüdÐ5$ E›émÿdË0ÝÀZmòkEuY~çàʱ=­uù¹9/Ëß o‹¦Û3_5œñ—¹Y¹%ãK<`eºäEvN~ñüz`Ïåå°ù¬º’YÙyuíý[O¼ K^CeqvvÞÛÞÙî4k”mfûÚò^½Fh¥t"µSxlðÚ.²¼{¿X”Ÿ3º°ŽUš3Àäûàì ÖÞ+#`F:xïXüëƒðN"Ø2 ~¨““Árä•.c­à½d0Gxl¶Jä8Çë‹À»÷À¢ú­¦ôþÛrðþ=09¬jÇn¢÷?4€i÷Áûi`ÇøêÃ}oÀûÉàó"½&&ws°¤&FÀ‘Ì Ôü=øÛ¿Ñ-Ír¿÷¯Ø3c#àØÔy‚ئ´(`†ÓYšjB¤Å<Ê|Ý;úæEFóèjD¾¦—ŵƒ+UÙ•}+3½/r2só_ / DwoÛ¨Ç_•Ïa'.&:òÊÑý |]B\ñ$Vþ†ˆJû¡©‚·2]Ÿ7ìxîLoIA$Ýc‹lƒìtj©-ÏCòœå —uWZjËrrrò‹Êæ„lÉž¨*)„nWÔÏÁ]ͯ*ˆc´’ó ÆçŠò³Ç—Ñ’{ui~[ÿÂh[QQÓìxwCnvVAqõœè _ §½®"''·¨¼nQt¢Xz•—Õ7‹µRG}%TªüÂ’ÞIl“|Ë«d=yƭ̼¼Ü¼c®ÖÞ§_– áhæ‡ß¿ÈÍÍ+lëÇö Î},+h˜œîkÎÍÊ*,¯çÁÇçßåçd”Ô¢[˜ø-™ÅÐ š(ÊËÎÎ-ü0ßæ³ò3®P‰fé9yï‘éw°³ñE\Œ¾)ŽH”ÞbUIAN΋÷S‚Œ3° ¼1«üýÒDgv^!.~M ±Á¸4RY\“WØÒ3.º¹0üM9¹ùõ˜¹ÁxW;²2ÕS÷üWýÂwƳçFò_.s?™¹™‘‘Íx@UŒMM7ìÔO+MªšÛ2;cöh¸…9Û<Qb­Kr:åe™šSão´‹¿çk¾‹Daøi¸õèù½h&™t¹fjyqï¸Q”µ¬¾¿yËÇÚ,0Üe›ŽŒ«jV>Øñ9™¬ Ñ 6“–{2òWúL5e=ëâ§Eþ üæ·`+¢±÷ÁZÁoþ üûÿ_|g ß,·¯õ\Ào~ƒ(߀±‰ð¿\GeÃÏ\•‚¯w‚¿ýkð¯þ|Q¼UÃùÓágþîÁø|a} tIðÇ?üø _d"ÌÖñÉ÷÷àþü¯ÿD®iX:ÿ„”aRQ&þDLÔ€?¶!+­P9+»^s0Ñ&?©ŸnzMW¢GÆÝ-ìšO 7¶9”"”¨¥ƒÔ]gøs…>òF‡œlçä_=b#'m€œËËcöÑÔõÎÄÜ ÷ÝG¢i¿Cn¾‰ WwÆNx[ÐÎ=ÂÞó5öü ”!¬k±&Zô´ÔÛÇתR‹Ý…ò²¤}þáþN$YJê»1݆{ÛQIU×úÜ÷Wƒ=m‰ ƒdƸযjæ}-6|¿µü.zå.êË*˜{†Ä^ñ¶Ñ¦2Ù?ïN‘ ~å~zõÛ^Ÿ“Ó&lýú ²–]5bX…›yžÈÉÏ qÖahàÀC¸à¦­jbwíÖMK#‚®¦HCÖjäŒvø]àiÞtº¦ETôÕcIæ‡%¸XÕÏRç’RŸ5f?QÁàFòƒŽ%°éŽEEóÄå§ݨFýzzƒuÊLNËØùú­X}3÷ýº°M}„¬qH€¹î±¨ Ѐݰ„ܹne"ÙÒ3ðTèùB%¼ñ|¤ôª,âsüòïOèÑþ·J¡›“…D›sÎN>/cBme G‘¡6ÛU¢©k0²ÈÿLl3Àm¢ÐT:§Ð<½_Sý~÷2Ø»k§z-zo±XYJ*©ÍqÂXIêÅ(rœŸL‹ªÀbõ‡Q¨>‹ŸÊke ŽLWy?6)ûŒ6e@ ÀB¹qk;TVƒ °|hß]j‚é~`½¾!Î6Ê¿¿ùŸ`/RŠÈ€ÍY_ÛÃO†of!ÌóÍÿ!^}þb ;øþMYø¾üQøz¼#¥-¢rþÝ7 œ1¢æ ÀÐ ÙÍÿêðmûKàÿ†Xk7|Íü&ºò~˜@üÄ•±tþUÄ6mðÅ?ìÂôœ£–ðÇ<$´Ã_~þù ÙæQõ8Èù¨I`T!'8f^ß‘U·E{ŒÛ¿[ͺ;_ì+·Gµ k\WCÕóOëùŠäi:ý,L„ÊnX©9Üåc½€é-¼þ}Š¢KÐé¨0Q­ôãÊcöBœ»’Í…·èÝâÄp» XP dÎ심¬I¶™:Z·w>4ô'-e²…N÷MoG渓m¹4ƒyì=š+õUðëðfr¥ŒƒÐÀûër¶1˜V˜á)kÓæuSe¦ ¦ó.wªhùcì©ÌÐÝZ"!:î¦zøZ¦B5„wZ/åd/b$šËí{ŒdÂjR–VmFnǘûF¡GøŽº Wó0{ŽUsZŠvp n¡ä8‹T»³è]Em‚®L£è˜C¤4_–ÚMÍšL—ü=ŽÃ‡(½ñòçHým††^Ë8¶¯º-Õ™bvj€©òYUáhš?¨¼{Kªå”ônÚ+LJ7(!”hé15fvhº·úŽ¡m0$þÆ„£ÉØKŽ[{dLz‘—o*Êõ£ýXcªÊ”Ò®¹-züDzÍÐpãC:SoŽ+¹E´+ö;Š§0Nc³ÊåFúíŠ%uwf€aÔ.¡Jê\!¬ÜÏÚN^º³ÂH±F’~¨ªh;Tß®Nž+ûéß]lÜœZWÙæ3‹€ï×ú:f›ŽôBKeÈ$[Ü~¿ÛœF؆ۦ­(w4K.åîšµl9“e•„††CN¹,#/çDOAT ±Íw$·Ea–Ùgjûžg›Áút*Cåf"VΛÑ!T’Á|}7RÕö€¨¤©G˜²ÍNŠ/ÆH•°j…H#WÎJº8>êIïy6,ÚmÝg¼GúÞòª_=ôU¿z®íEûäçõÛÀ 3Ä0¹“»šüSäp?Ä6»u/ „lïlhÓ•C×0¸yë6Š¸¸ø;I)’‘¹Ç H2Ù…͸\LÙ©òfe³âŒX쑹Ù+é´² »¿‚*Cºœ^ÔÝ;06=c²g_*æ+h)Ϲv!ÂJ‡Ì0tiA«°Tü<5ê¨?S‰`éaE ¦Û ’yù ±÷¹<ÁÜ:Y­5 cT=²D=¢Lðy5“xÀVÓÁ71«`|BBZ^¹Äœ6Ù¦JPq'Kè6È•¿‘ܹìŒù>Ü•‘·™Øp'ÇZ¶Yÿ2:þ¢½[t41ôc–”í•U¶ÑØ„m.¡1g1éÞ¤2HÎ:Á1¡â¡ŠpN#4°Àß~îôÒuølðo¿ó jW'H°ÍÂ,87‡é3Ô߀¿^ãoÁßü#ˆ䙟ç×z‰ElÃ^Õmà8¸c-Tc )NÁ{Ç4Ä6Ò Ž˜Ï]d¬}ènÙLmº’†Kè0ð9\@ruƒ×¦!+_6%Z îЖ’~>¶Y/ðkíô͘Dï/ŒöÖ5w`–TõTsÖ¦á>v@iÒ“"í˜Mœé¹Õ™é”‹áè »4½º 0j@ ?XgrDº |–¿4FÞ4°¿ä(3‹áV~Ý„©«?0j*«tóÝRý%wŠÇEÑJ6›ÅâKCêƒg=£E,èñü!‚E\×:¶1óB¶"€S¦T©§\ádÌ_á£[|ŠmvÊw 'ñ„G«ÃpØAÄ6.3phJx豬p—‹¤Ðþø"ÙÔE¤_´]§Ûl³q „½Ó[ïÐ~á,MÖÖÕC•u í¼^ËÂ|õËeÔtHOÛ„m¶zƒóôó§hT盕|öÝ y’zÓo[º ™J±¼´Ù§‚…sÆõ#ÅŸÎk©O•B‹Ì났Áéö< …Š²Ídguƒl´F5·Žõ]Æ8|.w逹†wôsÄå0w?1¡o–·•ßæ2b€ü‡9˜3Ï71¦Ûl‡m ?‰¹à~MÄaë¸yU†`Ïíß情ÏÀþð›?ÀkIüwÄiìtL:_üüøăôO`z<ø‡o$ØæˆKg±?ŸGÁ_ýþ?Aé¿GÌ=w¬“ÿêð/6Õm¸}zr”ôžE¡¿…wÍŒ¢Í _Î|+b%%â¹GM>Ÿ5ñFƒªÝ< FlˆJ^wy|°®{Ò5½€Í5'>E;p7gøœË<.—Se½GóTEîÒXRbÒÄÒZÃöuJˆ²ÖÞ)G²O8©8˲ÍÄpyŠ’šÁ$‹ÃÎØšÓ £Áù"ÚNÕ’ø\Ç×R-2ù͇¢ T—©eäÖX=]Q¥êî…"òfÍ2ÈÅ^аìÇ”×f0‹'8B¶1£+«¾ê™Z «ð&‘i8•b¥Zs\tÙ(””€7åª'ô>â©$Ü; ) æÇé¨Ù^Þ>æh¥¢VÃoS“¢dó 96ÈÚñHÀƒ™ø²‡…®ÏyÜœêkλõO¶Ç6ròŠ®g xPzœkºTTìçSˆR†ÝHdf\èTÇØRhè +)‡Ô©O%Dê­¦y臃/¯‰Ä -)!Û ZߺB4^FRi‡ÊÅK ÑU·½ÝLݧçÁG^úœäg©ì ¯ql¦Û¬Lõ&&Ý_ä|†WíØéì¹”kÀ¼Å‘¨ýDyyš–U^+]¢3ú_d…n˜· ÿJl²ì¿?ý€° U¹¾µb¿¹†‚¼¢Íák kL˜Mòšï«°Õ$äÉ^gtf{ì1N€jÒœrj—š¥ðp¨ !û†‰@P¤ŸJ)ã" >ëƒ Q¦èú5©°†Ç&òòè)ða$ø{dD˃} ˆÔþhz‹ˆµEEý6‹°*ò a•m²Š@ú¿À$;pž»Õò÷@HùŒ äôA‘ÎÉý±ûVÇAtT –AoeÄ¥# –fI°Íß!O³°“ÔÙÀß!wöÇ€ØÉ?veÿäul³¢Eß“Z kµñäòç‹0[¢;™*G†Ã•¡ë¶Å¾RFWëò®iщŠ Ê·‹»„%:{ÀŠ¤¤¤DeFÄ屑jU\òÝm¸­%yüæQWŠ¢"I‰ä|mÞö.Ö“HJ-cܵ›Õ^ÍÃóÊDE9Eê±Ûy\¤„Ú é” HGåæ]ñ•'’Tt¬rš'FRådä_ô¿Ír0d•H$†Ö¹\df¯y|QO*QYÏæqÝ:Qß0Þ#£xèÙfßUѳá0õ¶¤¼²^ôW¦É*fù¨×\èsÐZ›H"‘™w [1ÑúÕvÿ{JDœ¼²¸`¢’CÓ,½zpþC.‘@ðNƒc¤F»ÈÈ)Øßhdud(vS´ìà%ZÁJæõI*ܾà«#HÏv?²ÜcœˆŽÃ¯o)(Ù£qS§kKÑ´0¿ 3 ëí##U²¼,éTj¥p„°X)ï‘V¼òz‰¿<¼¬D$QAWžÂy! 6<3 É+(ÒÂ’*3¢M4÷ç¬Zoý_…ƒlQlPBX›í|¯CW"(¼"ï.¡‘™ìü¸cL2Ô64ß³i³ðáFpªÀéOê—„l3MV”Íigð©ö|yšÊÐO]“ß- lñø‰g¿Më$ÜÂÌÙF^þRT\r¹sËFgí»ÄAˆõ;d€MߟæI”m Þý ZÜ]_€5ÏVlì%6<¹€$ØyügUÉt¶ |ÑqÛy8[töÛèG¯ÛɺQ„ É×ùÊßO “ö:ÉÞú~6:“²æp„d+qOé©O±Á_(ÛL°$*ÈžêzßÕ½]]G–~êLÞRTtÖ—Ú1Œ±dL¶ÙrPS44\ûçüëŸÑLÅ&^âÍá¨FdnÇnž|_žO ¨¶Î°Eϯg›ŸHá9q¥àÙ· Iþ‡w­9·˜nóbd€²Í×¹“eøg îô‡“±¥‚_¼‹½Æ¦{ßOK.TtÞÖÐ60ZCC㈯;ÔÏ}ðßÿ–uñŒæêÀøð{·«Bý}Ï®ù™Z9½ìç‹OO‹¯k8%€¿¼`'«½.A þÞÚ{nÖa%_)Û¼‹cî=Áqüä©fCýn˹髯ÊÏxÚäs·°qìAàkoüíWp£ë¯û|ô¯äì68püÙciðfüýÞZC­øybQã¦ÑúÞæ%¥¦#1°Á©ö×7ãâEHHHH~‹î(íx}/þæí¸»m£_zÂEÒT>Oˆ»—öì#ìç’p9ŽÕ¦'vƒx\S8~)Ì´îsóŸ\·¼~Ô…–ؾ±þ¾Ôj®(ÍÔ7ã"œ2Þô2üD$†Óg¼íuulOó°%%ˆ@Ó9sýîëgõ)²·«‹þRBŠuÞ‘®iát"ꌿ§µ¬¼FåÔ.Z¶bÈf´Îà|ƒÇw ›K¹Þ|…Ü@Pð‘/aêYe€î¡££ôœ§žÏÁSTŒm$˜‚ße"§R/[ œ ‰×rÑÛ¬Ò#;èð†88;¶`Ÿð¹lÞ§´¸ÈF3åq¹bå Ø\±ƒ=Ègè‚ÇëQ/o+¸_y&ûÓåÃ+¸Èè¯X¯#wi„°qÃŽ/L6Ð?×üiªZûýüöj’T5\† ñ:^%MÔDßSå¢A§ëòUÖôtÚDzM¿–̦5añdÆ2‚é1s-Ùä5lƒ¤稵[ËÅÑXézþ zŸSú­J(4æ—Ç”äe›F×n¥{|ZKÏ/ÊÝú8üó·i!ª4%O¿@3u¦†]ÄCéNRÚ§…täš2ƒïA,uFu‡Þ•vŒ*¹\‘½v×—lvª>la'm)¢Êr_Lââ€Çƈ¢l¥ð ‚âo4,ŠÞS<{l7Ã3>f*ôˆ{„lÃè_â c˜7¨E`Öófßd×é6à| MÑüs—|,¸¡£kÿ0+ëÑ+e•„ò°ÆÃc røku‹çѦªÚvè~O¾‚¼fÍ$fÜÅx1¬£ª@AŸ¾¢\Áº_’½W‹r¯þ0;20&¶ ˜3õæêåóA^ÎA×ÐVfÇÆfDÊ×Ýpgûx\pàøÂàú’­]*¯};6'Ü,ˆ±ài°ƒîÑ["ßIQÜoƒn2¼íJ?šÛ "C$ÙÞ(’â¥ë÷J¤è 7p²ó?`aç›×¼U<äç—ŒŒ\ï¢üR—E3µookmÐÚñøz¨†¡/¤Õ„íÓ>šåLÒôz¹DìÑ’“ÇýÜíí¼"Úg6°—ÚBiÎa¸(àÀñ¥7 ¸”|ö¾¬¸÷p<|cà–·Õ©{¢‡Ãœik¼Ä½·éûÇfæfff{KÒÈÚ¦Ó3èÑ9Ä=2§§¢ðê#Gè‚]²P‘I©ÆN•Ûeøa+¶14>„m-ºNQQ5¾ÃÔÄÔÔÆå OŽ< ’·…£…T×Üèe©¢:Â(ŒuÖ4X§C£ÏN)XÆ…Ž/L5¢k—½ä¤Ç<ûô 8é6YaŽÁ±"ÝÆßHn ÛäGª“Hd *F#“ˆ5Â7¬žûJ ŽÓ¢õn“šŒâë9QP¨úÒRO†·dì] m.R-Ü××L¤É³³úzÅÐÚ¨mEÉ!g@áÁ•Ö¼Xe}Ûµ¶ö§'ÙÁåŽ/K8ã9†:>£Â¾ÆªgŸÖ Ù†Ïz}v—œqr }®ò• +ôÛ¬T•¾YX"_|›EÖ5±„ŽXù}Ämš½ZŠ) è‡î;&àˆÐóe¥å lÁ¦lG¤«cìRºYL=a¿ÿJšKÜ}› ›4†ÕÍX𡶤¾fž¹Ú»;äÕµ£¾Ÿ¹£–d-$TìL÷ÛÒ†.QQóÎûú]ñUp8¾ nÿûðjˆ*¤¥£ËT¦¹‡|? qËhÅJц8nég½•d¤54´ö…Üów¦ùÅ";d€>úýÓ½F‰ãQÓ5ö0tÄ5‡l;)òÑRqMjâm®‡…UES[]Yk¯ga;~i´Ž@[¿&õ$JMÃ+S”Üð›‡vº45-] Ù>à²èeÃE7þë»ïŒcD§)¹'HT½ØŠ~xóø²‘Š‚‘$-Gt>=Š$÷*ÄBÊú´ˆOº2ߨÃÉŽŸƒq$Í«­äK< aÔll¦[¡ÂŽ¦ÚªvÌl¯@ø–¯MÒ_{2H"p°YPN@à9ìÖR SN½~ßoƒǯ¼ù>õ½W8?cŽcÏœLiD¸ŽÅV;ð^%Þ 8pü7R®~6ÝB,£÷iû‰Ž±ì_Åùh8p|Å<‡GÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀñ3áÿú+ñ… endstream endobj 767 0 obj << /Type /XObject /Subtype /Image /Width 302 /Height 507 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 45986 /Filter /FlateDecode >> stream xÚì\S×ûÿ#®jmÕº»Ç¯»u 3aｇÊÞS¶ì½g2Ù¸gµÕjE„„ Žº÷^¨ŒäüϽ ökûí·\þ=çõyÑxrî¹Ï99ïûCþS»J¢È°Qæ—µHˆÄÿ†Ä¡Á §¯Ê¾äÌ·á=šDuàùN¸a>€9k†HØ'ºñI¾íÙ ÷vóïïäßßÁ»¿wþzwëC6½äDŸÈ'¹òäÊïîoyð#ÿêÛX`N#)ôü.þý¼—Þöà!‘&,‰<’_çžÛýOŸ÷?|>Ð/À–›z{ûôô¿àhEi-Oìÿrû×è“DçF³_zE án<…ÙæÒ@Šº ÿyòì­w’(|"“~¾þ÷YMŸqEDâL7žÓáGžöm>øÛBÿ¶Ô³Ðxᆠ¤Uõ¤ø[°ŒàåKæîß”Jn €p›nfž)Á 0v‡QAD|ÝŸVuzUÓíÞHÆi)W´‚H/Ob«¦® ¤uçîpŠwë=‡úïö>†#¶rÏo$§Æ°ZXLP±ÿÂt—F’KSð ÌyVž&¹<_Ý~ìÆ<«ƺìÊ%:8;Éåo%<“ŽhVß‚¹¹ê£—I±bçzò&¹ðæGtH§ž^ÛáÍÇü{uÍY’M)#ñÚ¥G2¾$Û–½ðiÑßÊ?Ý€žgJŒ["ßtå™ï¼÷°_xküà¡ð¨‰gï-†›&*|¨<}ášÙAr<1‡~ V^œr®?˜ûô¹Øø[OúÏ6\Yè‰BSDâø’ˆíqÈq¯Ã«òv_=õDpóÆÃÏ=NÀTäaD7 ÖãÄó¬yËm‚àDIç¸N Køë±³$k ]1i8‰.™íÃ$º(å×uÖ7+û×c–ù ÇŸDÞìðÓ5…O¿€¡Þ¯?œ"Ù5bŒ`$‚ßÎ=kž{¦î¡Vì–ÝArnJ:3bþ†3Ó½š4Ën6\|ä˜Ññ?!Ñ/åÝ–s:a¡@(ì8}ãÈsÀäÍ›}®ý9œ k›.‘¬jEóÄ?"ñ—K“Ýš /bƳ¶Ÿ›éÙ¤Rv£öü#?ú©ÉˆDDâ?Nâß0“°¾xð{´¬;ú¿ô…œë ì$€˜DA÷íž[OžõA AKÓw±MÞ‡©çÏbuž¾è›ïÒò7®Ø˜E§­XŽ+ÿ»‚Ë·_` ¹§ÎÞšáޜۅ­©öa&õ¥”_Æ&@Pµã,)#ñô¹{Kp‹`ƒz^¸ea$Î-Âæ›»_™éÁŸ›øÛ lDðìå@ŸܹùH.m)"ÿq½Ú¼¶^cÕÜ6Hhƒƒœ$ÚbsâëUÝ„#÷ÖñßH<‰©[Ï«Ò/2ŽÞŠÙt~®k)NÐì°“ëöÞ,:z;aëÅ%>Ødóo#Ñ•·œucÏñ«Ÿ¬kÛìÝê±óý×Û‰[ÎÏpo$ù´ùî½É>rÃ<ÎyJܫ죷,2ÚI¡ç*ên'ì¸ð$Ño}àvÙÁë QXˆ;#áÂÆúÛÌîižéouî¹YT}'yÛ…w½yx? áHüg¿‹öš’]ƒ˜WÞÛ¡íß%vm8MŸuB+Æšû0‰¹ÛÏb“AûÒšF‰óØ8z¢c«0ßí¯Žäß;wêˆ[(²fºIÜË/>ƒŠ˜Å›°vðô,Ð/ã_%*#¢ÌËq° ®x…XaÑ]DáˆÄÐ'Žú§Mƒs÷Ëž—Xð¹ÿà¥7=½9ñ›°óf{Ïak§ÿù`Ø_:¦òŸ¿õWO¿¸ÿ©ÃlèŒ "q\¿Ÿˆû¾wÓº Ï*§žœí=|˜ zŠºô Ï|ÙŠ¹•ÿÑ@EßODB$y 7¾X£pg­ê ‘‰è;ûHHˆDD""‘ˆ„„HD$"!‰HHˆDD""‘ˆ„„HD$"!‰HHˆDD""‘ˆ"‘ˆ„HD$"‘‰ˆD$D""‘ˆ„HD$"!‰ˆD$D"" ‘ˆHD$"!‰HˆDD"" ‘ˆHDB$"‰HˆDD""qÜH Þ<Ht$ýTÒ_!±‡à$ö}Ë.’ÌjI¶õ„–e]@åE׊‹D·‰xšïÝÔxñ)Bƒ(ìÿölïáæ¦GDÖFÞæË=üË=·‰pâ?ÚÝþèÆã>PHd!‰¯€¼v@í$´ò;@Í P}ƒèv"P¥ÝàÚ3 Ú'ö €oµ”HÄV.<\«)Ÿð¦"L ¹€w[„!qaì€àZ@¢›Øb€°zTHL›ŠD(±À'U ù. úÚ©¬C$"ýOâ‰F" þ’XBüŸð…@âµ—H$²DV Æ’pÌe°¼ðÏÛ0æ½$:çOAã…DâØ>QDãÁ;![?ò(úȱ0¦m2Œó°ù§f6|èZð±{á'nÃú؃3³àwê¡ßZ´yfÞã¿@âÔÜ3ïy³>ö ìŽË5ïcϲyq§¥Ø²s`÷r)¯æcïM3ò{,ˆÄß%±,rp[iäýÞº} Ù+5Œ? :6‰H⬈\%%ó¶.^·sH‹BöO§IãàÂ_Kå·Kk,Lº*ÎõFC…Yƒ½1Hâ› {åä?÷Þ²(ä\»?p‰PPÑú4 T ††áÛ âÉ‘xKT',Ÿ”¬)§7/õ9‰+q£¡òÈ]þÛIbà k'EIãýˆß°AÂoE)êÏÌI¸y"$1²PÎ |:õåp°7õa#YŠzzÎÕéy÷D¤L*8¹Lßr~ÚmíÞôì«ÓòJä©‚»XáÜÛ“‚aŽÄˆ g&î—'ë,Ⱥ7©b@-qpW0ð›E¢Û‘˜½SónLϾ6µ`Ðí2{§å]ŸLëŸ\x÷¬+Øa&$19S•b>/ùþ”¼[RØíÄN¢Ýy#ç"ÍI%`–OYÍ|M4DÁÔ¼:%ƒùÉ—‰JbÄtzŸØ ‹sƒreÔÔ4ŒT4–[çM§@—š8|àž´\ÇBFKOYžòE@ ß_ì'¯¦¹ÒÀa¥–¾œþºÙ9DÍzF ’xØ€bð–w$YÇýí<ìŽR>³´“×0Y¡o©¨¬ÿ¥çn,ª§6+¿”5+øÒÆï[KOyUõ¯Ü˜,"QÉb^ôqiUé/›Å6— —*™s1TDÿòè´,rRÔð|ƒ+&q2õÜ÷êÊïÆ%àŠÍ¬õTEu»‚¶-Ù‰k×âà- c/ÂVH¥ïU k½—xoRAÓ M½OƒÛH´³ßêË*˜Ó§Â‘_ fûG©©‡Ã‰ÞÌØmŠJF‹Ò`0}bkM6dO*ëTƒ$fÜ%1ûIÌ>s`r~××ú:ÒÖùÓp*8;ȧL…¯Ëñ;jè-‰»B¢Ÿ’Ö¢H›ÅN/ÂúvZâ2ÅxaêRJô‰s²_Ìwñ!›fŠƒÒ‚ƒ Kn“Æw.€H$‰K}4ý§•ˆ"E½ø­†ÒûÑgI"LÑÿÊ>áó5IbÙ¯ÿÔ·‰TæzÇ‘ ÃÅkM\0=»{FÁÃI§–éê-Iº.ŠÃ§%rT”=¦3„ó¼£å-©SYâIÜÜ B²¢Áì¢+63ÈQÈrÚVÒzÖ+õV-5qYn¸ö{ëÔÙYÏ0pJî}Kùê{½3Ò»f¥tÎJnýÂÌækŸ#$Ú)iMòWn‡!øXgÒ/,UQû$²MDâ;ý¤ìŸäÔçàc®W$Y;hshš‰PúW“¸Ð%XQÃmÆàÂÅäÂî¥jªKâÏ‘D,: {£°g³_BRqßb—py³„ɬCZ4O\|]䃦%pU”Ü!‰‹\ƒ¤J§ˆŠqÁ¬ÐE yQþ(÷ËS´–$]š’orî¹ÿ³^­ ;U¼%¯ê–Yù­2YAYQ—œêŠ/dœ˜D?-­Iù·‹T‚“Xtã å/ÂxbÓ^¸/>³PU°9D*½ó…™Á÷Þ¢’È!¢y"˜˜AQ5~gp#`ZÖÏrÊæsÓ®{ÅŒP±pžgŒ¢qĦxTKÑM¡¿ø=xDÈÚ2¦ÂÂLÌ'ÎYWD&k½CôM£Wl0Z¥RvËSÈŸŸÂÖµ°;ÞXª°ôÓø[¤Í€THi#6ï#ÑNB¿ô<1è/-UUý4¢eÄç0ÿÍà\EŠñ‚ĶšN³i=ÃÛ”ˆ£óÚ)ü[ظ’"ÿY@#6xŠ… \äâÞ  J¢Q†[éH•€©ñŠá´§Ø¬sëÿLí¿8N¢u/Ó·’ ±#‘ fE–ÕÖÎÎïÃüçåûk\(º™“Gø&‘OÔ^;-³}‚•)ÖssŒÅà]-kŽ_å¼\´ù­¬G8‰äåVSؘaSS÷(Rô'Ý$±»¶¨k¹Š‚Œ¾÷R—-R°f&b‘(žU½–/«ª·Ì"è{ãÕòš«'Ü t?1[UZf¹©ûRsÏ!}oá»8æ©øÅ{k½4­¾³‰øÞØBAË}vÎ3RAûJMEƒû‰Óãéš²«ß`@ÏuågY—/œ2¿´ò”Óv\˜r{äáá›ñ»)+eÞ% E¤Ì{_()%¾wàÔŒãKuô¤Í‚>wLúÎÄNÆ8äíìg$:æe¢¿´ùÌ1a…†Ærú4Ø™I‰Z+5ç¥ôpBßötÔ”Ñz/úô`,`üד(Þ,뛞Ñ1?âÀ‚Èê¹OHlâ±Áw §äv/Ù·0üÀ‚úy&ô\p´3Ÿ¿™P»0lÿü¨ºé…Ï°«ŠΉ>6½°G¼Ñ_pvAD½ouÑÃYñ5ðòùëkÞÈ}€å0%³ '\›~x:í¥„`JfÛ‚ˆ£Ó ž‰NÉ¿qØÈQ¶Ôâse’­`I¾ú§p¬Â#ÏØH–Ìdn_²„£íù5œÄ/üÎ`13gðü S0|–†1@âö¾gª¶lmù¨õ%¤·O$w¯ëÇÈ?Îd ÿ$ —é˜^=?üâwjŠÖ.§ôí×^§ð›Wâ ÖƒAܯÌWÉ„¼…Ÿ|C«¦ˆDô­¨ÿÁ0 1ω«ž•õdŒ˜£¸gVRýü¨šyOÑqSD""ñ6 „£¿ä¿›ƒD$"‘‰ˆDD""‘ˆ„HD$"‘‰ˆD$D""‘ˆ„HD$"!‰ˆD$DâX$$*>‰,:­þµ’D7‰`ú¨4M©í@uÐÚCh©íìNPд~ º©HD“ýApú ôÔ ‚«OÀ™ûàìB Zxû¸ÝCt;‘¨ ÁÓÞ @bíe@mL¡EouW0S n'ÑÄàÊ6p‡è?î-&Žsv¡û³þ #‹OtS‘%V¨jw{‰3‰ð)‡FÒŸ ‘‘8!}"_ÈÂ^a%l”8$ŠŒ%ìKÔÿÿÝÇ'7VÜúÓǯÿ]%–àõH˜þrÍÍöˆ‘ðå…¯ö¡ä%¯W "ÿdñšÓ ŠÛ1qZFŽÂøD̤fPÜ!¶ŠÛŠå‹Ëü‰Q:bð0aµ- ¸ Ö#ø3ã|ÄpeÂaÖŒUÂú/`añÐnÛpÿ‹^pac[á-þ ‡{¦ëá× ,¾ŽñÈá )Äò›°üò©>q}¢hä0Ž_ Ë ­ò±ñˆö¥ÕÑyã ãØ>‘/ÌÚ¾ßÆÁÏÆ=“Çz—øÉû¯2›F Ýa_9ô(fÔÝ)jìçð_DåS­ÃŽp;Ådô¹ÃjT&V’÷œ^w"ÌædlÚcPIåõ¬D(éÆ®Yâ9“Àd®ÙF•ð‰œ–þ>Nôs¥ÃŽj£äÙ¯ƒ(Qo¼Ò?£Êã7my[+ÍŠ…CÎt0+Vv¸[øo¹Sy$W¹d4pð¡.ºÓJ`ùöa×9T3Ìç4ã¾í;jn˜Ïr›²wýêš´‡Æë NèÚ°Â1u@'Þ‚[Ò¸¯Ä°dhœ‡¦mRAóp«‹ÛžÙ©¡Í/?‰Ñ$º;§M¢-¸O™*zWlÀ`?pDem(Áï.vßüa‹EåÛ°¦Áú³XáË×QÛ°š±üÖÁ~…ƒ…áåÍ ¤ºZKSÙ¥ðBÉ©¡~Ãú'K¹œ²Kvýg(¤ºKÓÿÆ J"Ö9­€¶}Ÿ…Shì/KáÈ9Rò×Sô¼S>#&‰šVQ…Â|$pš^¤—2•–Ê9åóáð`µ€²Ögqìݾ)%!œŒVÀÁ'Œ9aÈW5¼`£OjY«]õ÷cŠJuUÔ­ƒ CY‡’¶Ÿ-= ‡«îv$ãÇÈÞø£Wkã8‡?Éáâ?I(ÙçŸV·?ûès8¨è‡Ï{úkhÙ¸FÆü" ê åðŠ°p2ÕŸT¶ß/µ4 à@Vu/†L ÈÙ²gýÖ+ôC§S9~™;Ó>d·Œª!‰á >:v©£HtÐþV/¶©ü4àÖtænÏ:&L¯ÜçÈ aÕÓÚ0¢©ûkýèͬÆëAÙ;2=ÆÐhî‰cíÂû¡ž©l2ÜSÐIñ×eWø¦nˆÚr¡ä$LŠ2ü§±Ì¾éU‘ÎpNc¤dq¢V(…ÑOxæV¿Œ 1;®A´agráU‡»Bó6ø¦V„•µ‹_%Õ5::šžœëù?ÔÀ. f7AØ[@þÖJ H"F|5Þ.Úæ›Z/„~w Wûoö‰x?0û‹Nô2ñ°vlZf¨²ixÆ‘~B’X¨až[órèù GWt€–²UJ>”ÖŸ77ÒSÑ4´öX§EQT±I£¶`”ÔÑ–—W3Yc먩¡¤¦í“^ß»>9^YQÙÄ-& g»çú %ë Ü.Àªn·ttv²·V³ŽñIÌÓÖR1 ÚÀ„^¦æš³»#…¢mînl¢'¯å•ñë3úÁ.‡5Jª&«¼ÖHãQ ã zÙü~Þ¦ ªÆ6¾1&Æú-ûÈ7Øí 6ÅFÝÐËÄÆË=¥ÂÞÎ@Å4 å§G’S¿ÿ@b(;²‹¢ªkåmâšè¤¢¦jêÎ,ê¹%IòfÉnÖªㄽw¹õ7WYê*k™Úxi(’µsë$(+?N¬¬gåaµf­’œŒyl=|ðb,4Ü··Õ¢¨šXÙP””-Ê°0;JF7ÎÇÓXÓÄÉ@G]QQÇoãõÒ“€ZQ ï«i`oíê­F^©á¹«¤ ”V×èê[® VW72]娢¬¨ç).Ø&&6s¤ÁÔ@SI×ÎÖ;LKMNÍ©‚Õ9¼*…¢ÓÁØ@H=|y=맀¤ -½Uþœè+ÙDš'¾J¢x&Õ ¶æP”ìÒjaáî Ú¾Ym`ÓEPÙvÍBk©YBKù%ëk©`â[xl¸6ðºí<ÂB6>ÜÐѪ­¨²ëцÓ}‘dË*H"»æ¤­ùJí•AùÇÉ’QóÌ©üØ´Ú)"ù„pãyPÞùØÑJÇ8»³¼S˜Ê¥i†ÓZ…%͉ *E?B”ÇM‘#Û$üô²SqZàád`àÁ…Ž)!ÕBZÅ)¹º·ì$Œßž[ªúrN³gpÿ‘Ä2XÛÑ=JŠŠ>%%gAåe—é!§¹&é0Èߘ£°bùªÜß6]¥ðÑçBÖ ÈiÅÛ{ꎕž¢]&¿¬ý±{P¸cô¥—ÁÆK ƒž­Í­Ð3¦d¸+häµ€WsKMÛ!îÀËlH7¬3³ÞhÓeàa%­æ¶»¼KœœiãÅfÃJ.êö*K¿ó;ªjëë++›­§›®€Ââlyyõu›Pwn‘Èå?òöqR·McžÎöÏõºÊË ¯bÑùDÉ-aÎN涺澡/0›þæ°áï%qp sy…»Ë”•l’ŽÜ²7× ÙŸ½‡Ÿ¸¹1eW§«»½¦yTa7È-J'Ë«®IÜ·¥Î(!\)ÕžÐ"knºZÚò" ÒsÄNs3ÿ `X cÚ¢Ý%rdû´cýp–DýåbTÑ6¿´J¿Ôb+5õÐÚ²“ ô ƒàœã/Øüþ$&•¬GoþkÍt\’s°EEvó@2“ªnì—SâS¬µ×Òé¸åÌ\ŒÝ¨M£H “ ‘%&±gˆÄò_ +ªz1Ãfy° »ReÈ6ñò7f®\i›Þ ƒLHÖÓÕjßê¬Û”±»9qKcÒ¶O=—üB`·ô$W ʪôMßàµ.TEC7d/¨<7ਹÔ0ö[=²Û@Á¡›EM ‹#-çšÛ ëpÚATœ™²“Ÿ!mýé[jƒsª|Óª|£’Õ¿w¬n¨¯ÕÑQ[“ÉÖ ù âÔ%ƒ•+ì ùÔ]›E$2Žœ·2V5‹ù1u{câ^æÞ }=7£­Ø ùDlz£¾ÈÀæ=IÈOWÕZ›pà>‹ØÑ©ÆSäKÖòÏ>vÉBGSÝÜÉÜÞÓÔÎÃÌÎÃÄÆÑÂ+=›Š[Ÿ'q·ÙØ;è˜Xjé¯rJ;Dk¡ìX$ë4·4[·á"vGŒÄRyŠ$‘ºŸgia¦¿&Ê+¥" £ÌÊD'Q("±v˜Ä¢ö^'KSC¯lœ&!»Y˜VR¡fèœY+ŒOµÑuâÒñnÇI4q/lbáÓàµC ž"uc›ËE$’Õ}8×°8CÜ•&C¶ÆHÜ.MñÍoÂ>IJΫFò²j¦kÌð~€2¶ZcVJk|êíç©®cíÁôËÚ쑨ºl8{×T^Æ:í0_“mÇ@ô°y¢rœSsš°m”¨8s+&œ „'$¨kÛúenòÇH\êT)¬ª?ç‰nTüŸu]m(ß[fÕÑvn‘H;tÚÌ@GÓÌId’™½‡‘ÅjË`.½Í‡?ýŒM‡}Ów¶à#„ŠŽ¶ë)ÃÐâü8ž4{MŸ­­ì~¸ZSNß·˜ÙôÄVKÆ”z±²£ŸÅ‡“µ^Nk?§¹‰?jŠÛà3§—V}7¥˜«B¦¸æ¶•òù¿KbÕISõEg&«Û§Â9`“€ÝøÄÓÅR#äø˜$Ò;€¯ƒ¹®kR.O´H }b‘š‘w6æmtœ8Ex[Æ$Þ1:+^Õ<8« ®v‚’¦.}™ï¬Ê:q)j£IüID¢ŸˆÄÒSOl•¾3ˆᨀ÷»¥>c vÔ]æ²ñyY;Ö!9Åe*ªÚ¡˜OìuP_n»ƒÏG`—–žÆ–FqC©øꨘDk6½æ‚‰¦¼íŒÌ±µ¾¿h*~‡“}¢ºsv¶ÚÊOÝ0^¹Â®°‰6䟷ÒS]Ã9]ÜŒ™? n[?»¹Ÿ…扃fs;@JV*™¬¸é!‹×Ç8ñ2½¤PIÕ&vÏ ¢úÄЬ_Ÿ2NôBSu÷}Ö*j˜…lºÝzp­¬AµEÈl`žxÍø!~ÿÓ’ö¾Ø–7­‹Ù4Àl–vÞµRV\ðS1¿EKQ÷òB ÿ©„'ÙJ’DIŸhI\Ÿ– ëA¥Ö÷1zswטè.S øµ´s ±(W]Ï?³ú1³’H£èǶ‚¬ÜH%=·¸=˜¼Fý=¿@[w|øC¡Oü#›@þöCšÊžt­îÖÀÆžÈHO9•5)Gû )‰£|¢˜D%1‰ÜN°>ÄTÑ43¿ëF}OBéäOòwü¨²BÖïGPÜ,`Ô=ôö[¥¨b¼«¿¤ $DX(ÅäÔöÃè”q´V}éò€­wrŠc¤_!‘v육 eíÆG¥ÍfCOXB˜¢ì²µ¥/ªêëôt• |9´Fl™±“%¿R3xã-êΊžØ<ñÄ]/ïÕšŽ%Ô†^h«þfHæŽÔÃ}âý äñ›âÆkîþ¾ºÆ¶Ö^Ñ«<tõÍÖ&ÿDm Ö~¢ÈG$±²d—)Z¹‡¯òZoëljµZ×Æ?€ÝÉéÄb*ÚO­v«` î’fï¨gºÖ¿âzÙi—‘¥c`iã—ä’nïî¡»*$vï³Òö;öf:j>^É¥Ž>kVêwC[ ôÔÊÏÃ! ŸùE;Š–.5J9Ö—»õ ¾¡™µ_ªsx–sDŽ“—,e•WÁáô-´”•ÍœCü7ÜKaåH«ç7ôrx7=<=M×9†f:x¯3´ö‹Ü¯ÆéªÚRébدRqÊ91ê`‹ÿ":+ÏÀÔÖÜ1ÈÆ#ÔbõmsÿâNÑMÅ‘­ÒK—{]Æ: ‰Û£¿[ªûã@~yÌ×Kó0±QM?rÒnµ•áÚðµ°¼ÖX8o¼Î­¿î¸ÖLÕÄÇ)2Ï1$Ù7•£§¡ ïV”uôóø{;k}ûuöqæF!¨M “øõr/<:Å×árùìö^¿`/%]'Lj<§ÐTïd®™¡¢ŠErÊÆmêªrúö‰.ÙΡ‰†ºº&~œ>(ØÂY.·: ’Ø òvU[¯²6s‚ŸÂjgWm Ÿð°SRh?Qâ\³þIúv~lyuLyMòžËôÆÁ qbùDíèŸң1˜Õ1eGã·täU?c5‹oà[íÇn&o<[Õ˜}ø 6€ùp, äþx:¾âXlű¸M9¿â—4ƒ‚Ÿ»`ÉÄm{;ã¶]cµY S¶òr«{DGS˜Ç/ÇV6Ó¬ÆÞœ=í15ñùÙGžÕÜN¨ªIÜyŽÑø2c{CLé¯i¿¼¤CÛ6wcû‰ÐþÚû©[â*ÇmhÌ:üX´,SøSSâÎKØDŒÛÕ›±“—õËC‰s2B±ä÷åÿtZ ­Í>ò;D$:ƒqâf\U]ö‘çâ’5gcªš ë„Œê³ÑUEC‡mš@Q5ì‡ÚØ Ø Ð6Þ^ú¯W*ÆTÔ¥ì½ÎldîäÅnl)¬…“n@¯¾‘´á8¼c¶nê VøHWtÕ)F³˜”üüømY­€qüNòÆc1µI;Ïñ„¹{Ûb+O五¸©!ûð£ŒpßÜQP;€}5Wc7¶ÓyâO‡ ØP[Q·±v2» ètäÑå14ôÜéœXóÑ18ÛúÝ#ßM£þI`:ãýš'6›„p»Ásec³g‰ ³Î?0Oòšðw:JøÊáº?êØ×±vp?ú»â?t8» ­Ø oE!¡oE!‰HˆDD""‘ˆHDB$"‘‰ˆDD""‘ˆ„HD$"‘‰ˆD$D""‘ˆ„HD$"!‰ˆD$Dâ‘Øx ”µ€ª6B«¼4]üëدT!!ýí8îõý·¢ þØxl=Ohm:šï‚–»` áME"”¶œ{.‚;„'±O"êÁT6˜UBhMç€èÞfÝT$¢éÛÍ õ.Ñ£SHâºZì·³I,b‹ÂêA`þ{Í,$¤?¡Oª@ó‰C"{”„X+Ø¢¶Å™C/þyá$‰HÓÔa ÇÙÔ!$Mbý³÷e# uË'‘%áBJ_cŽI"K(x\ÜÈR‘©ã £$CV¬±·þǘÀ[pñÛ±ÆûóB$þm>Q<¨&g×~èSù&uO‚‘ÿrúßL8úž/çCoÎ{Á¦ÓqþËqø[*a9˜žZ¿$ üŸÒ%¡¿L§öŠùß="Xï3¶-Š>9Î"ñïNáß’{_i•T å=Õ E"˜D½óñj'2YVNÇq©±ƒ‚²‚Š¬Æ{éý8ŒCÑõ+1¶dCX#ãð%%4j̨S¢Q¿?þØLGEA¢¤® ª¡DV¤¨š¿Õ9vð<¦=’1-k¬ð{ÌÂ\0ßÝr¹Ý–Iì± #'‰â¡‚ùš…Ž.Š:βêZ‹Å$É'âÃ~fl¹¢²ÅœÜ>R U¡xÿk;E€éƒnQªèÑ´Â[Ó ïNfôãȤŠO£>Œl“éw§Ñ^bµ1{¦QXýS¨w¦Ð_ˆêŸL¿?­ðöTÚSñƒH²Nê})q%B‰x¾xü‰™¾²šÓ¢¸ßH€´æ?~×9P•b´0í‰#¢ßŸBNbâ2{§Ðîa¶‰ëï>Ä+0‰%À*dÂœSè/IÌçÓ o†H1†ÂòIÌž©…·§Þ“ÂjÀH\àf¾Ünë$V/–-döÇðˆÄ Dâð4G8#v«œnÀœÄËÕ—ä”Ä·ÂRä ¢§0ð6¥ îLÏ»3‰‰½ž‘øóWfö+ —ëÛ}¿:ï­ÜÇ„¹© ¦UØô «çéGö«dìê1Š³vË. äHëÚÒk›µ¾ê;#Û•z6+ ½ß;1‰ƒÝbFÒÁ¯ÌÖÂ:WèÙíT2ƒÖ?jZ==¾Š"Gy/å)v Œ5¼K™>µ2§èçL*é[àæù­Ó^)žOíüÚ|õá1ãÙ½³bv}cê°ÜØm¹ÁÚ/ÝvLÆh}>ß7|©]ñn_Ù†.5rüfMét†Ö,•áÃ5AÒzö+ôW}ë@}3ï©Ø'Zç}à³ÔØQFÓôsÏÝSŠúÿÕ‘ê„ö‰Lá$ÆÃÏ-Ö~ÙEÊn”VQ\BDŸˆ-€Lͨ“V••¶LœÓ<#çæ$haÙ`ü†ªjßxœ™wyFnק¦Zd“ØŠy>᪺,XìÉg–šd‹£˜KÍÝ¡¨¢´Ò,ëíÌóS‹úHY;Õ?;13ÿÂ[¡É*+—$Ü"ÀÞPûÚçVgVóWº”•;FLK‹Á;n¾ªÚ©Ã³B§0ß7“BÑx§@°ÐÑjÅê-R&øVaËR=­ƒÏA楕QÕùl]ÍÌÜK3“|¯«õ½w+©äÅBo?UŠéûMÓ¨÷f$ì’Q%q•Äéy×Ñc¹MþìŒî73N|nj°|u‰’h¢ªdû~Ø‘™9ççÄl“S5š—|‘8ÑH=½…¤0Ë×w…UúT˜”y‚ $Š}÷À´tÞ§¶.Ê+?W!«Èê9|é²Mªsˆo¦*éøN£‹]ÕäôMJ+ÔæåÌõ‹P‘ ñSKíAw‘”?ˆ½ˆ‘UØSL’&‹›üòÍÄ–i´ç³½#)FqØŠ(ä½H¥U*ÉXÌ’4‰Û·ÄΉlS:8Q‘8#¤ˆ¬¤¼8µo¡³- %HÔù8ä‰=0Ï7AÞš3¹_n­s²”ÈžÓJ ½}å ¦2ú°zŠº¾3Òýƣĸò½†Ú’¸s¢'Ò”¼+³Ò/ÁfÎw3•±¤NÁgˆ“è7¿66z/êÌ¿zg¢úDlÐJeìV$,J¸‡ຕ*Šïf÷FÆ$ ‡‡:¾Y0#ñÈgöþ²Ê+”5"§–€E®áò¦ñ“™ƒkA³¬ì·§>Ÿë96‰9;””Œæ§>À W¼ø\Gw¥]Ñ$îà°ÝœÞ÷Ö’ÕŒ¿· øÎÂÿ;‹€ïÍ”õCwÜ®`áZ7%³¢+¥8‰o­+$STf :ÙŒEbïb·0²š9^³ÿw–þË l•ôÞ¡Þ>²f )ÆÞg¾3ÖÿÆí„'«¤??åêˆõlžh±Ün3H³Á$Ú­¯MMß_ùÄ é9ÏÿϘ¢&oò¥cÚv±_Yy+(‘WX§ÌKøx$ &ÓN.z.iÅØ¢ÍÔªŠ¢â{ÑWç{FË›Äb$ŠvE åd¾ý(íN"GL"k‰&óÓb…Ëû?ÕÓ‘]EGžLÜ – —¬õW0 ˜yxAäϘÖ™{|M8¼ Ê³‚ÓTlß‚—p„Ë«œ—K\‚••]§sú­µ“ÈEb¨œyüÂȃ 0ýQdm×Å‘µsÖïù^Gí÷ý°’W|¢é{ˆÄ‰~ÆFDbvÓR]Ã…yD#qØMK©ùÂÊY^][^]WÖÀýƒpÞðü‘zå#{9 ]9íUŸÖ 6êÅ<¿4Y ]Y}ç÷Ãj>tr•µ=Œíbäî“Ó^óNú£¡IŸTNÛ«U4eL×ÏÉz&&Žzù#{/9u-M³/=öH±$¶æ%`”ÊíüÌÖM^UEY^ZAÇåýpþð>;ãÁ{.á2Ú&+üÄüú¥óGagHøɤ¼SŸÙ:ËkèÉiÛ|ê[ f=_à±Â¶lÄó_Y­þ» Å™ÏæùeÊjè)hšîó“¾q3ÏÛù;§Ýƒ$ÞùÜfí☳ˆÄ O¢h†UAÈs§Ã 5+qU€Ñ‡ÊÊóK$Ω–H.Ã/gâë'•k/¢¶‹j.’;ûâ:+ñ•-¹³ÿJ¿•œ[¡$ûÕºNl_Ò|u“ÈøâW*¯:C‹¿(—¸¶\K4Dd ~P{Q&qö¦ŒØOA$NH_ù 1¿‹ÁúÃïbü‡Cb#³Iž|û§Ý^©\âøßUy/] ßoÀǼþ¶-Æ>'yÚmôüB8F‹‰Ô'Gô­(âŽ|ûc`. †ÕÔ¥íJħÚЩlD""ñŸÿ’ ;)­•¡ó؈DDâø}e˜M˜¯0#‰ÿZŸˆ„HD$"!!‰HˆDD""‘ˆ„HD$"!!‰HˆDD"Ò'Ñ»r©€ØÊ~5ÀýáíD"žÞ)<“8 Ÿ€3ÀYbëÌCp»Ü~Nt;‘¨ Á£—Ø9A󚮃 í`K'¡µ©´ÜÍ7ˆn'õC7¸Oø_mƒ$¿¨ €É'´è î2öóÇ ÑME"š*ÚЯ{£_÷FB¿îHDBšÀ$²øBh<·m¤ZËŠDÌžæWLmlÅkÕ,W‚]%d·€âÖ׿v¬Ú$mC ÿ+!wO"s+rʲË0e•†•Ÿ 5âc•`$üÜ”Y(²SExI}!p›_]  íÿi³†Î9ÛwûQùì6¬+†ëµØÄVœVìÁ…HD$þ7$ŠÜAYK·ÎJi-swÏ0·P—´½…ÄŠN±¡Î&sóVªX¸„`vz„Y;{ëhihÛD¦à4cøˆ\ü†¼ž½Ån9…k "òO€¤‚]×­œS"¦°2ØíDÁ€D=ƒÎTüA G¯ÄgR¸mœAx’ˆÄ¿è›@i]ƒ¦’¦ë§þs—€Å0:MæjXDä!²Æ™œc'tåå¬ã`aq¦æ”žÝ ü4à :JO8”_Ö rinÓ˜Ü!·TtÁ[‹;@ùIÀiïÂx@Äʺ°ò¥'!›b§ ÿw‚rXy(nL¾°¬»ÏÛÝÛƒq²ò,¼P€0D$þEák%G(+kû—ÞaóûŠê_bÏöfIw@4Ãsj^º0aéo À|…¶WqQ3`ó^&28zZdEEU=?Vkk#§EÌ©ÐQST¤hXFþŸå¬b›ßÖG|£”YÒ-ð X%k»),ÎWA}uÔž—¬úáɉšêªd2EË*4jç5ØKœPx ÝÉÅ¢ OV5tÌ8J­à$//§¤¬¬®g›ÔøÚA2"ñáß»o‹"EÍvgo˜gœWö¾œšθªß'±@Ó:†ÖŒ9/¨Š3€uø„e¥eÌœN\*+kXÑ‘{èzg£† Ù}¥ä4`ý°IYFÆ)£:çÐõDöc}u­Õ‰ù &ÉAÖ€^Ò% Š WR·rI;þãUfÃÓ€yuïè¿å¼™)§d±§¿üD§…¾ªi`EÚ¾‹é›v«¯øÖ"îëÄyK“5©?}Àà# ‰ÿ‰m h#WANÞØ%5j?š^¦«¡lâÏί'Ü.ç)Å4%E-+÷ÐÕ^a«½ÂWyêëª(é­K­·>]k¢¨ßRu[S-;üuVg³.€è€µŠ†®õØÒJI7ˆöÑQ±JÀI´—$vCC(*ÞyØRjÑ<=奫K^TuaõT¼k®¡¶:îç fEÝ0ö0(Æl…9û:Ó¼ÎmºfgkáRÀƒŽïj3ÒD_±Áþ6ôÒjž2›¢%ˆ‚­”)Æëw\a’DLj<·¨B×ðd-U%똽E-Nà4^¶ÐÓ¢hèiêjèÀ¿ÊdY#¼ÓÀÇÁVÍ:4¯pš„ìNï¤d[ IbLÅ„Æ:…M-s¶ÒQWUÖ2ÔÔ1ÐÐ1ÔÔ3P^f˜œ£¢cŸÖ€U2·s/c$æ7À Ñv"ñ¿ÜOd‡9¯_´ºÈ䃢êSªªÏržX aµ¾°”t€ÒN•¥h°>0ù×-ÕåÍ NsžQkSkžÐj{èõ/K»€ÏšÕª–Ay,BÎI‘¶JÙ,n„OŒñ§˜0D$æïüUS~¥Ëö^vý¼ž§ôÚVstb²²¶uJ½˜DOÀä ¸¼a%—j‘‰Ò'N+ÈݸomhAZ5(Ã'_™¥ó¨Ý7 è%Vlpo~윅®‚nÀNF ,û<×꨸nâvc¡iyÈØZ›¸ç~Éí"£iŸr ˬì~éb¨¨¾*yL±ýzÚXCÆ$¡¥üÖ!emÏãÊŽe V“Õƒ¶=“ÓŠÓét̃ìæ«mÌ\hmøR-ŠN‰Dv3`üÒdLþLÍÂß-éº.RKUÎ4d'GÄyb2;_Ý<’(Úá´üò™*žìÎâP¸}—’´¬©ofu—gHˆ Y7`ëC˜_\×j ÷ºkãr*í<ÌÝ­4-c1íVêÑ0£ýÈÆE‰øq£”ÜXé¥Ê«×³C ·:º;(’íã~eíO}ÜLµì]’Ê<‚å¾üÖ…{¹´ã¡³ƒ•ºmD@vUÚ¯˜KeóˆÄ¿2ëïø¬ Ò36Ó5w÷av`‹:¬ŠnñÉ4n9³ƒ±²ÍÃvöËÏ€ªó؇èL©¨R,œØrqå¬n'¨:X°†“ø ìáƒëi—‡· ;±¿%'Ž+gòðüVPqËá6¡è‘ø_|Ctþù•CbâØ•P>qðÐÚ‹<`6|ŠûÕÓnìá Áˆ·Fžˆ„H(‘3êÔÜX§Ý†»NˆN»!Ñ·¢‰ˆD$D"" ‘ˆHDB$"‘‰ˆD$D"" ‘ˆHDB$"‘‰ˆD$DâßHâñË€ÖFý"šŠ ‰—Å$ÜT$B‰É•äÿÆÏ¿Ê[À†6B«²û%ìÇtÚþœv÷ŸÄ¸úüö\xDhA ïö€»Ï‰n'ué1xÒKô_më€àZ@¢ÉLB‹Du  H1‰n*¡Ìg•ã7…ƒÑ¯{#¡_÷&‰ë‰HˆDD"" ‘ø*‰,áï4G8ÑHŽa³dθ· ‘øÇ>Q =ž‘Ú>;¾qvïÍŒkRLž/$‰,áä‚+³cêæÄŽToêïyyÆÓYÉ­S©/ÐE$žD@â>]â¼ÂÈåsǬÿ[³Bwõ§A5R,Üьķ"2դ徳ýzU„X¶á_Ù%½•?v=Rù­2êš‹¯¼Î'ˆ\'"q<£S. ¥o'+©q‰ÄPo„‘ußÌ}N¸è”%œY(g>úRì²G ÚÏL*zA‚>‹]2©àä2}ËùiwIì<_8Êb-%1aæóIŒ>üÂÁ€…Æ3"ñŸ'`#6±XYYwIÂs‰oÄf*©{ÍÊ~BlÁHaΈݺBƒ¢L¦()i~í¼M #±s©‰ã¢ Æ2M]E%E#;ðòÏç„°dÔ”4ŒäUÕ¤-3ß ¿ ±CDâ¸F§·¿Ð3øÆ‘33ïæy?1·ú~mÙT&£SH¢¼®ÿœ´®™ÙçufFþcì’W#KVú¿ðs¤0)ý€¼’Ê'!§H´3ß((i­ŸY›)˜ï ª7‰ f$§¨~s «¶ðÚç&z Ö?À ųf4ž‰ã²bSÞˆ)–S¦,³þÎÈ‚¬b» õ6¶‰·bóf"GYaè¸ÜÈ —ór«o’*ÁÛ~‰½`ì|D©Døvôï¤]™TصT[ãƒÄ"w?-£ªä9 æúÆ+šæL=ˆŠ…ós( f³ƒˆÄñ'¦í—Ö1ý8¸yZþÝiy7ç$ÊEÎÌ{JÌèT^?hVöÍ©÷u[-î_ì.o–0™5è׸zRøõd~èÑPÉì´[$Ö­ÿ33—3~?hËÎAde³EI·H…ÒÚ “®ŠHœÏP—_I”Ê;ýµ¡ÉR»ÜÅaûÞõΗÖ2ý$ò‰+D$"Çsņ¦äu/ (ûÈ£è#ú»!G¦S{Æy›ûU1c„Ó2ê>vÊþÄ5o¤ ç&_®PªðÊ‚À’O]ò?ö,Ÿ›r»Š~s‰Å›¹D•LÎnøÄc;Á²Sr»ûs?òd~äY2/®k[€íb°ÇuÅé_~\´ÄñêF9á|¢`ì }‘˜‚ÑÆÈTX| b‘8®>qèØɨÃÒ„ó‰¿cÒgŠ·…t,œÐéD"úVúV"‘ˆ„HD$"‘‰ˆD$D""‘ˆ„HD$"!‰ˆD$D"" ‘ˆHD$"!‰HˆDD"" ‘8ŠÄÄFð~)ø´’Ðú  ¤ó@4|ZAtS‘ˆ&åí íÄþ­(þ«mg€³ -háíp§‡èv"Pa¿Ú&$8‰BÀ»ÊZAU¡Uÿ’)ÿÑíD" vž÷žÜ%b$Ö^tÂÿº7ƒꯈÝ[ôãéHH¯©ªö‰ñëÞ"áð&²F‘ˆ„ôššÈ$ ¡ñXàëf\|˜#¿‹¿…eâmGÅ&5ÿŽü›>Íß¿W“DçüoG”p¸Q¯qÇ?[‘H0Eb£‹ÓõÏéµ/˜ü¡·„ìÀj|I«}Îüg?Ü1}"«áµæ íøSLµÏÄ/0õ0ûhµ/0ƒÿ¦Ç“×K«y*q LÔãÏÿ fòôºgŒFëuÊóóÄsZÝKøI±Oœp$Š0ä Ø-})œMå•*¦¡­€#Êl¹[÷j)PŒüsêúÇ“Dhg •g,ÿækYéår+—ÉJKËJ/““^.+ý5YÍ#²˜½‚ìžQýüï!±äl-‘ùôcìFCú~¥¼æú…Ü–¨èÕWLŒu+~c½†°’ÓmU­ÓòŽ Pt:Q}b;HH Ô0u¶05×´‰)lÅ>YN'ÈÊVQ5µvõ׶έïgŸˆ?ê90új%ÏlU¾²Êë*;‰Q3™¼¾¢†>W@WÛÅlèc4ö‹Bnfc£¡OäÖñ2øGÆÀ2y¢q+dKºHâö U ‡”,T MáX°ÇûEW‰BX³q`ÈH&|·q€%1BïÖØÏÀ̓•°†ƒ!f˜ÈHQaQ>_ó™zÍ s+³uU— ,σ Á+äÁÊûYm 5ÛIÓ>'¯‘8QIä´ƒøZZÍ“@?_ ëh‰Ü“ 9%?jßÝä"¦¦i`nÝ8“8<;kÅmmT¾´Ê=UÚ!nEîÎ#ŽÑÛ @Ñžík"¹aô¾ILÇ 4úñ´­þ©Åîë³]·fëƒãìœí¿º†¥;…e8d„Vœ,âaˆ ûSŒÄrUuûäêÎèé§ k˧˜M48øáUõ·ý£ÓC6^€ÅŠŽÝ I-tLrð‹÷)§ñi4µÊ)8Õ9$É1œ|àÆ|¤Ô^ L¦;†f8%z¤ÿ]#À0ç Çï§8¥8‡çøÓŽY¬¶ ®¼È‚º«ëÒ˜Ž¡éNëÝ’wdW÷qš…ÐfmØsC3Ý3ÍrÑB$NÜüÑÊj”u ý<=D$rðI"³a€Û.ŒËÍ'‰’‘h™s²´Ìø‚Tv‚vpv=`nŒú~™ÊÚäÒö^H,Ì&+kšûÄo=¶í¸¹‘±cN5³0Öhè¹dìOÚ~*žS¡£fTyvÄz”ˆDM§¬&PyTœ«ü„E@;tÒÒTמq©²ST˜¦¬ï“|ð³ñePD€žszìÆ–„ÊÃÆšÎ9Ç!A±ÙéúöA%-ÉÛ;ƒâ"´­CÓ«…e\VÛ¬‰ŒÚt2yk½µ©i ;¿@ÿ¬aè^Õ‘ºë”¯ŸÍJEËЗK:z<]×ê­ ^¿¡3y ÏÑqµ‘/#ŸJªÒVÑX¿=yWw\UCGÃÈ­‘8ç‰xÀVzJ0DâÐ !§e`bÈ¥QôÃ1·$Ê)ÛÄì¾ )à6žÑ%S³a`ÛLýA^v!§A”—ººc.•|N[_d¼»i@9½A0’Ä Åo¿£(«*«ˆ¥D–ÖuÛÎîÄ®Jå“å­Öï¿di`äSÜËÓ]6ÕÓ Ù|ïºäÒ­.?3Øê.]•ÓUv»ŠY{ÓÂÔÄ·ü­²„¢¬°µ¯´ÀÉ8cï6eÛ˜]·¹/íµ¿]•ÑZ܆(ê/-rj![nÒwîSS¡ølxVz Îé?þ¤ªb{ðqb°­¢¡gÚQ¬Š»9EÇ‘8±÷_!Q¬‰H¢¢¦kò0ä6]1"kx1˜X@Øê·F/p·«w•ª‚º¥›KÝm}¾ëúBÛµöškÓ ëú$`è••Lוò77%lµ±1i×M|¢ÊN¬óµ%ë™o(jÁ¢Mê¡#jfq?=acÔ ¹í ì`×6i.ÿÎÄ/Û=ªÀu}¾KD¦®šÊªÜº˜´4 YÉ&‚å•ï²¾Ð5Ý/«"å§{\~§ÖrYŸÍ׋qéÕWÍÌŒ1‹èJòJvqœ¡ò¾é%Çn¸X˜hÙG员j§é€æ‰’Ä!/ "Ñw‰üQ$m) '(‰ú•Ì.¼J^Ç›ÅìÅí:¯ÒÓ€Û Æ˜'ªÛ'íçˆbx±Ä¯™åeŠ V¡›Í ½JÎÀò´£]úêê;ïˆz5wÏVÃËN ý½!‰1Ô6|³€ Hn› .¯#ñÄÀÐ “à°ÍÿŽDz3 î)#Ëè„m»ŠoLýD¿èØ!‡‡Už{è|@O*2VH=z'÷Ðm:4¾áIÁÑ'è´ÛÞOlë@uÓï´ïèT7Ïs%žpD±±ODˆBG~­à£?÷V5è¨Çæ›G\2faI§<öF•ç Ç.N€£oE¡oE!!‰HˆDD"" ‘ˆHDBB$"‘‰ˆD$$D"" ‘ˆHDBB$"‘‰ˆD$$Dâ?Kâ?ù?YEúÿCÄ»=€Ä£Af-È«'´²ë@õEÌT‚Û‰D@qšÀí‰à¡ã¾ü\yDhA <ŸOS‘ˆ6r®=Ïûˆþ[Qý°çˆkI|B+ž~¾ ~¼Lt;‘¨ü6pé ÑIì¿j@Ê$*±•‚j€Ç1@*$¼©H„R!XT x·‰ö @0úuo$ôëÞ qÝÈ‚¾æHHò­˜D±=ÂÑ& åOÌa3F'‹ÚøZ’ø°FôÃà_qUÂáÏ‘H\%Æ6ר•3(ÉO|\|¢èÖ\ “8#!‡Ï]âyÅþ c^8Üíc6êu `uÉÐg÷¯Âp“(ñÌä ÌLiž“Ô5Iü9â™\0=½íè깉íS‹p Æ•ÄÉçF}'æ˜HsZFX5^0B* ©‚¿4æ3R›ß‰©7*¶fvr·ÔŸ?„$ƃ·fäõ »H\“¨7çÆwHýE«‰ãáá‡ÅsÓåTUWš%OzÀrÀ|ÏEŠšœ†>EIu…EäÛÙÏÅNs\¢S–ðÍŽ‚¢’œ¦‰,”†™¢$¯a¿( Â(|%œŽð#r$ãí±2Y¯Ä£|d&LJ¬üÞ¶‚T †£Ê?ºP8™r{?´uUTÑ–Ó4•Õ4•SÓ¢(©­°JŸFÙ"áÈI„Df!o©ùûë/ Æ3âüi){åt×M/êËrá™#šüú2"ñï QÔá%`ŽËy߯ l䌢§pÄL*©@UZmIÂ%ìÏèþ^Uá÷Ý“X`}â¬ÈhátV6ìË©è·/LM(ÊŽ3†&¹ aî!┃ÿeJàŽ[–œ¡ø¯è…dm,Á`d.™‰×Væ¸+hg’ªðª˜xU\É2ƒf°%jj·ïc‹Õ+VeO…ÍÁ5%óøreÙ¥ÞG1W+i•dUÃFBO¬ÐÖý0â·ã·Æó§%ï"kx½Aï?ê*–p„UbkÁÈŒ˜"ÿ§>v~1xÛ¿r:¼kç=Lb1˜¾¾ôcÿŸ1ôà(oû¬’± OfŒ/‰…ráÓ©/Åc©LËPVÒx7þ4xJïSûÿÇÞY€Gut? (V(VA ´8„Øf5»qww’ww—ÍnVcx¡¸—R\âÁ)Ð÷„dw¾¹÷î&›Ú¾ÿï-Yú^žóä¹;;wîùÍ9gf.½Ø2p‰ÕŠᇇrà@‹­Zâu`d2_Å*ö³¼ ¼'"¹ ­[,p)Wø1%pÚɬP³-“¶ŽsÔR‹à¯Ã(—^œæ¾ÈʾgíHv6 •óOÎr‰‚÷.²Mš’v >tTœPMG—D5_èQ1ºˆ‚®O²~œã¸ÉãõYö¯ œ›ß:ø|vî ŸˆE^;•04dHTu(Žõ©Ô¿"ØæcjynÃYb¹|jæk…êW£¿›o´Ø*xsþ„ÜÛHáD“éÑÇ>÷ËXbá½È1÷Óü{°R²$)»0Í'}‘MÈ"Û¨iÑG‡pPƒ[õûtŸä‰É‡¿òÉZh¼À=ªìî„þ<»ÐŶI“²~é?ià$þÓ$b‘Nè+§€^QïŽ4‰Ý¾ša¥½Ðw›b?§kHŒEI#_Aã ©dh¸ß(p¯/4Ð_âÆ›”zxR¬PƒL˜Þõÿ,"‡¬ã1Ï1ûóÄCʬ®OCS(dËéÑ»?Kýq†«•æ7Š‹xŠ‰:zó=¸Ÿæ]ü,4™¦IP±Ë›’Ò:&kï2ªæBïmðYJÅ?©“) }W~–zøóÐ2M*eZÊmæõ¹VVDèqE?á‚áë‰Z´¹ÁßOH;ôE@¦ÕhJÎ þõet¢aÌ×53®)òdb·>$J\” þ ]„ÄñÑ%dm‡N…SöŽ¬x=."‡J4ú:|Û„ô#_zGЈ¦Ss^)°›–ëkê{ÍZþݤä}³l­©ÚþŸT‚a9‰]ŠÌëóLÍ—:äMJ9:)ªn™žÉ·+«Ç¾;ÇNOÓ0ìˤ†ÑÙ˜tݾ Þ6&ÿì ÷@’~¤2Gôñ-ø|¬Þ©Ô÷€µH좩>ÁdŠë¸ÒŽAÛÅz§æ™C ·(¬…ÞéíÙV&4íPhЪÊCézä«Iv†${$qBT!EÓôÓ*tVáw+^YòRaêÜ–4jh-ü:S¯3RæãK:àøW¨¹¬®®6/d?2A­“l Ô áC§8‘ìkGCGt©fYïá좥_„$V‹f˜“4½~RXæY¾psWqZ¥P}GÅX_Ý,O©vÀªJ¢Š SqZ©5`HáQmÒ¢à# BÑøØ Ñb\ÅkDùÊ›ój~ˆæˆ#zw±.c™CçÌR=ÊbßíˆæH¶CZêZ3R~’·!±ª{T<_Ë(l4Ui5€N‘®ÌëV`ßûÆJonØq¤4a甀’IŠê# O]K`˜}ZÖ{§z?±?‰²»_xúikÙgI´2xÞ騤*²ê ‰ˆ ™¤A'»}Z °ûO’ê5¨ ‰D!‘)D5-;.c"³hôt¥©)¯º5ÓÞ‰BРÉPÈDY©^ÅŒÙo$VTÝeê„™1ÍÈ­ã 5ì‹”j:çêÒIFÞs]Ræ9'Á¿‹, &Q#yâÎÎZúÈ$ ¸»ˆFÔ2 ýÖ%Í“¼ÔØBÝ*s瞊!MÅå2KðúŽmH¢­ U‹ÐS) QSÃ*8âU¾SBÑIÆ} s->³T›<'ã¥$¼] fXX,â†VžS1П{Y²—QóÇ"Ò’…mJù; ‰ÊU¢ !$ªÉ'Lí¤…–îd’ágåo8w¿µ±šwõ:§¦.³¯PD—®ÓÔ1ý´¤ _;ýp+6ï&Qò•båÝNîšÆQ£?$†b+‰ ç¯"6O‰Ù6%fûÄä&EdYC¡rj™HŸöãˆÒ?”xo'Ûm¸ˆMŒÈ¢éä*Ö %p~c¢C6I›}cXå³a9ÕI‹g÷HòÉê%ñ똖¾$vÌcÐ4-cfrf°fú³fò¾ŠÞ7”ßÕK¢ðî*AÝ!gz Ë3#ˆ÷Eì!EÎ-„D·£RA?5Mƒ¿ŒÙƒVjçøÌ+ˆuCÜBHb1E/m(%±è´Š6yvV/‰Ó,¬QØDƒéqפ$>ZHZ²8²µ‡ÄÏBÒ‰:³ý9R•¸Ó—×~ÂêV¨‚$ZO‹ï!1­/‰&Ÿ–tdñ㎥[Àõà+ç@M³¥jlq>wóTµ+Á’ÙOÿ0›û²vjš4 ì$ΘdÑ©kŠw´–e’ÓkÎ5¤íøHÌ…˜ƒ‘¨TvZMkÙœtû¯ O«%i.•Öõ7H,R>·¡Ö!>dê ;• &Õ3œ¤Þi÷×Æjš^'%Þ/ÂÝ+EØhÜ뉮ï!ÑÆy™céÐZ™JI6ú¨P~}!uYÐe¤bûèªÚ°¡wª¢G›z¹q} êš_']“z§¢Q1,¢QäH®T%A·æs²ÿ‰¸Mü+6¯Gæ]Q|i–­ÁxŸüÛŸü ;kxB…l55ùÌ'ùWGå]†2²ø¾"W<Ø+6=k§2»`B0&†Ä‰Žn$zиÒ'Š\ðIBUƒ:#þÌð²?>É:°D_v4ôoªjÿ‰MTu(>pëõNɉÈÑ‹·“âhD‹É™7‡–ߟšCÕÒþ*óµBUÓb#]¢nà¤Ì«C+îMñòÖ&;®Ãr¶u‚GTu )=»TG{¡÷Ú‘Åw•óÏÎvðTuÙ¨(ÀH´éC¢³¯wŠ“øaãDN“–úBºÆRmD–Ð4–Ò(fãKL3PÕUS¡iJD[} Á2e$«k½Ó1q…$ý°•ï8ñÅ}ô•«/@ 2¬fÄ´+ý¤©µPÓ¼D“J µ†Ë'fÝA4,;¬ÎОupŽµUs)EÇsRÖ=äpTÖw4Š²‹Á-hœkaE!i‘IäÅ®œÌ7Hì_ç™Ã³#qª_¬ºu¡„Ää:"…6¡÷N?¸wºª¯¬Ää€ôúAöNÏ­þ‹·hJ­Ty!šˆ­£VËEöfV¢Ùê°è½l™T’[fD¼Drc–Y„ˆPzûJÔ“ÄvÛ±2WJ½wÙðxØ;_cyç ,O‰óú}5ðl¹¸WyÞ{N»õ¢ìƒÄýà 8(ΓY*ï=äöÑxûw¼…¿Ÿˆ ~''œDœD\pqqqÁIÄIÄ'''œDœD\pqqqÁIÄIÄ'''œDüÿÇ'QþuŠÀòÃ@¡ý½ y–2°â(ð?*ä^U\äL&~ ¿‹Ñ-§€nƒïȵ@ /?—ƒýwä]U\äMŽÝ^#?P(Ïÿ zgÛ.—åZ¶_~ç—w=q‘CÙ<‰ï¹bÞ¹[¥mþ/—Œ Nb›1ÑñÖÜY¶ïRѾ[)qÈØkzó··î¾Zyâ-¿µ³”ÄÀ=~'o[{ÁŽÓù;NìrÝ^°ëëø»~®jìÆ&–ÿ"‰ð¹ÂöTk\þ§½S:îÉGñ…%:d5ªytE; ¶RÐò$,.ÖÀÄÊÐÜVÏÈÄÔ;/kïÓ¿mžþ›$"O< Øë„ ]S}SkS â²…Dš±©¾±©±}Zêê «Ôâ£oÐê©ÈXüæv¿OiS€^)m€³·Ù?u+û,6k>š–öy_ÜÔâ$öóN…ç@Bˆµy@¡›‹«Ž}2³!‹ ;É^•â”¼å.ëØcæO7Ü,ˆ¶ [«šÁ`y§¼†—ÌC0Mǯ¤Äe@c«®ƒU—žØQ –¹‡ê/ wñ2Ò\âTܾêÜ+Ô&þ‰–:F.國HcÖ·^7¥PœÓvàÞ)N¢¬æ‚¦Ç©‚=Éõû\œh¦¾Ñ5kV4ˆ «ŠÉ¢[êšÄšbÊj-ŒHö [ª4=N|ê@ý¶‰É(%1CKÇGJâ-S"#°Jꆸ…¯„fˆµ}‡C×-ý»Œ ­ÉÜu.nË9x'.[êÃÄôõ­™«ô[ámè’Çj‡QdœÁ&|Ukå©—+¼ ˆÖ±iϦòÖ8‡ØØøG~u÷Ô§»í”’È'«[÷’HŸëU÷p B¢>Í$  `{ö¦ÖÈ„PM Ø-/±åSœDÌ Öžj7ÒfÐtôiÚt*¡ÍЧ›¸'m¾Ãoy›·r»µ¥6]‡nìä»Ù€ÄÁ#·Ð&:ÑÙ—^@ICóª9TÓD„Ä 9dƒ€ì½›hN5æ6ñPcVx™D®a5!|…ßíwp²gè隺øÿÄ<Õ+U¼ñ€£‹“Žž!ÝÀÂv'ÿàkAàîo±2fPŒ½âÖßá¾æáá@Õ16óÎÎÚû¬ ®Z›Hó«Øïák¦ëµ['ÖiZ¹m‰|'ê.ñ®„ØD3Šqèþ¨ì4=}}†±Wäº_ùØÂ)N"N¢F.¹ ‰µR©»mèFF+¨9~u;ô%¬s§ýξÖ\@vä±Íqø—ߎ茬붡Êù¢I„Fd½jà¯ö,6ù õ:ק^0Nä·Ha 5(ã\XH ÒÐ#¶!½\ÝuŽZ‘ò¡‹ ïª=‡ìºrÑ€º=€>Ùʯn‡sÝs3²yTËÊhóžG4”ììã$â$ö]±é+½»ï<¸5¸6Qv—Ÿß»é/î9¼'9«Ö"–=Ì&“çݧÝú·€tËU¶ú²wõ;ÀÖ³+$}º4 ¨;uÙÔDË4²¹î~Ú '+jPjjn{†„x\æ•/{ÒœDœÄ#¯¹‹uì)ëDÇ''qðl"¿O<ˆÃˆ“ˆ“ˆ N"N"N".8‰8‰¸à$â$â$â‚“ˆ“ˆ N"N"N".8‰8‰¸à$~$þÉG6è2àÿ±Á—¿+ ‰p„ó›AM«\‹ 4ܧî ÿOZM›¼k‹‹\Éú³àÁ+äûjºÅàÆpú7pæw¹¨áçà×çò®'.r(€gòþ[QoE §L_欓k™±¶¬0{¼«Š‹¼ }+8ûHÞm"$1ÿuo\ð_÷ÆIÄIÄ'ñ/IäAK¯Å½± èóÕ‡$±Gx¿ˆ?nÿýÁÓ·‘Vê?iOõt'QþI”é5øw*Cu1 †ˆ¦ M»XB¢ù–²ŠJYùº¯YékN/¼¶^ÖI4y3´òe¯eég³Þwã_æá p<êŸ.¤Q險T-uTÔ(Z”Ånü‘¯ßc7ßgIÑœßgÙêÏ >$SÁ¿â_m+?j›(#ã…KÌÝÔ躚fÉC2Ý„ šœ¡I!kšøŒâ jœX~eRÜžI û?KܦBYºÌ½vBÒ“â÷LLn^vuJBãª.XÄ>¿5¨`u©F¯…=öEÜ›ˆeî±;ÕÒ±Ì5`H2‹®æ¯¸VÚ‚7¢×BéC«Ñœ=Ù ·d!*Xù'´º§óuô5-c&%Ÿø,é ”ÉQk˜š‘ bF°ß¢=ÕWÞ§ T&rÿ˜é`ñMÈQÉ·²sQ5øXÝø=‰5`‚WüÄüŸ¿rê%QÚYó·.3 ÿÜÙhè5Š;x$öŒ"(uoæS¾]uqÞÐ>¼ðøŒ»‡rbÁŽ¯Ã6Îi›X<Ç¿ò³ì» œ‡S¹s|‹¿HhP’–£XyoJ8oŽOþ×ËW.{-½œçŸE×ÏöÍ›ã[6%ù ,yXös­ÉÛ9!5£KÂlJ¥¾ .›ã7+xÕèRìÆW“#+¦'Þ‘½w–oî¬ÊU`Hé¹iAÅs|+Ççÿ䩺ÿÕò’/Rÿ¶i¶Oî¬àÕŸTŠ%åÉÈÐ]æÂV¨“VQàGuŠúÌä’)…ûlBÌ*¨áìÞ§ù÷Ñ”Ž1©¦Ç¶+çùÚ/Ž?û³<4ƒ8;²alxĘ́Š<Ì&Š•*ÿ*„?ºäñ¿Ökýx½SÔ(V½†£ú+§)‰˜'Ù÷çZØÍŠ;÷I@iI”]±§ó)sEœGg{$zÀ¤2¢FVÅŒ$M½…®•SâöNw $éØ,t)þ2|ë”\u†éôøÓèè½;×ÔLÅ.mZèÊÙΡúžãó¡þ¹««¦iøŒåõÓý‹Uôé ü÷):ó­­™ìòeüaef‡Rñu²æR§‚¯Bêæ8xhéúŽ+íP<ýÖÚ€b”<ÓŸ?)fÓ"Cº†mþ×n©ŸÇìŸæáEbŒfA/-Ó§’Œâgùr'ÇnÿÆÆ`°|ôZ:)‰ªÎL%a¯ó9,ï¸*MmV22 (°ûÚÞMÓ,rúòU3½R4¶Ÿg?Tà¿šN¡».p.˜³kšO föE6t§!‰æs"Î KÊ Æ–wbOQÎÞ¦¡ç9¦üN¢¼®ØÀè^$C¢d$Œ‹,Yf?¼|âˆ8¸ÞiŸ ‘EÖ‹CI̤“,'fÝB-Ñ9u"anð.%ÄïúÒÁq©÷º!µ`T€=É(i E@ðöK«>Û8w~ù3²J%çƧ_ד‚VP¨ñJ+¯oHÑñ¯Bw å£aÝËy´…s£Ï)T¿øÆÎJ‹¾\õÇÄQ45¦åˆr¸·—}ù\wUÅX_Ã8z¸½—ݨA¡Ì^~X¢¿¬Mtf)ÖÂ<]ŠPøϾ𠠑|>awÀž•TObd£¸P4Ù?˜¦[¬P×=98–Jµ[ñµ›÷¿µ¶Q·â(T?E¼ÓÐã ¼óôÔ¾m…º©ŸùØ.u]«Ä•ézœD¹ÚÅèG"¶BRÒ´ÄÐtRÁk…5`D`ÑÐ{ä`íbü'$Rµ}ƽB\Pþmczì)Tç®)nnªîk”êÅsèu»´‰©’LH91Í+\Ý:w·ã++M“¨©qÇf_Î|‰!9)0ŒB‚­aò»”óÚ&Åìšµš¶E •ù¡- Õ/¿±5$XnA–—`T’D°#i¨góéóæ¤â²r»%Ë¡²6‚Ó1”ýÇø‚aÌpôN!‰ñ‰µÏç2HË|·+`»?*ÔtNŽ£u¦æOnøÆÎDÓFêÂ8QË~toœ¸hvÊ#Ì&jZ²æ[{Í· ÓЦ«ØTëÙßÄ*U÷lžŽÁ2g–’°Ç{J^£EÖþ2ã.Z…S24*VáÐÖÒ¶ÿ"ë7þëÉAQZFñ ÍÝ9Ä.5² è…Œe¡û‰ŽVsBI /=¡BW!Û}žºãq¢\ÚD¤×&ÅmŸ¿srâD‹Ÿ”™Ï{7÷`HþÉI©ÇÑa,dïѪs\âÖO‹žHSDCK/MJiÂ…Fáôää“CÙ¨«Æ{9>ñ‡Q¥`vsDα 9×¹˜í“qpjì–ÉIGGTv(`‚îÑYG¦Än™¿wLá=©Á}=6uï”ÄŸF”?‡ÙFæƒw}–y^+²îOŒß>¶àÖØÌ3ï`^ëв«“ •4]縤mcÊß*p®ª—zµ+U^„åONiD×jD}¢Aç¸äý².ö©iÕ£OS÷Lȼ!uD#sOMŽÛ2%aÿ'eÏÑpþÕ”ÀZ–ÕJìÛã·LM80‚…ྕupLÑï’G°/,Õ3ý2ó®Ô â§ÝäÒ;åKÈJo)–S²gQ“DéÁ’~§Å2u˜M¶ |i~¡ôNO½Òê $Jxé¹KæYýG(s¨ Ë̹ITñjAâDIóö=M*›™×÷0°¬2< ±®AH ×2ç"¬ oÝ{”¬ƒc&)êºþå+ +êÏÏW]VÑ'©x´HOtÿÏCÈæUJüîþ%£[Q …k5©T ÅzJæÍÿ‰W3pqÿlx¼•Ý6ªèùß9äu+¹6&ï×÷κõiJãÌ•ý·ž5ÅIÄIü›–‹'ëÁþ· ÿ“’ûù·üÿqqÿîŽÿUïT6ÈåðNùðånœDœD\pÁIÄIÄ''\pqqÁIÄIÄœDœD\pqqÁå_Abø1 ÀD†º\ DapÒ¨’{Uq‘+©ÓV‚–DÎ`¸Xì“k1Ùª/!"çzâ"‡â}\}*ï¿%ƒûÏÁGàgù¨áÃWàáKy×9”ÛOÀË΀Ä#7AÙIÀjk©8ŽÝGo‚ÊyW¹8`jÚ>²_÷–gé÷ëÞ¸àò7å#úuoœD\på’D1T©Bß^³øÝ•…é̓O"ïÝ7Jê"«-ïŸRR,ízñûõù?–ù®&þ‡«óçÃ{î€æÅIü¯‘ˆµ-ü+´~kßNoF*â^i¼A²‰Èx@ç÷Ïè`n‚VIæPÕfÉøžÆAUjÿŸÓV¦L›#‰‚v l•âÐ,þð ÏHÆnÿ)1 ›D‚3 tÃnK+sc}<ÿœY À=v?cU#«¡‹ßÜ•É)'è'–7tþŸa„*qŽÝv´³íms…DÓ· ­Ì= ª[ż‹¡DŽÿ–È?Åjù¾Ðÿ´M„Cý4Ècæ2 ,M uí“%$¶Þî: Ñ1c÷CÖÑg•GžVyÆ>õ–×2˜$­ß¡câ“ÿÓK>fòú Ú¢ 6KÇ!¡ðÀ³ªFObÜÅ2&²÷#·IöÞ~åôÞÂÃÌÁÀgµ€òû¬¬ÂŠ¾†ßrN<+9ð„+ñÞ*&~—ôqnþbi ç^z”‰µù±å;NY¨ÑÌÒ+΢Åö-ª×uì[&šØ›GVL·¾*ɸÙ} ‡Ã€¹q·=°¸MÄ”yàÉ;žñ+B·ß Õ‘(†xVmÌ&j5gAõÔåC½¦Ð#Mb‹¸lçÉ„úÓyÛ…?Ʋw'¯»\Õ *6ñ г‹dÿP°ÿ ¿UT²ãt,{glÕîXι{ 㳩+kõO9[.%q¶DU_áœ|PÛT¾çR²ð@\ÕΤÕ«Ž?Ȩ?ÏÙË?Zz¤ifsÿ$îÎÖÎhÖ®ôM¿p›AÕá{a‰q =·°Ò­9‡E•?\Œ¶U5uCYn$ñvÇTíŽaíNßüKU“¶3÷äÓ¤ÚÃ;N¯;ÏßÇ;X|襔#õõ¼Ù§x-’`Ax”­ZCÕRÝj 'Üð,{Õ¡hÖŽhæŽä5ç+Oê—í:W±9¶ÃúŸKvœå·vç®=Sñ-¡‹Ûø,Y°-iãÄOhUGî¥ ÷DWÂr †79X³œY¿&ÆTn‹«n(?ÞÉ=ù82)‘Bvãü˜ýÃSA+Nâ?¶bƒÎ~œ“o믂ÐÀ€^Ï‚Êš0‚qbáž›)Õ{’W·²ZAõiða¤¿&±U”Y´Œ`á™\]¹-45__Ï2jãåkv¹3¬üƒó7äî{U¾}¯¹¥ƒ[+¬`•OX”uHÆ®§¼ÆO²ŽÉr¯„²å¬s̽ ú†Ú¶A%‘ìá…†æÖö^ñÅÛbËë-ÍÌ3öB‡¼rß9;+3‹åE!ù+² Í<âv<âºâIÓuȬË8Ø•SU¬¦SÞð–wò’³£ƒMPfHþšà”|#c»Ðê‹\öOWML´LÜ2ÃʶD•oprs²ˆÞÄéc¶zHl@0D’XºrUK3l+Xu¹#2*\ßÚ7 guXËÔÀÄ)uKÕiÀ9pÊÂ@Ç<¤lEñú ØL3[Š–i©ð\§·¾šÍŽ•W‘)´öÄcÆ\ÃÈsõ—°ùwo7{#Ïô‚µËSsá­A5WjN‹cSbõœ’–ç¯ Í«qv¶Ðó©«j|@"Y}Ÿ¶û‘'ñÑ ¹ö‚H†D ¸Šóì/ÑÒ1²Ò7µÒÕÓÕµòOÛýRðA þ†Må0cˆzÞÙûÁa&8yËÍÍØ!õô¦2*+ } +Äüöî#ӚʓˆIœ¸æì`ì’ó¯é­ŸÅ8|5» ™X*ö4ÓIAënV·AÃñ»§‹ }Åæêv <ÒR£µÝ³Y¢C¿ÆqW¶ îAë›@/k£Œ–ús¢ÌªR“¨Ò0NÌâ²ÈÆi°õr³C(f!Ù?t Šµ¼ŒIô5p+¬8ÙUuègK-×¢Ÿ03›/ Ä—7"q%¯/‰eÇ*¿d{Á:þš¹§ÙÆHƒfSĺ8ëjÈdzØš§u@ÍÀÝP¦E²Ißß•™¬a’ÆlAü–êöG.ú*TgaõÙ΀`²ë¾ú+Hù5'¯[˜jšÇ_\õ (*ÓÐ *:jÏ‚Ú‹ ·$ˆlœÊl|îjN³®üeõeÄbü9uÝU^«8‹' ýJÚa]OîÔ}?êßDþè­÷ÏZŸ»ï)ìtÎá Ó Neƒ|ĉ-¢ìŠ†mféQÄ{¬nüÕÛßÚ&v9é•LCŸæ)± õ[Ù½äG2ÔÅ‚ö7aaú+êøÍo}|Œ< Žc«O» L\3~x‚¸yÍO¼\]]Ê*πܜ$Šc«ÛÄe[OÄæ:Å;Dëh0bŽ×e²K ‰%Çß $V’ŒÓªÎv9[ùç”a³\«(‡/ ›î¨:tÃÜÒ"|åu¨$Ô?oåŠ^XqÛž•ŒDS}‚¦º*D‚ªºÝ.‚_tԞɩm¿òqìíѬ= Üj†¦väw–{9êE®EÜÎfdIˆ6"Ùñƒú“hií-êåB±]ÅÞÃÚÃÞ‘›C#Yf'¤DHf.ñœ¸ºÓ¬¦!lè{pù‰Hœˆ¯Ø|xa0%†C±æœdGÚš¢ïÖÒMòuʉvÙeG} ‰>þÖ¶q²$a˯ªwù!4 O¿Š ¦ñøMo}|ͼ‹›zI4õÈÜÿñš{ºº¹V4U·ÁY„DªBbÑú½ú: «PfbÝñŒÕGÝLtbŽ½›Ä3^¶–¦Å­Ø–Š(¯ºžnæ]pè J¢U䪟Ñð½$"Þ)§Ù¹€æµºžF±IÚ÷Î Õç@\R™Ê0uñµtñFÅ×Ö/*qËy_g{㸂6¤èÍ&'[’lú“X+%qÝÍ.wWŠž…¥«¤W»€ÄôŸ4µ¹Âµönn&&dŠI`ÕYÁiÉȈÛÄ„DÙ¥ö|wH‰°CÛ»sj¤m¾‡¯IÄ; ŠWWÑ-B ȉ¥R½û“(´½p7ÖrÊÙW…z¡ÕmOÝLcÖóšßAbÖŸ’˜“¢ãÅäE"åêÖç¾îÆŒØuçº3ÙÅ:¦Ñ²$²Î€(?k]Œ’SÈB.¿µ;“UÀ°Œ(9ÚQu’hùwHôBWl¼¦ÇÁ~Ö4‡‚Ê#×lÍ]#¶t¬¹ V^Ì <õ&ÙÍ ‡/$k:]õ(é<Ü&þ36ñ[NQÉd*„üÓ¢Pµµ\“6ÿ*h{êíj¦E PiTM ¢©wzÎü¶¿ƒDdŸ’¸aä•Y;Í®ˆ¦ÛÊØD?+‰Md2 ½ó™ ".œdŽÝõós èY[8{Щ ÛØõ̆n^c‡·‰wq£”ÄSú&îï´ÚD׊FŒÄœœDŠc*« ”ïl²6£ÒÌ<,lmLýò# +išDÛøÕ[NšÐµ(dŠóna‡h”ZÑÐÉkíLȈ¢j˜;ûè1n¹^ÃÂQ›h±²‡ÄÕdÝP”Äž=HâÏ–z:^¬“’NÍbèf”¥5hQ[_WŸ•ëkõTš‘‘±!YÇÌ+ï8F|}ˆêª #3ºY\`’=ņ+¸ ˜ë¶šëèX9†;‡¦˜˜‘M£OÃYWx¤d2¨†™³>B5òŒY¯ö H**Ò!«j›8›X˜“Ⱥ®ÅÐΖo:bnÌ ôœò›ªÏà6ñŸ³‰°m_ä}.{ÓùÜÍs7_ÈÝt.góæñ7ˆwÔ&.Ùy%çûsù;ïT!s>ºêø“¼í?³!MÍbÖ¡[ù;ïrEÈ·M¥{®í‚¦ÿV°û·IŒíƒ šßm¿µáLÁÞ?øXÜ,*Ýs¥ôà Ìäœ|‘¿íëTÚ]%»nzÙ#öOwrwýÊmF‚eXlÎÆÓ9[æ´A§ñeþ¶‹yÛoóZE?\ÏÞx®äHWÕÑßs·Ýá [‡bèÒW컑µátîö›UÍ’vã6¾)ÜqµühvN€}ôAîÖ›hþÞ:r; ·^.Áh‘låó^æm9_¸÷!’ Óñ?ò¾?õýù’Ÿ^A6ù°8o4½)Üv!ûû‹¬6žaM´áñÎ!1cÕÁ;ÙZ37]ƒÁrÉÎËûà$†úêg@å·s6¶go¾Zq\?"‰§óÇ;¹Ogm<_tà©Ý´´ŠÊ÷ý Ç@ñO轸MüǼSd¸¶õ—Û×/…÷AÂö÷y§˜>Ø(r¾´­çl rÙw–¦÷œžíSééA›t%ª¥o™2_õ>¢¥÷Zò±¥÷Io—{ÀžËkyG»aiz›;PÚÖï<'r-£[ß^è«•@Zßžó0XbõY’aC²áñσ¾j÷)y¨L9ïLìéñ>ÙpÿÑ›Ç2¤óÞ÷¾ÃóN¥>*OæLB¿# ²R=ÅßË9âÕç+Þ€bûÁ“‰é¾@!UðÞñP±,ƒÒC5}Þqè9uÖïâýë$âþØ.F,i±NïÂ;ÞïàýÕ; ýšôï›àÞ)þ~".ë%1OÖ+ÀßOÄIÄI¤w ßmàpqqqÁIÄIÄ'''œDœD\pqqqÁIÄIÄ'''œDœD\p?ÿJN ?ÿ—ȵ\úüöüö\ÞõÄEåú£à·¢ºD`ÿÀ:¸çåZØçÀ‰ûàø}À9/ïªâ"o²ê ¸û1:òü¯SB…b P!ßR Â_¨j¹Ü«Š‹œÉd!hü]Þ½Ó·"u(°åþ×Ò9 ö$ˆ8ül:þÛñ¸üÂ_¯­>#?.¹øèÂå?'ñ‘D1bwx2Ö‡'FDò•¸o5¤|H{ý^Äýmè?¨­ëwÉ#xÿ•'ŠßëHžò· —í)žøȵøXIÄúHòwhù=岇ýû½ê¹rÉ­¥÷†T‰þá±ý×$*V½P.ýM‘Óý¾^@ëÒ=´â·‘E7‡²»ÿAm{¬–LYJì'#J*ðDÿ_Årß/ýuDñ-(#QQzG¤ øOaÄÚáÞˆ²8N¢|ÙD‘‚ŒJY·ÄÔ~‰cÙA/¤CJÏcï­jh§¡kµÀƒûIù›>óÿ‡$b土–Z%Œ¨xÕgªçÉÚ&ñ°‚æyfvªfA“²žH°l†~nÀ;E¶LÞ»œ‡(˜?OŠÙ5´ê­¯kLh”3ŒÛÙ;¹õ+'~÷³dF‘ëÎ7Öžê†öj†ŽªFŽjVšºV‹ísÆwÊÀú׈ׯp,ýÕ~jŽûêeL$¯ï4Âÿ×Eâ/‰°GªÁØh ·%úfÓ¤¡i D3팗9ñG1(W\˜¯O™¼0ãDžxDÆv‚ž×'e/µ…˜= µ¨À\L•À×°ÈÅ~¦g˜ V§ÍPƒtıt¬„é_I9H›HoAÇpÏ]س(;5<ïÀb㨡(§ŠœçÃÙOQ›(µ•²™1[‰=·ZFŸ¾fN©ò—Å ½oÂw¨¼¯Ì¼§\yXQÓ|cm¢~Ü¡T¬ª"Dª€ ÷b†«#Å|“ÂJ4](™Í0Í‘l¼åáà$þ-‘nï“;¦òõ—.ÁšfÉ(‰hw¯%mÆ•wIrVÞQ.}ú¦Ð÷‘˜¹ƒ çƒ’(™R÷uØ‘ÙÇf¹'ÏsÉ™š|^±ŒŒ(Q1uÐÒ³[à”>!û)~à ڧûdÏsI°ú“²'HÕ¸SBËÆgž9/è¸båYk†1oá—3Ï9ýËØ&E¡hLlÍ<§øÙ›†³;°áªX~õó òo]’¿õ(Ÿ} ¡¦èô\+[Í|¡MÄÔân圾õþ~· ñT™w¦,¯øÖ%å/æøœÛ(@±òÞŒö˜Â{“Â*ç9§Ì únóM?uôfÇœR”˜9Ä]–¶ŽHÒš–Õ…”Ãï¼y¶kò\×ÜÏ“¯`hË\¿À{‡RåiÞéóœRaÐÒ^LwuBH¬}5Õ/ëˤË»)J¹›¸p†³Å¸M”/ÑîV¨å %~£ü¬ÈæYŸÝþ4íÈg)ÇG•³"öN]ž«E7Ÿkí¹Ø]01þ;]êbŸÈÐ-½¼ÐÄ\ÝU‹@!jA!“I$ºÃ¬Ð}ÃØ]ß ™d }žo¦å×þìéD-ÚWi·†%g3HÊYþ7®©~¬6QüÅ°ûÆ;èÍs†q$™GdmÖ0„S}§üH0Í^‰ê#!qO/‰PmÞ¯K(ÔY‘‡±Û…Ÿ{k9ó¸ogÛ›Í Ç‚)”D}±XÌ{<ÛÊíÛ¨&lõ£‡Ä‘iÛTíù¾ëÇä^Qpa–•¹¦ç±÷Ø9ËÔr™SÑ0Éž£hLb=Aß{dÅ”DËÏSQ¿‚ÿ^3ôg&5ÙvÁ¨´Zˉ…/1}&û¥‘):KìcØG.D$j¾KÆļ߇%e1(ØÂÏÚB$Q'—½í%QFÇdk“‡ º?÷ ZxXA þwžšø¨×N± iœ8D(Y…šKÓÉB—û`d*OÃ8b$ëíÇA"´‰‚çs Hó‚w+bC]ðt†ƒëR¯ ˆM´7›ÞøwI䀉ÁÉvÅjtÙ“ûd–•1bk1£•ÙRï’¦8ØkZ§*Wa}™§i­Ìêü»$"+6'%ñøãéŽ$“´a\DŸQ+ò(Tã±€qŠü"°rR6]Ãf W²0;2…E&ZŽ­êž†y§+ÑÂËÎ.£.yá[»à‰¹¿öngà$ÊÑŠÍÛ¡•ªþ˜áàC0‰É|5”ùX‘ çÌ» t‰ ¶g¾^Ü6ט²Èk£Oz¼dHÔÔ—%1GJâÝ9Ž6ï4ºRÕ¾p8²:!ú44NË tlÁ}%öË‘é›Ôµu¾L¾ªÀíœmoÞÇ&È’è.Cb2É"’8>,_Ë,ñ“òçJ•&D0Õh*$»- ·ãbʉtŸ1E÷†°:ÆƳÉúiÃx¢a™uZã/Ïa¿V|fž1}¡Ï6%®!ÑØJ†Äµ$ÆŠw‘¨ß»v É*oP£¨/ <‚Ä€•M*ÚÄ%ë†U¾Vb¿U b“‘žœG%ùìÆîTdÿöµEË’«PÓ5ÝÕ™l’ÈC#V'*Õi±sž2«ë_»×ÿQ{§œM‚*•¨IWýVgÙ<*‘@Ö¶™˜}~¥œsp¡‰)…¨I%i/r¯ƒÁÎÚ„zÏÎþÈ´ïh$óQ¥ÏÊÂ|´ÑÊP%$ÿ­yäe.›až a9DÓDå*d3Q‘õûç~Éšt]"]OKÏifÄä¼ ·c®™ÆÜàc èâáð‚#’ñ§%Ñ=œg`¸0ì¶C7Ö/˜¡6„ †”^˜gaN¡04õg…í›ɤ©-Uud*Ÿ[JWÕV[6/öþè„]bØpl¢×ŸF Tõ ‰ÚúDºÉ|ï5X»)•_Ѥ¿J¼Š‘8&‘¯£é2¢êì…!Ìkêš‹æERäIwa¸™ÍXºhfìeHÓ°Ü£ó¬lI*‰JÓ0Y>5ÙÈž˜A§GOŒ¨TÑ7&–LâÆ¿R¼˜m§£«»Ye .ÙAÔ |úÃ_œ¬ÃIDïÛ㮑^T÷ìGKÒ%)\Ñ Ÿ;ŶÅyâþ×<éš?Mï]”f«–nâcù…@zdEº /)G,Sw‘Ì#€ä AµT™žk¬Ý 7sO™=y¸Òaßó‘/=Z0ðOT~„µ?_Fl¯_ILgPc† ¤=ˆ¤‹z?pE’GTìÒ"™NÊ~(ÙÂm¢|®Øðú£â½ç|8mâÀƒÍâwœyîw²‹?ð´[ß“r|ðîrúŸ ÷='/so¿#d¼w>T<à|šÌtÑOÞ€“Û}®ûvSµ”Ä÷ê,Rb?V.¹8ǘ®æ$"ü ñN"þVÔÿØK@Dåø$=âŠÞcŠý_ÊxýYxB[æPñI%@VMy8‰8‰8‰ÿí—³ zœÇ#XÞ{ü‰×=¤êáˆÊ»C¹Ý}^yÃIÄIÄIü/ÚÄ?·¢×cÿÏ_rÄIÄIÄIÄ''œDœDœD\pqqÁIÄIÄIÄ''œDœDœD\þI<Xà/þs³A—*„ÄpŒD.¸ü2sÕÇAbQ+X¼¨mkY²T´ƒÜ6 ú¼«Š‹\ 0¦;À¹Gòþ[QÝ"ðË3pþ¸ ß5¼÷Ü)ïzâ"‡rõ1xÚ!ï¿Õ;yùÝÕš6¹A h¸NÝ5­ò®*.r%Õ­`ýYððrO"þëÞ¸à¿î“ˆ“ˆ Nâ_’kÁkË|£)²"lŲªÂ¿Èuß X"U¸'3’.S©>9ÿ éÛ\Èv-iR±l]þT¤uDnóÞÝk²mÒ¿¿xØCq?{q«>jÏÁŽñšEÜ&±~¼ÐGjÎJ†Ä ‘õD Ï€Úó@Ð*æ"ƒ|àèñÛAÝ…¾Ú¢×³HyMÿ †ØøGó<Ö˜blº€å·"ÍX}æýmļ&¤:H×´¼»ña"l¨š¾Ÿ^ÝŽÖt`K§#±dlÆIük›ˆŽ1ïÄÄl÷ÄÕ¬V$±úHIL°ñuð—Š_ŒGúúŠ݃f%ÆN,hÉi¶Ë 2÷u °AÞk‘N‡Ê×ñ­‚뱺𥥺åMtv†SjcõEI"_Ö¶öõúº â0H›¬þ샷ãÒ+ÊÛzl"2‡”n>îìÌjà·¢·ôyâû oeëkbêJtõ3¬[ gÑÓ}|£ìý{ûË)47zÕlââ ,¶·UÅÝž~óí»>ö/§_"ú±[Ðö†/s>ŒCõ“[¬Tl;îæë©MÔ`Ø$T´#CZxd•ºEåxÅæzÆäz'ÛÚzUœ ‰<ŒµVP}ªÝ˜ ®MÓõ,<Ìm“Š áiÄâ@ëPÌ^B‰a¶¡¾U’^×öÒËGŸì´£ö*:ÛœØW‚6‰Õ€Ãl0]ÐÚ;Èá·Hâ l“B& ±Äv©ë+3,™ûÎ[YšÕÕ‚W?ƒ¥ñP ùobÒâ4/¶MÜÊ—>S {"àÛÑÜŠ9‘dÓè‚’)åŒDÞáWwöŽ‰ºšž½¿G\>ì2¯èL'ŠšªUÊAþIɽ:·õÔ®·qà·Èsm‘¹®º½×%†dnù«VjÇ&À;rÉÁÂ5ûÀ3a뇋k>ZÑ6<VT ðõÕ±OfbC õNë/">^í°êd›µqhÍMþiÕ÷x§H§Cs–‘ìO¶JŒËMÖwÎ.=ö™rÑÁ l}“Y·'¢tSÖåüÈeÚ DèŽòßLälŽ`î*=üØ/Ȍ꺳öL¼Ã=TÙð"•·-}Ëmø 8Š ¾;Uº.†w¨ô¨9Ÿ.®9J¶6Å”¯,ß–±ín5êŸC/½|×™8憈²M©ßß´ƒ~A\å¾sÖAn.tÃ5üÓ’‘Yuäž‹«.ÍØ>iB"ºMO3ë÷E–®á,?þ›Oà/ÛÙS±1²bsúÖ;È,IäÆP-âP ùYBÅ÷™Ûïqûø«‘âQ´¯ú2¨»ˆì»”ì4-ujì>P Ÿu0÷œ‹c®dîÈÙû¢uÑaÉü¿%ó¶E”mÉÝû´dGc4ÿ¿½«`á„Õ7xØðhx˜"Ü™¶å ÔÖ±î(Úx2ªl]çDzcÝ2.Ú PçXæ†ÈòÍi›oAl9ÇDedéÑ-}Rª’÷½©nÆAý¸ãÄ8Hž Ï‹Bƒ¥$Êø°ñϾöõ´Ôs¯åœû@>ÿ»m"j¾kŸ57eا4q4›š$mýó …íoCWxQˆ KßCSÏguF|%œá÷µÚØ[ÒèVö~áf¶îf64„Äë@°g#ÝÜ××Û‡¬çÆm嵃Øø U×Ê'ÆHWaẻ°ÔâB:•dèaçdO"ëx”6ÀÄ,ÎJ]ŠžC¨ƒ‡•DvÌ;,lýH41ô‹_S£MpÌ;¨†¥[~´qòwtö´‡6Â{øO?ÍØÚ'ÚÄÔ€b™Tv¢“ßò6«ŠÃ j›ºG8xúÒ \-å¡yŠKŽÔ±ŽÌ;ØÅïu;1Én9;8­˜‹(œe\>…¬²^§Ó\_W›¨çníèBÕ6\^s 1o¸y¹P)Æö±¦Ö.V–D뺚‹¯WÄøømæ·!å×=kemàyªÕ­¯WÄÇkS)f±ææfdCÿœCÕ­]é•Õz ª¡s¸=ÔY‹äÊlç»çççD&ØúÄGîxUÓ†{§m1ýk/ˆBdIÄb(8–­Û@%š$A3ÑúŽ˜è‘ˆê ­O¯ŽF2L< jš÷övr)8‚„Šm rC=IS?fO÷šk`uÛe[CŠ¦a« $ä¦iAÅçÁê+€½sŸ!m1Ím$±zÿ:YÝ dSÝ/ˆa­-Ó\¦¿ëÍêk`Í q 3Ý(¸–×òÂIo‘%ó· 7ÁÊ |Ç"°ŽÓüÊßÝÜ$çâw¿€ú+€¹e»…ŸÝÞ»<+!QÏ9ùÀc/k ×Êë5Б; “ìS7ûûøÚ¡Þiñæ#¶Î‘Ù Ý«.úüêhBµåܪkyêm§ëPx¼î¢UáÚí¶!«Ùã‹V>n™¼çmM{ï’¬ ‰Û8m"~3$º“ßøGPh IÛ%NSLÚî¬+ko€Õ×Azú ýàÒÅå‘IÎÙÍHãð5[¨jZ®ª»ô:,ÒSÏ{#OBâ º}ú%ˆsÑšÍ4ŠaäNñÚë`Õ¥Ž`¢Ç:aÛ3WsËüsk®#†¸xÃ.ë Uè6lþžÁð)8ö¼µ›¸wúwv1ÞI"¶"lèem–v¼þ|O8?6Q$6<[¾ÂG'hGÝeÄÝÊa—“+Ñ°%53•j_Ùˆ8]‹ 'ÍMU'±²¹#ÈÏÁ õäJÄÕ¦gž. ª+FâfŠ–Nä÷¿ÃqRs„9PœRò÷Þ,Üy©`÷,~±¶^@щWnÆT‡ŒäïÚŠ÷ÿ.è²ò_…GS­cãW7í» Ud1Vº_ÐK¢®SòÁ7éy©.9å­ ®õ‚)‰·åv F" ²X‡îå¬;’Àý!ž½ÍÞ‚ª›Ô^æUh°›ŽCB,|ÿop†&õNcµ­â¢sŠhÚ–±[žB5ß²ô±‰Zmc[s' '?Kg_cKk¯ÈïAõò8š¾}ʦKhí®•lÝDY@ßñ$!%J't}u›Y*oí YnK°\Uû^E é T—üÒ}— v\*ÚûKRi>a±QFƒ8"<@Û6>aõ©¢îqa{¢ R¼n î™ýÃc|ÅæÿDºVÀÙu@ßÐ.u÷sñ`¬Ø Ê4ʯ٪é¸Dy„g¸­Èrôö%,^à^ódõ官ø8×ÌJ´jÐU….£'0_z»ÚY—¶Õ¢ÞcMËK?cÌ;­Þ¿‰B5OØú:–õ—^¹›™P ­­=B­Ýƒ­Ý—[¹ú›û¤æ³÷_ ŠN06·2¶q³òÍNÞö@ت~úeEJ–‰¥•‘»•Wr܆;‚¾á3FbâçÜ݇õôì’÷v䇑ÙgA€—'FbÙöSöövÆN‘^ñå~ EfzšzÉíõëÀ•åq‰F–ö&v^¶YI[~ 61V]C›ÁÐÒÒ +jBé&iŸ8Q‹dœËßÏÛžšH&›'lúYejëN+¯¤‘æ®Ë±ÚY{›Úoø-*6Ä$atž¹-0–ìs#X½ŸÄ󑉱4=Ki!°•üŒÍœŽ@/÷Zhbš±…±­‡_zÂ÷÷…mââõ‰9ûó›ñýÄ¿ Qvñ ’ÒK¢dëYÐÖ^Z¢o]v²›×ò!üÒ÷{§ÈVK^-[ÏÔ+’½'ž÷C'km‹öU”š¤í”ÈlDr σ¼LÄ&2›^û{Ú™ä7Õ¶£¦Ï¼\u¤6’h‘°å «ÐÂÛ2| ™'ß°Ž=a{Ì:ñœÛøŠÛ jÎ~ÓÖ‘…Û/†F{‘õV”´ [™Í죋w^ŽH‰#Q½ó¡ÁíçB|ZÝü4ÀÛÌ+ÿ{[sŠUÖÕÕ×;ý=y­Ý1i :^'^q›ºy'z9é£$Bƒ"hA /Ür:(&’f^Ü"*áÆh2ùœ{êì,DgØ Çžm?CÑY^Ô Jû‘øAö4?^›ˆ­Bs»kξ ò×±Oª€æŽ tHÐôÿÚ;°&¯ý'¥^AœuÖ Z@VÂ$„)S† "ˆ½—L È"W±Ú¡í­V­zëV°^¯­ÕªµZ«'ÊÊ{Ï›A­mïó/¿¿ïó{xâñÍyÏ9ïùœßïŒ÷I{lÒ÷˜mü3½}±Ð[ñ‰¸ 8×µ2È& sï4¾û€/¿_Àj,kªSÒŽî*Q­-ciÑþôÄë¿iðs&»f×´b)±Ö|Á9¼:µ{[}œ-íC_&Qt«(_iI.9Ø…ï–TýóTζ…ÇnÆ•~Ty¤ß[oÅ8Ÿï¡›9ç|õ$ó9óÀ#”ˆ„óÏ#Ž)‡°F¥åÁ>Å­=…B¡§“•ì¿®kúÏ3‰Ý II[QË£ÖfrØÓñ}Çô–ÆÖö¤ÊÅ{ Ð[z™›w;Ú-È;ÚU)L±_Î<„ w¡˜†s/K78zë^]±9+æ+šwÑɉ»¡Y*ïÓ:;z$7ß”mgð]L­ká·`yåëmÜs9§P%¼Ã—ƒÐÐ<±ñÒ󄌌`·ß;foÛãÆ Èæ‰e"‘ c%ó(Þ èî¬'²>¼%8ñ ¥ú3æ~Tfüúòö0¬=²Ž`UÍ[B ÷¶¡ÐW0XG †µOŸúiErIDF™§«£5Í34µ2¾wìn¸¿­WÚ>a‹dж„^%ïáß`5Û)¦ök›®•¶Å›¾½³ÐÁØkíáéŸÃ–ø9%Fçñ#â×Eù̳‰GSHöGû½]^Ñ¥+ò¸kÓÝÜ̬ýw6^Åê¿ü€b锶ót§ Ÿm[ä’•/ŒÎ,óöt )>,9¾;)›×VnM¬þ0™³=}àìb|ˆûÊ“ÏÖ‰?ÎýøÖ`bøŸ(;g²ãP’`ûˆü§|$9‡Unû$E|†ãú)“Û¼–½=kÛåšý§j¾æžÁOıw·¦°·$T}\¸ëzñÖ½Éõ—ÑDRtô‡äšÏÊ¿è; <~?¿aw"{kBÕÎün¤çs„Çîå×£Äm ìæô-5'¥‰'6íMªÚ–XÕœV¬úX·bZÞJ¼£÷2y{*Ž½ÀËyº£ þË’ýDx´ßU¼qî‡WðmÙ“ÏJ¶ìGÙ¦ð÷2¿zV{àJ*§9cóyÞÉ'ë6|‘TÕœX½=}ÃiÎñtqíG“ëŽÕëÁ‹zêq{îÎëÈ×ô?ÄÖ'™œŸ\ô‰9‹q¿ü6¹úƒ‚OňÎt–5ÂkÇnÎhú¦ö”|æìý.­%î(Øñ}\ú24O¬¿Œ.~Ž.NªÚžÂÛÃüâjŽxWÎÎ6<èEmr¢}]ãg‰¨“TíÈÛq Ï`‚ãíë6îÁË\µ=½ñ$^f¼œÏK6ïYËjÊú¤] û‰$:m‘Ÿ¯P¶þÀþ,&Ä3¿â§A¤“ü*§·ÊÙ”—_ ‘üäÌLöEyGjUœ i‘WSyÂÕw¥4y øÚ+¬* %éÛ“Uþ¬\€þ‚µÈ ,Ëíµ™Ëê^×WòV¬nà16YbßÉ´þo½r»¾l…JÖp®wmúR‰ug”MÔÚœF¹xuJ­ôºÌ‰­ƒäá­(x+jØ¿Â [;í'qðÎl‰@"˜²‰Z{ó…u¡GÅ°aŠ!${S¼2†Ÿß8-D ñmE§ß~‚èHÁ€D  HD0 HD  HÁ€D HD0 ñm’ÈòÝ[ %Qöc:"è``ƶük{6 H¼|‡QÖχ¬¡^kÇ®=êå‚Ör {ôb¨ÿ~bw/Öø¶ðKlñ!mû°-—±¦KC½œ`CÐâŽ`Wu»z±„aòëÞ)Ç°øc?W ögL€M&¿îx#p1BÝÐ6>–zK8†7ìP/*Ø2!6c3$‚‰ÿ3‰ܧ׽”"ù­jÊ/x[$ _½û«åÇ”_(ùëú+w‘¼éšßÏð÷Šý¦ºHþÚʉ-‰yßFOP„ÄR*ž©ìƒ,±^ú÷ šOÄçy©^Ï&&¯Ný_Ü3e”¡bˆúMѤò»ÿÙ<¥ß­#‰Bų+=Ñÿ4æÈ®ÿ_Ê $þE>Y‡vödª‰sœª¸ï1õŒI¬²dÐmíiTªÓÜð&š®?=Îÿ“(ëŠÝ³\ \Í©“soK‡ŽWiÀ4ÃÜÉ«T_ú¢ð #‰äÿ|­oê!fŒ¥„4÷`¼1'„¹O›9‘õàÏƪe{ím\ô‹î¾þFdnw0ï@± Y™Ó¬,hdÕÙ j»·ë•| Lc;ÙĪŠz/Úßàë±Ñ+,¼VÍ÷¥x娊¤ébL¥H`gå2¡à:‘ßCä|7×ÉrnôçDá[$QÊêó¨`vA³ø…o& ú…[G1õ´x=CUÚ{ûM¨pXb¥¿}xŠ”Íï^,%qdöVŠÍ&D»¿‘wÕˆfâ`æ¢_ÑÞï"ßpG‘¿#™‡¬œë·É¡tvˆÄòÝ6dú„²ûÄÚ'¤šÇ¤šÚ9h¥Ì]u ß5¿z»>ß-R¾D'Sdç”MIúo$”ßHúE q°I+Ô®}8yÉjŠW¶ª,ÔÙ€iF{ÒÜ ð®.½fäšE–<ÿí­ØÈúIói ¼É‹ÄZ[(Î+´ØOåÎN„©•y78qnPÎÌ5{G%­aÐÒI"L'k³áªSZ™ãÀucÖ?%4ôèdïšµ8Å0(ÕpiÕ?ÊÚñð ÝEôLwmJœ”<'”=¦XêmëžJÝ„'§ÍYR:6ÿjÇ–’8*k“¹ÓRSgÛy+¿G-†ÿW=¦™œcëàom¿X¿¼]ê%ŸIÞ`œnœa°´rLé¯òºðé&Š ƒÒ §†¬Sò³‚Ä`)‰¨Ú¦.Ëœùm?Œ8‰»lÉã*{úà%lÄÆ…,¡yUÊÙ=¶Í¯Húì墑Ïñ ²[g-«YpxZDÙì%†aÜ‘åÐõ:™uvN¹ª¼[3B’õ‹îË£\ÁS½øŠ÷V­$€ÄA‰Neã³ ‡°¡÷à ñA’XÖ`géª[ÙMh›{Þu£ÌÞE¬{«$Š0•’¯,iä9Ü‹Fó=&e_’»šVÝ8úc­²K£SDænŽöŽYˆDÝ„ªÃ¢¹AÜÑÅ—Tù’QIµVTêô”­ÒïÆGgÙÐüôÙxgÖZGu›^§ô¢ÞÊxkw]6"ƒgí©ŸÓªSòݘø"ºµó¸¢ÇJ0"›Ìç'ˆ§2µd…¬8ÛÓÝdIÓ<—ÅãÊQtÚ5&±J—urdÑÙÉ‘YVΫµk:žQ)uÏdÝü³:ÅçÇÅ2íÑšœ ï6I¦ø™ûkVwô‰R+ºsC4fvM ° äã) ½cWäY;,˜˜uN»äÜ´àk—ðQèqWî7w¶µuÍ]zmëò”À[¯’Ó–ûÄç3ø£CZ5Rõ5#g÷™éç†åÐð^±‘>ÐFeåÝ^/&ÎÞ–n´0ÑÒŽBñÈÐâbƒôt^%Q¾2Ó©[L¥'ªáË–ÅY†n“-h%1ícÔ¹Ò²5a<R“Xv†®@nñî¸[SBÏ6É6‚ï¾ïÎ0 ÙM؆Môó´ZX! _ëÁ¼EczQ)VþÅ$ž,*îUgý¢ÂëQòˆÄd—Tö~k[úÔŒŸÑü”Xºlï4¾ô¦±c€”Ä^ÕòïuJ"ò:‘©4gØO,l'»ÆÆ䚇6¨òº¤ƒajÕ}¢@"#Qwýý°0ªëòQUŠº+ûDKûIE7ÕØwÔ+o«³oéÆ—ÛPéSÒ/â^²ò¬‰ Õhõ%TüzÞIŠÕ`ÕiBí×hJ9+ã’›w Åi¨‚$öcS·M_–I¡1ÌÖiWã“>ÎOzé;¦FZ8º’½SG²»”ʉ“hé;‚ÛIZ¿ÛÜ%R“ó£1Ýyra¡ú’‚ħsÆæµj¯¿¢“½ÃÂAF"Ž~Ç´¦…çY89[T©ñzT™ÿ"Ó-ÈîºÑò½ÄWIÄ£SúxŠo»QMG%—[;¯ÔæÈÖ´%…_YÐh†k¶OU0¯ ^áEû ÙqÁØ’6‰×̬ sî*HDŽþÉäe1&¡›âŽYóiïdý C{ø-Ú Sûž2NbÏ7uÏbØš‡q/ èE)# 7Y» ‡Þùv扸›–Œ‰YnÀÖäüªÎkS㵩Šžé‡ÇQé‹tøØè5Ôù‰ø‚’@‚†‘±KüäÑ)Nb±ŒDBÍÍ÷LÍboãÑ©l+×-ÝPë!qî¨ðesÝ*µ',)VÓSZ‰¼Ç*<é’,êö¼ófTêì„ò}Uek;ˆ¼öÙQSÃ’lÜתó1•Ê‹2‰¼ŸLhô©ÇdiåbEµ—ùD•šGDÔ°xæj§LénSJÛUX‡¬þú%·ÕòŶVvS².¿´Ö*#q\E—,XóËlow³¥¢ÆA¨0O™1¬ÞËh'4Ê+¨Rów¬•,iöSóoÈI¬9hcFž\öH+G,'Q„©çm¶öÈU_DZfDhs`ã­¬ØôOˆ O§G[yf©Õu‘OÑ£Ô\³Œn¢Ë¼¯"ìPwLó¦™.®;k§ò}óëól­f&~ÝÜW6屶›ž|P¾ÛÚš:#ë'b}'©ì3 [ÅŠ‚DÜñõN§ÚûêUöEÄÊӦΠƒ¸K„¦¶9n^&¡ÍDQ—J]¡üc[k‡‰ÙçÞ ]m܈W¿î¡ê ÅŽ1=õÛ$n$;­A$øcW—ØRÞ7^~õRåwrŸÈo›íJ›ó…*¿C•s{ú¢ªýÔÌDá³ÉakÞ_¾KMðTEСÎd?²ëB 7K ÏÕcJ!4ôN _káhì·ÆÌÅÛ$˜5ߪ~óDiÀ©šÍ!{¬þGi»“ª®ÌõZ¥Wùˆ êÒÎj0›h`ä·bbÆ‘)‰®!“J;TY-†¾‹,="ŒüWš»¬Þƒ¯[–Ÿ˜çÿ²ûxþü§3–Ì^sˆ¨´aJ¬<`ÆX¬ÇVZ;ÝŸmÄU‘ MÜ ï­B¥5ö¶˜¿Ø rqò‰û,ÝBÞ‰*2õŒ6öA5Š˜œyÕZ+w›¥O¹J]¯t˜ÂôWeÚSì&—b§Ã@âàøDdšë¯j2¯i2Ôdý¨É¼ªÉºAâuÊœŽZå ­²Ëšå·H|Éà= ×íbØ?kVü¢"PªñDÎMÍò»ø‘ƒºõŠZ믩¡É,ÿ¾ë6°Õ´i–·É÷"å1^—zÅuT)Ê6izñð}à¶k0¯h•]Ѩ¼'OG›ÿDƒuO¬¸«˜:õß]¥¶]£üdâûƒ#XwP€‘ÿbë&‰ß-V•}ÝnDÕc4žkï¡ÜÔ¹xæDî# æU­õÒ;ʪêQþ3‰×-CO…sW›yÏ°o‰›ÿXƒyÄïí?”ˆZ æ®VÙuiËÈÂÝç#ʯáef·ËÏÎUî§8úé2«oi•ý0‚ýPö(‰µPÓõ¢NõÝDØØ·Å/5:ý#’•7߉úÿÀCž’?tdZ(yùú‡ý~;ýµ %¯d>ð³P9“?|Æû·þ·/“þDÉËǃßPf)‰d'?½Ò{rOúr“âC‡Fþvª·nù|Ê)†ûðV¼5ô ÷‰¾z%Ê$*÷Þ§3ýi6ŒI§o°Ä¿Ý‹BŠÃ¨¿ù²›¤ÿ¬é_ý*$þÍIü#!ñÿƒ×1€D  HÁÀ€D  HÁÀ€D  HÁÀ€D  HÁÀ†?‰IËD!ô.°?ObÛÆP"ÁIL;Š‘¸˜–pH›Ë:ŽÿBÍ/'Ø4C…OÊ?ÕÝ‹]lÇŽßÅNmC%¼ò»úh¨—lZKö`Èÿ~â/ôwèê²²Œ ¿ †ÐÕA @ @ @ @ @ @ @ @ @ @ @ @ @  GýH3%Ä endstream endobj 775 0 obj << /Length 385 /Filter /FlateDecode >> stream xÚRËNÃ0¼û+öF"ׯÄÉ•WR%héT"MÜ6"MJªø{ì8¥€ÄÉ»cïììx lÀ]ÅhrLjp°â HR„XD⠖΢«ó4i×c2tžUÛhÚå™r=JœK ÌU¡’FÙ„c†©»ŠÐmŒÞÕÍPK.°$Ò=Z®d‚y±µ„ú,`ž„¾#Á|Ìüþ‰/Cj6*(–>5l“û=pS™"Lõ0³€ê€B­Y~€ó¯ù©À\l0€†Cάµz!„­žÜ 4*Òuщo<âHUñÎ8áçpRÞªÜæ¥jl²©´jwヲ*½ÙãÌ&o®vX¹Ôw>Ž&¬êl(M“Òk5'ëBe6ɇËæ ÒÜHm^wÅØ{ýaÏ®ÉË­ ÛQõë‰ì‹?•ào†œÿ´/´×ÿþè_7Qè-¢ƒ£œ˜nÀÇ¡”º®G¯wÉ¡wR`× ;ÛÙy?ò™ÒO³¶ç endstream endobj 768 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 771 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 133401 /Filter /FlateDecode >> stream xÚì|ÉûÿÓR쌃Ãθ;ŽãàpmiS÷6uwwwê.Ô›6Ò$Üw9¬PÚ´I‡âVªÔ%™ÿî&ä¸ûÝÿ‹,̼>¯¾’Édö™ð¼÷™yvX`X`X`X`X`X`X`X`X`X`X`X`X`X`X`X`X`X`åã/|>ÇÀ§Ëy|¼?Z<<ÏÔûò~Ÿ¤zúy‰‡Ûݶ-Æ™lŠn“O=½ö¤ÇŒÙ€;ãG˲ áò£žuGãzPPPïÒûEíXû°ûS€TWO9ë:Á¡‚àˆ79T˜0nÝxÚK°(ßñ£eS~éa·j6>g ê}x¿UI—+ît}"R͹Npª 8WâLNf¬RVåø3~´ìؤÔÉøœ((¨÷áý$’¯@HAHAHAAAAH}(BBHÄÛ¿$6® …DÁl‚õñvl‚Ó¿ÄÖÞ±B BêÄԴ¸†;¯~üäá8û |@Ê©BĽZsûÓk½D>‡ûhM÷Ÿ<â5çyôhÅr? H!¯8ßEÔÍÒÏ!Õ_¸Uþ/A†¢rrHíÜðÚ/]+^ß³Óи eDÝW× BêmBj¼o­^ñÇõ·³¸} ï¼c»áŽuf-Á¼Œ àâš,ËÖl‚#«d¬ÊФa´UA°-Gß"²«xçBw5Žt"#ºRõÔgó]ßýÏ7O›—r†âDÌ6Ëò‘áØ`›”­8Õ:Õ¢1¢9 é»ñÆ)»ºc£§Š7PRýT!¨âñ¡‡àzÕvwµuëþÍ`¸;¦Vl8.œ®îŽó`6„„Ô{XîÈ‘­ü'2ðë€J‚mŪƒí]ýéÌÄ1Šy×1ƒîK ÓCo]¼BÊõ¤+½Ý'ŽßgË&ØU*üùìF¯§£'wý%‚-ûBʉMð¼VØ}éáA¸áÈž‘ñø`ùÃ…þ(¤&„\É«ëzÞ7ø¬©3:¯ŨC•Ý™ö¶Ázö=Ó}Úu}kC_wï` ÷á,Ê÷ ©½ ÷FÓ îW¾5F‡ÛúøàÞ½Æ_œ±eL´=Ïvìá¹Cß× ¯"5È…„}¶øY!l€Jx8AKAoC8b}ú_)i•« –ì‘–óì‡Z zÆÒÑ¿vC‡ƒž Bêž8áX¡²kRˆ¿ ¼ý€ÒÒ{_:±'ÇÞk ˆ\óYdÃUä›}½Y[Rkг´}cÝê=mÈ‹¿ÎÝ:×Á ƒ^ûÖ·xFCÊ¡|Lò3Ä€-[¯ ½¨3f¿ ê®Å¼ëwì_ºùA:»qÔz‚kÝÎ^áÚ陋’n"ð]Ö¢üú:òzú-Õ•úVÎÉyˆÌûŸno{„jÎvƒ1„ÔÛ„âå¬+­êùàIËØt®âÞ7Š»‘ွ^_šq™²Þ»ÓªhÏàõï½£œqIÄ–x½ùèør"ïöÞàÆ=7çF^ɹ @gË\wβÂG÷¸~ìÆtßZ¿únÐÛo‚„Ku…-…iáΛ³Bj‰…š?+ë1÷yWá‘{Š15¢HnÕë¸ýl$œÊ‘S1ƵR̵’`[ME"«mËý…{RA£!ÕÞ£‚N:q B²§Îäu·ºq¶Ô¬8Þõ=(¤‚Êè©æï>|kœ3¬e×"!U—}ÖmReÅè•Àgd$ªåoÛwEB Bê­BʹBÄ­†þpKZŸ^zb B#©ÃWÐH*ò^IµœºÝÏì4ˆªý=ê’tÖub\ݸwI¡ö×ïëàQÓÊ º9âP)¹­ vëEpfä .=-³Ý@ ¹Õ€ER;kÑHJÕ½Œ`^iu…'ˆ¤¦f#-y”¢ës£ëW$_Uʺ6Ç»ò­¯YýÛå¾JÓš>0ØÅý,]\mëè¿×Üw»±§þI%…3+çþÞ«×[Є‘˾õ¨Ê©D¸µÀ¾\˜:‚üÅ Õ}«ežWÅ«âµv«ù£‰1ë‘°”É™”"€TÍ0¤lË©HdÊ_¿÷†Òƒku9“½R‡s¸ÈI›Ñˆ4ؾÿ*„„ÔÛ†RIÚÕ‚¸ÿîîi/t—º'ÕÓÃÚŸy qP`Û¦zùCè*Ò¡S÷v7Ö<é¡n½*æô!åŒ:áŬF$j{Úy°¦õà•.$êh¼ñd¶WåXßK§ÛÒ±õn~j0Z£|õóܪÇk·A¼=oð¯Ówf8¿}ßþêͼŽ•?gÜ9|¯ÏèîÛ}ìöLAæ[åW‘×6cûþí­äZ,÷¬6¼ ÿ ûžìÞn0ÐIŠ­BZÎH¸uøºtÙø°•Æ}[ÿ©=È æóÚ:ÐÄ>´ô­Mä ËÜ€Ë<äíž Ï.<ノ¦•q÷p4\kÉ>ÕXÙ8Ú–:—ý ¥ÿ¼£ëðÍ”ž¾A°ª¢>ÿ{Hñù-;¶Ö¢¿ü&îýñΕ“âoUu~_wò††ÈË‚=)6Á¶BãrÙ¯¨i>r¡%Ÿ•W=3õî)((©wðX$Ûr‚Y™P®Õ+ӮŔ!Øês. užYƒ63å>)AÓ»˜¦×t—ÓP½#v÷“ ~ø>)k¬ÆñºØ ‡ aζ Ëwõ Š¿ƒ”Cµ_ió¶ò¦Íå͛˚(‡ï‰V¥vWˆxÖ:ìoÜQÙ²þÔƒUÄÔÙi·óÊšwqZŠN=BkЛ¾KkÈ:ß¼»²)jýÕ‰ÈÙWÙi.Á¥JgûcÄ€¸7õw?Þt¾QÆOîÎQÞðpSEËÖ‹Oí3êS7=ú:…ÛÇA,}1Û‹V/!!õöžÝ‡8vÿ†Çh«Azñeaþ€SŴ؆fj‹jßó½0ÿ³û0推âeŠ $¼OêÅ!‡*†î“²¾gjèF*ôŽ'nô=tOJݯ|äX‚̇¡¯ ^8 3tèXŽC÷IÙ eB  !õ¶0ëT1rkçèJ43¡â½O|ÀìÿðÑkoô¶>îTñ‡77AAAHÁ§ CH}H„TVØ §ôPPRRR¤    ¤>ÄÒÝÇ3fÜšê_= ošê_å²éNCcïDÎ4Ú?¬¯¼¹W÷˜1oázPPPïÐûU«ç\çÞý$ 5Àãßj¸ÑŒK=éìà]k«ý]oèîç=|>ˆëQ@AA½K=x>x¿}à“ˆ¤øÇù“‹øSŠq¦¯‹øNgù·Úùc™ø3~´>+à_iåŸàO.Æ÷@   Þ™÷S9Äç<ã{R@õ Ð!o¢³“àF äâÐøÑ¢€K-@ý0>g ê}x?‰= ¢@HAHAHAAAAH}¢óÑ¿ @`bb`58‚”ÀZÄröB Bê#‹¤hOgÚ¸­VÒ\­¤³ÈþÐX:~")ÌÔq hê®VÖZ©0-©IЯB¯ø †ÑzõâApuÁEê8oXÏŒWzÎÿ¿\–®g>ü+((©R Þ—^aRÚùÉ=¢ä³Õ¤æ{ßD½n–ûžÎÑÐü%øÊJç—Ù«µ³ÅPŸÏÇq$Å“\Bÿ0 þÃ8@(#ï9¾w^'2ÚfÚFÍHìþ·Gd€ AùóÌÖþaì¿À8`qÐ\§m)|ôtý[¬~²á× [8 Z¡  ¤ð )Zó/†Æ¿Gµ ®±Ç»­Ò§ˆá%’BlN+^¥ìöEöQvÍR%£é98_î+3´%–˜o˜uqrT)ªÈó_®ëxÍ•ëéoŠÒ³ÃŸÿÛ‹ &øÂÁVJ5iJ÷ëhö×ÇçèJ«feþ{¬÷ã°Ê¡]\… Bê@*ïÁ<-ƒR»WÚ"‰™«I(8ˆDK¨ÇDOÔ;ó5Hsú?èHð_AJr¾{µp—md¹ù;8!‘ýMè‰)1—ÅhBHýr竨3SÃJ>Ïhô B~4)âôÔÐS_'Ü^@ÊÞZ’´E¤hh2·|…ŒÔì$Á"|2é|jDåxòÚžÚüUlí„”ºoÖžø&’;–Âà ¸ÊñâÄØ‹²{‡M«Ÿsç B º7ŸdðmzR¢)ôUš!ñ©1>ÉãQïÿ®¡ù{\ßÇ)ÏzB!úZ(Á,0Á?l¥º÷,ïMsôuÛìa6ý¦°f•AÌ,¯³ì¼ÄIɸä=œ­gú‡]ÁÌ€ 4Mxß JBHm-:Vg™,ñ×$ôã£WªØÿä»÷G[Ïú©ÓK¾¸BrÍ"Û¢oÂÏülæ¸Üò(ÅC µÒ©rši¾w9ÆÍî™fÆ«k`l!õ Å'PÍÕ1˜•Ü)ØOZ¥7žŠ HaiqÑâjh·ëuí_Rð©éÚ«d$¥ˆRIJK(}Ÿ‰|t}¡ŒÔœØA:”K¿Ø1ÇQžü¦ 5ß½/åñ{)Í¢±tž(¥[”üd¦›”b¤Cú…2Äy¡XÔÖ7KW뇨‡hœE4²î9úÝ”âDÓÉT0Å9`•cÕØÄ­«ôÈb4>!çÊ"5«©Y<è@   ¤ÞN zÇf–Kü —ë…àsW£&;Eq”8‘s|¹¢å¤llÁ*£l…¢ãWœüÞÞI­Yàtf\NëØœfTÙm¢H›ÌDí9CaQÁðž¶]Ey:—dñMzßgNËm¶‹ úÌÚ'AÔœ™5zOÊ‘(£¿D×e±žËJâ" ø/sÑ2‰K+ÿÿ®oýwÏÕU›ï[…@j™ŠûYØÒùâr9µÓù“]W9p”»¨›ÏHï·s¹q¡H>Ì÷ƒ‚‚z[)èb‘T)«ocï~µ~•”ì¬ø^ä«â …¦ˆïübl¶FVq™s<™‡›Kú7BêW¶'Bˆ@Cuû9â¼gh~Kûýð‰äG/C*­kl†ÕZIãr‘ð‡?>8IJ.lãHìIQÛ~6ÐXà£áÝyòÒsÃÛ° qi·ÆPдŠ•RúÓŸ!§tLÜ6 û¯hØrŸ »/y³„¼ã"ÇÉiýPPPRo-’º'´]ŸHjxí«H`€ŸKú¿‡ÔL’ÊŽ˜†Ì*è7‡½YÆ…ç.U5Ÿg»@Ëh¾ëiëÙï2Ëæ„ õdžªÞÔÔvµù —Å&±³íâ—’œ~:rÕÁ_Úɨ‰Ï›XÜVÉ5:ß'ö ЋÊ_¢aû»mú‹ %ºá“2zÑHJNmeêlû´…$Ó…næàT{ [6 ©‚Ž5ˆ« ŠÅ ë€‚‚‚Ïîû[HáVÿX¤1Y&¤Ý¥{ã3Z°xc²OH»;!£IÍËx(FÁÖëèƒc3ŸŠÒ°×”ŽqéèÇgc9£BK‘œ§ã3Ÿ:™}ã2îcaŠ­19OcMH{$–‹¥—ç–/Uóø*µ­ÌhE£9¾(¹i|¶ Ìz2HQM8>6ï•ôr˜¾þ'¯ƒØMß|¸!!!!õÎÏóßÅGü>‚™çPPRoRJ‘Ke@ áMT`r\o„?Zy ¾¨Äù(   Þ¡÷[µûSTß È¿ BÊñ§à2°õ&hì¾¥¸´XÁ“.Pxߣ€‚‚z—Þz \mý$ Åãƒ'àás\ª¥…ìýçxµ_ ÏÑQ4uã{PPPïRϺ@[Ï'©Øwä–Ürœ‰\ŽÝ­= £ÆVöEÐÜ ö_Å÷(   Þ¥÷Ûy <íüT uè: W€üJœ ±ùdhëE§ wÆ…†„‡ñ9 PPPïÅûí¹»>1HUð_v’h 7zÅT:„„ÔÇ)D .?û@uýHHþ™øƒ-ùÜ×xþR(aéìîä­çBèG#¶Ý@‡¸Òû®FÒ¦)Wéø€Ð÷f*j¤”¡^‘qþª>IÇëÅÁ7¤MÅÅ¥ômh·X\4Tdž;¢®lA c2_u  sËU…íëÐïï~w‚Ãä4˜¨’÷ š1¹ÂA!¿Oá«ÑšUÝ椫¤ŸÓ\ty¨…T­®šEÔÑþ‘>kÑ>?äåk((©•ÝÇiq1Q‘—×4ŠcS9ú4DRU ¯ØO^/1Sx!}×\_ÓzG_ç2—6ñÉQPõŒ+Cé3 R€zö¦³›£*É@׃™QÞh§%-#'¯hê¹³ÒÒƒœu—_ѳ6.JÓ·„à¦æ¹§­•Ë–®ŒÍ; ”If&‡ó6Uuúy¸[QÙ–F–~ûÚÉû„b°Û<=]ÌÉw˜Âðäo!UX=—`N¿쮢®­ï»9£T?u¶´uNßAÒt‰,y/XY[(“ŒÃäVbdá4E†it”uh· óÑ-Å'ž>nª$=Ÿâ´ RLÔH^» ŒT Ýý¶?D/?8=19dm}em ‹¤RzµRʺÉlU’©Mj)…; ©AçyàÚu-uËèÈC]ùp B Ï‘6üÁ̃W¢iLu¢]þ£|.!Å,»÷Ñ@ÊŽz7ÀYWÉã4 aͤßëj"­z(ëlc`ˆ³¢ÛŸ”’k†$»˜CÔóÍcOtå—6:8Èȯ«…%çÔˆ†¾[Ψ+xmº—{ê²¾‚‚_9ër¯‡¥ž¬›oñœ2DR–™¹å¼ØŒU‡" w8ùä ê *›zïè(âÞ·R•0JºSPßh¥$¡ä½ë^ÎÙ[&š 6ÙUäÓ NÖÚª$vKL •ÓKM8ù<{÷uI¢ûŸ¨Wž»V=ä8³ ] ËߺŽ(í”ÌåyYh*{W².a{R{÷iØfÅæ$‘Ìb“ÎòFeP¼R!2Îg‘u !@CËï/F}“•2Ñ:û>£¬ÍiʶTz(º í‘ñLB†VÑž°þ„or¡G2Ã@•h–ö¸ äˆ’”FÈ_X¦ÄÅÇ‘›®Ò+ŒT}·´!?HÚq®–¦GÒE>³¢/ugi@j±GË\OAÁ³ªèJ§³¾ŠZ`« YT¸¡aÜYRêÖq{Ž«¬Qö? Ö_AO”›½¡÷ö' èâ  ¤pºÜWöÌÑÑؼ¸­¸uY™6Ê™Ùlœ%N„ìgp@Þ¾ãJê¡i¸Oœ@!•óaÊ:z”ªCå4©R@Û!¾ZJ^Y]‘’âê%D—Ý7LuâŽö ±pLrœvÒåœ=›,c%Fšé$4DEøh¦Ý‹J°0L)ÅuëÈzYiýˆ ƒ^æ¤Äû,l·({ßUiIiñåš^GiÕ`TÐAŠ”E®)c ©`w¥µµHŒZ¬¥å{‚Q×d­"íPô±<ê*±FVhª¢Ìê¥Jg@L\˜,)$pCuòjGm¢YêSÖ!ªŒŒUÌ…áegážTÀn4q‚z´RKË#±”Ÿ±y»²ªƒg~YÒþzoMyRNºJz‚Ä ˆOw%…¦#Ò°‰ÙP -E”ZYMråjsÆ-&º8()œ¦ ó’Èi ²Æö©ûSRTd5ì¨òñ’݇¥ Ç$º«YÇPv[Xè™fVá;}¤Ð” ÖFÆžE[Iªh$EßOVPw=þ<çL ¢ìÓí¹%·Œ‘T%ÈÛºIÑjgL¦»cî}úþlMÓtKGÿcý±)®ZѧÐι€±;GZÆ&žÍó4Ó %?ädïݯ¨âøŒž É{K£ ÉA©œ­**z%±ÐÉ_|fkI²ÙÔXPõ·r,î`TÌâ(5ûìôS­˜©ÍÙ§ÛhZ˜hÚí(ª…5OmÕ‘HêIÁ_Ûå¥õBOcyãìÞ¬SŒ×@ „FZdTTVu—·­–)g=%­¸Û(g¹ &ÁJ#IÙÄîÜ­(¥éw “|Vp–šsË¡ƒ‚Âïž³Š—¶ý”OR¡{ò¶°í÷éU8»™7ŸÝËØå™TPP“Wè8Iåú7B“ÀdYm3’Cl 6Þ¶ÐRvοA«™;Y‡ȹx×HÍ(tÏSJ9`•ÖêiÙ˜šì¬Š«¦J²rf©eüŒ­[”´übŽw3Ê›|µåìöå_î÷4S†TÖÞ}êVÙylÊÌQ6ŒH-Ü“…ªïÙ+©{lŒ?ø(ãðÕ€È %Ý”s Î!Å”eÚÚ–Á»žåsRXë-¢/Ð9ͶæÚ†Ù7œ®¨ôl’‚„IÜeVm“ƒ–„al)ùBgLz¤¦3+ýšH*"ÁM#à•ÃK)Þa¨.!o‚u¥ÛÙPCÆ0>á ^rÝRGÉ)ÿ6)˸“ÏÜŒ¤ô"ÏçU€¼“—\Ãhɧ{áž„n÷¤^y>¾‹ôŠóÁËÞ)£U–YÂôVU››±üU›˜s œ2ÖW“–‘‘ÕpðÙt—Îîñó6–\!e·‹WT×ço­JTöIaF5ßÇ|©¼Ïv ›Ÿ_Ñž¢,/-%£¨áZ˜^ j:Ý Ô„Ë}Y{v+›¬d÷y9Ë:¢ÕŒ2éü]/g9YI))yM‡ôØ£ÝhB8§/ÄßQ>¨šU‹A*@EÃë(£þ™…Ü*»ÂçXÖ÷@Jñ&-uy¢´œ‚~`èÁç .ÈÞ¼EMžH”'Y“ëR)Á+uw7QN°Í Õ¥‰k¢÷1¹· å•÷IQŽ²5ÔœJù­LôTˆ2rzk÷¦mÈ“Y)m›yÂFS–wÄ ù®Q×ÿÏl6zŸ”–¢aäÑAꙫ62ÒDi}ÛŒ‹ylèß  ¤àfߤðª7?q¢@ðTÁ£êÐá'8  ]FkÐdƒJôŽ'ä- }D ¸á–ÈëÂZácT¡b@ša5XŸõCkÀú,¬¶D{«õDGÁÍMµXªöuFåÈX…»±ø§‹ÞfU®Â ZT­æ mq í ½Iª ýHp”`D…Âf£ž8ÁÁ*±½*A›lq}Q-ÂHý¨'N p¯ž%ôX0Œ‚‚‚‚úERPPPPRRRPPPRRRRPPPRÿíæ%Ãÿ™÷ý) ûŸy÷Áÿ™ ê_{¿õŸÊÿÌËユnt°xT{/èç'xµ_ Ä~dmq= ((¨w©–nÐÑûI@ªw0.ƒÐrüim9Øv<íþqiÿ°‚ÊÀ£.Pt ߣ€‚‚z—Þv \mý$ Õ5”—2>®·B^í*Ô·•ƒ8Ô;ÔÊÝ ¢ñS”ê!@ B>ÞDf'Á6ÔÉãÏøÑ¢€K-@ý0>g ê}x?‰=Ÿ¤è|ô/ ¡{Öðñ)Ä~f?|ЖCHAAAAHý‡HŠÕÿµwÒ2­Õª¶¿úr ,€'H!¦2Xìö¥f?&ô¡œ‚‚‚‚‚úh ÅüÊ#ˆ¨à;=îÖç‘›VWýðèƒvõ¯DRé+ÔWKIþÓûq@J4§Q,¯o¤†Ö1.«Eä_±ìµW|‘Ü–q9Ý£Îá€Xv£õm^ŠÐzÇf·ÿ‹«A±¬Æ1/YBí›Ó§  Bê-.÷õNZ»kZj?@­_Z(.³<*‚#H1Àk7–Ó0_Vê×èR`¦Æâ…ÎláX¿É™DiãIä×-µcJxé*o¤†ÉûÚÆRVcºœ+<ô•%2ËçÇðßxºø¿ÿ)Г~j¥jÀ„ÜÁhɺ»PrÅ/ÑÝ£+Ç%l×J=((¨Oy¹oÈ)M:¸LZúç¨\ER˜e=øã#‚Ô mÉùná[dD)ykl¿ÊGÁ„ zËĺÊ{0_?NŒ.83|¤&Ù;Iéì©ë •d~à %ø" {ÁuA }¨ÍKû•¬¡ÊÑû€À1ç–i†§Œ2õ¥/2Æß›/';+n@¸%ŠM߸ÄÝ+õrÄh<ánã G‡ž Bê“„£ù5I))Å…îlQú‡>M¯Éîc~|âŽDRë(C¢·/RÓWTWsû.æ>Úô‹¸‚¢¥fù(m?¤¥¥d%äL¦gDR ©Â¶_•Ö,w>ð›¾ùj…F” yȧÜ% sMÜ$|?§õMu [¥¨ºF^c™Å† Ôž1Éû¨k‹Ë«®Q4øÍ»\í“÷Yø†%ªò*ËLr?ÏÍ8·TÓ뇰•òJRrƳbÑdVü¦kŠ~QAs±Ý>1”Y÷çËJÿaO]ªB’SïvZ”6 R´ÎÉ^I+•Ô%ä5–Ó>Ëå ód ³‚‚ú¤ …:C¾hnûØŒ«?(/r8% !õ^!5][\\ÃsžEä諸72“Pv@!E­[¨¨òcø=úÀÄp–¸røWñy«4ÃQvP[§y~³î¹HfÅ2õðqþHðòHtÌ"©Jè1ÇÓŸÁÓ9ªª?D>%P.-&ÊÍñçŒÉëþ"„¼F3á‹ì^­ñ;••Ö%HÈó…þ÷ko¡±O.g‘’Á7ë¹Õ‹T fÆ=ÍkúÖ!àwÿ«"™%+‰š?…^¥öLr”V+-ã#÷þäÇÅ"¦¿)ˆÏ }N(x0_zÍR«íãsûƦœ[ª`<5£{¬R`|ìÖÕj“Ò; ´Öæ†â&G±!À½*(©O R´žÏcJ'æ h5&:T\;a<BêýFRKÍ‹¾‰87%ü씈‹S|CÖ(Ù…Ä8‰)*>ŸçaÍÈ—«êüsz)Qv¾ã¶/Ó:°´L0&½|™zØxtB‡ÇÞ©Ÿ4—x=@Ó˜¼o µ~ZÛ€BJÑ|ʺn}p†ƒõÿËè$%$H*MD¾žWÿ³™3^IÈ)IËZLKìK\­3Að³¡õ‹ÐI-W_;!ý]‰…çJ)%CÌ£=üÎ>h)K¥çy?D!%+óKX ¶›Öú‹‘Îœ¨gbI{úÚÛm‰ëiá a UJÚõ ôTPRŸ¤Z~6Ô\áta ¥O„ÚþµÖ “McpIÑù"ä:ÿÖ©9m"Ô^Ü,½y¹Ï½ÛÄI¥¢Ë} ³VRmíD*Mä]_¨¦6;ˆ¤•Î6w[¡BZ­9)³G4cRÃçåè,EÚ)R8† ’ý- µØ÷éKZ¤lõuz>0ÃÁXRž´RE•ŠÞ*5óÅF‰(¿)I®°989ýñïʺ3ÆD‰ë$&Û“"… 'ËüÖÌb볜^«ûu©?¼’ýI8AkÿÉDo^ÄÓ1Ãò´’’U_%<ºÙµ_åAO!õÉ-÷I½0WËd¥ºùr5ý•Úq“Ózqµ'ÕÌK‡‚ú$'û¼!ñ?üiz%»÷¢ø'¤ñ2ºféÈ/t:2.ëÑLW ã]ã#ÂÅÕ‚&'?¿Ž;WKû÷°{„¬š% Óc/£Œ^mžE"Jh„Í+P°T^r‘–˜ñfHåóÇ$ì[%gòCTÃØŒ+?马²8K`6,”“YäY=6íÂ< Eªš³Ö^'ÐZgkÊÿázì³Äòyšs×ÞÉ|%’böÌ22^es|löŸ-b× .²;C`ÜŸ/-.®Ÿ8)­é‹Ð< Å€Ïr‡'ø¢i—*èþvulæ­Lô% ‰À=)()øì>œA ·ú;H1Á׎A?†Ü©É88Ï2û³<´¥¹áG›àEznóí6¡` Nò'/0p_¤ïó‹ßE$Ò¡uNõL^¤ë3#cøŒ â©çS=Óz,4 ÿqm½0MŽÙ=Í>üçˆVX þd·øéqOÔ»?Yg|ž5 0f\Üþ¹F®Kt½ç¸ŸÃV E“Î5pYlœ4%ƒ71ŒºØ k"ˆdÕÿlé¿Hßk¶o©ˆf×ÏvØ0–‚Fµ¢ æ[íD¿›Á™mæ½Ø øÛ¸&Ѥ ô£&¥]ýÑ6éÔÅzžs÷ûÿ¸o B B Bê)ÁHÌQ÷ 3ôFß÷„-µ1G6€Ð·,0’4ºãi8¨ýÅá–Ãmd¼ø:¨sA%côùÂ;§† `Œº»Š9Ü9ÿ…Nò‡îrÊ®7bLÞQ%|;\ÿÂw_wtè©  ¤ ¤ ¤Þc$!!!!!!!!õ,Ý@ïø²|…7}Q΀›m@$ÆÖ8&¸Ò Žã{PPPïLˆÇV<8Ÿ¤x|ð¬¯zÞúAc7Ž‡€±E{¾Gõ.ÕÖ šº? H ðÀÉ°¡l¬Á™›Kî‚ö^PÈÅŸñ£U\ÚzÀ_ øÔ»ô~Gn€g]Ÿ ¤]ô _‰3!6#xE.'rËñgühQØ ¥Æç,@AA½ï·ç h„‚‚‚‚‚‚ú@ UÁGþ2ª@A-*V• †Ha¦2k0ûkƒƒŸ!!õo")úÙn®¶ ŠJrŠjZîE©pI ìÏضÇ@WC^YUAÛÙoóŒ\x†_KÚ{5iªäý·³J0øòßxZÐO\ôý¿šD½Ð’z´iÔøԒ攃´á6ƒÙÇï¤í{›g¦/ý@¹”÷OͳÝL?;ðBeEwÚ;ye|èÍ  ¤>H1*»ý½-<÷fžëÊ;}ÃIOB?ŠKçâf¹QvIOŽèH¹D>ߟ›%§Ÿ‰óå>fð×_$§ëcíŸdíglf¢b}0Naà^Z¼bú©j—̺üªÿnRÚæõŠ–TÊ(H¥±RªëÈÃ}²;Ü]´5sî¼é( ùÿ-BdrnÈ)úíêys3VM›ƒ†¤vF#«z¤’QVER0ˆ<Ò½„ÔÇ´ÜG+룲±E³z㡤p††HåWt¥l¼¦:§®ê–X†ß 4•4‰­Dâ:›Çä4¹è+ª×0jÐUY$¤bV CEä-“à‹ä …Šv‡X—„á˜à#$¶^¿E^·Ö¼ØCúÖͪvÌÑJ/,’ÕÊÊ)OO¼ûH·\”›£ú® jÐAq†úç He2— ã Õ`¢J ÜÓ?Ò¬£3wÔˆHU·9é*éç4ÖT2ÊjuÕ,¢Žö,chM B ω}ÉNÄÇ©éú„z@J°´%°– rRUì7P¸ø^îB*ŽCãßF¹ª*9e^i·’_®GR³ 9ÕŸL§jëê«é«è¹{m¸O;ÛJ[ZJŽ¤m“ô×=77G’ª–¾¦]Nüi> ò¾£¦Æ†*$m=gßM‘`9cë}¬k‡l.µâÿ©Âê¾@o;Eÿ-®>ÞZzÚ $ägÃ/¬}`"¹XÇ'YUÕ9ò~PPR©®ðÄ keƒàðøÔP ¦³²ÕHv¡ÚÑKzüGRfI— .ƒ¢z@;^¢+¿Ú$ïYÑ¥vG-9§Mçy´³eÚª;žÑ+ÒXùrªA)`9CÖj?³žá-ïügv?¿¢=ÈEEÝ㽦ÑZcyÎM*{ mS¡¡ƒ\zÍDIÚžvA@öÞ¿Hê6Q§ú3þê õ‘ÔZ—R ë­dtÃ8¬úgVJ’ºÁ‡²/ ’žP'9Eh¥WôÄ&ÊšSjA涿|×óëAqm“º„5½­ ê®…š”-ý.µ¼?¹€f°Ên0’!š''_ÈܶGY=8µœŸwìŠ^¥ ×÷ûX««E7]îp6P—3!¯+ ^xälªlG¾”@JÝ*îø]MI£¤»äÃõu¬¢Žv c. B ·Ù}C«.5`]’™ªƒŒ›tA$ÅK&ljæA‡y áÆ Þ!µJ|” HJÈéG§Uƒ‚šVG’ŒAê#f- lV0ŠL»ˆµ?SARÑð< ÒrÓe-÷1¸Ït-Ö?e!e n^+oydŸµµÒ¶ßÞžµ}ËÿRÁîŠU¬ZÀ¨ñÁZZ¾'uMÖÊÒvù-ŒjÁ Rseû†G÷ÈÍ#/VÙ]o?eeYyy)¢ŒeúÖñ r2ÆçFïI5«hüÙ…&r­ÔÒòH,å3Ùma‰ êjȉ’+=«Š®t:ë)iÅßcÖ ¡tlŠ­vä :) ›¸­[å‰ÚÁØ`éå=îîÆNî3¡‹ƒ‚Â)¤ÊÛƒ’ò‚÷T¡Ê+P4IÈ(ÃÍrâ Ò6ªëûDžEÕÂ¥?:ö Þ©5†ág²Î´fŸn£V¢©õù€…BJÚ8·TÞ…¡ib–Tk«©:à !Åi³·Õ¶ÛÚÌâ 0¢íˆ—× MÛ·U†h^"„ÒsOQÞ>®;hY“½­Žå¦ÖìW •Q´^N=%§Z°åÄÏ/ïpwÓק?@J)´–Uó"¤T¤‹;H¥ÓÝ¥dI$;-[-3gë°¨³=>®¦ .[ÒJXu½^zR¦©OY‡h22ÑhB)¶+Z X\tO*`wÏhH%äÄËÆÇï`Ö †ºêÉ{ rÒUÒËÄ'8 >Ý…vD©˜…ÒRrjÆöè¡MìtÌ}<·=ú   ¤Þ˜Ý×dOÔŽŽÜ÷0}Ïi35ºa¥xIœ@7âË®šhh:QªÓÞK;r7õð£<6ÿ‘”¤iüèK>–Ï6©@;¼AQÝ+¥ƒò‘3ª²&áçA*9MÖæ «¶ÏËÝB+ýnQ-ÚUVšµ’)™r±BMBÖ}/@\:£ü®{Ü.òñCÊ’šÁG±ýÇ Ìt´ýugn{RÔÇ•å´ýÿhoÈeLiƒ¡ª¦ÏþvƒÔÚ¿äì ©XeËÐ FE_n/¿ôž™±¶ë!^a (./×”&Z¤?-¼xZEBÙï0Ú9íüu·„Cyå·^XnnJ®CbÃBÎ#K}%EÏšâ«Îú*ª~V=zq¬g’x[;P¢±FÎë òÛFmZy &N@AHáRÈ¿bfekP˜Ÿ‚´””¬†qÄQ2÷CŸ¦‘HŠè ä×¥ee¥eɬY¥…xT&ïZ3œ81*éºÕQƒT2ðsãè#iG®{xÙ(yÎG‚—|Š¬jxÔ†f¾œœ•ïÖÛ©ÛviÊÊZÓ[X—A”¯¶¢IbÔŽj/ ÷â¼j⦦éZ|äîÚ¸@ó윲W'£ª/4Ж(ké’}<4o³±¶Œº×æ¼r>ƒÓ¿6Èíµr@ ÅAˆóÀR_Ó:õ\êáë¾~öD³-ÔšnOse¯}iGê<â­etýŽ f„yh¨ÚdÅìäº9ëêï§WÞF—û„ªDRñ9± æYIGïĦ[+È1s*[œ 4¥uœ|7ÞZ·u‹º¼®ÿŽç‚ĉ˜Sü˜`}%³u±îų6¨iØGí„þ B ¯Â䘵 è2ª‚Z<=q‚Ž-÷ ,“ÃÇõr£Ä%¥øÝ}isYÕê·½»cPÏ6xG$YxFÙ'ÉAs$@þù»¾‘묂hëÊAÚÆݶ^afÞëüÖc»6HÈÌí [—cén·/»_›ÎnNÌ°ð·ŽØ²î4š¶s¨Ü5½d8îü6 jx‰¬mv~ÑÞIäR2[â>˜Hßìœ ¯ª@:=σr9¿º#(<5tŸð§¼—}ñv¤×¶~e¨Fx_Òðq_êM/ÁmPÃÆ_cm†¼áˆ0|¬Wš½Üþ…6C_dpFýæ¨öùÜÑ_Ë}PRRRÿ£Ç"AAAAAHAHAHAAAAHAHAHAHAAAAHýß!uð: UàR'oÖ^@.ëýå•£:tߣ€‚‚z—Ú}ùSÔ Ô>çï‚ó÷ð¦»àZèìçîàÐøQ*¹ :úÀ¥F| ê]z¿š' ©ûS‰¤*Á™G¸Ô•VR=Ä«ý~:úAm3¾Gõ.UÝî>ÿ$ Õ5döB..¥w \k„L¼Ú/T6¨krûq> ((¨w¨Å;ûé§)ÕC€@„|¼‰ÌN‚mØ”åãYp©¨Æç,@AA½ï'±]ƒ‚‚‚‚‚‚ú …ˆÁK»úudÉ”(öçéíRÉǤvRÛ?+Ÿyþëøëc¨¼Úø„b<"& °†„¼þo3‚võâב>óùoë,ѱÃ1ÿÉ`Á§Ì7Ö@AAAHa.e\Ô¦åJ¦óh?Ûøˆ+Ù|—Ðú|@ ±¿w¦¥õRýˆŸ\) tŒ–8žºJüFRLðµ£ï"¯Eúî‹ô=š&MOhûWn™µ‚›±';†Ìö¿92¡¹œßLÂ&g¿½qñ&FîšëUùÏ?!ÊõÙ6”‰äÁáÑ,îÇmbÈeôEPPR#‘ÔóÌm=FÝ`˜b"¿Ôú¤^ …¼Í>´LÕé+ÌëŽI<¶JÁç3Ηû À í5K,·~ËS6Ó9XrÂɼ׸ý—°•²g¥ñ¡¥‚™Ú2Kí¹#JÎÑUD…oÓ_µ‡ÿr@ôš¸Œÿú`íEH}韶ÚüȨ˜èo¢¶\öRU·/³†kÄÒŽ­ÐŠ—Ç{ÝÑ¡ƒ‚‚ú„÷¤ °eDÔ'?hÉüáQŸH ó~E‚e¢ÁÏBY«H©có?HIÎw¯®ÔzÊ«MÏ¢ôa LŒ;?=hÿôsŸea/µiR4糸ÒAGg:­ÑˆŸ^:vÓ©™à³è3“ÒÛ¾ˆ<6#ðàä„{"è‰m›qþóîô ³ã°u±)ÜiAûgŸþ<³Gø“ 4N ?>=èÀ´ÎXÊàPtsJÈÁéÁ'¿Èè@j•Õ±±É§îŸuiŒp\_DŸFj¦¯-™˜Ý‡ö†@JÍmrlÕ4¤·°²q0fRù@$çþäÐÃ3‚ŽLNxø¡¯?CAAH½‹Ä‰ÖõtV)è,t)CÿЧéåÄ ÿsß´å&+HASRÚq¿Ü'€”GÈ…"0Õ@eµÉYB1øÌÛo•ªç÷AǾuY»R#ü‹,¾™½DVz©yÖwþ‡¾µ÷—ÒX7%¶FìŸ 5#«ÿGÒïCÊ&…2—+˜OOè!Я.”^½Ü4åßãèÇDÒWÊÎö9<Ó-r•²ó7HðÅêùN_m©IÎŒà¿X8-r:,Bç‹d]šO2Ÿëºí;×´Y6ÿóÀq5‹ùvÅ3üËäUÿ𾇠a²µ‰¸zø·ÁG¿wò[¡—41™¾ŠeÒÄe¦ßúïþMß|¥ù1±Œ“BH‘ïÍÑÑ_è°yZàÆÅjFs›±ÕN裠 ¤>eH ŽO®›HYI”žÚˆ³H ½˜øeÜ…ŸÍ¬VoCÿ"©5 œKÄr;ÄÈÍ_„ÑÅe”JDâ‹ËKˆR¿Eõcï{#Ù¡7dÎri“)©©? H_£·‹ó‡VáþRßë‘ÄÍΣY`†Ê¯× ô‹dT¿z‚ä¦ÙÚZË|£ Á×–j œÎ‰äóÆfÜ›Ó%š×3.áØJ„±TðEpÊJ«Ýè†Ñ3Õ-sVtëçA™RÊÙcXè@>w0×ûS„ÆdÝŸÕ)JéÍm˜¯b45¹‰¤VH|“܆-T\-m>=éô2íx$¤š•+®GÅ¢9±à¢Âºq,è   >Ù=©A±¬Æ14lÛ½ŒYë.®:Ž†ŸHŠÒ:.«s’€wu‰¢æé¼²ÿRÓµW¯Q±]dàµÐÀûÓ„o£¡k}{Öµf åþ<(cRnÈŒl%O¯&jÏÌÄîwˆÎ J™NKì$äV¬Òÿ¡ç˜øí²®SÖYŽ-÷‹-^a-HÌͺùeês˜;õIßÌËœ}x–3ùç‚éÑ·ÿù–œlOJ$ïþtoÖÏÎy³|ŽNÈÙ‘Á-¤fj,^èÌ~áRA@œÈüÅêVó¬æ9,¶(ŸDÈìåŠö_¢Ë}@,nÇjýùv´Ïs‡s¿.tNw \¦i»ÐÐw1É|¹AÂ×™|«s–†ÌJ·ûHÍ0›ëSO _[,«6=ƒˆ¤ýCÓbyì\ó %$·™ñ­ú½Ù::Ë Â~³Ží´a‘ªÖ‡Ãc(2±[j2ÏÈe…^Ò—¹ü/}Ö˜@j¢³”f±HA÷wfæ«5ý³‰ë¸çg#íåF…ãsJWH+üa•ò›uübM³?>G <ûÞÚk±QèoÖ1‹HÖó¼jàM¾PPŸ0¤^qét>n •^ó®'ð!§Q,¯ïåû˜Ðf¾ %0˜U ˜Üø|)(((©„ñíÕ±™:úFj†®Ž9µô”Sx‚BUä/ûŽ©[ðŸñIaWÌzPtù1+?ì+‡Jô:§°½Z ¿Ÿ_?¿ Õ /ºþ¾%z ê£rè´WðQËë†~EoßNô_\(º$¸ úæ;cˆ=ÜQö¼ÛÓ!õ¦HŠÃKH •Rô Ür-±°H•(n™û„ÁÅÙr£Äé®”ÐöÙtïË}Ì:ào°hÕjI"Qšˆ)ÉÕZAgPŸ–?ìZ+ßs£—wç^øûéÌ»ÐK¯ä'ÑsUÜw翯_dçFK¨dçÔýCKê_Wt5lãÎõ1†j’yŠŽ[èœ> µ´‹Zþÿ{æ™ìÌÔ¥”ô÷ | ÊâÞ0–óý³wtåºõ…*Žièåß@Þ…>ú"2¥´›ö_\AHád¹¯'*wcÀþþ¢Pp $x)’¼ŽRñ)>â r6PåõRì½ì¼6Üù hºÆ0쯌SϲN>E”y²i̬ÕèE8º$‹­m֣׺È°àr]³­Ãj†®ÈœV&Öù.rí!lÀY tÂà`á3Ò %¾°é³s\eÝ._ÅN55`ø+¨å§j´lèôz@/mË<Ý)˜ ¡%õho‚ uقñªGùdÌŒ‚Zltõ#¶¡T ;½ͬ5gdÔhÍ%@¦%IyäZ¤ûný‹ßå{cœ½a ã®R,ºŠëN†àTÔ"£1X` r‘“Œ„·~^Vk÷Ÿ=áH«…V¿‹Z5bgÕ¨u ìm×.9E¿$ää×`Zûú E/½¸¯Lh56¡5 ªn$b¾4¡œ'”ŸDÕŸèT[|mdXÜ[FŠªþ{ùà v–>Ï<ýæ‘3ªÖ›™W„£Ë¯|á|¢gŒ^5;9œn[§àÔóÈd}ÐëRþr_>Gx-JÞL[Vʱ¸ G‘úã/¹cfìx¤+ÀÇÂó#”¤I—>jœþˆØ8S2ÛÅÚÈ.¯.ÿÂeG'eUuãÀ]­Ø ò’ IZZ*FÁ¡¹…šV r Š4¥Ôú¸[*(ê[¬«IßµGKKSÅ0(ìzÍL/{ìá嬬¦©nw­Éüó iäîÈ„PeU5Ë„¸ó {ón’’QV]?x3™ ('.ZYš)!_±IŒ;Ö“ÏiqÖ#JÉ((ªÙxPw„G,aTñ’ètm-Myuc³˜SÔ·¹Y™ÛÒ«ì¬Õt­’ÎæD€zšcî•–š¦®ª¦b~¼‹¹»Äœ,-’†‚†µ#µ¡'¿¢Å×ßCEMCÕ,2òP6êE]SKÕ,,(*D)V-/.-YSS]dïÊz€¸eä(yÇKLMôÔÌRŽ軽©|u¯-aÑþÊJšNÔT6j°»­µUA;‚F?ÈÓÎoËÝ'=¢´´Œ´–Û¾>–0ìâ%PóMÒÊÂ"½•”T4r“Ë1²sÛB|TÔÔ”tÝ}ÖߣsG ¶ä¦…†¤”´‚’®¹¥w’iv©»‘u;ÿâug{dB• }·7 ÒÔ›µµµ•õ}ƒs·hYQ³«ATb’in•¿—µ‚¢®i7sÿa]m’²žoÈÞôl°Ÿyûº)«i¨YÄDéFj²œ4[»)2)™PU³è˜³<òΣ:ÊÈ„ªéú0³Ë‡#©[ÆJ*Î)[õ´u”uý¶=D*Ó·þi¸ŸVþØN[JJFQYË%ºdè_Ð073RPVG~ ‘Çù(þ¸!¾ªjêè/po'«®Ï×\IJZVVNßï¸p Bê?g÷18ͤU’ FIÕ4·>MCÂv8 >'Á(ê8£rÐ×Ûü£”é+ ‹’Õ4s¦_Ë­è ´ÓÐñÛŸYÒ™ÌÌTÒ XwPþâhÉkxm¼›}à‚™¾´„jFN]ëKTs>¶ÈHHèømÉ« ±æêÎ…”ª_i ÍçÚ£×…)š§e]ägìØ¥HT°¦4Ôú;ëK;že]¡® Þ\ÄÕ3«;=LU-/ä”´E¦„*;2óØü¬m{• 3ÉìÁ$zž`¹/c}¡œ¼mà®Æ¼“Uæê’ê¡5—;ueMÂãÏæÙ‹Z z!»ÚGÎÃé2M©5ÆÉlFˆŠö‘4ÝE¯©äI9‡à½-9ûkI‹Û´±êxÁŽrÊöùigŸÇ“õCSKø¹‡Ïj(ìxœs¸ÜÌP^R3/÷HNñ_£à~°=kןšÒD×ͬê&{õ•ÆÑgÉ%O,Å¥\FC*¥°@^RÖ$©4ëä5GceYû#ŒËöÚJ”VRÕ<+U—ü»ùì$½àmØ|ñ…"gËÈi97Õ=w1Uñ¯f]¡n*r&Ù)gºÒ7oP‘7Ù34Xì‹äMäÕã2¸ü¨øhYu#Gê•\vgˆ“ÉãÏŒ’®uE¹Jš®‰§í\½ž¼’[áÍœ#–†²ÊÉYµ 2&Œ¨lppydœ¤É£\ ’­U¬rs«øö²ªNégŸÇeÅ*Ť_àgï;¬,%k‘s•U‚¼Ì¥lO2/ 9·rdBé#Ë}· ¥V*Ùg&iŒ%§K+®+奮/TuÚH«ä§+˜°(Áæ€W ‘Ñ0ór^i{Ì:5óL aîÊòf™)§;’ó3”Hî §)§kuµ=Ov:cPRÿ%’Bâ&$§”´f®q¶T4ˆ,¡rpIqýä #ÓÀäRt':ÐÏÒg{Saõ{Û¾ÿßAJ\É8Ø.8Í.8Õ.8Å&pkVó‘¶>¼Œ­ä”Þ'osÊs ORRs‰;ÎÏÚ«l—›ËFg3!5VJ-…T›œ{YÁ%PTuK_Šh¿¡—Y òö±Ô¬ÓÉÇö(JëGžÅWOŸ[™íÍÚ±CQ?#†@VVQ›šwq>¤êXØ^õì͵™]"óìýC¤µ’²ËxÙ;(æ ‘‘RœÀµöÚ)µ…5èÊ­8DF5 £ºÇI[V7þ6 j¸ƒžÖÚžî‚ÔE uÏ”3Èlþ?öÎ<ª£ë㛇¶¼@ Tx¡H)-Ntw“¬gãîîîîîY×wwˆ{ ´¸…Äæ»w%Y miû~m.ÏÿɳܽwæÌÌÍüæÌœ™0Ö ´©YÅ-½Þn–V¢žÍWÁºƒáFqÛÀ9{‚¤¥}¬ƒ >¼\¬B÷>/ÄSÖ³Åó{ÙÙ±h&³õ‘“¥Ý& y–Và`zs|3NÛ"ñ \u¬ŠC¢û+ñtLè,˜Â€·%£í‘ÓÔçñ:¤šî9™ÇìêÏwI=©ŒÒ|Çí^!_¯ Õï¸WßLEã|öÁórP5F‡™Ù—´È‡m06oÂég·ƒ”Œ8¬Ã^¾¤Ako'2¶ùA š”G¦¸$¤oÍ&Úç×à šC/ijaH%GèzW ÚvÝ‹v*ë¶Îáuz6)Åǵ â*ÅõÓÑïæ`¾ÿ9}ßA’IF©ø­(e¥¢ J!ˆ'…9êú·ˆttºÏR‡à¿ö!ÜTß²3Ó÷ßßG[_.†(\»o»–ÏIJ .¬¿jCÒ5O?•w¢§ìàÔ¼ž«¤hB*ÀúËðìké¿áçìE3“ œSýr5†Ô‡TËì- ùUƒðïl+`lŒ%ØfÒêRPϬ·F­ƒ'éâ‰ÚÚX,ZÝœ~ž®WlHiù ãD§ãE§â…'ãDmÌ–¡øØ bt ÔÏ ÛŸúYSô<8©»®äìª4Õ÷H?hloý€u¤ ®¾THÇê‹=©H_bÜyx±£í'R>»†Pï-£ºÐJv”hªki‹ëM×X©á¶íYÉŽíg.S)W\ƒ1bÊ Õ!„î¸Ì#·dì¹’Q¶•dœCjûþW ÕÔbîÈ» Oï@=Þ¾R¢{V}¯—‘ŽeéCx¦ùe€«iàºëò2‚œÁ3ðR>}©Œ¢†'nX]¢Ø6’Ž¶Ñ1¿x_9Z-3˜ ¹ZÝiýƒü7ÃÈ]PMBy3Ó1†LFÃM[[ '{«¡çWÆØY€Á{fÔH',Œ½~±&EòÞN4Á!¡ŽŽUJu¤†eº+†Ôs¹ÆÊ(É'… 9?Ý︕sú°.Ö$Zè’æfšU%ß¾ŒM›pÔÌ¢vœC«@ ÚÖho@r¡'ï¼’»·ÆBß>ñÐp‰ÐŸâÁøWËú2*ìI%&…£š w ¬í)íCP•²mгI¥íäiiÈÕÏ*uç ÷ûêÙÓèuCp` ; cPL—BªYx^>p^“ Nðkï8;:mé*Ú0©õx›r1¤d‚X¬ÞÍÃIW­cà±³Wt|»«“äNÔRU·e]æB2Ì9õ ©¿4ÝWÿÈËU_?½‰]×Ï©ïMŽ6ÑóZGWœÍ¼œª§Å§–œzTrúA€µ§Q3( ŠVì龌6ˆðÈV¢æ~R1mð:ûñ:Z†1çÄ+û•uú$wR¢H¨'•@*¿$#ñ¤~©Ý2H9–ڄ׶Š;ÚK?ûR陧Ìz@Û¶âò&H…œvÂÄÁâ]3ê`{JvïÂég”Ö C²¢Ë{RÑNæEÂxÌÃÙœ¢M)héó2Ò~{H7w{ºY:®³«žÑ+!=¦WNîÁ£"õ1`ƒŸ•žyÂl¹¬jÈ&¨&!Ÿ%77ö¤Zî;X;¯¿?ú,Ħƒ\]Ûä³â쎷‘_õ¤„<¼C§ELÕ]4ŒŽ[VCŸ‡ Ñ‚ñXÓg Кè; ©î‘}y£jÔnu5K8 àh±±Ö¶´Æ_ƒ1¢nÐqhýÈJ±óUÝbD´O:4\º>ŽäRT"ž.(ä0´)Ù¿ ©”¢Ã»ðÓèÃrõSJöþ ¤^ó¤p¤ Íp˜¯ú–½•‘÷î^š<¤F=)qÄHC?³fHtˆš{Ò ¢u¨>9GN’ÐÔý½LqîôÊ'̺ave§œ'…L÷!úÓ!耾ﴕÕÊÃØʆb —׬(kRÃ’qXÃÁ¾&þk¯ñ›€BüFü^àD³üâ <¤DgOÕp~Û{xU?†ëâ’õ2"“œusÎ|çáb¨IùMH9å”Ö?ò4ÃØå4²Aéj×H­fèJô7Óq=Ì€¼ŒŠÍºš&1‡Ø';¼=]Ф¨üš¡ÒIú ùgŸg°%kRùÜR㤠¨kª½ék«K ©\ìùcj陑ڶŒÜ³C¼º‡1‰q>ìëÂög~VZæÉç 61Ž¶xD2ó*Köì&Q<“=e¼èæ¤/Y“JŠõÐvTnÍÈø¸ ò»‚¦«V:ªÎ%YµO2´ÐÞ¯®I µÑæ›~æ5wGZ`m7q.0<)¤Jx”nÛ@Ñ!ù ®óš8é‘CÖ]‡ºß_zR#rØÌéìvЦî§7úÁ“¦zF‘;þ¤ OJTuŽ¢¡ë1¢æFpx8g»§‹]qB`»÷÷ÜÞž¦Äß„”uBQýS -«´¨~è‡Ü#¹ùçß©ä0¬ã>FÓàÈ‹'^“Ò0‰Ú]RŠ¶í ’ý2«† ¤kR€¶n#Î(‡VÓËn•âTƒµs|̾ÇÐP°d›€HrË®î ²ÃFWÐóD§O$-³¢}ö²Å!éÀ}V=ÂR-º¯i˜S÷’UÓ‰]7Èý{wmüïŽE‚Jñ‚Ó0ôNDX­±Nmú¤â¢ýðQðtÔ%fÓâu5×`õˆ·VÃÅæ5 &fDkcµtƒÃRÓ±†E¤bÃ=ñ1bHýhª®æ-™îÛ# Û¥ÕBI»³½1ƒÖ&Ùû .qm뢋Ùoä,*ŽÐÔ/¥_¬m¼ª:É[Ú0œœâ¯­±FÇ$©6¹Fi—yñ ;_iÇÑ2Â÷Ëž…ËÜß7hCwææVÈ1j>3/IÇe7§C\.YƒŠF´y´AQ?²¶–È!kÐ2YƒŽœ8UŽPVi’gGNœibÙv'qa[¥õY.wT…4÷‹£[á TcBdŸ)Rïý³œÚ‡ÁáÎÆ6NT»Ø¸CÏá-–ÈïµâvGõOâC ÌŒmœ©6‘1ûžð›E …@ ”bB ¦Šäò’8ÈïµBêµÖD)R íI!B„Ô;©}—½Nñþ6%]ö—yi þ—y‹kÁ#ä/ó"B„èô~Û/€{Ý句†áò~·BêÙ Ð?·Ô}Ed?TŠ§}Š] Dˆý‚ÆçÏ_¼z1Ø ¢D*š ›7^wz@P•â/¯jp».)v)!Bôwö~ôóàòã÷R=€x ØÅQ4±M¸ò JÐxy1Á…Ç€|HÁK¢¿±÷SÝ ï¿/¢@Ý# xŠ&.°;®>(†//è| ¨‡³!BôOô~{H!B …"RÿHq‡áŸB€*K ¹2¬’/’_&þüo6"DˆHýQOŠyí {wu´6y¹ãæ l…ò¤øÝó𠱜¦^S‹6Û¤ÄWhOJ:BP¦?_pc¤Â»*¬!qÁÿ•ðµjhLÑíñôþ?•Èà˜âŸ'ÜRa¿^Ʊ…7Æ2‡Än‘TÅoˆÝ7Žö@ á>"Rï¤zg:9jØn›Pú\¥¨sžú·>m(¾â@Šw¡žÑ씟ǔ>Åx¡ØÓ}âÏ*y¿1qþÆ6y¡sê·Æv«,‹¦°þLEI©÷‡mþcVΉºŽ½üØ3aQÌ=Øÿ£9Òª—¨K]Òù•àñÖþŸ§¿@‰n-A¯šŸÔóÛ/§r^¥*Î2éÐ!zw¦û”™ÏUØâj9øиÂå”’AŠ{m1ÙbFÞË7ísºO>¶ÐýÆ»V™3„â¡8ט/Šy(íüâ¹YH|YI…²RóÅŸ¡Ùm|Ù#"¹Û䑯.I ’¯r‰ÿvv0.,FöµV–Wv¿Pœ¯@æòå’J.JÓTÎØ¡AÊ[öj²é\I²ÂÛ‹u±óRzÞP r¦*Ô¬"‡OB …Ô»8Ñ?1£öãà¼5dï jºsq)Ñ|VÊwd^˜’{CLÛaÅXåù5OJ4ü‰™ö2·#cYƒpoÌ—­òraÕ"cK5¢¡:Ñò+¿c8@©ä´*Ákr)쀌gcu3ÇÀ ÷@UÑW& Û” ª™X¨(jz^Ÿ¦ü %¢’wz±±¹ÉHâ:'î;xfLfÀ„”õkÌãæ›Z,·ŽîÌ=þµ¡™ÑHl7?¤N™ ÆæìRÓOË‚Ò¯‹gŽ/¨[†×Äè|ëT°À€ªêwUÞ3W·Æsß|k·5$’ªIîd:Œ¤)¹ª8ŠÙi{‘>pÄÙQbþ¸ˆ‚Å`ªî3“›X8© Õ †+6Ž‡îÝù½lq\7Jô³R/PôKs­Õˆê³¯}O?%2O'¾È5_•…@ ©wRÝ{g,¶t_cœ:µpP‘ Å®_£¶z™]ö—yßZ¯p> ÌWgê×<)>“³o9‰´Ú(à+çâÙ±Í*â‹(þýùzèå>,”‹/,¦~–zUzn¥^ȤRØ“(Ò$Bú_<š3•9÷æéi- ìPæ LH.³*˺½¤µ$¨M™;<.ûè =ŸJúFföƧïT×v˜™uO‰3ˆâß\DÔø:øD±1ùµKÉÖçwÉÛ¿Ú$O©q‘éh=¾r˜êî­eÛ€Z7ð¹¹ùª ›¨²¾ÏÌLµŒÙ0b„O!`}}Ŭ[¡Cþ4í!ŠÝ5Ã7‹˜ÄõãTÒ¶h2Ç Á˜Ì3Ÿ‡7‰}¢ÇóÈšß„?D•Ý_„C/Lè‘@ê¿©÷g[«Û„M¿¼@?7îg«^š8§wjH†@ ©w0; ×'ûÛ®±Q Hq‡”Øý(ñ̘­~%Þp6mH1Þ·_ œwÝìç““~i ®­ŽÑöš^P%GÕ0zŸÒ¤w~âiûMhÛ›!å¥a_ Oµ•QÃÌ*–µ/”ráF ¬Åt†d2­{ž•ÕœŒ‡#¹Oß®j\ª"AàÄ¥‚AÃð_c‚ºåTÉ-ŒÉ'¥Ò;gø¸, júHEª¹6ÀÏÒvjbL?.]íBåñ0ZÚªT»ÕTÛÕT»Uú>_ÈC*mûs®²dý(ÁØL“Ωö~îhõuìuåü·ƒ”‰ÁÊÀ[rú^)-N‹7QÌåÜÊÕ$™'%–RãÃ3<ü5ÍX“!çNôr¶‘öJ¯× {n¹I"±ßf•¡×‚°zåÔD49b[8qn ñ¤!z§¢û>qqÖÒÏžšww|nÕWôr÷³Š8A¯\3™{alñÏÓâ1ÄĉŠÒAýÚt³å+³Ð²À€u`Š³‰†ÉV÷üJ´ö¼L ‰‹˜mc¸ ú2Š^=© 1L-¢RÞbHA³WiiÏÍ’*Üû4`ÇXÚÉ5Z¤Y…bÇŠ”Ø/ä§FG!ý—qf&þ³r3×ÐÏü ðþ1…êÏ ûQ¬_õ?M»ƒb\›ke M ½)˜êb¢a65ëò,g[UóÒ1|0ÍÉ`kráÝâÊ×ýÅkR¯AJlÆ4=UsÆdÚ½©áézqéƒÊÅíËðÖç=S*>¿Ð„ˆCêŸ@4¥xJñµ9fo†TØÿçExìWUãó›æ›èiëF½É“œéê­n·c|ñ_¸f/2À¬¶Ý§$¸+©¹i/&¢q¡ÓsîLÈ<±„Lš{Å{°€¨µÄçÈÄœ–y–†Ú:‘¤!z×NœÁñç°D uâÄHl³Äø2¹Hi…^“ |Uö•mÔ7Ö‘‹]XÓsŸ‹— ë}Ó‚‹¾¶ þÆ¡xZn—¤°Òö|eú}á´„ã =¨@>Nì†ùßË陘¿Ä*ø+÷M“èÒ ™yK¬B—ØNÏy(·£ ŒÉ«ýÒ¿B ®@I„d×Çþ¹K¬B–8³?,ìß90%aã×Ö¡Kœ9%ìúÊã¸2”KIË<‡ØEÞå³}Šç%>D û§ùæÎMx$ñø> Ε|^-*87ß!ò»ÂñÇWSâ'È•Z9·j¡Û. ¨’+_¸Äc÷iò-¥ü#_Ù¤LϾ<Û%yVÖ ”ðñ§Î)Ÿä¼„^Ñ)1‚ÅÖÁßX'wYI™¯RX;ߪ®´™ñ ÿõ‡""RÈÙ}ÿŠÍ¼ «_›î“@–/Ö“n9ð_½(…/Û[ÄuÑo<"¿iwä+Þ¯ÜùkÙñäþËÒM#H>óͱpÿ"áçù Ÿ 5Û-J#pIaäƒ@n‡×ÈO®Üydgt¼b•¢lC@„)…ƒÔ;ø›Cdlö¾edŠVgEÞ”â ãð"B„@ )Þ{À)É®dɬ,9V"R¤H!B„”Bþë–ÇÁ´µ`º¢é?kw%øá'P<ãå5Y.?ÿÊ°B—"D› r.š¼wºÁmÅÔã Üz®¨öKÙ•âQŸb—"D§ö½ï¤†@Å`m«Bêì5ðì4+ªý‰ZÀ“>nDˆýý:t<èy_ –ÛxM &Èæ?‚§/£^ñŒ—«<!Bôô~{.û¤H!B„© ¤‡¡Ÿü l‡%h‘\VH s›¿Ulà7ƒ³ñ¤!B„@êzRÜÓ—¼½œ d*ž¤oèËÏ=§@žL(Ö©KžÞ®=#‚“/ÿ;®¢{RÍ dGúööômméÛ;²Ü‚Jʇ >üEƒ 9ÄŸ‡J_É:Ö%øöˆG&²;Ygîd¼ÿÿV“Ò¼þÒˆ¢y€¶·3ïTÿ_0ªŸ«9}oW?ˆ!úg Åoê ´#„.9×˪üÉ×BÓ<±‰Û¢ ‚º÷ál—ZQRÕS°åˆKò!¦‚CJp„[,ÃYD¹ÅÒ\B“L­l ]òÓ+á@‘·éÒ¹µO#K—Ö ò›ûSi,7ÎMaë[vû K¸>í@Ä&ÚŽ£®9çþ‹ßJ7 BËý9@@ ÛŸzè£MŠîCîóŸ³ßÒæcGLþNÔŽô~ˆHý»§û%½Ô=¦M"+9 )x¢¯á;+ëÄcÃ|ÙÈÿ7*6¤"mµlÒ›9ââšž†¸ël˜ÅÍRGIâƒðåºwé›á‚sÎü`í”RT3$½Y ù§¤µôÊÀo r³ŠÜÖ=úT#à½vÛH‚²‹r“ÃRóFM’äÕøÊ(YÁìO¶+¸#h{ÅÉgY"ÿ‘»°ý‰—)ѼäR²”‡%Óׯ%^7 ‚TD€«^ÚU)¤š_ù)­Ï‘Òý¢Î›¥¬”f-—éoÕ"D¤þ|àÄ‹,ÑädªetÒñW:Àµ'õ'v‘ñ¦N©Æ¶dcîeîHo©ø‚{¿fPVSIÕ¡†ïì…Ê›'*3³°6°r Z„l¾Í­¹åàA5w4´°5pÏϪ|æf„Æ’õÍýã+‡"ìqq´MeD‡$ÿès[ÙÁoË3¨c/ݺÕÌÄRßÜjbi³Þ ’"<´1ÚD}—à/òt]× ÜæÔâB#3+GŠE@І[ü–¸¸| À/<ÊÌÆ ¯çu _þmaŸ©Ö׳ôŒÍ¶pp'S-]Øßëœg¿÷óõÐ3µ£šXù•åל‚,7tÒÓ^Jˆ½,<„'·c¾Uw§ÿ•—¶e-Ù™ÁhÎærLÌ Â:ê™{ùò¯ðš†ÒhÙDïl'{—œî¦$ó’‡åç‡3 ÂqFÑ'%Ô(k¿n¡¶Ôu}d§æž­¾QüçŒ#ÇôŒÝ}bÓ-ì]IzÖîÂÛ¢¶—H•ü¼kÜ‘Ç~V$bäfÀPS+3²eRúÉ!ÈéË LÍ­Äfxx±/sk:MÈV)G^ðû£âœVŠm@ÔzÏ‘ n#|ã‡.ó 4³¶ÄSý¢õó‘éDD¤þêMÊg¹øMBâö+¤x‡X-CáUfí‹Â[‰d¿Œxç”x¸.hïò4ÂùðnókÚÌÈÁ~æ4”¯%™çåî(!Û¤ÕCew ÿ@ê±ÖñFCÓZÍ ùET¨%årñö-:ø€”Š>Ñ猱ÛŹ ÖŠÞxGØ ÊZnØë‘C¶õ Z:En‡=©\컋uúŒÕ)~ßnã@>¡MŽÍk) ZÙ¹5 ìˆó 臞ãÈM'²+õ±&¡[~´§kÄ ·Ç'ëzî(­æ5< uÖ5¯\2GÛ—·g‘“uVêÑ@6ˆÚnÚêb<6½€!UûÀÉÂ.ñP7óز¶môžG‚W˜„6±. G¸è¥ÿÈÜ¿—b‘tìEÙù¾`Wsm»²âF jï °Æ¹Ñâ×µš)Aîr‡Š·í£P|Ò«‚}í ¯¾Ë?È™‚s‹=D'O>é )9JË0?¯ªŸá7œQT-§é]!ú‹Ñ}C’ ~(ȵ'»pKRÜã;HdÇ”Sâî½úŠ¥‰‘ÏþAaË;©gž†8á}ÎÎ\œQHö9À©ëçžn36° ÛWoª«k!JÞ{-žc«74§U ðG µmÉ¥Œ-Ž,* Åšr€WÙáííA$up8-“àµOøÍ÷!HElëâJ å¿Ÿ¾1Žè˜[T'¶êô9=¼~HHM!„ÖÛá·%;Á\ÏgëUHåˆã›ÖéPÓŠ»½ÜÍ×Ýå7pš@iyѦ€Þ>hŽ¶£ÝÕž5еN©q°r,;ïZÂhq2 ÚØËÙ‘©kÑ×4Ì?×if¨ïwp —U„sßÃk¶§^°c·›ú§ŸyÉo©Æ_Ôi}‹$ZÕ ôΔŠJ°Ô¼Òó "ЃwÀÁÜ,|Ç}¸Œm=ÁNÆÔ´kpéÚAl€3í2ww¾Õ/«Z<³Wõ½µ™÷¾—iI¶´6î¹vÇ€Ì0O+Q£Œ…sÙËïNH%D4Jê'+ÎÄ à»é]!ú ª™Yq襨 þµb–‡l²$ý’B¬I ¯XRŒc÷Ã=ÿl§)Õ4¬bXÐüŽ@J'¬«5Ô¥†ïælKÖÔ"9ø™9ú˜:ù[ºÄÅœœí é–Žd‹Ð¸ÃÏY¯Cjë&²ûZ)¤h0¤Xm\ŒqÔ˜Š’ÚaAûSwR@ù/!Eñ?PRBt.*‡ú +ëô ÿ#䈑õ‚_‡”±ipÎéHÑ»<½ŒI–žfN>¦Ž>f®.ÉÛè­ý0¤ !W®?Èï'ª31ŽÊ¨zæžw²ÞRß1ñæ8Ó¸|øUT}ga¬ç±§?—I#úâµÂò¶4D“,Ȇ®¾ëîÛF£J$ò”Bêᤠ¬’©ÈP´®©«SA3¿E )ý¬òâlOÑÖÍ©³²ú'[ }·}ôM[õƒÓw—ZG*ƽ*â2“mØ?ŠZ H£[¤ŠE …Ô_î{ã‰1ˆOØs³`W…5EÓ4±NQ'$+Ô ‰.OnîñŸcS°V¥tÅîƒ e›Ùù VÊ/ Æ[è˜æÓ ÊœÜC&¹fœâ5 1ë™Wó+^;à龨¸`ýÌΉC³Ä¢šaA˯Cª¦•J4 ;Dí ìì‚5xÝSRNFÆQ;{¤Ó}~{™Ë Æ1ÕbuÿAÖ!¥¤¤E#ê…o ©¢–þ GSú­²6ñ ¢¡‹Q„}¤ì‹ï σ<š§…cÉk·íeHtzHQ„ž­€ÑxÛ ×ô3âIÝŠF¼e\%ÈaŒBÊË”h’÷}‹‹wŠ= „²èGQûm;<Æc]ÄnÝ5 ’õ¯B*Ð×Â>v–ªgt`hmGo©L9HvòOí!êØ&Ÿ›qú‚ Ù<æÔàd½±}Nd¬µsé=QõIC’M`Lìág‚æ~1¤šH!B õ¿‚ÍÛü,&)Š¨«ÅÛ$W0ZÀ+aÿò}RPj„„yéèâI¶©é½¼·ÚOô/‡”º¡Ÿ0®ìL,{—³³V×ê„a÷°åe¨§¡yÄ–¬ýWb2’t-èÙëR FAÑ›.fo«´·1w[w›{ê¼)Å6LTG«y-ƒÉ­\©Œ —ÝþÈÅœªS‘·§ÒÁ5ÅÞ’ì”]Çjêò2Á9gÎ>3˜AÊg·é©§-Õ6ýXÞþo/;JÄYAûPRj4!¢N ©x³7L÷™É µVG/•ÖJ× p8§ µswV:š`ÍSÚA¤£¶¡ï¦Œ“/™GöW,3)¾,lÎ**ÄãT-soÃQ­/‚ÜôÌ£wä¸æIôÛÃmΤŽBÊ„`Vò ì"H¶Æ[ÓêG*p0Êg¼§¸êQ\r ç”xX<Ý7 ©b 5žî pÑK»RÖ ró£0„èÜÆþ`'£QHùë;åCC…Á0OÈ?ß”sà»Ðh?¢çf¨&Í€b( èÀìøî @ÑÓþ•€ó€î~/"DˆþF-Ýî½/¢(.@ñM\`w\}*n2ž"‹»„ÔÊ٠ˆ!ú'z?= ñ>)R¤!B„@êß)Hüá±yÓâŽwvJþº8¬0bü0#æØŒ¸bœW5¥È‚j’ „2 d×ÿxEÁÏþ‰Ö„îç‹ŸýòÄ6ÿ­ïƒ\¦ÿæ÷"RR|0.±|5Þv‘wù÷Hu‚ýgé=p¥(¢·~îÛã'„噪…¶™ÆPpOJþãæ»ÜÔ{¹±Çr¿¯<6Ma¼=kÄ÷ˆ$Ÿû§ùgþ“s¿û ”¾Hš~Bêž%Þ¢PJŒËóèƒðAYî‚?‡ãëól“¦ÒN ©wÑ“êúÌÁý›˜ûpQ¦ÙàW8U() ¤^íÐ>ŒÈYê}JaFÔ¿)˜i¬¹Üiû‡íS~iãŒÑ0þ<«WŒáß÷ž˜?/tÈÏ„zìÁ UÓ³ž¼aÈñzýˆ‡+3¼|g¥>…þ;¦èòŒÔßœþù2©ÒÆåÔàÉ%¯ú†¯åþºð¿ë\è=1Oþž‘Ïoœå^ZŠ7û8ïåï8\Ü_)Ë3úÍb"B„@êo]“‰G°X·æb¿º¤HžÔHÇÂún±Óò{¦3ù-Hi}íß&m”r0%(@ 6…)þ–ýì£øƒ³C·’ЦÂK:6·aVøŽÙa»§eÝFñ> -]Mv¸kŒÏ¬›žóL¥øê´ŒŸÆgœš²eVlýXiv=S’ÏÝúiÄÑ)´^hˆ21aç7½Ån>,P.º2=íšØ3º3-fϧ¡;àìàŠŸU?-÷ÑÄÔ#Ÿ†lý$ñ¼ ïtÂÒý0½qfØöYQg&0$›]Ùöiؾÿdß“zv¥WgDîú4tÛ' ­c¸`|êáÅTü·Žk§ÒzFRS)únFÊUIƒªäTÏLø%šœxì?ùO>ˆß÷ièöéi?Â*9HÍ­ù8ù{çÁj&ä4Ï Ý:;ò䆘_|èÛæO$fdÝ‹œzfzN—ØK}8=rÿGyâ¬Y÷§%V{ø?ù?ŠÛ •}ZÆ5%Þ[Œ!B õÿ8ñø¿Æz꺆ßøÕ)+bà„Lò³_iX™¯8q¿ )¿f¹ý•oqäÏ“£øC;Ù­´)ž‘p|¾µÓ2ß:TIå2ªÓœðã3¢7/£Ú~šuob\™*Éç“„†qœþ™ŽîªÞ—Æ¥oVÃ/ ¨˜’Y½ÈÀx…Ïwø>ôp×"EÏŠ;3Ó?A•ú!ŒÍªXJÐû2èôDÆФxŽšõV%^×–ߺ”OO8ºÀÂa¥{5Ĉi¾ñšz®óÂj&§^Š'/Š¸#?¤!¥«³Âž13úàB [5‡SPÓŒIÛ¸o7/ìÄôöj]“¹‰ÏPük ©Ôo¼vMO86ÏÚâ[Cãòj–tûTL¢:D“„ªÖë”Ä‹tü}0úQ埛šj…×úAò†•8«Yé½()ÓóŠ^µ”dþiê]³u9Vk©Û–3;>wñWµ; ¥ ’±kÞæËÐãÓ£ø«pF_&<šìŒ¶¬@•Tþz-MܯJ%“U¶Â:u>UÓ$zv|û‰å«ðgu#=$"Rÿ(¤Çå^œÍ[Å̽£`ž|ñÂ2,ዼw"ºORÒ©°ž¹zºscn¡J©ê:L-‚¥‚s«‰áSÓŠW›fN` @‰¨”ÞÇP¦5¬¤&Œg¢ø/f:y­ñ¹ AJ“”3F 1>ÐmP®"Ê¥?O(z¦ÂèRfÞX@&žôÅ°l43ã9”ã¤xžªÝå‚Mꔈ‰âzVÊÙ§ŽušÊSýb1†ÛàŽ]¦¸¬¶?¢$xR«´¦““c’„šÄìq‚þÏíVþ;ì"0!ÐNÕŒ§L¯PÅÏ,OÁq»'У„]ó(¸ÿÆ?–Ÿˆ›˜T¶ÆfƒRþhÃͨòÁÏÌ5l«$|bEZ~Å»¼o>#ûüW$ÝÅá×`OÙ¾RÇvZL•´­¤´ñüÁÙ.î«ý.ÂÓÚ"0>ØYݨtlÞ&-íð‰UþakÜ·|eOË“ûžcLUs¨‡m‚Ùæ”y1W‘©hMj`LÑ]x∯I©Äªçã(¤ø@%>C,+T¨9™?©‡ „9‰O”ÒS0:–ó}Dsüøs¼354ñ_äÞüÜÞg…‘××ÎŒY‰—à>¹°~%5^“TÚ&UËuJâi·q¡¡h=Žr˜Í^nä»Ø)c¡KÊjœá牛v©ô.)¤ìŒM U7§I_zíj]ÊÃùŨ¹ÖK"'{š¯¶Ùû H­­I©¤®Ó$¤Žãv-07Z&^ãåô ýøñœþé>q+©NßÚeÎ ;9Ž dz$_o†”©áÊ€›fØ, =CJ[{5‘ˆ5Ø ´Vü,³}Å냢~è³rÆNubÂnß\k“…Éw%f 235)áØ7—è?+èýÜÂ{nÎý¹vQ“˜ÝŸàç¤Ýýˆ¼<øŽ$–c¦µá¼¨KH‰Ô?)öƒyÖ6_%>•NŒ sQ3-ËU,HõÏpñRwiGµ½[’DƒmÒÐ1ù¸(eekâÝg%Ôÿ'¹VR#oÏí[|ûøÍËÉú ’~V‚=©_BjåZ9Hq•¹ß/%¤v‰ ø`!‘ôEâ“×!5&)FÍ,[²„T½F—úY!xR¤öýR#*)¤ÒÆqŸia²0õ‘Riñú‰ 4ùƒ*%÷&eœùÒÒt•óFeþó_ÔzÙtŸß e Aê©eh¼•ü|ÈH!õ¡Ré;Ô‰‰¤þkcþUâÏ3”2R5)‘ùà?öä%>Ç¿5KŸÄœí;-}ß §¸¤!úׄ MŽÈ×ÀÚ|rpfp¾ª6u~ÔME›î{:×ÜlEäý·‹µV H-ñ­Wæ (±û”K.-ÐÓ]e·Oê0µË V3òzaÐï~swLî‰O.+ÃKW3|¢Vùu(7®Ô‹ž@âý*¤”ØçWâ ¿È‚c Ò9šZÔ/Š§û fC4áŠ!e»[©äØj’÷G…½(îиD¡.|Lõþc âê­æV%¦Ãàœ VÙîR)9ÿihõXqà‡Já¡ÕF)ã8'¥37öŽ|mLHݬjÊT¯tϲ³ù H-ś͠•äu’÷‡Åo€Ôx8v1XÍù¤xT38ÕÅdÅF!Í”5x·UŽ»”øÃSà ¬ÕM¶¡Êû¿0D …Ô¿f3¯`hbÚ‰Ïüs6ÍH»ñ'÷ªü“Ñ}½ÅîšQðâ9qBfQ¿Æà–Z/5óZ­g¿Ä}û¶ôÛÂr–›ø.vHøÆÔóÏããò-1røÖ&n±mØr³èyÏPôŸSõW˜G}\Ô?ÓÞAós|j¹†)_©ñAÞ:„R岡îþßÅŽI‹¼Îv4W7ÈÈêmc¨Fñþ"«wbCÓrƒ¯ºoÜrÓàÅö±+Œ}æÆ]C §{i:VKVv¦¸’Õ-v*¿©ºÕDÏ)H% °Ú±ã¡;iu‹Œ—YÇ}mí»Ê8eZ!‘ óÍíWXD.¶‹þÖÔm~x3dÛ GS ‚ÛÓŽŒ‘”Š/~edó­cÖ|Æ6e«†Úüe‘QeÝs)š«nK 5ÛLwAĤ‡D„@ê‚ÔÛmcù—NððÀ_?I‰ñtL©LŒ%ù}CÜeƳ1¥OÆП+q† ®U‰ùþoéSæKqÛ )3» ÿ*sà¯TXƒ(Î ¦Œàìî1Œ>ø§O…%ÒÝ_,}å¢Ä‚>SfÃ;ÂTè]JI"}cè½b3ž+ý–ý²\†”éOʼn@w¾„ Wœ tÏ,—.eö ÒC"B …œÝ÷W!õnxRˆ!B„@ )Dˆ!B …@ "DˆH!B …"Rï¤Ð{ªþC· ¦R`|Tü—y ÐxyŽG»OÁK¢¿±÷ûf;¨?þ2ïà0¸Û ~~®zÜúÀíçŠj¿Dý½ýàa¯b—"D§ ã~Ïû©!pñ>¨»êMÍß?‚!UsCñŒ—WíMR—*v)!Bôwö~÷ÁÓ¾÷RCààw€Ý ªø<é¥uŠj¿DŒz𸼢إ@„Ñß©]ßO ‚Ô¡+€ÛxM &Èæ?‚§/àN^጗«†ÔaÅlDˆý#½ßžK龜¡Ÿü6 :KØ&¹2¬0‚Lm±ý€ß¬0}>)Dˆ!ú]Hq› 0õ§ä™LÜÝ‹Z¹íâž_! ñêíOv¸¹;“ ÌŒ¼‹³O¿\TdHÁ•/he ¼”]ÂVèžÿÿBAÞÊ΋+ùÑLÐȧ¬ýí,”D@Ðþ NDx^’ˆüÅaØ’ó¯¾Ä™ eÕû‡* zPp”µýÁvç[Ø þÍã@D¤þ]žTó`Fv4š½íû쵨5úÏü…™îã7?ö0ÅÚgWÑÏ=‰O ÇÚò˜ÍŠìI‰?sªï…ņñ8¬Ž®.Åν´ƒÝü‡Ù!Köt†…[6áí̆á?Þ(ìª.v½üƒI äèØ7‹D­?X ÑAÛûÞHqâC¿ŸNs¿Ÿ )`í ù‹üÖÁôd7‚ÛFëk™¶ßµÇ®tt þà /híö·Õ£dÞµ¿ùvõ3VÝÐëíÅ­¹ïæâ¼ågÈåç!œB„@ê­¦ûúR9Û£öCƒ^Ñw 3ˆ`t”­8ÔTQtíRNAà©£<³ê_‘=)~;H‹µ ¸±³?aVulÙ©Áylê…¨¼°o%q¯$½œè<\^îˆ$vDmðˆ](î–¥œ—Ì…Šó²+‚W»JÚ¶ídg.»vâÊdÉÂ^C»,SÙl0¿UzEÔ!Îâ<ðóJ9 „£>Â0»êiɹbvÀÆ”I¼Â–7¥ ™Ôú£5²ó…dòv¤ŒŸ%Ðß3ùˆ$q0šµÜÔ´$}QÇp £qÐú›r>épÉÖmx³Ì¼f¸8°K%y¶]©{ND´Ky_ùÅKdnìHMÒLEòåmít63Ƚ)j¯”EbðEl¹c2XZvèÛékÉܳ—`“^ ÿ ©÷aºO6 ¥{ic¼Öwñ›È“zîcGvcÿõÕÙŒ\¢ÛZ–B{RPxa0ÔBÃ>ç_êƒ 1Î<¢WJÜÆÐ?"‘€3ò^{Û8gë-œRò*a/ƒ¾i+ÕžÇhÉ™VEU¾Ž¦N´zôH¨7€×sÉË8 sŠ×p?(È‹@$‘lâ“õÈ;h¤ô=y©9‰D£ž¿*.ŽÂ±YÍ×-©$§­Cem€ß²³ìMbrN£bÈÞŒFÚ9x’ ^-ª¿ikät°Wj¿üšTkoH°+% <}ÿþyˆ8/xµ7íÍ©vúÊÛá4 i.úþë9-×džÔ„Ò^±…î1’UÔöç¼ú[¶Fv‰zyÑ ^&W6^ë®þúmýlzU“ïwˆ´.WrІQH±OW˜EäUòºlÍé×!_ ra˜‚`œijIÛÈ“²Îý */¿y8Øß؉ÿcÏZÕ=bmgi<ÈnÙÌJÈn3\íüÝ Ú1½q8X ©µMWÌÉ$·=`dÒ÷ 3ÍÖ6ý¯ù¡³‘QÄŽ~Î~.Á8²¨¬½ÖVµRI®ÉÕp\‡àäN"Î*ñ Òë"B õžTC_Ö¦Ú¼ª¾x ÏØG°Í¤Õ)¤ZgGš®qt^­Øר¾bilè³@آЖMU °kûGk­É:úu‚Sût0¦1gÄ IM .ÅÕ4·ñÍJŽ$DÔ ;€ðØN]Œyl¥ŒÚP÷x€‹ÖÐÂêà´aéj¬Òp^ÿ³l‚†ř˄ hÅ¥1#&³æ¼!Å H¼ØÏò±Cõ‚Ö3@ᶽ֖ú¬Ù¹0çô ·î ©=o œàV]‰Ž â4´p–uWÌ üJÒ,.‹!y0™0¤Â÷> v2Â;§ìù©àH›­¾iÔ¶çbÚ%îïá5ô‡ÇX¢1ÚÚû±Ú¿œCÇpX“¨Óâji~à`(?ÝÇ:qLÏ2®àÜ0¯î©—§‰Û†»’L¹;su C ;ÑNâÀ nã@D´½EÉyAã‹ .ß؇Ö&š„í 7‚ô\'Ó¤£œFñÓñºØÊÁ`sRåÕ††Y}â0ZšÆqû9MÄdmŒVWÕ”}‹U[®í^•V¦êèÇT ½."R¿)~ýco7jr-³ö%»®+!˜꽡(›y¡§b™d{ ‡Û4LßwœBvˆ¯„WR8p¢áizÙ©üs@²2(¸ò’¬ñ6"Nu5C< ÷rPÁ£#­ìJÎs+« HåžW¬ŠE<)¤ˆ‘ 0¤*O’Ðäà£@½ö¢ðÈ]îñxŒqÔ‘—Ìs]ŒsÏégŸ±ä¢æ`H¹¼)VãæTŠÛÎ!Q+൜|ãÈ]¬Ú^f-(»øçnÙQãI!u°Oé÷ H±ª_ÂÁçm½§† ÞwËÁÂÀiK_™8ÍBº'Õw-»‚9¼üQ[/ô´8ð£¾Ã”`*ö¤nŽxR‘ñy ìjØx湧ôªüÓ§ÈÚ¤@qçÏoír3$É{R¬SgõÍ£`Oªþ¹¿¿熤 ¬µ8“äâR»’;8 e04ØÂó¯®âQù%À9ÞboA²àÝËc†ëGìæˆ)Ïß'À¢íS놤žTã%SŠžÇ¶ç“çž2jùÍ÷Åàì-%‡gìaÀµÝE?û\¼Â§÷‘t-N#½."Ro‚Ï9ØZSÌ Ì,(¶i‰‡ûx 2Ý'¶¿?97ÝÈÒÙÌÙÏÐÊõ°£àkR‚æÛî&«)¾üôý·KOßÏ^¿Ó¯fUx]t¡/ÄK ØSÚJ÷1¢˜Fï~Ê©¾dF2?2XÖÖ権G…T;¶wÛb(»‹ÎugÒS)Ö)EuÏü­µÌ“* €~¨Î%¤4ïìËÑ5©× Åì±AÚ¢Â:À:^kMÁz î²vñMœó3OöqêzbSƒ bsnÛR #·ÜdÔ ÿÒ“jzêå/úŽÕ0Ä:|”¢®|d(9ÖcÍʯœSÍvTM§âÅkRäˆÍ5†X]—ò‡¼Ú[ÁÑd¼aèÆû¼†Ÿí(›o0ê† „\œi|êñ>^ÃÓø”Xû¬ó‚óO< Õ©ôº¾,F–®–AÈÆ[£kRU?Y›¸¥ïå5 f¥c32! W]u3Õ4Šov>r&a .Źg‡™ÇªL(æѺie¹ÖᛠϽäTýìébaɾÅtÏ›O@«¢‰Û¥¤{©¡ý3kââ\µV¨;m{YÖú2–KÖÕÔÒÒÑó`æTÃ+ªœã§­ u5ÔuÍâŽùùØ®½>ZŸõ=þþvžëoš!Ï´;>5‡ÕÐÄ’-â3[@Yû;œ¦Mö^S*ƒ!8äT³§ön@  ‹Á`q¦á;Jj O³?‹ÃÑ#`µ0ºú¾eEuÃptŸ£‰~ÝÇk|᥃Q×ÂèY'††P%'§ûh-WµÛÐÅŒî“me*¿(V§ìÄ 1‘…çG/Jîä·É®´Ã?¡‹èC‡ôžÜ##H¯\”l¤–?q¢ü‚ts.¯Mš¼ñGlÌÚ‹#[“àÈ I ’íW’ÝXå—€Hvd„ôžÙ®Nøq8Ç6Ù>©‘4Ûe'N\OK¶Êlk# øM⤤‰KË»V’µd ¯>­¾Ò!Ý&·‘y¸°Lˆwà—´ÈÒ‘<+—)d|¸‡¤tM¯T~YÇè>©2Y¦Ò£-.ÈÎÓ•¥\RÉ2ƒ%¶Ië_ŒoÎÑSzzžq•âæ@:^D¤H!g÷½ß‚¨è[jX«õ_ðöÖ>öñróà^…uA6I!B …@ Ôû.©«%9†è>1O’{3 /A„)Rˆ!B ¥xÚwÐëà®^±Ù|ì{øÒjÏxyׂG½`ÿeÅ."DˆþÎÞoG'¸×ý^@jhî!ô(¤º^€þ!p¿[Qí—A¥€\B…."DˆþNAãs¨|þ½Ì ¤„*š ›×}îôß³Šg¼¼ªÀ­nÀíTìR B„èïìýŠ;Àå'ï¤zé @qR6'À•'EWTû¥b‚ å‚—"D£TwƒÆûï ¤àî‘ PÔÊ٠ˆ!ú'z?=¤H!B„© ¤¸ÃðO@‰ÄH® + ¤$¦ ÅÆ H!B„Ô;çI1~˜c릮KÐÒÕ[a¿n"KÁ<©ñi{–êékàˆª&IS ž¿R)ü~rîÕÉ9W&ç~?±ð¾2GÇ¿#ñ=|Éç¡1E7&÷½=¯ŒL”'Òžü¿•].¯??[ðãxúÀŸy–ñ`RþÃß¿ýlbÁ=¥×-ä+ÓL¤=}ÓË)«ÿß)×/šéæ[7Óà¸üÆ3ÿ÷Â~>¡ð¾|a•&>†L…_†¢g¯™ñýIåóß®'å?@(ƒ@êOAªw–£ƒ†ýîñôn•’ﾤj,õi‘ýú(¤8W–Is£/©0Ïð‹QµÞ¤ÄWßä× %³ô¿ÕÔ Zäœñ•}Ôr»å6ôoÝ¥³Ÿ}}b êÇú§-Š¼{ÇogÒ¤¤íä÷B&d\äwæÿ±ì| ’±qfòã?Ÿ‚ðé|¢ÖŠÐûo_º‘¬ÇFgkã ÆŠ~çN•¢†…î[TØC¯“hbêÞ¯ü«ßükRTûß°+£Vqå~¾ …ÑcXâf )]qí­ "|¸PwÍ·‘ÿp©åáÈ{Ã[4&÷ˆª~Ê8Ö(þÆg]ä{ºùƒÈB ›¯Vð|¶säܤ.TqÝ+…ýu+Áâ²Ç Ð ú3Ó}Jì>%Žø½-ÙW¸œVRHAvæ²ÔÉS˜â±_Aõ*‚çì7ÿ*¤fk-ñkR‚JÁDq|fAV3áŽåËÊ%IÖëJÿ+¡3ãÚ󴱿¨¾Üm#°¼ú |fiýIfŸ|Uÿ2;®,©ÑÔ^s‹¯åÅ}ÍÈr0Õž¼BŒHn(þ Û^/,W.kѳyzÄeá¤_É?Ë}ýÁáÑŠ‚1±…hrÉ‘\jB™_óú#o(øeyGŠ0¦@Ãú,j­\â¼7U#óæ×æÉãä›I çfòeïòõCêÑ|¢ö’è'°Áò3ó#ÉŽÌÞ¿ò \ñùoªRyÇWgÁ¯ü«%.ã”hºªý>iŽÒ)l¾†õ9¸°òY¼±ÎÙZ¤BR¤þBàÄËI)§gúg®Ö œQ¨8Ó}Я@G$…ª¸eÞp6MÁ§ûÄúÚ¯yô7yj6uVŒ‰I›–雯ѳP5ž•~ź󹣧*År Å|¥MÉ$Æ“OÍÈ A•ä>£th¦½½†gçø”2UóôÏÜ¢WRÍ5ñNŸe>‡ú •¬=ßR-ÖÍÕÈæK¼Ž( Á4G4«³ù<§ob]ÓbƒoàƒHú ŠÙ=KUýàÙiwPüÁêNë¿p^©g¤A ˜QðÊ„›Riõ*’í=3—ت,¿Œý n#ÆõϼUÉfj$Ó厛ÇsÀ”À Z“h¥†þFÍó Œª’]èUêó#Ïß®W5+UæOJ([¦'ÎêýEâ(ÞЇ¡Yª¶ -ùo¯G‚!%“Ãc5H¡ Œy|"9ÙªU=û/#Z”¸°ƒ9Ë-Ph¶Ê8xžƒ/†TªRfÙÚ«»n™k糇_cS>#‚µÔÈA o:'þ:<øÏݧNMú¸ ‹YèÉXjä¨J2YT 5Ê‘šVÛ¡ŒÆäœZbb×?Ùò[ÏcãŠ;¿&¡1:FKm3æY»ª¹”}­o97áÊøDžÌ‡y‘í(Aߧf ¯JrƒšéG Ê/©ºsoŠ30ÝÞkzÅ{2Ë= ª7U’ÙJ[þ$è%‰!óxRP˜.>FÒç³üoðqŽlú‘e™ÆÊo\Š–:­!›~íwJ™ &$¯]c³ÀÌz™ÃÚ1ÙÙ—˜¯¡X¨RìW+s HU¬4 ýÂ-vÙPK×ú¿É'$ò4ÍDÐHiJ SÕ*o®ƒïU“è?3§%z²§ºÚûôb *ì2›‚  œ_ùÕÿ±wðQo@phq-VÜÄäîâîîîîî9ɹ$Á½¸CÐñ§@[(R$hÜöÝ»$ ”ÿïK{/Ëç÷á“ìÍî>3;÷|çyffc ÷Cy]»Å¡uবÖé!ŠÚ& :bPH¡ú¯ Õ6Å7©µ§œ~ìäü±œîûe…¦ÚÂ؇ÀYM MWQÄÍ)èûW§+ÿ#H ÇØïéjÎy,Á¸¶Gœ»²ž±q\ý‚±Tyƒ”Q`Ìz79bï÷ù­R¤ÚõÄx„wÎpô”ó¾-“¶KYÝ{rA;)»9`Œ€ÆÄý43þøA‚}9Nwvz»÷åR]Ãé­pÞ/Ž#oó“$õòzm»©™-ìî±Q$í„1\è;¿x¬NêxÐø¥ýÓ-478Uˆ¼%©µ°s“~ƒçÑQ<]àÏ+DÅ|Û(FŸëÙ\cµµ^õ¥=sõ0ËÃZ¤bc0x¦t)428@Å(i‰÷aÅO ö_î_)ÁhX«¥7;ù©»wtâVE\ðx&4.’ª¢8¹à½÷ˆ¤Ö„¿GU$¤L¤ôÅÜžñÛ¦d´Àµ#UÈÆQMöÈÂ&;$/f;¸`µ)RÓœ½1úôÑðŒÉE9e¥×@㎎ÝhÅûíãsG0î®RS[Ò„ý¨¼NpÈã¢iòv$8=3ÜÝ×7ÁQõç9¾»Æ2¡ñþq*çA¨8ÍŃOŸ@é#Àñ[§d¼öH^–%†Œ¥öJ‘d‰1£è ¯vMwöiBhø:ÏÓpè?¯Ö1\Ý5."OÙˆ:†Ö-Á~=Ó’ ç.û‰¤ÞJ°êe±šó3ûÀ­¥S2äŒóá Lùþº «²Òç²$Ü®Zg3…Ü%“¶GIÍyzÎKIVŸç·e8åå!w$9t~Í]«iyï¥óÎÈ«ZÌNy Éêœä¬JÜ2>u»œÕVR1LŒªûÔœWìöïÝìTˆER%‹ðZ«#_Œ ŒS±<·3÷ÅxÌZ˜MÒ5«ð6SòÚ¤òÊéúM,l—`¾šé⥊ËG!…Bê¿Z‚¾|h¬¿­œ9o[| ÅF§l‘SWÆ`0kí26ê8N)úI @j!€Tì3ÉÌ<%|È8ÁÊ–¢ëëtmffW®SU_åºyð!\Á¢‹êõĸQôž!H¥n—7Cb8ñ"‚!°¥AäB¿¹ÀÖSAS[Y]SUÍxnÂk îsRi;<"9^Á$IIHç’œ†þ4É7Z€‰çpƹ›m´9$9R0(Ý°%É›•q©2œÖ…¦K“^ 2?R a †Òü^R!Ï%6ªYObB³L,—Å5/q¢Jszg›̵Ifd*áC…•¥]_««??·wl$IÑb?’Az³¨»ÞcÿZ¢ß$᪃¡\Ÿ©b‰™=¼HMC]+t 'x£Ý&igÉ„gbtH9º)¸]GµÞ[‹Qý!³Ž2¹- G2‡ µg8#³É'_Y¯8Ž9)nÿ„ð<5»…ÁgÆÀ0‚WALð‹U±8'QÒ7ÍÉCÑ©^™ù’"•/5³°'b<¹[ª°N–=š„0¤ä½nJçž’ÓÏÁî™vP‘˜3’Ó;ÓÕ~UÄMaÆ,-U%Ãk¦ûJ¡IÎìŽKl‚¦›j¬ üuh` ¥Ž››‚¬ b<[bj´8íÝÈ´]òFtiÄ ¶*cM¦Rc¼Öù¶¦ËâKåÙhÏIˆÉÅèNJÙ!„Tt‘’ù.aö2‹¤¢î<žÕ±@*âÅx)¸²ù"VYNìíh³(þñȸp9÷àF2ÑdR(¤þ¤Xo§2¦çw RÇR ኆ£˜â)v÷ˆ¢6ðÕß…‚Krzi£Øÿ椆¥û˜5²êÄY™}’iIª*¸ Îë œÖº®3 ™^FËõ?¸D¯3°”ל\Ð&Uø HÉYlB*†”$ÿõb‚–œó1Ý€Ÿuuæ}RGFÆ)š‘F Ö]Ù Ÿ—ß ¥àR=)ë!µŽ4ŽÒ3)ö»…ÖFŠY`³ãzcßeî[GðºH=•(éœg õC|íZ|øDÚ›Åvé£Éu«tì¿£A’)1*„Ø1‚YúÕx¬n)y»cH-Ð7Àj)ê¸ÌKy&œ ˜Áº±ZU~•õf¿$íÎZ/©1¶I± 'r1ºBHÉ{ÞBf[îÃÊ‚þRFÓ³:?)pbßØÄý?ÚømÔ1Ü`S<š Mð‚”¼Ç R¬ë«±ò+j¤=E·Öêø~ R7$XVmfç÷L Š^ã_:ö,WK%køYy¯°§Žâ¼š“"Ú€÷—wn£šÝdÑ=ƒRÚsÒp3Ÿ/63Z’ò@JÎœ+%˜äÊec±6ÂSXmóì-WÄ<”Ê?ÏI1ú>©¨"y›ƒBHå²”Õí&2Û?„TÁn¬†œ¾‹ÀZY£€y)/d¢}ämøHŒ£¡B!õw#©Ži.®Bê÷9OFe_X®£²Ö½BRŒV÷q_Í7µ\yu$éç–Ö+ý¯|z1•ØAʯI8]Ò?ÕÙZ…5 ^9¶O^ËuÙ}`Ð.Åê•"ÿ2šÜxÂw3]ý7ø]“$Õ¬'& K÷}))FãFMƒYdÁ턆87ñ )£émÀ†qR¶¥r‹ 1£ïtLkû=úÎ'ê?ƒ·{®­ýšˆÇ¬ «U p§¸}³<ô9œx v[e%où“¯k¶kÚì°h9C6<ÛR¸SQÓm‚`ÀOªÛ aÿã"  µ¨#pO&™ƒÑtŸBY¿ƒ±úž [(™[‚QóOdÓ,ÒÈ¢‚‰þqXÿHõÉä?„¿,à Ì»+5U—%wŒ ˆU±¼œ!Hå•`°Öß!öHåð±jpûÀ"ÆŽ¢÷ Ò}0¤Jú¦8»Ëy6ͳ²›‘þB‚Ý3Õ;PÖ¯á/Li¦È ¸1»æÚX/31S²¯@âµþ!H©j,ˆ} 7ýÉr¢þœœ6™ÔHÁSœ䔵æä Z¬u‘‘Á¼´Òyð ™OB*š†!0$‘}ˆ’ ñõѼN!¤•-կݠ¢>/gÀ &xŽLÍV4͇!ŃƧcÑt ©¿î㾞ª‚U%®r?1‚ ‰Íœò¥“É<¼V[ƒÕZí~þF°ûÅ?ݧ$k·yrbÕäØ#?š[cTAÄ„ e;g[Ö¸îSð`Šª’>u|B¢">dJú½±™UË M–Ä?’ _]‡³™Ø Ãèšîô¤‚‘Ô‹¥ÝõGåV.3OX¡§³$°N’ûv^óÇ€³c‹zÇÆsämöH²_-2Ð]î~tþù6¶òŽç$ø}ß{H]ù ¤d‡Cj¼²‹¥¬æ4;åþèìª%DÕ5^À­Í4Æ®·ß3žÒ#÷“‚ü:ÙÐ[¼þ ÁùŠŠk~GÝ1×Tgµû¡Ñ¿ÌvñT´Þ+Éí.)^8Q }ïl¦hH—lFfã:UÕå!Í£3¯2•Õµž•ò»¥y­:qaTݸ”+ ÔUµ)#>)óH}Rœ®YÎö²Î;Æå>W¬¨j2“ MÃèdLÌ¿?ËÁS)fÃ:¬ê²Ð«£Ó®2Y¯k;3õ‘åÆZœõÌÄz𘦠Jfò”Õ-6Ç…`ýÒ‡ä5¬ˆ¿5*·q¡NÎáòÀœ”RиØ"ŒœÆÜüÞáëÃ]…•W´ÈŸ”óø»ÐLe|ÊhFߨ”H!Ë8';êË›Ïô}H’¢^ÒhZ¿`uߤ´E ÃRVÅ­¬•ß°¯½ÑµAbÓ{xN*âåè°tŒN椼ߥ¸ÐDw EƒÌI¹ÆÇï\¯ã0%ï½$õÖj ÝEÕãRÏ,7ÔTC!…Bê¿yãD1¼*V±¾q‚;`<_L}Ÿ‡êû¥-sH^n—°Ü>y‘ïxY×`˜Àx:Ó'{¹mÜR·Mã)`0?!ºt©}Ür»äy‘ pΓÕö}c¹MÊTrßøÈM ➎ȫZT.‰,{‘¼óGïóR ¡òË8Æ­p$M.虶{¹=s,½otÒŽeÖ±s²;Fd_\Z»eÊí¹îi+lœFò6½ãâö.Œº/ˆòdbèóC‡ÅÝô_çyoì6•Ê­XìqhhŒJ9ð£}ô Û”"¤…ÐR9Ç–ØÄÎOüM‚ùlŽsÆ”×9{22*¸0?è¤4 ’"_ï\Šùl¶GÑÄÂn¤5îÿàµ} •qva²öx†oþ ۸厅Ó3Zà#E?ÏsK_âÁ›²eAÌcÁªï‡{ŠÇõOˆb­pÚ9’Ýó]s¹MòTRßø¨- â%ŸÍqɘV')¨>™qz‘Cì Û¤!Òp›·N÷Ì™Þ&\ž¶O΄&ýÁÖ'Þ¯+5´„Ÿ_䘰̑ô}.¼mD^õ‚ ‹È^]äûÎy75¼Ì6f™kÉ„B81(E¾>ßï¨`S˜TÆñ=Oɽ² ¤@jtÚéb›&†ÑVXÇ,ö? ?P^Û4¯¼9i­ôŸç¹¦/u/ Âm^÷wa pÍ天7[eœüÑ!a™3sRâ©ÅžÇGpQРBßÝ'æ¯Eb÷Û3¸AFtWä¸è(îðSƒ ¾àƒ÷!ˆžÂ~"g`CÓ·Ü©4h§è D÷‰ÞëÃë ßÝóÉR¢ÖŠÞ]ôšÜOÝTtëW¤Ø"?šÍ¹šèž/îð—B|x£áÍÈýè1}p—OÚóñc-&¬ÈÇí6p.«gDAóRCÓ…Ñ?˜ßF 5'£[äùŠ¾àâ³fðóíö±CÕù¸gö+ÀÞP¡B!…¾»ÕÿWq!ɾ’†ö*ð,Ûý‡û`ÞlVf'ÚP(¤PH¡B!…êŸø ¤¸?Îo B•’/~¥*R(¤PH¡B…  ©ÿð_{ìêgnfm3›ý.C¿¼…&”ˆŸñ¢š¼ ºó²/ïZ B…êkz?ƒPËoR½ýÐmÐSqT+ôºêê…ž´Š§ýöƒZ¼êïZ B…êkz¿–èEû7©ž>èÔ=¨¤A,uá7èM'Ä©WûâÕC¯; Ó÷Ä»¨P¡úš:zzÞö­@êØÏ»võâ%`óÙ_`HѪÅÏxQ1j WíÐqñ| ¨P¡úG¼ß[(¤PH¡B…  © ¤jûáÿë!^#,n½àH¿AjÐ~.üsÿ`¸¢5B!… *RâI±Ê®y¸9êèi ô<YÅ(’‚aÊ,¥´~µó–N^\†[ó&&9¯o¬­obà¿)¯JÀ/q€2Bxå7A<µþ9 .Ëm€@ƒüÇçÐ#Ðçüë þ?o@aC !ŸiΟ4Ü>«}>UqáÕê¿ìjÿ7 %­‰ÖH`XÜJvä#òÑ— J‘±kÃ@Ç@GV(¤¾¤¸µm!þ6Úg¨åŒË¿ûYª˜Æ×°Ä'ÝW%¤8¥«aܶuraËûóKKµ,²3ϵ2+ž:ê#k9ÍB¢ýû#)àR’ãÃ-ÜCÌ]-ÜÂ]’÷å”Cü/õ¥p‹¯ Z¦;)‡äH{ÀoüRŸÏk†”/Ø}Ô!íÂßðŸ¬ò»žQ¼‚˽‡8Í0õ?ˆâ¡ÔŒ”ÐÍ?kg_6»Cn#÷£.Í­ïJÌÌsd<ú¨}oÜ•\ýË6–,½ \÷û°ÏÍoy_öÝ¡Ÿmp‹ßSTÕ÷¿Ú©úr7ísÊk­,¿ém°_ˆÿÎ×)ùTWöÑÊòŸùz…Gîù¢Æo„Ȫ}ü%fÊ R_RlÑåU(ÉOÛ8ò’8Aª®~¾…ßôØJã*€TmoL’¯Ya3Ö‚s{’šnTžø¤ûx× %ã É»êùG]=ì0Š¦Á»ï÷W<Ðò§NÁ…å=œºÞ¼b~zõ±ÛüdXÚ*69 |ÇðQÑ©›1Ûî}<ÎÿÔøyXr˜y±ÖÈ$(û|Ï°{Õ~wôìÓ³<¼ÙϧÏýÔ½¿í‰w!Ýø×ʧfzúr_~êë&ÒàMP~š‹ºÍNÆU”(¤¾þ Г÷øÇÄêÙ$&Ÿ…>õþ—¦û)Ž’¦Gƒb×t[¹•Üã"q÷Ôœ–}ò%ñ‚”ŠMFÉõ•Þ€ÒÒ½Ôð‘YHõ«ßgl=Å<·í&½vSÔcWcÙ'¢X§SýÁ©ïɤóôŒ<‚ȧò+!òÁ¦”£ïçK9øˆtàJ4ãhìæfj­ ŽhÏÙUÍ<Žœs¶øŸ‚í'lMôd^èaœû-å§ÇÀ;±*^¤”ž·‹ßv‹^n×G:ÔœrüMÁžKQô£ñÛïÐ놡†”YHÚÞ«±¬ãÑÅÕ¤Š^ÄÂFƱE²ÊÒ¿Ž<ÖÅß’ø§¢Çã¶ß¤Õ@ä}Ìp–{ÓËÚ¹C9±>ꉛqHí’÷?åÔ ,oËÞ~>’q2ùðó(o¢ ù&§î}ÚæÊÜ#·c™ÇcJŠªÚrà§R¯ÛO=y'ùàKV峔ݷI‡bGcJjÉWú¸u½…ûSŽµÂ›ª—é›Ë¢ÇÀGå£ì^€+QË©$åð½ÌÍÒŽ?MäœÉ-ïåÖ÷QNÜÚsà)À:£ì— wM~òÁŸ³·Wfœî,:z5nÇcN‚°ºž¬-—òÏw€ç’·§´6¸>©¼T@JÏ.=½´,iÿ+¸^µ }‘TÚH«éD9åÄ­äÃOów_Œ¤‹Ûþ3£Žþ²6ŸO;ö$‘}&¯¼]õ* ˜ :ÖkEWúÒ )£®Žf‹Ûv‹†ŒÙÛʳϽ÷w!¦Ý*Ø{1Šq2iïC0} sK{I{Î;ši[GíK/ëäÖ´fn»Å<·õ t0øûÕK:TÍ:·ãvf²“ºÍR(¤þ Hµ'“ø!AÚú>чºÄRB‡T`€…Ǧ_â—íÕÖ´J¼ f²N«g ,ùà×ݶÀém{Íiè‰t6tω`tvw²È¬e/73sôÌ;I.16u=ð<›ÁÔ!x„2.^éŽ rÕI¼EÞµ]›`æ˜~4eÛi[Sc“ô»Å|I>êzaA´c!IQx‹¨ŒËi×aS¼KÚñìK½9|¦¶ÇNvýû/³`V󀣓ƒQÂ^S_BJ¬º©§GAYêæ}&:D'Æ3Ñä )œ¦±?5„²×ÁÁŠr‘Ó íÞ­‡·qÍ9™O&j[øl}_ÒðÐÅÒÐ"z¸²«›…UâÉÂýç¬tÕmâežïä\v´Üˆhå–ýS$‰kdhíµ§½ø*”™¥…÷  ŸŠ%èêºSosëïš«*˜DmIÜZîînj`èUt9ÊÐ!ú¥”Ciy©¸à󌳈šÚÖ û’·]rs±×‹©ã_ëóµ×Mþ¹ôj{X¨чÁ:æ⊳ÈÍ){ài‰Ã¹nÍ%/‹¯>°RÃøíî î?c©«a$ëRwB¬›KF8󫧳yÊE8¬>pÆ`ã–w$"an¢®e‡FR(¤¾nº¸Áš^Aê¸Ç‚<]'µVœ!UÛaïĹ#Œ¤Žq´p®iâ )a^«ÍÛXËýˆs᤮–mÒ)8GÄ8v@ŒHÙI":dVÀeQÙRyýTI\!<ìïŒ ñÄ'ß&ïÞ¡N̤ÖÃéš‚,_UóMôk½ìQþÙ6fU«ægÝ€-o¸ /œ Ãw¿Ï)æèú ŸØ¥m–‹¡Ì´ÔœSª¡äôXŒÅNöuØÎÌP=¢ÿIfã0Hé©Û%h.šº‰§NÌ"7õù;êeÞ-i†óÉyÖºN<Æ…S:XãȳÈY5oòN¾ä6½ó4Òôæ·ˆæ»X•ïóO½dVu°jÚbƒlÕýëKš·Ñ×´.é(n‚øÍÏtT]aHÝ·Ð$†l‡ÏÍâ¨Ù”‚¦ã_y`k¤ïº¿'£0S7ì"£ì’.Î?û"<£°ò°”¢ë.©wKëÚ™»îkç ̃¿±šú¢ÜˆºwJoµz›j.q·Ìª|7hOL€µF@CÉm(ÆËH;ôFé­÷FZæE-›ïšk¨ºììá_…(L_{£úº!FÕkœ°e_iq²°Œ>òŽvü$Ñ&§èr“©¶aäÁNÐQcbì]¨M"éµ¾4j>F¯ˆÖ ?83HO¹Úée¬©t™s âœ= £ã–V†vü®†vþŽqÅÑ;î³@ôqªTϤvm×uÝ>â6B$Rˆª ‹vÊã—˜Y{YyÇÚùGâµ 7½âÖ?@Š@ ïw„º9TÛ©ŒtþÅ*"ï²?%-Z;¼šß O eÅ›¼2†CjpNŠ¶}³:!¥°æ›³¡ë®W|ÁáîdM³¸‚šÎè˜P¢‰‹M(9˜YA®¯eX•Ýv÷´ðˆ²ó5ÑSW÷¬.¹Ò ¯«pWDºà\È0¤¬ð&QÀÕHñè„p3ÖùdzÊz‹¯õ"º åe¬ašÿŒ×$XípÓÝkÐ5 ïš!E}YrJ‹4ÂûœæÞêô3Q±¦µU ƒwÌÚœ¿#8w‹™ιô1ý<'E©†â£mm²®pj±3¶Ž?ÖÅ`"çhœ„WÓ¸ì0YMÛ=«¦ÃËHݼð s{´¦ybþ¤‡\¾f¢Gð:Ò›EÎÖ< ¯Ùk†òRíqŽ;97Þ ä¢^TÓm‰Æ9Ðê~…”ßæöÞ ¬†¥GΞà¼ÁYTmU-¿£=1±ÖÖÔf.2 ˜—ä€ÎI¡úêé¾ÎØXo !2ö§y{[è(™&ÖŠÓ‰Úʉ_ NTš©aìŠnå}XTÝÏ8rZWÛÔ‹+Ïu¬ã¦wÈ¢¦~±ƒY Î/ÛÓ0Œ9±öeªé¸³/ÄòÊbùçâø—ó*!nuká‰{ÉŒRcCC·­O™§k>)·ML¤ ¤ØŒÚûæmÇÍ0xM/‰:þ¥¯?©-‘ÚŽùä+¤.Tµˆ§ R¤® uès"¦’jß»»;ïxÅo@ µ+^Ó<¸V^CåôÃÌ­'\ #v1Þ ©´Â0½ÐÝE•=ܦ޸ {5Rºÿ¤®BáöHY⇠zÔ#{ã •$„T1€Tî ¤àÁL#‡æì»ì¢išYE‹@Êœü\°\<%?T/|­ª‡×Ô`£þ)H–áœÚ…× Ì9|X ã”\ŸÞ®ŽÑ÷b\Šãƒ§VÇ¿”u®‰¤2Éû]ØäÍ x{µ~ø*rŽ–ÏqŽRòÕt<³kaHYP^€hˆ¹3AÓ<>¯J©«ÆD¢ÏQ¤à…(¹©v8Ç]"rÕ‰¿/œÚ¡íD¦Õ=©vö\5-û öÅÁ–{¹7*ÖÚŠÜ$€Tv¬ )R_u¿á}LJœ.NK]ÇÌ6õ<ýßçÏ?)ný 7CŒšG4Äéè¨bLBN÷o"eÛNCu]+WÚÏÜÆÏm¥ù—B*µ†YÓǺÒͼ|ßÝT“àõøÒˆxëøã]Èbï—ÙÇ[Š_ˆÝú ®]OlJ”~z3ël­Itþ¥.Îg UuU_Û0ðx?¯¢íãª+K_‚–t20Ûù اû|ö3Î'èû¦Ÿéd×öQ¶nÒÔ Î®ƒ’R¢„‘ÔBª±/"ÌC7¦ö´PJ¸!Ñk7íüÍТ:Òýè§OêY'‘«ßzixqŸ …õPR–‡Yj ÄËnÙšk©»—7?µ7Ò4¥=ƒ—,V^·PSs£Þùo!UÛüL®ê·.®¿mª®v²7Ú¨~­øæ{QH%f¸›§_€3rnؘjjxV#Â…4•Ü|'„Dc›½‰³‹»†ÏEÎu¨¤îŽ¥¦ªçö÷ðŽ¤êŽüc¿Ð«EV÷•?rtvµ0Puà¼C¶ A*šÑM/¨†Û-7ËUÝ8·èz‡§R ²»XFÔ±O8Öžuï!mïŒ+P)ëÏ ê‰1/-BžBj´±aà~v³(¤´|Š_ñ*®é˜F[’Uñ*ûèSV]bn¤vÈVm·ö¥¯¾&:'…BêëÏIÁ %¨ä¼ h‰Ñ'tÿ:lyÉ a*á}.Èq$øoÜ{øH…™®TÕó°öŽ¶rÔ7¶±Ý’{L±¥ä¦˜Ø9EdÙ¸x™E%Þofá`˜áglyø ûÒ/¶FúfžÉqeÝ‘Zq7I;6iÚs*ÌóV$ѯõD†{j™…ºDf8Äýèo¢kGΫjq×#˜ìÈãÓ4]·±ë»¢ÂŒ]¢\"ÒLl<ݘ÷y½ññAjAHeFáq®û†Cê ‘à™u†TÑVžŠflAÄ:qÙÆÒÞÜ?Ã) ˆhàXÞà`keì™ä–jíèâ’…ÕEûjøúíyÅ(Èûê9:Dd;EÒÂãƒ0X§àm¿æ²Èxms«À Çà,+s-§‚ëÜú»¦ê::À)™ìBœÿ^R¿Û4ìvu¥ç%j”1ΖéE ÅÍUÔL£\ƒB½¬p‰·KZCý œ£Ã2í\]Lü7“¡œ,¬ª£'û„‹®œÑ@º´g¿¾‘b=<>ƒuÙñ0'/ ƒuð rÔV4&½€û[=”N –[Šñ>Ø'9¡>ÍÄÂÝ>,ËÞ'Ø؃”{©¯èèQÓDrE·¾'9%\I#2§Ùr.IQ qVÁÎá¹®!‘ºx{ïM-¥7Þºén4)D Yß—cäæ‘afïáL¾ÎmèKÍMVó>!€TN‚‰ªÕVÎÍ·Žêë­YOÃ|ÕS]"ò\uô¼"t–4ÿf¡"ï³£ƒ×Üåk¨mèç¿ÿm&)ÝÄ.Ð)<ËÆÕÇ4tOQ-D?^melfì“ê’å줅1-¥£B!…¾»ïÛ~wýü…gþ(<ý´ðôäso˜È²dÁ¾vM7õÜ3ðél £ºļôK-$¤$åb2êè£]x~¥U÷3.¶/w³®´’/´ ¼«â5éÜ{ð3»ª•|æiá™ç´+ýà`áé—à.ÌòW¤SO©U}¬ª÷ä mp±êÊYØòùw,xèÒϸüš|©Sˆ¤K/ÈÚEwô°kº(ç^ ·({ÃBÖ¨3Ë_“N?)<ýŒZÞ%Üö[ñ6TTYKϪxC:õ„RÙ3ø Ù5=E矃2”‹íìêvò™?(àÖµÝEH P.u0.½(*ïQ$µìã òú‘Ê÷ä‹íH¸·èÜó¢+ýLp£‹ìšNʹ7H vå;RÙ[8ˆCÚ>r¥]PMÒÙ—tdƒ-4¨õÅwEeϨÈBzŽ¨=—„öP/w²«á–$_|;TÔ¥ê=éô ÒbÈó… Üg^Ð*{„ {î-ü·†îÈ0ü{0݆e0àtŸnÈ)fyKá©'pû#iwAÚ§“Z†t†soYp›ƒv•íÚpù%ù|`0¬¨²T–RÞE;ÿ¬ðÔS¸«Àez¨gŸÑ®ô ;Üø½ƒÍ;ØÁà­ˆ—ZOŠq¹…t®•ò… )ô³¨þß«bœ¹‘™£c•SÙÇ­û`‡u_*)K;è·m+T(¤PH¡BõÕÕÑœðÍÚ•züõ§ÞæÑO>T±õ§m+T(¤PH¡Bõ•õ3¿ƒ½‚ý¯|‡?*R_RGï@̈U+f6Ÿ¹ÿM[êñ3^T²RG†X5â]T¨P}5ï·ÿæ·©Þ>èç—Pñԯ¯¡ö¨ö±¸Ú/Pݨ­º×"Þµ@… Õ×Ô—ðý[ø×ÝUþú],uµzß (®ö tâ!ô®ª!Þµ@… Õ×TÍsè·wߤÚz µCM U™ž‚$ ÅÓþAQ k-Æa1¯*T¨¾¢Öì…jž}+ƒ$ØGÜĆlÏBwß Œ#Îb@7^AÄãâùP¡BõOx?¥Píóo Rìþ$|¤_œ ÅþÈøŽ B…  )q…$Áë—É®›yhFäé‰9-³ÚÀTEY~qr§ÀŒJÙ-K4QÁjÍÍì¿túÞÉeµûÎÌ¿J«\f‘:ŽþñEþwø2"ïÒr—Ò¬èR¤ºeŽü‘Œ¿2ƒût¡¹ßŒì.у#³Ï®pûIêsG>b\_lá ë²[ŠõE¸™¸}ý}‡õFîkœÁð¦Ëb[}¤ò®,p^¯g»Þ$|~D½o€këÚĴƱ”n™” j˜uΛ§$×N‰àȪ«®·ß)ÍD®™L«¶Ò¯l\ÞÃñ)ÇWꨮ¨B½+*RÿÕ ARˆþ`¾vEÐ 1‚ðÀ5?‚»ñH÷׈/¤Œ±ëÌb• )£¸AŠùúûè}s6ÏŠ®•âôNcÊê˜.qß<©ð÷©1•°Ÿd÷ŒM93;îÜÜ®‰»¿Ïï–.¸>#x˼€íÓ“îšÛ5!úДìGSƒwL$wŽÌ€»kbÌþi¯„€Ý/“S7=å`00"íø̸û¼î‰‘?MÎ}>9bǼ€­SÒ~“Ÿ²žM‰>;!éôÜÀã#¹t^ÓÌàÍóvMÎ|ŽdÁÕÞLŠ90׿tnȱq¤NÁõ%iO¦†ïœ¸mjÚ¤Ö§K»8;`Óœð²Q Äçs;Æ%˜P:/hßw9o‘Ž CjA̵Á[çïŸPøv¤¸Tá­![ç옚öH$wÝ?"§n¡)A™37®YD7Œ—“#÷€–œY>’Ñ Èä4LMÿeBô®é‰7$Ù'rá|ød@« ‰RA®ïå=ÜÒˆŸ…_0º£ÝX­_ú|:6(‹/•ØŠ”MQÐ0;ªõ®¨PHý׫û^-0ÐRV#®ò¯ÿW‡Q§ûUà=‚”0)tW|!5ÃXõÇðk ôñ²¾waO8)nït{Ëõ6´ÉIZ;®ó¾$“~l½¶Íì˜úÑ”û«ô¼Ç“;$˜- ­T53e€ód6ÊbtHi^…7[x껄«u Vþ*QÒ>ÏØHÉ8p‘ÿѱÔ!¤XШ$Ž¼AÊ8jç@S÷M Í–w:%˜dçf¡lzP¢´}§d;=éθ¤Íp.“sº$èMkÕ”×ÛM­–ɹ(‹3Ztöûè’š† S;A„>ÙÎXI?}ZbÕ ßh9£¤± .ìÖy––+ݶO‹Ú¹†`úCês©‚ó4´Ö9ð¦ÆXfl*ïXN‹Ñ ™W9%4O^ËnZ°äÁJUEEÓ„YQçgyF(³FÑû!%YØ´ o¸ÜÿÄ÷±»dµ —$¼ d¿dÑÓí” ¨“ò_Lϲ5[gÇžœ\>ßÞCÎö€$§|d‘Þb¥û®I™†=n÷÷ËKð³¿þ¤ í=Ü+¤¬uM÷ðWt€ H¥c1¸¥ÁÕÒ‘9)4݇ …Ô ©^™Ü;“bJÖ«aŒz,V‘ÔÿOH-‰x%Q°UAÍ| IR”#òß‘‘QzAÅF-¿‰´ßVâÝ'vJ°ÞÏ·v™Õ"A¹»Ä1n%Îb’È`«àr§FçÈÛËÒq‰XõÐÑüþ¹&ŠVg龦T™¼“ëpÖSsZEšºobX®œói!¤Ü­”ÌK”vÌ×ÓÚèÒ„xྐྵ&úóIЯʪ™MÍAMßTŸy·JøÓH&ÀEYŸ+̓¤(G¶Œ¤¼Iº¹R×rjv—dþnybÄ:\—±I‡æÇü*Ux^^Ãw,­Ø92:£CY ¢­àÄ”—#Š- `—…þ!Á¸RUõÇл°UŒgˈzsrßLßCŠ MˆHS°= X·0", «]8’?”îëi¥h~@ØF>  á0‰Œ|Dª]¯i1µEÅ褋?ÊaŠB Djé9JúQc†MöN LÁìƒ €»DÈ©kaUÔä ç‡_AÂ4t '*R{NªgdácAžxé¸@E£ ©Rှór‘u>&A= 5‘I¦%aÕÌ–ºÓzPº&(+iþ}oÁ}bAxŽS|âV‡Þ“Î9´Ìsï÷Ž&«Ã_Žó —÷¸ù¿ãš€ aæ*¿Dkþ=½w®±Þz¿ß‹.FfÙ¨cµ^uíçr$Xèÿ$¤Æº[ µ€¨±:ô’6ì™cnüCü©µº®“ º@L1ËÅRÎ2e'u¡'c¡½VÃ{,š”)k¸Ä5±[:ˆ¦f÷J'F*˜{(<'•*Cï…S‹q$Œv.€Ôèø-ë |—9ç-òÈ]§¥¶,ä‰DñÕêš?¤´#ÉÏW -—%¶ŒÈBj²¯ƒ‚IÜ>žôŽjÊÖ“C+RÆÁÚ/YI¦Æ«à£Æ2‘ÊÒ^M ,ÊêEQ°><yA)Él–"!dlÑ`1Ð\=ßûÅcÌŽ C-¸UÛÇdÖNá¯44•·Þ%…zWT(¤þ6¤˜/YZ,-|Ê„8)˜G²ÅRƒ³‚9©”avvª¿HÍÉBàËùWîüú H=E–Öß^E°Ÿ’y`=Tf¶2ÎcFRÓ¤Ô:X)WGSî­Â#¬Ià)X¹8äŽdjòzó- mægw|çç²Öÿ’°Yò8U›I R² uXIÕiF|±œ†ÝäüÎa‘Th®œÓ@$åf)©çAÊmRa·»{–«ý¯ƒ¦6Lȼ/I©Ø¨¦ýCV7rÍ Ê› •œ `’-Ã.1€TŠR±…í¼œ–%F†ËâŸ#Íòn»<ø)IH%#³e‘…ñ’äW#!åï!ë´IØ>©õÓo`} RiéÊø°± ¤oÐn¯ÁëÍÏé’·=ò‰Eã¤ûè×Ö°1ç­0Û º«mž­ÉºPd¾Ù>Bdé tvÙFM LÔÁ¢B!õ·— ÷$)ªY-Ü?Ë?S^Í`Q´X¥ûØí“"vÏ ãmÄ(­sÝ9+äȸ¢·ßÁG˜r*˜•ž»f‡ÃÇHê)òz¾ HT2\âP_zÍ:m‹i9mȳG“ÒJ2~Y¥ëô]Þ;ø"ÔŠ „ˆÅ–6³Óº%˜5«µ åMSÇ1úÇÆÑÌXpÒ‰Û;Þ×[O–."A N÷Q¤9Ð$?9ÛRi64è~ÇGR-wIÂ~ûÕ<‚¢ù_BªwRPŠœãa)¶`­Bõ¤œV ê¬á¬p¤oL|c=-³M’R¶QÛí»¼÷̶Éik|¤ Ï)ö³åúÆ‹RßÂG2w(`°Ë‚"é>Ì ÿp )òUº–Ó :dsRlhlCκY©Ø?"·á»¬×C;ª!jM¯’Õ4™žù€xdúa9-Ÿ h\$Yá/!׫oš»­¢w é£CŠöv|W^Ëo¥S‚Ý:ÛÞFÙöÐHz»$³[’ñ~\,OŸ6Š…:XT(¤þ›Í¼}£Ó/Í Þ6'xÿäôÇb¶™—Óö]èæ9A»f…ퟲcnÀ¾ñÔד¬¸Aj¦žìò'¡ãîrœœš†ý¤"ø×ñ…kÜWY‡¯1r_éuZšõv‰žÑkNn¿DñûôÕUÕ\'‚úò:À/Uµ,…·Ñϵ÷“5 Zié·Á0rFV»DqëDU9߇HÉdîSÔÏ ;ãÑ=ýuÞµ{¯ú¥ ªW-ÖÚ&/q£-°Àa öH”¶/Âm” z&€Ô<#­±¿JÐ×kZW€ÄJE÷ØxËš®² ”Õ÷œÿD‚ß6ÃÉEï±Ò6æGßÓó¬Œ)£X=ßû'¬7p_mæ¹Á8zr~›tÞ)y|Ì(¤¢3ÕÕÒFCƒRµWÚF/õ:<Õã1žÜ¼Fií:‡‚å6ÑkŒlÖ8fA£R·*‘á¬5ýé\§ Y“€•–Á²úî‹¢~‚€”«Æh·ŽÝ&„å¬3ôXi&kä¹(â¨ì„°leËýŸ„ÔTgW5“sÈòÕ(z4Û-DŽ`»ÞÐUÖÀ~½qìôô§ÂÂäë lÝ6ê»®5õ]kä¶Þ8hvòïèœ*Rßèk‘þt+ÐÇ;ƒÄ'Ý¢$F»äÐÖÚ~ð+±ì÷é…¥·#’È“’dv€_%¯;€Kv JJ2Ú¤˜=Â× °ºáSèÈ‘ÁknŒb÷H1º%á«1zD3~‚ëÄ!ç 3ZýBSÙ½ˆ…ý›º„·ct ¯#<‚ØÌì¦w æC¥VÁ¿ö˜”gt mƒODî_¤n$N:—ïïõAeá« ß&Z»¡–ìöyp}fϧû³SŠÑ;¼öO‡é¶Ù 0ðÑ@ÕÐÕ}¨PH¡/˜7¡ïîC…  )R(¤P¡B…B … )R¨P¡B!…B …*T¨PH}‚$¨ðº3Q!ã“È_æ-CãEE‚ÿ2/ü÷‘‹P¡B…ꋼߪ=Põ·ñ—y{û¡Ç­Ð£÷â§ßßC/; öèá{±´_´" /ÚÅ»¨P¡úšNãY;ôGû·©>èÆ3¨ò¡Xêç—P{7tù¸Ú/PùC¸7_ˆw-P¡Bõ5uíô¦ã›€TOtôĬXµb&`ó™ûÐëˆzEüŒ½zÕûY¼k ª¯éýöß„ž·}+î‘] qêÄLÀ泿@o:!Zµø/*F ©ãâùP¡Bõx¿·¾=HÕöƒÿ¹MPÉuXü&Á‘~1‚\‹Äø¶\P£F¨ø|°¸YXGR¨P¡B!%vb×0u%変D-}—ü:6âÕÅR€J€GÔ;ô-ýötqë!sóK·šëk­ìR/0ä H!#ÞUáhAPAv=L[nÝ¿zð b?ì/nB,ÿóbà0ŠàÖAl‘' –š?{"Ò œz¨Œ©šþ¢$"¸Ñ¸ÍÂ1˜¨Cp:o`„Vr âÕ#לՈÜepð&b**T(¤¾^$Uß›–Á‡Çìý%gëN=Uy;Ê#˜ˆQ$•SL'šÚà°*nÛ;¹°åý”»4Õ¼ØWsöœ0Ñ–7L½Çk›HŠw 3[kžTêGŽ€"©¨Y§\úÂöé¥^xÃú¯pÖ/òÿ,~S«Ÿ…>í!¿ù³v^®"êºdœí9ب~åó'B‘·ÓqJk‰Éõ¼ÆÏ°i|ÍPvœ+FUSMCCE~½¢’šš†¦š*Öu{7¿bœ»î¯ÓRS×À™úßbGíûÄ쯮©¥Ž3¶Š?H®êC9… …Ô?‘îëLãŽ=ÞÆ¥Åw Œ@œAàI¦Aª¾?‹¿;ïâ¯Ö×m¤jûswóáÜ/n†xס 'uS6­Yœ a£bV?©Ãtu]—ÔË8êá¤ô<ì‡ÃÆ:$ú¸A›·ú¹[:µÂÈKÚã Ã8Là#A8—߈\¼*AÜ5¨äª0Øá_…/Êð„Ñ(ˆ/·ƒË=pýfä RŒ×Ô`§¯ŸýdÓíÁbˆ% ð‡,¿\chè›}iàD¸²=ñI‘º1µü¦¨JP¯¦„-ò?ÿ6”¨m™\Åi@Š5«P"ˆËâ¸âÁô/8XñŽr¾…VþÈÛG«£•¿¡œÚŸ[ViAT2ŽÜ~øùìãôÒ=ÆZ:©µœPAž–Ÿr¼…^ÑN9Vgof`Aùß„úIT(¤þtŸ°úu}”ý‡ôUÕ¼¶µrëÅ(’‚WIÓ#«AH!.QàxW{£=ô´«8WÅR ìAHa @ ¢©w°3U×ÄéÚ¥¦žnåÔö&ç¥êèh«ãô¬SÎ0ZýL”T°ªª£ð2çn¼=ÔßÓ”üøX@¨¤ S‡ì뼦ǎ&æ¾”ýÆzºê:f^Ü›¬Z¨pÏ~‹¨’ o }wܺæE` ›¦¦†–iXì¡w€œÚžL.GŸ «¦E0 ÞI­éçÀ„êLLÑ‘ŠQ@øÁÎÒkmv©µ¾^6 :1‹ÜOA*H9tÂÒÔXŽwÌÊ(ë26ñMËÖÕÔÒ2 Š;ñžW?)^SoZ~AGCgéB½ÍHAs›úB\±àŸŠ’n\- vüdbˆWÓÄø•VJv„ùš“+L eGmê®æTz¢Á@Š[÷ÌÅk—UI«|Ÿ˜‡5£ݦMôN9ùž~›WàÞÌÓÕ&±…彜ÿÌkh t·ÑÏýÄÜkP¼—–uj¯ù‰†1pkQDÛÿ“!*¿¼¯pÏ> ]RåR+·¹;ÜUM×£´°¼=‹MÒ6˹ØË8wÝÆÊ/öÀsæåß½œŒô²ïø%#=c”™væu6#S]Í)¥ª'ÈÉ\ÕÈ'tÇ#ê±s&šš>¼?¸ o|ì-½™7è•ïâÒÂu²Êkõå¢öœ›¦¬G¢6A É0¤@4—CNVÁùÇ}O;Vfª¡àÄyÁ å®Bñ>:¶p¤I?]m¨c°å7fÅÓ@/ ¬ëÎõ¾ˆ@5C÷à-ŠªzD“–üæÖ+©Ÿ…ª~áîh`L{^GjÂôfqã} UuÏ’÷Ì]Lœ–†EäΔ}wòO¿`TÌ¢® ©¯IqáIyFù;Ê™»1gõâ )A 8ORÁ<$îhëÀl¸AJgîžížå‘ëìë ®çžZB*–&Á'³ñ±¯Í¶ì&j[rÈ•p¦ŽYÑOÕ˜ÄVôÎËü ¤Ûikúlz â#Ö…{&I{öhåÐêáZñ…ãÚ*Ĩ‹Ð–ÛЦ»UàÞ缺¾Âý—üãóCR-̉*NeÅMÏ­ íwt”‚ð§±+{W=¹ê} ƒ>êÿ:\—h/‚ éèfô³WCR)N!i¶nn*&\zE­¾–SÊ©N¶óÎ^ÐU7 ?%¥DÁjxãébn½©sÇ=hó}ˆÎòÄ;ó‹¢f©_]ÛÌv#”ÇKÐõÙÄD–wroQS±NºE8jxWðo ¬üü3HU=v´ÑµÚÒZÜ ÀÀ‹ˆšŸ;몹Ps›!Ò¾K‰Y¦VZºDC·¼”s½Ü:t)&*R_=’ªéÈØZžs¹|9m[,Î&£ðŠCJ0‘†ÕL9÷ïÿEº/µŽ,¯éc æ¤*!ÖŽhuãØ<äéðʶ0"ºýÔ™¿e›©ƒÕÐ÷-%UöÓOH*®°|(7õ§ÒÁùïl˜çïZ˜"Ú½ïÄ¢×À3_¼c%X VUM–ªòF‡’GŒ“ç‰Zæ¾ìúÂ3âbü±NeüºVf†¾‡»ùõŠðšÚà9©¬ßùÍðƒˆöÕw!ÝàÔÞ·ÑÖ´M=™{âQ·TËŒ ehà“YÛÉ»X£¯­ãs¬O©Úç®îú·VÃb•u²û$IHeÔHe“] "~- 3èì-,1ü\¤¿ƒnÂ~³ >úsHÕ¾òr1ÑÏ}X,IÕß2Áhxmzét¶>Vuóò#_7 ¬ÍnæUÔO¢B!õµ!Å­~åíf@ˆ»D«ìdT¾Ž 6 úì ‰Qº¯¶ŸYÙÁ©¾g©Žq.}ͬêdÕöí;€Óv‹9ÓǾÒN¯hgTv‰¤>^8Q±iý"©k&D£À£ïƒ-½±ÏÝr±70¡Üe©10Œ¤Ò}¶úÙ+I¢Õ¬ÓšÿRÎl:²Æ›þNE?üx7£¢•^ÞF»üŽQåÒýõÂönò{b¢½0N犛ž9XØoo+lè-8x‹Rõ.À@êѤ€Uû2Õ Bóuy›ØªÆlzE¾®[Úé.ز‹x £°¡H굇«…ÿ»ª•VÞÆ(K«èl¥AH±À¥81xÿ-p‚DG¶ªa¬« H?ݤŸ?^"ø!¤úÒ3"” Yy5Ȳzx-:…›ŒÁy¦•÷fŸL9Ý'X=jAåäb´’ ›Q?‰ …Ô?0'E?~ÅÑÎZ×Њ`hB°ÏJ>ÕÅŸt·®ÅÇΘ`j¦²~ –`©«çq¦'.ÙSA‰ onK4µ!šZ9åæ׊?¤.ƒÁÿ#G5ê5VmWjAªº5{Kž™/'÷B'³üOksêϬ²z¼gêÉôH“ÛØæ¨êøûÄ8ð“¾Æ.㯠…¬$´ÃEž,ª†ŠŽ]qôËκÐ_¸)]Ë:§°ª¯`ÇA[cM³­¬Pr¼Æ4/ã\kÁ®6Ö4î|gà"ßáœÜ¤¡jª‡v¼ÜÙÎJŸQx¹N_QÅ:ë2½¦'­ EE/—<4'ÕŸ‘5ËÉ<ßî|æçF¹ËnøRõíd¹>Á:|ß NuKh€ªËAöõ¾?û/ÜÔU÷Ý,1Zé1Ûo当W £¢çÆR|µ=Ì‹¨b³ë>ùÜ‹Ü=çìÌp„¸Z. )T(¤¾þœÔÇ©01zãÄð*‰]¥>)[QHahèº V÷Q]²2Åc±-«„”“­ìš7!ažêªX¬ª†qÈrE/»ªÅ×Ë£ å{â 6¸ëíÍ´•TÔ ÂÆG™Y'×à 'tE!å1 RH[±*x{X©b•UqV^¬kÌZˆUþÌÇÓ«¢¤çÃË;xJOk|”ÕÜé­®¢€Ñq ØÖR|­ýÃHŠt•]ߟ裦,§i‘˜tô¾£•–èD°JLTWVQ%zF~íï‰OŽ¬îã6t$¦ÇàTUTpFÁ; k†ÚÞ.³iŸÞœÒÍz:j*X ¢7Г×Øþ™HÊZ{puŸpwí»˜ämMuЂ:6q1‡Zû‹¹ í Éxm ,£Š3wȾH¯F6ù¢® )ôÝ}ÿùœ”8êsoœx›Óà'Jo ¼q¢*¾•Þ„÷ v ð®"¿Þn\‚½ñ58ÈÚ'»ÖâëÐ&¤ ¼¨Ù'uch'Q |}ˆà²‚%‚ã𥋠7R 7%5@%‚›ÖØ ¼ Ä¿>ðâP—k‚Nð^ªA³…¦®pOD· e®í½mº)²Ój`°_sàmWÂ}[ˆIÂMaÀÂ_[!Øcu¾ÚÐG‚7N4 ë(Ø®5øf­¡ã7‘Û¡«&P¡B!…B *T¨PH¡B!… *R(¤PH¡B…  ©¿©C·a?/v*ººÿÑÃÂJ±´P”*¨¥:|[¼k ª¯©½7 g­ß¤úú¡WÐË6±Ôû.²/ÚÄÕ~€ýÝ}ÐÛNñ®*T¨¾¦ÞtBï:¿ HuöBÔ«ÿeñ“ße¨ä6ô´r¿ –öÊû"ô{+ĸ.Þµ@… Õ×ô~MÐí×ߤÚz Ý£ ’`‹›XÍYèç×D‘/*:tãD8&æµ@… ÕWô~ û¡Úçß ¤ð÷È7±!Û³ÐÝ7M †ñ¸x>T¨PýÞOé )R(¤P¡B…Bê_)v?ü?’à#â Žô‹¤€ý\Äxî€ñƒGþÍ5B!… *R_IQï,°vVÐ"(i×ÛòÇÒÅ(’BÐÃx9Ù?^U~õ’¤N˜Mà ýÉlç@yP#-¢œYÁDJ¯eb)OY2ùwÇg\qsLa òÑ?…ÚÎ1™×eh}_P1+üYšô`\Á»ÿ “FäßMnýl'é—¢>—ßò'ºGg]CíùÐxö€ýÑÎ"%9½2Ù7Ç’»¾ÔxÖ»±9%Yÿ«Ï®ìãò_ ?Þ3*ëúj׈ÂßÆ‘Ú‡Ô5:óÚ(Z/\®H—ûsI’ŸóbøÁŽ1YwF2ú¾ØÎ.™¼Û2ïH3»ÁÝGuÌ¿?–Ü!üô¯Û’*úc\Þ Rß$¤ÚfÚÛ):•¡µIQï/ÐS^ãU7àgÄ!’âBßû/õb®SÅ,NF Å dÎCy'E{<Ç\GÁú”$_\Ò}HÈ~7ËÅK^Ï}¹CúR»`9œåR¿‹RÜ |eñžÏ³–óe~˜Ý=9jÿhj7ðÞãc¶, ½G²ÿ»öCS­ÔVúÖ~ÞoI=¼$ðʧ{2ïÝ,§è¹©­~ ~ÍÞ·0ôˆÍÈãþ?\9…ü&QÜ9Ý#yaüë/¬¦é¼>dlQïߪû€jÆG’•,÷«¯u¦KìÉ/§9{*º7Kˆö^Ë\ûèYÀf™ä’i©oþª@£ý=Tñ<ébѶº³VUk¸È—/™sl£†þrŸ=£h¯g;FÍNo™ee©à}VpSM²Ó^çrARŒ Åé“&?—à=Z©>)ð]î¨8´±ÖJ&{ÅRHêuLˆ·Š~" kQxDKœÜ2äK¹ÐGâŠýa0íÉù¨üçŠFÜn1Ü?s‡_ÿÃ# Rxý£YÀxRÏOÙÐ'Š}â.ñ÷ÏîUM±Õ]î_ÿ§u¥ùÇƦF|hŒ·‹‚ãup #û?ªB?\ÒÏ[Ѿ.)z)Ñló§–ùÒ½è14‘‘f j>xÜáÇðÆE“·9ûùêÈíšæâ'ïufÁÇÕ/¦ZEµ|ÔzÃÍàC£ý1z›†AŠswµ¦þÌìîOw'Ñ…ü<"¥¢“?rð ÜŽY6ýîK”B£ý|íDZòã‡.ú>ý@û?ìœhD‡BêÿpáD縄㳽“7ê…O.«tŸ  ¢vàÞ1I§fÖ}gæô"ß1I÷ñ/SWþ1üÐf’Ôׂïã¸XÎ:¢å};9=Ïb‘,ªÚ€3]äš¾ÖÀQï=#zÏ6þtô6Úî»—KÕd×»m^fὧ½Ò}û\äu†Žòz¡“ ;¥ó)âdè}àÊ2áÉêš©bh¦­½¢ÓöùŽ¡ëôMñ!“ ÀE~[­¼aAj—DaÅR9‚¹ÞvQø I0Oä®Ã›oÔ³‘#Z/ ¸,Éïnm†ÅjÊëºÍ õ}ïªìxI‚Û6Õ7yÁj(f9=ë­¿cŽ¹©¢óÎÁëôM ‘ß‘†gèOç:úo$Øl$ZÉ™¤N"ÞP*ûø¢Áqµ#c¡)~Y@³ï—5Xùn´Õ&îrÚf ‚÷,t[O´7%föOÏU¶ÚœÛ¤ÀEkÚ<—Èu–J87xð_òr™êºÕ‘-£’6ËêÙlÔ³ÛH°^á{ytú YM FÓj¹Ï ÎýÕ˜kìätC&Q[æ:øm$ ìI›Dé‘yz”\æÃ_ª£º1ð±LL¾ºVöHa8ðx…fnòK霳Ë,áö!Øý\%ņ!%k=ÛŠ j°] 8È=+¯8†>[Mˆ$)'.´Y§o£¨ã5;ãDñÛEÚ*rάµx§m£ãùk‰p z̹÷Šh¦¼EÞ<çÐõxMç9í%¯—hl\ödŠG¨‚={±µçF¢">rrA¯Dñ£UÊk'·NðVÆb”qöóSŸLݳZô+[ЯæÅß…;íÁ+GE¼Ý:‹ÄùÖ*úAJ]k¥SÎ:};ym£åþ’¬Ku4ç%=Bpß3Õ†ˆ±<-ˆà¤(·–qU½õæ±ÈO—a×®Œþc¦€”TNÙZ¤%WxíYP¿ØÌVŽh#‡·Xåqt$¼AæÆZUÌ*›9|ôŒ˜b%óM’ðdó-óçºF¯3°VÒržÙî2"uÛ:^žè´Ê©d‰1~AÌýÿŸS½ß4¤Ú'ýhë+O ›šÛ-~«û>†¯gbs±#èÞ^³ÓÛ$¸ÿ¾‘ÕŸAªè”¤Â3ñš4RÓ=åµ ÆR‘ivï,cÅÕÄFdL[©¤47åé|õ ^MÂt®HfÙjÃHÑâ¾qQ{§¦¼B&Ã8ró ûI¹Ý8òÝÕš¢ùÈ#Ô3Ù+ZÒ¥Z$sŸ¤vÄ„üv£KÔ/T^= ™NÏ´q”סŒAF!N×lCÅ•¾-…†Š›~I„7Õ·wvjBFéFºâ ˆ/Tpe5A~¹_ŽùëJ‚âò «È5."Y^5rBqŽöëJ-ýEé]ã"Š$mËH‰çàUck‘Ò¦ØèHYžÆ•¾[ªª°"ìÖ#ããß"— å7Îñ=<’‰øh¦Òö-è¬-¿Ò§\„Ò%\ôxzx9ß;[iç¤ÉSì¬elq›?,ÐÓ^øGm\¯¨± ËÕIÍ‘VCûc©~w#Â&‘ü†UZÓ2ߣž”nìèœãâ †ÓsÐ9¿hPà·£BôÁÇ`|/ï=©°qÆ{»á5rDJºçëkK³Ç¹8JýZe­9 Ï/{TÒ>IU/Q I“Sò’ýÇø0ÕÖPÖänSÛb åŸÂžNuVP+èÄÑÛ¦[k‰[ïÅqž¯PRX€¬c–ââˆ78ÆíU*Ê‹#!e&—mÔ Gᎋʓ2!¢ôâ(¿-0ÖÿRkðøÞE¨=#Ó~W¶›\Ü'+îtý–Ô²VÕtNΠë7"†*§ž‹zRì—ËTäŒ~>ËÆžçIM±³A{²´cž±Ž”ãyt áÃźª #ÅÑï¬V , ª¡t‹aKZWCú§L²7–1;†´h¹šÜÿÛè“œ²MJVsnÜ#©Wv_¿¿Ìc}m$L#è‚ ©[4",@N5fŒ¥ •”W™=Ì2½Pjª¬fÐx vœt}­¦Á”ê5Z> P(L#†oô¬Gc>´kkUfaR—_ò =X|^\ÃgBRZÏt¿µA7…†…”½«”+:ì##¤˜£ÞZçó¤”çÆ\Ü ¬3/ ]ø*¨\jj'­¤*KPVTrŸ’Ù#ÝA!•×‰A*FÒµ~l„ßFÇŸ…ymÌýYNÞh Ì´¶‘t¿ÅK¿œd¯û“Çe¡² :&çoÐЕ%¨àñâò¦—pt„}:‹201Ò„°Â·刊æìd`Lb©„e©0zß_,50Z‘Ø1¶Rb™Ò6'xù«c=m¥wâJ[QHE>›êêƒWö˜R>šÔ‰Z{§Y›HÛ7cÁ1¤põ¹‰Xâ­}rPÞ ž=x³rÜ&0ÕÎJƶ·©ƒÔ3ôˆ¥–¤Cn3˜j¡&îT+>*-¯;+ ÁgZ×l{Ë%ˆç‹…ûGoº¥Ör¿¹\gnüG ã#)Òf;ùÁ«Ìb9EQZ÷|=õõÞPÃÒ2dÕ}'ð²›H·Wké.ÌèI–BÝF4V<Ú×UVo2æ/ÖÄ åê'm_Í ÷ LJKë'dôCŠÓ†B*²—E‘UrœXŒ´´q Vè™ÎÎî™äí´Öû"oMj,Ñ ?Œ'¥ýC –¾BF.Ñ]„¸oÙçÅÕÆÓÀÈømRF¥CWQGÄPPH±?ƒT †{›­e½ªÖÂLħFJQçÕî'‘ûþ“ŠáŒ4ô‹añ!N’²ÜÏ»¡c|\eõ·‘Ê%õ~Èç è¨Í‹…úAŠön†OáÌì.ÞMŽ –ÖOMH Ä¢9OPH%vc ç}baŒ9IOøyõ©™x%7QŠí“º³Z¿8âÉ`¼^ AB‰QrZ‘¨›ƒf0ÞZ­¥·8±jµ©¤Ä½›>‡ÔŠð×èAÒqMßñèk:†ÔÈ!’t¿> ¤¢N‹+éÍÉ\¾ÁÑo¯"H¯ñª@ ÃѯR·RãBÜ68ïâµ1ÿ Œ¼ÎŒ"RÄ;|HÙ} ©1ñTiÍ IÙop¬¾‰®ž(¤h7×ièÌÏæò 5ÕBe…O?¤R:0Hm’°Ú,4<¤2¤lO}©•­¸’nÑÈíˬ}ÅÕôÖ9ìÉB<©AH­PÑà>6–,­:)µg’‹ûðB.I-V MººAA{n.ÒØ=²òÊâÄuFîë ÝׇÌMü]¨Mjd {£M$k›„FȸÝHIZîåC*›!«h=‘Ò=_Wm­ÿS¤¡¤X9þ%È3po•Žöâ´NRèšoý·!5ÍÕWÒ­…·AC8)AZ/~Ô§zËÈUSÙ`HDì\gD\c6+»{²§õßËý‰Äa ¥¤3‹—8Ayü£¾î24^ñj¡¡áêð?¦x…-‹¸9t é¯!E­ß ¡.¡ï±í.·µ&!‹B«q´;?©OÏèüRÅ’ÖyåCªøŒŒ‚1ò\aÖöÎ5Ò™óBê_îû0Íů;%ã·1i§W©É®u«¤Ä zïÈÜG£r«Ö(à ½=&çwjß„Ð 9eâÌäû£³ª—é¤- ±Rl0ÑÕDN?{äÀþ5Jã*M³ÙI­¸üÝRJNb¼_ÆüÚ J–Ósê×hÿ¤ÂþRy§Äõ’GQPH÷K€”ÛçRš“xõ'eåñ½èhÌ~5Ç­xBÒnY¼ñ42faî69y‡ÉY¹ýM"Ï,ÜW;*1OÊŒ)„uB‰dy¼Çx˜iõçbÑ·µ'±Ï­ ÍäÍ.ãØ¿¯ÔV[×^RÚºX ®I}©ÒÿRaÏÆd=A›ƒ|EiX'/?7«…”Ãu^¸)&ówYK<Ùóv‘©Þ¼u—l­dìZúÃ}Ï°yÏ—hi/pK“Ó-AzG­Û §8?£ß› ¶ãèý‰ňÃòøGE&êë=nb 7ƒ±èñQT9´6Š‰ÁüÆ°zPH`µì•"ØN,ÄN.hZ¯l:½;.âO!5ÕÍox¡*ÒÒ‘ANRF$aö‹H-Ô" "”P0šŠ:}èâ 0Íäœ(ár›p§ÛÚîSPŸ÷=tï'uƒòÐ)âÈð8yä•æþs;†6ê šŠ@Ê™‚ŽÖ¼A‘°0»•Ì{« 'õ¯[“b¾›î*¥¨€WÔ_å~jÄ7¸|ó¥pß‹¥j’xYe Y‚’¼Œîy}ˆË?É?CB‰€WÔZkÿó(ÆŸd›)èèWO—(Éi‡Ì :2ÓŸ´AQQÜö€Ìéœcª¹Æy︬[sÝ¥¬ “ê×iyR+ ¥á3R×qÅ7W«™ÎJy2"·q©±†‚R.C ¥Ë‡0/­{œ§œªïŒÄ¦YÎ2:‰£(÷R"¬ö®›zt•Aä-£ù‘7…(¿­Tןvi,©g²w´¤sŽ|w•¦ÞÒàê±UËõõ6tϲ²æCŠƒ@JçSO**­5)óþ4ÿÂåúºx¼1ÔÎI®žxÕ°i©7¦Ã¥T”—ûñ<)/AÊæ3Hm¤x’_rm©‘ÑjÏãã³îN J’UršDìätŠ&æ¾Ä1Ðpßž'G–ÖŽˆØã‡Ø£ƒ×ÈCísuÅkˆæßY¤Û)g¾Žx)ÅŸ"žñªu·–ÖMš”ñ@4jÛu»©Ùí¤ÂQH1º¦y„(ÈO+þôÁÅ”QP]å}qlfõZêâÎõ¸ÒóuU×Õ«`f*–7B¹3Ï{7z ½wBÌžÙÉOpŒ¾±‰‡–8$-sÛ"šðË"¿9!bûüÞ`ÆDÐgGÝÁ±ÞÎô(šœÓƒc÷Š†—.µO\êñóø"ôá̳ —¹–ˆ!#ùöåN;Gѹ¢·.³M‘Û;&áðü¨ûÈi"9õó\Ó—;dÌ­ÅœônÑÐMóc_ðjN›{ï£æSÛ&Ñ—Ù'Í­.º5Ï5k^ØUóÍ4Òr»Ôùá×ÆÆpfÆýŠc¾žI¤LÌEó|FæTݞ‡÷ÓüY3sºF¦ŸŸÖŒtÚ˜¤S ÂnðÖkFÆm^P‡c˜æYˆn*¼5›˜³Ü>y©gRñ.¨[àœ±(ðœýÍ@á8êû)A´eöÉóÂê„‹nÎwÉšqWÔ<ß%caà¡>´9IïxQP‘¼êEŽÌq¤þÍbuO ã,Ez؉25í9ºªHº;×·l$[Nð—¶>ù‰Å ÷IØíà,³KZäw42;'û’gój¡£s˜™ÞËìS{MîCZ=*íÂüÐ&^„pDüŽ…~U8v×TïâRßMˆÚ=7éñ¤Àâåv)óCj…Q_¹¡…S³»Ð“Ó-±Kš›üG‹tï2¤+6‰æñ6JwÝ»Ô!u‰×Áqñ{ù\Ž ?ûHŸœpi‘cê2†Xn+ÿ1.mŸ¯-·<ìÙ'{Є3/.ò:#‚Þñ÷Ó‰32ZEö̋‰öya#Ò“‹ýO #}ÌÎ%‰ËògÆßÇB÷/fy²°9•y±é+¬±ÍýÝŽ4“Лé¿Ü!ofÚó9Fzsã~ƒ‚ïîƒïîû¾éó½E îGÛO†Ùœò1ã>Ù_3ôà°µ|²ëèD…þñþ¦a÷. µ„ñQrÅ—öI}T ÷Sû?Ýöòq]Ÿ”Ãø3èà“ ;üƒÌ¿ÚÅø{Íd·9è“?/ŸúatÊÉõê63²Z?ßœ‹®IYïûtÓÓ—Šý«6þÙ®«ÏûùÙ&£Oú¶àqq¤—S=¼ñj™£ÃÍ»˜Ÿ]øgÝû¹yCÛõycÙÝÓllÖÛIé[,¥b=9·÷_H())øî>¨¯ñ0""VNÉh1âЇ¹ûãb6­s:öM¿õexõδ7”ÑŽžT ¾ê[Èø‘‡Û‹,ì¥ ªÒÚ¾³’^ý÷,AHAHAHAHA ÿÞ?£f ·øËû–-pclÿªAÉßzàÿ„S¬ö’>))))(((©ÿë=Àþ,X°,4Íßü/ƒïÀ´Í‚güPý°Ü~ œÎ ä]€‚‚úGF?ã“ áåw©^.xÖž ¦Þv‚Î^ð¤MPíç« tö€×¼PPP_Q¯>€çíߤzúÀ‰;€]':÷å­FPíç‰Q Þ|'î v+   ¾¦Ý/¾H½ è5èP)XBl>}…©JðŒ*J5xÝŽ æ]€‚‚úGF¿7 ¤ ¤ ¤    ¤ ¤ ¤ ¤    ¤þRˆ˜õÜ£Wc9g¢8—ÓŽ½aÔF WP EGL­´óâ7•gžï<m·øÔݸÍ×È©.Ò"f#`õßäGz-`7!ߢ_}«÷³­°yMøß׈ÕÂjÌ:ði·`?²±Ç㋳°ëù= @(©oÔ“ªù›7kkZÙŲ=ÂU5mýî`Ö Š'…GE‡ÏYZ›â¥$œ·v¢c{ÿiôª6o7M ™ ìÀOŠÙâ#¼¨·é¼»€ü²ÌÒ;'ãòß‚ò?§ù/Æçÿ‰êA!‹l|’Òô•jdÕýææ}´{˜‡äÊ-—€‚ì ½Ã=?(LK[ºuÅ$¥Ø?f7ÂÑ BêÛ…³¦ÕÏ×Ùœö¼™½_ñ*A¿Pë'ÜW¢b¼‚wÕX*á·u2ë±Y=v<K®¡±±¼FŒ`AŠÕB­ä,“ëhuü2‘ NI—†ëOý @/bï—WÞ3ày ç×p?sß>÷S¸Ã 3Ÿ@^–Ÿ¼q)¹|é´!÷ñïüjˆa̺w ôÓ¨¼Ö@˜z¦g˜ž¯ÔÝL×óÈÓž½óBôÁw¬z0\óá!õm„ûj» „b6FÅï^Š–×é)d¼­â–¶<µè‡/ȺpÅLË2Œ}@M;Z0!UO€Ôaʤh¯ÙGƒ ö…±k‹*Ðñ¹ðpmXñþࢲøýOu=)dm}gffi™—ZÝ“¹ýBì‘?RKåí‹Þõ™„0ëÞ'1O¦ìo -8‘[X  øHCDñÞ ¢cÉGß#æew¥oý%¤`oĦæb^o×t¤m>\ˆÔ^St…‹¾ü²šÂýaœº´o¤˜ EXáž`ÒéôÓØÌ¡æmû|Ö¡áEû‚ɧ2϶£m)Ç8\t0nßï<ŠQ/üG/ *<ˆ‰6€nu}y»ÎGl{† qÕûÖÅÂËo’Ùçr.ô1z³vAª#ŸÎ8Õ†ôØPH‘Î܉¢ .<¹í&µ­44ÐYÑ$3¢ôJÚ®ê¸C­Ì:ôáÏà *:ž|ø }`Z™¿d¹IÚ\|<ý—Ö?Á=„Ô×Iœxíe­£ª¦gžTA¤Ä þŒ—ÓøÛ ¤ìÖ¿óu25/zÌ<~DU+J!e•Ü€•õè€ÏpY*JèøRcwµD¤'¨ÛR‹+ûà !õxRXó{ó_‹§Ð5\˜ÏuäI} )„\¹›J5]¶P›ýp™ªVt©o-ëà‹’”‘SW¼’¾{R9`ž-SW±K8õéJ] ‡°Mù:vi9å½H!¤sÏ Ê{È'«õŒbò.÷T—½¼íaÆUtÁ++ÍRÏ{;­ñ‰µ²¢KÑ=dügÖ´ùùØk%ß.mAC¾éQ:ž‡˜5MzxEßC¨“E½ØDL*#Ÿ?¯%¯zˆ‹ÎÎß2ÑsL¼Ð—JŠÑ *C]צÞH?;“RZóK[=UÒÛÒf´-^ÚÙÌÚ»¦JÚ;þ@~ø¢¶^Tú±}šFÁÙåhü-cÓ^"ãaá>Žªe6â²!~Mqi¼ZRþÕ¢’ªz‚ï.« ¤gÚ†”Ñëj‡ïm2&ÈÛoîfcÑ€`'ÊõOŠ^Ý•ò)éâ{Ò¥wI™‰ G¦¤F(ºœç\ë ñqÒJºSÚø‡“¹ŽQñ«Äl)ц†!‡è ­”•‰Ì'¨÷ËU#}ÏÔò&'¡ ¤þ쾞¢ÓÏHUèȃüþ’X>ªVYÕ )zu›‡ŠQ@‘o*Ç+"œ bë–½'ó\Ÿ@yR²fÑgóϽ*8ûGáùÖÂ9 ç¤+€¶3†`žU‰‚˜U~ËÌ@Çu÷C/w}+›0Jèæ[´Z@:Y¥g­I ñ¤ˆ6š‰w9MXzÃfÄ‘)&×=±QWñÞÞ†žSñÂÅY_?˜ê›ÆñNÛêéo¢lž^xd›¢¼Eì%„ï(ÜÇŠy /¯ç˜´Ù;•ã“T¨©¤äq 31ÅÎ$íZH#ÈM÷’7)¥V4ëk«›F—"ýï¶ÅÉE[?ü½æ®¹–qDY'2)¢-×1ŒJ,аÏ)¨B§Ih–]3È&{)™ø{¦”x§–úFÊlÔ‰¼x9<èâi3ˆõÓ4©fµ¼rÖQ nje7Ü3WÓ +Ù¯¢¨r°°3ãRœŒÒ.÷Cª—VñÜ7 ÐÌ-Ê>0ÑÂÒXÖê ©RçØ×zøª¼i¢¯ãy¤} â²q‚5<”ÚÇÖ»;PH¹flè‘|B BêŸ÷U¾ts·¶ÝünS3 ©Â'5›¼BAo»”6?µT»ìèÁR »³v\ˆ)A›£¤â´¥® œ+Xá>tMªžébòÖ¤.Úî$%ƒÐÌ ¤n˜êëvMGÁéÇÉÌíFúºN[žPOU© ¢­zÌ-(¤J‚4\)¤T}v¢kCÈ3àâbl‘q2aKyܦKq[*’÷?¢ßN7‰ºÈ‡ç*`&)ÌýØUq›/ÅmFάÌ*ñ)öÆ©ÐZAV’;âIQ«®éki;_é/­2õèKfí e•´9VÝ.#¿’Ÿ ÎA ET·O‰.Å®Ú|9~Km~å`Bâp‘r´ís öÑ”•}3ª§þ. ©M‡ÔuOó!›lo’^Á‡Ô9P´=CÝ&9û"Ò}©9)òÖeÃ@ªêŽ©Žû¡^v=–oÃò×$²)u(¤üy:B*B BêŸIAïK/ÌR&Xºå ËÉÑPÔt"ÿʤĉ©¬²Ú]¼¬qÌ0Ò©¬Ë\t)ýp™ŠfTN£À…û†Ëî+ÌòKºj¦Ûè5}E{jjzÇí;µé6¥iZOTB˜nJítžaxÎÅÎbQHy;âMÙ…X†@l®að!Fã ¤˜µBC<´ê°ûÎ->RŸ~ª›SwËŒ€wf¿DÊ):rÜÔ­ èBƒ‰ªfÀÞvtcÚå7ée©5 •’¢ê±™TÙ˨~åëbªhZJ»úÞÍLÓ(ÿ1šŠSÓ“¨1÷BëH釦üE[Ç=ñD;­êC\v†IRéÈ>më¤\(u€rænÒ¡7XêwpOAå3;w¢¾zh³°H©j‡¸g«©`^øb<­òÑZÛ“ó`R›Â5I…•h¾„·—‰ŒÙ^)§Ì–®`¤š[=Œ´¯£Í¯ë 'j˜Ç]`6BHAAH}+kR¬†Þì§|“èÄä-‘;Ñi3/£¶-&LLbùfnõIaãJ“/rúùÛùç‹¿É%¶/@*Èxi\õ ¤Êòå,/¢Ÿ³ ¬}lýcmÜœŠn6³°5#ÆÚz…Ú…F~G¿øÀÆPÇÐ)2â¾s­I9«¸¤:§Úy¸©ëùFêâ4=¶PòÜÖΫ”z²ÊÎÆÁØ=ÚÖ+ÔÀÌÍoËsFÈe“ Œl,ð`_ÑŽMÆƶ>ñ–Î.ƾ¥¹å€^^©­fŸršK=Woibjæc”韘¥¬`ä”[·•£„7±‰¥¹8X©ÆÞ,iä²c¦Ö¦žqÖn)g§ñ¡¹‚œï®vlMªYOÓ. B BêŸY“úlKÍ·üfƒáÂ}ï‚ØÑ3ØŠorÛË^‹D¹øšt¹{ð¾Tu]h¥a§Ñ«»IÞž{Ut±†:P\jykѹW…ç^—w¢w³¦ré-ò#¹jÈš”‡vÊ]zÅ;äBô4,U)‡R9¸‘Šv¥m°~¿õ’/¾í¯‹×±È¬öóï(U}¼¾¥^~\Xtá=õÊû¢ صÈAžUoú‚T÷–Z…>lHŠ/¼§¡™ä]Åç_÷[Ž•_ÕÉ;‚ÖXóÉ~..Zj$¿+Ð2Ï¿¥T!M@šü­±ª²³©¢é¤C(åèWEÛiÕ=¤óHÉPZÉ—Z‹/ó¶Y L®èa ôOÖ?È…hÿsá !ßÝ÷ß%N¢¾Ú»ûH¸Yj&ßã4Á_s(())©o RŒºž¬mg£´2ëá¯9„„„Ô·©!/‚oR…‚‚H¾¨Õ‚'dlÿåú7m‹*Òþ!E uä–`· êkjßõïåÏÇ÷qÁ½× å™@ê×· ³4=TûyBìÿмìV@AA}MÝ{Þu~êîåOÁÑG©Æ?ÀûnPöPPíçéðCð®Ô¼ìV@AA}MU<[¿ Hµ÷Å2€#  ŠñIpë Àå ¦ý*-¯€Ò!oÔWÔš= úù÷)Í£G8† ‰¬Oƒ;o±[ÆdQÀµ×@û˜`Þ((¨bô“9€†_¾/HѹŸ’è® AŠþ‰ñÃ^Å…‚‚‚‚@H‹;:íÊÌÀ³ƒMJcA‚b*ÜœrP´ ;‡+œoZèžÙ?ÏÜ=;`Çôä7È9‚)Þ pœ!bþ/îV û3Ê[÷3’× ¼ìg#œÿj2P,{H±ßò3õ=CŠ FGѤ”m–øîMŒ•Q2žŸøþ[Ò‡‡:°ŒL?¾FÇPNVjIB'f9wtì&i­°ÙA§vLKy+0ÂÀ1ÅÖZBÛRBË\BÓ|£AðìÄ—ÿ“™ùù"«±ÂŽ®0"#MûBëhX9‹›&Í¿½ÐÂ^Ü<{Lqÿ+æ£eúÎ32»þ:“j—šlp>*TTñ£¾áz·Ó÷BÄ„ÔWö¤Zg;x¯ˆ~N&KÁ$+•õö§„R(d§zLOk\IÀó!E玠KY–¡-b>ž(ÜÇ3 d×:îM¿1!µiºO¢¬Œü”î8KÎ; ÿ#CúôûJÇÉùmÃvòð@ùË *ý µgŒ÷¶^ô»qŸUÊ#"Räý&v W OÌï¼–ù^,æü˜âÞáiò38`œ‡™ŒnÎ82ïj eDWØù7úà ÖZ0…ÿ¬7   ¤þG‰ÀŸÍ’î-Ò–_x'@B† Ò„'«†@jBX¡„ÃiÜ&€+á…t¸‚)¹•Þèa¢3‡é¦êR–gq%Ý“·NK¹=Û«T´˜‹£¼˜¼y‘1'¼Z„Æ Û"Nå¥9^Ô>»Åò1¨±À¨Ôós½¨ ½¶MÉx‡ˆ”Oý}Fg!±dz|ó =g¤„ nÏôc/$²gÅÞÆî~÷„¨32^‰…oYèAý!ªY˜ڻɡÛi?DÖ£•¢­x55dë"}NèÚ~Æì•~q.jϱü³gBÌáY)ox†‰Þ>=é÷1qûWi6˜åMË|Í3c–k!‘9;¢Nýñî< sy¯…¾%KLMñª¾ BÎŒ¤ô{RŒ7Sƒö+n›´mjÆÓiœDæôÄûB­kDfõloÚBÏMÓRž#Ïè”sËôÕdt"ø–,×U‘Ò‹œu Çì‹Ú;ŸHïll?ø„óoÎòe-ð*šúÇlŸæ*­î¶ˆ¸u˜PR_9»ïÕ"m9yU¾M¼ˆ™À„ûxM`ý6R}bÁy’&1+ e•V»Ár¦ @Ê«Ž?U(áÎ0Q—²¾ŒÛÔºXƒ m:?èÜhê‡Ùëì7MLº¼ÄÜzW2‹¤Pµ_za†WŒ¬’ûd ‰gI+š, ¯šV$E0œÞ‡ãôÌ2ÓÞhA™”T9ÏÎA^ÑyR~;®èÁ:º«¼Ž‰Å_­­¿2üŽÓ9ËÊQNÛcnô­ÑÇÖ*i-ˆy6ÕÁ|½%yjìÉeFº+ý.ã=³¬ÖÛ0'%U,²²[ï~a¨C$’²WBÅaAbO”œ2q"…;ËÆAÜçoÅm²•Ò×*ᢛËÔVy^CêÆ‘]®«ÿ£×Q±¤sË L6¸5à=}åÕR'fߟâêŠ×ÈË}!Dð¤î®&hÌÌz±HKEÆ0jzÒ£±IÛÅU¦d¶íOáô•õ—]šµY\I{Qâåå kIc¶hö½Y–âæ›Ç}õpÒ‹ž–X7ËÝ_¬h$…+Dúu¹žé2Ÿ£SÃJ7ªšÍÎ~?.œ*£• –~w ˜PR_R½#sîŠEoYOÀ/ ûU <©a 5!Š¹Á(qZʃ1içWj(J[bò¤d×8—ý`\ÖíÉÁ92JFs3‘ãoiÖ;×¢îaÞ)U¯ñ$ÌÿÍ:)¥ì7žÎáâ¹ÁïŠvÛ báŒôó,,7úÿŽøbˆS9ÎÍpƒíQùŒ$^õ‡ÔG*jÜ h=¹ kL|¡´ ñ²pL–¼RÒ(Äk9óóèµP¬ÕWy7àÈg%ô¦å£×ŠäÕΪÊ? ¥ì$V„™‘[.®â):0zÓ;g9¹oð¿¥%´Íô(œ‘ùn–­óFßûƒÔ‡ýê.n¿C˜×G¥åµ(ì‡T)í€×.RZ„ÕÁX1»çšÍ‹}8$ï¢sŽ£©¤i4Ö ¹K-ðÊ^ã˜C!¥½Þá".w ¯¶Ú!iÈRÇTqe…eq/Ç„zmpÜ-ÌÏ€EÛ5*¹LR¯X•PR_RÔ—‹ÍLVF¿â £쥌 GÒR¼fÿšTb7–'†Ì{™³“Ÿò %‚WG,OJn•Wºvß7ø-R¡èNN–ÑôŸ–tU,¥I,¥Y4åÚ(rÇ\[‹QùP@úöl™±ÑŠàª ©ÍÈi¢©-ãs^â2™xó)ŤŠ­Ò°™\Ð3>Ô_ܲxb zšXj³hêMF×,KRwû!¥³Ê«—E•UrœHL_JM—Q#NOºÆ3C 1ƒÒ‹£µÍ·1_ýxФÂ}–ÊŸ@jl˜Ÿ¸ÝþRWþAYyƒER/ù21üRôÎÙŽ6«½Žt„ŒBìÏ U°[¯?7þ¦(z¢«cH`lxàFûíÂ4~,„„Ô?”‚Î^,¥h¾Ì{çÏ$I‚Ѣȧ‚O Ú2;€".'½Þqóß½ãI}ccK¥Tl—øìþÁ'GBEEð¯ßâF˜¿\“úäüH!£qñ•uvS²Ú;%œwJÒ£wŠw„´õZ/Ž|g™Žñâ¸?f8º‰»U¢‰ŒžÑ)çIJ;q´šõ r ã_#ø“¼Co;)¿sdêÏâF©cŠÑ\‹YõS“ŸãØŸAʳG¿º† 2?î¹­g\,g­Ý.¡âêµjfÓ3Þ£K?…''ÝL®£wOõ •¶9$BëÑo/×1^”ðvª“»´C%y£>X¦&÷“{ îÃ/ ~„\2"s¿¤vÄø‚ˆµã‚ðj©£Ø`Ôÿ/¤z'ú'HØA;¹oTÚÅÉéo†BjƒÃ9ë×*òK¢Ÿ£O>åµXbý*™±WR'j|AŽúj¶½ÏêÀ‡"iG$µ³GÒz`¬ BêënæíV5#dÿ¬c“ÒŸ Øf^FÇÄ°=³BÊf„›zà‡À#ãÈ\tLNGZt`VÈÑÉiO¿Ñý9¤fi¯^íQõéTýz©Òº5AØhÌ@“CÖé;­1õY§çò£ïtE©èæ"3{q=×õ:–ëìwÂR¦—˜:m0$®1r[o<3í-Bœ ’ªÆëŒ|WØe‰«YOÉmÃQßÍðˆ^oà¶ÆÄ{½®Ûâ°;8N×l=i·Û<¯gŠ•Â·‹¨³EY§m¹ÎÐy£žç‰¿!<šV´Vßq©/bÆ ïóy…×›ÚaöX¬³ß=ŠDR÷nP5\kµÜ•±ÈDaã%4îçj…W0YóG?Ý#r½¾ûâFý ’Ñm£ƒ•” E61>î5ÚǺ½V?+óùb•ë^ð 5__uAôýú­øþ|kÏ kŒ‰ëõ¼çÆ?Ç•Q{Óƒ¤&ÚÈKXŸ@|«‘I;Ò³Ykâ³ÖÀõ'‡Í£É½8Zë ·Pq]çuöM³'÷å7¬QÓÚ`<µ˜PRðµH/Ü÷wæ´t®€½‰Ö£õ ³ý9>˜ã݇ü(DíB'öÜþzÐ#ÔîÏ HïÂ.D«à_‹ÆûOëåA.È£°g°Ò^~Ÿš1ôŽ ÔÞo!ÛrV>¯Ì^ôÈðf`ßÒzy)üC:„ßRïòϺhp‡Wïbù-â×>ðþ™µC.D›Ï{Šx]=)()ø‚Ùÿ(qBßÝ!!!!!!!!!!!õ@J¡ ý+·‚(Ãý™·XU€þe^Å2oÔWÔêÝ êûø˼½}àÑ{ð U õ¼…ì½w‚j?O÷ß¡­xÖ.Ø­€‚‚úšzÒž¶/jy.=HÝüttƒóÕ~ž.>íÝàê ÁnÔ×TÓ3ðæÃw©ž>pä6 Õ¤NßCoSq¥ ÚϹ ¼îGo v+   ¾¦ö_/Ú¿H!Ã#½0jLˆÍ§ïƒ·€T%xÆ¥…Ô1Á¼ PPPÿÈèwàÆ÷ )ä3« ”\Œî·S/=ò ñU×ÐBÈ«¬ié]Iæµý?ì¨ä}#â4ÿᠼ΂ôšÕ((©¿ )t~ËløàçãBŒð,H1êóü m û¤s€Yè¿Tëh:'\Fƒ~‚ëI1›@Bˆ¡±4ëL+åJ[þ¾cúç-m¨?…6K¯ƒÒk€ÝÀu–\Å‚œÈçzPŠEkÑ°m`_ìF´@v vÉU¬‹xÑÑ´äR&cˆSƒ”\Ëÿª‰WZNI#æÊ!%·`e"—Ô¡^rf ¯XÌõC*E¯âÕ…>W|׉w„UØM¯\´åmèïKo ×ršc:!õB !A%XËiKþöB‚:,ÓvÅ«ÆæTcÃû•{Fúî»Ùõ )ÖÕÞ@3Yë´&ßÝàR¯tPªúÐÖ<÷ósVRÄ+jÚ{³îÑ‘æ_¸bh‘yý¶hë5Óââ&›c”yÖÍBË6»‚^óÂ×Û  §f•”xJÅï^D;AAÅ88úPë ƒ† §¦#6#^IIIÕ<6*-\ÙŒE¹ÖåmgnJz‰° ¡g„‡¾kñmä|ʹΦŠ‚ºMJÊéȵ,¶QÜáÈ(O^VŤԶ…:+ixîʽð:>ÅGÓ.·°¶+À^^ÇgWÁåé´|5“ˆìK=îLþÏ{Ô4Üc¾#»bi¬¤`̦^ï"Zè¾à jaΪN·õoÜÍðfq§‹+ÚâÒ£Tì©Å5 “Ã!(·¼Üt£7ÐQKÉó2ûˆöÑU²gg›œªj•[Ûꢣ¨dwøUþ¾2-«˜Ã­pä‚‚úR¸¯ê¯ŸŸÛ–w[ïö¾b­|ê42CHQ·…+'çaqKVÅCkc=ç}Ý‚ )^jeOÖÎ3>щ†Æ&ÊúF^´Œ Prñ‚&^Õûšx€¸aÁ&6Å-ôa!•¦ètœu p.!—¨ûŸDcƒÌÚ¶Œh¿TÅëG—ƒÍ7Á¦®›£EÀ×,^Õu )ÏW7êòÕRãˆòFÃAªðãx©Šº[F ØtlªùÍÔÀ&ê7›MW¶ÙLGNkyîŠæ›h5×õ•Õ<R{}Gæ¾›Ô:4Üg‘ó˜…Æ!?¸[›„ìyG((©/@ŠrªÅLC/?øOÑ4(ýlŸ`„ûêãÄubÚ%ìÛsúZçQÈ 2¤¸è5}´sÖZ­€rÖÙ2‚¼Ñ@뢜Œ2k†‡T|¨ZH»°OîQ’7‰¼Ð¿H‡Ðç0/#7p¯eÅå·‹Ðòr‚†‡TÑ#ÚîdiI™þ2ð2=ʺr8tu=ôzR¹™DE³ê¥ËJúÁgç<œflMŠö†YèÕmî¶fÁ{žÁ‘ Bê‹kR½äK­Å[Iåíœtyõ”ì*î·œðüIv³î¥“©žíùJ[ ©P͆Jèì>¤EÕ/bIeYêQp°¯¬XseËRÚ• M¼šÏÑOÊÔ¦ñ¤ÊHeb*`3uû!Z@Šsñœ^Í÷z ³®#ãÀ}Ú©ˆ'~¢—r¥|åùrµºB‚xR9^ºÑÇXúDJŒR–z†ù(¤XW¹–JÎE'JUÔœÏô/·S®t Oµš›ÉúR´êkˆ'å~çIufî½N®ùB Bê?]“â«P·¦J)&´ΚfÁÞCff&š&Z–!‘^ ɾÌĉú—D3)5çüøý N?IaoÑ%HZ?á\ëv"¨¹ï(¨…ûö먛Dl¥]¹e¢fy´»¤±ÕßÏRF+oRM€Ýô!ÈNAÝc{î…wI9IùÕí~6xÃðÅU}…eç­ÝÓ3.t 0=wçv ϸco‹]´0RR0âPn É—#ŒÛ hG‰&Aɵè6³îWSEÛÌ*JuoÎö}&DFA5øRÔëȵÚ[zÖù÷i¤DU¿ÌÊ·RPPRÿí'°$ŠzA{ãD-ßlTu@Põ¥pÒ„Ê—AáªJyEe=7/ö&o•­ú‰·§­"^F^ÓÞ·äM)ïM*LQ!È)j9ù¥‘Tò ›@|b„Fx ›—Sõ›§«…‚œ´²IDì±Ä]¢]~äáj¡(/§¨në;E«Ü.Ǩ~‘¢¨  lzR¤«€y¾ÒÚHEFNÙ0êTd˜¥sþ5ÄBòéfk}yy%]bÈٙl¦¦ç>>¤²½•,7‘›³ö…¿¢œ4Aß?¢¬«¤å«ž’-)+¸&!ßÝ'`Ù}Øl¿½¨Ko›}`ÓÓ}RøG°-NèËCÍüK†î“b Ý'5PHígû¤®ƒM7Aa~ ©f4 ȹ†,iF­â 쓺Ê/{!ºOª´…7Ãá2ù;¶†Ì;} þñ͸Ê?(())Ô· —é)©I!µÀ‘ B B Bê[ëdt£40ü¶c¿PPRRRߣ'!!!!!õ'úåØܶš›/>B!Å©<㇪´ýûÂpºPPP_sôC¦µß ¤zûÀýVpû­@êi;èè7ߪý<Ýz‹¶â·6ÁnÔ×Ôã6ðäû€2<šœb%`b©€I´¸ž÷Þa¦à?T£ÙàÆ`vJ°[õ5G?µ# îÅw©ö yàèÇ4Ñõipç-À‘Ðø¡¢€k¯ö1Á¼ PPPÿÄè'sÔ@HAHAHAAAAH}#¢sqL€c ;((â™:`9„„Ô¿ RL0Þ;\QN]RÃHRÝPJÝpIø‹oz´ )lx•rhµ®±¤†¡„~ðô´—¼sRL02½nbbͤÄjLu²ž ¡_q¿Ü.¡â§b©3GæÜËiýÏMâòjÿô½m\jÝÄÔ{´ÿÓ© ½¿ºÿ¯QßÈœ;¢¹ïáð!õï…TŸ1XÆæ¢íƒ© ‘ûߦÃ}Ï—éè.Œ¸)Bi +–Ò/Aï]R0Sw´^äb·¢En…KÂ%•M–û_E]Å/¶kD<¯œ4Š &„oZv; "ûüûÜ€_„‡Rƒ DâòdL–_¡r¿pS¡ö÷Ut}¡ß•ÿvFÄCv÷tgoi—:Ž`PRÿVHõLqõ•tkùè×\PÂ}Èø–³IRÝk™7è5­W3ŸQ(àá>Rr+½êø7‚„ããñªnbµ7"a³¬zú¨OØÄϹÃ82ôO;V8§jqz2— ŒññÓÛ"ÌŽAC‹¥÷ò£ÇôaòùÅ‘|@ÂdÛ˜rÿú ü¨|¤Æîin’n óôBAAHýlj]3½$ÜΈŞyN,ó… ­I±€PB¸Œvòhž÷D}¸RGoij—`,Ný%¤˜|_—¿SZÉtJúã¸(æ:]ëõNâzÞsãè3\$µlÖ.±õë¥#žÔt'¢¬S ŽÓ3ÓÖIÚŽ¼Rßa~쑴ëô-6è;mÔ±[P!ŒTJë˜ê“¼^Çv£®åz‹¢q¤×sLtåu׆M*æsdTÊÉÕšÊxE㵎›FRÁ˜Ø’5:–ë œ7ê8- ¬¢ƒ±qI£å&«œá5„õ~¡Ž²”ãÖÅv¡k Ì$õâD úPË£Ùku­PËu½æÆýŠ£=_¤¯!O0Zk7Û'SÎü rÝFüF)ë Øç+ ¦SRj–Û‰ë:lеÜ`V4¡)ÿÑOrëÖÙ$mÔ £‚©þQG÷Çä¤Vø^Ç•TŒ×?XÈêŽBE©_«¢7'ñⶌ‰Û"©66÷ˆ¸ºûÄÜíý4bˆ¼r©©nA’nõ8Nï4?yÌñ¤^ãÑrU¹U7¬ˆä5ü¤e;%§]$ûèFÝÐ ùmB”—³"–F=É<%¡›+2Ôaó<©­Â%ÔZÖ()/ˆyŠ|5"ãÜuÇÉE=£wÊܧä¾ÃÑzù aµÏ16”5Ú:½¼}ž¾êâ°‡8JÓ¹ñȵ½£ãwHjÅŽ¡#X)•1Ø‚ò(ó´jÔXÄgLØ,n‘¼Z?v ñ£% 2Ø:J9^@‘J7ÓR}­ËûéJr?/Œ tã˜'åÞ‚Ë?³AÛwjvÛ·>Å‚‚‚ú³û?»‘F¹He¢ ¤°¼ÄäidÄãL¹»JË`Qf Cj†¤¢œ<^^Ç+ȈˤŠòÜÆÔ € E½Â”Bõë4ìæ†DH˜æŽ¢¢ŽŒa˪} )'Oi‡Z¤@\Þnyý™y@ˆúA˜ünžµù¢ø££BÅmJEhýÏRBÚ RCyÖHeÉ)9NäE)O~4Ô_’ò~Tâv)#†ðÐè"«}®‘îFï_Qú n•îÒàÛBiÙ2ê>¢|Ë›Öj˜ÌÊ㎊Š…<{ôû«ÔŒæå1ï”17æ˜XN-­5Öº]a ¿$µ5‰40PÊ´X„ñìG¥±ï°êH…H8ï[ª­5?ö±ÀäÌ@AAHýê›Þ4†‚ SÄ1 “ÒOMœÄ‰â_6ªÚM,ÀìÏ«Wu£ü Ö¤dr¿8²¸uDÁƒ%Æ6K¢ž >%Ç+à5×™ø¯1õ]c°Ê2sv€¤YÑHŒÑ#âJ?‡”¤k ©œmrxå &«Ñ ý~2žönt¸¸Ý>¤°þ¿€TZ^Ù]”×½ÔgËŒô—%µŽLÜ.aZ"4Ô~R†º|©;B)I xË2›ž×3)6wª•ázŸÛs¢§ç~˜äé1;ºj…ŠÖ¼´G+uõftñ 5">RÊ$O„þôGåù maJòaLL‰Œá6ô4ÄIŒ‹‘ÑÌ^a“>–ÆÄ3–ÚûȨ%f¶-62\ú mB G4ÝhµÇz†B*±½ß“ ’r¼,TÔ¼VÓ`AJ; ÷AAHý ß8Aû}Žƒ·´¢²¬ŠÅ²€,QJP6ó¢¹^B¤G‹,ld•ÔÖÛ°G“úfŒú¢'µŠ—݇Æ`{fXé˲Gòˆli°Öa›hÆõž±2:y£(¿®PU_îwJ,þÄrCuEþšT RÓ‰R®-òäÔ[“ÂÙâꮓrÛqäß–ëh¯ð>>1zÏz5Ãyiï…²/mTqžW=š<Ô“rÇëbÙ}qlõ7X1E3nÌr2e!€“°MÒ”ó¤t6ø<æCÊRgi`3ŽÙ;ËÚ`ýfÑôÓ½âe´3GÑÁÈ„ÝR*~Ó“šÐp%­vƒŒ„„] R戬òõŠ«¤ë0ŠÈ’%¸üpK4†-¡¨=?±Ç~ò£ aÀ“šæÀKœž…WðH‚C„Ô¿îØÀˆ®Ñ— £ 6ל7N0†ØÏùÛ‚¾eH!~MuFÂoƒÁ+rÓ|"[4¿ »êåtú—Ü…ÞûÆ£GFf]Yàž¿Ø}³XRå<¿³"L0.îÈܸßq¬¾ñÑæÆ>Åœ p]÷,vÉ^ì^:)ó¯.Ἣs< —¸’f&<Ä‚x­“CJ»P& î“‘¸A`½ +„özj s±KÎBßÃcŠ{PG/§aNhÍGB* .ô–£^:5å)VøÓPËyí_Ô‰Þ8¤-ÌÅîì èŠ[×$_Ò¬¸BH-ä?føÍÈîà­“Ž/[è’µÔ9-å%ö^‘wÓ|˜“rºxYèãâ£E×UÛ¦úgÇþ³û  ¤à»û¾%H ¬†…ÔÐÂÀ~¥A |Åüô%ƒG/®ÌÁ3û71‡+_ïÇÆ|^ûG¦~¶éÓ¶üɵÌ~c˜Ÿ½ø‚þ™‘ô!g~R×ç½!!!õîIAAAAAHAHAHAAAAHAHAHAHAAAAHýç™×åAŠT%xÆÙ×à˜`Þ((¨dô;pB B B Bê[½†;\WpRCùoÙr)(((©ÿ“"½Å8N9NE•|´ƒQ'0žJ¥z@;{/šy:ýl¯À{R5\¤EÌ&Ài»ùŠûeþ¢ßÖvZ³°Ð#ôÿƒÞF a5ñl] j?`6þŸõ½Cªž›–Ž7LòËÞê›±Ù7cKìÁ6Á:n:mna,/-é¼­“Y/ðá>„P±Á®z–Îzæˆt-<ì’N7&Ê©/HÞwÜŒ¸¹¨$fçšgÝàaå?Ú™‡À=ªºKôtÓ÷£ç_îû;å°>„‡†ÚS_°þc "óÒH7((©!ªëMˆ P ©g·&¦:A ÷Õƒ¨XŸÐÝõ–Jø¤X- ÔJÖ(pOòÞ–”=ÍI¥{MÕåÕÜ÷“øÔø¨7†|&mÛ¬¤^ÐòÔÄìŪûk—çã#€~îº)‘ZŒÞ}ÔqCOhùùxÕ„_ÚhÕÜÏ ùüGVc»¯®núo¨[׻ϟ¨aKÛ¿UÅù$³å¯=G((©ïR̺î¨0o­„;›n‚’,ªSè5).½Š[ÚòÔâ_)9«ÔFHsXÍ€u„®¤jwk~åÛÆÿ¬m!ÌZRz›H§®…äm÷Ï;’Lf*é ÊÛ[¹÷f}_öŽóQeÏÉ»âÊž1ë{2¶ÈÚPt&ç?.J9÷ ¢p§_Îî¸/˜uâR’ÔôˆÞ{³®ðû–tò†«‘‚N˜«º¸Ы[™ý³¶’Ïç]êFÎ)>u3zçtö¾PVkRziwÓJ‘3wDî¸G­ÃXù*ž¶±<ˆz¹à f@U{Úæcþ™Ûüó%Ÿì`T¼ tS4Œ¢œ)¬‚#„R!A>ê^yÖÖ¦jºv™—)ÃÌØ¿Ùpo„ç4þö/ƒ”erç 5 ¢ÔlÎ#nc_˜¿…>±8fó97{£„KôªgŽ&º¶‰â8‡ìíteÔQHEG¨GÖ•4÷D„ù)[ºÚÅíK=û>=•¨nZRí§å\˜wЮ;fÿƒŒm{ ”dMâkhõ@p<©%¤dÍ¢~É;ý<ÿ—§¹e嶪º>G(M€yŠmâiÔâ(×Ö LÜËV7νŒÆi3ŠóäÕSQHÅiD×—4÷FEøàMwѯƒ’ªz=9]}ˆ§Ì¬ms¶4 =ð®h/[Ã>¯¸ )­/™ºÕ{Ó3RÙ)MÓ\R Ÿþ¼ˆÜt¢¢ÙVÊUÀ¾xJ¯~ _|`¡gr²+ç‚Z\Av°?Üçg¯¯â~†ymK˜“šSÑæÙCjÊÖñ§±;xº^_Ý,ò|_L¢·iæje7³ž›üwR57=7YÑñD¸JPPRè¢ç:Ø| °êÑ!…²)LÅ"1·BꟅ””²‘—•W”•»AZÆ*ýlQ-`6Ú®x¼’©C Õ#ŽLŒL Èi»fúk¹òŸâ-¥JÚiC!ê©ÖÄnìãÛñj–QtäBØ"%»’'y4_¿­ˆÏ‚ÂK,ÜTñµ' R¤ÈWs¦‚ª[  dVRnmãd`ëeÎŒÞ÷ŠÝÈMËA uœÙ ‡#((©þĉªÖÈLjøÉ^N`]y¹ê¶ù…Õ)Þâ~=(m~b©„wÙÑÃÏ”„5÷¿÷%ÕPkúh•ïCBˆjƒh¦ý¾ ‚¦kè–úÄíÕ¨vÝL¥©;æ`“ŠÂA+õH©Eµ°›û—ÝJx]/NcÒìÂíuY¹¹Ì`mŸR¤ÿ.¤Ê U“ʱãWž:Øê»ì~@Jù„:Ôþa!µ7• ˜qƒTùmsC²N# ]y_xúQlvºŠ²QÀ)™!!õIv_WlJŒ¢†§Wá±àÔ5%}wÎ † …û:’©{B‹9:r2†‘?çÉ,ç2ÿEkRÌS´ Š®Û[Ž°Ê« µÌ"µ3êõ“¤ýOÉGw©éû¤žî¤WµÇ$GÈ©¥ ©’ºûÖjòN% Ò+ßgì»Z\ŠïÓ0ŽÈ8ÓA¯|bš}—t蔦qzaeÏ€IƒBܱª#e5ßí¯éµ\ÒÑ mûøó=yÛÿ¤ò¯3/Wê«„îk¥×ôí=¦¥á‘r¥/½ôhò‘—´.»þ…½®ªÕ¦öì‚TE»ƒ´F¸Á Bj0ÜǪíHßr" c³oöþø/Ÿ¥ÓjÏ+ñÍܘ¿' {«Oê®ÔK© £Õ¦qÕ¤P§ dËÜ~éE“R”cdånI 7±q³ˆ=I®n ðuÖ²ð´ôˆròt•"Äå7È0¢RhMIKO¸¿=!¤£lÛljnoænîèiìM;ØM¯z¤kéiæè®kŸ˜x¶‹vºÙTGÇÐ)2ú `öC*'ÉNZ@ )$“V`hîléflãêUA«Ù[J”¬i”!ö³Û¼L5’~E!ÕB]vY ôzRa`éŽ\khíîRǪ̂íKeP ­ÜÌÜÃÌ]õÝH€´k‡ª¼¾YPqF9‘   ¤ø¯E¢³ƒF@ U3üòº@‡ûQ/·Q*z鑪»ÉåíÔjôNÑkz)—ÛH—Þ“Ê;x—èUäräÇvjeùr'r­â¹¢—QË¥Ut`x·µz¥»°Z…Žfï#%#¥!ÕaÞrÎeäœ6êx/½²ƒ|¹‹ÎïØþÚ/诽›|¥ëãGˆ‹B®äïü¥]i§TöµœŒ\‹µ ;Â3© 93²‡‚؃4 zRPPRð³ß*¤     ¤ ¤ ¤    ¤ ¤ ¤ ¤    ¤þSH¾…Ž“TAbó©{àÍPX!xÆUq% ©#·»PPP_sôÛwÀn™Ïâ¶{€±Ÿw êMx?í  öÖ;)aß˺¢7ú£©B)(((©O$5$³jBÐ/“ü+¾X„jlæcÜDR¡&|µæ ÿŠ‰‘džòzßjÂBHAAAAHýW÷ö‹$°ó?‹Ø<>lãø°McrÛñ”î÷~êl¥a™:>bý·–V®;TÄ8qû/…ŠÝ>P) ä­¨ï?ÀùTŒF^Hªÿ ¬å•(løKwGaÆ@•‰ÒÂþ¦IûÕ÷²þ™ýýfȇ1¯û+ªltªPRÿƒHªçC¯ -·&ô/ZŒ _é>nå Cï1…¨åjÙ4ô½'ÀyºOÆ3§Q´‰ºd}]2…@¢jXäŒ)ìÂ>}Õ}’ %R’†IÁX¯Ðyž Wߟÿü+¾ZØ5¤äñ‹w¿hïL½y:9ÃK{_…y}C’×ÍÕ'¡–ëjêiëb/æÍ:¯"é|/nÙÏl3]"IW5ÃQø~á3e =#ãÊg0LuÈ]²áë¬1ùOÿ\úÔÓ·hSÂFþ/X¯:çªàïý (˜8"y±–9W /A=„Ô[IuóðÓð=§²ñJ•ƒyÍI ºäÇÕ3wjÒcFq©ÏLu~ò:8´äÁ’{C ïjK`f(!%ÚHˆZò/:ôLRªÜ‡CK±>‘*?ƒç'ÊßÊC ñ€ày[rj†}+n„è)CƒüˆF¥C¤ƒ¯Þ_‰;W†Iþµáw )¾;´øÖXß8‚éÊ!ÜC‹ï áƒ÷"R´Œ½>©QpkxΉñ^šþ a»zú-ŠëÄ”‹êÜgêÅW>óZ4×¾BíLHšŠÙV†µN¦üÞöGdX1Õ¬]óè±#…¨/;åÅ!¿Û¿±Áƒ¢¡þ •%%/„„ÊÊË0H¥,×°«õÇ¡ !õ7#©Žñ®þšv™?3 u)f?úìS—ü‡ûÛ5'Õ?’—tnoñÓ¢*ܬx¤tô­Wù]¸Z“bõqúV­¨íK[ m®uᨒN¤FƗϡѵ =¿XX ‡ÔG¾‰³|[U¤ÝãDþrü+¶É7­*»Ÿ»xkQôµ!ã²ʇýÃÒ¶þlÌÔÑ7ý.°FE|ÿK#-"‘¬£g;®D OX9WO‡@¤h£‘PáœýÊÊ^›b ÉŽú8û>2¬þiÁÒ‰vÖ³í¥C­Ãéý 0E×b«ÂÏ‹¯üh`89öÒ€ûøìsg³™u*â¾áÑ]ZŽz™ò#AÇÒö7yñôã€L }š®¾ÉO>ûPŸ/y4ÉÂö‡ˆæ¯¬,uôè?yn‚–¶fÝPÇÀyŠ¯lžaüˆ+y8ÙÌú‡ˆÆ¯-Ì‘S¦ymÇN¹?Ñm!Ú-ÆŸdä )PKŒÖ2IÎÇ ¤°4 ÷ÊWæ63æo*ÀÕ÷íÏ!õ©©–3à{ç$Dß:‡Í£9N‰¹ˆ:º\‰Íg©@Üì™™†^ŸÆgÏ3Ë@Ñ,ãùºéƒ åá«c³½¿œ=ótÆ#ñÑbôvak3)õî°ÄL [¡:–ôš{úý¼§C2wi°òÑ#òŽEãS0ÂßG—ý‹ò )XªM²ù¸XnüÕXìÉÙíÃ’—k1 ÔÅàSfƒ!•ÅÑ¡¹À´º`T´€`,QÅX¬–ß:ÞŸû£…Û<*]Ã4bBÒ…Šj;ßKÚ9yAηnéÓédmÇF•Šg“Ùô9Þ¿¢õKÁxkæ—Ñ¿«fi…Œâa\KY«E~RS˜³}~CO‘€ Ö¦_„JçéÒ'aÝR&:ØLN¼¢Âi›a0ª¸KEð`ªÝ‚IÔrý°€÷¥1sRP‹J °W~8Ë· è€Jr*AÏw”¸{2‹6gA›2Ý·b®øCÿðY6‚á'5ÓeŘ”†vΠ™Nȼ+Ïû©¦ÄëiiHzˆtID²¦ñ7~¾Ö9‡$VèÐGRî çÍoA}rÞòƒH ‘IZ:ßÇ^é;×y©ºà¹C3vbÐ{(¤¼ÊÈ êû¼!@…ãs“o“M^¦a%S}IŠu¤·Å›4õì>ÎïI}š¥c¹æy ^ìVå?’BÐÉëî¯mdübmªç„ēË.·1ÑvP@jfàuŒ}ÈÁ©Ñ—Õ“ÂuXI#ø؉Œmƒæ¤¢N¾‰…¨½l,&û§ë‰»å‡È3rH!‘”Š¨û#ŸèÙ¿ Oxl´·íÏ‹ÎsY03ìÆ8/»i¡ÍŠdlŽHGÏa ¯s2Ë`†ÜžºZ“ EÔÕšé¶[U w@AHý“HªkL`º¶Á‚¯ü—á£IµŸœxOGé¾âmZZäï”Mò/›äW6yáŠ÷¸ÿ¦t_߉D6w˜|áeŽ@‹æûAQ‡zécuîã!ÜÞ¡‰ ZæYðÈ÷%‘©­(&J¶kr»Ô¸È‰OÔK© Áðø$4’§^tyTaûLRÊHªïEHå•k“>*QFRlÓÉ™O‡!².S}ICJ|÷k#ƒoBÛžO´ N¶1ý1¼MEÔ;,«î㬻ÏiÅùmºr¡ÎþÚ>ñrþ)¤ãÑ“/,ÙÚŽM€{jô%Õ´Lmã0E$•üÒHj¤&…çŒ'æ è~Ÿj ©@4’µ$±¶Ùš±‹ü&ÅÞVÉ*žaž=Í|ѧŽc}¼fúW+–O¤fôŽu¡ º¡„ÔJmÃøQ…•3èæSoáfà!õ–>©cdzõ¸ÈŸDz?ïþÛ¾éH•ž½w\ô®O¢íü4bÿø7@Ê·^¹Šà÷o3½kÑtŸàê· ê×a­ªÂž‰k§9¯V\9[=!åªZÉù)v–/ÎIÉ!…N'=™hNœí¾cˆ¨çÕ~ã”9º¨C­¨f–åÄäKê…§¾31ÿ!æºZöžy´ð÷Š¨ þI¡)²Û_ëüèW…\ý½ž–aäHnïð¤¿)ìë4"A¢I5ùvÑî÷r.J=ô¥Ë<žúQ_—`ÆŠð=±B›ôQ~» ïòSª¦Ó!•òg!…­î“ª‰À¨Ž&#n¤ðùêt((©úX$-A¹}ÿ‚tß´~H¡T™ÉìÓ,tW‘z^Õl@С/Ÿ~CEØûAxž6™@ 8NZX¨CO.)¤ÐËý>ÅÖN— Cгþ2¼IÛ"72~ɪ‘HýÙsºä»ô÷¯ÍMˆHp‘ÿ¤–¨a‘ZaÃw&,AWÇ8h\š„‘´T‘î{U$Õ§XL˜¾óGsälÅtÚ‚õÃûQ(î#›adŒ|D$Ðg9ñGu\¥©ZØú=›A$’¦{n–Z¦­Cþ&dÿ”!u)9*Ž¯©G -§.”Î3’Óa¤f<‡”É”˜ó*ü+“ít ÚÈ)_…Ö©¡ ðLjZ¤/³€JY×x CmFº¯AÜý¹Ù< ¯]òqÝ!9óȺ$¢ÁL· è²FlÂk¤¬äKÐ|nc­m· îí…‚‚˜Å™^ñĉþÝ@ý{Ê•û’DÊg8”+w?I”o¥ØïçOœòEÏG2eI‰r`?ð\¹òÊ> BÚÿè†W¸OªìOž (üQÿ¶¬òÁ;›„JKú?’ žXx])VI…²|ÿž)™r/Ò ½Ñ¿ôoqza›Õ»E~¤͵*Š• Ø Õºd µ/|ªì‘ò.ÈÞг/  ¤ ¤ ¤þç‘„„„„„„„„Ô)üϼoVEð?óBAAÁÿÌûòŸž^pî!8}—ºö´wƒ“÷ðj¿\§î£­¸üß­€‚‚zºô\}ò®@ªù8t:xœº žvýçqi¿\O;AëM|· êõéh¼î?{' ÕÝ ¶ž‚Z Ä››÷þîwNþŒ(n5¸×¶Åw+   ^§÷[Üzú®@JîEu8bóÞóàA(­ÆŸñÅ«A!µŸw êx¿ §Þ9H kûÄM ¼í¹dMèAÜ@ 1µÈN –—âú·Úx)(((©ÿ.’ª¹Ey4:]Oß͵䆸'‘TmŸ°pwU;Ú›#Æ9¥¦îz,ªCâRH‹aC3µ<—´  z%|…¬¥Íh âF mDÿ½V"AìiÆÞþ…»ƒšÑ2È~´ %MŠ#’ÆþFõ)>jØÞ4ØP˜Ñ,ïÏÛ„UŽ”7 1UüŸú BêBª7-5\oþÆüÝ¿çl½³õbñ‘¥ûÄ5´Ó÷çí8íK°á•Öã;Ý'i!æ?ÌÓ¡R Tº1ÅÀn—¿í©m׫|)g±D—’PØ â# MrW¯ðØu)^V?Ëßu[0Ðc#ݵ­§I]P\p´÷UP¨“›×ÇY±‰Í4D,'µæÍ##­ PÈf¥õí©\¡¹•…>•N141YŸ¸íP¾Ž ×ÌÂÒÀI¥³Y. ñ[î£ùûÝÛÇ]»™¢’[0HÙ±- a>‘촎߬8"Ý»ž8G7p7üµï gßeαè*¡ ¤^'¤ÄõÝ ±ô¨Y+š+×ÿÓAìëN÷¿+9Æ©Hô'Ü~̈]óÜ/áRáöº6 GJŽ>æ~Ä9p-&Æ…džœ[Q@žÛ< Êå¹MÓØÛ“€¿â #³° «žq+{än¹ OÚÐÀ õÉ­XÉ6 iP†  ¬ =ˆJÈÛC§ÌܸÂ@‚HĘ’|?¢™Û6øêÊJn/kAk.kÅR¯(é:K?ྟOrX]Zù„sè·dFR­C£–.ܯh×ùØÜtÍ3i'ù‚ÒUk¨4Ÿ¨7¸Ç;¹‡oŦG3¼eÜêç_By4'o&r9¹ñÒ ¬Iaz³é y‹„›v2có@JÜ’|´ù[žCjßV*Ñ(xÚ“H_Éë—5+Ã.eUHÓJ¤'A°ŸKÌfeT}&„Ôk‚TgTØBFگȻ¤ƒTm^ ÕŸÑÖôò_÷foâ?’B e—Z/¨WÄ2â½kiT«¸½è[îîgS"‰DwÊÌØ÷ ¹Y™>J&ºø%äè1³ŠšA\B„q|£¬¥;2<À,瀛9ݵ´YT}Ãß×E¤«ÇòXsë¥ÞüåkMT¢ž¡}úaý½ŒÙ:‘`uPîÛûò+–’µ‘cd‡ô¼#€w ÕÕÉœD"RÌ£×ßF:?oé2ó0‰¿›¹@X2hxÓ“š›BvÞ"nÁUwÑŽfä_qUøü>v…„X°3jÌå‹…zŒ¬âP„µ=‚êžçU!¼¨}“–@Ó#Èt‹¨íÜ mzäcò.ªuwd D‹°5ÅX7æ-[bL#“ôm¼’DtVü« UÿR²ÆG‘1ú$m]Š©Sf¿ÅwŽ¨È½$‰éÃË«êw6ÐÖ%èhèymè6@‡ !õÚ õ,$ÈGÏ>ÔÒÖšfÈ0vÉKÙÓ)ª¸‰¤5ôeæf±ÍèAÑëî¼å‘à_„”}z³¸ÁA–\N(™šY ĵ7ÝÍI™Ç¹UãÓ"¨îœC f¬àå×ø‡/úxYhd Š 1Œm(k鉎&1-»Ê¯âJ2òYZx¬+·Blh⛾¿›·¿Ñœe¼üRÉÎ&+ ew¹›vYå—˜BlÈÏô&[ÿÂkE±;^æÚ6‰K«:3… 3"点•–ï$çhûàì\OjN I)äë´{•æ”´÷y:AOZiÙ~©!¾F{[Õ.%Dt$mý¹¢ÃòYÑþ ‹×í¶rÏI?Ð):zÎ…M2/¾]ÑöÔÏŽE¶ŠO? ÊjÏÚÒéKîŠ*OYS) ¥çùG¯:héý!’òcR¬s£ÊÄHöÆHöÇ•äR†¡ûARŒÁ<7ó`o×1[º®+ç’äðNºŽaȆG‚Êû‘‰ó‹êDu7Ù–QëŸâå !õoY‚ÞS°©9aù©¢#ÏxGnE™ù,áÔ¼DR¨WoDSLÜ#²Ë—™¤ý¤û4õXn–nþ–n‹lÜ= ‹–Þ5ᕘ×*NŠê_MÙžaÒtC§Ì¢*!Ù(}¤"|õ¼JOÙÁ4]FÄa°ä4¨8 -´õ[y·hIª±·ˆ[ƒžËÙs)gï³’ ¤‹°1L“RH ½³B_Ï.á æð_u²fûn|Z´b9Õ¢ mÄuŠtßK Õ„9†{êáAKD²E’™„ß„ÀÛw>ž»ÜÕÛ×ÐPŸjêã/;#7@Nq]GFÙZÿHÏ`–¡®Á¢ÆòÓÏ|m謤ßЕM Ì“å%ú¿>Oß44ç8zVÉŠuôè?@ŠEb…x& ¼¸Þ‰|Ÿ¨2Á0lûUG cçeM(”óŠ<˜‹–ñTšèœÒveïë*;…„êˆ 7œM,£Ö=‘wt˜PR¯ RµòÙ̽4¤üJœDRõ@°¿%FR[Š9 ñÑÓV¦,ŸÍݸÈƼR:æ¡ëÓ7œJ_qÈŠm¼é:³ß+âµ4´Ê-t_ãùœb,¨äüRAa Ž¤ÂÒ¢[¤H´} ‰ðüGG“ìRv­€ïË \Š@ªß€âõ;Hqjž³æ9¤Ú€x]‘æ“Ž!@TyÃÍÙÄeùâË Ýeü—4pP$%9¸•®o·£[~å_¼ä ŠÇ:aãà sÈäeõC³u÷×–-“PhÞá+ÏsŽÞŽð2Õ÷Ç eM7˽Ž®iì õb{‰.ó–†S¬’ò«°…ë¶Ñ_='¥L÷…nþÕҔ忭WŠur¡,ÂЋWR 8Û:;Yˆ:ú–±É;;D H=†® BêµBªæQHxˆ}^Mɱîá«!Þ†¬€õÜ:Ü@J¸k•É(xùî±'¹‹—x$üÏIÙ§5ŠÑÕ Å麹yµèkÑ6‰ñ´ݼãíüÊgÜ*P¼4ÙÀQIå ydÃô!ÓŠ.?´‹®k²½WPùŒWÙÁ;þÁJÁâ4ÃüÒt"²dÇ™”­J6ì4².Àˆ¯ F?¤¸H$µk IÀþ±«ŽV&~›Ú —/3ô(ûBÊ7<ð´¤:å5‰±F!’ÔÞórc;ñOKêzóVï_uSÚ¬Xº#<ü›…‘CÒÁÎ~¾DÅ9Ù·Êš€¬é‘¯“º¨é%^â­ÍA"©ìãho-_M¥Eÿ•…aÛ¯9Z0œ—wÈ#©Ü|7Ö¢_J=.9ÊOiÕÝÈ?£ •‚šëN&–Ñ0Ý!õºÓ}}œMìm­ M ŒMLJ2öâe :¶„¾'Çe³X4¦©ÛÍGxRøbÞ ß '¤µ7<ÍIìÈ#Bć×Þò°¤¸äÕòª»²Ë›z–ª3¡.¹Xº÷Œç|¶6-ó%jÒæŽP72cÑÚ¢ÊÞ’-GV:ÖI¹Õ]éÜ|Ši|þñÞüeRX V,£Óhö R7üš¾t‡«“Ý>7ïh¨®7GTBÔ·ôäTæí¾™·¹Ñ?À•êZ\Rõü{˜L_¸¢´¦3¥TbËÔ¦¸nŸìxRüs¢Ê6K=²·ð4÷ÀE_+-Ê_Zݺ¤ÄÏ'˜egéåí8hi 3_xS°Addž°ý!ÿø£è$Vè:AÝcƒEÒ3%•PPR¯õ‰òeÌlŸ£rq2n– +¦¥äÆ7¡ ïOœ´€WÇŒFA½ây¢ËiÖ‘ÛÑÕÚ{]LId=}³À¨wÑÕ}¢RC==C×€L>Í"·¨ Ä'E3›d-=1ÑAÆ mRù>Üê›þ~.zd"™îà#:)@¯Õ›·lµ©±‰bd—²ŸWÓ')©âi@±¨Mñ@‰þ2’úÏ‚hRTûâÕå mPìþá6¡Ûj°MÛ–Õ¿Í »"Vg­Ò’ÏwB Z†1àºèY Ø‹&Å>©þý\ÒFÅÓ6Ê”½>&ë…'N´(­UÏ”Uî“ ¦0©ëXù>)¬óÅØ^-Ü'!!õÎB B B B B B B B B B B Bêß©}çÁÒf°´ojG;@E# %Mè¿Þß­€‚‚zÞoç¹wR=½àüCpæ>8óoº®?íÝà4 Ä~¤Wžàó.@AA½ ïwù1¸þä€âMw‚‘R0J†3÷àÜ "ÀŸñ¥&§îó]ønÔkâ±)›AÝ­wRO»Ñ6 "*"¼Iö‚_H•âÐøâ¶{€±Ÿw êMx?í  B B B Bê-”°Oá$ŘDŽàRˆµ"¥ýRPPPRÿ¾Hª¨ù+k¹LǹLÛÙ¶¼Ñ%}¸‰¤0B OY7e¥al­Áú,ý¦¼ Ž!%ÃÒŽ}äã¸ÃJ“õðeî•\9²¸û­¼MØ·H2`!õw Õñ‰»–ó5ôõà æäó«ŠñI‰®Ë`M‰ùU×>:Š¯É.Š6¤Ç’ÏX³4Mâ§úð§zó0•LŒ½ñHIo|GÑü&öÑE*#åÿo”ûÖ·åô-PPRRÏ&8{Îõ;£"EÝãÆ,×]8TêœóÊæÑýFs±JZfÒ¬?+Æyº”©î¾ /¢Gž›t«¢êAßJo~k@ú*î¡Š°9¨"ìU‘ySôbLþ=û´KUþÑóÚú”™Þå‘´Œâ%ôû_¿xnvD~®¼Lß°ž–Õf,˜‚î Bêï§ûT³wMgz}´å³À¼Y¬àqy½¸I÷I€jR„6#u¸Ü9ó/þÈd“Þ‰ù©WCÊ¿yŽä¡DVÏØ0í0ËÔ}ÃñËð6éío©„™.ܬýg3سÊCôðS¯èÙìù3,¼æ²'¦ÜÁzCž|{2É”©åÌùÉÄ{BÖÝa‰‹§³fXøÌf{|ÞŒšÁ¹ô¥³Ûçg»¤/íÌô¨Åjå_‘çß”aÆ›j~ІT8*F4“í„œ;‡í=9öW¤þ¡™{§™»Ï2÷iâ4Ëqñˆ’Ë_³ ‰úöÓœKFò {‚‚ú»B\_úš9Î_mý,0ŽÓÄôv1n ¥¤ÍÌ&ÿˆù{&ëûTÜCêSSM‚¾Å\¦Ã"{ C÷ÏŠÆ^û–N˜ö;§ ÉÙ2Í.8ÿæ·TÝó÷ á÷ªøÙÐù£‚gC3WÍcƾWÔ®"êš@0HÑŸp“´O°µÓe Gð‘˜èÔOú”¯b.« û†fœeä7º´wd\±¦eé0^ ÿÖ$kCªZÞ9Å„53ôIÁ§Vß„üªÂož®oüEâ $(–ºa®QÔHëë7cQZŒ{c\ø.L£Bst-·¢¨Á™)((©¿ )Á½/­,Ž¾#±ðžgQ:«û°t_j²–qÜÜퟛfl:5»ÿ‘”Î ÷M£³}/û,ª¬óC‘ïÔ$²ÇõGžî#~‹­©àÝüŽí46¿sd„ÿ×åjò)X§C4}žÿ”´O´¶Òð<«RTr:d‡±ê¥Ô‹ÎojñEvÇ3}ö @‘€þ‹^©Ð‹*™ù:ÞcŠ:Ðs ›§YLÈïžP®E¶ünášrn©¡yÂÞ÷B²u,¶( !õ÷ Å¿ñ­¹É7)Oå^H-!RË$c¸? '8ûæP>,– Tjx€—äÒ«Ó}~èØP¸Y!NIÿª åœT<¶p‚«€Ô¨PÏ9nkÔë67k™¸†@Êr®ïY%D]Ú ›Èi¶áÓì"~´Oý4¯kŒ¿ó ßýrH  Õ1…Íš!‡”L ©ô Áhº­üÜÈìÓÆt#ö Ï8<É+ãgS óÌ÷¹H$!!õÏç¤:ÇzúŒ3Þ/z¦VÔô]g†Wµ ŽV÷‰»Ç;™Îr]>*÷ì$GÇ9Û+p©¦AB$hI ~Ò‡MQ]žê^:¢ô¶pb¤òÚ‡'—hZrÕ°D®j@ð-|¤¸çŸä+úJ׎ü~?‰mA¼ýhŸùZF¡ŸÆ™äh3×F¤.¾û-•ðu?¤Xcsª”^üžiú]ÀþÑ©01›éwå‹b×RûD+ó¹ / G$à#Û9ÖE¦µŒ ÈÓ4ŽÅíQÏ>4›bñeıÂʦ“H©U€÷½Jiú0B¬Aµ_†Åðu¨Ÿ¤´ åC÷!õž8!Ï•a’;4an")9Oe˜ñ²×²ýçÿRð^¸tŠ¯xŠ@)þA‡ÕIºÞ^5Å»tRðžá\tµÞÇAævb‹ÃŸ|¶a$§ ‹ O÷NõMˆiQ¸hAÜ5:jÍø”û(ÔÐ[ÿäÈeS¼¹Sü׎.|‚•é™ºg²RðîüÐtŸ:Ò¥‚›cC¤_z &$^‘¸öãô[Øåî¶dª7orÀ¦Q%ت•ûE,CŽLñ]òqÖ=lšìÚ'Aå“­W÷AAAHÁg÷áN/…Ô+F<.|ÙGBðòbŸvõò«ô åð P¤þ+K^^¦û   ¤ ¤þzK$Ã"sgÛ­S“BÏ!!!õ¶urŸ|9ßÛþ´a(())©wRPPPRoôçY7ð9 ¦¯3ð&ÄæèjpéøzþŒ¨Vsß|· êuz?—ý éÎ;©ž^pí ¸ŠOÝëÏzÀ•Çxµ_®+O@{7¸ó ß­€‚‚zºÝn´¿êîÛÎa-ÕáLˆÍû΃ ´Æ¿ÜkÛÏâ»PPP¯Óûm8n=…zÛoÓÞ¤xJHáñ.@AAAHAHAHAAAA½ëªí{ÁI ‘#8‚Tmß‹ ¤    ¤þ-B$n%[ê#‹W‡”îÍÚ×#i@9…H¡„V?M¯ØR´6jI·Ã.~!…ŽúÄÍ@Öú\Ò&yKûÞ\Ÿ÷‰ê¬å%Cš¿*¬i3žFPPRoE$UJW.760qJ]åì©Ç N> Äx‰¤û@Rº¿±KbPñ*GÛ¼:q>b“?‹¤BÅ:[:2Ìí[¸;$n-i@nÊ_ ”PÖú?Žˆ¹k·YÌ—7þ·'¢`EéV ×m³^É«ym¨Åpß„"þmtAAAH½RâÚÇ>NÆ©ç·&;ÙdK´Jn5âRˆK¯n1§[Ånë×î潆Æá95o5dÿ#¤$­ Ü^Ç+ÓÁ%ÿš¨r B ·‘TåMws÷Õe @Ô ]=$|DRhÈ Üo`žS…:dñÑÓVl³E;z¥õx‡”®}Zr;Ä @Ò $ÛĪm @ÇoÅ–,õM•”,:Þ'<~9‚³·ä8êy;[‚JjKß öw!›Æï,ªâÆÞ¬ŠÍþ©"¿Ü-Ùû»ÜŽ_‰H“môÏÞ^\«„‚ûºûIüU~)"¿œ»Ÿ‰°>äìjÊ”úe­M.•è33ó«îDïåTõ 1l#È—®+¿$n…k¦‹¦¯LÚòX‚˜]ÿ0®peâŠÚEé¿%g1ÄW$o;YÖ*@`QÓžQ¾Ù/U⛹2qëdt!nœ-µ!™â…i¿Ä®½%FÞžT´rûqó %¤dzì|N3ÈÈN$cé>Yu‹)‘8Y_Y 4õúº˜.»&8TÃÐsIÙý aä‰5,ÿÖÇ=p-oç­ÂÝ7 w7Û°ìb7ws7 ,cò#‘Èæ“èiEM½áÞÌŒ“²f X+%’ý2kÛ½œÍM o-nÒ“ -Šm¶GÜ|Ý‘Jö(¹€„HÜ•,‹ÄÂã `å #w¯$å„š'ì(=ÖÂÅ»opªº¢âÅÕ—ŸÒ6Pé¢o+´=õd“Í“ÎJZ€øð^šþü”ÝÝ¢Úžè¤ËâÓÜ 2›Œ’j¤Q€·\B¢Æ4ƒ˜H_¢óvÉI´S Í"‰Û:üÌIn¥·î‚K(¡ ¤ð»ºOÚÜ“%[¹ "Û3{_j¡2åÖãRXºocÕ$4§K÷9eÉ2ÜÕ‡ÿtŸÕ2Ð9(ÅÉ/œ¢­ã˜w„S‡æÄ+bõÌ¢r±Ü¦äèk3öü¥Í,ƒÿ©RâV ݽžB2° -œ™ç™gÆÖ³ç´ Õ˜˜eè ¸®¸©;9#ÙÄ.È=¦Ä3.ËÈÐ9nsoIY͵°›ûãü²“jœÅ#§¸ÄGûÑ"êdµ—ìílÿœQyQÅ.Æt¯áº]ßwét2kÇq–EBáñ>¤júJw6¸yx²íæÛE¬¸&©ï¶2šŸ°12ªÈÃÇœH_”×ÐîÉ"Ù•Þ“4ÑÑ£ –OÆA©=1)!…g‹Å‹ÈLw·¤Qù ‚jϦG±á>ô˜=Å- -ÒÄ,t¯èD‡/)ÎMQ=ôoPRøÝÌÛ[°¾&në3i#(;ñÔׂ`_|]Ü€“H ñ®5§, -b6w"£ýÒ ;iÌøüÚÁ ]»”Z>æT? Xh°!BdÁê4ŠiXöq%‘ML½V4µ@ ÕƒBª\ú"¤öm¥’ ËO¦¯nJ]…¨%÷@ÿ`‰yp6©•IýK†ä~Z^¢aðV2º¨ï-Þp4qÓ#YëŸC*¿M°s;Ó:"s_R?wW[Üê뢦—BªÓÏœàRtIý„~Ó}ˆlèÊ]y0´`M˜ðXA¥|?ž6óŠjÚå›y£9…x~¼,6~¤B̶J¨`3)â&W©CòHÜ݃°&­$ÏÔÆÃz~€‰··à´¨öqP ;Ë)À!0Ý+ÈO‹š^Ô JW,¥˜–EÙ• dÍ:[[G ·K'OK¿Ò샽üǽ3÷‚”¤áqd¨•åníéžµßÏÇÌÀ®0¯êihˆ—‘¥‡•G¸»Ÿ–^\¶àP´½‚ðÃl«”}lÀßUíêìbêìgéâmâµá±¬ù²-QÃç—'èrÄCÍLÛŸÒ¥4GÒêœ%‹-ì\ÍÝ- }L}­Ü|Ù6¾‹–Ü”xàNiYtGÒ„@ê€Õ9ý ©È8ovV½¤¶=&-ÙÔÞËÊ#ÀÄf[a‹¨¹;"À™Þ,mA!•Da.Ú!lI1ö$²µ{ùïLAAHáuNêÅ}+8{,Ò‚>¼L‘¿â±H‚ªNAu¯°³Rm¿²S ØÐÔ˯êäWvð«ºQ#7«¦}[Ù%¨îF¢å{‘òüª.¬æ>A5V©¡­«¡k Êå·ûy=hš±‹W‰ž®<Øù¼reýhmÊEHyy1~uüˆ- Ø%@ FÞöÈmF T)M’7³®¿ˆÙʪ5ˆcË< ÕôbÕö ê´™]üê^E‹ª–(ª­é…þ B >`ö A ¯‚Ï‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚úBjËÔOâNÜj°û7pÿ(®Ä¥ýýâT¡Âé]€‚‚z#ZÛn>y' ÕÛ.=§oãR׎pò^í—ëÔ-ÐÑ .?Äw+   ^§.Ý:Þ Huõ‚ê›`ÿUüißUpâ.xÐ ö\Æ¥ýýÚ{ÜïMwðÝ ((¨×éýên‹Þ H=íäM@…TJñ&0ßÎÜ*84~ Š@ë] ·ç­€‚‚zÞoúPsó]”Ñ6 "*"¼Iö‚_`·L„gñ@Û=ÀØŽÏ»õ&¼ŸöP{ B B B Bê탔°ý-*Råëþ#eØïþ#o¤þh!„„Ô¿Rro/~ò¹“Ó¯*bä`Z@p¢ëBMªáëÜ÷‹ºß²H µP•siª½›•1ËQ2¢´çÍcôŸ@ 1‘œ¹ý’Ê[úÚÛ%ľˆ10àEß ·5Oò—G/H1ñ€Q„Ô_¤8Íß²ŒµèÖšn;0H¡Îäcw³yÖÜÑy—>ñ Ô´â á÷¢ó퉤Ä]ì™3ÝVŽÊûís7 — ª"ð†-ü‡‘” ŒgüHÑ!ëèÑtô tÉ´yfåw¨üõvñ/zú¿1Ròx*“ª±èŠJù“©,ÆôÐ[(?›àà6Çï7”;¼;#ŠžýYUjœ›ê¼äŨx™†ýJUèp   ¤þKH©eî›áýž†ëV¤xÇg‘Œ?Ëè[Þ•i ûO Úß®t_ÉÎ9T—1Ř……5s©ó?äâ<Ý'Ÿ™êüäux(çá’C‹.}êî@`¦`c±U9ö[^¾l@„R†öƒj²@×êÊ/J¨É”åÅã—>ù ý¨\¬a–H”Gd HM63™x) Vú@×ûü,y…¢>5î#unR^=,P×¾Me x~ÑreV>u²ÿ,½=EðlH)ÆÜÚ"ʤ ~#ñ#„Ô[ )…Cx?²pžRˆ²Jtõ|F äãó{_ÚØ|›tGÁ¯7)Ì-§&iÇ[ÈûmÃdjf÷¶ð)Ý}ë­@á»F“bõqúV½ ö{3]²¾¦i☂g*%•3L¢GqPv IüE“Å^Üö“¾‘HÖdE¾ÇCN¹?ÑÕ[›LÒ¡/Ÿv÷yÏ ‰Ü§ãFjëéëRX?øQEï~ÏÈØŠÙTÙp–ó²¡Ï!uM¥ìÉd3‹ŸÂï¨Èz> L™§GÒ¡¹‘|_EÚ1ÞÙ{VÀ…!é›çèiˆ”ÙŽbuÞ…)v®:$ÁÀqjô„8ŸØ°H"I[ÿËô§Ã—ÌqZ‹DRC²öOc2uÉT ËÜÑ%¶º?òKžXó©››.QwžeÑ(ÒTè   ¤”Sƒ •šB „Ž”$x8ÅÎ[o ¤ÐQºz| 63k˜"Íuù{&óûÔΤüšs=b0<*J—4%ÎõoˆßT©óŸ|¯Ë(^rl¶qШ Rñ2Ãü!0: `µ ›ÌêþÄÎ@Û‚7²´cD‚dÍ}LAGÎpX*_‹ó^q»zaëw Ççñô'˜HÕ%àCÿdÅabÚS•²‡Sº³´¾˜]„‚‚‚©ô‚Þ¢÷äŦØÚýpû­‚”jR¤6#u¸‹ù`²¿ÉèÂ;¤>5ÕÔ6ö™f9Í>êûEš4—Éq—Qfeó´i¾£åyNNëLšÅ™Gf2‚ÿ©D]«=(¤Jiè‘l1ªÏœm§Æžë¿ÐÐôòync›†òÐ$›ª|2×} Ú{2J‰D—„=ƒ |þs'§i1×1€vLoQúd‚=©r𱳃¶S#š¬Þ,ýÆ9á{§h }Ö¤¸{*â;ß„”Ãõô<-Vâp>fLáyd³ÏJÀ¿»=ò…š£˜kØmR…‚‚‚ú3H!o‹7i’,Æc¯¹×¿3µžóø­™“ÂÒ}ùK4é ~»¸iÍö“’ÃœÔ ×Õ¤µ~´w:Ý|BÖ}yÞO59J×8f¤Ü±sÏþdÌþ:ñàLæ!• €TÁ:4çFTˆ¤Mø1¬e@OvŽŽ–Í0¤ú³\V ‚üœføîWLå/×&šŽ-í© ³Sí¬¾IÆ*Bå {E$…BʱQ¥¼c¢µ•®Iþ˜œkCKÎ}K§OF!uƒÔC%¤6 Ô²(&OèqjfëNÎíC ¥éV)Ÿ™åi¥a·B Bêùœ¿CûôÃÐÜyÎëÕxíjüé“ɦ´ÔyÏF&­žËŒ.Ðz«V÷Ýþ†ÅžuV÷ôýˆM3žº÷«û°t_£<×÷~p2‘Y<\>9•UªMóW¹¤e&Íòót$’R¤û†ÅŠtéJHYïE!Å9¨A0ü<»[•÷TÛ®Î}¬Æïí¿*ï±*¶¤Aµ°é¦áÏÑ·ß ™3«b",ƒK$º¾/x!’úí '‡Ÿ¢®¢¶Iz‡g¶Œà<î‡ÔX4’jV4ÍÑ7þ¢P¾ÎüätŠá¤øûJH=~I¥åj±“‡óú#)óÏŠÁ_)((©?”¸÷ÿT #k- I@×0²™6•º¨çüÑÔJÃØJƒé51ñwô!x[ …ù‡¥mü™e‰ZhúIÆÜLµÿÇ…Š©À«_gzb®[tõ;Cò·!-ªÂŽƒ’t˜…ø¿N§šËëV‘<þÜÉžlP€@ê½ÀDC<Œß¡"éøÌš¢á°f(¿O=¿þûØó).#¢S~vY2œÓ¡Ê¹ð­‰é´˜›jÙÛ5 Ü>Éz Â¿>ÉŠ¥m¿ ‹ÏIÝ–F0Œý0ÿá°”šÆ„üŽñ.òtßG.öóuêܶéúÔiá¿«ð¯~á7[Ÿ:5ò¢Šäþ74Ê”è3Cø}Ê9©sÓè†Sb~S<ç¨k*Cç¤|£!¤   ¤þd3¯r-Y¿nÌé?ò¶=qb …"\-{Åœ”éG¿E[vå.Ö"[|š…nARÏ;ö#Ó˜@$j™$ŽÉ¢"ì’ªMÒÕ5pÿŸ£Í(Šxõ‚C3©Tã€8ãn~áè¢KÔ!-¿­SSô¶K—ësg]‘@¢ýì¹U ²ºß‹ÎÑ'‘ˆÔYÎ+† ÐÕ}“ÌÍgabϽ­"ëøxa„6Q›@±{MEÚ1ÁÁ …” ¨d®Ô çÙ—¾'Õ é)¶“’ïŒ #<Æpº>XHœ§õCâ£á eò}RC3vülD#Éó,òÞ+ÆV÷ùÆÎs¯R@ÊËf®=œ“‚‚‚Âßmú7?»Oþĉ²þg2ô)6@•+w9 Ü[$ç²dÀ^§2å(¢ŸÑ [–Dƒ÷IÉ^½O c™Âì…D¹›ià¨þçh‰•'öW"V¾–ﮪP‘)ù[þ‡}R2e'< ½„„Ô[IAAAAAHAHAHAAAAHAHAHAHAAAAHýÿÌ‹Ûÿ k!ÿϼ…8ÿ'›Åèæ¥ÀÿÌ õ—5ãùϼݽh0‚Œäñ¨+OÀ³nÔÃãÔ~¹NÜíÝàÒc|· êuêâ#Ô¾ ?=½ ñ:Ø—j»žv=çðj¿\{O:Aó |· êuªþ¸ÿì]‰¤¶‚Z Ä››÷~¿pªðgü@ñjÀ½vô.àºPPP¯Óûm8n=}‡ …´ZT‡3!6ï=t€Òjü?PrHmÇç]€‚‚z#ÞB B B Bêí…Tmz°Hš€¸)Ч8Ҥȑ:ìÈ[ )¥©ˆñR¥ýBŠN3 t‰faKëŸC ñÞœÕ+̘T]mŠeXÔæ±|€8öC; ‰ìÈ}æªxzXû­¹-8Š¨ºà3ßJG›Ä X¹ÈØ"ê˜¤å’ EßM'r:ÿÐE; ÏÔýÅë7šùæúÍ73tL[èçÅH;—W!5‰\åEÖž§g•xKit±1ÒÑÒ·L>dë-8û¢óB¤’Ê+ËùAéù429°òb¼`ß w‚®.‘fë)¹$iêŠ õ1N:Åݼ‡E™G$Üs ª Ï„‚zé>…·i<ß)ù\@J|ø„9Ë*l:¼GFãEKÓpJªpIýo U8[öÙ†¬¼!8vÅוI¨–œè õ4ÕóX^TÕ“WÆ£Ény'PHQÙýb›„äTöq6°ó,Ì<Ø%®¼än¦gZp£¢í1©Ûõ§ÌHgÙMQ}W&?ÇÚ¿¼¸Vñ%oäÉ^é5ØÛš§AÎv¢KÒ†çI³˜ðù$GIÁñžÂå¿ëlb£Ò£ø­–Cê‚­ùüÔ}Å›¶’ܹ­Üã÷B|ÝŒSÏ,]¬G¶ô_~¯â[ÀÒó<$=ùÌßN¶p}Iõ³ä¬h2ÁÈWò›pÀÔX~Ū}…°¤èÑìý*.ñjŸ%ÆÙÆì-­Ü-›˜4«¸}¢ª63‚®]V¥øÈM¹¥ =ᑞ̸ý¼ÚÞ’õ[-ìbÓ*AT¨·Qâɲ )ÊKoa ñA‡ !õW÷½©:|@Jt°É”ayƒT=(YY`4¿¨øÝ„T=ÈàD°¢v”Ÿg@ù6 ´(çØïÖlCu½²F =ÑdGrÎy)¤z%uÒ•®ÞA–® 4]ª_Cù©§ H5]v2"2ü+’·Ü•B`Ô­°¿×æÈ~YrjÚƒBܬùžCªòº‹ƒ‰ó²'eÈÕÛ@” Ù"úO µq Ý4µ¸H;Bý\QH-‘Q*„èœ]A¶ÙºŒ_ÕÄ¢ùnC¾«@ÒüpKßG¬„TºÚ'¿b1)A#H+ÊÖs^-jÁ–U_Oαu÷³põÒ7°XõXTuÂÜÈ1q{r"wÝV#:·Ä%‡êÛ$F.=ÃC*¯ëÖuD„ôCÊSϧFÚ Ó}PRRÿ-¤úÄGNY˜Xíê“b‘TaE<Ó[È©~G!•–禭¥CTþ)ö ;O™1Y‹v¤Ä- Æ›îœÝúÒH*·\B¡yG¬¾Tzü^”Å·^ ©[Òf >vÆ7À[_O[WßqÑ’(žêÐyÉ61‰ä–Z‰PýÄ‘£sÙe©ò+$>vÉÁ–í³¡]~õäº"Ý÷2H;pªzÅ ÏäÊ_"£{­Ö£ÊÏYH¶’ñ¥ë[„À$}Án oá9á€lg~¹R…Ù´E»¥÷ZPÝÄ™»ï•>ïÌ2 [‰BÊ‚åš´³ùþp×o¡1QHIkÄdf2è‚¡]z°¹;R ©ÄHRÕ’Vè0¡ ¤Þ¤jé¾òæK(¤ÖöÊ£Ù §HEnC×âœ:y»æ¤jïx:˜Zñï—·É mn½‡_÷ï‡Tôæ’ôÖ`wG1õŸÉ‹e…¬æUv Tµsw!p±bÓÝ×ô•5Y[—ŸÑ9‰¤N£ÚŒBŠ»ý“œS b­ › EÖôh¡ K߯±â´RuÏŠt–e=ÙÒ|ªñ‚´CʱMUƒI?p6aT}ÇÙÆ6bË}ñó…—×]XŽ¿Î•R6±ÇÄmí>¬¹ö9§d§@rV¨.Ù3í/Bª­ÓÏšBóYÇ©~šJ¡û„T]_Áâ¥úŒ¤ìƒw“ò²å’Uµš‘IöÜßGÎxy‡3 ×D•€TMWP˜·sî±’c%·jSíèé‡TJŒÁzIaå3Ü‚ !õF UuÙÅX‹¬OÓ7dêS©D]ËàM§ìtôôéTC…J%‘ìcñ[ )tÑu È,Ê4¢‘õ˜ –Ý—4þ‡í¢o3¤B½ìX1g$ƒ·®ÙÌp<‡TÕ–$=*M.2QÇuY—L¾I¶¾/éjs¤Gg,(É>Ž®î–TžYàjI$ÒÌbvEú1³›Ï_¸ê–!…D³õÌÙnãšœ]Ù+TãdÃ$è™8µ„,`ûˆÏ„”èÐY7G+Š¡½g:Ÿ~9QÔJ–ˆ™d2c~ð¦§éáDƒÐŒC'ímüRvu¡Ú¸‹i•’Wø»ê]]¬ÉzúcG/áEISwttˆIúY nßnfhhè‘wúL(©7“¡‰…°4ƒŽ´ÉÛšî“ûIdÌ\Öö|‡‹°‡‘f¶¤ML zÊö<Š²ŠÈE~¿¤'Ý™rÏ‘bŸöiY«âi!òJhÉÓ ÖÇÐ)»IP§Ü÷Ô†>ÅB֪ȰbèÞ"ìSô'€¬ ­äyµ'Ïa¸:TÒ¢¼bý 'N ¼zY v¡•Ë[$·¼ÿêõèéò& µ•ÉwfµÈ»¥OÔ„îŸ7ôdòJ~ŸÂ}G- ™áëž¼°uW†)mFÏÖ*s!¿šm’o¹B‹a¦b×=!绢ùÊofFóó­depá„|vßßzâŽôfŸÝ‡„œÑûôzN;°”nÝmoiBѧêZ»ç7𠃂‚‚ú—@ +X}|Dm>ÿZ±¸¬}¸Fþ@ø¨^())©G$!!!!!õ÷ uð"XÙ VáMˆÍ•—Á£N°´ÆÔò𰺈ïV@AA½Nï·÷7pçÝ€TO/¸ðœ}€K] :zÀéûxµ_®3÷Á³põ ¾[õ:uù1¸ùn@êi7`íCÄ`¨gBlvÙ~}Tøø3~ T„àä=`²ß­€‚‚zÞ´ ÔÝzW e´ õ“*"¼Iöb*Å¡ñÅm÷c;>ïÔ›ð~Ú@-„„„„ÔÛ )aß ƒèÛ?y›!5м7nê ©¾¿oóÿ+é~^aá?zyáÍ|u{…8¹•ÿ±C¾À{£  ¤Þx$%ªEgÇÆÉéU‘µüÖ±qLJsûÞêHJþW/î•rèãÌ[¸Œ¤Ä@=«ê“¨]ˆÆÅì³}¹ýƒ¼»ÄmG_Gï»W~plÆ5aÇè„cÃJ;ÿÿ î•txL~ÇŸ»ßÞéUã¢vŒMlÂûóÚÄ`hÆá1Y·ÿÓE{F¤ÿ8ûR§^E½èüGi¿ÿ—= !õgBýÌ°´ÍÓY]âä´.¬[zFÆWÌ66'è™|šÓóìXÉûÇ´T®îîî‚'h° àîîPÜÝ%®Ð^Ý•º+nµ«_å®v-5²ÿÝM ¡GO~W!ÿNŸïÓ' »3ï¼³™Ï¼³ï.ý~»ïIΊ8¬‚Óéþ>³}RÍôæN÷e,Ã+cõÓ§ûÏðbK:.=Ç7Ç!§ê4Ë›;Û55î>†þr^o|Æ«¯n-÷ÍlµUAÏáËg£$•*Cp›é¿q®…ÍJçÝRŒÏ,„xÐ([•Nç$þjŒøvûÈPî̘Ï7úOÌﶸú)š!g±Y¢—'ßÎÖýKOHýÕv_û$—à1™5KUT„¢½šå7<¿f…šþÄ~)8 ‰É\c»lhžŒó)1„”È>·eŠ‰ž¬ÓMx>=K:e—<¡@òc%/jÏxÝWPÉÇ0:$iÍ°$èÝå]ôIj³$\Bo‘`ÀÁr—­EØ.³S‚ÖÖ}nzn‹tÎÛYzZ+B^ S+³>©Dxpw£œ' ÕqsbÞ"ž§>\¢c7:÷Co«­·Àle§³Âåü®JBØ:lI+º!Ö!AoGŽDZo—`ÀÆ´#] ·v7Ú]jb!½é‹èNz r€ÀHø\AwÝû‚^ÐDz˜×û°î&$i­ˆ‚1êñŒ°*ä ¡«[…•<Ì‚†Æ°e­¶J2D,G<©½"ø† ŸÒÑMR¾„ Bpƒ@êo Õ…W¿Ü_—õ@Š‰~Ù7VöH!ßôv œ.+–]o7O…!åxãH J†!•/Õƒ†ÏB Y]Àë5FÞËH^k"Çg·Â|¸y•¦Ñ*ÓÐE UûÔ`X×V+ªNÊDfKÉìË2êžC©]ùWç›8­4ñ_fê&c;º  ^ÿ !Åkãµn­ç23ÿ•6 üË${B•¼m 8ó1TÔÆû™–sžöÚûJ;¸BËxµiÈbûÜyÆšË\/c¸Vȯ™™ŒlWJÝ[Ž·™ß60u—Œžó"3¯….Å3Í-å=n ‰aÈGÎtÍXh(‹·š÷eéXæj £•¤Åv…‹ µæ¬ûE”ÑÃÃòåLÂ’<çúŸyr±¡ÅJÓ€F¶+ì7 ¢Á×së8÷ Õnp/VºÏˆ½waPÊÁeÆ®+Ì‚—;¬¶*Ä€†ÄnXiè¶Ü,h¹‘íJ»ášsË­W›ø/7¶[eÉ w–óp)vÕr'ú|»Ø•ºF ܘ³]Ò›{ÉÄÿDéË“5 ™g¾Œè,¯a73î%¦ø=©ç£sUUc 㩇KÔÕ''¿ú›í>á’øþGH u] Õ½‚58qƒœAÚr+†Õ>ÜËGÉ`ƒïíCUþ÷Ïë–ªâæ^ðn.W3˜…B*§bµNðZ—Dáãщw``J ñDY—_0%PH½Ä0*×(ëLÏEïTæ_]+ņ±˜´|œ²×0ÁŒæ©ööK#~ý8 ÌwÓ--Öz5 %´Û 5°ËÜ`H=\ª¢6=…ùÁ‚ËRé‡äUœÇä¾Å°š&[;Èxß_¢¤õ¥öÆpW%â ïÙB-åe!áÚ$s¯UÂψº'z%üÉPR[7œ ×ür¶ÎZ:dÏñr†‘Ö숻fË°øKƒàK¨’ŽÿYΤX‚Õ5ÁÝ}YP*Òž ?3˜úa†•õ¢˜gˆ(Ư;+Íh™be-ïxݾ{7ÉT}±O-†ûû"5åA7àÇbñQ?‘;0ŒgóLæ¥4 Š+Æ*ûŒÌo‚®Ÿü|°šÉ‹Û„‘çÁuµ…±Ípý’‰Ir„d‹`úG)èb ©î`@ îûˆ ¯ÕNÛ¤ þXôf@2‹µ^xo¹–îÌ,>â4ž¤¶0 /HQ»0´=ãÖh*hè(ae¬«1뛺#©÷ÓH&ŠÚÓC/ )|#ÁüØ" )o!¤˜ÍS{AŠöx¡¡ÁÜÔ&Aë£,ÕV¸~Re ³л0ì¤Çñd-¶!'r AþÞJú< j¹ŒªÁ”|´]nç4CY‘w{A*‚&o¶!¹rµ†Îì”F©"ØïG{Û/s?*ÁäÛ°\Ÿ$¯¡«¨ª¬¦Ë–dCC£Øòªf <·Ìø] nÕ12 UQÍvžï¾áÙÏ%é| íÁb}ýùñO‘ªÈÍ?…x¬±,–`?]¨¡1=¡ ÙŒMÝ*cF“bð1Ì׳I‹ãß ŠãÈ›þŒ +‹¡¤l5’Ö ©h¨·¼ñ‰õТúrß_Ñ»T å@ @ꔫ‚ŽË"›D¶ÉóœCó¯¯ÒÒ›‘ 01Î\c¡? )ÕHU®B")þˆàx9Ó‚¡…ͬµ™¢•¤à°‚Û4"j×,ç¸U:†KÝ `öl÷mUÀYŒ¡ˆn÷ýþÑ$ê£Åú³Ó›…²ÖXár ÃýUR¿ö@j-1ÿSHYn)Ê%9UâÄB¯ )Dí?CJÖjrJQÙM­Uq QW,´Ëœs“@FÅpJÒï0d¥w*h’‚ÊÓ.NõÊ]B´‘%¦ Âvò‡$šæ‘¹ÌÐ\Ƭp(ùñb#½5æѪì3f„^À°~C •„B*m›Œ9]R)Ss¤dÍ· !žÍUT6Ek)€ìIê¥f£SÏȨ:¦~ýG €¤ÄRÂnø[ÿTZ—0 YÞ„!5!ýü_çùºÛ}BkG†dȸœA&V?^š~9HË|+\«³?Žã˜<ëMH¤ÃD1Ž¿.ÖÅ/‰mE<Ã{9_· ð†}g¼üÈ@$2Nʪ¡Aã<ì–× µ1-ÒÃ+ØÔ~„ýùȤ'ˆUðo)WãíFôJœ˜ûÝ1{´TÇaTžHâãåSÃåáÈí$Lñ»ÙZØån—1¼'‹UUg&!ùØ…õ«ÕG|R½ …aÞ^¡¦:/B/ÑÛËq3?ÙîëóÑb¼Æ¢ø6áÅLk”dBÉñ ºÑƒèÕ¢ªÍ’dógü2€Ž†™¬§ ´Ô—D¿œqWRèÕKT°s_Ì21YÑØ]Õk):ÚkR‰Ý2ûR\%ÍÌÄN‰˜8¬Jà`n{÷vR8ÎÉ|….QÞþ2:Ð Œú»HŠñ~ÔºÝÂ8k•”–ºïšrl(¹qôº½Bi²8Þ»'…œD￉ÒÉ&…îcã¡@̘¶LÒ] ¦ØFRD9Çë‚ÔÝ·JÝhVØ¥ÑaôED?y¼×øÔÇ<ÀïLòß4&åÞˆðÝã2šà8H"¯ab Üojè©!äÞóÂ$Š/æ[%“boI§—øÝå»;1°d†Ïæ1©OFG–¦vJÞ›)ècÇO±G'¦6Jå^sKø”AÚÉÉáW‘¬Ø¯F‡ÃFn“óz Qwfô#QH Ì®›{§‡žƒ“ŽOõåN÷Ý6&õ©À¥Ò©§¦úp¦†Áv6ŠØ1-¤R’ñnTÄ®é¾ÅÓvÊBŸ ¦<¶mºOñ´À}#r[È“N=;Å—;Ãw󸤇hÞÙ9, E% ™]‡XÎl}hL^›TNÃø¤ÛCâL÷æM‰¨”BºÐ*ô$£IeYM̈Üa€Ô?Ûîû{õïí>ÖgRÅRŸ{yÎ'nÿÜ(³ÿòµE¦Bª·©œÄ~¦˜A îŸ]'ô3§éˆ@¼Oz„v–Û]ø,AÎå6@쪌K¸¹jˆWÇ¿i…÷i+Ý­EëüoW\¯îïF\`yòv»ú¿¶Û×ÈG¾>õÝŸÁÔ  õ¥#)NT°§OrÙ×ÁB8qê¡,6—H4Ô4´wȬ`¾€ýRÈLÕeR Œ ´Ìü67rê¾ô,ôõ#)x²MKñ¶K:Ãl€"ßÆîã°îÏÕݘ@ÉßµK×B­@ƒ‘êÔ ýx±¡_úe!¤˜èxQ·¨jGdVvÏçÕO=·§/ŒCG´v0ºÝÕý+vu[D¨§fÔ5$Jòû¬¡`ï>];2íÊ5Smó˜ÒöHõ2^h€H+‚z\!Zsۻ˩ëfiä·é\ÈS+€Ô†TGsgÞ¥»fª*ÞHUv¤r·yrƒW°ÜëPv¬©¦ÝFj¿„§ê7k#SZcÉUÄÔ¤HcÓÈtñ†Ö!ï&«‚1T| ³U%^dv H9S®…¦3Üã91{ž ¦DÚ©Û!ét·Z÷:%§¦)…½Ã3ºÀ-¾$fo#»™<„"‡±#JÊÌL½R`HÁÔ8v5(…êÃ]i·º-‰¼%l×ðdFüÑ·=¡ )‚ 5½dgT¡wîÉ‚JdSó!‰¹Ín%aCìþ·‚Vèçï§ÒÜb¹Q¼³ÆÆ=BÆ«ü±±¾ý†&t›bV¼-,q)ò§WR*ÐŽœ;Ât!ûœ)¼Ìg–½ pSÕóqOÚ’[ î>ãWèž´9éx;¯”vlCo‹{t‘?­Š"@FÙ\÷èBÏŒýYgÚ? ):ŒóO³Ùn1Ø2(Y…îx—ÃX·å>«âyxÞ®„âCî±[ó«¡¢e~ E°£BŠG„SÓŸ·aÝÎ{A ̤3]yÙzn\º[¦V ©/IÁ…ŵH=BV‰]‚E)÷Zg¨½:a]5«®BŠÏ¾p“dhpŒÏ­FVéùëcLr¹˜C*÷š`"å]ï ¶RÕ ©d‰BJKQÝ6:˜[••¨®y¶qþ‘=‰`•t$eë)+SCsòÞU(59«½.|KCµ@ o~âÖ·Øjù­OÞYáãc¥¨Cªqòš…¡žmÆé”Í¥¦úkÖ%ךýÍÕ¬<ݲNeoí12÷^mãàÍñOÙšj\`߀’c=pºQ‘[âÉÙZZ6ÑÇ!N]“¯•¦IÈ–äe^žæ ª¢âSvÐÔÏ­B÷:*ÐÔÀ“ûóig[}‹´ ̪׮D5˘½IÛÊ=}ˆIXUmIÙijfE™GŸäoÛ­­åàͼ™«¢îwŠŽR5²±O=šX¼Q_ïHyƽÖd«ªçÁIØ^¨çÍ!—õ )øfù;/}ÓðÉ;.;9˜Ó8u±I1ê&Ö¶‰‡ÓŽ½aWÜ0U•#øP¢Jjrœ3Ô6u%_NÝ|ÐTGÛ4ëaÉž$]uÛ¯¼3Ù—:™§¯›:Æëdƒ©@ê+d÷ñjï‹@ª'S¢#ƒ’¡ªœt½ýÝ·ûÎÖÌÃÏ")¬j¨pk®®KAa™xo÷YÆIß;cßõèÌ$5M‹Ãhï>B k“u‡ G"eØ™XÅmÉßBÁÛQéÕ0† ÚÏ…Xõ¸¼:8hú#ûðïy‡枸åb¨ì@þƒ{î€&N?â²_G=vYWÍ9å|g+]Ós;§I* ²ã•´ÒÈ×øN&jÎ'97zí€åïÞ­¦–WÜÁdl)À)9§T@Œ /áVráVŽßt4Pse½áœÞ…W%ÅžBZ!<©¥æõR•ü ﾎ×àÁâ^8©£¬y‰©'k} .Ò+:É'Ÿäyœ}èA"•®fÆ¢×@9l–ºÍVV]gh¸‡aö­8º¯o O¢Dxáƒ³Þ ³ ¢ýµŒÃÎ0àªNÿ–søIvéÃôídžaÙç» ûŒ¤ª!Zé&¼QxÞ¤G̽{Ô4‚³j øäH¬ÉFæ Ä~vÅ/&ªa;^ßã2BuÂÏpëÁ¢²Öáðëò:¼Íµt|/q®¡ƒXöÌÁÆÄq{¯L­@R_R(¡8W¡¤ìx]ˈ¸£­ÜÿšNöµ Å>wÕXŸzªR›ÓuÝÈEb )3YmëÇ°L§°l÷ÄMqûßpj?¦ |¼'U 1.=··°>Ú–EöP1p¶ L¶Jqðr[­uÊb0 H¾N±LŸ4:I[Õ±èg.NÝ%ù2šÒpúÉÐ-å?)ÓQÝÔË97ÕÁÃR^†˜P:’~åÖ o„õl÷iÛ’)åH&÷øU¬>¼6È ê“üœáVRi&Úxwæ[ÖîTemŸ4´Ú±#_QH%fè„ŸBn¨Õ@ì}y*n)—Ñ›SÕ)XU¯ý}=Iž©žI,Wÿœ ©lRÌšfo3ÇõO¸‚Ä$?°="ÔS+ú¯IžI 749Élh0rˆvOdyF§hèEdŸëìRµPQI0oawßÁÇSa•Zði(!)\ÆEóaH‘t-cµÂÿºH ËÂ:¶àÔ!†ŠšMrY›7 oœõMË„Ø•žN$Sncq-˜Z¤¾.¤¬z(-ÕSE/<åLW¯[äýl»SöØÖÔÀqg;²|­…²ò]Œ¶Q+Å{»Ï>ç*vxE—ð0ç !UüNRÙŒ`]·‚ä]×Óv_OÛëåâcs}ûÍoavsÞ¸éã`H$«¨Û'^D-9yÝ„à C*9×Û ¨$u·ðÜô½÷h5-Fz©µ(¤´¬ (å]¤ŽlRÁšDli¬ë¸­ i¥þ•3AÕ†ÔÞl-·”KÈ)ÔÕº½"©ä¢líÐガö!ºª†ÀdýGsŒ½…꾩çë-gÃÏj& !¤¬aHµøúYXs Å®BJ3êW©u†ÆagY'wª+ÁÑ"Òú‰r=½ÏBª"oŽÃ›EÅí¼)ôÛî[Eåq ë4ÃÊ?BŠ`SÚÛcGÊ«f£'rö¨¨;¥V´Ã"æ>¤²+^»;’ÌJÞHH}é{R]ô+m¬ò›¦**ž[Þѯ´2ªø…›7¨hxÄœ˜e-´ËÍ´+íýRðdÕé®ê²§°¬“~ñ®³¡Š+ã·ÿ˜žÝîIõ±–ø3¤ ïÛK°ŠË<ӆ찪ŠÜò;»ì¡•©¡ËÖ7œš®ü-%Z8e‡ü'Ü+W TT}672+:2KتX×”óy›Öë8æç]ì`Wó‹ö]ŽÜöœÓðHíÞ£†sŽ=ü†UÃÏ.ˆÂj&ä—?$¸íü·’·‘…Ǫ»Ñžq.ž×SÕ Üñ†YÑžÆ"«à|D!•ÃãjØn` Ó8·ò:ICͳä)½¼#£„c°ƒ²3S]/8ý"ĸø2xƒ¼™Šn÷©Yð¨Õm±)^»ÉeÌ‹·ìˆD·Mo¢Ã½zCêëÄ&U¬yôiˆUþ!>+LQ=8ólGágîI1NŸ34vK8ÒÄBö?¯Gmþ•YÓ7¤Xh,Þ‘Sp¥‹]Ý–a£fÁ¥_oóê< —ÛX¼÷·p«ÁÔ  õE!UþÔÝ–¤of¦´z…ª¾µ®¡wÔ™¶à9e¢¡…½>ÉNŸdKòaä÷χyá™äÒ]/w;¢5Á˜dUZØ_æðYH5@‰Ajþ»aHù,·Î¨ÿ,¤žÙàV8pÞ¢zfehyè «ü}dR‚¡…ÑÖ]ŸäîƸîëJÉMÕж :úÛ¥œˆ‰·Çjø%œzŸ’§­kbdím˜¡¥í”x¶uåUhT„…“±­›¾™§'÷÷j‹¯…ºfƒO •·} ÞØÓ5(ÂÄÊISÏÑ{ãKn}GRF¬º¶%Ñ1À>ítT´ N+$ùlsRz¤6ddíc˜¬®éžz©'—€Ï8rVGÛ=ñ ÄAC’ìb¶1ÑÜÐÒ^ÏÌ;dëSVÙwS’É=. §¡¶–Qྂ#çõÔu £ãKï{¸:è˜:èÍMBvTw…ûÛ©„Ö!O%7@Ij¿£ÌÚwA>Vx;çp¼SVm§’ô½ûðfÙÔËõʺQ‡z²ûàQhOÈË16w Úy˜¹:å×2k;c¢|•ý/uC꺑š~ÔÁV$•èâ¿= WckG‚mRÌ‘öâ«ïÜõdõ2„Û}´£úF!"…H}¹ì¾Š®^ªD³û>-ìB­±VxãLÌæij‚=U¡ÿ?ÿ‡žn ùÌï5ˆ¢¿ÍJ~¯Â¾ÏíÕÄŸ²@»>qõ?n¥;½¶)ÈÙ˜ü@pÃëOf÷Jô¿&Dî®ü£+»ú0©§‘×w°*ù}Ðcp/û{ÛÖ{,àX,¥(Š]Ê)è@RàÝ}àÝ}b*ôõœ3gˆó½ïþÿ<ôZ QK™»ÅmOòHHH‰­Ðçj ri]úá×ÿ¯ u¤>yß f5x-€€€€€€€€Ô7ÿ˼eà/ó‚¿Ì $6³ßó—y»øÐË&èÙ±FµwBO?ˆ«ý=jë„^·ˆ}/€€€¾™àãmë©ÖN(«r<9‰›`›™7 §MÕIñ3^T¶§ ' üñîзœýRk ë¯H5u@Z‡ C,ãév#„!‹«ýBQ¡k¯!R1ïÐ7”ܨòÅ)dzdB–¸‰ YŸ„î¼014^T4dED8,ž£ô=f?…½RRR@@@RýRL>RȆ0¼žEJ`qºéŸ‚mƒÿçvÛ)v8œÛímàYüÿ½;‚ñ⡃øO+A›ãü77ö´ËúÊcWÎxé]?ÿµ_@@Rß Rè¬B}9Ö+DENffr»°œþr¢kœ:^QMg%{(¥ûËÞ#©NéŒ K´å°'‰K#)4‰°HMQ]A]WA]GQM[Ö(iLvÚÿu^å>[€×˜÷¡Û'‚eÆ_.6xÐh+¥UŽg%þ'7J=–&waØ÷–à'f´}mgJٵƜ-Åø'þiï´ÖóÚ?…€TÿŠ¤:Ç{Î÷¢¯RQ‘"€TÇ(ßHœ^î°ü·’EfâÖ8]A¢ý0’bC©ëW„Í· ’u9-¾šh¤¸ÔãÂÊûä· çj‡%$ atCª” ÿ Žç ?– ¡D1$ ĸÝA™ cuIRßK0P* Ž,é@µ‰Æ;<´d4ÒNg¹ëÅ^bŠ4Çë.áu7-(d¢ç:ÌŽj†Ë%)h»ŸX.¨³¸Û’‘(¯¸»D4Øaö¶¼¤;´ÿhF›µµ—ý¢5ô.‘ 7KÑ:…5pEœ)jWdßÌ@Rý R ^bØ–©¨!ÅäK<ZØ"ØFâe!g²IªBŠI<Hëœ!ë|Jœ!¥´Ø»Zh?üþN95Ò˜äG©¼Ú…ÆÆXe9bÆ°dZþ)š!«¦¢¤á8Í—"¯“.Íƹ…®ö¾ŽL°rI!Š7Äx9Á3NFMA«·0ðj¯[Ÿ0¤ðÊsbß!Ê=$c”òRQÏ…B.Σ‚ WãqÊXÍeî§ã¯Çù¦®UWTÁê,ö­Âp;»!µS†Ä’D“¥C±:4IZý ãÉù Wp‚¹öü ) ©þ)}o诤R;…ó<ãù43ã5v»¥ØHz¿ÿm÷ ?Œ Éq>Ý=ÅñÅs»¯V°×7,8GÈ,—l¶¼¦×ðÂIZ3,):40!AÞ¤ØРHš0’r ”ñ¸*Hfc®±ÚþOŠC 5(>u­9u ¥­­ I< ý¶ÀH¯'’šdˆû4’ŠŠýIenVÂZDR¶å‚,é0ws–$…TÔ‘HŠ© ÑIÝX¡e25£z™n/H fC’”&$]¡BÂEÅ™ÐÇ•Æ?ƒ”$å=rJ $™s~¥nQB †Ö$ÈŽqHFIqNzÛX¿¾!Ÿ³¯3+¤xpT@$ Õÿ':æ>–ν¼RYenäýÁ9¿K2:G¥* Ïy:(çÑàœ‡ƒò_÷×ç¤ø’E/` 'xÅÈÙì w¤ð}ÿ}Töo'„ý}:‡ ¼Êå"š°÷|®žÚ‚À*IFûИ+,J¤‹*W©¦&<’Ê¿9‡¤/¸'5Ì/ «Ç”\£áè* Å•ú€—Ô-×6™ÿÃhºÚ¦T‚×5ÞÁ k@JnÍUÅ.é}OJ2¿bÞdJÒS ýåk %óC˜bôž”ºÓ¤´·Ê/ ´”–úÔcŠ[ghË/ô¯—¤ßZªŽÞ“b?Ÿ§‹[P%Áh˜ ¨Ÿ/M©[¡Ó;’b¶L³÷™V#Io—Ê8 § 6-û_BŠ ö ]ìY:Ú*™W±BMc^òû nþó/KÑÚ¥²O¬UR™ÕñYHwL5ÑU°Ø9€Ñ6" A^Ecn€€T?ƒýñBµXe5%U¼’Š²²‚ÁÄ‚¶‰nžŠ*ªJÊ©È¥êŸâtŽvöÁÂFª¨+ª¨Á½Xá´YJ !5ÁD}‘o­06„géœÍrj¤ Í&òjb•Utü'¤ÿdzÃ"ŠäÔT”Ôí¦{ä¶û0´»sH&8¬êZÛM£îóyÚZ3ã?˜.rp¹6‡S“5JYÔ^÷f›™)cU×Øíåa½ÌõÂg²û4ÖX— ˜`·L¶rXëyn¦9 «„]e·m z—gȺ8%yìâÈ3 µLzg÷©È%ŒÌmÁPê—ëù /@ %™²KN'y’̺°ÈÐP˜‰ùk¯GÃ8/æik ð*•{dIæ@RSíÝǼ¶{9Ž¤$ŠîÌ6·B³ûŒ`&"•çV- š`á:ÕÍæ†ÝB³û‚×zݘ¶g9O©¡1Šz,)8ˆ#W-4ÐQÆj/ñ¯˜`I˜ '€¤úßv_Io±DN)éy¨¤¿n÷ñz›Ê·í>ÁÃMÅÝ: üÌîëI¢ž§º\’L܈@Š}<†×ý¼³§‘ª,þ̃B‚s¹½úósR¤ìÖú<@²/z.x[Åúîƒ?gy±Èû">yn«¤÷»Mzž“âˆTÕÍtÁ¾¨Ðѧ¢¸}>{ÕÝ/ÑתpVu ‰Ý?9öWä3µ~1^mz|#˜¤À»û¾pℸèK¿»o@GY5~Ð7~‘»yª™‰¼Çíÿ/pÌ:¶DŸ(¯APÀ›,ò9/^«   õEFA†ð¾ù›™bò¦ÄèCôñʼnìïýšJ )©ÿG‘€€€€€Ô×þ×Üüùò©› i⦩!¿‹Ðý·Ð¨ñ3^Tã7@·Þ@ö§Å»@@@ßnöÛ…j^þêâC/š çâ©·­P{'ôLlí¶îEc«x÷è[êu+ôªå‡€TGtô.Ä«K}½i…˜•âj¿@ì*¨±:vW¼{ô-uð_ü *½Ìó¬*1lóÉû¤(åâg¼¨hÐëfè°xŽÐw™ýöÞú÷ªèg~MØT™{¡Kàv5D>v'qÃ…Ø åé‡_ð*ùÌþ)¤;5õÄÄŸ/ÄmªÍ9Û[ά䋤ª!ê¡úØõã6\ŠßXž°ñr܆‹q%Rÿ–¼ë>ã ô©]ƒºKŒ¿ªH/8µÈ‘^ðaO2ËÞ¥l¿I©ø³£øEGn'z{øß6G¿ð,yÏ£¾œÏG,©þ³%¡$—Ö¦xŬë ©/)äk^°çˆ¹% « ä½£]~»w2Ò·´ §y® ×ÔµöÞôžƒpªÿER°µ¥‡Œô -#˜nšæ1)çÅ-’ªŠ~ÞíKñL( jaqÄxÏDª{49dC™gúZù.³¢-²pKö™¶¯Ó/¾ ;_{Zfž(sL­bÕ‰¢I%§˜„í Wüù”Ž˜¸|ØnÝ¿n+oÇ6-›BjŸÎ‡Wt»×;f=`×õq5’41õO>ÕÎê¯+% )±‹¤˜•íÁá‘{+ÍTU¼w¢ªl]íO̽ū…8 P’?AÛu/­î{Óç Å©ir·ÐŽ¾Ám€8WùaŽêÖiuŒj1‚¿'îãÖ5Úëi…"}ÌÀÈZŽ*»˜ˆÈ¸°¢ù,<‘/øýUw]ÂcàÂ*ˆqù™ƒ_ʱf´B‘_!Çó?©³ûam诺>i¢Ûþžs;p SÙ˦° =%]ÈÿÈ)=–C‚ÏLa+¢V Ûe|ì)¿€ÇÔpÜϬëµXb—Ý03°Š-meUþ¹’ŽØÄíˆr$ê .§®¾Úêµ<çN]* )¡¿‚Ù”m£ØÀ®‡>é²À¤¸Œ`Rê…†HýgHÁßA¨¤áWR7¤ào"̦bx6¨…XåÚkEW1û#¤øœË÷,Œ<ñyÕÈ7— ïSB©Ë{RœnHqPHåïÚ®a–I.ƒr6mд ñ O0³¶×0‹ £­·÷ 3Ò×1 =¯è¥gì¬- ¬Ü IVæ{ Êà!{êëçªoéF´qÒ·Š?ú2ÒßNYYKß<0üÈ« `_sgcg]Ëu‘¥¸µ­!^¶êà(¢Þ±(8—fí¤¯gèF¿Å¨‚Šî×$Ø8Å™;úèع²±k…Ó/§¶É×ÆH57w Úû²`ó&’™•±­»™³µž^ 1Î?öp³×6s#¹Å»{eµ h7ÚÜŒÕ9Ïxu» µ–µÍ¼Æ¬²y\3c;7}swoîø ,ÜÆÒÎÑÐÆÓÈÂÖÐ÷çœs]Ì´px ßü¬+ˆ#¼ÈÍuÒr(&#mGBn†¡™=ÑÎ]äéÅ{À®éŒMŽÕrËqñ 0&‘Ô >aûš¹u-Ññ!’ÑÆÅÀÜÉ“q“Q ån(1!YÛy˜9Ø¥‡‡©RÌË/CÂCô`Y;ì’ãNtí(%j++ë:9åœ.:xÊÖÊÂÀq¾EÔÂ2Ä0Êþ“Ú†19•È`ŽúïÛ}‚¼Úû=®Qk›L´tŒM"“¿É~Îÿ²Ýw®ÁXÏl݈Sl¶nÉÔu-,*ûÿ©‚={uí )ePÞ¶íjšÁ©ç:xU/->'épØxx³†²Eâ¥æšz1Ut8\ºôØÍ\ǧä9ã o”ybW¶¥o>XÚȸx›dä•v²yùU¯ŒR •\ƒâƒÔý/ó®uF„zbÍ‹ k âK— ŠJ6¹·Y P~q"ÁZT‘K╬£¾áÔAìL¬ZhVµpúåÔ6{X+“h¹—!Nå/šª®Lä>NѳFÆÞiç;³×“5í .u°Ê^ø¹™ãˆú6/+C£‚H…;ãóo³Ë¯šjiûnxʨìÊß¾O×(<» ŠMõ%¦]‚e]zQtS9GÕþûêÇ[T܆–3eÓô_aZ1NŸÑÓµ9ð–YÙ™WÂQÓ É¨‚âSã”4£Sϵ±ªÚãÈšö%ô‹ç´u‚OBÜZ¨¨´<¢ø:«â3 eWÎïŒ*>åH¥‰UÔñ–‚]HAYëÙ–Ù9çáZâ#ìÕìw2oBQFšÁ7J®¿q#ièÇÕ ÎäbNð[ÿ¹Ÿ{á–™‘‰ßá.n5˜c¤¾Xvߟ!Ūî*8p-žQLPÁÚRžî¼÷;H­7TÑÖ\—ÿoÊݺMÇžM«äsjÞº[‰´W¼zˆ{ñ4AÅ0ú@µ>^×k+ãÒêåöØd{‹”óÌË×Íð*ÆÞ…‘ÛPÊ:í¾ ·HFž©'ZY-‰ä"##C5 Mœ¬¢íqîõ®ð W­Èë\8v®½g‚UöÞÝuÑÁ) È¥GtHÉ—:(œØ§Ž3 ;z…T«™VÔ/ÜkçKUÕ*údõâꙇv6¦¾û[S²]ŒãŽ"@©…r2pÆ}Aªàs_¾ª¶[âéväÜ“×HÆ&AG;áè¯fê´+¥ô%­¼‹UÕ•Q” CŠÕ rÑÖÿn­sø¹…SQ6Eá­SóС眽¢§©çŒŸ©á{þ-e3¶Ç«†åT¼q3Åk¢‚¸u…—Z™Õ§”©¢j'¸•YöÚÍÅØqó«¢Ý»HU@ñi®Æ ÇÃ.µÓvæã”ÝÒk (ORÅ—¯èªëzh£ÃοÔ`g™~YNÅ3G ‹MͼZ0ÇH}H1+»È§_PÊ:áÉŠs blX§ª‘]Þ/·û.Ý572ò.åsÑí¾BÊ„ÙX\q/ Ú_NÐÑÔs µp 6w ¶ðŒ÷åÖ#©eçï…¦Ùºyê»ï|Á@êdWáNž¦¾OÜÁ׬~jZÎî˜R1È°â:R>{‘TÀ¢ÝìHéZ¤\FÒ>¹§iàôBNõ‚”nÒ}ÞUˆ}€ŒUÄ»„Áf˜»…Zy$†nKΰ#&žD:[ åe÷@ʸày7¤4HíÎPRÒ&º„vŸ›q¬½¸ÊÛ}Î'*™di¥c—‘r Ê*ÊùRuO,Ô°N›ÛH­ÆÛfç£W÷|¥¾–ŽwiWBr¤fX…sWšªA`ÆeˆWó:¶¨ØÉ7POŸhŸWÍØOÆ©Ú'^@ªÑÝh»áeÑ!¤âÒÔœÃ`yD9S²*»!ué‚Ž–¦¾“Ðù–°ó‹¯ÁDæT¾p¶Ô7ÛÐ\  õß!U)ÌO.ixCÊgŸ³*šÂ\¬˜OÖ#Ù•é§jSÑ#)N͇g’n⃒kï&î¢a•R#V‰ÿ RŽ}C*öä -u»Íð¢IT({7A?y+ýÐ{¸ve{|n !ò4óÒmScïô³PÃG?h+n«ºÅßßRÉî$ïÆßBê(^# û^1wp••ì“Ê?n÷¡zŸË»tV«»î¨p™v¥¶'•©¸Žp¹õ]‘Á.(¤Ú}lŒ ³žÁÁ ïz‹§¡²SÁ]ι£:êæq§WcõJ+<ÕçºM¾‚dzs*Ÿ:k™sßåPsTq®~Ì6á64ºëã,Épê úáMxýଠH@Í‘Û®EåÙ[›ãtSϼrÑŒBŠ¨„õ®c6 ©c:81rOÊî*WsM¿³ì!‰H¹˜ê$Þ‡Cv=f¡ç\°óZtnž¦ÑºÌ ”Cç ðDÚåxÚzScee"‡vJ‰uW5ÎJ;ýGb~†¶6Þ%ÿ&«ŽîojäÃNÚu5<-Y˜’WÎNôÐó ÇnkH`puµ,ƒO@\¦šöºÈíW ¯tß6m€’ƒzþ§&Þ{ÙXÄîKÛ]åîaKXwžS×›¯¢M´Ï¾¾ý°©¦†eîCÎéÃÚªºNùRvÖ‡»xsÈuPlˆ)Á¹0q÷µ°„PM;rÑ$qBÇžB-çÓŽU›˜:\HÛyÅÍÞïyœuJ ³Q!æ%}‘‘ N ß|-‰·Õ˜`´å9²¹z¬\Ÿà–t$NH})H5†'å¹ÇÒ½Sx^ñ·HNÊEˆ[ËÏÙvÒ'žìÇ Ûp‡Q'H'îó²ë ¢=g|Šv5VŨ䳫[È[×hûȾr?8msæEmPæ†}^±…îq¼¨¿1k½µœ-‡½ã)î±Ô`v^ÞWvflØãE9ÞžÎÝîSèO«¤^ü-4À¨M+9¸i”Sóz]JqÒ)ý´“UÁôKp(A.=¢o›–\¼Ï3ºÈ+çXF ¯vu{*c{ЖF$È‚K*›â©=b‹²ýI*ãg·È"¸§´Zî&åàÿ$ª[t‘OîñÜ ‚ªÞÅ‘7xÄyeÌ>׎dè¸D+§W ÏíRŽÔ&SÜbhþ´rJ p1Ï4$Ð|Œ(sý^ÄùñÅÑ;g¢¡S&«€à» çA :€ÔÚîcU÷V÷,Ôýc¯ÇyúÙk‘>5•ùý`úŸ %0ûcºÇ¥Šßëõ=TýÅH}R"òàóç>ôø­úÓ±†!E°J+¼ÂõðGƒ«þd°¨%Ý­À ‰ü¼0¤ú°­¯s?-=Fh¡ þÎÐu.”kì*è“S>y­G¯Ë¸×aŸi«J¤’ê¾j­¼»EvÍ+G ³Ðˆõû=€¤À»û¾¤ÄIâøî>ÊÑ ¾¬¢+]ÿ©ž¨‘­ïº“Zÿå_vA?uÕÊ-+ó2ÿ»o¯Á,ÎÌ ²Œ»@¯¯EúúBßSÇCï‘1ÿÓ"YèH=_>αðûn¯¡á$îf=Øèúÿ©C· z…XêÄ=äoÚ•‰«ýÁ…!uè¶x÷è[j÷R]ÐíWPíS±Ô¯PKTý»¸Ú/PÍïPS;tïµx÷è[êöÈýGø×Þ]~}$~:òªÿzßz(–ö÷èð#è];TõR¼{ô-UþúõÝ©¦He?„¡ˆ¡ÈÉ1èV#„ÉOû{T]}©ó^}C-ß U<ÿQ ¥S a˜†%nbBÖ'¡;oÐ!c‰³hÐõ×á°xŽÐ÷˜ýöB•/¤¤¤€€€¤ú%¤˜|¤ axÝ?ŠøÃAËÇH}yHñß œü‰àBîÿ³¯zqÑ®‰^f}ý-·Û?½/äô¿¯¡¯ÖÙÿÞ¥ÌîúZúR‘˜°q¥±×ÄÌŽ^_OVçðê*S¦4DR_-’â@ƒãeÖkôlVº®4´[£g½V×lAÐáÅ¥ÿ}bì™ðûØÍBF¼ÀpþÒ`&$QP·Èªh(ýÏ¿í·$ðæß_“ÒiG–¸ì“èƒ5"K…?ÿ–ý°no¥„À@Rß'’ú)"_VÇBNY}Fj»¡à‰âÆb‚¼²Z ©¯¹Ý'‘wDJý°ôŠ¹ú: û‡¥_‘Ü04÷ÑèÄ›³zÿs„ÛgÌËhši5<¯µOßþMýŸ+üÛàºÏs9¦Vü&„¦ NaŠž"¨¼c’³ë¼ð_ú²°}œ[¬[­vù}´ÕWëƒ7ɘq%ûpB"©poY»kÂý„Okûm¡¾Í¸Œ7`Îúê¶i0åÎR•)í=KYxçê¶Ð&‹OúºÛ},ÁvkÛ=Y§[˜bäG‰¢{ã£ë$˜TÞÍñ‰7†Äí›áU<)æ6†ñ|\PÉ ß#s[‘³8ÐÄãS}9Óý÷ËCKXЀ̲)þ%Ó}×Oˆ¿aw*Z£EšïÂN†¤rë'¬Ÿá»aRìuA`24îØøŒ#Â7ÏðÞ86õ¥TþÕ)~¼iAÇ“»à$a3b*†ÆžîÅ™rFšÑ}y ¼up|úïc7ŽÊy‹a5ˆÚ3݇75ôŒ49W*ÿÆøø†¡qûás§†]€°à= ©'’95SÖ]Åb6XÄŽ‘YB‡À}ÏÞ±F7p(Eð[¸;•“ýx3|7ŽO|€ávÁ’ñ¨·gºwñ¤èk’Ô{…7&n˜áÛQ6P1ßŠØ Û3-øø`r[/H±a?\›»qÓ¸äß`È®™m¬­`˜=!á&üãЄ£Ó|¹ÓþTÐ.péðд5Ž‡PƒÁ¦€Ô÷¸'Åy°¬RèÖ‡dB¦¬nÖà”MJøD©o‘8Ámž CÊñ†`1/¶G†˜?€ JÚ.§n8/¸|hÒ¡UºFËÍ¢&¤ü:ÚËKQ'—A!‘ NS£ËÇûÅÈéø(€0äË+´I³BÏŠ-]lHš{O:ùàjM»IÑuƒóYªi0'àèèøWf‹¢~ÇpÛ'8x)¼§ÆÝš¬¤f²Ø™3"ëþ£e.¥’0ï²È*á–yšy}¦…­¬íiÔ¬‰ï$²ÏÊཆÓÁ´  õ²û8÷?B õú2C¿$¼ñcúçáReìœ$‹Ìö)¤Åá·„;¢™…Šêvs"䜫'°!‰”$Bø`Fçh¿äU›æQs|¦Âöä`ÕœG"5ú˹¦F ß ì†Ô8O9bÄÔi³m­••l†3¡ñHQNÊ©â—;¡.-\ª§±Ìï"z>¯§³$¾ Ã3'€Ôw†”åÉBÍ•X¼¢š¦¢ª§ª@ð×"©ï)»oHeU¯Q'̬ž\32©fdrÝмרÇÚ¥(C/Ñ#,»ŽFRžÃ  A1q2æ”´N «s¤w8î#¤n ™á"Jc÷@JF/YšÚ‰T›¿Wg8¡°¤ÖzÝG Îf+)“¦Ä_[‚S?˜Ò9(y›¬1U©œ Xi4µsZOâûé<-Íi¡;äðCE³88O«`ç$´ 5ÙÑjIØM!¤Ò³•4œg;EÈ9V!•£ =„î’¤¼”Q>ËÂd­Ý&©4ª’ªÃ(ÁC1ßÄhnÒÛžHj¬·ËJçÍ#„N«žzK’Ó%Œ¤hçeUtgG_íviýÐü·hòÉo º‹Û@$ õíïIIÐÛ1Ì[ËUTf&}@?wJ½Xëµt]I=jµõ{Þ/ú¤ŠÞÎÖÓ\ô™9-CRÊ‘ù’Yǧ„U¡¹ëü‘Áik\Nc¨w–k»ŒÈëºÖŠ ×)QtI_Ùè²Ý÷7:*³›…°oPxN5l(ëH=@ÎeÞ\ª®1#±Ý^ûcDò Á=)EeÏQùàÂ!Aá8õXinçÇì>ôSVc­gZCš¦ëá–>A!Õ52(QÞr;ÒvÇHg ycæD¯e­LþH³M ë§ù–¦£Ù9×$ ¤4,WUŸÿR’]¶RËntAû á=)览"« 舋dVŒNoÄð`HéÊ:Ôb¸/æi«. }Œº´yhJ…4Ý^ \_¡Eœ–ÃúÖb<›I²[il‹“]¡@p^­4¦~‘ÛlåÈAÜÏ'H}1H5M7PV´½*„TêvyƒLävÂÏ FRoæ4W‡½F¦tÊ1y958¨‘È<¼ØÐf)p™‰Ç ³”‘y혂‹ ‰Ö+M–šù¬4 öC5ÛXOFÏkzbÕ"|ðb»œ‰~ÙŠJóÏO¶µUtFåÞY-»rV ©TŠ¼QŠ4 ©µÚóí–˜ùÊhÙÌx$²/×<•¨+ï~WÔ Šå.7pXf¼ÜØm©Ó6p0¤dô¼ç9Ä-!yÉjÚÍŠyŽá5ÍÔÓõ},H —,¨\ƒ3Ÿóᓧö†øÚ¬µØ*%¸ÉwgYº­"ú/#¹¯5Š›Ý4ÎÅWÑ^H‚ÊiÂÂAÉ[eH,)a¡ «A¤ 0 3¶­&å¤w?Õ³ãG­]¡ã„WУ½»;hémpO%z:"\k ‘¤·u?ÉÕcOOI‡d·'1ŒŽîãÛ1ÌžK]Pa·—Žt ¬ã´Ì¯ì{.Õ€¤À»ûúñ0w÷}/ È*•1H&NüK NÚ,gB—êsV'?ÂZ¡m8=úqŸÏáŽòYæqX²8J*ëèrƒÀáí€P@RRRýJÔ§£oJþOog’,z4:ù~ß;ù·1QÇF§<”èyqSï×"ah¯FÅ×`ô‡W9Áߥ‘/ÿþ@@RRRßÔóü¯rn¯_õõR£Øâçà…)b£€¤¤¤€€€€~TH)ïGþÊ­8Êøh÷_æ%‹³ ¿Ì«²_Ì{ô µlòä„]ÐÝ·Ð/b©ß> ½ñZ\íèf#ÔÔ=þ Þ½ú–zø™H]]~$–ºýÔÜ]x(®ö tñ!Ò‹/Ä»@@@ßRWŸCoZ~HutA‡nCŒJñ½:qjlŠÊÄÒþQË¡×ÍPémñîзœýöÜ€^4ý(‚§Gf%Ī3Á6Ÿ¼½i…(åâg¼¨h¤‹ç(}—ÙoïM))) ©þ ©J>RX _ƒ8Õðì¯-ï‡B­e×A<ØΫ·ö{Úù¿B îŸ]ñê‘îôÑý*ˆSŒ·éÝW± ®¶FhSü¾È¨ë«ôS¢—ïªðÂþWOä^ý÷>‡®FZdW}µÁú± …|™eqi 2²^ÛÛÙÕHa¥§¨¨ªŽWU×PUU6Ïxĩ맑»òÕºuުʚDÛÌ*ZµøERì(1XÃ0`7­ÏË^úxYâÔ4=7·°kþb¢îùÿ_ˆzî%år ¦LGÇ{ó÷_ÄŒ¯éÃó/È—:?)äÔ6…ûâ®Ðÿd?·ú"N-dOë¿mˆWÿÂVe•%ã §¶Ïk²³èÌkzE¢«06öŒ<Ú “‘8 õŸ#)øë™l“¯¯ªæ½S©®Œ‚Lu·}”ËïŠÎ6¢^éêŸÛ}ìÚ®äD_œ%ãLSÑÑ+Vº*îÜg¬jqƒT=”nhz†r븩ä:²à#ÏÜ0"¸&_ç[äD$ªºŽüV8 ‘|J=R¯â4@%7¸YÒ£õðºL84(¹.¬‰n@a~ÖëvwÂñ£¬™|±åÿÚ;°(®¶ï/Ø[ÔØÑh”¨±"}—¾ , ,°,½÷&Ezï½mï±÷’Ø»ôj-–¨±‹H‘…ofvHHÞ¼ïó|ÊÆs_ÿË †9gîsf÷üæ>ç>#âO£¬\ƒàÛÑj¥ÑÈ¥?p¨Gü×+ȯpD3Ø=I¿-ˆÂFÄ1¸|i¬Ñ$+(ˆÿX¶Iv½.$º%†[nì’†ÌR,ÂàÎ)ŠÓq¨`´ ÀØ?¤nÚàIÑeE2žŠ. ìŠÁWo‘Bê¹›ÎIÐ*D dç_AüGN®ëâ•P\סÒûUvIú™„heùÚæy`R@ê¿)ú±Ç‚†»]>Hõ¤ç¦…Ÿ¶ 8Ï9[gëæ§oSØ eÑ‹Môpú–ÎùÍ|ôóÃ;WïdkŠÓ6µÏ8äµççä9²Száyäɇ^.ÄÛò™0¿š{Òó³Œñº8Ší:Rí¬° ttôˆžÅÙzí°8Øa}-/DE.ܱµ¤ì†$lz“n¨§­§º5#ýÓp“J0õÍ‘x=—Ð-aîó.<^æ««g klçŽcNÐÔVœ\]ߌšpŒÕ<Ru/BB¼ôõtôÉ!1{Z…—;ƒ­55aW4MÃO@ôíû­É&ÚzÆV‘{™ÒðíR[ Ö‰ö¿ ³@Rÿétò/ü¬Û4R⤌Dã¨c¯eì ¯¡oéj¸ERç®X’(N"‹ð€P²9ÃÄ›I¯–[H5?vÐS#†þÈh‚˜»w˜Ä^ìá©57 É©’ˆšzRâ=´Ì22Nu1:mm€ug=5?°×S3 -ÏùùEÁîƒxm¢ïæçeu¿ÙSôõ¬“³«!Îæ|¬¦kf=”ëOòß^\ÕKß»ÓDsH"hxæjf±ã-™îãùïäVݱ#z±®°+_GÇ`íÊáá:93g身}ã•7>šæñWøMƒ e¦µI?Q|úUž€©mè½ï ëX5ÕPÍ–ö¸ôJ›¿…ªiØazå»”ìp¬&%zïkö‰S¦”ØR4!SÇœÁ¼å§hჷÁM³ÒSså¿,«©"ªc}xÊ©~ŸnŸp˜ÛÔêenXþŠ?`Ň¾ûˆ19£Žøšz’£°ÙY§»˜‡OXék{ñ oQ´TLüy¹'^e°J´ñ‘yU’´¢x‚_yÉÅ.ú¾cdËÀ„³P¡€¦CX¨•sú² IÓ4®±ôê+RoK¯ˆ#=u ž¢Âó¹"&Á<(ë´˜}²™LÏ;ÛÃ:ZgnD (û•}þ¾¯ É(®¾›ðóRÍ›è]ÆÃ,€Ô)»o0¤ºc“#°¦þî±ÅîëCñFÎ~ÂÇȸô‰&ØÿnMêL³‘}…TDßVdìYB“cH=rÀn|·…{ú&…ìv¶›{¤ÞÜ,4§UýjO6qÚò¾¬)’_äFZ¿…ÛøÐÞÐ0¨â%”ìÞK 2áằ-Àjšó¨ì2Tzñ GŒ: ‰êž&—y„¥:‡ÆãÍÖW¼4>w57ÜÞ&ƒTà~æ®CjjQÒ™Âã't-£ÏB©é1º>'DWµ³œX²‰ÿAÎ`H‘Œ¼3O¼Ôu†„8S¸O¼m¼ ñÊBõ)4æÙSx,!ô(2K&¨æD4Ü3¤ßùxPì7vm¹ m¼±¸>Ænåœêf2VÓ>ãxîÉ®ò·ºGØÜêm,-ýTHÈ«(#øüÈ…ÃêÊ[T’‘Ë6±´róœÍ7ìâÕߢè‡üøþ` .üjK6 <ø>‹™Ž·MŒÛz“ _õ=ÜšÎÐp'«’[Ò‚œòH]RlqS+)á»ò Ç ZÆ‘g M7 ŠkP°ŸmЖ'ÜS-dò†üóPž É$dgé5¨â¨üpN{}|C!ö>Á>¹° ³@Rÿ? %áÕŠ9Õbé¢@1ÍO×2© æSÞ¦¿Œ¤Î_³2·;&I#©ÉD_£FŽ!åHÀokGÿS¿P,½ÓÎÀªC!%Áa£)èp¯´±Å¢(#_>»þƒ‘Q莸Hñ®½ÆÎ f†”¿+•Ì~º¢ gMqĘ3âpOk]ÛÂÔ¿•œºéF2 .DRææÛߢ‰|ã ƒ´òõx·Ú³5¦†F?I`Há#jD-¤²¬Müö³CÊ‚¼>甘_Ób‰ÅâpÚÚˆpšÖqwhã¬ãΡÙnµm^v”Èݯ†€Tý+/\òCY‚KNQ Ä:rÁÕ…ªÓÔµØp°CØòÆ Ô«½—-b…ìFr Ï6™IÁ?CÒþ)ào0ªàÔݲ1$EîE'•lInÛÛKëZãóòˆ-Mœ±mÚn}G@€¥kùCi<ÎßS¨k[û…T{ÙÑÍÚp«´e¾iªh9 îrOË •Sâ©¡¦ùÁmMu‹Ø³¤8?o7¶‰Ê¿†Y ©ÿ Ru²é¾²æ{¤võ ùcu½´c÷‹+{áﬠâmÏÔ3 Í©ŽÖ=ó´3§ [ËZ áe(=ÉÆ*úgNý¿R•wíÈD—mïËšÐHªØƒü#·áá?‚ÔfÞ$ø$wTiý5kc$’B e¹c@$µ#×Ð.‰¤`¯ŽŸ2Ò³Š:¥¤Eÿ² É9-æ׶¯u±eÜàUµ³.´³/¶2+Å“‡ °ÆáÇÐ|‰º‘”5 ©¨ˆ[¢mFg6¶ùxØ8ŠñªÛY¥e»yH.‡¤ì:TZû&!3ï^¬G!Uñfàt_^…ÈÈw IÝ´!»í#ýÓ å¸™‡£‘”žIØ6dJ‰¤,Ítñ+Û‘„kóÀ13]¬ËÖ¶ˆg ãv)Z³1z@$Õ^~þ(^Ë$ü°˜sñëbëB»B¦û,#`Hå Mƒ+èà&¿c_lc\èàÖ!_(ö~¾‘]ˆ¤€¤þ‰bú‰Ç´Õ–Ú:ž¢ûEGŸ²j»ãÓ¢ îÌô#ÏKV¹XbMÂNrš†e z#TÈHÔ$„ÅxVðã&¢>tw'ÿ_ )a“81ÚG¡ç]„8Ç*©FZ¬ÂæIŹK!èÛ³ãW?‰H0Åúñ_¹™è o1ª$²5©Ê›T¢q@Ù]^í»¸¤õÚöe¬f()õŸAª¾7—U c‘”v¼‹_ý<**Ð)çªèò w“uæÑ'•o“³#qZ”è=/¹ç.“ ¶IÇ%e¯ƒm4M‘5©¬ÜXœUNæi1¯òñ†pú¯¼Ÿw‘¬"ãµrkßgГŒÜĭw>$-ÚUÆ€tSú®ÃFVÙt$½;aƒ=ŽÊʯ„ØGÏÛpÞ¼Gèš”šyäÎ’ªÞ‚ezFr«{³c\²NÑ+»ÙÇë, ôÝw¾/äé˜Æ¦žìæ¿éNÖ$Å5”^}-]“*»ÜêŒ#…¤WCŒŸj\ýÓ3ŽwrN_!»&zVrè‚É)rçS^]Gj~¦eÄi.º&UÌò'z  Á@ê?‡TõGÃ5ZÒYVSÅtÃ)¨´úÑú0?]M--¢MüQfƒlWépƒ’ Ü"ÉÈM4ÔQÃâýË4}س#WŠ±°Ž<Ìo~ìhLX¿­C )+_éš”…E )|fÛȨ]¬º–Ùµ ‰Û‰š8›„îD!µ{Ÿ‰ S ©7;KŽRçLuL£OCô|# ¬¡]àÖÙÅáZž©çÄiYAصjŽ›Û +„ÆþÈ>©â]‡­Ì ±8‚kAΙ.A½8)-Y#lAüÌN ýüRV¡(¤ AãûÔü ‚®†––¾Y`yA ’ÄÎ=v’BÒÕÔ0 $ót¶Üýœ_÷>9?QO[KÇÔ;4#_Ï‚NƒáÆΤÌ8Cu-¬!9l[q$l–d¦ pX-M‚}RòáN8üÉ*ŠÀ­Qµý^*Mœƒ{òü/6Ô°#="8ðoxá‹ö¥[Ñ%¤êoPŒÍ|28mmCjð¦{pç³O\uw¥ 3“zfN¹u\¸`cgrvŠ¡Ž¦¦¶%á8Ü@$»ÏXÇYÐ*l‚xU¿øÚëà4qTV ÙZغ>È«ªë{*Þ¼ÕÜXW «ƒwÌL?Óß&᥮P*Ö¡ðWÝ õ_™î+½†L}HUq6 {j.ÉŽ »?ê$ŸpûüßnæEw¸´ ®Øó"oœ¸„ô3²ééjÿ[Ê®¢ÉÞ ²¤MöÝ—þ}RŠ4~؉®@e}ۣʮAÂz‰t‚ |² É |,¿!>ü×Ëè˜ßˆnº†ì B/Šì<*¿$½:òf dÖà}R݃k–}l>ì¨Bý¯@îò¶§ ªï;íªl‡—´!–¹úAµ•÷½9r]¶óK¶OªI’™µA×}KºOêOýS&½Š´íÒgéÖ-éi-ƒ®^ÑÿG:öÃ…-fÒšûvZ]F<‘í“Ðcð¯Ì-,]㘬Á¹ú@@RàÝ}àÝ}Ãú>Ö¶¹“Ãw>ý¯×,lxêej—ÙÀû¸9Ç›¬-½Â÷½C—áÀ'€¤¤¤äã {Ò·1Hßbñ_w¿ ( Hß!ÞÝ        õÿRÇî@Mr©³÷H äÕ©J‘ÿ_øøùnÐÇ\|&êé…î·AwZåRO; ®èöyõ_ªÛ­P§zÒ.ß­ú˜zü?ëC6Ç ©Зò¦©åïYäfÊŸó5¡ºñ²=.ß­úx£_d|jxþY@ª]Œ4Ã0|yr8Ýza˜rèü@±¡«¯ âOòy€€€>Å觱ª{        õ¿„”R`<ž”yu4K‚v ú/·m\ö¥/Ò[ƾ‚O@ò†¤xˆóŠ´3¿È¼1šÙÓï¿\AjDáu¤Ÿ‡(w{Ϩ¢;_¤7eôþWý‘ %ýªH21ïÙGêNë„œ{Š\ÉßßtäÎý2¾ðÍPíŸuc$ûÿÐ!Ýc³.eô Ý!èwa¨ËI0ìײï+Êú ž@R RÈ7nTÎÉed*NSsAFw¶ÞÌvñZg•¸È#IÅÐfa«¡¿¼Ã!’*8ºÒ˜ü½kñ·öžªäŒ‰L9Œ¤DÐd7Âj—=ŠC–¢ßZJ²XáÁ™RÐý·Äù¿ŒŸâ7MÎk‡“ydqðùÿyÿxW,9£b:~hR ³ú{#Ëyi/‡úH\[­Cœ™ûþí§è÷¥Ú뾋{;ôç™Ó:+âðHvÏb=Xhé°,â!|³†ïS€Ô¿2’âuÏñž‘Y½BGg~¤F&—jŽ"–£SÌH@Š7¸B)m]³ìíT|®#w–ÿÇ0¼ë+ ¬fä‰]‹?ÔÕÿPPôTI«”ÐÖd`W3î.·JÃêíª\¼GMÛöK9¤>2¤z¸Lé½êžæ½&¤iLVÍ´„ó“ ZeOÃnºO‚aß]nbþM^¯t<¬ìX1‚'§:ŒÞ_U^îÅ[Nñ_K´Zá}D÷êkKs¬6AÙÌ}^Æ{LIÝb+ÇuDXÔ5öüñp‡n¯À®[阠b9#u¯Šyø|÷¸Õ¦¶ê¤øéq[”l• V{œPA#Ó·­2±Q6uZG´YṄšêÓQ#¸}•Û5.Ž¡IùA/ž^¸†h·ÖÌYÅ4è«”ß0ñtïPuGá|·¨UæT ¼ß̼AýÂZ¼ÕwTßµä̧ܱóœüTˆ°{kíø`÷DO–i­Rvå,£¬1µZíX1†%…TÌXvû<3õeÁM(z¾ðÖ1ߦ ê#cQ²¡Û—,t.ºð²ý:S¤Õ«œ*ƱPHé–¹f®&9©â-—®¯Fž¬rÏ,³t^GrQ&Ú®rÛ9 ®„qk½÷:eSÛuVy“Kz1¥ÏdB#³-7§*“àqY´¡#ìœccŽÓ6Zg8½¸sZ@Ò:"\ÐaUæ”b4d+ƒfPõ—¶|Ê6 ©ÏpºOúƒðn?¤xs<üTInßy•ÍóKSÕ§~“øýbJ†]$Ÿ´š`3‹&{$•š«B¥âÈ)¤a„–êâ–Õ* Ūµ„à L±BaýZ£Ðñp$%x;j­æ~^.Î}9—b¸<  #x¸L»4èâ¶xtæ~u½€)Å]ÁËoÉfvá1¿`«:–öc’ÏLy‚)‡ëyðÞhnzFðBÉÈ\Iç«ÚïV QÆ»LËyá‰ÇÅ25 cÇñ¡) 8Bö2JO§*»ž‡GøªSÆ‘æ%ÿªÀ阯IÙ4š ‡TofÛà•ÝÎcÊ_-1Ð^ç¸oüùá<^lföuêcÚy$’bB£SÙ*Ö´‘ †ól±•ý7­èê'Rí˜ä-ê|EäÙãõ²‰ŠW 2Êyúµ^)¬û±JK[)¤zG<*㪞ÛVï4ÿ€UAÕˆo̳Cögõ|é¿AÃn×H½›îdªb» Sö …T;FøPÉ»,ôºYPµÒÄ}JQ‡bQÝZbü64:c›šiüÄ’v ¯cª··¦åvÅRø;ŽÛ lËɃ'€ÔGÏî)nÇ\7-‡“˜Rdüê¦nZ8jxf÷Ñ[V¨3?@*­Pņ&ß20œ—†PCöË ï/Ý …ukC'À#9ë—ÆÄEÙ²9®±1A*e ¼‡Ë óRßÂEFgîU!ÓGÀq± m5uuÄS$f[‡3™U÷Þ¥…ö^júxM]}mò<äÁã©ô·2H9™§f™;ZÚ´ó*z¦_A“bÔ]+‘ªDÐ/ëuvûCjQÐÄ’÷©Ëb…§À‡“c4LRG ß(à–F½@éÓ3ËÓ~yÄ5ŒRŒ^ÆýåDç/a:Ö¬1Oƒ,É„&Æ0Tœ÷#¥k äÉ&ß&lðQv߃@J<3«9™uë{"ñ›ì÷cã¹Ú6‹ƒN(z‹þÜ· ì­—&<’THOÒ4ŽÃG µ$¡S¼Ug9î®XݺÀŽúMêS…¢ÚµÄ8R“Â×zîUät+À<Êb±î_pJF䔪ÓáÀà  õ)!Åëšå髼þ:]“ÂähB'°‡!¤$ÈeLžŸ/‘D£ã"”JGpåRøyéCCŠyuµéCcÇÄG¨Ø y–ÍÍèBj³R¶«a4 :»GœQüb±‰¾²çñQl Fôæ[#Â×C@ê਄PuëâQÒdT+ë] !¥æ^ó7ZM ™@c¸mó­ÔL=WYù­²ô[EÙ äµq¤†î»XiˆÔ;ËËéûð+}êA>i~kBîŒÏúÞ÷g¤[úzfRtñ:·ÃH)zÍ:Ò¼B¤ÆG­WvÝŽáÞX©o9Cš8Áº»Ì”ømÖ{ø™jlÚÑ…®ÑkˆÖëlè˜mßØ’—$ÿ.[ZÊÌÖ0 ËC!•Ø…)¬Àbõ•Éˆ·Vþ+­£çf¾è‡T˜§–i,ëeö9“ЉÇ¹?¨Z$HH}«CoÊ&¹m#àèCôl‰n¥ÿ5¤¸@2Jú6îŽÂHñ¡i5LR¾¥ÚÍM”?>^¨f³ùdrï-Ç.OèBsc )îßûžB")mâÜ4´ýê*Còì’ÞQw‘çøê܇ßô—Ç¿œåî±6øÒ]¥ÐèPwuR‘¢è5:Ý×áV¯ÓÒŸ›/›ÄVàtÀ7e©„Ñlh\|þ:ÇeÉŠ¼Ž0Ù‘\hdz®Šuáð Õ¤þ•‘·cbâÉ© Û”q¸¥AǧÅU"Š¬Ë+ú«=÷M-SÑÖSŠ~|÷yÃoMJ)d–ih“Fœ›°AKßc*M>SÐ=ÌVõO÷}€”— RF!¤„Ð؈D-]¿Yéw'&ðUtH_¥wb„#©=*CCʉ¤L‰ÊÇÇeŸýŽ’²ÔÌH)¨Zÿv¡‰¾RàOè=èšÔvþ›…ÄeGÇç^úÆÎAÅíFÔ;Õ/ZÍ­ºRVCL÷™¬G …g«š®ã× WÆe]Xlª»Æ³Sþr‰Ž¦yäÌ´Û“âØj¾S ߣ‰Q²ì>Á“%Fx b¸Áñ#ªF‰c‘Dh\H˜–~ðŒÌ_'Å2Uõ(³²áxÿú*-öäœ;3b5Ì9#ø½3¼=Ö: ¾È¾ùE\9|ÚœbhDê&u]ÇyI¿ŒOݵVW_)æ¦ì9©xô“=©ªä<¸†ÉÑB‚ïäâN…’Ë« íæÆWÏ¿¶Ü˜¼xCå¸Ü–ù¶MÊtê{‚¿íj׊`äú¨z9Û+u‰{þ"Æ"œ%.´/˜èã(ýê\¿ü%n%s’îâ½!¿™WÊ8òGæbïŠÉ…bÙ¾cù‚LŸx᜸«Á›™þœÉ…ÒY¬§³ƒ·e÷`è¾ Ú3ZºõU$Ÿ°c‘[ÆÎôÌ—hÌòj¦?ï‹BdžvDÑ¥yáçæwM ¯˜›õé Îíy>ü‰ppTXûµgöOþ”"ñÈÌý‹ÝËDZ{ǤíùÖ%kv^çȼʯ#›PèÜžë_´Ä-wAØtâ´g\Òùq÷ª„Ð脲y‘—¦·±Ì Þ3šÕƒ4 >!ó8|/”\ æE7) ‘HJI·lCó\¿‚Åî%Ó3!—`ÞùjýQÒ­¸eâ9–ú«ï m‘ôßVÎoJ¦K’Û‘ã¢Þ q[V{ò§e¿FŸ—žÌ (›’rf¡{ö·Þe“ŠÛÑî}1=”·Ä-{±'{Fæ ©ÃcÒ~úÆ=SÉ6;Ýâ$x;ß1#· åc×”Ñb·ÌÅ^Â)yhPÆíœU¾ØµàK¤PÔ<Ï;w‰kî‚ÐS²YÁí¥ú:óSÛÁÈ  õ ¦ûêÃF˜?o9v›y%CïÍ‘'H Ü%4x×àO{þf#ÒÀ"C”üqÇ`¨MUë Þ'Åj{Ô ‹¹/ ¹‡ò“õzrXV/nÐ.0iŸ )4-ƒ¸ñ|hˆ PCm(û“çÿ¬»þ°êÏÝ%E»“ü|5©…`äïîûß¼qBŽô¾»Oôb!ÉzQRÛ{‹„Ð~ŽZ„ C¼ª‚‡,$M ð[P£ðé?Åü +­rƃ×"HHHý{¾_èx^ 5‹Æe¢¿ú뀆ÏkˆJ‡½@@RRR@@@RŸ ¤ð‡ ÂpåMÈî8tó5„¡Ë¡óÅ‚®¼‚ŒËy+€€€>â觺çsÔû¨ü”R¥ÔË™’ë ]w §Plü9?P µÐ“vhóMùnÐÇý„ס›o> HõJ §ï ßÞÊ¥^v@Ý=ЃVyõ_ª‡­H+^´Ëw+€€€>¦žµCo»> H‰{¡ý7 fü‰Q ½ ½î„Š*åÒÿ¢U!´=pC¾[ô1µó*_|&:|âÕAüz9ìó‰»Ð›.ä~ÉóÅ®…^u@?Éç]ú$£ßÞëH0    5!U'A6B¢HП áÕC‚&ä×~5Ãg§I†¤8KØ(ó_þ U‡v/Úí¤Éèj¤™‚fé úÐ-~r¾¬†Ó× ùü4 ë{ %G‘”°¢oÝaã}PŒ©íŠËÍ ÛyZØ{YØ{’ƒœ"ÊKê†c$…Œ‡— Q™­³›…{räÎ6„§Ÿ¦ÿ ¤¤ *(ɱòŽO91dñ÷Q1Iñû^ <ÈÚsÔ.èGzÓpk©8­ˆéD»-lú´ßn üôR~°@J¾!…s ‚Å@G?pg7ü¬Î¯ë¥½•¾½VÆî+ÑáÖÆžÛXÃrº¯bVhá(Á×R™9z:f‘‡%|yŒ¤ê!QÝoΖª¥gÑuxPåý1žêòw´ Ûúx`ææz¦ÙÅÍHðÕß]ŠÑþQ'YöO•?GÓCÄ× Ý±±!F ÍH”7ð´ÿ1â’&uC]}7†¨»w‹¡çø1æÎHýÇ'•ˆòÎÝ¢êê BŠHЈLÚO7#xÅž†„ Ð0œîÖ¿òu$“i/ʯ@¢kPÊ%þ4G>!ÅܾMߪ${W©…‡Q-±u¯S…ûC w'î~àb-…óøhúÎpƱ ¶†TI T´«:áÀïü½I{ñ›zó¶žÚP¼-œu:ÿŒ¾•p‘’ý5%;ÃJà#W¯ì<¿¡xg8í@êÁ—ý¬©“Ð_NØû[þ?‡æïŒÛöˆ[õ$Ž±#Œv4û¤XúÙàœ{ÀÞV´3ª´‘QÝ‹”ªy—µéXXÑŽpÆ‘¬ãÂÆ~H kžÆÑ÷¦{/m£ ¡;§âxâÁß“˜{2Ž¿ÔwdV /Úɯ¡U¢UÕ÷﯅‹àWí«Š^ã6õd•I<܉<>5Bù›~Ê8ü!xÍÛôÒÃáE;¢D°„eµÙ›OÀGÂé?gëàW¿ŒŠô×±L‹à¥Õ€á@JŽ#)ø`Yó¯”>Hõ?¬ÖuFDPŠo ›ÿâ)÷CJ"¸pƒbn|D"BG°âò8¢/ŸQ#w‚»Z—n]xYpážÕ;íT§t6) oUzz}d°žõ†m¿óªw·1wHÞ™ Øëâl¦A@ •˜k`ëî·5í諼ü0‚y@ÿtxB¨‰sNþˆ}ü$ÙÊ=q<Ž½™LvÛÛJ߻یÊ=[Â3!ºÆë6Ènz›¡oêèŨÊà‹ð¦6¶A™±Û®EEØ9shÈÓËkª5rcœðg7jn­ ¾7Q`â–%:™™ªGN«‚âãH•]ꎎò6ôÝQRÝ÷PÑÔ¾ÞÍFÏ)Ø=ewöù÷© îDçÔèÒ“!Þæ»áþa®²4±ñ,<G/£Rtqε.k# ÚóR8`l"\ôv½•‘¶ûf-ä;»¯´éî`H!HbŸ¸bEÝw^,ýu8N÷i¶ ÚDŸA=8d m-0ñ,¡Uˤ¾åV=wupMüé­ ¾+<—ÊþUÔ•V5šic½v"I‚º{6ú&á;^±ö )q…‘öf3 q„LRÉi1Xr9÷*TVw•¬ußÔ éMÝ~NäÐm/ÛòM\ó Ï‹á 1N?¥UByü$³°ÍŒÊnøíØcZUï‡'“l]ÛJĽ•6>q650Ë|TzžØA0òH?„`´c¿ÑÏ´2ξÉ–êÛŠ8=Qq>Ôâ&^M ±§ðÐf­8.6Ä8±¥`×ر>`OØÔêIÑuù‰ *½xÖgq@Çì¼³·)f®)gz²X‰Fa{ᦠ[zbC\´­Ê¸×º|mˆ–ôç"R‘îxOƯ‚³Gô¨‰G‘Lî±Z’‰of¥$!-’[Å­ {‹?dÔJrŠ²t\\–ež€@êß©:d ̤YFìàÔ~â”é¿”àìe2‰yªR[rL¼tù‚š¤ÇÜW®¯oå‘È Hã»{8jšÑé-èØ^=Y†àú.?;ó°­ô²¼;M:ÅØT®GÌ‚!•”i^-ºÙ£§·K,L¤ l¬ íWx•üü|Íí}"XyÁ:yÕÝÝÓÜ1À)š³õ¡ ¡º/‹M#„C•Òæç.DC»ŠN„w§˜\RÏÂmˆŽ°öˆv Ïpôpײqš ’Ý'lí\É®!® Iû[EÍÝq Q†N‘&ºú!?>¸`„@ÊÍÒ$å×Ò+`_1GrI.ƒý H)6ÖÓõÙÓ™–ådyVšèX˜Œë‡Ô‹~H±pwf`u­ÝSJ‘²I9Zz‡z˜ÏÙ;¸Y¸¬w‰/OØûJØ$É.ÌD u Œu@Rÿ¾H I6ÛànìźÃ·é¯¦û„U÷¬Ì<öˆK!xX˧û˜¯ÿ‘U'OBž.AñFæÁ›ãD'ã„'Kw˜ëâ}öAå'èãH2wøX›†Ã*Ç»I'Ðhe"]$’JJŽÄGÖ":yÐ@›èïKù¡2y¬Úœo‘e©šÚÉGé‚Íd3SÍ¿#ùáUïJŽ?HarMŒÌüövˆ¤k‘(¤ðþ©S¤Ò.@Ü},’úɘ#7éYóaHÁ¡ç›â#·ã²Rô ¨'%‰I‘X³äЂ #7»¡?ÏA )bÆ}8:bëèØ„”Ö¡~"®æ_€R²\­ÒOÕÿü ÜŸ#)WCOæîÞ|¼kxYm_Ùº‚‹½BØ‹­ÅGïÄçfZ‡ƒòŠ³¤€¤þkRÜšaÝMk¿míܱôQÃ-ª!qÃî®á¼™WÐ$ŽÛà®pœ]'áÕþîg¥ëθÇkHI»úÂy–°á0²Ï ~H]ÒÂ,ð¾Ç7­õ5„¯`Ê°ŽŸ!aaH½dÚ‚7Î<ùžWÓ‘˜§…Ïê‡T TÚpßÑç,|Ì¡Õtæï»J¯‚{ÇTÜdפ莎3˹Nß},qûN­DÐð.ØÇ‘ÌxRÚüaMêï ÅÙ™¡o“W q«ÞFÅ{¨‘8ì†ÞŒ²#YG^Ã5þîl¢ç´©-1!Ô8ùjYÝSw{›’[h.ºd ¤`ž–Ö\²6$„ì|·Ž{ñuÖÞ»ì:(‹›…÷.eTõðkžzÚh[—q®÷;‘LSn‰.CüêÛŽ/æ]aeÙÈ2z’ÂwþYÆÞ‡œºÞ¬G2¿àÖIDÏÝÌñveïòiÙ:Î{yÍ`÷4€”Ø! ÑÍÏCM7©¸Jˆ Ò ©BR¾› Ú–MÛ€;¯ Kïüìӽ̃ll(¾q~aαñ?w”lÿÑÊÎêïàlîš–rJ,¨—ER™ô<¯Ý(¤ž9è©QJQHÜe mrTÝv³³´ðˆr I HšâÍì&q~È=|̽˜¹Õ½±>úÑ p¸Ä9pÐXïSþ;Ý ln¶Çã“-mA]ry +;/û ª›Ÿuø´ê^Ω.v6$·(‡À77 m«2Ö5¨XXlD°wˆ,ôLà:R ÜŠ®ò¡Lz¾¥½ŸCP‚‹MÌ~&ŒWì†/솽§¯™gIV%ÄܶÕP›lÁʹ†; )ù¤zXg_Óϼaœ…ÿÐÊ‘¦BÕ½gœ}Ë©Ö’6‡[ÕŽx~ö-»F2ôÎá8Á¹ð–q¡[–æW/]3Ï¢7¢NÌ:÷¾;ÌÊnö…6N ’áÀ­î„oÒÞÊNƹ$ï¢ò㢸/4“°á ÏÀÒÊ®£[®$œ‹mh½a^|æsöÂçБsÞ°Ðô ~ßšRùiÆx/ë\+«Zzü=ó\u›SÙWÎ8ßέíaoeœëD>Bç[ÑÚZYp„\î³RÜW 켸oÒñYÙ#½wpA6ZqVÖ4¤,Ü–3¯™•]…y!8R—tÂÅnÎÅ·ð%xÒÏ­´ì¹6Nm/À‘>7 ~­˜yî £Ïs )ðî¾IÉ‘À»ûþj‚Šò‚µ,DÌË 7€¤¤¤¤†™ ÖÁê¨Ò›ÜFÐ@RRRRÃí¦÷¿ t€€€€€€€€€Ô_AJNoÓIR,9‡§Rà«ôõù@ª§zØÝ+º÷zÞuŠ¡_[åÒÿ [ñ´C¾[ô1ßÛ¡§Ÿ¤:Ä×hévh™¼é»íPdr³¾þQþœ¨E[ [­ß9ùnÐGù;‡PeRäÌœ.ŒàÓ=ÿÿ}$E«U²°YCÙð½¥ÃZ{þ8¶ÜFRÂÎ93]œîüä×Cï\H"|•òhàÁ‘IBœ^òÑ d#÷ô·ôýL7 FŒè/)&sõŸ|¢„o¿!ê® ~ô×µHý«#)žx¶GÀܤã+utægH!Õ=Í/JÍõ4&¡dŠIÕv—¢pXN÷ ßÏpvÑp>¯»Ê=Ï\O)ô†¼BªèŒŠaØœˆØ•î{ec8Š›RSaDâd˹i‘#ÙAÅÔ4 Ù£á[#U)ú'øZDú«´!z¤ ý?øœ?ÜYiUÒ¿J¹ u@Z¬¾«#ÿ~pràùÝÓ½BT}šeÅ–å¡g ûÊ,(­J€xPØ6ßœ´&ô‰ìȇz¶@êß ©^¶#º·¢Râ©ñªn§¤ƒÉs‡Ã ÃR çÞ2¢ù¢œ”§Ð˜HÿµN?ŒàÉ¤à‘¶wRxžªó zÃóرL±F#²÷®6Ô×Ò³Xá±e‰uNÚ ïýÔõÉêzxuc…nñZ0¤DÐtÏõª›”LM•ÂkJš¿µ¦ªë4 íF]Q€¯Å~>×ÍWÝÀDÀ¸ÆIW®À¸·ÀÁMC>BZå±k”tšÅÄòTøóœ¼ÔµõÔ(ü/Rw­0%kj”Ân êU¢Œ7ÑÐ7V'…OÏyÌCæW}G¦jµZ. ¼  è‘Aª‘¹Ekúuz»ŒžÂwóÍLT¼·­44ÿ:ãéˆÜSËÌÈFêÆþsRÂ'ŒK©Y¥ÎwôQÓ3Ò$ÎÌmLjޡz<&¶HÇ o”ôs(|µ˜€]ðÄ€¤þýÓ}²çç» a7Q-ȺUh<Ö a|Óú …§g¦~­ãæq%Ï'EóT£Ç#kR[Ôµ´¿ªE»³lªiSÞ%[“’NTflÔ\§±(ýå§Ü õ1!Å}º€ê¶Ê*è{ÛˆÖþ«Í#¾dÀH÷¤hárKŸÕ–¡‹Bk¥ ßÃ0qME“¸yÅ{•]öôÜ®A+,r1Ý'è™”¹Ì¿¹/»užûË·vÉS áØçÖ|—ðÕÁ #¯N Ο†dÓAc2,³ñ_IM›{h©ëÖQhb”H)ì´íHZþ—Á9+,½WQf§ÜGé#žV¼ÂÊo•Õú…áÕ \¸þ¶éAÙ+á#Öá b®öÇÔ<ÉØ”}JAÕèôiëWÎqó3ÑE+fõ§i¢ÂÄ(Æ ²Ç÷n›ÆÒ_|åµÂeïÖ“¯<ãV[ú®´I˜›ú¦Ï¸J‘wQÒ½žëº(ò¶ ‚‚®i~é‹cžÊ\徘ã°ÊÒg…]î—yÈî0˜}ëìESCóVYx/÷Ø2iNÇ ¯äE /¥IŠÅµ«IÑcYbFH}FÓ}¢Á’îµü°cE(=2,ß8ñWŸ¦ÿ—HJ"]“’±•7ø¦ðû¶8I›&ìûÛ+ìÛ^ôa/Ò‡"Òøƒì‡ê?g€K‚ÎÿäχÞØTõ‡Ú¤ç¸OJø®¢W›²I•Z® øÁûP¤W~ïk{ê2ÿsH^=£€¤À»û†ÍmïîûL46e³Šm…âPOD ÙTõ°Êvec¸ £€¤¤¤¤>þî{Å_ý©’åK€MHHHHHHHH‰!½†%—¢ƒn¾†0%òê¿LtèÊ+Èà œ·è#jÍ.¨öég©®hLj{ âÉ›`Ÿ߇î¶BÌ+òçü@±¯B7[¡}¿Êw+€€€>æè·í6ôËk0`À€¶&‘€> 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ý?¼ûÈ endstream endobj 782 0 obj << /Length 1867 /Filter /FlateDecode >> stream xÚµYYÛ6~ß_!ä¥2Ó¤M‚¤-Ð&îS´\‹¶…È’#QÙEÿ{‡Ò–8u½Á+jDÎ g¾9HÓ`ÐàÅÍÓéÍä¹H‚œä O‚é<iBâ(Ò(#Q.‚i¼ ßôm9“ZŽÆ<ÍÂ?:ÕâèE_j4f4|Œ„תR²Sø"'lô~úêæÙôæã ‰4`AÊyDRš³ÕÍÛ÷4(€þ* DäYpog­‚(ÉàYon~¿¡{Úæm /F )*ú²Ñ1 õRá`ÞTU3âqx_Ö $µ}¥fM§¿8Šê4Žî˪ÂÑ›ÔwªÀQ餬[õŽR^iÕn¹—u§•t›ù æyéwíFk©E}kmE­ÚE€ƒ×/ö­—d$a"H)%ìþœS0ro­¸Ç#c)‰³s,`² 4çŽ Ì¨†Pí˜2’ÊØ@Š!G© yšy¾­ æ'{—>-d$rHrFò +Õ‚  ®XãSÖ›ƒÁø‡/}yGcªuu˸x‚pò¼4.vﳦַ֪ä#GéÊâ–=•öS›9ëÒ8„eÙåþ8B…á 2v *ÎÆV>äQŽ–}>bqØ´ÙUÓ*øyÓ®¤.þ¹Ä¸sÐà¬gBfÑ·‡18&$¨zQÖª{ì"G) Âifö”Fð?Êk×#"ØpÂÛá)Ìbðwó[;ix òŠtqèG0€µ‰0†‰V dR@AâØ‹ €+wrGà6â4ÜTÍ)6¦UæßæÞ|+Ãÿâ:ELLÄV À[†¬g­KÐìVÕVHù±YA2*ïFÒ+åsú¢¯¤ËøÏ>ƒŸºœÝmï<ÀHå`Œ$A±Stt~0Ìýf™ÙlœbqœfKðƒ%wk5+ŸføŽøÊÂÖòðºÁ¾ïô#£±"üÕ!5;DjÊ»¦×(ñkÌ8“nåc9oúº0F0»E‹ãn—ªÝâ•E`p„9âõ€^ ÞbØh½¾LTMîËåZ¥$€–…‹‰¡L^ïTýs_Ë=o€d«YJr!†~È„âj]!ƒRof <+p–uDΡ$ê%%>–åÂÖиzÙô‹å-–”ÚÍ”Ý`%kÜÃ(Á&M|°sJ“"D¯jÏÒúËHQ­õ |çFàÜ7 ¤A9昲*u‰lÕ)·ì!âpÞ6+-mD~²U\ˆÄ²3t@áìÑ$fÔÌ¡¹€›µìpéj COv0ÐÕ©`Æ;H-ÎEKšÑ_®œ|Š“Ä60†®—R; ŸrÂl®´4\äuï¶JŸØ²%Lo&ˆÚN?ö}Í|›Ä}èê{Ð&f‹“€rua%õ~Ócx^ÒÒ@·Ih–^ÕÒDiNRh¾qO3óÍšš(‹Kœßq.&ß·j¡>ÿ0iÖºBôäºvãr[» XÄyò`ýF”0 ˜=?û,m‚ºT1'<Ï®•¯Ÿ?­<¨vb¾¨À÷pÂÛ5·H“·tœ¿ÿ;ùgò°ºØZÇNƒ~)£éÃÁŠS’¤ñá±ì\£ikàlÚVï/¤Céà]Z-Oyké{;ìxµ,ëÎ?ã îWwªíNœR÷“,ÿJ0ìŸH¥—²¨¥î}¨X?ñLí -)X…Cð&Ì!'/W"~jÀ' È!.“lÛ?x©²Ý·É\ :þ½¬ «îK:ß/KoA×W팼j Ûò©âv¿©a 4MÙ~ÐÆ­Ï8†sÙÓ 2+ÔÜ”/ÙWúÈnW SãNÕ]9lGÈ>WúßÄN= LÊðHY4Ú¶Ë{B¥GK{P9]3Š¸t\^êî¶F­=‚·:·›ÃÛd3SkíÁæN;5º«‚¾ÄWzÙÊœ†ºÿ·ó/ütdÇ„ 4ûÚß³Èí6Ýw£*†Çx| ÍND߀y]ôòëWG;]RƒXFIš‰«j‹bÃéölV1’kJÐ@Ê°!߇©@,e$ƒcªuX f¨H{gÓ¹[{‹h)µ‹ËO»ŽžB{ën%º#E£<ìÞÍ°VçH÷n<Åqå8Z̘é+ùÁ-l<‡/Ý&nÍØBÇÞ!Ì1äñÒ¨¯Ý­”tÊéûfÇ«»®æ^ŒŽcŒqžÃE%—ñ”ðè .£<„ÞÕ§áë ÖxeöPj. *÷e§mçát”QsÀ2_{ÏVï$ V> stream xÚì}\›M¶w×îîÝ»òÝÝ»w}ß}w·oqIˆ$¸»;¥x¶Ô¨»P*@ÚR£B h–Ò*¸»»'!2ßc IH íëws~•'óÌ3>ÿ9çÌ93¨IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMjR“šÔ¤&5©IMß:‰±ÿÄâïJQäC$åšy) «(·X±F²ßŠgžTÔXé Ù@ɳx¾”>ª®ßÖž·2­÷ÉTÙìò½£P¤Ù³;zÞòË %ø ½øõÌšhæOLYüÕš#ÁË¢nüªªS?­[ø‰Õè©xäggB¢Rôp$#cÇó/:7íÆ^x®S6î ã¢?ªÁÚîýý´7K -­E4sׄ³÷¤­ºÃÓfÑBýœž™q ýiÇø×?8mðï›~¡£§§/C8ÇeªJ8P}^ßÀ`GN—4d¬ò¡6Ó~šÌ%èȧ¤§g}¸rä^Œ–¶.òk榦õ€èk’¹*ô²&÷‚›F$õ ¨V>wj&¡ð}Úúr ¢«¥UÙ/¯ºa¸ˆð°M,–Ûý˜kÓ…u™ ¿ÐAëk``€ÖrÑBê›iP_pTW!)ÍEñ÷Gàúèêéáð„pzÚ8ºÕž3÷Ñ‚m°7]¤Ëy7<3‘‹–‘mSËe ŸCÑÒ5¨æKùƒ}$Sßiš¢Œ-Zú„” ¾4¤ëú¿ È#ÏOO_[~<Ò¬„b.`€uª¾ž®ZÝ”†©¯jÄâÖD–kíÈ×1JZ™Ó{@Šë?C®ˆïâõ䇭®®ËɦÞÌ@h8Ã]&óNGÏi\ô¥À"aÉöEfÛçm±X)ú˯пëY”e)(gä~ñc˜ÚGž ºs\“Û'+Òñ ÕãPx§†aF—lÌ!oü¢³uðSËÃÝ8‚ù…¼* äùX“œÖ]Fîrq4e/?ò@¦¶U¦Gª¾dƒ®:øÔž]°k3h&®DCNÛ„mÁñê\’•;‚6ùT]f¯êx‘Nr QZu¥-=W—ÉótJ ;9ØQÑ:4çú8êD6¼×(l|p$öÎd{î!C³8îzò‘Ò^¥o¤Ú† 玛ŒŒûe—Q“J• h,J6¶R–/”BÝS63UÇkãÉçšá´·yÚ¹Ú›9¬8)m£—q •ÒºˆG)dÎæNÇßHS¨Ê9ÂvXò!#ÿåµ]ÆfNº_Ò4Ý·÷Ó—lC ¶„JÛýnrŽÏ£h OU¥¬²Иƒi‘"ŸŒÐ›E¼[=¨¤çÄó ±RæC.Þ³»€ëË©ë‹¢¡‡Tœé¸êú¶ß;NöYõex¸ËøÃGWx)6^ÑÕ7j˜ÃhseÅ}GA ‘¾ºæR /;r¨d2ÙÔ)ôyã0ú­§©FÊõœ(O[&ê±{X W€d/C N§3V ^ïÁX"Gf»Üy³&=W=zfd$Äš±™–Ýw=ò…ïqÐ">›#MÙÎGa(éá!áªÑ†×cb@>ð†+ÃT^W‰Ù¤bJŒ ÓÑÄ-†œh‘¤+¹F¤_1Õ²’¢Mrã‡6à`m:ÃbÓùG»m·Ñ¼dц¦Çlâ©^QòÎ’‚”÷…wýð*:‰D4"x­8Ø‹”¼$É‚[pjs”ǘÂvyZ·ÿ1§9%TJ‹먱ábÒìF ì-M8¾q¯«[øb¥Zg¢m\/åY—eö‘°{Æm‚ÝVµ>ñƒFH.à¶SÉ´ç²Ý7=Zà’;'Drhcå¯lÎÁh³ãe¿lPš«®ëÑZm<¬Ï=/¦é&½FÓ—Eˆªì2uÞF i–½ÓX>mvxD%v£ž)G«¥€6Û^̱hðÂi‹Ž—ð•¾ë~ÿÀË‚Í Ûùî[„ï|üCÇö÷×<íLiª¡°¥Ì¿®»Þ)‘å‹k¥}²é ?3²;€ùÙ5$¿½Ï·Fxš0Èáû‡ûkÖ9ÓHÄ -çÐN©Ï¿èÀ¡‘ÉD–µ÷ƒ²$ŒŸ±+oDà8—½¿ù™†=„ž¼ÁR]-ÍŽq(UþjÏðAò§4mð¦=|•®½‘@öZñ%Ù©GÇ<­=¶ ÏÁv&z6;¡‡{Gœè¦ÞØ h»HÔe¾Aª_Ebp†…pó„z°É^;Ñ(7—3™‘wäxQÇ€‰bÿrÓ•g_ÀHÝYdH0­‚‘G‘‚aA+ £å·ôèΣò¥:¿É…aævëNªSB¹pfŽtÚh¦ÖMŽHˆÇmõ@Ðf¬é9‘i>!Ë#îÔR .âáŠ6G¾ßn§“ô^Å‹¦©u},1´ÑÅ)¡)ž`.´áÄAÈâÊÔÍ*VàmhúŒòþ©™„ÆÆ„2MÚÀËGþVsËHôùlœŸç–4è¡òŠ/ÎêAÆ\ù5úîp›w—]£sœád¡„ÇŸµ;T,6hÎüŽâ ;K‚!3ñn)—?­gm°Ç-úâ‰M1éí"I*ڼʟi’qÞŒzd´žE¦‡ÚSkÖ9¥hòô•¥± ±m^ ÈpµíŽúøoyocsâqu×ãDœU¨@‘·¾æ­cjï(Tìmɸ\Úùñ¼Í—Т‰f•T;ÄŸÍÛÄç6NŒÍT|júƒÐfª–cľNž‘Çt-JÄ» >ÓÓÇ{‡VÒ…©›]Å{yi§YÐ:¬›:Ó „Ñ™–„ª%XgÆÜU„ÕëÚ>G¦-&!ºYšèYn «­¾ÁÙv šî1¦Z^LÜžG6 †¦Vçí( -ˆ‹|çÎ0âCòoÝÌšH•UX†Úp'dÇ­HüÕ¢ oCsË«i4×Îôh ‹0Úvt ;ƒvêeNVûîKÊ5æ#¯…C¨;ýHÖ{ŒÃ¨¿Ng:seÙi~„6epÿtXtßbÌH×`äq¤!}ÃAw\J«"‹ÖP˜înN¡Ñht5ã ÊÐtÚëáhT9"ã ÎÖƒþª{Ž¥@¤0áD‰Ž†nIõ(ÚÈz_š¾Ý5ê<#ó),ˆ-¬“¢»>ž&›4Ù(.éõÜhuwoÖZMÓ5|y´1&Sä I7n˜~Ú #€;2ÐÞÞñêÄJJÈm.û°=Ehû7žù‚Ÿé~K#ZîܾÏ÷-qÛsu~&ü/÷ÒŽ0=jàè,†øå­¶l2ÔØLcÓܶ)m¼(r-BÅ;Ê|ôâ˜+Áj*àœ2´9©”!+hB‚6lg/„|ÜhTŠµßnô+màõêL4Ýg[®,Ú@U+ËÒg{!å7Ÿ 0ôKý´q ==Ô${ºÎBšl™)$§w?mP¹F$èîìèêks¥i?jœϵpÖ’ÉèB»ß¦ÞSµMÊà:ˆo„q¢oVÉ%#˜4aÒ^wa|ãµ½¶þë±l°3_Ó_°×X›Ï 8 òÙgm2=.^_37°½w½ ¹æLRíà´,ˆxC,:¥bº°k{l‚v—ÕÛð{Þ‘Ùu<0ƒ6\ˆ¡¬¹ÙÈ¢Ðûx"E´ù(½ ‚6pzr):&OÞ“¬Ü¾ŒÞbÞf~½ ü²¿˜ªE¹Ñ¡€6ðó»««Ù®kJ6šch#ª1×&^x]ó¥÷åë¼lWžËÿ$´sãמ%9¾Î:NûÒz›Ê{Ç.aRµ·I{´é›bí;Ýy`wP Ïoˆø#,¥~ðÃÐFº­<5ÚX|¯o1ô[ÍH±…ChÛN¼<«Aœm¾n½ÍÕµlÇHŒ ]æÀÁô6R´:âÍa}#·NTÌnÍ%P˜(†z˜p–D?¼½Îœî^nÅœncëÑPQ$Ø‚±!½ù¾‘¥m=£ ‡/î…¿˜¬¹£O¶‘ë×®GF:Œ»µ“‚î\×ävè+'†îÝŠ‘¹÷¤Úóàðìó9»Õô"Øžâ¹õ–dO C›Ž—Ž ÝõRZ9´™½'TîIÍð6=<ɱraظ͵'%IJ5Úð70ô–ÞG†¤°u‰#‹â¿KÚ :eAœ-ÖÏlý·sôowI&ÓkŽ‚·B»l‚êC#›Ò~ÐøàhìIQO±1_?":¢zOêdŒ¥ûÆ+’­×,<éY뤴‚ÊÑFõž”¬–øå…5t›pI .³p,˜ ƒdJmÞœßJöY'Û´SÏ÷jQ#&´á8†ˆiˆ oÓñ;g;v¸ìžÔ„j³•hS“DsÆÐæÖ¶ Qÿ!´Š =S†6°R!˜BŽócŸ(QLHȵaÒž¶aºœ¹Ð&Šß~Ç/d¿äËf¶6­DÞ´¡»Bƒ¢íqlXo#L¼yóŽ/+A¥{R’ y´RâöU;±˜f–Ö9Ùñ'ÇA£$k¯©cìÌfñí“[Ø,¦£ƒ ÓÄ1%“7B]©ûq³w°6e°\"j¹ ½*8f­a@ Ùtë¹ç¨Õä/_œW°·Ñ˜±·)ÏN r1_¤¡¥£¥E5sNH»/coc±+ó5œ‹ Ë\SûD- Uø?3Q{Û-ÒÑ×7!M-VJ{›s8ò2ÁÌfRoC›À±Eímˆº°m‚LJúzFáÒqÙü蔎™§rIªäœ9IÇÑÉÙÎ'º«¥ÐÄPßk㩺tg²wÖ:'ÿ¤À•în¿ÞCÁáËû„bb7G”Ü ûÍ)xF!‘pL»#·«{Gmù1Ð×=[ÚYrvµ–qÈÚ°HªÅ‰ÑZìˆ~ ºðG*qúº2hS_pLÏ@!)·È$ˆóÕÓ/ê“Ù\ZÌÐò:P †ímLÝ/—·ù–¡Cc­±!í½ü˜áû’ÿ~(g âÁ]™¼ô4¿H}1¦ÜÞær¼µï¡™™0]mCÔ¡£öf<}}…ñ §G,žaYyJxÉS6£:WxYÌœŽ?í>´Üшd^\[ôWMó!I,/ké<ª½µ’Æ0ˆgu¢(͇zµý‘±ÕÄ3>}^áo{€I”GÌÿ²,âm„‡âÃit†­­5iº=ù‚þå>T¶•“ƒó›IšhrJ´5!{Rò™ ÞÃ#6Q2}¤oÄX!Wue®CÄ—¶ š$’%Vj=êJ9Ÿß­j8+3¸•×Û¸œQ] 짰7×)©sfN´-ñlëSYÓÔµ¼Ê™8·-±2ëÖy g爩h•¤\a"[¡‚mŸ3_ÚÈ˪ñÁ‘·§æǦYÖU@ÞrD¡õçm ÔXÁþD,Va©>¤ÀsK+-Ã\E«,Ãü%Q´B–ÈôH«ÙÊ÷;®H#bùÒ*ÁÊWrDbÊ4]vI“®ªMæ-3ËŽÚt~Ú·ڤ̿a6Òt÷Ý0øöHÀžM#càÛ&w´«ù-HÑ3ùUù>ô7–<­›ÿçˆ;1ª¤Ç&¿i}{×ÀÈ¢E¬ ·0;m«=·ËÀ'õñÈÛƒ†zf­½ƒ»#ì7Ÿûþvb”Iza×'¢Mîr’÷÷ î/S½LfÃ6ø[/XÍýl3«+ecà»àgõݦSígw"Ùc×·^°ë‡–°­ÝòÚ„ª9(˜hI~<Ǯܬmµ\ÓÝœ~9ñF›#ïD£­T³q"/<¨ë¼e–$åG3³twsssuaàômÂöò?²žìÚV+¤<˜›93íU/ hÛvªÇšÔôéh“J¥Ó(ÑéD†ãµ¢zWÎzÒí—ÊŒ6µÆd£º!UhÓ`­m˜Ýà'„\O&ý\YŸ”·iBŸýŽt_äÈO@˜“²qÅ$Æpe'¬¦ÙºnŽß€’³ sùÍ2½(Ń|­ 9ºÌuûÅ× Œˆ$u }ïkØìɤ&CØtïÀJ»Õ‡%E'¸™f¼“…j´Q“š¾¼$%ù=ÌÒ9˜ÝÊ-i8ö&¾üª8HÆ9É€¸aDòö×0Ú¼KŠÅˆFŒðx¢‘ã¡Ú1¯…M#UŒ £Ù‡6;m©&Ö—z²l7¡Nû÷­²Y¶GÖx 9Kª%æ¶]£üù€çN –M)Z3Hõ6Ò31¬™ø¢&Þ½ý+íÖÌ Í!7sßô7j´Q“š¾B½ ô·ãÑ!mšg/:§;LèĤÂ0£%žòdS£¯Á^Œ›ÃÍ÷@sŠ(³ Q¯·ÃúØe.¤ƒYõ2ö[Ppo:ù3hƒcž@ 8±ÔÁà£%©Å@<É"F^„= û$h[ψ<õeõB©ÞA±ˆoÇ¢d¬5^uavkÌh‰1uN¿9Í°¨i²ûÎ>m›Xe’”]—z ©IM_Ú s,’ã"9’ºãÅ%²ž¾_dìî »6¯u0Æûn9+Dβj¼»_Ûˆ³y×þ¸(o¼q m»ˆÓ¶lÊyØmó°?ÿ€ÖÞÙ0IxýÙhÃÖ'¬Ù{ä„ÎäµO¿PÔƒ±2‘”Ó8 ¡ß&wºSÔæY·wÆjëY5ŽÈñ6pŠ])ÃÌWݳí4—úY.=•œÑ¡}Ûü¬IV1''îñ8'š÷ª=÷²ïì[Œ³]>kÅkÍ4që¦e—«’šÔ4/‰¦Ï$' ódYê,9zE$ã¡Àë©9š˜Ú#’ ·ïáÍŒäää3ié¯k{$x¿éªÈ‡RK˸ƒº/Öe_L¾#¯Uƒ©ÊÛ §C‘z8eH*œÀ'@Þ?~ìXÅÚt¥&&””iZ^‡°=çðÙèeù“³×ž¶£Ù7<¼xøRzoþíŒ'N¤fd Š°"¿~˜r§¨ û1~Ÿ€sï+±Ë+¾›™ŒäÑÉS)ŠÐÓ)Q—[nîÍôã'Ó³ò„ˆ¬}~+11¹°™§HjR“šfpK.gBM–^­T7ˆšÔ¤¦¯º^pâà-ì£Æ„jW55©IM_;oÔ^±jR“šÔ¤&5ý_^è•Ü½.}3LJsÝûœÃ¼Çw¨¾¶VÅGŠ™+?aRüa<Ï—a~šHáÄKñ||×7á78H΂¯ð²ƒéS›NÍ|þŸ¢²û ˆñg<µûžÀ{­ðÍŒÖÿt¼¬ª¿ðiOT¸>7ßüÍBkþå?½Œü÷My@Ì&Œ¨ cDÆtNŸÈŒˆ;d6ƒŽ® aSñš:Úš:¦v§Û¬foGˆñ¶«ï€°þ/\¶œï’p)õïÛs²ÉÊ%^vx2ÃÖÖ†ˆÇY9‡ ÉŽmQ”™®6ÕsäËŒWu÷ ¹ÅI¹Ž¾Þ À>‡…›ž¨<¦²ä?A‡ä°êîš ò¾k ßØ08µiËê·Õ\H·›bªËOnžð cÿÛh½ò/»nýÝÀ}âãË3–ù…õ …À¶«‹»Ôfßc*˜À¶ ­F„Øfp_N2Åü"¦dÎIÎ%–cäÖí¹— M,sѶ§0Ú„Ñh;Jfü¨§{ßZ¼Çœµ„YXú¬kèÇ~Vå_¢êd¾éRàš.Ç2C‘ïÙÚäòh³ÒxÑî<mø[ÌB’ ¤/2w-"¤‰LÆ{íJŠ$ÅÝìQ±.‹^_?Û9%˜—oK gE_l@’è±Ð·í 1ØèP¥þ m™ʺ8Ùµ´„›JZLnÝ—iêY\“Xù·Jy’q;ûI¥ýƒü®¹äÉX|[1tª›Da¶L ˜c¹”»n/"úL*f§œ…“ý~î<4kÚŠÈ +|eðÔŽ¸ƒÐ¼{|fCNàö¿ÕÔÐèš»hãþ2sc*enmqcCA1rSw­ Òfl¦•gÔË–±–¼Óx«`4ý¢x»Ïþi…úM´¿ºˆgˆyµ ÿVÖ+@n-<¾!ŒB7æ0i>+ö Àö¦ântŽ)BÝx4 Jd¹+“B¡››[]lƒºlòȆP*•i ZyżïæKÐæJ|ˆ+Û„F`Ú]‰Ü…$A›éçkÿ@ÝãiåC_†1”2™¼rO|ÞQ×m Zà‹{‡¬ÌLpšZá[ÓQŽ·ñùwsº©¹…aw6UÀï­ˆr5%›;y?¿¡'ƒ6寵¦Ðh¦–VK/¿S­;b¼ÈP½Xt˜Ý<‘J±ZÔh¥…ÎâÓÍ=cʆ‘;â&[wF{Q™lc:=lK2:†ü¬´Ž%¥°ðza[ÓÐÇ$øÑ~kûçøröѺÜÅÆlss2ÙôÀUì<¥âã挕<9TJô]h0{jþfwŽú,€¹ÐÆÖç YRðù-ã²¼MËr Â?·^ÃéÙÔ §IT^ˆ02‹`hÓ%­q!꧔LÊ}[¶ÅvYòMMÖñØýÅG½õC“æàm¶¿œ¹€^4Rmm@9dçq°J,š|^P8{­ƒ«;|¢±+“®­vb­¾ åÃX˜Št(Ž ö¯ì›Ü|¼¶3ÊVö—öôÚ€¾~p ÚnEŒ6é^t ¥‘ˆZîìÖd„LÊð6ÓÅ[YÀ‡Šoæ|±GrwúºHÿö»oëéâ—ŸBCûÌé†/Z&AÿS’#½ˆ[nBÔ+ë…{ùø ³É¥x>Æ4ç“ ãŤ?î„kz8ÆÎ7þ"úêÆJ+bpºª(KŽe.=†>w?Þå½¾%m›¿Õâ«–Ȳ?»Gùq8ûÐ2­ ãw•bÙÞ(ëõ' ÀT G›˜Z†Ž†^ºÖù×ðØ*Ëð¦3íú$cöýó§-C5ªÌƒ6P Þ\¦mº~RÚ<Ú¾ÄrÓY¾B›KOªb¬ ÷I¼5R´1¦=iFçòm(«õæ@º¹•­… žÄð]žŒÎÿ'ñÞÔè³óƒÍ£H§“’+a´y¨mPç¯Þw›¢}íl¬èd#Š™ÿ»^ì:ëw}ÈQ—Ðo1³[ûD,õ^qñðôò‚V3š½«‡———sО9mˆEinFKî÷}XoöZS6<ï—Aþ&½O'$HXoºÿt °Æ¥À.ìcŠwþѨM_@s$–f¡«¬8BXt¨óMï}LѶ‚ʱÝèµî\ÿà—/á¬Fãµz%ýËjª.õêÕƒ„X²ß&m6{$±Û¬4 ²ú” MRÅ&âxOÿàO2ã IÊÐe@æöÔìÊ¡‰k#¶ñ'Fr ÅZ°äCkÐh€Ñ¢3 ê·œñÖuJ–oHž“ž ¥a/ü¢Œ&,¦h$†3íV¡%ì¼½GîZX×=2>)i™^¼fVí8’ûhGåeÙ{ ¾C„uøæ;4ÑÖûËi˜×p‡>®p´¿¼BµvEïŠOZ陟€T–îmêrX¤Æ‘DˆÂ]Ø»o½ÎUD›´ØïýWDÒP6•F§)jf¹ÚP‹Z± ˜î$ØÏ6Û$÷¼_Øìäµì–Ÿ´¤„kXlËi9°©! € ÉîĈ{’„9Úäû#²³O°‚µhOþøl¡>ûp4ÙÌ­†« ËÚÅ=!/w{†©%_ªjçm^MÈÖQÞ2ªó‰šOE›±C\BµTàêw7\t©”]‹°ßZ*h;ÇŠ}z¯°¢ÁØKCco…©æhˆc0YR¢éÕ0nMœÝAg0hTjøl¡ ÚÀÒPÑAHjÛ}2#'ïɵ]K)þ›0I*Xª%òÅ-:Ó¤màeXÉd2!‰;`ó•imˆ¾R½ƒõ~åð­=ËÉtÆL±ŒY‘×Ë¡ym£ ƒšËèãh]GUhÓl¡iøxÛ[O•±¸fÕšèŽ7w©Bˆ÷…‰®NfÈèm®¯òØû@n·]ð5 ¸)ù5`¨³±hæ ª`kdvw(+ý‚@$£y¯‹3­‡D°ö $=‡–1î8BSã=~F¤£5³™a‚íe?÷CZ8{1Áë\Ó§¢ÍôvS½èÇ£¨¯b/2z2 F› ˜‘ÅÍ—B-6áAsÞ!$AaÓ(œüE¢ ç ±HÈtbÑ/UôBs[‚6Ü•4£µ…ØeÉ™x²¿„·qH@^‹Å"Üý!¥hƒ%ÍçMÙË©†$)E´©,9µÁ8j÷¬øC¼M6’jœõTò6£¾„E%1Eƒ÷©8³žéyTÄÁtýuZ„Œ8i<žå´/EdÀLÇ›Q“«Æ×ùš%?„O6èz}jí¦DRS£Í§ò6]àX˜±ƒäõ6Ý· Zô'ˆ·ü|$Ž7-£%¾½ÇÓÚo«\ç~9´Áv²RÌ=¥ž·wÑ-Ï>ÅÔ>éÛ‚ µXerƒŒ_¾O_-…†w™ëIlç×=È,õÇXš-Þ §Çí7ÕÃûm¿,ýðÒκĈ¸™¸,‘M³13”f½C ¨…ìæè=ï9Üx¼»&-ý&vÅm~Vú“*i¡Öw¿UÜ·òF?Êå)^þ>m@MÖ¦U(úºðØ2¼û&$Õ^S2ËI­‚EˆÝ–^‘îëî s}"÷Ñ£1ÄÁöúž@›Ðíè·u—ט.9 Då¶4—JI³y³é—+ûÀX®ÑæÈiÎÂ}f~‘«ÑyU!¶ ’Ûzm¼éj"­4ÞØ¡m)P¢·iq¦ÚKxŒ(G“ã95ÊЦ R4I7QùcÂÇÅæUÜ>G—›ú®Fï4äÙÓ©¨Þf¨îUÚõ)Ú\m‚3H\éâ±»ÙùT0ÇxíUÃ;uc蚤\ôyôÕ>%;ƒl}¶¥£EÇ;¬¹/–E4rQ<#ú¬5Á¤‡^CÞfªmt¨ÃáõÁ6grÛf¡èuîý†i5ª¨¢wwv²vÈHý¾ ¢G4<®.8hJö¤ªŸ^´aˆD‚mÐú¦q8ÌÛRëtìy CKh ƒKÄ2{RÐF÷¤ø$œNA3¦=¹¾ÓÄaÅ=´‰0øýºmx¾ººkó»dV¥©xK ³èt‘dÛôÍ£K~¶¬…_hhh…o:Ñ€2r·P‹º9$B-¢%B>¾¼“âlJÖÑÑÖ'±·%^æc(¨=J0ÐÃáqúxê²m‰ÍC"Ád³¾®Ö»Þ™Óµ ÿãÍzºÚ•ƒ<å{R|}va!Ñýu-ÌB7, ý^<ÞF!³ZfmšpûßH=“ —¿ ¶0´W<…¹Œenº;¯Ô#zæéÛÉ›˜4:“NõˆÚÞ8ÄGs½è©¥­m‰ÞÿôðòÏ2«PÉÞ“ú Û“Œžß³œD$2hdç%›G•{îY6™FgPèÆ[N݆'½`»Ÿ‰¦~‰Ög¦“eâ³òÀÈp3E×:lWU’9.üÁî?¶1ÌqË­FÞÉ. mƒ¦ Áô³¸ßSã¡€æâL73*•Î¤Ðq‡¯Â•ë¼þ{ G©”æjß~ß‹H7w½­è4“B7KÊ*¡‡ ôW/sçè¨Öîa5ùkþÎÚ#‚w%¶j; Jrñˤ¥Z:[ïÑ@âÆÅPN =rGê¸P¬ÊÌT<Ú²c©'™LaЩÞËßö ‡Àq»¬ $’Èt*ÙoUBözÇî6Ìì’‹F)†ZôuY3 Jkq”‡Ê`’ÈŒí)QLy›fOòÎäÍó1øË¡§cjT™Ûa¾ûßÅs|(kp#—˜üMñJÍg›((³#Uqa“2C”}¾ì·*TÚZ|Ø͉b äQüA7ŠÊßøpÃm—X¬Ä÷°ƒñ_¬*™Ùí&I®qÄJ¬n€ Ãev#bÕWeÍQáùm‰Åò]>‡…°D§´¼U!ËÁÜnâ/io3{pÎÎkÎv“:W|r]ZWþ]Ðpß0ŒlkÆ¿}£8ÿÉ&<µdJÉXr6ÎQïeÌK“5Nß©žÏbbŒêëêgQÝ8WøM–öÜñS|uŸý;áM×ãã‹we| “u0ìÀ½vµ·Ï7AõçÜ=}üÈÛ­ nBÝ6jR“šþ/¯y³…r5)ÓQ|ìJ¬ÔGxnò¹ òU³b±Xüõ¤ü•Íï9¤ ñ˜í='£¶‘Wà¨T㈕þT2R¿E%Uêĸ¿‚?\….þ8D’׊ÎÊîû7`ÆêžR(tˆþiàiC¼YÒ÷ ‰T]pg,¾£Pù×',H!ðÞb÷åسù ÐoBŠN^í—½à6ÌsÅì]s Ýß@{6 ήø¸oªSþhøí HðL_~þYÓÇ~Åk}é™":ì­‹Ï›OWÑ=Ï7Ñ+<ÁbùI™fdýZd²ñ~2Á1TÞàbI!àˆTÞÏâØœ~…mbž\áç³']5ŽǾ‡²Ê®ñÎ*¶µð`j?iû–Ô`)`Á .íŸ_Ù#Að‡à‡løñóÃoñÈ"øÏ€?­†Ÿm~üLI0ÄZ üô'pdèÏÿüà ûd!øK –ì×üŽ°ïÁ÷‘¯|›ÉrÂúÝËŽ| F±êeK¬w«.z0Cï(e' :bŸVÔæô½ûH=±òM1±²ÄÚØÌÏË˃x~ïõY%’ìPìµ7¾ßÆá§,5ÖÏ]Õµ+iE÷d±ªOÚžÕæÞTšõUWqš]à)ù7SQdJ9oöY‡?Â× ª¿¯-ñXN·d LXP ë izp’ä¼IçiF‰8|g|#ª}–nˆ' À&'cüö¢*8þVO »™BùrNö¾¤ÓaãŽAñ R/lññõs3*rý>kàÝq†§?F¿ŸÁ!Ópˆ%r¹ó?Šȃ ÄÄTþëGà/È vnü  ›vŸÃqtÁ«·àíkaÿü" Ž¶Já×kdöG8|wö÷‘)¹ãà`Gg±ƒûÀCPzc¯ƒèâîΠУ÷eAÍçkøkˆùo¸ÚP_ïdù ’@Ý¿ô ¹0Ú0_ q°¶·· P9'ïÃW^–$ZQBT%Æ0Yt'÷U'!8ÞæE6¶tq²¥p®”Â)ÖÝ=ºáŒò6šÞˆ·´ÅùÚÓ86Îv4+¯œ¸?žœßkjLwrq1¦’—nJC§fVâ&ËÍÍ‘F³:– -мh_k2ÉØÃÃ÷™üq-^–z!ÞFÔ·%Ø•bbåâhM1sɪVÉ„lÂ/‰KòðYµÄŸhæþ´.C|~ÕÖS4)4fÕÖ…ÓX¦î®v,¶]Ê#xã³d_Nwp÷Úxí%©Šô²¥›;¸ØšZyEÔŒòUŽüšÔ?メwi”˜»öÆLö²[PðÓ ÛØ4¢¥9‡nã÷¤ ¶ï(Úô/—m³È>½Ñ˜F²03aÚ=€§ƒ°5/ÀÞ„ 5¡¹±ãâu(Ãêj¦Ÿx(! $22ÈdáûvTb2é¶Îî«ÏÀvPíÏR8dgww*{±©ëyò¹‘ã£K£–-ó·¥ÚûoƒXÏ‘·÷l¬ †· ‰‰Û( ÿü´*žèþ©dhXô½º˜Ý…І¬ëS]|^ß8P²C¨m† דˆ®#"Y©JTõ¦bR –Aar´ƒyLÒì)&˜ì>qæv2NŸ@ü5…ë¿÷I“¿K°>ž¡ÚÑ@û÷ðÃO~®Inyzüa ©Çr)Òzþi°üâ(´à­àg\üäw`×cìôµ€€i°ù%(Œ‚ßBãMç×@+é(†C²0´ù‚ ~²ü‘Žñ6³Ñ†?~eñ{À—YÅ#CÁù3h‘·œlÜ•ï§Ü˜ ¿¾l,ái1´i}¨¯göcf‡í ³*ÆN®sZ¾‰©»p³÷¦›òá¾.?§k¿ám¼èTF3²ù×÷ä°&É“oN;±£áÞYéfšZÐ =t>¿DqZŒåÝtgùŽ°9Åh_y zæ€ÐÆ”\P?^~fÉRìJÊÑ·ç×.€oÇ#jæaØ0¿6¾/â¿;n@öê@¼›¦; ˆf?4D3qA¼Y+Wùòó¾æ{Çh¾«Ñ~Mæʽ٪úlÿrsSßµ˜pt)Tß|4v/·4÷ߌvÝ^J0[Žnw•\Ô¥b>ÔþÆ]øB+p4Ú"p+v½ï³}8—£*÷bë.|Áˆ€ÏoÐiV¨«˜¨îŠ>Î¥:oÅ1—M‰ÁdOkEc—B +Sô Þè«ÏZG0]5I¸}sÆ4Ê•U¦&a™Púþ.&Žë1‡Ó»±t«¯ ‡eÎœ³E­pÐà;².ã6S‡<Œu¯” ‚Á纺„ø˜|íe¦³¶§}s-Ö!™þ`ºª¼lœ/V0¶‚ÑFÇjˆ3KÍüvd«âm†ÑhËsU5 „6A ·¶û³Ý×(ç4ä8f;kÊZå­yÛÓ1<¹^ ¯‚Ÿý,ø€¢ôÁá¿ÔÕMà°'ü¼òèÏF™ß%ëÀî³ -ü3ðœø&Âà ƒk~^÷VÁ¼û¿è4," ‰0´ùs$8éÇ?T¡múî!ÒÖålŒ6ÿ„™Áq ×}¯U|-Ï/²BfЦt°äüãÅë¥uÞía~éeÇ­}ÖKB?3ü©9ƒƒ&´À1ò¯݉ 'Óñ°d6uØhêÝÀÐ9>ÅôTn-Ì÷6PŒhIYùµÍB%Š6cÃÏS æ—7¶Í82ĹP|ãßUÖLaù\ w²Þv¡­©¡¾¾¾©¡ÜLj|Â»î œAÀìF´é¨¸C0b¥Ü{V×Ò%R-4Áh³Ôdõ‘|ɱQ¯8z»ì^ÊYŸX€šï·¡„Ün—´RŸ‹¶AZ;¼rù²·ª¡¹9ä…Ó¸ ñSSEtf+o>´¹5#Z°ÜýË,מ³­gÑÁ¶;.ÉÇlµÀé¾ľ¨½Fg9A™û;Ñ.¶¢¡å^¦ÁW §'NÊSøÓÚ‡'i>-Mˆ¡JCÓÎ —e§‚á"-¼mŸ$÷`WÚ¹§04½¼¼ÂÞÿØ\ A˜îK5b*G›tŠÕžÕhH%8ú‡ÒÉ&EÝ‚OTŒ¶gÀóô_ØOâ_àŸyàÜøa“į¦4õ€>mþÇ d.„n=.^ǶÁÏ)óËljfà?~…‰ÆÚü¯îågÿˆEJЦÁCÿkÊË¿•Å~þkøÁÁÀ÷ØJkÚ å&o°‰Ú)mËÔÅÎIy`²ÈˆE²¤˜BãÖÏŒ\1 ¶†ÐNcz›ÅYRaoÃEimJÐÖôÔnˆô±µäèiS¯—v*h‰´‡ãhsÑòw+3c}³g­¨Ó'/ý`œ“½ •€_²÷¦P ø8°,íÜruuóðôJx?97ÚÀ’`_Ùš0Os¶žó~U¿ªfÙÃÚZ‰&^…±‘a#ìŽ1Ùr® åŒV0© {¥ÚÊ0‚ÖîrY´i³Ò4¸×/QuMW™àõkÆæEVÀet0]Ùî¶%åC¶R–ûù$\—W•±tIXî#Íi,®F›ËEX›—gx›†È¡Í›¬CÛMÒ ž+R€‘"-‚ƒôÙWúG£ •·Ö°¬V‰•¡Í›xçS"A›oã»Z×go¡ÐÌúxŸ´¦£hƒÃ2qø;üóz?8ì?¤ɵqÂfü- 2ø þùÙà äÏÂ…`ÓËùs4^~ý9V mx¼N*àøåÑf´ü`øë¹’ u‚i´y3 ÞœE`GLƒïéÞº"Ú” Tgî§ø®’®•ëœ­Ö\ƒWŸÍæø[eoXV±PðýåÖoß¹à¬Ú1-±'Ón¯DƒWÏù‚;¡ mDB¡TÚp§9s}6"­bhEI¢ï!áý&Ä@ ”@ºpØšD½ÕÉ{¸ÆÍrשZNz¢ü<†62T&âu\T)nö/c/ß—%0øjhÞ#FÐæ,Š6¢TOªÛÙIî­–š„›ý²h3JY”ü^€cà.ÅÀ¢kú#ЦäÄjzä~L< †††Dbå äç{ÂX«Nc1EÓPLˆ×²#jtb€žw§ÆÞ| mòa´iË¿@q 6™H„\”:¨mŽÉY:¨BÄ[)˜LÚñ¢Ë’¦ˆ6‚¾ ¾¬‡'S/Þv+ÂEØ\VK î®6#/9ÏUVm>·À~j!ŠÖ×Óàòfø!=0–Ö­ ·ÀÐ}^‚°ÈöÚðÏ[s'ãXD" ÀÏJÊ2 ²pöJŠ6€~ƒè~øCE´ñÀÏ¿*ÄÒàvaºå)Y-14.©p çÈ÷Tžš…6}`ê=K=Seü‡¨÷² ’Â-ÃÝVÃCñý.§?vv&@Õ%/:^1 …·iqz¶0XIÑf…›ù¾{°ÞøEÆF{ÿ]’Éž¬oàMŒÑŽª+·sgx›Fî¹A![1íþü-úJñä3¦žuêr-4#Ñò¦Áà=š.ñ)¢¸á÷–RYæÓbÐwÍH˾Û°¨Ùä”@ÊÛ¼~˜¸Â-[‘§Þ$…Ž©ÖÛÌ1)=̘ ï#ƒ6`ª:‰B4Gq*ÍØFr@t_b?‡™ò3vÙ…c•Mð01ßšÀ£ ôcì]Ÿ]øöd ‘ÙVè©¿¬ðjÎ[EN~ø1MËèv\ÑçG¼)¶ð±Wñ>6þûo¡w­Î3F{¥h³ÌÙìÀCÄc}ºÕZ·3mñÉöPg"‘`¼¹Ÿ Ϧ͋ kO½•®ÂuOÏÙ™P‰D’ײ}(#nÊÚf¨¯o¿é4š¡Ê2H2™±.ñW$V9IªSþ`ïÚ×]qŹ—ÎÛÚ§>Vt¼Á=fZ€{ìŸ@oÅ#w3*Έà{h˜ŒKÁXê¶p*‰H¡›îËxŽªº\Ìõ. Ü(xΑìuŠÚ™s¯¯k¹ 6Œáö×ÅØI$2Óú|^\Ü‚¿h˜J÷÷¼¬ôOçÀ ^O™…‘‘n;%h£i|–ß2‹o¼Ðù›ÍÀ Ï!ºC×ÑXX(ÓîÓ²ð“0!ºç×üìX::ºxªÅô'’ãÙŽEº9o=7“æt‡¬šœ?‡ü¶‘öYxz·´Ñ a øᯠÐ!£ÞJ@C«ý\.B´ÿ·àŸÿÏcæówYào?‡«J%—Œ¬Ev¨×¾UR„‡‡àWÒc…~·ü§‡´ÁŠ_!û_&îÝÕÀ…ŠÁ‘¦ (mÁRø";‚>,ÎÖïÛ®”x¶=†Š[ÄJm7”8)+XjÌmHóö6Ê !”™¼ÈÅ䯵¶Ïí}¬m6¦U«0 Rº="Ÿè§¬Ä_iÑ{ÃןÇnD¹½ ¿òùšý¸gW¬¢rŸlK,oŸ.VµÉÚúôÜ쉺ü5ýêA6•åÜœRª%–C5©é[ ôS»¶Î¢ 'Ÿ?¾ºÿƳ®¯8³ÎGë7nVÈk˦õ/›&Õñ5ÒP1ðö›.©[BMjR“šþI©ã¶5‚xUϳNôí4tt‚NèO˜y5³uP H H hŒÑ~8¤gtoþª»Oî´·®~Õ9 ¼ ânÖï¿Ÿ÷·r7÷í&þ?â:ÿï3]6!¦b¯`i÷¿ø%{I$}•s ÑÅ~xšOVhÚÿú‡"Œ$¨±D 1ô¸3ÕJ#>=lc³ªàki5}Ýôb5¸^ î%Q`è-<¹~á%ƒ6§7Õð³î‹)ˆ‰ÿ@0çœÔSf(›¿?úà‹µè‚Ià´Üv?u÷v´Z m¶”k#}ðG$‘¼^Å¢$#Hø/ð¯_ÂVK‘=_Ø£=ƒ6'—ÁÏ™½@ /ÝŸþè"Vë¿øL~x‹¯ ÿÏÏf±£¬À§¼©)ÀEvÑ«6ÁqNõ€­Zà'¿ýØÖu¶$i´™°§xµ`ú©á“³—¥»N¼ážþñ¯l ÒDe­FMƇ{G&”›EòÆûû‡Qo J€úðñïsvùaýù' Ô¼S6<ðó€p¤Ý<ìÀöƒ@ ¢ÃŒÁí«püœYbÈD3Ðù=–Ñÿ ¸ª´Ù&Ùú5fHˆçþÏ=äK:Š}‹NË?‚¿Á^í×™A›Ñp:‘‰cNšd€Ǩ¿ÀÑB™øà×PFœAóß{ jº€‡t!¬Ý1pÄ üü±F+*¯ë•ð‰c {â¢ýC“oË¡GZö¬ñ÷ˆÝrtB2¯ÛK³–-  >–‰ ‚žÄm«|ýü"W宅+4½<Ä•N1ñððNÏÉñ_ÍL(Áª‹NÁûùÃïÜC7Šyµ+ûúD>ª‘ˆüŒÃ›ýý¡/†…Xv=ïĬ ‡‚ü\i4SO7w“àarľ›MÉë—,9†­ ×î\éëë¿îÀ9ô’“©’÷•WÑ"‹&»l\ÕbyüAø*ZØŠ»À-|7à7®óóó¿]1¬”¾–¸=Èßoqäš‚º1©ˆùøbBH€ïÒø£½"Àlòòr¦Ñͽܽš§Á¥ý¡I÷š.Ƹn4Ógg¶&Þm}“±|Å‘7bñdx Êöñ÷÷óñN+åJOF‰_tÿ]_G~†ßª}êþ˜< àɵàçàÕ&I)G1øO䌠¨m ®WIjº\ u±‰ U"²5"&š¿úðAl°+dѦ9$yžÄüÑd­ðHàaQ4âûrÚ$ÆÀhÓ¡*mà³p¥3mþ$AüÓa˜DÌMl‰(—ÚÀ©“ [ê A:zsè4ìÞòk?ŦTYáÇo¼{SïEÜýD,E›ésm­=7ž•W”?H]MàDŠÁ`áI#3¿çoÊ*ËÞœŒµäÄÁ%­°5Ú˜ò°²ªòYö9mj_Øñ:oàVÚÜÆåvZë‘nJ|¼ÒVz…»ú ô Ï%ûêZÚëß=4Áå5LA‹~¬eñÁë•ÕÕù×Htû&„7¨-\½õ Âúü½B`Yc õÆ>;û¨ó_¼kÜ7¦8ƒã·žU×TeYE²Y"D$)mûH4Ûêim¹’Õ"÷â<#>å¢ç.Á8,öHC[gý»{ BY¿PAÞäN÷Œ?ù¾¢²4/ªÇ,š€ÇCR¤£kܱÒwïïÚ oð]ö&2=¢ª¾ êᄥ̵© u÷ãMìÖ!W$CðúÎD‹òšž±µ]]±¦-/ãqÞïZº3.uŽ:(Y_1ôL[ù ûÕ½U»O«§øw‹øõàó_ƒ:!¢‚© ûµJ´†Ð«TðGÉ9c«`ÊÇ00é¹ :#nƒ8”õMËë…`¥+ðJ…]_?'ƒA‰ÞEñ3øÙ1ãš~‚d!Ç¿ >¸?<ÊÀ|O®(¢ÍfK¸`²² 9ÉäW_€ á,IAþgø_J 1>ßTƪgÐFÁÜKŒ”dóZ°ëºBC–ìñ¡Å^F£L ÖfÜx4ƒ6‚ÉŽ.¸LB@ 6§T ‚òÔu4ÿ iA8É…'=É:çß`ìÁØÐ(¬Æ轆Ó÷Eƒžuµ »‚Áy›Óõ³ú\¬ mü7c yÜÇÆïì Ib“1d||É”mêo6´^,IcÚžª+A9´yÓ_œ~Ø ¾jÅ7,ö<¶±)ø’^¬r'4—f ŠÆKDj'WÎHA›5òh_ï&Ûìâj}N#²¶(E›¦ç©lÛHñÄ{5p\¬Æšï¥F'À­Ç™À¤˜£y`rt<?D6©ë~€€€è“ãÛ~¼êžmÇ‘sdî _ˆì;×!ÌDÒàèfï0TÊk‰-þü •È.¶çŲ¡’TMG6Î>³P¢%Þn×ÖƒLùßþ Ôø<à…lK=F® ó¶¨ZIóáH!ÕÈyl²3õ¢Ôgœ·œNN­Ÿ€ÑFÏ[ª*x¹â™dÉ"Ã^Õ°Ú¤@G’‚]® ¢è–Õ*Ùr„*+POôïEýæ ”nlŽÖHä‰)ËvÉØk…ü@òjémd‡hü|[Æ—çU4r!Á¿ƒE!Þ|h3#“é¯Áìë‡ÞÈDø!¨œžkO N𑤴ȿÿkŠÅÿëOÁ‚ß*Ù“úû€Kü Í4|bíï‚f+ÜWxp˜Ö.+")$zòûI©$%n¸e¨O ‹ß·z±£ß‰RsFÈòÍïrÎàI~Ñë¶n\ÅdÐ"3àcsbÜX;·-Û¶‡y[Ñ™v°ª£ÚŠ€÷ð_œùv™}C u ˲§@—f¿Åƒ¶jÛž(WSC¼[;Ò*w÷xÓLÌ6nÛâÀ6¤ö Ó®½è2Å‘‘¹¯ÙdR@ðâ‚Vpk†·ÙÙHgŽ¹{Èþ=›¬ÈD×-wŒ–XÔ–‹Ó'¯ß».ÂÅãÐKO–ĺæ†Çó  8›1í¯ÚÅößôè˜ÛÌïF¯ýV™L ‰YádN±†×)~ƒJ[²$´rÂÐV2peÒ)„{åŠh#,3#|ß«„}¤^$ØÑÌ®I a²Ž]–ª'úw‚Ú@S‹[5”¯LÎ6ÐÜ ZÛÁØ”d$ŠQÝ%hm_µ´É„í­ ±Y>5>hn]ÈâÕä%žm×S# ¥ ÎtZ…Ñòø œus+˜¹ u6ÚtHâOb¥íêI¤ÿ%Xð‡Yh#-`aÌEÓ © 4÷¨ÜÉ{¹>uvvEüÞîή®¡1ÌG°·§kŠ/D 2ÐÙÙÙ;0‚Ô²¿³£›/¼‰‘î®N(þÀð–‚?Ð×ÅìîíçJVæÑÁ^(Òõ/žöcÒ4I8H’"9Oq”PW÷_$±a ö¡éð…˜ÆMÀèêÁT¸ÃýP.]P“#=ýÃ\Å*tvõaÌ®TK ¡ÔØ ”&ô,ÔA5êèâMOutõI{ªï$O¨ À‰xãÝ]]]Ý}PK§§ úŽ 7¡OŒ Bµïéˆ1OþA8ën¨£ƒÝCcØj"I͹£==ƒ\´F#p-&‘ÑÒóú Ýa¿P*È ‡×-QOt5É¡ÍÒlPW ø¶aÏ…)PWVÿsmRV#Úæ½ MµMÝaK@‹‡÷Ù$Ñÿã_c!Œ”Òæï`ýÕoZÙ†jñïÆ3"§¤~Ú|Mê=ä2 Œm×”ï°]»”;]3@Ç­ÊtYv^=ÉÔ„QÙíÃÂÒOJáæL oGÕf3Ðý bB¬z]{_ Fy g fÕ“YÿÑù–¾\ñ7í«Ãm0ÇãÌÞÉ€cwÞŸµÌ¿¾K¯KwØijàŽå7}—ÇÑíca8CÜö´'`Öá9ê p5ɬÕsÌ»ªÍ“ªø¯0/¥²ã”¾ÞI%JØw›·ù¤¤&5©IMjúwã<¸cC]Ã߃mD1o¨£g®›Ä§Fzz‡¸ßƒŠLut~Ô-w¢æôhG× ø+_9[£È‹ ÷w!»ó¢éÉ^D•<46sÁ±H0Õ×öŒ!sÉa§âñá(´·X$–^Ž,€µâ=}ƒBÉÝو͵Ju”/’i+ÑÈ`ò9Sž!Ovuv Djø:¸Ð9†Ó´©‘‹wpf~÷§¦ðÍUÿb½¦Õþ9¢=8h㺾ð»%)u¸®NÕb¯üØÖ̉5yjŠk.bÄNd¦ªb F[É삯´ÚÜ–çÆ.¥!¡&øÂa (76$›:¸YÐHøsEˆæd£obáìaAƽîÄ‹wW7éÆaálc†}a•ÙÖœ÷cÎ9Æ ³=|½™ :^µ¼®aV[’ɆøÌ«â?FÕdò-¼`Oòuq-+›žT³ÉÖ)Àolå4{£§îÍ 7òò&ß×ê^Ù7`3ÛlpŒ®d UÙ¬ñoò%¾ÙÍ×öƒVñëFSlënl+óš_’í#PZdkl#ݦ.éz ‡äâ¡W4“À¦´½ß4…gõèKƒ5|·shš³¯ôyiW¤ÛD=Gy¾‡— Źa¨ŸÏ¾zîPx`¦ÞÀÀ¸K¹7îjŒ{Ò0+ë-ÙCvP¹žp5'Þ«†N\´"ö ¶ñÛvèÍÇÓfüˆ{ Ïå(tÖýZZ ÅÛ¿?L!ôÂWä E¸’ãÒþñ™‡£qtÓ#P/‘v=5eMí]Œi†nûPŸÙ‘žŽYhˆÍ–x»þÖ#,­ÿ] ŵ&2ÓÑ°¢Oqÿ͇&ÇGGŒQ7ˆdžWvÓJmÒz¶z{ëµHŠÑ'$ÔÒÜåx†-"ÛÌU2¦â]ü÷;›q9‚Ð)e·ŠóP8|GK.…ãøyXÇu5v:ÏÁÏÏÉÌÈÊidÞ~î½¹ƒwàt¸ÓÉìã<Ùïjƒ›_VÎQ3þ؃6xåy5ÜÅ–lâ°?Ð…Ne”AýÿÇ}jècÃÈ.:y:ØŒBæù¹™»Ÿ0b*.í—ÿ75ê£êýdçÈÔã©ûD†KL"ïÒÉú„À}~\˘Ø0ãÔ;å§B)$jÀÁ¸kÍ3@÷Ù=üä¬P+'//6N×Ú9Eªä{NÆ ˜Öþ“¢éªÓ&tCï P3:Ýr?x½ú”ÝìÈ¥Ðìb ÈÔËÝÁ>V4ªÅÁƒI™ZÙÌÑÇÏ͆ȴ,[¯iÌ4ì&šßO´K8z2Á—Oãø Ã÷ÛžâÒˆ¡¡\EŇZêþìåÂg±mãÒAå¦9×'ðòˆf!} á½æc;i± DÒöœnC™ ªÅìZzß_¦;…¨ðbˆSèÕ÷@ßëW¹’<­I…Û($Kb°êl#_•ÌÎ/ª8ÒÖ”ò¢iùK6ÓŤ±¦¥‹F$D¶ùñüô.žÆ/ 8fÞH§–ÓfíGÎÆ˧›‰$ú 8 €1P¶i‚¥×Ò,;“ ëȋïë˜%Ê!cMG¶©;2.UÔf¡Ö:smdµÛãÏsNDƒª7æXPƒ!§ ¡ÖäS/áMgÅŒ=‘X4"{› Ë‹FΣ®WáÈFS°©õØÈÈ2lÿû8…ãr´ e›Ò„]–Ð)ʱ5²Eí‚Ï {ITú H tdëí%¾‚r•/Ñ ©åCˆV¢Hr#¥v€*Ó©c™í¨ú0ç‚Ûý>þ?ùå8ÝäøãSŠ«].Btªíõí7=ëæûù&]RV-ºnhep­t\>ò‡3þŽ >îN5ä^¾¹(ÆÜí,r5\À,jœÙ°˜ëÄHyØÎ5f»ï×\eÍÙv—NŸï§[úQ]-?âmrä>øêƒ4/»ýÉOŸ?ÏM ¶ :¹¸æwvÛ¨‹csU¹z$i)z¨1ו•]9­/¨ØF*^ŸÆ¸âO`› vv!÷}3ÈÞ8æÔçŠ2åïœ ä `sóõp Ðç i|*ƒQSyŸ±›òu¨¼,° ¸ƒ¤p÷€/* I¡¼ì½+‰|® z3Ƈ™û¤yf¬ÄŸìXC¦zÚ5³ëÌñ.¸šš§\©†_¯¬xcg@¼>°ÎlA3Ûd[¹A\¡Ð¸n£73 ‰ƒb´/?Kb ’*e‹ t"yL‚fÝú&#{Ú)f@Q7 Ù ï¸ÁžOªêz}l`ÑÅ`ᢒüÊô Á~îác¯óHîàÔ,Meã]ν*‡ßú\õŒ·‡ðvfë³HÝ>œŠ6=£T%ÆLâ¶!Ð=ô×ÙX£˜óõS­E4ž­\Y¸T<Ä6«ã Û|U­ÛC%á.O“Èô¶ùmv÷#÷§»^Q˜œŸJárUæDû:ÅÀzdàNþùcééÇ2,)Ú P£ŸÒSÁÌ×\4ÀqO\º]ÓòCƒþ4ߤ7SÊáô¼—½¯ÎS,o v«xëÐ|h®ixmîŠTó|<§U=È“$s¿©KL¬¾÷ï$U¬Em ˆ»?Œ•wSm|×ÌñjŽùrS@mKú,7Vàw)??#Ö'4>kze-àï¶AC¾½¤«Ç¯Ÿ\AjÒþâ('*•:Û`øÓØæ¼­} ê…à´—±Û¾Ô”di‡Ý뫱ͼ‡¾¾sz7)99%1¹E²½u$:ßåù;ò\ÔR8\ع³ ãtâad›˜m:Ø{ñB@mµ@‘akÊ÷MM^+À“>éßÁ6–©¥še0ÑÅjž5¶Œvæ×™¦ ÛHgË©Îä ê<£çSÍÖM˜ßþÜbá䧙>.0VUº”´äó«0Û󉕙C§EXŽQ²Íò~2Án¼ªÑR“SÊg`¶q¿‹<ÏŽ‡9&_F³“¯špț٦G¹!xb›¯£M… c¥ï^àX0]ÛУÑUåi2™ÞŽ° 3Ih¼í•ÁMJRV&5-ûæsP biÄŸ{ÔÒÑÕ7ÒÀÜUи¬Î6`~ó}_sÒã=ìM÷êò^´¯÷0?ߴׯôòDxÐÏ¿üùíYÍØRÕj©iiy¯êÕÙFú=ÛÐ÷®Jï•‹CxÚÁÇŸ*Ö]W÷þ¸jõgÈTW¿~h*:eì«zëqŒ‡óé♊+úVÁªâ¤zð“î×*ÿZÇ6Èg-¿– gâÛ%Q~ï¥=Ú³¦î&ߪ9dÃ75ßf–0‹Î?—mÞ ¿+¹²¨¾…h ™QTl£È±Üú|Zµ¸¼}ˆm"P³Üê£^ÌØ;k)Ñ9IÛ,9Pö¼ú8ÚR 47ô.ÈÞE[}«Z]-I6,Î=Mã¸ùŠ\¼´ËJÅ6Ÿ4² $-¬ô²‰ú?Pê‚‹>È6rñO&ß·€ÊÙµ’ø.‰àãÅAÓ¬j¤ï‰çÆšÚºÔšjžóf˪²D²UĨêlÜr#8ßèUUJ"†ž…ØÆíÂ6µãÙ¡™h‡—MÑ ¿b›ú¹®·._†.+ÂLµUlÓ ‚SRß“ZÇ6ñHBÂZ“+V®q¬.C:óPC!ÃÄI¹ŽÝo‹Û½Æ6&ià‹’¥ù¥?ØÑòctz€T}]KÛü«¼C°ôR‰AËb Rk%Û(p3ËzÑÛ«SAL­¸»mê<Ùz½µ´j?§C «(j{©Ëq‘+§ªgöù’îÆ™\ïXÕÖÀ¥@ËùMl½Sw7™l¦¾ð´Ú]ìêáí…ƒN¥¸º:j_ÄV‰ÿl£ÄŸ¹:zÇÅ"ñxç=sêƒ*¶z+ÎÒXæ#óB‘HôåÊÝfÉŠul£$µF:zw¿Ž)Lt—éèýȺÍ&¶ÓÍ w1 ;%’ˆ§ºË ˆÜnp.~bé¼n›_n|¶—h¹ „×ÏŸ˜‡úÅç»|‡Ä•åe‰xÞÛ†§csf+¶™n+‹?vî$23æÁ›Õ±x ê6‰B‚V‰ò(K#Ÿ¼’eñò|·«áÞÃïáÕ†ñgt}êÞɲ0+å› ÖK^žw(ë¤8<:bä/\–ˆ–Ÿ&ð‰~÷u›íÙFØ{F¤µÍ‹Dâ¶ç'v±üWÕÙL¢ï™î^öÇÑe±hñ~¤JüÛä}DCt"åê· ±X\}!’B‡5)Ù”…>éÁÏ…%‰èÞžm@î]ÚǤúå^‰–Å“Áæú©…Ý =¥D&ol,éRF Ÿ• >ëÅÈ'ãõ§ht¿Y¡ä¸—¥Ö3‰|@\Y`äx ¬Â·{gß©Ö,ÛwŠ1g<>úQ;˜‘xqК©w§R¶š^¤[Å, ç-ؤïã¨èù:×É&ðêÒ"Š…¡L ×Ü'²ÍÌ &]ŒÇJÛÒ£VŽG߀ýx•NÀÙ ÉÙÀG}æÓî9°.Íu›3 Õ ˜Ð’p*˜BÊù:&\\ƒ³äð]Ë.ɪ2«Eñê:]]“šë®Ë»õãŠ?ƒmlì¢ß¨þ”N4‡¹ðÉd²¥GT碕]u ¾.*C£×?°ãQ)dr`ÊåøûTäÛY)e(…Éïá®fd2ÅÂ-¢c:¢½é§Ÿ¡rÂØk’ÃUäÆË ñ 2‘méU=²‚d¶2ò%ÈÁ,€o|/ª5ò ÷V qíåÂ3áŽ*Õ9줸3o1¤¹eY¸§(ÙæsÂ.Sˆm>à-”¾ V†"MˆDzòÊÏ7¼lQÍQ~ëX“Jæ˜9?oU­@,t”8›²ˆTvúM$My•q| Ô?Í5a¨tfb^1:­þ b2ÞQÉ6çˆn1È[ ¯]Í™d2É=2{®Çà Š+"Û@©ü¬ºÃ£˜fîõH“êíWþ›†°!‘®b›³1Üè¼/ðå:—Jb˜=i™Ë<À8tjÞ®g© uß6 çìÚÛI4hݦ={#N¥(dË—’Áœalûàs/º†_˜F¥RMBzçdßÓÓ£>ä+s¾¦Åd@(}Í¡“)tVøñ›Èø,>èH‹º‹°ÞTå4Ü–W M1rÉLf¸˜,ÛÂõ=YÖ˜úØ*•bˆsG;°šÈÕ¡¨§Ãi‡[v²½DÀ£Qfå}k‹E2ÑÕä°¾ûMŠÑž&žìŒp·{ˆ‘µWil+nfêâÕR%GÝ«ëº GRÏŠœò¢iÛp‰úÛü|uo„qÅŸuÞF±EŒuµ“šŽŽhˆË¦ØæpȆx÷¿>o¬?o£ù”ÈV‡p¦›ÏÛl‘¹æò+Ê«ÐpœF­nÀ¦’j|K±!J d¦¢â«j™Éˆ†ë˜ZÝ| e]ëÉ–¿}.SÞ‹6Ûs®|Øl(¤XwFvý§RüÝÇxÛu µåtõ_ÛD»ÓtGlytI±Õ©§¿' ÅoÑ Ŧ*#Ÿu2ÐõF¶‚liª£ößÁ>Z 4Òu Š)¸zÑÇÇ+”ý¢ÜÐö×9O¢‰“ߥ«W£íñÖÑÌñéâD×ÀÖÀþ&H UJŠŠž—Ö4À¯Í ™¥¡êãó¢¢·Ÿj–¤˜K 0`À€áw(³ÿúóç_Ù¤EñÇ|Ø(þÍüJý¶O©À¼fýUp7ÝWOkבûýÿúE]®ŒúÿÕ`¹ûÔóþß4d«â¡Q4Pƒ½±Î튡?«0K“CËöОZQ–|¥&U/àúßÿn´“VÚíl´þ[È-š7 K#æúÚÕ3šùµ9ó?×\¡Ø|ºO­¤š¶6îÅlpß·®˜j/n޼خ¾Šmþ‹­»Ch­·kO Ÿx¼á©©ÒÉÓ–zÿóÈßÔ.ª,5l©A^Ú³ø¤æÕ­…’­%Å–IËbô*¯] °:ÿ¾ÐÔ Û66¬ÿuñ&Ç: ïûQ_ ã$ø€Ö\W‚Ÿ€ÁdûÄ亗íŒ4*•É ¹ u„ÙïÅV<“wHòã[ï3-Çý­Œâápó=I` ^³”A€8oÖýš‘ü8O:ƒí{V®ìo¤ó9 3§o³ÊÓ©–h/[ƒ|aíºc¶ Ãê¨g?;Â÷>‰FÞU¤ê òÀ3Ì#®¶¦yòÍ}Ýd.Í´áœnDMêr}¨ÁiOþþ4Ä‚ÉfÇßûŒÜzÍ6wΕÃñÎjN…ûœ¹J£¾™CŠ¹lÇg>ø:„øzÉ03¼øCm4iªo¼ë^U_f°=ƒÍK¾Z6[¬§%iRPÚ¥¤$éµô0.‡máÜ4 ù5æÚI\»…¡×ÆlZÛø2˜é¥x/ƒsîåâ—T¦Ç-0ÝXö•wPhóº+ŽN'[?æ'rÙ,+·ÈþEÔ¢ðÝùX‡í}N:Xˆã%L6<"P4ƒcd Ê! Û<ù:p%Þ“Áä¦]Cªàfͨi©s7!g½‚NÊ̵¾ô°†¾oZÁ']|}˜m æÄ2I+(C©Àƒ@{‹S1 Ì5GyÙ2™L;¯¨æ™Ìù(Ã<êFoQv‹Åø§Ì,£ÔÐ_uÇÏasÌr£FýD•Æd03`ÔÃ=E4’ìÂæpCŽ\[EÉvõzª?X‹°ìÇ’oG©N—ÁKé!œœ'}؈þWƇóvtSc“óË€´ÉTOïöç¾ÙÙ¹ú¢“4¾óª\!¶›êáʇ—D+Àà—*Ý´gtrff:Ç×B‡À.¿, ›x–ÿœ“²¾žÞõªŸ` Å9TÁ2ì-ÆψfÑ?'-ÍžsÀ;ž‡B&]‰u·Î›ž™îkx©Käõ2´ä WOÿé×ÁÙ¹¹òÛi [?¸Œ‹³3ÎBGÉ4ÚI=˶f˜ú~˜˜š_Ùl'5úÔ—ñ¦NK.ÏÌ9ú)—Ú°©¥÷bt\%SNdŠ ËxöГàͽôaü^gÔ{“¯LÜܧਵ ú†¶BÕ, ×÷Z%XßÙo/s©Æ \ßX?Ë5qB¸4?ÜL$’Mì’Çç…’ñ2ÆúWˆÄ…aFÔ€üÊé™Ù©ïy¸’ðZ—>žêàft|l§¢l#ÏÎÍÍþ¨Î1eÜ!‹’WòÅHj¼íB3²¬ù æ°ô.ǶïxñÛ£HÇkdrzj¤ÙÙš­kš åÓÍæ®Y ó àoO{6ÓØ¿qhjvª/’­ã} 2ðv²dÙ$ôLL-J€áúkTšI÷ô}OùYÚg<h~ObyŽNNMOOFÙñb ¡YI:ÓÎѧWO.Jb{ºÞÓºþ™™™þú'» ø‹ë;Ø““Ö4S—ïãsBáâ£|n‹ð˃ †…çÈÔÌôäX‚9ÍïtÜH6ù™¢ÍmZ”ˆ¥ @RG¢FBì-ÿik`x¦¬ojrâõ²Ã)°\Mq² <¶yË[žç…THõ£žxØ‹èe|¼`oéŽéTve§gásL¡ó´unC‹1;䉡Òk\÷xUâŸy1¨ÄyW"åÕ¨fÖÑ;õHX[/<ñø7Ôðóo·º€¹î®¹*‘;iÞ²žKÝzôŠ%¤!….¤]O àC_ Áýá¶á9æ DgÞjøÿ žVÔ{!2÷×çì6†ü]Ô?Œ²ôPjRvŒ3oPKü¦®ÿSð—“ýÜÇNäxo®•ö•ÙóWÒ.³APŒáø2±XÒ|Ò› GKYâêÑ›¡E–y>÷¨ ]’ˆ$t™''-]#n!_GZ—´ÇZU‹æîÌV…½1Ôq4uq e¯Ân‚üðÇg9D×¥‚¶ØðµÌÄ—¼óf;jãö<ˆe€±Í¿ Ûœ·µF-×NyÙ‘™lžÏ¯­]=¿ÎÜ@ŸÎ12BàhýŸ] ®ÛI½DR8çï¸!…È ¨Åø0Îh°7ü&Ôw¼ÒmM),Žòu®–vJãʯÙ&ÛÒ#å#rQ“™Ë°u ¸ŸêyòåXÉqËì…°ù$Å¿1ÎÄ»ßV›^sËlxèù~ ½£o‘ ´Æ€ë Ž²Hµs° ~™ŠNy„œkR-Nä8­«¯ŽNd9¤µÅ‚õ}Ž¨[b?©pÁÞq£¨»M¦ÑŒ” I#âM³I·ž¡Ñ0z¿Çhዲq†žxnbg“ "´?.í¤€›ØMGÿÚ úŠ¬!s7y#Û¨­Û´Þs5ò{±åéWÄ켧Ú÷5†¿ï«i`²ý•€Grò Š:x0ÈΘuðæz¶¾¿¹%ààf‘I'ªºæ6¨RO2-¼—£_£éÐî!P’´Ó×gpyÊŽÄÚó_{[„jl£4¥¿ë…|µ½¿˜hqàøú>Ûo²W¶€Ötêe€¾ãM5¶Y-¹váòåËùù—:&—°þ/Ç6Jð[Áö.W6ûìRù· #jgmš=ÔmÀ Ãœœ.~Üœ‹&p0YíêéuK¯—ÜM½¶m³”½Æ6 ¬ò6FÍã„fpäý+nF7š&¢¬É•ó@oùU«è’×!ôÌF¨3¿=º/îZõÝô[ÃÀòT%ÉñzÝ ×…ˆ›q…T¿°@¡ð…2 0¡ j Å÷jf!ï…;;^ø°¹¾±¾ »ö¨Øæîz¶mzB3uØøŽ°KÀEÙf€¯­W1‡fÔyÞZÛ<[Ï6+x3=èrñâÛäF)Û°Íw5¶y††Ð‡“´OþظËGÛyàÁ0òGÓI_ZÔF¶AŸ›îxñ°!3¸ÞŸÌ6eëÙfÉ]owáô¦Åc%ÛÈWçú8,D×\?ÌÝ—º¾ŒXië¼™F§ïª£¾£ºl³r'ãð1 à Øÿepü¾OÓbE _H¾xõâm1´ ±fþᨅIðôþtÓ'Ÿ×±~J×b@}·)– .ÞZBÖm4° bM:ù¤Y™ñÔÝ™Ý&™)ŽÒæ%¢’tæÊ¥{pw–ÏNOÃQe× ÒU„Ü¿b¥µµ ¸T²8<†*D‰¶Y—M!?½Ò±¯tGGmXåì¸Î ‰ódÙ/A|‘Iå{óÙï:é¥*Oàs¥îY áÇÃÞ)d'—-ŒŒÊ ai†#tn­¾7—`7ýÛ±M»B6ÓE4d5N£;:ŸžÞi­g ÈDçÜ;˜ó^ÁãlVí–Îé8j=zÜÛZÛ¤uZ¸åþ}l|:na¼ï¶êû^\ 2ƒŸÎ™vÒ%ül¹ŒðëJ¶¡5‚¹.6gä¾P–zÁMŸP 9á“Ž#Kv›Ù|øJÛ+ã–‡«î¾…§I E‹ö’•¾;dÛ<Ü£–[í%ØÂöŸ«£%{ÿFå°ƒÚÇž!'DL2¦IýÛ¬çYÛ\³ωp&³ŒÃ#Ãø¼ÿx:2QÙ€‹Fí¹lŠ¹[d¨/FËymA6àák6àgº’™¼ðÈp>oís qŒíE;µfîG„mÀ—¿ße“ &3ÎÆ5¹› ±Í""Sð®áW¹Œ«û·2Ø/ñds1•ÁJÎÉˈr¹x=|òf\”eî¦f¾ÓºØÿ©§Rßâ“pN¹MA>Áh,÷U9rkÞ“¬c˜i‡ŽÓ3•¢v•mņb|5âÀ¶ÍXOÏ#ÚÊY­1$’f`O-g£¡ú†¡õÍEêãM;­d_‚Šm™ÿ}½z«¯8…M%øíp6¡SŒ‡¡¥š.ìepþõ_õã槺ú$à °êÁ¤®Å:<†ÿ‡BÛ¿õL¹Äž8à€304$02n•Êº >0(º—jh`ˆ70Üì¶ð/jÕT<‘åj6Ž!-íê;©“i0`øã|ù4Å6‘åþã 0üç`¼»º¶ujÃÅ‘ŽÊºŽÙ_¬Ô–ŽÌÿƒ_,ö½-kúæ°•ù÷ŸªTŽ8ñЇšv - ¿-ûú³¥ yUyiÿ·Ïïë~n˜{…?êÞVBö-åoÛ'¥€BÞXVVZZú EimC«H%‘¬Žz[!\—ýJUéû1z€vn¤§¦² |­º¶aJŒ:S‡CI®–—•. 6|üTŠ  ÎÊèc\1_ÝPfYVñ½gD•'ò¯t~ôkmø|UmÄpuà ê_o}iëS*¾|./oQ3-WÈ¿•—¨ìP_ÕküÔ0¶¼uÓIëJßÁ^¬%ó`¡UíR^ù¹obQYAøßÕÅÖ†Z°åUµ}c ÛKq}ßT\^UÓ;&ÜæyÕ=F ÿ ”d› ’6žèûwéûöƒÖŽLíü'vì ÿñtæ»l]‚„Ê®Ûs+Þ)㮆džޙ»§ü¦ì m°•1™/ì/Äíât®¬ÛÚŠ±1 ¾] «hæÎÃeK€b%ˆF³ðHL€¹_`É#ÒÝDÈ.ÓüÂ.N׺ ÓfdÚahø¾­GáùE$?zÄÛÍ^o¥bP‚ä³2ßC¥ÙNÖ\;áïjGa›FF‚?#B#3²&Ž> Î3>>,Ðݘ†ó;S¦hß_æjé.î¡ö{8Ûãµõr_¶©F:0õ1*,ÜÁÒØ9íÊZ¹VÛy .ÁÐitm+OÊb’ u>ô,ª^}½Ï0°d›p“Kn¤]÷۠ڵܤÒÙqñHã½ÉzgË'ä—Ê8}3[G¿}ÁÞ®NL‚~ÄÕjùÖr-ÞŸeë’”&ëçæDÂéÝlÛæ#¦ð)ü#ÙÆ!©Rº, …"ñ2òÑV——D°mŒbU,¯Ê¤+à]á’H*Gì—`àºÃ%$™ty ½ .B'ñèö5x º®KDÈSbèø›Bþ”Ãû« Ùê¢pIé‰z:>/AÏ‹%è./Ì6àcp*KR¹¦-TÙ*’ÉŠîAa¹²*S,‹—$+2$kÕË'‚øçßݼ+Bê¸*CN²¥+gg…NLvul$)hY+¬GÔoGÓª:ÛªS›UEA$ý€°œ¹Ûü4Þ{ŽšZC™ÞO p9ŽÚ¦V¤±"KUµûñêI¢ÖHß» õµ$5,œvÿx²îW:»6Ë/w<Ák\m_ç&¹0-Øe¨yêYZkHô¦Ÿy©x@¶¡_;á­m~xE™Ôob:ÛqU¾VÈÖW¹TkWø¯>›”^´mJ¾ôƒÅd÷myføZ¼¯kÆ-•ÄÒrÌRÛ&]TVõ1‘íMË]¦{y˲eä0!<(ÀûËhðÅŠüC†‘Æïg› ¾_.…fÄ ’?i/>Í๥×A "çyÑÙÉûzáÝ}Ž,;ßãHøc‘ü~V+Èx¢¥G°§B†lëâ¼hÇ ›‘ï)]jgˆ#àÌgª‰uRj² ŸbÄß/D|Š^ë õ²žzgîX¢ ’®ëԥݨ“´Ã©|…ñPË6Z¼à$ªÄA;&‰ÊÜ·$W?þÒì‹a$ðt2ÅãLá`ÔòÛP¸IÉÑ4†p ïăn`¦E‡ÈGO;'­MTߌ¡2Ù1I)þv,¢¡í(òÿ|´ƒê w,ÅË8>‰ÀŒKŽç0œ¥Ùì˪dBO:mç›’gÂ"ûgÜCJñÀ“tÙœ…s]³îéÎè:äÃH3Û ¯_±Óu¸Øó+¶±Ý«u¬lAUq5=HqݽÍé̶lƒ0ÈŒY·v:²}#’áõpM•€ÿ}’ífpT½klÍcùó€°ûF,9 Gm^ô-Fº°ŽÝ¯ÿ²Û@…«yˆ7ud«â}„}Bõ*2™lMjÛÔ$™Ò”ñŒî¦ØÓÙÜ”#‡ Á6l‚g£8fJöé² @Ôv™I&LŒð±ÅãŒ>AÖ~ò[N†¦™iü~¶ÉµâZz!ßv¹é”¶®ËÄ6ÆÛ,×Äëš þÔdƒ¥Z;ÄÜÙ˜üŽµs>€z±é‰vF9í×âh¨¥R÷G²ß˜³ÅéÖ¢ÖÜ+K>Šå@¸%ça=t®õ~ºMØÅ<›cA ßðå~#m¸¢ÅôG— ù,RYï<È6{µ ü„K*™±¨Û×-75dY²¼@~?>ùH>\‡£™L"cv±ÖÄ@;óшmHJ¶ùyÙÀé,˜\4Më²Ò%^í§c +*¶‘.Ò©Ôö¸ –;,õ´ƒrÅc_¨tStT¯N¼ûø*ÖÊ4›Â˜Bç¾^ó½:Eˆv!“X3i÷ÚÒ®c›ŒúµS4ãuw‰DÆçůØè-»¼GgjapðÈû†þ5æRɼ%`MõÙÌ6ô]„5ýðn¬Í^r(ÜÔËQô]ÉïÔucȾLÁÖ_3Û€vç“H>°¤Øg±ÿq³MQÏ 0þš¨eÔ²òÛÙ†ã¤vk!^@²Úæ¨x½Éˆyÿ›º7ªIŠT|œƒ ß#i§¸TK‹æ¡œt¤ö&”»_ñ¢>l-/p¤D~BCcõ·Ö´ôÏC’¾D$^Ád›?"Û˜Û…?SöÏ^mÊÅul£ËÏF¦x`¶N oéo;uÚ]­[ƒ€Býtìj s«EEšs£ŸÂK 9~&,K×ô37:ÇP‡gÜ.”C4˜iúc¼•Î?f‘n˽U?ú.;Šîø ðÎmfÒÛ. §`ÁG9-ËÒ-XAÏÕÃæ.'0ñ 5‹êk€ƒõ÷f®ª±çBØÀ6%ñN‰ âçöáÙ6qGó꺔±×”l#+£Q¥h"—öS‚r€•yw²®½g`Þ­¢©t`.UÓXP¤ZäÉ‚dÿC¨ {G%˜Ì­¢¡gÕÙ†€3ÐÓ××ÓÓ#‰›à·ƒhù·a¸v²¥éïµ7ε¢kYüÂjH‹™j{Í2‹ÔÔžÍlcdhh æ €F!…$Ÿ\Dâ{‹Pv.mè½o/¬ü¶`i¦%9ê=º›PxÄ1(ý9,ñ(Ùžõ·Š:ÿ[Ù†B%ë#À ££—‹`BS<÷c°’Ë~#ÛøÙFkj¨¯¯««x_lÍö9YÙ”ç§ïOWu®‹¹ïíZ@R ² ²Þ=Y•k@âíO8öîK—ú2†?È6‚Õ¶ÐÝóqn=ÛXœF{½’mæËb™ ˆ]Ò¸–΃±n*óBq7{Ä£_Ét>ä] žðZk?\9aÅÂ[ù'@+ %xn*°PJqŒ“¶$qÅ€”Ï tÏÏŽ‡ó¼Âž=zˆàñ“'¥?f€î‚´ýÊ=0y®Û뱺II(ÙðpãZ”ghº­¹Á2÷][ô£n` â‡êJ®¥úÎå\OK*ËÊûǬTÅ6Âá7Tª•P9ðo$r ¶süüáEî‘’®¾ÿ±ûÐòB¡Mn»JÁYúvW‹åøy(Ýú”*ãzÙæ+:»~¹ÏrNX+ºðq|jËÌã¦Díú1°©ë×\ Ûct¼Qïì~©W}E£ló•mdѦ¸È{=ªL/úã½}Ú°%óáZ”™g¼*SÄ6!Û¬ÌtÈ$C"ÎO0ó“j² Ä<#î½üFÉï”mdÝ–üƒïè7¸á¢ËL\Öä§uëUbT“RÞž3'ï­ø¹ú./Á<ü„*‘|/ ‡«•€ä Â6Hj3}-Oï^>àa¦Oâµ.añ¤þ MÊÒÒ# íJK;9=Àvlö˜ó¶”[Êýñ$Ó]©¯gÐ%¸×K:'àNžgä¸ã¦›yb¼«*ê™W 7W©pÚ ueï]>p2–|äG}Õ_KbA}éÇýÃ8×TUš˜UÀë6»´ÍÑØó ¹›qºvCï‡Þ†V§Z‘Î3ÚRý¸´~®í‰g­LGâÃÞ Iõ³ñö¨&_^;úžâhzäy#Ð÷aÉtJ[AñÆšì5)¹d®o\åm¡¹ƒü RYø·sêZÈjWûÔçAÑÙo*€­Öm ”"ŒôB¯6)+=çHÞ]P3­j„™²t}}û 90ùµ8(!W}€Ië³ÿFÜ2S4Õ°\´nHl³nUfº’lHl…”Dè¥Î·çp›!©ZÚ+ýn­ô’ÉÎûÑ.QÅH—â]`vm¹éðÍVËMBÖʬ‘¨Ë6Póò˾÷ÛxæïX·_o¸wØÐ<e˜•.6YÿVí˜Zí˜:7¾ÏüzÝm‰S¿äû|_QŽ}”*`Knæ›6@TK@d…|j´_Õ’/E öe¿b6 ‡lcE7qzVÛ>0Ðw6ÀÄè¼l#1©Ô1‘ ùz_%ñ¾ut·5~¢)U°¯Y ÅÄŸK¯Bd IuéAUk___{ý[2žÑ.‚:SN°€ÍfŸ¯†«H6÷µó¸H­Cný¸›å}ýýßk_èGE ÛèYûS ú[*î’ˆìp`HN„x>o‡”5QG|[×ÚÓõÍ‹OÌ~Òˆ‡MøÌ— `Õn%úqyDu¶Yüň‡‚+†íuõ²_}íýÙ×ÓÑdÍ"=i][%–ŠØĤ;¥ƒƒÏrbM,¨A9ßfÛïéê[Ö¶töõýl|™k@óšvã˜6r`ÝØø,ΰ,bÔ4Í-ö¤@>é|ƒ£pºDèŸWSõˆÆ…ïk[Zš?=½ g@=S¯(ȼÙDÓ}'뛿wt´ÕW½âÓ‰1×K‰*}# ÷W{RŠ¢hk§åΑìÊ+==£{o«š[šk?>6£z‚lÞ…CŸH|á‡/MŸrôõ4 ù¤½þ\çºWU·#Ì\Àibm\òéþ—ÁoïóÉtÓŸó `õ;s'éaÓÏ)a¬ )ìÒËžÞ¾Ÿ½Ýiþ¼蜀¢&ÿÈ©l‡ü÷ãý×È‚ï/%ÛØØ„¤^Fôö7ç<"ÎBk¿ËGù¾×Ð/?ß̳ò™mØ'­(ÖL¶û*n¹ÙYÛ¹W¯¨FÛë“®ÎþÐ  kJ ñ´²¶v Œ©“#óùXÑQccÏ^8)ÉL›@ ø:%F¥,éÌéÄ`kkk÷¤¸LÒ¶Û\ïñD·ÀÒÞ5¨~¡@QŒ-çfƒÉVòãý>W•À㼎ù¾\ì q³³xWŽ*ÐN>þ Ìw˜Úx/ÀíP—-c¨d!™ÌŠ[ÀÞ=¨¸Û_³ícÑ­_ÙH´¯“…­ë‹¶ÅÂ4nP.¤Í4=ßï!°¶¶Ú{rD Õ?ñ 9»ŽlÀ_óíæfV™°'b%¤G9gjAd5I 8ýuR]'(I²±ó½ Sv/ôÕÄ…xÙÙÙÅëªï@É^œôt´µ³³ó M¨ì…ö§º?^ßwmÃÇíÿtÛ6$YmÚ¹ÖÍ¢µ<°æþ.V÷jÖ„¨ïoîó°·³óŽ«ì™U]w•º8عúè„hdêû+·}r@Ý,×›Øø€œ’êìð®oN•ËòD›¥]BÙ6çEEá¶Üânˆ»&;ž8¸ì_Û“R‹]ŸL­Ý;W•Í4Ûy".¬»³Oè³ÚÁí…‡™q¶ö`m Ø \Ž]*R¨ìñ¥³§B¬­mãNÎÉЊTÜH²¶¶Ë«†šôVv¢ÀÖÚÆÁ=ÿ%²%zÀÒ"§ #  ]úPütQ¹L±»çfƒè·¦¡¯V–<¡P‡,÷~7‡5ퟎ߭œl¯×ü¹:dðIJÕ4ö±0hêhò{aL×$-=ÝÖœC÷ËùíÝš ߥšSÜÄÃnvÆTû¶\ø{¿ˆ|´,ÿRþå È¿4±ø‡L`d#¥“þÉ–5²å%™ûþ4Îzô;6ÔßÓÓÓ78º*ÿ=&0È“#ƒ`"?û‡%RÌŽæ|ÑhwwwÏtw‰Wåè;/iL¶û%‹ þZ°É·£†‹â«jxhËø®€Æ°¶ëPl­ž+þNÍýÏk—-뎅¼Ç€áw¢÷þÿ÷_æ5ÞÞÂÿ±×quÃp[™¼”d°w¯žŽ®_Ò¹yåNäxë/sº>G³ð)ýº m~ëΧéV~?Ѹ Íï®Ys)L&“Ászü¹_!ZúáZÚ®ÿÒ.œPËky}\¬äÝfzºw¾A̳ðí Çš^†¶À öð¾#^Ofj¨dÃaxY/YÀ ÊÈvÒ3|¬f•heÄE’Å›ÓLO¨B-ã_nãèftž™\=6ÕzÙl;‘l“soŒ‘ìdìtþ)ŽàmN·®Opå°)«vëR0léâ`Z =H$1ùW>tÀhžþO}'˜X¤oÏE“ˆž]P{ý½0Û€lrÉÇ>Åw+|­a=^¿P…7:9D¸›Lô9Žq…ԗ˸Ý<þóz4)ðzQ¾âɤß-NѲ=ŽŽÖÕE•úy\¬é€Y§½8u¶ùø° eµVš. #šG©O1æjHýØÕJâš!²MUº—¶ç©Õ¬Kÿ?V9·b´9PØùòüÙXo2‰H3²/n€NžµÜáxi->H¢`oÜõŽ™¶W:$ì†CQrïjÏz¦±ïe Ý H]šè ëw ¡³ù¾T†D  ›qÚnoä³Qdvv1%=kœúŸï¤x‚cyüS…ä2¿ Ÿ£ûø\äTû÷W…OëÇ×Ïìò;^dA>4Ý?8ä‘qGyS~Ó“ãù¨ûA’ŸOÖ#ÕÅk® ߢÐÉ×Æ— @çô~S©¼ùÕ¡Ûul£X'±È¯»œ¯¡±ð®%9Då×K¿’•l3Vÿîö›MnºNàéÙ[ã¾ÊÂV8:Z·¿çò7ÙPÝe¦‘ì˜G,|4ÜÍ©G<Ówóî#™ÚQ`äpÝy{=ï{G ×¼¾ó¾•ž¤sfDjÅÔ ¶CŠƒFäØh9F5Ȥ°«˜mä ¢dcèõdQ4fË/í¢ûI·P:®…(ÞBÈ÷=PàœõXEE¯‚¹6ùÍW£ÝÃΫ.¾`Ú@îqkïÐuõI üDfwŠÕtž²*¯šKdFäÿHÌ—Ÿ¦x/ŠTl£Y“ÙæÌn§I8}áp …ÁV­A•äEzÄ^DC x× û+Ï 1KZw.W¡–æ»\/†i„TMASæ%»dGÜÿ~ëT0hXµ€åùþÌ0§=zK{×c·à…˜m€,”D8Ò€º™ì†PMjÃð—åGX¬g•£·0uŸ÷1•ïMÅ]/ŽûýÎÂx_ÿœ'kÓëq¨òŒ¾qȨJui¢‹M¤Àš”f¶AVóB-(ió¨áÖœŨYožl%™kX£Qc›ôh¤ŒÓÝÏ(T*Y Cœ>Ó 2s~àCò}I,¡¶†7+'4­ö¬d˜p¼2—šwÊ#h6ymX¿Â€A#Û(‰;¿UÙsWJˆl£Hå†#¶- @\w ‘mÔ‡ÈgŒlãoJÕ_ÇõZpú€B¶Ïˆy¥a´ãr=ì¼ò⪋~ãû̽/—ÜÇÊ‚ÈÒ©Áo†4³ Lk'½XN©…*'´óÅÁÿ­E`2h¨à4jßÜ*°Û0P¶™ï/¥277ÅRï=ó€BXJÐw™ÜÄ5°zȉìsâ©bë§O¡»KX¿Â€A¤£ Á±Ê—îfGž6/@¶ŇúL3šó9äÖ­$/=n¢>ÌõLCZχsÁ–W6ŽZq#K‡ú~ÙâŸÈ8úPˆê:ôÒH(v—ð¬q‘¢óz¤®u¬Òÿ¬…ü [µ§#vÙkðB¸–î«,_»¸Û[Vd¦]%Ûˆ§F~ OoÉ6Pì³IŽü¸ Í«øÊÑ'µp l©ˆG#Ýsp;_Š6ϲ°§·á–‡)®éERMýQJOšc+1; 4£êz,›Œ8»YÓ¬œC†AU¦ïÙÿÂ9K!¿/>öÆd®¹µ)ûÔ¥ô.°1³ü‚™6íÈg¸‘w‘)LºdŠÓ¼iÓö&ߘFd°™x¦Åå/¨Ÿ“æâóFTƒÍ0dZ|EÜêÊÏƸÓ(tWw&‘{ÚÏ™}Ã&’tªG ‚©2Î4ÍAÑiI{(Ôµ¼¨t×E5×v¢:}š²J\‘æ¦íuzc=;sþ1\%÷,4^·å­\Í™d ÷Ä åiÃû9ÚÚZ¥?P×I“ß‹wã¨ðžÔœQ›J[+“ë»,>ÆÚêúç+•Òi‰öm~[%Æ€A“*µùäÉVˬnounVÓaMË)ŠísÿE17(‚ŠõJ$ž×üèì7³Ùxüy묧!‡p€É–{4ž¯TŽ(Æ€á?“ÅI¹ÏÛÿ9ÆØ“ƒ—Þÿ@Vƒ‚I†÷‡1¢Á€á?NZûgjy> stream xÚ½VMÛ6½ûW½T*.IQ_›Ó¶M· EêxO»i@Ë´¥V–‰Î¢ýõ~i-­ƒhГHjH¾y3ó†íA·‹W‹«_â¸HYŠV[”1”ñó"F« zÞûºJ„Ëòà~½Ýë #J‚ìÂR6R ÒNbÌ0 ?¬Þ,^¯Ÿ.#ˆÚÃ9ÎH†ÊýâáAXƒŽ‹=«=âiß½_ü¾ §@S:J &qf¾+û0Î !AÙíBÕëÆÍ÷ݦ~$„|€Ö­Í­¦nå˜ ½(Õ˜D/“ífÊÓ3—¦®âï¦ü­ý¼½ÔÏ6ä$ø¬ã+{5ÌÀîz)7àõ0೺‘2‚SÏuƒA7Œ^ð™°¥€ÓÜ¢ú­S¶LfÐY9[y|Û®i:›11ç¡Ù5f±ÍPŠƒtñ©ÛÁHæÄí²k•l•2!™ñgiꑼ²iÌíè»ó< ¤ðKy"˜Âm³4Ö* ÛCÄ_,.¿Ð*’”ãdÞ*¾S-±¦œênbu÷$©æÌ8Ü–¼h<§"Rû̱Ápõ>diî)çõ¢Âÿ‹R./¬†·Ï"ØËú†vÇÇTœÆTi„O¯‰¼5u®Ý© ÔnSJ´¥¼&¯¾µÜ_â|V€óé6lD¦.Z0ò­!‡ø¶vÉúPÉ=ôÅL=ÁòC»]dÖíÜQá}±ì?Κ‡YÿÓ–-ŒšÚÂí]uÚ¹0B›5kW¡ëGÚkYG#Jq‘¸^ƒ éMÙP•UJ>jð÷zNÝ[~Õ€/yf# ®–Ø.ié²#U™~£¥µ1‘‡é™œÒæßæ½é7Ÿëî8Ø|àçà¬×‡î Öþ’©«•ÐÔžK`/†u;Kè_W«wñ•¾¾”bãky|­»£²i‰ɵJe\Ë\žZ›/‚€¡‡3·ú¤² a&åðœt¢˜2«±yŒ³DKË hH…Ú«»=ãÏèé©%ÃÌXRHê-3kéwÂAt/~Ÿ•d/oê±13¡ŠyŒóç"ü©åßñXN›½ó—ÇFNÅXøÊô endstream endobj 788 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 245 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 18832 /Filter /FlateDecode >> stream xÚí½÷_Y¾ðÿ|_Ïo÷{ïó|wŸ»{wg%CçnrÎ9#(ˆ ŠŠdEpL€b@$T¨€ŒHN’sαSÕ·B7BÓ8è8îŒûyïY§é®pêœSïúœSÕ}P½–•• Ò,]Å'‚ p†_MÿÀÍÀépz)$H¨ä_ä³ÏÎPà·008lè–XB‚ô‡JJg €ß ßü ü€ß A¿à7H~'¿‡¬m±pG¿AúóûmVCK;:::JLddä«W¯àœÀo~¿±8êá+8zôhnn.œ³ø ø ÀoÀoø $ð~ƒ ü€ß A¿à7Hà7ð~ƒ~ð$ð~ƒ ü€ß A¿à7HÀoø ø ü€ß ßü ü€ß A¿à7HÀoø $ð~û]SJš¶"¥Ô~ú(¡I®ÅßL,G°?+дF4©/€` ¤Ö£©5Ø’øGÉ•ø;ÛÇ>J¬B±ÅÈí'W£«—A+ÑôFb#+VÁ¶¶œ¥Ô:4‰Üø ü€ß6œ0ÕØj©Si ›%ª’ GßÑ÷Öùirêj(§BÕ=[‰‹(éý.k‹çåÖ¤ \P˜Ž’«Guè›v&w¥V in–Ùý`Íö+Ф7­6NŽ •­%mó~¹S¤0I•MÏPRØ¢½ý.LâÍÔªõ­24ž%šòV:[ÇÔóÌ…÷èZy‚ßüö¿ÙëëÚ]úÑ@„XõhxL8]Uçü[$±¿s‡ªãå·‹ct¼”Õ™¤ * û3•"Õxo3ÔðÈJ¬ASª†t䕼JFn ¯úthŠV7.”‘X?$ò´ª*3ø©ØT5è.7u+¿kTŽQ\(~ëÒتäÿRõÅ=mws2bÅ­ˆñÀopÎà·øÍæ|ur¥ØHoÆØ,Æ/O°N¥ïþm¦ûn]¸{›Å¶½üï{&Õ¡»·ëëïÊJ®B/?¼Ï iG• 1)IõÖñ<µ‹£ë•(ö!¶dR è£Ë4ˆŠ/ÇßLyùŽ!¯UÚq”ÝoÌ'Šâ7ÜoŸ|ÊdZýŒGÆù\Ob~¿à·/õ© øÒV“ù‚—Z3b ²õ`šønLƒÎ y²$‘+©á(3üLš0(.é#I„¥ú-©Ýi £Ú&Ñc=Ÿÿ€ÉQ}‡ï.8xŸ–glj z˜©s4žp¬„ßðT…zp4öŒ'= ~¿à· úÍúÌÛø7ó—^ÏŸ{Xk©­Ä¶ŠÇ<D1;‘R‡‡a¿™0] ð0ŒXëDâYÊÖ &b°uý–\³äÀ‘µ¼(‡ -©lPK™¶¯Pðé&¬Ôø­õ6“Õ9X—°:~;wç“£[†Ä߈¡ªÒM]÷Zâ{Ù¥ÎdœhÄB)~«F½ö˜š{g&Áøø ¿}Iüf{¡6µMªÂùÌFJé#¦œFhA_dA;‘ZÍÕ9ÛÒ:ÉîaÒûA-%šo±ðó~®qalMrGËão~–õÕ„JÔÅÎØ*ôfôýb‘×3³seÒÆß*[´•6íÌZ€û§à7üöu÷D¤U ¶[ªyßJ©ù´äù8_ŠZH\5ñȇT¿É)í{†?É&Jõ„ÓÞ›±eõG¿F3> é5ü!~TšÆ©×hre¯&U6ä!/Q¤>lyŽýà4òþé+üæ)¶©KË, ÙÚî—áþ)ø ¿}‰ß¬Õg*VkM³©›ýrF–oVâN«šTSùû¡›SxüV6Àټŧh¥ß56ýSEQŽ¢$O$9Šù©”:R†#û°)[•e•UL¶‹(æc[Ž0UÒ‰LX©¬r$ÄÛDÅ:>­®›³ùŸUE…¢$CW3q>’w©ž¿à·/K©äw–ÕA )ÕÄ3$ØMhÊ á`obï`k}J ¢OÉï/¤5o6’[À·–Ü ŽñV~Ó¡ó$¶†EqI•ðýð~ƒ~ð$ð~ƒ ü€ß A¿à7HÀoø ø ü€ß ßü ü€ß A¿à7HÀoø $ð~ƒ ü€ß ßü ü€ß A¿à7HÀoø $ð~ƒ ü€ß~cÂ<­Mª@Rë‰_)ÿµUðçëÐÔÚ¯üµð„Jü÷Æ¿v…bú­ôú¯ßø ¿ý»$|Ê*GEæx jgú›ˆ¿¾J êá¦bPùu{Lyü`ËVƒ‹µ«ß¯DO_)º¸‘-T¡GêÑmó ~¿à·_ˆJJœà¸*4µA¿%Wãï'Uã/ˆY]r òäZÔËKÃêpMb…(„-Y%š˜û3©B¼V%þÑÊd’Ÿ©uuf9G~LzÕE£ÒÕ=îÄã#]K–›Ý&ß«ÓÙ# ï…²“éªJdüvùa.‹Ê>ùl 䎜 c™záÑÚ›&rò'O™áp¡fÕXæ7Š2Å`GFÂ{A›-º\àíùä×õ,EÍ“åD¤—FSU<3…mG™l­£Äöw{8™ÞÄ"Lðø ¿mdð-þe“¥qñ’¸Êoœð—BÜ~Õ¨‡§¦í‘Š‹÷K˜jZqe˜‘¤:t›î·¤J¡à ª3­M©E3jGµäè‡ßà[>yb'Ç3ÓÑTegÆøò ÑŸâ7%ƒÓU„ʪPc†OZOÊ›FÌo§È ¦sŽª0\"zÊQY©lmWrºÕSØ;âÒêÀoà7ü¶¡tþfÓ,5¸kðÉo4¨·ÄÄôÕ¨§—Žíáòsy¹,u«ËïE÷¼<Õq¿Up­Ùt¦‹¡*+ãv 1š3Õw$¤ÕIÞ¿Õˆn+˜š0}R»RWûMYëdq"êZGLJå;q€µýø ü€ß6”ªÑ€LÇ+3‰kýöfÙoÚ¶‡ßŸ¿[ÀT7ˆ{ÅohR-ºÃžBÄo|w]šUÊdF#>¿<–2ðíñ‰éc’Nq, µØo-H<È~¿à·ï0ø–ô~D[U=ú=1÷9¿½‹ÖB£«{Ž¤Ô É/«´T¶’ãoÑ1»¨zGãªÐä4éU‡{`ÚåJ4éý€V¸p&5‘®½ã®2äüÃÖÓg×ó[ÊÛF–¼ú ò&)ø ü€ß~sŠ½ûŒ®é ~ªÍÅæt ó['E•½ì7O ›·IUHà>;†²’¡•3GÛÓq·±EPyÿÔÞΆ®fhîäÆfÐm ’+xžæªF5˜©°HoŸ‡¶ŽçÍÄ áSkß3ü1'ÅŠ*–¢çß*QcCªwJWJõ¬6Ê6¶ŽêLÌ9¢¨þ‹ÈoÙi,ÍÝ"¿…û2Ü.b~ ?fÆv~~¿à·õo.àÏ•añùpö/ùŒæ”Zò›Ä—È7‰e° û(©¿)zþ|_ô¬±:ùüÛŠ] IØ2ăp¢í/ï´Fô\b±‘*ü )ä-Wñê¤HñªÅKVÃ÷Àoø ø ÀoÀoø $ð~ƒ ü€ß A¿à7Hà7ð~ƒ~ð$ð~ƒ ü€ß A¿à7HÀoø ø ü€ß ßü ü€ß A¿à7HÀoø $ð~ƒ~¿à7Hà7¿A¿à7HÀoø $ð~ƒ ü€ß A¿߆þ!UÃméeŸRFYðÕ H_‘‚®–‡f×@9|“ä—\Jg²ÀoÀoäjæ*ÌÌÌ,€¯ÂÚÊ á[qüø Ìià7à211qøðápøƒ~Àoø Àoø ¿ø ø1>0°Ëîµk×à ~#oÞ¼y|#ÊËË¡¾ eee\.NOø3 t âÿA!Š. ö¿yì(þôq³ „<‚ ñÇ®wE è €?yì†[Œ‡¹L(äwgõœlÓÝÛg7ßø³ûM(Äú¤Háôµ€[ÿ.[ÿn—“It €?‡Ç•aÁ°/Qâ/d ]¼Ðz¸Ï6 Ë"´ÓüD‡{A6>‡ü‘Fdç¯XkõJ¹™Y®™›å Dpçyˆ€;?»ÀÛÈ°2ÄV¿¦¼!ovvÿwfN°ÎøKss <©÷êß|Ô‚?ƒåí÷ì8|] J¬E”á¬PÈŸ™ÅÊÏÇŠKb‘5/Ö߇€»\#ëU)oin~‘¿N !0öba~–ËnøŒøÝNXD°0‡(³‹\þï°S ‹„àÈ¿øØß|á<²\gÔe}¤Û!¢Ó¾h4“K|Jþï«7Á☖þî®5_ÏÆçÊêw;uÿ)—Ù5k¤LKo#ß:j¢xs­I6cx<Üßø³êFÕÀüWÊtûu]o~ Oe“v«@ú2Oã,,®}¿ô°QÑ؇oÿ’UöíËy¤ìgeýéß­÷š»Œ}a ySÚzÁKþɧ+©«ü¤V'DߥÙì¹·êôAPîH“¶EäF.Aã-™L¦ábŽÊfŽuj¤ð‚™mࣵï? 6¬^À_ å:[ùí‹lèÕOÊF³[¶)Ûžµ#{án¦œö´_jy.´<6óHúý;‰˜mçvk«QNÖzUjVÕÌ·²$\¨šLj ×›]@'6¸ôZv›ŸjõÅ9<„@xÈwºÄõ• '×,ƒ¬·ât)Cã°Ô+òrŒº–Æü3ö¾Ùk^>P²ˆ>ö{:º„¿¿øŽÊÜÉ['Ÿ+ƒá•1 †ÈoÈg¢¬« Ÿþ#˜·d»`kú8x®S:O/Kúü|^OüyÝß92¯Vjt²^Q¬ÿÖ‰‹ÖTòùK©DDzâï hÊÙ,J]AÖm oéœ ÉÜ!G ÇI ßµsÅýfè}Ob½™·5Ì¢¤7‰ŒñgÍÙ®XƼlv­skýF~¾‡Jÿ@üyÕ×>&ÿÿ¢FVù푬»_üÏvìÚ¹3mÊD6Ôø¥Ÿ¼ä{ŸÚyçà Ãp2 (Ž‘3Ú¿2·ßD8u •!íæ|ù~e:ÝêØkr¤Ó­d>á ùBÖ-Å®ußCnÜɃîÖTu=]–Š‰ƒ/ì·1d+Û:»êÐv.á—ééæÍJj…çvùøz;èªïé¢K#­.vúL†Ž»›W}–®Åa:¹82TÔRÞ“»H8Är ζqÚä¿¢¦w­r`êÍ c#MMmÓ=ûc×ñîš >˜ëøùÙ¹˜eŠR¸ÄÕ½ëÆa‹Ã©Ø‹ê$cêöØ '#Å3'£œvì;ä㮢iU:. õ/ØÓiê®Növ»N«‰ã·çË™ñOÆ3S™î§`B®ò<’镲²«É›íN{Ú"Ã׊pAõ•^ý'ÍY¿™údÚëëYYba¦úåâü w¢Ó™ö;vúîÝ£«Í1²°÷¹ŠÎulU¢gÛîµÏÏËFGÓ·[¸îu²'Óv“mŽ¨FzŸý]É«ø©bOY÷l/3 ­ígЙŠ(èñÛgó_}\’¹í,¶×g«ësè¢Ð0’ñfsÔ]ì94µ€¸ç¸þ+ŽþÃ,ê\Àvÿ`º‹ÏE,Sa^æTŠš«»gÑ0¶7ÂÛ•®iìlg¬¦mv»7}Wž½ÊÎÛ;Ý=‚Bt5Y‡/!“]n ºŽÛ¶í hCÎ韴œðœp‡ÒŠZQtâzþ”ð›Þ®,'C}++#e*ûÜÝ*nû[[K6[ßc‡Ï‚pP <|Þu·¿Ï63]«·Âwùú{Zjioûk†ÜéÎôg½¨pèÚãFlkÝO’ÿÁ0]¿YúfÚéa5b¨L×H|ÚŒ½YpÔ‘Ng9xà5¢£Å1¶t¼xi٢ļvÌ}×>¿ÖZZ–z‘uk¤#ÃZÆá–¨x»Šþ¦dŽågâávù7vkhy\@§Þü‚>¿ 27ÿõEÇ’ÄYÕÿø’6•bæàje圙è„ù û`›‰Bê“~T0âdA×2q´³ ©¦¿î˜­¸kf¬¥®i¼Ë''D‡Ÿ'©1 -í 59Ö^!d÷ÛÙX1úd4Öøý÷bß²d ·ör­®7YûdìÅ“¤]Ž¾WÉ7§ú;Zû'W_õðÿD{Ÿ+èÂ^Ô¦Y©í*Â^xØiZgˆº„aZj^àñÀ‹S2ôíäõ}¢"‘ͤc~¶\SP2oe¦S‹®XÞ‡g欻ú¡´þÈ[eòòºµò*ŒýË››lúØ)Ù?·QÓ²$ï÷´^Ý¿Ùô¹[}eV5áÊã;#sˆÞÐl— …á‘ÙB®xÞ[sç‰âõª ÷º‹¢sž(}/¶0¬°-¼9@QbUŽ9y/K3ž!º€­ÍM³\¡D$±Ç„yú°‡ )”‡ƒ¼¹’9Æör‘ñjÙ<'@#¶(v«ÏwÓ˜¬¾9>:óPi«±q´ùún¦åQ²úŸ^”×õÄ®¾… Uõ!â4[¨Ì”ÑÜŽ-Àm¾HåYXœinïY†½K·ç¨wå†l6Âãü®gG5ÍN“ ïÔ±>OnÄÆP|@¼žsW–¹ÒƒJÖÈìDSk—¤ß.Z©éØN¯[Ò¼eÌÉÈpTW‘]GåQwØ»µDàئ¬J÷ºÞF®í¥îýt½éÊrTÞvW”îÇ2 ;ìèç^í£*³k'Èþéë-4³9bL«‘¹55â O½ô¨ƒø{Ò‰ªHúÍÓŠ–ñ|¨÷i*ÃfhÙžâàhü£7Yû¬<“E×ëÁ7Þu“g_°ºbð\@žöšAéä/jqଖìc7jÉÞ¼ ’߻ȭ¼ Owî#ºóÂÑ :Þ=×ÜüXKvJϸ(R®t/Xr²>‹_¥‘©žÖ¶¡Ùo¢”îÅæ N‹9áÖ3};]àßaéßnyo(uy¬Mtÿá{èm1%{¸‚·24í|•É2¶_®©›Ç½-C.£‹mŠªí<±|h%”ãÅZMWÂLýðØ.ͽ'º°ÊÆùà­­~ò9Þ–2Âõ½Ž?!×V‘ÑŒÀ ·0ÞËaoúg3ÆsbPʉq¸O~³a¥ùMzƒÒW”-›@W6šôíÆV—Ÿ‹Ï·…Ý4걊iôCä&æ%òÍ¥Ý0ÉEÇî)ÉÚn˜º‚{V%Yj­/õ6QŸÌ¡=h—äZC…?«Ú`>™©;GeZúlq½K³5ØžEÞFCÛ¢ïÆ:›‹kšž$¯ÝÁj‘9 D—vÑ—HQ¡ºÿ¯_G‘]IÔðámÑy¤ß”(êM‹B²FÇ…úœø2¿½ôUT5/ûM:í:Jr•“¢3è}”þ ¿ .´>£)3có7¶~MI†¥G‚¸Ç»Tû¶äVîõìëׂM” ×{Ú²’‰wÞø±K¡â–—c«ê=k—¥AXZÇG¼[šk·ÑñS+26i«@½9°<š) ÖøùT9ÿ[AûÚƒºÍ†± dÝÑ6‡´¾ÓB”‹õ3¾û½„émŠŠç[„+/¼žÄk˜ïuð±X+ÆOû@ºÔ®HÑêßÆèÀ9œòåõêmU~KžOV”MIo§Ñ9é~›¨9O§yàmqîg³òÄ8Á6ûm÷ìz~+Jô¶öˆu‡ßæ¿ëh);̘¦Éן÷›°!^v‹N91rPëÌdàãoè,ž™ë¢Ì j³ßtÍ H«ÉVÊý!¬ MÓ˜9­øÙÔW^tîꃵÅ2?Ô–{ïцâ7þ°£–ùÅÓ4$í9é7U ]}yxÁ[gK@FËzU°P©ªâJŽ}Ü>åDÑ´]ßo‹7sfçÕ'#»ˆkø_“¨TvùŒÈ¥É2+‰\ÕåÐÙêSXèÒ(Ío“U~Ö'‡»ËÎ19ÆÄæG^'+êxq×ñÛlã%šªÙl&»ên>,Ù`üÖú$BCç hümã~ÃÚ×ÀÇÜü'Šßøz ŒGÄÆÂ܌òˆæ7Óª¬J×ÜsƒÜØ.­-‡³[׫‘Ùê“Š;ù˜ÑcªZŽ‚õü†,äßÌš•|~ÅÍBíPê+¼õÖД)Ë~»R2Všdá- ½›“åå°ð¢4ó€©ÓIràÓ€"÷ªß`ÝíHk3–IÔ©ñ–“ãî¦Ö¡é¤½4Ö› :ö€)KyJ¬.œjRÓÐjŸÅ•†?¼½õ÷ülÏ :Ký#q9Ž;hmëGŽ½#%÷ *û¿E÷墋þf~=æ½VåãOÈ7ü›§ß]oÄÅÿêúi†²²‚-<íyKqa¸ÉÏÙN§³´­òÞC²³-ÿ³‰Ò%öÛq/Šï Çâð–­ µئ„ÇÝ´d¶*]|ƒ ºÂD]–*•¢bär¨ŽX«ïžãã$Ñy=Xð_?NbëðÆ5åähïú…Ë÷O%xoÈvÏuë¥ÿܺ ów²Í˜ºEIU£wÝï xüZ™W™­ñD#EAŒÿ÷x™¤ßºŸ¤lÕq”x3?RËpŸøòÔxò¿v“]¯——¼°qI¬}•¤"»EÓý8ºÔ¡DÓj¬»ï`ÀÁjÄ/¶à35‚ ÜøG:ƒid½ãõû‡ÿ³YsÝìsÏ¿kžÕÈ`É_d´Èû§êÊ2¯º¸²4\ãeÂVP¢ºÄ6ä{Ê[gb›uÒ—IzÔ‡ æóÎbSUhTŠžýÞÊ^¼¹.ô¾×RÚLa›ÎòѪ¼(:E…­a˜Pôa²)On«BpÉ„‹‘\B‘( èºe'kB4~ÞdRجÞUY×_uG3PóÐÑ€E¡RÕ ‹êÉ#z%¾Šw¸Ëo›²UåäU|£¯Ï ȘM˜m£¨ö⛥ ø›‹þVŽ__#Ó­˜ßùè7¯‘dW£ê ô3Ïò­íb¯íÓ}‰=Ömüë=¼ŠJoüŸ2C¼Õäu­áÛŒyñýz ý»múø]¨þ€p‡›Òò¿þ’#ò›àSæÏ×TU×HP]ÝÒÿEwr©W þ=kd°áÊý¦¯¯üþ‚Ö O¸¢Fæ¤ÖHëÀÕ?ùÊÓà$,IëœZúí1> Ž.5Ûžh÷@®…_wûYö=4Ê[ÑðgÛ ÛÖ¯ÇùÄG«yd ú§üYô&øâß&/˜boðêyaíN¡íÖ~}æ‡[­ †SYäýqRr|Ê_µRï6MƒÛ}ó¦–¹]ó‚êóš.—6¸¹ø0ÛèÜÖ¯Êþ;MÃw£ö:æ¢9½¥±ßÓ*¿bp½Cø•ìoÈ®mæÏ?L~Ïêœl¿ceí¶4tßTÛ¹‡ü™àÅ +Çy!ê½Ý²¨ndõ¸¯¨Û'\l¶×ÍÎÒÒ* òÊœø'²_^‹±µ²´²²Øæ}¤múÓF…MqæGŠï]ö÷‹¾±r{ æ‰äöüÍ,¬,EXXXîŒì ‰vé½µ®YÇx£¥¦eÙ"¸ç{õDù觉Õá¡\ôÃb™·YH§•·õí¡¤IÁ"Môü‡íŸâS δ«2ý¸_¸Ö`Iš±Gòê·§Oz9eõ Ò~Ù™Õ1N6?{ûqƒŒôᄦ}øª#Ùoaúb|áô>—‡Së.älμþºOâ*#NSÕ£èU{Õ²Yä›–+Nù»—ÃÓÜoÖê‰nƒG«ÌY&óÓl4¬»ð Ðñ–Gjú…(jk̸]>(‘Ë÷¿ØDß«ÛÐþ/ý¤æ‡­2P™BQV¾ò ¤¼üýY3½½³(úâ„%Ë5º±¡PÏ+¡4û¨,ŪK<ýnÞ㨧íYǶm MY¹½ªX_Úrª…íTš_îë†ú:ŒÚÚêÜóþŠ4ýFLhü7-ýÓãþÎv¯—À<߉ޥ¾ôîP²Áñ°ùÈî»CÆV~-æÕS¥º(@Pá÷è–â»à×gÄ_CÐ…á˜XÌHs¹)Ïœ}Z‡O%Æ›ì=u̗ɱ‰Š:3„·Ÿ…'yWcbÎeä ÅWpùaÍtãÓܳgcÒrŠx:]÷ô€—£žÅ΋qÉXpZ'ýòƒZlÉD?gL"/Žœã ºE&“ÁÍ÷Ÿ½”Š¢³7’ñý>oox>ïJBLÌ¥òaÌ>Òoø»ÕÏî^<.>íÆÀž…‘Æ‚ËñyyPüž‹'Ï7ϯ:þ®^˜Ø®úYŽâÛI¾Ó=)Xã7F^åPŃ̘so¾ÇÞé{˜äj¤ãº7$¥àEuÖq#3(*&·iêΕ õ}3Ïr’Ïœ=óqºþ$&‚þw§ãÅ3#ÂÔ„‹£KèhuTRþÂHÕ¹‹q‹r%ùb^#¢„¨»µ³’Âx”]2Zÿ$'æìÙ´œÇ\ñ¾¸µé—/œKk&B–Ù®3qWùsͱb†fñéUFZÞ&Åž»›TÖ>M¶€î×.^/Æs5×Ï2‰FP•Ó/äL,eIIø´M˜ß êGË ®b…[ŒÏ4×s?ÞÙ@Ë}ÿá”üRti0¯¦±Œ¸˜˜¸”ÖÑEÁtOJìÙ‹ñW‡Ÿü†ý7„õwßcâ’Yð¤ý”Ü8½]‘R„Òdä‡ÏÝù áÄËnQŸBk-JùšñY¿Qè'Ë'Vx\xJOÁ6϶…V '¼Ü°@‘¿0w)vr ¦<ù}©žÐiÅòˆÖµØ;×ØjÚiÖè2ÊïF…Xû?öÿ;df¦ë¹’ãTü•¬„H–‚êÝz¬C´»SÓÈ3è΃Âô³ÁŠJºX{œmU¢ªíurÍ/-[”ÆÙ¢p¯,ÎÜKÞÇ`¹?-å¢ ~f ‡C§Þ?}p›ŠY9'dZ˜¾íþ°ÄüšÊ·{ÍXnñ¯‘±î¨@;3ÇÐÒWï±Æøì´ïös1Yö ŒaÑlO7>Á7ï]øϺ'ˆ°®Qª±ÏyÛƒ—o&³e {±’™ 1V´ÛêÁÃû¡;œÍÙ„ß·B­´œ|ó S£ƒTé&søtt6Õ¼ø1ó±ÂÝBëà©”÷ï飼²’ ŸÕ |8&Æ®òžU¼*tÑR>t§s½bçÕ$ý¤î»ÐkQ_~œA{oÉr¬8»]¹–ƒùÊJŸú°v;®KžfQÇ%¶PtÆXÍlWðå[Uoƒ]´-B®ãÌÖ"EyVTbffüIº¥°y(—£é°±O½re|i¾©Â2J¸ž;󒾊|1%_}Î9§xÜoK“c\üº5:Ï#Ì·À¦”W[cöN§Ð³©¹W/™PÃ_NO5¿w1Õ 8“ñ¾±mRÀš‡ûž’òšìˆíJ¦^Aûö¿ªªÉ:᪠ÊûM¸"š$D4æ¤$s£Ms£Y†åLÍ5û¬”^jfѶaþB¿ Žë*¸d÷¢Â¹¡é%T8ß?‚&wºÝÕÅehN ú]#¦vnMP›3W8Ïz*äŸÞÜeÒî0„ö‘$D„”û}.37<”m/µ‘×ñ’«1go½Zly¬ fÊ·±?3ŸÓ·Ñù6%eÖƒ QÈwz'$¥]1}ON°¬õ±åÍÚh±î4à3¡gD9ú^&×Z,õ߬…|š¿~ÝIÓ>ùm惼"»Xh áž¬c™M³­%*ê†\Ñê‚Ý[BÓ›–ú«”ÙÚËÑYæ1ëøÉÂ뻫ªâ0ÒqIqèÿÌ`ÑÚY—ýf©z³œ|]—lÁv¿ƒ-â¢s§ŠÈë§ùë½Õü’‘˜mŠ¥«:Ï!_â·þ;22¬‹¢LŠü†HÏUñ9Së@ÑîÜcÕŸ4[±ÒvSpIì"~œy¡à=:])+ϼ%¶ãÝ­ïÈ™»Ñ…ŠcÊêG–¤€xC¯•´DSòÙšrŽæ×’¯+âÍ4<ó±ÏÙé^zXOTS³‚ç%þ£Húæ­ùýøQp§ÚXLúèâ§þ)º<è̉Ùibt÷ªpqx»½%UIAEË.åÎóáéòpGî{é‡þªß¨´àûµ=]$…É¡Êl³n>ºö.žÔ’¾qÿt±5°ËtRˆ…+h|WÈ‘6ÇvÇ.¤Žè‘®mûõ0㡬ýaÕ­ùY’º™*)Š> (]’>ý²ß®{²Lmù4á°àóëIŸ¿þ“ßÖ oVúMU·_ìú_¼5Â3êzÊ29ËS9žôb…¦7Öä08j’8äfcb²ûr·ü TU”nU~]‘:›3¯‰ÇßZo¹r\²„ëùÍžqùA;¹äÒØ[9²ôe~ûYÕqZ¼Œ8~“NqŒ‘…_‘ø¯3y™¢±7Eù Ö“•[U D´¨(¹îW’ïvšŠÖÐú#| ç-<ãD~3fÜ¿5ÞpÒt».é7ŠÎ€¨}Tÿ‰Ó@t>x3=l&cdYå7b(À\‹é÷tõ=šv}§ }®*Šš/ð+)ÿ¤óvÛÔFü¦®¥£‹£§Î¦›m?9*üÒùMoFÿ|WP·EÒózþQP—EHUÉ`JÎø½ëdÖKUáTƒ`¥N[ž%«™m[öÛÃ(ÌogÕo9‡=-ÂSQwž@ø­ü6 á·w«üv“û­.—¥m9¿È]‘âC„Úte£#៽¿ðë~{ØNÝâ諯ñÅyîküÖg*'S4¾¸]YîL3²êâˆùMÕP|ã³]WVáÙ0º¢Œ¸Ÿiq‡8GžÌ’›Zy¡ó›»¿ WøMð9¿UE©…£s4‹ÇßòÎ8o ¾…• ‹É^À7š}ÜÓ> nå…ÿéioξóŸú§¢þiGÑ%E×%Òþu÷Gg‡zÌÞLßöïq ê°»3zŸ3ááŠûîµrÓKÅøh™±Ò„c^çnÚžÉsL–ïðFùí?ó럮ã·(ºF0æ·[‡eL/·Ø•M|bÙuü¶“ð²¡þ©„ßÒkf?>WýÔ?scaýÓÜÁZe–Ö¤è^:ÒÛ9CœbcÏÂôò—š T¨/‡WO×¾Áþ©4¿ã~«Æ—å é)³ÊçÈþ©ú¾„BrÉ©ò_h4ùõʽ)íŸL/¾¨Œ'ôX*ëúmýþ©¾•Ÿ(ã#·7éwb½òJV'ªD8²çò=t¦j…ßÐrI/FD+˜á­œø}õ†,´;ÄKõ›ŸÎ¥Â|‘/óÂ_œ_ä‹š;¯·Œ¢iÏ©,ö[þy—m¡f»î3õŽùëÉ?#ÃvžZîÛ¢èsÚáÔW’ãoÄgñž4ë}Y’ýÓïä7dQ0ç×e~¸Ó1¬ÝùÄÇü[Y„¸]úýCêÙÞ—Šr*§ãφ1åUó?Ì`-.Ý×PÛ›wï^8â£È¶m›Ã§'–ê·ÙΛtšNìå¸þÙ †åžÃ9yygCwË(˜õ7¤úíÕÕ#,ÇôŒ l{OŽ{»œ)þ‚ø-½EféÊZî Î̾²ÇÚÖÊ^#4 ë îµV³öL¿ž—s”©D¿Ý4/˜éТPj'ñ@®2ýÍ.¿ó:\mjj>¶¸f€ÝnkV;ÈÛHüvÖÍÌ`{@zÞ#,‹Î ÛÂb3J÷:©Y›;žI¿•`ÎT Ü¿þU®ßFIÆ?înÙ›Ç>öŽê´’ÓëÄo‚ón'‹Ç×Äo&V¾;‚bîÞ¾îiÂt<~—jû9JpÔå„èPš¥¸uvuü†~¼¥D×Jʾ‘qÙQW%è&þ\Míõ3¶±\¬L§:…,¿!Õo§Œ<‚Ón=C[¾ÄoÂÜ€í{¯Õ‰‹Bx+Ìša¼íÌ…u«ƒÇCw«Ð jgÑŠhÃm¹ýb5ñÒü­•5­ƒGüèhH×÷ˆœ]%î/ KƒåÊJÌÛ½’çwºÍÁÞ~î/üÎñ]òï4 ê±:Ôk2Âí#¼&~Ü÷_T0Út##59=»aðÓó!åOóS’“²òNO Üñ¤”ÌiñôßoŠ3ŸVôùåd$%_ÆŸÇX,¹Ÿ›””œu«pJ|45/²¼MŽ ¾ˆÏ,ÁOîxÞ•ä´ÌÛØöš s®<‘|zMÐW—õ’ÆILÉš—Kéë%5ƒäNþ+II5ÜêgןT’»«{Y˜š’”–™Û:ŠGÝo®]½S#Žé–î&žìâñfûÒÓÓçyk ™ýņý®Oò¶õœô†јüø‡»wêð5§[³Ó’³¼Å^Îu½NOK½_?éãÀHÞ]Q”›˜”zÿe#ºþ öîìà‡ÌTlÁk= èíìôŽÑE, ŠK½³¬×›Ù©­CøH{Á‰Ý¾w×øí¬‘UÈ«Ž²¢”ää/yâ}ñ†¯§§&g\k!žYˆO¹6¿¢ºÇÚʳҒ’S3^Öõoõ•?I½["±ý®ò'/–ÿÌ»žÖÔ/zFe¤áöÕ{ ø¶¦Z²Ò’¯¾GùãX5‰Ÿ¿r)c„p`i:#=m+ê‘÷—®{ß²¢lyù©i/ûV6é…©É™/$.`‚Å‘@SVï,øíwà„‚CF!möYàþH\uìûù__Þöô¤âž/¸´lŒ‚³>ãkú§g,ƒK¬S£mû‰âßqó¼3¶¦78ß~ßøM0{¨Ûø`—Ù,oš¼e ü*Fü†1‚]6”„¢U~C:o:´šÀC*:6ž/©¹*ŒÖ7 xñC•¿ôaÀo¶ýµqÀïÒ!Dø Ûó°^èí‡;A7:’|ã}À!ÊEçdÄ_à àDCnËßw†K0ß ¢|ü©Bò †<â‹<ø†?¸Ù–øO @çùÜúÙ|>è €?{ì†n\àxÈâ«éÛÍƾ=VKè0ø €?}ìFL{ÚÀ/;ÜâØaØé8`9ŽCÉð' ÔVý‡ ÝÄÿ ×ÛãÃú‚:,C»,ƒÚ­ÛŽ …‚‡ù’zˆù©ÃßòKhÈÚú›nÿ·†óßw¿kÕ| Ò¦ßYÝ”=£ò¹’þ‚¢ÿE³rÃÒŽzuùKo6"™ÉL ‘/nÌ?„ÞðÉd–– ÁB6!"`;ßz0¨ÓæH—}@§IFßñAÞˆh…?lA…¼¹³çïò¿p-^mµ7«ßm£ÿÇßÒ:fØÿ³%±e–_zàÿQØàö~ñP9”ØðUù/WüÏ<èTøß2·ÆÖ]ÊZO!³´Wâf*r‹+E?ÕÛ–±kéÛבšòÿ½U>ú=ës´1Y^Q}±÷ʦ¿0ÛøaòÇšäU4–ˆsõ’‘œ +«‘‡Š›îDþA¶6ÚïýM{q#;yó·­ZSÏ€&«9¸öãë"þBõç¯iW Šn>mÚȆOy©î¿\G:<6l/M~Ó?ÿ矪êÆg³J–¥eÍÚò¢í¯¹oo Æà°TJ,ƒØâÑi;Þ,¯¢¾(D÷±ƒsËVæ#‹\ˆ¢Mªÿñ÷¼žQê_e®öòÑ0Yñ…ü.^³(lCù¡PˆpSº"üû̃ºÍC[·õ,µÓ· ¾ƒó%v ÈÚK–Ôë­è½Ù*†F¨Ô ´‹£ˆö¢K¶ø n«ÖÊ¿x°`m- ÉXüÌ5A$³éà Mû 5ÛÒB‘U‹Åø¸—-¡O“÷½ZD?;?`¿Dr×ßþÜ}Ñ´8áš´:áFBĵȪÒF¤;R>•^0ÒjóWbTdå(·aÙ.ø^îä\Y]o´\ÒðEf^ªÔåh8]ÎÎY7£ä§mŸ Á%³4V¶•j2½nÓ7z賞œ–,ȆS›4BkV/‰Ù”ðò׺DÎ}Õ“ñkâÇ,ºñžnbž‘ê›Lyfñ$±ÄÂ+*Û+öÖ‹¯'‘ñRóØN~GåòºzÊ5R±%Zë…ß._¹ý‡ÞºZá±WW#öü£­Áë‡Gü@yÖเ>£àvÇ”ž`A€,"²ûrCxO2Ž±©*ŠJ´#‰Ééˆg{+½muèL&¥w9¿¯‘ÉÆ¿oetÖÞs³2äPUÝÂ2°%úªit“Éd¨2[С†§î¦tCÍÀåE³(º´WÙóÜÛ“û\µµ4Ûꆆ Î*Qé,&KÓÀ;ÌnòÞÙØ’ýa;Êöušá ¹¯ÿ“ŽÏ¦ŠŽWý÷Vµ®Ú;®–X&=Že‘Ó­Õ3”è €„§Ç÷ª~Cyã­Gv˜3˜ K?¥Ÿ~®»$z«¢ùœ/MnkžÌ?Øs+ €ƒ_Á}½‰âè§ýü×—]’ºc~Ë., t6PVTÐuá¡uÇ-) &‹Å²‹»¹]•Æd±9ߧƒÛ 6Åf?òq0Uç° Ü -"ë5gnEì(yˆk¯FÙü¬yýxõÿÐ=+rƒ¨j3BD¹ù^%VŒ‚Jÿ±#kHb ·CiúÏŽy;éh©³ŒÜ+z‰‰˜…Ü¢”0EEQ™‘ö?’¡W•×k~tJEY¡y„‹ò§2OícÒðzó¿p›Œ:_õþÉÜÏÕÄÇm'_cÚ{ª€ÜË݃Ì#ïðËÍg­+oðxõŒ5-³]HN¼f©¦R5Ž•rÁm1ÆÚÃÈ]‡Ín÷n^ 6ÔÓ¢3µ¯–tÛÜ>»_UUUSßænñ=Yá7|¿ÑË!;t:¦žZŒO†ÚwGîïÔÚ ¼²„Ó©?m½ÕµTyÂrïõrÉâk8µY'ümA¬›¢ G9s«Û^ë¥*tV)F;´e«ú<½ꥫÁP3÷iŠÚ¿MS­ç:Á®ð/ñ ×µöO±ç9ãŸ=šÁçÍHv²Kz‹¢Ã2ªÏ§Ñ¹¾'f1x-œïÇ:üŸDc}¿!§üñkAÚ>7¢IMhýü_·ê~t½¡õ‹¯ƒ:°“˜ˆæxÅ#w‚»Í‚;œZC<¦5|BT¡ðûôכéï&_°g…¥½E—º4¶RΕ‘"ubm>W4„ε*+SÃE³ÈùênŽ*Ä»N3ugéÄ,™3¯Ø2ª÷:ˆ t´„CQú8Çä&L}g2:a©ºëöâqÒ.Ç}WÉMu—=~XÞ%q™]1ÿi£¢Åü¸hÕÝÚ›/>GgÛ¨ŠÌk]xCåÕ§Óåq¿ñÇ­UÊÈYçúh›Ï½ÂNyá•íjŽIµxž­éçî·¯Š—Õÿ" îÞ—¼¬8[jÒŒüȹñÎY*éÿRƒ½8ìª>Ÿ˜ºÓWfUoGMš]8¹Ö£ mêöœõ~~^úüõ·åä©D'‹xþS¤²ðVY·dÿ¯8ÆŒ©aHæª-Ëo³^0–ïš¼MÓý¢²²bœºQ‰NUÈ+ÒÑož÷¶¶ N!_GY³-c«ñ:n.¿÷¢j튘(êàÜ\%›íMÎd?RuGÜÅT1E+ŸÍ°·hÝ+€éºªrÙ~6O¼¿¡ ãˆ-?Y¨¢ê@ÎNš÷‹-UÝœŒß-tÝc/—BõU¶]ÅÛ@I”§ÎÁdìEn¶Ý1böœ‘/‚]¼ò™–^øQßK)éšg‚w?)®›‡6D[¸_Ç/ŸüöÂGYç9_.:öZFÅD²Û>«‘\uáãY†)¿õê©ÊVŠn¸þ*[}'9!­¿=#$<’i¶JùÔêÃo8%Cñš!w´8H¡s>ÌàMäüAË ¸'¤ßØ6 äAß<¹×>$\¯Ä‡c•R·ÖoDÞh)È¿ƒW4"˜Öb0{Å¡VûëëvzXoë¨ÐÓ‰V=[Ÿi±Ý€ßÖ üðýÓÞ…¶ nÓd+ÿ#vá-Nçû—Ð)Bkº±Ù—¾Ó® Šç[VEžÄk˜{ˆÆAPôIŒŸöhtIúüõË~»èA¥Ó)*EIQÁíÞø¥Î_ÿÉoëi÷3ó×gÔu½MW3tYn2§÷°CÓ[ú«¯aM*FEYIc[ ¹ÖD²‚âû‘¯¼ã&uþzé~³g$u“K.•±é´áÅ/ó›´ùë¥S|ÖÈ"ð¹ø¯!KÅM÷Gæå.·¯^nÕüõÍú *®$Šª¬Œrßú7^¤û:†—H\ÄÓøñ=µÙ%Ó~S2ÕÕø[Òošì€'Ýâû ïDãoÜ M:ºœU%õyâIA}†¬¬Blµ`Y¸§·›Ä¶­:ˆñ7Ñ¥cqˆŠùmzµßnocoË%s’wjŸ[X¹ìË}ËäZ)ñÛÐ]úõqY,u¤«X& Wõ\ÿSÓÈʱö§ºù¼êÅÒ+ûÂ^YZë·ÞºÚÇ£ÿ® ÌôöX´#Õq}G‚;m}›Œ–|"­ƒ½ß îµ­‡^.¬ ¥º^g1í–ýšslUÈetñWüöøÄnýÃ)kwð{øm 2—©g¾|Ÿá¨½2¿72µŒ¤¹O›2ÒÂ]5ö¤~Ý5ã üæÀ:»žÜíÂ`1“ª3Î[ç«Å~Ãëœg¤Iùb¿Å›ye‹¨Ug³âË94%òŽ»ª«¿Êo#抛ŸŽo슞2SÈì–ò9ö†;¬FÓ^"þø¬ßΘ²Ýo·’«-µ=ÅoÂNeù Rrd¡zâ”’Áže¹ôåÍ\{Aªß‚¿Êo¯Ÿ½ñn¹,žRz†÷Ëú³î—#ÒÉñ·3»,#o—Ÿ±PÀûÓÄÒ‘Ž&v—¯¼_l¬å~­úßSnX‘L/Nøw›]Ž>ÔíÔjÓ´Pà Šü ‚×ò¤mjÖa"kíÔw=y þ@•eŠn.ì4¼Û†ÎI÷ÛDÕ:sÄßP7¬™i3ôàþæÑÅõý¶Ën·¨Ë0Ñý±©gâ ü–^#®•WÕxM®Ôó@]A64ý:ߧ.OË®#GwÐœsO±ž˜ c¾[~û~¿-:x@°4YRúŠ+X{Þò>Ô×Ïq…ñ[°‹AäjÒozJÌWÄøÛ'MQ¢àç¤Å*nÝÑ–þ[2rä=AGŽMy}¿!½Mu=’¢,>gÆÑ2' Ñ{÷ðf¶7öº4ÖIËáQY¹jyž€N¯ô欵çÜCÑ…ìÑùC±/±R˜éihë“l§óåTšóÒ:ÙŸm¸@wΕàú~EѶ{ýä‹ŠÎ麗Çß<ôYG®‹úòµ·NI«Æ¶Vra·®Þ0²ý =ŽWÁ ¸cÅÂ)yù—X×oÖþ±¾Âo³£}c³¢̘ÓY§‰ËDïC¥­êÅí øýÓ‹¨pÀI[>÷iê´$.§Åªxeyí;5¢@U©Šªµxà.ÑÀ-õuS‹ÂÞo\dáP—¹_—yh·íÝþ$Q% Ñï½g*d—£U]ªháÒOœF}¥Ifêk{{5šÚîÓ¹D øø³,£[ì·S{cqip'ëu jͪ´4û¤6›fam͡ҼóÉæ—¬æ~¼T´»Š ¿1B°÷»^]£(+è›9bµ½|ÿtUXù&ä/â9„é†ne÷‹E˜-$÷+½´!·ÕÈØÄÄõxÐ^-¿x|̪暭ÍÀÌJ‡E³ö:]/.É«;qñoõ¢¼–;òòZX_ãõVY¹á5÷P¤Ÿ)÷Ó›nÉû§6úŠËÏ¿µäتڤcÙ)¹xHVQÕtO$‹$xÊ(q\âë÷9±"ŽE››XZk3\*§„Ÿ¹b%°`hZí÷Ý»Í7N—­ø¤iíËû‹¬Í²ßŒÔåò«ñû§Uÿ÷žÃkû§ÆÞWlMÌlÍ(l½ko:ˆi,ÐÓ«M5ª‚µû‘!¬¬'Êÿ¾Esx¹ºÇ«öØ0´Œ, µ´­<«'ù+¤5'BgÏ™õNŽ«rD™øªÔó௠æ¸ßžîܬQTWc¯þ{‹6áÕywSU¦†±¾Î±sç·ÈjŽ‘qNÿ‹æš=S]5}‡}¹(¯§XUI­aœ‚f:´•óšE×K?ÃÍMèhã%~7¼.â¯4ñóo‹ƒrò* Sx­UfŸRPT6vé¼ë bÌÉ/û dÑEÇKÕ0¿*ÞE9€?ÿ&⊻®²Ÿ(D\¬RT5Zˆj®¦ ÖXJåpèLŽœ*gÿ…¢ö»§´wE­,Ž²¼‹Vz,™-r²22¶ž·j§¤…źrÿ}·qñ÷n2ž‡Ih§_‹)å¢Ò¾Óð]'ù§´'ÙV¾^ç¦ÀÚ-KP|ÍÃHk6µö9wäW÷»öM‰;ˆ´~–ÄÒ{Œ+F¤?—µÞ!¬Üï{zRqïFú~È:O‹-wªWîwðíµ  kýf\*Ù_ïù7ñ+)ëK-Õ_)êU­e̓zÈê*D¤µŒõŸC‰] Ÿýþò™"]õt²¶ýˆÇ‘•Lò6²¨›ÿÊìb×z5ˆ è¯ôù‰??ì\Øý£OèŽùMÀ;ØmØi×"¨CüÛÅ"Í#¹¿a}oÜo=«šµ¿$ Á—ÜO9ä6"íþÂj¿¿ç8õt{ÎÛ‘ßxæ»8‡-þè…ÿ¬2ØfÔf%r(üüÑ%°–¸š^Öª E+ý† «Ž)©Ðè¨*Ü­žþ²{M® £õL^@½}§N×:,¿wëú³ø ë &véà¶á¿e)D@o?Œ ×v^¥%|Ë}Àçj -ö üˆüÿÓ%Íš endstream endobj 789 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 243 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 19648 /Filter /FlateDecode >> stream xÚí½‡WYû¨ûGÜuϹ랳ֹ¿sÖçŒc wNÐ䜳ÅHTĈ‚H6ç€9ƒ‰" 9ç:UÕ­êj iEGýfæ{ŸÙƒMQa×Þ»žz÷Þ…a°"P…BàIwOŸ—¯¿ï– ýõRÀî=‰p‘ßÍî}<ή Aú«¥3u˜µO8\¤ÀŸðÛ¡ƒOú3Ë0Hþj)·³Ú )~ƒ~ð$ð~ƒé/à·°¥&ýð¤€ßŒ]wìi¶Ìo^×gj±¼Z,»¨ÇÓÝ–FwJyªxšüà7U)§|Hï·U>ùŠ~ÃÒž–ijh%½‘Ì?Œ;íÔ»6šæïñgdñ[ó_=Wô[îïÿÒÖX§£¹žL³¨œ2–OlŒæ1Ô4ÕÖj©©›zÄÆÜà›$ YÏðO¯Yèºâ’S©³]3ªE¦jku´4i:ZT­uÚŽCÐÉCï1xþ ü€ß¾é÷òêqË-üîÙ…<]§$â§øBÙS"ÄòÓõøçE¿¿€/ÁWXHŸú¤XÞ'ùòœ*òÙ94ë#†‡g‹ßXó2ñ\)î á*à÷Àoø ø ÀoÀoø $ð~ƒ ü€ß A¿à7Hà7ð~ƒ~ð$ð~ƒ ü€ß A¿à7HÀoø $ð~ƒ~ð$ð~ƒ ü€ß A¿à7HÀoø $ð~ûó Í(òˆ—£²¯_ÁA†ì˜g•ç Ÿ;Üîß¿à·_”pɼëeP)ï1sÍ­9=_ߤÛº…k\òG,aÐ({ž ”5[":UŠ€ÍÀoøíG%<šJ¹û„Å?U†9”V,]‰ß¶m×· ûð½~e1Y Kü¾ÑxÛÙÖ,ø ¿ý¨TÅï¶3MêÄ?xnñ ¿<”õ⣙{tfù€‡¯Ÿ¹ãæíyM9òwWûl °pÚte80€ôŠ/Ï~Ûâ³=ÈÂÑÇc÷ͬbŸ^¾Û¶ä~Ζ½rëÄ­KVŽ‘i¥Ê~Û÷zz[Hˆ…³ŸÏ¡7¹UXBÄF=ÛÀÊÍ)ñAîëz3÷ˆŒÒv— -܃ãîO¤Ö;oð²Ú±ï :ÿÊBðø ¿}yð-»R`ϤŽ#DgiNÛ–Û›ý¢”BåX¸Äî¹ÝzàúS=­uA·$Y¥ã¶|mëˆË W+ÃCx†,2~Ë*ª×ÕQ÷N~’pµÌ‡/Û&*ãšñø1“j´÷ þÓ>#¦vÐí™%ñÓÌÂcgæÛ¸Ü[F”µr&SÖ›ês½?K~:’ýª’Ba[zÚw¯#61„ªgï¸yÿþû±Gb( ¿þã^ ~Àoß7ø–ñ¤ˆ¦ëY®à·—t´¸±Å„ýð®èw¶Û¾O©÷ßÒ9úi¥Ä{Ksj17£udü³Å€½µ€x/j–W>ÊÓaž’â{‹ŒÞj°éÌ®8ãMW”§d~Û–?‘%ÛX¨‘á¦ç™kCÞösmxÿ4ûUE›O¼ÍÍ+«á¬[úŒØéâ^]ëÀk蟂ßðÛŠÒÞôcúN§ÈŽê‚ߨ¦Gç†Ú<½t]«Ž\½ÂÒµK'»™UØV]™ß$®ú<¶¹›•‹¥‹•‹7‡Bq»4‰¯“ó s1Õ é{f|”½ßyÉø›|~¡‹Œ±6ô¹¯ä7ªñQ™ó*›8k؉%²¡Â÷Ã\†öWÐ?¿à·¤*l‡Ë5wš˜E]ì·cÊ~»ÊÒµ&üöØj‹[æ7©§Ï6­9ï#¿‘‰|n$§¨ŠO¥±™†1¯–cÎÛÀoÀwsþò5 _;ïóÉÄчmêéû’½ËÔÊá‡$Ž¹‹š#!!ü|(Š*-)))Á[T"ð]@ÑýðòŒ_ ø ø3¼{÷n÷îÝñð—ü€ßð€ßð~ððw§¶¶öСC‡Ä‘#G ~ly~þü®SàGͨ4QøÕ ²ÿˆ4÷ýÂW€¿­ÛP ‚I0)Š 8b™•â²Cg dø'DoT‚ÿ/E˜ðùÀ£smÉño‘}SÁÄ÷».&5yEu˜´Zýõ‚L”üçÏoÕüáá©ó·…½/SŽž™EeŸi;”zÄ©'RºÆE+ÚuÿÛ}'n}ß  ­âqúÙ›âþ×ÇŽœžYfåO2/=iV}:‹>üø¢¾”{ìCÓÄϺ“~O¶UoUöøZîÝ7# ÒÒ¯âw㋹ÇK›F¿ûp=u…iÙ—¤CEGåL.³~íËì3w?ÿ[*åÖ¹c¯kGW´êtGòÑ,Þšó“²_éºXÈòÏŒ0LÐ÷)ïdʱY:?©|¾`TŠõ‹Z“Z·†·:†v8ïêðÜ]ë,Ťµð-ÉŒÚðí[í2`´,^Rý䔹KðlËUÍe!β«0×È3C ñqm£Âí·.}'ù®©-Ì6sØ.j¿Î£:-³‹K{M¼^-]žï­ùv\JHòlà–C†|2ŽÄ¼®ûIm½%gKà‰‚oݪ!uî3ÅJË Îìu91X–i ï/Á0Oæ¹—Jv\ ñKz°’£´–œ76ówßÑÕ±\¦R³tˆxºtùcíg}ÄxN÷Í8÷]7Æý̉ØÇÃ+Úb¨tÕ W¡°ölÈÁe[H¦½Vµôô ±±O·iêôÝOf¦ìa¯_Ÿ_;ô3Žƒ ˜lxm.ž‘O'gX9UòÉ1¦Ó>´Óf×gÛÌî]í³­?º*;²DÐÝÞÚÔÜ:86=_sS#ý-ÍMÍ-m#“r±ôv6 $£}MM=ƒd&F;‹L×ó^´tö ˆœM´67µ´¶ÏHÉ=¡3C탨dº­¥©¹¹m|–Xm¤ãÑzþëÖÎ~"N·77N‰Plä½½×qL2Á·LËv~=Éq{n †J[[[fÄ&ilëÇ™ö–&<·£3Òù»òôH_sss{÷Rwê_ó~OwÉVí’…=¨´­©yTˆÛÆz[Û{Uùh¹ÛL:m`µgGû›;ûTø-ñÕì(q¸¶Î>‰¬&:«\uùU --mG·»$]êèêÁPIKK‹÷ÈòÐ?:ý¥p]0ØÐÚ?W%H[kó´PŠ‰ÆÛz¥¢ñææ&üì»;ZƦñ‚A‡Ú;GE*(šêÄK¹¥uxrvþv<>ÔÛBÖˆ@,[ íhkˆ¥C=íMÍ]ý#ø:³ƒ]É›‚_ëè’ÈÄP±U[ç´‘ÝkÑöÖæY‰t°» ߪ{€ˆXfú;6XíJ¿ÓÑ3€ïv¸½¹}˜8.Ö}Û?î6ÑÄwLCd~;ÿºk¢¿¯þÎ>B¡ž”@·m‰Ú;ñR’â¥$–ÊJ©¹udR„—[WÞòZ'f%ÄÞ&ëÍmñ…fÖñxCŽ5wô,õ›cÄÓÙ±~¢R:zÅd¥tÕxÑWJkñJɈôöÝ•×ÞÑ…_p­-Í"©¸·£?‘¾‘É/DKèÌpCë| !Êmr¯”ÉÆÖnD<ÑÜÜ(”¢½-ÓbÙé7u •®-âd'†ð#¶¶÷HËÖÊü†L÷6¶“JD†úºð<·´uL‰Æ<ÖYj£ÎzÜÐÖ3Mœ;"t&~Æd‡Ž6¶õ)\’¹ü#ƒ=ø®ºú†Ñ¹3B„“xI6µmO¶ éhi"œŸ´™~ªŒl9ã÷ÿ0;(»jСöÆÎÑœHLtC¥s²A¤RBo÷rÃÚl¢ZÂÛms:"ºÐVòBì6ëbÌ5tð ÛîIÓaåÕuÔ}?VG‡¶=&)6o#ܷÄo‚=Ø[|ƒƒÝ¼”Éa1¾#ª¾ 7†ªÅILÏ*ì‘Œ¼H¢É¶ ÛäLçw’’ú|b­YH„»UÞõüÃ!¶:6øõ8+Š¢ÉÛ—žýª/ÔK†zA‹d´»¡uOv6O70q Kç•CEã<£¢G€µžYcà¿{ƒiÖ•['"4×›uÉêa¸ö¾&…µ)z_ÌÛ‘kuƒÂýÆTšñ†‡ö†ñu4ÂÏTâkÖgºi:ž”]6SœÕ …ŠAùXoSË*™êl'V©9Ou^â7SûMÉLž]ì®|6-0÷%q'º’Ì¢2£<“—ën«ïìvæÆL4Âf1Ãmõ£Ž9s$\[“s»wÙ{ÓlQò*ý]sMBh¢G}Û4‰uÞ\Ã÷ÚkÇ܊džÞ6´s/ñ] G-Ô=òÚ• )4d2MÝ6û9ikpnwú|a+Î Ýs0ÜÏY›iòQ67å`ƈöÙà·ûÔµÓGhFVƒpèÝM'+¾ë¦ˆ³·žã+´ç‡3Ìð„äínÖ×a"KR3ÆîŽÛöf]Í9@Ñfœi•ö¿¼lkªë±#æü=¼·%=eG·M­!îƒ{Øô`s;ÑéÁýÆŠ ò7°ñ‰ÚéËd0S?NŽ–Üq³5pô9sí&™ä²™ñn–û³¯ò [x\ 7=vîÆ¡mkôBñüN¶6!ÈLwÃÑ2o¡Ú,ñ›•¹ïQ×:6&Ä€CóO¹/ütã(—Î ?tât^ž“‘{PÞ¥»˜T ÏcÛ™Ì=wIõgðMâö&m0Õ\gðYˆ½;—@×fïNË|ÒŽŸú¬¯)ÕÔÞ;1!Æ”Í4@ÔhÛ¹5ú›ã7˜È/uf²KàÆn[ŽžaxD¨¾#‹è_H‡?q4t,|"’ãy:ê'“½%iŽÛò(®µgÍ57úæÎ@ëu×1jˆæ·ÔpËiûav‘"/'nIÐY2zC<@_î8ÚaÓåÚe[2ñ\ˆIe‘ò3"ÕæSÎÚžgÉÏ/Ó- ÿÝ(Afâ>c-ÖûIâh‡vXï:UHìAˆû_ o*¯Oo2uLZö£Òo½·×¬¡]šëÛÍù •ˆ„b©²'Ë’L9;î“Ÿßœßí’†ÇIº,zqç¹ðyª£‰K ¾™£%7üâ;raEº5Ëïþa¿¿E|Þ¢¬&»ØLVÕ€|šþæ>K‡Ð{xÍYqbó+Ʌém{‚ïj—‡ÉÁkdÉ£R1^ZÈâ>5ñÕÓ^×/Už±ª4kš×-üñ¶©ÏdE7Éã°ÒÞwɪ´ÅhÍú°çãdéHYý¸O9HE¥¡H¬ì·[C›­ä±' ~ãG–ŒZR™/ˆ23Ú10ù¾¬þúz¬¨{ŸÈ +¯íà›ÇIÑoñÛàóµkiy-ò3 ûMvúRå+´8VŸîŸO~nz–¥Å±Tð›$±&§C¾fMIqï¸6r×ó>‘·÷ñÏ—.?%#BÉÄgÖ=â{üx>w ØSn—ÍV__ÏuËf>sípÏ^Ùɶ{!?‘êŒ5 ¿é¹jÕTË[Åü°¦XSþ(”ÝU¶®ïf‡µÕMVºá‚+¼ípŒiµŽÿ¼i DðÐ×qýÿŒn¹4Ù‚»ùVÝ¢(]TÍÓÔ®”_ñY ý1 õâºVK6Ú©×êfLj ä~C¦Êx4ÙgNœI;Êæ:=Ȧ“¿1¶ÍÊ;^"c>ãiýÈb¿©x2Ô+á’’ßVQ½§ç.GsƵ÷xWeÂWkí‘zùfÂ÷GWqñ6) bhØÇg‘¹¹p.M=õ )ìñ2CS¶ñÆ^ä{†qñøÍk÷sòRÃêþÎÍûMv.öó}Ï©ÎæקÙf.ßê·ß´ìçwæü¦aW'ìͨb= ú^²è\<Æ ´a;! åF,m½íÉt9ƒ~Ë%½ÇZ3Y¬S9²‚;}ö@´¿í6Âo†ŒÉ­>]våy^Bä~ûðåó´ež~ÑFnØûЇjŸ(ùÍ|ß5%[aÐæwsCŒž¬ßo·®¨‚ˆñ·ÐûòJiJ[E¶7¹ßfæüvOî7]FAã(Y)=•×YúVbý&¿­Ö²ìŸk„s~S‰8Þ€ð´›\é~·Ž¶8~KñÓæYí>ö®¶w®ù6ÌùM~¿¸àï¹ÁÙÙÙÉÑžI§µáA|ÇÅU¯ùKÀÉ‚q¥¨ïÃÅý|¯Ð¹ñ-’ñÚë<’ÈJÄÛÿ1ÎÚ³qÅ ì#g»|Áoc6Ô? z~‚_¤¢ˆV·Ê©B2˃hoh›]T«]LËÆidD"ó ¨DŠJÎì†$Ƙp¿Aq›ýÀV§7ä±ëT÷ “5"%üvø†|–Šð›ùb¿M¾ãPX®_‘qõêµ›7ïŠÂo«˜¢¹Îø ý†¿‘“öjTÙo4Ÿùçÿæ®Óaçuj§ZçʳêÄ*N Þ67éhù»xõêU2;×®]«'ϰ׎§Í° Ÿù® £Eó +ð[E¿€,ÙÖ·çXfößì7ŠëÔŠü6³ƒA‰-W¬Ç鞧Lºþ°X^¥—™FVø¥Œ—Ûõù~Zo{)ùm¤ù.“Å?wùꕹ‚ËðŒð›ãQ|úÓe·oð›ÂüBïC_ªƒ ¿•v“g‰ûòxâ»ü6?¿0?]Îo<:у•IoõM&ßDô%¿íœ7‚ßtlç§y¾è7a0›õJƒ¢ýïÉù…y¿ÝÍê·²ŽzZ±X¦îÕýb¿aÝwv¯gº<+¯ïíèi¯á0¨r¿Ñ6Î_θߊûßžM0Ú)oå§2좦~íÊ•¹j¼rµiÑp¿ízµÃó¿<Ðb°^§bêG}N$²ÃæÉÄi<:›ÆÖ»F´8Æ6o˜Êɹԟ5y‹> àóbŸ‘òŸm¿}ï1†™0ÔÞvŠÉc~8Ì`zãEº¼ß ˆþ©¸ŸÏШ’ÙÅ¡Ìþ—ý†.ÄP‹OpÈJS¿‘œmùŠß$qüÕ'ÈS¨Ï ]­G´É3nNYÍó£¯ãÄÔ q„y—kÎEXx|¨Ø+UŽå–<]ðU¿•LÎù-cÁoWFÉãVÞÙm`´\5ˆKþK7B~XtÒˆCùªßg ½æI1?ZMîa¬ãÓgo¤ ,&­}RJžKõíh¾EŠ-ï7Yÿtv †Îb Q²j$¢±lüm¿¼^¦˜—¥!ñr~‹L{F”Ì7ùm™Jù‚ß^Éú§ŠýS]f^¹<|m*8À3Ø$YæÒ’V¥ÿ‹³cNB+]­¯úmqÆ3Î4«SŸÈŒTÞVgY(ø éëœ_u¿·ex^&"üV+óÛqo;¯¬'ò»WÛ-Ú6¡ÊoE==O24-|çÊgöѵ«vÐjͶës˜trjV)w{\µ÷\k%Ëa¶(a7Rø…Ëá{APdW‡Cz;12“ÑÛìÝâ4†öÉ;¤¿àQѧ\uï›úú:Žnæ9…ßÁyt³Uø©þ¡¡þÎOÞtõùDäªÚoâ:ÝÕ´ëŸúÆD‡½­MƒÓºzÛ’7PÍc emH•ßDUÜßé·›ûÆñ«g<õÀÞ†a©¢ö¥åµ½3æ†ç¾ì7¬øü6ŽžGkWoOWŸ“¾ºþNü ©¿Â¤0ŠêÛúß]ˆûëWßð‡T:ÏwÏ–¨ÎX~«]‚ïþujLôyAHïûûI9·W¿I‡¬5©%­½c’ÔNÞq9ý²ù×*ª±wp¨¯~3{Ͷ³-ËÌ/ ØäKæjæ“ö‰‰ñ‘W§üYŒ/ø -Hß{¶xDi‚¶ëL-ê‹šÖ¾Þ¶gFÀÑWø-g—¡Kò­¡ÁþöŽÚë Ʊeüvd›_âÙüŠî²æÛ%\íéÇë±9ÌZÃ;¥l¹ø-ÁËbÛ‘køräuöÁ,Uá¥J¿¥‡ºxFg¥$ù¶øm°òyRÆÕÅoȸ#…vüõçÞQñ™8×àýý¨÷›cú¹¯”†ºk7f~F— >Åœ?è÷ZÇñJ)ÊÝÁfh/ï7ôuÖþœ7J»˜øp€¢fø¾±§¿¯mŸ¯!£è·v³?4O½nìëïïíns7ee>mÀ¤íFk(çkzzGE%ɵÝFGºK6˜o`2hoj»°ö¥~ëÆÐ.7ºVÀ™÷Ý=Ý/NlÔ2ÅÛdCaƒc\ÓÖ=Ðß÷ôøæ5¦‘²ÁAä]Þጢ:šœÔѵ­híloª6c0ÒÞ’Åhá©}§‹†”])šØë}¨asáðÝð.»ðNûzI.6Döÿ/yζ¿ö±3åê'ä>W÷ãœ=&|®¡¹Ó…×òÛSôfÃãùò'ݦކÒíÒH%½Í áéòwÝ'âðÇÙÄV|#‹7Kä»jÎTã‡ÎûÍÚT¯ ¸6Ÿ§pyü=OðK£×–«SغhÐøF¨ëþæü6ad WÕ+À:/«ñ¶ÌWî;½›¥½2cHîâëé9lÙ;Ý™¯­@ŽÊ šŸzÛò¸<ŸÈ#x¨<Ý£««_LtXˆlxž¡gã`èõ­–¦ *žGª=ŸHuŽTZx5ÙfsÒù7õÇÔ ¢ÈSëxr@Ÿ¯çŸ[uÚðYã0é¿Õõ5G{Yq¸»ó¾òtYýó3>GßÔõEǬ»…ÞËÆq¬ï¾:ÇkÞoþμKoðBFR¬5Ýs;–>2YwßÍÂË7K¹U:ì\9f¨Ç5¶ñ¸W9@®†—[þy§©ýÞ&¾×¼¡IÚžXóÙ–~‰ärb+>OßÔîÌsrlVjo¡÷´VÞìë®{o"žÝ7ݵ䳭·ÆWÉtâ8¦Zz^~ÎüKoºÈÏ}O¶rÝOãJ;_à¥dîµ C§ øe=dßiÈYƒólrnC}õûmÊîiÊO¡ÚnW~Î-ÕÁ=æùÜ„Y¦šÞN²ô½‡oìø´U¸É^ÿ^å06ôBƒí2?”꥛ñ?;$Ób¯4*ÛmÉÅ$}]3çM= ¶ÕŠM¿ ײ?E˜ãm±[\uuuùÎçßÉ+ôãµ==~ÈubÀ%/·ÃáùDgà;º·Å0oû|Cç? xØëÝÝâÑÙ¡Äí®zzz^a)ù UÝr5×ÓåénO8=%?Miž›žíñrùí¦ú®³Ÿoâx­bp®…¤Úh¹d·ÿ°ÇCì@÷–ø&層]­NgÚ£"™ÜÈ·_ñ(¯ÒÄ%Šª¨qTñ!ðE½]&8—«òÙñÅ[-ÉÇ¢nªœQr·‹ò£JÛKNañ•ªªÚî럠2ÛòÇ—=6ß?­˜Y®|–+Uç«PþÖù>7±Jòå=¨¬FźSªÇ/äD©²–ÙêKmàK.Ú³bý *['†uûnýÖJY8Šlü­¨mREËþÆJYT˜ÄCJ—cK_º´–ì@U›]f>É利ú Å«lÿ‹/\ÕWkOÙ™=?ìù7!*9ÖÜeÝîœÚŠ`b¢cJ<õûsvV>õ2ÞÓÖ7õÝ÷˜%~Ã{ÝÂ{·Tp÷]×7íy¸ý³h¹«ç_)“ýÍÝß_)Ê~CQDòðvþÒJ¹ó¦í›ö<ÖQ/Dÿ •2Ò^ÿ[*AO´íŒi·k±íµ‘;F1Åà×èÿÞ ÒÙÛùùÃ3 –tæÚµëK¹ú¢ŠëU "¹wçVߤHa‰øæM•rùy3×(p±ôhÇöˆ·¼ÞxøÛ ü“£âŒ¦˜£ad A¤ 7þ9ã (Ò,.}Ü“Š%À?¤sª­©š.àï Jþ•ò…¿¯ðàoë6A1ŠJŨ„x…=†Š11"•@ÉðwGŠ!¸Ø”ø£—“o3;?{C±ðwAˆè â:„u‡Ãb›¢:­[mþjýSù[ƾñm×*·ÏNON£’™±± üÓ“c¡te…%G¾ëÛ("÷EDc£ã’å_7>>&–"Êcò*¿¢î"ŒO Ä¿¸F§ÆƦň`jbjFþD<=>-Ƥ³£cSèŸhRáäؤ\U"šÁK/üéáÜ~ÐY~p‚‰ÉiD±`e˜QÈ’¼ÍÌLM‘o(C'ÇïA^¡¨d|t ïùà_…ð²iSRÕüÛQòZ¨EŠ†ïF·9G49„v:Eµ»ŸlF°¿\ÿ4ÇÏâ;^5”âi¥ôÖ¨gc ÜC¦>¥Sœ&1,beïå•íx¬Fj0 ý¹{óéÚº#OtVq*—‰tFŸÇxÕ2®¤·î³þÇÈßhü&Æ´dBúÃËöJÏ)¾ä×6Ê™TzäËÁý~–;Rï’ËŠwé?ëÁZÒW1w,}5æ /«¾¬íº;uÃu¼žf?]aQè4:E¥2Ùœ}‰×Ÿ£Ò9.NL#G“é²ÿîü†¥q†OzoµÝqâ®âKo¦oJ‘}œñ¡Ñ¹f6Ž¶FT:CÏÀgoH9g•ÆËþ.ÞÔ[C`_ژĸ°P)B¾yAf6âíÞ˜ÿšÒÕêÓê°³Ï*þ£{½°Dˆ ±ÿâÀ•¼ßy™wÝ gœÔt{U­³Ü;e«MÙ®7RŠyfjc1É”‘ÞÎÙ/WiùxºÜo_x-µâ mþ<Šˆy®c–¸uS×r…"÷Û„RidúXf¶’Kéôjdå»tñ’7+—Ja!ú¥—þί°l!¨úv>]øvº6%çãÖš}ªP½M93Yu£B¬™ð›xIUÚ­×üú©£ó~Ã?ì0Óˆ¿T%¿;5\a¨³»¤ãÎÚû1A÷s«£õ˜´ÛlÝÝjBˆ ›Y=,=°E¥ßŽÏûmoɰ­kÀ‹IÛv¿ÿx$`c Š•žÛ^&Võ>qàç ™É®2²¹ ÄÿÄçámöaÝÖáu.ÂÒdRö³Ü"÷—·…ÁbóÙºV~¥Ä»sQQã]¶•£µ±ž¹çÎY`²ÍA3vß)WÏ­Á;|µy–d/ÉͲ¡RY.Þ¾Yõ"¬ó©§9×ÐÚÑLë¸-^H¶¡‡þË(æL‚_PX¨»)ÍÁ7_ž²ÃšJe»xùœnÂwÝÅZõ?6Šk_^ÿ0*o<_L\.¡® ›ð­×µ6åo÷õ 6ÒeF¿G6ß(?†ž‰«ƒup\’ÍŒßn¤Dò8\{U?ñj-¾äUŠ¶K’ãímFâ~Aô†Í`3!]Õ“ïdß!x_õroRx»sL‹ÕÙ6¼âÄÄü)ÞV‰ÁÖŸQ#È)î†Ë5‹ú>’¾–zÕ˜¼µÞf2Ì&P,Ô››|¹š\:ùz‡ºY qwT0Öê7ã;šù¤KÑ|YÛÙNÐYþ<ÍÙ@ÄAM'£nÈÃS‘1Ÿñ´~›.¦®1þò Í¼ßºøÐlÒ¤dy ½X­m…ß ŽÛ°=®&—IzÊ4èF¸ßÎùZ˜í½Ü×Eä £½É—ÁL­”ÝÐ{_³õ­v;ÒŽ•Î|×M÷óYãyîïóì6ÝÀ?ítÐO{(» ˆûŒµXïeãoa^ìÄ3¥ò+i¦”­Álžù&¿ Ðé¬â¡òX×ä~[&_I¿ëlšÛƒ4Έp·ñ]J°ÁÎÃJÑÓñ&£óÉ}^Ølešp¡®”üX¬ãe}_8ûsî:)ŸeºlJÿMÇgJ^•b}Æãºalú=mQ›ÜoQkù bÙa:ÊÎr |$²›IÇ¥Ý ¿D%¿¹Cf¯í÷6pðéÊo:“­E{‚ÜØz†ê«‹ÈxDŽ5_ò¤©%îËømaüÎÕåëðuYT½M‘¹è2CÀ¯A¤Í.eÓÉÇxßO< îpˆê°ÍìNÆ(•o|–b<ýœJ’Drw>hX4 1[ÂVg6ÎÈ,žê~Éb2ñÞD¨çðÏä*S¯ÔÍ-òÛÄ.ƒidbj"ÃÔÔÌÒÚE@tjN®bˆäñïõ›Ó¹Ü‡^â~ÃE®Ç{*ûÂFkÔeýÓ$Gs6ßÀt. æ1/ÈÈ»cÊ5s’|߸Ëâù…’<Ç/ùÍ“yèF³ü0ÂZ]-µO_ð›™*¿±?ʃ¾¯úm•nôÜmOzÜ^×årí½Ûl£Ó•†ëNï6Ú”ô–ü|ÐÅ’¥·¨”¢ :—?¶ò(Æcä7M ó ¸ßLõOj•ý¶Æø™Üo<ƒ-d«í¸¿ÔoĤL¶·]œbFñ&;ŸZkÀÐ6GîºÔÇݘ°Cb0"ûù-¶ÛßQÌ]ñÁÍŒ-*â·‡ÇÜ-<’1Û¿?‚C#;ln§ãk|ŠipŽjs:ÞOô"è¢ëñgÔrɃguªTž\@"&m7ÔY_6(?àÈç L† ~~Åo³-zTú±%#×?Ço'íÙ.?‘Ùžm}§Á â·;Vf‡-½FÛg8½L21ÝUˆ~G9~“ß¼8»sÞÊ2^ÀT×m_¦ƒŠô—®§›ÎË/Á]ç;üö»¦§¼ÈQÉN=^Ôã¦ÊSálÿýs퉈ž¿¢ßîÙš¸·¢ù#¼¼Ëoñ¬¶Ë¿Y‘ß®ÜoÏÓ÷?MÖÆeÜÀH¿ÉÆßÒb²_MÔÜç˜û“ë_ŠØhzRqláÐf{×ä+JãoÄDíæë´‹¦À0ÿn¿aq®Ç›ã¤ñÉ"¦Í9®ÁSŒ1D6•úóo>ÂÚTŠ¶a“¬ùø3Ç&?æSÝ9äzÀ–fºŸxDAµßf«˜¿sd3a¨Ÿ³%ó¹Â㮶ÑÏdƒ6ªü&(¡ýÆ«››7-|ô``Y¹ßðþiÿ]-šyißNp s‰ñ7¬óE+ŸCuZš›&DÑl¥F¹Ó ³}úÚŒ]DwqàÓ›ÜÏ—–†xjèÑ“ñÒñ7Õ~3L¾÷Q¶Y¿±&ãé„|ünH>)r/ÔHÃ%gÙ:4ÒÕدd%õÜa«­‹:ݲŒßÐÞòÏ«»—úMSMíà}ÙBؤËÒ)îœÂ†ŸS§^o–\Ý‹üCkÓ„¢ßðÅÝW©ë9EäH¼¸Çʬvx—Óû'÷?*?}Téév°J®k•~›)¥ýÆ­ý¿!õ%o>Ìq¢ˆ»F3ãÍ2ôÊúD &øhC_}®Bü6o£Óþ yF_é®ÓŒÊ“‹úMn¸Î:çíd‡Xy~¡ë}.k2*F–<›'zñøaÿ”äóKú§Ø¾^ŸäúM—†w8íêt›EF‰‘ LŒýüPò®ýúêQU[[[Ëa{R·P¶t¼9a‹=“Åa1¹!G®ÛV{õ½—ȆŒMúü7IÖDì@óßÖjû_îÀ&š¶ÚSé &¾1*mX*»œ>ùïë|È= RSgíƒOCø¥™ºÅß*ðF/†uÒÿÏÿó Aù¹ª ‡µqç‰ÑûÎ|çÕf™òÂxöÿþKOö`‰8;ÖGSS‹£gvæö½?~£tŠ‰sùø쌥.Åa3yæ§㊻]™¾GäAÝhyÆêFíS؇ŒˆmR1ÛÒT°ŽÆ-.zÉ UsmA“Úïñû:M§ÔÊèìÄ“·¶9YpX4žC@ã¸ø ãÇ[É4-š™…]è±{{8ÛÓj°Ù¾?Ö¨UÈg÷ÎGP-£Šð=\w¥ÐBï.õÛj£¸‡gâLô¹Z뵓.‘ùn-¾n«K¡Ò(|‡•}„Ï3Ânq/æ7üôüœ•(%®YüM:¬ú¿v?Tºûm×\u{dîŽý·µ…s~cQÖÞûˆûDzr« ^•×{%ïÿ'3ÌC[I–&̓ô[Û™ðµ®Ñø‡–‹Ö¿Û^œ+ïïÿÍûÎÂS…ÝU6ZòÔ´)tªŽÛ<ç1~ïi¯º9´0Û1ÜTåk³æ÷Õ¬^ã°9¦¨it®c#p^½&êM¿BÃ%Û¨1<3–<Õ8¨«ö¯GŸaþôW„oR)–Ô½eW›}t³ã®F‡šé·ˆ”øÍSâ÷²Ð_óŒÎJžS|L᧋*[úü›Âpª~¤ôTÕ èâ¹NTÕq¿ÐÉúÊóoJëËNý¨zñ`§Â|Ÿr~–î'̃yøf«ÒN¿psY®2–üZDŸ_ú+ãoz»–ìó … z C±lPYWúýÊY,zœUQÚ(Š©x¨oîŸáWf)­ËeXÕÁ0U{S̪”Ý›Ûí^õ|~"Tr¼-8´Û*²Íél÷LáO† ðâ/G<Ú°ïÑŸ œe~kYd,ñdwW·2]]£Ó+ÿU´+wQû¸òsÇ„ßbþaD<ÝSX;ö3 ‰Ž; ¥â×L.àÝÐãí±m.Ñ­Ž JýoOB€å©‹gNšÏòøƦJéí½Ùûg7jRYà&üuÇߤâ£!]ö‡ÏbRˆØþæ7,¿hÿ¥þ\m£+8ü;‘ ’³ ÉQ5v²_´“‚ßøçÄo:Œ I0TŠÀ€NwfIg ÿÈ¿Á?ÿnŶàol7)‚‰QâE3(ŠHdVˆˆtJ€¿;ñâzâ?D,íÇz϶¦m‚?Àß^n"%ú¦È86pªyïž&çÈóÍVP2ü=z ó_–,‘¹ +›xÝäÝêÒéÙæ–Ò°xï3„pü '%ßä,Ÿ: ^(E‹0ärï‘ðF§è6› vó} ^ÏG®L S²—Úÿ…'ŸþøÆY•[ uÔ¾)­–Œ7½(|/Æ°Oe/>wM¯hw¢‰ç…o„ß5ó"íyQðJ$ì/|òr Y¶–^¿z14-VqwRñ"æIWÝëÒºÑ_Ü$Ë_¼¨~®(ªl–¿ÁP<üñeÍùãš×O‹J?+¾®¹§¡¨²cVÐ]ZPÚµ¢¾ÉhÝ“×u+Ï‘X0ðòUÍÒÊAÇjŸ¾®CTF +«‹á–¢7Uýòš£3ŸÊŠ^¼xñ®´j YØÑp[II Ñ'úZÞ¼ÄþâÕÛÒ¡™…ZkÞÔöŠfF^¾ü U8¨dfôÅË—B)ÖXñ¾¤±g¤³úíûšÿ8Á!³³DùJHÁ!dÇ‘žêˆˆèpo·ÙÕìþ´÷ì &À¦ú­íÿnŽØ2¾}«sNëâ%Å7»…ê³XTçI|·§t®h_c5êTƒé÷”hà1W‡?<ôš«Æ¯/'Á}ãU˸ÒUÔtÂé@~ùí£­ÔwãÒzã ¾>8á±3µúÇîó+W>:bnõràd˜kÀ‰»ä²§;¸{Šˆâª¿Æµv¶Ô3EL²×LóÚ Öû(Ä:øáJ²!)KüM?~åéd7‹©;*T¾±£•»ÿàï‘,±ÛàÃ$—Èë+Ù÷»t+£€§²½În·fê™Z»¸¹ÛYkhXtOËßÖ™f§•×… .Ѽ€ð`>ßv›»9…i<:×Þ‚ùZÆ°îâC,¶×¬‚m§{>0Øœ¡Y,+ÜgÃáÛU7w™9Fÿ§ù ßR?O!㲪AñØMŒ‰“[v„vXG¶ÙìmÝ<J0‘¬,‘Ÿ 7” ?¤2ˆÈq®ýžU\ˆgUJ¼ák~ñ\fz¬Öé6 ¢´:wWD‰le…å8fk Z0r+üGbÕé*G·ý˜tÚÐ8FH¼V~hYt`t.`š_‚.ømþ@Ä6d´ ;‡¹³Ed{P8{DâÀ÷Áuš°mëÀÜæÊå<ç7‘—ˆ,WÈ!wó÷«ñsÆÐq_ £hT„ s™•.œîrµ†/—H¤,?ß¹ H¥b±XVœJ–ÁüY(ì,[Å2—Ç“ •‡.ìÿ:#£ó±PJòZ ×T¸X?‚5œÚûVæ£qK«eœ°ÿAÝ“¥âÏ·ƒ,ö?±4UDamD沸p,Åv²¨ºy¿ÉÛÇ\Væz1ò:"[T"ÅPáóMÏ”òéÏùMéôoܱ%1“Å Äžä@2!/–y¿}<ê©ázd®g!‰1æú\¯%Ö˜ùȤً04Á˜}¬¤ÃúœGß ½á¢ìæ;úDS/ÿwY¿Í XßÕ¨“±±2KôåªòŸ ˜…t›UM¾ÅH HNS|D»kl«õù®"DP)&" †I±o7âk€›9ËÐÂÛÙ‚Â4½-ë‘L¼;Î¥i;oÞânÍ2´©!ÖÛéÎ Šµö‹;•²—ÂÒÍ©ÆÞ:´ªÃÞ³7¿],ªÊÖ§ë¸øo´7áYº‘ǨKYm½××êPzf¤—>WÏ—É•[(Úœ={ïuáÝ­¯ö¯'Í’áÖʲn‘x¢µ¸S€oåIߥ…PaþÚ¦ 6Ž~éY§\,XÁé²ýŽ»˜óŒ¼Cü]=¶êÐ I¿ÜáÌà›…‡ð´h®û_à‹:nF¯1‰µ'äò&žÙ¾‹úJ³}…µÃ2üº¬‘ØiË+M*sTˆ,õ[^¢Ÿ‘•›—½ ~ï~0ŒµÝK¯Æó]ö”àuÛ—G ¹£Üq+I\kìfu(õd€›o4-ËøåÄ ,Ûgã*K7å ÑgÌŽÔs ñ‘¹]˜|Óðð@¼”œ÷ÈZÁ”‡æÿ·¿¯iåÓ V÷¶ G k¢}•L¶~™bÍg©®ûˆf3ÓË£éÎ ²åÚ^ëàø‡ÎënZn׈ÈÜŸí˜dæ‘z€Î楽#<0\y‹É`9m Ùìdpð˜ïyüÖù0^—AÙnÇçé¹Çâ{6QhìOÃBbçÒ(f^¸X›2í\ÎÖ-õÛzë¤wCO#ª¦‘ÅN‚ ½¾ìh­on·19íüÐ#ŠOÞ¿ ¬´D]Mðìgú¶;2Oàsh—Šºý&˜ˆæwü`3Ï*£Œ°Ö³L#/<«ÒT¦{H‘~C‰ë‘¸+|ÊpOºò%¿Í¢Íï ÚÇÑÁ–ŠÃÄ}àŽŸ.%8ÿ?%~“JÛ˧žwÑ AAh§SD»õéá):‹7B¼ï*–¢âŸÔ5í¹¼IËöäWßIà;Äⱘ£>5ûE;¹BQš#Óæ^¡>ú®Ñ9ä¦lGM÷ËÄ'a5c~›¬«gË£ž—5œÇI–†w‰Ún:¹n5í‘| G`È¥µNa³¥Ô5Æsƒ5ÒáÁ¡Dùô¢½IW ¿u?ðaPL‡dY7ÜYÃr›~Ýq;mÇ4²55¼S¥Áœ^Öo¥jtÓy¿Ø̈<ÝŒÍöÓéÌ7ëÉ…W÷è»&”ÆñᡉYåÆS‘´þÊ£ù­Ò’ǸQ3 *Ë^Çö&ÇìD­×h 7<.=½ÇÜØ%„\oüIÌ:þNyg{ºÃ U ΣYCÓ"tñ‹*‰¯ÍC eçfO;]4H.l8ïm¾ˆîRCÍot¦º±AÛèî 0²ßqD>~xÎs½#ÑfR¼)¾‡Þ‘ OùZ®5IU|]‡[: K²; °JçãÝLK|…AGZ~3ñSdì%1»Äoki…]DË@'šhLvë$dæívÙ±ÿQþÏý©šæC²¸ 07˜iâ@¶óÇÑnVo.îŸ.´dðžŽú›N¢f.ïwÌ!n|’¡2ž–ºµ«ÇÄëCóÀü±ÞüÌ‚þ¯Äo‹ÊªªÊ¬ßP$²ÝúÚàIL‚5ÏÔÆ4:Gµ98ˆ bb4NÖiEçBüŸqücÖ\Ÿµ˜âx±¨VWS³fB~ȉŽL†Ñ8Š…zq^ýDÖÔÔëêf„ô0Ac­~3Þ*¦+yTí  ŸãÞ:»—Íq!ª»éäo´-3òî”ȘÏxŠ÷}¦‹q¿µ1gŠ~£ÙeJÉæ1ôbµ¶8´`ûæ7ÊÇgú+Õeñ[–§¹Qøñ7/ ð,Õàå/ò¤ÑJd9XðÛv½]YÈc‰JÃ×ìÇ°Iw?2[ȱ‰Gá¿Éâ·®Wz†ÏžË(xq"f³•_¢|LÏçne°5í9YÅ(&6ãRªÅ!8¢ʉ‘kÌÐèìê"êˉuÞ¾ï6é7m› ríýõfÃê{êF_Xâ7™·§¯Õ½YÚGŽngéNÍ•¤t¬øÙYž¡9W“m»¥ž¨Ö)[mv­,r¿¡Š~+SðÛ(xG<¶Ó%¥y—@"ˆkqˆjuˆ¯ó–H„(ù€ÈOG²Ëˆô Aqâ ®ØêŒÆ²1bS=/YL戔ðÛáŸÉU¦^¨›/öÛÄ[.E¿_(%ü¶Š ’O¦|¯ßœÏÈËbè%î· ×c‡>™› ù¨N#ü–ìhnä¶i—<Q1±±§«†É#§nÑ£ëÛŒ£ß5û¼x~¡$Ïñ‹~cºÑ$?Œð“®–ú§É/øÍL¥ß>ƒéØŠü¦Ìߪìt]/×ÞÝ·Í&ê¤â4µÌoF›¼%?rµ4tõS,¥¼ÊÁåÆö±©Ï º©SUnø‚öóêVr#)øM76·j®¾Ö÷Û Õjµ+½ò]‹ãÉñ·Ö¢Ó ®Ad$™‘Èè]»ö§Ÿ'w\w.@mÚ¥ŠQ¹Qô¨“aöë–eçdåöq©ßìóÈòyã€ùy§˜ðÛ®%~Ão”Ï׬ãW çB¹Þ;†Á‹Ï¹ßÉ™ä¥0º÷u´1]Ó%]Þ*9Êbo˜Aµ©îÜoóÿÙ~“¢ûz|“ê}Îõ%‡µ;E·¹‰±I¢WŠ‰1ä<‚ÞÙ¤gtð5Y#â™ñÏÍÒkL[ÿ¾WJÞ§‡ª3˜L¼“õ¿‰ºø4šaD>øJÈ)á¯øM!È@¿à7'e¿å¹°m²+Év8ÕôR“i„ûíY¸~|þü…=;#$÷Yu)Žë“X“ãÎÙ|Áç@UÍ/.ÉÌWü†.ò›7:£Pþãà=ºšQ×2Ó²Hÿ‡õ4Óñ¹£Å9i~ÕoJÆý¶Z͹_>P/ÙªËÝSÐRŸEõÞ3w ¢ÆººYÒoIr¿DÙóco(•’ÊZÀ?÷_æÛ‡«¼+àK^íÙ°=óé ü&ÞÊøíÀ yÈúTŸÕFDGjŸPõL„ò™(L*“³ÈT-—Áª,È]ÏÛ8"ÿ!:v'/æÖŠývç›ý†G™5Wî¿”w#1ìCj ç>bF:;ìë1@gòù…áYLýØ;;-vå—“ëOt0X̾t¾`›dzx.3ÒÅEŠª®Ê*;еÛ"›íc%e²Ž)Bt\1ôW®ç KƒZÔ…W r1ÒÄtãiü˜QŽ¦îÉùÄô¦d4XWÓM6¡ÚoÂÎjæ«)L*E­ ÷Ý”u¨EguõʪY•ßf˘¿±‹g0Ù¤ÖÔå¼ìöq[±ßð˜lâM´Žºyó$¾XšlB—¿aϸë5ï~žÄ33ÝWA£3kñ?SÊÿƒõ¢$c¶Lf^ ÑußM8yuiiǺòÎ^JÑ•Äo¡ŽFñWŠˆ\2`®I¿ÑI4î0o>ÅÈo/M©(Ç“ÅØzsÙç„m|uÆ­b–tº*‡®©¾¼ßЖgW/¾lZ¿ijiÅœù€7˜é¾b“VÝ7ƒ—-FjÑ°T*©ÊöÑà“Ñ ~C±Éî:Íüº ¼”Õt:ãã ®@ñý³™¥K\ü(Å~ã©fÕvð­öÌëåäç/ø o'—öÙ™»î&f/%cN¦\5Ùø†Œ¸Q¨Û.|”Ãõ‚HGíéU2³ÇL~K ä^Ùïá1w´F] G<Ðm)Ý“L ½.ç·Óñ^‘¹ø6ßê·Ñö7½Z[ÛÈM/–MH‹B ¹fáç0¬ÏÑ) C¶ð´<ε¹Ó_5 ä=vt6ÔMµ‹îá§Sÿ,CS‡™\²4v'ªòÂËÆÿøM„HN´‡vÙD´:\éIÅo£?_oä=¤¯ü–CS‡|IDÞºÙóI;XTÇ(åV9y¹ïpÖIº"ŸÃš|±ù7þArB÷~²§š†NànÙVÛTm*ƒ›ñ€|kHùŸš›å~“Šx Gµ„a®'¸®×Ð ¿;€a]ºkÿ÷ã&‘RÞB]4ö\$®è®;îjV9r¿ >ÿ_kŒdS’ÈÓŒ(:E‹mäüº¦J}-£Sv¼‰–×>Öº: ßÚ§¨ƒ˜jØnKÝuºX~t?ÔVÓ©ÅÊsbÖZn[Z ã-/µXzc¢Å²•Ì°¨…Mò á¢,KŽçü`#EYtÍõ†þÄXúÇ‹¡šZÚîÕÑY‡/ð·Åó`埤<«ÔÛ©¾iÀС3õÝ«?¢˜^ƒÍö©©k“×)ÎÅ]L»<óè-o+⾊þ©A|í»³F, •¥¼O~÷é*ßd£§­CqØ–4( j)+Šë™°påN´¾õµÖÃs¨gåý¶ôö”»ÚÿÜ[ t=Nûª­)X.û¬Uüι6ÚqÅá{"ÚÙíG Ϩ7ïâ ÿÍŽ'$=訩M1÷Šþxü¿¨;I/ICƒ\iT c”~ˆ…>æzh'ˆäχô8­[µ»@^ò>fë.U ;ßž_Ç2Á7GË£þcל߈r«’M'Í4=ÑÕZ˶ôz¶ñóL²Š®$òäŸ}ÚïL =ƒx}܈³ùÑüUV}㚉û|åè¯b6ÎÕ*œK  St :•a˜z§ ~ÖYm>¤8(-¿P*G§ªÎª:÷ O /­¯%íDåÍuÙ¬*ý10té.T6 •¥ª0;§X>ÊU©ØT”Ÿ…ž_wØÖ6R© ­ôÒZXRïŸýö?$~“HÅ)í!]–¯Æî R ø7Og /?øôgî2Ký† zŠÞ+Qô®¹O¸ò{ÐHÅ–áåqAÂo1ðëÈ¿qccÇŸ 'F+î4/©Êly¡âü®ô=u¾DsE$Ѐþî\<¿t`Ñ¢ž'Áa‘ÑJD„^x3ü'…´Ý Ùw üüeû§xTŠÍLaS"EàoóIþñ§ endstream endobj 801 0 obj << /Length 1365 /Filter /FlateDecode >> stream xÚí˜_oã6 Àßó)üè‹k‰–ÿìq×]ÛnhÓì©;Nâ.Æ%q›8+ºO?R¤ÛIqÁоí%–(Š²ÈŸH9¡÷—zWƒ_&ƒ‹Ï{YÅ:ö&$q`"ã%QDx“…÷àßï·å<¯óáH'©ÿÇ®Ørëj_.ŠáH…þO,«"ßÜ@jømòeðëdððà³÷eíîÖpý6kØÖŒj¼‚B‹>Ù‡î qs[잪ͮhÃ+%°%†a#{” /±dTx#Ÿôy£/Ó,oXU9ÛiÇ'a»#Pca ‡ :ÌAÃŽ3sÐ0 sسŽeN2jÉQ:bÌ0GïÅÌA›98bŽÌV<â6b™ƒ1ÇaúXè®Ï)èXÛ=uÐÑ€+è)óAƒ\“S)"K,®VŒ","×<ÈõÕg¢}ˆ.õ8º4n£K"Ž.µ8º48fA¹ãçqtí UnšÌïD÷- ÝÎôÊE¡Éá2‚nÀIR» Ò§€kwtšš&®ùÐ_ž“U4t²Šn*˜>T0Í76zò)A­ýÆUc{(q¨m¡d•HqVÑ­kèY—Rôñ5ŽÔmJÑRÂäv2=Zòòÿ*v:£Èu®í°÷…íëY%¬ ›¦„`3›qhÝÜ‘ÖE½¬¶he®heR´ÚxÛ@¼¨¤­¥s\´@Š–ÖYé+0BÆ~¼‰Ù!“!Ž’É@> H$™ B—ÉppÌ›É <•É€ïí@•\ÈçUõ½,(PYÊxiÍÙ«™ÎVOPu|'Y./Ãðö2Ÿx€K¢â œ÷ÉIõƒÙ2 [¦aËp•4–9ÉV«f55ªÇ–«zZÙ-¢ùšú¼˜(ÐñÙÿ»ÿ;„&"(¥Ù·Q`èèkú,Â3`7ôºªì§m’ú¿ñÞðçõ…†ª-ý.ø>™8È´vPô_ü_•í©` endstream endobj 790 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 232 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 18557 /Filter /FlateDecode >> stream xÚí½XTiºïKÛiúžçÜýìóÜ;ûΞ}æì™éi’¡r ç,’s6‹ŠP1ç¨$#FÌbÎ9¡( Á€DArª\µÂ]«VUE¢mÛm÷û›·bÕZ_^ÿõ~¡Ö‡ãüÁ0 ø9,\º2,qvH|ØoÊ&„%\¾|îPàçà3kïK|G9ØoËÖ]éL_²îPàgé[tÒÎgxîc0°ß–­:÷f èúú o` oèèúöËØêsÍÑ11·Ô¸qã†T*…{}ûÒmÍùkkë…j¤¥¥?~îYô ìw o666éj,Z´¨¨¨îYô ô @ßÀ@ßÐ700Ð7ô ô }}@ßÀ@ß@ßÐ70Ð7}}@ßÀÀ@ßÐ700Ð7ô ô }}}@ßÀ@ßô ô }}@ßÀÀ@ßÐ700Ð7ôí—³¼â¦Ii[âm_HÚäÕG×ÞÁóã9Ä·°Ü{]qi[§t’'—àKrMɸ²½DumÎ#,ÿnMÜÜÌå·ñ­×Ÿ%,ÚµµX;|òœr|ÝáÛS—åÆ/Êž¾ùâæ‡Êð½;'ëØ‘ø…Y›î ¹ÉÐgSIJ\¶7õÀ‹ügdzr@ß@ßзÛöâG< « ùÙq ·Ä¥n Š£™2žP߮ۿ“eíËâÄmyD*UîÅ;lsvòyŒüLœðŸ:)Ø6"cGžyö›é–ñPSÜý,E‡:3ø^S—F%¯ô ³0¦ÍØßœG‰$Ž4È–îdËŠÙQ“?p!‡mº%>-#|zŠ«‹5ÝqÒêÛ࿾ o¦ocú’;*_‹pÒ¦»°cOä—ây¥x¼—i@v‹5—µð¡xä·éçqbsuz„gíg˜Ù¥ß!uL—¾a„|ÍwaØNËxJþI†ÿß”»Œen¾ô*B!\µË¥,ŽÝ¦]‹-Vd—â9ú6qd{9>=Ö…Å›²­Ï}úú€¾}°¾Q¢´vY¸¥óæÜ2<ûÜ5K–OV)ž6É‘Ÿt3ÿ ùm~I¿×Ü{C#¡Tž®œ¨ŒÒü!Š¤2Âå+ÙX3’¶‘Z÷xÐaýÝì×ßÏ/!=ÀÅ }xáçòʤÎÜñsOJ©3µB#:³Ù·šXlnúu øo oèÛ‡ëF ²…¹;8¤\ß^ŠÏ[2É)$38x·˜kÉ_sO5h–uá>‹c379ˆæ¹>û)NõUu÷Oï½ä1-V\CÔ.›åË›t˜ˆ"ÿA“µ%{þuòøäÈ÷´Ó;žèTK,·XàÂdÅvå¾¾ o#Ö7¾ÝÅ?Ú# Ê# ÒÙÍÙ‚½á.²½¬Ëf<õ¾³‚4_7›„üyÊ.'¡ çMdÒ­–\’:f:õ-ûîsRß®£Z‘&ÇNàÆú¶f×NŽK Åîk'éf7<ÕšRßbAß@ßзÑ7®mJîý´]·ÒvÝN/¬ÊQ*̆m¬,- ƒnEÍÜœá³1·\uÕ–3,+¿ŒGxŽÚŒ€ÿí¡ÀšG_p²[«àé´G™C¢•€áÂQOèèúú o` oèèúú€¾¾ o` o oè耾¾ o`` oèèúú€¾¾¾ o` oúú€¾¾ o`` oèèúú€¾}„åayÅÝNLÞšhn)^ðœð Ðür|gNü»K¹çižrçjïQòHž{"ÇŒ;]©o¤ßµ}àÌü'Ê}až*¿"w¹ÚUç—`ú6ÛÕcÆw¡=&wY]¿g»}@Þî*rû˜Ê vT'ì(#c§>o/¥öQFúl Ò§ÃnFú`ÿmËùb–µö#l«ÒË«Âç̲±?íéëÇâ9NÝùŠ¸m7ë}¼Ùö^NnžÓV¤XðfPþÛÖSgܸ6®¾<×'iO^9žu梥oí„ðÊ2ZY9­¾ké›[ÂOW[[:Ûy榬}Çl쬹<'·‰‰[ã®ÆQÉYž!S\Ýìæ­É^ç>ÅÙŽåµ%G¹SaÆ¡ƒÎö [W_>‡ã–¹¥ôÒ±}@ß>ÀJðÙ íb.>ÒÖ‚4sûÕy•øü…~\»‰„|ånÕúÙ–n«ò«ðùsÜl&fíx†ï¬ÂcÂ|¬ì’ˆrîwÚZÑ÷uŵ»Bäf>qM-ìâ”H~ä¾íò Žô¸ío5vô#ômŽ7×>0£'B[º ÒÒ++¿OßäMxk„ûçícë8e/é¼=îâÓhÜØÓ„‹¸§²ÛÙÜ0éžs¯gŘ\ØGFZ‡y[zνÿÙîô }¹å•á‰Þ §•žØ ¾¥y;F¥:˜ù'3ÌÙ3rªQöøàrj¬,kûsþLBß2Ï^csùkεl¸Ø²áR{ò’T{ÿô<嘞·+3(8Àiêþ¥CÆßf»¹O*¢ÂÏ=ºÂœ·`Û3|áÚöþY”äz{qskòˆ¾s‰ÐÊ>©HBϯÀmþ_ˆ)#µÉz@ !Ë‹Ö¯°ñKÎ/ÿ @ß4Fõ·ß«æн¶”jë›SüêœüS™æìé¹U"73³¸¢ УÙfÜ9ø¦“ÇÙŽµ­ƒÊìƒçRCÈNf^*ÝÜ$ù ¢íY Œ¿©öè* Þülm}cOÉo ¿-ú6ý¼T]߈H9<Ï-Ūý —oÉäxÇmú ojë4ãvð}ç“ÎÏ£áôð߸㠤”*nÊL§ü·¬ówÙ\ë-0ÍÕ&„FuÛ±Mæ®\få4ÀÛž¦Ë}ØëhE ÙZKq<1Îgbziîc$ÊÛÞo}Y~ãá3»(Ÿ½‡ÝÓ–ïÚ|Õ«oëfÙy¯ ‹ýÉðú†ä>足¤GîjWú |­ '®­‡ñ7}S·íå/óÑón©þܺk¶!kq^>w®Møi•¾X;Î4vÛ3<ûnkh°Îä;ú/Ú™id¾MYDÛ.—ø¹°8\ƒ5qÎþ-Oð5[R-8 dÿñžwóßhܤBqöÝ*Úø¿/»¢ ômÚT®Ó¤+*};¼ÈÐrú¶r<óômŽÅ×%ã!îæh”˜S§Ô7¡ó¸±“Ϫômýÿ>ˆI½øØÏۑ÷fsì#V]%ÂÌy þ€¾it$wËÛ0Õ/ž«Ñra„ßµ³\µâ"§„\c–ûS­«ÄÉ’8HyMäù•äµÔR´¼Råª6åœ)Åö§dP;©¥tÊðw †ÿd0(e •dJv¨‚R]Nè‘ ÀÈ žR6°èŽHLµèÖ÷èèúúú€¾¾ o`` oèèúúú€¾¾èèúú€¾¾ o`` oèèèúú o` oèèúú€¾¾ o` o oè耾¾ o`` oèèúú€¾¾¾?;¯Äõ'cWZüê#ñkÀ>Æן€ÒûT’’ÇåñA߀ðΎŽkW._»ª²[7®ÏNš ö…ð©,4$xÅŠ‹/}>!Û·oO€ß oèú oèú oÀïƒììì4øí‘ššzìØ1¸CŸ3£ÚÓÓS|"^¿~ …ð©xõêÜ¡ð^0ò“˜òÿpŒúø—øàK×7RÎDÄ â?. !ÅàKV6â_Žârâ³B‹ö6¯[PpìÍ&âÀï¼a8‚+ζìM}–Rï—Ü쿳itOø2DŒúÓ:¢ú$Tôo®›½ ÁoAÝÄ9)/}Ë:@ÿ€/ÁL†!¨Jê0 Á0“7*êS_ú¦ÖÌí» ~ÂþÆĹ(¦©†¿½>õ»ÿÿ «4¯‘KÅB±UH‘êTÞ/ãÚ/ #‹“‹û…ÒˉX(Ë™D$’Èôœƒ D;%je +_Ÿ¦œ›¯>o?8٘΋…T b¨¬¿_H4n©X –*Fr¡îÛD=4=çË$B‘D¡¿Yb“¹òÍRY ȧ«…½g1T"鉥¿H¤ L€ËpDª*) GeH‡âÍœîó“š=6½œ'Ä{1E±ßúÐÛ¥yne~çmŠômÔ¦óÁ )ý¨Žë(}cq+ºeC¾}ƤMU~šX¿}¯«÷¸jEŽ“±!gjgï£+‘¤ç&Ëv¡ž€õ^Õx;Ï#2W;y²/ÛD«™è2¥_§¾áxeÑúÀûßë6_ª…Ö§§‡ê›V³Ü3Íó™j\׫ԦϳÂpíÃ:ê@ÏcW×¢U øˆnÀ!§ê\K†i݈õûLÌý”^¤¼û%›ÅzÕ%ÚÆ~Ž¢ˆ1ÑÌ:çc-¹T÷”¸WÖD,¨ M­öy®xNtÌ!o¤Sñú¥wö¥Û±¬ÜÝœN<ï!SÔù,n¢+ÇÙ7ÐÇÙÁ7âQ‹€l'©<ÿy‡C’gO£ó÷Ü«#Oñg09Q±›uâíwc¼ìl=&z;YûÆÍPð|ÛÛÍÞ¿<6)99Ì齊x¨nžæC§sƒ£b j‰çV}ôßn7(ZJ.œ)ïµ–,é¥6ÉÆâZ7Ñ8^Ž3eµÈPôQêÞ2æÇΞ›ìïĈ˜±U¡\%ØSvÊÚåèìïësloœ‰¯²! j¦y²}ü=í\bkzd8Ö5ÉÞ(ýdƒ²&û=écö¿Uo%…[z‘çWßo"ŠÝâðþÊ2mÿŽ°w±§‡—=Ó‚çÿ\#’θW&Ã626arL Î ŠŽÍ!ï¿8i´Ï†´©3g'yÚЧ.ÞG­iÔÉü “Åûë¨ÏmGÃþåCº7§2bR÷°iìÀµå«Sþ8XwaÛ?ÙÞCC¨¿šéʵpuw¥ós/U)¬ÎÙ1þL;`w'ßcÅMÄi廽™“OEGÄ%ÏecÍ[Yp i{ìçÄf9„‡Å6ˆu•›®ª–yºÛò­]cã“$~f–¯aé^ ZÊwßlÅ¥×Éìd/pLLÝ5ÑÉÉÛÓÑ‚ë\Xú¶÷ö~W;„©ó ×ÇÓÖ4sù’Ø©s"|<¢çU^0uVr¨3Ë}Ê6lHhÕ‡VüÓ6b¨ÿ2§ ÐÙÉÇËÉ‚m¿ûn­z³œ:9ÁΖëæ0gó¼ÿÅ83Váʸø©3c}íìýf5ꯑ–C!T-M£µø_¦v„/"¹1clpþ¼ ;›4\öšj–D[rû;‹EZ’¢³Yn˜L›’ù G%›¦G1­&°¸6«÷ÝDÛ5jATs3ÐÝÞÖÍ×ÛÙÚ- ¦¾W®ç$¼áæéá>tk';¦ùĨÅJÕª»žM4¹‰ÁÁ\+î¤uEÔØW}œ‘I§»¾$Â9ý€J‰0ù,{Þ†ûMúŠ÷£]¦y5>ûZ× Êa·Ü· 4̬v{./%ÔŽ”P”øŸ!þù…}7ìõ S3ÏJ‡©÷ÁFZ4!.[¦9…-,¤Ny¼5ÊØmñ}áj/;ÏXê`ÓžDC¿LåÇV{S.åcM÷â¥ìQ=¬$;;¦\%Ó^·Ëxœùö§bʽqäY>¨âòÇôq.­ª4Ȫ+*„2LÛè9ga;Ÿü»ï•ÖìT¬43´8W§¬BQ“ÍiéN eÍÞvG%‰v,Ó ùć¼Ù!iT%â·7„Óc¶“wß«K †;á7ž˜ë¸úŠÆSXãÿÉ^ÇëÊš6ñþ);`åyê¯fñ[Ÿ+‹c‡m*™´’ehOõ»Å·æX›ßlV(¬aѹeD_=,Š`,/¬§>·Ÿˆ1$Ý›ì47»‰I*ßözÒ8,r¸©¿£ây­vkê®`˜ðî(bìõScO"¬[v!k¨SN/7äÇ™yq4œÃr |¡þ[[Ç:n§ lÓ6•:Sg¹é¬úG…I^‘Ùª¾ZKmu}ûÐ|e§ºÛx'P…øh]€QÐâÕ¼ÄàéÔ žÖaëÏ)ÇZ›mL-\—ÞVî˜`bx¶];—ÒžÖŠ—õÚú¶ÚÛÚ%´Ÿr£·Æúeh5Ë….›O)»„ý5V̘‚ª’IÖñ+/ë«‘·G¢¨Z £n{lÌt#ô y’ji¼Ú@ª Ö;Ð,q¤¦òY—X»£ª³YfÎäÍÊ®5?dðTM®çéì…ÛšµpiïòUy—Teê¾û¡¾Z8·ÚÏkªj8e^Í¢ñÎGt#Þ•fUÍ„Ûçß$o5D&¨¬¬&\‚Íq§ç_H&z0‚¸Ÿ,*ÅûÑÌ{á½£m5á¤Ýh?œþ"l^ßþS8)l ç~iÿíö–yöÓWiöLºCÌG﬈[QÂϬJ·ˆÔsÔ½W¬ÛO>Úe DCzJtÔ;[Œ?VR_CðºöÙ½],úDJêÛOVQBJ´PÄÕžu±ªÞ£º4 û(ËŒÏÍŽŠUcød#×ÐR{:ÃÕÓkoïÀ¹Rߘ ªyT1"}SÆšh»ÿ^»–¾±IU¨uŸ‘RSã8Öüj·ªT»/$*:š=Í,œ<¼ãéâùL@ž£è¬´°bĪù˜Y#e¤•ó D{‹VßƹnˆA¶ØÎròõîÓ7rðê¡–ÿ¦“ªËÛl¼c5G<{‚M³^ žÒh6zWƒRß"©ZØ›££µõ­qh¹UHtWýˆôMmüC{úvüåÈ÷…ÑŽµ©éÛó‘éÛðÍRSß̶MJE"‚~X°Â::ùCõÍÐq%2"}ÓÙ,)}«Pº ÍËf„º8Ù›Ñ6Ÿ.Ç5jß“Èv -T«  |¥»±/ÑÅ3Ê~¦zR« Ï¢fSV𹬧­â‘ _¹¾§O ̧DXÐ6>ê«…Å‘Œeë¨T¼Î PÓ·:õMk¸¹åᆋß`ÏZ,""’§ÛÎ¸Ô¯Ê úÌf4íš@©oÃè›Xg¹ «oï\Æ¡þð°ú†}˜¾é‰åƒôÍ‚Æ{<0Jp.+ÙkòJ}5Òz4ÚØ/U ²†»&,w•¾9¬Ð§ošÉÕÙ,õíÝý·^µkS†©×B³§¡Ñ‘ÕTåd¿TŸ¾á)ÖcÜQ¥£ID2¤öÒv–o´ú4¦æÖÉ©Ý1…·M•2DâÇçœzÙõ)用{zW¥Ö¤Õ,ªÐ‹´“ë@ÈÁ8ùœêFd¥÷kŒÕ¾*R6ŽÍOŸFÔãþ%až“VS§ìJpã$êmHò&{cÖu‰r #Ð%x™êIqm]°ÃôS˜>}?dŒ¶VÍŒbÂó§Nvˆ4d«Þd²×jHºõ _o½øå´8±T‡–G¹Ä¤«Ü›‚ÌPr¼úɱö~sˆ#]÷VйԔraGƅ碡EóêÆékÕ=#òßêwX’â%+gá>£Y˜<$]PQÝUǦYª÷ѵyŽ÷äU'(Oo‡e|@Ÿ¾ ß¾:yñ–v%Jêí -WÞè"oâ{™cMÉ(;6—ïCreý« ²/¦[ßžl`1ã©f=´ÜôêÛÁÙnËT[zûìý#õßr&ûÅmþÿ­¿±òÔåû#òßÔšej¸ë’CÇßìgP“ãòÎãgo×;;/«Xka& óÖXºµ‡~}S\;}¢®[{ žÎfIê[Îó–âmNsFƒnY:¾Ò¨a4môæûdêe¯ŽyóXÓO*ÇCtäôö®é¶>“¨cñ>ìUGžàÒ—öc-6Ü¥š.6#Ð&û"éJÈ…mE§ÏKÉ5o|¬ÆçÝ%[fý…åt ¯¹ÞâýÈQ})êÉ#º¥ó^•ˆ®½ëYü y›ËÎ80¬hVN!sžw*—ä}û×Îd3™l&{ÒÒ=ʇTÁB®ßü+ªkJýÅlºòYƒ_>ÖÈ<,÷.oß–C§Ñ˜ FLê¶.å(,þ:çφ¡’}ãÒÆŸyÖA|Ì™î6f¼ÅœSm8RKû×Ýj«?©÷…³ÓÎ ´½Þ?Ž³"'ªÊýÅ"IÕŒ$m††ÆO;•m ½r†Ÿ‰%Ã3|Öë[É·^K&W!8¼iÃÊ’Å Mœ²¢¾OŽÕ3Ë.îU=¡Ò½YkÏWO6þ˜CCÇÆÑ-?ºm¨Ð8FFjRÖ¥Ò7²@æ^P&¸/ÚÉb¼‘å¹×²½s}ˆ|M)l"ý7ïÌ“9)ö|¦…¥õ®ë¯ôõˆI}j~áÊåÛ;‡O[ôúæìÿv$Ueó Fì*ÕµàRÂ_­×jÏo3t HÃþ••%Ï3æÞën2TTvaÇR>Q…LfHÒºÆ>²„«öû˜ù¨ô­ñÀŒö&<Ò½ÆNç#ü]Çë=‹—ˆ*ê4ùl›¾%OKÑtä†ôßƹmÉj«á—f Y'[ú¾Þ·þM½ õWVWX«ê‡Yž7Lô\¨1 ðîBí@ÑË«9'+?>½1#zQ’W/tTIC»äƒâØ’±OÅ«®p(r»ýÌúºYä7 îwˆäÉFßiû4ÚÏÃeAÁZø=k‘@q}„aqíêO“¾çÞ´k$0`röK¸#V‡”4Åå䌆ÃëAø´ojÂÉ­±Pù»#¸“¡ŽÂø¢S¾íM¡ÚÿT‰CTŽb?Fà ößç aäσb† RTA8t”_0(&!ú¡ {÷*¢sŠI1ùÍïæ ð®þ¥èìQòîÕHˆ ëíÂÐ9à˦‡eÛh`€ãÔ+¼Ikµ´zëê Þ_:ýÿõ×>ƒï»V,BQ1F¾ÝéùΠ‰T<æø’»§¸n)5JdhNn*ǘ,É(ƒö¯ÿ/ìZ CÿÁ>eØÐm~f¤C#øèðVüñ)Áâý™‰Á°!ùÒ¨B]uE¨c}dh¨¼Bö36¤îYs$ß ÐÚz´§Mþ§C¿ýJ|AÞ†#ýo«kÛ?ô*y{MC»æNîò[FùñQkåøÿ{¦sÈûo.»F^€ã¸ü+M“~õHûôžåÆà^ó0Yè«/ïûFMc\ÿµêHíg­P­Qæ)ÀzìÙ×øޅ܉ƒ;7 *î-¯~3¢E-ãÆ›¼è%·{jxTâÌüiôXKï‚ËåÊõžò+{VòéæÆFF¦&Vi¹çe/íÇz_Œ3a kóÇü›·jc7¨´ÞÊðÇò6r/µë;Œ362UabdÁIÍ<ÚO.CMøilÒÎÙ>ÜIÙçAv>«4 H‡üƒžud8öõ÷Bƒ¾«×PTñ«ø jêÝ>iè…•‡WE¤ÁumÕ¤ûBå‘Ë ƒ×{¢ù§<á{–Mº#î‰;ôq3Yp£Y÷žAj™ÒµM–®H‡àÎ:ZüV_È £=úÑxD:ýaöŠÒpUÞ·O6ô%÷Ãì„õî"lØA*¹VÑýZ{ŒÐüà KØŽ¦•2ñ[‹ûªO†7¤Óòo‘{M ^]±å2Vv¼Ú9ÛÂܪ8ÉÁÇ¥ANÜe窨kߔ췛°^ÑX@3ölÕзF[¦Eey³ÜÞ¿Ä%|¾šJ7Oñb'å1W]ÍXSÜÙú8;mÇ5]î$ðKÉ ‚áÂ)SÐo¾éþáÛ®o¿2¨ùûdå òÏ*³8~>w¡=—åàWÜŽR•/{óhr ›ÃõKH{£ÜK}ºÞhÂÆ®—ç¼í9|k·ý%ä>ÂûX29ö>ÄŸÒú[ñ~Îl/!}‡| ¸1o¿hZ3ÅÅâF§dÇJ—z1YäU^³×÷O¦mbÎ W/!Î_BîìùöT´U¨rŸèšƒãg‹Ûïºð¸\ÇìëõTº{ëî¹Zó¬Ý Ëûcý(}Ã1Y_ÆÜhë0©¢ÜŒònA’ëÄùªÝ~†ihW¢±ü»HÉ Þ¥ ZE›vùúvêiý¶ÙA,67r¾F|S2ŽE[rØl.—;å|ãÜæÖLžÀæðˆ3å¨Þ>òò„!?jð»_æ¡»øÛ[&6!Ý5Gø\öë~|NgË™"][½Ís_k…ð|—¿õì»—óRl¸,'¿)U}ª¸ú«Î†zرøNëõbò>[kNÍ«^|‹]·É [Šû»Xs8¶iùW¨‡YGÕ¶½«˜ÜöW£@:Ž'º¬%7°&ô-zùõk[çðx<·9-B¼ãjž…²öyÖ.bÀ,zT³$ƓŵIÉ»…£sB]™lÛ¬³eJá¤ôMqhnHXÆ™Á‡Î¥É|¬’ÂÔ˜i›‹wk†½3!X¢ÆòN¡ª..±Ÿ~¡}Ÿ¾9‡ÍUoÒuEæžä>wWæ:T÷Êï.:øˆÈ;ºÎÍ8jO¨ÛçèÙ!ˆôÊe©AϨßH¾%¹|Eˆÿ¡Ÿ«ƒJF“5-ÀA~OOwcÙSºÝ+1Š÷_³66?\ÒÒÛÛûüæNߥS‚â/2̬˜‹wÞ Eíuw9LvC‚*Ð]KC¢çˆ"EÛy®9ý΋·½½}ç²fÛ'©ÄÁӚ뿸¥_$w¯ó2 ͯEdÒä§Uûo‹Å¢ÉÝÞµ±à~ñA¦ 2ŽÊdd‹m9i¬ÜøûÍcsƤ5çû…¢þÎ*GºùýFÞÿ˜Gø%­D²í˜ÂbZ(õ­=Še•tàiwOOÇ«s¶V×Èž“`Ž­Ñ²;¤¨M÷g¯?U¥Yˆz¤˜¼g˦­íõÕDxŽñe-ݽ]Év&A95êY@z_;[q®¾é–`ø¬[¦û´¦~‘Hس;Žc7÷¢¾¢W¼<>†1XÏQ^´wÚñ®{&œ©ymD"’B˜™§ }ÃîìÚ°÷A§Vµ‡CÙ|Û‹ÏšDBQéáUfÎ ¹gûQ–™mI][OoûÂ`Fª+¸BhÍã8û/kìèÉñêK›9¶Þ í]=ÝÝ¢Ü','}oaÛóMYyr¢£¨Q ä"ô¥ž¶‡Ÿ’›/®òâØúþ¶««37Þ7ãéÄî˜â²¡¿O@d$.ÐÖ&by—HÜßô„Fc:ú.jëÊ:ïÚŒc‘Å?è¿i8áè4{^úõzáí F–6ù—ÌtrÕt>»‚-¬_}Ô·ëyó­#fdRñ·\Fíˆ]Ë_Wø¸äç—WÂ#{*þŸÿ72ê{ù¨?Õ}÷ŽHPrÁ/ú7 ìñf^kD•þ ú¼øA£¹ž:‘;¯PÕÀ0Qƒ•]у¿ÌcÔNuhä>õð€8çàêð¸´Ãĵ…Q,ßí¯‚mw6d?Pvp<8yä¾íÊÎì@^D!ñ)%Ìyý±}/M};:ÆÄ£aà̉nÌ£Åm¯Nl¤L¸ ²7+¸ñ¶ùæn+ÏèÁ¶%$o»D|¼}`Æp{°sšmb.2L×DçÍ”¾yp·\y¡ÊÂ^­,àò6KÎý>RgEðSó¯Qa!­'™æîŠÒ·ûãM¬øú¦»ˆj„2mfÉTÇ\ÆXžêµWMe¡¿½þiU-¥o«;© «—:›mð7ÏécÜôõ¦Iy;rè¯û0¥¾yNßN%}œ>Æ:ÈÙ½ý3<ó¨ÓãxEÊ0áæ´UOUŽr²Í¿¶U`CôøO¸4v‚mÂ&±òyòê~Qü{K6×Ó?<=»Už#}yžæAÖ)ò>}ã¹øfnÞ¼iӦ͛7¦%'ZÓ—vëéñÃDÃçñßd²Ç%=Ȩ?)Fý€?¯@埳ðÑ2¾­\¨ÑÖ{Æì¼98–±Ü™w®•5š3Kuc· û~c¿š¾Igr™;'%ÎÎŽfcǯªÂ¨ÎݱÁ«GÂøaûPuqЃº¾¦‡‹ÔºŠG¶ÝÈ_è’¸dðäh_FÁͶGGÖÒ¹\§84K·”\ꄧ¼,,¬^ô 7ð¢>þ¦# êúÆÞt²FÕ<åÑ,ëE¦o†V¸n}Óöߎ„2B „Ðo5nM•<‰ÇL½Ó¦“²²šTw3ÐÌŒ§ª%¢šìÇÿsì™ý³ ­§iöË)I"Çß–´ŠŠUcøóåZúæÏÞy•ÚÁ]mN?РÐœo÷¯-eˆ¦¾YçLOöÌ-gÅŽ:>ËÖîîõSqNVëÈá²{ûS“O ê[›†¾5©ë›µ{Ðî;r‡šÐ‚ª0Êö«š²ì[ÿ9Zòí(äûQâ¯ÿÔ•¾ Ep†¨ÿâþ—çµ£™Iq·Æ0óö/ÿ­—žç²d>söõ·J}KÒз&u}“/wb$Ý /Ï?‘¾ÝÛµÄ>6eÐáˆp·*¸ÙZq*Ã&dÆP§ “wN¤YN ´µ§ÿ¨¹é÷dA©oTúÆYw¸Bå¿õÞåZ²›$ïÓ7e‚"=¬õ­säú6!w /Ýbl´í5ºÂ™1éü gEYY”³MÈ`¬…á¶7#›ÁñÒµ®1GëðA}œ_Ыo #Ó7¼»ä”[ôÜAWªñųnòÕøÞ}ÔÜ<†¨ôÍá–™åÊÛ¡ûÛ”[+VOv6úð¬¬j•3ØjýSòÛiî´´}Ag~½¹Œ¸ž¹©ò¯ Ä_Óõý÷ŠQßµ~÷†H¤¤ò}.}S¶ë(WÚ–óT¿R˜`9ni‰ óØ,C‡ê¾Äõ,&ûa‡™©OßbRI!z™h9q‹ª7&k?tð:œ8¸¬Ué&ö‹dȇè[K÷íãmÂUýŸþbGºIÁfÅëË&t†¾×¢¯;É{æÒJo÷ä38ÞéM7¾X#&Ÿ/ YWw®5W¨ ¿ò~ª÷dÔ7ö]e'nV„m`Z¾jâïÌtKÞ±¾Âo>?Ör‚Jʵ,ãw:ôè›î""ôÅpn§ãÍE§—8^½u¢Å„,ªî,bM˜£êú†™kë3÷Œ*ˆ¾ê㟒‚ÈûBÍ!‡&"™ì’. ÕPôèÛLÏ°Í¡oäÛ%w9šáK[ºÿ Ù °w&ʶýFº©ëJ¯±1óíéÆš#Ń¢½'‘Ë ÜF¡>þFöjKòŒœÉ‰¤!ÓÇÊ’„_ý¢ÚFúoä}ù_S|3ªßÀ@~àøkùׂ[p.ÇŸ15xÿý-L++Ÿð„ t×) e“Hp³q÷_š¾À‰F÷L9I&w¨¾)û§·w¦[ñì''Í'|ÏPg[¶[pZj² ×20i‡.q¥ÄaÏŒPKÏÉ‹·IØäjæ³õùP}3зŸ´ôíA3‘‚å~4.Ï)if"‹éçËÛ}tJîäÄs8œ¤in|KnD#‚·–µr˜@è›£ó ’‰»®£ò靖.Ôô«¥õÖt³gºæO‡Í‚,ÙšÎp ™±»rn$/1zŠý„Ä…sXþÞê^ýe/_ìaj˜\°;ÇÁ6Æχ»ïv›}C3ÝÆûm«Ñ¡oa¾‹—¤1o·R7DlØ®þqÁîV–v§ßP•¥,%Û^w•i31!uîTk6}É¡G¸²@h|­‘w½bq„ëú4õm%¥o/¯åѹü„ÄI½ }‹zŸ¾UÙB÷Šl„h]‘-ncçjÃæzY³Ù¬k5}]7ÚL^õnè¬å’É`r]]ìL–mx¯\ÕëPê[²zâw-p‹Y4´ç´ÚqlØ®Fè·þ‚ó „º)0YUµÐàüƒö hio?¡oÒ¯¿moDökHÿ û| "Z²DÔÛÛÛ×/P m E„ý}ÄAPŒ©† %=½ÂÁ%YÄwrêv@ýäÅä ŽÊÊ«ú…bt ëA*TOLD*èH1å¼eyáÝ`â¾Þ~‰¶s‚ʽýRJtzzƒÅ1F¸dT}2#’*‘Sck˜X(èUf†JžTÔ×/”¬ûBû{z$ ŒðßzûútùoÈáh»ŠNíļ/ D¾ÅDœB„蟲2‹j ',:‘d˜¡le“! d¡W*G‰€zzûÝ â Dé¶u>¿²¿YGÿ4â˜\.QfWˆ`}·’+'…©ÊR ï~†@d_yB¯P,¥F¾táÔ§ ¾ýA*_!îéQ‘QNœ& R+GT^O¯t@-E}d™íž8ˆ‘Izûê‘KÄ¢·Sì:ûûÅÊ\Ë%BHª~‘Î&¢‚§Â“Õ,ª?µQ9Ñ\û†<Áð–G'¢v€ýrj‚!ä+ßšv@ ê¾1 Ú ¡vÖŽØ÷ÿ5%©x¦P(  ~ÚA\þ áÏxºÌ eeÕhlëCb¹¶Êïv®Sß~_®ˆtûâÅ¿èÛO,ô+–@Kÿ%õ C0 .½S,70N™Êq!&Qtµ+¾ûVñÃW½àí½¿ÖÈö‡'ÑÇhÍQÍ…¸Ïsìì]µp´Ùw·ûF4pž`Í~ïq~±ß_ üb«7Tc°<ä¬A EÈ®„BÞ— xY-¡&ähÍßþ"ùúÛnÕûC€/shU[ ±Oâ¿ ,‚~[O(‘ᘓËq9‚È ¹#ßà+Eч÷Äß‹ ¦((¾Äþ)JôO•ÿ)ä ÅHä…\†âýÿü{—ÚÑÀ¨oƒc¯Áß½³C˜¹¥ÕÍÁ1€àËõâ¨Ô¦¸•Ÿ˜¡ÇüÎDOçÀöæpðûz¾tQS`†(Ù ´a¨—a øðeëù#T)¡e˜bГá2D® 8¾h}CäNõ˜ÚnÎä! —cà¿ð%ƒâ… 0Åà 1 ª@2Dþ_²ÿ†cmi‹›9låÎÊ*9“ìÞ%=uW€¼ðe#ù×hró¬çe(*ÕÛtý¯oüó_ÿ˜â†éúk/’Æt½5÷gE:4‚ÿgȯïQ/^lHÚ†LýcŸ¸²Ô"×ýþ‰-õLa:K^gÆuž (µá#h`¿WDÿúQ2ê‡??“¡R¼oß.Á×-ª÷“c_Š*ɛˋ®W}èU¢ªË÷ªßj”ß2úË¿·VþyìÙ~¼é€û_wŒ0¼@§ñÛ¯4}LúÕ"=Ó§÷,wk£ƒ÷›‡ÉBó­CÍÒO?jéô÷‡_Ö Õ*e3œÈ{©ŽÜõ¥æÊSkÞ¼ o i~0Žî‚b2sÃÿ¾\Ýó T’n=¶°m¨sÐ6ÞÈ´¼K:D?ÐÂå#Éè½¹ÿÉZH}î(;éÉÿñ§ŸFYMNÛÚ®Pi×›‚@ǵ÷ˆ;uç’I K3cs#£ø” ÁÀ çR9ñ'ºúícÿn÷V­þQimüOÏ:ðíÉAö36½,šiʼnBÿHòFäµÛÅEöÍW‚þ¨T"ëüþSþÍW}ÿ0üÌÅ ýdÔñDÓ½!uðÙ¡QiÇu<Î0L÷…Ê#gæ­?Y®ùüU, *“â…k'?ëIÜ`j4ÇL`ÜhÖ÷ ̦ã1ª+Ò!©ï:4 «%#ñˆt>ëÕ¼ݾ ®ßƒZâÃU®ŽÁ0Ík†ˆô“9M¹ÿlG‡_/íàZzvËU1U^Øä·g˜Ìê¯, ÓuUÙ±é^KŠµC–¶3YÜŠnÙ«ë¹ÌÉŠ4yyñâ1Ž+È?º+èFôuEJaê˜hµø ò,Å'Î¥Ú¾Ò-Ó8‘䙳\ˆ§yrf¤¶&ï ¶²®%.j, {¶jè[£-Ó¢²‘·ÝˆNÊÂûªÜg¡>â^Éïñ™s½È׬äÞ™Á7Š¯ 3ý¬â†÷,ŸÄ°4gÚM8û¬*úÖ²sA.<î8qRI³rkà’åsZ^s¯Àݎäs3ν Îl(˜kJc²YLkP✦âc¹V–4ÿ©«ZÅ(u ¸ñ Ï?(M‰òbÐÞ Ë(^šînE\Äbº'­%Ðkm~rÞLx€²ØÉ›‰x–ÇO"=¢#£½÷’Iy¹ç³ßVòuä2¬˜Ë=¢RØTrÒ…mÁ`Ùg]ª‰¸e¤]µ‹b}è ×)ðJ%©H÷÷%1&Q7>òjŸáÖe;ÊKÕ#E¥u4£Ñe­:öw>v§tiŒ‡¹™¹gü õ,xÍßt$”Éæ0™ÌIç§zÏ8úpA„‹ÉôŒ_Þ-Õ»•­âyá™Mü.ÐÁpÏÍ6¼ùÚ[x5<Øjia^Ó‡Oò5^¢ŽH×zÛ¿»e¼Ô ¡*×Í<áÒ5Óù&Ç1èN½€êQÖÜØíÎg˜Y²æm-"uHÖkinRúàˆÅ˜ü›ÝDhOOoqâÒi–ŒÉ+÷ ”ZÐþ¬h¼G¹¥¨FÞDúl¹M|*=º2`qãc—æ8.¹¬ò*÷Mc.}(ÃPatýE߇TùªþÊ‹ù®|&Í’·xgŸÃ¥nã³ÊTû¢®Kt IÛ'k¸Í±D0Í—Z+õ­¼¡bŠŸ™±iä¢] r#ëf¢i²Ù,Kcó[OÏýÜRqÔÆmF·?õ¬­òB¾«-›Éu¿ROné;¨ou Ó•¾îÐ2Féס’.›Ó*Á,ˆN\O<ÁÅ3ìä¶× reÓ–¾8KóŠ!]LýúVrÕÊcõ=Ï/ÇäÕ‘^˜îb¿ëáÀ‘µÕñ׿)F}ÕóÏÿÓüo–}mðÖÀ@ÞÝ òÏô‚re$KÃ=bÖž$›LëSK†u¹ÁÛŽ3Ç3n6“Öýâ4‹Ãk!øËLsSÓÕ'É]Ôå}/ylfmyo\—v˜ì1Ô`Ó¬kzÉŽLIár¶w´J5÷)õÄtc›Þz-Á;nY²O¶(Ï<»€I3'o¤ÑËØ|ùegFøÄÕÂðÔK"…²Uî¦3O“£<™;®×« Žú() ŠþCûöuŠ´Ÿ/žÖt§éÊý¢—»™z®«ÔÈ‚¢ÝÅ’ó Ìâ¬;š÷j[å³³íèqGôU¤âåñ1œˆÁo£¼hî´ã]÷L̘Á)§¨ãû×c¥§ Î>ÓîýÕ%ž,O[I½~s5ÛÈ6‚è­‰_ä3­<š•¾)‘6ÿ¤rÿzŽ]øÊ×)9¶ÄÚ=œRð‚¤‡ä䣶«nïÁc MQùþ|tž«MÑ3¢ôz#éÖÔÄ>ÖbgéÞLf²ÉÍÔµ•\˜.s±eÜ~Õ÷•E<¸®¬ãÚû •…}lQ”í”ćþ†l®}¯ Ü\5Î~6Ùÿ”·¹Ð­[e¨¶ÿÆds',Wî>Þ;…?6é ò:Ï‚6™ô6Û.›OÛKê°øÞbÍ"ã,9ŠRw7›ï¨ùoZŽíŽ”Ðð…d™ôÕayn&r)}’kfJ_~àüT'9þîÅÛwö¦Ï/VßZ­¬éÎéƒ:˜óÅvP¥bi×ڵȨ¯úÿôƒøÛ¯Ä߈—-# IŽ|Îý;oÎœèÎ:RÜVud+dæ@ÓÁB‰[æmý•íLߘÁòf…$e%ïîçL»³+‚\žnDÃôöO=8Û¯¿¢>WÔÊyZrîSúÎKßy› @ÑqeáÜ&ÿ }»ohb[>°Ãñ€¾é.¢Ú#¡LûT™êx³çXóÂ6|7Q ûk¨,È%Âî>RßØ'_t*/’¥ØŽ]tðV,ãŒv¨Ñ×›ÆÈ ¯ØŒz!Þùäü¶£·KéÆÞÌëÏÛ„ÅœÐd\SßFVY„¾)–;ŽŸucpí9ÿ'ëJåÅ'¸-=lczþ•˜º¨(¹üIÿ}ãÜx«òÅ,sŠL¿¡Ô·\BßÈìÛ.5÷TYÈr ¹Ï%ägAí=†­‹ Å´ôJð†Iÿy}Êâ¹»Èvú%ÕN÷}Me)±>4ÇÚÎ)|Aõ¤Øb¾U©UïÓ7“%CTÑÛÑe` õø›ïdć¦rc-ä3f-ãÑË… {m°gìΛƒ±+\˜±gßú6š“¤ºY•·ÌýÆ~5}“Î ºh¬A˜ÆcÆ-¯À´¯ž ã‡íCÕÅAúF©uŽ¨ë^´ÔÓmòN•kÞxsMîyRd¢Æ¦fÍ!¨ €Á©è‘éœÅÅ÷ô‰ªÜ†Ñ7=•Etr7øÙEnU©ýÛ«·ž ¢‘u<±´´#2Uµo>;0]NÝ/¨,Êšs¿‰ÈZ_]Ñ&@ôê[mž¥E y´ãCý7Eoo/20ÇùüâR—ÉÇ©?æúsff]"NIRΟVL2ÌÙ‘¶p×S\µ•'éÈœ•uFõ¬·® f:N+Zjâ®·o:ú÷‡¢dSB+ª; ß~-ùþ+Ù¨?ÕŽ3Á\D8od)cŸKlqyÕaW>ÃÆÝÏže»œ’߬y‘<;ç©“cyVœI™·ÉC/6ÿƒ1]6 oýž²úäð :+0r ‚có¢üiÖ® q‘Ö,fÒšSÔ}1Á™F4rU³) b íTz¢ Ã:hÖ✵¶£]6kº¶3ö? Ô·#ÿ°¼e&¸Ð •KÑr§¸2,ᡶžó|Ø;¯’nƳc‹í8´°ØOÝÁo!5—·YºDR9í¹¶v,;ªÅÛŸ6aðÅCt •Ö1Í Ë‡ÌŸ¾/ ŠÕ¾Ö&l×èœò¹‘ÜYIiŽîÁ é6nç›Äô‚¬h[–säšÕËÜ|çûû°ïº÷“™Ë ¾M°Ú|ªž8sƒÝ^Y¯tè[dž«×ä)q<mÎÆÓ”TÌ÷µä:ú:óضþw{T•¥¥VÃÜèŽ~ñQAž]ÎåçÊùÓÓF4®H³@$í4–‹HOëuA²[Êöç‚Ìgy“Ô·‘WFDííJ³÷Mˆ áp­7'‚4'䓪Gɲ0Ö”ÌÔçÒå.û+} 3ùß+®õúfEcV èÛÁåN¡ /+…¾Úkéèäzùæ©Í' èÛcúOö ”¾Õ>°à9úö ퟶKß¹Ó‚RKߪ»U%hº¾ U•Xû@'Íaqù–¶®ÞÏzÅ <£ íjKߣ'sS3“fJã†/a:ÆÙ.Lw5ŸTðûžV  „(»¾­ü›¯¤_uX2£FõÈ:ë®À‘Ϲ¼wdëßpõ©5L絺–s«¯WÇ0Ë܇_Ü¥µÞv„Vß:süÝ‚s|¸Ž™òëS±•]¨ž@ôeáÝçY¡¬Œ¢º‘ôýtgA-Ûê‹âD-Ňßê‹8ª•¡kÊ´–úëXu¯sbEï"ü¡CåØÐô ²ô¯ÿW-ÃÔÿÐn-ºÂÁ0ËýÔëLï IÍÐj}(’ìµr?’¶§Yh¸¥‡~ïÃnäÌ&—wŒBG}Õùïÿ.om’|k 30­ZCÜZ²Á7&Ÿ¹j}\çEÒŸñë‘‘ëÛ^\äY.Õ5¿q šÊçBv83ùyA¼9¿íJÍïÛÓá=ç/žá³)îÞ—Iäo¿û“è«oš õS(8ÍöWÕãˆ~‰>Fkiþ¢ªb£…“£ ›n–½ólm f¿¡ßAh(Ÿµuüœµ¿Ò™?s÷”\ÿ!Å[ 1ƒ>&“<1&’9+1ø 70èݾƒ8šÓ—y `úûß?Ë®{ Bà7¥o‚Ëq¼­³áÛúsóä \Š+P¹TðoÿSúÃ×íÿßÂþ |©ýS‘TT†——` 1¹Ú !_mÙ$7ø^l`€‹E p|‰½xòÅä¦À±BŠ¡!wœ|k/!i½ßÿ^ÙëçPP|‰ýS#ß>€*÷ÎÂ0ŒÜm“‹1T†âNŽmßÿ€)„à¾ð%vOWÜP«ÊÔWØ`Íoå¥8tOø½õ]©e´Sb¿þayf endstream endobj 791 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 240 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 20545 /Filter /FlateDecode >> stream xÚì½@TÉžÿËèìÞ¹»oÿûÞÿoïÿí}ûöîÝÝ1"©›Ît“›œ3"¨H0‹YD%gsV0b@0!JNb$ç;÷9ïœ> ’ÚAGgÇ™ß÷Öx»‹sªêTøÔ¯ÂéBQ@ @ @ @ @ @ @ @ @ oC‚TVVÜ; ܯÜå<¸ ô©ÒÔµ:~kMÔ5pà~µní‘L²¾}4XÐ'ÉÈe]Fš\ܯץ”¢–{úû¡Á‚€oà€o ð ð |ø¾÷•ø6<< |÷ä[ÀÞèèèä)ŠЄAÀ7p¿¾…††î˜¢íÛ····CßÀý6ø¶sŠ€o à8àøð |ø¾|ßÀ¾€oà€oÀ7ð ð |¾¾€oàÀß@À7pà€o à8pÀ7ð ð ø¾¾@À7pÀ7ð 8àøð |ø¾}%wäFUDú㈴G„Ûyé]B šTŒ$a-F’Ÿ5‡§<Œ¼/J.Æ/Þw¡`ûÕ÷©¥ò{±ËR "’ó>C’‹z·$?:^83|ìšäR4)¿g÷¹‚ˆôG[O|0”Z& œ¸‹«Xºíä“-WÚSJ?ܸÿb!v=žªôGÛΔz8šZ. ø|ßæç6EldêšØ®Z9+'Wm¦–yhb™ü¯áÁt––¾}ŒŒThܹT²†qdÁJш¡ Ó€”r4åù3¦ }wþôðe—>sŠB¦èp-LVqM̘T’E؃ÄâˆK|R¢ÅÒ¡R\àÜ“ß»ÚÅ‘edoç¹ÞÆÍÇÀÄŒEU5ßx-±ä÷‹8àøöé|Û ç²sÒ$K-ë1§.µ=Ö‹Ùo)•¨þrߘdºé1ü¯Hr´ÉE×v{ŠŒ3iOŸ°Vh¬¿#k}sñ $æZ6•Ê^—52A<4áQ‹Î°‹­“GZ†n ÐÓßVekEóJhÁc‘óÍÁ4äbZ™œ“)Å]æzê–뮦Ȃ¾ß@À·OåÆ´5nT}¿ÇC/Ó ¯Mxz«Xï!L¸”†ªn§Ç’ËÑ•N–›²RËò-¹ ^c¨+7ÿ¹EWŠF§l¢£‹ñ“óÛ´h¬ù;·²ÜŽ¦W sðMÆ´èÔX ¦SL%:É@àð |›ßphœx5fÍXb݃ñÄÃÞØ&2#LÔÙ8Ç+ŽÀQ)ö5ƴܳC“µúH‘\sò-µZäÌYdÕ4ݨKzñŠMQÙþ@*½Æ3ÙñEhú‹R-æÖç²Xfñ K^zA)S™ºù1Ì¿ß@À·ùοq,|Bî„Äß ‰¹bo­Ï0 ‰ÃŒ¨âviû4­M+ìã0Ûïá ĆŠ¥"o{=Š&)èRWÊ„)5'ßÒªÆlèKìSFgŒ(“^6kÓT·Þ¦VJZüa*lN¾¥T¡>–ÊFÁ%IÓ'Í’ò0Iš{ž¢‰7ï‘ÉT݉X´ut˜ÆnIesO1£îN&I»¿ƧÀ7ðísæßä$)1d1}εÉýK1"Ýg8žËÙ{#N²Š.šÒúæœ+EwDmgêÛ&ÈÆ°ò)¸R$Ä“C±LK®B7mõÑ·Û7¹-$½¬ƒ«¦î{C:oÄf•RtÝz/¶CXZù‡5Vàð |û$¾a.æÎ&y8‘oáÀgÞ$F,ßä7)² æäC…¾¯ͨ–»ôJÙ¹¢~[örm#¿=yâ¯ÐôrÁš Oº&yO® ½²Ç”¼ÔãœàÃ^¸2tëgŽYT¢Œofa×NÕ éÕè‰ Ÿ;Ev_‚ÖOo àÛ|\ð&?–MèT¾aƒÐ5vËé®7“J§*‘]!¶*ú»’e›¯±DïÈ4¾åQ•—T—O:ŠÛµÔ Y…Á;wk3TÕU–‘Ô)Vkböæð¼C”éž UbÁ>ÄÞ~ª®¦qð™ÔÃÆTCm…¦†ª¦ºŠºº¦¥täý‘”Òßéæàøö©³¯R+q[kê¦Yl|šö Å2d†grz²†xÝßãqâõ‡y0â}ÌçDÍ7,þošñJ~AZ…Ì3í*QÌ¢›¾_W2f%¦UO -­bÊ+À7àøø¾ßÀß@À7pà€o à8pÀ7ð 8àøø|ßÀß@ à8àøð |ø¾|ßÀ߀o à8à||ßÀ¾€oàÀß@À7pà€o à8pÀ7ð ð ú½ð ?Ë`CäÞðë¢ý©G=öWÏëd–ÜBÇ ¤„ò/™’¤—#îÁ‘ >­9çžÓ²ÿFÝ¡{ÝIÅòã«âu¸YðnWÒí+|ÃÍ¿¸'½oÖ¸Õxì™°pä@Öû¸bùYGï7Θn_¡ÉE¢#w›ðвÛâ ñs²¾íº?rônã›ïä –~üSYø·[â^*à[røvý› ÇòEX?~·ÄˆÌØx¥6ê ?ùÅàþÛIEã²6Ž”&½?tKö‹÷7wÆ=ð |û08-FÂ}ͤU Û¶›k¹=H.GmmYVÎ <JakÑ]bªSKÑc×îP©L3ï]În6V«ÜÈÌ•„ý{&–N&›yírr_É`0v挧V¢Þ+Y&Ápþ”´éS—mÈN=¶/¥ñ¶§³8æÎëwrõté–;“*åö››ƒ‰¾M ³3Æ^w§e̹t*I“ë²ÁÂD›J¶<ü %Œo$µÎ:–Þ¦lŠºÑ"tÇþÝL*Ó1,vÓµž´ì ww;“5G®Xê1ÝÜ]lü_q²fQŒ¢±!vð ú­ŽO‹¥&ôÐk#Ö&ùfï k¾þtZ9ŠÙNÑÇ|IFÇSߢÎ$ƒuÏ1ÌmÝJf»Ëø&2ÒÕ ÈhI‘ù<êK5>šˆÝø¤RK•½³õ´åÚï{žZ6 #)ÏÛÖí¿tûP†¦¿7§/ È$ì7¦õ¡òÔrüðè]<™º[+Q;’û±÷xø% C·¸ê©ÇLã|[AÙ-ÅbO)“Ó;Ò^6i“X;óq ¦Ý½¤±‚ú¿8íÉ}¦êÒuW…øƒ?¯gSI{ŸÂøúmò- ŸÕoÒ"›áGÌOå›–Çáê™™”x>\C{GÊ›q òr«2éM¸rZ!³ß^Tb6“çþÌàè+ÁÑWƒ¤kè|³îPF<ÃЕf¼%¦xÖéÌehìç+}7X¹úZ®ôåÐVxæ%Ëì·ˆ;C„yv4+‹É4ˆ/nÒUWÞüŸ*¬@qTO³ßÔ©Þ±Õò‘²¹Ã/±>íe#Î7ÙüÆ7uªKL%~{ziS™½ç¥,´—}ºZd.ŒOA ß¬ýs2‚±êvJÅ ¾±VyM\€ó³#õõ‘ªŠÏÍ 0Þ¸ Ÿ{þR‹Bs9¶:ìˆÌõ ;ý‡Iü½š¦†~`VRÙÌu̸Ì5¦wtÞþ[MQ¹íVìÅ“|Ûqw”ï±›wLv\ᎊzÄcŠ‹?,Nãcb}A!ßVÆÉ.Àù¶\go±\+ã[ð úò­T`Aõ¹Ø•Rò|Kyƒ8±—Ø&«QqÑ,Ùø´¨[‡¦¼å®_ Àù#NMÚ§–Ž8¨¸¥u›è‘Oµbÿk)Þú0R…mÐqÙš&óL/©7 /™ä[pV/a7FK`2ÊÇM‹/ñ‰é»#™{ïà©-#¶ ÓÖO§ð#ç|¾~|ÀSЭÅ`|"Â?”o‰¯ÐˆnZº¾q‚ÄâqG*‡˜CÝlÍõ|’ŠÅ /ù!kL)¶É•høÎ`]»]8ˆîœ¡ªšïdž„¥Òð-;¼S𙺽ч¨ÜÕñE’„—7Gw]]’ëÑÖÄçøüÃò`L¡4©hØÍHE/¸㘟«¶Ó΄"qü³Vm6}ýÙÖÔrñ†Mággî™ä[a«Ž-({,¡P’vø|ýí·ã7ïS4Ýâˆq_9º5€îtû`mAr;ôJη³Uèá ¸©6àN¥9f2o¨©ZÄ`£Z̬*nܤjÐhtÛMb_" WNª©ï/”ýµ]ëe¯å•^-õÔ]Æ -OÁL¯2QÐ/Š&EÛÌoÏCÁŽƒÛ5TȾ—»¨dµÈå6æzØŸ,ןŠ—HE!Û7ÓÉ4&wí©F|®Jà@û‹ñ¾6œo×+“VOòÍÄPÝ;®‹b×¾` ™d¼õEƃóÊjö|« þmœo½LÅ»aþ úmÚo²åÅ ùv |R« M+— úÊñ•Mù¶·RÙ5²á'æ‰}N•½,0é‰]ƒùcži²ÉbžŸø+KJ9šŠ‹o»%Vˆ[&ƒÂã­Ä¦,1S‚’mŸ“'Læ)çâ‘N.4$•|ˆ OùÄ5Dˆu[ù²Óˆ={²G&b‡ý!  ¾€oàÀß@À7pà€o à8pÀ7ð ð ø¾¾@À7pÀ7ð 8àøð |ø¾|ßÀß@ à8àøð |ø¾|ßÀ¾€oà€o ð ð |ø¾|ßÀ¾€oàÀß@À7pÀ7H±Œ]ןz#?h¸_§K¯B­Ö Ý |}’öî?¸vCèÚ › ·~c×ÔŠ¥cîg8¶žä×uš44àègêĉ‘ ЯO;vì¾~¦RRRv‚@¿zß@À7ð ¾€o à|}£ºÿ~"è‹*!!2á‹+..ndd,hþB2@ @ @ @ @ @ @ @ @ @ @ @ ÐgkúÉ! þ G#€@ o—pÔÄØ?b±D8‰6D*FÅØR)dú–'EŒmR)"ž´ß„¨@,c€}ÓœT„H%˜Ñ&úà)cÔ"`¿@ onØR„‡±pÒ|üù‰X$À¸Y¾eÄI»Â·v»;KðÏr  ss×3ñ‰9È ô-Ûoãús¿’’¤»EŠˆˆEÔ¾ý׎?ýà¾u¾ýÏÿsTéýk¤ˆ@ÊGÅ#JJÝJJ°C}ˀ×úüOÁ%Þ?ÿ›óJÚÿú£`¡Òðÿø_¿íÕdfN “;?LD"óÈÁ©|röÏNƒÂtþò“È”‡ûÕWddîlûܔϫh&wŒþ÷ 2¯:Šüú tV!_+–á{F•”ÄJJÂìÒæ7ãJ %ß+ ¯\-þZo:ô(vwÚÓO½K2Úîä-šþè¹Úiù÷b<]¶—õ\ߦ‹Ž¾þÏ%ê #¢yÞ¿”ÄíýÌœªÓþ·%Éõãæä¨çÍs_2ÞBÒdTöñgÿ%*0°[ö¡1ÃÿöëßI†Ë®}½jð6ÉëQËð§–æhá©ÍÑ÷fx·'RèF¼ö‹*ÕªFÐÒSvZî—¤³˜·Î#|~ñ9«¨o|Ø`æ±ó”¢‹|íiG³ÞÍö/8äQ9†G>œŸ²5>÷kdÿñú?Q·Îóâᇋc.n¡ê=QT É|Û~©¦ü09‚E£šXZ¨S´R ¾šƒÿ7ð·?ˆ( ¨«v-V-\8 ¤Ä«¨’H…_ßn’gw–sw—ø¿÷öùnŽŠÎ}—ÂîLÒýˆ¡»cFÏ.m=·õôS´?ßÚù0á»Özï…W Ó:é´HzŸ+SŒ{‘¹mZ¿‰ s…z/iãí!t `ûÙŠtÎ+Æ[¨4­Ê>Á¬ì4S1#šj”¹Öº‘$øc1=ßZA ͤi×Í‘Š¶Ç€ž×-™3±Lž'nöÝsgjðk…½ÖL—qÝ´Ò«EËN;j{^žuk“–Æ*‰‚²ñy¨:.¦¨m¹¸ûŠ¢Tù;2_¯ìtQò¢×­‹ÊA˜ ÈOµ‘iE3g†LñüˆE4’»v™YÌG¬%Yàc¶ª†} âR\ˆ³âÜu`z¤=w4Uô_‘ÕÓÔn¿Ÿöà_΂ D}ž^Ò… ‡~øÃÈß,ä}¯Ôkj†×©økÕÏ.G²4é4ª¡Ë†ª~™‘8Þ~dó**]KÃ4sßTÖ†7Õê 5¿»Qákœmµ¬ƒç^`W¾‹õ¡1m][¯ìš'ê³Yº:lŽ‘ëÍò"–ýÞj«÷?Øèíaog¥É1»^ÚÆ{“Çá0t-nõ(Z—÷šzXÄe©[ xMO/&<’Ý*uÓÖÈÅ‚¬ùq©aT„VìÿÎæü‹{V:Ûs™¤Uã²R’Š†­w$ÓµŒL­ÓΦ«PMû­ìNª¥.SWO—®eq2ï=æó4-XÍ0€(ß¾§Ç«˜½LÍñ‰}û±nþæ® ö¬Ù‰Vü“ÇéNtßž=ºàb¦OQ[¡ç¸© ïv$þ–Z4ÓÐÄÔÚÂË]C¯ØhOÁ¿/gæ_;ìâ`kÌ¡[èAZþ’wWÿ¬l2™œH7eïcoPÁIuÙí3QLõe»o T&s—;âö[iÌÚ¿èûÍa]6<ö±âÐt Û$=»’¨˜yç£ ´hX>0Ù¦‰·«p¯÷gÿLr.¿åáâ`ÂÖ´[w +ã[ëti ¦ž!×ÿÄ#ì’þ7¼-9Úzú4ªÎî“ñLÒ4–^¿zÎ×ÍÅÊÔ€iáózDÒ˜±{^6[ÇÊÅ_Š W¼õ—xÄbóº«CÓ«±þfo<Ž>Œo¯ G‚Wêh3Tՙǯ•"ü^k®ÆÒ×1ÈìFkÏX¬ð¾µ%ÐÑÚH“a~óU×Þ`G{ †¶ùÝšA¬2<>Ü2");u³†‡}Mæþ)âÙŒÇÇø•–µÎÞ˜ÅÐ$ë;å7ãNúj-*©odleaÆÖb°9ºÖî뱇ѣ-II;áádoij eX3 RÔŽ¥ü^¬^4Œ_KŽë-_™}Øä ¼1ê—¢ÎÝQ&xô¿é¸ý6ðîÁËVtŽIf4µÑºGîFL*GßÚůàšßrß.m¥éãöÛË«qÆ:Lm:ƒ™róÙdË¢Ò˜ú†F‡«ñ‘ËõømU›Ã¦q¬Î´Ë:‡«V·©¸íáê`¡ØF È"´>´×£Òé¦abV1ñP³ÛæÛYvõ¿”5HÑa/vpâ$ɬ²IÅ{±ŽÂ%‹Õö‹¿ t¤R©¨´¢Ž-øƒðû…ÂJ¼¼ûR‰T*ùòãÉ»’ªy­lä÷ꤗ*'w¥„ÚX!.xrØk…Å6ìC}¦;ƒJ«••ðXõM5ŽOvÁ± «ÐØ<Ü|)9JaX¶Ë‚¨ºLehõ ðAl¸ Ót•|ø—ì¯lwï. ÷Ñu·É=L·•dÿÝ%sÂñð†Þ’hÚMßêâU–¯ˆ¼Ý!»FdÇQ¾TŒ“°úôJ¦^QŸ²ö¹RØf8ßZ.h®Ð–wIÃE:š+^´â3šG)>§±.~ÜAŸz¦ sZ‡‹L3Ž0Wõø^e;&ߨtÕDe@Z©˜í“c<‡´ÌJ›ÔE›•õZö±¯DMƒb¾ÿ%qqŒ'ÅvËC…eQs)Ãa’o‡ýë“Þ¡¢]ËÀ?ƒð¬>aK_} ŸÄh|õàyåÌ~ZÐe¬F‰/Ä«9Ò’«®®[-D…ÕÇ4Ô¸¯‰Ò*eÓ4^¶Œ¡Y+”ÕüOÈM@Ã¥ûoajž ‘Ó&»tìµÎRr|Éa{±—m»Ó‹Šy\=-u§‰»nÒ9aϱ'w8ùï¾AxvVä•7Îî÷ËÎ83éì¢~ÙÐ5'^UÏo3]gÔÕ<‰¤µÜò¤kRÆñϹ‰:§QvóÝCk̓£3«Ò\”ûìmÿL¾¹èÑM׎È>ßXo¨îuQö±Ã@U.«™‰¡vA‡ïÊJYlmÌfyÇË°{ÍTm“$ ŠFÊïÓÖ¢7¹–'YÒýðæ¿k¡–E1oÂÏ_d¸¯—£½>Lm­²¾6ìMÉ a&‚Š%Þ dí1°ŠxŽ"½FÔ…r[mÀÉÖ¶¦ žk.5‘w®-g 9.ÄŒ‰¤é2]ƒ×å®ì+ÔW§¼!.Ù`´tGf'*²"S£òdãÚž"M»dTQ[@ÃrŸˆ¤hB€“wtædzïou5Ú}‹?˜““;&’~)¸áÿH%X>ÿýßIü þîÍù+þ‚ð¿üû Èe_có£¦ÀC⪥òÁ²´‚³H3oã›Ý⨘(­Be²a‹¬6D­³ 9v³|â,)Îj±”bB¥ƒ$êÙzœ†±¡¾‘wå‹¿oŽüH_‹ñ¢íY$]wËGÇÛÈë#öÎD}øÀ·„E$·‰ãaÃHº‹õD½úª¾÷z oþÛ{+è¦ß®ZíÏÂê&ž ‰(ÌTïí ¼Èúj(LΙ F6Q?'Ïp¾±žwÊ­÷ü+}¯«xÁ d“–Yâݪ„ç¬Íº\ÑAðM…¤]1.%Š¶øÚ!]›€Oç#³ª“ˆn’osªÿí:[gHˆoœœ(Oé}³cyòf†×é°Ã³ß ]׫[vLääNvxr)*´¦3²0c }w;žnåŽÈJS"Eï&l¶ö>ˆ=W—‘YÞAÜÕtÃb›†=[êVG¿×>žmøøÔ6F>íÎYB2Ç'([N¨«y NðbCL2—ߎֵ$þÍçwÒVm›gáø;i¼PJ$_¼\^c…új¬¢Q¼”âBl׸%ç›#-·–(Q_.CC§Iði|Û¨|([ÝߨÕTcéýv9ëêâí–›Oá:b¥MÚs©·n&[âð#ÍeÆM&a¤ü‘ÁƆ†º×EÚtRuãÛuÓÖ‰B<¸^;øxÑx{64êà¡Sꢨ-|˜:ö±]w{òë‹=nÚ¡_e FŠáM8–vjì;%É‚?ˆþQZQ1†N*þâÛCi¤•¡ï™çÓ}¸KT³º'£ê°Q]tºEÆ7ç3rÂá|Oåo-fÞQ)šš™4ÕUU×åáU8v³^`ÔÄtåÛ£‹èkæÁ7¬l$kŒÙYeÝ3øö#=`ÒœZ…ñ-»«^{ËÇå¾]Ï•)øøô€½)– Éôh¨©9%?".©=éDÕ¤ÔÖ*‘l|Z5±¾Pf§ïuùc|£´O¼Šòún"ÓÂyž|‹šä›žW78Ã~›Småç˜+l`4åÉ6Ý€‹%“_ÚpO—¢Ý×k: MøîÐO*™Ê·‚óû)tº<ó(2I]Ë.•ò¸:ô{¯úÐI"Ù¦~ßwáüé6,çÙfÒ„=¤‹ñmðý ݨO4mÒp¿â¶@()Ðiõ‘«“_³Ã]L"Ï}ùÑ"fù`e*týícß/ÿq¡`áÍfÖ¨åaÆ›ä‹ÛoÒÓ«¸19Óg8{Õ¥ÔN.v¼Ö_¬–=ø“|EkúdwÎŽã3ø†Å*õêRµÞVÒOðª¥ôt˜¸SPû` ·ßÎù˜YÇ<˜m {_éP©'ÃÌ̶\ÿœ‰Ó™|³ý ¾‘uß ä“¹%™Q:Ö> K¿îæRú¾ð¤LòíÑüøÖû:›ÁÖ+òPSœtm’ò'òU´YŸ½þz5n¿}”o57bXvÞ3sOü‹ñíèçóíú¼ùfD?ó´qÂ~Ëcjh5ðñ­ã[ÑߊŽOò-bž|Cê U—?ê•—Kc’ýTûm²@¥‚á·%t(”;ïÑ‘I¾I“\ô-ÜžHLƒ6¤€o…c­Ï˜tf'RmáC=ª<îË\7Én¦[N>ù »CðÉ·.mÑ%Á‚…=ÿð’ß÷()!‚A¡‘~…÷ë‡ó¶¯ ¹·Ê† ]1‹—šau÷˜¿¾ë6ùÕÛó›– ÑðÍjÃQ|B£õúZ ƒ òPع-"²W QÈ·ü=töùµcu Í3ÚìøÛDŠM²<ºŸàúx—ž–sáù v¦lþ÷âÀ Šk£|S‰èÐŽíÕ.…Q®¬À¯0*ºjk¤>Å­{©h´´¤”7Çë½HgCmç°x^|Ì&-6– øNÖ¹ª‚oªêTŸSò%àĵë « £ç‘²ŠañYPiIZú¾ñºêš;gÚ¼#Ml ÚùJY•ç¿Õùqé…tðAø ¦O¯|®ó›®ñ¤a혛oV4Æ&ÜF:òÉ+89­ò컓¶ïìã6T߶9yo¿$_ìj~ß10_¾µžTWvþ¾!ƒ­õ½ãó䛞*#_Ʈػ5û®°¶6f›‡Ë·š”Ä9ªq÷)Pˆ† XŒëoˆçòc¨|„oØð«®¾A,¹|êfDÞ¥†Hš¯cÅÄü›uD¤ûÑšà„‰ØÅÞZôôÊntô±æbý÷2¯G}ûãòm-W·Û3¨ä¬»góíÊïÑפ¦ ¢f£¥KO4Šùs·TÌÁ’*Á?òµV°î7ãW Ý/õÔIyMbYÓàÕÕ½~™¼01¸!BÁØßÿ£dáÂA%%ÑÃÞ÷Jë†Ò’0¶ ‘¯²~îI¥1¬-¸mó‹odëÝ¥NƺºÖn«-t ÍïÖàõ¹îŠ3Ùîäß «è|{®¦I·ó –¢ÈŠ–þ*O7m*Å+ü ‘)Ç6°}N ßDý;Ù«h£mOuè\®q~“¸þ^âR¦ñŒg»@Ûø°]þeðÍ f#Æ·ÚØ¿}&ù¶ÒB3þ6Îáð{3]¦¡¥­™î¦»TÔõºd =Àd²Ü=WéSI¶ÞÑX¼…'鶈nj$ÿøRMû÷lhP¤¡²üMïììiþ¿~ºfðMD­ì•§"?Å’ãqQ[·.™Ìân¹Ñ‘îc©LÑqÜz-S¥œÞêàà¶Ú΀É2^ýZü‘11’h¤ÉqعËÚ!44Ø0 ¦kYZtrn­œUéd·Xeñ–šÍ¢ëQ”KÃÈšI£®™Ø'v,ÔSKÇÐ×ÇC‹Ìò;ú¿=ó¯ª6“|Ûîà I(ž7ÞÍH™¢ç‰O5¿»µÏE¶wó´Ð¦ëÛá“Ûbž.‹œ]-‡eó 7uK|N¾ðÌ> Mª­«f¨fú«x%ÌNXÉIæÊ‹òúÓóŸ*Fx¶JlÙ,Žaâ ~Ë•ê¶ò V~ëÇ4˜¨ŸÍ綑\Ãg›TifËØ»fnÓò¶¥DgÊ÷¿ ^ÿÈÙ%+Tþ>kÎ š¡[LaÑÉ]êš4[÷@ŠOiûÂ6[8¯r2§êZÞkWlÎ#O¬Ò ›lÜëíîuöÌj²Ç-Y¾16'–Êùöló¿ëìÆkkíC2­k|æúiíµýl*™kãdf w-+h±¾hru—¶Yè3ìqÂýíl]÷U«Lõ¶nÁ£xºÖèkj0‚/µŠßž2 ©Ù¬ò³·àÊis5cs­Üß¾»÷ªæ“|Û¿Fk]4ž!ƒÏcµÈfVZ4MŸÍò²˜ÑˆGí*Ï\®A­_‰ÒaPt õ5èz»¯¿–÷‡Eêêõ?›<*–â+¤üœÜq¥Ä •wì Ž~ÿáßôüóŸðÊ%ý;|?qÿ‚Ìܪ¥p‚L¹qÚN,‡f¿0}£Ú´Û§†¬ ¸ï›#³7“µä¦ox0:ç5Óv÷)Ø"(›3ìÏkÙO¾.1½$[ý‚çSšsî}BæÜk7m)ùc®f%UDÈÜ6µþÌ™i2¯ñΧÉ%¥JAù*,š)€Ï¿e÷ Ù…öñ¢™+:¢ÆžrÒîãKzsâ÷ÉF>RMgâüö¿!3¶êͱ“Rö,]9M#ÒŸO‰TŠŠÐ¦ýÇÄJJuÿð4T8`ï‚üáïP¥#Ù·¥bøý·_ZѾv ?§S‘óm^û$?鲡'Qž{îþž‹¦,ÚòAËèϼ|ëžg×3ÿ²õTQM‹‡)Ü=Ÿý,˜-+Åþ'@E÷‰•¾ã>"¡c_<2(þ»? ÿÊޮÿe…Lß÷9ê}ù—%´Ž)|Cy6g¶h«2>)e?apüNŠægäÆ7}ÆÒ‹/¦M>lòäÎ.¦™òéEó[(›/÷,Ääþo¼±¡à Ò®>V„Jë–/â/ü~ÿý°ß¾Ñú1/ !ðó~¿`ÑÌÑW|$ÿ¡l~~KâGʈ‘J$bD*á{E¤È›W£Jßó””Ä5•Q 蛓lƒ»ßã†oïÅ—ðCÁ¨X$BÐ ÕA%%¤¹2 }ƒæòÄ«ÿÄ'\#Ä÷6Ÿ>ÓʤI1LÀ@ oyR`r}Ê쑈%)Ð ýö 7ç@ @ @ @ ~åšùóOSN™‚-q èÛ–á/¨JPDŠ"E$bü‹r}ãÖ›ìøZcb :Ž O7+ìÍ•ý`Øo è[æ"{µ^"¢ü¬Ö”íõVÁ­)m¡(˜o è[œJqC­däQÄkçÍv[\¶´Ø¨=ˆ¢˜o è[„Nþ<Ò‡óSd‡@H%¨ô~×…ðÇð‹ðfË]õNIM;ÄèÔ¥†ßÂãÏùu?œªàŽùÚÆ3Må9íçÿ®Ÿóð—_$ÞY90™’Ÿ›ÈGΗA 4ãOs ¢øWxgÿ~”÷—n┇|8kJ‚Š±ÿ0Û-¹1"¤É~{£SH»UbmH::uõ×€¥O¬)sý®;‚ì÷t¾Pôìt¨ÛšÃ¨Tàjo’÷zp^Á ú,-Ì*:Æ?ëýõ¹QcÖ¸l?óHáU¯2­öŠ¶»/qXƒ ?c»ŸüÅK¶k[?á0ÄÅöð=ù1UÝÂ씡-§¦a…žGØyZÆ«G‰Š0øfÇš•¦¦f®[ªå•c¸¹`­‡­™¹¹‰¹]ÜÍÊ©5}ÿz‹óϪì9&wû§ÅÅÏÐ=•8Õ®ÝCÇÀÌÌT.3ïMꉃ›ÅeVLýç=ö:&×»`rç—f…X*ªàåM ?ÏYŠð“ê·‡´Z„5Zoj¶í•´ŠðƒhÄ¿’ž?Þ>e½ÿÁìO½‹ßSEbnLo!ygö¤>n}™aí´E$ù»†„ó ßÃb2JÚÆ>ë!ø§"×î-ytv[Hâ=…WUíYÌÍò>dB©–7Éj¦aÛW0¢DÝå_4|ñ`ªÅ…x{+º™¸qÏuâcI¬õüûQ´~Ú)Û“J·#¿œçArm÷–Plð£À‡éi, ‰¹RXøòfÆ^ 2ëQÃÐhÉy2Ý(ûeÉ=æݧO](›r'Üo¡¡ß,lÓ[NÍêöL§Iæljðo5[ª¶ç^e…LåeÅg®U£UIQ¤=ÐÌ4¯Ÿwd£ûµ.8Íä—V­à]Xéˆ/y‰ŒnçZŽ‡´šmmt:Þ2Æ DŠu•¢/d¹Éz]a‹'N?,z7Ù7—_<ž‘q*¯TÞ²z«2Ï=êì«}y2=õôùëm<üÊžü«Žæ>g®àÇÝ¢Âîû™çÓÒNÜz\6Ù ïŸyòf´þEvZZÚÅë¹X-t×;¸‘ÁvIJNí ƒ•'/fbµ­7{cìÝ·ãU—lÂîc°¿|þÔûn¼ßm*º|µ ·£úɉ´Ô³—n÷åcÑ–ª §Oœ:½sdHÎ7Ü[\üðfFFÆ…¬ÄÉóÝoœ=wW*?B»ÿlRFåдì+I\ùb@Ôvyí±[uØU¥WÒ®÷ÍÅ·¾¤ïêÙŒS§/Ôôà¨{véˆ!‰u õĽæ‘ÛghièM?ù¬“wîÌ©AþXnæ™Ô´^¾ûÈPáœ5-ãÎÓêÉèF[*.Î8qöjÝ€ ̼îŒÓEüÖ 'Sª[q>IÞ_¿p*=ýT^Y£|†Dá¢m™P˜slƒëæŒë»¹Ìº~É@Qæî´ò.¤â0Ù3˧ŸàÛõôæ©U\©§j›Z}]ïêÙ}7¶Y7ã(¸q*¹¼MäùeŒ¡zaeXÃÊa›Ì|CKy/"Z,C›b7‰Q±cp“J±È—šö;éP]×oMŠ;l¯OYw¯!-O’V¨³¶Ë82Ö–­¾. µÕ^q¥;íôÜxè鋂ÛX†~X †jžû:®\³÷~ÞKDÐnDÖpß|àÒ… ?+}mßdâX¼˜}3çÍ~{N>ÏÏó·á8Žugöb°Ü®fÝé¡-Ï/™¯ Àª[k}=_Štµ ã›aø&zÔ»Uø $?ņí¼sUXl~Aþ? }§­x¸ãÕÚdÒúÝ1ç3Ž;™Z2åö›8ÚKßÐ%ðÌÅ ;׬TÕõî£ÈX‡ ‹r»ï5òÓB8n[§GÜP‹3¼¥¾AfOJO{yŸ¨›Í7ÃÀ wûèäô]ë\Õ—røhuvM]+!ëNq7ïùÕH’ªÁ‰[÷^õ j³n¦VGÎeçÝêV”ûÒÁ: Ý8a¦æ44Ø„AîçÀrsô÷ ÛwöqÏÐý€eø)ä=åwÌœ¼3ù&¶2b:š9DfÜ||÷’5‡zoÈ/O©¨i…ŒÞ±–´Œ–ÛÈC‡kÔ©Ú¡Ö&»¬lŒÔç’—“‚ö&^8kÏ!ÄáDØäbaTÜŽu †úÌË‘¬¶uW^×2Úˆ—i]Ârm°UV‡ÓömôT_L/Aß夳ÈÌ£—o¼hB[.,gÙ„zy=ÌågErŠˆð¾û¬ u‹ý2vØøTûmÚœ’áªír¢¤!s?ÉÔ£¹¯ãÛû!):e àZ€ÉάT\÷‰|2RuHDze¬©{ëTêëeM ]g¥{¡lØó MyˆšÂmÚ…o1¸uHj7Ö[D4:ì(Ÿ“Ï‘J¿Ü¢)R㤾*軽Ï\Ü6¡èV+åM§êåsµ éÊKÍ›P´>ÓÎð#N½îÌW¦÷ÈRµÎ2äØ}ìÃËzÔ€›ò€yÍ,ŠVq?ŒØ0#§µ1„5'z¹çGöf¬Ê¶=‹¤ën¢3Ϫÿ²)|+H·×1\+&¢~Ÿ¹˜ê€ìE„¡¦ÿU"åãÝ%,ã[ÿýÃK 'Ù飑ôONÝ)M²ÇðH±Îr½R!úуàL>WíQ^Æ)È+ÇÒ¦K½]Ñ‹ò«XÊÚ¯ãk ›´Ì²GÄ 6‡¹/¯ž¸¯ýùn:Ýgù4¾ù»èøÍ$<'ù6çZ ~N±1+ìÒ âëxÍQM5W {ìVl<×J<Æ¥=AÛÏ>BÇÞ¨kÐãßSQh²§ºsÔĉl7•Õ¬;/÷`zš`ë”ðÿT—°l óñ˜<¯ÜÌ(i9-¨°Q_U4*ÃQë¥%KuK$²@øÏ´–-Ï’ÑFÂoÕ¥¨½šÍ7üß–iL-ö›><+N†Ùk1i4#"úlÛOŠgÄKì (êù¨è§ù–ôŽ?NˆÇ/¼¸‡ÄäÖŒK­7À2Ã/c¿õ ÛÛ,kEï°’ØùÎ)ò­ÛÎ÷«‡‘NÙTÜW˜E¤Ñö\Œ§Ó›s«ùòåÚ&g›Í•—_éÂøæFw<%%:P¤L6lOå› ”Cåúo9x`?¦ƒ"M©ô=Eø(/v³^À¡çÄè}{t} *ß%m*ßÒlõ½¯Ê£îÊ^B²Æ|÷šq|.WÊg*Ç»ññi;ÿö †™ýáƒûe:àecâ°%‰ÉÅ5\]sÿµ7Ÿ™WØøT‹˜0D©ÈÌ€žUÒ©olz^íÑp‡š0éœnÁ'ò͉}­†(ƒÙ|›a¿Ysi ÚˆèDC…Z$J«¨ÛZyù™ÖɃ‹dy£®©ýzŒ8Y½w¥ú »"£ö>´£B9×ñ‘çfPÇÅcãSšßøVÙ0’²ëgðmÅuTÎ*­EœWbÙ>QŸ>M­²oßð«²ö:hi{t‰&p‡ˆÃÛ ™!kÝ(š”À}×p/Þk- 'œj?Å7ËêTM2!:já±ãm¿…Óÿnõ÷†5Û”‹r¯ô$b†\pƒù´›Üjû |;`Ëõ<õlz'Öd²t´‰ïmV+Ÿk—ñÍùŒ¼ œƒoü ,ªOFNEY)¡²òòúAÁ·À¨y`ŸË7ŸLyÔ|ÛfÈ Ì¬–_Ì“óíƾu«C«Ë'ÒPVöê½|Êÿt­ŠŠê¡kUŸÙ]OY_˜ßžÔy:Ԕ䳺æÇ·“|sd¿Q«È~›Í·+/;‰èÄCEl2©EØa±LãÕ´•œo:õãDr»W¨l¿SQ:¡²Ò²vžâ¡¶u=yhuÓÖðmåÄbÆ7Yœsó A‡ 2–²†¦™Í1ÿÖ0Œ j/«‘lz°áùíe†`ƒá2M¬NN‘$΂d“þvÒ~;9ÁêüÄ`ºÝæy¯ì‚¾âZä¸p4´ÅúTçÞÐFçˆz›G#YøþTŒà/~•8_n· ûŸ! uÄ=>‚"AúKvÝé“O{³ÔÔ åÛq||š½†¡·+²Šv¶ö×*æÛÖùŽOgñ k"YÞݹDÂW,&6>oº¼KÕzãäàc¨· Òøë3ê,×î¦ÇlMý¢¡i»¤yOñ­†xKnài¹e‡œoŒÄ¢V"ìî¢(:m¥¢uEdø½&]7($.>é¡ño×kç=>eî¿UIx ê’)jÖƒ(Æ]–ÙE×'ô°/÷øãÁ‰õ1**¡-7Á`eB;SCmâ¦ÊÖ{¦Œ;Æßk“çêFgοáÞÈUñ9^0“p0>ýÅù&BáÍö›,·6;$Õo!Æ^¨TfÛ¥Xyņê+_}þöMUâ:}£€sXDÏNmcp]ÊßÖ¿W³ÅFÛ~>Í¥ˆoñÁŽŽAGjkë…½Ùjj'¿¯¯z-f©†Aë¸Xß:Kâè4ûâªêAÒSóxëþɧØoXÕ¦k.g\ί~÷¦"ÚטÉ`ãë mžZ~qÙïêêkJs¹T•„Üv”ßa¥A¾òopO26êØm‘Ôêíö´iöŽäáш£Úçe¿Iê —’žÖ¼iEùÏ™‹é—JÞÕ·uk³™º&ù¯êÞ•¬Ñ^á–øJa™K‡C;c}3ü*¯kд+‡f·!~ÜŽGõ€Ï/Á7| *ÚÒd»¥É.¸Öœ‡Ž è×ÞÆ+[•ê­ Yí`dj±%&s²ClxzÆÕÒØØÔæÈå"âÒÆ;kÍü¯È«ÈP¹6×±]Æ7¤ý™«¹¡×Vü¶ž’O;.×hÕ†íyÂÓ#íÃKäÖ§0Ì"øx; u³àÙ–w!ÍÏ.;y‹gòíÃþÞâs^!ÙòLèÉeq=ûeA¿½—foilåPÒ9êla^ŒAK¼x0v‹Ÿ‰±±ÕÊÀ§ ø '?ÞÝ&ð¬|:nÂÏÆÌ€.w#öw³‡ÈÒŒ•ZVqogzOÙß‹ñÍÍÁ,»_­º¶ÛÔÔ,ì>ñ~ãè:®‘YôÃ&6½¸¹)j½«¡‘YxÜ­Ìüà“’£5Îæ1w^¿¾ä°õ)æêgžzï=qÍäþÞî²›ls¾t߸ÔÛåïÃVa±¼(,ÄÇ'ÍLŒ­ÝnTÉléÑZ}#ÛFžd²N ½¾ãå`jdd´÷ä(aà íu Ûf`ÀW×òÍä¢áÄÔý½A^æ§rqLå173 :UŽvßd¯™X•|mÉ´y'çÛ€ƒ©~ÍÀ”ý½2•_>jæ1Õrì(»îíl©Ãbr¬öžÄv™[„ )#nqÇ‘ˆ 3Sgïs¹5SŒïv7–þù¶i¦è­ÍÆFNGgö¨·ŽJj!¬ŸþBœT"k± kp̽ŠŠ1³qV‹›ë圩ã7d¶‰?Çü2í¥ž©3As6öéaÍá=5jïá(~µgâöYoNÌ¥÷Õ¹m/Gç^j›i;Í‘NbþíyÃ0úÑåHE ž ‚Ìx?«Ï›ë Eæà[fq÷Œû‘YIñÊÛìו¦>2Wr¦ÿ‚*x}lZê?Ü„Ì~<™ùmJP¢]´ºñôlG>RÐÈ¡ÏQ¦~N[ï–ÝèùÅƧc[‚ëŒ_ óÿMj«åÿŒ†sñ Aú˯\¾ru†®\zözdþ!KùCïšfu>³ùöi#ý½bé×m ï[à5†_Î’¢‰ï#žå R|° xû&ËQ"Ⱥv¥cxÚ`é~yöÜ…‹ÓuáüÙC?{ŠAš}ãJ}7rô럂“o;Cà‡@ @ @ @ @ @ @ @ @ oL3Ùkº/?¾eÂá?°ý#KD“hC¤T,£Rø)>ôMNŠ Æ2D1¾U¸¡¨áÿéÿVR5ÕJ¥BTv~PÿÿþSÇÿüg€úÖùÆû_ÿï»?ôûxK¡”ŽÝ¿=¢¤Ô£¤4y }ƒ€Ã—ú–,.ünìÿ$ÄÓwÿ~ÿÝÈ?ý˯ruác'6ÿä]3ÎÛêëíðGzû‡±¯½=Ý|‘t~Ù&éîîJ>/‡¤}]ÝÃBéPïà_áU¢áΞ¡Ù'XOþ?2qjòÏb) ³wô/YI_g׈èíæÉÏ:”ð{äç"C=]=½CÈ”C¡Å¼Þa"Ä2jxž•½gÞELÜ0Öß;ÂÍþ‹`¬¯g€‡üŒÊ)áõwõM”)2:ÔÕ¨žÞ¾q¡äC@âÑ®>ÙyµRÑ@_o7®ž¡Qþ” Æ»z‡ðÕÝ=6í¹þ@OÏ»¢·³kTŒô÷tÄ¿;¼Éþ=‹l’ï”ø®Jß”ò”H* yˆ…Æ‚öÝÞ½þÈýO½K<ÔÌ1Ü6ýˆP$Ü‚»:ãùÃD?³•;±VÍÕ&eWöÏ+<~‹É(iû¬gpP!í*p1 NQü U{³Ãg7­ Æ5ùç[»ö¯Çƒ÷|™ÆýâEÛa±T-ªFàÍåì¼QFx=ÚÄÞüXvÜ{ÇC–®žž–á H:Ù¸o¯¡o/¿ÜöÚÛæUjâQmZîÛÁù×›ºx7‡Ø9ʨ ÍVß'S:«šuœ]³÷Bñ¼žöÆ*5ûSÄçÑnLÊÔ¢SiMnN§ ‘Ú˜`½ÿ2Va6PhtcSm¶‰¡>E“vøé0qAGæNî†ãØÖzjÍÔª‹dho¹…¢-Æ‹TjùÎlæ¡Gu¿Ë*þßÀßÿƒhÒ òÒŽ?ÿ»pá‚>%%aÝ{‰Tøõ °©ß‘YG¤#su„ßÍÝޛ㟠sß…" úNQÇ}†îŽ™¶\Ûé瞣ùV®ÇfÙHM¤p’o³çÃeÈÔž|êííÏ÷k䡵q;OëÖ¯1äÐCgaW¾?ÆÑfésÍ}6íÅ®I‹ fiéØZ›2X&qwˆXùkzl¿â¶Ò{í*Û íá[A}•™.ƒ®ëhïúv ­ËŽÿ/ŠölWu [ og¾â!¾}Åí ¼’ä5ÐZwÛÏÓ{ݺm6kWêCb0°½•¡cocå;i¿UgÇ™ëЬìléd­à˜ļ»üâR5ƒ.¾;z üŠŠºöÛi†ž$7õȨyy.®² «§Ò(ö¿rT϶ߖí:wÈÏÄÌ„²l™£ÿ¬$­5£R™6.nÑå½Û<©–“ë‰7ýT’jú¡-®>^ΖtSÏÒ!…¯ÖIß)«’åMön¤k-ÎX7•È}1 ²¦GlÝ`¶ç_ pà·=;ýŸlžt¸D\ÖŠ#{÷:»yùºÛS¹.Ï:ùxtÃuÜ-5YºlMugÿý=X¨\¤Ê¼½šI§d•£ÂÞÝkܨ#3=]Sç{Õƒøâ=ÿ-éÇÍkÀš¯øNJöS4âÍw¼±€Æ±åK0“=‡Å]#ÄÎ=Úš:ÃxÆ×dÓ¹îR>ÿ3#»¾,ÕT3àÖz¬ÂêsáÇné=âB¥iÙÛÚ¬ ‰×%ø†ÕCÑÀÞuT×Æ\_ÇØñVîˆ0Å‹iºýñ˜×6hžÆÂ[_ýnÇÌìÄø¦ç{~­ƒ¹™™¡º:uWj^ccýµØL®™õš}ug±Ú›µamàz?ª¦~Úãw¾ÞëÖ¬Öbë]zÙ9•o]u¥ÙOJ'yßzó¸¦]€,ž%Z6‚¾ÍIf›zbߓݹwÞðQ‰ˆ/!%]Å&åaöc|“d¥¦`ù•“p¸k {q°úÿíœÑö;šUG©T*~W3¬¤Ä_ð·üï¿*) ^>C$R©äËg¿ä°ee‡ìsÃõͪ¬ ¬éÇ­7vØ”.ïÄÓÖ-3؈ÕóúLw…Õ,Mw¼»«ªeNL  ² ËÃ1’·¬½z@æ9^ŸM¡1;xx»ˆ 7Ѷò'Bk=»~™åìCoá>º®¼[äv—× Ó 㛉õn^I ÒX,.a¼ÈX®ã†…Û•å§Ê $<›îíÆ8ßÚï’—sr:ä•«öòØ<Î÷Øq7cý»(Ø”ràvËtó`Z¼˜kUòª}|6ßÔW¨Çæµ£–zîÛTúVk¹¶|˜1žCZfÕ‡Û¦ƒÚ–ÉŽÛ„÷ÓƒšvIŠz&é`…În’ó-ç ¡Á¦샿‹®þª„çÐý€e ¸•:ÜS\V-i˜‰­Ù†NÊ“™à¤br‹.#ÔÂ!ä4áâÄ K{ŠŽ½Ñ Ñ\Žäž÷Žºë¯Œ$>¿½©nâ‡5¥¼²ââaÁŒÙDüÿªnmå®ËÆ>ó48tý5áYrØÎ-rþÙ ÖṸEûrÇz¸e^sÉ•IãtÊžœWµ‚mƒawàîešWQÔß<¨Îõ”YDÃvtÕ̪áþ²‹ªZÎD‘¤l²ßšQ6px aê×Êl®ÎÜxe]7"ÃÃ] £2+P¢öjrzd>Hð¢°ô‰4Ü?hºéØŒñéóV¸ß›»j÷5Ü£ý,Éôî7Ö´Òˆ®·2d™vFîûéè¿AÒÝŠ‘?j¿MÏU¤¡¢¨®Gˆünà&³íÅX.üðÉ‚$ßý±]ƒŒõ$)Âÿòï/HÏzYÇ=œ> èwÑX”ôvr°\£»˜ô`«!nt«8 Q.…ÊdÃÙ—¨u–!Çîc­úˆ‰¦óéŠáþ¾¾¾¡w5ý>ªï·7Gþóo£¤¯åá¦H$]wËGÆÛÓø–f§ïvRJDÝug1É«œIö‡“Åò±Ñh»Ì~ã=‹ ÑZ>>„§¡¯(qƒ›ç.YGDN\Ê.GÓдÏÌ*l|J “÷@"SzfI'ʯb)k¿"'Ù¤e–íø’Р6›q7zñ<x“A7ê}"ßœµœ+&Ê`’o ªŒØÚˆ~òq=hà SƒÝ‰Ž­"-Š'ÛC9Y²#oÔÉìÒ±,ØÑ5ÔÅazûdªä.¢ä~tþ2ÙIãØ;ìFÁ­+·G>üÚÃXÖål,õQVjɲú¾]taÙ%É+Lß³e$,sN®2²ŠË!ü¤Â!}6UÆ·ñ ú’»'Sm¼˜r_‡àåQ²mÈFKͤJ‰l¾í½³G'ðð¬ñ©¾kš¼†tâ5¤WæêlxðR‘Œont»‰,Í…WÚo"Z[ã‰0ºÏÞY|ßL2ÞéÏåXoŒ—G±Å(ðZõ$îŽ6×ÕÒÒb¨3¸÷ßbµ©8äè–,Yüß~Ÿ’×C)f¿‰F£cyß)Iü­páHU%>¯$‘™o_ôˆ4ÒÊÐ÷Ìóé39 Ü%ªYÝ“ß;lTn‘Õç3rÂá|Oåo-ƒÊ`Nƒò·b7ëFÈ{{t} ÿ“ù†Ï®È£îÊ^B²Æ|# 8ë&¦Väë í‚k{ÖÎH„Uèñ +h£ºŠê­Fôóù6±¾€ñÍÌ€žõ1¾ÑŸ5 y:ܜǤ3ºøŸÈ7Gæñëµ3ì7…|ãR¯uщ‡KÙdõf~«ÉR•Ëò«|ÓÔ©'’Ûi¯¦65§hdJâ{ų‡üjÙbxÎ?Ìc¼ˆFq⡳ø¶ò¼¼Ôúò—“Œ;4Òr²¾a}ÎäúBãŒÄhRc&fß·xêúì˜ìüQi¶š]ÿôtÌ®!}3øvÍîz¸ ðÚA#‡âÚÆ“ßöÌä‚/;êiíȪ”Ç+å¹pÏG>L‡b=¬÷Î;qÍÍÃ$mË 4c_-î‘u·ý6zÊ«i|»` ³íwÍ7üY'54Ô­ôÝè÷ D·P°à ZºXž£R³á¾4à.y™«Ÿì·•¤E 5“ö[•Î"œáŸä›8Ö\Ó#³yv_ƒoXíµã8NØoâáVÂ~{·™ã·{¶QŒHúL*oR·ÙŽ~^/ñi|“Ûo¸5üî*ƒnܯÐ~«ÇøÖ0Á·Û[8ŸÃ· û ÷ä0Ôµ;Qž—æG+‘i‹*ÓøÆ ¢/Þ]6¯eô%ë8‡*Â[óõ\ß}Ä—ó-Í]>^ÀA%Ð×¢ÈøÆßÄ\²µH:»Ã¾Žp,Ú›tªvÒ=ì¢~´jÚoM|a¾a-Qг=|[7_>N¿gQ¹Ý²R*¾µçÛ>¾Ð¼‚Y4Öo É®ãùà bR<3›¦Ö¿ F:«ÏþÎù†à“o’MºháwÂïtÿÓ?K.ìUR’Žõˆ$ˆô+¼_Ï/RÓ°x#ëz›³·/Q]9„¢ Áfö›R‰ ^ĨXlAÐðÍ:(úŽlþm™íÞKÔ:^ÃêÕþí<±B¾å拾ÖMÌ¿u•½B>‘o­çW©jÉü^]Ü41ÿ†A†=±0u$Ôëôã6¬ÑÇyèy¥â0ŒòÖ ˆ~(«…¼Ü;·Z‡%³ ¡ýUñœóosñ­šµŒUJ\0x—´ˆ‹ÇŒ isX†›ÎÞ™!zT—“…ÐÎ"3ïwɲR\o¡®l¨˜oÂអҪ9çßtýäHrw™ªYÅbyu"ÌÊ"@¾ îÈö?~›Ê7ôÞQ7=çòT¼»íì¿GHÌ¿ fRìÒgßceŠ˜n½9]Þ#~œo=YÊt¯bœps+óÃü›§¶½œ9Â÷÷]|w⯰Z[•^Ð.´<ÑT×­ÊñúøÄf‡×°Ï-Åy9eÍáÛfgnäÅÏá›T«}WÇŸ˜ñî~±‡±úñ%'f5Ç~ÖbNx嶢ù'4µŒ{jŽk:fLÞÞ•I¢˜Ü{= Ÿƒ=³SS•\N¬ûL¯l …µ¿‹ù7¼Ÿbâþáï%  ,\ *,à}¯$úNi8æ8öWòUÖO¯Ä„1)d]ÓÄýa‹¬†êB<¬™úfV&ºÆ>…Íø4Zí%{U« yêñ×¥¬fYrÊÎíSUUã:`a¥í f0˜–fLgg¢Ԏ¬g¬Þ7±ïâõÁ?«zauc¼»Ô€¦Â`pž5K&×OgðM‡®L¬Ÿ>K4aº]–GÝyë_—re³+‚È[™nÌ5\³3¦®ö\–Ϊ;±fÚ +6…â±)óz{ç€ Ç kÖxw0Vn¼ÇËùñ_.TÎ7J£8ÿft¤f¦wŶ%o˜à›P©z¹°KCÔJÝ%j,÷dl¤<²Áœ¦¬ÁÜ|¹V‡M?³ÓÆÒÚT¥eéS=ö1›ñebYS×'`Í*ÿg“˜þøôÔ*KõÃWßÊÁyÇó/úÄúé™% î¬õSl|J‹‰:hcnea¤Ã0u+ì‘-‚×oZe­¢Éf’Tœýövcù;\³h9µv\,/zAoäZ7CÇÒÌ¥gqâ>þÈøúéë§S%ò¥,ÉêUô |õe÷ä>û3= _È>c­awZ^j½Oþ²T[¶L(>ä@Ò q½"Ò´©ªÙ¯údfßÀ¾ Ud†¶¥9—¥k–z§ •Œn4Pº /ˆò ?eƒ£bÜ"åUg.×vÄî:ëÌT]sNq AŸÅ…(«h˜xE6d9ªÚÈóâb$Û|#qíûÔ`U7ܤo¿æ´È,}ò‘½ÊÿõïU}òU§tÛûʆåù&8¼Á‹¬¬Be0du:×þôÓæ«îä°Üæ©Íê~Ú>K]ê²åÊË—.3w ¼õjx®J Þ@þÏÓ¿}¾aƒ,ÙO¾ß¾ËSúAðÒHL²`d|háÞÂï»þÇ?ây!…÷³>qÿ‚ S·¬M}2mùÇ6”Okï©Q+Ü’§xÿqû¬7'f%«¿å«®´Ï|’¹R>mOÚ‡‡´Ùôü†ÑŸø)Ø݇N‰mƦ¸GÑlûKÍ,îqÿGö¿M¬Î|ttî-v³~HZAbÑi%< 3uavb¦W£9R‰ Ÿ\Cdú]3C˜ý 2­Î S/Îp7|Ø2-±SÃA~²¥ÉBî|q!øáèožoXÏ"‘JQÚ´ÿ¨DI©áOÿ„÷š¨`8`ôo@• ]¾([V}uåFÚ¼â}þZ±¾ð¼axÆădNI?!^ýCcßs³:‚oÝPp¿° ¯üÿíÝ¿JÃ@ÀñÃv¬¢ñÕÁÙÑÁÉÙð\º‹_ÀIß@ÄEÁ­ˆ.RT­UÓ\’»û™SP ­´*ņï‡,™.Çå÷ûÝ]²[»ÿmJµ³±VÉý¾rë+ZÌá±V…ÖÖ¶‰åÕé4|NFKº4Ò ËîúÁ” ºÇ˜½oå™àè²m+ƒ;Ûœ˜*/´›Ÿ\¯^õ~gl|[^ß;¹ãÙ ¸£|™÷ÑÙœËýög}ñ-ñˋ¨R‘ÆCä¿äë¬6µé±¨P •›Ð­† ÐÐ!_w}þàrÀÿ{Ø,d“Ô%¡DY2“%4Ú­Ô¯ŸT±¥T|~JCÆüô=\?®Åƺ,–³ÖÅ/&4çJ¹›  Àf5_“3;ŸS5~ñøþÁíêŠC@ÎrW׉ÿý)À|…vÝN€zŽì¼< endstream endobj 808 0 obj << /Length 2694 /Filter /FlateDecode >> stream xÚ½ZÝsÛ6÷_¡7S7C€ß}kzMÚÎÜ%縗é$›–h‰WŠTIèÜü÷ÝÅ.@¢|Ê5ÓX ìîo?9XlÁâõÕËÛ«¯Âd‘ûy"“Åíã"•‹4Êü(·›Åïݱ«Ö…*–+™fÞO}ÙQëõ±Ú”Ë•¼¯ˆpSÖeÑ—Ô }é‹å/·?^}w{õÛ•€Í‚… æ‘Ÿéb½¿úðK°ØýÇEà‡y¶xÒ³ö‹(Éà[/Þ]ýë*àƒ£çÎ38l˜-RøA˜Ò¡?JëÝͲ¯é®ñ£$‡’gN˜Æ~ž¦fÂ×ËU(CïůK·ì©{Xw%µö…Zï¨Ù6ôU;ûþööíªW…Z­ÛMé/W±Ì½w-è,Œ„W)‡ƒa|£/öÜzXÊÀ;>.eì=¢!Vð²R‡;ÜéÎ݉ÆÖó|(QØÅŠä[ áçqLR®ÛýCÕ”0`xO•ÚQëÅ ðyîý³U%‘Ô®PÔº¡OÕÓ·+ëBUx¼ÿ.Eì™é-1Ð!ášÃ9U{ä…¬Blö-}Zs«d²+PSöz÷«Æœ’ chcÙ'zcÏÁg±"ĬDêçaø€ìçK@Æ#…‰ QHh îû-Z>IcqJƒUÆ`Å„Eb0¤Œ­àã 6ú™¦Ä`ÎeË#1hiˆÉ<6C Z7ôу)3Ãé­YÆ„ ÄrTàRx„2èõ¼€Q-«ìLP ̼FÙ°£k„9„¾`ZüP{yÔd"ÀpÖ±'É~H.›u{l”Žó@IÔŠGûjÛêØiEÁ0‰£hPí*&ÓWxÿ9ö<öØ2CÁ,øPÕ•ú´LP~ˆ…V&‘›q`ú¦-™WÓ*"E…6Ëp<çÒë‡CÛ©þ,Ñ%Ðð5}Þ Z´4ÖÅQç4h–]×vý—¶Ö›K¬»¿!0v¤]>$AÙ6ƒ@nÙ,@¡¸-Y¡YWûJMÏ/"?Š’?!À¿/ ’ndÃ.ŸZæ„ÐÄ°„_’ Ú©tÑö]}³-…p R† àFÏ°1ÜOQ|ÃÖ4¾!­ÐËÅ70xwWØ­2PO"AE¸Ô&ÑTp„G¸Ô&Ñ”’(ÌÑ>“Î&Ñ”³\jŒÓ'.L2²a‡·ÔI¢Ø™„7˜¨À¥ÌÞQ»¼»ãØsQN诊sï/^–€—¥x0`ôD ‘¬@в~ßöˆ '‚[Né' ú„e´<5Ë37 À F ^pµîvÃ>ïi„°†Ë™¡Ö9ä1Öb.Ø°ÁX‹-ÖbÂZÌ[<‹µ˜±æ˜ ÖÆaÅDQÆZìb->ÁšÃþûhîvVùÿJ¾«¾LB¼A$bÑjNˆ7¯éŽCÚ’pc?‡K,~–0ø^á6…Þn0o—!ôäÁf„ÈÏÜt€&¸Š»ÅùܽêüÞšð÷Úû 2oÕ2é»ßuaáøËÈ-i˜0F~xÄ‚X˜ÊXx÷è°ïݶ»&:9 šìÓ6ÛnCTè ƒTëJÕŸ¸p/Ojè[Ч;Ö%:®Ð0ðTÕ5µ(Çê“̤àÐCÌqÍi©w°‚Ž†œO%Ùí3âÍ­yaCã„!F-#4dáK²ê¡5“Ú»¡òêÌ“Â4«g ku*7ˆ¯Nk«* GÕ‚ˆ@©é(©·aLh? M肨…a¤¶ôE »²'${1-%£ß[¯ö- Û’¸ÜÚÕm]·è§OUÃõ®A `uºWÝn«55i¡‡íÇ¡b*?kFþÏ”`̶‹ÄÁà%Þ†4†áøEÇ$Âhˆ7ÍGC)Í uhûjY‘ú1ˆƒÊGxDP¨6m³j´‚¶K¸d©rã‚fZ+†„npŒ©x©úÖÑÐÐxýÉZ'Že|Û™ùX›Ï8Æ3šÜ¸ Á3ß žª^;;ÖГ“q¥ªl‰0JE7³=Ô¸p¸YÃÜNí|7:X_Ö嚣$2ë*«ŠÉö^û¯ÇÕ‰~‡ã­Å¤‚ù°ŠºaxX‡w½¢ˆÑ¨ I¤ÿÔ+0âác"÷j¯d’9q9]×q¨ÚžUSxèªdýíhʇž"Ø7|²ÆLb†ö^‡ÐLs­fÔ¾ÖC4Æ…Ù˽êAU\hîØl)WÛŽþ’ƒ&38ÒJ ‰©ã §†¾EÃ(0ËŽƒtïuÅþ·ë9Î|®Iý‘„ß,µyÿ±H襌‹rÖ3šãþA/uJ)ËN×Kl pgöŽweÉE‹ 2,ÒþFYBõÔ¨ë¨#†\. zH[Ü~s8”ͦú6|ù\e~’Û…t'.ªšOoæiW™yªÍÙjîÉÖ–V‰Éi±/²ÄÏD6v(9ëPï—^ÉwôÂ’ŒºÁ¨ŽÏ®£mh˜ñ@•¢ú m-GëF82`àÜfhN€ ša¨n›-{b@áÝ$\àœ/­wEW¬aO¦Z¯Ëf«v” æƒæyäÖn\û¼tîšÉѱR8k%]Úäà®ÇZU‡º¤ž£5÷FžŸ¸anUhïæ¹tí1òÉÜDhüv,êê‘©æ\ ̬=tGkM„Ô¶á†y¤³œ3Ñp(´ÅÔ^Qîmœ4ßõtbLEëÖäÄFé·8Ç5Â;Õá[–¶7DîÁæglåŸc[;ÿó'̤ହÀóí³'wïë¦ÊXE¡ð£éýu6YY‹z‹XØí§Z1uܤœS´Öò%€Î>É]ÀCo|âÄ$ìLóŽ±\b_p’ÅV’â§þQ-rÀãü„j9Á¹Z°ãBN˜ÎÜÓMÏ~¢ŸÄWanòãÝ$së)UÝ «®ê`¸ÓšÚD×cîŠMe,xæñ®Æì/qø¬ë„iè¸N˜:¹BÙtIᛚßBS“+ô$[Cgâ:„{ë:8®õ4b4äm Z׉;%œÙë"ÑAwð˜P²7âSò´¤·ÕñOl±ëPǹ1f©)åÑóÛ_uÉŒª9Ã+›XÒ0r¸A:«t^$ ]0¼í©ÆÊíÍf¦Æ3>víÞ”/j¥ÚUJSNF›Æt|'ù²…Ìð®çbòýb›Ó.Yæñ#Ný@nZEwÌŽ-r,ýðj|æøÑäI¨Þ‘mÔÍN£{îFl¨)bÃÄqøfnø…‰÷£_a¯¿š³Èýø¿®ùJN{@ƒÆ÷¥Úµ›kV5?“Ûßu Uõšû-ŠKœQ 9ÖîYU×£Ûý8 Lÿ$Ž|™\üÏ ³ÿ­I_~ˆ #­Œ0 ýløàÛ]qPæÿV ¹¯)'ï¯7€Å~zÒ?ê'± endstream endobj 821 0 obj << /Length 1720 /Filter /FlateDecode >> stream xÚ­š[sâ6†ïù¾«™)Zmw:I²§n›í6!W»;Œœà)àÔ6›äß÷“e XE7`Ë’ÞWÒヤÞ .ǃWo™ ”H*ƒñ}À"‰AÄcÄŒgÁçðv]æÓ´N‡#Åá]••úèÝ:ŸeÃÁáÏ:á&[di•é†("ïãƒ7ãÁ¿Š8 AD¡rŽ"ÓåàóWÌ ýC€Kâà©Éµ ¸ŒáÜþàÖ-FLbD%S¹% J¸°“x³iW í’\µK©Œ0‹t“.³Õ,ŸfUãÐH´ÿ¯Þr»Wp-Bq×C*B]Á3´UJH?ŽôÙåúþ>+«¦Sp¸È«z’ÏtŽïCè­t±Îº«éj¦ Ýd±Lë¼X鼕³¦§áâ½R,Úk8 A ñ^# é‰=¤œ!A)\jÌçy¥ë©æÅzÑúú–é´Ç2«ë}¼\Oçú¨žgJ!uuA‰ºÆ*]ªÒ‡÷E8°,ÂA=ëÃQ—ÂÑ3Ú ‡”%Ä ‹áœ@ìòˆ$I F‘¤®: ·n‚®¢!FÚÝF$¡*ŽOtK»¡ÜñMC$^„ I€cÚW¾*Vu¶ªõu]Ìò/Óî>ücÈq˜ )_ž_E¹Ç" û°HEŒ`ˆzôC>ZS;.8ç‹ðÓQœR±­Žjo£æ6ko%0£o¥7 äõIY(.àùs²ãäÔaûåj¤Û›“8`õ i`µ5]«ì7}§Á—Ùˆða½HÛÇÃÔÐ 'Ë´žÎ!q0ëÁiǬmôõ›ñ›«ñäözòçï·ãɧë‹!!$_½wëÁ‹!·?R¦ÃÔÍ]VõþN1Оl¤-§î⇡¥a¨Þ´4Aк+¨Z’Z[s^×xm9(ô ÝQh+oQxw…¼ t½îdÍ>pT XÈó€ "L¼G"DãX·Z:€ó i€³5ঋ„“oÅìÅž x¶ƒ-ðÞ_]¾>Š=v {¶æ`ïdÍ>{P\`z{>µyì…=ÌQ¸nuä`σ¤aÏÖl؃yÜwõbÎÊCüy°Ññg»ØæïöHþ<Ø1üÙ~¸ƒ¿“5ûüAqâ.~?Ãt6á>ø E¢½éâãçC±ÃÏ–lè›géÞoò:â-t¶ö6sïB·™9Ûø1q§KöˆSÅ£DœG\$áÃÀ p1F”¶k/‰ƒ¸ó p¶dC\™ª§ÝÓaòÎ7Ñg{Ø&ïæHôÎwcȳíHz§JöɃҜ“óÈ“> ¤ôd„â¨]¹#ØÁžMŸ-ÚÀ·ÌêyáX–ñ¡ÞQg‹oSw}tÜêl;‘ƒº“5ûØAqŸ·n(Ô`0æ;! í¢q¬ÂøÐ4ØÙ¢z~Qÿä™;êv¶øÎÔâ8ì<¸1ØÙvbv'kö±ƒâãçaÇ$"/k‚UR¶Ø9ÖQ|hìlÑÞ«Ö¹žâÃBÇží`çE«–ÇïŽЃ% í)qx²f@(ÎÎœYP˜„S/Ëx‚aÚòÇüyÐ4üÙ¢zj[§õdY=8àó ßÁgËïÌi|áz°cÀëvw²hŸ<(Žéy z‚pø8 ^Ð#1âÝÄŠpz4 z¶è½i1s½t=èسõwØ;ò­ëÁŽa¯7ŽÝ‹ÓEûìAq·å&0Lĉ—=%"¸ÛÈöÛÀ6|wê­{q€,{#A7{j‹ôІÚé6úHBqFNÚPÛà x¬2µÛ1‹:ûe8ð5Õî¢ZA"L0µ×¯vÜ™ á¬ÈªÕOC‡µ¾¶LëZ_dáÓ<[ély{uZ,³J'Õ…Nše™¯òÕƒNPMŽûfC½j‹>6·õ5û·:½‰ÿP·Cš• £TšÃo*PaݪkìH’M¨ Úwó¢Beô©jÚŠsÙÒaž){ct /Õo"PÔÙ&F‡IKrôctàê§2/ʼÎÛ„¨ ÚZ¶‚v ¥ Úz6A;nEÄÀEEΠf³I´´%MÐ4A;Öíè¶`¯_ÛHèÅf@ÕÁÁ eñ¹ßáÛ¡:&ìòè0®Ý`3;<Š»OŽŽ$¥á'H’6-‹"uQ.j¯Bý¼<©K`~gMWÀ…DÉ&ȉ‰mãÿ…mg endstream endobj 828 0 obj << /Length 2672 /Filter /FlateDecode >> stream xÚÕ\[sÛ6}÷¯ÐÛJÝŠÁ…ÉíÎÎ$έÝ&Mmça§éxh ¶8+‘.I'ñþúýp£Y¢¨™ÙÏ„à|8®DÐän‚&oÎ^\={MÙ$rFØäêv’’IgQœÓÉÕròÛôò¡)EWÌæ$ͦ[ިЛ‡rÉgsŒ¦ß«ˆ ¾æEËÕ‘Ï~¿úéìÕÕÙgÀЫÂã(Eéd±9ûíw4YBüOÑ<›|‘©6“˜eð\O.Ï~=Cš¨[Σ á#eD“¾;„ó|Âò$bù`hBhIT ÒT,·M•E4eÀG„js}óàdZÖúÙ=*ƒ|B Z×3ˆú2›+VâÇÃæÆü.[a4@žC¡y’¨BWåÝʤ¸Eï15AI¢ž¸$Þ©è¿+Û®ü‹®¬«}¼i–@û)µ4‰”‚Z”ÒØ¥v^W¯:e¯wõ²ü„QDvþsCcÌš>Êv©›åS¾4¥À3]š‚pYêÒ}ñp{;£[M¼/6ü)‰#0 Á"Á Œæ’XCc^—{*ŸP Œÿ®ã±"wœ?MqD3rbÍée‹r«šÓßñG4¾ã@b<à0µS8˜¯êŠÿ– Ù5\tFwëb¯c,z‚ô›¢[¬öw3Æ7üYßpX¿|5ßÇîêÕùÕõå»ëŸ¼¼ºþðîù c<½:;à6þµÛ¸-9à0§"º¹qFý&N#”ÒÃHÄprÜaü{‡±!1p˜˜ÆalÌU×Ý_ox·ª†ì^ö6öÙ¿}÷r”ðý)ák‘^ù§BºÊY”Acx)Ÿ(eIåSx"v\ùþˆ½òmHL”Ó(ßÆ”Êo»¢»^ÔK~Xüþð½ømøQâ¿<§~ŽFý6Å|@ü§"ºâ‡ÜÉpî£â EqÂBˆC*ÈvLü{ñÛ8>,þ˜Fü6æVü›öî ö ÷Ú·ÑwµÏöj\Ï€£Ñ¾M1;¬ý“í‹Ü$Iý´ŸÆŽÓÚO²dFÄï\/N”BûqN`5Cj?¢¿™H­~Rªÿ¡)J>°Ñ¼A­øcÍo2¢#y‘;Å~cqB"†Bìó ('Ç%ïØKÞ†d’i$oC:þ ôý ôÒ· ŒÚò¹çÔGuùx°iÒ8ÑõÈ#¿ýþ˜dÉãSX²°ãàØ{€ ™x@Hã6¤šæ×mwXúþȽômäq“üq3ìmŠ èþTHW÷å~[ý1‚Ò³ç\1ÎaÉ’×½?b¯{2Ð}H£{ÒêêߟA¯›ÁÈ™þHð'iÀæˆ>q8ÒuÈfÌË„YY⬋æIDðñÝ͈ÆÈü°„€Ôà@ª­ýºþwyø7¶‘¾ƒ=nW”ðPÔÂwâÏÉŽðEî8õ;è¢IQâ ‹¦(ÊÑñƒ®ˆ½ðmÈ}#l¯ü˜Fù6¦Z綼¹.îÄWnÕïß«ßÆ¥þbÎÿ|œ øó4.à4ÍÀÁÖÉ® @nÌü¶(ÅJBìíÓ˜EǧüðzØâd{л.Žò†à`bËaYµ×<ðæðéVÜÞ¶¸cÜàåûË_Å—Ù_]ÌX2ý×õ(ð§küÁ’ÆÀRàd@×(Š²ä¤“®=Z†r€sNõ&íûºãme´ÿ¸{ŽótúyF’i±~—7r6]Ö¼­þ2ÃÙ´Sï7E׉OÑÅË/+^©ØR¿]ÔÞª—]­¢–Òoʪ¬îô‹Wonå퀶SÑ÷²àªGY¬Tü­¼ÊqÛ«&â‰P”ª7âýÍ@¸,.¼xPË‹Ò¯Dý"Ùpæ*ɳױ}á²Bã±LÑû\˜çþžWËòëlNS2=W¹z|P7„‰€F%"éôR\„Ȧ¼ºëV*Ùóõ]Ý”Ýj³í4Î), sx%¡_7õFå&]ts(¯¬ø|s¿‰ÑlÎÒtú¢hÁFëõ£J(M­i%Sc`”,:Ÿ¡í¢n8d§öÒàŽáÚ®h:h_’S(M=ÿÛZ„È´¨–*j “ÆT¼í)R-VES,€É³›ÇŽ«·e¥ž’¯ÜmË—*ƒy¹M^4Mñ¨‚·Ò(”ßv*CW«˜¦¼[u`˜˜fÓowöÑX{ï×Tµ®Ä çšK«Câ@ ‡ª¡ˆB¿ô=ØQé&2~¹Ôö¡:‡6aŸS¶†.US/uõJcZV¬ïWÅN¥~<Oùºånæ-rl#Ó=Èd™n‘÷Yé¾)«®¸Y‹¼I¾¥"¦)â#Sô!Ä"ˆu°nTôõõëD2¼!RBÃSó†SÉ[Ô7+°q8쩹þK1BmA—pe"Å×ZU±¶R¨ ´-<Þ=4_šNIü5w¸xãŽ/Ðë3^tì Þ#Mã(M“=Ó%(#ƒ‘fM4?2Bá†(õTx"þ€› ·§1L¶`Dt,>`J³¾à†On÷–lzÈ'ψ@¢‰˜4”s¡/1Âð—AÇÊb=”F é±ð™lUùÍÊf`LÏo¿ûNƃq1ôËÖ‹O˜Æ7MÉAe ¡é‡†/ËE§~êÑöý«øõY ¨"(‡3Ðã]ëŒcê£9&Ðìz=úÝéåÃt>É­¬ÚꞆ§dý¥4u·Uhëêòç²üÌ›V^m”–P7Yx…¬ñžÖy®úCì}BCöç2®¶ªòmIýÒ­Œ}¬ŽRüü«£›[þES¯7˜½èð’·N²uÙukǪߘÿ+hÓÇn%'qTõÐ=|Û}ëVý¹®îø®ëì¶ì ïzv«B›¯]ÕMgçl£ÿY§³»˜{p«MÏÛ©ú76öSô5×Æ\[ÝZ}kLÍvÕÿ…ya¤ý,b)׺–®BZŽ0Ûžõ™Sø¾AopðO`ÐÄYö'Fî'½erÂüaw Þù43"lôþ½ÿÉ@ Œ°ž©<÷‡µ6²45Ë¡óUqß™KѱXÿ²óß\<¬¹;¾‚ÿ ÉpQ^ endstream endobj 835 0 obj << /Length 2268 /Filter /FlateDecode >> stream xÚíZÝsÛ¸÷_Á§†êY>~8íÃeî’æ:™º‰ûäx.°YS¤¤âø.÷¿w)’bdKvïzÓNÆ!¸~Ø/ì.@QïÊ£Þ룗gGÏ_‰ÐKHòÐ;[x" ‰ ¤1 áͽsÿýºLgªV“)bÿ_•.mëõ:ëÉ”QÿØÞéL«JÛA8a“‹³Ž¾?;úéˆÁŠÔc^Ä< ¼Ùêèü‚zs ÿàQ"’Ø»5£V^Æð̼÷Gÿ<¢Ž[júÊ+Ï6޽1 ™ð"&IÌÂÈ,ɽ‡3îI@¹“;êqΓ‰Ã`þÎl8Û¦tÖIe¬»ÒƒH$Š[äR{‹QèVD†ÀHM µzéSÞ9‡ƒáŽ""b/¢! %·æ]§y-øµ±ÕrÄBÀ ±è=  4ï@£Ë04›A=Uu­Ëü}]êüª^öÀ¡û•ÔÒ Æ@†8$4Šš…ýx‹û€z›ÿ h2½ T$Þ”Áê‰EþsŸi‰šëtߨúøPxHâ$éŠÀ ;µ kg:%²É4¤ÔÿåPF¦\„$·‡mL™|]§ãúrü¨sÇ€YI¢–³ ô(ïŒñ¹ ‡þpñ)Þ´5C‡›•^UºîxÌýÆ…Y.¡Ž÷àÑh• ±A¡fµÀζû£KÙVu´±`•þ¬‹Å. N Ž6ãQ|…Ç¿››ÑˆÈ$Ü6÷VØéÕ–0Zûë`lÿpÙ[¢ï·õÖ¿¿è{»Þ¨è‹¢Ü%5ä!É’®ûý®’úÞüelÛày¤ÿÍÞYfk’Õå lïmPÚ7eº3°° GÎAçë‹‹ÇôAò?<âLßSw¢· ÒJe7K ÅÔj± Ê&mãï*¿ùM•,ž.ȸˆa¥­ô:ƒóÀ °¼ر¶Û2¦Rˆû–¹)!œ÷-³¯ö¿¢ý/_ 3ÀÃùûLé þojŠý_SÓÔ«W£‘Ûø½ ñÇ‘Á(D&_ ‘ã…ØIcá¨ÆÆŲbäÁܱÜ ¿ji‰Â&9ÝkáÞmÀ/–Wylö'*VïÑ͸M}¢º¶ÔõºÌw’#ÊVu•ãV&„Eq¿±<ݧ ¯{÷•ê LJ\ n]O"~ö¸ž¤½«Ú¤sUq >‚o(ß?òìn2x¿ÈµmÌŠ¼Öyí¨ ûTöQ¥W¹íš¡‰›f™í¸t“וžÛVšÛg½t]o×YÚæé„Iß^õ¹>UÏ–æ†^°{{ú£?±”7‹«thªáa…°7YŸù ï–CŠŒ#a`V9¼œ4@¦+l Ë,’>VuYäWºªŸY‚†‚ˆùgË´²ô•V¹k*‹1+V—)h)-rKGâ33wšÀ™`‘¿,&\ú·¶ç¶U™¢îzHÎHK+7SånÔíR¹¾Ë ‡3éQº8E{FˆbŸYQ\§ù•#æ –ˆ…ÿZçºT¸D(Íõ|LýÌÐGiÛ†l¬ŠÒuweÀw7O‚kÔ惭'Rún¡Wè…[¬Ak®k•fŽET>[MáK÷«‚ÄñËüUšëÊ’ZvF}UÕcÚ¸ÙøõWè{Ƕ]ir §1n²ƒN‡6 ‰6;àÄ_ðfÄõÍÛÀÛ©ÿ²½j}Iß¾ÉH1FRÒò‘D4ßVŠ•®Ó•‘&»U{›“ú·eZÛ-EÑ“fÙzÞLX6CŒŽ`»LF„¨ û\Wn´Ê‹zÙAl¢úˆrr¤Ž2/šµ.ïE[‹Àv•iã“WµÊgúÄ©cg°uqR$’pñ¨¯8"H \‡»Ãu ‰G|Äé,Óýˆã€ïÿ†3xÚï5ÝüQ^Ä!4²ºÅ¯oSuö:±7!o‹Ÿ!t«ç’PKx©æ°…\&¤&?'ÌÍv¦>ùÀy`¾E¤/âÛ/Hi§tSpwŠƒ¶cÍbóÔY—¾x\zÝß^Û^\†O–]…€dΫ†7˜8¦“. ¥ÑË?«•IX‚sÿ®XÛ =n°k| ”—DpÜ&@OƒÖ„dlÛ´ ’qN/­d•Ö¨4»n¨0Å̯Šs×y›®à­“=áÍ#AÖÆ°‘[› / ³ÙCÇ ’>±¤—z¦ÚùÍÇcÈpÖñN0#‹°)>`À¥¨ìÃt‹ø Õ­Ë;ÛQ,`uS„.ƒ!ºóÏgãæF«Òñ›Ý™©–˜ŽV¹®M4-ÊkKe2Zqæҋѧ‰žªM>×8Kà6ðÖM¼n¬µ€› »®lR‡æÇ&þè²Ý3²G0åILh<*šòˆÃθ§ö àó˜XºY¤÷=ÜÀ>M$åqLàï7ˆ…†°è˜ì‘áq_l{DO¹ HÈ&ϧv6êÛAÎÇìvL1OqO5õE»9zâb l¾Oi±®úåLjË«1 "(‘$ 0ÉÀ±¢À·ž¿YÁ÷»ä•‡Á%f²S¿·Ó·íFWYå¸lùÅs‚vÂÞ¦õ²™}M†È%c3gDsÕqS«Íhƒ¹;;;¶º,+Ò|ææø=â:l®DDsïý|_ì*†®ŸyfXÈ{ÊÄŠ#h¹Uß nC˜«6õ-RÑÞP2»1…9ÈÚ–Ëm›#›Üåb8—ÀyÁœÃüð[©£4©j]KÈõ v¬*z7÷.™Å–zv݇Ó¹ÍËb]šây$u¨…©Ó…FRHm.ƒ!e©*Û¸Ô˜€°wQ¬MÊbšÛ§ÍœØ£2rGe3È!8A§UœŠ0íËÈU@¾]™kv•Þp¦+Ô);Ê€>PY ºêÙyø+.ˆ<|ð¸¶j†÷œ0æ~… ¬„PªœN„ J¸Ë 5·¿&û»IÿnƒpÜ øÿÜ°uaHΛ[  ÿ7»Jðm endstream endobj 832 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 101 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 10319 /Filter /FlateDecode >> stream xÚíXTWúÿM6]“ýmyö¿-»Ïf“("Ò§Ï0t†^éˆØÀ.–ˆQQAATT°·XbÇ^@@ª4é Ò{†2…™9ÿsçÞ:!wÍz>ÏÄܹÜrιçýÞ÷}ï¹g@ @ @ @ @ @ @ @ @ @ L6òëÐzÙØ-doàü`ìßl}e¯ùOxËåa|™˜’ÉƳ¤ºMž /VŠÎ…m 9yÈć·¬‹¼ž2bWIÇÖe^1Å‚7"vUwøúmÐöæ„eXű…îâØíK–„¹:0ªI[Ÿ-\´týåŠ1Aòƒxµ¦íÉQ'DüJ"µÞQ4ÚjVZ›‡ .íYêóÝI ®²7 ˆ¼=Rmš©³£Òû_K!Çó*à?—7{²¬†þ<)øÅ-z¿nFvЛ{ýÓ±5ù·BÔ4Y[¢ΜŒZîÎÑ0 hÈ (?÷ÓÓßÑ É×úa…ypxyŠ[¨-L~ø´H @Y&7!» n€ñ6»%ÒA!¿‡×Íãõ DJ”ID½pewwOoŸD&ïú2i'” ûùØz~ï ìÿpCÁÀý#Lçíîè扥خÂþ>v¼H‚[0¶oOˆíÛ;´¯L*æg™Î1Îêîïö”õ÷t÷ `˜xr·K ö„<ÒIÕF^ÚA‘– ™ßÛ/Q ‰L&èïÅJÒÃÊKôðúE}]<éømÂ÷bωŠÍ¢Ñ˜‰•¼á*÷âÁZñû¥xSH¤xÊ×cõ â›KE½Ý|¡L"æc…âõ q%–Iú íæ²›ºûÄàÞáÀ,lsÙV[íÕ×Úð“H;J™ ú¼VEa¤›-æl¸[imD=ý¤^)ѱ'6d`× [Ç¡˜·ˆdÁ^l†•ë€‰ âíÍH; 9Ft3;7{3ËâL!f_R~­» ‡if¿zµ¿ ‰l콿®v˜é“¶n°òÚpðÀnCæ²à‹puKì©ù&l‡·V‰Aѵ #º®û’•žv¦Ï[°ÓˆxVF¤Íë‚,=×<°Ç̈¹(è,ÚìEÒe|÷ý™\hn­Œ¯M#ò$?Š“YaÂÃݲŸPHW‚#“ªoë¹Ü!›IóY fâñ5út²oÀ*sCC;ÏÚLúR¢­iþWÝL —lWk’6ªèm€ÎŪõÞd¥Ö4&f³æn‹¼í–î Qh åÝðoÜPº®Ó‚å ],Ø&æqåXvÅ.šãrpׇû~¿ØJ‡æ‚µ ôl°/™Ä\²1èXJ}l4¡6ƒ"(á„ôË:K˜ ·´‡¨eþ~²O”—uæg•N™Bmà—–…†¶=PÌ$%®V‹¥Ã“[HyoW·X™ø×ËnoÖ¢/fnO³Ý>@ôø&G#­+E@Ôiiʲßx_Ýõhçlýx$sïàBs׃ØRÍ=²ºÞí b×GÁ¶$ïr—¢ÇÎ\ÏvíQ|=/.L•íÑ —z‘g›¿TØGkUyM‡`d6è'ÕFÆ]oo¼á8±žW°-øP·D&)>«¥ašÐDåò:Öò›p!ó¬ bœÛ1®AÂo}›8ŒUçÓàAå9’¦]é ¿lw§¸n&ÊpŸÁJªàÖ –í‡,"Óºß]Ë)TŠIÖr­9º×Ê =Û1_Ó-¼;Œ0ƒ9Ç _¾ú.áÛàgÇßøñÔ‰¨§­‡ï ßLr`¥{ðlƒŽ»´9FiŠ¶Q¨MÇéð=÷‹ø@\½'ìi-îAÕº¨c»'õmÄ[F×RòÌï2E#-¿–®º4¶“0@™$ÌÃÖyû0ØiiL;ò ¿ ƒª“3uç5É7ŠÙ¿À|þ~h:éÇ‚è¶-­míe×i³MŠåjáGÞ*&ö­97KÇ¡šeç=²*§tò›ðO©MåÙ•si¶1™/šÛ»x¸Íå½®³/IGYúiª¦M-ÏÎ8SMw Á89mLkêÒ™tzz®"KÒ®+åx*ÉYSå`9áèªS©tfREoÙ½Ã4#NY}~šÎú‡Ì™zébLmTYú¢µÑÈiÝC¬h½O™jYò¼Íµ‘öo]´ÀÕÕÙÆz^äÍgbyúE2PgÅÔºMHw°'Õ7,sT$5:ã,_zrn_bÓ ê܈·Œ*;Uõƒ/FÙ]Ó|5]yʬô¼¿“ñúƒ@‚©ÍInµb×S³tpßA©6w#Ö‘é4ÊdMUÍGírµ1£EÝSx15?¨èØ×K¦ª6«¡Ú¸5Rmš0µÉ Yžü£“1™Jc0™œ#\ì,§V{“iÃJB&kÍ%e÷Cµ™Gu9'Ás8=9.Ö–ÖÖÖV6Ni-Ø¡2Ž¹Òiz‹üü1–Yë-Ù%߶ÈTEçª2›Ò•O¥1“^öe^ÙC¥Ó‡×Wc¶ú…&LmfíPêAôFc§À“¨òI•¸³Ì„A?‘ŒU¡!f1™ÄXà¿\^˜'+S¶ƒ¯H*­6ãä¹Q$…x}›%¤YÒ„#º)à­¦ªúÇu+}›O;§­'pßfrµI;Äš·xœ\ôë¨l0ÄÅÒæûÓClø_O‚¾šúõúöv4fÞÞ¯£eÕ#}´m¡áÒíc†©Í|Bm¤¢ö'Üظ¸8.7¡¥†!•.ZÚßÿø0ž‹“ôø8s;–ÕÖ^]õX5ÑN⺠·¹{˜nbÛ?Nòg2µÉ®6²ö+'N— ”ª#ÜiÆt?• @ûb&iUÔåeaâ.˜¨Ó/׋'Wâ­åÂ:cïc¸õÕ¥DÍže=GÁTçH¢;‹[Mtv_)Àò6©Í_Žsf¿¥Wµ´L’翳øîñ˜\"o3®ÚtÝ#©˜)d¥§­¹£wœé¶ÎUçÜ-mW„-}˜çp±\‹n ¹–T£Ø¶Æq.éjƒXœuHMÇ6·›ˆ¬ê³®ŸyX6JmFyU1{4\x.¼¸úFú’m6ÆÁ… 6ê dã[§œÛˆçm¤u‰TÖíb< ú^ÆF_Jž\mªì Áð¼ ™þ,Ïb4‘¤=ßœNÝ[Î˽Ab”¶‹†G|·×³ ¯É&÷m°D¾ âm»M7fèÓè Ëù‹=íɽ°äf¬ÏwWX鱌çùîؾɜBeú¼\mbÇQ›ÌK¡kwJ=to1iTßU›Öø¹ÐzGSkÇU›Y¸Ú€j7’ÓÊkå©À‹Á ‡Æ<ŸLm@óBŠ&ÕÂ# :=öø<’ªO:I¦Ò)lK7g+2lm‹ Э¼¶ÓÒÀnŒ(LsþM–߸“ø6})†*ª^'_¢îxÛôFî*t¾()*(,®méº'Šx•eÅ…/ªð;%¼c–•µò„Ä®ÂÖç…/Dxd#¨(),(,á ±ïí ÕEð[QIC;Ÿ8 TR^ZÔÒ¥x¦"l^X.ßðZªŠŠŠ*[û`AJòË›ûÇEy‘zÚ` ‹Š_Ö4 ‰A5„ñÛJ‹ Ê+ëäºñZH[ê*±’—6wöÑVÛ‹¢Š¶ñîúƒ/‹òj:G5LÐ ëÕ+8Äkª„ç(«j’tQiÌ´Ê^üô]͵ÅX}‹ëZxx›JzªóK”ãyZjK^Ôvã'íï¨-**¬hÞ"ž€ÃÿÝ-å°j…EÕ r‘Öç½hŽ.Œx ¸¸¨s`Rµ‘õÇì]N÷º)E½øu½¸gç¡ør]â1*Å°²çµB•Ϥ~&FR°D¢žÛGw]z!D— ø•†œÏ.²˜ CGŸ%ž6:dúŠ«^ó˜w­{öÊjs|}ú¾ÍËØ›é b”¶A ~År½†þž¶ÖÖ–ÖÖn~ÿPFéUèå‰^õ‚¾ özë]3@ Þ*?b¯?¹~¼-GÍóð‹xÔae¯Vª·*ø™àýøŸÞ…pˆ7Ú1¶ýuÌq§j)·S'… BÛûn=€xÇ|;›@ÏÐ,`kt—ü¬™´J.º‘Ý.¾¹&¸¹Ölþ qݺšIú”´u1 ´œ°÷ÈòÏ:S<¯þÒÍûº×´¯&ié-(È=½Íe½²U2‰Õ6»f]Í.­æý¬ è(¦–ò~ÑÂçExùßÆ_{'ÜÀ9R2u™Bºô†oa’ž†Œän|baeËŸÑ×ò,åIl,7%« _îHÈ$§‰ñÍ|q]Q&6>-¯gÂ/ÏÚ÷Ÿ‘Íš‡¸rC«+ÍKˆƒÇK©nàP&¥&Å7ðÄõÅò}Ssyػբ¬'g 5 ÏÅ>ÉjìÅ&MHŠM•™»¶0£WÆãnYy E®6î¡•½BÒòœÁ ?*ìÀË/înÌ|šÈåÆ=ÍÌëÅ^hÄç¶R!/ «BBi³ ü"¡6í)‰]íU‰q¹ñÉUBe•yOŸÀÃ<)¬jW®ìï¨IKŠçr¹iÙE½Š!,"^=Öb\nʳ|ž¼+Kªb¬<¢à9—z­…IûÓâW´ŽíÒ2qoNZbll|Q=¿1†P›îê´¸L\mduey ñqqñOò˱3„­Õ×Ïí Ò=osã^öÉóô¶e§&Á‚&¥ewsl•æ$äV÷wTÄq'$¦7 StA{NZ7.!»¸F¦¼¾’Þâ¬TX…䌼‘ _ÛQ‘Ÿšƒ×òä*¦M`,aÂv+}Ê™'µXñ2ò†WJ"ä'Å]äèè›)Ow°¿ +5ŽË}’”^ש|çVíù“áUk«¹ñÃ.*Íã7¾¢wÂ>ZšŸSÙ×\žË}œü¬¤„çí»2å×,%óyŸ¼±Ûr¸ëœ-ÝW†%¿_ÑÓúSÂU˜^|Y•S®¸óð»ùÉȘ^&WKÃyÞ»vCÖ/_bcmu&© ÿ{_u|ÔÑ;Ä´º“fE`Gh¹µEUÏ[1h¸3­¡ír.=;ëB#ÛÔàƒš¥ý®Ýð›5²þ[}rä½øÖüÌÃjÔyÍ2ÀÝìÆ W!Ÿ×-=}N7B9OÑgù[ŒuÔí S›ÁïõU7?#þ,hÉ»ó{cµ1u§.m5®\⦔ÃÑ×ùÄùôY[ұʄ¯53w^‡+­´)“Bc¦Wc{dïµ!¹ŸÄË'iº§G²ÎƒŠSns-w("ÝåÇrß–O4(èçñ富‚bÓ™ä›íÊ¢Ko-66Ýe–D½==ý¢1¹—;u âùž’cQ皈Ë(‰´Òð¼%H¸Í`ΦLb0¹°V­› ,=D—º²wDo4a+MˆSö½0¥Òx†ùüʸ¨c÷ÃÓ›ç“T¢åòø½·ùªpb桶>Ñð¸YÇÕ)6%=D±òNºkÛÀšKØnnÌòÜs8LåqÕÙÔ£ÅD‡Êˆ0×öÀ:­T"æñxƒRg½m¾Ú*ÛòF½Ä×@ž³*©Gaì’Ho{‡ï‰wÀ=ª˜d~›¤¨M4«yOSÓäd<=JS5ÈàóÛÐÝ)#ö­U¼'5¥wÀ1µáxúG>9x bÝbw¯µ!5=bÜ®+L>wüHÄÞ½{÷…[Óælï…koù-Ùª´†g{9ZÎrµ93êplïÞR‘—=}ç…¢¾ú'l²ö‰GÏðrç>»ÅQ%«—ò’êj2·G’‘ÏWDEüœó4 Êæ§ãRs»„?/ ÉÝ»ší¾Ë7á&e£6Ò·y⬩ïqüòܲ¡4NýÓº´U=ŠkÔú"óÂÉcû"öFìpfªÄ`ÞTøjCïâïs€žB •W–þ-lÍEw«G³ ÄŒb¹ýlnf:VÛỗýÌæ­¤yFßRïù²þ&F[/O\³*[uËM O¨½ìÚ¹SöEDìßçÏѵŽÌÃê¾{¾¦¾ûñaÕj•»5¥îÒ¥®˜Dù§aøó±jdkªE¥èc°¨:suèó}Ö4õcçnKÙkLV·÷Z<ßÞ|ãÍê#ß9P©fÑù°SÉN¬²%kh9:;›p¼.]X¨fsîqÒNÛñ ¡6‘›iû9쌃åWç™0éfŽÞnö =ÃàS‰˜8äž·2b²8Þ^n,kA`Ä L&,»cÇÑg˜Úy{¹²™nK¿ï3þY\k¦þ¯Iü±ÎÃ…@{Šº†½³³©™ËµkKU8‘pmÞqk5'ì¡[ÚéÕ†T-gyV:,óÝ+1•hxÊah³ôM"ùýÏšR5-Üy8™¯8Wp{¿;YÇ0"“±’5s¼Bm ´u(±ò–—Iúƒ–º’©L;Ž®gÿ}Â<´ÉÉ`¸yûp$Óy•ò=“Ö©{Œ€îð…NºdC6•¤gy 7AéöêÚ+ÆD¬´˜=ûž·ixdæé9.ðuµvÙr¾îq ®:}ÓµÌç?¬Åª6VÍZ‡iúë }M©æLm&Û$<¾{âHŠmçÄÊÌÎÏÏ[OWËÕÿ0žÃmN ƒ—ÞÑ{±‹gó­ºÈ@[s¬h€¶BS—bïìÙØ+{~c?…¬ciiÖ cvš³tm\<-XóWõÈ}›6c–ÎÉ8Åll/üKÃQ©6/®¹ÎဠÒYòHKK3µ=“zÝñ6Ø/Eá#UF®Ä×ÊG8à_”R%ÿ †oLì?üx2â§&Þ—ØtÄÚQš(rÊБg#¶U™L¦<ôðsÈF–jd•Á¨ªM°åPIF•91ÈõpŽh\…Ö:#JFTGÙ|#›Œ¼0ø·15Qn<^½dU8ØøC1¥¡¨Î;äöØj ¿t#÷#J~ºj© Ë}Gºtä–“\ú‘×]6z‹©ôL0¶ŸJ.{°3š$H2oˆKûÌ|ªÁÿà/WVœóÞÏ}ñËûØ“äm0µùï¶ä`{•µ†ÐO‘"ÞºuôÂÿRèýfjVt{£÷8x-Ø›½'€â´%U†.(xþ ²tĻ諠>@ ÞUU 6DE-[€‡¸~5 xuE  ¦”–‚˜°i “Á{ïiÓˆ•==Ôl¯ÒÈÈ!D +03¿ûøë_Á§Ÿ‚÷ß!,ã~æÎE†ó*á'Ä;Ž­í„ªÅþûñÇ€DË–ÈHpõ*HL¨Ù¦*29¹ÀÃÌù;˜ý)01‡£ì Þ]ví’—éïßþðøÇGà«ÁŸ> =Aæ300€Úéç¹1EÅ :|õgðÕ'@0ü|L¿ß~ˆµs_j-Ä»h R££~÷[ðítÀþè >Ç ~hÓÁ¬?þܸ$tS_að1ÆÝÝ `˜ñ øæyÊ_ Ìÿï·ÀÖðxÈ·A¼£46‚O>ÁÔæË/±¯µµàôiðÍßÀ_?ŒÏ€n2Ÿ½@çS0k: h{”ü®ç"”µ¦Ðù7PýP>#„ú3F_€Y¿N^® 5 ðù(ŒB¼ë|ôáÞˆÅ#bõ›€©øû40÷#À†áÀç˜蟯?zX›€°½àÑ㙜wÁ”JKÁçÁÚ5@ã+ð‡i@õ¬qŒ Cþ|ý>Pûpu7o¾ë²Œ@ ' €P›#GÆßàÚ5ðí·²™Ÿôs1n\³¡ò|‚ÝÁ}<±rg'èíÃîøå4~]ˆPˆ…Hõõ : hÏMÿúP§òb Äœ£Ï‡,Ž90>Ÿ‚Ù³¾Á†ë¬Y â€Túë“úpú °±ªs€ ‘ Ç2Ðg`¥Rf¡›§þ!øóÇ`úoÀ²E 7´·Uö§tF ôôô Þ‡x·ò"ñ°ûË/±û¸Â($IsssqqqVVÖ³gÏòòòêêêúEÄô²Ô4püXºhÊ£‰ÙŸ1ñc¹%ÂàKë# òøË4 ýw`ÂK–bÀb®c©éØ8ð8¤¥c¾ÐÞ]TT`1`,+ÉÛàÔq°a#pu:_ƒ|þC¡õÓ!aæt,húò=ð×°(rÓfldmÝT´T)2B¡°¡¡¡  6)lØüü|øU$B3Æ Þ $lÀT›÷ßÇîÎ »(,,Ä-’¥ ''§µµZr&ìÜ8°t)ÐÔºj`΀ÚÇ€ô ÁÈKá @k5Âg`æoÀWÓÀœ€õo`¬¾üøx0Õ»v€Û·AÞsPZjªA]-t¥@Shn‘š±OS3hi%৵•X€Ÿ¶6b›fù2\Ó؈…?ð8/+@QHÏgÏ€e‹Ê¿°3j L5€îŸÁ·`iÕ0÷Ìø ">‚ËŒé€2h~ŒUý@C˜˜‚£Ç°LÍU>Ô“ÎÎÎçÏŸ+›qx“BÍD3q"Þ ,,ˆ`ŠËn,b±øåË—¹¹¹£ $[ôvà_…JwH©]pÍÀHOßÈÚàýiàO3À??jŸ`âmÙP‘ù1øœˆÂà‡-ÏÁhEý3ðí§àkøù û|3“/Í¿òW€¡ Ô[ ˜è`IÅ 4€ž&\Ôo€Î?€ú_ÀÜ?ûƒ|óPù èLÇR+ìχ=ßö”O€C%üö#ðåçà“ÀÿØ[³g1Ń!¤Xü³âA¥Î@ ©©© %z¸¼àÀ†-++ƒ ˆOx…º!âàÞ=Bm8œñ| Ç«®®Vº:ÃÁe§¢¢FJå£&\êí/AZ¸q9 6'K0ûïà³ià÷Ó°äªÆo1ãßÓÀ×ïaÎô(` f ="šÍ ´q>3&^?˜|ŽySп‚1Ñ7‡ö§@ýwàŸŸ‚O§?Lh`Ø .\ÂܳìlÌ)úù¯ × (Ñ0… =™± óLTi쇙?ƒx7QŽ(žÔš`8í¨   kb*++»ººúúú¦dMB==æ‚»÷AÌ-pápJ.GÎ.ÀÜpŒ€èë–`ÌtU@V¤™@÷[ ó  «` ðCž(*€60 ç£Œ©Àœ ,Ì€…5ð["vƒ3'À•ËàÎ=pï–/ª«›RngjòÕ¸¿¿ªtc°Ÿh—KÊØfálºöövÔ×ï:ZZ„ÚM%Û •:3ЫáXMGÀ?A뫪ª‚–¨œ wêöüËÔë—ŽP”ÓüöööÖÖÖæÊ[}¼M`õá_ëêêÄŠ±L(bB @P¡6Gþ¬ý Á;{KK žU÷¶Ž¥©D Ê ô+z¥w]JKKaùaE&ª#^}C566Âf0‰t €ØXðûßc“eeg¿Î}¿§§ú<0˜R>ä„ÌÌLh˜/^¼¨¯¯‡z£ hÔÆ&ÿ6 …BXþŽŽXX¤—/_Âðgr Åk•VV¼»»û¿Rxâת<¯m¶Êå¾¾>h¶EEEСK€cs§ã: ¸A“‡±t‡ -C t_ ¸#ܽ«««©© žb*¨,6üGp—ââb"Áx uâ-Ó0l¸ ´÷èÃ@OGð´êTPf‡ð|È+0*©2•“âŃòu©µµŽ`EPX„@¼ýš36íݼ@£¦¦w6ÊËËKJJ`ƒÇ)ßÿd\3¹¿¤WüàЉ‚ŽJYYîJÁbÀÂ@Iäóùc“KHgˆÿ1Ž@ àñx0Œ‚¢ÔÖÖ†'U***JKK¡.á…k”| ô à2Ü .×ÖÖÂáîð 0˜êîÊ+ @¼S*$›2HU@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ â•ùÿ[t& endstream endobj 841 0 obj << /Length 2125 /Filter /FlateDecode >> stream xÚ­MsÛ¶òî_Á×K©™˜@‚“““¶™f&Ó6Õ;¼i;/°DYœP¤JRUÝÑï» HŠv¢Èö °Ø]ì7VÌ»÷˜÷öêõüêæ‡0öÒ EìÍW^"¼$RA”†Þ|éýæÿº«ó…nõìZ$Êÿo“Õ8{»Ë—Ùìš3ÿ.|ÈŠL7~„øìù»«ïçW^q Æ<ŽÈ£ a‰·Ø\ýöó–°þÎcA˜*oo¡6^+ ï׫_®Ø€ÑtÄ(g d´]ç _ïÚj£[`»(f±ôƒÙuÈRÿÇ÷›j“Ñ,¿/u»«3{Rõp¸±ió¢ ¥ri$‘-ñsŸ·kœ}\Í@ ºiÿ¿Õm›Õå˪,^}Kdo‹v]íî ¸'OøZVŽtYµ¸Tf@$×¾æXÀA~,qhÄs¯ Ÿ,~x;6 `'ä"iÿ0Cnà®Qä\.×Õö[$FÚ©P‰ÈÐÍ~\!‹ÕÎ]G” Lööî%}µë 'ï~O+t`×d#ýº*hº¨Ê6+Û#b ]Ž%«æZA§š$HÃÐ ƒK¿ª.3ëͶÈ^’Ì¿‘²ýÉ|"VAÌC/æà‘zÒ/IdçŠ /f<ˆä“¾ÐaÀRA(¸gþ7œo§+=2iÀ8ï“1ëQi¢â:óV“˜1ŒGëÚ±ðØG‘kÇLÊX‹‘/il,fÌÿ]ˆP»¿»|F¯pgÕ7Hõ–ü§8yR#2 ®ÔWˆóT«€Bȳ´údÄ“*´®jÅ2ÇhÕùG?t®VM@6^ ½£‘ÍW;²ßÅZ×z"l&mýgcÞú¡¨ôá?ÚÖè,U½$‚yÙl³ÅØiI™ÄÓj´»í£v»Úí-˜;L7méÍW…7 °ÂÅ·0P1Ýó ±ùåalnï‹Þ c>%„²º€¿Ì^V?ÐêÆ„l uæ³D c¢2I%’þë¬Ýgí¶ŽòŸ»ª…ÄW•ø¹Ñõ'¢‚áÎ0§éоÎ[:æà÷kÝŽÀ‘ç]1™’Šœn7ÔaÇì08CJ^¬ ûpdî`7•³À&7!ÓYc½Ñ#ØMÞœ[#Á$Š.Š­&ÊÅJ|&€pÀ€.ˆ­=2ƒØŠˆŸ'¶FIÄ2y$¶FAïƒëEQô|ÁêPD*|¶(I„’SõÑ™E™ªiò»"{¤²€QHç´ºØf÷a«s‡Éxúæx4ŒÑGÌT¢SÂÒÝC‹^ϤqëU°­qûBÆ8Yæ+ÃÚÊ€pßz ¬þeÖt±Ëˆ‚u'sþˆ~g’1`X„½ÿ͸u„ÅÐ1Í¥¶U2,ÓÇ+SÏrUW›I[QOD“LêR‘U+>2 ˆ ¨éË%NŠÊ\hÿ(„Vš —,sfË2“rí>@/V°)÷_ïZ\Ä’Ób!0+01¼ÁÄ*„×´¶­ó²Õh5†«^ü¢W!"&`zBsÈý5–‘ùÆr %EvÚ'õsc˜K«­Èú1y7¶uu_ëÍ&/ïq¡ÐåýNß; hÑ0a3FHò!ɨ¾½3>sÇM¦‘!ÏXWX@ùÕašºf^j›ï¤<š§­[bx: zÉÉ"ß*)»H¿Þ4sÂ/[è5ïŽîÎ$OKûÀØ¡AAÄPé då Ñ`apr0bqWvIÿSnmf˜¤Ž øEO éLfwGnéè ˘¸gCFfׂA”H8‰ÎUÂg·¿?ÿÝÆûéE¹Q¤"Hxôtˆ‡'U|Inì‘éçFBü<¹1”@L%æÌ‹Fãf<Ú3¥Áp÷|>ÃÝN‚‰1Ø&ÁØw#°…®ëÜú…ùª3È=åôÉÛÑÉ"/éÔŠº_Ÿ÷Ï7ŠÛ4($—Ï–÷‡*ìÊu¬PS ¦RõÜ 7¨I œ'§®%¡\AR¶W.@¥ýB5_hE Ð}ªº€÷Ë’VûØˉ.aWýjÞ+q¿÷bb6¿u)tTeW¦»ZfxÝ^O¤YÛ’ÿ‘žÊ07aŸ¦ XÜ»3pÇs‚‘!<ÒÄeÁˆAq—~Æî"¨€cuQ0:’é#Bü<ÁH€+IFuªi{˜<Îyâ0åЯÜ~øz¸¯pÿe·;yþàö“7‡ ÿl%œÚ àéó9?WIÀÜë~\ô뮎ŸEŒªûÒ%òã+À½™¿È†WÕÚŽã©N¾ æ3Õ÷ìZ&©#m¦¶bÊ6X R,²‰²'UK¹+hÖm»}ys3Qø@&8ì¡`/g(t±Ì¬š"ÇŒ‡.AéÇ£‡Ý èÑg[aƒÚ,»HŠÞò£ ˜X úuœuÏT[E‚ªÂ8HXzI¾8Ré§ Âû<é‚3e››‡±ÝrS#ºNùDÜïÁF]1˾£¢Vоùìi¤tØgè­˜ó ŒG_“BÜ8øíRFP|ñO—“¿­F"àœ^k¡²â áº*I\Hz³ÖÛÖýÊŸÇBŒ~…ýOàfЙùý «7ô endstream endobj 850 0 obj << /Length 681 /Filter /FlateDecode >> stream xÚTÁr›0½ó:ÂL¬Hè1Ó4“´‡¶q§‡4d[S .Èuý÷]X)±O§´’vß¾]=–‘aä.º™G×Òœ”´ÌENæK’9•™$E¦hV¦d^“§øq×ÛJ;ÌD¡âoƒéѺÛÙÚ$3Îâ+<øj£ƒ›” Ê“çùCt;~E22ÂI!<£+Hµ‰žž©áü0š–Šì'¯ ÉrkC£/;a[±±8£,-轃ÔeÛ×m7 vÑŒ„J»OãÝ4.ƒ]µÚízïV­MõoÜÚ ±_w7·úÐtºFßeן@m´«Ö>ĺõ w­3­O"ÏX©Øz‡#ÃÖTöc¢ z7Œ­…¾Ì8§¥”Ø€n9öžû” li2K‹4þž(û›ªÛïÜ… íÐj´ƒ7–2žâD|ïa݃u]ãIÛ¹µmW¸™hêæ•*üµÍ“Xr¬Î÷¶ !}9NIU·>™FÄÐd8±­¿y€lú²883jB2l‘ ¼äQ‹B\AËÔ+ÿöÞlóîUÆB¥T¢”¹ $(3øgòl”óõý&ãä}ª½¨V)ÍSîÕÚ&Ös3 —1¦¼:cÙ›Ú-º¦ž-øëteêPCïÐ P/^tË»9 Omo׸7Íq …v6õú(I…?;Xƒiël"dü{,ÂŒÊÈù ܬu`Ùùš¼—®ª]â󥂸L¿·!ɸó¦ X À3 \&ÆôÒà %i1½œà’*®Âˉ¼/ ªTŽ}û4=ÔÊ´5*#L¨óA'3*òÿžso§1@d0D¹À´•ÐÖ\ˆøs’Ž… ‡a÷ãÔøñsØW0aà[ã ÈdNK! Ù•–çÄÿþœˆ] endstream endobj 845 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 150 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 35507 /Filter /FlateDecode >> stream xÚì½X”K–7~wvfw¿ùv¾ÿ>Ïî¿M3;;c@rÓ9B79çœ$'1‚ **0‹9aŒ0‚¢Q $HŽ’›Øt®ïMÝt7ÝèõÞ;÷ÞÙ>׫o×ûV:Uõ«sNª@KZÒ’–´¤%-iIKZÒ’–´¤%-iIKZÒ’–´¤%-iIKZÒ’–´¤¥ÿi$Åþ‘Jär,*€!Õ·Ê!jc)‡«ODSuÕ¾P—Ú×óíÇgµºÏ2{ø¥×˜…ºö]Äa©º"iªÐ¢Ž¤W±'ü4ZPúCD•ô$ÒïÞ_¾CaÞïûüºï+µ{y÷ø_ÉþõýÈÆ8#}c=Ý°¤C³"øÍŒH«Ø}Šßžóg³3‹P.Ì6íJ#è¯ÔÕ]e@0MÊ85!ÀøÛðx¿Ž®Áž¥âä¤y.[Fª…ù>ºz«ôôôÈÈjµ¦¶`O¾?ȼaäÄ4Î2ã—ByðÚŠ‰Vnß—lwiñü¥­« $+·ð†â=Ë´¹FõØUÄ!°’ßB?›ŸçرÈ$"ÑÆw}ýÜ¥¢9œ¡nUå}?s ³7_¨\)S…J%ãBhe¨# Ç;„níŸûS¬“NÖÕ’x{:•â•1)VªHÅ•®1 ™s›5/•Š¦QÎ.6WÒ}âö+ÊÜÐ_a¶¸ý7ë´9äà™Â$3†„ôÝð£=Éé^ºT9Úì®â~!Ó>¾ 9»c`TªfŒ»ëš<Ÿ³ýE·a â¢Óm±Ü¸p\}‡«¿gB³’‚ç;ìÌÃ.H”Û}¿µ^Ìýq©Úd^W‹6Ìø·3 #GX#oµo6Db\Á¾NüI4=e´qŒ½R®9² ’ºüd@í»¶Òqr#:·&…0væ`ir;îИ®e•P:?vdK8$ÑhTÛˆ=°¢£ÍzU•œAh3„_~¢NÞŒ#…FÑÆÞï€pô%•0gÔnfì1¦І¬”(…»¿ì3h¤íçü Š”ÑF9!ª¡iÿ‹ÐåŒdd°`dp“ùŠ}¥s(ÚPˆ1AçÒ2r$”Z]A‚µG4ÄÁS{x_dÁͦ­¶&9+¿ê}sÓÛš—•LΫBeœ CŠZÆå&oÆáIÖÉÅ‹¤ùÅh¬Â’û¤©8F8'o„üœ­™PKŸ{e  l&*ÚnÁ‰¾¡$ÛpÔßxÍ…N¸$â3:©it)Å·Cˆ¹SåÇW0ÂæTÑƉ¢\sNHþ¡ Ò~b¯¿··«µšF¥ŒB]­åàJRÔ–o»žÁ€¤ó´‰I‚¢‚hª^Á'ådêö®4KźòL«¾ §Í]RC]ÅìDrž¨* :Ããn“ì1+’ÊÍýoò©¾r3°'ÛAMjP§µ¡JCK:¸?ÚÌ…áL2›0ÍMRwµÛ<=êä\„ns0¿Û$ÿ>†¸jg=‚6 JÝÖÑ«®ía…%©E›×yÖ¡)*¹&SßëÄ&µþ*Ô/–.R…›Ø̉Ù郦Ԙ˜Ý&ñˆb:W"Ù&ÉbŶ[ŸTd›Ü¤Pë´ 2´É3Z=:ßz2ÊïÈC\І’Q=ù…ë&2´æeI;WÑ;|[Q“ Ь6k@¸£H6¹Úâ­‚Î\νsïNsÕÚø\Ƹçò2r„6â±údK¨¸c÷c˜[ž©ˆúûÝ!rs)î_Pæú¶¬¶§SH©«¤‹l &å”U?Ù]Ì&—vÌ¢²Íà uõ€ÿî´7Š½TÍ P ?©Œ;5šT`æ u 50WâŸ÷Ïq¹Ü‰þ<ŽþxD,/m¤s4Zɸdmžƒã7®ƒi­ƒîu¦ö[kRÚ@t"Ñ."½@4 ¬I]­Ð¼£m bÏ7:“ñö!©×®ß¼ž{^Ž6+XItÌvBhƒƒƒ9áÅÇIɇC7Õ¡1zgƒž×I G‚å(ö£Žªc…š¥¹Õ÷Ž°yP*áß?žL$à¦fÁ›aoy~’ã'/q imÔ¬I=ájì°ß7Ú¶°Œ6–óPŽŽËem¶`hs1ÐÂí\•Œç£.«Œ.õa²MéÀ4Z­âÓ©ö±»Õ¢Mëýã4ß5*&ƒ¤ÕŒ=תѸ܎ÃQQ¶©¸~òÌ!j·3OñF«g–´Ûäï ±Ü©b·‰°Ã¼Û²€6PaNz8iŒv%?i…ºÛˆ"Ú|+» *Û@™ˆ:¯qöoo Ç}'»d¦šF¤ ab8ž¶| ´Ò¹à‹[ÿt"Þ‚VÒ;­’R_ks+L-\<‰´½¼êã`Iay>z÷qš/UìLü¡–Ó× àN݇ÙmR=­Î¼l[Ân·ÎåwxJš¬¿H¦ÛO ö+ì6ˆô0…j ’¨  üü©l•R»ÇE›»‡£Ý£vw|lA©­ö2ÉØnXü5hg5õž©C)lnýîv›¢C k21…a¶uI´eÛÜ]Ž”ßHÜš£j‘æ>Ü´Òåø¢œíÜñ‘­¡–Ž<í«¸Ìp” ÜgÑæÏi·y{ÈÁÔŠ$/K}Än³€6fWg=Ñf®¼dÈrÈì66Éwш[=MÖ«ŒÑ·u\à‘0Y…ס>@ì6ã¯ö­Ô÷™Fì6LßTLuM`3Vç*N¸×wøÚFÀšÂdMê~º)úêÒkR`ªÅ·**íf  ¥Çº iön£PMJÒZUÑ5!Vƒ6jפdeú~ÑÖÁù£ vÆd¦¹¥]ÑãŒÿ4Ž…*T˜Éq\ÿXþÙý3;̘L+6Ç>ðqÃÜŠˆ&uÿÊ~wG;†‰‘[ìþIÕÑ9aC00$æ6ˆ:Ks˜8:ƒF·.ïç!š-=뼯“½9‹jæß%J\±ÃI8=}…J0ÔóŠÝ6[Ü>ão#oÝŽ×_¡§¯g@4KÙw~Z$÷·Ùkê¼Íb%)±5h›ýV_“¿ÍŠ•”&M =ÅY » l·#¬¢FîVëo£¯§™.W%¤—Ýq懪ÔZmN¥„ÓÌìíìw]¯.½¸VOr¹ Þ÷Õs<‡¡M×¹ÑõŸG3M;Èþ9í_ÖÊñ¨÷í-okš‘L&‘ )Vo×hò·ùã2×90êNZ±ëv3f„ƒ¿³4Yžý²K>ɦÓ|{Lžß±U}}Ý[íÐÜõÞø_WT(ÈeâOOŒV®ªè‡§‹kÛ‚#vÞ^@HnÑHßòð«¡{i¿£D`zx½Ëc¥¤_w«¸ŽP“^iò·ÑYæ3»0¬¦×pVS4úÛèé>çÊÇ)?@ÿ·‡ß©Ó¤fÛc]YŒäèêSØ<çD£˜¹×îýWÜZ™¦í+Hý²¢§ÚYª÷¨™tÁë—!u›nþ¯•Ô.êÿ;­)åÄÛ[+9ˆxyÇÛŠÂb[˜1(Qi=H½<½Ùd¥¾½ó†#Eþ®TmæW¯üÇ ÷Kïí‹ýmþ¸Ü}Jn¥­-XE³úž=ÀTƒ$*3òbÜCѦaT ©K/ílL=r¿[“¿ü×fMq-¦á ðã’DÐÛÕ~a³óÚÒïÉ•\8Û_Ô8 þ¢H*Lªi¾OC’uè@w°·ûù‰H’Ó.¡7Y ldã¬êgøÖE…âØé¥Þ|ÛÝÓýæúªßˆHîm)æ{¸9µŒÏ]ô=\.<ëû‰×±1?Ü~Yú¥üÈÅâw¸°­bw怟À6«Ÿ2 «Ò­mìTÛÏÑ™+’ü¨#Géêì³Ró55<òú²SLÆ×I«RáøŽøÕ¡2¸‚¯€,-iIKZÒ’–´¤%-} €Ûîèêá…··7úàêè_'Ÿoyz{{ÊÈ?t̓š~ p&À\GYÚú/OÏÕQ‰Oë²È¶#nµ§——»“ç[…uî‹­žn.b¹&Ù[ëáÔ£`E):ã³ãŒJ9O'Æl»óVE• ðõjçK[/Xú’Ê~z¶ÉsÓ“ÏŠ•OìððöBkí—[Ò¹„Î"U±jIKZÒ¤å çjª«kjjÞ×sHÆ7_ÀÏUÕuÓÐW}žÁq­“Ñ›âëÖD½9•,Hr7ûé­b\¸û¼ºººìÉu†±Ç†ƒ@ÁêÕÑT×T_È\iR2)×'EálêZgzâ½òt”Ÿ$QHfòcU öÒcöª”sO€sô¥—ÊÃ\\^öjš/–ÖXÆþ"[Jß@rà­ÏâBþ®Ǹô–Æz¨Ö•/î³p„ømK˜Q, ÞSÚž¤%-} ¶$Ô.ÐúªÏ1-ýO6¨»º“à0Ñr“@eµÍ)LîÂ>ÚªW;”­ììåÆ(ÚÀk¶Ü*Ñr¶í‚!)zFö]GY¶•g†7áæñ¥h#9t`pF¨ˆ6“íE™Y'P߈¦²öï=”}±›‹9À¡hÓp3ûÈ£…3Ú_œ<žW§‚6ž©§åKÇ1§³˜D'š¼}éÄž=ûÎä".Q¢ìÌ*ÑfûÎÝM3Ú.¤%-}ohSuq%Þ×ðp-Ù"ú¾Êòkåõd Ï8å4ТWÛ,¬w¾ü,î×O ±;ʳ­Ü÷ð[rðDwÄþ‹ÑY‚o™—£ÍüàŽ1ñq7¼à÷tßj†GLÁ“âgöñìªÉÙô]Ź`¾73у3íJš„6^ÛÎËóÉò¤D\F·ÙŽ³qQ;O¿(:šnl-Jjf˜»>­x;.Ôv!-ié«ÑÒ¤ÜêeôöE¾ÞàPA3$¤¤›†ŒªÄï/Ï%ØøªEx,Ï3ðôºY8ýgÛ‚l¶ßiRÙVnðJß~óгo¿…l£ˆ6f©RIŸÃèÂÛiÄÏy‚EÅwÉN3xx40`Óõ´`µ!¯ÞyËûøÔÀÜ‘&Kb0,Ì!â¯\a¾eJçÕ$}]˜8'žµ"RïôóÁP¾±Qд¶ûhIKß m(tj,õp4ÇÑ<+zÐ=˜âC¶þ{•Æ>]/sHþšd›w'l7Ô¿j²ó&~…Y«P m  - úoŸ¾=ÚèZn\ëMŒÝW„yÔϼfPÈ«Ã##`Šôqµµ NR´Û¼Í 7Ý| )>˜öDÅÇ ’m¼·_Ä~Ì[ã`些@^j„û®+²¯„iÒš’q0¬E-ié{Ô¤àMHAlýE=è«êlS‡Ý©ÒŠÌ“NAð^$€/ó´†Ð÷FÑ^CSŽ9GF,:1#·VmàuGƒq~Çf}[´16ÆïÏ>fbhVŽ {éì;:ž¾xOˆ‚•¸ÙL‡Ñ@<_ÊSõ´\°Û`5X1ñïzù··E9¥_’«0Ù”´îÕ¸V¶Ñ’–¾o» {¶GÇÄkÛÿØB ÓÏÕO™•XØýÌD˜Û ¤|.•F1ŒøÜÐ_i É@ó=¯ ©vŠžñ]ù[ ܶ+É6H:¡NäÝ›â˜ÑßV“‚í6 ÷3©öþHJobörD màsM^246ÚšÛ®mb¶.ëâ×@è—×Þ§HÁ%i~f6>'Oö³d±¢ÎÁdˆß›áQk7¾h›×ö!-iéËHÐP[3+\Ð*ø3Cu -Š[f…ÜÁªšóò ¿ó“mÍïß¿ohj˜…MÖŸº?Bá-èÑAÒîºwí#B¸¾µÓóSƒ M½ æÐÙô¾¡Cu UokÓ{Eªo”I}Ýû9¡D:Û_Uß °Ó3¦jß× |Æ»Þ×Ö¼¯ÿ0:#@Sæµ¾oÅö*‹kHº}êüòFzÛ2ª«ïò“<¥‚®Ö55µ-ýò÷·C!ïÇymÒ’–´¤¤‚!ç${¬Þ[ å†–´¤¥ú¯™™¬² Ú:*Öî¡Ö’–´ôƒË6@{\ƒ–´¤%-iIK¡$ñ¹\®Hº°A"œçNÁÛ~Äü)î´@­ p, ×–K3Só_–»€;9‰Xn…\%šœ›¢9Éå!Ÿ79 ¿›ž™“( *²RÁ»5¡ rÍNMÎò6—ÎOMLñD»™Q8359¡‘¢¨3?;‰rà»ÈPSÜ ø"0t]8? %(• eS¨%ôn†;1ÁŸçs§ÿ<‚×g÷°‹ùÓ\ìªÅfOp'%ð9‚Z*š˜œûŠZÌLqçâÅeÔn´ÿ  ñÖ\ø¸CïBJ/‘}á›ø:r½©¡ԣ͒'…ÎÇë9Ÿù¢Ü›Ÿ9È/™D’›—····µ…BfdWÏÊs/?ŸH Q¨t–•%*0Ã,pV¬æݪ£ž¶i%Ph‚§Õö»Š‡çK¯xã]O û1ÍÎLmífË¢RG«·qó¢YF²}×WŸÃ‰D«?nµ% è®Ì±pÝ„ã *yDãêÕœƒÉ3 äåýSËi¶%®ëÑæ-šßöÜ ÝVåÃT›!Ñbú÷iŒ¾ÛyõóHuŠ®Õ>ñ·/O¼å\QŸ23lÓx­‡Á_Ú\£Ûl¢Q)àKf¥Šh£0íJUEˆ´‘J•M"Ò%OV SDŠ³_aoc{éqÇN gom6Ðå¼Â-‰ˆw)’J²Ø"Pâ3½•– úÑhs(ÌmõÑòŸj/áð<1vÈÎÄóc„À…;̓7hÀÑ…Qý’Ï Ð_Ѯ䋥ðÉ?ƒ5·¬Üwá$ƒJá ³}è73"ÃÛ·z®/£¢h#U—*P¹q^ùˆlù?‹Ï®W{J¼À߈֥օüDÑF5T†6-`R)‚6{UÎ+W›…J 2Ú ¯ÄÕ$òZõ¬惼ÿ^œ»RˆD÷Ôœ4®œŽD²ÄÑèZZŒ6 ‹”×¢I»Ð+•åhÓ~Õ|åááÍ<áédI6s+™P’m^I¦»®›R˜Æ¦‹bV8œB¦Æ2‹:±Á=mϾw†[’@ªÔ(*hÓ'Xh¸Ù¾wD¦Å<Ò–«™;‘ËG| %sãÓ<•¾pw=Í÷vÿÈh³?ØÕ}wÁâîŠ>eÆY¤^¨«¹M² ÐЇ©jÛç¦mØ…ñÖVœ?|Ï¢÷QI„’î=H@IŠ—nð ¥%s[¢è$bt|üËÂÓË1´Ý…Û9\pdŒj¼Ês«ù²# ˆvÆë àq™•ȇ½–˨PÍSÈ¿÷½4€Ž‘½ñ¶]t„Ä<øF”¹ö¶L‚wP˜— ef„“ˆ´ð ‰×Ú!Ö‹býìL­œCÜ)dÖ‰Ã(ÚP‚Ï;™™z’ÉÔŒ¼JEÙfòI¤Ž|ƒó½Ã‰t¦ihD¸ ïoEÐÆÐõð:Ÿ@_*Î82Ýz&ÙàçJ¶p‹ ñ ÓÙ7ß E}¾ÇlDŽŒŽdÛÅûyÑe‰p*!Ê•L´\³&¡O ®e„Ǫ́˜3<) õ¶T­‚…V?ܗ̶ aÒ( ‡æÍF¹9P¬½"ƒ\˜f–Ï?Âîí»-\×_"‘9AYïX4“ʾi4~ï‹ Æöðí·ãåG¬èø ˆh Íeã94‡²ãö–kó)dŽ÷î·Ð,g«÷wµÂ×—¡yÄÞ`åxi·ZMj¦d§yª5UßØbá» HP´tfmÃáKZ}A“,ÐÕ!äµ##S:Í ‘Û¸Ͳ Kñ>ƒ ‰NTÛ$ xÎ4ýâÖ¹%5w)ZëQÊæ1xXmDƒ¯-IºVnA)éû—7(LÐR ¬aêÐëáêŒyáo ©, ÚaAP¾o™+ BÕ¹?9:86½h"î63¦ô‰à}¨l#žî%™Ð_`RÔwÒþۭŧ#ƒÒžø’¥-A§O3ãa!mþÝi#¯48p¨lâ¶tüÑ&C«$´ÉæZîÐ\¡ç3.&K±‹Ñ^ä¼nâ^–> õ¨ïØy5uµ?8ÌðY£Íí*‰9€Üd7[sZÇØsT&5ï‹×yŽ5Þü¹“çg$0Ú˜è“Þ"×XòšïëÒ=¡”;®†’<2ÑúŒ–ÓãÄBÂÑ&c"û#zYÞÌ;+‚žªlÓ}O^ %į:­CòÇ®~œï¥’ɵ“ê/.¢^&<¾™ïÉ>sÊ´æ„+ùþ‡ÛõmS ÷¸pœ"ÐÀ¼Ps¯ÓØm_9›-"3ËÁÜ Ã„Z:€vZqœ þØcxŒ¼½äŲð‘™%Ãý<¡V´ùR´ÔI{>ïØÍc‹Ðæj¬‡gö3%- ‘m*_\%Ó=:¦Uí'Šh³ï7‹¡Á<“N­Q6õ(¢ ‹L£D$‰¤°„=½Ø8t ë½êä/-ªJ‡ß®"9ÊS_m\™+{rçȾmžvÌz´ËPMãåþH«äkh„–Ü0óÀóRaì}nžB£Ñ nN¥P¡Þn¯hÉBÅЗ]mý²~(i75¦tA3d'†6cRÙv™ü•·ބΫ½E÷Œ‡R¾êG-Ÿ² ºC£¼polüáGŠÀxÌÓÜ~ûÅW%/ž?^úê¾­áÎ8hÍ]gÈð<~éfC§ìJ4A'SŸÕ"kÙŽª'G2÷nß¾=96˜â…É6ŽGdrÜ Ý*½ûÃjì6™!›€ ¹w‹ú¹B¹ÝFÏl›mú‰Ê•&Ž$±Cð:|¿ä\ªòÒ›¦+Iø 5Ð,]äÐãŠW²Û@ÈÑ~O^1æaFœMÊi ×3È[^kºpGdjœ°«àY¹¬DüDša੧HæÏË_åÒWRëDàáaGŸ ·±¼sq&AȆ¾Nk]Êëy0Ñþ˜Â4+~ŽÐ‹—é^!{ó`´¹èi’£Už¾m :µÁ% ãÞLåe´9â¶úü %Ër3¯>ÓÝ”B,lžTa»"Ú,#b"&Š6Ãц¢ÏÂ6nK{íð„¼Ý<­ðWÊzÕÝÛµ¯ ëTùïMžÖ©wªóY7¼Ç…ŽÅ*ÿhÍu …Ô=ŒÕŽŒP™1t ËlZ~f²¢lcNûôyÙ¦DS•s_‡6ÃnÐ9nÙ>ü‡»c­ROiïÀ#qlä¦ì Ž:´×¤ÞŸÞD ËÄ¢Kç=H”³-ê ÙplJ¦ÁŠ›éË)ÐÄsÚÝ(8oPžû<â £MêsùÔu/Á+újUözËyÍ°ò8PEb²ù²8|ÖãÑFk%þ:ÙF >¼Ã„Lb*¯€óÊÍ ¯WõOMgDZ½ €‚•øL²·óúcŠlÿŽhƒ¢Zº­‰CÚ Y;O…ÙS™.‘Õm££Ã¯r÷“L/6ó”L¶>½Vdû.(FkÞîoÛêK³p G×Äzá¬Cj:‡ÆÇÇG‡ûN&8šYû $ ÃÛ6äB™bñÆ^ï Ð"ªš¢0ÓÇ¥[ÁJÜþìêæ#7QÈx°'áÐó!Y-:ÌuÈï™{žß8¦|…„Z´’ÙPmMnÝÔôôTÿ+ £Çíðj|¸ÝÔ+ØåðG8VG¶M ³e"fƒ-:›u»€Ó%,#ã'§¦¦[žZAõàa¿ëqóä$6µ9³ëÊ[ î3×%ôLOΉÆÛ06äÎÌÍŒ~|âdgb8+öÞ  2Ùú¦§gî 'øìV³.yO[NyÚ6%<ÖWOÃ3êy`1Ú@‚ë|ßmžò¾wdjjêÝ•-+Ìak ˜dH{ŸwMNr+OÅQȸ³0ÚHn¤Ç_x «5â¾+D#מñI0_o©otþí§ééé¥g©f¶s"©z³Íà]œ¾móà8”ÑHýM#¨IF/Q)¦mCPàdiv”ŽÝ6´A”¾{d»µN$Ë68aè?^ ›œýŠ ñŒÛãmfpüiï"ÙFpéHfˈH &ŸG›yfÖ)b…Õ¿]~4˸#çû³"¢Rp°*ÌÕšÆä¤yŒÎæfŒÆÑy$Ê\œ¹þÖü…£Ågž¯7rG¬÷ƒ÷VÑBähÃ1cÖªØmZŠhV.Ú¼bš°ûÖ¤xŸj) NÕ´D.”æt²6c²ÌÂ6eŽ«[!¾‚ ½:€Í‘FÞËaÒÙV.Go”+.xq5ÀÅšÁd²-]2/?C5*{†É›^¾â\%áO˜²˜ Ÿ»ôÝéz(zn†øˆÑ÷\'Z6îÓݺÎ;_žF‰Yä¦"é° 0º¡¬º®¯bEK°Â Ž%‡³˜ ;Ÿ˜†O°¿ô¯÷‘bVˆÉ\ã¦øìÂFôÄŽÝVÆ‘ùŸ°ÓL?½‹ò´¦Óè>kv#'ÁK%¼¬M¡¦Žhápüvö{mnÁJºMú¢]Qn4*c㱇Ð4žîϱöNè¾âÃÞôúÅÙT3&Í9d뺕ºÍ„f£MQ<ÎVmx}Uq¾t:ÃÒ-¤¸nbImš‘]¦ mÞè“]Q5™×QèȦÓé¡ÉÙS²Õd÷C°#›Á°¼ôvl[„Õé']P»¬t×ÜA 7ûZR¨æµCbéd{b Îô_·gZªA @«-p4gÐéÎÁ MPwA2šlzàmË‚cv\@]u ÚöB1ö/S§´ Žâ3Û¢!¦±í½5bËïr|œ×Êû»'uUa3_ &ŸY¥]d‘ª»}‘¿Zgù]å‹üm”n]W½›^%³ÅÆ©ú+ìÕøZL||F1w[œ£Jµþ!êäaéÙf4kR›üGv¨ù^Ú™yGCK(2M­¿TÉ_Dª®!Ô ±¨½¤^ª¾Žšë«èÝ£A%TnY¥¾µ¨æ k:ò,¹¡m w›/ð·Qí¡jûÿRL“Ç:îõfR 'ÿ³ úÿAªUà‰†[‰†ûcßídfÄ1µ!¢©!î¬@«è/MÜ¡þ/ðiîä_ËU¦k×î”úsu XÛ–ÿ#ñFðº¼\ ùÑ_ZUYΗhw÷üÐTõ¶¢|U4Mh9£%-iIKÿ“¥ÆÒG×ór'øàÅ£Íý³_‘L}Ùí²Õ•â—¯è›_|S¶xðõ•{5ßUQ§Î÷ÔÜ}Tùé‡ç¥zMÿ3BxÝýûe?v_Qò¥"6äÃÁ¤\ÍÙˆ…êå9pä0ÈUhß'ÁIdCAÙypø(˜Uè'eÀñ#àÈQPP´ðý…ã`ÿé…ŸSÀ‘#`ÿ è_0Û²‚[°ŒñþœŒlyûàE•”7výV5»MÖç=k„ŠuÿÚµ¢ÊÅQðøæøœ~ ©¸}ùu¯È­Hó£¥E…7®_¿sÿIÛ§iŒ¹‚¾¹·çIJn&ž¾y%÷uïÏÏ.Í~#Ñœ<3Êў䜗_Óó³LN5¨ß½æq A¿ ᇠ![n~ÇêÜ Å½YäLWu#9ýRÓ÷845 Ëó^&ßrÈ6¤¦žiøÂô(ºë¾ù'ðÛÎRÀ7ßÁâ9px7&¿ÿˆØíãþù«o_fý¦ü=øüðïà›¿ƒÄá|ü÷ßÁ_Bþù*Ø â9ó»¿ßü#–þääÕÿÊû>'*ápûGà.~hú~!yév©¹±Ï=î0k!²,#\@Õ¾ ØËeôÙÙÎ\„ö¦é”Á{0D[LWl)šA_ ÕÜ y­ŽJJI]F3ÒO¾üþzº˜bdö sw³w]wüÜ á|cå î­³ ê22´×JG‡º»»û‡7aoWY 绺{ùØRƒ¸¿Ž¡Mâé†éÑA(ʧQÌ:?<Ø3ÅOVÛ0K{Gçá83#=ÐG=}ˆ™Nd¼¯kpqaãvö¡îgⱡ®îîÞþAžÌPÈ›ï…böôŒMÍÉ 4µž¾Áyòs°ÉOyØÒ=4«äü0;Þ70ŠLsâùOý½ÝÝ]Ccb©Æ% îpÏè”;ÜßÕÕ=8•U§{šÇÿÔ×Õ?/ˆKø3HJÝ؃Ùô`«íy×À0â6=>ÜÓÝÕÓÛ?Ë/Ñ/xýý#ð0¨vBÑ|_OÇÄ \xá, «†q@2ØÓ9=¯‚R´¸ µ´¶iþÂÀ˜@[ZÁ0ûP"ÍÍ s¦àWm]M¹»üÿ߀_ü45„`jIð#˜–™²?Bß ´µ‚íi.ÐÝt~ ¾ù ¨ÿ v ÁÌ à#‰–‡Áƒ}êoÁ²Õ hýq¸Œ•] Ú`ôOð7®i2ÔÚŽÄ¢(¡Í\;øÅ7p¾ý‹¸9Û]ÊBà‡¤ÑE¸`±b#Hxcý"þTOÔFˆ é"Þ`_/ÔÃ'fŸ>‰¨»§W"žëíî˜À%ä#í5 rVr»ópï,„´Þ?äL¶ã–h×ZãÊxØ!^¯…¡ÃÙ]®¶koÉ»®*ÚÀ'< 1h¤¯‡äßßÐ6ïæОÑ6yÙDg€Ÿáy?BîÀ=I4:3ûĉQÁ‚ls1Ñ–ie¿ï@V •©¡M TËPöªÂN¸# Tß PÇ?"}cöÁ¾M);í´ÉÔ60-)ŽA%«Ac7ùâËá×—Ó‰8ÆîSçJ‡¥³ïR(ôi»SâüLôéE·:/Á÷âñ+RVÚÀ;¦oí¢Y9ïÚ»7ÆË‚ˆw›…†@Ï ª11jSúŽMQd<5§nèþ[ÈzòîÌoG«¨Áo¤©[zÒ¥¤>É´öØúHæ½Édk¿¸}{w:[Q}S/kbËÙÍGïõ®ëܼzÊ”N>Pw€Ä FLpœ­Wè¹¢QÑT7Å„è•œ•‘dN6Î(¨‡'²Ü=d<-ýäÙçÂöüx"™–´++!ÄÃêÜ¡yq¥ô¨½}â+ ™›RvúØú…F”œ›k{llHôÝéaN ¸OÁ;þxLý›õÀ)‰¯žaÚLƒß@ßüoЩvµ¯Nÿ`hÙ ~õWõ¸;Æ”+©íµ™úÖ±ÁžWoÝN¶`ZÆ#i ¼,èÖÞ¡›büñFô{½0?„'3÷{2Âcc:F…¼†\‚>lóî­ñši‚î÷7z™§À*¡pz´{pBõm]\LX™X" Úk¾Â¬›?BÅ3^q¥êeúóüMèùŠ.òâ"h3$ù©Ìààgy´\âé¾ÓAˆ€GŒ6ƒ³Õ×W1ý1P*q2§å7ŽgÇ{ìɃ·Ç>?â¶ñz'ÞÆØsvµÅnx?rö&K§è]˜[‘B EÎ#hs¾xð›iºlÄéDrч±ö¦© v6÷ÂjµT"ÁŽ‘¡0‚´êÆ',÷ºÊjhy”äí{ªcüHçÇi‰h Âz™¯àéÍÖñY¯€hÌ G«æ©Ún´©M5Ò(ìTê‘NÕÔ¶ij±s)V®QØ-WóY|4½$…›¯Þ‡ŽU´‰ÁYÿ ‹ÞzFWßÞ®#èfé3›a‘‰gÁ ¼éÅ/w—sàÆËšÄÚˆ-ØôÔgØýVp‰—žIE).Ögêaô–HÄJÂrì2ôá)nEÀÄ>!  PÏ}SDZ€ÄÞm´#¿…žÿ‰8‚ Æ1Á’sþÑ ‰‰„ÿ“†6Ðó]xû&Ð…"þàÁÇ ÿ!ÒÿÐ’› Tª¾¦ÚüꟿV¦þ-V=ÚˆJàØûUUmþüëßÀß„ßýj„:´/tÖ¡× J·`˜ƒ£>çJ;OøâC°=¹onî L9 „#å@=¶a³ñÑGØ…D-ù!LïsY^\dÑûݤ¨[È#„6¦]ž”g2Ì‚POÚEh#½Lå¤U¨¯„6ÆæÒBôqƒàg|Œ!Š6‚´~s5Ã…§s‚×ï,k’ø0ôŒaBpð½p·TŠIet 9#ó B‡7„y9ÇíÒ´Q'ÛâÌLØÖv)Yçz\”Õ M2'6³ kÔù÷ Ò $…2Üú€Ôq>Žd¼½F¾%«ÏVO¯hLmf«èxê°l–ª¹•ÅÜø9ÙFlaFyÙ=…ÄóÐ×ÍCN©ùÌ™ísOàqä+sKð@Ú.ÀJ±À½ðÏÔFÚc‰Úë€o~& EÐæOˆÝ¦lþüÛ¿Âþúðw¿¿‡Ñæ?±wZÂP7ìd‹¡@Å5hDˆ|ô{3¡m„Ú˜gªçÔïœùø¯oàïë¿pЩ/„6Ëiëd;©ø t“¤7s™®œÈ;MJÜæHŒbS½v8ƒµ»#]îÐÞñt†«@¢1×Ë!VG˺ähƒø—óÍL6<R6Aö¶JMhäPì6\8ïiwül]µ£MÅåV[åL;âié—û€z*!XÀ«'Ù…@Ó¤7‰Î•Jìø¶IÌJ¼ñD-f˜«¥ˆ#‹ÐmÁ¹ñÁÚŠ'Ûã<ŒñÌ+ï”6ËѢѾŽ—…WÃ]™fö^cˆåB0=Úðîåþ¤P}Ê®ÂO‰W4²iYÕûZ”Þ¿olëâ%Ñ™pº>6Þ<›eJÄ»&œÒÄ“sÉì¸CUX›Î×3ð&ýBÂ6¦”×½è:쬫wcHÕz[+ÒÔ-x†^VZ!j>n{‡ý<€X06VchóW,ÜQ ´¿€ŸéÁ ² ¼zÿ)+—É6zXÄ G5hóY’£ ”åß}~m 8ÿ¶H“šF4)²2änè-ˆ¨l ÍýÅp!ù¯_³Ž¦ˆ6¬Í2WÄÄm¨˜Ýåĉ½×¢”,Œ6Ì.Ì\Öe©ot¹¬±VFuu껫¦ƒ)¾i=~G†6Ð,9þŽL6‘HkR½W}L M mVX“b"&ÔÙxbô¾‚¿Ùfp¤ä¼¾M„¼‡ûY2O¿¥Ç$'|vîEõ°¨Y¼•ßü’ÈÞŽÎٛ̃·\Ä„ûŽSDx'5†6óÍT]6ìÒÞÖ÷² Yàéñ >³mþ2´46uÊÃטÒN6NŒtÕOÊêë|y”c¿’~éTbßœ-åÌ|Î)ªIÕðTG'ªIIæ†kÚäöœNÎ2RµP“&eé»á$ÖÚ]gFîÌ¡€6 /çœõËf´Àp¥M7ªI0[àcTÇM©&'DhWyp4Ø36ûÛ  Øf¯³õÎýñëÇ5càW߀¿wF;2XõŸ€Ì³-ð`üoì·åðÏzð9´ùj´¿†âZcßÉ·m~-ëIc ± ñ>#Û@o÷š"9þR•˜ðˆÖ#cWålíIª¼&uÑÚ~gõEΓ#pÁFæUd›UºÖØ‚2×Ú˜|kHüv«)þ.ZÆÁ÷E»N\5©´a+鈴Î%™™u§ `“…6‡½–Ë6ˆósª£Õæ[~U+± ›F!œ®X°ƒ©V “ŠkR@2^og¬ŸwEéÏm æÙ`GÝ“óæmeþ±$óÀqĈSG55ÛYëº3õ,o„›ù >ÏÛùr´áz©§ËºxûqEEYÞÑ «5šüÎm±4³ :”ÿäMYq”9.ì¼Qmfz‹†¤«K bí¨Q'MÄÒa‡UFÛsŸ”4O]Ûìe–öòõÛ¢[§8êÓ^©¦®¡mZž5¦Ù\/|vïêQ##fç ‹ü±A%|U!‚ ;K ÿ[ø!⌄ág²0ÓAV„‘%Mhæ0{Ž ‚TGøÙÐ Xáá‡-O5£ü_$"Ó TŒ€«Ið³ßËÏÉ6¨u1-^½à²ð¿C,Ò<óa^iM ‰A+Î•Ï 8'#á/#ÊTd#¦c̆ÝoÞ^;¸Ïð†gAg°ûÜíâÇ·ýÌñ{î´)Ë6àí•4‚…÷Ý¢ÒÒâ±ö¸˜óõðy,'¶­?Sªê{“lw°VökA¶A|G&‰ˆÓWѤàv¿—e¢«³5+7ÿúÅìýÝ$x‡¬ÒšôÝHÝ-c#Za‡ðgw)oìÖ­{D;OH.ù0Žp„ótVBb⾓y¨ãTÉ™Æ'k×oï’ +ßüÁÔ”ä¦qʥ³[n¾/¹z(!qóÉçÏL~ŽLÊ¥9›7'åÖÂÎE×Ï$oNLLÙQXÕƒ.ÜÛµñÐsØÈ*lÉßulÇrŽîI„¾Úu¸^æ3øîÑÕÔ¤ÄĤԼ¢÷rðS˜³esbò¶½ïº1¥ŒÛX°%9éô+3ù©®ô;Mðð|wWV ŒüÞ7Ó·$&&ì;‘;)YÂnÃ^¢®<ï(T£W1ëô•ìÔ·ƒ öÙ¡šÌmI ‰[®¿\Ø:8ø6/))éÒ¸Öoä$oJØšqäã˜h‰ù·ùaFÆå&h䦧%·¢ËôHúÃõ·mNÜ’~ð#¶À.ØîÁȯŸWc”¸ xºŸÕ ²ga0>:<Ý›¸ù ŒGඋºg=°u¨¬7\ \]_@Ï„yqx¹O_ðLvC€°•Œ{ptè)VüÀË x€.(ÏŽŽ »Y‚‡ÏÕ ¥¾· 8A9î€æ„w0¡àÝw3ø¸ÃÛ-¤é ¬‚DaÉFöÕεÄ:ãTKK ##œ³ßº–9Ù‘žðëYk²Þ*ó-"uÇu"ÿ6™{c‹#]ÂL(!«C†çÄ@ÐïamB “ &!IYj bª3ÚÇÑG%éùF¦ñᵂٴ¨`GkZðfØHÄûänIuðôëæ ù­½íÍŒ T¼‘KhW [À¹d²!áà“OòúçG[í~ÚÎýf¹7Â`=Ýë#àÍ&ºõ‘oaÃi»æfâû;Ž;‡2ƿצ¶í8Xø…Ÿoò\¶ù|럡Ë]ÏÚ‹nyýpš³Ü]=Ó:.Yÿ·S>úêÄ®C³ÚúAóo÷ÇoKõÚ|ìüêÕñ0ë€#ç(¡M’ÙòÏ ´î°4>V"ïÍÇ×9s‚3ä?Çî­¥®¹¾ÚÖè^oñ¬tüÊigÿØì´¸ Ùu½¢™áØ@Øn™uy¦»boô«DÎI´r[ÝŽºÓ›™‹#ñäĺ°TxÓäÇ+4v<ÈÖÝy]Z’ð¥Ø¤UªlµwÒ]Vgɱv‡—ÅͪAÙ'‚SB9´u ¸Õõ%òšHÇu_ZÈÝÅ„J¥êÎÅÕp7·§‘å¤êD°ôª–:PWÈn¬.ß6ðä"!Aªîjl‰BÕ;4ÍS%RuÇJ£÷=¹ÙÌ,J@ªñ{®…‘§P™'KËÆZú)‹6ó#unlïõÇ`o&1W#ÚHæ¼ð¤#µ3 =V"kk¤C†°é¹ã÷·­öɸ©nhˆ v‡êâ,î5Ãx÷ÃhfXÒKæÜÉ«^öc=©ï]¶©e¼rÿ™‹$¬8Õ.ëÏíÇŒÉëQ”Âcñ(Úp›/ÒìÑ‹E¤£}<™SMÝg³ˆ;*}±ùI¶cð>Y×ÙR‰mPZ.ü³A ôûvÚÚn)}±ÿD5ìôS¹/ôÎÛTê"kØèoM"“‰L»Ü’VE´™ë( wæPéL2‘žtü.AòüÒ^S:͔ŠY¸Ý}»ÇLõ¾u6¥³L)DRbÖ ¨ä©T…ÆæX{]·\Ÿ0.»ëkäáŽß™ÅKÇÊþÃÀöõ­Ýž®Nl’ÉÆCwÑØùú¦‡%ÝÔÌ”fævçÝ'´REÛ–ye› )t*Æ´uð†Òg“VÞ½z„j¤s¦d¸Ù[#Idºƒê“Þ\á—⯟š;IS7¯&“é 2Ñ-jÛâ;{5™ì“^œèâdG´ð®â©¨˜—½5‚B¦1($ÇÕI¨OµhöìÎd‚#¤» õ—MnT2TM¶yNh>okà{·b«…¾lS$DǽWxlèºâ´ÊîE¡ö42™faeÇfêEžn‘¡šˆmòǧ-3ïO¬ÿ/› Úaü3¢‚—ƒÅm鮜¢¡%Ñ‘£M t·g_¯kjÁn.Ʋdú`:Ê`ü±±¾sÿâÉNØaÍ ê¨Î·;¬Œ6 tV»löšì,¡°­%J‘E‰¦Ë÷T`ò’¸ý4ÑÐbH¨Œ6-iv{xòZË^4e{TN«Ö·éI¶‚60ÞÁÛ ºÐ2z´t‘1gªûÃËš6•=ÄœžQˆ¾244oW@›Ô(ÿÃE¨ïñ¤·¡Á©N šë¢R¨˜/Zïûø考¶+’J°F›£|JZ¹@TCбE¼…6„50¿°½1éWÞ€‘ }“¨ls‡+Ûä^ýIÔ¡• Ž¿¦ñŸƒÆ;êKßÃ_6ÞÛäˆ]íbË´Œ½€>?<ào‚ ¥…ÉÎ8xƒç®HÚîÂÚËÈך|¡¢ßàuPMªõŠ'=ü!Õ1 ¨¨»ÿd Nß*z÷u_òê{0³gëù@ÐÖY|†î‰&õm=v‰o)©jÑ៑y?<õ{Þ8rsòhƒöÁê¤/[kK*ÇtŒi›D4Òç‰f;0×ÊþÄ]7Ú•Eeøyj–‹¸ŸÆ”ÐFPA^iÙ+¿¯÷5ÙÌJ¬ŒT/s62솸“cÃÝÞls"Î ½^Ž6-·cXÁW6æ š=,lìmmƒ6fMTÅìžÒ¦{Zª·ÛìÖĹlÓö$L7=tñfñóWÖ»3P´±[Žm†¾I4°Î`ØË” µÝÌ e‡^ ÐèûÎä=‘Ÿºš¡Í”·žáÙeÔ"´od>JÛχpÛîªGJ9Úo|*•ðÌè¤Þi±ÖÁúçOüµT“¨Gc cSò‘³Â0oˆæ' ®æˆ¥Ò…ëꆟ­0„{Îhõ5hrv% ¯Ùj¥É㉥0Ðø±t §½(•ã˜.•ŠÑ¤fçæUÒ¹j äv›­ù@"|²ÕÂvb –ö'E­ïbCi¼ýÍÌ^¬\nÝ}‚•7_,’?1ˆÖ˜töåh#í7'´pÑ,T"–ÈÐH›X†xÙ%ÕÂ$¦†6¨L$ñÛ Œu,Û’’…‚0Ó#EM`N.ÛÀ©¾Úlîqîcz€Õµ×ÚYöÈâíp³]{£æý™dÓø, ~ùO Ú<ÁÐf~uEÆ;6ZgK(ú¬þMj.Š`¸³Óò%ûkBH¶áa é4‚õ4|rv ð«Ì5ÔhmÄ©,ä²yì ˜Sµh5;[Ïl`²ÚÄÈ å—Z´™í~Mà8Íwç<ÏI´÷rý|H83pîüeµ0¼9B¤Yµ£c†›²Úš˜Š0cæú8¿ùòÑsd£§©O”X Û$êžÒ¬z%Íaõ–Ð7U·Îß©_mn&ysàÎ MøNDBv³ªòó(;Â=ú’gŸ ƒð¸s¨X‰›ÎÉ¬Ä Øž‹­p‰÷úÒèQ1?ïÜ©n®µÛ8ï…§Ùª´hÙ±´á¶Õ>~ݬb·‰°dÅœCÎ[xi Ïn‘£ °Ä¼Gª[“·ÛÚœqyDÐqÕÚNfÉœ|i¼ÒjLzP¬Še\‰s5;^Ü xo‰ËM;ä™ÌÕ0™v×aT_©Ð74ñÏDë³e=mš“eä•ÄûÝ(ú;ÚÛuLÃRÒhkÕÓ·°íºæÎ&[Ï‹Ð<Ë·ÄÎ2ʉ¶¥­¿£`·ng­Š¼ `¢ÜÏžA ¿  mmk™†þWîfjíèDß\Ycæ‚*­ÀÇ’t¦¼ ÌU–±»UÑ$°¢â<7c×+,  ··ÂvT¶‚šÈ2 °cæu`KâS] ÊëµÃù'N3e+u ¦„µ3csÙm;†®î*"+ýÄm.vê;MtJÇê˜[^™3Ý¥Ò'K•Œ«ão¯þgÏ`ó¿Í4-…6pʼÜ}kM ôqD³“…5`ñ-Àóc7xë›P¬sž7Ë—y¯IÁæŒ~Ü媯«o`h³ý̤-×ÜhY1rE¶&%9n§w¬Qv>?²&µm*÷†ëûïSa‘tªsk˜#‡#š:Ý} K/;ê{Ý„¢¿¼´'˜ql=¨ï*9¼r¥qVÃüƒ3i, RšhÖ^÷ªáúÙÒÉ*‰BO>~9Û@r$ÊjÅ*ÜŽg\´z16lïS¯es@…ÙµæÅ){ÃX×(=§ìu}­id*•Â²»VÒ‚JtÅÛ—{öٹjS£D†=¤fšSW=hÅx+žË?¸^¢P#wœC»\“šlnO5`0Xá;.'k88]ï}÷îífy$cûâ屿£¥«º<×ÿÚ•i)vÁ[NÌO7Ùt³!|¸y8ÁØgdLÜu±1[I²Â,V¬2Þûr]“BËÜw}ÓïÿûÓUØñWuý‡»%139.õàMð·Õ…‡Ö&¤Öqµ®ÃZÒ’–´¤¥¯6íH5)ï?¹’j4‡(‡þÔ«ñvaK¥TF Bµ;®ÔoU[¼MCŸj2ý©|®ø?ˆg’Mr^üÔ :ÓM YŽjî)“Eqx~Oº°Å|}vãW` ² mÖ”Åjâ ¾4øK&ëI4àêžulÃÊ%èUÛ¸lÿÿ⎓é–2ŒìyC£ÕÝó°6e±.¼ê•#FEÞ>kSšéÿkï«¿ÚÚö}ÿƒ÷û}ãqß½÷í¶8!DWB‚×àîîE[(” P¡õºëP(´¥¥†»)^,ñ¬·,!Xåž½Ï9ûÜõ£{‡µÖô9?ó;¿ó+fç*±˜PÈsÙþ0;¿ÝçÔ ½s,ÍŒmdáàó¬ãÛ¹4ì…ýƒ _;‹/ú?w—ÙzRr õëyB±ü‡»”â[ÁÕô{hóZª‰V¡MWÍõØ° ð¨¤ûï¿‚àªËýC»‚Ãc¯Õt€â,¼»““ú¢“QJÚÏûï{>Öx7,Ð?ißyhU¶?, Î)~(S¶h¼ññΨðȤ'Ís˜—ÚØÿeo¬ÿ¥×°b_óýSá¡¡{Š€Sýâ.Bižœ;~Öï›|™w¶»çYIXp`®#S",ÏÆ»Ea¡¡Ù§“ýJ¿Õ^u°³2³rŽNßÊ— ´é®œÍM ‰(}h$ò‡¢ÒDó"ÂB&‘àÄ57â"‚#ã2jûùªãDùéá!Á±É9mpIâ¹A__W€ià4-;_ÝŒ ˆ¹ü´q=d>óÞyV¶Ø‘±óí¨ Pñäé}©Ðt:pî>ÚÅÑV,#'OßÝ7aÁ{9œ´Jž\ÄËÌH[b·öGÌ2N׉‡ßXReçïô0=S Û]žò'켎]?I;Ž€Lã꟬žA“OV…Ñí ¡t]=Û>-}q:ÝChÚ,çd$Oal‚9&ï™jžTìvMºÓÀÔ@ц÷¥>4÷]üGÒ—»¾Lû¨â;/>uCka“NȾ\ÝÙÙ~ãH<Ó5 âe‡û^)/Zûç–ý¯ÎS˜¶5[Zjý„ýÏá$'ÒÔÊ>æΫúî1áÊäš>ùÎËm 鮦!'‘Øgün}Ó/l_×àÈ@[µ±áÓ$4¦CØ”Œ’ÊƆGÃØŽi ÎéÙ‰D#׸÷ÍMuO숄߻á{¥wgöfß‚ÝÔH»Ë¶E(§ÍŠ±­wFöØ®{Ï|jîW†7ò6µWv2­CÚ:>¼¸Íõ°4p» ½¯.Ndr£>´´·~ªñ¢êfW"æÓÒ. Òé¯?ÕÆ9’Î7¨«)¾9ŸÎp ¯ojo®êHÔ¿€[iÍ%²l ¯=9nbâuöYÓè×¾z1bÕPžG³ô®mlkùð¬â¬üêβ·~ô¦~pZÖÿrÕ~ ƒ[×ØZ_}ÅJb{D*œÊòô/…NR ðtzZ÷¹áí=K=íëíbß«Ofù¤¾ûðŽ«~$†å‘ô¡¥£±ö‘Áµ^™B!Ïp¤úî+inm{_q–¤oÑ%åRqÃÃÝtVLgï—‘ÙçÄ÷M­­ïw{Ñ‚Îv®aXFoëRͲΌŒµ¼¾J64áÁœðWgŠ~Þõm—÷GûÂ+werÈÏš}üÞ›‘h7Yð!²ú6ð^;í´N¼œ¬+5qŽ•¾"ï¥øx?…0ÀSWÿδҶK1hB$ ŠÁ )ÜTo¼nä~fµzÕÅiî*ÞfmA9\Üǘ;5ùäS}ÓèüéKߢÍâPCRV>$os?ÀÈ,»Ž31”È Ê7"[Càf]M Ô~DÃ#ÇFcßK¥fÙär$ôxo´yÂÉÇèP–‘Ü/baÙAqQÓK~.õI‚ w—~óÝÄøÓ"·dì‘tüÚ mÄîL­eêñ·ûŒª‹L7G›þÓšZVÃèî$؈6òtÓí^.¡›×«d ‚+Ó3­q—?œùTÀ`…Aûê烞̴ûh•x£-eOÔ±IýX”'æ?0-³ak¶ýÚÄ`Ä l~rÄÔ=­]íNKG¬bÌv\j”m¥½ÅV*Ô aìÜ»ŸÑetÌV+úÁ<:ûŸ¦»kÙRG›©ªPºi2ª ö—üF†þÄF3îMò$ÙEÛ6 ¸Wšu[y’Ê¿ ±0î±FY%m  OÀx†Ùm ¹ íºq¬-Ã/²Í\ÁcH‡ÁµÍáüvø=<мæ#t“]ƒñ6ÇË|§Rú!¯HÖjÝÙ¡cƒŽ‚B"`0€.ž¸ù¨?=QeÞ²ÈÑg4 s'ÒÞø:¢w-í}`ÈMZ‡™ø†~µÃAw©ÞÖï0ß{Ž·únõ˜8gIÑí€cQÍ%ØÑif¶–Æ4‹À½êâ_5´YSÐóâh¦û^Œ•¯ø1ôëg`N C5ÝH\düÇ¡?ÛÿÚŸ—üèkw7”\‚ÁžÆe5´™v!è[8¹)ßÛëk’ –yo$»  ÝJ„‘Cc{ô½»»3a»nõ‚6$ •ˆ9Ä•q½vâÕù,ÛøuG‡L²ãbÙ;;XRÔ‡z ´9µ‘$VJ‰7 Í´³–.SžšáÐI Zaæš„úlŒ½ŒLE2ð˜¯Cص÷[ñ€–†D[eݸŽV$ª¥‚›¶ýšœƒ¨<«õé [Ÿl´vŸÓ-íO}€vÖÎXºrm F~‡¹1®¼AQ•ï¯OPGƒ¢w{4,ó×£×UL^öõê6Z¸ùêJG±$ÂÚ]V‡7  £C)·9¶Ó,ób#Œ6$s¥SÔ.s2I9JnNö4èéç{'ÝÞÙÅÝÃÝŒJ(x»¬Ž6 d:ëèC“s«ëZ× ùÆîl£cEJ—˜  mNRä XØ*§“ ]p ž®B›×ÓÃö=Qc9D%)öïìEäQ׋“®)ª^fûYçC{Á„õvòKêñ‡¬×³ ^Nuâ&Ÿ‚'©d6?ÀÌûh­bÞF5’ë™nl×ô9%ò¼;x²ýÀ¾5*ÅAæOA›ÌïkYZ€ÛÉÊ Ÿ¨Ð†ç­§ukƒa%„6‡ÊQ(Q*“¸·sƒ\p´ÿPº—•»V4=ÌÑÕïÚZ½Š6ŠµhÃÜ)ÝmæÜuµ®b…Œ]÷Õ‡y› ]íW³ØÃůOF"9x1ÄÑëâ[õ*©-¨Q+ÝMâ†Chc~@…66ëÑfÚQG»fC,Gm®½E¥^‚P¢þ©Ì6š_•¢aUð#´èÂ’,V&iXÙˆ6›  G®qÀLпv-ÉŃFtJŸÒ›H6gÛ´Á>|ÿäwKÀyïëu¼ÍF´¹åêSònã8ªÐ&ÏÇðR§µ ¢,{C—Œ*ÞcªéÝÎ[µì‡rS®ÕB@‘l¤QԥĂ•:º¾5œµ×Ñ~ÉÃ\¯ gjtÓ%é&hƒºû;àF·GüÍb½yýªŸ¯7D>¾^l:ÕŽërå .)þ3ÑF.TïÓ0KÅæŒ\øøî3©bÍIê|$=³>e ]u]ßÖ¢ ø¹ÀÚ(ô66‘E#Ïj‘盠ͨ°é†&ÃÝâé7D=£ ·#]x1ŒÁÄðçæÑeø S"£|ûׇÛ)ިѯd±ƒP·FÅÊò² 1lÏçê$•¢²ÙA;&Á B0ÉÙðèì\ÔzÙ—í| ZÑ“·â´¬ö¡ˆÒý¬˜f $\"¥'8“Ž?Æ’,Ž56~(~Œ6`®9ëJ;v€™ný8°°mÀRo=Ÿ"Ì´ü°¯Ží¡ï£ ÔÒ žºþ§1/åùž6:vèI*(4³ìçÐ ²!ý®¬ÀÌÀ§Ö±¹àƒl6‡ú¿zDÖÕÍ{-P¢M:ÔþOWZ‡1–âëÇßMíà/E++bÙh#š{˜ªi™!´|éñý9†6&Wa´éeÜ0L—?LdÛdU¯™šËƒ‘ÕÈGgÓ²«1áY7<ø•E¾îq¿£Ÿ|<èÈLª€º6ØQÒ€ÙƒO7LoeìnmÒÕxEu:‡“úà;+Ÿ¾ýÃz`”‰Db"þ$Þž½vÇaOή ÅÌu¿b-ÚÈ&?2 È6~ Y)Q €~¹]RG¹xÞš»„ådî4cv]®ÛmàsÄÕÝÎÛ,.6 ‡jᥰÒz™N$yE§§FúPèf5ÈöRje¶÷9Š_Éûàœ¿›™±è]3Â-ÐfΆªû~ž*___$R¾1)~vF'J" ¸%°ÓàÖRHJnJ¸'ÍVΩ8ws†¥sL°;™Ä*„櫼ăisæ±E7iD’{DZZŒ?0®š’ÿoJ*é$çä] !tÀèÞ°pÚÌt="ӘṑNŒË%±Z?:I‰àá÷Ñ$NŒ+—c´¬á“TýÕ}$–E\Z¨Xþ!Ú,7] ’|b2’ýÈtó×°ÜHbgbd õH'ö약¶VvAÏÇAáT BCƒ?ÞÈ&‘ÈAq»“ÂÈdÚ¡w°°êšŸ‰E^ÝVhýÌô·fXr³s²œØdÌÏqo[²…‡—ƒ•mæ[Äë¢ WO/”<Ýw†#ÂÔÓ†§‹ øŸx‰Õ^2æM%²LÙå‹þÞçkz©ö‡IZdxa®±r¼,#~÷ŸA’ñl·ã¸¸§ï‘bÕ&柾¦ B¼X¼+ˆhH£†džZÿÀ²IÂ;™`€$ Ûs†/Á¡ÿœ±ùkL"œpúÕI½Š”Fœp 'œpÂiuëÁùñ–¦Æ©…úÛ@™°©¥Mò¯¸Õ+ø# í#¿z TqB “]]ƒóÔ9õ>`¬·4hçý¬%¨|q¸¡c _§5PÙj -Ù2 CãÓê:y?dïÿÑ6àÃß·ÿ뎂´µˆå}òW³ã\tÌjÏs“«þ¨+ñ¡wÿ¡m–òG@šÊ"Ƙøvñg«$n8Ìö;/à¿Æü–I%2¹L*]^£·‰R©T"‘H¥2lJûM Ô¾U–S@ßJ`’)ïX‘ äR©x¹)V(äèR™›Ì ô|ó©–½ •¡eÉV¯ƒåršZ.Ç®;áì°¬äÐsÕ }˃¡ï¡’ä2‘P.­G¹L†fŽü† G­ÐF@mT{%U¾‚“@¯å˜E2\ó¬7A¦æ\n¬m,®[U1´±P+”‚]J#ÉÖ¤BzU ½‡Š]^+VûJ¢ÖLTÅé„õ¹YPÚÆÐóœá í(Ú(С“JQ„AnÉò’8©úÀ©‡D&SÝŸO»ê1»¤  m–¥l_t!¥p¿­b´·±4rÌ8×ÁÉIŠÍWÌ1Ëk…j2(=Ø+ä›õŒT†/ä¿õÞòbG_g²íƒÁw¯EI]ffŠ‰!Ù·z":qh—™œž»ÿ]Ï"8ÛjN¡Zù&¤Dy2YìÎyXƒkO3>:ƒÉq>ü`B!¸˜°YÜ°Ý;ƒ™ò“ðYìÒ¥Y‹4?xúRA‚3‰ÄEãýÞÞçÅ0bG†Röéfx–õ–³I†žQi‘ÞöL+w4XÔÍ söØ-€´»l›Q¸$WØLÄr¡ó¸77ÞÞÈ?i…ôô~YvÂL£9-!óÊ®À@wW¦_:úê4—F!Û- ¯Ê÷‡'WžuÓÞûÑV“š”¬*Tw÷«…»G%ˆæZ1l½³Ò£ Iûn÷À•ðép<Ø&ÿti”³•ỉc1Ü¢’ÒpCëØ»hÕ2üì+·¬]ñ,CRÒ¥èÉlU-⪅‰u@.lÈœã°ÍÒ‚MÒX z×¼HúùÀ6rë=ûQ‹Á=n~èlé;*Åc®¶<Ë`›;¥Æ™;¥3 I|a(ÙÐ|ÏC+`í9®mø€n @âºátŠI`LÍÔ9óÚÔ ÖæL‡€ÌÔ&‰t² zŠf»˜FLç Ø¤H/òö¾:“F%1ÓòWŒˆc­9L;d‹~ðÖº©åë@Û”~ôÜá4’i5Âf-ÔbQIQ)™^ÖfL·4h"Hxc»ãÝ § R°õTl(lä ÊæºÙ4:Ç=ÄÛ`0¼gpÑ鮀±7%6ÀÊ% 3—¥âúÌÖGñ…ü— ÁL#gTãmñež–Yªí$_è§PY_á!†x$þx)Ö(ä0¦2r?ÆйHÛ€síb/¦jêgKºûyFÔZ®Ã @•á–‡î²8a+°N;ù̳Aô³Wǹ6±`2+K°~ÚÖV™ºš´·hT³Þ´Ä­4]gxš‹¦Æ‘,`pnR‚ƒÞ£–V@×V•,°V”1£k®aWï÷Vù§Û.q°!ÿ]zÈ•«Ì8*îrâ{ª*ï‘«A®'QfK<ðD‡êbH`ìÓMˆ6ªè£‘¦FI+¬¨¶4öžÎ¶€¶äowãuí¢"0éx>ÅvZƒ¯£©$Î4òtöÅImN ª 6Óö; ÷Àhsp;çühþ³¶íú0Æi8™“_ö,ÌVj[Ä£5™j.…ç—E18÷À@×’U{ÁÍÌ6‹¿\V~ðv¯¯Õ{ð/É ‘Žq?4CVú˜T¦Ò'ùVQõa‰›¿ ;þÒ+ô÷ãlS—ì÷ ©ÀŒA«ûŠY@‹5I9{.šù”ÏädcÑëüo|€ELwSØ^13«,WΑ×sµ­SÐVŒ}:0Œ¾"h££Í_mîû³<°iv+5À8$íö­ݼyÅ™L+†!bÕ*Ó‡¨}y}ãÆ­+4}ó)m¢Œ^kBÕ~S˜D·—Ñî”bjÑÞ/¡– œ)¥x Ä•q­vâ}é^‹˜ýàš Ü!+C½ƒÑüož+LesüÆ|% ‹x²™Üæ “^éÈ}gä|´9϶¸¦–¾;A…®úgzÁ•éF†m~ÛçÂc øÅXÏù”SïKš?TÎoæ«i#ÓfBV%Eæ?Q(äölÛŒ“·nÂÕ-/»h®C¾?‹¢ £vÔ }˜lZ%H(½énËT,‹½m,óË‘Te·J¬õ)×& ´‰!Ù¢ëèʼnTû´"”}’‹™ `ÚhÚÍ);ÓÕ†þ¤mîÙÑ»Ï`IDó€ ÍÌ}mTr›„‡˜«˜Ö½Z¦°§…ó™ GÑ@Òsšcö9¤R7n—3Ö¦T#)+KG†…xÚ˜š ‘yAÑmúà…° œý‹¯>˜à†»xg  îRøaÝ®Sâ)ï“N»x›A¹ñþÜxØìâÛÇ<&gÒüE;Ó!ø— ”¨]Ô¿&pÕã1ι¥X3—¿QékЦãõÍ]™YY™™ûŽ–áZÿ´h£²“*Ið³‰Îº[~ ¥Û·ï¼Ÿ’ª{œàêê¥_¸ƒ½¾UV~붳“B¥†+‘Ãc×U”Ý*^ù¡Ç ÕÄè1# ¯ÜV¥¾û â§’äš©ô$#l‚6$ûeë´™˜çžS‚%/nŽ6*)qk.†6»9ÉÅŸQÖ$™E÷Ë/)[mKY¿¬Êq`zæ¶õ MM}ûpЙ¼mPžî}ÍãcûRiú„ƒ7×M-'àöÇ ôwÝym$s¯töåeÊ TþèÕGu´‘·'£ áyéê]À|q`#Zžá•wk¦h–Jgª£MEQœ¦DÚdz$6ÿühÓ~:†~ZµIÍN¡«V™Ù69U<åf#YFìIÔ­2oºžéWæ [ä ·ð816Vq’àœ¨#Ïß¼z]{ÓÒ¬ê£ÊÀ ™P¤äzÒW¾Š ce<6cKpu×ù‹M·Í‚ÒÏ9Ó>Áûï¢1Ý¿8ÆýT,¸tV°=ãK\iõð‰n™C÷>›êø^+šö^­°±0…ý_µ8ü¤ÂÞ«æoCQ³ÓÜ,÷­²±Šù9"·ù>Ú(ê³Ò©RÍÁ.ìP´Á8Ì–’=Œð<´òòå>&ƒþ´im¾°‹yM"t+ÑæžžÏÏ¡¢"šisD YÎãA="Ð7(Ɔ 8’kœ¶m ¾kpB´³½Ö ùÚÈWÆerE±p‰Œ6ÙP•îÄ:æUb&ó…ŽZ1·&Ñ u<½[Ù5ÝP¼Ó(¾­d¾|ç$…ÃÍ?9Ú@ÿp&ëåÝ~708ð¾â¢&ÑbV¶Æ¼½ò8ÕÄésWß@_×é(“Ä»ëÐF0RI'Rž}îè¿sПÀE‚¥nn>á ì¼ô²§§³$ÙÊ*ê´ÖîŒdy§vô|éiÙíbè[ø *þcé¡‚ûHI·¹¶áæ±é©±{A €Ö³¥Ç ~Jx`ç7ÄÞP>bGcrÌ0©‘%›Á ~ú†²ãT€cbaÂìM™F´·Êx˜#ïO9{:#Ûøä-s'KëgáMw°>,a7üÉÒ'c‚þ—MƒÕviš„JÁò6µYèúyppàÕ| ÀC¨Ž6P¾3ohÚÔ+ïz†¾tð³f?âmZ§Áé—Tmêµz8É~_kLn³ôŠ¦iü¼­÷ÛòєͿe î×µ |yr2NÛ v©WêOqØsoxxðmÙ¾=±ŽŽ9c |P>f©Iºø¡¯£ù¾ž¶ù«†Ž/Ÿ3`ø/Âaå›ÂbSÐK¯ hób mmSÎvìëüèm¬›÷Gϵ^í==\sòÔ×943kÏP˜–Úº:_2(´Ú¡Epªš¢M¿õ¡w¨¿=×Ç—Ûüåhôyšozåª ¸hâpj8—ë‘~D‰cŽnˆ§ø«é–‡á>.®n…7Þ¢¯‹s|/>Pm(²ñú¤®Ëž¢»R4Ï¥A;—`W°;ÞóQüØ%sGÒ"¡¬rN?P1T-•ü=¸n^W_t¡9Vf…¿COwUz8»zG6ÌÈÃ}ð•0ô ?7>JŸsõS'ø˜Ë-—+/»f{^yp½BÓ¾ eÐIª—'–µŸµ Bl½Û­¹‘J¯W`|˜Ç«¸kgàžáz…eŒ%o3À‡+p=/ÖÙÙãÙØP[ðVy`=eP UªìXPÁµöUN`¦)=ªUúáëBÌ k!;ÆßÅųôÍ(TÇôPÄSðmQOÅ77÷#¯f—zŸ'…z»¸p£2Ž@lìÝëë7¿` 2”i1žU­Ø$j,‹9ø -¨ª$ßÓÍÅ# °‚ð±YaPžÎ‰‹àêéiºñn°‡«›_tí¨}4ÕVàÁõÏ.C'©‘©¤ù¸UX ¾qúR¦³Ó—•¿&?½2Y^VòFþ ÄÛL¯ü(fñòDù­J4‰x¡˜s"ù¿à .ݺU…â¸h¶“Î`/JäøTÇéM ‰Tö×<ºÃb“/º‰µÓžÌ&ƒîzìóÄp’,º©óžÝÉL€î~¢Qñ/(¹€›™æJ7³uÙ³;‰A§yŸjUàœpú[|²ÌÍ|›œšš_Tž®~"É4’„Çÿ™$ÙžÏBÍœüWn&N8á„NÛf±I çŸˆz¯Øä×ߥžÛV¦X›ÏV!ïÿ{…­ýz³þÜâÓ5ݪVCņê(6K¹U+~­ÎS«g¨ØäùOM˜ø5û‰˜M[×PñãYý3ŽÓß‘:Jí }¬‰²t}‹äºï Ò%²žÞäòßOFí¢{üÑÐßžU÷ß_t/ ­Ž¼Ñ4rÛ䣯ÿ×p$¿(TÕkqß氈Χåjn`çíÀ^ú"åwt´Nk¦mÛ¡o@DIGc‡­O|ýæÐãL*×;³T=ïŠp%­ù)~pj‡A¢ C}][ïØ·ÃKªÏ®Ç“Óî¶jhh뤣«§§£ÿÚ±ôA$¶û¯mº¬D=Í퀕ÇõWÝ«ëV1{6/…MÖÑÔÒÒÔ%‡§æwLIVWèÈ%=Mmm]çì’U`”ΑôµtÝÏ« Oæ¬ÿó72'F}ÉÇÐþ­´oËn}{UÓØEƒ(€¢£ì‚®–Ó¦ðj ‹&ZŸ%»hkìÐÐÐ8ÜâkÏ¿ƒ±ŠùJ4/mM-ŽKðÃOãߨÑ77'%8üéÔ}݃^± Øj¯MVÒ¬ ¤ë¿Y·*¶ØVÔv4õ|«r‘?“ý€3OG6©å;bó­vͦ=’ï~‡ßÛ¼¶à…Ú+»Ä—K:è Ú7¡ [Ä p¹ë± ¶Õ’ ú˜tê7mÚŒ¶“;Ô²¨>J4pBÍB/íñ Ý]½€g‰6¦Ùpô“æk9$»U £úK Û­¿aÞ⧉S«‰D¶díŽÕ(o 'V_>/"j1È n‚™úîQyJe½å’ýáz€õ€x?Š²=‘žy×T9L<ŽeÅ”Y3 ÚfdÊ>˜wÕ§zÚ1³ªÇU©RÌ·_ÿ²åô¯¿E±õE{q§…IÖ›qÕ+Aï3‘v}ÞÑÄ÷iúäü«XØ…™Žçn&Dßãu[rD¼gtóåŸo.î2äxl1¹à¿÷›SÛ囼^;Cqîè@›°ûgÓi"Ó.¸u6ʼ›MwÜûÖž}ä£ôøΉt S6Õȶ¢ SŸh>dU‰Lmñ\qº?™h@5åV´NIxÝÚºzÓB,–ìü›¢ÿC €~¼¿}Ô„A¡RÉ6~É}s’çCívc»äÝ # ½@ªÈðp9tÊ´òü&B¥ÐSN>É1´)ºU³ÓÓ’h@t;Ì—¯G˜¹/ïíX†$’cx.õCÊëOp5!ÒC³/µÜ ¤ø”C L¨š¯z1å¸s¡ä“ )$+Ä‘B¥‘©Ì}—kàµ;òôß´нnq¨Î•mH"3s®ÖÛiœxªeŸî7eP¡æXû$õÌ`“º4‚RØ*’8zêóÕ…}ÿ°G<¬¡½mv? Ô€Q:mL' ÌK¾6å‡Â}ÒÎm€[³¦œæ¢–hÖš¢óyJ®Ž6§¿¬áESL·çáLÁ±šÝ ¶‹l­§¬‹¡T‡è›ê½|eW†6H([_*ýþ¨ø¤¿mJy£ò“ygfól @¦„÷Kh“Qݯþ¶ÔEǽ~Æ1 ,mPUæçª>ly&…Іh†˜Ã•÷?Ó\Ñq’ñG²Ã¡Á£f'îÂQxnú!^`0_~Á¥K{#hT …B Ë>/@¦Ùu=ò®78VühãÉ€Fdý½/ŠÒ²Ê„~<ʳðÞ÷ ú±TG'›§á%8ñô„ž=µY±âGaô +:ËÛ*æ ¼ãÈ'?è“Ì` ÈÿŒ©òÝåšp´BÐUE²À,ó/÷SÜOƒ“w4L’‘±Ÿµ§2í™Lâq/θù‘ÿäx”Upú}¡Û ™šhF²ˆ@µÚŠ¼È&ñÕk©å6æÚdcì* "˜eC5Nö5M8 ³â‘Z¢Ù,^°öæÔÚ/¨aôÁÊðº—~Ð-lKMñã\­Çžï yÁœ›tÉ„œi„-8F*󉄬Ë=ü¾W$¥fòÂÛ|²ëI¤&_Í ö¨¥ÿ}‰½‚-ÛI]«ˆ]û:´iX=‹=¿Ó)ìÑx›Å†$C¢ÿžK#³ Ë+"u‰MÕé„è#oÕ°a3´P[œ‚ÏÆú÷v_÷з9ضŽ3üòöÃÞCýá*ÚÀáŒë# ´I|9§K†Ç©„6tq«S,Ø)ÃükhóLíSñ¸£1¯‚Œe+&ñ#|füYîAÓáù%>Ÿ¿´´p2É) >œ*ä7Èx€–Âckî¹3 uŽ‘ÑŠhˆ~ÞïišyÍäéOßýõP¢áºŠªÖo8Vü!¼ Ëf¿rRvï0ü TG›x"  N<ÚFöY‚MTè,kÄ9ÔŒ¡æ‡é5‡›¹šD’ý äLÀs7Ðy:.ö¾$u£BÅêg+dRý2¸2ò‰m›TæK¯C ĆÀeáÔíg0KP>WM3pƒ¸€ä£Ê Ý3]7™Æ®RµºëÞ1f@êÚÚŒ#QóµrŽ<ˆ„ЦJmæëJŒCáðô÷Â(ÆAEÌÇ’T‰6¢ù&hÏ[TúÝí ›u¹{y Ž˜½ùº¬Îkó>\e*}@)„åÓ(Œ&_1pICŸ«£èèé‹“ ÚXKZ1OžßAž‡“èLtÀ®nãrõo‚ßám<ô‰æ®>h‘îŽ:]ˆÚ³Kös ‚¬_Mßš’9.[¡MÕN¦MnÚ/AVåŸfQŸ²0ÚÀc/´dS_ð~mLÙ®h ½Üìétš?b·+Ÿ0£tNK~VChc„öB,3ûµ°ÐOºÔñÌÓXH1°êlšSÜP>kId4¢¶9Çüõ¬â'…Nú8ýQ'©ÐÇÊ>vÖßþdf-Ú8Ŧìä“íd80îø‡Ãì°‡H’–¹kYíâšÐÉ_ùr~M¾ž[ú|ªë…»9‰™s<º(ŠçÒ­<šéy~ÀýX÷üÛTß›C`ï ¢ßEhš;Àœ,Fd=-ÃI9|’:]‰™. ×lS‰|u&¼.ɱ޿¶e½ÆZÔ6¥:qk©Ë:´¹s(pç9Ø“•Bº\~8:,±LL#öç-Ú¬L>ˆ‰C3)ŒgAhwSÏKO™0ÍÍÝÚ¦á©ùðxH\q“R†®xefW[[D°v—4oD–ùÕø2Ç›m3$2«§W½–ìñ]‡6Õ 6¦{Ÿ­yÉeÂeAçドÜ8.E djðZ·Ñ›ð6Çšçà n‚¥ 'ÖþòϪË} –9Mëx›þ7—˜ž›£`ˆbHõŠID(ÉÉÒÌ&ëªò$£ Â"³—fûÀúúj L,Ãúz{PîyÂÐbµ‰A5ÞÎ!ÕÉtOeG–µÆ¯Êmf±…¡I)ÿŠU)ÎÚÔåè[u¹d¾5h×YÙOÈm0ñ`Õ)½VÊocÒ¨³",£vÙG³jh£@Þì^öAE8DüÁr: u}7t7SÃ$I ~mDà¬1Ù|A¹¿$:›$œGh+_-âKD°²RŸÍˆ¿âF£µ"v¿8ž~EÉ=Ý7ÐroUæj™¶în&Nbä4mndì`¼ù„›9îÎ §0ø{¸/`o"·1eûc1%ï&›²Ãï@Å|~YÝŒœ¦ßj2«Ñì·—4õý ¹æ@>üñë¹ØiD$®A›…—¬8ÄñîB¬“G­Òdôp„CÖ•ZÚÈEsTPƒ¬YAóï4½¬ßûÞœIVšÎ>6Ðt>¢Öi†„Ùe‡{;b›þVhƒ¬&¹0̈Žàœvê  E.|„9^øT~¬GìœóÑP3«à½*gôƒo/zz­s`ÑN‡#׊5~ %¾œæi]Œ]Ê–£Mõ¸¡{G0Q’èjA´Óa\Î~:Ll'ጃ, GôAow™è$>žQßõ÷³rJ?ª¡ Ò.^½1cgBøïI‰›oï¬C1í‚‘*Á`×™¨µþt{•«1qçõÖŸ¼“’Œ½3'ä\QÈEöjÑ;ôð/Ž·ÒÍ,ûJg- èu4O¾ðú+šªíÞ. ·ý°#æîÆæá+þvj9mAŽxçãjkmF5qªî„Ïï÷²§Ý°Dð*ô7Î lŽNÜÿ7 çáþgDÓP¥Š6Ó’àeiHÈT£c7T»ÏŠ9YÃ0¢›Ì+3û|¨€‘Ç„Æq»Ó4‰ŠdRYÿiì‚Šåù–äß4]x˜ú·‚$͈c´ñÛÙˇ§X¤ƒV^Ñ5O{[s6ÀñNC¦ÝM¶~ü´v}¯JlŒˆL#ÀÈ!äÃ$¼6§>ßµ¡ÙVv>‘9µ7¼Q)± MëU¿ùtœó &?ÞàšRŒÍ,Œ™4¿Äüo"øNêcwRŠŽ»‡m]ŽCDî­‚s˜·ÍHòCšcJ3w-k˜è¸”ìqiÝ¥øèÍØßþë?Ë[øªU)QÓ·1øß;>Ôøª‰§ ­÷ãKhN¶WG{Yil×ÐÚ¡á¸óe[¿âéÓ9‰L’ž!…BÐÓµõŽ~Ü —ÐY[ûóò:ê KóßßO¬¢íl?Ö'_å˜dƒzÿ‘s»K9d¼s©l’¶¦¶¶–%2ýHß<È»ä`a»Æoš„èý× nåµÞý¿ú–‹kO5_nçþ—YÄXü»n“lõyE~à¶ÿ÷Ÿ?­oCN¨è]­¡‚ÍÚázà9üÚDÚk’C\µwl×ÐÐdÙz—<þþœ¾ AWÛewìúsl¾¾ u46³´fÒÓO=D…ae©.;t)¾çÚe£ua\3ÛÔ̘iéßoCŠkÎ:FÙu8Vü¤ØT7u uÖÍJ7è'l–ƒB±©2Œb£J¸ù÷ŠÍÔqו²É¬[âM«Û›\›}­µ)ÀMs^ý%_˜U9æø>œúŽúÐƇ›j&¯ž:7yµ¾«(§ØD]W]KdíËz¿ u½ê C¼I}§±ë^~OUy]ߨº±ˆÍgůÌjõɹ¾ ŠM†\;9ǃ¯vâpÓwèxœ½]Ìáá‘‘¾Æ*š.ýù/Goƒü˜Fžy:üõkû³"‚M7:þïˆ?3¹‘¦yÛV©˜žÚ$×™Å?6€¡bàfjÇœ77Çé;“–¸žÊr²µuñŠxÞ-ý>ù^v2+ÚÁÎÎ'<£oNŠ_Qü÷¨¾4Ðnqòÿ¦–K]œÖgjkíWØ…N8á„N8á„Nÿš¬³tO^ët ÌÂ'£!dý"?O7ßทݳX¸"ˆVrâ‚\Ü|N=R¹ñås­©á¾®Wß©Ž¼êÅuuó¿TÕ ªÉ~Æ…&¨ÑAñØ¡ÔWW”üKÒu²DAƒ»µíƒñ?ñTýk||.ÀËÍ'0º²ejÝ>?ÎõNã<~È §_¦•o5oׯœîsÛX;k`i¢'àµëskGÃË«€¶aIb,±¤è–VÖwv¶&{˜Åœ„£™,M5‘ Ö6v´5ø˜ûÁêµm‡ ŸöÞ/_zÚâÍ)áW` ÙL[°%‹!ÞjYŠ>GŠvNiuGGÛ¥œ¦s”² 𿼠S²Á•áŸì1Mÿ*Ë ¦º$~lmo|Sn¤M,n®¹Pšûhjh3€ëâ„Ó–ßǧå‡:rò| bòº÷þŽEqm¨*<|èô•'’žK¿ah#~*ïÊÇyÒb;¿a^ žØz&ÁælÇíYq±e8Y­kàÊÁç™l§½ï±‡½µ)‘B¼funM.ý˜ªËʃàðãËåŸ'ߜ㬢 8[Sì·»LÉÉ  Ment—e:e^ϱڎ¢ty¢ðرeéZÇ;ËyÇÎKÝGÌ­À)¿6Õœ8RpôäùŽ X¯ôcÉ¡ u«7Ýu· oÕ gûŽž(Fƒ•äÄ|^A«ZwÊÉ.ô”ªõÆÉ¢JLq­òD„Wæ5|Fá„ÓwèS±I@æãªç÷¯fhë=ÿ² ŽVï yClŠ`ð¾]z¿ªòö¹°{]³dmdWâ½÷V~×*l\ˆ¤„Ÿí‚–û^}ÏU8¾/AûÞŒ<ŽJ8ѯÚø¿ÙééÕ À§'ü¸I˜AЇÃn¬V9©g8ê¼² 8,ÌTàPä’ô±˜6# ¸Ëô7mÄ‹ƒAÁ¡‹âµhÃïÖ§˜Äºùݼ}[ ?•¦Q­|Ê+^<¼VÄ&R^L‚üÏH¬$nsÐѯ˜ãá±’ NÊ“^G[ ¿^ŒŒ¾ØŒUpô…ÅM€Ï'œpÚ’d'lõ’+1/U‹³³Bˆ+@ÐâÊý Ž÷ ËºãBš†YŠb­0ø¿½GôLBEXq0(é[TåŸÌÚv¦mŽ«C~¸fRèCÝþ‡…d°õôuµ¤qüø²UiÌZ´Q;³È—ø3¢a®r‹ay †6[8·½zà!¦{.qaé¼ öº&r<‹Aß„Aêƒ5'« ®™ë¥6Ê–½:§Ë„PnЗãè^Ãu2pÂiKâVؘØŽGKÌ vMÚ(@y<”Û„ÙšÈZOocïTlrSÔ—¤è3½ûĨj®8œœëR•H˜Û/t/ºé’ךּ4Xò¤l:~¼–8EŽ¯À&v{=ÍÝ×lÁÛ`K^.œŒs¤Fä–aÒËvvxÙmúÛÕ‘­e2‚^]gû£ËŒLò ‰‡)"ÀÛÙÈÒJwÌÅ4£>O²ÛSòq]N(¤4ÞÊÕ\Û…›k«žpÐÈ|s78á´…ÜFõƒ?Ršê–5Ì‚cÚ$¤ìÏËèw¢O'¶±“7:ú¾–Ì¥¹g­¬nñòs.ôèg“Ê&ì4 ß,ƒÌõö4Š•ûL4>…8È@«ô+ˆZÁ€²v–>mH¸9Ú ^ú¸4w1ÿš ÙŠˆŠŽŽŽ‹±¦“"N<ž·DUhà>=b¯x=×$ë>¦oš ‚3öz”õ6GHÓîíõ§8' ¶VŒ?å®ö„‡O*œpÚœä¢×÷U—Ý—}.¾ÇŸ¡'©‡¡d‹½Xè´ê¼h-óµ')l+ ùž®å)æ_¥-ö#—Ô ïíYm«èaÇ­`3Ï3hòñ²d]·B_;ö½ÅD¯àÜ#š®Ù„d+¹<ÌJÿìËõœDIÐߦÛ.€êë[¢ èmap·qm º„ú¯‘Ù^_ɦEQ!Œ*«žÒX·’5B¤u')é.ãG;ð)…N[r7Ò-LlóŽœ8NÑ5x5,RI‰W¦Þ’ðÔ½»£Ý’vé°“Ù«ô¸3~s yÖ,šOHT|J±™‡®!«OkFåØù&EùÑ ®4Î#âœ9o²¾­sPB¨TÊë!˜eúRsJ—ÄŠË>\˜—iaDÊ~ˈªJócââ}œŒL,àœóÄr°éX0‘n›€•›ðzv œ¨¤Ä"^7ÇÂr~]\Úµh3õò°!™™¸÷HÞ®X•qHŒ]è‡9°ò™êAô³…áZ3'1 &K\ŠG@„ª¥i{ÏCIÇÚÙ¼ÃIÜÉÐ2îÂ'N8m…5È’ìm†¨­ó9`ˆæZz0ÑçÔpKKsGï0-¨{Åh{Sï7¨µ·¶¨QsG÷2cÑ—îöæ–¶ñ¹ePåjK¾ÜÛÑÚÜÒñ/Q±K3£mÍMÍÍ-ØÍäÄPw3’–ws§\Îõ¬)©¹å›h Ú µ}þ†œÂäÒ¥ãnFëÑF¶ÒØÜ.QãzøÓ£m-MÍ­í“ó˪²ùÁ¦Æ¦Ee`©p¡¥­]ÿ!é\ÓÒ–¶Ž~Ø«Á—:îÑz4ǾŠ"¶o>£pÂéÐÑP8Ã0Š—(þwCŠññ—`÷2p€Ò•Öe\½'œþgñjàßC©W½„»¹þG+ðîÇ 'œþdØùC¢ã„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8á„N8ýÅèÿab ® endstream endobj 846 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 381 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14700 /Filter /FlateDecode >> stream xÚíÝ\TWÞ7ðK6ÙìçÝ}žgŸ²›lŠ±Óa€¡Iï* E°—Ø»¢"*h¬X@:vMTÔhìƨ±Ó› PQ¤×aÊ-ç½wfèXbÜì¸ù}÷¿fÊ;û›sÎm„À›ª©­++{B¡Ú—D*eYùð565Y;¹»Íu ˜…B¡”åè?sì„Éȇw«¾¾~ؘ¹û È®< ¥ª9dìÔ9ȇwž6®£gíÌ%qi(JU±)̘ɳH iƒ´A¡6€´A¡6HJmÓ†éëÄ‘6(Ô»­˜ÚÖÕsÏž=I%''s™ƒÜ@Ú Pï0mÌlœW¯^ÚÑ–-[hšFn mP¨wš6.aaa+;BÚ mP(¤ Ò…BÚÒ…BÚ mP(¤ Ò…BÚ 76(ÒiƒB!miƒB!m6(ÒiƒB!mióO©T–ûw×=²»]íºK3I¬â.~¯aîB&Ù}Ÿì¾ËOÏ_Mç²+OqµuçbÅå]÷É®\î2Ùy?(eëLÚ?‡øL²ó®êy¹Éâ7v,1Ÿ@ñbÚ½àŒÎ/˜û–ãÓº}.Òi£FµãršµÞÚýôµ”õ•‘™Ë¸-)Q)mË麗E:Cúi[…Eå(‚åRºñ Å;øPNÃÿá{³~ÿ°œvngv…›±–ý”ènÃ-æzõ²ˆ-Nv&š}õõôÇ……œ,IUFYKvqsˤF»ö7Ô0!ê>-3Ù|èˆH·ŸVë hã=?øèsî±±íÒ…´AÚ¨]Ú\É´~å±6uÍÑÜðäÜð#éÓçL4êx¯8£XêÙ¸Ùø±î&FZƺ:_ŸP<*ƒlÝnv¢‘¡—³TqÄW:‰?¿Ï\w°‘ÐÐa殄tî.Õ|"Ž|oi8(hGÿj“sWí»èïdhh>62››¬­„BÚ mÔ0m ¿• ŽOWõŒ’r¤†[:/ˆRþ}^âjÙÏqÚQ;m×çb”Kt&ùz¢ƒÈÐqåOŠˆH'[’¿µ44ê›Üå„îÒ†›sB–tò(}ã¡£–_$ª˜Jçû\¡+'k³»Ž Š‰¹®ÖòiŽNs—ÍsÔ5™°)­µŧ…Á€©ÇZzyi|§lþ=¿°;øB‘6H›÷$m”7f’u+næÃ&n½É*C)æôy3#·ÅÇÓIRvU€­–ñ¨˜è,>ºoÛ{ÖêšÏ:\®h«´Ž ®]4Ú×ÞÒuÖ–;|(qw%Ü,t¶26s_ÌÅãC¾•Ø˜Aº¦MkŽÅ\»ïlòÅ°ð'ñøN‘6H›÷¦m“˜CæZéYMÛšÊ]¦§»ë½¢âsɦõÓõ í—œ©çuÓØøl¾*P_ÛvÁ9zÍ7ó Œ­–œ¬UŒ÷v߶‰K§çOeâq‰ë2&¶j¾‘…ãªóRå]Ž˜›hNŒ¯ˆKoösb>ÑÓ5pöÍU>:V…/51·Zù#Ù™Gv¹c D37g’ÖõP»L…ºFV“É j±¼$mÄAÞnÖ#çw›6;öo5]t´2žk\eUz›i³0kO>ÿ¼;$OŠ¾¯è4½,mm­ÝVE¡mƒ´AÚ¨{Oª)^Ñ2i-ň =fŒH$4mW"ÃÁ“öIZž”]é-Òv 9—”ñº´I£fO%r½ù:×yÍ»~íB¡™cè™æ¸tým˜PO·Ã“š¼/>ë=©Fw=ÛÀ£1H¤ Òæ=%nz½‘é(üÒþëó¶™q˜«9k·YZè›~0&UÕ>Q¥Í eÚW¦ Ù·LOÏrö÷µ‰él‡­Óèq.“"n“ø Ù gc;Ï™›)Ÿtî¶ï'³Ö×÷\u祣ı?]²ÑýÒ'¶.=)¤ Òæ}K›¸L²qs€ž–Ãòü–ºÊH|Z]€‹­É°iÛo3Ê–Ì/J›ÄœÆ ‡ÁCç­¿Ý~ô˜lÚ½ÁL{€WÄ‹ø {塽­ÐmrRk quæ°¥ö—î›Ê¸ iÓêñv[ ¦¼ç¢m`½`KV[û …´AÚ¼'iÃ&fVùY雉ŒÏl·Ñ·°GLÑÕ±˜}Fœþš¶¥«¯ÿô¥m5#lõyqÔ™kN&CDv>Ë÷,Iºõ]Ðä ‘ÎÀa ŽÇ(†ƒ6Øe®?`Â>q[Ó…‹Ûu#‡X [¾]¹uŸ±¶ó¸eªÙN™íhkh`à¸óa±uÒi£¶}õîGó1{š;÷¤N_´s>923¾Ý^ü¶)wÝm,]Wä&*FQ³ª]<¿¹šØ!m*üÕð©ÐÔÎ7xÿÆkòØ׶mRF¹Ûîy»7•AÖÇ®7×ùÒ|ØÂíw~ùÖG)/÷A–“Rã_ýÓÉÆU†èÚ„]t™ƒÔkD³ñwâ3Ѷ¤ÍÛ¦M.™æ:ÀuCFRÆëZ5$,tœP_ÇijÌš 5QWË–®[%2Ð5óŠÎ}mÚ4Žiç<éðÛ¥MbNm€åáá?ǦP\èýò´‘úùÛÍÈxmÚlZ;ËÀtDøÅ.i“J-úfý”OãÒ‘6€´é&møSÑQv|³T]§nÓfgN‡Éºv…"ÏÜ*Òr_rŽëIÅ+›C¢Žî6×êë¿«97`nÇ´i×çÊ%‰éâ—¥ 7g.’”]³lU#ªSßmÏÃf_‘Ö˜E{ò:÷¤ø·“¡zxb&ß â¿Vþmv“6Ü Nj}¿$m¸Úy칋ž m^Ö¶a·$Ÿéédj¢ojnã³ôdäKÚ6n›²×íØ`e&™Yú„œJë²ÔgÐucôF­í0œBbo7ŒŸäçr=+`^»´ao˜9g¢¹‘¾™ÝÈI÷¼ì;§MªªÙºu«½µ‘‰ÐØmÊ–M×å­sPeÅ­*G}‘‰Pd¢oí1¯]OŠU¼° I1Ö&"SË -w¿IX-tܓ׵mcb7#uõöÍ6æz&ÆfÞKG§°qÆg^ѶI‘ùûÛNKGO 6ݤÍÆ‘§ŽYê÷w±cî¶c³Ã7[k¹Îú6&µsÚL6ÈÊÍÆÜnüŒMÉ3CÃÌuÛMJì°ßS*?Ù×îDcN%æ¶oùð³ùFN‡žT*ãÑ(7cc›Q_o<4w}¤‹ås3C—ŽiÃ=EB–|þ o#KÉë¿›·å€¯·­‘¥÷² –tùºäóÃMt´Khl¾èX½²k³ÔÕÁdøôC:\IÙ•>¦Z£cî&v6I}ánþ…ÛÚ' Y|víL¿ïj8ÐÐ%¦›´ °²t»ù¶¢+”E̶4u*!iƒ´AÚ¼“žT2¿œæ‘]y$ò§gaûÏy»ZXw“6ný-çþ¸3[5ÜŸYçmñ¹Ë†Òö?ý‰Ùu\ÚØ.OKÊê2ê’ÅÏ$§-møµÕ³æ¹›Ú‡oÏâ»cü~«Ús¸¨sÚ¤²ËV,™ÛN^xö¦ƒ\ÍÙ¼ßËÑÊ: tGʤM:‰9•Èµ×Vß!ñiŠWžM–̱4pî®mã'²x16“{Áü8ÏâeNF¾§‘6H¤Í;J›c1מMh¬£ijnfeçì0ÔÄ2 ›¶Í4×þ.ŠuR±Ê±” fŒû Û%wÛ†R¹™›Ìs ‘Ï¡øÜöƒ*l\*µdö ©£ÚÛ¤“¯§š›Žú>.ûU뤸š3šHdfç2ÌÞÅMYnîn_¯£´É QûëOŠh,Ê$+¿ñ2pê.møQâLUV m6H›wš6·™ 2¶dõ%[.×E§‘5sÜLýºoÛX-¸Ìw‘RÕd‰}­>s‹(ë0¬‘AB7N7Ö·]vµÃ8±·FºéYyG¥Ìo߶™9w˜©Ãº¨ì–ãÞÜ®9ÂÌ¥KÚ, žcf¸9$d**‹ß~O‘rì›´m¢m0Ô¾&•oÛð9™E–.²ë¾mÓ~ 8Òiƒ´y§ióÓ–(wCßméÊ i2åsí͹¶Mj‡ÜŠq›ú¢Iko“ø ~eô¶o·±Xðc‡q.XvœO³·Ðu»í6Ÿ ÜÄÜ¿ë7›i öKwZ¾rC¸ÈÄtÑ))?Ï yú²y7ã6[¶›ˆæ~WÀMÆ=öú#G³n³OǾÁ¸ ?Í­{Ž†ý¼#K¹˜âž˜ZâmþU÷ã6H¤ ÒæŸØ¶96×WÇÈfââÃ6žÌœ8ÅG$Ô3u¸ælml—uRCM5-ÜÆÎÞqqΊ6zbb;®†Vî;‘´ÎDSÓÊÑ#pÙι›÷úú[˜hÛOß“Õa”˜o Ýx0ÌXËÔfÔäM§oÞfoebi¬ß%m¸¼jœ2RÛØÌyܺÓË“NøzXèy­¼Öùu߶áWN±óæŒ12µ½âðòÄ“žÃ­Ì- ]ãbó6H¤Ío9ns<æz~Ðø ;{;—‘~‹GøÖÕÅÉÚ'nGvÛÄñÙ$xáÜEÇîÍš=ÙÑÙÉÎÍkäôhÕº›îv#Š8tlÔ¸‰N®®¶Ž®.>ãG‡|¿#•Ä¤wÙ–8Ä_I äàähçæ°êTpø¦ñkoÆtÞK‹û·zÊìYÎn.6ŽnÃÆ- ¹ MHï² bfÃŒ¯çÍù®$!½ãÃÓÈ®œæy‹f;»¹Ú:{ú­M]µ~¤ÐûHBç¶|ÖŠ%c7>ŽËP½¶Õ;Â|BÒã³;t[“’¼¦­ÛxUŽ´AÚ m~é:©Ø:ú–4ú6¥lÏÄÜ–Eß¡c;î•Ùr™‰æî½-mí§tÙyA9ql*7OW1w˜—­o7eÛ³Çu9v±êÙSþ…q3Tnq§ˆ‘ΡÔ~úÖºS6qÆò¥?‘Ø;Ü+§î’鞃ìÃ2º]MßîU±­Wc»¾˜nÞ>‹´AÚ m~ïGœH•ŽejìÒiƒ´A!m6ÿni#´½¼bçž‹¿Mí¾Tu×cò=IH¤ ü®Ò†ki$ïOoú¯¿Õ~6ð7+Éÿû¯}gŸÅb™EÚÀï)mT‡Ú»ÿ›Ööüf3X`‘6ð{K iƒ´A¡6H iƒ´AÚ PH¤ …´¤ …´AÚ PH¤ …´AÚ mP(¤ Ò…BÚÒ…BÚükÓÆ-hÎÞ‡ü!’:A¨ß¸ð±«I%fs[W¤Í»%nnîå;zZ°ÿÔEíËÉ{‚{ ê·­ [ϱøÔ¡¬Gšš[®^½ióŽG,®¯¯«o§¡¡>&&f üæ‚ñ¨ÐÐP¤Ío`÷îÝ]?j€ß9¤ Òiƒ´@ÚÒiƒ´@Úü~ìÝ»7 :ŠŠŠBÚ¼[,ËŠÅârPøÔDCCòþ%XBhB² ËÒüU†/Šåïañ1À»ˆš! —*ÅÈÛÒ†‹šæÒFNiï l¸F CqiÓÌÇ EZò†!r)‘Ñrš‹– oठEäDF(®ÏÄÈZƒ…ëV±4ÅÝ+Ut¦ðAÀ¯.c$Š6+gZišHXZÆp™Ãèàs€_6üÈôÔ÷òÜ2º­ÏÄÒ„®~ÆÖV±2‚ž¼‹°!äQþ3ÁGþúW¢ê2)þyö¬tЪé3ùvƉà]hˆ‰— Í=⋧X¦YÆpÝ(V¼~cÇ=‹?ü!rt¤à=!¤½ªm8ÕBQ“/*iœÂOþ‹hÈ{ $+Â(~"Dðï í–Zö-Þú Îgìû±ï‘ÉË5íòÅ/Eá®…ƒ -ï5¾és>KûV·ïÿÆçUMÓh37â}üÐiJ*¹x¹©§€‹—ò¿ü‡üÂEiŸ(>uõiLI¡YAØÀ¿£ÆÒóNîÙoß@x1ßÊ<òÒÝ.·×ÄM1þdeáõ£< ^ž6®0±q}ØôÆ/øEîR7£ø»ÍgbCÇ/|žb¶Q\÷égL¯^µ½5_ômìÑGÜKãž!÷=H):R Æ=e#£›ö ûÒ¾†êf¦êG‹þ÷^Ö¾aYöÕ'õ3 u·])ìÔR"„>³98¾"•?Oð^VCºÛýn…‘ÐÔDh,4Ùr½ˆ|Ãõ3½ÍDBgŸÄ‹…ª',Š×5VXU±gy€¹©¡KÀ‰ûõ|RQ534MM MEú®>‹¹WñS¤«ŽÃ ?úÓ¥–°?]li·°åéǧr0ZX;®Hø±¹­mãv7?eŸ½©‘ÞðñÁ÷«¥­ÑQ“{l¢ûPîmŽš~—NRWz÷JA5!âSûNTPŠ?=¤§o¸àà÷æë£(~ÿ¨²'Õ­Ñ[Ò«—¤·@êä ×êá7¶AØ€ÚŒ´d[c0D38"1ùȾàK½¡~ø%´ùð2_-áÐM {’ï]d®k=:U±¤ge>j⸑>;œøáH¬HÛqf$ßhQtáû3MË=×ÓŸÔJŠ®z¿ò™»ö»#‡wmY,4pfüeeÚè™ù;Ø/ŠÜæôñð™#õµ-ÎÑ,+/Ì<é/Ô[¹/#»€&$íðü ÑsîIÛç¢ê?9û̵N\}8ùðþ˜0k=ÍQçi*™™:„ìØ}ø»= ­5ÝÎȹ‡äÚ(è)íݳ¡g¯¦[i´Œ•ò»Ka§LP²œ5šzþE iVýi¦%/24˜XÖÖa®leîà[B“¬ÞCÜÛÚ’”nÓ&}Ø`M{g§Ã\†·–“ÝÖûŠ´1tH{Ú²Þ¨.ÕÎÌ kÛæÕ½?y]ñö…£ µ´Ì,Ììœ<­ŒœZÒÆÄÚùAc[ï¡$1@{ØÜšìuZºÞTç·É¾Ï‡¶S¾x®ËYk ¤4ͽzÕöî%×èI z4lú†‘Ë¥Œbßp¤ ¨I¯¿(N¿¿£¢ £Úæ´º =ç©8ïì:cayLK—‹e’WO²ršPN”iÿº´É÷¢¹5¯¾›§,âÓ&µämÓ†Gích–ý¨¤²ºŽ‹ôE–Vó·¨Ú6Cm3ÊÛ+RW¸ G/j.J4èoŸ&i{›5…éÙÅ5ïuX™6õ—Î6 LÏÞb@¼0¸V ôìSÖ¯/Ãõ¥(B)Ž|ƒ¿sP‹¿YúqQßGŸ´ÜV:[øq‡ò$÷ÏXÙ|±¬eù®žç£?lF2ýº´1ॸœ8FÓbæwòÖ6ÆÙ9_ ùø Ò&âBžòicuyEµ¬›e¥8PSkíÕ¢–«Ò=¦¶ ¹¶ áÇmŒE‘g´¼¸â‰ö¢ e» ûd¼qß©‡µ<¤l¾ÉçûÒºËßæÊòòúf™šs\›…æÛ'/j)|ÀôìQù÷OJ\ñ÷¿Ë{|XÇeΑÃÜo…”P8š¨ÏOä¹Í“õE6+¢¾½qí|È„†Y/¸F@ct‰¾™ë¦ý?ܼòý"_û!úî7jùé_•6%§¬†èG]+¨h¢^¤05Ô˜úãõÉQÁö"¹q—_׶yþµ¡ö„ˆïž”<ã–”Ÿã|†š{¤KºyÝIþƒŒÝf]½WüôaÚƹžB=sÿÅ• ¾ ›Z˜/Ýqèò…# ü†ê²<[Ê7Ñ~Šša`bµlë×/®œì!4³N)“®;9”µ´´Zž|[ÝÓ†¦)ŠHÄÕúÉ{~T)ÈÎÿ(cHÃœ…r D Qòéç|?K.Ã(1¨OߟñÉ-ó¼Ý\œÆM>”RѲ Vï ›æçáììâ2fê¬ó÷«”7?¾º~ÆÚóm#?ù»¦'*#?[=ÝÛÕÁ)1õ)wµð|ôä o7g{ß%Û¾+_~~æ¼Ð‚Ê–i*Y<÷‡Ô*åµÛ'{¸ÙLù¦‘ìS«çÎZ‘/ëæK*3—Móss²quuJ|/Áw˜ÝˆÉ{JnZ²"úÆ©Øq¾Ã]\œ&ÎùáAc˃šOo_8Zñ6ýÇN:póév+ÁŠk3§Yrðš:kü¾– Mˉ¬¦\òù?ä=zCøï‚‘JSnŠÿð¶göÃÅW¯*65¦ñwêÔÀ!”L*‘H)ºuD@µ†UÎÝ.•R K:n ¬¼Øa×&Åe†’ñóaZY)çæ+“S&R]!¤ã¶»ŠõHÜÃOß~ËNC¹ªmƒù„$R¥zü£Ú+î7»SN3­W½Mþåp·³„t¿W&ŸJ/.m<¤öiÃu¤d„7UéÊÔ¥‹Œœ4²üámŠí¥}ôGõî#ïi – bÂf^~PMÔxpU±IM³¬”¡÷îæéÁTVIø‘Ån /Jžq+Þ‹ãÛ¨ï’Ì-ÆL[cH]7ÜË”¦™kŒÉ唼Šåšq Ãó\Îp—ĦŒÆÇ€<@ØÀÛ‡ «èI)6î£)JBÉù½XFB(šûŸ¼¹6>©¹‡F-×¹si¿¢iCø±_–?m¿Ž›?· #ç7ä“˹Û#m,ûÓŸË{@jK±N Þ¾·GTߊ}?Û+¶þ£»ç·´9|L¼+š ¤ ü3ãˆoQ„?K8¶î€në§}òÀo«ã´:œ§Ž%¿ôôZ¯ÊŠ?X(K³-i¿Óahþ¾fþN„ ¼‹¸á7(Vì´ÀOÛ>³rV&ãn¡(š°hÝÀ¯ïJQDÎ…˜áþ#ë°Þ›–R,ÍȹÂ>àðëÆ?¨ 5”œfeLû€P4+eY C6ðnÒFÎÈjËHiÅvhÚÈ(š¦ÅDΟo )xC—Z8<ïÛÔ–·? }ãZMÀh¶®Š¥5o¸8u]§Â¾lBö•­€—ÍÿõO¨ÎÏ£Âj ^ (_·Z±ŠŠ&ŠžSñß?«Ê–.C? þ-cá–ûW¤ û’å}äÝÿÿù%¿8:VÇÄ!ÿ'“§Û÷ýrðà~ƒ~¥¨¾šBËЄ³Ô«ÖË^ˆÖøÅñÇåã÷s ßÿ~}êô½ÂF@ü‡?7Ù›‰\ÊÈŠˆÏŸ– ͽ{fj½&lÞOM/®Oôœþ+ŽWµ.Ðÿ­‚.AT¹eŒÃøyçâ}Ý ^•6Yîºz3w)|pïþý{÷ïåžß¹Ødà`ðWg¸òáÕiö†G7ìY1}ü†ïÞ»®T™@@÷ùcS>lÑ3-—ÓT÷pI 9×à=mP㞊ê¨á]Û'ìK{ª›¥/Î[ôwÈ}Yû†eÙW?žTÏên¹ô SK‰«[ a›òdDvw¶×ì ¦»ƒ((oR¤ÍÒä;í»Og"¼ŒtF< »}QÊ#ª×Çú»_­#Å'Ö%#Í®æ_Ãe´›«¸§€*]†sï’ÊK)ä‚:€äåók¥ðWjòÓHˆäñÅE½†>se|)ݶ”=úyáƘ»&±BªZ4ïŸê¹æ [Ÿ·t’‡«Û°+ÊåüvòÏ¿ß`ïhmjläàìŸR¢Xž%¬šæ1ÂÕwÌôä”rÕ>=àä9¾T,>1Çc„‹ïØ9WJùsÜ1tÝr_Ë¡&†6ö6“à ¹±kŒ‹c@&ÿ¼U?|QƲéNÞ*U¦)ÿrèŒÑÜÌGŽ Ü–œÊ¨VÐtHåm7¿]j¢ï’#SRSþÙùãF1bNøÎ2Å¡¦*Þ>‘ñœÆ£q{KÅŠ‰ŠØ;¸lºœ¯þßEËNŸoü@ ù@PÅÅKUís#]JлùÚ†|0ÓhÝ€ºŒ´<þ)Ê`Ðà±³–¬[2ÎÍHh;¾¸ž[üå?o›¨©m4sñÒ5á!㇟õHqj§Ì>––Nw·Y¶n˶õK\µÜò§?ÎÚbªmqø‡ÜM²&ý§®þfÍòÙAFƒ„Vœ›²(^Od5ËÓÞîŠèÈ_ûÙëhÚ^{AXFvçl¼§Pÿë°ˆ³—R¹WpkÏÄánc³¥í“Cõ¢kòOÕ8ròüµëÖ¬\8ÙLwЂÄk­m›Ym]«ºâ•þŽ³(Oužv“Þ Í‰s—®[»|Œ³‰ó´çbªã°“â?%ß¹º ßzµð=øŠª×öíÏh¤=/llj{}(éÓ[ÒûMGŽˆ ô>ã6 ƒÝ _ÛrjÈæÛ#i®û¹ˆyrÍÑ\gÙîL剡äM%“x®æ'Ë:諯¥»û¾j!}v8ð+ëù]ÎNN‡Û&´FÅã#“ëù(ÒF[Sgü.Õ3ÒO.YšêGžy®¸V6½ÝyÀZÎaº[PR¢¿rÜØ:ó ÓÌllS¥žŽ™¥™­¥5WÖ–ÆÃ'„5ÒÊSPÕÌuêｩ儼M×\ûkmI)ën柛fÞƒ…T&¡$„® oæzO½{×õî%é£!é%(ú¿ÿ£%b–bå Ú6 *OZô3ÿ±±íǽèÎ¥ÌçÍù—¶‹tmïHZ~õYfoÈhçYÕ|Úø ±YÕÜÒ ¦-jð–´)Ÿ%ì÷õÎÓ©7¯]¿ÎÕë?íµ¬[DÈ“xM=ë+k•ó%õivæÛO•*ÓfZ»´yù8S[HªŸä§†y‰ìçW´mtGÍ ŽÙ±=*Š¯íaÞÆ~ ¢^0Dþ<Ù´ÿЫ’¶ñšÂÛ—²_ˆßïö)MKù¾UÖóT/¬ÏÒžôÀN¾EñûPáÏÔâ—1w­¦žßce7£Ý‚œvt±¡ÁIJ¶ syË,sßú•çoK›ŒC†˜Š„íËXwÈê\EÚ¼ô<ào6ʳ\Êj÷¯bi¨'21‰ŒmDBçÅ­iÓn”Xñvj25ÕÛpüISÆ*Mƒ1OIç7˾ǻI³ü9(†"L³¯¿¤gOZCƒÖø fÐB7ógbàúQ$õ@FétÍ¥ˆêþ\bñ„iΩûÕŠë -÷T-6ýl챂n>†’JU§Wãf¢QF±Tc]‰‘…L£‡Tã\gJÜûÃúM›Y)Qì¦I18¾ ¨KÜ£«ýô̆Gù1/'%vYž±Õ­§M„®Zãm(²ØîF^Öõm üµ´lO>å—¾W¥MÉCíÍyQ/e‹¯íêèÏZ›–›wåh¤·¹æøMg^׶y>Õ@{Fì••UÜ3ÝÜ=ÞÍ%¨mT»þßv÷VcÂrJ*ªJî[?ÕPOÏrܲŠ‰rÜfxФåK- æjqð™Ã,‡ù®}ÁŸíÙì©oá™pür^öí¨E~º"ÇÌ éº­íãÎNnW ÔùÛãOÉu¤ä¤yßž:.jz÷–}  !ëѧÙÁ‘û…ÓÊŽ‹uR &¿\{&iÁH{sK S§í矴,}ÏÖNæ`mfiiî2ÂýÀ§Ê›ïœá4µmƒ[iÎ:[ßpeoDÞP4ÃÇÚRdy³˜Ï¥ýË\¬‡Zˆll­ýÆ×)ÿèŸ~çì>6çyKÿ¥!'ÐgÄžŸ^(¯]ê¯Eò_ε?nî™0ÂuL–´›WÜøôÊXÛ¡æÆC-',ÛUs;ÜÖ\håCHáÔan^^îÞ-åå9bÁƃÒº†»*vŽ»âÍš9::Ç].%Ýžp©è £½}èÙ»jü3¡8g”â”™åÿñWº·@*èUÑ烦ÿü_yÞüÖÅO²).hVN°8¨U‡ˆë«+**›dl»6:©¾¦²¢²J,ïx³ê2é°k“â²\\_^QÙ,W­u¥% •å5õÍ&jP!·ÚUÜBUWrÓ‹Ù—ïu¥¼ÊÊÄÜœ«ëT©ÕP]QÓ e_•«m3jª«âÞ¬òMu»W&wSÝã3[/ÜUÛ/{‰4ÃÐ,S»iLЛî!hÄa+¤S§É{÷ zö*š)vÒ䨅?rõ%«HÞ>ïÚ£Z5ÝŸ‘åG‡)Š•°²si¥‚+'V\S¿çˆ¬‡@Ö³wÝ?–egQ29ÍâH¡êœ6µ¥e5 «¦gµeë¢h9‘Ëšš…T5<÷&?$ÜT[úáŸd½)µ6œ¥ˆœFÛÞ­ØΆ–³¬LR.à™¶AŒœi&²æ½»Å\¯ª§FI/©¨çˆŽ Þºm£ØlOÎÐõ›"r>þ³üÊe®]Ãa%©ûò³Æ5( A±×hô£àí1ŠqÂ6†•H¨Œ›DÚL3|14CI¨êà¹2^”F¦/´®ÀøÅm¾×ÄÞ\®Ø|OF5+ÎåÂ0ÊsKI)RR\ÝãcùŸÂH¥øÄàm›6„?F5DÎRüCS,Cñ7ÉÅ dJO& bà`š¥ð‰À[¶m”Û±ªKÊ˪”›Aq—?ÊÿäsöÈ^d üêÌ!-»$´m)Ùîcí² €úQ Û°mã7lÇ!|Dð®ð[9ØP–?¡%,¡(~,»PÀ;lÛð§!´bÛš•ª‚TE?½Ry’0hÛÀ;ŠÅÖ7RBþ¨§L~CöÁçëƒ ]ç–z¬ÉÏÞaÚðÃ52FB$ñÅ«—-z䳸ÈÉ3ï°ì)gðêÙ5wX–Áб3ÐÍPDwS¾nò’Ãc±Ý/ô}ù„ä MñE)ÇhøaYš?sŒfågŸ}\è³äÑÈ¥½æ=w½ï—\%%ŠÓ‡âøè—üª¤Õ we6dÞ·vSd¹ì¥Ó‘s dê|Òüʹß !sÈرdÒL²ïBkû 4íìš5a…õµ»V®H¼zï}úxh™œͪ¦ Ë(N¶ÀýC®ÖœXüxdp±÷¢Å|¯Ô|÷T’Ï´PIï/†–VUTÿŠCÅÑu••MÒ.«eÙ'“E_M8Qq6bÎP{Âæ—§Íæ@òÇOHýËZ> Ù6šäO!ÿû¿ä¿þÂ_î;Ž(âëÞ‰­–fF7_”M7ŽM¸ô}ìRºùbí·ML…2>+º¹·*?[v`y‰Oð3ï%Åž¡O'¥M¡8ÑcÇS¥U–"kr›S{?q ~äýx…XZ˯ç‚ýW)š5ð/i†óÿ—5”?*(((y^)o7j!kª~ò˜»¹ðiY%Ý2¸Ñ\[\ø¼0’ÒâBåC(Å€ˆ¬¶"óÚNóÁ6'–T6){;Tåó'ÜDŠžÔŠiՓɪó ‹ä [W^RXÿ¨¨¤‘R>#]Urc¼P/dÏé’âçÜÔ•EùÅü@fÃÆ…‹JIáÙˆ‰k¯¨F6%uäá=’Mrï‘ŠÆvió)©‘“ü»ü]…OU[Íò¯üùH@\ÂZ»NªžDPòŸ¤™®Í;05NF˜äÕãÏåV*ž¢âáÂr±ºo÷¨9gáSßÏ¿Q½1–zÂ< ~8,¸Ø7øñè¸ÂUD¹<–eô¢à_“5Ü_^Eêw­Aúz Df“—$4+–gùݽ^v溃ûjj24:5â„ò!û<,‚í™gkdfa*Ô4¶´ß›SÅ¥¤Q>®"¡¡çèqße?'¤~Çl #MM}--M-'ïËŠ6GQ¬–©SrÄl3};+}M]7ïåÏøS–4lšéiidàä>bö²1!6[üÊìf³âÄÀMî?âÆFåËIõ¢÷ ßPQÖüüP¬J›þLl…-wõ&ŽkTo5%†zƒw;‚¡áyð˜ûÙ—57)Þ8UWÓ¨º?7ìŸ \uí©š‰¥MKŠ¼v—­â«Å°B‡O^øÈ;¸Ô#æA˜œH¸ˆQ‡á7»¡„þ5í&z¶£…û´‡ŠÖÁÃ㡆Ú&GòÊISa€™¡ÛÔ5ÕŠ œ 720ôJw9ë ¯PoàÄ g÷ÈwM±2|©²sCWþhÑßQ9Àš},ÄÈÜ%9»Š¿Ò˜¿Üg¨Á¨UüdEñ:ÚÚÆî‹ŠMš’K‘æ&Ú±—•ÏS7S¨»í²ê|¸/\9uúr5ÝÝ+4!‚¿‘BåêÞbòß½ˆ×RUÚp!£ Š!Q“ù«knñ—“æ“$ó—t"êïŸ:qúne³šeMOƒŸxl{º’ʹ0‰*^°<ß/¸Ø'²(˜!ü¡‹ a:mZƒ°AØH2†ÖŒ~(où l>:#!¥ìEÊ ƒcOZº¬|ó,g¯oÄ|Úøh '–´ÌDr{^?Ë–ó€?=m1À>CÑ_Zï4`æÙÒvKîÏöƒ„G+)Ž×Ò6=œS¦jYÕ¦ØòçWNY6M¨»ù|.é0†Év3žùìyXÞvÕîÄmž*mz|LnW¶¼½z2è?ˆùhþœ(Û¿æÓ¦ðM—³Ž§õT륳FZRâ·öÑt™DþSíáù¼–>ö Í[OW)5 Ž¨ê@þp«Ž¦g>CZ:©º=ãÄ ¡îèv]æ܆鎥 É:à=dD\ë’”…ý,º¦Mž—Ö gÇÃœ‡+ËÕV·ïç+¹ y¯ièRÒ¤z|]ªŸ6Ï:¥Í«2Rù*S$Ñ[ɬIÄl߀qoI›þJªÛýxÏ@>q 2–ì\@$EÜy¹cHfi|¨)ešÃŸ+S*{4·Ð=ø±ßÒ'¾Ï™‡„Q¾XmO¿3²Üµš:>…ª½óÚâ&íh°P/°´­ÑÍü¸y¦¹£ÿSZ‘6îñ¯K›L×~ºI9/™T*•(Š¿À5ô¹ž—6©o6Ê—çÁ'Ì@{²!†Ü{Bœ>jkÛpiSÓnú%ZäG"cHF ÿÄ;»yKˆ 'Émx›¨4C¯+ýzEáè5Ù~ K|–û_«>Íõ%iÂïúM0( j¢ö¼M?½ÏZzL„œ Ÿ~þqé$s}ã3Ï[ûl伶#VpË䛥Míb³¾?j{|í¨-{_7M›Wö¤žñ¹z®íÇÛÒFãO$«–¨Ž.!z\O*ˆðkÔ^ÿñm™¥œíÈ/ȇ:Š¶ ûžö¤ä„ÞT2sÑÅAKy&V|Ãý:ðkž~\MP›jM ¾¥×ÆZEGŠº¿ËHÓxgú3Ríj#»lÅoFšŠOºèôýú?Øòº´±KWŒë^‰-Ôq¼ò‚ðgo$qþú†c¶’×¥Ít¡î¦³ÙÊWVx-iÓæħݬ.æÓfÛ5Ub<ù‘ôÒ #æ¶{nP½»Ÿ£IY}Cõ¸‡Ûù{…óˆX±r†›àÄJ¢! ¾›»ÿí/»²iÝ柊սÙÃËö¢ù‹Ÿz.+ )-g;ö9Ñ°µˆ~eòýóAVD¶ncƒ|Œ÷ó]–Ø XÀŸ^‰u6`=|ä¸@£_­úV¢ìdírþÄ.²-mnMÿoÝÉÊ¿ïæò[Žzýݿ曞®Ÿb;H[0&ÐÓVoˆUÀ•EçQä§ýE·‹[W·µûm8®"opúJäê¼’_~v賿^oî®'µÍ“Ï s;b¡G>5 ÿ ‚ɘD²Ñ›þhL>þü?÷úKÞápÒSÀà|þ%ùÏ>ü~«ˆä%OÆòÿù[ÿðëj½œÿ¥È¶'³‚‹üƒKFüX}œ•á¤. Æ B§_:¾ÿÀ·©Eu-½ÅÂIÕ^=uhÿ·G2KÄíon¹Ü®‹ÑrZ£Ò¬Ÿöîûö~¥ªéR~ÿÚwû÷þp5»ýDmI×îgWy#}~âà®SWr(–¼´'¥¼zÿ Ù°Žºª"qÉéûmÓœßGÖo!™íºˆí/œ=HÖ}Câ ªÃí]zRÏ3m½¥îÛÛ° µåɬ¥ÞÁ<¹ï„BkÔºÓíxûŠÉ^\íã§Ó ¯}!ìKföÊgjE9\Ã’—χ}õÛïôb²Ž®:]P­î=)Â$<\µ¸Àëìa(ë»Þ»¾=yù^ £î£¬ Mòe·wGÊeµ4¿ ²àýjñ½/[Þ*ÏǶlÀ5PðüŒDÖG endstream endobj 855 0 obj << /Length 1287 /Filter /FlateDecode >> stream xÚ­WmoÛ6þî_¡û`3ÃW‰r€é–´)ÖK=lCS ŒEÇÂdÉ•äºòãwÔQŽä¸YƒÄþÀÓ‰zx¼{xw¤ÁM@ƒ×ƒWÓÁÑ™ƒ˜Ä!ƒé<ˆxIMd,‚i|~X—éÌÔf4æ‘þ^Ù¥×ë4±£1£ÃQqi3k*‹‚pÂFŸ¦o§ÓÁçƒÅhÀ\’ˆFÁl9øø‰ èß”ˆX›fÖ2¡†1 > ~Poèçׂ(Ä$ÀR:ŽÎ—R¿ðî(îïHEŒ(@mvt^ƒŠÓ ÇUQUéufñ©.p\W­bá…ƒÑXÀvçE‰ÏvÄÔðëÌ®ê´È=Všã8+òÚæµ×?nl–çØĘE$ÞÉgªk–«ÌNÒf×åM€Âåë¾SCMB&Ž•aü¨c#ð}¤¶ÎíahÆk"4 ƒR­µ‡`ûƒm(€m5ebBë.ãô2$Žt \Ú`¾¹åÂîØ„<䆇² ¹P„·þ5™-!ê!¥ÃE]¯PúáÍûw§_œNñÑä·(ŒòïOÿœž^^œüºgÎUtYÝL߯ëÄÔ6AõYZÚyñŠ|jJb£)¤yRlªÃcœä‰29t'k|rò8¹Ã—ïŠÓ,3GŠPTÜq}çîÄ+?  ºëx–o½MG‚´k&iU›|f'tLjƒÎä0±ƒìw°ý´ J“IL›Ÿ×”öË„ƒ›0 ì 棤VRdx:# Á‡Ø==fí&©)¡ }ñ׈AJ(Öt4¬¬u»mÈxÿ‰‰¢Î¦^\®8—}w;Í1ôÖdJÉ¢ŒÆçÃéÂ%0¡õpiM^¡&÷#޽݅PymQ$³%vĆ jÒ9ÎhrSx!ri0Aé‹KK¶¬ ÙáœbÞ°cÌbFb¦A€QyÇlOB7Óæ…O½¸_²·@HEa·l7\ò¢ ‘Ü©`Rh¡È4¦\5&Ò·ò˜H·^¶i~^dY1â —ßøl¾0¥™Õ°y|^®+¿‘kÿ‘­ffå<…E jjc¯z´qßCü°µä?¸bB¢t¸ßO‚¨‰ßë'J¬F …#؜ƇÊËûžÃɽKEÌá Æ­Kg®Ôcq£²ã\È\¢§ÃyC0:¼Å£Ä+PÑP ›sùµÆ×µ½4ÿ8½E­A¥K@i>«=]êµ9NZ¯V¶lÌkÞ™§§è,Óí)<ðËô‚3¢#ŒéñóÊÛÓó0DªðÅÊ¡©ær·¾9î,̈S_úÝò*3³–ßÛÔ¸HódćÛ÷þìw1Ýa˜ßŽBÕÜ0@‘¥È꧘Çà 艞Ã`EÐY³ÿ 'aü¬®¸³LÁü2 æš ¹½×Šø––sa®gØ„4šaøÓ÷0†Á×kช¡û@œâE«›¦'½º¶[v•[¾ûúº÷~-án ´jÖ—´Iò¼¥£m‹÷ó¬êö¦-¡è„Ððõoâ—ëÌV»–þ” ¯ endstream endobj 847 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 174 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 12101 /Filter /FlateDecode >> stream xÚíw\TɶïQÇ™wß=çóÞ?÷žûî¹çÌ™ÉÝ@7È$ç *Ì  cN̳€ #%E$çœCçÞéíÝÝÄFÇq0¯¯¨]U{Wí®îú±ÖªÚ»€ONþQü‡÷åôe}Y£#7RŒ þàäN Œ˜ÀQœÊ‚Þ0šbƒ’ÿ‰0B*Å”)ÑŽv6¡5¨Ä€Q’Ê’!$Bþ! ’N¢éró-³Öûá¸Ô€Q C(IA»ÐæÄÖó güZå²²Îmq•»€èµ`´À0Œô¤ »Ó¶UÎ_]é·¢Úgim`DuÐÆ€^¢ ú€?â-)P*¸bþ —!(úy²ì¥ÏÚ:Ï•Ukk<ÖUøm*ŸQÀËÃQlþˆõ‚H1ÃQùœ¶lâ CQ™Eàgëv¬¨t/óYUí±ªÆegɼaø|xÚ·²:èNû …I€áÙ¼”•kª¼–×yÆ5&óTJm ÃPÒÃÂñO»ªOÔž>gmòÖƒ$Ë‚˜®¹ðùÀçcÛd¶$­¬s»Ú‰ iÙ4¢«Ë}ÂÊ}V׺ÇGËÁùõƒý™ÈðÈÖÈðL|¤ÌÓwÍÔ,Ó>ûFéH*gdµ· >%ù­éauÎëÖábœOto«ž±®drxïÙÆ]R¢—RŇÄBþ”eÓ¿oÑž[VslëªÐå¡»c“™ÅO¶®^´déŠC×2¥ ¡N»vô×°%¡¡K7ï=YÙM•´$ŸâÏ5`M[¸äLòk…!SŸõÛÊeË–í<’Ð:`Û0Ü׿è(NÚ¼jÑÒ¥Ë^IC>)µüÒ•µÛËcRübÓîeåÞ«ª<¶–Ïnø„—®®ö(Ÿ‘ﱪÆwe•Vçc\BJ„À…Oƒ¢ÚÌR5YÞ#wÈpäüúéfV‹Úú‚5ç|uÜw'²û³PT¶†C%bQ{M–ã_kr¨¯þŽ™šÅ3‰Ì/«¸j¢Î¹Õ=îɾ})£‚@º–Ma;Ï>ô=¢§,ÎOÝe?|Þð A ,¢bòòZ·ˆê Uî׺ORë‹åñ`LUÛf–ªE8_!uȹuÁf6a}7\áç|t%‘/zp¡î8*í¡žXó!ï‚ãz ŽÂ ‡RFWî£W+:Iù ø5/ââ®×tP3Úm¥W¯Ä½ªïê3Ä°—)·ãâ®å×ò†6£xÙŸ÷®À'ŒÜ šáÆG}êÏ\×›Rø°«~$è ð…3h[L´— äO Æ`±£$7(Fm…£!">¥¡gEí…!8jÀèÈ †RZƒcŽ Ü"€B,&Ùô`^FÁ“BI‹FJ=ÕÃ$Ôîtý·Fb2‘í ýÀŸ—bBj÷o—æ Ö_BêG¥ÔÞ™tZmd{75×HòÓ%¤Ï4à5áŠâ>!ÁÒøO €?TP¥eX÷Ï^ûÀc`BtæT‡‹+ÖÒ‚IAkOJ’–!þáõª¨Hn_%ý(±|·TÒñã¿zÇÿÐvü¨µ`ÔFôô¬J¯Êÿ®ýçßÈŽaBú"«GE…?~lǦ5² 1¬µ£g¼ŠdìÉøç=JA%2³ê? ¿S‘ŽQéÜ{ƒ9)FǺ!š4´$ãLjƨtÏ](Äð΋'°þ/2^…?v¼4¯À$ߨe#j~ùª˜'±€ÑÑÒt‘¦<ëPQ‘ŒWéýïÿB…‹>îß$cUªÔh”Î ØW÷¶‡<½ÖXGsݽ.øÖÀû`8‰ÐÖ憿þ;2ö|œŠXe z箘,"•CGwq¥6‹,M,ýË% W§)!àËu¤1QyéW}ŽÙí"¾ÂœÁ{VxÑ,C®¢Jj>ËÄÆã7žÜáÁsÝuu§z$wDí¹î4Õ¯©Ë®-õ\z®ÿ¼ªÃó™v.Å 3ªz&¶÷!y–µ+ØÀÚ³¸KÑlwiÜ$#«›Q±OWÇà×Û% ûJXìB Úõ¾3ð~`)+’ž…KÄßEÆŒGÆ«t«¨eeRŒ@IãCGwq¥6 Œ-f]Ãò"ZÎQ³Z'&°sÓL­f5Èw¿¤þ"—Ö›Ų́E”Ôf:ËqùÓ¾t±¿ŽþÞ;/7\´øªí*rFWSEúÃøù>V&Ž®ÃÕïÝ2ÃÁ)h_±?0y…ÒŽ¶V*ó¤ l’˺å%¤ÚLwן:¬jÞeàã8J F ©ÏšTTz¾'?Fò½ŠTel…±y'Ý,ttç¤(µ™Ïµ\ø¸?§åáUJmÐÃa^k{ áãÝ ¸VžE‚‘ÔfEê`µ‰¢Ô†BÔ6 6âöÂÝK¾3\,”Ôé›lâ¾ð’tÀ·ìC·I¯ä+ò„u 6ðg‡ü·î?ÿ.§";¾÷/á‹×úÃ8¼§QŒRÏ @Fu¦Om)© vv-iŲ̂Ⱦù)äbÄtSëiµèû©ôÄd}fÀú’¦Öî^žë-`Ú)© Ö³~š­s ¨‘IùiOK;pÒ“2jï5èå› Ťçf‚düÿF¾+3®gþü†¿ý]4fœä;•æß6È¢6ŠK?ŠÚ# ØܸÝŠQÃ"OºÃ¼«ñ~jS3]O7üZ^¿¥t㶃k)@m¢“ù¶Lcظå·)1¶\4žðË ‚¨µ€Qä.Æ%Â%‹ù*ÿN|7¦þ/ÿ…vµv„®ETTÄãÆwOÔÄQ„Ôû¶ 5åŒ×GØ©³,¼\½ÿüÑÕå>VšúnÉJU¼«Úà±S´ ìgß{QÑPõêôæ`¶¡×Êîv~³ÌVªšAÓž}µ¦¶àçMg¨š{Ì¿t?ùÉõ £™‡¤„Òê>PxŠz¹”šÜvÙ;JÇýЬ¢‚<‚’Om]×Øq¢q?t«¨HÓŸa!Ýõ6˜ô\ÔÂÐè~“ƒèÊÙ´ì¤Dž—o rw´²µ³ ˜>'±°u„õtˆàèŽy«õ/®ýmFH\F…dyTkéu;ç5m²#ïo p²3󚶾“l¶)ueˆ“…㤙K"ªzdöTCüô9a¯û–؈[wü²U^5ïå3`‚®”¸ÃÆ£ÒËb£Òn)‚HP^÷´éb•1¸ŠJ…†:.ü0Š‡ƒWîá}ª‚£^OOO¯ünH奻81øŒÁ ^=¬(ÀQIoOw/_(/ z{ø"Å8Âëéæ ÄŠsP ™ìéåË7™¬q¸R»ð€? 6ÔÜ6ùé]Þ3öûÞ[p1&¤¶X÷ÞDB˜™gÏBßÀ·…¦&!}ìF­­AmÔÔP@m¾µy·Ý-vÅÄßkLå]5?í›Ý==W³ŽÀ·¨6J;ðŽŒ¤}¶›ºuXÖïÖ—º•ù?®1ï×>õoѦ¿«›gÕ >‹/@K ›þsØÙQÛ¯o8­ù³œ^ØW øFm^Ã'†k¦ô­I:C'3ÜÖåýnmU£6|öGÚ\0g_ž*Ù­ÉpΫÿ<Ô¦-ÍÎŒ¾îRݨ©MÓ–¶S>ÔøòÔfdkdx&þ&Û]~:Úžd¦j™Óoß(I匬6Ãý}Ojh¾"ul¶«ËÔíص*Ÿ5ò•áïÐ!ý:âeõg)7Ó:XmÞÐ3oíÛᧀÚ_²mÓöd±Ùœ#HoÞª)N66V³6žDMêÙ)Îf––¶Ë£nB˜ nï w{sk+ËÀ¹k²ëzÉÓkÏÿjbÆå°æ›ŽRç˸y~66ÖÓWD– l÷õy•É'̬,m—î¼ÐƒŒ0º_œò5™{^få5µ÷-îèMŒ\ähkæèx>«Ay^œf`Ìa’W`läúœ¼ôÒÝšL—Âæ–+›ClÌ&¹M¹”Û2pÚpbÃG; Ggßèë/Gé9›|½ïáÕ§®vµµ2›º|w¬£é·ºX[[Y¸Ož›I)Iâw“ÀãÈ@uõ¡ôå÷뉮ô~µ‘Ÿ\úøX°§­••uð²m…íxŸ>ÒŽ²½«fL²1³±¶Ó$P§æçgB¼ím­-ïŒ5_bƒÚ_¬Ú´&Íb:zúZ9nس/jS¨ SÕjú2_o¿ûcv¬ 2¤Ó¶^Ë—Ç ¶ûÒ m½ÖoÚ²kû¦ÅAÖêLÿ\!!ªÌ;w|=W‡³ëÊͼªVR’ò/GÐ4tf/ؽscˆ;›ÎõÉmQj3ÅØÌe¶ïäà]ûîܸÐRO+øÀcåëÉ9/|öÍë¦9³4M§¦·Ê –;h1ÍÂ~ݸ{çÖð¹n:zf×+xÕëqî´)jà'¯Ò2pÙ)êI‰­ËX´ú×;6-ð5Ö5ñxÞ"{;ÂW3ÍÕ-ýænÙ¾}Ǧˆ@G†®}xƒìœüø zÚþó¶o߸ÐßšëåÍb¸ƒÚ_®Úhªš\©“…]0ÉÁ>3‹ä:Dn¤l²ÑõÞ{úEûú°¦®á駊„¸£h2󧈗U í­še­î™£ÁÂL/mÕW2¤3tª™¹½oQ—¢äùÛ‰žß®6z:zA’äùXwÙ”IºÛ^*9B¢C³\\‚¶ôÇmt´ôBNgÈSh[­îìeäë‡;h^‘½}'w%oÐѳ¸SÞ9Ln2×:ë豶?*Wœ3]­ ƒWÅRºÐžcg¬9'2«o?vÞ&럂oTYŽôG d ø[8ÎýÒ±Aj#(ºmÃ¥…ÍBäÎÚ±Ñc"gÕ·=÷fýƒîSÒ­Ò†‡ÇL˜ô„FòeÝãŸm#’Íá-›&i3=Am€/WmTÍVòäñ9lfÚѬ9ç«ã±ç1x@b’®¶¦Éçõ^›+S›:™ÚÈÆJgÑ)¶ºe²xÀ©¨LML-m&¤¡A,—E70Y3”OqÕWÝuÿÛÕF‡n–XØJÈw*7ÍñblÎW:C3ËÅ9h3¯Om´è6O«ºg *è!Ѥڴ¯`©Î4Jœ—°M·L eRÏ…é{aƒÔS*hkª¹d —A‹o"°²½4uËÇh¿#ȼh¢ž¨ ð«E¸b Gb#¦™Û„uõ}ýc}jCqs<íÌÍ8Æ‹a`¤«®¬6 Wh3ç4(´kPˆE%Îío·äŠÏï«¡MriOŸ¨¼«ÚPQ⺾9)¾Lmö‘’’ç®­ÅdІ´þºöÄÀË…ÊjÃñŸß.PØš£“uíƒë{e{#7¤¬™áfeÆ1á2ÉNàèëL£Ô†ÔPuŽYúúö¶ž]š¼ýAj“|j1ƒÒ0(ò^t{×À4©“J$FùÚš™™²¹lC6ÀeH‹o&Éó'°‚kEÎ^Öâ6À×®6© µ´§‡ï¹û4³¢¾E»B¸?*«Mc꯺º}jCù\]MM|ʶ:'õaÕ¦^Ym^{kèî{Ñ©Üâ°°3©6 Ï!Þ¯6…;½èÎ3›ø˜¨ö™SË9$"îÞÓâªF²<Æå_2Û†¤lºžÆÖì¶K˘&Ëî*eڤĮdÒ}JûÛ$ˆük»ØúÖib¢ôô,mºIxäɧ™/êÛx¼œ8S&¥6â¬0ušw‘íeSÖŽŽ ¨ ðU« zuýLSëàê¾E5ÒÞÊ æPµ‘õÖÝ·ÓÒˆ,$úœ/IŒ»ž×þûöIÕ&šåh´Ë/VëøxíqV†6‰åʶ–‘óó~_\¨}­«Å¤Y¿ö¢DQÒ~¶®M ¯ÿXÉëûÔ†¸ºÑší¿ÄYŸ}®¤KYmª7eèÍGúõíÊæIæk„x=ÇoUŒ´OÜšŸœ2!Õ¦‘ìÙÇj×>ëì?%ç7[uPà«Vìù¾…Æv 9u¿¹"wïb[º¦úÂÄ&™Â$š«³¯VñÄ—öl™fʲŸÿ(¿¬±¡&åL¸›^û!má.ö¾a5<éÛÔ†(½¿‰©©¿!öQe}cuQÚF?6Ç#´Yˆ)ÍI9ëÑu¸SÖ=U^WUrmÿ2–žÎæ„Jò¨úôXcƒ‰E½agCÉÅÍþºšž‡3åúUšcn¤ÇöœßJú>rA<'Å/›çh`íšú’ì™êÔ+ÛÌ4uÖÜ©'•ûìT.ÇgqAm»PÐS™ÿ`¡7‡Å |Á'­«“¡64–Ï¥äüšºêÌ›Ñ\}Ò‰…(1ð¥ªMËýiÿä†ñûÔætx Û,´ÏßÀO»©9툧^"5ë]u ˜&Æ,ÝxÓÕŒeA&LŽé™äji×ë@s-›³þªl&ˆ÷j¥ ÍÉ0æ2 uµæÅ<£D@Ò±ÐWoÒšœþv‹/ºÿä¥|=Ùm5üS¯Ê£ÔtÌ—ô«Mã ]ï Ê«‘ñÌ]:úú†zö)bRm¶ÿ¢g—3·©ð¶Õ Ž,‘%Ä£géééq9F\#:ÍzVZ+J(ÝQEª‰ÿ´}‹ô ¹†!ÝpÅÙ¾ËÆzŽÏ³Ò30$;Í`-8òìòfG&“¾xçCª¢Ö KÃu—‘þJ[ŸY°5ל¯UœÝ•=Ï‘fÄ¢z†©¯µ`ß] &[rÓ•l®Áæ™3™ ‡«·¯˜³õé\¿—<„è-Yé¢¯Ï ¯„IgÚžÉzâA³Îƒ;€/Pmð¡ë`‡Üõ‡+¤¨.ÌNÏÌk—M9I;j32²Ûù”–ð[*ÒÓ3ê:ý†º’¼ŒŒ¬ÚndXddØÙ×ËW¬·}C˜Ežª)ÈÈÈ- ®‹~–üH¬§673-ïuÕí÷G‰’ÞRwmaFFfu›°ÿ8ù¡í•/ÓÓ3«Û©O÷äf¤WµR-·åÅY0hGò¤C/­¿uEûU…¹é™Ù5]èëÂTv^±¬k AmAzn‘UTÐP’—ž‘ÝÌG åªà˱mˆw¦7¥ðaò5üÈ;2Þ¤W¿ìÆ,©6ÜÀCVâoª`p=gVZѬÖw½õbG¾œ·ô­Ò­0ª€¯_m¾ÒVXÓÄG­2à³8ö ¦‡þl÷G‰‚7w]^¬§ªËáß­LødÕDŽ[a‹øýÚ'x¯Ý­õÆ”}.ÓpË¢í¾Ù4:_)¤ÐǾå|6 Õ¯€¢+÷n‡¬C?ú~+_z”˜ßúòÀŽ£uoQùç¼'ºýݪÄy1~3VTuþ¡@’|îÈÙøTê^‘§­þâßÚ4Þ7åDÞj-µñ32ÜzÔæk Þ'tßÿX~ü(±LmâÿŒi­œ?B¡RÖ»™q²£F<´o™P[ñcu»lldFž3¢Ú¼eMõÛßÝПÏü(Ñ›ÕSJYoêyöȽڟ©ÜõƒÔæ¿¡kGp'Am¾"®„Eÿ·ùÇW›â¸ûåµïsfO~TÔ¾òn¬:íÆÁè]ûM«èøþâ=Ïn?½gÿÁã)E­#¯»²"£cxüìijё»bNÇ·’ƒë¼{0rïÞWõd%©±G÷EEEÆ;›YÖ)¯ -åÒ†5s¸t“U;£5ÊEkR܉}Q»ºRÖ²mNuÜy©°,wåé· »<òXl|e‡x @ØrïÒ±èÈÝÇÎßêé}íjóµPý8ãÞ‚M˜ôcïN¶ˆcØ{….±8[V/dr8¾~î¦\&MÇ*^$À$ë¦X³ØFV¶æÆFL=Í%Ë åß—µ§ YÆ '{rL­}]­9,}Û%[7yêš:ºù»˜°Z“–Ä˺/¿²ZW_ߘkìà`mÆe2¹7_µ‘­Ï.žÀÖgÎ _« àUÏu5asØövæ&\MÏîFܶñ¡¹¯ðÖ5sòðw·ä²h“7v)Å㥚Ưåq›âít ÷˜%®†Ææ“ýÙt]—”Þá§<Þ¿ÌÍ‚cåàºbMdMW…—¡ç´5V& WoKs6CŸ³?«¹/*TæÌe’}â`cilÄ2ÐZ{þ%¦Ô')¡®AÁîä›05±2åpô˜{eÂDt¼ˆ#ÕƒËå88R5°ºç ȳSÏ®e¸½ìóÿ¤¯¶ëi9¤w!DÓ€m#­}<‰eÀæ°l¬L¹ #ãb~·\QžnvÒ30011µ·‘ušmHµDfÛH—{1Ø#KKcSc#?/'c¨Í—Ï'œÅ8¦ë.¿÷á=Ô†i o6em­Üë}=ËAÃþWê—lñ©©Ú†n×_µË‡Yüæ)l«ä*Ñð¡U{J_Oß÷×Óò ÎÏfjMÚýD®‚ÇC½Lí}+„!n qÖ1›¥ëÒªpK€ã)òToå5cuû—²×Ow8Óíæç¶Ê$ŠW²ÈÙÈÚ+T›ó~ÚËξŸòâè—üÑÛÕFWKÛvÉùH–ßs2Ñœw¤BÉA£l|µøÚÓ‘cêè—Õ$ÿ•Ñ±+ˆf0÷–üèäCÓõmç¤× e)Þím“u8îâa}’j©­C‰¾+M´VÍ$Š]k:Ñ,´J1ØsПk³p‹#DÅ7L9z‘÷[d¡—gš˜‡ùx¿'Evæ‘E– Ç%/Úe +¨ÚÈb¬Ç4ß5ÐP[°÷"Õ˜âOÿyeµvýÑ[-3ß»E²m?¸Ô“Åfnµù*(IHJð E%_N”¸á2ù?ñ•Ì€Ç T¸qÇ&ôAt¯5Óñ¾9à(ðŸ:Ð v^Ï^Cí)ºI<õÛŸ:®£$–5Á*M1šð¼¨9l{¯R>Y &ä÷ ÈqEP·tªpÔ]ÝíÐ…35·)›¦§ókâ˾vñŠ»'·ŒíÆIµñÑd/mí·®Šwj0rê„oWMó;eíŠw'¨œd0;êµr”zHÜÆÞ0dC"J5C5t?Ú^/HëYk:aé½jGd`ú:@Gk{FË°êHµÑ²™Õ @d—Jþöû˜ZÏÛ B ‰ÇSuËlQìÞ|ÓyÅ(yLK˜5{ÚºSÔËÎtGcÈãYxÜ&±•¼òÓQ]“ÞÓÿ‰ U‡ªf;QÒ´åóz%¨lFÃQIó"î?>åØ+#ÃÅÑ7N)ºÀ2b€Ú|\ó[¾ïS¬%Žþ»EîáËï©6 öùÔ¾ñB© ×f©6/Üõ v&dŠ‘vú3óèƒÔÆÐôf^‡<ÕQrÎHuÒKÅIxÞ^…ÚÈ¢1mIWŽîظfÉüéÞöl]ßûðPµ!Ïh‹3ÖåÆå5ÈÛl-Rq·#ƒbUï¤6†Î¹ EÙ;ªÍÐ(ñ½¨>µÁ²Ýµ5¹¦s3®üÇÂœ­ûËSnÖ(« wúj>‚÷›<%»œõÜwŠI…gÞ=¹yÝŠÅ!îÖú†v‹äjCTóÖœ´¨ÁKníå˜>h%¾Ý7_bÿbò¸øD¤…>:; dï®·,îDô戰!AÎæ4š¶¥6­‰lcïµ²ÓKœçadžÔ×A‚ïòO2'UvóIwuèªM¾;Í`{|æ ˜„\m’~Omb)µé[‹×¯6¸¸}µ¿¥‘‰é‚ˆÝ×õ¤I‘$ð ÖÜdJ¤‡BÔÔé>ASü]Mµ ,¢KpåcÕ‡Q£Çg)~³¶ÐøOÓ¼>µÉޤŵ/昸3r¶…–åÜÅ‹æNõtš¾fO¨¹ž±ÃƃOÈÎê®~hCWs šw.³ï-_ÈžH7 šäj¥Ïtœ‘\G¹Ù'þŸÍþv ûûDóÌÁpµy¶âtm šdjS¸áïjYuü>Q)u5U Ú^ Ô Ò« ¬uئÁÁa%eöœ_fE—ô—%îàþäqQ+Azª¶Ï¶ÖÐ6˜:Åב3ÑÈ)6¥J¹OHµáxøÌsÔfÙ¹Oñs2˜8!`Õ1ù꘻»§hé°‚ç/\<'ÐÉ}êágM}ÎìðKróH\rÓÌØpÆÆXïs~êé:¶&4R±æºŒ¥nú: ³)Ó‚œLth¶Ó’Š)‘G[²çØh±¬Ý/Y8ÕÍÎcÉιކ,ÇÉ—ŸVÒºmÁê^žvnóÂg3Ô"NgÀPý ˆ÷þTk‰ßGm”oÓS¾a©»üÙ…ÓÇ.\OjáÊ g‡Õ0$…pKaÅó›'Ÿ¸›^F&aÛµ³Çîf×ËŠ°ª¬;ÇŸ~ÑÐ-?¡&ûޙǮ=Ê‘àCVÛö/¶hé æåÛßÝwAýÓóøʉÓïwâCŽQj—zÝòúé¹SÇ.ßNàĈë‹Iµ1µVBà…É 'Ožy^Ô¤8NvdKÁ“³'Ž^}#SIJ܉Ë‹åÎpoÞS6ý`J÷°~ü~ÊÒOŸY½÷#Ï€ð\bøö¸¸ò“ܾÿGë¼#W ÿàÛ!ÁO¶–X$~“{õ‡vÀ|{éàä“5{Ò_@ÿÀ·CQÜýÄ•÷Ÿ?Ûr„üi̤njÎ}ý|ëQ2Yû”ZUÕ”]ø|Û12Y•”N*F{q%UºùHIµÔ­³¬&mÇq²´ôƲ´»º!mljÔM‡ ÎPËzŽüô'ÈÒ‹·É$¯±-3òLê¦C¯ÎÝ_¾úÇ{œû¢5ÇCê“Ò¶'“¤’¯©:Ä{-!“‰!ëbTÈœ[ÓÂq {yú:Uª6é w2YJ*OÌ{2ç’Ãl²ÂÂs‰‡&:‘¥Çõ½ ÙÖx~²%KOù‘Éâø¤ÃÎT)Í“×Ô|k´U–%&—ÝzÒUYG&»k©db²|I i®”'>-»•Üöº‚ÔR%ä“&YÊoé(¿“B–6ç‘¥Âö® 2yóIÝsê%ÒG«¸K•6dPV“¸»—´£ÈÒÚ§98Ì€ÀGçÿ GŸ$ endstream endobj 861 0 obj << /Length 717 /Filter /FlateDecode >> stream xÚUKo›@¾ó+öR¼Ù7lz«’FI/mãžÒ°YÛ¨<Àuýï;ì€eãÔª*$fv™ývžŒ¬ #÷ÁÇypýIb©5ÂùŠÈØP­4‰UB••dž‘çðiÛäË´K£™ˆ“ð{ëÔî·yæ¢gán|s…K[‡ IåÑËü1¸›o‡á$®hÌb²,ƒçF2Ø$ŒJ›·*‰2 È‚<_6xûˆDRí-D¬@,¥4ÕŒ÷X×¥R䶆#˜= ¬71Õ€ëczèÀKÍÂMÚ¢RÕ(óêcr몥úd·ñƒº¬«ÎU];ž@ ßQióu•vÛÆQ>£|`TÙGi8i  ³Ío÷X ΩÕZôN32“’&f¨Ã­{í69¤d$Ø `íçÞ!#ÃÌôêÏÊå"®Ãý®Wë&Ãy‹2Ä¢­‹m7 㢬³r$ Z‡4šIe1ŸÞ²t#Òªó µÛœ ‡ÞsðoWMÑw9æ¢S†A§Xƒ2­²´«›ýPÝmé ‰qñ+:L‹­»Âu‘cVn†ÜöO_"ÿ@YNú×$ÔpI$ ˆàöbCƱ>ôñ F‘RQ+’K`-)³b€à¤À7TÀ·ó£k,eœ_Óï«XR'#pãÈê]ä±Ç¦ÒÏ–$¶3j˜-)-6ÆøjÞpñÁçó=ä‹ÖJRž$ÿ‘žó*D|bZ¥“0§"9У5Çã…͵©alzPǦö*r‚(cS÷-¸;´ªŸG\-ö«US—jYøÑ]çU•Wë—V›×t_Ôi†‹]^‡£H^·Ä~Ïèa€bj¥À°î~§åkqÌƔµæúg?ÿÏx:¦œw™%!Â/‘„$F‚…cð+ùÜ=’–èI«g­w_im"à2„âSÇÿÆù – endstream endobj 852 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 366 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16039 /Filter /FlateDecode >> stream xÚíÝ@Y‚7p¿ÝK»ûÝíÞÞííÞî7»;*AÜÐ$É’sA$H0aÎ"ó˜#˜3‚Er’œ$Ó¡ÞWÕب3çŒÎùÿí—.ª«ª‹ª¿÷ªº!ðEÑÿVU×T×Ô¢ |=¥¹¹§ÿO/jû ³¦³|QP¾’b>gµŽ¡yoo/NÿŸXØúÍa§ò’s ÊWRŽ¾!3}Bzzzpúÿôit43.“  |%%)—ÌX¼iƒ´AAAÚ mPP6€´AAAÚ mPP¾À´qZà÷úõëÊ‘èüÞH”OR’óˆ±ã¼°°° #8p€´AAùäi1RLL iƒ‚òc¤MäHH¤ Òiƒ‚‚´¤ Òiƒ‚‚´AÚ   miƒ‚‚´AÚ   miƒ‚‚´AÚ   m6(LÉ b3HR9T8¬„l›A 硈Ïe¦'çç§â_1‡ÍÃÌFÞôsóˆpɹ#~+.Ì”„fÌóG¬hpzJb3ƒà·âåg„ÜÑÛ™øD¤ ÒægSóÞ¹hüEMQZUAJP&kèXzíu0C”t¶¬]ÌV‘ÿ«ÅÊGt¤Ä½$Q[çªÊ~3ÿp‡0ù@âŸMW’Ñœ—ðªÓNGÅlYRBÖˆ1sf‘}©y^Kæi«MQU”Ñ™îæ½?}_:_¼QjÑá¶À^†¥$³4©†Y¸h ü€ÅîÊŠ2âí”R×2š½áÚ^áÓñ§DÚ m¾ü´ÉítŸ6izÈÃiUÛ®Un¿V²j[Cu控t\ÄfR‰é¯Mتl =ÛEžSqt =ït¶2е[MÇ‘°d‘à >Zša© N&Ó¬}Åg¬Õd‘M[µÕå§9ŸÈÛvµ(póf=uËÙÛ2 LŒÄ»u•åÙ,Sÿ³ItíEDüÀóµ,<¢®TÐÛ¹íZÙÚý4&ë™úl>V(H¤Í6º“Ì¢Jç5sÊ'åòÙjªÙl‰ËefØ‘”¤©Åö Te™DÜé‹´†žKÖQsÞU– hË$3ùÕèÎœ˜§uºR.›«…•“ý·ž°&Í?Ô—ÉqµW5vÙsPTo‘6tîKZª¬â¾ ÝÅH¤ÍÏ£ßf²Éê´- 6žËßt.kÉŠùluÕÙ{2²Éþä EÓˆt¦í³íX‚ŽºÜŠSÝ¢¦ }¦'„°Ut-ÍTtç|Ÿ'jËHN›Œ×&JJ3J³Fo@ì³N[Ke[ßÂ.蛜ÕXs· ÒÃoÕBM#ëí¹‚5JJ›,rðìfÖã øS"m6?‡´™¡/«Å’g)O¶¶é˜¢:72û8˜N›µ19Ÿ$å‘Ä'¥úz,§KÂNa}cþ\k-}³·û‡Z7Ó&«ÜTIÁ%º(){Ô%x:mÞÙš+Úù§3Õª— ŽlyÓÈG_3kŒ?Ÿ¨¦¢±øt£àò–ä´‰þnŠ‚ífÔm6H›ŸGKj¢ùöºco·Á ÞCb”h°U¦¨L((RjªšVAѯ„=·L³+pÍJ3÷=φzc$¦MbîÀSYí…WóFVl2IÌ£õogÅ2×Ó÷ŸHTg©i(K©È Ö¨8…­¦¬=û||î8iC×…V›«…D£ßiƒ´ù9ö‹« Ûí×V‘ó»Fs˜BW6¢“|UåÕ–¥ÑÕÑl«W/×1sÛý”¼¿nC7»¶F/×PÔº-ºcPÔÉó’¬_k§ª:c‹`æUþ‹´ -w>¯±¬[ç ¡¬ñXÂ5)f]éåæZV!)Ì­†øk"m6?Ï´IÈ#+ÜYf;æŠNdúß„¬:[­o½Òb³?66géÖÐà}¿‡ I\z£¡†¶Å¢È»äP>&ɯIèÆP–²çº6ÿ²ÏÅTÚÈ3%6{hû®ÜÑ×”óÜY$Lm[¯ø<Ñ2÷_Ïðp5ÑP6¿É“pß2Òiƒ´ùÒî%îteÿÙdCñ¨´I¼{KKVÖ=¡21{¨…®ð,Yj«©m±í±hb€ßb¶‘ÃÈ´i·×g«)I)Éþu°LQœ±›®®Üîbg¦&ÿ­±Ã<—y‹´¥Yl=§ «1ÙÌ’c.ìU“’[rm¨âĬñi³¥‘ºÁìÍqYÔjŸYjÊrƒËTQR0²õò¿<€Š Òió3)TÌÓþƒÏù£/½àF?íQg`:jbžs>üp“øáˆÏ^ÑSÒËV¢ŸrDÕ• þþ[…~›c½B÷ûÆgîÆ‹~*ö'zÔ¢½C1Ï>£ŸNÑ늱ؘ|q» G¤ ÒeÔ 6¢Û€^‘øl‚Òiƒ‚‚´¤ Òiƒ‚‚´¤ Òiƒ´AAAÚ mPP6€´AAAÚ mPP6H(H¤ Òiƒ´AAAÚÒiƒ´AAAÚ mPP6€´AAAÚ mPP6€´AAAÚ m~Ü’AíMöþDå@>¾ji_iÚ$>îíøFªi ë§)¥&®q/ø8‹‘6ð¦Í£Õû+u­Ým=r«ùÇ.‰OúZ&)$߇³i_cÚ(3rŒÉþ)ÖE·¤š¤U’ m6€´AÚ  m6H¤ ÒæëHÁ…¤„Ÿù1W”Dã=%¾bJ‚`ÍØŒ¤MlŸÍÌÿC.Ze0ƒâ%¼bÆêËü~OgF§ÊbÖ+XÈûf{)a¶Á§Ç½÷éH@Ú||Ý&únÑt–ÿ­Ÿ¼ÌP•éK}WM›¦¯o9gmdj¨Ûd‘M~z¶{£_~ïWAŸæ‰YófZëj;G=ýžOÏ"Ž²Ì6Åå¾w¶—d£¿ºeÔØÙbÏmP3ò?øu@Ú|¢´¹óÚP]Þ÷æ‡k5{Ož0Ò’f·tѦ£+¢bÝÜÌT”5æÅÕE¿ù@Ú¯_¦c±#ú‡œ¶TX€'ÛØuÕ»{Ÿÿ´9¶JÉ02.ïi³aåtåéë$¤Íå3í1H@Ú||Úd‘xAl:INá6mbŸ¼õöõ³rtµrõZ¸;3–é 6þi=K}WZÚ;;úìÙõ|L7NÙy$RCÁ8üÑ`J0 «èK·ŒM-ýRû›e†¥Mÿ’ì=}ÑÅc–¥ËÜ%ñUk·¬“6ôÓ©„l*lç^;7+oŸ„’ÄÜÛFÇÚú™zÚ:Ó Í¬çF¥èωÏ!»Nœttõ°òX|u`ùª%òb%Ôm6ÄfÖxΛcnï1#èÔŒÑAú¾ºMJ´‘Ëf´¤ióiãŸUm§/càè3'`óì%+tY².ëÆ©Ûk«ÚXYzÎñ´µÖUÑš¹þ.5¼žŸK=UÕ]Ž&Œø„óOF´¤U‚- {XJrÖsé†ZèËëššJAß/oÅ{¶‘«‡ï¦ÙKWéªL¶ ¼,X‚x¶l²ûäwK}+Ï•»S÷<Ѭ[·#TUIÍyI¤çJ# E“i6/Ʀ KÏÍvú´«÷,Xc¨>Õ*øFâËnI WÒ]Ž´¤ÍG¤óãaJZž{„gh6 [8}ÚÂ= YcÒFWÑjQ‚ðS죪éFŽg‡‡Rbnßüér†k$½úððÄÜVgí‰ÆÏ…m®„ÌRMé±-©èÃU´w¤ó„éqð»íjJÓ#Ÿ‘aÈ÷õö0vß“1j¥Í¶Ó&:í¨-*õ‚žšŒ­¤´Q›ª¼8E”*Û·¹*›ïŽÏCÚ m6?JKŠnž* Ñ÷7ž¼ãb¥k°h·„´aK-:Ñ/¨´Ð¡D…,²Ôt[—=2mLä ïJæšQ98²—8ñÆa–¢Qø#~¼ ¹DŸÎ¾6cÒ†·ÊËM×jöª]g|Åo’±²üœ3}#7ORÚd‘˜kÉŠö›³E ºØ½ö–ŠÓFIÇ/:W¶{“ª˜íBÚ m6?FÚÄfvù-g+MÕÑÓ7²°·4Ò4ð–6FêSVÝê³Ý¶~&Ë*(vXÚÐ-©Õ³•Yv‰‚Su¨%•ð¢aÁ² EçZe‡õۜݢ¬á²ãØ5)ŸÑi“Áçobáà:X,íçéý˜´9p|ŠÖò}9â. '¶Ä–”’á:¦—8ƒˆÓu¤ ÒæÓ§M¹±CðªÓçn¾Ó~àI_L&Y¿Ì|š—¤´aK ê6¢Þ’°Å–ZFÌ–EvÝÈVbÞ~Õ†L¹¢©¡îuº©eX/qBÚauE£ÈÇL݆©/e¿5öcë6>s]Œg®^NÊ"ñÙ‚6]QÑA=NÝ&e7KÁaËKAô ê6ÖÊã¤ø 8Òiƒ´ùÓÆz®£¥ù’ؤ—̹œørÀËÉ@ß{/ýpx06&º Þ‡r˜ÛƒãÓ+,ôYN!i#/“اMvÆ,C×u;ž’¤æþÞäW½‹9ijZ¯ËÙ’zÕâ¤3É,à6}^Ó³%=-°™&3¶ßf÷`U¶UøB·ÎèÙvÆ…))˜n}S„´a"åy¥¹¦”ëÎRú‰ôfG_>k .´AÚ m>[KÊØió&o5–Áü]·#ŽÞ˜áj¢¯ÇÖ²Xy±>vDݦÐHGÓÄHÍpfIJû,¦Éi²]6¦¾PΔkç ÕUØ,U‡%¬3ÔRc«ë,ø®+ºhô5©M1;t´TÌf†úlÚg¤Ë604Ó¶Ø>úšT.o¡›:[MÛsÝ Ÿ`-eÇÕW†nÂJ›cz‰™¨ \ÆÖd»®Ž[©£©¥g j˜=&mVŽH›D/e‰ý6+¦+› m6H›ÿQ¿MÜ+þ†Ä33½Wº-ß|²,öaáŸU³7¤}Ö½îXöîûµþ¶ºzù{E¥l{ÀÏ’ü±£è{•Á{“g-ös]´hkJTj=ç¨kR‚Zx[OÝõò]ãâ曜»çNMÄéÊØQ€bêKaÑGgz¯r_±eͱÂè1wÒÁ²ëRÞúóå#¢Op»Ý¡|²åØ•9Küÿ(ú¬bŽxNÁr$|Njا)ã%dȘ¥½mÃǾÀçõ.ŽŽËÎõ&nø¹ùÔHMayê§Ú{¢Ki1'‚6€´ùê¿q‚ZµÌCCSÇÂÃÇÅÃUW›ep9áÆݼڱÚ@­ã—´¤Í×›6tÝ#ñ%?êø­[/Ûr"øxalÖ¾Yâû•l²ýøéåÛ/l½ÛÏIÒߦ…‚´AÚ mP6ðU¥M©‰Ëû£—=e¤IViƒ´¯3mìûÝVéXVi[üØ¥ršMßo´AÚÀ×™6òIêî+×÷^ûiÊù£±8‹‘6ðU¦ Òiƒ‚‚´AÚ   mH¤ ÒiH¤ Òiƒ´AAAÚÒiƒ´AAAÚÒióå¤Mð±,(_QÚä#m>W9¹Î3<çz/,ó¯4·sÕ64GùQ‹®±%vÂg):FZ:ÓÂÃÑ6?1Š¢ÆNLMMÝð¿×† """6_‚”””H€¯ Òi€´AÚ mi€´ùY¸páB8ÀW&::çþO¯¡¡áܹsçá'GïöK—.açEEE8÷à3ÞðIPôÿ†~ †O¦„?|ªÀás)ÒÇçS\ŠGx|ÂçsI/—þ‡BÔÀ'­Ü0ACx‡â“Znõõæsëò=›{ߢ^Ÿ,ièÚ E' ý/§t+Û½©dVH•Å²Ú%}™Høb\ Gòûf£~ØR±§?mÚðù|z§>iN‹,XẺÊ=¨rNH¥MQwö7|Êd (êû·Í‡?{øôŽŠ;ÊRgJ[³”æ$Ü÷ù5édÂRõ‘k8h¯b°öL[ÁqöTÕ;­øãý°ú‹àM‰ÿ~¢aÑÄÔÖã« íC«ƒ*œÂ*œ‚K\ÎÔÄñEó#nàŠßû:lYDÅ|vÿ™!GndšÚÓ”³ÄDå»â΃«<%Þ?mž2iSý‘ëâ^ò±‹8Õûöž›¶îm¤Í÷Ç£øÇ£8Âô„ŸÇcºkº©î=e~ŽÁoœ‚jíÂJ\nµmã·eÂæ+£=û$yêð%ô=Ó—2ʧÉ#|7”ø\ÁtÎKÀø[£[FTÿw ]ÒZIWÕ•=)/Æ­‡KLÑr$óÃ@Ï@×Áê@¿j»àJç€:‡ä’íÒGçáÎ †/'l˜cçíã5ó,,Ì}"âøƒ6÷rÌZ'kc+[·¸´×¢ƒ¾åž©…mI{÷Ù-K,ͧ»Î_ó’y×"íYM§ëk³5ŒŒÍŽ2Õª#?r©›™©©çÊuoZ8Âæú×Ù±ÅM//x:››Ûî¾ðB¸Gçjèi«ëéë:¸t’vÀÍÂ|N—ô´_ͤHÝçãO¶ˆOéõsÉŸþƒüþÄe5á K›¢Fb£Fþýwdºé¾4&ã·,4#ÿù;¢hJŠ:è×õøhrU'éx›}¿¨™™×´ÄjÎÊ-þÈšUF¨ñ²dÒW<ßvº©Ùò ‡ÞñÈ`èv—¤­˜ckfn®g¨ ÙW~sÅ,sKK¿-ÇÛÅ“ùÝuûBÙX[YÛ¯O¼ÅçE_ý‹ …Næ¦Fn^«s{c„Ûò2ÔÛ…Þ{óý¢Ê;xƒéÒzw¹ž¶åÝwŸÿ¸Ù[ä¹æ°¨Z+¸Eÿ}vÕ®¬¶ ©t xãPÒŸÅ!=|Òã_>¡ÆpøŠ:[šòÏéÈË.ØuøPÌ G6ÛzE;}|¶ÝsõUÍfHLŒÝ·ÑPMÚkëE.=¹é†ºÛÓÊlÅÖØs§¬p5bzÔ÷PœöúÛW÷ëNÕI¼ý¤ò§åÕEc…É>á[NܸÒQ5ýJ“ );¬LÌ™¿ôðÉÓ‰»´e¦„ßi¡§Wg\[d¬57hë£ôúL|pØgöÿ·ÜQ½:ôÿuß‘ßɵëHäZ2åÿ’·e&Óió‹ äO"³W1Ó§þ–L&Â$*'û?DÑŽlØHæ˜Ð¡D]®^aÎcÞÀÖ`ÏUëbG¥Mwú ÛÙ ­Íö$Ÿ8yh‡ KÞmë5ᯊR÷¨ÊËúnØyèP\Ðl=ecÏ‚~ÁÊƱää¢öN>°ÈBIÏc=3™Wêm cî’x(9aÿf Í©ó¢.Ðkî/:k 0uYäöC‡“6û9NQµËèaRÿü;ý©Ò«Öo?t(aý2;¶åÑÖ¶§G:;ÌMïúìoPÄÿíÚ"Q ”p9„÷]Ý&ÿ —Ðrçð× ª{Þ.áR|ú_Añp¶¡ZCÿí,c±é©øaŽãT•ø’¾æ«›uÌòÅõ‰ú+òšVŤùKUuéwY¢(9® nœSÏÔ$øõ¥^ –¼ÓKÍn]úàŠöù™š¹l£Ï»”]6ZZ¦EÝ¢I Ð2Xñ@XXg©³:&uT{aô·æ’ÿú 9Y.zøô8S¥©¤Í?N ³÷ˆžÔ]F~û âÍN6`êýOL¦°¯ âBØgÐö¶ª¥:µn¾©£_EÄ—J\§*Ìk%-7ÕXÚ·ŠZE}~ )*,£ÜºQiSêª$³tw⡤ø¤Dº$„/rÕ3wkæÓu ­™'øâ›Û­›n8&mÞƒgXo3yr‹Ì`3iÓ nI=¶×3Ùý‘¨{Â!¬ÿ&–ÄwÐS¤±šÔ6~価ÓFZ×·[œBm|dÌiÓ÷Èh²ÚÕŽ¡®–óQ‹Lì}9í7ue¦=îê˜i®­j늅ÞÖ·Ù¯û8ê/fÒ¦îR„Œ²†wØžÇyÃ.§ñ_;*É.ß›œ,Ú{ñ!s íçup¾¬w©y^A¥®ÜzŠðž·ßyãTî\âþ¶¯Dð‡â‹®R »q¢­áŒš’qv[?<4âƒ\¬gl:¸ÚýµeC5’Ö›jê:J;ÅOOQ›6:Á”fû,_µÂg¥ øú®\¾¾Is­…C‘òýÒ†9lûÉUL°üæ÷DZ¨«ŽH›áWÀ×N%“èz~‘ÿ5™sbT“ì#:m¤ŒÂÛCiÓxZCÊ8W|1—þïÑÿi6ó:Kâ•ìJ¹dÔÎ$ܦ›—¨Ê+›[̘3×ÇNßÈ;Tø›¬3ÛÏv4ÒR”’VXµíX=ýwè½g$§â¹lùÊa{/xÃÖ.î—uàì+ .w.i+n'-ë«æ„—Ì )w{Ý›Áçs˜›ûpå Æêyh £‘ú¶g0VŠ]y\Ñsf—‰ãŠ.þàASä(«_ÐÎÔmè´)y÷¾´!oåä‡û<î@_?GÐoc®åuý¦ -ó“*—Ë ‡Ëô<=1"mnu}Ðò?‰áR¦é¤ö'b9tìçÞ ï|ÝFÊ(LBÚô?1š¤r®ièþôz¯éö~œ¶kZRºOº‡2:ç}£æª™{Tuö3 )Üê*hI‰“Ïãryí¥D\%ü|›) GßÛ{fï}Yõ>¹Ñ}4¤Üµ ãEÔŸ r7ÿJûG½5>… P ¹FÌÛí<Å|õqø<±‘Ú‘×Óq{›œ†Á­aí†ä[£¨kYÖÉ!Í7Þ—6RF‚ÉÛç«›yE‹ß‚䦯¼ÂÿPÚ¬^'¤©<3ýÙ«Þ±­ýQdÂ#z.2­‚´ù‡ Ä:B4½=‹üó²6EÐo3üëT¿bÅ%Ó®3Qü×/Ÿfå—ñ©K q’·ó?-þM×t™Û2è µ”vZ[ÜË”j0Q:¡‚—´ÔÉfñÆÁuÏ|3£%aLrµ‡•gÈà:#æ{,O¤_täL5ŸDñôîV2¶Á7…;c )ÿñ£ç-ÜÏ}àðIfÏr—ƒ¯VU;WÎH¨ÙD7[]4A·0N/Û8!y-tíæ®NŒßc«Ãš>/¨_Сš°@GI^'lOì¾u‹´Ô”|¶ ø¦*ªZÓ¦þ¢¢Š~Ž0mºž›)Ê&\*líoË:e¤«f>kEbrŒ·ÙT5ýy¯'íÅíÓÙ †Òæh„‘Þ2aÚôn³×1]àŸzã]º°É@EɼllOEåcò› Ä`!9ýqR"¿þ-“6›®·ÏÉ„ ÿýK¢â@¼M-m"JÊ·äÏÈ„o™ËX†'~AîwjIQ¼^/'5ËÙ!£®I=Y6Ñ`íPÚÜ_2Ùt›ðçò›ÑzZ*.KB’âw:hÈkXûÖ ¦—Þ7ÔVš±,<)f«‰šŠÅÊÝÌNJY«ªªwúnÚ…à9ƶºêÓ]®§—4ÜÙ­ÉR¶ñ L:”¾ØJƒ¥žø’Ùè†ÇIúÚª–óü“’£½LäX† KÄ­¶†KnRߪ]oÿÜU>Éí{\áZéRéR>“KºyÌ•~>8<ôÔ€ä¸az:êKÎ%\êæ‹Ž^ž¨ß×S”~iÇÆ°¨]1/Šj¹Â75nWyyEÏ€øäv–•Wö ®9Эõg—ÂÃ×?o`Úeå)‡÷DFD&§·=bÝúiÏÛzï á·Öž8¸%rý¦ rº„mQ^MþýQavÄf–4PuÇvFì8öœþMsyÎу[#"ÂM)oèÜæwõ¥ç“vED¬;rùqsgè>œ®šÝ‹æ^mû̇ OõdV¹†”»V;”÷å‘Áï¯AÔÀ‡gø#‰·Å~ð¢Æ]䇟<²¡O½·£XÒ*©‘ßÛ4j!ÔGlø@úÒ…;¹ßã4çŽÞiÔ˜‰#®c³LÉ >s‹÷ÊÜÏzEYp )ê}±¦Òmm¥ëª`>‡‹Óà£N^ŸßÂù÷~›ÚxÃ'ìdæGDè½Çø…½é5.«ÞXv“N…kP߯–ò…_J¡†Ur>ï†r)newÁÚò¹š ŸËÃg-àÇÁ£ø½ï+·4õÖòù„ÏAÖÀUÉß$L¡[D¨¡A3ï66œ&v|º¼áó(ÒËg¾¤XðíZ|ŠKz¸|>䟶nç˜|a†îå“Š’ËMß…Ìjî­AžԃVòÀµÿ“% -HòȺð?ÿ£1í&ÁWrzHGRÉÖ%3Cª,—½õ(îËÄn†O™ ?è ÷‡?{øô¶Ò4ÕÉú®¸iÖä¿;¼5îóyä÷ÿÀ|ñðâ*€E¢N?¥ß›Ì’0UU¯¬ÂO–6tŠþánCJDéÜÀr×ÕUîAUsB+lŠºsëðIð;jþU'û>»;̘µêÀµQSû;«6;j/é¿‘¼qEòñ×ÝAþþ;â94åZ8V'Ç_#çÎÁ°™G ÚËî,0µ.GÚ|ïú‹¨çWôn1øÄÅãó®´ZUhRåTéVî´¶Ôý|m2p Aøš Í Š|ÌÔKxi0Ù¸dœ&ðø”ܦLßl¥œü`Tó‡×Sçc;¿ˆ"Y'ü’ïK~gd¾ê_6ŽkGL_Ê&¿V""á:ˆ`éGÖÉmî+»f纳gÄ—øÛü¨÷µÇ( »Tb³N4YrƒQâ>$ï¹ø'{g¡ø38‡Pƒá#ø ?¿“ßµ«le`…Sð§ Z»ˆb×ï.wð;‡2 aó5G àÙ…ÝVZr22œ–ÜÈ œÖ]›µÎÛNAæ¯R²ŠKÖ'Tw Ž’Æ«ÒrJž? p×Wš:YYÇ*éöºÞÜöüŒ††ª–¦šº;>¯…ìkqŽú “&Od›8¹•+\æ™uZ†Q™·Vk«HOž,;74¶E06B‚‹,›ÍÒb+Y,}GÈÙH¶Œ”A ‡ô¿«{ÓFçEOúlžðì*@Œ¤Em¥o4Ƀ꡺(mÄGó5ò;3Ñ£æ<â ,zÖÜ„ç¡/÷I&ýËšâ‚Vá³Þ¨*Nvßp|Ô.zuÔJ- íeÊõ)R“¥œ}¢ªºÅ_úÝ×pj§¯–·“&M¶œã÷¤L<òJó¹½þšò“&ËȺúl,hÖœ¨—×ãÜŒUee¾••SZvðm§p9Ý×ãתIIOúFÓlÆÙµ¢×@u¦%­3R“šôíDc—Åi¯Þ¾¶{{ô&ýMãeßg:f˜Îéâ÷rH‹øš6OPoèìo;Píï_m\éìÿÖáxÙ^. ø<Âçc@;d ýOþµp-UõS™oû{ßsœªí\ÖÏ'¹®ª &Ë¢›ú¸]ͯçÚhYÍYÃŒýÒtƒ¥¦ÊbÛß®ìîïï;9WÃЪ´yëo½¯/m˜1À\ðÌ>µIKKãlFw 7ïâ:y™5טs:e—¶¡ŽßT—Ó[“f¯<Ùõ€ ÆÂo°Ðñ¾Âç2'`þ­˜í;“[y£zu(©%¿ÿ¢»€t÷Ñ­,â¥F&ü™tKjI] a‚åR³ ÍTMþ퟉ý¬~RŸN~?(n¦FTµ‘þ¦˜][OÞ˵“òÏxhê±=ƒzúû9ÍÏf±dL×?lóÀöù¶šæÎÙõÜö¡Ö,ÃGíÌ»|´¯ó4sׂÆNnwͶ*Š¦áLÝ©*IkŠüºËozûûßU=¶Ó`-M¾K/¦h¿»œ¶Óêwô>¹q`±&KçZÜS~.ls—̷︜îë{½µÔOæõ ··üIÂÖmqõŸu ƒ]…+/V%Š«:„âóû Ù^»4°Ú6¤Òmõ§JN.—ôò™q¦ÿ½Eø*†ù§#PWzÙ…Jñæ0Ûä7½…‡ƒÔLêúD“yɪJO›zIó –ªúŽ»¥¢ƒ§öœ"Ë(gôȼÜPkYßkƒ+º´mž¡u@“6ÖZú šÄÞÑ0ƒå£Gæ}_K¡»žl 'âQÈsÎ3‘R/L›ÿÝKü÷éä­` ·÷ ¿"ƒUƒÔ]DÖ€ôJÜNŠü33TÔœŠù¢Ô{o«<óÑäCkgYº„÷ \õ ”å·f4“VfðûÅâ$‘88•c« ç4ábï‚â5ÃÊX×Ô¾'™wþåÁ•ÏqÀÂï#uÕäÁ5²-ŒLúµhpaÝÆmðž…&2ý2á„ÞÒ=æäW®£êIªæŸvWpL|øì°³Ê,f ãŽ7‡X2VÅúzZ8¯‰í{½GYÑ£VtŽXÝ@Ï»†ÚŠô;—c·øi¨³ìwÑiCZ¯±U§ê:.>|é~uck¯àÅßU^6PSöX¸H¼çÛë²­ü·9NP¾Cp±ƒ(üøänÛ¿*×ÐJ‡µÕžÍüjºª#쨣[R‚ázè¸8£¦h”ÕÖ/s0nâƒ\­Ý¢ú‡N˶Uš²a…ió¨¤ó}iÃI7œÄ:úª¬´äMq1SJJJÊ**¹ÂqÀ¦þÀ´a;uDé[f^Û9dgIÞ:"m{‰…¯¢ä˜`Þ:¥Nþ°ä×òO»)8›6­9ûT§8V -“{ÌÛÊ&à@Of¸¼ú¢fÑô¡ÕqKÛ멪:®ß±ÿÚãgç«[íHþª­¶èbÒ6O-YyEKÛY¹í¤­ä¤¦œIZqµp2û°´¤¢®éË©oÌ[TêÚΩ£ïIkjÈ· r×âMœJAm‡/ºJ%ú²tú<ͱ¢˜XÔ5xŽ^ÝîŸýîæ6=›y\q½½û¡¡¬ú¹òNÒ"L›wïKR7WuòºçýƒÕþâ¬[WÒ²x´ñºþþ´y_KáÁ2á—¤LüðùwïK›‚CÌÌ÷kÉQo2AŠðÄCjÞ!³IÛG·¤ÆI›î·· äURê;Û»}íõ­?Ë­¿ -­ó°W´!|NÛÞpÿ»õý{mXV ƒË¹¿DÝ’iIqòž?z-ð—ž¿á™Í4ÖºÃéý é&ÊJg«·‡ó(õâãW•ä˸&EÛ_\î\ÜVÜJšÖUÎ /õ.s-î{Éçs…7÷áÜ‚±'Ø…-5³°Á#na¼ª¬ö•)<¢¤Ä>^#8¼ù§ƒgjXÎhé㓦ïMׂJó¡p[=ƒ9µÂ¾NÙ<݉žqLWÏûÓ&€If›^ßKÚwàxÛضþÝdÂ?“&qž,VÖo#H›Á7ÒŽ¢þ{ò«?2©RrƒürÙs_ô‚½§0”°7úš“¢÷œ{Tð‘uj }®{ƪ¾`¯Ž¨ÊÆ>í¦ø=>öÊ®~ß Çù­ººJIÎî !QVZn[N #ˆ×˜a®É²Ûy‘~áᶆV«v§Sí¯-õXÛNgNÇ"G]§%;x‚…·—Þ0aËEßo¾‚ŠôÃ{öjøŒ½Ä|r³ûXh¹k~dz E‹ƒÊݪìŸö]Ôhø¨ÎÀ8ÒßZäk£¨ªkâáî &;yÉîË|Á1}:\IVÎÊÉÅÅZO^ÃülF½à¤º:YZáîqÚÔùVŠ•ý–¹¢Ìï/¶U›lá:ï|Ii/ vÓPÑ6ôðp6PþÖ) ®K0ûÙÚò3. ®>1ˆ­æ%¼g{bž†ŠÁtŸ›» 9¡!=Y¿„3&»ªÈß&_ÿ?¢£I~ý2×›I›©ó é%¿ûÅè^bÙé$«UôÌ#¾Ì”oeÈŸE&ü¼ì”Ô…•§¢ =oû™Q“sŽYýÕ<~ðáã8ó‰ö§D- ¼'m} [KU9ÙCE×ÛsR4'YÙÍp2UUˆ¾Ã$mGVâ4E9ÇÙsÍsµt˜l£µ‚†~xôƒÎ×g-Õ&k›ZÍôp6bOµ\¼EÐ9OºKoÍ2”ךn5ÓÝNSQÚ7úÖ`áö]yy£Ü¾ÏwØðIfÏÍr—ý…¾«ªƒ+g$×l!ºþÈáÓÿÇÇM5ðž )ͺ{éòµ¢&Ž¸1!˜ÜUuçzJê½gýâ‰ÑXÕúh-ËJ¹tµºK•9/]ºœ]ñŽ »‹Œ¹{Mü›¾Ç©n§r)ò–BêI’|RpÏ !O.³÷ß—¦”x[{è&U"9“&Z²ä[çJ×í8>rê{¶Yø€“y?õÒµí£§¿¸wírêúþ¡JuÖÞ¼ráæaõ‰ÿ$-åù›Ár»Ÿß»žrùê«òæ‘Káç<¾qéJjI3G¼vÑ/¶98¿úliCx|’×÷(¸Â%´Ê5¤Ò!¼Â“Gz™:ŸOŸùFÕÆ;%©‘(IÝ<~¨qùá'¼û–ú@zHêjùÀ›é‡~Á¹¿cËá§ß?ªÇ¬eô®£ÆL¤>bÛ$.\°«Þ:Û®{G>cÚPE½tÔ”»V;Töˆœ":àÃzëÆkû9|KÉ£Ã/>_e˜¹°]ÔûbM¥ëÚJטª0ŠËÅá?Jàðø…½é«k\|‹­{w ££~ \Š[Ù]¸¶|^JÓ!ÂçòñYKøqð(~ï@çÑê=-}u|:k8ÈøQR5x“0n®€ÿ½(á÷Naã€óE_±…ûàÓæ óM¡Ý|Š?@q —ùhxiáðø¸5>-Å£C†Û…ÌwŽÔízíZß[ŠŠ |²Z€`T—þ&R½óõšÈ×j«åo=ÞˆÆGâÀ§I©Ò/Ù^áXæê_í¾¦Ê3¼Ôº´;Ÿ làû$Š`ø_Â8àÌ—·õ5¯ß±ªÈ.¤Ò!°Êqm±ãŽJŸ{MWƇ/ømrìûæ{gÿKð$Ž>Þ8Þð!|:jxtæ œð¸t†GZxÍQe^AUÎÁENÁo¶¼™›?ÑG‰?¿‰kRð “¢~À¬ÃŸ=|z[iššÔŸO7Íšü­kÌ­qŸ_ý˜ù’óÊñ}uQù›ø ÒA,æênÁ¯ßºIý›gJsô<+¶ó’~Œèø1,ú?·jë'M£Æ¯í*ÛQ½duCP•£­ãÍú³\:€÷bX^ø”ïwÔÿ¬™õŸÝj ²|ßÕQSºj¶;ë/¸{|ëÊä»ã>»æ)#ÕãDÍ£ƒÌo§/"‚o×L&¿ý'ò`TYÒs.lÞâ´öòçg¼ù˜©#–m0Ù¨xœ&¨&-é¹ÂéQV:ÁÉF5 xÝ5^Ö^¥„Þþþû‘µ‰K’ô²¨Q£<Œ]úgký V¸ºÄ!´ØUüÓKö•/ ¬p-›±±À§‡ÛAñé pp¦§'yì»s,ÊLCVZú[=»)ÏË…¿ê¬x<ÏR^ê›ÉÒò Bö”´ ²Æ«ÒrJ÷¦-sÒQš:IIË,úò+ºýÑþ✖KKS­¡˜ßÊ ×rz·ŽÜÄIß² íb.g—yf½–aTÆ•}ËØÊ2“&JÏôßS/øþì$÷©lMu--ÕéÖËß Oª¿«¡¬ƒž£7ãQOx\\%Zâ6ÑUȵҡ´9z”ü›`úo&“ï^ˆ^á#?2áßIË°Ñ£+=!ä]ë.*ª¢få÷Wsê/ßüÝÿJþ¨•´FÝl[ö¹íÞÊÒ“&ÉxE7‰O ~Kþv¿J2ßLœ(å´8,£V4ò Õ^´{µ‡âä¿N”‘Ÿ¸»¬‹yÅí¹nª!+#=QVA}å–#ï8Ìt~]|ø|–üߥ'ý?}¯+9Í¢-í«MŒôV—ÿÛ¤¿O´öô»[Ø:˜/›—()©Û7~¦/ Éw.q¤G{çãü*]Bªì7•/í"-ƒã€óã€Ãà»î¥`-5Í y-ôeƒÛTM‡â>>éËvPœjî›ðŽ>ž:ËÚëXxøõÐ'|Ó –šªª¦Ó£z.}0]Ú´@ÃТ¤•íˆ'+Spì½8©©£})—4·øúæiòR¾)ÌÖ)»lµõØ«ã˜ëø÷œT'9í)¶¤†•Yx/qïþcƒceâDªÉoÿ™.aÞ.éwÍ¥šÌPtÝ‚´ùÇ ä—!Y-ôû,ñÕg2çJó”åšä¿Ød€?|<˜QÕŸáƒD‘ν;vÝ,nµ«Nl²ÒÒÓ =ú„YqÝM{•I1‚‚¹u õØz³‚ëèV¯mëb]ÛR:¹¸->fºæ^mLX–ÚÊk8ì§g©}ÉVdÈnåÓM¢ ÆS•#½¥s/P{ªéŠ’.z¸ñ®ÓÌë™ÐêÜj£¡7;¤¦—>w{’Ö¸këêdÑ-Øàô+±Ñ‰çºú3Y°ö¨|ï R×–ZŠpS‡»—»EÏë%mÂ318Œ9jÚüµ¥}¯T‹¶lœétøM_^òÖtá/¨Ï¿9ª¦¨ÿ¸±—4ß`©ªï½_&ª½=¯Ä2Ê=8'ØB6ðv÷àŠ®îXhhíÛŤ•–áâfqCàh˜Áòï3xo9°‹‹—œs^42/6¿˜@ÖÝ?©ƒ|ókâÁÔaÜTˆ”>áRßgŸHh Ød>Íty»xúÁ€iféôu/Ni±5îUóD¡ÕòÂDƒ•t¿¼µà’®ªæ½Q˜5å_ñôð. Íy—Ž§¾\ìqÇI³/ҕɾ­&Sív ‡ %œÆÒ·ïwP9—4غ/‡Žj]¨«ºþR6ùF) )wyÓZTOjBÊÜÂÊ܃Š]ßrJéEñpu$èHÓ‘›–ÞÚ/üÝà!œ:ÓÒ%¢oèhnX¨"·åEi½©¦®ó`ÜqÀiC½²Q³›=gþÜÙóÅÙÜ@gºmO0ø‚+ƒ+5¸0m>¼nR\@®ž"~ä›bÒ¦AÜ’*vŒ/ü+‘÷d~X Nþ¬Å ;rt=ò®´v|ü9qbƒ‰þâ´¡s-ÈÐ|5“6™Ã55æ5 ÍØf¨¶ìøó²ë«ÕtÞ¬œ ·¯³¥®¤ ûÚù£[<”•”=S˜¦ké omei•Ç.ß/­®ë´^]Ý©­©1sîán\0¦)KyFüÝÏØðÉÝÞ“¡å®/ÛžTᾺʩ€óHP£á oÇÁ¹£5œUS4Êlë'„Þ±äjí¶©è$o]É– {Ü(L›G%ïKNºá$õÓÅ uoë„¥¾®¡±‘~ÃcÒfaêLzÛúj‰Ô“ ÿBÜ“øÓä̾iS6læÀ)Df6óÃIw2á/äwDKŠþÑf2Q™Iøß'm–Þ›6ÏO¯ÖÔônVýÚj¡êuøÙ› ުƑÝcªµ÷£¦k)9yíK8ö¼¤"ÎQfNŠ°£ŒßÞP|.n“‡9KQEÕÖ}ic?ɸ°QKÓ=§®¹N¼'ëëë›:û>÷AÃŒžÕs;¤Ây[ÞB¿— J÷SµÉ]§áPÂqÀ$8yöSb »ß/lXz £ãÎŽeÓ¬=;8â{ç=½)*:I³0mÞ[·! óY“žôVø󟤜<Ÿ.J¯ëïO›÷µîÓñòO¤JüðùÉi“\&v€(ý–دÌ”Ïüjá¹u ~1ù— dÁõïÑ’'mŠïÄjk¼ê_\(uPgm¿VX“¾_SÙâ5WtÿQOí«Õ~ŽïÖhJÏOx6¸œ£N“iÓñ ízy‹phsÒSt^OEýTNCíƒd-Mý—mâ…Síç%gW¶|ö–Ý0Íë{TáRå\鸫֟Á8àL‡ Ƈñš&—‚tUM‚깄Çãõ¾ŠV™¢›ÚÄ%oŽ«(kìº_N(Ó,À]ÓzVk?Ÿ4ÝxoÚd šG×;èêͨxÇåñø¼î׳µ'.Hª JÿèkÂK¥ù·cwì:Ô:ö^»{»™´a.\ z}çË1IòVÜK,gI8„Ç'é‰Ìôø\Ñ+<âÍ<\w‰p‡CzjˆÜ2AŠHÛ¶=oÇæ­©EMY·¡š_ë²|Þ |³æ£¡Z:ÚOk¸ÜæBKÕÀ˜{‚Éäú.7¶¶wéöÕšês&Gð• ¼®ÜcšS§Î¾PBHãb %÷Ýôž¡gçõ—\ÐPÓºöº‰tXê¨/Úq‰ù+ðø—¶±µuÓ+û„/ëá…}{cNuŽë=|fðÌ5U®¡åîAÕŽõ}eâ:£x´rœ\ ¡qB8eöÊÊZúŽ–ª²“W¼ÉVH.oV‘“3µ±±5Ó–×´¹’ßÊLm¼:YZáîqÚÔùVŠ•ý–ySæ÷—Ú±&›ØºŸ~ÓNºÊ×ÍÒTfOst´ž¦<Ñ=ôH¯`ö³´åg\\}b[m°k”wÚ‹­¬k0a$]Í:É–‘b®€ÎÆžZ2iùÇ?yòË_‘åLŒLô õÏÉ„_’ÅÓÉ„%ù/fâŠc¢§«:û—2ñkò‡ÿ`~ø•"ɬÙ£"VùÝ7—^›özÔää Ï¡†ÞîjÚ>…?׿8b¬"chaå`¥¯ ¬¿BÔhz’l¬*mbemo¡£¤nœVÂT +ooWUPvpw÷p¶´õŽJ 5Rf{åuÓ‹D)=S 'KuyÙ¹Q§{aÛ–ÑBCV×ÔÂÑvº¢’úžë¯ïzŠZ¤¬m<»™ûÓ¿G1〿î}¾¦Ò5´ÒépÍvæ#ß[Á!•¹ÓnÜ*Õ'Ä8½oÝN½û$›#žH Ï©1펎ªÜÔÔ[o»E1QSð,-íF^M7vßàÌà ~xq÷ÚÃÌâa—Æ9†ï^$'/a§RÆ5r9}èW…ɱ“¤´}D’ˆ~è$×Ï“£'È‹’÷Ç/éx²ófÁÈ©ïÙrÁÏüw/ܸy/½mhO ~Áíxz/íÖƒ]ÞÎi*¾v-=¹‘âtÝ»‘ZÒ èàh~zÿFÚ­»­#÷wOö£[7÷éêj—5eÎ\2ÀÅ8àðÑœ‘—kÄ•á‘ïûl‰Sã.òÃOyß-õ¾0 $w²Ñ<5þÖ‘ñ¿¯’™Z•z%¯áûö˜×:zRc§·‡Æë–qkPË=G÷èÏqÈp)^u÷›ð2¯´Æ3„ÏÁg-~ˆŽ‚#g üú9Óož/ëù<«¦ÛÚÜž{-)œ6æ+‡¹Èø1êÂê]ƒŸñBÞüïõÿuž  endstream endobj 867 0 obj << /Length 442 /Filter /FlateDecode >> stream xÚSËrœ0¼ósUYYo ¹åaW|IeMNŽ C´µµ‰‘+É:‡œ4Œ¦gº[ƒG`p“½¯³«ki ¢•ê …*©ª$Ô-Ü“»ã24ÖÛ|'Š’|[Ý‚ÑÍqh]¾ãŒ¼ÁÄÞή?$”çõmö©Îž3†1àØ\Ñ‚ÐLÙýƒ6äoQY•pÚª&P¦ çwÙ׌%¢Ï™(%Õ[…¨8-tl¦DI…æ±ÙÕçIiø8G åA £ÂÈØÙpXB“WÉýoùœÓJk‘ôËJQY–¨ÿK×­ÎoR^¸Hõ‡c v"ŒF@ÝGŒ s— M6ôöý3f¹œkr>Åp^Úx!IëÖáñ`½[±°[æ £S?4=†?Î>õxz$É“=³mdÇ„HõMïœJüŒçwÆÄ!q°˜š¬ozšï¤2ä:R¼«·‡æ•´·ò]ô&š€&¢ ÛÌ(G³Ä3Ý|\|q’"»Qˆ×ñ6¬—Ö„þå÷å i^ñ¿7èŸ+®Âzr\•ØH%iY·e?ôöÉ¿,» –!.~†ýq OvÁô δ endstream endobj 858 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 389 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 18482 /Filter /FlateDecode >> stream xÚí@Y¾¯Ñ {÷í½ï†Ý{ßÝ{79c$‡¦»irÎH&0 ""¨1‚Eh¢iœQÇœ#&Ld*( "’s§:¯ª4:Ž®#;¿oÿëÐUÕUÕÕu¾>çNU€PŽÏR†"&§¨ä®Û¸qÓ曆@ >jÌ›ÙÑÞÏȈ^¿Ñkþö­—›c/5 ˆqW[Ý&Ïyú´ž‘±næ‰Q;Rò ?@|ÌH-$ÞÓæ?ƒm`¶mضA ° lƒ@À6° ñkµgà¼â¢¢†>ˆÅâ_á8Øø;EZ!±ö Zµ­7[·nÝ¿?ê6â#ÚÆÂmJèœ9Q½Y¾|9ŸÏ‡mÄǵÍÜÐ9+zC ¶A ° lƒ@À6° €m`¶mضA ° lƒ@À6° €m`¶mضA ° lóE•œCÒJÉŽ{$SÌߥ$-Ÿ$ÓsåKRô¿éw™YE²wQü|éòw™’•ÖIÏJ)$™÷™%é•gÐo)‘¯¡OP²Ûd”Ê·K/™šÇ¬¡ß%•w@is$ínŸý¿KRóû]¶m~¹3ª¤5ÈF•¥§ÅÑÙ;Ÿ'ç)J47ëÆÕâ°ÔÜ—%KvÒÁ]†úZFÞK¶ÜÐ6 K½â_²|}Ws„ËÚòÌü;=M»àä„;onW¶|ÒÆÅ68Ú™rô4Øž½ÿŠÅG^É-¡¬:n5MrÕâè©Ž]œOï@·ßR ;gûX±XJûÏÒ±ôš·à@µlg’ñ-Ã6°Íçb›¶©öZ\» Kã§-cbêâunΦ,ñëï$1¥•âç‘„ãß™éŽá°õ¬ü¢¶Üb\‘ZLVEMd©±ü⟤H+ÒºPʵμoxÞ ÛŠHÆbŽžÃì”>¶¡R ÈÖ}ÝìõuõMܦG-‹Z¸ÊÍÍZWUÃenÆæleQ0;°ýÔ溣é°ô^¼ù¦LVrÛ„Œ³çšZOX˜Àìÿò„©‹¢Ý=lôÔµ=ŸŠÏíYÛÀ6Ÿƒmx6Äß’]ìjÌ2±éš˜ŸCRŠIÔ\s]³³&™èûFn•5m’oÕû{h³õ=—f“©ÒŠEaÌt Æ.<Ú@OIÀ6´’ÎÜ´·åš{.9Ö˜x["­ÌH’nµ.[>ÅÒw[z"‰Ñ—¬¹ÇìÀŠyV:¦SgN2Ó3òZv¢¥»i&³ïêË=*K¾Õ0wÚX¶ÅÌô§4â° lóKÙf}ü-ª[)%dõsmîøUçÛ™„ÉŽ–Õ¬ 7sÔ´Æm¿Ÿ¦È®lÈL75а~ AÚìŠû.ƒÇÕqù~{#Ÿþm#uÈ¢¨i\ÎÔï…i=ÕúôR1ÕL›å»ü²8EQ½IÏ)k m9=%áPWMË/®XšÞém›,¢ÜòÊÌ-va«šÏÜ™¬Ø"¶m>OÛ¬ 1ÓæŽ[q¾>¶[£8ƒÉ›Kùùµã͆黧%+r¼ym¡“-Y†Ž ¾æßn›:ɜ͙uU¾òô[R m†sÇïM.î@–¶ÅÎœµÖùÆiã3úlg&摸äµ\gâú│º æßè»%'u'™û³ ýŠÈÒPm“y›ïà[†m`›ÏÉ670BÈ“]Š¯ä¸ðX\gº%%JÉm ôå[Ežcæ.\즯n6ïÓy$“CÚú£ ölÚËSS÷M©Í(×|²MJv¶•Ú—¸ûéù}²¸t#ëzµ¯Ãh®ß©igVJnû¬éxFf Î~>Y¼ÜC_Ý$ì¢lú· óòɺ„ —å×™V¾hضù\²Ä6¾þë¦Ì§cýäyËœíôu4'Æ&å’Ä‹÷ÆÚi»¥&0Õ ²aG†™þ‡Èâ”By7]®cV±ô-LuÍ'nIÈ‘[h@ÛЖ¸xÈDUsbzyZ^?»”|£n‚‹ëÄß^,íüÊ*swÐ2›/}¹qÏnsýávó R¤Õ›lÃxiCÊ<ÖËÅWI*¾hضùllÃæ° ¸zòà°Œm'ÎÞõ’Ÿ/+ÝiƚýÓ[Óez¹goÇ6³Ÿ³á¶¬Z"ËêñÞvF&sö6%+u Ø’ºvÑLu´gÂô~ë6ٯƹiqÝö&1u²ù‡&šßz¥6gÈV—Šœ8¦6Áëo˜·‘ÕmÖÇOÑÑt]quضùœZRþ[øÅ=ä£û]YbÆÖÓÖ×üV[í:ÔG°õty¦Öáû›)*%¿kÎÔ )ض¶) [¶ëêMO{˜¢4(7=·t¬þ®Ï–íŠk Þa›ôÄ<’Z ùd˾#V†&Ö]Ñ__J‘þKÅþa¦©n>5=‘6½ !ºº†S“K•G§çÝwe«q¼6$tÛÆÞwÍUùÊé•$d•Ï˜`Ã6° Ý]ñ6° lóÙÛ†J˯Ÿâji`ã³ò¼¸»½#ë\^6ßJGÓ:üÅŒ{y—mŒí<¼‚¼»#p¶WÄé¤"²6n5Om¤™Ó„ K2ðÏGnÛë?#ÀŒ3†c;wåù.fßò=l ¬Ü—Ÿ½±Q mt4­æg1¶á™Ž"]ùÔ0ï)Áövƺjzã6æ&æa,1lÛ|6gTqÛŒ±<Ó€-}ë6ɧ/ÛÚ™8NIï•ËeR+qGXq4ìW“mï`b?1¹ïl;~˜Þ»å2K…¡“ÝL•×ob?)jÙÉ–.ðDÀ6°Í/w ø]’QÜ÷Fæꤌ»Ò+¸ß(³9ÒY¥$£P~¸ì²)za©%º+!̬ôRé’½#³¤çBòô"wöÉšýk•m¹.I/–]ÝIýä ©%LZ»×&J˜¦TÛÀ6ˆ^iá>Äam`¶m`¶mضA ° lƒ@À6° ÛÀ6¶mضA ° lƒ@À6° ÛÀ6¶mضA ° lƒ@À6° ÛÀ6¶mضA ° lÓ9Tb!ùô‘TH’‹_Òûó»_æK§*^ô^ P±çÝ äõ^¾°Ïòo,‡²ÛÀ6¿€j¶>&%>s 'F|â8í=Ÿï" %üÂ?ZÉwd^:EðSïðK ʾs3eñ^F8{KùŽó˜—ÞËù×Úùgkù¾+˜—aüÌ|þ]ÂNà;Ïgbòþ=ÂßQÀÌ¢ð\Ƭœ6ŒO”|ýßÝEÙ‡m`›OÛ‹É}ç)ÿúû§FÎÏxŸ2.qÜ’u¼ÒGÙó5Ý·ì,äëúðµ=ùšžüU‡ø ß8¯åÉL™º…©$^ã«»òµ½ø,?þåþÑg|ÎDæ%=1æ$ÿ>á]À,O‡é4~á¯;ÁWwcÞΙÀß]ÂØFÏWº~w~êmþ…zþõ¶m>¥mJݧ—ÙùÑ5œ„»Ÿ0JIâ=’x¥õé·Ú{¿+’ïÏùz¦rºFþXÚÇ_ðUʵpGÌ?õ’ì9ÿb#³˜¹ôòw$Òå;™·Ó È–§8ýŠY€^­l…YÍÌÜ“ÕüË­ü?™ñÃ3`ضùĶylåµ½äÓnú†€oœ86²NƒóÃÁüw>ê…zçòÊS.6ð‡Ûòçï€`Øæß6tõc¤C¢º{6ï‡|ê~­ÿgsÔm`Øæ×b›1ΉZ^uZ¿„mè`ÚS-0lÛ|Ö¶‘>ì›>Dôhì["þìÄÄ¥ûêTYýÚF¶æÔÙß?¿Ç-9—ÙUz=)o<·÷RÿF×OYI²´3=5_¾¶·.̬Ÿ92ùò§–÷»žäw¯¶m`y¤ä ÂC§¦—¥~ÈÀ•{$ñ!©ûV£ÿºMI8}Ú{òºu×Å)?wÉÌÞ¾hM´×ÄùóÏtõìímß(€¿æèOZOY•¸Æ-ü|rá»Nºö2xN°ïª{)EýÌ]¿Ê=â¿uضùɶ)è ´þÖ!æNÚÏ>PtyØ‘¸þTݽlw0‰«í¾âŠðgÛ†ŸObVÏÐ××7µz¢³Ç6Þ'KœG"—;é8¦%¿{áĬ'V# §\K-ég= –8³ÆîæÃ6° ló ms½ƒ?Ú9QÛ{À¼ÍÇ°MJ~×Ü@oCË)ëè&Œr»/«™?ÌŠ‘ùIm“K¶ž.ZñãË_íHfضQ² %Ï-’´"&ij@ÛTé’i…ý/Ù=1¥@±Î|é†hÛŒrJÔôT²<é!_¬lØ6½ö³y—,›¤œB¡_¦“yÓ|Œ¬‚7ô¶ ½¼SxòÖK=+‘~ÒÔ"y~¦_ÛðK”¶8@Îê-¶¡—gB!ò6° l#-Ù5+—Zjè¨ Ó3ÒÌ=4lïK~Ÿ(µÍpÇÕÇ.›k¨3B{ô_xv“g§ÞKê³$S$sÄëvîsw6Òóg-MÇi[Vmåß$;„%ú¬¨SçжaD‘O¶¿6ÉßU_íoÚ£m¶,J‰5ÐñxÓ6²ÄïúE11ÖÆZªßèéyÎßsI KÔôìd!5g"‹ÃfpuÙÚú?¶Ëkb²‘eô[Ŭ´4Ãì¿mÐÂÝǬ4GxD'çõ­Û8ë:¥DïHs°Ðci~«§oæ·òBüû·¤æ…©Z¥òKP·m~õ¶É‘,ZÊÕÑ·îjô‘²µû®úzXp ý¢²ûkIÙ22çðlBýp?úÀ-ÿqölwbÒë^‡NZ‰;´ÓLg´]èÞ5G¯ýÙH®Óº¸|¦9“xSX7\SV·I9ÑÞœm`=>|WaÌÁÜŽlS6Ç÷ ÛÐ>I-ìœ7Çk`w5æȃ¨í‰fºæ×ÄfÓéU½Ù~¹bÆD7# ÿe§^o»%QÎçð}¢yŒãjkúEgE-[¶u“µ9LjËò[SÚm¢Ü8¡Xž\JÍʶ¶Ðq^ô¶m`›ŸŸ%¾òdúÌIFl].‹g odÀ1È6ÖßØÇܦKw²)…m¤%TÖU(]aîÛogѳéŸsW Zw«÷X¹®º“öì¸O2K¨ˆˆ)¶ËÒ«ÿ Ë’Ké¥$|®©ŽlÛÀ6ŸvÓ·DüÀ͉‘»é¶Í'ÚtŽ¼ÏkñŠ¹<®¾™§gPˆƒ5‡­­ã“ð<­àï²Ñ¤ÓW<½ÇòXªæYi¸ãlÛ|â­ß'‰eäð_¦~jÛHí$NNÛp4:óÇÉsxO 7/nÑ5²ÆÑßã’Éä3WýfÌŸ´l_ì 1WeÂ6°Í§ÜômÁ®Äu';û°ÍÅÆäom’çïàçËoµ'»aÿ ÆÒ’RÜÓïƒnEÛÀ6°ÍÏ»¿ªK¢®·rÞæÓmýRÿ›ŸzlÛ vÛŒtHÔpÿelCW67óù·`ضùÔ¶±ôL,$)·EŸ.®µ¥LJ²šuxôܯTºÆ/¥H Ü‘0 d:n‹åZ¸-’O‘uQu¿”=±NyyYúWyyæ¥X±¼¸×ò²·ÿ컸#`Øæ}ûJ ÈéØc‚ßý߆aª óéb˜jÕhVí½Ì¿™ìV3Ifœ¼é,Sö§máÿ1œ ÌÓxã.ñÿjÁÿ_cþò÷?dn5Â^¾ÀÄhæi¼Áñ̬ÿ5áLbîÿy¢ŠÿWKæ%=‘~y­o(»Çæí›øÿcļ}¤3€m`›OئHÎ#;.Öe^ªÿıƒŽË±©ŽØ`É?øˆ±Mò ¾ëþØùü¨Ì=¯h{L\ËwšÇŸ¼ŽyüÝÜ‹Èä;Îå»FòSn2/ØQÀhÄ9œ¿x/ÿ¦€¥•?e#ß%‚?a ?»‹©ØDígÞx¹ýxFßs)ß1Œ?'Y^½AÀ6°Í¯ÃuaiDE…ø,%i²ÄQáß•F¡üî[Œaîùˆ8zJ‘bÙí¹ò/»Ÿ¨¢¼|®t=o,/[ ˜ %ÛÀ6¿ª˜Ç'C†O%FÀ6° lƒ€m`lƒ€m`ØÛÀ6ØÛÀ6° ¶m`lÛ `lÛÀ6ضAÀ6ضm°Í/g›I+w§1÷ÖF|‚ˆHcl3~ ɼ‹£ñw‰¥{@(l£`媵\§É3¢÷L_³«'Öî \™1yy*⣇ݤ**×ázÀJþ{¿}YjÀÊLú_ÆA+2ÕXÆ° Š¢èWD-‰^«ë×ÅLš0ÞÒÂÜÂÜ ñqCG'TEE2jd¬•…áû¿ÝÔÆŠþZLqI˜zyy­Zµ ¶QN_NŸ>½víÚÕàc°kÈÊÅådtô xhÕÐnmÞÎñãÇû:|8“'gÒ-)GÇã«W/ÅÑøuÛÀ6° €m`ØÀ6° €mlÛÀ6¶œ8qbø;°“¶³ó‰µk£p4~¬\¹2==’éî …?~>6{÷V B­ZU[Yù1oyy9Ží`.Y >àc‘•Å\¹˜ˆ#ßtØÀ6Ø`l€m¶À6Û`l° ¶ØÛ`€m° À6ØÛl€m>” þUmK»à#>- ³µîU};N `›Þj¸j?ZuyæMÉÏ÷Õó—ôïC1&sÎĉlÓÛ6ÙîºúköÜ‘|À:*ne±ÏÈ_Ûl§æ½'¿jÛPÔ›OXëê± ÕßÓטI>”MþŽš‚]F£ìrÈÛlCáÑnüšl#+ðµ·÷†x¹»:ÏYÑXÝ£WÝæõám‹Ç{¹x¸û®J=ÙA䀵½Xæn¿÷™øŵ´é¾nî^žK¶—¥fînoimÆãpìœWî¼ ‘ÙÆ牨|KøDWW—ñSœ¯è^àW`º°S¢‚½‘ššvnÞÓ¦Mòq17÷v·åpÖJm#ª/çÀb[:Nž4u’ O]ßwMyóVaëÓS½ÈµAF,“ñ<-Øcô}b^HHÍåïW. 2Ð6XÏ?“óˆʱXG½±¡NzÞSC–DLsµ1ÐTµ9Yƒ3€_‹mhtÖ•YŒ²˜ñRêÒ^äÄ60ˆÞs‡ž{!ÎWË:4÷e›lùª›»l 5ÖœImf=š¥a±·¸A:SüðÈ*¶¾î²ô´¦^äî [R·5—c[\XK=‘½lÌÙii¨1'ã)N~¶a\P}kk¸é±×’îV•àö=}nôž\ºµÄxøŒDÔ%ƒPu[¼-lÇ/¨2¶™kö7£y—HO‹¨q½®MØÆ©¸•n4Êözw–8ÖAÃdÑ+ÅFÉë‹vf:³’ãTàד·)Ûï3ÜpnµXášÖ Žzúk¿Ë']ÙnêªFfÆÖ–¦VÒ°¶25ÐÃqÿ°±ÍÿR(DúîœeÆÚÞ‹^u§o؆ÉïîÙjíØ€h›ÔÔ_>+óNîónV%VšÔšåÂئ€t\±®›u_ÐÑÖÞÆM{{{GG§„’ÙæÏ2Û(\•·Ê\Ë#rÛìé^ ¶àc‘—G~ó¢¢òK†ÏOÚÕªkôFY¯¥ºÛC¢‚­l'zO¡*BØ#‚¾+ìi*Q­9Yç®Þ.“åmè–”Åå–TKÂX‹Ù1ÍÂ>-©7zÀa>B!ÉÎ&‡“#G>(è5œ>Mrr}½Wäæ’ŠŠŸ´«µ…æ#­§¦ÊÁ¤-!Ä…Í•g‰­²Õáú]n”Ï«ÏÝcÃ_LdYb«Ñ®Å2yêùÙõÆVxB–ˆÝ—n8Ê®»¶àlÂü²+TZ¯à\|¸WÓÒ5hkâ¶ðIV&>žú«w3ªhyry²3G_ß,j+Ÿ¿y‘=w´©óR™Æ˜ºå3SSÓŶm^6ݘ¥fí4­Pª­Ê;»,µ4BÞ¹ÿŒÞÆÑM6£={åmlL´‚·?©À¯Œ¶üs{×-™3}Ú´¨ØÌÒÚºÂÓG ½–®©"÷»¤˜°™Ás"âwŸxÖ&‘IŠocø·¬Ê’SiKæϘ›úãÃJ–›µ¼Ø»uñŒ©AÉ'sé7<+9{è’RM¦³êì©#7î7ãÐ𫮊õzÙçòÅK©mþ:ëR]ï™T«Ä€aÀϧ_ÛÀÇ·MKùTíßžCø4/\Y P²‡S=ÅJ1O¿| hˆ1¡$1预JÓ™BÒA‰ˆD×>X7´g( ‘±ˆ(1éñŠ˜¢ÄJD éE`ÀˆV‰HB‰;]±aª9Ý-)1éì"BªK,$ŠÀ7€µˆÐµ"Ñ­)¡˜þ»g–ˆ‹èºèºðºPíLKŠPi£J1ƒöO'%î’H›Z° àCmÃø†zú°óÚù.±€®Ú(M”˜©ð´A'EÿA`ÀʆΖŠ‘ÚÏÿø?‚ç(EW8óßêÊ:G§Žƒ?¦!…¼ àCé:{¾ó«¯›UTºö¦‹ 2=TŒ[ZÆù׫¨”Ö k;bÈðÁ´ýx¤ME¥Yåw•üwF>D,é b‘°ý_þ½ù·C+TT`pàÕ=iª"úE›ÊÐÎ…”P"$ Û67ÿŸ/„**/þé?(¥!ÆðóI¤ê?ÿ øzH—ŠJµ¹€qC}£¾nÇW*b•ïÉbf9d‰Áßí$¤Þøƒé¸è½ÕwáVõ–ùo9ð¢«bO½Ç~ô·õР?BÛÆ-M**¯‡ÿôÇŽÇOEçŽ4Ò/‡m:Dxñ’ˆé’‚mÀßñOXûèƒú9YEÍýÕÀŸžÞo±ìe½àe”ùOm޼ߛÍ/º_²Ð×vÉ…×eÓ&zøyùžûUwf²[ÐÕŠÆöA»j·,°¾à'êWôìê†ÈéÇyûO›»;«ìýtùÙþ°P"IkÇËßü³p¨JçPÑŽ5ÃǾø²kèoêut:êÄ:ÀÝk+ŸÖ6¶~ع.i®­~þ¼VÔ÷·o[t¢¬¹ýÑÿ¹«DýíAÙIÿ3¥òUç;7ó,Ô'n„Çßõ¥÷rx#ü¾¼w2ÖLG?³ò=÷·fŸ‰šå©¯?¤pµ5¼ª|öR®ÈÎê…“Ùfs¯ÿýRõy{Lô4Lm'úórµe«œœ”ûP‹J$¡¸cåJÁ—C…C¿jüÃï¾üªcȦß|]µb¥„P]°Í¯gÁZ£gn>,ú Û´§»pŒgVõ™!îx¸`Zð­]/ÆGnÙ[Óõ!¶i½aå¾Ë/ž)àTÇõ 3gœk Tõ:7çï_}zÛ¯Ÿ®­áûð½lCJÔ¾=ÄLßeii“´àQ;#ý8,Ó£•ƒÝ6D(”ˆE]ígNuüî_tëiȯTD_yú• ioa._c,ñ k˜P”D,IK$L•„’Õ™‹på3Db±¤'c"‘.ÊÌ~c¦ôߊ9\¹[v‰ÄŠ‰ÝëÉï@QÒ©"fŠ’ÏíÙ=·%cŽ—™uh%E$Ò…¥‹0c+Äí%StÿâýÝ“gW6qFêïz¡ø!”ˆé½‘ÐûÕË6²Èì|®„RjH5e[»ïñKhaë³E³n7S Åû]üZä”Ù¬äZš¼‰"ûŠÝê±MŸÙ½6*‘­°ûÀvÏ£Ä'6…°ýHÇÐ*ÛFÜû(K¿‰l ý§¨½"„÷ÿÃÏ»Ó=õg7põ7œx%Û¤ôðŠ]³Šél3ÇV(h«û«ªàKá_´ùu§ŠŠpÝfä ]ó¡d3xÆDØx:cµ»™Æ¨oÿ4\MoòüØ¢:¡ì¬m}|aE°»îè?óí0]§•ü#õ²ŠDíiCíoÃ2o'.ôf몎þ‘Ó¤]—ˆ éxQ0ÝA߀Ã24Ô72—O¯Iòêhüg#µá#‡£=aîªË›¤‰†öÁÚÆ+³o쎴6ÔÖTûV“kµdûi1§vOÒesõy,.Û懧¤þ¦Ñ¶Åär‘ª¿ß´rg^]ÃãK[¢cs¤+kÏ9sÆsÒ¶çÄþÞ(ÓemÉþþŸåuIÝýMw«[mþ=oËÙîØò¤„ÉõP‚¦kî®É#œøc“GŒËÜ\ù’ɽ®zúZ /·U‡\þðâ ûæIZîŸ]ì¦3ò¯#FüÍÜsö“ÛÌ´¬ä¶aŽÝÃÔ¨é¦:ßÒ‡N]Ï8duòCéJ_ßÜË©Ÿq3+r¼ù¨oþöíÈ1nS#Ï35¢ÓÁ\}.Û€«gÀµLέ&Ú6\Ó™Çdz5ÔFÓ_côŽ«²x•eÎγ›^)¢+{Ïwo\{¼¼­;õúôz®îæó ÒêÛ“É.c4´ó;ßù)a~Œ„t[¹‰m øJEòÅPñªö¸½NLÿ¸H$.\4®¡ÿ¹½o‘¡†FäÞœºæ–ª»Ç&™2ðMfNéÎÛS t¸î³oV¼jizu?CS“þ]6óÆ×ìÌ9¦ÖKv\nlin­¾j®Ëñ ÞÂÜ݈Ìæê„l>ÐÔJ¯¦óðâñ\/þTQCCËâãÙ¦žw_Kˆ¨#~¡¡•©÷´èG¯›ë_dDøp x©7ßHºjù³=M­g?ê é߯¶géqkb“4ˆûû ϯìÑqI5 +¿[ÓùºæÞ’ÐDUׄ‘3¤¶ÜKí’}ðnG}SsaÖ-—T‹°ê—æã‹_]³tßí³µ©©S,é©ìuÛæ’Ë—¬½TÕ§ Öåø;ZŽ=šÿ´±¾æ|âž±>ÇQÑ’ªó6dÛû.©liªx!ÞFCÃ>"¹KBÕåt2Ò363ŸxæuCÃó‚C^<}#÷i÷^‹Ä‡ÖÏ4`O,ê齡ë6fFÆKÒ«ê›kmò·ã˜ÙŸ~Ø%µY9?vÍÖÔCM}ˆàÅê K}îäÙOƒ ~j̺ØÌ~\Ÿ{KŠ©Ëv nÞ¬ÿÿŠ‡~MÛF8ôŸ:—/Pâv¦ )¡j3˜Q5K-¿qZ­[>yû£íLÆfµ‘Ò„m#«CE-Ý¿æçWXŒ4‰x)· {ì´Õ y©l94Ü`Êý:Ùù]ÊÕ Ûvœ>ºž^s3ÓÞù´g«•;ŒÕÙqçïÑ?Éñ‘Ö¶cVw§Ò“\öÚ}²…;v„z›ÙÌ­VVÀÊ=Y·‚?Â5?O¤˜-ÈuvÞúíôÊW]’ʼïu­oWJaTJý“óõÃ÷åyº%5n{‡d€Š_Ó/ DëèlºÞ¡Ø¢xß s5}™mš.­×åðÒoµv¿£){…Î(«3¯„͹4\¦Äµv”{ñû¶yK9øq£«ŽÉ—JEX¿BKÃFjá©è`žñ*þÎÌ ù§NIˆ²TS[~§¥=ÿ #{døÉF¥6Y{¬ÓpÛ˜3´²N¿a›)\³iÇ{”ò0VKßlový@ÅKØZw7ÿVÖ‰N掞Ï?Ä?ûLF†bò¿íkbšUTZ¾úRðÅ®/TèºÍëßü–j­ dÍ( †„w£µµ/1£DzßOZüjå$뱫»+Atëáá)GMõØûbÒpÁÎTwV|i÷zÚn†õk›âÓMôô,m,íl-mmäAÿ=u×uBuÄÏ7aM:Ò³7UûÞß6„´\™ä’äzRù¤Þß›ô?•µÂºÓi©Ã2Ø~;8¾Jáw(ñÆϵ “vݽÜDÓ#]¨<õå÷Æò,qÇŽÅS ¸Ö½>²•­¹Ñ¢MííY£Ö•öª˜ì›©Í ÙO—°7mÃd‰³{ê/7÷µ< ®ø¯|Vù>.+$æˆp°Ö¹¥Âaî–ÕöbÈׂ/‡t ýªãŸWÿo¿Ú¢¢Òµ›>ø1]µ¡+7ÐÍ Aüx»þhóãeuݦ¡:›Ê=jh«[7ÅÉÂ!ô…RŠ§¦dŸÅ(½•Òº c›»ï´Í½ ñ¼1fçûËP"™m˜mè¶}[ö4ß$£RݦëNì¶ÿ ¤mÓpq7ÿ?=Ëe­~fÝf_Œ£¶ùŠ¥-Re›tÔ­¥¶éÚÈ3ô+ëïͯs˜ºÍ‹Jû Jñiºìx?u›7zÀû³ s¤ž\ÿ¤]Ôý»@ëf:—5nQR»d0ª†‘&ÓÝD¨×1kº¾ø'ÑC»TTjl_ù뤫7C¾xüÛß“Ž&Š¹9ºˆBø`APì¯=bÚþRÅ©O=:gÎÖI« ×VN`›Ùœy"¢&ÊËð£ð>©ë~šm(ÒP|r,wäŒï«{RջʹLv\Âäm~²mÞ–·¡„÷W,MáyïyOã¤|¦Û–aLÞFp÷êÞÑ&‡Ó_öÌ«:’þœ³å’·ÉÞ³œ§­ŸYÞ³C9+mÆèÉó6vEr 8i·[»ßø:g-KÓíV³¸)ç ³¡šGè‚îu6Ÿv¥>ï`A?y›m£|:_²®¹¹°©§vÚpޞ˚µö€ ÷¡yŠ®¯HÄbªKÐÚáîÚ¦ò;ò…JÕ¿ü‘ª­n9xªsˆŠðË/…_|Ý°qý¥‰ˆy›ATe=㮡ç¾ûJIuÍ«§÷nDŽ7`;¯®¡g)Q]ö¤ ‰#ý ÎÞk~ùºé^^–ãØ$Þ‚šW² ø;ê6uÙë&O >TÑþfëíi–¯™¶…ç‚ËŪª*óNl1Ñãq¸Š>©¶Ü6Ú^¡Y…jjkçŸe>Ú6,­SÚ'ål¬Ëál=˜ý¬ªªâÞµµã8:f¾·*i5 On¦mãy£NØ%’¼£nÓTºbApäš”:1‘êÖúéê:Eœ/,«zYýôa^r¸»Ë|w®t4AÇËíkf‡F¬«$Í*Jj‰€t¶Ô6³ôi±¼¢›NgŽHè¯^ ¨ùÏ?Š¾øB¨2´ÑÔLÜÞ!¡›A“ø§«ï­[§š©jéYXš™ê°mý³Ÿ·ÉfWçîv1PåYY±5†;†l!«š×ž1Ò°©¸Ç6×güQݧ´VÖS,Ø᧪Áf[šM`ÆÛ´Ü_ïÏÓÐѳ´43åj¨šN:õHÚ %jߢ;ÊsÏî¼Ø£­6fùw²Vû­Í“Ôµµ yŽûžu’†[Nfª†6}‹ŒìTkº¸sç_ “TÝÒµ]ã†ùß9yvÇ{?­‘öË4—_ótßöût=ï´Ñ6[Õç<(mQ¼±åªm†ë–lóü€ëŸÿ¢¹µ¸©ïkswºé cq ,-Œ´ô,ãÏ÷R×?RZ+[¦õÙåéöÚô\++S#Ý‘EÅÒñ6´mØê¡iiÎFZfæ&¦Zªê©×_H·/¹÷ýR]-Cc»”¼jÒõ"Ô[•5ýJφïE3šµã Ó'E^]±6câ4ó¹´#®©ì¬¿‰š¦>ÇÂÒÔÌPOc—zõ™¼¶>pÕ40ó+é¿€""·' Âƺf==É•]Qc•D é"]G˜«2ÅC¿hþú+ÁÕlés_D(Ƀ+'WWvëÄ‘Cç®u(4$¯u‹r²N9z"¿¢¥»6Nõn_¼Ñâ6Èš®Ÿ:xâBN‹bNõ½ìãG]¸uOÒßJd›{c ½íû×N:v¡ºCLÞÒ’ê~kWýÓ“çîÊnië³?´Vîæ=ØwúÑÕ²îèÝ°pµÙik“î6÷¿EªåÎ¥ãGŽ­h(\±^Á½[ç>š}·ªÛí´mìY£6•Ñ‚~žuêÈñó7(åý””ß:sèÈ銦Î76F½¥]§H¹=νtôðÁs×òÛ(¥)mY-wò-$¶¡¿lfœ°€H:;|'¶ ýºyî|"tŠ(Ú7Âæ†&uÕ†"þJ¥ÎÖ‰ù6%b”âATÁé;0_)‡IÞ·Ýß{¡~ÞóWB ¸ÎªiîÃÏØî]رjáå~¯·êstÞ:S¾GRÛŒÞx¿Ÿ#FõóßaÏí8¤©¡3žNQ¯ËùÈtk3ƒˆ;)‰ðÆúiÓDe¥tË[ú|J(©]Ñô[ÑÐ/_«¨‰ )ðAõéY³bO ?ÞÒêr~´×õ†mþ¾´=]0#èP¹°ÿÜgiJ"ªƒÝ'Kš…⦃J,dÆàtIEùíÿçwâ¡¿í¤móèÎRðVçûXÅ´ýyIfBìÕÚOšš{Ÿšé/Dz ®Dú±XÔ.PÒ‡F %tíFÜ%`:I«íiÕÔ«¨tå\AÕ€ˆ¢ÿé‘4oÃ$iÝP"¢ÌM%„Dzo JÔ.a®¢Ô©¨T}ñ5©†¬ àçúF–—æÛeWÆtÿ#O˜ ÔÎh]¹HL‰`ÀÏRòrÝÈGH+%Ϙ16m]"a—•DÀßÕHÔ^€Aˆü‚Í7.—(¦Kpà£ùF"aN1÷ô1OéežÖ &Bf–˜àâpÀ‡{F^•‘‘ô&ÆXL5RMÅëîÎ:_³ŸP¨Ú>špº˜ûÜ0ͦ.Òv»á\ì㙑åös^x¬4EÖÔ€bJ@·¤H^ËÕMçF–[TîùÔoÁKµ%3)Øð“LÒ#‹î›…*ObþanV,¼ÑpbA©ÇÒç~‘å^ó+½ç=õ[Qæq¹ê8s{cäm?Á7" m‹N%鮢Èúžè×"&3,ªízYµ:²Ìwq¹Çü'c#^¸,)ñØûj㣎"1!ŠŒðAç¡ôwMÄ<)›±P ”¼uqa©­%ï÷lª«µ©±¹E,·664·w¾ßyKQmÍÍ’YöÚ›…bêÝÛ–Ag[sS#Msk»H2(s”¼—IÔS«¡˜ ÌĤ™jÝZ²à™ûârŸOÜ£ª|’ͯ<t/Š–Ô¯¥9ÝË P—î^¡ò#$™“îÚ÷±;skIëÓ-k6´¾uE7wró½6Þµsw´…ÛÃÆG~Ãþj»8©ë½Ä!i‰›e§mµ¶ùcCù#ŠsÂþ¤æý¤õ§¸æÕíÓ=ÍÕ¾ýó·Ã¿Ñ5qX¼õûz\÷ göU,j!Íõ’J"Q܈˜yÀý‡°¦½2éù°gŽK*|ª¢ŸÍί»Æ<œy•wEÿ•ñ<ܘ±ý¤èƒ¾öŽ]áã¬"ªû–fÁ‹è¨µÍBòøú®Øäí±½óc›;ïµiñÝiS½}J›~Ü´ hEŠàýlÓšîn販ùƒŽáé,ý'òe/Dù‹Fsnê"¢–K›ÇihóÖ(Œ?õq÷槕/)ô#¡¿eÕBuƾ˜³à¹ó¢§Þ _¸Å–Ìo¥êĤ]B:¥µ‚gu}æ•‘jTÿ¿º~—ÝsjçquÂϾzJ6\bàµHÌöÌó1³ oèSI·•Ì°6Z}©æñ¥Mn®ëÞZ=’Ù&§Ï§|¯úoÞ‹›òWÎy* Õù;VÇõÚÛw>U¼MÙ6TÿÇ÷-%B6½"PS{ãé»Ê¶¹UÑÞÏÇ轞§éAZÆ6§v*VÔë8ŠúÝ;ú¹—GéÞÍàñhl'i“M‘P"!í}¹.¬Ücq…çÒ2¯ƒÏÒ)ÒI+FH·±D²§l šÏý{m*IZ1k¼·Û„ió~¼U¡\JΦ…úxyû„,ÛšÿJñ††Aܯ5UÝú!t²»§§Ïüõ{ª¤¹‘Îê’…mÍ XæÖVn.ÁEÒ‰’Æ»ñË‚}}<ýƒBw_®ŸùâÎÝëǥܧšK7„Oòòòœ}G®êÇ++SÏØÑÁïÈó.Òrw^°ÏÔ5ÕtÓ½­ÐgÄ¿9f>ª¸¸Fõ¿G§>W|”ÔHÂR'#Gž=ù.¯WÝ&WBçÑ£‰&›¬?¡øà Õ\Œ'#;zÿ3Y–xG¨·™ÍÜêŸò)DôÙ×H·Þ¥×þÒ…NH´TˆC¨Ü6tÝfö¥_ü‡ŒRæìd~/—{•ÿ%=•1‰™I¶ì#¢Ÿ|Û²œµuöŸË/H&’¶ Æë)lÓ´ÖbĔيO¯·)iŠƒ…Û¬RÛ¨Ú‡=oÉ›uD|5iÃ=ð‚ßMíuÇòºm3FÓúhI !òŒ×1–šã¼e¿ÎÍ0`òL õm|" ªÚÈ laì¾-¢Âywy²ˆH6<˜^îYáºîñÌ6ªQ:vêi.‚Á€èáV=5›sO”†)ÈÊåëÕþöVÎKê”~Ç_?8j«¦½ý±„4\°3Õµ­¤§ÌõkBîžÛjÆÒ6·¶´µ±…­)kÔp×Ä „ꈟošt¨go~žmd;Ýö˜¤o#óçGòÍ¿2>qQ؆þû²¸;UÃ`¤BLc)Œ&ÿ<¡']ü3úîËtYÛŽ=êî²&âæ¸0g¹mÄ9ÞªFæ&JßÜHG]ßjl©˜±IÈúVaÏv.l1âên¹ÚÖ×6£Ùž·”ú¤D÷cªO¸±<{‰§®ŽûªúA§ )œ/wæ?Œ¼Ðp0¢Ò#²Â7ê™ÿkª‚žÅäièö•%x0!,‰ÖÖ°?ß×6’Ú•þ¶ÖrÛP Ûœ°W׈{¨°MüÝwÚ¦øôFÎëÓ5­ÍMM²`hí2-)Æ6‡?Ô6ÒÌù÷&*¿!N“I\yò‚pTˆ½’m®Q½ ¤… 1_ÇØfÒ0òoo&ß‹‡ñ:ú¼mÇŸô¼SÜ’0o¬Ü6›Î#µ×½­ôñ™#ÐÜÒ*kI™ÌYߢ”vnÌÚFÛfó¥Ö~l#ë§Þfzÿ…ÂNP¬l–G—bØ#MÖ ¶”¢„<äÓ¶Ys?xùCŸÅ>‹ŸL,j½At½†nÎ ·²ƒ‡ºcÖ#u·ß©Rü R-nn]¿öjuëŽYÆ6ãŠZ{~++.Ç°FZ_h’¶¤~Šm(òìÆ.+-ím¥éî U_=ŸUþºõ½ló–h¦ù³ØQÍ®ži½m™¯ôÞgL&'l7½+$ÜŠ¨Œ"¥™ a$&ƒôéGpšÎ:èèEðÏQŠ¾{ª£f‰?GÑ’zn0Ò?-›twóQ%·¯fç<’ÙFÓ%¼ªC¬èõ—ä¥/â±õ÷S¤üêFö“cõoæϽ˜Š%¤Rt/â‰ë‚çKŸŽ_ùÐwWýf¦,k,KÙH ›Á•$&­›|U9>›Olž¤3ÆöJ'i8¹PM× úPwséÅ*g-Iq²,ñ»lžÀ$B©Úüñv,GÿõÝ?­9[Ç«³­N•6¾Ë6홌mYâ®ú«gž¾”ÓÖOåYHæ8•ÿ"Ýe±æ8ùZ…¸Îc>!m›ß¨?è‘׊¹+͉Ê?“#÷™p4ŠqÑ’ òY-ÉW*Äq±l”X¯C%h¸~îØ© ·ZÞÜÁž‰ZšÖÓŠ:¿¶Ñ’5¦;K|v½&Û碢°·>8îb0Ü+æŽÌ6Úúa=D§ <õt­–×¹m6ž,z·mh/W^;xà؃FÚ­¢³‹ÜôLNüã‘‚ª–AÐÆ—Hª…O"ž¸/|>6²ÜgåÃ@1é"=iʇlA7ƒ©¾J×X®¦»kðì337/ôek¨OL–äm†ÚìiËcw¦o™d®Ç2uþþv%3çõyí™Û”m3wÇÿ¾Ü6U M´lÂc Ùƒ]a†\]kïéü;6„ûq8¬)‘ß1ņé7Ò¨œ·ùÁÍZ»Of›Î½~\cë¸ïÏ>n‘ú;î¶:æN3žö›¿=ÅXBw<9x„¬%øWò_’ÿÇ&G HÞ~2tùö_ÈŽ" —[5F/3yàFbú'¢2”¸Í$«ÿ÷[òÛ#—û»@ ¡ÀÇA×Ì>ðQŸðŽ'| 5´õì–oMŒ[îÏÖå¹Yšðœ7ÈlÓöâÖT¶>Ëdy\Zf WÞ(ëy¥Ê¢m£gldÆVõšº=zœé(]=Kþ]Ù¾ÇÁúcÆ΋>söZ3c›…#õ=n•+Ùf­¹ú¸ý²¿«ø û«V\‰´/«éÂ8C}-#»%âÓ’7N±ÑÑ1°Ù~©LÞ'5mØ7KÏ>øì)ú z),xⶢÜ7²Ü»\rŸê¢ÄrÝ0]!wNÆ­‰˜0iVøÒ'ouuWµEµçHX:5 0héºøóùÏä7{í¨ ¯pYX1>ùÅ‚.±ô^6¨Ëü#´§(%ä¥M~ýÀ3z_$Ù½Œré£z½‹¼¹úîùÊoé=¿g/¨¾—JPýUЈ<Ç+‘ž é%î¹Ý (ÿËd”ßÛï6îÏu ~*î7£Cõ³¯¥´µ^ó)…m,æmj‘~ŽÖ[?|¯q‡olp oMqÌ‹N%'^yôùŸ–bJT#,ŸÿÈkñK§û]w‰XÒÙ€_ †³éó#âo~ÄN×nÛ|ºúÂËk1Ë—äWµ~þåVD‰Ûº×”'?\ÁȇnY‰!ðë@ÜUSóªCü1WyØg8;xmë'´¤ãõË×Í’Áp§) EIÄâQy³¸…Pb¦ûIŒ³€Ÿ•/Sj8âxôß8&ŠaPÝÓp¨àïÉÿžBº endstream endobj 873 0 obj << /Length 636 /Filter /FlateDecode >> stream xÚTMOÜ0½çWø˜HìàoÇôVµ 襅í‰r‰³‘Ý@’ðï;Ž²,µU¤x<gÞÌšX°šk²¬‰0”TÄȤdY‘ëôj×7e1Ù‚›<ý9¸>Hg»¦rÙ‚Ñô((.]ëŠÁ…,»Y^$_—ÉCÂðEJ1K0Ôr“\ßPR¡þ‚P6'“Õ†HãÚ’«äGBc´ ϨÉBP Fyg’YàŠygÇç©É—ï„Ìì^fÞ”2,I-×>NEÓ» pSéó£»¾ÂIWg\¥õàÆ°/¶U*w?®ƒXÛ ÜFwe·¹m¶®:¸Rônv:ºxe7Ìfc·rãqU*¦¸`¬ˆ%8õñu}°ž‚}*6÷­;™¦&ýŠáòì5ä:ÍÖV碎ƨ?È¿r‘3N„¦`yþ‘´@-.ñ† í­fï ”±ýg¼^Öä³ãÞ‘ú]Ïs£®S3hNrl-c3­€ÛØ e·ÅªŒŸ²…¦4ýŹ¨\‹Œš®ö]p"âvª¿ßyðß‹ãÃr()€åù€ù¶¤èÂpû/5}Êá„ÉAY@9¯cs®›8Ó|Ãa÷6±Ÿ‹° Íj[Œ»ÞÅãqïv·kã­ríÊ»ù…8÷ÅsÛÑ î»ÍÁ9†ÒÇÓÛçqV6m{`74Oó€z;x¡!ÁÒÅ„ Òçl-Hmfþ0?^8g·ÎþkÚzK®ž‚qŽ&|%(À~â<ýž §éœ>òç7?å3/qÏKþÜäéA*½Ãñ±àJDQc¦¿NÖXu endstream endobj 864 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 401 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 15229 /Filter /FlateDecode >> stream xÚíÝ@Y‚7ptœÝ»Ûûîöö»ïnw'É©›nrÉ ’ ˜*fT ˜#¹ FÄœsDTD  ˜‰’;Öûª:ÃŒãàòÿí[§«©ÔEן÷^%B>%Š¢è«ªª«ªQPú^©ªnÛ à3ˆŒŽÕ³ñ°ñ™‰‚Ò× ÇÖsûömÏfeèÚÅûòw”¾V–, ^²!ð9ÓfþÎt^6AAékeñÞ,¤ Òiƒ´AAAÚÒiƒ´AAéi3gÎìúúúê*++qXiƒ‚ò‰ÓfO–™™éÆ×u°råÊ””$Òå–E{²Œ éxYÞAppprr2’iƒ‚ò[¤MHH¤ Òiƒ‚‚´¤ Òiƒ‚‚´AÚ   m H¤ ÒiH¤ Òiƒ´AáeQ1Y„—Cb;úG1Y”lÙ ùûÌøòÁŽã0¯³åóáeSí/º.Q>9¯Ã‚Þ­ãÛÑݪòÞZ ¤ Ҧז¸ü7~Îö®^Šâé4nÉ¢Sü¸<ÂìÝô8¹dÓæY6N#\—Ò¯é²-v™Õp—ɇDŠ¸`¢€—% ˜>ÓÖwÁ¶t²põ GŸàmä­!±dÓþÓ>&Ûôtôå‘sG‘$Æ ßií4Ê6à2=~ûªæ¼ôqui[U»‘ÞžóvlΔ†~•H¤M¯/ñ5n†ƒMÜ}yûÓe³³•®¦JÀîŠX¦ÆBÅe׸›±õô4-ÇoÍ&F~‹§ÛÐ2`kº¼^Aïì.›ê µ,~4ÉÐ|ì–Œ.µ“özÊ-Mm{Ÿ/ÿEîãÆ›°ØÏ\yE›Ý–tp‰§w§—¨§er‹´Q\N¹ƒÞ`sïy²Uõš:{¸5GGÛzÁñšØì®y…‚´AÚô´qåþ`·ñY|žb§ÎzífÊæzn‹Ë§k$âÄ®Žï86×léÙYÃgÛÎH–.{ ïa¼´±‡?ÑNUÇje„´*òvÚÈj5³ý-8ºóO6É3Šþ7ãå(CSïi̲¤Õ$s»ÆÑRÕÆ{£±¾†ßöÇmM-&mt¾×—+¯PÅæÔOrÖÒ6 ÚVÐmà iƒ´éÕiÃË'kæÛjêl/`:F–mœËÕµ\{펙¦úˆy L ‹Š+ óluØ£V¤2“¬‹ØÄbsæ©Ž“îòÝÕmHÌñ8¶ªîĽÕñmm4º•M"OžÔ×ÕÏ»—#ïü ?ÉQÑž{¡ÞÉÂÐjJ$ó~Vwi#«ÝH·ÐþÉ+æ ~•H¤Í—”6ÒÝ?6Ÿ,o¤e:®¨Äˆýìë9ÿÌõÑÔ2]qG^W‰¾Y6ÜTÃ~êþ˜ìFw{5sÏØ(E,t—6’…Ó}õlýÂÒ%¼Îºq…¢©vêúãÄH«+$ÈGWÛa[ì=²2ÐA“3vS6é¾n#«e¶º¹èØN:ß&Òió%¤ýö7{’÷È®"²:*ܘ«k7ç½SÇ]Ø­§¢íª…~½%i W]Ùÿ¸¢[8›Z¿~¦Ûz¢ÿHmŽ÷ÚÛíóì&m²„~^.f‹¢2»öèÒá¶r‘–ÙÊH&Ǩ¸Æ,ïm9ñ¹$öêåÁîñ q9=¤ Ó]#òñ¶°µ1 ¿M¤ Ò¦÷÷ ãhü >ä[¡ßªýN[SËÖ+hÝ i…ÄËfjTI¸CbÓŸÛ˜ª;Ï<Åô÷J«7ñ…â‰îúzl-ßqúi»KÁ8O'sÏà·Ó†n¸…®pÒ2Z$«5­Ý¾‰£or™¢—¸ã>ã¤b`¿92—™ª§´ñö6·vß„´AÚ m¾€´áþ0|}Yl–(*](-"y/îíj;C.—m`È54äpô¹,C瀈LŠéÑ•Ž³&.ZŸ­œÜ©“¶»–”8p’×qbx:Åë|ð(ö™ç­©;2.®9¼>eÚp.—e`À,‘.ôõ éð÷Ü’jquÒ>å,ZRH¤Í—×K¬è€ ;wÉ„5Äu᡹aÇeeÖ\_mm³ùW„±ŠÑÖÄÇÐi³ôz§i»í%‹[®¥etQ—Cu<Ù/>%ËŒ¥í¾)“n:ÅeÛ±~²òß._âœel=öÞ½¸žz‰¯'›jþ4zg3~•H¤Íš6±ù$$ØNGÛk}{³…$dæ[«4ŸŸŸÿ¾´±»5Sz®¯¢Ä¶ŽµSÓ5 ZŸJÉΦÿÉhõŸêÁ5¶YuEDn ›¬©n½,(ÒŒŠÏyᢧ©ï·;¾@‘6ñM̪JÏUŽN}:ÆVe½4üŽ€#m6_hÚP ¹eŽºÊ–‹Sòå&éy}d–¿ ‡ã¹^ÑýÒCÚLáêÙí0ÊW^ÜÇŸ~u)dž­ªonç>7ìäô¥«í,´µMg®‘^’Ðàccd4zsÆrÛq«|²fÕHmuËà4ŸSîÈjìàíèNÏÐ×ÁÍÓÜDWW×~é¹&ÎîCÚ mzÿ• yþS§NØUÝ¡ë•)Ñg.»N\´ì\sšn[Ã'›lØÃøÝ]nÉ„I¦8š)ÙÒ¥ïÀ³Þ=[¤ Òiƒ´AAAÚÒiƒ´AAAÚÒiƒ´AAAÚ mPP6€´AAAÚ mPP6€´AAAÚ mPP6H¤ mPP6H¤ mPP6H¤ ÒiH¤ Òæó–tow>/!‹·3——Æ祶òvä0ƒ{ ˜û‡_ªæ%dóâ³xÇËxy„wà|0¥‘¤G£é ³(^r½|0é3xî%3ýΉrf)G3?¢/UÑ?Ý{þùÑ=YŸ­Ä§¶ðpÿO¤ Òæw/—«yª#xƒ†ó†ØóŽ•2á@¿dËSqæÝ'¼e‡xmx?[óœæóJOo ó£,x‘7yÅ„÷fäŸm˜}yËÞOVÌ þX^–„7'7ЖyüFf)#1?úÉš·dt!iüßVÕ©¬õJõ 7ß ¿‡¬@Ú m~ï’CxWjx»òxGKy™^†˜©ÀЃtå„þ]ÕÙ[ÈÛ{‡w£I>&]ç¡k/ôhô Mt½èèc&m2D¼ƒ™AzBzðV 3&=Ÿë òL£DO“3È®ð'­¥$¢ès”˜RûÃÐðûÈ ¤ Òæ÷.‡Kxÿ£ÏÔF>ÏâbnÇ qÈûA;âîgú€ñ·šk¿‚´AÚ m~ÿräï;s¦×åó,nw~ÌP‡{?!m6Ð'ÓæïÆL‹éó,.D?"o¾Œ´AÚ@ŸK›L ïfóÇM"=¾W@˜_~챞ë Ñ.¼úQ¥Û´¡çÃ<Þ·Óƒð>nÅr˜ÉãrÛB÷iC›GâóÞýô:æóÆæ“øü®£ÅÈ/ÿH@ÚtSnIyç|ÜT1™Õ¶ÿ=î88¹8^zÌ@Û‚{nI]JÔb·.ç}–2+ÐKgèOn›³ãs?²n“K¦MÕc{_§Ãä£Å’@ןÔ’âîv<,~Ì`ö"^!ê6€´é¹—˜nI¥µ~dÚÔ8r~žpâãÓFÚKœÿŽ^âËõ4ÝÖÿ¢Ï—ýÈVs褓$!ï£ë6t\Ì47ô»ùÞ´™ã­®ëz8®°kÐE¿8eý æ4$¤ m>´—˜i$Ü%;ï1%¡€¼}jœ9<—D—´÷Ë·2:ÆÚHMsè·FN3ƒ÷Är´GuIzÿÍj\´n­©Þ¡?÷›“ø„©EtX«ÈséÆúÚ\Ž‡­ã¶)£SKê• —³F:hù–c9vÙÁcÜ¡œÕÉ­oÕm, Ç\˜»d&Wk†òPû©QÛ2>¸nC·¤ü†r– %H›wõ§ò;µG®6TSv[›žÚv¹ÈÑ\ßfJÄÛugU®¡ñ„È;Q·C6Ìçj ±öI—þŸøÍ4T—\ KlL:h¢¯êåw0ÆyÁ“Ÿ4äu›¶3XO]Ùuå­°Ô–U[ô 8,Ž÷ú®$ñ\_Ž™Ã’Ó•Qi ‹WР2qOs—ÚEtÚ]+ ­YçÑ™’ŽÇ¤š Ô7`;,8v[°ùà! cŽ¡cèu~×´ ´ãêë{¬¸u»5ìäiKí¶!âò>8mvM×0_´¤MåZoÉþŽ)uêä¸eG£óIlÓúål໼›´1d5þé!!±yÄš‡‘µ_§Ê@Ž8h¢³¡Ûâ˜\¦›CŒ±3Ø>_ÑK—Sçi¦k°7á3N\Y`«Åê’6$úf…µê¤$1݆Š¿Ã4¸ÆûØYùl‰î|Ü*.«ØZCköÕN½ItÚTÿåÏ:#fE*Z/˜¢«ß]Ú̲1°˜¾-GZ+Ë'ÓŒè†U—n¤ ÒióëúmÌx)MíÍzïNç‡_¯Z˜<#d‰¡žéØnúm¸ßû$ŠäûuÙ¼m%ÛØ~ýuQ‡ZSÃ(—Àã²îæß\—Ù±—8öF¡‘îĈò&X‰>µ]W˽KÚ„_8g¤£a7zÆȱÓdÅÖÌÈÄmfd懤MÓ‹?÷7ñ?Ýþ‘ôXvݤ Ó’º&—\2}¦©á„T¤ Òió)ÓæûN½Ä±—/Ø[èèY X°åtàøᆣ—w×Küøc¤-m¶Çnd _—Ü!mÒë\ì¸#ç_Q¤ ÓÍw£)&âÆË”åis=ÏÐ@gjLyûTõ´ºöo?sˆ«f:+±`ù¾ Y IÊ^yôaÌÕmŸÿ«’鬫m·ñgã´u‡w—6æ핤 ÒióÉË™ç<û9m½»±9¢é憣–òî2eâòɪZRN?:¯zÄË‘W‡–/͵tÝ’FÚÈdµøŽ°²›£¨2mŽßëz42—Ô}?DÞ’J/³5`{®NŽË‘ÇÑöè©š:žë;wG\½m¢¥>ëœ"µ²¨5RC•u9úÓSÝæÕÿùÆÀwsT–|5¶F.ÓÖsè!mn"m6H›ß°ä¶܉ÍáOp±²œ´-.—i×ÄfT¹Ø™Œ ‰ÍétHÚK¬bhå¾9ÄÒ5–¬gNæÃ,&œŽÎét ʆõS´ØN!7I<3N“«£‘›q@ Û÷ÁZòºM žf¦­ï»:“9>wû©½‰žǧS݆N‰ôzg+ŸML[,—Dß,´Ö8jý¦MsýßþKÅÈaÙUa|§^n–zÝö#m6H›ß´\xÍó mO’¶7ÊPKÙnì\Ÿi³¬-mÇMvÑa{-¸Ûù\bmeÏÀ=C+gïqÆ:?»,^ŸÑù8½ûçµL¡©Áu=u¸µÇrôÒÐԎ׀3‡¶3*¼œõµ4õ}&˜±GÌÝ ¯nßù\bfžÛ±6R1°ñ9ÆÏXûG›Iñáy'M›fƒκòVÚ T›2w¼–ÇÑwª­ÛgöÇq]Š€—Õå\bvû¹Ä¹Äš®žï·Ó¦Çs‰‘6€´ù˜³ûd'§Eßx:wã®™a)átõ&_²,lÏœ]cr;]'_ÀT3¶ŸJŸ¹vׂ½%1yÝœØ&»øhûÉ´YkwÎËŽ¡3$.3FÙéNû• Ì•Gt{míÞ³ÓC÷,;Y›ÓÍuR1ÒÁØlþò˜#ë’BN×Åæ¾µ8Ù5Vwº^½ÅœoóÝàmEdÛ±3Öì 9Ï9°IÇØmó-q7×I).€ê2øÞë¤6H¤Í]¹ðæfY/ºŒ•¶Y¤û—ôuNwgKÏÍëé§ÝŒ#½,+úpIåÃ:^¹Ð6Žô@|OEÊZÅ涯ä^þæÿýEÛi]õÚ}Ÿ9¥yâ;Ó‘+"3É':é—‰ ø"²u«·†y(Ò6=–KU<¿¼Üϵ¸Û‚è3Ï«¿ö9ï8Ñ0HÕ{¼»ž†ª©‘îP›Ñ‹.}âÛhÌšn£­ÅrZr&×IÒæw ½C>ßMÂwäĨxÈQ‰(ü|iÃ\'uDܬKyv£12CÒvfѧ*‘·êé9GgR<\'H›w\'5Ì‘—ùÙîš3ľdÊwáyŸ7mp7-¤ Ò¦Ý)4fW~œ†óóùÿž‹´AÚ@K›Cżÿæ0}°ôþH—|i«ªˆÈeý±²×EÒ×ùŠÉÚ_…ŠAY]¥mBY˜Ü“¾¾'3—yUDrÏ-"ñ_o.&tëæ3”è<+W¯9íEÎþײ•°5¾8¡¡¡Ë—/GÚü¾.\¸°bÅŠxŸ¥ËWœŠp'çþ²hi(¶Æ?¤ Ò¦w§Í"m6€´AÚÒiƒ´¤ œ?žÞìËà}‚—†œŒE§ÍÂàÕØÿ–,YríÚ5„ÀgSWWwàÀƒð>É::‹œý}O~ÂÙ;v Ûö÷’˜˜( н:EúWl†²ÓBº=3à÷N› äÔ¿`3ÀçH›ß`3ÀgI›?`3Ò6H@Ú@U•BN|Í¿¹ºlÒbÞ—t|Ÿ©Ñ] ãèú>Cí §,žßŠõ±ãüýÀƒ†»Ž=yŸO¿¹wž‰ËØÂÔwJðËÍL¸+k—S¯™)6û»²U2è{]ÃÉëÏÊJÔ«ðÙcô5ü³:Û$`ýzîOvÎ33§§eYÙx¤4à«Ї[R•—͆¨ŒÛpJVŸ 2ÜÐÊóU ’Mv¬ Ä[²±ž\‹áêy¼’ÆJþws¯»Òèx–²ÝPyÈžGÌëã«Ær†{æVI˜¹fî²Óùy\ìfÚÑݱu¿¨Ð× ªþIÒ†¢R¶ÎàÚ{U2ÕiTž7RÓ;þ Šé·¡[R;¯ÊF¼!œnI•‰é—â£3œ¸^³å©!½~ñ¼¾•ª™¨?dsQû¼/mŸaj7­VBî_ çèŽ~¯ À/ÙIÉ?MK*:ÈÝÑ+”¯øXthê©,¾ü¸ç´!ü»ûGšh¨ØÍ_¹éÈ©‹kÌ»Í7m4T-ílìmdÅR_W×Øúi+Òàב¥ %éÕåÒ&j®›,m-œÚ }å{LÅ#%…w¯Yê?ŠÃÑeièx !׌~â&·t³¤ À¯rükròO½º¤Ú|HåæòÚ©¾µy1©½b¨Ê>TTÙcÝFÂ?ŸÄ;‘¬h2ñ_Lw1¿p/‘<Ãú)øz+Qt>_?¼eÕÆ㤠À¯Ôø¹;qÕÞ[Zž}Ð)=¬¯©µìpFcSSC]el ×ÎçE“¤ç–” ÂÏÎÈ# ¢²¶©¹©ºâŽ‡µÖìí)t¾Ä40ñ(xZC¿_Yš<’5pÖá—Ì´—é´ñxÌ'bô||Ç?ÇzÊ~\v+–£©jdjlnÌR3rK.—5‡šBŒ†Nã]”Ytz“šŠ}©´ß†ªËo6ŒÅÕ·´01`©Ûψ¨•5ÚøÏ7úh±ô,-Œ9šƒ§l9%»ÊáuÎA]mu®Ýåz|uúrpJ#GP•Ÿ™š™_$êpÁÕ!µÚ~"))ÌNM»ýði­âmùX¯ÝIKK\)è8£ÊâÜÔŒü ¶7|Qä7âRÜKö¨M¢xâ&¶üú˜¡H+E‰‰ˆâS­T[îP”€!% „¸“|ª¸‘HÄtÞPÌ¿íµ!%Pb‰D$éPõøM(JD"1ÕDg ¶åŠ„j‘HD1€OQ· %:t=F¤ˆ B×tèèRDŒ´€OT¹ üÌt iaòEÑo#QQ Ð5Rð)†ˆr3ËúÿKmÄfJ"ï&fÞL¹Vãê&©­¡DÈø4§´|ݯј# …t]Fš95CU¿úºzï.”€O¥nÂ䥫ì¯D^V )¡¤•ðÞmPRjЯvs¨´ÛÕø-)á±SÍJJB¥~µîãL—䙉iË7ô;Jov$R½ÄÐû¾·Ô[otwj‡÷¨™éÛ³ýuëÖiŽŸîôïU»ÖÇcNù/›XX—éç<¥¸ëÛâôÝkÝVR-EÓ¬Lzœ7U¾2Ætö§ ÿÈòInÑÙUE§Z'¡º{§› ÕÃW]QiœÉÒŒ¾]Þsˆ¢Þ±·Œ[=èÜ„`›Ö冬Œ$Të–üžêE²´ lu³ZÝ.õYöá5WJˆ°4À)àù»¾ú=~Ž§©;¸,·çò·«'jªí{&é¡¡Fõ4/é^ú(kz-ê2B]j‚¶¾AÆs‘l¼Š‹‘lNZ…€ü&­¶OÜ”jnÒkVù¿ß‹úõ«ïÿµàk%þ×ý*Í…âV‰ˆj;åúZØ0Û·çµ36䌚RÔоÜ:°ÖÉ‚c`h6oÛa¡ì]aýdWöš‹•·w/³5a™Z8îL•5o‹ìÕô9ººžÓ60_5I]ÒÚé–&s+çðÓEò¥=áéXúÖµ¼ÞèjhÀu=/¯–y»êj,G_OŸÃâêÄÕ’×—9\Î’#tÝ&ëÐþ’"n.¾žW.[]á‹ûW}§Æ«:Åiy_Úœ,RÔmxfs樂0÷ˆSu9t°µC@R5Å×|'Å©8îuYõô=EËõGE¤ìnjAµPZÙ©ôaè´­óþ+j(Ù8ÛÛÔHÏÊÑç@ækyu$1@‹ÅârXl-/Æر¥Ÿ]oâ–ÃÒ†Äó˜ÅãL¸&VvögˆÛ2JR›´&@¶M"Î0ÛDÔüb´¥¶tZöŒÍGèÏ9c´±ë„å| )8Ê6´yÔ,ÿMyûYýä‡LÝIœ½HU…³»¢×H¦+7¢z£nÝÖ2 Ÿ¨ÿ€æà+) Ï] Äb ½Ð’ê«žœ±Ð2yUÌÉGÖø;hp _Óß”¦3Ôc÷:~d÷D{M3ïe¯èo·°~‚+×nԘɫ¢.\º¸sÓ Ý!êqyôžM•^ðai-Ž?\ô°‚þ[¿ÄEÛdôÂÇLØ`¦6Ôoã1fa¥Ñšo óu»]:wtÆcÇ©u‰°îÕÍKÑ*ÆIéÏ›„¤&k’Ÿ_̵{]*Ìšò’'M+:tá.oç®ÁVÇC.ÈÒ&JÅ9âç1·bÏí:pPkx¬õÊæVie£6{ß@³Óî:Ÿ6+0ü·’ÂúN³¥¿ÿ‚ºyƒÃQ]zœ›ó| ‡ZM9râøîm 5TUBç0áôªähÌR.ÛúXjÞ‹fÁ³îZê+Ž_XQIñ«g9êXúÌ;xìøáø•*j+/Ü—Õ;ÓÛd½MÄo0Sê·é8ÒÅù'œÕµ6N.©¨$âÖ-Ë&ÏMHºÖ‹Nož¤Ëq-•¶·Ä¢½=ÆŸ{Õ{÷Y±HÌ'bá¡C­ßô“ô î÷Çj3K¦¦*!JŒCR}¶n³Ç[Å|ÉyÅÞõl —½êJ1ÿþY®Î¾Œ*Ù×]P~ÓL_+êÂ:m&Ž2pœ´\"ÛIE œ5§G>~﫦³4Ão0]/Ïöú(;.lÛc$ùÔ†Ù䘴QUÖ\~³Jþƒ;[‡°Ë™Ú¿úšÑ«;]ZRowœ^ßc¶F¨|1glÜØ0YÚ„ÿ42_#t%êlôßín§½¢_>ðuŒñÙ§Øsß\`<uë=í%…ÔE&*ÎËÄŠQŠ¶» 2 ”uó–ï8Ï'hªí`*"¤ùUš•ºòEëöºÑS"R¤ÛÄ[ÙqQ‡m²^¾MH™·ŠÖÑŠÆžÖh—Ÿ¾¶Ú0u¶õ¡açmBõ¶–”|}(—Pt=­ZCWÔÿkÉW_ñû#¾zµ…~OBIÄÁé6}’ ÏA]w_Á‹¶¿¢MÕ/kZ¨üÓk8ºn唬S„ÙIXq¦…Ÿ"âú‰®¬é[3)Ù‘DSÝX3º¦MË&gC›1Sc£#¢£˜j©¢²é>EÊ¢‡iÛ=¨È¿måñ*,§²†®ióŽ/sÛîÅùôéùsG Fì.¯Ûp¦46Sm{c¶µéî•t=äùÁ!ö7ßmû€ÂêªæúÖÛ:ÕÓÙsã/ɦ•Vun˜f¬yWÚˆ+\LÔm½&'ž½U׋¤e£“ÍØi¶Éj •ÍÌ–ë6mÚU>*Ìϸ<×Ûf¸«oq]oï^•H>Uæ=¦¥ŸRk¿~Â?ökíÿÍsf+H(±eöU5õµô/×Èû7;óíýsô¸ÓkÛÇãGâz¬ÛϤÍHÝYQ÷ä㉺K›º™f¶n>óƒfÏ“–  9 æ&•JÈ“èa,ye†Qöqi#ÝkŸeÌœþ?Ö» ýŽx,ÿ¤Ëü Z¨ÂÇ€µöÀmÒ6WQ‰«ú°˜Òw¥ ÓÁ{÷übÿñ.6†Ê´ö}½¸ZºMô‡w»MºK›Îéë3Ítu·^¸ÛÛëÊÒõ––5þùO‚þ_‰¿êW?à+qÿ?T*)I6ôÿ$¸u_­Ûä WÕIÌ{ÖV·}‘uî꽚³¸,§¡âþŽ¤6Д3#ò }HÚ´lp6ôY»¯ã_¼Ö–1Å´¤~]ÚHŒe±¬Y fnBÈËùãbÇÊÓ&’=¹¾Q¢8¶*I71Þy§Ûß8PÐ6‹æœÅ·Ë>0‹g±§Çœk¯ø×_5ù™}þÍ{ÒFºÍ$b±HÜü*zªªa`=¡68ø®Kêf›ôP·9´Ñ×Òyus{ÃêÙX­%Ç2{÷y8VúOj DúóZIéÍ(¯ÖþJ‚~JåóæRB s;-\ÞWûmvV7ž/ÿåKŠ}u†Ì=U$~|IOO+ìR©|'+:n¤§º#åÓoÓcÚT°´¢S™Iž&ŽQæzä5É—qoçøŸt¼_“÷¥Í`ëûòšTMfZZñ«ú·Ö¶5ÙÌã༃mY™âè±cBÓæaúmœ¯Ÿz&/mô·.E÷ê˜~›q.QöaŠc®Õ§5¬Ž®¿Úu? snç?¬èRçÉ]g«b1µB1xv±ƒŠý‚ÖwöÛÔÅh[¤*>{}Fˆš²ûSB*dÛDEô6Ñõ‘â*óRÖ:ù‚/ÝUÅòÓsï>–P$/i%ÛÐ*¯Z>~cáA.[÷@ó%oJRoÞ~ÑÚëÒF"ë–inªRR+ héׯqˆ7'NÓQC×sÞü4„â·2½Ä\–Ù'³†þ?Mv1V³5cÇ.Þ8{#c‡Q¥uô.$>9ÏNS=kmÄŽ°ÅšÃ,ÆF2;Š°~¼‹öŒˆ¢¶´™–ŽÑú˜Û–Ndéé…&¦3£”F Ñqì6qÃtdi#¨¹a¥®ºxçÙµ|òò¼ššZÐþ´nj‘ó¾w»wùÉÙóç=÷è¹Dsg<º]Q±"zب„ÁfGgƤ‡¬Žh™ä)”H7?8¬iÙ›sàŒ½Oӳ쉰ëY8­¯FØhœ±AÒ嘔äùt{-6Ç),aÇ ÿ‘l}ƒ˜Ke=@%É<=—¶´ñSWI(a"FÔôl¼ÛÀÔa{ÜŽ˜õzjšÞÛ“eµªöm,Ý&û2¤ï?¯=dÜÆ=Y÷žÐOrÓî³O‡~f\u#ǵáÑ‘ë癳”í=W½‘u•§Îúñõø²ÞµÏ2 è¸á“7y9|%%Ñ×xaÂ%-|I ÿå7jí? Ž ìt‰˜5›>™6ÒëÍËâc ›‚/æ<ÿ¬–¯¨ J²/n ]¼bí©›wš¤“ %~ò¨¨üu‹¢ûC\öè^ùëVÙ`eÑ…5KçE&]¥¢–ÚÌ‹ûV/]°jsL惧"Ù<ù•…÷Jøⶮު»ŠAJ¿~0|ÑÂ¥·_6Óíµ{÷ŠžÖ4vWUV¥\I ZsuÙîŠÂ—TSEÖÒu)Ñ9Âê—UÅ/ZÊ‹ó7l¿½òòÑOŠîVµÊ£§©êÉùý‘Ë–,X¹!ìzn Ýì“M#j©iÛ&Y²m"¼4ýHÈâùû®Ð[¡ìñý’ÒgÒ;4qÓ«[§÷¬Zº`yè¦ éEŠK§©¦ç‰kç'ôª´¡ã̽@™´©¹u[¢¤Ôª¤ÔxtáS­¤µuÏÞf%%J©_éADÌÜ2»^ßMªÛ!ªëŸ®®îgúþ© Õã¬HÏ«Ñ©3õíÒýºt–4sÆßÜ ê}—B¾¿ƒó­ãÒ=uMSo=í¤ëÝ}tÙ8§ÃC®¾é]µd: %ôÿt´îÙÿù¯—þoæ$a]uËßÿ§þßûñ(ÕŸ>«2¡Ok­œà3þæË/ã`‰ sé¸åIT7ô»æ Ýn•HD%¤Ä’kÉ’œó” %¦(¤ÄÁºu€’øk¥Öe8}ºz×öº×çMÇšR¯ZW:mˆD,`îs.¢˜ž·HÄtS[ ’0iCU<©QRè×4q4¾pð+[RÒgH1çÓ趒ˆ©äÐU %l D„¼ñÙüU¿&ÿñBl.øäýçÒ¾éÐ!Ìá=éMÐ¥±c®±K¹úHi€ðh’€àÊøÅU›Ž/d§^S¤ó ?Ä¡¨ä¡H"À%àð[æ‘ì¶I/ øä("!"戔Dv;D1¡„ÒU‚§¾À§ Š9ëjSbæÕ$j}&ºÇ‰Ûïºð)ˆ(127§ _žx¿¹|zÐ#·Šæ;HødÙÃ%tØ´ä·Ü\qêÒGn‹Êg=÷¼×œ…º |´‹ÅÂ_Ÿ?cYÅèÝçVx.(³²Ø¥¬ù>AØÀïüý|û Ku÷ãê`¤ÞûÆÇ­Eý&É}÷gîí¿11Óý+b®Ê¤Û‹é¦‡™{)Þ­ÍÜR6gn‰ËÂÒAO]–Üûjí݆lÅ­>7ðq»á/Ù9:Ýg¯ãä¢=¾ÚãVˆk.±ÿñC\ù[VÆ¥ÿ üwÏ\BV¸%%rúæÍÿëyèåá¥ãØÖîU‚_ô9O׎5SþYÿšôíéIËYÊ* Û=üQŠn"‹ù·µêáªi.ºêC4Ù¦«÷¦|Y÷¹£(¡ˆ AÛ%Q"‹˜£O÷›ó‚{-,µ°ØuÉ3·èGsŸ’Ò¶»Ÿ"iàcÔm™äw$¿â—M,|“àø¨ëÛâ´„•®þ«$Í…“-ŒÞN›ª]DéoïI›–|&jv¥“æªÈÉc½Ê?1ÊÙ·ú¥MvÂ"¶™sJ^1s—`I™—îÐ¥'ò_6|üv%Ås=§¼½Ôƒ ªVþ›³ ‹²SبŒ[”(úBöEf%Å¢GÂû"RC8”>`A˜QuuE¹ï¢çnó+\Txß©¿-dn,ÊÜé×hö©Ötwït÷^ª‡9HG®ŸÁÒŒJ+ë¹ DQïX†Fƒ­îwnK0çe4Þ]±2œPü°Y©oïÓÕ=§ ¥¸Ÿ(ƒ( Òý:ÿÐÖM…­¤5–ï¢&I¦z^ý[ÑAfö3[äo—8)ë^jé©FGuß’¿Qd;ˆ{û­Û}¾80[ÅÜ£Z,-kë4m[Ê éÅäíTõ#Ô¢"ç#e ò¿ÓŽ*–-¬p_PÔsSI`«ä˜(ªUzß<í¥… óÿ×YK&ºX˜ûÌ}ØܾïdÙä6ÜØÌÜfqä ±l76ø{n¼R´ÊÑÊÀÚÖ51Cö'A°‹¶!G×Șë;c“™ºáð¦ÙvVƶö£b.<”/­,žkçW/¨‰šïeffâ6a±ìÁÝUÉ FÆúú–‘¡éŽ{µ¤òª±‰ñòãYô·5ó`âƒ:"n~x%ë±|}Ÿeƒä›?ǹäÙNEÚ0GTɆ)ä¯ÿFþü7zL>rúNò§o˜ºÍþ•œÊ¼t沈¢².-z#Ýak³,-L‚v^î¦ç¤:/dÚ(Ksã£g\{$¹û[\ô8l}®žÛülîmksz‚ÏI[RüÇg{››Û¸xíKyÔAâ—¼à‰VƮ㥿¤ßh,¾1Ü‚ù¼&&Æ.Þ%MÅÎv¦3¶¢Ãõ|°×uj³Hž.5g–¨¹>od:=*/Mak[\zÓ«¿M|Ò<·läæRņÖ’†Ý=ñZòØk˽ÅbJHQÌ£`¤i ›¾¤±â¢•æP¿%[“’v/›4\“ëRTEï\-ûæPÓ¾-agâî豶êæcC+™G®ÖOÉuôš0nɦc'G®ž¢3XcçºÞ y”sÒ‹¥µ z_^a)ݪZîÆ2ôœ½#1qGøJÕÁ“¶žfV­É5geº<:ñäѽS ýß(Aõ³+§Ã Tv§dV4IuƸѾWîvÚýeÿ©8ÄD‡žÙ¸x‘ÿýQúIš6âðù«.Y³„Ì#_+ÃiL}¦îÙÊL’xzÑÔqfLÔß4nôÆãé]²¦éé5[An3V%&íݺxŒŠ:+éó ¹ÆÇYáAcŒ­ÜÏ&ß~ýæMZò^k5íçR¾n¤ª ÝõUݦ-Ý“´/~C€Ö0ÝÝ™'ÔˆO0f?eéî¤DÞú9ì¡Ã–+$üºôë;ÌUØÑWRW6æ²™“ǬÞ}©KàÑ›;>ÐÑxäìFéý§jÓVx¸MHkèåUeÉ£6”M–¦ 'Û+=µèéÈÈ'!"Ò"a‚†Ùöb"1j6}ʾѪ& O+¾áåغ«® œ3àêìM{-ûÛÓú亩¾VÌÅræY™£ í'‹e¸…õã5§w}2/y±Ì0»ym·Ÿf‡ª³Í2i£ª¬¹$ùµüù[†°åÎìød^ªÇ Ÿhý'QöT´GDÄà‰Ò@&mÎÍ"ýþAjwóÄ#J_“¼WÒ<½I”¾"u=Tìº[Ðñ©ZÚ£ãÚF¹¸À@Ùi›lÖ×#æ˜ÚÔÉvQÝ’:-}\zyê7CQñ8è0s³)ò¶ÙjŽi›óó³3UÕ½Ÿ0ž<º%u£µ§Õà‡z誫hè»^ÕåG½ý Õ²bïÕO&¶ðé°•ì¬]Rì¹ð‰ûÆ’@ i•Þ9TBum.Cß ÌwT×Ù[ð¢­;¡áeùë&IÁéµÝ‘e²Þæÿuó,9ᧈ¸~¢+kú–tE`cwÏoÝâb`ë7}÷Ž¸ LÙ½s£•ŠÊætK*z˜¶Ýƒzü;VþQϧHËòŸýÉ¢“í‡0²‰ÒwLÚŒ1"ÿùY¾’¬XÁ”µ ˜úÌÞ¢w§MJ½ÕÕ·¤>‘÷ýЕŠâý\eóŒÖw¥Mcñe] ÷€à³©w:tý¾Yh¨:jþê=òM±ÜPEãàËNiÓm'riAÆ‹<-Mܧ/o}1‡lèÕ\_6-äñغÆÚü–›ó»—º‡<òk×PJv¯tìv}TÍ%}-ý‹Å5¤óoÇ^Û¡R5Šë±n?“6=>¼-mêfšX9»øOñW”éÓ&í,‘'ï|ø{Ò†Þwï“?+‘-ùíï¼N JgÒÆQ›üËÿy16!äô£_’6üìájº‡ _*Í’†§)æÚgªÞ•6L#/9>`Œ» kÈÏ=f­-b±—{©k8y™®ØþS§O™xîÕ{ÓFñ«(ߧ¥Ì9þ¤þKùBIÄdWͪå}Ê[Î-¹¨Ôka¹ûsÉ}é“í˜ÓpÐQÓwñ³mUu“òŸ·Õh_å]NyP[xv=‡åüHÔvSëº9¦œé§‰èCÒ¦e“áèõû;.G$2èÒ_“6i-#ùŠlÿû˜å/¯ÛŒÖ'?Û’ŽEðåuö®Û<ñRU_›RÚ¶Mª$q†™e Þ‘6ŠÎ ‰XÀom®z°Ä]SÏqEšæè«Ï;Õéc …ÒNônÓF"æ8aþÞŸ£ÈiˆzDAõ—rÐA"!«·—z®-Tá¾°ÌûFÍ"^úM·|%ˆš¾Lï­f6s·âËòxœîàYÇïŠJ.rô´"¯ÊOpi|pÊHO5>ùÓoÓcÚT°´¢S™#Ge»|” } lj‹÷MùQÓã%y_Ú ¶¾'Šº¼ì¬ÒÊ·ûC…Ää¯ä;ë¶ #Ü¿ÈûmNÌ JÿNî(~~Ó’zôæiÃb+ÈÉ.yÙõg'g±Xîë‹—ì 0ÒôŒ”¼³ß&÷Dˆ‘‰G™bgÊ9 ÃšFÏ7c½µæð çŠ9ßÜìü£áüFiÚØ Ò¿-‹QKa^öÊJzY§{q&´Õ*__Y£®cžYɤ’ úaVf^­¨WŸ”äXuô‚r·à2ŸE¥#ã+×ÒŠiBI(iåU›>­¡ü²£¡š­×œÄ¤M†»Iƒb«ÊcaÓgÉzjÊï$E…Î Û}üqe‹â+Ñz÷Ö‰õËçÍ_rèrfƒìs‰èAaVñ³&EËAôðnvñ³fÙàKúü‚Y[w]¤ÿ„ _§œLX¶`öÒ5ÛSò eóly–‘}§µí°gë fP$‘VÁ[/íÝ4w΂›/šèèÉÎÎ~üºþíÕeþ}–O–{'º“45k·ä'ˆ‰êÉáâîD<'‘“ií׋ëÈ¥dÒm•@Ø{;)8æôÛKyóüþÑ„ ‚f¯N¼SVÕ¶­êž•ä<”?‰jº“‘U-”-ˆª~œ›µv~Ðìõá×óI³j©.;—±hÞìU[ã³>Wt]HÒODÏŸ;÷Lás"nÎÏË~PþJ¶ü–ª’Ó{¶/š¸tõ¦KéE-ŠýSPu7t¬ï©šÞÜELÿâÉ©*Þ‚2Ï…åŽç*R"<ó:'ÕíÕÍžþ¾àê~¦Ð5Hõ8«wŽJ¨—A}ÀÎÁ´ÿNmØ}í#?Íû7c‡áî·ï;®è¤ºÛð²q6O›™Ý»Ÿk+ OVñ‚žŽZúÈGÚôEm@ª&Óe¤ÿ}¦]ôì¯.Θ·ãV/oŽˆ(áõçÇ‚+j."!…Ë-:U"¾€žË¶úO/?·OLQõâWW«NðEõÌIÃBd ü†ñ­¨Q½»"ŸÞÿr©L— endstream endobj 870 0 obj << /Type /XObject /Subtype /Image /Width 415 /Height 312 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 28291 /Filter/FlateDecode /DecodeParms<> >> stream xÚìw|ÅÕ÷ϙٽ]ÒU—eË]îâÞ1½„ZBè o!<ä Òž’@ @z7½Œ1à†î½È¶duéê¶Ýóþ±{› 6زlé|?úØ{ïîÎζß=gæÌ4M†aº‚/Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n ðº1 ðº1 ðº1 ðº1 ðº1 ðº1 ÃêÆ0 ÃêÆ0 ÃêÆ0 ÃêÆ0 ÓÅêFÔfa˜nαòîk_yOD BJ,"ßw†éþ´÷îÀQ÷þk‡^„£ßl¸1LO5âŽBi;$u#²%ÜYÐ4l»1LO6°)EˆŽ…®Û!Øni'cXVU]c4AöN¦h›G׃ÙÙ.—žÐ‚îå™"¢®‰í[výöÏÅIêšÆ} ÓAñXÔ¯Ó7.8kÖÌé–¥ˆèè4k­ÝÍ9%¬ØµýÕWçž~ݯ,î:e˜nk³hn—ÑPýÙâ÷F ^=kÆ4!„eYGgmµÃSŠ”ýËGœvéE@ ·¿1L·U7—B µŸÊ˜ß°,SHŽNóM;\Y¦j$PŠŸ†éÞê‰F¢DÙIE뎞ikG¹ï”aº«º)@fÌÓ4»6R„Õa˜/ᙀ0 kóŽ-n—&5]eFÅãqD5j”Bui€«Ã0뙦L9]×))ôІ•o¿¶uK…aØö¡ž]P>}ä¤%>edêßr†Õ­‡i©¦MO-|aºóÜ.ID¤ ÀÏ>xöu¿œ2m¬ÉÐaÏ’'zwõÞ¢*ÿñcúø…æÃõÿ½wõ–ø )÷ta‹AB€Ú¶îí?½þråÔŸ|[6¯šû¯mƒKGN˜\(Ð0)ÍñEA±ý+_|÷±?¬\½#fI)€Hx‹G9ç{'sv¯\݈+"”@óþÍ ^šÿŸ'Å´Hpø ãäj Ç¶oœ÷øŸìtû³5‰JqŸþlòUg_÷ƒáý‚`&蛑%Žauë1ž©½¨Ì¨Ae/ûóìi3 V¬i÷'Î{vîÏ ë3pÀ²l$R;_Y½»Â‚xÕ†å»Â}†üC/>ýÌ{çù…ï\7ࢢŽâõ›ç¯|k>â‡c'ʪ\‹DMÓJø¼˜lnš·¾?ÿÁÿ·à³péÄ‹æÌ>¹(KU¯{{É»s<~žç¦A!T½qÏÞ Í¦2Öm¬ØR5ª_~â)TfKYvþßùVy©ÇŒSdÿº•¯>ðñ»÷¿ìÊ˾åê>Ù>Ë$ B6ßV·䙦–…2¿pèÌýñAùˆ~±š=ï-}wÅeʲ=^Üõþku±Ü±çOÛòòŠÝ›7Ÿ0ôxéî;úò_yÿÊÏÞø×ÔÙw ôS¸vëæùo¬0óìK‡ò†v(¡išL6æ%º4Bdû¦ùýpydÈù¿ºè;——åÁš6»|Ôè¹ÿüÓò7ï7|øÔñý„†Hf͆ÕMÙ÷„±{6TTn\š><×m·Þ %r÷;gø@ÀÔÁ#y~sÝ?ºhÚ)ç4D`)6ݘƒ‚ãݺ+ÊŒ…b-m¡X\ùÃú– ÷uá‹Àmn_þÉÚxî9³Nýú ߎ ëW5ǽegžtñ”Ð’g/Ü.hÚ8oÑŸeMºxüìã|ñ¸a¥dÍ‘Q":´T|¾þ7µÁçͺô†¡ýr‘@Y¨ŠN¹dÚ)sü +6-_Ö©Šî«Øº¾Q,Fêö¬Ú¸ÝÝÿø)åÃ\ñ&2- "3à)*>­4WVí^WÝhH bû·TVlŽç âƒùK_üONá¤S/¹ª"!z»Ê„*¦¢õ–˯{ò4¦#l€(ݺ擪>n„FMÕÎõ²ßq£&÷sçŸ8qxéc›7¬¯¬VùýD[¶mC)\^·$¥,+},›o «[”7"¢œ¢òYûùMS²„·¨ï‰g|v6†>ÿhçî ·,þÏÿ­óY¹,BfýÛ4^>=O¡+P6á„3V=2?ïøoL>!× Û“¸uà€p wÆ·Z±%ÒKR1Ó +ÔÜZÀ¯ÝR»qeÃþ¦M Ÿx©®¯V³¨ÆˆÖ¬^³ç΃´7£€EF4jI·îÖdŽâbV·žå˜‘ÒʆŸsçy§eÇÂvË¿¦»RH—W®¯Þ¦èsoþíED²@˜Ï®©þÙI¥.C¡pŠ |æí?.ßÑ&j3<*Ív# -/;<^­©Yß`LÊAŠ)g*‚ÕÒX×Ðò–óò]M{wïØZY·ogÝËwþŠ†dÀ'»v­o6ˆÌ£€0#{÷…É•[ÌÒYÓV·ž-o€šîÍñeåJéÄm(E A6mÚºþÓʬSO¾æ”Þ….eêš±ñÕW_üðÓ»N¹¼<´‡j¥†Êq[YTN0Á—Ûgì°²ÈÊ‹·m¾jòa4’"Ð\€±ú}VV½§Ž+ö…öo~ww(0蔟NœÜß…Q¥±âíŸ{~Ëç[jê X&ÔY‘R ˆPCM¨¦óö…d°ß”B_Ø#dÙ3eXÝz¤gj·é+Ó2Á²À Pšš7lعfEöø»¦^øݾù`Y€aEpÉ{íyõ冫ì‹¢Dš¢væÝEáòy³!2æ4ð[&øûŒ~ò©K}öý§O(üÎwÊŠP"¡ÐŽŸ\øö«Í¹‡Mžà‹VìútIÜU<þ‚+gN¢›qKózKömX¼`õ’ý{†• $…zN ß,‚XL€‚Æ-/|ö•&­Ï¤Çt—²’êÊÒÆ°ºõ4iÙ·HH@¨ k÷Îå;våüÚˆ`¶WY@d‚»Ïì‘¥yÛ7=º²êÇ'!¬„@‰" MH«e˼¥/»wúŒ¸IH¦…ž¬3F 4ô´'­üÞ‚ÿþä±ÝËÆMšë‰×mùhÕ/ïlé=áòëŽÛ+²}áú--®àäýK4!MÓK ¨pj¿¾Ç»—.Û¹gG¸X×Ü.¨\±ö½—"k]¦©Œ†ëßüû§Kkû_òË cÊ4S “€‰;OV·žá&Fb€Ñ´Õ «P‹‰Â'$R¨#ÕmZÿÆÓ•fÿ©ýyì.H4\Áq æ®\ùÒƒŸ|× Xm¡êš½•þÆ0H8JÅ›Zª÷…ö?úâê'¥“—È°´ÁCÏúÃà_|-{àœS¾ÿ'Ï3YòÉ¿^üð)ÉwîàÙ'ó†)gœ¤}kÞÿïæÝû Ï^ÌE”" ŒSÖ€aÅÙÖ Ëç-™^’×2Ô–§^¹û%M"©x”üF]tç)—žWðX–D;ˆy°ÃêÖc¼Q'­#¡VrÒÃ×ö¡’ÑA#šH¿Fˆ¢xÄE¿½öìü#ûIOÅÜÅçüùê²½ZqI$ ² 'ÜtݽçùŠGœ–<Ër{}íÌÛúNhŒ9 @–Â@vÙ8M áȳOùÁðÑgoªo)BéæôRÚ·_V–gL¼é}¯ ˜œ¥i!!€Ù‚9ã¿{áo¦D³Nôùf~ï‘a•õ©Œo¨¹sû•YDE*‘fÓ †cV·eÁ ¿ì´ãzƒÒ´þ*‘-X<îô"B{KŠH ­hʉs,@ÍŠ¡î)9~lÑXºe’Ý3JJÈààô'ÕZW…æ¤×•ž¬’þÂ!¤" RT–ðå š>j  ÐȲ3UI"gøà)åRH,SÜg´Jµö¡@RJt’r&S³gÊ°ºõ0ÏÔN„‹R×%RD ””šÛÞZÙ¹=•"¡iBs¶CD¡iR ¥±Z ]ÊŽN@ˆ(¤æÊ\áhJ]sjh'†C$¡énûBk¿ø„˜¥Æîsòq†Õ­gy¦>-BÆ2&DÊö^É’ìðŠä¬ ˆéÛÙY¾¡Íîmµ’Á»é¤*ä ”BDˆlG35ð ½rkL%BžY9xœi7”¹´ÅäÄħÄä+ö@©V›Aƨ„d¯)àå;jÃÔ¡63[/*×:= ÉæE¾Ï Ûn=Ì3me=Qr¢—ôOv#Ú¬Ðù[Y[dÏú’ZѶ|ÛpCB@°=ÓÔ™‚vk•Ü9a¾µg¸9k“æ&›m «[5Ù2l¯ !H|ÂÄ(PlÏÚKÛÚ–ÚJ\’å´.®U…Ú­¦[|ؾÑÖáðgÊ0 «Ã0 «Ã0 «Ã0 «Ã0 «Ã0 «Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ã0¬n ðº1 ðº1 ðº1 ðº1 ðº1 QûË|T ÔA‰ïÓùpæñž'n‰YAì ¦ŽÌa0!p<3ÃêÆt¢Ø)@$ .pöÌ¥*1O¶Ì°º1 kŽ¤GÜÍûÁRî KÝðçÞœäœ}¬m «Ó b XǽøÇãÿtW<àï<­!"n€ë¿yÃÒ«oúò5ƒXÚV7¦3Œ7G[„aöÙ<Ë™}ò«? ÃÄNñOÉôx]õu'<ôëü½«õ»[²ò5Ù3eXݘN3ÞH€éòÆT^] ·ï¬Ö7à CDÝAO<¤¤†”¡° ÃêÆ$…©íôðéÄÓAÍgŒÉ@ª¸+jHSGJß=½œv¿!Ú^.Bjˆâ`.Ý$BL£-ß­4Ï1Î@¢”öt rj.Q`ª@–9V7æÈëVrÒŒjíð€"Ö°¯fOUÌ0 =°-˜äÞ%RÊ6Ã/p !áÅ¡2£õ{*B¡¨¶‚¤Z¾Ú{@D‰ ¦ I #ÒØP_±»¥©¹cËŒ:ôL‘bûë++£†(ìX½ õµ·Ei®Úµ_ƒEà¨ZBåT¼¥©bGCC ä`;V7¦K´-alPÒì "$JY±#BOv¿ñÏÿö¯»ëê“©m.%_Þ ¡Àdxš”üDŒ7l÷úoo_´d‡žƒ"峂c-9§* iæ’­‘šu+žûÍÜ?üdãŠE …2)¶™ç˜–.pyPw!‚#]”¦a ”¨»íÛsbÑQ̓n/蚊T¯]µðù-Ûk5Ýšo‹S=¡nWOÚ‡M7 ¤°Bó—½óïu›÷“æ‘ièÌ´ÏQ×h.Zšß(@€Ñ°~þªÞ®nj–npû@w¡p|eç4x`ßæž]ûÁÚ8©Do"×ìhE@@BûYázÜ«p”€ÉÆxR³”Q‡Ýš+OJ—e9£Ðm] \ÙAO Ðãó’Q‡A]îl+žxó•R€(5Dj‰‡ë¡Ð‹uMS*Ã-$ (õ˜Þ¯@×Ý~·7'ÛUèñ»É²]ÀDm…°êcÑfnÝ•¯éši¨´H $+RÓ¸oSØÛgÀ×n,.‘Ö^¥”}ªŠ%Ja¨x]ÜŒ =_“ˆ6ùQxm-ÔÙA—×ã³1n"™£iÙ¨”s8BÞ¬x˜rŒ(î’“nùƒY0F‹€E€€Ø7eucŽ gšìÖBšM[>\öÖs›6í0ÝE}N¼àÄ™'õ*ÈJ´‰9f)±Êϼ6wÃÆ Ùkúä /1°,àè!"J´Z*·-xré¢ZÁ¸‹¦}NŸ,­U£Ahï¢>šûRu,»Ïø³ä))T¦¢PÑÊUkæ=³jÅçQYÜoÒÅ“O=¹Ð§–=zP ¨–Ý Ÿùèɧw×¹±é™Ö¾¾ãú£Ž *P×âõ›Þ_òÆ‹›·ìÍ~Ö¸±}ö,[îqêqÓ&ùuT*Õ†(Åö¯ûôãykVm¥“O<ãâ¡CûëI DBçb(ju2„€̦½Ûß62.«´¼—fÅ£$Xݘ.iu!!¾ç½wî¿íÓ•û=ùAŒ®Þ¸bUeMä¼ožWœã%+Í„nw}úÀOjêã(Tã’›ÖW^ýÛ»†ø"‘!0¾ýKwÎýÏó՛㠯[4oG\ݹB$©¬¦µÿ}úŽŸlåäûöìÚ´&·—éò&´À1ŠP*£vÅ'þüÝy+MwÐE+6.[¼¯öwßüÎY–­4dF‘¦0…­8U‡1ät€Û ëÞ|ç{¯Ü)}>±g_ÅbõƆqW9ÒG½JÍMÍÛV>uGÍÞ0™-M‹Wî­ƒn>¨·tR*}QŒ1"»7½ö¯&múôó§ˆ(Xl¸q»s$Ód« aV~ðÏå+v øÆïoú×¼ŸüåáåñKžÛ¼§ÆJµ¿9ê&"Ë·ì/~óã7=ðÚå—ÍŒ¯úÇË/¬¶Ù&”cHiP¿æå…O?Ö\zÁ%w?ÿ£¿>6gLÖ–'îYµ³š„–LðFfÕª‡~¾®¹lÖOŸ¹ù/O^tÞ ‘Ï_Ýky]"­¡L Zu ^ðÑç'ýô»{ó–?üeú–5/ÿßÇ«"nOB-"(›uù¬«/ï;väÀ ~úèã†^§ÝÁSÈ ˆÐ¦÷ÿýZÌ1íŽP Fãžu󙹧žzÍu#˳4쯅wmºéwkß_xÚÔS0 „`~pò²ò <^Ÿ'§ÄC9P¿Ë®¸®CóŽ ë–îÊuÞì‹.-p—_©\´uÃKQ¦ÛˆÊŒ*oïÁçþ|Ω3JrÁ=çä=ÚS‹[·f·²Ñ;¹< «“þú‘£ È"½ÿ×ÿ§¤¡º¡â³…K+›ª7oútm‹5BÑÚö ¨ãGé£DšÉ[0jôà‚ß[¸»Ñè›ï³£@"…¶UW¬ˆöžS6`ˆ+N¡&ð½âÜOÅùø‘•¨iì[°²G;5¡¶ 4_ï^'Ìv¿ò¶•fó4Œ¦Í;÷7FÍæïý»æ}Ki.³z“­lÚ¾ Ö<¥P@œì>KP†aÆãʲ”· 3YŒˆ4쬉òŠÇÜF €ÏS4hbvp )#S‚È2•'§xÈØ2€hÀt Æ RÄ.&Ãêv Yo¨‰øîeKžhŪ-Q %š¡½µf‘h'Õ2 {@–K0MÈÉÒC¡¥LAiŒ7í×sƒ.ŸN‚¥ w¿á'õÍ‚"G¹”jÙO¨yrsTÌsêÑüeY”–Ù)nEª"ª©©rñ²W¶ RŠ„€úöñÇ#€˜hÄLÏ;%’Df¬Ù”Rx|‚îÎõºÜ¢µ%FDB“~¿‡T2Ä‘ûV·cGÛ’} ¤¹ç³'îyëí ½f_9súìþ%°óõ;__v8Eë¦%Ë@T¶„HØòû<˜hn€B€”ÊPd9‰4«¦jÓ^t÷£d ¡ðå#Y±¦J€Ré"eGùøóG^þõÎÊÒ•iH!ˆ´¬’ŒƒqB.¿PH±˜Jê ¨ýÍm]ÅÖn<ÃîU8:<ÓD븠ª¬Z½Æzãß½}Î×f =:ÇëFÕÞØ,ᆖՕM P¢‡ª6W4›þã{çhŠì® ¤¿Ð›ß×Ø·#ÔØè~¡6¿ðü?ü`m% -1þSÓJ¦C¨~㲈t¨"±ýk›Ð%3TØ-³úåh·¦—Œ›<|ÒÔ‘Ó¦ )/®[½h×î&ÝÓêlÚW7…àÍ)Ë¡–Æí!ÓB š€hó®–pHle–u8hžaXÝŽ!ÏÔ¶RHÅLe*+NºÔö®š÷Ù§«Z”.Ñj(ºðè°uá‹oî­S.ì™÷¥›+sg_ÒËåQvê! P@þ}Mɯ›¿ê“yÕðX{>{éÑåKvûü‘tIÓò¦MŠ{ýmÑÊË M[,{ýuÓåN"éÎ):(ÞñÊ¢…kZLÀhÕÚ—ùÔ÷­Ý­A´8s^% €2•W*£‡*˜;hä®ZñÇO¹-¼u¦¶ɪVD!E*@Å°#eZ¦áœ0‘¥ C™V¢,Jµ&9·ìIJº1]oº9/³²=Ã&_òæØýKß¼£(,Ÿý­Ó¯¿tóÜ¿¯YõÁŽi§÷ïå³íme;§ wø·Æ­[õác¯¿õ÷™yú÷N°L‚Ĩw ƒ¼fO¿áîè¿þ¼úÕ{WS°×„O¹é²¢,,•ˆE!@½`êÿ^òíÆWç¾öæÃVNù¬©×^[ü¶Ûç±ìœæ1È?îÛç\~çÙÿ,úï'Ê]X:þÖ³®¸it/ˆ´Øñ©ñZº¯0XÜ7+àÆFËéãD¥¢¦«tüÜd¼ùŸG?ñY|Ü€13Ã˪2Òo w°4¯ÄïÑ]öEzvNI0KÄ4gÝBoN¯¡ÙÑ<‘È㉘ˆLéÀR懎Õ92¦›Ɔ¤¬¸È9þ›gŽ·s«¡—ô6)?@C >1ì/è$ ‘¢ ØûÌ\8£xਢq'/«iˆxJÆÖ¢¤ìÒI)ÃtõÙù½Çœ°m—AâS{åk&G%! ¡+ÿ¸ë*žøAu³ ”Ž)-ñî?a”ö7ÚYCÈ$Ô‚åçÜ–?êäÊ={,O¯¢A'ö.ñDC‰q¦HD„ =ù#ÎÓwNäÉ]Qg˜J¡š+êÃ/:ÿ¶)Ó«öyKGÃîWÛú¦Ô}2÷BYàî}Ò5g3òŠòÉC»èÄ9×–Èì~–L*N ÂP>í;÷ŽTC½B$ü#" ”ÉÜ*©†Õ9r­n‰AœHdF1«ÿ¸±ÃÆ!A¼b&;¥L@¬â¦c’™ ŽžUªC¸úM8m°*á"ƒlǹ‰(Ãœ>£N’m’¯¾E†c [åU$øúM9k°f â1|Òi…p˜R)H‘ZÁ°)½ÇÄ# %g/H¦à @W dÔð ¸*«P”h¾CÈæ=ëžýý&sÐÌkožg a‡T""÷™²º1=KôèHF[ ¾Š¤vú“dß à¡vnÚ¦ŸŠQ} 's& Ï°º1GĘ"¡Uç T©˜›@vv"g(iF#~Õʘs>mFäI±Xݘc±‘2<Þ–B—f$ÜÆÃëƒ^°D–éõa eÌ0Ý®§ÜN‹áW±ÚÚ+GÙ «s¬¸£Ê nß8è͹¤ÎðLÈtk®ÆºÜÍke–Hõú²oÈ°º1fµ²bôɃ¶?=éß¿#ÓîF „ŒE5Ý9áܨ¯HX|íV7¦“ÕP®Ÿuusao-éÔ0¡¬h wÿ  Q_¡4Ç·3¬nLgz¥HÐ’WºiÆ7œÏÕij‡¯ ] ÷Z2¬nÌ8aî#r(§ç”“®1¬nL'C‘Hª#cI¦MxÅž)ÃêÆtžgšÊ¦v´Snì™2GÎ<Þ£.sjäNwNYÓV7†aV7†aV7†aX݆aX݆aX݆aº‰ºµ^`˜´Q_mæðÐéѼ‰™žx¦&ã¹H›@05u=s¬ý8õu³'’$jßLcÛ­kµ }jv"ÕEw„2Ì5J~ÉOȱ£lHÇÂï‘v¸ÎWHÍŸH ¬Öo•R<¬°ë‘nò"¡š[÷wáé,ðøÀåF$utû@Ó@)¾Edž´é.0 ]w¹bG½wxÔM)U_[]±i“ f¥2fá$–¥!«[×b(Ípo7ú˜¡Hýžª•aåØ5&)hª5«veYfß溆Ý«XÝŽ!uÓt=ª­¯Úí±¬£<‹»v8Îòó úÞ}৚žQ "š¦ÙØЋŅì{t™gŠÐÅQýSÿ_Ãö‹ç>±©>$eW©—«º¡nz´ù®‹ÞmÜó¢I$øçï˜ðJQ3W±ÐØÑÃQht¿ÔÚ!'!*Ë:tèÓO?"º\î@VŽ”–R¬mÇÒãdÛ7DݽÝÍVî¶ÊEDš¦)¥,KÙp×B×ýÖ’Rd?Œ¤@)¥ˆdÝ "RŠ/)¥x’Ñc‰c%˲vˆiÚ\¸>[~z»´Á„+Ã>Û-mÚë£ö§éÔ-ý”ÚžqÃtc;êç¿æq¦ ÃtOx^…äL5ÍØÆ àÔ mº¡nv»±ÝtÌ÷¾‹ RB‘ÝÍEDD–euY¯&ûÙ@´ûœ˜îÀÑó¦Qô¨ëº®ëRJV·®|æ@“BCDBJMjB—E„hš&¥@D!¥&¥Å=¦ÝIÝt]×´®ôEÓ4;É^³ŸW˲š››#‘Å­=ᑳÀç27ä7ÿ ¦Øäÿ‘Ù]¥nJAa¡õÆžnÈ¿ðÂðÏ~Ö¨ëÀñnÝÅG ÈÊÊ ]Þ—ÚY¶"Ú" ƒA¾ñ]ŒÍÇ°ôù<ÞâbA;n©K’<”I‰ÏåËâ;Ô­4N)Õåñ"Ûg*„ 9:l7¢Ô "꺠³d-ì±|ŠŸ‘îÇÑ §uÚ윕mÄ%…œé5±ÄIGÏ(‘Ê6®ø}!¢ô0I'³›=Œ‚#¾»‡áv”„Âu–í–Tî£á$ùW´Ý«]q_Û¯NGß3ǨՖ.vÝÍvK?O~jÖÇŽ²¬{ü¤t±ë¶Ã0L×ÂêÆ0 «Ã0 «Ã0 «Ã0 «ÃôL(-:ãëV«;. s‡/8@·‰¬æ H s,`‡Åƒ‡ÝηŒ»°séÚ¦¢&–¿DQ¬n Ãt†×®ÁuPúhnÔÁþÝo0{¦ sŒˆš3È–)B Ijo6ºv HŒtCR!Û)Ê0ܺ‹Ì±º1ÌQ©f­šÁ€Hjº¬Û¾jî3o.[_e {.%ò’¦l°Ôdî%D{h7¡ËŸãw"€ ×ÕF ÌÁ檆IÝãËÎöiŠŒpSCSH˜Í áP„4]C·& ÞT[6Pº9Ù^ ŠQѱ;©«s,¼í‰W쫾k”ˆ¤8^Ôd5:L¯‡ö‰ÚŽ¤©Zøü?ÿöÈKkê<ã¿~ÉYm‚°]FDcÇ’¹þíáö‡"X>çÊ[o¹jBß,A5ÿ½ákO˜WÜ{£ñçÛÿ¹!žÝ{Ôœïýè{§)ÞüæîùÅ#ŸUš›öÝ|OîcäÕ¬›÷Û{}eyµÌráo½þÜü`ÙWûØ5ßXݘc€D0CjáËp4ùXI¯ÓnÔÂŽŒ7"@”ãëÞúËOùÐVY6nkÓüçVìÛ³§%ˆ(…”µËŸüé­ÿ»°Ò=x`Y©oÿ‡nÛÞ,žøó CýæÞµ+î€_oÛS™;²ÔS»îÕûÙÉ~øîa½ûô+/ 4Tg—ï_Zâ×¥Šï}ú7ÿÓ,J{—äï_ûÖooÛç4÷ÆqÙ¦iѱ<#·»1]l”¥/ñ\LbGô•ÿ„8liÍô .9}€ãM›Ÿ¹ÿ±íúñwüã©W^Ÿûøÿ\6ýÄã¸*Pµê_/nîÓ̲íÆt¥´i¸\€šF‡±Ø¶"h·µ+Ju¸—eAzVôt¾`G€§¼i%Í %ø|äráËtºCÞ½ðMjÐiW\:iPÀ­ =éŒ ÎzîÕ•ÕBjÑ=kßXØ8zæ çOàxÈÈ>ýÚïOúã·V,Ziž:‘”%½¯¿ýÊÁ99Cg|íòÙ}²áã*o:ÁïÒ…RóºLÉ-xÆ÷o[~á†7V7¦Ë¤M¨¯ÇµkAJ׎ƒq?-«} ‹Å ±,«õ‰–…á0„Ãíh i¶Ó¦Äbîhš·/pDC,æ(£iBa!œ{.̘A.ZÖýe°¢Uëö ט¡CAÓ”!J‹û÷Ézª±nW­mœ÷Øw¿íÑ‘P`¼a]´eàÞmM0 \y“f–˜¦%µì@é¨Zݼk—eÊ""Ë2-%ôÂ)óuGR½¡Cj"Pä>S†ùrH yyðàƒøàƒ²3Úé¾Àiíh•è¸Fˆ/zË;^‹ˆd¯B„xŠŠpð`5q"¹ÝIýjOSæ)3ŠHš[GPÂåugt‚Œx‹‰F¸iÿÖ-Íš°÷½Ž×»(`‚‘Õ+‹^ ¸\`‘edJ?x®n8a«s¤6û•0Î8ƒòóÛ±³¾Ø`H¶£µ»JÊ÷â‹Öº\ e‡B¬ë D;Ö¢àr®w´£òx@JgGË‚ü|5e x<˜°UÛ·ÝÒFC W°Ô£0´¿^™„0cf8fÐtÑÒPxÎ÷üþǧz"ÊåóC­P‘úÄDˆ™±êFôçfç{ÀR­îHkÅn¡u¬nÌvH‘ † ßÿ¾‡NÑlš¨”=à‹r(ÍÛ{ÂpßC[?ÿ´&4©$Û°{׶µõqƒfå•÷ËiÙ²eù®úé…^?´ì|ÿΟ?ÞëÂ[o9¯ª>عª·W€UUµfq¥»dÊØ~ ª,B©iR`»BÖ=Fš²º1G”¤›fY<ÖÚ´À"ðñ¬Ò[^úŸ¯OºnÎÀæå/¼ðÒ§q¨L+«xô9“Jn}çå'^#Ož£7¾ñ»ŸüṆۿþ?¶Wl†?¿ïŒùÅ™Y¡/ÿë±5Zïž9Û dI ⱺݻö7ö73­û¤ aucŽ¸õ–0Xˆ ê[fdrG½ €€D–…ž¢9ß¿uÖšÛ»íêûå´D5Ñ\àAˆÇÃq­øÌë¯w㯞úõÞ¼·;^½eKó)7ÿþº³T¡ÐJÕ‡¿¾xÕ“ù´ËöèìkþçªSz2}EƒJTË«÷Ý9rØïF„£dĬÔÀ/D¬˜Ù .µ¼ãŽ;ø…믔`ֈƗÀUFY(<]…ž²Øz¦é–yúõ* ‚mS‘¥Dvéˆñ#{‰ÆŠ=µrÔ©—^{ÑŒôš:yôà¢`ÙØ©ãú«Úêúæ°ÒJμé®{x^™W„>zäñk?xáþOÖ´ûÍøæÍ¿¼õ²!Yhºýyîx,j,}Â@w<®N=ÿŒÙ^ eD¶­«(~òy'÷#Rt,Øhš&¿ûÝ¥Hê]/w^AþɪøNÔ‚ €§G>:ì\ºÉBÓÚvy(ÓT€B“­úz•aMVÞ=iÔÝõWoÛüûâŒ],D!5iV"iÇØDMH Ó°œá^Çì3ž)Ã…VG*&Q‘iZv²I;ãšÑÈÎùfš uvv… ìee™q" R¶ÏI IYV29"!*P¤‰.á«ÈêÆ0G¥¼%š'“ *ñŒèD?'ÝÆä:[²lT*"Pv&ïÚf¡-“¶"B";\"ç% :)€9š—a˜Ã+o Ui»`hkÇÙTzÙØIS›$F ¤šûÚuŒ÷j³º1L7ÂöZ•"òŸ|Ë]ÃÍ‚\»k@ã‰(YݦǛ|ŽŠé}FŸØ@™†…Çvç«Ã0é%9á(D7š€™Õaz¬gšìŒhÕ~vŒw|%8{%Ãt3«-ᢶ¿‚Õa†Õa†Õa†Õa†Õa†ÕaV7†aV7†aV7†aV7†9²$‡d¶œI­·¤Ž¶lg¯Œìj±3sð8S†ÉÀNÚ€öàÌŒU™—Üà‹G9ÙC«¶6>t÷]Í?ÿù•}W=|ßCo}¶ƒòúN?÷šï]yÖà|—¥„ –ÍóŸÿÛ?þ=oM•¯täYß¼á†oÌ.m~áOüûßK×úC1—~|Éì±YBYJ¥µÜ1¬n sHÆ3ýºB))²å±Û®úÕÓ›<½ûd©†eÏýé¦í5÷ÿëOøƒ¥¹®½5aáËÉ-ÊÏËÏËÏqËŠˆ;»0?¯nå;Oÿûá×WTróDåš'ÿø‹ªÆø=·}£Ÿ;¾éÝG~që]ïWùKJ³kÖ/øÇݵ¦îÿá9ý Š³|¤F?»0Ûï '™oH'!ï¸ã¾ =â}ÌÑø¸Ê(0 …ç ÞªVo_ò£-é ÇÐÅD´»1… µýÅ__÷ëWrιýáÞyÅ9gŒÎÙ÷ÊS¯lòŒ¿ê¼)GõŽî]¸»ø¿ÿÃ-3‡÷-믶o\¯&ÝôÛŸœš÷Ü#oÕ^øó?ÜwÇ_›9÷.]°Nœ}æàØâGîºýÉŠA?úÃ_~÷“ïž1a`ÝêùïmˆŸtÊ™S{‡7T匽ò{·\4m°)=l˜Í7¶Ý˜Ãô‚¨/ᄇ8u‰&ñ£éLi/v,»©æ|–±÷Õ>Ø£Ÿú̽7Mïï€>¹?\6oÑO?µîŽ“Êó )U 7èq æd{ݚ˗““ØnE¥×ëóç÷.ësþ÷sò‡-iê—߶léóêÇ|ëgW]<­—aO=mñ•O­X»a×™çäeûÝ./;˜—¥id™$ºmYÚXݘÃa¸Hn‚H¤T¨ý׋Tû…(•² P ¶šñ®#Y±Í+*ªÜã®›Væ'Ë´@xsÏÛç¿Ï.Y´†X±˜©È4c1¯eÅã†i™Ñ˜‚À¨ãGyqþƒw|oÑ[S§OŸ>eò g}½Q04¯rÇ–†¨çÓ—î¼ñãxÈí^úñæmÍ[j¶7šådš–aÄ Ótâ°Í†Õùª d‚ “©¥l7[ïÚyù@K'§”™ì18°‰‡D±†–JÜ–I@äçø@í­lá³Ãp“¥!R¦t ;é’ŸýŒžxéƒë>øûüÿ^rü7¿û³Ÿ^Vn-šÔ­xs]}4j!b`Àè³+š0¤Å,…­–¦¢îØ|cucáå·0†Ðø©hø=Wµ@AÂ(Zë pºìàý”, ‚Ð:vHèÞ&ŽÚN“Š6Õ ûK‘ÇP:…é‚ìÀU;ö´3í%ôdy¥GímP‰ 7jjŠ‚p€Lj¿â Лwü9×™vnÅæµK—Ìé¥yÏþå1#Väò(Ñ{ÚÙ7ÿß÷GÔ×µ€¨Œ¸©²Jx­­¦jmîòPzV7æp sIŒÂº—±z[†â(ÕÆKB°÷ÛÊA­éØZĶB&R”±­l%¶êI@­Mõ=¥nBRùmªôtR¨3’H }ø袢ç?yeqø;§ç€ˆ[{?^·ÇòM™Xñ­v"”šf6ízõ­~øÝËΞ4`ȉ3gŒÊõüò7/¯­•çîg>׌¡¬¢²Â"ˆ¯yëé'ænŸtÙÕ玑€RÓ4!ÊƲÆêÆJK ") d*ûäžV´ÜPuK¨´yÅ{Œ#L â Ì´#"€ËìÙ@$ T”Ùº*Ž*–Ùˆ*d(“4yJà tA‰”Òõü¯_4õOo?zûMí{ßõCµ}oþów-Þ7êÆËÆhÐ`Ù‚›šà…©bõ§½³(Ø«ì‡çõÄ›wlÝ´×ÊÊò:ò¤‰Æ_ŸzôÁY~8»Oåò—îÿãÝo7O>îš `¡h¤…@XÀ}¦¬nÌ¡´´Ù¯Ž"B²Ç@öÈCmÉ>HÃ’Díu>X@f=U  +Óô “ÈjŸB†#y¤@¸È]b7“}±¾!Ù}(J)áîÎ-·_¶òŽ§oÿú¦JµæMk¶x§\ó‹ëgP¦‹4V5†Bq[Ôp¨¹¦¦©}¥³gŸòÒ¼¿üß¿ñÚý¥®Ù¾»±ü¬ëgŽà)-ºôºë?ýù_ï¼òŒ‡…*¶í1{]|ë7gŽË3+?¯´vñ ¾[æ¸~þµ‰ÃýÒâhÞNôU8Þ­ÈÚö¢Ólv8þäÁý D E»n””Þ´?H/i~вÒþ @Ë=z.èÁ´¿\p僫\à.W]öPö½>GÞ‘z‹†=aP>Ô×5Zîü1'_öã[¿;gX.š–oihlÒ˦>}T®Ff¸¡º‘ ‡Ì8yâ}ûî[,psÄpçõŸuÞß½þâãʲ4tö1jp‰khŒ@ÑÐÉßøöל?½_t{<^ Ë@ñèÇ—÷.p%Z²ºuʃoš&_…îï™:žuEøA*Cüâë/Œq.ˆc,€¢MÕûk›â }YEùY(EdY±æÆš•]TteÆCõ Mq-§0/ÛÊŒ…ëkëš"qÐ<9ÁÜ`ŽO)!QE[êkª£–îÍÊÍËËòhDŠU<ÒP[6eN~^–ÏòÕYÝXݘ¯$/©Dfnk?LGLٌЗغbõœkð…aÆ)yKÔQ B*M)v¶pDT ÷ÑþN)'ù¤ÀT‰Tª]QL•¯H%ºFQ;µ¹“N„SX²º1Ç’˜¶¤Õ¶¬Í7à ÅJM“¯ŽŽ 1¹ÃÑ_¾T–¶Î€ó»1‡ýÛ,´ç:vðÅ¡¼å…|‘^ØÆRBTl›ìjÓvHZ{§…­ƒ_Ò×´S&‹ZgÂ}¦L•`ÇLô?d M[O±•)ؾÝFk7h—’½¥ì™²gÊ0 Þ)Ã0¬n Ã0¬n Ã0¬n Ã0¬n Ãy’1ÍÔùYHä±l8"„az®´Ù1pD‰Óud"`Xݦ‡’”PJu¶Ü¤©à>V7†éégkÜ‘qNÛ´ÁêÆ0L§S ¥L7å:CF•RéMoì™2 Ó‰†[úrçÉM²¡-©nì™2 Óezw@ËÏÎ HH@€üÏN·vBª®›Ò#B†ù*JØFµ(}‘01ùAW «Ã0_ $$… @ NVw;g©ý-(èšô'¬n Ã|Ii#ÂV©B¢B äx¦¨«Ã0Ç‚SjOàí$²GT`ZH@ •BEd °@š‡–tù+½ Ã|ÏÔ,e'ë$d(T $J%D[ZTÈ+²|è…dG«Ã0]¨\­æÅH› SV =¹¢Ós ä°$X ôÚÙ¹ªnaexË”¼3Æç„GÚ?euc&CÛì\ìÎü7ä8¢Î ‰N˜GÒÍ$" ¤fµµeYͼÏ[>jÔbÒˆƒNà9ò§ÂêÆ0Lš¸9ñj /3§bL,'eO)€Hc•ñ+š>Yݼ$lÕ’Cá"4L`—4ð³º1 “"MØH9©R€H©© ÚH€€h`tcËŠù5s÷[I#å…>aù†'Wå#JG8Y݆éj…ä‰æ4Ñ"@BB°[ÚP! DÑ¢šVÕ²°ñÍ:Ø%\…R¨ÐÁ±yÓGåLÑH:¡q¬níXË©ÉÔ3ÝýƒÎ¨’–}%5q[b¹£ÙÛÒæNLï›0Ïí»œèO®µs-$*Ón¹íÖ䀕þÂ<؉㜱~iµj½gûTEÒ7JÒ“¼È¼IÐîMi]ÚAUŒ9˜wÍÈ%;\ ˆLB¨#¢óħ¢Ý,@Q¯ü¨þ•ÕáQˆIÐ 2@Y4*kÒ¸¼éEz?ÝÔEÃŽ uKå½Kk@ì`–ÈŽKpf¯l]DªÕ´Ãƒ"QÚdÀv˜6Ø—œü×inMnï–Úóg¶?éeëÌt_tru%Rò•( }b”œ·¸½TÞÁŒDˆéò&uP@«mÚ)-]™[ï—6c)«Ü—ðL(Ò€‰ •­~„„ ¥¥×¨Ê Ï/ }`IÔ €€å7®tNo}¤$ÚbˆØ%C±Ž1Ï”2 –¯`¶÷±ý¢2¾mýëCM­Égâ`~¤(sσi9À¹~¹K‘¾u«åŽžÂV‰k—™YC¿Mp€ÒR¢f'*k=!2:®9“ô8ÐÕ¤šTm‘èåÕ²ì_x"…  ÆÜ» þåe‘÷ ×@7ö–Cfœ7*k² eX$„]V—Œ4=6Æ*¤y¦˜LÕBe×´þyO¤Ïsìƒdà" !&ÿOº¾˜’-D‚Ð6Ù9 30ˆˆH©¬]j¢Þ‰ZÃÁT:U,ØõI+ýãA^‰ÔEHTÇÎ\HI{’'-’8µnå¹ȱ´ëkŸïÁÞ¤ô2’ò$ëmK£Œ_L«|æƒÒqÍ™Œß @ç7c[úð…Ý÷íŒíH~ $iõÖþ÷›_\×ÔMÜ^å%'—õج‰@†E¤ @´£Hºè²kú¶ãB;«ÒÚÒÚõYU<ƒt¹]šHêNæí3Í)³bá°n¯K“õˆ‡ª+kB2§W¾V¿§ZåýšóêÛºF ›¡Ñ€ü\ðêŽ}î<HÎK†€Ê€úzhŠ@V0¢[ ¡¨tûЊÆM=˜ôy4 „p¥µ0‘#ÞmÒÇÒÏÿüoåM‡]; Ýû% ªÞÂÃ2-ÃÇÚ§†¢T* þòú@þo]­ÿ3„yóæýü––¹óKÇqºw‰‹u¹*êD±ùè?®>é¶÷ˆ 7ë±ÍAìv‘tãï:«Û³öëµåBJ\”Å ç¾5Q¿å­‡.9Lû¥9=¸`³%1';ÅÎ(õ­e Pnú–¼»zcBóYÜŸ @°²¿!|²Áp¤¦àƒ%_¯uæ¯\³µ$,µoR” ÚŠŠ;ü^ìΠóq§( Ίƒß~ðÆëï.«6Ådf&óò½Ÿ¾÷æ›o}Þ”:<+1Â$ ë|¦ßì¹h.8çDÔ Í¾ùbÙ !¥o éðè!"WU'V}ºè­÷?]±vÓžÂ3.!,!6Òj@ÆÛ£ã_lQ@8÷­üü·óHBv¿¤`N»iñæB¨«dÿŠÕçmqIarÅ÷Ïÿõ‡#ŽÔAQ6=£¼ë5oQd•k¿ýö’¯–®Ý”_pÖió ;uNÔ¨­³ðÚ“aŒ+à-—Oœ‘ŠB0¼¿mAdî)tíßÙ¼ª…Õ‰`²ðàÁÖqcî¶ëÃ)S@䀾7%B§Ó¯´CÍ/æ™úM¼Sôº‹#ÕÅjóÚx›ó‰]Ü/ в÷ËÅ/}´ùDƒL„ÀúÅ6G¤£Ø採ïØ°ù«ÿúíÎ |>ž@p&Õm^·jÕ¡Oím×,iõe€  ˜ §ÂòMp¾ÅŸ_@àH|N¨/‹„sÀ¾åøþ§X܈¢ÔTz|ÿ–­û;z`÷Îmª<¾'É? Þ¾Ày ¨ÔaJ€sDh9’¿ä¥w¿Ùr¬ÖC³Á¹cÍâ—¯9^Q/1Æ8ðŽ®dÀÇäÝL2"@óöE¯Îyg×y AH„À™RKeÞ?çÍzvÑÞ ·â®+Xýá3=õÎêB/Š""!B›¿Ù‚ä>öD"A@D©¼hߊå—·øÞsxÑmBÄ.w©ÍeÞã[>xõ“ï6¸¹ÔttÍšõ›4¹ewb—kˆ(òŠuóï½û…ÏwÖyTW]ÑÒמ¼çñWwÖSA@ôÝ鶧LsQ/i›øõ ˆ(‚h&V LP8Rà@¹Rî=µ§%ï<« Í`ɲŽrE`W TFCÁO/ø;ê^É;¶¬ ð We·ËåòÈ”#Aâ_u„pF½n—Óå–UŽ„øžY¦È²¤0@N·Ëåö* a Àëa’G•%Iòª” 2Åëv¹\n¯¥ ÀG¡€À$·ËåöRŽH2¦ª²$)Y–eIåœ1ÉåòH”„šñô´ž±qQICî½mJ¦u¾UȸÇ.7¨ ¬v½Ï' W½Üé·—3B€sð: æ,DõgsßãwÜž2|Ըɗ ÈÊÈrå ¡if£ŠìñH2¥ ö¶ˆAªx].—Ë#3NˆÏŸâuUåÇÆ<úæ‡ón gŠ5$Œá³å³/O8"A¦¦`€8 €*—Ëér+”B@‘=²WR¨$É’äe€3¯ÇåöPàê…3ß.^¥¿ìñ¥ë6mÌ[ýñK÷§ºw~üÕëPdÛ­°ö|(o3`‘ rêu;]nIeÄb²DÚ­“ÎÏ×À©ìq¹œn¯ÂüU‘<²Ê|ƒwK €àTUdY’e¯ìuS­aV{ˆM/‚,{œ.·L9ÔïœÉn·G¥DØÿÆÓKÉW-\²*oÆÕßýÇ]g7/~mi8•=nY¦ôÏ/º‹ÀÿgÏ}}Œü†ª"¥Š*¨*WA­|n·cõ9é¤tf°´ä^zU°>Œ£*$ˆ€H8!>ãÂç¤ýë&ùç»ùb2~†#„ k®:µgë¶EUŠµGöˆ±c÷ 5 ¨8jìÚ²½àdƒG›6ôòËFö‰± ª§x×úü“­}†ôQ* w”ª!É£Æ10Y9y`ýWùÅÕ’kÛ×ßÄ[,Ó'ô cU‡·¬Ý²¿¢ÙK‚zæNœ4,=Ö( îšSë¿\%õÑ'¸6[ÁÕ–1rÒ„ÑýBÔú]_/?PâáºÍｪÞ1ûñ¤ŠOÞ_ã8ùöiýÓSÃãÓ²{…˃ÒÚc¢€+ÍX› Û »?8d@`nŠ'aÓF(¹€æ0z9ŒÍâ´ ·oÁ•‡ I‚Í_’Ôkí1é½RÊY\t”ÙÖèu…ÛƒP.Û½zŞʰ1&êh%É€ôÂÙ£Û6o+,o æ˜#/ËšJ[Nn\“—Nvšv¯þfUÈÄØÖC{5Ž3«>þ‡%hæÄÌ‹§öPþÆ­Š›%°'˜4í²ôh3R „H-¶¬Û~ôœ‹ã2†M½"×vvϪ/·×8lùø]SÍ]÷]ÙÃ}ðÃÅy­†±<:´¹¾¼ØsÃʉÖ„œrí5ÛW/È«h¨V©­dí·«O6$þá†ÉéqªPÐ}"!ª»þØ®M›v¶šzdïçP:¤P¨·òTAþöÝ'*[t¡‰9£ÆŒÈîbëŽm]¾©"!§_«h×¾™3füØ!i!F×¾eßäm¯h®p®ývYôÄd/‘Ëç+Žýx ¨Â›=zÒ¸!q¡½ÀÏ|÷åêÚ~nœ:ܶaK9æê§ï&"„ôùã#·>·xnéž3p_rkåÞåË·)‘c¯¹fh˜» jèä™"G ÀC œ¸YëaçΓ­MÔšn2"d’U´3Æ8RÀH{¹=ÿWαøóO oË%Q€æ²Cß¼õÚÛŸ­/sÊTCû]5{ÎÓ÷NË0º+·~½è•7–(obÀÅàä­w<1gæŸD±â ßüý;SƦ¹«K ‹*/HÆœkî}éïÏö>{`íÚ‚s5nWõúq™×ü!·lÇW/=ÿæ²}2c/.ß|lÁßžžÚ/Ú]s⳧ž(H›<"áü†=•Þ–FSÒ¶yï¼~ç@<°nѳ‰ïþî|mÎý3Íûþñ×ç*î ™”k:¾…½w¤ùìübiÐ]l ´òß’§_ êxxôìÁÔ¬*Àçã÷;QB÷ÜÊŸ{¦Åâ‘ÜR„qÝ÷<5þü(‡`K ±zkªÂzõŒ ÇÞ ß¼þÚŽ>/Ä œIeŒ (à…Sùüíïï/ÛsAV&Äöÿð¼wæØOîÞµóHµ§AݵziZï•;Ÿj‘š¬(+Š˜vËøôð}ß¿1ÿÕ/öV´S©.|ó¾Gžù¡ì0=m)]³øÅ--j=u+¶ôbÇß®Óü~uAƒ`÷ò¹ùÊ{®ŠjÜõÆÂçjBæßó—1!q×=0s\V<gª·ñ|U]ƒ*ºšü¸ä¥¥%cRÇŒK³¶çtQ$JSáúgÏy{ë©FSHh€á):1$jùÁµïüÇ|–wÄ¡pÊõ)#¯òéY7ëS·?ïíç–g¥Óû‹jššY¬Oÿý…ÛÆEœÞºaçþšVoÝÖU«ö½:ǹC_¼^´gQC}”Y´ð•Çož$Vì_²`Áá›-9ㆦ÷ºî®‡L“zQÎeªT~¦†éL=’¡©lÇ¢¿Íwõ{!wê°30ößPSÿ»z¦¾ ºO؆TO˜ÀÜÜqÞ}f¯#Ï­!,QŸ::ôŠp]ã ;n­Ð&‡€Xô_‡Ÿ=«€„   ¢»:ÿ“W_yw½mô] ^x|Z†éøêG›ƒFM­îûlÞ³¯ û—¹s¹}BhÓáo¿Ýäê‘=f@²çÄÎ ;vk0 þÀ_º5ËPž—T M3éÊËÓ[ö* ž<{îc :±ðÁû?/ïyïœ9ýùæ+2Åü¯¿. ™Wæf蜕;¾ÿaW½'nØ5Κù‡ì ƒ«¾Þêì9~â”ËGET],ùÎ÷^~öŠ¬¡ÍdÀÔ©£“‚¨}è•câE·¤Fô›:4N§œ;„ Ÿ |á«ìÏSÎáÚm@c`úÕÀá£9dѸñ6ç>>"ü€ù |êM0(„sàá¿FoÆLÆ)é)‰qöàˆ¾iiqv2&1sÞ9cFeÇGX€3A$žªo=ûâçG2n˜ùì쇮Y’¿lÝGÊÐÉWLê+4íÛåèý§Ç>zÓÔ c{:J·ì5\6ÿ¯ ïºbh¸ëÀ“w=z<üº ž¸ý†kš.~­~ø]ã{ %ëþñØÜ]ƒg,œ÷ø­WŽ¶×ìüzCQÒ´{šÂ7äíµÝ¼èݧoê*e‚%yÔ¤+F%‡†%š0"!jOìܵsÝw_®ÝU7ìŽož˜bR©ÊƒÃ{˜Û/:HϘÿ½,ˆ¤¹8ÿ­Ù³V4e<öòß¿a°¡îàê·9íéã§L]µäµç?ÞéȽí©çž˜qyŠp|ç–cMÖÁ£FZêNíÚ³aGqsïÉ·<òĬ郭‡Ö~·î|XnîÈÜÑ}XËî£$ûá¹/ü);âÔšïW,QcGÜþÐã÷_? uï?”Z‡ŽÞ'ÚŒL• —MžÝoÔØËF¦ŠrsÉ»woþâíNÙ†Î|öžìàŒ£9&sXîðìD“à_ÚñvqV¡-µÀ9£µžŠbùˆÕ`±rÓÇö3ôdeHÈ šlìçëð†Ü/üðÕœújµÜé%ò+g~!E BCeáš¼ý­1çÎúÚ¬ÛWWWõi­£¢¦üøÆ-Ež¤ÏÏ}òúL`tº½îÆGv~·æØÄfA‘ˆ.åÚ‡Ÿ|âδ`¨¾°¹pIuQ•W´öj1¦6(²ê“ù_ï2M_4÷ÉÛrC "Lì:Y8kùºÓ³®Ì®(44ë²³\“ª}z÷ò……eUu“5 1Êd2ösùh#“²ïxéyÕd³YL±ã¨¢Æ¥_ ¨.(. û[ùϳ'ná88—’íjKñ‹m0èn¶ð1.  úF|à;²ü8},2S° Œg À!qÐÃ?%áœRªF_}Ìf >¡êË Vl81ê–¹óŸc†Ž™ß±e÷É+r2û¦FZ‡¦ ÌNŽ1BFbl°É‘4t̨^¡zGQéá ]ßë¦M8¾GˆÆF5 Ÿ›™‹»›–åUYÇ¿ùÊóÓ{éœ(iÿï-õμ¾W°yÚСYIFJÕàÁw?ÒW¬UåDÔ ¨8ª W,zæãíç««ytî]Ó˜µ÷”›Ït‹^UÕ€`E@pÛ²zNyvÎ_ï¯ÈM³µœÚ¿ø,׉JuñÑ݇›úM¾ëÙ§L·ŒîM›šï>|âìù"‘›£ÇÝzßœ9WÄrhùÉ»¯Ù{üúᓇdõŠ ª‰ï—Ý;Ñz$EˆË¾ê¡ù³®LÖƒS*Þ´úŸõUÍJFhþÓŸ«-QÁÓ\±æíyKU:u¾ïŸî–( [ìÛîÏd‚ɦF9G$¨™o—”<ø¢%… “=Hi‘.Rò+Õr‹`b¡Ù¦Ü^†„¢Œ@8v’’øDC&I¿/Ï}aD$®æº#'Z¤ ¬q !Ö˜Ëf<ÙhK„²J+HÏÜýSà Ekê˜ 9釶*n¨IåÄ›;.-*€ØBC,Aª¤ª*‡V¤(‡G¡îíÇ«\܆å{>û ©L4ÏÔJòÙíÇêi"€HzgfH€BxDLOá€Ä¼2¨Ín/¥ÌQßÐcÒ™ì‘& ª¢P@DPˆÌ…õÅ(Æ°AÃ|HÁž ƒ³ùîà24âYÌpÙûÄ%ƒQ‡¥Mà©á…ù7A‹¼¸[BTUõ ÏÀ/ªÔY‚B­œQJÛZe±†Š#Å­AYCÇõ 3g€AéC/º­ªìD“+NñPêu¹E£ØêõÊÔëlllRR¬F{Ïa½ì›—¾úŒçÀ°!9ǾçÉyÖï…]‡Î4‹(Þ´äu&Yýi·£öÌ©c•Í”ÒÒØ꽎ƒ`¶‡›€ªª¿xVoŠÊ1媰úÊû÷/ÿä‡!É3ô0ÙMÀ¨ÊÚ\‚@ëê+•õ½uà`=c`M˜5j¨ù´[¥žêºêÊ ±âäú¯Þݬª‚ >]ÛXCkj«%ÕëfQ#† ìßÃÀC6´V/ºäd]­C wº$ÕëiqÉ’I•519=wP° 3ÚÂu’Ä$…sÁFNUæχ¢ÑÞwääi Íiû×äíþañç#Ÿ¿w˜Ao²Í@©êWj¦ÛO¤|ŠBl¦à`)¸ÒYª‚Ê@µRKosV–u„MŒQH8hS¢¿öú·€ŸÝ°]ÅdùB ^s0T™š¢úŒŒà?´zZô!á&ƒ€#猙¢Â-FÃù7ž‰FÑa&þ~w\Dú€(ˆ"44(^bº°ù›Ï÷šDß7S·Ô³¯MR9œ .Xo´0@@DQ äö´)é‘) ¨0Úžx`Tw XD°[9g`SêÀpTx±h3¼»—Pæ7äSú]@ ¾ð*¶©·0 õ@DÎU¨ß@'mó:ªe£ÎЫ‚^g æUr«Wa$ žðO2"D$œr}dάù8_úçÆï?ÚºêÛÈ„ÔáWÝýè-“íJs+w5Vúê½2Á'Ôaª;",6Ü@B PEaþª[ÕÝØ*ë‚í¡™SïÉœ"7”î[<ö¢¥­¹zlv~ *ª_²þØ H^ÅÙÀl¡¦›_Œb6[cBù9™I´¸<çÏîXÛT¶9ν^é‘©7 ªÛK 1a&»90@Â,:«ÙsÁ£HLú2±œrb1íÌŸ(E†0Ue>ex]‚%Ä;éyd÷¹}}ë®zà‹?½áΡCtTQÚ|0`Œiìö_+*ŒÄdB‹²*0mˆt¤ÿº §qÙvÈŒ‡ÔnLý.ý,A@äŒRÆü€Ñ+DÞX}î¬CÊ ±ÚÔPVZ‡¶(›Ids÷e#„–Âåß쇱×\wyߜ܉øóÙOæ^½mm^ÍÍ7DÌ:bÊ36YéüÆeù«ÄÍ   Q¸ªÊU'7¾ù˘rSF˜ÈIöRÐ[ FQ$œR•ñ@ý)ç  ŠÉ oÊ«#3â“úÁùƒ¸rNzŒ]•RHpºAa­YŸ4žˆi)ZýÑ ßžHzàñǯˆŒrÎå¦èôkn™ºcÁÇoÌ{æäè~¬jïêm%)WÎœ86Uµ’×åqëeÕ¤“Ü—Ó«RNÂÒ®•ðãÊÌò± AÂù#k×bÊôiSâLvݧÛúÜ'smØ7*R­Ü²*ÏÛkʘÜÞÆÈSá&ÝŽ‹Ÿî½kRXÃÆ9¾TòèÖ5÷$gNºyô§ï¿ý̃5{2äÓû¶n;,¸ïÎqbœ5y½þچʜ—Þ|blï`Fߦbû›þç1[ÞþhÖ}-Óàðö;ÎìQÎ'„õ0qRÖ¡|y¶cONÜ…Âí[Ž9ßtGÿ”pzJ!Æ÷ï½€§G¥6îYµò°pý©zWlöhùlÁÒO¿íy}ŠË%yÍ TºÊ^·EV žÍíÞçNMêåÇnvÿ¬ékŸúêÉž<<9Óä­Ì_±´2!÷©oî¼òTÞߟ[,÷}à•çnL°¢ªjÍ.©é,#r‚"‘EP…ä þ¶À8#\ðõ£ð§D-\»´tý]z¦þœ)pÆT4†f]9cV+YüÙª5ߊÁ±xð®{þ42RÆ>0kžðÖk·¯<<4yܬ»½udªÀ\úˆØ”4g˜Íä›!Á”Ø3‘ņêP…ÐaWL˜zêóµûwm-™2kÆS/ ùí¯·oþ¾€¡©Çu?ùÄÍ#í"\Ð[c3²,1!ñµôBze¥Ç™‡¸1“nšXøåîµyW=þ`?Å£=’Ä:°32ä ̱üº¿°&F–íÀoôÐ7‡Ý”Ž¥Œhƒiñ:_äá×…`´Ã5sèƒwóP—a Φ*'¿cþ¼ÆW>Y·îË“ÖäA¹wg+/¬3› ‰WÜüˆ›š>[¹ë»/všB.»åÑ·]•d‚"Ùå¤Ñã¯L·ëò¾9è!aX0ëÚ‘±àÔÚ;ç—eœ/:²ù؈ȰԬ¾á±&½às„¬áñÓ”È =.Ë^x¨ªJ^–tËü—\Q~þãúŠ€ˆ¶Þ×̹ã"9—9“Zë+šl •ð]3ß.í~"#X#I|O]k¶y¤ ”«„ Ðøzâ´Ûn]Œ¸ù/QUõ0ß]!¡žæªò³Uu.]pTbrB„MÏT ‚(‚ÚTsîì¹—*Øcz¦$D™EP™â8®ªÞ’Ø3Ên —]¥eõÜn5‰îºòÓgª˜-ªgÏ„0«Þsá\Iie‹—íÑÉ)‰!&s.»š+N•¨¡‰I :@B¤ê³%çš)© a6=uÖ—––Ö¶ê{ È´:O*‘ã’{%ÆX¸/èiûŠŒÂ[뱤ÜÑq`¨wAl,ØÍœ›±ä 4¹Á ‰)<Ü„ªL†*¸ AL2„sìЦA$Ò‰ÿü`UUÖÄ»o™œ"pŸº8A¹·¹²ìlUƒLö¸žÉqa๷¡êLY³›m7éÐ[}öÔ9)(9.ÚnÒ#DkËÏ”×6JT°†D'õJ²ë©¢0t„yêÊJÊjšTÑ—”ªGÆ‘xêJN–ÖrKtïô$«\{ìd¹Kˆ”#2@dŽÚòÒòZ7m¡±ñqáV=cœ¨u‡óÞÿ»ó±Gÿª* z¿qŽ‚žæšÒâ²&U•¦“jÏ·ØâS"ÌœQOKý¹òò†VÙ•dœüêùÛù.ç‰yܘ騨SŒáÉ©I‘6=§Œ#2©µòLIWŒ‰fõU.!$>%΢6U–ž®øžqÑaFW]ñ±ROtBÏØ« Ó‰ÜUqº¸ê‚“‰¦Ð¨ø¤ÄH£* ºŠ¿ùpñ–Úô'fÝÚ;œ¨Š/õ«q™¿©€(Š]Zyø„P*“«Õ2kN5ô7#ó%ˆ/ôò?ˆ°ù¾…1ök&t~~vóm/À;å%}Ù}ßa¦2æK" ‚Øv -Þ‹DN©ê› "ˆàT¥¾>$  ‚(¶ÇÛ/á?EUT¾`¸€Œ*” :ß9œªŒˆpª¨¬]»áS#2†ˆL:lÄà“¦Q` ¹¯wHûðA¥ÄgÍ " S‘vVÄûØZ÷.}oÙeÔôû¦öãTíЀ‰Ða®:†ÀEA@àL¥”s ‚N ŒRÆ爄ˆBû4pFiÀ‹Cì8C þiäTUŠ:Ó…H:Þ0àœ©”"!ÌU–ÿõ;Ÿ•ôº÷Á#U¡íŽ÷9Ÿ`T¥ "´Q•¢¨#E_½pÛÃ_ xò…Wž¼ÚÞa蜃o¾ÅGi=eÏ™ªRŸú¸ý—¡ vx¦€Q•r@BäÚ#_/ùì´í²™žcPÕ¶ö<»uf7Ÿƒékü‚í:Ý€»Ù©éÃÿ€¦þ%ìö TÑ·e”6.gTe]m_@ôÉB/Î.rêgÜ@ã;¦ª¬í¬Žç OîÔñºþK>L$¥j[j¡ã9èÿ.lßcÁGcœs_£jJ»·Þù”.~:ú¯Ùö{Ú7šñwì@ÖT^ÕÂbúædõ Fîo Ù6T~‰)ñωÿòŽ¿ÀwšÚuŠÛž ®‡|G:|"´Ï‚Ÿbº\ Aîr^(k 2:'#^äTõe{:6ɽø´¶ñu ç øx“QF)§Ü÷ªáÐÑÅéxënð¾PUíp°ë 8GBP[êkºÈœ!YfFX«Áu]¿šQØ 0Јš»¿5íǯÅn·çàmûºB·ìÆ/j¹>ìü¿¸åa—~¼Óf2×xàØåky—Eè/$Á6ŽÆKfÍ»ŠVÄØ~ ïÐ@Ö7rF7ĽþÑd·Š\¥ ;g‡»Û»æ¢)€.spÑLvÕ ts¨ÓÞ9]æë⮢œr“-õê»ûÚ¬6#S¤íŽ´w;UØýˆ¨7Y-F½ˆÝ ø©«µiáâM€.êÿ‰¾WpÒ[îiµØPUb`ð›uvk›ÎN²Í›½âk¿mrûeân ÒnìЀ÷ÚåÐE5¶Ý}ÐeåÂÅ ­;¯î®×¸Äˆºì6wñ.]çmÛýµÒÍ>~u¿(ô™*ØuÑ^¼Þº“‹Ù«»&îØ}½ÑEsØyÅ‹¯ÔF(ˆ‚Ïî@Œþ³/©ënx>e±ÐX´wýÖS‘‡”l䜵Q-^rË°‹ï&üäóÀ‘Ÿ·M©ÊxG[YC÷žiçªQ_/Úÿ²uü¿AÜMÃOÓ|';©Ãv/¿YCââmnÚíµÿÝ°e¢Nç(*ÿŸ‡rþ7ÓÞyóVÍxë>«ð‹}Ëÿû¸›†Kø²]›ùÿw÷Xþ­2\lþþ_†Û#fäÒ;˜þLÔÖiçVÔ67ý·€ÆnÿŽëú÷ox™aûn[Ý}ø¢œçÿ2LoÖÍG4vÓ ág¦œnY_c »iРáçvä5vÓ AÃï„Î:EI‚ó…:å²µœ© š½ökã× @íkРáw Í3Õ áßÝ3ýÕä1ô¿Æ7j¶› ÿ¦h«cëZàøK’鯩5Ôân4hø}B³Ý4hР±› 4hì¦Aƒ »iРAƒÆn4hР±› 4vÓ AƒÝ4hРAc7 4hÐØMƒ 4vÓ AƒÝ4hР±› 4hì¦Aƒ »iРAƒÆn4hР±› 4hì¦AƒÝ4hРAc7 4hÐØMƒ 4vÓ AƒÝ4hРAc7 4hì¦Aƒ »iРAƒÆn4hР±› 4hì¦Aƒ »iРAc7 4hÐØMƒ ~KøOê­Å= endstream endobj 882 0 obj << /Length 830 /Filter /FlateDecode >> stream xÚUË’Ô: Ý÷WxGº.cüÈv< vÌô]Ux÷ÄEÏMšþû+[NO½`eY’%#Ûbä0òa÷ú°{ñ^椢U.rr8’B"-iZIrhÈ—änM­œÚ߈¢LþôˆÒ‡Ù4zÃYò·ºÓjÒ¸‘TP¾ÿvø´{wØý·ãŒŽÁSZ°‚ÔýîË7FÐ"ŒÊª$§àÕ“4/aíÈÝîóŽÅBåP£"—Þ;çdÃÊÛ'HœÓ*ËÄ‚‰3Êd˜ÞšÉ©¡Ö¡À%ªV<0r#Rˆ™á‘Cë‘•iòcõžgÉùäE;6hh– ag&\=o¥LFÝ)gö"K~ú£Ñ©¶ƒÓƒÃMoó•1gYB÷7)v Ôk5DÑ8 j†Æ·F¯S¥1•pw¯ÝIë¸q—h›Ì× 3ž$)PƒG* ãë—å* hG]ëÆ h3 H–=‘Ô­šÐݸEµœõÅE]¸dëL›àEÒ+W·!~;Êëë΀[m{SŸŒkcÎk€{@¬œÏàÃód˜{ o7?}/U7k¨BTe¬bmÀíÙÎ(> stream xÚíÝ@SY¾0ðù¾ÝÙ·Óv÷½·»ß›}[fÆJ ôF¯ÒA@©Š£ (`Á†ŽÝ±b¯3ر÷ŠbCD)Ò{ï=v¾ss“˜„À8Ž3Ãìü›q“››{ONÎùßÿ9÷& éd2­‡²aVÑñ$þå²_H% QlµåªudßU oQ :6.“øÆ22 ÞáŽd’Þõ«õ~ÿŠ;«V¬Ii?Qiõ?_’Þ½`"×é!ݯ­¿;Ú€]Ú#z“ýìŒð°œº¬+s…þ(‹ ÉXO¿=zãå[¼´éöæ[/j´¶~CC-k|hð—1gšÐÀ£ÙcEi¿úŒç(ûo²‹“+ƒxž3^}=îÜ|ñ•*k¿áÄcøÎŽ£MÃïʆx×ؾ Û;~¦Ö×–Ño›ÅåÐiÆÓo’¾Aì#ç0*8ø`(Óù!* _ò™Óûu4É­ ±ë®âk\ËEƒ¶çãvôõåï_qB÷ñ¬á>…aQÖ#Ôðeƒ{ƒ¨!iJèW¨¿ÁÃ< qȼL×1Rö]I‚Æò« ¼ì¾?Ô1x˜ <äËß{¯DýÈL¬?ÐhæT&F‰ëÂô¡Ç1£ÍJ4ËPsÁÏÐmïB$iMõñˆ”‰Úìý«†xÛZ%ÌþÆ•é—(® kíŒ=ÛuçP²¡ò(Ùy‰®–§^-2ÍwUîC¿ìb±üqãl+£g*~y‰ì¯kØ"º½?ÖŒA1a›Å_ÎT,—ôYó%ŸAa1Y³Öï ËO¸†\ʾooJc39__ÊÅ » îÐè&ıÅ@/¡I:-ŸÆgQÙ\³5ÇSEdsë( R)ÙÅ9K‚˜ ÿy5Ý’æ¤ñBƒ;-¨­èª÷¢‘ØÓѧºYʺ€É­H&N;¹ÖžOÇ/§€¨’6yT“G›¢Êgácc々;ºEŠ–%îiØ0Û‹M3LðM*êÀKËEÌuäy,½M¤Ei‰:£ºK;˶-vdÒ)VžÓÓjúñ°<5ÂÛ—™oívâa¡¼Æ$Þ6ãö\Ïß=‰Ã¦™9¦×ñò'Ñ:‹ÁeÓÌ]|%8Ï)y>Ñ’A7¶r ~ZÖFn­ûVèî;+3O¸Z2˜4úâoà…WB ؇eb?#!é±)\ÚÌħÒU6áKlÅ˃ƒqYû•Ñë}•Àm˜Xô:ÚÜ\'0›ÿøü–Y¦,#þ„À¼NQÚÉ56Ž™óí "묽¹9dS–l Â{þi"q*¾cB5xÙ Òêšíå)¾¶ ½ózV‚Ž6xáhºã¼døM=µÞN@c2Œœ¦Ìɪëu”›sŒ¹ƒj¸.É„ çø°iFL&gþÎëýòO_&ê²á;û8c„›E³tËm ÷XŸqz²Û„N ˜ß*”’ «ž÷¶aÓMŒ=–Vw“%.âüÍuw±v†›´›f;q€ˆGÄÊGkØœé]•^ݦϵéK¡ƒ¬QBûçOr YÖÑÙÙÙ^à@ÝóI…1îž‹öôvwu4ožÄ7›u¯Yw=ˆÍa¼/ Ûk3¬™7 „xõikhôк~±LÚ>ÛŠ=yÃåîÞžîÖŠH £ ƒòðÕSÊa3~Zúúûû»2,c¯¹ú…h®ELKŸP,C}­Å;¶ooì!ra‘ˆhcbAÊ“—Sìò:»º{²/.åp=ëÅD´¡šÐÎ «Úºz:k–ÙëYÆÜ$v$­ äУO>ëîêªJ?eÄd4õIÅ"ÜýeR±DJ¼ßîšœø]{;û¥šƒº|w*uå­\ E×¾Öc:–ãŽÝ•d©¯¿õ~MWwWOSº}ô²ËMøðäÉç8‡Wu …}½I+|˜~+ñ&$ý} ü,çm½Üß×ZoY~ZÓÝÝÝ\p΄r©”ØõÀÓ¹82/OxÚ×'ìë.õbÞõ¨KÒÓäoÅŽ¿’9 ÄTöòÜþ=W2É°&–剈¬Š6’¶'¶´qgž·¨ç6÷÷ºñÌ-ž–5ˆ%WÖ;ó,¬=-èg_]Ã5õi— Y ä6‰ÐZºcÇŽFÍäueZ¯K.ß^ݳD|!£Í·±|Å)DÜ>:áÞŠ+·«³ôÚÊÑl?Èú ÷x–‰¤¢ÞPÆÔÍçûzº:[k§Yq£>z]í8\ùõ½ý¾žËÑœ°xq_ÙQ®!÷^IkWWûµ8[ºÓjüþKîÇsY‚çU-Ý=½™ÖrÍmj{ðžÅIû7žÌhÕj»÷-±ñš-•)R¨öÒ$‹UÖ‹Ú ŸlÛ›0 …Ôf¤iŸÄý|_¦ˆLR«rÒ¿(µåY° VŠ)lËÆhþ31Ž6ÆÜ™dž/îs³£J*ÇÏw¾øšFÃ#÷¶¼ëL>¯YÕkLŒ|›цy*·Qq½=UÏf nè¯n,àZ.jM~j–OÔ×ÞÞCÜèèªË1ce6Hp´12f©ê'Woy¹Eu¨£†'ÇéæÖ"2ùgÞ¹ùªE8Ô,¢úŽŠWÐ\C”+ <½u³´[š²|"#t£*O\è<%?ò`/=ô@±8gý(Vˆ¼€hñ«Ø8}’] ç[,¿¡ÚøÆéNëÏË£M”Õ·AYŠ(fì¾,$é ´f﹧9’Òî)òh; ,ö2Õ?ô¨Zk$u¯‹™Ë:‘üM=ØÁLh•z]%¹ ºœšj¢m2·„Ò=Â[”¯éëé#îV26ð’¿)i{›< HÅ¢þ§ mù1 ÊhÃÜ|)›Ü›ä٢Ѽٸ¨§‚L6§)Ê iNNÂãE´ÑytÀÉ&e‰ú&³G²j‡ë]Û9aÒbUPé®~Âg›ä·ÃHj¤’dYŽ7¼Ù¢ñ¹tU_ã™°_õ"娻ØÉð‹£5D´¡:ÇKC-¡‡=ýÀ­RõhSüp?‡Ëôôòð&oŒÆ>éTD›‡eŠ©Ä®3ô­¾©G›¡ [rçù™óÌ,=<\=Ü&pYÔguùHʼHžfˈt宀N}Ù…²/oØyõJ¾w3»²1Ò6hžFû”I·8y¯=ªj·)— ¼BˆhãÎØtö•bµÂÍ£Ѧ?֊ów˜ä­¨Ýqî×d´g¾X5z‰d/Ü“®m†£åÔ(ª¥ÏFÕ\èëh³ÇÙ<ä,æ‹íá »¤dRù˜ÃeWt½Q}<:¼ÜÜ=D¢ìÒYûœ´¢ »¬žæN7øÂ-`æás7ë:ä"e´Á5öüòk6ÍÞÉÑÓÓÕÙ‚mý­"ÚØÒ’+»y7†.BâHŽqÔÍ2Í"4øSõ,\Ü}äUçãí&06œ~.g¨ßÚ3ÏÞgžT‚:+òÙ´ÂNèÕ#•4×Ö`Ü¥i»îšÛ|=·KÕ÷òôÇ$ÖË£Ó¶a¢MYê7`ÁfìM¯ÓÎmp´ =£m”Ñ&G›Ê7‹6©G¿2s $Æ›òÕŸl¶m^Þ?ìaEwªE›þ¶—l£+¹ŠÞž±Øž7W=ÚT¨G›$]df<ãr±f®ÕB»*½áä|î™ |·)Rå¼MÃËã\–Kƒzõˆ% µ·êlù‰&Ç/ô[´õVYñŒ®åtÍ@–³VOϽ mÓq#ë+Oap8ù­Šö!mªhîUÎÛèŠ6×çs-c‡Iµ†P Öd+XUÒ".“š!6FTÆþ"ÅY÷ú ´œÄwå\2æZT÷IÈÑƉÖqëÞdÑts£ž™OŸb…ž%L·ä”í ï´DÕÚ÷.rðš¾û;¢Í®$¢?­µ¥LÞ­8ƒPIN9'=T´ ÀÑ&)_óÚ#©8„´åæ2©5Ò·6CTBmÒc —^ÅHj`¥µžV´)Ͼû¢\¨|M¥Û8£Ëm8Ú46ðn§Ä\~q?yi Øž¯™ÛhDü¡?\À¡WœŸæzÙؼ¡£Ó(¶±•5 É~š#æœTÍ-Š±E¡"ÃEw–xáWáœÔH>%•qdÛjËÁcGv¯2¥xT?åëkü8|]¼~åÔOöøGŸ¢¡£M_e"‡ÊÛz0áqiçéXg¾{Èá3—.&˜ê@ Þ–lîæ^2r7¥- Ÿ¿"^„#5ßn^9;"vå–‚6EÄøráaU?¸9úÛkEÄäYåí%ÑK¶žÀ«=Œ_<ÿ9hþ¡°Øo¥ŠÄD¸m~𮕭©_G¬ºŽç\ÿ*v›b°S—w}þ‚Í}ä•Põù1ó¢û´û]oýË)ÖÌÜ&±Ö±G*¬ÙöÕ¼ÈYsO<,mÍܵî6~eRÂü5‡ódŠPv*n^ĜȈ5Û4*sØWEFFžÈîî-¸µlþì¨yK–áªïܶ|N\üI$ë_¹tÎÊkÊŽ…Åìî'ï·åm[1?rîÜݧî½N]šŸoY={VøÊm ­ŠPtlQغ›u:GX—.ˆžµdõö¢nÅÚMYW=&8v‹!ÚŒ,½½½=#ÀÀÀÀO8UÕlêm±§§{$ÔÃOX ÓLíjûGb%üpâžÂ)¶^Ý=‰úøÈQ[SS]]õ³ß::~º+ߥ¢¾ºFí¡EUUåÏ^ ¸ ?]F+é¯mèÔª„ÊÊÊ‘ÐÞÅ­º¶¶ß …ÐÇÖ\¥B{;JO‡ y­¥åä@Kàí;Q[**B))èÊ´aòòBŸ~ŠÞ{Oq»uëWW!­­¨ =z„.]BkÖ 77ôç?¿®’hD¼Q·‰P~>Ú¿y{+:ѼîJƒo[·þ›WH?zñíÚED•?ýé»+äüù0á;×`„ع}øáp]Iý6nš9•—Änõ®úÔúõèw¿{Ó 14D³g£¦¦‘j^½B\’Â7Áˆ1yòë¾ó›ßÊÿ}±X(0­Z…@ׯ£ÂBÔ×7rßÑ1h¢êí}7›uqÑ)8½¡RQHZ»<ˆnßFÅÅè§CFE|çŒ~÷ºy‰Åï&ŒCTÈûï£ÓÐÞC6òÚÀy‚чˆAC×®¸ð»pÿ"Þâ:Á‚?µ~ƒž>¹±üj-\¨8”ãL¦¦͉DÿùâËSqÜËl>Aôߣ±!Ÿ‰(ñzóß7‡½©µ mÞŠ¬‘Þ‡ˆ÷‘¢û[‚ŒÆýmÜüŽ»Õ’%Š IM%ÎnOŸŽþúûýéÿ1G¡È(”›÷3 ¯Ô÷uüò„þþÄü€(þ¤ ~‡ ÿöéã>ð«uýº¢s͘ñ:-Ÿ8 ÿ/¢ H!È°£ÿ"‹ðpD—.£Ò²÷|Nc^½BGŽ k.ú¯÷ãdûEIÌ>F”ÿ@<#´rÕÒñ0¬õë ûú¯¢|Š˜wm‹Ñ?ÞG£þÚ½åæ"aÿÛÁU›mhDÏÐôPôçß"½÷‰#ý÷‘Úp¨b_Y’ ñûÕüDpÐPÍT¨µUâ¿Ó§dŸÿC¦Sô?È,?y=ÈÂ÷Ç}€>ø-²2GW¯'hp€"ooð7]t,Q¼\L™Ã Ä ÌŸ?B†(v§Ú©ù'hôŸ•B\ ô;‘©ú×÷®šb\‰kcôhÕÖ:;;Ó³³+¿þZö_ÿ… ?–‘å!‡r¿Gÿý1²6'NÞáÑÜÖÃ~4äÖD"t`?óúçÇĈIU!8ÎüãÈÖš¸þð»bÝÀÀ@VVVffæÀÈ<¡~%ÆSD›J¯‰%’œÜÜ—7n4¬XŽþŠöïdæÊ ÙÑpšÁþ|€ôÿ‚˜c‘§=2  E‹ÐÑãèÈÑá®:¾q%F‡"Dg Wkdò2ú ‘´p?"&I¬”}¾ÙJcÐÍ›¨¹å;³ˆââbÜ­rss¥o}‘ÑßÄÄ·°KJJž‘23Ÿ?^…GXÛãÑ'¿‘ýó7D ØÈËiú1äÿGdôwd'@Lš>ƒ¸ùíàì‘ËG^®H`„ôÿŠô~83ixG¶xù;ôÑ{ÈÆ=NEª¯° óG7***ÊÈÈx¦„ƒ'´zðóصKѹ¾ùFÕh;::^·ÏçÏ3 jn'ɶƣ‰.²±D£ßGôß)¦ ¬åÝÍúd)EÌÿ@”ß"ÿyÿ3¢ü/¢þQÿ(Gãþ“XÈúO⤉áoçb ø…ÖÊíà‡øF}}Š#Ìÿ /ȉˆÆÆï 2¸gÕÖÖª÷©ôôô·üâöœ9Š Á£*bd))--}¦æE~~ÞrQ1Ú¼Uæã†þ‚¡ß"Ö û?";ü.>VÉ1¿%Þ,퟈OA6äd‰\mQ òvA“;šèŒ<‘‹ r¶@ætÄÖC£ÿH¼ÄäCb°fõ±;yÝâ*ýë{ˆ;̓ΜEª÷5ìµÁÿVWWã|—™¬\' ÐäÁÏ7KÕU7‘‘ª¶Šû)NÈ&ªêÂiééõííÄ$Å‹—hÍj>þ² >8'ù„øÆÿHqâØJ@pü±U»‘s­ä x/áâ?A†ï#êŸ×™Z ›Psów—È;ýýýõõõd 3äÈûùùù}ow]bNŽ¢B¦MSí¨«« WˆzÌÁ;jkSþ¾XF&šƒ8<ÄÒG3Øü?ÈßÚDþc«Œ¢Dpþ˜¸áHBÞ!C¾ÙÊ£ _^!¼‰ ÑQþŠø,diƒ|}ã°!—¼#‰pT!㌪´¸BÄbø¥Nð³Â£~òû Ÿ}¦ÕnqÊÇê-V>žÈ|ñâ…P(|ÝèëêÐÞ½hþ<4-YóÑGxxõwdò)û1ûõ{â6Zþ︑ޟíѨÿA„ü<З¡Äi ÃG4.yƒ…ïôöö‰ò\ìyww7zë¿ÌØÒBœÇÂãií·¥¥EÕ…UµQ^^ŽGm¯ †ÿ++C;v ØXŒÌ9è£c¢ÿxïd…¨ªeÜÈ诈óúüSôçÿDÞ(rŠ‹CgϾùÅNêu‚ã Ž*ª:!áÏ Çä·¨òïúI% RÅŸ°ƒ©fð¨¾-¥6סøõb©”Uá$\«Sã6\PP@ökmíígìøÖØ„êë‰pDü[Od,x!¾¯sŒ3l3V5rœfàýâ½k…A²ïãùöSÄ$ÜÍÿû¿_ÏœkþÑm\!íííÏ4áงS¬!·‰+¤^^!MÍÄÛoh”ÿÛ ¨@´©ýt˜9Šwd‡©¾a@·*JÍò½<Ý·é,UÎ_eËøvÂïB´©…z®WãŽ,r´ Ø(ý‘GRÿV#uIý\‡ñVn>‹ãâ"¿œÄ1¢îJkŠhÑf˜Nƒ»MBœßyN­ò îàƒ´ðÞåûöî:˜p<«´Á,ñ¯•DØR^^ÖPóÄEŸŸV^ï·÷@µh…YÓW†Vþ+;à²{ÞVó³Õ\ÃVÝh3÷Ý€jÑ<6wÆ9Œw^zΤðz’ì{-ÿuº¼5pBèv¨"À¬;„ö)•jL71"o&Tã½E}P/€w?‚ôüœdoòœLöv |ñà;#àÝ¿.ËàB ÷Ü÷ÝÍ÷¬Òw·ë7Ø’ýbëÐÕ¢öŒìû}Ìà'$.½öŨQzcðM_o¬þø1òû_¸ÏÚ‚ÄÆè„û•?põç<þ×|#¾sk5mœ÷ÙaÖ,}‘Õ÷¿ÿÎG.õdN/BÒÔ³[xŠáx–µçɇ…øÉ;[&óÂöȆÄ3ÒìŒ\Ñ0{é­1¡Œ¾’Ý‚joþc ½¬Wüå’¤Íþ efÿ»>¶ˆ;ªŸçU“¶Ì6vºñËê÷7ó ½eƒ£¬ÏTzPü]ü°§6kQƒe<…JŸ¿õT¯”XçX¬ƒÃâ…28#"·Ïãÿkέî× D,é'Rªµ^ úÈ¢óøÒp9ÀÀy‡ü )þr ÝÁlË2‡ ™Lã¥ýt¯ý…$ŠÓnÏýúÂs"$ÞŽb˜Xg6M³%}·©ñØ‹yBÜr—Ú0VÜ,þŽ WZ3ý[uZÉÇ}uæ|úÍœVT×aYÑ'œQh=–d.#ˆЮÕ!¶¯|Cꋵ÷äü_¹OßO.ß½ÐÌoÉÙ š¾Þt­ ëÓQ<”éjæZK5—?Þ5|~𪯮.ä9,#U¢b7ýÀíäA¾p2ÝÐsw¾|•¶H.5>«úüÈ Œáy½]+ڜˬ½ãéé>}Þ×ÍÊÖÓ–³zN»»[IJ­2í)oPí_Ï vws_}ø^Û5E´IKõ]z\§½àæÜPoO—™ 7”ôr–¯ŸÅrqsY—ÙCäß®öót™8qÒæSOTwùl·£›nî\àáîWÒ…í±=MTÈĉž±›NUM¼5{ed .äìåñݺºMÇ‹Í4v˜.Þ“’Ë»ÕmPUú™™ž=]ç¬ØQ7 ÝßäÑf~WwQT°§——ϾۯTïàñ™­^Î^^“6Ÿ úTUÆß)Q=RâÙþÚç^ÞÞ÷+Ûå=Zz~ŽGÜíÕÇRvhŽ•¥ÀÔÜÒÓÓ»QBD›)qÉù—¶úz»M™•Ñ¬Œâ¶C«çzyºÎ\YÓ§Y2ùƒþªø%3==\'ϸœÝ Š)Ï.î žäêåãàVzÄKIÜ„ <)$òqí€jåó»ã&Otöñ :t#WIOÝžŸc·¯§ã$ÿ/ïTHȈ:JϘìîîµïNiæ¾Aѯ!̱5f%7µ*¬H[¹¾OÙ&_%ú2íV“A»9ç›ã^'†áÔH6V,O—Éñ‰×SÞŠrbNˆ=´<µ4Ò[ýí¥Ì̧'¶Î¥™û”ö¨‚2$i´7ò]¼3=#ãjÂמ¾Ö×D¼ÕNv•Hb²é4Á‰kÉÏÒSOÇÏOsîJÊS·Óõ-oæVuKöEÚñ=f&§¤¦>¸`M›³û6¹é?ž­ÛÔ„[éåe…»"]Ì–Kû_8Ò(Kœ{ôðîæ/ÍÍ7áf*lH1£è¯;|%3ãé±M³i–¾½ZÍLïb4õTáà8Tûì$Û€ù°·Kü”8È‘±íbþPóRQ_Öµ%4ªç£¼‚æ~Ñá9.æþ1wRÓŸÜ=?‰=~ɹ—ºrI[òF¾ó…;Ÿ¥¥Y``5]<(·¡ Ü"Âc’¦$Ûa®7î`6I’ÃóÜ^3ïãêÄI.;Ô£ ’TL3¥rX&Sç¯I+ª—’­Y-ÚˆÒgº›±Ù .‡¸™Ç)¢/kù·ÙÊÝìC÷iChµ“ è`²æ{éšÅ¦ØG( ífÆ Ý{C£;×=¥³ùÅ­ýHs~CÚßqsï\¶õn99ï+ËYëÍ ßö&Ѧ>çØCìtá‚y±ó§± è;u¤r|yFsvÜ–œê¶Ás28ÚŒD •—…q#·<6ÜáÓ²»Ts4ÅNú£Ö¢çëm<öfâ®ÿ%ϼ\ÔçÌ7Í¢ü[kL½vj¥Lц˜·¹­ØiÓm}«R¡ìP„7×É}I¬ü-,œæëlå"–jœÓ9ëËb™X{M;vãYŸü¹ÎÊk–ÉÌèùò7³xát¶¾É6ÔSŸÄ7fÑQ­ w÷ð,&tˆïb -ÅŒJIëƹ³yÐIE¤î.b³YË{’wÍ·ôPÍÝßd38Úl™N›²!Gã›L–u8ÚÀÄæN£ÆLSj´™å²óÐÕGl´91(ÚÌæ}yüqUyIi)q+++­néTßPÉ£Ó{5r›6?sýÅuvu÷ööæn›Ê˜¢Š6ÌÁÑf•“ PmT¶3œI OL«,S/d—Fˆ¨L¡søåí"¤ëüéFû)›ÎËJ¶û3B6¾Y´Iä±MS_•“;%n%%D §kÞF*ê©)/8wp½%ÛÄ~jœÖt·Ö,±2Ú$ñ©ôݪhSâbðÅ7¨¯ê4Ã*NÒx™å‚7¼ÈUp,«÷Ülzd’ö¤è hsGñŽÑæ`„—ãœÕ5Ê·´´´¼²zÐEÖÞT›ýèRlˆ “ÅþæIggåU>}7¯BýwŠQOÝm¾1#·©ÏíÜÙÍ·p|mÚ›QõŸtéŽ6I;æYûÎVUÍ=]ÑfC%tg±Ú¬´ôÄ¢Í|³QsohDgVâãE´y¾d¼`.yõ]åƒpok.—9ÁgzZ]ïàmIº‹fûXqØÜÈMç:Ó;nÄ­èA¼ƒù—×Èž_ØäaÃás™.Sf¥V+®Œ;»f ‡Ë‰:[Ùž™ènÍ65·Þq³¡–(®­g>PGús¾Jx¡ØGÙ¾ñÌÉ­òv4Pó4ÂÛ†ÇçÆliUž¦V$Ïð²Â…tœ<#£A8¸·ç°l×¼ÎêÓO¸˜óxlÿð§5Ýd•Iz<- RZäcŸJgÖØSÙšW ʇ…k¦Ú³Xœm‰ÁÚÅ lLSÓØø‹ý2Åp+3Ö­\m’©l›JùHêþáN,>å5man³iŸ_¤g6_m–)˜»5•¼cÿR;¼}3ë5ÇK•C›‚x_Š¡U†bôÚj¦¼0Q;ÖȤ™‰ÀÂ¥ªí]d°ì®rÞ&‰Â°-ʧc»+×Dx ø,s{÷ã ‘æE¼ø^wqò,_ejë²G~þš|þæyÁü˜§zeHuŽèÒöh+.ÃÌ~âÅÜVÅ™qiÿ7«fZò¶.{o¼"·þ`Ÿ«UH¢"Úôó¸ÜGåDÂ×Q™àÈçrLW'fäž 5 <.Õü› Y{å“K…—¶±¸lÿõÇv#óhqg…Ï$¹¨ºúÏnðÜ…úeöíM¦óú®!jí@¦k :7«U0µ-¨OÇ ‡ººO{Isª€Î}Ù†*ÑÔïÇX/îQ>ÜîgŸÔ8܆u] §ó› Ã]3§u¥½l˜ªS»rO±™á®Ó—éº/ûŽ‚é¾lOkŸÂ¯ÖuuŸL»Ð²7kKÊûÝ‹,ƬxÜ9Lë&&¹ÎÏ4vÝØ__?Ox•]âê¹4é¾¼Éz*Ü×KgÉñùÄéû¨º‘öIâá]á*õºOw(!.ØlÊ°§ÑÓÚ$p± øÓ¹M³½Ž=ïÒ¹Bòž ç!h ¿€xƒr¿ž½7y¨5N® ]{±>J0†$º§ßàu2õÿÿ~ŸlÝwNôEú!S‚ßïGQÔßCæooËÞj—5ÏíݵçbÁí {oe4~¯]ëœÁVeì:t\¬|ºðÁ©ûO¿Ã émܵ{OSŸôÇ™9}ë_•Ÿ£ÃÙênœ%z›&aÎ/² Ûär·fö½ýìæë4¿Àõ}‹×[zÏýæ?2sØ’ÒItãCË,¼çß|«®"Yjý¹£_ÔöSyÛWÄŸ/Üuž¤ÉÛà°èÛǺj¸'ÂÉdÝÍù$wûÑ8?¦¹ëÞ"VTlΞ)áû¤?BÏ&N:wWšPƒ;üš¿´ÌDããÖqZy¨ŸE#W{ès_ˆtmm蟦‘Ë·Ö³-2A’ E²¡¢Ðëh£óœ¬(ÎQ°ãFòılècªânÉÃÝ»¥ýC¤_ƒ®çoô£0žvéŽ62™Lgå úÖrk¨ÉØ%CíE"ÕY ™d—ÕºSiƒv!»çi³›¼ÿbõÄàu×êžQDe| q¡oºX4D5j=|Ãv¡X¯»ê‹=³KgŒ”Ɇ‰pê5=ôß)ÔÈÄ‘Sœ9¦æ-˜æŽ' 䶵æû¹XóìÜfL›dÊdN_{•èE%‡Fq'^êµdÅ’n4¾Ë=ùõöMbÒ™¡‘sv§Õ¢Öt?{S®ÃÄ°)N|®é–+ed›ú:œéuÐÉ;lݺåŽÖÌ°…û‘¬oÝ\O6gî‘Kæ‚œ)ÑóW3™ßuÄ•ŸI{£,y&Aa¡¶¦ó—«Äd|mÄqaŽžip/ׄ9iñE˜Œ³ÌøLO¿ å;ˆ¯oK Ž»›Óm<ýƒ½¬-ì“‹ˆr÷'ºš;yûù80Lmžk [:2.ùyYò¸6³Âç¼êF²žšP/®µãŒ0?3:ÝÉi­¯Bœˆóc1˜Á³fÇ?ª9ºÜÒ=​¹¹ŸŸÇØ0pv¼”¼f©³0ÄÅšmë6=ÈÇä.=–«Ù$Û—N³¦SÝÂfGÅ§Ï 0ŽÙK¬02w¬ûª\'O¯ºtqk´™€äambfãŸ=€^îkiÊró™²lÓWÒåi¦<üÑ ™°ƒH¼ªžV‹6Ä;(M˜iì7¸aˆ ϹX0.ŽCë Ó ä¿=e‹Ÿêèìcofçx5—¨´¢“&!Ggû~µvu˜;ÓÎeN³ õUdL°g3Íg†ÏNé@Í)[T÷)Á>Lm=ý+{ä?4Óþ’JcŽ ŠX¸*vº ßêè˦žLšÿNrØÎqdÖZr%–Ê Ã­óÔR{ë)Š¯"ö_c0YYÍBTuÔ`<%öZ=¹É¢8WjæU‡5sg‚1œT¡V’'›åŠޣøÕŽ¸³°uç‘°Ñže²éZ¹ðÙv_=ëù¸å”]ôgS™ÏÉoˆ›l†—ž¥íÊ^OgÏ"ª¤=ÇŒB;œ¡ø‚Õ…X[ÞLù·#»ò˜ zÀNÅ0c55à¸fÍCnóïDø•Åø°ëõš µ}:ý³EO”w[¨ uÙ£zTst,ÕIõž[Û'X…œ zQO WO IÕz¶!¥±¾¾ßÚ›³\ƪ—Ÿ.Ú4pñÅZÖ_obKüJËyÚx‡òAe óaÇíHîåò"³/—µ7ÕË·Ùty÷|×YbÜ t5åggÜ»“”|ÿÖDΨOû¤7Ø–³S>’êk~bN7¸ùJQªÖÚÛ‚Q¬t)JYá@µšö8·¤±µSçØáùù¹Ê|¾;š3*ân§²BzfñQ—µ~0'ÛÜ£IYzÍJT\òÜ|Ï€fQÔ+!FI´Ï$Õ*ŠÑ”çC¡(ÔºÔçõHJ=ÚŒ5ž¢øB’.p3öˆÜ^\^ÕÞ£œØŠfºð7ÈGRê.M1pŠ×ꮃ¢ Ñfñþ¹&Kó ’â ÔQ—j5®$ï¨Læ3ó:”1 ?Õl,õn*»àGsXOŽ¤‘¨ÓÁŠ~ì1›Ÿ­¡³Âñ;,{ð Çܼ°ªNþÞÊ_cØVH‰hÃ`²Uw‘[lI 5´[+Ö¨yðïGÃeOZ5Vº¿ëõìAßRsàKD´¡¹«¾LD›à“šÑ&×јBþ( ycÑ—g È£ xÅ=e7¸ªgb[!:Úx1×Wôå}á“Xjä²é掓ˆLAm$Ç-L ý¢×_ºvíökžìQ;4£MOí536]½TtŠab-1ÒH9±ÞΔxÊÔÜ3¯µ_ëHªÖæ&ëë­ÏQ5ÿõÞ‡Ÿ mÔæmšïÒÌ {p´)s72P/‡I‹¾ßü&Ñf ?ª_5c%i9°$ˆÍfð¸ Ïð-}CG›¼ø &!§ÑwG´Üñ‹˜K-o^øÄLz¿]£FZŠÎrfeBåO^H 'P>Ç5ID·ÝŠ«¬‰Ÿ|¤{¨mrnijÕ?DA5ÉìTD›ôZÅx©åÎTCÛumþ}õ¯±|¡ZóìOû Æg±©ªÜ¦5„ÈmêÞ ÚÔûPÿµ_×I¦·Ž6×û[ÍùZ׈68ýßâÎsÿú²ªä“˜Ÿkå6Âæ43šav×UÐÙÚxÿàtcΗmšËÕÚ|Ï<î¨ð;ªÜ¦;ç6—r¿g´iŸFûךœág釋6²Ò¦ºŠØ³ Øcx¬¨3Úís5ô;ñ&Ñf‰Í¿boujDI©£ñ¨sßôê¬LàÜF5‚ìO1k¤Èm†6¸6=ƒOG@´ù•yyÈn;‡ìH•wVç€û§—Ú[l"Wèyu‘Ædå¶õ£ª¡£Í8.ùMþ Ó̽ç}£èõOæ-úºg˜hÓzž6ƪdP§{mdHür/…b›ªü¹ˆ›Wì¼R"S‹6Ûܸž›n’Ï&m b›ŒÛ–Òd½A6Ü­7òÈy/mù ÅOžvdŸ¿þþÿÕá_>¨TÌV ”¥¸ÖhE› QËòþ½Í8¨-'û¨¸ö—iô°\ãWF‘0Û\ŸõH>Û}h©ÎhƒŽÆ:Ø…lVNCç/\°¢¹_ò=r¢Ã§†‡­PMgŸX>eâÌ­òh#Xs*]«;Rb(‚…Z4§)çëÙ§qV¬É:z_™ö¼M„+kÆ&ůÁ¬ 0õXpõ7N`™lQþŠÔÍ>†ŽËp m2ÖÐi!ľ:^ (´„tEÁ+’w,Ý÷œ·ÑmÔj^ÔÓœ–ö¬O 8ÿç¤pSí˜9Ù‘Î3›èlÁØ%¼”Oë¶ø;Zš¹ø„O›Äg°çîyB|Ø•‡?7rQE››ÛìÌȯÿ·E[ñì‚w¤¡ÖTo>ËÆ-,ÄGÀaFm¼H¶ÝMs¸qʯ±Ô_C±¬Ïó„šQ軈#ùP¨‡Éª£¯“€ë;"̹ÆSBCÝ-¦Ž¡ùä…=¹[>£ûã‘”ðùvK†¾GÈŒO«È“%kgÙ™š9%–Š¾™îBaò'Ï"f›r¾q6¥YºN õwášYì»CüQ€âSQ,·ISBü]ió•×Ë4»¨îùÛÈi‚ý­B!ê­›êag:Á#bºŸ€Æœ¶)yÐIô®%öt Ç&`kê‘æž17”Ñ&y¼‘ °GþW]Úsý'X0¬œ¦Oõ5c™L]tX*Ó: ÜDù"^mb|©ä9)iæ‚ÏÙ‘ª//o‰™Èã0C‚}]ø|ó ׫ˆKiŽÏñ¡0¹“¿\(U+¿¤+Ó܈ñ¬ƒüj¸tyˆ«¥•¹…‹Å¤ZZš™òmn’É\ù·Š{­æ”,ñÇòO9š1XÖNø6Sr凮'Ûí¹T÷€i!ÞvöŽʈÖRv~’‘óNU´±5£y@Ld Ûq)Ö66Ó„ ÉëìùF.“¦xX󬯗ËçjºrMèi5Êhs;x¼Õj‘FÍ‹š^\06¦µŠ¡·þÄyÓ’JHR©jVPc!¹¦L*–H^ÿñ¼â'këJ5_(y½5µu‘b;òGRµ¾ÎâUûT^—¡±EÅBUa^TþÛ)ä®dÊI•ûÔx;dÁ¤¯·+Õ¾D¾ù¤v…(K¡]•äæ¤òÿW{bÅtnD{‰âg€UÛ©Þ©<Q•J³–ðêb­zÄËÂ\¹_Ÿ~N¾R¢EL¬×?íå¹t¿î†¡¬ ©ÚO[HU U{Wÿtå;R®/SoR©VeËÈ•Õ®…& ¥QódÁ_`„ëÍŠ7áw q!ü—ÀŠl(ŒäZ)|Mð†ÉD¹¸ÎÇzæãYó'½—  ®ï`bN=ô Jm´Öð‹óÿŸè„x endstream endobj 877 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 269 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 24229 /Filter /FlateDecode >> stream xÚì½\Û–ïçxæÎÜyofÞÌ›ÿÌçýç½ÿ¼¹sO2“iºÉ9©ˆ`Q ˜sÆ€YÉt Š‚Š( *˜%çÄD– :w×ïªî¢»iO¼ÇãúÝ}¼ÝÅ®½«ªkk­µC@ @ @ @ @ @ @ @ ôÃ$—Ëù|AII)$HŸU*..¡î€À¯©•k6ÌÝ0ÓiH>Ÿä¸êÀú ¡ùÿÊZ»e·HSI@‚ôù¤ '}›¶n‡æÿëÓ&"OYJ@‚ôù¤óº6mÚm AÚm AÚ€€6 ý ´^*  $H?;m–®ð~ýúuŠª««8@H~nÚ¼35³8sæL€ŠŽ9’žžLÚ@‚ôóÒÆÄÔìĉGTtøðጌ `Ф_‚6GU´Ú@‚´Ú@‚´m AÚm AÚm AÚ€6 m€6 m@@H€6@H€6@H€6   $H@  $H@ÐæÇ¥ Œ†Ã—ó_Ê£’BñéÌÞÈ2‚W"ç¡ %òÈbѱ+þI8 J¢€„‚ciÍQ¥8]'ëÅ¡˜Ü "²¨Ï?6ç|ž–º¨üQEcgÓªýq¥ùÇ’BòdÑådE*9¹Oê]|ð@¤º‘“Óî¯í9¼×”É´qñ°w]`ï2ejlÊ´\x¦Ë#‘W¥îI•g¢O1ô¬ŽäÜü.g;cýÙŠ ôôLìVOæIÜÛ Öæøæ(ˆÛm€6ŸT܆nÅQ¹M6Læò ²ø:ÜyD¥];6˜¹¬ +TØ61yù³ŒÖÝìÿÚ`ª 055ÝGU6>ü&º|h¥ó,æòÔ¨Z"8þˆáœ…§«ÇkL¨mvÒ¹äb2ŸÔhC Ý)'vì]gjîzê™"’ h´ù¤hƒò™ØX&ÃôÀ™Ú¸»ô«FúVû2‡(’|€6[žU0KºZQE]Kìæ˜Zxm¾ô6m¯'xOj½¹™˜Ï=™%Š­^acd½çR &¬ öìY`js,¼RÑî_¨(3¦¨gï ]“5 äpDø56@›ßvÚu`« kÁ…M¯gí]“¹Ñ•þ#ô!¦Fìã8Ít]ftE›æ·3}“ûÔió”5ã{}]c=*ÍùnîÉV Ñ¥=k·n±67Ò9ÃPw†±…ëŠÃþ÷$hÇ°k zzF»nô ŸHµÒ k)Æú3¶'óƒn^bèÎ46f`ÍÑ›£o·pý¦˜ÆèrÝ´Ú| Z¡ú˜Ôj{¤z/öx~eÔE[69O[¢]'­RÝ®fM•¼I ?˜¹´Ú@‚´Ú@‚´m AÚm AÚ€€6 m€6 m€6 m@@H€6@H€6   $H@  $H@  ¤Ÿ2ͪP¢œâ„×úC_Õ¦M¡í…bz™_¬: Š§Ì0>‹ •«W!¦ÿJV!Öœ–õcªP›ÿEŸ…êI}¨Š"©f%2ÕIdš³½€6@H?69#W+#ÉåøØé¯9wš52póÆ"nÔG–cPpî¶p÷¨íŽ2dõãJñ2éœÛo9{5Kxúž}³AQEr-÷A—f†ìAöí7Tì”FnöFÎý.´® PQÚ2t°o½¦JˆH,ãf hfxÔò ¿â³xÐ¥É+t"ynŸâ!7gãl  ¤Ÿ3ÉÉÞ|'ârIxÔ³ÈJµÅ¨ÏIÕ¡çÓÂyOÃ#³#Ë&d(Ç ‹¸ý<<æ¹F†H2CDbi÷ Ê‘PY¡9‡ý—~?,4#<¡DKDD|:¼°°{‰åªÉ /D…°S^D–k©"Œý•€*â>~Yªå4¹Oû¹Ï†¸OÞóòôz_@ ÍïÄ®(%bsFÍÄÓv ¸±G?Ú¡XÒJ½•Q< /9q5²BËB4ÍãÜk9s#ªZm =Š$aœG—Š8é¯Q ààÏUDxdVÄõäì„œ¼ªÕ2 ¼q­ŠÖ’YMhÄL(XE$×¢BÂÂ2µTQM ë @DBYhPºÖ*PÕÈŒ¸Z-´*-< HDþûÖ+öÝÍHó°‹W âåñ)—j¢ñ´Ú|ºéI@b Ã1ô%^ÿ‹§à7D³©SÒÅ^±lܪA>Εòp^Õ<Ù7ëCÏÞP]5 ‡A.‡ÇäR¾ âI(Â…êâZe5a¼'”ñÀNm ã<Ž,S³(£Ÿ)(”9;a÷èÆ®p£"³‘³FE]Â/a­T-vôP ¥øÕŸèCÄÅ5_ ñ04U7"x²Q¬ZÊ€CRdÜ¡u¼ŠRF¨AVâ•|8Bžjزòºm€6Ÿ(mZl9•¿F]ì¢ÕØþjJcð~. Šá>Uí¬ád´†OTX5óÙת)8(‚ß…¦+Â;¤UC…ˆ•m“ú[84(Ñ’P¦ZûF]è…4Ea÷M2ž¤*V‘¡ ¹`éœô7q¤„²°Ð ºŠ£Ùi/#KÇßà‰p„}®r¥ v:ÁDí4ïw¢DC²jèu À!ï7²L97_´Úm~mn¿E<ÁL%n’áÑ9‘U*nòM{záÊ€Y„¼’2µG<Õ¯r.gˆÌ ËW´PbߨGÖ*ùhÈvR‹Á¯~´m“x©(,üþ¸Ct¯#øP4j‰ëým|Ÿà`Îåb*N¢Èp§9äxv¸¨–XAö%–ûÞEÇ®XæanÆ\õ‡…oaP¨O_Ðâ>£‡TX§”³–³Î]¸5^E%™ÃI{E“‡Ríe2Ó+ ‘Ž‡»Ä¹ÕÌõ3t8Å­Á.}R Ãé\Š2,LŽ&ŠÍE|S@´Í]Ä}Ø=~÷:YF[5rÜ?U,ï·BD‰6ŸmZlmŒ½_þhÚ\¹^C;&ŠaÀw[BÏ¥­]gc±êQxt¶ZX˜Êp‹ Wa`Ç$¾@£sù𺕮3LwE?;ûT‚Gæ$Ž‡…•#ë𠲃[3,|ãÄÓÕç¯Õ„±qÐG}C3ØTo8ýîªbѱ#!{wã‘<èàÂÒqg7ãŒõçsx5Òû\d·8‚žæ zTH<6:‹Ð³7Ø·^Ñ‘g:h۪̾°jrÇTÙ¢z²@ Í'O2JÀ+…e÷?é ~Úž/¡ÍhÓÄÎ$³ °‹äZ&# ‹©¢zC²‡¹%šQbª•qò†Cžôg „ÝëZÇú³ãܨˆ„ƒê –G<<ûüÜá˜îSÜ1­ÞîØÙÝ[7®¶1sGöI0/‡…ËÇã´ìÜ!ò†ÂS^‡¦GæDÜlP*sã„®ñÊ R"("óÂÙä gn„'VhÄly%²Ðì¾À¸bÜQ|‡}³Qa„ä=V888—K‘M…˜Cumk ‡ßGÀ 9y YVøÂNaˆ{©ž s³‡xEK ´ù½Òßüâ5> ˜Æ¦Î^«m­--œ¼ÝÕì(Á´1ñð=eÁ²uöðbèZÏó,Õý‹¨5²Ü{ Ó”á0!Ó”é¶:‚]¬JL¶Ð”ûvvVföžó/7wÝ»ÎÕÐÛp ·L³/ûè¹ÃV,ÛÅ—ê.ú?o¸Ô¥ú^˨ "àèG;¦ã†ÕÁle:®"(!ÉÆÚÜÌÁËÍ}¾µç?»Ù«Ì¶ò4:¹nœÐ3[»û ÕÜeËgÍX𧯟ʊÒ8£‚g=£ ÛÎã¸t•Âd ÷žeî<)Úˆ ÚÏ >¯urŽMÕA»Bq$ªZKå@!«‰ê ÿ¼)h´ù%<)ÞݧuG ‰¸Z"¾V¸Ìžå¸'%¦|‚mckÎtÞ\‰³ñXšé{Ö©å© Î†m76]u …Zbf&Ó±åF·–¢Í’lÄú56f®§ØÕDlzr§Û×ÿ×váÕ°° µxû cÓ/y,*±”“í¿a±‹þ¼0Ú|¢šp%±oçFgS÷ˆ+Õ<»ó.m*x/1·ò åUquĉÕ.öß}í²0!,R-&Œhc0G×içãˆÈ^RÅÑåöÞ© ..Œå^‘á ÂxO©@q0{®Õ1L2,’Á¾ýzbÐx| 9ð&Œó¢uÂú+¯@„hÃÍÀÌ Íï™6¤ÍU* yô.ðI×®åfLŸØèʉ´1]tè‘¢¥—/²³qÞ‘­â8ÄT ×8èÚ+ŒUÄ]åÜ" =µ©(q"B]Ù=Ïä›QCÑx}vrµ÷BËU9ß…øÇ)ÜÊön\ÆôÚ…'nG•qÅ¥N_ÏÞ»ÿrT¹jÄC~xñB7;ïˆ"2h|¿34OtŠ*ks1úfq¢Ù?áܧœÛuž³ì6©–Š!ó’ü瘮½\‡C¾ÕÊç¯ÎgÎ@žî‚¿TÆÉ æøêZåÔ*ÃÂtŸâ±Êåʹçn²ÉF‘ÔYäd+öfEr$!uS6Ž}®êÌ…9çþ;  Ðæ÷A›¨ ÙöÅ,£y¼:Ù15ÄAosÓUZic²âL5åËD• |Üìl6G©Ù6U^L=· •±åä¢väŠ|*Qâ7œG=Á\ƒ9«+Øó#É>Õ˘6äÄI<ç|Zd©d‡›ƒ»ëæØìµ)Rœ»ˆu¸S»Dý ¹-{vn4wßNÙ6ôD§v´­¾ÁÆ …ìIä˼ŒmxeääÍ”FjòfØU³<K+í Úèû•‘ËÝ„e¢8,|­ÐÕÕdá‘:žêHã+•v¹éÙ„Ådq2Û4ÃÂä8œKEØ:yöR-òLQ1­‰}·•‘TÍS_žKeæ‚œÚЫ¹ ÐhóÉÒ&º|d±…Ëþ”2ÂSØêhÆ4[£Õ“bÍÛu=šò¤ »mÌ=fD©ä‰ª&ö¬21òLˆ©ÃÍ*¶flµ‡ûò˜·‘uã}R¼¬¶ ÿñóVߊÂá ¨žy¬imÃl2Û‚v‡Û4_ÏÚ7¬L±üKLÅÈé[”;ÃÉh ÚÇÅ#ôʈ=ÛÖÓ´oª÷k×þŸ¿÷Ü•EšXÑÅ &Ó)Ú(L ”A{Ø\ö]ïÀÅ|š6Ô"~A{9œ´W¼¢!Wgcš6t;Сû¿Û„?ìÔ>"¹T‰åA{"342(Wü ¿¤p ´–€hÃ}òžKNØ„p ÍïĶ)'mgh¿ÁÿFã‰ë…>~[W¯w2´Ûu"£•[¬IsûU~Üü“iõ»O51´ØÆW‹©–áæ³¼Že½VºóÐ6·ãù•™ ñÅ=íçþ§ÞŽ˜â€¤‚u>^æ¶LKï‡<å¼ìðØÜPdT„E{ؙڮ:’\T¸nµ³ÝöÐbrŒ_\^XÄ}¼úD¹vÚ„s³w»0ÝfØíK¬9y=wùÂVö&ã´)'§’qÔ[—±J m*ðŒNœ‡÷4²dT mʈsì§- {>Ùü ä¯á1É‚ÆãÞeÊ dáp2ÛµÎ}Àožr³´NmÚm>áÑ}e|?¿ ÃÂy;Ô!^n£«ÃÂeKH¡JxþÆÆÒÀ—ójÛöuf¦ÆföËw§ àù%j=ัß~â>×ÑÔÔÔfáî#$ªsÀÙ×*ÑC?ªB¸gÛ†ßü™i½póµþÍÛæY,»Å£V˜!—Ó$G·‡ Z·Ñ׌iÂdY¸o»DLhXfD|!.óÖË€„=Û7˜»o÷¤Êq èOQeC[½=ݾûÆÜm£ÿ#±÷J3» 9ÀÝbÝ´ÚüÚ´‘=àZWzÁÍpÛ­ÍJ¹\çí Ýáj ý©¯6|86äøeÕ ”³v±Ž¸XOÄ5âPLð>Τï\¨&jðK&¯"hg5?wÛÕâbéÅ7¨³>ð*Є¦i¼Åf<˜ƒß¹ÐÊ}6 3€6@›Ÿ"ª‰J–åÕ”žÆ’˜eù¨nVè¹›ZVó#ÁCç^Gȉ+ZWê Ée§6±Ó^¢ SAµ ¾Ë¾^ƒÌdÿh]0ôL2²jÈUÖïj}9 ^ÆüÁ»ðË%x R*®*L-ªrò*¹uá—Š´U! öåÞë@^q]Û%â<íçKñð<õ™ TÐ'´Ú|\:þìÅ}y8ý1í8(Vá‹É¥Ö­R¬fƒp¡Ø© BÃîá äÀ?vúk¼ÜM™ÚKI+ÞAc…ù¡º _Ø=6õ¶ÍRrÉbz tºŠs7ÙÔÜpTBR5žÚ ^=Z“ª#Ußÿr>…sç-õJ…ˆræ‚úÂè¼8w[©*8éoèUÓéŵEáÃkžç Ôü¬˜¹´ùÄisüò»™&Wn¿¹–úâ—Nç¯füáД-·’ñbzÅ2Ũ˜˜\µu¨Èq}¡Ré¾õU —¡ ía*æÎp¥\(úÅšçRU_­‚K _gPF½Xóá8¬"Ð,ŠT¼{·>,*›Ž½àp9LHQ6¥Èh¶r žny£ž§REx\Õ‰O½Àá‹“¡2Þ¸Ÿ&2ÕÆ'&d ŽÃ„Še! G17ÛEäzé`Ûm>íwe¾ÿó¬w3¿BÊfÎþá/6ÞM爂]Šª%×óL(¸Œ'÷IoÈ©$*Vƒ×«)𶂻ÍÁ‡cÉzé Jj ÅÜ~r2)ª‡ƒ8©MŠWpª/¢Ž=¦*"$ ,«¿Ö¡.äÌuÒìIád¶N¬3-øNT=6{/øÖ8†›õø5Á•DÐçnëÄ*pØdÈšs¯“ZÐf<ƒâè|≮¿”¢Ä@›O>•È…÷ÖQé@Á›¯þÚ/ƒ\ˆ¸Pzö&ž©4É+P3 ÞÇÅóŒ*µ¯@Žx|ä"ž‹­í-·8Ã͆ m° V¦m‘srØ^ðîì®Ð¾Dyĵ*TEÄõíUTá—‹QŠÅµ´®åÎË >…­šrBkØ™s·÷ùˆ–°°bÔÍž$ï\Ú@ú!éHVÍWÇ•´!^îØd‘Od- IñrImðÊáºðºIªCærð‚œ“`ν׎Ý­U.ª‚›Ù®½”•ŸþŠ“Ñ2Y䬄6j…síg‘ÕÏ{><é°=êý˜Jh´ô#h3(ž¤•}xœ‰êØ¿e(›<ƒÖÒ&Û8Y†2Buô¯–*Ê~Z¸D@  ¤¦ ¤O"m€6@H@  $  дÚ@Úm€6€6   Ðh´Úm m€6€6@Ðh h´Ú@Ú€(ÚpŠ$x½nT é£Ò±çˆ6›îgü˜Ý?Ÿë\߶ƒRtùoâ |òÞ„ ´ùµµÌ{ÍÜÕûÜ×RMÎÞ»–ï€ô1‰¹zå”#Su×Ïýû:yïþ,®Ò²í 6ŸZs"aÝ™ë+ý£Ý7¸ùrñÙç¸bç_ê,=Öéém~MÉår¡PPR\¤šJKŠñ_í³jÍjHÿeZ°~þ—G¾´Ûdó#öõýl®º|V­ôñ^¹zÕJ|ká»ë/|ƒ;zôÈ‘#@›¿¸._¾¬ñC€&“ßQ¿©G§.>º.ŧ.  ÐhÚm@@  h´m€6@ÐD+11ñèã´õäVD›å'–Ã¥øÔðôéShþ¿r·¸H$}œŠ›‹ÿúÄ_'W%Ã¥øÔ522BÝÿÐoS5Ý5ˆ6·oÃ¥@@´@   Ú€@   m@ Ѐ6 h€6 ´@@Ú€@   Ú€@ Ðm@ h£"9½¢æÄ hóóŠ{ÀÕóà3ôáAˆ‡íƼ­@>Q hó¼ÍÂiûô¡ñY<÷fýX#÷¸Ì}· ´ù8ç ý#Ž  ˆ "„¤ Ú*⊔٤üÑ‘!¬a¾@„Q#‘ô5ßaÎò¬‰e(‹T$&sŒŒIdr…Í#“ -"‰LÄ¥þ&’Ê•Õ‘€Úƒ/{mt]Ã#B²d°@@›ßkäÄ`ݽ….VNk¼—Ø{ܹٖ²mÒOXÍYš‚sÉ1ý,Í™‹V¬òt27±ñ¸Ró^ô2×ÏÛÍÈÐrõ¦mœ²^Ñ«§‹ç;˜Û¹­X¾ÈDŸ¹hŒœ2€ª™&úÇýOÍ[²éx€ÿ†ûòã½$=„µ×Ú››Øº¹Ù˜2ì]o¢,¦Øc~V,ƲÕk\­Ì–¬¯ë@ð´ùôaƒÿao·±ö8)$7+9f³gP´¹{ÆÞÈ; }à÷T9ÍL|¥Ø©!ÍßkW æÂkŽîÌeïÈw£v­XsJ@å¸|?#°›%Äp•ËÚ7Pñ—¦‡L¦qZù!ì]mÇZsêµ=—³r&ck7AôäœÐ×syLJˆx>Ì­WÇÚ|ÂêZküõ–'ÃÊö,;¶HWƒ6¾ƹfz›#²iƒH&ÃyÇêÃtg.i&·Éd$[Düžîîž¾ŽmV߬¿Ù£ ¹ipZµÂ!ê/c1Mã³ÚF[rí g^}©pŸd2 Ÿ/ÀxY`äø>¸±æ&Ó\ªepK‚~·jèm˜z|ª{’û?õÄ.fм©qý~VPãx{Úb¦Aƒê{ñ>ó̾cºÄw[XlÚ0™]•6Mϯ,q4qX°|˶í;vns6™¹vœ6 Þ=e,y°ÜŒizñiÛûÆÖlÓÇý&Kßf†ÃÂÊÎV!k³ïÿ4íjÜ’ ß­¤2)+Žõ/çÿå_/ü맞–¥,ûà¹6ºOŸ~ºFJ;+çÖ2&ÐF©Ñ¶ô˜Ž 㵉r5Ú lµøfþ©Be>Énë¯×©Ñæµmú_ÞµÐ5¸ÓMV:•:`iäP¬-¾žô)„g>ÔTù»­¿ñâ½U¦Ç×lšmDo³J:ézë®1f:VJIÚÌZÚBH.ßÍŽx«ÌÑšÀš1m]ÊhÓ,î©w6›s!ãÅš¡ÖüµKW– ˆg{Í欈?hiGßÝR Ð'!üÏíÐ5FÆsïäW××–Çîô²´E¶ÍcUÚô5$|ÇŒÈ(¨o|ÑX_}hË+!@Ø|Åä{‹øüú†Î®ƒn³]ö'5½y]™›¾bñŽUÆswßjLB&AÌv/—UY%•µU…'¼Yvë.IÙz²õgnåÞ«klj¨*XjÄZaè÷`õà†SNû™1ŒXÖ JÞGt¶Ýpm¿}ÒZoY*•­»üÖzOGc–õ¦“ûØó’Ë~®z&kâj…-¹>®æ††&Kv÷d5·.èëoJª$ÆêÌL 9JÚ ”1ŒbSf4+þ¨ ÃØÀÄbG`ò¨˜2_äÂöâ>ó&& Þ½Q)¶ ô;"Τ[årí1ùÇuIËÕË“«b&+×îôh@ @ @ @ @ @ @ @ @ @ @ @ Ðç+¹Æ'z±xÕ¥ÜáU| èçÀ "‰€K ‰\(ª²G$—KäR™P~ÛF.—ÉdrD©T¦bÓˆÑw”4múq¶\*#Cfý?!¡¹"• „r‰DŠI× ý ¼‘c¦ÈE„\"“È%´Íƒ,1̸J èç0m‰X,inÆÄ‘Òqb¹H*“ŠÆ!&·‚@ ÐO!ª,iþ§ÿ5òà!ï•?ËÞ¿Ÿ6 ègA Ò؆£Su- wJ.£^‚Þ7}Æû¿ú~E™X°ùÁΩòÃþM¨wÏ«n—õõ òERÑHßûÉJô]ý¬cÃýƒÃr© ¯·O û­_Å^ò Ã2ä¢þÞ÷£ùèðÀÀàúãØpÿPsñhoß ô#ë¦Ëýøæô÷QUˤýý}£é>_rÉÈà@__ßÀà°Xö£ ÿúÎîŸï16å:ÿ0…KE„D& d½C::ÃS¿ä?M'ƒÄœ¦· ;²^ü¸ŸD:Ö³kãé>Í?t.š>kEtNóƒ}³§9×J&/!‰IèØ~tuÒ kÜ-—ìµ^œñ¿ R{‹Ó{÷äɘç?ö~•í:Ð:ñO¢g¦ÿöÍéjÁ©5ŽNKýQSgï`Yl¸§‘KV~ú?ô<Û…GUþS“ûæBЙ«ÏIñG7‚K->·ñ§¡—¦z>våÕä§# Ù½¿õ/þp” nXÆ00¶urÔ3b®Ø*ý%pCž±0‚+œ¢#Bxñ?+&»¥ZfÍáOÕ~1e,7OF|>}RrmÏ-¹\ûÓˆÞΞo’Q¯µLb’2i‰{ Ì|û'íÅìÝqÙÄHÓ+Ÿ·ZŸTîdKâ+§Éì%Íír¹°ãÞbϽB ?pÛšgcZŒ\¹¶±ŸŠÍ“?Ëonž»ñ̽Iêò?é›çéÍoQ?òƒ$ñĦ¸©ðe¢ÇÒÓb‚àí±´Ýô@ãDd•ç¾5^Ò!’i=¸ g+Ž=´þR;Áo¼¸hU ª=)ÿЮD‚¿ùÚ»Z-º ׳e¾þÜæ~-&¹3©ïrí§&—k9~òSÍÝÓFL·ü.òËHÙrÆìÍ·Ú>ôÛÿh°¡kZ^9ò7SÅS¿èú» Å‚²|ñÿ‡dªÎÈßþ½¤«—‰?ˆdüH{ÈÞÕ6æ,;÷5wèŸèåãè%.Ö,–¹ûê=Åí#Ôåßiíu®¶únØ\[–¹¹CÀ•<ª ðÅ,&“effïáÓ'BÈ®¨#~v–fV¶sÏ$ÓMñYø|‹ÏºªR—8Y0™ÖÛÎ'£û¹+3ÔˆiÆ4e2MŠPE‚ó..gqÉO÷Ù&t¿Î²ßv[qÈÏb‰¯ÿ…øj*ñÿ|K$V*6"Úü•ÑŸO|óÄÔ¿!æí% ÄQµÿßÿ ¾úÂu'Ù"}iëâÈÂÝ°b§ˆôÄN9ÏžR=ñFA¶öåÓ[í-˜–NK.缦QOé5 ÌÌÌ]ûeV½Sl¨s´1K.jO=»ÉÚÂÌÆiIR%¾žékMÑÙ¡KiáP3ŒK–tò]hnná¸`uJqU]kê*ýUWƺò|Øš2-Ví ïÃu¬,ÌÑÅ1c™m¸Õ€v½¸ÔÒj×e Ò‡Vxwˉ²Ðu«#_*´ÁöPóuÛÙÆÃD•’6o’ -æ½ê|yjÝ|Tõ¢íèàîàŸÒÂÖýZ enw/÷}OÅç½ýâÞ sjJ bÙ¹Õõˆ'´!iá¥cÎ6æÖ^W+“ŽÙ*h3üv¾“Yp~8ƒ g¶­°´°°°qÚ˜4,!FŸÚXâßÚÌÌl}j-YÔpü‰ÍvæhƒÍ†c±ÃTÃivwdE?m»¼ÝÖ’eíày¹¸‡¾3kî†/t°dZ:î MáË”x|¸s•µ¥¹“'£Îüâ.ÇÜƾ¬SÓ2æ-žáTEg{~y Ãb7º £¥nfܼ‘ŸñY.êú?NÕýñKÁó|Áš•ò/ÿFø…N³¥³6’ÏÆ’½Ú`c´" öY^~æÕc]cîãfô@6´F[K¦“»_üƒ’·ÍoïÅøêZäv¢vP¼ÊÍÊg7§¶¶Õ;øæ¡ÍœÙ{8i¥ååOS9öºzÁ¹Ýhïw÷ÖèYylÙXÞøúMCÞVÛ9žAÏ ¿æA€ÞL×̺¦æ~t´Ò§wìä="PÐ?8Šþo°¿_Dµ ’6èùó gM®P³mÚSæ0=½>©|ùº®ÐÇÅÈzѶ£1·_5·ä%š=s^*E&èÃeö)ÊlϽ¹yסæA‰F*Kñ×Óµ‰ËÌ-/Íçíõ¶sf)ióÆÅÆø|Ê[¹¸½½þòã ùÅ¥E¹N­±`nL”¢Ú‡'õgºdÖ¢ÓᲞ=ÎzkŽdç<;¶Ö•¹0›¸cmsXöó7Äd¾in~rå´ñlÓûo¥È ¾{n±•×ÍûÙyÏî\lb¿ù>2~ÝR¦îŠ— ËÊó\õ4šµãr!u¬mE··îØÛÔ'U'@ÛÊ9³N–Ñ[^e_d2¬*† Áû¦ƒ[7Ü©ãÿŒtT÷àÅËÉ_ººtñÁ:S¦]ï„„P¥[üw®×Q¾3œ7 ”_¡-‡c2頯݌õ‘MJëG²ßÇ~ÑF.úYÙûm\v)Ÿ§7°Üv>!'}¼YÈb†¤ccã%wå4§mãÁÊÆé³6‘¿v~¬§¡á²fåî™g _Úü“zz¾]šÎ„Ÿà]‘YJB’ô ¾×!|¯*hƒÈÓ¬ÌVâGèüAÝ/Ö!Vç(ÿPM|7‡x+Õâi«±çÞ…Ùs_ H¨cz}bëñ(ÔO-˜ît¤˜Î9ÀÃÊéfîÈ [+æŠ¿ô–™³Ÿ¶Òám6›O+̳ԆƛîеT^óÕµ<Š¥]÷×ΘîZ®Œ6%x}ï„ŽUú:RoºÇË gâ ª°m¤-[m¦¯â”izRi³uY—«º¨ò/\c>ob ú"u.5ùæ\õ‡\-õêäçæ}ïx²R¹}t·õ4uÚ4K†ëçêωk’)£eÃmïp]o£õ¦»7)\èѪ’‚ö>9¼_Þ•s…ÁbuÉ~Û\GÖ¦ó©Š+9øÂÞÊ$4ýt¬s±ÕLÿ´nªÞ±wÏ×­Ú^#&Êfx^ n´ðð4ýµZü'úK•Ó·†ñ¯GÇï¬Âd¦©Éów?¿'…þ7:†îI7ò›¾øbè‹/…_Má5ehÙR !!g/H>ËF»ÎÃace‹Òw–t¸ØaÆÌÈ×ôU—^Ùãm½|‡@N°÷Ù:¬K‘*óÛ­Ý6§KÕh#⬜Ë\°"*’RTlä ‹éF‘oð]—ã¡?#Vîþ„=ßÈ#J¢N›zÀ½øóŸˆÿýo8}¥C,¾¨¤ cüËÂðÁözüáɨf áã‚‚vš¹-ï‘.ÕøæWž3§-ÑÕå\<Æ´™ßÌ'icÉ»ý‚Ü.'†ª-ÌL£¼V§MÏF£ÙN;ÎÄES×'úÜÑM&zv¥BL›ï-ýǔŶÞY5Ý&€¯N›‹·ÇÊzÃÍÝ+­–ì½!Qž¦m ms›ÏŠ«GÖ;xí%ûce’þUÌoNŠ>úÎiY>{ú¢Qú’Çî4Ó°m™0pµƒ…³Ïö£)O+hīІÜs°òä6_OóçÏŸë쀼ñ¼6 ¦=ãdbµâJŽ¾v°f¦¼t?³™5çZ»Æ£aô¸ËÂ{{¬â’Fñ™NgÜìùÀ½„hctéõØhósÆ+$ô@Û´Uˆ#Ã_ ¦Néè?D AŒ•.ó2E¡«Ü]¶œ–«G9¥ƒ9ÖÓtÚÇÝ­Ôƒ«Í–øñmöÚ:ø¥ÓGL›-´ž_âfîæy`\í?˜Ú"UÐÆ=ŠFù£ R¡óOÄÙËDqñ²øN‡X¤¤ÍT‡ñl‚B lJ—áy|ú)óƒhsëìV˹>}bB=\çöýÌóõãCЋO™Z;¼QÐ&⎠ÚiÓî­«ëê»ýðAåÕ9xèÐ#ÈrÇ´±>F[ð­w|¦Ûþ@Úìs45Ö]äéÌtòn(ÂV´Éo¦2#Ú8z#ËN›&÷ïgªä«ôIYiÒ†¼•ŠîÄÞ»ÕËÕrÚt Σ&uÚâ®R']ÝÅ;ƒrJ«›^¾*Ka3˜ã´9uµV‰“׎˜6Mü·3 S»5¬¡=V,/ŸCÇo¹ƒû<îù@,¥Ý{ö¬SªžTV“a]9üs»4ðÉNo‡#üƒŽìË/$:Õnd‚ã9rB€Ü¬Ïeâ‚ìÁÞEŒ•û¤Ê‡·T,ˆ¤2þ ƒoO‰•T¶q‘‹?º±mãw냴‘ÞÙîn¶ö˜Öù§Ñ¦—˜ªCø§ÒO4âªÐFçûñ[©ï†Ò±ê%¦è‘íã÷&ôãƒråчŒtŒRG.“ˆBt züL¾YŸÙOW—±ÓÜvÅ;ñGÒFpÚn†×¥º‰Õý ´Ùkm³*5âÀEs>—$=©Ÿ6Ý~Æß®ØG_Ø¥s´Ñ†êÄ9ÞÞ; ;}A£:mj2#LMm*‡”»Ï3eMN››¢þj7ƒïC+$Ê’eB²$—–²ìŽ\ýA=}QKgºUÓ@ÈŽ÷cXíüez}…ØñõéH¿ø+DÎTYSÓAÎ ÿœfIIªØºÓ,ë(“rh£³ñ¢ƒ‰„\|h©µ›_¸"“ðÅ"‹é›£j䤓y.ù¥µlÝéV×êfjo.oÕö*Ä?)m NéÍ\Ú©d`[]y]ÛЄƒ&þV‡XwEñ-zñ×:„sÌxÜ&°Jñ§Í"þÊFñyé¿ÿÓVš‚ã8[›ê¶Ö–ÕwŒjÒ±åŽÉtFà“ÅÉ®s0_xÝÜ ç³æíW_ïv×ÙnGžÉ‰Ñf«‡­ß '+7è›y×*k˽¸ßïÜ“ÑæM´Þ·.õÊÃêzQUõº{OÊÒvóC‚ŒÛêI*ýé´¼o/¯¬›ÐI{q»¹™ûiê$„µ-fÍP¥Í…Ô6þÛ[Ë—|£Üo¸Š«7m>: YsŒÞ·NGšF™šZ–Rä¿Ù¿È Ñ&¿Õª•6õ„ddË<‹…;¢¨Í/Ó}ûk•ŒÈ96{ŽË¥5þ&ó¬ÏêaÉïï,¯¨É5|u™g Mçt“Ûû‹—1æ켋;¥Â‘êòòwÃ?ȵ&ðÌï¶Õ¾#È{šò…ø:|©=»÷ãk‹Ü(DœÏc¸ þ{¡ë-z. ;°tmìWW‘\¾Ê˜gma9Åö-¾–ú —­QÔ¾ÇÊn]}yÎmµpÙx‹üaÆ‚ÙÏfØ,õÝúNHÜØlmjà±r½ïÒy¦æ6 ùÔOœí>g¦Í㈹úó#±QОíÊÒgÚ¸mI|~„c¬ÿ4;š­åˆo.øз%¦ÿ á|„H´%t¦Û‚‰xñ®„Õ?º,âûÿE|õwÄÅ|…ëÔ‘Küë?_üwâÏÿFè|Eläi‹ ³þÝöLÅÄ ë®ï±aè[Ï]äj®Ë²\ü„ (ï©Xæê`îä±mÛF;#SûÕLJ¨B‡­ÌŒÂn+i3XÅ25ŽºÎH|eÇ2]³E‹—µŠaß^ï –å¿Mžö,S»E÷Û0cºî­þÆòÈ8mn¯üÖê8þ*ª[j¦g`9ouxúe¸nºz¢µþ œ]æV~÷ˆ´]Óg:ÞïË+Ïü§¡Ýב2]Ï*¯YA›+‡×Ú-ÜOÓf…Éh£Mõ“³VÕ]bç}m¦«½ËÖmÕ O3»-ÇŽÍg®J““´q²28wó\:zhÝ|¦)c¥ïߥsõ6{¯“#ÄõËÈÓñ Ë#MK\ìXλ¶m°°°¹õ<×ÞÜÔÅÃçÞËvW[£‰4m^ÙY¿‰+ª½êdÉ2°žçéjehæ’¥èˆ9ìcnj¼Ì×o冕sTö+ê8ëSƒfµOèÁ—­ñ060qtu646]¶'”òÄ—ÐÁI¹hä]Úü¶­³[ QŽ:“‰Z[šûG”mV*lii%¿Š†ÛšQ!mÊ“ z:Ñù¾mnmUtßIFß½ií¥I.餿õv477wö#öÈÚ››»´›üÝ-­]£ÊS”vµ¼ní“ û^7wHÐ&ÉðÛ·­|±¢†¡Þw­=2Å 8igóë÷|-WF&ê ò²­í•N|PñzZÉ“ÉGû;Z:‡È …¨­µ¹o˜lÝtšíÍø<[ºÞÑ·ÁPo§òtÉX?ºh(Cy݆»Ûß¼iIÚ[›ßÓ³0Ð…Åe*¾ŠFûÛÈ]ºû‡Ç&¹¤¯»ƒ¼ãZ{Çè_J4ÒßÜÒ"h(î}×þ¶¹¹ý]¯H¹¦•\ÊO^ïV$øé} }[ýƾґù‡Þ/¾è3`¿˜"øB§çJœ\,G¾”¦e~fz¶)ªa®ƒ½Ër²Ùøþ³irA÷rÛÅ¥‚Ÿ|¾èáƒý$™T(èÒÑ‘MùrTGg0À¿70D¤£#šòÅ€¹ 6{äRänl>©Äa5jíÎöçsi~¾óŶ¤L†h2X\„Çõ}õU¯³½\(–õ uëèŒM™ú^G‡è%b¸Í@ ÐO0lð°L9¦Mσ'„Ž6é×ÐWrMù’ЙÒìhòIåB¸` è§ÐOîʉήw_ýu÷ßþ3Ú,ËE2!ÿe£ø¿ýqô¿Áÿo4¼$¤"°©A Ðç wKðHa©8ù†¤ð±Ï¿$;ÄeDÃ7ÿW0õ ÉW:¢ôTXýDÚ2©¿É3FDŒÉñ¤R‘T&—KYIÁ°Îñ—:Âó'áZ@ ŸèIa»FFHe2±wu£ÿHÛF2* ;gˆa4ú¥Ž (@— ýɨÁ6äÄ üÖ(r$~ižˆÉjž2UšÿTLÀB¡ èG›6ªÈá ÔÈv•™Á²1¸®J,K5 èä‘||)S9Œó@ @ @ @ @ @ @ @ @ @ @ @ @ @ >VôÛ@ER‚/– ¥|11&–á‰Q”ú H"¹r •ú*WÉ C%ŒgϯR‚P¦V‚P-úë‡K 3¨”0^£2ƒH†öR+A‘_¥‘J  % ¯*ðîB™PBŒ¿Dý(ŠˆÔây QÚ!Ï|T—S?XÜA”¾#n¥å¿â·t*é îg¿,x#DJ:‰ôÛ¥…ÍbÕ h{Æýê¼#Åíò²âNfEQ«T-C›ìöÝŠ‚Wª„´›…oEš%<¬E»SŸoÝ*.Ö(¡ƒ¸}»ŒÜK^ÚMÜɨPdV¦¢VÚ«¨EJUw+µPñY¥„»÷ªÐ ¢ÑŸÒÓK4JÀ{¡Údh;:È»÷«Ñ‰çµ©õDóú‘VÍ«~"§…HÛÐ7“GZ››ÒRÆ:;&îDÈ$5 —_55\Oâw¿£÷Ï@õI׆šßÔ&\V– Ñ8åu×®ð»ÞÕ_¿&ì×r\"aÕÅØá–æÚÄËÒ‘!m‡.EÇ0ÚÞZK–0¡ñKDµW…½=uWä¾–ýG‡«âbFÛZk.¡ÌZjðÑŸFÚZP6Œ®¢¦›Èo…{úÁï4Ö2‰$ïüù®ª*r»ö§x~`àp{ûÄ ô×gc½½“eÏNœxûöU  ‚ÁÁÉJ@ÿfùû£r´Qg@ûf;¦õèÓÌ:rD*MV…xl • —É4vìÁv X8 вn’jU3ÞÔ¨OU—/tu½¸s‡¢F3”I¥e11à iiC€C}ªJLíre ¹Yk[®¸xQÐß_›œLÑ@㯈!¥‘‘c==5IIp&æAÉÿ¾<6•0&¡°òÒ%áà`UB‚httâî¨Ø²èè±÷ïQ 8B¨AÇ2 #ŒÐUPÿ_×C áþ>Vcb"»aT•è9ŽšB õµ<.n°¥E#CÝÂáa:•ANf’‰Åå114ª¯^E Vµ)™.¡„ÇCTÑÈ€€ ª:”ßßOWAÙE%\®xt”úŠ¨¢Á ”Aa´H¥è3]"ŸöRM(,æp¨è*„CC%:º ”MȃCü†ÜB ÐGjHDdke•Âpâñ©h¦ $Ù'4LQ‘ÝE;q(gy\œš]48XNc~ôżè“>V|Y΋Q§<ÂÅûÆFªá#“c¢s„]*¥…ƒ¾jŠÕW®(úÍ'„…Až«WI# AÙK£=È/ã“À‘ˆDxdŽJXÓmŒ§ˆ¤ «ôXQˆ£3 PTÆÇKÔãÆøÔ®\¡ ‰jGUHø|Õ*ПhŠbêêUšET¶1¡4·Y ·ôCâ6š‚ õôÔ&%M qPm ¹3ÃmmÈä@þ…FLUÑíé) Ó&È 1rgP¶‰aaEÐ8$ᢄÙõ¥×üþ~dÕh c§,&Ñ 9wZbMdÐí‹J BÓ«@Š9äµ!kG#_ü›¿  zï»\"“ýØñÐþÈ(_òI G‡GE?õrÉ$##Ãb™–{ilt„/”Ò×d²4ˆþÂBOLtÒ’ß4m”¶ÁóS§Zž?'&ŸVuäHgY™Ö ¸©ŠÅ÷ìxóFûE—Ëñ¤€£G»kj&«mz¼oŸÖ(!X=ܽ›Šáh­b¬·äP{ûd}LÈty´{÷âÒÃöîÕ:Òø/H›¦äÅßØœýô6X|äßõ–tKä­Ü×ØygÖ'A›çç™ÿ¯]ÔO,døm¾ùœé·:'ÜlâaŸyzëËÑgÿeß™®ÉsS>Ù…V-ON:ªìŒ™YýNH2²v¡É¦Ð ùOº§˜›<êàOrUˆÉ‹Ê­òI®™öß=Ã×`ÃͪßPÜfLúüئG7ϺääÁ PEë“Év¨ª]„<äaQ[j““5â6H¨ýÒ‘–ÊK—4¦6dÏ’Eà*Šˆà¿¯zS!×)ïüyz´°Æh=j4  +}4Üg­–Qyl,åÄá sPjЇ…‡† CBÇ@Î Ó8d0羕þ¬!ŸËWθ;XY:,¸p=oœ6NÁ}=å~^Ž––¶Ž_âK•Wo°)p—µÓüŸ¾Q‚ÿë*¾¶z“¥­ã¦ñý¤}­JB:rdéâ·ÔÎÚÊÞiá¹ëeŠP ×Èimo{ö*gæ²Ðäó`èÊÙ].vV¶öóO%æÓg,ë Ùçë`mecëv{_ª­•…o·]à?þÔ¾°Ùvñ‰rÅS¦#wŸ¯§••µë¢ÐÔ"jcqÌ"Sï$|^wÖ¯Nö•lôr47·Y³ŸÝ/R´Ù®ÊŒUîö––N§¯‹jÎÙï×x‰ºk-õmŠÇ¨£ÝÜnokí²hsvóÐOL´5d§½—?y.’+çv¹ØÛØØÚ¯;öí%Ù:É25µ°²ò<AonÂ)G;++[|DÔ™†í´_ÒPs7ÜÝÁÒÚÚõìÍU:=ˆ96íáäq§œn5ÒŽÂÃëY[Û¸-ö˨ê¡øéNÓ=wê;´™O›úêëh«¦*!a¸³S³õ7oRAcż§ qã†ÔTÊÂ!”³ Ôú¤d²šk×èŽuŽ‹£XDO­ÂQå6…G'EvQ|¼ÆLL4VzLTw9݇E±)¥œK…£¾ä``º Ê£Çá T"@©ò‡ ÓA*T‚FXíROw{!»®$1)¯åu#pÃMØén6}ʽ'3’|ìõ—ž~BÒf¥¡÷æM»o?Ê~r'ÞËxÖòèJ|#ÕžŒ9ÞÇcs ‹§EÏÕŸåŸV«@zêi=]+NÒݬÇ'},YKO£3‘ŽÓFróèR³ÅÞâu5äE—ëZñn>,.ʽ|~»¾©û3òþ}ÄÛ¬gäœñ¬0÷ÑÙ mZl›ÑB×Ùß­=w9;7ÿÉ7c½]1ÏHDrgÙ­r÷½t+3¯=}z»36y”S˜ó(Õ×ÖÐóp‚²äåæ÷ž{CŸää={”¾ÚÙtÁîËb¹&n70÷Ð_Oú2æÂMRØšg£«w€œ[Pð$#i¥­î’p ŽÛl¯ô¡÷áZ]kÏÍÛNÔ¼hªÉÞd«ë˜…¯õ»LÛÙ³·†&çäƜعz㼶šð—ŽŒŒaúÉ¥‰‡Y-N}œ[ð,óØê¹––FmÎmd¹îÉA·ÛZùžºŸ—ÿü1gï‚Yv[†å²Ö¢‹,]ï^nãÛNTÈÕCž³Y “ïeåçfÇ÷™m¾öyÇï²7›·>€›RÿêuyÖe»Y3NçRwæH¤Ÿ³õ’·<}t;a‘¥ÞšÐ|teú›îYΞ³;üzAQaFâk]£È²~*Z%”ü†:2°'ÕN4$_§üd‡hLo¤»ÅG»ºÐäYPmVÃñA¶ â ²ŠÙl¡:(ÝèqqÔŽxþ‘Tª5h,ÂÃiÈIRÃÎ…¡¡xb‚@P¬VØK\.‹J絪煸„gt²ÙQ_EÐ8(ˆšÚ€ª©Ç){ úÕ‚»«ˆ_Ü“â¿Í³d^-¢.Áë‚+Þ¾[e˜6º³ŠÊ+æ2k>Jµ™¹8‚Þ½÷é®éÆ[È ö’ƒóg,&- ’¶Õë<½÷²2L›™,+ÔÏÈyyÛ˜ ýY.\ë8sCÔK:*±g…ÕÊ·QSÞãøÝ¢Ð&¥©Ñ½ÚlÚDÚȆ[ž?/â+&ÃÏî½®Œõgð^GMŸaV§°™Û®lf³ªŽ¸¾Šœ9{n ¹+=…¹yBl«¡Ÿ !z·¡ë²÷M¤MF›ÖœS†M©rÒÞHWûûQUÚ¼´~Æ4§beèôõÕÅß9œG¥çíµ›³ô¼Ò¼=áb6Ýþ°`²(½¨{¥å´W;¨K!itgÎT§Íð.Öô}Ïéÿõ«6O~f9Ëü~35IPöª:¿¤®›4´åâÑO“ï.”`ÿ8dƒÛ®a¹Â¸=îËtß›>ŽÔÜ1a24ŒR?|Õ=ÞªÇQ×706gÒ‡—»BßîÔ(ñ›=–øíÓ§Eáá!”ñ–,—7Þº…{¢•6ÉÄ¢^ܹ£j´LˆçËš22I&vv+Ì©™@ˆ9“ ôÅѤääÊdHêSRË#VZ5î-î7‹«»~]kÔ—Pv¦£ÃИE¥,B6:”KüˆH› YF¬<(P;äIÍ´;-Pº5×–Ìv B9lml½î`⥋qHã£"1¦³2PÓ“5¸Ïœv®^®Š@žÔ·fk ¯ïÓg®¬”QÅI‡‹õf­9‘*&.v£‡‹«Ï™´r¦v<~pÜÇDƒ6TÙï*oïô]µdñ"//¯ù¶ff«OR´ù^Ï¥Rá,H¶.5uóŠ‰#u1!þ¼õ £Ð|NÂö\ÿÍë–’»/p²aº.íæË>’6Äð+Ö+W¯]'³+Ç|UÚ|gqpDy™k¾·>*&dgÝ,=Ï&Ñ>[륥ßXœŒ6âÁBû™³âš¨\4¼fž¡ mpßJÇO×ÄnÕ–ý ·Ÿ ÇiCÖ#ëº|nŸ÷ò¥èL===Ì f~†!²ËÆÙ/v!Om¶š¿ýúZ›aÊ´©Ö¸ºÖÎtÝ’¯øÝ/ÙÄ0pªâÿVi#“6¤¥!ó£ïåK­í5dÔÊðÌJõÕ'TQ€Z:¢Ö˜0Aή½~]kИ^D¹*¨ŠõYŸª-•€’ÖN(ªƒ $e}i­ÀdÓB© ¸Š¤$­ëáàGT_Ú [‘Qâ_–6/sbL ­J† ¡F”ÓÆÑflÓÄÆË{׎í íعcëŽ,dÜH*œ¾ŸñJ3‚‰h3kŽÞló¶,#ÿ´WŠ'õàs;=ƒE~;•¥lßµ{÷‘à8BTáøÝle!d_ÏœhÛ æëOgì ºZ\YûâeÓímNÆ«”´1˜×0Dµ„»a1ÓÞm]>Ö—_d/Ó˜ßë®9ÂË+«nll̾°ÉÐYmÖk§ y0Cé±ç7¯_åle¨o±äþ‹aMÚXùÓ+%mÄí-V¥ŒÇ3¬ÿÚjrÚôe[N3Hz7Þ'åëa¬Aüü}vóèÞÍKܧ}£ ö‰ŒP·m¤£û=ÌÍnN{RPßð¢¾*cÚ8m6ß¡Ïù4IôµüV“éÔ0¦q?´.Ÿ3ÇeÕÆ;èK¹s×Î} #¿AÚÈ ;ˆšË—¨°p“r¢“†è¸1æ‰úÔÊ,¡ÂÂÈ€A¦Å`këÄvZªœVP“”¤µ±—‘Ó-q„!>žŽÀ¨……Ïóùˆ{…aa3¡¨c(Œ¤Ì¤råzÆžnI†bPΉ¾v ‚‚ÐŽŒy.¨išQ±b\WT_ò‹{R]åéæÆ÷Z”½&ØÛË'¡ Ú¹ÀÈùÜ]m%½[müõŽ§£tèY*#ÃÛ6žõ#’ú+瘹•÷àÇ¡”ÿÒÃàÛså‡I7/ÕÿfˆîÑÚï>{mDaËÝœ¶_ 2××:›øд™«¤ì‘ÿJæ²m"™&®ïœÙj>Ïû½rœøóÀ­FΓØ6»ó•G"?ºÔ@aÛŒÿ 2©œH>³Œe¹uà¿¢ ªãeérü2݆ÿÿö®Ä©©$ÿ/[³µê¬× HHÂïFÇQ£#Ž 23…X³–:¥ŠH)‹: êà‚¨ ¢å¨ˆÈr„@B/ÉËöñòòÈ»;c­eõWˆ$4Ýý^½þòû}ÝýuËɸYËŽbûXKüßfŸ“0±Ã6´#f¡/Û0ýp:Æ[‹‚çˆÐ.³‡m¨‘WËæ.¸â^ß1ijI™mºŸ\å ¯<ÏeÏùø¢/·•wºfœü¿«Ä®ªÚv³Ö3‹ ‚ì>ÁŠ3Ð\‹# KnÝâŠÆà?}°3PŒhì–|1Q€ˆÂÆÚa9€p¸{©°™ ëxC£ MN4Õrí×”+c¢M°ST¸<×B‡²X`Ž†ä \€Õ‘ب\&»µpèNÙpóÀ½Xs-Û¼ûåæÇݹ@à ¦Ua Û¸†š–…f^g&ã*~Ú>· d EÉAKRTîÕôÏK¾Oϯÿôd8^¯¦¼â0 ˆŠ‹-È…»GŠÆ(ߣ²±°+ {Dcœ1¡}UÜ-ÕŒ%Wq1žõvØí.L $hfOº …@€dÞäærC·4š‹ Ï7y/Bp:¡š¦$ó¶ €% h B nÁÉîóç¹Ë‰qÞÄ)–…½š°RtýÇß¹`xzJ¶˜·iãr~Å•vØåím_Æœö°Í/‰ó–Ÿ@³g$ ‚¯ÓÄÉëbââ®4àÌ×åÐ"Þ)ŒZÑ\_ÄÛ’r¸yd «k/FF„ï>úSÞéãÑqâý{câÁP‡Ò5­Y±T°4.uŸxçÆèÞÒÓ¯àSÔP?oC)b›¿ÿ%2ËÃ6÷vΊú½ÔX}0ý@|솚ŠÔÙ3)XHnü à‡E¯ß‘¼)nÙêo7o¦ž}~w*•¿â0Œm*Nn.^´)yϾ”¤0~ø¶£èFé/Y¼0"!éX¾ÓE夭FD¦—¾:&âX…*=9:J´¾¨u¼à°(.­Še›“{#W‹òéð£(,8<>q}tèb~B™ ,kÚÆx^IJÔý6Ç yK6Öö}Š&¶ “jðYݧjk]À¹l/Õ×-·——utà…ý.í¿þjP*!ùs¼/¡ãŸÁ€CïÌ eF à1ªÕ€(|U–dLÝÝï }eafRI4p•w™@JeÒhØÍã¾Jè?hp£“côÇ|}üÕ}¸9‹¡_)“IåÊ#s&Fº;TƒìÓh5vIÙ—ôä@—)TÖ]¯Õ¨VÊ¥2¹F7ìÄcf¼_"ï¦ÜÆú:% ÞŠ w©äR©TÙ¥µPžEtcƒZ…\&Wv e¨OÕ©õU‰GõZÔß®Q¸»ÂÞ« ¦¬Ã²N³n™Y•fèïQ€®ÊäÚörlFhôß`Gë5 Ð ³Ý+GpuÝ2i‡L¡£POz͸j§uDÓ©=‡wÀ}Ç,úN©Ú€’ ‰BǶEj:Ø—“crxãôf§¡ú›?GŸpŽ:Á·‘~ ê¦Æb§{»=¸h§G®Â=¡íƒ}XŸLÖ¥˜t2£&xuªžAxý£è&Ë´ƒpŒŒ÷Ÿû,Ž¡^¥ªÇÄÞØ~­¢SkbWñ õÁ›&WéMwJ—c¼·[®Z®T#¿lúÓˤí\ƒýå©Sš/¦éö³'ú?|pعx]FÆô;žçä ¶·jÂét>ÉÊšæPÀ$ó»Ò˜§zý³ìl_ Ê`6?ÎȘ¦†1®.3“kRÊe›zâ8ñ¹À®}øýñó]̇ÒdqRDÌÑRr[þXlÒùeØ3SVYéëæÇÈÂ?ÿ €Çì^ è+]¾ ƒ‡¢"0ØýŽt¸Ö—¢@øäµ­€+ Ãe{%%6UçJM—.ž4œ;g5ýιƒX¸ö##s­WgÏÒHòõë=sPT×-ûˆÆ€mštä úl`úv?<*:=óxÒ†è0^è}4©CŒ§ÿ@Xí®ê6«QpÏ\„ã;-E·í¹äæM®hŒÍdšÜÓÐ.dOÁŠÆl+p-R{]´ß¼éµ8ž¹àΰœHùáΛc¢x_\<éVqÛÊʼ¦ÅÁßB>T¯_÷â4ðúw¡üÈtl–²˜¸hpdj˜¦°ìÌõÏ’×è„r˜<ŒŸPbG[‡ëëîÿvûveõcÅà„‹öPÕjíWv3â—Ã]øÜò ³UÔÆç#p7&€ïÐÞS¯g# Ö…Ïű†À“PŒ°Œô[îÐÑ{ª”Ýf{[PàI^¦ŠÆ¸ðx1$ÜKå&@‡¼ÍÏgÏG`Îq((` ¤`oòò¼\& Å»Q( Omn×B§60¡¶qøîí—hÅ+y‚þSZCæN­t¸Îß±!‡WÖ ª©ÁÑqSdaÌHH6ªTøì§I4¨½¶@‚x 弄Ú×JÆŽpPçæzˆáŠÆ%%æÁA;rá³ûȘq|Ò‚Öúz«@G ’‹ÑA«À©î[˜Ä°ãtõ' 34h³Ù­ãuwž½Ñ‘@›€à¿ !á·‹«ªFòúRñ8² õ=³ük+ýgKÉUjÔä·ðOz«¼íZ©9³ÛÏ0””—5枟4øû-\çñ¾èRkÉUzr"Pí7®·––Ðv*Ðå€4æå:á©ß~š ©Éwùym¥%Xw ~PI KœÕrýFuIÕ›^ï3²Ž•¢Ë[$–·½ÐÝû«Çù¯»Í÷K_(Æßø+Þ¬~$½ÿTñ2pª­•ÕÍ/df?õk] ÇÊwwk%õjÊo ¯µtõÃÐÿà;4hTR¯²ùmâ•zü¶êA[ƒÆùº×O_uÛï=ê­€ëõ{ Ï;©²Tß¡‚ßá@X(׈6X]¾_Æ ø…~ö[€ž¶=µ€ëjÂ5S®ß×ÄŒ5ÐcSÎæ% øLðoñòž endstream endobj 888 0 obj << /Length 538 /Filter /FlateDecode >> stream xÚSMsœ0 ½ó+|43]Ç6˜k'm&é¥mÈ)ÍÁ Þ… lºÝ_a™´I/½à'Yz’ž'GÂÉMô±Š®>')Y™ÉŒT’äS©"yZ°´LHÕGz¿Ì]­Žw2/èƒ53¢›¥kL¼œ~@ÇwÓm  “LÄOÕ]ô©Š^"9$—@ž²œç¤¢Ç'NðßÎ’² g54+àìÉ}ô-â¡Û—H S>Bæ’Iµ’¥iÎr%V²«ÛAqr=AΛØR1*RÅ ³-T`(ŠPþ%Â*s–€~þëÎ:=Öë\BÒZto'D{%¨Fs4±Pô+ª]KE®vH—a*E8Ê‚Þ:L~å݇ÈÅš‘ uêÖÔÏÓŒ`ÐÜsçZd;éÙõ—ÞF«‡mˆitfthüàŠ[n|ï¿ôpê øý‚†;!X©‚¾tV„h<þf%ð¼>n×+©3¾-°÷ âÎI–Òªí,àYÐqrlÙÓÁmÄA(@®–cë© »r¢Ódm·ïCE¯éÚ»sº·tƒµƒPàš]zgßÈ¡ AlÅé‰3ÂçÖÁkx9¯pšËül¿ñûmP)“Ù/ÿ+»îlšØUÊÌŸII¿Æ ‡§‘œ^úI7¸•_ðWÄþäÚßúmpÀTe¬”Š!•zßøo>ë ˆ endstream endobj 878 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 363 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16141 /Filter /FlateDecode >> stream xÚíÝ\Y‚?ptfçnoÿ·w»w»;n‚£*’›nš%IA1‚‚9sNÝDsuÌYJNŠœsŽêý«:ÃÎgœý}÷­ÓTWwWüÕ{¯ª»4E Ë~Ÿ$Z8Mq™¾å×QÆ{x_¾r»ö/Ю½ü'Eg”_G º[»|ù ìÚ¿Ì´YùˆŸLPP~eçµ’åË—c×FÚ   m6((H@Ú   m6((¿´²ãZÉÌY³òòò^õ››‹iƒ‚2¸eûÕb=}ýM›6­WØ°aýoKK öw¤ Ê §žþÆ×÷@‡Okk+öw¤ Òiƒ‚‚´¤ Òiƒ‚‚´¤ Ò6((H¤ Ò6((H¤ Ò6(H@Ú   m6((H@Ú R¡Âž B{–/‰yŠG?+} AÈK¢˜?“(zœ°DI×;ðº&HdïÖóÙ£QÒ%aO…Ò†%ˆ¥DÉ>Ž/û¸$‰tz½/QÜc éŠïFa "m6ŸJ‰Hi¯­¦£Ë60ÐÓ7ÐÓÓQÖfql=7…$2û28ái¶#µtÆm{Ê$CxŠpÑ4ŽŽÕÆLÒJo>Ô×>7¦4"¥Ù­é°9.*õ´¡S+6ÉÁy¼®–²¦¦ª¶ÊpŽ¾‰ƒw/ «®qv…ó´4”Yæ[C3¤q'-["ö²Yªzúôr9šßë°uÍ',X«ˆD¤ ÒæIŽ¶ëgG^èg$:›¼xÝ”¥6ñ`n$)d_Ø"û­¾S4¬6¾Oeön^B©¥þèIÛS™j ™Öâe7Ötö9^ OnvÒc;m½™Ú§bCÂn'˜kŽ´ž¹{{œ8&›Ðe÷ÉK¶júî{ƒ“d$ÂO'>3 -|Néª,=ßÙ•B[#÷ér¬÷¥1SóœßΞ>͑ŲÜrO@ V"Òió ¥Ëž¤®|Ï +gëhÙ Ï$áI-®&œI;wFï×ÕqÙ“ «‡P»w/Ñ`OØ!­ÛlܨcäôTL?5PÚЩµ`Édýq“ƒ»›?t¸x‡ËÑ^rª"\:$*>Þp´ÎªdŠ‰ãÊ ‘)ò¦œ4mÆízÒÝ(‹Lkœh0Vß÷NdV"ÒióɦM&Yᥡ=á ýààõ'zì±k®‹ù÷_êÓ±p²‚©ÏÐ㤓ÙÓŒL&E$¿¶Ô>9¼ZÖ¨é?m’Hx–ÄÝl˜Õ²Ì^mŸ$*"¥ÑYOÛzÃý¨4¦™¶f‘;×}}D: >´Zƒ3ã“$Ô›iÔT²+Ì¥á¶'+iƒ´ùÄZRGé–ÔsIv?e¨©6ãHYd&Y»Úm{ 4„§IOÑ3œ{6*CÞ¯zý–†Óx®ÉÔàˆ yßË@u›ÈôJ[í¯'F´ôùôð4ñ-©'EfíÉÁÑ™Ô|—žŸÅ¶žåÖGÂ~Ó†nÊ­š£«e–‰•ˆ´AÚ|ªý6òKhÒÉ4®Åô3‘Y$JQ—ÍÔµ_ÄO‘¶›è´9-Oþ;Ò†I§ÍA[µ9†×…QiÒsëI$"‹lܽŠ£­»é®w3^—Å^~¹5æ™ü³¿”L5ùÞjCvDz¯´‘ž”'Îåjiz-HÁJDÚ m>á´a†?¸­?FeÞõž½TdÜ îí%·u›ÒÆÎÿøŽ /¶þ(+ÏwÜídºn2¾S­´U´¦í¼±åÇì-gÓüxjj°§ò+éôÜÀ5r zªh¦Iß%G{ÂîDYÚ˜­>›·í«­?>ó߶™«®l3=84™t_ˆ´AÚ m~ñicÏRwÞ•Ø;m$+fXhÙo ïÝN¡ÿœã¡ªçvš'½gïé½:*f}ÒÆ‘£ÅÖÑà( [kÔ¸5¹ôÈÒ+“%{O_rv¶b³Ô9:\G¿à%LQV‡›áÿ™û?“¦¸Ò/4ö¥>g켘Š­Aœî÷Ô´p[´êly÷Ï(H¤Í§P˜M‰Híõ-z`x:‰L—_NÜóÛ²á|¦)Ä4¦"3IÏëëdïÙ§¤‘î/¤ºe$!=ëÍ—µªzŒÖ³ýEžÂ$[¯7Lg¢Vƒ´AÚ   miƒ‚´¤ Òiƒ‚‚´¤ Òiƒ‚‚´¤ Ò6((H¤ Ò6((H¤ Òiƒ´AAÚÒiƒ´AAAÚÒiƒ´AÚ|Ü’D|AfXB^Þ ÂAB¥£Éó^ÈŸ’=è©ž¯’=K?ÎîûT׫~z Åý¡6H›_æoa%“sG’ZþòUÝ°1•¬¯Ôy_êñþªwïZôŸG¾äÐ#¾äÖ SIùJ#ìK=þ—ÌS-ߎú‹.ýÿKnó°Ñé_©ÓOÑ/¼õwí¶ïFGÿÃ÷w£/õ[¿óµ*OúÔõ¿kÓcý+ó†¼/¹#4ê”5ß2%ïQT^Úy…¥!=6H›_^Ú¤—vÓîn<’I*¡:ø+óG†]*anÞÍ‹ç/Žàm½’A¶óWç-»ZòœðÂøK¢øÛ¯ÒÃèW­>Á_q˜~j>Éɹ¥j}tI8]ç }*æå/?Ä»RòLú†ô«¶] ]b·ì-Sòβ/—Ô};*øÒiƒ´ùE¦Íøé÷ÖF 8N*á¯9ÅŸ´‘/¯00¿Õ)/²º'õx*‰êùÝÀ©Í*Öw>æIŸ§z½jξ¹/?響1wðsRÿ Òiƒ´ù4Ó&“ðí–ñ5Ýø?á¶ò´áŒ;ÿ¶1}öó½‘6HøM› Âw ä³7¼x0ÓæÚšÚ¦Ûøçòø!Þ¿n‘EæNdq´ læüÀÏø´I#óšO9ÏøÖu¼D•é÷Í/ú´+=&Œ¶œ÷iH›Ÿ˜6²[¥Ä<'1Ù$:‹é¥av«+¥ü39]icb¤17¼4*S:Î3žL½±ëIo­"~«ˆ”¾i#»Óed–⮟×b™1iã½o2G‘6Ì¿ò‰yN¢2HïbÞáHŽÈ™5Üó9ž#¿·KWÚ„§Ë_H:ýAѽï#C§Íü…¦&žçùŠ÷ï÷î0‡_“˜¬ž7œbîJó’Î&?¥¹‡´¤ ½ÿò•ÍñóÒe©±µTMœm¸ÙÎôÛL\ËWŸ(oIIÓÆgÏ-W+KE×Ô}ÅÙjþ|;kÒDk¶æ®™OhÆ=Ó†ÙOCï>›äbª­­id;}MDŒy[|XJ¯;ÙÑu›qÆÃÜ6e÷©ÛLrþÞÂ/u@Úü¤ºM ™=ÛÞØÁ?ø‰ ,‘¬Þ¼ˆkທ>èÛ¯àk¹w§1[ÇpêÖG’Ч•þ³´=$÷<ÖS‘ 9–ZnAY¼DÑÁ›Éú\­YÇ+«Çô¨Û$ ]Œ¬g‡…%Ã;§N6ãèY2i³ûÎ~é[QIÕú,«eyIâÐ'­³\- ½ö0·«ë *"µÚ‘õ½çÉ^¢¤»ßf˜ú–è¶ú¸±â°„ŽóìØ,‡åI¼Þ-©ù‹­tõL.ç%ˆ÷ž»Hgβ³m=ÞœI›ñ6“·¿ê“6ž,ÛʼnH@ÚüÄ–Tðƒ†º“J…Äw¼¤«ËÞrŸðלäOÛ.;a-MÖ¤m"™{MRÑ )†£U}¯ˆÂ{¼çN^ÛÈ2(ž’æ†dëÑkïwVÑéJ›°ø\SáóΈd·¹Ü¦Í±`Òæá¿”¿IЩ9ºœñ$*‹)GžÞåŒ6Ú˜Ðkâ£2êXßO=ÝžÒ}Nªñ{éNZfë2¢Ò™ºJDZÁˆ~Òf‘…‘ÝÆ0Ùý7Wjú†ôé·AÚ m6%m¤”ݧ¯Øš±ôÍ̬lÍ,̸\Îæ»b>ÝHQôTH[RšsxŠý½ÆAû;×í=º[×l[§gîv ¡»aÒ§ß&4.NOUmå=Å4\>'oI-‰â[/’}Жð`º‰di?ÁÊ)ÖNö:c¾Ÿ}ùÝiÓ¤¬jkÀr*‰L‘çƒû­~҆鷹 ï%ffJk.?/iƒ´AÚü,u›ð´{ƒïצȞ:pæš®.gsá/?Äw èÑo£é–/ë~‰Ê¨¯9Âíh[Ï´Y»c£ž¹ó§òV]yx#mè«©úÇJGH"açÐÒ1gÒfn÷Õ}[#øzf»ŸôíîÙ—;PÚرÜ#K"ewúN%nΚ¤Íùî´1DÚ m6?_ÚD$¦Ž½8VzF&¬ßµD—®Û<"|‡]W÷ÉZR7ÇF¦0;~ôûºcXËîHzî§A‡¢´¹f»¤ºá©’%~~®aéµ*=[RÅæœásŽ´Ê*T[÷î`q¥ý6³öò gÉÒæà7Ùºì ·:eãD¦µï¼^ËLXÒ;[Rš³œ5LüSd-©ÈÔ‚qìH¤ Òæ—U·Imq4Q¶]|fó¹,ÿí]g³uXó£ÒƒÖðÕ&ôHC‹© "6ŸIå5^×fahŸ^â”ÚIÖlc¯ÝÇ“V…èh²\éè®Û$ÑU‘§›©‘ý‚ÀãÉëb.8»˜²u-¶=H¯ôËÞ$<¥uæD3×UkN¤m<?ÛËŒe³*4íÝ-©úajÛŽïÔQ7^™²ùôã).ŽÆfH¤ Òæ—”6L‡mðÅX;C“É[EfŠx;s9+ïK¯(–õÛ<®´°à.=Yâç7ÕÐÈ`Üäu;âû\©"m¿$uø.œclÈ5±›pµ=äeïëm˜*G£·÷dCÃqS6ì½o g³å¾€·ž©DþAÒïO­Ø°ÆÔ„khl2qÅéƒ)}?(2£ÁÕ@sú™ÞiórÈs²zó#]ãñ³Öß#“ÝYþ©¼Þ¡±p™ÅÌËò´yReaièYÐ+m’„NNúSwå m°¿#m>Â9)JZÑE§G8]ˆmäß®ë9‚ìt¹lLþW÷õák‰¥#ùIGýËóÙÏ7Ûóê¾®7‘æ õÆ— ¤O%w§“6ߎÞ_¹úxid†ôÙ ÊÙì;·½U¼ÞßJ½³<Ùº& ©×,È—Ò6?Û÷¤\è–”ËÏñ­Ì9ûá;àߎÝuå”öµéÛ/®9ë»p KÏsGÒ`,«§më]µÒæ¼³ßʤÍGù¸ƒ×Õ}7m¶_e:ŠêwÀ•é÷?ëèä`jic?{뮇Ù…=?qY…Þ/²²µ¶y0$£ŸŠÒ6ƒðû6þG™//ü i“& ·Ÿ0;½¾•Ùãwx£áÓãgy#»6€´yóW‹ùÏ¥—øþ„*Çû¦ kNø}¤ üëÖmŽñÝ7ü,ý6øí>¤ ü‹÷Û¬ø™úm˜k‰ý6Høզݴ;›xÏ”\ì¹-„íÉ{ÍÜ„%Lz–Ðò;¶Ko×"{ü–§“Š±º¥zÖO¦Éž:Øï«RHðÃöŸr{—½E¤îÛÑH¤ Òæ—˜6ÉäÑÒý­ú[ÍHõ~KíõÂѺ¯Tôÿ]?üo'ÿÁ­¡þèþß Âÿnðâ;­’áÑcž:ûnÝHõ›_q˜§þfP:Bƒ.Òǧ¾2 ÿþÛ;ÿ«ÂûÊ„þóõwšM#ÕÂ¥Oü‡^Ó÷j÷¾fËþ̦=Д¼Wù^³ZY3$é´AÚü"‹ôZ»w”§"Þô|Ëy¼%‘¼$ /*™oáÇ·[Ê»ZÎ{ÔΛº•?nÏÿ]9á¼Ï·ZÈ<õ •÷DÀŸ¼‰oµ€p”—Ixâø6‹èvïv/‹ðÝÖó­2¯¢Ÿ Ê<åÀ»Zöî‰yWAt m6ŸvI#ütÂW\HÌÏ}Q±sBí$ "‰DÂÔk¹U}zSÁÜ€œ‰…—VºÄÖ\@Ý>°öÒ”¢+¦+D(‰DHÇ ö¬,œçP캤ÀmË«É¥mùHš_üjýñÞõº–K½1äS^ Tÿß5OÔ;¼õûÚ/iéõ–:mtåE")‘¼º"a¶,!]§¡„uâæ ¯½Væ»®Éw]Ræ°áÅ”[õ'…¤¢º£ eÈÖÛo ôÙFJæ·?Ñ|z÷‚ùaoÛ~B-ˆuÔ{}TGÒT«ñWÊ[–Ouºšú‘·êŸÝðÊÏúW—ͱONNó^ß.éýdãK¢¢LªÞ•Ä™K†;ãµÐ;pŸ°è„«íÔçÂ÷›¨†Ì‰nî)%-ôÃÂË žýÀ‰ÿèYóìVŒç÷É3Ž>Èÿ¨ŸOI:DúßY~P”XHÿW@Õ‹*7ä»­ÌŸ¸¼Ôqù ÷”–Û ¢jæ¬Eý3»¼u)<¹ÂÜ3øCײlôU¦ši¢>ÏT¯â°>¡ánôr—i߶Ónü†ŒÜñ^&x>ÕØðDigÐ÷5'}ìä]a¬)ùg^[raƒËqßgšƒæ{,¾}}»¥…OkŸw®Ï C•È½²·½õfWòo_’¨#±{Ö9xˆÊ¯YéX½±ØP› ­Ã~˜×D?¬I9¼ûpÂ@/V«9Uþ¬›•ê­aäÌ;rêÌ‘ƒ6¬Ñþ‡~ÄÀ¡È™òýy­™ò¾:PD¤JX´&oÒ²bç•%ÎÛ üŠ:_ŠI§˜9÷-þäjÑ?C]ØÖTY^VV^ÑÔ.èZ>âΖªŠ2Zu]£X¶ ÅåååB‰¸©¶’^Y]'’nöõUžÎ³ö––• ˜!TsCMy9ý~•-"Ù§PqeEY›@ÜZ_]VVZQU+`’_Ò\õpÜhý{ÅUµ­ôGS•¥•ôKÒOÍ¿\ÚF^„»/<ÁL]ÄRVBòóIQ iõH›„j#ù¤°˜´‹­jºˆHE)3~Y•,¶ùN§·’ú›sCo¼ Çi­./¯kíçP)5ÔTÑË£ª¦AD)†R’ƺjéBªljÈDDÏT»PÜÒg¦*ï[Œ6ˆ+­®m•×Zë*èB/á6ùq[MYu %î.äòú–&jŽl˜e7e{‰tIŠmôï”NDÍý€ˆøRvËÜu¿|æë*™¹.© µ™Š´‘NnC53¼ 4uÈg«ª„øX’o¸$7䜘ä}€^8Ó&.¬cÖÂÊòÒ–NÉ››E[c-½+ªëÄ5I]i#l©¦'[>SM²™*¯mh–0QÓYüü4[mbfumƒ@ÚÒ ꪙ-«¢²ªµSž íõÂö¦ŠòRz4wˆ»¶ÃŽ–† ÙfÓ)êš Q‡|;¬mlé(uÐc¶ )ªá•®Ö™ä Ù¼wÄ­Éõl"ò­š~+±„Ĩ¡gsq®/o½üOJÔIÚ·øù»溄½ÞD¯Cæ””Xv6¼AÓg vd2fk;¸¹[ë°ØÖ—*¤k*÷š¹žŽ‘£çŠ%³LµÔ¬|™¨OÖbéì_ä6Ñwmؾ úìea×éÁÅ÷9Ûé›s]·vk¥„ÜçÏ5ä¨Í˜¿pª½‰á8»gµ̊騱2ÖXµp¡µçr^ÈN3¯¥!ô‡ó×MÕÖ`/\w(±”^SÛL†™lyLØ“[7é=àu½ìzűÁôDé3blNþ÷wäOß’ÚNyÚŒñ'þ‚p¸DI‰|>–Õ‹ªÌ-Mò™Qõ$¢ú{é°=½vEúRɱ *ZóN½™½¡+œ¹-¯é“ ¹šSì—5¹/n÷Ðg«Í^°xº³9×Ì:®´…ù˜ö CÀ…ól¼VðBvX™êL÷'’¶°µž²™:œRN¿6缿1{¬»÷|o÷qúÆF7_Ô3‘p{Æ×]gXoÙ¼eÞxu­q·›HùÕW{CSsçÀ5›K:HEêY- •ÄR: É7/7t’òOS«¤»íåÍdÈ¢aB´¿"#õÉEÝæÜlf®5͈æÿ‘¡Ÿ“‹LË‚ð—a'ÿù2ɽàäå4úˆÑVøàY™4=^š«~þ¤µOä_ßÍÑÑvžé7ÏÓÊcú,6›#K›WGÆ8E0mÝG{Í8ª®Ó}æÍteq¸ëϦPUÙ«8²4 —®»RÂÄÏö™Æ\¶Þœy¾ö¦\§©²ƒÓí}–ºÞG<&zì YîiÀáL|%–¦G» Yª.®lŽÃýé„äÇÑ2tòZæ7IOScöþ'²#OcA,Guĵעꬋ\6çySWk%ÇAYåH)óèõ¹*\³ª6ñàÖm–¿tÙ_4_ÑgLíÎY±ªÐyy‘㾂µt•F$1aC‰Å”@ŒSQ½E ýÆkÏÛwO6àÌ–IÆ.ëéýuÇ ®ÃühùQ¸"žÞÑÎÒ;NcªKËë@¬lxÙ±™#-–ÉŠ¼G÷ù1ÌÈÏ¢ÕǚĖÉWñ•µãt¦KûU:klÍÙÎôÎ(Õtwû(}×FzU´ÞÐùÞä…b‚j‹rŠjÛ{7J¤Ý Õ7ˆ…;‘?ÓI~¯Dö%17 cv®,Ù­äk%2õóðö"¢ôi–uk<¢Ç¡’kzT°™m¶±,¯ ²©o‹%vµŠŽGžlòkïÕ¾\.&£jþ¨F>ÎÍãÔl¶2‰ÕQ9Δí²*FÞ}rk“²Á$æ3[®²¾7}%«lßfÕ9“Õ '>h¢šó&z¡5Ý÷QWVûᕼž²ËSÅq=3GG6¸:Í “ u4åææuˆ¨“­øš± •OPŒ7³è´©ˆgœS,Î-¦äæòÇ«]Èó7k¶”¸³ 7§±gOtYâ¢>}Ó Ù€Äc+9ºº²´y}ÌYÅ9’~°ÇrøœkÕòFjÎ¥M.Óo!ÊÙ¯®ê)ŸÕªÛK¬Ë‘OrË2îÈy7™6Vl˜=—eœ#·¦ ¦£÷\*¥:j\ 46ÿ o¡ìŸoíèB×–:³§o:/_¼é'´ttŸÕ06±°5/7—®9æ=ÓÕq,ëN”–Eܯ—=fVŽ ¹67¿H4¨uZà«I;‹üDB¦Žz±òЊ"—eö¼¢uÒå)‘o[²«‰‘0}k6ÙÖjß,’-®ÅSâ¦öõ¶4J±ˆ›è³æ‹'-©,–Η5òåž¹n8kºlÓ YáàîA½¹iw’OeE¹¬%•—v„=Êô…Xš6fZÁ—³åk£0f¤†m½«5\ÑQ6νÇjî¬#‰ñäìädzä%2çš´nó-ù­{÷ˆvšDw3¾ƒ 1òRäÊûŸëa1.0R¾'*F¿ºvšÁ´e]ÒTø£îXNR‹4mL´ø7^É?&?|„Æxæ¨^‘¥lúLº§žØ̱´y],] åU—ô†sâ…¤)ÎG™»¤Uñ¦Ñƶ¾?Ò¯ˆY7ÁiFð»ŽÇùLª<îêëyÊÔmâªÈ¥íL}&³ˆ0¥ð,3Zt4G2Ü„¼ï®—ç¨úMèkùû î³u›®´¹ºÜXÝbÜÊÚÆ®7mËÞ«®:¥ª«1Þ^ÿ*+ýþÝÛ±b×Ù(;…11bËu–·”ÄöÚ›Žfµ•?4ÒWÝ{;¼°Uvài•tÑ•ÕU?›¤¦¾/©W÷Ôëû{9:nUÝa)ð7úzþíæ·ËlÍóÞ”?KÐ.ÈîHXžg¿1Çs{Á|Š>J˜¾ÔeÞ¶7?0¥v£¶ÏBÊ´9êPIן;mYŽ!wHkK‡ûº^1V?isx¹‹­¥ÃÒPuõQ*±uò´á_Ï“¿¶0æ{:m„ï—6ôûÖ]fvœáÖd(9zˆüN›ëò–Ôw[»Çœ¢G4l˜6³Þb³àׇ`³³™ûö}jÀQ‹û–¢ß¦+m(qû­ˆ@]5]]##§ø¢æži#­^³ÖP1Ÿ²âø™sWo^ G§ÍKYÚèy•Å6“™´yÖTp«ÆIn=6×Rc÷XtÚšª>—r{ŽR˜­«c[Ü}r­aëÛÀTñÇÚa$äPÝæõ¹žíTÇê|÷€üI….õ’2&fèŠM§wÖm†Ï—Ç»ýÅU¿Ù‘Ùµ«7/6dyyDZÞ676Î4š¾¼Ÿ¼ø)iCsÕ *öÝ~Õ#mþ0§{¸½–¼nc¯Bôÿ©ºÍt ËÕ}ê6W½ §¯èzƒæ¢óܱ¬„æ÷J›Ô㛹ÖÎožjþii󒉑DÅú)ŽWÔm¶‘Ïþƒˆû«~PÚH^Ù© ãçÉ_-È¿÷fݦKMiî•àY*¬©½ÒF|x¶•±ï®®ÑöŽ>pÚdµ•Ñu›1±•½·CÁ ›±ß®xóÔF÷\4åÜÓck¥T).h鼯?‚×úÑNªHÈõ!ya/-+š°2ÏãUG*%ÒµYÅYóÖ~­¦ïžÛ²7öù¨x´²mªŽó²3ò]ÅS=¶ú9i¿ÍÀiã8q.Ù@’ƒU4Æ%ÕÊ·øªÌóQW2åý6¥ÍHÃ4E‡DKMem‹ ŸIuP'œ)Š{8³¯M¿ªè·ù )—O)ù~ñ”v7›I”¾&²‰½`Æ¿\ÔgæÛꫪÛûžì½´PYÇ#W ?in3ì«ÝÏÚwÖ´Í’ŸŠ!q»l5lý6¥ÍH£ Ù‡ç\ÖRçÞÈi”ŸÇɽvêá[ÓÆÕqÚ>yö Û«*«d½}}«D&–?>2OÞoSÇ<¸–£h]&›ŽÊ6”DT]YÑ&è3\4ßv´ÏžÇòå}<ð~›šƒ6¼lPäZÓîHƒ‘4mTܤi#áyYw@Õ$Dq4ÇÚíÏf*{o¦Í‘ Ò^éh¨±ñDŠlüCK¹®Ëéýw¾ƒ–÷ŽŠªNáÁ ðZéiG‰¨³ª²’9['¬šl¤±–næK=Øå©í²B>í-•U5’Aí>IÈåú(º>³¶ÀkmŽë±º éE5b&i$Ò¶¼5qšâ÷k««™Nðšál¨©¦wøsî|u‘«®n7mÁæÀæZª Ž3CN›«;æiééûxOϪ%W¶»quYs–,šîÄæèF$–½-mH‡¦²žÝäù¼'ôÊÜ5nÔ¸OúiI=YÏìGfÄr QL‚T‰ÒÿCÈú¯ˆê2òç?)SÉŸè†Ãº-_çöÿ C†#cò[%ò¥ö9ðHNzhqŸyóœÔvo ]}½¹~Þã=׉¥CXçÌår–¯]ïën£k`ô¤Lzø(mHÞ$Me}»É ™úGZÌ,®ŽÆÔyËWøNær´6ŸK}KÚÜ9¸L›«ç=Ë+±DT•~^—£•T&짮á+=ãfLTÿB¾å0u›X陾3œkG¬u™ËŽ¿=m„-¯lX#¢Zû,†ôCþÚÚ.3}縛¸{ÍÔe³ä5ö¬ÛÜÞlÇÑÑœ¹`Ùª¥Þôêž¼ó2 ,Xª¶./Ut&n×TUõX²n•¯“¹_È“gŽŽõþ¸‚G¼þÒ†>0]_C·2­&ÍôÏÑT5¼TÂÌgGf´®šª™›÷ÚU ­õÆš»ml—îÒM…q†,•›9ÌòŸµÐQ3µ´ŸhÅb©kŸ{Ñ![‘9öh[î9)±„ºU{|Eñ„Õ9S×çÍè·®JµEiI ‰É©%µ­]5UQsefjbBBBv^©|TQsRRR½âŠÒ’Ÿ”-¿žFؘ•ü41)­…9JJÊò²“Ÿ&%§IOú0o(¦§&–voê(’˜Þ!ÝæÊ^&%%>/¡7fIQÚÓ´ÂÆþ{‰sÓÉí[äasŽ[ØDîÝ!Ù%$ç!I­&u…äÎMû4vö8' )ñÌKžfþ.´«Ì¼>!ðl?•tIG^vzRbBFv^G÷PqqÎsz¦’Ó2+›„Š™¤¥&–×)fª½ìIb†ì‹úÒÌL•ÊÏyU½JI¤—OR^il~D /Ÿ¤æuMWy^júËjæ¥Â欔„ÄÄÔ¦NJÐRœœØÔ)éµ½L!wn“G©D $±wI|/#ùϘ¥qûyYÚ=rn&‰Oíç+âÖÃ3M"S:ß|ÿª|z~R³^wˆ:Rë½­"3!SÖOK•æ½H¦g*1ñEÓ5.»„ºèezbBb^3rMá‹Ä„§©™/;ÄDÔÑšL/ÆÆÒŒägŠÓ’ç‰-²UÜX‘ŸJ¿aJzESg×dt6–g¤Ð›áÓg¯ …Š~·”¤„º6‰lœÖÚ’ô”„¤”ôò&A×N/h*\ëb^Ý.´…é1'7êºÛ¥·$‘ï£úþúÀsiÿê‡QëtK—ôÎ_ãa¹ê¥_Ç 6o$ѺÃËJ&l/ðeŽ ¨ÏÀ{Uê¨÷í9þÕWm•KáãÌšˆ%TÞ Ì™^-n¢(!º…à#‘PT§¤¥°ó•DÒÉô‰±Hà#V—ˆ¼Eá« ðÉ£äw] úÀ)q¬˜!Ìo^‹HÕýkæk m”H60XqCI$bJV %Pb‰X(Fí¯ %¢„B ]µQD$¿c&%Óy#¤+7ø2 ZÝF$”PŠЕqWKª“¢:èСð0h•‰ ½íâÕ!­ÚH;‡™;ÕuPÂN‰_ €Á "¸t¡\ihó¹“Ý]ÂímUfMû÷#i`5ºº·ÿû­ÇÓ­¦véÏ nÝhúÏsÿë¸í7 ¢–EK…CW£¤DÛ„¢N:\j­-Û¿ø¬XiÒ±%%¼u·ís%±ÒÐÊ)³ba[ÚÃF%%ñСZ†è#€A$®¬hüýu~®$üöë¸ÒÒP¬ô¹à7J‚sçÅyƒV»¡•o`)RRê¢DnÝmøÿZõ»ßvÖ׉%B, Onu~ØxïzEõƒú¤~÷ûÍ©ÿÀ%õîW¾Ï¡ú{õ/gA¾9 eÚ(ÒÖ)$mtëI8ô7¿ýmû¡ÍC”êÖm`YbößÝ”Õf¾,ûðmŸù§$;­¥ï sŒÿü×¥öÎ15s_õ¶aå‘?ox¯Ïj»¥úÇ¿Æ4ØŽ¹ðPÜÇmØRü<­•ú§–dCIúó’7^Zåðí7ÓÏd_Û3Q‹;¥•ûn¦‡f?þgv¦Ìè­ÿ;©ELˆ$‰õÇ¿lyÖ>ÇRÃ}uÔ{¾úÕáqÿgÊœç¥Z‹µÆü#üvé@cv–?Ï)©ÿ™£¦8ùâtÎXµ1:fΧå|”à EID½tô:‡i2DüoJÿù;"h¦Ä ¾'õÑƤ…/užñ¡+V:zû"}î÷ï¼Ê[±-¹¡*5Úmꦷm0¿!#w¼×‡I6N›ðC%Iùqõú“?rØ´ÍÓÓ&ùg^ûìX í´7ï.J<¿5àâ³ÖÜK¶æsÛ y<ÃáÄ„fË~~lïðY­Ì´µE®™š'ÉÝå»áè{¾:÷䄱<ÙO€wvtˆÅM‚äæRÛ¡wÎíPÔ”l¥5rïÍBzÚÚžâŽT?RøQÖ/%’tаªó %ñçJB¥!ež“)‰€ù¶7œ·U¬‹έY<×oqÀå䢮ÃAË[—ûùλ5ôT‹l17¾\°pQYkËùà@Ÿ9>;"ª¥_‚͉^ædmlbaï;Ç·ˆ¹o¤ðÆ‘ Eó|¯X{ëY¼¡+¨_³Â÷IAó½ÃÛ|çzû¯ß—ÛÂlÛ–zj³§Í³+.Ÿ^gW{¯þáý’sË­S맖yîL¢d_tk)"ó&câ8•<©ì‘6{HæybeDlÝHj¥|‹ _#®#þ³ˆ©1ñY/½Í˜Ä×m&=5÷WŸxJ&‰Û11ÿa?GHAåÑ u æÍ]t¤šR ¥ZÏñ·-ôóY´|õ¥§EòE×Y»j™oRqóݘ-sçxlØŸßJ(qËæ%“ ¤3µû¡üæãÎò–-ðY¸8à|‚ìF“¤ñé.Ÿw„õ™–úÌ™;ÿÐ-ænéùGV9Ûš™Ÿãí“ÛFò/^4ÿµô¦êO·Z]̪©}Ä7_r›’¦ÍÉÅ ÕW¸6=àúâʆîã{Ñɣק\]p°´\¨XÅâì ý—uþÒ ÞfKÍQÛnH7]æ>à,÷ S×G\LM~´fš¹±›?½w&]Þ¬­¢}36µŒÞ)„Ç–Z8Mþáü©ˆÖZ#·\ÌbZ¬·ú¸ ç.¸ý$ùÁ…ýÆ£•ƒÒ:[^'ù϶²vZtóÖ½F©}y×Ã}â³j³@ò‹DtÞ×0ïH{<Ë%ÒdÕ¯]G.ÄzÍ9øUu̯<›75ÂdáÓ°sOW¯ þ³MvF3ô‰“\øz‹ÒNÜLß¹ëüD¯àÑÞLÚPm%e5Ì v ‹e÷Á}´Ý{âªè¾[ˆ$†þ·›.\>¿mñ ¯¹ÖªŽÒ´i+³4Ò8v¿‚j|=NuŒOàžó~ ßµB{äèãYmU)7ܬ¸³VìŽ{@Oö£ðy£´Lƒ¢Ž;ã7Á€ëÂÜò¸>A‹¥3ËubЩ[©OïøÚë8øK?]\<ÙH}ò’uGZ9ÝLwü"é6ÐèÊfVÁ…‹Ñ{Vj¨É–ÝÁY|aù$Ï]Wè-l½™æœ3©]«2ñèFVfe‹c¼­çz5(í5†˜Ô®]×¢¤$ú¹ð ¥&%¥Ž§)"%b¾&…sRoYz-SÌ”·^,—Ïîœì·™®°Ø?uO%;\¶å›ë²Âb_’¦TK{÷ý\ÙkÛã–~§ç+»SvÈ w?¦%U}qÍ(£É-Š÷/»:g¬a@«4mlÍu–†ß”z$™!#YŽUôši¸¢£l,kIõèƒ|ãÑ”CN]ìi„Y%í{Ù4Œ(ýž´(†ëþ‘X2ÛÚ.Kò?æŠñ+È?¾$ñUô–öú¬Ü·1Nëc”Í·µ>]ÐYùÃ2eã©­Š@*¹>W]cjµ,mLuücbe£‹Ó÷d¹Ô0ûÑE–²©¬%Õ”pH•kQÐ"o+¶?Y©ÌšM¯›â|T”Í2Dò) [̱[|‡~³n‚Ó iKªgOì+îñl×h‘D:ý•‡ÇØ=<—-yý8LÙ¾´HvCpqâì…7Ü£êò¢•Í3Ÿ4ËfµxÛÚýc|Z%oé>îµDòcªXÎÈÇí·SQuâw§ÍƒªÚç—¹lýŠU^üêUus'‘tÌw4XÍ“·¤ò3ðôe•¢FÔ•6Ò”ª‹Ù²Èc¢£³ÓxG; ®®Nz•˜N-'.¿A~+¸ô5ÃufÑ¡µË^o⾋½W$z®3×yJt„|»Ú·u[ÃäEGÏ)­ÆÒÚÖ#mré´±¦ÍàõÇÉÒ¦.`iÛJ’Ͼ¨ÿê«êÿ÷‡Î¡¿©ûó%¤‘ÑMvºm\„-ŒF½VKz_q5n¤rtq×XÛmXN¡wdiûZq¢¡¿´9ºÂKßÆi×Îm;wHËλwìxÝ*Oþõ<ùkei#|Ï´!äzQJv%éÏHa¥Dæ(Òæ»-Ý£MæM[æûÿ#‰õ¼7ÛïúáV³‰ÛŽËSJ1zÌbë¹ë»¢«­"ÎH}Ôí*yÚDß)×_ÚÄF¬Ö56ߺ]±@vlß½}[’,mŒ»~üíÃÓÆáÄüxÅ ØÛù°áÖ!þ˜ÉM½&¾íåuþWåÍŠe~$hø¤ =ï6s7vm/8÷N›rÙ‡Ü9±ÞßÏÎh¬Ãì¤2aïºd³‡®‰GÀýäÌüÂÂì{§t{¤ÍÃüFÅ„ÉÒ† ´Ò›r¥÷*Ït4ròØÓc»Ú³swq¯´i[k¢9ï\ZW6$Û¤o3©u°ö~¦ÚBIı ³JII2ä³F%¥¶s'Ë'N) mSRj bš²”a3à"9²†ñRòþÑÖ†’² ¦RÊþzUl«¢ƒ´nš.ËÿliN}GÚP$1È—=їꪶ2¿2DÉúmÞ•6ÔÛZR6êÄpª"1ÉvÕm¾%_8t'‰ÅbäÍlÓ4‰êÅpŠä½"Í‚÷hII®/²âÎÛ¯CRSZTÓ!y¼s¶Žû‚®—Õg‡ëŒ5{Þ)O›¨·¦Íëó{Xæ¶õ]uG‰HÌ<ñî´y{Kj–ó1×£ùô7_3þjLJGÂUÞ(ûêZ‰l®UUM5-‚¢„ˆa¦y%òQ›ŽíÚ§ìýþ-©;›fp=wqc¾öXÇž-© "vºßnÕd³™kbÕ#m¨¬qߌQœ*/z|¨gÚ<è6t(^ð64\~¨kT—ÖvJâÖ¹ëÎXÛµÂ(ÅvÕsZ8óNu÷op´›*z{ ýCΧПI HÓ³ŒN%%á¿©_èËœÊ+la.óû¼ìw¿§S"!®î8®)Éjw³ñ¾ÛeB™™LØE/¯'ó‰‹eë¦&õ¨.k죂vÒ8`Ú„ú;»Ì’¶µïŒPÙ[-åþ7ýé‘Ô[Ò¦é:{8瑼n#ξ{16»¦ŸIÂ"#¬å·M!R"gý6JäžìTT ù­YŸ }ÿ0føMé–üêóøECŸ™/||ífrQß*ˆfÔˆyÆLàùq5îƒ1©¾Ä®’.ˆŽ­ö˯(z‰ûK›Æ+:Ãuãe»`kº¥òØg_Ê—Y”7Çu«hà´9´Þm¼‡¼¶ÖQ_|åÊÕºö~*"½'òÆzÔJî¢üÇáß{‘ROÚ‹|euñ`²ìƒàØ\ßý˜´×V³»¶ï‰ì…7¬\BT}Zû©~Þ·m™¾_y´þÒ3i’ÒX®šªšŸt¥ÍÃÚ×wvXŒóëZ¸þFs6%Tç'£%¯Ézï&i~³îŽ´ß«óÅ\KŽ®.+½Š"ý¤ ý‡èUˆ¶²öéf«iOá«Œ1Jh'¤ú‚îÕýO›d#_Ýäh2ç”,½ó]¿™Â¬Q}¼©¦JD<³ýˆ^ÐWV;”/Û„%Ïc/ĽøIÿ0Á.StF&KèZÒάD‰@"·Ö ‡  Úqý…~›·«I_3Û~¬º&Km”‹÷º—mÒj)ܽ̓k oe®odîyë53fC’ò¨Ñ·^ÖÉ_˜æÿge7Ù*̹z¥ò—k”RE ãM±fééj9L÷Ϭéž5¬6ÒqàRŽ¢ó‘ÿ×áFÌq mÇýc4\vÄÑõÐõ¬?±ôs\©‹'#þùü¿ÉŸÿBO“ØeL€,9B–üŽŒÝG\YäOÿÍ qYß}œ>¶šü»:„(ýŽl8ùÆïÅJbl†iJ…½Ï“'gwÛê©èééhë[ìÿá±ìe9÷¢Ý̵Í,Í uug¬ÜSÝ)­?tTèiëŠÐÜà/‡›1;rë.=Sv?bêBÏ/z;ê阰¬ÜýæÕISyêß´—w¥ o¹¶ñ´Óô–š'œ3ö;GÿQ‘¸<éä÷#¾‰/éçpçdrÈçÖUûY‡u]C¿¶¾¹#V–‚ì»Lœ‚‡Ù†~eqiÉñ6éÐÆÇ©X„ŒrŠæx½<²ûÜšúIÉÅiìÑÛÞì­¸qp‘î˜aúŽ^+ã~œö­É.1su_ WsxôÝ2ÒY¼n¶>GÓÌÌØ€«íµxk>“+’§¼%ª£GÙ¸Õ Èý£ë 5¿·¶¶´Ÿâ›TX6×V[“eû2i¤ò˜{¹ò ¢R–þy”‡ì¸ãÛÆéªèëëhZó.É“¼¸éf¡ehjlÀÖtñYûºY,”@~{Ë9«øºŸÔ£"íC‹(梺ù$¡„tΈ$Bé ¨ö#ÇZ‡þ[£’’ ÷6$èk?õ dPfMÂÜÆ…Î:]¨N skúÿbæ4•H(jשּׂ­ûü7•JJ’æ*lKðR²¦ª¼’uR]íƦu››üŠR0(™CH×-y©î;ó2ÿRB _\€_õéIŸ®ÿ®»¡d endstream endobj 879 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 394 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 19775 /Filter /FlateDecode >> stream xÚí\Y¾¨™½î¾wïÛ{7ÝýÍÞÝÉ£(¹»nhrÎA²€‚‰Œ$H¤""HNæœs&GÉÑ€$‰Š 9u¨óª:ufGÇÑÿ7g¤»ºN…Su¾úŸsª»>B0 ƒB¨ï‡àˆ= A Ü6x§”WTI©[ø*Û–^ Ò'›|–)›8–”ƒÞ•UÕšöÛ³êPZ%$HŸnʬE6[w=(-'€m AÛ€m AÛ`HÀ6`H>@ÛT”?€aq° $HïÖ6uÈÌ5,=-µx ` ° $H?­m 6::¬ ]HpppGGˆl ÒOhCÜ6ëÛ&$$äÙ³g ° $H`° $H`l Øl Øl ØÛ@‚¶Û@‚¶À6 mÀ6 mÀ6 m° $H`° $H`l ØlóÁ$vBþp|Þ'½"þÍN,aà¥V`Ä ø vB>}”˜RAäJ,‰ÏI­àÏù|&>÷UB)ž×y hröÓù‰;1µl:¡€·Þ„¢‰” îG ç,%XÂ^˜XËìÖÈM,™I%>ÂRáh‚mÀ6pJ¯1W–#S$äh²x¢ÑHR¢+4,œŽ½Ì¬áÔîJ”œÿXú½EcgöTz%ኈhI’¼ß•Wø[BDMßN!Km;û2“X&UÕ1v©m¸Sö:¢g¤++õ”ÄjÒªodhŠz6Û#sXÜåpç̨C>v4IÑoTìÎ¥T£Ùé)¹7äE¾“–•‘““¥ÉˆI‰¯¦«é»3äB‘׋ÈcÅ:)K&¹éJçˆbYÛT „3ge©d—ÌÎÝ,œÙœ]­åUÌcJ‰ÙÒk±õ¦"ÊÐw%é5)iõ¼¸e¾mæ·Î쬨Š1IÕpLÁ6`›_„m0ncgwæ~IÄã ñvÓ#EbÎIG#Ç}iܾ¢keÊAOXÞᔽ™8}ý•ÔZž7^Ó’Ú•’D“%o¿ÆL«X¼%!;·Ë*¨‡ßgK¸sHfµ‚.UnÝ¢‹‹»ßFiKb›Ù ÿ×Åu-]Í1öS° Ø惶‚ž­£_ 'E¯Ý²™&¹Ò$(/ ·GÙSméï­3¹$çö’%õ#JÑWÌis¸rK&.«î°§ ¥óûL^c›¨¤Ü6~7ØK·$,Ü_FA-ì3½š¹ÕNCÞzWf#:Ø€Ö2Í i:[.¥,kı-]m=Øl¶ù°m£LSÕ2²ÙÈMæÎþçú‰´7f-YJJÍÀTSßOZz4’°fDKF /¨H/i¢N×s=88é5¶‰;rœ*Kv?:°´%µm›MEowJÍiRV’¡+©pWª©o¤H§Ò´­c‹ÙË´¤ˆ-±·STÒ O„~° ØæoImĮE¼D *qž*»è$=·ÄÐc%ÁG9éØ'Ï TyÛèrÞ½1éåýÆêòº.™óÅòš~›Œ¢U2I×÷òÁÚù÷ê ôšK}1E‹#É5hWænª„ŠÇ‘jÞJ–„=®(&µéÜ@fµ Ûàk,ÌW•üÒhoO:ôÛ€mÀ6¿œ^â4þr±Gáqˆç©¡ÙÑg\‰ç.ÓdI.‡z¹ó¼Î6¸ÁjÐ\âz íŽr ˆPÓŸ$>à}”R<¸ÝÇŒDR÷ÍF™ ìM†ÂÔõ72êç•^<íH2¦GRëy¶q¹2q+r›p·ÎBmµŒ¶|-Œ€ƒmÀ6¿4ÛTÃÊÛ ¨t·Ø*4×£‹<Õ¯¬”IjÇñ0ƒðÀ²¶Q¦©hZ­ŸKŽ;ãJXœ…0ü‚œ¥$$ÕµµLmõŒ ••©d E¯³/Òðu]Í ˆS=®¼ÊXØΊ>š)G’ôºIØFA\DÍÒÅt‹‰í&M]]šEÅ9"gf¶ûØló!Ú¦rÒÓo×Ƙ»‹Z=éÕcnž[Súø]4üTögÅ™{IàÆ*壮Û#·ìÏ_`b™»×z„®õ™K¾Éñœï àsâqKâ­*·Ð}¶îøGQα÷â+¹Á—b³=í@éÜí|¼oOt;x{f=K-ª_ç²ÃÖ=x-'ÙùìÛ–Y“Þ€Òá› `°Í‡sAÂ" ͽåÌ“úöËä÷±,]æì’çg\¸dìGî$° Ø$° Ø$° ¶ l¶ l¶Û@‚¶Û@‚¶Û@‚¶À6 mÀ6 mÀ6`H`° Ø$° Ø$° ¶ l¶ l¶ôs§ÄF”r(/(óý¥™YciØl¶ù¤Ò­ý×fþÏtÊjuI«¿ŸÔ#¥8ñÇÿ9ðb°Í'i› ,á!zŸ)± } ÷›q×ûĨñÍ(¹î=%<°yõåÊ„G`°Í§h›Œ’éïÄú…Éï-á×÷ô2Æb›ç"2x{ê½­ñpö ØlóÉÚææþký+$å »ÙýÒ¡ÜáÂäóÇ«À6`°Í'g›÷[ãð–TŸ˜ÜùÕ`° Øl¶Û€mÀ6F#:x³±?¼³÷dâY ÕèPñÌñ …TÎÓñ‚—YóƒmÃÍ{°þõ…Œ¥VËϨZðT|ÕéµèP#šÿ„b° Øæ—x}O-ÔÕÖñ,KýØc›Ô3"âê¹S?ryÕ¦ZTi©v±\_ý€Ø¦lH_[DÇ5û …|ù „8ÅÿÒЂ‰µ(2B[DqWj#Ä6`›_¼m ô¤ ¼Ë?~ÛœÝ#IÑ‹ÌþQËgû¹Zɨ[iŠÍþá¶62 è{潡‹:ýî/\8ÆW…n?ð;Ú’V ¶Û|¨¶áí)Eƒ{®<Š¼Ðu¹%Žs/jGðlãSžÛu¡1òRóþ‚ét–«Bñ÷:‰y.6ÇæO.µMüÝÖÈ‹mÉüvGR~wä¹Ç åó+Ý`äÙ¦ýÄSt1|óÒ+ÆwoÚ›;±`/ŒDkÚW0Åy.>Ûôî‹÷Ü[x¹/Ÿ 2fòçaF_y|fÇ¡¶á>¯l<úÊ£ˆóM{î ¦œdŒ»À˜ëÍœRj+d..%|ǯÕn\kL×ßz¶!&gjžmV$PÛà5"én¶¶¢]Ípíeº¬‚¶yø½©E]Û4ÖÆ(Ë)èXØ*RVS¬vý‹âù]û¼è2" :æêJ’²rú×f’-°ÍþÇ(/Ò*PfÃôzUJÎ×Sç=~7½zz³•”œÍÉ´¢k"j_„Œ,-èÆÛ¤W3·m Ià6b¡QD<Ï -œ‡à¡NÒ Jª'Þ¸z_‘ümÄúƒómƒï~zcƒµ²¬ÅÀÞU[KÉÞב,£¿È6D}/î33Ö¥ÉÓÖ»¨+Réšf¡wÆçw’¤×¢ÐP_U%š²šÅf¯mGûçÙFx_Á#M 9]ÃØÖž®dï±w½¤RDrƒÛh¯KPUÀË/daYš±Þ’B¾r„D– ¸¼P­5(2ÊP\u/´¤À6nlS…"S#uLýcjÑÁFt´¡ MD7¢8«zIlc GS6Š*"º"Ö®ÑU²926¼rݺF#mÈxvä!:ôy¸J+zGÏ·M–Q‡vø˜QõjPx„ YÁ.fþC·9ÁFÒrÊ*‡´îôzJk¢âµia§(J-nו6~œQóÊR[R/àAzÝâyÒ«†ÌÔEõv”g6L9šRÔÝoßN¹³ ¶Á’dIIíÀ´—觭CÞ[¬L·¥ÔpŸ*γÍз$Ï@c%¯Ø"{Ò¥³râ¢$½lcD—S6(äò€±ÊwjžÕé‹GWŽ’¥./²MÔ.cIõ° ØæCî·áꩦcïôÄæö»­¢»^ˬ[b}iíõSøó{xn”W[»¯lÁl;Ãýd•4¢òy ´ÔrVÊæÒ~›ÔŠ C’†ÛMúªõ‡Ç7I8C1ûœÈZΞ•RÓj|ùÿ7.-”¬hê±EOÎ4 ié8gJ‰t UÙÉÅžªi[Ì^´ïxŒäa­.g’ÊŸß~/)YƒE±MfýˆµÂ7Z{žªÃ †çB®œ]­ú`ц±¶m²R0ñHx°`|TXÂDSBgßÓ¬b-éõÈÇVRR=Z€m et7žNáfgKU¶½˜ ¶>Ûpû/Þ0Ô’¡)Û»˜mðÐV”Ph=)ým%©ü±Zÿ€mTíÝE fóòv•S5ß[º ÆXb"z9p4™"µZÑùÊÁ¾ø  hƒ%YZZÚÿCà¨.1O#ÚºJ‘q95Éݪ¥ãÅørvx¨ÄVØ¥/5mzõ„ŽŠêÆØÙ¾‘”S»%¥÷ÛdÕ´jK®¢ÒéŠJ ܤ #ùý7N·ÞÊ6cÂ"ªTŠõáÞÌêyfPÝ#°%5¿—ØÎ^Nyí…° ðQÄ6 Söj_ÑìΦ7—ìÌ&´ÍtÝE mHúsa»ŸMÅ ºxÁlÛý­EáÁ:’j`°Í§e›¬ÚV-1aë£/ðŠ€×̓¥ÕjdQ·ë‚ZR26ÑÉü–Ôf'õ­ñ ‡®bDPh*¡w¦¸ÑÈÞã—׬óÜY½0¶©F‰§â¥É:AÙÓ[lÔ­£’Ë » ¥/ÖèPô·]K¼vN’q¿JÜ̶¸Û¶|ÊÎRQÅ>3éî}’ø¦3S™Õh陋“>Í *!¯R‹²Ê.ëùý„Eÿø6ávß6XÀ Šo WhUØŽ­ëI4ÃE¶É¨GΦÂ4ÇÛYM|7–ÇæqGÄÞÛŒ¬$Yë‹©ÔrïÜËjœ°S•Ø’ÛqlS?í ³J~ý‘}9/cn<±_ïdf%/m´Ñèüzı •¦lâq¤!öÞ‹=篫Q¾7Žj[؉eU<5R$);&í¹Õ½÷Fƒ…!IÙúh|ó¬m8u³ I›"n¹§$³ eª‘$ìÒZ3jæÚGxÅ Ùå!+o¿‹Sg=¶®¥)nŠ)™—,†Ï³'m§,Å8´”èéÝé!C1‹,X8O5Š;'+¡î_@„m»Rä%´3w^ŠõO™í%N½šF³‰«Úw§g×™»ºú 2r‹lC˜pÏÑT9ÉÕ µ1wz÷Ýzä`&E1IH©{›–ÔÀ«o$ýâ=¤%u|/ôÆÞíÞ䫬#GÛ€m>­~ÎÐðÍRCM YJBQw½ïù×®)W*˜øί2©%/µ•¾ÖÛþÀÍs£¼Œ(…$³6*'¹rnDfî®ÜVG3i‰UdeßÙø2,q~Kª¹lR&)ùï¯àÅQ){Èbâ[/1f«Xâ©$)Ï ƒÄÍù(³¬Yô•†ÏŒÚ¹µ$_>+#¶zSf wžŒ=¦r+”6f¥ÏëON¹S@'­°ÞU–Ι'½|ÈF“´UL!džm¹U¡È´4ê*²¤¤†Mhô™â«è;ïO¦/ “*XÑÇNékÒd(22´5Þ'c‹YKb¦Ç:YÍ‹b›W_®<ÐÀrs·—•X)+¯¾~uÔ> IÕè”ÆÅ÷ëj®Ôr¾?[6–âòf§Su’_Ê•ò»4¶~icR¼ï@~HŒº=$Uèçõ<“/6¡ƒu(£ŽóéCâ{@©:o1Îož¬Ú%ý6Xfñ5^ Þhªá,­zÁ7•?â|ˆ;°U²ð¥ÕÏ_gN®¹yšÐ¡†…ópv$³vnžÌFt/ù~(a›ÔEC`øÞá $º¬«ˆµsµ´]F|Š»kuLËíÜ^Xt<ÛÄ×bû ÐáÇœ¼M(d›ÙäPFÃâïI…Ìÿž¾Æ¬ÞWŸ}O ßÔEß“"l³l¶ï€¶9sìÁ®Âg)ìŸý—BÛæ=|ük‰ÀT?*Y;8—3€~?O™$i_“ùÓ|ËãZn‡³œ”AzzØló‰ÛF>dدvþ:¦¸ÿS´Í+ÔMmrÝ G¡+ÊIKÓL·¦Å•`?ݯ§NZéKJŠ’×¥<Ê€ïIm>qÛˆËdž …í-~ñ)Ú†û­Ìj¢ÆqSzÕâo?ý«± w±?ê‡2À6`›¬%·[(øÓ¶ üšØló^l³s?Øl¶Û¼/Ûá¶yþ!Ø&&ø`bz?)£x l¶Û|‚¶9¢·MÞ_>üFäý¤W_ 7kÙ$5€mÀ6Ÿ¨múDeñ«mJõûHž½ÄˆmÒ*1Ü6û·'f”μ·”VÁ†'ó‚m>MÛ»Ù5ùßÁ¯¹C_¬| _ÑÈÿ~ësúäa› ,ô³Ïæ¾¹ l¶yÇ5.©½Ï”\ÜoÞÛ€mÀ6Ÿœm~Žä~óØl¶Û€m mÀ6`›Ÿ8Õ¢÷|¿ $° Øæ='Ï[÷>Û¤?Û€mÀ6y Ì®ÚñØæ!Øl¶ùèmS¶Û€mÀ6ïÍ6ÑÅ}`° ØlóÎm(]¶Û€mÀ6Ÿ’mü`l¶Û¼Û$CõÛ€mÀ6`° ð£m£µÎÿ`ñH£O6eT£¹5¸mbJ^ü¼[’ù„°Í~ÿÔOùpü, ¯†›v€mÞ)ƒƒZzFv›=m7yÌ&ËuN š†òjúŸN’0¢ … Iëhü,kWÒ6•ã¼Õ2²\)úIþ‘Ô DÄI>>>`›w†aK'¾zõ*&&&ìSÂ)ÌI(DÈ7Ì÷gÞŽ={ðØf§ž^ðs€»lóžyñâEttôÒ’ÿˆÙºI(TÈ;ÔûgÞŽ¨(Ü6¡ºº¡À‡Øló“ãê¶À6`›÷ÀÖЭ`l¶Û`°ÍGf¯P/° ¶yŸLMM¥¥¥%}2$'%G$D íJØõ3oIVñ<)KKîÛÔÔÔ$àçfttœðž‡Å?nzÆz„|…^L¼øÙ··Mej*œ„P€•ÎáNÜ6½£½‚mÊ““áˆØlØ° Ø° ï“î‘n° ï±™1!° ïœÖ Ø€OË6Ÿ}ö ´ 6{ ÜܽpÜËØÆló/qy¿µ…ß]üEÛe­Ù¯uÿœzØlóƒ9ºƒNµ¿€¿èÉv¼úz‘äºI)Û€mÞ®ù$Ø6óZR‚δo:9úB5w‚ÀfÙrÍ0ÎtbË, Îmló · QßÇ[rÝ,U)4y=µÞi1ª\Û<ÌÔø\1’Û’j->a¯+#¯¬¬­&'«¬³÷h.^ÿÓ6)ÉÊRT54,íúبâÔN}y)ºŠŠ¤j°öäƒÞA)tý\v]ñÉ õö¶ëlŒ)òÊY9LŽ?&ž\u1S"ÉÈÐH"šVÝ“\Õ”œ‹5S#«hj¨ÉS ×o-lä ÛürlCT`önW5U½­Cœ CÙÁdQa®m5^¡ñÍTÚk´q3—ÅSL½šFÌf*%†Ûô_¤‹É¨àæd­‚ºuï ñš] ²ZX;ð÷£ÆÄâªÝcL4õØŒBÚ{;ý|€ª˜¢?¾Ó­‡åVŠÅ–Œp&O§:ªÓl|g0ð ¶ù…·¤˜ö2_¸^æ·W°]¦Km3æ«ô¥IøõÙÚ>51ÅÆçž~„Û&ú\‘99<:I|Æš™ššj=BVRk|ÉâÚæûÕš&øºx¸o…”víËéžÜLYYòýgln‹jj¤çAYÕ8Beä¶fÎmáÔm¹o岇@5ØF0!BBÙÏëê~öÔÿð!›ÅZvC'J5W®<ðtn¡írKlƒÞN0T§ŠJIoò¸[Ö08ÎàÄs¶ÁßU IÐ骪Š* T9õ†~žm¾%[u2ùºhŽ_)©YÕ?Sy6Š*«R3¶(dòU¤Pµõ6:Ø9É~££¹Œðê°šI8½°@R%%}…„>„´çOš_vCÇK5pÛ4ÏMÈò¦-¶ 'è™~ùìIå±ø@Š¤š¥sßsžm°GYnⲚw;ÇÆÇ'''[O…’ئ‹±Ø6UçvQe«Gõ ù)QLBÒzžµ···qR{G{{ÿ$NoàCãC°Í/é~8F‡-åŸóZR3¡ºß/¶ kòù‹¹,ÓE+%2^¢™GÆ<Û0ÒœÌÔl='X¼}¿½EVyal³Ø6SÏóâ-©›ÍÓ¼–ÔPç­+—{ÙèÚf™- ¼r$21G9m4˜>8Ûx}±Í/ŒᤤªãÎébAígÝ¥ÄVS×]\`›¡›*+©‡š&xYZK¯–»Ù1‚OÖÈRv-À§åÛulú§9³G§ìµeeéªÕ½ŒemóbM?±&™î8Ì|1DKŒîƒKmºí Ü ‘¨œ~îôÚtGÇç,p ¶ùe»†ßs1S'I©(+Ùû=ª&jr¯ÛM™Ÿ+ðFÀ+.F›(KÊ)(¨«ÈÉ(iG¼É >`^±Z½j¥¢¦é“§å¾6ª4}] ·ðžîʵJb$µó=«Üö×Ïfmó8úóoåËŸîšl¾éa©"*A’–Ö´ö,ì‗]Œ3W#Ñ•”Tè5Ó KÛ ¶>LÛôŒö@9üã¼vªà›û–»éoé2±ùçç¸Áw÷ÁØ7¶l¶l¶lØlØàãµ &èî[¸WÀ6ïD8Õ;ÿöbÃÀêºùÍ×ÿH¾Ýµü¬ˆ=9˜›S5 ÇÀ6?Â6u{VõN#6cdddšÁ^^6h é†’ËÙ‹î‹Ê«4­·ìÚáf­*¹J&ë c´æN€›4Y;:9-»{¦ãj„˜$Ù|ƒ[dxÀ59²–ÃsîÏrÎ o\C1tÓ¶öé¯Õ¥STôŒ¶ûm5R'É«8tr~½¦ÿþN²ˆ¨þï˜]~rdÒš°!8¥à—o›®#ö+©ÖO¦¸ïXΆt£…¶aç…ZË[¸0øYŠ¯9“CüØKãU/’´ó+ÎÄœóö¥\ç·»º7S¾r»7H¼d o¶”×\ã: N˜þæ"úÄÃæn‡iMcF¹“ǪL({ï=AÃMè’žIù¼%·®Õq>P¡ ,g›œ¶œúçõ9í97šoÜxzãüÃóé•é•i•iQQ;ówâiûÝíNל¯;o¾¶Ù✅Ù9³5g×h×V9¢‚'ú!ºdª$ž$R$¾ÿö«¸¯ðô÷}ÿÓž?áé»ÿøïÿþÛðßþ.üwŸ…~&,ÄKüä'$´“|…„|8É[(·=wá–βWSv Ã[<ÜQ¨á~Â2‹b›Î3Û%Éò®”öô½›œµª½¼•$íÔÏ·éïzX[^—[P’ë¦üµEVÏ6æÒö×Y¼ÎéBÓqº€¯Ê›úýÅv~“Ž·ÌÞšóŠ¤UYÕƒ/8ô¿èÞ½ÎÀ`]Èü$0â÷‘¿çýü÷v~ò äH ¯…¡ß„ýwžþoäÿýóž?sÓq_|ÿ5ž„…¥R¥ðDJ')QV=¢Š'ÃS†æçÌñ´öâZ—.®7\ñƒr‚ ÂÃòÃbJb2«2³ª²ÕºöäÚí–Û·žÞ*í.}Øÿ°©¿©ñEãøÌ¢Ÿ"7T6ôÞ?;øͪá÷ÏoI!棼ãkÕÅD%I:ºn' mƒs-n«²œ”ƒWHZFÆ¡#vòß™ÏÙ†â–7k‹(W9-¸mÚ-W oÏ]¶•f)ȤÉ~’[I3raÀi‹acÜexù>Ö©x UMÝs½¶÷v¬”^Òo3 ¶ß<¾ÏXiµö¶Ë¬ù¶a<µ$}¹ùhÛl©|aq°ýµ¶éw!»ñêâئ«ò$]Bâþ„€€S ~Ñ”éˆêyò'Àºêo#&o¸À6ëQéÕûÕs=µ×¢]”´6 ඹ„ÛÆ™°Íx‰úŠÕéÏø^xœ(-üý›btj³˜”íq¾k†‚TÉN§+P_¥&],òB_’ìÆòÊçð'øxy[Gìûu¡Éwîß;¾aƒŽma¿ Ƽf%*«ŸqæJ~~Þ­‹‡ÌUÅ×Eöx|o—Œ„bÂÙë÷êÚ=ôDtœc JK®Ûgæ¾ÝAZÑ:¦¢ãb ¶ õ7œ“vÞ•yëöõÔൢ$Íòn¼¡7}5ÌFJ^;íìõ‚œ“‰A$Éý÷{ ²€_6œè¡¿éÖceº¼ÂæЃ'irFõS¨/_EYáDAwÆú«qkõ•hjúI×j¸-l¼'p­º¼<ÝïJ7£#Ïiª‚¼œC`ò =+:¢¦LwŒ¿ŽX#î¶ N» gm³w›š‰Çeîƒ3'ŸÞñ°ÖVV’7uô¯˜kô5ÜJ²Ò‘W Sì= ;FÐ/ëñXü.7<•€˜öVÕÁÓæ¯NÐr9S–›À›Áðÿˆ4÷ã¾øI$ƒallÃXøl W æÙ‹…MâŸAùðê±pã°˜Ø ‹…¦£b¨ü`ËÎáé!N\Âৠlðh†E‡ÍBŒ¦±ÒèæMþí:n¦-À4ü„¶!b6êd´Æ´xno³öo· è°ñé1®«„Ø€ÔNš÷-èùÅMÃfã«Fò¶ÕvYø·™ù>3ÛÖb’Ðâ9Äx ¦àÁd3lŒÅ ¡6Ï0ñ ƒ‰PÚÓ €6 ÿVSßV#Ÿn£=›N—1ІÍKכּxÚ›¯ØOºä ”f?Ç^{ºbØ2½í†Ìo¼šHM–×EïtÝ,&ÿ—=Ã+YŒÍÄWÎ äs´'Ü«ÝØw‡QÄãÍõcy“hŒÓº‚Ñï%Ò}ÞÝ7„ý´ÙÙŠÿów÷ìçwX‹Šèµ²–ϟ瀄þ€z'Þv}“ÙÒù<¨j"u›¶´‚ýKö{8ψ3«»³—ñ“gc)e®FBjo^Å3$$„¾ÖÖYñµýɚǗ\W~¥Pýö›Û{WTdeÚÝNü%«<ø¯ß)>˜Zn_ð~ÞÕ=ýsé†1|%ÑW‘´JTDdKø£“ïmÕ#ÌÁYSìQ^)`,ÄBL4u ÅϧÓhG…W‡aÆóÈ)4ÊàŽ#–`?~Ú‘Hùn+ÃÍÌŸ8û`z cpAßËÚTëg¯)ò"$ôôü­OVï®MæÑ S­ùI:NƒØ{ šlÔ ›?û鳿©”ŽÊ¢ß½i í„jv¡ç÷oÝz¦z¢í¦.Õ¤ñí=ü<—F%Êé&¶v¢·¾©yŠÉ^V6¬>K͇?ljŠÐ̱Mjd皶Ξžg§"¬¨tóº©÷´úâÁûÛ;´ª_scÂ6lt©?ëkM`»a@‹mñ«kˆ‡> „·®Ë0?Eÿ÷Õ”æææ–×5OÎ 4;—ägçää”×?™æ÷j=®Î+:6ÞßZ”w/''¿©ã%wA}•·¼Í5 ÖÞ»¿—sà†{[Ê ñܹUMmìÙPu¬37¿ht†ÙÕTž“}¿ ¸¼oBPvöxeÞÝÎ¥ïîþu×ÚFX-Wé&xgÄPº{?®ÝA]cólóO40‚Šï  Pv÷šÀ¿+s•å¢ çÑ4Ì»ZgøÙ°§«Õìã“fFŸåg· 2±¥Q76ÓÚXY›]PRÑ7Æœ»ÖŒ?¯yP˜›“]XZÑ=8ÉßKÁ¥4ÕÓ|õT¤¬¤ÁÙ¼‚š>^ &¨”Þ2;»£ÿúÝïQQ?ß6ÿ‹äÿ‚þû{¤ ETœïmáp–åwÄ ý?!BJĉöª¤¤Š…¡¶šâÆW»6ÝTü>±p [Òœ?dB“·tp\£&!MÑ¿ÇQ,£³PW‰F×4ð Ün¥N“V6Ìëá:Dp)M6Þ÷s5$K*úEî:ÓDT±eJé-³3ÒŒ%È›pÖ8º¸”^Õ¡¿~†þýsdjˆþð?ÈKýžÛ+EAÓE +‰.78 &´Ù˜x«m‡ü’+‹r‡¦ÑHOc%WæÌ.;òßíu-½T]ܪD–vÜæëj­b»Á~Ö6¬ê]+(úO§ÑÔÓ ÊrTUmO¯MfJ$2=®ì9««&ÂÇŒ,!çu´”f}òz‰l¼n‹—›]JJÕí0wÇC”¨n²4Ù—šëk.!EO­å^àÑ.º4Y’ÝFGCeqÕ¼r„Ó/ÕyG‡J¡é˜ùlÕ‘¥È»]k|[wôZ—¿ÌCĽ}WƒlÜ;øÛ'®AÇý4ä×DòBésò¢äS^¡¾%)ÉÇÊy=*½EZr«ƒŽÔà9¢ÜUèŠzÍü€"Îv5Ý3—;W°½šµÇÎUªLSJÂÿp wžéŽûê2+÷Þè$J±û¬„„¤YÔ5îG3®Ð¨R'J^.ÈNlÛtëÃúÎ!Æ¢ŽJâO~(¢ÙÎv¾ ¿ !û}|Û![ÞYŠn ¡_£üâõU;$ô9âÕ• ´ê÷H!paŸ(ç<›yÔÔôr|ññ/ ÓÎïç¾›ò·’7tJƷ숯U?`€¿…™Î²’&qÜkìr¥ôª*RBtísîÔË”Ò[fGØ@Û£GÏú—öï<>G¿Óä÷ˆ=A¿B0%^—…"¡ß œ^ÞGÇñBû-z8<×’*ŸÝ}lηØLÛ£†gƒŒEçÏTu¦¸$íX¯hî'8Ódgm³›°Í«™Î»)2²´jþ¾<¹sÀ?>‡Xt{’ÄJÃVÞyпÇß#îT¯Û}[mÕŠŒ§Äë“‘ZTŠ|!{ϸJI9\ (Ù¢†kwVŸ£&iCä¼öFoPRµÝÍï¼{l&¦˜ÍÝÜÑÞ¶¦æ6]z‡{£Ñ GÃa-¶¡Í¶¾m¦Ù/Ïí*ŒÅ?žØ/}übiKÛIú‹-w‡æ¢Sî)q#&KÉë•ÿˆŸ®’™_Q\åµ×e1ø…p"L…jqhZ°&íT­Ü²ð×OnâÙÉ9ÝlŒ9¸]Gq}È!bÝgÅ¥hkzymœBüj˜~§e~ö7{°˜hx5Ô£ÇMˆ"„”ø¶ùOÔ:Ä?:‰º“€WR&¢þ ÑíÑâÄ·<ˆÌ3Õ¶ì\2Ù·™ò…ãµþÙE5çÅËŠ)qªÕr¥ô¼,LB̦“[ÈË•ÒÛe}O$úƒò½4·—ÿcL¼°@_I£Ñ4ÃIì:¢”NUpfzD¼.û‚T_YUÍæQÞÁœlº2/¶áÙæÕƒ“rTrðÑb“ÁdÍuãÌ46x4o8ˆÅ˜yÕ×Ùòô飚Öþ`¬^ÅÊÈÚÅde§#¨²ªµã³•k:ÅFUÅ-œ¨.4—+³êd¸*ÕœS/æé¢ìt$~ÖÑädäyIZRä{•-á<Ûäo7¾ä÷ná§bÚíÄ~;Ûuâ8úŸ_¡?#s+´ÞýU©ε¤úfǤúÑo„PÈu¼-†þñ_Hëãœ7R6ðŽ]<*€Õé¿"¢vrÖ\Ý•§è’«/tsl#¨”ébÙRz»ì¯¥ƒðÆþœ¹ YN¿ †„‰~õoèW¿"Ò¯?#Þ†ßüq¶¹¼Û•®iÑ5Í?OzsÛoI!FÝ­¬uÚRß‹‘Œ¬ìBöf/¶ ÂÆ…8ÓiÒë\¶†„†„îðR%zŒ·ïVGgÙŠ3 pÛàÅKb³ÿââkÆX‘¶¤•6[¤22dÑÕ«¤ÊGöÓž¥Êš<Û\Ø¢®èö~ºH&Ù£¾&»o¨/ÚöÌįÝ"¦Ë“…&ˆŽÄ@lôñ~ûò©•è7ÛKÇx½¡ü½¬>M“•/škØƬQÑòÜÍ«Η_o›š xvÅ&£Õÿªm¦‰¦5|n])ÍÚæo¨gœöpFXî­­•ÿ4¶üØØf*ÁRUÓcï¾ò¹éO,VãE7>»¨gÉKH^Á·Í’RZ¤‹×”ÒÛd-³ûÎß˨•èß9ý6Z«‘ˆÖ2Íêl›[û<ä4ŒŸq¿Œ!fÛmA¶á3Úq%s§¾’Ùá0kmÐ@ã5%i‘øû¼{¼ÃLö›9ÛXYd Í„kwŸâFsµs²JwÕwqËôði½L•¥ÍwŒ[µGC ”¬Óß‹m0ÆÜÞnÜbTo¼£Í"¨mý{€Ídb¸n8ß‘úx‡ºY»L¾SñÍçá(sݨâ¾ÉªS2²äóUC¼öÕT—…†ŒKÔÅ×Úf×…µ;ðWžÁ³Ÿ«ægGì'uÇÙ¯µÍ¼ìó£ˆ%'çª\À À§êЯ„Ú¬m>Cx±õðUbÎó5ÄGN_¡ÿVåÇìläfŠôCPMц+5œÇùÙïÇn_ç>…ñwªþE³YqÌ^BÊ¡ëõº(Åu±–«‹×”Ò[dÇæݲ'hÓWâÅ’Äß/úþWè?Mˆ·»Ôп¯Dc,~-Duüó{Û,8ZN†èju} îm÷R—öÛ uÖܯz5wüJÒdE5jYhúI¼„°ácÎĶÒ,š85”w¾, §Š~š½¬mð¢(õ—6 ›ír;ï·aóî, óÐùÎ,ºn¶X†_töOa‹oožœ 9ý~¯3v IOA4ìÌÓùâzwcALÄ j±öê2 îXëÿÔ¸jª€w°‰s“ýÑÞYCìUí•(iq‰„ËEMµWöÚ‹È7 á×£—–Ê*öÛ«>ii~t!Î]ZNóN;½Æ6쩨uZšæ[+kkÆú£×ªÊ›»×65?y”{6FRT<á^·—X°m°¹ì½#lÄ|‘à–U6,`›©Ÿ¡Uö¨¡ •å cu¤õ_è/z¨¥ åá¶ùú‡&ʯBµÈLýöÔù¶NäõÈ.=(GçÐgB(ðþÒâë® ð¾ß<µøhOWXË ›…¨kj*Ï9£I÷I-gE·KFœ”q»¢¥åi}Á1}qámçž¾>8¨K”¦-mj|†÷¯—ÒÛfgåÆgÝ|l¯o$v9óªx€"7¡oþ ý'§ß5£r:~¨¼U–"gy$ôgôdø -)Ö`r{zá«Å§ÏH©±ŒˆMHFãÇõ•÷¶Û*qlÓ5g›!Våé ‘Õ*'s*?yò¨©&ÞK“n±W7³ûõ;Jr~CcûàX[žŠô*ÿ¬Ü–Öæ7­L6ꨈmØu§{Ž`›ibD1G_jź}—ë›K®¥RIR±—á[”—áK!˽û ¹ùIýƒ›vÊ+L¹£ì†óIþ»“Ffˆ¶Ê½Ð5’ªÖ7ŠÊk«Kb\5èz^üˆ‘u?Ö'ôxù;­x;›mý;MZìÒ»ÃÑ¢»à?Þ؆{BG~¦¹ª4‰,©³Ö«¬›W×ØŒ±‹qÛT©âd’”¹sØ“—¼þ›Hª/ÎV„c!òRFéÜ0a¬ö˜y…¤ílÓ ›9q-ÙW•*J&‰iš;å<ä÷‘Z)B¹QÏ‹™Ñ@>IR4éÆÓ…ÙhæéÑÿYw¢OÀF¿z‚H!êÅÿRPés4‡~/„þHAgÖ!¡/Ps!’à|ú…"âê`¼k*’þ_búï>G'ŸK7ÈÂ)ÅFÀ'ûêƒu¥%EdtRï6Í~ØUrt­Ž…,©¨mq$û “ÿ-ÝåJ‰==l£ &.aŸ^Kò2¥ôvÙ™©¢’Žq‚-{íu$öWèßж#è¶1Rä`+Z#ÍùH)¬G½³‡Ä”–Æm³ÃýKÕ4?|_Íc¯o—pgÀΰ\ˆ¾lKê‡F™¼ùßâ[1œ¶Ì!+¥£Íoþ¢öš2B¯+¥Å TJoý‡Çü ú8æ×lÁW¨0·7ǹ{çO¾ñäY:]à<ØÂÉKŽ2z‹‚ÅŸ`ËnÒ‚Å 8íù³1‡8Æß}§Ý!-k·uî‰æô à>E¦{Ê5ŒÃG¡ ÔÕ ÛM]蓨ù‘zçª{ßéž&4ú4ZíAŒ_ìþ$+ö#çO'üÅ>þ¯ÎÛ×w¶ zÎjy2Þ„·vYÓ· øà®ióïüÆàùxÿ`[ðCè‚çeðSJÃØØ ñýWFü0ÆÀØ“œ‰“ð}a~ZÝO]`3˜Ø ‹Mü ÅÃч—º’F§Ç|€Ÿ.°Á¸¿„Îăfãéþ§îmîÏLZÇ€iø mÃyª'êg÷¤?Ûéß²6 Í" ÃҫǤ~¬b~P;iÞ´ çãÙ¦mºÞ»ÆdG—¥_›™O§¹w›yìÓýÓÝ`~o˜DŸ Æbó~äcsÅE<ò›ø‰âãm{w´Ùøµšú¶yu­˜¸;ÆZôðe€7ë†Åäüò9ÿçÏ16±qá/Ï÷Å{·û=[ãÓf¼³e]îËÓ£h˜ÿèaøýâ…MNÁâ¿œc3ff˜lŒÍÂÿ2^·lü MOÿ€µó—Œü㽌.þ‹F[>ûK‰5ƒ¦oñYœ2Ä‹_ _ÿË~ûMÅØ33ÄH ·qòbo8à?ûoc¬bgßßFL²Çr‡Ï10ÞC]ñÏœaf´Fø>3ÞÑcáÝeÛã3‚½œá5­X! †¿2Rv86+—õÓfg—ÓÿúwÏœç·ã,%Ä Û^³ôüHèOóžþÆ£~Ÿò翇TO${jQ•^²Þ‡lØÓ¯â"“~òìo,¥,q$¤õ¦°‘ÎçÄ#¥hVšß~åpªöÑEçUß*×̼õöÞ—”Xqx´«,àÿ¤6L-/NÆá½ûz~æ>¬ö°—È÷ßX]h{o«-ÈñkÓ®â1±9Ïÿ¾=xÊ«Ë$ Ý( ÅæzßaŒÅb üâÁ&,Ãúh±ô2¹ü³’–õ+÷ƒ»;,Ö¸b#ôºG-½eö¹·Ó|v•ô±zîkÉ­ëAË>lˆódÞ ç“>B‚„MÞ˜ødz²ùŒ®†ûÐÛo,#„½þ*4ý²\•dÕ½|ybØÛgŸ¿‹o*¥£²èwF‚þs™zJ¨æ.ñ €ê+þç«Ñ`µ1ÝêÉkûµh[ŸçòŸþúçIqã¨V’NóŠ[þxüKÏ“â•ç@¡]—*¶îJ;Z\ªï*˜(ºîÛmU4|™wº f=³Æç©n@«åŽVóËÏŽâªá sÆÂ?ªç\{2Óžæéhccí³+«‡5wà*®&;Û›YYZúîÊècrgf§ï´ö9ÜÖQ|ÂÉÖÄÒÒ6þ|)/²2TW *(k˜›˜æq®¾M÷Žx:ZZZXíˆ;1>{ ;¯[Øm|:8|퀯µåšõ[|²;˜²3ºlt#î ÊrÖ.ë›|Q*ïrƒ·ÕµW.­Z…hÚèJ3o"a›/Ы.´I­A&îh”¿øšgú»Z½)®AõÜ'̲BíÌ[¦±ÖÓÛ5ý ñ÷íśךž­ðð6ÆÀÉØ€u6kÖ9oÏi™-¢™ö¼°­VVæŽn~7ªzø{)¸”úï§kSeäLÍׄör—.¨”Þ2;ó’}Ô^ð²´”r2M­$£#åènC~ušA»Ý‘„0ZMA{/ó΂æ|$úa›/W • [!júÇšï(8ãÕ‹;ÝÐk/Tafj¨‹•¥…{hj_g1ß6ˆýèñZÏŽN`ôª&6ÀÙÚÊÜÖqKÚ•2"Ž­½ae¡G“–5µ4÷¿RË;€§öm¶µ°²´ò‰Ly>Ésàµë6hxxÓcý s먬[ìY;MtdFzÙ[›mð }ðœ9{>Ou„ouÀËÔy{dMÏÔìA)K ´qœš½ M%ZRÝO–2ýÆþrûl›óüVÓu±Ùï®ÊU¿ÌÛþÌ4{ä— ëžéÜÞiáÛjØc‘óâ*¾Ü»n8g² ûˆTÓWqŒ´ZbS@ÄÁÌ$+iõ½Ä£K§¯éIѵ¢’^C¢Š(8 ™ËY®õ lôY7ñ€àþîÎÎ\Ã-¶&Ú'«&–ߦ­µ›22÷íØ@–J*zÏÓSv˜$"ºÁ÷¹ çC]å$$â xÏ®XJìOOÄ9J‰k½}¯²wœx·àRzË쌳î&f!Ç9Gr|q)=tb‘% ]Êíèèd`hb¨w`†‡ôm7Sò¿ô|ÉùóHöc‘ JX'®¼ÿRfÃZ9¹´Ú—̇—ådÉYœÇÇsºTšÔ(ÛöÝÄsD¹+©hn|ÁäVæVšçúÈžØa§jå–…2õèš<ž=——zd¨BÚ‘YNb÷Y RÐå^OAÇüü<œÛ3?;÷ÒCt{²8ñçÉ w~n/$„qß6Bèp#ozkú ]ã¼ '£ÿT@ î1œBÂHÛ cÍ_2§eÄæur.:ºmW©nêgr³Ï¤zš[nÃÏàx;1ùMsOëÎM4‘¢ºrp¾\)=/ “³á>à~ÙRz»ìDÿ&§ŒæÅÿóþh!á@þ¦¡ ¡ÿgJ¼¼úo*´ðþðj,Mv‘m­·©²Š5ü§‹÷>¬hê!¬æÂy'ÞXÞsùÕ¼=›h0"³·’èÖ>©I•1}ÊVùí%q³Cĺöë®Ö âwÒDXklÚsCÓkDõýïϔêò–é3Ü.lÞp§´¦MÅ¥Ou3.´ Qª æ;ì*y6ÖìÛiÛBHþ`Çï63¿6£ƒ=Që°ÑÇÔK³„v;ñ¯¼‹Çµë.í£ÉRKgŸ­5a¤¬ïµ¨®rÚ›N³ø§áÉUªEqZ°&ùº¨'²“3n•⩬ô¾³Ý: ™XA÷Yq’Üõ†¼6ë`n›´Û-ó³¿yè¤ü: @N[‹3ú»RàÛæO¨k”_Mžugï=ûø¶‘¿ÝÈ?ë‹ä¸¶a¿mp.o"*…†:z ]½Œ„qÛÎë%ž˜«q¿B!׉+û?þ éo]Ÿ¾-ãaFÊÞ±ˆ×3<¯è¾Ÿ-:b©ÝU§¤Vã„*Ki‘.–-¥·ËþZ:ˆ"ŠË™7&EáôcHA˜ù~ýëyé7(æþ³Í¥].tMËîi~¡öæ,¶Í '(™h‰ñ4“““¡ÉJ*j94pªæÙ†èUsÕ“V3Œ?rö^vö½ë§õ¤¿ ½?ÆÛwË£³×{Žmbñ%nS Øì¿Èï—Ÿ=VEÚ¢róŠ”N§*ÐU«FlvÝ…Hªœmëb2‰Ó-Åàk»‹-œVÌ{¨æ cúµ›‡<]ZoÐnØjÿ’ÕÃÆG¢ ÅÂ>æÛjº¥¾tÍZÔ ßxe?MV¦øåll3¶ÓPÙÐ;v¹Š°È6MWãðШJàXô¿j›⪽ùÄܱù¶ù3êã …Sãög¢’DŠ?6¶a±WUrçÅ6s™ž­“À‹nxvQ­Å©41™ìWok›×”Ò¿l›~¢”v΋m¶ýÛ‰¢•JËäúÁ¶É&bݶqnCM?º&Ø6¼þ׉gOjâ½u%U|Ú¦§ê´¼”ø©Ç<©0GS¾™g›#‹lƒ‡ú$­ÇÇ6ÓM¦¢_F4½aTñÀÆÕ«ÅÉø‰G•%’¬4EF†,¥í6þ^‚ bïhµòî2î° |jš7~•sÿÙ âŸôÎÎN¥l"S×fñÎ ÖCóïÿ郟--7äeÈÉ·[y½+õºÊ’þɯ· Ññ⚟Œ–ÛtrÂMþhkôÊɳû§¹ý6ËÙf6;·‘=16:Å`/µQ#öÜã½{r}&„”üçúmŽóûm¦ ¡_¡;Oˆ×1rHH q—=¨C_i"ÆÒ«s|ll†µøh÷žp\)cùxŒ›‘¶Q‹jê†K"e#™fwdön”ëQšRjÁ#oÔ…ˆe÷zþTp)½ev¢ ibl|r™»aÔ„Ðw^³{€þ „þÀé·9e‡„þ†žóƒ'hO&c¾Á6{r|trÉáxq3Z’ª”ý„:<8J]ÒoÓQq1îhålÎö’4YqzaÉ•z\1<{pDNBæÿF¢ÊÃÒb+‚ïŽ.güÐ5'¯ ;uó>‹Ð£h¸Å`ˆd)©í~aöØ>,¹™ÛÄ].ÆœžÄËké ‡‡Œ¾\»Í/Õ)Æ;­y;›mý»ŒžÚío÷YrcÆÇÛ»5XwŽ"*bìè±ooø:#MkË bˆUk%)­à·7åHzÌ:š¤a@×̲õˆsöL¢£¾Œª~DDH~ëăd;I²œsÐÞ¬ôxkuaqýÂ>æëlƒæ²ç4O#F‡³–´ï•~[íþO"† Øœ ‘ˆ þ ý/:pÝãÄ6_þ™º¡Poô·ÏÐÿSE¼†Î ù5úëwh£ Rüž¨SÙn‘jÎY£­x¤||Éá·‘•×1 Þèd*¹’”QAÔÖÁ† ²¢¢Vn‡d9YJ“i—¾z}p2üô´‚˜Ä:ïÐ}W É,¥·ÎÎ:±QKÏïàcûð±›-ä冾þ9Š¢ßòd«÷WôŸ£ÍÛ‘¯úû¿¡ÿTE£ì7؆Õë©+½õlß’ÓçE°Ö÷òš&aû⽬ílM9±M×<ÛÌô?8***eã✖–°ËGGQÒ,:—ÈýêŽêªÕž¡{ÏV¡¡uª¸¡£×Ñc™[í4ì#.Xé“ l¶ßh>)À6ÓÄÿ½.zRJFVÑÑ>Žzâ+©—ƒ‰/JÒIÂ"æÎþé™i;Ýmd$)J¸Ci삽®šk]_N.væ¢1©cë vÞxgUŽØi±l³ ì4lŸnùx†¸ßN8¬î²ý!Þîîn‘‰§ŸÏ»9ïaî© /'WW÷ØÃ×gïZ8“ìœT:{ÀòNxíºË;úË#½ÜÜ}‹; ý4 ñvvsu Û¸k†K ¸º{WvðÒ£MÞÛ> stream xÚ•TÉRÜ0½û+t´«2B›7ŽIn¡8akWlkðÂdòõi¹åÙÈ!9õkYýÔ¯å'F^ #×ÁçepñM&$§y"²\‘TTeTå’,KòÞ]UèAG ‘fá}o:D×cUšhÁYø nMmto0‘TP=/o‚«eðp8ŒŽäŠ¦,%E<>3RÂú aTæÙN»¢’ bMî‚ó¾"“4žv%i;2•&TÄÜ‘]|obA¾ZWC9haT$Ò1'œt@òañö ŸsšÇPŽú•TfꨆuÕNRæ^ $?š# ¡€1Æ‚åÚÏàgÃ1ÃÝÖAÛ•øa‹”®zŒ©õPE"ß]…§¬3ç¦3…)«öÕ¥iØè¡XÓh!sõŸç¶1ýa‘¿äF·¥l·Ã´ÿ&ï®E]†º‘8íÓìÔ~ßûÖÄÑa±§Ó~ì "Ð5ÃmU׈l[ï½øoz¦µ«ÕžAaÛÁ´ÃÑÆù´YÞ~³ 7zW[]~ltO×O¥;δvu¢Ùß÷Ën0½»Pø)Î|1 íAk“$ˆ ËÙoÓYˆ|OžÒ\z÷]ýÒͦ6—+lÀeæþV!rÊT>{@¢ðÏÎO- oΓjìî0N“Ã;„ÌΣª½<±Á¹³cæúgcÿõåãq.°?•L‘`ö,M¡nZý²Ö›a~ƒŒ=âìºk¸û³Nÿp©:í endstream endobj 885 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 325 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 10249 /Filter /FlateDecode >> stream xÚíÝw\SyÞ/ðÙûǾî}îÞçyí>Ͻ¯ÙÙÝgvfl ´„„Þ¤ƒt,E.‚½!"= UÇÞuT@±a¡#(¨HQEé-Éïž“„’Œºº;Ì~Þó}9‡“sRNr>ùý~ç$!`: …ƒ/[ÛP¨iZoÞ`Gž.lœ–˜,]c¼(…šve²4œ©iÀçó±#O ®ÞAÙ÷Iz9 5ýŠzéºøD m¦MÚ,ʬ$ÜjúUF%q^¹iƒ´A¡6€´A!miƒB}PÚ¸¬\;áÁVìÚHêVæ=bææ{äÈ‘cã8p »»»6Ò…ú´ic¸Ð+:::fœÈÈȪª*ìÚHês¤Íúq¢¢¢6H iƒ´Áë…´¤ …´AÚ PH@Ú 6€´A¡6H iH iƒ´A¡6€´A!miƒB!m6ÿjÅ)ò*H΃±¢¿:µŒž/Z@HMdTÑóé…E•]C²*F-SJrjHF©èÒZ’^*wéH‰ædÜ#Ùâ[©+’ë¡þ¥.Í®›/s÷¨K³î=iƒ´AÚL¿ŠÚ¡4ï{†âl†â†ÂwÊ*êNá‡îÒ{:µSóî—3”T´âî¨@H¿Ûb­þ7À\^¹h—§–)!»÷¦)ÌQ ËÎ*¾Ëúó×~¹eZ™psæQ[[Seùo”äþÆÒ4^}8¾PÈ ’z¹š©ð­Ò‚Ü*:¸Äó£ã¢•%wo–òÜYúVî+÷\K)Ý=¤ Òi3­*z÷FM}Nýêͬ"Ü+¥†º*ÖkNSmêRÞ¹,¦¶‡—‚UÒsž¨õ’œW¨¥:'äØ[qk‡W6`k"oœK¿þ‹KµfËä½s+¥dýÎHU–†ÛÖ«œJúV’ÏÞ01Öd›‡$—4TÊÈæÝÞêvIÆê³WŸ%£)´>a‹†®cšøîÝ#[2² ´•ŒW ËÕÓK$ÍQÚØ'Ý•tåèk¸~SwÞwn¼n´m6H›é›6âÚ¹a±‚îQÚtªï{¨‡s½QSMi͉×tV”ô²nK£yö1·¸×Ê´s‚Ž¿73&N›b»#XIkiJå¸Ö8¥$ d™¶ÕJñpP\V:SÇ"©H˜œ³]IcQr…dáñi#ÉÃr²ÜËÀØ)ñ_|ôiƒ´™žiãœVNÏ-U)W›lÔ„ɨ {x*êIÔ&*åû9héŸË¬7NÈž¬dUuS7[eã +é•’VÇd=©ð ejv!éå²ó7ma¹¤RÓådÅr#㥩kΨê¶UÿÎ9£‹ûNÛf´_¶\×:h‚±h¤ Òió‹N›Ml¶ ‹¡ .6‹©f_Lõtºì46q%œ;ý)·RÎðTå ·ÑmzÅ èoª¡m¸çÖØHïdiæͲ ¤"…;®5BÔúÍQìùnTÚdÜ-דŸ³ò,?åV_ÊmaH”—ÎüàÔâ‰ÒFÔ(ò Z¤o´AÚ m¦]ÛFCoáÎK­»ó^R_ð6M4?ñÇ«jle¦²Üh±³]·UJzC¥d]lˆ¦®grñØñ£ÉÒ&)c“¢Šel¹lOÊÇÏ^ßn-5s}èb†ò\¦²¼ä¶”äغ[o MÔ“¢“¹YÉ›¬ÌEO iƒ´™îã6â¦KD˜¹šénÞ}’U-©È`wu»HºC$ÊŠ¨Ø`M]ä¢q¯ÿIF‰3Ê_Ûh7ÅÑôŠ‘±—R»xIWéû%鯹%| c†ë¶²ì‘Ê©!î†sL6TS·%5JLEM9Ù¡2O'ò*ηAÚ m¦Ú 3îÖÌ“[z¬7~æÕ‹jrŒ°ÉàÉ„i£=GÎ+«vóñ*I¨MŸ“sô”®Æ¹€´AÚ PH@Ú 6€´A¡6H iHÒiƒ´A¡6€´A!miƒB!m6(Ò6(¤ ÒiƒB!miƒBÚÒ…BÚ mP(¤ mPH¤ Òæ3W±0©†\]—Q“=uˆÈæ„Ðua]ö¥uÙœÐjzÿšìëë³³Âèé´júBµ õgαµôZé¡ô*YaÙWb²SÓnqC²¹a{¹·¹çš¹A™ôŸ©7éß‚‰8@Oep‘ÞHø•¦MZyÎÐoR7­µpŸº.-ðæèQµâ®™W‘¹WšWÏ{ß|Ÿz‹¥ÔZ›"svÒ6Ÿö|ª/C Š¤—ñGÄÝzá‹mœ½ô ü÷è½ol1Ù“ùéÏcò*èÏŒ. uvŸ¨s”q^€Þz¥¢Oˆ¯DÜ“2ð_•d™*Â+•½ñ©A™ïÌ/|½íüÛìú¦©Õmgºíyùî'ÒG>¹À¹õÑ(rAöC ¢´QšŸÈCÚÒæð9)ykî¨_ø§2ÓÎe1gÉûdVí8÷dÝö &Ãrs‘d8úã«”$æ5x診ɸ‡´¤ÍçO›Yæ\Ë°Ï›6T­?ÎõNüèo£‚%îàI3cuu¶‘cȶ+Ü¿ûs”¼{Äß¡¡1?æb÷¸*¤ m>OÚPÓ!†»þØçM*¨ÆC5ùøˆ­È+£ûJ¼²ÑÁœ¿«Ä}+ú|ãòAŸÉBÚÒæ#?•Yûñ9ð¾iSJ¸\ûuøò¤ üK·m¬ÃéoþÜã6žøî>¤ `ÜæóÛPmŸ$¤ Ò~µi£eyìPeÒ2U5d¦kò’œZBUj =“SCOsDÓ©âéZ’,Z^<&ºˆú7íy®cqŠJ›r­•hD2}_ÔA«MWŠ¾P i€´_]ÚpJÉÕ¨Œ®?þµã›9SÕÏ~>›Y7ƒÉûR“û•Öõ¯UÚ¿™“ó¥5ó•zç7³/ý‰ÁýR“ó¥æÿÌíþfv½˜æá/Ù]ßÌ>õ'uQÚ7F9‡ª¹‰W©ùÔZÜäëÜk]ܯu¸Òâ²ÜèA¡ôüÿ§ÆÍ}…(@ÚÀ¯/mÄ#ÀÉ÷ÉûTJ1áøó¸Ëw§žiJ®&œç¹Þ{8[Ï&S­—SMÜUÉÜÕœ”"aÒ# Íæ®Läd•$QœŒ"z±¨ÃÜ;CܼWÜ•IÔŸÜKít{&ú(wE7éÝÔ9PMw£B²¹EDÒ~ió)òjÒ?ßóÖ×€BÚÒ…´¤ …´AÚ PH@Ú 6H¤ …´AÚ mPH@Ú PH¤ …´¤ i¿<î«v_n½Øý2<’AŸ$l¡ÒEØÏ‘aŸôþãÞJþ08ð ;Qtž *fèéaÒw¬9ysý’Ƕ„ ¢iŸŸÏò©ÀéÍ{utmí’ˆzûðF»Õõ6½¤iÑ]JúEBÑ#SÔLðõp{ò“5kì"ëC›ì×6¸d=‰ö màƒ0"ä÷ S]%q€ˆ„…CT究¿&¦Á-²Á1¼Þ6 ÁlÏ£À§ƒµƒÂAj€oÜ Ó›®Ñ ŸŠ›!RÓU^oÑà°ºÉ|ç“€‡Ý%ÃTÑY4î°8À‡Øÿ|Gy×5IS‡ŽáÃ’ :‹°&»Ðz«ì¦íC¤—Š¾ø€8ŽFÀÇ |h¶åᲑ´zËÕ¸(¼ÁaÝ#ûòžëdH4XCºŸrg™=¹ß)sŸ'l¼IÍëy‘>gÁãŠ7ÔdÅÙM»Ë;úþ°Ä?e²'WæO?'•È¬û㟠 ŸŽ®'—ÔtÂø“¼X&{ì ›%=(™ /sñóË‘ÊLÃRѳ;ô䌾ò·J:Ç/õi÷zNãºèz×î¾îó-YkžÙG=±?Ýš):.NÁñ§©ÙýÍ%ÎÆ,UÛåë»%OKw]·žªªŠÕ¢üÚVzá¡NS¹§Šê“ƒìÙ,£…+ï·Ó/®Â@“ÅPc«èZ8 Èà‹’7SjE#;Ï»’7â¡ÂÐïl|ûì²#};Ì”óÔÌ;!ê UzEmÓ…ý|rmÇr%[_j~Éóìk-í¥Ç,·–Iîè³"2ï+òÅäM–K^:TÚ,8HB-éùÿ%OôŒ½ªÎo#ÿþ?È¿%þ©D ¬åxÄ|ÜÛ|Ç4¢€~e^ß«¬¡ó²W¶•3ÜݼuÕBuUE#û•Å/‡Å×4øêa„§…KYËÐ2;ï¾dÑÇû¾W[ØÝYµÒV‡©¢²8,pXœúÝ‚C‹“{ú$çzô–^8ªn“ú½ÅéCƒCâ™ÃOvmäÍ4ÍÐXý¤ªq4mŽ®2¨ë.I\¾îä BüŒ”=ßÉ\aõ{Œ4”4tL–½^í,NÒseÕ7º‘ôÅüþ;ütÕUØj¬e‘ÉoH{~*õÔÙ y¹óô‹EP}6ÁJ¥ÊT±\TÿVÔäé¨Tf0kŸ×­÷XÀ¤æ»G¼ì•ì˜m¥‡œæ«1TÙ«¶ìëçK^/Kº˜¨S[ÏÉë«!ÉQŽG¹l†BÅKÙÁ†ü}é¹ ’X ¹š«î<\Jÿ5üÌL囬»=Ÿr·üîëž8=ì­¬·ZÛà´íÑJIJ8,jÞÀ$ú åç%\®mn~~5a‰œÎ2: ÚÎhËËq¯>jmk}Z}Æ@IŽw»› ÷X³5­j^vt¾}},pºG$]¯uƒbO¼}ÓIºnͽçÂ}jņ҃:ŠŠÇ‹n¥2fž ÓgëÉöŽ·]–²ÿqîõP÷›PW}¿-GÞt¼¥rïIþ¡í¼ctúõõ ¨–ùÐÀ°ø%ÖsΓœ[äéSRrž¾'Ú™]ÿ@þ×—äÄ-Òô”Äyßü¼ çŸ $_ü”>$ ë7„µmpxˆz ø’ñmÝÝ­»ºR;™°Þ•¥rèNó‹gbå˜Æ©8,±Pœv¤ìekkkc¡£Ê÷þ‡Ÿ‹ÞJÊ+([ùp^¼~ÛÝõ<Úx†ç!üa›óÇ-mí¯©áÞ¹l¶NÑ涶֋Ü5c»WýBòⵢŊ”fzÅæ &3RPõp¬Û|»­ÔŠBÒQwgÛ®øÎAú¬Žþ~ê ûûúéûJ§9W%äéã—ÝÏš®™qèŽdÍIÎWVKžu=o®ð^È1æQ9ÕrdSÚß¿¨kíyÙRî·„;Sœ6ꪨm0Ðß/n„<8‘²ãÀU™WÄÀƒ$Æ,ö™ªm­/®Ä/VcÉ‹Ó¦·Àÿ;ýuÔDA¸®~ÐÞ­/[_>?¿Åb®cuEÇÙZ~Ï^¿¥îqsá–¹³´o¾–ɲ{Jm‘®ªL†žóƆö·]­iÎ*FQô›NkE:KAóJucKËÓ,_ -—jÙÚ¼=l¦Fa ½õ.çD°õ-[èf.ém«Ù±}[³t{ü˜=Éo1c{¤²GŒoR¶¯¿Ûô){xT㥨÷bd½ÃÆçµõŽŸ.ëöñýD ÊdÍä[îÎkæòÄ‘7µÎSûö× «ÔÙGFŸÇX_ ×T§҆¹ýD‰¤­^ó-Û»Ot-á®záÉT‡H˜¤­2Ö»I ¶Z¾Ÿžº3Cάn¤5•¬á‘OM®[b¼û§ñíó šÜCݤ±Y4ú?Dÿûídã=QÚüžüÙJ².¿N¡¼FúÏ?A6=’¬û²Œ$åþÄc¯ão¨ñô6ESç‘NÈ@îþ½åíCUÉÞ ¶Á£kî÷Õ6ð¦ÏÎ’Ó¼Õ/¹Ž"ž9ËqµœÞ³ÈÜ5^tk‚ ¦[väõÈÕ¿¶Ra«i'-§fËkÜ쑬XžeɴϦV<Ÿ²ÔÄ1–O¦ê,ˆÓæ¦ø1RZN¥üÞšj TZålª–,?Ør/û'j¿¡¦y(å¹øú†[îófIÚ6“ ´KußNz¨ê¬ûid¾Ez³dÒ&ÇnŽõ–3#Ëó{ûèt)œ­Ò'yÆÚ^¼¢Ÿ¬á¡áþÎF#ÕYù|QÚ0?hßÓ·¹ž³ 6Q™Ž³-SjÅ÷¸·áðáÓT®l3ÿvñþÖÑGn§Ê8PÞü³=#QÔtl\¬æ}B¦;ö 3`X(¬ì¹Öh¿¶Î9¼Îö~O±/;"B„ÍTøqNów–žÙ¿Ö€å¹ÿöèÓtf½—þò"è±4RÉÊyµWoþNÕ³K*m¢ŒÕ5Ì­½Üy,]äá¾ÈÒ@ÃÄ+Bœ6ß©ùô¦Ð§5¤ÒfªÎÞÙ±„“ßýòÿAODˆzXο#†{GGBÉÿü‚p*©N½€(>È¥Ä`}g_™—eN ‹YÐNÉH!ó9jºFƒtÚÌT6{1²hé^¶}_*mžÚÏ›eäHojSxz¸êª(øÿô˜´žž¥lò|$ýîX¨jËåO›)ˆzR«FBCð8ç+Í-g¾5º˜Û*½è«cÒ-(‘¼¡ »šG{RïÓØ ×cz‹º!b¾Ê2i3ØzÕyæ\%†oTì­ª:ª)“6ÃÝO7-§zÓ,CC]#5¹Ü'CtÚ¨² ›º$OØõ•³õ¢©þ™—âœuwd†¾›æÍ2Ýzî®z EŸSUR÷òmÛ£Ç?~ô°îéðÈ›ÔPg}°ÒBïÝßõ˜ŸTõÜ otŒjp;Ò–DŸ[ ï·á’ÜæÛn; ý7mÄZ²÷ÖhÚœŒñ4ðŽI›†ÉÓfpƒ©ÚâŒѧÓF $iÃþ¨´¡‡ä¼ÉoÿJúøTK•þsæø´ÉÝÉo¿ T›ç6Wû¤ßÐ~þ…—Ÿªë´Bfˆr°«iÀöÑ´©ÍKQ×3~#I›S¦Ís¹ïcïóR[‚îIýÝiÓ1òÔ=ÌþR»¦uðÜLÃsç[¤&6WŠ$þíSÞì÷O›þ}沃%£ûØ)ʤ¨7!ê~ùcæMUm¿ƒÒi#Ìv”S_~@¼Ëu?5fÍ—6ÒiÓ·’1;ìf‡ôýoq‘Ÿ±õÞìÖ§èÐUe–ª²¼’³$jûï-T›á“Tð9†…¥waEoAèS‡àGF]Ãüa¤Íûö¤ªw-œc³qäÙy³Èát ¹®£¸4k4€6,7ðˆø·™,m\ôÂSòèÞõ† ‹¹£¢—MM=âg}Ò´1Ž¿0ö)· {RDÎTÒÎ(£Ã$ªLÒ“úÚ\2°–ž_(T‘û‚8çŽì¹DØ:¤ïç{R//ÄÉéØõKL]î’r¯»)ÇoŽ©ïèZW¸®:óÃÈäi¿ÈÜmøÅ·Ë~†C\õÈ6<ªzBï.S¥MÜûô¤nÐ=)Ñ%õ?$ý§Ë+*ÝæsܯH"±¿á¬M@;ŸÜÔÐØ¿½^gƒ*S÷ò32EÚlu›o½"¦ðÖmA•c–ü¡»ÅE—Ïdê(É%ä?Ÿ"mvº/°ôŠ*,¼9( ÕÇ“ü6§Mp®!_ü;9OÎ&ÆÄäßÈÜ`Ò:L\~Oþ¯"ÙÀ%W Èr=ò›oH·h7.ˆ¥“'árb=Èã²_æú^Uçû­y3 =JLÚBÍ”-‚ ®_?¿z®ªE3=ŒÜ´LoÞÒ­ûŠJK N¥ê+(ðÊzÉäis)ÍOËØíÊ•üö^Rƒ§¢ œq*·¤øöá„™Š†©VÑ$is%3@ÓÀùò•ü¶na[u¾_PhGÿ;ï˜tÚìÓ ¨<_Ü|³ð¼ºñþЋt¿æéuî×zWÓ.5æ_+°³Éq?I?˜Ó»Sþb_yúVcnÞ%3gî¬ Û6ÂRn”ÿžeæ>ÙÇš­wøâ­yÛ<Ìõô”¤Óf`½¹¢SxÜÕÂÛE·¯q¢l4]vQͽƛq,¦é™¼üÆNþ _¶æ’ÍEå¹G…ëh(ÄîÍkk«y7m¨ß<>Ú+·kÿÙ›W/D»±,CS÷ÿéݽŒyŠœ—JŠïKY;sžîývú…ÙÝ\àï[ÿF¶x+ÖLEkùOWò/^¼ ªŸŠŠ†­øíÑ~ùú?å#t¼Þ÷<¡oè-5M7ï œzj»ë·.±¶¶XúZ02°ÿæþ¦Õ‹--Í<ƒ65tòE£½ËY+|&YõQ²žu¸x¼SÐtÉÝÖÄÑ3Œ>|ÙS·3ÄÝÊÒÌÉsõ͆‘sj÷èÙ­}Ê÷ïpòßq•W{–ïagâàÜ;LŠxQV«6¾{EÃÊÞäÏ_–¡öðÆ+äÛÿ&¼"âý=‰¨ qÞäë?5;Ò5nùÒ}Dþ[ò×™dÇ ™÷8úݺ䤞žÌpÑ[hOúF_;«KüÖ?êÙ:C¯RbVÙX-pYx³®KÒøzyÞУuäZ«O®°]u„¾º·µþN ¬lÜj_ÓõÔå®^bmiaºbm\‹øøZk®‘ÅÒ–‘[®=ãc³ò ýWçãÕÎ ¬¬]î¿6Ÿ´qtnë•MáÛg‡ =Û_¾ºëôƒŽÇùu'GG' w/,\ñƒÞ²üØ‹#OªðiFâaƒ¥Gì7½lí:1ßóIõis}ÓbMï¤w_uWr–Ø›Ù9xä5òãÃv¢i}·7è¹î=hþá=Ž6Ô#µ‰Ü½@¼Ò`Ç:O sÛKO†„C];Y˜™®ÙCoÿk)A¦ÆV—ê­mlJ›»Å·ÓS´ÎÈ%^¼§Ö_Xlgim»‰w~´qÒßp9Ð݆ÚzËÃvŠòY4¶ÜxÓÞÖ¢¦]æøpŽ§©­¥­ÅH™Gf^¥MË"99%½ŸqÂïÚZ´¯':Ioü´ìAÇ©âlüÂÒívá»wC8Ñ9èïŸ?¿<}i»·ži×ÐÔÛa²³ûÆ/*”:wqÊsä¤ÚT+’Éz “,2ÉÉ“ä½fÝY¶ùÀDœL6sâK§Øã&8ÓO걿ßÙ}DæÌ\á{¼@ÄW²ËÅìRvsøçîl¾VÜ„7$ºcòäv]K÷¯øÛ„ÂáÂÛÕÆ€éëÿÆfÃ- endstream endobj 890 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 184 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22044 /Filter /FlateDecode >> stream xÚì]@TÙÕÞM²›lKò'ÊŸ²›d³«ÒË0LŸ¡IïÒìر÷Þ+Šˆ½wEÒAªTé½—éíþ÷Í›Œ¨«fKî·ìøæ•ûî=÷œïžsî}o@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@øþ!—Þ#×}¢z¿ü%§¼Þ BÓ%6Ý"ÕúözR“¿S¡É_rí&Œª—|Øiò׊üµv"ü°1ðü~zQÓÛ˜¸¤·þNB6_DZÁõ¾v涭,¿?ïÔ“1Š¹¸Šò¯‰±Ò7Qõ[»gêë‘·Õ¹›»ÍÙË—ýÇþ'-xx¿C${/’—f²þüÐ ÅíO–ÿûÏ7û¨ŒùFÏ<6¥yä™mÉýÈè’×í>¹ô†)Fô¬öŠ‰†>QGß®€s7ø‹¯]Êzø×ÚŒ{µ½³_ò~$?pmï’ÅW ¥]ySüR†¨>I Y~Ü:òÄŽT;+ò²¸²×fyge¢Í-gPœvqEÄÊ“â·š\8ÐÙÝ/‘ᥠmr ^)nÇ6«£,ìn>ëÐÙq\NwWŸà Ä-^1‰Jq¿WÖ544ÄiÊeÐXS7 ŠeˆnÞ·¦)·ª(ûáýä”Ç5CZN¥¤¾<ÿQJRrrJfAW¦<¿¿.=1«^IÖãĤ¤GOóÚxx¿K*ž^ aÒCæ︗˜Ü¨ðN„½¹O&%%?ÎxÖ: V;à ™‰ÕðKsž( Émåbû{ î[3ƒL ½œòP±KÖRž’–3¨5…ù{ý÷Â3÷ùÅ>¨ÅlŒß[’›ž’œ|ÿþ£ü ÅÈ®¸Æ6¾gÄ`ðYÚÃäûÒŸU Éñú+ÛÖY÷<õÖæ‚Š&‰â*Yc"Û~E'M¦ÌÜñš­ ¯%5%©¤U¤Óç—ršóÒß¿ÿiNIŸD+àwe?½¥ö0µ¤¶Så±qa5sª‡xݵO$%&¥d½bÚ-´U'ÝÜgeb}óÞÓü2)ÖPYKUñ“É°Œœ’j±*œK™)™•ƒ‚Þ†´‡I‰‰÷³ ª ¦Kò‚âG÷ž”wá~=íDz¬Ÿ´ ó^œP± ^áÆG ÷ž5qA×S5Û´U¤ÞÏk—‹º²ßOJNÉ*i„;E½é““<«h‘â†[{ÓÚ~MôC΄,<” ëÎïn|œ’\Ö>Bh¼ü”䢦^¼äRQqÆýGO+Ä*‰6ç>J-|!l/¸÷ëk §3ã~¬£}cÜ•Géy¢ÊÃmâ‹»új ¦$?x˜ZÞ2 ,J.¯)z”’Ó‚ékGÁ½ÇÏÄrq]QFrRRÊ£ôÚ!Þëb^wzʽ¼&Œ”¤‚®]süÖÜíQk#çNø7A¥°Îò¶‚§÷ÓžqÅ2Äï<"—ò,ñc-<ƒÂ¼mˆ$šÇéJ~ôöÎ0ÉÜ}räâya6DKVàv|h);?ÉÀ{ç‰yŽÓ—o?¼‹›m¢Ûâz ,Mx{çlæê3uõêÍC@\|Ü™N¥:.Z<ωF³òËiæâ^{-PÏcÓ©ùŽS—l=|`»—#ÍÎi>¤ºk»‚'9PHN‹×l8÷*§äú,'#ûÀª^hÏÒjhkõ| ïK»w¿KǨÎ5aö4"#dFäŒ`7*‘¸;[åÛ8XFo™lå0ej€;…J žw„#WjWååÅ,ÁÚ#(ØÓŽH·Y“kÕY•÷°†üÜÄ»/Cý³ëV¦ã¢n÷Œ¸ê–›­•=qÊ”`k:i¢ëür»JÛrC=&ÒYìY —D¸2˜V‘ûb6Åk÷&;Í9²õÀáQ!ªÍšsñ–>^³`‘Àœ¹bÍÞóI°ŽÌeSÎÁsÍd˜“œžã”%èšH±›}fzPàæý‡w.³ ±—{†K>«|ÇB˲֧âJÖýð»«R‹›À0¶ÁÎÜìkk´²•+Qû6poò^'³˜Ý3<Öï9¼iaƒDY÷tvHÈæ‡×F¸‘­Î¥5Ai¶•e?ª„÷ãeß»[7ˆ×’v–nª·6±„ÄΛ:n¿‹o‹8¥Á4#*3°\ˆó]û"kÚŒíwúÌý†RÕ'µWî]B"ÒÃæEm;x–S~Ędpý|Õ~ÚŒ©-MI¯ÛøØ"=¼A ¹‰ F™‹Æ³&Ç-òvŸ¶úð‘ýÓ½Zpºbã4>u6þç” í8sKÄ"•…¡1Î<{V3Ê^–0ÓÖÀajý€ñÃ;÷kZï/35qKhQî;åbfµ¬3¹­fzŒƒÝø~AÃC†aèÎ<¸]u-ÄÜÐxî…züPïƒý$ídZ¯Â¯ `Ñ–ì€ms+쨞ó •ewïð#ÑæžÃû¸1>ÌÔÀxúéj¥¯Ÿ~ŒJ%G§`cqJì "=J¥¬ò®ª‚Œ¼ç<±\í媵¤¯è§Ó´GåלS+)æ¬$E•¯ou!Ì–_ªÀ=?>ׄ<1á¹âXã5¦!yíå"üPÃÍÅÆîi}²áyHì_§3'#½º[<2Í"ælžâ`í³^é:´y‰‹¶p7–=hÉ8϶4.ÕÊAæ¶ÔwÏ+ÙfaJ•LÍzw¨TÚ¶K˜/:Â’¶¨côÜÄèT…T$R˜˜?400P{'šA±”`µâ´nwY‡Ð°ú‡Ž&Öw䑹Š=ïdü òÆ ùðhMÂAÉ9“†Fjئó ÝÐêZ‰2oclΊK­Q¶HÂß<›É ½,Î6’¼åãM\c¸âæC5!”€•¥:g¾äÒ3ëƒ ˆ~ów½|µ¾!¼Ú")ÄÀ½7Gɶ3Ûiî–!‰z¿ðÌìI ï)õ"Œm&X­îSŸÛzÙæVå¶)N8À"“œýCC”õ÷q1Ó3©W²Í8ÆÒnM~òJÛzáù¶+ÄN-'×O#š’líØT2)®@¨ÌÛxÄ5jÓ2läw2òι¥S*xß]›“lõM÷T*@øÌCßpyz2C¤ðZf ‚/qëL?š×âdµæw$EŒ£F¶ÊF° ”¼ ™m¬’Zhbå9K9@¶ ¥;ÏMPÒ÷hÖ·ä¢álóJ`lÃŒš=Í@Ýr¹PcƒÃØÆÃÈõ *÷Ê?4ÃÏÞki—*™qo*…R¯íHˆZf»šÎº }àöÅVÔ¸§u§<Öœ#ÙÍÝÓ(~'à(4ÛYØÝÈW)…„¿5Òš‚˜#ØfÑ¿¸[Uknm¨'5`E²ô¥®½B†µËýmIîóZøRÄïíóiD¿=7F±ÍÀF¶ãÜÍZl#8=Ë—áöúlSrï @‹Î¬«ªÔBEe—PÅ6ÌalC{#¶Q i±­¡Í¬ìºÎà—ËmLŒaP´ØÆë˜X‹m"ÉF§² Û\X>•1ѯŒ‹ï©3&Û$ÛלּNXà©o¸tÛÔÏ°0ºP¤b›$-¶ ×Å6]ÙvS—”idVUUU]׈¥É•lsg$ۈߘm,ˆd3‡iG7z›ÒBóxªVŒ` ÛT°M§šm¦¼!Û`ñ'ÿp¤ãôK²ÖkTºí“v lºDs\9Ä;Í#â±ìõØl£™““mŠºùc±Nï‹óÔÅÀlK^b„÷ ÉY"%ò¨º¸=­ÅEÅ ‹ŸmOô_Ü-)#)YïªgÇÀU=àuØ&öo{Öe6ÙtO¶@íÏËeXn·Â1Øæ.d:Î6ò1=ÛÖ9$bàÛêórÏm SHÇq¶Ù2Ñœ6¯Y}(ËEßbuÂsøµà@$‘í”Ö,Q^&çWæ×Jß ’ê) ¦ŽŸz¥]Uº¬µ¼¸´¾È;[w)Ó\>xßVÏrë£,’zÛ¸dal#»io°Xù/ÀS ¯Á6‰¯I±Nb©¡þ þ$â¤=J§åíÙF>{×^Ds˜’»Šá°´6UØÁr|Ò^@°ªÈóè`›çï˜m°ÌRON„‹ÛÑ Í )dy.KëÖéü ¼«,qûÃUæV1Êy¨ãKÝŒHs uï³Oݦ̃VÞv"ëÍ8^ÆfA©“>wûm… ½³¢¹ÎÚ©NA¤ì wžuB^åÛ™aIœ¦Ê[Ë:ÊrŸdru¬äÜnkj½D¥óOf¹2hRL&¦«×¶ºÍÍÖÝnTf‰Í6¥:ݯTԺ妕qÖáGÊùˆøeúãí“»u8¢ŽŒ'O*»D#å&Ü:͉é2«oLÛc' aÖž{2Œå-9ƒ*«\dfíUÐ&À²Ä/gQuŒÅ8›Š«Äå‡IÈëU­¬Zæµ$¶HÆôm„Z’WY–ñ(§ºïå‘”rNŠ[qÊ@œünØ[6КþäÉÈÔºÒ•¾iEfú{º9¯ÉÁ)ížã¾{1ÓwGÁ§Ãئë]væ¹"1\ó¶l#ôåŠ*¬³¶4· š³`F ƒíšœñÐ͖ζó=R4tkÛ,4nW¸}À´Ù3'{ShŒð•ç¸ª±¬úÆ ;ÑÒÎÓ×™E¤Û/‹}t­ÖïÈ»ne:~éí^NaÍ]_G;"íèË Zºx-ÄÅ&ï.™íçÆ`Ù̈œâ9‘ɶßp¥+˜ßáKv_˜¨a›Ä©_“f·àöË/™Ê$˜Ð]‚–ì”DZ ìhlÏɳ§‡Ø-l½VTJqߦk~uâìx Û<œñ51¢A4Lò§±Ð¨cÅWŒu/Yn]uÜÔ‚qò‘’Ñ.Î62²»PÖºRÙ bT,–ÙO9èªï¸_Í6Â}l<–¨ÙæîdSzÔ e·<=K3Õ[7j_زÙÎÔÈÀtK‰¢rÙ½}‹,-ˆS·^”âžàƒ9_[†Töâù¶ÆŶ–ÆT‡ QµYû ÌØ7žµ«Ùfó&=èÎ6Ñ é„ ¶Yúos_m¶ v#ù-ÞӘêhðÕäóx ò¶´SnN¶i¢³3L Û8®‰{¢˜—Ý™Î6˜8­Í€¿'ÿFʯ+/ÌLOÏÈÎoìÖ^Ý'm­-ËÎHKKÏ,©jRûܶ¢Ôì*ÍÐ%hÏÈ̪ïPº0²Á¦<¬¬œÖA™Â=h-ÎËÄŠÈ-lìR;ØüŽâÔ¬ Ó ìÌÊ̬iT,*äVdÃ"Jšá`/ï(ËÏxV<Ê·QF­ÕÅŠš7+âvV<}šQÕ'ê¨ÊÎ(í–‹ûKàÝÓ3 ÊêøÊö*ÛÖÝT•£hsiM«ä%Y ·ãX˜ÍŠûƒ£XZ¡—Cí%ϲÓ32òŠ*´W÷ û*‹Ÿe¤§ef?«mWMuHÏ ³ò+º49ž®’'™eÕzÄ®ºçY™¹Ïkë@díuå9°âééÏJ^ JT핉ʋ³òÊ:Õ…ˆ{JŸd>Dz.yaeVjnM¯înç6Æ7÷TU•g?I/i⾜ìÌÊ&¬Î= ÏÒòT´&mx^˜›_)Tݸ«$=»²YgÙâÁÖ#AVsuêZOyæÓ§y=JS–µÕfffV7÷ãKzÊžd+VÖa;Û+³3Ó³òËø i9BõtRMYvvæÂ4Vdgcn| 25£#RÕZÂ+ÎÏ,¬ìƼQ~_~Fêó6¡zXõµ”<ËÉÈÈÈÊÉÑÔ£Nâõ¾x:/xjã Ê¿c tü€ÑÖÖö}§µÚ:{\•°†û!Ë vë÷)4qó{÷ÛÝ?¡µ··‹D¢7¨WBpÈÊ~1ÊÛ¼c$ü€qëÖ­ïW>Ò¡ŽGieâQ)CX±²Ü`·~Ÿ Íi}˜V!%´›7o~/ÒˆïééyýúVgd•v ªùoÉ%éÐ`  _zá•ÉßÅb$ D/£ÝnžbcAT˜2x{ss¤õº€ÜR^âãÁ¶m`Ö, ìì@Px£˜á'À-XÂS† µÐcáótt“’À–-ÀÁüþ÷àƒÀ§Ÿ‚ŸÿÛÐþ[·Éo˜$¥RŒ=ÀãÒRpæ F,††˜è>úüêW#øÏ‚ÎΟÂ`„€ðššÓÜ f΀Fÿ÷#-bŒ?{{$@¥ ÷îÓ¦77 ¯>ÿüuøË_bÏ”jí ¼) cÿú¦ñ»ßO>þ3pr[·‚ÖÖ™óöžläßÿ~-~ø!øõ¯Áo~ƒÉ:<á¯\ÁÜ¡Žÿû[™ÂcêÔaæðÁ‡ŠíÁ¿þØl,E³|9ص \ºòò@GÇ̯V>ÝÝ"ç7W›÷^ꬓ[þ瀞ððóæ 0#MN••X ú# î§/Wð¯_ÖçàÏ€ÉÁ ½ÂàéSÉ|~ö3ð§?ÿû0¾ÆŸ€ ß`ia û]ç?¦<þï÷€ô°úüùsp÷î»l^…¢d˜O?>&Ÿ€?|V­2¹&ÔúQÇÚÐóñÿ“¡õ¯±?‹OÁ~妾ÛÐü×€½B—Ø¿´OÁ_>.¶àÜ9ÍDíßpÔ5ìꇢÁø¿‚}lT6b¥È¨œ:ùŽoš àÏ>ì/€Í¯±;~ó3 ÿ%ˆ9 †¸?V’¨©Ë–?ü£¶B1 oõ ˜1p¹ÈtÞX©h4¥±|ö)øò3Íø…™ç¯Þ§à¯‡ýhrãôð—ÿ„ÏKÑØ"h&ÔÏÁï>Ñ4ä¸þsðÙG€ð¹Rzðîpûw¿kVÿøtC ^^àËÿd•J@ý×ÇÀH_P£D1›âÔ)¥±üýïàI*°cƒ¿¨ŸaŠû9Ð%øæcð—ÏÀ¦ Xð.•ý•­¯KºN _|Œ~ lU„ óOÀ׿Á! ±ñ½T{h›ŠÂe¸f Ø´èÿ Lø¹ÒϱýLø Q£–€ŒLe²úkªÐc¹v ûƒo~Œ‰9i° ´ÏÀ·+:8qñ Â[¡ºZLõô`æðü905_~˜Ÿ+}ë/°‘š ]_cûüyš…"ß»âååÿIàoFŸæß sû?Ÿ}æÍÝݚɩ÷á"B7àŸþ„íÛ·‚_~ˆU‰ý…ÒÏ¡} ‡Q:d$õ¢¾ŽÙ67cbüË–aå¿úüá7X~-DDx{@†ùê+¥±ìÙ£Ù'x¸‚Œ>ÆŒEíê@·Áà#ðù€lÖ¯ wA]Ý.“€ÇJ•Uàò0.øæàO“±!˜­rf c6îÀrUú3ïÛ®!àüíoê! ¹T 6n’³Hàë_‹_ÉmÁ¬ÞøÁŸ~Xàè1™8ƒßó´w€Àî]Àì[ðgÈak£ðfM¾þøû€“§Æ®žò|™ ÖýÀ%ÂX€Fag§4–ñã‡é<ÔÙ)ß± üîSðÏO0%dkeu çÇk“OÁ_Á?þ B‚AʃWÅ[ÖóìY@¥‚| ÿÌ>ÁîÎRø]ê ‰ð ø㯀Ñ̈Çd¯¿!ûv•ÌÉÁV ã©›„uù<àyNNù¥K¢oð âý ‹MØ w‘ñ9–¾âøk+ðøñ‚¨Õ8 ìmÀ7†ŸÚ 'VQ1Öçàë±9µ•Ë±õT¯z’Kù;gIyyyQQþ–9úQ]„10s¦’mþøG, 1B—¨ïì¬Û¶CeȈßB·Anñ©óvTf-Ž‰æcÓXŸ|Øàjü¼0½r‹t +ò¢sª^`µu «{´3H>¶¦ºÛÏ©©Å>«ª@j*8 ÏÞ®À‘Lÿ>þüóC@þØ)Æ_5ÃÐ>Ãâo¬H l*(yþ:c1üäp8%%%¥¥¥<ï ÊêhtË|GWWWnnnD~~NiYCQæ,àâÆÿFCò§JGÑö @üü ÿc`M^Î`Æ4lqòã' ©ém¹Z 55 QñJhpŸlàW€¿}€M;â’„ÔGü÷s`üwà⠎ŽþHy¦££6ñÙ³g𶷪ªJ&C¿4‡ðr@Oàg?Ã,åãAZšö¡PÇ,L—òó¡J•¦¦vÞ¿/Ÿý\þÇ€ñÇJß›­žÆúÐ?Ç€ŸßbΆÑo€Þïñ_Ë#"G:ð°ÃRŽÆF`Ü@0v,ài (ÀÚPƃ?ÃÿÅÆ\ËÏë]Á'ŒÏ5>[Áop8þæà‹Á¸€}{1›Róä˜<°´îÐóçÏóa‹(((èT¤¡¾#áàW±ÙJ¶™4 ßÝßߟ§gÏ KJ 1BIHÛ³À‡€/Ñ.C–¢¥PzV¿”/€ÑgÀðKðïoƒæÏ+¢ÀæM öØ»8{öa„¼g/¶÷ìÝöÁCÁÆu`Ù"0o:03¾æÖÑ X¿U”ÿæÆàÓô¦p€ø[&9dd`¹8­(¿Ò-ìîî...V5NÉ6êÐá•CsLŒönH5juÂ5 nUVö ÎÎÁò$ŠÜB˜ý/–̱øP>Uø䪇­°#%}ŽýY}¬à°þ6¦Û)tÞZ±î·þ\µ^å×ÊÕ½(Jƒ–Hú›]šð `þW@±öÁ‘ÐÓûúM„c.ä™êêjeCT6‚›ÉÛŽÈׯkR7*“‹Åµµµê»¨ïÕÑÝ­L¹ÆÇË=<… Œÿô~‰9i–ŸbÔÊV´ Ç^‘놭þægà›Á7`iÓß‹?b´/åï€ðG@ü#0úŒÿ;žöíÏ°î€Ä‚KïH5ŸÃ€þçÀr< ÒÁ’% =ãMc^©T:88é÷ÜÔÄþô>Âæ80VQ‘š‚ÔÊýŸc…ÈŸaöò% ~ ~þçà×)AØ+/òža³'ÚKË^O±ÛÚÚ 9¨9S{îçóùok ½½ÆnnÖÙ ÅA@};\zpä=1Nq"hiÏK±Ùç% À¿þ HMþ&|¾ú|ý!æ"BÞÀ僳Î?\†6Šs ?ÿø“¿ñïÁø?`q(Ѭ]ù±• »|'vmmm…<3‚?áÔÓÓ#•JQ–áµpì˜ÒRþòmÆ•ÆS0W‡ÚV7 ÕÀÁN,Ѽ§Z^\nÜgÏ胘WO¢K `ET@øÿ ÿŒþ ÿªü$ ,¾tc`e `k vm±GÁù þèè|î”kÂFZZZFX‡ååå0Þy7äó±ûðÔ6:::JKKGû9•••˜ôFäc…B” Χπ=;701ö À"`2$~ _“¯€ÙW˜$MÿÌ¿äñ˜íÈ€I"Ÿ Žç.€KW†90¯ÍÏjIB¯O @ž-@È3õõõj^}›áN&h®¯ÒxQ]×Ù?M†ˆë' n«‡æáïÑUk´\¨ZÚ„£m;pȃŒcyÍ…Ú꽑övlšþAöhmSüµ*7°=ø¡ ‘èÖÈ×PfíÌL]]T]íjÇMeeežÞÍp ‹ T ðoÁØê¹Hnê\‡6 ô`Ì«¤-½‘èéÁ\ \hm¸Ü:T’„{â…Ÿ}}cYõ›Ž2d ï§=ШÑÞÞ. G“ü›’ v£ê”©þnDÑÚÖÆÂÜÌÎÝïXJÑÍ&ü1…û¶B†6‚Ktô¶,‰ ç¨ó9£#,vAý„®5TEh_#êö®<í> ¼t`Ýà}•im]”A ⾧g|Ö­S=žù)Ðõæsu!ç@©ãÓ’„¡+¬!lŽ\.çr[’ØozK$ГéììTG#ª‰±Uõ²‘wR+¹dhÃ46ÃqN¾fAÖ¼ÊÃÚÂ{QÍmýpR- ïÊÎÈ™Ë28ï¢HèQÀø7–¥K_©™Ð®ûúú Éäääèäµf¾xñ²Soo¯Î7íËßЫ‘õ…ÅB—†rÐWÁIF9é¬Å3øh;]]]|Õ Þ‹ñfdhü׿üG}kÝÈ9ê:k£°°úŠÐCƒr–H$ï•d¾'²ì,îéŒ:aGÃ~„Þ—TõNžw%C™ˆ“p|ß•ç<µfóÏý–P<€V/ïL£HÞršÌq"Эˆ&ìÝï¨ä´4,{óz¯7Wk4¨¥Ð–¡ÕŒ[F“ü„´•¶¡¡¡©© ÚÁ% H_ü(w‡àÈ -úQpȆÖ ogØO°ç^ØH65]´çâ£ÔÔ¤«æžËâRù÷85C$è4B¥±±666î潩 qbX`iÐíÎt¨ [%þ^ßJ-c§õö¶ SzPq?ÊÛü€ðÃgƒ#Ü)Zôü[ZZššš #M©²²¯¸—Í  9ÀÓð_’…Ä¢3eúöC°LÔ¿*d3ý¦Lý>ãs!ãH¡åßw®RgÓ ÷ööâ?— …¹ò9”!äsH#E @B†Ç…¬à ®çU¿ÇUyr¹L$IÕQ9æ¼—ø.OïF6ŽØæÈ`ï"m n®zþ¢K3¾‹r¢Æ™M*ìý74ÿût€{r‚è”5O5sR€“h7Átcn/²qÄ6?y.ÃÉæÒ4&5l-G,C‹ÌÞk%sÖM³¦3&¥6raä(ç5íðg±Ã«Åh}b›Ÿ¶×„“Mæée¦¦öç²ÛÑŠÖ÷N7 Õçl^F65¶°´461s ž-£ $1b›Ÿ>Ä)[ý ÍNõ!Yü‡èF‘½‘i–¡‡;04=HH¸—˜|áèºmý•ûɉ÷î?Êå¢ÅPoéÕÀ¤1óÝŒm§Ü(hï晄3:.ÑõMˆ–D ؆Ó~J­‰æ-Á9B'z-ªçJ,ÆmÑ8üÝÅ äÒÔ˜¹ìɹ]:dŽ$„€€ð® áÖͲ7§±}#f̈PaÊ”¹·êÐB" ¼[¶iŽ^·lÍêU+µ°,jub#b„wI½" ! üH!—Š/…P&r™ˆmÈßæB@$–ÉøâI`³Å’ïRU¹DȈ09©e¥ØËÄP€R]EÊ°KÄo~/¹âZ¬ãðbåð"!Þg"±¿¿L;N„uœü•§>þªS¡6B‘?»§bûµ¥ûÝÚûÆÂQ6ë ™VX,•ÿ”löÍ%ÿ c‡¾ž‘‰FÆا±1þ¡¡‰W± HrþUÏ­ ‹ÿÝïѕɦFì.øôxýUØô-—«¿CU›Î;6aZ§Bºž¿ö°\†ëFþ²¿é9f6¾äyŒõçÆ‹ß\Ù€”w|‰3)`K’‰èî±µlKSs¢…‘ÍÑoã™lxë¡ÊÛžLòþ´öW“ˆbLI8y²Iôª{Õ;9.z‚]$ì]ègB ¿÷ú5Ï?éö%eÕÀ{&q[É¡ÃñJ©rž»X¬~,û)±Í›KþB’Ú_KN­¥0X uÃvJò–#úu F\(׭úöuç¸Ø’"ÉUj }¶ÖÕᑧá7v‰Ö)/+vô^lLj]·¨Tڮ뵣+ñÊûbÞ†n$—&3æîLÄ¿È‹ÖŽ·ðÊiÒ!@x‰D:è¨3NŠ7Y&‹±íÖ”(súöÍø­on›I#[ËáÁ/¥ »ifn©¯Ö)¿6„âôŒ÷ò^Ä«ÂmŒð!{¯LÃvˆú–‡QíæޥäFÑ9=›¿ôŽ¯×ãÚõ÷chŒEø®ÁòIΔ©›žÊtÔM®S¯ÑŽ1ô ¯Ëë¶ô%µQÞ~¤þ¿Jò?ÈŠObl_#Í6eƒÂi·ãb?})¿™§‘¦l /åÖñؘ£ÇN%çÖèî/-¶Q”Øp1úÈ•Œå]ûk¯ž‰9zâÜõ‚†A…·Î¹·ÿr~¿JÖØ¿/ÒÎÅœM¸—Z׋ßD&è¿sáè¹k9bå)²âkÇ.<.RÞt 6éú¹Ø£1ÇNžTبì7A÷õó± Ϻ+3âÄ©íÆÆr~{åÍ 'Ž‰½vÿ™°ñîH¶ÁÐsãHLZ¿¯”Û}ó\ìÅ[Ï$ÊûJ .Ç^Î|1TqóÀ©û<¹(õÜ6ÍgJTttL)Údï‚^mÆL€§.æ6(Þîâ«Ϥâ¼üÐ…§ð2Î9räø™ë¥Ý/!"ÉópªÙ²+ø·¼˜U+Ž?ÔH¾õ>‹AY›‡Ù—¨iž ÃoÅ¡ŒáÝ –?=´gƒ`³î`̹äleÔ,hK½sY!À ieʾx9Ût×>»vîxLLLÜ™«9/:tR¥‚m6 qZüù˜£±§/%Ôj*.﫾wõìQxÇSž7¿¦ä/¥—iߢ9éøÒÙÁšï®#Go¿\Œm·¦sš /xqg?L=_*V֬⹩óãQáåÙÆ;p¬K^æ¶xé$¦mò l¬‘–ž%Séçóá»p"É1ªN¢JžjHñÌnånm¨·ËqrI¿òPÁ!}Jx‘ʯl£ÒF³ H;aê´&Ën/òX¾ÊÇÊ1­ÓIa,‘ju»\Ö†±Í⨆²Êmñ¾ Š¤ î«®*Ù¡»ÀŸmä·½dÛô?še¤g:ë¢ÒåV$ØÐ k.5ŽÊ° îŽðtð]Ù=< ” Vß»yýÂé#á> 7_èQ›ÊP’­>5®°}ìHJòâ¹¾G±ªç/¯õ&:Ì+Sq]ΡS–WAÿelsvÁvù)¸.mÚ—::URt>`l¾è\©’no"Ò¬.dõÈe¢}³í¨®+šT×äì 6 ùõÊ2N¿Bò7‹‡Ôú†·%åè "=ª_I¹²XŽÁϺ•ç\œIÕ÷9„©FýMkÒÒ“™*õoŒr7³[ñpTô4´Åv¼ßÉÕWᙽ«7ŸÁ¾6ÝYdbîqG¥gqL’Ùî¤VìâžB_&yòú[JÍ®:Ï4¥J­‚ΞLÛ*÷×»ê[Íj„ÊÑýÈšI·Ÿ¼VrŸžna6å*FPÖšÙžÎëÂ÷·?ÝÃ67ü©²Íx—'Š´Ö™C5!”€•à8·c¢±ãÎ$íëTKÊ¢#‰:#©GŠóL'X{¥Õ+÷Áæ O‹ñKÓ5î´óë[V|— ð ½™´y;ï(ædI ]¬'¯èÎ’x[3Û$…W?‹¾11;΋t RŸ¬àø*3°\äâºé”qÁWš4žÿ©ãxÂƧM@PêÅð~Œ¯2Å]Žfö›®ªÎ”s2OŒòm°ÍÖœËÖænÿ•pÚŽÔ‚Ãîäc©d9‡ÑÙa5rЪfA‰‹¶p÷=uÞf‚‰crm¿ò&¼æ铨^‹eÃÙ¦ïѬqæA¥¹ò´žt;kÊâ輑6Ëkž1‰æµ8qÄ„¯úÕÀ„H´d»M½˜×­•9èYÁœr¥bŒÌæ³”î'è»+ó6²¦¹ÔqÁך´œ»<7=RtV#àéf›ÄÙ#»ð§MB•ÕËdº’з1 ÍÖhý‰uì~£ŒWFv³]ÓeCìǶåvõ<{…ä«E#v/:Â’¦•·q¡…D]© .¿è7µª£ÐÅd+»´NÍ…)G£(¤Ð#ë-™dDðZSÁQÏËÉÁ&/ÚÝÂfõY­3Ûç²á/ˆå ééYkKÓÃ¥jæ’‰±T¡óÄ ‹©ûGØv‹5ÎòlFï#+&uYtªÚ»ºÐÕhâÈ´w—PÜ‚ª”×H¸­óÜÌ~ÂyM–ºžÔ€°¥ÓfTÛ‰îJxzºPLMÝ×ÒÁ6vT¯€Ùd!pÉ9±JÎ=U·ì-VNîª<Ü]L¾5X¥Pú̵Φ>Q½Bª²¥,ˆ)„×Èz+‚Ì–$@¹WO£Yß©à•ÇMòÙu†Â1K½Ù3na=ÅÍrÖ3Z›;¨•õ©‹ èO¾^„uXåW¦¨ZØ4Ë’s_c‰u7tDRСï,ô¶1_}*IE(Õîa° Ú+ Žƒü=‘n‘w1Fz9ÛŒ·ðÖd‰ù-3ýh^ F³Í·”ÙÍ* ôf:@¶9”3‚m¤}ÕaÎæþ;Êu§æ…=÷­"™ö%Ö©2ò#ÞzwfŽÝ÷ÃØF˜çej˜èªîY' }£ð«%@ ›mäCeÛ#ƒh¦ãHvÞQ›ÞyR,Ò•¸™%n:oaÉ„l#é:q‚ñ¦B¦Ëä/ÂÌõ¦Ýi}EcK~´5’mœ)S7k²ÄUWƒ'°V@¶¹ºn™FÓj¥»½ÝĈšØ3R²}µ—Mõ²0šÀv^·;îA^­âXë2‘¶ג’+ÍÜlâ¼0+¾»ŸfN¿Ù9²n=U7­õÍÕhF2Éà3oã Ò‡@ßc+eíÉbµÌF{OÜ)ÒÃÓ¼Ù¾³›…J-• û–…R~ÒlÃÎ60Lh™I4 >’$â ¨Àáp†øBlcÏ$Ùz>0ÓÔÜîlaNÞ½Õñ¶†f; ùƒš x…ºõ$ÚN ¯åöä\´"8ksÕÂÝà~à®Öl`ç{¦û’}e7 v9Ž÷8Z†­:ÙEÜÒ}æ*¶}+íÇ»î/Ö:UÊéçÊ_š%–÷uµ 4‰¤Ôã -½Š¥¯šÇÙ&¹^&lšÍïS­iEûEêxjlIÏëH~îB¶¡/V΢½œm*O­ 2m’kÄjåñyBÙ¨i@© »³S"S7Nv0Ò‡m kv9Ì’<눖äåPÿñuå\µ¡˜ny8 :(zvïÖÓšaGM/â’f” ê(qër‹ô<ÒÉ6Ð𬠰t¬èSÎûKkÂmŒþ›Ø&ʤþÑ&’u¶R}zsNÚÙOŒ{Ø<Æ ¸Œóbš ËuÊFlJJÂÙ6ÍéV¦Ò¿¬“-ÝW(ÈaQrkƒ1щa{®¼Wӥ헭¨lo;ë ý•Šx`Õ»àõ3Y%ªDêåÍ¡dºgºÒ%™ãFpœ\Ó/Æ+¯Å6 ül¡‘Ë-e¢[°-Ü^g–XácÑí¼ÙÌpÜ(Ý m‚×L·šs?YÃ6Â2&}ÖÖëJÓ.|—lÄ]KCìÜÂbÔ«-ŸíqÕ7uˆÍíÅ¿–^ߢ—Åa |í@¨‰ÉŠ‡õøÅçO®Ý8^E´Å·¶Tu¼w`&™â_§¼yÍÕT‡àœ¦¡—°MÕ&{Ñá‡êÒnï%æ6×d›Z —œZ@eùæ*“§‚ãá ®3›‡$¯!ù‘}uïÈLK‹°zåÌ¥n¶ÁTƒ“æfb°ñ’zjnç ;Û¹·F œóȃÀÞ÷XÝÞ†pGÏ-°=Ïö’õI[+“·Ce·\&Ún¿®Xʯ™fÃtœºnŸRMÛM0cžÌj’MS\¬\§×*²þ=¾t‹À•wéf¨¢ÜmFÆŒ-w«•)ôè’™Ém ­0·$ߪÎ6¹‹ÿaìU¨^KÌ­ p&x/Q ÜRÞÙmóD¿/'Ãfæš £}›®,{†é̽…ønÁ³cVææ‹O*&²;Ò{‘i,ßÀ k*Ë%èÄÃJÍb®î\/6ƒæ»¨‹'ÕZÅYÏÖÓo«Ô'ñ•ÕÓLŒ ãj4¯¯|ÕŒ@“:ÙÝÎÚÞ#èøãFuå}–¦ÈT™„ײ1ÂÕÒØÄÑÃÛÙÞfWôFŠ…Å–KUºÖÔõ­´š ?pJ©w³‹‚Œ-–]P¦DZ®ùIž§X#Ã;3ÇËÔœèààt2_ WþÓÈ%K½–˜ß<ÕÓÂyn<¬CÅ)÷¯˜kð})á_š‡7ŠÕ~ºÕ|Þ¾¬Qy ñí•¡ —)Õ\ÕÒiïÁe¡l²)Ì`Lt»©KâÔÓÏ’â]f¦Îpçnaþ“¸àúèõcÒ¡²™öD"ÛkÁžT†ê6GNfÑÈ~AÞNlº­ÛúØGXÕ†&»™¹F¥*²½‹ƒÌ‰Š5>;<ìhgÿ€W;*ÃÁg¿šPpÚëkÆZÍbÆ3†&¤#÷YŒžâeáþ,–uÐäÉ®6VÞ¡ç“¿¯”ü螪ytÒfF °Ca…‡­yðº'j1V\šôOò’nœÑs9±,XN“¬--œ—ås†-¦Ã7rÏ-wbZ0<ü&ZS<§Þ¬•ânô­ƒQÎL Wß@:5%ê„z6PXz)ÔÝÎŒlíâhC¤ÛÎßp÷{äÍ©s=l‡É¡LçÀ™Ée½ØºR¨$óÇ ÕU½¿ßi{«B=d·×1ÌM˜N^n­æìœÆd†ßù1/– z›š†DÃS¤‚îúÆ6¡TÕ2™¸½µ©­›«št÷uµ756466¶w÷Kt®½” Zš;û…ªGˆd}-õõ­}Ê…ý"ng[3¼¼±¹¥‡Ã×t6¶œ«>Ü–1cË]‰ÆWU " ­|U ý]°ÚýCÂa·óºÚZšš[û†„Ê••çɵ”IÂç´µ4544¶uõK¥‚榦ÞA‘\×zRNv_êb~_'¬ôO9)"j¯kêÂÈ‘ `‘ðè ËÜÖ7¶ $jJ:ÚšZ»0Š8mõÍ=ø)¯³¾±Só‘”ßÜÜØÕ/ᶵ2Žhns=¿MçÈ%žζ&LˆMí]ýb¹:_žåb¼´[•Kkʼê¿1^×,¸|°öccKg¿ruŒ :ZE6wõ ÉT½÷µvãËÛ¤ÝíMÍ\åÏéim†òihlníäëŒ×„Šöj31–>À«T‰«è2xö¾!‘ÊQ}µäG®Ë•‰ºZ1at á6,²£‡¯>O4Ø^ߤ\7‰}ƒ}xµ›[;†„’‘q”jÍ7§·³ÙÐÐÔÒ>Àk­î“ twàúßÖÕ§–¼2/ÀíoÅ.kjëìÉ5)™p¨£µŠ +§º©”u¯g@¨¾=¯¿µ¡Ee&2Qw;&œæ¶.TÞ×ÙÜÜ1ôSzøë{GÕ=2ûV#’Ä0c‚¸:—e½à”¼|Z[¡ÖüÚ¶4ʆ êÝÅ7Ö­¼^4öl8“AÉKÓ®ìX9ÃÚÒrÞùRqŒ¤aW¡/›¼øJãËDƒ“Ò‰ÙL‡·DZìo©éç‹‘<Ôö”tbUHHØî+Ù@÷clÿíÂ’åb‚Âfä·‹_vRGòf¯›:E2€ˆ€ðú¦… ËuC>òaÒ#! üW–ºýîá‰úÿ²Àîå«â~Øõ~'Õ–)’w(]õ `†Ý\þc•?Âj)è. `/¼‰­i ûï_çH%˜˜˜Ñbï e@ÒYäom~([þ#™¨hb~W×€ôíìd¨·[3ûü]qg ëk‡hÉص•ËzzDïn „d¨§ÃCAËe"žZh7¶Ú|k»Wð–õv]êo¦ohr)ý¨Ã߬vˆÞ°)·¯§Ÿûò†pÏÏ¡[Í>¨œà–‹ë3γ‰f®³wòT}o³!pOï†jÞ‘ÚH†z{xˆuI·aµ'sÊö;Š=‡¦9lü.ÜKÍËËN8¾Œd@\v§Ó»—ÍŸwÿøßžzÜÂrnûÛiÍJê½ÆÁW»c¶'q—£‘g¬dÌ{ÉDmS¨v9Üw&Ç ¬‚V\•¼áÈÑ’tÀœ¼_Þ¿ÛÅÔ-ú-Ù¦-÷ ´ýç³Jª{º«ŸÄ?ª½¡³×¸:GÄ u:ÌrÙ££ ôiÏküeœºCK§Ù9:ù°¾‹öód*Fؾ҃î¿âÿý{Ö¯§6¯FÚR{ïyçDˆ_F†H²œèùd¶;þ$^þ9–•ÕÞ[5j º°„iâ´_Lœ=ÉÀiÛÀËÍV,T„ŽxTÊ«[âÀ _}±g€#T.ð’ ù<üÀA.Oñ¦ö‘¡…˜Ë¹sh …µ¨Ž/„ŽÁÛàõÅ%“(;kXÃ¥Äç>¿Ç2§ž®æÃ~“‡•>ˆn  /5„ PAi21oh:‘Ëàò“òš×û8Lš}´‹3(ŽŒÍE}Å$ƒU©Cøž¶ä£v^KkCëœÙÞ l£vŠö›Y:$”v&6•PE\ÅÝÍÔ¼^L®¨®]\z‘ ÊdÊ6I!¬+•6Zmä"oPÕ_RÕ{JáÿPm¡ä$¢!¥ùªV7®tµ Y|ª{D«ÿë=)¿s‘ÁcCþ]Âí«}QÕË—«;òÎ7cÛm8ÑÕ¥¹QMWá/ïÅ5ç§zÚél[…l?iÿµÜÆ…/âç¹Q˜vÞ¾^,KªçŒ5ùí ' üà8ú¡½ûB‚ÃçÍŸëgoiíµ GñlIÙÁ™vv°k߀àí™@ÚwzëbGÙÙÓÇÅ–iï99î‘ê¬ÇôLH»vG‡‡GΟà@byDfôHùe)áþ–$š»_àìu†ÏŹ|ã}àîf_*É"pö'¿òæœII,G/²kÚúRå6µÙ&÷ôJW•iïêîȶ$Û/ˆNÆÜÁÔ3þ^v–– ¯À…¯b$h;²f®“êæíãhÍpô‹¸˜¥xRPÆ¿³Á݆lãäîéê@fÚÍ_ºG6‚ħæ»Ñè4¶K€ßä$Åu‰ûü¨4[WOG:Ù:|ÝùQ,U¼7ÜÖ–I¥°}ýƒv Ýßçjî{+:ÒÕÅÅÁšjF¶‰Ú}‹§zeÑ¥é^¶$+'X ™Èž¹í2TÚîÅÑ…n®.42ÉyRÿÊäô£Ž_±wâãuÕYϯÝv$nó§ZZø`/ë<º|– ‹æäîåbÇ$Ûzí8‡½ªåZ”'ƒA³²vôó ¾Ö2Ò‡(:àaì¶~Hù].èëSl÷¯uÆ6ø r<ØÂvu‚î\R_ùæ“™T’ÃD;2…¾øPƒb‰.àwY?׎N„jãæ`Ív ØuµPªxÈkQ€#òÎîeÓgGFFø;¬ÜÜʇ,¦69hxæ¤ڸz»ÙCµ^x0Yù즄»&Œ@ž}çЪ°é®+×]—²å@va‘;N³¶qöŸߎXFÓœ†}ò©æ—d†¥Í‹¬&L:V¢Ü#n_ägë~DÇ;,¹¹Þä°-×ðo'¦êYxgw °6ÜÁÊiÊÚ>¥ÛÒ²ÊÁÄrúY¬ôº8s‰¸]ù‘´}íÇ­Åø·¤#Øüø#-ù×ÖP̧Jð°@teyÙÎ#¿]1l4³ ’É“Ö«Þ‡Ö»Ìa‚ÝÅÛ [O“õí´ò†ç;±ÊkA-d}²R£…ÅAD’×ò8å@4BÒ›[62’ê¸jeJß Üß›„>ÞbKPq€ ï^ Š[]@!ÙÞxsïøLwŠ[XM¿ŒÛ”ëCÕ_rWù%¿ø “i{úiëHæW‡Ú2foº­¬tÛe–!òŒò™CõÉd½À£ó­7ö„‘YËñÒã÷xR,I³wáÏ…ÉW˜Ûøæ5+ªÈËò6µT=:*éxèk1!ô\ƒ¶ ð›³Î[™Q¯(/û°›žó~œmâ'›™SýWÞÅ%Ö¿‡J£]*S†í ËL­¦T@§QÚ:׃4ÿŒDGž·eÕrúá{£øc$ÛàÇ«’—›™„VèȘIÏo¥1ž)4@P“loEŽÜ‰½Å(ëÜ’™õÅ*åÓ!w7L&Z¹<®æ1gõL{ÃêÒ3å³»IsY&Þk8¸£©­6}IŽúfÓ)Ÿ†ë/»êDЛ߃{~[çO¤Ñè'Ó•/²y¸ÐÖÄ#ªz3’†'ÖÔW¤(»=MI‘úÄ™ÃÇ ¥€ø-»gÚSÝ—5a ;e¨tuË{z¤ó_sy‰Î¼]%Q½÷¯Ý,éõä)ž¾0 VàÚG zBï¦þ¸±/±Tù¬ŽL¼w%ð"NKZ/*ánwÕ·ß‘«åâ§9S=P<ÞtÞ‚Hßv=_õ+ òØålËI õn: Õæ~³Ž¼êjˆ¡{†H9ªÖ\ÙhIgÝ­Óœðäx¤Yù ³šmä¢ÁÎ.Ü”að$áõÖLc|~K“ {E è]é0Þ-ºRS/ÑJŸq®°WÿÔ•d²ð’æuXÜ!?`%¬ ±eÌÚx7Òôu>fN“«û¥Ê9wû,O¶ó¶Q9”k»&“Y˺•lãnN™öBÕ³ò‚-úD§¤2h)òÒ£ó ÖÎÙ]šk¯mŸB¶Šê%¨†ôsVf”KŠÇä³hئ1~Š¾ËÕ;i^\ÙjI±ŠËîV×…;Èù5Ïñ`Î;­#oÓvƒFdD'TŒrVF³ vFOU¢ƒ‰itÍÈbd–¹ÖãüN6ª†HqAò”\(aî6g=ëõO4CçÐ;#ÒúÛ…@ÂY=ƒm㱩_u¤?eÆ7äˆz<ìѨ™û­åäªA1Õ†;²¦.¿„ò6#PpÐu¼óNñèÜ°eMƒd5=Ÿ3Œ‰Êv†Z8–õŒ|«Ü½Ý‹hLç쑪óüöf¡+mµé(½akl¼šAÃqS¢õù´fÕ„ŠäÀZÀ)ÑH¶©63¶™¹fÕÊV®Y½À΂<ólº’m°—2Õ«-îøj{’Oœèl<±Lõr5éÝ]‹(4ú´Å«V(±rf¨7ÙÂ6¹odÞ¦1ót€=‹BU‚L0™z¹Œz!•¯©‘ý´Eê ¯^É6·\t3ã ýÈT ÕÎkõÞÓÏ›ûå£'~G² w°«MЂ¡Z¶âk«ÂéÞŃc²ÍnS׃š_«Øc@˜xKò‹.,›FfZÍŠR·wÅT?7*Õ%“óúl6ž¶°MÃÿõ+\è$2‰é¶ûd|G¨ú—² 7š@±¾Ñ3*2ÒÁ6ð^Kþ$ª^TòÈÞ” dº®/àRáŠ@#Ã9 5@ó^µ–ydSÿØÇ@ÆYÁ´ ¿®NÂsÓæ}k9¥š7‚m äÝȶŽ –­TªÅÊåA.öVŽ¡U|ÛDZ³&_R"ÌZ<Ž\6 Bló2dm¶3ð=(žé«z0ÝÖÈqÖÞZ>Í×Å„›Ûû—tŒ˜-‘Æï\@cºä ùð+Š°·&^ïÔ°MWy¼½‰þÖ2%Û\HÁ6§G±M©¿±‰÷ÒíÇU!6.îøÍü%Û˜q)oÎ6V«û´*O¥Û¬=§¹Á±cq±'*†4lEÔ™´™hDYzðZqUmsKkCU^c‚¶æy™ø¯Ù§]aXÞü§R€¬&7åtÌžÅ3‚†&³6–wKFÒÍ0¶Úàj²¨S¤a›[k"¨n¯bí9©ŠÝj¶95…jí¸åаú?~ºŽ÷l3Ž¹´[Ûü‚G·îß2+ØUo!|ó9ìEx/gΓ=Töµ¼ÑsºØ²Sûó@–aäµî‘lÓÿÔQÏxS±ÊÍÒ¬Ï)d`¼ ©N‹mÚÓL<?P²MÄ µÚ=ÔÅ6C»]ξ{Ǫu,.îÔ¹+°/”lv±Íú6»Äª®ÂŒ[ÎÔwZy[À¨ÄáË|YáñÕë^ƒ\ýnY±P ”ÊSÏX[š,’ªðÆìª>Kà¾Í«Ù¦g9k‚ωâá)Fu(øöl#+PT>©Ywî gHJG#|¬|¦7ªÜ^gŽÅxl#k‰¤Ž ¾Ò {~UmM vÔuçÒÆŒ¤$·ç{’½Ãñ70ÀO~ô¼@+§iuÂïÆ6²´³É¶.9]:fGt÷k±Í°,Šâgîò÷õX—_ôÉ{÷m¤¼êi¤oÃnuhÊPóDPrK<jª(+ô6²Xx)H_“m¤wxR|"‡tMÁ*}Ä6o’·Iœ£o9«IÝ%²¶m~÷ŧtÍqcAñµ…~LoÌâF舴êËœuLi8üò³¤í/îÝϼ˜¤àµ×Uº#:3ßÚÄ}+¦4uc±ÍÝÃÓ-I³ñŒ~âvoSë¹%ªNÖ&¯ZµãyïlÓ|Š4Áún«p4G g «½iUþ©ú„g¶o9›/Úl#?;Ë›á¡úmÎ¥•^d‚Qð)¬ŽÜ²ýæã3UFu~…‹ÅÄ¥/Ô//¿õÿíÝiWWàÿÓã a_EÙÔ"›¢TAP©‚ ‘m–$daÑ ¨H %*k‚HÁRÁ²‰ ˆÇ…Å%* ) ²„I' @j_ªïó1$Ã̽ïܹÛÜ{:³`xri´·êȱ‚W†ûèi4ƒ‘*m1QÚx²ã²å+õ|œfå!í\îV!&ûöùÒ‚OÝÖå\ãÈ:¶Yi£]2­™XõÃÕ ‚â.¬|¬ýŒ~CiCæ\k¥8)ýšá¦T7zçôÓ“Ti~¤„0~r½»Î¢³Ï×÷Û|BMcxÔôªt½Ä–JCØ|êØnu/þcuݵTœ}^ß:³XÚ Çú»Å¤V¬&﫾û½#ã0&EI•/NÃ7Å,&Ó?("Æ`odôÉ^*jF“üMIiµ}—cmmü"NŽrc;íM6 U÷Gz³Y^'2ð¬”x¶½w8_µ`©n£‹•ùž0ÚVVд`tFc¾n£ÿäÚQº Ý?úG r·¥û–õO¬“"?Û.´!/äàÉ|âé˜p±#5ÖÝÅ#²°é‰æCK µëθdaŬ†˜ÝäÌtö NËæ¥'ðt¦Åª5ÚyÕãgW/¿¤Ó–•ºÍÉÞѦ4Þôo p£»$&–uë¶Lº‰}Ï`°ö§rExj ËÑ.„ózÑÄó µ4“ÅdíÜÇ©i8h®´Ñ ó]>è`ç°c2›³Ý•f¿]><ûK²üëþÙÑÁÉ+(Œ“g§%zº±¼£8cºÍà¦ò"è®>‡âß\l²è§ßˆªëµÈp2ÚöÇDº³]¼ü¢÷ÅDGÅJ,—±Ïnsl¬£Ÿ˜ˆabú±ÜÅÁÑeÛ®'ïögÚÛ4(õFï{öx±]ýC²rDI1®tëÝH.0,—6kÂF5·tKîÈpÚwŠ‡§Gø²¬ìw7þElRÚhÕ9¡Þt7ÿÇãJÛÉçªó±ö¤†ï¿ùù6ÇCíB0jÏABÙQÏçóy<î8š•ÿlŽ{m dÒ8õfj>Ú¡Î_ ø8‚ ÊmÓk;‚ž·]Êãg#XÞÙ£7Ë{yhÇZ\Ôñbbåšæj1ÿâ=j93í§Ñª"!Šr˨ç”u²b.†b\¬®svµ¶ò¡ƒü¤u`ÌpÇ)ò¸Ew©l½*àa¢K¿ü½~A¾Ñû%g„Š™õ'¯ìm*ã‚ Ëz^®.a­í¿]Ux—ŠÌ·] 1CqaM‡îy§ì®#èRYI zêKù<¼àÊjv™öãHM™'O˜/ªl|hXgF=\ós1GQ /,S N™žB¢y÷§„ ˜øÞkªTÕ¥F8ÁìXQù ÖÇÆ <ÀÖ¹¢oL +4/ò¤#–š‹ŽÙ¹Òí»anõÝ Î£!ì°S²°\Ïÿ>Ïõ„»X%+Þ˜ûÚ¢êÑëXIû"”5àKš®H`¹'J,¼=ZÏ µ CÐ}=í)K•öõmÈuðåu„åȃõmøzüa¥o endstream endobj 901 0 obj << /Length 510 /Filter /FlateDecode >> stream xÚSÁr›0½ó:Š™x- Ä1¶™¤—¶!§43Q@Ž™r×㿯ÄÊŽÛ^zA»Ë[í¾Çƒ‘WÂÈMò¡JÖŸ³œ”Pæ"'Õ†dEJ*RH ²ÌHÕGz¿ÛÚÌ&]‰BӇɎÝìÛƦ+Îè¾ÛΚÉb’ž>Uwɧ*yK¸ŸÈ'…ð—K(XAê>y|b¤ñõ; +59,¨žÈ\û³#÷É·„Åmß¡3P B%*\&%¡x¸l}Û+I>:߃ÌÊ f*d\#©jöTŒN¶vCƒ±f;̘lÍ„ÁìðܤžªéºuíúØü|hçm;`’ÅZD®ý§Q?ã4ÿ1 ‚DžÑŠPfQñë0Y3Ú{@ëÛ`úb7n´Al­iÓN³j‹¯ÌBAsz^Èk3œñü•rEíxŒPÛuèú—ö<æÔn6µ¯ƒ™÷£…t%£·¬Ýq‡E—E6Ÿ]¸EGí„­­bŸ93æP*…Œ§­Û OêìÌur›¿TÜ™cçLüb^ ½™ëíÆû)v &ðnÆ #yû ‘¸à·‰>Rè£wï]øWIùÛ÷ߟl±"p.ºå•Í… _Ó,ŒžúÿèËòÍÂãx¯> stream xÚíXYÚ¶Ñ ;»û]»×~»³;fggœ1“šŽD  (*˜#ˆæˆ "Ý 09‚ˆ ’1¡  HR‚ÄÕç¯ê@Æ<~3û?÷¼#]ÝÕÕ]§ªî~Ï9Uuøµ¢P  è|\àÀøY8~úüÜE+„*ü/‡~&ìFz¯:ù8àøC±æLá0Ùéiw`†Ÿ׉sÂÒ‰è áYdôìÕéi0lƒ@À6° ÛØ€m`âg›9«³³2Ñ-Û ?kDdç©Ë"ÂÃÚsýúu¸¶A >®m†O˜?y’÷Êö,[¶ìÑ£GÐlƒ@üܶY¾|y~~>tÛ ° lƒ@À6¶A `Ø€m`¶° ÛÀ6l`¶mضA `Û ° lƒ@À6° lƒ@À6°ÍÿySâtæ&Kí"SýRË<¢tfG¥K’~ÌÄ®™Ô,J¡^T6ßÑÌÖv†6¡|RœÑú‰aê%´™M¹ÀŒŽËa¤1O¶ýÂÊMLÏ ÛÀ6¿èX¶ÉŸ­ó“þ¬þ¿3â>iëÐTõ1.Î&þS µûücȬ‘²0Å )Öÿ²œ/Ê"ªcœÖKX¶|ÚX¾Éô IDt#Ž÷ïo'ž”Ó¢èì·° ùjÑ~·‘Ž\ÝïõöÒëßwðˆ©Óƒ…éj)g#a9d†û½þÿµá¾Pùª—Gpûÿ` Ç|aú›³Xl›Ñ¾3‚“v).Ä6…m`›_j,\%àX¬¼Ù’xH-šÀa ¦D•©\ž<ˆËqwu3´pÞÈÌÆa0؈§7ó@MK´u»‹m¹ð|­˜~×Ë&ýL:ÕÑ6*,[½€ÏçÚNÙr“IT„‰U>¾c¹¬–¾WÅ}ÑDÀ±œàjf:jyHŠBõ¹tl;¹ßp Û÷2Dæí·JfÌ/àsö†m`›_mnhê/ô>y—ò²íËó8–ÍøaõæÕÁÐ ç¯ëqgz&VÖqÂÒ^Mv38®¡«]©$ôV±¹¶Í¬¡*¥tc&/ºqkû‡aó/ ³ZëkôlZ&`ëÎŒ¬TZ…ùü£LìçŸÙÃÕ±XzU&î`›K­o§+Vë‚–ñêO:,§a›Â6°Í¯Â6LjAW|¼8l[±0‡NãG³M'Ä…= óÆèN:ž¥–’øvšÁöòÃsȲÅvlé›2Ô™O·¶É WŽÐãzlJ%-¹Šª%',ñá®Ý¼ƒbÕ׸ùÜÖJ×aqº8‡š8¼÷à…ªÖ¤¶iùΔF7ýÁ#÷ìÂæ†m`›_mª6ؽ9%NüŸÌÜŽÈ"â+'pæÆ)èbÜv4B kº(¡5©X¹~!O0ÄoK!‡;ó`Iksn7¶ Ë”ÏqðÝÖ)›h:¼Ô4ÙÎÐÐc£0©m;º‹¯mîƒy¼bËR>ßqÍmu%«³mq¥Ê'y;›ZOÛž‚m ÛÀ6¿`ÛpÍçy²þÔÃõ§®9ty¤ƒ×Ì}Õ•Æ°L²d²9×i­(“ˆéb¼]io­k7?IÝf›ªˆH/mÅã 2z×δÖ&—îmÓ<ÅÎÐhÜQ§ú-¢¹®†<—5´mèŠÕl7Cï“»s™Ï^¸ijÈò ÊW¥C]Ù†þ2òiSF›X{&a›Â6°Í/Ö6« ù,óÁƒdnnneï6oÏúËuL˵Lsc®¹ý˜13–(c‘•…‰Épïí‰ uf’F‚ŽnãõçúÄqÛÅvcq&Y4ÖÐÀvù®Î¹MFÝXK©÷vz™â˜£–¾Õè3™Ïõ˜1o!×Ü;XÕ&Ó…m˜~yÙ¸qC [ŒvضùEפ,×Þ!»ï*#—Ð(UOôÚ]†\cGïy®^sTáî=Ñmê{¦*LÙZB›!ø´ˆß_0ÿÚ[ÙF”N‚ÂýXÍüâIëK©ÊSe.'2b»¯ˆÝ¡úMY:{ùh>w®û.ËnÅ-B §‹v¦çþ0£^Cf‰°¹aØæWÒJÜÚVœE¦ŽÒç9f·É@²©)v}Œ&]ÏV¶–¼«m˜¨u6ÀdÈÜÀ”v}R>sœù¦K/arËÐS. 3Ú$Eiµn潆,È¡+wíl£<Á&"³n²+_Ÿï¹6° lók³ s€_:f4@×ûX]x›$„ÖË:a_oðÒëêšTw¶18À9à䂧ý‚•trááçL# ]:rfØ`ÁÑÞkÎ :å³)ÜÍÉÄ€k5ýÀ‹ðL||'wnÛª™ÒH¾‹¼ Ü6Þflc¤«ï±åâ‚]1 BÎÎÝ tÊ70r˜{ø©gÃ6°Í/½•Ø²ƒmÄéÔBï¡›éAÉ”¨í©dW|Ö`S]÷w„­¶1ìl›AzÚ†NKxz&S/+3"eÅ'¥aþª+KCŸmd6t䢨ÀÛªÜI6s„×m§8‹tøÜàÃûù|þ¬½¥ÛO0áè«—L¿}°íè¥Ç‚RÔýòØ ° ló˽N*ƒi«ßQt®IíÎi=¸µ¯™Þis”×R¥ª{ÌUoo{)S»ÉeÞÞÊæ õ•ª "2™åìVΦ<—FyV*S«ÚÝùõ1[3­ÍÂÛ½¶mضA `ضA `Ø€mlƒ@À6° ÛÀ6lÛÀ6lÛ ° €mضA `Ø€mlƒ@À6° ÛØ€m`¶mØÀ6íBx‡œÜ}뺿øÓÄÕå»Ó',¹±0äúч,'~‘(tŽX4Wá#¾á/>µ@,œ#Îï÷e^=9ŸyLG¤¯øæâÐàÈl=ól‘H˜(Ê!¢ǘI:bËD)”Èÿ°H¹(Ññ|QŠ\´øóxV¨èJ(‹ˆf ™Éy"ŒùÛÀ6a·››þð¿Å|ë§\ËO5ÿú‘úì Ù—¿)ؼ÷Bžq-s8Ö!:.Bm§0]—2®Å%»Pgzò°ÞˆbŽåUƒáôc:é;KþòMÌ€!B'Ñ@GÑ„M¢GDdâ%ÒÁLFÝÝ–ˆL½EÚNLÆ‹’¤"®󸯭èècÑ]"ê=Œ™¤gNUˆ®×A5° ló¶‘T}×gÇ#’ý)â–ï¶çºF•?én/ø€åd‘]y„E\…ðF#ýL(½u.½d&›™IzÕâ*èM¡2<ÞµŸ(¤_!J–3kM¿ñb¥èâ &±¡'o623Ó3¤(oÕžPÏLÒ‰ªˆ®½b&%¢iÁ¢™1þm`ØæýmÓ{çÝOTk»=gs©¶àÅÚÁ÷?`QÙDd6Id8ácÌ ÓH¦Ç¼{#& ?°Dâ˜Õ¢˜À6° lóÿ—mrˆHßU4ÐI”ñ©l“IDË£E½¬D¹° lÛ|BÛ$–-Û—¸åZóG·0E²úðÍÕgª…oÌ4L½EÏö¹ 3˜ËÎkÏVFÞZzð^è{Øæv³^W»x‰®aeÑCåx4×ûﻜ$o7C ŽMó?X L‡mlóñl{šÇåÎÞWúñm“Xa7Lo¸oò›åp£A”ÐÐ^Dœ%÷aÀg™ õ Þ™öζ »Ãçrfí.îz†øJQð5:› =¸r ŽÅšË’ŸÕVM7saÛ¼…mT㾩ƃËav*qéb47Ú6<Þì}eáYÌœt„¥u'Ž¨†¨ ËR/-,£ Û¨ÇïÎÒ|Üí ;[–ݼζQÎÖ拉Î?ž,l7CÙw¯ÒžÕkd9œ¯^—¶¶iý”4Â|óÃh2¶‰åóx´mTĬWºf½èOœ(ú›¡ð.#–ý”«Ü6­J¥ÂrÉþ<õâ° €m^oú0§5Î[ì3Ș+àq-Ý|WƼêbøH¥mæî»;kÖxcC“!ns£+èC¸ýÁ«<Øo•O™áe*` Ìl½‚ît™Û“˼'ºœAvS—œzn?¼³m”‹Jnœ·t¡¹ [ÀØÍ ß%ß¡&µól¢¹±¡€m(à°û·Ëm&‹Òk¦NmdÈ1³º4®q¼§¹Å„s¡é¤³mæì{¼`Ñt#Ž‘éÐÉáEÌv§×KÝJl*ºGB¯gñì×^iêÛ¬YëȲ Dn]À6ocqjÍxgßÒs^XŠý 3ý&²¹.‰]æ6óÁ.ã×^º/aÖ‚Y<]ÎŒC¯:TšÂïºY±‡xmX~}Qð+£Ã\Oô lcEXJé([Ž©ãÜE{“Vì>7ÆÝÆØX·ƒm˜E¥¿œèbj<Âw~DâÊÈ+œwö&8¢m+qèíúõÇãlX}6ßZ{²0TY·RÙ澃‹‡«©‘Õ„ùá·–…u±±4³0°˜tE˜ÑÉ6\Λ‘cWŸ ×k悹|½™G¥Ì«ôœ›.0'êäжY§ÏÞ•mô‡À6° lóv5©äÆÕ®®:]©›;4éùpþw®â:qZçv¶c@|„²¢!¾]bkeh7uwhj»VÓÍf˜ºn¼.Så<˶l6zéÅÛÚæ6;¢Žñõ§ï­VU@v^NµôéœÛl YÃX.U7Ô„&dnÕlâÝ¡<<½ØΠ÷˜5áémû¤ü23£ž¡•B¥»„W¯Y°êÆ6l—µWÕõGáÕûƒôܲÕcŽ§){¦îÀ6° lóá¶aœ‘òtöâÎc½íGŽ·w÷0áô±ý…8½snÞ¯z‹8½ÑËqÈ ±+CSÚÖ¤d³'º;LÝ‘¤Ì1h)¥3­%jRkCƒ ¹¼%W”­Côl7ˆ[ëv² 5Þ4¾©ù”õQs·¦Ã'p·ƒ!ßeÖnñ·²M²¾¶!›=ï’º1Y˜Òàf§Óm¸3"ž(×K!¾™?ÄÂÀmi’P)OæÔbßÚ*° lÛ|„v››Eö¦l£¡ž3¶Ç­8tgå«C?8íèÒ6¼Ùûž«&ÅéÍS]­Ç,ÞÕÎ6’)ΦN³ƒ’U­©Š.û¤‚6 ¸ƒ–'¨[\•}Rúm“JÍ™5™oh8døk;G&ìlLͧíêtug›Dþ–Éâë-ýìÍ#ÝØ]ÛFÙJ¬^¯¶¶É&¢ñDÿ0V¶ÛÀ6° ló¡¶Ùrø‘îì³L¯ ýk.L*ÊýO׶ár§‰óĪÜ&­~œ­¥ÅøõíkRòÓF †ßž¨1y “Û„ev´Í:á.C.kA«¦nŠÙL‹â~ÇÓóÄiU3}Wøklù¶*ÛÜ19"—òßêé»ÊkõÉí©d´›åÔ[R#qBîx¿+NWi.d¨œâ¿Î'≺•øÈCæN8™Dsa̼­7¤° lÛ¼nÓþ൩µyIÑõU ÝœKü†+º;ó¶Ã7é°(æØÏîËìð––ª\Ë·UŸÝg?6`ïÙeG*ÔmÑIe¦?8l|Þ¡=Jغ.í&5g÷­ýÃTx·‹ùÕW.¬²Ó·Ú&‚mló_v 8Ë]¤ëò–×€ßw9‰®I™Ž˜¶åÔÂcãÆç˜y¯O~Ç;NŒ]+ú»q—wœ¦HvŸt¦ÏŸp$<¶°Í™mÜDÚÎoi›»#&‰sÈ‹-ÌÍLL÷^¿ñš¬m.ôæ ·~xªÈas%xçOI®qµ74·³âBêRtØÀ6ÿ%¶¡yÏ "×eo¼WpÛ«2ÅÌé…Ldvª½1èÊT¦úŽ¢n.>¥—,¾CÞÁ`° €m~ù¶Q5¤ätyìÿA” äË?ÿ²êûü‰Üªþì°ÞÄ}lE}lö3,ìÇ裞¼ÛϨ´?—~LGØ?MD÷‰02Sô½%ý’HÏÉOü3ÃÒÑ“æS˜±¢v\eÓϘz1OžD? e‚~@OÒOªf¾ÕÀ6°Í‡ôïìÊ"tMê“]‡ú8‹¢r¢@$¼%Ü“’NvfaôCf22+$“ìÌ%¢¹"Q¢0ê>Ó£”,íË '™t…^ë„QÄzfÑ©"õ ˜âÛ"ÑmQL)“ù\©frž°df ;z’~R˜ÈÌPÕÀ6° ÛÀ6l`¶mضA `ضA `Ø€mlƒ@À6° ÛÀ6lÛÀ6lóëÅiÜô×k·]©j«ô¿//¿@|Ê@™ÿ"èF½Õ¨Y°ÍÏÄî=û&OŸÝ6¦Ì˜cmë 01G|²à21·˜ BQüŸ›Ã[¶llóÉ8yòäZðiY³f á²!V¬XÛ|2¢££W`Øض¶° °Í/¨¨¨ °ÍÏGZZZ8@ƒX,nll„Ÿ…BBðkEAÿ'W(ÿ(˜ ÿ—*§˜ç™?ð±|#§Ó@)ä…T!'DBêIu=¡Ã5€‰L!#2B)(úq‘4ï|õ¥Æî.X‰’|´¬F‰Œ©7I_‘ÊÈÂí«ï_Z8̧Äum§º¢Ã6EŠ$–Ç®)˜¼0ß}~¡›OñØ¥…#Br–*è À»å/ eó¯ú M#°2±‘ËÏúä:/}ê¼ð‰ó²B§€àüÅMLå ¹ àSr9¥ 2¥9èl†ù_&'tZ#!rQá²ùOF,~躨x„¾cdÑÆI±ÊI¤EPðÆ̆ÑMSµ¼žRT«"cúš’fIÞg>…Ãý Ü}KíóVÊK("'tåJËÞ™&¹$ðÑ´ÄŠ‹ªIJÙX##$ôùâÅöKŠÜæ9^zÕHÕRäý¼\A8?SŶÃw®kµÏ`Ÿ]‰¹_'ËM¹~3%Wöš…?¿E¢ãˆŒzëϬº{!«¼ñEaÚ¥ø[¯¨O\Lï÷öÎÞº îÇÓéo^zÙ}r4šœ½š|9>%¿\òò^|ìÕ Ù­µ´45æJº´Í×Vý}öàú¥Ä‚Î/¯ÌŠ¹œÔø–gª¨÷ªè~úµËq—.]N»W¤ µµDAj¨Ÿ'Ãv<^ š¤è܆P§+B|òýŸ8û?s«<ŽÈ骖œ®l1m5ŠfˆæçÌ5e+G9gKßûí䊿õÁÔ⎿)%G½ú‹7,caï¹²á5Nˆq"Z:¤á­ *mh¯>~—ŸßÚ3…k0âìÕƒí#–†%¼wA¿¼¸ÎÖcGSçß7Ô†^äÏ3Þ(ÒG‹hý¸ÏÍÒõ^~q;@¿÷ „†ZåêóžÿäL®!·òÉMCØÎa ¾éúœé¹>k’¿õ¾CN¯t4âê™ZÙÚas¹úCghþ¨³MÒúݶNÕì<$ùÕ•yEnþOœüž9§¼ºÂ´ãP´nhåЕ,‰\Ùd1tý[Ùþ‡¢«EÑ]Ö¢y¾`„ŽåÃîòõR_SþM‹ô£³+Iû_%…¼~ÍD÷/ˆôÐÙcCs—?YªÅªlÓ¨èj ]¾ãÖÁ…[o—ª$c¯g]e í÷èΠ躔^_PA¼å{ow[¤Ý¿_õôµ-S­Gîèð5™–È7Ô†É_fv½:ʳíU "ÑÒ"7˜G¥)~¢‹´Å&›ÓæMm?UÑîIE‡­Ý¢õn¶2m+Žs¸¼›ô¯»ìD³‹¶>Syna¯þ†QiªÉÜ#«x<ÖÉÌên¾ìûüJ¨&ÿG®ë §4ËêèÉ{ ‹º.Ìw[XàœXvAïM/š†»>`Å·—LnÈÕ36úxFYË«OoîkkÌã˜Ù8‡žÍPeæµqÞ?YTW›³h¬—k`áè})ŸÙ¯kÒOš 6Ÿgà¾ý4ýLó³¤åÞ†|–ñ ›µ‡’ZRž»{ìúÚ[[ru’ƒ ‡m0|Ü‚œ 9%}9mÈ@€#àX¸O©–’'WÂlíÃÙÍTs©ç˜ÅôOëÍÕnÓ÷äO¿aŽ‹ÿý‰ì»Ó&·Ñ'Ï“ ûïÌK½‡ÇÍ­»lE±È<ÿûïÈ$U'ÙfU4—$DØ,MPVFòGsþíµ¿¤‹ OUU7Älö¶³êy*sΚê²Î¿$5±^ÿ1œ^-¯n»•k(¥m\"Šs϶æ±Yúî³7—*s²¦ß8£Jèܦè‹Ã9Ÿ^°¹§©€edjŸ¯ùèævÚü™aô£úçyÉw2$”F.ÏÏs¸Ü=W ”³5®³øÙòëx°4ËšWŒ]U0±º®ªFñb}ñ„yþEî—^‘) ¦w ‚y=²×ìXÚ3ƒ$&']8¸‰««¿õL]f)QË tÙAG/eeg&ƆÛë÷Éü¾5%ÎÈ5÷˜°$!ûQñ“{»f ã XÑHQMõ÷.¯bõ·8•ý°°¢¾áÙ¥aú}§n¾“™™r切 ÿ¸MÇUŸøèØH–Ùðéó6§?((ÎO_åÄ6Ÿ¨ ò²ÌH3=Nà±ËùÅt}½<û¢ŸÏìER…¼¡¦ABL5UUÕ"¶ÓVùœ„Ÿ&×®’]s˜CãÜ}m~G¾Ö%Α‹g‰Ù·äËÞ¤D)I2ùJ‹Œ[EââÉž Ì[üâ赯ªª¥W¶©¾F•Ñìf_¯k/;%6•›Æ˜Z_#1)ᜯƒ®ÍìýLþ_wÛßôª½ÉYÉ—;¹/xÙDuSP^ÍÔËqÆœ9ë"CwÈzºÒWsaR/ã™5„j·•éÜfóP¾Õ¨Ù ×^»œ|õˆ§ ¯ýº8¦ônøýÈSÒ,'e1.{¨ã”Ã×2ŠŠ‹®Go ÔÝ—­Z?iÌÚÙóE;%BÔ¹À)ú¶éªœJrtù䥇s?ôH¡d;J}Wæ}ÙüBütÕüÇ®ó TlRö…M> ݼŽ[‹ uÆìÐ$:M»x/:J‘æ¥ö?Y/IlIkﯧ7¦6üí9}zŸ­R¬üκ¾lÛ¬òFf? eõµÉTî±s tÇE´¶¤­è§ãüPY?||ÔÀ~ÖÉ2õªc¼{ ¦¾`ŽÜk:Ü)E*x]l¿»×È…»ÊÝJ¹;õÒ"“£4¶Ñ"‰uêÙÊ2“Ç3™Çóú“¿˜+/ÒU¦ºþÄ~‘v[«ìtWݱ‚Ø{õªJsOŒ7;WFÒ,û[ÐÜòÞ⽬þü£Y5uWP’Gî&ÜeaWUKŠ÷ëèr¶^ÍS—²[fF'…lûÜáCÝ·4vQ‘éx|j‘‘q­ 2ÿÐRÛfÁòãÖ’- #Z_’ë*ä1…ÿâ5Õè6ŸÅV¤mmSËå°—G%ª?¶æ¡ƒ¥þBQVÛšTëW«¾`ÏÓÓÑéoî0%±¼¥Vú1jR´ËåÔîÊ€GŸ/Ï.¾¸pä–§>„’Pô+D¢ (‚ºÓ¨Y>HÏuû™vwfÇÌvÐkéIËU”²ÏX—uæc›9ž%-ÈÛÖWß*åy}{ÛTøú™µ*úà¾ý‘{÷ï<¸gI_=‘²óáññ‘ý-­Ó,¡ùöì9ãK÷ÃnëÏÌ·l&›f›h$:ÚäK-2j¯Æ6?(»UkRÄ8ã™ …ö×Äl¡:ìo»w$î^fhb‘õJs35uëm¶þ¡mDõÄS§Ï¬Ø'*Ût]PílÓMA=¡ÈÓý:,“Ø»•ê–€êÔAƛ䶳ÍÈaVÿtyëŠúþMY“¢ÈÀ¯É¿uÈú dƒ2¶.`æß|mºo¡m,J²âéF3Û­ÄÃphV}í ãóL‹ð}7Þ™üê×Ù†®I9†H4_±eßhnk.wßµBu9Ôç;ZøíLêzËIËSoݺ|öÀT÷‰>ù¯>b4íEdåFÿ×ey£—ºÌz<ü¹ä1Eן2Õ©5HmÞDÅ,þ¸]1êÖ­–²jN¶éÝwó=YËU’m¦ßïà3¥m¸[w˜ƒÈº“mžyé4ÜqœÇHuŒ;j¤X™ÜÐ{T_ó•-]Ê£òím£dBòÙ_ÉŠPrõ:IO&ÿ¡m³Ocí6}ReL+D½võ¤×Ÿ‰Å$uk¥âmsI¸ÈÐdؽÒ¾e¸f‘…À% BÓ6È´Ìäüèqâ¡Ò¬)ÝáWìâ_8jþ“M7T?~-íÂÍ»õv×µZ­ÎZ›DóDZ¾›yéUË!™s§@Ûðò«·´MÝÚÁ}D]oë¶ò';²¥õ@BþÒÖ6ß’©f³?dæ ¹ÎÔ)ŒÿF \T·;z]‡\7dZË76N®è(e±«`ïö6ûYŽSßþK¯¿µmº/¨â·Ò[Ó+âô9ùZY“2üṿî]ï`fË_˜;d”ÿîŒUCÆ®=LØ­mS­Ç /®g;v­ªAìgµ ½}oFïÚr¸‰jù9¨Ybªïªì­øh]*2űÒ‹ŠÜ—Ž |:[Ò\§9jºéõý½£ûñÆe׫¬Ó2en›$0¤q‚âÐ|S–ýæÆ×DŒm„¬Þ–w” Š¡.Lgv6®ë5mNò—ÏŸV¼êæ$'-¢ YôM¦p¾™Í<ŽrcJ㦫䙺„T4½É6TUéÓòZIç$)+\<ææl=ýˆ±pj°`­§ã ©¢ê«­mÚlå³âUyÉó—ôìTÒ–ñýŒ†^ÏWo‰†‡'³Y«¥ª¶_MÙ³²ê¦µ”Š*ß² ØÝ÷±Eö«4TœÞJúÒÇÅÐÈ|ð,¿yãìúÌcŠ™úFý½“ÆzzÃÆLÞ²uƒ·£%ÇxÈÕÂZòZÛÆÛö:}»Nž¿3†HJ&Û Œ,m¬Y:{ì ÞÔÍgÞÛâɬ~ÛQ Wn¬lT^ÛknÌ=šÓÜÅ—výéù;2y.1ÿ‰ ^Fz­¿’Í{É GòE?Ò÷ bäB¼]™N¨o݉LÓdjõgòÙoˆ…éõ?Dë3r³®ó‚åMLúL?ô¼SãIŽa± 'Κ3~8߀½àø=UïêFïÁFfæ‹×nZå7ÑÌ ï„Me-ëÕuAUû[p9–vóçû¦?“ÊëŸu]PÝÚ†:¶|"ÇÈxÊÔI·è-RégÖÇ%ô^í)ÌÁ¼‚QG.qFzþƒÌÑ%ž®ÚìdÄ·¤ç—Än,5”iøú~ŒÆ½¯±Mí²!}·åt™ãôp bU‘g;ëèèð—“Ž¶i³•_H>Ð6Í"î _Uï|Õzw=¾‘¡ƒû8ï1ÃLz<ËYÅê}§i³më57>¸OJr¢4įÈeïË@å‰Âh~ga+™*ãî Ú¾e×î輚֋;/ïÛ»+0p«(òèƒrõ¾(+<½!èÈ«–T&lÞVÌüÞ1o¹{5*8hÛÞ8ev!«¼rb½Ø;w]¸×rÆà‹œƒ›…[~Œén Š®UÌ“/ Þºkß©z)©zœ¼-ó¹¬S+1ýÓUN¶,'3g‘í™~¥Ú²tÙ´¤†“%¡ô®M¶/'sæ’m‰BӦ½¸e±Ý‘—&…o ÙóTu±Dç‚bô’¸}×Ã2M2ÖX, Ùq-Ki¯º‚C¡Ûƒ‹é•¯?½sýÞ[e]m[ÕùÙÉ‚¹Äw)É©&Yadi”æ% ‰ßYd®/Ù±¡*Éœ$¯ËS‡›.í <·§óNtëðÖ ‡ªÕS²›»7o >Y¯y¹ñÁÑ »NªÒ‹Ö­,'¹×‚"“[NþSîhIÈ Îm >T+£H݃  à4eS³r_}±/lǹ[ª d‰{·í<•¢Y×æÄب]AAA;Äܬo]#Yìú©¶ëo~à¡"¥ä)•üx=mx¢ äDŽ+ À‡ö<„ÍôÑ5·"ý—%Öüê¾öƒø­ócž|X͇9­F¦hn 5Ì_QPØÀ‡É†jºw½ m~Ýy5¶Zöë»üçá³e ÒùÚíZiZc€×W¦:>j¹SêEÇÙà}u£¼fF!'2…T!iÛŠ#U)i ŸE?à£ä6 …œbî}®ÉÛv€Ë”œ¢CJáZ€"Ú6 )ÁÔ2×ÀH[êNil¢'›(†ü|$ÛÈä2…„Pr3oËóÌBézí 9J ðÁ5)å°.JÞÐ@QR…¼u;‰DÑ,m #¥Û>Špˆ¼¬¸Ärhí¸6¶!Šææ¦ûHý+…®|ÕÐH6n®ÕÒz*à3U*Íͺä6kiU¬Þ(…l‰—.î =~÷âÿGVV&S4+š Õþîu_ö,0Ðm£%ø 7l–jõlÔÒ’F’fðÚƒûj¿Ô’õÔ*f¢ð1ªRLµI–šVÛSKöÅO÷g9s‹-Yµ¹I#m-­ú•›qËÀGò_ùËÕ?üØð™–¼§VésTFbçôìQ®õ9©«UÈe((ÀÇÐ ßPÅã&SZtÕ©G›KimÉg_4öüMíÔÍ„RÈq×›O˜h¶{ð®oïpµ›Y]^TÄÞ¬jibì±S±‰¯kö/8C¶ì#Ò·ÞâŠò“»÷^/®{~÷Ò¡§_RŸ¸˜Þïí½¦ dW.gŠ¢râŸw¿@ªðÜ©{ ;}ÚØûc³Ššž'ØýTúAkÝüäbDÔåæ6_[õ÷Qʱƒg²;¼ìÙõˆC1u2ê]öê^òå#‡öºoD.£èoÛ`ï,í¡UÓó7ÒÏ{È¿ÔzòÿtbÃœñÛ¼ÝoeûŠ®”nÔ<ÿØ~à¼îòõR_³ùýúGr_’ö¿J yãZ¯‘§«‰"/ÔÙcss—»j±*Û4v¹†Š.ß‘txáöäç¤:ÅÚxrIWH{v^@×¥ôú‚Ú:œ·B=x“BÑõèúýª§/ošb=*¨Ã×dN5kWP›˜6_Žý8¢ôµg‹m:¿T™¶uAXSztîMÏÝ­RM>:³‰Ç38žö¢›/ûžªQžL,o¢×çâ…ƯzÐéMsϯ^hi‘ì,ŠP”‚¢d¸7úëU£¨zxÉg¤%‡5P`1"òF¾¦°d÷ãB\-¹l¶ž¡¹í–è[MÊó$kc=¿5›÷²4Ñw”%—Ë2:æl.sçôš´F\=€Íãè»m;EÏYwe¾‡5£Ç34_~©žR^n„M/—ðŠ¼sìŒ9z–n³Rž6QÒ—S,úó>W°Ûäj))ˆ²´{Èl¦šŸ{{Ð’¹±v̼ÃÊ{úS d‹73¤½¡¿ú'ÙyE½;3¶Ñ#ãHÿ?1/ýS@2^¶î²On£ÿ0Ï÷ü ¹¨|’OsºûBò,a·ÓÚ$¦ °ñ±‹ö×c÷<ë\VòÆÊÈ5“LØõ ø³6¬jR"µ…I‹' ã±u¸ÞÄ%¡…šÑaº,(F5Ž½y|6ŸÇâÊd~ì]ÍýÐu ss¶Íq1°øÆVÁqùôÓW§ëë± |Ö€aOè'ʧê}mÈŒƒÐ¶ üŽ=/[èôý0a_ÛÐïÍÅ̈ÍigÌGg鸾ÊÀhðTÿðGOK+ËmÉ5ñÚL'¢µyGéqvž¿]ZZA‹­òÞµK—$?•)¨æú&榲õ¯êÔ)÷Æ¡Dë·äl2ý›BN¬br"[c›ÏÉ_MÈ•T’v› ïM¾üž)sÆ+ÌlóÂIz¹I~£E¼ŽÑ諺fø¦úfånBIÊC–ûìI¬î”Ø<_êh4|ƺ̻÷ÜM^1Rß|‚ˆÉ²ª/Û³úyËË/xü }‡¹ÀyvE#ÕmA5RõE7F˜pçm9òôi ý¡¯º+¨¢H]{ˆË¼÷‹**ÊnZÃÓçœz(m¬( ˜jcí´,ïiI-Ó–òjÀÜí—J”YJ»‚’¿¬,ˆ¡s›{ÙeµåM¤æÎÁÞ–G«Ì+ªH¾zÎr„¨ÏÐ[ÑEŒmF»ˆÙS¯ÅVÜ+¨H¼pø{ãèí™Ñšj_É™q(Õí'Qk|¶ÆwÈøâÖ˜ |.¨ž¸K9ŽjB—ã­J7y­¼vuˆå<ÕÈ4{Çô8p¼f¬ÌÍCy<ç<Í5¹aÃûX®“´µMy,m›UÇ’Õ[›ç`©¿@˜Ù¶&ÕúÕªÎ[ëöë×÷'3û)·_´ÔJ?NMJ.—3£}¿j.àð%=µšzö|ÕCòÙWe_C/ºY¦(Tþ@7ÝQío¦ç¾ãŒºâßRNÒ,Çþ½–§IZö¨â”Hc]ýS•Ê‘y9ã[G{ee³ê42oùl~‹) ÃBƒCB‚BB‚Cƒ–÷Ó y,'mF(S-áGæU}ËWdá(òÝ·ä›oÈßÿN>Ó"£÷jló#y%Ó(ª˜±Í†‹ô2ð51ó$T‡}ámwŒ›Ë M,³_©J©å]uk† †/¶YRáÝ>3”ƒ‰4uWPílÓMAåËÉÓý:,“Ø»•êñ°ÞgdÞ6¶QP÷—,ΨmR—z’Ö˜Ú6tMÊó¥ùªwWŽÙe±ÿ-›;é74=M±ækbêyE£ ‡ßm|5mˆá)¦ ›ã¤-ˆ}RC^?2ïˆ]ÍG+÷¥F¯ãF^+T—C}¾c#ó¶¡öÉ£¼Œ›ç掴î2þ~õûöüu“Þв‘ådW÷Ô’öü\ÞS«ò’õü¬–ÞÇrS$ ™œRÈ0îË먘-ÐC:p2´wßMwe-{TIz”™~¿ƒÏÞrðg^¬CFzúùÌö™;KsæÍ™}8_m›œ·ïÈW?‘ Ã$9•<Ì%?´\»MŸT#¢zíêI¯¿‹IêæÅ;Ûæ’h‘¡ÉÐ{ ö¨Yl!p ˆP—ž²½`çDZÇóÈÛŽÞMA(mó¡ã€·³M¶ß‚0#ßW-=†eiaÚئMŸÔ;ÙFY»(›2”·x_žôA Àm¥‚È·N·ð:TJ¥®ÕµYªlÈúYÇW(:=”Üuâ±î¿ñ1,£Îæ(Š)¡3cÉgZTÏK?ëÙ°#¨ás-iÏ~ß—.FåMo¤pJ÷4‡:èZ®8¬irWÖþ™ñ Ç|7-®¦¥¸%ìàk_«KÛ4lÒ×açõ.?òƒm“Éd,G[zêÉŸÚÚ柤ºeä {ÊaÁ˜ay;!úNÌ×Zo¸F½ý_nÔ:¾±ÑíòV)+3É¹ÛZ ¤Ètè3`eÂÓ·¶M÷Uü‘mó8`™ˆïU]¯ Iš}%¬ßÐafqWü¬Ü‹S– ž°þ=™4ÝjlÐù;ÏM òsÛ†Þ¾Wön^º1¢‘jù9¨^dªïºýôÇêø–2­2”´¼ìU-¹ÖçM¿ùRrêdý¼¦ß~!ýüóæ¯~×x#A&—Sh%~-…Ñû¸ÞVwH¾ô±Ñ:c;½§O35v]§XV>]`à,}í8àÔ!ë'‹Tå^›³g¬¶áø,Íû_܉\¼aÃm£ÍÞ{G­i}ÕãÇk›;o>¥CöiºÂ§2“{˜Ç±ÎÌãõ·Õ/Å-"Z_’›Êõø¢õ'’©ùBƒ¿!¿7%ÒÎÝÁ’âü¼ç5²;õ伉kU´º«%óÈ‚Þ?˜%IHå¹YýuínTjÚ“¢ýr­ÒË_k›Ç´m–ˆÕí69{»)¨îm³ÍÇÎÆe­Æ²ç‹«šß`¢h8ô“ëƒ\õèç÷Vøˆz¿«mäeOòŠ_4u~A–±ÖÈqäôAìmg™Z¤4c—ÀÌz´½ÉŒ=ùê,°­mÚlå³¢ªøqAicù^}xCÎkzÀ«3™qXëOªºÏ¨ŠÂ¼ÂŠ÷?aˆVˆ”þm’(^$$È´´¤_~‘od@%rJ^Ö_GþÙçR­žu~¾t6ãÊ…×£BþjÉXs‘`⴩Ζúl=›+Ê#¤ùq¬×ÀÂi̪ÕËF[™ðÛ%•Ö“×Ú†4¥:³úÙŽ™±õ4‘WÎq$05›½p‰—³!ßÀ'äârR2“7má8sa@EƒâÉÕ#®^TvéÜÐâù=c•‘^„û2tÙ4€hý‘¬%ÇÉ—‰î—Dך¸Û0Õ¨>™Ú“ê]Îß2ï☑¿j­ß“ iWÝÜù¼ÿL:ÐÅ™·÷÷ysXºVî½]ÍÙü•±ªãH4k¨¡!ŽÿÊEÓG ˜|CÞ²^]Tíª¡–™ÕôSSŸJ¨¦òÙ]TW¶ÙÄ؆:µz ÇP0vìèÐúð­œcø‡w_oe¼º>È"ä{×s¾g,ìON\+îÿ®5©ÚÅfÿ¶%«‹ª)˜ÈíÇç°/ªOî¹ç®£ÍÒ6<£ùú­¶i»•%h›æ]z†³ÂUYâŽñ<>ÏÀr¸ÓhG3WÏÔvÓ"®ìJÛ0¤—ùÊ„÷>L˜>Eš/¯Ý¤mÃ\C$¤4È>x¡¥%û¬gIϤ¬Š´ź®”YMÊ•sG<~6¾¸¾¥š@µ…WÎ;tèàɘËEUêcS^šyäRëïDuƨÓeõêÊKAZüÑèÃç“”iË«ï\=u0úèñÛ9Å-‹­y|áÀÉä–ŒY`t¼òcI}qʉ#‡ŽŸ¿Þ(#µOï;r8ï…¼S+1½—U‘ƒb²y ‰Š#ôëõ%D´ƒì?Oî!¡'˜ºU”˜nc^%š6eƒ49˜n%¡‘¤øU‡ ¿ JV³g†í¤#]v€>ÍM<}èð‘É÷žµöw(³n^<u ú艔e-‹í¾ õ"÷Ì‘ƒÑÇΖ«Î­é\PŒŠ:^ôR#ÛæòÇ¢Ó)sÐÆ’¸‡:’]F—bcÂÑ}ç²^v¹uŸÜωŒyÕÜÒÓPx*&kÏ©¼kyÔ‹ìðÃ?§õU|á܃KÅ-eñ29.û䃮š;¥±§9î¼×åN”}ñà‘h¦ Nu©Ì³i㸹èrä±kªF£Ö­,'ùi§¢cî¶|³oœH¢ËH^r3òH\=]óm(î˜ô×3?+µNþë2éinRU³ì½¿6Ó­MÉé½BÊø†ÖN3Ä‚\"¡™fJÑXWöùÿH?û¬æÛ¿R5µ8ˆZ蔕¾†¬µŽÚLŽ²{=ôZ—uIÐ9¹‘)‡­S(/…’È¥L?·B.cž’Ôɤ´}k64jiUþû;Yc €.ÅÙ¼ ”ªáNÙ(C1Òa&˜ELŽÃ”aÕó‚?ü¹~ÞL)¡P‘¼ojÓöêd%…ú”?ÍKRJN=yBIë0æàç­¥jtô¡7µàÃÿX‹€ endstream endobj 897 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 321 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 13316 /Filter /FlateDecode >> stream xÚíÝ\Y¢.pÆqvöÞÝ}»7½Þ{÷î̘%ÓMr*H0"&sÂ1`ÅŠ (#æ¬c$'ÉQQI$w¨óªºl‚3ÎŽîŒúýçü˜²ºBWuÕ×眪î&þ~hš–ÒtVN. Êo´dçÔ7¼bTœ­Ÿ·Kœ<£ ü6ËäµAfÖv8O? +Öl¢² Êo³D÷å8O‘6((H@Ú  miƒ‚‚´AÚ  üÓfêœÅ"‘¨YIgg'®R!mPPÞo9ZD ¬|||¼•ìß¿g.Ò彧¾¥ý®]»¼”øùùáÌEÚ  | ´Ù¦iƒ´AAAÚÒiH¤ ÒiH¤ mPP6€´AAÚÒiƒ´AAAÚÒiH›ß~ É&‘e$²ôM Ï#!Y´ìQ:$‹-!‘Åìvd.‰*#¡ÙtÏììHf‚£…„²Œ„çöΫT˜19$¢˜]xT)ûqfvFåçE‡‘ÈÙZzÆ„æ³÷>«ˆÙr6H¤ÍG[Â3Òø£¿áh«éê¨éjÑTS·sßw ]/„Êi3æ Ó4YRÄNxó.GmÄÆ+-”,p˜dÍm6çã²?çh^½Ùð¿Î:ÛÙ?ͲèˆüΕ[¶šhiŒùNsä7Fãf. Ì/ ½VD¦Z ×äZùçª'ʶúmÕÖ%VZêcÌ<–çžfH@Ú|i“¡7Fc»¼Ôì:[¡ÍÒhæ¼f=¶Š?)h¢ÙÈ…gºäU‹+¦ql·*ê?ôš悉~Á$,§ÁJCÍí|Wߨ!Luhîd=s×—šäµ”Gü t‡OÙ›ª¨ù‹G9fK<¦h8Ôõλíð.w¶âTB¢ŠÉÖCþƺc&û…d“¤ ÒióѦ͖¤7ùp`¿§†¡'ÅTf²:õuÝ£_z®p³v Ïa -$VêÓv³YqäNŠÇñŽíf‚hдa˵PžšÖÖø7uf!¾þÞZºNóeq”MæÏrtXwÅ7Ò_ßhNp›?Š´±ž«Üâ;pæ„@È?˜*¡²i¤ Òió ¤ÏÎEZ™ÖÍ‘Ø\!Og_2úÃ9mm»ùŠþ– sa:ê»3ÅNz‡‡æ°Qð–´¡7{˜q#ÔÚMÛ¶zn¡öÝì3R¶•ÿÊ‚ûݪk4•üÏáïHÉäÚ0A—ö€ËYqíu(ê6H¤ÍÇÜ’b›9%äðµd+#õÉ;ÂòÉVO3¡ËÅVHfMå¸ç©¬1ESydù²ézÆBC· ,Eçí[ÒFºÐÑØxõˆ¼¾+-MÖÿ«óA¶Ý´ßÇMÛzwHÛæZ3—g´,-4wº SB³šm8Z³b6H¤ÍGš6†:j|]mSx:†s}îå’ÐÔ'†Ú.Ý{léÞ®nS lÜÝ,L»))[ ¦±àò›å¼­n³n¦1æ©ð‚~ß²Û8Në¯.ǺC²¤Ìõ¬ç{/g×½hþŽÁþ´ÁÒ&‹M¯1äê,»Šº Òió1×m2ÉÑbY)"ò–ÑÞˆ@ž¥Ë’MÓ3e㌥«õ9ÂÍɽs•ŒÕôŒûÉ´!Ñ^ kŸŒ>ý6Á¢µ5Ìv1 Iú\Á”%[dkÙä²d£©³èÄ3æ9 ì·9|é:_Àß—"Æ5)¤ Òæè·‘WHB É<ûÑVkò{;[BóɪÙC·;òKBoM› ¢0¦^$/9²FVq°åÚxIËÇ&×9Œã_v4<¬wÓã»^ UjgíZkDZ¤ iÚ³´À¸ûözߙϻ€kRH¤Í'”6„º~YKÓÄ;«ÏM€/^…‡Òè·Õm¬5U…¦–fVÖf–²â° $— œ°Ì*{+]_GÏÈÔHŸÃ Ø,8Få“”çwÍõ嵄f–ißp“I›Ý|!ßj‚£ÕC}ž€§e9/Lq¯ Òiƒ´ùKV—ߪÀÌ>#ƒ’›öß©ïsjg‘LÑþ[/‚2¤²Š˜¹Žô™Kràf•ß­û{ËíÚž ¡²Ä‡ãêdVJl“·§B2:˜É‚™U(­…ù{ðv•ª((¥éÍ¢n½<œÔNå¼¹Ùiƒ´AÚ   miƒ‚´¤ Òiƒ‚‚´¤ Òg.ÒiH¤ mPP6H¤ mP6€´AAAÚÒiŸiÚdÑE$°ð– ‚_g»Ø¿E²"ûF>ªP6œ'{H>,ÿé–|Ùp¡lš¼žYÎÞ;Üov¤ mÞ­„fHšþgdíXÝVxl]Cr~­»SO ·¦¾³¤¼/SÉ”š#õ­åA•Š?“fE™. Š 5Ç—Ï™NÝSk¢¨o-©6ì4ת³§R·ë©ÑØá½×©2Bi8±ÃöëÙ¤BÚÒæÝʵ€[åÖÓ™4ø@% ”ÔÐ ,ü5¶.©2[DyPÙTz7e·–2p£ün³5“Ù>”‘;µè[?Ùz†?y+•)¡(CwÊr);Mle²€2ö Î”S ¯)Û•ìdYl­fÒVÊpµöå¸:QŒ´¤Í»¦Õ´·ü#Å¿^Ú¬Ž¢6ÆP½í¸YÉVü€¦¢È›B½eÿÔxåÙ™V•†3åwiH›Ï=mx3(©l[é-Ÿ œ±Ô¤ m>û´΢„³©¢¹ ¦µ•!AÚÒæ³N¦½SBØòA/)§â[6€´yÿi“ÙÜò±Ôm.<¡Î?¦½–% Hn þyAÄNœÞÉ̘.Q´¤4œ~ºß&KÜþc;-s ‚ÓÛRE!HølÓæbˆovPÑG’6‚™ìuíAûmRžñy\ïøΟSY"¡ù]ãÌtŒÍ'xøWö¤óOöÛ„Ý:§Éqðÿ‘kåWO«jŽï³‹rÉÖͦ¼ÉW~;6H›¿CÚÈ®¶-QüT.û[rYýÒ†ÒàÏ *!GKÙiÂóÞü0œr ¢˜}ô(J´RÚÐ̹UFB³iùdÌŠ" K‘­º÷Qæ=YEÄ›å÷LŸ/ûíÙoE1ËÇ+fÏíÃÎÉ,J03D×¥·ß†™&4_±iaiLÚèHÅæG•²¿¦Ç.'«Ïv/­3ÖëC"‹zö̹ŠÄVfÕ‘²–Ën»ìI*¥ÍíóšÇ€ÅŽ•oBŸ•æ’ãåìÎï­É°? ZDŽ•þ&îDÚ m>DÚ0'ãšÍžúºš&æfº\×}ÙayýÓFSßmõæEƦÆ<µ¶sùçôýA·<²#à ‰PÍÀHÈ7qð<]ÍDSoÝ&,µÌDkø‚ã¯ØŸSÉymÆý«{XśߺMȪ^s±ýI—Ôgú߬8[úæ”.r54t‹+`QnãÊ |û}J'uÐí®ªÆÖ›ÌìA±…|µá»Cr¨Seò–{úçŠçÌÄãñÍ­m&¯ âóû¤<¯Vym5ÐÓ5µ4,݃RJ[rïÕ8{[¡®–™íLß ÅŒáY¡)í«×/âkŒ6µ°š°8ÆÞ^ËÕ§´OÝæöy-Þ”M¶šš›ñT¿5›äu°ß¯à]=5FݶÝf“±®óeÔmàSM›ðø»–®»²ÙwöÈôT}Õ±^‰ýÓFG}´ãÎüÈbUÜfc2fΡÒPå¶ÆÍ«\UíÉì!µWKk²ÒÝ}Ì)¿?ÑdCžs@Y˜¼a•<°ßF<ÅTOÀ×ð…¯«51àaXÎÛÓ†);/¯tn1ï€b“s‰ÓDAÒ†ãèß›6Sù.Þ¹HøÌ[R+Í4v;QÀ¾k‡å×›r‡ ’6Z{> 0ßu’ç÷}ë6žzÓ6ËÞèÙºMX> ì“6l移³Öøuuy¾I⾉A‡“é6c&¯ämú×mØ>[ßÃ;„W-˜ÉŸ°µh`1 w0éºþŽá´`æìIc?P©xz7žõÞ|yÝ&(®|`ÝfÑD¡åÎÌHY¿S åýäô[Ó†y¨”lØäi4k³Bdu{‹1H@ÚüdÚ¬^<Ó`Öcel hÙ|'wÔšKtX¶Ò)‰ÒQ3=àùÑBY"g6vîáûÊý6Ôõ UáúÛì!t6Ts¤ÑÎ"R7\cAl¬¼mµcßV¡íŠÐBâí=WÏnw`^ÏåÙ£Ö{NÛ^B6­s6š¬tQŒí·Éybª£±êb{Plž@‹»=‰Σo”M#Ë„UK&›ºGF”0¶æs£CJIˆÒÝ}¾»§p –)`¯vmß³t`¿M@´7W×Á÷‰($áÙõÓçíï¢~¼%¥9ÉßÝIS×a>;×ÐQH@ÚüTKŠK³1ÖZ:XØظEÔººXðøfëî(Ýrvúªp®çê™ìõµGZÍØïŸÛ÷*yñòÛiÈkhbÀ3°Yr¼2¸”¼6Ze¤!±)úª«¯É.açÐö¦ªS÷¤‡öT‚~¸ÎÓÔõº#ëó¹×bÁ9—zšÓÛJϯ9nc[qÊ%{÷-Ö2XàSJˆ ‰ºËNàñ4GÛhO¢¬9–òܘ3êwûðÂÞkRíÓ¦ŽÓÕåšš;- àiªîˆíèwMjéZO=ÇÌÖV¨Ë™´êlpvßkÙÙz£¾Û’¨”6êNaþ·y8qÕ5¬ìÇ-ˆ™èÄëŸ6·NU³éM›IŽêS·g‡ö½&5VcÒ>«º {›[iQÜ*V »‡$‡V¾3„yTqON {{É[ï·)ys¿Mõ°Ñ_øü98K"¿/¥·²^D˜:Ò›ûmòd Wü“„“£ýï· —¯Qvs3q@9›6ÇoÉFæ÷™©áP‚™!ÊŸÊ”ßoS¢¸•h°ŠØÅ*ž|1 Íî»uì}>l½(T¹²7uuÁÜ}ÔüCö ¯2¥áñwxc4—]ê Δœ<ÂSÕÛ‘F~é'rɪ9Ct|N 6AÚÈ*KŠïýpß8aèF§ù»emÂåq5ô­gy]kú¥ß¦XHæÚÖåYïJ¦‘6€´ù8ê6.»(×=Ô‡ûVdŧ2oS²«oá$<Ÿ váþç¶=+[ZßN mióNÞ Jkò‡ý6-³ETx&¾q6ï˜6l\‚òÉ*þ~½´qÚÄ~Ûðµ*êôêÎ+ÙÕŸçì°üã 7kÙo§¹XɆFb+;þ\ûÕX)ÔÙrö¡ônö!f$óP\Û"»TÉߪcÇ3 9#Î÷ ÒæÊe*¡óÏÿòBÛè•*ŽiÓŸÿ8äWé·É%ÔB}cIG[ÅFg;lä®øÙfø všuÑìð[êò3j×ej¸ ;œJ•ÙO0ØR.ÞÔ=¥îÄNfµœºOØZ3<ÌúÃ~7 Ò>¡´a?͔ԑü˺«·ÿÑûרÛÈKr•ÜN¥u³Ã©ìpªìž½´.v8EvËÍ=1;Ì&£˜ê|8S*›]6œ.bJQ^”ÒìH@Úü6Êê[I¿fÚ  miƒ´AÚÒiƒ‚´AÚ m6H@Ú m6€´AÚ  miƒ´AÚÒiƒ‚´AÚ m6H@Ú m6€´AÚ  m>ó´Y»9¢ô)EìKüÉ”õñÿ¸ë/Ìv½÷%?cÒ†>™ðIí®ßZùþ!1°r@Ú|N97ÃcEoqõX1~ò,ˉŸLQw6ºù+}+û÷¾dqæLÝÆθÏî2´vdÞ‹?¥øëfš˜YìرióIJKKcÞJ¼?î;Ý¿í÷;½w¾÷%o>°™I›ƒöÿ)í½ß‚~Qƒ´ù”ÄÅÅmû„ÌÙ6çëm_oݶõ½/yÝÞuLÚì[½oü}!m6H@ÚÒiƒ´¤ Ò6Ÿ­ÂÂB¿OÈbßÅ¿ßþûý~ûßû’wïbÒ&x[ðONyðàA?x¢¢¢pžÂoPjUêŸ÷üù-œV¡Iöñ¯€¦iìø­IªLbÒF"•|¥«Rƒ} H@ÚÒiH@ÚÒiH@Ú mÞxœþý‰[éÞ{꘿âöÈ£á/^w÷›’~™u7ÞÒió·É9³zÍ‘y†Ì½`þ×U/äs3ªZûM)}xÒeYÒ6H›· Ûš;$ŠèxÝØÒÚ)«ÁQGkK[§¨£¹¥©ÆТ–{†c¬´uv´³i“ù¢µ£µ¹©©©µ½S^å¡ÅÍmÌ°¤³¥¹M$îjojjljnIñY@Ú mX—æiÌ:W%l[¢?ÒÊy©||ðR§UAq‰Ì-—ße"$b×\Ž¦Þ¦Ý> ÏÙ´‰Øälå8Ã}Š5G×àÌ YÝ&Ïç;ƒeÌ@ÅÙÉ|·;ç9Ç"æ:ðí]¶°q„Ã6¿$m´Ñý ÷wÚŽšLÞx?13T}ÁÔe¶‹¾E‡lü|›Q'JÈ]?s˱lV4]Ö5¡–èfÒ†³8:SVëfËîÒlÚøÊÓæÉ%¾ŽU=»D"©¼3–gÕ„c6¿D!‡ÛåûwhG1áÑôP¨«WÓE ÂWÍ÷½vÎ{©ŽÉŽ"u{¦îö&m^]Ô=þeO¿MZÕky…%+r¢É¬Ò>i3ç$‘/¾1}Œ–És)F@ÚM$í“õ8™Õâý MÜUÜ^ëXÞzg™žç)òö´Éìé%Î,mt'ULcúX&mð ÒdWéoO*sÓ3.'¤õiªÐl55Ë4àNÙ¤MÒió󉛸¸LßÏþ£ó¥c,Ôdj;}Ò¦ù:ç;ƒ)Òió77¥-æ:ß.¡nɳgŸÙðaênò4¹¹[ 7_qÏžŸ‡é¨1ªÛ®>PW•ö\‘6é”wR“-’ìÿ[‹í˜~tvâÛEÚ¼JùïáºOñ ÒdyÓ{; M+Ý£ü>ôŽë3çÀe‘7¾qÇ m6€´@ÚÒ6ŸmÚ¼¹¢Üó\B@Ú|¥GþS}ºˆÊ»áöoùñkšÐRqcS+’ió·»O ãÏaÒFÚÝÚÒÚý–°!-O’„æ›Dx±6?³ñ”yÊw挩˼‚ÚÊ"¾“¥MÍ Ó7ÞOÒPzcÕü3\¦n9p¼&¯‹nÙO´ê™Luv~ÒNDõ÷½WÏŸá2mÙ&Ÿú.Z¾À‡—WÎ(¹;lötg·Eë {î n*ݽÚÃÅuæÁ˜øÞ–ZUÖ…enS]]çDÞ-WjÆÀOH¬LüÚûë‰;½½ÿþ…YïéâÓ?ë ç^ØÄÚŦge$\šïj®näƤͳ³S´¦ž`}£Í3¿Ÿš“•µÕIkò^Bwü±@ßdQAQÝ‘o:ê»íÑ7²²2.-×ЛU+ËŠûg¦l¦ù¸ùäiåÅCËxV³Ù±Ý…ê¾'®§§Än™¢3iëu)!Ñ[¸Æö7’3²ÓîÌ1T[“…Cà=iz¢¬1Üø¯R†ù›|vòÏzÂ;­¾YpªVVù ÷£Ö4˜§œ6¥§vœv*¦•65½fâäá úlKŠîj|PÁ~e§T"¡I‡ïÛÙJÝý³S„F‹»å•—±£t¬¹·Å’ïy^Þën)ñ;!"RÓoR:‹¯9¦ª:µÇÀÇãç\Kª{¢ÎÝê”w I:Nùúøªé&Åwc|öì¢N²—ËŸ$ŸÛííSÔJjó"De(*Dmwù¶ÈWÕQu2ôϾ}ã zû—^=L :°Û××çR|Á Ìðù ™ÿØ?2oFÊÆ+ø¥q#‘)-!"‰ˆ– “2D*¡»H7ÒÞ#)-–ÐÒV"%DL+ª6b&jH§TÂŒDÞÀûJ©D"b+3bZ¬¨îÐL…GÊTu˜‡°àý´£-ÓÝÍõRºƒHä½8Lò.º‹IœnZ‚º ¼¿Äéªø÷¿ÖoYKK{’…–4Ï_ )/¥EÈx_uÒß­¢Òöÿ],w1‰#¥»®^mùê‹ržPü™Ölèžåß2WŸÙhiðÚe>·JÒÎìÚ¸7ê­³ÎÑ'§Êßa»=æç5žô[ëûýݴ튧ÿs7^>}ÿ¹Z·Ï^Ú¶såáKéýfypxsBèƒÙ›¯óî^™²ê²÷é…sç74åyLs/èz‡g"éZµÌ-«ò53œöýòuAyôÏxÂìp’¾ Úéé6ÏýÀñ›ûz«îL›¿]Ôw\ٗ¸mkæÞ)xõ/ûç\È®…s—¯Ý–ó¼•|°³žYnWz&›6_!Ÿ‰˜Æ!v¶í¿òøßþCBòù³ÁÕ7ظQ?w®îÆ2uÎ’®¾¯åß‹¢R‹ðqžµã­3k¨ýyï°’®us6&¼¼¶záî˜vb´i:5ýüy×sˆÇÃËglÏl¾xx‰gÐõ~å,s<·!çíËë¾6FpiçÇÉ x†Ï›Ë]-­ÓÞ)m:,µo—62ÃS£OÝ}ú¶#x¡žàéß'k¤u“ø#Wî ¿y㊗‡¥íÂÃúoʛƢÀ£$²ã*ËËÒçr3˜9ÑdÎié€i/œ +~ÖúÓY#iðœ ã¼Ê÷òõk1Aë5GsÎW|°þfu"iŠŠhèÐ#µ»‰¤£$³YEE¢¢Ò4eóT>ʸ`_HñƒüŒ„„øœâÇtÏ™´µ:3%!>.>ïþSùa ªÍ‹Ï«îj~ž71)½¦ƒ½½²øÀúYö3·$%¥°Ki[qvj|\\VQyï›ÁÓ’¤Â§uùñq±i™…R"~]wåä.¾þì[±±M"ÒVW™˜–ÁLÚš´1àV©¸ìäÔuWÏ/3œ?G®Þ"u]Šó›I›Cy$;ž\¸HÒ‹k‘Ž™‰äÂy’¨8+«./¼ú¨¹-iǦðLf¢§™qé›îºÊÒä„Ø”{¹¯¥=;DÚY’›—–UÐ.UœMOÒÓÊš›«Êâî&§e7‹ˆTÜ™r;ˆ§=ñZ|Âóy½ÊMObvZAy•|6I}a\ö3QkuJÂÝ„¤Ôê6vQ¥i1fjz§’‹™c¦+#ñÎóföà)?å[ÛÕ|{;sEòf{uJÆã[÷›IÞryÚ°³·?©¨¼“ú$.§å•â­»6ùVÌ7f±1é3ªÇY.m'Ä{ñ\&A¤¢×)Iñ¯»¤ýŽâîæêôäøÄä{ ÝV=iSSžz¯¤A¶ùÌ‹˜›š‘×$[CQj´‘šÑÙÄä²fö ˆ_×d¥%ÅÇÇg–÷T­žÜM+"Ò×ɱññI:zkDOJsâîå•u÷Ö‘Ä-™)ÌA’[ú¸÷ izZš˜YÈ T›¤ítD1ºý™«[ÔÈæfë‹ò„{}Þeš_>LË*RlÑËÒØøŒNÅ!ÒžÛØô"6)›Ùò†‚¸Å¶†kDÝ+}–Ť͙֚‡I‰q)é9-bÅSʾ—Põª“t5Ä%Ýc^‘Ü´„¸¸„²çòÚý<'9¥¬†j)‹Ÿ1yïs>ºŠ?}Sû¢k R“‹_¼÷àeJ‹Ë̶!*âß}ÑYÛÐ`o%QÚ>T…ÔTÓbñGÚ Zlb2ÎnûŽÍvf:³|.3c:_f먩O_¶9ÈçD}õIغA[Ò"-çm³g̹pã†ïJ{®ÎÄV1y]š²t¶å8ÇßÇ\Ò³-¸VÓÜøN6å뻇Ë÷ȱ­¦¶³¼ìí¾ù×ñ¼ÛcHKÕA¯i|¾ChøñÚnò$>Òh¢ s`T´KHmåƒWì;†”Øÿ…|õdÁ2b¬FTþtÊ%Í/ÉCò™åH†¨¿8ŦÌû†üé_ÉLWòï_̦݅ÝÏ+ÓäIY‰,F¤Ç]øN‡ ûí£³ž:º‚囼M5åè:5³oâSùæSý:˜6p¯“½äwÔsÝg?gýõ›×VºšXMÙ@$mÑ=8š–G—·1çàc õ‰kƒn/PsÙ}‹™K”±J}âÓÏ]¿qh“¶ºM#MâŽo⨠öGE§Ö0{¨nº‘ú™"æD—å2‰]Q\ÜÎnhwªy8QÚ¾°îìsS&ÉÓ¦éôî aö77…Å{x† _ÝÀîãG'¢ŽýÙ•Ýgò¯—7tIãý'/ÙE´Ü·6–Õ÷;2k ÆNv[yÄo«…áC}EÚ\ßc:~M³Š%Ö|Ë©óùû-›a¡£5®EJß<ºVG]ï`TtF=ó²¼°¨Mq_qpÿGc®ÉŠ ìÞ}|t´ÑôÍ.VQ¯Ûë¦>œŸ'«)ÜÙm¯of±y»×´q<[·½ìN7Mj›µ4È·£¡ŽÕÊSòÐüèF3V3/Ó¾qœE×+z+¨ë 4½Òëت×E?ƒÉK”ÜÖÂKÚå5‹«^³µ4¹çjdÿh¸¨£9»åéùá¼iLĽˆ™`Æ_°~×ÅÄâ¼c†.>VŽ»öl›dÁµqÝ&_ØT͘ä—äUšª®©·‹‘ÿ÷Ï­Õ©uµ–=rNyXó¾=àÜmwR]ͼÓ7WŽ·ØxéÔ¤méÙbñ/Ň¿úêÝC†¼;¦‹ˆi Mt-)š4'Œ1­8Åùö&ö¥Rr~±¶…çÅÆTßPkXB“ŽÔ%cÌ+e“J_WêòtK™·BÎøNwYÉ T:ªM:¢Xpg1Ÿ“ô¬…>¾Ãr‚Ë&ÅÑso×0ý¥Ìéû2};ÏpuWÏi/•¾évWü•ŠHL8©é©ßþ?"«ËëüžØ­VŒLOT¾eJ¯’/þBºåoâÈ×ÿD×ö]‘¯C¹›ˆù¯ÃÎPõj¼%Ô¶ÚÖ8¢¸©î쪑æ+{멳ìøû/°•¥Â˜IúúÓ;dk>º4Šk÷šYF%¥©á*¯0Ån.¹®XAM¢º–)ót%ÙkUGßÉ÷I½P'ƒ©±·&qG™<êí®bŸWï±#ï!!]ù±cgt*öJëåÑzç6äÒÝ-GÇZU”´È'­?¶"Ø$BöŒZÎý·QN%°Í= WÚì²CSÕ&ù)N˜æ|c¾ºRÚ$I¥¹¦z|¯Óâü{Ùíb)i¾¥3Êò™üi(:9M~Àt¼Ìð¹5L8VFŽ¡ûº'ø'j¹VÙý$IK`R/’¿(O§™Å5“KYÑŠ'Ôò€Çᶈˆâåa¦ìðpfTõ<[i¤³Æ´S{’>G¯ô¹­*¿D¶o—8 Öz­q,a«ˆ‡ì­|bIåIyÚ0Ùé¹ÁVƒ3£ Œœ;d¯®¨$f$Ï©]9mÓUU91Ï/¾ÿ]}Ùñ‹‹NãLºÂщ=© tü¾?]ÝZ*®ü_ÿ&ùâË–¡C»¿Tib’'9™Ó¢²nCîö´˜¿¥o×m‹»ÖÈmyâžq 3ÔFøÝgÓf¬¹·X>²ó§›SÛ®”6’=ãõÌl  :äÈçl‰¦ÍvÓ›o+ê†ý‡qç¶÷M›·vŠ4¥ž:ù?ÿEþë?ÙjÌöYÝæ ²#¾ç¬Ì **„ –KÛÉ? #RÅgKúlÍdmGŽ¡†FI뛦ã{Ï©¼ÂßTüæN˜tà"›6'œ \ŽË[¤îöH-ëÚ>iÓ¶”7Æ~½_p»ù¡!û,Õ5CÓLÚŒ2Ú(ÒÝd¨ÇI|ÔÌT•Òfpu׎…ê-êí Ìt›pncž¤>3t˜Uüžc÷ü¢îùKÝâ2Ì¥]Ô?m~üý2h¦õÔ€y+n·4ÔR®Û0㼜6«vΫlêyOR¤<¸RÏìŸî8Án¼Í[ ¡€û¼U¤Í0i­=;máî å“Âô,%²ÏôôìÞ®M&ZÖ+¼)ÙA|`GÛ'O¹yÛ1ÏñÏìm•HMRŸz²âm[s~¡–g<“½µ–ÂYU§,\½˜YcÎ?•û‚Tœ§ ³zYÚ)úmf}¯x_^¡5¾¡oÚŒÕ2©êi;‡n4vÛ7È.ìn¬xPz-l³ßøÔ}ɇë<§Ù›ûˆäÜéΡ*]_~ÙùÕÎÑ£iÂDM‹?Ê.âë~Ë­zõ½@Ôèª:Ê·´÷}¤yžÖwÛ dic±G‘ûƒ¤x‹•Þ¤-þ×._¸t‘-W®\N}Ú"O×-±Š…½kÚ0§o%›$ûN“ÇOIC¡Bv”*úm|³z&*`§©&äÜ&ò/£ˆôç]:¡ÛÒôÔµËÚåÕÅÈð%Sœ½£z+j¾Ýø½§i3ã„b§ÔÝÕ?mZܴƺœ¾|‰Ýö‹Ìæ_¾”÷J–6Æ[ïC²´Ix·´yy1<Ì`yï?³LdÓ¦.…únBö÷·JOÝ`Ëé›egïŠ$?/möM±š¢h°icÔ?m˜¼$#.2`çDcu«i »”ë6t 5[Íd^ZIEM]Ý‹÷½iÃqiïíR–¥ÍÃø +g‰,¡zvoçJ=m—½G¯\zsd¼T> D{¬8+o=î}{ßb¤¹1¥öm[S™âcà-)ñ5Ýp–©Ô˜ $t³±@»¢™~kÚôöš6Ú¦Õ=~ÿ´¡é¾W"IBøJ‹©k>\ªTö))º¸¸ów_Ð_~!RùâuL´X*‘J˜òQ¦Í£3;5ìö¼…v^?ÍdûaûÓŸ(vlW¾ÞÛ-?š6+˜Ó“¾»ÒØpãÕÞ—£±®I¾GÞš6Fkº”áß'Ížœ`ûjºåÔ±©²S–6Ú_‘%GÏ·.”¨ü‘0o)‘äëé9$Dä/©xí²ÿJhI­%oTbe·ìa:çò©Ägíù‡Ü´gíér•³Éºc ?š63åïÍG§Žq ~Ð3#ÝØÀ¶+ă¦ Û’2U4h2hU¬%áBgvïS¿#0<·1WÚ^6Âüe¤gÆn±D>ë`i£¼¥J#X9Î`]Œ¢s]Te*Ôè“6¢Ö§/Ûz ®|ª°Ž´ÜÒeõ\6f£…pé•ùdi#•§M›rÚœ¿ß\xUÛмSñLÄq§Ž½&—Ý9–{R•’æ~/ʃ@;ÞœhÅLÏ ¸ÜÜW]J7Zôùj´–þ3Y7Êó{W}Âΰ3K^ØñG^Í®®~½ÕÁÒi½HvbÕæÝÞ|bÀÑÛ2¯c¡«™VÉLÆ÷sÇͳ›qBV5RJO{ÃU!Wë;²¢þ†´¡³¢\—lC‘®æÒлϞ?¯,¾e§3lUÀLP|Öÿà…¼÷{fJ$¦fÓ|à hˆJוî¯UD**5~‡¤ìGÈÇØK,ÿ {ëóMsíôõxÓ—í}Õ­ÈÕúœÓS¬õ„Bá ß“Š.Á´å6>=iS­'äÔ²a"­Ív2Ô2¶žÖ.¦%5™K§2myÝ 3–•µ(öÆ÷;-foëy¨82JàÞÎ6~[Ù ù|£ŒjúñÝ0¾³dàÀ˜5ä÷_’Mò[ÈÃ+dèPrú1QS!ÇJˆ*2”Øx±üMš½®JlÔÙî-GÒ<°=%=ê¬a»oCââaOÇÌÎ5ù…H±C¬›c§'ä9ÌYõ„íÃdUxr²ñ¬“=isg,w¼¼~¿kž•®®0¦}ýàºëx}¡€;mÉÎjÙíž’œõªæÛÄ=}²¦†¼¤Çì»ù­Cóþú«L#°Î™7"¦ sàÕŸ5p¢F9§^~RºÃýÜ:Å-eû÷Uª1%!4½ç}°å·¦¹nˆén.5æk”Ôõ»ÇÜ¿jkÌ56w¸ùðõd þElEð ûu‰Ì²šJ®Ïs4 u-&ºþP¦èù=¿Û•Ïço»Íœ"ŸEö|wÞÖpfå'VÙñ8æOJOŒâÏìmI-™.8t±LV{lóóœf(äÚÏZû¨Mqhu?Kôp2aö’ãÜu;³äFnáO^ÖÓyóp« _¨·Â÷DoEâÁ¹½:Üî¥Ôõ†ºÚŽõòD*¼Ì×3Èh’õ Wœ­7C6D·³Ôמ°<¨èä$óyg/bÍõ1\{yÚ¸LàœLaÒæžײ7m·˜¹{Ç3GΉÙFæ^7·4tÖn_äl¨Ï3³uŽI’ßoI__l®¿êì{½K~'†¨š½ 5” œ¦øƒdÈ—-–F"Ò)•2Õ÷ô3àôÀúwÿ:¡òúÐ}îbüñÚ£ò7)nGPÉ'o«‰Ò?ïÅùÑbÿÝQuÅ3¶î'ÖIÓƒÌK“Á7¿ïw Øï´ÓÞÖ’tÇöýf¥AzŒo07xÚñNK&oyiú­´ï®Až= ãÇ-Ò§™¦Ü#«ÅÞF:oê·¿|}nìØ ¶¿èǶrk{à”Ÿgÿ‰3æS ïñtdOBK_íÜÑ­2”©ÒT«©rpìþâ«&úq9û}ÒòšÔ磾4åµXúYÝïMK:ïU|,j¨È¾_÷›|ùèÖGé/š;ßËs“ÝYKwZÄ,ÖÎNôå?6üóŸHc£¨àA›ŠJç_¾01KhÑgùÉx¿M Mw³µÒ¤gÀTlž-q']´˜t¿æò¤_~Õý§?“Ö±´» ~iÚ&[Øû ›¯húâ÷¤»£KDD’®Æ g:†¨H¾þ¢nö|Zö!M€_Ô’’ÐZÊ4¦HÍKéõóL›Š½½Fv/Ùã?  ùºå¢ER´¤à—{K¼˜½î/–´K;$LÒHº¥R©DJ·u ùêÕ'mGK ~iåFöÁt Ó êf»™jDÌ~ÖMÌ4¦D¯TTªþù_»%¸&ï¡1Õs¯Mzï‘]gšO­GB$·/v}”÷ÀÇD ¶ZƒxøDý3WmS endstream endobj 906 0 obj << /Length 939 /Filter /FlateDecode >> stream xÚVM“Û(½ûW°§HU;„PrË~¤’ÛNœC*IÕbU#G’ãõ¿OC#åñLeS:ÐÀ£yÝ4O0rGy;{3Ÿ½ü[jRÑJ Mæ+R R†•$ó%ùœ}ØwMm›ßˆÒd{סõvß,]~ÃYö;ܺÖÙÞaGRAyþuþ~ö×|ömÆa3F8:/hÉJRofŸ¿2²„ñ÷„QYrˆ¨ )´¶%fÿÌX"úm&Œ¤*"„(©PÁYQ Z*œ½|·QšüéÃÊ!F…–Á³æ¤'oÂçœVJ‰¡ 5Æ`üïú%Do‡ÌÈUg9cäFàSá’ù:d¡Ùnßí|Ÿ:~Z™ ãl3zŽ½ûRér®²ã!˜¾[Ž°´Îc¿õþ>ͬ°C‚EÖMÛ¢¹Äà ·’Yêö;W7_ubk»á ª;{l½]ÒüF²ò!¾'8KØ|õ!e!71»ssh†5`tYh•m÷›E¬)úÂÃ=¡™k†Æoa#Ôn—8˜-Z~ ¶EÀÊ·­Ï…Ê.!Glÿí\k‡&Ì}|Ý ïDm„«ÜbSûÍÆ>Þû|kœílpzX×ÓIØ©$>å<ägpŲ}¬ 0ÐgéƒÞU¶î±½ßb”Ø‹e€Îºä.–´c€™Ê¬X¡M˜ó2€~*°üê‚e*ì\rœR<­imŸÜmìP¯²SÒJŽ“ÇÕv{‘©…u£R½ýg7»Öõ¯Ò­ _¸ãñƒ{=m¨æ’È ¼xVxJЦRÄgâÃpA$(£®ªç|0Á~:¹à$|À àöxäl›Š2ÎÏ· ãE)iUšÑqçÈêªçQ.Û¨rZ‚¥‹$rbU•À¥è•ââõxBê—›K¹×l<þï.¯’yöPT!)7æ2úø`Á…ú?Ç:ÉËDÈC^dø;˜s%×, ÷£‹…¬'x—lßAGzDXlúænk‡}—œÖM½Æ½³]½á+ß¡-8DÆK¨Ç ¥Ù¹üaïju•`γ G¯èÔ9ã  ‘f³½Ã.òT'ž`)–Äd5¸î®þTO÷Þ¶½J+·1¼»D9)°bñ×ñþ*$8\8àzC¬]:ù…_¾KTOƒŸ~–\}7ðæáéF&F+¡ÌMYº8úÇÚî†ñUÀj!.^X·{еK¦?±‚`ý endstream endobj 898 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 303 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 11863 /Filter /FlateDecode >> stream xÚí@Yº¶½w÷îìÝÝÙûïîìݹ3³;³c–L7È¢‰J#Á¬HPÅŒ(H–`(FÄ,˜I £  HΙî>UwƒÝGaWœ÷Ùoêêêª:§ªžúÎ9M!ŸB!BÔøèOTœ¥Ÿ>²µ`º»'ñq†©µs]]-.ÕO€õ›B/Õ&Þ#ÄÇ[R/_%EjjjGG.^ØøycNÈþéŽöRäääàâ…mˆŸÝ6NŽARÀ6° ÛØÛØ€m`¶° ¶ÁÅ Û ° €m° €mضA `Û `Û ° €mÄ—Ó<ÇÕÛaž¯ý¼T8, öL*LÈ#1ÙBz\²6rƒãâà¨,al6‰¿ñÄÞÅsÅ©5äÐ} "³ÉŠís¶^‰Ï黉˜»dç}sÈyQ€Ã¼€¹k‡e‘8j~ö›e¢'Ú¹- :Ë홟]äìæã Þ««ç‡¦…gS{+Œm`ØfxF|N¡²‚‰gìüÄù! ®+‚'qÆ/=CÛ@¸3÷õ¶Š¡cþ‰Ê±yÄ×ÏYÝ`±ø]ÚHמLT‘›‘Ü@iÇu†­á¢„¹}U}½xª¾¢†‘“‹O˜k@˜½‹ƒ²¼ÊüäÒ8ñ’ÔJ²» 8úºË•é;{dµ3뮦¢‚ê]ó×&¸l¶u²UQæÌßù¤¿Í`Û Û()Ì:Ò&zIgái¸5gst8×d^èW–Itt.m˜ø;e%‡8Q]å‘%‹­tm‚âDÈ6¸ܮ¹¦4-BbòEëÏÆå“ШŽ²|ðE¾x‹ÑWŸ©³÷D*sæî¸Gbzl£>AÑ/³'Ë#w„042Hl6lÛÀ6ÃÝ6të&êÒc‡½.£ƒÒÂlg¶¹oNô—ŵ»)9PËl?‘Êc36]DÚ©ªb¸î®Ä؆Z[ÚU¦šfÈ ¡ø³âd&&[`<‰g·åÉäµÓØ–ûâ ‰µî÷3v6Š—ìcZ8d¶½ª±Ç ä6° l3ÜmC·ŒrHØÁD.³í¦0áú%ŽœfðÊÝÓõ¹–Û (9ˆúsø‹íÙš®‡­Lí7Äõþ”å@-©-»÷qt #éæ’LγØa²†û¡ù$îN¥žcÉé*Aòñ_¬ë¸Z´•lCíÛr7=kÿ8ضm†m¿Í$[wËó¨°°·ç¨È¹&¼¤Þò^‡Äå LôUÙL[• .[•Í³pO5Ý©+jéؘL´Ý˜¹SªÏv@ÛD¿È`ëlÎ"Ò-)*¬ ´ÍC2ï“Nj,• ½[QSg´"/f–Ô\g¶ÑÜ”7«‚m`ØfØöÛ¼’>´‘¡dþˆ$ŠâY<ÛJo^bBžd]›õ?fa|NÃ4u9}¯+â(qc-êü5 5¿“Íq—®±ÔWç¾ÙJhrOwZt¶Ln#Jlvœ8Ä–SZzFfè¶ÁÅ Û cÛй‡ÀÑH{ÊêËoÔ‘-Œ?·Ÿ)§’%Ð6ó"£®5†g6ˆ#ê=äyþª–:ÃÈ#jË¥úð«kãY †iPv\ñ]í¥9u=¨-ÙJÜgªÌåç;²ïjLPô>ÛI}$<³~uD˜:KÑÊï4FÀaØføÚfò„±3Rdr›è›ÏÕ£ýO¶Ê|°€ØN;ÍïŽø¥¥¡†UÈeiÛÌu²Rc*±{‚¥cq€ÃüU £sã d2Û¤mØê´ÀoFÀî°ì>I¡§c.æ¹.tXâs¨´÷R´müâ7$'¹xí?g!2ïuÑïþè}CºDbn×x¬v˜äºÃí¯mÄOgXž<}Ÿ³Oä†ËÝÒ­˜¸|âç»x²ºêd'Oï³±ùolC­9âLά¥Ó—nÛt›¸yžªïk¶[dvõ\Ï€é‹Öúlê󨩘³l–$ÅÈÔFðŽ ³7?‚mló¹Í¦ä*ÊnS–oÛk¬§já{>NúÉ,´mLxFîæs×.Û~ÄÁÖˆg´”ºü{/yjÉç®±UœV&-Y¡Ç‘wÞQ$V$·¹ñj2WaññêSË]ž|þQz}%ŒÏ®™¦5vŠëŸ˜ÓŽŽzS8²¶ÆåtÍŸ©¯eµtYTú¿ScÕ)æÍ/Lå)› Ø_L½ìµMü\m•q6Þ ^ÛwOœ¢¡¡ây°ªmê––vÓ„¦zx-cÉ)]ìy ž¤%¡ÄsíÓ’Zî©;qnl`›°Mø¹ÂÕ©ÕÔu“%ܺ–m¾hg^ŸÜÆD]Ë&J”œ$ÜÈáÈ1}¯I]³ydÙt%]ÏñsÖ%íµóJìÓ’Úqj?[Í&ìÌ)†º]­Kº%¶{š¶EL.­¯…|K­‘}r›ˆÔt¦úäÈ|Q?pñòµ™ä˜$Û’êtÒQ´ßU';&´Ìše•p_Ô|ã®&[¾¿mT丷%}¿†“•$”ÊöÛÀ6¶ù9ms³ÚÅÑ”Ëap9L*ÔÍÆç÷±±†õ~ñõµ³ ÁŒ1zú!AïñyÍSÕäö·ÞoC¥1‚eÎÚl¦Üœõµ²ý6«·mÔ0™%Õš3ƒÝÇ6!q‘ [WO;7*¼,,Í´L\ãÞÁ6®6ÆSN%ˆZ—Õ©§­Üß6Jœ¹‘=ý6S ™qEq° €m†Æ6ñ÷È\syÝ9G"®·EÞêܺ–e2mlôÚÆœ9jú!~?Û´ôöáôŽJKlCOóg˜é°òŽ1OëFÉKÛ&(lƒ†ÉIÛ²KÛìPŸd¹õBåÖ‹’»\÷.¹Ílkc“•§ßØFg@Û¼é%†ml3¤¶Iȯ6Pç–.¹”.rä Û˜¨ë¸F‹’p«€'Ç\q•H÷Ó.±SО+.—îNÙ¼ÿ¤ÍâÍqÒ¹M KZÇÔZqùK]¯r [Ú6[YºÓbEA ;§iŒêc›ð#g¨–ÔŽ\ÉóywdTFdËôcfw Þ¬¤Ä{"Ý.ÔâÈÃ6° lóo´M\q·QÕuÙ¸ïöŸùŽsg1¸æ)…oF(ÛšðôWíÜ{kÎkÞ”%±¹2½Ägβ•åçl<¾"úðêÂ__ª—8::㉖ª’ÿÅnJ;ËÖ.{ôÛ?‡?îùx6‰¿ýÒ€5ÆÂ3É?áÒìYNº†3¯,Ù^â¶YVšºN!¾I7|#÷M掟^ü.¹MÜ…S\¥Ù[ίJJ·46ÓPGnÛÀ6ÿNÛÐÐ7«g¸Ï3³=?¡(á~÷¼…îÓæn¶Mð¦%ÖÁO×FÆXØ;[/ p<:ýºÃLW3Çù‹“ž$ä½é·¹æ¿3`í"kÏtÑ´0ª°ãÅoå´¯5Fzüz±Ó\73;÷å) ~|\Öç÷Ï%Þk7YØÏ°˜éå{¤bgŽÌ÷xéA«Y3=Rú؆ŠÐC§¬],æo¹CôtU–ª‘rŠ;›b4}sï/ð8¹ÏõÚ_.³éÓGœ6Ç܃ml3,ÿNª|Œüš»51CöÍÿ7ßîËx²`ãÙ(q¿ÍÍRm¶Üªô®ŸTiÔ>çÏÅÚzn×`Û|ü¶9¢=æwþ7&[0d¶¹^56øð!—ßj:IYgŠõô…^Z,STžöS,—O–­X¢Áœ`Y¿Ê°Íp°ÍèßmøëÐÙ&5é ÿׯX‘ès«qý‘‚Õs×,‰ùéJ™C6ÍYsôY þ*À6ÃÂ6:£·nˆmó«Ê‡ÓHt.~e¶m~Ѷ9¬3ú÷ëaØü‚lól²mZxú® UCùŽž}mSHêŒü|ÝÉ*‡h£iáÇ`ضù¨lU@jF)VWºhøû˜únwÙÑ#^ñëŠ CµÑÊñ ÿ ° lÛ|D‘-ŒÎ£/É!Œ¼zSžIÿú¿F ÙF©ÆZË_…° lÛ D¶ùbèúm"ïQ¶AnÛÀ6²Hb!lÛØfHcAZÚçô8lÛØfhc~Ú©Ï×ý/lÛضmlÛÀ6° €m`ØÀ6° ¶m~™1/íä×ý ¶ml3Ôáqúø× ÛÀ6¶m`ð‘³*hû¦#Þñ½áwÅ3æÒ²h„L˜o[óûà?-‹¾øcK^ü°Ú[´ó|ÃÿtÜÐ|µ4ö"j[:Œf¬˜î`Û w„B!õorb®äÄÞX¸ÊÂÌÔÜÔ!¬éÌÏü>3û±ÅèÌL>`ýFæ“k>«9ûíS3#Ô¶t˜š‡„„À6Ÿ$Ôq ²ØÙ}ôy`Pà­ß­ÓçMÙÌìU«W¡¶ßlÛ|ò¶ùCÐ`ØÀ6Cm-lÛضmÀp$;;;00p%Åf•Íÿ0të÷]íKÙ&‹‘°*µývüüü¨³—ê§1J•‘‘qÈr4ä/ëÿòaŸ½yóæ.“q;£ã/åfå™×3QÛoçòå˸TÁ'Lê£Ô¯C¿Ûx¨øŠ7Ô4¿tŽý&ôØÛ`ØÛ`À/Ö6ÿûljŽù6ìÛ¡Ýl ló¶À6ضÀ6€Ô6ß…}Û†š”‡)° ¶ùv·¦§Ÿ©oçS“’9„jrOœÏô[øEÁùÌü*œfÀ6b›¶JkëiOkÚ©éú›;'Ú‡Sü»ÞcuVv÷[8=ÜaA~ŽØfŸ…ýõjQPÓ¢t #yC!W“ý,Ýc©Ù½¶¡–èyS²*ñŠzç zÖ@†ôûÛÀ6Ã~[©CáI=]~7EYY%êI›èb£ÑŒ; µ,5Õû•mu·Rì¦jëMžº2pc[–·œiÈÊífºLR¯gàÑ$jVZ¥1Õï:%óIJë<çÙ¸û‡…xªrµöŠ×À/ê{äá‘ï·ÛÈ èœ®Ë:QPAMfÄ:ÎÚ±]×ÿ5Ýq7VÑtáWp8j”m¨9§#\læí·¤”Ç+ž~F7¯HG©O9ëe 5y8HË2àUÑ–S¸ÎSÅ«/ØjÈpIÁé~iì.Ø=rûÈ¡ÝÆ·„¨NÈö)î¾MÃ×| f&Ó† ÖgeÕ¾âñ\š 9·ežKÀÒVÖk›Ûœm¨–”È6ãxË:DŸ%]:ŒKOëdlcÈØ{í…¸c¹úüL“m|œ|àFTVÔÛæ$!j_D¿uŸ_Æ(™l!ü\u]GBÚ§òT~h&A.Œ°Ì&Ò:°mÞôb›7^‰ß¯>? ¶¿DÛd½m†]“þ§Õ‚É»t<ÒÜ-Œšqt&7õѽiJ‹¨° °ÍϪ?G=S S¯}%ÔtËuO+O'-×íDÖ6'ÃgM±‘¶Mlló¾ÉßêôõW.5‹ò;{oÒoµ”N?&ÿ5m›úÂt ùïÔÔ j¯ÎÿRÕ³Ç6 ªŠ£Î>ª¥&÷z+,Ë l£¯>jWF‰øýÊ4›ïµ6t£–Á/Ï6c"Æ ÎoÄR¿l(ý#‡üà¡hNÿ…¥æH} ß·¿0Bo†Ž‹z 5ÁÁÈm° ¶ØðqÚF.Rõjü.úÉGÉ£CÍⳋal€m¶|œ¶Q‰QA=†·SnŒXê0Ô8§:Ã6ØÛü[øÓ1€Ü6Ì8æpÜs{ý‘¡Ç‹HÕ/¿›PÖ)l±ŠGw›!">œRx;yÃ%¡‘~9wšjdÚ‹ÁÞí™Ó Í¸Ï(ù=þR8ðVú®¬çY™ýVxglŽØh&jÛRûè‚ÝM]=“ÔÂ7+‘mjóÙšTnC]ü-ÅÁól´4yúö'Ò?B¾ÞJY£¦¥Åó¼\AˆàЦE“´¸º ·¦HtQuKMÇ¢½£hž†º¦ܹ^Ýæ9Y›3ÅÖ=¯¶G8Mσܭ´4Õ­æú¼nô÷à-˜0&¶’úKãco<]^za« ­@Û¦&WQMûµ¨%µÄpüªÙeeeE³´”Çž~PßY–©.ÏÍ,¯mè$ëgO4_´¥¬ìUÉó{ÓXªa×EyQ]–¢2ÃÜ5üUUmcݳÙÜïWŸ«'B~ˆÃ$û ¤’ÒÒû—’å:ÏÚDðÐTyÜÆyå¯Ë\Žâp´ÕÃ7|’¶!¹óÕ\V÷ä]v:ãemÓæĹõ’ä)*mMÍÝ!i¿¯1{Oôxƒ†Ú*ú¿B~WwWÆîä Wè¹õYòŠÜ›­âÔ‰$úk9fð[‹µÙrªEùáß8qôa]Wö{öü¸ÞYj¦¹5­çïe¹H¹ãŽ©R}K)<’ò0åíqøÁáCýhÜ*½õö]Ý·ÂÅÂ/²÷圩*}r›¼;Lu”Ô V…Æg=©¤’²ÍãË» ÕU MM­­§šê¨é¯½$±ªî«žg;%NtZy±³æO…[Ò.“¹„Ï4çèéY[š[N£ÂL›©h™Žó€wgß½}ßlýæo[þÖ?¾ÜòåW[¾z[„~õMè7ßú÷·Ä·aßþsÛ?ßßoÿž ÿKþoßÕÃþ3M|Â%=8„Ì4Qêc1ݵÏv®›§®2æxA”mªÍY£vß©/su!OoÍ€¶Ñ¥lÓUw]]•QÔ*~º‹ä­7së°}[wè)à»Bþ%¼×þ¼åÝçÉËäM—Kd#|:Em¬ŒmÚ_:v½wE›­õVºI:iÛP¶äkWÎnÙ£«ÑTƒ5yíÅmpAØY;I]éÂcq¿L›¦ÂÊÛ •ç5ðˆwR(¼sùFs—ý6|Šf¤þ_áÌmæ87tã*C 3µÈ´bé~›Ù*fÓgm_ë唓¿õªƒúˆí„1æ®>O=›iÌœ:×31f£Ùý¬]vªË=7“Æþ¶9OmìÞÎ9 ž¶g`ð‡Ij\ë>-)o+Î$+爨Og“ ÊæE-p Ÿj&FºšÊ¯œO;sæ«’{ýì£ÒFÒQ{úÌù6(ÍèlȾvñôéSé2J$ix™›~æôíç ¦W—ÏNK?_Ò@«)ãBÚµ‡%¤«æTÚùÖm„¼Æo°~nÓ¤‹ˆ~T ŸÛè§êøðsëFHø>éðùÝ„Åv^Å6>/œ}‹ÍI#*ðAR!ožšJ¿ 3ê@Ø(¬(˜í_jéSl¹²ØrÕ3‡ôŠÃ”‚Û> »‹îHd#äwó á“{M7}ŸÛø?·óy95ø¹MFýñV¡@,#èæ§úýê™ø±?`åSñe^¾)µðíÕò¾¥î] ÿÄ¿·.~òJ•¨ßY1HU¿û¶¤–üª‹^¿û~[–tJRZ8YÕ—ý_Úø•Ú,-7ÙWÞ,lõßð?þ“yÈN ÒY–—pøÖû~JÈoŽ:Ö);{…‰ºÅÆÔëñÎ<}·A«Tk™}á6ÁŸËRœž|ûÐjs}Ç•CWçwï¬ÿO½<ý¼¹»ÏÌe“ÙVÛÎ\Œ°×2YÔ÷[¿#_‡¼m›MȈ„ã¬ú÷oö½¨å}ûýŽï´_‘‹•moPMiöŸ3­¨×—c kÚþeÖÍܳ†­<~É¡;?eUSØ‹H{Igíµ1iôƒ‚‹w~9΢¹ß’â´¾6Lz/Þ ›>þ»¯.Wý<¥n´û<3|Þò˜HšT‚²î¯—Ö¾/Ìýž9ܪJ§·*è¥5ÝÃÛýª²ï•.xí‹g>9¹eš{€ž·FÞlû}.w¡@öSm/R†¦’šÛ&&>¢¦ì@·<ÃßWúíÿ 7;ï£>cÝ7‹ôÛgñŒíÆŒs¯Ú+æ`Öx·êí[¨“>ú–nþKõ5½Þí_•Â~É‹ô:{ëCšŽò îD?‘åwbÚ· vp?ÉûTcgÅ ¦Ž…ŽêØÌjÙLìC/ÂVAƒw‰Ã½–Lñ&›IKÀV~Ŷ~Ïí ênwuuP®¡’õ¿až×4•Þg©ÍPU4vYQTß)N òO†Mæ*3U•,Ý‹šh6¦;´Ùu÷T˜“­ÆÛqþ9UîÒ½Þ ªª\¶*WC¯…Oj]˜iªÁPUÒ·v/¬l¯ÿ ÓbMvrÐM“;qZƳæöÒ» †2—ÃP•“»RKʲL`°›»…÷wÌÚu­²ìƤt­6íQô-{ÄoHðQ"è±ëb8ŽžÿýDRÞ.9È-edÒXzæ_H~ 53kåùÂƧÇ6ù§¾¦îo)ÊÊ öë›k?¾„«"§ÊÑMÊx*>’­–:LRc*s´v_y(^¸î”ýhûwR7ëk2Ø,õèKÅÔL]9‡©¦¢¸æ-Îê‡g]ŒÕ©âØÎ\-ÊÇ|ÍžYùô´ÕdKEÉ+†ÎÊmDz9j–ªËnê2o_ üÅŒ}Ô¦ó·9ºSSr%~Ñžú³µäûßÑ%² á =¶é"›çŠêdqÛ.¹Ñ!™óí•Ë=©U%Ï6¨n§næmÎ H«ë#皧—¦j)1ìU{oÇùjŠlCšÏÍþZ›NŸ:럯œmÂd*39¼5».QsRœÇ‹vXÅnG:½_Ï®SGY¡ÄÕ1>z›®aG-Sylöƒ»žú,¦²¹[p_T—‚öÔ°Etõr'îºúL\½íÕOf«©)óô,Nç–H|Ñù”3îë+Å]Ôdáe*×™h½± M…îø/SïKçW/uÿ9*S$mAgµºÊè—Ÿˆæw­Óú§ÿíFÛI£cϽj.8©¨JŸl ÅÇöfMñ"sª.CINÎ;ö’x—ž&Og¹štžà•áiÏã24ïW´Óå}|F^I¡²•ßãÆÆ¥ò)e V¬‘´m¨S¯üŽ¢üØguÝ|Ãﶯx9õZË!!ýÅš®Gs½ŸÛø¿²)¬Ë•j& „’k`Ø&6í9Ç*%=håóùw¹ŽãºSwÄGéêšÆuíÝTÙn&ø0¦Ì ÊØ~s‘šªü®k¥´{_ÝærY/èê=¾ÍÙÚ-F(º3rŠé?´R“5ðØÌ¢Fú<jÌÕÑ/mç Â{ñK•§yS3 61ÙóZD‡¯¥âqâž]É}æÍÝæëÿ&‡¨S‰´½¢/¥ ¯è™ÆÿCþë+ROå‰ØŽ!_;Ò3ù ä?ÿƒ„ß Kt#šŒøuÊ®Møù}û2~èSþX/ë© C©w»Û+ôµTÜ.!ô&(¬Ë¨PÅè~f£ö}H¼´\›Çb(¼]N­±±ø*›Ë-§ôZŸÎ§O%ëôIP}JC^ébQ5]™¿‡Ça•6 HÉ^yy¹Ù[oÐk# v¼‘ 7›¨Æ§¡*óJe›èDê¾¼7æÂÓV!‘Ùa¡ ›|ñ²æ$]üÒ›tñljlã¦EÆÒŤŠÏù?2m½ø &_Œ õÜò{ïØÝgvGß~Ñ!SæÆŽ#öA3uÈêoE2•å$¶¹4¬½‰m£Ý¼ ÎjÓ+ìÔ|“ IW­›yúY-½Ã­êã”’ž¶ |R}Ac´Ê…êúnÔÑ`q]"ºD#Æj¼Ù–tF¶ÄÒrévZ‘­ezšª)w_þ¦rVŸ+£ÎÒœc¢<*± Kt«ß—ÿªIГ«òûÚFØz()öym·tá㬶ñ8}V´=O6œ5Ã$ø¸¨YòKM£¬Sèlª’x©Œšñ"c%W×»]Hç6 ŠJ^{èïüÁLmTò-ÚVÏöY2§¦&6.Ñc8ÖÓݶ‚«ÌÙÑtåÖ'íÚÓÖ-¹Ð³özLò8@eLS{lÓÕò:9)¹±CðÁ×a¿sEÉÔ„Ò­„OÒ“W>uði{¯íuPM'ÙŒpûæ^’{úòž2t–¿ä~ˆþ¨YG*$wÁÓI£•RªHû­Erlf±ÞÛ+¸µ¬r:'=±ÝÙÚ=–š}r¾žþ†ó½kv×bÇÞ~A/°ÅÐlv¬$'}ž0Šé@}¬éÞf&{~+yk"Ú&º‘µ6‘¦ÂA<¯Šló{b$É{;ÏÓ—!uë.¾@O4‰Óh>),$Â{—e2ÑFÖ·» %ÉwÍ«—UMO‡2Í]z?³ÍLË…›Å¶Qà.ë‘´–²X¬<*{i8GÙF”ˆRÝ´ C3{W=G]-1¯ŒJþÆ(½ìÙ%ÓÕÖí@º^©23ªÚeJß'En½G—èUOÃÀⷢܦ•žyûM§ñÿÄ©=m›COÞ¥OýÅ•–¡…°çíuÖúØfã”ÚŸ’Œ•twó){v×S¶I+u øíô]¾­¹©ß¶T篵ŠlÃ<ö°R¼©{§ñìwSÕkËúnÿq„tõ6w>9ºeåÞ»3ƒgÌðM aßÇ6tËÒÿ½´ÁÕ)0™6@ vÔýGS4fQçgõ½“êí)+9Ѷ¡]T’IÙƧSÔ’#oPÔ³¾vÌM‡ el³XÓcíIIÚ›8Z}i§l}v>=ÍÑ5µÅzlós´¤ø~à+ÇЧ 6å{›y¿´<ÕOø¢QªšŸÃ”cëç/\';¯ÖAnü–GüÞKÒUu䪱Í"õ¥Û{º¦ïæ-êaçrcõ½…]â×–jßßiýY² !Ÿ/\S:kíc×uE³}‹íÖ?[Hº¨äjŽŠþBêSSº¼méD·ÙÛGÓæh¿¬Îž®´“ö”Îm&L Ü6‚6ÚÓ÷äôßć؆ÞD>})=ïÉN•zlcôqIé9ÂéeJéó›îÛi“î2’ïP+5Uy¬ŒHwHßÙ½ZËÞCÒßHÈ™°%ú®þ=¶Ù8¸møÛ¦ª»zÐw %{¥m³”²Í>‰m2ßn›ú‹tÑzŠ³äo"ÛˆZ”•ýûùßÃ6÷OoÓ0sè5zø\•>¶é'¹•¾×ZOaYÌm“ÛÛÌ0tè]h±æ·zmó¬mJŒFž*—©Þ›‰+ug,ÿñ~æw±¨;Í^YýAM1‹7¥•O.³Ü|êÉvs¹DÑ!ùqÛ8ü¨mK·BÛ¯®úv<ÓÌx²¡á$#C=u6CWWcCjÙO¿ )µ¬{éæUbâÿÂ!äÙŒÒ@wÓý4t‚óÉŒ_·Þ‰¯6­L|M·ÞaýcÔµ6’3wŸä¢tp‚Š~©¨ßfÛ¸X¹ÑÍۊîô|zeçÁ¤}µmüAms3“åÞ&I×;›úžrÍ¢ËMüí×Yôô|ÑP”ɉ¼™d™Ì%dÄhѵùŒ^ _<)º$³»úµ³µ©©­ÏLâe©ì+n™WOaÌL¼F Sä˜F%=Ý3Ù 7]x›mÆNz!šWv`¦œ¾¿ÄŸÂö‰ûëÛùƒÚF…y¹ºKÒÑÔÐÚÙ¯÷¯»†üjɬ«‡üz·…žTAæ“,Syƒì¾ò––µò–Ɔö.™u7W䔋7Îj¥2JÖ6uqÛ¢z¿l«½wж9YÔ@Ûxÿ]›ù’$øÖv¦ü˜ËƒÙ†,±PöKÈäUÊsöÜ"Ë1§¼èÉBoœI)(uñ›º¥†\‚Mµ}ŽåJ[ ¨ºø}ë)a¹–{d¼ö̃Ô)Üt1ÐÎg¹!ÛL|^IÙfWgy÷‡ÚFÀïjllì?Då6Y" Ý.ð-)¾ ´h¡oÉTï"ë‹•G{FY…ŸÞOKìó7ãªs=Âä©»{¸5ð…Þöz=#_ïiÚÊ\ý%Í‚As›®š mŽŠ½½í¹Ç¯sR˜šºÍÝ}zºɗÿMF³‰•ùBžÄ²Éˆ/ÈéçÄð3žEþ¤DìŒÉŒ ë$= $\Ÿ– [“ü÷2ƪ_‚+86Kçu¢Os­57KEÉÀv¦½!ƒÅ0y):MÏn²çñ¸~A«l©Û—ÅRñÉ9°mH‰5c¼ž™}ЉrúⲞșdìçï=UKIÝȳU@ç6£úÛ†´.×Tfé[Ï Ú)ž¼ïÜW û6„ÄöŸt‰ô ÈïK‚8dôÑ•¼OÔc¬ML4鉰‹oµM»+çkÎÖË&BÝv*\6oñMŽÙ2/£!·¤s›+ x<ö/ïÅ3MJŒÔ§T¡;ôÔ˜“¦Í M#5×Õ”•-ø­p37^u2ÂkÒd#‡SÏêû؆g—D•¾57‘ª^C»™ö 6ÓL4„NÎmuäòØKW¬˜a¢¡Â™ö¸S<&õl"cÌÕ]¤³h–Ùk+ MKËÀÀÆÊÜce”Ø­ÆÌ‘'¶÷Éê R·¨2•WÜ­Z¯¯ g6[ò­!'Se±mê~8Îã2]œìïÝÜùž¶¡[RµOϱ¸œª¶>ÀSÕ$½Ä­¯³©6aQý‡FØ%ÜüÂÕ¿ÈeS‰ëpï ~[1é4—ßP[UQñº¦®©÷;®¶êʊׯ_×5µJ:1:ê^W6övâUTTtð¢q¹®êÊוբܯ«¾¦’úTUM]w—Ûšªªë{.»[Ê+j¢­ÔWSë¯hïò;[+*+eo ¢ä»½‰”¼$%eôW,ôtc©,!]¤¦‚¼|I*ke¾cQSIÏ,¯$¾;ÑQÿÈvmZÿïu¶6R¥ö¿]¼Çâ1κjç*«k雩hUªøU2ÅïÝgÛé%ÚEtÕõ)~Oy%Í£šŠÆú¾Îo§7ZÓDß×W–×µò:½äõ+òâ%©k!mÕ¤¬¡§ó¼‘® ª¤µM½7~òê%iíê¿Š¬ÈeÁ™­}Ê,tÕTÑ•ßÜÁok¬ªih VוW‰WÈo¨«® ë¤ª¹]²NAGµÃÕ ôqìl©UNµÓÝíMTy›º••Ý’‚vµVWÔ´ˆK4`õ6ÕÓ•VQUÝÞ%ü6”°»²¢¼ƒZFØUYþšÞ: =QU+.¸àä"£O»ú@Ag+}I¶,¨«,¯mh• ôW½n¡ =ÂW+*oW§Ìá r£¨Òº[¨¦k©±®¢¾©§ñÔÕP^Q'¤j;µ+ü~_Dª¦v˜/Îm:lÙÅü¾ »aE‹=Ë ¶å ð7PßҔ9™E¿´Rû;Z~"ÝŒÝæ§W|”w}~K)G}~ÛOD—€±zoøÓ êÓ-äC6Ã>…“ìúe•ú(sïW°>²üè_±½ëÈ”|¢ü¡.& endstream endobj 756 0 obj << /Type /ObjStm /N 100 /First 879 /Length 1765 /Filter /FlateDecode >> stream xÚ½YmoÛF þî_qÛ~8Ý ïHA´E¶V4Ð-†´5Ò¬8 Öýû=”S϶œZQ´Mu–x'òásä‘âB.8.Å‘]‚\jp)&\“ËqÍ.“]ÉeɸB:áZÔž1W´L˜“«jóÕqÆ•É Ö`®N »’œ*–áìbÈHt1’ °‹ «2‹‹0Àkb‘8)ÕÅš"nÕÁE(D$c¶`¶š~Z\ ¦€V`h€Í*˜”“àŽ¸D”'ð¨HÅu©¦ v‰‹`]Q `pȃâr„ÞÔåaW D Ô@‹2M$¶pÙL/­0¦—V¸b ¶5c°'ÆÓí?²Ù`“dpC_‰ì²fÁÊx»#Á l2pA¬˜> ¶NÅhH&G­†0€>‘ŒGj À§Zl1Ð4xŸìÍwb1!w+Þü}9…nNšçÐg:»¾2 l™Iózz5¿Y¼Ÿ^µ!£½õÓôÃÅÙ³ùwpÃH‰½zŠ×-0„Vn ŠÖ Àö/ì@È6äÌYa¯ qõ¦Ù>9PÝÈ=.ü§À£[ø³™&£ÀÏ]øë`ø¹üw@±fý.; °¤SWPXªáq ((àÇ¡PP?&nÈ%Ëpž)Ý—=;P"à2E$up‘й…ôp6›c©“6‹›N–ÄíºõêVnÒß¼»nÿx1û4ižÍ¦‹öá´ù¡yÙ!!ÕZ}@¦|E«Ì9l19vÍ÷ó7sØ]ݼ³˜{1Ÿ=ñ1Écƒi—.»^ŽÓ…‹«—+Þ…ŒVvA¡$Åg„òRÕ3ëéÊšÖ˜æðà ]¿9lßÝ7¿¼~i>^__~×4Ó™ÿëâÓÅ¥!ëç‹óÆ~áMç7ŸÏ¿O¿\.¦WW˜ùø_}GûñM6“¼’÷ËŹú ¨†8 „pcíh7NNQê0VÓPÆ ÊÔP|]ˆÕgœ(O›D| ùN¶.©êÉGõq¬æ,Íýœ¿!ÇHò%õsêšë¾åa²½Wîò0ÎG²:C´‡ûQü-¡›ÄT‡ú[GL¨G<ŽÑ¨ ™`<*Ü]N„Ó\äo Ãóì=ŽV…•·pâÓ8Ž·dÛ[Vé ó–•a¦“UaËkÓ{)E_ªl× ^žÚ Î­7AÞ»¼wy¶8;_œ]~|â%Ý™Yî­ 1{+»UQ”`ïz«5übî£MQMÞªödÌJ1 ^Û¢Žï MËkîÇ6åŒÃ‚l/{åH‚O%ï•Ë$žQXï• À±{Ÿ\Bé ºÿ½)¹²W,jöÖr5ïÜÐ{6rê„]k>Üg#¯™ú•n›r»K·m™ªínÝ+G5ú¥°k‰ne2åaÀv#dªƒí¹©Ò5â\Üek&o±“µjòÃ(—;5šµ§ú #Y¶sGŽ£fz*ž‘Ž(3¢3rFN-ëÑ$ÄاaÝŽˆ¹_¹)‡HÂ)ösj—ÛìyŸ2%¯5VÇ8P7Žd½—S× žq„¶b„D¯"{å )*̇w׆¿„N$ƒqÒ1Î;x¡Uùzl$lyª£°¤t·~ÉC­/=÷UÙÜW2Dy`êýf‘DÖ_¥¡%ÝÖª”ÁûªgkU¶Û¦1zûÎ1nmBö`œà³ln€TË`jOêHZå6_.£týäkës —¯½â}¸pç Âé(X±­¤Ò*òاž0 ݨôl€î€¢g£N¶psî z4ZµÎ‘„lj4Ò=°JŒÿ7™É>\óªýT§Æi7J·Ý(=Û;¬ïÙË“­^Õ4N±”²ÊßžoŽ²‹´Û¤“žMº.J:Nl‡õH,·m.û…pª<ŽõuÛz 4ØúÒ‹#›rö S¼¬sä·° endstream endobj 915 0 obj << /Length 1262 /Filter /FlateDecode >> stream xÚ­WYo7~ׯàã*ˆ({ºF€Öi§AáÚ ŠÂ1Šµ–²ÞCÙ#®ŠþøÎp¨c-Õµã@€HÉor¾á vÃ{?úi6š¾Ó!KxªÍLG!ü€E~ÌýD³YÆ.½‹¾Éçi—Ž'*Š½O­i¨÷¾Ï33žHá½&Á¹)LÚh®¸_Í>Œ~ž¾Œ$hL²H¸Ï#±y9º¼,ù&¸NbvoW•Ìch v1úm$œµ_F*Ö<°+”/x ˜%\Á¦§e±·5îá\…‘CÉÙžoc %O‚@aÕ¸Žcòÿm›ÿmÝ4Öµ=°-Ù `åj@›~ûÂË»ÛñD åu·;ÒËËìnl!eà­î±[7ÄQKß[Õ=-™§m+Ónî j'rÊ[#J¯^ ´)o™ÎIKG –骨ӌ'~xŒ%ªíiÎéR^ßšXJ‹º¡¥vò¯´\nKWc¬0(6°!¥¨ë;¸ ØI¯«º)Ó‚FèKK]t[gsË16›ÝænA™®¨sm¨Ch è_ÑSå¦êHžWÔf¦3ó.¯nܶ±^¿«À[gM{  ù,„®qöt¯‰x¢9ó—¡íÝ‘»øÃ{fp·?Œy(5Ó1Ä#L½üäGl`€KÅt˜p·ô X­x‚ `uÀ¶}ÉŽ€—rW ÊýHó$Š×Àa‹ƒÈëüxØÚL ‹ÁÿÐw‰¦TøEÔ&ÇÑq՗צyóƒê!üGãøšKHÝçiÿ¬0Þ‘~ÎY œð:kù’œ¤Ìî…w±{sSjš¾0G[JÝÒa¢o…k2Œ¿*%¡82l–ó§° KøÙ­ó·ÙÎA.±Ù›VÃtrS@&.ã- îF¦[+¸øôëùÙ õO~üøÑÅôá²ÍšeSÏMÖ7NNwÎ1KZeÿµÍqC›×Õ\­ÜrªJçtÊ:ËHWIì@Ax80q½¢¶o‰¬`SJ’û¼È&óÔU ('XJU&[OcÁÁÞ+j¶Uˆ4[îÜÅ¡áêÁñ&Ô «iQPg'’w•¢7]³ûá(Œœ ±V‰÷YâÜ”ugh|¶ÅÀá ØK$Ð!lmñÒptËe•|,©Rj<Å´s«ŠÂ1ºS3¯Ëeßa ÀØ|Ó¤% ðêaKÙjŸ÷kËÒ͆šî™TÃQ7‡B´Uèù£Ã0_À¦,kLÛÒD õÛ ¯Pû¢8ñN;Z”»yÊ”ØrŠ¢¼BX(lk•EÖò¯l`ðâZ´ ãÞ3\IdYØW¥‡‡B viuÜvÝòh:5¿Ïïò¥Éò”ƒ~{7S”LO7FrÞöçÀ¦§<¼ßVi“˜k¡_Th`µü¿‰|IÝj”YÂý>e6ŽáY¯6 ~t¼É¼­¡X§æ›×4º<þê|wò{œJ‡<{'’ð±˜¯ì ¾™ÙŽôjƒ¶“"{xRiAÑyÞKßÏ>ϽKR~Ó‹`û³ó)øP€Ÿü%´ÿ½†Ÿ*ð™%ÝÑú<€ä•òÎÆH†˜ƒöõLŸd¿XþrGaÁÁÿ¬µÁöƒ'J2‚J) áü¦Ýfï endstream endobj 903 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 321 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16677 /Filter /FlateDecode >> stream xÚí\纸Ñ$'¹'÷Ô{Ï9÷žûObbDéeÙNï½W±÷®ˆ€" ((((½ÙƆ=lH·£HSD@:lŸùþ3³ËÒ‘5Å÷Éû3»³ÓË3ïû}³ B Žã°@z5À.x¯tttxÍZ6eш97î``›÷ËæÍ›çGŒ<[ñÑFÌåfSù] „÷JttôêÔK)…â£Ì»Èfª?Øl¶Û@@€m° Ølñk´Í´U|„¶€x߶±ðY¶oÿþú“••ÕÚÚ –Û@@¼CÛ˜M^¼®?ëׯ?{ö,XlñŽm¼&´?aaaçÎK€m À6`° ¶€Û€m À6`° ¶€Û€m À6Øl¶€Û€m À6Øl¶€Û`° Øæׂ5q?,‰>¸dËi,=µ!»1­%àäÄ¿·»ü·^šp5‰x]@ ¯M:¾<1'© g*Ò®?^¼q_ÈùÎô¢îÀèƒYU©C-1™³ m?{uÂ1rq1ÇÖx”PL}TÐ31Û"}èä’ÍûÂ/JR z'ßv¦xiïÚòOΉ8×–~W6g8 `°Í¯6R‹Ú×rÒ‰˜tæâ}µ©Tr2‚mÃröT,«ìn¼Þ”]¹ã–$!¯)ªÏœ£Î>Íå§Ã7À6`° Øl¶Û@@€mÀ6`l¶Û@@€mÀ6`l¶Û@@€m° Øl¶Û@@€m° Ølñ«âá£è#úé-° ØâýF>JIF)ñ(eÇ  ¶Û€mÞø/¿•]”‡RRPÊa”rvPìA);Á6`°Í¨"± Ý\ÓùÏÿ×úõÄÿúêÎœõ‰eè7f›³”UÄ!° Øl3Úˆ¿ž3L³“¯/>LÛ•ß D‹ð[³Í™Ái!J9¶Û€m~šmÎÄý`K<™zl¶À6`° Øl¶Û€mÀ6`° Øl¶yO¶I.$Þ¿Ýß]Ù6Éwĉù’·ú+8µbXÒmQbþ[­ÛpÕß6ÉwˆùKÚ¦'–›tÛ`›wi›"”°k‰²–{Ìwm›´q“ª^xâý·xpˆüƒãK]**ºö+âòúºý°NUÍjÓuñH¶)E«–h*$¦Üïo›Ë…tÕ{G=Û`›ÑÚ¦—þU¸Ôb*Š¤™Ì Ûìñ×`úÆÜ!Gè3>("‡ g€m¤3—-®mÚì¢e•xo`Þ"›Õ°kE~šy¯Õ¥h¿ãùÞGýFHî»QÔ´ä* üÃv)Ç"4uœ"¯KnT¯mÈÕ œ–qWúT¤Ü681óŒ{ä_OÛ`›ÑÙ†¸BÓÊPàÆMvÎn–žþqù”‚ ÛÆoÛWs̱tòt]”°ùöP¥M1J>}ÊŒ™VN®K’¤ãô³ õ½7gîuöð°tšºpwÝæ×Á¶!/ùR´5딇·…½»ëâ¸-yØ€µJºÙèén«Ï¦é[:˜¹ÇõÉ»¨.Zeíäæ8+&ê¦hê,_ßð’f mã¼åo骥–ŽÓ7lȔ۔ u‘s-fe§ÜíŸÛ\{âèá± íä6Øf”¶I-êšçÉd8ÏÛ³4*ÅÅшn¹.¶xˆÜF›mãdaì¹2aQøv;3]›•Ûóû~L'bdkjØÏ ›‘âáfÂмùš(»×6äÈ1‡ö°´4Ç-ßvÀÓÓËnŠ5ÍlsÛ£aá[èZ U)Ë·í›ìí¢£;yCn#åóC3YÓU­ýw¦ßN”æ”ÐR »f{r™úŽ3Ã.Xdaâ`hLs ,lm¦¥§«•ë’¸Eñö–Žé¬Ø[ø€J*0ÐLÇ~÷ÀJ*§Ì@OkZl%ØÛŒ¶’ºÝ˜ðCȱz©Uvœ»aHŸ8ïlÛ¨jøìmK“þáì“©tuÎÊ3iý[Qújs¦d§P_RH/xb¯Ç¹çùé´k2ÛãÜCK¼ÔY^Y©ÒqÊ:üL”µÍ·ô³MJÊ­±2Rs)•ýðü.–ŬIEý*©Œ²×n¬InÉUýÿœwü雵i uÒ•ß–µG®äX<„mT5§î}-ݨø›´™Va—x`° Øæ=ØO.BM«·îž°qÊÒõ>ó–êÒ•fìá%n·ÑvÜx»ç2/­´Ö˜èžö2£O”^Vç 3Þ)µ‘˜LU=÷Qz1:™Ò[IeÜmpfL°ß^‘YBÖ;„sÖšk™ÈmÐö3 h“¼¢ó‚3¯RqÅÇÓÉÀfáö;ýF`yD<À¥iû_îqW^•±ê¶ÑÔ¶ÛH¶“•v:Y›fr¡3l¶Û¼JêFµ.mæ1'êx`ÆÕÕq» “fi¦´O*™´M½c¼m|MFIŸk¿¸Ü\m’מæôbiûê}R™¥UVêÊî©5¤‘d}R΃ÛmbOÕchqõtõô¸²0Ð5vœ¹íÖ¨lµ'­­¿¦§òJ¾Ù`c©5´mÈVbYŸeS° Ølóžlµ3ÃÐñ?ƒÒ¨ÞŸøó· ‡¶¶Ó¦[=¹MÉSKB,™õéýr›FÆ·vÛ_ ¢r›ô»älûå6ä8lc+¨qÈÜ&d±Þ¹Í¹-Å…çÉΠô222ïÓÊ–þFÛl9@ä6Z«®BK&s›Ãæ6`° ØæCÙfcz2‡®»æ*Ùÿ›VŒ¯òbÑ”fìâõëà–µÛhúìjL/%¥”x8VGÓ ð|Wjÿv›¥3¹ ›m;JÈqÒï”[ª~íšðälú5¹mRï¢%“5X®IeÒqªÙ*´Aí6Éy/mL4íW^N.’v^‹ƒb­9Ù>`[†¶MŠ?}]Ÿ­6-áÙ¯]‚6ïŽ×¦Ýl¶Û|0Û$]È×ehšz.›oo£ç¼ú¸‰‘Ž¹[€ÿ)^ZQߧûVjëºxÙrlžff aèº1þÐ'µãô®Žº‘ã ßå!Ö–l¶á´˜ëXo%EÕV[³qt4-<N÷ß`ibí¹Üƒf•4°O ß’JW×°ô ž²ÍÕÅŠ¦i²â´`T¶!œVØ5Ë…ÉàXMH˜6wŠ±ÅlsØl¶ùe[‰Sˆêéø¥©‹=ç/ÙY‘qE$¤zÌ^½äDw?ÛÞåºtgrqËÒµ<箞v"®p`]#[Ê•»óÖ{Í[=mý‘˜;Cày´’Ž… W,ÊjL+êÿd Ù-ðßì5oÕÔÐcqù¶–ZÎÁ÷Úæüq·y[·Þ’Èué’û܈M9ü~}RÅ(î;øYâC†|–xðï—xTøÍ3ï3ÉÀò»7ì<z¼Eös…9åfEŸ¤ÖsKîó4`¿·ýŸ%î]DÛ$_!m3=¶ l€m>âï€ã©í3<¸ #÷…ÛN$™<ÙŒiî=ú/n¿é;àñ§‹–„†qtçííÛ`›ù'¨o.`«Ö˜êš9.Œßv ”>½­mv¡-[–qt–ŸN*…ïI`›û÷m(±}^TïyZI¿'¦m’wâ)%=³-€_œÀ6ðkZðkZ`° Øl¶>"ÛœJº”p}˜8¶óÖoÌ6¹”mŽ ” =q¾çüõ:° Øæ§Øæݸi’v ÇúÃDƒ2£q¢ÖoÉ6·)Û$÷DJÿ·»À6`°Íh[Pî¢KŒÌú0A,+áîo­Aõ•ÏHã$JIB)?öd8·?Õ€mÀ6:rPJùuõpÛÁ6`° Øl¶Û`° Øl¶Û€màZƒÛ€mÀ6`° Øl¶À6`° Øl¶Û@€mÀ6`° Øl¶øÝØ&9ÿHmsló!ˆ÷Z˜pr@Ì‹Ø={C&扑ûgýÒë°|Ó™ôT4=4é#Üÿó6íÓäZƒmÞ8ŽÿFnÚ½¥ol‰vt°773…øafjbgkCüûË®†—×ÒÌLdhÀü8§‡Gè À6ïC8ƒÙ±cÇzàcbãÆ©©hݺÕçænY·nØæaûöí¡ÀÇDDD&a›Ø`° ¶Û€m° Øø9¶Y|LÈm»BØæðmÛ¶ ÀÇĦM»Û¬_»Ba›ììl°Áû««+~QÊÊÊ>äârr'$ ’’Û°çåäççÐo ÀÛQ_O”ÏpYðÞyù’° ìÀ6€mÀ6€mÛ€mÛ€mÛ¶ùÕÑû}%|4_]Ââø€mziÍ[ï2?A8êñžX>yåQlD)ý<#Ðà÷i›¶›‘¾+ÒD£¿ ÕFÕ>Q¢Ö§†šŽ5o—n!Ô]sƒ¦îó N øÝVRø…Ó€ÁwúØf¨Üƒ$¨;ÍÖði°ˆ~s:u‘j(ÝàÏk~r~‹¹MÃQ×è,á¯Äµ‰S¹–‰‰>‡¡5eYLU_‰Z+7-rÖÑÖ²´°ð^¾ãh¢£Ì68a•âЮ&ÃĈKÓÑ[\ŒPã…x#&“Á°´²É%3”º¼L?]W×H—¦kî–žS+]4¯2oõL{6‹ebȦ1ŒB2/_Ñ7`°L sóÈân8‹à'ÙF"ùeÃÞ¼’ÙS¾7Z-@èÞV?šÝÔfYMÕ½Ú›í¶.xõㆎÛ>å‡âT††ººc’tÆé!nƳ$²OP}$ v{ƒ¦ºolN¥¶,ÆòŒé»ÂC«YZÆ…]a¢óm¬=:©ä«9 ÷½zz5Õ4tÆ_›>· r5MM(>EGÿ2±y3*)ù ¶É÷дð*{-.âó…B*]!Æß:§•Ëë¦ýÓ4Td¶éîhí$í‚„ Ö›}í¹‡ôEýÍõšê>Ï¥3’[[Û¤¯ASñ)¦ZÖC1»ÎöžX6¹HÒ¾ÔàëYGÉòëÁé•Úô9 pÀoŠ7¦rÛ IùJ}¦¦¢©ÛÌ䬋5íÔ¤ž*ŠA7ZäãßÚa)o·é¬Íð6b0膺F†º\÷ŒÊþ¶!æU\MwУ±uÙ††º†úl6]ãÐ}!±fmOs»è2Y éäm¥‡_mà÷ŠÔ6|©šÄ¼—µW³w.öҧљ!'^¶qWžÜÇ67b-zlÓ¶ÊFÙtþ®º–¶Î®nÖ½ÁbÜ Û Æ[{¸tZ쉢ÖöŽ®®îW…ÙLõC÷EAÝ,eçÕY¯Zڈ᱕Åa]­¦h¯N7as˜»nwc÷]hßùgSíDâú{s3·Ø§Ä»‡çuÔ\*e• ~'4uý'ì—Ô殚iÏb1ÍÌŒô¹:îs‚ ¨n!~ãÃà6Zêª&F†nó·fïöøÖ0JÚsumß:ÚK ;'×Ôë 7w/RŸ¤:3éG¼íÞcÕIªZ“JVµÈ•Æ ÛÙZ:LYRPU»Ü…­®ÎŽ»Ç?Ÿì¯¯=ÑÂÊÂÎÅk_QköV?ÕIꋉ^ÜpÖURVÓš±ë ø}0ò÷ž†|º¯ÏgÃfø‹½}óD#LÀ»ÇÉzßö¼Ã©ÿÞ¥p$¸ÇĆãB!¡1Â1L UÀ;4¡<#Áø" ÞŽ:×îÊxN~²àÕQ„fp1‘Ã`XÞ|áÕþõ«ªÌWX#$ÛðmƒcDÑ$)æ=ðYUéP39¸ÒgåC'!Ãþà'Kò‚‰P‹,]éi!TCü{ *>äùäÀ*ç j—ÕÕnËŸ8\j|Çn:îäHÈ kÓô[í’¡{ñal#›Ñàù^ôpËÊØl$îœã>·zØb­oE0ÄúK Ük|¸ÂæùTMZÖÝúá³Á¡§–…ªÉ æüæAŸF{Îõ¼‘ üë¨âÂGwôq Ç.2Úf¸îzžÍVó|>Ô‰Õ³ïF¬y{ö&þ†ÂùÝÓŠu.®ÐßõZ&+Lv¸*ê®"Ñ“XMe—ž{–{údnÙ—KË9¤ðG”yGö6Ì)üuP¶ùîsô‡£—êú/E_( Oj=yÑX4u»l’éÿ‡ÆÚàýgL‰P˜&ëÊÃAÓ‹ L&ãÐMÂxxÑFç¹=åœpÍ4c¿7‰W'6;°8Sª¨¼N|?“¥¦ªáLÚFðhGÃôôkéø6z.;¨Õ»a¢Æ8ú@Ö¦qxËs«¹²7]W­&*Gµ“MKw¹ZVW;¥¼š¯O÷–íÆû§VÐ ¤ëÚô(ÿØé íLЈғQi-ºr%% ä]èáË7¢Ž¹^º“É:dùMÊrW}Û©õBé&–ú0¿óÛS5 ·Ù»ÑÇÒv¡,³ê¼l¡¨YJÖ mÅ5Õ¼eˬ»ÌfÑ÷å5µ>9¬«Ä8#Û ¨£8BCÙñ>y^œ6TT]sºF:üܦé 3‡Úêðá¼ÜìÃ×+º>Ø¥ A¢UO‚«&SgþT\°ü™CP•§ÿ#×VD¬XŸä ƒÆš·ãé±(†ž^q#.ÍY»[êîÝ/#Iª‹ªÁšòëPü|/ó{fv i›Ij†9¯ø²ëôY¦Š¶anyÖãÕ)Ú“,ï’JnµU´M(‘/Eð,“6Éö>5ÅÁ3ŽeHGO}e‡•¦}1Q÷ƒMeç§ýSì!J‰µS'¡˜::Ñ›Èt很´Í·c‘i°¼jCŽêèÿŒÈ"r’ÉqÊz:+»êÑ;”èß•4œmò7¸¨›y5ÊF …b¢àGíúã<öVÉ×üÀLMu§Tê>ÞÝÅ'OT±€Çño¬2¥OYK^N׌Õ‡Këdû‡×% .2~w·ñ£,ǹ¤‘ 99•;‰øC×o­¸ŸmȱZ*ò–{è3YKK3kks†ªSòcÒ¬]ÏãW¹kkÐÌ,L‰áfºtýA¶Al“Œn<ì5ö…Cèà)„á#Úƃ>5ô²¬ë·óº•¦Š™«ôÀ‘áh©Ï`š<ìîg›æ'W—ºë2ÙÒ63 «¸R•ÑP¶!2qÖr7S_qÔ›¯Ñé»s 3 âüì†>Þ²ùMq娩,:ûô—º¡r›Œ¦¢€Z]ít¬6MÖ‚Œc —ŸONJ ÇÐêi÷a7.b¨MÛ{«×6Ý…¶½¶±y“mžO×Tšs¨ ³¥©©±‘Œ&òßnIm¼ö¼¥mv.&›_Î=BÝ<Ä “›ûÛæ\¯mf™ MD<„Ž¬A Ÿ¢Æ5>ÚŽá>¹ ¹+$ÂöÖ¦â+GVM5¡Ó´V&®­'nÊŠko÷Ú&g‹)aâÅņ*拪:x@ŒIîšëø¬Ìm:­'/<ØÊ„B ‰£mÆIms|.SÍ.¸®›˜šÈ}°« ™¬yÃÛGÂf”‘‚ ª{·²ìÊ8Ž$o²Í´õWe¶éºi¡4)ª ¹ùucï±kz-Â䶹KLþ–Í–dµQ+LÔ ›¬Æh„Å«Ñl¶‹‹fs¬‘É©0ašé´•/zD-«ÿ âºÜï­Æ^žÕ[I=×þ^ÿr'YIh«{¤G°·‰Æ¡WúT(‚N¾Hz¼F´KEÿôyˆJj‰-úó$è¹yG{‘¶¹'”URæ!½÷u;%ô• ÙPœ—IŽsµC6¼¥ElDm?½’±¶†êW­½½Ÿ)Ë]-œV Q×jýo\ÒŸÉ—œè¢LTRÄ6­Ð§{Çï™gg¨‹Û¯·’Ê*£®Dq‘Õ„‰[ŸÉËÎ|ïSÊjšGט}àVÏäM+Ìèº å¶YJc.PI!ÚŸ†~,ìÝ—£§©††ávéÛˆfè;çàKù˜ü®~ß>©Ä{HT`1abœ¼—ËIc¼kzEm¼kÛu¯3p­iO€ÅªKÒEnòдŸÝÙÛ %inlÐsùa*)²F‚2›ÃÖVz†×xVú†–ûµà äã}¸„ìðÓ¼“Ý,¸çFÓr Ï’žy ‹ôY6›ˆ;OsÉ6–²Væ=>Õ*Ö°ÞZGoÕ9øxXÛ »ã9¨—•×¢8Z{KÚ¨³Etlµ±Š}¤tšálÃ+O }o˜Ç“u\<:w`ïÙÛC¬r”úìψÈÆ¿~A™¤YÖJüÇqè9ÕªÓ|}¢€–Qû‰*Ñ—@Æ esðù_ô¹ÓP]5‚œƒ©'Kš‡Ím°®õ^æ³¢xŒüꌸ{ÍTC§™I„F³£™tç²vòÄ|q.œ¦¥¡áLæ6{½ÌÑÒÅe…MuãЖó‰åònZ¨jïÈ“*¦~.{œWò#ª‡¨e½«£µ–qÐ âêKvPã.Ù-]‹KÉ~îšÇ&éÜîžZMWwyB¶Eáõ¥9»üÐB55ÞD±É¨ŠjXn­Fé‰èj¹ì;Ì7S7Dº=bnC^è;ƒ¼uÍ·©¤öu»†ÑâÓ8ê›ÛÔÍbó¡Z–pASˆ§³ƒ•¦éZrί‹·ÐÍ ¤÷®^ÛSç˜ËòÙ<…ÍJO@ññ(!Ýx ÿí'q¢éWÚó÷²Mû›‰î{36^ÝžÈÅz,-}}C‡±0|gƒôhu?·ÕûnÎV²±·8{«%}×@ßÖÕçpÑë’#«Õ&*ùn=‰º*æXª+*©{ì(DU”3.×É:?Ÿ^b¨}§îì/F½O ÕŸï¢Ç`1 ¸4Ç©‡®–˺–ñ^jÿ59­æƒÙaØ…ö=Á•îU›+á“'ˆ}¾D¼ƒšuð ážîëûå—/Þï¹-|Èõ-W¿íwô‡«¤=«ÿ¦Óhtç µ¤Ú‹É¾_ ·¼!oòé¾áö>Úõ~ãHø°C‡yœüWðtFXÖ°3êÙWC>Á8ÊïIáC½øËw}ŽúЇá~fÐœì–wˆñ3™Á•ËŸXu¢n ï™­³rš·çYQœcô™‡¿‘æNárw—þ‡“ãkß½ºÒíhK¡ ´ ï3™þÙß”üµoßofëä‡âC}‰ž*¤D·_ÿ¸ö©_¯§~# dÀ{° ÙN#ĺ›$µ¸ôÛbÐ À{Jnú½Àq¨¤øuƒËÿ‘¾À‡‡?ÀÀ;Ðc˜ ù_¨'ÿ8¯aÂàKðnr#ÿC1."þ'ÿ›R„jp &Æq° ïB*8.éD¸‰õÈS!ˆE’ÀßéàÝØÃÄbÒ5H,Æ&Ïm$DfƒHá= ø•Ž‹qÆÃù<¢l’g1†ø˜H,å•mx7ÙMSøÆÆS…b^_¯ÏßÈÅ…}R¼ƒÜá ­ùW½‚^û£º»I½TU=ÿó_^¨j.’@;1ïÑã']ÿñyû˜/êmŒ‰·|‰;ñCë—Ÿ¼TP@¨ RÞ ’¦fÞ_¿ý¬åÕ7H„|b`ݸ¯ùcÇ6)|‚!!È€wQJ‘™K½¢¢ècxc:Ò25$FŠþ€}ö O“I>ï}Rü|ÙPÁÿáX«‚!œ.K„áMŠßbcþ úT¡54BŒ$Úm>Ž3a¨ш#Ž®Æ4>ÜœñŸ:cùxø/Ò•£QnÙOÍ~Úþ©ûí—ÍnÈÔ¥áŸÿ}¢Ð®  Þ½¿ýó? ÇŽ­ÿôaÝK1&€ð_c>:‚Fy ¸4pÉùÌm¡Ñ)ü–[A ýs„ÃÎ@ØŠæ:¡´û£^b{ÊšÀ­'nò«O¬Z´ö¾`ø›KW®¾ñ¸uôóø|Äò¨‹ø(Œô¶W">ô•,±¸åÌž¸ ÿ¥¡YW£íŸŽ ykÄÊ]ç«ñQœäŠµÜ È}Øòë?wÅL,µGEŠ?û´û³ÏÚ¾ø‚?fLÇ…fÿÕÄö11|wá×—„ꕈßrrLÜâÆ4/ødoèl3—9] g-µ9{«øÃ΂÷ }­€äŒz™ÍAÎæ“£²º&qU¯u?â«ëžçJ^~sn&Z©9¦â#šâètõÝ…ÏßzowW^ÓÖœÚ0ÄgÍ®tc{·-ñ)±aKÍ“¼7—à£zô^¦Šá Ø]çi­µ,¡lä9UgL5õ¯o{yºŸ*lü œ½ä÷¤$ÂÒâα_tý¬{Œö¹Bë¿ÀžcòËšð¼Í{+V¨J2!ÇG¼£=°P6¯.¿Áñ7äô¢|§—ýÏwòEËigûå]‰œ~µU<ômÆ6=×Ï ‰È÷¢'qË¢"qÇ\×Oú§WÃTC¬¿tЀÁ7ä¶z?´Í¥ÑNæwzÖ¡±d7“¹ˆ7Ø¡§ç)2§T‹do²—Nd¹VvKÞœŒTªRûØf˜qÈ¡û—¹z,Þ;²ð~5ÙPûï·Ï?Ä€µFì3Þ7Š¢O?‘|2F8F¡ÞÁIøÄ'ƒJê]Ñ]s=hš%M[CKCÍgÅÖŠNŒº<%·ŽÇ¹˜hëêq8 †ÏŠÍÉÛ?^¸öÕm ¯ìžïãlkmLçšÄd è|tÉÊÎdÒ fe^%.å›G·»™2tõ9LgQäîFžDzŽ¦/×Ðœ{îhB€‡“•)[ÝÌgÕ£6QÛÍý†z:ää†ú‹Ž? rÛT;¥ñÎAÄøOŽD„ Ö¼uM8OšÐ^JD_}‰ÈøNÝjèÍm&§ ý‰h,õ‘_T¯N_\G¦Š²I8¾¨–Ø,oó¬ãE­ÂÖûA±g¨1[çªüQã½;¨öô$¥‰{®Q"”4Ø´PŸ££Ëe0™ŒEỨëXÒù<~•—Ž¦š¡¡ñ܈CÙñvê²ÜFrmÿF[®›Ã`êèø®Üòä5‘–w¬pÐf°èúºNóÖð%HÜZ™¸fšC‹Ë¡Ó˜Fë3΋¨lÇçÒÖZ²59\&C‡1sMBm;¹¼êË,›I×çrŠxù1³¿ÓdÞo$ÓÊÚ ÷ æ+ErU=ب¨n}¯s¤Œ/Úðou‹›Ç6jŒ7 . †tÕÜZ7ÓŽ8zL-Kçï5 ÈmÄ-ñA~º mr…YÆa».Jpq —ÎÒárX†\ƒKr”•3.¿¾~`¦ñ?ËöUÉXwÌ%@>+Œ Äu/^~ñ™xÌø' Ý ’šjù+aHmÞÖE=é´ÙÛÏá¸û·Îd°¶åÊë’­leÍ”Âv±XŒ$‘öÚÌéqT“DŒªššÁœÝÄ]U"—¦-£Ú–¿&Ïnñ³$íI–%òò®¹ËU×Þ[Ò*"&ç=]b êyNºÈƒVswn &!.œÎM6ß›…Þ$›QîFk*;=Æ¥¿&‚=8µ'óÔ *Ë¥àÔÿ‰ °í¾·­îŵõšZ~Ïûþ”Þ{Î*𞻘ðØ‰× íø”ÿ©‚èÓ1b…úå+ëÆIãÀN¼®$¯æÚVtØ jÓöÞB=O#àÝ…6*ã#…MÌDm›­=]85»Uµ ®>kío›çÓµ•Œ¼¦¯\¶hÙR"/ž?™¡¢u°ž²M¸ Çk¼áj’­–mœ°¿mÞÐŽy> }AÕDcÆÈŠ£»BÒ6ß( ™Ù½·«™Æè_Šˆ¸X#…? ¦·ÝG}r$(eDcj«Øû-=p¡ µ[ú”éÅà[½7âk[ͤí6d)”¼RWKƒÍ¦s9 ›®ç·VÜÏ6Ô5Ûò8bŽ SG‹CÆÖQsJ~L]˜G¢çq´Ôå“,Œ`›¼ÎqÐV\p¡‹HTšŸ¬ó21p_&+O†·Í$-‹¢FžtŸØ¸€©Ç·x1uì­\>Ï‚A›žz zm#j~6ËºÏ «º¦=Á6=óUW‰* ×·½hƒº–/uÃxê¥1ÑtÊ\ùy2¦]q¾ùƒ6Y’ _ü÷ÿ ?Ãóië×ã:ÇŒ•|òi+]C$|-–à$ݼ.“¶±©à øuÖ†ù:j3öÝîµ ¯ØNõÛ°{rÛG´MíT ¥)qGîÜ̽žGÅõ¼ëyyµ¼Ÿm‚“!¤^âÏ ç/QÓkt(¼×6_+ ¹zm3Ûýsi›¬ >¶éû ´øO´ Õ ,l{Trë‡[§;0t8ÆqWˆù–»(M\—ß×6æ„mˆù‘Ž*ºÞWîW6¾nnï긾ÊLÇgx`nà sÓÔõyX[ßÜÒÚ)숴þVj›ËkÍUçÜ(¯ijnéàuý8ŸÉš7²mćf,Œî )°URÝv·ã ¶Ñ¶,k’ÙæøÆù\S»ìœëÒc———{ãæ’êFynC«uÎú~Û+ÜÚÚ)h·÷&Û ó‘L¿ýÄ‹]^t—Í'¨aOÜU&ÎN?—£÷<¹‘—÷Jð¡\ƒ“-6D¥Ô}5§ë³?J>Û¥ À;r öoÿ%óE›‚‚8ÿ:qÈùH ¿oóN¨8¶™¡«WP/–欼Öú’¢b’¤¹ª¬=Ñ[IÕîf|Ï:ÕBVR£°(ÖVÑjëÍ>©°X ’H¯ô‘mSÑ?}¢’Zj‡þüÙP#ý$q.i›{”m¾ƒl"åýÈQ}e†ˆõÉI!ǹ͗MÒ݈._F¼Ÿ^Iá8¿«­“ß{âÅ.²³r¡¶åœq“ÖÊ]¶Ë‡¬¤ˆ%ùн¶í™'/Îˈ5e­¤Ç6Ye”mÄÅ6ŠŠ›åõ^îGûΙ´Íë {oôLÞnËà.ècæÀJŠXÄf]›Õ }6¨ÜSuÂʼæ¡6thÛÜߨclù¤ëéÿ»;y¸¼•8ñZ)*ÆÈo Ø#_Úw®iÔ¡“ mbò—EY\-ý‚Ê;tzV¾TAÝ¡¦ß¹¤=îíÚÃDB 6 ð=&6Œ‡ãB„ñ7nêóGÉX…z=Kbñk"Äcc?­SS'ùc¡ Šw±ÇÛó-U5fì¸(°/ÐRSߟ85ësCh*Ü“²çAø;¼84ß(œj%Ö6µé´ñzשΉG§éÚúgzˉvg{m“N3¬mÅi}oZÒsWÝ<öƽ!Öy½úüïHúG}6úûXÒ$…"$ Z‰ÿs<ê’nÚô¥ò£š¦»¢1 Èy}¯”‘w¨Ý!*¼p<·¼}ØÜë Ÿê0Å?]þɦ9æ6ÞÑÄÊg…š±t§×P›Ûy'ž¡ª¢áLØOqÔÖ]˜$ùÙqîvLºKu噪ÒÒ‹ê¥^ÓißL? ½Å óÜÌÕMÈ=!‰1W6:*¼è`˜‹-“î#}[vr¥Ž†§47zý¤ðÔùËírñ•žŠÚv9=vy´{¾²¶ea+ÙTúCrƹ»oÈmÈR纹’Ú¼´Òw][˜›(–ç6w‰ûŠŸö7³KöÆÍr63R3¸+ÍmÖM3wµ•|ýêJonCv ?s1Й;g‡íV-”Y27s“mq«ç±¡¡özÓ3©ï%ñnœ;v«²û=÷EaJrõ>ÓEcj>Q@]u1&yr_ô—¿àŸý‡ø“/xÅE¸#Ë)à]ð:?ÝÛ’¡ÉÔÕ£)™:Ϲ\G=Ó‚‹lYjÆÕvtq2×c;N[œ_Ceã6ý¿I&÷Zz’ݪôï&1.?¥ž³Åj—ZkMÒ`:…HwzØBcŽ–ƒ™.ÍÌmöÅ'¯¥gØžŽ¦S†üà]Þn2Ñ4š˜Ö]>ÓT]I“å¾ù*ñ.ÍAe‚Kðí6Í·ò¿ÐgAÆ¡ïX¨ð6ú»Røotëú›rØ‚¾ù }ÿ © ÆŒÞÒéNÕiþrø¿hèNÃP-§­ 4ÿfý`àBŸŸUSWÝ—GšAðèÄ 7¦®¾ƒƒ™¾Ž×ü«ÔÅÔU›?ßÓT›¦mcifëz Í}‚Ù6bùö»j0,Ü,¼Wmï|˜®¯®dé>»JÈO˜j4IMÛÚwE»]Ù`D›`íììä`–]ygß|-%¹É:KÓuU8VNnŽæ3Âöu•Å²U•í§¯¬ã£×/Ør”4´söVæÇÎý^‹ý QLm‘`øl†š¹­­­GßÒ9.KÚ\/N2ÿFkÞž!΀ò˜¯'Sí6²‡yîdN±f1 Lœl¹º†«¢“mêÝ/&.ˆ-&ƸæoDS´uvvt°Ùx¦úÆÎ9šÊšó’ ·c7’üu4&éëé8}RCCegN]oÙîo:þû¯¬6õæ-‚†m«gê±i¶ŽvÆ,-«É‹oÕwK{À'«ý—Gjõ{îøÆDÔö¶,ñ'NŒngwL$àI„" ï…¹9‘ÞH>QhöBVQ`›wÓ&/k——P`}ž¿’6×SC±Þ/Ã1j,yÕAŽÐçCŒ½ÿäÒéå³Åz#ŸDÖÅ-¿§Ã›|5tÃ1\"!“ÖÞÔkb–Ò!òO¥ ‘?FÛ;††y@­ò̯ÝÕƒ÷Q¿mìÝY&_Dï`j_á˜|/È÷!NÕwÒM”¾”ïZùwÊËöÓË;î1Ù!“Å{ž‹ë³ç{בÌBZL =8dpŸc:p½sÀeǪï)Ó³Âý;5!Þ¿!Ô3ZŸƒúŸ}Ò•~\–¶júѦ÷yê“ëCÔH"ää>þÛ?:Jp!NýI—šŠF᧟6~úùãÄPJïš”åîÇêĿ׭{¸oÆú£%ý&úWÄ!SÜ~l{ÏRâF…u“-ÿÝèq)&¦ºɯ*P_ÒÔÑý’O$ÃUOÁ5À»Mò~ö7%íÛ÷›Ù:¼Ož…¿×å]Rä_YÀÄ>ùŽñÉo²ñ†wâtÇ'ŸwÖÅl° ?'¹!ÿ’Õ,&¢ˆÂp!ñ)D̶µ5ýýïäCÅ•eÐÿ ÀÏ-¦d퉲#Ù?=߿팎mðvÇD> stream xÚì}XT[–î}ýºûMÏ›ž7=óÞû¾7Ý3ÓÓaZ” ¨s È9IÎ’‘IŠŠ "˜0 æ„€ H1 H$g(¨* Ò9¢ª¨Ô{o{íZ—ëWuj§µöÚÿ^{½×†a9ÉINr’“œä$'9ÉINr’“œä$'9ÉINr’“œä$'9ÉINr’“œä´L ?ýH5®¨y]Í[ë¡´dŸ*ŠOk†ð'Ñ_¥$„V{&ò#ôiý%«.è˺åëÑL¼CÐ*ªËÿ$]k¤úÔî^ER+Z!švµ"¡ŸT¿|!Í5eûÄ_ç}2@}žbCpÿ=Ÿð}³¼õª{¦ëè¾øðˆÈˆˆ¨Œ“·™<´3!zslhòH”ƒ®¾dB<Ú¾ØÀco…ê‰üß}ï„Ìž).çèž(ÃûÊ 㬵üJ\ ÒO‘1IEC‚±7°Ówë,ÑôãíUC½óËO†_•Ü€°·-n÷Š—¢ €wå†1EƒàòÓƒCc›é0„ê˜àÈnõ@J@`Ôî{\ŒXx%h=¹d‘ѧj`ú{áW‘~‰Ø°£ƒý <õ0pƒI:o]:ÀÿpЊXÏøÜ)«#wÙeb}õqúJÔ5Ââ3¢\,]¢2‚ô@σ 0Ì›)×S%§e¡ÌôôÊ÷èø}%E´i£ æVŸƒžFüÙz$_Á¹ìXâh7-#› ìsFfv ÖŠj. û‰”y ##ÿÙ$RÆÛ²lÔßsøøQŒg¦…xÙª¨<ýˆVƒ´Ç€@$8ö±„óÔ1–ìÉ?7¼tô-(ºÁSв0ß–A›Kë•àZuÉä‚7P»?=ùšu8ÝÔ4ñO=„$:pà`ΕyÞ_ PdSmîV C·ìÜ,+=ˬ½±:J©7;0~;-Ô³;ÄäÕÿü‚­3¸€hÇ£l5ôC·%¤gd¤ÄÅØhê8ÇvNóp¡c]IÕò?-®Ø‹þ¶ Á bV˜F?Y\Šî§qe7¹ÓVYD"½â ½³Jа٠0ˆ9,ZäÁƒÇŠ_ Ã9Xé‡eúÚŽ!‡1½NߟÛÿ“Eëa.—ËA‰Ëãñ»[m Ÿ‚ËšûÈW,/‡É@ø¿YI·aŽƒ¤+ÉÇ]~‚–‚}ÅÍ_¼^¤Ìe´xȼX~u¸BЭD_»ÐCÈÇ›±®É¥³04éAUÌn`##N[ü`Z&³×wR,÷axÃ>ïI‚Ï‹Y¥ô"+Œì&>QIQc!I`Öιí€Ef Žeë¡m†:[ïðøê+Ž6(»sÞúJY÷ëA(};-«äõ Íªu­Æ…€“õ¼n É´Ý!¤3q-ÀŸû%û‹‹›ŽÂŽæÛ˜¶ðda =ÎÙ™~ëínH6êŒx©h^@†ö¨¯…'ÂLÛÙ-§pŽ EѦ2ÎH…àü’! i‹.fÞñ\xha£M¹7±¬¬¾x#ZøàU—ÿ4É~-N¥*ðϯÏGQ5 6ž~îvfGE)QP´á½Êþ3Ù!?ÁÅ/".>l AÏ:ÿùG±…*ÝMö3Ø’ˆ|¼ë–\Šö‹ÃÃGÜ*hƒô3o¾Û@H*ê©;NÔ0~3Å‘(ù ѧҀvoYÑåýøk ‰rçõíh3÷,y…ØÔW¼›Ì²/A›UëúR´A‹¸oh™;º»ØêYå?ŸBeÚuâO—»û½£’bü5uÌÎ<ù€&>ã¸Á0yI€T´ŽrAýiÿ’¬¾aŒtä&û©jn‰Þ[ß7'Ã=1¤±)±‘Ö$Ž60ëyh Ûš|C¥GÊ»–ËÄF=»í¼ª’né—6z;RBìƒö• vÞM?Ý”‚[®ŠZ_‚6æuès–äm'žâP÷·‹63=ì|«gñ/ìT3Àótµ(Ú c4ÕÃØ!†oaÒÚ ’æã<ß® f‘çªZ l2låJšÃƒ×=7Xå,#[š!R…väÄ+€«þˆ?Ïô·ÖÐó@m›ö\%e Óíü®:ã© ;'1ÍWÚèh{'ĺYDç½Y€øš‰Œ8ªéHyószÖÔ-jæ.µ§j[èj¨•ÔghcµQmûÚ†"eÖ¿Zà-cˆHjÎä+ŠVÔµz´69"£÷Õ1/5ˤYL2"€TNO3#å=E³û´†ªC'ß®ÿ´Yµ®Õ¸XÚ, …oñ9÷”ß_wvzn‰C[Úw^IIÃû¿¿š÷˜+¹žÄÌ‚÷6šJ§ßpp~êò‚@ÛËkzS}ç3wÚæÞq÷j[f$×rM×ã4”T“r²Ì\»GfD²" ªÇ\©|úäI-NOê ÎìÅõÄ˻ȇçý¬ÕOjnô) MìÇò ë þbt¦M_ |5Òe§ D›l4-®mÕ¯†Öahu´QÐy΀'e©kÙv2¥¬¤<ÒÏ7‹vÌóçcsKߪmƒH–ÃZøØ7ð± ÐM(Cև͚N´!F4J0o*öÞÓ;@ÌG'2LØ´G€¢A3S²hYh3Øpø,ßFŸ~¶pCѦ#WAÕ¼uQ EóuºI%S+4“M»v8ÁX)Ð"k¨|'ð]t¨b¤aš² –w)ÔEŸlâ9ʆVj¼T´±QV×/SKß_;c yÀÎÙ'kCY‹j;Á^F€~l¬†Ø‘¶~‚T)jÛ0>ÔXû÷v-mµRÍÿٶͪu­ÆÅ:ÐÑ—Þèéé©;¸•hŠŽÊÞó êV]K|䞯 SÐMbböÛxn»€e\HÒSÚ÷’)ûUŸÈ«$ìß¾'W­ ˆA{ËW¶‚Ù÷$Î׆B€¢ëÙNƒD»IW„¨:: 6¨^ FΫɕ¨°”j¨àÛ-D.b5io ¢*ÐUy4ÝÃC¢hƒ”#&Dêy‰»Ú¼Àzøf¬Å+½m ¥5~›hÃ5ÖÐwÝ™uôø±6€~â1´¡?7!µ(Z8Q(ZjJJN'«àm …bY'Úì1ÂѦ«úZô.âÚñÞžàûm:r7œGý-¶Y¨*œë•þðNœÇö«-Îë««z4ƒ¯¤*æetqñ ÉŽºõX~²µ±g΂„ÖËZImP?ÒÍ“êÉÀ&;ó‡õ¯[PjÚb«Œ/®àW€gžSÖ´|³Š Mí_4H;xøF^›MMpƒá‹ÐFj]2¹‘€l´AW¡³þ.šÚæñ{2sŽIó·§8„²1´Ù@pˆŒQ© ›¸€e™©Lߨï5‡”ßq^UÏs³%G;mÇ(:v7æÙ^nJÛ£‹^Žš£Óe=2š;åoæÒÓÛu$Ćd·Ri¼‰êé7¥È‡§m¡1_õA§„hƒ Bõ ½ BäÉYob| ‚EÐí”ah•÷Ü«¡ k¬I›¨u¥qx±K mÂo4®öêü›AªÙçO° Nqe 5Am[Í”• fV¾#GѦ¨yì“Ц(YG›OòPÿ—*ĨÍT ¸òÑFss[ oFƒ¡¢êÍÑ&sûÚ_ / Š‡y‰Ñ– Ûì›x{M/ñhÃ% ¢QýÐwò­…pðÁ»õØ6ëóÛ {tXMÓìé$o% t+Î ô>Õ}5Q€ƒ$ï))É|JK5ŒkiТ´º¾Ôo3TC  6Žó¿vŠ&ØIAú“>Ú`n–P²ÊÁWÌû©^®q—%Ö­£í5©%%göbh³4Óÿ¨à¬6ÉÔ%ðØõJ–䠃ش±¶.Üöã{‰aö3M¸Ö­ê%¦u’´¢7~Ö›3**FO°8ÚÐÑ´ŠAO_%@rÀ^’J¢Í'ûmøhƒ–Е bó¡ûùߢß‚®Æûš¦ò»`®Ë õ%VRðR°µFdîkA71«Kϳ x^ Ú42$çËé‡A ú)‚( »M6âh3×Y@Unˆ@wSTtÝq´Ù¤¤u¤[sÏwª(»ôŠ5™bK?Ñ„Tr Câ$z„|º Ú -ât¹k(Eó±Ù§»Ô7™<ÑèïÃK|3΀bœ0»:¸ã¯u@ +Îp@¹“¼I×sŠ'6 Oy¨ï|&,YÒ«*ûñêu­ÆÅr‘«¡Í»ÇgÐßJñ؉>ÚŽ!k¡ üìRà~Öךp®ZmK½ÍW%h™úìlŸX”Á)D|@pXâ-£ÍÇš¶½ìµßI5gÚ¨¨˜W.ïtä²çÃœõ7§ ŒI>Ú :¢îô±·=Šý"‰6ý«KQ¶mƒ¥á„;žþ)k£Ír‰ßÚÌ>>´QÜyüòÕ3™Nî5§T÷k_.£ ÷•TSÑ Û•såÒ¹Xk%’LJ9®$ÚÀ]›7);oÏ8VØ,6 æÕU#³®×=yëãinÅßIÑ8hj[xÊ=»‡oÄvwuÐu C%Še„­É®#.Ì´ÖÖ>U+¶~àáÇ'45½·ùÙ™:lMð´U1è^ÀöÛ¨·lß™$J‰ñ¹×Ÿ 9„Zš{§saáÞZÞ‘@Cß]˪-Ëo£¨¶9,N¬ÐÄ„û®.Jy³ÇšuHZ©Å­+ì Ì¥ZE$’ ¼P{#ÙßÔ-ú´„¢vVä€é{&î"ÐŒV›¸óÀYözmɺVçb=hÃj iSsn]9ãëhzóôŽÆǯ2º.ÈB¤ }OÉEÝ6ƒ³úþWšøð®o|n-Låæo·&;$¥%šêšïM‰²U=öÝ…ÖñáîJ²ëF5ÐÃ/hGBbTˆŸ•Á40sT°œAx¨ÀO]yÓÁ§t¬ÕÅý6¢Â§GÃëYIá2`¼:§¡BEÐÆØ#(E¼Èí G§¾Q/ñûÇ×w¥$§8õ± ¸Ó'ì>pöýÍùØÌ{Âe0­çÙÑýˆHv¹P4ƒËma(--­¹—&,§÷Ùµ´]©Çî½–Àç–‡ûSwî{Ò»ÐWw* {Ž/“ ÏfíÜ™rìjÖ’˜œ3ÍÅVRd·hæúñô¤»NߪåHS?æPËéìtc»€Ä£îÌbÚ1Z÷§¤îÞ½KœRN_}«ٛø|\¼(ZSrlòÖ°µï\L=vQÜé7|8agšd™©»v_BÆé@ëô´Ã“l1gN÷­ýÛ“NOcíÙ·¬6XÍÜóY»ÒO]áq'¦Æ½^Ã^Dª =óChÉbÕ¦:ÇZe¼Ê¬ë2o-.„.¼‚ô'_LËÚn3ßQ‘‘–’’v öby²ïÜ›’zxzèÉŽ”#Ó‘-v]Ú±÷k¹Óþz÷õú¦>h  †W3÷Å›é™$ïÚ_X÷^Àìð¡I‡ÄðxêýsD†";N';ŸžÎÉ@8ß›yäÁ³w¢•¼y¶ïÿ­{ =ñØ!'svìje`š¼¢Spªl’Ýêáƒ;ö¼_{ôäü.AÃW¨lbü‘ ‘™äYnÚþ;Í°œ¾ocë“6ߎóH}0ó·"šÕ#A__SgÚJPçÍ$ô}Ÿì °Ú²ôiíçÿ*§Ÿ Ú0g'i ¼¿é°F^¯¤µœ¯¬©œñç'3“,tÈÛo¿ÿFwzbê+Åsï ¥ôKñÝQG>ª¿^´®ŠKËãÉE!…˜­g’’SVPbú©Å¯¬©ìᇩI)´|efפ´Ûã’R¤QÛð¢\oå$'9ÉINr’“œ¾Q3Ûæ4ÑSSVz¯äáËîq|• ±†Þ»w_@÷î× â6!ëYIÉ}*}üì%èh~Zzÿ^éÃÊöٵʑl—9qÿnñ8ƒûƒøJ{'ys#%%%ÌåcìC]u9ÂXéƒòÆÖn.,|3M«,º+ÂpÉ“ÆvṊ™¡¶’’GôÕš,š½¤¢æé»Aüž ÐÒ"1"t·ðõ0 IÓY_ûèÙ«e.!]PR"™©´¡^šZn¨Hšâ‡ãܵëº/H_úðQSë;þþº•%»Z¬~Pô¢m\4ŽÐtg}ai&ìÏ&¿ÂÜpc]š§é !BmDBõKêÛ§¿I¼™í*'’3'/?;m )·=Ã˾©£¸ûúûbäíµå`=¶‚7î–®~ø¾>!)G1yrO‡T=7Ÿ@gC€L:W÷qµrVÐåm6ûžÁ?l¼À…=fÀ®âWÜÞ'¼œàŸþ©8¬J ènvt°0Ò§jÄÍ;†8¸ªuÚ(©;{cüú¸Ú™QµµŒ]¡un.]Îîåîhh ’57GZâò™DÏviM\DÉÉÎ.¯ Ýf}2ÊÓjkÚÊ ÐÌÚÍU,—_V9<ÿn öÙÕÕÙX è[ºbi6Ûo}ËZ³./Š Æ¥—­…±.U[EÛéqÿÒJÇËjåÀpɾ­DKŸYƒ°™âŸ|ûK„ù¾ú$‘¤¥«§onë`idˆäÒµYäòg4ö€#I!«=Všäè茶ÆÙN‡¢edå„}vŒÙU¢SVßY -uÙi“µ´Ì_ÌCb]©¬Zu—§K‰OTkG?_Ÿ-îfƆ: ™hýqŽûéó?7Òqìõ·6 ɦja×;ð/ýå™;rи‹Ù*@ c%ê/}´À[M#? \û3űwž/Û'{l­2y«”#þ½çÖ.²…ß<´6Öà›. ©&šlãM8t²ËÛ Á¨ÝŽÁ^×9UEý›¯F…/æ'>†Ú>iümcÔsÞ-¿YàÌ4;«+o½3¼N´ÏΛzl¨dî“»(¹Ú äò9霮‚6áפù+—éº`¸ûžJ¬QWðžeûi~òVŠ› èðvAÒÀY­ôæA/’yðeœçò$k5»Ý4~Ç}†0¡‰Êl‚*%«¼}Qo6| HOÛÜoxim==};âHÚÓÌ•¡rk M×qGJô;;uÍv׋æ²R5È7üÏ%"6¢Â˜ê=àJ&šnŸD‘Z©È+ýçØÃe´ aúÓ_GÁïó”É.S+~`¼Ø®`¼’T$¦wé`É› ©±™s£ã“BùLßóý‹aê’ÌrľC0'ÒAkÛéWø÷÷ê¨?<¹'ÒÕÁJ]U{ÿÝÖ7w³}=(‡è#L,ÿTwM˜“! £§«M1t ­éÆ9`_?NVUÑ70 Ý§ð„²º·mðÙå 6<`#å׎}Ð: Ͼݾ}]Àì1#ÑWE†­ çç‹))šy-”¨å{½h#ž)qòõ UvÍÁ«ÆäYm>ãpͧ×ÅØi¦l”P+‘xÍ8B à &DSuCsoïhhêV£11!YÃ|5a¢ºÁ‹÷2qˆÈÅâ6Ãì‘&*œ®Á^¯¯@üÉᆥuvŠXëYCÎʉêÞ¡g²U/S¨æõšç\´UöÝë[3R ¶üëu7Æ]ÅΖ2N¥€Ž.¨oé]ЀÍ×ÐbùÙ½&º ®¾…¬²ûÂ$O¶Y<e:Æ3¿°úò·“]"Æ_ßq· È`Ⱦë4l?æx±Ÿ’ãñ·5ya~aqéÏ>ÌâkXhê5bÅ—Uî ÷ ?}¿™-‚ѳ°°8Ú^nêî¿ÿVv9âqeæŸémªæø½Z•ëR(õؾÐùÚ$u•Àƒ5Ø/=ÎJj¸’²Rð¼Ô‡gÿX¥f{‡™ªíªJÏ°£W w©©k‚~wÑ~žè)((B½4$âÍ#Ú€•ó2¦1´jûqG%ƒøúÏC´ÌÅ> È,}͹ÉÅüQZdAk¡MHþcˆ%–‰Ã…ÖF›O¬ëÙå­ à?½md”#¤©ŠxÅÞÃDÝÿrŸˆ`?Y˜wÒC{ã΂±}ÃH2¬—}Ïhƒ?@½Äc¼7ü:á)=~¤šŽ¼XuSo|©¸j\,”ÅÔ ÷ˆãÈçì`Sï$ÜQØWs h5òfß>¤€àKþ¾aÎvý˜S­°m Þ­$wªk þñî#øAѦ1;ŒŽI7z‡{ßÄšjD]C%{Øô/ÿ¥sôö›¶ÖâÜXueÂö"ÔÜeõ?UUU5òŒ«n|Ó\{×Ñ€bê¿KèSeõWÿˆŠêî±Gñ¨¶²Ê¥ùºíµwÐ_+OØÖYK¸ýI«Â§Q\9s,7øÝG,((ÓBÁ2áö²r±#›{Ñ 4Í(ša‡í•q´YÅm.D´¥A6ü·¥Ž„ €PŒ¶†ïìÇûmP;þQ˜ƒõðxŒ††aÂæ³ÐiǤ/DßàGÜ2 5TUDé”í̵І¨©¡"N7ë‡×D›O­ëuÉ~´`Áë,GtñîB%˜xÏ‹”O&Äê²ÑP8òrå1Þ5OŒ¹ñ½£ÍÍm:ºa¥øçºÆ¤ ‹¢hƒxbg{,+ÖBTªG#\m‚ÓaΠ#Yáx벿DzÊÚçß–(:×›'ùpÃfc¡RQ´‰>ÕÖœ i;´#[– èå‘pe}/šP%& (Ñ®eÀ\Öâ‚H¿È ¥G8hÀÙ¦H\‰ñ‡À&ò…^¶¨D–¦?¶=.Á2Ë¥ž³N›NÂËh³ôº‰Ï£Ü`Ø$(á˜õŸ"ôèä»Ê7ó*Dào—Ï ç‚éqz@È•gÂrJ3L%Ðf%ͼ-C´åñ{¹Ìúp8m_ffæ¡=áD‚eª¿¶*êM œ4 dk×€ í8v}Ú ¶z¿-¤ß…\P\Í–¶¶Ym¢ ^­ê£’Ž6ŸZ׋k è#†j•r„ÿ¶_¬Ãâ_I{ÿ ËÞÍ1»d£ 6ölµv81^˜†–¶6ÙÚZSÔÔ<Î"ûÒÝà f€²ÕjÇÞc=|/±‡Ž½k¨’:ùDMï7tôš(NU6ö_.o–:,Õ”¯.ûcqM@ÓÚíóÝ\ÁLycDæ,-.ñ#,b±ê_)©Œ®VŽºs”\ÏHGú ´ñ-qúÎT^?ji@%xAb§!pé©ðÇ»» ×Dx¶ Yþg=x+iùÌ–‘UÌ°·³ÒâP ÏçÙ6s(mþêý6ð wU­÷?ÉoƒÎÜï«Èí’¶é…ÞZ* u«iTÔgþ ÂÄ|z. oâM ¿ ²Ì1CûÍ÷‡6hñOl%‚ºÆFB2ÖÓ&í­·mÐf¨M5U¡86Ж-²þ„¢šyëüQÐe)¶ lú>7@Ó4yîsàG@¼¥//Æ«j?žä~"ÚLn7Öp9ÒÄçÿjš–W7¿ÌO&*³ÖsQŠdó‡#b¯–jO“ í¸ðû@|ÃXØfbÈá¢ÏßœŒÔ°f‰¡ Ž$Ó¦„ȤcRÑoå­Ö‰[zPÇ/ÝÇX)ñÆ€@Ÿ¯º¥ží¨~9+¬ëÒŽ-ö!ù~›£¯IÞlà“ C§?jŽú(k{Ý.{\ýàšYÅç(꒬Π(RÒ.Ö<®)<¿›¢LÈx„mü£õxìÃö=¬z\ù ÀÏ0 ÉBÕq¤Ê’¬ê¾3·¬ª¦üÞOËíWW)Gl` ß"o²l^‡mÓïKQ κü¬¡¹¹ñÙ…47-»4d`¶")GŠê^¿l8àìiú¢ÃmºûiLÌöîi®Œ¥ý@ˆµ2AÿàÙk¥ËJŠoJÚª¬ª›}ƒ½öÉA“Ë÷+ ¨¬¦A¼šN«Mj‘ùkª*=*/¼qa‹lüš £‰R•IûoW>£Ï_õâûm ƒD¨hBLk¢ØÎ)G«ÊËD*yð”±Ú¬^—‘Kp%FKŠ²“|•Õ´3Ðá#©é«•ƒ ±TWÊæmKËØÍÝéBÝs~M‡‰la²¯$¹)*“s.Ü+}p¿øöžP[E‚éÅ& K¾&ÚXoR ?w¯B ¿¥%m£\VOiµš&î‘]xa¬H8ý)ªK"RMßÝtôM„Ú¸îÊ}R]‰ôôý¢ ¾–J mQ+£cuîv‚¶å­Šº—-M¹IU Ÿ,õÖžRT2¼p·ª¹¥åYÕ=GCRB^ ,úNŠÕå««˜[ÿ­ø‰Ñîj¾uÀÖÂÄÔÒáðW½“­eážvÆÆÆö^Q•3"S?ãÜžp c#SûôKµ‚u?Ì¥en÷5362·vÚŸWÅ^µñ6Ð} •ö•Ïðs¦[ ~›çfD¡ðŒ+!¬õàó˜£9IÁæ&†F¦‘{ÏÍ°ùÑVškgªodåQÚͬʶüÑUÀhK±©©iËÈj§qîDú8™›[9&Êa ·‘v»©¹]Òõ¶½*)ÙD„Œ]£Ä·Jw»ƒT~ cc+Ç-Çn?½0 ¢UÛ芒ahÒ$Í…„`#ñòM¶!k z´©©ñŠ<:€÷€$Ü 4µÍ(“óúë2·ŠÜu¬Æ‘~Ó¯¬rv^gõÝ0ÕÒ¹þN¼‹ŠôÈFç:?S˜XQ³íåñ[Ý-21·ß™}cFDˆgÈÛt¬qQÄÛƒ>Ém‘…6"‚W¤¬œ,26ÜvkeꢦÆþ7`¸Ç‰dÞ(¾u,?‘™ijžÐÐNhfí¸ëøm¦¸/­ïée¯ÍƆž‘默&š BÜl Íì½óÀ2ðâLâÏðW÷oUtÎ~#¾hõïâem¬“¦•ë¬yP¾ÏÇÐo,q³øÕÉÒ®É#mðYcŸðëU‹o×nÌ‹ÅÅZ+m#´fqÒ“¬ÅÈZ­]»/W6ûûªk½÷­¯ZÚ§ ZE»Vî[kGÜ' ‚$E IãbíËÃ¥²¼º$ö±Bò@9ßõo5³ŸNÀ_à‚g’TRòî×7Ôß=›¨®nT7#]!'9ÉIrº¡÷Õ™›¾g~ˆ½ÝYîa‡˜²N>Ûêz˜ß~l9ÉIN_°œƒ~Rå$'9ÉINr’Óßqæfffgçy⑪!‹†<¥/|c&”,£w /24„íÙYÚÜü" 9±ªyÄbÒfé¬Ï¶¥XÌ9¤.6WDô<ò„Åùdw^³d{>[F—ɘÇ$1;7Ogqy_ns"’¤ÏÏÒ¾(N/k6;¿ô)•ræ‘¥¡ê Ã\œ§ÏïD\ÎÒ ™¹â|Iø¬E¤£Ð s3s‹Ü¯xvZnT&‘©­Sbp3[«©¡î~âfÅÄK«‹ùÛ]ô"`håhoCÐÔÔ3qºÞ½ÆÈ-JÕRtAoqe 6{øýDhfïµTQ'’o4 ‰lÍ~C&“ï¿š\?K³U9Û”J´çËh|Ïsm’†‘¥½µ‰Š:ÉØÜ·~öK]`Äõ³Tð;ôEa[J˜½‹ÖŸ¾a¿#A…b˜Œ ÅÁ¢}d"ÅÆÍëÅûù¯DóCô‰ªÚÑWá…öOìw1z_{–LvE2ŸqÛ䆟øZÑÆZô1£*ï™Ü{,´,t <£NJŸ²¥½¼ƒ…¦€Œ·ä²²H}¶¾Û…¤GYu"î6ÔpŸ)§Oó‰Ã]B=d_Iuݤl7°$«¥Hîå™h¬é*h´ –Q³TÙ¯N«xU¤™Qco,?žy`Éë)YÌJ~ËÓü¼“ q{^Áך=#ñIö ͇dØ+< Ç‹uÔ1ôÜË“Êè)i5®‹ ¯¹Wðð¹äþpÉwÄbyŽX[.¿Ä??Úl˜ Kí$i\¬±gZåí6$õÉŠâ›Ò:±ÓÂ~_%t“¸Â‹lm¸‚[ݽJ ®¤I³æ¿´±P4,»¥îzœrZêF¨±þÞnQüÃ’S:›’ˆD2`”z¡v Ó¼©û[þ¸9w´½ØÅL‡¤IôJ8Í=`ÓúÒÃ\´" J»<+Ø&6ÒúÀQŸ¤¡ DeO×ÇÿA+Ís=OcÜ-H$hèp±º 6÷÷éjE?©ÊO1ˆš eá«ÑÉŽ /+]M rTÎ].74ð⦇….@2²ª{?É7aÞù=Éur´1ÒÕŒD"›ºïx?ͦwV!3D Íø±}ZÍ…É ¸¿YßÁãðíZÞX“ººúÃ7|ˆb7üwuGöÛ½=TuÏ»ýWw(b)šÊjøÄ"…ñ[êÿNFº8G‚fQôÐMÀÚ@²Ä‚TJÙVw1ÕSÅÔ¯2F[“L(ZZZzïÙüöDW÷âöAs= ™&^¨åWÏ;í¤I$;F¼êiÕVW/h•Y¡Îa9¢ãˆÃ\ªýÒtïH7¤P-À(íâ“EìòfÄn ²UŽ>Uë «á2Óúχۅ%Δíú½¦Ý(—¼Yekö,«&—… FÔÙ–s‡ÉÁõNjW®@ߢÚëû ¢Þ!ìbVbX)…ïâW8ÞŒô×£Ì\{% "ÂÑ4Úr/@»“ÔÃÖYöZ\(¹Ÿ‘±É¶Š {#D—}ë£EML0i†ÿ)Sô§úÛYT-‚&É!xO 3’§^! «¨-w¥ªê%=ö3! }4HÑ2 fu gîÒô¹Ý[A’&‰HÙb Á‹­ºÿ¥Z:ÍG®ë&uíXþÖKïOWT˜Úì^DÏZ§a×¢5¨©©=ëg}m¶¹õ9mȉ¬~{ÏNÓ­hÀçöù8_>ÚÌÕèlPÙ÷¨kjjj²¿Å¤•‚Ý~H®I£³Ëgæ晌¡x£Mn§?`X3ì júgMOOMŒ '{X8m;ŽY¨*Ľe]33Ó­Œ-ô•-2ž¦«LTU<èššžžì©vÐPI|„©ŽŒMMexSŒ.qVéJQ´É²õLÞ¬CTq°«Üœ¨œV4„ M˜#1út7¿¡/Ñþj£q˜cû,ïSe‹ôyDP·ýŒ}âfggaN×Ú\LÓÅ#Ã…ºÊêGªz¾˜jô$+úœCyµJ從¨cíÛ=<>==S·“¢oý™¬æÚA0´329A[b/öURŸŽÒé ðl+¿ßy“ºvIy“3ÓS“cbœ(ŽÛ–ÐÛÃI ø¥ÉÜ·v ¶1 ƒê…™-»7¦!ÅÆÂñ¸.梢¾ÍÊÊéŸå|}hƒžþȵöÝ]‚)ÕâNc¹Ö¥í[p´XóƒC˜«ƒÇEäZè¥ah¹IÕ¥W0o—¶ xÜàaN«Ñá!îôäpÞŠ"8„"l¿:A°ô¼<MæhÆHd²«_ßÙ®eˆÌö•¹v q  š­ÐÙ¨^0Ÿm³Ìÿâ „²ì69œêæ=jã‡Æç{ÏoT6¬Gš­Øúý]Ð/½;¡®â1,ÍXí©¹éã ºáêÚ&Á;ö\-®Á­Ÿ5ÑùP#4JÆRÙ¡‹W8v/L‘ŠMOÜr"Šd΂,‚6²ÄR•kRg6XúV+¿þZlm4Fè­ÖfGEyaYwÔ…¢pð)ÿHíø«;(}ÕöôfŽ¯ƒ±ÂŸÿ˜ØŦeß­yÃŪë<£f²œ®ÿ¬š²[?>N}ô=bNâ²\xXUï°ƒ§ÐŒ;UéÀãy4Š6mwÊ]gcæcÞŒ™—¯ÞE`WfWŠ¡HE£{ájp ÌÞ14 –Š6h-²üóëð..Ùh‚|Zb0÷ T‡vEhk5ÝÚFü&¥sJ‡x“nÔ™µÂ“SNp²êLï@Ð&³¬MPÌT0Q9ýÍ¢È,3=ûöêYüAE¯¦(…£ÜÛ ^®1çУ<µûMüãYRðh½‘zî'«WYC_%ÚÐíW· XD¦ò¶3j&ÈŸ·m‹`%5Ô%m„´AÀ0éŒ_1¯—,”iՉ͠[>îm¾i¯P@~§P6 ]‹÷3ÇθF |6˜ìGP9^ Ú{FGEF éïé@¡˜÷qðã™7„n´74 CA ›!u“-aQ‘XÞˆG3C T£P´Ù@p@;£.RA7qAÚˆu ÔþìAZ„‡.EÓ8nŠû©hÃÊN&L‡éç*Yô9Æ+ÓÞH¹=È·m«‰Å5Ÿ#0E¤£ ’Æý*W&f‹NèÁç£Ñ@‘po’Ï*4ñJ†H îüó×¢½,©M§ØKj]‰óÓ22çËiS˜I‰Tž¥ÓS—€z]è"SFƒ©¦†C`^ATT˜…x±f"h,Çô^6ohÝ5gAÐäS(œ1? ÅØŒÅê ‚}=´å”õ¢÷¼K`ÒÎ O p³qè§GxŽ~"„¬~®—}u‡û–äbô˜m ÷WUµí›&Ì—]R¤  ªánк*©ZZyU]t$ÃÂBçé(‚Š6Wâ|̓v/¿ù(öÅÑ&ÑpË)êÒÀÀ {]‡Á‡ÜU”w”u,盢͠mЦÊF©î>úû*dÚºè†8Ú°ÖB©ì°xË#yºí!h©««ñ£Ji «yuªß-ž8Ú¬&e$‘‰6+ѦÞ@‘t_ˆ.XÐW1´‘1'?HÛD¶ëeÃ×ãý ½búEécÿ<¯B;,k9VÃtÕ6%ãÝGç\t|Î<†%ÐFIíö(,îΔٕh³å–Ð^”¨ï+‰6¼µÐæÚº¹¢M‚>à'6ÔNº N™ FÊêgZFE{n”Æ„çQ´)j[mÞ£hcüaAmÔ7źǠUºN´i/;uª»ÆétúÌh›ƒ®Ê¶óm«Ø6ì‰ &uSKsâÛÌÞÜMÓ&2n>ŸÁö´M¼Ûhªkä܇ {ÈE‡’tí)gi‘17¾m‹¹¦Áš8Ú4ÝIïÞY:“-åNçuÚ+©¤6ÐÅtcñ£µ6YÒ ÓZ—ßM¬"$9j¬È¸k  êˆNð1´À…WZhA™ÁÖV®Ûjð4ÿŠ“e/ñ™XO]» ¡éY:cúX¨¾ÇYö*])î%¨yUˆ*Î ½°ÑRN»;Œx ÔÖaëA:saqiáÖ>W\mÖÏ…¨—øŽ®’Æ©ú1¤mŒñ&7‚RÐõœ¢O.Ä{S7 LÓô}õ75ZÚ¦×6¨—8ÔX×yÏ Æc~nö\”³Žûv\S› õ=uƒ/ã*“ècjáeí}sDê¨f w?~röµíôk§þN½ŽïM¥EPTv¿Â¥x:ÔÑ6è6@æ/&{ªH:Æöy5=œÉgfdÓ LzMào‰±B´);l¬bsôä\¼QÐ1N½ôb 5Õ v½‹pWÕ9CMU -½Ø£÷F*¶"+)\íÁöD‰î>W¶ÀèpY€65ª¿%× ü6‡ þÕå6‡”û®:ÏÞˆB "Yíò+ÛøQp?œü­‚Y¿¦þN3µ=xŒ½MJ!7úÅÄl­ˆñ¶ÕTSAV6d]‹Ý§Š&é|D¢½{àlH!T—]ßœýÃ&«q¬YD©¸£«–Æ[µU””ˆ§™2Øá°xu,øO +mÅΦ=†¿×Oa/´«¨¨·ð#áÊËæ<¡ïb¦éŠ®š‚¦–ÉÛÙåöˆ¦A¸ qT÷Ý‹ùœéŽDw# "ÉÜ}{KG“t¿ wéõ£K[l ÔÕÔÔÕÔu-\ÏÜo`²ù»;˜c»ƒìHD‰ í:?Êàà38R…_úSQàš¸Ÿü‡?ýÅíZ¿pw_ Ràá7XŒÒ“ñ€††ª9tßevíƒÌ®¡;IdÍÐêŠó)ú‚†¦Î; Xˆ3ÕºÍÙP жp~ÜR¯…Èð%Â×â>7luƒ$*NðÝwà嬗 ‘õõè›R[™ Úyðfù6ÕœbCf¡úÒ^Š&‘ idTÙ‰…«œ{«¦¢r«Aˆ“Þÿ3å%¶»`ú• ßa.sìT²?H"H@à® # .QÑ^†¤‰¿Õˆ7©,uË6RŸÏK7^Fok)/¾®7à¢Q;¤º/ YùdíÜ[‘~ù‡922!|þ²ç9Ù[§ÖèFV„QVÄŠ’¹1LæfEHV¡c õìs´žmRÄ"û» ¿s“C3 Âùº(hxhí]mÂè_²½ë«5[4Ù§ìîƒÖÙ°õ‡Ó¤oG\›‹uvì•Œz$6bVU‰®¥;xîQ[ÝWßæí¾ë£é2@A-­¬›>??ÓßhN¢ìº÷–Ó6±@púV #—¸‰d-E/ÈÜ¢m0Æ…åå¿=ZìnÇþÛÂDWM€­A“@Lö_{ÆâÉ£Bü¸€Ãšº˜HÖ hjÃ3>ÒØr¡|“ýü VÚ7/„Õ×/r’÷€œþhaþøž }išïuHÀ+¯Ô]ãùg º<컨û°û¤ì_X—œ~@ºo÷lœºZš;ZhƒÔL±S¶Àÿñ;ø?6À‰ø€kË©XøÏÿ ÿqœqO ŽEÃþøwÿÛ…ÁÌϼݑv»ò;¾?þŠÈ%Ö¡÷‡iÎç0ûøŒ·ýŽŠÏ®ò“²WŸô²«–î¯mŒQ$1ݽZÚ¸±îÿ²š8ð(SºaÀU~…6ã¿ÿÇwèEþ¯Aªè×_ýþ%ö|û¾¶›ÿúõdØ@ ýðÝo`4† ô‰h#rÏ?Úۭ팿"Öðf,47 žì7'Õ3~¤ºÖC+cGÀ?XöwOòÏuÉ÷W`Ô"ªÂ†‡úáÞ>x–—˜,£ ú ‚ûúàðŒ@Y™£po/úì&Ûñù…åˆÜ%Æ8V) —eI‡ ©ì¬’}ácf‰Å¤¡]56±ÄáA\Ö$ÂÂðè,ªW?ÍÔ‚01gqeqdtnùŠzhvlh|Nî3ÿáÉå÷ðûŽo좊Ø6 Xã×ðÏ🾃ÿç?Á7°ÀDÅX³=hWFPø¿ ÿª°=–¥Qðßý’ÿä¿„Óñ¡Dñgð?ÿ3Ü8Ú6»Üù þéÛ#`á}½ sðÐLì Ñü üÝ/á~.¢ƒ&¾2¾-‡à_}ÿ ‘ÿd:šì,z­lõÏðÿü%¼ûåJ¦ÇÊwë‘5Íœ·ØAª[ý¼(Ú@ÃkƒÚ–îa®‚–ÏÑ ÖÆ¢¬Í(FÖáQ‘Î&d@Û¥žŽÖ6Á_›J ‹ô±3$×û–hÏ ü<,@À:.a×ów­-­ÛMÃ0åî7Wp¿Ü·SsüMB’2¥Fµ ³ËùóoV”¨£¾m›.ÕÀ9bšuœS6¤¨ë+y¹¼Ý $‚¾!án6Æz&–õý̥Ѯä(g’¦aLòî‚ž¹¼4?A;$1åt z4`îy¶1…`ááï  hg}@Ëï>¥ ír6Ô2>ãØÎ`ª¡ÙÝ3»¬¼âOdï6Ö!&œkAÃu½9º²Íиh]èv²çbôâ–Ð3]Ë'½søAüg}]‹m1†^»wÛÊ2NV²³Jöòl JÐåÀ€ÇY)Ö»î\MtLÍ:žäcA4õÆ&„’ c-¿~â­×|ܽÈMð6"Q\^.á½²´Sû÷æÙr0øa-›ŠmèØüï‚[‡áŽr>¶ hÁgÐÏþ·á¹9¸«þóïavN¿X}n±M31¿mƒÛÚá£Þèß+ÂãÈé9úù—*p?bZ ŠÿþÙoaìöIø×Xùu‚‰~¾z 6'ða‡d· ˆ9®†¡Ïÿ·bãÀ†Šðw?‡“"à¿Ãÿ?e¸¦—Ÿx· úÄ&Ž @‘SÅÆïáUÇRF¼`šn7$OVó7îõ3qÞž¿|#*]=šzð|%þëȳó’^ç<<ÞR¨ê÷ &À›'÷_©€8ƒv„M—ÛHÛÊNîËC¡©¥`h”ŠíEæ^ó¥%ñ븥®n† íÈURÒ ¹Õ‡güxsëF­0X&ÊãT)[:ø«LvŽ`šˆû éþî÷Ã+îLœ}ßÄ? Á˲œ?B?öVWñâk\x l2|ÃÁgñNSùÀ}¾{êCá.U=×)DZ}ç7S«± aÐèf ùÅÓTì 2ðŽCû£]J›§Äëâv^ÖT1,íåïb­Üç á†ÆæêÉsS¢FòwíÏ7lVW’Ž62Ø‘•½*×$›õàᾺŽi)mH,Ä;ƒNÞ”„Ým)<Ð%6lã¿ßàZ¨nËëÁe;ú¡³ojQŽ?è»ØsùzÔòŸd*,£Mžúùï5àÒðÐèòbdm´Ðÿd\ÿ#܇%*JCÆÁošQýzwFªg‘ÿ3Ûb.—|‘}ãWcù(T8Š6UçèçŸý¼÷쉵á;Áê©¥Vø j}ýËÿ‚ñðîk0’—'Jƒõ7P»}Nì¹ÄJj~zü}Û놆†šÛ§lá2><Ñ´v_z<9=³°Ää¢o5×tŠ=?46I_XŽÄ%ñ†;p‰¸É²[bVï4 ÂDב« fÙÁ+ã¹Þ&Í’øøfŠefÑ}v¡Yú‹¢ Åc|õðØÜű¡þ×-MÍM¼½„Xâ´;í h€uƒ^\GØyÑ?7ƒÑÒ\‹åâ Äè;¯ ±¹‡ k.â šp?œ‰&¹Dpe´ùî¤H]T±w+è†>3;7ÝÜ ÿ‚Ú¶G—ýº7£ihƒ/™V²Ã‘•=ætŽƒ÷ä|­¶‚N-ƒß«Ç¬ø‡éÄŽÙŸ` ÓÑ[´C>“ÃÀ‡6&˜ßõðþ“ŠÍ"+)Dä÷Ÿý]—DT;fáÇœº{—·Ury…üE6Ë~Á+üü«_ ÉÎÕò!`«.–ñg0©Ho#ú$ë>~øfR^|‰šd¿Ó„itx‰ §[c¹· ßØ)u‹ÞEñk&DÐæB¢?…j|(÷êõù9iÚ =Û÷"ÚÕ@E“l`lš^ÀÅÚÊšyŸí¢ªA¤¹í¥‰£ æqamµ'n;×ÁÜHbjÉú¸#wÉyTèûYl³PS¸8°CÈZd"‘„ ¡¦¾[ÅÁËlqס­¶æ^¸|óöÍtG@/ñÎ*hÓYu @ì’ Qe“R\þx~Ñqˆ¢óá°û.¾…zÎF“œ#xÚ¬ló¹bh“ëK¢PHB"ÿ¼éÖ{».xiy*)=`†ÃÅÀË"7ŒœÜBºãbA*;LYÙÅŽî2ê@)AVûóT?Ú8`xÜÀrTYòÔt/\|ŽÇäðô Ûf§úÕîಠQŒ>qÉ“:q‰¼*x ÇÀÿŠ!Õ¯þN†ë!^÷š£ÿ/AAòúa>¢t1kê;¸‚ ¿B?hûðóVG¿ª¯öZ­ÿÙU¤vÌIÇѦZê´ÔP„íÛùÿÿæ¡È|$ùW¬®ç“è ¯“wà©9˜·bîζÀä¿Á?ÿ9ÿùš‡ÍÒ{°Ÿ~þK¾7;›ì .lýŸè׿ûøÿËûk¸óøicÉv4®´^žöÕ$SýbvF{[k(‚Ý,áJ ‚X¡ö:ÆŽ>'Oõ°ÔN;WHÒ¢ïØÿ¤ù±¦¦–½oø¡ÃÙÉ‘ž$õ“ ógÊÔbjïž~0{b(•L ½ŽÆÇî¬8¦Pâ¢o¿ä{<¯Åꥢ¶Œ6 m’ƒNè·ӶÄW0næÃl©ºÖ.ûIÜêF&R/µÏáƒïÒ#³ä"‰á¹ÐtBI™˜šstß6c‡À××¼T 6G‹j Z­¡º¦sÐöŒzU”M¼bR°tWB‰$퀸ô쌔͆$›àÜõ£Ô6‹Õ_OÚ ˜ÅïËÚŸa¤ML¸ŠÊŸÇh·Ô­\Ò÷¥XènÞ–ìú­qÞw~ÒOÕÂ{÷À×&ëL7|æ(¼?| ~XÏØ} Þ»¾ýE›KÇÑ_Eÿj{q›ËáCè“{/–—QÇSÑ'C‚HˆRwŸ6Þ”,sßø`·^m|`?|0~þA¬„ÇE¨“žçß…¦ÆÕ øÿý ÞÕ¶B©±°ç/k®æç]¼VØ5ÁßsRyïò£fT?y³}wo^ÎË»T׎~í~\xþìåî˜3ñ®´àZòÃâ·Ã‚ˆX̱š’;ùùyùWn>{ÛÏ/ŸC/¿}ùBÞåÖ1~€óÖÒ½ZúÓàÚ#dUBv›é5Å×.ä]*©mn¬ysÏÊ óÑZ Ûh‚óÞ_¾Z#å-íð›šKùy—o– ÑÑ`D÷o]ºY‚¢—U…ùù—ªÞ¡ûÆÚ«/_ºXü¢‡ï'o{~i]þŲ§mø^xöÍ™‹Eó|ðgU\¾ü´{Œ¿åuåÅâG¾’’ÖfH¼.¤­OË._ÌË¿|ýië€Pàóƒo ®]Ì¿xýõÈâX[ÉåûíRׇ²Ø‘šýcËË÷;øÚĸræúˆÀBi.8SÚ:¼>Ôß¼üÕ4ñ½6á¾êª’+õø]o¼òCQŽgzäx §Ï'Î$ü÷ßÁMÐ_ÎñÅLª¥òöŠ©åÇèÈu™àý„¤ùSlózéù•äìö%ùˆ‘ÓçSÅ8ùæ_¹ ì©Sö8[뚸&±–#?ÉÑæë"æÜ ‚ay°9}æàø:¢|pç .]º^T1É «O½:å>ó§¤Ý?Å6ËINr’“œä$'9ÉINÝ% »ñþåœC™wë'¿ºw筌ӕ_ìKø–]XiÌ…—Ngg¹pýÞ$k9 ÷t÷ó¼“G²³Þ(}ÊW8 &Ÿ9Y?½Ü*hªóæù‡²²/Ü,aÃë-çó;væxÖ‰+ з­Ú({_V9ž“s$÷þSá…VÛœ±{WÎÎ>r¥¸fZÖʼnΫgÎ>~·ö-.¯ùÁÖ1:’“}¼aš+]¶KcgŽ½ÿº_bÕÑ>^<ä½UÞ‚¿ìë¯)8”-Zê‘ÇNö°Ä_UwòúÝŸ¢ÈVÓ©×÷ˆdJxü®â§cë_?b ´©‡LÒy_>¾ º5ÙnH–h>—†êõTÕÍ|cm7é"Ú‚”Øv3IQ t ˆNØle¨Û¦Íò„ƒaÞtœ! ¦r^pðtî}%Aèzîì‰Pg+E¿îÅ5Êù’nºëO"¸¦¿º¦—‚~”þ‘´ù{¢IÖóÙám ¥æ¾»˜V¶ËASÍÌÁ?9%ÁÉÚ@/ {ãrá]¡®’º£WDJ|˜™.É1£Á”¹¾¦8JŒö#jêp$jCþ›y_㩯®‚;n‰mãÎwÙPÉ›=R#-u4ìb¯ ‰{^ˆÞ¾CPj|lˆ³ºÆæW,Ü(5!Œ|b~z²çòdéÒXÓ 4–¡V+ïìva$åjŒ–’^–n‹ÿ‚£ä] bñ!%®‘Á>»Q[ÅcZ¦Ñ#¥i2¸ûz+V‡ät?] qæ­5#Ž4CÐœ;ø_ ·ùÞzë¸ÿjÙnl¼MöÈqÑV¢MqŠàs[°r)ÔžÝ(³i—›Àð:» }’c ø_i}"]¾8ñxÒ/_ù^º[Æ]-+ûG2@¡ÌÛRDú|¸‘B"]~Ê73&îÝHqÆ@¢*×bµŸÁï8šŸ¹zµÌKð1ðMæïKd~¨¡`5—Ñ2íö³ >ʃW^²3ç¨cZñax›.°] mا\¨.‡Kñ/œ÷ž§K6–±ÏV7ùVó²(–†Üõ€½.:^1ü}•aQ!øí‘ÿ 9WñH» ÐóÏíµÐ£XÛÙi“tRÑa2\xÈÂÂ)öŽv7{¥¦Aèþ>]bXi´“`Œ µ%:“©&›-´õlsîó7jÎ<ðþƒMöÝ#‘[C‚½lô@ë­-s ,MŠó(€ž6`áyç%? ŒÔºŸ]Þ¸QáÙGE댛ƒÌ-ÌuUט·˜ŠÜŽ×Ró)Ÿ`¥| 3ÕRèn®C6´´4³È:w‰¤¦v§i|±¯Ñe³™Lµsr=ò–j§â—rà ÀÀ|$Ë@ù1Cm]c 3}ÐÄÞ÷A;‚K“ïb¶X‘u í7ÛzÆžõq"ùgHqšìëìg 5`»75ho% ñ槧˜X”/ìà· uïÿÒ:îûbmó®EÆ`ƒmnÅÔ¨'BEÚæí¯•]/ßZaƒ_ÞÊ._O7݈±5]s'Ÿ8ô¢=©]9ýZMMíÂá= ¦¦uºë¸·ö‚›)`lik¢«í¸5±{šõýt7¶?f¢ | g¡07É t-²®ÖÁÐœ«îÅ\è"Oy”Ž’ÏIt ÷–…8ƒ†–Ö&º&ö~÷_OKŒCîý]Gƒ%ˆuö1OAÍú=ºïf)ÕPaëƒ)áØ=³ÍÝ!,æ :’6jç[Ã0<JR‹ZÄoæ‰.ÑüÙÌÊk³ÐC3³LDiéÛ%Ðfæ-•>ê¢K[çñ‹í­=®©4ÆZ~Z“ãmu½ëB,à%´mdöûWA}ç”UHŽ»ñ} m'ˆªúùe»±Šc.zRr¤±mÌñ#’²ÒTæÚ€qU/ J÷±² ÎÄ7^È„çh/2ê"4”•÷–òo ÌuU1JA#Ô Bð°}7Ã4}‡e×µ03XQQ5ƒù´ÑTS‰9o³çd8kP|Г5Å©`H•mÂHѧ»!ˆåBuÍÇŸŸ4]¾ö#¤W¯Cmó ¾©±8àai}¨ŒêêâvwSßx—جm¼ W‘ÉG) •ˆ£¯WYo°'Ì êù‚;œ ÎèÀÇ=o3Ãíí<Òfùv×b´½^ÒÕNš÷¤,£MýUŠAeÛàäädOÓuSÐèá,«äÑ`SuÕ«þ• Yg7åØWêWK3ß® ú¾Ç&æ#ªáðs<üï´¡Nô¥ï«»‘ûªjÞ ?Ð_ÒTµjÀ¬‰Å—çTÔç¡ë Þæþ»ø°ÐkAÎ<~³œþ{×áÕDÓîÿ‘{Ï=ç;÷žWªRRw„"Eš€¡IGDÁ.‚ìˆJQŠŠ ¢¾ E5ô"„ÞCB²¹»Ù4 ‹~çú}¯¾wçˆ9»3ÏÌî3óÛgž™y†@ I“îÂ{ŸB´ñ^…v2W_ó2ô8&1 Ôõô ä·?^ 6ðŒ‚–>¨¼W°ÂFº+`«BI ÿ¾9 £vÇ^·•m;+àvø®æµ¯ƒ)A_ÇŠÛòme³…2Iß}õëš¼®kìL"•7Ñ´%¶ÁÔû/‡jÚ{ëW¤Qf2 åå7ò›o®4xp1ô)fIÌ"ÕiæËÓ4;±‚Úç‚AGâ®;Š€âK‡àRYò¢?„«“§eú-¿a ¸eÃ::a¬æ÷rZæBÙX^‚ I!V}¶Œ¤4t<†eºi{HŒ\UlÃýûõÕîuIS/u¿“ŸN+ßÈŒì aÑ}Ž?‘ÿ6$cÌõ¥y¸§¹Bt –´ÂåC5_$|„ôÐZÿ}:Xa‘pË3l[:ñ§¢¹ ¿9êëéêéÒöº¶¡›¡Ä]÷F’, ¶‘TVXy/Šª§O&“ˆDRÊ›Þäì`Qÿ˜š'hc¦YFNµN{ß‹ó))˜êvXQÌükªšeûOR·ÒC³ Õ¥W²g­,.­ !QÇ} ¢ã°d4Þ˜³`ç¢x¢©V.{Qž·Ëjåå´ËWÜŸ­£eYÅ•˜^¢v‹]äü‰ yŠ–a׈闔]{›[c¡"`žøRn,tU€­ufgßÙV¶á~yWÕ2üÎü:oue9/Ž¡¿ïТHá^ãdÅPÃ6!íùAÖ{ßM£»Ø€ßc$%a‚£ì¼ìex8I142‘Á$kk=«Êl£:M/ ’-Ýò¶RkN$Ðå©ŒõµµÑˆËÂÔè'åQÒ*á\npç?¨¹;±uKð4ÌúlõÛ˜žÈÔ=ø)iÝë*Ù¦Z©£kËfåÓ9­ªÙÆÓ 8©VæèYÉ<J¦Ð}‚‰ u± l3⢵;AVgdS§+e;Û z­Ë³5"ŸJ/T>sDö}ìªÎ¢è‘^´N-÷W’÷÷JPèIý#K¶½ü²+ùà…¡E¤ý/Žµ¹›cÓ›0äìäÉÿ15)± Vš5„mŠšÐÓØ¡Ìhf¢He þµÜÉŸ®îåh:à—ùq»3þ¤©fdb+•%XÓƒŠ!$ŠQ*tc©4SS£Ý¨kPy ‡ 0ÑOÊø0¸${Ÿ}öjúé ÛæÓ•`3 Z¬¦©~P„ÚÈpì”Â|½Mr¤•@²3¤ÛßܸuFòÝ¢el¶™ùZ Û6U½Ë2¾è°ÕÔ»ÝË—û–£]iGRÛÐæÿ­Jpu‹—RÜxFèécüÅØfÁiTJákñ3«~{*%¶ÁL³iƒíZ‹¹öî¢y½-ÍÉå– ¿o_=͘ºåÍ®<¬²¶z‰Õèqk²œš‡`Ú·!a›ÀJ™¾6BÛfµÉLK¯ˆ+ ™#šü‚Á6´«Òø¢M€öqDÚð8iG(ÛLxêhÅ5ÈcØ‚‰[ÙFò,Ó­OŒ(Ô«¥=ròD¼ñ‘±5itvøïì^À+§±ì Lwf2Ý%p¡SÉæŽ.þÉ­° ]Í3_×åãÿüX?3ŸãbUr˜k¾Ã6ßSÓ&¶ÁJ³ˆ°Íó¦Iô1 Oú™ùTñÿÉê^»` ¸¦VmñÖÃÿ>ç†Rm¯ÂÏ]W?{iÐý3ÐlÃ’QÍO µ¡:þ¶©¬Õ8ºzxÕ‚<ÃH‡à«bÁAó!GsI¼fÄÊ#ÅqýõwßèQLQ¿N>Ã`"8àvj‹m ñúP-Ük3ÙÑ Ì“4ãdÄ­}µÐ&¿]VN4Ù¨K$;:3ÐVâdnJ¥›º»{4­Š'¶·^´ÒtJË8t‘Û?"ù˜*± fšÍÛù×|­öD§÷Êf4M[xšŸø‘žQx¹l±G—Ï`–µ…m´5L>ñ¤­èS¦?`›Ïe—,@Ï|ÙWfÊÝPñÛ§ Z<¢9$õÀLJr¿ ÛtW§‚ ÍкTþY[š3Ê6â Ëó_¤uæwÚS´6±äÑW>ÐArÁ—Iåv­wï'j^¯åI 'œAàX~£˜¿¼¤Àƒªv—Í[Z…y)š¶‹ùlB.äF¸«]@†œ¬I¨V“Û`¥YÚÄ6SÅ'Õ˜òýêbád×ÐìÏR·òC4Ÿ·Ðt¸.ã…ÙÃF”D‰7cµ¯h5ytmü×Ñó=>R ¢[4mñKS/´mžèóEç·½®·ÉN4‡›ir~€µNTfüŠô0 L(GÅðG>Ójy'ssªë;  × ¨°mÄ¢)o*pªXÖx¸Å £Ê9é o¾:\Ýð¸Üž‚DJd©íVÀ‡„Я?’RfˆÇq¡éºM*}ý¶ =Åž¦ý´{ Û`¥QjÆȳ¶<9­K0¾òðYù›—)q¾êº¶_'×±šœ‹ÛZHØ­w4éAQ~v”›¡UØ#»¬©ŽwÞÞ>SH½gÊüt͘ÞÁ…¯+Jr®[ê뜩@zewù5}¢ù㊆ÖƪS~î”Ã÷¼iGì©æžy¥åÅYI~nå¶[JÓ¢ž{ð´¤y6Še g›ÕD=BÜí¼êò’³á.w4I6ù5KBq×ëKºº†—ÒòŠó3‚ímÌ-)hõ¶ô³¶þ'Ñ/܃ Ð<$=;;CŠG…oáfåžqÕ¡Z%¤¤egÞ?ê縇äÄžâož¬ßä%n+:½[ÇìRÚ“·o_?ºGÞC}T7ƒ-GTqÚ×çêÛm›Ô¤Ì6i”ÙÁ†¡ëØÓ’7¥ù¶DÇS…?KÝ°rŠc}üo È ÕN@Ç=æjAQ~b˜Ñæƒg¥oJ NùXìcV$=x¦£ÂÉɹåÛÆêà€ D%ÜÊ’«çQvûòzx“­û Z¾1—s²ÓO²6p9#9üB<õ9“¦K:yùnNúm;šSì³uÙê¼ñ'±Úæ~<ì!p¶% . 3ÕÉpŽ:Ÿ“™ž‘U¼$QÆ\Ã}¢žá©ëiyY©žæä}awåè'Ìt½3°¦•û7y‰1õþK`ìÅ~÷¨É %»’7’éáîÎ Œ*nB¯~ûúŠÅ [ÇL£þéV\™²Žûµ4:€ÉpcDŧ~“¹¼Öš/;øß‘G Ar/E?µüÁš¸_Ó;þ^ _ÎϪê3Å®`±Xl.Rï©ò“N1/øs-ÑþnLÿ´²·oT=Jðrwñ 8Þ8-¾{ÖÿR: ÏË¿Ãôp¸µ¸ÄÙæU«Ô™—Ép÷¼VÅM>ãs1»MþN¦?çz3™Þ!Ï[àïA¬¯‡ç‘1Ijy~ËŸåÁòþ4õ¤G6tä^4u<$yFÞ­€ƒ,–§<¢.ø|xÓÒÅÆ’û,7w&\ʪìâ\wõ~c°nT8Í®„’—’zÜݼ^ŒÉj †’ãB¬ÓÉOV”V‹-ÔõaxúßÌÿ¤0$ hàÙeÆ‘„ ìÞ&Êóts‡Ka!¥ÂÅ2==L ¤¦ÙåÑAÞLOï+Ù5ÊöÉŸçYÞ×±…F‹’X'¯ÊÙKï¿ÈbÊ-/hÓz8+Íö%Uªî·$Ûdùýèr¯MëóvZ?†‘½¿¥º®]:¯µÜ[€ÔÚa¾ÊÒ Hå9¬ÂEJG6ôø2" ì¶*¾m¾´õc¥Ç¼>÷.ðNfßQÓ–"T¥Ù¶ÔQåSþuoªRíQ]%YQ áÆ{»±cËCª4¤úxc•oûYvê…ªWþÐ9æŠdªôŽã/!WX'% Ú€íÝÇE%Y‡œ Mñ~†3_ùð»ÕºÊ¦±¿vŠ`ºùU/wØ¢‹cEåÇ8=¸Þ9´ß ðòô`ú^Ný]ýgÙF”t‚uå)ÛX&ûOñßCßàÀ8þÊaíjggçüêÆÖÏ÷·µ£O Úy&žåtvrø[|u¢µ‘¾6»£oø›PÉm*äÍ÷÷t²ÙÃsRû]ý?7ÙÓÙÑÑÙ=1¿&Vì.‡æ&†;;ØÝ}³k›vÖbÉYœëîdwtõN-óÅŠÍÎÐôø"§«wbnMÙ¬Y_äöv²ÛÛ;F¹Ð¿É@‘:¡‡9]½ƒßTÍú»Ùãó‚_uñ?3-áeËÌVVé¼óÙ…+T1©¸B¦PàÀ˜@©/ñ'B̉d7't>W(•3_{€B"V®Žæ"54—ƒfáõæXPI†fÎÖ42‰’úyí‘-g AÊ>G73Š!Ýâ«dÊp9ƒEG È$#«vpáD“ç}"TNÕí€baëdeL¡µHO0YjH£ÉûL6 –†šowv_©œƒ­•ËûBn£"¸õÉ$Zýèºx}Ô•F:‘-]SW/L_0möán §³> 33ŠÈ•Ô@¥¾p²ÙH¹V*=ä·è,ÓààQ¸Ã Zï««<ïD—àCÏ£­v;_“Ø<ÂHïóeR#g° ’^·Ï‰hY¦êysìÛM3ÂwÔðä”0¦½*¶‘¤¦xÌÛ­xCÅñ·Àê›´Ó&42™LMíSËÚn˜þ¢­­]ÜŒØ6 }ï}­i:$ÀÖýpó»+êé£æhhhH"Ì@ƒïëDÈ&¸{›ÙFtÅZÍãɸ¼Û¥„9»…ß §Ýõëõ|i„hÊ‹\.k_n/@Z WºçG,h4S^M »î…„ÉN4ñŒ¤f͆ó©–Ãæ6<…åt,Êzöt±ž¶e;â´—¾ý —³ú9J2‡ÔlýµNLΨt¶Üe¹u#pQ™öê¾[) õÚè쩾êü“‹<ÝpC±¯½1…J%Ó¬®å×JL?Ñ‹ÿ2=ß$Ï4ñ<ö?õ진âw§™ÿcâ!Yí&ìoFvVgF³ì”Ù‚j/xýÃÈÝ5ñ¥ ›t.àSš8~{ˆ“q”`ë7Çã ‚¥¡?AùeÛ¬xö+€e°9±ÚgmIÿ mðyó¡.¦útÊ6Ëߺ>Ìø¶,’÷‚î­l3쬩{§W±C­êb +FŒìÂÞ-Èó R÷>Œ|LA§Q¾üúRM=²våÉ1–m`‚Ô÷ÿÇï³ÓÓÈcÈy?ß\€`û¼¬{òêŒÕˆÊ›yÑs'óýhôØ|ôBz¤›ë,z¨&J¡w N ¨«43£œ½Õ8HÓÖìÒ—666DbáÄ º¶ÞýúøBKmL’VÐsdßDki"ºÁvêyº¼Ÿqþ=òùõƒ§¯…bÅz׬ml3Ñðö~^™4 oÐÖôátƒãwg›æ” =kŸÙæѵåU¡’±ÍütK1_¸R¿ÇàãX šÛ–‘”ü×V¶!Ͼm(•ŠF¡î2SŽRÈ,.•s*®€ ×”B° ~ï.Ÿâ©Ô†sh²"µpâ y×Í6±H¥œÄWâå:r"·½Z–裭GMbo nð%7n®m W¾¬oö¢·å² Ô#ç¶òÄ;¬_x¨®E¯Xò_q€Ñ‰ùMvé)ªQ$lXm|kê m‰E\@3¥§´@X±Bt+ÛlÇòoîÜÓªñÖŠã÷Çè¦YGc#øQaå W²˜e›¶EÎûû hÙ/=µ¶ÞÜEÁ<*q›mÓc£FÈVuWC@HÑü;Pþçš<™0‡Ø\¯¨JAÆ„ÂÍ;i¬X>÷(ÒÃ18IÑ#NDµ{ÝbH¥œkH,¦ñWç-h¢±­¹AÀµT/ †îÃ)KòÕ¢¹ÔLÉ|,bѽkcØ¡%ä~mÞ%ÂjíÈæ x¨¦ï0$}¬•£t€fí(ÛiãuÐÁŠH4ëCró’ì@ÿGHlÏÅÚSÚ´È% /&ÛÈðé°Q\ÞRqüöÖd¦UÀ_k{_ìjN30úп¢`›ê44ï[•² ¿ñºÅõ‡Ùf!‚ªq¼~EÞ­ÇxÛ$ˆ×{lu´É»ÞÊqcàð“†i$©IÏŠüú¨«–î­îõê„cïcŠ‘ÔJ½±µ|^Œ!u2Cþúú:Ÿ//V‚ZfÍkhîÕdw#½ýÇPƒKºg½s,G[qù¸ à—õi¶QÚ5¿r `¦UŠ…Hqr 1Á—êNjÅÂ#É”ý`–À`›úã&`Ô3¼­âøÍRÐÔ0›3±!ë±+aFÀ©¢&ñ|+:’ši)…GRˆ÷IÑtó°–!ãGGRbñóÓfÆþùòQIÄrHJ#$Þv$GÞm–^Ÿi§”-S· ¯ØsÒÝ··µ(Ncâõúd Šó¤¬¨ñ<_½g=þrļÙÒgÙcóÒ:·¤E‘‚Ð5B¯âI® SüÍõ_ï°Þ£‘Ö#wé,†þJÑᶤ”ctÔ¥ëûeÈÌ$1u~I‘E4íBÝ“YßfPªû6o]ù'FRÐ oÐêrÞ\qüîl“ãF³?ÜÖÓ?22Ü]_bH¢æ7+¼Ä¼aWc2ó\ÖÐðpOÛ?×½úFn\‰m3?ØŸ88/D×ötw÷pÞä\A»}]]=ÓëH¢¹îw¦dÝ”¢O}œž²~DÙ%”œóðø‘fõ¦‘ÝÇéL>lkvà”dZzuÜIÏ.¢¡‹ÓÍ®÷²¤ùŸŠ:p®¹†‡nµ÷pÚ>è’oT£±p1ä§B-¨Î±÷9íu/öÄ ½Hø†/w4w[¼îäôvKÑÙÅ‘8¹Eçü÷Z¸Æupá—ð©àbRÙ^ã£Ä„¼úm±h®ÆRWûDníÐÈȧùˆŽÍÉJ9Y$‡:X8PM¢d¡#{Þ䜻™ƒŒ…KœÎ.¸IA®û¼ŽÁ?º:9K’@¢C¹gR²dçÐ͇qEMxsÅñû¤„5Yç­é2™dbÏ*øÂE.Ï|%‘H/¿"K\‹ÝQ®æ"Å)(a†óDSÇnTb½ŒÕ?…ÓÔæ d?œ™Œ¾ÿ%èRnõ¬KÝÎßêBìÕ'Q]C•Ãî Õ?s6õI†‡¯<á åßyaMÎEsH¦Y$¡ý ý¼ r⃠(DC —¼ÆI±’W¥‘`æj„+‰@4²ö(mG{þÇK{h5¥Ø£iT#µ8ÖËîÄî(ðسŽ}á¢.eÑ725b[¨´ÿÖ±Gã†J‡bãG=m( `b›RT/Rò//TÄ«kîö+™”_©N8¤k+ }³PNÓÔA_úÞt4iå+AõIAºvh0!ÁX]‹øœŽ¿y³ý „}w[Ì>ðŠ²e´u]¥œn×%fˆÉPˆíý•ÊGøND ï^ÄÎ-ù;ሺÇê³Bˆv‰+øjb8þÖàäÆ”wLý» šûx/>CbÚÍÖÚêÒÞN‹qÃŽÿVß_eT@/Äó¸ã– 8þ…d£D;øÛÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8pàÀ8~2þÔyqP endstream endobj 929 0 obj << /Length 1242 /Filter /FlateDecode >> stream xÚµW[—Ó6~ϯð[sX#Ëw¡ ]8ålCxZ8­b+‰»¾aÉ,é¯g¤ÇN6§¥”¾$ÒHsÑ|3Ÿdæìæ¼Z<_/ž¾ b'ó²˜ÇÎzë$ÜIÂÔ ³ÀYÎûnèË\h±¼âIê¾W²ÇÑ«¡,äòÊgî¬d%…’8 <îùËë׋ëõâÓÂgÌñÑxè%,qòzq÷‘9È_;Ì ²Ôy°»j'ŒSø¯œw‹ßì$Ðì,PŸy,H0Ðë/¢î*ã?bn»Å½'Aßå8¸_BÈréGîáÁ Û¾À…²ÁA C%ŸM'àiàE6¾$ò’Èxyäù‘=ÉÓ›:ÊœŸ[°çC|Ìãq`ŽûN'x$\M¹÷}/‹"NgŠ2ßãYˆgZÉ®¹´aŒ™8Ks®x&#ÔXÛû™Û“ªäm£e£a™[·Eù1n‘4‹¢ÁAÛTmHoP²À‘Í(—ò`”eî ™ÅŸƒÒ ·5RSVïQ {±]òÈ5sÐ CMãx/š$M½«qKN¶mUµÆÎmÿÀ"ö‡Øä?ÁÀšIfQ6º%@›Œ÷8±z…„òˆ"×*?Á%©Rlm`-Íð÷@ ä'xiú1Côç…’ÅT(!3ø;}Üy± ƒÚ&MæP&|eœ¢‹{¡pÁ&“q±ŒMÉÓ–½èE®eO«¸‹d1€U‹Á†Á?HD–±|`ÊD2C壇RïÉZS”ÈÏe1ˆêrȱIµuåSÁ4eUá %ÑTm‘)“{Åã,5–„ð¦16Ṛй³ŠoÛ¾Uù—$2x>تݚÍ›¶W%шý²^ß⸒ø§?!“)Ÿ0©…Î÷§œ3ÑP¨’õ¦QDµwÌSâeA0¯c}/ó{5Ôêf.õ2Ž 2€7Ðãzl n9~ õOé[ ?¶¸©š€‡®À¦(J“R O»pä3™n…½õ,OQ×·&¨ÏöýFÝæmu¥:™[õ|TéĦ¬À$sBfÇhº®*ó¥ïÌFV‰ܯ@ßQ¸¿¶Ø ¯è“úé*W|> %YÏßQ!À¡jzcˆý”­.p|hr¯(Œ §p¥ÓEºjèiDD ¢r×}”#Uã˜îK³i–w3ïD¯ÇMÛK™£‹úü½E÷轕ų¦„ e£´hriž=iL¯†ìØy°cŠFTx£›§!™÷òÓ m“Áäýê†>ò¶½‡b!ã£Ï£ÖØ'ú)í3BÕÍ],–M[–qäÒsMêÜ;Aíü;# ¡k¿ù3ãâwP1Ÿ:1b6¨ ŽLгÒ{Ñéñ‹(„tÇœŸ}1­à;BGú68kF endstream endobj 912 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 101 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 21194 /Filter /FlateDecode >> stream xÚì½\TK–?þfg;ûÛßîþf÷?y'ü&ì3›Î™nB“sÎ AP@˜QÄ@1""Š ˆ€ ˆd$Ç:§úß{ûvÓ@ÃsÞø¾éóQúÞºu+œªúÖ9§NÕ@G:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:Ò‘Žt¤#éHG:ú{&…báÕ7™Ý"ןô‚ªœŠ%Š:ûLoÉøŸXžÅS€Ÿhf ¾^âB33Íò~Zƒ}R^[Ó|?º¦Ö¦×ʱ½X´<ú”ëO甶±ô†×üÂh-§ö^1sßê8ÿû´æqѧ¿!nïè›üº¬“†:è¯J¯ûêÚ# šî«ßáŠ5Åa°´”ü;<ôŒM%¬4˜O&>» g-…Ñ^iU=®ÑؼFg£?fÕqoÅþéK=UtC}å…ž)ÑBmÑ_&”mm¿€1_}}=C#c”Œ 1¾k÷4öÏ(s8¶ÖëKÊ•v¾f òïv±W3äFuåŠeE/Æ5ú‚ –IrÙqæÓyx7g£ž¡IÖ£nÍÀÊ=Ö¡GÐ…hð*vùŠyÑûòO; ºò–Í>QW%Ç/UömuFÕ ðÕM/šìÌL $â0†P#áböŸ+71ýç]sXÝW{ÁHoÅÓaô]ÁDïåì­Ö4Ó•zzú†Äàø´†Õ÷Õåëëùí.™í"HøÅÝÁ+ôL ÞÂ1Ç[‹0лóظìÏÙ5¼ÅË=âµb埌¼š…C^>ålô›Ãoá,‡»®XÐÁŒØ^<…|­3Fy«™£ÞJ“cÍS pNøìÂnƒ/õw>Ò@yWm™9ÞÈ3¥p6¦dòÆÁð/oPÐÿ½™Bº/lÞOˆ>y¶‘ßOv;TùµÑ&Ƈ›ÕøiX+ˆ±5Éx,4:O¼µfP·œ~ ?ÁÚ< ý"ˆæXª|­`«—¹cô´it¹p›§ÃºÃpî2ô‹¡-¸2 A$PqjJvÑÌÜ{f¤sÉ᲎‡“)kÎ>R1:=x0nŒ÷oCrÌO %)dJÈ€|v(ù^ë›fÓÕfx‹´¦ëî P(H²·ôO»ðé<|t:…D¡b1nï$³y=XKrÌ~ ÏCåT}ò­a0¯R¨2eáÅ"~‡;až'S(Û$RÅ·‡6ŠOœn³|M­â/ËÁÇ Û iÁP„+ÓC.Rá÷ö+0ß 4#Ô_¥‘ÏG~½˶]]×3)‹SC…›E‚ewm:TÙ;˘цm;ÒÚ'„‹ä-¯Hpáø®É»^­XJmét^A¸OìýÁvAP›L¾ºqòÊùW£ o—ƒº77ñÊŒhœ™ËGžA›Bc]Œ?%ù6W‚èù.šL‰tV…6d#Æó™¿j†)ç®´0&Ÿï©d›9hcžº4ʾ>™Lpœ‘j#n;Zò*]‹¢ 2NÎ>>"Vð² Ü[¬ |zãD%4RÚíW`¿}´äª 1lËmov^nÖnÆk÷]ù\ÙF<ñÞŽ€uL.:wfs¸†îõi³œM–ìÀ}¾¡ëÞüø슇 Ó?zgYù=l6uYï<™ù¼ •3EÏö,£­R »]sLL©ñ{³‹rº[9ÙÚ¡h³ÎÎq‰ ÜzüaÕƒôxO§–©y€3@×[_Ô(¼u 9¬Ë6ÁGJÔ¡>×ua‚½ô°Ò€S?º ¢V´ÙIcyŒj×øµ¡B›»N#²M Ol¡èm¶©¡íÓÉù²²PIÞØUG› á–èdYØ©îA½l³…m¿]úñ*Ùˆy½WªE¶Ñ#?œYÒö´$Ú@9ÅÁÐÊ#2+·àÈî:ÆðÄÃ.¸½L4° O ð,*pïJ¶ÞtÓmdÚo¬Ã׌¨†výùÝTŽ÷„X»º¤ |s+ÏßÃÁˆhQ|¯w˜«Í´!Øbmàuð¡DÞb,#`Ãh“Ñ"™£Ã¼)…ÑfˆtÒXÍœc·‚—lCÜž—#J´!à£.ål±ôH…Ä\¤Øâ#>Û .¯Â4ѦVøW˜ðÙ†\X;\I4[;*… ;mì#v,m\mÔÃh£F/ñ~O5Ú¨c¾·ûNÐF*xTq­¡s\y×z~'ÑÎ{J¬ÐD›‡ÛØØ€3rÕÙñVÑ( òRìØÖÁÊæ• ãÜÍ7¹3Ï`¶Údû[mz‚Nlü&²Š6fÎa;PQQØëL§¦_¯ŸÇÚ®»™¦&x¦™Þ2àJÕ[Õm¨ÖA³äç]\Õ£!®Ë«÷ûàðxÛ¸KR-D»lC¡Ò½ü4õ÷ ß^)SÉ6±_i"Þ±p¶1¬Õ¤½×æB¼ÊŠõpÝ¥4ƒÌѤ>žÆ­´­G†ÍÝ#ñf®QV#…úzh“ 5Øí£ÑLNÄ„t>Ú˜áðÞš¬ ð^sRôɲ à,»Z6,B;Âíh ö¦Óp¿Ú¤·‚Q1Æzžiñ*‚sÿ`MÇV£GÓÜöÔ-jMUïå2ñTOf¼/L³ J|Ý'˜×ôãÍ·(8ÝÌŒlfŸý)*'#²“!†aãäâ¬&{[K ‚6£MtþA·tAöüæŽÙoTh99üÀ”hýa–e%Ü. áÉèX°É,Ú0DgM6úûÄ‘,-ÛÈÏ:¸ÛOÚZÚ¸@¶ $³,5ÛÅßÏsWa½â“emh3« h  øNÑF9÷Kß”˜°~ýúh?gŠç8Ô£fц»bì´³°²¢¡Š´„¶]4IæmåØ„¡ó‹Lç¡Í|»Íâh3‚ÑÛôR ê,Ò(W<Š6þÔÈÝ÷U0 ØΡû»½óeSýÏîärÌܬ¦,×óÕJ´qŽÙ^q£ìú,]{Ó9©‰6·`0œ]ùBq];ÚP¶EWoh¤YZöàƒE2Å dŠ#‰äõ»j{§”¼EѺœxnÁf¾šš‹6Ò3¡–v)U²CÃz2$@ÞýšhϺ‚²é–²ÖyhC7&í¿P¡Q‹ë—oÖJ?mà0ÉHCö¾‰ ÖoX¿ÊžÎˆÍQ¢Í2R4W§¹ÄcŸ‰Œ>ña_KŸ]ç”­ YOùKó— ù-.,ìš´ûZ¦{ÑhCõEgº™¯#Ýh‘~¾Z9‚ô0kO\¹y£LEåEÙÛ©ÚŒ¼-‡Ð¦ê£|áâÆ~Ží¡z5Ú@"iž7.ê*,d~¬ÚAð΃Fm¨¦´Ãç°ñJE½ìSЀ©†<–óxlÚ˜»‡i&x½ôjÕëþÚÿ£ gœ|óѳ†Æ7² œyh3Š5µtõ TRppHdÜæi„6V¶koÈ¿&Útºê¥½«­Äk½H*MŠQ§b«è Ý1ã†s¢Ònrú-Ou׳J–Éâvôáúsd’YMë;W*1µ¼eÁTûuì6뮽AïÆî01ÔÂ&ž:ÙY´†áMx¼o¯ÚHÇ[ÙL*“mn‹½ ‡ãì­þ4©T¥ŒÏ}}khW'üœvYw9m…I@rÖ£ç¯Þ¼{[ɦƠhó%5V­¢5—øa”h¤õûWàC† a{6Œ‘1oøù¹†&0J¯4±¯6Ê*ÄG|Ilïè”ÚnÐâ€ØmìC ŸºSŒèÞò%í6£@Ðó’I%^|12_“]žF&ëî ¨Ñ’òj`é PƇL3^ C ™&Ú|» Š6ðB}Z´½sT–Bñ9í6ÿSÐf áO«UuºS)ëyh#Úoeè[üaở‚6òÞ82óY'Ú<“·¶.§‡!h3E\ƒ7ÙFfc‚¢M-lK©Š÷Ó± zdþœ nðÉùÝ%†•LU’W:uÅh·&÷•Ž|ð1lU{wžŽ#”wÈçN²_ßJŒÚÛ‹)4ÛÓ(*ªÑ1±ŽE2ikŠ_ 5Q¢Í‡{;ˆ¦­3Rž’øâöš“d,ç­àoBD‚ïôµóÚš[OsøLhS¶'ÆÌ+Z¥HÉΙScgÑfZÚ@Ù&pV&ߎw2Ûåý³ÁôHWvË‘ª4º©QìQ¥Ý†ÍpUúÈŸ™Q gžÌñNáÕ¦›˜X•6CÅìt Í‚mûL\Sá¾mmzôæb·ì(+VÈa•PvfÕ{û\ëÍbVbÏiðÕkRp²¢Á0&Ákw9X ÛÀ£¹ó2ƒhâFFÐF¸“cäœÕ¨YFùÌG;ñpi“m‚2®-¶R¼´lƒôñG6xj¤Ÿ™ó1m(+ÉO¥K#—D›{i±T×H壩¦2G+9üÄRhƒ¤{'{Ã:„Š·{+\ÚF^ïb‘Rþ¸^¸øR¸¢³¿’|¼ êS¡ˆlSv3†å=!ÿêð©úS4C̺%c*&´<8cG7 N«Pbm Fœ çpÌ-¬W"qç¡ ³Q±´MwQMJY§ÚóÉx¦—ÍhÖJ¼z÷KÆK£Ÿx«L°‡ßÍ÷ü9äm’~enX¯Ãrì•©¯îTŸÙl#Žò²§X:ÄD…2-j_U0ð× Ø–7WW˜ZÂh•D:³5Ü›L3  ³£áYNk›%Ê5)¶Õêë*MXv) jª»OP7W³O+ÊMÉö[öìO\í[˜°‚à¯\l˜l}àdmFµpðu··rßèM‚(H“¢ú®9dié¼:joâ°»ÀS´d,‹‚gZYiælª)ÛÎåæ[¨›ðÖ[01D"•2‡LñÎÊÔT¹ïÙ¬Ðt¥øJ[éu虆Ò=½–ô§°Ò9kUÕÅ;ð<‰2¨§j: ´ Áá£Î=›³ÈךCZapôù$”En¼¯GÔI¹†«Øémþîàwõ£´!g™‰ù+xV3á_Œ´!¬:‰” Öì9u!“9)–hÌÉtë­Bnúôt<OpÈ~‚ MƒÁ“çV‚LÛzNS¶q1ý˾mh ÜwdÑn¡Q!¿„ñ{ñ†Ä°íÇù/ÿDˆV£MS±—Ía‰ú­ÞÛ$S¼EJÕßîp£|ðªd»‰ÊbQ( +º)•m}¤¢aa‹õ_ ÒÞÎE›×—I8Ógª…±Žy.œ±¾)‘„14 [Ø'eWªÙ5ÐpÊÔd:Ótœ4]f˜Ù¢,ʈ¿¾é™&m&ÚŠ©X,aã—/!Ûšâók:gD:jN¬Ìn‚o³×úbˆ„yÝ‹@²|¬1ŽêŽo4µñ[L¶é®J³`³-ÌÍ°x<‘afnÎrôK ”ZSéæælJjnnÎ`úìMO`™›[°8<ŽdƆb†ï>ûmZ‰åRo&‘B…ˆ?3=Í“É$Ó3<âŽÌ~a³Ä¯½ô|B7ª¿·8Ÿ7ÅJuÓVò§§´ï{'Ë$¨\¥÷ƒŸä®ö†á Är]¿Õ‘Žt¤£ïBËþæuÿ‡{,}8Ì´ßñý4_èHG:š7@¡ÿãmVjüF³‘LTÛS^IAÍ&[‡Ý·àÆq¬5ÉÖÑcû±ë‚Y½¼=€Î²Ñˆ™|¤ƒ–=¿c¢-s[Œƒ­ ÇÆ1jSzë´|f£ÜRÈöCí OõÕÑ·*ÖÀ‡n$Ù'¾á>&™zÅ2´nàÕKë÷˜#‘½SÝ¿s¡[¥òC̙޻§Ðnßꨇ‰Î¹~·~\~ýòÎÕŽFdç:®T‰7ug·“ üö¿xõÚÕ‹éÉ«ô Èû®Õ}& Ma´¦È”¹Eð] yÅw5ÜæÛ&¤ 3º¡¡£o‚¤íî8£|åÖ1·½³W¦ õvµwtöÂŽ7>ÐÑÑÑýqH¢ ÉLoØÕÛ?ƒÁ”~&“Ã}P`ÏÀ¨\.êêìâ‰a‚ñÞŽîa8)¯…mäò€–£Ž.9O‡Ð&¦äåœ!&ªµ6^–þBŒÜ´:¬Àx£>’Þå½™e`µ÷5t?Óõ„J!¦×iNÅos#ðÿæ¹{䢩öΩ\2ü±»½££wÙôúnHG?vvttvõŽO£ÞÒbn_Gÿ´˜7ÕerpàÚñd†ubsG×”H§úÚû¸rÉtw'Äžî ÄùH_w{{Gÿ0wVâóz»aþôôM ÑÒÌŒvwòżñ®å»â…¨(˜èíä ¦†Û;ºÄˆëˆ\4Ý׳úãà(ÊhUHxçW(ç¶wÃGbˆ&zÛ{g7'LuuªvBJÐ"õöKÕk*$£;àê÷ŒrùHÝGïžßM1‹} •P¬:úÌôö€+6$½é½¬O²ÉŠpˆÛ–J§ÒrOdZxlÈ9qЉ‰ñÙvîðÂ÷ :ÕÆkCÂzK"æƒøo*^ŸXCÀ“ÜÂ×;2ÖmÞB$0žtNÁ'„ØQ7Á» rþóêhH úêz' Ò×pÄ—²b{ÅÄ´A©,†÷ƒw==æJ Gh.‡Âÿ¥h¾?`çU#¢ùž Û€ø½Ùé©t->ÝÏU°Å‹F!EmHZånC5·¯Dv‹¼ˆ <¹É•æ¼ªúRaˆ5î²eÛî¹½ÊÈ+}g˜{æÉœ[ –BÕ¨­‡§®¡0Øeȱ“`:΋MgX¯]çÀb²Ü"'ÜxxØ–àås0ûxr€9ŽìùlÁé’ n„ð¢Õv Ÿð¸a¾ Ö8ÒéT‡À¤„(3S¢í†‹*oKñ…h¾!q£ƒ•SVnˆía(¼%Ïu¥ë)ujg¬8äLÉO ÅÆ+)1–#YDå neò£ë¨ ³¨uña–8çL›pêåõÈ { Ùaó¶]Ït+·:ú¼‚³œmÉØTô­׌Œˆ‰åʳù¡6l‚÷Vå^ÃùÝTk¯I h½’Nâxª4 YÁ‘ý·_È£næøÍ…¨¤q>5€LcÕtM#²M{×ðŒ¦î¦º‚Ñf½z5BÕù1†6ÏÐ ymTˆ2³‰e`—¿’ãjÀHxòIµì¹nŒ!æ¢eã>Ü®gêÙÉlU;ôM]^ªÎi»»ËÁÈf·€ÁÛaXcrñ;´ó£Ììö(™0qµÉJÒÈÍT%MOßnŸrÛ‚<Ë…âsò ]W×ÇîS_3GÖ»o…xœíBÆÑ^¨œOv„0ÜוÌ[}wÁˆeÜéFÝÖ²ÖXÙDž@ùÅ}kK3>v>LväZÜJR@‡ò´'ˆ„1r>`´qÓs+˜E›$&{̢˩Ntïýh“I?úZo½Ð®w;aõ‹?¢‘[îç(‚^h¼–@fo‘ÌÊ“:ÒÑg¢™. 3RÁUŸë/5ÀZÕ •{¨6ÛYF GáAn°"‹`é<"ãÏΑˆ´Ã¥/†FÇøbTMŒ<775¾1ˆÂ ¯±GfUwM/™7Œ6$–¹­ B¶64’©ÇáÄÃv¼´:®Ä¤Üiéë醨½åõþHS¶Ï>”©$ÍZßî@Ã'Õ±÷º–õ>™\9xZìVèT”D;³ÖRëp3˨´'|0t;Ì€§>,òNN$Ón§E›¨•Ì-|ô6ûeØ”¢(–»Ñ“1¤‚É®-ÏkªŸÕ>O±5pÏù€ #³W¨îí5÷ŠÉ桯)c³JäéóÃ.K~82>66:::>6°É‰yà„ðçW;™ÇV—¼n¿•Óh3±š°<ªüãä8œÎØèHz˜‡×º, ŸŠ°ÁyÄçv÷Mñfws¾º´ÌÚÄÓ }v›Íh‹9p©–‹Z$!´ÁY7O*-Â-v–1GÑífƒG´eùá–Î4 žÌ²°Yw¤ šé»E3bTO« ›ƒ°D槠MTÁ}4 ÆÆFª3 Í+%sj«³¡ ÝÚÁÙ !W¯äƒçúyè¼>ƒ¾¦Åä½ÐÔ ¡ ÁêͨÚÐÛëƒY–Ú N÷upÝš£²ðñU#ÕæƒkC0Úè[í/†6–{TóíöËð—QñäQ4Š6ÒÞËv¬MЦÂs®\¿²ÎÒÈ->ýñQ‚ïuÑI ¹   Æé8ºJñÆÞÔ”D˜%,c—¡Šä€·½[JžÚŒÜ^ìcàxlq´ét3Áˆé˜bØ!›`[Îdû¡uÞ&X<ƒÅö\µ}B‡6:úFÑfì=„6_Lþ5h£zwzøùºéÖÂW¡*3ÜÝqåÚ4·VàÈfŸ‚6J»®¦¸“Æej½ Ö¤2ZåóEi.ÝHÆY½ájla@$”ÓÙ9¼hƒ3>ÈSåÓl¿Ò0«]^îdD;¯¿‚nH¸?¥D›ý’9h³ë“ÑFrÄ`¹¹DùAë•(Ú@²ý±ª¨¥{cÙžQ¢%Ðôz/ÏèÔÒh¹¡ŽÖIYê’¿Nã¨e}%Ú áë¨ÚŒ­2]±íÍú4¿µþIJ‡ìqD¨C}sÄïµ6#çT¶£ô+ÑFZŸ^:y¹Yõ¾ì ¿}èž €×ãH7>\‰Ðó /™DSjR 1†§}óò+1¼?zô%¼ãÒk•€¢ÅJ¬Ž,›ìp2§¸Äãªv1Ë„â9F̈Þš”1†”p£­ñ‹½úFNPF®¬[I PYC¾¯1kTâh³ši“*úT´n³¤å<@õÔÆÓDSçã­Ú8“ðVªÍл"-<¢òe`´AZc0Ù)¡Í@!ºqáròñ¤¶cAúV±hJŠÁµ4¬ÒnÓ{-ØÀb§J)ZK_¡´ÛœŽc0ÊUm »_zõÝ X:VøÄ-µ÷þ~6™â?¤D³DÞ|#›Žtô7[‰‹­YtN%ÚÁ?mÆ^œ10&yE&Ê8”´Úgˆ»Ò, é¹[SŠÍæô¬”HLjµ1T¶‘äx3ívßýJ´A­ÔLŒØ•£ó­ÄÚJ„C/ÜYX*ËÒÁÙÓÇÃcN7¤úÕ ŠÀ¼•emˆìDwó€u;3Ó¶Ù0ðA;”GKÒVY2m\dÛº&B$]o‚3ž‡6¯.í%RY±ë×ßh–}Š&Õ{1ÒGO<8F&3¢bׯÖaŽ>/ ]6´Ù‚a7Óš[pau‘V],¾óª ¦Û__æ#Û%ù}oJ/œÉÏÏ?SRö~T¢6 ¼ºsåÔ©SWïÕËFk°$³çÝ3ðÑn— Î=îЖ³àæéÓwš4%(þÍ ù¥÷šëñK'óŸk?WÕ¨d3/Þ,:s¦ð̹[Uu­ó1l·á|àrŸW”äŸ*¸RùB„úÛ(€Bðâîõ‚Sùg.\kêG ;¼ŽŠœbÕ[°Z8yóBa~~QóvÝÎ)®V $O´Ì ¹õTž)®FyÕððz~^~ñõ‡<MtŸ-*¼Ñ0TsÌpuj¸©¸0¯àtqcßôÂEŸ‘¦ëù—ëäˆ*›h++9 ±º¤ìþ¸RèQ~2r¢»´j‚Â'ïÇû®øé;CUáwOÏäæœo“w½ºzî6ºrfº+.Ÿ…Ò9µrP ZHçÞ¿q j²SgŠŸ¾éAQZÊ«¼¥|º~@¢:ú¼Â 4¼¢Øú©÷ÆÿÁY!?¼Vpëú-•óˆt«¶ Ù÷¢’ˆ•øݨð»-l%ö¿øM¤ÜyÑ×@…6:ÒÑ÷nàN:R•ehæ=*Q|]¸[k2 ñŒÈM{÷nŽb½3^*¾'çéÐFG:ú> 8Í·N•¼øÛ@ t¼ºw:/77ïô½—m|olŒÜÖ“ùçFøÒï¶=µ%ùðñ柟&š®(y¥CéHG:Ò‘Žt¤#éHG_Aãٹœ’ùg0Jº+3 î K7CEGs[`¸êBîõo÷Ì^¥þøáHIÛr燿®»R@ê^€|`¨¿¹p»lßvg€¶p!¸p¤¦€ƒ9`DÃOZ1r3À¶p¢(¿W§¶‘•‚Ô­`Ç ü†×BýJ.¶€‹‹ð¤±$íùgá”ùHû‹‚œœ“×Þ}ïºxòLa^}çÔßn…øŒÊóúo_>›““{þê­¸Eà<†êîÏÉÕ ¼œ­ô•É¶ç òò Ï>? Ô~ 3½·tÎ^*ïåJtÛßþjj/Ò#8v/0ÅÇÉL@¼…Ú ( -ˇ²&ó[-›”Ž­_|ü#Ìé?×"‘À?FžPùmgÁ·ÿøOàGHø]ÕžNó?À·?ù ü÷Gÿ 5zÁ øט ÿƒ¹ªËOìh:ÊÜ ›f„²ƒMÁ øÃ`U˜b™úÑ@.Ããàn,øâç`JF¹Ÿ2ˆ¾â˜E ˆ±Ðç¸DîÌyñIØôm.+ðº-á‚}#(HùL|ÀÈ箋x¤‘ƒÃšÛzÇ­q¶3×g¬ê@üºïŸ]½&&VM^¦&œ*Ä%­ífº¾)Õ'rÝê`/ RüvŽ4š“ N¾ë6Ĺ9Z’\ë¿££‹úu> ¢ú<“Öĵ}î( P/ùb±SAgÑF±Ú xaXÐϹU¬Ä“š¥UheÁ§ *m%_°wtÿX:³§Þƒúøâ· “ ëÀ¿}þí/ªBGX08 ª‹` ú2~¥*ÿ£7 ‡‚ákKä4‰“Lø:(Œ ÷?Á×ku&Â׿ôÓ ñ ø__€ÿ Ì/¶Þàç¿ýÛÏÁ?ÿ\¨›}T üè'à×ÿƒáo~ ¾ø#X”Qó*¬õ«–Ê Qocƒü¡E")L² ùÂQ(´ÏÅ‹uZå¹E ­_!ÓìL(Úô/V“y½oQy`â!©å°5…|±~´ØHÒ¼)ÛÂÂ8f Ž­ò™XgÓ}ϼ'=j»:CùqØ¡¢áþjôt£÷û÷…÷j˜ !ú’ª(ÒÝ~8û„ûŠoçpàt:Ì~E]Û‘»Á²» 5ÀÈ:îr\xp@€%…½ýì‹Æ´ ëmÙw*ØÏ?Àß‹Fcí̽/U¶‹tæäŽ(‰die‰Ç›%d•*Óì~y%ОδàX0)f.áwZañ^:^·Ñß–Ì`[[±ÈæÎÇ®Õq‡Åò/Ï¡[{mþÛ4‚z ×Óÿhrgô=Êua(–¶N.ÅgwQÙ¦îÂ.¶©1‹cïæyÿRôr3%Úðsv„º9¯¡(ýÒcø“«èrÜ¢…i¿ƒiÌð_ V cß äÆ ÂJ+ ^¬ë¹ ¨+Ñðßc@ñ3´“„ZGGðÙöt'¨ê¼×à4e^Ãøcµ ½uü|ñOàíØë §¶9¹B: ~úÏà‹ŸÂú‘ùÏàðdÚä=B2ý3|ý{$÷j¤–}‡áëÿ´‚¯7"(T Ü÷!ú¿_üÌù~»T݈¼ô?¹%à#wö!·\Ê¿@ä¢ßpÀ‡ê£©îÀÆ侟ϴéV?33›…Úm„¿ƒ9ö¦,Â…Å0·¶`PÝ"67%ötÑÜÞÙ.ö:,X½¯ˆr7§³9VfTçÐ/{àÁ$}¾ùwôèªcá$¼I&ìD®¸uj¯‹Â±µ%˜ë]Tʯ¶R knHŽ t`âÜ£ «FJÛ£S^–D*ƒA$Ñ“^æ! "ëº1ÀžÌ°°fÓ¬=VW¼Qn9åÇ›üŠ¾·^-Û:šhgeaNÃ’,ÒŠžB5–¾;óGf›ê(±é[ѿ¯Uú•Ž#Xrl¼£÷?/ ÿ“Ùñæ[6VL2‰nkç˜Ý*µ)¿£†?>AƧßQ(„{Öš‰–VVxÚÜÞÇY{½ 0ƒo/ €ÕVðE±òL!øù¿Ã· bðÛŸÂh{ЬÇÇÑ Tx_ÿûoTç­¶ðõ®ûJ¾‚•¿B’{$VÇ-¤ I0î™/P03Íá§ëÖÃ+³ QÙ¢ªçwA¯%›F÷Øú0ñê¬õL7•¡;H £¨aËA/cÃS°•OÖp§ôÑ{.Š6l:Î6F©}(Ý‹¡Ú4Oˆe- I¶“(ÚÌÜÿoÖFèMÑó]úú–·c·ñ"C0veæéÆtSl$jýyŸÕÅgÇ=T³­Og’Üß(áRòÊn¥É¡f8Ù²n4óå+åI¦Æðç‹ Õ ~‹;A?£V47œ¿ÇÖhÓtgâëæÆãmw²í̈&8êúCW‘Ïø¢‰ yS££CON'‘I®Uè £h«*¯lèÿV5)Ñ ›5ýj½ÈÃi‡ßÀH˜Ãr9&E§áG« ý%2élMÙ–W¥ÒHü1øÔ]ùª©òPÓSÜñô6«e«.BAžb½Â!é’Ú@)•Á‰—­Âã½wŽ¨Ø+•H¡Ô*w„:¯É€Ø3RºÕ>b÷J.|Ðübsõ©ªéæ ™P3¤²=V¦Pœ»ù²×y[ˆÈ÷‘‘vi9ⵜ(ZRgœßªùx@уÑÛÁ2d8ÿ:œ¥OIàŸÁ€\Û _nCcÞ»23A="»víí@¨á;½mJ&½ ·„oóz@(¾¸ªì„à÷ÿ¾­š¿@.Þ*c¡ Ó­‚tU#|ý¯ÿ eüþ!ļó¿AâàK@£eõÌ©ìd+ éhr)ÜN,8‹¬&$B‘€>¼G`ª¿´} #ù½–,êþKµJ\S´hç3Iò˜¶ŒýX=žÆ†'áZ¯"Z:NÌ~ŸöóKÆh–hN[®oÛ€îD•æºãíÎy^^L¡›ÇB"cÙA†ËAªàÈÖøPb3 hŠg‡¢IÞ1ªÃjåCƒã<Éè›r*™ôzöÌÔ6û•¤Ò>áœþ£ e÷…*m¢ÃÙ·ïåhÕŽ6×c˜±êÎt5Œhè Oc¯ÒL±áè„Úrh¹¾Mí2‰ò{¼3S\ž„·×v¹ÿY¨WñËW•¨Râ…Ù˜¬ÍlÐþ9dTzýmiaéåšÚôÓëã5)Vö|yùZk<™}ìñðØøxÿ›5fœÍ³›Kö…™0¶Ÿ}:O/ü–-ƯÓÜLƒ`6JÓ-•\N[ËðØôH9¶œ-9œïÌ!ºÖ®zuf³ÆÿR <í¼ZïmNf9†EDFEGÙ’CKà©g¨énŒŸí #¼×ª¸ã…¥b%V·íõÃèÙz†ìË,h€§’Öe™Ø„A¹ŸŽ÷Œ>Þ4Ré~è$’¸R)—_÷i0Úsï ÂÌôx"fm­ü>†­…Á_ViŸƒ6r·©TŽ:Ž­¥Ñ¯Üߣ͗„ ••u2š„§°-mlh66lƒ3ÿ(…ÐÆžtQŽ–T¶Ö{¨º:l¾mÞ$Òþô•B±D󲶵µÂ¬4Øðtb¾•˜EÊ»§FcîŠQhy/ø0mîÁh£òt/;¯…jö|8çeà¤m–áý‡ÔV•ÉÆþVD¦Ã*hP¬‰r ˜ø}„xâ¡o´÷HÅuY¬7i!Ú(+4Ö|×ß ¿6íŠHs¢D~DYúï|¬_wc­ 춪Ûqüm.ÉÐR)ñ©ßm« ³Áì¹ÿ]n(ÕY­$ÝžgƒXëóîÚ¸'ÜRMDâÃÞ6©ù@¡ éÀ¥fË'×QLÃK[¡~žëbDŽšý$÷Î2%Ú $›¼_’ådÅÄúgk¨–òƇ—ýl±æ¾£pý{½1¬:ž4Ú‰ËÎÓO(œ3Cµ4²E3ô¼8G%š½Fí²â×9zD'mn¥¯7s„e ¤D£¥«¿4ÛøuÐfí©¹²ÍJÕãðO_€ÿ´KÀñÕð#ß´ÉÅ0==GžYmžÂú‹Ë>ôÖŶÇÖM‚p²ÛX‘ƒÿøðÅÿ¸KGì6ÁWô)Õoáë_"xR‡ä;ZˆØm˜`a) §ß®X _÷)„6fä¼»]Ê»»™‰L·pm(5‹6Õ…;趾Zv4Ah<¦Âö$>¢´ua,mJ¢Í¥Í¡æ¡Iˆ x¶ŒÝÏ‹¨$v‡|É•mr`…Q8¾†`s·oÚpo¯ÿFE¦Ÿ½[ê)5Ú¼;é¬mþ*䔟ñÄVÍ}Àv9‚6ý~F)uBtÉD!Y㆟6È ¿û‡ˆI*|¥EQ´»cŠg:ûºïU¿<Õó‰%TÞ—/‘«ÃŸŸÛKãxŽ}GçÛ++‘má¿©„CÇUv¡kÊi±æ6ž‰b¥Y^:dËLȾ I0Î6´ÈCWÑêóëÍ0ä‚F¨Îã« ¸wU½‡®Põ B!MJ:öøqí¬}üM]'5wÇy*qt¹ëcÏ}„GKñzÚ†ûµ¶teÛ ‚Í­rËN=NAešúðˆN!Þý Tòýʼndº ¤IuïÀXxÁŽ7ˆý30PT$°ñÉUµ¯Þ<çššBµŽÈkxH6^}àÔÃ'55ïIt¥ù’Qš;Ù!jûíOžU?.>ƒ¥y#ö`ðææ~º‹e2jçÙåbfo«<ìF:¾Ážh»jëݪ'·¯æ®±ÇÑœ»øR xëI4LÍyôäÉåÜ}ᎆæZeÅ«“Û¢öªló¿ÿï× 8üï#êOªU±‘¬?Ó€=¾ø(áù?”…t´?@¤¼!‚ZÿЀBuH×Ø‚,ýè§à'Hüˆ”ÝnÈ:ÑOÔ ¨µá¬üøö·¿G’úgЊÈ9ÜVI`O›ßÂÿP øÍàÿ"á?û/0ÁJ:¨[ƒÜâµ7ܯóQ•ö§$°ÇK¢ T‡‰½>fá;nWÕT?º½3ˆA L—ÎE‚Y°‚·T<ª©©º³7Ìœè¹C¼mÄc/lpFkž{úìùý²"7ºñš‚·‹£ lZÚ`K°_w¨òÁ£Ë'SML÷?@\mp%;G^»÷äùÓ‡G< Ya£ð§ˆDg6®J)E 4É6TûࣗïÕ¾¬Éˆs'pÂ'¡8ò® ¼ÁêÌҶΎš›…áΆ–áºô—2 0[òn¼|ùìø¶uak쌻 ·õ4Ɉsã^M;¼×Dp3ë²áÑË×U·J‚¶m‰¤›‡;,l¼ºÅÔÔ<ïÚÝÇÊ·úر-ˆ*ÙF’éwžµK-H–qe•·ËQºqïIƒúc"Mû ½ªqH g <´Š¸|óNYq–5Æ8ù ¼Ù÷è V»)³¨âVŹ“;èF&[/+¥ù­«ã ë¾ ù惋>v¼4¥Z^C÷Jyú¬xŸ‹­•£ûª»Ý°]@¡1ûfËõƒëíl¬ÝC’Þ¨ý^¥3‡7[Yr‚ãMH@ß‹‹¶¶v›o¼‚›£l­­íÓÏòPP•_ÍÞæîé嶫ÒZ¹èôÂבּ··Ï¬DaÿUÎV–_“Ê‹šø®äXÛ†&|hiåÛÁƒ{pì]|°›••ÝÆÌëò¶t{­§\ʦP‚÷iyrÞüì?À¦â¹²  5ã߃Ÿý¼¡v¿€/Ç‚?üüò7 "}¶¥~ùK d`üçÏá[õ¿_ü T 1Ϧ€ßÿü×rpú™F²R°ÕüúgàK"x:¬òK‚ÂGA9øåÏÎtÈf§9Q3°2¿ø°Ž“j7h¢Î$ðÿý ,§‚ZU¯»üøÁO˜Ú[») q§«µ?uG-î寽~OW»sU½ó£äræf;Ž­½sꉛB´ }ál³3½ê8ò²ã©®ö[;Ç-Y¥èaò­GÉ6±ãš6£Éw»c Îáè~©5 U÷wŽ½®F›ÍQŽ[NÖ¢©ŠÇm‹²·á¸mx6$SÏ×Õy9r >·ç´*}aº#0¶4ʧ{Ì2O¹÷-C ”óDÕq¼¹Ë¨H®–Ù ´ñØút&)Ñæðõ®ùÕ\â“ÞŸæ%8Ïõr^šsü¬>Åçp¡×¢j‡'d.išÐD£Oõî›Wý%äÒ…ŒZ,Ù¥Ãÿ>ú¢9f8{ye6,Ïš/$øç/Àå©ÅÝ1ÁœQ?UzÜ%Üûêì—ôîÓâ›ùiÞ}ó“Y´;-öH>3Xóì­úöþ eãmílA«ûUß¹WÙ4ã|Q´‚ÛL¨š\R x¶Hû/êv‹rMÐ+º¸ñÛ›™á–G·J\˜ø¤Óo4;„mæE›Nð?ÆjÎÜ®ëÿê­hó?›úþ/àÕ"ß~tà8€·cê³€Ï'¯Tý ‰ûØÊHoMƹ'55åEû F„Ë-ãŸc¶ŸEˆ^\É•~KçBµß:ùaLðm¶ìûÊíÖ›4ÄßF)³’Ví{1mDcžÖ'oõü;Õp%ø÷ÿÿÂüTGÿ(–²ž/õ®n"F7EøXs8.>Q×ë'> c ´Ù²Ú&9÷ížÇsw…h[·™+©}ŠºðCâБŽ–VTÿæD—´:èHG:Ò‘Ž>' xÜi¾ä³ ­†Që‡<ó- ¿Õì¥ü îÌ7•³\ÆårEùçJO&šžœÖâè'âOMñÄÚvo…\2ÅåòÅÒ9 —Kf¦¡`îÔ O*WÌ~ˆC"„‚'¹\žP æ~BU*À/p§„b)ø½M…”õ´P2ï\"˜äN+þŽÅ齫)®›ž|®ÊUìI9þà-fþÅÉ›†¿£ü¥µÛÿDþ†RŸj¥SðçŸ~®ôšò¬kž½0¼p3“u[Ër"ØbM “Jf/¿w‡#΄`iÅ6ÂRlW"Ñ%må®Vlc<‹Ã$vÙ/¸ê7&_]°6§Y64éüvJò-é/¨õ¿¼@"\OVÍWǤÃÉ&[+Gþ.ÔQm«²ê5©E®ù´sH”!×â=פݞזœVªcsZrŸknúJUZµ$ªÐ’ÁWiÍÚ—nµ¯“~°0õX,­…™+>1Yí ΋){µóKJø´Ö¸ÚWB9ðI« :ýÁŒN¾P=¨móÎQ|¥iC±¸c÷™­æ–kï̳eÈ%“ÞT궜³ÑTrrÙìŠí­toœeD¯Ò ì¥+uåFx½<Ñ‹éƒBYÃåx çºë™a=¡ôëŸKrÎ|µ“µõ-WÌ}W±PŒŸ#ï]mÏ\cOqÏy2/Ø9²¥ojQ?,ùÁ‹7 ¯$=ŽN0Å’-\z¦—gWÀåü[ÙIæ"G°Hhæ«;xÕ¹=Ö ³t‹¸Ý2©dSïób[&§Z8ç܅ݨîEð$ …L‚ÈÔpyÚýIuöå¹þ™½]ĭǘbïÕÖ¥„8É$–Kôó~‘ê+mŠÁº«A,ž`î^ÕŠâMæz¶;r†¨Î䘮¹WžmDsƒÔ=¯Îïf dšMÁÓnUs ¯g%0‰XS{WÑ#éÂq&žtaì½ÐµÁ—F&Ò,½o4£ž2áØÉmá4ŽH¤®Ú–7$BSà” wçØ8½µ©ED"‘B¡@\L|6Z²ÿDðþø$܉'ƒ¶Ȧ ·†@L`9¯©Ÿ@óžî«p âqD2;ùÄ]¡Òµ­<òÿ™on»áiEÃãHÉ'¹b¹Vøá ¼^íl†Á’|Öx²]…6@4úaO´™H Ó­ÓJ^JP|VŒ½«s6Çãñ¶I CèVÁHkJ¤j"*;1ëÆ´Z½Žç&úá ¶S؃úÚÀÎleÙ›Ì)xŽ–rjÕ¶¥Øaìx¾iÄ£Í;V»“ˆ‰¾z{®ò¬•–B§ÿ¶;©ÔŸŸÛÃ&ãHTΑʎ¢ %Ú´Ý:nŒ§4H¡ŠÊeÓM}PCLÅÑHÉ×gѦñfÑÅãêŒCYaÛÊ´Ë »üh³ªÂ^;%ïüÉ»ý䘅âßT×c²±Þå7ó=öGà\÷¼L‹´×wPîv”Ü/ØiE#À²1kvN=wŽ­ãR5Àd†˜0ÖT@©®6ýƒg~j~”Ÿ[ïæŸröáj’ËIõÖ{Ñ&êl2Z”×G\èÇïý°‘(fR=9.²úú{šVÙâBwÝSh Mñ"+¨¹{`xxäéù$<Éû¢w¾?†w‰ëèj¹Ÿ£oD{=(ྺD"3ï6t÷´¾´%îºÚ%á¯÷¶ŒL9?16–¾ÊÅ->SÕ¡ÇVÓÉ;o¼“õdh :onäNŽß=á„q/í®ê\*–tõeÇÈÈHûó"–)¡°nåûŽ epœ×E^dsƒE÷`GÒ}k-(®·»§¦¦º^—3‰Äs/ÇB˜ì`¹··` ¯5Öｩ|ÞFF…dÊÇ‘A¶ õqÒ¯ëK3p«†A!Fsèî)gGF†{³#©>ȧEÛŽb™îA>|쟼LÇy½›âÏ@°«ÀCtK¾8Ìo¯fRILNøÓÞñ)îä±õÞ6Á;a¬ã×Zê$_©…x5ÐÕèÏ ®‡÷ìÁãcÙ7©dhœ;ÍíKs75Oº¥¥éxoÉ„¸SÇFG{[_úºZ˜°WÃCIöÎo²:ï)TÚ¡®ºp*&ì¼BÜWÊ4$å=m‡êÿôäZ}ªïG¨âz7¼iT~õTµ¾–$Î:=ZíH¼«…Ûú®þ!èAîF*…„  o¯UäÞž!¨Ùûsã}̼ãϧÊžØ}·{¡…f«“Ipvõ¿¯xX…¶žõ4t…OÞy¾¯oVúvâì‹‚ • D›Ñ÷ÕûÓ ñä‡&ÚÌõ DfËRoOI‡‹éòmªî-aÒŠà;méI%â®»ëÂüýB¢ÏÜkQ¢¶p¼óÐþ}oç4+‘Cç_ªn‚$VñÑHw–ßƘ!C%»#hA#æ&ípÁŽ‹`èкà[X=·ãÍlz§Ñ£5ëÒ‚V0a´iÌ2ñجŽ&i9lluèŠh -醪+Og}9.k9cd¿ZªäíÇ0Ë­_üõ§.O½ƒnvœé®fPIj†ù]Õ4 þÚßJZÇ4¤ß,ªØ‚ÉpòÊM7Õ($™æ‹4ѦÈÇ”µý‘ZÛKµ3X¨IiC›¹ÚŒ|úxŒ¥Eø1/dëÝ(¾›K”Æ®’i”ˆœ;ðá,¶—£»_bñÕëEÇöZa·–u.¡®M²¶q߬Ü9(o±¢_x«š 8¦Ô+Í0¬<Ûm…;¯ }w4ë™<_“âwQLÎ7À‘gÑf¡Ç‰¸ÙÖȤdà‡,Üô7”PñÌú™ù¬V£d¬yK°‰D¦"DÆcJš!œÿÊ È¡ {½éI†P %Ù3HxSûÀõïÕO 9[m ¼If¯ˆ*‡!üIцÇq¸‡ hsýµÚÂ:ŽÓ[÷t €Œ‘UplBü%ù8p8~æ­ÔŸõÂ:e«g¦}kIwUQ$ÇüllS …=7ir5w^5å|Þ ¢™¡X £iûiµw:oïw®ñ}ùaª™}ŸPýYƒþ@½äZ!è<±ëÖ­Âyh³ïÒ#R–‚·ŽIßTŒnDê9ŸŠw R~N½õÞ ™Õ]If1Ç”hó%u­ZàŸìºÃÀbïB˜$å!¥…þC^]´‹Îñ£5>Mù’ÁÛ±UîdgÃâ×Å„ ɧŠbø…Wó43ñAVá[PUMXomhP‰°ÎRßä¼ê\7Åd+¬IÕŒö½:O#“CcÐä7&¬ec ÛjF³½Aªò7Óid‚…ÛþÜ«'r$P…6¼82vMÙìlRh6mÀâhƒWÙØ®Ë1qLŠ‚÷Y¤µã­œ·ó¤,ÝßR•Î´™t3Áôåû«Š8Ú0Th£˜‡6ÐJvÄ8Ä_çÎðø“}o­ÉÆ0Ú ¼’‰¦»ÛÞ]+8äÈ"Y¸uq%JóÇ@oÇ£²ÓÑž,2Ýâl-WmàôŸžM¢YÆCBèkLf² Š MY½Ú&?ŽÕ‹ƒÑ¦ßßØ(îêë¶Ö%½ÿ¾­«W¡X€6®92M´ÙôP6Ù~66)‚žrmžrçUóƒõ—Ò‡HoYìÁJ D›"õç,g¶²ð¾çÞ—gPÍúDj´2Y™ð\£ ΣO¶Úà\zÄK¡Mß̓çÎÛž©é¾PPhMŽV¡ -nFÕ'»*XÓ{c`²£ÌTo%TØ•z¦×Û¸5§wÐ9Þã´2‚'Û”hs<ÌÍzõ¶¶÷-³ÔÜ"3ñ bŠ6³ZÈé AœˆmhÓ`m´2¯ J®Ö\ovžUL¼GѦî•È¼ñºM6Ô"§%K¯@Lô7½¼—žbhHô?ôDmf¢‰¸Ø³hs*‘ùW  Ìô–P c¯m%<¹*ÉQ01øáýûÖ¶.>$ˆIË(‡ßjØn‹ <¦Z@„”µ :žübr)´q^ñÄí¾I7%×vhV¼gY“ÌÚ“w_ø ™jâ˜âo Î’¤ospXöö#G³²²Ž;ºÁ†lšxüÔem,„±õvÞú£ÍLW ƒŒ«hEUŒÁwÏ.ݨTiRÐyËYnT Zùœl:ËÀ™\„ÑFiX“<µ3|¿'Ži¯ò™áÞ‘YFî ²Ü”µG²ŸUÌÞÊÞ'é}J%S_VåâÙ¡ègp´É¼ßŠ •â¬å„3]° ›á¢ïœÕ¬–6ySS’2ï|´‰a9PkRkíÌ£_—¾µ$›7ð•Õm{}ñZ¹@¦E“Š9pÍMÞãŠ%í¹×6ñü‹6´§?ˆÅbáàË [&›ó`H&nqµôN>%†^‰øÝè8úSs6PXá¹B(P03æÌŒ?|Æ[ì‚’òÄ"!"HKŽ¹‘YBDÊ%”å0ÚPðöÉ}b9ôâýaNÈ$bn®<@%ÒupÅ"±h¦'ˆcv¤v]¨»w²èª‰³m,Éfv;Ç%épóMwúé(¤3%»Y[GíçKÄbÉTjÝ1ò¬t¡•Ø‰I°jž‚ª+}W–A¤™×õ €¬7€J ʬ”É$"!??Ææ T Úç ¤³¿‚óbÀ^pŸ€6oNmÃZy|ä $RÙë«{#ýØXÏ=2mLLq^IWx"±\:ºËÞˆwCË’ÔèSŽ´ùê™T<3öÁÓ–‰QZ‰Õ¶†Æ.µˆ :HxW’¬ Ü2¡rÚOÓLó^Œ …ÂŽëÛõð®°µ_ðÌÆÐ4éF§D"–†¶Ø­6£‡ ¥FZÛù¥L „R™ pƒ5j%–s×C½eÃ1¡TµÔûë{õIöí°l#qáĹêGjsï1–‘‹š¦ Èb©¬î\4–ÏÕ@›žŠ8¬!§ªêF¦s xÎrm%¼"Üù:'ÿÌò=ØûM I†×RI/¿”‹ ;L*2¼©û&ÄðS% E0(Žs·òNšä ¤ÂÁ^8úªsª“¥‰§˜|H”5„ì÷Á‡‹&?žÊÉi•..Û@ÃD˜êeg¾sFUÜõ0ǘÀªíW™-G¯™¾›ìÈGžþÿíÝýOwðÿÂdK6÷ Òrm¯½+}²€•$%›Œ ˜²2Ås¶€8" ¢L†nâP¶ Hæ0BFÀEah™ÌnáùÁòXŽõz- mÁ!Iż_?õ®Í=}ï>ßï}¿ŸÞéÇ›®ž9UÕ¶rìé^bSý¹o/Þ²Eã‰FõvYÝØÂËm~¢/ÿp„ˆ"iJþåqËå“%Ð&±Ï%~x³l·Œ ¥²÷rzÇ&‹{xH ºÌÞ£‚£ÑrŠ¤)‰<@W|í.Û1;^]”¦QPf´R“^\cYóø·SR¾‡D¾»kˆ6Þ/–y ÊØ*EKÛæçšÚ”÷ƒ|¤Ÿ€j;mØìíêÂ_©„¦i¥6ïÒÜÀmÃ7ûÝäÁÜÐð­’ 7Mþâ¹’§ M­.<ºO-§D"UnÕmësaŒ†¢Ï>"Í»)¤f_µ«CØhD§Ÿ¾–¦IÄò ²†^®þ™êÉŠׇ¦¤´,úÈé^îž±;ïwí#“­Z4¥†)¶y c~Ð/üõÝ«î½5ÚLĈ ¥Öœ.ýÙ¿P¶ßÆ4Rš!Ó*¿ ì‹-óÃMÁ4Ozh¨>ÙÝ/å^Ó9]€Ò\(oÈ6Mv/;ih­Ô©Ióî„D¥ê[²^÷Ôq'îPOcâ6Ž¢|ö¦=žàÞºÅtÕ—…úÓ¤˜Ü²¯®ÝÚK6ò°)1\Ëf'È|“ó*‡§ç­ ÌÁŽôÈ@B$Vî «¨oT y%×Ù‘扡8#F*Ñ”80<ñf7÷Ή¹¯ToøÑlŸj£o®Œ V³CK߉=~¯ŸmÏv”nÝU`OŸ¼”O ø´Ô7­´©ôÄ›tD…ù¨uÿš¿Í[t·Ÿ-¤ñ;YB/A<>ŸçíMÞò­…™j+ß[@,ák?Ì`·Ýh(ü4Â\ÌR‘œ[1Ê=_ÝÒ€˜îù:^GEÉŽcE5FËxÃèƒzš$*ÛWæ6ç v~¼ì¥*SåYñ2‰yÇIMhl]û¿Œí%¥l3>ŒÇ'}ºGKj$ÚkKHáÊAºšˆíš“‹i®Ó)ôk!'­oÏ1üåøåÜK=&å(?ÎéãDœgÕ­’Ýg?³ïÊ!‰.wi®%ÚØÞø³fvã8»Ïö!s¿2ìXãÿÏî³F›ÏË»Ÿ1»ïé†0ãð8Ùe¾9=‚‹S ÉnªÄ™gÏ‘[;?ð¹³ûV+Më¼'߈>ÿ§³¥9Ür繌Ì»¹êi¿§«}e™õýžWûœ¦ :;_G_1vãMwœûÍ?Íb~±tWš>ñ•¯j[À¿7.°ÍÍÎŽõ\—ÓŠŸZ—µº­ÑfpCVÂE›u”mN”w¹ö ±½Äª¤éÍV¶Õéºæ©ÍX/Ïvèr&]±ê3Iá÷-%ÝY›§PEæj6ðžmîpxAÊs*‡ýÁ/ÿJëÀ†¬$=’L¾±¾h¬öÞ|‹«žá³ÔJdŒmåíßÒ?ƒ±¡]Òo}zŽ"\ï²^ˆ§÷0Œ‹ÿK®Šv¸‡€Üä C endstream endobj 921 0 obj << /Type /XObject /Subtype /Image /Width 227 /Height 56 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 4912 /Filter /FlateDecode >> stream xÚí\ׇ/DŠŠ kP,`Ã5FEcK ±<±£Ï¨yDŒÆ ÆH¢, EQŒh‚"AŠ (¨ˆô"lßeÙ¾;óÎìì.HWƒ™ÿo²ÎÎÎÜrîwÏ=ç.…‚%J”(Q¢D‰%J”(½ªä”(½iµT ÃpJ”Þœ€@ TJÿ P•J%*% TJ”(P)Q ¾c ÖvAsÒDŸ°ºw¶¦ßÝ„½žŽ´ý°4¨£þ…Úw/Ûìßê+Z¾ö±æ—ÞÞ3Ï+LŽã!ë¿ÌàH›¹3!`®ËâˆÖ·Eɾì:|ܯ¹’`ŸÅ³la)Û–ú%Ïa3wÔ¼ŽéM¼œð8ó¯.]¸Ð—Õ𞲘‰“§I®lf|àåÁŃ3&MëX™ù‘óĨ2þæ/f-ÙtHªÄÿ- BÑüŒH„Æ”¼å»Ðþ[Í Ù;ÎÎ;Çe cœæƒ}šéT¸—%ê·÷@eDÙ ´>]ì·Ô¹³íôgÊVOΗ²lÉ'd<÷šÖ"º»¥Ùu^~ÇßÕ?±‘&? AHï§è¢æ:+-cˆÌûO_½#º,û°)BŸò–Œí9pÊzq›ƒÚÐý‘ï±Æ]^Ó -¼ÅïDȵº©¡#®4ïm+F!tì± ÞRòÜJî¢!=†ÏÿNüx§.²9UTÓh[ÉJT îiì“Fš§jâ›™£§ãxîO]zxð› 3ÖXMuV}½¨X¬ñb›¸þÜRTÿÙ¾H鱴³nÍƧ+Tš§kbì@Ù}Úø”tôz:ÄHpE²§ã´=²Ö¯äQùO÷­žjˆ™;|r.½‚¼\]p}ù‡ýT—‘±Íp¿s÷ÈIã3 ¡ ‘gý=t7‡§LÎHÌ'Œ±q4ÒhN ʽð‹wOSòB§ß…±$J²¿Ÿ#4*ôoÚÚÁv]Œ2è=éB6KÆz<Òœ¸UW_Ïf¬O†g„}ow^>×ZÓ܉,ØR“÷[?›a$¨ì¬èyÎ=Èš ¬†¼ô¨Ö£Ú}ØÓÚXÕ»¡³/ç²Õ¡”Þ8æëÐUWõŒÍúß∂äå‹æxÃIâŽEn4±ÓïŸ"ºs”^ßh÷vÀuÚa¿žðÓ/ÄAᯙ&d#:öÛžDš+q}Gd³9éä†þÖŒô^ 'ï”5ô¨…׎|ÐÇŒ|ÚbдÈtMúñmî–ªáÑï6æ·Ø‡ õ¨åù­œj¤º_·ÓÀ]§SÈ¡¥gFÀ•OìíÒ{SûZv§üï5}ºMNS5în„o¢ë"Žo¯õ¨âÊЭ_X ²ÖµcÄþìün}}=⊞>굎ǻ?ùópoÄ—ÍUñœ°ðážÄê6ð¨0^\ÏÑv¦}§gW²9U¬êƒtG?‚é!I¦‡ú,ÜCç°9î­ðMú°&žcÂ3~KmA‡õ´›¼jDòlCodðñ!ÂÕIçü¡‰9b¹PŽŸÛá†aðÍ"›Í)¸4¡¡>±d­aëí®áR¿Ë>”Pµu0<´“`° HéÿœøP(BK«Ä³acR‰¬^WeR‰D*Ôr±X ]Â…wí¼à“Éæð“BÜa¨O©*|­-TôáÊCt&ùp¥Üç%QStå0DÛ.ÁS¹qáÜÃÿ&†É%2~‰*ä*SÕTfûnð>›Ù ÌûŤûܤ2ƒS‰½Ú±›‘ýä%•¯0é€BŸG×òã¸s”ÇI¯ZXà ™ÕYM&S>*3²,E{£y6˜+xÝû ¼-"¦5Ík"Òé“óŒÉ¬º¾{:B¶žp€Ç¥ý-MÞûäQyT——è× ¡eˆ ¦*Ûw½×Y¢ˆ(%b±T®Ä2±XBTÿÄzíšZÍã2*ó¾kŽtô P1ÉîÏFè˜Ù'<,gs¸UYÇz!4%ܨ‚S~Lèyƒ#¬)•r( š(K*[12ã7þwÓí"i[,ý‚‚«¶:hñI–Æc?ýv¹çÅrùSÚ ¤gú×C!¹€á²r—î&Cfú4~ˬá”Íj± 긌\­ã\ú¨”8å~ÖõÚø@[QÑù…Í%AÝÞÏ%O³JGs9DWà ~àݲz Uóá&­ÎÍyÀRù]…\QS™d,ˆªV !g¯[Ò%›aî„1ˆó}ÑΜ㚊Äaßzï o˜7¹’æ~KÂn“7q³þT¼ÏÕ »õ×ï¶ ÞßõëP÷…¦8f08ñ}EÏ*bdgåÍ”Ë 4ð þ©rLQ5Å 9ìÈÓ¾g…Çñ zuÚ ð¥>±µÓgˬ^í½«[ØÄxN±îö¨ûD†Då?9¶ ¼çOJ¤¬¬Á†hj@…öÎ?w¸ ƒ9e)·Ú¯ï+›JµÚné/M9 6Ù_PC'ÜûcS»t>Y+ü'Ü4ÌÖtÜ ÷[bî–jZô03ZÀ®ª$©7Lþ©‹W­XNÈcÅç³]Ò9\®õk[ÔÓG¬)¡üÔ8¤3£²¨/’„É ÿšéÐÃØØÈо¹`«–þ®Èv£Ps›œsÙ<Ïm°sÑ ¸Iøe!TÀø²äÇq~`F'·•Ë5š0ØN¿Ã€,€Úuø’[;–ïó¼Àª·ôW&ÓFC dd¤ê±ÂúÝ’aÕW`¦­L‘k"^uå÷ÏnƒNŽ™¯­î?ãúÙY ˵¾Â-#º›™/«z€áŠŒCÄÒ¡œ÷ô4„`>õXáA¾bæxh²ùßÜfAmã}Ô¢ÛÁ(¿–Ô›…ØÏéºfö™íì}ïÜÍpÔlRêàµëqã Š¯ØÂ2;w•÷š¯H­YãååéG×€ÚËW»BT¼¨xMNdg„†|¶)öFjΣܬä‹}kAµD}w*4@Ëy×Á•/¼òœ!ܼM^™”Õˆ–¨6\Î¥@Îä¥Þ_iäåí½áߥ TóÕ¢ZW“åUG1ê‚ÊŠó2]×ú_½sïÑãÜ;Çw Ê1^,0ã­NjI½ù?pËS—ÕV·ÖÛ{ã·?Tˆ[ß×`Û..î5rÍç‘ róŽu„X勵^š±óòZë½ö¿÷ùoTfÖ¹.­»*ÓØ“b¹2qûdÜùj¹Ö£²ç÷êb÷¡'X¢U bãzÿ8½Ñͨ[%M€J{APãö¯@È4–¡~Ë+¼d£u­´¡u¼áà÷v ©ÀÓY­ÖÒ#—…bé «5PjÙ­ß!ÈÜ‘ÖȪ¥B¶&Ñ%`Ïë6_ *œíŸíd`ç\¤ÉFíÒ'@•b’G#šÎÔ>-Õˆdxáå"6ÈlÍwMîF˜ÔS×Ñ•'ÅHʌޮZúK…å× ]rYÚpézc BùùÎÈþãȪo}S{_žó ­ ¹KÞ(~zÞRÍÞ•Œ5 jBÀL„œ‹UçÛfZ£nEê¿´ÚÕë¸Ç›•y<ÉÏijæDœŠ»©wé5-˜åF€'B¢Õ!ëûéÝ å“ ç;¯«·*ã×÷Cº Uç׶Ghø29–>q6Dýîk8Ðr÷^jJ1GÞ¨ð'û=c4dáÏÚ½ ï9Ë~JVJ$S‹OVÁÓwà îŸZ­¨ jÈ|'d;B5JŸ,s"Òÿ=×á½|K'}{wõ.|Áqc„VE?ÁÙi}tóò@íÞò®Õ³W¼«j0ç^JJ1WÞ"3¥‡¦ ÔíôSõHþ8¨:™’°fÙv·AŸÚ¾ÈmkÞ¨bNEjjC h£ Vô:bÏÁjð¸á=#çÅjk§ùC ú¼?{ÑgÀ]ó%cu¿%æhÐÞFAÍ‰Þ –4·{oƾxElOˆµÌìfÎqÕË é˜ù\ÌÅ›2‘ØÛé;~ö ºË>µ Þù' [Q‹/Zè™Ø Y²xžµšõKò‡C:˜˜úî*=rM4ìÛûOøt¡«So¤cðåx2XTð &ôí„ôŒœÇ»Ø›WâédÌQW,9ÁhÞ£ž<~3$8z=œæºÍêöÒU¥ñ¨½¾üb îÈ©sgO 5½¿ü#·§F"c7˜EÊ´½ªÝ³—,tWéúGg]›Þcöß*3C:Û{vã]Fê¢îŽîL•áØ1ë`Rë÷5×퓾Ð~UØ‹3³ÏBƒÝO±[ñ=û?$!“¦±FS>›Œ®ß_Ä<–¤$¦ŠÕ{³Ýæ8Xè@2ôHÐ"¨#|á¡7m*y…_˜v:4$0øè_‰÷%u÷Âû׎‡ ù31M¦É2¯‡9›©m+çñù_Cɧp¹ ál|)›£ ØKã¢NÐh´c§Sr«´Õ=IŽ:®x5ùÑGãHÙ¹WC…MÉqNþ½£!ÁYUòM.*J=ù{0v$!ƒÈÖ*î'@bó¸ù×ÇÊ« Ï„:záF¶\³a®rÙÏÎ ¢…EÆ”ÿîVÊ+üÚÁxiTƒ¯ø9´àÐG‚ºf”?ˆ ?y!Ÿ%Ñ,ýýå: ξq,y&6U;ñ¹ »B.±ÌœkÐñ cÉùDTwíì¡C!7žVW0ž?ñ;-($òb«­ŽW’qö8Qݱ31E\™zÿ‚St"øеIk~Ô@QSq12,00(2öŽDTr4£ˆ§N.“áJåN¬´ë»‹ Ñ<ˆ¥af…†¶‡\Zú›ü–T Ðýä“·¥"îç‡wé‚ÛÚžÚ4<>¾ìHPµIUVÖºV_KK±fK± 'yâï¯n̈Dprþ|;A”µeH »wuUãahˆmØÀÊÉáÀe@&“Õµaúy wsSGÑðji‰ÿü³:iOƒBÚ"0˜²cGL“aa¦¦ôäägyyåååL ŒüGì£.B,&&HJ „Í9G Š¶¶Æ‡ÅËËñöªV‚ŠkV½v%è5—Ë­äp***ØGŽˆ!«BHÙ©I¬ØÕU8oãüùR¡°R&cÊå˜æ÷SZSôs‡H„9ƒ¯Z…ÏŸ÷í‹AG"jb‚yyaááXffë —J¥‡Çã‘æQ‹ ¶òý¾c’H$eõÄ`T¦¤H66 kkEçÎu·”––ØÞ½Êôteq±²¨¨…#)I¹{7äëéÛÄ4»aX×®˜•Ö»7¶e‹Ü5ŽG«C ”BKÁÛÃ+‹ÅjúýÙsêO£×ûÜÕÕÕÅÅÅ¥¥¥ä ƒž©TVQQJ§—ÑéUqqܨ(YD„ÒÃ36®ÿÕ$æææľ‘Ÿvè@$év—.€bï”S¦("" Š{÷â÷;‰ãEÌNR ^ÚL´³¬ŒÏç¿cGý ¹.‰D"@«?›Íf2™UUUôVVV’.L •êPäålÊM›°‘#±¡C‰ÃÑ‘8Èsò9R¹u«"5fÝgåàú^|,´Ã'‹a6‘”B#…B!5Žíœa’šUÍÄ pû<ºMpÛ?Ñr­‡í¡ƒ«/+ƒè¦X» Ø(iA ´¬‚ûÒú®×†¶àª†Nךš QJZ« ’ pK-„dÚÒFh‹…Z€FÀ’L—Èù‘ éE)Qjˆ Ã`0´Þ°z!¦…p±n®ý*è’åH$(ò;6 ¢’’Ò™CíІ6 ”Þ VÉl”Åb‘ jS-r—èzi~`Y‡bµžSë?áü'¬ûàBµ…S”Rj%±àÖ-rspœJT"é"O †„OánAî@‚oÔn)€ŠUªë9á6ð¨§ÖWSpRz•²î¾ŸÏ×­ñŠD"j ‘Òk“²Ž´›RÈs­O®{'å6)Q¢D‰%J”(Q¢D‰%Jí\ÿ¨æ- endstream endobj 922 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 129 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 7189 /Filter /FlateDecode >> stream xÚí\Sç×€ÝuÔVqÏî:jmµ.TEq€¢ˆ£ˆÅ"²‡€ˆ"‚ ¢(ÓbY‚aÈ^ì!{† q¾›(]_m+üÏÓóKãÍ{Ã…{îsÏ{\.‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚|ŽàÇåbtu´ÿÁ9Ÿ^Ž ~eL€îÉ1NÎ0Žð?š8|Œ® &‡ß @dÄ'hâhå þ­]Í<àóù=9ÇlÎw/Ÿà0Ÿ Œ®Š—oÂx<©¨¬äñxŸšl ‰’êDz†Ñ•Aò!å¿‚óZ¥ŽÕêþ2 ¡¸>¾°£‹"©´Á;(¼²ŠþiÚæ]L\dzQBQfB×Eb1#Šš•‘žÖÃmãå÷†\ÁN)oÂ袠Tµ¼|U]SKdQ늜ó‰ôªD¶‰É)O©`a&tQ$9VÉŽKŸ•™Ñ‘cN»Š#°/aÌ„. *½Å'ä]ð›ððp‰”••ÕÚÚúIÕ6Û”cŽua‡ppLʳ§O"""BCC‹ŠŠz`!¶éÛ´¾xóÎÜÂÒÐÐP__ÿñãÇÍÍÍhŒÏÃ._Ò!rLGG',,¬žÑÐ6h´M_²‘‘Úmƒ¶ÁL@Û mÐ6h´ Úmƒ¶Á@Û` mÐ6h´ Úmƒ¶AÛ mÐ6hÜYh´ Úmƒ¶AÛ` m0Ð6h´ Úmƒ¶AÛ mÐ6h ´ Úmƒ¶AÛ mÐ6h ´ Úmƒ¶AÛ mÐ6ŸmʘÉeM´êÖ´Z^Z-WðXÓJ® ^"–3‰´jnZu‹ð9‹ZÍ¡U±EˉGre3±"±y´jµ’-|+fÇ; ž/Õpo[áT°Ú_eŠÖM­¬•,\K¸ á66ƒVÕ,|´M_°(yˆý›Þ¾Sé-dárA”³Sk¸ÔJ– 1ÊYÄ«”ŠŽ—šDyBä±›DÙÒé;I·©D*vú‰Âu[:¿[Š0QÛrL˜{íÛ†¶é¶Ú†•ZUïìñTÛÈ⼑å9s}‡g‘Å,r»ˆ\\LÜ#ÒjZbsËî¸ºÞ IKʇBç„Æ'Üpõ ¾¿ûè‰{DF|9»s‚‘«Z©Åe7œÎYÚ{fÕgÖ¶Šö;¥ª54>ÑâΣ'1y4:;Y° µöήÚF–ç,.˜ÛÝ ¢¦ÖñÈÝ’ h›.¯m*X1ÙÅw¹œ3´ ⬡¥ÍRt“ZÅJ®`ÓòsM¯Û=Š*J,c¥äç\6½”Ïš§‰\Þžglë”QæâýÒ-"Ktê8K¦1 2%ÅÂÖ¥ÅÀøJÂ!í'µ²†ð„wº6w_g³ á+ÙïÒríï 6ÀàŠ®Í}ï„B ]pbíá m„ÁΩ¯ß$ýöCVç Ìvþ(5yáÎ×ÙµÄîNÊI”=~ÆÌï_•µ¤ÊÑÎxÁÒí¯ ùÄNO+->¡²û1³ØJú®ukNÞô‰*o!wœË*[Ü%&Œ]-¯ª¦uYqŸütñÙšwÃ2\Â-5uW®èì÷ÙQ#§¨*>¹¢9·¾dÝ¢…œ:mpåÄùóËIÌ\}8¸ -ëÐ6½Ú6䪖ÐØxÅ–m?¢cf}VWwù’ù2G.û¦Vg0ÀÍÉpÎÔ‰K˜G½¯¥V5i*,“R±#ÎnÄ&Eg“_µõ¼k…¢|`šoV=·ýtÖ”Éhµ1Ö˜±@öàIu­Ë²–¹òQ|¥¨A|~•î1™±“ç©\È®çPéÿ7²[ÖK+ªi[¨ª•˜þ•Ü™›¤œZJ·m#²M.£bëòe?[? /jJ,fP+*¥%Gþì˜Hhá¾åIñͧ–_zäFxf'<)éðžMÛÎÝ{Ïg›µ2r6~™…,:±ºÚuïÛÊæ’Ü%“†+[&×'ÕÇçW>|p}¦ä<‡¨ÚŒ:ndtØ‘ãê«d6ïUÕ|Q˜JoÍ­/^&>CË-2ª¨hŸPPz`ýü%ÊÖ4zsJÚ¦wÛ†RÕ£¸GNåÚ‹ôêæäŠæ`_·%«wš{Eå·¶*ü°XûšÙ¨ +§”)O‹ž5æK³ÀbjY½ë=“És6—)&FqïÕ¿d·Ù†I«…_žÜšýÍ*ËgQ±E "g’JúÇ~/¥’ 8^˜‘´¤ÓÇœ¼z}îwûã µšãè+»[^ëþ›Ô*VbiSdlÀ·³æœq Ž)ecmÓͶéÐEz_q©˜’)¥¼fËü/4=ÒŸß7ÿÝjЪš¼ž>\³j­ÙÃW‡ìQÖ¿O®ƒ¼ß®.<—µ{˜ œ¸)²¬mËÉìprš²üÚún-pïÎ5ÙÝJüBåvï?ïàK«‘mt¼bâÊ„»¾‚ì8hè‚ r¹œ‰¶éý¶‰îЙÎMŠñ—ZµÃÈ=:.ÜKr…‚7¹XeóìƒVñÅD{×[ÄæÉ¥§ý0wŠÎÓŒÌ:nçÕ…½¤¦L&hÿ$#«bêŸ&(ND™LÉŽ;`¸]ƒ\ZÿÈNk²´‰JÞ¶j¾É«¢ì¾À6ò :ßfÖrˆö  jû†Cú©Uä ´MwÚFêøµ§‘%씲ÆçOíÇŒœê[à8tüºðŠ–HZÊJÉ –aµiÕ-)ù…Æšû ß¼ÿäË,­ª%÷¶¡Ð9ÌÕG¯Sl9Q£ /ÐÅeäiß¿Låz^U‰æIÕ-ªV™¸tBi·š‘_vs~CÉolSÎ"çDŠõå’ÕLÁžT'„“Ãs¸--mS^ÿaZ¢n®mŽÚøGzr1ÝTçøâMJ eÆrÛNÚ„ä6½r1¿üpx¾ ÿž\R­´F|ªäüe¬Ò¼ßÉJ”ÙLÖ¡—í×sy[À& çl"‚F¯’ÓĊ½kÄ9ÄSò‹ôÎY©bÛ mCtÒêá¶å™ïä5|ÉÅÝpÛmÓa™5Æ ?AlÜxÉoÖzÅ’+Ù§÷.ºrçe+Û ÆWV/Ÿ¿VýV&ƒG­æþøJzýŠÓ·ƒˆ]Ÿü‡ÒHPÉÐ9Ïí´†-PÖ´Â[K¬è´œ‡wm¸pô.dýªk•4ŒmïRÞ9sÅ6ZaSùïj›„ÄgÃN÷)úõFÚF`n@_NŽëçG<çtø§gÛ&46~Ǻ…ý†Œ7~˜ñ“­ß;8#½$uåÂ9Ò4.XÜ2´Ð9`¸iÐ{Ñ}„0Ò£áƒÇ¹fqiMf›¦¬&î‰]«vkÞ Îil¿ÒË¢•çÎ>À(´2Œä:bÀð#¦z–Öí–üzÝó" öë\Û¤3Àò²òêýü©åh›î´Í©eö~IõÉ€ô:ÞBΉ›>|ô¡KW4/›jê™U?&)ùƒ_)?èÿ†ì’ßvñ~XfçWÛÜx]!¸Í-Øڊ沿Øgãn„ª! 2}I¡¤¾Öu‹q²7Ÿ;s±ºñ5M=3mÃù³°~’ʨ’ l_ÞL´O.eXŸß3îµzK ö¤~g›ÐP¾„äH®›› ÈùÂéÖž”âN5‡ âVȨ‡ôZ.Ñ‘yxKÿûu[Ò=£ovÖÐjçÆ%ß)_M,m$Šáw‰¯Ä>ûêEP;ÛÆöUƒ/L'á {+Íoe¸†eýtÑ1â÷ØbèØ…º?IÏ^wà‚‘¹¦ž¹Úé3k¥¥OØ“Þ†o“W¸ô”UÏ#V¡•Ë­œ¯lèžÏ$ãu›î³Mùæeß·éÔªæ8·ö4­Ž—Z#¢“•·wý•9à÷Æ_nçVmga›öŽØR¥Ë·Ÿ'äø'd¼ŽK Ï­£T·šjÈN[ðãÍ_¢2žúû+î”^¦ BM?¤(§`à•ßi5Üܸi¦¾~ïmÅŒjv/~IÈLL»n­7eÜ´«ï…÷ °¶ùƒmæÌ~ý`Ð ž ·®ŽÃãý;át§mö*l?zýe{qÂά©Ý'#uÐàÑ»R.!¢_“ûtĨEÞé5Û$¼5hêóÒÛÄìÙµyÞ]íýëøô׉¹Ñé…Y;¤—¯ÝsÚ90Á?)Ûý™ë¢ÙS²{“˜Ež'6âj8ƒ° ‘ºéåUÖ¦ç–lÑð}++·MÍÚ“DË÷Ž?õÓŽ9+½bßSªCÅÐ6Ýc›ìºªÃ {tœ£Ë[D SkXGd—œuŽïñ’”_épMíOW2› ("\õÄqó'±é5­¢ÕÕRž>eú4qÉiâ3&NœtîarB 3­¦ÉÆòòâs&L—˜÷½ªÁ½¸jx䧸g·cXy]0R‹LçF¿ó—Ù£îJ WÚµ]Bb¦ä¬¹S¦}õ½Ìþ[orDmp¼Í_Ù†O§_?Þ… Ü’’'œnº^ÙLJH>qê„ÖýQ/†Øïq±w¨Øû'SˆòU4x¦župàTr93š²x¾´o)Ÿ"\=,‰ztß–ñ‚›1múô‰‹¶Ø<%Ê›”Ül­sÇgÍœ1iòÔÙK7êÞ'ÑjZ}=­g®UOªç‰Þ–Joö |µoï>s·ƒò›&‹Ï”˜1sªÄÜõJ罓KÉUÍ¢fh›nKœÙuˆ†\ 3!£¦¥cØ°``-d3xɥ䪖 ¤U7·7\ÞÏcC.KÄ“ôjáHàò¦´:Èi‚Ä9üǹYY+´ ÚmÓûlsâ&ܾ –æ°x<Ì] ÷îŽ6˜]óó0°?lüº:èÀµ+°d ž^®ppˆ/‡·ÀDL®½|9ú Ã`i ÆæàdS†Ã¨é`åW ÀÌŒ.ÂW£?H822\©M8á´ ÚmÓûls%ÞzÁÚ¥ðÙ ðJ#e3æ,Ðd] ò¦P™ ‹¾‚é߀“Ü< %À“°4HJÁ¾]0oH~ %Õ 5¾W„ŒHXº,k'Øø ì9oÜaü— ¾ìÁPåCûV ð<=y´ ÚmÓwlVê0”xþ%Ôrॠ8:»W ¶g@Vb´µÔ0§Nð¥x¸Â!i›WlÀÖ.]†j€­ už˜¶59ÄÅÁþäƃíMpp†Œ<ðqúð+9ü™3™T*ü…pÐ6h´Mï³E„ÏB?1hâ‚ò°q#lÜ?,‡9sa÷eˆnWÄI#xvF¶y{7‚É]¸m2«aÖxß$°ž3¸þúÎC¾‡àf +WÆõ°^æÌ„þß“j4ˆ5l˜Ÿ¬¬»“S%þ§ÂAÛ mÐ6½Ö6ƒÏ#Ê@s}Ûr%u˜5ö˜CA '–|Ö÷ÁYˆƒçCؽ^ÇÀ 9AË™› –¨m¦Â*5¨ŠƒÂÕ î‚Æn8dáí¥Ñ i^ü·ªi<¸FLÌsÿ~}}cã{÷îegg‹„ÓÙ9h´ Ú¦÷ÙÆ6¬Taä`Áó…?Bp$D¼…¨p¾#†Á.=(‹'OˆK„7Þ°l ž¯žÃ¡ b“ ŒƧàA$äÅÁ¬I`íäHH‚×®0m$Lœ ÷} >"ß›=,œò·ª)›4ÉIM͈ø•Œ¶¶¶ „^°¶AÛ mz·mÄ&Áè‘íœ0i*HHbì—0`8({R#F –LúAÿÁ0a<|>† ‡i_ – £Æƒ¤8 êŸ‹ä ”„ bm7ÄG,‘‡ c7¹þôðIÓðáy6çÎ .éZ^Öý –fzzJJÕbb¿¹P3dHãˆOöî5Ñ×ï¬SSS[[ÛÌÌÌ?U ÚmÓ{mÓ>ë%³¯Ú¦cD.q8::êééµÝÝz¦¦.GŽÐÇŽí(rZ®7ŠèšpGïÉÂÂâöíÛ„júÂ辿É.fO?´ÍËï–ÐjxÜ®?‹‹)lüëf=1þÅw÷u؆hoԽ虙u¶ kØ°ÂiÓìOž406î¬KKKWW×ÆÆÆÿG5=ß6²…E).»ÿø™¥‰*øʬß$•àÕÒ2ó+f?>ˆ+mDÛô%ÛtLçX\—_WXŸ$ü®¿ ª+wžw Í ÇÔ&”4Š¾¾xL*®-¨‰/bt|U`°Mqq±››ÑOqpp°ÿ0Mo]·¹fmsÃáÃWû-7ïÜñÑÔ¬0P {Ô¨ô… ¯Ÿ=«obÒqï‰ÈgkkkooïŽÞS/ýTfû»Ì¤F\!ƒœ“zúôÏ›T¯§3!¥¬1¾°6¶ 6Q˜f:çñMí/g,¿dÿKÖ6}®¶!6)*=ÛÖñö±ÓçOØzFf¦5ÀEµµ»4mM¬lŽijÞˆ)l R%6·ØÞÉþØmík3j„¿ ³·ÛFø…U<ø__Í=ôô»ýˆÖ› ¨HÎ/‹Ê«£ÔÀC«3h›>irUKTbÂOGÈÕ¶÷|®­u|¢Ä7gn¿Ö8$%ñ½¬á-×ÎV|;GÇ=)¥¬Ñ䜢”Ü «;.'5T¥dT#è@AÛ|<Û¼yó&88˜Ífÿ Õô‚ñ6%5^nvs®Ö¿óÄÜÊtáüo¶ŸºþZa¯¢ªîuÛ‡GTTLÝÃã+ù.æ'$¶k¢múàðò&ZeÃÓ—ÏŽ¨Ûsüâ=¿·ÆææÇ-™Yê™9xœ<¯»ïàáã¦b+Sƒ%ååi]8µ}¿ÊAM£gÉ•iíóÖ¡m> Ä£hP §§ÎÌûïï€W°âÞ—Z™ëÊî9xZßäâµ;&÷‚28O^tADù„FÝuõÔ×Ó#r¬ÇÚ†Ãá¼Ï/ÈÉÉÉÌÌôôô4000Fºâ¤ó Ú†Çå62™ùÂ+(,´´´4ÂTèâ뙶MBˆmóóõÕÕÕ5@ºC"„èéé}R¶ÎHÅ>_”fVVV˜ ]˜fBzlmÓ›Í~ùò%q,à ¢K!RÂÃÃãÓ±ÍïzU&HséÒ¥·oßödÛùŸàååõéJˆÂ&&&¦'gB—ÚÆÇÇs «qwwÏÈÈèá/“ɬEºâïü¯'ºííÔ××ct,«'«¦íšÒõüîoþé šUéžãá"‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ HOåÿ3mß endstream endobj 936 0 obj << /Length 2642 /Filter /FlateDecode >> stream xÚµ[[Û¶~ß_!ä%^ ËðN)РIzAqr²›§¦Øhm%kD¶\IÛtÿýŠMú*­X°(Jä7œo8$EN¾&8ywñúæâÅ[&“ e’ÊäæK”D‚‹DññŒ%7‹äÙõC½œçm~yEU:ûصI½{X.ŠË+‚g?˜ŒEYäMan¢ˆ\þyóëÅ››‹¿. â„$ŠBå)¬’ùêâ?q²€ü_ŒX–&ß»·V —)\ËäúâØJ‹!1¢’é·%Ijx°—ùaÛ.BP&Õ Ó°#Ì”iÓͥijÇMÑa«/溪ËOSh"³¦¿Ç‡*3OU8¹¢…­ð¾¨uËžå}‚šKkq ÙáÀu‹Ó Ë+*„òö•rÑ)’MûXÚÜÏójÝëv¯øs“SVÕ7“ºËç6µ\[ü¾êú¡,n“ž(”1Ëð›òÕ¦,^ÚöêŸÖm÷}ÊIÂ)R$?I¢ž•pDu¤„&’ DSzªx›!œQ[Iôd3 m?ǃÉ&ćÑù\1”©´¯¸.’/kvv·sí¬KÒ$SÜ—ä’ÚÔ´:ó²¨)‰ñì¾m7&•¯wWÿ9öäØþòÙr½(þA›ûͳWÛ:o¡OÚÛf¹xI^AÓÛ5ä$¡‚3DÒô lìTS6Æ(­Lk•JèÁÄhõ—]sÎï*ÝKÿÖ6«ÐicÌ;/oò¶-j[Åg­ÓîU­WÛ…–ÍNçZØ*ª¾;5›bÞîÔûóÍÍ{“Fl¼¤p÷å’ŠÙèÊBÌv:Óã™v:µMÕÅÜôqHk¯aR`pçeÙ ¥Ÿö…?7í:<´åÑd„èϵ{Árö‹­uSæó¢Ù©cGà.o¯ìS­‹º±åóu'@6^šÀ¶zü®“U½°õ©Ê²Ò•~_®¿Ú¦ôÕl6¥•ÔÛ+§s×F9í}ÞŽÒæ\˜ÚØÄ$&„DR±Û…y0ÿš ’ Ìcº°ÎQÕE³©ÖMq[.×…uYηqÌLÎÛª¾[.ÅúYd¯6ž };*ø¸¡î¤W,E¬WtçÕTf;#$v½ÌJB¯æ¿¼õjpó¹Ó¦.ðVè5úÜ<í¼ˆ¾7Ö9 ÷õRÌrÈlMQWµulê4wšFóê]1Ïúì®gÃuÛé›­¬À`goÁìÉïîû–bʪ#z—*(Û•9àxŒg¸ê_<ànÁ¡ìº%=1*þz(ëpŽ84b—kŸô·®#_–ù]ïvv'º<Ë`zzÒp(ˆavÀÁ(˜>gYÂSevÆ~*M¦s6ö¦$ˆƒزQÇo—\·ÚáZ¹ß"8"ŒD‚H(€ÓPŠk¼´ ßí<Ü.-~ßÎÃ÷„¢0Éà<"I*B¡~ZÂ8Ü.«õìL!‚ù°CÀâJM³ ð8’ȱ­g‡ì®S¯'ê©Ìqcˆ€ìŒÁ‡DzpGºþÁº€ã”F)‡âœLä\RXèÒ(œKRžùÞ7×.ïûî#Hà¸÷EÄ}pǽ~žûÑÈ!÷PK6{X`f µÜ †x漫¢½¯NùÿàŽv}íÀí>øyÚG#‡´Cq…³i´3“ˆB;'ˆpL¸:¸ùÖò#ˆàÈ÷e¸öW®0«z½]å7†Â8cð…9o £‘Cc€âLÈiÆ/PL¢M‘‚åÑÖæå–d·wÕâñ„-DÀÙ‚/ GÜqç~4rÈ=‡¶MãžP°Tî ¬g÷¸¿/òÅ!Í;Ú#€;Ú}ôA´Gw´û௫öþç£aCΡ¸äé4Î1†ÑŠGásX˜î¥>‚ ŽzOˆAÌGÀvÌ{ØgˆÅi&&ÏÒF¦¼³Œ E•ïç«êÛòÄp»ç;Bxìžïû4á£Q¾YªPÆÉ4¾•€Ñ(Êbž© ®Ì_Ì7E}›Õ ÇI €cÝ—`ëÀí>øÙq}¸cÞÿÐûãƉÇeDL!žf©(sXšqĸÚå}^-ŠãÄG€ïyð‡ð»§=À>Oûhä€u]ZH2‰uàŒã(ߥh ¯eìÔ‰€#ÔGÁqï 1ê uo „qÆà 3ÀFC‡ÖÐ퇦“¬´ˆE”Õ CHúHÙ[Algø Û‘îaþpáøò­÷@ŸÄ·`HfQ2ºù4•c>QöÄGÂïK1ˆùàŽyü õ£aCê¡ø´ÁžÃsg´çeŒùDÙÜî£"<¸#Ü?CøhØðn¯SM¢œ¦0E9}BEBù_ªš¢6'ëc;=÷¤pÜûb â>¸ãÞ0¶†ù×û›Ä?‘H²('P(2©=†¡•^· atœöàŽvýIS¼Â83ð…`£¡C3èö?Ǭï~¿¢°Z¤?ÁÜ›¥6~‚Í–«MU·ùÚf›ð :{Xà ë¸.€^³tÖ´õü}¨í­ ‘b.°‚ö§ssg+ îÛ˜‰ R³M¹fÙGÐÝpmå¹¹ÝðO׋ &ÁŽÈáÇ8ï ³ :Ÿ¶œ8Œ¡TZ…ö'¯S'•†6,¶€¿ÇÙ´Ø>ƒŸ]\RÄ'…6x(AhCWoœÈ®–ô›BïÞܘƒ&°ê¾]•&Cëý¨ía¼Öëi¡£õ·Ï"Ô@Oy Æ.yݼ‚t*mü¬÷pZ§™JÉ̶ ÈaRŽñ€&ÁÁ„õ‡>…íî†÷lgãÃä­ª>c^­VÕº´»mSзÈ/¥ $s=fwDpðÚƒ£”÷c©»ƒ_ˆôÃ$G¨’”zþý7£}³¡Cõ^‡þ_tæ‘p!QFAØ@(OÚÿׯÅr endstream endobj 944 0 obj << /Length 605 /Filter /FlateDecode >> stream xÚTYoÛ0 ~÷¯Ðc´Š.ëŠ;{mè–zO]ŒXm øHmgÛÏmÉIœA7°)ŠüĤHÐ "è*x³Ï\"ƒdEÏH1¤„ÆÂp%èqò°©ÒeÜÄÓs¦ôäGm+']mÒÄNÏ)™œ9ÅÂf6®­ÛpÌ0>E·Á§(x (\Fuà+¢Ð2ŸJ@‹æF£ßUŽ„ÔðÏÐCð= >P‚)ÄG0“¼µ–Upp¤\ì(QŠM²ž%˜på8]GÑ7geëuY@Ôm¨Û»º8Zün怄ÔXRŽ¤Xps’ˆ®*Ü’`hÊ„LÁOa$BÌŒòµ bsÄv¬Ù»Æ`Béþ5­^(ŽÒ=peÑó(ò.×aÉ€J)|‚¥qH÷<£˜LÏ%!F¼p÷“rQµŸ¢Í8 AA™Œs»X5yv9zÒ¤Mf/L]æÖIëøÅK3o1æ<»Ž¾~éŽFYž¬v(8¦ZÿG©Ž;  ýÿ¥c)‡f¼SÉ à2Gò¦€ŽɤY¥µ“씆“?q¾Îì™ÓìÊÒîz»fewÇNúÕºÚªNË»v5XoŸN·«›¸ÙxÀe™xm\$N¸¿{³wnëÊŠ·•TØp?ŒÞ% TÞ°¬¼{b›8ÍlrÄ{>ñ™ZØ×­›ùn<1ÍqØU€S†!ý\¦Ö²›S³›ºýc õ­  ‹Ý›FÊá&ß<G§´€ Û?dQ½ª•¿Nûa¯›~^ …±ƒy¾Ød¶>Œô//|fÀ endstream endobj 940 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 417 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 62906 /Filter /FlateDecode >> stream xÚìxTÇöÀ' ¥X[\[ZêòªThßkûúÚ¾½¯ÄîîR H‘„$K<! qÁB€ ÉîfwãîÙ¸od7Y9ÿ™Ù»ÙÝÞèä;_¾»sçÎÌùÝsæΙ»ïL9š“À„ÉŠµpà"ñÈ•‰¬*˜ô$ûm˜Ü%ÚŒX!a´aÂhÄцÉ߉6Bd‘ˆ¬Dä€Õ<£ FÚm•ð¡¥‰ã×%OZŸÙô–šÞ:Á÷üÕ’î;Œµ°ï’¤ñ+ŤŸÿ5BJ5a]r›„¿® ×¥ ­·ÍéJP«dmeÊf¥ê†ÛÐú´J,¨¯lM-ÕËùŒþ¿—e”Ëñq‘LJer —Ç$”qí¨Ëàz Z}0Pß4VI­賞—NB02[Pi+’ÊÉÏ99.oA«“P%=.Sð²Vr\шæðÑ5jjCyM(¯ÉTä¬C—‘…Í¢Õ™¨ÈñBA×nƒæŠP½Ð#èØLnŸ6‚Ygêó%åÈROGðÝ“FðªÓhç)mUC[{²”t˜€ÓÿŽ‘pik½”Í ÚÁä+~ÃM™Ñ^Ø—ß$.U4µkZëõÉÞA™±/Æ’°8@õ˜…à–h3ä¨ *Kºï0V·CÕ)¹êH7ây|ËUðÒrѽJ›„Où*P5÷ÅEÕ–Üœ0U‘/%k•X°j §;}= ò«‘yw•¿Åå÷7\1hŽh³@a¦ˆüÜÙ¥>ç§E³Ú\)Ẏ°³µ)i¢Í¥HZŒ~¢Vš›L.ì–6éjdŸŒ¤mŒ6m¸®e-üôR“B\‚,Œ+Ü*a{ $žH6PŠ2T¯u4œ•äÀécI `67ÁdNþß‹ Ý1§ÍÒÔ´!¦6ڟŸÎÔŸ»X€ðÏEmô—Ó—˜Ù$tÛĆ ¹YÚвu¤Ð)Á^s;RÆ*ù©+³ÁYØ֤üºhúDp™û-fab@›Ž:¹ghƒÇ»@óõ*CkB¨ÿ´y!z€É¤’?œ6Ä°ÂTä'Žœ¡B‡’9¶Ïî™6Ú¦—¶3ÚÜ´±ÌKƒ\A¶Ñ#Û’ŸTÞù­Q—ÊN—¶) jöd´ /MCAB®6)±B­ªmIoÖÌÚ•8xW®¤BU\&ÛéŸbÚ(WŠ•ù…2)Î ZâŽd.ˆ*S¶7)NŠ°r•C^ô¯Í§3³ëÕêç[n‚6BÓµùj€É‹IÉÝ Û Y˜„ÍpõJCË30å&[r·67OQª—“úù8²ÇO–ðñó•¥U8Ùd¸ügÅuùíØî¨ísß*…†ºSžR‰~®NS©TÊI£FÕ¢TSÚ˜'Vüg£è¢µ°7Ö'5šasu†ž¹ÍâStXR•¥MÂÂfNŠZ^Y¡ÓÓ®CkÑÑêA œÑײ mj¨ªCÚï˜6X }¥HAu[OËD7 MGÊŒ6w›6 PeU*rª8‘kî˜68Ð21ÀËNlt•%?±ZíãIšo^ºà×}ä¡9|k.4ÉÉ ’C±Ô„ê ª‚¶º^3ã—_n9u!Ÿ¤I,)8¸—ÎøY‹š°J°R4Æ·äµ},È`ïµ9 }üÌx›4(ähu Ç: T܈6 Òpa^ †ðQ:Õô¶ê”ø‰¿<O¥iç-[ÔðìÒ„Õ¼½ÉȂŠ5xx¥hæ"1]˜„ùóâbZ”Xg›Š6`-¾]E’°)4mƒi™{¯ÈÆõ¦ÕmúΙÞSºŽ6C´š•àd¡<ýk6›¯Õm~Û—›·1ì ø®ËëÓFøŸ•"9k\ ñ„•bü0]aL›Ç i³Nüâ©f(+'‰ãÀY8³æüÕ–¢¶IªÒYR´/ö­%•–‡í2ü=Èí<Ñ¥eܼ„¥è©MIÚWð¯µTJòÛÖš³…Ym°/;Š ÃY÷Zõúãå Äâë½$…Ìupä_©Vïå¥SKŠ£Íð]ù —£™tüÎMSj-©9´¢þê¥]ÖÛà{9å)¡Eî{µÊöbudÖa5œè¤ó6×®”uT'¶gŠzë:OO´yÌã<ʧ,6î-,mð#CL¢Í£?¦¡¨2VIBΔ¢S¥h÷jT¤DÇé«RYJÞž'× È2t ­º¹hÓiÞ溴A SkBbË­½ŠOU¨3¯â'éOgÕMKå¡ÝÐwÑt5œ»RfîY[§N¸XˆÓ·mվВ=—ÎKäP)%Cc–èBúë­¢ng‰ÑÒL¬ä¼½B„GPB;Ä‹«lŽzå(Ú¥UˆÎáôYFfÚ ‹u5#Ø“Mô¢o7‘ Ÿ£dj…zË6N¡Z” h,i˜ë^p@ØMMD;Ú¨£ ‰ ¾ €´äê%¥¢¦6¥^Æ´±Ä”µM_sO®î›ÍrWÖ¿’µÅ?Úgõ·ÖQÑZ<7Tº:°dl -è Í¨]Ù«]³;ëÖ©NKÖ…¬ê×9#1Š¢Eª…M" ’¢¹º (° ­ìR< 4ˆ†ClóÑac„@)æs“6‹ÒPˆ”$~²„ü•¢d–ù–¢]tâZXBìg´¹ «ûžÝŸkã©oë„|¥¿lwÐfÊ¡üé•Ië„·½¤³5\˜´*\:jÞu[ÄJ0Û«ä¹Õt5¥xIdÉ<ú°2´Î¯ˆ{e`ø[цé·øi¢í¥ó“æH—yäàNµ9¸x€W°%þ%StX‰¿t+\XüùžT¬rh12qoîÊ`©¹CZ™½«dÂ6á`¡röv‘áíý­pÑÑíð眊·zfИâO Ö‡âË3‰ÁÅåü²ªcÁŒðáÝy[ŠSûkØæŒÍAE-ô¯ä^?œ»&XjáœcªhZš¾#0ÏÔB÷NÖFòó±¢u'‹&/Î(½TÈ‚ ÒÉK™Ÿæ¹pÿ‹…à|­üIÁmÔšÉÒ¡Zšø£ F›»#?óoçªùÉ…j Èå/<ðUÄhÄÑ毭7ôc<™Ôe>àL˜0Ú0a´arÏÏYž4bI—ÅVBÏ\៤?ÐLM$NìÉeû:žÔó$“×&²·Œ6Lî]ÚXðw‹U'B3hc0ƒ¯úf }s4KP¢–±üÑë½,ä5ø ß¡¨/7µºEÚl/e·H† £ “{™66Ä%™s»¶Rj¾^+&«am2ˆG ]gb“`:'ÁÄ0f·u¦>ÎœuÇ%†ŽÞ6D:ü¸GýZ$o¨Æq8Útxdx›Ú$èu>×\£ £ “û6Ñ)ÕÐÞv¹D þa™à9ïJ…Fs6®zÞöÄ ±M*ÏË•SçòMR¥ÕWÔüÛ€cÎ^݃š±6ÍÞ…í;ÃËq<ÑéœöFÙæ¨j¥ÞZE–ñ˜n)”¤dÖ'Õ)5õM}g z/MHS´+öÊn€²²2…úRvs;ÀÉ`ê•`!˜{M®VªÃêªsJéZAIY«¦¼Tv¾¨=,¡Úëmm˜ÜÓ´IP¥Ó岖¯¯©*ÅÙ8Ùa±G{ܶR£PšÑ ™…ùª«©±õ°Þ>EË5 ÊØ‹ÄY{’]uK}5gIzÏ,ŸQ6±\ÞÚ†¤•NÌ(xfÓ'‘/âÀô² ¤j3ÊƯ܉¬ÝZe=#(x:©|T«Ò¤¥î £o“ÝhŒÐÑÁ¯jîÿÌÒkÝ”¥¾ƒ›'þ™xéä?Êý®¸Ùl•TÔŒ¾ÜÝ)‘[öÉJgâ³Q šq÷¾Æ{uÈhÃäÞ£îs‡âO/½ /FÆÜ°l¯A‰'B ”"7 ×&sÝÞ*&Ð)ϳuºí¹v›ØL觴µ¦s¯™F¸mÈY¡AL>ÖýšØðMô:‰ÆeÄeJÏZwÄL îíF)t”ÍÄ&¾ß|~G8Ä€6†W%è‹dÝml¸Ëiįý¥(ϧùÐú-êÖ{Ñ«´¹›ÆìI¿º“:d´aò Ñ&Y$ÎKC¹‚ÃF}Þ"9M†¾Ýyž~á%mwš‰Zê šû¥(·à¥~Ö|¹=¿ì†º0@ÖKî„£õÚ±THœþN†l€¦ú-³_2º0"3yµh^0.ÕW‚G‹£Èׂf]HÓ Qì2r¿Ög¤€Þ°N{3äE5 3â–¨T~ÙÇZŒ,Ò LÂ2ßT)†®³?;xó”žývbmߧ¦ÚX%¹JG@óØ ñô%Š9¿ YŠ·] M£ÙâN´Ù²¡fjjc?€a/ÌMí¿þXtþˆÆ¦Çí.üÏ#i‚FóØÑØŸúX¥ä6¡%\~ïœ2 Ç|u~J/ï¬m˜ü•´yƒÒËÇgUɬߪ¹CÚÐany.·ÝåëŽS2R–xá±¼W²ÆYðåªÐæ!sÉòÌþ•üídÇ<)©ÍÝAf?,’÷¦ö ‰t¸u´%£Þ:a¢ÏSšì-hÅ&мÛÇR‚¶,(æ^Õüš™ØoË=ô™6Ÿ*'VÂ’V4ow$²È8‘=0óÚBd!F扫³QRì:ÁÂ?ÖŒ d%2?ÓhÊ‚DRæy§ÿÏÖŸÅŠPÿù×:ë62³ 'ȵ³R¼¤èÈñ øï›ù¹–ÈJ<|ï7êÖhu%ç4˜] Ó¦ }·ý,ýFUºmJ_÷@WŽ6y–˜ #öaÚ|H¬9L›F4gO8UÉ$_„}T–ü?½ÂyS´¹¹:d´aò@XRí€~Ú}òùm>Ïoó²ö ’øìöáÇ.•˜™§à‘òM'+€Œ”‡‡›'ÝmP{éǦ,¢ß׳òjôËA÷é{\°¼µÇõ•-ÁÈJòÊÏÑ“ô&ºV¢OÕÀY;.†–¡/×%Û\|ÆÑ)zu²Ý'µc½ºå‘ÚØW Iòw!´Éíµ××Ãâ¢Ў͉ZÚL ÇÍÛX 'oö¶ú3¶ Ñ ™‹o0KLhÓïz´‘¡™»NÑÙÉC?®Nù†|²Ú$ÝQ2Ú0yðæmôoIÄhv •$d‘š\~Ù}š€âÉÉfÔãHÁdzÒ8[Rg¦N´ÿ´ëƒ³ž-(R¢Ï6Çj3º2bÀ:ê zÍ癬m 'ø¿pÍo·Týø‹”QbÁ÷ÙððˆÙ©ýW»ƒz`sºƒºEjªÌlãïÁØ’ÒÓÆ\t¸ó×Zˆ;«L@ºÍ;óÉÞHR<+ Ö¯ä€^Ÿ›FŽÉ]oH›ú¾‘—kióȾ¯õ´i0=æìMÒ´L_ueÂÕkË;ß>G››®CF&/Út*€dMÆЪÜÿ~°Ïá÷„×sËûè~¤ÌŽ«øÁúk=¼“mÎê/MÆãQòÏ ¡uüVÿµKBÀzÎÜ]1TñÍI5Õ€Ù”¹ÚÕ,B4÷¨¬m@­p5¹‘ùÄè«)ü€[ǯO}´&†¥ë¶ ÏCÃËÃæ%ÑÆZ2íÈLœïŽÀå{®L¿˜8JW 9¡J@¾Ñs,<7NSUýÓÔs¬v. Œ\e3zžä BÌù_[¶3ÂæƒM^²]ùÍÞShþé_Öõ·ÔZ"‚5As]ÀGq.å½?Ûgtùü³;B—ö±¢ÃÙ2vuˆÅ¸EqÈ2e‡¥ó6®xfåÝçËÅî¶P6ÎÐÏB<'`ζGÐ/ø>Ðüç#'8Y$½c¿cc¸µ¥Ë~d‘H_ß'}á¾à2ߢ’Lý}׺°9æönhÍþMÞ.$|Iˆ¹Ï’­ásæºègMªtèÍ~–Y‹úÏ}rù:ô‘Ӣϋ$™Î½d0w½ÿF|üƒïÂ-!KûYKê?›Î~qlé¶Ðïm>׳sëM×!£ æ¹pSN QÓø 6I·³ÂÍ2Y©Ñæíüû¦iè¼ÍW; ÖZ‹yr7ò/¥f´aò÷󓢟ÒoÝñ«‰Ó=?Ä–HLüÂîç=îQÚ¤Hè»_Ïéa²Ü%µtª°`š‘=1qI<£ F›{Sæé觬û 5]s ¬0!Y9ðcú1ÛXr˜nÄц ógÂä®ÑÆæÊø5gL:¹3Ïѹ3“Ä"d}×€hèŠÈ‡Æßëåd´aòw£M'èU{& ˜™lÁòÀË}­ˆ›ÀxŸwŽØßÎ@î”ÑçÐmžî”Ù—[£ £ “?6BÎyŽ‹áOrlof#ìL›YÉúÈXx­Ñj$ëçù:jÃM¸ÿœ‡r÷£›úVÓø‚þDßv.‰µ¶$\QÉ1Ç%ÃðÎ v¸{sÅ°Nè¸^shÎíûG3Ú0ar'ºMŸ-¿ Â‚×/”Œ„¶aOÏMB6×Ô´3¯_yÕ¸gW^3¢ú‰½é2 ^¬ÔØøšsÕ^øÀP÷+ß=k¿®°±ozî[ÛnäyƱ<+E»¬À쉹 ¦›-1mȼeÊQ#ÚŒ9;•&®BÇ÷_êž6†ÅÇoåÖôZ‰g‡–WóhEã°š6ÓFn!åü}KÊ/èç¸óÊSWy¶×½‰¬â®úçÁ­Ð}»åuèf´a´aòWÑ&²Õšd-mFíX§n}DK›Wºn5i8K|cÚŒ¢å’u|p; ¾ð¨²âíŸ\7xg^ý$´¿ð[£UÒ§Þµé¸<â'í?—7 ô=ÛÃK.Ék_CëãŸý~tNèWÓFª²v3Ú0Ú0¹WÞ€[&]ï¶$Ðfí‰ Ï.×îÏÀßb3ª«ñ¢€½ákz[P/ï¹—·…ÍfCxõåñ%;Âç?²P€¯±ZîâˆVý0©Õ¹¥ÁV›N®cÓƒ/¡Uâ˶KgÛq®ÖV¢o/ß>ï½—EœÍI«ý ý7:íŽZ8zùXyߥÁÛB<2§§¯¢àÛI˜~tíÎ(‹Y¶^½6ìÚèéMªås_z•®JúÂÃæÃÑŒ6Œ6LÏbIMì=3ÉÈë§æÄÛñ»üCdÂhÃäþ¤ÍZlsìݱêØ:á¡ß¿<-È7qÒ/höm}4ü®'ȄцÉ}I­ÿr¦š!D]Ü™³osO‰?$A&Œ6LîO݆ £ F›Î滑h±-ë']­ÐÊ$´ -LD«“Ð*cÁ1—v Ä2Ÿî5×,—üQj.*.ÛrñÝþ|6F&(mèL=’”#KÚȹ'¡£Õ¨RŽ*äH¡FíJTŽèl!Šj"X4€ZôXö$#ë ò—’fTÔŒ*ÚRƒjôÉÞ6Xº"‡kBÙùŒ6Œ6LÚpÛ‰ Ñ¥&$.AÆCÛ*Õ:‘l QÚ,Ô¹f[IÈOOc=Êð ÓÏž3·;õÄ"ë† F&;ÚXP A¶Á¶ÞBäTäÕ\R³D$þnZœBÊe¨P”jbÄY H²åHÖ†¶‹Ð¹¢\%âk±îTM>FàÝ‚ H‚¼jrmZ=jR¡&É_{¦e–¡Štª i4hƒˆ!ˆÑ†É½B¹•Éõ¢¹cÚX“¯¢ŸGŒ¿ iNWÓ—J{JP[#ú‰Ä*—G‚ů•I‘%Õ«Qp6aàL ¥Õ|š‘9å-mp‘ÚíL$š P®EæÚD*Pe#¹Ç •£œš+ 9î,DÇÓÈíÏAáeÈ+ŸË_{ Måh³¹ùe1Ú0Ú0až Lm˜0Ú0a´a„ц £ F&Œ6L˜0Ú0a´aÂhÄц £ F&Lm˜0Ú0a´aÂhÄцц £ F&Œ6Lm˜0Ú0aÂhÄц £ F&Œ6¬*˜0Ú0a´aÂhÄц £ &Œ6Lm˜0Ú0a´aÂhÄ £ F&Œ6Lm˜0Ú0aÂhÄц £ F&Œ6L˜0Ú0a´aÂhÄц £ &Œ6LîDvE•¡™|&Lî\ú- Z$fõÀ¤'I­‡ËÕL˜Ü‰«†øVLº—+5°/ÐQ&LîXxšž0ò˜†U“ž„цÉ]¢ PÚ°ª`ÂhÄцÉ=FžNºþ-GÐßôÆïmzêK·*G{üãÚ붓ºú̽Úo»ê6W5À 5(­=äÌöý[R/À½ìLn‹6<˜)Ü|@Žúûˆ‹Ñ—4 2q.ü”Õ9ËÁH’‚ ¸Ÿj VÁK] àbX„޾ǃz%¼qü¶’ò%·fúöGø—Š îÅ1Ø•6qNaF´É0÷½…–š| 2‹àPÚôf´¹]ÚÌJ„ü#Ú8¶? r#òM&(ŠÀÌ™p^.ä` +ìi‚>§¹P 0ã r%g߉%íò/—Σ,± ,ïmU7A^´?6<£zøPÒÂûŸ6N`W-p­†:ê⸂o ”µBt w‚G"¡M í*È­³ã m„^†wí©í0Í™ „9Œ·'éôói7Amüehj…AäÔSg¡†æˆhŽ3Ò  L¨úôEDÄõ{ T¶€;FDBN87Šš!« ÞöÒEv„'OA²Œdº1Zx‹¡ª¬aCìˆ1  Lér(“ÁÖèîÚÑ HjöñºÁå‹’¡¸2+uýÖ¤íX—U-p–<¸ ¤u0ýØýç[¢Î8ú4 ¤f:%µ]‰× ê„*€×\õ ½½ÒÓº¡ÍO'aKT´‚m¬._GX–E´ õÓe4$.ÕBE¸ Ij …ÒFø¯74huš5¯Ê[ÀWBzNm¢`_1¤§v×j´áÁ¸(n¤qá‡Èn‚ä2˜äJBž»eź¬yðx(ª„B˜ÑD&]Y ¤ýÿÙHÎ&1'GBb#éc[c¸4ùuð´/ÄËà»@R¶Ù(n—8˜.ähcâ ‘¸Ó¶@hY<˜GOÙßC´±Ã…·ÕÉÈÖÑ›T>W`œ¼øaÓ—Ž©b5Ì ƒ±^0ã*@+ ±I‚Ôæ}=À) L [ÄÎ6À|J³ÿòAÑvôa4ñ,´WFc\ÈO§Zkà#/R¥Ë3!<›dGÚú(ˆ5Ðωœ´ÀÿõùZ²ïoœÆ—“S> ›“¼`b 4ü@ß‹µžò‚ñ¾pE —ãHà©F¸–DînA&(Upð’ž6CýÈÁk'`‚Ä´ÃéËÆÝŒY10Ñv—Óñud™½`R®øÒv{œr3<Fž 5¸c0&„{@u›Ü<@‡ôÝéÐ]¢ÍêZÈHïüLO”As|ãN@ÀŽ诀+ ¤Y_?‡1ŒŸt¤Âÿ/.8m:NàvÆyƒM66†(m@ °êéÞk²¡JJ²~*Ì ‚‰Ç®G›áĤšH°Ý5P”I:Óa xÝ“bÛð3wîîR¬½É…#¨"w¬äï#åߘ'øðj hð´7é±UÏ'§ŠåPÛ ¯ž€AÎ0?**`Ìqxå´+ RL\  à}rGÿ•ÔÛy" ã»Tø_J›®˜6“Ï4qCK!À|Rl<„gždGn¿Ÿ ùÿ­$…ºÙÇÎifDH:¶u°"²é³oc»X@´X+s`W4‰vV _ºÖ?u…^î¤ÃìÁ[n$ëàZS«™„)á÷p®ãm¬§´9J*|’¸·"Å$¦_xDsåL(‡Z:bÚA¼ROS[Ø…At…Þ#O8Ð` < POk†f.ðVyJâÑ1Ú…Ë×N ÁRàep-‡«™4¬C†p:O=ÀT·“6]ÿn›6Oâh‡I=O!é¼ïÚE·‘ÁÞ³\•n+€P1ŒP:ȵHV~,ƒ]ÉÏþ®0í†ö0ü$éÀuÚ ¡ÍÇ * ´ƒtZÒ±iŸq§ZýaÈXçË•­—I°ÿQ(’Ã7TWÇå¯øÚ“£îgÉœ%õúy.u;œ-4è±÷üͫA]£ë<2u-‹{ÑÀc0+Ôäà#7¢Í(x! *¨ÝzQSmšÔ„6óŠ!_dpùaЦä´ù6Tà|ž„`…û#{®ÇžVÃâ€Àµ)W·g„MÎ6«áµXHÊ ×^° áÊÖû8U–x„6_úsºM:¤ÞÜcwf¡n–Øä8̦jõs¸f‰©]ùž;­7jMLr&ì¥Æ, t"Óá!¤—Û4u†Ovip*Ax]#m÷¿ ˆ’@^*7˱Ž¤€O¨>Þü2ØOFZÈóU0”Ö˜\*ø5œ§GÀ£®$þÞr¸BÔÓˆ›·)ØÁõRQl;K 0?r‹¸gîÂ"h*!%©SÃ/$d@ ¹‘Úô²…éhk )Qà“À•ö͉- íOá¹ D Â%¬XÊ ÔvX{ŠZRŒ6weÞ¦‡7¿]i£¢ùΗk¯|ë +Ë!7‘³ýÃê z#1§»’˜£#ÉÃÓ¦RçD/?t¶Ö6£OÂÛ'Œ{8¥‰µ^¥Ï¯¬™„ÓDlag|p‚ëØ^(—AK£¾Šj5p© fx“ŒÎË ¡¶Ÿ&·cž ÅR®ÇÎ)y)¹DO{ð¨†0×ù±a^R@£1:>Se{$z ¾Ù+‰®´Ið 7¢ VÒ¬O»{ùu¿•!̃SÍ I…'|aúrùxæ³Àü¤ntË/ áUÛzR8Áã~T¡¢¿‘wÌå•é3b!©²jè:œ[½ÜÖ¤AŽ R˜âÆÂhóGŠäÉáð•¿lé £ F&GÚÜÐßö~qeýóË/TÝ=ë~ï´æ$u_4î=RWק î^‘µJhQ€ôÿ“kUçgä_Û¢ïô6¦“ðæúI'²mŠ :ó§g}OÑÆvæ·àº˜ÜjåÐ¥&ýŽÜÒWœ·—]6Ù©Ë­9Þ3Û ð`\4´Ußb8¿ ðn8•wóNÊ•,¤LÈ‚©Ç‰ÔßÖóÏCM;ÐW„9Êão£ÞtG›ÝùpBØÙ§lQ5|y\¿„àá[š¸ k*úß-Ú¨n‚6¼›¦ÍÈxÄžóÇ,,»ƒrî m΃ªöîÐ榜Êy·£Û„·CA²œai2˜‡ržk¶díÁպʎjAñµð´8A¥ ¶Ò è45…‘—ë ¨>õ֗ĽÊšÁ…¯{¿éã#ˆgkb)¿‡õÙÄ;Þ[ÔóÓÒfˆ+ÄÖA~¼ï©Ïë‹xH—Aj9éÚ@3w8Q¥Mž¥_~<ñ4ˆATƒƒt´q„Ç!¶Šêa®n¥ÙàS Í%ûóTw7‘Ki3ŽGÒ/ië@òŠ9¼žÞŽæGƒ¼8öæU“΀›¸Ÿ3œ¯% ù~9Ùã>`S.BJ*Ù 8›üâkÉžÎRøiQ )æFå[)PTKyði*œºÚ]uiiSÏŸ‡ü&”À:žŠ~-ä×·úÈ"@ÜÒºŽÎ‘ƒç, ñw6p*ǧ~gvI)ŒÕ.¼÷ƒ¦*x**ënŒîN´1¥dÓ\»,! ?³|¯'ëw/è|Àé‚ÆÖF˜æC< Û—s+…y0Ò¦‘ãAô)P`No÷K!?‡4â+ç‰;í4_x.”ŽPgxŒ®Þœ|Œ¸½VÃê;™ày™äûÁ%¢ýšÑz®l#(xê8 õ$«ç’ÂÌKÙÝÑÆþ#u-µ  F×HIþsÔ­\#®.…ê˜ìO„¿­Ï¼¸Õ}¢0âx5ƒ@p=ÚÄÁ˜CpaB;çÆr¨È#m75„èÆ'@l‚ Þð•Ze´†éåïÀx¸ZOrÄäÅhÀQŸñI~àE}""IOÛ~÷ê~ƒüW"ƒüà‰ ’ã+Ç ?]×÷œ p†Y"È)'¢)«ƒ Ça¤iý÷¼»¯½ ÔË{QL9έúû2ô+Û¸–NMH&Æ×t¢Û \’EHw%¤´Ñ(aw4LòûZ¨Î&-òo!¨êaª7L îí;‚©›'mˆWüÈ&×ZGu†y©PYIÆÈ«§9§rs†|Lò†§Ã Z_ôàÖNg¹a6¢ z»“åF;u·GVðy>mVé–‹;HÁåWW/;êô_ß@S¦ÎA. gî­pì —>ÎW®ðý¨¢¢¥Íçéì‡._\EÖ^mrùz”ÓýLxz0v¢ÍäsÄ æ ½'¢i‚8O„"€Ïéʜ֎5ê¶Ä?7DÌuÎ×t ¦lð3Nß †¸‘ÕSý\éÆtÃ䱃s°†ºt=~†:œÚÁÎFˆëÉ©üÁ¢ML:×.øùXSJÂó4ð…Ö’¢ÎÓUÖÛòõÞñ#ƒ¡½­‡®K[ä9GnA8YvN£áñþˆnýçö8Aa¥mš¾®ÄQU¬ Ì*ƒòD.å§ãè¼Í!jÛ(náÀ ê²wz…Ó§$ïzó6_{pÝ/§•®¸ ÞZKê³x²F½ÃõïOîÖñåòu•‚Õîû'òÔÍÁ-†cÑg|RiíºÂà¿ã¡DiÎÕWX–Ç ‡Aº%©^ípú|ŸÎà”QòÖ‚¢üsÁ¿¸Ú8À ÔP7Àõ…* û ¾6:;•?`ó6®ÿüã*Ô”]6¡b.æÐÔñ™w£yª4N¢3Jã¶+¦Ïq×JÒô¹à›OhÓ‹Çäq–K¹W(ç^MuÔ±‚†\ ^ê'r ¨‚z©ÛÁÿ%Á•xEðH4\¹D½$zX±£³¤¸j ¢hµ#^H7KîµÆÌR[ §|r ªZò¸˜œÊµŽH†6MÂÑæ&gÒºÎÛàg}hŒ‘‹ÊÓgaq$¼t¡;ð›£Í ®°¡’/ëV‰ëôu䌑ۧ¡/êacWÜn}À QésÊÈušgìNÛÉ#Uë¦ÚÉ?×Vw‰ƒöMå{”S“:û›Ûê=¡ô^ävÝ9†wܵ£¾o›Ùêy=WÔ/õŽ[6ÌÚAg²½®Sù¶–ØΠÿ:&wô+BŽi”`ìšÝÓ¢ŽÃÝwm;mŽ}ÆN×(ö¾Ø‡;‰aowÔ·Ý×é0ëDwÅàuñ=?¢ß‘€Ë…ê6ã ¼Ë{öò3òÎîÖKÝÎ Žm,t›`·7ë`p;†·OLºu*çuqfçݨÌOêVÖ’±/¼üá~R:ÚPw”Œé"ƒþü¹t{ð)„>·½!Lmxú÷˜]ïkÌñ;xâÜõ™Wæ_"ÇA&ƒ^GXUüá´YšW†di3”4K ¬ŒºßªÅŠd0Ú6ÄîîtkÒF0»mg𻞠£ æÎäó×;·jþ0O^M7Yü¢ËŽ§éÎ7Ps‹eîäß­é1>w‰¦Ë¬5×óï&Á.)pqºTcWÇäߣæ®57£ “[Öm™j³•'š 6·lS£EÁ­wÑ>^>¸­Êú.mŽª¹Áèà¯ì1€q#.)Í”W=çf‡ž¿6­IêƒYQÛnòúñf“P+h{½[àAQzÚ•?©V÷RªÍ°¨mì%¬l§…W<Ñ*Ÿ°óœ¸Ûu_¦.…øÚ!NÕµJô_Mô^¾4äïô²ç*á»”WåíÏ™t°ÈAÓøÐ)þÉëÍLò ¼a¸Ã9‘Á6ÔòŽ®a´aò'Ð&Ðj?#Ú4hÉíц×ÜýAùºP‰~òº; üûIïº\9ß#7xàß4ThNh!§Wð`\äӢ˛§™kåH9N¡Q…ÞÀ´ 3EÏÀ$É&ü£¿#øÔ ûõüµn ƒ©ôqêM*Ó /Šº4ÅÈú{^9g\$\àf‰Æd¶œ¼© ]0œ®ôÖ çx ÿv‚#·œ<@üL •jš–6CÂ~UâÆqÑ‚€ëÓ&JöðÑs †´9ÞŽ|Ï3Ú0ùKiÃQAǯÖÞöaü…ÿ‹_”Ö8.¹ü«iJâæÉÓx±I¼²'Î ÓºöÉù9¯^•øš§¼u5ÓÎ`dÕ…T.Œ.Æ+·/iƒ¥¸i|Iý{¦v0íÒû9!ÝÒ¦÷±¤“åÏJ›&¦ýªÛy[3êÒ[剱8¯sõ½Fö°KóvÆcíE¾ÜY_ÌÀç†/9¾´½õÎØáÁ*éð†|Gd GËDI8’ ö‘|áÛ8Èç¸ZG›×ùÛÆ»ÂÆâçÎwÐÆA½¯vÛùŠ›¥ O½¬üј¸¬›2£ “»E›AAÐþÔ3>ù|²Ö¬È:ƒãl(S‘·{ŠwáS¡Ží€þuœ¼…Ÿ›6²MñÚ·ã=ås´kOÓ ÿùµ™ø¹¹Çûgø"ÕX）ÞùŽW,ȘZ[k¡ñBÜòRïnhãÌWZ‘ŽãÏNœ^[;KKo…éw>øBAú:L²@°v[¼ÃHçN³(jß6“€¨rÝ~ø%€>1ÜJÈQÉ“#ŸÈVd`e¶¡%¯@Ã÷d±–~‚ö=¦£ ²©Ä€6ŽêYÉ?Î ©¿iÚh>™o>UÊhÃäO§|üéí x~çФêã¤BG‹1a:|owLõãñ5'uTZÉún¦CÂÐs¿€ügúµ»ãMÈ)º‚>šÏ‚rÒŽ‡²: úįáÄ÷@ºK÷ f©Ì^áÁ³±Ï·´ü -[ߨϡe9Y`Y:ÊþrŒþ{1¼®–Ôàå!Ò]Ò ¼K—É¢ÖØùù»ž:½žÐÆQ½ªåŠÅœòàéðÈhÝ…Gí„ö©ÃèÈí‘6NŠ¡nrêkÜôh@´¢£»µ Ð0g Ž«DmïÎ>wruÊ°ù6ó„!pTW4&›ët_ô§úÁ×ÀŒr)èó”q8m €…WtšÚ5  bD›*çz–”ã­L¤3Ú0¹ ´iµ¤Û¿Xà~ÞØü„OúfB ×3J@íê^TzãSÅÙ»ñøš“úèÕô`úxUZ'YñÒçðÒ­_ð§ÚaÙE?­nÛ$Üé'Z]õ=†Ì¨@žRñt.¤mè“Më‹_YM¼Me†ßìƒióœ¬Â^Ó$ô;PÌ1íD›îçm/ÍC'·Cë_Î hy¼x†Ò†§ˆäÖÂ]îÞÄ©@`â}F }>öRiU…iëòªzL­x<0ï{ÿÂB¡M//GhYªÝ嘆³œ¶öðsâ;%eV)ªSj—ðJnS0²¯]ÇvCÉCû;ðçˆ"I…~KùÚÞì·F›î*ç”l°S´!mÔ^˜6l–˜ÉŸA›öh ŠÅÖ=O×½Rë}sœÛkü¯*«¨Ù‚œÅ˜6}}oq4L›+iá”6ª¯ãv­ŒÛ»2nÏTwrº(Ó]ñû×Äÿ¶:~÷Ò¸µíÐç=gáÛG_×*WbÝFöKÎ?JS<¾àì؉6ßÞmì ®ý_H´ÏÀÇm•®mèòùjÝCü‚гī«"A‰vÉì˜Xî‰6ÿ~5?h×ò=Etø({PÄÙÒÎêÞ]Ø\ù¥ÁŠqÍÏ¥fù ".w—0Ì–É7bâ‘0d ƒ^9ÙX4&+×ÙAŠ»áâóÛ£ÍѺÇrNëâàæ®À›íì 8“?c½ÍÄ‹ÿ˜ð†—‚z35ì)™uxX½½ÁY¦u[²T3O]¬A;Ngs;P¥üïó€Z#Ú§ümÎTU‘½~€8À²Â> ™'é˜êû² AÍø3ÖÀ´©3 ÚŽ‹ñÝäyHBr–c°tKÇÒ±^WÏPûN=Á_<ÆMÕ=mxð}Ú»EòaQ’“øX§ÛÀÓWß‚–¯´ŸV|_ò:Èæâ{ü½|ø¹„`nï¯#×£Í'¢odÒ%”´ê=¥Ã }$qõ4ÍEEHe_ß hyD‘¶2ƒPtr(Ÿrî…ãä5ò˜4šº½ÌÏ™V•j2.E½ŸÑ™3Zê§Fpï¤+°=\§™Çé›÷W©žå L½t×½p6>‚ûî$O3ÆO2Þ½½óŽ‘KúÊ¿†z¥)¤~ŠWÍhüGO$=î)gó6Lþ0݆X ’jU/XøÅVc\h¸GÒÕ†áÐ>¼¸eȧýàCf#M}ƒDÍýe­£ñ˜J-^6ºŠ/È(Ê éÜKÚ±Ž4+¨L?ŸÃƒ±aö ‹Ç—‰á¼rê'ŠrŽ”)mð ûŠoÙ¬2+m~L£ø;Õ^ž¿2E]sH›²iØç šeæ3âgákËJV!ÛöX@Q«:‚0…Ùš°\’¯{(Žù)Ýrí•s+~Ö*`¶…¯)ä£ ›‡WÔMÚCa¶$(› m¥¼uü7îð TzàDT€¦{5›„ÿê™d»&$¶šÊ['V·Ž1*(P¡ÚÆdžõÒ`ò™Em\eÆ宣ᶟ”ÁÏ×Öö·¢¯•ôlAÕw§‘UZPðiõ7OÄq¾ómìP·ž=¿ 4Ç…7.~¥M_'ãE-ƒ C’²w¡#ê“€¢¯”tîŽðï+K‹ÛL´1ÓË¿yÅ“–ÁQý{;*NLf´aòGz.hŒ\¤ ¯ÚëÜlùÞj¸n}‹:»Qkt®©ª!5ÄV¢ºD… ½Š5«N®ß< W»Nn­ºDì¨×jWpÁðãˇt…äGžq3¢9t)°­ñÏ#¤rÆ…ôŽ”_ÏåßÖ¨ ¦îçcc*m˜+:Þ[ݶ8À‚¬½ùõÛ<ø$ù­ ݺZ0Ú0¹¯½2yMvùï7½”¿pÀŸçBuŸˆSuAÓè!Njæ•É„ц F&·1KlæÔnªÐªz;)ïâ7…M¹,H.&GU8Ç^8}½_•š†´›á§9O¿\Ö8¦æ.|ƒ\²F!ªÿhS'e/Z$Ó£jm . ·j—õ¢žhƒ›ÌIi¦­FÝܬ{׶iš»Ôšýôi·ìu›£@£+ªæf `B;›‰ÑÒM ío†w­¡w Ú‘ÒILèÙ®¢M§ã§×ç5mÚã°æf §È.”&sÛ^ÈKÉ”"›×09¡up tÙÇf¾ Úh¸ÍH;xúU(Ü{‡#ºw<Ñ%z„j´‹‘½–Xü[5˜„&Å8K'WÀ0÷‚ÿ s6Ò—¾My³DcVúN  ¹GÑÑ&‡ü÷Kq&…Ÿ?çÕ|S´áJ('´ jïT?&Θ6¸èÞ/PÚ¼í®o / LS‹Oþi;ßmö‚êCº¦÷*6d¶)( Õ4ÞU94æcmÓÑæ¨þE–¾ü?{çEÕõñ›„@è½é6¤©¨( Hï½JW@@+"ÅÔÝlzï½÷Þ+ é½÷¶Én’mç›;e³@_üDžóðlfïܙٙû›sËÿ“T1ôË[¡Š–w¥Rmz`^î†æLðýMÖüZ€`pnÓt¢ÚÄ<-ò'j÷jU‹-^Fû Ô‡óºû6D3®ZmW¶’2ÛŠE•ÿm(·ªÃhÜ!5Ï™o£H›Qcé~S§X†–˜tôH, öù:f´×~Õ}|Œ¦MÃW˜’§Qn' U&Ä- ln˜r{_7¢išIŒq/¦ùÞºÚŒ,iX$´Þ¬³ ëµ_ôÃ;£±]JÜ0«¯>Iñ^:>ƒ•Àü:Š+÷@áwÚÃL‡˜=á¿ÔáQ£äüûªÔ¡µÛÚiÅ¢æOÒ&™  ˜Pjã’kqú¸[ŠÛi³ —ô»'£ïœŠ¾{6yw…lá9´H¶©sY\Ê…ávV•3éE‰_6ÉÖöô©J"bF?iÇË Úø±µ«–ö#k&ìž—p fP²ýQïiPC¦Q"3\—x¯/è~i?t•*5D`Ûƒ_¢WÊô:ÔüŠˆ½ê£mY±Ô·îÍ`þØòúX“0-¾òwª¤îp¥N¶V]Ù£^u²¨zÝóâ¶{ïq§vÄK.¥ºêJƒ9¥i€~ XéíIÙ _Íò¿D›<@Þåk­KWÛ”-hT5ïV•ç£Ñ”¯w}~h3–Y!Öm»h3ÔΆh›ÙùÝG6ßf„‡t,%Ý â×[ˆ“gÓ²!%©Át?]?Nj‹ `¸«!ˆ0cGãäîSÛmê3 ´Ä™ 5 Íðpˆ…E›ŽªÔbeHÐFE³½ˆYÕÿ6úÚü0z ¯ë6-OÜ)«ÒÍÏ´Ô„~Òöä$h3ÌÞ¸R2d]³Áîãì+0md«è„mtz¦Í ï‹bcmFŽdhsO îX05|W«äÍåÎÇ[T¾yº¾a'E›˜"KªÓÝ#mVÆή8È +uZÊ…7¿7Ú<«žT! /}Wùº­òñXâ”AD©›9‹Éà­~xži£á½„_P?Ú´à ú„W%EGí›ÊÐ{qO=©ld ±ˆ²•º`ÓyµA#3&™ ˜Öh³)v‰ú¾M—”ºDÅÄÐ…ncƒš-È3*™ÊlÌ#}WL›ãŠ´ Ãd£d rˆÇx‰ ÓKÒËúþþ,ˆ ?Ï{Ý ,K8| ZmEŽlë¸m·dQÓ+mæ†mëxK]‹ùõô«‰{·×JDôOØ×Óƒ`ú± ò².ÜnE¼ˆBæÞñ’3¿$mN«Ê}*O·.¨˜>h‚þ3u»RZ*—üÐi‰‚ív ÃHêv‰pOJÝ,©QÖ¿íEÀ8ë2Ü¿¶ý¡'Ú+iÄ·±ÿd+ÔÚ´ƒÊfcºªH‰êçN ×ê'xD†QƒÒ{Ó߯¨ghS,§ÍåGi3Áï{ðúmËk!º–ÛÌ¥7m”Æmº)•(û÷m¢Ü?Æ£ìïTdÿûchƒŒý‰¦zÄ+v±»£WÕd­BÀá¬Ù¹Z¸“bm0q bgJN=Ø’ò— ¶ú5çm¼«Æ•i8ÿ  þM¸åZNÅaÍçTÏwmÒ{бäX°ÕOÙï‚pI?< ÐìTñÎ\3‘âÏ;Í] ßù`»µ~V­(:)Qã6Ê´é¯Ó}9ÄáŒÆüwçLä}×ú!2ÁûSɾót÷ûÄÕ™§þt0ÈòDÄ]†>Mõ{5èiOb—©¬È¢×Õ}Äû¢õ^ý ŠÖe'£´NÄÞ£à’K$Þë}aþ¡—×ÑkªÛ6ªëÂt¯ÛÕ0ðX°ý ?K«6ä’AÛ0´Q:Ö›¡»rZÖ*ÍœššÕ@ÿÉ<8“÷òú+<}¿Î^\;08ׇx—]©š˜Yy|ƒÏ¶Èë|@‹,=ÐF†;þV-»Ñß®/O±Ñ.êë<š6Pl|w½ïž¸ÃM0d˜l^ü²æ¶Õ+<ü§l5(^Þ³Þµ+YßE “°;Ðz¨¼áã¸Þ¦¹fÜZæéûeÎÒ¢¦õä<Ñÿ?mþÁpɼ}–y{­³NpFæ^Þ9¿’zç\÷üÓL¸±Yî¾éF8 ÷ c‹üm†©wÔSÝro¨™¤úžHçÍØ{Ï¿°ëÁàÀ§‰û÷¹WRrÂ%w,ó÷ÞŒáÑóƒ\èoz7s¿CÁ®ëá.]sëz°0à¾eþžb9tI?Pˆ–ZŠºQº¯yìÏiÇíò|â™Eû*6z®™*Ôkâ•ÿÍ#©ñ æÏŸÒNšg>ÌÈNIìg_IþÜ&o·Uö§Ç|£“ãà­ÄÛKAz,j³–KV_õÕû)óÐïi—7ºu©>Í“.§ãìþ.Ž×ŸYJ¡au5ý7ïà*²LÅVË8ÃD¥m8’ƒYk/x7tü6c×{vuÄã±3á /ïÀ§ÚÃü3"©'íƒ{÷ówÞOÿ‡‘'¶X¸XäþJ¿ƒŒrMó?#lѹôCœœÓýi£ ÷ÐÍ`²hÛ ã48ÕßgíÑÍþ|Ž­ØÝù~Áî#¾©ÄÑ¥þ-Ád†ï7¢#å³íÇRNðòŽŒ1’*ÓX´'î*7Ïç6ô̯H3ÿÐànSœú_K¶½gª@ƒ"ͼC ˜“Ô]Ê[»Âº{¬Ä«ÐÌÛ=X^Œ[ôGÉÎÙ†Ïmþ=ƤÎiÿ™)!¢IrÅh›}»œøùR.p`MÄåƒ>é䘛€ð|ñxɉ†{þÜضštï ÚŒÀ.{xuRóúcZÖçÅc#üصÄÏ¡Nj¨û½|Jo™›/EQ凞͂(=8”5Ó+Ý–  F°´aU™ÿ¯¾öó˜Õ¥M×ZbùBÐguÇ9@ßôêÇÒ†5ÖX 8kÿ+m$¤DTöž:}±j:_,A+„éÆÚjUå?{÷X'Ö’Ë7ÊEâ”☨GÚ=/6Yž8:YL,7UF¢Ël§’,(¨º°.^á<•¥©KvǤª=ÔóBjÀ{{þJÜòÉá>e1ÙÿZÕßkR%iü N.œ® €Î¹þéö¢gs†„¥‡öðcêBŠ}åMkŽx™-xi®%ý§¾8W†4ÝzZ¶Ç=é£ÒñT¦ÒIš7ñ§7šuúÞ£‘(üaÒ¸f¬þ½•1a³“½E"Ehµ)JY#)h™FX!*Ç£•(93|­Ç"žFüü}ÂxNqÓ$~ ;7飮õö”UxuqÎO´ÇÎu“L¼h°sþ¿ñ‚:÷ömôà›ÂAœ„ðgЬôÀ²ó/x"m>xð^BŽÎã& 9-DëëþÉÆîð#H×öM÷¤ §³Q†Þ\ß17NF/¬ÕUº*ëa™\½]´Q’¸bûºtnU¦!Õ6G{ÜkLšGrå°ªa ÑÒ'‰iý¬Ž‚Ä[NeÁlm +ýæWDû9Ôyê‚“­‘KlLìA´‹èzž1×û‡’TV¿ž€ÃëfBJ)%D—|ʘ¬+¹|ÙÈ»ÒÞH~/.Ãì“´ é¹ m8b®9–R¹´LòM5îdiÓu׺2~*ß_¦|w¸\Í­£@ŇJ_Aã¯KOFÛ·¢SžÕ½¾%9øþ’´aVµq•Ÿ3O»bDnÅ#êÊ#o3 /ŠÓ“ œ+ëŠB § G1Ä÷ I. ñÝ ‚óH‡_èCK)õ$|WÔ7£êXcãj“ÂwA:j»¾¹)ºS1%¬èoýP/œªìÛL÷?Ó&C1ï‹eåà•Njng&oÐÁ”Å^)6•Ð I›¡®'ˆ¯ÔõAÅ^§FŠ²jÞ«“ªÕVž¥îæžôÑ%WD0(­y$ˆ‡ï²ìè¢^ÑCÒN•£éäñ%N‹âw‹e(®dÓ5÷râ«%ÉF'Ùµ}—7Ä1>•~`˜P?C!ýðhApºèUE=ºçK8…æ]hê6êF­Ä±)ÐFÅ4`x_]e­ú‹MË‚s%’áa­Cj%cV±¸ÞÈ”!ÿª÷ó%Ó –9ZËPrÃâ(ÁÀÌæ…ä H¶(ae ª·Š:—6öÁ´áÀÚÄeRu×Ê%ÄûÅ&¯¸´®êL@qÄŽ“C46œéÕsÓ/Ý\Ò¸ ««ŒòBDÅüù-#òÓFéÄ°wùí§Ô(îéÈ\¤èVÚ—UõÛI%‹ä'!*- Ð§'èwѽ¨Ëï„g_¿4º£QËGCɇvqüK9e÷«ù=Œ@apž`žË°?2—‹$k‰'dvàµöŽ×_œ0=dxÑ—EvªÜpÁ «|É?Æ›zã_ÎQ_·•bþ¨Eü38¹’X%":š¢ºm­/*¸‹6¦DŸ¢ß"céÜæ úȺéÖÚa+Áå;Ðq 8WŽ,¼‰ÎŽìt-*MN"vÏêD§ÝJ©—‚]Ò‹HÁ´Iß.˜«J¾,Þˆ^ûû´q ñ —gÅü³$N®-v&êÌ—¡MæÔ yç†~'ˆnš.Ü.ï[ßúJ» ¬oFõ殕~&.edµNäF;Si.gzÿÔÒ´‡8Õ‹Í=Іjbå´áÂ`Û sâÏošM8Kùe×Õ^pÚŒJ«>@ÝÊ]…ýä"^šÕÄ“€×ùK|è„öHøÞ=E•ü½éyt ýÖzßJˆKFeömÔLÚ`æxò†ªš%6Bßq\èóQ ¨7;ñ¥ÐïUÞãiÓ47ôT]ÛòaäyÌ–gL¹"寮\\­…ôš³½fÞI)wDâ'½& # fTX.ê }’§‘)EÓ Á[ˆ®¤Qç½BÝ)Ó’øj~Ô¼Ñ4URj73áÍ–Ö/¨Çó·wn ž+Uƒ¶Q¦/Î+éÑìuÈ(ZýÕ(MŠ¥6À›Ãô(Ú Í6§üÏ!ÖV2ÉL´Åº‘ÚøYβìÌ{ÄIÒ&|¼3ÄC?º÷EôÝ/¢ï?õÕñÎ!걩Ê‹ DÆóÕ´á5¿sU5ß#¿gz’ ýT! _âȽ¢4íªfÇgÿ†åuicrÊþ ƒ‹š¸ Ä#h3ŽhÔ7c.¨­±’Ò©œ6ú"âqÝBÛè4ÕÀ€édˆƒïî÷"`¥fXw³B£¦ú&}» ‹6úÙÝÊy¿ºuñ\â-ÌË®“ Á9õôž–6#ì] Àî³’¯æÆ2¬Ù¬zQž¥ž}›Á¼$_ê®Íš“Q¥«fD¸+gc¾{‚¸¿Í£Íâ\È^†ðHÊq窷|jÆ‹‘ot±ŠQ|9 !ôˆŸ=ó+Yw¨Š¿èPä=b÷ãÑ·’°Â´iè8ÒvíNO@lG›½Ñ—êe¯M¢²wéµxrO'O)úÞ§‰û+aác_©fM”?‘·À8Á…€Ã/-è¼=Œp°Ï©¿¼ª°ÿ â‘3ö®•}„ô r-2c$½ÑŸ¤T!.~ÔÜÌúÔå_lèN'çèý…L²Ž·!~™ÍC•S¡¡ ^e$m¤ySÞã`+™dE›•V|jãѬååÙ·ˆß¢Íd×?dc„éŸ ãv,Ôp-⽓´*®M ¼XUz¸•}­Â¡s†ŠIfnÐçH¸þ0.aûB Ö:ç¿ù÷5‘Åß̱-mVõyò!hcì_}ñhÚØ6´)]“´» áƒ¡Ôîú{CÞ6—´iä_Sé¢ ˜u¢3nÂ^i#è+-HîDç½)5z} Óxcê”ö‡ñö„šáÐÖ÷[`q?-ð•¢eæøVÅ®wÏðY³Ð:¸qˆÓ7YSb_‰IˆCœÔB@¯3¡$"NÔl&Ι¸ä‡<êòo`”I= ýܯK,Óhé´ÜˆÛjÁúôÛJ~Ài^ó†=,¹J5Õ1Ç%â÷ÉžúɵšêªÜ+™ê•lÉô¤ÂX‚d´<ÄèdkfÜÕÄ`Þ½Ì7Ì¢RÉÞ˜ }Öú7G>¢­M2´{°x¯¡fÕêdå{ÒƕץŽÞ×pfÞì§8J¬ — fP#orÚ➦͹²): äy ¾zxx™)}V/ù‰"øÑÈ ¬~-™Ÿbö~àíoâ¸ÿ÷q?ú´£´¬— Ÿö@dPÑh­!]OT{¿»^y,mi£bXREÔ¥~ÿQ–¸Óª[‘h—9µ‘ È'ªñJ°¢Ð€tYµÚÂ¥DOªp|ÀeAÛĈÊ'Ùàdë$m¾ë¢›¹ÏšYæÇéÁ·YcßÜßY§Ï7Åe~lAæ ¡òèç vôqðWµu©iŽN¦uë¢ù8HiA¥ä½vÕ,ùH§3VŠÖî92¼/ýµà’ëdOª‹6›ËååxRð[‰[E¢ ôƒ¤÷¢Žsa¤ëEÎQUÆ1ô—Zj€iÓ&|ýN„ý*_³L@ÎÁmŠ…óŽû{o¹.´ÙF¢0JÜ¡Y7²ªììVoßQߨ¿fÚAµVá2©l0¡ïþŽ¼Í*–ž­Ô}9‘ýŽ¸yí^_ï-ÁZ̀λWeö¦í,ÔŽ¶Zém'Fî¡Ê3àÄ]æ»òQVÞ]¢~†6’ KántlLï@X‰¨&p4c¾¬}á§!æ§b.çü«N¥íÔܧªòðÑ`‹ó‰ŸîÜv‡æ®I yO ËÜ “çL0‹%–x: ²6(}£¼jûÎ@ó­ž±Äy¾±dsNÛ\N[’™ã ¥/ø(q7Ú?õÙÒÙùµû7úølý­Ð»f*¤ydÞ}×ËénñâëÃòj¯Î1ðQdáW«}nU¼–ÛIø6ùˆSoÙŽ|rn¬ôòý$ù°¦ ìN2®†¡3qC–~]9ùGÿÚÞF‰7$¯,kÚ£¢SÜÿ¨†~Ç‚–ûÚ˜ò‘gr0uÎK¼UCøö~LœØÒ@ùí³ÉqÝö@• 6Ô3j{úÊâæ•k¼7„Whƒ }É4mˆ}Ílê ³Ù|Û­nŒ@„}›ñ®Öyç_a¯2m¤»nÒ .î6/ùyꎣ•—òº'E¯¼â\°ëjH M±E‚^7©¿œö‰SþáõvuÔ4ßêð£×ƒ3)Îo¿eQ°Í$ýú8}'°ÞuÉ5û']ú)moc›wx —‰ý« |ŒõswÛdŸ]ŒûAdç(â“eËî9ìú*4z>{pê -ô¦b¤º•lÞo'™ë–W¿Ø¸Xäí¼ælVtn ·kÊòM_=^ön‹¬s+l[é”쉺f¿C;õÚk¦Jó§X÷`Ã9;Š6åæùÛ±„Ÿ g“?µËße“·Ç:o·]þN½d-ÊÇ›ãñÈßy;áNŸéµÕcì¾ÍÑGŽúeQ7ë%¯/o'øSrìw‚´ïåïÐÉür†±”¾éF%ßfÔÏ93ßBÖÇ8W;×~»vâ¦O¸``¥MÇÄOÖ»”“·O²=æ§pë/Ih.G?ÇŸ ÒíT˜Þñ¼è½åU_’Ó²OKfX„Öt£ÍÌ]óq÷_†tdçsVõ."6ª›Ç\M?ÊËß·Ç3S!¬O- ŸÂëj 'mû9…KeùøÁnnW…YtñŠ—Éݼ·RoLg¢ß—$oMcܬÏÝ};徚I”YÞMU=ëì¬ÿðÚ J›Ç.¯ºœ?Ð'%Ry}¦ÍÛm¬bˆµçC¹€\xw ý.-Tgv}òG{Íþâå¼ú²r”O¢'«½ýÿ§ÍÕ‚¾©Ýh#”¡¥,mX{NhÅݹ³Øt-IýËÁèl´²´¿=’Çj0ÿÿU™2z¹¦ÒÊ`¥Ð¬=_¾Í³Ò}sår5¬œ5–6¬ý” XÚ¬£ªèKTDÖXÝLë¥dY×.ÔWXþ,!¾R6)U•*Oòˆ€ZÒs…yãà’ød˜òR öS¿™#2§'{º4ÍŠêf z²$YFŸä‹ ïY.éAmÝ%Ìÿ“?û¿ÏŸXœ¥ þqÆn‡úïÔ8 ]3-<Þ…vMMâÛÝ÷©!SùhJ%SbGÀ'y‹›²µA«xX]ûȦÎþ S%>VË_£¦nÂÁh‘¹p¬Üˆ-y5gz¨°÷GzVÄ«ÒZ┚¥èk>rý D2>¦yÞ¦.¶ŠÕˆÿEW¤â‘Ѓ´6tÀ¥ú‰’ä¹3ÒS]_ˆaƧԀse 2&®¦xCpÑàÿôŒŒšqqAÛ–3½÷¤êÚM!—”h×L'‹Afñ_p6Åêžh³¤‘  “¯y‚«!çɥ߄¹¶pnÒp ‹–¯ãÝ–°¶¥ui៧¤–ÌQE ´éÔïÕÿ«¿L›:ZfÅÐæ°å#ǘ0RœÐõF«o•¡÷ð½<ó8‹/¸¢+4 ¥ÑФ–6ô£:õž½_ÙÇ#1™% žM&`ÄïöçP´©›t„ïàuøzp²pPQ‰&¥#^š4§Ô(| ›ñ"kÀÉÙÌÝXD܈ZeN&V63h×®à¥Âaé5û(·pqìùM{쥪9êʤïËiÓ1mô Œ  rᙤž ê¹T6È1Í™º3'¦•˜!}i¡DÅ• YÐc˜×úŃK³¨LÁúY…ØÇQA‡:;7©“—°#uy“d¶º¨•ƒÊÛtbqA‚m`‹¯zšÄâ,m蜀扩÷²vÍLâÏûñWˆÿwÚJä>$™tÌf_×M´¹kVÎjxmÎ8U¼•òni†)–5åL7ÌXtñÐFxê·¢IiÖÔS4Í] D£NGÞ?…í¡Xí¾‡Âêh©·iû7Ð8ÞÇäâÓõ–|¤—×@8ËñûjñŠæ•Ÿã¢'m›§˜.“òmNÇ\Ùœ™”*J¯5’ØìÂŒŽš:Œ¤Sýêrm´`5àXŽÓ#ÊÐjÜÆœKÐf°E›Öm©’ÃíLÊESÿm¸b‡NW·ìëhÓ¡TT.Ýú`@V©º<êó©[‹E‹1m¤èC‹Ö^>éÝ)^í^³Ø«fQ9 ¹f°;oQ\ÿMÃÁF3 Ú µµ¯–ö#+'LÓS8ð?•Xœ¥ i*õ*£ $ÔOø6 ‰8…Üâ°c ›1›ÓýµžÔi§rÄIi‡ácõšÊ`Èl¼ýLh(¶úuh_6”T™íyKÖ1ñX¸Þ§¤ã­³Q!¢ ÷*‘?õ`Ëéë@Ž„¤ '¥ Ð/Q!SÜï‰Úæw-½ ÆmZûèõâôƒ_&¹¿ñ!±£=Cc? ¡´$™è‡î³ï|qÇm”tR½Ñ¦¿i -HfkY!û´Ég|â÷¿ëkq3{cÑ¡IµAÚU Ä­Ž3<®GØÁpîž+Š6 Í=;6\P7}Xè\@àKV¥£M‹²HÚ|V<ß?Å‚¢ªµ›f´A&?HVNØþ0ÞÇåOŸXœ¥¢o3ÏPîÛ0£Äºp*ûUqËøŸh£æuƒngm¯-¾N|~,m˜Š{¤xº7ËÆåäÿN”bçâ‰ôhÖž—w‹f<7ð H§¼b]3û:ÒZ)ÚDÔ¦#.¢-vmÔöÆu}¹D…ž ™Hs+~K»¤ÁžÍ>§ GÀÀ¥fø<ïòQp\µã@wÂeZÒö¦ZóÇéõmz M¬ ­6'åoæÚ ñ/ø’HOðþ¤¸ceÏL°5X¤BÒ¦¯y|“l0AÃÚùvÍtVq^P5ô}Iô…èV`3ÉÞÒïþÚŒuâ–uL§¿µä’¾ì½‡KËKnQ³Ó|HqOªŸyR£l€<±øX«ò?—Xœ¥ 3n!E—íÚF‰]™°««¦>¥Å7‰_þ¯Ó† c@ûÆ G;W¤L:òHˆñ'¤ 3g,›þÅü[JšµÞÆm0”Š²dè®.â ¹ CËJ¾Øäå ê*@¿—M:•Fë§YKúÜK¸s4ÔàRâ¹j@ÊŽæáu;»¬“µ½»ß×{}¯X†nù½0e‹jiñ•í~ú5ù¹f]£ÄØœ°VÚ¼UU¦ºß#Èó‰¯ÏÓb@š>•4ÍŒ\ÆOá²´¡h#q•!§dÞ*ç dPèÓ`‡ÉƘ6ùí¯}æ´Ì×4‚Ø;°¦—i£üd@ׂBç:…Ü©˜^-4ˆx<ŒÃ› µ}ßÓçhÚò þ¾>ºðjà7ÕÒ1û\?ôµr"›¸ø'Ò¦Ÿy<Ð~Ÿ€µA:Ñuò%è\ˆ2õ!°óu˜Ë‡~º.ãše3ûâ®èÛêñ•Ÿ®õößþc  ÅK,>nŸ£:·éaNêõ¤¹ÂRê 9’ôù ¿ø®©@ã\÷’ͧÛZøØäžU\Ý÷Aä7F>òI«vA™–¿Ê<¸Úºœël4,>9Œc™åf®l„ »ü]ö;(s(\ÿ†…h¦ÿ¯MUg”fs¸ÄËâ+ëd¬«5ÈÙ>×Lˆl ý²u)"qröÎ=߇|Wn‰øÙªp‹iúõ1úÐá9îÖ¡¿<Ñ¿4e™ øþ_çÛ“|KôácþŒÜûâD?R˜ï¬›¿ý²&Q`SÌ“Â]¯›Â¥" N\üêè¯L wœ ~Ì ¥AVws·ñ²/L6ìäDþΪ–Q×2m¿gÔ—™bô}æAÃüý[ݨd R­¼ÓM:zY%E8›kn¹•¬Mܯׂo˜–ìgƒí½´ 6ýžòG?³P1¼LO»ëÁòÐßµ ·jg\™H'w²Éû‰I,žcUx‚J,þEÆ>ƒ¼“ýYÚô¼ºßh¶±äŸE·²ˆÌÔý7/#Ð*.– u¶‚ÿ¾ÜæQ.èaÚ&Æ)†)£¨ÞݸÏè¾<}å&±w²¾Hvê_¼RѲòÅ ñÿ³–x°çYàíÿ7U=øw/SáÂ…Ò¡±!/èZâ?C›ËÅj&I±]í×nX²Þ¬xƒ¢™—®ÜäÒô N•W3·w«Ü¬dÍõ ëÂÝò©•’!ÍcêeN» Yæ3]KÌŠ»Ÿ½8?ãÿ¤Ê”çoRXÓ«Ý“qžÑ‹L§§Êu{w„º °¨a5଱pÖþu´‘©ti¢i½…úŠû?¼P/ø%ÇñTä²YúL”öUÁ¤=‰¯e~ÖXÚ°öÏÒ¦#Ð×v áøtD €Î»‘¥ Àuí¿z,]¨èX1€ó¸ø æ÷ð'S3%‰€ú"Cæ[ƒªðNb‹F•uŠg ¡æiÃ+ #ƒ«0•o[5k¨–㪆,0ëdÝ`–6¬=ç´‰—uѦ¶²î•ês•{ßrY´¢–V7à=¬H"g»äÕºòî°8KŠæ™t"I#ŒŸm–$DÓ† Ë#×”VCMlÊZò FÉWÑ?Ú`›[ˆ¦ †¸œÑ6uÒSz3q©¨D›M`iÃÚ¿†6Òy¿–«hž#TXu‘Þ¯£•6-”÷b\‹8á¹ÈÜ`æµâ Ù'Ãù¨²ùâˆÌKg ö)Ùú’>η{‡ÿçÀî¬A…¹8i¸ªa‘ ÆkàçVÚ'CzY]´ÑÙ‰‘Ž+-P5·˜Ö_Ù/Ò0ì@zµ ´‘ÞlF¡U c%Ðo6½ã,mXû·ø6Hߧ{†%Äçå&RD?e¹ Ÿ¢A5Ò ÏCfAķל:È•äuÄçqdyàݾ¤'cSnÓ´Ù•9,7‡á¹OXâØu\EÚpjÊ0gTH†É@à HU¤Mg4 ÛNÌÂQêJ@+Ù¶ÀÒ†µ mƧs_v qmí™6¦mƦJòÚÚÌ7#ë_–àôFé÷ÍèkÛŽ^hSYh©œ6™mFÈGýŽ@ßÚ·3ý¸¦@«-Ø;ÎÒ†µçˆ6™`\šhÓ–è3G1I›éƒ(WDlpñjê6“†P%IÚ¼ñm~“Ó&ƒ¤A£T•Æ~•zRma€nÚ0SWFCñïÛˆ:½Ÿ¡Mv 7Ø;ÎÒ†µçG'%ý²µ”i#Fß:Ôã{€Ñ³±*– ú :½N;Ñ19iÕIࢬ­µ#õDZàÕŽtz¥Í/músð0²yµÊ½° *>äÍF”›>ÀÒCÚ¹FŠ´CÙãS²])eúŒ˜×¡é¦ •CY1¥m`nôQÝ]Š6ü@çn5]öŽ³´aíù¡ ÃÔb)ŠÊ»t"ÔðBŽ£B¦È´"h3 ¶fóZÏ c {A2ClûœF¤¬ß_±O=“¶­©ƒðmr{¦±#€Ú‰@ÇqFpsͶ`›fÊÙ&ôlµŠE”ÞUdc¿É,ýúx3 ®+øöÁaïâí;švÄ9å]ŒŒÓý‹Nõ×£/;§JˆJN&t/Úý²©éJŽ%|ê]²é‚oê4ï¯5£b¿Èۼؙ+7ss,ÚìT¸Í¾`‡cáV·’m‹¨Tþ/iGÌ~ó†bzEüi«hR/l˜äX²ÚÅ¡p«sѶ­æTœê¦Ëɧ­³Î¯°²«ûXÚ°Æ*XciÃKÖXciÃKÖXÚ°ÆÒ†5–6¬±öT´á2y» º>sŸñ#ú?W+C ²qÝ¥La‹¬Ùx·Ë”õ\¹Ò8ìqâ²´a¥MWÛ9‘;O"£³, >°ÄËZ̼¦Ñ«ûž•q`{úÒ¯¿ÜgÅ®ÌJµ!'ÁËC•4àDÓ–X6÷'¶T` øÐ7ÍDÝÒ7Ìöýš¸ÀZþ4¢ŒSdŠò9àµ@÷*†L½²hÜl}faY`ƒ„¨pÐTF:¡jãJÔSX»2¦iœL4f&¯û5žË]H¨ è{εù¿)EgiÃÚŸ_o³8eÀ¤)&:‘±aÁC12 ¢h3Ò€k+øTD5‰BJ‡÷ì ³&SÒƒk3ñf©J˜LÙtrmm-¹*VG¡¼¼ry®gXÕ9å^AiÀ7Úæ(kÀ/€h[_òˆ °\G):œAa¨½ON¦«–JM0’(þK"N köR§±8äÄw¹äö&€9ãMC¥ AÓFn ô¤r!q`CÆȦR¥æ¦xòÛ±žw¡m9Òa}ÖXÚà䤀Î)ꤸ0Ø´v ÓF6÷ËÜ©•-sÅ€J?¡Ú{•ýPô†XÒ«c‹ŠK54¿™Ñ6Lغ`"v9Z‰×ú•â©NÙ'j@-+ÝÁ­æ㬃õ2ô{p6±û¶ôáEùÞÈ°Š(6šzéëAvÚåTì‚öÍ•/fí>E”oCëRÃü¤¢1“ È íº¢2@s {Ö€ßhF¡Ar xŒ’œ “Üô¡íMyª÷Î>wܪTZðG¥*'´“A‹á!ÞQ‚³Dqãió[™Š}|"Rrqâda•±â¯·=g~åCš½œ â„w˜°´aí…§ úçLe¤´‡e·Ø·A¿{’p£<µQdû*öIMqÆíQŒê‘[’å®Ë^Yu‹ZKÌñ®ÄÍÍ‚K|ÞjÛN|~;êxCégD±­i£óò|HÚô‘Óæ¡ítj@6¿å?6Ã[>ˆÜ SpÍø•Ü¼ëp‹¶½ Mßuy,O¯çÂÿËMMëåav®5öM Ïꢄ6xŠoÖQ~û”F)âóßšªL‘6\dã]-Q3Jùù‡´}-’)s •~Ò{Õ3ýc=èé¶ûÈÐ}'–6¬±´uã‡m†ò¤=Æ´™4‚ê4¨Î3À'JÚÑ!§ ÒÓ¨&ûqF;9Ýý—vÁ¤ió¦1•|3 ÿ4ÒÁ˜ô5Ôâ,óO¢ÍR õÛ¨ìU(= ËM3 JPpHžZÎ…Eê·ËûnçëúfF¥+*߃Ä(.ïömtaÿÃY õW<%ÚLw×Ïkžõ]$çlüÂym¥Š™¶´j¦¹Dù0§!r’0zXÚ°öb÷¤È<àècÅdRä©0÷êÒ€+Óf«=éièÕÚkA?{S\´¥íS)ÚÌ5“Ã1C'“ÕN~JÚÈV¨Q´ñ»RÓ¸‡¢ÍöJ”C:½}h-ìE•)6î@öîJðF]Mc–çï-ïÈ}³vu[ŸÚ€iUS…ÇØ[H;¦öL‰¯Ýpë¤ÆmƸ]•Š–)ö¤Î¿ò0Ñžñmpºð³–¬oÃKÂý^®Q7§~’}ŠûUCÃSí•æ¤z¤t¢Ÿ|«©ŒEa7ówS=©'ÓÆ ŽèšMæ‘“ÅÚ²"I´©íN›,1Ì®8‘Ô]¾¸›¼¥'»cªæÄÉŒ¢M½ð¥è]3295¥+çÀ•Ü—CÒͨؤÓ} ÛWôB›Öx@_ÙÓCâ#îHÄ“IöÒ)Kx}NQ²v˜:„%f¥ ýØÔ‡·ªð­ïc4O†kóQ[ÓÖ±úðdÚpaEÔQèxe«gðº@­F@_;w<-mô;üÄÈ3Þ~ž}ÒwyKÛ¥ä(ñãh“;,huk®3í3ðª·ZmñçÕM<Ìyw€Ý,R^(E:ñZûBt;§4àºíÆu“ι¶;îÍ™&kÚ½?Àæ^Ù¨Òê/ÔÈ&³*yO\º +o1 »‘f»Co5ºí󦩘<Ü`»9àG¨ rØè4” GÒu¶½·ÍÛ÷c?óèN˜Açpþ[þ1 „íšQdî7»Í¢Û}¢ãSŠÎÒ†µ¿¶ºO> ºo–¿Ý:ûä ŸdzöÙ$)¸ø3 Ê=൹]àæly˪…žúуÉÎy[-3.½kInáµ;n›d(!A‘ãT~`$y”QîæΩ÷ à­#:QÉä·Õ÷2wûíùÀnfìXfÛ„Ì]C ¾W%½¬é.Æi÷(Ú¼´å¾Oå¾´}[íêhÃ0ѹtKÑfÇ‚mÎE›]‹·lc4àW“?µÍþ|¥3\¬×ñSᇇ…ÔÙ®ûÙ®hË·öòx>ïEiçFALÍ4S3{§]öÙ -Th>VfDý.E[¨y•mm€Ý˜~Ú6Eë\ ööÌ ¦Ÿ¶¦í2M§m鑸/òòLÿÏFbgië\`¥ k,mXciÃKÖXciÃKÖXÚ°öß¡ $NÁ¶ü?) •eÝŠ§¡ømo§ÄU¶Þ*t÷î[d­GùX/xÚ_–6¬ýiÚàöu<ç ¸ŠÿߧïݦEmÌO7"çwªýÛ°¸û¨™†2ãÆÁXUM&ø~Ë¢³1¦z]“ªãO%örNxTÜýsÙHµÊN$žK‰§8p¹ˆ(ìC¢ååU­|¥€Jê–G7—ŠFÎ1¥ÉkœÊ\JìR%Ð÷+·¦8,mXû³´á¢”¹“^2P‹cûågH”5àÚ½iÀe^Ni™oåéZ8`X3ò¢w ±Ñµí°ÏÉtÄŒ>ÃþN_ƒxƒYÕñ+$e¿+‹»ËšAe… yhƒŠ@SÅŠøfÈWõ›)q÷üà“7ƒ²ˆ3Y_Ò×<"ŠÓ8ÎQN=¸œ?$8͇*¹:}Œ ÜFIÜmj 0cy¶£ÝtAøÒe}¶M±öÔ´!5àçí•4àCLk1ð‹¹ÓªZpðâ†#ªDèfÑ|‰¤ÿV§díZ#A-od † ZN`4à—‹§9å¯ÕÌtךWM²ö7ÈÐíàl ÃÊá0iÛ¼Ô–m—&"#I ×Iqw£v¤× @é·(*¤„Æ7Aêó ºÎvœ³9çÈYç$ÔÐô,VwÿR¦n‘§$îæÊ4L›ˆ:Ê´ù¾XÍ3)–ªçµ¸i’Z}ÅƵ1óÚ,]šœê"y6O–6¬±öªÌ'jÀïqÏl¢òW~Pø5MbGÖ,hÞ¹/ÀîVÉØÊÚ3êÄ¡õš|¦.·aÿÍ2°нHó!w‰“Ôô­'x²Ò×a‡¿c@Û°øŒ·úÛ-³/!²/õm±ðí­Þ~«|­Ã:PDr0q }¹ïÆEQt5oBqyWwX†ðUÝS­^è<ã,mXû+´Áþ̪ {[msŽŸêÒ€'†–œb4à­îE[Ép4ÀËÙô¶‚|Š‹½QþfëÌ/ßc4à.E[äp—Š}£È£Œr7sM½GyP*¦ñ·3xoþÜ7™`Åžv;T2âîT×òÝŠ7:nq-Úè^¼i·%în¹’rÊ!ç³mø”—2Û‡ãžþ=C¤†ýb_¼éû(kfK‹Añ‡o[Šè…4&9š9;s?ÛêØDcçn&Žâ‚õݛ܊×ß ¤bÔ¼á«cW¼Æ½h÷qïÔ6?ØcžÄˆ»eŸÄ]t*ØwÔ;ù?+îfië\`¥ k,mXciÃk,mXciÃKÖXÚ°öŽw×PËóŒ=Z¦\LÖÃQ¸ ”k›ûXEv‡ëMÓÍj´YÚ°ö\ª2UÍ|[Äj —Ü0›”Ïxٰצú~Æ €¾ yÆOœ‘ä¿Wébdþ”V%M€jZ§”¶N"¬¸åuUò(c>‘jL”Goݬ®£ Ø²v$N)À‡ß]ÖÍ÷#_TœBò4s¼Z¾XÄcñU4èÇao7KÖž+ßFä+E.¹r—à·Ê)Åٚ̊YE}7†ÆÆî¾åXÞHI¹µ™<Ýr=¸.#÷ÖSЉì}¤Ÿ0~„Ž²¢×Ù h]#5íÊGÚ¡¹´g«-“©ßªCþÝi3"ÿ¼!úxiŧÌ*bÉOM(4"•Zѧ›»ë s!{»YÚ°ö\Ñ&PXd&¹FFÃl¿í\ùµÚ¦7 j›Äï.–ªÕ×}àaCĸbŠX<<±~:€úOÞ Äã·0vš°LG(33xß*hû–Z`3'òpNÎ-dê 0i%Yb¢xÉ4ŒÚT(E Ì ÚP°Úž516!î@m´Q7â«p`uTmT kúŒ¢â]hA×ÒhÖXÚ°öÜô¤Û[]Šæ7\s>ßè’O;$\XâûûסA”¾[¿Ù{ ˆvýsÓwÿ|Ü–M¢õ2¿D:3/|×Ù¸ŠØøjøëbÉ„~d|˜A~kŠs¿tÔÏ%ª¶6C“šÆ‡kL½ü  †qEk“š§Ú§ðÔÉ5u£Í%ï•ê‰6Ô™¯’Ó† }M‚¬yý¤Âf¢¯‡òË®¨³=)–6¬=_¾ „ªv¹ýéûëxÜ×bÒÃ}Á»lyxå{9"ô 6(y«i€g@6Õ[™æjm]üqXå{1õ3ÿá±¼þZkÓUj=mt„Y€€ºùƒñwç[6\šîB½e,¥1bP¼;Øä·ì•Õü%‹qИÊ,‰ÚG¦ø‘~JÚhàT˜*çkI-C[Z;ºâ•Íº7,mX{nh#£SÊR­’‡Y—ô1´ï ú;7+†”–Ÿ[hŸ3Ñ¢ìR#A›|EÚLð»ðÒ^ø©V¥oþm4møÕzTm]´±û š>“k$™ÈÃb{1ò÷mdbýÑgr&kIb–öÖ”%•u{† 54iC¹éÚܸM´9Ve)ÐWPæ’_ÉÖ†JÁÊ .TAV,]lˆ79'õxÚè@!ÀvsºÚOËYÚ°´aíYÓ† ê&¸õ SK샛§º\*€œbÜN‰bµg­`B0Á9¸µÀ´üˆ.5ÞýmGàZý9tOj¶Þør8@'¨ëÑ&¯è(Ïy‘´±ô&‡k´¬Ú ðdƱÉÓ+,DŽl¯%1 h¯™GbèKžçO%¢'ÓÆ¥Œ£ÈC›ÅiÚŒµ…Ùf,vXÚ°ölh³%ˆ^„RƒÒÆã®7C`n›— ºyjâ-D{̪‚¤²4êÅP#ÀÛp1L›:ˆmb×qW*µ.X·à2ºþJ'*ƒGÿM× ¸˜¦Í<8£J†’¸œ tÊ ¼¦Qg~P%†>tHá^q¤kÁõXüAMgAAM›™ mÊDpÄžäŽ;SÍmPXG!Ÿ¶øi,mXÚ°öŒzRZÌk·ºLwI“üSaZoÑTpQ¨pXòbmÈj5©HY]Knð–nÉ4{2êÐÚL=²rù h)×#?Åcé1§Äa*Ô¡ûƒ”·Öu¥äPðPåЕ|Z ± Ê¿k,mX{uRrÚü‹\\Î…¦˜eóÉÎÚ»<öQaiÃÚ¿€6£ý ¨äßÖÑ…í±Ñµx‘ûœ°´aí_@ÖXÚ°ÆÚÿB›¿¦Î~ü.ŸîûÏž +giÃÚóC¼Fn"ïϵÊ>äB_½žŸÕ¾–P'…örèë н¦ú}&(àÀî4HÍé©*=p­ë,pXÚ°ö¼ô¤ˆçJEÿOÒÆ/óë6wÚ *B_/A¯Å®5Çÿ»*œ{Ò!½Ú¸×Â@–6,mXûûi£6•PŇ-Ö`R‡Ý`W2Ô´A9i%|MþMy+Œãáf×sÍÁº jÛàŠï#*¸ðJ0¤·Bd>ô—Ó†s¼!® `§éi”‚@‚vh¤|Š6º°/ŠÚ »6ØábûJðRäz©Ü$i`R•m`÷ÈÜ4TÍÁ» *ÚÀ)ú0ÊîÏÒ TZá°éC|“ ¥d1|ò$m®úÀçXHnü÷ÅÜ`iÃÚ O›ÄNð‰Ãªêë¥8˜ÕIwèo‚ÿ$l¢=ž>fK/Š›HÒ¦¬dm𲌲€l\öPV]9â’ómaš-ä´’Ñ…5 i‚ÙV0ÝÊ~t S°é{?gÊø6ºð}!”—b5÷ g\ÉÇF a;¬Ie7šŽzÀdK¸S…yJîš^…¸Ì¦XÁöµ¸Âoó ´ +»ß ‰„¤>Žß’3màX.ÈAEÜk@(‚­Nð’-dú³Ï KÖþå‚1Ñ`VßIá¤Ó§Ðû6ð ¼(Óæš=œr6³•Vú}Ù±ô·ï¤“ã6š/…ÏÉÅuÚðJ Ô4âo ÛÁÔÀazRŒéüt<¸/[?,!¯º'µ³Z³™åˆ\rɱÂqû‘Q&Þ1#¿å@?R7‘"ƒ#Œ²û×FL ¼6Z…Cïõ¾;¨s0mÌ¢éEÈG2!)‡íU±´aíÙÓ¦¿%ÈdЇéR%´2´Ñ…ÙPUÊtXiÓ[íižlN†Æb¥e½Þ20s£[ë@_²'¥ ÕR)ˆHÃJ…N\Ï£´Y bD”€ydHpL?EÚ·aUI§ŸÏ~s¥ky7p0›Nð.‚q¸BÂ/ZÅ(»eaÚŒ°©H&Ô¸MÝÉÚÿ’sYÚ°´aíÙÓ¦Ÿömú0¾Íƒš6 C°[2@WaNJ6‡œhÚI#%E >†^;øúЭuJ íÛl1a—Z´Ä ;m´ à¸É.m0u§Í·õ¡ ßÔTf—Þq”|‘A*1µpÐŒ-4RΗcÚ ²&ƒkÉã¢ë(sàK–6¬ý=ã6ª$FVQžØñ h3ÀD2xÍ«…ÿWîIUçÑÜpi²2Ç^5Ç–¦€¤™ÜK $F´S ¡é4(VFÂA=Ó¦`£.ó’7>?24_ ÀN#Ì„AÞŒÃIDô±·,¼±Ÿ |ä†Ïj¨-0b(²W5\<šÉ.’6–‡ó·1ÄÃ;T·®Ÿ.6šÃÒ†¥ kÿ/£Ä\X]Q3¤Br3w׊¡L€çw{XEÓfãÛ|ýÊÚðlQeŒâ`9pPáAh#Æ_{ƒÉAÂå0÷zˆ°Z¼²&“BH Ø’~T?ÒÑ…“)xÇ¢VˆÉ‚%áøˆ_ÛÁårü!!³åt:îF• pUçɸ^S½é} /È¡Ž81Â{ùš¬yœTˆA"†>\I"2ŽÄ(ƒH„w£ãVÔnk*ÄÅÒ¢GWº„Û¦¥æÖeú>ZÊropjfêÔ{ä[}æZt?M¿'͸–ÂYéô$Šg¥ kÏ‚6)J€™Ö°<{#¹OX&GÐf­]÷ÖÓÙ¸çòÿ9íÀ-•uEXÚ°ö¯YÝw+ŠøU £ ž¼(7²>°a8K–6¬ý]ÊÖXciÃÚ³¡Í?›œ½5,mX{ah3"\‹û·æçôðÄz¶ƒµ –6¬½0´áB|;X6B\ì?ÜŽ¥ KÖ^Ú(ç£ðüeHkÄ2xY>zl uSÛò€ÿ˜‹%Õ^Y]yÀ r`M4Þ]Hç׫ÃËêj…pñiò€ëÁ²0,ê̯‡ntɤF˜n ¼R¨joüi*ö1ƒ°(¨‡× ³¦Àè@¨/£¿Usa=£­bfePÖ Þ rΉÞÕñEÐךZA<ÿ!vXÅÍô’ê“Úàm‹î¿Û@𯆒føÒ‡^Rošƒf1ÖÔÿòŸ–“³´aí/Ñf_)”¥ÒyÀÏ0ŠËåÐÙsm`¡¹˜É¾ÆfØB¹N{»ÈÀ,+¯wÅC'™|"™üSOmç  ³ Ó 3O½e ƒxO¢ ÖÅ€¤ ¦[ÃL{h8j…7ÖtBk3̵„æ8ÙÜI'¼æ°ànÎKnÞ„WNáÁ¸pœÆ—f‘+¹öO¯ý#¾¿ãS­0%BP%dAféu†©vÀ§KÎòÂæÛÀt;H°ð£1r/f™*äKîø2%m! À6Ëi!^µ„áfðà²KÖXÚ(=6­2XLæ_D4›Ê®<àšLð7=`²!©„ÒdšESàuKx%œL¯plѺXÓôò€?J›~FäîkëÓ:xEÓ札‡2­Â!k¦ùáÀ”C¥núXÚèÃpœÊ³¯ !¥ay˜±µit†—E±¤~ê0‚U-WGvXª&tRÊ 3› š‰½Òf¦Ö8$•ƒUDw@fN¾¹A⯅`—€Ïäˇøz¹ðï?–6¬ýyßÆS>àëXl—c!¨È<à¡O‘|uïyÀU{É>Ü .ÇÀW1p1¢Úè :šß7-×3mÞ A =£fÄÐ&¬‹6½ÉèÚðjú˜R(Ò´¹VñÌå ÷Ã,"Î?à'[¹ºV/|Ðb»vÊ%ÉT¿ûœ»Óæ`¾ÞK10¥ k/,mzÊ>Ä·;œ¼²‹hyT ÀçV01» Tp“ˆ§{K˜<àN ÁäŸEƳš†wéûÄ<àò à¤äœèÖÜpŸûÛ‚@i¸ñv§M$ô#ãNÔÃ%ߦ{Rª.¤—Bvp¾, ìÌq#y-:ðe@Œ3cIí9)WçUÑéÂeBE³k–èGÑ=Çy0€§4›¿3j«é’Ó|Á ºÚ°=)ÖXÚ̦œžó€ï…ó€‡4ÒyÀݳèÁR½b2 7@N Œ$Ý{aÐ(ê6<€lžØ•<…dü«“ntx.Ûžò€‡tËÞˆO`Y(ˆòZ ¿F’=wàË`Ãÿ±÷`QeÙº_OÏ}3sçÞ™;áÍ»÷¾¹÷ͼ7=3Ým"U®¢¨"çœsEA‚’D2•1 ¢¶ æ€HŽEÌÚ¶¶¡Í ©Ö;ûœSPE°µÛ±»gßúøŠÃ>{ï³kïÿ¬½öú×ÚA.ä­·¡²Zsý÷Òc8ršÔm°.z_=‚Sw ©]D Vmà~ w^ÀŠzP½„§Ãð)콇zxíD´h0JÕøžëæKxüU-b?æÛtS•7QÉ/áÉc0¨ÄId#à¿—¼¥àÔõQhC …6ù¾å/ÕÔ9I—j>h7ZFöð×Õøö­”Üý\¦Ûmmú$3]¦é°~[E^DÝSÍPL¦iu¾d6ܘY²t–NRhC …6£Iøþò€+ÓžJNÀ·Að<{ú–·oE‹Ã^tû¡G°»‡r2¤Ð†’Úüî\ÿò=­Üª`ë ”}fÿ¹o¢Hüê38ynCQëßµB¡ %—hC …6”P2‡¿Í,,l©ŽSÍ{ÍÖ=Û¬~]ëßy÷(´¡†‚’7ÖmÎMÀò:¶ÜöqXº—´‚ ›àÒ0ŒMÀ¥»ÀÛòÞW´~\ ÷aøÄ×ÏÖºªn ˜ígnÀ¯eàPhCÉ÷m.ãÁƵѦ[ Ëö";Æúûpûüª ~Q9€lªÖ›ß㊖ÂÏ6£“&úøåF¸6iÓG×Ö€ŸWŸ ÃèŸP_1…6”üÑF/,S³ë/uðŸU3ÐFàê3Ø–t9þ÷cpáÐOÁåa踦qâ!d&’í_ÂÕG`_­€µEs>^¦ëæ'Ï«ðå9 ¹`/BžŸi9þì3œÜTFÖ‰ýTPê …6”ü uñ#¸óØÛ5 fÚFDС†Í-(i¸‡†þ«c„ÿ¹ –]…GWpo1,9 Þ»ˆ]ØÔØK/!Ÿ@ÎTÏ}˜þó›r8 Pº{jzcè÷Q¥ŽnƒÝ¸õùG5è–ŸR›) m(ù!¢ ¦NTÀ’> ¼}ÏÞ…ôÆéôÉy38à øÕä—ûc¢$΋ü@¤ñ…“Âov¼Ò¸ÃIṘ[4ÞwÓD —·LQ“,Ð ûð‹ˆ‡5†“"ýk)¨¡Ð†’Úô‰6$D”Ãÿ¬Ç“ˆ°p¸m6ø8)¡Í$|BžMÝòÑÖ8ÜJáé¸&JUÙ ‘BÀÚÚ©ž<ø¤jªçÖ $4߀è?v¡Ö?¦vRÚPò=F›jhnÐZ¤bxÊu üS%Ð?ÓÁ–_žDjɇZWÌ{áÉ$¼”䀿m~¿çBJHžÀÑFק¦ÔðÛ2XùÚš5÷â¡¥Õ:³ žÞž®º ¨=@¡ …6”|ýmþx ª·•T'r¯ãÔHü¤]ª×p©äPý¾Âm¶¿ÞÜøºÞ¡Ãß…sÀgG)üŸðïUðcWãpé˜l3,ÆÕÃÐSƒÂæ©ü›þ½(´ûÃapþŒlèOõ06>å-ÙßJ†ƒvî€#0p>­šs ;‡aWó×$¼`°žt RhCÉ{:“ê| 5¡óo™üøÌ<àxÓ·ÆPr‡…Ûàß6Bò%t–í¶uƒ× 7¯¿ Ú¼Í :âxn›»¼r‡¡¯žE.CŸn_lDÉ°>Ÿ€­Ý$Ô #/D~- <çÈ_<;c¥0ÿ8Œ¼„_V¿n„ú8݋ʔ߅3ðÏ•(!ò €58½}á ¸w5ôo¸ü«]̾O¿‚ßTÂ'ÇP gôù·PÐøžçP×òf# þT´’Ñé«A|~^A¡ %ïÃ߆ÈþóÍÓó€túAç—ðçÉä&5päâL9íœzG§_€/†¡þ,éøßpá<˜·£‹-ŸãºJ9Z\ã_=‡8Ý<à›†áÞ-MC ¾=„D›ë×€Þ Ÿ?…¦ËSy¬BUpù)¨¾6¡‰m„Û៷Âù'xÎñ*Øñ%\Åûó/šù=Ðx.=€@<„ð"âgÝ{{P…'Ÿ‚ÃŽ9Ѧ}ÖíÒ0Àù?D3lõ ”sj'RÜ°íwê.y1„]…Á!òö=‚'Á…°ßEH¹‡ñ¬ÌV¸ùåôìZ™×%W\†£Ó!…Ó ÿY ùw¡¾e–­úΑþòܽjGys0M²Y©_!¢ÙÃçÐLé6”¼´ñún  ‰Ý5Œg÷Æ׎q Œ>ƒyµ@;„Pè?¥ˆ;€’í>øs-܇(<x»¶´ÂkÀ«Fžhò€Á’Cð»Í÷9¼Âó€ÿ ÏÎÜ4=øó 0ž¶‘š¯ÆGaÍQøhìz—TxŠ™ÛpþJþq=ª¡@ð‚ý ÞC]ý@ŠXáu(°¹mžFA†/`ávøh"…•ì‡ŸTÕqˆÞ‡l çžÚ–9ÑÆú"âk„Ð$¿“’*Áº‡Ð34¦ºùôuM÷YÒk€WOÈlV™÷`W +ÂÑn¼Î2èHÙ‹.ZôÁççÀµ ò•ÀÚJ6t€½‰ì•.\Ÿ¡>á#¶aV´‘€q?<¹Fþùk"©¶Ý†ÍÝð›ðÓ¨õ̽ð»ÚPò>Ðåß„>iåßýj*¸áø?x ®kò€ÿa7,ªOt9à÷pøÌ<àÏš\J†Ðù¿gßË`hsï1ÙÜ/O ô!ò°`õ׌@á~ml*È:'ì4!2~Z …ܤOà¯ëáÕKTòü8xl›RÏf.ÒI´Á>Û6ÁMÜ×úÚ#¨êÇ)íb8 †mG¦¤ïUxõùŒ,6bXyÝŽÕñÕMÍËáÔKÒMz_7™{4èú3µÂÚчÍ'PáÃOá„ŠLIsn®Ýšm·û6hƒ’˜ßQ ™÷ª ¾†:“¢ä}ð¤þWÖtênˆïFŸyxð+‘ºFãÚ9ò€¿'û‘|]ðßlÉi(? =dĉ…›fììd»Í—$Úüô ârþHöx[¾„í—à 5”&Ñæ?Å`<7&ruø üe#ZMWÆ5=ŹŸX1´y­ÝfÒ§úgÕ`rÚŸÁíëH')Ó{žy®÷£§ÎÄŸQz~!»~xôüBàÂï4<¸…zuè)ÈZÑý¸ öa †·õ#9É AŸqÒÇoäð£Ípþsë>¬î‡K×áçÛ´Æð]¡ÂúQ˜|Rõö m(y{ݦ~Ž ÂênRÃÎŽÙó€¯ÑÎ.&ó€“ðÒ)¸Npñ,yÀWwAr$áÁ+Çàx«N.¼ÿªƒ„£ºVb Ú`Ýx`]C&³«ŸB›ßiÐý« ~¹– eâƒRPDo™Î÷ÄÐÆýMÐF ÷Áµÿ…Qÿ­ íÔî?ÔUcÊáâ+ˆ­G·/íFψaøOE(&X^­¦{ ´ýg=£’¼hÑ÷o’Á=¦ø rdéúÏ RÕ$zŽÀ/µÇðMÐFc ú}ÛëÐƯ“(´¡ä£½X§ç?‚H˜?.…¤+pî ’t`Y ü¾q*xÕ8¡ÉnT…¯ì¼<•üOxð?zmp©Y­k„ñ¼“Ü _l89ÚˆÖ° áÉÇ'Ð'Hû_¸EåG› á*™LœˆúG1¬¾ ƒ—I&»^äŸB힇èídÌ®?ïÄ9t›§Umš%/B|°©mû”ðË 2ùoÚçh»÷/3ΦW߃þ³døÓON!mClkUGÂHÖU軄JÊ_BÿÞ'èªíC1TÜ‚ÌcèÊO·#üáUÌrÞ‡ý7çì9…ß‹ÅÇûà#|wüñIxö˜ìÿìa¡Ï’›°¥ ¿‘ÚIQò¾ÐÆö<_bFð5ÑYOó#´`Çž'-2Ü°ðàò]ø-±ßi†G㈅½²kú¦ò€+‡Q\bL»ˆª'­;Ÿâ½Í8 >ƒOI Æð3X}G$ ð»áÑ- ÚBÙÇ$†´ó¨Î+Ï qœzÐ-Ax­×è6Õ×Q«Ã3óqÊ9G{îz n½‚á/Ä øè®søÒ~ úÙt´)|çˆÒ&hÂó¡á»°‹÷€¶™lëGáøí©<Í×àg³©?Ù ÝÐ8"Ÿ¢a°À™ƒ£ðôRr®Þßã7þÓFèxHÖöå}øoö|9†0 «aÙYNzGt"µ ¢‡Â^;Qì…ræ9œ¿ÍwÁë2˜ccÒ…J¢j) Y¶b…6”üíwRß,xé»Ë.Ój¨D·3"-®÷$¯\»“ÉÁKthJg4-ÖJØ=yeòÏ’Ù쮥Z…EZDøà7"¡k?à´™6&¢Ù.–Ïm™–K½>!çq½.‘¿L38“ÃX†JΞâœBJ¾ÿ<©÷™œ’¹Á-õ22PS<)Jþ¾ÑæwÇàÖu m(V&%ÚPƒ@ …6”|wÌ…w•Jû5õHç&8{óöAF% §Ð†’ïmÖœ‡'cpã,ü6­¤ðÓ-Ð|=…¨=Ó]úç7¡£¢—ãHG»åÛ¦—I» ¡»¿íðìƒ[£Ðw~§˜‹½ÎÃËQµQ€C¡ %ïmNŽÁÁV”éû—Ûá€IÍ7œ{Øí ƒÍð›MÈ/~—Ž×ñ‡ D”&äWxÚ…ßË´ l—=°ì ¸lßÆ9έޠ×aâü®þt5ñ¿uÑÌ ÆÇà›PÏ(»(À¡Ð†’÷‡6?Âî~+'sÛCÒaÜ ì!,¯'/òÚPl–úÓðágðÅ-ÜIxf¦9 „߀3Cä&ågû‘sÈÿÎî¦ëtTJ•þA%x·Á—£pæ8Õ#ÖÃï>ƒ«wIGµy | —3áûÈápÖ| G®Aÿ]AºÈî»9 :ˆ§ w=üÅq’ AM m(yoºM'@ÉaÒ­ô€`+útñÈ ƒz>Ý öÂÝg¤'êó9»ÿ¥:rj§¼î±…ÿ³…LùY ò»›©½ü©öƒò9üVLjJ›O£b¿ÀéBôð—pá rNû@–ªéxq~Œ§·û©œìCÔçpq`F )éÓù6§t m(y¯¬Lì÷U€ œãœLƒRC(}É’.×Ú| =g÷—¾ÕS‹C¤?Ì 4'†èkp¬}–©kÝ ¿WÀ¢#@ߢ©ïÃò‡p¶‹¬“sšt…E2£?©Að?4š†'g5Ü?:.Óý%ÚPòÐÛ}\™ÀýáÅ(šÖÕqÙ§ã9Ü °N£±üW³mfÛI›t€Çu›€ßÏÔmªÑJÿEùkO‹t/Tæ:òú¿ÅCQͺ“*‡£ýdÒ†s ¾:=K$=‚Ó´ô<¿«•e˜ m(ùó¤~º™v?Ôü¹ú *µV¨êÔ Û«±²ž!wR÷fäìþE)d?…C'5+z+¾½š1?õNÀƒûoŒT â—pTæâݸn#ÓÞé;©{_Á¸ ê— òFÉ-æKÛnc}æUN!¦Íý»‚šÚPòžÐæÃJ2¤AJ:ù¤ þP ¿ÅãÚ]†ë7HfñEÐè6¥ºÄÜò‡z9óGåHÍ(¸½ä¢6ªÃ«"¶Q— ë´ün'зϢÒ|Xbña=a÷ÃøcܬT Ïq&¸X‹L4)8£jçK¨:…®F\Ks<‚:ø?x ›Ô»ðÅR2íA ù3J·¡Ð†’÷h·át SÆad×¼ÿ‚“ø”ðÀt˜òsú9r•y<>­¸n3wÎîÄ‹¤¦ÑC£/•ÃC€ÏÈÏå¯àp«Î-‹ÀØåYö;¿ß“E(¬eÛc„ OF!´M³“šË¯¯ÚŸ’êVÆ12bÌ €–« ãÙÃÇOÁ”ÊšG¡ %ïß—xFp^'¤LaÐ0ˆÛðZ´‘Í–³[¦Ë°žÉ¡.ƒ¾žÙêÁŽ§šÂ"²î-ÚÈt OթͧÏÆŦ„BJ¾+ž”DWáŸgäìþz´y{YÔƳåÿçípòÌôë?>ðhC …6”ü€ÐfŽÙõë£pïÖw©|X/PhC¡ %ïhC %ÚPB¡ %ß…PhCÉëåù(ŒLPB %”üÍ¥ÿ+öPBÉ;jlê§Æ’9CY/%”|[ÁæÒ&l‚’9…BJ(´¡„BJ(´¡äïm¤½ ‚̪ý¡+óƒW‰6žV `sIýÕ¶\ñIKt'^Xrn~Ó5àÿPh³¶bwdq£B9yebejÎÒÝÃ¥Û7&ä"I\”˜‡Ή.n]W^D\Òº¾²þAEïøò–„܈ܺRå[ÎÉ×Kë—¾Ë%•Ö%D¬ÊÉk|õ•köY¹W¦úî¾%dˆŠc_þPÐFŠ~?rµe;-˨\’­p´aóìâ :ßæËmèÔgº‹‡t..Í–´ŒR«ò mS-#Ë+ú&¯Œ[ÒÅ÷Dû›b vÆì ôqã¸&ÅíŠ-¨]¹å|~Í~ìz\a­«)Ã4R—©]{l¸²wˆ§G /Ø¿¼d_\ÁöÀp:ǽPIL×w!} 'Ñ ÎÊÉ‘½Ýûq¯LŸ,|c®õIÄÆY8¯Rý@ÐÓ‰%cÏRE?9…*Ï@`€kX逼W-WŽ¥U‰ÝP›TÙ¥Q]Ô˜çíj+¨/?VØ:Ž®hÐiÓÙØüÏ$=Xº»¨uLÖ£®Pâ•ìZ½ãrÅ*#n¾W²_J­Ù´™,šÉ‹ª©˜®LDÙÚÜœ¼‚¡ g=«hHM?Óyök¯êÞ…¦bþž®ø‚ÚU}’>üý¨QÃÅ„â±…û2÷?ã·cÅÖïîŒ+Ø_~´ e ݨ6Íçc×ï÷@RÙ®Bô~D•”=ŸX²;®ôȆ¦qÙ\¯] Ú`3¹xW\Ù ìF r·µ`«#QÑ.ÅÆ¡ ¶7Äoº W’˜–¿c|yãrQñ%µc‹Û¥8†îlIÚ~Y¡‚’CCË kãŠ÷gÆ–¡´g<¾h·¸óNBÁ¶¢–1ùdm=‰-¨ÌCÏ–Ç#´‘÷Nd”íHÞ÷ìû®Ût>f²9™h³Hí¤} ï{åï̵ðK‰+ÞëçïÅ°H”bÞ «W‡±-üoØ™°‚nd±îÔ”n#m¿af¸hÉÎب M™Çž+úG…4»¨üøÂmN6|Û„zLÍ.;Ökå!URköïm¢¥ÕC€á&•ƒò­Ñ‰ âüi–˺§õ!#;má±n£¯ßc½¬Š÷¤°ƒ2¶Æf‹ŒEQÛ FÓ¢YæÞÑöD%®¢™f6jé6·ÍFoÆPÂÌ”‘vh+¿a£ŒÁ¶ Ïݜ΢ñ3[h¼mDG»x†¬ä#=VÄ{ñœ—Æï  ¤[&•wƒâD=MÏ©ß *TÏó£¶]¢ÛÈ©¬ŒÙ4ã¢DÁNa¢sù•Ó,,»6&}ÏÈpyýˆ´{„Ãa»ÙØ¥H [aåŠ0¶epLÑnŸ€`kw3„6ÊñhgoÑï9ÚHZ¿`s¸¥]3K–l­5†ÈOão‡î—ÆLöÊÆq¹ê•€«Ÿyü• eDD9º­¬WœDh#xá&œ ùŠx;àhób}öR#WiÕ » ²ý ]ߺŸŸýh¨)õæïm’LÝHJXìoŒ69]€©ÜØ‹¯ìhOÏhÉ”¼_mÎ_”vMÅŠþÇa«òº!ÒycÚYB)Û’ÆdFJûÇMyzi‡_3vñRçøÝ „6ÎâWî¦óýD7ˆ] 6ŠAp4›»}k{í¦ç„Zl•¿F·é¹aÅÑÝõC$qÃYÇB†Ïvì^{KÞòÏîÈÁÓ‘)»†Ý"ª;fdZ9øÊŽÎLïÀÆp„Ë6 °¤AíÚñ¤·€—å§AX—p=-§d ß2UÖ3ÊåpÂ÷¾ÀjP ªmŒ?]±÷9zê¡ OÁ<´“êÁF ”ô{Ž6m×1´)ÁÐfJ]$?¤m0ö^UIjÅcn\†ï¶gŠî!®‘á†v t¿©+Í¢%•]†,ç`®©ï&9q;6Ç_-òåXy8ú„9x‡9úsôi '©¥úw­Û,–o9ÏàrB­¾¡nçÓè†z¸pŒÍ<Ó˜jÝõ,ïÀë|‘wènEßçƹmSõ(TOm æ…Õ““SÚÒÁf $Ýg¹†úëÛÈ‹«Ö®1 +ªlR2íCy |«¢žD›ÊþBš¾•G6c¼ÃmíùqÊÙÑÆPëì@óLkQàÓ¾h_‹kìˆnD"ä²<Åç±=TvîN`iÅ $gD9&žÂ®¬I´r(¾'mîb;V–,v+¿XÕÖÄà$(Î>2[ôIÂq²·EûörM=ämØkq›Ö=ýk›I•/&‚ÿñۀ´ë9Å^R÷LÛUvüË¢Öñµ¥E<Ϥ*?£Î,†wÍ°¢çÏhц64ÙÐìZ•`%ª:ÕedÈpMÞ‰é?ñ‡F X&ÐfY¨¯efÓ¦3P9„¤ê4(”jj©Rv›¯×mæÓs{Ð^ BÆ®—o1µv0³vØfÉU_™-ÌÁ·9ÄlT¨ž9}üù§´é›Éw_â-Èk%/®L_% +¨jRa3ÖyÅ.>‹wà•¶nS9p[¨ÿiz»fÆ¡Ì~b²WF3b„g+˜ú‚4|ù×☺l<=5Û±'Åî­TÝ,ddu«Y´ôN|ã°?Ï®`Ã?÷Ê]}L{ùúÜX봆ꡖú;Lö¶pO-×Ô@›ìæQ|SpK`0?³ Àô™è@æm0ÉÉðeÑ…ùͯˆ”uß³êä÷‰÷4`y”Öãö{,7³ ÓEÕf&´ä}qU|Œ}Ö¶)4v›ÒýûÙ\~YLÚmJD©&Ébbvu?Z!ï•¡ 설kŒÚFQhó¦v›Ù›~Ö¦FË·ßFk°ï¶pÞ¼U­±^rœ(°>/ˆež%í Qâî{Ä-!þ|ÏÔSäNjÊÁuû)ÝF>ö´Ð² Äî©`wÎId:–tŽˆ»Õ³ì¤†`mI>Ë&\Ö’¦/LA~'Y`•¸¡¬SM@YôW¯Èt®{J%þìÒ¶;,®ÐÏŒÝ6ŽÝhʳru¶¯½‡µèFó^§’ã„5«œn2Y÷Ú`ì ckÐã(”w­ðÖ½®1I·úûŽ6=HLXæÅÆ8\.›E÷Êi“ãÖõÄ„ Ž‰…ϲT“iwˆà>W—p4×ètK ®ã ‘Jç<-Ñc%Õ \AÞŽl;Ïè$ÇÈné.…J5³øV”•˜B›oƒ6XJ«‹X †¥{˜À˜n·¬FÑ’Æ |#š…O’‡¿/‡ÃÍAÇP²YÌ¡Ó\¢Òm­-¹qå*ðŒ•Îl‹ ‰Rc%îñþ#Æ4# ÏWOw&Û:ë†rb±½¡ùš‹³Z‰±I¾8ˆoVƒ6MÅ©lÇ)bµµ)a[Fè]X»·Ñ õüKoj,c>‡c"Â!ÂÏÁŽaÀ_,9 >xŠghh´ÊÕÕ#°+ÄjÐB왕À`°ìýsl|c]W*å}ãAf‹ìònþP|‰1赿ÄDÜ5NœLáÚ£ZÜñ ]ìÕ˜tÔšÂ/D#¨ ’ñòöWäf¹gûvøÿwUÒ†•Õ”Çê¤t›¿?´A£CÛÉJ-n!îRkx%ê›Q›Z‚M'£Š lÂH{^߇iS‘ÜïH»Çð™üŠx×%]D±W“s²¼í¥îŒì·¤‡œáÒ.¢’—’î âJyC·Íú:è-o!k´\3¥É.µ¿’jjCÝ6%Óнt&JÒñ/ƒn—t¼Âª’jJ÷ÔøjzIîæ&We¶T'°ñwŽã,ší¬‡b.PB1~p’² Wr¾‘K^åð3wOm”S<)J(¡Ðæk|àjÆ[ß[qò}ÞB×äÝ’ÞwJ¾ Ð† m(™ÉCì¹òjfåIUE~¤œ!Ïìßc¿Öõ³è81t¢wZç_Ä„Ó´ëÕgædü"V€xqhWX5D4ôMÞ>¨†Ó³·ˆ]”«H'Ê~ÐòFŽXD»“g]\ºÅæªðMšÆ®TÁݱztÀ¡9Fb¬*ú¿~ö¢vû5_î—^}ä“ÆÛ­>ûvËa&Ú ŠÁTÀ7PþBN0œ¼ ÛÃ~ l†ßљԘ­Á"ÆdÐY Cý…z¶þE¸TÖj#C}“Îd0˜4=:“ï£ ¾&?+CƒEç+$ ó lÍ}¶™f¨s]ß²L>ÇëOÒz‰n°¨´s‚¨ÐÈȈÅdÐô°ù–.KK »ßú]Ÿ@Ÿ¿Ð$øðìXÔ~ÏÓχfhHÓûÄÂ;¡¤‡8ƒò=‡lmÌFó™|Çøš›³‚V¬lw½µi4Ÿ%pNØq[6G…³7ÝñÈ+À+I×ûÄÜ+®¸9µZ $î¼?Ò›’F[°Ð:¶kÖåƒdòºT>—Á0øÔÂ7µìõ¾£âÔÑ~fL¾•B÷ø¯¢ù¨áG¬õZ˜P²ç¨!ÇF¡úvº ÂB9ž}Ó¬2qÁÏUAtÊ&Qß{ӾƘ´…Ù§´hÝýàïþ÷Ìs|WhãÈb‡ì¯"ü‘T/|=l¬âwcNJ^ºY`ᘇ)6²¦ËfVàÖ{Ø¢tsr+Àôì:)øë¸hï6®Àgê"&ƒs‚†¤í2‡Í"ÐUXLV(m¹µ$˜).ŸûDh D¸† V Aˆ9Ý÷3ØržäD nŸA¯ZÂe=&˜eQSyu)ÂSÈ[܆<Æ,x15·±—`áÖËà ò~RÇ ŠPçäý#fø÷0=¡`Sµeh)ÖܬÊ&ï=M¼åQÓñaÓMgP…Q>æÜÈSØ´·µf¬ØýPÇì,x±çGƒÍçpß-M=„ƒX{›62LƒŠzQ=qËü|Jo¨¢[rr”ò7IYfAsg…’Œ+R…w©¢ås¾©Úìm`šº~{´‰Œ2óÉÀ”@4òøW/„+NZTª`Ó¹‡ÆFþ² H­ªDOý&¾£¹ß,è:9JäÓ© =Sû š6%ðñDhÃã±r .=DŸéUWÃUG\Á#ZÇ•Õï‰>ö6AµO5BQY†¾`|G›€,-ß õrO®IB/6®º3fp´ñšî…¥KßظºªiJ6¶‰f ÍT…ˆó;æm¶À1ó¢¤ýÁêªSÚ÷®Ú|NªyÇ°È0.ß”Íây¬Ú)€äP .‹Í5µ6 :„­÷ôò PÈãr„.±ëŽco7uÙÉ;%]äÌ,,ògºÕ¢)·«fž#Ñ›{$4u¿ˆ\Í02b³¹AY'ÐåŽ<šeþ´b³Vˆ5Ÿ–Êa1¹<®ÐeYÖIt~ZÖ8U²¨$ˆá\ƒ£ sÙ†­–fB&ÍÈ>J,€¥>&\‹gjmµ´CÖ;Ãbq¸<ŽU@z!ò«„È+¿¼3ˆíˆwC¯)™r"*!Ž—´ôK-hU:›¬õ !S}äË ¡ v1Òr;¶[ž¯A›¼šfoªòd~Ãó·BïÕõ.6lÚ"cÇØ‚XmÇf³ùfÖÞÕ_:Z³Y\>ß<£B}õœ—ïupò45˜¸$nèšc½+!·z›©1Åfšy§çwá1·:Ú 8|!‹)ðÏ9%%Øßíw‚Âü±)Àesì£ËË•Úh9â:Ç}}ùèye_@\×ho-4æ Ø|縭7u"9Pò·Gôu÷AÚê†âtàºM.âóö£W‰¬í–›Zûˆ@ÛÄÍ5]i[ éÌ>øHƒ6Þÿ—(ú_„DÆ{F®œÈô⾹џcéËÌ\2$§Î{D¬Ô¾×uñÉ,w·MØ]ÞSj?;šsîllÎølíÊîb² {‰#«(›a—( v4ssëÊÒM|KŸôSÈ­h]‚· ¾64:Ú˜M7¶L?„ž.-;Rà‘U^58&äÒ’¾ÌŒu&î ŽŒä±h|»èÌÃO4~Ó*T+YÙ-)@Ö°”ŒÓ"’hÖ3–¹¹-¹|+ßÒ{Mö0mmMØ®9²ÓÈ`âe«ç™5„õÖ“½0ê(pQýf[·ÕH9 ÑAîö™'1%ÊSøqpá{'g†!Íqie9®±HÔظ¬ÄT¬äÒpoÛÔÃJä4lPzUt¸D›^uÁg½k¡/zN´é‡Ä¸DíÑöŒXž¼ëö[ Íb[ŽexÙ 2E¸Ð,’Îaú†—³¦°>ll9H7”œAîpQÑVÛ%•çr&-µ0 :0Ûfä'Û …™­H IË á:ÉzF4FXõ]L'©|diŸM§Çmû 9äe°¸¾‰Ð>ψnb^EÜèælbïëìåä‰Ä7,(WE  ›Íd2h12MjP̱OÚôÂZQ–Ày…b6ãŠÁ'V´¿.Þt-ÿ&7RKröÉ åx Ãz/ó±ÄÕm8òåúC׊Žtðæ±×vîXÞ¡î>6¾É9È’åF7ä®mB“9W\@„HOƒ÷“€¤²­qL»[æ@7äe· bÙ¥9FÂHñÀì¢ø*M·2¶¶&‰,KL`¹¦T%Ÿ{y†9xøØø¬È>I  ;fËUÂT»*+Í"´¨ªĽ(òiñ.=q-msS¢èÀâPwnÄŽª³ã.&‹„ÞY•çòâÎ3]z’h±¬áËt¼ä’nè& 4òe\Ÿ|lßT>…6Zˆ£Mþßb'má•zJŽÈÊ÷øíÁ&˜%—“Òðí[Oî£ø—©Pɨh3ׄCr|Sr`ÿL•˜Ìü\^@v•jj{+i¦Myyèí–ݸqè¹=íÏ‹÷‘ Rñ¾í\A 6Yu]Ži.¦†D›Ïó«·²¬ü ¢’è {.giý0ïmÌü¼¢’½"“ýWH ÚÈÓ ¤Û­G|Þ³P¨Håc¤‡×î¤|Hþ/.Uh­M»U #·%¯G›>X¹ÒÞÒ¯JÖýª`Ú½ÇUö_˜Ù{Z9z qò²Z­6Ž¶< 'ò¿ŽžVö«NΈ$­”mÎb0£Å=°v¹Ýk¾ÊÔ•-ÍO<9jk°0ê áeª™óË\¾{äd±æX±³W(®ßÍ¢q×~–¶­/9#嚊Ðf²¤ÊkòôpqÚI%î$]úÓ7¬7öOß8H¢ Z/[Ë™l‹È‚ÃéÛûûð"j‘UÇô¯Á’û2Üû´¸®žcê!Ç–êv)“mž+™¸,ˆº¹ªïº©;õøpáñ;ëkO²LKîjo*ZY øy]S<Üâ=ǘf®Ø–6|¥3ÚGo–µ½­Ý†xÒìßסM”Ð3³Ÿ¸±ô𠶉լ­¬ÊL3 /ÆõCRñ76±Ùæ¢nòub¶²nÓÐ]Ó… È‹¥‡Ž³M,q´áÒÙæl3ëä} ¡Mþ•,™˜e,ÔÌkŸàm)pxßvmçÉI» òôuâ±\ ¿Ðè6oa·©v²2ZÚNŠÀÒ³P5;Úh&o½À[ µW]~¼G`a«}/Ï6[vVmÏùKܾ1Â,íÇaa m’#œL’ ë1rêîWô=÷u÷H8JIO²Â2l¹í*04IFZå “y†)íjõ©»è!Q²äØõâ¶1im®‘ “ˆW©¼ÆŸg´¦mbÖ #<œlrzˆ‘Y“ÁvK­zåïéXsbÕÜĦóK{0݆]ý9A¾[™ž`!­ì¥A›qo–kÕ#b—…ûò"k±½md¤•Wf/ɬ­æ™‡Ê{'|…\Å]¢dÜâ` mdû÷òÍl…6BlèÌ-Ù®ÐÊE¤e`¯¸cJûxEý«IÏŒ¢•&ö± åD”›¥öh -Ì—U_ûöh³¡zšnã·GßX¼«’+ ™µ•õå%L×”J<䣴ëņ£_IÚ®Óïy¯‹GnsÕИ+ï¯á5/ˆA.ÜVƆºÍºæ‰¬ŒhC³Õ"åäNêrѶ=Lë I£º¸c”`3QøðÝ£ ñNiVrØŒõmc8¸äµ"Î Î%!8Ò9Ðf.™†6X…RD¢y•¿}/ÏPß&TQ1mS qq‘|ÏLqϸ¤ëy¨'Ó:±[m͈׶æÀcqçX¶hƒ`©ì ¬\íklVÚ9*j{âiÁàúì’â¤`{+†A¤{byB$Ûy5¶¨³åyS—2¬dó—l6'£i+fcÁ,íÇŠÅņ²Ý2+OÏ^áê%žìÀ­’ž±òƒ vÖ–t³Ù ¬N à™–tŽˆÚžzY±Ø^Û‘•Ø–Ï´H,î˜uݲã|VõDÑ7‰6ê8OŽ ®EÜ9Z²s«£³9Í¡iP;vÒm3ÇÄÍ7ìXzŽÙ¨ã½ù&1â®ÑÒÝ;,hvùÚq¹§vR=êµ¥›c·’F˜Ø˜pß#ãÈSqÇHFÉ»tÿÛ˼1ÚŒÛr9a;&*ZX Mr['¤}ÈnÃâ{æ´©%O¼ÍY¯¹4›ÿ€º¢ë¢‰Þ‚Њ¯$]¯â¢­Lý¶a:ñ²z±ÁoáÓ¦Ã;ÞÄm¥¤g\ÜvÏ‘£ï\t{ÊJÜ>î6ŽiǤÝFÑs×ÊÐÀ§è‚¸s¤ìäY“ILlJÞÃNj.´1õ'ÑŸ‡ê•fLó 1n·aëþ0éfÙªoƒ6“ò‚SRöÜ›ôœužc³+S¢°´0å[Dˆúñ×ýÚ í¨å¬§·'‡É´‹,+!Œ6JuÚ†|.“kêä›~hreÉûžy±8B—å[¤šuš[)ð˜&¶©G^jNÖ†M;6:³|½µw—nV¢"Á|Í2oñ~Žž3†6Åά®jNÙ8)Mi»Q²Ñ‚g±Gó³1ŸDñÉë©;.ÉqÏyëF4³BŠÆoÌaçµN`BfrG¾ý7S·_ JÊÚnÒè ˆ½u¿¨ÜdIjrõ…òÈú&6¼]Õ?l¥o …6~=-éË=¶aý•BJÞÚt8;û%ÁßË]JîÃÜ6¨hUZY­Çu’‚êržeˆB‰Íö“l–½X³¡HŠ 3]±¯ª±™¾Èlm²¤¬ 0v-Çxˆ%Ëoç«JU$ß@jÕGgÇТîŠ~uˆå§n¥÷¥H´#›E·©ž›²æe#xs± ÞVaeå{3̼ƒ¤ã–¹17hÛ]Lq²äÌ-ª±µ·eИ^)u’>ÈÛ²ÑØnñ$"ÊÅÔ¶ørUÿ;>#ZÒSw!""È1©¶÷jC¹AÌË08 1!ÐF²[fdäYŒ)-ç .ÖŸÎ÷'ÑÎáÌ Øü€ØÈ{Ú8§ŸÄc븛/ò)»…³ãÉš­JékÑÆ*H±2‚çTü¡%šr™E-ýìEm²Ê*ÝÓ<"4žè·¦eò^m´Ñ6³äHŠ8¶K‘~Õý‚ÃaÇæÙ98Úù'¬Üñ¥L©eàRB^E9Û2rrÏ›½£'EQgaã·ýËIƒŒ¢ïéÚàö¢ÜâDaD¦ZShCÉ;ÕmÊW9»úWÉ'Éc«>õ²HÛ¬ÝÞ¹B|pyN9ËÔñ±:6ËW¬1>¤­ˆâ/Û½./Ó8´pŠ¢‹ÖéD°Ë·æɤbYò¯ Çà„í×±i¿~‹‚ɵÈØ{1{W‡P`Ï¢[•uCT°§±wvöþ+©1[`ÕÙ÷Ä‘kè°êPîþˉ©‹M¸ÿ-w*‡Íy4ëØÈ4:ôÒÝÊÀ=ûlÞÆr‡•š} $ø™YfŸVô­Ê˵°õ°ó°pJÞyg$Gy37=“öª'ÑfåÒ@áÊC8 D{p|'uIëY6ÛZÜM„ ½oJû4aû—ù‡1¹•¸6ÙÒoÃL¦Øìhã//?ÔÈ£:OìgY¬W(Ïhóú/k:ÚàƒœW½Éˆî˜÷JÚõÌÎ#0¸ ƒåÜ›¸FŸ$íy< 5ë·l7¢Ùgi…Ž qðô³t]œºÿádµ:hƒIûLŽui'Š¾E¡ %ïÒ—¸û…Kß"({Uu×ÚÏTf¬yk0´ièàx¬Ü´fkïÑV¦©†6’¦v6Ûb’{l•zdõšdóh©6EWm”S^š§º …9¸’PX³ÝÉÝÃ%F"=UÏ¢Šz!)+ÏÆÑ#xCOrV¢ýâÍzÈ{_„,‰·r ^¾ý£1oÙþÇŠAµw^ò¾ç:£¸ÀÄ7£¨v;Ï6ŒXøØÅ{SÉÕ¼µá ïê 7*Û‡ˆ¦ó·(ŒmW–4Ü-:q7ÉßÄ& ¸i4*ÀÛ~m#ÁÉ’iÔgùL¢Íº{A¬’ø\Ùw‰O§™Ù{X:¸cbåèé_Ñ÷†h#Sô<µ`pÖuB¬'7l÷“Jå6¢–GǾ*Ô’¢Æç³¢ qÀ·&7…. Ì× pJÅ”]wqh€Õê¨WJHßIø­ïÑ8+§HŠƒµF •³¡Mϸ·=rûulˆŠ[î[²>M®{PÞ1A¡ %ßmD MlŽPŒ»ÍWô^1¡ahI+— —(ˆ¢¶mg™¹É1í¥ë —Í* ‚©ÀÃM!=ŸW´žå±Ž èJ:Ÿo8v[mâ“üEg‰XŽ•}·… ÄǶÏÊÚljTf¢=/¢ÅahyŠuõ #§'½€2lÓ1^Öû©Ã3ƒ¿ö;¢Ð†’ob%î›aÒé†ú4—•õÒ>䀷V,ÕЗT\'Ó/ª ½¨˜MÓ󒜗Ϩ9o‹„%ð™æ^èjo0oQúIM@{Ä6ºÅšÿ ‡¿ì51+*úÕqIËŒê-;1åض,9ÑÉ™8„e~†ªj»åëïƒèä4®gò>r))!.%K7D%íƒÓã9»ïøøá%9î+>#:éÌgÓiFöôü¤Ãä*Ë,Êò™ ÃOÌ<–£s4ìÙ5Ø[ L,íÙL®sÂ6tv¬„ 5Û,,ÆàZ‡Ÿ'úYÕ÷ ÀßIÿcZvÇlÚ kË嶶æ >Ñûä#–ÀÙÝ1<0T(ïš|üg¶EØ”Ç V~Ÿ˜¦?/´ò¢|îH]×=ÝÌ çwÍò5 zøz2X<.‡iDãº.­’¼YTLѦ„‚B™ŠÒm(y‡ºzu¬ƒYX5J˨zâââ˜~ä•üØ#‚n|F‹nÜ«Î\ájVâecé+¿¨qpE*±@Ö×Tð¬B§¡Mˆ·›•™À{}û$³ ¿¦šmê÷X1WQ¬lWžOæC#⓲š,˧¨½¦W­ZJwÌ–Ÿ†e‹-Ã䕘Ò7ìh¢¸y–oÏ3bzv£’)k–ÓíÓ±’ñËÜ̃D¨¤ê…“Ðп¹÷Û›ñRŽL±§•H])Ýw‚ÆqÈëDW®uͽ€ˆàDn¾‰]ÙxfÔÅl^˜ü®¼iˆ>–P÷ »Qtð$›I/윫&„tÞ²ªC¼EœœÎ©U‰)x„«d<—ndž¸í*¡7ÕwX™è»d4bƒ¦PÞ33àØSÛaò°/ÔIhnlQ}Y>×’ï|ÄÒ&l9À6´œD›É/EÞ÷Ê“7Ï5«qù‡ ¢óŽ5WßOö¹|nAŠNüoYmhUN¡ %ïR·ézÁcq°Å5ɪÆ6S¢“×S·_Ô¦àhS°ãŒBÖ“hS1ôÒzÞ¯ƒª†çF—¨¼<:¹ß•`»ŒHWz€h·1BuþŽö”ê–)ÙØ”w|XÞ§Þ°ÿfUÿ3 Ú¨K ®ÙG2€*Vë1£¥ç&‰®×dØ´škµû\z`hÍÞ‡dÉÃÛõáÒsjgæ_#4‰KjÒØæ¹R%˜ YG_VôO±§1ÅfÅ*7‡„Vì"‘kÛÅ`…|£Ìc/‘²Ñ!!&~Ù*iËýÔ­*’gÝýŠÍædµŽÉ”£…PÕ…·p mý£nú¿s(¸+ëznbÄ ­}©}>.iy*Ã7JÚ –—&ZD ½ ”ÏxL—½}xõeEßXƦf±ªî!g›—ERu©Ø†“h3ù¥(z˜.4ˆ9¨Ù £®ª+‘b6š>­¶MÝb%JôâÍbò„¶~ieË)´¡äÝz÷IÚo±9Ü”‚+k3K^Ò-Õd!éÆÒbŽÍRí캎Sh#SNdmmÍošx ÚDT_ò´Z·çÚL52Œ}Šì!Ð&iy¢{X‚Ç”Ä.ß|MãN¯6Z6 ,‹ö²N܇½‚½ Þ8LìP *Vr½¥Z0XÉø˸Z¬¤ð¯Oˆ’ÅS8\wlC!0a.É*·wr¶õ‰KÜzCù„Ú|êUÐâäæÁ44´ //Å=“–˜‡•fÕ]^·i—€gŸÕªÅ³ÆàkW-“ç*ÖxVªtÐF¦TçnkËi7_eqø¥ÝDÖµ¢*[ºŒ@›ܬÆ/ÆvxRN(­Xa¼¤%È¡MÅÀ‹ ð­JpO-Ö|)ÓÐfêKQBúÚhš^@FmZ홢æ".‡¢ÿY@x¬vmnᙥý[ŵN­Ä“;˜ñi6" m(y§Ì… Ø{Ù-ÿ 2«ö]·à-ˆ¯½§E7Þ‚èÆ]:îs:h£%s¡M¸ì|zæ*›Øm˜žQ’i³ø@ñž]Æsï¤æD@R2cئ1¥¸¥7½(‹eæ•U%{û >Ïškì1™¾+¹&+ž%X\‚—\[žÏº­«ÿ<{Ç)c×YÒ;îäåïŸ}\6ù[wÓ?]²õ¾b`Â×t±íbnÂö7çաĵzíÜlܬíl¼×Ô•wkT%í9N32Kkž2ÒNG›IKHã‹kB:'+ÁÛÑÚ¡¾+ l´ÉëS£Å¹špÖ4Œ9ۅϽ“šm´ýô” >ÒãfegÇ4øÔÜ?·¨c|v‡=åxˆ…žëÆçÄk¨ 'ÔКÒm(y—h#i»‰é6¥]«zq ]æI"PgZ^*]?èøöhs¦ª³ŸeàZz¼ú+›¡DuÙÉ;…ÇokKYÛè¬hƒ•”ÑA–\§ QŸf±« GQaïì摸µìà®É2‚Ÿˆ•\fËqH-×*™WµÑÁÅÍ}yµèÈvo±¤G‡=½<)Öl©C˜PëO\³o£ÓÞÍÅÊ>Ç ëÔ8 ‹7ÑKÜ\WRàˆ‘[)£ñœ×µëäuš m$­·™l^~©ÛT !ËÒ–îNºO©mrTP¸½˜çP*íºÆa»Šz È GåDñ‰ÛºcuWò5hC™ì:èioÁ Ø+W©§×vâžL9âÌ0 ÚMæ8(¯H¢vR”¼k»Ís.‹“Õ2NÌÌo7·¼Vlß”–³Ší¤M7žm´už×  ¶k ä…dïbØ.Ã6“h³ÄÓF`n=%f¦‘bò´KmˆV¢}„¦Q»eZÇÁâög(þ_-0‹ë#–ü’ aøö¹J¦,5ÆôÈzÆóë/H4ìé˜ØH«ø-•ý°b•‹]Ì 2\Þ±l¶³´û"ψVÐN†nX‘²Â4ª¼ƒ¯r¦™ŸhpúMC­!ó0Í’ºµyŠÆ4C-´Áà±ý‹-ÈYïk“s+@ Måа“…@{¬L,Ü U³£Íd‹¢S×ÂÖÈådüCC*Œx«å§‡í,Lµkã[øB„­¾³ø!¿ëVxSº %ïÜßfíj¦YBiû¨èàcú¢Ôƒ/Iºqˆ;G!t ú<æï`í#9+íBÄd¹j<)K’àBhc‚]Ÿ¤K5hƒ-Þ r fèžqQ5_¿“ê™@-v?²60XvT}–ô¨E»Ë˜¼ø²Î1M—F¥JH^»\à‘&í/ül?ƒkYH¨{% NLY׸vÉ”¼•&.É’žñ⺣L®YA72§˜ ؾz%]c%{öó ,ÛlÝ¢­4†iÊñ1qûc>ÝbÕ¶£´0ãú÷K»Çd]÷LœQ´^`é ³:§†H‚Ç$Ç>(z.ð²³Z5¸œ«ódÉu¸q¸ýs—cµ¸²¤í6’YÕ»\šE˜S<&у¾å~,6››‚{ht›9—íuu°àñMX\û˜ª+2âí¼x“Ê¿péÖ{Ø¿¦¡MÈîè)NƒƒÙ‚øíå ÜÒÏà„å‹bYL—öÊ.ÂåmD2n‹eâŸ}›Î/ФoH 38eø »üèN:=T2xO¨gѤuÄÜùЊi”Ùü€@íqHÏ^a¾d[%ÎøÆÐÆ"¢ÎÝÉ–Í48Å®o§‡BJÞ••XR¿‰ah_ðY-“aWÐA7’3#cöUa/÷ÎÇ–4èÚg•ƒPÕu‘Ϙ·îĈüðgtûünq.6ÆÉ:bWiݶÐUŽû§‰÷”1LRÅJ—ølqµ‚fQ®š®Ûx•ö¬Ý9¸v‡2våbS·u(·‹ "#øÞYç1@Ë̉4vXQyi ñáv,/DFpµtYÛ¼ñ,T¾p.Ü‘·^¡2VulN„‡¥KÑi… BÃ\¼³[’iR‚§sƤí+´AÁ»î›3è$.ah³Æ™Í³Ø€'NŠ¶ezÔH©™C¡ %ïmðR¸fS{[®aó%¥…;.Ù%ï…’,« Gol8‚É-w+óÐMW“ㄉ{+û4[›A÷<± ÑP…‘ŽÜ m÷dJ Oj"B,œW¨ÐF†©s½Wˆ½W°µƒ‹óRi ¦½hÐF¡õæÍóÚŸû\ÕdÙ}\jë#Í6=#—JÇØËD,ÅΚào­ µ…'FÃéÀï$>í>HW]rkIú“ãS}R[¡É™¥ë˜Ù-“Jv(»›]ú¦!>Œ‘l#teh¸*ÄÌý¤UæôFøÈJe*,—~LQ…£Ù78ó»BÅø¤êYoO£FM˜ K̶b¦ÐA*ö5}ý,Ä­Ø”Š#ןõŒ­x¯-ó¶9{ë¡8ràÇD©-»-9µ6e‡åÝÛÒŸ‘%J­òGpæÀ6`ïêmƾÕdÛ¤q–™¶é#ôÖäØzáòd#üEýñ±&ªþËprï÷ü̪wì‘@MüAhóÏÈêË¢µä®L!„8Óa¨ùèPuÎK¶INÀ<åÎ6w†–åØfÓÅì+ï[‘lvc˜P8 kfMrî­4Œ;.4!NÝãmã_ög ôtË•U> E¸”8Ú~ØÜȆnÎÒ‹Á$ 71$E馳“B3éçSãê7Ê|±”fÅئ* µ&}G¨ÊûæqæÀ6à5ÚÆóÉ!¦¶{€‹¹§vµª¬k‘Û`gè©Ü£«áéY:k¿{øqt£îí¼â¶Bêq'^gUæÓ¤çÖzp§m¶B‹Ï†,J«”mãºø„Ú“_ÆaŒšŠ®ïùTKÚ·‰&NvkÎÀ|œ¬W[h¦}‘OŽêj*Œõa6ºÙÏ­Õ8Γ˲m„K`âJ­õÍn?t=<>¡ÜÏœŽ¦Þ‰ffR\¢çÜQEQ_(5^·ÍñöRgíšÜdçÖëK©üÃQœ6° ØSÛŒ¨ȶ"‡ÛwMZ¥®äƒ6Ì?oliÕ‘]ð·מŠŸ \çŠlF’6Ö~6)D>œx‹yˆ¢llj,¯«ª¤¾ÿ®ÜÂì¿<ªÈÍykH°]©$±cZc°V»/Üo^76Ðovþ,Í{qØf5Ó–Ê:öWy«öØ©3FC™gk³ÃÛ&WaJfR[ï;I]ÓT0­¨O”\•¹ÎŽØö–øô_AÉû6žƒDíWÛ7Êc Ûdõ,µ¾×@diË,Êü`°§¶IÆ”ùBª·ÙY‘»Ëp>¶Ùj®$ìݦ}L®ÏÉ<æ+j·¿òr·rj2ÔίÈ{Ý»5¤ÿÃoÜeøufe2ÎØü—ú¤¼ß\*¶[5DÕy\¡° ¯Ó6‰û'¯ÜëÏxH/€mll`ÛØØÀ6¶° €mll`ÛØØÀ6¶° €mll`ÛØÀ6° €ml`Û€ÿ ± €=` *LZÇÿ¼ŠñÖ¿°þÑ8+ endstream endobj 950 0 obj << /Length 270 /Filter /FlateDecode >> stream xÚPËNÃ0¼û+ö˜Htk¯Ÿáˆ€B¹@kNUQcP¥FU’Fƒ„Ê¥—µw5;3;>ÂÝy6”*¬ ð ­A­4XåPU|›b=öû]}ªËYW¼¡Ï¿Å¸oB9¼¸ÉƒU8„z¹‘H(Ê­_²Ï:&¢"–"¹BË-ìZ¶Ùrhâ| eåà<¡ZPÆÅ÷köÆøÛŽ‘“¨'„t‘B'2)5’‰lþÜ ÷Ǹ“/«þ\– Â¢.µ ݆ÓíäðWâÒ©VHæj£ÿãŒ*¦ (k*4XÎ QñäýkŽé¥º©|KâűOµ’/PÚ`E¦}-/Ý~ðFey endstream endobj 941 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 513 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 72249 /Filter /FlateDecode >> stream xÚìxTÅÚLJ*ˆØ{oWÑ{ëûU¯zí~z¥¤‡"M@¢R¤H/i›„i$$$ÔžlËnʦ÷Þ{oÿofölv“l@)”“ç}xg§)¿óÎ;óÎÄ?ñOüÿþaé ÁIu¢ˆrá’\/V‚(g‘ÊƮ؜&QD¹PÉn’ç7+ò[Īe(Ùr¼ŒÌPˆ"Ê…ŠµüÖŪ;~P‹U!ÊP"ÒF‘6¢ˆ´E¤(mÚ ›©Æ;®)†Ï¤rzø ¡!‡»OÓCjoj{¦a.üWù}X¡ÍW_ž~BÓ‘ Ÿ)cÑ­yúüßáü¦î¿Ú|„ì/3 Ïú"U²\ÈÂZ~uÑF׸†}Ih÷!»ñ>¦í„B^¢§XfQ.%mâ§Í*}m›ªsÓe҅Ҷꦮª¦®n ·‹]PYðK‚¬²“Þ¯lìêZÚØÍÆÖŽ7æHÝQ‚žÞœªöÜêöú§7à`±âÉšÈ|1m)‚* ŠÆë]´ÌXãZÊÞó«žT.D4ÂJuÝX`LQãh€lsõdežÛFÐ;¦¼‹´·ßíL9»i™ä_v0¢¸†';÷y ìKôn[iÒIKÙžx1i³¾”tÖSÙUF™éñºlé·PìnBØ^»¶â7µ÷§'h(”V)úî?º½¤µ¾™õ4`ÄÙÀs‹yšs3ÐÓH¾•:ÔÃj}r`„6ÖòÇÕ¦É ?÷¯Î1BÅ«1·!g±L V w;ý­“É´Ô½6“X)‰•âKÅØœPÚÃor~ÝoŒ³¢eN¸ÃÎ ]i’46›tOÔ÷\Ú7©”˜H‰™L€…”˜êJb%b&e=Ÿ†¡!Í bÁïÐ0ë®^Úä M#£Ðg¬äF4µ'óþ}ÉR±¦jÏ$ƒ>–Fó™`vbpÈIÕ¯´Ìåýþ«Å‘•®ûŠAÿKošÈ„&6“ ͤmt ©¾¥Ìµ-(Õw?sž¬ö¾™L„Ò¥¢ o(lmMÏMmÌVéû¥M¥¾™äùíøb-KùIϪôØ"Úúcæ)).ŒÓf†|ÔÜ„aV²Ò†ªÖ³â®™Å!`­»Ã-¯‘o]dë!Àè%¿÷Žž¡1'â–ù±ÂTë§åÀăicøÈ}=-¬‰ôô’Ì& †¿ï¼[ }ñ±ÂÈÉŽJÒZE¦Å“„¢.'%õDVOº;É<>‰£¬é&u­¤²›œi$"múÓ†GùHK›ZŠ•b-¥W’ÁŒÑæŹ²>ŒÏÖ [ž©×?­åwíoDSÅ0mR&Š°lÚž@æ$%4wwÕµ¨*»šÚïœEÛE–Û‚ßTônÏ·ë•ŸT÷v÷Äe7UwC­)£-ûÐÁV²¶¾n{iC/²ò›Š;{ZJkÇÑþ`)ûædWAJqCe£CL-Õ¾¾Yªs´)ËmNª?Ê刺±ói£}ÍHo&QÝÆRº3¥k½£nª2$m„ûñº ÿU53äó°Ì§rKŸ}se±8V bº(EÛ±GÎwë7K®ŸÑ˜¤nNufíÏi³VA¦Æë…f·¡€ Ì`}Œ,L¥Ó3B“òj!:Úl¯$Í•Œ6ñ$»š½é¨2ÝMäìÑ‚ZIU»C{©º•´\¥´éjh?¢ëK´S•u_0m˜6’ ;÷×mÌÕU4 Sžå#Ö¢§iä4éô˜ŽÜ„|Öò7BZ»r i÷˨ëI>‘ÃÚkº2šöí¥Zµ'a¡Oþ(J›-ÈÏ£áó;0ŸNâh šÊ½Špðp&í Ÿm¯¯ibq-åÏkGz¶H› ¤Í‰€ÜÏí³?w`òáó¥MogW€ªîˆº.DÓØD»‡&×`•éÀ³³¤º/„6 ÏoÛ5}ÿüäê[½o$æ!U _Î×hi3bž'¥Íumè\O½5yBqÆÔQ–‰Ó¡´ ?ÉI@5I¯‚µ’Ý\­0Ni9Áß³ôþV’WÈ®+zȾdÞåľ’´_¥´©Ì­ûÐNèK´Sk=OÚ´Iµ´/&Õ§5ôvñ¦¡“YíÛaìÈ]ZB©õyHGš:kÔò›©¢VU:L¤Í•1“êjiÿÌ!û+IövYÿX¡âo9Y]„² b&¿0ÚÐɸ†X*ùÂS™åÞ ò y,ÈŠ•I‚nó½ pÃí™i”_%‰‹Z:Ü"‘ ^ÿ¢$Y§ ÓùüÊtÖuIP I®ÐÍý9mv(ûÓ¦BO› 6œ64JCqLh³£\œI]àLªXá’EûÒ—ÙolHÑÚLnX™§sÁiEç>vU¨*'ßÊãz`ö³œX¨’cG æzr9X0ëÕ^d”6SÖ«ÕÚ\þôÖìU'ª*{›Æ&Ðf&Ó¦îŸ#”ó›ãµu‰å4SJ"GK››ìQ-Ò抴ÛèîO‰m:t(KŸþ`Úp½÷´±V.I¿+öÐ>83öw€|<7k–ôƸðÝÜ®˜ðDÀƒ(ýníæIn¥$8p;1W£Kíƒí6ôzO©«'Ó9"f©X˜…râÚLÊŠÚ©':Ú„ö§ ½Îì!ÂD2´ž´Š´¹xv}H«ÿi\·a}5¡xugxm›Ë·Tà¤o²Ð V ãg±…N=mf&<³*‰ëHrbžP|»@&ÐÆ2¡¾/.QjíÆkíg ¨.$ÒæÏDséñ*L[Ãq¦ê3çœ/$¹…€ÇÁœ¯sžZÀ"~^œA»èÄM™_;fo‘6UÔ*ÉùdgšäÃ^ɾý–ýŸÓZÿ’ñ-yÿGÌTcWH¨’³bÿj3¯À5ÿúží®¹Ïõ_ÀcßÚoùÚq#•ÿ:o¾}V¹­ÄVjÒr¢€lN'1M¤´Ž=Ë’\‚nò›†lÉ&9¤a(ÚhC‚¸fçBRØIÚDÚ\Ú ‚Ϧ´öü–®~™Ú®û6SüôÌrÊz{W–wOgö£¥:Øã—÷ζŒ¯=JÎ V:ÚXË*Zrkþ½5ý ²ô¼·”Y˜EÚ\\ÚlTÕÎ^• ohs•}rãÛ?ô-û*¬bÖnK˜”¹r—ºñ­õ}ïÎ59^Ñe‡°…Ú#µúf+Þmf'ù¥ÖV×ù%Ôú«êè…ùJfá?¸ê w:}XVÒyz€ªÖ?¡–þº?¼¤?»”£–;ïŠùW âß¿ü˜%kgUÃæÚþáþ3æÏÌIæ½Bñ^ð' oV¿®•£š7Ÿý®ÿš”ª–>²¾´JTNëˆgŽ~ÁÔ©ˆ$Õ“cdQ&‘²åQïjâ¢Ñö@²³œÏ®·çe9QHf„’~ë³WÇî¾·ö;øåê[ÍZ13¶nÓ6Um&y”zûeéq¤ ömDývµm’¥×=úÝ9q-½¾à˜¦þ¥…ú] #§m ¯R×ζMáKê2›èº×Vª„5Ê9‰ËW'×¹œ*yð;6;›°«<àxËÚ\úºS—ªÎédÉ=Ú)••ì¥=•»|Ó´í;nc鑈\‘6¢ç‚(¢ç‚("mDi#ŠHQDi#ŠHQDÚˆ"ÒFQ† œíŠ´VôÛu`¥Ô:›p_¶þr–ûÚˆƒoþõ…Y`¥$3ä"mDeè5©Dӯ橦˾;R‡&"Û:aïk ­ãê[®ë茪k¹®¾ulDÔâ/ÎÜKoÖ·ŒëAÏX~=ö×mÄÚµ¤ºþö¢ÚÛ+[G$?ÿ#¶bx5TìO¿>À³O¤("mÐæøä\Õô~´i$ҽǸ“@¬ÔDü½=a1Sñÿ*„ûÌœ¨=ƒøÍ®ó¸vƒ*lSBÌÕÓcn)S­'³ýém”e±H$‹ö®<`CLÓ·&^W™ý1¡šƒyÒ{G¨-´$3#é¨ÿæ—pÊ4:êõdµÄ‹Òæ§ø›Êr>d:Œy⧱ckäc ¦nLwòøž¯ÊJzcü7Ã]£ãl>EÇëc,Rˆ©ÆêôÓªøEdÉ`ì óT,»™'Ú{É¿—FݽÿU´¼7Òœ=ˆÉ©—Ðñ4™šúÅ™»KS°”-Ôo†<Ü›ûý0+Q·E¤^·©Êõë=k¦»0™æ²êTÛyÒ†à˜üƒÒ÷=åo%ÖŽî*ù`˜…ŠÍ,¦f2™¦a´©& vøó#)Â’(ŽŽ®œ±ÅŒý+½ÛÞþ™ßI4¯-uÿm¼U ›ŒX¤nMº&€Â¹9(ïüuyWËdDP‰µz]êCÑAë‰yêOÒñGOnçþVª§<ܘ÷ƒ‘ÍN¥‚ òý1äí–æ(ÁÑæ)“÷CéñÕN‡ÉÛ·«'§ì3@œÌX¨þîÕ7\‘ ›HQ.m,R·¥Œ¸ÌV‘Eû€›Æ™ ¡q­XLÝß½zج3åUŸ çe¾ÏóÕ¥»}/°ü† 3óªL•w=e|ÑÙ*ñÝ£·•¨7_Æ(‘6¢\:ÚèV|¸Ž15Cرo¥b^ÌÓÒ‰9×:Ì5Ä$Y§`ȉY:™®!Ót~ÜfidªF¸6Oa[ˆµ‹ M!ƒùhk]¹-4lƒœ©Î±šêT4ýé©d¡p3£ Uc¦e €+–O¢ÁèOÓÒø*y™cƒö÷XiM³VgOXº-ˆÐè&,em¦f‰C«Cº²ÑèÓ5ÔnÆ3åÙÑLµ;Š§*å M-ÐïJ2j\šÆÔ)‘= ÃÂДi.&©ï½½XµYû öÙ5!®HQ®Ú¨îøjc›/¥Áä>ˆÖ É•7´¶Ü6yYôõ»¦¢÷£L¹‚a¡\[NÔ'Ö wœv°X¦®Ÿ0“âB=#úïQa+‰yÒG‡ßhë%ÉuÄD®eÞŽö/ ïûÌNR›²˜LKÜštOO÷8uéí1)ïrÚ$^³È ×Ï’¤MÇK¿*ï)«¾“}é=a6™s<²à`|XÆäIÞŸ7w Ï-zÒÁuŸC69üqqÉóÁY÷¡í¾És‡Ò+Þ÷þ²£kDRá£=$J9Ë0Áëg)ï´7i)({¨¹{xªÂŠLOšõ$ÍZžöòÂ_dÆQóÞ¬–‘½í7¶ö’pÅ,þ…2éé¢;Ñ~‹ºü¶ö¶›¿ZöÝòÛÏõ=¤¤ü‘Òú»×¸WK›qëw’´BVQê˜Å"mDùËÒÆÃïÀ¸Ÿvtbä‹‹Ø–ûǾ€Ê/¸CbòDÏ×Qõ%™¢Œè ˶F²(ß l¹Ù2¦Þ˜¥¤ZP^Ç0ióè­Œ"f©¾åä‡-Q#~ÞÜð÷ï˜/6™çK‡ê¤¹ò‘Ûß OÏgv˜ëw™¡wâ æ©Ä,åUOÑuÓmfÆ>°ý>ñéàîcbAk ùñ¯¡óÕQÓÒ÷¯Gb–D¬O¤‚0ÚÌ ¯ùæçHVQÑi­ÄbÓ±ËûÕr‘6¢\RÚxž\^Ö=úS¶µž½”]ZI~ôb×ÕT¾v±Æ<<#íëã¯d+¬)(žv0©,ø’Î)LÒ‡yïŒ VG{º_~)ôqg'bîß„[îµH{Ù}JgÁdîì@Œ‹Ù¾>ŠÑ¦ëQìè­„ON½R#ͽª£–;·m·¡´yô:¶_EAæ{ãî´H¼aãÑñöæ¡\>î'[/bžê6ê`Ðí”ðþßw4ç_‚•Ã:Þ¿‹œ´ c´i˜:Ü’ÒF5#zRNÔm€áìô˜[ÎJ›§+ñ|FË¡h3ÂÕwŸÖUüÞËzïbز/ü¾lû³mì›tÆ”ªþ–X*õ Z("šÉ©ðy“VºwqH`¥MÔ9hcv¬dÚÉ}~ô‘C{ˆßŽpA²8ÔÀ´»ãå _-NÖÒæÓ3×SÚŒYúzGn 1×Ööš «YÛ¼EÚˆòÖmÜý<†-qîù|ûªY&) sÖ½—ão˜Ç£ÑlÍ&ÞÐý1e)Œ˜s¸iNî(ËŸÏÓøRܽZ6ÑÎÃ… vÛ¹hx†L×ZGc*é«Y§ÍNå‹o"{ 1e×·®_‹>“Ò.…³6íO›ß¾1 Íµ+m¼mRÇ„…­à6õDɇ µ“O|fÆ<º2”Î’NÄÂiÙ¾žŸd ûZýs´+ò>ô×M;ÚÚ°í:µü¶ÏæåÍ;ýKÆ¡‡Î¤GÎó÷•¿7v¦üœ´ûÓ" º··8Ž™©Þ[r£<üû~ ³Õ\ÛÖòЬÝ{ŸÛ´ÎY¼]N_–² .Ùê¶óùuûßq\Œ¿ÇJŸà˘Â²f¯ý¤ÿô#Kȉ°õ7Ì9Q â°ÇyÒ²hcµª~ÏçC4?ôï­ÎŸì7&Üd¡µt¥÷Ô]ÎÏmØs¼aXtÐNbž23lbcék¯nÜû­ï«jÆ«7“Òù·TjL^ÛàþÚ®54ÊkÂ.ïÊ”HQ.mR朘ôó?KÅü„GŽ;²Þ>ÛgGÌ[Ò¼§¶zm×m½£/î:#ø|¾¦oÊ0)ø…ØœÿŒb×Ê7Ž|’œóÕ‹Da¶b÷ÃÉãóž¶ ^Ìù´–Xg¦R/f¥ÝÒ¦ÿ³ƒOòóá‰?0ÿ¤4ïŸ×Ó:ß;:ó× Í’ÍÙ_Œ2ãÉÎ LÌ{ù+™!ÛªxAšýÊ-sdäÇÝÇ3Ÿòö³Û©¹ÛÝÓêø{ÊÜ¿¯ßow¶ùȼàߢޒæ?y8î›Ççj0}‚ÃWìÈxæLâ§ÌK¸û·uò§?_œôÐîïârž^³ó¤ñ©™EÊßv/:ý· ¸)÷X§ çÛÌs“Èþ“úæ‚]‡…EÓÄo|›7qƒ›ã¶_>¹›U»EÊg^–'³'†'~øô÷2r¹?Y.ÒF”Ëì¹ÀΆR¿íûAsöÇWèG[èL*}„£§g¿“jŒ~úêü?ütÑ=Di3HH’[F7¾3?ù Yæ©’ŒaN^´±VÞ¶y¦{܇ýåÐÕ繧å¢'(ÒF‘6ÆÛrE¿Ä;|q_$:³( ç¯Û\äEÚˆ"ÒF”«WDÚˆr ic!#æ²~op3±¤ª‚Œ]  9 ?ø¾ö8MSƒ;æ—ßà)ŠHQ® ÚXËȉz¢.gxé37ƒìK$nõ¤«‡töð¯³ô²‹Î^[D";øuÿû;’ˆu»ÓÒEš;Iÿ¦Kz£“Xí"mDi£¥Íñ:¢*ëG›F½‰L]¡j •ð&¢,$&üšÞÔÞ7—“jƒ‰B¶ ™Óæ;)KŠÞ™—Âþk«X†iñ,ÀÔxÝ>[»Cÿk¡s0§ékï˜Híhz<Ë΄ß4•éu0€Þ™&Õcn¢ Éï›È†LÐH¾b)%ÓùCÑ_§K¹o‚´Öº;†Y÷%hÖ—¯lP¾ToÔFŒ7¨p]ñèé÷ÏRB‘6¢üÅh£ ô߈&’P4°Ï[)m¼’ôãWK›¹2ý`I‘göÿ¸”)N±õ,äV#RU'ih#-=$¿ž‚ŽÇ”fÒÙIJÛIW7±×°á™’TAÊIN;ii%sùGšv”2 ª¬•%•\ʧxR’ØKä%¤´‘¤6“övòÌH‚4î| ©é"õm¤µ‡äÕéø ƒØæjR]NÒšIRAqÉ&åM$«•Ô6³\hôUy¤M›u/‰)`Åž™Hª©R×Î’mn%ßó:IkÑåÛEv¥°ˆ¿æöRÓFÚzIZ ‹H+ǧ†=By;)¨`Uºƒùmµ„"mDù3Ó¦ª…œ©$á:é¼`ÚЛ¦Jö_7õ@µ¡ª‡Ä0Ž U‰ÌcJ½VtY6™Ì†0冹Œ,É ÙL‹Hì&yÕL‘ ÁN¶“¼b23%¾VÅîÐŒ(íSX¬øNRP+$.ï!Òtã ¦t’Ó¹B¾ên›Õ‰ë*XâóiÊñ$¬™Ô5ñ¬¤d=Û—Hz@6ª¹yJIš@v&’ý$£’L‘26n- NÉdN Ë׌çûc&ñËbø=PF\Ò™ªc¢ Ý ëd¶ŠåµDÁRû­˜]oKdQÎ^B‘6¢üyiSÒH|Šˆ¯NÚ/€6aeäd9 «$åݤ¢– í„bŸ•PÚT÷’üÑf| ùç'.‡ªI{3ËTcQUÇLb%4–¤r"›{;Rõ €©7 ÒYÜYºGHm%9Ä\J¤]ä˜t‚s°•äIP›ï!]¾‡kHsc?ƒ6¥M7/9MùH I,c©QݯdšÌãéÂã:f“‚”CVfñg/%[5ìIiøY JÊ*"É`O­­= %9XLbª‰¬†U²‡š,Ê ½=Dûõ^:Ská´1=W EÚˆ"Τèñ+ Þ…Ä«€ìNì+s‰ð!ð†ŽÍ|²`–ÈnF—“ST*Ø¿!ÅÜýSI¼KØD†þê•ÁT‘är8] Íš<ÒÚAf±9ÎL] Õ-$,Ÿ)”6!m<8m'hÂó2È7¸x mÚ«˜RA+‡ŽtU©@›JYÉ”–0]ôåÄ>XLB*Hq+ØFKÐ\I|J…|¤3˜äv“´J²^C–%±zد&K³IO§nƒ¢ŒÔrÚ˜%£„"mDich·Ñ‡”‘)ñL¦rݦ6¦ ö*·W ¹Ìà{äèÌâG%÷’‘ÙÝÄ<Ž$u“èîÜ-'»+Ic™“Ìòš­³åuïLA· íO›Á ÒéI+Èn]¾3íÍc´©’6³8 ¾Óx¿ç`ù>‘Ì×ΥľŠ´6°|—êò]˜Ëò5S³ˆ‹¸ÙÙŠk/”6 RIo¯Îò¬bê¥ g)!OÊR.ÒF‘6CÒf€Ý¦64ëý¤µ½ëM# §2Èâ,60·¦’Õr¨–4Ö²e&J›ÖV²MCÖeðAÊ=4KºH|Y•B$%LøϹÓfp‚J^UÌ–Kó]—Fª@Ž§´Ûœ…6tÔçvÔ2²6…lâ¨M*r¸–TÔ“_5dM*Qt„|¦´Ð|·¤’5PGêkÈT3òøg‘Õ©$¾‘dt“¤|2Oɬd~Ù¬xi­ìšÒ†æk´„ Ä[s©•‘6¢\BÚx—“…ú•\k¾˜b«ÖÓæp9‘;64XR+qN4 †Ô´’9g§Œ$·_u‡ØÐÿþšM4M¤ ‰Ø¥Ú˪,’ÚDJè䨈ë|&å•JNÕââ%ì$¤Ð('E­$¶œh2¦( i$ž©ÂœKRCâs$¨ÍwC»IóÝ2Ð[ü—"’UÂŒäĽ”œ,h£hãú/’W))h!éu\á“ IÉka Ì–®Öd“4šo39¥ËwQ*Él&ÙuäGù1=Î*WÅ*<§,1€oæ•3¸„ô¦¬•œNi#Šè¹p©DK›Cš?ó—yÏ*¾ÅdWƬøTëÇ!ÛŽ¬-&ÛÕ"mDis i“ÒKüþ¢´¡ÚÂ÷]72NdîÐ{ùäÂ.JÑn#ŠH›KY쿲˕µ\Ø¡muE<¦HQ®jÚˆ"ÒF”¿m̤—ÙwÒš{6 õ«•Lçñ$ŠHQþÌ´±M/ñ¿ŒV9Y”FÐ9¤+Њ‚æþÀá;u *„ÃØݪÉöä +¿a‚F—Òä$º™­ß‰´E” ¡MߊkStÇZ¿é):fªÿL7P?L¹ûóÔxý§Hõš’‰ÎUj:OF´Öå5]ÆÔsÝ2´Öz¡Ž6Ú òŒ6MBvSããÆì Ò^Ûđ¬²5‘íÔÕºŠk35•C›ÒÓ:q&h­ó.Ÿbàâ=EÎ ¹ßƹ¹Î0kíÒù4]iûªE[~sÝ+¹þ‰ CŠ´å¯O9ù5íÉ_ÌJ’›H{'©ï&u­d‰’ØW’îF#|Ÿ[DÛ½¦µß¦v1\Ì”³·TûÉ\F¼ªÙÎØò6–æ±l6„I~!óžN/$ÓdDÖÂ\„*;ˆ¼J Í"ï'CÚt6˜ÒÐÉ= ÉÜDRÖÅr/h$5¤«—”·÷t’ ’PAJ›HailáàF+AFÜËØ™<í¤$ª‚³ädg1s™¬ig‹DÑEŒ2þ¹MdµÒøªY*ˆ¢”황ê"¹uäP=I®g‰‡óÝAßiHmih'­½¤ªÌâ[‚rGøª’TÂ.+¯E7‘6¢\ZÚøiȲ a³¥Ç¾ZRSÈa*%~õ¤¬œLá>Ë›øX[BÐÅÎ(¦p§MG/;2b…’½ÁKA¶%p/ÅnæFM2_ÃRž£ ÛëØÅ~6à6:ÄZˆ9?ûÅ›£ƒÝœ©$¿$›Iq?kZ˜™Ì«ˆ†\WÆTZBs))ë&»’Ù¯©Ý$§Š)$ô:¢ƒdñpãÀ2î'>CEÎð}Ô} ZÉÈÉ*²)‘l:÷/XFƒ%r‡îxãS-Z‡Š.æÎÔ?¾gæD?1•Åš-'ñmäx+ à^Êv /Mgõ3›—aO5÷hi#ÊÕA›c¹ì]¿6AØÒr&Øe1±-fãb†”œl ²b60íJIaûÖd‹ŠíIëi 'ZˆDCÌ“ˆ,¥Ä­œÖ “2k~ôÄ:%£Mw-KŽÙSõDVÂÈÉr:ô:Îj·iÌÈóSXa,ddc9é¨åkÇ2æln›Â°“ÖC‚3…)á¦BÒÐb|zB9 é$¥õdo6YÀ=¯iø¾Ù/x“ˆ*YÅÔ³ dvãÆPvZ‡ Ý$Xë1ÁÂXÊŸÑš_ÏU]¥¬ZŽ’µIl†Åç)d§|XòÇ·æÞâ"mD¹h“ØÅüŒj{u{þùù-)Õ$ºJ˜*2GÎŽÚ™i"d‹B¡yùdC% K'‹òIjÙ\F2K7<+Iv`å iv‚Ø©mø‘¤tØÆ4²)Œv¸-I?—•¸I˜Äiic9mz‰ÎmaC>ilÒb&'®E$±‘Ñ@ZŠї `#½YJ6hÈÉì\ˆÊßE›€T=mòS¼¬t´¡Î ‘5¤®‡tµ1Ò¶„T4.3”Loi#ÊÕ2“Jå3©^²˜Ÿ&—rƒ¤ Œq`?=z¡I,ä‡q´qå˜*t¶€"<ä¿R|äËÊöYb+±!ÿ”ëhãŠ=9¬ð†ó~2)±i¬Ç^RÚH¸ÇáÙCø. hJ»»i˜€ÅÙèªfb™Œ¶Z¼ä‡É!¬ÎßqÁuPÌ:Œ{\1ú(Ђ}€žF¼á‡ƒP ì e´¡¹5xÞù¡ƒv-w–˦|âe„6Mø4¯…²Nøú~¦Ïп·üE^ º–g·[O›Ûù㈎@C›ïxÿæ;È~=–Çâ_á Z-¹¡nCëð‡K`·á´É¢ìÝ ²K-‡6‹ªž6ð®nDi¬BñRëu˳›Ž HÖ`Ò!üíٸΉµ ý›ŠI~8HߌIB:ª‘áY?¬+D8mìXÏ߉ŽBä±;oJÑÙ‚•§ð¢×Ùh3Þ“écÏó¹ùŨÊÇK‡ðnûõ™½¬?tò¢}ºx`±ûéf'ö_§Z÷Ÿn¬üË3á+ÇS´§vãßxþ0T@P$û©° E­ø2·¹ÀDÆZ¼pŸF¢®…Ñf˜3í;0 aO4']èØOž€OÂL ž‰juÆ'ö_¸b8ƒ7: =å ®wÄø}Ü‑ŽXÓˆSì×B:ÌùLê-mv!¶K‚„ˆ/G ª^`È×û„AR3L o– ÊCÎ< „”6bvд3©†£¸ŠÿÊi3×SSve8/ÄÒ¦9ÂMzôº\cw`wH0>É©ˆéÆõ6¸É=-íîNò9öE{FÙã9)ò2XÍÐ1þªFº£·6­x’÷™V`‚³P‡ÏÒj­ˆt›Ÿ@mÞî,T…{)4ñš|Vâ&?F²×Œ ’»aâÅFú]n¬G9ã1Šß*Æ›}yH;Amhée´y#´û2Zr­†þ=n×ãPÓ0´*ÈëÿTõà3þ¢Ô¶ò;žÈn8—Ã&‚eôsBY:ãð~h÷Ìöd?•÷bU!~ aQNuã˽ìm)TÅø–àH Z±)˜—ÄáÝXvD2kêmFò¶~nÏ××îí"´õ¥¤¥EYºB:€¶sFñ×úX§~ä©PTw#³ aÅÈéÆéHc´±¡è§nB”G‚ÐÕÌ®YS: ¢jÂŒ¡&à†vÄÖcÁѳÑæ…} ›‹üä~Zý#Á¨©`#ö3ma„_-ø'f¥cû)¬ÈÇ"/¼‰ŒLAÃëß6¼¸)xƶÅøõ‹õ}œÆÃÁ(ÌƱð Å0Žh!/“dëì¥ÃxÕQÚô«C å!;Ÿ«Q–«¯mªòì; ßNì×M‘ƆòqÑGö²ëì@];“ÚvÝ+²?m®Ñ¾,\Øõ½ºs-æ\$[‡QÚdku›Ý‚ì<ß™T“¯Êêñ=Ÿ¢ŽvÅr)–I±<Ãì ì6öø) A*NfRŸHÑL3icnuþ3Øm$ø<Íùº.!A°Õ—‘“™Uu#…pt'?ñkliÅéc´Ù|Àä ñÉ´6 é£úwÒÆþÜ´yÃM Íª"È hcYEØßôTœ‚ÍÊÇŽ8Ü„÷öbrΨ±±óùDZ _º±YÞMNXY³CH ú6/ÉßO!£_gcµ7ÆìGo-¾*€k°~X}ªFy¶;U“´´¹·_n(†Z…·äh-Ò×6­Ò]‡`ׂP!µ;"ûÓÆÇélÔ[?[a"ù}´á¯Ñ¿¹^šð‹m·yR¢Û•ª³eqƒ£ìIÁðA´ TáÁ£è¦zÈ]µì`?Y¡³€ÓÏžêáÞÃèmÑÓ¦©‡Ñf~²ä3Á,£MÑ9h³à8r GÙm+³b÷%b+Ì£+öï«\ÆÙòHBΰ_Û»ðt8ÒÓYxf—ÎØ8j?W–$Œ6ŸûöC:U2ó:öô<ÝÆž=æ]ÞØžËÞ§£ì¯DÚØpbhÅ£¸æö1¼2ït`c™bÓÒ‡Ù/ôaúLßz°;7rKB\ˆäêî+á(ãýGK•L a|V`±î8€÷°_©Šu7ž¤‚)*Úþ3,U9¨í`‹˜#½ÙòVM/†ñÐ}gšÀ4–afá‰Òš°´=Ç=Z|7n°cóeÚ»²zñÄ^ëo¾¸Î·goɱü‘?’²Nu½P‡Ó}Ëyr;–„b¸{–Gxmæ ¸G‚×5è©Ä¿®¿ÝÆ_¦ ª\P˜o ÀêÓ,ß<ð¤v¾yÚ¸±IÙ‡?môv›!V~Ó†µ ˜Õ—ea-)ì¿¢œ›Ýxo9PIÕV™×ðWÀSN¬’oògÙQÚ\˧l·i‡í^تد†´¹é ž°tÅÈ0ÜâËÛщµrCßH±Å÷JLò^mÆ!¿Mú*jèEhÞ=ȇ7#² Nð7c6r „!óE::«XCÚ¨e¶>m·/Šò1ö|4ÂÖjæw9âWÜï~Ù–«ÓFÑ–ÝUÊ°Ÿ. Š¯”hëjÛ>RxjZ'­-Èi…Y” Ûì,振è×1š¥4 ‹öU®ÎY±>ÇD›ûpW8S×ÿ…3©ï£EŠ úÑƹ ázÚ|Lå#´ÙЌԸ~´¡/‹6´Šf cUBù„åñ“¨ëA^-3£iŠøÒÌA ZdT£©ïfá¸T¾8˜Æ—*QYËì6ÌboEé¬_ijY0ÇX¾›EŠª¡l jÑ–a„6lMÊo*YK”àZu¢´ž‚ eU¸®¯B8 ƒ¢ôÑ®cw´ëVKó¹áÅI0¸Å6¡±©´xu¸•?oY'¾òr¿;=hjEc–ÊPUÈnÆÐÔ:‘TÃFèîS,Êû‰œ®vWm$ú)¶ 6ºû6ü¿¶ƒöÔ팟ý¢kQ†vüÂF?‘w0ˆØ×j}÷w2j ÒN¸¯ \·yÒUWò¾túJec,AG]iû®mûgm˜Žá0±1x:mŽ}ÁxâÌLÇœÃ÷óɸ]ÿ:´é7¸úÕ6Õ±¸y‡ß¹*ÿÕ‹RŸˆƒ.Šn/¥`4î+¶cÿk{].Ú–#{‰íu˜•f7ÄVL›AÚõ;¨hø8¶úõe#5lkÐÊS3}WÙmÐ¥múwr;ƒðvH” \ÀÕ׶a:vC£/$7ܳ4  £8öobÚ0:úÊ^WB]¦†…·¹‚fRé£Í•°Í‰kP3ü0ÞÖ”Vÿ‘RÑ—#Ÿ™>â΢Ç4ÃéÌ•·wë*ô\àåD¼u¾“ñ{áTŽ3)Wâ6<‘6çA›æ.ƒ-s—[®;ˆ¨ztuãtúWe%xô²ZYtÛè˹ˆ)Òæb½}Ú/ÅÙ”"mÎo;·äJzqH. H’ ‹.ÒFìœ"mD}ÀE¹šiíjf2$Õ#³¶Ò?¨ö;`Š‡þ8·y¾V $Ó|k°+î¼öWÛþÞB~¬À‰¤ó}¹8àx%>=ôG¢Û_¶…€ËFü˜ ›˜Aµd×ßÈÿ‡rqG{3Æ\k´×ÿ‘ãú» –7ã>§Afc`ѵ½ÌÍqçqä^ õɯÅ!>í"$edMÊ È.À{‡ñÌ!8—±À]ÿ@Ùf¤ ZóË&a[J:‘‘‡ñ|÷V°…›gÿÐÆ3;xwà1ûßá¨ë€ÿ&#ù¼½ò%xÆ·¸üîè<À„¿´æ<˜6öؘ /ùÀ%ë |±_x¹T7ü¡w ß3ö¢ d?¶[ãÜL§ ý{hmlØÆ×Û9Kï BIÙù÷®‹Ò÷žFwÍÅ¡Íïr*—œn³·Yº¥d>„Wg`a¨„i/]‚A3Ùáƒ/sFÛ ´‰HÆËá8SG…Þ÷Ÿ§q¤G2ñ «‘¢z´¡$£_¾³1ç¨ðßåɈ(…[¢n߈>ù¸kV§"ª–A¬< ³ÙyæÄC'áϼO©x {±;‹¥°5VØÖÕGë,¸„õ¯+{,×àkÌOBL)~ ã¥rÆ©"¶9êH1îu$ ¯zÀ±ïb sC|1®ã5ðC"ÂJà®a>éO÷œf.-•ðWó]ŽØ“Óø6à/ÄŸ!h³?ïF³>³3Ž¿%“ØnÉ”rì‚[!w›ª`Ûö,UX ¢K¹_¶ÃÙh3Î ny8–ç\ôy½~EÈ`­#ÜtÁæt„ÃF©_³¾í| Ù¶·kúhã€ñ^Ø—ƒ“øÂOh‘q8­ÆG1ˆ6ê1Íis6gàT1÷‡²…m>Û“#+Ç·¡H¯GK;Žå°w7í6#á’‡ˆ"|ppˆ§p8)«0~žÀ˜pÍEx~ g‰?|„oÕ㦞gâq"Wðéž,…c˜±4µ´©f»©³¸£$:î ÀÁ<ÏÃ;^mçǪ%¬sCt•o‹¢q²«Â œÊíñï(„Ã7MçsÒlÜÀŽ8§ö>€6Z²¸ }Úÿn1øça,Ô ½N(ç’|”ã½ , dod„§´inÃÎ(¼ y/Nòýc¦Yh-Ç[‡ñá–Åd·~ùj7Î=él,_ äÝ8®Æ+˜¡bû‡ñ›(nÀ{þÌgœ¾"§x žàŸz3_ÈÇ"˜+åÖ(¼uˆõà×p¼ûR¾ñÉVO“Tì>10_÷2´·ãÛ@Ø!hÓÛ†ƒ ¼¿Fä¤ÇeÐÈÁÛÇÙ¡ßñƒS®åîçß„`r ÒºðÛqrª ­õxvãXT5 ´Y\Œê¼€Ï¢X”Ç\ùnÆ^ÍÇ{Gν¾Ö66.hÜœŒ/(ßëÁ6Y wf§ÑÅQYÏ«Zۻ̢1AÂh“V,tƒGcÐ[ͮۀû… H«rpHÙo3Û7–ïµÆZáÁ“@³~F\ ˜¸ ´Yê/ðÖ­»"„íÙrF=r†9*j9ðAzûΦãû^ž5œIÙª%š`)BÕBôœDmƒ°‡ù;! ¥Í”\ÊÚN»‘̶ ^Üçýn^K4ü0vîÁsüÜ€ ¹ðT°`’&øž¶Þ ;Ä^¯#ÿÊ´‰NöRNV ¦˜ÝÏéÅgÚ™ßI{ß>½&òl¡Âï<‚ŽŽ! Ìió¢£~_ôÉ}ûYyF:sO®*v-ÞÛƒá.l¤lkÆ+{¹›}G» 9“êé·ñïBLæûÌ”W ›äïvc7G9ãõ44¦³gº±"PhÇuõŒ6#øØa+ÔóÁ*l>%œgò¬ä|ì6#ù³ÜállFæÀ˜¢ÊJÄW2ڌᢠ}ïž!ì6Zu®–q ìpÈJ~Ø#ïägãz/|ƒyÑ09Î<×h¾7[%üHŠÚý–ã ø ´ùÀShn—bØG¤M{µÎ7§ñÑú Õ(fî?«Ý†Ò¦Lw§¢[ç¥>qO?ÚhQ¿= œëøŽM“D®U!¶œU΋û hcÏ^ñmºz¨jãNi»L¨ÆçcP]z6Úª„7{¡·ël´ì6¼¹”0ìtô.ÚÓ²¹È/Ùݵ›y¸¶ T§ÇŽ äÚÂ.æÓ¢‹[ͽ‡Ñ_ƒø±g£`·q@z ¦ûŸ6OîmE)ÒŒî±Ñ”aº§ö(CG;dPÖs/uüŸaQ¸ÑÍŸ+ÇOs…§yˆÅÝLJ¨FŽV”Ñù‡îaë:9‚0Ìau¨kbÇÓ%µ¢9‡…¤jÞÿ¹÷s*ãÁ©6.ª§)•‚_̵¶çe%vb³ç~ŠÇ}GØá`OžæŽE;ùÓ¹èh#a“”‡] –ŒÒƉ¹ü\kgàkƒ'ƒá™‰ý™Ø¥dêûà~ù>ˆû`r4:*ô>Ñôärø÷ѦRˆ²ª ¹æ£Zª¹›6ÎqÂ#{ç8Y?Á}fyw±ëll@¼nöͧ8mv2Gþùî[„ѦÃ/mž×Ñf{%"ㆦMßÙ­Eè.¼<Ñy©ßˆªj¼–[>ñn:Ï m2´kiÃ_øÈÅ ¢¸—Ć&i¯Þ¥£=‡ÝÏLuNåÓ¸Sù5îŒ6,J_t;A·m{žkR÷s»ÊׇùáŸv˜àÅŽÎX/F ¹R(ÒT zéLJë·ØÅý±4Û7œÑÆ…Ýø>HXž‹É.U<Á§óçma‡;¼ÙPýù?(†s'w¸›îzhÚüOOGÜÆ:Û8rBŸ²Ùèis½;;úl€Ý†Î¤*‹…)’uòŠ† £XgØ^‹µ|Zw“—p2ø ?>÷%N›õ¹P2ÆÎÌâμܙåŽ,|BOx‘ÿrv±†Ÿ  T³›ÙÖNÖ×ä!®MíìË´rÞtù+àœ6i?çqˆìZZ‡ò4Ôãf66K{P]‹’vl9Žêd•±~¨jd㮬嬫°³D\ÙÉÌ´-’™ýË\ÌfRÃù¶™,`îa#´yXG›œ6˜ú³ÇQv¡» ÙAm̼J˜€/ÉAN5;ˆ ¾×6RúNï÷dæДJæzóÁÎ+~v„GWQx}úðIß­C7G¿ø\Òž>©&@ ÙÑ ¢¯È#ÌìG'þ¸ŸgçÛƒÑÚ‹ºfæ)¿BŽ ¾uçú#ìÈ‚‚Zf>­®áÎìHG_Ñ®¸ö³¶Nµvºû}ÿµ3ˆb;(M‡³í™1’¯D—mÿT†.½ö%tÐå+”‚AFvC¸sÚìˆèEÒ?ÇîƶÆjI¢sã•è¢Ûræý ¯€¶‹cÇä¾:×¹-SÚø+µ‘ÑM»]í]vƺ«aëØ í^mpDÀ'Xzÿñƒ´ r.±}€çìùöý{‘aU x ÇA×çLpÀñ ¶otØë²³3¨@C§r‰A=úÈ‹ž ç-}´‘ˆµñ?ñ\°×ÑƠ¯Ù3PÆì¹ëw¶ˆ¬á&Çó‹ÞGƒG³ÇÈÓ]Hg»è Š~RÿKÚì+öp‘6ÿ;Ú¬ÎÅ!Ã]ÇNlšÓÓ_zµ'þlÕ2˜6ü´·†.>Í9ïMÑ7A‘6—ÅEW¬‡ÿ™W¦dЙTCÉŸÝ×û¢?ן§¢DÚˆ"ú€‹r9}Àm05²j$Ub[ìy9/ŸÇi„¶ƒ€Ì7£¦×!£i\Øu=Ì=.6ºØŸ¨¡EñkvžÀ¤pD¤sy¶ÿ]³ ÷B˜ùÓêT"mD9/ðìväáÓ`¼|nlílÒôÅÞÛŽ'íÿX_W÷÷Ô9ï÷Æóþø‡/Žwád<»¦r›óE’ÁJ0òÝù^Öן üÓÑØ·?$x[ƒm§Gí^‡ïCDÚˆré6NÍì'úÅY[¬ËÂ݇¨p´Ž ¸ÆN¸ãœÉ¼nH±<˜q_lë4¶|Yˆï<…±¼!Áy˜"¸ÌÐD>óeN‹Ç °,œåõv";_Z„u‡ 7;è„ßs>Òþ¹ÜEKëÎé‹Èö%”3¸Ö>8”ôCøÍ3Ì[| nqî¬Ïƒ©Ÿ#ª3B‹mNãfgà‰`¸çÀ'ÏpG˜‰Ç°/E7vGP1žEa'2*áÁŸè ßemËhST€Ç±½:Žü|‰G¢øñUpŽbqÃ2Ù·Ìhy¤`¤;üóh!¶Ä +³mìðK,DÚˆò§ÖüÙÁ>à| Ax¢RðV æ$ Ÿ®Ð~Ô¦ _ÁĶçÇÔ·s#ù7‡pÏæÉÕ ü†·ŽBÞïH6š\JPÛŒ™!øÛ!öGÛ£¸É›y.Ì ÂÃ{ÏJþßT`™0ü)ÆI);‰þÉÅß}0MÊw@qZÎÊCC Þd~¬lož+ÿ¨PÌýú¥ÿZ£Í+þì;/ï)¦×}r†•ü¶¬@sœÃw*;Ù×¥ÇìG\$±x‚ÏéÞŠƒ,Cø®YG+óº}/‘Æc´;Âë±WÊCòiAé˜èߊÑV§höµ©Ì^,ñïG›uù°i#Ê_›6gñ—à­¿³Î S n?q`'·¬Ò}ÄǾÎ1lxöããݺ EIºýoÜï`<¥MŽ$û0?ID?¤xw¨Ë iC§W‘ Ãù–¤ìn¼s@ Í?tq©š4ÝM çµö²½åØÞï;à}ví!Ák†ÌïÁ{„(ß$@‘ÿúäͼŸ˜_a‘Pìà:ü*lvÚVŽµÜÝ^øB4'óM§…Mò¾ÕX§ý85§Ícö‚ëYW»ò«"¤rã˜@Ç?ç®?‘6¢œ—øg#KlïDóç:_ì€nøíÿÁ>{ì.ÀÞ¸~´9A• 6”43)j>GèR Û(aؾ/Gn>K³6“BaÎdÒAýædC݆Jø¡I>:XN›1º­ª'×áûË¥-Bîí€ZmÜ!NO¶½¼J¥¾ u•Âìïëþ 8Ýç¹õ´ágnÜn§ûfk¡P]cøWž‡¢Í5Ü~?ûµöéÞÍG¾Ò€6¢ÝF”«ÄnãÄ»þ¾Øwû³3‚^Œ@W•Þ;ð:mžà´qïDÀïÚ‚åYhc™‚ùðσIдÙÖ€ƒÇ°¼ µCžÓæzm€Þ¹oˆï/Ÿ…6ö OHú;Éò=Z%@dv‡Ômn:ŠÎRa²©·SÚ5N›ÑFi£i#ÊÕ¸&õ÷ÅþÄû€Ûãæ(ìŦ0 óæGÁC“}wÏ´¡ºÇs|>+g³­ãÒèXzšÛmŒÑ†çÏ÷áH2€6üãªtZWß‹‡µî{œ6 |ù¨çóµ'…¯l÷¹¬ZÆs—UÊwŒsî÷ÈcqWz,¦›Ã„ë·Ná}oV¤Y9HJeÏÕ <äÂîÕaÿñ‚tþ1nÉ´ñ©ÆöSÂ÷ˆ'mh ¯si#ÊU±ßæ? ¨éÒ}¼;Â\| GG¢JÙE!Jaˆ•tàK_6¶…pg‡Û™¡Ãƒ1<°ží£Ž¯búÃœöëÞR~@þo øìcG=Ë.FaÜJìÕ _Ã]ë(ì@[ßí}˜ÕÚ£ ü+e0äÇAu7òªQÖƒæÜÀ]z©æc{¬ÿ<Ñ…ùï7㡽Ìý¶  Õ ÈlCW pÀCÜXû¥€‰rvjÊhGÌà«„m×:ô†Å´ieNÄf,dJ–€A-mîõg>éÚ'}¯Å|&ÕÀ¿iþÿì|ÅõÇ‘{à ئÓ»Co¦w0¦CB %@ ¡Bò'[ÒÝ©÷Þ‹Õ%[’mY’Õ-ɲzï½×ßßܬv÷Š\0ÂÜç}ô9íÍΖÛùÞ›7¯°õt]‚ _mÔ¤vf±Ø&å§M¼òìÍb±M"L foÓ¥Oô–±ÕGÑkìHùÓùmŒ´™’ëÛ™-¨™l´µT[\Ýfz½ö Õ‘àù>Øj¥.Ìm§êÜÞ,èØÎì¦Ùq»ñ•éø¿A!¿Úü„eŽnË¡yŠâg¤íÿÄ—b¯6¬°´"hóß—: ²…åœWÓÿ+´qøyŠm„üïÑÆ`=®V|¡‚6Bm„Ú´9$môø¨ï&þ`ÊÃÌ™ xx 4þ?OV f7V& °yíÈmGN;½‘$¬˜N8¼‡6æMK'®ñ1½¨“CÕˆü6¼-ô"A!? Ú¨ñŽ¹åÁ€•Áì¶Þ^ PX­¡Í¨ËÃ܉›"ðv%&ZqUý»‘yþ”)ô—HmÎ|®L¡2‚Wã²0*ðä—$€#h#ä¿A6§Á§Ÿìân6m¾ÙÛRPwS”uá2áWosyµkiûóYx8ïïÇ»qôïý©ð¬€S.rU—ßØGý¼L‹/‹ýÚ‚áø”©G«Å`•6ÓI˜ï,ÄX­&¥sðI€õ«¶ÇGˆÍæOÛ‰©^¥j˜A!?m>mBm-ÇÖF´×$ÚÔÀn/6'Q)pÛhj6„œR܃×óɳn©ìÝ×:ˆ/váj_<\‚Öz<ƒ§YÉàÓ]X SÀ3›B¤ƒ:Pt€¼s_ËG[® åu?5¯I }:ö´Ñã±ÔÖsÿœwšPš#tA!?.m <*s±¬‡¼¿üo]ê‘XÀƒ*BU}z†/­¬¨\p'‹\¨auë˜F´mq»¸+ÝrÊ–Ã~HM)þÈžƒ;Ã×íDC»¼¨´ÍLŽJ·‘˜·¯¤qyu–9™êoîäáÜ1†öV+ñSBm„ü´Yè…©)%W•©Ýf:¬É€ûö.jzQÜEÑC7ûð8)½K}‘ßOm‹q+ møºS#¨îCMªúXÝv-mìÍD”´)¨÷A.Ò¬ð$g<”ˆ'ñt"æê°%ýí8Á‰¾œÚ‘S(tA!?6mæ{n3oÚÒ«³LcEà•FGý­Py³7§«\>›;ç;ã9‹}µÞoÁþ=,°z:ÂZ¯ÐFšIuŒ S%#ý”!ð±}ènÒÀÄ{é)G8“Ò#¤ñõHoÄ|[dõåx`爇AÐFÈk·±q¢¨Æ{}+Üxз9mûPˆ¥qÆt‹ß䣥>,Âj>ÿŠÃÇ¡XžD{-Ñó(ò÷Y-Ýkw¢©S¡Úª–ía!˸ŗgu8ý{¡Ë÷°ÛØÁeÁé¼Ã³ãYIzñ0Úù‘­Ä¬K¢¬Âõ=¤½|—ÀRš7ªB¶³QSKV—ÊQ u£°»2©ÚusÎu"+±{†Ü2‡òNìk¡RÚ=ÃXÄ,<_דíww3UôöcÕÊN 'z”´³VŒº“10Á-Çccø»6ýÎ]E˜¬ÓЦø,`¦q±:#“èÓ‹©1<á%fR‚6Bþ+à9–Y§Š‰Ö+cŸk½lZ1¨Šnë´‘Ú:U›éöÚÎ ÚºáÖÝ~¦-9>Ò™j/‡¦‡Þz‡Bm„ˆÈ!‚6Bm„ÚÚ´"h#DÐFˆ _¶•xE \*°§Û+q‹ïŒW;ëVV^ÉFrâkðzÜáÕÂVK4h­Ç.ÈkÁbaÔ´ò¿²~m-4ÿ&7D`ËNr¿ù³µ²#5`™?:§PP‰g°%Ù#hïbÙöÿÜÂ(²@Sà„_'Iµn!‚6B~ÚºM ð¿²<½1ÏEqš…Þø,Žûq+kpÑnÔN"­ š¤ˆÑ#~» äµo¶Æ½³øqhü)nðîNLtØ’çRü'+Œ»LÓÆ€s¢¡Ë#'·,Ðó>ÿ” —Rü6š/¦ŸÇì#× „Úùïé6ïµ£·Wù©ª$0YI:ÏŸRðd*Õì~-˨ʿvàR­wÜ|–%xµ%eÊÃqpk–C ØÖŽ†z<‡?æÓ¾ë\ÚœB^‚׺sßæ¥:âÕ °5ƒBŸrÆÈ2cœŸ€Ýe‚6‚6B~Vv= 0ºîÆ•ã©î¼ç9—d^áeåvLÑV8†ß˜¦>ÝX1ÜÎÂy•“vù#:ÄuXäMÆóä:/Ùƒøl;Ž %ÚÌqGç$6û³dÚ¤§3ÚHGÜI7{khã<ŒØíÚÚâÂt,h#äç¦ÛÌr¦ýTݦ˜Ç< õÇ È(á‘P¶„Чcx)Àl\‡ß–bb g¹ó~Nô£¤›Xø$–°N3óŽ=f»Ó›.¼qÛž溤 ]½“æeóu m.È¢ò¸³Yc¼’@of;a¹«ÀŽ Ÿ“•xQzXðj6]Ä&£jáŽÊI  e½» ív=ö˜Gj02¥n¿Â§¶6`\RNÈ4´uŸa]JQáÉu&Få•,|zMÊïÕ ²’Tp+±qýôirÿO[®Ëz#ºSˆ Ÿ’w·¸êT‘ÚÓé,zë-?~J?3w¢n¬Wņ봻˜oQ·VbA!"rAˆ !‚6Bm„Ú´"h#Dˆ cA›ïê©6AbÉöJÜåÏ-±×$"IÞžXÇBœëÌW”Þ*FB½FâËÉf»Â ušíåVl¹Z|«ÇG¥Cé@±Õø< çºùÒ¶|•ƒ¤£XÙWeAð¬D|-^TÇyÙ⎄×Á6{Æ.[ܳuØš%7³Ö¡¥C/ €{Ýœ—·s ¹¡·™ye/öFt²¬wåŒ÷ó‘T‡ßEÆ-2àŒ(ÄTZˆ¢hÔ|M;j1ËK|¯ýúöVX7Å Ú9rÚd‰™¸9?“NëÔŸ&гô@z:q{ m o±€¦ëÜé#§N—áx<,ËCÛiŒÉqlVm$Új8ùlòÉYáÄ;Ü_Š»bðH"þšËŠRåaa>ìÁÁÜbéˆ\šÀ\±%ý€!Žú× ¡ÆB߀ž+ƒKOL®©§fÎÍè¨%àXîÐÒ‰K-ŸOÂÃIè\è(…øu˜vG°;×Y¹FWt€Š\<˜ˆ`kô¡î‰ØèÙ4`x/Yùš¶Ä‘ŠLMbK‚êëÛný[´rT´qŒT–¡oκÉïE¢MS“&ú7ýhbž6’÷Xx†%ÚŒYtæõ¾Li£t¨Çl/ïY©ÎÚ¬ À‡¹ø*—±Ñ«3P<Žý•0dòåògwckž‹å9ØŸ(ÀŸ#øy®I'_Ý:ÙxÂŽ¸%œyþ0ßçá™XÃT/£çÏ r³MáÔ§å0Çïæ`[~Ó®oÉÃ{‘¼å‰©ä©h¤Í£Ax|7¾ÉÃm´åž,ÔL!ó ¾båuûÑ9|—-a\Û|¶y¹oÀB/\,WÈZä‹ò°5†«h©ÃÿµQE Œð{K>‰çÚ©ô›r•‹é×'Ñfr‚âSÄLJÈA¬Icϧ­ÚQº—Ã!>•š&€Î:mìP8©­÷=…ÓôÖiÃFÊSŨjÂ"³Zᣘ§Ã¹‰ädø—øý^Jȳ٠'‡"a){q{(í^„à±$¤ôcO¡â)m,lèÄNV˜æŒ½´„ýñÆü:ŽgÌXÍ|ž?Û‹¿°Ì?§:c}&«(Žìx&V™I™wxœí¢Ë“)È@T¶ìY$·´mÇîLF›~” Á6 ¯°Kx1§‡A:``n Â/êçÓÝxf'ê¦ðI,ÝF÷|ƒMqx'7rnØ°0ÕÏwã騚À¿øö‹’0Ø‚ã¼Úüú ¢÷Úù/ÓÆ>”9ñÚ"º‘‘Oϧq&uÛvÜKó¬7òè©>Ó…ÃÁäµ»˜ÓFšIIªø#²Ül©JÝÖuö$_¿Ý bæûÚaçÞ‰âñéW¦£¹vq†{Û·hd0´çÚË{®–´³³ÝQÊñx%:Û°¯ïìÅ®>ÔVS‡v }/?—òñ 6× £Y Ô,£ÓÖ “èp—R'³±aЪ؂šYËô2î¦(Ñ&$cð•"äUÓÆíSø‚sæ¸âÚw¶#•Sï/£Ë‘pÚܯB|”O)8Þa·QjÀ[^S€!ã¹±9×–øÉ´Q»e²™ÔûÉÊ×´9†>2ΤU}}÷[· Ú9*Ú¨_ûëXrNf·áä¬^Œ `©œØJ‚C\šªäîVžÍF¢¤r¨ÍŒA»µŽÊ:¥ÔÌ´¹}7;U.ÄZ‘FncJºHª0:HûNÓƶƒT¯\út?ããî²%y+#ŽïEÙ~v•,W†Ì"éu“#Ýj†Õ–HÛ7cÚË&'ËJòU¤¼5  yãò^¬å\lïAe ŸI½Éw¹3ÝÔrš6ÒQ¼š ÝhÃ`5í?®T]?3ÃF5Ò‘ª NMPË–1 ÕүƷMø:‘Ž2ׇÑÆÞCÀÞåkŠa4‰6Ò™«¿¾ a·rŒic¢šÉõLJ"e¸rShsv{$õ¡qP‘æ~¬y&eÇ~ìÍ£5šÖA;]]t’ À=ÎÚ’¾*Ýæ³ä¦kahÀ©~Xæ(|g:ôñŽ8u7Ð%«%ö(^öBÄÂTáÒ„KºGJ³Riâãm¹Ã'«™>³Ÿ‘tRûu~X>ÝÒ‘Z.7m^‹â÷óL4ÖkhóNz«Ãu¸¶ã5Ô§s' ©¼ŸÕA˜eËy¬á-¯ÌgUDÙL0¿“`{ —ø/!w¡vñK̤„üì6ÓÏ’ÆncÀE™,–‡CÒY3×+V‘ïc%V:tÄÃÙƒ¹ÌÞŠ•Ø¾]¬"0;îY¡Ø䧡ÍÉidÞá)F]ðJ F¤fÉ»°å¤ùLŸ‘æW±ÐõùA,‹ -ž«D}=¿¢Ø)¸EQ³qàr7Ú¸€Õ%_½Ír‡Ÿ¶b¯|b¶õ˜ê"Ö9coßxj<µ\¨§™Tv.¯àùE ‹53)¯QÇríéÅh5Û’ƒæÞÏýyèì¢O]‡Ï7¦tc¼‘gú·ÃæS×¹ÎXä$ì6Bþ›´Ùk…6îEs“F©@ôÙn3îQôÈ28† ô89˜òN–« [‡Š6C]?eŸ^Ò î2ç™v·ñEÈ°³«‹Îä'™6‘|òåÞN¼’æÃ@03Õ.õ§i‚ôj§1õ¬/w÷²•}i"½ iÌîÊŽ¥ÝkÇ18Š¹ìl*¢ ¬Ùw;¬wLJàÎZôMá× ,á¹˜í£´”¦{:”ŽÀüµÅ'³Õá˜$Õ¬ƒm<{†K6¥SšâÔ}J¨Ô hàK9AYJ°’´eŠI[5_1ß‹f¹eØ>ž ù› ~V“£x%ŠŽù¾88B-Í­ß—°Zoúò£ß˜^mÑÛ‡sk7žÈà}VË£^‡7KiË?-U+~¡Íufhbàs24`|ç +[3ã-º =S¨¨Q|–‡¡z”_xr!÷¢ü}زzûq¹ o¹.Mò-ÚS¢”ÀÐ7ЖGÝ”½Wί±¶'8 ÚùáicÀSù¨¬ã¿qî}ðŽ×ªvL¾%_×ååÈŒc–ª«Þ1HCü,ëCéò|”Õ®ÉYò@ð¤þ_êv¾V:Ο¥Iß&Îx&lð>éO[æxÑxZï‚ ™ä!LѶ¸fs¶£œÔgeh7%ƒ#zFP8×Ø*ö2æR»Á™öº51Yt2‡á½‡G„%À3Þ¼Õ‚à}H>UÓÆŽkYÏ棪Úm¦X¥Àe*£n’" ®´~‹ÎHCw'Þ+ÆJ¹Cæ?ðš1äÄ•BËoñÅÂ(ÚHgn‹;÷b¼—Nr+]q»™Ò^ÀìvíÉh6»ñs[L~TUЯW£$Æ0|A!GDf9á…x^%¿O¦2‰÷dÚ3¢04Loþ=‚ÉRÍ°Êþªñ%–Z¶—¸ðµÔkó”E…$Ú,÷ÅK©šc=Ï÷’Ňõ mf»àÆ0ùQg—»Â&Q#ëZRË•A16…«Ý1Ï'É'p\9%ÚØb¾–ØãÄ@3ÿC{Ø·áóíg´Ñãþ\””Ë>rv<¢ê²p,sæ*ÁåØÎ²è¬ ¤ö;Õ´1à¹: …ºµF e…ÃxD«< ÿä­ àÅæÖá ŸCÓæªBÔp/»=ƒØäK.vmN ƒ{©æXÎyɉõ­x;’"¿$Ú,õ†«öya–ø,áâEùgÅ¿Þ»ZdTcjžÛ¤Òm²/§/DGÏÀn‚6B~ð™”4÷¹N<\æÇêÊ,XA-ÒÆø«JIùÜØÜÇö3)«´Ñc=›ÜÈ•u)Ho•l˜XÎêÙÙ+»ŸI-oqSFýkyˆ®CEÞˆ±N&q¾+ä4m†14ÈÍÎ/WP„Ô,y÷9î(ŶTM;MfRòöh#A¦×8åqâ•I[fœIY¥'2Ô<&»FKŠ¥Ó^\ÏIÄkÞ¼Ù\o„× ¯!…Xà`™6%R{…6RWWyÚ9fº#.ÂE*¡ôvfOÊ?‹'©Êvm6Šgüðt ¼“idi#Íe.ÑëB?…¦´Ñ㺫KTCU¯Zž/ÈCéÊj¹ÑYUjjz‹Y-.s°DtðJÇz¬÷Fò>Æjg|Òƒœ<%ÜrXÉÔ›%¾’n…ãMÇûQÐfžnø47åaw>Ý"#mf;›Þ¢‹ý•³5¥¶Ó<ñvÕÑÝàP‰ôz\äEg{ƒƒª,[™JîÃ×ñ RÔ´‰B•{8\à"h#ä˜ÑfžÊ{pP%-]˜½ Î]0ìäüš tvXrk·FV&a¤ õc¸Äi¢çÇ£®Ws¬Š&+3).I&ëîÕ2÷ ¾¸ÜK9ivöK[z~Ù„çÙ)-ß8¿ÊÊKð¬—%ÚèØÂN£‡nÂÀÚ KÅ]Ù¨­“/–Ù«—2=M¼û[ Š)mä5m$5IRÛšÝÍLÜ:NiÒZ£½EM˜cq&%i5¬ºè*½êÐN8Õ‹}Y(›ÿÚa©ʺd9va×nË´¹§ íü£9lZº@'h#ä_?#žäsÝ°†)êO²ÊÍ»ðÎöCÛmŒŒêždùô2m¬§I9Þ +Ýñe#Òr±Ø K]¸Br­ m7ÊBG¬Ie}©ü·®ÃÌk´NÜàªi¹€Í¿ Âr7ü©œXdc‡9Îôé9áD›¬¥‰+ ŸI9`.Ë›÷b0Vz`ç8ªŠèvôãËD,“²Ì•ZJý,wÇà«pÚ¸ˆ¥½(Ÿ¥p»D­…nXåÁÄ]Céî岬¡ö m¬Ý¢EìŸ/@y uHÐI÷¸ÏS¹ðÅN´ä$Ýõ'‚p¼;ÒÇ™ÍÕ3iÖ¶=“NàôŠyeï‘vYàBÇý­/½Ÿ/]¸&¦p§ýÛ2¯bfŒ™´r¬üm 8- …}äw±IžR½ß‰ê| mvMàÍ mºøoë×x+”«ñ=À™Ö‡RJF&0<Ž¡q O ûÖÆexX%Ÿ²$rk#‘Ó‹ñ øçò¥¢3¢M[þ“tuòúi±;á –±ó¹%£¬ñ(cS *ÚàeÙÊ!Ö"çÖT~ 5cš£äWÑbY”%±gùj?ˆþ*bȯs16N×Åe„i)n›d´‘t°JèvÊýõVÝ,íëÙÉË·¨¦•|‡&µîÄr„.DÞÚú𒚎p®ÃÐJÚp‹7Ÿ`As7^õâ :âZÑÙ‡Cž)h#äú#pØZıùûÃ<Ð âpa݇s=óµæf„?d˜üs‹Žèn~¾ '%DÄI ´"h#DÐFˆA!?&m¶YHÎO‘Ñz³j[Sç ñÅæ1Î&ÔUð¸ºñVK¡ÓfQŠšm‹Ñë[/–ù0MX&âßY!²›ñüM"ÙíµÛÍ/s«iä»ÅC˜È[¼9æ‘ûÆ«øÎBþHˆÊ¼BŽ9mìÑ<…†Í :eï÷ S<å2úxŒðײCË\oäõòÎ{,˜^ϊƾn%T<©³dߘl¶åDu bæß’_3£•R^¾ÛÅò(ðgŸöÓ߃mX÷ýï‹Õ:Ç™£ì¦tòE¹ÈÝòÑ­j­V?7®€O¿Úzñ„qõ‡¡[¦Í±(Î4Ð~²8°¥M&·ÈÑ´¥k¶Ù9Ð9eÚìdÑfÑßWFÄÞ~¼k5‘¬ £¡ÿjAb*²5ºGî0’‡á${ÔDŽÀiûÝt¥Åß›½è î‡;«›9׌®hEÏYFîI<Èq®%²˜ì柦MaÏ> SDž(@ÿ2+­ÓÆy“x/‘‚¦ïpÑ*3¬‡w£ò€¼©oA}u=DýÛm'ÿ Te ÊX>Û™ú¹<™Ps‰«¥Ÿ~¦¹m.Ãp•Æ}—Gwªh3Çžë'Ï•Pð½gÛ—Úis éU•&œ(”à·A´ñÁ|TTÊ+GÆs`gxŠžw»ÄŸ•· ”èåodº·ïðlêyíàzà ÓÂR·;»ñVŒ| ­¦žŠ‚6BŽ˜6,‹ÄX7n,Eu¶â‚ûl ÷áo}Œ6rª§á Omk„¿¤ÉøÒF›­r¢'6¦lX2„u.¬ˆ@2Mû\y„J´y2Ž<Üxà!KƒàRˆ}Ìcöêx<•¬‘µ®´};…ÎiÚ°*]òS¸7Ž‚®O0ííD'|Úˆú2ÖØ®]Ha9NEÞzG)(à¯q¼ÅS;á¬zs'GÁßÚP}@Œzæg臦i£ÇÝ»Èyp c£x6DI‘±\võ91™•Ï“isÇô°ô4¡¦ŒìGà^ÉE¡3•‡x/JÅCYSý¼i…ÜOò®,ú»J²>®nÌj‰6ïøZÐ!§i³&œz¸Ý[ÐFÈ÷Õm¤ßÁ3qÍTÉ´YÊê}‡Oû9mæzÊ5˜Ø“ö›ƒh)ÆêLµâíRV™e /Eó1~K«ÍeÙ´ŒqâCèí¢t+K\±! %ãô7K§¢WP‡F-hó¡fRR?²¤_Ý=éý,pÇûø`‘~‰{±Þ‹]°Ô{úP\a}MŠ£Nwä&šë\øä(t7:c¹7˳çjj¹?‹®t™<„¿@÷¶xšÒæÂ4™gÀñ^ØÏÒ•¯räTYç†%.$›s˜mÙÅ2m8@ŠÙrg愈ÚJ¼ŠM²Žw< Ú°û98E E—¨z[èÄió÷ ÍQè@ÓVb=^Ù¦f­F$h#ä{ÐæšRí 8ƒÉ'},Ã’ü€=žƒ® äÔ«òëñ—T!£óÆ gŒNáÕòôí;Q>„©I5ãî`…$;'ñ˜7ŸþH“ŽÕlP<”‰¬ ë´ñ ô‰)LLÒ_éõ¬°–/yøß· Øœ"¬½c5:Âk‘rAðl µr­æ«*š>´wãR7®9LªÇ²ïW££“ë-KéòçÈ·è¡4V©Ðá7y¤f²?n •)‰*ÒÍ™`25ôJùNji#¼D›âaÞrZ¶x eü´ßoÇhƒÙZ¢ÍÜPÓÞ$‰`Ū`á@ í‘Ò7c¸65ŠíYGA!GïKœ "NJˆ £n Üp®?;Š¨L!Bm„Úù y÷ñXi“Ha½¸WBm„c݆->«¦¶”Öû%q¯„Ú9ƴɹUäæ*Å[“ÆñœŸ¥g!Bm„|?ÚÜåNî.×xr_zN{Ä)»ÄM"h#ä˜Ñf³'.Ï¢ è9zm ¸( ‰ÇIˆ cJI“ÉÂ'±Ú™”!‚6BŽ9m <5ÖZ A!?0m ø¼9¹ˆ–ió t‘"h#äG ͧ*&IÃ!Úè±9›ÅM"h#äØÐ&xØS‰Â;·L{ø#h‡¸iBm„#_bëÔ7§á#áæ'DÐFÈ1ÒmfxœVxb–°Û´òCÓFˆA!‚6Bm„üÒhckV:üX<ÆÔ­I™ì£¶ú¤ƒ\ s†Âå[UUË펅€^>uM=‹ÅÓ – £Û›•P´òK£=‚º¸÷˜úäèðv1¦0ÊâkÛñ+«çùàí3Ý­¼‚Õîƒ °ooô4«ã)ýÛ©*‡Ý5Çìï7Ìa_Ë{+®Ç"cWN–ko¦Ô'}Ž•nùHíZ鎸.Þ2~¿RøOÐFÈÏ’6¬¦¯þl¹v*¥B'o·U’ž}ßÉ¿þ¶rÑj‹N÷c;cP¹wd=X*׿þm!2¥>”­J›Òáâd•Ëµ.—Vä`Z=¶#5›†ù0ð% Ð8ÎM:îôÓòŠ x݃×ï>);‡P^¡¤X7ÚÖ(]êSv=U€ž^U|kºÊ©ÍÖN¤äò²˜Òáž`…ÿÖ‚Ø"H7à]_e÷ÌDdq(w¶É?KA!G¾>Ûaž $&Ñcÿû µðºó/”¡«™©ôº5ú©äAtæ2¤xµÃkŽc•PîeŦgéÌ:d ÿ?.§¥}˰Ƴœp÷v*ì8-÷Dшþc J*TóƒœéË€?3òLMá`#ÎpÅIñôïø$j[­èz\¹gºó÷›sQVCšÆ½q ¾Jñ\¸ÚhŠ+é©Öö>ôæ’Tcl ݽ¸Ev·^ä‡Ì~:™¾\ãe:3Úk|øûÕ‰TóEº«½À…ò‰ý©©%ôf}}”©¦›b±Â™ÃóŸUÉ´ò3Ömr]WNZ€‡è}Ø ¾ŠÇÒ`*icËiÓ\Ê-Çðl=ÿ†&Ò©êŠôŠÉf8Zèðü=@Žû–ö½3aû0ß)¬:í´ì­Ã\æa¨nÀƒÑØà#: ˜åŠ>~ôwªPXDïŸÈÁîòÃ³í°³ú›¶¼¬—Ä?œíjÊ(SÚ%Ý^|êj7º´õqT¨—íDèx;„•ãL¤‹ V‡gð0<ãøÍ<ʼno¼3}µ²ÊgÐÒF-Îhžô3)!?OÚhÔKCî\_œæƒÓ¼áÑÏ49BsQýøs·3H¯åÊÔ߶#i75NV éL{«®Œ£ÏDRÙ_¥ÔÊcüþ~”ô`ˆU5z$ˆœZìŽ+Ãñh"Þ¬ÀdÑæÙ<ì­8Œ.ŽìBR±¦XÉb/ª¥û‡`¹˜/+ÿDo,Ñ&z>Ix¬ Ã58Ñ‹.í$o2ïÜ댥>¬¦Z3ȽéTçà€jPÓÊÞ»Òu­”?ºbÆ›f¤ «'ž;—Ý?¥°5A!GH›EÞ‡Æ.uýˆÉà£ïŸuì’G“\øžÑæÝFTæÐxWÓf©ÝL® Äž.ôOÐØÜÀ ¿'yjäd­c³žúߘF½-1`i(Â>‹æ_Òäîpic Cñþ „fkÖ¤V±r½d-a‡{õ 7ÃFXžIÕ ã0ü­ScT­Øxiõø“NÄ䘶è«l|­¶çňÇp Z9é6¬“u›‡rÑ:ý‘9m ˜ãŽŽ)|•$Ö¤„ü¼i3׆3OJlÀlùÍ¥;1Ö‚Ë‘YÈÇ‹ôºÇO÷N„¦™ê6FÚXìp–#fË#ñöL´ôb®'ÇÐ7ª†1ÛOîÅݾ*UÁ™z¾ÂîCؽƒý¹2L˜ÓÆJ¸zé>ÕÐ`‰Uî>ÃQkÁ¶çv* mXŸóšÎtÁûyÉ]åÒŒt`õ¤ØÆS¼YÑL{YØÆÈQÄej×<‰|¸ôU ‚r•«0¥3Õ ~"ð§Œ/h#äÈí6SÈÊÅ,ö¾r /„[ú€Û]I1tã´íÀ\ùù¿Ç_e·QW•5ï0 ¯@Q7?’º+cG·Êhwµ7lÈ’ü÷JŒ2Íá•Vôdë×È’NŽÙpžÌAegÂ9,˜ÖÞ»­>{î˜Ø0N;pŸ;ëz£™•ø¯~ìSGܶ›l;_Dqô ϳ:Åë" YóÙ%Ò3©ýU¬>ø<½¦·ÍÙ8X¯œÃ,v¸Ê!ÝÄr!ï«™žc<©÷üäÓ#¹n×^‚° ùùFe:âïe~¢GðX0ý"{·Á?‹âsc™9ÔÅYžÈgž*ïnç¿ËÎ-pÚÅ­ÄËì¬tÈ #Ïæbh’ÔžðBØÌ8÷¹4ûØ%h#äèümYý™é6§9Z¯å}øU¿ ‡~Œ]mܬhõò@xGšun8*Ž{ZlÙ(£Þ¿½Ýÿh½QA!GAnÜAf™€Dųnu0ÊFÑÞ:Ó ÈYÌQÿU9èõ"¾n’Xj–ñÏ€õ‘¨¥O»{±IÞå¤(³E®¾^\åe!¤ñ–Tðn‡ðùù|ô´‚C\*Ý•l5ù ?œ°毶¶ïµš³4·ø³3ô¡Þ&»tøk‹V´"hcÀûQÞHU]Üãùx?1Ãç…¨mTP“ßhš‡Q<ϼÔ.ŒÇäW!¼{”(G‚ËnMÀÁùIä”"ukÃ,ÏùÑÆ›³PV¦í_kwQƒ§Ã¹rrA4E$}Ï—Ô¥÷m“¸Tµ0ä=‚šI¼ì«ä´¹2u,>‹…`[H×`§ŠàÖi(¡‰v·Çêñ^4»F›y¶fAîV†dË´G±­ _:mÎÞNƒËc@¡Íê Ì·Ç»QרxÔÛM ¿H\:ü§_Å"j‚ÑÆvƒN–ý“ýi<ÎwÀm@=K ±h•ÉÃüërÁ) ˜0FFØ©¸¤ò¡>Òl\à%3Aà_Eؾ¯ Ïa>ÌqŒ6òÚñ-¹Ìë˜ öuLóÑEG±N/¦"¿BA³Ê•ä3_U0}h ‰Åä¼q?ý76œ<çEÛoOF?óùs×9=7E*rs$NgKÃ0ÙIZÎîÉ,½ a·ÑÐƸå-m΋’§ŽbØ úñFÚèP¼é­„Jq¹N Ž!Ôë¥(9 L‚'à‰ÇQš Ï:–5«§»jŽ¾œ…Ÿ7í1¨Ó†:ꉗ„0§b“ ÒÑPŒØI«´™ïŽGÌœË1ÙÌ4ŸïÐOöø«$ä4ru(nžÛ©‡ðn¼ÍŽÎt›à½Ô`¾?ä,þPŒ•´âÕêÿ‰$0º`KÜÿÖŠž ˆ6ZsJ×$.v§ÁÈic€¤Ålv•iãDjÉ*g¥«¿”!m¿B›ÿ ":ïvÓ°=‘¨{èÖaÖDÈ)Ø–ìiÜq,ÐqÚ¬Þ†4àj \îh6–%$Úü1’kGO䢪š‡/óÀåax Ÿ´£!Ÿ¶DwãﱊÝæ#]èý:½Uû°ç^ðkRBmŽŠ6|ÕÇ$,vÅB$Oâõ@ŠD(ÞóUt›)`©£²Ëïö£²L¡MàŠß´` R™š W©RÍ, `Ñöª•)[µP¦ÍilºWZƒ…¾˜¡fGL›!<ÂisW&úYãëÒHcùtî‰Á'¨·D›ù*ÚœªÇW¬pÓÈ'–YbêÎ\#h#äG ›g+12Áer ãSpIÅ»­HËæmVl'#ó•§ýII,gj„^nÀi)™h#“AR^.vÖœR6š¡ ð1¥7Ùœ7íÃÎTj3m Ö¼$ÝæíhþÑó…(©¤Æ™€.ŒïbÛhÚHºÍ?z”{B2‰Ï’qÞNTV)SÑÿ5ÇHA!G•iL"!Ñ&Ž‡i©r»D›%{Þu;ðÛPmÀŽj&µ:”ôµ,¢ªø”c^‹×b¸f’0]ÔÛ³%èêc*#¥ý|¥Çüªh4]ó2f¡I)`ÆU=®I@ß$[ºÒ+´‘vùw/z¥~FÚ°È ïîÒªjŒ6ÀbÖaÞ$¾c‰RG°c3,Ç » h OƒºÊv·¤ÛXˆfÒá³*ØËY2æ¹á¯{„ÝFÈ/]·iÑú¥$gà³jÍ–¡AflFs¾v¼Øb'ð’ì<³.eƒÂK2”^nªe^9Á‘JG³´ <NZ/mŒ-ä‘Ñ&Ïó|Wü»œ¬@Ò+³z) ^§3ŒœƒÁ^¾¯¤.½æ§Ðæ¶| ™Ófm¤Æ4=“z8qÌ‚ä–ÁO{'Š†)¡Ä¿R`ãFYÓ£’±8œ¦‡ lM X ¢Íií6öÒ¥c£|!ËŒöd±&%ä®Ûèµb°´ÑAþÈÌô¡™éèͶÌŽeR­·þ£oÐv«]Q2=Šµþåöû†Ìt›!<lé´Mn…ùuK«v!uŸãB·"ì6¿™åŒ‹ÍŠ¹H´Ùüc@@š6^æ/h#DÐæ—WxC$V»ŠÀvA!‚6Bm„üïÒÆöX'¢üIU¯ž®…'DÐFÈ—6:”Œàèc7³Ð¡~ omÿÉLUÜX!'x m„ü—hc Öf¡‘™}x)J^y‘7*+>ÓÓvòrŒ¶øµ^þT](\gißÃæ?„^Á­3;ŠúÐ:Í24of °beãVèÌú±RÂôÓéóWI×ÉGÑi(h#DÐÆl|UÊGÈÇ>(9FÚèq^4ªÆhl à¡`^IAz]‹bVóúÓxlÞ‹úaLŽâvcÌ‚>>ÀC§ãö3ÿ%ÉyMR–‚È}åö¨Âä>`ù(ÖáªP•„á7ÍÀ·qÂW,f³¡ëcÈ?ÙFOÄplàŽ@nYl kü|.ߘ[Õ¬`Ê<¤³Ü8;Kñf1 ËT´a+šÈZ:±·ã-ðá·9¬»I|™Êžõ¸& m,\«½7úÒ–û ÐU ¿& L ª+ý‘ÞEn9î{~À´r¤´q$×ß÷BèyÙvJDæÀv¿™qV†Ñˆ[Ä~¸¥±Y]È~»ƒ¨ÁG±ôþŽ½h4¦•H@i+ŽO,mÌêË‘¬Î/ðm"ýôÏóeÁÝöøK :TÒ‰—¢5jÒ­™èîá– ‡è¡·÷"5'ÒIEsÉ»" £ƒüÐjà}±Ýͤ+Âèè©EÝ&i!©ÜN%íñl°F‡¹d†ûùQš&ðLŽcq[9Ó–‹v°=¶¸i/&ÆÙqíÑ>Á«\Iï)æËEÐFˆ æ™ÇÊvÏ3FPÚ¡`/Eâö\ŒÖ+E!«€?xqÚl’ëçNÊaM§&¼Êä"7œ„Û£)lª¥Æš6+S!6äOÑzå=¯~×d´±C+p³ßøà^T±ÀqÄ$È;2ÿÞ%:4·xðëúª[Cg Ë:× «ÜI¾i@h–t.cÝ.ÿËfFÏ× £Xqtìf)z$Ú4Ë•øâÇá²täOáa_A!‚6šf‘7+Í‘xv?ÑæÅTÔ„lûEpÚ\æÆ-6Ò|áL¶×‰64ä/K&-èß{ð`%jh6£Í<-mæ:c±‹Fæ:j†|ðw?ùÁNzé GK]d¥b¤Ž"Mz¾ V®‹’Q8QÄÁe.üºÞ,×ÒÆhÓ?Æ¥w™ùª¹ž3ÿ¤qHþO23•T~ùÀgD›†:~αãø4”Ó&w [üm„Úhu–òn¬ÛmnÈÆT“b mÞô9mì¸FÈGé=mNÖá«~ !WDbK‚&ªÑsŒ¤cçyk×m¤“¹Ý‡·y4 ÕL·Ñ #eºä%+Üy<›Ý*ë6ßõhiÃ2ðœàl¥8ÿ7 whÀ\‰„Nx²}eŠ Zš+=â*h#h#äÈì6=€³±\±G¶Û¸ÐOÿs´ñ¼xf£ÐŠ6¶0Œ`W}tBr»YL·²ú­ê6–«CêðVî÷g)Ð÷¢»ÚƒcÜnãщ¢NÂÀ>ž•ŽÇø(Û¨ƒ¾¥ÌnÓ‰°,zsF¬»Íî dåñ¥½ƒøk ½£ò'F1‹-·õNà1±=©ÙÝYLѲ´´rdkR <ͱ¿JDz?þÄŒ ¼ØE³k±B®m-½®pç´‘^ëYë’ØгÇBOì&Mi[kéml2ò†ðJ”Ú¬µf·±£,|¶rRÍOÙšTVNN`´a™?ap =x.BÑLÎAõ0¦FᶇM Yeí¶&¥KÇJ‘ZȽRŽIÿø ¤Ö׶óÕí½€K¿-Wï Ùä(^Šà$<Þ½t;Ë°È‘ñ0 =üv_†qÚž´"hcÑßf:äY¯§Ö›Å;«]kÔ-¬„NiÜ´ƒ²ËRoÜÎû¼½½%fçf°rìß ¡,¹ž†¿m/¼“ÌmÞÏ!CÚ-n™áæÚ´ùY<Ìl=¤ÛÊTjÕaï~O.%1¶ÏCPMØ‹o_ÐFˆ Õçy‰7î‹Ç#ñØàqäÚ‚gasŒÁJgñÕ Ú´"h#ä—b%æÅ»§«Isƒƒ^uõ±tß»IEËéÃÙrÿ^ »Û‹ÕË' Su¥“û7˜ÝgƒÙùo›±à¦Îl/;K?¬HoéiÍòîÕ!÷´rTºM±ºXv?¾Úƒy3ŽÁ¥¡¸ØóÆé¢ U¹1“)¹ÍQwGü³‚w–P¬Tµ{5¬ˆ%Úp‰§éiRBc/>Mû'à€·÷ó®öV`‘ŸÕ¶Z`õ·Dy´êpw:mû"@ußñM oùQ’…J:Òْ߯ܩŽüÒ–û#w34_Ë–û_•«íüzÏêšov¥¬ AÁ}Ú܉ž jÞ/æ{yfY?– #§M`Â~à¶b¹zÑÖ¨„-˜F‚ëð—¼¢Œn^TW½ädg–@˜©kbY‰ºoø¿'%R…Ó@rƒêwÖ`ýw\w+ÐÜÈB™ì©¢ea«2¼›RSy»ïðF¥ª°Üáà#~±'‘§ÍÁrÕº’½…rçüͪÃÜ“…‘^~-î}è8@m>laUA·’ÏRð¨7õöj ò«É?ùïþÊeþµ‘ú;Z©ožñ1½F Ÿ§_ÓZF›•ÛiñýÛbmqv{Óâé5ÃÔ›±ÆyqÀ öŠê‡Çt±N9„¿x-Œ\ºƒäbKi×塯“+l™xÀ_ÐFȱ¤c¤j4ÙARþÎ\PΉB5û‘ëéÇõÞ´åÆrök<…}YÔøÍýT;IzÙîæÏê|æ·ÌÑÂÃy^ó™‘«;m:ð§Rö#:†«¼X[AiÌyec¬Ugo™6×&àJ¹ð¯v£«-š{bƒ›¼æNÔl;SÚü3PµÅžŠ’?ÄŠÔbO±³¿’{¾sÆXTûw»0[‹Ð cpwo¶<žk{ªz•oðú~ì*c-£häîVÓƞ¸nöá-ŸÏGv¥)ÐÎb§isJ(™g·Go¡¼£ÿh‚]<"åâìß |‡ì4ÎÊåÌc‡–¾ÒÍþ8_:¡v¥8{7p³¥Ko®v““iØÍ” ^ÐFÈ÷¥ÿ©F\!ù¿I¿Î÷ºÒÏÜñ 6ìYMÄË!ôæýT”sí"y¡ÌÕ–žI–¯I9Òü b-ôxÏau©Œö#m2~Ó€ð1¸Ä(ÿžìƒ A(ÀWI¦ÆSÚèÕ çTR0$Ò<éKãkm-K'³*J®E¾•Üß±2ô Ð÷#Žk ½§;ñ·d` AÑ5´q oí ÎrÀW:†šµZŠ,Ó´1¶4)Î~q î Ý“"™›¥ª8»ô«ñ–\ÇXœ}™í»%'»àåR”ªŠ³OÀ7’¾>©ÙUq”{Dz÷V¬ ’6¼_Žœþžè…«Â±i;={ ا»ñz8ÁƒÀË¡XêJrK*šºf4æX¤Ífw £q=ÇþiÃFÙ§u¨hÒœp'Ú‡QÑÎT”™ic€sb3pã>L6ÓX“®e¡+êXÔ?û±;YÑF,X0Ø üîzûÙ{~¾Zþèâ4LµZ¡3 ߘ¾3)LÍ8RÚhíÉ-ØèqdÅÙ)šCÖ‹¾ÄöÌv!ŵ¨€1Ö‘bÍ^·ÊXA!ß—6:¸4" ‡t›ZPJ‡ß&á±3ÚèHóS•£mí:ĆÚLWæ 9rÚ£“†PT®­~+FlB؈ÖÏHvõà_‰x®„¦Kêêºÿ Fì<"U%ƒ…pêAW«ÒFÑgÊË]™è®·B=MÐΕ[nÚ¾¦ïA>kƒS"Õ‘‘noÂ^ò£6ÅÀ_}5ºº8ûóÅ(/St›À%Œë6§È'ö·:äYùZm„|Ú¸Ð@xÆ7¥c¸¯í.ö¶ ÛHômL¥Ã÷¥Íì:‘6ó¼f¤I£Ø­9î;ñ÷PÅ -ÍîtŸ‘64œ¯÷ °÷qUb£¼Ó"¹œ®4 :™Z¿Ý[¨Úh†IlòåŸþý å0œ‘‰Ý¦r‚M‚XË?—bçË7ð°h£Gó¨é¢Ÿg>hÇŽL¾ãR6=œ£Ò×$óØÒi]ëJfÀ›Âå²íë³ìÉ´r,i£ ãË1gD“‘0™%{9_zû¹óÆžQúé_ÄìÀɃ0ÄRûÏëÐTÇW¤Ç2³Ûm^KÇÜ£¥1Qù¯ØJÐ]9´q¡Ž-a©“f|½^ŒÅòz–=Åú]LŸq¤í¨ ãó\³5©Ïüø.&  >i<„SºÄ×B©Ÿù¾40—ê°,Œ®z)[5+Æ{1šùÚÍé¨kV[·z¤’͉ì07˜ÎäWeU+xÏG^Þ2àÁ2–…̳™ýö^73ʼn]”D›Uzùíé µ ò™W&áñ`-ð·!NšI±)ä)át!«ØÛ&ña|)êw»°Î•:I€~'}ƒ¢o€÷p[)}ï6Rÿîè~*fRBŽm U?ˆMx0L&€,¡5­8Ù߶2MÃkãèMSŸÉF7KÕë”Á,0òšÔRKkR¦ð…nËe4ãÇ ¥½æ°qqí²  áÉ% …«soÚR®-ã`Ù” –8yu8ÝÕÔnS¯Ú#«›Ýc¡b:h{o/®“Sè\–D+Ñ䓨íÊáf>D‹ØG¿Î%å°³7ùð`s“—S$ïüÉ}”µ»·úšžç¢Ó½v4hþcU†¿EGiqv k¯ÈÆás"Q;BabŽVÔ*éŠdZÖlø°¯5¹LÎqÄöz’%yÄ–Pa%rL}‰u*Ñ›¹ÊèTuÀuJÅT¢ÓzÒ´ÿš›[ü× ²Z¨û”cXîdægk"&»[ Äžáb ªë5X:‡C€Aµ‹^û¯y3ó–3|/:UåöK±d1ž)nݤú+v8Œ´ò¿'uW„¨Ÿ+⤄Ú´"DÐFˆ Ÿmìå°_gõmf‘Ú9:X/j"â> Úb%SèYáˆlá‹£ƒx'I º¤ŒÅ£Z+¢53$cN4,¾„EÐFˆ‹kR+Y Ô—;˜¢òÖG¢y áY|9£¨Ç NJû÷ZÑ>‰oŒé¶Ò^'F1?19¸[ÜdA!B,ê6Õ@h‚F!Yà9òk#ðÒ.Ô—+º=@D7¾KTVxÏŽcEiEâ_A!B¬Ñ†ùwa ';š¹g¨hs‹‰f[æGMø¶MÐFÐFÐFÈ‘ÑÆX+“§£1ÀÐLÿNN^–ÛsÚ\ªGð8Þdþ®~Cõm»   #›IÍfáx뵑ÎÆ*o2m.×cM4F»©Á°Ü[m„Ú9r»MÒ$Êrµ If´±q&gýVÝÛ h#DÐFÈѬIÍaq”iÅÜåfm ‡0ÐÁóGi#5{³“¸Ò]ÐFˆ £÷·Yä/˸·L];S}ê1\Éh³€¹ÙÌeí{á¬ÐæœÊÂ'h#h#DÈaùë-);h+ è”upÓèi¸·‚6B„m„´"h#DÐFˆ Aq+„‰•xžIÂÒñ»dœá&Â*…ÚùAVÀOe•££âÓ²Öp Gó|Šû/h#ä—¬Ûä_+uŽžÈChÏI;ÛÃpC8ÖÈ%?® Ç<'\Žs‚q]€²¾Úÿ:âÒÜ3=äO]±)Ká}øsO°U†­eT-î­ A!?ÚHêDÝ«‘2Œ/wã$7^Ìh['B÷ò¨ð ©ï¥÷=cð6Ö†¶Ã®1¼Æʶ.¦ÊMÇmÃÕh«ä°šÍŠhÏ“ƨuÓt}3_köó"àÒû§ XW¶hÎ×±Z·“ÇYNtJMS¸Äw¡¹Œ³QRrÖ¸‰¯UÐFÈÏgMŠ¹çmÜŽ„.*—æ–NC»(k@D5IL&&¨öSÏ8îõå´ÿhGÆ.Ž E‘¬VæV¼Ù¬ðÇP;.̓>‚Š©IªÌ\=áñà5sÌÁ ÎB±´òóÑm šð¥±|¼—ñÃ,GYX‰6·xËíÙŒFj™ üΓhxE¨v1&²ð§ˆÎ9vVÚ/Ú±+]¦MÝÆ—%¢²¿ÊBH fy͸$9»•³ãŠ?æÓ „í_« Ÿzÿ<[ZâO6Ø‚Ê1 ü1ÈŒ6<˜K$‰ÉãP’ô º ÛJ(w±]¢mtpDÈí98bȬƒg="«¸n#A)æ9÷NÒ‰­v¢ÏL¦÷qåЕQñî/¢mm„ül¼ûŽ÷À…A¸"`™JÏ‘4ŸóqE0Öºsž\Œ%NªÑí‚_…bµ³Ææ¼!CTkÓθ*XéóŒ`¬w7=\‚ ý07„iV¶ìaöÇÅü¸'úc£j™~™'. ÆåÁXç!P#h#DD.¶ø n-¦oÅ«¥¨¨¶TÛZˆ A›ï/z¼˜C³6éUÓ‚³]Å×$h#DÐ毳)Rr Ú´"DÐFÈ÷¶KÅÙÁx< O'âú £JÄgT»,œÌ©8ÝéX+Nö|ñëùXh8¬¡tœî‰Ão±ÑWužظáÙTæµ8ÝÒ÷%àw)¸Òï—d²´rTºs¦FÚ€˜:Ô¡¥Ç!7¶à"Ý‘=«O4â^óìzŠ™zÌãXŠ“ãq°šcAz­Ñz—ùžÔrwÜ*ÉÕç0¾4¶>íãän}Ÿ+o¹À‹Zãƒ\Zýÿ"öA!Gîoól&†TáKÛ¨ð®S_§ûÓrö…þ°‘c6/ ÂGœ€_…°•q=VPXÓ£Á8Í…wr[?ÕCédµ+Nñ¥]Îbî:+(öüµHl0ŽEÚ°g³>O“û\뇵n8‰õy¶Êhž;_L—”“+ƒ©<ß{%È­ÁEœ6§èq[Ö_åÌ»º +œ5çpwJ+yŸ'¥SŽ÷Ù̲߉ezºXN=6壻–ï¸0†NÐFˆ ´±q¢x¯‰×ŠŽ'EÿG°­¹Ã@lØøª ðfí{­nJ§7[÷b“uØ T5¶ŒÂÀ_eY&\›ÑŽ¬rü>“ZþÎç%‘cžÛ><ìw(Ú°O€ºfl-%?À÷c¨Ï×  EUx!“¸ŒóVŒ/«a-ð.%·äÅÞˆkEU^ÛÁ?ý¿F¤U#µ‹Þ¯r$Ŭ`jo”NY…_›Ik™.U,}ÔªÒm.ß…Á6î }NÐþ‹Y¾´r„‘ s]ÉÑw¹£…gi9 YšcËþu¢ý Ódj‡àÏ­=N-Ð¥Ñ(ž2†lp×A ×sÁ&‚:Ÿg—z¤ïçåÅ+Ay™Pš€;\c&eÀ %T|œGH…%ØâËJäVð>o/@›+ÝUÉ:Þò£:VwƯaçe&õI?4'ºÑÇR0…êгœ06…{}T Ô´a=€ÞnD6P秺»!–u›9.„•Nf[ ¸9Cm²ÅØ@ñÝn‘Œ6Ãx4‡o«…[±hš6“èhAp%‰?KŒ³Þ. °ßÅ“WÜ•ªêsš6’Ê4‹‰Úø¡»Aª>/qÀ—UÈæ§zånt0±=ž_ËŠDž¼Â„6§êy·­£¸».‹“^F˜*~jÝfU1ùni^æƒÝÃHÙ+ì6B„X±Û8Ò€ú½fŒÌq%+ m’€ˆN›‡g¤MX 8+B±Q °K·JÛ^8ïëÔØœ6þcˆKÀ|uŸz¢¿m\†ǯey‚eÚ¬9ڰȇ.ê6/³:ÝF?ŒÀhYïr¤]Nu´"IJ•øŽR–.O¶HÃ3±ÙXNÛgË3)éu—»UÚ@¦ÍÝåiTl¶—øX¥MóôLJ-–t›¥3lUú¼ÜŸú´H›'1PÎ7þµ†Ï¤^™6f ¾0×T¾K-&„×ÒæËAd¤É¹Qÿëm„±îoófs¨êAqú¦UB‰³¤¡ôQ=úzñe.ò‡ÐQÏÇ—ÚèQT4áã8ÌrF PÞ‚¯ŠP7ÿ]dÞ±@‎6èSM­ÄÀÁìh"ÙÙÃÒ$rT·â?…¨Ãö,êÓ"mŒã=®^paVâãìpEzºrEΔ6öÈÅcšsx»££ˆ¬A“ø:,u Ëau«!Vnbjq«V³|ªUdÁn›D@š˜I 2£wŸ'ùP^ñkCq–—jUÅ€³)¥ùEþ²`À¯Â°Ê…¿?+Ø\c‰'5;Ûµ‹‚éßó}x³³q–§œÕÜ›çKŸíŠëÃq±—©ÉèêH\dÙ(§ ¼€õy¡üïé8×›¿_â…«å¬és=h÷Ë0?è'ÚHÙ(]Z0õsæÉ:ÒUaláÛ€8ÑEsëÃèܦÏá¦H–Ù7DҿƤ“9™Ù»¸ãªpú÷<áÝ'DÈ/#rÁ€ù8ÐͳŸ×c_'´"hóC J¸Íù@#Ö:‹o\ÐFˆ Í&:r‡&щ¯[ÐFˆ A!¿8_bG<¯‰Á\€§cµæÖGáÁ(?íñ8Ç“¯L­òÁݱx$·G`‘*\z– nŠÂ–<ƒÓÝÍ,¨,Îzs<5 ‰Ç-a˜uøfû#Ó»<EŽÇ¢«ÇÉAx臎ÄtÇS±Gh€rÁSñ,´Mí7î…ǶÉ©zàÉŽ+h#äÈýmÞk’c FŠGñE¢é:Ñ\²„\,/E]EᇋX0Ñ3…ä–SûRä3?½¥l—ÅAô>§Ûö#¾‰…G›y,»ÓjrÀAx–!¤•ÃèiÓF5ZvØ9uöG€š¥Áíá>x-8Åé{#ÂfÑ"ûÈØL›p–«ùˆèêK7œûJM‡¢$½G@­Y‘ÌaÉ^ÐFȱ›IéÑ8ŽwÂéÍÕ話ô€pA+ç@QQCÀõÞ|û0ð€‹Ò•g/¶1-(vþñJÞòÛw#«LkKa´‘^J”–-ŸDÓ@¾ÐŸb”Îà|[å…ó°Áóñ¾t›üä˜ Gœá‡óüq‚«âx¼Î  s–Îý±=hlÇæÎw®?»FŒÓýè(§NçlwÄþôæ,êp‰£¼ˆÀÔ!µ‚’*Ì÷Åø˜&Îú,vÒ\æœî^t µt7Öùâ|M>ùµ>ôé™Þ2 XÛ†¬÷š6¬ö¦[q†·*PÔD œ6sì±ÞŸnÚ<ƒ–6ÒÍq§›#݇ãUIïmœY{?,4ª¦Ó´a7ó_Ó A!GãoãN.÷g‡Ò#:C&«ðaìØ…Ô8O+?ö(ì“1ÇÑ´ÞÖntT`‘“ÖUØaFÚØÁ¯†]8Γô%ï>쨤¹Õ͹Tä׫é}D¼åz<ÊbÉ¿ÍÆF7Ìv§pòò¸UÓUÜÌxÖ%Qƒ”BY uè_®A¼»‡ûøÉÂjÆÑÔ»´‘ÙÊ)¹uà‹ l­£÷ó™ÊW;‰½ÍÎ_qZÚØãÀ8îñ×ÀüÞt·á@þœKþ±î¹ø®žô¢¹:êÜЊ~èŠppý-¼…1˜= ‘ò¨×áÝjL ¾õhb91þP‹Š^•ôáÝVXpa½HªBÉ0)¢jÚœÁJäl/Cx ½¹€}GsÙ…W¶!¥ƒEÇ;©hã†nàÅ@¡Û96VâÛŠéûuÈŒ“'鉥rÿ;5Š¯8×´á7Ñ2vØGô}tÿÜ¥N3ÒÆø‘+%©xÖo‹hÏbi"Îqæ6¢ôü;‰Z’W0€¨Gi©<ö¥5Däà( 掋yÃ¸Æ ·îBU37isijf@OÓñC?ëÁõœ‰)¬w‘UK™MicÞR»²ÐÚÃ7æL!/¤^ÜäŽã ¡|Öîë&'ÜS‰ 9”þÅ*† {,‹¢–Æò7Æ(Œó™ºh"z®Û¼åÇ£N$oq—ic‹ý£x9’ßÏ·"³’ÞÖÍÈÌ–#žmöH k€_!>×€àbWÍ…˜Óƶ»%­ÝŸÅ}‚<—ŸÂUn3ʼn[ ÙDõ®lTÖð6ISøĈA[H€¿×桧V‰~•´¶¯ƒ¡D‚<]–ÀfRv¸?›XêYNWê[N!ø[94£Í v¼O 3îá2mtts®qçݹmÍtùÛ—0Í#ÝfIÝrÔ‰ c1“º8›U×Õ¡f¿ ãË75\gÁ…2†¦p‹î)eÙ¥tJÔƒM·a¼CÞ®*/¾,‚ºšµr·×;ñ¡½Ö K\HLë?lûR;K´iBYÏ‹e¤4<íñÌMéÐýÀ%‡¢]/òU´i^ðæ‡^qÌiS­Ðæƒ mËGwr?÷žpAŒ¼Ôµ"‰Óælt5ÐJŸñ2—ºb¡#žÚøz•4àÅh^¢}Ùÿ³÷ÞAq[£oÕûî{U÷Õ«[7¼z÷ÝûÏ÷ê~Uç|çØ–“s`†a€aˆÃsÎ9çœa˜ Êe!"B !‘†@ɲeÙ²%ëØr­ˆ$öëÞ{ É’-Ÿsdm×*Õx³wïÞ~½zõZÝ6Ú_BzVÓ†b£hùéüüCKHï‹´A.Téý_mykR`VŒCí«ÿyÝF»ÚüˆÞ¦û ¹dÁÕïù‡Hû øûž€£í¿t¬ô,O ö£{Ù}ùáo[ÎD÷æêZmÌ\c·±[ó]¦Í¿ `ùW=Î0“ª[=“J½\º²¢Mý¯^xÛg‹ˆï^Ü4¶ˆxmF€6wVÑÆqA~°uó>ôû_B›õâÄ_J›îfR¯¤ÍÿcÛ[¹ÿ1 ˆÿWÈ£øG%ÜÀgRÿuIuà¯f£;]üçmÈ¿îX%ÿ¥§/>\D¹ÝLêÊ"~Ïj†m&ñ%rë3<åò;ˆ °î~niÜUäÞ-4„  !¿M·¹þi\Y<ª½…|qmõ²”ù·Ó(+–;Ñv8ëal…÷סÖÎñ›ÈÎëÈ¥{°‘ÿ](ÿµÓ^ù²ýdüø»îÄ:+à¿@ô6©yö©ŸAŽ| -ÿ j¬¸ƒ ç?GB ÿq;´öL~ÔÌ#·Ÿ!íèþ6ÏAèÀ5düGäo·áýOÀ®Ú=ÓÄ­ÄZäÚ2÷Rf›íl_ÉÒZÚt#—!ôí«2ÿ—AdßuäðWÈóçp§¯}Ÿ"ÿÊCóCD´ë h×ßEî|‹”ÎÀXû/>Cõ 4˜ýÌudçMäÐ'+VâºÛÈý{HË,râ{ˆ ÿMûò™Ôsäè=¤}9rw­•ø¯#0qÙrÞögãÊvî–[Ð. In´³w#G~Fú§ˆ5)B~“wßÿÞ‹¸YÝŠŒˆôò_W€wÙ°y• gã„܇ϘþµáAă}ŸÝù)Zä?mEð:ÿò?{_ðô@W®]‘ÿðb> ˆ \׬tXð —!„¾ù›²ô?ú×!äÿëÅÕÊ!D2ˆ|°c›ÿcLœ¹ŦM;Œ¸ Ààú´åÁñ "9‚>¨Á5ûW‹Ž ÿ 5bsWï”®Eþëøi@\Ð%CÈ¿ ï-»cÛ6ÇvçÛ‰0m¾F¤#ÈÿêÁË>ˆüßF<·ì‡ùwܽ2¥ú¿¶#üA„³ÖˆÛ‘•ïúÓ^D<„p ³¿Ü»O†:€lóâ•ò¶"®‡ðWÿ·°Ê¸`j°óÆìA8GÁ€Ínß‹Èl.ÿçV˜àwA‚6„‘ ÿHQ#ן ÿý}Øw‚  !mþáÒIÄIBABÚBІ‚6„üÑd÷uh\%„ß.§Àa¢y©ÌÞ†‡ZBÈo—ÎIÄh&Ê—ŠõkD7C!¿U´ÓÈ ²ÕJ!/‚6„´!„  !myßh£^Ò™Ã,úÃÖ´ôDoFàuËZÑÃ;ñßËÀ§fпš×IðÍÛö’~9)û,Í,a?Öæjå]ð_<Ë_7³*óð»~mÆ~?yÃ>ó]¡Í¯h6ºÙõ®›WšÓrmbÍé]ënxK{£f›ú,^xÚ`uš]”%Žë2Î._.&{vÓ¦Îâð\¾Å`ÒlðƒËçÉS·öÌþ(vp` ºåG¦ÍÎ:Õ9¢ËŠî…—ìþý¥ü •åï"Tê®ëm×s÷=ÈŠ?€ó“ÄёΠ™ÁD ÎÑÛšhFC&“<“èm¯Óœ>Ê Ów ŸJ&³8¼°6+ÌÛôke Ëϯiü0ýE‘¬LóËMî9‡E«:ýhÍã]ûé‡@!tŸùÌÅ_ýϦۼQ³ñÊè+ÈñÅê‹A£Ó<ô7?nÇ­ž™yŽ‰'öºzð¸,*•. ª3YÞ½î¦é«qÖéÞH´ IIß’ù?²nƒL=3?†¥hÕV$»8[²ºÙDH(òîoÁ=¼³HIN<;~§i× æÅ$¦¿=åÄJ7 ö’¸ ÄámÖ&ˆhÎÑ0fœÉ°…öhãRÐÐR? ¯ˆEúU´ñ¤þ§ƒSâ1}ŒA•ªgÐ;g–º†/¹07D´ZŒÖÇ ©µmðsÖ‡ HÓ0‡´í;Û8^Ñ{ ^칾˂ô\Bzpdaƒö×å¿gfŽÎÊ5^FïAÿ Ÿføƒ´aÓ«N?6-ÀŒØøhAª:å©›/#]ƒ‡¹žm0Óð¥ ^LíîüGÑæ › ~Ý‚$x8¹·ÜÁîšf˜(5ð§tç¿t%o 깿¦.@éa% Ó¾´a! º(´M°ê¼d\€EZ]±Cõ\uwo9ðÎyx§a½øB‚ëÔòZÚDõú‹kÆrÕ­Ëm¹Z@’’…¾¥ó°]´SÑ-ðÿ •ð7¡ ªìÍ#ÍýǼ|TŽ"cóÇ (^ÚllgDZãwmà  ‹+{×GgS à¥Ááêõi£z”UYA¡qÝcš'Vº >i:ÿeXT‹îZ=Ô=ýË´IZ_—П8éDV©/#AüÂw,¢ÚN›®©õ©QÝHâ§éÚ-Ä\gŸ¸œ¾[=+$„-!«¬\È£º„ÖÖŸz ½äHqKI P&3I Ÿ¦ÝåAI™l6¯hàlüg?öˆ8n*_è—Þ ÚöäϾJ9ƒ&V„dt˜‘àp&×ÕÍË“ÁrIßóо!a´É©È䉽¹Ž$0°c÷q±TÈuñó‹Ê’{KYlwßèíÌ›á*Ï—{ð9®©­—ù×›Ñæ%ÍÆ&ÏãÝdÍ·–¯`´©_î3"¨’¤ókt© )6%Agd?wÝÓUÌvS‰]BŸd0b‚F…†€ö%óU1XüXã50RD†Ð¼"ëEŠdÿï_Ž¾¢}kŸå,ñ‰àÒ.aÝ L<.–­HÐ IªèXWQqaAk\§–WÓÆYÖ诸È<èTfp͘Ý…oÝÝݘB…›‡GâW=¶îl6é8tšÄ'”ïœèh£ž#9 Û¬x#,Š—²ÓGîÞ]Úh§ždUÖID qheÉžÏô–åf“*.4£*$½• ‡þ ´ÙĨÿ‘Fç«¡iiIæOÆ…ø¿”63èt~êçrã~1‹äâ›±õSºÚÍ{åÞž4¶†i¦sje vçØòSšYÊ#o°Í¤HîÉ-y͸ä6Ô?Ô¡égæƹ§ïï­Ö6ð}KŒæuh`bŸ¤}ȪšÄ & {'BÂüBŸòƒê©%õÉK!±ñT#¬ê`ãé‡p\¦¥-«@Z÷4>† ™ÿÙ¶!÷ªèNÝ¢; Ð)Ò‹´1MÌ3?¤•_XéJÆ‹H×£lšSÙÈbª¿€P¦ž[5O´!»¶Za‚ÚÑÕ[=×ÄpÓn¾tOJþ«ªúhN÷PN÷ÑÔÊbŽ(Ú[44Vf7ÚYšöžO+ ˆÉöQ*ŠlÐ\Wë6ŒòÓ1: €¯»Š1§4Fž´ü¨7–ñ<±Ìs¹ôÂc?aŠ}FZ¢4»¿ÕÉôÌÿ^zÎËt›7j6¯  ›DQf4†eׇeTzz™Š¨r˜ñï‚s @wVêŽ/aEÏý$#ÿUY…—vzM›£›~âÎqp,Iëë2ú%-(>£G˪õàA–H¥=;Ëd0Ô“p¢.ÆE)*O^Ÿ”"ñ/<‡Ùúê[C¸»uÓ×$hœÿqÝZ^5“¢&AE dÒzW´aSöÄþ¡j×sìuúóã gõì]¾ó‡U£èlEâ‚©€6àñÖ}ý,a(Lpì©ž~ÇLÇ«h2?õ8¯Y':KTù9Û>6ÌÿJ•§Í Òu샟®›¼Ê`DtÍ 1/§ > ¶<ÊkÒI¸Ž’àÂÜŸ‚öP»mH©RPyñ-§ÔvkIo:“é·hœI$:Pµé4 ’ƒ[áÜ:3©i¤»¯Ç‘Ò‰~>+k· ö£ ”qÍÇnÓuüR\V… Ì5Õ,š¬ètïìÇN·NÚ±QU©F[N›…¿‰Hý Lqe:(å†Äº~mZ-ºwöֹƣ·ªÚÚiòœhCÇ­Ä¿LlÔC+.+E˜±«¼®xÓG!}ô'¾ŸVÿnΤØα͇3Ûfv í¼ Z&hÇŽ:ÂïúË&çTw#«ÿx¿õÒF¿üåÒÖ'ÖîB¯/æ·oŠŽ'otTÕOu":š§ª¶beÒ6pLg´£c )€¤Ä†»ä2ÍAÚ”™±üÔ·‡r•»_L°÷%µ¼Š6¼2 ZJFë=7Ò)ÇÝ6FÂ_§Ÿœg‘:&?ã8’jÏ¡OY‘„h6J›%ÝÄ\gfåy¤$ÕÕ»ë«wÞJŒc†]'CÁLÖ'¡kF;ûëi£zÄ£3Š ¼m7L^E›©Ÿ“‹J(d®Zwý‚uaÜn~Ÿù4:-‹E&•ìêúuv+¤†¶Ìo¹Œô¢¢><Äøêgíiƒ)êÏ‚üÄ9ûÀçTt÷JTiHAîΨY϶(fFz¬O²ë:\ù4IhyÙ‘^M›žKˆ¿ð/1›Ï¢¶Ä‡˜õ §‰ ôu¯›€3»Y¤ 2‡¡x=Ú”,Ó¦¥Í:“b&îÿ^êK±1¾¥GAgÁ>|ÂßY·ù]ì6v ØwAóø,¤Mvÿß0ãÒå/‘¦ï±ÒÖM?‚jÀĽúã1ë}ï¹1ÚÂ& ÛĈ¼2vcê¦-µqºöÂ-ƒÞ6íÌ ¨ƒ•² ¦ 0Wz‘6/&Ø2¿N-Û8 “£¢µ<›&®1>bVõI¾Ñ³ú3|eó@7•¬êž{âBÿkéñgà¢aaI)úÓmÀ÷Vz‰rføtZË…gÐ1Àú.9¼lM ³Í/܉ÊÙ4Š_Mð»S¶sº@{ÈGæxd·™A+ZLÎin¾ðÒ•l†ÕÜ?˜Ôa5¼’6 …òÖF† °¤¡z÷”¿›£¼¶í©CtŠ¸d—¥¼$âQTsèZQ[»·*Ò™¥ª=õÍ«iÚ^auß7§úÀ'Í»´L¾²rÏœê6L¾8¦¨ÿJõöÒ¦¼ÃOÿ+ÿÚ¬;Ú©ìlcð}‹Aiï™Vº“ÁºUlfbÖЗôã_©Âb¼“; 3âäáE(mhucßE'§y¨Rr÷} _ô²¿i³Y¾-+1*Ä°%ãÌu…wtÃ…WæÁŒ„&Äúo!³HûÀXplšgprÆÖ4ÝCÁ ü•q!ÅýÝ(·££¸¡Íç”–{ÆŶ^0`kV$¯A£Œ ÊVwL¡JÔ,’S•Û~{WSO•oÖéÄÖ²×Ö²]&Õý&·”¡Ö}ǽUÙ½]VÜRsj*$.US’½ç¶æ†Ý´’jrêÖ›%Í%Q-—qunzÑJK8òÕ©x œËŽ/‘ „ü£Vmª°58"rá—çm‚ë?~7bCP°öÃÇéeo_WŸÆ‰w~&EÈ;L• ÍkÓ†TwõÈ­~â;o…7!H|¾\æЫðÝqð#hóC Rô÷¨zión… áa†³'çp‚6„1à„;Nà+ÊôºìEícFÌ÷`ѽ¶Uöi¼(Àð¯þ X~ 1àzË:±BWMÏV ¯¯í`­:ñÎÙBᬿRÿÁŒÆ˜«9š·¯Û ìü+)Bwñuï¯5ê~º‘©lÉoŠø˜F:ûúKN¿™ëš)ÊTÕN­MªMßÓ5ÿ½àô“ót'®9Ä•õ×ÒÏßGÝÆ‚DE²ÿÁV‘3I·®¹7x¤8ËîÄrÏç2>(ü |…ÒŸ§½ùë2PÛ¤d j_Òh»F©ôï7m°@×Þ‹˜ë ¾؃ºˆëQ*ŒÕXÈ3]»dB#^Ám[®ÂÁŸV|óæ^¬Ú¸u»K`›nô3Ï uF½æÐÙ¢¤Q7›‹¸g· £_½uÅÇ",¬Him‰_áÈæ‹øÊ5ŒŸ½ŒÇbcC üËòwÁtL—o­á"b²Ûýä63%2J}eó¢ÿ"éB 9€l¹„l¾cÿAÊLŒ6/ÖòËŠÂ0‡ßV×ÈÂ=Bm¹ÂƒÍ-H¾Ó=~ïæK«?êâ;º{ϯ¡úà^1.ñbRYòœ!P& =Ä'3|7//¯¸Z'¯ô²É4ŠS3ê³:»§ë¦ômwu‡û7PcÕ'F6QÝ ¸6›Èä[*ÚŒQm+’ßœ³ý+õÉ3 u?'7`ž$A!AT—Çvz嵡-6·,‡Å¤K½™Ž²†ý¶i©Aû¥ŠˆÀø,&G²íFÇÖÝBOâ§ÌëhÞfphRŸ …ã[>š·¶¿ÊÑ£#084 !Ïc†Tž6X‚Ì霔xðÉòç7wuñø¡GPpéØ`²oÉ ÖYºÇ>£P(SÏYtÇÄ”hÏ,w‡ëžÝ†yxv4s9,©wÊnþmŠS›Nkg‘œÖmˆî½¦ Ò¾ï «}”°Ðpº@îê&áH|«N=îØÒ¶‰™¤™Ç÷èHPlæ¦2ÄXË—6IÛPý3+3^ž{LLJŠ9LŠ+h¢d–Oþ)¨$˜’ÉÊ]RÞo¼„ÄÆ1YB©\îWI¦yÚt hby€íìâ[Ö9¸ñ³è£ÿ7¹ÿ‘½®[š/ 3ø¾qŠÜIסÕmpÚÌ®SËÚõÊ¡kð‚ÏæÉE®^©U!8m,KþA~L¾ÌUæÊz–]ìÜsÊÅUÀ*üRZôª›ò9Tg‰W4ÚZèû§ ÐR&ï éÔœ#÷Aš,¤|‡ì½ß«wõ’èaíèL¶ª³–Æ–u‚dê“ÉX¦Âƒ’¹ý;Ýá=¬DÃÕ¥Ö‘»ž¢ >`ѵçžÕo9‰†ª-Ë‘òƒß`UŒEà3uM ÷Uº·Îêì#9{5LÂɯ攙Bå6Î =É ¯]|iéÈwòìCRzv¨_þq¨lŒÝ`‘Ù¥#ЩÛ0õ7ƒT5òØp …²É¹ì4|D½w‰F:ÃÌ=ž«vÖÞ{Ž8aòÈŽ907õn¡ÊRLèÈØБÈì×¢ÖneÓ (€z£ôeE´-莟£’ÝjÏÃLjG.Òh¬ÖiÔcٌۦޭ@Ý·M›kêãl:«â4,„¦ŽLºGµmK5Ùy‹á âÅùkJßCXbcŸPÉ®íæÇ<2«%Œ˜ËòñÊŽ=ŠÊ‹”Ò÷@;tƉ$©Gí!ç®ÓiôÚóKšy4gFíYx±k‡ŽDì@£é+Z«¨l/õ<’äéèÛû‹‹O­ì®y¬3?o9úEç…¥5†¦p5tÏ"ÈžHH-úy…6ëÖò‹5 †æpžWÎHÏÐå¸ÓHm´'‡U)z-Ú¶ óSD©[A»*¬Ir냮ÔS#R++ÏÁbé™ù„Crlÿãë6ê‘)“•«;•¯?•oñ“Ë[gÊÊ xñš ºÿÞ©gºÛ«i£»„”·ˆ; 3€ó»œhÍ´-^àUòè‡ú\” ¢ûÔO앬…ÞÝ$«¼ÉÓ'È+¦¦yµùÙ.ÒjѱÌpfÆÅ;[mݱÕÝ/4Òô½cžþô¬w@°OÞ>ÚêzÚ¸ò,ƒy%æ±nìÛˆ¸x7¿Øì=3˜Ñ-²-‹©…Uî •Or{û»ì[þ6iñ¼è¸îÏaùÏ.¥DùyÏÀ¹Æ…O"’3ݼƒ#Îè°²š^2™¿ä}D.8»bN©*•ù–t£;Ú••—I|«ÕVÛ:õì“ÄÜR™OhXÉtÛü%;N׈]˜nRè<<áãQÖtö®›wR'êðŸVTéîì–Stä>ܨîa ¯WÞÀ“5´I ‰?ð<†„TxºCLjxÆÖ¯u¯Y˨7`AM½‡OHXÝéÎ]­ž©'áGY¤œ7ïðDý5ÓÂbdT¤ñAÓ…ÛªÏèzÐbÛvõË}ƒ}Sº5f¤¢©Q*nžyî/!§ö?z½ûÆ>ÁhótÔmÆ|ßó×Ⱦ§¶^ð‰°þG.`ÔŠ¦*¶ªò:´Eû*›·4Ö˜‘˜ð°ÒsÔ™ÔëÐæšÕõ}  ¨ë²Ž…$ j°Û€åaý¦á¬Å],¢R%¥c×þ]a™µk$´ôÁúÖ€føcE=¼!m–pߘé¥÷D·YOo*¢›A´ÓaÞžnc~«*Áß¹y¼ Z"*Šˆ'„ˆ'„ Í+Û° îT¼d˜G£l~»j:ƒ_ôVÔ#túW&bšÿ… `,èŸv§#háGZߢ’¶n 8x JöÑuE³Á‚¶LsDøÛ¦Í4Ò¹sghí¸þMé>uÉ3fÇËn0Í}'ÚàT1ƒ$xh| 9ûµ[°î²ÔP›Œºþ¢ XóH€dcÎI$3G*Ï:·æÎƆôüÃßÿrš³ˆï £ƒ_y[÷¶ gWµö÷ˆv™FÚqÝß,vØ‚d$G5¡(Íùoy\–ÀCÙtvñwÔm,Hl?°Êº6,º2®l®êêç?e^×ì;ÒY,HZšÐ+öMlê¥ùîÓºÍKNæ5ÚØÚ)ìå¨g, zû/‡BÏ!ÅåyÊŠñ-íâp//ïï¯lƱѤô蕶½ýB¥aóåõg»Æù‡îdVÃ<’AØhNb»5a¯Æã…/ã‘éØÿ¢'˜Ø‚‚/#ú$ÂW8ü¼ÇŠ©1Kc$j.!Y¹î^Ùãxœ8Ï îŒòå{Ü;‡hA>/Á5S˜8½Ž‡ôÎãÖc!ÆëÙc!6Øýzœ6Y·n-‡¶’D–óŒF—CCÌ'~†¸]ÀûEÜ­ šFKšžG²R¢`”úÂËN‚X²• žÞÕ{‘9±Û®Á€wãä%K ®èOÝžf/RUÏá匆o`!³ì<Òn¾z‡åª»²ñ49“ÕÖðæ_júÀË+9»Èñy[áÛ¾K°-çÞËvqpVX¹˜ó*^Ô¨ ªµÅ˜ÃâZwu{IK+ ,Øç˜æ—ߎo8`·qÁª0ðæÎp†ÿx×Ê#°RLÖ÷Îú÷¢nÓÕ¿UÄ%ó\$tžGúž¿A&œš–¹ Øbo!+R@g›‰)ùʼnòð,w)[è]ÙeFZM[ø.Oâ럷Å4õC`@C¤‰ø"ߤtDÖì,v”kCÃýb2¸\vDã…îÁ±TÈâÈ‘Eº‰oâJ5±vS5¤CrjwtY‘Úž¥7¤îb&S"J×€æq|XæÂz°hlÏô~ÐëõN‚xÀ Ð=³bÄü¸ê’T‹)ö 7ÂÓ—[Ê$} –m<¶¹\„ïSv©)Ïwºø„…é®i6¹”FÆFúEÆÒy †y©<Ê78˜åÚö}Œ6Æ…Ç.ÿ{J?<°[îK/¹)`3ÈÞ‰=m¨Šo‘Ä…JeǯÀ“1ÏJ$"¶D!p]CòupX_bÑ2²ctzéÐÓÂÚz6‡'‘û³˜ UéQ®©Ç¡¡atÜE,ä{F4ž{ÖÜÑÊå±2e`å`çá阒U…ß4’å³6” ÞÇ‚JBü#:o§ÇûÓ©L7elʾÛî~J“቞üž´ ÈèòÅ.! ¬šD* ☠ ý#£v}¤’Ó©\™_Tõ$&Œê£v‘Çx+}.A•ãëöÄ%Ãô7J…Œ)ô»JX’°ò³(Øq2]äL*[‘7¤GÁŒb(’Mt’“OÞQGg^‡Ím¸ Þ?æDY%%,®PâîÁäÈÒ¶ ù+=¸Q‡Ød²Kúìº:- {l¯+XlIPåYˆ©îý»Å|šÀ=€CgºFukP†¨O]”ˆù‰¯H*Ϭ‹´©«V‘=4ÚY|ï oÞ¿Ånùá½ÖmÐm…–ô‰qÑî'STí ¹úqýJG¥ÁL?1œ#‰;¢›ü‰N£û´^‡¡â—Wþ¦¢C÷A'§©Ë΀A§ 0Da÷ƒtò3|8QpC!ý¾:ŠƒsÅ ÄîÚµ$L5^BjºóEZ8žü.£uŸ½¤¶ifí"©ж×pÜêá² ‘ñi‰Ûo™àx´èíêg¼®§Äy( ÇÕGORJì°xw>;ÿØz*\D¸,ÁxüÈÊóbK£±C·sã„ìØóàN¹ 7çð=0<7;o Ãᩤ6™.Ph.BCG¸˜ªÚ½LqÝƼÔ4x½óÂsðlzª§[òPHŒæû"9oø9  Ý™V9²^ÑØ^F’Ö‚a½\£‰ní]€C^À)¨º–ñxliÁ0/.ºÑþ½ø Ô _‡åõ‚¦[Ó˜Ìòi4 çJ—•DÒ•[tó¶(u Ò>¸¶ºÐÒ» ,Ÿ\>ô£M˜ŠÙþ¥iú&s“ iýÏÎ2˜2åm>me\ïÍ'-Aì–84%£eуA´ÑÏ~Ç¥‘êÎÀxýÐ'FœzѾß3©î3f“«™ZÂÎ ÝÇ4ÿ˜ôçœãvNqý6×=Ù0õ3ƪ½€ÏÜeŒÌ¾;ð„¯Ô@eÉ)“õ‘íïÊ3…=c…½c…šÅ_= iãÄÊíF£w ';RƒÕ Heg®È_ýš&ˆ¦-Ui-œòO}¦9eêÆÐWŒ‡…«¼òöAóï…ÛKîÊÊ=†7Ÿ;ø#:=\”Ri5`³º<õv¦s‹&Šé½ |š§ˆ“užahãHKP£qa•šv)v"Rn Žíö mVÂ~zQÿ=þ06ñª8È œI j4hÌ—áH##´Rƒe©T»7*¿1$£ZáB‘ÕÁÃUù<T·;ˆ”ùÚ±¶q8SЛUœM²¢XI–˜Œt·¶»¸Ñ—X–^¤áÂuæ&~J˜néï¦Áv”ºˆËo4c®O›q`éy=ºIZuS ?x¿nú©„Å,†þ±†Ó)¤NtPˆOúæœÀÎã†AC<¿õ­aGN3œ¨!%[Kvj@É©9ka2èyÆQ¬%úÊêÏà±Ý®¾¹'±*nÚZÏ––Ãf3vŠNñéœF2b‚9áÍ%[ÐRÝr˜»‘Vt©iâûè_º=¤Ä3ñ –¦úä &S®¼Æ¢8¶œÇ{Gzf’{ÖÎÞù'¾ô¿ÄÄaR]àh~G(ÄÊî« ÏY±>å' æ÷Ýn£z.NT•5Y¿ämü¨è ~Nqã®>¦4ÐhCg5b{ƒ ´É²§åž›Ó&YB}hf *uáÙ-ê)”6‚*<|àÔ GJ=m´“?m>[Ô»"…[/®±²®ÐfÂ̢уÒk±W„e×ÇwCÚÌ.Ň è\y§m;ÜeÚwR<[ÀЉÑÆ+{K³EÃôÞº–6¬L-j¥©Ôvˆj°†‘§¢¸·~½m¬?J>J=ŽhíÌ ¨ÝFƒå&ÈHÑ\ª—‚çWXÒ¹aèóDIVƒäséXP9œÎÏ!E›•Qñ §Šœ~£å±œJr­Y.É°Œúö©Út ^Ø»ªÐŠv}±–6A/¥qæuÿ“6þuÃÿëïe·ÁŒ]°/¿‚6ñ‚€r|þÒ1t’És{ÙjšfôF|Aµ§—»I”}àA÷™1&ƒ’±ÜM (mð£-!ÎÝ¡1¸`:_ëêVuô÷øÐ@®_rxöTmXV}É4‡¡‡_±:fR^9ðžrzœÁhÏ›™dzëÞ;ró³ø‰Ú-ó?I7$ì¯Wb´Ñ è@O– ј¯÷6šs7éLVn°<ÊW©­KrÎ_Rú~Ʀ3Uíy|y‰̤֣Mb ¤ ˜Dº}è×ñ7|s3ó¢=bûÕ´Ñ\¸›c/>qúnëÚTb´ÑÍüÀ¡;6Œ=Ç^Ñuî¾mÒuÚV–oimS2GeÄv?[¦M~Z¸²é‚aæ•´9täóui3 -ÉØÚJ¨ä/ÁÝw1cx¥áhÕ™g˜•Øž6úË?‹7}~5ušŸx±œÖÐF7õ¸ùÔ=:éë¹ÍÚ@+B’½ݪo`ûaêgŸª'`”¢-JiÚuÔ7fU¡ùg i—# g U6ÀuJ›O×ÑmìƒßÝæU´YZ­Û¸x¦ìÄtÈÖ]m,AüºoQŸ½Ûqî9fúh2VsiÚ _1ôöIÜðÛ9ö3 a®Îü<Ö¾û>E«ƒ³×Ê‚zÄV#~TåRÇØ<‡¡¯¢M†Ô-Ê`D¿ì: c°"µ3ßs¤úÑgØF qñÞ¦ù¥ Á¿‡˜`Eš©bá´±"R¾CéÖíTFý±&cÀU20iwíáëÙÙÁ ¯É-Îæ(²ê~U¿o\äì³ã±nb=Ú˜‘´ÌXITK㱿5lía²¥‡®7ù$&ÅO<‰Ùm^¤M¡‘ãÓ0xãuæ°-ý:&WYøºf‰ òã‡uÕÞ¬?dvanHÜ|G7v‰íÀ®˜@ôÓ<8ÔØ>o' ù|ÃÈSojÞ¡Gp@y m|]x~õ£ 'î½&m Ö§ñEè&'•êfߧêЧUÛ“©¢¦)äEÚh¯ ÁÒ¾å皎ÞH/HS…»pB÷µž_Z¦qæ:g£súÖ+ C7«7÷Qh^­V¤cà“Ê,Ýw­qð³Ä( 3´Æ F*eé›ó²­ã=~Õ§ÛN[ÞÚÄb‘#Úo§oó7:Æïø¼éÌâ2m~ïðõhóÌ“EWuÎÖŸ¼o:Ž±‰Y¸ï³ŽI@ S˜»çóÆ#½ØM·×¥_QUÇ» îÈç 4RR}$Ñ{tÓÏÃ2QìæºÁ›u&¸ÔMÙ{¿_K@¡ƒz†G‚†y.§®‰È›âÔÓC7 ë«HÜhíÂ/ÑÆ‚¤§»1…ÊÜÝŸ5^õ8(ГÊ#• —„ž†c_ÕíØÏ&S ÂA¹¬5%Žª;r£rëA›ˆá¿S~Š3ÙTR¬öªžXÇ&$¥ ÈÕÓW™Û§1ãQáµ›û~ž…ÅC(Æ'ï»Êƒš'pÚ(Ãó÷C­@æ²ÂÇÏ#QF õ±óÊðh‰\×eÁV¨õA€§Íés|lˆ}Ề¥40÷—]Sà{¹ú&©§`®Š[õr¥4 µôèÏ@yNË ©šÄæþݧ§\½Têé¥îÃ2…¿ªù¤§[|»̯Š ªÄõö¶ÍÅn10¢\sdH¦ðó«™28È÷®×¢£OÍæmŠ­Û¢'É/@;¸Bé_qü¾aþ‰·Ð1cß#ÌxÕ¸½ÏCáëYVõ#ÚÝàŠG%Žà{UÃÕŠ±Ï‚Â\}‹Ž<éûDæ·ï¡§Ÿ² ¼‚:ÿÈ'¡ÑñïøúÆó¶ÈÐѹ pÑ3 ²i+IÝð´ÜÛ×+«ß`Y¿ Œ–ŸB££\´wÍ«áÛËþ¦àîヮ<&"o¾ðþ¶‚6„ü3Dej§ŸÛkÐ!|êù òìï^ 3³ÎÛÛ„ØÙN#hC!D 8!ç8)ptú»êmAR0BgB" ‚6„¼ݦ½·™ÇtvSF²© Q¤IkArrS=röªûöÝ’LVä}8‹‚6„üî+à“ØTzÉðSƒ1Î-J›röþTZžëW|Ts`î“Õ;÷,« ½u=õ›Ðs!hCȯ¦ÍÄ=‰,  ä´´í_·öÈÝyCwæÓø–ðÀbí1ÇÑ-$7¯ï+ÓüßcQ’‚6„ü}‰g– Š3„!åyÆ3©EEïüŽ©‡½mÏUxˆóöãA>L±*¦ñx×$¡ä´!hCÈÓ¦¼S'vÉnP†ú¥ê:'_²eºé–vhŒÏtÌÚ÷ Q’mÚòfQ™ã7©tŽõ‡×Ï#ÁÒv‹þÅE++Òrx..-™Â”ä˜Ú.<Óg´!hCÈ›ÐF=2Í` 4è^‹@{‰ U WŸrÒ´{ÄÛ“Ë÷Kè2ã;i%IІ  !oD¸wß}!—Ôr¡éÄí¦Cçx çÜ}ßÙ/yëgŸ&ƤUÀý͈Ò#„  !¿~MjÌ’žÆ¦e¸H=]3ÊO>Ò¯ö®!ÔBÚBD.BІ‚6„´!„‚6„´!„  !myßhÓ½¯ÈÝßÕK DªD¸ù䃖—áUwQ?‡¨ÂUË7HÑOUáØR€»_ÒáµÇ¿f—V¸*”ØýøS~Q/Û)¡Oý›–áêà—®UÏá§aöX¾HÎp HHÝv?ÜÐŒ´ö —©Ò3û¾Cw'ª˜  !ïm Ë Üebünõ¾ËÕû¯µtÑÅu‡®Vï¿\sðsÐÀ2T"aáŒ~i€ë/x0?iŸ¯Ùïïœ|"#S¢f¥yûº[„Ñ®Eá´±©%†ùEoæŸãú—ñòøe´qËÜþÂî¬K‰^YHvñÀ=4ØgNçasTÝa#vhòÄ÷T·i ©/f(÷èÐC£ô;œè1ê‹HVAZ¢áŽ=+­¾9ˆå©#t‚6„ü³z÷¡— Hõæƒ~J†88µû\÷ÌÊÎo‘6²œÝ[/¯Ôˆ4wñªÞzÜßß•ãßzF‹D] ÍvÖ|µ¦¹;³æÊñïù ©0Í+tØP|Þƒ«F³HN4×¥à2¡Û´!äŸV·ÑŒß”º0<¢ª ú>7¾°›ÄÛ£M"•êLqr´É&Žjߊ{áÒqt!&3›Éfî€Gö]¥¼-ßñ£?QXåã~ÞNìîï°GŒ OÜiʲsi0jœéÄ<mùg¦Í¹ë|UU°¹jèG”*K¿m€n³gÛUü F( ø ;ØAšÑ[Yuí<.'¹ç~ÑŠôX‘ržêÌm\òãq¶ãçÆù{®ÎÎ=‰Ng‘’† 'vHݱ©)ABþ™i»§é"RÐØî&å üó û®ig—™Ô‹vh±"ÍsQ‰‘ ŽLU°­ËŒÌHÇð—Õ‡¿Â³g~êÇ$‡î~œÌ“Ö}¬G•ÓÔ¬ÈXyrû(íô3?Ÿ°˜]?Ú×Kzq¶²hÿê½ñ Úò+hóTN§³hÔšÑ'ØêhE 4 M‘Þgx‹¯>zÄ¥]XãçýgÐX'Ä8ßÅYØ8þSù®ÙŠ~kA‹š.ò©Úc­è·T쾦›¾Ã¡96Ž=׎~YÑg©èŸË*ÈgÈSª÷Ϊ|®›yâA¥Eî}hÿR“ùSÎRòÖK0Lú,µ§£ÁVkÃ4^\3ÌÙb+¬w9Ξm3HRb´{Þže7E½y1ˆ·É¯ç>Œ­àr|êOW.¿¨ßRyðK­‡6mocJ’™\%äºgš¶²¨Ù;/WôyQ¹åçpP˜æ~!{$h(«vô$ƒ*(í_¨Ü3_¾ã¬›˜%IÝi´ÀgÛ†¹t'yFOÙNsÙ¶Q¥7‡-Q¶]€éÇG‡¹¦hjö.TìšÎiÖs>ðJ0a½>mØ’Jξ \ø”-ˆ¬ÒÍ¿°å¶î?‡äÖµI%¼šóðÝÛ*XqƒzË/Ð&xëºZÓ’~ö‰Šë»ÿ¾Â([Â]¸§­Ì´Úóxi²å'²e) ñîÑ–DÝpB¿ð’ìYŸgU7IÄÂPÈ€6—ÎIœÆv–º%üàIÿп~ÁhóX¯ˆô²#÷ë,€6¡Ň(ça½ßà“œ"w>Ä2“"$•kX@|]Ã:.ˆ™!o‰6EÃW˜izJ¦irŽA‹Î¬*“ÝÆŒ´ìÙM¡ð2t£Å¦cR¦ƒªë¦áè6Šspy—Læ/øŠF‘öC'idvºn¬H? "oŒï¿' VÉ9®m¸ØtÈÛ×̉½@ÚçØ„ìb¶Ó¦€CõñûzÔ]'#!8¬cå༷H›Ši»Øó‹xïî>}=¹¸‚æÄôOí¬>ù÷ šCºO]‰MËf:;m­~Œ)ñ~’¤]·@>m<Š¶^Á“Ú| å¯Ð&´ï§^»¡ÝEîÑ) W0^]æÇŽ8‚i,+´Á;ï’îÌU²“ ý_õ©k‰…%T'V@Fwí駨Ë%Ì^×ñ…è” ™Rº³ad×mÈb êžÔ{IIT‰“ nÓ¹÷‰н`§ M/G´¦ +´Yž*VV)¹- ³ßóŽùƒÊ*2>µZë:ZAB~m Ï o¾¬G/(ðG‚=ôü Õ9')khƒ~ã·‚MΧð¾Œfïinc·›„)Ž0€ìE¹³Ý"ZÏhçW²hÃbÐ “ÉpþèÏL·øæ h)ª7õÒ=â«i`°|˧n¨~6 *·w²]bô6’´h«h’D.QvbqÝÈz‚6„üJÚŒ,vh²aûô…”œ?„ä•AÚôX~–‘6DÀ† Ûöy3“ÂlŸ@2c•îgX¢"Ä¡MM–ŸdΛ¸R™ÂEæí"“’ù]SHœÒË£a7?:àÀŒÖ]A¢}.AÅùÛ/ëælc:Б¦/2(Ñ]vNoQ·©4ÛÅž_^µ+…q©Û=Ät+Ò^F‚ÜYÒÈš¢þOõ+V%Ãù 4fN7ú¨nsd9˜}óÕUºMXÿƒÍv/2b ÉÄW<R¸n¶tÛDé¶ó.LføŽï^Ôm@ † 7™ô¢óËÅÑ]Û7Àò¨Ö]^ 2ÜcJöÜ0̯„•aºUlŒ³Ï‹›j)tïÆI¤yË.Š$Ú¸Ú,o˜½Á!o¨[‡6õº<®8kåf ¢ðyVŽ¿°AB~+m Ö|*¹ùØ ª°T;‡ÓÆd}èMý ¤Z aÛ>;Ê p;&ãÈa %F3w›çÀ©™#æCåƒØc+mó˜xJ¨BZ3*0HWßNGœIžÒ~`Ä;@Iq%k.´ÃnÕÒ’&Ì;i˜ý]h³ÖnƒvdýĽrÓ~ÝÉÅ;&kç—=èzqiÚuDîãM¥»§›ÌàKa7,WºÕ]ÖÛhó¦v›:“žÉóô OñAÅ74˜ÊÍë^KˆŽ¶Ý)\|ÙîÂ¥†ÝŠ£Ø/>g÷4ÈÝxiØvÀS!§±™½VÜVcg·YZ@]?Œì¼¥™%oâÛÌΘɷÃXL¦Æt™WÑîï1û<Ò$É[X9ÞÝŒz»uZõÄ 8!o›6àw´¯›Ÿ§KX×<èYmÀô?7E, ï½^?‹T•©èn­p—à9ÄKì˜RXʉ6À{-Hv²D½»­cðLöÎÛ û4Ô$8»ÖkÀŒÉŠd妒y±˜•X‹›:Å¥Äs›ÊN-+\3únÛŸü+i³ÿ @–Þ&mÊÆW®`¢ø‚Æà¹Ç6·M¯ Åv4ÌüÁa’ë/ >»äÄ},o¯¦MÈö»X ¬ˆ‰ôÜèSó®PÁ¾ü„Ë"W?‚´Ù@«ŸÀïì8>'¥}à]4g¬g?¦Ðž æõ³§Ÿü&<:”Íd4ãVbq× š(®sWEÎ$í|*%+EÎvIl{ˆ¿âä'l5fÇm=JÏ’Á+¼®›z\X_Ae{wØÛgÚò;ÐÆ“F+@íúÃzê&ÇêQx=¯4Ož¶ËÕø×R>/–û*Ø"F¸Fâ¢ì²Ó†Ó×؆ºñ¯Ý<¦È×ËÏ—Á“?…z»õ±Ü]Èä{H\yéy$Z˜fÝpë3!TwnUÆZú¨.v´ùšMÙ´š6Mt¿b{Ú¸SÈ4‡Íå¡ÂåÅìé»Îut`°¹¶‹<6‡Ë—W릟›l«Û¯^×NÿÄ¢ÂÉ#v=1!R–»{m¸|1Ú°Y4&‡³ü".Îôk:1î@’µØõbð#ÑO$,˜è™±²I\‘T –Òœ˜oáq,eíd¥ Âs‘ò]¤…ÆàʳvcëP†Ùç‰ql&•L"Ñœ61¹âЮÏ0%-.*”Ææ \¤\.‹B¡ó¤ÁÕçW/~™¥—«ªÃb hCÈ[¢m´Ë ÖÐÆ Bàžx ~´ hx@91ZÑMƒñ /çÐ8î™uÞ6‡íiƒkï` W0[%žøzívퟦñôWfØãË.(XÊV»htôCŒöbÅS~Q^w³ô•÷.élÛ V‡Àƒ—b!ð†õ^´ê+–A1»NÞ ¿j›ÓeóÎJ:ÄnFtÎh±{…݇¬Õ#¶£ê㺹ñêÔô£çÙ$‡¨Æ¡âÍgü½Åâ8ƒÁ‚¨OÌ3©”4ÍéB݆#­èÔpsnn"Õ5>·ç\nc ÅYxÑÙ­ÈkNc2ùŒ€Z[ óˆÒBwv©y‹´± ÉÉBßÒù5e¢ÃÊådYi¶wé±^Ë×ü²OÛu½ñKL:¥cn§œY˜Çó b9²*Ï¿¢pÚò¾ÒÝ[îVRQŸ®ž{mÊó Š‡ž$Å„zÛhc°.*…” ÂžÆ1Äh·Ix£ZÜ2‡nŽè;ÐÂ4—‘œ‰[úy=Ú‹Û5)t¹FkETá!åÇA•fIˆåûæÙ,hÃàe±™´¦s¨Ú@48ÀT$‰Iœ3vRع+*¿5¡ñpšçºîm±šËˇ•W¨ÕiÆÏÁoýù›)5º¨"]ÉAì°ò%®Íî¨üŽ¢C÷ÒRWhu0+¢ù4.»ˆ*ªÒ˜!Ž‚üYi»ïgo¿Œ6ú¹§EÛów8¨mô–E•ˆ”ol……CІ÷9rÁ84ì>NãyEVRÏØt›DÝÖËpX‡r‰rÅi£G»LBTˆ½n£7?ήë h²Èª‚¾ÏLØlf¸‹…a¦PPžÍò«í¹øXAÙ;h;|sbIáuLÂmÿ±)•a S8„ªï¬ÑmèÌôX?qhÏçz4ÙŒôˆ°¦!á‡L@ýÌãp_®Kxm®a$1+Ì ½Þpt'™¤jŸ…‡•gÿæâ°)ûÒubšîàÛt8·c—ˆ²!¡ï.H*-EÅQdåNE%$‰üuëYl_2Íÿ(Ù´!g }²ó)¾ê4rœNñ뚆¦•„0/¨WQVç§Í Rœè^k‰ýÿÛ;¿&®µÿ7÷}oß²N&{ „ö5D6‘Uö}ßdßIB’IXÜWÜÅ (;!!´ÕÞ¶wiokÕZÔ‚dÞYD[½[¯=ŸÏïÃg˜Ìœ93™óÍsžsžóø%wÿ¥ÇòI›æã'aIQU•áîÂ`-Þáê Ñöh»»0*ñ¸/‚˜N±—ÐÞÛ„0„ÞÁ°ð-ŸòIÍ-¢¿cAt²'Õmy•š›-à1e)]õWà]B+*¹–Š9oñÛ¼Nrù ¶{{âOVxq°!m€~g^b]¤1<§‰ÏyFɵgøˆ˜ ‘º¤TuÀò¼Vf´0ÃSu!.¡¾a*:õ=vŒTàšyôÜ¿dü«åã»—˜H}kA›œ{z0üUúi#“•A®üóÚh‰çÓcý†çÄØ?Ex®æÖbe¾WhÎÑoí°ÀK FÀÉ&f›LnIŽxmÄtß.üW^!—»Ký9\,{H}CŠÏLùy·ÎN±®úH…L:ì.1!(¸ø*f !Æ¥p bÂ<ˆÊÅ©g°Ã–DªÐÓ+–o`ÎÇ>šfhbá´ÁˆàáYx«N›ÿcÕè¨nȃaVHRŸÉ’¤#]ИÊJó4—˜Ž¯ÉœãÚ‰R›-ÞÉbór.aPB«ëò!:]ˆýéÁ¥–íÏÑ쫆ªDIÅY+²'µ•6‹0“†I Š%>R)Ädð½ü…âàŠQ«9òÁEÙÚýSf÷9ä¹ÞLx½ir˜Ð-š}˪8¶ [hã_ûÁçÚ C™›Ç“IÉg·že´m¦½6m6„-WwLV¾C}¶œ»óhÑÖʬ? Û–O×G¯Ýˇ¹d  ˆ\´´´´´´´ú0hÓ¤­ K,ÀžTˆ‰ØÎKÑY ·, ÿHª—È´üúá—¿vÏ0Ô½æÊŽJ+¨»ñü¿ã‹3£ŹGîÚý÷Ò¦óÂx¾öj¾öZ”¿;/V] »–¯¨¼ø½áÓAWFd×üû^È„ ŒÊkK¿…[Ö[Ñp«Ù²½†"!TvåéÇ7‡îV°ã”_Ú}=©œ(/añ²±¤N›(µy)£VŸ\s¬yÚ>èÜmú)¯ýhbewñÉoÉànÇ×1­äuK¬>Ô8¾N£M?ý(·åPB’c0é¬d9xÔv¹þ|R¥>·÷6~Q3šÛŒÔ^}Nr`¿¾/ïÈÝäã„êÃ:Óã´jMrýi•U]6%UhÒÕÓZ³},¾kè‹Œ†Þ¤š#û¯½ Æšmûjô*ãJ~ëÁ„ª•—2XÐâ†.•S”o§MÅç%ÊcØí”_|„O4Ângf)¯õpb¥>[3ŽaJG\¥ñÄÍ”*$¹öXÍõe<[ºÃsk;q2­÷‡º¾ º¼ƒ_éçÑ¢Îà Õj¯/Û§MšVŠT'+tªa >õñiJ•N5ED²Qí5c\õí>“°\w.±\—©ÔÏ–ˆO/ÕžI¬è®¾¾µÐ胥 •å,Ù×r&.9‚åø´Xã|7§ˆÒÃy'¤|ª¢mÎ1*™})—P¥ mù]gƒ|Ølœ6Ó}OØ58[›¯¹,ÆhˆUVSb¼Ü#+2ÚŽ‡ø³e…Cˆõ—Ѳ?"ÇÓ“ùeŸ#ã£3¸ò´Ò£sñÑ2(¤* µ«ò„Ñß‹Ù:‡Ì¢í§/0¨¼ÄæóYõ]\ŠkÞÀ*v:ŸûùíÎ@¦Ê4=,'JÅÚxà0ä*È:8Ó4¾6p`@HtåÑôÊ:è·’OQýìc_ÎÿùgjrÕçwGùs#bmª©‚$‰éW°«°)®ù^8Ƨ׷+زŒèúÊÙŒ]a!ŠTÍdIs…†G¡š—å>do}žæêž„†G:F* uá199'+3^šs²g~-6˜'ŽkÈÓ^ŽŠ g‡4ØÃC°/%¬8WsY¡ˆJ`@ •6nÎœŠ)„ÿ;)ì0¡¥)"Nò˜ÁŠbVMïЪ[d§Ã˦0Ò¹2„ßÖÏ=äÁÔÊkËuåI´ ñcmÓ.0œxûgQõ;t¶§–°ô¦¿FçhÔæió Ê.›"Bo^cÑèí“øöþò,~ÆÑÞE4Jöq¤ê0 ÚûJ`Iö©€§œyŒ¯ŸcAå¡P¢öo†‰Eh—x‡ž”ˆ½çðwøtw8×ù•nz¹îÜ×úET;óJ}óKˆÍë2¢9 ¤|»f)o>VO­9–ÓÐÅ“CÅî²æ;õ 6_Öÿä¢í‡ŽQDqÈ"ñg^ò˜¬ü¡Wµ%¡ðžKøåyÔOøIÖ©çí¸y¤õÞŬÁ¼Â£ÃUX ŸñXn ·ð˜²îÛ«¾Üm€>ÜžT¤zž˜ ;qŸÁà·Ì¢B6×;Â;8Ê;8RNw¢W;X ­ýgaq¸ÝÚ1a­žQ9ø29:BRñ)a˜ûIâúɾ«hûùK°(Øq½,¬½ïHݽ(™œ‚(ʼ÷Ñ°?—“Øw`ñ±„ºKU«’4Àbâ´áA•×—Ér ^¼ò^÷›h#„Êž’GFÇb[1P¼*¬©€¨t‡Tè!9|5ÞüÂGæA¡óå½û/ᱎýGŒ6<Åyr[.v;ô7ì¾0^pþ} ­hkæEwÛ@VC8Œˆ£Kzãl §uE.¥Bû°‡\ÖP ñ=e!øƒõ‰äÐhqgWéÛl³mÒþ|¡L@ ˜6v/ñ:m¢=Ù}Kd uF8LËo;{ ‡èÉÆh¶ ¸ôÊÁéq ÷¢2@Û0÷ÐÃÙißÚqiˆ%ôEˆ#íSý ÚdyH¶ýÔÎ&mÌ´!š9I›¾Å§R·2†Öcº é^§ê­´¹²N›hŒ6Ÿ5ëõTQ¬ö3ÜÆÐŽýbã´Ñ ˆuŸäT×rŸ$÷|·Í¶á).lÒæÈ&mr.¡Õíì°Üž92~aÅbDy†]ÚOÂÍ9óczÂîà†Qì‰U67ò¢ë¾ŸŽ=1dæ.›NÃhƒ;Ĭh¸?Ðè÷C›†ê†·RC3þUþÁ»ŽáEêÁy:˳Œ£¾É†ðžT‡ºÔ—§&–ûëº8èFóiµ¢š›_3˜‚âW¢;ÁmF48ˆ›Ò¯¡Ÿ[â|ô‹´éYD#á€ü[d;¯+.?{mX΢ÆmñׯӦínuG+?¢¢{ÿ´ª>³mºfÑ¢}¹ø• MK*»â1ú6Ú\DÕçܘAä-hÇ¿‡ x?±tXKc’ ð¦hWéµ5|®3ܘa¤ d|™ÝzA5½°©åWñ{ÑÏÜRAO è¢MÑiC§ã´Á~ Å"X—ÄfÑc” [zC¦µÔh‹Å PD²8 |>Tqm ± ÑrŽ88<1M£F·ß!£ªkê÷Á,¦wx †÷ü;vzue&å»·Jïí-Wd”Ü&h#r M€#m0&h‡E :ß'68B±Ý‹Gl„—ªÜÚ“²<ñe¹pÅò¸î·Ú6LÚðñžÔ°™E¥zEyIøá­ŸÁË/¹¾±£ˆÅ¤ùDe†ø2©‚Êá-+´¿•66Í/ˆ‡¹¢°”|ƒ)˽NšszËB˜F“¶h-öé4ùE),6? >WÓøA­$KrwC ¦¯"Ž…DŠã:¿´úh£YÛÊm´i°=ëÛZrÛ¸¾M¬ÝýMþ»ùéF;É·”ÑÆõPîÍ=ÄÁ×Ý(ÄH¾çk[‚Á ßv#]Û~ƒ¿p$vÝõ’gmöÇlitØþ/ýŠ¼‡Û'ïe§ƒ#nÓ~îìNÏÐD.È @ @ @ @ @ @ mŒ6Ýè_“KS.ëŒàÑÚýiƒ3ái.×Ç>ªUµw9Ï·@oÐèŸA2øÄ9õJ¶(K¿B6½e%Œë´ïô·, ¿þCÉKhôŸ¡Ñž5©åü\|Z2“ãQtXINª1¢Êþ aœþ6šŸÌ÷Ì7¨¹€m€þ=¶f⾿7[袵:æÇC#3ü³¯"³hçÀ(Ä÷]O§ž!  ÐûЦkôs.ÌMTŽ·Ý|¬'·Å¨b˜ù’ïì’Ö¿éÊ_š/& 2ÓÖÀÓ´z_ÚඊaMÏËäq˜ÒøŽÆOHÛ¦º©†ÅóôúÛååÉöQ’AàÚ½¯—ؾtg˱ î|º´\wUÈœ£Úÿ²á«ÑŒ~ÁÜŽiГ´ú猀ã§W4Nº¹¶Î9ŽC½Šrgø¶ÿ<@ @ âì>íôŠzjõµ?c;Á88  ˆ\´´´´´´´ú hc|•š×X0ðbc~n9)«|ÿŠ˜ž&dÔÆä6DŠ)ÖæôÌëÍöÕA‹šzbòcrT¢G̨zÄ“×ä¸wé5ÝÜ5ь݋ÉÓiM¯öæÕ´Ž­!7FýÚ¹ícd½·ÉI>6ÄŠêM¿r ¹1]?Õ½YvV?÷ßÓŠ§žEå¶*ßït3š]×TÒO,¿lBëûô‡¤fו õ­- [³ElÊ„6@’ð%£m€þ¥´YõƒX1'6Óa¬=©ÿ“7€L÷EÎ.òÚ Yíg0¥î×zqœ=“N“ÃRñQ™-'2šÛÕq{o•gaØ#½éøÆþt•IgÞ‰6·L,(Jc¶ a—Æ[6ýEÄ•“§±:¼Ï³¨zè_Nn—%‰2ûøU a-NWD(-j[j½3þ{bصL^Ûû>‡ÊÃàDí_±mIJ¦RŠ&Ð05ÿ&Z™é)mù›~ž$¶mmÊ÷{&\´úÒFø‰Kö ‡YÇÓV6óCÚÈýª®¿ÞŠqÚ°ý4Ž1uÐ0•¼.lÛ‚jÆ?gГµf”Çpjž@ ÚäwM=ÈëèÏVÝè4¢šÑÉ¥ÅlQ|fë™–gež¢¬·ðì÷º ék×ðWY­'²»F”Ä›¯™xÕq^C¶#3ê'a–^~µ¾½±î‰î¶œjž"V_ŸZÊl?×>CÜ‘ée^ÇéÌ–‹JbŽt×õ»é­WÕfV]c÷³UåÊþš[¯È TýuןâV“y­¤ãxØýÖ°¿ŒYm§ ÜEn.d¨-Z¢9ëgž•"—3ZOZÐYì \{ë¯ùÊ3™mg+Î~G¤Ó²!´öð§­gª.?n;7\xøÝ&mð” -gÍ9í§s´#Ê©íqjç¯ç}Ôzv:³åd~Y»6#Vo·a8WL£uå>~†3äyñÚÁ%ƒÕ¡4’6I×ÛÏÍd¶õôZrav3Úvq>û:ºn´Û¶]ÐèýhÛÿó ú>[–¼6ÈÔ"›Ai·ÓÆ¿f¸×!zb6à´™E+k«ÙûñLsÝ“V¦K`Çü:]¯\£R9±‡âRäi šT‹uõ槾"ª,¾6³íDp€„¯Pb=Юá9†+%¢ÈÑ ÷€]¢Ô÷0à”Tf2Eò”†£¡¡ŠÀ8iÆämðÄ 9GDJóé¸Ô4:[Þ<µ%¹L£2Ší_â—a(?xÓÏ n¶ê­›´©×#âh VaõÈC VÚäåÔšaëwz‰Ù¢Ð¢’ã÷0Ô#vÚ„ðý ½¢+R÷«<ØÔ=>³¾³šÉLl<Ÿ•Ë€|ðü_F@ 6ƒêFß”+ƒºËN'—ÄÃ_×»WwînÍI“¿ÐE{j½'¥`²`˜Í± †déÃvÛöÞß»f]u×~Ä øÞ;[µ¸ÝƒÑ†â̯Ÿ&öN¸2C5 hóý\¯:ò_wnιøöYvdí4aBLýÞÅ*#á,öV ê-⤠b \s¦—ÚÖmE+Ûk½âú°=•eþ‘½7áÐ~ì.ª³ƒ¤õw#ƒâ´·±vΩl(1c–Xf8-âÐÏ]×X¼\Œœº¬ Î+÷*­mÕ*9Ñ­Ýsv?IF¨›gñ=òwo 'Í[‡5á¦Æ"Šw~¨áØ Nõ,šÉìבfÃY%Í%\µˆúñ?Ê<¾„‡ÁZ–ü 'iæÔ¦mczÁ…) £¸eˆ=À½{½µSŽ ¼šÕ{Ø‚$ò–Õ=ù/-²`§ 2‡¦ïE"O__t¯’m?w+(4âˆsßÇiS*ðÍ#(··ÇÐý#ó6î®ò«?뉫gfæ^C€môÛ6{ÎÙ6’ÛúbEBýƒÝoãâ*ò —ø…Iü‚!;¹ûsd½×Ù6u£?ÛÌŠÛ3OÚ6çX0Wâ¾!ŸÒAÌöÀNܦ×iãÊÎ%ü66ýˆÉ槜#m\¡µÕîÓö£:í½°¥(¬Õ§Às²uXéº4ÂðÚÛc] æpZf–a– cH€ˆ[råi§¶œ|²oᡈ­¼É ­è1=Pm˜©6½Ìf1;§Ðø ¢¾îìÚ 4-#*²ÞJ¦$FL?‡À®1gíI¯ÚÚ©RfÛdì‹wÏ;E¦ÿÖ›ŸIÝœ“®¬B”ðc+öîªé3¶+­Õø@èê\~ %;AÙ)‰Ì_qh‘çñ´}ÖGîP°ò†…å‹ßšq-B—Œ¬ ¹Póšœyòq¨»Ká=‚ £MÛ5êô+â± Íq$m²Ó…YÇÚ`5|"qqN¼´Æv 9øœì–f­lWJËÌ#‘«SÙˆ6™ñì-´™¾Í¦Ñ•f´{a]–-^‚6'w¤æì9f@A÷6çvM,6ÔÃL¦X^Ð8Šc›—Xu §ÍÜ×\7—¦‡«[·&+´ú×x‰qÿêÌfe¹¶ßÕKŒ½Ïú¹­2ïdÛìHIÕ:mxYgí´¡:ÓJ‡‰ö>2OsÕ—fOO‰ŒÝdòŠ»Lh÷ìm-Feµ#(7]\wRyû·¶ÐwO÷1fÀA-V (c(3¢šôtßn~lK‡8mŒtUµ´Æú´\ƒ=ê5f´£«,°¬ÍÍÐâ]¤5ìrX±YršG–™¬¡\âN“á=©]+7«‹ìÙ )Tq“-ËôàÈO˜êÔPáLÍmÔ_ðqêÁ‡ø-¿Sœ·ô¤ÌkB.½äò²ðêÃc„Ç »ÍUÒþFÚè¾+ªÊ *øym¹ÅâôˆÅÚ];LÌI°iw“"i£³¢^îÔìãß“;ëOM6“s@ ˘Tç ˆ!Æz¤ß†%ð{xxû“r—†×›v¶m~v í¼<Áœ€è}ª4ÎO Ã*ÆózŠ8ÛÏKšR,âÐÅ %î 2³8‚.£­®(HÖzûÉnm+åœÙ0þf2™‘Çñ&£½~†Y‘ï“åd$1(.ùƒøvUg“ §®{D'æ1ÆÊZqnÏŒ…G£úôce6ö`z'¬¨êÚ$‚e±%>žpzC2nÛ˜QÄ‚ÆFørž_ÅW:¢nÃ5“/ˆÛ\ÖÌØÈ.­«Ã4é{YVŽ¯ØõÌ åþôÔãϺ¦_©ˆ¶ìÛë°Ã"EšÉe¬þëÁþÏ•c/És5S/Uø7»D<0ôû‹\ h£›ÿMT¦¹¯NèNz6ü%üHý×È»LýOÜT<зˆ&¾âº2ro€È @›ß’ú;?¢eè~-Nkü9»¬fÒè4FXù¥.ãÎÆÃOŸ¸+g2¨LXœŒÜFL€6@€6¿á¾Mƒåõ¿ºÑá>p ^%ÄôεÂNÇ'ZožhhhôŸ¢ ¹5¿§î†=¼Ú„6<_Ù‹˜ÁC´zm´ßBÝz¢p|æu_É%bœM?ûDѽPÖ {wûk°:Lê´ú}ÓF;³š¯¹ª™~PÐu¡câf¢t Ü-Ô^É×9†ýbÄÀvG¿/hÑÂâý>÷5RÎO;ú„$OÛÉ ,ib³6“ÒKFoþN¸/¯Ï¢1¿CÐèC£Íô2‹‡yK"óÚÚÆÖštÍL¶4nÿ‘¸´L$k˜$c‘ÐÖ‹‹ i ®4,ÿ°fŽH¦9ÿÄêÑÇ£&­hv^¨_ÆÍП|i@ƽã1£FbuN®¨'WÖGÃ7ñÒÖòA€Ðè÷F£­}ø‘}ñðYûjKÃ?¶?&‚w6BÔ·~Âc±‰S:‡¨&×6»HD PVæÌÎçj§_¶ü¾@ 0—ÐÐÐÐÐè}iƒGYq{2³ô,Øß´&Ä‚öܶ„l¾Š¶îÛëgÝÆC«ÈåÈã‰bm›3Íøaoò½ùm·éçÑî9™#óÅl8Žl†´ÇŠ’Ån—Ã9^Û‰íÁê‰×p[@€6@ÿÚësâ³…/^¥¸'ôZŸ‰þø*… Qh.3yþ±Sx:HâÈŽ‹Sá‘´]tsú#Ä÷‹­>¯Ÿ·Oÿ â²(n®ØYgŽ»Dñ%qJÓAƒ+ÃKeYÞœE++’\yiÆ_r¹ËY|õòøp—¸#¯êºÛ!÷½Ã:TÉAB~é„æ@­«Ó'TW'ª‹ÕÕßpýíCfW¥.N”]\åôúD P#·èÿÁ'å žÌ÷µuÆw†!  ÐiC¬‘Û=·ZÖ;ÛE4´Ò†¿ìëÓSOJê ´g·a”ç/sèW_‰= Á.®Qu7tDr:Õ€%@ cûÈÃÄïúˆTS]C_FíöeËò5<º35Ú]Ác©lúé?±”ŠëÏóËòÃóC7„¢ãù4­hçÀBýõ'x’Ó7|ª_ÇZקáÊ’áá#®šÖF¦DºGü»`_øÝÛʼ¸¹ö{aQ:—çåŸy+çõÓrùñ{ˆus*5  лӆÈÂ6‡ª†þ–Wß 1`YÊAí>ÓoO€[Ú%¬íã´I¾b'¶_Äu­¸ºŒõS¢#}| /tÏ­¯V¯{ù Ää³t0ÚÈ‘/‘u”uÏ?÷ç|¤èø;Ž©ñï8tfá§ø¥cüXÞå³xd–e%&V±=“;FÚÆVõæ•Ã‰ä[í±›aÁî\Ixé…ÇøÔ Ã}œÝõØÕßH›õ=õj5”¿™\‰ M¡¡ "2¼Ìâ¹ „4EV™ß›hc~.ßÊä¤iÆ;&mu´´úõ´Ñך/.Æì …2EÙ%3ÎwOßeÑå] $mÜbz¿¬?ÿEÝÙ;™y{܃ëÕX ]xåÃþߌc϶¦Y cSý5?n§ -•[+ÝÓE¶âÖ¾:ˆÛqÊqBT3d’ܸê1-%gåpY ¿ }ýU<{T×胲®Ž+Õ38­ìÊ‹n«Ý ËÊßQkÅÀàÀ‘Dמ¹½¿‘ÐØ ¯_¤Mñ­e>Ë Ÿ,Õÿ†_[qMé›hƒ_ÑŒvÏ<Ü›œÊ¦ÓB 6^ÿÐÐèhÓuÓÂ`Âi¿ížßtM`¶J‹^+ŒkïƳÒ?•¸¹ da¿PLž²°Â~õŒÍ0ÿ“'ýó.­m)ß´–$£Jª¾Ü‘6E5yâè&rõ-Ýìj¸'›Á€ ®¯lO2‹v/¢Õmtš°Å‚Æ ?E6kç·,’ƒY#¡B—B"Gèå¾!!óË´^M “D¾ÆŠMÞ§¾[XQôFÚ8Ô­çZRWA¡ú¶ÏÚÚýjÚ`šéŸá¾0ÓMQu­sü¥}¿MËlù _t½'E¶t¬Ï•ê-.À ú8¹ûûMVà¼ôeÒ䇗w Íš–.õK9¹‘ÀQu±)ºŒžû|fõØ£´ì$:“#WjæÐZM_Àƒ<«¯>ÔÌØßsíQ:מváýzRÅÃ+úOOÑÙºÛ«žL¨n-xmÖë6úCB¢‚qý2içmm€Þ-rðK Åõ\6KZÜ8òR¿°æÏr«'Àý6D£«-”S¼u: šš²‡«$×%&Y¤º>Ç„…í³[ü6äGúñŽ“sê…ÍK+Ïw³ ˆ.‡Ž˜jÐêë%d±=“t‹ú¹lkħ#ŸùKÝ!”¨]ÄjUS_æs‚Ì üÞ´Áè)¤–wT±Nè-¿@›ÎK!—Å–eú3X Ðè}ǤlþXÕÀ¬Ä·@3©Gõ¦Í1m´1Ì?ñMkþYûZJÇõé=6íìZNIjúáû±Ñ¢¤Þ‡$ýÞŸ6³hy¶œÅtË<ú¶íHž,Oék²KoùAYÖ:º¢}sºI@  w™ocoD¥¥Y~yçÈÖŠÌ>ñøäcJŠ/ Ï?ù-Þü‰åˆµÆ•¢úF‡É Ó<#Jj†^lŒ ¸ ~ É¢òKú¿Ónm§Ês:5xÓ¶Ù\’âmo¸ŽÈT.t‚Ö«ëQžqŽ´I  Ë'7öÔuvÐ}³i#£ºá´±f™N¾¤1–_šë“z§M’N£à•'Eqn¼µú‹u´zç¹Ä ÑèÖ³³!ëÒ™PÝÖÅjHðúGûw8kËL`bËûÌš#«ä˜ÕzË*ëÄ¥7ëöÚÚÙÍúàËœ’E­ßÈFŽÓlm€@œ        x@€6@€6@€6@Œþ“óÛ endstream endobj 957 0 obj << /Length 1475 /Filter /FlateDecode >> stream xÚXÝs›8÷_Á#žITô¢o¹ÄMÛ¹Kr‰;77½Î Æ8fŠ‘ øÒü÷·Ò 0˜¤yb½Z­öã§Ý•ïÑ ¼ëÙoËÙ»<ôb‡,ô–/b^$1÷–kï«ÿp¨ò4i’ù9‹”ÿ¥Î*¤®ù:›ŸÓÀ?CÆ}VdIáN¡óoËϳÅröcFá°À£¨\(ˆ¼t7ûú-ðÖÀÿì„ÇÊ{²R;O„ ¾…÷0ûs8C̘âDZ ¦$‰¤Q&¸ LR£ìݧ](¼+ {Щxè” !áT¡SE³Õ‡Ç-K•Ÿjý=Ïjü‘TuV6Hå¥[rßËåRÛ,YC@ ÿYœÎV¸ÔNË.iRw vkÍ6Û!õ”7ÛŽgâöîCÈŽà,"à,8oíß6Íþ_w¸xF$f²•ý>‡es*ýç'CêjMà¨8ö/ß Á;ç±$\ÆÞ9¥$–÷b0d€ÆgküጠŒÍ+$õœIÿ©ÄgžáJ™ì²âyÂCª‘áÐCLÌ”‡¼•%èØrà?wð]$6èJúû¤jÒüšP!ü&YòVY¡ËÇÚ hü&ø©õyš„ͧÇæG@3Öš´š³À?læÐÍdŽ'¢‡„Ö²5È! ÎÜe€Ôõ+¶9'F’îxHɦÇgÌ#z\òYÀ b˜|{Bº¢v 2G'Øõ¬IÁ®"ÿ§B¡Ÿ×øMP¤ÞgiþO°Ù{]5¹½‘KÔ±UöãÕ ruÕ2ë½.±òÙÄ­W.‰hüÙTIÚ8 rwÊ.Ûéêym“y„"/Æ0Ò-ì¢(ÌöÀßÃ}gÿËõÁÆþ:«Ó*_Ù«M^ŒW°`±Êpç¡n7ån%Õ»U^&.> â.",%nïIÀÝnv"uþ*UfRlÄÜK¦ÞSÁ`o‘»Îë&)Ó©KzÞŠKJ¹žºýQqW²Œ_`ö©Ju5ÂV'.  €¨ØÈûw§×Y€r@?‡®Tk\1x2~š_jÛ3²uY8jåT` åL², ³†bæ6 /¥¹Ò!ü¿çÔÄò€b6Ɇ°]¡3Ý)IuÙ˜¦c¯¤Œdm;¬Â5VÒäq• ÙàïuÞKŽáP«÷iØl©ïÃfÁ>ƒ$Bô0‡›F e¯‚ž|¼¿ÆQ f&]pM8'*äG5Ý•)«ØõöQ’SÊA¥sú/S¾¬Í"¤/´G¥¢AïèÏÏ`®[Ù6æVyïº+™’ 8Má2ß½®ëÜö kv[±»²/iÐ,ž‘gPo ÄR½G–ÀÚl•u¶›üS РÂa{ÀMÄ o3§lê6›î HÆá0‹o#r\gÌBÆ,%¦ÒÖq¥³·wHØÓªëBk×zTáj}H[õû©”rIBF»:“íÁ†‰>CæU+u6¡"*‰ FW镺% õO©$V€Þl꬙*V ¾YO©S3>Oè±Fvz^¨Ÿ!QQôëúiL’£¹‰*˜ÈÅhnúÃB°-5UæR$ŽŸ &FÕÍ0׋åT~( Ä(%&Ž»Û‡I%! úaé%-]$ï¾L)¡ññTüKS>..®¦LQ$Ro7åjñûb¹˜Y@UoÖ³¼¿0·ürJ¼ø ^_vìönùéöæaÊ&A” o¶éòöæfq9jÉï³Þ!v jˆØ»y$`jŒa¾ü8å#'T+lØ—¹ÿg²Û®—ÙRâxdZ[;"K7õKn0¶]ÑΘïû×kÿò„‡§}wÒ@¬Yû¼;cè”ôÓp¶b¨ µŒVÑâ÷ƒv9~QKx‡o~PO¾ø¼Ö©  6º\ðã]n“}Ó¾ý…ný7p(ð1yléÿøtL endstream endobj 947 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 381 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 45157 /Filter /FlateDecode >> stream xÚì|GûÇ'ÁÚR£Pwoߺ¿u·?mßàR EZ(”"m"qH B ¸Ä…$w¹‹»»»çr÷ûïÌíæî"H¡ÚÉçùä³7;;;;;óÝç™™g@`Z£Ol-.#¾ ^\Î& E­²*Úü”µ\¸\ŒKª÷¯ãåÀ¥OÙ¯¬M/£´qª&³b¹pùób.¿~YÂÐù ^\ú3¹mh%§ N.œ6\8m¸üãi3bqܘnY¤<‡V§îze4G1r‘R85j¡rÀ,ƒSôÚ…JíUCçŠ!côSc2v±p¡Üð¦ò1‹ƒÉ,½¤(É<…^â±dqr2OIzȼX²0®ðÙìZý ƒ»ÌU’ùì@HKß\Þ»)Ñÿ •d‘’&Ø;—Þ´1—ž¯9ßà [7bn¬ñ‡r¦†´hÃÛ„ZÕÞYÀŽ¿ýEødd!¹e­B…Ì©Si4(/¨ßàÅåù‡ÊÃdzicü6 è7CvA—ßäҌ₾+ƒ©ì£“ÙòÌ¿µ¥äDhqB¼kþ•OÍž] "CÌå&¡]Ù•d†|ì/9i¦ÿÀÔöhOù5 !·Ì~ʾ—7¥kk»ê¾]ehi¥¸Ð¦c’P <¹Lú è—€¹âæ?>mMݤ ì6;ݹ"*r:³ûv¢ÌŒ%m vqºJ5™+ýœ•D©²]IÓœOÐEë­À«$RÛÕmÌdÄ£žä–ˆyí$áº\q¹pÚt¿šÉ±­Qy´üõß iì¶DºÇëBfg_µæˤ7˜,TZÛ¸žy0a„ÿ&RLz¬WÓºÏj_ŸiŒiXã^ÿ,‡Ñfì ™îò—t?…PóÍäÚó¥6íMéê%H“’ë7Iú“f û§LwÊ´;…îG“BLäºô»óÜM›Yrƒ‡ºbiÊ÷ë2t6¯£çÅt¥&dÛTžÚ¤Ùj‘,´ÊoeMõ)edªÌàýê*¥Í–õ“ïJÈš51çE›î”ÚdöløÝ´éé¦öçt)ñO¥)¬É$M4­Âß'mLbIÈf馋2 :ÈlN›‹£ »DGƒv*Ѧ;¤›6â+–ýyh†ÁËLVÜ ‹Œ¶#å±uªš¤Òéí¶'Ë3»ÀbÎVÄ4w¡¾%(¯MÐÌßüQyÝöüœ:u^IÓÞ¹d‘@›Žeò΢’æz ¹¹~ ÐBgÊN–tª[:N¤5uvéBžG­ÎÔ@“›×R§Þt¤å£M];Ém–¤…ê$Iªü$Òt~SP¥Å³‰¥Š™ì6¦q4þ÷2©Ÿ'™þœÇis^´éjê8“ÛÃ$:·¹QsÑ´¡o0^h¢ö;=TЂFÍ—TZdt+W uã–-ªêfáOkUÓÚ":Õ¢¡ÊhzôE›ç¡,HulÛG/Ÿ§Öàö…±÷5¢µfˆ)UK†o.÷ø)ÑKÓ4Ig²h4³XŸV è´1Z”ÒFUzZ·op«CCµ6Á‘¿AÝ<àë˜ßJqÊ;‘uD(ŒÜ9?6¢U=ym¼ *Qf4o¶M¸·"žvq–$ ¦Ä µªŽ¢¤ æ›ȺR!ó.§6b½`}´eªÔ˜Ÿò -©Ñ‹ã\Áý6Ue-Q¬†$–wª——+È …ÜmzÒfNzg}8£ 5¯bïø)e²{qD…Prš€ pú£yì¸ÕÛ:Zž1´­m"KÈæ4ò+“Mé´ËåOÒFCr›(²ò[Hˆ¬ˆé«±¤dqŒ.Á¾-©xŠ—%RUŸÃ ±ùœ0çE›¼„Ê'6§=ÿ+•g7§ëø“´iòš„Ú“×RÖŽÊ´2ÖÞeä›h*Sb(mšñ?ÇÓZ43IÀÀsóUY>vC6Z…Z±¯E±¥küKYqPÐ ºn›½IÙ¶÷pVw¿¨cÌV¨4xúÛØ E™ÒÅ 63±øh¡ü$°}ƒ˜ÿ‡¶Ÿ]·ÉK*¨èÔ|øƒRkàüRØÙ”QõÃAš‡å~å*h^ŸsÏ®âöªFáqF®)@k­Ñ,ùÓAí >idj\¥¦å«ò¸°b_ õ½&1×ÿœ‹ÖÎn£ÉµJuHìZ6M#fPèû’ÎâV¤r£yWM¿M _ÎË[Ò_Ýšþüæ”s˜ñ+6 Yn 6¸®ËÓ‘&3$ãÔŒj¡ã7 ˜íºNg õC³¸ÞžtØÇà­]bKJC¶§“­édK:ù1Aû.È’T¢j'3åç p_/k%ÚÌÏ ]=s¸nó·ZR‚®2cGšP_Ù’þèú­.¿y°`uÆŒ6¯“h£yb¶ðÑÑæ„‘‡r>³ÉÖʧ6ÙcfÅô Í8}Ú,‰µ(ëTìK+ØŒø`ör…Xÿ“Xîók;mNŸi8$ª R‹´´Ì /þÈZÌÃ'6ٷΧA#4/Í–™gi¶1.}›‹–J²¦¤)VH(âY@ZÔ$¼”¬gÏîXBËiÝXšBÕ›£%äHMj™‚€_´éÑosÚ˜È-MÌ« >³ËÝW¤Îî+û6ª¹:¯ök« ÖKÜ“6dvràt¨à#ëœUjyp¾pÉ#6åÂw¡[îwǪbÓ;DÚÌP†Tt¾²JÑw/ñJ:’{mõ‰¹€o@ñç69»’ÚºŠ*ií2—X•.´£†ÜÂî’q.íTo­ž+fYDKW›zù:í)ÅoÙª’”ÊÏ-³V×£¹yü<9í·ÑÒ†Þ:> +ùÚ¥  ¦S£ÕmÌâç´<°ô ÕmTL_ןŠ8쇴UGˬ‚+Özç_g®ÇL3Ùè•©Ë— Éî¦ VI™¦ýZIB*Ipý/ÈöšìÖrPŸ›@üËÈá"²@ÆQsž³û^s.\í¨7[Ààóƒæôšì¡çvý7õ·ëü­Ãç_èx"½jÄ|> ÉiÃå ¦IŒSšÚÒ3ÕpŠ¸ühÕ›‹‚fÈË:šF˜þÕF„|ÈŠ´¦ :±jœu#*KŒ.”6›ËÑ^CfÈø[æ´ár¥ÓÆ„M’ÔŽÏΔŸÔà•ylιI*Ð<`jŒvšºèïܳ?-ESˆ¦6•.1× ÑS3»§µËnþµ¨º´\ˆ¦¥xÉLCßá™Útdéh£qÚpÚp¹òi“®Þ'¯Rut&ת î|c^ÌókÔ@¨¢fÉúxKE+Ðu@Y}Çì‡,MDV]i~­S\³óýÅò¾ÕŒ5…h©ß“ÝnXÕ øûe6Õ7î«Ótvݽ@!¯ÈÈm(lS7Ö鲡+RCó;Û:ÚÝ#ËÇ ´)*.ëP+ŠÚ„j¿Ó)UË™ùá-ê.MHj£¡Y>3»âòÕµ•Í±]öÁMhã´á´áreÓ&UU@'cS%aA¢&=<ÌR”¯/d½(Ë ÝfÕCblR» “ʵÚÅÛ‡[+ Kûvíù¡Ð¼ó-u'yÊ¥-FL‡YS¦9nM§äø~g¹7Sn™©ñ9˜&è6:ÔT–Òµ¨nõ„ùÔãf¢{-ê*knدBšm7›ÑgŒ–¤é?1GþŸSí(-Ö.#³*©ÍÕœ6œ6\®pKÊÖ+rÃLöΡöÜÄ<2[)ÐFì·YIi3Ò”Ñ&MíyH\xêÖ_ ;ZúžêFiÓ;\S“\)ÒÆLq8ð‡rw³æˆ•¸¾Ó‹JNN.W#mÊKj‘Ž6#LEK*"´€-u%{ı¶¾¦¶ïç³Óf†¢¨ ïü¨ÐægÔ·ñCØÀ÷ãNµ:ÚTö ìV‡2Ô7P§i!pN\0ù[ùôlMMhºÖ×ø½àF´pKŠÓ†ËÕF›YÔT >žÿ›ãÉü,¡î-sϸ@fÖUÛغeo·öE€…²ï»œC·‘O>U¯©k2³ÏšìZ(ÔìvÐÅïÙY†¶¶Év9×ö¦ íö‰?ÝŒ°Ðâwwfý®hi.ªÒ1Zž+äíGÜi%gr;ÐZó¯˜îËiÃå*¥©l¦oå7ÛmäY–ýFûpäÃ~ÊvŒ¬^±3Aˆðµo™GtÕ= eÖéš]îÉï+õŒªšgJýýû¼ËÒ ¿ˆ"c¶JÃÍë²,Žhió˜oÕÆÌð1‰¹kööÐ*—ÐòçV)Å®æ9Ê5U.!¥#)r=ž%ÒfEŽoxÁ­e;÷Ä=ªj™[]*‡=΄-¹–ÕÛýóÉ·éÞá…Æ&|v§ —«ßsA°¤Ò5v{“ûØ¡‡ð ½œ6\¸\mì³àä•¢£Íܸ㩠'’ëõådjãû?+yQsÚpá´¹(¯ÌiÑ ¯ :Ì”è>Ä”ë6œ6\8m¸8N.—‰6æ±Æs¢ÎÖß‘P>`nÔÀÙr2;zÐܨ2p¶ÌxNTïpcºY³Ì æœÑ‘áÂ2)®ÕnBÔ×YáÑ—soº¿^ô 9²ó̓y¬ð8F=‡ý4×?¸´rö2ä´ár¹h“°äÌc) éJÑb}‹vk#ÁvÁ“ÜŸ«h'H‹ÚêaåôxôÁ£f„ßZIǪ@4£Yœ±ßm ³mÚ@Š«nÉ®œPÒ4 …9Ÿö\6ÿœ27T¸ðöy1}·”eöÀõC§'\¾TÜíqgWîçME}'ymEhø#7®KKZ,üvkÝ'—8g/CN.WmÄÏ®¹òÿä·7žù‰˜(¥&¦òm $Òý¤.d¶äþy 짂Ì9”âlÚã³K¦w÷3ËÉŒdºÐ½¹’LO¢ûÎd»ÚMKé·™èh#§ñ§'‹‚I=ž‘$Ê ·0ÕÓ"„S‚˜i-–S©›fF» [K!QLæ-…˜±ŒÍf£í&‰4ÂÌm„lÏHÒŠÛǘÆÓôÕ96mÂĘô¾B´¤§\¾Hˆ_F¦¥ŽXýSkݧô”X2 Z&Ý1ûQ].ª 9m¸\™´aíerìíQkzj)¦2F›ºF›æK{¾ÌLü!‹ÈCm ª½©²¼ƒüw ûÖÏLuÊ%6{üÈwPOÚ”K*K`~^º¹Ì­jhÒ©í‚g´îûJ5IË}¬R5 *k2™’¾*~pDدZŒ \ä-$83eH²·'#OHHÐÑ_(|L—‚¼`žþœï  1ÿi)OŸc,4y“Ô°Jâ˜ð Ôƒ—î ½nk‡†>’Ó0âç#w3Ú(­ónAûõ!™viˆ«—¥€¦G]¦¢ña2CÙC·™ôh}ݤr5Aç]·™'þeGRù¨ºÆÛsЊ˜Ä“iñ§kÉ›c‚nó™ÿãq ß *Ù­»>h©û˜j2fÊÊVã3ûíè]¦§:g Ý}`Wß…p‘eÈiÃå²Ò¦0åÃ×wîx×vAÞݵ- ãOÒFÐÂSž?žüÜÉÔ'óZHmÖÿ¨ýe–@¾É¤2%¹ÿ–2v‚`œW¿ÍMïû<ß^öm¡Ô~ñlÙ|`ÉRïo—z/óÊš$‹\DfG¬\#Ð#2dòRÁì o™0_ùyô¿Xø4~lvÆ[^ï)åËoÙò¦~Sí¨.ä×<ÄÓê¥M±ñÏöžlo—ð0Ÿ×ÅkKã¹€qŒ6òãM¤¨øá_}W_7;>fŸ†³¤ÞYÂfB¦í˸Õ̓˜%N>ôX\Â"0wX¼ßR÷›È­¬l#_®=ÍT²ø™!ÏæDÍÕ)œçE›ó+CN.ÿKª díŽ,·}h¹ý¹_‚É£¸yã÷Bågò¢‘iœ^KIÕk)7Œžžx~´!UOÃœÍÖš˜íÔ ²Âcµ™û‚˜º­™¼Í˜&üwß EY&ÆK<Ðu£¶% yÀ;+£BjÈËÖÆMX³-rCùm‹ìž?vÖÞ%>¾y¬SýP¹»—·€£åvh>Ò@–ý¨-'ß$öÛÌ”½´kÓïᯠY \Ûw¸ØoÞ×$m¯@÷þiÓNÞ_Är÷Mà e2³ó Í…—!§ —^¿Mw—¦Y<™’Nej1/j!ï® b3Ž5ËþZʬX©¸mÆü_ú³Þ/ þišgÓð: yê;퀯bÌÒSƒÌi>¿w†úƧö<’~ÜC«u£æ1s#^]½9¼›6Ïì›âìaÛS«7“M yyݶ`=Úxy&¾5anÜÙ'ž‘‘+O~|Hùæg?‡|æõ©ÙÎ#d¡×1ÅÃf2,̉Ü+{{ü\1 l"Ï/7¤ÍbŸ£òɃL´·8é!{uâ|K©OXüdýæÞˆ/žZ!m_w׎)ÍU¯èZœ‰Â"òo62åafôOQ/.urG®gÆ}å5ËKñß_ö¯¤Ö¤NüñäÛn8)ˆÏŒÑež§âõŸÜ-†¬ÿÖãÄ!Üh¹Ûæà÷+ßØâ·z¨¹p•bâo›½ç`Ù<ÖñÌ›,‰dKÒÂÃï~³í½é¼Û"ßØ4‡˜G­ yÇ;zò`sjI=½,à»SúÉßûxýÉþ·>ï2ä´áÂ=ΫÚ+c[ož0'îO̤¥y`¸†lÞtõ,wÃúm^ûAo `šÆõ!éTjN.ÿN?©))îø@ Ÿ7ö¼+˜ŠÄéý®Às%Ò&®NEþ«O›ev§RŸ?œðb¹fžŒÓ† §Í•!‚á“L¦¦\Nwª?‘gA¦¦éá‘õ® !½…ë6\8m¸pp.\.mägsgþ«<š/µwwVy}à´árÅÒfåjà¾!Ó ÃÚšßÈ綠Ïo²ßsE7ä™idµ?§ § —ËA9upž–J‡µ®ÇÔ‰8•ŽìLK6è§]¹F Íà©)bd­¯÷‡iI,…TšˆùYÄSé´ÿé)’«u‚˜¸è   SSÅqjÚ‘"i&Ê~Üœµ *¤œ2#ÎðqddZušæ•Ó†ËßNã5›«U¤ªü¾Ôú­5Þh’DædIâè¦ÆkîXe@›ÎÇ7Æ/*¿M ’’ù5™t$óF`Ì‘¤7wŸ^Û6 3ÿ±]îdÍPÝï’wÍÞ3ïg¶´¬ÿõ “Ô_âF&|-ÜÎÓëÀ€…‡J›†5Vß™X1º¥eÜ‹cÈ´˜4V(¬=`o&Dûb1]–aÜO« úO_ªKò– ²ÿ€›•÷Òñk[’·“Y1*åñ7¶µŽ|ú»¸“åä›C\·á´áòwÓfF²g)ñ:hI§ÜÏH˜;"/u ™,´ën>ÔsY¿UR݆,ß*h ¾wF 1‰¼~*T¯Ð¥]LR¼ G¯·õ$f òãOBÌóC挟ž§ì£›¤®ŽW÷&]›ÅTyÝúu¿ZO—‹™‘¼,gTì^7b’d“yÝfç=Ä4yqäMááï…úû3åk!£Óîï#Á™É¿¥o?‘6/½¾!q‡ Ï´ªŒ"|œhÊ3ÓŽ—•Öœ6œ6\þ~Úœ(™²Rëà¬|`‡ysõd¶@£§È{îÕBisǨiÌÑxÁ`èD³øá¦@õ2í·1Kò)µÁ~7mÈ”67ì#Z#ƒA¬6F÷M›˜Qǃ6w¯Fõá³£)OFf?œØ4 &l›`òÜãõzYäR2%:T5òáµÛëŠ>$fa o,P^mºÈ;ËÃè]f¦rÚpÚp¹L´9Xòé2­ƒ³òî?wÕÝÆhc|ï¼^7”6÷‹½Äç¦Í]ç±õ ÌÎQ“}[ÏôC›‘þÇØŠ[fŠC'¡ê¿/¬÷¹eùÑɉ£ëÂþ îó,ÿ…(˜nRßLæùC5¦ï™{"m¼{Óæ¹eZ§iNN.—‡6ÓcÃÛɪ§µÎA/z=UUþ>™sÚÜ׋6ß0Ú(ÚøúÅ®›6ƒ_˜N“\ bò½¢_Ú×Ò†j,6¿°…ïL’Õ­ e´™–ÐLVùú™©ÜXFL_Û\bÒ÷y&)¿ÄÞÈ•ž5UÌÏ%œ6œ6\®ژǿ»ÿuÃ}ýa÷®õ¡^²!šõÛœ/m®ü9ÙzëÈ9ñ–ùãÓd3ßþÕ‡ü°•ùÖ›Ûìæû/TÒrUg£M¬YÒàš´/n±ZþðoÑ7¢þ½'¾!f‰K£ìR \ÿG1‹aÏ M•cöîŠèÏmáãƒ/6•½øðZï÷\çæ–jHúƒÓ†Ó†Ë•1&%‰;~Ûè"Ù#t곂"„Ì ?ÿÚ„9½h³Ô*,aÊ ­£ñ¼'߼ΜvžüüÖ±„·ÇÏ—‘eŽ{”/8øn%«Ú<4|—«òߨ/ܷǓiâdïw~pÚ'mwýSÐGÞøü—`bj+{e£•—@¡±[~J{û6ó$!ÚØíÇ¿}“Y|ÿn òoü??•òÜO.öã~3óÈ0ñôÁíñ¥m´O4ZÊü ýû^9´ô±@ ‘Ž[)»0ÕGzö=4~I-›¡ébÀ±AFZZQCO=éLCÌÒ€NìNG-P”E/¼.¨CC#VÈPÜ Zg>”ÑK\âñ¦¶· !¦rÈlCz«¶çö1'®ÍènæWmlE¹T´ù¡ ²”žßt6¿æ¡²Qõ´^=íHÿ/PÁ#UÔä³ÆnƒrŠªá•O“ýñ¨¨6o®@[ܲ¡RC­¥ N4CÕ„Ý9´²Y…ÐÉ ()ƒF…=Qg¥=ÒËã4ñ»‚iàþ äuUhâ×X‰ öíðˆF¬”~¬¢g'1†|Ÿ_zÑôRø•Ðƒ—]詆.XU#¿O{à¡0~<¹BRÙŒ6öHêkážV5œè%$£«˜à•Fy–¤s²šÌêŒ5¾/™ñ-kÅü½¸[ FX£¦a øÑrbICŒœhú÷;`ìizp½Ëôøjä w3’ÕÀ¨‡Nh ÷JL÷†y é-^ŽF|3þ8’ä žh+¼¬62—sÑ](oAE«(Bë¾XÚ°k­ûƒ½t›Vg¬àZë0 ñ¡Í|¸•Øѧb_C#7Ì ÅÖ®Ÿ‘¡9Ÿf`”/­´ƒYÌA®ìvθ5Š~p´õ“ña„>U ®^Bh´Ù ßVøE0­ž5;´5ßq͘sÄ~Møý4½Äx7½ÄØ ™À3,ZU7ã#/íH Ìöb[âEb?…öVzPß ÿ@h‰ÀV¬=%ÞBà–@›{(fEÎ;à9I¯³»Ât[Ê50–½8Šë6z,ÿ/^R&[êq&DWyã Ð ËاÂ.•VŒÕ^Œ6h+~›ª÷]õhsN›”ãA5Þs^¶Bãr!´IÏÂPgfz»R­~o矤`A7´£NªfddKíÝ’‰•¨ÛLö«Ê®¸DáÉ jƒ[±ª(ˆ lÚOc~ƒêN´ª¨%ÞQN/à:ëÄ/—‘dIýZƒ–JÚF„k…D„ñ¶#>U2e»¿ºçMµúßó‘&b&©b’ÛàFoôª õEôÖÏ#¿„†¼›…@šˆç»Îà kVÂßà]l…¤v7f/Ô]T ªWáO‘®EÀ‡îâ7zvŽ¨ÛœV¡µž‰¸Þþ h,ýÓfJzüm¥"ØË?{éqÀ[l@›·£ÑXŽýÿËähOª5ݵW—‡ Ìh `óa+8¶aÎÆ%/t5`ìI¤D³¦Q‹±§PŸMí²l`ù>±Ð„5m^Û#Ò¦x×Õ6¬1Þ´欿";õr[ýÓ¦Yƒ—ÝX5`ò˜ ®TSýpS BâÄ8Ê°ÎϦRSTÛ¯òn È0ü0Å;Ù%Fû3Ç´–Ôhmú»éñí¶"m׳•†-ýú—s}†÷ê½R%}ÑfäjÊõ¨Š¶8(6ÒMyP1ÝfüAª{Ó˜’b/ÐæÑxÖK`%æê!/ú߀6V½2/YRïÉÐ^Kõ®Î´’_k#Uãý$u¬Îw25³àŒéµ›ëñ©½0O ‡BüHíà-¦pw(ºÚ™%ÕM Ĩ°ø˜¥ãjJ›Ánøô TJ¬ÃN칂h#Àó0 b³øßnŒg_“ƒ°ÏÓÑ£bKê³}ôqþ(GM5ÖDaw1}ÝBR”6MH-ÇÒ((Z %­ „@d&Ìý±ºGÃú‡‰5æ`÷ Þ®9mú‘¾h#®+Fc-ÖFÃ¥ÖÏQö¸=Œ~ ¿Ä¡ ¬§óŽÒ˜§:‘]†µJduÐ^âÙØM¼ …ø> §êPÆ ml1« ÃJÛÝKlÇ:D²®ì/’¡nÆo2ìÊf:4Þt kh! ºŽªhçÒu¬Û£šž}•EžàOmø)‘jD“÷ÒÆ–ö] µU‰c•ˆ(Dr†²oºo –Eãt5²Ù‹øo,²2/pú¡Í#§ð¿=;üŸ9Ž×˜Í;l7¾ÆקX¯Ž­8£éãÌÄÝnRˆ5ž<Œ™¡øò8YKºM=®Û‹™!øâ8H¨¿Á ¦!xfžÀÇ>ýÓÆï…bé{‡DÛsâÌ8z™Lª¿ÍsAK›>~Ä=þQü@$¾õúSÖ½-µÚÌ’‘Ÿÿ¯i#mÆ2û”Ó†ÓæŸ$–¶#Ñ•Dµu¸Ãþ_TCþ>¯Lk©³Ž § [Ú“üï`å>à\8m¸\!´qÆc¾åðWæÁ¦\Ýê…Û]ÿMƒÝ´œè•À<楛B9ÁûâQܺûJ-–¾z‰'zbBï÷¨? ×ú‚ ê?¾lzÿÅgØ O^„ çã¾ÒTÕ>+³íåŸÜ2Ôí½µÅcwãÞ=Ô¹|À—•ÑÉ–þ…>à»q¯uÏûz7ápð¿‰6̕㽸/ˆáQMÛA*4µáH.‚+Ñ øE^‘%Ó›6Öp*†e¸anmñQÞu§»3ò‚Z¥'›[ky)2¬`cu&O_¤þn¶éÙ‡“'¼Dkqh;¯èϾ&ÛKó: £“l/AjçéTn{q´±B¹Ïœ¦kèû€Ùc¤3F:‰ãt¢¿¶F9cžøG"ºâ W9P/Ú4P¸ÖHò(w`Îã礭x¹ ƒíÅdG8S•`¨F;c¨ƒ^~X4á”Uc¶†Àèî±B{ŒÑsƒÆr>ÂIÒý€Âñh=Çaí3êû¹ ÑöUæbLÉWw¸Ö;“ç¦%î9Š¶½¥=ꀻœ¯&Ú `5a8« œ|¼‡®3À…>õMNâ v+¢aýW]F›!V´äµï·ûîƒŪe¬¸“îÖÝ+h_®Q7mX•ÖV˜AözÕÕƒ1¾O[¢ÍpýjïD'Mr¤??—A‘KJ¬BR…Ô_«ÔfÌ‘–€öŽÝYÒ–†PóG:é¼ÂG9éžzxŸÅ%ÑÆXjqúH[zº¥Z„»Û‹Cte5˜é;=§r)PlÂRË¢þé.çÆÑY¼2¯  óñÈ.ÄuaŠä>€Mª¨Gj+º:Ù›µAj;u‹®¥§w¢!3Sé\£½™hò3 |À£¬Gbé‹þXÎwÝÏE[Œfn°IÅ8UA'PÝ`Oo”Ù û2„eaC=û¸±*ø@ÕŽN rƸ æÏΔ(ãýl~)›µTˆ#ÄÌA“åiâÄ°¬vTÖ#¨Gshš,¨E)<\MüKÙ3ºŠŸæBà3/CÔ8S§Œºjd¾ºÏ¸3wì)ƒ<ëÒhàK@›ÛX£jkè2fwÕÐÆ¿N| ¢;{`² §3L$cº~buÏ6 ·ØÁ®ÊäcC œêÞ?m:±§ ò”«QÕ ÍÏ?I[úÑ,ävÐÙ¿˜OŸ[5š[á+\(™8¥V¨Ùt¶Û¾t‘6FtñœìRVSטX‚ã„l9ÔlzžMß´Y‘‡¬ dwÐcAC[šD’è:`aU(kÀú(1¦k=ìâàUÎ&Û÷]zŸAK)­Ø'”´èJ:PVƒýlFâÊ#l`½ÈF‡v¨ºÄïµo3¾÷ï—6­•4Á£EPiðÇ1F*o¡î#®¹É·aÓÄ1ìg—á0«´Ï1kýPz|:ùðÉis/sf?‰’.t•SoâC)Òeî¹ųÒ&¦ +ÙÔ¬yYHNçÌJç~¯½¡8ûBM0ô?'m&øbÊI±v-«Ad½iz3|ÂĶoYçŒðÑ9óŽôyû¦=f„aœ­¨e oaœŒ¥TÔÎã2IdžY;aš‡ì,ñÖ“BhñkÙk/^Ò9¿ÉFQ®óæ êfl3u8ÍŠÈ ?á°üB,)[¬a>k­*¸&HxµÐ¦iYbÍ™‘Ì .4©7µ#[½d;kS„ôqzù‹‘¨ªíç1YÍù’5‡»E=GP†ˆŸk×cÕIúBç„c¸¸P‰:“Vø$•‰ogQmnÂ˵«‚g”ØÓò†U¥¬ægdp8›%µý€xUužßÃüø„*Ä|(¦Å!:[Tx„¿~bÌäV|¨_8tvJš•†‹^êÏÊÐÄæäVçD­‹t5Ì Á•j<èÚo‚¢21‚U§]lÂO’«øœt(˜&0Ês‚¥ƒÈ’ÑÖЊŸO‹1C˜S¹sÁ¸Ý^|–ô6Lžk |Ïí",)ÉUdŒÖÇ–•Ø$ÖXÎôòÿ½Q†>à¯3ðI°J¦"ýÇ}çòïvæµ<[¿ÍúLêÜÔI×ëÈS°GnaÌÊds.¼ä¸ïÚ{9óöM¡ú ©4MáïFG¬,E\´xùÑç%ÈÊÇ*Mœß§…+Ü'7_ŒiÉÊv¬-ÎÔã[i•%éHêù¼½iso7m¤õ îôƒu.ÖY¡6Wnc!>ø;rZ2½i3RK›bxÈÅúsëAt¶ž6Ã,Å! jˆY‹ D8¤ˆÅÛŒã2šæÇÓN_n³ êbÙ‚€“bÊÚ )¼Ü,àL–x­[.ZÚ$Ú´INÄýÐæVi–oE>Øk@›é†´yHj;ëÖ/šj¤S6ø,Š.Q(TËæ.楾 ë«°ý ®õBs5^JÅ:o™.íbÛ¿M¥˜ ñ!Æ[Kº Ãñ ña÷£´JÔ%¡šÝ®E:¶ß“ð‰û¨Û©<—Òfì>z;±$S‹Æ3X¤ÍH«‹è%¶Åÿ {ú€o ¡÷™u†>àÛzù€¿¦ ܺxQ¹ß 7;õáþ±ž¸¾3ï€>icŸ+‘›‡k]h¯È”rm¾6¤ÍçÐ,9ó’¾h3@¢Íæ®û²µ¬£µ“ÑfC"¥nØÁ~"mƒÏõ„ø8Ú'ÐOZàqÊ0¦ ¥ÍÂ#mÒml ”ž÷-±¢Þì +Øÿ„17X+=gUí0‡Š:ñ•ï•¸äÙz‰mðö¹hã-i êo"¨~/q7mÜ(mžðÑ•ùn˜xŠ6GÜiÇõ>ÌMØ»;pø˜´¨Ý)‘6B³úñî•Ý»O¢Mcÿƒ_ú½ÄçA›;¥¦±£QgëfÑF{9‰6–ÛÜh÷È#Z/uK¼ŠÄl<ç0t/Úòq¯)Qývé÷ù‹´©fÐ=ì=ž4·3 ÐQ‰]iËz+´uè;•ÏbËsó¢kˆÝ§W·ose´Ñ` åEѦIƒW»}À­è>ÔÑ{'6× H)ÆY[ŒÕ¾x^øÖWŠ¦Ç›QðŠÁÈ#’;­Ö = ó¥Mß½}p}gÞ~h#˜5+=Ä4 4Ì?¥/Ú\ˆiÈLu!Ò²HƒŽ°@F›ûBYݳÀCÇÑ"-‹4ø ¨Û¼“M¾˜7bDKjyâu8½IÏ9¥G&•!=E³B`´1|^!¼A)ݲ;áXƒ¨ öYÉGL²^ÓÛ…üNüoÿUL›2àugF7ÂZ´¤Ò*O„ ¶álºMÚ1ç‰b6îô¦®I_Å£0[4Í †é6SJ™({‰Ó³Y•Ø¯&X‡H¥Ž¬_¥mzOîŸ6c­DÚDéÑf•§XÊü|äÜ´Ñ÷Rß y©ÙM=]åï;öÈø·ã] ¡Í.ÈÚ±ð°4ÆáŠ1ì °ñëdx3Ómv"¦ ‹üÅJ~¤‹Òf +½é(k3;ýæ^$m;îP>àuÌ^¾ÁžÚ› æÍ:†m"ò°‘õ’Mö¢y¶¨De%VD±€~b†J>à %X‰èf$§‰_mA‡ IƒÉÁžý6¥¥°a‹q b%§oüÛ\ò¹ø…/B}l-þÔ×ÐFºÜ’cäïòÊ´0lZéÞb}õ ÍvÚÕç£]Œ§á¥Mû€sá>à\þ+NØâº=tä}€îÞ‡¡ç¿„#Ü÷×[ßl»ð»ö\ØöÐ97ö3cs°3î؇;=1¸ŸË:ã~oiák©×W(º±öºŸBúBˆVîÚÝLjÕwÜã…I{®`OUN.mlé°”ðw*›Ž€7táÙó_Áí °¾ÔÊj¯ç¢‘šyÑmÓŠ¡îDd†Þt´§3…±'Z€ìd´Ð}«­z ø ­‹Í`”fƒ rƒ‚yÖÌv—ñ “‚"JÎÄ7Ú°wËÐAFe)j:¡Lºz<¸p9pá¿~µŽ /œ¸ŸºÚ t·í¦ÍGyžª#ÄB„pÑaœÑf ÓÈ®/o}'ëAÌS•íU§½d€a‡hogGcÒ9ˆÞjÆö:ìÒ©n§õaŽºÜv» ÜZ«¿§#à,$Àv±{[½¼¿ÄAõåð ï9m ±fXÕMKx¶Ð­sRõh3ôs§²íWpõ°40Z£ÆãîWÉŠ\¸œm:4x–Ícù" y½sƒÝè¶Èš.ê 5ª[·±‚¢™N=À\v2ϯ‡NÓQ¡£ytKºAª=£MQ^B§+GgöüŽO¡;‹Ks8³/÷ÒQéf °AÝ^ºvhSck%JêñønüRHg"ùä ¸éE4·¯Ä¢ŠÍ%»/‚¹²æ"­ƒzon·—Ï»[å8^‡êFñ‘WÕ¢*Ù€6¯F£¡Hzv{:—û}ýÛ­è´Ø—]ÅÈ/† ¬¢çãh™£ÒÓm´!ú´}œ9)Øè–¶0h¾lÊ«4=É©n§8m¸üƒ,)[ŒØOAA¨’§cO â:oqÿ,nã‚%‘ÄæJ=ŒæÙáÐk?ÉUó8›÷¦"?Á¦B ; yG6Ïv`’³äÉÒB{×ÿ¨€¬8¹èêËéÙÖ. Ýsפ~•w‰´©Ì§ˆPið¼›8õ7´[‚D÷œY|íäÒ¡ZoM{­Œ6Ÿ¢C÷PæFo݆îq&a侓ÐÔö5h¢O»>hsW4E(³·è\ÄO½ òpç!´´è”½EåÈŒæ´áòÏê·±ÅåhTcN÷ÄW Iìè†5=icƒ×BÛŠÚvººŠíøpM<¥Ÿ”¦fùÑ–5PÛ$µ X²·6eæâߎßüi ClBé…i@T&v&ag"ì³ÐÞÉh£Æ[»EýX@“ ÈÂ{D‡-m2?©áRìº"È”âN#,u ™hÓo¿}ÚZá—ƒº6Ä?y @Hü^‰6÷œ¤[©þ ڌއ·ýÅõÄî “¦gH·¸ë0š›u´™W†lN.ÿ8Úü\FOÍ? öKÔI>Ëw[õA›GeÔ<¹7õ§¾7P·6Ëw¼rõho§>Ú~c}ÚXàÞ£RÒ]l­³ìr ê,ü¬+M'Øt Oìg–çÕÒæ9wmr“&‡¡H…Ê z­Hæ´ar§]„vŒõ[ÉÑÀ’l«ç]ÄÄŸf·¶¹@ÚØP–Ô:ûDïÔ¾P·ê,)û&ì;ÍiÃåeI ffÎPwfI9IþÎÒìñÞ´ÙPŽè(qÝ$³$¨kiÌçI*5Ýöt½Ÿá˜T·nck85Ýš®ø÷D]<ª –pk„K˜Ô0Ønƒú´q`[Z‹× xÏA¤ÖUv’ƒ˜ÿCÕ° ïÛ“6¶}mDîŠMrQãîÉ`h#-MÃâ©ÃªãbÈ%Ž“žÅúh³ VÝ£]ÌQô~í”-½N²YTÙ…×<8m¸üƒhcCWÝÑÚ)_¦¢¾¨ç<ÏÞ´¹%˜Ú2‹Bàg–æÌ#Ø^Cûl‡ãG¶Ûò½ÎýЦW®¬ëPÖ…åGÅ[ÜƶK¶Uba ²U°:eHkêH~*sð=“ùºZIý6v˜‘Öz, Ŷ,zëIŽb‹î­Û˜ä"$¦ç Rp;”yø%*6ß»‹sšÅž¥QØ:Ip-¤‰_ú­VTà¤v…7lŠÃú8¶ÖS<¶&Ð}TNÀ%Åi@2~£ËzÐÅÙÖê[’h±`#àwŸBe¹ˆßç¢iâ»âp¢i9ý/ñÄiÃå*“ºö¾ Õ¹£ÎŽÁ}®†sç\™5CÁ‚H¶Þ‹5ž9†å1øàý¿„l%Ï×Oâûh,ÅmÚÑw¬Ž`Ž·¬¥ÿÅ<Ä{elˆ7Mj¼ƒ®Õs§;A/‹RÏÉ¢H½ufñÁX³@¶„Ž-n9ˆ¹'E=~K¢1#@ZåÌ™Þw€4Ò´*£XøÓÁ˜s¸—Úà€¯B±$ÿÙ§3y´àvgiÞ'Ì#` &BWʼnFsù1rŲ(|…¥gèÁJuO^&Ó…/°ÎêÁ»1=”nmÿ¦¯¨¤Þ‹ô ò6¸÷GáócWðf£œ6\¸çÂ_PhuŒèÿì«r˜¹_ì]îEfñUµ‘1§ N›¿ß)ØâÒlâs•ù„rÚpá´áÂiÃ媠´v®Íe±Ñ[ÅW9ß+ª0m¤R²þó¯ãÏ\k{e¬ÃÀiÃå"æÛ sÁoYâD˜˜<Üëv Ü£ÜézÔtÉ`W6Oÿ*+ì*Gï¿Ÿ}®$àXcY6©lÓ `ŒõŸyäAÇØüí ]Ƀ Í[rÚp¹ZçÛW:—þd"ÆØÓš<=-Åì¥ÛFJ'úSÔô­áÞGm 69Ç%¶ÔYé“Þålß² Vm8rZš™cÓR¶½|Žú»{o=áì™´í'Ð 2šÔk»ù³'Øã‘m ·­?û¥h/‡C‘ÓWLN.W‰n¤Bz¬A­þ(_2§§Îðª W•×àAg±­¥¶â=_x²=s÷ÆR@­¯£ÇŸó}²Ñl:ò~%sº´ÆöbX…`#Ûì ’mÆñY‰¨·„÷µup‰];Ž‰Û4 iOvFv”í¹—Îù™°Ÿ:JwuàCO]œ›„&5ššñê^qÞi!c§{bá¡“(SѤ„Lj‡éØŽ]ã½è´:M'&³qðëCè¦6ŸÊè>5u¸ËI6L·m-&¸‘íL‘ZÄÖÆg!³(Æ;Ú±Œ- ®ÿÈF‡Ù. ¤ŸÄ Eu6‹kàPD4PMfS€n‹™M¥øåÝHÑT¢´P¢¿ùÿíÀá´áògiÓ¡Ác®}©ötž›Ýiº)í8º ]âÞñt‘ó #]Øq’Îéž´£K:»QÆ»]èò ¿–¡8âhs.õn¾N»«W ä2šx®ŸïWè—6ì§w|NJûub_4sîô±8zöZ/¶ Ólš@omäFý/(1lðU4ÞÙkðtFl×?`BL»rœf»ãi§ƤÐm7Gí¡üc‡Q§hàWûi>_‘‰{žö¤‚;qò -¨ÇÎPD ¶ÄâTä2P¶±ø¼=4ÙîG7½²¤ûiV–QÜ9"Dˆ‘6­eÌ6:/‚´çˆps\g‰‰þÔÃnE=ʸnÃå*™Ý'h*­æÐ+þ­GèŠÝ} J ÝÀNK›ÕÇE=gmü•t^œ@›Ç –× [&Y@¬áÜl…Í98–$ââ¹hT—Ðs4}YR½icË6²†2¯Làu7‘6wK»k%±)9Ø­-ñS.öÇöcjÙ‰[`ÜàŽ—ã¡Ö®5Á&ΕBÌØž¥éˆ\±¶aa,Òf½ËwÄ <†f±ÐÞ—¶ºŽnÀ¶ºûØ£h/»ñ§g!9•í§lÏ-).W™nó°KºÍÓl·b©{Á©á´¶Ç7ÁÔ_l «³p8΀6GÕ=ûx_q¢ºÍ>iëç§"Q]jÐôL’_e5VÖuéÓ†î/Év{x˜mÖi%ÒFtI°…oüЙÃ*Ã[eö5kŽuU•ª‡52jåu³4m†Kiºwàô F›fiF´µ\¦»÷¢K¯íÂmñNÕ¸<’°2GÚÑmv¡øÌM¼ä?hÚè±ð÷°“øàgê±ø(=˜“Œýr©|ØnnAÒï ıœôo§ —?K›(5’b :-‚ûÜvL·¡¶ j8îƒ6‡$Ú<Êjþ¦&Dé ^[Š[[ž…6½ñÜ<{wìî‹6,K“óƒ­eX}‚Åa´¹^"ƒØì-î’9ÖNïÖýLÐÝÑ„t¹¨'¼›µm&HiF;ýmÔl#æªxÓ±mØš{×t/¢Åôº àûý,VôY"Âû¢ÍN$ó½Å ï>‚ÖV‘69‰%,ÒƇ;ð…»¨b™æ!½ÍQZç2_±'¹qÚp¹¢Ç¤†°N Cm¨nÿj(í•wPlM¦ûX³u¥Çw81Kª7mì隽ﳆvíQæQnEÈÇYß…eß´ÉÔ`±G?£À=hÃœ˜T]”i·iUF›}al6/Ûjü–¸ðˆalðØ2g(º vÏÍnY×€¬Xv­â‚Ô°m2mND³p¦<Üæ ZRï‰;,÷î·)Ü‚é©ÁÌyóKÄK}iÈmÇQ×ôxš½îGicÍ…HÈw¨qiDR¢hIõ¤‹´™-n:À¶õ´Æ³Ñh¨â–—«l¾Í?º°ö/» ïøˆƒÎ7ú!±-*Ô·aÚ!Q·ÏíÀ¼Ãb[ؘ‡à$¸8—uÛ²=?9ƒ:5Ðjjñ‚¶³G”"m„6¢®¦ﳡöŒÄ¾4kM?"Ä`BÝÉ&$K‘÷R•ãËhÔvÒD¶…IÎ ¾•P1kÎ;ž-0h9àdØ[å†Ôt¨^B—å©RSµ4øX€![ºÜú LiS‹|4uÑöþ%Û-÷»Ä¥éÍ·±Å@„5ПªV|äM3ùÌiªh5uÀW‰ ̱}×Ý#‘æÛ8b{Ú:ÑÒ‰ýq0²ió˜4˜ÜŠÇñ¢¹YìÙ]肇3öê”:÷@>&Ååj›KÌf¹ô±³˜% ·Ô«Òz|°”âkw¬“ºmiœ]zû«Zê%k-ÍO³‘âô炤?qΩ*¼µWJé6b†-zNÃmô|zÏÁ³Ô ·ÐYR Ó¤´i”"[è£ÅGÛÕ+AK½É0R6´1môÙFoÝTk½˜vRä¥Ý½«þMm{•§ î'uqòÂaüQˆªB=€0Ú[\Ò1Ú 2LS¤ ¯Bœ6\þ´±Ì…°ɻ# F—vûcWœÎ¡ËséõÑdNN.Üœ § N½¾›Ë¡Øü›ŸïsÙþ³´#N.W&m\®G{ÿN7mY3–Ÿø‹ÃƤ®9ŸNZ'i3[N.ÿnpÛþûô5¶=×Uz‰‘†Š iê|<¬û;kw®lºi‡ÔáÛcççÃnÛ¿÷Ù=»ÙœœqÖç“Ñf<§ —·Ÿ”s¶Gº“Û±á´x|’ùLg“â²fõ–³8Q¶°(D¨\™ý­Š<±Ymn‚Ë!]›z„í¿ Ñ°IqàB'Õ¸9J9 ”`YPâE·Ë¼ë0ÝG¯º–njðeAÛOb°&ùÓ¹m#ì0˜Mr›ë!|Ø”æ­Ô‘Ü4†¿â‚tnÞ¦ý=gÔôA;Š…ºzŒq¤™icƒt`ã1 rÀ¡–vÙn킪 #ñ²€iûÅì}ïO³·´eÌo4F…ˆXš·làdQK™îE7ö]”C3©¥]RhÌÁ»…âÁû4¦PæÞôÖs²ØZœ6\þå>àŽl‹I;Ü ‡“(Pc”G^n9†ª*Úr?ÏÇR/Ú÷bl‹é…𠤜)vÀ¸ÃÈʇ[;n·ÂH¨U=Í©éHe“ï=MשèžË'@`É^æeÙíaͦÐ\ÇfÍýç4ëÅžÞ)åP†mT|ía`I=ɼ8wŠÛÌÑÕœDÚ|å)ÆÖNô=ÿµQ¸/T—àw®Ûpáý6Tj³Â ^xÛþµøp7]GÂ.„ùF±Ùõ™ «Ù4#í‘ÒŽW<™gA%–Æ7ñÔ/é³xØÆ}A(ˤøŠ(GÔÿ³wàU]»¾êgW|­H'½zï•Þ©*¢é-í¶ô$BH¡Ò„’„„!ôžûÿvæÎæÖ úZ&ÏÑç²wvvvîÎoÏÌœr Ä™±™6}΢¤Pm.ëSc”6ÕhÝ쌠Dj‹Û%E·Ù|dÔu¤E‘á´Ú¤BÆD£†°þzˆ3©„*¬†|x•2Dàç‘bÔÓ ÕÁê{îˆQqD;jh€<ŽCÊiÃ…[÷‰ÊÍŸ4Xd«aýb«=^4Æm[°ß³×®­ÙQºÙâ×NûZ¢yžúxKnÎöbSEÏk[CŽêR=ný’ú®ë:WÑt3—ˆÅt|ÀU¾çš=ÙRIN.Ü–˜ N.œ6\8m¸pÚpá´áÂå¾h#ÕHoý¿]Ìüãön¤÷S¹f‡üîJ8m¸pÚhÕÖ k.²ô(§3ð¦Ë}çÜmîó”Gñ˜LïBww–çC½w9žWÝ‘¹Áî%“ŸÃu 8( Ohÿð(98ÑÓ†+.÷¿î‚Z%N_ ù×1óôÇÀ£pŸy¦Íš;H:%:Aˆu¤ÍO·s’äåšÁöwÐFŠ©±èç®^îîgNN.º'ÕŽú5{Åâ1GâÂlF×’@–û{’æ4–K—ó€WýéBÇËÁdŒ?F™ðR ’®¶˜GÔk©} Y5z–º=s)9äƒÚÈðv$JjOnäP ]·±Ã¨X\ΣU9¢Ýðš³VŸŒËDE =e7F¦’«?Ùœòr'r€A2=¯1N.\îÁÞæÝ„Üb“”Ü[ãÏ ØÞëÁlfÕan£ÍúlDЀ+sÕyÀ¿ŒGe#Ù*+CoRlW5ò€7R=dôCyÀ%¨Ñž4ÝI'ÇÆ ¼ ¨¬Àý¤Î•™ˆNguþ÷4 HO—³ +0(ŒF³'ÙÌ…¿Ú ¶ŽôH›Â|íO ܾÐ5Ñq¼Êp£fªõ%WÝ Ýw^œ6\¸Ü¿-±ƒZ—ÐZ»°ÓËn{ÏyÀí[Èn'Ú Ì¾[C±±ÕÈý›uJÉV×ûž´{¼ ÜÖpWùqï6t#» å{r ™Ú[³m»¹nÃ…Ë¿ØOŠÅšwfHªìô¿ÛÅ€Ó† §Í)Oíƒ{6Nà»ã†'.œ6\8m¸pÚpù—ÐæåÚÜìj-iÁçú¡Ô/{H¾í3zK[v7èí%{€’ú%V’ӆ˟L)^ 'ߎòý£=<îL²0èÈ©E^1º8«ió™;‚KPQ%#Qڼꅫµ((Awg‘6·I"¿ò$æÑôš"m„ñ›YƒëBW»ˆ´)…u$ÊÈí¿ c´9’€¥WP×€ý¢e£@›®ž,Fe1. ´´ ᎄ’þ¢‡Z3m^:€Ä Ô×ãÈRø)zSJ%ªëiÊu ¾L"…oÜAwON.Ùºor.r“Ɉ;\Œõáìá4=‰êJ‡êUêXý‰‚„’ˆaì§]__#ȳ 8…£½ º†¢©NœSü‰ËöðàQËäN nˆ´ñ=.UâHx‹sÄ&¹‡Ú9cå-^`á°ªqð´3|nãH2©ä pè žqÁk 3ßqa¹«zûà)g¸Ý$õ´éŸ„¼«,èDEžw&1Än|ÈåœG~!¹Ö'AP6àV.¹œÕ, Ò£ u…ô@§êáÈhÓTƒ·Ýñ”Š€©~Œ6ñY¤ä§G‰ÇV ¥?#­]zULòKi“’CJþ7X$>®¢Ž“Ž]˜Ü$>+2H=ƒ½ñŒÕâ%¡€#Ôâ]zéëÀœC”6—HÉá>xÖ ûk•Bî‘цÚ(ö*qÆ·q‰Fþ鎲râì/|ÞVB<÷ŸuÁ³>$AêPoN.6ÂsØ‹=Ô R´ˆs€Wœ²s…·ùó LËG~"SïŸõÀÿ¹á#ÕÔ`;%åFG ð„¨“ £¡§óè —ÞN Î_ÍYDÍDŽgBÈbN+ ú§£*ƒp)Ú¹âmOšñªNmUUõ‡1à *.³ƒ¯‘ñ«C›aîL8W†yGHãO+±â ›†üt‡ÑÆðL øX<˜ ÌßÃh3Û—•ß’‡ã Œ!Ÿ‹%´,ö¦´èQN[ÒQÁJvK ð\¾—õa;’]d„6ñÙì*/$ñ¾T´Yt-5ÿ’“)ä‡h“–ÇJ¶÷%zK›fÝF†Çåä–}Æ’³|œâPÝlð²ÊxÒk®bœpN.¿ÓOŠÆ›rM'li™±^dÐ]–zi•t¯ÆÑ0­µ‘Á1º¬ð  #…ÂA5CÉ´O5mžóBhŽåâè´¢´9!¦…rdŠJ·)ÇËA,¥æÏHˆÓr ýouIwìÊ{ko öœxp/›IiÒæsg6<£JéìÃ(9#Ý{{%‰´ÑïFZÛcö¬d ¾‡mŒ0ÆÐæ¸8jïE´—Vt&e¹‡œ’Ž›— („™Tä±÷<ˆšÔVƒ6±U¸^ ÛT8fSÚØkÐÆ…ŒmþË¿¢·eÆiÃå÷ê6Gkq #c” !p½ŽS©ä <ÜûÃâš!µÞ_T„+çÔK‘ÂCØ3u…¢y¿=ó #¥JX±* —‹š6O¸’«ŒÁÈcw[·1H›1(N5ðÍC&WͺMp|C0-×’Øyú0k:´ùÌ™é6Œ6öH¾Ùê˜û´y^$ƒ0MüчѦŸ8äÌFTcÈ‹bÉx`í>J›z1€³# F´>Zòe±¤0ƒÜ¸_·…ù£©œÐæä%qÙ‡¬2µ¢ºÍPqí÷» Ä¥1ÝæœüçÉ=ZºÍ¬”g±ÌËŽëцÆ;zZªñƒ:ò™—‡Aút5¯i<9ù“bím1å´t¤t÷À3ÇÈÁç¨Kûê«Ömtiã@n'(‰^Ú•tˆŠ6ÿ·]¼´±CwÀíŽÓ…&ºL¿­iÄ+,x\ ~<ÆÖmaô ]³zC†—éLª“ 9øI$ádqÝfÏ ZÒ…|~GÎú°'íÃO’•™Öv„6 •ÌçkF6ÊóØLêV&»ô™jüJc-¸„†jr×Âñ©Y¨)P¯ƒ¢KÌ5,°”LÛ‰BÈú¶Ê•L˜;†³ ·d²˜±œ6\œ6Ã2ÉBM+í|»§šàt‚ ^×|¦N{&±©ÇâTv$þÝ(ÞAȪEe=9¸+JÜO)Áþ(ª%k&Ó±¡½ã& m¡Õ€#z‘²ÈŠ´zÅ¡¢Ñ¦]0Q ZSefœ8wË,Ä[´†W‘œà%5¨jÀaìZk3H™šz¬:Kg4¶œŠ²\F›/DÚ¤UaùQº²í‹Œ4ÖáÒ ‰F1¥ÍæZ4]Ôk­Mé›TQ3¡]‘êÄ⣢WEHuö šJ÷¦&³’Ô;þÍ3dÍÜ¿·jÑP‡ûéé”`YIíÃWO“>ô½AJ ­{´v]>¢/#­¥ (*ÁÛrÉp|r«H€Ös4ê—#V^CJR+q§Å·ñž‚”zºZB5jëp£]¼É<· ­<ˆúÔXO³Kx"ôjé~I#Œ§ —œIÙ2¥³ÓðìÞ­ÈE"ªŽÚ~â»E'ëf[{ƒÍnæ»õ4s•3µŽÈĨYšm¾œ­^²r;½k9ªÕ$u…ö-¸Kñ”ž–³J&åàb¢ø­^øvŠ­v†ôÝ “´\ÒAì[ÍÖJ4r…ÛjLTõKÚ‰w±[ãWÓ¼´£¶o¾NI[ ÷ùæãvbý:íÔÉiÎiÃå/è'¥i™öwé ¦$CY3Ø'½d¬àÏ ·%æò7 ÍÓˆÏü»…zp€Å „âT.nð†Ó† ÷çÂiÃåokocÀ†Mú8bKÿÔ›}7uNCw¹DË~F÷Z!§ —–nsQ‰õþO¾=N¿y˜“i!õ}~XžÝr<&¿[f×;büaƒ9BªïÃÍù½3@1YÒ¹Ù€Aûðˆ?‹r|—ÅŸ¬z˜{©ÿ9/u·ôVÅi2¾bR›ììß8œ6\~/mRñ‹Ÿm›°îÈïU*ôº«×,Þ÷pnÄ4îFE ÙÏýé¸Z9yí¹÷âŠû À´'inмZ ZîG½¢ìïvJ“Ê.ŽþóEj¡]~S6,áKŽ{‰>Ýœ6\þå´©RËHÂ…ýÉêíÚ1È«Áõ;0óbGƦ"$ž¬¸tÞÀu¿º€Ø ‹ôkZ^Ço£ºc}TŒ/E2I.*pò Ý„•¢Ãi\ƀܩDžëxVŽ÷£ˆÅKC#²²IS]ªáwÂm6¤PÍDÜÇŸuQÉ(­`ó—§÷#¡Õ ðM¢f<¸¤$&C‚TÔó'ðÎI”¢{àh1ªêqú*Z‰0yå$Ššãu8à0%J=ÝÆ8Ê\±¢üª§ —;mžÚOlê^wÅ n˜tµ”?^Ga&^rÅ‹{QLÚKΨ$bÖÏ‹ä×Ö7݉Wbæ~<²GÃæ_ŽŒ&ì=Ej^’MlŒ'û3ϬõÇðœ+†Å ¶”:&D@ÙˆÁûˆÓ÷œ\”Ñ­®98Düµ‰—A¦4@›ï èçA8­ãóƒŒ6m©•oo<ï†-7PžCàðœiÌó.›BÓ5¿I=¯õi£ vtßù“òVgP]Åæ^‰©û™ äªLì?‡êÑF ·*†ªÍZ²‰žœ6\þí´yå0™}äÄÔŒGåd•œ˜Íü‹I#£iD²ož<¨aÆfÛJp–|¬Z´G\n¡QÀ º“ß,åx3MµÌÔ¹u1àoe_¯Â'¾å€W”6k‘@ ~Ô¹S²óñ‡m¾-¦^Tª³¨§Àûâ‰ï!Hy†ÖÙ"mdxÒ‰Üþ“®ø %A SªÄ›4ÜÍÓÔÞ¯ Íñ:lP[Ù šÚ<_N.ÿ"Ú¬Õ^%ŽhÂÚ@rÄò‰pRW‡“¹x‘¼Öuâz ŒHDzø‹.áP6åÀŠ:’{Ý@ÞMlOÃî4ø壂j,Ϩ< E£ßóU„6s¯èú/ìð%´i,ÛæG]uhÓºÍÚê©Ô@ðµã6~Ø÷DÚmÂþ µvQôq'ŸÛP¯mq•¸%ÚHqð«á”Ç‹„6J©ÏT5‰`#TxY‰nÎD©{*Ê"Ñ’YlÛþZì QÓF¸éé^œ6\þ-´ñ¯CR¤–Í¿0§y1'kaø¼â…Åi¸`)Y}}M¦á ì@WrqAô86ÃÄp"ï»’“@§¥˜Le\8™| wÁS{È m†ÛåzB›!i¸!ZÔÛ3·Áiw´±G@%f1J4ÓfgO«U#~‡NÊâ±%D}¼%Ú˜œ¡ª µê܃é6½.#˜F!kO#‰5)5 Y¯±¶,ÅlÜ:/®ÛP—Ò%œ6\þ-ö6/“ãƒ÷±´#Ê;d€tAÀMâqê|-¼»“à|Š97­JǬ@mÚh×<ês5¦Ž˜x Y×Xô‰>n¤æ·¨§Y·¡Áz¸Ò±é‚Sy$/¹AÚ¬¿Š DæÝóþAtpk6RôŽÇ:DҾʹy†}P¹,Ù$Ò­y[l*@x¢ëîJ›ú[lÆ·ãÛ¿Ø„®nbö;&Ojè6Ÿ¹ ?Hâq9‘æ]FÑ5C!8m¸üSm‰¥‰k¢/vx&ÞpfoÞƒt4×¢¡ #UAT<È^Rm=Q b²ðr36¹úé P Ä‚@­}¨|©G¶#ÌϲlÝ'/àB¥&¸Y;µP6aÃ)RþíÔåJU …ñ¨:F·oJ¤Œ=«{;{ʱ%T=´GP| Œý:¦€-»€ª:ܬ&IÏ?ug5ß©ÆíZ"¥uøÊœ¥: ]ê‹Gèºj•8´”ðê–0<€øZ²P,ü=%×íØ׎‘ت@@.J\3¡[ž“¿‹×µb}pÚpù·x.؉îÞÚYE˜¶½ž+·fI‡ Qvû¦z׿ä)Vb‡ŒzôÛ+~«ãÍí¨áý-×@¤¬L+™!§r™¶7ônÓmµ?7»xKôœÐ¥Nè¶b¢«ÝÚ=`§Ños‚;j¸±ë;­Ûþ µN.C?©ØFœNBç/nñ߈ӆ §Í!ŽX“Ž¤b^ÁÓü×á´áÂiÃ… § —‡N›ÿ¹Kò]<£GÛ~Ó üî¹8 ¸KÛ¤÷àñ-»·ž¿{Ï{¿wN.MÚHP¤„±çÿ Umä,D°¿*qž¡¤Ø$`ùý”bÛuí\{ŸèPW/F96f ¬‰‹ÍÁ[b¤b÷zEPg¨=&ÏñÓk¿òlòÕÑ4š˜Oªë£º)›¤ê>™…Ö2ðú(B4·–‰ Y€Zö‡c¼±3{¢ï#ŽX—ƒCñ$p8m¸<Àø±j|ð¿Ðm$¨WÒ8ÛRâ÷DâH´D›²û£Í–ô{§†ßó4Øxµ¸ ~»ÛOwŒ62L¤¡Ý_§Ù¬\ë A›öNh«PKk 9’l "õì*FáyíF:À£†,†·–ÃìÁÖR¿AάSÛ€eûXËŸ¤ÖPO;âq'<¡¸'Úü’ ?N.Ië¾VÔKñIñYt5HÊÃÿ‰þs©Ä Æ!Š)Eqn…(¯Á·Áhë¸ ’íºUT^=²ô=‹â:¤àeQÁxÔ þ7QZ‹“*×i)®SGˆê&’´Åµ+CXÒ·Ü‘VÌ›èâ¤M ¬NáJ%òï ÿ>Ö¼öÞ(­¤®ÜÚ´±O§y<ÅLs£.!6‘ä · "‰ôÞßG5=Ú‚g\1ñ<µÈu`>V«H=VgPWMÇ£9ýÿ\ |Þº0F›”\R¬Ë1r鶴™)Ì}òñš;IM~ XH}®Ÿp‡}ªîF ÍÖ0œQb´jz¨ Iôþë#ÒFJt’´«xU!š‰æ=:´Q%¨U‹¶b69 Ñø&eÇh+6RXŸAq¡:§{-Ñl2›Ï“®Ó²®ŒFá R²•3éºÇœˆ_|; ¢ø*Ì?BóãäÁ#š¥¦J½Š\ñÚ^õœË£ñð¢;zž  md~ðÃQø;>:Bª}ENrñô¦&Íß]!á>¾;@sƒF#+C³“Ž×<ðÚ’VÏÚûn¾!œ6\~mŠ›ÐwKˆy+Ú}ê‡ö°­Dt”X˜Àç$„6[#˜¡~10Ÿú¶£NCLiÎaMcLu§) žv&VpO¸àÅ=#ËXŠ7U $MÚtÛ– |ç#ÒÆŽ$?²ò`.ZÃâ$&ÅÖ·!hc{SÏÓ¬âR¼ÅÅxÖW¤ Oyb{&]‹iÄå ßÏÔ6MÚ(•ºë6ÙkÑf}ªª0ò0>òÅ¡*dž×Ê<ì®ä©i³ìâN‰­Õfã“H‡;†jÅ.yÎDШ4DÑBÝQWÄÒù  kí„]9äsÎml:u×U2N.@›Oݘ­~60dÚ;[xä|pL½( êNhsì®´ÑÈa] ظ ÛIJ êÐÆå7hÓœ;ؼ_OÀÕNâ¤Æ¶å¸Í´±‡G9V%Œ>7ÓæE/C#ÈÆækðO¾Ïua’‚’oà='uÞ¦ÍÉ ôí—ž-ÐÆ_]AÂ%t±¤3£v‡É TR ·p1Óè]hãH¢vve÷bWBt›w…ÙS¥Ú9"´{ƒIcÊÏ‘Dׂ.Œ:ˆ;%¢¿?-Ü5€hVÓò™—‡O›Â& ÞÃé·i¤ÜÝ,ÌT'˜Å¢¦”¥Ô…$–U­Ûüm„Ùõæ~?‚80>æ€î'ÑPÂ\®ÖåÚ´vÐØriC8‡1OpÌ\!ÒÆ!ØÃ\œ¦'b9mCkz4°ncK§-&gH¤ÓóTi¦Í»§ L¼XUOylmÐ=¬Ûh‡ÆjO[û¡‚T2ê<ÑèÚHðÒ>ô÷g3¦T`Eùöõ#¤d[zV?´“ëþ:‚PYKÝÌ%ì\á_¥ °ô¾'Úœ¯ÁFUvrO½ƒñl…gÔz t!¨³)y²çJ±ê5羆“—vŽTå~Vnl–T_ƒ8m¸<ü=©yEH‰-D–Ñ %vœav)»²Q[‹Âj’z›ø,;"º߇°QP  žÊP¤•˜<¸ùÕ¤ž¹*7p"JÉLª¨³ü_ƒªJ²ûœÙ@Îê鎣¥ØÁ’b“†ë•äƒ7Ý[y>œÄª"ÃP(VB¶’«€‹yxžnl=GOÑÙ“²½ y¤Ú |:U*^ÙO•:–g&ãV[QÖbûörß«DØÉímöÅéb­o hÆlãCrdô1$²À·ý¸¨Úw«Â oviᯛ¾i…CU©zË>‡6ïYqùÚ¡’–{A¤ IëIn¼u”ì754àz12q<‰\è \«'=YÓ„MâFÀpµÌˆÚYÓÝöÞT›jÈk@i n7 .æ)æ3).›6PJ<#×sñ¾KîoÍÏ»´ÓaË´ó€Ûê9kºNKEs©X§Dôß­ÛV»’ÝZasܪô^Äv-¸ïÖvÄÞ­çáÞ\³ÔP‚rC†»¶Ú_Ùkï^é$ã–bu >q5TÏnímµãþÙ1‚iÝ‚¦ï¹Ø {õâ° é?™£¡±ý-Ó&N.`Ý'hÎ'’=ØŸž¼­BÓÿ>yR$ÍÒÖĸŸ—•ç‚=‹ÑÅãá\¨} ÐǃHp¯L.œ6¼7¸pÚpùŸ¬Û´ä+}/NÐÒ{ðP¾G—dýªîÝ[ö7ϬÍiÃåß¡Û„7’­¢Ç4Ôá[,È2°)³5@kõ¸X3·@¡¸ Žð+Alú=,<îGD1Ùß©©ÅºDŒ“•xA¦…—£Eiq7j¶’“Lï8sàpÚpù Ó†îAo="ŽSJ›%¾$–B;êw¼½ Qä³ m5Ç>µž}KʾÒñI$þË~„go!>ý7lS¿ˆ¡ûà{È3ü¤"jžGŽû5âì)­ì3A%ÐÝê™QZ†,‘6$ ¦±*yŠÿÖœ6\þºÍh?’mö]g-Ú4+0›*wÆÎà¡ç:¤-_œÆ.ø&‰éjþöÞ(*×5‘Â7J='zÂP ™—HfÞ6Í%©½_g²;ü4©3½™6ôDßjì äê § —¿.m&û`î5ܸÌÒÜ+mö‘)ØK{±%3Žò#  )3´ió„;diº6rŸŸ#m[BÌM ®À´Rã.ìÈWY¸}EÃF‡62´ "AÚHø/ÎiÃå¯Ka4aìû Mû Ráñó ¿b””š.éÐFfÈe›^¥ËQ$WÓl¿•8š‰v¢«Ô¨lTf1õ õ˜â§µp¤Câö%Lîø@à´áòW¦ïD]åÑÝ÷¬ÛÈh´= S<Š€5{ï6wÙ“r q¢º‚K!Ê©#E+²óœ­i,§$ZŒÒ¥#nƒ:™ò_œÓ†Ë_˜6Â`ß{n'àY}o´qÐR3Â=‡m¤øì^Th¡¾‡ïŠ®ç°ê¤%ðÒ1xn6ŸpÚpÚpù‹ÓFF<ˆ…¿K5÷@):!þÝ/SÿU¿÷i™·ü`º—Í}„¯¦œGÜyu²ÈÖ t9 ]›"k•Ž6ŽÌÙ|`õ†×g^ EÓM ü37]§žóÀTg-? zà ÿÅ9m¸üi#ŒìéÍám%˜šFŠ­Ü¯¦ÍŽZ\ˆ2¤ÛØcaz³µ ͘@¯­DÓ%êO]¬e«sÆqzn¯žË¶Œxj¸¡.™SŒ¡{µÖyjÁÂ@5o¾7h­¡¡tŸ9N‚º´â«Äœ6\þš¶Ä»õrïÒ>bkÈ÷YdsU¶Ó¨°9Ε­¶µ«ß¥ª…¬Ù¶¢²þåtü¯õ´éòQX¾÷ç;àœ6\¸Ÿ]XvCäå?„˵Õ4Ü1N.œ6˜´’ãZ^óßšÓ† § N.ÿúu›»ûYÿeÚÿ¿lÒCñ4ÿÇx¬sÚpù½ºÍñz¸ÕŠ$™ ,ö½Ïqôoµ: TýÏBÞµ>¬ÎÍt‡I¶»ÿzä$½ÅÇÔ cR2qLûú0§ —™½MökÑ& ö6÷Pók‡Pxó}S·¢ãýþhóðÚCÒ0Õ’ž±ŠEõu²Fô{*§Éæ>qa&ˆ–^${8§ N›fÚlÍD~%ɽûr³æï×äU!<¯Êñ¼?ªêÐЈ¬bbœ]¦®/*Šð”J‘Q#7ÖžÇ÷áD1 *!=Gàè$øDZÄF3³p"“Í5fçAˆGâ­Ã¸P†ôxCÎ*yfÂoâZ)e*Vt >öÁÙ2Œ9H|"ªY%˜à§a¯˜ÜJDçáU!óëäT!&Ÿ;³Ê? GJ9Îf¡¥Í;¨j y JT)oPä"¯‚Äfɳ$°>‰”2\½ƒo2}¯µ ü píIH*Ðæ¿N¤Î&àF5¦ëé6¯ ·î ¢®è€ ±È¬Àå[ ÊÍíŽÒR’+± —‹ðŠ ‡!»'.‹mà´áòצs€hè"È2“RÑ&E‰#1xÇ F¡$Ôs òüŸoÀ¢`¼íËÓįJ€ÃøX\+ÂËhã ÅE½Œo4E ^qGPvÊãô`ï¤çÛ(ZuäcR…ɺ ”¨2¯ÉQ |âLu›&¸Æà=o,ÏDý Ò’AĪ°“ÞÛGÚìBin Š«a´í`¦r|ì…÷÷ã°‰Žî„&œÅ»ÞèBÚð:5St*Åž³¤1]Ž’ƒ;¢/ÍŠµïíÅùrº62|™Šë×ðœ;©§p Å;Þ´êÉÎûûÑ$å\/rðd"Hûó…báxÛK®‡/A·N¯,|ð¤¶ÍsTü¢ÐÁË®áÎu’+gW!¹Ü^xï 1¥^|ˆex‰ºH²{JAS Vã%w.‡û‰?k!ˆÓ†ËÐFÿO Íëb”‚£6\«Æ/Ìo"²KýX÷ŽáNøçJÐÚZ¶k}¼È·¡ p=ÍÒ»´£ãJ,»©ÉlÝf`<ò²˜âñ¼+iC['<åLÜ%^qB¿ (o²+BýÊhV‰v‰4º ™IIHþÐœ´Ç¯Ÿ¸4DïÑò0iI1`ìÉ´¦s…uàç´“£yE§§[^ÄÍ´?+ϧ — k sP"² )”6ÝÃPy[ý»× <”Ôóß ¤×‘¡}2—¦›”jÐÆॽ5‚nÑpX¯:â¸ûŽ¨³•¦Îp,Ä/A°9‹ˆxôI$×+A¨¢Aü´Ömh…. ­hB½($‘®×j0f?s2½4ª¾m$«²ÂÂñ¥™¤dp6¼®Qßß›¥ÑÜo10W»`¶n£¦ÛòI Ó€«ðÉ$JË«”Q?^"•äÝÆîÒ™]B5ú°yÝÆmHÚîR]\ïœXÁ±¸“Çâ%>C¡ô˜‡˜S†npç"§ —¿ëºÍÇÇhZ(ÑûD¼ƒX¨aaµsÇÔ8š%Öþ÷ÐFZƒsêí`]Ñ+á)XS„ixÝ· °°˜9@éÓ¦ÕnœÖïÕH NÕ-6#|™n# ýñnìhú`%ž•°Äm‚6ÕÏ[}SÂX~š¹—î®FxkáÿÕÕmH–íuƽm™|~‘å$÷ûÁh,e}ØꮺÍ[t"Ù(ÌûÌ•™’„ÜÖú´éÎiÃåo½JLæ¾nôɧ¯ÔŽ®äCD>u`:¿ Pt‘Â:¹Ed´ êóýhý[´yÍDŠ{˜ÅSWJGR²®Y $3x+7â^(Œ,©aÚ¤Î#…ø„wD0ÂÝr–;€®ÛhÒæƒ (+Ø¥çdz^’aÉE|åÏ&n_§!Nèj:Ùé¤ …©œjÝFM)žÙ˃lùWøéEJ¾L“†?.AJv„1óh%\ϲ™§ —¿)m„÷öþcZ´ÉRù€KðÉqÜlÀÕ2Ô*awš áÍd•[ÆFÈ£I±×’šo—ã1:ž•ÿmþ†ÉÚ•CÒ‹_­@Q):©bÔØ“ÆܺΦ*g©k¹ªadºA‹6$¸Ÿ…d~”_ƒ2¡ºˆt«QœIÑË£±7)Æ»ô ïMRmA5œ" Ï'§wu”Ô)‘_òF½D ljÛMåõ˜v’Ür+ IDIýV“edzUXƒuAˆªDUÞðGF-*k_‹’2tr&%'¦’ÖÞªAj.%+Kþ1yõJ™&ôv(n+QSGò’ØCëCâÞ(Gi#N¤SÒ5®g5hóíäž—PE#1§ —¿¬¸£žÃµFØ@"iM¿oÍ à¶z™©5/¡ÿY¢—A[Æôõg[íÂw¯D*ž¥ãÒn«›7\ÝZ±ÁR t‰¼ì6›ˆ;h4O3­¹½X½^Æðæš%ÓüÁAû¾ìôò’Ûk·ª¥<àö†âBsÚpá~R\¸ŸN.\8m¸pÚpá´áò j%–J+ÙŸî›,.þ´zHWo­÷ÏVX³[Ë´·’=ä{á´áò¢SÒÉæ,ûS"úÒŸµ»A—I³kiÞG8Ý€Ó™¡rrÌ(γÓQ^òÇÜŽ¶4–‰“ÚL1¦3ɇÝð>ÇiÃ…ÓFëøçñtxº±­™V œ«G@’¸Sã škî’H™©ŒÚÍNÜ‘±×NT§r+pФ¬˜¸™¢2 f…5ÍÛ~óº2íÏ:´‘`J*1®{L³=úÕÊDÓ>{í8ýÛÑ–Ç=ɦ|·8”gëÑFÆLwt{ÃN]R«8m¸ü;t›Ò&¬ôÓš<邧d˜ô‰E[áž•Cü…ar¡[³’¯|b…ò‘”,͆ße„—‡Ê¶t@m»F,[Αo6ÓfG<¢ñæÑAŠÎ·Èçô:Ì?Ì®è[ÇÓ7 ‡Ó†ËÐæ gå?QûøÒGÉå˜À×L-„ÅwtuÌ<ðý TæcÎ,8ƒY‘$!”µÁ€ÃAI”¨ÂßÓ5m:‡£á¶úºJ8¦´©Â4vÝW±/®…A*G PSŒƒÅH¿¬öaÿ??¢SÍ¥í$¹öG™ç¦S;¸ó n1Äu”1Ä¡a§D»;ÑŒðÝ@4UÐT8¶h@¸ÚÆm„Æ”}id‰$%fxÑþÖŸcWô¹ŽØK–ǧ —ÿõLª¡ £öè\{â^­áîS‡È0J› âR¤M€H›µi³½yW gæ!2'œH¦¼Í¾¬3D““¨¼¥^B9ЀˆãŒ6ýî‰6Jà=ùp¾žQL™yû™Ö5·göi ÝGªºìŽfçFbz(£ÍÛb ·– á,Vä³EôÐ4œµEº1:>v5D Ʀ#õ<Ék#4«Œá}u”úŠ“‚¸nÃåßB›”@µ”ªzæíðK.R/áùÊŽ^ Ä‚}t&uo´19O³[:°UŽ×-ÓÆQO1ÐØ“ż¬;-¥#žö¡'šUo¶œÜ€¯ýØÁÇœñ¸”ͤ¾ö`ëE‘UØÌÜ3Yf=Úæ·lÅ#¶X]‚‹ñä+]ÚHñâ~(«ðq4Š2Y…w”èæÁ®øŒ•þýž%N.¿sÜ!¥d€ÿr3N!øêËñ&=ů a€)dÈwpÕZ‹ë7´7›¨¯÷sR´ \RëÑË™)Ks® þ6FÅ P xI ×m¸ü›¬ûì` ·Lø\ÆÜ ÿ>GLÁ¡l8'”`[:lö±×ôè³XN†çñ´WZ¼3é´‚ž¾8‡¯a[´ZÉiïK.´ç:ÈY%_Ç#(ŸºbVf±¿ŽÅᬋw%°½söyÒ9, %g`µmæáU…úFÁ'E<‰}9ð¾€×äêÍè÷Av‡21PåqN.œ6œ6œ6\8mþ!}õ{’ÓqÚpáÂiÃ…Ó†Ë_Š6Rm¹_e@úŠ„ôOÉ‹ý—Ê»-ý;OÓ8m¸ünÚH1á”jðÓé÷ã4-ÁÈD¤gýF}yQëºi÷é¬íˆùyøDrOì“€üœ¿Ì?H ›Û8pÚpù7ÑFŠOc©)¬hÌö¨3âêq(Q|ÿÚršÖô¤–`D".dr¯v³«H ´ç ê{ÞÁ]}ÝäìmùºvÇUP²%é!ÞÙÍv·™{x³šd§á~®I{CŽöb :ëb=ÒT”f'w©Þ)-ÜiÕCiÓÊ^¯òæbŽœ6\þºÍ&üè¯åþ´žq"ü¤óÄ3á9ñ¸h«Öên5áv%QK¼âH16™y(oBz9±×¨²!ñAn#®£¤ ùbtW*±ü€ÖuŸq#ét… Ä‘  7ˆwUšh‚›]‹µHÌÇþB2TßqÀdzGg®cã·NÓåJ 'ƒ\Ë1—´$¦ˆdzrŒÔ¢Í–”¦éšÐlÏEØUâ î–MH-tLC©‹ˆ Þ­xÌQ·KÿAœžrÊȵæQ[×Bˆ—VV n7 'W¼kR«H™[((¥Ù-ÿt¿[È¢)ó§Òö(pº’äÖL)Ce5Þuæ´áòôÊ4è.<üÛÓñžêeM½¼Ÿ”“™XƒåGY’)a,w‘aDÉoÒ–&në-\å:ù_ƒ•G™Â°§.gµÀÒÚ‰ä¢zÝÉïù^Ñ÷Ü‘¹,™‰>àQ Lsp*â4i¼Ð€¨^ñŸP–ÔI(ùB!†*E]{rü{5mžvÇ+.º´Ù˜…¼¦öŒÍÄõËÌ»sì^v q•ø%Të¬V´O¾ Iëžð%W|ZŠiÑãÇ |·—´§w Éë­Šxsª–²ý9wˆ79òìaÏGvc`*Š Xþ;“xâ0ÞJÊiÃåŸF›7œ ŸÒÖÒ,„àÔuâêø‚‚eÑýÂEcBgRsØüå…ê¤ A°>Š8? ⚇¤L1% ÍŠÒ†Òæe'íªí~p8Ä<¦ëø€Ó8ŸIDÚT¡5mò|ä%‹G’oŠÛ]×mh…ûØ-t?‹âë$ppËOÉY«ÖåãL¼F{’EKY£€K´µ^‘Šà<œÈ'×µ &G4ÁóÆíK,‚q·xç ø*,½[8vèAœ²ý3±à¸–ïùìx„äcKŒÚ\~V¢ø´X¬¤Äx?ÇóðÝaŒôhºÖ¼æ§4¿†¬†Îð <™| î'µÛC+\Æn¡Ã1ìMfчG"0ò<Ó‚ÏÜ„äaS”¨/í{63ÈÂû+È’×jZðÄ^xѸ͟;³ »¨«T¯“‘¨ÎçòÐNµ‡îŠš‡¥¡á€~œ6\¸çN.œ6\8m¸pÚpáÂiÃ…Ó† § N.œ6œ6\8m¸pÚpá´áÂiÃ…Ó† N.œ6\8m¸pÚpá´áÂ…Ó† § N.œ6\8m¸pá´áÂiÃ…Ó† § N.\8m¸pÚpá´áÂiÃ…Ó† —ß6í8m¸üm2JàœÈ…ˉkÜ“x?piQRoÚ\)†,ž —ß/Ò8x¦À)w—Ÿô"N.œ6\8m¸pÚpá´y¸¢þï–YœRhÒé3ŽÔéœ×t"Ωä*Ò¯ð<©Í)Iè:åw¾Rž ×ó¬fÖ‰¤¼ò»Vx·ÞJ:¥Â9÷ûCèÓFU•KªúêBçt¸$A–Ì~MJ*Ò wJ„ðÃi<y<¤÷Ðà UÄû}ÀßË)í¾{ÆЯ|·Â²$¸Ц>àmº\€"m$þ6m”;œd¿ž¬ýóîñl~—ÎÆ»"jšV®ùÙƲ§¹¥µq·ŽVƒ§®(•Ç“_sÉZ'ûÄ{©G¢ÉÎËÅ#»öº[Y6v€/qˆ}àŸ#ÖÚt Œ….N"ª…ƒïuº,‘¥=p$bƾ’*”FuíÜc§Á“0w¶ÉÈ’Šn³`þWýº:5÷vBÃ$³†ËʶmšÐ£k§žÝ:wïÒ¹G—N=ºuîÙµãï,šaÑ£[§ž]; Ç»w Ÿ¿˜é[âkÒé3£ž=…ÿ:ÒÓlÀôáN¿ù#&aá|ó¡Ëãe§3?ùog»ä{~„ÿ7~óƒŸD»¶™_ý9í~{fãæ‘ÆãîñM·Ãnr·¡ÞÒÿá«? ýl:.ó-þstBãTÌl±ú$œ“ÈÛ\ž z(…B(Ïþ/|årŠöòÊðŽüoÎämëšF’ß %]„Tåž½ÞÓØfw=QõÕy8%ÓÆ$‘bìôMÑüºtNcÅèkš¼I­C8(yw@°‘Å-‘¬ÌFÇM?²Þ ÷Ë5}º u¸"4›¼ÙImªk%±JT÷Kî+붬ó}„»zíHc£‰äø´ÁV«‚ËšßwÂåÈK\l°JyP¡7ÈJõ*ÎÃã„Þž5Ìúû°ÕKßó k ¹q±mªûuQu{šÖAýîË-5×Ôd¡"Ü ªB" ì\yô-#c«ñz[xØ,è=fMêC¡Í¢Ås}·G“6_Út¥(“‰·¶zѫ_¤M2é[ª=ÎøÅHIµ‹ø€9ÅÆ›~aº#‘tðæµ?nÑ¥ë‚@CÊ ­A¥Ê ·öíâ~#¿OnÜ3ƒõªÎcCºKõT'°&Éé-¸$f˜š¯pºÀTAÕ0œ3§×„õéì·Niîڱ絞|¡7š[²iûD‹)G‰–•¢~Œ…džþ‚º·°Óq†ñ˜ýR-UJýäûÒx¤â€"-¿@†¤Ä_œ•Ôo¡x׉êÁź%ƒ­8P" W8E‘é¬Û¬™?ÔÔÔÔ²wÿ N—ú½·ü`©j°Øùìh4Zr6£cg«5»62Âܸû¤5!ú¦^'÷ìÝÛÆÂܬ×ðkC„7uÓÆ=§~tÔS»Î68º­ù¼Ï¦yK÷4ØÔ¼ÏBç ¹&mšæ.[bjbjnnÖÿËŸ·ŸÁvéö/,çÊÓ˜>°|F«ù‘Âçï·î²ìÕÛṲ̈ÿ”Ÿ·E6ÃôÉ'üàgÕý³Ñ¿æo÷–YôùÊ)•=„Bã…Ÿ[øùÆ5711³²î»¶—µyŸÉëwÑ´ Œ2ÀÒÜÊÆĤÏ×;ã¤ôÞìy¨__k Kk3«þs%©ÂS½aÃ`£±A¿,)\Hèí±vé²}›?1Z%šuó«™Ó„¦š›š ›çhOÞhÔõÓŸe®CFOèee2t®‹£Ðª„ÆõÚìvÆ>®ºoo Ss+«~›Ý·‘ ÓÈsõó®&F–½O]hlBi“ œ¿b™ª·ûM^½-òÏ¢X`ÕüIVß*t´”„¦: ·½Õ|D Y'“ÍÑìŸòÌßeØòdÝiȉócGô³¾W(pÍhs:ë‹Ž&‚n#Õl„7ÎQÿÏŒg¬Þþë€á£-,,¦o9'¹cÓKè@ kë;¢¡A›±Ë ÔÏĨkß «wÄЋ&`Ùºuæ¦Æ“o3rѺã•B’S×ÆdbjÕoì’6OhóÃ\Kã©2Ú?Âûe˜õ{s\nèwc3mœˇXtž´5N¸‹-^‡ôí%´Í¢ÿ´•INguíÜeW,{…mÝ4§ÛÈŸ{uú𧓴/ߎŸtÿ9†Ü¬Cø™î]Kô[(\+$ü³ž¾ÿyVó¡²l÷>ØÛÒØ¢W¿Ñ+4hãœVÙç“f{UÿáºMYšÿÑ <'ËLëýÝaòÀ$b骩#–UœÎèÑ­Ç_. œtI­±6ï¾6´ZdÒsÀ–s„‡›%»Ì^Ü æÌ7s©Zf,^V)óÝÞ³KÇ¥þ5Â野t3äÈž#— ?‡K:æϘ8du°kZÕPãOø7ý6ºÈ¢›åÆ8{2“^_JRÈå¾_9Çt²LÀѬyƒÌ/‘]¢o37ûÛ› [¸Tqzã‘iS'\Ï3ê4Òþ"y…­sÜ8r®ÌýAú¸^&S¼Ë„{0ÐÊjŠÜé"¡ÓâåSÇ}Ê^IÂhýa˜ÕØ™§¬:Z'èfä%˜„‰{›Þàr‘¼\æM3´äŒìÜm‹.=çî­$«FI×mÌ>ÿ! L‘†áæÿ]qŒ¼žœ¢²M\ᘊ[Æ[|y\@Ö^«Ž×,ñÝÕ¥×/ò X0oÔ€™rWúÒŸ5ÎÌfN„,®ÉÒÒ¼÷·a¤ÚËÖë“%{ËÉu³fiwòÌåÛb”NažFÆ ÈHi…_¡§»w껞þ@¶/35ï%ÐFzÔgàðïd´·Í:h¥¿ð£<\Úôýú×_öDÿäIdÍž3£¬»?mâTzcãDëÇí¸©33ÒËlº4[x³KèÖuôΑ6‘9=Œû ´1ðØ$Ã),¤{§N_)ŠÈ{ÿô#óÞáÇ V›“çPK·™;À¤Ï[ªÌŸbaýM°pÜÞs½‘Ùan.Ô¹vÃòîýÇÂ…#Ïõq»ç„;½ºwh#‹É072Þ%¨P„ôèñ•Š~i#OVNl[cͳrhÏ.?D ¿HF÷î½6%2]nR_›I.KgŒ·šç½ãxþÖà¼! VŸ t5|Qßí]»MWM¢’ïôëØiI¸¦n»ˆü_¼Î®/˜=ÉüwAµ[ùË¢A³“¼Ó/ÐbàEBÓÌF~ŽÛv,O¸Ü®ca¦ŸõÞ–ˆÙsûÿ!Œê“L•]±ÅnØø)½zYtýÜx®âyeDž6ê4b—jŽ–ˆ]DzÖxœ\. ž1Ò¤ßÏ—„ßnà@³Åû TÊ碥_Ž]yT¥ þ°~¹Yÿ Vfvt@ýúÓ̹{ò…guâDËéÛâTóÁ® «á‹Ÿ5µê«jƒðÿ/G žäx^в&02ßySPžý9¥½}m„÷²XTJÖm(œ/Õ íùá¼C¬†]‡¼Í{M#´±0]V%£«Oãƙϑ]mñÇ v52žïÀ*xò«­­ùÄÕd²&¼y# ŒL¬©nûkio/œ7Ílº\Pÿ*mæYô9bÒÌáLfؘÿNÚt6Y链nêZï¨é_5î?×>…|EÆ#yB¾eÏNÛ΀NCèÌ"I—6úÍVá9 ;Þ¥ë¨Ý*°DÝìid½MÐ`$Ææß9j/hÌ™ÛgôRÕó€]Í{MN™3ÜràÖ,º¸§tI¼lþ™ñÆŒ4ùpn…IÖ|Û[ ðyt_ËY>DŸY¾pÚÈ ' îß©h3ÿ«~ƒ–…Ëé,æ§5«Ì&mØJFÖöc—úv1ZyAž¦&Ó…Æ'äYv·Ùƒõ¾¸ÔWÀà”¾?šÐ¦k—Ûi:„'™ZôRM½q`ï®d&õgíIiІtò„±V³¤Y¾ÞF£ÖPþgt7ê¿;‰þfXï¡v×fMcÞgHÿ¡£ûÓȘea° ¿±#ô¦†ÜpˆihÓÅz4EE›Ê¡=>™ ¦í^¹±‰ÍŒ-k¼–.œnþ‡00塧»ögËçY•ÏjãXKË#û‰—ë7pÔ†hÌžÓgÒ†y¼z:¬ú ðÊþÀ>‹žŸýXå,Ò†<¿.5¶½Ð!⟄¹cÚ\&´`²Â¯Dõ®iƒ]~GMûOf¸;¤ËLÆ(¤‰ÚÛt}h-Ñm&˜Í’°Q¿ÅsùЯŽšõ©B± s&Œ°áœB˜8'7~»jEŸþ»u´ñ¬ µD—‹·{ÑqY8«Áöh¨©uJ“õ5ªeüx‹92áRîÓîä°›dJ¨C›4¬Þ´Þfú&gÕ;âl‘Š6vû]ŒMz}³)@èíeKfšM{è´yh3)‹î=FÎX9~Öòñ³˜µ5\AwšvèÙ£»qÏîÆ}ÖÊcÒ̺™ ió GM$¥Ñ—ŽtÒ-ÐÆÈÈz{| ´™c3þ—Õ?mƒÃL­ãwBo«q.…ªƒÎ)E}º|ôã©ò¾_tü.Œøë¯cU´qðXݽï6üCút]}Œêê†hcjÜÕ¦ÕÕ§dt½ô»e‹M{õGÖèþÃÆÍ „4¶ÎÒÌtýɺíÛf÷Zvš¬ž ëÑk¥Sü%³Þó\ Ì­F+bKŒMm$†Z¸2ŒÒ¦çX{z×vÇŽ›YcËP¼f@ÏÿmHvØ®5îºdÙ”)Û3H6ݬÖűťÑ6ÖÓ÷ÜX½hŠå· ¶t©”Ä4Ê“¦ ²ìÕw€ZúôY\Ft›®“vÓ’NñÖŸwXÝL›É6æ#åEªf,™÷£M fŽîÑ£»‘ÍT7ILƒ$"ÚÜ¤Ç–Ó NgÏZtí²êðILÓEW«¯$i-ΤŒzvÿÊ6M«\·k³Ñ€yä=%ÒfÉKëE§$±v~¾Ã†÷í1t›œþ.›ÝLMÌúMpP ÇàfÆæ[NÕXûeý¢nƒ6 “e5mâ±Õ}‡©¹Õ²ý7ÏÕ ²ê§ÙFÝ-·œst¼é禿óÁ¤¦©}?½%[¸‹Í²­ÃÇÚ˜}&MТ͒•³Í•ËãíŽF™õ[²^S¿sŸ·¹™é˜_c„Uë6Æ63¶Ÿƒ,æö(«ÏFo)ÅV 66»óŠPÀáX¨EÏ.¿F4:Ç]´èh¶&T¨¡Á14Ѩ[ß-IjÚ ·±šî‘+mjVEV¬Yl=v•TQ%#̺ŒÜQ(5D›–~YyØA“®wF55ÓF™dò…Ñ’Ã5’غE³«Öm¾›lc5?LèmûC~Æõí1øWù߈6z2~ð€¾ßH⚶Éwv5!(Ã:´1ðؤ¦$ØÛ¤ÇpÛè5 Të6Ö¶žƒ4¦rrÿNƒ×e“?~À¬‡Ù擵’XÌŸ9Ùòk'}KœÞ{üz™ðä„Ä™š˜¨h#Èâ©Ã¬Íf9_ãíÞA“×R$^%–ñ4îd±1N1{uî4ßã†Ðæþ¡ÝM±Ÿ˜«f–ÆƳíãÙ”mÞ¢)ÖGLs,&[6ÛfôûjÒ°E[(¼ÁÕ´n0¦ÊÆÄdšÓuáá\óóA¹h£HjXºAº>´ñO°·Ùí!131¼&NN×R.œÑÿ[W•NtãA»N&èkib>p™);+òòø‰ãMzüjËÎs-_T˜IõÙô«‹›•…±Õ ™N«tû‚=­ÉºMlõ„ñ#LL¬¦nU$• íc:h¹Ÿð¸*â m:vžÌvx¥‚ú=rôScã‹=ìcÉÃ0k¶Í¤õÉÍï »c1£ÆŒ~kóÞã–yØcŠâÂ…S{ö4]¸¿ÖñDƽÍ,ÍwË—œI·25žèZ2°¿ÑŠƒÅ*¤KŽÇõ6ëa5nðëØžØßÚÔÔläB¹ClÃW3¿6íÑõçã˜8Þl®ìüô/Ç›Møé¨jÓA[;cÎsS“A“–n¬Wݸ]PÜÈCLŒMûŒš÷ËñZj‰1Ö|J™+y)„ÞôãYÙ]¬&‹º X/•õícm5xÊÏ*…ÓĄ̂™6ãƙ͑fÝŘgâ¨þÂÀYï´UHÖNõïßǬ÷˜ŽÜ2ëi¾Mè´¸ÚIG™˜XNÙ¥Hº3¼¯éÀe‡¾]h3槔‡B›…ßθÄS‹6½:iÑfÞËEº´Ilú¦ßç:´1éh´9ê7 è´ó–Ì33îÑoÒ/Û£éLêÛÞ#V%Ê"³»÷ìC©ÞcCt›Î=&7Ó¦GËí¤ÂƱC{›ôÞrZnɘ9ÍDPïg~3ÉÄÌrÂ*ÿ橺cHäˆCÌz ž¼áÛuJ¨_°h¦™‘ɈŞÛ›ßOJÆÁ)ò„ig£-ôF6lÙ`<ê§m{ǯFùªÔ‰•ßNé9|«p]yTÁ”©_šõì3~ÕÖ¨f‹ 2­'Ë‘‹È™m×/¬×ÑõÒ]‡C{Yoˆm©…J6»Vé6D©>›7bÔ0ó> }n —î+rN«ܳÃü½5üLJÇ„²n¨ùGKÕ³õy²n3PÓVªÙÞFÇ`µEÚج—¥h؇4ŽÓ2÷U/¿/‚={MÏtjAÿdÓ%³ Ù¢(¥ñ÷j¦K+QêÜ ¶õ{ß ´™-ÍÕ.©4P[œÒ€á¨†•²¦Ö*Sê\QûÎͶJÕù§Á‰3|‰»Ô|_¶Äz´¿Ò+ ÿ»kPþ¶-®ÁG¢ùéÒ{l4¿Õ. ý¥…Ë)õê=%ÕåÆØ, t&5 ÙC¾ÚîœØÂ#gxP4·YwÝÒ¸ëŽ3Mb4,Òÿ¿½3jã<ãøŸÒ_Û©K9%í®n!‰Ã‡H!æ4B>ÃCJ ƒAFt °ëØ@Œ‰ÆÔµÁŽ!Žb¨ÝzÒñLƒ;qIÃì$h«•„Bª/péwæóƒïŽx÷Ãóî>ßÏîtGè9÷| [ž\°ÒUõ2~TvçZŸÏۼܠ޶y¦¡)ª}\6‘Ûóô¹óíÍ7^zÙ9)|>i¾2Ë”hï¸ÿ5ßù¶þæ“W™Ò–§{ó‹%b2Q÷`mð6䤴½÷*{6{Š×²\Ñ}¿ùÕC óåÿaxñiiY<~aV;øñ­übµ}su_<ÅÙÛ<çûztü³{'‡W6Ác+•îjúç _nb¤pÛdÀxþuó´+~µµ»´Ýu×6ó,Ó·Ÿl£Oͼl›É½~Þ¶àåj’ÈRjïz¯=M-ÕÃvW×ýAuWÓë•Cúá…ÐàšQ&ZB…ü¢¨÷ß/ônì¾òaçC/h0í”éõã/yH=§–¥ŸÆ”€mÀµR)J¯›k™t§]Î(¥Dù³kÍ©™Gåö %ŒãvAev­i½ÑÅÛ«ÿ3Sr¨Trjçæ9&§œ›!”¼ásícäJËï0XX/N0=l# ç”\^4 Þ BÅ·™òCÛjâH“g½æ¤’Ë7N1¡¹²üXBÙkš¦ÓÓ Óæ ¿µ É <Ò÷¤m†®¬- Ï×;ª£/¦9D~SÉoŽS$K;´¢;[É&ÒttÛ­Ú£`IòL³?ÅRÛ2;™- –%1›R¯5ÆÀ68_ÀØ&M’Ze1:K‚â²wäYýFË÷R‚*½ÅÜ6^mg³2q³4•8©ô†+J¯ý´‘aòu=§Dý{áÞ¦V›;ÂϬV¼m³T˜“)È4˜¯ùÓ×õWgÄœ£#Û¤ cšœç»]¶(LV­Ÿ ÓRw©ê¬F×m+)òpsÙÙn¶}%ØVz›Ö˜Z©˜CL”ži¢ûQAQû..å%EFTM3mSpä}yÎ)çÂgµOØË6ýË3”\q„4j×*Šœ+NÛ$u»ßÒQ&=ñB¶‰jv]%6O}#þeÁ5º¬¡^_¸ºòú)%œ|§e!u»ÄÏa®_Ÿcm?9I—‰ÜY3¯Ç mÀÿÌ6v¯Ú&þèU× [}F'ˆ:äSÇ5j*IkvÆ›G–ë®ÿË°¡¶)-<ÀÛ¶Åc;ÇèÿÕ6v¶a“Ù:gtºul–·[>BkO}BìØç^|ýMRû/.VFÉˬ®›ïµ:m°0±ÎN ÛÝð•ØüÒŽÛ€7iãØr‡<Ðó=sêú%"PÆÄçÛÈqªÖBÇãÃv¨ø vµ O[0XíÙ{åòôO7ØfÑæe# láê·‘ˆBœ›½Ð†[÷ã)6K–\ªbF¯ªKâ't¹µ½(DTÙ¡¹òxór[° ›cÛÛØÀ6¶° ° €ml`ÛÛØÀ6¶° ° €ml`ÛÛØÀ6¶° ° €ml`ÛÛØÀ6¶° À ml`ÛØØÀ6¶° €mlÛØÀ6¶° ° €ml`ÛØØÀ6¶° ° €ml`ÛØØÀ6¶° À\‚ml`ÛØÀ6À6¶° €mlƒ¯À6¶° €mll`ÛØÀ6À6¶° €mll`ÛØÀ6À6¶° €mll`ÛØÀ6¸fÈÌ?éÿ"þà endstream endobj 952 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 114 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16294 /Filter /FlateDecode >> stream xÚí½TTÛš.Ú÷õ}·ß¸£GûÞ¯ïë7Îé¾}Î;Û€¤*¨œ (rÎ9'AÉ ¨ˆ`À€Š³˜¨` ¢(Q@’JΊPq½• ª ðlÝîݧÝóX®šk®¹æœ5ç·þÿ_ÿü'üÍ@._3Qí©¯,p~fb|rR®”(_Î(_q‰ü;6KõÈrÖhµRä`h|_®A>$£Ÿ9ô?þ úïÿQ, š‰eØ· úÇ\ùGß=Þýÿ¨æTÔý78ä¨+° —)O^¹8ÑÆ<æî[ål§· B’!ш‰ÀÐ…!ìºÿvÍ ;¥tü“bÝ)Ÿt§2ðïðYË´óO•ébèE”yÚ¬©ÒéCÃô²®µùI´Ý×Òg{ß÷“ ¿û;äïûïÐÿøoø±õ ülÊ¿#_ÿå_¡¿üeùÏá4Tzúzü?ÑK`šÂN¥=S-½×QWÓ6쮊¤ ÇóÃo¾QÎ÷23–å›_KsŒ¶ö†(ž–ÛÉŠfäkã§þqá`;r¢éÃÃQTkß4ßûÆ6˜Nl7’Ÿ5¶¶ h¬-°Ð5rL›S0é1+굶Iø¨üJ ŸÅvf2v—|Vۣﮙ‘õœílãN€qðu(aÊ3åÔ㉯¡ø;èþ j›_f›Ÿ×,¤Ø É`¹K½&Õ}› ©voDE-ùÛ,A’j¸10wdõ ßgï¦8†+% Øj2Û$K÷–L6²è¤š¾$aæ#“ÆJáÃK;wˆ 8îšlSº#äuŸôAZ¨C,`€ïƒîWh&©Md Ë0¶yÖ¦^í€ñÄÉ`š¨¶øî[;4µwGW\‹°ÍÖ;ÕÊi¯NÄ3¿Û t#™éã0©åŸ¦á¯ƒµ9,ã(ѲÍf1v ¶YâÈ;)!Ž€m¾;ü ®HëÀ¿.ÎC33øߢx™mÖkC4þG%AU=Ë%¬É6Èì½±#H‡á:¬BOÛ™lw &ÃÀï;° Œ¾·Yt«kWNÚ9ÿ¨”yM¶Y`€_FWìnÇ¿ÆZâvø/ùö2Û¬øËmúlƒ`{ 1Ã5a!²MÈ…Bá专D|³&e¯Mä›a056¢©×ߣ§æ"éäÓ`€ÿxdx ¢K4þu¸zß•Fw)±MáÇoÒ¤$Æz® '¡¯¶¿»Ýf!éỺºZõ¦E¸fÔû„`à!S©.`€ÿÈ¡¹JÜJü N‘(…Îú!‰;n(±Í'h-ºùÛHjŒõ´NV®ô£ù­Ä*õ«¾’lz\•ëTØF­w `€_ ÷·áúÑû'è_ÿ?þ?ÿ¨j`™mþø'hãÆå¿?q Ù_—m$Õ)DmÍ“•Â•N{¿ ÛÀ8ÎIz0Šß]6×ÝÙÙÓÝÊaÄÝ©èïîꂵ-YéÑĄ˯ÑZIû»`ôž‰óµ ÛÛß÷K‹Àwo`Ì@Îèþ+ô_þwˆ`=¨]~ð§þÐßÿýÊ¿¿ûçe¶yê‚°ÅöÕ%×ì¶#èòV“ Ì6q¦F[o©°MÙ‰xŽ¿2eIö4ƒ¨a›Æ«it—­*v-ýí«ÙfÄ™È{/UÜ}º˜C¤°–ÁpÜrf›¾~ÒCô†#64K9ÝvTFÀwäùš,ô%ïýUT3«[©°ò»š• Š¤5Wüìœ+CÈ¿Øtùš €pðc£?ÜÆùÁ rŠäÊø'Ÿ¿ª¥02?\ ÛxÄ ÁHø¥è4[¯{¡[9E|Ðœâ|½åk ºîJ|9&ú{¨;wÅqŒ€_™mÄS}U/KJ^Ö·õb2 o¾µþmiiiùëêá9Äó¦ëíC;}Ú™üÕÝÂŽ—ojUeYkeyë(. L´T¼¬ø Eß.‹…cee/KK^ÃÅ K*ÊËú§Гòžw/K^–5÷a‹ž ™Ž7%eï%è9™x¦âeI•©ÐÏïßÂU}ÿiši/®lÃÝúfß½*ƒÓk?t)K`s#¯ËàF”5ÁùâÙÜðçWep»êædò7å壳âe¶3Èæ[êªJJJ«ê>H Õ/ý‘z}lªyù²´ª¾M„w‰¦ÞVÂW½©û RTv¢³ª²ej¼»¹´¸¸²¶îÄÙ¶—%ůÞ5-þ""Ê6{T4©C ¶™i®«MrL9qd·KÏ1ñ6–c·‡ ×Æãà‘£±~Öº¼F!T{÷ƒÌØyòÜ“¦¡öÜcl‡àÓ¥.ÕDp =\Ü-Уêv¡a->—a¢ŒYº%=qÌô–²Ù¬È{è2 ù¸«>-3Æ‚‹ßWœaÍ é²PÒšl¹DfÅÎ-±‡\þx»µÝxÇŒ`[£cg4ÍŽÀu˜ï«Ò×%9‡í8ql¯‡lzc•Ñ7´uÈ~ñû2n7¦"Î u“Ì4s¨d·ÍÛÒ·‡š˜°™4$lŲl#‰°åòí½3Oq7æë9œ‡”ýq£;I–l#ó)»M–AH²tÚÑ€færüä_3ž– a uŒ¬¹âÈðÊpÚÿôÑ[š®íÎ[Æî‰ùOr|Lõ\¶çCÀÑàGdK-×ÜV 6lÝe›Ó¾ú»ÊñaßûX[Û°¡„!k¢Î \Ü7¾}‹¬‚u ŒŠq$H…\&KVúàJîêQ#ž˜ú@gE² ZµÙyQ4¯Ûý v†'ž|€¿¶Ýñ Ï}ÀtFuŠúk),ÞÔÐ}‚ßü}~Ã`GÙ™^®@ÂåT&óí/´. O’I !·n­ÔB¼€¥eu >¼FDàM~E$pªP²ÚfGˆ:û¿¶åì&-ë.*çR7çb‰C טtj…Ûô\òÙdµ¦d"7szÖóˬ ‡„57µÙŽSø×ON,£ÂIèC†µ¶ÃIÌóZ.ž±4`œ‰,q­¿îÊdÑ«ßÜIf ,çÐe9t§0.~H¶1ßHØó¬¾Vúú· Ƙl3ꦭq¤eéÁ=ê©£•þ™7}LÇÄô3ï:Fñ³¢N”mÔÛmÐ)%´aÊG¡Áê»\ÇÌæcŽ‰¹°3âF`¼›ƒÚOx›ï¹ sÒ!szÕôœÛ¸M }*?öÚ+X~<íÜ^hº»œf²§#;4øä3š¤ÐŠ‡æ—Ùlæ›@mœÅ'ßU s˜m„þDÍÝuE-¦‚ôtwVÃQ·¥¦ÆÍ^LaÿõXoÒÌî“íäS"Ÿwá:Ól?,Û(³ÍGAÈΛW³¯ ð73 :õX¹™¯¯¤r]⮉¦™2}n5(* Ýocèu± a›k.LÏ›24µ.ÿßb«½jèé)’m—¿3»Í€­†VÖr¼ð©`}ÄjÌj"¯+ytlÿ{#×6¸eTòe¶Áø&ÉÙðÌ‹Á²³ž÷F¡á[ô€+Pß3¢À 97õX-—}b1MçeÐWþÕÉÓ]ü€ûÈ:©c[lv^kk{ær¹ šyBwJ‡¦êHl“±|I²N•1t¸mŠ ƒS¡æGa}ËUSûpëÒš.aMkkù,µ 6j?YºzÈYgýÉ¢uGi/^ãùál“jmd±yû…³YÎ?¯òƒr#K.$ºGb­U°(Ï {°HzÜÙÈîtÊ6ÎLï»XÍ`¶1°ŒÄV€=lð;dÉ6ƒõ[ãöOqwY“-]›\*âÛ.—@â%¶Y¹Ži‰nÚNúúœ¸ŸaA«D8aÖ†î˜w÷ˆuàyL3 âo½xÄ³Ý OºÚ ßmçs©Œ”½ºo%Ú&ž¸ìH)‡õ±Û¼ ü&ÏîT©pÙ\«¾NÕnì}-Ød‰hRûL5|nàMvkR®wÃêžÐ¹þpÅnÆ+§­c”ÏC§lÉÎÙ-X‹cM,† ÛƘqï.Û“gû¸r+;óŽë™{)¬ÐÒÆWe]óòœ?õ~•\$àîÌ­lØF•m Š« ·ÉùE‘Xú$c Ý! 9?ñŒºW>°¸¸(Z˜Ÿñ2g{ô’ôšéR¯·OŠÅ²Ñ–ʳתo&ŸðL즾Ø÷8O#'ÁÎb!&œŽs6´uòÌêDÎu]âÛšr¬üð™+¬àsMMùÖóhÎ#Q–¾Ö›"4Ø’qWÖCÔX$v1gÅ/–KÄS=oŒLYڨݦùÉ&Ûr`fnBÅå4s71Â4Õ_à»(‰DâK‘NìÀpâ`~8QÏåó¬T*^å3è*lM>çjé^¯…¯™ŸúhÂ$dW <&šîLÙ™Ü;-…ÄíV:Ĩ{mpÏôfhàÓ²¾Û mrQçœH,i¾Ç¢Rj%€m~—øÄûãº,•í•D{ùZÖ—›1É¿îÑ1c&EŸDõKÊÉ1Ñ¥¯æ¡‡WŸD¢pÍ2óê0£.;Š@ :¤·Þݧaà¬ö•J¸ázkÿtì¸ ÙûOfŸ1½`îîúÓ_H'±“ãnÄ?;†_QØ| ‹u<‹hL¨:“ðM~3:Q wzj9ïÄØL2þ>ÐœI 36ï¹1ZŽÚmPpA–9‡ª¯Oñˆ>24D @Ë‘”f§ñh$™ž~{F‚Zpäâ܃ad"gðúS/ªIÍ@wÿUË‹6:õ±,Ж7œiìœW߇Uon¨J_[£å…±Ž8O3’¾ž¡CXí.Ž¼Ï÷0ãè“ÈæîQÍø@í%k=çÛÔší^œì˜Z^Ü!žê˜Âî:5†uÑð¢DLÓ?$d­×6j °e‹Ê./2—¥÷D5õŠØ½3€¢ç¿ÿ –!Òƒ’hê¿ûFv–}¾Nüt߃âwÁÞÑïÒÍÑž\ƒàytÞßKó ³¹I»w;p©‰ØJ¦ÁÇ;¨úúnA[œŒ©l®ß =ÈŒ$YI‡å}ž—×ø ;J†±™vpy6©©I4Óí6WŸµà3rŒ¸vóš¯ÛÚ3Ms&­Ë|%\K¶y}uËÔ}^†4ôè[:ß49u—%“A÷<"Á<_d‹þæL ×Ô”#Ù8&iÁçû›6)Ž¬='/Ýæ¥KMªîlƒ|̺›1VnI‰1†TšaLî Ù&=”¹ådKÇ57=‹£ ¥NzÆæxYÅÀ›Îb'¦ìv6âQmcÀkw€7RuÌB–ÅU\ØÌ°‰ËÇŽEm÷´&íh®(×øÓXúÄã˜õ‚dø ë¡Uß¼¥Ùx3™Æj_œsjÝm@±¢)Å—¹5ó­|q”IέCÓf‚xô“ï ùJª†Q6küÄŽ‚oÕxÔ†hŸ)Æ.vqè´¼VäªÂ“véÚlC¦j³løtò¥7#X3xÙòìÜ—j·ïÚ3X(ÙÊ šy‡ÆàéÑqññ'Ê;¶!;L*(¯>'ƒaë «Èššššë6ñÚ!h¨0E—dzêî‹æ–¶–æ·FT]õlA½Ù¾D_dÙûo}¿›HÓrönešXÇ(uÑ®Œó`lüˆVâ^Wâ&Ï3ÍÊVbaï /`’Ä°×ÇÎà$klÐGç"Ûü,¶Z¨=C÷Ù±ÄbR‰D&‡D“¸Tb݈ ³ÍN öEêØ:ï@¶Îz_-ú0iÅŸþ*ÛÈW° …Ý8%íÊÙ½‰éÚž+JræÆ^PØw!‰X‚6\–íJµÍªSTV.‰‘ÿ»s7êšå_L8E«v£8Ù”p«ת&ßñHk² ÜO&Z´úÁF2Ѹm@ÃÅT÷˜å.’"]ìÄ?$>—ž%RAïaöÛÏN±´íyíȤΠãYa“ºòü6’…6 ~6ÛÌAÂ×Ü „£•ø ®m®ŒÈ¬H¶àÏc{f_ÿc§$œç«ùt”a¡WeÉžÌÌ0,~@á}ˆ¶¾Ù쨥±qÃFM3÷ˆâ†Nü”tîñÙ•F¡8„¤¶Ž,`Ý`;íÄóõx ÉÿS3ž·Ÿï:¬79…‹³×oÔ©D‚”¶½ ¶åQh4•»÷ò 쥒lºsÏf;‚.Afõ¸}M$¿c½~Ñ÷R»¼z÷?ëcf™š¼Óæ\:F3² .kà ËГC /<8 4\ð‡Ÿ˜h õÓ¿üß饪žB“M?m$|˜XDæµd8˜ögLjFS›ïiÆ„kEfÏy#QtEcÁEK.…B¥0 ìn•£FñîÜ 4§Æ7WíÙD-€Ôì¹U6uùt{¸-“@¦[yF5/œ ³Ø¨A/‡êΚhØ#ë­R¼µ|ÖaìÒ/þßþ׿Ç>›\’ÂÆ;*6;ðÑ.bï¾ð ì¹ð3Ž:’Ck„ePŽM¡6P¤ú2]¿­.X%Ä‚r ‰Õ••«¿—R²º¶©†vP[+µµÅö“r˜Y•yUo­VäVšÂTû’«ÓüÔVàw°{Àoƒž<"×° Ào¤g‚hzÿ© î)½yýZ+âmûëŠ +D€ß™® 9fÏ6äУ?ÿµ¹FØZ@àï’‚nø} 63Ý\:¹îÙ¡õ¼­b…ü½k–I1È–^=/¥ÉdXd…‰ŠMdèU2<]‘ j*ÈäÛì¡)ˆß¬ 9¿#|ºH´= ³ÎΆôÊÅ%u'/#I#{x¹Ó¬Ä‹%(‡Ì9YÐ ÌÝíMÉ,ó»]èF½ƒåV×Î?ÜßžÉâÞ¬‚söÜq%ºõvu?p$Ãß’jj—(”AÓ ¾n¦l¶MBBÊ4ç«ûǨ‡ ÿ~'z$õ¦èŸnBög{zb‹¹ß^L7\Ò"9tbëžP´ R¨í²Åþ0–öáÑ.ªQÔ<¥ysö?ÅŠë~”¬%@¤þ‡>d]Z¶dA¸®¹OæÛàáUKˆúf=(¼8°Õ`s*®RáÙÓ ˆÁOû!Õ¥âv„ ûŸx¢­ù o¥xa]ƒ4E :Q’34§ >ªºih›ì6¿CÜJÐé,¶vÖ }=·KÈÅÛ»B,£aŒ¤ a(•”T1¬ * -¦D=k;[v¶V6÷a¶ñÖ±» È$>dÅt¾VØà÷+ÚÌU16ПMB c0ÔQvŠÉq˜‘BoÇÐ}·/ñŠxqAIN[ë9]mÇ50¹lqq‚&ÝHëÎXY4"Û°âñpvÐB‹™ð¤° Àï“j`);•Àp‹R|C?f:FA÷44òœ¼žrµ!†ùê35Ì; h¨t™nÓ‡ê]¯Nù¹ 0ÝœØjgv+t¸$“ç¼³ÛPõZÙò‰:\Þ‰¸ÿW݉10KDóJkŠŸ5‰Á/ð;€ÄŸ÷爬†ÎvCÈÚ~7àƒ¶Ò+6\=:ƒF5rÌ©êB¥éÝãI4}}*YÏÔ3®i ݪ`¾7#ÎGŸB7à2 l ›†0Ù†àráøö@3C}m½g^ ¯¯ ÉŽR.q#™Âi›žp]÷m¾?~€^´Q¢ae<‡²š` j"$ÈQ¶ñÖ±¿´:¯:uàÛ°Ã%п:Ûä¸m°Ѽ~u-m¥^ðŸ]muŸú…L\_W;9'ù*!hI‚憪j[¾mÃìPKcÏÜ·U^:Ùñö}Ï÷ÁªÚV¸9âñ¶wýß&Âú\ßÜ9ýõ¢’.ÔÖÖ-JÕ]*V×ÔÏIdj‹Ÿ)Žõ¼oü8ù%WÉ|MmP,SÓ_'$ËW_ÕÛQß9&Yk­i«íðŸ0M<[][¿ ýö¦c¯K†ºÚjkj[>.HW¶«ÇXÿçúÚšúÆÖi±òTù–k«ähô]Cû.¶I dÆf5B‹fƼ²Žé¯jüâ`½>' YàÐqC—´øMÈöÔ?Øü~;ÂÒˆ &¿§´]ü‰æ 7gây¸¾ÓWÛ¯^%°Ÿt!=yk·™gÚ[ùWs $ü\AãÚ %ê^ùM7ÈÜÖñŠKFíòÜ~ÿgÞâQº‰yt±Úøߎév•Ý<¶°"9L`Ñ÷õ“Ê•ë0¢”¸Å€ðp ê{ì§gwvµsé!G~ÛÏ,}¼N—ÂïJ¾™là%g¶PX|¿Ðps‡ç•,Sé9ä¨éJ(…Êpñ q2eÑY¶"ÙŠ"F§¹ÆßùÚÜŒ;ü|ék_Nš t?ô›½–ÿÌ€ÿJ‹¥V]Ž³Íš%,9ª¹Ñxóm¦qꊇ’Ú-ÖzF@¢ÉlL®œW¾RvRß^ùZl³ºkU`tœmÖÎ)WÙ²bÅä‘ ZéˆDµDùÏoõsíýÃmüðçJ>J¹q¶YQ>ôpOp¶ºvuÁò•_TØ&ÕÏea©yÒ•@e7Tù_‰+Ù+©Û@Óz|Á¹Ö½à€¥í2»ÔO“‰œxÆbl³ÊåcÌF“ßó3+¹Ä6ê;÷ sK‘»?_G×ßÍ ’ïr&n½ôQy ñäg6ö¢k´$Û—bu´~E±ÓÂÓòÔÏ8åNQx×cÝ·e•/e9kw¡ù·”Lò³Igg™á•| ©‰tÁ„­›–˜äèî§Ï³ÊiEÒÇ6hWvùû†Fnñ¶¥{¼™R–mÆèBQ ’Ôô`¯€N0·² 0xi—ŠÑûˆ’Ãœ˜,gG[²>7.ÙÊm¦±ÐÑÖˆAøúwÔfÿÑeíɧ'.f®…“« ßÒåE;²TýE+Rpnˆ¯BÒ6Cªot–eÀ‘²‹lûø²ç)¶d¯L¬QûœôÝÂ¥07ßó Ú’íOÓç}Üà-‚ÇdËû¨–màßa¡¯ÆÝÖ˜cjãd-`ñ,®¾A~÷™‚ПÌS÷G¸GÆŹ È6^iX°Œæ –Ï‹!¾Þ±ñ±Ö<²_ÌY‰|Y¶Ëóþ³ñqT·ØêeKáŒÙd›º9dñÇà‹f†1|cŽ™“ï§ DÞxšâN£Ñ½ýÒ7ßLdXo{… —ûÇ¢¸ ª›§'—Du‰=‡È³]ºDý;‡£}C£cBÜõxvEøÄrÆ™x¼M-vZPµÏ– £cy†²þLi4ÓD¤ðž]J°°°6åP¨F.SP÷ÍÝF†l#»ðØT˜4ÜÌÛwô‰ °ã;Täs÷ٳٓa‱Á ¶jÈaÚŸ\’¦?i鲚F‘è%³]åd±zhj=ñ'NÈÍï„ÄmFdº×Á‡…DoKtæ­"¯ÊÕË6‹;‚¬É$¶§еÏH–ë¢9,¶»§+MžYŠ¨H6­&ùzuY—büyf:ÚÏ’Bâxúæ RQs¦Ë{ðA_¾Éíâ6Š––[è˜snµ#“™îÁ§g¡÷ûÿd{%Ùg[bOæw¼ðÖž ˜ÄmŽl]»ø»rÙfÁWûŸÃ}+?¸ÅŽJåx¹»Xzï³3'}øin ùø‰“ª8õyRTa;Ë{Ûµf%˜{§(À©®bÝïÞMÖ!QÔ¶I“wßÞ#0dÛ†EïB¶V*÷µ4`›9:[ l=júæàÑvØUÏñÀkì‚ãžd›Ým—¶ñù,c ‡ˆ‡1+B[ïùøoèñ6Säµµ¡½ŽÚç>Ál³hmÂ6»‚¥vÞÔà$"+ž&›ôàq~ ßɱh¿ÕÙ®NÁ6ã|6µ´m ê/ÖÓâ•cÄÜûT_‹_+‚DŸnøí´,ùP!C—ÚŽv_gÑN¦ñnôYteÍ Ó¤B,™‘§K°»TŸôÝ$@T­w<èdN7:¥½•z þÀ<òtÎ9ì㳿 ë½Hsý´Ÿ$£ïHz-èÌ-?çÈbYb6Ç™þ¶1V¯Ê3 †þIkÉ6or÷Å¥dcǯÏ%p]#áƒùòX‚¦îÍf|ÿ=7còñÇ­ðQûM7š>­kÛl‹J+ë›…Úq¶¨auT‡ ½ŽaeÞLq2ó?¦ƒIŠp>Þãy –dzÉr£«ÛùŽ;ßÀÃAT}D“`Ó„/<›õèì»ÛÍ÷Ò¨t×£åXê‹6ck:GXúVSèxî/Ê$øÁ=kj—ò“mˆzÇ=O°«Îû’ùñ¯àƒ“±ö[öã‰~N<Û¸sر§ OÏ _™rØ’ü e5ÛL¶æ³œÎ*÷á»Sþl¿SpGíq¤Fß@Ÿ/lÚ@Üv§Û’`¥¡º@órÝ6î\š•|@5rÜçFI.ÂD”Ÿµ7ð¹>÷ Šëi§XL²î½·â¹†lƒÊƒÝõU¯Š‹‹sÅm‚0¶Ù@Þ<«ÈtÄÃÚýØC”m\I‚} #È|WÔ u¬`›ÅHꆤwbe9ýO:ÐÕQUñ¾Ñ9_ŽA2:ÙÅCdzAÏŒ2ÛÜpì¼¼tÝÙ­ŽÉç¡Å^QÑ;ƒ%~Ìõ$ÛŸ‡ùàù ®{ü’^pg—µYð~ ßžXÈÝáÞ#qê‘ÞCο»ìÀö¸wѱh»°=q¶q`ÉmÁÖª$šÆßÅø* ¥[z·Ä6ð(t°²µµ³20h<$€µùuXÉ[è[‚y¾»ñV¾°NßC±Eh#g­r!‹N´?¯a·}@Üd‹NxÙwCóý÷§F‡Q$ÙšÄ\FŸJâi{rJ€µÍÎëøUý× Z®#ؽäSæZ=º¿3¬I雤ãf×¹ ù¦š-§háÖҶ̟Èx‡Êj˜ë™µ‹X%g,©šÅ}jí6ò«–s?ŽÔÝDïôÓîµfݵ”@רSK_??ʤØú©èZ2áV ŽeÂùžO …fL#ª¾a·ªMóT¼CH jd“}2%jÜz?ŠõÉDÿ æ:6&?Œl§xìñÐr>ã£.5À|ÛÉØ]êÒ]Ü?ùM-¼ÓoÚºf»>-(­( `oL~²€rûõ Þy¢†„M%£(ÛP¸mÓ"ÜNÕ’Og°F¤ªlÓ.,>»ÝÈ#f…"=ßrI"…¥žyVXTøäÞ—ØFôŽ­I~3 )L:ëï ÂlãFw»ŠSñt3c›©"#X¬Ä7v˜rLì–ÞÅ”Ÿµ3Âw ¯¸‘f✄u{ß½}ä5ØÛ²"¨lƒŒ‹w ‹Šïˆ^b›õ†i2Ž²CìÌöÝBÙÆ…äzSÑPÑc²×ƒOÐÇl3}¼C®új@g+ šy]¹Ÿ_T\tÆ‹Ãßõt-¶9êcçzèÞM=ØáosÃlÃ|Û/ÄÒ?åz‘ÎÁ5¼žêx¤néF²žbisÞÂ<¢b%®¾âÄö\Å6öôãyŸ0ºO23LέÆÙf³ Û,É6#XŽ§Wì‘:_±GKSûtƒ¿ïç ?Qüï›8?±kñ*`l#ÿkl#ÙinHc0YL,Ë#·]Œ< %êè<ë–¯`¤;;ÎèڜƒU¬Äs=T³ªoÛÐÃð™-¯c®ç7+v›^“mä²ýŽf>g–cz{YS¶Abá®\¿‡é[­Ãâ‚n`9‡*›ŒÐƒÅÌ8/•îxfrà1•è<&_ƒmDï ȦR¯Põ(Opû¸ÔÕ’c‘xaI"Zb¹\fɾ^9ô[®*8Ã÷MT|[¦­ÃÙƘv¡¨¯‰°‚©I«ÅdVÕ辪î*ƒa9¹R“šmºu€æˆõÚÒL5ax]ÁG¬xú—³t Ù¦æꧽŠn¿ao • Q¶q]Á6ⶳá¶Iç—xï³ š]ÈÃíÖ©å¿€mFÜt4Öá3¡éæ~Ò’lC QL§tXAÏ|„Ë6F{r®0„BI*Y-ÛH♢_Î)[eÂjAÿ.…Éoyó¾À6¹QN†I—–ãé-nθl³’màƒ®nî0þ\‡ÿ¥;ƒO<&Ñx-ã"H.ÿ5Øfè}.Ëñ”TEhº°5O8 m€‰t¿˜md×¼ ­¯Ð%³†TBα0¢ÃîÕlSÁ‰Îkù5ÙF~ÅßÒâÀ²lãjD8ý¬o°úŽ¨ ½âÏS}9{õì#—håÞa?ÇàSkYä‘Ÿõª«žç­‰(Ûä`Ï3¢FÁ³þ«=v‚÷b){öBª²L2" ±Zæ~ÓeŠe™q,ì¸83’IÕIȃ9b·áLJ7£QøP»u®!ÞŒäÒ=²e«í6C¥$ Æí6t$õþB.›ƒŽšSíOáÖ•“ÁætŠ~:ZŸogò¢QÝ={Én³ÅzY-Þç®ã°>XÍ6¦å)>‚C° Oàn{²þµ†YÙ\¯¡>9¯mò«ØF43üìù‹9ÄÂ;åO\Ÿò åiw¸›f‰çBy,QKçÜ,ø锟˜Uˆ„k¿åJÓ'¿AEï‘w4ýíàÜ’•xÉnSt̃c‡wõ­gŽÓ^ù|#H|‹²Íbg¡¥€ÁŒÍÇØÆœDÔÙmxÛHÏhk™Öâsuȉ³éèÓÄn³šm&ó‰ì-…„ñ*+†ã¶ ™ÞÙ! û´9è ²}ðî{ßÆ6µ·uL2$Ë\#½jæ|yÜßL´°‹¹%‡¾N¶™é|ú¢L5ö¸Î{a4_sHWϦo®81< °î¾…ƒÎìÐlä­è^oîæ£( Ü l°F‡Ø´-^Õ;‹Í+õl#¬ ¬ç6}5ÛÈ:êÞvŽ#m{¡AñÂ^Óïeèë~A“‚¤Ÿluµ”¢ö¥©+¢îÙFD«í­yù¢5d‰'ÝŒ ÎW¢&Ì(äûŸGpðãÓ¢WØ`>ï°§ ([nà!܆3RvÊ3þ œGØSH&|ž‘ͼ¿E$Y}FÏî´ˆ9^€ôdóQ}Çs¿©…¼¬÷6gSÍmÍ“n5æó%اÞÏÚSïÛcmako% 9|D§Ì6TîÝ£‘vv|:Û:ð=:t’¼ô¶œh€Çh$¢$gëÓ#f,‚ÀˆÄà¸V†LÕÖ› ;kkÛËoGBí¸LžÍëqhªó%¢ÍfóÊŸù£®3öNJÞW`kÄ5³³370w ª@nÓtÝ^×î’‚m7hR>ÌŽ˜këVÎ`*›äÝi>ÞçϓדÜ;EÐË“ftïûØU/³wr­c1¶é¹µ[Ë_g‹Bþ‹„boy®M¢õÎ c«êîn6IÇÅÅÙÄÖûCû#ÁÊ'v¢4v“åžÌ87''¶Ž¦KX&&çÀšÙëR¤—ƒ³‹=@K¹…Ñ’õ]×ä”׿ Ð7e ÃÛ‚\tÈl.hì¸å½iè‘xo2‹çælg¼KØtš¬ !ð°‘\ µÚ¨ sÃÓ›;– ø;©çç“ Y4'gG‰³åÚÒ¹n]âë>ܘôñ®³–ÅéªÃÞÖÉWqw¹¾tÊ‹üÅz˜¹ÞÖ¬—Ð,Ú{ÓøT¯:oEr¼ wQíý]];ïy9änNÈÈíÀʈå3¶Ý}‹ë˜þ£Ì7ðAn*‡V¸–¿MOùimšíj–‘Ouôt.½†>gýAÛ§ è=ù¤jÛXéþ¯ûa¶iÕÔÑoB„g¨« Kƒm1lÉ1fJÖÖgÇä ³ï^æ6ƒjcoÏ&“¶]˜‡ ·×‰&ÁôæÒžª69¿.aÈ×H_—ÄŽ¿ðŒ@ŒŠñgxïCw 3… ÷ž±!"á;†‘í±j?üB€âítµÞixî#?¬7V³^‹ö}'å§ûÿFå`襤Žz} 3‡°“N6ô/° â÷RÿÀQ@§2™D*ow6öBD~Ó‹£ˆ3ÀpÉ 3¦.Í&‘8I'žaW}|xTƒgõYýíƒÈeã!”È á×!ŽÆ®©…ÇÜ%¿qZìó£oHy+TÏÓôíRePåÙíÚºD ÷Ð;~¤Ø翱cÞ.ˆÝæΛá•ödÔnÓ1-Qëˆ"ÿ‚¿ÍJ_è þ0ÅßF._åý¡â‹"Wñ0Pºj•§ ´j=×egîàœl•c§BÏ,]o´guï!v·[ê=a”÷õ]åo#_Ã¥EÍ¢ÞßFùHMù+:MÍ/µV€ùênS.PþEw¾U÷US¨R]ÔD>Á’2],Eªýö×ümTj»ºw×Er¹\mËÕ9Ô(»²@9‡v”/¬¾· õK²ÍªßR¾¢æê&–ã°›½lµÿÓšCiM—°/Nÿß–‚P+ñÝ7+UAÛˆ ¢Á:ºí1ÉÚŠ,b%ì]}a÷ÛÀwÅ܇G¿ì5œJÿVìã1 nÀüU¶ù6n›‡Þ„~¬Pré‚MãzÅàÊ ?ièµMýˆló3|ïçK6ÿ mÇêÓ-W,×[_üð«üÃë ¸ 5Ž>êü•úäÇ « W󛯒!Ã_¾F§€Ø_V£¾mVeøþ½)_ó·–¦¹ÆÜÿ é_ë1¼ÊÌ¢ØòX­ì—RèÏøú7¤êüPšÔ¢1KëÆ«Áµ2Èê3þ…à#ùn-[œÌÚîOÖ'Ò î¿ë[Áè›Õ¹Û‡"Yd=2…"NºÒ|z=‘&ˆzùÛÍ9$M°ôµkúÅßgŽšeVÍ/·½óÞ¶'öu¿»Áùº…_2ýÑëd·ñ)D={ïÍJ‰|%K7Ö!,»ŒPŒíÁΦßmÔ[‰— ™Ÿœý›…4S}óçD"aw wùÂ'é É'ÙÃÂ-åªL*-Ìpäí|´¢”Ź©i¡ø·“l/ˆr:}óìw•mæ»ò+»®F»^ɿ)FI "k›[LöܧGoûDçBìrzåyw¤ß(â ש² 2¸†kò·nÙwöþ4ÿ”ãžóÉʇ*'Ú^DûoŽ/éÂW,^õJÉÀžÈ ÃRbƒ¶>k_È?ŸqóýZ•™k- 0M'óçݵ`ŽíU jÑÁ€p«j {Kk7R¶®`½’ËQÛÏ6"íöžÛ²ÅµQA¾AÛ‡DÃM‰áþAa 5# ™`!ûhJH``xtryûÌ’Ò]pq``PjÖch´À+47‹O·MŽö÷J=yGùmkë7ËãM²–q—$Ó q¡~þA‘qÿÙªÃ~é/§?¿Œñ }ñi»T¾0ž¸Å? üIËÔû¼´m™•ÊYØ×påø^KªµGTö£²9ÄíÚïOß[*œí­»t,ÍœGµóŠ¹–_± ‡ªOïÉÈSÔhñbú6¿ cw_/6Ÿ Øví¥^FÚçÊk€;Îjëz©æ¨Ìö6Ìò À÷ÁÇšd¾»GÌ놖úŠûæú:GË'•e›‘÷ÙÌ 9ÏË_¾H µâûfÂò¶¬ñÄOÌP˜¦K6“L¼¶í=×Ôþ±ô^†¾6ë#²ÃÂ6»óPzh±Ñ׊:~§²²,#ÂK`Æ?V'š¨eÓ(Te‰ç‹ºÚ N³Í½%2|ýHí=×rV%”<Ò†•x_!X±Ï¾9{Eƒî¤Ø$¢îp­Gµæ1Û5··ç¤¹ÍýâbSê[;J®Ækêy¡K†&¶ð6¹ï,Û¶§ÜÈ뮨©éZ Š6>û•4©)_1½Ÿ²vй_Á6p‰Mçb ñŠ§µÐ…hR2ÑdùË(éÊßè’ º$xežï6æ‡å«¼•µµË‡Æ\Qkƒþ«iÑþç³MsÁ)¶‰‡X†Î&I‡™®Žç ˜mf=¨ë²ª%Ø-ò“<—4)v|ñÒìlíFm§cžDf › Ö¤4øopct$ÒÎwÇeõ²MõpϳÓ$SwEislMe¶Q³ªl¾Ž©ï9ªŽk”].FY4ò‡QL“’g9P`M >¨/+RííÒW5È¢ê [êá\<®ÈôÓø†I=iöØ– ìE•Dm!’5e,ñºÃl£M3öõO¬x[S–Ž­M¼‰Z‰Õ±Í 4×j¡§wæamíÛc±¡Nî<Œmê/¦¸m¿¸ºk†îúòw­ÕouR·bAؤs‘‡èŒòׯïIsð2EÙFýUˆÿΓ#út³kž={Í#ê-û„ö¶,o»_Ði$vèëó›uõ-®æ>yñ> stream xÚ?OÃ0ÅwŠc‰\íó߬(”¨;U¢Æ Jª&Tß;¦¢ ËÙ>ýîÝóðæì6°Ùƒ²Ð`cÉBxå,mÀiºQ:XWËÓ°Û¶Ÿ-¯Éùj5Æ¡Üæ§]y-EuSoqÛ1–‡BBÉ7aÁî;2™6 à(‰ktÂÁ¶gë€.õ P5ÎÕƒ¶>{X²W&~Üy…f"Èxt&‹i+‘ŒÌb³§ÞZ¸;¤™kV*ªH¡s‚þÊ_Y4ÉþÛáß³±ô}I%Aym‰ªÇ^J>Ï\š*æòuæ$ªÃk7æÈ@‹ QÚ0Í3y±šý¾b endstream endobj 953 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 345 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14173 /Filter /FlateDecode >> stream xÚí½\i¾ïíž=÷Þ=»{ÎyÏžýܳ÷¾çÝ4&$7t¢ÉY‚¨D ¢b ‚’³äœÍ9`ÖTTT$#DÁ@ÎÝ]Ï[Õ$¨³:3ÌÌï;ÿÏØ]U]UýÔSßzRó~(Š éÀ§îÜ&_' 3Ï^8wñÒ¹‹—Äq)÷î=¸â«?…oi¹x“Å¢1"¬—mUãÖÕÕÂ_N\|â¼Í‡Óï“ô212öUÇe`›¯e›¹!ûSŠø02ʉý’ضA `Ø€mlƒ@À6° 1mc·ØïIEEÇ`lƒ@|ÅØý€˜;¯ ŽNXXXee%Û _Ñ6&ŽËW{ygãÆeeelƒ@|eÛ¬ö lÛ ° lƒ@À6° lƒ@À6° ÛÀ6lÀ6lÛ ° lƒ@ `Ø€m`¶° ÛÀ6lÛ Ø¶ù±£/âR]Øåú°ËuÒ¿ò:&·—^•\H%ÓRôë˜k/ÿ­Ï£R ™O%Ý}v±.öÞà~’%›%Üj »X_@ª;übmÌ]Ѩev[Lï¤#*»Arè—‘×Þ'ä3{Nôëü.ú¸áW›%o—Ç^krÎõÙobïôÑû”íÛÀ6ã/2Š˜(Nbó8ÚÚ|€/à«««LÓ5uXzð]z©\8Åïl &i²Ô%T¦I¬’]d"˜<}Å…$fÙ=ž^ÞìbªÈ±Kˆ-&iy7u&Nt;Ô’^òjh‡“mI Öæ<Öd–š’¦ÒD6—o:kñºSôªä!R ÏHãjLeñçî¢ V$Qaÿ’ùŽl¶Š–€9gžÆT uu [—MYÌǥ猀m`›qg›‡¦ÊJŽIÏö?&»’ÝÈž¢Æ®FleÓ·$۔ؽþlƒå«Üù:Iô[Iñƒ ÙäÃåë¬ÏlM-¢$¡6º°ø6Á×zR‹hÛäê+Ls?Ò:Â6ŒšJHäÁdmu%3çM[®‹ö<&tÄœºbccÀÑž”Õ•*ݬ)ÿ¬\i!pJ·7:3¶‘¶ß€m–.tÑ1›]*;çÔ»/Wx.h(Ù禔ñ¶mÆ™mìcÊ¥ZVˆbO]ÒÕRv ¯eJ,¥­î¦\‹ÕGϦq•Lo“TÉÓÊÚ—ÌVáΊJ|Ș!þJ¾‰ÖT› ÷¤åŠ±lñà‘_Ù`qz¢üˆÉ±¤Þ«q4˜Ä·ß›ü€Ñ½Ÿ´{÷ÍTïò^箥¿&²D^ì‘ÚÆÔ=,oðœSKIpXŸÅZ~´—¶mÆ¿m¤Å„ó7ôªÎ[+è»;þT&ŸÇZšÞ˜\Ôáh>ÅÄ·,µLfƒø¬›Fœ‰¶;ž¦•OžyHT¹¬\ñÛĤîdsµWx%ÝÉ`M1ÙãÍSÕò»A¤öرÙQÝpet{`7]_ò:Ò*+´ ·ÍÀi'_`b aãy& W¶mÆ»m$·?}›§F 4–g ëƒóyóv2Ujïr-=ûmw%·6S¢ú¸qôm}‚¼8\#¿s-©ò’Æض¡B‚½y:†/ [}ZiŽ×a+xè¡ß¦ç×XësmÖ£•^Ò`§Ã²ôÏL“U²F± ½ç´‚¦Ùfz¦î» peaØf<ÚÆLEÉÚwð¾[öÐqmõæP=I&‹Ž&–“ÔâwÍ7=ßóˆ®:‘Ôs§´¸œåéµR/Ñ‘QZïdÊÒd)Z¯:X,k1þ¨mÄkxº†ÁÙ£4­D;«ËQ˜—ÞF¿ŽØ·_ÀÕ\u\H7ý!‰Œ\À,Xe Û´ÂwæúÆs·Ã6° l3Nm£ªÈ×722›ndjndj1Ýi•gÚÃø*¥„ÄíYÏVS3wótðð²÷ðrôX¤ËÕ0\y0i+–cJÈŽôM\e]ß›Ãoü±Ë6;¶pµôýNw~X¶Ù¹7CÀRXv†iI^½fŸË³ñXkÏzµýÜ9|5ÛdI'ר¶)¤Rï<77áY/NO,Ä•…m`›qÜ'U!éßyÈäC‰L¨´’¶ù\] gçåþ²Xè¼ÈÍšrOÖVœRLvîÙÆU2¸ý™¶!©NðÕ5# éUÉòÑ5t¡(µœ¬÷¶Ðä.ÚYBÒòË-5,<ü\VøÝÚÊP`=šm¤½ÞQÇOêr§:GÖ¡¶m~­Ä·üéK:ZênáO‡-¿ûÒF÷óÀ'©¥ÿ mÒîŸ kß«ŒÖ$}RL)~$OUÅ>îiF9Ù¹iŽš–ÛÎ;¢Ô! ‹ÙÎåk¯;Ñ1Ò6ee×:™*jèùF–à²Â6°ÍOÇ6’"ÿÐ<ŽEðíáË EË–9hÌ£ïtiÏõX¶1Pœ6sã ¿¤‹ëeá»ï‘´µ'ùî W{}–*ßÙ?Í;îüº¸SKÖz²••¬=Óâ HÚ½z#-³Åq‰…ƒ AÌ©Þ+7çªÏ ¾’VÌØF``ã•xÕ/åŠoүͦü©\ãWºÓŠ¨dÔ¤`Øf|Ž%ž6Õ.úþˆBHjé{ÿO{ynzù]ØéáššX*™N¥„|þ”IÌ<)¥dï£/…ùFÅÌÑ%s¯|ybJ&¸|ÈL"3bp‘lr™²mF:I§wI-–}pÔ„¥Oo`Ö˜WÑÉ.ÑfÄ*É…£“ºJ+œÝ†™5Xr±Ò‹GL:C†~„™˜æ!³™t¶f^ò2é|4Ôh‰I˜C<üÑVÁ6?±²M¡(úì­¹óµ¹j\M¾®©ýº=a7z’å·RZÞM½i“8šªÜÁåø^$›7˜j¨+˪H_¨qÔrÿýßFé§3ü• |Mµ5Ñiš,Öª= ßá´KItÒ\%ö¢È/þúiWN²YêËÓjF×ѽބ¼þï Á»M3,”L–ÞL>¸(­øÏpÞÎÄ‚a#6¯ãð8²é¾Ÿe¥1$IU^°Õ-ì掶JUC‰ë•Mö”>3W™Ê\¶$4UxÚÆN2cîŠef¦EZBGYÑjiøšøK~)—½ÃÓfYñ5µÌ—í~%»k$³ÓÎÚt&0-Û?u ²üÓr"ïØswýR²è%»/Øê)êÌ̸ê³çf…2÷CÛÐrkäv¾Àm×Íú5ѧwdu}‡Ó.!1ɪZË¢¾Ü6Y™<wEú‹Qìeiä’žølófæ –ÙŠÜlóÞÁHÇÄ#|„m‚6ùóµµ7^%É}¡û¯IóªOX¬GÁ&à‚?“ÈY~iy[Žå2‰œšzb:²ÑÊÃtÂÒo}“sÂï’Ý%U,Uó•qwçdä¤_]•l¡3YÛ:8¢D–Ôi¥ogóÕVžïJ/!qg.Ï6×ÖsZ,Pe¯Ý6t©F²i —­µ(ìÂÆ}7W,á° }.õ¤^úVÀÓ\sª?¥p”r]âÁ]]›m×E)…° ló1Ûl‹ßÂæðæÆ”g”É Òt.-xï8ÛÒÄ90æžÌ6ú ÓÜ´¦t`pzy÷|ãÉzÞÙéec´ÛHrãÊ•6: o¦– cn´$ÜcÄ)ùÝÑ7Z“ Ä ·Ûbršcn´J—KO&)¯+öFsLNK|þPÛHòù]éªæØÜ®$éô”ôöw;brZ åuŠ‚ž˜ëÍñùâQl“QËl|ƒ9b|žHº*1·Þm†±ù¼äÈœ–„|ú$›éU‰wÚcrÞÇÜhK`ö#ŽÏmeÎóVgRáÙfèƱs Ù]vw¥~àÔ¢ÆÙZ1ßñ‚™FS¾0Cb›™[sÒ‹É@ZE:­ÇžäœðžÙ†^~.‘#˜‘'J»OüݳsRïÜÑ›¦6†mHò­*s ›ÕÙÉŲj×òyl®ÃñŒG-ö:l—m÷¤£w«9ö¶0ñNGtNsjÁ wÍñשÒ¼Ós«/¹ ?öf3½6VžJ°Í/Ý6~Îîf:¦«# ‡N\KIî î{ç«Ù†‰v{ƒióOô¤Ÿ?¨¡®¶RR“J= ¦®µÔgƒÙ¬…Ž‹½LôY6~Û%wh•[[S‡?}–ƒ‘•Çêmîê‰mJIܱ}–¦ž¾Åtk3>[`ãs6E2ÓwÔñ“Z,å¹quôí–ZFBü]5´f†^ïKiÞBÿpS}c sžò$=Ë5[ò˜&ßUÚÚ}s+»gÊtø 3—$ZÍYî´p‘@5Ýsÿ–0o+§óܵµ¸vóé3¶‘6¡$^}hª¯Ò¹} m3mšKZUìõ7‘W›äÑu£;ù;Ù†Þaö)¾†ó.ú¹yî—ËóÜ÷šÙÿÅ 6KMË9‘®Ö¥•’Ĭ#­)»^¦”Ÿu3¸\×­$ý>I½–gÈÓÐÔ_IÛ&=·ÐX]ÅrÝ™Œ‡LûvÂÅ‹†š³mbN»DèíÊ7q Ë'\¸¦ÃלU™<¼U± [ƒgºj§$»&]/0åcT•ZBÒŠZì­t-J¹OÒn•êó´mVÇ•2GI:èÏQ™Ä·ß“ü9Oï%}Ûw?n]£¹¡áY‘Ù¯b½ßš¯mY mÜ…\#þTûõtR§6Úò‚î ›ýü£¶Ùu(ƒ¯¢ëŸ;¸dgZª€£æE’.îæð<¤¥Êä‚^W7}-źÓm»Ëé'»2B5v$>`ê¡!3y¬inqõôÙf<"—k˜­- P¶ù¥ÛÆ}©™öd«¯è{Gjƒ¨Ì3N W;.ZK‡ý’M[sºS%¶1TUä¨OÕP™¢¡*å¿ðfìM*û¶¡¶}£`n$óv¸m4YüûkÒŠ$M¹Õæ¦,›µ¹©å­N:3Ùôx÷}IÏH9 Zi¬¦³‚ÎóÛÂ7ñÚAטŽ:è<¿ÀÅÚpÖVi[eZIÛ;¶™ßõ• t —ŸM,Ö+$· {~tišÔ±yïfÙhš-þ–ÖEj~“¥®åÂ}‰ô ß,3Ð×´óË’É*÷š®‚â‚S}Ò|çŽ@ž®aȵÛFÃVVWúfhh°T´¾ŠmÔUgïÊ?ð„ì}Ìt!%^{ä>ÇÅvÙ"©ÿ&^¼¥ÇW[yfx7ÙGlSLvî‰æ©˜ß\¾g¯€«âu–~ý~¶¶Ò¢³B¦?‹±ŽîôÀØY‘8þJ¡!›ã}¤–Ò¶±fk­Œ¦y IسR•ãº+O ÛüâË6+-õ§˜V¦Êmv$Õb†ÝôYŽ3̸ÿKm©òšÔ‚L±‡u¹>Öïù)ÛPé¥Í.Fl§œQl£©ës¬I¶åšéfš3ÖÜL+}b®2ÙawcF‰¬O**Ö]Ún³Þ-ŸÏ1·Ÿ7ÃÉ]sôøÚæîáyÒÖ'{–Çh^ø]QÊ`%qŒVâ¼÷³gqL^LúÐ6z,§Me²ß¹¥3Usu¶ôV¥víÚÀÓ1 ¹ú‰š”éâØôáÝÜ¡Û‚¾RÙF…«©¬©6 õi[ßÒmÝù¶4I%hkr4·"¢Œ¤|vÙfçþ$¾ŠaàÁ%aéŽêš‹Ìë¥KõWæ§Ý—ØÆ•¯ï||ðY“×4Ó’=kósº8b¥i•P.krO8´FMÓyló‹·Má‚uöNZzÖ‘ñ¥²Ö?¦^JÒÊÈîkÇøªúCmó¥í6t¡åÛ«Ú|õUG»>Ã6ŒmJ*ÌT¦8Jl“,±Mdô\¹mÖhi{ªØr¢\'n=SÅ´QHÜqxŸ[‘Í·Þp­_VdúGm3't¸m²Ä2Ûìü,Û|¯í6V¾GÂ.Tí8ÇÄ®K/cïˆR$ ¼tZy{鮽—~Øá#¶¡¿cä‰LuUϬÁ%¡q‘Zšún1o7íÖÒY^$·kfr©¼¡¯Xè½p¶¡ÃÎø©m"aØfdŸÔ†uA>\-­µÇ›ÓJÇòÑ5ñä³i\5ƒ¯i›"²=.’Ïw’6ÿ~†mn¤Þç ø«É–'L™d Zà"=iMj{X(O ¸$)·H;ÝIò~¨´{Ïmõ&ÏŽ¨ò[göÜ-oDM‘6F~Â6¶–:?Û m%vè²wö|¥¥™-éÃÉŒ´´¥ŽþÖÒFæìû&:Ów½TÖºY\ÃͱŒ²HÒÙL-ž¦Ï™þ”‘¶a6aÏ&Ží®Û$¶mÆèO.yãj¦ÀÓ6÷ˆ+M• Ýs_Ÿ8Ý”ÏÕwØ~³o Ojþ)áþÇÌCcèpÜÚ†)5yyÏÌ»’Zþ™¶ÉI.#k<¹|÷mù$ƒþÔ•=KÚJœv3ÏPMÅÊ'3ã³*-¿Þv–¡_>ÓðRܽl®ŽõÚè<’œsßD aëwI¢Pіؽ+âî$¢lóÆÎJÏÜ=!õɸ}ÿ'iZª8|§]¹ý²Æ"IëÖC’‘_ 7MÍó3$[2È™$æ¾ô M 8×-9P÷²9Æüé‹vå15¾Ä“{uU•]÷4Iž2TFIƒ­¶¦{xÑ(¶¡÷_ôÐŒÅó9ßµ¶m>2–¸àõ‚¥†ºêÊS¹le–ÊTmC ëEaÛn‘TYŸÔM=…o45TdÃVƒ5/º uHÙÆ]ïÏÚ«¯dŒV¶I-n³×þÆíH‡¬€tö †|,qÚÅTuU®÷ÑFÙéÝ®65R¶ò¼–\Lb/ÜžaeÀÕÔ0µ°Ö3qõŽY®ª9?¢iŒ9”lnÄãêšMŸi£ÍV5vܼ³)ºì̈çipVï—5õ$økªëyŸiÍxзÄlË&(‰K|BS]}yª|,qÞ»™ÖªÆóÏ1¶)î÷Y5Ÿ£¡¬g`¸,)WO ä\"·Í ­¿+{Êm³s»Ÿ&O;8[:–XÑxԱĺ\Ãy;FŽ%ZÇá2c‰‡ÙæÂM=µÿž“>ªm^Ïdÿ—éÖšá¶yf¦4uFèµmC'NÐJ mûÀøü^Å K=>_‹§¥Åbk(rx\[×taØ=w%WWñ3#ߦJª«é•.¶\U6›ÍÓµ]w(y ³ò> ñÒx$§ö9;±tœN$9ú!âå¬lºùQÐ&35ðAÛX©¤jÛÀ6ƒ¿Ê,ÆÝlŽÊnŒ¤ãêÛØÜ®ä¢Á>ñ”ÂÞ¨¬×‘ÒµÃ#övïБ¥±W"oõŒþ«ÌÂþ¨¬Æ„žÐü®ˆìFÙ˜ºüΈ¬¦ø{"ù–ÂèkÑ7¥? ‰·[£²_GdÑÇêK¾×‘ýž©1IN,ñv›dÕë¨ëÍ ù”ô9žp³)âjk²|ÄHJ‘0:ëUý”/¦â®7F^octÑ'wW(?¢8æúýü.Én›âïöF]mŒÉí“-/ì¼Ò/û TÒíÖÈ«M´I’ Eô GÝìý`H‰8æjSÔöa­F…TBnKdvSBÁðf“üÞ¨ì†Ø»£Þ•¢˜ìWQ·…ÃÒßëuôížQ}w½)úFÇà(:ñ³¥½ðÒ 'é‹¿úŽNÉäæ¸1wD—;9¿'úZ}u¢rÚdÃå{Nºû>â€Tl½¶+yø¸Í„Ü·‘7zo¿¸Ö>°*9¯%"û]R!zÀaü߀Ø€m`ØÛÀ6° ¶m`¶ù%^œPN¤?úºÿ¶AÀ6°Í mDÿü?ûûûþßþî{ˆß‹ýkÌ^‡€m`›”BñsƒÙýÿò»ï5îz…}O55¶ù©Ø&YÒ´÷øûÄû?ÚÇFÀ6°Íx)Û ° €mضA `Ø€m`Ø€m`¶° ÛÀ6lÛ ° lÛ ° lƒ@À6¶A `Ø€m~v¶q=”V&™0@ }ÄtÎJØæ«pçnž¹Ëâ5CÃ~Þ +]s[Ýéˆ6Ìm ­ç åÇOèY:¨ipýüü`›/„¢(úÿ¨­­ £Ó3ò°Í×âåË—ÁÁÁ!€Ñ€m``ØØÀ6À6° °ÍÏ›†††;w†††nŒ-œÀ_…×`œÑÔÔ„D?ÐOä1$àgEÿ'û‡’/‘¼|_G7bÒ'–üCÑÆ¡èº$ÿЋz!Àד !"Ú2Ý"JØO ÅbÒ/?ê,¬ï«'"”m_“>JHú 3bÉïø6ªÖÓ¯Æ>¬b!RðÕ 6ÒºS=êº^µ.ð‰cÀ‹Þ¯ìCžº ”}àËm#Ñõ(QÚãÍA/ÜüªÖÕ9zÕ»UÏÚ[±“^Ù>Û'tˆÄÃÀi“°XÒ.ó²³z_ãŽ5OfÖÚúÔÍ ¬šöbÉÙÆÝtÕŠÞeÀç—^hÙô3ÿˆe5#z¡K4„–M}_Í–ç¾µvþOìü^ÎÚúlÎ¥¦ÍTŸ´Ž%Q’ð¹ºQ}uý/(ªO:Š†®‰“k:ïª]ìS?Ëÿ…ÝšW3ÕÆv’vI¹G4PàÓ³–ÉËÐc”¶‡lõq”Rȱã"3rýÕ¹Ï\_v×K¯]«"Bª±¿1¨Þu}M@£ï3»Ê®!é“6!!B\¾Ÿ)Î:S(ü‡s!.î~ô¦säªÖó¬ÿøS@açáà**6Ïdè'©Dõ¿É„ ²ø·?“å›I§X>¤ô5ùõ„ÁµCcc¹í?ú*:Ô=HwçZ}ãíµxg…É&÷ûqmljm¨“ I>/mÊÚs¥ïŤ¿›ôÆÕ®^_ãXm\±°¦ó1ÑE 1#&/ôA4ã§ä0êS|´5ÖB¾F|}ƒÝÌÅ)}c>M¨O8:7iœzÜ4²h"zŸàíñ »£ò”¹¶{-³RDVé“ ¿&›H‡tó’°ˆqÅDOùÇÉ~G,V:k‘?L$ï†hj;¸eÙÖ¼7½µW,µæTRK1ðCêæ\}’ïs×âŽléu‹EI5¡>u¶þ5³ëæ6«èEbJ,i5 IŸ ¹fü”L émÌ:ž¶=:åÀ£·}ƒ7T{õÙIỶGÄ$^)¨‘}¢¹<22¢¼¡ûIÎш[Â"âs*ÞJ×ïÝèl®kl5wË–-yï%;xQx )bÇŽÉ2kÛDDÞ§}4<ùÛ†ŽúÂÔ¨­Û·ï:táN/EúÛ^íŽò1f±—ùÅî9Ú%"-Õ…qÛskèSm_ì\Ò!n¹/p?Ìm^žaIJøøÈÚSþâLÞµ'<Äd!ŸüáÒ4l»ôµö·^ww–8§÷Küs":$ãÖdš—«u'}ê­®´îaŠ.¹ôæðúj»õÏí6[ KqÚTµëÍÛxiÌ?&’¬ê”Ó]¿ïbB´&¿,¬4õ¿"ÇNÌLr<üñ×Ä.e°&eí=z®¥`›Ÿ¤mĤmµM`ÝÆÊ9!Us6ÖÎ﵉Ebæ÷QbùØèf<òv½¶²cüåÊ6ÕóU'-=_=Xx–Ξ6q}^;ywùslSswŽªúÙÖÑò‹Ô6ó¾Ì6ûôÉ„?¦òb_=ùË¿ ³Í?ÚJ Æ¥m(Ú)þOí×¾´ÙXãâ÷̶^ü\V÷¥ó0d3>¹¸\]yN¬¼ ¾²jãÎB’¦pW(i›´>º†VuÃT rºÈûÂÛÞ6¼ï£>e›ÓÚŠüÓoF¸ox§³äuGù&åùCZi¤UªäÈŒø¯l›!g€ð·lCPi·á…]@Û…–ý¤_(ϲ ƒË3N[Ü軳ê‘òÏ}÷^½~ý¼ô²•žúÒíWi<½.PV¹ú´éÍ›¦Úoc–ÉŠ!%m%Ã6â¶`W Gߧõ/Ûºš#X ,] žÖÒ;xù<‰Ù£µ!³MçU“©ª[ϼiz#“–ꂈ[o¿èõÌÉþµäN “LÉÕBRQA”8ò« äßÿLn5ÚFו<ª`6ˆÇɳWß¹l#n=”‘‹ð=Ï¿g65sƒ^Ø4õ6á·–?¡r)¡ÄÕwŽÎ·ä²ÔY\½­r:¤—OÜ÷(+Íe:Ëeqù:«ÃŽ¼j—ùS°‘Ï膇ìEDæ(’_ý‘4Š>j›—óÕþ÷ÌØJd›9Çñ†§Žk_M¿Ð|Œˆ©^Èæ'vùF.{,1¡†—i‡Õv†äÓ5imÈ ™QjLÛÕ—ýNê;ýœJrG6/ÈlBžùѳkb¥ÿ¦‡ ÄL?”`p øÒãï<;¯éðcÛFDZįÞô7ª_,y ÀÏ-—SŸ[dß÷Å ƒåjôwÀøeà÷áÔù€†üN?|5ÄTŸX:8%ý£é]%2*¤‰øzeZ7´lDBÒ/‰û ÕF:WÇå5_Ã_0|5ÕHþ”m/%"Bæn¿í}yöMR`•wýÌMŽHÀ×´ M?­ѱ—qÁ5 }Ÿ9ø½pôm°*wÇLS€ïZU|9Ô ’iÀéêR3Õ¸¹lQ@­ƒ_•½o½ÃšZç §¶W_ž¢f'|~酈ŽBŠSâ%„ùSèbé§ß^oÈÜ\ã±¾jv@µíš›€ŠY»_mj>’a]Sð麒HÜÏcDrˆ…´„bºäRÐvÍÿ¹ƒ_­ïóÙ~Õö‡_m¹ß~wÀ3 øœÇÙ(YŽ¢FÏ>S^}Aæ¢ÆjøÈrê'6õ‘ôýÜûþÇøîÕC: ;®ŠI/%«=‰$ÅÑ•WGƒêæø¿²÷«í]g_Øv½›ô‹™’O?Dóó«O‹{Ûr²nw|Á>zjî]¿[ùÁA ®ÊSŒ×Æô?øæ?&í­—¯¯ºCVØÿ10ýå¿·u¤¼qð^Jp}¢L¥¥L¿è_ÆšFó7¤«o¹¶š¶{@ï‹”Éÿñ÷ÄŠ}§Ê#Vb­mã~~|;»©WzÂâÒ×Þ‰~Ì DQÂÂë×›¥Ué$§™_rFÒÿ‹·±ç‡•äùúCªf<﨔¦0ãyØ]²¾ÎηÖÚ¿Úq×óUͽ¯èüH‰»DL%KˆúÓÏN6¤½ö¶1ÇåÅ?¾ñ­{›E)ŒÁê+½1×'NÔQàîxú$ë4~K~;üÓdr½‚t´“Îr=ƒüë?“›DªÛd·zú2áwä…ˆÙ }Htõ2ô®æuGy|‘ÌÞ—²%í„+®'ÎYÔÓU¿k•ëáš®œ43‰¹Þ†öÑeÓ¼ZGpëd¦`qþaqÏyÄ}µ.\³ûý’÷Ò Ü=ÏIËé㳦˜lëýA¿•ù:iÝ+ûÒŽÙ{ÒßHÞ=í_3'ðùœ]½ÅD(f&¶3 9bÌ6~*ÁÌu¨{x÷ÌñCGŽgæ=¬#ƒ䊞åœ:zðÈá#Ywî÷Ê2,Uvóøé¼7½ïŸ]8qðàÁÃÌ*ɵl}“¶š§a™pähÖÓw’§ç»‚ëŽ9tüÔ¹²m·`wuÖó…„tÝ»rŠÞEæ…믺™uO/§-™a`n»rßþ˜»·;÷ä¾s%ÌL¸¯O/Yv…^°pá æaüžümù?æD8P{’œDÇmblI²ªdßOj›wŸJ†ÚkŒmŽµ]Ö|e­›ïqúù¹ÊåQ;k©gYÇfˆG·ÍÆN"¼w%óð‘#g¿Í}+±KßÛšÌCÛ Tµ¶¦ï;F'âžPUÝ°ý‡Îç?¦Ëöw¯¹Pø¾¥¶äÔ‘ý‡¿UVM}ò¶h~üø±ê·]Oó.9¸ÿĹì×ô÷ïf’ñСó׋»†\Ó®Æ'Yg>tè\Ö­¦N欻k˦k«êG<|±è)1¶™áu±óݳ‹§=zìza¥xðê÷?.¸~’¾úGŽfß}Ð7¤Æõ¦âîéã‡Ë|øF\u臶 ÍÅúŒõ5Ž(ÉԼ⮭ÕË|^Øù×ÏŽ¬ñí&-”X,ýt©FDúE„BÙfœ´‡”ïöà°T,].r0Òdkm<ý@ºöÜ–Y|MÕ9Ë×û-2a+óìwHïÚxÁ´ÅN³"Ó÷%o^¬ÉæÉcnÏ‚³¾+fhªl‹8^ÖH:ªXèòõÖmÜ°ÔÑ\‹§y±JzÄæl…ék<´—Å̈œiÊ1³Y󖲃¡V&|“éÎÛ¶‡µ0ùz-ÿ/æáEôcøAnNm;¡ºë Ê%&) '~ERn kvVãŃ3(~mú+òn<`U¦³º¢’߉'Ò·’çOÓ±«|/¹ßìgO1¸'mõ©KfM™^.u¡¨{ã"m]Ób¹ o…[)V7}üj5]æq5íöHßµæ‡pþê[*}›éc¯k»°‰>lÛS} —G>h«lâ—Í\îçqêS­+¤_©¿c½‡ž¶ÞôÜW2ƒîöPSvÞÏ\î[AJŠúGÊZ«ÚÊëpUÂ2+(ª'ØUÓÐ5AVl»ç¨1MqúöØ6…onúÔY&Ôl¥K¶×Þöy>3¨ÊisµG‹ø5%Q” 03.e“ŸèÍ30*}/%¿ÍϬ¶áÙ-|ÓCɇ(4yêó6¦ÐÏŒD?}ÁÌÈ.ùí_wÎe²¶w³äcϯ¨©ºIžŽï|µÿî°ÿá`½¬ýšáß5O6ôKm3IÝ¥jàG+ÕéÊ:gK‰¨Ù×ÙÀaYJï'ËdÛ]ɯCÊ{d™JÜA¦+‘ßþŽüîwä·¿!ÿí&¯I-e4ò«_ _“ÝeŸ¬I}>U§æLe/~5àÃòÐÉ,‹Â×Ìë—»ÙS rß3‘þªxÖTsi» c›…<‡¨n¹ËË 4O4~Ò6ì˜3¥ì¨;£=Ió¸ü#ÂÝØÖ.õäuÉI©)¥)Ï$þÕôõ|Îœjº2U¥>Õj°Ýf>ßj^ª¼ŽLòÓ­%Õ¢ËÌùΞm}WÿÕRÇmÛaª÷‰3ë/^9ßõF `Ê\¶¡È[qÝÚÖá•ËšEÍ~5v~Õs|jlž ‰HR´«³üÈU)Ñ©ÍKµmŸvxtGºZ˜¸û´ ¶åwFέÙI×)}uµ] tdÔ_p›,Xû~¤m*æ¨(ðuµ uåÁWüÛß|òÚ¥¶™È[6ø¯ÉPaéœ-ùlÛÐ'•´”üê‘›ïeùJÜG¦]»Hx4±›B~e5¤Ýæ÷¤oŒ6Ó¯f§)úCZ‰m¢nQÐð)Û,`›­¸4pïž^0V™]ùiÛ$]®–¾ë¨?+˜¨%?pE„›¦c›g·Rô¸,ý”×Õæª))°n´~`›y\k¯ÁVâ‚=3·öáv;có%A]¢DêØiÉ1õO¦ÚsM'+„?ìÅz¸Çæ‡n%¦k·TçÚš[ž,J®ò^÷ÂÞ¿Ú9§å43¼ˆ˜va1…¢Íø,Û\ܱB`dõ¸CZW¸D=Ió¬ ݼZú†_¶o³˜û„3eÚ6.?e›çî*“=¯¼õ¨Û,ýÛò8‰ñCä·Ã«;’i–Ãmó¶7Ûè}wÛxpÌ– ö>¿©È4PRHzþ]m#¸òmªïìÖVe~;ÊF±çHÛôqŒ“‰ñ"ÿNáÀÕoÝdʱÜFuäY(LÞV.Ðuq¬ùÓÚ6b"\[mãWkT=oÓS§°†5"¦JÒd'""mÆkáæűêýÏ»¥õ¨ž÷vøÞh&÷w9*™¸¾ìÉ*B=Oìt9˶Ÿ >a5U÷Z‰Ç&묿2¤“¤çucËçÙ&­|rìXáýùi”gÁMVO%̾ºmÏàƒ“ù”m oËlÇš:½¤w ÝFËÐrõ;ùþjo³¦˜ÜéùbÛtöÊk&üi[.½Hº®ÖwíB¹m¬Ë¥ƒkÇ° ]¹+ ¡4}áÛ>±ìêw—ÏÐb¯‰¹Dõ×/Òú³óž—ò%ÏRR0ßþÃÚ†¹ØOÖ½´ ¬r xêÔMÚˆü×ßDžà›ñH™ —eí—ÖÞÝÕÓÛvÌßHÕЗɦW­••¥ÝîëëéîîÎÝ Åç)g²ÕGlSss³æTÓïEÝ}¤"k‡@U%îF}gwwoOë¥M“õ6ôS³¸u£«‰µKPSGW³e×å´ÈCy £×‚:î“?IFô½KZšIK ¹…hü;™ðkâ9Ä6¿%U=¤¹yx´~÷š”øÑé”Ä7Äß©lÓtT0Qsߣ7}}baínÞDÞñšŽÞž^i+1_G?-û1¾ýÝÕÍ&ó– ¿Q>Ë6ôýö>ÄÁTÏvqÕÛ6úÚuµ>÷¶QÔ^–Iï·÷y g¢Vf}WOOßX¶aλõ²…’â²}…ÌÕï꺖ä­%Ð:SÑGQ¢¸ucIcWWWGåéP_Sén%–$O@¥íÆÇ€Z—¢žTO?îãŸ@ÉFòè¨ÉÝ°`ºª²²šŠâŒ… êe=M.¯™cÄãstøæöKOç×I—G®RS¶ÉÜ©™³þ·òRiñ¡çíÃÅf*“”f‡Ý"¤ïöÉ({cM¾—ÇfÍZ˜[)+Ü·d¹üQÁíõÀy,¨ ýØ{øHMŠ šG9Ë•Ÿ1¾ø‡›ýÉš¦5^¡âÑŒ=Ö×ó×UÒVbϬ±ªk¿T5¢j7ì@Ô˜?[¢Fó©K9ôê±ãn´®ôHÁO\½ëÌŠ{Š‰XÜÙ€ŸÏ¸.¿üU²¶Ü6W>ågò6ø¥ÈEäÄëè¸g›ˆX(¤˜¿3t?¿Z'ùJ¶€¶Mà<–ñŠoG,š½s½·ïú‘±ÞÛ3xÿ\Y‹ùÛ}ÌÿˆHR¯‚løÈ-#®«*\3²¥¨ýõã²²²û÷?ˆ²’òê6¤ÛˆZðàoTà›ÿ6^œ endstream endobj 954 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 174 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 12101 /Filter /FlateDecode >> stream xÚíw\TɶïQÇ™wß=çóÞ?÷žûî¹çÌ™ÉÝ@7È$ç *Ì  cN̳€ #%E$çœCçÞéíÝÝÄFÇq0¯¯¨]U{Wí®îú±ÖªÚ»€ONþQü‡÷åôe}Y£#7RŒ þàäN Œ˜ÀQœÊ‚Þ0šbƒ’ÿ‰0B*Å”)ÑŽv6¡5¨Ä€Q’Ê’!$Bþ! ’N¢éró-³Öûá¸Ô€Q C(IA»ÐæÄÖó güZå²²Îmq•»€èµ`´À0Œô¤ »Ó¶UÎ_]é·¢Úgim`DuÐÆ€^¢ ú€?â-)P*¸bþ —!(úy²ì¥ÏÚ:Ï•Ukk<ÖUøm*ŸQÀËÃQlþˆõ‚H1ÃQùœ¶lâ CQ™Eàgëv¬¨t/óYUí±ªÆegɼaø|xÚ·²:èNû …I€áÙ¼”•kª¼–×yÆ5&óTJm ÃPÒÃÂñO»ªOÔž>gmòÖƒ$Ë‚˜®¹ðùÀçcÛd¶$­¬s»Ú‰ iÙ4¢«Ë}ÂÊ}V׺ÇGËÁùõƒý™ÈðÈÖÈðL|¤ÌÓwÍÔ,Ó>ûFéH*gdµ· >%ù­éauÎëÖábœOto«ž±®drxïÙÆ]R¢—RŇÄBþ”eÓ¿oÑž[VslëªÐå¡»c“™ÅO¶®^´déŠC×2¥ ¡N»vô×°%¡¡K7ï=YÙM•´$ŸâÏ5`M[¸äLòk…!SŸõÛÊeË–í<’Ð:`Û0Ü׿è(NÚ¼jÑÒ¥Ë^IC>)µüÒ•µÛËcRübÓîeåÞ«ª<¶–Ïnø„—®®ö(Ÿ‘ﱪÆwe•Vçc\BJ„À…Oƒ¢ÚÌR5YÞ#wÈpäüúéfV‹Úú‚5ç|uÜw'²û³PT¶†C%bQ{M–ã_kr¨¯þŽ™šÅ3‰Ì/«¸j¢Î¹Õ=îɾ})£‚@º–Ma;Ï>ô=¢§,ÎOÝe?|Þð A ,¢bòòZ·ˆê Uî׺ORë‹åñ`LUÛf–ªE8_!uȹuÁf6a}7\áç|t%‘/zp¡î8*í¡žXó!ï‚ãz ŽÂ ‡RFWî£W+:Iù ø5/ââ®×tP3Úm¥W¯Ä½ªïê3Ä°—)·ãâ®å×ò†6£xÙŸ÷®À'ŒÜ šáÆG}êÏ\×›Rø°«~$è ð…3h[L´— äO Æ`±£$7(Fm…£!">¥¡gEí…!8jÀèÈ †RZƒcŽ Ü"€B,&Ùô`^FÁ“BI‹FJ=ÕÃ$Ôîtý·Fb2‘í ýÀŸ—bBj÷o—æ Ö_BêG¥ÔÞ™tZmd{75×HòÓ%¤Ï4à5áŠâ>!ÁÒøO €?TP¥eX÷Ï^ûÀc`BtæT‡‹+ÖÒ‚IAkOJ’–!þáõª¨Hn_%ý(±|·TÒñã¿zÇÿÐvü¨µ`ÔFôô¬J¯Êÿ®ýçßÈŽaBú"«GE…?~lǦ5² 1¬µ£g¼ŠdìÉøç=JA%2³ê? ¿S‘ŽQéÜ{ƒ9)FǺ!š4´$ãLjƨtÏ](Äð΋'°þ/2^…?v¼4¯À$ߨe#j~ùª˜'±€ÑÑÒt‘¦<ëPQ‘ŒWéýïÿB…‹>îß$cUªÔh”Î ØW÷¶‡<½ÖXGsݽ.øÖÀû`8‰ÐÖ憿þ;2ö|œŠXe z箘,"•CGwq¥6‹,M,ýË% W§)!àËu¤1QyéW}ŽÙí"¾ÂœÁ{VxÑ,C®¢Jj>ËÄÆã7žÜáÁsÝuu§z$wDí¹î4Õ¯©Ë®-õ\z®ÿ¼ªÃó™v.Å 3ªz&¶÷!y–µ+ØÀÚ³¸KÑlwiÜ$#«›Q±OWÇà×Û% ûJXìB Úõ¾3ð~`)+’ž…KÄßEÆŒGÆ«t«¨eeRŒ@IãCGwq¥6 Œ-f]Ãò"ZÎQ³Z'&°sÓL­f5Èw¿¤þ"—Ö›Ų́E”Ôf:ËqùÓ¾t±¿ŽþÞ;/7\´øªí*rFWSEúÃøù>V&Ž®ÃÕïÝ2ÃÁ)h_±?0y…ÒŽ¶V*ó¤ l’˺å%¤ÚLwן:¬jÞeàã8J F ©ÏšTTz¾'?Fò½ŠTel…±y'Ý,ttç¤(µ™Ïµ\ø¸?§åáUJmÐÃa^k{ áãÝ ¸VžE‚‘ÔfEê`µ‰¢Ô†BÔ6 6âöÂÝK¾3\,”Ôé›lâ¾ð’tÀ·ìC·I¯ä+ò„u 6ðg‡ü·î?ÿ.§";¾÷/á‹×úÃ8¼§QŒRÏ @Fu¦Om)© vv-iŲ̂Ⱦù)äbÄtSëiµèû©ôÄd}fÀú’¦Öî^žë-`Ú)© Ö³~š­s ¨‘IùiOK;pÒ“2jï5èå› Ťçf‚düÿF¾+3®gþü†¿ý]4fœä;•æß6È¢6ŠK?ŠÚ# ØܸÝŠQÃ"OºÃ¼«ñ~jS3]O7üZ^¿¥t㶃k)@m¢“ù¶Lcظå·)1¶\4žðË ‚¨µ€Qä.Æ%Â%‹ù*ÿN|7¦þ/ÿ…vµv„®ETTÄãÆwOÔÄQ„Ôû¶ 5åŒ×GØ©³,¼\½ÿüÑÕå>VšúnÉJU¼«Úà±S´ ìgß{QÑPõêôæ`¶¡×Êîv~³ÌVªšAÓž}µ¦¶àçMg¨š{Ì¿t?ùÉõ £™‡¤„Òê>PxŠz¹”šÜvÙ;JÇýЬ¢‚<‚’Om]×Øq¢q?t«¨HÓŸa!Ýõ6˜ô\ÔÂÐè~“ƒèÊÙ´ì¤Dž—o rw´²µ³ ˜>'±°u„õtˆàèŽy«õ/®ýmFH\F…dyTkéu;ç5m²#ïo p²3󚶾“l¶)ueˆ“…㤙K"ªzdöTCüô9a¯û–؈[wü²U^5ïå3`‚®”¸ÃÆ£ÒËb£Òn)‚HP^÷´éb•1¸ŠJ…†:.ü0Š‡ƒWîá}ª‚£^OOO¯ünH奻81øŒÁ ^=¬(ÀQIoOw/_(/ z{ø"Å8Âëéæ ÄŠsP ™ìéåË7™¬q¸R»ð€? 6ÔÜ6ùé]Þ3öûÞ[p1&¤¶X÷ÞDB˜™gÏBßÀ·…¦&!}ìF­­AmÔÔP@m¾µy·Ý-vÅÄßkLå]5?í›Ý==W³ŽÀ·¨6J;ðŽŒ¤}¶›ºuXÖïÖ—º•ù?®1ï×>õoѦ¿«›gÕ >‹/@K ›þsØÙQÛ¯o8­ù³œ^ØW øFm^Ã'†k¦ô­I:C'3ÜÖåýnmU£6|öGÚ\0g_ž*Ù­ÉpΫÿ<Ô¦-ÍÎŒ¾îRݨ©MÓ–¶S>ÔøòÔfdkdx&þ&Û]~:Úžd¦j™Óoß(I匬6Ãý}Ojh¾"ul¶«ËÔíص*Ÿ5ò•áïÐ!ý:âeõg)7Ó:XmÞÐ3oíÛᧀÚ_²mÓöd±Ùœ#HoÞª)N66V³6žDMêÙ)Îf––¶Ë£nB˜ nï w{sk+ËÀ¹k²ëzÉÓkÏÿjbÆå°æ›ŽRç˸y~66ÖÓWD– l÷õy•É'̬,m—î¼ÐƒŒ0º_œò5™{^få5µ÷-îèMŒ\ähkæèx>«Ay^œf`Ìa’W`läúœ¼ôÒÝšL—Âæ–+›ClÌ&¹M¹”Û2pÚpbÃG; Ggßèë/Gé9›|½ïáÕ§®vµµ2›º|w¬£é·ºX[[Y¸Ož›I)Iâw“ÀãÈ@uõ¡ôå÷뉮ô~µ‘Ÿ\úøX°§­••uð²m…íxŸ>ÒŽ²½«fL²1³±¶Ó$P§æçgB¼ím­-ïŒ5_bƒÚ_¬Ú´&Íb:zúZ9nس/jS¨ SÕjú2_o¿ûcv¬ 2¤Ó¶^Ë—Ç ¶ûÒ m½ÖoÚ²kû¦ÅAÖêLÿ\!!ªÌ;w|=W‡³ëÊͼªVR’ò/GÐ4tf/ؽscˆ;›ÎõÉmQj3ÅØÌe¶ïäà]ûîܸÐRO+øÀcåëÉ9/|öÍë¦9³4M§¦·Ê –;h1ÍÂ~ݸ{çÖð¹n:zf×+xÕëqî´)jà'¯Ò2pÙ)êI‰­ËX´ú×;6-ð5Ö5ñxÞ"{;ÂW3ÍÕ-ýænÙ¾}Ǧˆ@G†®}xƒìœüø zÚþó¶o߸ÐßšëåÍb¸ƒÚ_®Úhªš\©“…]0ÉÁ>3‹ä:Dn¤l²ÑõÞ{úEûú°¦®á駊„¸£h2󧈗U í­še­î™£ÁÂL/mÕW2¤3tª™¹½oQ—¢äùÛ‰žß®6z:zA’äùXwÙ”IºÛ^*9B¢C³\\‚¶ôÇmt´ôBNgÈSh[­îìeäë‡;h^‘½}'w%oÐѳ¸SÞ9Ln2×:ë豶?*Wœ3]­ ƒWÅRºÐžcg¬9'2«o?vÞ&럂oTYŽôG d ø[8ÎýÒ±Aj#(ºmÃ¥…ÍBäÎÚ±Ñc"gÕ·=÷fýƒîSÒ­Ò†‡ÇL˜ô„FòeÝãŸm#’Íá-›&i3=Am€/WmTÍVòäñ9lfÚѬ9ç«ã±ç1x@b’®¶¦Éçõ^›+S›:™ÚÈÆJgÑ)¶ºe²xÀ©¨LML-m&¤¡A,—E70Y3”OqÕWÝuÿÛÕF‡n–XØJÈw*7ÍñblÎW:C3ËÅ9h3¯Om´è6O«ºg *è!Ѥڴ¯`©Î4Jœ—°M·L eRÏ…é{aƒÔS*hkª¹d —A‹o"°²½4uËÇh¿#ȼh¢ž¨ ð«E¸b Gb#¦™Û„uõ}ýc}jCqs<íÌÍ8Æ‹a`¤«®¬6 Wh3ç4(´kPˆE%Îío·äŠÏï«¡MriOŸ¨¼«ÚPQ⺾9)¾Lmö‘’’ç®­ÅdІ´þºöÄÀË…ÊjÃñŸß.PØš£“uíƒë{e{#7¤¬™áfeÆ1á2ÉNàèëL£Ô†ÔPuŽYúúö¶ž]š¼ýAj“|j1ƒÒ0(ò^t{×À4©“J$FùÚš™™²¹lC6ÀeH‹o&Éó'°‚kEÎ^Öâ6À×®6© µ´§‡ï¹û4³¢¾E»B¸?*«Mc꯺º}jCù\]MM|ʶ:'õaÕ¦^Ym^{kèî{Ñ©Üâ°°3©6 Ï!Þ¯6…;½èÎ3›ø˜¨ö™SË9$"îÞÓâªF²<Æå_2Û†¤lºžÆÖì¶K˘&Ëî*eڤĮdÒ}JûÛ$ˆük»ØúÖib¢ôô,mºIxäɧ™/êÛx¼œ8S&¥6â¬0ušw‘íeSÖŽŽ ¨ ðU« zuýLSëàê¾E5ÒÞÊ æPµ‘õÖÝ·ÓÒˆ,$úœ/IŒ»ž×þûöIÕ&šåh´Ë/VëøxíqV†6‰åʶ–‘óó~_\¨}­«Å¤Y¿ö¢DQÒ~¶®M ¯ÿXÉëûÔ†¸ºÑší¿ÄYŸ}®¤KYmª7eèÍGúõíÊæIæk„x=ÇoUŒ´OÜšŸœ2!Õ¦‘ìÙÇj×>ëì?%ç7[uPà«Vìù¾…Æv 9u¿¹"wïb[º¦úÂÄ&™Â$š«³¯VñÄ—öl™fʲŸÿ(¿¬±¡&åL¸›^û!má.ö¾a5<éÛÔ†(½¿‰©©¿!öQe}cuQÚF?6Ç#´Yˆ)ÍI9ëÑu¸SÖ=U^WUrmÿ2–žÎæ„Jò¨úôXcƒ‰E½agCÉÅÍþºšž‡3åúUšcn¤ÇöœßJú>rA<'Å/›çh`íšú’ì™êÔ+ÛÌ4uÖÜ©'•ûìT.ÇgqAm»PÐS™ÿ`¡7‡Å |Á'­«“¡64–Ï¥äüšºêÌ›Ñ\}Ò‰…(1ð¥ªMËýiÿä†ñûÔætx Û,´ÏßÀO»©9툧^"5ë]u ˜&Æ,ÝxÓÕŒeA&LŽé™äji×ë@s-›³þªl&ˆ÷j¥ ÍÉ0æ2 uµæÅ<£D@Ò±ÐWoÒšœþv‹/ºÿä¥|=Ùm5üS¯Ê£ÔtÌ—ô«Mã ]ï Ê«‘ñÌ]:úú†zö)bRm¶ÿ¢g—3·©ð¶Õ Ž,‘%Ä£géééq9F\#:ÍzVZ+J(ÝQEª‰ÿ´}‹ô ¹†!ÝpÅÙ¾ËÆzŽÏ³Ò30$;Í`-8òìòfG&“¾xçCª¢Ö KÃu—‘þJ[ŸY°5ל¯UœÝ•=Ï‘fÄ¢z†©¯µ`ß] &[rÓ•l®Áæ™3™ ‡«·¯˜³õé\¿—<„è-Yé¢¯Ï ¯„IgÚžÉzâA³Îƒ;€/Pmð¡ë`‡Üõ‡+¤¨.ÌNÏÌk—M9I;j32²Ûù”–ð[*ÒÓ3ê:ý†º’¼ŒŒ¬ÚndXddØÙ×ËW¬·}C˜Ežª)ÈÈÈ- ®‹~–üH¬§673-ïuÕí÷G‰’ÞRwmaFFfu›°ÿ8ù¡í•/ÓÓ3«Û©O÷äf¤WµR-·åÅY0hGò¤C/­¿uEûU…¹é™Ù5]èëÂTv^±¬k AmAzn‘UTÐP’—ž‘ÝÌG åªà˱mˆw¦7¥ðaò5üÈ;2Þ¤W¿ìÆ,©6ÜÀCVâoª`p=gVZѬÖw½õbG¾œ·ô­Ò­0ª€¯_m¾ÒVXÓÄG­2à³8ö ¦‡þl÷G‰‚7w]^¬§ªËáß­LødÕDŽ[a‹øýÚ'x¯Ý­õÆ”}.ÓpË¢í¾Ù4:_)¤ÐǾå|6 Õ¯€¢+÷n‡¬C?ú~+_z”˜ßúòÀŽ£uoQùç¼'ºýݪÄy1~3VTuþ¡@’|îÈÙøTê^‘§­þâßÚ4Þ7åDÞj-µñ32ÜzÔæk Þ'tßÿX~ü(±LmâÿŒi­œ?B¡RÖ»™q²£F<´o™P[ñcu»lldFž3¢Ú¼eMõÛßÝПÏü(Ñ›ÕSJYoêyöȽڟ©ÜõƒÔæ¿¡kGp'Am¾"®„Eÿ·ùÇW›â¸ûåµïsfO~TÔ¾òn¬:íÆÁè]ûM«èøþâ=Ïn?½gÿÁã)E­#¯»²"£cxüìijё»bNÇ·’ƒë¼{0rïÞWõd%©±G÷EEEÆ;›YÖ)¯ -åÒ†5s¸t“U;£5ÊEkR܉}Q»ºRÖ²mNuÜy©°,wåé· »<òXl|e‡x @ØrïÒ±èÈÝÇÎßêé}íjóµPý8ãÞ‚M˜ôcïN¶ˆcØ{….±8[V/dr8¾~î¦\&MÇ*^$À$ë¦X³ØFV¶æÆFL=Í%Ë åß—µ§ YÆ '{rL­}]­9,}Û%[7yêš:ºù»˜°Z“–Ä˺/¿²ZW_ߘkìà`mÆe2¹7_µ‘­Ï.žÀÖgÎ _« àUÏu5asØövæ&\MÏîFܶñ¡¹¯ðÖ5sòðw·ä²h“7v)Å㥚Ưåq›âít ÷˜%®†Ææ“ýÙt]—”Þá§<Þ¿ÌÍ‚cåàºbMdMW…—¡ç´5V& WoKs6CŸ³?«¹/*TæÌe’}â`cilÄ2ÐZ{þ%¦Ô')¡®AÁîä›05±2åpô˜{eÂDt¼ˆ#ÕƒËå88R5°ºç ȳSÏ®e¸½ìóÿ¤¯¶ëi9¤w!DÓ€m#­}<‰eÀæ°l¬L¹ #ãb~·\QžnvÒ30011µ·‘ušmHµDfÛH—{1Ø#KKcSc#?/'c¨Í—Ï'œÅ8¦ë.¿÷á=Ô†i o6em­Üë}=ËAÃþWê—lñ©©Ú†n×_µË‡Yüæ)l«ä*Ñð¡U{J_Oß÷×Óò ÎÏfjMÚýD®‚ÇC½Lí}+„!n qÖ1›¥ëÒªpK€ã)òToå5cuû—²×Ow8Óíæç¶Ê$ŠW²ÈÙÈÚ+T›ó~ÚËξŸòâè—üÑÛÕFWKÛvÉùH–ßs2Ñœw¤BÉA£l|µøÚÓ‘cêè—Õ$ÿ•Ñ±+ˆf0÷–üèäCÓõmç¤× e)Þím“u8îâa}’j©­C‰¾+M´VÍ$Š]k:Ñ,´J1ØsПk³p‹#DÅ7L9z‘÷[d¡—gš˜‡ùx¿'Evæ‘E– Ç%/Úe +¨ÚÈb¬Ç4ß5ÐP[°÷"Õ˜âOÿyeµvýÑ[-3ß»E²m?¸Ô“Åfnµù*(IHJð E%_N”¸á2ù?ñ•Ì€Ç T¸qÇ&ôAt¯5Óñ¾9à(ðŸ:Ð v^Ï^Cí)ºI<õÛŸ:®£$–5Á*M1šð¼¨9l{¯R>Y &ä÷ ÈqEP·tªpÔ]ÝíÐ…35·)›¦§ókâ˾vñŠ»'·ŒíÆIµñÑd/mí·®Šwj0rê„oWMó;eíŠw'¨œd0;êµr”zHÜÆÞ0dC"J5C5t?Ú^/HëYk:aé½jGd`ú:@Gk{FË°êHµÑ²™Õ @d—Jþöû˜ZÏÛ B ‰ÇSuËlQìÞ|ÓyÅ(yLK˜5{ÚºSÔËÎtGcÈãYxÜ&±•¼òÓQ]“ÞÓÿ‰ U‡ªf;QÒ´åóz%¨lFÃQIó"î?>åØ+#ÃÅÑ7N)ºÀ2b€Ú|\ó[¾ïS¬%Žþ»EîáËï©6 öùÔ¾ñB© ×f©6/Üõ v&dŠ‘vú3óèƒÔÆÐôf^‡<ÕQrÎHuÒKÅIxÞ^…ÚÈ¢1mIWŽîظfÉüéÞöl]ßûðPµ!Ïh‹3ÖåÆå5ÈÛl-Rq·#ƒbUï¤6†Î¹ EÙ;ªÍÐ(ñ½¨>µÁ²Ýµ5¹¦s3®üÇÂœ­ûËSnÖ(« wúj>‚÷›<%»œõÜwŠI…gÞ=¹yÝŠÅ!îÖú†v‹äjCTóÖœ´¨ÁKníå˜>h%¾Ý7_bÿbò¸øD¤…>:; dï®·,îDô戰!AÎæ4š¶¥6­‰lcïµ²ÓKœçadžÔ×A‚ïòO2'UvóIwuèªM¾;Í`{|æ ˜„\m’~Omb)µé[‹×¯6¸¸}µ¿¥‘‰é‚ˆÝ×õ¤I‘$ð ÖÜdJ¤‡BÔÔé>ASü]Mµ ,¢KpåcÕ‡Q£Çg)~³¶ÐøOÓ¼>µÉޤŵ/昸3r¶…–åÜÅ‹æNõtš¾fO¨¹ž±ÃƃOÈÎê®~hCWs šw.³ï-_ÈžH7 šäj¥Ïtœ‘\G¹Ù'þŸÍþv ûûDóÌÁpµy¶âtm šdjS¸áïjYuü>Q)u5U Ú^ Ô Ò« ¬uئÁÁa%eöœ_fE—ô—%îàþäqQ+Azª¶Ï¶ÖÐ6˜:Åב3ÑÈ)6¥J¹OHµáxøÌsÔfÙ¹Oñs2˜8!`Õ1ù꘻»§hé°‚ç/\<'ÐÉ}êágM}ÎìðKróH\rÓÌØpÆÆXïs~êé:¶&4R±æºŒ¥nú: ³)Ó‚œLth¶Ó’Š)‘G[²çØh±¬Ý/Y8ÕÍÎcÉιކ,ÇÉ—ŸVÒºmÁê^žvnóÂg3Ô"NgÀPý ˆ÷þTk‰ßGm”oÓS¾a©»üÙ…ÓÇ.\OjáÊ g‡Õ0$…pKaÅó›'Ÿ¸›^F&aÛµ³Çîf×ËŠ°ª¬;ÇŸ~ÑÐ-?¡&ûޙǮ=Ê‘àCVÛö/¶hé æåÛßÝwAýÓóøʉÓïwâCŽQj—zÝòúé¹SÇ.ßNàĈë‹Iµ1µVBà…É 'Ožy^Ô¤8NvdKÁ“³'Ž^}#SIJ܉Ë‹åÎpoÞS6ý`J÷°~ü~ÊÒOŸY½÷#Ï€ð\bøö¸¸ò“ܾÿGë¼#W ÿàÛ!ÁO¶–X$~“{õ‡vÀ|{éàä“5{Ò_@ÿÀ·CQÜýÄ•÷Ÿ?Ûr„üi̤njÎ}ý|ëQ2Yû”ZUÕ”]ø|Û12Y•”N*F{q%UºùHIµÔ­³¬&mÇq²´ôƲ´»º!mljÔM‡ ÎPËzŽüô'ÈÒ‹·É$¯±-3òLê¦C¯ÎÝ_¾úÇ{œû¢5ÇCê“Ò¶'“¤’¯©:Ä{-!“‰!ëbTÈœ[ÓÂq {yú:Uª6é w2YJ*OÌ{2ç’Ãl²ÂÂs‰‡&:‘¥Çõ½ ÙÖx~²%KOù‘Éâø¤ÃÎT)Í“×Ô|k´U–%&—ÝzÒUYG&»k©db²|I i®”'>-»•Üöº‚ÔR%ä“&YÊoé(¿“B–6ç‘¥Âö® 2yóIÝsê%ÒG«¸K•6dPV“¸»—´£ÈÒÚ§98Ì€ÀGçÿ GŸ$ endstream endobj 971 0 obj << /Length 873 /Filter /FlateDecode >> stream xÚVKs›0¾ó+t„™XÑ‘c_irjS:=´¹fjáQ7ýõ]!pLâL}Ò²Z}úö¡]ú‰º^¥Áå;®P‚ÅJ7(f(‹„£´@_ÃOC[æYŸE+ëðsgZ/]ea¢%á…WÜ™É:ã?8f˜FßÓÛàmÜ.#ˆzpc£¼ ¾~'¨ý-"˜'íG« ¥aÝ¡OÁÇ€LDï¦9–£‹)H€%€¨$Ôa]ÞTpêuG0WfŠ;`EQ Ï”wÞSŠ)Ùä¾ +®½ûÛ¾o~@¼[Y]xaT·YDe¸·«3WÀLŽ"JЊ ¸RzÄ/‘ aÙoHÑ°ßwöòbGG¸Â:prÉa4\`K‚Õ³¡§÷2*ű\¢¶Ùþä(³rnëÞÔ½G¯lQ~#„™¶s¹WÜñ;eçV6¶ëÊõÎLl¬×VYŸOnwÉGŒ<Ûí¼nbOB[Ï*[/üA+šp(‚K™òäZs?˜(p&ÃÏw7Ná:b$6è6P´R†8ZI.ÂÀF‹_T¯q9|Ø;Ѷ…ÇȳzÂ0^1t¦ðš²žLlµ.ë¬/í¤ØC h¸õà”šÖ8¿K;tÎ)QA ᘙ/›C;î=†Öïîʉåót’) S]¦¢zžH–`­‰¼8$p¢élP”]ŸÕ¹9$b¬=Én6éOàp‰µRgãÔ6w}åŽÆ\ªãâŽDá%ÅñlIÚB_ $g3ì‹Ñ+ª Ì1N8ó{i¤¡R 9R…ÐðZ—~¨­Ê¶Æ+³µz/öÛIW”sÚñÄÚô{cêSœ¡ÓQrÖó§ÐWÄ"àÈÓs_=´~”â×,l¦Æî> stream xÚì@Yš¨ÑîééÝ™Ùé}ûvwvÞN·v·Jææ@Î’I"˜1£T@T(ŠJRr6G´UŒ€¢ d1 ¨€dn¬:¯ê¸Ánµµgÿoþ±¹Uu«êž:õÕN%„> 8ŽC!ìM¿7o•EEÇC@@üâØ¿cOg|þL»9þÉ.›R ~Y¸mÉÐЛuðÀ~PÊx¶ –¬Kª@É•¿0Òï"Ÿ]G¥L`›ÅëK±¤rñË"õšã¶Û@@€mÀ6`° Ølñ™ÚæðAbŸÂ†ƒKÕ€m >H¤ÝAŽk·¯^µbÿþý9Ã)((Ï€m > mf{„ÛÛÍ N``àÞ½{Á3`° Øl¶€€Û€m À6`° ¶€Û€m À6`° Øl¶€Û€mÀ6`° Øl¶Û@@€mÀ6`° ÄÏ qôÅg;óZcוŽ½¥äØÄ2œœ†ø·T°ëâÓ^ì½'•IF•¼Ùy¶9ºšL·{wžoÙ]Ø—TŽÇ¶íÌ{_:ö¢‰+Pâ­þè+­Q’åF]z{ƒ/]bbÙð‰o¾Þq¾9*@2V>¼ +|­¸æQ[£¯õ&”¡‘k¶Û|êH­xídÈ¡QÕX,›6¡ñm`³hûö"ùž^†bO_1`ýH¡éz~Ih„¸/¿ÒJgŠÞ¼ûî"éRJXPˆ¢îžô$©[ï·š®©í_8–jȉÑî#§]u˜*šjÓh?R45 ­,Š*M©‘ÌM>qò´ÅÃRSu Õ$<®F¾8r‰bï«“Xy:‹¦¢¥®¬cl=kEtØu”R!ØlóyDJE›‹™³lJ­–Eè®@.‹6Ëëˆ4I ´°%|Ó"d±º‰_^r¥TxÈ®p.S}ᾉòDbïå;–Æj†s³â«‰i° ›½Ø ãM×F«†œgü¹3&ôéÚús½=O&–[ƒ¯Ö-YhÅ¢ü`¹¹4± ¦7)×ï˜ë3f:oÖgª.>*N®ÌmÄëýײ™¦[ŠÉê’QÑ°#ÜHW“«ç’OT„¶Û|^¶qòÝsK:„”FÚ=äí¢˜mŒ¾E–gjå3'ît»¨û;|¨´ae(Y2YjEÛRG6k¦gT F´nRî¢ «Í©ºËBŠ‰ Ƴ ¹ˆŠ§®&l+ψ›(µj(ÛI©ðXjÇdl<Ñ-YRÛâ¹–wîÓÙ\“ùñ•ò¤Ef“€kCM§”j{l¿UÝbýÒKe°•Á6`›ÏÓ6²–Kˆ¯™&wÅÎ1‘ÉÄ&{k1l6ŸíÙ{©Â‚;uVÔK©ȸ^d®õýÌmÕi5(>+ŒNá.My˜,SÁx¶‰Ï‰c1ó#JGÙ åâ.…âz%Y–á«—ëÐmRêPð†¡}ðe‘Ì!Ãm3¬å奧ÉZ±£\&F° Øæ3³ .MÒky+gѶ[boc© géê;$—v-šg¡m¾qWéi6éÃÔÒ÷È®q0gêÏÝ}{°oyÛ`!ÁÙöšC£»ŽÓj^»h«è¬ÌJ”´˜’‹®™h̘—ù2­ ¥žÕÓ¤.L¬K‘ŠhlÛHz„rB38ÞWÈÞØÊ`°ÍçÔo³)¶RÒïQƒ’J^{­_ÊaQ]Bn{tüÉs\5ûGÄ.LÄ®h[ßûP§¬™C4 n59šh³¹l†–!Ù†Jœ8·lò"lãóÓ‰Gj o™¹2Û-1¡‚ÌRB}-)Ë#¯ ¥I‹×B*Ý!9±Zb•·ä6ÄzFOá(SVœ%l [l¶ù|lcÈdjÒµ”išdЩšzföN~¹q•ä›B×±©ì¥éw·* :X–“©O¥Øn>7t&º%ÞÎPW³ÝQ“^­pÞyÜÜ&XšÛH#·iwÕQÖYžIä6©%µV\º‘«ÿÖåAË‚Uoõbª°ÖäI’–1mC¬@%ŠÊ ¤+ë¬Ï‡Ül¶ù¼rýÙëÂò^ï¾Ü*‰W1×ûe­˜Š7nf* ­tŠ*¢" š–*ÍÐ{w…üL4‘œÔQÑ\˜^?ì¤óøý6Y1L&cÁŽŠÄò‘ç©Ó®ÓÓÒ²¹œ\ŽïØ»‡Ã¦ÐÉ-®¥Â¤Í0^r.ñÎض!Ò­ä´iWƒëU®pºl¶ùüz‰e'©+QüÁšŠž÷Qö}”Q'‰û(9ÿª¡ú4—Œ.²¯XÒu“œ?d›¤w³MZy££>…c¿iW±,ý&EÉB?7ÛÈçÈ›¤2áŠV,íµ»ëPfl²î#¯ås9vÛ FÙ¦Œ<•L¬ö™Ãz–›Î&W D8'¶Û|Þ¶!ûOîô-›¥Í¶_¿»ºÖ® %–t¹Íárg–uÉŽk“ÀR”qo(Òk$b©D±Çs (?Ùyûåv¤ß#M’VúÚÓw5‡2Õ·`Ñ@+ªœIûÎ"²>µZáb¿ ”p$–Ae/ÛW'·™tÄL2ï¡ÐÄ$ C Kg~p¾®·Û€m>«k‰ç˜èé;le|ß银–ƒï¥„‘ñ–À ,Íó_Ö’Ê?¡=C}AÚ“‘¶ ðd3µØ\¶¶6G\¦Þ’ÃIr{ìHO513äÐUiT —C¥SÔ¹z¦N…DS(¹E„;hPì·‰“¤!éØéœo¨Ì]œœXùø¶ÑÒ60Ò72Ò××!ÚY,6GßvCP\K ¶Û|^‘\ÎN¿º)§zïÈ»™ðØó÷üóÂ/‹F+!ÿ‘oâÅг²Ý¹¤Å?>/ìJorù°ÞÚ¨ÜJ¿¤ ¾‰ ‘pÞ÷@CR…ÌÉU(ñƫЃ7$“]Ü”y;òRw2Ù@#Dâíéç6fß#!Å;ž$M¼è“W×'–Ç—¡¨S’ïæIÃ/¥`ÛÉÆ}å’ScpŸØl¶Û@@€mÀ6`° Øl¶€€Û€m À6`° Øl¶Û@@€mÀ6`° Øl¶Û€m À6`° Øl¶€Ûüm“XŽ2òßœIÌÿiß•OÄjd]~=ò reøñýågã/~܈»p&ùZ"<¿lóÑluLUEJJŸCàJJ-L“Ѷùµ–>éÖÚ‰ðŠ°ÍDZM\âýé›þoþ£IǺIÛêF£Þ,á× Ô—RÌm›¶ùG]zÛ„ëX-H¨„lómÓ oG$9{k>eĹ|¼¢BrÕÏÜò5rõ*eë#«]òÊù¶%+ÏÊa…)ýâ°*­ð£¤[däÛ|pÛèÙ¥T”éÿ7-é4MeILÓRf0{ͺô‰²Ý'6ÄîS7—{­1àªi(OÑœñƒcä°6vó©7)Ò·ÇJëÃÍÏÍ›L h š‹®NÓR7vô\—^—P†òkÍôfPÔ~…úUÙßÊšŒ§_ýa¤mˆªU&$lcå‡Ø²©UüàÄg[–Æ-Õ©šÓ¿eëÛ¸øe†]ê´\XÊN†ò­ÁE †Ê”…ü˜Ø%jÓ¦ ¤+ ù#ðoÿ+)Ý·vO)-Ö›úWu Ë «=¾')Ž®öíŠSdMÜÎPsS—d÷m]m¤J¹5¯op_H«zîÀ˜ª®»j×-lh`Y•ÙŒ¿ê{ŸI!E$IÊtt´`ÑÔ˜tMºÆ,}×ÍÇw–ŒQÃS ®k3¾·\W8òÒ Ék1cŽ]Ü|¤ùç]£XBCM§Ó<£Gåui¥·ô¾û›Íö[©Ã—²;‚®ü7÷“(nïÊ1Ë“¢6USÙxóOUìécnnijK÷„ÄÑU§R4fÐ4É ª}K¡rmWLJ\§H÷ú2rõ6z0ØËsÉ÷›.*iõñ_ÃPÿÑdÙÞ}¥ceªRWÜx²rÍRE™¦¥Ìж\q)î6Š;]WYÃó*J몪Ԛžù:ß9D§”¿ëEž`›_j›*U»ð‚¸kob ˆèˆ¹tÏÝ™M¥šy핾$zω“¦ºš,ŽýºŒ{{òÛ£ Ú·g³2¡r¸ÚË2Ú¥/M©Á=p(lÏCͱ׺b ;c.?X2‡KcZn8ó&¹L[Øß]йûü-KæwæÁwã‹ÞCv–ð»þëÛ¶!7zIa›-çºÒ«xÞ+œXtÊÌ¥q!ç_KßsåÅæ]áÚ ¶¥×Žb±tGŽHå¨ÓVœè–-H!âoá‰%=ÑÄšçwĶùy»³tô½Ž¼&>^ÚGæ66KRÊJM4T˜t #ûÐè2$?ÖãÑ©É\¦ÆêÓ¤mÂR£9êô•'{ÆXÄm”t6‰¥J]œÙ0øfíä3ÙL ]SÏ3/«ç•(>+JÑYÙ\ïˆä²©³|Žî"VìZWLá› ˜:lõ™‹2ã+FÛ¦ØPŸj»áÆÛ$’…yÍaÚzŸNøY¶©Bᑳ5týGÛ&µ´Œ¨ö»ÊFØ&,v—®ºü$JºÕ++Ï‚6ßÕ,®öÚC¯%EAT®}¥¢ØÙæŽ:yÕŒ1Å*âQÜõ7’ Þeµ-.‚­Éò8Ý[(©u…;7×SÑ6ôŒ”ÿ¨Ôêöl­e™äkÓÎ^´2à:/µàÐ,Ö¤Ži²ˆîô­°×aš-:ÿ:öz÷Îô]5ŠÛ¾ºÔ’×Nv´™¤¸F:Š,‡Ð'¦Kz’äeÇ`›m‡]åÒz%ÍZS*[fs¿Ó^U”ZCüÝêfòËÔ+¼”È1ä â¸|í®­›k¹"ªˆØßQú­b#U §%i²Ô—œOzeã<ǹ ’Sêó¾ë÷­™·Øñ4­ú-ý6’ƒu\ÎfÂ6I×{vådé°Ô¬×žH¨VHŒkPÂO‡m¬œÝ´KgN؆­F_saìã×PT`[ýV²t |Ï’«-ë·‘ØÆHCwõV.µ,¥^žW´ ±ˆµGäüò]¾ºÍEwªÎÚ‹ò*‡†ú²¹.³ÝtMB¥WKb¿å³™†³ƒ.Š’Êø«V¸q´Â¥AIžŸZ-Z¿Þwöªí;‹Æ¶ÝÆ›ñמ(Þšs+4·e)FaäáÓÖ\†¥ûîÍY7£ŠQÒµ'[öWÅ•ð£r«¶fÝ %Ô¤›,^²ÌÔÕoá:O]-ŠÑ²Ä  ÅfŽ^ ½|¹Êz.©{kÐgcYÄå$sØ´ù;’½FÕ(ÈËNÇÆk×-²(öõî#^w^:hcl[èf6›³þÂPNdvGë“â’C˜\ã€K²¤.>m…†¶Ûjw;SÇdÅ™¤â¦YFÊs2ú¥G®äK¸,u÷h³Y ]}ÂMéS÷¤{ƒ5ló!l#«áÉå¯]Œ¦pÜóÓî£Í+­éúŽÛ.ðG$™äѼüž¥æÓЪ´*”|mñµgjý ï²ucvõŽ /b®÷9rÅÈç]l“vûž%‹FØ&ãÆëEfS.§Rî*t`V‹¤²¡–ÔÒƒ/våµì®…Ôrõ¸¶QS™t6ê|ãŽsCáºíƒÛf°«<2:‚âº'µ“?¶¬ÕÙ\ÛÂã²â¹Â´êñm#òÙèÁaÛ Üsü'ê÷ó¢Ì’bcsyb#Y+Ѿ^T ýCI¥=‹çÏÔu;xGRÔW¯èé09æî;Jˆ…¢ôh³mö¾„jhI}Û8ÅßÏy€2ëÈHºùlíÚ94M½µ¹iwkݬXæsà Æè®O®$Úßé®-H½CÜKû·%ïwr4§©üÎ0´t²[´yã‘É•?;·‰ßŸÌa1IÛ\ì¬ý®WQÚY›:åÖ÷U\Vú‘±b½Ë†ÜøjiK*N‡¡IטFUWµoµŒ¢÷Þ}wÛG;FÛF›¡5zãXé"öž/6ÕS¶ð)OªFñ.èiù_G©W¯ês(ó¢[ˆ9:R§xœG’D‘4Þܒ^º´ï4Õfhš[ÎYµ8üJüif5Ê6tËeYû¤¹bŠŒrÐàxî&*ÿÍ 3.Ý~ÙiädUKgÍþ–dI{vß•³:3”çî#¹å(æXž!ã‡yûE„yƱ©† Ckš–Ê-Õ¡ hª²hjÊ6n¢¬ûd•#ä¹çÔU{K]wÍöÛ’JrîºWmáA¡b9mÊ„žÞîöÜp…±1§.ѧÎÉà§×ákíµ¬üOI{ÏöðÖRÓñ<ý&EÖŽÃCƒÖpô\Š%‡Ñ«Wtuhv^¹ C;všÚ¾ÑU`›÷µ Q¯XtuUMLºWWNèuÉ™Aц%ÖLçà+¢1r›Ê{Öw†¾Å© =*Ä3¥| $ãÌ¢å‹ 8tšÞʃ­dë¦ìmCÌDì¿Ù“£í%ÉmZÜ ¿ã.»D´­¤9LjñmK=}}cccc]m Ó (úÎP¿Íº|²ê¦Õ ‹agx'²M2y’¢c™–ö‚ؽåhTKŠáYð¶Eà)·[m ¬ý‰j½:3,žhcÞy3ß”eµ*›HBüü-¨º{jó=Ùµ©5(æ\µgP˜•…‡¡ªï¼'ºtd¥¼—¸HÖKL,"ÎU“åETþ⑶¡ÐL6m“xÁEé´5çÒ6fìñ‹†ÌæeñÇ· q rŒ©ÉþK·'Äsé*Â6Ûµ™&Uu°Ö±˜ Žé’͸´=<9žhTE _±‰l#òôYÁa;…Ü}"Ï6Õu¿8 F%¬ [†ÆËm£I³Ýz©oð‡$ŸËa3µ=uKs]mªÓ–ÒÁ¢Ûå¨É]¿»lóÞ¹šŠ…WR@êÿ22K".ö¦ÜAҎĨ°Z sß“íIåÃ/©@)ùÇt”Uæ$7­Ý D8'YáêšÔ»(±ðÛ,MšE ÙKðŽ¹ ‘#Ýî_4kà]EöÛÜèõXD§êDßêÙH»+‹õ~®#ló^ý62Û=–ñgORUcžÅe¥¾S¿´ÆVá[½\v!…|[M ¿SDe&Z7ÖL[ßØÒÎy†?ùßL«–™“4s¥üª¡ òcj•0Àoe´þèë ÎIMd›ÇÆ·`BÛ|Ì~›í }~tá¦i­»ºõÐݘ[Ò.>ò'lØ`Év?7xˆy·–”8`Ëz6Û(àÚÐ1êða ’drï•"CM£M×pò*/Ò6öÛ$WPÈgþz®ŽÆÜí7†Ù¦lóq{‰GV¼ëWŒÔgo¸ »tM~MZr5¾i¥)E{ζKýÉxô©«CR"¯õ®$Jjþz_3±™ªF¿Í¾¢ÇÖLµg’k‰û‚c¹Ôé® Éï|+ý6Ìù¶‘^A$X»n!‡m±>6K›õ®¶!÷ô{hT}Ÿ¬\3*cé¾Iw%KcÑœCNÓSezz–"=-rë_düÚc}ƒ—ÿIOÍ$ £Rt×d7%¿˜äË6cô+H»ÓUoƼÌæÔáO9m›ÄáéßîÄ]l6}eNïà•™Á{<è”ù’¢’7.ÖÊÖÑ/‰$Mb›ÙC¶)# Á¾¦Üʼn‰`›Odi£5(d9Câ´åÌÎ",½¥ßC)·ÚüB7³(3ìÎï•lÖ= 4µÙ~'¢o!b"ñH¿‹öœÈ³Ñ¦»Šì½|7Û»[Ì±Ý öÊ]·åw.Õ»Ì"’\›ÕIU{+È™‘xãeÀž83=e¹™{m£J'š9™÷ÈE+FjµÂ!ò]l#Ë%nYrÕM­l9LMÅ–”Wá[Aæ]UOÙªvîŽlmCbe’k€+ˆÝ„ê¶ÖaàvU ]™„›/œÌ5˜Æ›ê–ekµ(¹øÙÊÅÖ ë­y<¢4b/<Ü_¶ç6qnáÏö9E$äšü¦mC,ñR›jtIv$¹ûß!Ë'ûA·“Íb]ñ3‰Kã1?Õ¬Ž-&‹(µ¤ÖF[ÍliR|YIR « TLÖ_–žòK*®]7—m´÷Þ(ÛH*^ln “¾0²¥‚m>In#M$Jû6n\H£R¸Ú=Ks“BµÛZ4x›U2!¥°µª&WGÇdö|[—ù&&z\6UÇÒ#âš@ñ04žm$×Hl]­£·25Qñ>©[M œt˜Lº¶®®±ÕlS]mm›¡9suVL‰X:Ûˆô8mš¦îL;sk;³aaëx~ßÏÊm¤‰Y%Ú“¹•¥¥Áf(ô¿enÛ.H¯¬#¼ºÉÓ€ÉÔÒ5^·kðäxZ·Æ„ͦšÌ Š¹=t~6>÷Œ ]ÅfêšÎ¶qu·²1çr Mʼ½M‰dÅÆ7r´µ=ñdzM¡¸W.zt¦®ÙìùK=ð’O…ÿvmC6<7Ùqf{ï.–÷\•ö¯óõ±tpµrtÔfÓ¸†&®3í¬>ò2­ZìëáÆ6´Ùr^(5UìÉL}Š W×ÊÚÙYW‡®m¶(¼@(¯~øŽè06Û4 h´mÈ-žPÔl«­<ÿ?£à*Øæ#ØÆ6©²eÉ2_ý Éãݽ˜rÅ+]å¶f³«Gà’ ýÛÎuº·k$78T£=§KÖíšç±iîê€y>{¼’Êã+¯“‘´ n>_±fݲ¬i bDK*¥ª×ËkÓº´{ƒweJ»5ˆCvxöÙ御®®kƒ—GÎëK»;t Ò®“篬ވXU¤p‘-±/ÃÕ3,ä*¦pWæâ¤ò†EK·n9ב›7¹zl’^§uâÂ<±±j÷Íù!rÏÉ“n+7, ¿“X5$–ˆ¬#nþ+£ï&V(\i_‰RË^oŠÎXä¹yîêMs=ˆßu2¢“,±ªÛ“º® ÚšGî/É7/òÞ¼*þa¢ü²ä=‡ö9­ÉŠ–Ø,áü•Ek|]V‡œÃ’/žv^|¾GVàE5ó—lÙ’/’þ´ø¼šEë½O‹ˆDTV´£×‘¸Ñ×-—5µ"gd­ˆ:”7oµ¯ÿÅa·&E&帮 ÞvÓ6{ ë—zx®<Тഇθ. ¼6ÖõÀU|¿MÛ–Eì¬6¥ëâæÛ,ü-’òpYàu²=µ Ùµw®wTD¾xð*Á˜s·WúnsY½Å=ôäΛ’¾ A•]-%æàŸ+Jøi¿ÓêèÈÂa7Ë$–ò}B¶.ŠkI-®[à¹ymR}¢<݊ʉuZw0¶lóÞ÷€W(ÜfRþ– gðþAé%4cKiÌiFÞÙW>´ÄÄ‘¹¬¿tÔ=àƒí á3W¼+SaìˆHR¸“Qvs_ÅX÷€WŒè šçÐ0-BÖ©5r¡c T\í¿kØ}ˆŠ½UCe84Ïáë&»sð· /ðÁ5lcÝ•9F­½Äá+™4Ö=#6÷Øk>¢ñ.+|¨^Yæò‰Gß œ4¼0‡Ým*¯–ÉoÙ܃K£¨å¶'NÀ' à‰`° Øl¶Û@€mÀ6`°Í?Ð9©Yûª‘ôJ¼Oñ÷ƳMÚõžºô‚À ° ØæW°MÇT•›>{Š½v}¸±1Ž÷çoÞööºŠÅe˃?^4èÛÁÛë À6Ý6þ·ÏäͼD¼žNI*ÅFÛÿØ1‰\zµ›¼™ló‘lCÊOeÞ®Zàû9DåBÿÜ”¢„‘ÛÅóƒ2‰ÜæãÆ"ÿ’µ‘ •(v"°ÍDZM’üÆÉÏ'F\öi—¶ù`¶:¶Û@@€mÀ6`° Øl¶Û@@@€mÀ6`° Øl¶€Û€m À6`° Øl¶€Û€mÆ·Í’uäû/*! ~adÔ"û5ÛgƒmÆ·@`lå°"üÀŠˆƒŠ±,lÿ’àŒÅÛ >ƒÊpÉ!þ…¢ølciØ~Š-ØfnÞ¼¹="\1"·Gx{®33514Ð7‚øÔAlSc#ØŸù6224Œˆˆ ô¶y8Ž9üÑ£GQQQÁÁÁ!Àglˆß#T¶yGîÝ»9ºôxwÀ6`Û€ml¶l¶°Ío—gÏžíÚµ+ ø¼Ù½{7ÂgΑ#GÀ'žï>{úúú >s„BáÛ®3à7 NüOŒKþCþCü‹ÄKˆ¤£>ŒoÄ„cp\$ÄEñ§° >€º„bLj€F$3""¿Á†  :~UJcdpÝÂvÞ3Hlø0YÙ\"SÂ{}åMáOìü[¬Ö´8Öó*Á6|@Û Öu¦·Dø=qY_ï°±iîæ¦y¾¶÷ûj$A90¡L†d1Øò}…5‰Ç厘8½à"I/ð`VƒcÄ\$&þ¼ÑyοÁÁ¿ÉÑ·y¶Ï£ÙYÏBÊ;® ‘Xžö€jx7Õ òÚ™çxÃCþ-"·Áe© yö‰ÈzÎ=ÏÙÚââ÷Ü~S“ƒÏSûKíGH@Z Ç$²Ñc¶ÍG Áß:n¨ÿãçWc½}¹ÀçĶš%á $ †“g¼«ûnml!R+ÿç÷G]•’ënˆf–Xb(·ß¬†vÿ_ºG}sÔº£W¹XÏ]õ¼½ÄYOß?ýÒ0ÕÜ?õÑ¿ƒþõ_Ñß•‘×.Ô…+Ìå%Rž‚þòrìˆÐYIÔKäòWô§?ˆ“ýEaŸ-ë-MçøÇòZOX0ôbnÔÆþ,“´ùÑŸ›Ô…d¹èjÝúh¶£K@½khÝ2Ö'ÆødÎ#"s!²nÀã·LSŽ‡:×÷Í{ÕtÖ]ucjѨ‘}9ÛV˜Z-hé¨YcoêµïÜàpäk†””29ÌE ÝÐLôoJHéoèR³\8/Ѓ¾ùh¡;Z²dX„f‘KÝç‰ÝÑr7ô¥ú;-•N鎎Û¹ÔÑnMäÀëË®F; ÃVþLs›»s½Ût£Vrƒcx·¨sÛ“¥ë›ü[ìBW´Šq#ˆ#¾˜<ÌŸ"™[àc§o9 Ž:´PÏ*\ô¶‡dª‰Ÿ/%òÄ‘éñÿWGlÍ=^"ô,oM`ú5Ùˆ@Rš„â®"žP> =¯CZDJÿ‰Z¥CÛü+ÒœMÑÆkqIÜE˜Ê%Iq„èqÜBhBù î9åOßöMàÓæ6»ïx{5ZÞåHò”Üè_ï¼±ÁaëÃm¢fIO0†d÷HᲚE÷kªãß½˜8&“ª¥JaêmI:×!”m¼—µ—|ç›2¨Lš†¡õ‚œ‚:©CZ[ÿ§î†ÆÚŸ6Ì·6Ôg3™\ߤ«’Q§—hhÑ©¡©±évBüÚK©‹­¹L&…Ag,ð¯{Å“-»>GUåÇÐìâäÀå–ÆEÍÊ=¨ö5OØñh™‰*ƒEç°i\Žþ¥6rË”ÿÄØR@üU›¼fEa!^Ö*û³÷úÉùôÜD_|t—Hî«ÞMóú¥BS‹°Í_¦âOX*]¤mæìS,§!ÎÛOiRû®Õ+¶„‡º~¯F9U˃Zôùö8§ÑâäóÄT ºŽlx2kÛc·ÀÆù-Âû.Àq1’õ ŸæxððÊn® 5,·ôI}ýÝâ\G}5û¹Äî„··£*»l?þ¸©¹¥¹!ÿ6®%0¯Ì/.,T§±g-Ùq§ùe{ûë²S»õ4UC®t£^= \f¦g¾ñþ«öN>^u*‚«®¶íHICssãƒÛNº:+JZÕèùIBJ:VKroÝÝÞñúY¹ÁæAyD}è}|Ô„JÛœpöÅó—d*òæP؆ÝçÉöË@_Ÿ8:áÂÞÞ~LzÚòâ4Y m)yk¶"S$·¡:½M»ãÚFÜ×Ó+$“s~_?Ošø5^Ê ¬iB5ú|ªó;Ó> ÖOÂ÷=ðo°óm˜ãÝhUÒwNÚE#ϾA7Ÿ Q¢ÛtÖºŸä{œèrrÐ2ÏЄnèM7[ÓÊËRN~«×\]³Ù„m..šö£îÉW¸¬™ÓVfoª5?ø¦ä,dOÔK}Ëmä û¦q½. -­9ƒ©ÉI¹úH²÷Ÿ"l³rû±<½¶Çtšév2_é¹2“B ?X¢Ø®Ccv<Ò7=6Ç:†ò:QK zúT=<¹m¾A“'£?þýéOCñçEIå6ãÉ êîçâ 5 +½¬¢ë¼R^lÞÐìì×è|äUìýÒG—1kc4O<¸qÇÖ»°Í¬ªz%¶a.oÊÇtU;Ži›¾³ÔU¸:}=®ž®,ˆ¿'_´MHvÍà2%¶ÙúólC¬]Þ4‰PJéiÇÀ¥‘¶ù…ý6Ào!Žµ‹ŸûÔÛy?³ÙÔ4gë“9ϱFùi‰ÁÇgl>!«¨SÜÕŽÊmº£,éFk"r›þ¤Uº3ç<Hm³lbÛðkÝÔ¿[s­gì£cbéEèw“Î òlÈ–Vï°Íÿ¢äFŒ:Å/×?±ÛÒd¿¡ÞáBÇù Sƒ¦Õ|âM”¾DMÝ)I$Û¢¼í«t ¬Êù¨&ÜtšÁ²Æ>¡¬s¦¯i¥ÛbnLšÐ62Û þ.7Uú¢#C×ØámEùe½Ò3[ïd|‚~)[TÉ3à)Õ#Ó›Ÿ6“¶ÙzîƒÛúm>¿^òaŸ‘ÛXo­_¸½eq¯¸N@}^›¡¦›)zÓ—lß½¸øÒ±½–µä1¡çÖ"]µYb‹Ê«ª+Š3B—ҙƙ5ä¾:žmðþ/{¶Žý‘+×o=éyx9F[m†ÇîÃ%eeÅWâÖ™OgÌ*|Ò3mD•Îj.vݼq­©ƒ˜k{ÊúÅ[Õ½­–yš§AŠÅÌíKC9Ù(~²Ò’ YŒž úm((ýÊÉY'Ѐøgæ6ø£ÜøµëýËe3>ƒÚŒ‰;ÄO}êm7<³-ìÌE"òzaÐÍçÔ³Füƒ½(;ºÜV‡¦¥J×1ßq¬„/Ï?ûŸWG®uÒ¦«Ó¨”ÙKn5Èzb_žsù«ú‚&Á m*­ ”7æI÷ØÞÚã³ÙÓUT4Vn">¶V÷pÔgÐ4è º«çÎ;¯å¨\oó¹ ÆÅâž­÷Ý#¹öJ}ŸŸp~ÖµÄæ9ݨ+Çjúàøˆ+’¥m¬aí%|ÌfËxW ¿ÿ]™øà/œhž²1‚X;½ËO¡6>¶Á1è\[Vmw- …D;J¥ü#ðæÊV–EØ8x~N‡MÙ“j^p_ð”B}~#(>øDúL|ØùsnàZÞ[7B"„cHŒ„¸PÑBbr„€|縀Ûà.&t""&Rxæùr1N‡W~ð!„ƒc.â8Ÿ|`Ÿx°%%F|>‘î aðæ:>DK ÃD‘ˆ11ÑšBCO;ábNXˆhfáïÛ’ã<œ|1.ÄÇÍ*b8#S lÀûÚ'{eÞ´ö=,Âú%©ì¡öbÂD½HÀÃÒ¾d€÷ŽXðjѲ§_~Ý“{ÃߟÐëÖ¶™ýûsÈ7ÙA?1ïÝ’ÂÚ;¦Íèûú‹þ EDû I›M=î+;'+5Lù‘Hl@6¼¿mįÛzþþ÷¾Éß<ÿJ õˆpÆC¢ÞÀÿ|ÛýO“›””Â7¼?Ø¿Ë|ñ_I©/x—€"D}¹‡;ÿùK’Òóú?˜Â%ÆÀ?ÊAFöÇ/>ŽŒóª&±p «³‹'Æúzº»{ÅøÐÛ3Å1¬KBOO/O 6\ØÓÙÙ5=<1ñåî®·ÐÙÅÇp!¯¯««[ˆa}Ý]=½ã'äB^Og÷>Náàø°WŽ~ê#îˆ5á?’÷þë$èîüóy×PÇ’¥_) ¿˜ôô_¾‰Ä¸Pðš¥Åÿb’x’oþrÉKê¡—øJ6¯c|êó÷Ûªýµgvï;?0jø½‹a*ÿý}“Þº4öÜ'²÷®b5gÖ.¶ck|ÿôf|ÿ?ÊZt§Å«SòêðÁ]¹ï²á·WV®¡6C]!Tü»í¾G¨)—CQ‘QS®®®¬¦"›àÇ©ŒÏÄg£ÜUgP/>ošÃV3sÛòfÜ_w5ÖðïœÀž± GØZ³çp§|@ß“{/~ï¨;¿+þl¿äï¬-ì÷¼ÿZ f}k-øµr„¿•UmJ“ø_*‰þirï±\ñÕsÝJJÂÉ_ôüî ^~¾‘7/À>úyd#Ãã½Á{ÜCdß‹[³è³jDã„>îq»½g¹®epר#?¯ãîjó™9ÏÑËò ƒe-’é+mÕfSmÜü+Ÿ÷I'ëxTàaoÈâp“®6ÊýU`þ½òækÏ&,‚ö»g-©ßû^íSßÝ\0‡c–ß…î_ s^Ú•ȹ–h¥lÖ3Vá4ç'k³W<•çþ7·/0°è~Ëf˜0ïyÛ¶1ñšõ1¶'V¾w¶ùÖ7’CŒ´löòÆÎÆ®cŽøi»¡ªÍ>ᯗ¡‘Ç€UšHb˜þ… ^LÁûò÷üÉ_½ÖÔä÷t‰0>œÿ ’háý[—e¥ed*¬¬Ç¤Òö¤ôÔÁŒôô´ƒ'ÎÝ{Ú-Û)Ú«²²÷?|Å{ZyeFrzFN~ÅiU{S~>&rGËh{júñ¢;Ò™?¸}åpvZzzæÙÂò\ÞŽÀ%²]kõ4þt8=%5íØO­|r&Îįv2×1š·75õê3¢¶Šï=uêr·×8X{Ô+– ¿è 1ë©ZÀ™b²2¹s„…vûú&å•ãŠ¶)|:a‰´ÕüdAØ抢-pÁÃ㺦›ÛªOŸ;7ð ‘“ ºŸåf'­é=‰mÂû°äü‘ŒŒŒCÇÏÕK¦z~%k«—‹9+:#ãÜ£¶ÇgâVÌ6Ñ3]°/5¥à…u=<¸?³´¾§¹òJNzRQªå±‰Z¤ø«Rb«5uô=¸~:35)ëðɺç½ÄðG7Ïd¦¥ä>óä _AK¼{Å—e§fdd/ªÈEñ觽k\,´ \ãSS¯< #l³‡z NHÏÈ8|êRKÿPá’Û¨Vœ•Õ ÙAuAnVfZΑ3OzÑÅ¿ªm0¢Á+ãïu))‰'ý®ó_wýîKÞ¤Io&+µÅÄk'À„pü“º†ü÷L„3‡¦fé²h¡.ÉÝq]:¶ù„'‹¢aè°xóf'}&Cßêhu+9¢>Â`ù¬Zcà°&1#-ÜÃBCK7æ™6´ß<ºqµ MSÇ'4<åümB*G‚]´vîë6yºéiiè¹Ç÷I—,ˆôà°ÝÓ7¸YÇ$¥ìÚ¨§Ëpp ò™;Ùv\›-!ágšˆEíÊÖ´]ù¬ë{ýøƽç„–ÕvªçGݦ©˜_nå)^eÉ™ô„§ôÃûØÇ_=®,&•1PYpµžÜ›QOóÙ”ÿçšÚ2†m¬Ôív${éÏtœ¿fÙ=¦†¾ÑÒ‡8j>»ÄÕ˜A3öß~¨¦õnö–Yæ]=Û­Áág[„¨%W—C;ÏÓÄiE\rrØJ -ºnøÙÚ ò›±tí KÏZ’™²ÓžM×·ñb¤“Å|ÿŒô˜%fªš–íÒ Òüµ™šŽË½ü×ÎÕÕT7X‘&M`îîv°Òær­·„Dä6ð…Ó\âw-×å¶dõ¢ÙÚ,­™vëŸ e«¡P+ÖKj…åѪÒ%œó5¢hÑWzû­™ËæºøÌTûõlC^Ý'‹„}ý3ÔD“”º&%üR û½RãW“&ÀE˜˜¼i’›OÚ`/ £L×N-m“~¬=°BYuV ±C=Ï3¦h-=>Ø•²w!UÕ&‚Ü ›3iTŠñÒÈÁ&yâ|e­ÅGe{ëí`Me‡‡’¿»nSfpoµË–U~{êâä’^Ý(o#y°FÖ=SŸè¦¢c{«‰8Žòw¯±0° çËZ¯îW”Ö<ä‹ñÑ-… Ké*VÚùâa8íÔþ‚™?*/K8UZ\tãÆP\¿U;¢s´mð‘-ò¿b^WMYɃ—ü1l“dKSW]“R.“vn(“Mß{é%ñwaúR*cu›¼H×™™Øï”cË]m†®“g›|y¦éx¿û=Ù«©©5kS¶ìc]$cú÷t÷lé<ºž4QžýˆüûU~€–Š^Fu¯t®Úã3™ß¯É©—|ů·Ñ,ÝÃf2µ4ƒŽ?õ•¥®ÖâäVJ’ÇgL(Z‹BŽ ÖŠ} iª6áDa «iZô-9e²þü{)Æj?ªÛ&üJ¶‘ÝŽ àâu>¼ß+‰'Éûâë%%Qj†Ä8y²ù¤ˆrW2W¿è—#ÁD¯[_õ‰°Úƒ!5»V4˜3<.ŒbNãž v•–,±ýpÙàxn—©ªÙiOÇÓ¢­šÊö’~Á~7gY¨B}ãï\le:{S›Ô6^º‹ÐNùWn™N1»t¿‰»w¬ži`-é·Þ71J&‚,gÝmk·“Ã:“·¬t™ëìêêì:×Ùqá–F¡¬%e¥ªB×RÑPWVˆSéîM¢ [RãõŒŒÕoc­ÊXÖ0¸¾MLÆŽ£÷ˆ—’–P+e –¨#ØÝÔd¶¬ß=%lC[yF$ŸçóŠTî´ì§ØFƒÂN¸ð@¶N}…fSUBK^I—ÝßRæÌüΧ€°ˆ ÍIKÇ3V᛽AN&ÖóBÉB÷E{YëöÛ„šPt,wU'çz31ËÚC¡%ëîP­xr¨¢V”ǯcéhŸo,,e‘ºê¬_+·‘´å0LÀÇø]kx_NÆ&ÿ›ôu¿†¦°ó¥PŒ™ apü“Òb¥k¶4 C8|;àâ‹qëÙL½ËC»ù‹;G‰£U8‘Ú?Í¢ÑYq?=ÜÏò¢gª™nïi›WôèL##W×9óܤál¦M×6s¾ß/±§6Ç%{¨6ÖM×2½p¯m˜m&â§%t5[ßv&Ûµ±Î”m>Ë–»¯X±lÉ\Sušk¨ßf[içÛ;¯~ŽmÆ…ì·1Qè%~v˜ÉdD®Ø6\ꦔ;ƒëÒöà´™ÚÔÀjlÛPµ³[ˆEæSµRｑeO+æ°¾ó¾B^¬ãh±ŒMÝäÛbþ<'6UÏvIo”mBŒ´f)ô?ŽS§‹h"¦»¿¨—jEkÍ1cµ"jEg‚—rõ,n+ôcå†èÿª½Äd#Æê¼ùë‹&%þâ á_÷¹Ìa8y,‹ÅpO槶M˜®©»»`DCD|‰´î(Ûü6h›3lc>–m^ûêÓÍWl.¯¾Ss§ZwjîÖÜ»ÿ¨_<ŽmÚßÕ6’¥·d;|¯fSÜ)QÙUª¡1GÑ6¿´—øçÛÆ8¬wðóÓŸc›Ô;˜üǽ®;eªúý¶;ïb›EÛ$a›V/®–•WDµlCÛâ.±->á‰Ç²ÍÞ¡&âãX¹m°Ë¤mt‡ÛFR+î O“¶±,U°ÍÉ ½_Ç68ù¼,±´•ôXY½²ÒdÑדø_|Ý1å{ÑË‘çãb$†‡÷}Z°s« iö+žöbò–T_ãƒû­âû‡‰œ™šY#<ö?Ê`L×É%jZK愶¹K^J%:²€ÁZ´µG„ËOZà¾@,=>±mB&jIIòõ®ëZS̃¯ˆGœ“"ôx=@í#Ùf‚–Ôð3à£lóLºòcµ¤Öl?=Ø’j¹Ïú‘yðú¶å¸hqVE p4´-x|ù¶Øff`§‚mxcد;F´¤2î†Ú×d­8ÝnǬ%ZRyC-)áÞ93~–”t£c8ê ß9ð;¥/¾9©çËÉ¢/~ß«¤$º[*‰ù˜d°Í'…WA™FË«—µÑ®›6E?PÊËËfZš CŽÈ'lß鬩åË—öc›Aš?˜Kû »Š·iMgÇ\)_XÃÖÕ.¾)U8š0·±40Û(ßa±—uå·î<ì%¾Óã…‰«)ê”Û’ê¬x×µÃQó-h4;ßW"…–Ôí7o¯¯?/·ñºªoß¼ßÊ[n3¶m’—R5Ýš†rsc«Ù•=-§uµڶ˛d%‚ï_Íšn´© }Û W›4gh'–ÊK »nãr— œZ\Öoc£käÝ5mˆTæŠ9Q+‚k…–ÖÜ¢x¥±ZF@æmÙì‹wè¨Lûè½Ä²ç›“ˆz»»¨ô¯”°/¾z£¤ÔenÍ›¬ÄSRzjiIø!‘Ü@7ñ§Cº‹Ý>G›®nh7×ÕšCcjû¤]“Žm= CÕ0™ãà¿Î†Ëäš;æ×KŽ~Í™TSÑ6ç÷˜«šDH÷¯®†s³ª ãÙîÁÙ$>ì¢ÃÔ°p]¶ÁÓ}&[i¸´Lzñ†x`ç:.{N–‚m§kJúmàtÈr‹f9ËÖçP#±[fÏeiÌZñ¬Wü–ß!¼»ŒËa0©j m]c=*…¢Éå2-‡6ôÊ¢þKå ]Sccý¡0Ò6›½µmdn3uãå l3ÎðÂËÃmÃ`зKls÷l´!KSoæìåñ7ˆÕ>°ˆÉ¢YÛÚn<Ú‚^žÕåÒæ/Þ ohåå·aÁL&m¸çÒ}4þð'{Õ©Ü,Û˜MÑL®´Mùæ·^W$¥€óÓüu˜š6óW¬_·ØŒ¥Æ2^U-“¥ð|¤›Eµ°±õ:Ðp"ÒXÓ:^Ñ6jí¬B™#[Ï+Ô m¢V8\}"͉„GVéÒ(Z–®‹–¹Z°´†DÌV³Šãôôœ|±a‚ÒÒ¥IØäÉýJJ¯¬Í»sOô=Y¨ôû—JJâ;UDæÃ#¦‚äæÓúFzußí+Gdås¹¸]¨Õ <»t‚,ð‚G=ËNì?]=t¦®³*gÿÉU|ƒµ¢jd­¨È?}ð@öáçë{Pkí¹ì“å;·!ù|P¬7&~@‰h=}ÑAc ÎNþ³×ú“pò$á¤I­ŽDIŠEBÈl>åŒÑ'2á7Ft§Œ¸»vŒÛFvâ¾m‘øx#Þ5·~ç9ào¹/Ÿ()Äûâ–:ì¬{· rØoË”ôoθ‡ÿ¼¿C™âccð1§Âþnó/MÀÍš‹aò¨†?õX))õ~ýUkê.œ‡aHüÆuþå—ø¤¯S¾6·`"LŒ‹aw~sˆ{[3ÒNô|À}k˜m†v&~Ç“šêêšš;cDíòöÿÅHr?òÙçd %VRêúãàm/ÅÔ`=]­_=ðõ$Þ$¥¾íQË‹ ê¿É/ôö#ͧ˜Tß”Úó«?ꨮ¡Ádhš®ÕµÇ}ÿÛ³rò1}äsúDUw~ó­îK ñ%×ÞÛf`«Û?+‰&O~ú§oà]™0RZ8Ž~ŽËþWï?’~1Âú‰?ùýèöMœÿZ(&ßõBʆ‡õ^éùÃïD“¿îSRBmà~qŽ‰c†‹äInဘ“ïwÁ1±@@¾AŠ'z9C“7ùw]JJ¼Û7 Äøe`drÁÅäå4"!ùäs¡äeu.è ÅbQÏá"±iSRÂWÂ9)~qC “¼KŠ”Žä¡’ÔIcC:Hú(¥ç?ª¼fP‘°ÎHð>ÆÁ®*ý¡pYùúï†&üe#^'ÀGt‘¬Ÿ“]ðº>.øÐîò—ñ)Œù™wߌ§ 0éµ€˜Ô5<„ $ü”€˜Ûˆ‰ø qñ'&F/ø¯ñÊyBÂ!·àƒÁ—<¡Xú®—.ôrÿó]Û—m|äðb LÀ‡Il¤K—<öýøE^ûáà{î[fù·Ø¬}êüˆW¹ Ê6ù,TÓy3²ÁïaΆF'ï–¹[šço}dû¤ÿÙð®:‘?ÀèÙŠ²ÓM²1„jD…>5ΛŸÙû5ÎÞÜ<{kƒÓ¦GΗ^Äp¹ ŠX ÄÅò×FáäÃoF¾“óp^VsäúúY›ž8ú7Ùol¶}¸0¿ã õK½ô¶'âŒã‹ÄH€ ^:ƒãbò¹ç’<ßáÝhÐà¼þÅ,¿û®ù/Oöà˜XD>‡kmøYm)Tôæ§üŽƒ˜¼MD¦6"ÄÃ’[‚üZìüŸ:ú6ÛE=õ|Ø_‰a&„ÉÛ]8<Œ€ŸCÀ½¹œøˆ/MT0¢U…ãyoø49nj²ò2gßã ž¨‹Ìy0iV#Äáu½ü|¶öšâþ„ßh%Ç?Ä»´>^9„׸{×[µ¡Gù.^ìqÿ}¿çõöþÏ퓆 Ѐä៴ÿ˜he‘Q‡]ë7ÛpÆÅ‚–úÆ÷Û„¢îë[G?³ºîr„Ê_§ì{Ò¾HŸÂœó˜¨Q­iHIix|}Qc·BUÆQcò´C_˧ùT´ï4z#{u¹l²îf¶ýûWòùü¹lBäQ•ÅŽZÊ`LÜ>Jù÷ÿÚXÒ]˜8oÚßu ÆûiX™×~¯wõq瘥‡ñº?~*}w6.â5=iâ}~Û4ccªáî÷\±¾+‹ÿïô™eÏ?ðÛ÷bîúz7Z–ôæ!1âáýO–ny<×·Ñ!®a†ú%m&lT0øæ7*4ðªÚ–fyç½Þ€Š×&¬`šl½C¾i*˜§gÑŒU䆙,i"½Ì!wù˜sèÖMtã&*ºŽNÆ£SBÿ¢KÞf'­H§#ЕÐTQÊqTP€®\D[æ‘ßš¡ør#õ#ýAJÓÑ èv*-A¹ è/Jè/&ä|úZÑõk¨°]»Žâ}Éïn=‡nH†ÜÂ:êüæX‡Vô¼¬ÈšÉ´»%×6U›¦Q,¯ÕwYz­EéLšûSÉÇÞæbsªí½Ï`›òÚîΦϬʆ6Ò²ÙË¿Ùözü@w¬líÿ°k{°1z}£ÕáæLâï”Fß öõÛWw‹Ûˆ\†¼àNsÚ¼Çz»:ÚÚÚÚÛ»ûx¸üob´×û¦½ó¦s€/’í½¢~bJžã÷u··½&F’ß’lAQßÃ[©U›¢—]½ýò™wwHfÒÙÝ'–Í|GoW[{ñ;Ée·utv $ÝuüΧûÖ9éYÔwvw È/ t¶·½é¥æ¥¶ ʈ¤§n¯‘mTï m®¶ ËË%> ÿæ=FÿG }c%ë lUÝÜNNã*ûb[6ùñâ3ù4’‰žG¿û iVf7ÒÉ)w úqq’ÿâ³­|ôºÈÂÒ¯U2´¯ãu{÷ÀÛls½¡KØ×ÕNyG/O¶ º;.¥ù3îw»úÚÛ;k ÷²ÔìKÚº»úˆeôÅE”ˆ'Ý"oºzDï°×ྶö¾H<ÐÓÙFl¬Ž7¢øp^/ù±½£“'†E¸˜¬ ÒÕÓÉ·éãÒt®ŠõõÖ7ä6•Û†Èmz:ÉI;ÞtñÅCeO¤dÝÒÚÔÑÓÇÇZN‚þÉÌÛ{…Ç6ªæ{7X§>Þ\üæêƧv~süš[°{DªƒËN@k>eüÎéHG#-†Žž>SMÛr^vQ½tlOUÎRC¦Žƒ½µ•f·lSù‹^ɾœ0CM342~Û‚5ëVºšSÙæ ÎKÖÏN„ÛZé0hLû¹.ëSÎCÊOî˜cBÓ6™io©Ëfùì½";Ý(êY¢N]~*%hñŠÕ«VΟEÓ6ô>Cäùözº .[ÏÑÑ)¾–Øa©¶ªS´ô`½O+÷*&jUunjN™da©Ûï£ÿRBÉéHéO¨¶Xô¿*Hé¿Ñ+ɇ×Yä|Rëºzð±{xF؆)hÍI?Ò+ÆŸW]H¹Ò(m(„³ÿmÚâ´1m31ëdÖö9fV–†ôéß›:x•Jš}÷b—š³Y ®“›ëÒÅnÖÚ Ëaî\ßì|„ñ#ÝÕ4Ü2÷nš·dÙ²enÖ ]“Íqg&ì÷¸»ã5FTØöK–{®te«Q\·¦><9ßmÑ:…¦LUG¿|ù,:æhDÕ5³˜m¡ÍÑ6õM)"¾8µ}p›ú$žÆ$¶¡:'ŸŒYaeif¦ÏФsÖl; +ŽöšO7=Õf¶¥!Ûh–Kìé©æ;«NÕ‰Áâ:ØÛÚÎY•»‰2óÃÚ†<¹Ô"¬õn°Š¬[Ñàî×äì÷dnYo>"/÷c’—½@jó)y¾_ïGÍ€ÜûÒOWBgN£/~DªúËY´Ykwõ˶Mƒ¯á4Æò,òSs&FaØm|)ëXé°šÊõΓÍïF ¦²}­ä[¦ýÓ”½ŽÈfþ¬$ÙXë{ß¼7äñ@”·‡EÝ“×,[²ÍVÃÈ©ê9a½;=, ¬Czd«(~tùøÁ³…}B|ø®/ùï0ÛÈëѳÛèJhÞuòo¦ú›#â‹Ç¨d%Þ~—‡Ø_—ìDÏ:‘PHVÏ1û1Gæ6øˆæ¿ô§Wý”sìÚÃ1m£ª¦Î´ð}")=þ«bÖw–5Ò±—“—P«^Hþ~rÙ_SuŽt8Æñ6`3µÂN5H§¼¿@3óBÝ› ¶ï“xMMMÝe1Òæ]o¡·¦š²–e¨4]{^–¢3š%i¹õ=LÓ¦â{ZjKôør´Ö´mùäFxY²MSyö]y?ÚPsƒºjGž¤¹Œ]v£éš\¨ëC˜0+p›mvIÚD¼Cë¬(Fv·[ #p©¡®áÒ‡’˜¸%ßZ—IÑ›óas C¯°Ÿz¿ËÍ®!]ÓÚÂÄ’K‰Iψ%O›×|:®ûšhÎZþ¬“&:ÂÞ†cYk»±æÜH6‹šTÜ;˜=ÈóÓšf|µ¡Â6ôÀì¢Á]íìcóÝÒfÃÓ¢­„mj$1σ­å²E¡£/h¾±™óŽn©m¼ô8†Þ­òT\F41Ì/?è@âî«gXw:ñ1FM‘Úæ¶ÂBºÑrRú3zDè¢ýM q—"áX•ìu ùÝ€Ù¬_ÝEkœÈ¾bàïÿ™8¢}è%oÂÜfŒ”ñíçmÈÜF…“RÑ*+Xaw;Cgþaé®|1‘°ÍÊgÒýý’a›ûC¶ÑarÝ׆_`1CcË©Ê m£¡ÅŠ9[#ûVÏÓï§mÈ)ýÅ}Í·ßn("»”J]´Sá›>³õlÝã ¼¸¤©lwg°ß&Ԕʚÿ`pƒÜÙ©FÕ=pã¹x yµþ·V»k‡J¬ý¸îtJ䥢¶*7ö·ór^ Ž*˜9ƒëüam#±ñ‹õõvžÚø5:=ZÈCò ,½a .þ”tGÚê™,ñoH·Åàv_Ù»‘ÃÔ¹Ð6´—?¯:d¨:=Š¨dO³htVÜ™G¸üŠÍ¼hs5Óí=#mÓ`Dg[ÍÞ¸e[ÁÛ6Í5×3´^ø˜'±§6gN¦ppû×M×2½p¯}˜m&Dj›/‡¾úJ_NFJ_¡ä›²¾ß)Jˆº ƺ‚ëå5ò»á:ˆt[€žÝE{üÑ”h‡‚†wÛLl4a/±EA}çÿoïÞƒš¸8€sôìÌýuw¹¹¹›^o:¼Aò•‡b%$$<Ä" Á( ¢rˆXP@¥PÀžµhµ/zT‹¶>–SQg@$"L²Ùß%!/ `èe昻ïgøMv÷·ûÛ|w6Êïtdĸ,+½6m]Y%"MYŸÆ:˜rŠ^Ÿ6vneÿìR.%¼îó®mñOÓkvÝ vúk’üÂO^n㜮ª¬ƒRØ+]½9±=’i#ï·ÉWWÜ£“ÖK——×+~ÞàonœúØÖGº=ÊÖ4¼ìöD÷o ÓÌJý’àJ´‰£¡ûm(" øÉí ^{÷cV;ÕJDMïÆŸþˆÓýÝ}¢ö=O{(+uíd’ó2Ïo†µ†Kš/¬^ünFË´´!³§ ?ÙÝaÅzv7-·_ñ“–q0ýÈñ‚^uÚ„”‰ÕeùOÒfC2Iç.—pyäD1y8¢Ù›àßEîDHMŸ#¿(ÿM¾ìñiw&ZÁR@~mD¼Ê 6ZcRú§M‚³ch%¥ùÈt',3 ©ž(ÕU›`eçUwzÑãgá_«,½´;u³µ{°¡ûm(‘düðƒm¹m»í* žk¾Àr£Ü=}ãÓg¦D¯u·eî«P$õýÉ°%6NÛyÇ>*-ܸÌÞ©øºâÜž3m†~.÷´ZÌŠã-ýB,ÌŠps^µvW扒Sî]m¹xueÛØkÒ†L”&;ºx$¦¦å}Ù';‰ªã|6§öQóOEŸ·‡7‰Ñ¯ˆ±q_I\ìÉÛoÉ—Ú_C(Õ{$|²úOÄh±´#ÌÌ vòf”E(y)ÒÊÔ+mÆ‹Â\ýeëŸgÚܪâ:Û9nJæ­iã7ŸYa½„½ƒ—]^OÑ¢ÜD7'æž-ëç.:Îez.q/¹{üuo½ÓF:ѳŸãìê³>%+·¸ g;ÇËÂÚ¯¦]~72ü¯J/++f,÷è¹ÏEôìiChþÍ3.Ö‹[‹Î=΋÷¶7a¦ž•?ñW9›¬m—EìHÍ;‘%Û‹½‡B­ Ü’’ϧ¡¤Ý¢Ãü©6ò[h|ÀEÇ05r©Áf…¼ä£/ǵf÷=¨/Mˆ b2£“|Ó&PžÙ}Ÿ²9!ßvªÓæzÙQ%ÊÎAÉØ?²ãB‚YÛsªåÓÏ(AÝéŒÈ€ cû¾cÍÏDÊêÕ¹¬ ¡É—4“Žäû3£n´+.ŒüÆ”HÙfÙG¾æË‚ .e#;áЀP×mþÐgä­wÈ­á9vQùK]ñs!¦fÄ܆Dì!OÆ´^lvIÉùcÄו˜™Ssâ@J®i½ª¾á©!Æ$W_Îy`'J#=œ9×óøè³EÅ ?¬:~Yç¾O9ÊSílVö‡}2Ç u„ÖÞÜôƒLÏZ±³¼mJ¹tUœŽ•¨ßF¿.%๚ôÉ=†º²ªÓfúê¤âñY _‰ñä€ÿõæ)MöÂ-K›ìhK³€òéë{T¼ÒÓËÏwÕÌßUn‰g;Pð [»ôü0ƒgEÀÿÊâ. endstream endobj 967 0 obj << /Type /XObject /Subtype /Image /Width 265 /Height 43 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 4527 /Filter /FlateDecode >> stream xÚíZTUÇÖ¾*jÚ‹)ÿ‹Æäåeýyb‰Jo"MŠô&‚ˆ‚0ü‚Q©±`‰ˆåi$‰†DÄŽ€ô¢"¨ ])Š©n=ß;çÜÑĵâû×ùÜ{Ι93s÷Þßì={`À€ 0`À€ 0`À€ 0`À€ƒBòMH® É­BùH̓?É7‰?3®¡ âO5¨´eùŸÌà¿ÀZ%j#ˆ‘U<¬µÏa*ĦŒÐÅHã!ˆ`n ½Ï7˜Z*\ƒ/ꊢâÏá)$—u"§~Å! '%ã“»&¤Ú éH¾»ÿZâ/‚ ø<—ÇåJ¨wð…BBÈç ýºƒø½8þ-V¬C )X· +·áa÷óy ‚ƒ«»±È;N¾0¯Qzþ>ðF/wð`y²<qD5‹wÁÛ¾{ªH¼¤Ü¹<¾œ”¨¡PH*ƒ' o˜B—T"ùþÐ ¤z ™R&ÛáñxT}JÛ$ƒbÍÒÊWf8BŠç±Þùô›Ô éa 臈¬Î§Z%ˆ—"ZŸ] %¿Šòq³5·°075µwó‰:”p»¾KªÛþ–«‹ŒÍmlæ[YÍ—‡¹ó±ëì›±®¶æd‰•••µ£³““5]jeeaeíW!PœÈºkñ1 ¯|„Ú.ÜÚƒ½f¡üñs¾j`± ¹ø… $É £Xxõ ´ô+·ðFüš„ÎçŠNÒCeé+s×½¿~ÿí’€˜:BAGÝ ;ã-éP—älkm%’»µ“³‹=}GþÛ8¯Ê®¯‰ûÆÒÌÜŠ‚µƒ“‹ƒ­HIV†ºÖ'JZ';–/qp°·ÁÆÖÊÒÂÓokbVIŸxŠ§†ÁiÌ]»fuRùÓ èn<³“©ÍþÜ:2—!¶™7÷­²%{µuXõÝÞÂ]¤TÚëC=þpµ‚/’!ÿ[‰» ;œlªMd/17‰ÆŸ_m«£aä²ëø锫éWÓRNÅEÌÓøÊÀÑ· ¾´û`77ž:kmÜéëÙ™2¤gæÖµs5yYéämnAvÜZ7¹O¡Š322²‹º ÈMìÒ¡2Û¢½OPUÊzpùÏ«‹.û°seo+åºAA‘²à`ð…Ü+VáUÞÒFk¿ò@ë”XcQÐuÕ¹ô=ÌÍÉ<ëÌÑ(mµ•Òòs³Háfæ>îí­)ÊLOÏÈÌʺôó~í/<‚7dijjv=ÅâÖ@sS÷5—3sIääæd¤œZã0CcÞKIËE{÷.puXYÁvUf¬w0™ç²@ºfhj¥`ˆÑˆ¸$x°Å^ËhIXZÞõëYç·ùXšºÜëçƒÛöcÀ¼yA§Ÿp¡wÑ[y¼žŽþ/wxOáÅ‹ 'ÿì2ƒû¤*ØÃ@ÓÒ?§ª]¾¬ëÞy{‡à_ D·$5LT5ö5Œ¦íX­kfWøX ·IxAª"?£Y0Û rÚê~€Œ¤ ‡î¤]Bj1U«á.R®àj.UG¤ š¡h"Ÿ'#-mØc$G ‘<Ù(Χ^LËDC¸÷Š\NFÎMI5ÒSœŒ’æÁQ“”ý(¿AÕÉ..âõ"ÿ¦3ÿë8z y·Àá¢ä*.¤¢¾œ6d¦ -4§º›žŠÔ,tóŸ‘–ʨáª1uõ¹òÛK/ZhÍ ¹¦\쪼e:SÖžº£hTmæÙøGõÉ?e×n±P3Z¾ãI¿H/§£ÝÖŸ$Å“ðÍ÷§«ë®¹ÎÖJ É„sÿ´ïZ òDOûkÓÜÌçlû¥Œ¬Px*ÔØЯ¢ö­¼îòÛ×Ê{:›« ®Ýèé«ýÆP+ðH¾@ì~„mõE7+I×6Py« ;'·ønMŸ@b0ÏÑÿ~ö­éz{Ò*Å#Ç¿ÅÙ]]8Ô¤¨1U}g~ýˆ$¿µR×Ô6·¡_i—däŒ}n”l8HMX×£ñÞ(¼¡ŠŠ.Ü Á[,¨8#e>| £U0öUÌtDŸÄò3öàã¿cô(êuUC¬Ñ’QƒDßm¸àõqtè2ŸÌDb)õüJ$^cáÍqí!5€¼8¼9¯¾K5ʽÆìôÇc1z ÆO€k I&´•R±Kò÷w-<ì€÷Û`½ ÿX®ƒ1£1vŒ×ãá=˜| ¨ŒÃgžèÿÃÔÈrD ‹ÎXhÍÚ–ÃUªÒβLoÕ5' ¹ÂÁÔ°öx•.ÉoaÎ6“éÍTS‚Ö²`ë™Áço‘ïõ´µ³TK¡Ël­!Ôh¹ï˜»Ž±_d+G¼`ò[#}l#g‘ò¤%–ºÇ‹è¹ûÖJ'M— Ç—ÙšZÚ'Wm77]»—Í5ÅK‹±ÒñØùk˜—çÊ ý<Œ7î9Ûý—{ ºïœÞÓŒ×6pD” HJ µÐK¹ õu2ÔÖÜoj£o²ÚÃRCTGÐoS°Æcßeê–¤Æÿ뎩5j"ñi?“ñî$xo€».ÆÐv¸î-ä|ùX£0Ë®`£Æ‘£F <èx~î2ÞE¬/õîĹhaSnÂK›*2ÚNÌ>¤®—ÅÒ¿V¨ÄkŒžˆ¦ã› ˜|Fy7Ö»H«¿£iV¾‚˜\» nü&¥‚×?„¥3œ 1Ž¬ü&¦N„™;¼ Ń-™^ómÌ~p¿¦Z†¢«gÔUÿ5â•Qcu¸"58 Þj®!m=THÕ\o4Û9­¼]ºèz¤œ’8¼q¾ö¢­‡{±ÍÂS›<æ®Üv—r#õ¡+ì~È¡í掟§©†á“9•l6›O€S«©¿¼¡—G·ÄÏŒµ6Û8ðø U›Ÿw$@ÝÔëR÷¯LrKúM tSwÛV& ¦:Ïݺ-:¾TÓgÍüj†<¦«jÛom$ÃÊgô”Nš`1*ÿ™F15Þ•£ÆÛ´9EfÒbëmƦk©Û¢ß ÂÂø÷‘xŸÐCX~ £FñY¼9o|‚ÜqoF©Ò³´kà7@lyæèR?ó_Y¢IDñ¯áÜ=ªÇ– |ô:EƸ«tÐG¹Ößpƒž…í𣻘íªÏzO¡n'»¢™œg0§KuwŽHc[—iÌš9ý3y|>틳§«ú¾ jØ­Ý-÷LPø{”‰šºoÌEjBpò÷yj{…T÷ÊÔ85ÄòâVyië.‹gËrÒü Á‹u½‹¨Ì ²wú¹}ó} )äþ¿EF–îa­ª©ïp"³ùeØ|»¸Õc¦CPÉc©äšƒ½›ššš™ÌÕûR{YPJ õèlrþäÈ0Àáˆs³Ïì5Znb ÿÐB†¡Æ[¨¤åKð°Þ„žíWP¡Wêv:’™‚{"÷a‡Ü2üÊ>Œ¥È˜1Ôψ"ÿTqï5—ñýäµÏQÏóB)5&ÌÀ#‘Îë0m2õÊîd:ˆÈSãúCj¸FŠ´ =êÖ#Ž ÀHl˜AÝÎ z–€Ê|éæ²~¹RÉòÛ*ÓÉeø òæÚ:z†bÌkhh`0Çþëƒ-¢Tzÿ£0›ÕÑç8r9¥¨Á«õÖÒñù±OF ^ÒOý¥›oÑ&ßu+nŽƒ_Á8%~îúŽëú„Ò ^x4pžeØu 5lµ¿§m…ªÑVzBKßþøÕ/Cò¶ô— ŸÏr½RÑ. ¨dÖò¸ t¦šwµ”SÕwÔ¿;òlÔ¸„ñ,¨¹Š*¡ÆdÔu‹©±ÁLF+!ÔõDUT‹ÄÈFŒ±ŒÉ15Þ|ßÅàÈ!ÄÅáÐ!<€Ô:qGÎão45&|ŠREjHG¯¡¢Öa˜F;¦˜§RÃ=F4cMÇÄ+÷€¯¨Û™›Ÿq­Q¥`Ïh¯ÊqÕxQÔ˜gê¶:)95-•BZzÖ­ÊF¾ä—÷ÝO·³µß—Õ#¿˜! Bë6S-§ ýBq@%öþz¡¥d ýBWÕr#Ëý™Õà•ù¹ë9m8Ó/”dl ¢ðçP=£u Rj8}/µ•—‚’Ômkmš«æ4§¨ä¾Ü–(-¡¦œAÔP² ²ªœÒâË”‘Øìzj¬$íyG¨ë×ÿ‰4*N­<>–Q#ïÆ“aÿÿ"E’CãqÁå‰óZè„*Í‹9:ÔçÇÎï.”T*KÞþ!j,—Pcã—ÏE‘3Tf­áÑɲIO˦òâ{Ÿ"®Â$¡„Š{ÛYs5ܾkîŠ$,`W­_hé‘ÄUät[gj¾ý’` ‚ôbjˆmŽ`ßMœk Wö²RC:Ýóû.íY­þ¥æÿýØÐ#Íù÷ÝÎøu‹¾šm`«t­1UcoqËÓvÕGö|:ã:Áwž¤Ù4ÝÀ?FQË^×@ÔÞÇÉ0¨ÐÔš=åОDÝZoDõCÜIÄôbÒl“ë.üèe¸á·d=½OÏ퇨ñÔ^‚Á'øDY•#Scà•ø"ÿ¶œÆÃpÛ^JjLŽ¢e¸âv/EøÓ»|œ¾þ…PÔ"¯»dÁl­ðìòæ tçç–=¢âÅÞÊx£Ú»’+DÅeIÑ&ñ·;%âåܪaðmÓã2)5$¯v•‰ÿîâ¦ÊãñÞXê‰ÊXzzgÁy;I äÂXr‰1 yí”EÄâÕÑxeò›P} ‘ NÀùÛrÔÐ’£Æd5HZ}J»žQ£0qî?‚ï{O¥Æ 9j<…‡7-6_ºePìB%oÕTW ¢ÆÍ3æš_m–Kµ¦ø+Iޚ͗d¨AØUá2;ðÂ= %êö­Xàæîæj§§­edã¸ÐÝÍÉqyV >2‘ç¢ùù’ŸEûAÜÔƒku5uÌ绺9˜ijèl8˜ÂÈíñßL\ §‘p=‡¾ãz15¤‹™ì3ÓáíHjh:ÊSãG-}»—ÀkHö0hŸØÛXòûñبˆðððÈÿ>Up¯M>øä>¹³3hkÄöˆð„†„ÇŸ£ ]"øÚËñ‘»öWw𔤦¹O°Ö «6£W ~¡.«=á„Gýh½ ÿÅp\6z#‰à#a7¼—bG<$Õ‘¸KÃwŠqóg8º!ô¨ì_O5¢©W–û#A¼Y‰K±x1B%¿†‡¨ðX‚°³è.Å:O,ôÇ: »ó–y`Yz¸twíز‹– ¥TÜ=»_{cÉRDÿ„¾>ü´Ž^8,Zé qt;\ìq""#ÿ=K"ä u}3žX¾{ð–>u=}úß1Ç“ Îö´T úév;!;m®ûÅ1!窔ž ØÍ÷ŽG,¨ç åt'î۽溜l¾’}´þ¶ò¸àè’–N±²xM ‡wÒùɈ푑Û)cÛ¶9²¨ƒO–²;jbÿ;V u ²¬3»·‡†Eí½p­Z0hç›SÿK\ÄÙÌ›?‰ŠM(æ 6Àú«¶ì:ÑÊÜËØ›Ì%Ä'Gzšò#¢~È«èðrœ²fó‘¬=F%¡ü4&1ìž¹²†;Î'¹%žZYÙ)¸çkdp›ÃGÉž:øaj*ŠVáxáৄâ‘å!ƒQÚÐ Õ QÈàƒŽF:¿ñ”ʲ£ªP^JÈÞUj?Cº 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`Ààÿþ;Ý‘ endstream endobj 979 0 obj << /Length 885 /Filter /FlateDecode >> stream xÚ•VÉnÜ8½ë+ä¢"š;E“8Ë%q:È! ºE»…Ñf-hûïS%÷&=—Y*_½ªzj‚A7Ñ?ëèê=WÈ`£˜Bë{ĵÂRH¤EŠ…áh¡Ÿñ·¡Í7¶·«„é4þÞ¹6¬n†F,åX†8†a-}0É4fÒǺúXj‚þ­áHHÌ$æ=‰Áœ¦!§wO¶l U’¸¾Ï~;š¡mênÿ²¸z¯ØAqýãUÂÒ¼´îú:l|ø俬܊Êøyç—u›uW­õ†ñ^ÜT#ßS¸–`¦¸§UQÔƒgÆÛ›P}J±‘’yœ%œãTM`|ÝëªwUâN…8I1e8´ø‚é ]ÇOâ)è£g×…¬¡,‚Ç[Û…E¨,F¯'»éö³åüâ~Åd|ïæ7‡' *è2-J»\V t 6;ΡË:ËÂ`V¤ŒñÂ5š`ÉØ匨Ù5ŸÐÛðÈ\Óº$´”` +ß$ÔtÂe{—…VþE$±E¿­‡‡m°t}^Órhšº_ð¢Á42nŸ§é¨Ã³´ýf>ݸ͘æÆÅäf«é²ºšMuu2_­{\ׇÍ÷Ûaq·b$¦Zíyó v8"§£{N-ˆ—ÚwЫÔJƒµVG“ôê@k8TÊ ŒVpzÒúŠÖ0!AâÔ~"F°Y>'çªÍd»sýιj! £0KÓËÚÓuñü/55Nµ¾´Û˜ÒGÝvX»î¹êíÓS:™ª”ô+ÈŸ‚âñ½,³@ø¦bbUÊ@ªÒÔgòä¯jhˆ °~lo*c0@?·9h߸­œ§xç7,n‡ÂuþãÄLœ÷Á6&Ž­ÛÔeéªlæÕÀöójI•0TⲂq. ìHÆý  †nFÑZ¸½}ATíŽã´‡‰>G˜0(€1âxþÿG±ÄIÿé§\Šñø…_òóÿB€¸QîXÁçOAžÖë/áÄggÆÄ<&ÿ›u£4©°Ù«¨Ô§hÿFw5ò endstream endobj 968 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 257 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 21026 /Filter /FlateDecode >> stream xÚì½@ɺïË„}ö ÷ž{ÞyïžwòÞsÎݳ1‘Y‘œsN**ˆ •Œ€€¢¢AÁœsFQ0*’sÎ9ç»n‡µÈ qÆ=gÿ©™éUtWWWwýúû¾î®B@ @ @ @ @ @ @ @ š- à@ Ð/ »÷þAQSËÁ¤%•4íÝeeå ‡þštæì¹õûÎ$ H–TJÊCÿøÿýôÐ_mÖ§r> H–TJx'Úm AÚ€€6€6   $H@  ÐÒÒ¤² }ÿþýû¦éرcÐg6 }vÚЙìé´Ù»w/þ_è³@H€6   $  h Ðh д´m AÚ€€6€6   $H@  $H@Ðд hÚL¦Ô2tº|*¥Oý)1K*"2‰e2®@)ù3VH.F§Ëð¢œÔB"gö.ðœ<”Z2½|,ñÃŒBRKÑéÒ©mñ…”’iµ*C)…d9@  Ðæ‹Mx¿¶ÕRSTT «(ÓU””VÿQÝÄÕ÷ÖPRñפBä¾FIA^>ìGDòû.3ö÷V¡ù.r‰îŸ\,r2WÔÞ|•óAhÉ¢YÅ&çÍ.?¥ç½w¿Ž]nå ùå?¨oØv¢ ¹M'¹3ÑX!Ïv‰/™ÊܲÑQQQ¯MIVAfääp«]"Ðh´ùbiãh¤oSp®*%¬ˆà0oš¬VDÄÉ,¢3 |¶ië†$‘=ýØû* í#9bû$,z¿²–ë Ü\ÉÚjkÙÆ•Ì¢ §mßdÁÒuºÛO*‡’Ψ3V:Dä&‹-tòb”ŠYø: ¹õ§G& ˜í[6y]8WN•¡S…<Ÿ}! Y9Ï«=ø~6@ Í—K«ˆœ”<ê'ž&´Ô”üoàîϾ£!š–a‰/2˜ †ÑoI_¦¸1Ìãp›äC‹>}ÅÖ³ƒD¾Ú$?¹B[EÛ“9ÝKBQñò4‡‰ÛµÖÜÀéXᾈ}Z6ûˆÍsÅ´1t?5éµádÛíãF3I.Ûh´ùâiCõýÄ÷šl… {£)E¶ìÖ_â'æ õµY—Z“(ew©3˜»î oq²Ñó¸”Z@™(óÓf¿“²elÊLD¤¶ëÊýàrƒØ]Rn³†Š\h&JzþNEQ/\²Î,Úà&MJÆ}åšr6@ ÍLëè¼3¥dü6»{½­¶’FÀ‰<wþ´¢†sB!ÑÓ;ÒìÏ$!Ê‘‰»uŠ¥ªES´+ ÞJ¡×fGÕíçR gd¦ómTÿèx¢_Ûc£bww¸’ Ñ®µÊþ¥‰óÓ¥¾/b¯Pò ´Úm¾\Ú2TÕÕ5´Ô4´ÔuÍÖ]?–ƒáÝëv+ ã5.»#7úE¸x{0䃞naåŠLµ5⊧Ø"…6¡ÞN*6ÇgÛ6E½òËœ¯Š8ïƵÕ؆®!Î~ý¢ײ5­H|ͦM.–òìŽÒJ­0ˆm€6¿ ÛOÉùD×NͭДWvŽ¼íu…L×-Môì>O‡w„:N‰å¡ îõÜ?§²Jmï«q›ã“”¬¢ Ðñ‡·˜*†;¢®Q{ñŒ:«¥ÂôzÂçä͉Ûä!ßmt˽¤}´Úm¾ø(1!Á}™ýÁ;U¬O…dsQlÂ~u÷øbòÅ›ùi£i_uºw”ÈT$~†î²NOÃ|wxÆE³cò µ•lö¥§`»liš^¹œÉBòÑ>_c¦íÅÄ|’6žçΔåàŽXXʶ‚üÎsíðL h´ùriã ¯cž’7ã±µ‰¡ÒÆ£…IÓºvJñíÿl:;LÙ6暪ëʦÓÆFC]…Î`IÄVÓ‹ÍfRѸ‹‹ƒ*CQII…®°’©®o¿÷Ž£„Œ%%ÖþׂI€à;ù<ŸAS…¶¹n 1YêZ:êšJrrêzf;εໃ÷m€6@›/7%‘3MO½œK¼¹—\HfÎä±f>á ¶gn•H–ƒo5• ÄùTßÊOÊ'CÍdæÔ:³ŠÈ$CÊ“ëSEo»Ä@  $H@Ðд h´ hÚ@Úm€6 m@@H@Ð$  Ð$  h h´Ú@‚´m m@@›Å\r(¾ð× @ Íç¥M9™ŠÉ/—ËÈåR2ŸZ.#óK$«áùEˆSA.çãæ Äx/ÄØ/å(¾ýÓ¿u®PéúQéËNË•[5NC€6@›ÏD›û­œßkqþCc·S8ÿ­G,³7$YiE,/3áÔ ŽÆfbùßÕ8χ8»‰åÿÐà"ÎÁ;D濲9±Ï9·ðüÄßiÕÿ×êØj„÷Ó/:¯@}ßýp²´Ú|&Ú$fsdm8Ñéœ'Ý„}r¦€õ˜s­† Í¥2NÔÎÅR"ÿ^ çh:'ù=‘ÿ¤‡ù˜sò5±ùëqNÌ3NÜsN—“ÃçÄd$yÔùÝò_A'Å=)  Ðô™i£èð9¯·ëµÝ¿ÿh´Úmf§[ —¨ÏyÉ­¶®ûý*  Ðh´™'åÖ‘-W[×m€6@ ÍÜ”ôŽC[‡/¤”  c »µ®¡A÷Ç&Çò=ÀI6°tÄ󧒩冔¡ðèÔOCKGCÉ : ÇžÿZ1«“:¬³ J¾¤i¹/q1xòPøIoƒíOó~Ê%ÞŠÓ²;™P8+Ÿx|–Z,©xaö†Fº™zfM§MÒ‡Q{Ûí·G§FHÎçoq°rLíM*Dë7­™ÖTÙ9ºyë™ÚMå“ ú&k÷¼B /_?í‰dng¾éÀÁ—Sƒ'½®Ò·Úž@nœZŠ6owµñ=Ÿ<§)ˆS“‡DYØ™nÜwø9JÊão±· ÎäÍ=(_Û“+’€6 ?wÜ&QÑ1é}‹™CÃÚ×'éEÐé—^aQ´Õ«Í_rÈ9’ö;¬j°.älVðÙ7âtæõ¡güiäÏ컶3M·í½ÿ ¹Ú5-JL 9ž×¡¦lzôU³wâ»ÄüEÑæP¤ÓîöO¤Í•Íý 3çr«~tŸñŽ›I‹°ô‚÷š«oLŸI›ac%åW‡§Ñ†ç¤­`v²+)º’ƒxÈù×:Š:ž·ƒ‰†z}àFqðé7Äòé;jt…'_ãëɉy‡ž?f)«ùžÉ 9ÿ6ä\–×ÁÊʪOƨzFž½¨nŒ/Ÿ¼ÿÌPUY×ÄÚÀ5.%o<óD^›-X6aÁó££hŠzûsPø‘5º{+“f¬L òL(kã¹Ô"  èÏJ›µœ­Ñ®æt5ÇøÄBêâÄð—ø$ÃÉóè±1mÔMw,ÐO÷ aØ¥PæĦ³â6'Î…0]î%¿.Ý‘žX€ßsÝ#.Ç :qeûÁ³«’I#*¹íMºãv6ðjKøQ mòѱ…ágv¹ºÿá0ÑòÐÓw|R ’Èɤ’³«w컀wá´Ñ8p2«Í3üÌÎțᯈÌØËmímôìýwÅ<8qçáÎäÖè[ovLõˆÏJ,BÑ×_¸…öJÌMÈûtÚLæˆ6ÊE4ÍnŸw-ê4ÙÐg¢©.ùü1SQ32Gl¢$ U榧ÄÈ×ÏÒüp ~"özíò»=êä«?mPBf¡EM7\„<ÝM ¶=JxžÃd»Ÿ Ì¤×MÛ#î'dÕï<|úxN£¦¢y‰úØ[÷v¥¶»ûngXꮣ£s¦Ía´ýIi“ÞwÓ™¬½ÏƧf[£&:‘xRmÌv¥ÌšeÚ%:ƒ6+-§Ñ_Gäf©ºåBKÒSr¬m‰¥xïUUeZ™Û¹}N]IÎõ:_Ùc³ Kƒ[Ôõõ›6™;›S´‰HŒV¡i­ß{aGÈ!uåÕ^·úñÞ˜ö’AÓ9EìÂÅJÍl_vJÁ Ú¨èzXØ:m>xÆqMÙìø;ìø½[{cƒ5¡þ§ÞÇp63Lým<÷ž}bª© ³ñ¨ñö¤3éšJb‹ñC“Fç›ÜÉFÀ²õŸƒ6”-wÀ×HÙ‚˜a<¥hÜŠ¡B€˜Mp‚¼çÒ‡Iô­»,u‹“ïÉúpo÷Äq5‹]IïG5ØʇŸ 8ø毕Fö&&ÎAq19ÈÑš¶ýÒ¾¯È˜æ!f[ŽŸÏYïl­fº›œrhú%<©“Ðb²ØÑo„Ô%Ÿ=|,³—J'ß IÚa°Ø:ú“IÍpûñÂùm›„=—[/ñ¤rQâ»Qu6ýp¦ ñömÔTY[.·'‘±”€Ý†šÎ霼m–làÝqbI…Ø#œ6IÅÈLgÕ¶Ó½Id—'_&ä¢à@#Ï«DSç¡ =®4Ã]žÇìØíAcÙG’¡¼ü¶ÙÛ~uêÅ Úàù‡OžÐrŒŒŽÚ€þlqê;©ätèÌuÛýl\¼v'„>M)?“:|öš«·Í&¯iÉÃÉïæd!áœó6þg“É‹6þ=Ö'‰ÛÄ>ȲߞJuÄ´t3׉xWz?á°Ù;ìÙåj…%„­ ÎJÄMý"Þ®ÀP« [Oä¿žlë—IÜâ Qä¥{Ž›vZ»øìJ,¢ž{úl‰)æOÀSò»Ö8¹„<ÅÜznãvØѽóæÛ.&R=èm¿Í&Ÿˆ×|ÂxUµÖu§G|ܵÖ^O¨îvè̵µ~Ä¡˜hû° ¼#‡Üï¸7o&mÆ7xxÞŸ¢MžÀ}ûÎM¦ñGäë¾ccj÷ì~ßãàâväÅm_åÙ®÷y;û\‡Eº%&‰_Þ¹çÂÓv“7žˆ…͇p/2ôðQÛ‡âS“‡öÇŸ³Ûä±Æ7)ú­äA6ÞÚ÷oZùÝKÍ©´Ø¸/.oŠfœ%–Û¢Ž]‰µñ¿9™ô²Ø|ch\>Ðô‹Ð&%—_â3¾âµÌ¾“‚/€6@›y~CüŒIÁwR@  ÐFZºTƱ üŒ×[¢Öö†ß¯Úm€6@›?íø6¹X|=ønÐh´ÚÌN Ù¸ï#s¸ˆt¬J%COGL-K†)¦ž›ÏZ.GÔ'œ‰,çz°m€6@ Í¼ïÛà$¡†#ÞΩBœ•IJÊZâO:;8ÿ®N?8X¬ƒˆ±ˆÿSƒ“Í%†ýw5ÎépÞŒs"ŸËÿ¦ÆIÍÅ&~oØüÏÿ}ûôÛ{œ_tº“š5ô/¿Úm€6Ÿs4­·ÎÎΚýœÔ„yt™³æçðâ+ü¿Ž¡œ +y’ßsÖäìL$^!»ÓDä»ÆÛ>ê 0…§Œâç®Ä÷ÎA¦Î¿‚t&£ï3‡Ð6 ¿pÚ@‚´m m@@H€6@H€6   $  h д´m AÚm AÚ€€6€6   $H@ÐLÚ8í=MÌŒ ÒRJ8p€6¿2]¼|廕4¦™ódb›»hZ»Bú IËf 4ÂgKV›htzhh(Ðæפþþþizýúu``àèÏ­½¤€6¿båç燄„ì–˜€6@hÚ€€6   ´m@KSaaaÐCeâ‚@KR†A÷@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ŸQù/ñxQü[¼@Ÿ7BŒ‹ÿ+a˜Hˆa<Â0lÚ}nÛC"$ÂDH€±áŒÞ'q>Ð, è3£aÛ`BÄ}2pýpµs`“îŽF „øÐ8 è3ÓF„õ Ûbš½jí}ší7„”Z†„m@ ÐO€ ñ/W$¦Ü' ñ0T9‘T¹~O“•g›ùžJóK]‘ÍÜFÜ·‚(1údÖÿb"$ ¨'O¸AÃÇ'V4öÊ£Ê4 Ñ* ÙîlsH£°RÌ"@ÍÂÍ9ã³Ú ûhãaR û ÷Ÿµ!†Íñª¥Õû¥¯lª’p)~y}¤„ÿ¦…WMýaüßrá[Ÿ:ÓÝ ~MVÛ.ñ‘€è(˜è×tØ"¡û¬[áù}Âï–Žä^° y*Îz劂PÛ$óŸ‹ÚÁX’‘A­£?ñ¨ <‘ŒÚ<ùÁbK8öGôÃ1„r™ßËfwÕ³—)Ýí—²fñÁ?¨æ´ñüR(¢h ÿDh¸ê °æ:tÝ/ñn|¸ÅùHƒõS€ñG°®ÝŽ{+7ô¢F~½à—qùM° ÐR«ýä­„žšÒÿ¼ÏƾC·¢}ò&ï¼êÿŽŸ#á(jh]mÚm ½‘Œæ\Ö ßþv±%ÄþˆVÄ"4èkc•=ÄO r}2,eÍ’°eê{s.¨šÛ‘ký®Ë‚66sÇØg÷üñãënïƒîû%çx÷vŸ*3êRðxÁ­.õVžuVm‚òÁák 1ÞR²[É®ÜW¾Çs‹›çÅŒÒÉ ñݽT÷m›ÝÜwßßB­º=³rðab¨‹ë–ýqW¨ƒHô[£Nc¯ß¼5©’‡ÿÌO;çé¶e§WЫê!ªpQÍ• AWù}E»w¸nuóÍl Þ2ŠóY£FS]ïºåT ÞÿíÎym3z›§¹ÆF΋;VöûÅY/ƒ*¸¨õRu$~¦ï@ni(û,b("]{Ô!é¢ïo mÒ_‹Úû$´!kúî2Òa"–ºMãÐ[´LKzÝ6kugm´ÑhÒe" #TJvIÃÌ×H™† è¹Ú|½HDJ h ù>í#ˆ¦Œ6†Î¤ ZoëŽ7M¬‹ÙQÃ~·MEü9´ é/tߺÓÃÿM+q3êxtÂÂÄ@ÛÐzë–-[692™zÎœ‹ÆÑËS^‡n´¼:±e³kÀ‘ÓÃÒý LÈõóÜ^Ö>.ÞÉïø➸gÛ»ªúp×£º;Ÿ‡m;ü Ϭ{˜²õ@*tâ/ȶ9Q¿{Wõ;ºÖÝ¿ÉΣÜG8ô€Q‘ã%æ$æ«É*Ç]yô:óÑV#Å]Iðê]Úã ±Ö÷yNnvÆ-+åÕaO»ðÝ4 -·]{YX_]ìg¬¼ñtžÙ^p•¶JóQIe˨èÖ^'õ5¾™9¹¯Ò.ÈË_¨äåWÅ­f›zí‰-¯mÈMOUYÍjAmy•Wi?)­jÃ÷ÖèæZÐ>ƒ6ýCc<îÈ@ß iœpß"9b¡æ"’ùŽX¸§þ×È3 ••£ýkÐ7¿'Úµ÷6A˜ã×QÚ ¤øÏS¶Í)wôÕÿF×¢;Ðoð^™ûuÑr'²F#™ß¡Ñ™‘œ6_ýÒ0Cw ƒ.DQýzdþåä¡a =6F÷ JDå…ˆù7èúèàyTZ„VÿÚ”06¼þQ.Âx=}¤eƒõìÜRÒ9›6òê¶î>ûž¿É¾‘¸WIA³{\Äëëˆô±qÜ]VZ–w?DYeûârœW÷Ž«:%ÞϪ«­<án®¹õ¤ÔKR8¦§AË©¡~¾‰1Òözƒ/l´Vµ0Ûvö^za#·ñÚ%§›xf}Úéía§¡AÀ9YâQo€/<ºµ»ÅzO“MåÄLD>›Z¢q8쥟–ÆÞ—/{ë³ãRn"l@Ÿ%›ÕÄ¥z_Çë½ Öë5S2)°ö>r•5çNáØúr:Ü¡âwk2JûÄå¶dìa†©>þà “ ¶B®®ýyõÍVY®ß83nºP %¨ wfÐæ¡.’Y)Þ¬ç=’ù[ÄÃÝïV”$3oŠ6ÿ(ƒ.ˆ‹j:‚ddÉ¥"ÿa=úV½lž½¶ù{±¥'œ@¿•AùÝhè’ù_âžš"yñò£@ô·ÿŠ¨h\˜ bn˜nÛÌ–µ³’°+©Æàö³XÌüN”º|ØÉ%ð*ÁÚÊJ´”Ãs/ÂØÈ~¯¸áxoè`çó>6ζê_SU˜¤ „‹¿8ëælI´W½qÝDÞÎz£Ýuö#ÉWˆKøa·`Û3­nfÄã[Ž^;&þ¬k¨é)“¥1(BëØÇn‹càC/v檀 §ÑF8˜¥F§9mÚLiã:+Ûd\HÐæ,wžøúçék2žVöMÑfQíÊGÿûkô¶umè¢ÿw§x•,&0ôÃ?¡}’¾3:%®&VÓ‘Š ‘h+HC…,¸ý ±¬“ü‘¸‹þFåv̦Íÿ³U²|ýO–ø GÚ#e§ùiƒŠÛˆÍÞ›Å|ß>*•6áV~O%[vYËþp±åicÍLyZOe΢ 苉–",oô¹_½yTó¦Ý k£ê½ 0"›¥*Á~Cö¶û5“áâßñ<5y•*IÀc°!ÉҔЦJB›³i3ü–­ÈjåÏaEõñïmðút‘|‘‘Óé´Ù1›6?þÿ(øºQ#ÍÚÔ“ ó¹¾é蛿F2ôyn?™6?‘6‚ÅÓÆ籤¶­æ+¼Ú¶(Ú¼:j8I›S@›/Ú²ÁOÿ êñi0 h²ó«µÂŸz§fIÃïUa†òN©ÎÖšwÓÈÖCcÆê O+†(þÔÞÙÆÔÂ)"•6+Ú`Âa]U¥7 £”9Îni!½-L›ÅxRÕ§Ðÿ°//L›µ¿GŠ’ mãƒ)Oê;t¨H–éDÕÝÄÿ»ß!™ß"£+þÜŸQ|M©´ù‡ŸNéžÔ¼´¹txË mèSž”¾•§¸°Î²Ëôk¤Æm&ô4éÏ«¨½Å[®ú(mÀ“úbxƒ¡ 4ìWgÐ`{¶þ¨d\‰)-Uë¦]Ÿ®¸Æ=$.r¯SùðÓv¼ª§=”5LcO]Jd+©d´ñÞùiƒšÍ–¯Ú™ò²«ðŒ»²ºÉ‘“§8Ñ¡ú,åã9ÝRiƒŒ—¯ÞuúM/Þý×›è¼i’þÕØæD1U‹ M¼'cì„ÜÐ?þçmž†ËÎ~(Øýƒ ÚMö/%´3¬VúJ½ÂkËCß}ƒŽÖHµmP9QŽÕVt·ý'Ú6X“™Þ»fÞbl›´8/–¡ã‰„$^漣jèá#ùè~¸‘–­ÛþËS kB¯I¿ÿ‰N:2µ7„df½>êï¶s·•–ÇKi´©¸aä½øK ÚàÿŽ¢>ܶñ¯µúrnd5Ç;Òïݼ|õfnUû¤KÕRöîÆ•K×n=¨éâŠMñôuâX+¯õÅåû…TX´³üÕÕ«WßÔ¤¥üÝ«—¯^¿]ÜÐ'.} èÜõ—Bñ΄wn]oî'‚·–¼À·ÊiÇ}ž{W/6J{I€ND#ÂL"Ûs ;C,4ÜAI/Ä«p»PôI$ W¨ÿ€â¢Ñɳh\„ââÐ0O¼aÓt< A¯Ê‰Ÿy(êôäÁ¢G—ѵç„7œÞ“/áõ¼Fq·$N²ÅÇ¢.\Ù7Qt *AÍ÷'S¼Bó{”p]L›¼4t5äÕt±pN{uTÑ8­½¹çof‹$d»qýzç(Ÿ¨6·÷áË×ï>Åÿ”óäöåË×[Ç OÊ&8«¹ðå•+—ï?{Ï_à 8ƒ{þàÆ… —ßVu×gÞzÑ„g>{t½¬yH|ר~r5x[ª¿:k‹?tä/'nƒw ®_µuæÀ=$⧠ ù$tÒuhùßãâ´±ÞózQ¾Ï§Üð°–‡ë}á}›/*rƒ¡íñ"â>0hžî¡)ƒê'éî! ÿWÓsÞß>ä;WA‡ŸR1ôsëúsà›fƹ}~¿w>—m@ @ @ @“EL`ƒIrÄYð }VÜD “¼‚‰D E"L´@Ÿ 6&Äø<„M³D‰(þˆÐøâ „"ø†}NÚÈÁløB‘dJLˆÛ:ùÝœš}.OJ(òÊË"’À·u„‚qÄÃ}+  ú\°A¨¡ªIæ¯ÆÞdLͶÖT×££+À„àI@ Ï¦A/ßñßþftÓbä:òðÞ• ß|;ôô¾`>ŸFOrø_ýuŒ ðù‚žÎ¡ß~ÃÿVfäþm ÍO0§~`SÿEsþð3ß/Xp(ª_~lÖQƒ@ó^%Xg÷È·2‚¯¾ê =ÄG¨Û{óø_Éðedx%•þŠ=#)¢ëÓ·J‹ì‘Þ˜Yl/åõ—ߎô¹ÓBõÁŠÇÉNÖ+–ÿ(»zÅr9ºÓvßúQñ€~¥éGeä¦I~õª­×º›Ï;ÊÉËã?åðÿ‘ ¸V®¶òZcnvõí™-j&RëWó [çÎ’–@V›DAô¡”ñÏ~!wýá(ì‡>Z@BÞxï¿ýŽû™Ñÿþ/áøØ€Œ ÿ믛þáŸEH„„K9J<Ë nª³îø6ÿ+Šd¦ÀEI½}>;a*~5ÏV¼uŠÚ]3oâÓWõ·±ºQÚwëè–ä§ÅøϾì㊫ÙÉóÅžèŠ÷wø?JëºÈ£Ê3b5Œ]8¦{±4ÏÉŸ¢Î‡;_Cù¦æ{¥9Õ'¾gîâÏ©¶“¢–­ÍjJ®B4ï1Îo˜L“6ø6ÿÊ ÐŒ+Iˆ‰úbãy22£22#ë6Œ}û×£¿ùk^Fñ–ì#)êJλ¯ÇV–WPÚß' Ø7ÞeO£Ñét¶Gäåqòzw6þñØ•W›ì´4ÕT-¶Õ }q¹"Éb³UCó¹h¬-Ú{ƒÁ ÓÕö¥>¡fMÁòþ«VHAÚqKc¶ŠJð)bÜ9o|+&‹Å>T‚÷×fÆþõQõ ;"ÚgËÁ;/Îùy„œF¢q+&ËëNÍdg¤ª=$œ®<#NÃhã½²âzÍn×ÔÏóÁ—rz;roßéÄ »½±|ëåÙÛTŸø£ºwþóSzj4Ùå²A©Dµ}$Õ>ð¡SWÎd0Jô´~ô,ŒÅÚ•~ØsƒžŽCÛ6£¢WLÚ.Úþ§‘x@N¬§ð¿~¤õ 1Þkïß™Æ݈ظRsÂúV­\YÜEØ6—þ—úZè[ ¹÷¤ÑqbJ—¡¿ûû‰oÿjä+á72mûoT(ÀD¢¥ëIq+TÍ©Y¸¯ê­OÂûÉfm‰/)C ÜBI78_òؠðÝCm•î®ÎöÍ –ø…ôå:M¤q禣¶…C b9î¯+¿á™]}\nÕªðGä|N¢.-¦ba;qß«,ח̃4öèöÍöa‘43C0ڪƢ•uNH»Ñã´Q7tœ¦¡a‘4ÚLû²„ú°¤õ]úƒ÷ si#'«°;å-iJUh0ò['7¯¶xfªö³ò ®äbv‚‹­ÑEî²=-òGÍ\)­Ýq}ãJ» âŠô–ÈÑuû…*9¨ ÏHxF46ÑÃb1˺‰‚‡›Jo=É‚¾š ø iÈÈJðÍ×Üo¿ÿVF|– †{RK¶â¢skTmÏ‹CO"‘@ D‚zmåÕ=ⱕ»ËαX6£8mœÔŽ\Σ6ÈÜ&gr|úìu¢ñ* ùêaq¹íù§T5¶áü%æÊTÜ8893¯&ãiUÿ'Í'Åí/VeÐijWfDëÒ×¾ö®‰¢ nrЧIeÕ'ݶYØs™¤Í2ùu}âjóô4éÄ4X9S“î5’WØDnv¢…¶u´H\H“á2ùÛÝŸD›°eú©}MÑ<)Tñ"âõ˜šñ¿þ+ìë¯Æÿå_¢1¾ˆøpj _/|?-¶Ï“úyc9,9VÝøä̼¸«„÷õÌ•9øJÉP‘HYIQNQ}L€~þ\™¤mC/éw@îHOc®fõSÏk%ž”ó±“h#UdÜF\mO_‹‘^!6 æºni’ý 8),;^ýi´Y¦Hň¦Û6 4 EHT;ü›ß¾ú ÿ7_ |÷6!ˆ0L´”cÄÂx+ÖšKe3º'·BSQ®tP|wí«¹ÁbŽ`£Íh©š’R«`ŽíðógæM¬a³¶],C3Lï°Ô<õ¼î'Äm>?mÍuÖ¦JÎr«é«.µ}Œ6vM£xö:  裱Vâ;©1A׿üóè·ßp¿‘áûõø×ß þØŽ ‘p)”ÙýÐKNÝm\~{ÎGAË C"{Mztšøö|ÍOWsûMLê̼yô4È\µ*=æ±x«Ò±‘×Ê1$ͶÉQY¦]'±¯êª«Fx µÑÈŽòJ¥„¹“ÞUöýdU¥Õ·ó;‘ôgR“øYˆ66ÒÞPÛ>¸XÚü %®vói…Õk©Ùr³­ØªÔÄ~ƒ9 Ë•í{¥ÈXŽ¿¬ª–ê´(UýhÃꩪo…þšáø“´K8òµŒàë¿ZµzPæ+î×ßtì ‰¸Í’ýNŠ²Â<×+ÑUuØ,ý5¯ˆÇ)¿â¦¥ÃÔaƒ•–éª+ºÙ«DݬÓ&sër½£d8jd·1c5]w×å&aõ †®¹½µ‘–¦ù¦R2¬‹ªŽýNi»„6\ –ââ‘Í—!MŽ®ã}7ZØËþ#­š·Ìªšlo¦·jåJš²â Ye‹5›nˆc3eé1òJŠ*Ó¥¬¤owx²„ò+Gä-·K+þŽ³ªÂ®ë³³«b§U›§ÉR|\ŽW{ØÛ&K×ñ«-j°RS`«i_.âž”¦ë)sC çŽt:+ârÎüþIm±R·X¿3ÈwÛ®€09yÕ.†ŠC¿cøMÒFYI©„¤MÅ•C?èo‚.šÞx÷ñÛÿþ¿úvPFf<+³ãûe‚¯þºWæoDÃCÄ€7¢/ý}›3aÓg3°YìšõsÞ—rgn5_=¤€q®í²€5kª¸ù_"þ3ìñ`þFY¨ÚSËY æº;Óç}ô(fìkVùØgWèa i‘Œ+Â&ÆûÆ¿ýJð›ß àwüñÓçø_Épe¾â§§‰øBŒo³„aÛpÊ黟å°d“´ÁDÊüp_Pù§×?€3š¼t„„aƒ †x¿ýzLF†ßTÅøãƒí22‚o¾©ÿŸ‡p!>4ÕRµL?fŽ,B¯bu˜›M/ ‹cɘ#ºªîàâŸÀl¹ 9´ÁHO L³šVƒ-">'ë›8›Üû÷2‚¯d†Ÿe Më×Ì+l>m;r„D\f _âOtp?J( Dü¾žño¾|ó•ðÄ1¸À@ ÐÏ—ˆ|ú-aB¾€zs˜‡ D¡PÈk×Ôæ~+3ì ´@?_BÊ›b<$ ìâ}>Ü™ PWCïW¿áÞ¹"€f@?ß“O¨€Mþ3é™óEB~^._È…BA Ð/" ‚@ @ @ @ @ úÒ%u¼©¯¬±Å–°È攈-°Î/> †}P̪êô1Ø~Þ±`Òw/ÒþÊ5ÐÞÌûô­úÚZøÒ/¦¶Ë[#ïWö¾N²=ð’Êâ儬ÚÈA]iÿ¼Lol1WäD÷êÕ«‹º>aŠÛì+AÊë'ÊŽþø½^”1B.‡ª[ø<™›?ÞÓuf^¾·ºZÝ|w–…gæÝÁÖlœuË›¶Îkû*ºåù^2Ü©-f1‹‰A‚¥ H5kØRn“É*í™oλsXMm5Ö•gk²m0WuÀæ¿]Þ7Zœ1§0Q¢%íMÝ ÞîG£ùçë•vë1cï¼ BìC$œ~ˆóµö¬ZÍsÜÒª—è³+*mN+~d«·1n~ Ïçµ[¨e/#ë&:²£pæ­%ÖGÛëøû91 ñ>r}G0¦­NÏnÆ/¤¤À­·zÐËó~ך'2Lÿ¢bžã‰øظHÔ‹µ‘ógbKƒ‚æ7;×ZêZ½úfòÂMK9`f kdæú¤‚ZÕßUÿFnçÙ}›µuô7íŽå‘>ÔA•Ídéèê†\È<na¤gbétûC§²%'˜N'F[_­1Ó50²½VDLMh«†o¥­£QŠ·B‡ƒžêˆ—£•Î–Ô×w£lÍÖ¡êi«#ÿ¦UˆÚŸ3 \&ˆaØ}µ½Ó³.Xê˜XnÌl·fÛÛöf&6›ßµôIhCNSöåµúÇnå çÒ 3‡Å½#Êc­wüã‰Ò;ƾOEMš»îᙕ×j;ïÕ^8mÖíË|>ÔÐÀÀvSP;i:]ÛªªÆdjëêêkª«ªihYºú"á°¹‰Acwc ³…¶ŽÑ¾Ô§ ˜ú¼‚$‹É} ×Ûè=¯B-OXžƒõ· ÛÆñö78ý¬ ¿’RÖª;Ÿ®Ÿ{‰që3·9˜ëY¿›;I€;ñ!¦ºÆk.<¯¡VÛ±NïiyWR 3~·%ৱ6ÑÅ&ªm±É‡*.-ù ™¡ž©õÆGÅ=ÔV›ìõ²j»ãwoÐÒÑwÛ—‚çTŹ°É­¬Ý‚ñZ]t5¶‹ËummÕWÛu­èì^sû'fÑÆ71÷E¢¿¾¾£[ØI˜Ä lU&SGOßÿM¿÷F½´Â–£»ìuôCÏàVÐØÁívZ:&'îCOÒ…8­ÃOÂùª\üs3dœÿ0ö ܈!&–¢fÌ|Ü{.´ÚÞ»Ê-‘‰ú3Ø«÷ÞU66Tí[Cs %Æ×=ºÅÂØ3¶¡¥µ¹6sÕŽK„â±^KÝ|g~cg_o{Œ-Í*6Ÿ°šžÐVj¿íìä‰Nnµ2ôˆ­onm¬È¶U”|KZ¶Uq²*ê»cîvõö7•=e)Ñ«û…c TVêævã[á{8\Ñ3c>QîøØO( ÿGüžÈ£Ów†~kú4üêÏòPQÓ;y3»·¯¿0-IYÍœ‹÷®Ž[ôåô›yõ­Íõg,™,±m“}q?Ó`mY]Ss}•·!ss*1Ñpñ­ClO¢§çÅ®doÁ]'oG(&äR m{߉+³ia¦ªëpöeqcC}Üfõ]§7ª³L_™y¯¢¹»»ÿÐNó¯ôôô#þ°†KÝzoMGO_WýnÃծɕRçÍý^Óg’6æº*é%ƒ¨óñ*% ·˜êÚZN ;Zü£f¼¯eß›ð¢kV ‚ÎGŒÕì'y•õ»m”·F¾ÄMè0'#‹€äFü<Öä:ÑVúÜlÇ×t¶Ñаô*jîêïm ·PtH¬Þi¾ãÀe¢ÚHxt½±éîäú–ÖƲ— ²Çó‰ûˆƒ™º¦•oiKwoËASùu§j…cÃ{7›xGÝêíÅï ¢7I‡¥ÕÍ¢ÍÄØè_ÈçŽçqêècý Ôu×\Ë©h¬¯9d§®D ¿<ÞöN]N5£©k€6Ûkj¯ÙSÓÙÛY£¢B3³ð¬lëéoÌT_Î|92ݶŽsñ#¡\f^ÒÁ=¯ê¹É^9t(*˜xu y{`]`ƒ­{© ÏŸß¶IÛ©¡ñ–º;ŽtU=Êx‹DÝz Ùw­|êîØù.’ÉÚ8AÐF}ï™7Tûžl–5#n‹S3óòÚ4ò“®sgN8[o€œ™wÙj붩™yé™ÕŸ63/Á˜óëLcIÇ’6Ù^²´­#Ô|¨BVY«™eú[ªúß nëü¡:‰m#t×ZóNB³‘ûò+íɉs¹GײnWرV ÎÞ¿”a?oD˜Zm‰çùžíKØd‚n#%&åIÅùXùÄžAæ¹â.ª¬ªÌH ½­"ìShÓõäÇêoâ:¸‰i3¯'…ÝÙÌ4‰Ï°ÜßZšöòƒh¢Yƒ¡PÖ+¤Ž¥.ó€ªÖVAÕˆÛùÔñ¶ÝÛ d}?Ç}­½£ OŠ?\Ëb¨tH,ÍÚôPMóƒ"‚6ì¸'åÔVõ7ÖÒ.`DøÅ,(Qª'µ€býô\B.‰íº7¾?h‡§‡W§¹Zµ¼½l¶WºY@înl£2-(K<›O¨Î÷a„Óm›ùÑ¿z_izƒcây¦&ÛÿFKÒžf›€Z[ÿ&k¯:‹ËM1Köáh³½ϸ%¡±·l9fíÔ̼Ϙ,µA5{xrº¡—;çÌÌûZA7µ°¢df¬«¨¢;.¤f¯óøse^z€>ë~Uß,Ú¬2Šd¤JNY³‹E;š¸œz)‰OÆmšÍäåtͬ©ŠY[›¬þ~uö qrCµ4e½ÐW‹¿>qOjMp¦øGeÌYÜh£ÊÈi÷ˆÖ¼kL]¡ÜH£Í2%«~Iî,ÚÌ*ÀK•ðªsÆ©í{ÉRRkãŠÏcWù]¦†Þ†œ­™§2Ämßõd³²g:mÆ:ž²™ sKñy45ÔVQ3ÇÛÙÁ”q%[<hó}gºÝ)Ñ4Ú|ªÈ¸Øíå‡ü¨¹—?‹6¶Ìätª’㛕ég$Ì2øþÀ[ž4Úü%g0$š%“‰ˆ¡ÏB N4ûáöÌžzkïÓäæ.A«$Bùg¯µà°1ÛõNÕŒÃx¡š¼R券zõX,í¡ÎÌ;’«ªÈè™Û*?of^"::ÑÃf2ÛFI‚Ï Mô,Úœp2]›”Im&ë”ЦÓjåò;ƒóÜjžR7¶WT^ÓÅ[ìãØQâEÐæUÃUtã»ól=KiSÂOц|®e®£,¡õà¢hÃߧKÛñ¤uúyä¼e+3šÇÅç±£øKÈû1ÚŒw¿fÑÔç>HÚˆçÁi¾·ñsÐ潄6Á¥ÍéIÚèmÄø8âñ#ôx¢ L(Š­óðkµök6ÝW·©…_/˜[:/T³”µI¤Ì¬ºW©t]G qÍ4•îˆÉQ|~=Ûø°-@m"þ(3TWyR.¶x‡ÚKÊ:HWZ*mô$NL(,Ð Ãu׆GĦý‚´)‰t”]s’Êlx2·9´NÉ#¡P\ÜDcN)Ñk„¹rÊzÍBtÅÍØ* Z¨q~íMC^|q¨g½‘ ¢;<üíj¬yÂQ‚4piüå]øs¹õ¹l÷ß6]ô®7¹ÞéÑjë_ç8Žº…˜Hˆøh©švsç°þv=Ï'À —öñ/ÆÒV ПñfÖˆJv×[ú7Z‡ÔÙÞjI ‰0‘šOs‰V{ümÝú¤PªEú'ÄÑ»d;Sß?¡\Œ7¨¯§]Ò9Ž¦YÎc9»6ñ3›ÈÞ«`yl1eÞ‹õ×Ô™’CÒ¸¤AK–5¸m3Ž}ëMêíc»ÝÑäô™Kû9žå¹zò¥ÜiÙ¦4Û>’5ã]E*ü?APd¸£¼´nð§ÐF$())åáµmSÕi!3ÇÞx¬6>6‹6¢¡Æü²ÖÅ”y~¿“ËžsM õ”ZúÇà¢-]/]„ÆР_™WQ¯aKØ ™I›UF±Ãí…Gí?_5„çqcz0UôBöe”Vùymb©Y…íë¢ÇçÝýÐ÷æZ¾}¡ ÓˆHÕ¦ÇF^®¢þ&jÏÙ~–ìü¼èˆ°Î¾¦ø#! Çj3½TN|Ct'9ìüŒH髳'/gUŠ‹ºu—z|Û]ü<"é …9Ü6Î?饦¤±{ßþmmâ†Úò‰9šPE~ßͯ¾tŒx³·èQLʳ®ªÌ+¡ûöE'\ >>B}Õ‡„“aƘxŸÌuýÕoD'‚CZj¸Á¯ÉQÔçSo–ÐB™:_Ä£'œ6ÊFnÛvܺ?ÊwMÕ^€ ?<S”3˜õ®¥oèV¢K}óóW9ãóÔÖ6q‰¸ô´(?ÇdžeþXZ±Y1F–_ø£êf¢=„\=MæFs§¸Sç š…Ù'Muveàëäs‚7º5½1{n{*nM¦lO5%Uš&ùB+ºã²>èâ ¨±E]•™'•VëÞÎ~ß0JÐ?­äDú®§©;‚xí¿Ì ßðIœ¹†µgp⒒›ŒL|RñÌÑΠή\â\EîT >_[U”›•ó¾uH|öº ÒÖºùm@KMÔ[^~å¶McµÄk|Ø—ñœ§¼¼y7åÝô•Êªè´ 0ÔyE~õZê{ÀÖ7Y:Á”'uÌ[g­w¼£ý7•–é7bŸDž¾ûÈKñG “´™,¢p#,R]eÙ·jMÃ<Ô€õ–|qeŸÉÊ„2„‘´)ìCCÏ•–·J<)‹ñ¯VÑmNÑ&ý„¥‘]¨x'Åq`¹ fVxßz¦2m·výúµ¶Š+<÷¶uz €ZZž”ØÂá‘ô}1ýɸÍä'•rÊZ <é´ñTwr­^OvÅËÞO¤&ãIeß¼´™%/³Õ—*Q[Þe׫MgÖú¥Õ Q!KÎ~I¥Íj#IÜf¸BVI«‰76ÇÍ-¼ÒÄE×%}Oß:kѾŽ–!É+¨£™{V­°hƒËúü´‘D‰‡K5º«W¾êû8m3i“QÕ¿Ú\qHýð*ÖlO6 >SY{~ #BË=-@ãi´QÖjâK£ gm¦^™Z“üò×½pu€@zÚtL§Í–nȤ'åàu\¼eË)¹M[¤››`ª±åeâ5ÞŽøQsëGi3cH[ÜÀx«ç}0XGƒüþkÄ2?âç²÷\ÑLÚd*-7iûÙ´A¨{—…ñãIjâå4j'ýéi3‘¥º’~8ñôë:^OÉ:Ã0õô©öqtÌK[ßÜÕ;âô£{לõ”7Æ=—VlgÑšþ½—ﳟuw³“ÕØŒI§M^Bàš×çø¦õt†–…³Ø±²Ô§Ó餻:I¬\çùÀãgüÚŒvä¯uÚHE‰ïÙ ¤ay29!:T[aåÁ;exfWþCû-¾€賈_ëç¹ø6Î튈:ÑG~6úævjDDôÛ>ñ®qŽEFèâáž”šoRIÑã‹‘‘Q§o¾I{Nf>¹qä乂±ºÃÑä{2 'bªºÄ¯²Ô¿N:yƒxJ^Ÿ~Æă3·˜Œ³§/gR詼wúpôU*²‚ ÆcccZ‡ˆO’Ëž_‰ŠŠ~R=Ϋ»Îy!>‰Îpü@„ˆ_w/, ¢òUrÊírq¹=Y£¯ò‰/ŽëbŽÅŽðET…«²ÄEGEK|UÞCít¨1×ÉÂhýò:æ©î_Œæó}æðæSúhË­]ÇÓ–âVY›y øŒúÅã¡êy²hzÎÓ+ÑÎÒý1ç?¡Ð%; ä8=%ô«‘P2ÒãôÞ\ñÐV @ @ @¿´$“õ’lŠؾ”¯ÄA Ð…$b‹x">âŠÐê ¡Y@ Ðg–a†H¼<ë¿r°ÆɧÊ\2"}6/ NS 7çPóÎÀZ»À÷zSbptp¥@ Ð'{JÓg'„d0 I¾ºß~vO“M@­íî&kï:«ó GÀ¶Y¸9§á¡YÓþ}| ˆyfùèMa:ÌZçÏ1Îâw-º•l‡6ž]0Ü4ù‚!Ѹ@(—‰˜ö D<rZ÷6Øî©·öj5oØÝ!hŸ¢_ÅYéëþ * ÷JÝ o•Îëná÷*ú³RmBŸSYü÷¡«7pP×ã[n¸˜é°‰n99¹¢îñÅW)çjÍpÃDyôŠ?ôH¹\Ù¯aé—>7Ÿ7ØÍ‘cáO õÿ)ÚÙÙxy̽¦E­ÚõÝ þO,¨·‡:#ܬߩ† $9¨%d“™‚ìjƒu»k†ð1Ù/NÑ&à F%èðDH€¨÷ñkµök6 ©snäU 1¢_ÑøL_ µºOÞŠ¿KM«QúŸƒ­íkèf”W®@|‹>³Õìèý"„„\Þ¢N·‡Éd•öL,¾N£¹¶&[±‘:3ÕuRÎÏp£µÁs²EIV´7}DÅò}Ü>þSXz|Wr/û˜zÞ®P1ø´½ðÜTµ)–ñÞú®4ˆ.p[å è°YÇžÕã¿Þ Q1Û Î//N]@fÿñÅ.Ä0>Šjp÷m6Ý]oq´Æ“ÆEh©Ýˆž,j{ëãâ`baüÖ»IúÙ¹[sK» ç3«©UCÜÌïô\ Ûadlæœ@Ž‚ƒ­×Qe° ML#Š‰±g^]Ž±·4µvt}PØ#.¼Œ£íÊïÈÞhcbn¹îvÙ0¾ÚÞu:l|+c“èrü¢îÜh¦û¦iÆŒUÞ–Z®É¯îDÚ˜¬;DåØé(¼n¢ŽWZÛq‚ ½ÜcÑò…‘µÃÖ×mbw«ãÃÝõvæÖkwäµHhCü©õýMöæææöñJIƒ¬À\Ýâõ¨Ø'ˆÝ½É?)}¢ì®¡×cÑD³ÆöÛxfõí8“mçÒfݾçùW[Z˜¯sÛßIÂìæNu&ÓÀÄÔÒÂLWS]C[ÏÞmÛÛX4÷µìÛjodlyøüs$} ^Ñiu‡0É/áæµf¯ª†Që3ÿá¦íã(d‡Åùçí8Ùθèo;ß0×yªNK²·2sؼ§±)_L<¨úÀ® &&æî’©Ùè'rcµ\SûkÓÍ -l7½j#Z>h­.›ÁÆÏHl%FÒæhWå'3ÇÍ/Z);oÀÍLëV)q–»Þ¢ˆƒü¡¡QÒªër²0Èkã~™ÀÍ‘ÖMþÕvÛfôbíQÿFÛû mqBÁ8áZñÉhÍ’2l_±WÓ¯½,¨¬( ´Sq>ò¯Ü‰Vnµu5¥Ùë髼n‚z¬×Ò4ß‘UÙÜÝÑn­bw¢0¿kÒVj½néìãŠRvÚèm(¯©¯*È°Rý@zß}Ÿ±BåÒ›òúÚòDos&KlÛ¼¿zˆ¡k—[V]SQ´Kîv–€jáµ}ªv~„qVœ°ŠåÜ)D|î—x|8Næ‡Ú²nÆ\˜M›35ýµ‰io«ªÊ£œ´èý¿¬#…P|I¨g½‘‰â:}ýíël&Ãi0ÑR¾à{ËÝêéws4^ &¯\9*>ª†‡L–Ö˜6UbÚ¼Ø1›6ÃïÙŠÌî¹ óóhCXè½l&³u”dõ ÚDÏ¢Íñu&ë’2Å!û±N m:,W®¸30Ï«ÏŒRÓ·PTqêá/Ö½%^m^7 Qûjzw­g)Ä>FŒ¤Ž²„6Öƒ‹¢ /@“îõ¬*AØòz% M´µŽëÍòÙí‚pqµI²2Õt¹VŒÆfÑ&R:mЛ` ÷’fÛI_U øE…»÷Ï{×›ÜlŠöhµÙ]ç0Š:ð«KˆxH´tÍËò£æ²vÉTõ²Î² Ö`ˆkª¡ø X|»*¿¼‘ex÷‰ M A’QuåŒ*q¯鮬î!¯hé´i˜ò zH7Òp“apHì-H›¢#örN‰TÞpsÆdÜ&l‚WR‰¸8~k^%aˆºó”uøèÂÛè§hoæ­Õ´y=E›4‰'Å yZC­ûö¬‹®ù~©wòÄï[ÄÏÏ­úLyé´™¿¹žíb³¼Äæ«ÒȸMcòÚ•VÇ%5ïÅãlÃi³âGÖ›aêŒL˜i²Îå·RžTãB´™Úï@å&Ýv˜Z£7Ka¥fÑÔßÁ‘ú…Ì›zT´»Þ2 Ñ&¤ÎîjÓI¡x/ /á0EƒfjtÃ5[C|·±•i'r‡ˆ¹¨DSŽZ%ÍJç&EDÁdRÛø#žk–‚fKIç\ÝÚDÍÿ÷ÑƉϱ„·»×†TΩ1Že¨¾Ö«å€y›˜ói}Û5¬«¿Ë3m&„Œ:‚Ú·ChŸÍ±¤-Ýoí¡#²¶2™×ÓŸº@×äˆò-a^霞ô.øãY- ™cŸzÈ€ÒõCn3ÃÇB¾âcˆ~YVÛpÙû8BõF¯æ)õµËCDÝÀ±,KF­êhO^²e¤Ø,õœ0D¿¯ØœÂåóWÖ½9k1 ±I ßD5¯¶LrOp”˜¬n啲܀9²¢Ž¤ v0ØÇ°T˜rFâW[î™Ñ†%¼KŒ˜ Ô±(FDõÇ®ã6[´TûñùYÉ3ëÆ9íÅ GY}ÿpPZ&,\½á€ì7û†5 bl$µ7»U {yÊP®ß-iã7§mXÙ#c ’ìíåj ùY¢÷«çùHFÒ3í Åæ daÈ lÏ¡±imýáà㳇˜)“Ú‘yYM›¦ñÂᘰ<‚;Jìv’ð¦´þéÖ»DtÞF?¹´éÐß,ú¸úÝÌÖ/{‰¦MËöwÍ°x<«Ò!£ÓïDܨg$Dœ–Ân{Ëj©ƒí¾›wè¿^–¼º”Djû6ámÕÅ u|ûËbôoóéÏ´áïìIÛñ8œž%V4 [|Ju-¢²Aµ».·¶«¶Ùž†!v{ßRïaˆÞœ{v·_ƒU»w endstream endobj 974 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 174 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 46288 /Filter /FlateDecode >> stream xÚ콇_S]Ö/þwÜϽ÷÷¾¿yg•žÞ „Þ{¤AAEP¤† REA(R”^¤÷Þ[úÍÉIBBDŸ2ã kæ‘ääœ]Ö^ë»×Z{ïu8œc:¦c:¦c:¦c:¦c:¦c:¦cú‹ˆ±½85·Æþ'÷²ÙG»þcÄæ=¾»±:;ÐôÌìêæ.XúÞöÚÌÌ%vûöÊâÌ‹÷|˜ÍÜX]žå=?·°´Mcî·Šµ3;==·°ÊýÆm7{wŽ{}~…W6sqFÍók‘ELú&·ðåõ]Q0w6ffÁ63—¤;·È-vUz•3Kk[ÿ‚2²™¾»9?'hçê›ÇI6àðÁnpy»Nç>²±0 È Þ¿¬¥Ùɹ•]ÖÎò”äƒÜG§æöØü“RìÏyñ_fç7w‚¦œŸšYbŠJ)·1óS‹Û ±Ü^œžžZÙ“0iRw8±–çf§fâÕm-LÏo­e3¶¥öe~ƒÎÞ[—Á„ÙÖ¿ÚL=µÿ‡FóGÀf£1ËõR!CâúfKþY¿\úï–ãÁ†L}u¼º¶.SǨ`IÚIŸ¥kFêôíˆleèYŒ¥Ç“-Ú¹(/s ­cÑHJCÇ,ùõ4ÿ×õ:5eA×vqWn8œíÆ(ªe¼ |[pF¢`X,QŒj6»¬ÃÐf©¯€€@h8‡‹BîB]*œ¤9´Áý¸ìŽÃJ«jî½ÉâÜñÐ$ð¾ã°X4Ãó¾ðç“*ÿZbÉwæÆÒ="K!£1$<×,îæAjµ*ŠÛ/ <c—ùûëPC+íÝV²VMQ^ýÙ$c«á:‰oG!ÑHø™€D™µÓø‡Ä‰KÀb­Szøœ‡Ã‰êZ ©«”!5M«Ò°€óP(2ò­t§›´:%Ú­GNe¨²}p%K&¤IÝá´ ©…!®¼X½úÈNÁü!ÐÚÝ™ †:À" Ú1g”õ5%… D$RÿÍ毄*RDˆwiªÜñ”ΦȜu@û%/~Hô7tεgÀ{Z²‚µm©2J’)Ä××/ä} û¸³·¶WýË£a(Ó©]Ηʻ8¬~¿8Ú<sÁÛxhÃým5ØŒ@Ðs­þ"¢ÝÙÜHO UÐ>Ç+»ž‚бR'÷¯ˆ¨ÎN¬9Q]UKÇ$DW Ö§èó¡†4´é/$âMŒÕ0WžO ï\¬OG«é óÐÆ‹Hð¸ßpx©KŸŠ¸*Õ¹!ƒ?RÙ*ƒ³lö؇ ƒÀÔí{ÿnrƒùÝÛ²-áÆa¹Ÿb •#œÑ—÷`ÿ€WÏrѦ†põ|[Ö@Ó2|ÖÁ[¼æ0VzŒPˆKyÜ£%g‘;*.õ¤ˆ² é¼ãr«Hü(:ÿ1æ#Üõð—:ŸóæFÚxMçE®$èU¦¥¼cù”°§ì¹Od .ãæy¸ŽýòKx›4©ûÚê¨êë¡ñ–£›,!÷KT¬ò{yhó  S·ûRî›Aub›Œô¯5À¬Ñwg Õ±X YÛ2ëå hš‰¢ —&š í TQ(¬ý…ÖÉuðb¼ÎèVkN¨=ÌÀ«>€ G㸄„¢^,ìWѬ ¯« Êçx>ÎXãÅ3†X ZÛúü‡)À†dÍ5ã0¨ò½ñç­ð8ŒªþÙ—#ÛR=`,‡®˜ç^šóÔ2]Øa2×çú§7dŒ»Úp8ÓQTŸˆŠòþ–¸a´Â·yB‹W±{ôà þ|Èîÿé3md<æBÀ-´ñÊ}û£LæÊ< éýêE*¯Ñ±Z ÑÆ5­æðBÆrqxbó¬L»ywéÛ /+<͵+üc+øÌy¤ˆÒꟾçk‰åþ`è\7Ì•æµsÄ¿;æN e€ö%C¡Õ6·}ˆ;ø؃„@ Ünå-ïÐ÷¹xð¶_:ª¦‹ Ô‘ú„’Ž6co`|ç´ÔN¡JçqÂÏ«Ë™F5s?= ÖDÝÙ<({‘Zòf™=Ñæ$¢hF&çqJĆ5±ŠÆ*‘$­®9óøÔªþxˆs^—PÞöц÷µ¹ø&žè´Îüf¦ˆÊìÞ7K~ mÔ"rŸ^QCÚ¦¼^C9LåÒw"i&0íèW¿¨Ç´Ò•ù ‘ü²½` ãõ}’&§{éÚ4åÝ@£)¥o¿ }{÷ä.©úd¸žrE›¨ïžPXÛÝ?²µ0u뜱mä·Ñ‰m¦¨ÌĘk›ß›Üdr¥îµ6q½ø]wOOÝýP%„VãØ:g©ëôϽê™®Ï ct[§wÅÅ™}Ï­iôe²×[Çl]Díxãn8)Þ¯Wáî8ÚT¸#`¶9’Ú±1\HP„–LB‹;eÒ2ñI¡Ú¸ÆǤîç×Pfé¥I—´¾oÛ°¿ƒ6*Ž‹Z„ Â4¼¼ýH¶ˆ²}mv;Ì òn e}ƒ½ÍÞFªV—²®Ï”C8=ëàÆþ‰¹ÙÉ’0´Žó S~Ï‹¬ï½Âä÷´4Â]Ó±Mì£Û6{+=]=¼P#w™½IÞH3÷m›3S¡%Üï˜ç«N_†Ò°•Fïy‚Ĩ½mÔ=ˆoÑôbg`‹¶Ÿ¥ß´6ÖFkY=ù8-áÏmß tÖ  ¬gX凎•=0^£G`Ä{‰¡Øî±DûÓ-â“úU‚KG -^,–b5¸É9WÁ´ òi íu®JÉáZ5O°´¹û´•[r¼³¾®×=¶„'ÅêMVV6êÚDZ†„D¿˜àû\?‰6\ `Þ¿`¥n{•&6$ò‹Ðêg§˜ÿ&¶ O~XµYaú555U.qhýØÏbhÃè4†*[EEGñÉÅLOÇî"ƒSƒ5µ]Š…nñÐf3DkŸ^ ×¾ .sm\Îë1ˆm„¨¡Ng¿—©d1ØôWùò9i`skƒ Ž»^ÛÂ66ÖžŸxR»wµUtî|b,ÕG*Ä6íh3Èá|K9ƒqŠ~ˇ‘N/ÐØ•÷ÄÐÆ-ãmkc]„¶wGE6»,̉háµI?ˆ6N‰O÷Ä‹Ýâ:,GEàÆ•žŠ³F:à(’‰¢™ûˆ6õ÷\ëdìX®<\¯s™«<»÷ô ¶YŸ€‡çž¢!¶£‡GóöPþ§Å¯åhÏÈ:±;ùKJLm)\Ÿääí…À±d×À¦­!Ê¡ Fv7D{¹±É)™Ãw!âTÑmÇË4–d8B¦'õàÛΦ´b¹œ'c0(Hp‹¦8¿íeò Ѧ øH벂*\}½.Ž6´TW¿XAe«NÚ¤K)u¿Ë¶ÉàkЮà_5mò˜Çc{br°±%¾ñkÛ6ŸâN+“Kß}›œš_]Ì°PÒ½'Ž6ôv=eˆç½÷ïgƒô '§ðé .ª¤^ÑÐñª`ýÚ¬]$cÏf½æÇFÄÑ&ïpzݼ¡2Ïx+iJòþÎyj™q ªõŽ"<šør`£ãùwâ6¯.ã• âÓåz&F]³zRF@g[õ•ÉõkœªÐ3fç3¸O@›ŸŒÛ€hË + âW<¸ñ.óŒÛ¬6?@)cnçÖ ŒŒOÏÌ4Ǹ#ŒhƒT|Uöц3ßxKé1Çõ,ÂtL"Ê$ÜÁíU•¿ŸÑÕ‡¡ ¯”æ{E­z^Œe²9€DTôm‹‡,~_”X^Z¿j¢©í+€DÛ¨fî¼*Ö%çCÁYˆ6cõWa*6cbEvÈ+Çõ0~¯mT·rY—dÿ¬Ò ñƒ6;Ñ*ºÑüåËø‹:šrȇQâŒ@KUS_A°mûª‹áÅô¯lI´ ²4²»#6½f«cvü¼Ö WR-á}™~C‚#3šÆÁ¸ Î&œ5?åbpøênq¾ÏVä`Áºp-³-îÀ? ÇàI_æXß]ç°vÔã”A,h{ün€5…;¶ÁG›ášd4Iªqìï´ñ)j>êFi¶  <ìí»–$umM‚úwWÀ÷‹=m>Ä uO¯ò~¤VÙëÐú.{<¦É@`kL®¯…º¦>wvšõÝ­—´43\ µl”¿NƲëvŸfñ\¯âl<ÓAËß{½ÆoIwékC–jð@г ¦?>O™^ßã¬ì(ñúQפ8K ú*Šç‹&zR`óǪ5pª†Ú(Ú¬‡P ¦ÔÆ"9@[ë4u6?°` ‚6`dpáo¢‡µþî ø>~mOjñsº^EÍÄÖÊTß/ýÝø˸"Â=©r¶Ìæ¿ÈL°§k½Á®ÖHœª¹… …´9wÔ¤Ù¹”%`r{a®¢ªªLj"Ìï*‹Ç"”I$µ‡­€ÖÝ PÃÀ4u´Ð‚ïµì-ß“Šºa¬grÚÚÀx_/Ú‘ØÒU•d¥C€£0X,žˆTÆk›ß+ïÙËoC!ê½âhSqÅfê"²»o«èîEMü)9DY†µqºXÃC(à×µZèiõíÝíчªx<üþô4Ê›¤ÄC›ù3ˆ"T< ƒ)*«¾[?lCçbïC¥6bAØÕ}¤‚  îîsFÀ%‹UR&Õ/Ò„OŒÕgCሦ–tQ\nu7ÕDjÛ[›œ ˜x¦„i›»ôUœPÄ¿hãhößä)_—=p­¨b1x´øždÅ¥í§næZPewŒðh§ 8ÎŒÅçxyåƒÝ„@±>›œ½$gÎ*z]øámÁp&Ë™„=‰^íÝ þM/¥K¬¾µZ‚œ¼d±ÊHÏeç¡ÿ@Ô‹¯IÕ&{Aટgv@Îß~üyŸlvÎ%+›Ò©æ´ßTo…!/0{§„ķͲÚÊos+‚ˆÔ Gš'ödófƒk;&¿§QΊJÊ&9ÀÈÝé§XEE‰¾¨ IDÖÜI:rä[/Q´aN2n»(íYUHV(ŒÛ¾ŸýU¶Ð =)Áî´Cë<¤§oçHé–È—£ðI6‡¥sý¨Å~·¢ï3™-Á©•*œŠAï6ë'Oê”Ñ5Y<8ªøJ Žäï‡÷cúr˜$&¦G/‘û9ÇôS´6G¡•¸ Õ=Ö¿\ç†Å…HÀ¿ç¡cr>ý§ìEÝ+ >÷fxï?JŠ¿ËÈ_eÓï¿9-µbÐÈüw3?4¢ÿ:#·Ó•éçwá¢$\x×ÿ¯x|òÅý2”¬y¶móOÒ»Q¤ýÓiªæ¼¿Að÷I¯?Vô bÑ—––vhÌ_µù{k ‹Òi‡ö¯xFwgsuiiyKôü1ý!ÄØZ. k[ŒcöÓ1Ó1ýEÎæwL±èéïE°e^?4þù=ƒ]úÍÞ#ÿ¼+ýˆõµèwUŽVû²jàÄ~cËÙ‘ ¶h¤_ZReKll>¦_jxÃ5Öü,ä‚—‡§§«»÷½Üà hÚÒO[·kb÷*÷ðòXç°ÖÇý}<ÜyäáááéÁÿìææýà~¨³³ÿ'OOOþ/îNg.;Ø×>wvõàÞÈ#wO¯¨´²%öwzm¼îœ¯xyxùÄæÔl ä/t[SÅ©w|¼<ÜܽB¢R¿Îî‰È+-'ì²›‡‡›€ÜݽnÆçMðv"2»Íë‹‹³Wåä…|ðCBø7WW7¯ë1YýR 4dóÛWWþ¥?Ûl^‹quÉü8FköòpoæV·›q墛°'ò88³Ë©¢ú/c¿Ë5,¾D¨²qgœŽ:pÜû|Þ6 ¥üwsèC­`w`dýb³ËÙH8WéîàÌ­ÁÅÑ«i] _*Ó.xzû.1E8 œ£gØ´ø"̧».—Ë:õ÷—£ÑšpV'äö;2ÞïJ˜­.FË¿€.cgãÀ‹4ضÌaoÏSc¢#ytÎ\«i|‹÷ùväÝš¹‘·ns?ß¹nF@¨;\¹Åý‘:Å;/£ªŒð¸•PìíWìôqhm÷ɽï£&Â1þ‘‰àS·Â‚¬4‘D«e¾¤²‡^e¡Jú§]ƒBnܺqÍ×Í"§t!õ%¿g/ÜÆHÍìLœ€¢oŸ5Ó€" ¿ÎípÖÇbFFEÝv7¤`u­¸Ÿ¸_#"î~œv¼ôW܀ˆî×’Ó3S㣼Ϛ))Ê»–ïó‚¿!6èÉøŸYVEÞ{3ÄzMÀaßÚ¸b¢«fîÀcö>EǦ,Ó8ŸJxߢ®_>GÄ¢Ý.Eð¾Fd>y+D›ž²[áG¸¸Ø˜èà î$ˆ’{r›ß÷½§wÜO) Ïxø…Þ¸v%ÈÑ\CJyÔ2-ƨ•OwÃ#n†x •qUË"bv[ap¦ÜÝÚ>î‡DBµ/=gŠ°ô…Ò(¥ñXy5Z " oã»®¯êßÛœü¤ŽTÊïaŽ6"Äj¸î€¶ñ§IÑ®êrV9C¢—¤í`uFÊ[f|;mn ¥w[ÁN¹?2æ¬õ¾ p—²ßŠdñbÍ7܃(£®6,„ÖÐìb¼¸%2á†A˜¥ˆžýdUùá\nÀcÄåê‘7ÃÔô.¥K4“õ:ÄLÕ=òh~[ª+pøn#‘ë»÷ôQÙÍãì‰÷þ3Œ‹6:V¡‡ûA+¯Ôа²Aæ¡žÔŽóõÙ<ÛÄKHö5Þ^¢]6*¶êÝk…€ªgøMö`sºŠ €E›ê”SäH‘‚Y‚ˆ©»n­çì|ƒ#”Y²õm~MZ¿Œ‡ztp8 .Ú<ïÛå°YÛ<ÿâGÑf% m¾"´ ôäy£ÐeGGð©(;˜–pœüY”)FÍ{ž}0PSyËNð—…6N‰-{¡ü;hÃ4S‚û=î‹°¥Ä˜k£Æªðøš)ðç—1ê*.Ob¯zú÷"#°vײ+nººŸóp0Ãk™U´ó`p¯?쬆¤ijfLƢϜ‹™æYcó ¬uˆXMCc=Ý Qù¦Z°‹i_A5 „þ/ü-`ûë缤ö©5ÎÆD25HtÚpDЦ^*ÚüèÀúñ!¬Ÿ M`‚Ø «m¦0”÷ã¯ß³m8ïY#UœÂ2¿ ŽÎ/®ìÒYR§³ù8ˆî×=þï2,±dí(ïæát„¢ÞµäÁ]sMË›9ÜZ£Î l. *_ò´5Jx6Âaîx[’¬ýÀœ«œªëÆ$,4„;fWCõûU «ô¤tL/Þ›ž¡É¹¥mö‡6eâ³Ï«¬ N·k“³5Ù¢UI}»&Áz†‹ÉõÚ«bhÃE­j2S; ì…qÒ¶ *dñ× ´ñŽ(ã°WÜ4•<Ò;Žm›_9J ¤Œ™í®:k„Âáˆdu볯'v8üÜ>(˜Š²(Aà@ëß‹6'Q•Â-o̵¢g!wKôÃÑF,ÁìÞ|Æ3E„ùW`N_ôÁœ:óxJò©…Žç$,²¢gtÿ z&:çj«£†AkùN9ë…&Š´áž¡·UùÛê()C0²Ž¾Ùj5Mb ¦«Ð^E÷žÐ‘x—n†ÔÞæB‡Î hò ¿Ÿ.éÏ'ÞGŒ£åtó¿&ïp=c³×!—ØÉ·¡h+ýÆ$(mØ)…E ˆÛ ÑHˆ()Ëiy”1ÿ ´QƒÀ­¼/‚ ¼àïccn€„âgb‡ë(H•âÉÍE¬ú`+„eýP´yyUáTÄ÷o‹/)i8.ÓY‚€mJ¹?LVÜPÀ›ñv­£Í/½,8&:ø¸üŠè ˆ"¹z„Í?‘*¾÷|òíƒßoÛ¨#p8 Î% ™9œ+x3À9t–‹6ª4÷~ð)$†håPù<é¸{]ý¤al¤m3ùù¨çG‰ÕÍãbyukÿŸ‹*¥Œ°H·möÆÚìm}û þšfqµà€ÓpKê\ÁEë‡õëÕý ýdŽÿ­õŠ.Þ4´2C<‰Ð8m‹«Q)õí@ºSÚÒUô3ÁÞ]´ÖC l›C°mlnæȘTþ´QUF‹Hàò/.>1ÔM ‚uø8·ò`sâ“F%ó㦄mÃÈ÷2Ç;…°d¢ ›³ñQKîVúîõ+.5¾L%)"#?­=)m¸MÈp%©Ÿ/:F›_jXL Œïnóã6ÌU7ò•Ô÷´Ù?1nS¾"å|ǶQ"¾ß–P"ÞSOÂ4±¡kls]Ñ(ûqÖ¸ `Ï5„š(êø­HLÄRl‹Á`°…‚xV+=O ÎÌ„¦†ðx.†6V¹-ë9€6_1·n¢£á¦¡ÿrŽ¾üŽ¢ˆ8›Öμ•.êˆhó×Äm€”ßÌIÊ9]`V4ÖÆ„‰6(©þ`܆¾æfªæš ¼.‰N£3Ø"hƒ­æ RKÚ%ŽH¡é#yDQ#㑱»bh¶5Ù¬…‡g6-Õz¢ŽÑæ—£ÎR²¦a'ðB­-A”xÓÀœþioö¯ˆ‘¤¬I‰Ä-æZ!1˜˜çýb¦Èä ]8ijäG"JÌûyé¼Äââ†ØÌ/m&kÓõÍíûÖXÁ2¢)pþ;Öý@Þ£Ö e³lö  {jàsß”ÐÉ`ܶÒ9{3½=b9ù–ÿn¾ÝùÚXÈÑ<©¿*JÌóÀÛÓ<–}|ë†YÇp‚eÓš`öà5p´ú&F^ÜÏÑè¡îÚîaÕ`i«­·¡r†]¼·Ô…ØbÍ«DëZë­"b0Ïû÷Äl^¥Í±§¡¦ÁÏC)ÇhóË™6\é»m©†µ¾ü±³å‚>³º½Œ€ÂëÔOüEkR¿m@!dÖÜvA(Â<#s?·}ýÚ^WB%"Ö1tŽp¿èšpi¸6‰!Tt/‹(¯ÚÉrG/©©h¹”5|îêééîê¨{LÅÀQçS«xRãïï"ág&׎€6Œ S‚‰_kWÿÈÈHOËK}":²ø ‡E»á¢¥eu©kpttðs¸½6‰ˆØ6{O£¯Ä׎˲mŒ|»:¾ŠSÇâ6ýFAÊ &p¼ËÁ»1V#Ïj*+‘Š_´}ùÚÞú)'Â]N ÏK€p²>>‚¥ä×qeí…^Ù0 HWÈœ~BCN‰(}ÖAƒà›\#îIóÂf ! …Çš¥£Í¯G,úÖSj°&ÅáP´¥wøÐ2%.GþV¾(vsu2…nƒ ÖëÓPs©hJüÓl±dMÌÅ*ôß %?ˆ6‹}yˆ“èWk2A“ëð¬º~΃B"hC;ߪö ÁW^lÇ\ÇÀïžx(†UàŒ#øωô¥òœ.Âẋ¶_åß³ÒSE¢PÎÌ) ¶{þÀÛ#”.³Ú8HÞW¨{oR TLï ´º[ã¿¡™÷>j <ÁÆÐê³ÃôÉ IÒµÎzý_àîD´»Ò± jŸž·1@‡æ€–ÛVáZwÛ¤¢Íe}uò Áá¸âîYáMËý/ñPÅLJouþþÀ]_üRÆåwBU¯`ßò\-´àpItŠí]ÜcïŽØí¥w´±(†äSÆ{+ë‰VÉ&N²ƒÉfÃùlpX×Í5Ýn< @M¿JQ†Â ’ß+ï/hÞð?„Sµ£’†ºôsRÒN²pØ2B1’'\~èŒ û(ç³=¡#Õ9=ëÀmlŽŒ~qdø2@dg7î åôõ‚…s$u‰W+Áb³VfFf…к3cNQ‰®Z”ÊÒC ñ«´³HÒZp´“`æ¡ç¤${Ë–Ép‰ŒìÃNÓ/Fô¥ùÃËŒ"èínonH¥­Ý_†‹«µˆVÝ<ƒóó'WÙ\[ꦫŽšÙ…‰ùåµõõwÙÞH¤yí8WÛ1ý»˜8ÿé®{j`¥Ôìö/ÂC€yƒÕ1J8ÃÞ߇Ûì¹×]Ñ0†Ð;Ô:¾~,¢ÇtLœ¦²þçAÔþ=¸-ÝÃ:’c:¦c:¦c:¦£ÿß™¤ÿ £Eüí Òëún­o–fT°ÿ˜Ö~÷æŸåíÏU÷ýj$ró#Q°?[œÿɶ ôÓû쿲úƒ’p4>H±¥ÿœ&®ÂOžRRVIQQÑÐñRCï<çKb{Št®ø4÷V^A©ä“Äú÷âgeÅ ÓGaÌHaÐ+it-Óäxë~ôw(¥wù÷æùOñC ŸåNÖÞ²¢È#EQR .o?bu®À3{üû¤l͉ø7£à×,ñ—ãrÙê€ü¿Æ·[TÆæ8 ñ÷‡ƒ?¡âŒÕ©îÖ?cØôî®a:°¿m«ùÛˆ6öï.“¹6ÓÕ7ÍúUçþ»½8ú(ñª6zJNN^íp!êãàÏ«mþÛ·‰åz¤&ŠtÂ8û¡+[ïÿ£Ä¹Öe9ÿ’VÆPLáäÓ~ÚŸ4VcOðŠ¸gSŒ-m®-ä_2R‚éÕ­þaUl®-­¬óÚ?߈ÁáË[Þñcox™rG*Ú âënjÆN©´ß=­eS(^5G°í­M“ƒÐ:à à×]:SlÖݦÝÍåÅÕß±èÆ+¹*Úopzq—-:'­¿ºpJÙ¢›yÕþa®,/nî0~\/9YAº)ôïN¼½ÁWâñ&Î{‰÷}meqm‹Îþ½`Ãé-¸¡aGû‘GkíÖ(5]×÷ý³›[[k‹£Içô!pbôÇŸ ò³®š¹G<û!NÖÇë#íq?ôæ[)§² “·µÑ1/{X“ͪ80mŸ…68\íŠhov.iÊé s8¬ Wd'Q©Yù¥ó;Âöõ6½ÈJKNNN)©ú°.èce°,?+)))#·¤{ŽÿöÊ·ùµc´!TuÎuÖ?NIN~P\5K?€6@A+Ã-Y)II)O^~fs¤ìéù|߆óœµ÷Ößh+('v2iߪc3+…’¿ÝW~ï~°“oâU\ösg«öQV|5¯´~ |k6¯ðùΆìôä”ô¼žUN^ˆÚÈè»$µg£t­æo‚cÍ4Æg>¡íŒfÄç¿í6½(MKNJI»ÿªm?¹_ï›i¥ü3P;S]fQ©ÉÙyÜêø’>ß^H-ëcmfRS+ÞvJ8MÎÄ3´2±¨EäÒÆuC¢É5`šÛé-ÍËæUÖÃǽ¼ª@¿™»OòR^w/~xš›÷ŽÃÞÈú¶‹?“N|yõ ‚âJð—˜ÕR+ÛÖ¦¿Ö§S’Ss>¯‡«Lõ´1R7p‹Kì?ð¾˜åΤôÜÕéÒûI5üSe=j2S“’S³_åo fͶ$¦ço36^•d'&&å>©_eï«A×ûêÌ”$jrzåû¡,}-N*ë^ŸjNM¡6ÕTß õÆbM¢©µ“{Ï‹Ó*gyï´ïJJË]§ï}zžÏ-6;ÿÙÔ®PÄwêKs“’’½lçì§$?˜ÞÕÉêŒsö¦jºN±q Ýà‹*i‹õO ’©Ô´ìüO‹’œL½g†B[ß\÷eJ︻fós¬>+z@¥R3ó÷Îð¯MÎO©øÆXÊÏHâŽïóüóÅ=%1öÚÓ3þTjúÜDkBFñÎöģ̄œWà^MÚ§—eà‘s!c¢YËz·$<™Ùv[OÞè—3ë/.üFöÚ Ë•î¿i„芔'ÛEÚk\K.~þ8SŸ‚±¿f›áÌ´"‘X{ßPjl¸6ÉÌÉ]DY}? Úpú“fj¶n>ÔçÜ~1â=Õ z×c¨Ñ¡>jhh@Æ;ðÆòMŒ0mN6’1(SŸ»÷îº[ Ȧ`v…ÁÇv0«È ö–Ù¥U%)ÁX(*²QÊV쇎0œO%GP~{´‘L@ç¼›ßoÓÀ!í¼îÞ‹ñ:mŒ$ê÷®šÅ¦o8™á¬œÂ´ÌÜ®$Vqè3ÆZ訒a`Ço†œä~9<6úš©å˜Æ³YAgIg# BËkj¯Ø@N©¾^ã̼yäd¥¥©ï–™•7º#Þ¦‰2ŒÆ5k}3Çs‘†yv¾ –¤~ñVüÝ0_ RÉ7í#ÐÖ\e´Æy# ŸèœÊ'¹§õqºgnÓx[Ók"LÐxµ áññQWôðPC¿\OÆŸ:Àl¢M5®\yWÿþN°- i’ø ¿ivëœÚ+ž—gê© ZýÚ#·YÕ•%Ž¦dM‹+;€òì$ÛÂ1$ƒÐ»qì´‚B<à½Î±¦Ï½ân«CÑvNÏÊÚæòjÉÝO1²º“˜æã€Cc2>Œô¼†«áhÂÃcâqH‘d‹³_4°hÝÓî ÉÔ€3¦0”ÖKüuX#Nßñµ·yPVUœ„VAÅ´~ÅPu¦‰6ÙÂ10'·d­ï"Î0ÜRÝÚÅ'®œ‹Û¬ôóšxŠN褻a~êˆwb,Û†ÍÜ0W#é[ÞI¤^v·ÅapÏz€Ã 甌.‡™‘|j;76¦GWwèæÞØÈø.À%ÖÛDûÆŸ†6æôYCN¸ðŽÄ”©¢lÒ…ÊûàŠ6Ñä‹C¿¡¦à÷Zp€ak¸ìé«-»5íÁÄE8lëžì_–@œM4?Mk¢‹$´N Ðf–µ>f®† }ø¼9ߪA@e¼•n^3¢XÞÈåÝ2!á®ï¬_“…6=wäåÐ _ø6íüc÷”°©ÙnH’g™ n·=JD©}ß9"Ú §+(¢®¾ä¿”~±ŽíÊ ¹Ö„¨Ã-¨ÂjŠ¯ëá ¢¸¼è.¶C(k4 ¦ûòU”/Ÿ${ÛßBý|4/«ÀX®¢*è9?wëJU¨Æ¢{ow,Õ_•‡™÷3¥  €Z÷í4/Í Õ’f1Œæ¸;þJò茞=iÁa¥èÛ«ë[ì?m*ؘ²×µþÊYkÐæÃüÊ·jHHJC7úz[<ÕHÞÉÏ¥4ûÕ•Sˆ3càú!!7Í°G›p«1&¿#Ìö«¿¡]yñ£yw„œßÛ5!¯“=1/®]·"µïßvŽŠ6rÝ/ëtСÏ÷2£x…ï'ó‹Î)ê°ÚMþú¢¢ôanμsšÊ¦©€‡5\æ ¤¾#lFŽ%ÌJ“Œ”nÍXib¯f7ó¾¯^"É;Žñ±n´óEEY¯X?mˆabm, çn×ò_.DÆô·¾//)ÊÉÉÉNÕ@+§}Þå¢Í%gÒ™«5,~hxËÙç÷‘û45ÐÜÄIZÜf¦B®Z7´\5^8£Ó-àØvõUëÈ!ïìq†óáÓ›«`ÒNIéjÓjKfN×|nW¨㧕 W?#2]嬀 XðdøÕ58ê`銣 ‚òvtÿüXŽ<\¯c…Þšw ¯i<¹žèçl¼IPÂêw-×ìk6z§ãy|Þ‰ÖŘÄׇosªš¨ˆ>p`yôE†¨Ö:%kÏ÷²?FÁ¥rR(N]/’pmlU´¢v×ߦ›"MÓf27ýÌÕ}£*A´‘‡h5/‚¼`–\8Mv¾Ìd\á°»ôO©Ä 0¥¡ óŽ.Z;4s¨¯R- XyÊG€6'a.s骀6ª¤¾µ=—ììì]¼KšH1j¥ Ö¼/î­NÁHÀÒÞDëSp\B#5Òë‡@AÙœl°Óæ08þtÐý-I´ÁáËZ„ŽÀF˜Ì2·…³¢ÍâBÏc2xX”¬£‹¥5|Í—|Âý1PTÉU5¬ã#PÏC¤Ý´À eµ…ÐfÈ\^9âËþûs³.«ñÐfBf߆6§&ƒü×#ÒîÙ^¸'rû0×z¼ÚÆE›áºH"uöJü³êÚWï^]ÒR4M㣢NŒ^Zr¬`FTi»áŠ1Êá& wä0æÃÛ@í“ïcH(¤}`lPìë]eÃ$Úpá"¡ù Ú°èwÝÌЪºÑ…5/ëjžækqѦ…‡6ND‡ë üãýâš¾ƒ6HõƱuÐbÈvC‹,‰¾Ú¼ÉÉSDévìëû‚7ZÞ½n©>1là(’Óqé_­Ú'•©C¢¶Íf NÁ&S¸nÎŽÔ?é+=zh¥?mê"½‰VR¢ŽßÛ¦iFhÛŒZ+(_û´ÚšŠÓ1ŸÝº&£6€ÂÎýN´iÎ ÇkšNíòm›­w‰J˜ïØ61zh£ØjáðmNVPÏ,.öÂPv‰o÷Õ‡'µ ]/¯%=Þã¬`œ*&öm›šxF‹oÛüÚ0KN“œÛF°DõUï”r\¿TÛ†k€6K~%Éõ"ÚH*8¨zåWÔ‘V)BS!#@l“ÆbÍdÅ%ŽîÃK¿‰²p‚þµæ~Ú“îýñò;mâ~—)·qJªÄm^`‘„’¯3¸ {}ÜŒ‚ºz_°E„±Z”]0´¸'uQ•ÞW†ÂQžF»ÃMüh‚Õ%FËõ“» Á†… [’œnØ¡hÃIs€‘½Ë¯pk6‡ËóÐFzßiœŸ@®‰uYcÓ/0 &ËýäÐüÔ´YñD¨øUðgñ&* 5Jê=:Ú€‚—ê…7{é nØÌPï²^>µdb`p½Ø/‡¡ÍJ£º¼X—ð}š®’ÒÌeÃ!hca|6IJjx1}gï|¢ª t?Lò¹ÀZéÌ-x$*ÊS† ýJù’³×‘¦Ñü°L£}Ƀ#)µ‚”ïëÍT%„v àMH¢Méh?ë»h³·ü&Ž×há…sÅ!·áKo˜®M 8~ƒé§å)Â}ŸS­•)WÖ$ºû-Ï®«î#ؘëôÒVÖwÏâß‹kZ0³ᬞ¬…·HÚãŽ6>‘hÃY}q]e޵ΊÙçAr(›Q¶ô¸ÍÈ{yµ€YAKW¾½~òºïhógÅm¤£ x.{¦E…2pð¡&'xYÀÈ@lŠçG!P´¢ïEß´4T#›ûo±Ø³õñ *+À{±±ÁÞ6H%(•·Ó`mæ>p=©ó¶ÖúŽ—©‰wNkcð:ó‹"kRSÕa0”¥wh|ìm’ ÖùÛ¶¬ {IÆPqîÞ{öþN“)ü)çðŠêÊp_‡[ Î W釢Íø‡HÎÚõBÄõ‹êx O?}Šg5[fßm¸Ê™â£KÐ0M¾}É“ŒT òõÀšÔ‡x $^=,.-<À^÷b~ù]},É.ëýÐxùQ=)@/ž'¢q$e«Â-)Ö¬ZHlêí@GóÙ/ Ñ›ôºvsKš'5Âflº›ÕÍ’S“œÍÔ<©¯Ìôðæg«Fv¯º¤¢Í“›(²öÅ‹^öïÈ´mxTa‰%©û†FÇܺl †4õMr°rÑ­yÉBÃæÜõ¤{7ÔN1àšÔ«;6h<%(216ü¢&JÙöv5˜jôÚÌuQØ3žbªÆ|l0‡£ Wánè(âT-"¨öš¡7¼¡)žÔó?QóBÀ…çÝ;lÆÊ9cÅøô½¤ä+v84öÉ׃^BÚ‹8wJSGÏÒæ´™¾.5õKÛâIÍÞB§.­gï•”œxÎÚA2j]FU&Úph±vhM³àoŸ³Dц‹D÷ôñ½ë÷¨QÁÞªHåàü™kRŒ532IÏüæݸëþÎd&üYÏÐæOY“Ú[éNOHÜ‘½ïksôYáý$jòƒâʉ5ÁË'9ŒÏõ™©Ôää”âgoVmZi)~N¥RÓrŠ¿LòWBÞT¤ƒûmØk#iéã«;í/Š“©ÔÅ5à›[9ÛÓéi_Ç6À¢—‡>çg&'%QóŸ¾Z=4Šµ>P‘œ˜øeEÌãÚ˜éÎˤÆ'$×|á,¼Ï¬†rþ]lJ‰`6à°§ëbSË„ï'šl«ËNONÍÈëYf÷½/Ì*ëäÏ•ì»ôÆL®MÍ)Ún+[þ—œ¿Dc š`ã§Z`ƒDjæÃÆþ%¡5R~[%fí5<ÍKJLzXöz‡ÍÙYÊÎH-~׿Þû$!ç½æ¦ÚŠ¨y™²vÑm§¥¤5p™u¸#õîY·ØœÇu›Lîp=ÈL-ä¢ ›VV˜þ¼i’6´uá~ÖÒà#î &¥TóÊkz–˜˜Ò0M«+Ë|üjDð~Þãã@[ãÅ™ÉÔ䬾Eñvmô&¥d­î‰0Óõ¾ Øo“’Vù¶“¹9Ñ\[m¬È£RS–¾^qŸ{k2S’’S³êZÇ„2¹Þ_ÿ CØkæ^]É}*5µ¶oµR¸ßF¬v®AПœ;» >´ñ¼0;‰šRÖÐÃ)R@ë÷.íääÎTIV •šÙ5Ïk&cùuy!Wh3ruLlK•ðûÆDGYáƒÔÔÔŒ…ﻦ=“N:>1µ¼Î$ÓV§ö‹©D4·›±56<¶Åâì.ŒÎþ@^öÎÂÐØ,ó÷© ÷óìôØìÒöálfÑ7ÆDÙ4ʕ彿L[Sg ðD‚–Ûí&ÎX¾Bû¯[ ×áv 뇲—qÁíÑ,‰6¡ÎXËPàfɾp¤“ì5c9'¡º]+?ÏáÉ*¢ñÿ±þb¶ÿÙîŸå÷ÜãK—œEÅöÁ9 3ß6g÷œÆÉËõÛf³¶‚2N]G 5 †&˜;\]¥ Ur%ÁÇŒBĪ@áE¨ªëß,íL¹ÜÿÖ“= ˆ^ËØÆʇF)± ÀYï‰bW<žD&“UÉD4ƒÆŸÉdIÃmJ#h+d9Õ Nç-=̹”£÷‘öñÊÿ`ÜÖ~ŸÊ°™{çl°n‘G›µþ< ¡©£§ rJKÛ«ìÛ_' ›íš*j`¾=¬°eã¨ØK‘8ûIbÄæ 6›ÍæÈÊåÍ–áLïá1¯æèÒ-þ‹Ïào–üåš+Þ:¬QÚû¢  ¸-“&­p¶ŒJÅ®5¦C­ó$8#Úx¶´÷=±Ãá”Ôö°e½¶éà#2ÞV%;lÂ>¼Ul6[“|,ŸSzeß)ëaðr±·±ÏÝ—íaU\¶± Èbsh •TLÌfß ™"i Öz+ PŸG] E{ÏUM±«h°V™~…ÄÔð7Zw–ÞAàuj…9zØ/ÝOþ¹QlÙõÆýã|ÝžT.Ñ×;4•õ¹ø5œf­|ÿ±?pöñêox5#~({D¤Ž¹çcKpj<œ·‹Ÿ#!„ËtÙíùóbXóµ©0‡ÇaQp”Sg²P¸ɤ­åDœ#chîL`Âà»LÚ*ÊSø-í¹cò?ò†‚Zôû–h«¸gÜç»ë@lBù3ÐæLJ° Ë­ƒr)¥Fx™µ»˜}ÃKÏ(0æn×¾ìÚñÖ‚`ñx,cϽeä]á54MP7¡Vv3ùGO´9ñöyb *&꧿3ðцû)=Gð¨jÙžK u#ḵ`-=ot.ÐhcÐ3?vÏÛ‰D‘ ÝÞŽí 6ÂqÖêÏÛè¢Ðh²Îé‚wÃü÷²­¢µH N3º¢§)ÝDm8ø×\rGŸŒA"Ñzv~ÇWe:Y¼‹ôÅ®›ž–X š;oº…¦ ÷$ïÍwßò²ÂaÐ8²~ô£¡Äz£õo´dŸ†ê¹ä9aனBè`Ñ×µ•ÜâZÙ2ßzåûwíй®\5¤bèã9kæ4üÿ÷z4/‰A[Ÿ/9aP5c×ÚAÖ±÷ªR¯jà($ÆÜãz¯ÀJ¤}ú›šÿÆr»Ÿ6 …ѵ ìYdÐW†HH®€a0˜Ó)/Af¾y¡G [ÿ˜ip»ÝÖ¤_9XáIÆcp$ý´7Àé“ g( ‹Ãa1XœzÏ&g±§U,êŽQ|¸íèrí1דºrš˜:ĵfД!1¹.§`ñž^*Zv@DŸy=¬ÒÜß~ɈdÈ7/K|Éêîs ¬Oõ<±_d²6‡ÊÉBÁ§Þ…ÕÍþ,è?à)¯»‡GFú?S”Ñ)-Ó|´qT#hX&•¿ù\›I†ÁâêEÑ&ë’*å`{çy´‚òxµ Ô&:Ÿ ¸IáÆr•á#cÏÚ¶þ¡Ážx7ŒYøZáåþ2UäîÓÏ\ß¼ÿÓcC(äÆk`—æ짔1çCÿØØð›û¡jšD˜uþ Ú6~y;Íä‡ÅinêûP‹A‹;veï\ؾ uŒ­êË»¢«bMåe˜k³@ªx¦Ö u¾qÂA]ÒÞ€¤\Ñ&깤”6 ŽLÓFrrÚ‚ùvw¬+¯þ~KæãŒÖ`eŒŽ£Kd{OïÌ ;˧߼TÐ*án¼7€"®5~ûÖTA+¿ÎsØ›wœ Ôlƒ:‡ÇÆFžQƒý“<}긡„ Yy%ôOÎ/-ŒQí‰dï4`crWJQ£vxzq«:;©^f$«óm}Ãc£Ã%w}0Ö=«@ª)S]"ÙгöëðâÒR[U*Ž«fìÌ º›PÜCr§¦fi,ÎæL×­°kŸ§À›˜4˜‚è´=à4´©÷Ç(Z>ïÛ¢¢é=)ÛJªœ"•‡B“ ÊHì¹ÛFW²íÙhÛ°ööè¼Vt*–ÝWššT,%D¸üR »Tøal|¼óC…•…&„âµvˆÊôf(ÁqÖás s“ÅÁpƒóë,•áJ׶±§µl“*¹ªñéy* ÍnµÖæ_»›æO~d«hW¼>ùé~zjvAùèŸ)̽…„ë—Ë»¶þTojg¾ICù <2ÄG›Ý¥¹‚jóäßÛl"©à²Úç¿–Fà5.sÙÂZPÇSbânjœ«â2s½ûKjYKÞ?œã§¤í´Èi®ª ÷Ø!¾{KCÁµ°Cˆy ³KL –jÊÄ ! ‡¾6ÙÙ›b³€±*¶QÖ‰oâ£ÍYU£³7˜|Ž~É^ÇÖ?…-mö®©É{>éÛ¯en™ÉCeüýA~»X-‘'P6“t –"ñòka{¿<:'‡p5$ßB ®Jj¢‰ŠÚpDÏÜ=­ªpåñ _V™ÛÞæê®× dƒþ¤ R1ú£0»mi°ç›¯ë¨Øîç©`tßQTqœ¦^ÕU×óY¼åÜÏ@Ñ=LMÃi¸¬†ñ)’õ8÷­=Dî¹jC !2Lèæk:P‡8°›’×4D›l¦àṟÖø‚±7jDÀß(â1ï ?%¯ñf‡Ï§Í×¾ÿ øÝX(EÉk·óNlO4«ááí‚À s„€ÖÅÙ›3Õ#œ­à·bµ—BƦ¿;}ø»º€'•.’Qo}¤Î‚¨à -ÉK¹öD*çí0'/TðSÕ|λne¤¥"I1¾™ú¶¥g“y ¶ÃlÎQ}Tö—{N£s4ÁMo¯ZÈ©h3"Keú3” ‡·øÙyEEáU F¶ùï’ç2Ù u-ëã Ö`ñ¤ö%Î|wVûöB÷cœúÙE&§½üVÿî¶Ø°ò/:b´ o„ß)2"ˆ¬ŒŠëxü­.‡Á©éYD¤OlðOˆ(,0?Ôe‡éˆ$pèw|´qÀŸ¹V/˜/˜¹¾6ênWYÒl›îÊÛX,^ÍÀ**ãñôk?n×ïì^cN",F#sÞ Ñt»¶7"ÈÇ‹Ò`nœÇ@½Êû…RÞ£+áI‰¡ mùƒº"¤`R¨ô S-ßÈCF¡8Ì%hZ¸¦–¼$yÞ¹¥¯F°8)hOx˜/VËËèÃI ÖÔv-¾øI¸‡–Õ%ÀýÚë5@á²?ŒÈ||Ãnù é<+Ck…rqÛ@ÕÌ,$—›j/&Àq@ÞZ¾`l…ë,â*@´ù å(,–ÞôÖ{Em¦Ú‘0(ÏÛ`›nG„ãñ.©5úœ©6<¯zÎæ€:›òü›Ú|gµ£YWFR¥€¤¦¦FÄ"ÔãxÂEÏ4Ǫ^~$ mÆN£NV¯ ÁÉ ïl,}¨*¸pF¢u/ÍÙ“:úÊÌ-÷0a:¬Íú@Г*¥2™ò}ÞÒØÌé³Pù€ÆuÎN£ÚØÜ#ßñÃw´[#Ü•ôƒoÜؘêëšc°øêÐcC¹NþU‹ÒІþ± ‚ f<¶oû¯ vº9œ‰ÓXüã¶Õö|gÓTî×~C´jç §ø"Á¾pB¿™.8Œíò TT\TüxG6/‘õð׊âìk~Îyè™ÐŒ=qÛ¦%ÞV‰äXÑÔ51=»´¾òð4D+êÝ~”øV“ aÌ"[U—ËRÑôoíåEY!¾ŽÊrг7rœƒ‡÷EÐfÆ µ¹‘ò¸XÐÜ¢âGÅ×ØK®p˜ßóýW<¼MÐÿÚ,½QU€•ÌîKWŽ‡Åûæá똣_ß? ú;™œ:… ¼Ïµv®é¨ê¸_.)Úg`QAQ7ÏãI½¢¡ãU!8óÉ¡wä@°úý+ô©×Ù¢./¹æ–ôÇ7Ûæ7Œû÷fëš®ªõÝá 2xu¢µ'6® c'Ú€`x§”6è³ÂèT´™h+  ‘÷K„mzTRRÓ> Ø6\´Éï0ógÐFKððE}ÝK€ê^µõí'ÊëˆÒ–£\Ý–عbì xáŒô™}m NŸ¹šÛÅù£Ñ&ÕÝJ×ó&KPÙöÛK ÚäÈR™ y”QÿMÐ )“Ï»µƒhcKp,”€h“Ö*cÅœñN@¿ à Ïfÿ‰h³7Z“Š!©u,²ø3³ÏXùvð…} ž|ȶD†|® ¦èK›šðv…yÀÚýã‰2sßf ÍuÆhwggÿÎÅçø“¸òYºˆY¸r‡r-lðg%X ¢-DG¢o®Ð“Šr45ó½' mØ@-ûrU†9¾ÄæŒËBz¼¡’qj»p,X,ˆçìDi«§·%5ß ~Г‡JÆÖ )Z.ºiW°b·sÕJ÷ôå4™hÃblï쯑mµÅÂNèp§ùru¢šˆ”0é‚­P\´Ñö* l“aáM e‘fîOx×Y²²m`Ü—$´KÜ„fU¸«ã}S„ aKãÃËÛkƒõªhhéƒ/ì¹³‚ßý×GD›ÕÁîãO¿1K-lÚ.ç¨Íòl›CІý}OJ"n³ÿãÜsŠ²üÚyñžÒyUÌnƒéjïÇd|ZÕD®‘zÚw1¾áö¤XÕWíqö ÁjnO¬íI2àI5ËR™þ y¥nFà=ÙØà)ý;œí}w@°&õá´Âh“#Ë[ÂöÍ~ÉÅAHïÖþyžÔÂ.g£CGPÐÆ`\G5zØüM9ãmB1ä%o+s±ºâN6ôØfCÄžúòîe/3Òb é$üÆ ¾Í3ñüÉÄo °ö¿Xbµóºñ¨¹r´¼êëe&g»IMWÂóßâu`×ù'£_Q/è` Au‚¸:NÝtD‹Ýoæd¥‹Ù=q›z£Í £[<(Ð⩤åýG6ÚpªCQ(Ýwsü_JÂ,týák–eßÇöÝŽ‡e(ˆ6ÌÝ¥âûÍã{Àðl ÏEZˆ­¶;ßu¢O¿ÖBÉżœ—å¹0gžj㬩FÖ›£•,‡¸f¢ä±™_ùQŽöLO’ÿ GhÃéyâ…óÌôQCçŒ – e<.†6¼¦—U_¦¾ÓŠÖKEÈá²;y.µj`‘±Õ=Úœ= ïÁOÃ>ó1†=_‚" m–ÊÑ'Èo@~ÓæÈëÐ~Çg?™ê—¶Ì‚6þšáüêö6fë^¼˜\gq~mx:ÍzbÅhÝ.jäßAŸK ¶GÁ ¥_ùœÈ¿f‰¡—wì3¦>Ý­)ì£ÿ¬mÃ^èjzñþ‹ä¨ï6GË)R °36ꈺ÷Ú!*ÓŸ¡ A¨ùðÁ¶OE’í%¢2@œWÚ°Û^4|¤ñ–u«.`¡j½ Pìúh£Ð@±,Ææ»Úêž¹?÷´ÚÎÜüo e ” Þÿ›¢Z/­ýÚ—"}’ª®‰™:E×:­v˜oTÓÇL'Éf>¼—ep¶&_àNZú§ |PfÑÒoÆ`áC¯Ó¬µ°$-# IÏ:»¦Ô¸žgwŒU‘d-CI'4­‚÷ôVÒYM9ÖÐ'a­'Ï”%è[Z˜ø§5̽¿…P€9Fär«÷6U6 |ädnfieJ€ªœ>OåÉû²=Ôø2`ÿ¤ú¡°®@ò½/¥· É5mn-ÚH’ÞõlÞ–¿‘¬ÿ–§t _©Ùóåõ‡vy‡€™ÛÙþjxŒ‰‹2<{¥kƒÅ[Ùœ u3Czzz†7‹³mO駨¹Ò¥¡ò÷Ûukàr1ØxïÞœñ)ÀÁ¯®oaªÇi_Îx#+JÎ$% 8¸¶±¡ŽZÃ2õ5ÃUCÞmCU—Oºj s·š>d%àIN¥,‘¹~{¦M.¯d@Ùg!íq«%è+;Š Í´¹Òÿñ,š“4¹_d‡i㡪êh4öÜÕ 0—}¨ÚÃB› idn¬MR5ºýHðÞ±/¡ÿ[ÉfnÉùÿ£âÌSËåP3Â)(Á4 p¸Xã/ÏYëþ?ö¾.ª$Û{6|›Þî¾Í³oóD#±é¦#ÝÄ&g 9‹H4Q$ (Š (ˆ¢bDrÎArNë»÷öí&u#3;³;¡Ïqî½]ñÔ©:UuJŽ¢j¨¯I&+ùžÊ‡¥mqP“&}8¿p0ÓL’—Ž½Ù‰SY´§ŒŒŒ ]÷åg¤®PfËGYo„]öÇzJþÛÖ¸Ö ¶ˆ3ï&³ÐQÚ±}›´ŒÔN¼™ƒßÍÚ) p´4t>ÈK“Š•Á)PHRÒm3—Ôòî5+àv2s¼±I´á”ìÓئ»nI.ÿ„#Ij§²º¶¦î®»E‡>–Þ=ºA—iNÚIÔ¿vf¿¡ž¡±§ “Çsw¿RêÎFÛÐG|´7R“ñ9ã–…ÚFÖ…„œ 8Kƒá>ÖxY)ŠEZoís¢éɬ¹uÉÞþWÀWk{lôÈ/wÍšßš}ïÙ݇^ËÈn¼Ø„ 'jŸÓÊ|7P×\Ž½þUh†\‘¬ã–ûZâ®Û%lÛfZa-§„—GÈ-Ï\auänÄîòf½7g}|îμ—Ù¢w÷­½î}ÍNÐ÷qfíÁLîû´zîF)p7ÏäM¬Åp¹"˜·9Y rõfo2¯ ®oNÚ.¯ß6Í\·§’+´+ƒ5·V¯HKø¾Y¤e+Ú}ü_;G ¦÷ ]‹£Fjv-››ær¿Œ¨ÿgˆáalùŠ!nϯžÆïZÊÿ¾ÚL}ÄaNYjÚ4pÄö¤5JÂ{iºÙwŸ§§×ZòÜ·÷Pjã±ˇ&ÅçI¿jÖnN«Ú5%|&«Õúõ¡Íf1}Ó5!Ö´(š;Ó†Ä^ššže¯€`Í ð;Q¥U¦a·V}»9ül21}oÈæ×àƒ@Zå×ÙѸ_K ‹“``ŒÎæ Ã3ËU?€+opâ€t/øúËûßá°É/áܯ½yHnžâ>…ܳ §óÓ`è#c€Á¿¾›Ã‚?¾ƒÃŒ@#€óÕÀ—1326'Æš›`qþKÎaÍLMŒŽŽOÎ/ ®Ï@ ªæ01ý29=ÇáŠgßÊ9œœÀ‹®¯^Ç€è %ÐvÿŽóûgÁg @¨Yýán¸ÓÉe€¦øáãpþSà—¼áÇwÕà'ÐóO{ ¨éûïpØêÏàƒ‚o…«a{M€‰/øB¦¼)¸¾6gQ&?Œþ_QøSð Ì"‰Ïv‚_~ ña |ö#ðÃÀìW3¿c<öûývøluÓ…Ï1Ú_©ñaý:©(°a>`E#“ì]ôUhª†ÖÏúfPXa´øjbdHêJ2%ÄŠÿŽZû}›­™JlÌpá­Ìý‚áWMMÁG€O4EæΉ6íu >øðêÁýK÷< ?Pø›ç áW\ü<ðüèð™Å&x%bò%*°ð ‹.mÐ` àoIÓ/ÖÄËhÀØgvíáGÌáç¿y º_?øãÏÀ‡Ú0ÔoÀ¯%Á"{X³ö*lQ~]eW,¬p¹›w䲡÷ÎlÍÛf†ÐŸVÐde°”ŒÉkþ> gŒ#ê-ûðnCOÞš¥ö›ªÒÒç_/~Y=RLï#‡ßÀ"çuek"œ{’áçÇžðó§'ÀÍ#àƒWãÀõ¯ð—‹ÏžuÕn°[üøà'¿盿vÏ™¾Fà§?‚;Ž´€/DÂ÷Ü‚£ÿ¯àŒÅOàg¢ ˜á€‡Éh/@g1ÈF§¡* ¼~ýÕ_Aâc¾Âõ…ŸƒÿŒ/€ýšð¯Á&H`©ßêÑ~dïkŽøáàC hg¢…ç²ÀIGð«Â)è,ѺÍo 'û›Ï@%²¯(f‹0@ôVøá@9ÈÚ ~ ñæÀL3CŠí‹N…Vê6ûéð³ ßñà<Òü˜„ª6 þüKð™1Œ6rÿ›çÛån¸˜š§Ö÷ºùGǶ’m'Øü‹þîû}NÛ»ž©‰ÝA³î¼cL“Ý}¦õâÈç$‡ îÊe\äØæàËÃŽÆd2IYË"«½¯?ßFÒ2c¶¿ÂNO '[ïŸXâ9Dj3‘ßX<¹nŒ´W•SPÖN{ÐDcNm„–¤ùòÉ‘g ’/²mvÊ6ïþ!hó¸“în¯4¨N9a8eÝŽ ±ÿ?…6µˆ>ð{:<¿øÅoÁ›‰h5t-øÍàW#G@GbmwD’èÿø)‚$úÀÉ‘ç‚xääûð]øõg2@òW€@?G:ñ8®n*ýøú‚Fè¿÷µŸÿDÄMs‚›Ó¹l€ýøáÿüïÀßeÀ_üXs ÈÉë'Àó ¸…ÜQø'$ý<Ä £ $%ƒš)ÀÉ©àÕ0:p¹a`èh^Õ7ƒ)ÒÁ·€Ð4 ?‚£ŽØ=>Ìnð¿H‚®G€#‚9ÿ¤CÓ0V £ÊO%€Ì/~Š6TðÁ_À‡Èó¯%À ÆCž.aæÂý`%êX0±Nà¡äŸÁ¯·6þà÷ o´>NŠðë>~~ €4 üú9ð¡øÍ/àçßhâß‘—z½Ð²mX,ÀXáŒ÷†;RZ <5ã.k¹àöcØxUœ®ßAÁês$©ã5ëGÚ€¶ó’8esŸ»O_4ö-2«Ö£ XªÐÀHH.©ojz]~I#sô.ÜL#÷œ1TÀĦ®þî7ûéÒƧaaã2ßEØ—[=/DéaNW?.:쬃#iù…Ä¿X\¯dÍ5\“Ö}Êwá“îHQ Dî']z£¾S.gùL"çvˆ£’/ƒú_ß|rH|«Ý mêüѾs¹ ì²mœÿ?cŽóDìüüñ· Š "=îïh”'ˆHCc4$)Ã÷Ð"®>Ÿ!úÆ‚¥½ÿbNÑ@cQ`a¼(ãpß„:/ AܯàŸTyÞêÆÀ#L$ÃUHj¿?ŽŸ) PÊ׬ÐÉËÊ `??ú, ãxWœÑçü©JàÇH說¯-Áž½àp.ú Mj~ôKÐ8 Æ+ÑÞ‹x¡ô@@à)$ÐøÅ06BºÁ½Xøû4úÉÝ0ª\}+L·ùÈ@_wüÖ*ï"'Ð;OÃ?í4æ÷9„Ï ˆñé&ÊXoä(Í>*ÂÌãkgR+§uÎ#\ý(X5aXsöÑäs ±¤·}´éHܱ“”ÚÉ÷é' mîz±nWIuyI“@ŠËh©«„„~-?÷Æ,ÓÚgØ"fUkJ¼0ø&t¯…*IV×=Š'òr”¨=X ÖÞu‘ ™¦ç>È;°;y—¼…ö`Ùƒ÷E”+aמ6W<“ú/¡Í–åÏËh3þ„ôúþq}&79sà_€¿GñÀ‚nðÿ>?ùè™ç£Í‡¨sé9òúsX“ï>ƒt:b%îGûÎÿþüéOàÃ?!ýâð„ÉG›Ÿ‚z¤p€ÄÿÁŸWs€ýE›9Áfì÷I c |ò ð ÇÛJ»ñ*´ Ì^)Ÿ&ÙOÀ‡¢Eúáÿ€š1>Úü ­ÔY]MÑDp?…§*µ Þ þþÓ_Â5‚þ~…h#nW…¡ÍÀe¾ãåݲð+Ϲnk‚6†¨!‡6Z!HíFàÉôú™6ÞvF”RgahƒTäÂ^øãO0 {n#cˆ<Üm¶atëg˜èAj!h3áC–Sq:SLh AVùéŒ6Ûƒ®!:òm$è§6ã@]€B÷ÊÉi¾]±ÉÞ™W»•qî±7{ß5Tæ“©>—ª´¹GÞB}0»¶*Ò•¸mÄô5¢MìÎuh£¸xm&ÀoµÚœñÕb9 þò;d•\p>oßü;Ð9ËG›ÏP)`¾F^¶mºP´±<п> a6ÿ:‘;C!´‘ü+Ü_®F›MÒt;líQ°CË/mNÝB{ZQ8¢¤I€#'A| øý´ùu~Ì…ï‡øs¸´u“ Ú þ.©ókäï.¾n·¹Yƒfj{ÚF ÇÁÏŽñßsCÐÆI¸nÅçÍ1Û62t¿Ö¡Íþe´Á´Í±Dë6£{ðX}Ï#‰çÏñé|¹ mK0ÚlS>"XTÜÚ ¹¶¿Îˆ9¬—0v>”}§ji\pòì‰JËÀ>ßœŠÝN•u©V[B&kÙw:'?À^Õö ƒ#Vi¾Ú‹lø.âõ~º9´aY¦lPO¹àÌàê ʇ€Ê_àï:è÷)dÑç×ãl>Ú|ÊW‡D¡ÍjñˆïD%jvÌ- £m:¦QÝf-Úüfm˜LøÃ):]yp”Ý)h¡h#påäµ>È îWkÐæ_«ÐÆy5ÚÔŽKAðwl_­Zss€… y湸Y³&%m P%êË¡ —ûÅ:‹ k­l!±ÛJ²e¡Ëmý]¶(y Цu#´a%a´O?(%\.q%ô~´Yçt“3Õó*ØQ›D¦Zzœj,o­ 4¨L´J| øeþ]™’”t.lÛ[ôÔܹ7§09Œ ;ºíÁ<ŽxMêk¢Û–ˆ¡u;¨¬Ñ6°lo mx€L þä?YG¿‡z!èNAl›¿IEàÉMð9²»CA3QhÍŠS‘姿ÒGà\·@×›ž7‚œ@𳟀ß VbQh^¡Qìmð1üQ?Ÿü ” Š¬û }8ü¹.ôuc´ R‚_¼ÁÄÐûÆ„þ(¨Cß65Ã`⺘u<4Vò?À¯~*`‡àš&øù/€¼Ç{Цû<¢\}ʃÑG·é’Ÿ9b¾_<´þþõWÔ"䧞 ©*(¶ÏïÓQ”R÷ÞÚ€ò#Ð|ç>¿eÊâœô|®qE£ —3÷üáƒæ‘u+Dì®Ý:FÅ/Æç7X“z}JS‚æÖÁ- 7Þ†÷à)ß·O:´ìû‘„Ç«.¶ãóq˜ío-\5ÏSüê¾d þ…öÓOMA.b^°…})ƒ?ä;a9¼2KÊx‚BþI[𻟡qÿ¶äעߡqüï¿E¿ÿâÀì(:ª#ÿÆG›—hØÏí(Øúsô5¡NÇIüÏÐ/ŸáC FÉð} E›Ï‘"=GæÞzCë߀_ÿ€<çöˆ¬¾>@`m)A*¢ƒ¾ø?d9æʨֻàïü}q ~ óúœÂ[Gþ3+Þa`:ú*‹,ÉU#¢ýì4øçÑX?ÿ#pˆCÃdòV—,áç]H×ù{‰Í$áWžÇxÖ;ð)ŸÛ—G@22çÕ ã9^E¿¿Fø_ì€daƒèœ[àgóØÕnDïz7±ÑîS$ÙðZaVº·† í}ȓÿOqŽ°rÑvî# Íþæ@ÆÓÀÈYCÏ,¥Ñ2Å@ô+VJ¨‡™`hf¡E#ª»UÂ3Zbÿ)P€6íWÍ?£_‚WÀ›Õ·üÙûæ„(s w£­A°†éc©€—76³ÐV"«:Ülãk:CÑnæ8)92KÕ9UXÏ«]mZàv½M¼þU¢ ¢sØË“Þ3›* èû †³yÁ8è|Ÿ‹,ªòâòîºåûÊlþw ý‚ÜÐa0—sg ¯ßWÝ3_UÇúšûÌ—r®;üÌmßþúÁùÿÈÀKL­—í<Ã'7Ø'?øÐÅãPëè"ø ÜŠILß(|€#PïÖ5ý ¾Ü¦•$c5ô5õ_øŸ93‚f›0ˆÙ;‡žºìõ«˜ÿÏs·:De_Ü}èÝrÉÆãäÆhãä~FzÊGÞª˦˜¾Í3 a7-£P·GÂÕ®è qf» X׉•!7D‚•Ã¸ð®ùÈxN“0îV;¡å\{“–Ðx›c׆Ÿ„fÍ ÕSI*9…f>çK%%–·ƒu<\oÊ{ºÓ7j¸ÌK1THXU5eyú±„;ÌUhË“Ì5)*šZªTŠŠñ¹ûý|ñ¯ ´ÑÃ+¨êéj‘Ié“p'^*ˆ ¢+’4uõT)òj¦‡S³uµ”xš±…µ³ò6­c,~ç`ÍõéÊr¸pxøºå¿TƒòcÜí¬Ô šÖE#h—šë ÷¶')(èkäU&Üãåÿ6óÈçÒòuÃìùö§†ªx¼‚á.‹°§ãé~²W‘‡‘2I×i‚Á!{w” tÈòT·°\t«jWþ |E|¢¯ôÜ.:UAUSKEJ7M|ˆ|˜l `%#N§ØY;îqsR¥’\3f…A¤Ðè¼.ÿ 븖‚œ²ª ¨à{<R¤nÔ'SȪºVŽ^Cÿ*e<ÄäŸü£Úßà‰"EŒÁVêá Гû©åõÈbÖ>-"‰¤®kàx ìu¼éGT÷Ùe€™sRüØ.¹€iG‰ßkƵ‹[LßL‚/½•Ñ}†œX¬É–Ã*–tNw|´aôÛèhù§£G/_^ "´ÛEå¾t’Ûi4•éF]­«Ï‡ú_©âe®´¢ŸÄÛªígŽ¡‘ˆJ!ÖL9¨SfÀº ûÕÉ-D«aø`c¯s¸Œ¯ Ý—P.YW¤ðô×ýs€ÛmH$%ótn«©ôΰ×èiEfg FÒaóåÝ›O:fÅR-¦o$±’Mä´N =‘ì·ÛÀ!š¹ZÃ`¶_•0åÏ:¦¥¨2‡*!Cö¤-Þ%S‚ Ô9K-ë`øÞoÚÀuDÎ0à:v•$”Þ³´!EÂ× QǪDò•ªÁuú¡ˆè€ï¢BóKâó–3Úß;:³X#ötjH |e9kmÀóó†£Þ‰‘Çnä]°—Ú,µIJ›x™¦ÑÍbypsÇCI÷øUñLJLßxsÇcݯ׬51,ϤYáª$¢¶±™•µµ¥±™¢ð”wb–Ýái…—Úªb`}òlVU ï{VYÊ CÜvyUwÿ“¥/xLJhåÓu%D†n>²ÈϱÔG°§m¶Ð ôæäK éI|0ßè`dµõ¤D‚¦L®k.|[…6G5”ìóÐsAÌ7êÛ¥:—¡áVèSgø€²mÀÒƒ´ãJD¢¯ŽFºdªRõ‚64bÂþÑá‰D"9ïÙÀÒdwIñ˜ŠKz&DFsÁŠæQWÖòVÚLu–)bˆ¥Cð…#Þf {¢Ÿ þ¤„  ô}øaŠœ‚Jý̵ꉗžŠ]#ˆéO“~9‡Ü7« ”Ëv›ÉɆb*I>½rˆßá®É|´A‰Óôä–­.‰€/x»|Dwa¸)+‹ŒÃªø—®FˆÚ-¤qê'Û¯Ÿ¢ªï™@νÁh£à'¸ä‰1ñDMJ"½´:g:DØS…£º²Ã5>Ú@Ñwžæ{Ȇª—âJ3s]6³£¯¯“Iļ—¨+ìÑŠL¼Âh3ô®úŠ2UJ…þS¹ööݸ¨è`ᤞ¢Qø¥Õ¼åŠ@.`ŒZkQB2Þ²&^Ò¥HÅ<^ ×màrÁËŸ¼ß6úü™dÑËc˜¾t{^Îå2_Û_J÷Û{îåFЦa¦ýq §V»ˆ*ç3|I<݆ÃêizÙ?.òYeŠ_ÆCîtoÕŠuóöò³ŒaôW†b°®#|m¿ò¬ iïís¾Ê—PK„6;vÐ1О¹P³Mó5Œj‹ÞšÛmÚ„‘¾ùu÷Å0Ûd%v A0量Ýú|› zØmCÇ8x"†¢ÍBÃݳ$¢fóà^‚‰¦\=,mžö¯a`¨èÐäè°†„éIEüzˆï©¢7ÐŒÊB›Ôµº D/Âv©øžíÌ´À:ñ›­F›ÄûM‚Š·åÚËÙ^,ŒÔ3Nhäc™x&%¦o4Íu^W’‘>võegW瓬 I¼NõȪÛ4LN5•*à±g‹júª‹cÍÌñDòåòæ9Æl¨±¢¶kxKGW__oËó›ŠxbZEïÐë4ÙíJ—Ÿ5÷ôöõöt&(šÇC“¡Wgä%5‹›{{Æ`cÃTÇ#%2K°,Ÿ@h#K Yîoéîè® Ô”QöÉCMÍIþ’jñ«æþþ¾–7÷´‰R^©õPwxU~úÝ,¬qr [©—k{»ÇØiðц×ý÷)Zk;úk$Ò°„Dž}•¯ÛŒ¿-$áåSJ :¾¾åf±KžH-xÒ:?Ѻ´«öË;ýP#åž\ÑÑÕýº(ƒ£Þ¨œ wuš]pJOw÷\Õ*´SEŠ †{éÄø²V´ô´a÷ZðÞçoöõöñ®›dL·èSq‚nõœÀ+ÂbnDPrå¨XªÅô $ÞΙѺ"=E§jº·¢kþ6pOBFþN-¤¥pꮟT&a $Eÿär˜;笶s)RIX3yÑ>*$œ<KÓ±Ê~Ò=§ëqŽ­žN^GRÚ~q¹•½0âg¢ )óºŽôVΤ·†²QpŠ ðLJõH_Ç]k- ·Ë;n¹gÚmyb¬JÄâpT-˼§h÷¯½&E 5 þܱîÚÒ²8›”¦KÇ”IV¹ìå rŠÏª±8¼¦…geÛZùe» ûmn¨"G$+¥?æ‚™8{e‰”üæv ^öÌ-þžÁñ*YY¹œÊ¾uó9áѯ"ézæe¡.•£jYÖ¡80ü0–Š‘$ª˜µ–ù§¬ésYW‹´Åañ”ºq¾?œ¶K[¤¨/û`[|×­£DŒ4Õ`ï$Ïm.g餆s{Ùåû´ñc‹ä.±`‹é› 8Â6é‰øuƒK ÈÝ}`¸sÌvÑ0ÉC‚y„6Ÿ+1€Ü„oÏ[Yá÷~pEWù_Ï-mÚ§UÇU_DYÚEÜͲˆ»Žñ«’ gÆU |µke=ë¯Ez•Íˆ¥ZLb‚û{qn~úòa=¢^ÄÜŠ. £rÐÒªì¥ùÞ‰rdÕ7} ß>+{inn¦4Æ£°ú.(ãíÞ»‰«±Å$¦ïÍ×Eb·oÕ°?Ö3³j {¢ÈæC¬ï mšcL>ß*i”³ðmôٌۺjâÛ0²¸¬ö,kMb#±˜Ä´n:°þ;÷?ÑSVåñmë™k8$Æ1‰ILb“˜¾ä*ZEùVVb£ Aþ£ŠÖתþü›à~W<…n°ðV85X÷]„þÈc½•9úÆò&jeâ{‹6Ì™3>&RÛ¶)z•›¥Žén$aütã¶ì»bòò1ö·¹½n#|¢wéËÅeMöwö£—çÿ“rœñ5”9ÑÛÕ?ñµùWìÙ‘ÖÎaYŽS{þs¼þè"p_ވסÈIJI軲ʸhïf5>È4Q&HIËÒôŠk—hiìR„IVZZZÎ6ð|Ï *¬éž¤¼¬”¤4Ö54}xaƒÓ½ç<5·|DxÌ?H8Ñ\J•’ŒŒ¤¤¤KB ï×ÁÚ{fê²2R2²D÷°Ìø6®ï0â¼ÇãÌlÿcU9™Œšé™yæ&Òúâ3OX~Ö$»/6.Yÿ Ûmßl´y¯°…é¡Á‘/ç(Œû"Êq—×EÞÝMðm•QŒ/+6äò$ÔÒ&àê×$#PªM—Žªì:Íàó^¸›¾c$»÷‘(´’Ú¾™™éö²Š¤tØ#šîœ'“H¯{ ï¥'ñÔëèy¥ –JDëÐþéÙééñ3^Æ*ú{Ç 0` :Óiª®§†¦¡CÇ”Õ ‚§xÀR•L—“·?rŒ$­úŒß6sjr™¦{^¨‘ñŸ"‡|»2É’¸ kµ“Pý56T²šOò—cë7œ&ê Rn7ϾIOKmD…#·¯¦¦¦f_½Ý9cËLó³ø¨ÃTyRà™ÔÔ[èþßæç²ÓSÒÒsףǢ¹cµÉY×ææ ³“³Ëßñ¾5>+½˸ô¤qH€@}/¯dÜëaL´]ÉLNJθÿjù`˜ë»Wp9--=¿äÙì îxS‘“‘’šv±¼º‡e¬y©9¼òpÊo¦ðÏsq9Ìâëé%¯à|OîdÞ|1Zÿèæ…ì;L¡hƒd°8ÒVp93%%³²ebä–í6umcñ3O¦d\Ì«jæ‡`4ÝÌÍJIÏ*®¬c¯x!‹ƒn榤¤^Ê/îŸf£Q—&r³ÓëæêÊòS’“/>\€YÞ ±"%-çuçØrJë¢Cßz_äe–ö·VBùNí3ÒP™“™š~ñz÷´Ô_D–Ty6/|,¾i©âz‘†mW¢öÇ]ü6_êþ™¼²”Q–}áú«ñï ÚôØ`,"(yúù½ì\`Ït›)’• ¬¢bO»šêàhz5Ì…¶± 8ÜØ”¬’.(Ö½¨ÝD ÍëHÔÉ@7E¬”wò ˜O]—¤ˆšÇÍèV.'®ÀÁ Ã̉ J¾Ç¢Ã¹Ð°Rþ«y™>O5ÆYÅî±´H»~++jVŠp¶næd‹¤fdy8è žQÝ"dñ¢ùü‚#žHq ŒˆñPÆIÙE=D¥³FDPžs-v€Þ< ½>êbnF¸½çàî±O‘î|FGÇÜ÷D ˆÐm˜=Ö*ºžmtl”•®nÐ óš<Ýf>`·"•®s,*.ØÓŽB)F}>ÌÔ_ÇÉÈëÚ¸íwW¡ì# Wèð¿ÌÑzm^ÅÄ1&.ÚA_CNÙ²m§Ýš*D{ë½»'ݺrÎ/£vøÆÛŒ‚[±^ú; ˆö/*zU²Þþ¼«ž†O@pç8{ðÅeyó@;¢yH¤ÏÚ`v¯e †ŠûgÑtÆY ¹$D¡7Í I_2ÖçfÃ`e&™¨X=îÌìNS1¶´QÅdG¡P´A†Û6@›ÅX}Š^Äu06žÕÛ¦½œ5QÔ<’)øΞz¨¸]î2 7=–²[Ž¼aƒµg¯ íÃoß^Õ…r²=ÿ¼?™lû!ƒÐF…yµ'k5ű$â®n:DQýÌíΤ¨è0ÚìÂ(å£Ð vûþ§3ý<Ö£¼§x-Úè‘†Ô åiVQW[GžªÉHåö£=€5Ñ¡«„…цÃ<ê¨eã—Úm l$Cæù,x™a‚Ñ=ËÜ´ØÀjIóûw®äåæ]¿ê§!­_ƒÀç¢ÿnuç`Øn3ñ$•$GI*xSß26ú(¡ÍV’÷¿ýEö;TB!žÅê‘ÕççÛ^_•IÚ¦ø)nj°¹–E,/¹¢=T—ôG«TOšKee”R"è·X©ø9©pl9Ç–Üxº~ÿ<¨¼BV°ZÞÊÉ0•Õ‰ Õì°©u÷Á'Õuµožñ°ÔR yæ½x¯n³0òTUŽrolÝ÷þ»‡||=\lõw¹¼èßÅmšØìP;ÁßÄ;`‹‘%‰‘G'Gy>µ m²œå!X_&NVοj ^‘Àª¿~Ç“MvŠ—Íš`X¹`äü5Œ6]§‡ Íˆ­ŒìÁk}™ßŽÙ_Ž<çõàÝûÐFEoe=¯"ÎFh3s@‰bs®H ‡½×­´aÐ-¢®´£ÎÜ[mém±-ÐÓ[ÍmÒg7Òp»ÌedH«8‰'U¡‘‡61ù¨7Õšâ8qw_˜¨ñЦ[hôæ¥5¬k7Þ!]¿,ЩÊÂІô äu­e~ DA‚ro’s¾ß€Ž‚6«­ÄpîzgY››0ð4Vµð‰¸^Xt¯ì^€†”hÑT÷S/sUžH¦P­²ÖYHa´¡Ì­Z•P6`ìW¢àWç‹‘Äd÷¯Ff‡1‘|ýÕÈ +çî){i¢ö­Î9~N :ÛäÒ»—3}•BÒ4Z¯ó£ÈÓžeCùb”&Æòâ+DÌfÓB‰8¼Š‘Se[«ž^Rÿ^´y­…ß{u%°LT„HIÖ²ÁwV‹Í4¤]8 ¬¶mîpWØåÆ6…ÑfˆÇ_ÎíÃ4k_¡™Š@›…@ ë«­kÔ„§I‡ÉZ»¦E-‡ðGœ+ym¸̹èc76 §t(Qù‚µ.Zk›f$ìVÔDQãH–à;gª\i»llïµ’ÝÈsL(ܯ̸'~û¾GsBVK6…6"¢¯aÝ€½ì΀s‚žqÄnm‡©HË^{‡êìÉ.]eì—EQb3¤ aW)x?­¹c5Ú\[Ù†ìùñÚgw­4ð¶Gnr¸à½h#Þ€ls[è‚m¦knHêM<1+—œ²—ÓtyÖ=³¢Í*ou»5)P«.ŸtT3 šã‚¡'—ˆdÚ«a.Ûf,G8óx·Ñ'¼ÂíÚ‘åƒÆBÐqƒFÀE”·­ÀÖ›û…EOꃭú;¢›¿óhÔ”ÑøÑî®.½WýnÚîü“x)yíª´ñ¹S—¯<`p¸«ÑÌ><%!¯ÿf5Ãp&ër¯?äùŠ6Ð/åÇÔ¥õ¢ÐÜYÍF[? y>É­Í–“W¹×·Ì϶_ºtgžÅ÷AÌÍÌ.¢+òGœi&ûoóZ1öÒ€¸sc´a-ÍOð|ż:ª)¡'˜žŒø)â$»Mo†Ý6êÞw|±hͱßIÞË##íˆô=WxU`”‘>Úž ©œéñ±éExX* TÁ™]˜#šžÝ)«ô÷÷¡ÈèkXwf—¤ZÀCþšà™›B›«MìÙ^SšTðÕnÞçÎGçhx m´­}³P»Í¦ÐF”ØŒ{àe=nðíêÕiY9íÓÕ´q: »0z{7+åÆr×Jó¶4p‰`qsqnlb’4P´rïÉ´Ù®è-h ÙÞ§7¢Ù¥†˜kšGCÂñ$Û_aW"“#­·"04£Æɵ£e~Ôn#¨³}Æ»º”kÂœ¹&=2!"]àè)‰—£hÖ 1ÀL§Ÿ½ùõ稭§,ñIÕ²oqY_™î¾ ¡Íó¥ÕCQW¡ ^éaÛÔ Å†}Ë[OÚÀgœ~{vJf‡j9ÌMîÂìôÜû»Š6̉ ^ÕÔ!úÌÙà½V$yÊùçëѦGˆŠê¾Çbâ¨àôÜÏ3¹kÑâUn >QYóÀñÓ§Oê)ãŒ}SÙ¢uxµq¬^“,O7µ 6Ó¦(˜Ey-<3Þý IÙÅ/ÐÍÜP«œ×Š5ãïëéåíîlN“¬öú@y$—ñü+‚Ѳd¬½öcÕL‘ÑíJ—¡iè»yù¹Ù›*0ÎQ<…mþˆÖ&µã;ƒ6S —Ož/e­\MY¸•“{>ýyë(ïëâDÛÙÈÓMsË“œê²‚31‘Qѱ×J«Ñè“o£zQCºâUéõx(XL\~Y Ç è}ž™R)€ìÆŠ”ÓUh‡›é¼–~>::&íJéäŠA¡áñ­s§¡ìbr‹_0Т²&E½ÓÈ×~U…YÑ‘§N'\êY·sÎ\yØ}-+8—’ßÀßoȾ‘›SÚ¯!4”;k«Á›O ¦{ªÓ  "ãJÞ°{n‡Ÿ+f¢ûm¦\ÏŠ‰ŠŒ=Ÿö¬mjå~Æ`uæù¸È˜¸¼âçü­Ÿ³Wbò_ð­!óÝ™ ‘‘Qq²ª{øq‰çN—× f„ÆŠØÓ'ù²W|þø•ÆQÑW³mˆÎ§7ã£#N'd÷2Af€¢’Gl-»Ì+YóYɱ·Ÿò€Á¹Ç–UóFdî³›1QQ‰—Kgãt|øÕ.D&šÓâ¡&Kè˜c5ÙáÊã”{Tò#ö&Ź­ìÁÕÔˆˆˆ 9E3l°8Þ‘pætÚÄ”:Ù›éSíÏ2b###c/d¾äMp yùó’˜sÉcÈ)ýŶkagn3V í¹»hq§Ëò³b¢#câJ_uÁY€ùÞ‹g£!AŠŠJh[ÈûlÞ™ÈØØÓ1Ëš¿ÄáùE¾y1é‹åó\¾#Ln~šr6&:îBYMÿÊUŒ×wób££ã³jûùó2öTF|,”îéÓ§cãâNÃY¾þµñMÖWÄœIšã¬^Œ‡Û¥äJzlLtì™Ä;OZøŠãòAKS±{´ï±;l•M–¾Ý6ß5>Ì.¨åËîBæv›¬ÞÍDär˜oÊòïU¡ŽOç^«“d3^/ˆåâESƒÂk—Ä|ø¶k²ïEÝà·jà²÷T&KJá݃#³2“}õeUìúX›‹ËeŸ°Ü‰§‡œNÎLŠ±Ö§’Ä.,¾aÔU_³ v&¦oÞ [ÔÞÞ9vÐÇÝÝ#$2¥kŠ»É£ë¼0µÅéöíÝãî“^´|žALb“˜D€ÆÆ_DÅû9“˜Ä$&1}¿GPîüÔØà@ÿ»ñÅos=¸ã#ƒ£“KßÏ1œË˜éfr¾DíWÎ`/ ¼[`~åû@¾n?fB\7OŽ ŽÍ²¾`*œÑáÁñ†Xüšˆ9Õi¥­ @QuþmF–¥¼õñçßS´©‰ýËVåÖ)Æ—€.w1Ài?ê[dø®F¡´ù«ö„ÀÖ¬¯ƒÿÐ×UøŸ8ϽËÇ¥t©˜º/æ ŸË˜4VÞêW+F›/Šõ›œÌ³FŸ*ËÈ=XKø=I"’9nqE–G¸«ÆU‡!Wyë•“ +œ;®9a¹ÖaÍÚW¡Kq×Ôuí¨-².\Ñ#ýÊ·/ËùÕq7jQ²Âi¦cÌћ܇ïaäï·Ll,:"äD¸± ¼T«,g=&ªª½®jÑ‚=h‚Ñê¤?yŸŒs–—+êî¯÷AL"©-g—¤m^Si$‘€/| ïPšëxè³[‡@ *i[å=íôîw7£då‰$2‰ˆ—#»Âþd8 ciGÝ•ÈxYåà¹btC@sÆ‚n{ó]3šŒv|îƒ=?œtØU¦˜X*S+ÏhaÝK{_^6V#ãqd·°_½Ÿ¨¿åbL‡r7p ®Gcær„ |OÑ+ú:³òRŒ†4-èòÌ>d)·+Ý^ÎeÍ;`ÜÎÀ›ØÃœñ»N½N<°KZsß"`í_wNª­</¯ÛÊßÔpr—´‚V(šwÀ–,M'—òvgqßå‡l—Q.EOmpîZ¨» ×":]¸Ë‹1õ2ƒ#¥U¢û?«3Bˆê»G˲)œu¼NÒ“u.ê|š®M%`IªWßp™C{ñ¢®Ãñî%´Gl’ó•öº4,Žì–³Øš°cûL¨?¿«ÛÎó0sÙLÂêÒx{Én-ª<Žh}àìá6—Óp'A›†ÇUO5ö”xì¤G6܆Š 'ïQ:Æ`´yØÚ`E$¨š6wZ†õ—bä)O^U8Òq *E7`ÎôFxí¦àñÍýÄeÞ‘‡ñÊ‹8<œ ‹ó©3m§ 0$"Ls9œðn~—À±W$‚|á«Îô ; ™HUÛ•[-8eÊ.Ï ÓV$âåɶ‡Î"fz_©R°v—^øàƒ…¢ÿE^Æhã17S2§¨k_ÔÌO‡3vÞϪ»†ÅþÚÁ>C%|äµfÀ˜²Ö•óIhcÍ¥¾[vXe3Ÿ€sÕµµó`¢µPIFæDÞãÖö¶šŠmYÙ£`qºîÙE >ûí@ï0$2û5‰ú©u-í-u/Òt¼â8P_ê½,¥ú–¾ªiõz©á‚³ê[Ú›k«|u(y™¾ÌØEP18röFÏàÐ`÷ gÊû‹]Ð÷ц\²ñìíª††º‘’Ë®y¨“Œ„д¼ãkšÛZÞ„Zk¨:]€O.°Š£üîÖð¤K”ljH5ªŽë¹«ê›»8BtÀ¬"“ ·ëa¼4 QU©ôfdë.§5^JÁ§4Áïy‹‡mtõ¯#Ã#{ÁÛLÉóìë\kIËx^zéAŠ&&fñèyŠ þ:ž·8˃µÖAHpÙB^I;,õÞÀÐPݵ`i<ÕÌxï£æ¾¡¾fo=¥ÝÁ¼N±9ÎO>ÔÂÈx&–@øävŠ¥¥º,ÍvÓpaÞ cF›þÛöXª–Ïñ‹ýï†új÷«Jšž;àLma>öÎëÖ֦ܓ>:¦jÒØ€ÓRv#eü´ohdžé6r8’®¶}nEuSc]ÒÝxUË¡y}('ëèyÞ~^ÓÐ= µ§ð†c´î&HX…e56·4Õ¿9dI×v9½5ÄÒBýÝ#³ªþ¡1ÆÂaC9³°‚úæÖ–¦šL-iÓÎElª†J!«z•Öt ½»Ÿ„#¨×ÀN=\ ¨f>UuÍí­i!M»ŽYhšÆì''¡õ k`xfWC5H7™Yª6Ãc÷%•Ô76VÞLÀÊ‘à+˜ÙsGlÕÔÌö¿nhi®)?`¢L!ËÇvÆ´Þ/QŒ6_˜Š¥$4^ñídyÎòþû‚___v“S žY}*³7/PRÅb\ÐöÃW0P ³П')M:[ƒ*Â]YÞt»åc̃e$´kóËL3¬¼m?¸/<©Ž·Ì…swÄЂ*øs4ÚÇ÷vÏÂؽÓÒTíN¯ªÉ¼”òÃwó«õYÑþm|Õé†>s\ÞÜgýp.ìM™|*ék÷|u†V!Ý®CŽ@ÑVÊ™k¿B³GJËØk@ ¿uošÕž5×gD–Éjƒšrª„>ÏkÛYw¥ã•5BufÑ[MâøK'gѬƒÐ&w·¬œÓ Z÷:í’^PN>?jNv †ž6Éùú³î²ÚNóÞdsyŸ‰„¢ãØj´Ú]Rʤ™‚oR %õ`ÿT7ä‰>×ùl VÁH\€žšÎÈJZôfRXRä£.4TS†„¼æÛá0öH^žZÒÀKt¨DDÃ1§›êëæàs,6›Ó‘‚Ó0ž‡k5]#+mìo~g#¿3ì©@WY^k^™®…Ð&ôê tþ4øG Þ©Ÿo¯P Éç×ò÷E3Z5‰¤ÄÈÁ´þ,¹º¼„F_Sɤûí07ê¢Ì¤L‚øµf\ õ?_RÍoÔ!Iž©œã%?ÚxS‘ˆ£Í¿‡6;ƒgQ©v“—¡»DE„#t*ÀËŽˆÓ¨™_åqâZ°+AM+ô/LxTD ’´|dÝ<¸"!§ölwã.'ÛÏŽ ®v yÊŸ&%ÛÄèá¾óL¾¨ó=NLîÁI{–t¯1’Ü‹?DPT ãgyXMôÙðêzlàMKY×ý:[”Ý¡úH]µËP"9Îþ鯫Oiù^ƒÀgÒKE!âZ gºG_A&§pÕ).ý“­Ê$íZ˜iÏÅ<ÿ±Kžš’a0d¿³"´-ÍZ++݇1úYƼ{,Šd¬ÛXJ#Žª²µlÅf´£ˆZÒ‚`aÇ&9i¿­š?ƒß9gJý·ìסÕã‹ü&¨Ïµ”ÖŠàñ UÞ%§jy¸9£+¡Ÿ mäïÁVbÄÒŸÆ¥¿„r{„Ã+¼yÇKsƒ†›ï¸ëb¬­¤¤¤¨¨H£*P4MçÖ  ¸~Ü^ŽHÕ4s¹põÁŒ0Ó‚6¤Œ²n´Hî…oǺŸdRˆÏ#¨GFÓ#‘ödT¬A›®G™$’ "FŒxKmCgøöp4ù©®ª4zv¹7Ѫ¡ˆ_6›3˜‰iÚ¬8Ì;h‘Ýt:+=-¡´´ôŒô‹K«ÐæR 3EË$1 …JOO/ïg@#ìòp.;ÝÛ†ªk‘œ’º,-½â ˆôo3j‘ñ½ß³¦áîÄî'«èœM^Î.##£´kö=hc¼Â›–÷ ýÛNŽœ‚T%\¬sM $ç‹`¦^‰L(鄦óU2§Ÿ‡(úA 4é¨B̬fÖŸÓ£ŸxÀK!é ©iP9·íÉRBØÇmé‡ '†¯Ø“ÜV˜xE³Ž‡6zçù<é0ØŠËêX6¶0Úl’óiÞVšÁL>Ú0Ÿýœh'mVâæ£ÍÜ>"Þc…º†,SQhó@`%^6·ùNE4ÜÜbCYtáfSGÏÀàà›dœú:´á8}]ž•³ÏVÛVüÁ´ÇkÇÚd–÷ðÍ8<´ï¬L¥¨Ç2—óÍ̼ù¦k ÚÇ«ã_Š0Ó28.pxºXg!EŠZ.ð:Ó¡¡¼m@þQ‡O·nݶmÛ¿>W©e‰áä ¡ 󴎤aâÛåÕXÕ…¹¿m^žõÁëÙL2K)&“Å—:Ç îÓH7¼±+ìÆ|9[`·†6ÜXmI³¯ù"ÅíëY`7^ ëéõÎ ÒáBÙ­^“‚ZãÍC_£ÃsÊAKv“Þ´çI{2!·¾AoÖ›îÔ!î®|s“Dò@TîÛS&þ ÷ö*+x »cò¢¥T“O{ÞÃK¡+7DÉØûaˆ‘cØUèÃË' ßäó»hÁ™•+‡>‘¬ÛÚlŽóœ’£Ž %6Ê£Æx»mTÇÍ¡ 'Fgx®\ÀÖWüº™wíš”´iÈÖp”%+ÐMÞ1ÐÏe±>x•hcƒ  {qiù.¡Å·±˜-ôW¬Õj„P´©¯-R `ïöp·20LTZxhƒØŒeÒ:x àÜõÕ'8„ –§‡ú'ææ*Uå$s»Ð¡o¾ï…šN¬Û|uhšoùãð:OGÑ×ë¡zûoq×ø·½G݆=r§‹fèÁiUã}CÌuþm†nS¶bÃJQ—nÅá*&¾c‘h!QS”û3ÄüÀ¨ËÄHPŠÁÔSÕØy¨¿î‰ªTºcÇ $Šœ¶g÷7¢»3NíÓÖ·CMµ“OÃ)ÉÑf²ýufÎUØ¡"!Qººž‡È.ùh§Áw Ó›¥ al¡@¾S;™Y| nc®JQ©F¦>°‹RIÙB‰}Ù“Ò˜@ÑÔ¢“ñ×ëà“Ž />âlÀºM¡Íf9?ÿèä6Yõ{¼NÏì3× Ë*;mm Ü›“Œ%ˆN¼ fªsˆ8¬´!Œ6‹-ç1[uZ„®€ E˜ÅBŽU“}‚ ¬ÝÍ3« •ÙkSˆj&#´ÌÔÅa¶ÀëySÅÚ³Ç|K5qÒÛ ?YóÅ9©÷[æDê6ÕÃ`©Ï‚H´9y÷™Õ_id`XR‡Èî@ösUX¡¿Š!íe£kþܶÜ6â¹×:ô©¸€ô'`þàûÔ\ Ò%pb»Í¿µ&U¸ûc…£KhfÏŸÙK#õMLUIòZ»ýÞ"ƹéžÄ­ÒwÆPøî*?¿K@U×7ÒUSP3ˆ¿ö é’9Ÿî¤ÁRÇGù–»gLTñŠšFÚª êÆ ·Þò÷yŠÞv3´¹E—ÑO‚_Y3§\Hxœº†Ž¢|îo°®J³Ô “UuMôÔ)ÊÚ'3ñ6gœ¤|Œñ½ÉíþŠL]U{wg[¯3ÖÆx‡èèûIw"}O!m˜ûvÉš}›6sOH•ë†™¼è/lÛ!µ¿”7z³3=ͶnÇ_ì\à+?ÓžäÏe±ô6^a½ÕÞþIÍsjyxcœPÛ¶c¾U¼»,w~.‰1ï†3fç»ilÕñàÕW8ë¨Í6úœÇçI›Æ?%ÒÚQ{í1CióƒÜ ¢¯ä’ÒhCVÀW¶;/÷-ʧà{,˜ï‚ìµädHææÆŽ'Êólx3)îB«4Òci6jÀÄÝí’ø»MüÝ}pîÔçs`´\B wãͲIMxÃM7z˜kᔵ­ÌM4ÍÜÛ[Ê´ˆr*:VÏÆ¡öoØ­,'…¥9¤·žóU!b4õŒ uTqJÑ·ywy šoÿÐ<¦ÞâädSîó cpîØü×ðèÃl»éd¨Š£j˜iSÈŠÞ'®-ò×=µð;°4œ”´¦Ó1Î 6YG4)²Šjt’<ÎÎ#j9¤ZŸwzWÖ73ÕÓ>›MW! h3e¡!µïl½m¾(­ßÄÄ]KB6; ³~G”ð`ë2–ƪ "ÒyO™Þ„$ŽtÉdsÕFþðš©‹ÈÍ_¢p7¨ žˆ¬ç{9¿æ¬ < ÜBu›[Œÿ$*?øíí} óKkò% _XV7ÑŠ¸"suIEC´ ­û.Rì×7+g²UCQþüÝ!ÀÝÔÖ?1‰I@Œ–|ŠZà ÷»è:d¤t·±Ý­nÔJvÖE—î¶ÉjN×$˜™x5òL&Ü7šœó¥šï©ˆ°fÃ|œŸ-FgÏ¥H‡Å]GL_X¥[ûðݪYá +*NFßÂÖ€NTR×)hXÜLMaí‚=è¤O"­l­id’¾õÞwsœïíýâU*QAÇÜʘŽ!(yg7Š»Ž˜Ä´zJ{`žš›˜[Ü´£,ÞòkijbŠ;>1µˆ¬£?Á=¹5?3>3rjfž Äg£Ä$&1‰é[0 ®ßû}}Bæ&ÿù|M™ÿí4×TJøõtëªý¥ò_VlÌÒ rYaô][‘5í)4‘•fد =D—• D±“+<!é iw‘Ûÿ]!ßl Šµž÷ÏLËŽîÞe½ƒáòc~—ßÏ?öBD€súÓéÿ"§gûº„U|•Æ^Š:ìu¥}¹R=Wl|c™BCO5ïqs-­ý²Î^æ;÷¹¹ä&ÄÛí œa­ˆÉWm]½F‡ßÜquÛS? 5Ôü9_/gWWg>¹¸ºŸ8›÷ŽÃï˜\væ)ÿ ÈKìÕÎ6ÊB]öœ¹'è]O Âü½œ]=£’ FV÷ë·7{e4_ŒÚëÂ#WW777WôÅ9êò£¥¡r'gèYP ÏC¡wÞô­êþÈ?ù©‡¼ t\½ýÃn=k_Ó-Y½W]ì¡_ì=Þέ—‹1^n^ßÍrV°®»Û‰ÑÕXZvÜ6øn×<~tÂÉ:$íP@SŠ·™Wãß—Åç‹úÄ`ò^ê¼b¹C;n=ÚŒ>‰v;RÀ}ŸÀœi×ÆÑ*æþ›U( × Øæ¥hÃ8Ê/áf—`ð«:na°ÿ<êþeºíàÁý“_N‹­¾I" L¼R“ÆxÔ¿fÌ̱VÒÛ3É=å™$²Bì6bv¿¦ªª…s\ìi„b²ҥb)æmS¼­†¬0g}c×HÖj´¹bM¤ø^â½\9b.IÐòOLN‰?l­GÃR­:¦™ü r"´1ñs²cNÂàaO"“½Ÿ@^O\*k˜ë¾F•Åï;Ï+DtdøAOG’¤¤wzµÀ¿ÌL÷'5i²†©×Á °°c=]U ÒÚ§æ—ú°GE?qø€^–öhåíË /õI4}%Ê…+/ü…ëŽÃJ{ÀYZWl¤wmh¿]l:'¿•r{tµJÂìµ “ÝKÿ]µDp…º˜6‡6Ü”Oî óØ˃sëG5ÚûZÅlvÍ °Á<]Y‡6B‚ ©‚zK,Àžõ6T<œÓ¾ñÄA”S,¡<¸ÞªÌÚKr)‚J+ÊèÄ2V•aØ‘¼Õ ¹j5Ú¨XžÈ^•§ÍZNÚ" ¹òþ½h³ðHy«\RûÊ Ô:í0R.Wø×ãNÞ%ãû–òrþn9ÊL÷5ÒNÒÝUþ´ÀÃô M…»s~X5ãI†`w X®ÓT¢ì NãÕPÀ–wõ¹$êJ´©9e@Ú—RŸf,m™¾ m4”¼ö¸aI*:§b³1Ú pæ÷ÈÙyÀYñqðÅ ‰Pܼ°²EÞ?/[ßžËh#¼¡¹\ÑRø½C›Ý’F±Y¡¶š:Ú4†fà\1ó¿'×äŠá<æ„:aé>…>®Îû¼ö™«Ëk˜¶ó%±xÙ-õaUx!N–SS§ˆTïcY‹¤:IË;å ø<ò¤á)J/ú`îO=8¸SBëÑÌŠ.†ä3Rä·CR»jõ-y«Ð ¶ÐcB#…_«[x¬*‹+è$£ÍѬò;‡µ‰1‚ìïÓm`\»îJÔuœfð<À_oÓ–×9äñ)¥Ï —ùyëe‡%¼A½1K«EFö 7÷}ûŒUðê6å¨Sîá'™¦tŠ¦©¡®{PœÀÓm8ý=­õ Šê&ƺ¼¢{xÏZÕ)§ ºÃ lð½GFz:18 6x)ãDHªz¯YmÓŒæ5r´Ÿ&™¦ÙŒ:*™qTÙណìðç´›È)ÜkM 5§åvÒïò¼.ö?T ÓŸôw?N"aÕß΢Òr;Þ†¢ ï–×Ù¶+ =sìISÑÛ;ÄâžØ£bŠœ—d´èãÉútÅ£eH–ݲDõúQν³n$ÕÝݼç¶Ø’·;fÃÅ(ŒÐ%áåÓŸñLÍÔ•RÜskíÜ°'¿•’ÝŠ|^è2PÁN} ˜Óöú Ö‡Pïmù:Dy9XlØ {Lñ{bkxÕ~{K? Ê {y•à~y¬§gú¬{Œ¾R .W¹/T†ì !Föð eAš~*ï³#¦x›ÃhDæ ƒ™^ò=äFËÅ'J²úª:ÉLt²À>`G±)‡$oöÅE¼¢N7l´açÚR•ƒrøCgbxhr&T©„Ä»`=û¼Ñªó9›%r¦»2ÞGÕ4`žf^瑨¶×C,åC¹Ôç„Rµ\æÀŒ/u«sѲ|ŸõRÒ:0 £Qiÿ$_‡¹ŸrHAÉb`•I—S`F²¸KâNÏ,.M¼ÕÂþÿö®ó/ŠlMÿ%ûåî®Îˆ4Ð9º›$GI"’TDÌ¢"JÎ"`BtP@@É%I’œ‘œé¶º:­Þ½wgö7ÖóA骮:§OxΛÎ{ŽfÈ„³ºMȈýlSs‘ê’+Ù_z ‹°˜æ©V[¤Â6‚·A–”€»Šu¼1Âø7Æ€m>ßr€¸w®(”æë[(8K<~A W‡RÝŽ‡J—ý±ý¢}]ú®=vÊ1‡óge8ádHÅP¬/­I2Úü„ÝF²G~·ûC¶‹V[A¢2LÍ“Š{Äòíóît½Œ¯êT}ÛP‘— Y-BÏØ[›"tÉYRq‡›á¤O;ŸqЈ[õ'öÊ›=m¤bVÁ"! Dzk$ó$Ìì [Ö¤R¶©>Œ>=}„ê.­ÑÙFÚ/ü1xÅk³uŒN®ƒÓÿ;l#]•+l­là–©@çsÖzÌPZ©½i¥¸+Cf4TôËQþÎæ÷{-Ùz!bG:˜:…§}OŸÿí6Æ÷yò¦X.£"õJ–ÕÙF-EŒ0üÅ-ª øX‘BwNeÅ­p:É-©tßRÆÏó []“°¿ã¾6ÎUzîætSØ +LÇÊÍ/>3hA2ý9šÕüŽ¸17‚üž×“H¶ –ý¬KvÖ€Ž0b«§K123—ƒNÆ£HæsBqñ]c¼k¾"g×ëX9¬–ÿ†çnezOwïÌUP´ ïåê€hgö˜TWc›) ±tt9±†o» `¿ÙzD'ä´‚ %Ûpî9˜ÚEf(JÙ¨qÅ™…—üœl#WÒ\"œöiUâH=kÏð¼R mlSè®m«°¤)à$éÎvæ+¨0LñÒža3Î]©¥E¾ú¦t¸åøÚÐo@ÆaUÙFË0š#ï‘å¡b õa}Û(“6/€lü}× ôNjܽaB²øV¦%« i~¬6ú$ `åùYÙ†%©>ávSñcGsÆØÌS=ë…"UÏq2ÎP.·«ÙÎjŽÏ9o¢÷P’k` vôú—ã°ó…JÜ^pH3SÕy'­NG«U¨ô| †“º*$ËúÖô1&fÛp{òú–Ó[ªå ¾Ôú»˜áIú-Ó»ªlóÐÙÔúRšâ7®¼õ9D S5QLtVEùÛÐðŒ "Ϊ‹!"©ƒ§æö½fI³Ofó9¢VPÙüžù¾Ïn#™×e¡0‹(¥WP…üì̽¯ñ„b¥}VÌ~h‰7¼æÓ øÒ4þ×üÐD—q%É8aø^º‡%¾o·[ò³ ~ç͈¢ß—‹|×uîµÛâô~×ÿ°"—/Uá[ß ‚Ì/!ü}E Ðõ Ó(x¢]Wm$®”SØ­×z?Ö¤$µœ¶bo>éà.·!tŸÊ­þJ¶kSz“©Â6÷÷³Íî|5MY(3ÔÃfÊR2lÆy«Ÿ0Ý'3J‡mº·µað-ˆdTÙFGDzG>´&k£ºcâ²MµX4h¡kØ!‹ ˜ãù â=;ï»\š"`'®}³aÖÙq¿\ø[½¥ rÐê*oRò¢—¨Áï[ü©fý`æ…L7Ò“/•L¬—t'\ŒýQSY¾,p°-Îo‚_+¾L|¯oòq^œàM¡«{KăñîZ&Á\¹¢÷îVØ¥ÇeÂÍÁcX­¸&®tplMU3ñ{5©šÄsN1I^Èéi^ÝÊå‚% ævÕWñj‡œmDÕç,07åÀÏ:ÎÐb†Sxf°udž'ÿÁœ+–ŒS÷ ¹ 5$äñIuÛbc.†lÐYþ@‡h?Ã(fª&+1Hèsžºž×ËäNaQOr€6Å~”«Âù3õ4ùÖÿÆ–G¢ˆÑ/¶A…ú¥ã?˜÷¤Ýq7ˆdX¢`›³n8×ÈÒÌã4ßûE*ý.Úžl:ãlŒÅ éV'+F6e!(@·fÕ[¥¶(–ÎÚøãd‹Ãó ožÚ•N,öB¯î}Mæp™ÿüFD¿hW<¸ÐñÊÝ‚ŠÆ`ÈFö«dþò‚"6øcOi‚ ÂЮ?ù(­ê·Ž?pÝ¢AŽtTq–¯øXãÐ(’‘cA‡\IaMÜ=vÖu”(V£¯3î*ئ-ÛZÛ$^Ö+ܹ¸`; £oé]=0åÀD_Í“JòÂÏ…,$ ‹³ñ‰ê_”Q{\Üøø2û—f‘Æó>‡ò»oi¸µïˆF !p{¿¹oÆÐ) Á‡{7Ú0çÊÜø¢Ü7&Ú7§Â«V÷ɽ"Ñþ£1÷¶xÚ{c|Ry®ìxªýQ»; КB÷äqÚßò>¸¯Î?×Uš‹Û[ú¾7i¨¤æŽkÚ¥qß’Ê ¿WüSå4l¿ú‰ÖØ›³KÓÛ @•:F.Ú»lò T¿.׊ìˆãL¦óÅùåÕÍͪÔSœc?ï_P®gŸ¡éEWŽnl¬/O´Yð¡YU¶þ'õ¦¿µ¹u6·Yíq¢Õš>7+„P/ýÚtŠŒË^ ‰@YxFtÏnÿ ‚"¨t´½9nBB¡Ph<#*«r‡í þ³°P è/øýÀ í©!þŽváÒ$t¶ýÿv`ý¼xáß<§ÿ£ @øå–‰½&L ‰Hãš®É(Ò°¡û ëª88àO“ZþU™iO"§¿ R üÿÄté?}׳/CÔÂG­£°‚–ŽóHÈí*M³¡¢aººHŠyÜë&¾b&ñV bÏáº::zöÁw—e¡tbþzaB8¡«Ó³ñ¿Ù·(;ÚH¸=›Œ‡ëÂtàN¡÷ÇÖÁðbþöìãpëÿþx‘2tOXwÙá°¶®zz¿ý§n6Ϲ4Xwö¸)\¦«ƒp¿ÿu™õçMnÞzYÆR¦ #™{üÑ2.V·s'j˜hx>xø$äCø¥!à,/¯pö#-~ˆo?/í=zŠïq˜­Ó¬ÝÝ¥Î}mXp‘ô;Ül/#œcøÜ›ÅÞ}qÃÂp–ð Ö6dz›Åâ°ÞÜ;A¢:Ž²r7ÏÛ뻆}ÛÚåp¶²Î›hÒȘ/ÏMØÑ÷¨Úä2eæ*ŸÃÚÞÞ‘a—µÑx¦J²ýqþ-Yú¤m—ÅÚ^›>{Ì€â)ÿŒH³ùç±HâJ0qìû¶Îb³» ¯ȼ/¼=RÚÚàK2ܲƒ6¿ˆÊžíÞYû8#9))ùùÛšeév£ÍÑ”´Ì‘E8A„­eùIII9¯ª¶>«°ÍvaêƒÂI´JI´ç©ØvÅ s/P2x§ÌµS‰ØgMK²;ëÝLI§\̪V*N›šØF2ñ C0–±ìô%a†ŽiÖË‹³F‹íØÿxOžÆ-.ÐÊ$,òÊÐ"—·Øc‚Á:ù&$ÇûÚ™#iŽ_wDâ‘<¸aó’b«å‚æHH% L±c,±ÖÛöšo&a-8˜`"sû€ ]éádkïyLévE”Õc™/‚Br üà&šÃ½ò{eŸ8so^—­² ¶áN·ê±éÕ²l$=…1¢‚m„Ûk;¡šx¨<ŸÂáF5’c§Åƒ5‰x´í¨2´JðÔorïýâçLâØ Êõ|w²áõñJ¯Q/¥nEfhÝ7¦‘¼ãÞü˜m€/ﶛaÈïF7Ô®¯7Eù¹»:Y{\ø4.}LÄÚ\ß<(Ü«/ߥG­”g (¾l€uIWÐJæ9Ýç•XÌ¿krÔ)[–ÿ…UK‹à<+I‡%ÚÝÿZ°Aúò´±'FÁô@|öÎúÆ–PɆ½ZèÇã6á—@ëC‚}vqMÏ× –‚9dl³5 'X\Êt·°˜7^WÊ6(eÏðHJì›.ébÝ_‹C;M* IôÊop»t¾5‡°Q¹þö™ù,±fžåmm 1a®–T¢çÃ?~Ä6’²êOSmC·ê‚ÍzÓµðˆ°3~–ÖÞw‹¿k’íËwÑ£DÊÃû–ƒ°G\²‡û@ $†‰NíöC’Ï­€F£t«ÓEó ‹ó"`Hóò±- Ò ïó°w tÚ+„_Äv#è,N±1 À¢iѯ{„ ¶ØmÈ"`˜ŠÛ…FÜAl#lMYçxæ³ej{Éãhó¶R”J¶ÂÛ&U¯t?# Œ»•™_¸ö¤c÷¥2 ¿8>”Š'Ð-ÝK»ÇØÔs™?`ÐauÞîŸ7£‰y=IzÚ† [ßk €mtÍä›!'œôôê ’ŒwĬ™&ù²+d-¹0õn•-‹.”•d#»¶|÷4†‡£6©ÃÐ0„ð÷g•¿7—¦›ßÄbàä÷â9™l3ÓúmWe›&9ÃÈ6à½ú„Ã¥ndMU~X¨¤à±“R›*ðïŒ+]ÔÍžhÔÇ!‹F׿yPˆW_4í­ßöˆ —ú~BQSMš”h½šv„Z§ /‘°¯¾ôeI½PiÍu…i]þÌþi¶Y;ƒ;T·u@›‰¶ÂÍi¡iµÛƒ™H¤çäÁ­ÊË>m†qº:²ÎÓx:x-ÑêˆCö84!üýÁ_zšÛ3«Ès7ãG¥t.ŠçevöD•ˆÍÛmZŸß<Ðn3×’‡&šÔOq÷N'ÎŒ ƒž^+ý<ߘ‹ÅÑ&Øb11$î½ôúb[Gªb‰9«WýŠdyºÞÞÅŽõî¨_Ö¬„ð~[Mn‘¨=ÅÞ‡õ/±” *jŒñ…1F×dUÚêJAhQß- ¿k·‘³ øŽ’H´}’"'^_}Qy—LåY|é‹õ‰©£XÅ7ÈËT±Ûˆ„Ÿâ½Q–§·÷ <ªviN˜Pâ‘s ÐH„ð+àýS,‰qûÁýÛn¶†ÓÜ®@Å'ÅÍó¡ Á—o^8eíêáN$ Û¥“Ná“âßµhöþARøûŸ°:Ó·žè#P–v'‚OؑШ€'²<$¬á|inã|Ò‚EûdwK¬#ц"¹œ÷s¶Áb(»ÁÔáBVúõ0¿€@'gç䓯ÌðÖzŽðLQ×V¢l$º‘»O¯‡- t Ë‘Jš|R*²ä‹œ….# †iïó0 ©ÿì«œ{D£.4•B¯øº&/“¥ðI ØÓÎ ”¹[€þ~·³Êöû¤Äë¥-ýÚ54!üý5)pž|i({”–””œü´°â›Ô=²9"‹·*ÅÏ“““s^Wm±W³ÓÒ{§¥ú…"Þ†óþQbzZZª)é/·äyq7¦ºŸ?JKNˮ隫¤Ùšë}‘–œú¨êó˜XÅ>Ò\š‘’’–ý¬clU&À9%O³S$oNKOOKJyUÛ­ø!Ão3ÒŠÛÕÄ0;WCÙ«ŒÔ”´ôìòÆ¡LV>±|й¿5{^&æ5 TõÖLéËÇIIIé9/{g6e•ï4efdç®sFiž"ÞFÀYz–‘¢Ö©)ùåÍÀÓßÚßyÚ:l#Ñðº}1¶!•“› @€ðwÂ׊Wêÿ"7»ó¸u K¦Þ⬺™á.æ@LÂßKcýÛ|á_P'â­NLÈ2q¶Æ9SýÒ9êê ü{Áj :9µÅ‡ödB€áÿTÈQþq  @€ @€ @€ üþ ÙJ endstream endobj 975 0 obj << /Type /XObject /Subtype /Image /Width 227 /Height 87 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 6166 /Filter/FlateDecode /DecodeParms<> >> stream xÚíy|UÖ÷çVug%d!$  [PDD”aqXaÜ@pD„DTP•™ñQuEQA„GaD0l’–Ù×NwuÝ{ž?ªˆ|}cê÷i>tºªoÝ:÷[÷ž{έj2M¶lÕx Û¶lRmÙ²Iµe“jË–Mª-[6©¶lRmÙ²IµeË&Õ–Mª-[6©¶lÙ¤Ú²IµeË&Õ–-›T[6©¶lÙ¤Ú²IµeË&Õ–-›T[6©¶lÙ¤Ú²e“jË&µúÄÌÌ ¡iš&0_=Mcº¦iÒ4Mïãª|KÓè—v¾œ¹5`½¸Ò‚®>R‰ˆÈ•¾cýâw>Ú•ë‘DÕƒ|Mý›53³¯Ù«X&麙ºyÑ’Mç¤Æ…g¶~ºf_j¾"º¬ˆ4Ý›¶qÁ¢ÅŸl;ͺvE#"ÜI»¿xÿù›R‹dî÷Kç-\õßïr•.ªÅôµyô'ìæ<9rüƒoŸ(ôVK_FB§£‹'=ýÊš\]ôÛ”©éúÙOžlÒÂ3š®Q•@Õ`|9kÔ„eÉÂÁ§÷®š:óƒ¹ü‹ÀÁ³çÕÑŒœøæŒ+勈ò6Îá/ãýÛ®lãÄâ‡ÆŽzbÖ’T ñ;ƒZ“IµzVˆêòÊòm¿y¡U}gõ€*½þõ9 Wî,ú ÄD÷Wóæüû½/² T%døðG_bä¬G£©(éèÐŽwöî¡qúd=Ђüµ_QS ~Ÿ??xkXd?åhrïÔÁ7†ë?ø½ý.½:Ý."ás7•TŠA` ] ¥d@×´Ò €é6àÞªCV€’R1ˆJ}© —9K)™"0 ¡]Ô (i*ËÚ¤ë(Å¢üN¬¤T,t]Á·øûÐ4’¦b]\h¹2}=¥’Š*줤©Xèºñ Òüühš¦äÒŠ@š&ã¢QWfž(\Ñ­m|➌”‹ÖÌîÞqöƒ]!²,yIeÊBM»ØFDf¾Ä„JšŠ%·iß"²Ñ5×Eùé‘]Þ¸~sl¤eB»LmëRŸJDòüÿ*¥ˆ‰º.çõˆ%Š!™\éï=ìOõ¯ú|Ř.ˆ¨ý´Ÿô¼/Gv&ª7v¶‡ ¼Ã^Ö5*€ˆˆB[=0sYRžÏ…#‚;óȦ j®E´ºmò¼m¦DB×Óç·' ðòÞkgõn*ˆˆñ}Ư9\¬ëzâ³]D÷-À©]³¢‰®ûæq—FDÒ³ó?SzµŒDDÒ¬Ëï|«|eº?»‹ˆ?üuúþÅtºÆO5¼á¾·¿ÍÒuýÔûmÐfIºKæ|Њ(¼û°ÿf뺞3;A'¢þ 2u]¯¤á;üý„’’I l]„¢ôïÿ9¦wLf`x\÷§ìÌç ä»n{gëP""òo{ç¤ÏŽ»Já$ÈÂï—Ní›)ˆˆœ1·>4×9EB2yãæ$ÿ[z]ÁFÒÇ µþÓàh@è®ù·Q××OU^Ûÿß2«Qžôï¦ö&„=òUrž×4MÓ”ÌÆ úÄñÿ8ëñÊ¢3ÿy"õ:÷hÞ*¾C¿c›½ú4Ÿß2º¡Á„2ŠMÓ”ÒHß1¯{P¯qÁ£&N|ì¾n-@Ó»gÌr{Mé:¿û™?ÎvýœòÒì—§»½m4@7[œZ¬sÆÊ®@@“„Ý;÷˜øÚûŸ¬^öÚ„žõ€ðGnÍá¼ï7¾÷Â~@x“ž3ßž¿ü«Ä\·RÞŒ•%hÔ±ï£Ï¾ôòôñ·_+€6Ãç§z˜™Ím B`°†N}ûã5«ÿ=mPcÜia*)߯zý†B8oxöíùKÖl=YÌÌYïô‹oÓâ/+2˜Õ%Ö’ÊÈMúñûïö$ž-6òÓ|·óû”Œ|Ãd#{ǘæB:õhòô™ÓžÑ->pôñE33ç­îPHÜ€.±Q]ïýÌ”'¸-¡>àŒøñ “™™³×=q€F7t6îÉñõ¿¾ácW¥2g:˜–íñ*#?eïÞCY^V¦d.\>(!ªqìý N1³Yíªa¤ŸýðéX oùˆ‹-™i_”'Õ›—üÖ°X ɾ=Œ´š¼°ñ˜¡Ôþ9]½ËØEé\ª¼=OvœßÚ’j0g}r€€f\t ¤tüý€ÀN¯|zŠ™9íïÑ@³[Ÿ?ÏÌÌŠ9û³¿zLÞ_ú ùÓ«=ƒàíÓ+O0³úf¸ èþ'}žUvØ-#"@wÿí3sÞG7…9ôˆáǬ2MSª’Sû¿ÝúÕ·‡Ï•(y±­¼^¯×”|agë ÒT\¸ïÕn7tùóS /œ`æš^@ðMƒÿ7½ŒTˆà&ã–%—àGâ€Ð»žÛPÌ\²íÉ@ÈõO|Wjä⯧Çhðk>j§ì˜^ÓT̬L¯×kJeœKܹuÛöÄ3ÅJU?¨f›Q2¼OS'›¦)Wœ€pÁ¹cÛ?;‰ž÷ê+¥4¥TZôé®^úzß–‘šJÿ|ÞD&ô|_#°€ j}×èA0vo?|Ìå›èí:ý©ßõþ,MÓ”¦×¯U÷æpåççäxå6`å- ™PôùÜ]ŽàžÕ)¤Ìoj9áo¸Óö³-ÃçW¢þµ÷Œîiš¦T@›Þñ`£èì)·¡˜Áf )³’ŽÆí»ÜÖ½K›H‡TÏ’ˆˆÀRJ)¥²|hËËTÒ?zņ5óþö—F{KŠ‹Š ýn쇢¼üóçÝe%4Š»cÔý- ¬Ú„Ü1iLò’“v¥[ßÿo6Ðnì³7X•åÀnO~´bÙÒ¹6ð2+ë˜XïˆÀJŠÈv·ÜÖ£k»F~ÖŒ ÎΨª<óR@³aqe³d.Ê?™˜‡fq ƒu@Y±Ö°ÅM÷Æwb¹}{ ~-ÛŅ "´Ðèv±êà¹\ ü‚"[„ ßMów^¥L¾4êƒÓ_ô‚Õ‘µ/=¿GÊ·Á“—è€:•™–a !€•]V& û;fåU•ºí€’²Ü_UŽõ7¨—¾æ¥ÇßÜ°/µÀðšR1¸ø=Éyßì-«ž¼®4ü”‘óÚÄŸƒ¯†ç^×µ ¢ªð@”×%hÔë?¦æ-þfá[‰.Xeê®zqÄØ+vœ­bÍÄF€¦k af%'îûáÇ´çÈâgDëVv:ºë°·l[tG ô™”¯*:³x|0ÐîŸRZƒ¬™º~XÀùÈÞóE¾b¼Å©ß~0¦w¼;=ªïø¹;Só ßqŒÜ”o>~{l°ïÃãÿøÌü­g Sš&sæŠN:=ò©‹}a,¯áÞ>»19þÝnf¥Š¿~õŽ @Dÿ—<ç6¥,ÉJ^7gìM|…ú7ê9êÛ’s ©$³üj0€€Îoç—ñ™Ï/ïà–QŸ33ËËiðk7äãƒ挗Z@¯wÓ«K÷š¦©<9‡ßÛÕ —i!MûO^|0Ó•¾ë­ÎÁÐíÍï’Þî ùÃv­|î1V}¯í9nåþ ¯R¦é5¥òä¥~þƨö |ƒjýÖý_]³?Ï#¥iz½—X1¼s£ˆžÿLû]"ÿT}¿GÅl%åÌ¥áC"AdýM֘¬“„r>¾*Û|ÎYÌ»,øHTšÏ¶ÂN—l¶òÝ1+¥˜HPé(ÆÌ+²R¥eÇ,­"•Õü‚vá ¾EŠA¢üÈxÑ.)Ó7›¬ø¥*±ÂÉ—–åËQ€„ °ï¸tÁÖDTú [Á»Š¥øôó*¡i§f¶ŽÛ9-}ãCÕߧVãèo¾…ŒvÑ­ü{íR'©Âåàû³”ËÊ ‘дK¿UáÀ \¶P߬\«Ä»»|™Bh¿Æˆ•žÿ8åšahÈ+‰ÖÔ•­Ú+ 8¾ù»ÆÍz´9XrõϨÈþ5J[Uq:Ðtešê÷¸Ú¤Úª²G[6©¶~1ÚzJ•}b“j«f 0ë:)EçÎщôukš=›ÒÒÈ0ØŠÔæ›Ðm?µ–w¢šæ‹\¥¥!1‘Ž§ÿ›Ž­ñÔ©èÚUõ釃”‚R¨™Ë¥lRë  DÐ4”›‹eË(%…öìÁ×_Ó%}­ï]WÇ£K5r$„€”Ä\»xµI­M€`Ý—¬¡?¤eËèÌ=Jn÷ÅhV†,âúëyÄ5fŒÕöµÖšN*¡lI©RT;G®ßp §íÛiÊ:zÅÅäñ\‘/ëËû: Q/¾ÈãÆùxj¾Uk4©ÌL§OÓúõÈË£sçÔ¨Qܶ­•ã¾ÚxeM£}ûÄ Atâæ† I¡l}¬”¾ugÏZ[O\¡ÒÕÀ¾&/£6 @½öšzì1’’…ðíYS [ãI]½Z:´ì¹hIR^u°qAøë_©°ÁÁÈÏÀa€.—Y¯ºŽ½{IJðÅ­ ƒòò`ŒÌsçrçΈ‹ƒ®×\ÔhRÊÎÒîÝ @RJ~ðV{ç°¿ÞI‚«voIYY¸A˜¦š;—qò$edp~>Ün23)7ùù8s†\.2) Í›×ØH–^£û€##ÕÒ¥âž{èÐ!V Dbôhåvó¨Q®"·ÕZïXz/ë圄ÔT†ï橬,îÝ}ûªèè‹wÍÊ¢³g‘™‰¼<ÊÎFABCkrÀU¯á )ÅqqjåJqÇtò$3“Û-&LàÌL5e ÓÕ9½º\p€fÎDa!ìçîу##!%•ßááa]ç\êæÖd?UÔ‚ŽD)nÝZîßÏ×\"ÈãÏ=§Ý}wù²1eM£ÌLÚ·ÏšBÁéDƆVñ1˜‹Ì¤IyáU³#5ÿù©dò"ÏœÁÍ7[A+hÝ:=(ÇŽA)&â«Y+@D3fPb",bcáïÏ}úÔ ³Ô’¼¿Õ¹š¦Üµ‹gÌà¨(_hÐãÑÚ¶¥‰éÔ)ËK»š1¯½FóæYþ=¢£)+‹§Nå„„_ônkµ+GÅ4v쯼Bë×_ø<&†{Œ‡ áæ͉R^-3­Ò˜€xõUš6Íw7iÓäQ£Ô¬Yµ+UwHõÝñ¦i”M›ÄÌ™ôÓOìp× €;vä[nQ3f * µ-[øëæO¬ëðxÄèÑôÁ@Ž‰Af&Oœ¨fÍ" ÎÄòjgÞŸ™…€”–†íÛµ1càr±®[‰AnÞ:¨¿ÿ[´P7ƾŸµÀ§ŸŠçŸ§ÄD„ÈHJM•ï¾Ë#FÓY—Bεv…ŠÕ¹Z!U—‹,Ó¦Ìðz-'mÛª>âví| €:Òl̬딛+ÆÇòå`&€ë×G³ftäˆ\·Ž{ö$!êX¯ö¯¥*õˆéÓiáB””× —Ë·½~}~ã 8ÌfX îZÔ¥—%„ ´t)=õY¡~)ù¦›èôinÖL-YÂ-[ÖI·§®¬ú+Ïë‚´r%Nž¤S§| ñÒ%×ÂJ4€®ÃÏÏzq` ¬3ŽŠB\bbÉVlÓi“úëÙ-lyY·%¤„iBJëž;˜&ÊVˆZ΀®C×áp°Ã§³þ¬‰QéSwmÃÛ¤þ–ãÒG>U Y¹i]R‚­*J·Mð«.ðŸù½µªŒlL¯PöÔlÙ¤Ú²e“jË&Õ–-›T[¶lRmÙ¤Ú²e“jË–Mª-›T[¶lRmÙªLÿ›ìg endstream endobj 976 0 obj << /Type /XObject /Subtype /Image /Width 246 /Height 74 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 54702 /Filter/FlateDecode /DecodeParms<> >> stream xû€üüüÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþüêÜÕâêóþýôëÙÔÚñûþÿô™RBvµü±T I¡öþ¸v1£Èéÿì¡CmÛä®%4¸÷Ê!ºßþÿúêÛÒÔáøÿÿïßÔÝäïýæ¾O(wêÿýöá~=/s›Äú绑:0H¼ëùòƯÍgvNú¼Œ·ƒ¢b üþÿÿ  #M1""QO. ÿÉ|E20nÞÿð–I0Y|®õÿÿÿ !WjqgwD ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÜÇë ÿÿÿÿÿÿÿÿÿÿÿäèêô ÿþÿÿÿÿÿüîÖÔåܧ™ªïåßæð©g}Úþÿÿÿÿÿÿÿÿÿÿÿÿÿþýþ ' 8V}Áèÿÿÿÿÿýó¿—n8!*Dc¥ÈãýïÓuJ 3ŽïóÔŒ^9 6WŸÏöÆb!MÕü™l<W½öð×›vV*  $Qw£åúÿÿÿÿõ²QTŒÓÖ·ŠB& !V«é÷ô’3 h®ðÿûøõ÷ÚÙÞöúúûýóÖÉÒóô½‘i7" "6Q‘¶Üþå£wP! 2R›ÊìÿÿÿÿÿùÉ¢xA*%TwžÜö８µ8P÷¨‚¯ Ql)ú¥L \¡êÿûÑd+9}°ÜñίNƒÌèÿñ¥%d„­n@<ŸVH¬äúèU #uÜãÊ…X5 !9_©Úøÿÿþúîš\]Æáöö³` ,cÂí§Dh“àtE "jÎôÇ`<$‚êüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüüüÿÿùÎN".P_f]M7 4ŸÓôÿÿÿþûéœY!:Moy~wlX1x²ØûüüþïÕvO T\*+Qw¦¨˜~Z 0¤âÿÿÿÿ廣}f55Kbƒ‡µà÷ùãÃ`/  0K_uzx_J7)mÍòÿÿýüýÿÿø»S.S73;s‹§¢—iJ$FÁùü÷Ï¢€J9]}†‘•¢Ñïÿÿÿð˜H$p²îÿÿþüüüüüüüüüüüüüüýûôãÊÃÃÎÚå÷ôèÎÆÄÈÍÙòüÿÿÿìœP 1EepuqgV/ p£Òøþþüüú¹{+B"4WfmdUD! Éôÿÿýüüþÿÿï¬g%4B^eeT>& >rÏêúýøçÌÆÌæöÿÿøçËÅÊâ÷ÿþüýÿÿ÷©U+d¦èÿÿþüüüüüüüüüüüüüüüüýÿÊ*+U;..SdlfXH% pÅôÿîß³Ža*rŒ’Ÿ·ÉÛÁ²Šr>&7T€ˆ¯Øðÿõç‘\:A'Mp‘›Ÿ“|^&&’Õúÿÿýüüûüüüüüüüüüüüüüüüüüüüüüüüüüüüúõê—W XÄÞñüüüüüüþÿÿò°[&_Àÿÿÿþÿÿñ±G %-O.")LSTrœÚÿìÃ[6~èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüüþÿüן2 `Æôÿÿÿÿÿÿÿé²g7b˜êÿÿë«U-WŽåþÿÿÿÿÿÿÿôÖªEkÙøýÿðÖxT5ƒÈÿÿÿÿÿÿÿÿÿËq$ UŒÖÿÿÿþÿÿñÈn g“¿þÿÿÿý÷µ{3h¡ÏÿÿÿÿÿÿÿÿýʼnO*oÁþÿÿýÿÿû¿V >ªÙúÿÿÿÿÿÿûäÂY"*‚çøûÿÿðžs5.µìýÿÿÿÿýüýþùåÓÈÁÃÇÜìùýýüüüüüüüüüüüüüûûûüüþÿÿÿÿÿþüüýÿÿÿÿÿÿýþÿÿè³\HADOzÖÿÿÿÿÿÿÿÿÿè­9UÛñýüüú¹| A{ÚùÿÿÿÿÿÿÿÝ£d 1†éÿÿÿÿÿò¹g(QŽåÿÿÿÿÿÿÿÿ»…@r«ÐùûýÿÿÿþüûûüýÿÿÿÿýûûûüýþúéÖËÁÂÆÙé÷ýýüüüüüüüüüüüüüüüüüýÿÊ‘+=sÐóÿÿÿÿÿÿÿØ™`Q¶ÿÿÿÿ÷¿G! ZÝÿÿÿÿÿÿÿÿÿÙ~ Ko¦ùÿÿÿÿýûôç“a"oµÿÿÿÿÿÿÿÿÿå¡V%N™ïÿÿýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüúõê—W XÄÞñüüüüüüþÿÿò°[&_Àÿÿÿýÿÿõ·K $L®Ù÷ÿÿÿÿÿÿüä¿[6~èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûϸÃáð*n}9 ÿýüüüýþJ†Ä½¼‘sH÷±•ºA^bÿýüüýýý $9BA3䧯àûÿû8h2ýüüüýþ(B$ýôçäùþÿ÷øûüúùöÿû÷೜Í=[nS0:vq5 â­˜Óÿÿ*6S@&þýüýýý (ãßíýÿù÷ùüþþù÷÷ýýýþÿþý+7><8"þþÿÿþýýýýýþÿýýýýýýÿþýü@’¥¬®ª…)úöñññï.;èæïôöüÿhlU!ýüüüýþ"U[. ûÝ­Äîù¶—¶ú;cfÿýüüýýý:k¢Å»®`9þýýýþÿýýýýÿÿþý(4>=9%þþÿÿÿÿflZ* þüüüý'8% ûãÛòøùýÿÿÿüøýýýøøûÿýüúöýýÿÿý"wd6ýüüüüüþV`-îܸÓó07B:&ýýüýýýöÛäíòF/þÿþý0?@ÜÆÛü%(ý ÍÊáùþþ $ÿÿÿÿÿþüÿÿ÷ßÌé½xd_ÿñâùþüø×Ôê.  ÿþûýþÿþýýÿÿÿ ê¸w^xŸ¹Ôóÿÿÿýý ÿÿÿÿÿþ!'ÿÿ +ÀêçÝìêÈÚù$& ý 7Aÿÿþýýÿþûýÿý($þÿÿ'Ñúèåñ ÿ&þøûüý ÿÿÿúôùÿ ÿÿðöýÿÿøöÿìãÉÂðþúþÛŸ5*bÐA^|\F0 ýï¤_X¥þ ÿÿ ù÷ûûóúþÿÿÿ þþûûý æíù ÿÿ üìóíóÿÿüñõ÷úÿÿíQuÐ¥|þüýÿõ®‹Óü9„¾¾w*ýã¸ÿô÷úúÿöëôÿ  ÿÿôëñÿÿþýþþøïôüýÿôêò ÿüùüÿÿ ,&È©Íÿÿá‚J>Ty’àÿH6 õôÕÄàÿõëÚåÕý)J( ýÿ 'B/éÄÕÚáöýýýüüüüýþõÕÌ×íúÿÿÿÿÿÿÿÿÿÿÿÿÿõÞíûý>O*ýüüüþõϘ£ëÛÎèîÿÿÿïÐÎóø&/B3 ûöϺØÿðß½f>7i¨ÌüþÿÿÿÿÿÿÿÿÿÿÌÃéúÿÿÿåÅÎû #$ÿÿ ú÷úýþÿÿÚÊáÿÿþþ#ON/ð«^{¿óÒŽb·ÈñóC}lýñ¹¡„ÊîÚ¿¦«¯âRvLÿ÷ëôóDmYâ¨q“µùמm>@-4^®úçâõúÓ°ž‘•œÂàú ' ù¿´Üá©SL˜ üëõüþÿÿ÷˜}—Ôöü¾ŽžÛñûHn9þ=vjûÄŸr³ßþöµ‡d›Ãçýܶ¢‘”š½Ú÷õáçþþðôîûñ…hßö§w”çA_+þ%-ùÂÂæôâ°{¬Ôÿÿüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûûüþÿÿð¹x! "+# /[½ëÿÿýüýÿÿÎ’N ?HK@2  /]½àðüüüþðÖwP \Ñòùþüüüüüýÿÿö¹LFpµ÷ÿÿüüÿôã³> HŒÕÿùáŒ_5 (>CC2! !Y¼ðÿÿýüýÿÿú¿U;g²÷ÿÿüüüüüüþïÒrL [Ðóúÿþõ¿“k-5>ˆ»ðÿÿð‹1 ^¨ìÿÿþüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüûüýÿÿüÓ–0$fB/ :FI<,O·ðÿÿýüûûüþÿÿÖ—P  #,,@h•âõþüüüüüüüüüüüüüüüüüüüüýÿÿöž?RœæÿÿþüüüüüüüüüüüüüüüüýÿÉ(*’¹Ýúüüüüüüÿÿÿ׉0Šîÿÿÿÿå„B' /S{ÍåûþòÃL =Çÿúé“_Qm> #@IH4!YÁõÿÿýüûûüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüúãÅ B"QfpriY* 1s|E#Zºþÿÿýÿÿõ·JKw»øÿÿüüüüüüüä¿Y4}èþýýüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüüü~~~ÿþþþ %FjV9  ':Sew˜{2ýüýÿÿþÿ9Z[H* þøúþ )Qfz—w3þÿþûîîíú7RK2ÿöé×î>AD9.þü "83ü '>KM:%:NUA/üû$2Sgœžz0 üüþöéÙï;>E<1ÿÿþûîïîý7QK3 (' /DIB%òèéþ .@EJ2ÿÿÿÿþþ7[C( þý 5pŽ§ŒV%1 þùÿ/GI(ýåã<~–Ž[-çåê%@Ri“¢‰>ÿüþÿþþÿ6Y_H)   2Fez…‡uRþþÿÿ÷íâÍËÓNtT. ÿÿÿúòãÝý(KJ>" ûðáí(0CKB% =ùü&:IK>!Ë´’·Ð,›Ç¬W#ýäæî,EWp“¢„5 ýüýÿÿ,?<. öîëìô^uHæê/8CC6þöè×ï?AE7,ÿÿýùëîñ"@SG)üüüÿÿÿÿþýýþÿÿþýýþÿÿþýýþÿÿÿÿÿýüýÿþüüþÿþýýþÿÿÿÿýüüÿÿþýýþÿÿÿýüýýüüÿÿÿÿÿýüþÿýÿÿþþÿýüýÿÿþýüþÿÿÿÿÓW9»óŒ4ÿýýÿÿÿÿÿþýýþÿÿÿýüüÿþýýþÿÿüõé˜k'm«HÆÚž9 þýüþÿÿÿÿÿýþüüüÿýüýÿÿýüüÿÿþýýþýýÿýýýþýýýýýÿýýýþýýÿýýýÿþýýýýýÿýýýÿþýýýýýþýýׇ`ª^Ú4ýþÿþýýÿýýýþýýþýýþýýýÿÿÿþüüþýýýýýþýýþýýÿÿüüü'yÍÿyþüüüÿÿÿþÿÿ÷檜‡±ÊñýûBd'ýýýÿýýý$5PBü0ÿþûòòííðóþúþïúüüüÿÿÿüüÿÿþýýþÿÿÿÿüüýÿÿÿÿ®®,,°°ÿÿÿÿýýýýýýþÿÿýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýýþüüüÿÿÿÿÿûû¼¼XXööÿþZZÿ„„ÿ ÿÿüüüÿÿÿ××ÉÉ„„ÝÝÿþ$$--ÿýýÿÿüüüÿÿÿ×׳³ÚÚÿÿÿ99ÿ--HHþQQýýÿÿšVe©üüüÿÿÿüüPPÅÅððÿÿ''þþöößßÿZZÿ„„ÿÿÿÿýýÿ÷÷YY´´ÿþ''ýýööÿööùùõõÿÙÙÿ ÿÿììÚÚÿóóÿÿÿùùÿ þåå ûûRRÊÊÿ** þÿ%%ÿ22ýööþþþþÿîî??ÿ ÿÿBBüüüÿÿÿÄÄÿÿþŸŸþ``üüÿÿÿððKKÈÈÿ þ¯¯ÿüüüÿÿÿÿÿÿÿÿÿÿ¨¨[[ÿýààüüÿÿÿõõ((ääÿþÆÆÿþþþþþþÿÿþþ;;ÿýýçç’’ÿÿÿÿÿ¹¹ ääÿÿýÜÜýýÿýúú‡‡ÀÀÿÿÿÿÿàà``HHÿ ÿÿ??ýââþþMMÿ77ÿèèccÀÀÿÿÿÿÿÿÿííxxBB¡¡ÿÿÿªªýýÿÿüüüÿÿÿññ66ÚÚÿÿþŽŽÿbbÿÿýýÿÿÿþþvv¯¯ÞÞÿååþ}}ÿhhÿýýÿÿüüüÿÿÿ55ÌÌÿÿÿÿþ±±ÿ..ÿÿÿÿÿÿÿÿÿÿ„„ÿ66ÇÇÿ;;þ««ÿÿÿüüüÿÿÿbb··èèÿÿÿþ‘‘ÿ@@ÿ,,ýýÿÿÿÿÿÿÿØØë럟  ÿ úúþÿDDþþþþüüüÿÔÔ””™™ÿþþ þkkÿDDÿGGüüÿÿÿââ³³ààïïûûÿÿ@@UUþDDüüüüüÿÿÿ÷÷ÒÒ¨¨ ÷÷ÿÿÿþƒƒÿ00üüÿÿÿ´´——ççííââÿßßÿ ÿrrÿGG ÿ''üüüüüÿÿÿÿÿßß__ÅÅÿúúÿÿÿýŸŸÿCCþþÿÿÿÿÿÿÿêꪪÓÓÿýýÿÿ((ÚÚççÿ**ÿ~~þQQÿÿÿüüüÿÿÿ¶¶ÙÙþþëëúúÿÿ66þuu## ÿ øøöö÷÷öö÷÷üü¸¸’’èèÿ ýý ÿGGþ‰‰ýýÿÿüüüÿÿÿÔÔ²²ííééËËßßûûÿùùÿ ÿ ÿÿÿÿýýèèääææââììÿþþÿ$$ÿ$$ÿGGÿ))þþþþüüüÿÿÿööààëëüüÍͦ¦ÑÑÿøøüüýýÿÿÿÿÿää÷÷ÿ 55ÿGGÿ'' ÿÿÿþþÿÿüüüÿþþýýÿÿýýççßßááââÃÃËËööþCCLL++ÿÿÿÿüüüÿÿÿþþþþüüü4¼ endstream endobj 986 0 obj << /Length 1034 /Filter /FlateDecode >> stream xÚ­WKsÛ6¾ëWàHÍX0°x§Ú&çÒ©£:I´IœRTU÷×wA€²(±š¸Îè»ø€]|û # ÂÈûÑÏÓÑõ;¡‰£Nƒ&Ó91@Œ´T:A¦3ò9û¸«ŠÇ¼ÉÇ06ûTû*ÎÞO8Ë®â½/}^ûøGP |üuúaôv:ú6âx#<‚Kj˜!«Ñ篌ÌpýaT8Kö­ÖŠHmq,ÉÇÑï#–.Ê(Çû1 ZmÍI…‚³Åûg“8§N)èlâŒ2a¢MhRé×íõ:|Ü⎼ÀÈ$"ª¸aºôAûú†#%n©` uO@O°„¥ÚØNíÏ1ºÌ¹Êžöaº©fè2 YQ‡Qd»Ú§•fÇUÞ<.£p³N¢¥þ«|½õM1•ýÀ—OéNüøNÆtgÖ«¼,[Ò#D³Ì‡^XUÎMíÁjjétʼ “-Z2\ÇxÑòN£åŠh¹¡Nˆg–¶HóM…œ‰s$Źߕ¡Ä÷0W¨Ãõ›2á¯ýaÈõb\#ݹ Z"?¸½çSQ‡XïaXD A ðK¨ TãB„à$üðnq‚w;_9:ÆQÆùñ1a]Al®<™"RÓÉØ& t·E?j™òÑô±Ã߈ŸZ!_ô°’‚rkÿ‡{Î_ !ÀK^©gf.ÁL®ps´ò7L‰Ú1ÃeѾŽKyå_D'¦)€|”Æ€|¾è/©Ð÷:sL§üc褜ÁÚ=:ñ–N¡ta­sÊö„·'RדÞpvIÌÙÍ- ÆDZƲ/L±‡b±«YÊ[팳«89$;îå¯#ýËñŒKJ9j•ùa¤W’c¦òóöï|µ-·[ 4U-. ¢ ;ÀqÊœ 7¸¾[I~Ýà!ƒà€ôázà2;¶nÚ™—föuŠÉ8ÔÅb7»ªg„ÉŽ‰Z+8c¡³B]°Â¡Çe"Õcúž]<ì1ï/ëMšm·~°]°X Í¡®±Ê ˜†Þ–ì¹e¨†Ú†÷>´U¾‚aTb¾I:MºÚÌa ÖéöË®ÊÖ›ê¹Þ¶ãÃX¶›‡fcÞ¥Á§Îè¶óË×iK;.#,X——Å?m3pF•‡Öe?tH.ÚëjO›o%±WþîÞ{ðã@bcÏ•m“†ÀÐ<êm~YæÛ¦ûLØsj€“ψû]‰uàä¦ÿ="è endstream endobj 982 0 obj << /Type /XObject /Subtype /Image /Width 302 /Height 322 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 24931 /Filter /FlateDecode >> stream xÚì½\UY–.ŽVõôüû½žyóŸ÷fÞoº{Þ›éžîšî®©*--s–$ ÉÉ@Î 9’%Ã%£"ÅQÉ9GÉ9§ËÍ'¾nÔ® H»¿Z…çž|ÏÝßYk¯½öZ8ð× ÃV,|²dxã¡!FAzàÓÕL4>80À°ÚVüðííí?vÒÉOV,½ÏÇ¥MÎ.®“6&™®ëy*ò橨[@€|šbz]ÙÒçʵ‚uTÁ™iŒè»Ý¹Ýxn Ÿ¨d·ágÓžÞ¹¿Ž†qzjò¹¼ª”„Q‹òI –PÎuŒ½UX´ÎL ¾ZͨEÓêq @>I¡˜W´&?Øx`"O\Rëh&Þ.,º·¦/åÃŒ2&L$˜è_tïѳ59‚¢(`" €‰‰<Û¨Ÿ€s÷ïß+’ÂíÛ·›››?ŒZL˜H0ñLصF¦¾>ÞÒðññÉÍÍ›› @> M-‚‚¥tãÆÅÅEÀD @>(¥hèïïOü%˜¸°°˜`" €‰€‰@€&˜˜`" €‰€‰@€&‚_`"`" €‰€‰kþ:² ˜dS½Ì&ñžâ•©«NBŸAø‘Ø¡nåJÑ_ñøÊËÕI™Ü#׬º¨è@É=¬8¡ô™&n”HL“ÔZ\F$›${¦ÖJsMêX¡P{ÖÒ âýW2:µNfAr¹zÉ™ibRd\yÑ5îVrBÑ n%OÁ ˜øñ31¥OoÆ3[%’ÕŠ§7à²D£öiQŒØÔHî™V‡J1M©#Wf4‘G¥7á™ÍÄJ &}Eâl ‚_ x†èºô!ÄJEI’\õ7É‹7Cü| ñ…êñÌ6ò&é[%N’ÑH°NôŠdLÜhÖ)Ñz3šðü&ÿÜjÿÜJR.Wú_mŽ~ÅÍl©ª:”QÍŽ(jö¿ÑWÑ þÂÝ&¿+- õxz½ŒŒZ<³q10·&¸àur=YÔ|»?±¡”Œö$XC²¸r1ìV³nU@^Cèý‰”Šãh%Hð·Ž6p­>â9›º(}ÛhRÉTॠ?êný.WåwF¿ät¯…)¶‚Ÿ0q AŸ+ý#Õc[·~³sϾ={÷îÞ¹}ÛÖovÐ8ÚÎ 5&©ìb‹ª´Uw}óŠCF{ A«<<#uïöí¦±­YݤEJœ'« ‰ Ú±å+à =YM“ææ&ʦçÂJØi ´‰+$#IØf8$㊦ŽÆÎm_nùú›í[¾Ú±ëˆ†Õ…À»3©õ´%Ò”²yç³ößüþ÷Z…ñÕ0Áhi‹BáWó÷þñ÷ßîعwï¾Û¿Ùúí¶Šºº×c .7ÐZuu00ñcgbn×DS}¿ª]t7~¹ÏîÄ3+‡OYîøNÓóþ<ù;Öpü’sT4LTÕ´ ü¯Å”AÄQi \G{ó}ªÖ>÷Y„ÕJ¨³GªŠ;Ž˜]ÏÂSˆ-ÏX© /á}2u4ÅcNN9¼{‡¢iXÈs(»ÏjÆÃrò”ö58÷pAHÆZ4îQ‹‘©®’‚º²™·ßƒyÒd­E)&ݧbw¹3«'TafÝ‚‹·ëþ½;”M"¢k 2R4LܘLܧbNôÚÈ–Õ‡§\¿vôÀn£¨ÎôF<é儵£Ý ×Șc†¾A÷fS¨^[ÒÓ còÚî¹±uxv3ÛÞÉ|ÏQ›sµxN#¡ÎF,OŸ‘b¢ÈßÒ„'=®×ÓRR´ˆ‰©ÁD0žÝÇÜ(RPP6(NªF©^!ÌHQÑ°pa¨k™ŸŽ¯N®¥84÷*YgÕ§¶ ¨¹CxxbøþÝ-bªÓZ¥Ü>@7­Ã[H&’j«O¿u]áЃ°–ôF¢KX®¡¦b“Ù—ø Tõ¸mzsJ e@ÖóƒâÕÌÜ®¾ËJ?|ðØ™¬¡ìfœA˜‘å²LzSñôAhFöy=ë´V‚AŒ:Lâ­œ>uÒTÁ*)ª„OY§³§åÙ]L¨œ¶¶6U·O‹zţܤ"&fÖ§¶I—R¥5²OR<•WC»›p 7¤uªbÕ‰_l%}•™ ‹¾î»÷ª8]ŸNoÂýÃœ«»…–â—Û­¬Ì•¯&UC¤_¥O~5|ÆÉEÓÄVEYIÝõJB5BR€P¬+˜H»CIvpý"¢Žhظݘ” dP”I¯e¹y¹ìÓ yÊ$TgBAîÁÝò6Y}¹ÃxhJ’¼–ƒïí Ê™¯b"iͦT±Ýljù†—£`T0qƒ2Qk÷Ae]§p§ c§sú'­ÓÕ÷»[…dÔõéÊïPw»S¦Õ°üb"öì3ôzÊ˨# Hâ Høµ‡Ç•öìUuô»?K;dÖb".f¢oxäM[·‚iòj1ù%I«e{x»íÑ ~ÂÊnã;XëíS³÷Š¤ÕóâŠ^¨S7¯eºxq¥þÕ,×@û£ZÞ€‰€‰™‰š{kX„Ú‡fÛ†äØEÜð¼ÔSÊKïÀ£â|¶þùßnýö€‚ê!¥=»¶}óÅoÜ«³;É%Ù‹,îÒ×Ó9î’S 3h U¿) ž^Ï?Ï`V4vÈêd4Ð õéªçlí,œŒ‰(‡S”)úú«/~¿Oñø!y¥ƒ‡|ûŸ¿Ú¦“X¯a’>%4¥šgwò‚yZ,a6ë0qÃö9O˜ˆÕüäJ~JDùLcuÊ@Ké°š{H);æáPă±ÄòÑ3gNîÞgX‹gÖ£© xò‹×' ´åæ­ma¯sÚÝ2¤ ¬˜KœÐƒA‘ẗb+$1®ä­¶âi÷;zÚ¥$7›qÑ=ã¬sÒQÛÒV×ÚßQ“D…¼RCÿâpt` &n°ðªØeº(œ[4Õ¿Ø‹çv“þ:5•¦F ’ÑAhR:îš°9ñœ×øÅâÇfwâWð+ýÉíųš0!©©(î˽ÂM—ºqj”eÔ ™äžé âRú¢(ÑÌíÇ/¶‘&q®Ôi‰;!®NziVƒŸ0qCΊ’¬E‹IOkJM6IÔJMAª]9J4+Jz¦&fJšdVÔÊIX¢›‘ÞS¤ãD•%31J2= LŒLÜ 3…Å3 ESw¥³Ôì]É,]éYŠõkL ~ó|^lõcÙ‰É+¯¸èÊ›3…LL0ÀDÀD @LL0ÀDÀD @7–ˆ3›ÕoðÀKz¿L3LÜàd¬ÅÒjñ+ôTG@CÀÄ-5XJ#šØ¾Q%¹™Ì²h˜¸±¥‹ïÆËc™ÿô›¹ßþyîß7–|¹ø«ßuªY¤ÖÀ `š&näiøi5xø ŽËÉ¡›?›ùý×_ï™ürçF‘Ñm‡¡Ÿÿ‚¸ù¼Û½ÉÍÔÌ&@FÀÄjšâÓ8²ù³¥_ýûëM©µì¬WsY%ó@^ÍÅöácßì&˜xµðµ‰€J€‰—‰S8üÙÏó— ÆõâÉ-xrëFœ‹I<+-&b+Æú¥žÒ÷ä`+² ¬–•®7·*Û&õëÈÜÛÇ–m0ñÝCðâ T B: /Cº@v&Úº†¬¹>­[ÁDql™œRIlÔàÝš@¥RaÈd›ù©ÉH]¥[­©´6¨(džþ¦8ã å/\êi OK? †èw¡_äS]õõS¥ê‹N%Êñø‘8&¾­íÑ?½¸.v'±l!¾džÄrNJ-Ó ¥š”Xº˜@nšÉ|ü«Ùø2vJ-š\N, W&”,$”Ì%¾˜=×ßN31¡I*g%W#’F"©ÏK^"©b1¾„蓦¿°Ì½¸‚LªtÂC)ÂJ2P‰_,u’«ˆ¶ —¥U†ÌzQB¶´Zøü0>òÍ.‚‰—¯6ÅUóSêdræ$—-$”³µ0±@kê+/ˆñèXÉUlâ!P[ç%›ˆ¥KÉ5Prùr‚ä1²TÉcP%È©çCüER*™‰\ùë/18©œxøKÉ+ÞBÂVt6<$©‚IÞL3¹¡½¶žLüu¢èU_Ç‹¾SçwÂÒIÓÔNÃÈVß)Ú9½:¦Œ›Ú€§5â)/ÛŒ-ìÕMì4Mí…bæ ¡o¬æz3¾’6ÐUÕÀNÓÌ^ÓÄVÝÈšØMËÄv—}€`Óæ¥ýÝÕ¢®›-}Sƒ1©Ú¾+H„g7r=ÃYÝf´ Ugªlæ(ª]ÁqO¢¥Ôá+'•1­[¡j…ÅÁ%—CSWUß–$ulÀsj' ã3Zÿ÷¿â›6Õ4ÔõÌŒm¦R°Rê&»w¶±ÑtK‹.wõu=vÂZ‹øÖÆÖÇ ­¨Çb§aêl|Ã7ýºÁ)uc;b«ºáu#-S{ #kmë¨Àû½.A1F6šæNÚæNZæšfNÆÞÙE£ÉT&IR¯U/y{™…¿HjÄÓøQ…/Íl]ŽxŸ¯—¤eÝ6™d’Q+ˆ,(>éäCÜ€ö)?Û¤òøJ˜þeÓ?~&Šs©Õ ¯ÜÓÖ<~Tó´©w’]x¦mP’±•õÁC º^1pF žü¼üð–?ËÛÄ:G_´È&Ä!2Ç>$É6¥&±>ŸgšE¬±tpÝ@^Ý.Ò!<çDÖ hógKÿúWo5:kZ†„½â¥7’™B©ê-d’Ròc=žÑ Î)8Y›ÚŒ í4² ÷L§2š¦”Ï»øEXøç'7 7‘5žjQáþ ´uMž3­Ax¸P/4ÐW-4G›è3§ŠÖ§“E°ôœñ°|·©Sí?ü þ7?;ý_Þ§çÕ†gQv ™¼·”ÿf§¶kd%’yÅ:$Ó9᪹‰Î¶ }2"‰'sÉ3§:¬°ÊõB–]x¶s\®ÊÎ/v¨ÚÚEå:„g8Ä=ˆ)²4Õß}ÌÂ&â²ã…\ÇèK¶êjJ&AA÷çI¾×áɯÚuŽì2‰­Élç%féYœ‘?´çÛo”üëñìª.•Tö9²À“Z½ãòÊÆ>ñ7¬=Ï8¤v2µ;ú¦O‡0ñ]n 4ái·™¥¼ž§ß©Ìüb™ƒ7­jÂ32Aß!îÜã…ŒV<åEµüÖ-F—f®õá9]ä>Bé ¨ÔŽ_zMJìõGjz§® _êÂxd?‘`bîåÆNNF瞧ÖÌä<ö+˜ /(wK¼ëšpÏïZWb –Ñ€Dßkò¹:œÚ@¿ð‘ØGgo9F乤VÆ”ñÓàÄLÆj&¾žWšC k]Ó‰×>¥ã‹‡ü/–†?YNkÂcî”»äô'>mrŠÌ÷¹1D¬a”ÏæjkžÛͪà{*¥š‘{qï¶Ã6ק’Ÿv›ŸÐ÷,LiÄý£½¿=ìUÊ21¯PCÏÐ>½?«JðÙþõvƒØfâüÉU¬óiéªÚ'íSãËØIËÁ ûŽê:_™ c¤(:Ÿ-I®ä$–-g]³Š|™D˜µåý¦6îÚyƒ_ï#™¸mû.Emóæn&®¤Xx+ÜuȈd"Y…œ`bÍD}š‰+Æ€rº…LL!Œjj¸ábÇ©O'$Ô‘*8£ÏéÄcoÜS8¦gÃh TsfM¿¶†¼V`ë¥^œ6V/÷ãÎÎ+˜H[§³š†Õ÷ìÖtÉIîÂÓk±Ì.<&ûÊáÿer ºÔBu­ÿ(R‘&¾m$‹xKWs}.ÄÉ«žô½¿L2±Ï®©PÚ»{ïÁÃû9¢fa“PA¼ÏSŠ«ŽØàØ U]³c:&ÇtLUt ;iŸÞLûÞÄÄùÿõ?}õÔTünoì¼Ú:í ò†)‰ôÐ@-Û#8\QÏýÜ“IdzF[•R&&=ë2ÔPÔð-Hh ÞðDKãƽN¨$š40ô}ÑA(>ßíGý%L¼zKSßÄ!£ŸÐ‰Á g¿Ý¢T“5žªœÜœ” Ý|‹&J–âK–ãŸTÛÔøܽЫ…òGOø†=žIª!Ëg¤ÖH³ðv¹ÁIGËçó#[„LüŽ¥Š¶ñ1RLTôLíÝyøÇ0‘Љ&GŒƒ‚ »Ãîô„ÝéH/ÐPS7ð?÷pè)'äß‘?pÀé ~©™vUá—ûÖ`"=ŒH,g×w«ìÞ£ížÇè!˜ˆgtâ —¯Ýõ¥~÷R N@:ñ£·NqR'&¤+*yÎe4‘+ÓkÆÜ/:Çßq ghèêûß#”ãeµü·[ sFs»s¥%³Mo@Sk±·èÄéÿñK+ù¦É-™„’­®ÓÖ;ªhõ€®þ™VÇóŒ‘׳÷»?îàaL31áQƒº‚’Aøý$ÂT®CE¹ñ±øçýã\·ìvŠ®%=6ŒÊI{û][·îÞw`/!{îÙ·wû7[4ÜÓâ›á Ätå£;·}·[Q×ÆÜïZd¡ý¡sWu,Î9×ÁcßÓæq=ø¥6ê+7cyc¸•šÐ:ýaLÌi_´²µÝ½ó»;v²sçÞCª:NŒ {Ó­ˆ¦„÷ž#IxUÔãÍL$)FéÄ!õ={5\r’Ä:1+÷ðŽ/¯#Sjuº1<6D?1,ïžªÊ±Ó õŒ&zxÏh¥ª•u[XYxÝ!:P·¤÷e7‘¿¾L5É Ãj&~>þ‹Ÿ›kX9Üdwà—H&Ê+œ¼™ÚBËõ‹’×sx8î(fâã-e½;‰-¤?“嬆RjЄâLô£˜H\‰ ­S#‡L÷8_ ˜˜Z9eco§b~.ä9'¥!ÏCž fJ¼–ò¯6â±Zl=œöíÚ­hSÁó ÒsIòêÁǶxÈØ?º•,®J{l»ý´ÚÞÃD¡uJô«TQµ4Ê¥LìŸÙ1Ù¥èW}± ߬`¢”Ǹž ñcqNªíQ°ŽŽi!»®D?ñ\\âžoº£T?QRò0ñ£öØÔ£‰Ïú,N›Õ÷ó½=™R §Ö!Œz8¥’víž®¾®qà£dõÓrZÈâ¼ibi@¨‘hY˜)aâèÏacÒ@¾í &êê+8î^ ‘L©šµ?ë¥dùjÖÑÃè[Š‰)/‡Oš¨+aJ*“x¥— 8…dû>XL~9df©oà{/£ ?—¼}¿cÈK5 LHQR>á˜3(b¢ ÍÄ´Úe¯sþÊ'|nOVwzÆ(Ÿ ÎïŠ+Ä>ê¹=”TCÐ\ÂãrÃwnÓôºÕiëàbá_<.aâa“š‰ô(ÆÅ>\è;•fâyi&ŠÞhš9W‰®h¨$Ë•·ïu¸9›ÕŒ #.êQ¢ŸèââHúN‰¾C#Bùy¤2f|—A’;l¹GÙÆ÷/« Ϫ›µq4Ý­ߌ¦Q±¤å˜øÑ{l¨ŸŠÈ»¯£«uÌØãtH®KüM瘫6q:FfjæþÞù#iÍD?±üÈ–¯ÒÏ&ß"v Å5þ†CäÈR¶X'†e^WTÓ?“Ö!fâð/þÑÍën\;éö!¬S]Cµ½ò&–çoùä¼r‹J=®­o𠽑cç¬ùÕ¡8FžVà LHP<¦gâÙ+ó™‡ÝwÛ”œ çRKÇ-Ï)èzx^ï<—}UáŠað­ ë ~ÙwÍÎXîW0tÌêËêÀƒ.Ø}¹Í–´N 3»‰¹]|ÂÈLÇþ‚[ês¯Œ‡¶^>*ÆA9çR/iš¸YEÜôÌ,öL½wÚÝIÙ Ð÷ò#]S[F'qçc[÷à?ûÙé¯þkŸÞYjƒÁSÊg½bÓOœrÔ2µÑ± pÍíKmÀ rQó„ታCû\HÔ¶p5r>Ò/Ó9þ†¹g¸GîaT‡e^׎©Å…·T…_{néì­wÆC÷´Ë û0—춤Z<éy¿Kh‚þW½3] ÝýçÞ7³?ôp>j%tâæMjzZî Òê11§wˆ)#÷$ûGhRùTì«%a,yWü„W£ž Ä—.¥6 C+Äí½Œy1B&^ãÄ¿ºðl0®d‘Q%•M'Uò‰S*gc_Î2êDQsdÈ –\>KÝv|+úFäEk9 Ä—%nãùHB—ø¦)‹ñ¯fÕH„(üÒ•º˜ŠEF.Žý&Zu⫱ø’9†¤L¼:æã^M%W£âÂâRe‰ýGâK™¢èYâ/’X:_¶HšŠâ·éHï,ñåXB9+µžBSª–㊇cž ƾ‰{9*úLF’T:W²”R‹ÐÁºÄ•\1M|ØW³©2Ñ€ |01UR-Wô2o˜Qñc¸TT§d“Œ4á©R» ƒÍêeæb\-zØF3±^[O^Éöqz›è*âyt(šôyèó7H¿^¸FØñݧ0Ú­^²loL5'Œz]q ñIè›—šu­h€Ñº"ÆUJ'}*ªÇŠÉL”xãþÔ—mÀß´³0roÕM¦¯¸[ñIdŸ¡øN¤fŸ&nˆ™ÂXªì ˆUªEñ3øª­ŽH…AâˆëóÛðÔ&<·ºBEþ˽&·ÒÛÄ5²eâ'¥£aeÏÿ¦«ËÜFêªØo‰Ò—ì&k ¬þ.kÍ–f™ð¨ú•]9ç«neuãÕ·$±NWÝÿ[orÅÃÇWÅöHâÛA´ÛƱNWM•ý3…±UQ¬˜8Ùéªù‰D‡Mo†3Ñ”Zi«Iº¢7&{'+‹k¿c²íê©Ç23j1ÉØMÝꩾ˜8?ä_4S¸nåEÓVÌìÝí’âÒÖéªû_ë&×øÖ«ft‚™Â {Æ»æìSÝ7©¯”fùÈdÏLü+Ííö»+wzºpFÑz<|00ñ¯‡‰D{Æää˜ÿû_ï%=ν×­ ãZAçÇ/×ó;2Êf&ÿô-é±¹ùdLÜèLŒÇ—~ó;¢=/þëïgÿõÜï¾Ü(2õ§íئ͂_üòòÃñä&@CÀÄ]#± ¿›RÜqܲKÍ¢SÕ¼SÕb£H—ªy—ªÅKŸŒÔr´n=rÍ&&þD™먰Éz,£Œ¹1e)µ"úŒÂŒ@-&nD¡¢µ(£þcôŽþEB¹nVÖLÜ€jQ’)qcŠx8X§€‰@€&&˜`"`" €‰@€&&˜`"`" €‰@€| ²^LÄ0L¼œÆH>wµFT¬p…à@>„Ôƒ‡°ÎÏ?©’O1ÑòÃëD1ÓR’]co†vž/ìÊ­®Â® ü¶€@>œ+hÏaýÄ7¯Aßí©ƒÖ‰4ËÊJ#⑉Y‘IÙ¤$f_H¹t>&ÍÌÆMËÄJÈû-c+= ;r¼uº&W31à“ÄO| ý>m¬#i-)f"°U>eÇk×®-..¾Å€|¯àñx/^¼¸°N¸~ýúÕ«Wóóó‰¿Ä2x 눒’>Ÿ¿.¦)Í}@° °~`2™,‹ø Åú‚¦áº(Ä·Œn|‚X/Fˆ¯ ( ¸^DxçÀ§ÆGÀ€ŒúZþ„K­’úªg¼b"úaŠ£äGŒú‡øH ½ ¥?R+Þ…@Q”øŸ"µ„ ùG}DøPL$(£¨E„$Ž"fqŠB´vÖ)Àû³Ni}H©A‚‹rŠ.@sMÌŠüIFÅÜǢКøA„“îJ/aR:ÁPAˆU‹‚™†¥’k±Áƒ&Ö}‡ÓGXТЕˆðcMÐUkD¤2A‰Ï=óMÇ"B­Üûõœ‡´ìz峇‚—á%Š´ £ð“tQ‘H ÜH²ïZn í²óÖ9Û¯qvPÍ¥W%rÀ¾ƒÙ€"”cEÁ“ø¾­Nü_i‘}ß^”Œ‘>”VYãS—JÒ„&Ý24qÁ‹”І0Š¼š»4`~¶[ËkHÓyP1¤Ç¢tþþ"²@~iÚ• Tâ§îQâÂ*KK´,rÃcÒ¾@±{^¶‹´‚A«8#Ë-ÑõdN-<#yE™ ☄²½µuâ!ÍDX€ð%H®!(ˆL„!AåâC¿þ®ÇÝFŸíÒ9S0M’G!´3‡TšÀ]Tœ˜:˜4ñÖ¢,`ôv½˜À8/´4Ö´ö/‰µÙJòa«ûO«Hœ$Ÿëo¬oš^DèõíxËs=í͵55õMí£Ó "jßÍi>1Â*%Eø…€Ë0QZI¡+>Ëî-`%…ùœK¹»ÈÃqæÓþ§½6¥²:u¥®{—yK.#ìéÊÇù^§µÿôÇo|r‹YÂ;ÁaÎÔõhw-uu--↥khEï$LŒ¿é ¬‹R¤_ ‹‚ùØ>WB˜ÐÉDB3¢X7»éÜÈIûÁ£>ý'²ØÜb_á’ú’øÔ…ÒoCÐ ?eë”RMÜùþá%Dë"˜¿<>:2½ÀÃÎèPßøÄ_žìî˜c{{‡¦!B±ÊO¨ì4 ªž åOôwvtôM@4•˜¹039»ñ9c=ííÃó½âNŽLÎ.Á”GqæÕ¥“æ¶!‘Ñ6–§c ËØ¢èÀÓÐÝß»ôê5‡Çêxál¨lvîê, "¨ñXÃý}s,¾äk¬«uJšOöˆ¶™‡'qÊû2ÁŽuvìSôì×½>ž°ÈŸÁÉ}jh(#•¶I@‹üÄu"ù–îÎ76wxÒuÊ>þê‹%Ç VÙËþçc®]¾x!"ÄÛÙÊÜÖçaݱ?{ª'ÆÇ5*çÁ!>Nו–´LtùY[„_Åñê’ÙÖÃNiá­"O³Ž*[Õî­pÔÓË«YëT¤ÙÐRÆP`èÅ¿‡ø8Í0|íú•<ú5òÆcæøS”¢$¹‡]H AÅ]m`–ˆ˜7¥ìØ£r£|‚nó³Îëd¶àüz3½C{Tm“.¾,¯è‰ôµq »6Ï!u¢ˆ‰¼’k tLâ/ß*«¬xz3U_é`@~Ñsz~=L^QÉ+êrE]K[su¤Éyóà!>3'î\É)*®ç@dk$zSÄUg=ϘGÐL$1~æÛ¯mÄNÚ®;YÇå´O®¬è¨’î‘FZoóÃ9+w4Ê»O¿s©ÁἉh¯nï^Ý´ñÀþŽâ"W”Ø %ê#â@ —àæ´}‡4oVNÒ:q®û±¥apN+52VPÒñ#¹‚ñú"|ìÝ£òç¹RLdö…Zë:&ß[÷ešý>‚$%7"t O=n¥‡Ê¦n›}±Ï¼r8Êãp¸|ÐÝOu–¦úW0±EëËm¾—^ˆ;PO.k+É®'<Äf±ø0Š}šI|„÷`þ¢gfûRýóÙ›>ýúƒÚ#gFø¯I #ÀQÉ £ÐÑ "N$x - i:Ò»­f¢A`-²ÅJ툊©M`HXHpphX˜ÓIÝ»T/â•…ÌlüZ†–èÃÙeŽ_ì4.ëáI¿ Hß)¶&Û´þ´Ýûb±xçñ'—H&ÖŽK{gQt½ƒ§EÃ0 •-ß èÕ¿5’2bå1 ç5¬_»øœ|¼(Ñ+„0D4Z!ì‘Œú|ÚJQdÙ‘L<¬y³JÂD[ õj¹?| yãM§T+ëš8ºº:;;pquóö )ŸƒÊoF›Ûú· 1%LÜ!a"&ílYƒ‰Söß}m•rO¬tÚoe¨É«Þîœ*S_ogÕÑ#-j—Ÿ šz¶«{õë¸ö«e‘ϳ0hW)öhp€Ô>¥<6­éûjTÒýDtªñîiC½Km4µÝ¬ÍDe’‰ðLçYcuÿ‚h¥¢e=¾mn'ËD‘N”Ž ·Î 4y1¼QÂà¦õ΃öI"b²‹Ò¼ÔÛ¦0©ƒõ׉"Ÿ Œ!u˯üFô݇µ\{U³'ÂprP‘¤(Ó†)Š®ÿkà£T‰â÷óÄÝ㇎Fܨfs8Ë 3/¯D+T ½ÜŽCfº{5\Øæeã~ƒbb™¦üV]¿ZÎ ±Ò2ó¯he./3&ïæ\H¹ÝDôœçEšXûJ¬ÓR»ßn3 ™ˆpû:Úz†&©‘z”³¼877×ÛTâlf”sol‘¹´Ì&º–Õ w©å–õ°Ù¬ñæçgT¬.Ü]bÃDƒæ±æÛêëǸëî;Ť¢Ýš˜¥ç†LÜúÔýM&¸}¸d´Pâ$Lx“YE5¥«!öú§ÝÒs¯^˽˜å©chs•`b‹™’¡÷c!ûc‚\}ân‘ `Wiì7=ß@¬n}~Îù”ƒg@BRrtˆ¹¡qÌ킉Åñg\‚ÛFD:±Âýëƒ'«Ðü@¬Ÿ[ôŇL>A8^q~jPP°¿—›®†š±•“¿_@§  ³ò# ÌìBBÏ{8YŸv¬ž…)ÚM÷U8éêæ–~¾SáCD¤‘ù2pØÌ¡OþáÜ©PR‘-ÅBÀE€5­Sº}ðç‡_Ü/*¼sïiqiwowMMeS÷ ŽÌ•½xð¼f„Þæ3›ë+kZx„% M?¹û¢‚Ä ™¡ö§÷‹nܸ‘»¶kŒl~ˆ`´¯µ´²a~Y@óš¬*¸÷jŠ‰ÀœùªO+š{x0ÁDAS郼¼«×‰#‹ŠnÝ,¸rñâíW Ë\ˆ ![ž©y~ïÊå+…÷žu“pô-3§^_ðvÊxÔ&ã¾\Wµˆ¢¡Ïöi‡ŽØLò†a:H?(É)°¶u*‰ó@!¢ã^0ql2IM8G1á¿Â`pQؤ¨«‡¡0LIy5…;‹s¸ˆâ,Åç&uA¨9 dô "\ÄD!©t#5há…—¦úRBÎ>j™‘õ{™ ùEÜòëå戇3EB¨DÞ€ïEEé j)m¹F¸ìÔ;\fl [c’&™*+m™É¬]{d{ÕI¥> pYýÝTˆ¶î­þ90kœ;Ȇé— õŠJà/¡¯J±j’ÆJ~à+xã\ Læ"2S±·tœ¤^«. ã;]ÿài*nF*W¢pÎ0¥ì×]e¼×·ÇÊ÷ÃG E]n§̼—þ„¯ÔЫìÀM€÷@E± -Ö†cZc3ÿ÷ÿ‹·InéŸÅ,(€¨¬å Àà]L”d´@W¤½5Hyó¯Ï¹ž´É›ãà8óÉÎ/ÿi¯M‰ø4«Îº& ¤SJQR4-\-š•óY= žæÊøffq$ôUböìýŒã‡÷nÛ¶}×ÁcÞ‰7Ç™|©‚Ú2 :Þ;ɼn(‚…¼_ýš0Pç >Êmb}¾iêÐAîüLVjC€u ðÖ¾˜¨Å³Ø,¬3M–UãpxCI%È+ÕÃãó¦'FǦˆ~ÐʪmÂe³––––Y\ª†UíZÀ'‹_š”Å$6±¹|!͘K×Å@e’Ò'â³gë+ëÇÙÄòpEá™z§­í ,nVtA"u÷úe¢Â…”»õËœåö§Y*ûöxÞ +„¢0$`³‰ï‚| IH¢¸Sˆ cs{×.ŽÜ&ŽÜføs9öÏ?[Œ‹!v!#Oi… ðfH6•ÁçAÁª{)S]kÎNM,,Á¹}©±I·ÛÊo¥œÉ¨îš,yt=ÿa-¢«¶m§«¶!üåöŠG©ñÑá¡çÃ"Ttý" â4WÜÏ̽Yþª8/;5&<$,.»iˆ¸Î]¹––˜w¿bY€JúM(4?9TóêaZ´¯ž¡kiß4ÑÂûKîßz^××YålesõU;$¬Æ+ȵޡꖱ,<’“åg²]ÑwŠ8 4¼ˆ ‹ªéŸ{ßÖ©Ä_Eٙܳs,3SþgŸÃ›>ãËÉÍ|ù%& ßU¸àïb"\ÿÕÖ#y¥cÔJd¦ý®©ŽšWjέ>¡²}§¦gtDDÊÅ‚ÆöîpÏ“ÖA¹s2UÛàæ'¹VÆFgÏEeçdŇzéjêf” ãçQnðQÅcž!I× ‹nßȲQÝ«ï–2ƒâ¼¹´ˆ ÆõçLª~"Â[ìn©¼šèãéáá™pïUã"4&LÖLJŸØœ´¾VÒQ ņm¶}ížõõI+Aûw}4Of^}]yÏßÕ«¤{úôÅ}lòV‰kwu,=Ê—û Ý´™°Q¹Å/8NF€#Œãà/u‚KéûkÉÖŠ2 ¹HV¨9m¢|TÝ©mKô…¸ó}‘¾Q2UÛ8#1Ά§C/ +ÏÀùç醱p¬$?BSÇèFy7ŸºPß%ý/ö›×Œ’û,ÎÍ-0É”ûðÒHn¤—µ“GHdüÕ[š»ûØ|\¦ó‰Ô?¶=%ÅD¨æø—;Ãò^Š½CWÂíÝ}ñ5eÜrX³33>ôgÉc¸´k‹œ…`0‡»¼ø·ÿ´iôùæe9¹¥GOˆw&6Sa§¨¸1ÀÚxkÕ¶ÃvyônkÖŠLµÚjÕ²ñNÊÈIOKËÌÎñ·?±u‹r1 ¯¼mjåÝ$ª‹Á)uøƒlÕ6reßK­­ÿ©ížÜÏ”¬×U¤}¥õOÄL$? ªTþ¼3œf"…¡<‚‰;sºe·âYò?9 EƒÂ[¥R%cüâ’Åÿó9rr„ð6ÉÁrr£»ö¦8„<:à­MJÂDÙªm„N”ªÚöà-Lä7T9|섹‹»‡‹‹³³3ùÇÕïl)/|kÕ6š2¼¹{é!fú ÊǃҊ†fÙR { &Rs^›}³Í÷â#ñÈb}jÈÝoOŠ|ÀèûÅtÒH2rØL_o¦œD¨Âÿû[æÿ;hÓæù_ü‚õº !ë'RTD ÞbŸR›æ´ý‡4…UÛ0d¦õµ‰~ÈEaÕ6-·72Q?°šêp5Póϵ¼âÜëɵUUÛvHª¶ 5Õ8ötÕ“N&êû*»EduÎ!’,ÿRL¤Þ( 1t¾2<UtEÞ¥P»Ýû­úh%Jñô¾t¢ˆŒdÝ jh“P‰¼––©ÿþßP‚†rrË1Q3‡p7ýœ÷Ùæq# bgÒ}L%Ðûo4³è¶:x]á2ãQ9“‡Ïi¼“¡!¯šÛN0ÑâÄm·û&zÛ¹E ™¨­´ýD@-&{šèÛÇ¿c‘u1 nsɽG5C8Æ}r5JV':üa‡ÅDdq~n‘ÉFVuåú«ï¸›*ýq§~ñë zH†ø¯«î[YžÉ}ÞÄ@¡aðÖ[.‡ÙT÷“Åýå.z´ÃÊpjª ÑOœ›™åà÷×O!À”ƒ“Ÿ87oÒv鲊Š`aa9&úÛŸs?û÷b7·jA1 Tx‹ãAØRÇcì ôƒï?-~ú°(á¼ý­È\J'L\Û:-#ub@qš¶Ò|;“žI·‹nä$«´ŠyNPäéµh3Yø‡Få}ha(9Ä71ï)“àÂé"ŸüŠ‡Ïz¦™ÊkxY˜™‘æ«©®é™™‘Yø²‡àì…¡p+msç +y—ÝÎhy5.p©Ñ¨»üŽ—ƒÛ‹Î©÷dJJÒ”‹"¨ž‰!íÒùgÖõ<˜è¾î^úÍ¿ò7}Îùåß±)Áp0àmÖ)ÝV™C 9‰qñ)i—ro”U•Þ½w»¸fGÆò¯¤^¾ßEïqf_>*ºÿª…Œqãäf%^y2BÙ¼¾Æé‰1ÑÑaaÑ·^¶­ƒyÝM¯nÜ~2±À£éƸ•tmp†˜“wr³n=«cC(&SŠÛ«ä˜SœŸèëè㛘_Ì¡*G-Œ¶ç¥\ð¼œS?¼DQƒÔ¢ýõOÜ­moWõŠBÈ߃N¤­S*?†C0>ÌÌÌ!:‰Ë{öð;;yÄãøœ› LhÉŸ¶|ø(`˜ê÷í`MëTºîiü!â:0Âi¢2k˜8nÕ?Â"0ŒŠ8.?ƒ¢2¥‹H¡â6²…§„j’>•Ô}&]k:í¬™jÎJŽ«h{_LÂDâF ²V*hk›:x˜"àp„‰O¼v&Ç&ääØ?—cÿÏbçß”taÞBÅ7ňJ5òÁ¨2ÁÛ+Ædk²ÉD—¯¦ôZ™Ôõk·ZlUĹpH&üÒä`}eå ~oD^ÔÝdì Â#øÈç@íü±2@XEÆáÓæ†DÏ‘ÿßÿ/6BÞÞÒçY§ªmRs1VžOš·kQaEй¤šxFªf‘"}/Ö)ºê'¢(L˜Øñ!È1~Á,€ø‚ž¾ÙÍ›yûsN°Š@RSNÖnÖ¸,)dt–t‡r5Q¥†ýpéR¤’îJÓ—JN½á®VmÂVÞŸ,‘WZ}O¾S‘ù Ó9MaR7 `ƒ¾¡A(Á<WÀq²ž•“c%^@$_0à¯þ•²BIãoÔ«?Ú:ÎK¤1Q¥Ü8¢Þ3¡9¯Š'5µøµ0ŽƒQ €Ÿžó¢@ñTHQ%a(ÊEƒ"ô‚h€Ÿ°g-™Ù,þ(éãÒ¹VU2]‘+K–Ì?[er‰ˆkËäªÃ¤I-LÞÀ{S ØŠÙ7Ôv+ÀûÔŒÂTdp„`Fy’Ùà`z7*NÃQ`¼G2ÒÚNèRE&€aCq> ·,Öö-w!0B×[ àÇ«>L4×bÅ@&w‹`„æCPˆ*;ŒÂ¯¹u}Ö.½ÇrGÏsà%qªW€§øp1qñü©!BFâá”3ÄoωpmÕðT±<š9yž/Òy²À“ø _úkG»ý Ú«ÃÞ¸åðbÅ©WÍÛøi®$9¹hŽˆdò‰Ô=¦â\˜õtò¦OCß1·!M×A]Ÿ^ýã—¹0¡áß‹8kG€ÿ@Ïߊ o%Ó_zkÜ‘xð]f0—ž‰‚ÿ(ÛP8… !sž’k„Y;PQ@:¡ 1|œ;P0™âÖ®á1¨æ:¤êÛ¯“4ìùrþö¢`Ci…ˆ‡ À_êyŠAÅ›ÐÅDìÍÅfVOÍÀ߬ˆ1Ù)^k^èÍëñã·©?D8wR8•“ p#3} ø(·/mÔß}@Ý©OÙ½O“1~öÉdÞ œÔ &`b8OüäݪÊOØκ@€3ÔßÓ7< !/¶6Õ¶õ-I+IŒó›µÚêóOöwÕ¨¦PUYQS7<»DWXS{aøŸq\fê¤`y¦­±¦ª¦¾o’ƒ ‹Úй«¸M•5=cK¸¨Çj%ÿ}­Sâ/„†X]£œ× Q*!µ#‚p{ÒÆý<†Õ­{úݙΙäõ >º*œŽáˆ±ºîµ¢$˼…ÞPOk×ðëóDëf×Ù™k8Ä5ã’zRï4Z±µ”\í¥¦¬ ¤¬ª¢ªrLQáàqƒË¯ZùðZ3œ¤íÍ•÷.ö™ Ã­/½OŸ?*øàu³Èôuy‹½™!.Ç•UTUÕ¿ßBët•ÿ½Õ»p&ļ<™;É‚™ÄE0â?t‰?—1ì:¨ìÔ«>hÓºXÁ‚–È®h(´8?7¿Ä"ó@-“¥N¥Èt.+wD% .d¯¶z 'ÙMçˆvØŸ9>2:::226±Äá"¢‰¢|‰â3#Ti&Læ|W Æœh ²Ñ1r ¯ï]ZJp4Ú{HñJ7™müv¢·®Þ©Ûå3 Ë¥—|wo9œ×½ýæþ¢'Hý]‚gFÝ/ ;,ÂÓÔ} ø8zwé’S’{¿Vt¿}×R„ðQ F £óŸb¨ì´ÆOZ'’Íf¶óî½'ýStÖ_Œ·0Röª¸áõ<.˜~ù¤èUÛüToÕ­;Oº†ºZ*«šúÈ”lËâºdæÌT½|tóFþ½gåL*/)"îi.¯ï˜™©|~ÿÆ›OJ—({SÀž¯-}QÓÚÏ'ÃLæÃí•ä-¯Ë¼D5ÜÄ4ƒxÌÎÚ'^§ }RŠqt.Pñ;‡øíƒ3DLV”öbŽ6½t±¿[;,lÚC—wïÚíWƒÌÕyT÷Lx²Lg>ÆfÏ[îW²"¯;7ÐñôÙË×ãË(öýu¢¨{Ç,¦øDYÏB£ôˬ|áþÉîÃCÇC†N51«(k•$:ŒÁ0.@(ëÌâ©‹Qÿå–ÃWJÇ©OÈLûSUÏÔ&œ]¥«´å y¼‡‘¢¾­ÿ£ª® ¾§¬WT¨Á';ž{Zh*©ëÙÙÒ8zXAß¹fŒ‡Ã¬WÂŽ«ëØÙ:„Dœw·Øµc·Cè qèx›§…¾û…kód­ÝIÿS{åŸÆãÄøøôÜO Ì}Av³`þÜäЫ{y®æš‡äUnY6·=¿¬{ìÄí†T¤ÇêÒ½(ªÞ™Ç‘¥ÉŽŽ×SK¨}}&†ph"’µÊQTRôXÆ× °6mŵ¢ôÊdã_U¡†;Öl©rDÃÒ.0ä|sA^nN–æ¶/汊 ævmâàåŽ_Ùø¹2ÍÌMŽNL/Šîe!ÓË\Íñ oùn¨“éÉ3^ç".Þ|Ü5<»¢oK©<öëƲ¼¬D?{# »+ÏzÅ m¡¿î‚·ái÷;å=´ÿ¤þÉ}½‚†×⪋•)žä?`Ê:bQô‡hD2ž ®b=0Œíµ÷0pèSIõcÂst!jÄ_˜ÝÇVøÃ?õ~¢„‰M©ûkŠ¬ÓùŽÇ¶æBH2ñ­µ¢ø-vÚÇÜ3nwN  ›œž››arÙÏ®¿±BŒß–nûB…>Mö”· ìŸeñY ƒuyéQNvVæ–Ö¡ úfpj^ŽñÛJ‹"üÝÍŒL=ÏåÞ}Õ?:Í —†›Ï»š›:WtŽ ½“(2XqÇJ[-ái›@Ôô¯Ÿ3?¨d?¸B#þ@‡ cHÝr±ß°¾{¿†{ŸÚù‘3“ÐIC¡’1ŠðïÖ$#Õ.z²öîQ¾Z;C¯í+½ª)¯z¥ã/¨U‡sÂl´Lý/. "s±åéíâNb÷·ÔŠ‚&=§ü±: ý¸'ƒù£6:FÞ)“K<ºÅB<ÖÔPWñ+¡¾.'  ë1”•a­®ia“ö¬¬qbfQ€ˆSïcgú#È- ©‡Óƒ5Þd­er•Iß'³õÌ‘¯ £ÊIj#Äí(—öú‰´šCP¤‘Y8läÞ¯éÚ¼ùB2v SÑÏð×®\•·1*mj¯|šïi£¹ÿ˜VÔ•vZ'¾ƒ‰8\'Yåà¾Ó>î<|x1Æçèwßy\®'Hµ&ËûøðâHFdpZ~ñ²€¸:+ËIéß*z…Åf¤'{œÒÚuX;ïe;­ß$s`ˆËœi¯¯hèÃ1nÓÇÍlgù§{(2P}ÇBi‰½JZzZZ*FÑó¢ãÙt/Eûèa+° FŒÎÇ»—É=¯nyû†ÅÍ#tu qD **)bbCO $û4?Î>öçß²s÷®];wî$ÿß½{·•w ‡ºÏŽÒ+]ÅmÛv[ø0†ig,,h*dhëZ\z5¡+Ìöï¡QnX.ö1¶{}´›Ýˆ ’dQR£€„oVˆTs^s³x-ÑÙA¤;8(ŠHmBWNÇ?K>‘©?Y‡tçlÕm é…ɘÑRŽÆ5;t2…¦Öø2ÈêCˆÛ$þrÇz.%¥>l…~ÈОÈÓƒ¡íÌ¿ÞWg9"  ¾_;úiëbàk×Å:B*-(¾bR’ì…%ï ©þkG—¿%Ú{ûô-x¬£âÊõ;ýó,©Ü3ßÏyJ+î ÎбK}Kä{F…L\ø>þÓu¬‹!™!¸êÂy§íÍ3@0|¯W}™MßÓ·)ú \¿t¹RªGˆÊY¼Õ"~g|oê¬È‘!L¢ˆ¯Lió“døk6ÌŪð‡åâÆ@1I†aI‡]›ó?µmÉŒ¶È&ÆAra€CEº 9Ñ?ä“saX€Âªã(Àar>",Õñtx/T¤ë#L%3…Å 1ˆ>"€ˆÌ4E§ùDx:‘$"¡úx(Ê£’ ‹k™B‡LùM."ŠšÂï«ŸH‡!L„ Õ‡S:êDŒb(†AÔ ¨0À{å"5÷ã/-ò{›ŠôFéõŒ ¸l‚"Š?Ï àý‘4D|Ö•K“Ç9µ•â,Qýø/‹—â¹y”.R”"À{#"[39É<¦2»In9.ása G ”°[ÿü_ÿöo¬çϱweZø±Ö)†ÁÃì]{Ùrr‹ººð̤€Šç–/ÊÉÍýýß-]ÌÂqÐMxŸ<¤R# ‹œÓ69ÿükÖÝGŸÌ39ðû?påä˜ÿðÿ3¯\g'LøÉ:Ekä_ù6×Z)VŸjÚ²W^ÿBM͇ v|ÂÁ;B<½a›ÊŠC>û%o“ËvAc›°Ÿˆ.¼… 廓!ªÆ‰®Ý•bÁ~h] Él{ª»… ' Ó³at2aÑ™TÄ’ù2êi”"5XA²Œ_S³ôå×|B-~ñGèuÏÜÞ°ÜfÎÏ>_´´$ÓïKž`"ÀÛTÜ;ëb€ùË-õMCdînh¦¢äYeÛþCëbàBÓŽT)¬ÙáêÒâ'Ÿ¼ª¨^¢ê~’”p;ê+ž>yò¢¼nxzI\OFzáúfi¢Ã¿‰Û,.1­m s”µIŽi`Äüå?ò7oZø—ß,ݾSS’Aºo€w1QjrýŠÏ² æ`b¨÷¹ä»‹<gÙñ[E— |E‘Sü­IÒVn!—f:_†8™W;®~\MEMÃÖ/±ux!:_ü¹Û)úšÄÇ5µ­}b‡æT&âúº#)•ˆÓÅ:øÌ»UÈýõoH¿ ¡åäØ?Û4­ Ï_fL„:àmÖ)•Ù7?84²Ä„ºÇš›!ø†pÆF&–`”7×Û78·´ÜÓÑÔÒ5"@É 5ºÊÂ<6tºíù‰áî®®ÁñY!©xyqvj~™PC=íÝã3TB¢ÙB¼™‰ñéy&™’ ]Ls=¾õ¨ÍóÖÞÑáÁº‡Yº*ÇÎ_zÆEñ‘’؃;‹jFÇƺ+oÛè)[EÎ7‰¢Ÿ=64¸Àà?lšýOý2#T„ ¼ŽvÎÁC\¹Í\¹MðçrD·q9÷ùh`„Î>˜ð–fDü÷ÙØ{½ LM‚KCUÑ¡9ûpNgˆ·M`Níµ0ks§sÏG䧦Ýxµ,©Pƒpf^ä3\ìmì¬Lͬo–ñÈ”iìªçùQñ©×s2"#BýœO™»?­ë'ögO÷Äû{Ä\~Ä`¸`áYAvaù°ðŽ}áNúá×¹8zíô΃¶ñlц‡©>òªvMã ˧û*] ¯U¬£u*1°é„-=7Ï27ã}ö9¼i3$'7»wG¬GQÞa@D€·2±9mï‚Ê j%2×õÈÆÜà\N+ί?i¨°OÍ&6=¿¼¶qp°÷B€ƒ[ÄŠÜn‚²›ñšz.UÖÔ¾,LT?°?”`1Î+.ˆTPPp?ŸSÕÐÖÕÞ¦¿ïØéÐ-åg1®?ªf Èö ø‚Ósk£µÎ&ç/—`ø„Ýö¯Ï¤Ü»J;îdª)¨v7‰.Œµ'Ÿ{Þ1ãë鎪c* Â1Ak sß>¾ÜftÓæe99¤³“x# FLRx·ït­lüÂlü§Œ”´Ü‡¨=×βÈî·×³Š*šæ Ïö8Áb·²ßŽ•\ ×Ò7Ð:B§u›(4ûbŸEÕ ñ å°Ù\žU ê þL^˜†±[uÏŽ·i}¹Íûb±˜‰O.k)Í®'ý°€µ¼Ì#k¯‡NÄpiו[‡–ÙK>ÞKŸm–ƒ~ö9œQtŸøvdFc2,\*µÀðÆ 5d¾ÓCšùônoÈÆßj£~T×Á7-çrvVæÅ‹9Á®ûö¨/ã•…Ñf6¾ÍCK´Öb•9|±Ã¸”Ê.혥 öôµWy5³¢šA298Þ¢õåvŸœ⛤™˜S3.íÑ';Å>ük ¾HªćO™¿úGNŽ³YŽ·y"'7ú_[p²†ÙMÄ„€¼ùÕþnHÕÅxø&ò&šO;°ûàU55UUUuuM}£S§±ª[Ìmý[ßPƒVgô`"9q#Öá°¢þ’h”¡:a³í[)ë´³(ó¸¼ÊÍŽ ¡”Jºˆ}ا&©ôD½’!ló¬Û¢œ,'·øo¿]úåßC›>_øùßðû;(Ç)YÉ…€ƒ†ð&ûmIßwP£€®Pƒ¡ÓÍ÷Oê…\j{g] ²j[ûÿkïJƒ¢:Ó5IM&S5™ùsïùq«îü˜$•™s§ê^“hŒŽqMÔAÀA‘MPj .lŽ Q@P4¢&¢@¢ ‚²ˆ- ²5Ý4KÓv7½÷鳟{–^NwC&™Q¡2ï£eÑݧ7üžï]¾÷}Ÿ¡+2¿kõ~qÒr½,g2] qÔD˜G/dG/Y^Û;.~s‘ÌßvÂ)na¿V”±pi\»Jï:lqT¼r›è>?å­!kòPé#íoÞ¢økÁ ¿¿íµ7Ð_¼®\Ì^óW‰õ€‰¹8Z0{^ÖåGvµ5 çs—Ì8ðu'ËÄ!sV&¹UÛ¦ÅíȘظøÿBvßgHõÉ]‘+#ö4w™-“^}íÌ¡W¤œ.Æùœ°˜ ãßy-ÇD‘÷<Rã\‰ÖmŸ9s奎1ÜfÒiµZVo¶²–òvÖœYŸ•5ËÌÓXç­”õË"÷—ë­8K?Ôªï’JG È«Ï:ô…Ò ’B¸(4_¼`a9è÷º)p%¦×›ó£¿zyíÖwÞ³=–²f‘;Åðkx,*‡Þà©ôÈëã¿*9SZR˜™øÙªÕYg;8›2™Mlbm"ÇD†Q<ªN‹^¿9A’•“³7mÛÚÕëò¯v ZQaÞéÖw?X×,ÃpüPzRÎékfœ¡47-üˇ ÃöfíKO•¤¦¥&mMÌþúê¸ '±ñҽѫVGHRSã6‡­û¢¹_ËwÜ2Ïû[‚ƒËZ•S;uÎmã†a°á!ER¡ÍÍcýRãýÎré"Áé$ËMo¿½þúÖo,Ù9ì~CP$å]7xXDamØ4}•e¥%¥g.UÔ<é꨽YÝÔ®bȱï/Ÿ-¯ë\2o©¿^×Ú…à ƒ)ËÏ—\này)l´÷á•ó¥'‹ ŠŠÏ6J·J1YçÝïjÔFTà ¦¼qütÅž$,šÚÊK7ZžØIW\>]Trª¤ðĉ…Çþ~ø\M‹át¤lúÑúʲü£ù§Ê*:äÒéǺ³vÆŸ¬yÊLÅ)†¦RüÌ(Œk×'ÍgÎéX×tö¬5ù\K”nÏnÜÏÏüækæ>¶w÷ñ1}Q€â¢s£&q Alvçb7Ç ’kFÇP '¹ Šîçý,’ȨqO·#{—`j…á.ìåÂÕ|jGQŒ+À¤H\x¾<C9ØQìvö#üi9/fHì]Nº£KŠ2Œöä¥ÆU=zÎøÖÚ½ü Ña)®š” EPxoŸ!dõèQŒý¥pß• ~M~~¶_úYÿã?m/ÒŽ^ `rïÔ5*ד¡”€{ ÑušTŸ3kϼ´G¡¹ˆþ¢z» vÉ ç-–¡†¨G”fÖ¦º™ñŠ"ÇDš©H"¬eÄíÄǫ́&øÊ6n†ÃcQ??ü­_‡óç°`#`²ýý…kEÑkEÑŒ—V”O•/]qy™gö•~ÕÛÃwC1ü!!ŽÑÁ:8†’\–¥p‚%$‘ÊÏùÕ›æ/ÒYÃN3 ‹ø¹íŒOÃò+&£ 9‰ §—Á¹Qß<YVrÓÀÖ§¶Iµ¿|ÃVp„to?à…ÙDG«>íTïÚ¦ùŸ9R–£r·UŽur:^,]Å®´O¤ìŽºùd)_pK³ÿº…ŠÀ MظŠÞÜRo´H,YDI¯¬–(öeD̆?Ñ;eÜí®^Ãuh,1íU"ë‘jrJR€ÌVù â“—õ<çxù¤äõ)OÖ‰è) Èã4Ýà×¼16áÊ÷LqÆ‘5’Rë=òõIŠ¥‰K2úžYØ)+æÆ"Å \°ÔÀíd¼äÚ<§<¸~FÆ{>[·9£Tgcsãò Loó~îD/>áòeœ½E-Ç>Á)ÿæø“º²OßoÃñ«:”òöQ§x;ÞÜ€ëóSó)F\/h¹á86l“eFmS,–ÈþV2”©µp,7ü†5•åìÛ`ÜÕ«€{ÏÓ5ãB<¾Ð-›È@fÔëXCȵ˜›ƒ>t1\‹N¥C‘SI‹¢Eoá¨9!q;këP‚tª%º……ì¿ÆÑgyIëf¼óûME5ã¨ãs ¯7}FRqÝer¶2vWñ>a" yÊäDÙ¢äþ e¦Î®")œ ¸Ó ~*8E¹T¯À  …yzYÝ­;CD¸5ª´µvÊ ®kkªkíT+:[ëïÊUFyoÇ“ža^+ªyÕ’)®Vö¶57Öß¾UßØÒ­Ô\¸„*ºï·?U ôK´55Üjh~8ÂM…c0›±£­Uúlg_¦¿>nCTqeÝÓ¹Î`ÁIJ”Ÿá†ÝpãÂÑ1qÑsbŠk8›HQ6ãXóÍ›}jó4°‰cfÁL»È#Õ˜œ¡+a½ò<ÓÀ<‰|eáØ1Ì-ŠÃZCœAI÷¶Ëà~/ë÷˜qêö0‹|Þq9Ð^⑇Œµ)àã·ÿ7è@vZL¬ä`íý®/·­Ù )ÑZÅ 5´üáõŒØð QÛ·'F…‡®Hºñlœ!-•Åés}úùÞœÜìƒ{Ó¶Ìþ(!¯ÂÂ0VUמ˜Ÿ+7Ø)Ú>ÞTu:%&,bkòþÜüo¿«ë–XQœ ¹)T÷¯lŽùöJõáèåÑE×X&²Puß ÷×¢zù4pOïmÃ-g‡rÓVw›Û ¯Ð%<[’&þj(} U™J8Ùp¹!Œg—àßÄã“X~×=?>2t7üñ–°¥ó–E5È´ÜÌüqYNFBJî%½X¡SH ÙšÝ)HÔ êÜ- –l)f]°ÆK9Ë>[Yxõ¡7tŽ.wÎƇcœ^ãˆR1ò\O÷Œ@ ]êKçI¶oÛ‘,É-®6ØØŠhûƯٞWiÑ*ó7l)˜HcˆYÞÛ£1£Ì Ϙ˜Œv©ÒïìýÛãñ¶V}uº<$E˜5Õk–r4äœ{R ãêÅ`ÄBåÀä 5˜4rÍüå›O —¡hEÝÇ5O®K=TyãöõêêÚÛ GÓÖüñ½Å-(ÓRž•Ò®4 OGšâßý0´©ñ QÅ6A?Ôu<#ìí?-½út„ý$õ§v­ËäžaRäoò=Sk¥ñÊsµ9>$~ÇT™ÑR>tì€2&Y±J"_}ßp“!>GJФó<†§Á ÄL,úøO…šˆu.…šU;ÜÓø}u1‘öˆ¥ó7%ì;˜½ß¾ýû÷ïÉHKÚ‘Ñ¢'›ËóÂãv»g€7{*ÔÐ^2àÖû׿ٛ¹1Fr¬G‡jž–¯ X~¤âžF¯~Üüeè¢ ¹gŸÈÕA¹²Ó Ðr|’"î™kw+Öfô§Éƒ¢»Ý2|K ‡Š\¾”rÔßxµìC¾ r‰iÇD§B®«&&Œµ‰…šÀT¨ÁTO·®Zš|ºfHo×jXèf³É„ ÖÚ ¹“)Ô8— à’çóBW~ºxÙêƒ'/=ê’iô\*¦1óÃ7ûß3fΞ=û£™3g±gÍøó;sã»]JÓå ŸWƒ¥É‡¦† åÚ$Ùò¸Þ…ߨó1¡I^ƒ¤„pMƒ3 ˜d;çWEé¼¹gy“HöÔö_¶ŸW¨ùa­(.N´Ës·…JJUFÇéyø GÍPÈÉ™(äð¹¬zé?ë£O§æWª-í8íæÖ,Ú,V†ãÃyáþÑElüˆ8DœK{Zìi|~é±±i¯býÙŠ½Ê•MÆo4îÃ>o ©RÀ$[¹c“î—.ÞyøÑÓnéÝÚ¼Ï#f-ø,ûœ 5×›‰n­¨¼B Ùö}ap@À®cçîܽw«êtÈÜÿ ÚÃ:´øÍ 9a±ƒF'·¾û>§PC‡OÚ_\^o%d´ëBY•Š>ó8ÒwšðXïß7.‰*º*äNuƒí™ ßKG§>uêìf½ÐvãíÝƒá ²5šó/(0¹xØD×4\}ïíô؈ð¨É®¬ªšÊÇž®êfˆÞÌôè”#ÍŽŒiøìñœ£_×™X÷‘JÃÓ ;y3jïl,O‰‹ ]²zmäW—Û¸ñž„íÈ.ìSYD–æ†ïêÁ1üÈîäCgªvÂz¡| ÊiÑâÕ žÿ2á@e³‘/{Þß´ÉÑñ½ŒkÒÚ”F‰¼M$¥¦ÆTyÐeì8¦â´Dhh;ü“(”µLxåÉQ±6åñЄ§=n‰ßBü5Þ†·¡óz1ö)¨EíbaÅ÷™ÚýŒÿŠ2sç‘þä»ú:’"8Eo®Ï :,?–ŠŒ‡z…+•çÒðÌQÒžšÚ>3<=¸ã«qȦ…2¢ƒµ KÀ}Ò2´“‰6ÃX]Õ7=j”a¦<ô~{\hk#̃¶>3fàÌ6_U Õ¤€ŸâZ¹I9aLãm¨|›ƒ½‚báoŠŠ~ðY¦ô$ªQâ/d’À­&3éô­§‹ÎO$4zÈé𣣀Š€Ÿshë1®‰žzïÔkx)#ª¤ÿ2ÀÏØŽ3bAÆiàzhBŠæCIüœiè{sŠ½S/7ß#é TüþG Çu endstream endobj 983 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 195 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 42917 /Filter /FlateDecode >> stream xÚì½gTTÛö/øzŒþҺ߇þðï~côû‡ûî9bQ9Šœ³HP@ň f0D%EEr’$9‹äœSQT®½{ïÚUEINº÷œkÍ{åTíÚ{íµæœë·æœk­¹@PIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%ýCi´&>,µu7 ý pÜîê/"ñ“+y/âBCÃÂÃÃS^— ÅW'êÃC£ò÷²³Ãnå|ãÊ¿»óóǧ"ÃÂ#⟿ZÉêòùMZHÈÃ>Þ¦MÆ„'¦—ˆ/LDß S ûÁ} ‚+ËÍŠŒ¼ûà£å {¼#ôaôºº0{78B±ÄÐ; “À@ñä+ÔÀˆˆˆpÉ«"[Y"}€À_LÕ14,*·¢¹ÞZô*,"B‘Ma‘¹°æ|I»_ HxëÈLÓÇÛ‘ñL?!Zòˆ¸ÁáRn$¬àPsA˜” 2 Ï(‡Š±º@Ÿ7.G$gZ”Öp¤­(,âÁK Ç~0÷qPñ¸œvòVDEF½m“oÚxgqä£$Žhœ`¥„ÜyR$”{ ³»<4.M´³Ú|[›Þ=—2ò9ønÔWžlÀ¦Dk¼[Î^ñê¿>„gµ#›õsu…:Îü-õXs%¨Ù»_òñ°7?æïfIÓ= zº#•„3åÊߺr†°ÿ| yµ€9rÙKdXzyûú]¿âuÔQã€zpNrk¼ïQ<ëÝ+ÿüì›óšœ½G¸ø[»¡*ê°oÀM9ò¿áÿu~´a¢RphÕ°#2^iÍÃé/ñ /ƒ*švüäKô»~½~ì/ˆ ¸xÜ™HÕ¹ê¹áw»…ù`ó±-‰&J(­nºêQO_¼lFG»>¨ƒú×ëûÞ 6ݼ’ ó™»Ð¤‹ÓÈlš•ÇŒÑç–ƒ"^ôý ¸ÁþÎzdŠÍñ @¸¿ mj³ïèú7ü ¼›\ =/\( ¡ñçƒîßSŸ¯³M²ŸbC6憈ÊéB¹F]füÚ&’5l¡÷ ™n†ÇØö÷´æ‡SõW{dØ‚‹‡QËhœ“)ÿlÁ#œ•»hgµÐæË«PDÊgœ­‰:Æþâ[®]¿÷•û¡ 2ì…B˜„RÉÈÐVBIoIoA„ðu‡ÌótrzÃ(É«ñbÿ<Ñ{º@®ˆR„ÐkY!"‘HZø…üœDÑ>ÂÀòÇ>çsæA`Þ–¢–Õ ìŽ6=uES }×sF\ìÒç‡(Uôƒv>Œ6>.ÖG( §5¸¢ð,ð±fØZ¹Ø¸KÐFïgTÆÔ/â%„6äþGUuŽ¯Êê$‡6¦ûQÑ» #%Ix†ù2O´¦oHA(ƒ˜£ÛDrâŠ6䀈jg ysùxrå7Ül ;/o¸;]ƒP<Òš^ÐÇ[êü@ÒÑŸ\‡Ð朑ÛÕ4kôʼn8÷ ñ[^Ÿ7Áå-Pô™lR,ÿ„6tã#büØLÚTÉkòð8 ‡r΂ÑæÍ= ?C\JÕ„ì9´ÿäxáR.82¾ÉjòKÑÆMzvçªÑ5Ž¬åÑæ»jÓ‘ˆ·>.Pj|rœŠÅ;9fo¢«oéпÈÛdÛŒ‡Q0î'MõômÜFac,Š4¢žÍ1×ѵº[ãM!“;ü¼`Ã*lQŠ`žmöJÜéÞ>E#lä[¨9Ñ-­ImfÈê¤ìNÉp{͘|¾^gG¡˜ Iž[µ#“_¶ÏÊŒðßåæP ñ"☎¼:…6¼†”²ð9Lí ÁMc¢- GíE\἟T1¤ ¯Üùk‡uðÆ.g\­„—¯Š$EChC&è.'ïæ¶F˜êߪB~~q„q«²$æŠ mô¢.'ææÈèÕ«œÂnÑ÷Ð&¹nX0RFDQªf›lóƒšgž¾z½QbÎËÍÂ=Ú6€(úR)8ž„>ð¿\Ñ<¨•Ù#qþ/Zªû¦ Y}ú8Ô§A(6KOÛÐîf¶í>“" o¾/íÑ}´¦Ó¹›ï«;…ò·Ãvj“£ŠqøŒ«ùi~§¬kBž”¶¥KŽ<½z5²ÀÞ0?X‡uˆ¦t|DÙ¤¢@vDŠžEÆKùò²»ÆV%h£Bé”c³ï£6 Û¹"ö¤îé™A?8Q<ïB^%ïIU'_Óµ>‡ÐصtJÉê¯ô¤œµFWÙíh-Ã6öfOê»jó£ ¢RܱÁ¾ºêÊòÊŠ§ÎDýÛ%òhÓóþ ÑÀbxrFLsCm/êf£ÚÄÚÐ-#ùH1‚y[29£i|Sé3õÁXâyñXÄ 7B»¾êÛd¨7&ÚL¤q2^ ±®GbÙÖú}ÉOv³bPèÚ*ª÷²ë¸ ™Hur=â&¥#Gœuq(mêâý¶Ç·v®¡Âx¬žå2F›9ü…/TMÃ~È@–Ž‘ˆEÃkŸúÊÐÆPMËÂÉÍuƒ\Îe ¿60Z¶Æ9k˜ÜbmŠÛ¨¢L]åÉÖ+ž¿'´Aš"œlª­.++˼rˆàv A›ý¤ ,é='égÂj@@xÝAß'¶¾ÊîÑÓ¢·¬ËaÍfÔ‘D&—Šg~Zº=`‹ ¸yÏBÍ´)tI«Õ0]Ë¹ï ¹T ­rq®øº(W´(ÆÛ€DÖ®ÛõÞmHTgùeW"h£Ãi3 Ò§ã0$c×RDâÆ#hñSÐû…1hfnò¤×LTοœEÞ’æC7¿Rü´>ܳ":>ämŠÛ|Om~\´ØÍ›t!‰'S_½ûTTå@Ô¿S*6uY!xt‡”Œ¾… ¡5ýh¶h¯hÃS°mzŠ2ß $h“3}¸wÔüJtùÜîQâÕò>ôý&Þ¦¸MÔQ¼ñI¸Î´¨ä£Tßìº'«ØIù>ÚìɶߵÖѲøü¥§ó;Äm„kÍ:(­"iø³æž'~W´ÞŒr0®så4ø®{nSiöBsL_ÛXb Ö¼ôr²Fkj?Ì.›cné"ÂâqÍK 4J ù¼#–˜7°ú6tǸ LSydUrþq.™PÝ"?îŶÙCÜFGþ·LìAÊëñÍhW{}ÄR Ý>ço¼A›ð–‡.†µ55"ÔÖTl…"Äv¯ü´Ç+ïa‰‡?&*ã6{¡Ê$’¶ùŠX¯X¥út’¶±ÂœÔT Aƒò¦g¹¬:)$íËV´±!“Ÿ·Lm 0Î4c±^ˆ?øÂSS÷ü<åiOÚÿ7j§‰ÛÐ:—‘Ò¸—R¥`ÿ…Ùí¡ßkb.ù¼[9cÎúZ‘'f¾7'UõÄC mò¡IZù탓j‹fqmdh‚ýÚ–‡ ôaKHm~B½ZÚmÊx7ÛF|Sä) kW’̶هŠß­ÀÝІ٬£‰©BØ·>tÔ’Nr ÚmqDÅÓÔî,l %»On¿÷62t>“ü¾v—9©Ëö×À,èÃ#í’Qp½¿ˆ‚'¶Ï Þ„ž3>zcûp`ÙSë“Ö(¹²X¦§¡•Ø¸,÷‚mÑ涶‰û¶Ý%~|˜jrY*#oÛÀSµáhªëacTh '-HªIõ«òŒøn†±‹JÐƉ¿­{¹«mƒø‰—íh.Nk)Ú|Om~hOjµßBO[Çá˜ï)g]‡ ³e—04ÿ¬šŽ$+¬‹dNj0Ï_—„±w?åá`JÔ1Ë„ǾŠKª[–”iÜp;†ÙØíúSù²Y“ 2ÖÈÔòY±ÏB¾UÏù–¬^"žµL°!ºÅØ›˜žó9oJÔdX\“Ÿ“‚¥Éžô41Ähô:4]#†dz> ŽÛ´§à1›Ðæö'ïr–T „¹·êÒH( FF¡ñ †cÕ¨¤ãÅ]<|, é•,n¾HøX CÐÆ@UO¥kËú´¨sÛÆ‹DLªÚP¯•*=´Y×PŒ6æ*ê¸ÍRKeÏ'buMwð¤]Í©F–W.ž¢Ð¾ÕÆ¢Õ §î4£ÍGÂâùpV·}öÕW=ÞÜÑ6 ä˘ˆ®:¡5Tï·ƒ£YGTˆçWåkØü™­§b4ª& ´ Ãð4¹7šøÚ™_óN¸ü‘Õ ³ïèh4ÍæˆhojÓž€±ôü1£ÄðÁç0!ZcÁ“Ë€pmÉâð„\“Å“*!Àã¬3Å7qx‹SÀ…îãmˆOÀ…^ç*ö€Íb®®2yâ ¬C¥3™ël. ‹Û¸½ü5æ*\Ñ6±ø)ûc„÷ÙôaÖ:[$Y¨ÃƒÞ¦x;°Î\]çòQ—½†Ô›Å ¡HXœ •ÄCîâs â%>ŸÃ^[çH|¨Þ[ˆÃßÅà†*Àä „ò•‡¸È\[¯#Ú¾@6wcPñ¹ÐÍÛõzqÍþJóÀA5u ˜ÔÕj’.…gÌíºÝ>ùªÛ~UUñj*ûÑÚVqï€LuÙ ùI®æÚûöÜ¿OÍò¨ï§¦AY?è)‰€^­Ž¼NCCõÀãÃç˺§¡Ÿf2ÿ´ï RM¹ªª…|†—Ç Ö§3#.ë’°Zh´¦&æð¹»íS¬m{S]ây¬Ýþ&öt¡ê‘¡&ŘÿO«gpÝÞ„žÞ¯*ÇY1¡O?g*~úYÒ"¨9Ò`8úÉJ«¸CÛ*š}?¡^ÍCm®Áÿí'U)¯ÔÀ3ì?4˱šÓð!yƒÕG|?5("¡è´9堪ʪþML9 ¹ªí§‹×uKA‘7‹ÚÿÓ™‡Åòð’a÷_v¯Æ•=ò_›Vº ±dí†~ùïËyKÝ/¼Qj–ý"p¢%‰D0™P˜|X>‰ßçSµ.©äšåÜã­Å6Dž!¸),úbO¾#jлeðÂ>m…7;tK„$|ØŽ2‚¼LʾεåPȤВ>±ærBí¨œIVý(òkuŠ?­åò¸)¬¯â ™j½$·¬!?ø¨Êø‹¾ Vzôðš• @òØ^ƒrè>Sò /õ‚±Úylkå&_b5†¶µ+6§Ûjýìj{Iã.6RPvs ˜y wªÞ?ò1pº¸ë …7uö»°‹m3Vš„gX¬É/Ö4ÐFçË­I¯MƒXý´ AoN˜= buF$Ñçç71´ó£f`sc© îµn,¿}‹F^¾n©$ÇwÞl>OÁjêËmÒÏ9¢yäí¤²?þkSOÉSšÞhè)Žôö}i)¿¤´b‘»G´Š®:PÎ>ÚZl]øi‚ëõ­hÓ±¾Ñæ*Ô©V‹‚:Áhs,@¾×T]a¨9%A¦›b‰8Bý$O¾‡W$bI:ó)ÚXÍóåŸæ\¤ýì%·¬œ»Ô¡Mù˜\ÇãwéÀ¿[@zÒXí­í+\œ¡Í Ø„6ïä Èv£P.ûfZâ V×M(°z¤2 GÒî˜e+ÂÍœãÚÀË—¢ìõΤÔ5e\Ò±àI ¡ ïyŽázC&%Úü¶Í×BM,)©°=?Üûòû’0ÚàM—`óÏüNhƒtÙµ†tU’åìÞС®ãƒV1Їw§±¤#/7Ç•€YGÞçÓÐh3{ý³o1s7´×oªšœí]Ú)ˆ$ÎIØ¥‹ÁÕΊ{ŸHèbE3u8—]ÙÖÛVi¥£esølpVE_‡¯ƒŽk`6Œ*¹—1ún¯?•WW–<ôµÄ:ÃÜ{GTÆ<ϯ.Ï÷¶´00 ¦}¿a1à„Ë«T4s#^sÈBVÄÁ¶Íaß]#/¿Úˆ"-)†!EÐ×¼38¢[öVVÂã/~P,{màj¯ ÑIè²6´C¤÷-I–SÂh£á¶L95C*%oU¢Í¸þufø™éÓÐh-C'ß÷µ]«â•ó-ÉdƒÁ`e„ACöóoBuº4 ¼ö8=ÈCÛþ´`ç‘ZìIm¤â­ ¹‘‰'Ò› œÒSs|>¸å AŒ5Æð~mÌÚÇGÅ4<ôíÁI-ý“ ržÇV´ê,t¹8X“0ê8úÅ[ê:X|Ñf‡¡.Eò‘ á"¡« õF|™dÄqcI†º®˜‹$hørOYÝÉ’öÔœ¡ð…t)_RQ^MŒ6À.kZÞ?º„'“6­Š×2óÛmíýè”öéQ)•½¸ƒ!ê”ôAõäÜb¨;¤leu¬5Ö øóNhÑ@ž7VÏ_¬.¼pS¬{f¯Ì“Âi1ù%1e)m›)N õXôÀÇ⤿.ž€ÁH<©Ñu@ %¨“Äïÿ-hC#©TBT Eµk\Ù¾[IÑæL‘>@¥‰›ÀUx!j¶ñ}[žà?2ÇG6ˆÑ&šD"¤D&‘ÎÞN]à+*Û¡ 倓—·•ß¿rŒH$¢uNM(V²'ÎZÃY²(F+RTî7„—O¼=n§#Œzæ‹w½&†§R#<†ªgtóÁó1&boqüôHgßtÈ,““68©m³#‰=©ó|):V¿môQ¢”W$"ÁÈéz÷"20ðî¨ÛÆm­ÿ‰Ö8¼ng´Yð£ýk$¦ËrkVËeVm &„˜“ìT(ÑæÇ€š]EÅ‘ç.½[EÌã–ä»S@܆Œ¢æµô÷ˆ©o`˜ÅvŸ?Î:ià|þk/òDÏÐØ´lÌ/½IÃ[>l2ïXÂÝêqY”Xê 8L®ånB¶Íh£0©-M¿Ìšp5Öº‘Ô"_±–0ìÉ|9´!Fåö#_a´¹óù,C8ÐÚ|gSu\ÈUŒ:ÆþF*ôòËÚ¤‹y]²2O;ö†6TÜ棔YõIWñ¦ÇeIwËè8‹Ç›Y-œ„X}»rTQ“æ© î¶Â¾ê\}& ‹Ci¡d„ÅieÔL)¢ 0[ p˜Üo‚×J´ùèÝ-ÇS°Îˆ£ÄpFÿÃF7ŸÕOÿ‘Qâ=ÒÖ¸Œ¿åðØ·â\2lèÉ Ã#LÁ¦¸ ü#»Õ£S1)ïªlµmfóNûò¤ †ÜxÆžp9Zaxî î¶w´Yšaq¥¯eWRþNª€)ŽÓ5Rœs ©ïÁ“úã£ÄpáKW QÁe–úßñ˜7 ¬îÍÇô†Vù‚B[dzêÓWÅ¥ ÃÓO/nš—F×ÓÐF\Xaˆ'õ輋$%ÚüËS_éSÈß(h{|Ê;½¿¯"ŽŠÅ}ücç¤~+Úˆ·TgûX£T‰a¯>ÏÌB4•÷ðœš&!à£$äæ(1§!^êF^+»Û6¼^"ŽâÜ7>³°°073ñò®3èœWèü+1Ï‘¾6ü:nw2W Z^) ÖÀ¹BVÚRù5Mu³ºIæêÊ|–¯%™‚–Ú6ÌÔ‡¡ŸGøÛÙ6¾ ûÓ³³sò4;»(üÑF‚0…d"®øÛŠø›ðå%ˆÕ¡/«V¿ä ±úæ$^4}‚„bœ>µ°˜y«ï´"€`§Óä ú“Mžîhj¿a«@Á¶A“œ7Ð"PðGÞ)Ñæ_ß“šjÉu6¥aðDk|ø|û$lR7Åkiê+¬¾[öÐø³å hóÉÇs"rkÉŸCŽi:^R@›‰7¨Ÿñí¿mžû¹ë¹]ß1º ˆf»Ê.¸Y PZZZ$Ï+Q‹\™Côµìk<Ç—o)û’á>¯áÆ‚–²Æþ’Q…4m]Æ&ÒÓ£_(ú“›„Så±zgx¿¶èÏ|Û{O;s=†›÷ÝÉ5!¨Ù•¤¤?Þû¿þÓ«þkù˶U+IIJR’’”¤¤½¿§±±IzÎNSSSïà„ðwÊÚ²>Ýù¥K%hu²£±{v%‰úšë¾N²EK€;3P×Ü#ø 5­ Ôµ ̱61{¨ñKÓ wO|ìiêÿÕ‘(`¶ûË—ÞÙM†ˆÏninœcîÁ™ã,Ô7¶qE¿L¤‡hþc.ù÷qf»:§~—ÒöØ IsÞØ@o3$⦖¾¡ áæèïüj!¯¥¹i(oåKc ‹¿§“VgGZÚ¿Š@ ·¥~lYøçF›¥£Xœ¶…½«« D¶fz2ÁæbìïRtß '¬³xÐb+†@oŸÙ|Àž² ‹%õôš…õÑ0@–žBü7Öû°ÑÙ_£RâÖ\ýIçÆ^$Ôû⌵ Dæ&$2Å þliyèÓ ¯‰;U$ðõÂÓ®_/¤ª«(5ÛQ@á3í)$õëênÍ—èùXÉbš÷‹Ï ´1îÿ.ý®Hƒüç[”MØÛvèÃhŽÊ!õ7ÚzË íËøþËô4%’)šž±®…LÔ6:¹Ìÿ5§²ûh—N­onàN™â8³ztB^Ë<8_Âë~]âî…]íï¢tÍ.@à¤þÁèþŸmŽ`ðþ²à/Ö™««Ü©bm“vÊÖ²uøS˜ •¢ g£dh³õE€â|ìBeœ ÅjV$yPüãŠí`è‡)9Õv‰Š€ÛåšáÖJÐf«üwJð;Û˜C 3¶Íl?Ï«8)¼ÍŒñîéÅÕ,Y颞~‘oY²3ZûjÙvýeË’„CaÀnù gÍU §7?¸›¨ve{®@„­^LÉànïØ(ðûAµ›z¤7½Ë;ñ‹*sŽYíÏ?^^—¼µÉ`{M¼ik›ú;ÖM¼léžP·~Ÿ?ˆ=µ Ú|Ÿ]}Ÿžê™ûC:|ÆT#eè·ÿp´¹Q:"ÏûP-ÇÀ:X”s-W<¬ðT†‰6ÃêèÛFñú+Î7+UÂ}’Ý‹ª>±KÒæs؈¤Í0bÐ)¦.ï;a%íI2ý»EªÌ¶ÉK·6dÐÉxŠ…ûç1¦‚mÛ{tÝ‹HÑ11Ô¡zñyÜ|ˆ÷â¢Ê™wÞÄJÉåƒXè{ËCý¿ÛJ÷Hò™¤‰¥3àJ¯ªšf^Úc#G]Ycôì z%ËצªžYP°TC3×â—g÷ë"¶ õðº…hbjBÂk_‹þ$ÜA“§ê_Bh3½.éfr~:üüáY3¼#|pÔlÓew+ â]ßÚ=¯yiÇ¥CjÇ"Ú ËmoX葵õ4¢™‹w‹xÕ³Èó?-½yäëéyÔZgéyovSó õŒ•Á…i—€›AÑ+æxœþò“Æ$:CŸN2°=^öm©÷-w”“ÿ[S2x2œÉÿ÷ƒÚ“\¸ÎåÉú¬¾¡!KõÏD^àçªéôþ´‡‡»» 4¤ß~V‰ÙÛQ'›ZÙÜû²¬À‚¯ ÿëXsœˆ×zùe²’îúP©t#™nû Þ0ŒþMüñY ‹³Ë!KC²Åñ/³â¾Ã]zäŠD¡™šèSh&aYH3[âŒ5¼Þ_vbì/WY“Èd†‘©»ßãñLëÿ4Š; _UÕ5ÞÉ ôc/¼dZÈ]¸uÚƒ§˜›ÞxòÞ¢_<*_Ù· $²©ù‰0x·,g ÐËN¬kh¤G3s»Ð8¾Ù4\©¿…Vc´³äV‹ €5Ú18 ¯ eÏF\=F¤h›3¨Úß´Á÷Œ¼úwM“ú—w<ÝÝ,õ‰fž-b&Á‹'’-­.f6~¸M¥^(p3¢aGÀïÉó°¤ÓF:T+Ï«Ýóp¦ mm›±ºLgc²¾±)•@ñº•€ àÃ3‹kùVtÞ35Rúô$Úî4Š15ïí9„ýimm¤Üåù2öO„¯\9¤ït#¹¯%ùŠºÞÞ+/›j_‘ìâµ&è9Þ€`žÁ$¼R"¯Êû ·h¨¬¾tÔ¡L Úàä£ÑðÑW1‹Ê¡M^¸§Ží¤O~NÄ“éâóÊä+Úžs–H?ËD )€}Õz,ÎxÐk…rÍ•¢Íš•>öyå,È Iz>¯ëu~†šîÏÅÃÇœ•t7¯±ãÜôij†7¡÷ÎW`°_W´$«<(˜ØÖDÚ„6Ë姰Z¤Ô:Éf_{†óM sš}ÕîˆíïA:÷¤ .µ¿ù¼¹!ú¸µ¼™ˆ[ïƒVS‹®Bû'ô¼žÞüâÑçš š¥–rUŠÝ“€—]½C$Í|}ËÓÐ]’4ò’ÅPºA`ôƒ Þö¤ ©ÖÒã‹û­TÔôÁ >oD1vC4y±"NCÇŽ)@V!æ€éØÛÏPSǹ„JZÑ’}‰ÄpEðh} Ÿ‚ÓjœäÓ•šZ8Àr䞊@#uëhH¢Õ‰Ç)†Çž°GŠ)Lõ<ö÷¾r&tʆ%GzÑžÂû8F_9«Ù&Ã×XƒbJ†•zH Gá¬ã™ž~ ÙR~ßžˆG§UM)Z«vdrN§X@¼+ÑWzXðûkÖê6Á›d\~–¢á’±SoùøÀMÛâ,âz¯tçˆÄ6ÈbŸÎWWGÛ†Aîy鉡_­¿~ÄEþ,>´à±5™jÖ‹p~}Ô…¿™'qR³Ïh:=ÝÞ¶Y®¦îÇÆ4# cù™jÙEwCŸL)z‡¦¶1Ò`a¶³¶´iàO‹6~å’\˜Bö|ô9+5² ìY‰F-0û_ôÉ,ó^Ã}èÔ °ùŽšÁÉoL#·ü"equ‚£pQm(ùƒ’U‚ùO$UJ3W†6¬ÓÄŸýêd.碫>¥gq“ÍÌ›é ‘IÕCð‹Ù3t®f„³+Ú?~•Ø3¬êst‚ Þ´6QCã[%ÒI<²OÏŽ Yã¬âšd–êý£Ö.wžo˯Mh³R~Z srYr:ãˆæ@V¿Œc=?£Ó&åÐFÊÖâÜäääç;.8³·Î÷áܪTe®yR/§ëqó½äæé1&Ã-}À4ÙFkÇ2÷«vJ¢óƒ^ŸdÆû VÔ ÎVj éŸç% ±>‘OÒÔ„×è¼>.J«Í~´™ëÍ!á%…›Asý)à ·W\ ª;¥n»†Zn}@ýñFÜœsÛçœÝÎCøl6.mVwÖaœmÂf´yhÁ8öQšš$ÈΙãI«Áë6Ð<ønj+Ú^ß9‡#mðC«ª'`¢¿Ã•¢¿àú,ض ¨™Ýù=†ªo'%,ˆÕv*ª_7š8Ù×ä©J9*¿Ãn¤³6⊓ªžïÚ&´ÁÓê&Ö$Ç<¬ÕÑÕ15,Ú,¸jî8òý`÷k JÓidá"[%cR{Œ¥m1Ú0¶E› Ú,RpÄž5Iç^žøYr=D·Ø#/{¤A0ÖËÁÊ/vÏh*Q4n—†êû)ÇFmªFÁÆ!‚6]f‡.V3¿_r{ë}w¼‡ mvE1çÖÛtÔÉŸæEÉÞvŽþIˆd>× ™õH ÀØl ûíÊMhSpxã †»û6Ð&äó/B©Æ¬žÅ©øwl¹gºB£Û't†™±>]BAzy¬“˜ƒWë9Ò.̾¢C>‘Ý,E›$y´y¼'´á^ ¢®|^, à.›ébwA›ÅþO<é+Sú…mŒêof'”ïbTuš–åªk4™õá3.º£¶ÈæÃ×Γñgó¿s{C›ão¥ÿ’E¢êMq¤Õ`×i«h•,ncÛ”BRô¼±U0Ú\ý«¢,J¬çÂã¦ÿT‰&±[ãjY `YvlÝW™åÜk°ŸTµæ§F÷NK'¸¹´ƒ:í¢MžñêÇou.òÑÀz-ÉÅmbO’-.}pO°ô:3}K¾b±ìùnFZáQOµtmׄr©?ÛEËâ"jîB³Qs´á- èqyíÈh(ˆ:d bx*¥3ÊJÝ*J2 °Xo¥4ì%n³6ð½cL`z§ä¥-1µ¬F6â6Ýü¥ÏTMR#â„ ˜'l{{EdF5@Ï0¨ÊÅ•Ò(FAC] q/øÇMÈv»  îëfîû@R½®4œº†{æô.hƒ=`ôm+ò+  øÁO—âž! ûmæÛ¶œ©ÐÐ"ø—Iæ:sOiÏAíÎñ¡iŸx…ðN´ÜG%s;f¶E›‡{@èþ7Ç0:—K$Æww¿½'õ¢ö¶+#zdBN“_æ>]:H8±¸yNŠëaIµ8¶Æ•DÈ]ˆtÆÒlC![:ù4ÙÐ;á…h®…€'.ƒÓù» M‰¸_l  ò§ÛHri¿D9ÇÞœR£\XÝ.nîU!ØŽJWTMõV}î[úÚ.{Ãû+¡¸óÌW>ÔÒÀy\ ‰¸í«‡Õ8_ ]ïK=…Â’=}ïß 07¤™ˆOxizèˆ#QO_½rûº.ÅöV®‚'µÐ‚!Ð8Ÿ ¼@#áÃJäç¤8#åDu´‰Û…ðÐÛŽD²Ùõuáö« Ê‚\°xœµïÙ„÷út-•€¿–ô&ý¡1ÃÅPŸR1³Ú@º“uZKb\ð :nǸó踊îuHMDüEG=²‘Ó‰‡BôµµlWw˜GßÙ¶$QqÌóZHø-]¬ºÏ3 h ž `ÙM]Ï<‰¼­O§Ö½ñSÑÐ NÍe×îm–úKÈdªºAGZ;om}»£OÞ7¡Þç<8¨A x’¼loÛpŸ¨©ã¼£î]>bx>)ûž q$³g=Ì[g´û­4ÔM\Îä îlÛ€ü…n4ÖàЩ°°{®&T-ê)8Ñ„6x]{ºÇ¥;Á×OSćµ0p§[(Z8¯«#nYQ T¯gˆ;¬€6 ÿŽ….ÁäðõÐı×.»  $ÐÕ¡O$ñˆ÷Í^ºf> Âf´×/Óñd‹£W#áØï·Ì X,ù­ˆ{×NR±š •Ã[u Xïw7‘i:&VÖ¦&Ú<ÍÞÉ×Í­&jbíNû= 4'ãô¼Óa©í„6à’F“nçu-±¦4ÆJjÛâàö W±Äi€¦¿5—4*.Y-(®áÈÇ48s_ªË ÖUé¸3ê8ƒ16«£®–xÏF@`M×W–éØ8ou¬¾¸vhcÞ‹9i]EC÷úx}aÍØDAÊ“h'"¸Õ±®²â²Ï-ëŽ9—ñys21áò@yiQU³Ô´‚ï/.­ü6µ¶Õa—®%æöµ7–•––”V´õÉ"ÀŠÊœ¬«€µ¸±kXRÎTAqµtüÛRR#Y Î™í…¤]Ó3=;ð¹¢q\>ËÄ·öÒâÂ’²ª™u‰Y%äT”—LB Ã](*)_å!uÁÎÆ’bèBõàŒdnf°³²¶}f'´™ï*uºðTÒGðsÁyÇôþ@í†ÑFhí_Ú:ßñÊÿN‚A܉*m4¦zRôƒë·;þœbò%%ý $ä,]?cCi%v  fÏT¨a4ÚˆÏö63ÐÖ6sð>å†Á‘œvð@ áínÎRÒ¿”ôE™é©Ù…Uü‘’e 9SÓ3ðGw-qwmbñÔôüÒ* ìfJR’’”¤y·KÏû§€íÓò‡aíRíßÐ(àÏÉQ=ÜIn;*Ãne|o£+¸³¦ì’‚ùU•ï–°ãîÏ¿” Y#fTÊ"äáð„š¡Õ¬žÁ¾†P¸[dOð%à¿Èç·†N;àüRzAî¢>ó²n‡<9³…ûQÃÜ_9\Ÿ¤’p;6O‰„Ñ@â‰H@ünrýô)¾Ù_8-o´¨† \0åº'Fz|'‡5r8]>¸¶Ñ½`©¯ò²§=‡Ç´Où?aŠé `aG\9®M!DûãïÚà $"æ(,==ˆŽªãÉmtßÇG-ÝB²™v"Û>»·üĮ¸ª•_ÊH—$0²P¥‚ÒécîéøüTVi¸XL×ò_KoøÍÐöŠçæ—Aæ7"‰\3ÌüǪ-Øî~êþn!tAcÐO´‹[ÅpΉx3µ ¾öv-îœ-RÁÿj´Ñ¦ :7Uù…îýà?HÌ¿:‡Ì|FAj‚õa*þøÊ/Pȧã=¶°OðØŽü¡ßû«c²ÂSýŽ{\›©z¦…£¤·M#/áã ¡B Ë*ìïM tSÑ"Š7LÁ'TÔê’q·ÓËFÇÇ'ÆÇ:«3´ è{_@txxhhhlbஉ–yhñøüuxtZ$g[dzÛ}Î÷PH„Þ=Ê™9@"‘«~éH D™áë™bå\¨VÇ0vG›ž‚²±ßÀØøˆ„Æx©™‡†ŒHWm‚ÃÕûORŠ@ö€mÄšÚX–—›’Ñ,ÞMÙSþ>ûS=¢Æœ¡úè¸ô9I¶Ñç´§%ãùa’»6€°âmZl\Bni‹\eÀ¯õÅIñ±PeZG6–^ÌvV&'Æ=K7³² MÛŒ6 ™axÒ噕’UÖÝu…ÏâcâS«»¦v±xÅð5–'©^>²ƒ¹¹³º 1>615«k’- Ö$ÔRk2;éé«_“’W8€l{Ï»ÌøŠ618“_>‰‰{ù¡Jˆ<¹>Ÿ˜Â\›|™׸ W3£Û§ø[mò¡–2H>‰i¯‡×6.v×"myþ¹k)௥&'L®q ²¢ŸÆd¾-c‹@îìÀ£ðËD‚UTtL#Ò‹%¹1±q¹Å,ñÂ&@Àzžœ0¶Âm.̆ÌÈ-]‡œ~y•ˆ·Œ|Ó©•p)#>ºm ²„éN¸E=ÀP¡ÑpM£ù©;òÎ9FÓ:ïŸë̆†ø}LP.¿Ì—ô8ct 6EZó‚¨Ú9A7½~žüQ~ºJm¡i“н­¤ |ÍÏ?*—¾¡Q˜¸<ПšÉnsBÍT[YRB\RÆûù¥q ÚHú âmJVç„dýQwYJFÅÜhsq|Lô³çoãMÊÒC 1ä€G19-cà„6úC<þç¼¢¾.jD”†9ј”²".[²O§m 13&­ú/pö_Oñ w Á!(æõ‡† ´…i¾4Sû ©‚.P0ØKËï¢lÏ#O•<ðÁhaâe‚^}zË:̘˦¤›04M—?BiÏÝ~’ô4Ø‚¬y,ªyðáI;'ñÏ"nž%i`bÛÙ³ ù.Vº‡½Þæ—ü ¢æ¡“×ââc¼],4Œ.®JmU=÷ 6z7Ãß¾èU%¼n  wÑHÿª~\ée¨hº\z–”p턦ºÉ8¤÷³Ej8ƒûÇÏø…FÞòÕÅa*$ ×+"]ˆ ‹ûO“ܺHÃh½ï:ŸëzƒB“.Þ}ôìQ‰…BØ„6=céxR@LjqË „´%!v]³à褘p?^3¬`dz¼Õ>U”óù@¨z×½l5ÕŒFÖànùþ–ÅÈ62.%Ìï K(ÃæR+š@»jkzæŠÿÛÒ&:œ'[}ÇnÓ×@Nƒüåo 4ÚþÌÍÔ”¸Ö†h»`&$„•N,zÅÖüÔeÿWµK€`ÊÕ˜žÓÎVÄ= 9î8–jt=8*ଓÆAíúiŽDÅÁ¶=ó¨-a~ œfx¡x9gN—N:ãtØ'2³¼(×Ñ€x4ª\›I<ÅØ$¿Ìí[ƒiÁIoîá“œúÌÛÉRÃØÎhÈ]4Ð!:ìz><£¢ø­“É5ô¸>—þà$m=Ø )š`ÔÅöªN}Ã^˜br ;5còhƒPW¸©Š%œ´äÃe2Ñ>A¸é,þ°§îtC5Éx2µªwJ1ß°G´á.Ï.2¹Í<59#ÀñŠtCÛ#«[r÷M6¦khQ.‡D'DùÛ™[Km ÿ¶="Ðp¿³d,¾tè»`#ªÝe§ó!Ee%÷ÏÛ¢qŽs°97‚¨E M{YÞ7 .Vkàtƒ›z] Žº{…AÀ\/„Áδ¾7±°™` _oE9]Æb.LLLÌ-1¥ 'J=ªwèIÛ_!D̽k€»X(^®¹*ñ¤Ö¾¤«“-&¥ÞG_Îq,å‚èÖV1Döèzè^NˆÑñ©‚ªMB›¸Ä‹E‰Í=aŠ Ì’î•ÈTE[‰—c.8cTÓ¤i§‡¿ÎÀÃj€»‰oÔ'X»ß¼û,ÝàÁò ýü°U€ Ê\¦ôÁ´Û¶æ‡CE›Ñfa².“¤c¹‚ 㿽¡… šÚ¨¢:$«a¿<0ņ“—rúKÐ$½ÞEI¾Éü3ŒÛÐËÒݵ×%kø—‡Ê¨$¼<ÚÀã˜`H‡à;ÖH$QÆ$…¯V]UCÙ)ÏòTã+Ý|Q®z«\!«5Kƒl6Á‘ŒW_³=0¦0VÚ1â­JÉ*Ö÷'Iúwʑσñê‡à¬8¥~tâ‰7’婼ek)±ddvãpÄ€Ò!Y…Å2QHÍ%`ŽëS±:Än ˆð°¹‘QŒ7HÔÆ Éªò•Ê+ꨣp[¸szÚdÿ×’œ0+Ÿ¼Ö €˜¿Ú‰ÆJËtF˜kŠ“pÏ¢ú%4€¼%C=ÊõÌZ‰«Qäó³î èAV×-̉eiý$ÕÛr„žÚ טÞt¢],dŸðn1T’·Æ¢LµL4‰?ó²¯Yà!Ù©.ç>6 {F›­‡ùmÃC1%¸h˜JrÚÌuå“È0Ú°Û²!ŽË Ô$’y^¨©¶ž¹Ì7%Rš&@N+]Ö õ¤44 ¡Meëxj¥éð|ÓÛ ïizdŒ"‘Hv· DrLü+øR[Ñf½.õ6ÍÚ](eðòð2†Ú/:h6ÂilÉŽƒ“ÍDº;4˜~ztÑæt2 òš ÛXKÝ÷IFš˜²2¢jØÄø÷g¾ÖX]kß[+Û6JHÑûkéÞÇ<\]œ]\œupj!•,IÜwlYª µéwi–nü­¶ sУjyØ34.ëÛ¬t£1äI¡ `äoá|킱ŠP¥» †H×MHAꘞDP×éØ'±jב-Õ(bŽkS7Û6òh3Úð‚DÕŸæHU”Ó¤£¦U´°¶¯ ;bÕ,œ<îÇföIS4קÝ#ꛦ>—T#áÑu‚–áF4ŽV;¹†T›;š…Ó´…7³‰V<´I*!Ôgž'jXÞŒÍHGžMuchŸJ(Y=X<µrt·lÅ«c%,©{ ”—Úpm‰f0Ë•¶…ݵ¥dQŒ6tâëÆ)¤@Q«ÿÏä‹l´á2ˆ†ïg½@j’vÖÎÔñz,äê3kÇ%5iú™ä½¾ mv¦T¿ãTó3gN‹é¤ƒ¹ŽãÔ$¼}Ž¨£ê”¶ugŸ ÚBËHœÒ iÂÒôHKmitð5CÜ~‚Žq\A–ìbÛì‘<µT[%›lDK}°m3Èú’LÐ7I‘ ôñ X ˜w߈q4Sjqüt ž9] ¯MmÔ1z=L$8‘ï®iöpS„z¨öÝû¢ÆUñî³½d"6­nô/%ÞŠ6ìŠÄ;/¡4ÕïêX)‹i_«Ó¼ ½?Cq”1Ps-ä5ð¾þfÉš‚fó›(Ì™ ° Ý û4)éïm%¯‚¯Ø“ÐtÇ¢~¶¼m3þîš:Î")ÿsÿàðØôˆ'm_H•m¨ç¹Ò§9;”lá´ ÚˆÇÞ¼´§×.xiã4­N/pDHÜfDj§õ¿vÅXÇ@*Û–ÿD׿|_ZÇÐÐà°iÁ¢³šFp»4)kb›(±Ú ‰JLå•th|;µËçêûô˜ë½tðš–'ïÎsÀÊä 2Ã4XÆ©û¡a÷#¦¸ÚЛe;hDG}­gÕ ëc $"íÛ2œÊÉ­eçs+TÚ‚°ððäòm&v;ßay8ŸŒ¡÷­+äõí¯~F¦™ÏËÚÂíÔ×<˜7%A›7Ò}Ó¢–›?S6¡Íºhvòj˜\Mbß”Âh£CÌ®“Æ~1ÚÓ±=ò"í9LiéÊe\|{K>’ l>Kxƃ½Z6¾í”ñ»ÛGU§8{ò¤öHS*êÒ?€Õ~1Ú¬W§Ü"émè´HŒ6§?ÊŽ ¿kDpÊhß‚6Qâ‰|Mhl>÷™jN·¯ü‹£ «ÿmÎØ‘+’ig[c «q>¸Ôú–¬çVægu Îu d»‘Þô¶9h~Û<ñ?g‡ßÿ¬C á<²IZÈfol„ìfæ$Ú@^©î‘gåRæöÛ 7ÐfŸ†½ Ä c/ëÛ^nA@À]ߘ{Z´&’žÖ€s sR2´™¬ÉÄë.peéÏ„âYYŽ¿öA¼9D­¹s=t2aOj¾ó‘B^!ͼÆÔmåì0×)àÉUoÙ–Lz\=4úá ÎØž#ËÂ%ëo´™^—½øåy{×°ÜÞW^—4q)ÂÇ–ŽÏdzÈãòÄùðº!´©ŸXÛ¼E®&ìÙVm‚Ví¤dÓßÊÔØØJ<^Š!ë[æÁÓ™ãë—ä§ gïg”ãÔ¯@`§Ôúë—©ûO‰“™zÆÅqæP~4ÎÈž½E y¡&zV!|I£—â‰Åý WæIßE¨]³#ýck€”sœKú´“/ê¿· çOŽ6Lp½]ï úN%â¬ù¡‚Åñ|Π!žlC%½n÷ %Þv—ÜéaRQð«ÞfÕÂ6HØqk¯{’øLùc4ã,•Õu£j騖`oé§/ò0; çÈtÓ¥ú¾@J v±Ó£iú¿]£Í- ¯'ˆÌº`¨r8¼eS”8çËJóë }3_ œñ§Lˆ¤Ì¶©Ð + ̹íÈõÊ0GœK"ô¡ê©=™~‰N‡Ø‘ˆHܨO{„œLÁ3CÓûÄýŒ7eÆ_ÈB&§„QŽtÊÅìÝúîÃ䢊³f$R:ä¹s{ŒU´.¿•D!>Y‘=³€­hÏÞ=ÇŸ½i‚O””1ZuŸH4èEêʵ0 d×Ï(  ¬ì¬¯_ ,'¡×ܵ©Î¡ïÄ_—mô aoÚ@þ¤ñ%r 0ÒNõ§;Þ mºaÔƒ’Ý—HÐ$—K¶þ{Z’ï½ú¶#ÚôF£Uí¤¦óCÎËþE!¸g´$;Ì'š¿l”ämÉ !`P'’zþV“|–HcäÉJ±GÛè™zG¿Ê¶Y›èÍy÷‰·e‰PA¤ qq‰ó‚¬HdrõÀ*Èí…š+èÇ[V$ÏL1Ú˜“ÈôÆyLVzó¡ŽÖ8ι:*ÄH²¥Ðf}~èuîû5±÷” 5ËÄø`a®„‚è-~]Ð>÷W°m8~„}^ïÅÑß•Þƒ*j•â5KßÊOÙêRhtIÛ72›%µsÒüýo”oÈdÔÊ¿ûÄ”HaÙéçÿÛ#KÜjöT\ ‹¥’ñ ÛEí¯¿åcœ•.D¡‰D×K‘Ãâä@~”–Ê~²¡ÓÊlëiK²‰nbãö¡g%?Êkÿ~Lx—SvñÐ.7å…™ékcÔ5Ýo>C–y˜¼ßrȘ/>Ï€¼åç¡hD<…B&Òôï&‚1fúÃÿ÷e#A›¯™Ö?1 }=ÑxÙÍ ž@8ä2´ Z¸>sÿ¬½¦†ªcü0«˜¬©òºyFÿÒ»‹À¨øþÑ*FŸÁ}qªùŠ›)Ô" ™z"0~Ž-w:0…·’~‘FÄQ(¨z·Ÿ}D*µ:ôùü!}ˆ)$ÁõÒƒ ¶x¤[nùi?ªaŠ%?ªúïW¥Y²‘uà¿‚²áúôr"ÕèqNܮՎ}4#-ÄÑèQõ¿§6®oªp¾óæ1 MM´šû9;ÙtÙUÜÕ+(aŽ#n g‡RÉ®—Ø¢FßSóZ‡—ÍL¸ê¡ªhETŠÏxg¡C S©x¢Î½äxÈá.1Óª¥®MóÕSõ„Ú#âNÕׂ )g‚ü~òßþ-®½•cñi»ÝØÙ'e—f?q0 ý}ßýûTÌ\.¼¯íe¶ŽˆW•{Ș¢¦¦ÒÔÀPïÄæ̭˯FFèü—þ㎽ô¼‡¨¦ËŠ§qp°}âÎIk -,M×46§«ªZØ»´E Qb‚y!Fz§Þ„^<ÂСhiQ¢ršÅʼn^^·Ý§ªeyç¸Zù?ã{¤h3–ëð_t8íxMÚO*êC+B8¼¿>u+´††¦º:ÍÒó]ã˜dhÐþÝ»~¬Ùv[ÀŽçÝÈ[¾[Ö‰+µåØMF©ÜK_Uímw.ì|¨Õ¦S¯`§%ê;O$XmuÏèw>gj«á½Ý àÖ+;TcsyÀÖ=&ßm/òð‡‹v/€Ýë²}M€Í5ÙiãÀ¶§qmzpÛÉ;yRŠ1Šï88[Ëøþ]{O.æL¸)KìEÔÀƒÐFÿlÑN:¼>ÛóY¬œ+-ˆr*é_ƒªB›¹{Yœ+äó¸Û_øOp«ëÐá[ëJùýbuåZ{ù“æ hói@e°cóÞ”SI ðä I¹iDØJõKiãÿøzƒ{¯·’þH¾¾E%ûü³•SIÿ’¸´sÀAI?°V(á{¬ÚCLâŸ?òÈ… ¶÷ùÿ1•ÿ]ôJ1ÉÆvO+†¬~‡©Oö8XX Vˆgè8Sðç²Öª®É~;jÿëõ÷þ¢íâÌéR1¹ó¿‹:ýÞ™ VŽk¡"Zg_ÞÔ´<-Qű\uíÃpp­ÃÓ„†Ó¶Züã$òÿÛÿ/+øóh*üù7üœ‘ï ô6…ßýßð$(ËF°Ø’þ_ü;DÖürĉ½D³½Q ü³ø(y¹àøß Âþ•FÜOø½=]K,þïRÜro^×ûË\é¯ÀѯoY:ÇöÓƾè_])¼;t¹Ôègåõ>~ý’ƒÎÉ{óssÂM¾í9¤Ý2²ö)ØòQ©}Ï,|b¨*¾Ž8£|éxqç˜&ɲžQsÒ ÖðÀ¾‡¶ú÷Þÿ•rÀ¹yÙè÷»£ l/Í|Ç´@.£ÿ»g¼Àãúð‡ÿ%¾:þbüÁãÅ@ôßÁ_µ´$þŠŽ½ÿgà7+0o¥D8ÍüzÚút+ž|µ•/;˜/•¡ö¯S%4Y›ŒOLžcIV1»ÞDgà ç&3SJ&úêÞ?Nýõè´”ÄÞÉuIÛ×Fßg¥ÆÆ?+øܽÁ‰¥7éI11qÙùH*è¶ØÄ4È-{“ý4öua¼Ðµ·æÖu/²¶ó£ÇO‘™’õ‰üìTèÁW5"DYq‰©€[‘ûz0çSt}í[ý¿S$ºô`? ä.$%&L›Üá Õüq·&e/A›ðSÚWßͽ‹9kchèz&>1%ÞgÅ7,”d?‹Ë/eä-åfÄÇÅ&§¿˜ç#½ æó‚ÖåÞÊÜاO_¼ÿ,‚D«Lˆ}šœõqEæ¨ÂæR8GòàU€ÐÆæRáÂ×Ïp.‚ç9CâT©÷hêíè¸Üîyp¥':)bÙ›Ôø§ñÉ5=Ñ”ç>“ð©î›<ڀ༕Úߢ¸R>óuT<ÞA=—å¦ë‚Ä”êh,ÞbÖœû¼jKze CÞI¾d€~7ÀwâUC]©àõ«`ù(øæ1x-\m¯Þïfnƒ6 ]`ä]Ðÿ&˜Y¼¡ÿy¡`à-êeP™þ`üÉ/88Ž-n®I\¦å0§rgØÿ·ÿþ†ä›öÿ?Ò‰“8ù¾˜n6I”Ü3:ƒ¢MË(Äk¡¾æ<›RÙ6²m†šJ’ãcãâ’Š¾ Êtx¶ÿË‹äø¸¸øÜÂ:ŽôâhGuê3èZÂûrøŒLÎÔרû¾D¢mTtÌçÞo‰I)L®$ô¿·Y‰U] õ/ž}š˜ë«IˆyŸœ=¸&Ó°¯¡$)!6!éEó0SÊQkNRJi¢#ô¶7‘âððÉÓ.¸Ðñ*±`x´­èIòkdíãDgujBL\ܳ¢/H#9ùO^ÔÊxÙQ•ŸŸZÝýÿ³÷PQmkºhŸÛݯûv¯ûõëq_ßçtßÓÝÛD,*çLÎ9g$g%(JF $%©ˆb¢ˆYÄ ’sι *­·REROÚ»ÏÙõ}<‹UsÍ<¿ùÏþµ ^l½}æNÛêt{iaÞ™üóú~Z´‘ŽÕáÉÌ/¨ #0|Íe%¤´ÖPbCq=áìä“væ žâ³H·ë “”x±›O$ØDeM0ã} ¡Æ. ½%hãÜ"“KJ ­õÔ¹áÐ*œ~‡!²bLÒÎÞyr÷¼UÑ%n=vÀÊp¹xåÖÈ °:ÕÂÖÖ± Ž/9ÚÛŒ³?éeÏÔëѦ)E·ŸÜ»`DÃï+o“Ž¶gÄ9QhÎà‡CB`að­©¡~ã’‹#B‰-ŽN J™vXF©)´4Ôó /¿}lžŸ-ÍÑ)ÜÖï@Æ pEχëi9œ*(ˆ tÖ¡šôÃp›ÁÕw:à{¤ôyÕekš¦ù¾3æ~iO_TGØQY®H<2iQ¨!ÓÔñTqIr¸Ä«Ÿ•nâm t¬¼³Oeïµæ“hNK2 öz*Ãȼróeï0rWdãhyñþ³³ÉAX:ÿL°é‘ó÷*KÓÉ8ês8´¢‚·‘/dº ¸êÁÕŠìôÔx©`zrlœô¢'Ï.»~ãèö×@kóÿñBÿ¬2†þô„œ6L g’%Ì-èƒÅÐÃß™mD›wEÐóÿý¯À®ÿ„4‚¤¹¿~ñÀA]àÏþ øK˜ñ½ £ÊSèùŸB7ñ6€ø_ÿ÷@j)00¶i2.ÿ–…GŽp Ÿó áþú 1%VBÏÿÁCØß¹ý5°ÉÕbïs¬&Ás_‰¤(>WÙ§Œ6µ¹¾êD½Ãy§3ôIš¡EÙ¸ á^‡™’S”ŸífÁ4 ΃fÒ‹$<™ðØ©ÂSÇí¨öiw…áâcÞ‚õùkå=}"åzˤ\àЦ‡Á<ž>Y’­ö;ùxðäÉ©ÎZ†mð*¯Év%sMÒNÍNŠ`â07>!,šäŠŸ©eÚ#`¶ÿtŠ;‰dwáê­¾U ¿Ü•è”îéàš–{œxŸ.„hÙNç1¥aöÂv…³ývG2)Ôó-ÓNæç¤E3uÔóŸAMž~ì«cyÐßÓïî“e™Á˜”WÓ?å]Åvhóé²#™h2´ŠÊmhó&Gò+G¯N<16p…[Á$z <®®pÜ€I-xÖ̾ÇèPòšPíñ® vš–ЖÔx{?M÷0r’ªŒ¢Óᤛr±¦˜ûˆÅRNÖ£øÜ{ÉQÝ<_Ü¡p å’±í<Èšk[§#‰®ÛX%žGÞû;±䣉–*î<’.ÊŽèíò«„¶ã¬ýz–îéHV÷OEÐíJƒÏJHºf‹"`öñ±=LW…ƒ¶g¹6 û¢ †º¥ÉÆ|SÄTB<ðCâ´Î¬‹55Î'dYŒÞSS§ÝCЫ×TCÛó–H ,´ÜïnBtm=ÏßGà[ÏH6 <·ñ9ð´yb=ÿâã@,ºOn6»þ øËÿ˜‡çA¶Í0ß²ïß 4ÿ'–+݃1äßáa~=ÿïÈ­å6 ÒõPû;¸è?°Õû^ç@?ýù_ñçÐCn Ø…À¿ý3ôŒ2}MÐó¯ÔD|õOðÁjÚ” ¡¾³>\0¶ ŸUB›Oµk?¡–¢h’c8Xüí`S«ôëò#ÊLC#ÈTIÏ;Ð=JQŸ€h¢±eü|òC:ŽŒp µ‡¸ÿ[ÈïC—]µœÏA;õ9kÁt©”xщÏH/ÿ(é}§°?O  mìA°&'^¨;¸9/ ´Hä$5Tá‰Çè¶ IÆœ9[§ð j¦!û’§¦nÒ¡Œ6RÑëêŠÖ!dbÊ^D™±¢¡šÌ> ÐV7lC»GêiNH»Úùß·ùTæ@4;)6 Ír ø ýQrÖ§U»¨8×&²\Ͼ>`ðì¦i4„ìÄ#Mƒãâuh3HÔ´ˆ/¼ûL¸XzÞ‰Å.?lÐ!0ëÇȇÓOü4ôÒEëÑæ+ ºfræ2Œ—•ÑÆv¨è= 7qžn}´ßßÇÕÙÙÙÅÙ€ªãz 2çÉŠäº%eÞVº3†»»º€²Öc0Cò´Q秉ääkGM¼Ð´ù÷GD›Êh3¤Œ6v%Òh³@ÂïCúµœpÖÔJ^ë8Q¦Ë"ï1‚6Ÿåîª&íÝ„6“nŒÍ¾ä5Ÿ 'Ž—¼jƒÑ^¡ÈˆÃh#þ´c›:ë‘®ÔÍ!"þuhcOM¸ðOÕÅhЗ=jíì>b´Çµ AŽ[Ò+$ ˆ6ú6±¡@›«‡ýèƶG•ÜTœÈÈo/%ž­×ÙmL†QKDmðû¾†6Ðå¼Æàà–WâßD›òFÿ|h¸m¬£ã¸5Ú¼þúï_ÀþÏÏ(m‘£ÍŸ °ù›dF›ÿ ,~ëNª¿HÛü¯_À§³_J×!ÆÔUè=ÕýÓýY8`à“b$†y§_3¿ ¸£öšÇP_ÑœŸa¦3ÿ#o›Z{ûúÞæFà­‚‘tK#ÍgO ò´WÛ‰‰*¬F§_×ûüÌd?Ë];pÉ×ëÖ¡ Äa‹}M™)W>ŠFêI$.ÁBÇËò‚ŧìù¦Y•½Oó( ^Ò:'G;—¿†6Ú¦yÈYzNÓ"XPxŠ±×Úq´u m$‚Q ¢Ž×á‚-}}}ö›P‚äh£L1=a´ižé(Wß ÑìdµýȼÍx=ŽÄlG9O'LöX•£ÍùMh#=kƒ5ÎýˆŽ¢l¥¯»[ˆè«9^’z–-ù°17>óï¿…6’ c §²5N õ™0÷qk´©£Í6N )êBgØ-FMž6¢M j…Wëmœ&/wÊŸü}h³ 4äï'"7_ˆe‘¹°”ý&h#ûÍÑFÖvÿâƒö©oß0oXƒC0\ü‚þð«­ÐØmf!™Ìßü € …‹Àä€'Bhó?`´Ö¡L Àʦ»·…NóP²¿üèt¯y ¨)J (¯-úÓÿƒÁú?Ïý¡gî ´Ë…@ 6Û‰’ø»Ý¯"#Y]ìíé£hóXýÈVÃTÍ }õèhÑBÑŠ`Í´dü6þæ;°*\–(Ü£wŸÅþ ûe=o–ÐÞà“ÛVÅ ~ˆ¼ORDvÌ2ºVÂô8Áç_ÎÖÝ$2yce'Ò ¡ }ŸÚœBæˆx©C q¿[nð+¬¡ï ÝŸ]C›¹¾J*–Þ&@ò–{Ѽ޴ù)y@ØÍÅQJÃøÊ!‘¤aó´&ß'áØõðÄo>ç­F Ùˆ–»(tóQxŠÍwܦujû…ÀÌÖhÓt7–F@XÄÎêd2Õ éߥ.CýNÃävhóåÁ! ÕY–«‹£å7Ë'—7Jh'_D}n)zr;´yu4`‹Ê®'ëÌ3Ú¿mdÀÒö.LÊSô ¶$BOV­ûô<³  ѧÙm–ßÐvQŸ ;ÞFÚñúqMçÔW¸º¶Ç·*7ù( ¢º+Á§ ñÀ_ÿíoˆ6`¯Á—ÎÌàÝs@ûï¿ø[ ɱÚô¼þöo€›l·»ÏCâÜœ{08lwÔþÌçÿŠs©è3´‰µÃ0õ€‹ðwÿ’ È¿øwGú%°)ÜÆûË‘T¶åüº2Õ’ —¼¢@Ù~wÁ¸Ã‡«ÜŒècð1ÖÊ0üôSôûž‹Z{Œ»Ñ^6;ùÎTJÙ”­¡aîIS3ðÚŽÓk›Ý=…dÌä<œ”ÈÑƆB"Üý¯ÄSõŠÎ-pÁˆ-µñ>¢3ð„Þñ­*kv§â´çÖ¤qî ÐÂQˆ ×)U¬ºíHp8¤,%^}Ï$â^AËa®é¢³9ï’ý]hó£SçÃ&¨gdæy¤¹:èWì ¸ÇLv Ý'Œ“tv_ƒœãA{Å“‹é,"Çé:F|¯Å¥+÷‹¹t*ƒAc¹–¿‡ZÓµ¿Þ‰mœ’‹Å*ÿ–,‚.°ê {´´ˆw[WÀn¬¾p„K%ÐhT Ó0ïö¨Ä™ÿ¹S§n å2§ºüŠœ ‚µŒˆ{45 7[DsÝÕvügíà†i&Î1Ø“¢pq “•xèÆ ’aWcèÂtž ½ 5IL]CË¢§ÝŽªíÖŠ|8’„·Ž}†;ò")¡ÚL¾*ÝI`ÍÁ>FÆš«öš³È4:‰Hö/œ‚û¨áüáÿ$ á}°8†Âó»‹®¥™w`[>@~A%gÃLvªcm2k‰Ûÿúk›ãÆ¿Üq¶…Ö+æÿnX áÞõÃ’ç}…«·ÊQÒ¾â¥MšÍù?¬Ä­B`¿)þ¬=Д=˜ÃNcra¹ÜLÇ118°T ~&#‚ `¿ Yÿ¬ܬCÓûÊ1ˆ{É0š\'a=™ÀÕ/}Kß~_w ü;šÛ/±ÀM¹„öõ%à—ÿzù;€»kéÿ b/lŠ(!Yºy2†ˆÅbut,ý’»aT9ÁXƒˆçàÓ«²T*N›Ãáy8³0ÓbGÕ zL }ŠÛkI$’è4 ÍÐéúèf\0ð&ÜÜÉt™iîýàó,÷í³gi©©csk—P7,ñ®L o§ž¤ˆ®— t9tM|âùÈz×G»H*™d”Ú9þ‚”òô÷hCê•™vKš†ºî\£ò8Á>¡ðû#›ëJu$Sh *Å!äHû¤X/%¾•†Ãã¹<½cWEÏù:j†~GæªÝ~IIT ³‘FLaýO©o³µm¾Ti¬³\ØB‘~k×ßé©à7ò±­RØ– eO,×¾aʹζ}[yØÒŦ:lªóºO×Wr}&ßr9tYúìQÚºíë+ïe_ùIlöû-ÝæsÙ·‹þeÒï| ŠW?@·äO!à›ój›øµ¥±•óˆ->Ï Öõ…ÔП ¹óõM¥ÃÃÉ;`ƒ6ªl‹ø2sU~;a´ÙøãVí2ÞTÑï‹^µ{7!øÙÙ}¦X»½²FˤBÁr÷Ý8u¢û˜R×oF›?IDºt3 ‡"ÕäWÑO þ춭…Y`Eú“•¾Ò¯‡Ñ!躾Xw·T—o°Çªì]ø¼¦ùfã¨jþ«HEú ¿Õócš½¥B©HE*RÑoåˆ-™DŒ( l}¨„~”­I·Tø«"©è7›•¾7!g‘ µ{‰$-çm}¸ìˆÈG’£'U½§"©èÛáÖ›Á—E‹ðŸ¢]ÈÖÇYVþvXOÛf~ýyS¶UDÕP¨HEò´Ð÷>ØNÇô}9wˆ!¢L\w;[ŸFÀèà#2G—¥C—já‰T …ˆ%É4¬[Å›d«æ‡À±P_ökMÆÀŠÌÛdϾÂVñ€.ÅG§Ò4|¨‚’MÞýW¢÷*\²ÒT÷»¬©èOŸVú pÄäê.@&• GI”¸*H—µ÷ÅQ Ѭ{^"Ãýx¼ÑÑxv.k~dÖ˜­:®Ïò¯ÄïX;HçÐÌng{Ú§‚|O°=éP Ml £n;Ë#U4mZâÆ&w2 ?ù̼ãAÙÅgíªqP‘ŠþôRRÉâ¤6/­W…U¾d~êSð¯3 Äвk›ùô¹ D›çç‘XÆkhé>Ï£ïà“0„±;þ”ÛÚ •‚h™ K„.´· 3 ™dÒ„„yÐ/¾?ˆ˜ŠT¤¢?z¡ÍÊÝœŽfãèâááaÍ¥è¦<€wmíÄú6£ ø}cY Ã2@ âÖçç¸aÝ!±ÏüÛD¬UŽ _T¤¢ŸÕÝÀÓ8rûùÇ~^2ˆ6 ADÍ}5³rDÚm`¹Ï[ †×,] µuI¾l‹6Ó1ƒ=ħ‹À)sböë>Uç«HE?+j}r†Æ¶žÃg™Õc2ÈÛ<†$0ADj@%€zz¥ÏÒïXÑÆbÚÀU?‚×íw=­óõË›Ðæz’‚A+'ÂÐ#ê,•Bë—nˆ›¤ ©èO›„}5ÚÚøç/W\?ëíá~7ËB‡ð ©G8ôŠ¨… JȺP|ÒÅ€ä™ y3¨»‘Db˜ææwέC›Áç(|kÖþyùå÷Ú,¿dªá£3‹n|€\”O<=¥©ƒczßʃÇ<:èêt¬Z5*RÑŸ¼àüßtÃÝøƒ13?OÈñäñ¤'®<‡~oÌI9{èâƒ:”ýX™8•“Ø94ÞM/jBò.ÆÅÅe=Y»Z:—uàê‹$ÿgeYÑÑ®4 J7†{ˆW†×nÞæÅèÅ–«FBE*RÑïÔ䥮[©$K?eÏ/’‘Ûa¥oU]¤"©è÷EË}“"܉šÄ ÍBeÑóêüøÒªägç˜EE*RÑŒVÆ?\»zýC× B©HE*R‘ŠTô“’l½¯Ú?žËjÙ7ݯ³ •ýŽÈïPé?Ɔoh¾ì{mŠ·õG-“ð=NŒe²-¼4+õå65QÑo3-W»â<íö^ýc«üå^±ùM_øûfÎûþØÚu+Ë+2·IöÛ­SaF*L÷Ïþ¾gÊf¡mÌYø9Ç)ßTuþ˜§«“‡Oè5Xemãü—”H_'÷´¢ ù‡ð{A÷ñ˜@G×ø“פÀZ8Àª’^®Ž^ÁqïÆÐò÷3¯:Xº>žAËÿXiïä¢LŽ¶þ½"´^Õ3½]Ý<Î=ú¨´È¾6í%*Ò[ÞL†ëÁêWu’ïÜ0ÿ{`$H'#˜N‰o¾VŸ®‹;‰¶³ÿ]Gd»•[WUTV=ð[ôó>6ÍÐ_ºo;ùõüMÖ ˜tyèƒ>tù0– Oµ(QòH©Ò^ÌÃ÷?ƒæzëRl#ÊnܾR|”®‰I‡¹.¼áhkÊ*©¸wó€—îÞll“·2Ój„U8Rtï^yJˆÓ)VËXÊðäÓì#®Þ®(Í=¤¥IyÖ½–‰—ndFq-­ÙÚ”ònZïºqóJåw.óÐâD@±¥¤‹G=¸<çȲw®•œäëh‡–¼S¡ÊF Ú;:E¢åÞÎÖÞQ8ª‘te¤¿§­­½»Xϵ¹¾æKŽãÑK=Ýýˆ_ÁÜDwG{{{çØ IÐÝ܉é›óéèê™ É|j2ôºxAñâÌË»dfPS{¤¾ºÐÍ€¶î¾!dÓ´:×ÚÙ g^[ûÀè´"gÙÊB7Ø^ðåò™h~êÑ•T/üS[ÇX…Õ *¹¦gy¥í!]ÏzhÍ»³ØJS÷8XÔ½d]ž÷5t z™ò“h„ßæš‘íÏ¢|ÄsÆlBYíèBó•Ó»ˆF¢|Ÿlˆ÷‡¾]l°Ú{ F“]Ø“[í¢17þf;”óòÀGK+ËÞyôH5}Ãc'3¬—T,èêh_ü ]µÿ·¢ÙO8#ÃÝ@ßÜîdå˜L&µÑ£êYÄ'ÆQ(T×Lpì>_9îÌfèy„fæ•AáçÞfS±X+ßè!.T"®è9d*>÷Øã”bÂð ‰^KÅ­Wé:8C·ˆÃû¼è8ƒ—š‘ù̲òËàØï¿XVâjN7qŒGŸž¶¤ÒÁ<&Ñ>ü4Rµ¶^\b‚›I²ŠFv̪Îx—$$A€>¡¬y–4åï º®€u‡ÕÍ$Y‘Ý}}û6£ 4Ú®ÄapT}‡#Ü ‚÷¹kQìÞ樿Í;èjÀÑá¸õÊ?»pÀŠJ£ò™D»à“VŽ°¡ªƒ5óÞîFÃc3îw!?G¸Òœ½[†g”ž>ÌÒÑÞŸUÆ´ ¿t1ߊ­í‘òISrÀžÂ`ÇÆ'ØëqH&þÈ‚v§¹ø§‘8Ö~™oÀdN$ ™Å£[æq!»ÞÓE±¬ÖBYtîf¹Ÿôâ$:ŸŸ€Ña]†Y¶ûXÕ!(ÚÏš©C4‰.ŸÄë0Ͼӹ ”î¦:žß¯gãìccˆ'°/ @ ζÈ¥°-}Ž<ÿüTL%¢ãýM)lý/sÐÚžïxB¦PÍÝb÷ù3qx‹ÔhÅu×EY‘Éæ©é™“Ý–8ÛÒëСXK>‰«°´AÍaøžÅ4χu¬ðì‰(,žQÔ õd£.IJñKŒ aƒÓ,þ1¸P[k"|Í©TË´ô¬®e`¡¿–J²—À¸¥R™y}Â6w-dXé)Á©[¯±z·D—®†3ìòD ±T0Ûsm4ìÏ@ûòd‹€yÚ½¢B¨Ïç›ñrÀ%4`hßEOMƒCrW{‹žÆø”«ßoÏu/†Œ¥«sV,Bæ=4\ùpE¬'äo–^…`4(UC(†‡ZÂò^£xö6Ob‹Œñ±=Cû}èæÖr]b2!’.½<¦NuE¦ââ>†öp˜©ŒRcø¢ùIâÝ(ÞÇß@êÌ ³“3‹[¡MÁNm€ÏÉê» ç¿¬l}’‚}*ûëD£!Jï¥úi1@´™¾µ›ê="OšÀ² ¾‚árM†:Åy©ÉR½.†V9©$”®¸ê/7¢çúÇ)j /D ´Ï‹kœ…¼Ïv¦˜{"3óÓÅ$š/XÎâ‹45²KŸ<ÒãÉ@¦ÕÁ'àû{y†‡ÐÞ{~Jj=€¸g]üdª©Ev/_‡6½g÷ì&ä}B™Ì«ûè¼h¤Za|2PµÉë©{ñ “awZ¨&ìÑï’Ÿ¤Ôöà’ž¢!B.…RY!OÀ‡Ü¾%:YÔ]…ÃqjGÐÌ«L+’ó9°'ºß^Í)@íVf›ïRÈÌ~8fÏ“C$V,ømOÕŠ#Ú—ÒÙ+®N Äë¦ÞX¥º1í5Ú•/RøDï»àCi$O?õ®&|E$ÒêᨩŸïFÑtã‘,Zï†0Þlä4æÛ¨„³ 0>஌*Æ\ZæD5?] i«+êTœó¤wüõôRËW[+q4ÎÀÊXÎ=‰ÐÑ`Ö¯·B(Üj£–ýnƒ¼o¥55zŸ¿»¥g\Ëø2Ì—Š&'&VÅ*LÚО÷#N«GôI&©—?7ÔÁTïjáW2§A´)|³íoXxÌ…§hŠÏo2w’ª!´Q#G áW%F:{ŽU6¢ièïÆ—ÁvàÇÂ8ñÕhÊñGjXý.¡ôNŒ?ì°.6£¤ÐÅ€q¢-§áT¬‘ó b·­ÑæSò÷iyš­NRFZ{®¢µ~ÈßE†x›’½æ‡Ï) éŹx¶Å^±¸çÅ N[_½µ³”d©‘‡ÕeÆv¿òÿVš{Šûi' h¼ªA6†Ðfö!ˆ6 ¹Žåˆ¢½ùL—K ’äFñÂo ík¸~œ¬gúæ=RÃ/+sIÚ†½0˜’óõí¹Í 'Sûô+ŠùTw9jê ’ç"\M#3×WoíºA2÷’M$(wˆ‘ɹ^m¢óQžçJ‚¿u`&ò¬@›\[ ›§h£™¹¹[ÈFðf„ç !°ï 5ð<¤¨ûÛ|ó-Ðï @×ǧÌa´iÓÝ…-W¬‘¡jÃ-ÐFIJü2ßRŽ6\çCÏö½*M&ј¦¦k#iflÙ¶<Íó%0 s/Ý{óîÃË;%›Ñúz©+1ØÉ@‡×ÆdV®Jן?A´Á ˆÐ7­×œ`´²ÔÒæ­haiyèIÿ:´Y¬£â 'ÄRæ/ ½Ð§â¢ _ÊÇeÌICûL·âBCtÒœêz©„2ãM vDrÞU×:û>’¦01ØÌÈ$ôÈ%ñ|5IݼØm‡™h¦<šd›.ÊÑÙ˜¡¹Ç¬K/[  ýÝ‚6â+’eÁûÍ¢dÚ¬L7qðÚ¯Ç7¦@Ð=Ȇ̱».uoQÈÛlDôY¢Í7=˜@ÿ‚`É ?#½„oø+Ñ&þR/òáRMöNšÛw¡¬Ç³³´åmfª3vSíA´)±dïÏWL¨GùÑ<Ë ~‘êKóŽ_«ŸÏ츠S«þ`h‹ m¢¾Š6cØaY›Û¢M˜m^žŠf:‡(&ùí Â÷¡Íˆö®ün!çß•nÍÛl6<çCO‘&¶Ý9I6´Ù$ãwÑRO¬CW“Í÷7£ÍZÿHÄÂÑzŽr½cfÃIj+´“wÄÖn¡g¡@›Á'™–!XV»C©á’1W? +o§íÔÎ  «_ó54ï«ðå+hÌÔ$ꬾ l¤,9ÌýÜ“Ae´‘‰—]Ù” ¼Çh'¿Î· Ì)£ <qŽ<ûØóHAëm{ۣ Ðy³‡yq¯5p_g±z7ŸÂhê½@oE€ÂÃÞ)—[Á92ÝÛò¡ågö»rCN J…¶Ú\¯ ÍdË›Š ÈË@+²o²©Ç÷šbYŽ³ÐÉÓR×­AofB 4ܲ Öt_Æìf”#"㡇¸„*H¦¼òòþíÏc"™L`Äð:zíκR;ß4„áÿÚ²®R5öý´ª×Òý¢  •Ñfé]þ.œQŒã¢žJ*ó}hÁí0êv>;Ș€Èmævp>£Bºo¡ øßÌú©7hªÆK±î‰`‡/àv†U!â½™ˆ6Ý0ËÐùø0‰âNÝÍ4ïÈsò¼',ð¤²6°Ž’î¼îYÚmÀÒï¤;²lbPx›ûâá¾·cêÎÆ;Q4t¢¼žfçœö Ý!êwe‘Šêf6L궪–ÝÌjw=<×Ñí_„¾ûxŽ@1i+>ñ¦ˆ¨Áh+%è1£s.|œA.ML)ø³v)€dÜt'¶B°Ž§¸é·Ó Y¹DÁà;mñdU'òçÃ#N;I~Sœs±îÝûY¡êN YŸÕµðo=y69”N¥XÙÚ²8‡À,x Ä9T‡Ó¨ißwS6™klc¦G×µ(}õðÒ ¿_Óâòy`⟎¡okiDcég^}‡ _jÙùðsùîöð?ÕXh ^\8Ì£`ô ôðvRÑ#ä÷Š3¹4¢¹—„·ðJF„ºaæ;-cTë­<ɦ3-,•„%óm/}Z’ŸrÄ—C(,•J$p,ŠÞ¡(Ús7E—¬Ic±ðXZHÚMD ÐYE !µ1, |$G–Õ¢·QQzn¹XÙ–k)¦¢6ŽBÂjrÍ]*š¡®Œ×ãµö<îTÝI­»ÈÝ.¦¥L¶ÁÃÞfM÷- ¶ G¥¤p¾¡hÙVzm[铯—Òn!è_WƆŠ­FÆl!®ÜÜN`ck¶H*[»•úvc×u‹roÊ€í³–k÷I•c’>?ªG z±e{ׯŠ#ŒâYÒy[b:-–*·|ëe‚‚mÑSºos–[Ï´õIyâ­ÿaK;‚­¦ÜW¬Q6g²õLd[Í™l[sŽMËa‹^ØÐQ·½xÏU¼ÍÏ‹¦*c}Ò«€?: ôÙ"¿¬Ѻo1ÆàÒ¿ç»âD{ÿ¨¨ù˜7ÇÔ_,UÝÃþØ$Y¤p¢T~~^<œlÛ-è¿=µ<8mLÃÐL‘yàÔMÙwà@"‰/q{-uð4kàöfP¤š?Õ¬SYhªèlÆßu`Ùö;™ÊFPE*R‘ŠT¤¢µ]ñs‹”É~F¬ì&ñòï–ÅŸ”Ó›?X©èACŽP5´H&Â?¶š÷ÇZÄÖüLfS é¯]Ž|ü W)ôOeÙ5Ô8îsÒ¿¨»-þ>QOuŸ+{%ù½·VˆÆ¾”\{£¸ïiÊÔ3Ìiøòð5úµÇ±FÕÿ)„›¯dÑ¢Àk{ú¹|CmÚ"d_c‡€M÷Ñ›~ÚªV[ÝG+ï½ë6¦my˜ ºÄëïZ•¾’mâàÖÿº©uë.ð7݊ʶìíûú?¾Õ™Ûlß_ßÜQ­awÒgŽg~9öÙo ئ+¶­ÏV}/ÿpðÕy¶ùÑ­ý'­ûfÅ„­¦ò¦³ò¤žCŽ¼Óæƒiä'ƒ [tñ67Ú*ÞæǦ©FÛÝõÜ–ƒ‹(…ìÈ$cõQnæT*ÝÌ-²} âeîxਠÑhx¾7¢SùòRº1‡Fgè&œ‰ ÔT¥/ÎûúÇ;É$®Å¬Úmšœ±ÔeШì}Ùw$òM`D”tUfG°Tž‰ÛSØþÒ"ŸëIð·cÐiÖ{z–åú³Iþö4:ÝÀÖïMï<’Ç£ÃîTÏT¤îA¶ä¤+h„_ɧB5¤K¼ò:NÓ:cà}>Áü2½ÙrAœcÇ—«iuå¹hà]䚣s¾\•ÌÌïD5çï‡Ó)¼ƒËð¯‚ñ27óp„eÈ ¤ÎÓOrµ†+ê¾@“ðaQyöVŸM2`Ó,ý´²wÈJ—I„vFäkµÝYÁ6`»\bKÀöWdÓé43Ï„1º,dÓ­ñ{mi4º‘}`Ýt}*“®:›/>þjN×=ôÌ|¢å‘½ƒF7(y7VçdRqØ›~ºüUô.^Ýüˆ`â‹1‹Ba(¬–Wk¹ Æ•Jc8„ç,ßÓ!9Œ¯Ls¨T •B"Ç\ZA´ ˜Zèð¶àR)̨Өªv˜#åØͦX{.#ò)ô÷Êô©XoƒÆ3v¼ù~XŽ ÒW%I†,•ÊÚ_Œ°Áƒ—ê éCÆS>.½¯/Ú±i4ª•WtãÔ&7-§ÕuCW›÷ZòÈdFȱkŠÞì}yÁ΀V)(í2<½E!X8g ‘þe ¾Â3ø“B)àlyìh˜ “N5u‹F4‡Á,Æ›Úéƒ=fXúaüÁIÓ°ûÚ¶'}_Á üH4ÿO¤šZF½ûÒ><-–ÎÖð´µ²+êúªOSñ¬§#€`j Ý’ã˜qcj|†‚ ŽÛÁÖžþÞ®–3†] 4%_áXVqǯtvõˆeÀô@ª‰gcGoo牽f¨í±p]º¡ëÃÆî©©©g±¾³P fùÅ‹»ú¦³«ëq^°:à Ҍ6Çi,«íèo}}‰!”u@Ó®¹¼0±à.’ÛÖ6àM‰ZÃà¨Óm+[ÙIMÝñÕr)€§ (ΌǠÓÏ|8§Áˆ¸›e¢—„F†HD‰úö}3ô4ZÇ<¥¥pÏaÝo¤ú3LLCªáŸçßtôûV¥ò}v5ÇË”ï›Öv@ǧ0=²k¤,“¬Ú™0¸ÑŸÇ'†»ìôÉCÏ{Ÿ¦&Ç’\œãKá…Ü`¢£™põmÿ@Ë« LÒnHÅÏÉœÁ3zÔÔÞ5²LV1ÕuŽV6õõõ\IðåèÓ Ã!»’ƒäSÍð(E‹Àô?|qh|rr¤É…´ûP¤ö|,ÐÄÀ5®³·¯½ñ‘‡ W‡é ®ÅÉÆ3:fõãÓ³«2·Ñ$p=ü“[:º»›ŸXawG݃F#ÜÍ6 ¨¨oíÑox/ç‘ý § «ñ¡¹ŽVz-ÄQÜËòƳ]?µw÷õöäEÙé:'‰À±,ßÌñæÇõ =>…eY~øÒÙß×ûîÆ‘:&S’u¼ ÐS¨¥9‡å÷NL·2öø_ƒx®gãÈË÷_ºúz £ÙNQ™L¼¼t!ÍUß&y`h,¨ù~Ûú¼{õºQ á%Ï;»»_–V'[B—ÿêØã>õõu_>ìÃÖ£ðãFŽ8Ó¢‚ mšñJáçId“© ¡Óc)~Lö6 9^©l'%ZìåQ´÷)>¿ƒÙcÚÛIih˜v£Ñ‚#c÷é·rÛºÕ·¤=܆Umø!(;T©†7ì_•¶ž ÄØÇÉw±ÅË'O5Îï“,p{ 5¹œâdå_¼õÝÎãÄîÝüz)Ê'oa•¹RÏÒ0é‚œNëR¹¹ÉážGjÀ,Ž:¾4ùñ…ò(¢¶rš±ÇqSÚ­«Àk„ÈörÈV‹ZÛEÄX3NVÞ¤:A¶EÃUy3‰\;X8ÑL§àëFy“W´ÔlP´¡¥”½CØû£îVæq<µœ ¤ø$€ÏµqF„À ŠÊž³u/¤bg FøéHÓ?óB]ŠA-…±Ô6¢MsÚ.u“6yG‰bÛÆ>Ö†¼»¸~éšÚ“áêLW&F/ë¨Y ÉOR»Ôtëä¢âh¶å¾Ç`âw¶çá H~ÝWk™(jØ~?šÌ;r2󃣰m¦X,yÏ3™_…Š‡ÂÇ›Cáã?%ZøÍÈuœç¦æ¤Î0=ŻԠ±CfcåqŽ÷p(y»WÉ…I²V¦½f*¨"×ÛÐ1‘•ígøÝ‚€±÷z’¶É^yçnœÊ}7)þîŽwKU̱P¦šqä3ÚühC¤×"C)ØÏ$3­]ƒ²à³Ì÷g¯ó81ú˜I"8ïESy’Ô±Ga«LNj "jÐÅêX{!i‚ƒ¼iZ¸ ¹Ç Ïä5«Lu¬^·PVæl•½ž©§[PMl‚ÑríMõùö!ßë߆¸¸Ü)#ÐXëL£tyôÙ$s±©˜ã|Ì Ê‚›y»U6ù…J!wÌïKã-ö?ºèêSòä{L1ŒFØ<ðR0Ù÷Þ4xÓgì[h£PM'ÅÀ£Þö1•ŠÚMwÞ¥“In¾ò^ t'ªánÃhcLλ߃LûL«½G¯#Ÿtž "yƃ O6åÑÌì ·5ÖÕs‹¿t6£œ¸‰z>ìhyàŒ¢ÇÊ°7£Í” …±XáA]Û¨‡ÀÊG¶þ™ÜM‚¤é̲óf´ùì§è½’x=ËèŒáJ:ýyy+9ˆÄÓ—Ï‘@O+2ÅplŒ} ·ã‘¨4&H੘o: 3{ ´dƒa&,‚Ž–c`Ü£÷­‹BñF™IOñ¼“ÂÆòÑI3®çUè0Æh›y*¦Ü^–>±~q=ÚŒ8`˜ °ãÝôP]Ϙ g´";ëC…Š—¥1ìõh#[œžƒi|rA%Åùƒ¢Ü\Ë!{_z·º¼  EP™·Œ=¥ë_×RÌ/¬ÈÖ{œ7òÔ17{W”HóÌ[Ø€ e¥.Fû68Ÿ°5°9zU¬\“¥å¯ ¨1ÿûüÛ@ç"C²jz¯¹º\éºÙvI¶hJý€¸‘Å`:å^ûB~8;Üe窉–'W{ªˆ\Ë%Ø[Ó½tŽcà]/æ<Ø}^djÓŒ$ÑR;»y­™î *Ù0.Pî%Èë0‚6•JhsLŽ6§Q´I3ç9dß]ßpÄÛ˜Q2ËÑHëÅA–ó׿ƒß‰6õl5Â3ÔÈ|Úm–Ö¡Í}mbòÑÛ®Û©A|ÏÁ¢òðBÌ`´ºcê3áê*ÄÛ¼ºˆçnDlõµ¼8[[qÁÖ€Á0u[®žo6FjšÅí+Êå à±P ¨!cŠ|Uq,Œçµ~:…Ú)Ê)Ý€6’6|-´ñœÃ*Êm€û™Ä ›Š»€ña¸ç×ÐF¼4ȧaîµ,Ëú+#ãnÚŽZFõ”ü.@4Ø?Lª-=Nt©›ì“s¹Â¼ˆ ›Ò¦t+-§,EMæ&ÆJ2E¤ð[âá íÈ_ý×w3Ý¿‰6Hn3“y‡òÌÈU Ès ]ÿò˜À>Œ6[2M|o>ócÁzv ãóe't½Ê¤ˆ—ÛžgD¦ñy_ãÔëÐê{ÍÉ«y`€w˜TZ6+Sm þU¯PÞK±©E¨ðo£ PŸd‚q;³VÕ±1(^Àz´©Mu'º§Èûa1„©ö]h#·"î:×(Ar®É‘Ÿ¤FÊ0°'ÞïD›Á›‰êú>Ša g!Ïä hïÒ*›@ÇèYQ…o:§@‹t0Éô@Kû°HÞM£¶¸K¢u7D[£,T÷þk#ò.‘ôw£h¹^FN9Ûó/÷CW²o¥¨ëºKÐé$:RÚ!|“ìJôL—Wy!˜ñÕ“”êŽêGAéÜ>F3ùÒ“/­­ïŸÝ`è`N?QFp{.‰´§Ù†½ilùòùca„±ŽU¢dÚÀ'îÌ¢®ÃóºO­-Ÿ.§x¨qö"xkÿ6²Ngª¶ç‰ò†¦Æ;YZ,/Hð*n±"j†ž¾ßü¥µáÍsªfì•0릫¹1¹7‘ òB-Œ½’ú†FzZßEú˜ê°Ý„Û£Mó¥#îq({#n4$ÓyLÝñeh9¼¹¨çlêxÕ»ŒÞâšs\Q_ë‡<ŒXFœC¯…òëÔq'2‰CÄßo‡DQËŸŽêÚFœB¾Œtw¬l1oõŒ¿9Ó%öݧ–/ŸêOñ N2à{xª>™á5÷ÄzU\ìiPòBÁT¼¹žaiÀáóõögÜ@¦ôò›h¢ù ±Òi¥ýI±1—Çå&ÏÊ?<kt¼V.;}FfYõÂW–ÀÒ`J°³.Ÿç”Ú/”óD‹½i¡.<ÏÐÆ«¢qÙrž¦øñüÉ7 ‰cÁöÏ%"ki¸ŠÊ…Ý·ÇêE+ЦࠑÏÑ`Ò÷Y!$Ç8E» |fÖ±+°Xw¬ñO×àIï,¢q$–=-8Q9÷–Ôf…“9®Jê"¯âô™t·aø[éJ­>óÄ•:m8ÄKBds|VzÄ\ŸÃ×58pòÎ ê–ÕÓN·øQRÿ¼@×°Ô WÏÙ(~дY ÉAN`Ãl}6Ã7à’½Žºy]Š­wäãm.×Ю¢}¹<•o{>O Ô)‚ïs¿d`u÷+:¡$ÙÂ#þ1\ûÙ¬0G.O×/©LØY²ƒäŒl3—’<9\Ýø‡ã@G–¡€©ËG¬\Vô3H8ß´Æ„ˆçóèñyz¦vE>!uZªóµ1äqõS¯|çLQˆ‡mÓrÁó=¾æ\ϼ~ øt/×Á„Ïãrí||œ@ús!œ‹½ûë+Åq|±½ž8šÝB$ÖCo/;›ñ¹\®wìÉq¹^’l¦ÕËœ‡|Õ¡ PrÛ¹:±ßC—ǵõ‰k[DGn¨þÜcö•‚I<ãýÐ|Nð×=x¶M?ýœüÛtz¦n*qæÞ†8­õöd_ÿvý[õ€rA뛿ÎÙÌvmZëšåñšš5ál;u碾-j²1L­¬ïsmKŠ%£å ZÆFýëNo¶qøÈd¿¥Ó`K§7›JßfÊm×Û'1 [{U³¦fœa«îZܯ:9©èDK/j`>áOa‹Xm³"ìñˆËºw¿âT’Ÿ6ɼSô_ÀÍ{Žíù÷n_)4¥k‡¼~®WÀûbßãy(ì±ÜD_m²e·Xµ&T¤¢ïX<2@:ß2)ÆßÏ/*!»}Jú]v”pŠwòCü|ý"/>nûùlëPÍõå$Eƒ=˜Ý9-U¹àP‘ŠT¤"©HE*RÑïD‚Ñ‚¢s£‹ýC.Þnýs*“Þ*+lZýñk=ÚpµðVóï+·ÎšÒó÷»lõê`uAÅÖ–zÕåEUu¿Ü`±5¿´üsy~þ½Ö ¾dyò\qaǘ`®ûcaI¬9U–w¦¨¨PNE¯W 1JJ>»]v÷å'å|Ä‚‰’¢3=3äh$k¯¸q)¿  °øBÕ«Ob%!7 .(¾8ñéö™‚Â"˜Š‹‹‹äôz`¾ómUaq±¢ì⳪k¿Êx¸ÀºΟ-.,:WþðÕì†+A{Q^>˜[aÁ…i±RS§?çοѰÎL»öεÓÅå¥ï%+sŠÎ .mÛ™ï/çž«ØЫùEçÇ—qÌLsnáÕe&üáh¦Gb4Žnìãæë!NqO¿º~©hLŸÀlübÆÆsVçk¿¯ÜjÎùy¥¬iV3#ïm­ƒ‘uÐùÄõîßk€ž« º>iKõ©8uÃŽÕuÒ’¾Wd’A¿è{|–À5õo;ŒÕ´­ƒbÄB½/ÔÉÆTkùaDzÖã=L¼SÊ”‹X™ùÂ%ažô@È?ñ¡‡¥Øz¦I‹ð1b öf*ìE'j/Ñ }&kóƒƒCÃÂÂCƒ¼èd¢ó^ð¤ð;­³•9‘Tža,J1Á>NºT›¸«€²VÆ>º²5Yúæ.Þþ¾Þ6¦ºš´‡-“ 0룃÷Ú“p¼NášÈèIV™Á¥éBú Š8áeCÀkyžþ¤Pý- ðH˜·Ûƒz[Å>2ÁnB¼®__Œaè:-ŠITÏÕ]ĵX9*úƒ¡`=Óò nÈË¥ælŒM1°Í}7 ¼ŸnøAiKZK¹µ·™­=¢lF›¯ß8_ Û±îžWˆ'¬¨Ôšž…¯|¾!–Ê× E^æF˜Ÿù"Í[ðð¹J)ÅƆǠËYe´1ةߣœä¸›Ãè«h3ãN ÆV)E…6Ú­–ó ugU™ëe·­«s_x­ÇýkήîfEè:„¯kßÜSŽÆžÒväÕJ€1Î.äŒòÅzS±'V›òUGÛ6Ó]NÁq´A^‡¨§Þª%éG–=pÂÓ"`o †jÔ/@"G}m õ¯év:\ñiBY};†³Ë¹¨G¹Û¿î¾F¶ù§^Ú|[ûBE¿5ÚœOñ×Ó3±4â¹f7š¡MêÝ)ŒÓ-(Áø‹]Xö­4o¯à˜¡î: “[¨›·ª`úþJX»U8êfIbòÌôYd¾í¾•¹êÄÿ ¹(b†M4ÞÅ)}‹À“â.ƒlçìjÎ%± <ë…À½½ó“Ïàü¤å¾œ;YVàÁ72þ‹V'êÏZpˆ†¶®¶F=k·Ö©mˆnç­ô-ílhZZ®©s›&ÕTÍI#ŽglÁ&cí½RæàÝýQºY cëìbhìö Üw1d#p?•CõyˆàÂRß ÙdL ¼¹vT—A´qrµÔ¥Òõ\‘š‘Ø<ä'9`FÄQ\]ì Ó¢ôlB®~ÊRÙ ºƒ««1§kضŠLÜU/:¶šÇ²[aftÿ<ÅŒwVhãøM°êÿWÐ:>$9ê8¥}ÚL»` ~e_6¯ ä9Þ@ûœR”ëíÑF2ŸB]0_µGÛºSéJþ?±—9#4ç¾òBVB¨¿>gî&ø€Yœµ'ج) hs¦úa¢1Û5_„D‹øo«›:Rù‡î+^¬¼?µg 6k¶"àß؇IS=±ÎéŸÁ.Æ:ûâ²ÍãG3˜Œƒ°ß°¬ñÚ z Š®›³¥^Jz¤É ámʳBØ‚³‡§>•bè~ Eúö¨Ïéúª0ãwA<¬ò 5Ǭö°!ïïϘÝa5×é×Ú‚k>ªõê ë¿š©† Dy›ïJ³HBÌŸ.‡b¡«à«£v¬=D?ʲå8‚KÙ¸ã jë<,Ž?vµ}µù¸7 öS0oä9X¥=†”Iª"42q/_›ó =¤ß;`Jôþ6ž·!ã Oûa‘Ñj¯>Wü´wÝ|\èæbˆgßÁSV6eÉ ä>ïºjê°«G•él-,ƶ||pTðY&-•>å`¦”Ž¡Ê³À«²äÄsÐÑ®äÈ|è5}/|ÑѨ›y›KÒÐpNz HGMpj÷Q# äDÌùjxa_ÓaG£}1QNÜÍx¾ˆ®ýÊÜ žM¤VéÛ€6ÅÃÊh2âkÄô8vë;Ðè¯HÂkìtN¸R~¿¾Õ+A¹¬…'D¢Û²Òö½5Ú8î[wr¹Ÿ¤­ÆyÇS}¤Gð-ÚÌ–Û3‚N(¿SB°yâ ¾ GËmùX¬Ã œYÑ&2û°Ôo@Ä–¾ùž“„]=gqêºM+h7žŽ°³ ƒÜÌ>ýA7I‘ì¨/Åãd.ëmÇÑõLA^NÞ=¼›ç48ÒŽâ“Z‰¼¿ë¤Ã´ÑFô1[]Óè-j¾*M°ÃYÄVC;Ñhock¯ 3~'Þ†H{Ô7‹L?éÜ3š:é­@mjµpì†ÙU$Áp¥‡–a8;Ÿ“éÆSÐì`ì ‚7>åôn†žÛ9xL'½°ÙmQcŒÎ"¬`trzI(—KËFM±äÚ`dÉn/‹ö»ÆÐ'-õÔ(y9QwÌ`µÍÁ4?;PAÞÍo‡xk7^¾m®4âyæ?Z/F.§Ð˜CËë~›ïäP m…rN/£éÚ6ç7 ÍY'lrt®LµÃëïÍŸZ¬‰Áåh#½ècb ¯w$óDkMm@8ÕÅz§\Ÿœž¬¬‰+Ò¬ì³î)–xªÉ5å"N eíÜ5 RF mºž‘1LF$‘ó'_A¤B3­Ç£Á*²è 5Òñï¹M×¹0ý°Led+´‰$ÒéHÑÆ&Æ*–ÎÑË}ŒD¸–”¸ës^ÚŒ6Ï;á]S·DˆYê×¥bïì2¡½.îtÕR m`ìfÐ.FðÔ÷  ,/ßkŠ?\Šð™Ó”='k—¿†66´¤’ˆ]8Ð]ðÎæa-0;Ïv¡¯—Þî![ƒïo…ÛrC+ÜM/Kئ>«ªp—¿§“ÔGXJ ~—?ñ0j§×£ žÛ:®¸‘J/m#mÊ£éÞ·áwÒÔNkl˜Óu7ðl£™éÒ« ¾.RÁèé7Îd9g#pfO˨š­ËaF>ÆnPl"À КO*o\îx^H¦Pˆá5wi>žƒå6ŽWäKFrÚQ×äÄå tמ¥Ò'V×ÀkËRÙ¦{W¥èËžkŽÚÖëÑf¥‰5†Wžleâl¼O 1˜6{Ӗ֡䈡{Î]EÎ9áLm ûä…Þô k ŽÈ`q<]„G*ô7 —¼R¬“/—“ ¦ž`!ÂÚ´dï9…¸X m wjŸl^X\XXŠîµ¢ëF-*‘MpßmDëQRÉŠP0𺈡¡zª@ª·áÁ’uð-y¾]È<âÙ¡ã!F›^; ÜÑ›#MûœÍhsf¯îþ“Ûð6@ÿ­½$"moph0LF¦^džâ$…  ˜K„#;èh…ìÛ¼ ÔÂ×éžd÷Dh WïdÅ"si{´¡¦]–7¼§hÞBi#w·Î½Iù$龂Èm²Ý-m’J„€¦[™C+¡D%­ù½ð6ôšÔë¯t¡†®N|#øÚ€ùŽ˜ÔÈ/GSÕàãÏú(ÒcÎxâµÁ¹X{׃W× ‹W:?źs­B.€_v7Ìd½ÜfÕY_Z?ùùùõç#(Út\#cõzV`æ–‚Û¶üÙãj„^>Ê'«q«z9ÚÀ¶žÝ7‰œê¡qù')¨TÁ[önê“Y¤!ãÀµ÷¨<»2E¸ri„¯¡ Ðm¬¹»´½X~S€ð6×BløQ§™Ô\Jb»¯¨x›ß“ÜÆëì;ä¯öK^êô}KÀ7Ѧ…1‘dzt3’ÕQÄQß³¬]»õáäŸO[é}îËÔv £Mq±'×ü äEèÛÇCäÓ}ý˜ì®%?.Fð–£øA¥K§š8ò•ú1´²Í·s®¼Eå68V3"®³‰¡‹žÉÞŽžqˆ ‘Lµ2ðä‹ï‘™¿èKѹްÚx]“¢ß†°)‚.+<c³&·.'»º&<%øsBáéóíåÃl£H‘’ܦ3ÏEÝ0áçD½·9ÚêÎIï$“µ1qçÊg÷99Åœ_øœ‡7ÍÙ òì¨)/â¦%[Þ¾veû)ñØÃXŒ–q“Ü–~±&[Kƒ{½ ]×âù¾kÇï"øårÏKŒºÎ©MklÏt«GÝÿ\·lä*–upƒvÔ×¥Äп«3öRhQÓ½yl³Öat,Ž–²Àñ¼Á£QC©ŽìŠh`=É°ÁòÁ.š¨»‰£óä—ÓH&ÉÎx÷4(òŽo_™e¸Pô˜dìÛïPk:Á±Œ¾Ì$“ëÆPx•|LÜ…÷FçØJ³ a×WÑ2Ñ ÉE'ÿ•Ã^ˆÜfñYʼƒÜJvÔ‹bUöíêüôИê†üw ©‰žåofâéïL¢±ÏÕAÒÉ÷gL n¨”XÇiS §–aÖðã,ªC¸b“‘.ô™ñØDž¹»½ žÌÉ«ŸC`H0YÏ&ã5M“¥ò9–æoD¥1Ã"ýœŒpxFñg„=™ò$k2 í0³Zw3@ §¿Cføá!& gíìiK¦³‹ßB!ê ̉E6F‘b¬˜:4Ýxˆ² µ¹)5ȇý·£èDœ©£‡)ÇæzŒAh¸šã@!èp"c£Œø–åeÈIªò¨ËB›}úùèŽv*Ü”J¡ú‡D¸š‚U=YAK” IîeÒ×€À`[ÆFÓ ¢íÓƒå6¢@][7$|Ÿ·-ŸH`WÕaT¿Š¾ Ç€¹®d2IÛ"[™;ï{\Là£h³CûLòå»$Ä–o½æ¯ïõùX¢ƒ§qèD<‰bh² FÙ¸Ñg|K¢[ÙÚó(D Í.Ú©?&Øå¿6¡ ¯¹mÂùöáÊ"8Ñç,üìí^©œ›šKõÔ§Sˆ:$:‡AÁÉ|=÷¡%è€*ŒZërðX2N¡° ª†!öåj¼ßÂ[eÆ÷Ã…$’‰³H÷4_Cˆcé4$ˆ8Ì7Ñróóâ<<^»\R 3ë«ÕwÚ_˜Ÿ­Ç÷ Ñw?Ú¾÷²¦¤–)ЦðŠ6_®$ˆd3W?gSZtb˜6Á)¶(ÆžÆ`í?kÅaÒ¬C`}Ÿ¨i¢ÂŒßšd’•‘Ñ1±T2;9>22:5»„*U,ŒNÁ»4˜`dL$•ëy ¦FÆç 3Ó €’z…L´<16:2::³ ë'@Z"ãc£sËk—±RÑÌÔÄH£ãóË« F|~rd|bñ¶ .UJ¤Š Üå…0oðåì"*^™Y Æ ×ð™úoa|d|nEqÄXš›†¾ŸZ‘¬i}LCïVÎR-Gè #˜›«-ž[UD’ŠgѪŽÍ-¡Î#g&ÁŠÐœ$B8§ °YAT—ôÏP Ä+ÓPOBµ‚ýîÊfÇF–DÒ§©xtttrqOJ±pqtlv .Y¯Sˆ¦†F&DJwÙÂE°Þ`6£S3ó’õŠ@«‚…Éñ±èDZ™ù%¸xÙüÄè¼`£Ò¸L*ûq¼‰ÐòüÌØä̯Sã#Ss¥;qéÂì4\øèäÌœXɇL$˜„ª56‡¶N63:4¹ Þ€²Õ¥á‘q±L6?513/Pn©pfìוÿ¿½3j*Ëâøÿ15?LMWë¸@ö}!!TÜPAhˆlb# ,n ÚŠ #(㊌´Šˆ¢"à‚(¢íàÈ¢,ÊB€ ²½y// $ –ewWÉù” yk¼÷ûÎ=÷Üs>[î‹ÃFgß-~ω¶ tÿ¾µÎ¤‘ÊF±Œ]Cƒý£*«Y§Wööɬ-ÝF†n.1´è¿k1žQóÿþÀàиÞxhÒI¢@4€/BÕ¶%Xr»oœcñôˆËm_y¨e¶µâGÒ¼ð&¹ä½1Àü-Ÿƒ¦Ï$Æùó/Iûâĺ­§Y‘£ø4œˆÒ‰+}׋ø,ŸŸ¶*t¦¯h·øyIc¿•ÉÛ_üWu—wE9~¸¼ï/ø¢¡°&ðU æ<"g¨N |Ƕ ðX“ ÎYj§YW/N÷÷mçºöÎf«i¦ÔÉN;}éóñ[|WŸzæ:åÀ‘ÎÒ¿Íáõ:Åj—¤q8›nšº³Q[[œéN#\+BS^ ØâN ¯*ÿãÅE? ûÅdv[¦M‰á÷‘k)d¿ìdåk|±.bÐÞ¿éΤ¸(¡©æ•—­¶Õ-a“6d”ØNÚq-{ž+щDœ÷£ S‡˜’!b’Ñ+ñ\ûøÝ0òÇ;ô Ê9‰Á4¢+‰ÌŒ9Plž¿ž4wÜ÷L@£ÞïRB›€é1êUj³aPºñâØ*‡º“×~æ.õíQc³¼W2$èk¼¦äÛÛÇYf¹}S™á&Þ ÀfpF·¹¹úfÝÕºþÇž®ŒÃ/°™ô[y‘|Õ”h÷-ˆ_&^ž¤5Ÿænî.ÏS²lɦ#¥ö³z+¨„µ‡s"°°Þš‚0¾`}ëðÏíàðÆÏÊÍô¾Ð°1ÊÃyœeIE¨:êÕ}aîÒ_n9Zñî*—êÓ¥ó˜íƒ&ìWþòPÚω$aOv3+}™,×cñZZiSzRŒds\ù›±›Y6µ/Œ ÙÁ#%Yqùw,¦ÈàEÔ8Šuä‘sš,}Nó΃έ|?ªxGh¬§n¾ÃôL7!úxáܸŠËƲߙLÁ«!-ú®òXjçd­ ›¤6“{³®»Î꤀ §ú’ü²­åJ”,6·ª]ŽJ祡)WºwnÞ½}d¸)-&4¿ K²¨; öï”H"R² Í5í—“BvÝ°¯ÄVÔŒ+D/ðjJD¢90U7ônGBB·Â%«ª[ÀŠCÕS+o‹Šx3`–“n×j÷ø¢:hmÀ,G7ÐèæJÙWt§ªòÔ¡—y¼¹é¾±¹¼µtoýX.’}'ª«+3cC½×‰lj“'ñM»1àà5Q¿)%r—ôkѾ:@t=Þiûx|¯˜{»»îx’8(±®w“µÞä²IM£¡´yYÍ6ƒ¡Ï‡Â,|-³™2‡§W”SÛ<ƒ³Ÿ™œ#m5…Túâ÷˜j/l]ñ½“ÚüNaòýŽ)ªoSTo½h¤¨Œ“55wòvE…ÁãHëõm áv%^ÓÑ¥¯q˯B­¯’ø Ø³¯œDMykIX¸¯VÖ²ñe¿%”Nó y¾ ^ ­ ˜Ýô6üÆ®°¦î3õ´wiQ“ƪ6­'¢ «­ƒ}Šx®6SëÙÙü·ªÔ Ü ´æ7Mâ9Ì ûrJãY?šÏ™–òƒQ«Âìy ]u<6³m9º‘æ½³?ªºý™ÎI«íý´Ú`VCGe®-k ™t)Ë)"[P7h(!Îã‘ÿQ¨ììxž$¤.YH°Ÿ"f0µ°^7ØäÆ¡?éÁ¼Hzå‡E<úíf%ât@ü…²«žÉr«h–9ä*4¿i]²Z!‡¨0`¶7™/E$jh·fI´¨©xûF¯ø#¶Þ\’â>Õo3y<& YÅ L>oý[3¦6Ãvµ9ãG[{¶¥üÐTµéÄÔ¦eyUJ 3<ý#¢Ekü#…¬ôÇýŸTìœÙÑk¶d^G¦Î¢©UÊÁ­9ÛýEkzU3ï¡jC<•â)+Õ‰n qxâÁ™f‚¼Äþ{N¡VI¢?õ–Ilài&§prñà3aÒgÅ /¿AŠL?¦“ðçy:Í ˜íŽDûúÙÃóÿÎôÑ=ý$˜ª6§·­Lȱõ°K»9« æ•é«÷廤¹o°ÏCË‚I.ÇìùÂ5)Æöªž'ù;ÅÛúƒ-å\–çó ”z ý~MuMí“1U¯•}­sôjƒgŒòeJ¬åŸlåf;µræ… ¨Ú0„/d¸U§Šã17<¯ºêŽ™êêêG¯°Ô¾CÑ®ÞXJºüµôȲ.'ûÊ\îÂ>:wÉ óŠì™æÜ£=ægÔŒA{fµi£î³áPñ8Gj;øHêaF8+d·­3ðvuI!¦á×ëÙ®ûJ[úZ„±þÀsË®Šƒ[Û3¦i(tu[gû4ž f­ÊÑ¡ÚÔõ¦ùžSQ¶Ü¤rŽJý§GR†ö<9tÒúÙ6/qVÌ¿ U´€s­ÉAÕfÐ2†¼ÆòH`ŽYRr#}+)ÔšÖF&CôN©›v„½|ZÈp[Q×­\)|ª*bz¾‰;'§jÁ³šÆ«{YüÞQµV«U 4‰ÙÜ«o¤HÕKü¾ˆ²€}úµB£Ñ´—g2˜t«m£¯:{K…äþìå{^­²3aNÑU{ŽÅwoè‘Ohþ»×_ä«ÆâwÆ÷z‘¼’Ëj¼¹‚CàžïÄ,›ÛùQnž¡R…jBý1Á›¼2ñ–9»Á|XeÖ†!YõôµÆºi=êã²þää{¹–îÍã­m•¢W«m,;Èâ žô Âfz|!ïbÃàô¶Um4]%|­ìµ û†ÛV¸‘~½þW‹_6yùúG‹V&M˜,ËŸ.\¨Ã_ cBç·Æ­ýþÕ,wßÉü‚£Öuš†‹æ³î‚iÌæa”y}}IÖR7&Nãzúœ¾×†IEWÙ?º÷™£ûZjNy0‰T/õ\ýõ£ÞÜŸJÍ1š8êß½ :Q«%ö#‰D¶A$Ps›ð`6S÷³+« ‘¾i×É‘ K–9ƒZz,!ˆF!qÄ~Wž÷Z.辞½•A¡RXî™E÷u¸] |Èœ³;¦9†LF–I­)ªÃ¤¨âÉ÷b2hïÝ+dPHD’‡_dm‡O ‘!üaE¶S5ºágsПK­ù1Scy ŸF§sÅ>%;,‰Pë¥<ùŸ?̉½=b³‰þÅÛƒ%–6–¹‰äIÌŸÃ{®ET½ L:õQ—ÅQ#/‹žïµ\ÄÀ¬œéê.Íü©Ã3¹`§)ÞdK,9ä!ÓnkšÙÕä0ôé{i¯ˆ¼58ÃÊ~ 3¯zp<þŒ“\SŽmÌ]íÞ(ÇSÙLD-ç¥_} ¾{jïèÑ™þ̬$ú±Ñ©—p7Mo].ñÖ!X*ÀÉÄÇG¾g‡-ÝÀ3N:^à{æÿ÷àÞ endstream endobj 994 0 obj << /Length 1460 /Filter /FlateDecode >> stream xÚ­WYÛ6~÷¯ò$1ÍS¢6@MÒ葸èC²D¯…Ø¢#Éq¶¿¾3ɧ’n‹Â€E ‡Ã9¿ñè>âÑËÉw‹Éü…J¢Œe‰L¢Å*RiÂŒ6Qª-Ó™Šeô&~½oª"ïòéL¦6þ£u ­^î«ÒMg‚ÇO‰ðÊm\Þ:zQL21}·øiò|1ù8p#D”J®YÊÓ¨ØNÞ¼ãQ ôŸ"ÎTf£CàÚF:±ðÜD¯'¿Ox¯-g”äL& ¹5°qC|u²K–#Ñ0¼VpÆUJ6­»n÷¾q÷®íÞoªÚM‡«àtvæͤá†Î.Ö{þ"‘gL"e™•ÀûeùWb×LˆáÄÊ7…kÁw†ÇÝÚÑâ°ö›~ùÃbñ­z±ôdÓ!OÏeÿ^ÕíÎ+ÞÍ„”Œg ©êcûüs¾ÝmÜ]o>þЫáž¼]bY"T”ËLª¿¾"œšc/dX!£D&Á[_‘Ü*èK"D„?РÛ-å욌qpíÙ5HשbYjÁ‹V£’wõ yA·ÂD÷i•èŒ%˜dèÎ|ãLÂyÈZåõÃÕböÍ—vÞrÃorçí¾î\ÝÝ=yù|A”9=05æ‚ñ'=c[•w∢ú3ð«6Z1aíˆÒm²€nÕ¿I–ÿ«ÞxåRœÕãÚåå^y]Ò‚¼O…‰Çã±àÏ©†JëÖÓ™â*Ôí-2¨”¥:¹@†Ó=WâÁmizäí#N·¾¬Þr.ᜫD WÓfÕâSÇ;߶Õ1#è㉺ͻ¢W1!ˆ)òÍæhÁÈçëäë“Ea‹àIƒ‘ºœJïWSiâÐŒ‰°áÐH$‚ Æ$€Õ”YSƒn"ãDœTtÂ…ýŠ„„°p Ï]“x•D%]úÃUMgszm«ú>€'®ôü'z±…ÛuÄ(<\ìÛþpU—Øÿ†;‡kŽª•¾Øo!LyWùã^Þõ5!%0o(=ɵÇ} ¾Á’Z~¥’–DêÈqH¹4„D„T†ÍuŽ»ŸÐ$7tUC›Ïj¢ wÎ+l"9vÏFRYfÖâ"— ï?Tcý-1,5zàE8b˜5ih dêÕÍ”aÜ«¸ìyö-8>䔂Ɠ séHŒ†’,Ú.«ºT•²O*$í à„O•ß·!цƒ3\3TîÕk1]´…nûa óÎX•K @ö÷æ–Rë§ÈŒYk®§#‚L0nSµ]^cîÕ)³RÁò€àìrÊùÅw£,ÅQã»é̈~öR:;áÎTWe‡4(I2Pœ‰Ì çh{òU³Í7Õ_®‹ŸfV‰“q³nÿ¶Æê} í*èÿ÷tßa]u®Ýå…£wBmüò%-ŠuŽøÏ#ö„Æm=Ê%h(û»^»aîcR`SÕ˜¾LAz†N{M„N n5PÕÙUîæó $kËüÎÕU½ø,V~_—¡&રñý|Wí8¥ÚÌ}Õ®fPÝM;—0¬Í~-:¿tÍœsžAà×Ývspr’â"^L-Çö!%€Aüù aPê¾øE¥¿oGÑw¼O Í’Ä\Nðùá˽°Pœð­ŒÞ—¾9ÞJ°ŽŒ Þ4ª‡n‡!¥ÇqN SüÅÖÍWÀÝé È„¡ÊJXÀ¤lÊ´Ìpúšÿ¸…¹â{Kç– +ŒÌ:K¾¢Üñ£d·ovÔiwÄ“Ü©9ò\´‰»‹˜_: “ߣ¿o¿oA„†¨‰~\‡€c-H9øæÁŸ©}R1­ü/C±GÚ$,“ǯ<“]kû7ÚÉœ endstream endobj 990 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 110 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14660 /Filter /FlateDecode >> stream xÚí]|Å÷¿$-„z—Þ %t½+Õ?é HQŠ  ¨(M *M‘¡„šNH#½—»ïßÛÙÜ]rºþÁù~"ÎÎÍÎÎÌÎ|÷Í›yo ‰§…Á`0†esHHüçÙ 9êÞ¥ó§Oœ8qòô¹;Á‘êü{úå'<=O˜Áã˜OXzRÐ…ãâÚÓ3+ÅqÏàd}¶G|2¼a3·þiz²É|àyôătÓT™·N{xÝO2Äøõ0ÉWËØ'$&ôÆ)“xO­,§bôúKÇOËèéyåf ÞHt¤Fxœ¼¨×*~ÇËÓóBšÁJ{(ÿ¥<ðô8áŸ)»‡„Ä3£þ÷øæYš¶rëÜeà=ºtjÛ²Y÷©ß¦Ôßãƺ¶lקÿPw#† ðå©ÄÐ?æ òºr9¸ß6­[÷Lá!CÞØ?Ýü!Qoµ©ÿêkLÉIÇÚÖqõˆ3M–òaçÆoì ÀŸö¬d5Ô}`»V-»ö¢>sí_7Ž}>^-@ßn[µëäÎeê?ð­›é)o6wí4`øØ1 F»÷ïÑ¡­ë€w·¨Pþ®íà>ƒ©Dxýô¦­Ú¶i38*ÃbsÒ#. ëܬu˶_ÞL–=DBâ"àû) ëwÚ{'^ûî]tkØhÚ®›|Il3ço.9Äùz(ls'ÖâìÉ€è?ÚÔo0bÍ 3Q"¶1"ÚݵÖúK9I—7¾ï:dŠIDŒÂ6óe]ëãÎ÷iTw…g’*Ìü¸xø¨Ï)…¹¾rØÀw¿»yf«e¶!$öiÝÃÓßwT㦒m$$ž¥l“™ìÞ­ýŒÍÇL”*ôÿŒÄD4˜mÞÉ%“˜;G¶¹­·(<ÅîŸ_¿AÓU>æó–Gb› Û|y1-g®^ææd›yGŒs!`áëMþ·â¢óN×&?Þ£_â‚BR ºð½uÙ&=.U©H”d ‰g‹Œäžmÿv1NhS}®qÜÛŒßøÇõ+Þ—5\ºz7óÑØF¹ÿÀ‚Ñ šô¹ží‡¤cíê·ØrüÊ —/ŸšÜ±éÓ³V‰Äñj½ûK(ãÿjÑêí“ÔVÙÆdö'ÙFBâÙ"=Þ§‹k£ƒ·Ó„d{¨{«V­ú,JÖfRm;tt3k·© (Û(2Æè~MzÏ@¶éÔ¬E·NYyvêäÖ®u˧a›9oëÓRÄEú4ªk£NoG1áÝY?ºï‡Û ÙFBâ_EfJX¯vM¶Ÿ~ &R™‰ÁAÁ÷îßüûƒ&íf'õ6~° ö<Œm(Iæè~mzÍø0_ÿæ™Ô‰3æ[ôt3©Ö»õîEèÝoмµ;“2è‘ýÜÁ×ì½kúxÉ6ÿôiãz¹X±';ø¬iÒÖ„mžHoCê^mÓäO÷ä”mž¹Þf¡gX6>¤©Ì˜>­[œ|`V=É6ÿ ©ÚxŒ‹ðûzZæý–§jl3÷p€Œáá3)}Àæ6. WîþØ&KKlŠÔ€šu]’-‹ÐË?µi3$.‹ é÷‚Ò &[ü›]¾òÍ0á- ‰§‚ª¾{pkËÖ-[ºöèÕ»]×Ö­[w6?6Ý¥%n¥MRzv7wë£èmü7»»4lø{r²M›ÚÀ6-™mšYf›³ ºŒüñŠVYýÊéc üjŸ®Jûôj¿aÇb”9œ_Ïfu~¸LŠäŒ ¯÷0dÐk­Z¶rë;`ð ³Öý.û‰„ij"e)ñ÷ƒýýýƒ#cŒS!dÞ÷Ï ¿à(£ò'-Q‰JÍ´ $†øú¤èsØ,èýïú'™íÕÕGø†Ä™î ̼çw7:ÅB¶)Ñáþ÷BMS†øù‡'¦ç¬\d LŠQD ô3­†¯šŒ¦.hÛ ®‹z¯¹¡qcôp‡W¤¸õîϨUC·ãú¸6DŸñŸx ]Ѳ;îIª‘x±Ø¦˜Yd©,Ù&+ЬÊÅ ]›R @CÄ°à²Ñ.ÛôÂÈ¡pT¦0$á-7ž—9`Ð@x%Â׃.K¾“ý¡½l(>P¡›p1k2âCNY­Ú:,ò8z[$èñ%8¸:Ô/J1û“`È@­â.Ñ„óF>%«fÏ ÞÁ9B¿~(”ºRb¯I1ù+£_N“ª…ÅÚ±ti_‘âm”x;üHñ™WŸ Óµ/ŠæG­ tKv¶þ\NiêtÅÔ±T²]af¡bÑÀ‘Òté‡j˜˜~Ùù!Ãý_C!; }•âý7q3ö…s-@ájãPÄUJrú²H6‰‡mltbP‹?f›üò]–)¯hG—+<(\‡SòX‹ôÂ'kq?N‘ øöJ¢ó‡\‚KôZ—ý¡&P²¿ýqgåùÍâøÃáø¨'l ,ÇgCçˆ÷@W› Ð ¶¸¸’’½µ é±(ªÃàÖ4ê£Á`=ÅO8`6ö:ÚRäjr†ŒK°Ó‰gé£QX WÉnsžå\`ˆ§<•*¨ð]Ç#½Ibó;Q¸Ù|U?–âr²M%ò:Bµ·øe.t¶8mn.ºñMʧþBµPÚÕkS‘+èˆöU™-r·d(ÙlæpÄŇxGÇïS²²öŠYâÅ‘mt(âGGú+Ê_[…mR1¾…?ÕÜ„žû¿ÚSøË>¢Ûçs„EH2ˆ¯¿Ê6éÈMårï }ôWÆ·3a_<²§Á½ (´ÃcüP KÅÚÁŸ‡›?ÐήHAÚŽEÄ_Ì“þ]zË[QàŠ)ÙÄ3½èp>…gO™¨¨É6v²lö¶V¼x’[òWBÔïïú¦Ÿ@¬’¯ É']ÐO_Ýy)g‰m®ˆf±±¡?5<ç¤Yõ‡1ibœ–*úãY¹¥öÜ4"=;& ¶±ëÈécD"x":Å›SA²#K¼Hz›œ3©ÀT¼Õ™:óçZg¾ð]V_Ê#"çaìk°WÅ¡ü8 ½ ÛXUi*#)övè²oW‚³«BR(­ÃÄÕ$bÍ‚Ã9ÊçÃhSnDS¤Ÿ˜j³hÑ¥*tÄֶФ˶:”‰Fe¡knþ0mÅírºêë•ÛDüHñ&ij•$TX¥"¦øÖc´ødRfU¥‘j€[}úéÛHM3\ÉÛ\âùfQxœÂéÓâ﮹¥ÕfÅMaf<œy˜"«¶Òž›âÌ6þÛ8ô5RW £øÆÉ¥$ÛH¼ZâDlÇÂÌ|ñË×éòƒC$]xü…ß½DüÑÏ9þOàªÐ$¨ÈHE@îç´jÌDÃüÈïB$óÚNžïTC­Jtï‡jžéT†Â퉜‚>% ŠÁ¾™g s^…3jéð ÏG¾ »‚(œ½øòÞYìß%¥uylnöælýXñÂl“Lá¼.¢D¡[)Y©FÈ Eò4ñáÛ)¾X-jŸ ÌÝ7ˆ*”µ8“J#–ÈSêbxè ìù)HðǾ?pŒ‹±t‹U_pŠT´oˆÖ­‘@7Ú•ÏM<.ÔM É6ÿ¶‰'-nIÖ{Œz3˜j ”Ax*‘ÊÜçç­ÆÖ-èZ•ÂoAB–˜8§ÃáËJ†ïXxîŽ"å¾ü°'_Ú7ù¬n$øs‘^/Ë—NP7Ðy¯¿~s§x?ŠË•èr}] /ü…§fñO¥ðÁ‡pR†³­QK<Ô•u5nøäØs5׳Ӱ7y¦Sº=>YÖÖ®ãã'BY´ÓÙbú4*É gKz›ÿ£de»`ýjI]aÜO‚×BfŒn\úëÈÃ¥}g1:T¦@ûeÌBopšÆX¹ eY<ï,ÅK¶‘xiئS¶)Ίbu¿Mf¦÷K3ƒg#CÛ·—‡·{óz·Õ\q"DÄZB1¶p0~ü.÷®¥çžæ‘[KÓäl`P1 G¾¿°²¢‹Hpå]Ϊ­6 áÛíàËçÊ$^ls†Çû׬`ùp‡˜ªlšFå,P™–Ñ«„®´±{V¡x>ž ¹ášÉ™}Ö¢d~Š¯ÑÞÚCóÛib¥Lß¾õƤêÄ0ÁÌ6ÿ+M,”µ»ÏãK8s¶.ý¡ºýñâõ¦B=E‚¤ûx×øœñÅAcyÚ¬P˜âË»À#Pì· à5©¼=…vÚÖ„m&–l#ñ‚à , V[ «ÛÌ «—KZÛ¶—õS.…Ìö¬»Çðù'¸*¦-Ž §u°œÛÝy Öb³‡ˆl¬jĤeßLøÐ]ˆ·»VÛêá›%$$þAø²B&_LœŒÆ¼Qç£ÝOÈÌ)çÅVQе:N§-ˆr¤KHH¨_ÿ#èÙ 5k¢Uwüåÿä’€rWRFöBíÚhÔ _ì·,HHHÈÉ¢µ ÔcqW.S ‰—LVy¹ýë¤aЋ"Lâeýö«ƒîâ|µkÖ`Óˆù4GPŠ‘#6Ÿƒˆ˜c¨S^üjWØÖ)#‰lºm;ã×éâ§buñ@°-+£IÏ\e=±M¨ç=Š_2…51¯Íh1®ƒö¡J-óòØq]”¿– tñÕÚO5àk‰YÆ´ÐlÊth=\äiÊ6íȘ=XÝš";/7þ6›[ì= ÏŒ‚¶"“öãÿ¨œ$$ ÷Y’©=Ù”vìîWöŸ‡÷aÔàíµìki þ©2¾Û…yìëFמâ}I&±q@›QØ»Õìé§;ií˜fj5áŸD6àùìPr¥Oäͱ±ã,Îíå| õí›ÆÖÓ[Mž%óï‰p´¡]ÄŸü†;Wѯ&%´™)p¶‡=jõÆÞÝpáM¶ÝW‰šÝt«l“ô¯BâܶÒ:9Ÿîm4ŠlKeÇAì]§RؔĹ0$£ºò×™¸bcÕ¸zo³‡çÞÙ}¥ýÚ¤ÁˆOˆ–”fÙíì²MW'ª;yœ¸)¶«ÕŒÍØSá1“íÓÇ#øi2…Gì”d#ñ €7¿uœkù×÷Ù~p”æ0Áã3ºìý‘m¾ãá™vY¢ [•m6P ž.ñ ºW¿åá?Þqñ<šñÆ~E¸Í–Ý­?´pó"<=‰mNóÿˆOÅM3a›Pö2Q/ËöÊGˆOH%¶!W í¿” ܳOÄ 9Ù¦ ±©ûŒŸDd×:t¹øΟ‡Ï²ì(S)ljQ«•_‰ƒà¤^c[ˆ£;™TœO©ô—κC*‚àç‡5,µÿÞ:Û½ËQÁè<Òt2$)V"[Wa•Ú1*ÀõódCQ¥™œLI¼0ˆ8Ê&„£,+Æt _·h]¼˜*Ï7²Ç] gF § Yl£}÷ýWÓOîKqâs‡]ü·/ g˜FoÌ>'°Æ6×8Ã!kéÈdÛ¡_ÛTÑÑ슧ɇT@IcaÚO‘M«f/g¾ÒÝf¡üûklSZkº4b§ßS|;=ÎÀÏÛ.ØfÙ®ìl£NîÍÒî¿Åž"ši²ME lc@®Zb{üumy oaóÆεÙù i')²ÁP ÍHl“Ÿe9%ÿûì}Ô 1Aø}öìÁž½$òufykÁ†ÑìZ'¶1 Sõ“ÓýØD‹ ïÊã?É5r‰”n XÁ^yí‹âóoIãññDñݼÛß ïXWt®¬G=æÿØlóúHôã4åqéB®£^Ôy•ô‰ê,¬(<}qç»ßÔ!8ÇFÓC– 2qF¶ICö!ìÐ@ŒgǃV ½E¶Qê8yÆϱª·‰5 ù«Á«‘¾e·@Õ×… [Q®†,§LÊç%·¥߃ôiŽíÄlQÕÛôZ…˜X¬ãY’sçìz·ŠLw€:,PÕ]ˆLƒUÙF{QÚ??ʼ*jñ+»­ãŽ°hœÝŒr¥1jµ”m$^¾á¾ú±; :hò¹- •Á‘h‘àçé(˜O[ÊQÛDüâW˜yT¶‰ÞiT¶¡pmmx1x…ÿš…|ö"+‡ÂØqE¤ñ\h_›OSdäárÜ®¡’)¯|UÒ4Û;PX+’­=šòšQf2JØ› ¶ažl4HŒÓÂJá«Z¨þkň$Õý6ó™uDZÿ‡q­‘WóóéXqœøÚ&ØkåÌk™ÛLd›r˜Ð@[&+‰;9ôó râ¡&Øú+ÍþÈ9á³OÔÂýY¦r$]MÛx|)ÒÏýÑø¦F4Gž¬‚5 ©IBâoÔnœšŒØDG#6išN•JN¤øè$¦»}JEf¨úO=…£b„ï_ ljìõ)t™¨ ÿ)‰ˆá¬’SÍ‘’$â“Lâøq|ÀŠòkT¬ñéé)ˆáÒÆ'B¯¹öUʯ¦¡ç¦ÑbV\¢¨cLbâ,Ô>1–ªæ™‘ÊÕŒãZèÅÓqEèx9MZ2—S«‘IlSœq\¤ä´ì³6ugŽšaߘ’@á” èS©œ1\΄.Œ&uffpy¢‘–)¤PƒÁjÁ$$$þ Èb ‰çŠÚ64“x¾3Q³9§‘øó…ÎåJBBBâYâìwb]uÉžâ±õ{D¦Êæ—øá½zâðj£s“r²ÜDXæ\ș҇Oh:eé^ ‰—rÅzíë 5ûºñ3=ë$ ï §m«UëaÛIIñé˜;’â«ÔÅ7Çtqñ4¬‚%ñæG"ûÓsP¨mÁ¾•¨RµÚÂS.ˆ‚¼9¹˜3z­¦˜SðÇ>>3E¾ ‰—”l~}‡FýÛ'áý>lÛɉj|hã 1pa"¥JG¡Å€ÑhÎ{ò‡óÆگؖ°ý¬xŸœp–ו˜áó ìªši½)~Ÿyü) >]Åõ÷(PsœH¹u]vÚÉ“©¾Ä6žä;øOàçW-°Dgö‡ð?v3µ.Ð( !¤ůö5gSί 0ÁÁô„˜Tx³lSg’`›ms9É6ÿ1•!¯ðyµÛNáÄ ú;ý ÛVG’2ú;Êû§ A%Ô®Nç¡lžÂŽìØ­ÒШ2jVEr2ͤò–y_;†Íß# -YÜg§¸göÁåþ6Ú°ûʼ¨ô;`)Ý ß%§ ¶•¨²]Qt…ƒ)lS l¿¼†ýJ9·ÃlV>Wf±êH˜|-/!þ0ç;³ÈߣP! ÛAa}"Ævƒc!”ª†Mbê¤üé“1®'ÇWÁW&‡Oyn@•(à€ž“„G)•mêO–ép*ˆWÚ ¥’>3-Ê£PA¼þÅ4Ó¡€=<#åk‘xé&R–Q2<ÂÉJµ»Oe›ÚrMùÿìœ\ ‰Yl#9DBBâ¹ÂoÚuÀÿÖI¶‘x!ñ¬L59O–O® ¨Ç.ÃóÑ&YÓ’žuæOÖìÏ#ÿçÑUžWzÒæ2<Ã^! ÅÎãjùpêâ|vÃSv?5yM<óÉ^p‡ÖüüÌSÕk [„…>7·Óùá‹|DàÔÂ>ôT5H=—ÇåÉ3y§¢8gÇ"¢<9ÿºÏ†ˆJó)«ÏùçŒ\»ÙSrxGvž¼ÆF…éÏ Y6ð9b_~6dxi?fLÁ´9¸–ÁÔaW°x&OÅÚŸÍwäyÃk*ª2‡÷a×_O(Œ¸E›q"æÄ~ì:ðäôþ÷jê4Ÿ¢õÞ(Mn‡ÃÓžW»Íæ#È/óɾ7`×nĦéiZ>©¢Ê_ºy9ÕÏ2Ð-Ù±º#lò $Uü¤×–ïSµlÓµº¤kõ¥Ñ–nÌÇÛ¨ùgf˜Õ‹*Å1i" d®×^[ºúP“rr°MFV9ÕÑ‹FVÛ_4ƒÖòJæ¢À™øbñêY>sÇ ¶vÖá§&ïW<Ô`ö,ã+æé˜ g3qeµ?D¶JÕ¢MØF}Aj1ôz<¸H¶ÿS×#3ž’ÆÅ}&UœÅcÚÔÙfu]Ê?Ë6Woþ:ÔÛ3ôf¯>«Yùgõd lÃGšæÓ¡åHº1[oÌþ*5AEôŠLrŒà CÍÞâmÆâc™±M†IWTJòÝlz;ÇÃøíèµ¢¶gš8¸'«‰r²’23Óx’i×RïÊz;Ùþè)é(›º*œæ>í¹uîk>CKE>¡ìkoºêV„Â+Ï=®1`e8h‡²vÂqé¿iL—#GPç!C†|x÷;Qñ2¶Ð5Àûí´3²ËÀ7‡lS-¯8ôDiŸ]p,,ç/„¹Û9u–‘6öpc#ˆ°ó&¶Z6Hš ãtµãLë…yµó¯‹`éÑbm”4•qh–v®\1x§EÜ<%”æĦ±ôS‹eé±Úx`\o¥`%±gŠ¸·J+„ÿ&ªìPáÖÙ¸¸NZ½ò9`îQŠ¿<.+ŽD…"¢uûˆò/I¬òÑ@íGüî—mæðæü=Aa¨\F;¤/?šŒ»%_¯Ž¼Z+UmI‘oT3¶›Ë'ˆùÃEQ-C±BÚC ¡Û"¿ŠO;ݸÜøŠW³8@#ñÝmd“Ò–úƒ ö'ðáÂËþDì~kÝ1¶­ÖmjÒ§·‹‘§ ÉHζ°ïˆ¯i'­¿‹Ók·¸Xe›Ïš±MÒ-ÝÕ¯ Ê+ݯB¹MëÛö>~-òl< w7‘¤¡„ ÖBª¶‰¿ef¨¼Ùàƒp*¢ÑX‹±ž'%u°+'š½‘=uó{}Sð÷'|ær´Æ6…±ÿ}­+:âx ÞndL_!b÷S Ì,ôª)‹œ|“ºˆ•†[`›nN(é„Ãê÷(5JˆÄ•;Á)Ÿh÷¿·`íX’.ÓÙµ§‹N[»Õ"Ú¤5ÒÃa«°MÑàa›Ù“Ìœç"ƧF¡‚3Ê´FD.ÿDk6•ânÅäPçoãôï(hK'ØF3…VÌÏFÜsàï‡éíÄY±¦² é[Ð ¦ª8н¿{!à*8o]«ÝP¤¦mAJ êól÷·(bø[Ÿ±Íæx:ŠNAK¥8Ñë>Ì„P½;nÂûo”ÉK“}uÓq§¢4¨»âø)Œáþ_l„q)¬½¾A|ˆ¶×]¼bûbâøË|HnÕA8íº<$óߧ0Ì•Í1væ6“ê[¥*âlâ®Ò±žöEÉÂëÆA2Ûã®pÕŽ†°~†™Ä¹'n`ûqN±ÁœmÞ¯Ê6#÷Xy‡oÎÿ¡÷ð÷½-^8¿EÑp,’Ò±€Gñ”³ôÙߎz4‰©¸¿“Ù  er¿¼:g»†€«èPŒ.¿?O?­çAm[œÀ–ù|žr}£\½••])þÔ‹´ÆÅßùåN5™Iå!‡i'¡WýM¯ïÔv”´ñqôU-ÏGšvž‰c»øle[Tu![¼:Å)þÝ‹fl“Šï·aûN ç3Ù7þ„¾Çþ³ÔD;¦ñëX†‰Ü&+=ćF=Ùåð<È_p”¨Šc'ÑžéwÔ1 l£Mè÷5%hîNg*hR˜ /†AŸ€NÕ`SR0Õ î ¦a);=˜ø‹ò¹Eð6Ñ£¢¨g®P>d…©±2i‡c§0³³î«ô­™Ù…ÊvЗÎ g¶ÑåÇßaëBçÅ€™8þ›˜é¨FʦlSãw±6oI} ¿:!!ø|$ß^NLŸ÷íž}&{qö6"Øìqø"ñéw©J——Lûq¼øxâùû¾n3ê9Í£èvã<<ð÷5Ž¯1Û°íäœoE!]ù»¶.Hc>„—îö¾k¬±M*kO óÇåËçwù g=qü8ñ| oáL­=§‹f±MmGŠß*„ÉÉ=érª—Æ6:–¯ ˆÛËŸ§ÚÔ»¢xÔ¼~DT!ÁO2NCã²ÈgË·¹«,åvÎï÷Üz —šô™”ßMœ8ŽsgPCù:":U°M‰6⃸E!{4¶±Á ‘Hò)‡­± ­n›á<‡JM€÷øóÄ?=—ÏÐûZÁ6³×sæ(s¯$ ‡ì0²ÍZöo6ìˆ(ö-î{­—Ùf Ë3Êì©°½x­»_§øÓ1â–CÓBlBU\°#Ô&ñd¹qÖ û,§ð;Å ˆØ&/wš³=ÝÇìr ‚Üã 3¶‰ßcáëìÜOtÒÑuDLÛÆ·@lc'>:C¸ÇÎ`¥ÄžÉn¸È²lí˜øVoò…7¿ëZØ»›”fãºÑånM´ú µxnÝ‘"&q›$÷}`L}¬LGº ¶±Á¥TªcÒI¾±,=zA/Š?Í̶_Puº‘ùeV¸M`ÞyÕœmL(É(¢2Ÿèš‘'[Á6Öò OR–ŠN«ú¯;ežf}w~¿ÅÐÇ>"ŠpØbÄó‘m"Q˜í. •Â+ÜLÙæÓƒb¶5€OýžqYc›*Úý‰4t¨b•mÂùCÐvtöżuÿRùm)¼Ø:Û(ï¥$ÏYNjæá‹ÝVÛá‘2ûàWl_ƒ^ñ^vmqØäݵìÈ«Xwc ±MÄrøÓ·x‹g7×ù9OÈM¶éÁr‘­#jÖ¤dÊ6U53ý‘§áD9}˜ü;­0g˜±C–·ë;ƒ»}…òD•>ñùxlSî±Ù&›ÞF-FÝVØ&BX Ú^ó ²Ÿåê)H¾ÆjÏúÔæ¹°Í­U|ûx“ë¤'c›OXÆŽ1éê3Ý(fùyìá±0dÅÊ6C› B]â±x&äÊ­àǯ»¹uѯŽ ,ý›¡|}¨Þ¾ä7;õNóGÄ•ûCÊÜ7êâÎ]ø®a™ÿ¢(ƒ5¶YÈ:œ™¿Â/‘[¶Q^n.¸ÀešÇºýÓˆ{õ6¹ì·iäDxÙ·X9‘´sn³(^™/Wª€e¿rÓ±†|Ðlû‚¦*$ü葆Z¯ t«g©¶I‹@Õ¢‚ ;¾‡~Ü‹º`g ì/,òIJÝb¡Ø¦:Þi#î*ZWLœ/òg´.ë:ªØK¨• ø¥ŠikIűø7Š_Þ]¬ä+ÿËB‰±2¼—·ª3åCÚ4?iƒÕ5¹ƒY·À)‹—Á¶+‚—Û Æls‚ðD¯ŠÕÛŠšNâÒ.díX¸ª8e²êçHCLe›L¼ŸñÛ5±ŠòÁ½}˜Â˜m†§ô·X`êSQ¦\oüºZ„wÍç®ØÕe ;´+äu&5§¯Ö¥pŒ'3Ù½ü%Ï.o\“J E*š_í¦Pu=¿‚C±–±qʱ†¶ßZ!R–}q¬ÑÕuu?½¥í?ñGÿymŠùñ,³M‚˜Ïæõ¬ox*=„ß‹ n° û;뵆|Œø³œ›&×]bÍðô B«\ŒóÑU¢õ#gRP«Ý =7×~f›ßÙÍQ§5,ÚÑ»Èek®/3CÝaâ²µ3]kRºÂ"~$¯küÈ$uŒïךGá¼H¡²M+î*Q¬¨’G´É½$Ü?‚²%k…“7ÑÓ#ð«l)òÎR嶤笩­¾Õœþ½ y0;†Šä%ÑŒ+¢›)5>´NôvçIHR»_+¡ˆ°çø ®ìû¬ÿ™W¢7ñ§ÿ«£b²F+ƒ÷xÏF$jjkRõ¢d‡° MO¢ŒÖJ×/Yà[ºœÌR(⌠ÄEœ±•‡IRÇ”ú'¶ê©²Íò½ÙE.Á6esÛ!™m;úC™²êã"×mçY[t,¦1+ƒyþ†‡mòÌ-œ@Ýã~ŠÕÍOêLªÜ ™«lsãÁ£=׊S,µÏcî\5<ÂÞøìf°œÆðæ!ë'±>Ôr!—bäòŠ-r…ˆM¿0äÚP9úÒCªiÈ‘æ^“ÁJÍÖ'£¨Ñ0×á™émr)r·‡ô4í2ó2tÕþ%¶U¶ùïÀóKËSõVXdÀ*ÛHü“Ø>N./^±ý~¢]a9Mg‰mžSª¡Çª¢‚ß³ ÷áoÙãõ™D³ºBÿÑîzç®ç–à/yh᧠;/Þ©¬>Çq+ÎB¼Â6Ïm0êÓàqñ©Ï½¹ÅU¤ûX³iÕ+ñu¶ÿF§úãþ_Ê‘=Ý#Ä‹ûD‰—œ Ou¯ªòÚÇë¿qÖEYöZyLnO«ÍK9ϱ_sÖÑçðZg4k…¶XE”¿LrG‹æèпœµf(ïy LüÞÚàüÙ7à=s¼ê‚ùÛ—õt°¯Õþl’+º/x6/‚6øcT?4wÅ„Å´x—­‘ӣЦ%Z´0þõüDŽÚy2˛ĢžèÞ[¼›+ëHÚüïˆx½UîºÊ»Ýª¿•™\¿ˆ³^Ï÷+êT,O;ó:µë43m¿ˆñK“í»¢4§™u0G&Þ8{iúü…ñ/›îÏ+û;{œ†F:LÞ‰C;š)ö°U—vï\z€qN¨¿gvÁ?áieøÌûÂœ¤<¯À–ïi¾ìb@ò=䵡Ý Ï4kF’m^\ÜöBób´Vrâ&m< dÀï¼½ás[ ¥?2nº§©7ïÜÀ¥‹OÆËè\‰ÆìÑ›âOüˆê´áMoÀ+ð¾E½åŽ.{#,NȦl£üe¦â¶=ëú->´NÝ£~—®‰.wû ®ð®{¿›T†àHÁi)ˆ‹Cr†¸Ô§áÆU\¾Š¨dDùS†‰i´/Âˋ¦^¼ÿü-Þ±p¶ƒ­ØphJpØ8¨ [FD¨Û±*dßý|—¯ ›(ð¼¯Ò§Ùÿ&EFpk„úãÒeø‡墘P\õ¦ñ¿/"Õø¨{T¶wÉ#RM/m“|z÷‘ƒkJCù E«B¨Òª—‘¢GD Ý~+@s­1½ŽŒ¸t áfõrËg²5?.Eâï>šyê›mUýôÚÂÏ­­µß]~ã!QH¹O¡7J û‹¸F‰WñbÄ2ö5šÍå>÷6{±¾ÈcƒrïüçÕ/ê™tž‰¼KÉ­²1¦X{ŠI»ÏSv¯”Nva¶ )ÜÌäÞQÇ)¦ºUÛq ?lká­êZ[œMÏ!Û¤£®­1‡ÚÞÔæ…iO”Ú¡ZBÞ:Ø:Èè†BµTýt8]vû]ÜÒËIKà„±®”ìœ2<ý,ìåÖU¦Î¬n&ŒægüÆv‹[Ízü›ôz³5e䟖]á-˦3E- ÛBØ8D<Å¡8n£=ÑžäçÌ÷–Ü&ò¹¹ÏY·%x tÔu³ô®ŠíçÁû¾N#˜=<8 Dy-YYÚ©àÞqúùTãí‹ÿ›ÝP‹´Ã26"¶Ê|v£Ç>¬Ù¡oø6ó¾ÇKüÓ –fmíq'†~:÷ ½Üš‹»§ÕÐ2χylë÷ÁÚý¦l³c&J—ƒûäth{®˜émZòžêzSà„ÙÜ{K¾NñKxG®ëÏ>È‹Î\é3tDmÇMÇë¸qÃüÏà4… Šr¼ wé!óOg"ÞhLÍÒ¢5*•@ÞðzÛŒãýÀõ¦!4}ËŠ-ë×Cð1Úd-¥R¯ÔÂÕ0 »¬yÀ"Aw*ð†£HˆÇ fQ]Š­( dÞZ¿–ãÏ°„s|›ñ"Xsi²ÏqQpç2¬?Á2[Lèß{ø{3ode+‰èÛ.›Qˆðe+Þø̬^wÙðaó14U¨¬Î7èÊÐëËdsé+1Ä‘ÞQ4pŠ¯äBº1@µ’¨¿„_fM‹~%ÔÛ7r¼ˆ;ÔÈê[a:ƬÞgª™ö,ä"m¶w,KÆ>´µÀ›ÎÈQû¢B™ƒ”-JfªïšZ¼-Ü}.,À’$To-RŽi"úö¸£²nYbU¿³Œ{×-mTËMö“F{æË›eÓÛøÅúUøøc `C=wXb›<œ¿ñl W¸av7ÅSØûÄ;Þâr\Im¬*›Ä·U5,=ÁŸÔþ4cEœÉÄÛ¾ ÊA¥fØ~íalc ož0n}›3¼Í^Šh›ýöÿ‚•Ÿ`õ*TbïUÁÊ„+Œ½ äG{–;£±M´°õ~w>½‹ñîlyñ733s`ŠÆ6 D[]bÙ©ý#Ûl=ËÆÈQ°·#aC{®ó-í4;£oÙÌmøšì“”íɛĭóB#çV¥µnpü7Ê'í|b³7Èö+Õ÷'q¹¶¾Æ6Ö«ù³â«Äì=QÜ åã“/°à-aÒ"n~Ø&Y¡Q±j×mû‹”'W ±Á+Â2Û,ïd4f'¶© }Ÿ’Q½£(òOÛ(øŽåsÇŠpëŠê솨×NKlÃV™$J±j·pƒìú“‘l²·>D\.j ±M8ÚµBçÎfíÇh‚½0ÿëžtœ0Ës1îÏT?à!bP<ÈmìÈ9þij°ellÀ¿…ß °jM\­1zõäCÒóážÂ6wØ Íq¬Z¿ª±6 ¬aò.¦ñÌ®½F•*ÛÔvú°oŸ‹ŒlóÇ5ö&ƒ|y¨x K\\ËÂÌq‹çÙÙÆ"ÊéÐÚýá}éW^n˜®©Ó÷õÖØ& =ݲ¿ˆv\lÕ¢Ymæ(¶‡4ײ~ÆÀn:p~î+î Ï6ÊÛtåYÀ†ûæJ9sIøw,$œíë5ó S¶é\‹µ"Yl“GXkªýE+šÉ6 š2³±ýÞïšÛ¨ÂLŠ¶™Å³ª¡G5Ž½Æ6õ6Ì.dáæS6¶=æk¦œÇßåSqÆ5 åòzÂCØ&À„m>bO_þÛD23®# _.‹m¢I/a—a)¬“9¢±M*Í Tf`/[ŽCYM­Ê6¯ˆ7µÙfyî¯ð Em'TdÂ6J¯_? bÇu'Sß4e›fX{y ×ö¡0¯ƒÔšDü£°Í·ï¢Z5Œå™ÅeeyJâÀY¬o¢·±Ž?Yžqy sßbõBq!ç,wAñb8t_³ê¸|G>‰åì"OW)Š¸tEP¤íc³MÚAv…áÿH,èGÓ.…Oò ËíÐiÎ{¢­³Qo³š|¿ÛÖ«ž¾‡h`^?dÂ6Ê4ðGÜ>‰ lÔ¼ûznl“(ÚgéÏØ¿IÜ®°M;ŒÍ[ÓÙ\it2–W f-ô`Š‹8/f:ÿ®5"óÜfRJ{²¹z…X4GPz°RÈ8—@Þ&¬BçésÁr˜±ÃYxÖÕ—{ _\ºÁÚa¢côeÌUáh'bzNf‘˜û[ÅMYs»…¥ô-DJ·M¤äé3Ó„m*c½ökb­äò;ì’eu˜“ëQ”äPWn¢[ñO?‡F¶ÔcÕÕ€ý3 ¶QMõ«Û|Ä‹&]´5)Õ¹uÇû®a’ÉS0¦§æwº .hBË{,níºL &õ¦  X*joNsÿ7ãQJÃØ ºô?’ÛÄŸ+¹•5ê yÏOõ~ɳ†YEnm&àÜN¾’JË.õK‹•»isl“4Ú%1üÊ™ÿgd‡žè×@pHÿy»Årvï°›uY™Ñ"UѲã=áÃÄI[ìSØ&•wéJXÈo—®¤-â4—¡úrqùÍÛÂKXÙ–Âh.l£N”>/¶Ü«†ß˜*ãxv)×°z<œ ˆ*4tõrKó K6¹›Þ#7[{k^`îÝrbëæöÆÖ¬øbIŒ?oá^£Þæ‘kýКš"h'òôz¤1ä8ÄitÉZâ<}é]¨l“§{ö4¹¸>0èÉïw‚v&Å6ö@5i»¦<ÅúTÉ`u&ut:}g¡Àûz=\¶±äIÄj]Ú’ÿMäd›g+áºÙæÇe›§AeÖyéYføi7ØÙ¢Ó ø\AÞ¯ò‰ç#ݨ²MÞÇÙTœž´.ß“¿!?Ë–7¸IÇTÄ€Õÿ"0s$ÐÂF-±„ÄóD)ÞÕöü€û–¿tê‘L§ƒžËsõ)¸íkÙÕÕgZ,f¿®ùè+‰ÅÛÈcê£äÀ[|u­ï‰'áV[<®Z+a5½!¾¾HNìz¥%Â×_K— ¿óJýìŸähø'fgÿgýâLîŸ~²ðèé-¾ƒ|/þíDʨ endstream endobj 1001 0 obj << /Length 778 /Filter /FlateDecode >> stream xÚUKsÓ0¾ûWèhÏUK–9ò(m…aT[!š&Vj+”þ{V^» i8i½»ú´o׌ü Œ¼É^,³³s©IMk-4Y®H%HUZÖ’,[r•_î{ßØh‹…¨Lþyp=Joö¾uÅ‚³ü*.ÜÆÙÁᇤ‚òâÛò}öz™Ýfc„#xI+V‘f›]}c¤ý{¨¬ ¹½¶¤ÔÎ ¹Ì>el ô6FR5zH*I­¨P<½ÛVyÒÊ!F…– YsÒÈåÅcúœÓZ)1å/%§ÒÌãî{Âwc>s@p¯>(# Q¬Â[_Š’å>®¡Òäq=Þ=;×âàŠÔ´TÌÉwŽàµðëÙ· ]t]Làu¾-x yëAúʘ€•Ø–’CèæŒe†Á_ojc@íÖÆfªaçŸ`»ÙÜ£Ùv-C7«B7!¬*¦ØGåu!X¾_Bå+ˆF©œ Ét¾œ½o `Ž+¸Êï)_L*©2„±˜é]r }z]À¶CáÚá¹Üdò“¥ ÛkßÙèä¸Ã.€é °ë]Šì§ûaLt[¨'Ü™á+œl¡õX×?…¢©¥ Rþ+6Š|©9e°4¼¢µhú"0CBoâÚÆD¹zâå€jÛ;Ôîì0r')wÒùv¹üˆÖµ³-tFHQÍ"Ìäý{ÛÄ(MÓ胟­kÓꜭGCžÝdpôí~ðÝ9ç{Cºy7Ö'­›Ã1yœY ¨bô…Gúâ Î÷Sݦ%ÿú—ÝîÆþa…§±¦¹VX©,I½»Ý»!>ÿcE¯~XÛBÿ÷æ?ùk‚éâ|j¶fc*²”‡$z¹¶»8ÿ¤JX;Zˆ£ŸØÅ~|8Šô7…¾Â½ endstream endobj 991 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 473 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 34213 /Filter /FlateDecode >> stream xÚì@TW¾ðIÙìÛÍ~yïmû^¶o4‰Ò§WzïEªˆJ³€ EE^f†b‹&v±w¤3T{ïŠQ23÷|· 0C111YÑÿoÿïܹsnaÎoN¹÷„`r€aXMuõúÒˆIÔWòï¤ÃÀÊyIé©hшIyû}gÏ…œ;qð .iG¢FˆÉyÕý ‚C!ç‚m À6Øl€mþ!®¿µ I“cº´RYÿšÈ6’–~oC‹ÕW©òÏÈú6™·ÑVËoàË+V/aÙEw;më³}²ˆ¢ 6®m²÷¬gÓ,RkÁ6`°Í$l%Ö×3wŸçà„‡Ë¼‰û»Å„@äÖVB¡©µ¥ƒŽNÚô9z”niB1ËØDÉCIMP¶A‹Ýõ¸³Žà• B•¦ãbé] é_õã¸Ï0âšQ;²rtáÒµ]óŸ6ŽW¶iBkr˜ìy9R° Øl39kR§F¯/8¸¥e±ìDoæÉÇD”wÏŸ7ÛÔw ÙMäúèäP눂•ŒÛnÓ„Ò7¬å°«+ÕÚmÖèsÓñBÎÉ2ötƒ¸ã/†vô,ri¤Ð6ßxl»¤ñ‰›n‘Ü!Û€mÀ6“¼•XÙ3Õ$ r,>Z4ÜÛ€ v|¥O³KUn0mt«¥¯|Q_XÂ0u=3Ìhv¡Kö¬;‹JÏ¢•Å ¹šÎ˪ñ¤BgÙóüJ‹ZGvTx°œA7^^¥ ly•t ’3HT~i¦‡=“㾶F!z·{ÀÁ6`›Éi›ÓÌM‹*Wï³>q†®¯³çÉp› ±e»ÌÃè_æq…d‰%2qÏ4XÕ6ùÇ÷±t5ñ2ôu©`¹‹ŠÈ¦ž¢æ.¿à`![GWKKúç| O¿µµÅø[5|Ö´ùÅ7Ä*;’´*æZM†T—4µò¦}Î`0Ù,‹¦IcìüW®ª!Ë9P¶Û€m&SPw¿àÅÕÌ."{ðâ„X=S™6TÒFl@tF· òº WŽˆ¢¢mCµ'2MÜ<Ôz²$£ìOÇ_µ3õ‰[©rqlé·#1U{çŸ\Û€m À6Øl€m À6`° ¶Û€mÀ6`l¶À6`° ØÛ@€mÀ6`° ¶Û`° Øl¼¹¶iÀDçíär;¹|–|«)ß"ÇŠQ.·’›Ú _nUÙL:´LÍûvvhý»=•Øl¶!·Á_ E5™‡r°\D¼üÒ^TÑ#JÜF,ÿÝDt¼K´ó± sÒE瑈æ)ú«¡HÓ‘°PX±Ù¿ÌEÇžˆr+”›%l]@¢)–¢¿‹²OŠš ‚mÀ6ï¼mðdqÌH­9DHRöŠ\–ˆæç‰je¢ÍgE® "dQUŸ¨²Wä³J4c©¨¸(ÌDo"Þ •)j9Ç‹|V›í¿'òZ.r[*ÚvQÔ†ˆt¬ÂDñ߈¤Á6`›wÞ6[/Š–íTÚà;Öw°ñ—Çn6ü.Ô¤À6`°Íœ4ÑTkQÇ“8^ ²ÙG‹š!‚mÀ6`›tÑ”!Û%b`ޡɆ‡Ø¥&œž§`d‚6TØ4Îz<ŠšQ!~ÌÓEÚÎDMŠV•”,e«Ìé†'[Ô¦22p£rp`üã¢F¬¨}ü”EÒ ö(E’VõÃSž•øðøÆÄÃøyQ«¢>ºlFîH¢2]/Ølóý£ì¦(óÑü‚ûD*_QºËÁÞ\_óK½éSùÞóóò›”ùqIj‚žÎtšz°ö‹woÒúò òå4}éúÚÔ[_ÎH«Ãu!rM¹%áÙVÒ†l´¸|ßœµáÄý}\ f®*RiFÎر›¦£™V‹<õ¨½ài%;]oºÕêâUÃ{¤ìQÓwãý…A>øAÒõ´ñ iOå˜x†”\ ´FLËrê]Ggu¹?ß‚ª»þ³­u¿à­gFKbþ_IÓÀ’Ôd½Ï§îÕ€mÀ6¯#ê䢚A*û/ œÁ`šJ.àÅI ZUºNȤ gï¤ÞMÌHá›Ï)ĽÑ<b)¡j¹¸½Çš5Åÿ…ò­¡ù¸)•5Ý2ÓÕæÍø¦P½*(À×Ì?SÍ6»p¸Ü´*"q*©È9¶üy[J;”/EC{”4Ý7f~± ï18$ÐÄgeq ¹¦¥°¼{_ˆÉ”Ó·nãÅç5¢ü²ƒ|]¦kB.‡f9Áü¹ÎF–þñæ4ú‚ƒ`° ØæuDP6QÙÁkRå‡ùzÓmë7*§GÁ-‘}èBâî;TeŠ´Íìüú “’´<µbMñÛ20²7CX‰(bÑ }ð]Oß:ýžø;Ûf¸¤1Û–ôUq˘Öß6fN[\&^CÚf575 K˜7ƒãs„8€feeµú~kJ%È?~œ3ÑlÝ Ï"7/nyh¡£¶Û€m^OÌJ}f%:‹VDÙꙬ*lS›{¸uEi ?¼r¤:“êÜIãØ?fMG‘Ž«¨­ÉÏ¥Óù‹Ž(FnóÀü çF[òœx-¶Á·Mô\6Ëc?n›¢–§,vB%¢¦Ñ$rıc؆¨Iá§VÜòÀl¶Û¼®È.Íϵ¢P7!/°Œš|×KÊ–š¸ÒŠx"ª2kd¤mV²9,6‹©±e]/+ÛàÇÌð±}pÛD.‰`òìÓF·ÊÌf2i4]­‘Ð×åþÛÌZUÚNÌ=WÔ‚²öUêÓ|7wᶂ½{FžD=nHÛF`° Øæ5?¹P'5a‘Þ,Ÿ­Ã¶ñöð02·62³àrñ‡{ðÂY“š+i%¦ƒŽo)ÛPÏ5´µsžÕ¬•Ì>R“ Ì]×1’fξc? l3Åf2éúdÐ8\¾Õ¼Í"²*ae¢©GZŽÛ€m€ŸÒ6QDü¹x!$#7@_ß7£Y­ÃHR{ÛÉ?2l›Wl·Áݲç†hßmI‡b†±–‰ëRјٱ_w»M±wRþéžœ*"r«”»kAs½9î¢nÕ’Ølü¤¶ñMM±*ìÀ‹Mº®KËKÛ‡Z‰¥HRq†ÃâÅ~.þ~¶Á“Ò!¢y7µêM·^xbìÍ-?^+±jµÜ2Ñ3IQwšmˆS&î5«Ì÷ ¶Û€m^gDn±g‰ˆûëКÒRCÓ|öŠ°œý‘yeób“x´ivA9u ª•˜gä‘0ª`$" ªó›^jm‘®[ÁŽLºŽ¦§äù¨jÔOd›”¿a5Ó9…ª'â±z{m´øxdF‡aRx2Zt"­‰;]œœ#w÷ãT^‰/Þa¤OóH;Š//Ûû@ Û€m~HàY¸CÙýDü¸×wÇ%Y9¸™Ûy¸…æ,?2 ‘*û¤’ Eæîö3TÃÄ|qÖÐS ’æg3ìÌnI\ŠDkŠ²N¬J‰7¶ðŒ«]Â#42Ú)b½ª²öž²pp_{zÄ6±aÖÑeEc¨¿ook³Ä6áKB Ç–m¢#Ã|RNJ†êw‹b›ÇïfAž‘™•[øqÜ6÷m-ï$l“¿o“… ±ò”]½Ò«ŠàIv° Ø懄¤VäŸ1ôÓ8U†á'¾å!M²&¢üˆê[ÔÝ}ã§_¨ÞÉ®þü&¦zãC6¼£Â‰R¯+‚sÁ&ÜQã·¬‡Û€m¾SÌ^3òœÔk6$2ž/2[ˆÛ¬ ÝÕÜÓâ@|ؼër!ؘ춙»–x¼^.J;,Ê8&:õ\T;H Šµæ ¨ìQ,ÙÐ*J;$*•Õ¢CˆÍ²NCÙTÛã›î$ â:b„œ¯Î›í¹Il†'‚ÛfºõTæéÅ™HC£ç·ÿÓ ñ*ÑóÛ?aï½7ø‹s;À6À$· ®—×Dy¢˜ŠþjLcßÑ?ÌD7%?ƒDS¬ˆ·>³]$ Bøò_ E§ Q›-ÝN ô÷O3â-½Äf‹ˆõŸˆŽ<dGHQMp*n›ì (ç,Ä+Dæe4ðñ'Š÷?È=¶&¹m†@ ¥hd„=r™¼í–èW¾E5ÂŒÙLÙ,#Š±›‘» lS0™º™°]èÇŒüV4ðËÿ¶ÞÛPQUka6#¹Jõ•{KŸ¯^¼j–·©ÝcLÅ[`Ü¢©ù‹Mçîý)Ûo¡m*OpµØK+UlÓúÌ™ó…KIÏ+¥#nAÁNz1GG;êm°­Ló`:nÛ€mÀ6?¢m¤(çص„u§âJ*—ï½g·B²Ë[Üг⛺¸’SK6J3Nãû¥nÞkÎ`äMÚ÷0ïøõø d½Ci)Jýº.y¿òN¹Ü}M±%-ùRª »éúSqŧ×Ö’å¢&”²ùÔ²w¨1÷²÷Ÿ+­HØÔŠ¿…GÁ©»q¥5ÙõÑQ.ÅVn8™rJ¡ÚßsäÊ’uøQµæ6`‰ë«2*È*¶zgs|É©ø éåýd¯7âFÙÊmMÄYl’fTɨõø¹¬Þ¯¬X¶ûŽèôõØug [TlÓ„ *ï'm¬$/È=qó¨²yqꞯØRWZ™¼û¦hhÀªI«ð}%m¿Rج| =}wMRÙóŒ²Ö¸âòÄ­—ðõ9‡ÎÇ—”'l>›Ó¶ÞRÛ¨Ö¤Úž» Ù&£4Ÿ®Ç°ñ_1'<Ú€­ëœp‚¦FájeÌ·ž9+:ÍÅÅŠ¡mºâ4JJKå19î±áßÜJñÌÝóê1ղͪD_Î yc°bž«9CSNîñÄ>{Ž³¾GqY»gÅÓ3v‹§ÆÙèmåàÏ6°Ê©%R[ž•Ábó}·öâÖ*n¸l¨%HªQùª—rÙ,KïhŸ@?Có@»»KÒŒBØr…¦ÞQYnnL¶Yb9‘. ÿYfbøßzY^Í@aƒšmŠ*Ž°ô¼3ÛPa]±çâîåµ–èj_àÊ_t,:q¾ù쯉²ÁöµÆAK-.yR¢væb®¸éª‰>oiùî‡ùó­SJysÊñBWîW注){Äøñ¸³Ê¨Húæ.‡»çiî×_Ó8öiuˆÚ&*ÆIh³¦ e‰×èñfeI•ÕÀ  KsïbQC™Pg~)U“yÛšë›$žQÚF|ù{²ÌCNQ—®`ß^Ãzú`kRæÐmR ©gêOžò]W6¢ˆ>Ïkg!Õ~^~†ÃäFx†LxŒ½Ð,,Ÿ,CF.]Ì5ŸQ@Š+%}5Ë5Tö1ØxÛlÃÓeåWÆ "~Ýk¶&n›"é#Ýi¡‡¨úVÜrÃD{zÐ~÷QHTKQqk·#SÓmc/i0L"íqá2\Ä·ŠZPx´±ï^êâV&ÚÇP)§çeÑÈ~=àÀ»ÒnSÜØ!ÐÒ‰<¡ÌÎÅ­,õ§ÎÞI”%ŠÛd±E~ó ùzÎÑ©Šoµ ^Þšçê”ؾvÝ£¨¦Òš ®éBqýC>—µü˜¼¨æ¬€a±¶³·à†ïFIkCÍ—^Í-æø®/nCk7¯a;m’œ(ãØÆ7?3ã°RN!_–·Êóžé3&}榇ÊñBOßç¶é‰KN:K)uÃFŽYv- Yh<;µhèÑï¤ô5\kŸÂªjžÙгZùbu –ŒØ¦ã¶©®ŽuàrïeTÌ ]~@¦r¾²™V¦¶ËOKGž‰(nyd­§í³­Ÿj³Kû¼ é6Ù×p¶™}ˆ:Â6ñT0=l¼[¶‘´<±dO øz€‰¢¤¦Ž;YNT”r«eT×0že-pàN³^~•<˜*Þt½€­ýøÞ‹¯Y±>wͼW…¬,x3’ʉÖìÚ[&&šJ»¨E%†ð-|óšˆsÏØ´!pÉ šk6l;~âÃ[8ÚôÅ{ñÝ­Z³@Ÿ5?«­,XÊáÙ¯­%.cê: ‡'L«’ãWl¼[¶©8Bûç´uÛØiÿÉ^Lü‚‹j/\Ìa19l–µfê)²C¹KÌÎ10Ùl‹gè|/*à™=.ÖO_GÛ8xïê‚,¦ñ¨>)¢²ÓŽ|LÿÎd{âÛãY,%7SGS/òèU Ê9P£¯=ÍK|YBäå~oÞTmmßLe/93‡¯ù#‰ì6Õtpµÿéšx/öTaMûsÄn2‘ºgþþ }}¹×â mdMê)1…ľ:g{S‡Ãæ™ù®©(*çdì!>TÇÐGLVSJ¾2Й }§ðä#½b¼°×0ŸºFÈcã—ÑÈqQ¾§ÔÌa¡B¾ge›˜eÑ\ó0Ê6i™«µÌ}Á6ÀÛdª%³ô,«VPñ¤lç$ï?¡æÐ,newKq9+e’¨lI¬!‡#.í]“RN‘IÎÝ@Ô¶ðDÈíÅÊÁ%”se)SCEdúC#ð“¶(³A9÷eQ‹òV–r^K¢“¨êÉšãr|3â¢UÝâqKôQ5;j&С£Ú‚š—“X¯¼ Ë:v;¯‘<ßV”¾Ú_ß>“Ù¯•¶+O?÷’å„¡Êj#~x-Ä)“ד8êâ·)gêTý”reY«j%!gNÇS(é:°fTtî·Þº²Í?ݽÄxYeóº– vûô#w#bçpçg5 W±P‡»“‘±ozÚ‘»köž1°=×ÖKþ£iÁ½ÄØæ•mB؆h¤­WüèÑ X-›¸lž_zN½ü{$"‘/ âãuDžÅœŒfÑOsäc"¿l€m^-díÇmñýâ&Ë,¯ l€m¾[ }½ãüIÄ«ÆnIETµ{lLzÛ6"qÃ@êîŽÄMu‰_5¦ì½S(Uþ÷§F¦yhÌŠÚç ›êsj¯%嬃͉Û;ÿ=Cn6¡5»’÷>ůgò–Ú´}0.1ðŽÚ†RÊéK¶& .ß@hfodbÆã1…v1yÿŽ.ÚvŸ¸ç¶üÏÀb%ñ¼öN¶-YjÏóØ[øo™:¡X‡ÖŠä6¶ Šï‚m€wµÿñ•Ù[r,ýÅùÄD½Äoqaí#/+-]Z>ÕõÜLL›‹F‘²œè½Å×H¤ˆèÀm§ºt•%“’Vâ¶7j¦Ý¡9bˆŠÀðľÃЪ)S[µ#w!'bï³òFÜ’²sœê§¦v¤šf¢®Œò؆†Â´=×jƒì©ØFÙ¡ß>tÒQ§6úÀˆÉe†o oqT™˜xìDhøƒø1(g£¶M#Ñ-Ž?~šÅÍ#Ó@ßmʽ ]ϱƒ’m€· &•³)‰¡c¹¢Fe<ÌF”{êΚãψ{B×ØÙYpì-¬-ø¦.‹6Ü ïÌÁ̵g.γt tñ dñÍæ] nMs¡¹móôõsñ_lfÄ´œ™™Û@”XRKD¦L;w‡gåŸQ@æDÑ‘;3¶ÀŒÏÔ5w[ºVŠ¢ºs9/÷”ÃE§Úõõ+Nöáù71m¹!OßÌÁCÈá˜û¦eSé߬Ð4ˆ ‹pš»ØÖŠ/°K%²§b=“6s]qëøe›âæg^vÓ…[óë1Iy«“ƒ ÇÐÎÜÂXhá½³K)–£Uö6¦\G33CC»9I‡zñSX‘lKw*qñòužl" Ûú‰òÕ„€/ç?oïdË3²6µ0ål‹¨—md¦†šA%xé ýŽS-\5 œu¡§Å­(qmª‘€iæàÎcðìm·¡B° ð6Ù¦ ÅÏ1¢»nŒíø Eáåjl½p˺³ÄOöŠÕÑúB¿\ræJ¡WZñ9âçxU’¯¾Mªä J˛æ1“NE…ªk<.#ñÀ ññÓmvÈ®~üDÖu xÛÒ,âÚˆ”]ŒíÃ÷â)—œE3„ÎñG‹¥=æNDÙS⧿ü ‹-L9Ù/Ú·®mu”øÅ_wVîa£kZE”avgе´g?ÆÅRr¹XLwO½‰kpíîÖee¢¦qlƒçß Ù¶Æ~ùÄÔ™Räãfn¹`q»];ZšÆ°ZL¡p28Æ¡N9&|&Ó9MÜ‹Ô“M§''NM\s[ÈeFìx(V¿’ËrV8ÌΖ´·®È^Í5öÀ¦jKsÆ<Éý5ÖsٵğjãÐKOˆömcêE!O³­ËÑXsFÚqçùÛ“Ö6ŠPw!/`OQëx|7ß1£M]°Gyç[‰ô¼Á4ÝEGIÛØpgg´)ï@ÞºL—–×Òrg3MSó©éªðxœè]]ÉkVrlfåV<Ë®èήx±4;•oT(½kJ›B ^¡¼¥–TÝ#3'l9¶ŒÒ6ƒñ±a<·Ø"©²Ð·2Qh»øÈîL]ƬÌVr_R4ÓGèSóÒv›²¨07®ÛZq;‘ujó¶õ’GÕ]PÕ$ø’w‰j/ЧE”)×ç—Wr§ –5ÏI,Ë#‹Uâ¦~7!Ï)³­ˆ ž òQˆ¼Ê®Ô=ç’¶HãR3X†ö9ucmsG\u…ÏâÅ& I)Ìç™ùäÕ£¨?¾ÏŠ‚ÓÊ«bêž"†² ðv•m’B,ô-sDm£o©%šÚZzQ*#NXѦøî mcÍñ˹¤Ü~Ûr]n¨Ò66âBª¦SÝÉ'ló4&i ‹Ãf³˜T°˜t6ß:¿¶ O9ú¤ZeA<Ö6å²E!óŒg­bYæZ®¥§Ò6ì Ü6eó²sLõĶqâò ð½[Gl/¦žmh3dІŠÍb0´µöáE²jÁÈJb=]S3ì8iûMÊSkœcÅ7_Ù´<+ÃÈÂÎÄÒÎÐ~yn+JÊHâò¸žÑ’°ì²Ø¶Ñ¶‘¢(_®qœ´¨͛ɲN¸ˆŸÚ¼9³XlÕ«D8,ÛoY»MÁZÔ•fÒF”UVî¹YÔtÛTÿó…{©‘0ñ²ÍEÃéÚ ¿’mº–¥®äÚ–¥"ÈV\‰ôŽ)íóà}dÊdKiQ³Ò6‹ÕË6qÑ¡ƒ¿*I`øê¶qàZ'gžì0ckÏο'E€þç¡G”G%i!šg‰ýÖ^4 i.95t´ÔzjtãUùTÙ¦±Y¶É=|9aS]⦺„ç$íÝvô/Ü‹ŸJˆçâQZé&Ö¶!²äÁ]l†wNM+O×t9Ùø‡®¯£ÇÐÑâL]cÊ”Ïbï?j"äØû9Ìpâ L毻E¬-sqiP‰lMÒfã¶Y“ãC·,²Í.›µó‘¸-ÏX"äÒ,ÜÌM„\ÓYÔÈx{÷ y,C#¾®ÀØ7å4^$˜ë`Fc›Y-X/©:Ë`p‰>©»tŸÃ´ŸµÀˆÇ7tOÊ#û‹%»Òµ™þö™éÍwŠ:-jT,tâ1}7Žî“J°á¸í)lBâVêÈ6Š$J‡N˜ð9¦nönî\žÐ'µVBÍÅ°g‡‰€Ã·ô²sqÁ/E ä¢¤™(Û°œ ¬­lfÍ3`j›8¥ä6ª÷IÑ’”E<–¾£ïB¡qøúZ>‹iṶùûñ-CjpÛ˜›è‰o+ÝšcGÓ›æ•vMYomA‘KBø\¦µg ‰Å·X°ª~Rv‚ƒmÀ6ßz/15–Baƒ‚ å Ô½.cד+#å|ê³Ã‰Œ¬ÚF=qÑH"j+UÖ`#oP=6¬PyÃ&RÝ×Èñ`j¦þnáÈ™*Æ5„¨qœõÃóI6£Q¬ZJT?áe4úŒFŸéP!säãŠÉX‡Û€m &éìu`lónÚ&e•®å:Q \ ° ØâÇmÚ· uhòVpÀ6Øl€m À6`° ¶Û€mÀ6`l¶À6`° ØÛ@€mÀ6`° ¶Û`° Øl€m À6`° ØÏÌ>${ß¼´TÌOÛ˜º=`õVˆAkvÀEø1bîŠÍºú4°Í¤ð–ææ];·ïÚ¹ƒŠ²Ý»âcc\œ ~`Ìpq†‹ð#®—ÄÄD°Í[ÀþýûGý)à l¶° ¶À6ØÀ6ïûöíK€IØf’òôéÓƒÀÀŽ= ×áÇ ½½r.?Ùípx]`äÿ1ò_åKÕׯÏ76ˆÇ6€É¦@ýè™\.ÇWÃ¥àuYÿ¯ ®Qš9û¢±ôöªès®êƒÂ ¯W8¸rðx(¿Utõ’ó3boXߞуž€mxu§ ¤Ú£ºˆ£ÀZŸW$\ñŠ½ì~sFÔÍ™)ç]ûÐ3¨Ið=d#—ã5¦…^…W ñ5íéÌ»ìwÅ)ä¾]Ü9§Ã7>–uoƒlø¾‘ãnÁ¥3@ÉG2¹ b[ïf,¾æ}Ã!êšë¾NÉ}ùu¢äCÖ® &5ªÆIýû=Š•ê D"çêk¥×:ŸÞ騮mSLêë<ø••¡çƒ?õ~e«NV<éï­.¯¼õB1þ6 YmuåÝ®¾±ËQ ßã—UÑuöDõyÅk<£ç7NT6Ëß’Ì‚ö<Ê‘!ååQ(ðÓR”uEÜ´‹¾jsÍ­æÑQ9$šŠ1Èe!`¼Þƒ/\«:¬Aä`ìÛl#òøç2Þf̉^¶ †^þ½T(ƽZØÒö¡ô"êšóWwWQ+nô_ˆ¼9#úªcäeÏ.ù¢ú-ÚXKæ>d®‹>ü%úüHãPJ¬¼²iüÍ¥#K[âÀ ç¢5ÖÈÌýéçèKòS×íÄ?ÞWV\*'þ¾½^ÓºóÑزMq~š™…¥¡¾ÀjKó]|õá$O‡ãè9kþ¼ öF<ž¹¯OÀu9ÚÅ1\çæ9'<|‘‰€™¶û%9·Í4ë”â$GG®æ—Vn±÷É-{;¾v3c[8ºÛ æ„?$”Ûw«ÑÇÙR`nçbgÊ3´)©zH¤«m¯ƒ ÏÐÁÝÍÁ2//òKŽ²l³yM¸ŸïáåÆÖ,Ì:F¬zzNS—±m…?—ÍZ³wT[ñ•³–æ‚oT¦‹ºdWt9FT¢^$_öÆmsÞìé–+ˆ”áo!Çêñƒ¨ïâÍýqšÌ@üÇxOŠ³±çrjƒ'M›uY&7ðZÍ…LÍ/uRË•Yz±fô¦ÄRçf]M¯nâ;üØÉ\QvN™Y#­¹Á[Éâãy:å–YM­?Égß“ý9s”eÔÓySÚ~Qý—“¼àº¿B)dÖk C¶ŽhŠù%êGŸh m"¤ñå'¿G6J¹L,Dÿã€Ð="óž'6ÕùÎFn;‰å븅>A/äʽ<>Glvâ.yœÍ¤vˆå5¤ +Ó~„tÓˆóß"^¸rå–¤ñgbAl„4ô”+‹œ‰fµª•mbôѧöÊ ª²‘ÆÏîaÕbG]<Òø_ô‚|YK,ãäòÑ°‡þN§‰Ô Ûß %7É>@,Sç…ËRÕk§Ìq[n<m¾‰&µÕ‰x+MÏRª@æÈâ¸F8Zºc±±²lƒ¾YnÍ7²§ò»ìÊ]ºé…~ì%e=Mݼò;ä«.gMñ‰NÔ{Ó\—‘UN m\`l}_¨üfYh|1µ²qC‚À1€Z^æË÷MÜE-ç;ëÎÁ¯MO}ª.Ãõu•Wí¸Ó6Ö=F=—™L¶óòC㺰G—Z[¯=~£Ú¢Î;Šî'cXÖÅù W=b/»Ý‘_Âøÿdo{ƒ°,ß‘í¾¡Y½´ùl>sjlÍÀÐêt×ÔKkïE³¦Ðfu ]µå „Áé¤@noÐÕôÄ«úÝ7OñXLéí§]O_/cM³¼¦ lCcðëî÷R¼²k&ÝQ„çöÝ™³ç~‹Ä ‘M±`õKtDŠ~ñ ™'ª‘Æÿ ¿Ô@gñúÑ{¿AûòÐßý‰•NÓ_6QõÕzmkþ¢n\F 2ç,A0CÃ%î¶Í#E ÷ÑŸ— {V¡ƒ†ª+DRW‡>ñk ´µû;¶`[s6Wß ŽøÅéE_-#’”u:°8{.<$ÎøëP#û•T…è›dsÛÙ¥C×ìñL-Um}/±Í¬àž¡Ë1Û™³vçÅζ=¾ðÒ}ò«ÑÕ}»c KÇá™bÏÓ‡—Ï´Ö×Õ-eXy‘{|à¦;EtQYó}V¾v*×ß_‘»¡MÚ¾þçÔ¬k…§ÝÂœ½¨÷2ƒÉ;~³ûo³Q_ìY÷ü{1z¢®Û‡]w8|g"ºÅåHþæ7;ý@ú 9‹öžS_yÇñ ­ü+#ÍŽá\­ù'Ÿâ¶ùŒ4ÜX·bApúiUÛ<º´‹Çá°XÌat§ëÕ=%môtR¿IèÚîYßÕ6ø[—Ö¢ ®ƒpcà¹ò×èà Úi†b²Ì0ͪD÷Eè³04P>ú¡‘h d‹Ä!g¤—P=zÿ3„çÏ5þÓ:ïÑ¢¦‘]Ôf!?µ$ ‰ú”´ÍWáè“ÏÐpëÙ¯ˆ|Ýw†øïÈ•yH¼<Ò‹þï?ÑÒm#iþc”mÈ:à¨ØvKíL™ÿ@>)ê'ÿ„Øl×õ¡—èÓÐ’½èn›ß!eÍUb›áÖ—ß¼ŠmTÚmúªi”4øÛ,3µ89ô‡êYÌ\ùü;¶Ïqæ®ÝyéfÝz¶úwCO›yþ*/ŽÄ-´"o}Ù¾ý[R#™Ö”mΛ}®³ëÁP9í\ñ¶OÂâÌ Yì‘$ ºã²õ¨ï ƒÅo¼×39ºT(ãnèÊ~˯9Ç]süêa&þ§”¿jòw ¯[–ïÀv)iRÿUížÇ˜W;8\¶ñÔÒ[ÕÚû­¶é¾QÁc±oŒ¹ÆßÛ6ÏÉ ŽçÜO‰¼¿ÚÙå¡iè Ùšs4ý·9 û -ßCüúÿJ=½Ž4~¥lÎ8K|jGÒô$þÌúŸ ²¢)æ¡JòÒuHã#4|V~ÿ=T¶IAÿn¤lÓ€—mþ ¿ÄÁœFje›Vúò¿Qø†‘_¯ßŒW¶9"Y“¯íÈ:R}å ¢¶˜{v¤lóñ‡(ëY¶ùÉm“lfë·q¨lóÐKSgUë‹W±Í…ζ2ßèéèN݇Þ:Ÿ¯¨Q&ueo.]Y¶¹ã¬=µøŠ²µ¾ûøš¡²³¨jÌä2i›ÞIa†mz²&êºS Ϩfç>ì9Q§P7ù)ÞÝÜ+ ÑæÜ#OóaMÎÔ)7Ú¹ÔÎdV&µAWó×:,“›d»Í¶Ù¨û¥Ñi*{dÅdfV6¿Ü­*ZRPNµÛŒk›]™s|³”_ø®¯Þÿ=þ„|ƒ½€l©.@¿û+™ÅÈ’üãF¢ùô“Ð ²• âÏ(y6ÒY:Ôý¤@¿Ó@t=VA¬ÙdŽfX _é+óò‘ƒ¨KîIIc™ôÅbù/d»ÍÝJ²1y(óZ|ŒéÄ‚á'È$Y¹r[a3œøéè¿l•+ËŒÓn³ð3ô÷™C.oGvÞ¨WF´-?€î’v>¶iüIÙÊ}AD|¿Ð©4ô‰åP¾$Ûmš¨v›W²âÖ¥ó÷ŸÉ¾£mìYœí—ˆDj¿3²Nj·±;R}ù}çvéÐMÎ÷£W°ÍŽsèÙUC=fqÍåqÏO*©#*eÚ_¬–Rz7Ó˜cå¥l2w£û­<ªl·Yè¢cD´Û<=¹D‹=ëš2i,;9®¿¼=/± Ö}ûÊå{ÝoŠmÈïäÖÇ™qW]£®¸]‘µ#Õ>Û·]6T'äÒùî ¶ÀÙÁ‚.°*i"Œ»¯øØYl=ƒæºóÙÂÄÍdÊùµ£ù ÿQ“ƒxóÖ?4ØU7>[h±ìàãÞf‰aæ<ÓÇÕškj¿ïRY¶9§£Çi²ÍÕ^:vùxvéØ›Ç`Ò\¯vaÒ’„/ŒÝÇ¿Ú¥‘Dž:@5t\'–ߟ>”ÝˆÆ |ÍSòUS±\Z3rzféÕ‰~ýKôét¤ó7ôþ/QI ùyˆþþs¢íˆ>醣)!Ýuö qz®£¿þýüˆ6XiŸB~ª‹Xι;T¬b“½ZŸ"ÿ@éIO¼ öòŸDlâ­€¯I·o!JYª¶J€( }=6gõÎÒû4jÏãQ¶1ж×+?Ùw:ä3A"™‰²<Ì4™& ›´nç²h¶6¶ðš”™E@¡…©CPÐ>ƒ”°ùe}Rõ‘ÿäÅ ÛÆÇž‘¶(¡=©É±ЭgÌòr4ç™»œ¸KëpáB>‹>A±±Yy}9ŸÆpŸÛ5€n•—ñXFø¶…±_ÐÜÉ[,PNôlOàëçgÎÒ·òH"Îêù%=}VÃÝqkRŠ-3ôéa»ß Â ÛÒ•{Õ-ùŠ&cºæRጾ$ؘûCFîQÞ&1rÓ©êÆØx·‘¨Þá2ÁMª/¹1BíNã‰ï–Qï3ÄF}ýYõcùàê)苬q:7†×Œ½s¹æS $¹:ê‚ŽNjô¹|ÇûmTS@#/©ž6ú~£3’–”÷Ž›Ì¨¿ˆÚŸRe{¢Ý&êö²o͘?à˜ïÉ8×sÔ¡bã$£þ%|Ùý6ã_-ìîÌÔCoŽläX߶GÙ—:Ñ#†aðÔ;Eÿ}ôû? oÎ)f?‹F­¯œÈ™eèý¿+:ÖåoÐ)Fy¸_þa½£lóò<òFå KEž’ê›oŽm0Võp_öµx$SPCÙï'²Ñâµ³Ÿ–ðŒFƒ¯xkµm”#ññŸˆ~ö'´Eú&•]¿ßSljlŒeSM¢»2ÆÊÊÆV+sÿ¼‹oܹ£7éV9l¸ö€½ôF{à©Ib¯#‘·é ®£M¢² “õQ“1ÕÙ¾G­ø¾Áu"Ã0…\.ïG#T ¹\Àë*Û` …“ÏGa#ƒ `˜LŽmxmºQ &S ÿ Œ { ÀýÓÁ¤˜¼¶² ’c½Ô }ƒÃƒbƒrl@>ˆv`^—p0¬ÿø‘g¥ùƒ*ãEÉŸ<‘·5£~<Í Àë*Û`rÙ“?vSCÉz‡Ÿ•îå}û7¿Ãz{ ° ¯I8ƒ²çÿùÉSÅ.Æ/äØÎÝO?üPñämxm¶Q(žÿùOï¿ß;U 7b{Òû¡FßïËž>‚ü¾[eôû‡Y i¯®¬¿üàÉÍ–S•R…ÊQ]gÏ^;\uå`åÓí=ÏGƼUôÜÅWŽŽª HÞ{yø塪+‡¨åŠ;MçëŽëxüðÉ/>xø«O^¼÷Þ_þ )ú°¾·¾"E}å2bær¸<[K–©ËŽ Ä|Êسkó½Ø&v3=ù<“¤uµÄÖ­+ÿnñuò¬°èØ W¡õüËr$ï{:Û–IúÌ Ø~ ^ØînÆ5sôp²4´ö ¼þLFd§ÓuY;Ó‚çÌŸç¥oàxäî@çÁ|kKC›€ÀÐGƒ¨©8~ŠÁ ühZwŸ¹?øà\åž3äg¿ÎúõîÑÇ,2 iÇÇ/«F ªÛFvj“ä¹ kÙ÷UÓ=<Å&'MíÝcÊ6ö¦›|m-œ\ìè:zq¥ønïîͲ²004² œ?¶ƒ.˜é¸ñª¢çØÂY&¤‡y†FFùX2­Üãî½D²¸m˜FK¢mlì­ ÙL×ã2rJÈ ÜlY&Þ®–#ÛU÷(W§‡{ò8B77†>^Ö±!áôDͱåÍ}<]ýRÌMXTÙæa­Äшaïæme p ˆ£fÏMÇôˆÚÄg ¬bŽâç®ÿGgÑ ÈûÿÙ ™lðyéºA ®9ð¡ÆàGï=ps–ar91ÝËÛ_“zt4ZO8ŸÊŠ·.ÑbàE†ÝËM¼VRt5­Ë2¹ÞOÌ•©ù…NZ5Q ·ÓŒÚD¶{tnÖÕô"|0øÈžÉXµï<µÁîÎrµgçét–gN-µþX”€½˜qÎ\'ªlƒzÞj9sI½`BäªÎôø,ÎÒ¡‚è8³Uá¶ýÍ®ygåŽåÊ(;ÞyíÙD¶QŽÈÎ/·wÜx2Ú69Î<¾ù%r½îæ­:<ËGdKËÎt_·dÙ¦{Þ—ÎTÙ¦¿*Jgšv±T9=ß<Æ’ÒÆ—”môô™ÎIÊbÕFwÑI|AngœO­¼²oµŽ±nPìöN_ï(å$sÆÓ´“’¢k›fê,¦NòqmŸ©Oئ«] É\߬üúñ-—Vâ ÙÑ–¶þC¥?ìÆéå‡ýùÿD]JŽdÝïÿ‡âýú>ø¼V…n^ÇWbÄ]o;²<¶ûÆõ¢u÷|æÔØÚ¡kÔé¡©·¦˜| mV×Ð…[NÌÌ[MÖL†æ¿yŠÇb6ÞxòˆàqçÕݬi×ä̼ ~Ýý^êƒWwÏüîó€ßHŠÎ³X9¬‡Ž¤Å95Íû›iþßjv\j·±Þdâ·Åt(Œ}j·^ž¸lóÀË6æ>% jÇ«5i&—^å©oR}fÌ# Ù¹]oš5Ñlß騩´€î¡ëUâí/zYMŠ&”> NéÌ×î,ׄžxëOYYM]ºG½OÛ¬§ÒËHÊ^<½válMõéêšSöìi›ÛðfÚ±Ý7µRûS v[Ò·Ö>¼z¼˜mjs§“ºü]g*D–®žœ(SŸˆ­º<Þ„fbE¿¢³ó¾††ì½_(Þûù@h8þç”ɱ>ì]¸•¸o±³hï9õ•w¿ÐÊ¿2ü²'œ«5ÿäSÜ6Ì®´Í£K»x›Íb“°X,}-ZÝÓ çÿ.¶yZ¼jÝ›É$®?{øú3xe1'ÒxΊ Èìÿö& âY(¤xlã ûð=ùï¿øàç«VÉåHN<¬ù.<•)+pd»”4©çÏîùŒ©qµƒ#e-½Õ­½ßj›î›<ûfÿ˜ä° z^/ùµ°¢J†TºŸñ(:ªØæ•Úm~ÛL¥ WÞÄ ½œ—ˆ^Ñ6OgêMÉ»4jSyÎ ‡Õeõ^Æ—¤mR­Ù^ÔäìTÙÆ€†—m®(á˜;ÊÇì·Í\°Í¿âùoê+*íÑÐèùÙ‡Ï?Ðüà?îÿòÿ?çø7Z!Êž÷÷…jóæÞ%óUçéÌ©S¬ná¿ÎËL|”¿ÎO¤›uX&·ˆv› l³Q÷ '¢9AþÈšÉL?¨üͽsª0:çÕn3®mveÎuð¥&ÝF/žÜ?wyü¦ËK«Âsÿåq¶òÚ½z®¬‹þ*ž¸«´Í§NÏÆû9ùn¶Áºn^¼x·û;Ûf–KÙºòp‡ÞTë[C¶Ñ™®#i œkCK\ßôJ¶Áµ`‘¥CˆDi™ÛU¡±}ËŸaì°æµrŠ›¦õU+!ÞsyN:æñ=äú»k•í6š9Zì-m]Ôö­»Ó–­ocì7ž @öÿi[lˆâB!{ü‘}ø~Ÿ†ÆS÷™ýï¿×«¡ÑµûÅ &Ç䊷]7Ôä ÉÁ^ 6ÏÑÎœ.´YßLæÊî«sœ¬6î¾®|ŽQò7ÄÊóéÕ÷¶Í² Þ¼Ô*2•kîB}–À<éÀã­¥ö†LSG//gKž™ÓËOɲÍ9m=vóm®îôÒ¶Ídzî™ýù ÍÞÁùj&-Yò¹‘;64.®Z²AÇ&óFÿ0ÊúÔ|ƒéÂÖêGÊVâ«{ þj’ÿO‹‚DÎ_¼Tú¦~IßþÕDÕŠ¯\tèá{G­=˜aeì¿sÈ6ÕŸk /‘¶iÝ•EgÐœftöÞò5Ô§ñÌ#vÜí¯Žžf“¸2ÐÖÇßߊ©mâùÒ>©æi:¼³O•ùýÌ–úŽ"éÇ­>¶ftcû9>3x\A¢ˆõàÙR3–ŽO§£Eìž›Kü-FŽe¸ã°'A3LY|wg[ïeæ†ô¯ª÷Þ9‘n% Ù¹Ïrµ2XϤü—&ðI:5|5"™Ÿzßü”¶!F´Q(ä×®wkü ûཇú_ùÀóÞ_þlð½ž0xø7¥Éß…[¡ÆTvì½#ϬbR›aY펎ñzÔ†G;ÍëˆýÑDw`÷Kþ@cæ€ÿ–!ò×~fÚ±±µì‘“Eã¦0²L´Û'aã¦0ñÉŒºcïUs—ö² 2Ñ ª_ü?wOoößýðSf±A¢e=.,xïg54äÒæÙý¿ý³ï½º44ÐãNEÿÜIü.pA䶮þöIaÛ|[ƒá¿q°cë üÙ¶Qb`þÏ하†Æ3ccü‡¤ëlj|¦¡i¼wÍ@ˆñ¯…®Õ;P—ü–RÒ·ÛæTðÑj tV™[ÁÄ_ôFœ/·ÿt(ˆ›Q˜ agÎßzÿç=7Éd¨ɈûŠõ´»ÿßû/~ñÑ`w7<'|w_© {“Ë6ÀO¯LA |ŽÉúPÅq4Ø×Od°>Å݉ƒh öføZðƒpáÈe¸`0ÙsyÙ.Š¢êtïÃû?ÔèùfØ€ˆœÑrƒ×§ƒr S wô*äƒê]‘ðâí§¡À-Û ÝJ¬C˜Jm[vûÖ£e ƒý½`~ÔZeCð-`vùòåªÊS“(¨¯.äßIÛØÆ'i“g|1Ĥ·Ñ,ß9s'#Ž³‚KÚ‘¨brDnuÿ‚àPȹ`° ¶Û`›g4t'onJÚ¢Œe[;ÒË_ˆ›ðõµAÖ¡öe_7ç×a¢$ªï[¶©qõ©Áá6`âšK76fÔ ÂÚÇI_5çÔÞ¾M!¾PדºçlÒiÒ×­«uªì‚Š¼£ø»M95äŽÈ5âÆçÉ›‡Ž­9¥ì:þ®˜Ll9l3風¶V¨¯oâèkã:ËÆÕÛÀЀEcùoê.$3uQk¯»P›Çå…—=Á³¹HŠ–Æ80‘Ù¤+ I-,œãÆu[)iE'rtùËO²a†‚ãµF|&—/40w020äqYF«ò†…Ó€Iš|MôðõAÅ—ÅCŸ-nl5ÐÕ5r ŽÍÜÊ’Çç3ÙÆ¡Ûž‰Þmá඙¿pþÕ•« P( — lóæÛ†7[DMDग़¸ S|2;go\Ï4•²Ü•åµ]ÜŠÕv™8^Ù­EMdñãØn®¶~ôA9¡”ñlƒ© ò†!Ÿå¶¢<¿N!&w‘úñ ‰w²¤ QÊÊÛs’Å7[±zÍ1_Ü6bÁ4½Å'”VX7¸¼ Á2Œ;òBÜøîÚ&¯ºßÄ̲¤¤D¢Bii)äe°Í¤°MLùˆò¶ï¦±­×âU')š?ßÉ2`gáév¹ô„²(’»UÂÔ7I8ITŽL˜.+ŠšÑD¶ÁY±z‹­R Á÷’¿{']Ï0¾B¹ML¢¯ÐE"nºiBÓŽ8€¨Êe›°ã*µ¶´È›Ïž±YÔ‚ÞeÛ°8ü¤¤¤ÒÓÓ!/ƒm&mÈšQZ#1 r°â¦Ë&ºÚ‹áy_îdmè^GE ú;™Î.X™»„m47«N©‘qm#nÅ‚¬4 7‹¥jë‹Ûž:0¾tÈï"–›ïZÓ4ö{Ÿåmë¹GBi”mˆhBY_¯fé9­mx·mÃå'''/Ul¶™¶Ñ¤‡ïïÍ<ù8ó䣔M»L8šÖÁðÌž’HwH)"ë5!ú¦‰…mDe /á7^0gê2Y†QÇåÕšqm#ié÷6Ô±H½*iR_ß&›iô…Uòu|yMÖ ºùª¸’S´ZO”ßJØoÛà•»²lšyj-Øl¶™„­Ä4=K'3k<­‹©§&§êbïø½Ä`° ØÛ@€m° Øl¶À6`° Øl€m À6Øl¶€Û`° Øl¶À6`l¶Û@@€m° Øl¶¡}*hFù-?JHGO7 ¶ÞYÛl¯^¥É¨Ãw‡ïhd_r¡ˆ˜$>µh%’wÄüÝê:*qbäa2eD 8,–’©M43BFíHüÎ2 ¶Û¼~Û4bÙZ¼|<Øt“F3u ÙÑI¶ºy-!=™Á ±Ôƒ;ï xÏ==ê%“ rYßcmCÅÒÛˆÛÐ|G.ß3»^m2‚À9žÆ³ÓŠT&©Ìع—É §×!¯ì1ÉÒzö©%kÆîÿÈœMBú‘IǃI×5r Yr —Þœ˜Ò®ò›ÎXuRFʤ?"Ü‹®m¼zœ-Éù±Ôu¥ M½y@5`°ÍkµMŠ‰^ÀÔgÏL-_{üa扇KÒSYºzaå”3Røf3×”yb$²*ûEu}äÊìŠk–¬Ï}‹îQoåTžL±MQó}K}-žÓºõÙoƒ|Íü3Õl³ë‡ËM;rN=&“z2Óš?W’[ñ„|ÙUPÛKîñqæ±#æôàͨ=æÖ¡à #ÏÄìò'ä¾OÖ,£3 #Ž P噌û¸ÂE¹¨àpµ‡m²œC³gþ\B52'#·@SsÁA° Ølómó¿âª:!}z`É]¼r„W"¨:ÎÚíÇfͯ²ùìüú Ó‘´<µbMñÛ20¼Fµ&%>r”¡§g±â†ø;Ú¦j¤¤1Û–ôUq˘Öß6fN[\&^hⳂšÎ›˜¶² -p¡qýNáÕ@Q3JHt1M¸HÌŒY°%xӭ“'84‹ñgënèX}PÜÚe¡£¶Û€m^§m~ÿ«œôñùm*Õªg¨Õ‚´Í\1Ùr2⡆oµÍZQÆ@>jï„mr×µ£¢¶ÿßÞy€E•¦‰Ú™Ù¹3;awvwžÙÝ{wïÞ ÓÓmI•«È9HR@”,QrÎQÉ¡ÚæÐmŽ˜EP$Š’$ƒHœ*ü÷„*(‚¶¶vO«ßûüm§ªNøžïÏ¢”qñú±M1Áw ‹fv/tzN¬Ç×ÛF”À6`°Í`›ÿíkÁaØ~»`S5Š^ôÊ`*†Obw.Qnc“^2•y1å<¾•mj£³SËzY¡ Û¨Û&唉×Y:³÷ÄÙ÷ˆmvÑYEeU"©°Å­i9Dl¹7NÕ4)ObÂ\° Øøk”Ûü[r¢¥,Í-Cœ“Ê'j‹*”)ÌEÛ|ßr›ü'ÈBs“ªIPÞŠÙ±?t¹³²™OÜ·OcN=‰ùæiâ•Á<¢×­²iê€d7 ° Øø«ÔIq´*36Z§<-z,*%Æ “_Úʦ²‚¯MpßÏ6…• ªòu/­lÜòÕK¦‚ÇCÚòìÈò%®[b|—Qþc¼¸&l¶Ûü°ím„1{Âéò2†~Ç.vî¹Ô–sH±QÕÐ)õ@TJ¬n™p©kdºÜ—ó69©Óé ›6šgŽ,”™ü¨¶©@¹§Òô" êDKÒoõï½ò<áÄ †‚FØž½—{2Ê·rÈj‡sðE¢ºüáØÞ+Ýû®×ªËÈÙéNÂ^߇€mÀ6®uʹÛiëäÀbÐt¦ŽuPðéÁ…f´á)qØRÆRd,÷ÕJ؆ú…ýÑ•¶áÅÙÉmbúÜ^å×lÔí÷-µÍ%lÍKl³CåtxUÛ¨PÖyŸ“°»“ªõ*±ó6£€ó¢åUÈÙu±'t"1hòLbÌ6ÏÕ(_¹ŸÁ>“}.‹I¥1DŸÁ?bu½  4¶Û|°¶Äx­q5ÞàKØ‹%=ªDË—%QI‘áÖuâ+c›*²Áò, Þª§ÿ¡e=$?Œo@5Þby÷ ¼'·-”‘Ý+¸«}_^%ZNþèò½¨mÿBO‡eXø:$° ØæƒÄ66-é' l¶Ûs§ÿðÇsù÷Îæ—|ØT½#l¶Û€m$#᚟ ñ±h>|šýý¸å|¸ûÀ6`° QÖÊ?t¥÷ðå'n¹Ü}øR™]ê9~ëÕñ«= KÞ=uÝýdÆî#ûŽa' pÀ6`›÷J÷®S¾”+‘l£2n(÷FùﶞjŸšwoªQ\¢‘¬îÁ¼Zð Øló©äSŠ±Ô6[kMŠ&êqðž˜uõPDµÞ긎è¡IÔÚ>EÖ*Ôл”'®j±–*—è)Y@ Ÿ…G5¨°ŽXQ¥E®Ÿ‹¯7Ÿ2 ¯“"‚ŠÂº…Á¯ð ²Â:QŸP²U^¾DÑÂHYä¯/l›hkÉþ¤‹UWK—/V]‰w­¯4/$FñŠOÚJ5:šW#ª¤[q@–tíÄWûX4ð9–—ä·D ÅÝí±c‚ÿK._8Úoì l|¢¶É«˜óeÓähªžsNÊ!y¤Ÿ¿½Y_JQ`*êï*x–ÿÙëmd0˜tU'òîÞœ 9–v–D_*ì>Úe®©p¶¨^ñ6Ú°%‰¸J Ò R²×ñöxÜ:d¢ö•ÖŽ"ò‹!nòrr EK²1sÚ¡#›¤iÁwñz´‚º3êŸm¾™_PMnÅ|@Dƒ*ËRµ >×Ŧlòûf¿nµmÝjH§Rlm»ÔG …e\«3Ù¢C§QJ.Üzrd¿ÜÒžm¦ÚªöÎ}é§öJ)¸g×/Ú&¯R““«Â¡Ñ(ºŽ™©…düb­}%J=]¬¯©D¥P4m“KÈÂ+A|~*ö-Š‚ª©_ì-¼m)yº°T<*\=˜ty¶þîIJy¿`_6“ÆRßu[ð1 l¶y³mRô¨òÅÑ$4Λ0¾ÂmS…œ­”Lƒ²Ìd•M»;n¥GæãàQ –”û‘Á¬²™Œ;=*,YCÜ’fefÀ•W9åÂÔóŽ±Çs–>÷³GÊiÇåã!ͼ‰º G‘ãò-~'f’×ÉqtUßö ï5Pz_YCOYßï¾]¬­TÍ}RèêûÊøØöDúr¶XêíëÅÞÍ¿u[j˜V-þ‰*”œ@“Ó‹»5“ý`Ôq«"“A :7Zø°YUNÞ,½ÛÚœÒÆ:ý¨6\VeJ›d¬ó{ñå%Ú´uf)}Ø n¼YMÏãH΃ٴëµ*ªlyµðÜÛå×Lš0å- åÆ(÷~/a›‰°øhöf'Q'ÍJ”°¿€©¤—QŽ|v»(ÙÄàpËÃcÙúö¹¥•lYv4ÈÕ¦gï–Q^´Maý ¶Ì:§k¨¨^”09,é1Á·3ÔÐ ¿VX-êa¨ÚQCÊF‹#Ó„m„ùÕøX‚ƹ]µ„mv®j›4° ðYÙ†ûkJoÝÓ"šŒàl¡¬ŒA"vsÝkõÌ®'ûåU vê˜ÆÝ**Çm$ÎI‘wJî’V+(ûä~¦±£µ3üæ4–-²7QtÈÿšn|$·ˆ&È[Ó8óK9$ë1ʾRÎàXk¨¸|A*ƒ&ÍÆf»ET9–‰ 0°Î8ÈfîÊz‚~‹[‹v›Èq<’Ó»¤ž=C–Ûd>$Ç2N«"J†kP@¨GwON%Ú—'«hŸõX´ÜÅMOò ¯rH±ÁóÄQ_&°Û¢+'QnÃm@v¦²ÚÞd5·j"l]®¸“¹ a[e5òžÕp•å)¡¥È{µ£8Ð`Þ½f•åyœ[¶À6‹uR{òö)ȳ·¹F&©1¥·DÞÅ#‡²EEwgð®Ø¶î4™€sX 4¢''­¶=Òn_åÞGT–ÔIõš:49¶¢FÚ¼¨$8Ö—©¬´õÀ9@zÒñ#L%5õðò‚”ÿhPSJWàÄ”÷ò¼•–2]AÆãQI}õ(‡ÃÖò8ˆÅ9¥-êÊœà‹óDMÙšÓÜ;Ç%8T]Çž…Ç6£ù5<[mŽÞç„£;]hT•Ð›|"šÝa¦¬däì²çˆµ­-…±9š8ÎÖš ÕmŽqG¬w˜íðÝ.'Û`™Á´oÏQ¥å ]“]bs T˜úáäÈQ qŠ¦~xWÓÊ=UŠš™§]ÐmM†ŽÏ%Ì~™×ÑeäŒÜSݸÚÊ,‹Œì ”¶>7Ûu{WdŽKòµŒ‡£XN*äü8Þˆ¥JÁ=ç‘ë²çtâmWÜÜ%¿r.4ûl/\“/$—ÈÆ?…OPHÆQ§®ï¡ÖœCÁ›”£¸õ(õ›oœöÕåÕd9·š<ãó±oyå•g׊²QIÇn:']"£—ü‡C~)‡œ"ó} ªs«Emòî´y%:Fp} «¹â¢é¸ƒGÝsZHÛì9qÇ-å&¹¶Œ³“ÎC{àS³Í'”2Î_Ûr–Iɸx—IcDßG˜Þ)y'çî>ú<ç1þz·“Óå8f›w]ÉLyUw ° ØæsHX„SÚ­¬ÄVÔ³6ÛiG§Ò¶øÝŸýÇžýÝÞ)Íüí¯Æþ³ñ¿ùåø/~6þ‹_Lÿöﺆ˜ÖÉgÕAl€m~b‰ˆrJÇ’®àc™&ÝŸûýðé?ûùǛК57bm°ÍO9aù©¹ßþ~æïÿ˜Ò…2ë?Ê”Sƒ0ÛÜŒ> ¶>ÛˆGÈ${.¬:¶ç›ð‚èeý:¿§mþîŸ2ˆ®š¥²ë%vHs‰ ’3;|g*(ÛŸ”mð{P˜v±rë6Sª¼,…ÂÐwHŠ¿3»0Nï”ὄð×·ŸÈÉRboÏä½·m2Ÿ¡P-šéÙÜ¿J…r ²·¥i¹•åUðÔ•7:åõäm€ÏÓ6Duv`À.ªÝ2ñvÚWéwÜ=m8v'f~ìkµZàiÊØýÍ^^1Ÿ|½?ç‘ðئ…Flfm½ðײ££’îî‡Ø¡Þw³/£Œ¶>OÛàí]K«)ëí ž‹ŸÁÇf M58›S7ÐM:~Åz—Ÿ™cKfE^9¨‚ÀÞ; ìâDðžTS{_›#éåxKÚ”ýû,bROßØæèeáVÌçŠFÈ%q-œü¶y¥Å\›Í‘‡­ùØ%lÍæî{#®NÔ¡à@WC×ÊÃ&ùvAYù®ð¤’ù<¼ã”WLª¹£ß6ï´¨«“Dk”{þôïoòtîtó3uñ>Ò…÷A¨„†Çl‹¿å\V·MJ:zÒÂ):ã!Þ~xßéÛ6nþfŽ!Mù¢]Ã7lïÑËÖ.~æÎáÞ‡ºò‰Qnör÷liÜ{ô¼…Ãn ·äØ{ˆ»ÂÛX~-ùè%k—@3‡ §”;\rŸEÛðí¼ƒÏ¼ÜíîæðõØÂ8]{²ãMýoaÛ–_9í›Ží¦•ÞÞ{xã° ðIÅ6U(1ÊT–U'1ò9¦Ñþ?rO˜CËiï9¿ÌêtM×cùDs;=]¶†¾ãŽ=ÅÑǘès4<ð™Ä÷dØÐuñŠ¤Ê¨î)AùÕ³Ûԕ̼²¯¹…D2ØÅx^)jo•¥ïÂ-,–.£àuj4ùèEeÃ&á\ä¹^îz]1îölAÕ+sªºM”ON±{h]Žé}~—äédy¶éKÏ #µ¡Y¹,)iÏóX $ð÷Ø¥x­ v5ÛT£´ÓÙòtïsý—¬º:-ÃÜõ%eî¤êäæUZeƒl#àÌhHt]EÛÚ3Ú O1¦ÖV,•­9MJ›¤}oý¯Å·|h¹mîÌ{{¹)m.–‘¼‡¥»ïtp6U†î”QGüV5Ú¾]iK`ÙÊm˜æG4Õé¶iOÉ!ª°]S‘—ÖsŠ%¶*z»WS†â^ŒòJ+89£]1¢å»}›hþw‰~Rºy¹dGÔªy ¶NbeaíÒ¹üÊ_ÙÛ[³Ù‹Íb±˜ª›3ÊWÚ¦7¿r̈Aµ;6€Y1(ÖEÙ(-§¹;ì`h[lß-:J†Æ†Ê¦…`àÓª“JN¶‘SpH­]’“Â$ÿ»%ë¥p'ˆÇ·éÓ–ýÒö¬Ø6-¢•œŠY´WtKŠmÆÖÝy¬2ò(‘ŽUE|Ê­¨W”–œóÛð¼<]”mbG¡Ù—ÄÔ±ÛÆ9³NTúñ¶‰4fÐdl\,©ŠŽÉ5¤mê•6É8Ô‘[q´*òhUrf›r¶Å}ÿcÑÖË÷•¶18°hM¶vbMh„ï¦øøcRRv™ Èɜαäî½>”~o|oáašòê¶Á¢¦=ûìiÆ šø¦ì¶'ñ ÇÕÞFÙ*,æxÕÂQŠ>ݱ ð©•—·©0¤¶í©.|,šf·à uVP Ω™Öce[8*»ïn1uƒbhÙ;Ùf$97KAÍ2¯V´òœ“YøL¸ÓºœµvE£dN*®àœ;·¼ànïÓ’9©¹ø„ü:Ñ4»>!ö*†‘o°ÍksRfg ê‘í6 5[.>ßníŒç+ûýãä®å×ðÓnã0?Venðúv†Ü°üšùô’|: ,'E·K'ßãVLê°X6ùÍ…uh½(վВr¼,Úžˆ½a UÃUmƒ›ð~›Âˆ9rTž³“òÅFºS C ŸŠf μ7š uRÀ§Ûà÷TTB(]NZ÷×±gŸ%œ«w°7Q øßÀËv{;³ \¯õ%_ëÙi¡§¼3ƒ˜2à­msz¨ ªw3[A/¸8©¸/ùj“¹ŽŒÆîÒÜ*ä¹Û¥çùùÞ µêJ»´†üG¯tè4«´‡É7FòîŠÊm 5kReÍ’«“¯÷')Ʋ?¶_OámW·0"1Ý6µΪuR…¥uj rVÜ^l×¼|]™:öñWz“¯=÷ °•UõÌ&n|gÛml“@b—»w»ÉëÆæ>ÅmÃà¨Ûí+M¹1]PD§)Fߘ•,%ίão×–Òð¹‘rc áà!}K;îjnõJÛ`¡#ÏDKIW{³žëQ"g',¨hÒ¤H›Æ?ÀŽRÒå:]¥&1õÛŸZë>²?ã­–í¶;XLƒ­ap"³ŠY'¢RSU8 &Kekĵñ8uúzL ÛȲ¼pÛdÙJÚ†ÃfœÁ§<È}ðÊÁÙ–…­]ÅÀ)«†¬ÇÖ–¯È¤3” Üv’¥²ûŠRØLš†óÁ‚û4†f¼`§äùöí[™L¦’¾]àé!Ñ,0˜m»mc£LØFà±U‹åx‹Ó–ÚƵ · ¶§ÉÇNÑY*qwæ°oÅdgª*Ò±5ºæ§>"w ߰н Ê“Å1ñ9šQAL•…夌OFf¦+±ilÓ€KÓ+Ú £¬› :* Û"òf~í¬©&=Âl£¢ëUŽÛF‹FÆ6XJIv¦ÈJ»’#¨ãeÝ%ÝÛ·›cƒÏCí\ˆm€OÑ6ä3»ßñÁ ªñy‹34áð,[NV‘“c¹ÃÝpÅcŒ‹^y´j´Ø Y¼’¼Åi›×LþI.'hñëâ1Õ%>‰×/±=\rd<Ñ ¡dÏ…Å «¡}Ù®U¾f— ÿ,̹ ¹Á+§‘Zø9³ñIbmKöhñ'$ºf¬ÜMho|Š¶ù„{e’¶yï¹2%æ“úñØÛ|,¶™ÿÍïæ~ówgŠÊ.dßx¯”{÷¨“š;äBÞ­÷]Õ»¤KéWÀ6Ø棰M7U»[…y:³ÿØÛüÄ×Ê­D‹û^ëûxÓ›C¹ÕXè`° $H`l l€m AÛ€m AÛ`H`° Ø$° ¶¶À6 mÀ6 m° $° Øl ØÛ@Û`HÀ6Ÿ6Æ;=· L8 }‰[èLØæcÄÔÊNËÒSc«ÛBR1uR4²‡駙؆¶:zúQQQ`›O€âk×¢"#!Aú‰¦¨Èˆ€m>R.]º`° €m° ¶À6¶ù¬l`›”ÞÞÞ ÀÃÕ«Wá üTTTÀ ÀGˆ„Büò• Äß|| À‡S á™i!Ì yØ£‚™—‚!Ÿxàƒ¨Fˆû„‡BÕ ¹£/’Ã[L áàðÁ…Cä›Ðõ“áí¶Aí¦A[<›õE9+€wÌ/Iþ´Ì‹YÁLnWX`×–À6SßnS¿6ÓSíY à°ðî²òùüy¡(ëDÖð…pn@0ÑbÜaÔjìÝ»9½Åk½ä#mø~¶ÁKf¦^ßDü-àaÞ™Ž †ƒšº,¼zõB·÷Ì?›Ì… ¹+€w¦{¶« ÃOäðn>o‡ulõí4ôo×/茞NðÑ,ÀûQ5UâÛ±yxnuxsAü3{ÿNóУ³/b ç±è‡G”çÁ8¯ ÅYÑw=DÂ/ð•ôwuô OL¾hïè]²ÊÞNôä ª«CÏÚÑŒ`ñg‡ð…ËÒ³n$˜YeyÝcÔÑÓÝÒÚ?Åìí|>ð Îðãd¥žÍU¶ZÎuã—­z•ØcêÝ¡÷ÍHÌ „xÔÃCó|Ä×¼ÙÛ5­ßý‹•Gulr—(EÈ2ÔÚžs£ê¸—Š¶ÛœTÊ0’þ5Z³ý¯ß¡ß/~þ Ô0"úJs6¾äOÿ‚þE"ix£éVÑëýþ¿ý#þúŸÿˆÌeäÃŽ%:o¶> 'øqèšn è4èšo¬R9QÖº- ËäÄËt¢à˜GÞÂO=²Y±oB¡¸ÑÑ*ÌŠ¥ÄÿÛ¥¶MK.X¶²×üôãSq†EKÂìÿÏÜ@ãµ:.›Wu_mT¸~(Áv§ÝvS=ª–õ£!Þ‹oã•ÙŽš‰éöÁ9T™ôßì-ØÖÔJ|Ø9Óÿ¸˜[Jdsšö¡5?C½«úQ(¶ÍoÐÔör·MösñŸüâ̘WóÂÊc·Úæ° öàæuë]ÏÀ ü 9€¾±ÿn£Sg÷uûv˜ú¶šÌ '„™‡úLj»ÇÆÊQ-É»¹å„ÛºÇB—R,U¶ø“è/-’ej¾˜¢æT©õRáûÈåžÚë‚Ž·ðË£2-Çðûø••p¼–üÀ~Gu¥€ ø«ñ&š^ôMrù%7:Ëûþ"ÓÎØ¡€\8ÞÛr÷aíÒ’B+!êèŸ4EËV ?pÛü Ý­Fåå¢ôðêŸ|m„KÚYá+í{\ZÖ4wðCÚF89?ê×e˜ÔíÜiÚfÜÂ{ŒE4¸j„ŸOXÍË7a˜U-ÍJLz0¾ô+™ßý¦äR¦Ñ³´¿ÈY‰oÕWE÷”2ü¯çe6nÄŒÑS¢Q‡yó<þLÿeÚz½.!ny »¬o’übÛ+#.¡³©;ìr¿ãPïâ /·,êÁ[ýò—xúÅt¨r±ÜæW¿ZL¿\ƒR¼>¶€¿ByÅš è4öéÞØcr¢5C(ˆžŸŸQÚoE†ç…Æ¥ {ÖJe·-ü9éÔr½=ŠÙæ ºóB–%ÖUÉ=¹TÒ6CÏΰ EB¢ ¿î‹ G ÛP9µƒ¤¾PÇY£¼·µM¬úòb4ò²µ·£¶Vô/¿Dye‹9©ÙÕ‚W° ð“±PÈèØÜjêÝ`,Y& \vµ~Ò±MºÝü`ÍÒòWŽò_…WòŇaÈZZ&¦fò;m3Öu›Icö VÜöïc›ÁãxèòP¸ìÌ¡ÿ5â–}¯rø+ÀçÍøöèùv™”Ž^FüÏô t³—Rñ!«w^=ùzíŸ9íÐÐp,E6 g¤)ª­³x¹Íkm³Þ¯ŸФQ ïu‘~r6ë›j²ÜfUÛœIµ5Ü™!2Âä«Þþ—«oâÎ/ÑÏÿ/ªíÛf ]ÈÂtò©Ø6¿]åÙ°h±7ÛF85Ô×72·ðC–Û šzfÜb†=,yèsìEŽ®á±MÊQ·±4V`¨ì»ÿ[$ª×S⨙;úï¶ãÈSÝsâ§)õÏTÇEÛ¸(º‘¶42dUt¶Ä]½Ÿ¤L“ß¼ÝÅe‡)£v¬î%i9ö‚mÚÏl—3ÌÅlSýM²ƒimmÝ1*¬ù:RZÓZ¸ú&ò‘ÙZôó5¸a~MüûûB'›Dh&Ìó·¿A¿‘H¿üŸ%±Í¯ß`Á±­šïE¸#€Ò6B$@'ž§6Ï4x¯©ÏUºØ Ç›œ›šžEââboŽX†-œ}’?3:6¹p˜¦§Æ§fD-bf¦&°OÎÌãoÎÏNߟž­MÈÇþä‰0nrlb–ø >ñØ;¼Ù鱉Iáë·MM ‘a4<ŒÆÆѼD[bþ ¾pYzµäû#C¢æÇ«1?Þ²-±îà‡7Q .?cÚØeßï‚ãÀœ—Jd*>=ga _/ü “.ð¡uà >>¤– …sH8ÏÇe3 ²àƒª†c<|¾p^(¬|UuwðÂç3Ä?’m„B>:žj›yœÒ¾Ë¯Umw³&Ì• À· æ•1ÁhzK€_»™§Ep›•ïSc‚îT|Ÿü’äÿHË,¼5Äëjuî6 è0î0ö~¶¹n² B¾—l„B¾pVbpâ ˆ¨¦râ¶_Û–Ð6 ¿ÃgÆwÆÎñ1˜tà{Ù†Ïç÷ñ{Ä!Ÿ—ǯ/õjÕè4uïÕ:Ø<…O.Mð½h˜ªi2Ÿâƒ>ª™ïâ5yujûw¶ßé=CD;3|þ€÷£zꮧù˹Ä_¼þTx»i`›uh“qêâmlÄ<à0úÉ›‚Ä:¸ ?Ä/îleó­¬Ýþ©Döµ ­•G/$>yÌ)¨ )BHF±XKŠú°ÇÇ $£°ü-ª,§«BòTÄb"&‘UPò©ïØþp=¤m‚î¸ð‘¡«HFiÅÐë|d(‡Šžá/4Ö¢œ–åû›f‰4Ú@ ÔåÛ¦° ÕÍ?¯;íê83\âdåÞ0ÿñ] e'ƒÒJWN³*>¼ßûRA÷¦?ø€7aÿÝX»ˆk?fVªu¶&°Ý¢®Ûûy4ßíÔiæQ¯ÛÎoDx+¼ Ó€|€×+cV_Þ`àÝ¿8p;—cš¶tpÁ±øÝv™×ºJ²45]ñyÀQ%>ìðÂt3'ð9yŸ’ƒ—ÖãoyÄ£x‰›ˆÆùµão9G¡‰·bbÑö–SJ݇ö¥ pôk¬ûëTŠ„UhÍ/ÑïÖ : ¹¼ø­ù_öiúç5(ŒøÝ—ƒþCyq® üZšCü5Š:]éøìZ²mÑ1è… ¿á¼Û`|¤Â˜£W1÷ñ] SôuÜ.¬¼Y˜Ê¢K…oAÕü³_œMÒÓ÷¸øoÃÎo¬d̾ţ}?=®¤kº) Ó m¾;Ç{“#›­ý;LN^Æ[#rXtá*UWŸž-x“]mÏ›ºûGFü©‘¶æƆ†ÆŽÞ—¢C>Õ÷´åL·57444õ½ÂG5òçÛž|ËØd\ú¬µoÿØøÐ ì{M-/ÇçD'Š7ÝØÔÌò{;žÕ×7vöâC£Ï¾ì=”è¡k‹­jN€¦†û[;±ÏÎ×î=VŽú¨oãó`Hئ$}wR\\OØæéªûEØæÑôjo¶¹1 qZð%7GW?8áZˆê€2äБï`›úÃhÍïИÄe3xÿ•ìºêÃ_÷­òk“êêØQ ppÆKgž55LÌ.­ ­oÂÇ|Wkv0»û_‰âKbüç¾îöÆƆæ–ö±þB,19Ò÷¬±¡éYûøœP|ëðOb‡þYÛÈ$O|Òyý=Í­Cs WÂäH?¶MÏFgÅ_Žt45÷Ž­´®Û…™Ñþ&l-íøŠ=Í—”6jÝnn{>9ßÕpŽ-¥ïYÛ‹i!´»¾í%öUsc}C㳑iÞî2Â6—f^õkî˜ä-ž v¡>Ãwåùà˜øP ÁÌxG+v™6¶vôÌ/FUüç-ØÂçÃÓÝß.ÚF03ÚŽíaC£øúÇöu5=žyÑÞ\×2üAî´ž‰¶€.£úùʺ©ò€N ®-Ç:Ó‰¬øï3ÉMo×SRÒ3ñrµe0˜17:qô< ËSumvÇGûkÑä ½Žà§ >y¦gÌvô¯g…ZIoP½?=±ÇóâäeÕcÓ²J‡Ð`q]^ÁÎ7ÒßÙ[[YÏþcò4NŠ–g÷pv”…™ód|¼úª£•¶š¶MZzþ8=>G1°Å~¤¹âÁð,îilM®Kئ;[Çð×z%®É×ØßÖ×ØKÒ6äÊæÐÖ ¢†ÕÐkPBzþÿÖóyѯ§m0þk ÚygÑZ;þ€þAüùÛ L¹OúçÐü@mË Â+Mªt¹’ι%J꿾®—a«žñõdö±Ñ{_°•Ccâ 57q,Z YßI’—U0uðܹ™#/cÐDÕ3Þ*tºªwH„ƒ¹>]E¯ŸUþd¬-]Y= <ÊÃJGVJù:1]Æè½=t9yëÝáÁîVLåj9à„5S)¤x¥mÔm3ÙZ¾ÞºŠÖ–!âMq•—QŽJϾÞ3q`¯³¼ŒjtZö4uÛKZß×ÙD?÷ÐѸ]z2›6×ϼö±ŽÙFÓ6ƒÃÒÆ֬æh›‘úàu³6Éëìð ÙÅ‘ßt¨ŽøøÄvmº†eXX‹Ér,$·ùœ·*…ªg¥¯³wi~¥’,EÝÒ3.ÜSY^Æ>M4Ëê^w%3§½ u ÷ŒGä¡>8ÑçßmxãÕ¡ÖíífÑ­ŽB!Þ=ŠO4%þLlÓÊÝ*k–I>+Æš±·c·ÁA7–Îîs¢Âˆî2rÊÕ“Ôœºî+úÙ^у-¼¹ÄúâÌÆmCØéœìUcÐÎÔˆnäæ#¶2›Sð5ãó€Ó£nv’Ë+öéRvœÁ^œK³5¶ÏýÊÜôØøäÒ’òDØæÎ-|*Þ“—†™„m:H[[œ´ËñÅ؆ª)ñ–6²+ZÛ±©+ø’ǼUNù‹´æ^„2…þþg¢ùòÞÒ67"ÑšBÓįLµà?ñàÅ¢mdUŽÄ¶Y§£å;=ñøccc¼eϽÁ›7ÒÒkE¿}6DIÝë6>ûqIÆ:ºÅ q”ë£nâz»Ù­4ä3®G^n®p´ ñ†¶Ž‹f'ܧ+e;çãv”µûÅâzúàFEË+Áܨ"åÀ½nQ^à´«”v4Qž$œ›Ÿ^^´t1ÕHI}ë(q1Í4—¢ëð„hä‚Ü:Qîið”Ìz“~âåt‰Ô:Úu±õ½¶ªæÜ|ml“l¨¬iInòLÙt½—DñF‚ cgâ]‘«k‹6ÐÌ°ë?XžsZ”ïöèɯ¿ÜƒfûjitVy/ùš U“%msÀCÑÀ_4¿Ï\ëiŠv±ý)¾Z:VKŠžÞË6Âþ„o—QhǶ°ö­ámfhŸœW€ÿóÙ”ÔÌ%hÓwž|²ôïYóX ¾öGle7ETseRìÆÅ7D¬Ûò¹2_a:íð…Åׯ_;ŸAÛ Ò4'š½® ŸO ÿbûÙíï0W&i,yk£Ÿÿ'ê—ÌD¶ñMBI i/â–,ÚÆ#^â­$”}sÑ6†vÈÝ ¹»£¦øŸŽV‹‚øˆñÈî°hI±ú™æÛÚÏuâk.#nàâDôó?¡bŠÒ6á(YbÛÒ/¿í¼¹^N«K<ÿÙ\#Õ'°Su9Á]Õ)bÁ eGb•Œ„³OU7Iß^ÒR 1Õ~ 3%",$84ÄFMÞ$/Ð.Ø­K×µË>øí“vÑ4‚3/Ë)rùçngôæ•\ú:NõÌëËmöéë8ž gßAC%ä5Ú±làðyÌ6"aõŸ”]oòBl›/^ “ÍíaiÊ}CNJÏù”hÍ/ï®—ÓìÀs…½&2k}’›W|÷Ö u Lj˜±çñÔ„Ø`ŒÊÆ“õü¾Çß2Øj/gE6¯ÏÙLØæ•ìZ§‚ë׉5ܹuZ_JÛ†[4Å[Õ>üò‡*B!f¯› è4òï1òí2|4|ƒ¼Ý>·yÀ}”¢yÀvº×xT–ä<à )×;ß=øpËYƒm¿ËÍU„›û.wG¿Zƒ~õ+ôûßãéï~C䀆Þ6¶Á0û{¤˜†¿à¬A– 5 ¯ÍI½­mäuž‹§vÅmc‹ßà'"œuÝȳˆ¥šo’™†V©‡œ”GãKªUùÃO”×orˆä>¬®kn{–i,mR ª>+ý&×Íi‡¶’SÏåé0šî¿Î¡1l%N¨›³[ÍØÛ•Ý߈Ùfæ¶QZx¤ò³VÈx«Râ—w7Èkvâ¶iÑÝ$cæà¾x½¹¹ŸêFÃwãeäT“]~ü´¡±¹v3}ý©AwÅ!&[d^t•·ßJØæ…±ô&#»Åôðð<ÐŒO¥x©8%–~ÀòQ,Rõï4n1osAèóì%8jÉÔI½/ºJ…¼¡—ØsmÆó¥ç5Q™‹nÞ ŸÛ<ó¶™ì}Ä¢Sš^‰Ûg 2ð¶Yì3²Ò= ¥Äx·|ôßk¼§ø }ÿRâ•Õ\ÚŽÖlX²„ý?È,âl3~›(tº…ÏT>‹ÞÍ6Û#| Û<Êò¥Yù/|±˜ë§aæ#ä=×¥¬¿ÐÆ'¢3c##“ó Å9, “>y°§B•¥Ûy¼ÅÙ©süM¶¹eóÇ•)› ,6¸'OèëN×»Úf­ÌŽ—╤؛XÅzGÛLØÑ¿Hªœ ãíu±#Á‹ÑWµ)º'Þ›´å1Ûðë/2Xì¾i2¼D·}9„mx>œ¿Ü™ï Þâ—üfÇ„ûðNãñ&ýzô½º ëÇ}¶-ø¦ž¤Sd”*‰r÷†ƒNh˜enåíRÒs$Ÿ;MS”õÆù¯ŸüÅQÙ/u‰ËiŠNwÈå£eídÚ ß`›t«DráHGÝù륯m­‘R¢jûÚblÓñzÛ¬.¢×Øfyä;Ž6ɵK–U¡5ÿGl›¿YqÁ,µ 9öÚüý÷Wh¡„@Û”L¼®†pñI07vùü…ÁIþÛÄ6hä6ý/òE¢Ÿ°e®u=Ò…ýák¬nJV¾Ì˜kÒO×½¸„ª¬C–‘•Ž6СkÄÖ!~¹º¬N©8nÉö3²ò9ˆ³ŽªœíIÈ…u…»h[ÓÉìLgé•«5½oÛ¼º$ÿ…ª¨þå·rÑlÛFn“TÌi2¬ê7álÜw±ómƒ…Y«“ŽÅ~°,Ÿ¦í€Ö#Ö*JAßg$ÂT—Cßt¤r·Ò(ŒÔû„䇳ddÍq¹ç¸(Ø“å–õgYæüo"àœ {º=µÃ —6ú<ç'òþÇ’•irŠ¼ÆVïÚü@ðÆ%û²™,E6SÛÜýn3QÑð§uÖ %¹¡;ålcI±Œï6¤}µ^.ôÊèI˜ƒ!…Æ`3h&»¢[FçðµÕÿå«MU"Û´žÜòõ4ì”ÖžgJI¡«µ +óÿ›µeµ3ð¨8–XP‘/9€yà‰8ã³4ÁÞj]ý­ŒëX>q¥ÿ;M)ÿØÈÜÒËBˆ~»¹— Þüåk^ Ê÷Ñ’‹,O“ØڱʋշÍ{yóÙWO6­¿Û>»déÀµû‚ÝÍE§ª+˜$Ÿ =•g­´YŠÊÊt¦FÜÁ[¢(dôYŒ«‰ô&yYYJpÆÙi¼a,ÇßJšÊV×ÔKX™'µVÊýt}óC*“ÍaÐé;R»ÉÓõª)ÖÕTJg3i†ö¡õ¢Â7Áýµtÿ«Ë6øtœ{ç·¢‚ê—·ÿï´V|BäÙh+Å/×˹ïÁnAf,ìµ÷ٙߵ:q—ŠBtÔ•äÖKíN93óú†-§¢•ìΞý÷/m³ä<´?΢@á°hªFvWkq ‡kõèòLe=Ó×[&óýLÖ­§c?Þuï€.MJžÊÚâQuÉéÔ3ñMåŸØçO§R8lº’Žåé²vòŒÇ9É[FÜù€),0ošªá5ôŸi ¾•çW¸2C#9w±¨tK¸øŽdÌ/\åi-”xW(…¯òP®ºòt —?þ…o|–|ç[o(0zÝ[o.c¬Ü5á÷Ü6ñJŽX«•®úኃ)\uc—Ñ·ïñ'”lý»ì„âÿôØæ–­|r-^!h•S*ù/·Q^} «=W[3Zeó–oò›ÏÅëvðCÏ *”x†~rðgwdþ4Û7äÚÜj{õ>÷ a›˜%orbbr%Ósp1Àtþôúè}Gÿô]ÏÿljX²‚W×KËÓV mš—ïé+É\§ðm>ð1óÿsmP* endstream endobj 1009 0 obj << /Length 1305 /Filter /FlateDecode >> stream xÚË’›Fð®¯àˆªÌhÞÀÞœÄvì¤\‰­äâumÍÂhE h7›¯O÷Ì€^8öEÓôôôû%=D4z³øi½X½:ÊI®¹ŽÖ›H¤š(©¢TfDæ"Z—ѧøã¡« 3˜eÂÓ,þ«·‡ÞªÒ.FãñÁÖÖôÖ [~^¿[¼Z/¾.H¤‹RÌ%Ii»Å§Ï4*ÿ.¢DäYôä¨v‘Ôœuôqñç‚m¿.x&ˆò|RFR…ÌhÊòZ½Ý¥YôK O¼aù‰aH)@˼M¯þ1»}ª*·Û€Øº}ÛoÁŠÕkÍOø1š– PűÛÃþ®hÛ/•õÄgµeåH{stÊÑ ®)šj"”‹l´(÷Q€Ðh®Ò,êÀ+WÈÇ 2Fr¥x0žó”PðØQÛÄñÎ,!z.†¶œb£»/l QÂ%È,Ö[;çpŠ:ó‰—ò˜_ðÌ9œôEÛ H—pÆ»¶¬n)å.×à»êñÔñÞt N4~]¯ÿðPg¿lè¶Ö”ÀE©˜,¡iüva¾ õ¶ßW÷.5@ÞÐŽÄC±õ`¿·EµIО(aŒ þMœ»µ·ª¥®Ÿ± ò¸m|9x5ñ¸ä*6õ!”‰3Ðá>Ô§qòòÁ{.ÏmÈ•·.œ[àQÓv;SWÿÚ2à/¥ö¶éí(É þ¶ \ÊÖN|FÆMQJ{Áåî–sy® ËfÌŸoÞ@&îÐ[bT`7fg=Ö4¥Gõ"j†¶[JßFÀç`Œ¿ z½Žp9bœqp"/â¡3U]5]˜®« åü]g‡C×\Hâp½±6àn©¢?øýõ’!ȈǮG>W–LÅÏO¶]9Škæ\pï¡J9µÚ°»¯3T.5à⩶‚´ñÀ¾³˜&U{è]&nÞ†7ž8)¼›Ê¥÷ˆº _© ’PÉƲ+íÄ_'ÏI–e#Õ‹F’dSS+«~0M1×ýdJ2ξÃ^‚v³éí\·ŠdZÿ¨BM[à(ºf“HƒI¨ópajÌô3M²4Ybœªæ[šM}K\ÿ¾ì8V\Á…s-EåD‰É°}ÑÍ©Í5‘tòâ|6‚ÌF˜ºo=T5ر& \Ëèkø°Á4Û¸ÜÓÖ†ç‡Þ×Ó7•æ0µš´^ý=£3“Dʉ䤥»Fæú' -’f ‚‘ÂÔ ÇË'’”S?÷¨1|Bh°»WûÚÛnƒÝ“Ïcæ6 ›<ûñÙÄ(%TOÃé±'s¥„ó.?cúÝ5Cج˜šø›d¼iØ•œ}ÆwSöœá\—XD@ºa‰„aÙLS"”8ÏfÔäfµº¯ÛR5Ðí*SÆ+N_ÑtEóU¶ºäÂÉcŸœX²:[ \—;‰Ôû0w\7»Y&9tqØK—> stream xÚì½õ_\K¶>ü?¼ŸÏ÷½ó~ïÜ™;gfNÐvÝí‚»;Aƒ$„(D BÜ(ÄCŒ(„`  1œwwiÛï–!9sfæœ{÷óC²Ù]»ªvíª§V­ZµbÀ€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€à P*•K.Ô?ýÓŠø羑¾Ë…—ú¾:,ÔyÉóŸ0ø»Î½EГ~Ñ­%ß½ZüFZ?Gãèyå2o¥Ó’+6Å/ëzZÊ`s-¾©ü—ˆ¥Eýº ò?áŒýy_µn(6Rÿ”;ù+±Ù•`lûë0˜œïoì›1œ@îonnbd1-W—uƒÙ´¿ý5,éî÷—s9vü 8Þð_Fœiì|àŽó~¨4\+åpÕÏtGœsþû*ž€ÂÜhUûÔ¢ž)}ueƒ€'QXGïëͬ8%ÚvKÚtýÓŸ8USðSðƒJÙ+—ý…hF;>:rˆ‘©oÔÙ*?g¦ÿÕìÑð²o5ûÉô?pŸd 7æFëLñ¤9ƒ#¥ó‡ŸêÜyæó_6i¿ÖÐú’""½B_b¶·z½§ˆD0³ ÜÖ6>¸ùñ«{£ƒÉà$\x&S“Pæ¥Ý 2ÉœÂMÉüò+ÎŒ(¢¬=ÙuÚ#b3í;³'ૹ¡ë7°h …LåØžÏ(•+ÁéªÛD«ÈqÅ¿h>ý]#ÖÅòXa³vÛî­:üfr)W+õÍ5Ë·0ücç’í–mÎø[ r½–þ bú¹Õ#­¬Ã ¦”G²Ù. §kaœ—]ØÄãc?ÒWº^ùB}oâ›9ÝV‚ÝOƒØ¡Ï”†e¦¢‹îënòI;*§Ópþïî&ñ|· =ŒGß[6¹H“·=¢°"%ÈŸïÓîПZ²vríÖ /Û÷2‘+öÙæï±ñ¶Š¯®¬³ܺLJH{6²¬Ð2W¬bWi±ÍüX“ßÓjlÝ×ë·5">ú®©\÷'¥>jq!ºòüˆÅL¯‡®ÊSâD1iÐÅÝ}~þ;o¢i¹P|Rš ´©«^ûÑêùXÐKÛç–f¨W^ÓÛ¥–ÞÙäau8¿Q;É.±Qr>ô¥ä'ÍÝâ¨nË:\´SE­ÐeÑÙÞIé™ür¶•µ¯/Zrèt:Í'æàèœþ2ò™´½Ñƒð2Þµ¡dø)³¤Ù'×.Í?m{à–kEei Þ[.j>ïX[©‡LgŠî¼ï…æèâvxâýZh/ RhÞ1GFæádåg­÷V^ÞÊfbÏØ¡YEÝ!“Lï3™ÐT`þÏ”JÀ%lóêùf ꩦ/Å:P·îˆ_‹° ”àíí\:…Agm>õ.G^Å¡Réð‹Ò©dò_ùÛ T©[Ñgªõ° ~È8-f1¨dÚêí)“êéöþFÖQHh˜aÒC†;ó£Så³èÝ¡/çø–[5×ö@áµüDZ‚‡çrعò±¯xº¨UJQ`kNôÛÕ¿ *¶Q4|¬ÁIs²Šm tÒÎtpF~Û@ÕÌÿöuX.Ë6ðgz´Êùtáia–Wù%ÎÏŽN¥­Ùª¢ïýŸñ¶*‰R>C"z¡ tÝÇý×3‹´Eïk³ŸXÕZ’iõ;vD,v}ÞGu¹°¨¹Ž=ëG[¸áQ õê4P1oÅb}Ó}/èç†{ûœ7¦bväpŒƒAçZû”· MÓpéO‰ o®Z XL¶Õ“/zdAƒl£sÀ3^-p—L2£¦¸ /®p£“_Æ6SS­%TKwôVGÆFv(¼ŽØánv¡•±½iÆ7¾ÌÂ’ÿ¶ØwTÏà‚þ÷ ˜¾€úh9žà8€&˜`XéíˆÔqÜ`P?tOƒ“…,sÆ'äãW=:ÀòÞ‹Ùw|Y”Mò7‰;J ‹m¾V7Ë;{òÂŒ{ ƒò¥lS4>nɤôH”HÏ :ν’€²Íû{q–^qhÚ³>l‹]¥ÚuÞ J~𺸵S—R§‡m:ÒØ4· $ñ­A‡ÑmÀ–`µ€r¦Ÿ ˆ¾Vf¬[—t¦j^·MŒ)Ej™K2P ¬t›«I`Ênž_XBh¼0;jÜ“E3·Û ÐeùtÆ£ŒY™ò»ÙfîÙ£‡ðœ²ÛŒeG‘|á·ñAgÑ› 6ÆG³GMw Û°Ù¬>„r’üdÁÍë œݦÝ$u7<,c  ;[ÅÞ·®%­aÒÈ뎎À-–ßÞk¶G&ŸŸŸ^Ç%Ÿü<¯˜f³X=UÏE´–yú©m¸‰Öª‡9ïuÚR1ïGcìÌì‚ÿ”ÖZRÌ>ÈÀÎÛDþba?,·Ö¿"ZøýÛ@0ÉX÷ ª§%³R™B»Ë_ÙퟒñÉ/cIÇ;˲´kF¡Ðôò~+ªyã¸RA ¾8¾ïÂ6îž‘×ô®ºÄ|Ï ×)á´m7á‚ÆÛß–Žê$RÄ639»ƒl¿€2ò†Âfã£ürÛÇqÍ-ôƒJJb)Î)Ðo[|,¯—´,£·ØæÍ°ô¬¯Õér¸§Ý<ú´&÷Ü6„m¤Ûx&Éï¥h‘d²˜ÎˆÔÿ}g‹Ÿcâ}4ƒlƒ¼çÌøp{{û»”­@ä)xœ×frý7ÃÂõDÉÙr%Wª—ÜJ`Q‰ÃR­Êuˆ~4j“Ù‘Z&_¬3¼kO‹vËu×&yG\XBûÉ%‹—åÙF?–c½X–m<8éï:ѯsu—åö‹Al'vdœŠ²ÞvcQ¶yÂcÒæ ¸r/÷< ¹LŸŠõfq8pºÿ”³LÒ ex¶yoö.«vLÿ»Ž}aqxsrÚ]:zUvÝYE žFYb¢Æ„â0þýlƒ´ÒPuf€—U`ƧΩ[®úæñ–³Ÿ, .–G ›´Ù&^¸ê02µ—úÙ@\Îæ <»f ²FÈ\$ :l:³Íe7ßy¨°qÌ߆­uQ<ÿÇú‰í<|£"!Dùz8|a]ñ`Ã#žMfVp°`|è™»íË„HjPä[=0Û8oÌRͲ8Šóùïf›yH!YÀ«{?­NfŸÛŠ°Í„—áV7ˆjäSŸÙ ‘Á×ÝOâM-¶JÔƒÚ Ûô>2©[]z‘™u{w+ f›Â´õ‘§>ªµM #÷€§mT†¶¾qÈɘüF­€—ô¿ƒ$7ì‹xsŸËÚósïLJ€½íƒ( ·¤E|óKÙ†¥Í6sÿÛ¸³ž}@o¦î¶Ú~ñƒ!¶Õ½G!¡¢´o1gjØ&/šÇ«æØ.k3â)xЇœü¤ í(5bl|N(çz Ùft^vŸëüBR õV}¦/‡Åb-tW:}uZ Ø}çgVŒª&jM)öÛL÷ÛØ"ÝÖ÷TÝÍÛäi³b§È(ùͤ¶^H¡Ë¤ÓÑ6"î¦gè§È:I]}ã“åqÒÏÁór…–~¯ÃÒÿ°w!l~¶#'‘ÁŠV‚CVóæ©%{( l£œSa^®'rèÆ £ª{’ñ&{SÊËQp´%‡må¬f…-_%ÛØËZ¼añ° ºˆ(Õ¹Çõ°šQÍ6ó[9Æ>ÈU²Í $Û8À²ÍXËŒómB¡Œ ±ÍqO«ð‡*y1e›½Ö„ÌaÕ8’J¦4zÒ“>vutYœLŽ¿• … ¼?$°Ý­ýëdÞnc—ó ‚¤™^AZ!‰`’·çŒþ£² 8èbnt·yaÔL|»Éá9(~¶©DØÆM¥^’M«Ùæu_¾ÙãË»I^‡-·ÕlŽ¼Œ¤øÝUªX¶ÇÊŒÜ(›t13ÏA6# MYl+P1Ëb³ºl¡›×cýÖ\/Ò[õùÑj‡/_ôfzØF)ŸG»èèØ4”üÌjg÷”­ÑeeŒOï¾ìðóÇu¶H¾ì16Î!Uîyr„~ã“Ð÷‚EaÞ,E–·àôÞ5vâÀð&Ë›“aÇT®ê…±ZÄ9Š£¯¨>Ä‘(ÛÏZtÙFgÝ|w£ãÉ>éá·ñ8Õ…§ðŠq¶êr‹‰èm3é8N ¢™m~Íq\+3À6[}¬Ï!P®xý¼yDnˆmÞìòrh÷*z´Ø,¿cퟠÒÛøñl’!¦•¸ñ)E³ÚÙb›»Á–öÇ˱ !ØŽC÷? ­HÜUC|5§p2Ûàî¬èÌÐÌ+{ §ç\Mi…ëY•qpEÉÁƒÅ8W7§3öúîãI!ÓjmÀ¹ äHJúD„}ŠÙàÆÆ€M*µ–û™“²g5Í É~•=·x°/EasÈìßQbÉel}Ùƒ$šÏÍÊšš_¢·YEÌ–|7ÛÌ´PÍxU¨2¹x?$Z ²ÍÕu‘Wab<a“x«\ŸÞº7Ê€\¤f¯G¼ÃäD_w,Mùh«•0^°çm‰ÂR‰ð«Ó4«^ Mv5dWéêmf]Éô½9=è5ž–ùczÙf Åf²ÈŒëŨnP²?Ò^ä·i¯^® )⤦K®qùœ/AKË;»ÍkïuŒNVÄPKÅ[s3SàÚË))2÷ÉçŸÙʦS!Ô.pKÓ¨nÔ¹áS[àÝçàÍ|tœ¿9kå—½$W‰ñ/¹_'v'Apê[Þ,g ù©ìoðíÒŠÚ,™•ÝðëüðÌUÌ„ò¶p‹üÐ óÎÇk¢ˆg*ÁømäßÅ' ÁЕsš`nfuø9ãÿs²dzÛàp9ƒóHmßáþ"PÀE¿8¶>µ·QÌg^ÚÅfЙLö¶³Ï ·{djŠc¨A4çÖ*Àk›¨‘§ªÁñÆ?sÕö6ýQG„@c°‚w^š›iwaâ Šëº3…am¯ ‹D"±¬ý jQqÂæçÿxR?‡…¼8ý@Ä‘hü˯«—NÈ^€Y)2ú‹®n&ÚG«¶†ùr-ˆÈ€*$ð‚9gŽ‡þÇÇDZW™xsssž€Ç/·Ã{R*eÑž"ÒÈÞ½¼bÇ¥š™™óV¿|߬žÁYdó¦‘E{R}‚ÿþ›”-(‹5£/ÿæ«_¼¬ÍVö©”r[€ØÓ°„\÷ê ƒL[¹\̪fàÌÛ$²©Ò#'¯žP …Hj¹?½hY(¥ú² 3ü5Zƒñ¶r?+&‘€óX¸YßʦÎl ¢SiÐçŠ9xkJ¡Ú+¿wx-‘D&Ö÷KšÐv¯»½×Üsç¢Ö”·ïq¤3˜t–øZvüh[Ú˜‡ªTiãUÿù3_¯Òg¸õýÆ;xDÐxÉW^LJUÒàühû‰ma<ŽD"2„NW^”ËÔf6É!À‰çm¿¶íÏÿ@(õN(¿ËÞF¹ÔärÑŸzŒ{Ò–†Í].éë°\j£•³^3½&"Ú&· ¦§Z¢Kím–i’¥¶ÄÚOë^+õ´‚NáúpIÁÏ’BÎç.ÎVçAåw~ÒƒvÂI©a«Ýì O{XuÏèÿˆz Ð÷u”Ë>°ô“-¶%6œ~™ž©T5ñDôÚ½ËÙEUiø%•†^V_;À¿äài~#˜AñoÛ”s»ˆžöd<ÍHZïÆ <%Ŧ„…ž?âÎcwKÿÁŽ«TJ_æ×ÿHŠ¬üêßïW˜ïoxß8ôïèGp‰I^À¥·X/þ)PQ˜•qãƧÙ%+L¢ÿûGÒþáVf9Ö¿Ìv”¥½øb\ƒ ¿UÍÍò³!½¾Eº? Ÿ¸Ñ£Y²x7¬8Rz¡eJ\î¼N¢ï:˜ƒ†¥\3˜¹û§Ÿþ;µdð ™ìÃ<§íz3ËÉzüqTÓMøÿ1ìÂWÕŸJÅF¦¹ï½6½y¦ï¼_t3  nÊmWñ© ÎÌÀý°éïòÛîwÐÅè·÷“Z[¸v £ê!ðT„›)‡ÊÆ™@6‚F¿‡: D"Uèú¨¼M©¥,ª{hôÇ?ÝéÔÃ4=µù\2nG~«†˜S½×{p8†…Ï›¯#á`À°"¶øòoŽÆ]44û/#äŸvðÛ[®w [ë}%Ʋö|ƒãàj…l`³¾NË@}>L2XEø´¨ ÍÖ¢]oPîô¶:òtQ­[Ñë4éeULÖ†yèf´Ãåüví"“mx3ƃØ6EÙ•Í£ãÛÇeê¬$¡Náa÷âwùz#ÚÂeÍñþ·š›‰ìøkeÐÅxÍ¡K0Ö‘0`XA²™)cš9L‚½VÆŒ/3*ÚÈMæ:%–\ëÅf¶Á»Ç»/®I~ÙÛg1Bß|î%*G¨Ù”Mõít§3\¿wm°áëàÓ]FV{Ðr*îˆ?Ëa8£Æ³=ÏY,[)”…tòB|“AøN/>ªDŠŒÖ‘‡ GºQ(÷õG$HI¶9dëº;}š’Øþ?=&2Yl&ˆ[àôÜñJý ]ćnuk¿®b^ÒPß ¹c%d¾ëF_ûáNÿ]+Å_Â6ʦlØm¿‹åÛô¿4cFÉõ®1`À /·ùxž…¯^ˆwÚqYµ&*Mqc í‘“¸`É{Z0<º}œøÌPÕAžW¾ûßØF>íN¢î/@NÝÏ}RÍ¿ÂV¾_E&ÄJÄ^3%œv®jþ”áb¶üñ 5g]48c¬ëo¢bL·Í8£¶&Í8èÀà;£¦cW‚þº,%Ê6E]W£D±iÚ#ûÅA«Ð#PÓÖdv½FZ³µÃoða¤=Îݳ&<&¡´idAq$Ÿ›œ/¸´ž/ŽžE,å-÷ÈÖ»`‚-e´Ù¦ûÑ~Þ¦ ïîíçÐIB—Ȇ1¶’€aYÉFé)$·ÀæéSïRM­TÞJRœ]ÂSUczª„E³‚¦GÖƒÝèÍœ ñî ÔlS!é-„–rÀD7›SÅ𹆭¾Œ ™ÍÐд4·Áª'1î;‹AåÜjóz»;…4bç$ò¼›{öÂ6¶Á[ÓÑÁ;ÝõœÍu‘+!¶[X0y<ÍûˆL‹n ¶ ƒØF6±MµÊNtÞ†ûüõ\ïÇǤ`÷‡Ç<aO¦Ê ÉXÝeŸÏåÙ^-hE3ò· VôȾŸm¾\ÝA"Sï~†ÍQ;KSÉ·y¬CaÀ`˜læÊöÒh¬5ááá‘Al!µq%œ<Þª’ÍÖqè´ èãÀÈkT ¬¸±O´á°†mÆ[Ÿ3Y,@ &“þ>·òêH¬Ãž[²ÏéÌ Ø°|²¹˜íÎô2Ø| DÒ|Ð~ÊmOšj%uüʆ³C,.aQÈuX Úæoãsè‰FJYÂ6J°ëÙóºÆ`U#}~vÜ"x+¨eú«TÊ]D쌦‰G[Sy¶é~É溢l³«UìLXößÿ W¶ž)Ø(Þ{7@¶æ$r¥jW¬6ë¬Eð¶Ù®âí‰g5<â*^—ÛíeE£Ñèˆ?Àb3(ø-7:–“m <oþÌS‹ˆ’021­ëP0l”_bë¤ráXJ‘9ήfWß=!ûtƒ=ô¡Joã}6ÖÆ<ùa³–ÞfÊO=€êm@™¿³¸¼uº;Ì¡8:²ïµ¨¨ëv-|Õê{èÑc0BÌ‹¹õ­ÐÎ ‹+yðˆÍ8äXx¡ “;ÁÆ×J--1LÃ¥|<ávÅðÛÈÇ­‰@1²’ræ­ªóV¤Ý7ß!•êñgã7Ýj–×›’Ø7¿ ŽfF+ÅlJI·Ž l#üvñúm!ç«Õ¡Š®¶'$݃qw_¡œ¥XŸÂ€Áò6‰pA÷-{¬Š:_S–âä¶íÕ¡h/ƒfµzÇ0²'åcÏÈ|“ê$"á‰N=E·c^æ;ÇúeéX[|=Á`plî5jÜ^Ÿsø‰è-Q—ÒVdŠ£ÔHUKh¥t,Ζ)˜üÓÊÐ}®[›©¡ÇËw;C·ÝÖžBîF³h›sö²{Þœýi%¿ÌH|ö¾J/D™âH‘×sq&Ž¨âÊ~n´m÷gž@fˆ/gªvÕ‡›Êƒ¸"‘&ry\Ѳ(xÇÚÿ{‘R¾À» ;Yô”RoØžÅ->mèp·žÃéËÙkå¯}r\û)—†@€Ãa›b}l3†5 ~EôT=Ï,ëYtóÕ³ôÎÑ9¬q0`À€ ¿e¬à!m©×8î̧ü‚qƒ†}¦ýhT}:¥xú»Š]&ˆ¤¡ÖÓç‡ð×þ² ¸¤ýWºô“)WŒÁm ¥òŸðžËøøÅcH hð«~_3®ýûü'÷“!Õ(Á©“W= ¦ï ³ß–¢~GÅ­xO<ìx{4Ól0¥å³öÍñêÚã`GÖ_þfb†ÀÜܽ01ušS‚[,¹ÿ‰Ñ1«å`b¾•õÓ_m½á¨+cM·ñd›ï!škvÌÐLP1obô·¦ é|ɦ?òþØ ‚àôÀ·“;")8c#šÀñÌý|Ù|8åÜÈ*b¿b…dò©.kùÃð¥òdΪ?P[µ©ÍZØÂ9Ë$f渎Yù/úr ´¿ñk× j4kšQÝœÿd÷—+ª{ÂM³Ì4ÆùZÈd–ÝêÒ¶©¥£in¤iƒ;Kä½]»çzqYH%ðøȽW¦dzìÍï³£¼¬W­2^eLXw¨®ñÌÞxü¤ ò_»÷ºñzðî—‡¨|½—¿î ¦B:|!ÎÉÄH$‘«_D9y5)’L ÂKYŸ–2@Õ«4 :™€Ã‡íN™.ž;”ò™kû¢ˆŽ.¾ñ¦Ií$vîù©õû/B•–6b¨!/ÐžË öxVÙ©\<½InÚ@ÁH4î録ÿ²ÍZ;öÃ/pôÀŒ£±>I©è‹>?bœ bþñ\€f=­ÕWŠÏom9¿0ÐúßÓ-µóÜífë,`]y»Šåkö9€gë Çqo}Èx|ÛÔßö²ŠÉÑü9_±ÓÔáì2³­ﶣ•bqë)UlŽ¹ÞÏÁv\ášT½Ok;¬]è9ó£T&oP±HT[²•õŒžBË{±GÝ©74#Q»ÛŒ6äÒ¬úÄ`oš‡è½ø<‹ë¾oÛúÀ}7ÕÓùT ·7Þé—·d0ˆìÑ9øÝ’ºgtŠÍÑ“É¡{Ú¿ïƒmƒZ“§¬só>±Øûý×ì£$†õmužg'c(æĺá9°é¼?A±Ü¬ý{‡º.¨õå°L˜ò¥)'ü©¼.èõg¸æ¬ÓwXt§uonñqÞž†¤îõ ÒêuÁ)†ó˜€:¥möqOÎXTÜ«=vqH¨¾ù¯V¢~„ÅBEœÝ©©f¬: ÛÌ´3™9h|àù:6ƒ< ë¸þÙ¡Ûu¨…ÛX@>õiîwleõǪãq"*¶hئàrœÀw£æ­È6ã-oNºlcž¾ƒäyFÓENж_Lqýel£’‰æ-R©šmà #íÝàÚN÷ÖÆxYÓè ÷¨†¡ÙEò`„«ïÑgZCTÈæ&ÔÝ[13„„Šf°„®95ª0ZCo|­9$ -bOêŒÛ€ƒïÎI–]ÓJP6yyw8ƒFcÂãJÕ“—ü¸}wÙ¤Î;¬Ä6õùî–O;üð,r|<ÿ†ê´šrðã™[ÁÙ·]€¸âkIQ|‡cÒ:&m»²žÌXà²û*Ø™ý žªGfÌ©hì஫}oÂÇ1zÞ½‡ºé«3[P¶*ÕVJSE^†Û!‚w¯qD»cŒ4ÖC™Ô¼:k¿À6ÊWQ,¯ÔVUŠ™Bš‰“N°)iؘxâ³B{‘òøÊõöq˜mŒE»+3Ïó ™a™Y°²Óö‰¥áÖtÑ.ؼ³>窇N§Ò|7W ºÎ—ÿÉk,ºlŨ<÷/ówö¯ãqX6A‰SHÐa_kÓŒÊ!Ù狠ǪJúò's ¨±Ûîº26ÝÌcÑœ£OL·Ä8ÐÈÔÄ[Å*Ñ®£„æ]ËæÆàƒÂÓåZl£à¿iWÅ+Kßî½î‚ö°É‹á»^jP½â\ÝÈ®O»f:h«%±c¤-Cè•ÄÆL ÛÌwU˜ó<Ô“ƒ\Àa}ÐÝ…YË7zÔ C«Ñ“ìà{àw-Øõ±Ûýú+¨a›½×«Ò“NQ:Ëöñ\Ͳ{hlÅØÄ«›Vd›=<óŠ~äØÀh9I¸ökéå_Ì6<Ð6¹À6wÚo½†|°V‘1ùnÌ—sÙ›;§+Ÿ„MUŽé=¡ï p`-vTã·Rp²‚aÄ©D†ë³=N‘7@5ÛÌõæ³Ùü¾8Ÿ}¡¡'2Ñ.³Ql¶åNZèèç£\Ë:E­À6,n0z¬~Ì•‡Q5,ûrågq‚f옮p8·¬P6‹ƒ ’=éëaß>'7¸Ï€ey{®[å]G9;De P¾‹³æ—tMjZC›m:?Ü»Æjªt7Xô´UÏJV›m”òXp¾A_jÜ™bòAk%7Ùãyéÿ¨Mç)$ò…<¸ˆŽü‹;¸ƒ}¹ëø£7Ww–Á°G£õ"úGÈ=gF8Vܯ"˜=L²Ç^°»žÂÜ/> ˪S©—{Ã5fLg¨±û²Ã¡CÏÄøÙ q¶{ŠuÛ˜+U㧧ûw¿^è*:lÓÄ3²£èx{“ã£Õs›…œS_4o>åA1*^ø}ºµœnëÕQtUÌ¢Òø.¨çU9Úl¯òcùŒCùÓÓÓýõOø"çYô˜ ¨NlĨRǬyÉròÿ]³»-óMÓ˜šm6pùLOÀ´ðÑ< ± ‡Å.@Äçq­·®À6w>÷=Ù¼õ&<•]KX4çkÞùœmÌÏLÛÈ :‰~­¦×—Ù&“J¥2©$„Æ|ܧ-‹Ny2ŒsšæÑ/Xñ`‡Ç‡ÀÚvÀ"t`ŽÍHaÈ”g¢¼w?x_•–(ÚtFgQƒ°Mßt;›Åj›B%ê1gŠqi¿ª«¾|Ða*¼ÈüXÀÈd%U1¡’ÒO†yDß.«¯êa›Ì0¾ç•þþK¢¹å!è%Å8}øÁ0Û̉˜ì‘ù…ΫÍ6-%ç¬Ýã$ÿµb´º•ØF °î-„ù›ƒÚ¶LkRïÿø”j`cZä :ĆŠWQ½ Ϊºãkp5¤¼êÃ󻯖šÀzž£J=X°Šì…Òå@Ý=í´W–ʼn=®7¬À6¯Â¹ÞWÑ8›{Ül“r¿¡ bù?g ë¼ ¾¤ëíZ#[›mä#‹nõo}å÷žÑÚlÁãÜø¦‘`¥ÌUy]Zz¹ú Ø–¿Žr¬’КÆçD‡mÀÑÖb;&[ƒŸñ±_7N=ûg~“ºçŒ6æ1ì¼×lã,¢|îžEbÛ phï¼óabè…ÕÇ/ZIÝýÜ Ž½"2ÖBÏmߌõ¿Û0˜8¬>ñMðþÑQ:K»*u‚;†[âî–¨vFTÚŒA!‰×ªåãoÙ:òrNmòØ“ª#ÍBë%8Î<ÎЄœ5˜Rj§U‡=s.ñbÑî#“ô1Ù¼YÅ"¶j³ÍÄ6Ö lƒj‰¡lòw9ŸÖèe›P~Ð}UƒUí5·:¸"Û(;R)>·´›X›mº>Þ¹¬×üt=@¼æEÛ lÊ7ñ€3ušp#Ž$³ÏZ IS‘9ÛmN¦E‰êmT=h¸Äˆê‰°Ó†LTÎÜ&æî(Ñè{FECÛÐÑ:Ðp_h§0*6‹ÝÓêWf›àGhñ{Ýl«Uˆ`¶Q‚óMÍSç\›ŽlÓ"0a}S¿Ikáu><£-°M¼˜{ì“&Pò¸É´Lk:ÑTD¹©µÍÊdþ¶Â>=l-FÛJw)Ú3RG;§Wûˆr·¥1í³úFõ3¶óêß5Û¸ZP?tJÔlë£hòÓ~׈ à?È60ïIyúâ.Å' ¦Ž_ƒmÌE»äàL ŸöžNZr¯²â–Ùò¾´1ÀbKšÎ&¬lX„°b¦ ’m¦uãC~NMâÅœÔ(*år9,Û0¸uÒ›-Xa7‘|Æ\(Æ%}ªLß=Úï¾GÅ6Ó]‡7§Í6`‡5θ¨oaÎjÌ;"r[£a›Ï“jÙ&Ô#æn9,ÛˆTZµžJ3–ÛŠl£èÈ3b¡È§û¨Ì6¹1Â:û5Úl#éú@»jô§þbî‹Öñ•ØFùv3Ïùlƒê©‘g$œÎ3ÊaW~ó³am‰»k.¾ë›W`›4žï½õCµ\#FíÌ÷²bá6U‹õ~2g¹¬Ä6`ém›5É A¶ƒ…¦‘øMÚÚ€8í¨»Êò ûUªvÏ&™yŒhóë¸* 3*¶íµãï.é×'Û€Í%iBïuªÇ”Šý6ÜõùýÚ•Ú`erï‹J¨z¶Õ9èÌïšmÖ8 W«†FKŒD!p#Ö\¨þÙ¦&u;0’Óë—°×¢šô¾Ïºôôýwêmæ›’ÌEp‡œmâ‘oÖ"ßOÚ-¶´ëÚ±(z=8ßGÑ)Y1ÞhÉàÚÛóJ¹Øö¤ Må!xòqœ(gÓ^#‚qÖ!»Kà‚–Xæ!`.‚Ku;…†„–DóLw?ïGK›(dsݺLzyƒËmà Ҁ±¨Ôï¦4zÑFt¿lÚ‡{U; Ž¼ÆÛ fÜÅ—ÖЄ†Øæx¬[â$òÔTÙX€j-Û^l¸ÂI¥Ò tLIµ÷nò/ĸ§Ymç›­Kƒ¿ïhÙi:ÁnaÝÖ¢'W_-Ôþ–Ÿâ¾_Ó˜ò‰‹×‰È»lÖßX¼'Ûýî&‘ÎM¼­:a—ºÍ‹dnÙ#Q¬ Û@´1E£·É>¸†~‘q¾‹mÀÑ\¼±5êÿ¬ìj$Mà¶Û´ƒÏNxm¿Ýª³±%ÿÈ¢9k¾Ú˽!‚dÒ™¨šÓ^ÂçþÅ·Î?¯AP’*6“ÝŒJr˜Cd ì|{°¾4å¾*Îéºë–täŠx 2â‘ŀ؈٬Ùãë~gL¿SI‹ý6ãý0Ô“%©çÏöMîèü&N ™EÄ…Æÿ—¼QÅ6C…ÿß*;h„}JsE,¸²oÈOµæB-ÊÛuöƒD¼ýƒ‰Ê#bím/Í $šns©Þ“²‚÷¤`ÅòD¤Å|²+Ê6@³Pïs?’ç]´r VÜäÕœ²†òO:gÍLßÍ©§¿l/½"Ü<Ð…ÉÏì~¸1d//î¤ñ ¾óË/èf¥lë/^iÝhuûk³]x4žºãr–ÑUßM6rÜ ù²Wwá‰d†…×Û&DƒÜŸN2ÃA Šƒ#€MÈoÞê¯/ °ãÑPt{ù©©ÒÛèOzÑòü›ÉL"ŽÆ±{ô¾ã÷mjï·)ìÎÐð!ë%Ö‹Rê í¤$zÑÕ2&¹}{oé]é±%V®`‹²œ-h°.:6‹S,*v‰Y¬š°`°jfV¬€žÀ×Zf2Ëèê·Ë5ܤJÐp ¥¾¤Ëd¸´n¿Ì–X¹øèûÈ‹Rê3CZ.þ¸v÷0^i¸é”K#¶Ž4¦Ó3”"˜+õ~}î~(püïN¼©H‰pNzþo—Ùžš¦¾©ßm‹ÂÕ.?èu0ÿÇV`Àð¿HL¨§w»'åX[ü#PÌŽÞ{œ bµ0`À€†»p£\a¡ý/«‚ŽfüÎsÇ+’Õû¸>¥Çòçm—?œ‹†ïYG¶}JZïonb¼ÊÈÔÆ;*ûbÒ9Ýú矙ÃÿªJÌ–ì%¯EUÄŠ77÷­ú‹yÖ¸fP+KïŸæ’ˆD½(¤’ˆx|Ø® ‹ŽýbÀ€aE‘BÞ›Ç"Ñö¥©ìóR…TÜÑÜnPÒŽ£ZŽèÎæ‹ýð®¸C±Td2 1\^ç–Z[DôÅ9ㆣæN¨’L6?dð]QR8jp±L'Kå€wé|øbìÓuÓZ®-šàPþQ’8¡.Å>_ÞÁl˜Aßòr ÛÅ.|ÕØáƒÛ|-wÜC£?È7Y™íz¢sÒNÚ—Å`Ù¢ ruƒ§Ç‘—XÿÁ€á‡°ÞÞ28í#¸`b¶}É)ý6³ ͪ¹µÈYÄ$˜Üÿˆ&ð³2yšùDH2ºövTÌ<:¹™I£2ìmgŸÁ6, )™`Öð9ÓÇND ³oUt¾tÊFÌDžŸ¤¨ã’ôc|€Î [Ͻªw}E¤jØ\Ñüµ ’¶\MÉj¶Q>¢¬NïSÕnê5ÍÌ]Û¥Ë@é]šG¬êWåœ7ÈÖQwïÞ,Zd¥l*¬€(e#G‡mBl‰¯j&Ñú<<ì} Wû‘WQlÏTµ±ël1ÝØaë=0üd\be§¾Ð$’v"‰î¶õ!òGŸEéDŒM#ý„|?•}]ÆÑ —õ*¿cî4§ä™x×p¼°å h–V [Å–ßLtŽƒSÖ>ß-tSÏ9ã'p=‡„§œ-¡òwjŽº-°Í|žÚ¦!aŠùW-ÏOïrY§ñ¯¥Hq¥Å¼Õq Ä5yUQ±ÚO¤ûojNȱÍ㤯ÝiSÓSÓà ^4êó.í¥”|unáˆÐ„+ÅøÝ(Ö0`ø~ŒX3ñõC2=»¶lCu¨W@bðq^ÍDùr¯|CnÎDÐW]kT Éá¯é\±?$ܸ¬O#¨ÏŸzŽ1· ‘hr¯0ƒwA|Ï4±|fÁìÀ+€ê=«¿ž¾¥}fA‹m”³¾Æ“Mý$Žt³Z­ÞÛ;»¼cÏjHáž-ô™öá >Å!î"r=kisYsÒY‡m`šíÛêë(‰<öÖ”W PÛ¢KÊbÝiÓØíÍ{3ŒŠ{±þƒÃhnœäâ– m=ŠJ£«·±Ÿ¶ñf?¬@‡Ù ƒ1>sHuz²³€%²BØhP¯od[ô vëyW¶™ö'‘ØlŽ,¦`Jnp|×’$td›u ú¥fàÓoE&4M/¬û><>ê}Hý«ü”}KÙ´ö rM^ÔÀ@‰ë²Ï[o×Ë6V[2kU¥>=²ãžV6ò-|Ö©j“Q'’Ù‡1Ì´†@’‡­Ub¶¶Þ¦)'Åoo:8Û±ÛÌF3W]®S9ÿ®¿Å¬Ä6Š$¡éžw²ER”5•ß/Õ^Ìi³ ˜x]nUQaß=)X›MÆ>>&9­Uý*—ØÓYe“:°Ñuûm*¦Ôdµ Ýi€mÚDæä ˆzDùòô”(,^›µJ· OÕª y¾øø3 –—l`ÇÌ_-j@B ºH(¿³Fž´J¿C¶ŸŸwZ‹êL”‰vT¿‹ß`½ÍrlÖ<ß%p‰@.˜õHùõ -øžf9ƒò» ¹H½•=Û_ÂàˆQ•l¬«hû3x)ÔY‘™ò¤]EƉO`ýmó‹$Û1Ú™¸xöìâï·í~Îb-ó{ ·ùn›æõ7q˜—Û¨)È‘q £½>èψ8˜oǧ~^ +‚S_X§ !§]61×K°þƒÃÄ7Sƒ—÷­§qf8Rà¦#í£ñL·þŘ¥±·¨¸Ê~ø€ýjGÂÒnPe‰7Ÿyq›Ne‚ÃwKˆ* W7†úï¨'ü'³ a›þìóæ^[Ð%É»Ç'xt2F[³ûê¤ ¼¹šw¬X}¸uª˜¼Ê”ˆœV&@ÿâH·abSv~nÇ¢HÌC÷ËPOŠoD›Cë/ìÚì€'’Ý£ö ¡'ŽÁNšÉßZÇä¨âåÃÓ3l‰Lçžy‚¨¯eC\#U)xäôo"²i%›ê;ãC§ÒèLÞ¡[ùˆ&ÛÅüïÀ[}h>u¯y4<¾çFþ¢ãÏ0`ø> gÙã·wƒËßjŠÕ¶ 6­{I´ƒ…Ú-±êQ~J÷®Ò@pýÅ( ÞQ~O(% 0`À€ 0`À€†_ú¼‡Lûi´.)®/á³Õßv[ÿiuL¯‚Ãoj¦ÓO%ð˜T†'17ì¿:*78T'¾Üåàp$S+f<[°öÿŽhþ<D¸ZÙÆÿó_‘= $*KŽ¨açº?nð³…nã(¼C·ß(µ,dc Ä¿m¨-¥²ÑÖ o1ÙsWšæ=”òéó»Â‰²9ExéUój…Ão Obíøaæ²½Á"¸+z äïûë݃îÕ‚úãN* °1Àšä"»‚dI+€r*1Þ“µ¸1Œ¯—kâZJøþŒ„‹ Žœàˆül]·úÀÍÍ—»¬½·ÝEóq¶µD#/cÀ€á·ƒÍ®Vs¾.P†L®º’MßØÍ€D*3îd†L Vïuel›Mp‚ ]êóoÚrtÍÆgcÓ(,~´Þqal,\çÈ¡ÇæϽû£PÎrªü2?æ(ùd¦/LµÊ’·}m*TíäœxÒ€J%u/¹n¼ò<¿˜m”`oåG(Ÿ—'6-°¤ƒJ±š\aˆ†ßB ;o§Í“.=ë꜒Ìi–*µ/È ÛÄa$}€óßÖ‡oš”«îf‹s=x/-ŽÏTXS°¥b9¶}7áè6SjÝc'H,éþ. ¿)DÙ,ÖV{‰’^ïb¾åI|“¸çð¡ÌéútWž(±R›m*/&0Ã~Š¡K>ÃÂÓÛ$GŠo•ÁùLÕ>7![#ž®zK.A42{VX €÷>Áwe¾|ÜÑŒíê=òÇ'|DVWŠ±s§NO [¼>½%èð}MÊk™Ž`?êʾ|“ܶy ¿…•””ͼ¸²_ PHdc}üNÞ¬ ÎS]œyd&À;þ^>RA#·äôÜ µ R9Ù›9ãJ Ó½cOJ%ÛœèûÈ¡¬’ÇM” f‹âþ,>-q,þNoS¨ÖJÝU9‰D¶õk™Aédïî5®d‘ʱ¾šýy‘½ß=ןâP8ò6ŠÙª.$ÄÞ®@k"‰D Dø»°}pVrÉ­½á°ö}×1bZb ~ƒ„³ôβuÑQn}–9ºö½KB8i—¼Œ °R_ÔmÃ!ªWx/ 0`À€ 0`À€†ß!”z®þ¥P­üz*ý.ÿu©üá¦0pÚl©ní_ñ]–)ÓŠaøÅã'#᧿þåjQß?oj‹^/=’N#›˜™™kè»ÿW,Tñiÿ˜p…$ÿUñ׿þ‹ÚS1·êç¿6Oþؼ Ǥà똡_¿=ÝC\e.ŠÍePL«g %ë¬xõ«D‚Ø€?ò¸EÉ((D³ª‘9lÔ`øňóæœÚË]wÎÐ|ªT*—8^âÔAÿIpô¦<„&^"=mñ“?N®,Û¨÷¯V¨À’PãʪcF–ÉËInü!k{$^¾b?&5ÎÍÖñ¶yÜP“î“÷!†HfÝÐ,h`//ÇlÓ[¯•œ*/jÊ}‘œ3ÏÛ–6¸‰àS«u*ÛûÃðc#`²†s“€ƒv&ÔÊ)$ž6tS1ÿòb“B&ÓùW_×¢]ªúõK6H¢ÅŸŽv¸±Öwk\D & r ÿÔ zxècqaW¤…ˆÏ² üÒ ßÜçBb²XHm±M’>£ßôÌ°å{£ý|®ÈkãZLøœ™"fA ï¼”…V ¿.ÏdžÍÃêâ¦d€Èï&G’i +×ÐêÜ}ÆV0Û%$ÞnËþ“èÚòî–›˜Mg}üÝí—tWúŠéTgǵÂë¸ûîÔƒà|4î?6¿Ó¯ŠGÖ‘)T —ð–Ï—ÿHˆ–ƒ`Ùd CeùL67¢ !Ù†€7k’NeGÿäšzûèFK{”¶h“ |1Üc–pß½J7[&Â6`÷ç,ok.ƒÁpÜÖ‚Œë'!TÀbq8œÈl ÛÈF›·9ÒétStþly#€Ì`±ÙlNrµ i«Ë–\€I£'\Ó²ŠD.d7’¹É »F$ö!*fz>øY0h î¦sÙ‰Q<„mÀ¡¯…~6l •ê{d{ ³ÍǺâ{>ÁÔlÝÑ'2̆ÁãM^þ ¡‹Ë;ݶ¥¼Ao~yg후\΋9ÌâÁ9eK*êŽÆ”K áïN+g¹ÆÔ§Èl:ß•Ãdó {ÏÚÿ´ÒðJ b›ˆCª`”}¯Â¹·¡Ä‰â­yíÚxs-Ñi“Æñ t§€´¥bf½ç½jTË?Aõ6 lCuQö•I˜(ÛÈ?³‰"Íbí`4×Û$Xò÷¢³?„ú”Ÿ…;5#ñJ4;è@®Jq¤Å6fögÕM1îCZõ¨[Kjɹk^ÑÛHnl ¸<´=ù|ŸÃ»Þ¡m@pÿj–sø×9Åå%ë…&'Ëf´ØF¾‘ px|M>»fJç»O÷T†ºŠ¸6pn™–ƒÒlj´2{#Øg^t½K?h¿6Y»ÁÕzƒnä`lƒáû±ÎE|¢°îF ØÝLþ•x—M§ îº_lšðv=²ùÙ9¹òÙZ{Ç ïЮ§€nÍË›_]d¯Þº(CX¶áïPÝž½F²À6J¤ È ý!¶ynåz¥j¡RE}Æ vènõÊDâM¤]k—Ÿue…¼èEïõÜÙ¸X¶YÊ6`›€Bê™Q¨mNe›/AøËNT˜é}¸S#Û_ßlœ¤am¶Á1cÕÆÛÅ«ÈÅÚ²M kd!´’š*9ºÖ2I'N1’çR¶iáHõ*™‰bé²"Õ~Ò³$]½.¢î/ÜËbGÊv•Ð-Q¥ÞêL€d›¶ìK@ÀfUë*3³³Û`ø墼†O&·OêÝH)Å™YCDÝó§P$Ù¤ ” Ï=éL§ «;Wó“nT€Òf‘1)­ V¥(§šØ|ËAÌ6ƒZÑ«7+ήŹÂjp®Ž¹ŠÛ¸d—b›½ÃßÉ6`ç-&…׃ŒÞ-~ÜC>³5#Ê3¤¿5ç•ú¡¢$¦0j+ÎÁXë3Z–B#`½ÍìW¾1éF \…’Ó¾|÷S Æ6~)²cE¤ˆŒE pÒÏ4òä{h@UÜ?I–åý÷]h‚®÷m8t"H¾Uˆ:Ù›hŒñ¶¢Òh‡Õ“¨lCö½ûøD‹Aå;G·Ž«v-î'z›á('K¦´+ɤ«ƒ0¨`´Ê’už¯Þ[„¦é}@qOC+ÐQvÏŠWàpz)zgªûK„«˜F£;o"Œ)|x…B±ðXÛWòߌ­Ð­CkÈ{î4c•2±VÕ@6Ç“šfà÷˜üì) “‚󯿊áx ±Íüzò·eŽi¯> ºŸA¥Pƒw |IY%‚WRg׳Hd2M Ž(TÌSH„Ö))¬·q¹ø:5‘ä²m‚ê†`¢ê-OÇÛ©S%Î\ •Ê=›ÓêeAzÝ»co-]íÀ£R©6¾†QßC²¦Éþ˜mX4\õ L¸-ùWØ GäœU3Ôðê”± å~X’…#P¶<ƒ—{év<JñÛx|yÍÚ›{ˆ¾ˆšK)͹º›Ï Ðétïõ†Ê•ŽÖÙ°H$fâí÷‡Öñ=€'‡éžªP'>™J Š¿0ãPÐ)„jµ½M¤ùZ~6Ž0|‡h³D´Ö+o/üù]æ.0Ûxß^TŒNKÊ2\1±ÿ{ ~Àe­bt‚›kýÞZS1¥–b¶:˜¦UL‚zìm”ò‰î·•ªu_ÿã]¤às†´a(`½ãyÝ*Ã^á£=BAÇٗf¦ÓË5Ý2fÌè¹þÁ5±‡Áï°·1ÜÀ¥Ÿ³¸ÁðïÊ6¿¯øt‡×Ñ/åÚõøu>Ǹ9C6$3 T"uSòé«g“…4Ó[+8#]Â6ÈL2RÛ2òo±R‘uµôNb2þÇ@:ð)¯¢ã÷Ô¡‘¹¹¹º2?/÷mÙG‰Ìði%%´Üè,~“Ÿ›÷¦±k|Åi]1\óº´ë0`À€ÿarx1åBãâŸ$eë÷Ó‚¯n¤½é˜úßÓÒͲe¿Ón˜º'×ÒßÃΚ¡¦™jyvÿÖåË—¯ß~XÛ=þK×<Ȧ_UqêÕË·fMÉu?r-j¼—zéÒ¥ÔÒú;!…á—âæ_GKц”œ^ b {ÉMCö6ÿSñúrŒÏƳÚcüáj–Ëy8žÅØûk’`ÏÉ‹>¸pb€»˜ßþ¯äš¯)–þWnÞ=½'’n9¦Ë7’ž·Dûbúóìg÷¼ØÄÃyíبÁð‹:Ú´P]ý”:­öÂ[¢Åyùo+Ædêùmnä}ñ›Ü‚·#³êÙMÑø¹"77¯âK#úØlweþç¡á¶êÜœœâ÷µ¨!Jcé}1Aø ¿°yz%¶Aºø`kmA^nþ›âΑyDa¢(|S ¥J rr š%hBÙôPIa^ÁÛ÷³ i~ÞÛyœj¯xói%òÁš×e-hJåìøû’B¨ž•5-šyy¬£.??¯¼ª”´ä7¢O÷6æç• NËUsúÜhAa‘b‰$0Öý IY>$Q µÉ-(Á™2¸œ¢®IűÍëäÂVP½{ÔüöÁî”Kåî¯U°~©üãjç=Õ™]R§˜,Ì{_X†´¨M¼y#S¨üK×U–äæä7 ̶ՖÔwôHa+¤èSI8´†wô‘Nð‹²}B›ÐsàòŠm8Á>6t0ü8× ¾ØŽ÷…ÏÙ%¸â.½FûÛTg1ÏÚqäÜ‘øÞfT [&=jÇ¡ó‡wxZnë D5g#­ì‚7¦ß¿ëc/Xs ƒ¯£αÁÛO¿‰ñ~ݬÉ:O#¯¿ÌnZ‘m I6ë¸9Óîä•Ž$Ð)ìvøœ£œÇemöq½õ²0ûÎ!Ê*z=lÚ3äË2 ÛvèFÊA/g_*` -Éš¯{±¢òPÞ&˜¸\B.G}ÙæáÛÞºq%Øë1%Ý2'ùÂõãñ!;÷âá#Ýç(L‹ãWîœ?°•Î°lB, g‡«]<|eºÖ‘s‚²>yõîÙý›iLÛˆé$ºp{€ÇÓ‚’Œ‹ÛIf¢qéâµÐ2l“å"Z®|f§i]++.„süRï¦ï‹ &X­‡¾I×#3a`lxt^iyJb0Ç& „-‰Ú\ÝÜ%ÈÓôMöçð[ééë}½Ý}‡4w•ÜXXY/ÀÊ.ì&¨üÆ#³‡æU[áùg¶z컡]ó¦ŒhÁjU±oi!ŒˆØØÁð °Î]p½´ ºøpcå†SèÍÛ!¤ˆë]¨•ËåÍë2Z%uÇ=MYh¿/»æØãÒééf6ÑêÑ0#¤qjæàpÕcµÇ¼¡þlÑ©\æT¦¶ê¨mêšBc?ÜõÆG¾…¦S>—Þ¡:4¸Ö‹™^Öß™q˜è³­OõC2×AbˆmfGÞ€E/…B1VŸO³÷7®g›Ðǯ…9âœá­êk³Ç_T„X|5ØwÓƒ…!¯«§¶0ϬW¹˽”ðœé"ÙofT K³j‰Û«eØ7…y²iD2ÛjïÙÛߺÙ))¤# UKLÛÅ—ó¾=Æ&ͨH8þÕŒf§«›³cêP£GEßôÈC{dÓo˜ç uæu7“xZõD>…l‡;ŸëìFçºJ•˜ †ÕÞB‚?ÔLŽŽŽÎ”0Vqªa‹×é`"þR›ÎäzÔÓfý‹Fí§ß¥fZÚmˆY`%q¸9•évEÝmð&Å# l#—Î !2t*sn¨!ÂYp¸<Ãb†=èG؆U?®râãϹ]Ü›sz«çÕl«ûjΰ5È6 2ëâ6:…eÈãr!ñšÿ7´ *“¾éü­fŽç ÑÆ–L ˆT½OˆŸ«•ÿ& ×fM!¯ŽR¥ òq¶ ÙÎwá©šcÖB ²ª‘|yßÁ¡1…^¶ Ò°ª±¾UÝ!âÒvß×.R6VÂf±Ö®CËŒq³†^ÉûžüÌŒP¿F³9ÕzDçûÖq‰ÌÞ9UÖ‡£ØÙFò–ItÔ°MuZ¢p³Žíâà§ë4K㈪Çn/ ¿3%ØèÁð£x¾Ñ™#‰Õò˜›ÏC/‚Š;Ój{œ8ík»&£^£Ze¡‡G­×.vì ³ËEu·í±57+]`›îÏb ±­Çql£Ø"2Jz¤:ùП`ˆmrÏluG¢ÚŠÑFÜ"¶Q‚Sùñ(ÛÔ]ßwI@ŸúVH±…Ùf#‹v´n}|2gÂ6}ÖæøϳàRmÉtZšêùË”èe›v!za/d ®owYwDKC¥8åÌ xÐ}•J5¼à‹¶,#Š»¶çPÙD/®MOƲlSÏ#Ò{TÊð@päQkï‡g>«Ÿ}!•¦VÛ€OÇÑæ:i<—t V¡¶Ân@I †ÑÙ(”²ö)•…<´Š)¾Ž³]/46ž{ùK©8`ÇJ(鸄÷¸ˆööÜ“›ÜöÞP6<3á©JYáë2%Â6tŠíz·óÎÌÞß…Ùƪg‰2BÛ ;›²Ñ13ÓË%QCï÷éa›·]]O“¼Pç6`GEYIõd¬f¨¢ìð4u» ]<;ësè.šòíÕ5lÕJÊåd=šò„Ÿº’Šu&¥¾Ql¯ACs*•z\ F9î–©jÞ×RÕ=¥€VRúØFŸŸ˜Òœ;52ÓÁb±?Ã5ãÀ%e7,PÅÈ»ÛƼP¹V¬@¥|ŠÃZ§Uíý¹¤|ZÎèc¥RSe©—ø± ]Ð zÑ ¯¤@ÐÛ†ó¼~½ÞìL¸Z4¤õêòöÄ°GêÊ=gà­†151†!›™òÝDzÔ ¸à•b‹@’Éå:¥t¸žJ¤9¬^æ&dÐÝf`•£ÜÇš+t Š q#ãxïŽy?уma¿÷Àk6×q'*ÛÐ}‰m|ŽÙgãm¿Y†rˆ ïèyµt\Wo#àÚ»xªá· v1wu›ƒÈÙ÷ä¡]|[ï7¼y"ÿ'Í3Kزã!<œ“ÏÚäíî«·‘¶ÓÐø¬aì#×î]N^“|*ÂÜÖ~ËÓ‰úæäk<ÅÉ·spDvÒÅ;²¡2:“½v×ÁX/~êÕ(sX¶%Õwè$Zh\büÚ@*Ý¢q13ø‘#´\äÓ|êSLßœ´ýÿoï:Àª8º6–Xc×Ó›‰,ô"(ˆ¨ˆ]Qì½K,±w+ ÆÞ°w±‹b/Ø°bC+írï…ÛÏ¿çììm\Ôäûóÿ_̼Ï>°wvvfvÊ;gfΙéß©ž“ÿUÜ1ì}lC¤qnÍH'7O¿€ æ}<Ü\'ìz(æ}ú¥åîήÞ[ôíß·y@C—zNk.bg>:åÒ¨µø~âž‘nž¿Mž9°}€½SðKmÙF#èUß[A',šÐÚÅ­Áˆqcyõêã›Û`馨ïêÖ¡kï¦~A#V³z”wiÇ1”)çê9»w|âlšÉ<õ|ÌÑè#'ž¦fK½€þΕ³FŸ¹zG|-'éÂá+¯ß<º}ð@Ìù›¢ øS}kûl:tôÜ‚v òõh;Í|>aáÐÖÓ×ÆŠl2ñdjÂÕèC‡Î\¹kìtn\8},æ\¦Šzçì×û_RËž8|‚:ª7g…DGG_¼‘`|%=éÞ±ÃÑGŽÇ¢Y· 5ÙÑÂÑ}å#×RYNqìð¡l­Á6ÛÒ›TsÚ/7Ê#°oÎäˆXN¡JÖã³Û;&¸úåæ°îMkGÇËÄÏÛ2­ñÀßOê_]¯áј¼†õÝ/“EÕ°`ŸW-ŒÉ2îqð –2'§¾‡sr¶ÎŠoæ ÍU›êum²Mì‰C©r¦‡wçÒ‘û/rœŽò¯íµþÐÑø×Y»¢{xU¯M:Ó»[ÇæþZvì1tªPOGŸ}(ù6+ù>&àÌ5CöóýG®êó¬Û:_/ç;Ì>vR7¯¥-ˆëðäî³Of‰e(îg°@Ç)áïäšW{s‰îǵ¶_F¤$›Ÿ¶·wŸ¼`YØÄööÓÔBy¦¸8 š4oYØ$w{Ç#ÐhQ¿À^#·ïØ2¼swoT¥#ðÁ½Æ-9wîthdž~߇õüH¤“CƒõÑÇ+ÌÉFã]ßíÜk¥Ùöä¦v»¼M@ðèà×®\äé8!UݶlêÓºÏêQsF÷±oЩ+õB –#:´]ºr½A—Ñ°f‘¿GlÙ¼¶{ïÎKQúéáùŽM¯Ý9k´“‹ÿC5$ÆnõtôX¾ÿð­4èR‚[½VêómrFøØw[p$Cie½›ÕÙp:ÉÜftéœþxjÃ#‚ëG}̘¡»óÄm‰ Ht©ã“ êä2¼\iöž­\Žßz•øèAÂãgj 8ébTýv}Y¤]7O¨'Š\ã(Ìõ¼Ø¦µ¿Ó¥§ì•Y}Ýì‘p|•Kíúk£Ý}+ß±i¡‡—ï”: éeþ`ÿIâÄû Ã<ûDÞ¢Ú1¸ÅÀôyÙwÜë:O^¼fcäÔ¾ÚÖl0\x:¦¹W#sø|RÿÁíjúŽªâˆ@‹øù7}&„§¹ãéX?SËlÛ£g ž·=÷̹8|Þó[Ó ßÏsNø[1°Ïºs¨·~ªßЬŽu¯Ýw]²XV¶ç©òö¼vî#‰íâŽð»/ȯFÕh"Ù€Ú€ßb6àí˜ xö)ÇŸ}ó´×½ôvsz©°=Y»¢mó.âAäðrgçN[p×—»×帒Ãàú•·=ÐAú¥êÕÝO“áaöÛk®õ›)Yç¤~†lÔݯÆÁ»ÌûIJ®]Gïmª_mÏ;z‹Úf°-Û€Fö°Cë G‡M:,Þp0ñ¥hº”ÞÒ±ê©çV¥›ßľgÔ ë‰‹ìø —šmºõkíëÑ*4’5¼kkœk×î; ¿W-‡I{™^n§¦nŽî ‚C:·ká_§Ap²ÔÏ/Û»4{N¼¤“?wóð˜~9ÍV~(ÛÌßóTÜk4OÊ~}ÞÃ;ÈÆÙ š'Áž!}ƒ›5è1Í|*ü?7¶©×˜“¢ã­Õã«úŽÊk˜5Ä×;òÖ[é—¦»ëÏl?õ"z˜wÿ=¹‰ÛçöÙŸ÷.˜¶Ï"WOlä3ñ¬˜€kë5Ÿg_šyÔµncgrcù¨£W嚥Ëéäî\­zÍà‘|ÞæïÎ>ëQËíæ‹Œ·oß*^ƺüâyçäÝj;¬H´(ý9í†XÚ€_Dð&ƒ0p`?g—Yñ¢ øʼlÀµjåK«·2Чz»;%˵槾ÿ #©ŽÒ¼MfÌ ×v«„0ßÆhâî*ž9ëîè¯ئJ½ÖYlÚS;³SS—ºö=GL¿ò๫ kwîCI0°k‡ €îcÀÆØææmL‡ž_<:¦O[Oç:ç’…üiëRõØcµeóÐNóuè¿7Õ W‰ßøòu†ð|åæ-G,ÍÆu® #Ö—e MïîVcâ–Ë80<µÆÙÁíŽ íÍ+cxëÆu6§1 »»;;vêÜÑÝ·ÙÈF‹nfÊÓÞˆÁËs4ÿklcм¢0_¼JÒ°{F·Æ}§É  ~{·³gÝ™'Þ˜‡9«U£a‡˜Ù¬þΪŸ½Gä•¡~ÞK¯ßUuuùåPr.ÙZ¯ rv¿¥ÐÛ<0Èò/ÃÔf>#N0‘Iw3üçcó,ɬ“®õZ)¤²Ž‹é7n­)?P§?èÓ~þÎ ö òòmä/Á×Ûmø¢X¡¢ x‚… øâ\6àq;æ6fçD›@6à‘6à&¶I¹±Ówròìf½¿ÇšøTó*¥Êx“‘£µš%ÎŒ(° Qø»Õ¹ú’ ý‡úüÂØƱ­Ò²KŠ?µ«M“†.}7ú×t¸c5Y`”mÞÇ6ƒ^­V›‹ÝYуjùLÐá‹çÜ]×ÁÜÂ,ç…{m÷c2ÐÉ®Ð6UÞþB+xåoïpWA\pmWXã~SÒnn¯ßª§4>2Lkâ="æ¥1 ñº¹#̧ÿ$«>¸µ§Ç¥tMDÏö”… ×Ä$ü)¶ù½·kžl£½è¡z5fY ûg2Xš/môiÓ×b’¹U£A‰ÉWÇ-ûÙg¤p7»w»st1lìڰϾ§R%úVu½káL•~ÅÃ+H÷gDŠé>ÃŽ>siá/ Ç ™3£—eºtÇGu‰õ]ÓÔ¬œ¶LêÓwÉ~s¦ÉQ*5zi®Rdz®Gªš³Âß4g£oîSï‚™ xêÙuµš î÷„º·›D-iewû6ŒFŽ„…¶š²îï«æÕ•õ¯íÉCg%ðfþls­­Q’ΉÏm.T¯Ç+»8ÕõMV Š²‡Õý-ü¤m¶ÑÇ{Ööz-V†¤=Î5knFnÛ`$¯om:,Iê†;öÏ h^wÃY&‡¿xx=)K'²Ím=KIns–X%|ÆÞ-ख़(x#¬ƒ}{ÅSöN©eß8>Ó4Ä8<·C£–rerf çjgŸ³iŸc+‡·–u7Ú9 1Ìž>^aqå&5t¨y+·zBPßÉ[y(tÈoâÐPýö¬‡»_ŽÎ Á`‹mp3Ok¾m›¸žx.ÐÏ»ª‘mžæ=’œ»¸VÙ~—µº[§5î0Š*;½ýÚÔ —þ»Ä§Ñ³‡Ôhô[^5L7£®÷1 {§Ø·›#f¹Noâú¤Ýݼºn1ÿ&½Î&÷˜Šêò„&îƒiì™Ò·ºÿøw¬T¶òõ8ü˜mÝ1°©CÔåt1 úÍTßZ½7=g¥ž°Ì¹N‹,=g†¿…l”çÆ×v`i.ëZ·ÚòÛzMÚ=ç:ÎMBôhYßÕ¥--Ñê;Ô÷nÑyP×uí½¯ÐüÁö)íÝ}›Lž>-¸‘[ýEÙƹãßÆígÍšìïå4vãq¢¢C]ûfÁ}VœÍ´ª {§urqóðòiÔÄÏ×Ã͹ïÜ}Ò,±5Û¾Û5®ÔgԌѽý]7kh£Ö!Cî<¹bd­"ÙÉɵE÷¡Ó&kèãÑcU”7×¹Ôuê:adßàzÎã°ŸÏàRǧMŸÉ{’A÷¬»Ó ¹.¯‘Ô•µ¿º¸{4lß»W7ïú^Îõ¼g0~½¸nl=gw¯~-ƒšzz ~jÀÆ*ü¹ðŽÎžCÇM íѶž£ß¬øš°—ú 0ßB¼œ<{Ñ@ ÏìâìêܽO`#/'ÿb ‰úÕWˆb`Ÿw÷=‰ÙÖƒŠì;=ÛwèÚ%ØÝÅ5°c—nÇÞ¢ ¸‡§—œÚöjáèßsóŽmšwêÛßÞîghæ_×¾qû> O¤åÁ6pkëä:NýGOÕ?ÄÉÙç®Úë׶wn).è¼ò÷rmÙmÐà.M†íYe›<ûÄV ÝëvoßÄ©¶Ó™çH< Ñ‘.í5z:ÚߥEØ=³d·s¯qòQnýmêuüã)úÔ'7ôtmÝcȠƣ'õ¬î;î+àÚç{뻹µïÒÓ¿{Úd@ Þ¡žÕæÆi=yò…ºNnÞMÚwiàáæ²*î '†¿ jE–L©±î2E6:굪,™L–%7Ù€ë5ò,Y¦,K¥1Ù€g+ä™è‹Mʼn6àMŽL–™%Ï6*ÂirB`9Z‡½ªs²eÑ&Zò/—Ki3h29nû-$ ýe¡0¤SçdfÊ4:m&Yš‹Íœ¥Y&“+sŒQkUBø˜FJ6™3«1F%Z7ë„Gú\*sJY&&UJžf–\!Ú¡Ï¥Õªs²è™BI'mç¡Ý§ÊV°huÒxI¯Tˆ¹Ë;1À%æRV–\ÜÃœ"Ò+äè3[¥±1‡iÐÊ„\0ƒ ÍÅ´k:mÀõB<‚—^¥Ì÷µ*%¨ÂÖ ±lÙ€¨s”f™†P¼¼ÖqÃs‘D„§Ä+!aÝ;æmèt”þ¬ ³j N(£µU̳Ѷ]!ËÌ–6;Õir²XõÓðYâþ‰'ó~dЫRü¦ä¶ÿqe~ËK¹ÏþJXû¶ùkh×´·Ì–úò¹Y-â²s¹¾‡m8>fdê^9p5g›ÿ¿rž6àÿY¨‹ÿFÜ_Q±Î€ÿýˆò0r±‘€Û‹+:†òbÿWÖôÿCpŽÿjûÿ}ü¿'€ãÿµ?5ärä5ƒƒÃHÛWÂðPýE~Xô#ØÙÕ¸þK;°+Á󘃃Y%ç6”²C¢°+@í DuÈüó„i!X… ñWáâ-žÍˆŠ!Ãüδ\`óüé2”ýŒ‹U«`ÍFHHeì$ª»Û +WÂæ].>kÎ6{6À²% 7Àîõ°l›$,éáÈnX¹ œ‡\è’’o¼88þH…‚vP¸…Ôü ‰âyGêÌóKMø¦$Þ¬¹Aîjø‰ʾ6ÏvŸÀm¥Û\_…O{ÓùMµŠƒÝô– j—€|E ¡°ƒÊ])†·èóû0^ ?´1ØÞ¥ÃM,ðè>ª" 9Å âOWfûáÍ2Ò–_$:jhb›¤[èâ()`ÙfÛ8t#MÔ{ëÁ.?¤l“ ®Î¼—ÇÇ=Ñ…_¤ÉÅ8]=äI‘Û•ä™D5¸üŒ7DåO=Îù­*±»îˬÙfL+ÓSñš÷„g?Ç¿Šn ˜ÐödF™"Õ„ø­×plrÂâ$æX‡Ø&IUð&^Mîj|½D ÛN…O„+ƒÎ’m&¶Ç§V;å^+çààøˆÑö{äÏþ£º:ãϦSáåe¼)ßt:Ð*¡P~°û ´¸¥/ºOØ =ÜÞŒ÷Î]M#)ÀÅPt ¿lÁ6Çæ¢cÛ¥H,·w@`0¤èq2gÃzˆæ'qpü -~°㸠dO£úâÏ|ù˜û“,æî÷“ɽdæh¾&Uº(>J7Ÿ%èXÅôÖ÷(öTÈoÕ—ðrààøNŽd2¼²s˜£…{ˆ†ÀÆp¥ݳ “|ªè"èªè^£EdÊM/*è-Ñþ—,´é'ß½ˆƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒãã…­Ýçþ! ¶Üô*×¹±ÿ¦‚ûÇ~/×àø@Œ °kp(¹ÉÜwŽ5¹ ×ȉðP2hš1Ôâ‘pýŠ;ÃÉiÖîÃ×äï©èám?;ZJCÿ09¤ÿ¥ã OÍdkg/ôyÖê˜Í0° q)&ý¢ó;aÐ@9 2µyÖÑç™mèsÔdëK(“aÒHLvÄö<ùAtÜûF=|<<Ì`±„WÆÔæ>(aœ¤ ùÜ8 C¯c!Eùþº¾h è§îZ»g¥@ßþ0f³)€}s _o¸žò¿Ðöä÷`Ô8neäÝ  SB½oè{k Ÿä+øV¿AuÚ”u§£`P?Év„€§çaäè?Î&š|žÜ„>…ÚøÂl¥ãü.,µ!C+zÌŸ„¥¶ñ˜EÚ–R3Ò-›¹²ú÷‡›­“6S¾=à-ôêeQóÇÍx>Ý> ýX7™¾½áÊ2tïÙ dÒbJæmèÙúõ;Ú6Û”'“„rå¡|9VÉ»áÒð/ñ¾ly(WÊ–fö“éA­"x_¡"|ö]à't_P^© ¹¿ä½«ÛÒš¤uL+V?ÁûÏ*²¥s´Ýù§?¤²(·@“GåO6E˳(¶á¬î†÷¥>#ÇRð&ïí5WtB?¥+’ϲj€W§XPåHõñ»À<ÓÖ±*ÅR‘ù?M³Âu²ryþÔJºÁ£§¶S"8îŽ+K¡ļéÆuÀXé’\‡¼¿‰G÷J}L¯sB—ÿ±Ù~Æm–¶bõ¥—yú|y=ÔžÂÍHöVQz«õ\êÚšR©}ƾâ%åÀ%ô³8ó¹ŠÔF'Rù“2ù eÖšîåû÷E†Ÿ©š}I5¡Ý||W¯†Ïè­Fìõ„,FM†(B.µúZ'þ¾û:@"/eÊàUŽÚQ¥jïÏ¥“°Æ"~E9j2¥Ë–æ, ;n³š¼~4s9¤úç³Í×Ò%|N…Âئ ©fœBÝ»¦Û”µ”È6¯­k,Z‘‘¦+|9j[³Í—Ì{ú-øŠ*Ã% ¤\³xQ¸Iý˽ó°"V®ƒ·”ÿ{–B;ø¤,_JJôÅ£°,Ön•ØD©>øÐ)N22æ*úÒ`lƒŽÖB—îp3Eܨn‡ðpØy”µY­}~NjBwþ€®Ýá^: l %Ë€(24/v…™õÓ8L[ÄrIH¸ %K@§y”lÒ‡tfb›!ñ!<’hËÝÍKPûKOˆ\MQgÃÖu »Ž™Ä†â¡¸/Þ$]!†Ô#u ز}î9aÑ_W4²`›—Ï!åÕ»ØfçmˆÙg™ó°Nz}ÿü¹i7èIÊ×°a~¡ ÌO¿²Oª<ÅóAÙÞ’ø¡†}[0c÷œ$ùç̉1z†ðPí(ýˆí©r°«I´àŠ.Š»xÿ ÖP†ºH‘¨¿*O=ácÐå[oªq×ðþ§Ñ WQù¶¦ò]‡å{#ŽOFÇ©$;µ,ùËàMæÒ„§nÂûùÑì[ºÂ—?JlCŸôð,æÉÎp©—Ä6fx~Æ3É*özÞ°Ó4j–§CÒ3P˜I)³BËAãÆðû‚0„ÂÅ!h.si^ ŠûXØæKSMnW?AêÍÃáâb([ÎâÝ¢Tñ"¨Oqn¿Ù§Èoýœ¡ÖpO”:†¹PnŸBõB«ÑÊÍ=d™$œjà~رÞŠ)WCÍ’ÈNõˆ”Ü©aR:öŽí‡û Um)>©À§ä#¾E&ðUÁá+¼9niv„tªûí–Ø&?4,5%³·Zt†|ÔA×ó½JU|Dcü>Ôºoàýê« ;ö@2}›îJJ€;>­1åäæNÈO£,ØæS²UyÛ܃a­,r¾l¨Õ ¨Béôi@‰ôBÂQß'%Ï/À«.5ØÙ˜BY|R”ÕœŠ¥p£ÌÚø®¦Ç‰|~Õ2€UƒÏkkS.iÓáÛPB úX÷ÎäªÀûB¥1µE„ S Ä9Ðýá%üë+Š2¼/^²NãÍd8~Ë÷ •ï(¨Š}Ä.Ò{¿/à+Ê7: :ªe xñkñþì-“l“t$¨¯À±*øühÁ6ø½Jø¾ö¡ßz!V_(-”Nmë׌–DGfÇÎNýk‚±›ÞKlÓ´.jïc>ÅŸ‡~,lSâïÃíx8þÕœz’lS¢ÏÃéÓpê}‹&2¤*WÊ•ñúéè³ÞÄ6‡ã >ž]ÏR?x$UÉ4TPRÍ©é›Ç›(nU†™j 7ªcE¨½ë_ æ³Nìi¨#ÛÁ^U\eíºN0þ¼Om¿¼0*¬$éK«`Ý@¼ORÍÅHüÀ˜¸5“ùüì æ3Iŧ™~|RÎQÃc¤ã =ìtvŸº½ØD:ëm5“©wH^šˆ÷£÷1V¯Õo_‚Ðáp€ÎVk(ÐNÔ¥|µ’†«vPæs’6íà†œEŸGè>/;È_„2òzØód[-Ø&Èüºý•‘”:FŒ‚È8¼Fe}) În_Cá&ÉÕ…"øÙiá3Æ6ßÓˆ/ Œšyø%~‡€‹zxE2ƒ¯™ú» ôQÅ<êR‰yXøxòbÖS>A_Åñ~ßHŒgþd Å ±?M†c”EEJÂÃùÖåûT½âx@ð±Ùx‚ÄŒBEoíÐcü`ÝÃLlãd‡Ì 6ú–?XË6‘½Ñåmÿ†D¬Ö´&`EY5\a÷ó÷°ÍéÕø7úDO»BphÛÇÂ6ff %ÊÁ™iÞ¦p(R˜=±‘½‚l“ªÕ€jÕèª=ÖšØÆüò™‡U(%wÍ2]/°,ò”m F›]8#…å‹Âõ g¬cùÎ_üZb›7›¬=øN`!«S {W¨ARÇ”3p*›ëbþ,Âû¡ Ÿ/Þ\ÔZLùÞœNâË?"ŽÅí˜-ýph_ä'üùâT-oŠúË‘,êì;н T®€Ž+ï˜FRr±•½ÄmjÌÂ{mjRÅÖ+!´™)(ArSëáÅrê…étÈ7[ð¾Õl•ƒL>ó½êæ‡J!ı;Ð1â„õ<6c›Þ¦s‘ÇŠ²M<ÈR­sþuZÆ-êo‘±g_‚& ‚]M.Ÿ|#ˆ&Ä6eY\ß–e[È6©ƒ7·ôiH>Ž/›\¦„†” ‡î$ †A!ÚU²ô7(! ÛÞ#¨PŒMò|÷“Oö΄OòO[”‚shܺÃI\Œ÷CÖÃ@ê,DQ“:‘X=¨S)ŠZpô$R5Ž~ãü¡ =ù{BlÓŸ}Zþ‚HûB~]îmÆ6‚Kþü¹±TgZ×ÃNëm·A›l“ †ïì`ÐJèç?·‚¸õ Û|ec EI‰Âê6’ý&œ0c›ÒÀÍ!ýW¢ãZšm¹_'©àHŽÛ”&):þ5rQxŸ8f,Q«Ñi†]EŸ¾Tï¿EÞÔŽŽ‚N‹ uæS¢ÇZäúõ4–Eò¼ïñ¬–2p.- Uª«·C³O0Ç„OŠ¸*‰m{$¶éMúJªö™‰¥C@«eøÀ™§ÄBgaå Zóz7ÛdÀý0ÆràßÂ6"!gÑ4iÑæ¦y‹« N,Ûž%þàpÓU´yê¶ Îæ˜y.ÇÄ#Û¶õ0óð›[ÒÅ̱œ§¨ïG˜ Ôe‹J­~19Vï*iG,6/8cg­{ˆ³ FÇŸÛ¢·¦Ræô€j´ðÚb% s7‹º0Ü# ¥50ý«HîåiUÂŒmέ0½rVšöÉä(³Ð~Ám@N.’~…SâÓ| •ôŽ2,çm*ÚA±šì^öÀº(o§åÙC(™¼ÛËn†v4¥l©¯Qz,`–Õ™:VšÞߘBð µIeœ4{ËzÒ¸õè|“KigI+x±4ß´Q¾C¼MŽ{ßÐÐL?™çCx­3Õ@Ù¼ÌLVŸL´°3Žys*€Rœ9"ƒÌ†·µÙHaiéD$¼Ÿm„‚(´ Í>¶:5…­ÎL J¥E½|*4Qâ#«Ë€GwãþÃ+µfž³ÍÂÄþýÊc5ùÏ–< [?„ÎC˦(Œ†ê*‹Fkk5*¯Ñ'EAŸŸ£bêU6} µÄÄ3ŸxÀ7¹P¼B-YŠ3*Çôùø Ù9oÈ[¿QÌ@%³(Û”WBø·c8Ô"„ö›m^@b6êM+F$xÃdK~´V@bæ‘â™D˜O)|›>ß[¾jE½1W­TÓõ  Å,@᧞Ò`,Ð¥TÍrL,ó:#¾®5«ä˶¦SaCÓK›0ˆY¡ÓšUŽþkg5Lsh|â%RÙzöcÓøb.­™={Àð‰ðVš1Û3zö4]3¥cVÎBŸ#&Cº–™‡hRaâ¯Ð£Ì]ÍÃœ? zt…ûo¬Ópç 8r¹ô[“…׻Úã¦ôY =»Ã€ápóK˜ò™ G7x.³ñi…n}!÷Ôþˆ¾ݺS&—¨ßÐå×±ï©B1@÷ncrytúõ‚ý`oœÉqgôê¡“qÍøíŽC_!ßúÃþë&ŸÛ–¢ÏáS™úo!ÝL9,|W¦šù\0£‹’òpQ{:%{ìl©àÒî@hèÞVE›ù´,_›Ÿvb ¢l™†»Ló€Þè¸ç¶Éÿ²Pt™0ï=yµk>jWn‹Ë³Î]:ˆI‚ ÷R?´º>Z@kX+`íHèÖ À¥ûô†N 2ü¯ñ‘V =zbÝΑ­žnÅ(®¼Wg¡swSIõ…èk¦odzH*qj±»‡à›BlíÕ¨`Õ€Ô¿™x¸CëC¾AµjpsÃkÀatô eZ¦äÿ N‚-›à@ Sõyr’Œ…©Ñý^ÇâP1eõŠ¡Î¶±|'g!Û4¥ÓÞãÒ(=B†Û[~‘ÎŽÀ6®  ¤ {ÐÀy°|ˆÚqÈ6J(VÌ2¯ÊÀùg  £€ë³­Ùæ[³}à åC%·½g Ë\Þz‹Æz–‡gÙ ¾ÉŒa½¡zE‰m óŒ„gGØ@*ßÇ(Þ)ÁP´v.Îp3’yT†àB:Ø7ÈJEM^°"¸80ÃLõbÃX?"TÂ╘yàzçÊ··Å6’Mî Òs.ÕŒåa¥Â¨‹.àé+–þê‘6lnŒl;Sb©ÃªŽ}—,w\ÜH|ÆÇ)ð'²l²Íó3¤@[Ží.ò…¥&ꤓÏÄŒT@1F r"•cÁ²p4Õ‹9Ûho™*vÐj2k˜ÛTllbW>§¼Ô‹â •NÔÛ76 +¶Ùö;xyÀÞçïa›¦A›ðuGüYÚýŠ&ÀyŽ¤¤èEYŒ¤Œ¤êNfƒ[n £;E–p'I°fmÒR×Ìg8ÑPe÷CܤE¨Ã¥<ái,ŒŽ?zBâ –·E¤­Æ„Þø犘ùóÁ—4l¬Ì[c¦D=bK¤˜ÕÈv²ŸYÖY±Í”vàíäÌ´­no©#~GÒu ²ôŒmj,ƒº_À/d2ð ] •Þ1’’ò*7ÛôpƒFM™‡¡l¼,né0g=dç½¹Y{ƒ_¢"MŸúIS|‡FJÅ~¦ú\ý T´Uê*ØÁç¾,YÂسŒÞQö¾!=›Ã÷_£ÝDãŠì@´×díÒ` I¹m…‰$oy W,ÙÆ®ê Súló9Sˆ˜EZͱ¶ÿX‹ƒäú69 ¢ñ‹çûø‡‹ ’’,®gɦ§¹ÙææF²ãûîÉ©õð[/2Alö4ïaÇäÆk´1HáðHi"–“ЩîÙbWÚ49i%ÛÌnÄ¡m9‚m_ÏÊNT°ý¥,3Ìðò›”ØöÔb¶ßŠm>pÞæ»±p€vyL{+íÎÄžWd›çÏ,3ê(¥yòÜl£ICë”gv1—=Ø´•À3Bƒ·:DNzKT)Mï LÒ‰ùüÞ }Vñ†ÔxèÓ–_¤T|4 ª’uÒ%Ú„³;Ù€Ü:Sê‹+ûé“àNÓtBúQÛl:Æ¢ÒZ±Ù<m§Ó™ý:8J•‚OÉ"㚊±MµE°’ìŸDãß 9øÉ"Û$åÊ+•´kn¶ÉÍHBç&ðí€W“ÆÑÏ­k©Py¾¢i¥¤§¸ÌÄ6X ²)E»ék«UB~Æäç2.Tû8ñ^ii¢¾—vÙš »Æ`€o¥y÷­ø´d´¹ø›ÛTvƒßgÂÌ™0 ˜¦Ñ*±Á)cVû gáŸ!{„Ž§à^¸uªÚ.‡Ç³ÈzkõG"Æhå²x*l›mp€#Hu,2±D :gÑit$ÊW¥­?„¼½Gûä­…5Yô™úž$JÓe´ßTD²m¶)—ËðÖ®<šæ!ÛPP4ÿö@é4™¯"¤äZX´`óÍFqŽ~4‹Û¨mØS¯Ž•D¢,FR:9«ê‡¥Y#‹øÉ~¼m¡Çõ…àDª-ŸÔäÝ{c Ë”½Dá§Örhð£i“–¹´ƒÜ!5„7a¶™¸‚G»I´¤étj¹SXg†ÛXæÒ×v¸M™ÂÌýñ:k¶²:tª v´+&c¹¼:ùHšB·dÓº°@ÑrHNÂim£»[Lƒ@¹|’ßÛ<§ œ;ó-d?ÛAþ¢_„lS”؆2Ö±£%ÑéÉ+hka¤™‘V½Bòy³‘д |aoš%Ùf?Íž jdÁ6F™‚¤jÒÌ؆2Í}0óCfzý®À#zw©å–ª÷I¶õ‘¯kThö2î[¬r-ä ½7  ÊBFdÉ‘dІ†º¥+£}Ê ªÞË!‹(½z—bX-ÍZ‡Ñ\té°" 6Ñ–³ÑÑ¢¤b!¶ßÅÔTSô‹-Y° «0œµÝ•gx/t,wbq×Ðû2Û¼Öá+â¥È1cQx¶ƒ†½ÌØ&¯9vÊ™;´ñHËÅh£ÓCZ$:õ†ž•…¢…!_·½¨~Fмhëâ8“p.Ý̧Éä»` gFâ´W°ŸìЇ…æ‹®º çH›¼ô:ð(‰ù 0Ãöa”É÷Ðüçò$Úvã*L§Ôï [ŠEG¦:jŒÿ_ËWhX§¶ÁòHH# rM*Ô€7ôJâ5â;¸aÎ6‘%xÈL3¶Ék†Pƒ±\¢‰ˆÐ-˜W¢¡Ðî?`Õšp£cH•ã— #‹BBurÈ3À¡dͺñ–o7Ï`’îÄEua˜l÷%VKm¸×ƒ¡´!ç@ÚÐéüs$—oL¼=¾)”¤ÅÄA±Ölƒ•°#@#Ûø†2CBEn/†¦Ç ‹‘TõOÀ®S„èø9JæB¿¤H¦IžvhÁ§ˆ?œ·|ðo`€ÀÂÖ½IÜxk—Ú!v÷3Û¸H?ÖÚg‹ Ø)—0s©@ÕrüÖ>÷›íö¯•æm€¬ùÌíÄ·Ý„Ì]ÖïŠ+&¿V²v?“ óhË…¥ ÛXz(ÐÌ‚m–öDÇ°[ïg›C£¬ƒj³ÓFGüFIu0ýt!SbÍk>…>ð÷¦Ÿâž„Ïoþ™AlòÁ¯²Éq0mTh±q»¾@¹ô«’ֱܲU¾ç´¡¬»ž.Mã4G24ß¡kí Ó,±È6£°†ö^¶ÙØÞ:ÆÐ+´ŽoF ó­ýK†<÷‚WBI)y]I¨ëþ.¶éRCª<‰ðx¿ÙeÅṉŠ2¹/¶wNÞÏvP7_wÛÊd°¤Hk¶1¿òå×qÒ,q!Æ6©1~†íf߸¦ióÀd0~ÿßÁ65¨-/¡·rÑH:Zé³ÆÍçÀ짆å¿ÖÒ›Jea?.¥à¢–b1¾.šÜ ?ñ©ey…©Óâ8¡¤Íõi¢!0ÞP\‚´€o‰UKÅ‚ÍK¶Q™‡£ÂþÚ*U*² G… Þ‹ß.®xæåScéSÌ yÖI†Ì‚£JmaÏ.d‹Fú(f;Cl•/îônVâ»:­©Èôfʓ袓r@%9Ršó”mlåˆR–ÚFŒXåôï™ež5¬2hÍô­ N4?gÁX)›WZ¶nUÇÄ…iàk·0…ŸofÁm¬fu™j´¦Q*z“òÇ»EDdØn,q|gõ]©:l[ .4» ægÔqppül#ŽkVåyÁÁÁñ7â£84ø_Q:6YâL‡@ÈDOסsgh/ªð%Bp0þdWL]r:7§bÏHŽ÷Ã[ZŒ¾¢13A2à³M•íã¡t)v~bE2÷si J²Xù¾'ÏEŽ÷I6é¨0JÇXôZ`ñpKOÔ÷6²ùXé,m­°'2éhûÀƒÓ0{6¬ÛϘŠƒƒƒÃŠl6‘µìyøU„"Î&÷,²Û”DJGf†„È$oÐص?þÙ¦D5(õ³ß鼉ç+‡ üò3t]IG`-. РüØu,­ØFÀ ÒO æÙ¦ä·ìQ!ÚjIÁe+Ɇ΄m<®^‚ódwÙ”ÌÊb€]æ Ù¦žäŸ^Aë{ÉŽUd›ú°§dbð2‡g.‡æ“c‘b¸ ’pÌùióÊv¶Ïïð;m5°>ÍãˆlómdýB›y¾Vñ¬åàà°@¥hèm÷„Ó`j{l_ K–Ð%žúú9,^Í6¥ñ$“Xãã"Û)ƒ†0ŠTÜâÉ®¨yÎrpp˜¤hñºñ ÓÀJv ]\;›ùÑš­€¾øägÓÏtÒ·ùJ2^Ηö?ãYËÁÁaÉ6zÐé,Oî6 ‹ÎÌìÔËŶ=íbhz‹óš9888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888þ+ñ?Lfí endstream endobj 1004 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 347 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 42681 /Filter /FlateDecode >> stream xÚì½utɶ/ü¾?ßÿ¿u×½ë}ß[ïœ9“ ØK-–™™™™™™Qjí03Žc”-cà çd “L23¡qLê¯A’eÊdæÌ97sníµí¥®®®®®êúõÞ»jïB@€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ú/Aƒýëë½Úß0à!î½:?7÷¾NHLr@jeta;`À€ÿe8¾LEãÙ/-/¿Wh‘œ_í{• ð¿ wßAìƒ3ßC´©ë O!€þ—á®Ä.8  `À€Ú   @À€´ ðû‰6««kÛ¯{h0àßmlý’kjkë7Rmmí“'OÚ ø÷Dߤ‚ÂÂb ***ª¬¬¼sç@À€ÿ£Ñ¦¢¢  `À€Ú   @À€´ükY9i€õˆfn«gÐSSì–>‹eV¢—‡3øµ¦<èoÕ –Žå×›~ì|GõìÆ{MZf^¿#ŒßÑtá¶õÄÒA?´hó‡àê%‡Í†LÌæK½²ŽµŽ±žD”·¿‹ùlx;T}åÀá8ä\Кï3HzN›ãW7ŽÑee#ÛCj©Òpvu„ ˆÍµ÷Lï®ÙèÇ~tp°Ó;ñC"];ýОJ3ՓÕzoDZô#@€6®êQ°è‚õx~Ïp~Ïí\Å)w)‰%˪×ãôHÑN–0\ÂfÆ_ETxJû™ƒlzÌñ7æB:Oh˜ÖìøÓ¯10A ¤‰Ë†·@Í¢žúÖÏÝ–B•ETŸÍÑÜÈî8àgO¦ Ã௠A…¸cËÙnˆlÇeD_\QéÍhó7;Ù)ÿTÑáüî[Y§üÜÈtiDçÍ´¥   @›÷mÖÁ—Æÿ*f|èÛú=š¢ž7ĺ’ì«?INräúŸR˜Æul¼GÛ:aÀD‘‰çn2¾]|—j›×õ#ÕôJjŸÊ ­˜À¢åhî"Ù9¡LTØ¿ŠëPõœ!É“&-™ÉÎveyVÌ JÚÈH_Õç¶` Ý<’ŸL±’äÜýРÍm0F9ñÒIJrÍÕcÃüâ)MRÜÿs½ZÉäH+o®a¶”ID=vßž²Ï¹á3íRÓK¥TŽ#„ùe'ÙFqm–Ëf†µÌª¦L¢^öõˆjôŽ˜þÅèÙôÌh®CrÛ¢™øLJ§‡h>Õ˜0ÔïogRl³zúøTZäþ¯5úíáËÌM'.²Y´Œ³oàv]õÌb¨ŒÍ;‚™…§œ’t¶mxó8¢žøÊb´ÎwÜŠ6„=9:ÎWà˜ÙlÅmÚü1ÐÆ6¿÷Eó§Í7ŸÖžtÚ0dE­s(ò¼r³ÝãRù‹Ì6‡”ç:QÛ”óÆY$ÕÔë W;:,p­m·0óî„6õGN@LZîÕÍÕÌZ’'›Ô¥žCT³K>²=öEŸ©¦ÑßHu±'YV£Àï¸Ú`œÁsLlÓ®hÐæ€6‹ÁJø"Œ…¾A¥—GVP!§ãP DwI¨ L. L.÷c’Hñç,.ï=ÂÜÃHêCT;«ffn9ÕÏfÑÓŽ¿Ü"Û¼±…©'QÙFq¼–nCsŽ¯ îÉ´±‰•ïÛ8²ºm °îE¤‡Âk˜Ùq1!`€6mÞk´™Ä@ °:†É ©ÓmX¬«Õ͉­÷|¡Ö¿ m Ç3¹&8­ çÊàô†Ú›+ØÊ@ýbRrÉšá˜âŸRá›f/ãйþ…WVÍ å-)tª_õ¦;NÞ—‘¬|µ{fÚ‘ÈâТðܦ°ìz¿Ø ; —ÌöÏ»ø“Š°oƒÞhÐæýæú“ç\ýÒ«G7ÚRæÞĆúyÕ~¾¾èŽÐ†f‘œÂ8çøË "ýÖmW·ø‚¡Mžw Šs Œ]ç „Š%b-±zi>;–”åã’Ý8Ø1KÜq91<À£â13eyDzDyÌYÕܳŸH´4—€—€X×°ÌèÆÊ9DÖ´hóGñ“²ÐžÌ²YTظF×°~ˆå1óõô·¬éUî˜/ê—ô¤€6mhÐ0`Àm Р `À€Ú   @À€Ú´ 0@À€´h0`€6€hÐ0`€6m Ð0`ÀmÚ   `À€Ú´   @À€´ 0@€6€hóOf,¸÷Ò}QëADnÀmþ‹¢1R÷äjëàÓ†¾oëû¾ixÒ:²c”7Pk¹ö¸¾ïÛô”%÷§˜DZo˜Ó¿m°ÈÓ4øÒò.ª9$+"ïù(³S–{¿n[ÝP%ÝRcïW­ãˆâö“úÞo,Ê7þ®ï{Ü9úbûS½:& Íýê±lFnø¾}| ¶Œ>þSýÀÄÓ¡ÿ;o?«ïý¶]·caÿÇ_7ô~Ó2º† `€6¿m°]¿ ôwåB4 …ÊbP(d2W(õ«ž‚‰pý“KAnÎt&ƒÍáZ0‡#ö¬E¢í‰b1tÄÁ!׬Ӗ{Ñjƒl÷Ñi¡ Óˆ¥l£ÕÿU´{_àágýz¢bhV@úsĤ©9ŽÅd£r8“Ng0Øxál6?¢öè!&ÂO±ñSQ &Ý©htÙƒÏc°¹|[)_$åñ ™Êúd÷šn¡GjKƒ¹ÁMØ–O3HãÑ#">‹jÅN¿¹mÐüšÑ{NØõÀ²ª€´ygÁQŽ=ó¶grìãrN?ÖÜAºï"Ýi™T+rüɧØxœ\ öp‘D¶¢§Ì[ÓŒŽDõ<þû.Ò~®ŸÍ¤å_7žÒÎmØE;>-°±fxƒç7T@«ÿØvŸMБMh3'¤|ˆím=ƒ•Œ–¶ÿãèO®ÊÅž{¦[O›N}ŠÄ:X ót?6ÖD£î!Èó.ì¿gJÿÆÇMÂsÉéÔ°u'‹|Ëuè½Z LÏ”î³\+VÆàö­ÔÑ?Ë!qÃNÊiT€6€ÚüFF¿òûëXZæ|ÿ#ó×|ÚÐpö3%¡Dàh#kx{QÇ/¢h“seu›³(¦ÔPÈiõÇÚ™wF›Óë)êÙŸÜ œ[¿Wmé깕({AÖ-­iO7ÕÔ m³OZ–ÙؘCbû5à*›âÖ!‡œrCCêZ*¿Œs÷2·G›I¤ýÚÃò[«ÝsåT @Àm~«æ‘ô`U®EEåF™·Ûà‰–²%Ï¿Œ6SHeE•Ê‰=óƒZ¿ Ú„ž^>p«0¾‡h§>ýÞhÓÐMâø7áÖ›æ³g˜¬ä¦ÙõÇ|Ú˜6­Óδ Ðæ·³z~9\º——2¢™3¦´|ZthçñÂc_(Œš”+ƒÅd1×™É ‰#.+õï"Û`£5!.‚Îv,»¹¸aÇIm$664²5•deÁÖ ò¾¿mrÏu/ èsif‘Ž[_û¹Ùñ}K0Mj)*tdLhç,ÊyÚ m´ùÐfa-Ên/;î¦môHa}“AÇýã·Í!&MªN1±Ü9¾ÎŠ‰5å;jRSˆŸ¿’ú6®m¸lxð ¬[1–<±Ú1¨ÿ»5)!‹ÍY·i³!*/¬l·WÏ?÷fÓϸ€Ý‚¢r­çMc=Óº°C·|ì*ôptô)@Àï)G6Ãq0Šï®ý#4©·—ù.š*)]ýhRm¿§Œj=Gîþ‹ŒÐìƒð‡røÆO [ÚüSf¦0›§zÖ¸Èä}èãÊŸD³jz=‘X…H˜²ÿ3í6¿†-Ûz¬ž&ç² •7¦[d&–ô˜Ïâsm;ÆÛÔ¦¥ ¦^Û&}=Ñò,1€¶¤ù¦ÆèF¨¦¶Ç¾öÃ&‹ºÊxáood%q»Y¼û6Ï ú÷wzñvj« ÷ÞÒ>³xûoª!^ŽJ¿ÍÜ@›¿‹gÚ† ïzñÏŠ­‡Ï=Í­O~m~g¦‘¶³×ý‚ùB1Oì♢®_Ÿó ³wJ½¥üçÖsCz\¼ÛÙÒ¸Z£Tó$Ε7W‰œÍç†üBBø"1O(sÊË»ô›z3½Æèë]ÐØ&wvB3ˆƒÃjotNmßÄ‚Ÿ¶3—Ýݱ=¾™…—~2N«M#­§.º¹9¡é2¿ì¢+/ˆtþ{7¾-O$A›Ž`¡spËqkÅ%b[_ê ÿÕ8sWÛ ó£àÑ7æGÆk¸änëšÞªû•ƒÿàbPM>‹ áqYžeŸ(·(qŠé€ ž@$rŽHêyÿãÿ Îûøp» ’Šë+›[uz-;Ò#›‡/’p yîí­-¿ìÒýÈ6¿'£ïçÔ×ÎÍ^Ì—„´*·}çwÑå‰ïE4çÚÙmNiæ–““ƒÉ{(©mI §’ëøú:‘ɢ؃_ip!Çߟg]ù›ÞFËÂïR϶ ƒ4Z\˦zTÂÿ[ŠÍ™Rª;:˜\ÛŠ«(T7æÐÈü€âC™ðõÅ¥è¬Lº %¬õQ`{¿ÞYFgŠü#ʧ6ŸI,o—K¨LIPÎÅ7ÛV¸v¿–Ab…×÷Ϩ¬‚ÈPì‰Eô›[­UÐI숆>4=½¢œEáÄŸÂ꣙øBÊ`úæíÏ츜s¦êv‡Î žzì!‚äIÉí}MZ!Dr˽®@«4ÀŸXzš u‡NÚ±­…2'ž,îW¡ úì1"‚D,µº®“ÝVOY|dgÄD.—-ä yŽ\¡4¡ë<ñ}ÙÚÆÖaI©[j¾ö]Cúª¿†ÇŸ×÷?ULíP1 ƒüu´ÁÕØø8Ž÷QÕÝ%Ñ.yã7£‘QöJÄ"–@n'·g°%Ám <ºf\b0›I•¹ûs!šØµ y‚ðPP Ùt®c˜«Dg»M¡%+¯O±˜tŸ€¡gFhf™HÀ”ù5´O"í—§½Ý4kt^Âéç–qoÐW×Ý•o¢PZØ:°ßºŸ[†^¯Š6’`•-ßÖÞ;˜KÝÇæ‡U`P`hÔtr¹\<ÐÙÛ‡IeÙ¥ö«ç°]œhöáJ‹Ãµê™Ÿƒý|!4W@œ½”Ë`;'_zƒ ̱g^n,®Ä%$^À„øž¹­ÓHsÏ '7{Cæ™›Ù ]OÈÿ!){€¾œØ$µ…äoFT„pa³Ä)§»ïš1šl,Ê)Cç‘ Ù6§oq}%$aŒ:ßC³f'_þY½©ƒf‘”8.Ëïªm"ùü€Kð<’ÅaöÑf æCzQ,Ußc19Ùg^˜×+ðRÚÔÀâ;Ö` ÚÑ ®5”Žê_¹v\êþý™—¹#ÚÜ~(â‘B›Þ(Ê‹IK;þ¼0?…ËaÛ:‡ù§4V´©œ=¼Yä‘ÝñpÚÔTzØH›±5?8Ú”•¹‘%튤s诛ÿ7@ù#¦ÍÍ#)Qr&™î˜do/Ž(I$Ñ}uH¥â€O\_¼Çå«ï¼òæ|äªz‚¿ÀX«æW³!M;Ìåé‘¢ú,¦¤¤ujC¨I¢³:n GAçvØve²ùsôÁWø v$6ÄŽIf:%Édv1•q6ÌèV3:¶T,'¬jR dk&æÄ6ÖQç×TÓHa}“ßd2¦E‡Ûó½Z”sH×=¤Q]F!yV @±¿”Jñ(¾5úö‚I W¢¾ý¹˜A÷*F‡˜vièÑ0˜PáÕת›Ó »´÷1c…âüy&“yö)z/å%ÍÆ¿ñÞƵÄX¼ñÇöœÝ^ÕߢïøJØBϪa¼c_H¸ûü¢ïO\f†oÖ)Íï«óò¶5)£û\º{Š8v±-3X°¶«ã\:)k‰ès7Uy掠ƒ·¤2šÎ®ÇÒ»çŸûËÉ”1Õúnç2Ø™÷0«¬_©>1]}} >ó9Üt[Y·&Õ ªeSvñÜSckOçžoZÆcz`rKI~]Ô‚}"7èkÚù'.´]öõÓÌl‘üD“{ÞåßøqS#¿mlÔ°3ÚLB+õÐSþ¥³˜P9¦ÃL¬µZ- r¨Ã­Ö–ÈŒ>”bøc'˳ø|ÉñÙå!)‹{ô ö&è+ŽÏÔßZAót…ÉdÛÌ«ËÝ ˆvvÕÏYJå…¢/g•òH`zMp†§W†–kf?ï#Çœ{mþxUµ·³x’šÛȶï’FwߎAK¼¼ªÞê3þ­‡Ð*õÜÉá¾íÔÓˆbüeùñÙ¦Û˜ÝÖUA";æßÂ^?­þ…›˜K¦´Ï!eê-«ˆ¬hcR[ôHEž?Å>G¿ä—‡Ù3õèS¬ÁgÉéö9¸d6ËcÖûé•D//N‹}>&qY·Û7= 1iy½kD˜µî+*=Dó±fp}£•÷Uø·F;û؉Bñl¿‡ªHgÛi6~u[ì6Š‘Ï%Ì]ÊßRsÿ¾É©Ü¿pp`zM/ŸXjøºúü§Go ˜{cŽ¾Q´ñàÊ£OÞqí®ˆCuÏÀ¢ô˜àB3ÿÊŸ·Û¾îõ$ig)l(‡ F=RÖ–Å`§µnªg`ü§ì6„¬rë³ÈøŸÏF”A—†¶6Œc#.;=žéÖ6¾Ùª™_ î²Í¹£ÞÒ °îuvI&—Åæpyl6Ó¿ê–Qh×½Ê*LçB<X;b|À3W ß1^Ý0lèüÜÏÛ™%pªZÑŒÞ3²Ô3Š©ÕÎñW¡L+`ÿ#ÍŇؚCÁôeÿh“vè™jâ©“-׿lˆPâª`˜ÙW ÛM¬–u¶ Vyˆá”r¨ul³“]~nË>°m+üòÆÆd(¤é-VÝœ`/=ñʺ|X«T2¹âªAÃvFCazÇ·D5µµzظh¹p¿mÌ¡[t›&æÖ2bƒ ÏtŤÁhæ*´á&·Í»Í/­{æ(Ý"#r›Âs›"r«„$Ë<¢fr^¸w_äEÄRýWé_ûK„v™Ç5ú ß‹ª. ÄB‰ibÕj}ÕD׆6Iû¿5Ž©¹—~<’¬f¦kvmT“_…D§ùDgûDeÄ+”ãOø{ÜK6ÎbL,gN7X‰Ç_8:°¼ uhקççqÙ,§ðüÐìÆд".Ýʈ6îl—ŒaÓÜôZÝñ^w!‰D:úz§vuL#]³_;Pl˜ëõg1h$Š «rtg´ùß’íÑÆ<׌âðÔJóÀ×e‡ûlŽG1úöV¥ÒDÍèÈÚ$ÛÌ}çDÙåØòM×üËØø4o¼5üs/)æ‘ÔX{È[Ù8ºŠQçí'>"iØ14=)JÊöÕ4®¡éCßùz ì¢NaVßIóWT&c…vü®˜DöÓ~…JMm—G=\Ddk¶Ø3õà-G%úÔU='\ârÐ;zEW×NüvÙæ-h£Ò/§gyEeûDgy&ô´£cEMšY=ôsþ•žé9Öl°)I±\ç„ö ã›Öy¸Â†Ô„Ïèm È1ª6N&ÙGŽ:ûÊ,«T¶µ²xÒšá-² ÿÿ'G Í¿á‹m§øÍ>z–o‰W£}¥Æõ¨’Õ•nÍNB+ªí[+¦vS|›s8tŽsXº{h2Î)žÁ4Z@•Ñè?—’vž\UY. ™~î$%À}$×e›Úƒ‡ ·B‡&¸ç¯èFà¨&ÅŠ×> dÍì3w&Ù¹iÞR¶QéÇ{„§z„%Å4M¡ààí)ûT)-»³Û<Ï? oØ m&•ãŸIè»üÚaŽ¥è;<ô™Ð,Û`h3b6¡#QsUÁ¾ÏmVÙKY,ß#ê»?¹Ó÷zt??ô±©þ÷1Fsn6ÚI8¦ žXÝ‚6kʉ7Mýßtè̯(þGÊmÈ.˜qéìª5'ñüúˆ0NŸTQmYKÚÙŸ"BâˆÖðN<¡šäHÚíbQcZ“SPQ‰ÜZ&¿±·ù(ðÔ²Ú”ž[”I|šÆ0˜hm¼} Z,\á>ÇÖÏ´øÚíüÑQpý “b[|ý œÕ¬øÐÁ;(Ñ-¤¨züÑæ+mB ´A_ƒ~Ý/¡ÍRRb¶{XªGxŠkhGÇ%?M^;¦ÅwüA¹ùâU6™š}}Ã]2ÒÙòȶ š„´*rlXÁ(ÚåpER­‹D¶AÇTw—9u|§1-ïÉ-Ïa £›·{„¶¾k/ùõ3›« aþ<ß|¥I¶ijŒ²æ$¡šTvJÔ–Š ìc.*ô@¶ÁŒöYQªKÒrã•Éç.‚ÝnT³H€³•(ö6L¼£s"*5i©Êó°åtâQÐ5³¯%lçš1Uß8*'xLÌ©ô¯ 5SØ~p¸Ýƽâ¦WÇ4ƒ#l*wä+TÆÑÆ·vùÓÐÐ^H&CšG„¾;zR#Åft~'´™RÞå\3NÅÖvf²(¨l³h‰6è©öùdå§*“y¤BÕÉbz7Ì"áLº÷ xÞh×mºr¿ææ2lBlÜ´*Ï87*û&´1´œºÌf³~«š2ÍI¡"}U¼ ;¤ ÷Xó§3¡êQËoèÏ®¶BÏLqM;â^5‡„¸‘DI“ð4!–›:Ž0S7“EUó&2sçN¶_;a¬˜¡²0šbÙ†O ¢b[´‡Œ,HAe%Mw›Š» ÚËê[·9$FÄÑï6}gâƒyNÉ(VTÃmTÍ'[“R×åáÌ„h•¨(2ñ¥“lX’Øx2<.œJ–”ôýŒ¶yfª?ƒïQ}&³ýLP¨™î]‰ŽV mXb©¯oþ‘låE?''°~x _Üu²bøI9ôH5½q^rÉ+ͤìÛc’Ý–YåŒÞòɽdœ½ÚV“Rê~r²%‹Cj³UýQ)qa­>Ý%¡«ôÚ¢‡Ú´^`XÓ=Ó;Ó;®¤Õiåv$åšri½r‹K¶rJhM：X\#`’¼›>E_Ë*M3“&+?”uú¥zöy°—‹_Çwªª‹°$_ÙªI©¦ÓÒÂ)¾gBuLÅþø2e@l"ÃÚÊ·f”xºÎ[Ÿû¸°il¹OruDaghjLDåºfUÜ´3†¥MET²0 ð@¦âr\^1‡BìøZ±âÚ ÚE‡°ôœB6™¬ü ·?wYñ]ã#ÊöÇÖÚ é<ßú¶ ƒZÿS¨+ƒëS}$25‹AáÄú»cÞx—s %¾AcK,cË»¼ü¼ÙçÈÒ®˜’ž²Aƒfa)ÂCìTþW|îb˜;ã’–wd¶PuÄÃÇ“°«&_zÙr^Y)M§›GÖÑfkŒµÖS‡ Í=­míäòf)ÇÚ©`íwÅÈß<<<â½Ä–]M|"‡>’'·œ‹NÏtr¡rÞb·Áp¯ãú)c¯]HY\Uw@°CAè† Ç.JÜ‹z—ÍßÙœ&#èœÆâ;«šþÑG.ôm{ož±ýÚ‚‹‡Oú)l¶N=:gGße^•Òr.")Ù9Ô•Âv›_àÊæ©OrãðêFß=¤ãØ![—˜ÊAL§n=}ÙÃ'PêPt®Ã´ÞF5òUdB’³—Sxeùiu÷,R®ÔºxxÊœ¼¼Ò»‰Òp´I;ò =/ËZY9j^oHÊL–9ûv`6ÿÍ¥DÑ« O¶wõ³óˆ ©¸¢˜[Œ‘IAÞùãÆ9ñÊ7Ô?´n3^ñò:ù†ÔŽ /RQe©ØÁ7öìÏ!1å3JÓ¼gÇåáÀˆh™³—Ì3*ªeL=còœ‰ÂÒüÓ3Ž~eœ,{,uò‹9ôB3÷S ›ƒwë#Upõ¦Õ}u]Gì<ë׈Ê×ëõŒµwõ‘¹x&4÷¾Á„óòÅy¤TyÀ3 ÄÎÕ×Ñ?-®SÏšü¶|Ð^h8|ÎÛ?Xêì%ÊË9ó„ѱYè´—_–Rwþ‘Ž{.,&ç:¸zÛ¹…‡× «LrÎô›„,¬#Ðü…W^ƒ¡ {ÏBšº=æhïVÌÞÍÏÞÍý!uôKî]ÓÌ/GºólóîªñÑèGÅÅHåžÎÑ- ·¾uv÷Ï ª»*\7W ?p‚5/ «sèÓ€°0©ÜÛ;÷tûÑkÜnó ‘š&FÄÅË\ü<“•õ£ÆÙÿÆãWÐÇ)6£Í’é./ÕÌZ¢ÍO>RªsýwÛ£ÍÀœwĸZ©}`Ö7(X*÷ñ/ëoߟeÍNhóËnÅú-ßSÂÂi)Rê×eH¥¥T©·”áe~U!¿9‚è[.ÌÝâþ^²âDCÛü¾U UÌÑ%9ímþ“÷&žÙ°;ÿG·Â:b‘6ÑOáÙ/a·\,gm/<ÀyG`×Ø£xŠmZá_ŽŠiâê½ÅöD¹s;Ì<€Bs¢…Œ/ÃÞ%Øaª3¤¨'°BÐœæ°ÃD%윅…Y„žÁ>%X¤Ðôn¬&Šì7ÊÝÓØÚæ$•1'*}¡Œþ@“UØ©ý³Æœè%è…èåèo´¨Ò3X4ÑÑ¥÷¹ÁÍëKáŠ×ð¯ŽÖònhø·°v ÞíÛxc@¡Åâø}`ûWbá7í’±C”Ìc²ÛûMõ‡?FàòóX6ô0¶;D/DßÕë?bð…ò"±X£)jc!eg±CN–m <ø>öWìÖè¡4 «IF±Ú«˜Äe‡ýÞ늅Ey¯v(ŠÇNÕõïŽ^‚^ˆ^Ž¢Õ;ùVOЧ šÖ?>x ±&Ä‚7É!å֛Ц(-Œá˜Ðæ×z.¤ú‘¹‰ƒš9cˆ‰‚ª?§uÚZ/Lgï×›C‚tÌ°¦G4Í"Ú±q¡õGòÚ/-ƒú—áq…Çûtìû¨Äx¡PÄ—¸V vš¢cÁ£ßEÄÇ °t÷ ªÛFt3ÚLTß{ØÛ;¦žPgïhÑö€85=‡åŽv\¾Ä9¶ sÎ%v»›ûÉGLsªy€¾NÚÐÄeÃjàø3Gá>·â•8ÚpcÛ&ÖEbÕ¬!͇ÍðWãA!p´± lÚ~+L m¤Ñíª­_Õ 711X6£Í^ZÚõ k6ò+ XQÙÀ*ú{k!šYÓ&z3Hã±3ÎÎŽ\¾Ø1¢¦~dûâGØBlÊ<>?^ó+öúl`PO(¶u‹Ë:ù”¸Eíáëy~4.ÂœA2sYŽÊÎy¤²3“.,m3¡¥büq™=ÚËú=<Üx"™SlGþœïæ%&IV2´b||ÝrÇ(#Ko¨ÚßWpuÑXþ4-øULc¸W¥T98:ð™oVñÕWø+´VÑ}µ°oÉ ¡ABAˆ}Õjclõ—oPªð/µfò›-UÙšw@W 9ï, ‹ca‘º/\„It{ÞA]ú¬œG’&žÄ>µ&´ÑÎ/ņ¹p}k0wÉ iúž\Ë+L¥C í7‹ÞŽŠ§ B+†ˆ×ãUdhpâ;Õf´ÁõÝ+'[+ׂ»Û¢fn)ÔŽÍ=L,+Åe›àöÙÍþÅøû¹=ÚÀúÕä@GÎdX0ÍZ…½ù;¡YbQ]…PL÷MÇN³ aÐ(¼¼6|u}Im)Æi(>4—žHçx"­—¢B9ò°âc3·VÛû†ù+œc…‡u™µ\2-æ8îëû7©ð‡ê˜’sm<šþ¦¹‹¤Ó„ù÷Û.ŶF•,¹ô£ïÁ¦S§˜6Œ ŠsyÚðG†4µMlÊ¥ÙÅ(†¦U«" iÚ;Jó·ó5z@·]¼)aبž¡]ÚRL²æÇ´ NÎK¦ÑÜËÆŒ^l*|A5*Û´œíRI¡ÝÏM² dkë^w%¿ëZŸœiÙ<¾Úp~ÔMu(8[qæSÅ”!)Á›ÊñLUî¿@$ÕcÎSÏ{‚»^”ªOGæ·ÄÖ^lǽS'WbÃäta`ºj¨pÿ`x”7]œÙhºJE-M”ÔŒŠ[Z Í‹ˆà`ø ú:´ùÝÐFÿ¹Øšjé'Õxä4Äb]ÛΨrõ˜€I¥X“dámM:ì‹–ëA—g+¦‘B¶ÖV$á­&EIu®™²WZ<ŽÔ”D’…±í3Fa >SOÙk_¢CF´1¤'ú²œ’Ûÿb#Ú|©},ìókúš0’¨ÆŸHEP@•N5µîŠnÔ¤h’²ÑõÕ¤Mǵ 9þ‚Q“âÚGÔ]û¡ùÆ3Œo>Ë«.b²¸ñÝ_’QÉ„X<¡ý¶À|(f²8¼®ùÆ÷M×M|íIÛ˜A=¿C¨_B<¦ÓC;:ûiJ;³] …¢y_»Jö8—~Fˆ‘ªÉE9Ï=óúæg¥ÄpÝÒ:t˜¦“ΠûŸÖÜ3Ú: +‚¢*£IDd—f°YŠ ˯òÚVê…µ»½²¤ ¡ÀÍ?µÊÙÅ…N¦^ZÔ, ‰¾$nÜ&ñ¢Õ›þÒÓ58£oµ47²“KضΑÅþ‘Q<&É)ýmwµøreíàËš•xþ§®ù—þ<²[«1½ö´®ôÜSìc¡3tܼ/dìŽ?½¦{(…¬í#ã.±A©R‘€Â Ã\´&תOŽ—_üÈßvUÇcX§^XÃ=ÂdTVú5Ì/~m€&õD›ÈchsxG´QŽÿX{á“‚Ž[äœ}•òâÕÚ%MU؉qQ«ŸgŸvxSà5m &[ììkçâcçê#ut‚hÖ>5Ä8MJ‰c²è4²5Î6,&Mà’‘}ê[ó,*Û°E>%çÔ\úÂÈ¿¨¹òLiÔ¤ä ::`÷š™¼ûyª_¿Íí—ÐF­ûRJgú´Lkv65ã3"Ê^ÇdETñìíŽR±$¼Ñm´sÏÜ™6üಘb"20&ŠE·¯0¹)µÞ|Tsn!­(‡Ã° îzÖuw9T²—&,l&$Ÿ$%Ýdw.üàLÝëÙõÄì¡€7¡03†Â”çõ¿Vã*RÛÑ&š•¬Èªyàëê3³IÙ‰–$êè"*W¨§^§äæÙ9ºØÊä"™œM·rkyfv¦hêûªúÌt|z ‡-‹?µl’m¸™§¿7Æ^›{ìBÛçݳðÊŒ6x´Éo¢¤Ž.h™"©=Ú¿1G—#_HÙV±g”„(>òƒ-Û3ï*&D?ˆˆ‰•8àù%2”|z ž\ ö‘È3ú±.¸³A¶±4l´ù5)wºµ¥&ÕÝ1m7iR„QBiÞc¨ï8s;óÒØoCó­™Ü¬IᲨ9èP‰yrV­ÿ\FúÀÿøR”¯‡(´f=óÔ'Ò'1´¡’¬iD jûd3Ú\»Æ¥Òœã«S+Ψ‰nVmE7¨ä`\EO\EwBÝé’‹?ªgMap+1¼`Œñè ô­WZìvô‹vY¼ºçÞz”µ3††Ó“ù=Ãx¨ôÜ“wФåÕA&“xð¡bèQÁþM… çú3hŒŒóÉ$ylUùÙÓ«#ë.o@›ÙÇÎ4’m`vpš1OPZUpZ}í(¦ã˜Ã±¢bXI}&ƒî×0‡$¸îcÇjL* ²­docå{à©1¢Ž)JOui2UÞ6Å8ž³_Ù“? <……?Òl,?-+œ-JhA£â¨T®úâ—u½Ÿ¹rÿB fn}Ÿ&´nñ þ<‡l,> n%6ÏIiç~ð`í‘w<ì¹óÊB¶yíåÈæ¹ç圫¾ôeÕ‰!"Š‘rü{ÎG¾­OM@±ëí(ŒiWé~t3>%¹‡çÑü•‡®r™6Ég [™4÷ô# E‡t%'ôþ⽲¾ÒS_n˜^Ô#¥m…,ºg­ÎÒ†oÈK e8%v´ù•Vâ´@*7á–ÙJœ_Í´mpYMÏ+ðÌ:dž.Tëæ QD;¡·µùHVxß/ÂØøob½må¹WUzCnRÓ5¨ˆÛroß`ï¦%ö#9q~,Ïl³»œúV?{7=ù.ÛÐýQ¼²*Âv«Ä›˜5©C÷E´]Q'×Öý@ukæ9)K´±´ÛlâvD;r[heåÕ‰G‰™úVbX¿šìÊâð8\ æ0bÞj·1Y‰³‹S ®¤ri8v–ËÝX—G¶¡Ê”î+;ú‡–¶>»mÔóËáR+qÉT׬9ôúf˜š~}ä;3 Tª•KX>Š•zÒTJ“•¸´­b»6L¯?’V}jrZ_k»õCû„>­$ÓÝjFŒÄ4“wDûlb.!Úéoü}‚Ï/š$¿¼y´èH­öCŸªÉ/íhÚhô}¼‚S®¬ªLòdfv*Û>¤eœÐ¤8ÉǾ!NiõŸI­ÈÁ‡Ÿt/XhR·ÇyVV WMA±z‡x4mtoÜ] —¬qBLUM½ q±“%ö(n r¬I©¦'Î^á0lRÎ#å%l‹.cC,ˆÃeÈ+±•Û“ëŸÎš &-÷êš…ÓëR€—³(°Bùk¶ hƒ©N'±è‚ôs‹è‡^}í¶„FòÓ~…ººõuZÓél•ˆ¡¦:Þ†*K>ýû”/ ™©~$z@ 1‡U™I£±½ ϵé1‹Ÿfüql| m;í4îâwñ}/+îÌR7n‚Hó¤Úet Pv¾›¾—pn•HOv¡:äuή[‰Õ³†¤8gH–Þ ³°ë½ä"qh«z ´®û›«§OBÏ7ć¬âà­²ÞŸÑÁûîhCL ×2Y²¢¾eؤIa3à¸Ó’5³¿4'5·q.in‡9)|¼›˜=׿HJOfÙP‚à‡„•i§9)´Büøž%Š9ìÙµú¼ü¼ÃÛ¿°Dl«Ž,:õè&–§ç¯HFV¤}â€ê.’Îfˆâ«ð™÷îéïÝ!º¬¾}i½t b0£4빋ôLãmGf‡^†ç‘¢Š(ÇÈßqBEÝÃÉD%Å û}¶ÑÇ`Üš”‘@Dc5‡DúPÙ9“øséx8Ð8žÕü3gÚÎ-O°Ä¹µØO6ËÊ©ú úàAn®KqË4–_;ö‰‹”" <¬ 4)T• éVÿ‹E_×YCeÙUÜx£³@›Ñ{"òG¡‡W±`õ賸Š!†uÔ%ÞPRGåûWŒ`gÇ¥>koHÛƒÎA½€²7ú$Ü~ê[?g!Ä 'X±lᮑ8‡Õ?ô,Öãåò·Êú±þyèÀ¢ |+êÆð7an-»$ƒi½/òÀ3%XKü«]ó–“S’8t*[ ¤1°Õ}ÄÂæs½ «?%_Dq•“R¹Lk&›Ï¢Yq$1ªûjbBgÖ_š/‘ˆ¨V»hkŠ ÕÖ-6ãü+Bå‡g‘âºb›"v ‘Êlùö~é'¾'vô(¨.@‰{ˆTbËw È:ý _Ý—¿—ÔBlDuësŸì”qýVȵjø_ýuÝÉ^JçÚÛ»y±t»àŽbòkþg›ÿ!,ü Õ˜ªºÚè6¼ÒÐ&!1‚-hXŸR?r±¥óC;¸„–ž›J£‘t*“N³`r@õmõÔ¢ŸƒÄ6¢Eõ«‚5ÔÐ Ñúê>ë½ ‡ÍáBL*ÉÊFàèÑ>kŽ¿÷–Å6ªë.NŽ ŽÔÞ݇àJüêq mFb8„Jõ:¼ÝÏáÑègZê(àÐyŽqEƒk*Ìù¡§¯'ƒlÃá (d²Ð%±ø>_£7–fóXTH £Qh¶~%MD`ŠÑÇ>¾ K$“1ضþ¥}Ä\Uë•Q¹£˜ÁD¥*ú$îH¨Zíý3Îî.4™Ãç‘É4[÷¬ŠqÌxRPÍ¡ï“z†IììýÚ¿JLñfPš‡WFä.r*‰ŒD&Óm= ª‰]É®\¡P˜1)i‰‡ÜÃÅâxe]Tàá¬}¡=.Í ¸&µƒ>2“æè*;F÷|íá&fA1g–´ KqQÞL’OÀ£R¹ŽIg³ØÆOaQ,KîÂË~éìÀ‡¸NñVÍý¨¾ƒDIþ—cçwF»ÐÜS¹Õÿ—|I,ÎQÝ÷ôpa’÷ÒiŠõ^ž_DçÇÚÙßâ <àÉ5ÅøRÇØ›ÎñeãFÒxHüα7Ørã‚pcžŽ±¥Î‰UKÏl‹·‰åNìԛα%bƒõˆ7“ôBüì’bb ^ßÿÎ`.мñR·ŒšBè гh• xMÖŒ+çu+Æ{aµ5ïõ†åé$Ê×­ gwZߎWuÙâ,^&v#ãöjh¼V›Y… 6(ÐÇ·ˆ×÷N ¶±ú,™ç¯vZ”in®wؾ“xöÕÍÏ>‰7¾±ãŒ½Ù¹±a·6_k‘nì>¢÷±tƒEðó½VÌXŸN˜Úßülê—õrðxìæBL]Ó©[Û˜Ù"ÿ*Þw†M/$ÞòÆ 7Ô Mt™©ôŽK›^õg':qb©côb#Vàå¯o)Õ9¶ˆm#eÙzæVÂü·9‡¯LÀï(¶ßEZÿú嶻ȿHÌÀmÿv´YûƆ»üßÿï¥ÿóÿùñòÿ¿DQ¾­ РÍeÎhCþÛû'ð`´6@€6ÿ•y$µ …‚½þqjÔÉ#³†ÿö æ«Ak´hó.‘ú¶ Iý–hÕ;çÜ)FŠr§üaÒ·æßæ“7úu6l‹6ÇN¼õa·ÜtÝ~¸³!q›–9§¶@Ã;7µaS8¿7ˆ(`€6ï?ÔL4úiŕξán‘å——Þ T9r?0<Ö10·isgn9Ýç+÷‰ôISÔ ¯©è˜EZÏ]ˆˆ“ûÆ„”_Rw0Á67i9Óï+÷ ­¼ª4íl‚¦7êõ ‹‘ûÆ…U¬ÇêÁ}Ÿ[Oø‡Ç9ùdžÕÝVÌ‹RëWrk[ÝüÂ]Br3Oþ`\5¥{žRTéì옞¨ùt,«Ým°:L<õ ŠñªؼÜoèÔ¨€Š;ª™—¡þN¾fvö‹ðNQ+¶k–hƒ(®ÞvôFóGbìåìIüvtË¿…h&?ñrr ¨n±DÔ)D;õ™·g kPcÝmþEÑ<ð:À•Ï–dž©‚ã¢$ZÆ™§ª©íö¨f×’ÜÈ,û¸¸†K­ãHYs9Ù†å_YÐèáãB¢yá[¹U´ÕQm¨®qµÑõr{ˆ¬îÀ—Ì•7UPHt·øúè‚ZG;–0¬KŸDJë‹($¦{BCT~ƒ”)Š<ÜiÚ+ªn¿†Jâz$×GåVJ9Ö²„˜gô¬!)Æ! ÎW†§¦A6{ÕcîÌSßû82D> MçKël™ûÚInf´!‚´”Ô屘,ÛôcÚíÐÆײO‡gSKš"òZœßf'ãHC5ï‚6Êë÷BÓkC3ëB³kœDä–]§·V #ÚÉY‘ b1³Ï½´oê¨T›—Т£ Ím¶Yb\'³}ºiíÎ"ÑÂfŒÈ%™ö^ØF¤Çƒþ-†J˜òòAí ¢šyã)úP^ñÀ¸ÅÏÄ+g;ŠKÖ<½äi·Ï.eL©'¶Øx eï VýOýì&Ýç˜1iÜŒ~èS1{_˜ö¹rò¥³ØÊ9wšHï¸qOYEíA¬×rcîõÕ>1z„]>Tx¾•|NwP(òò‘5‰ ®*Œd›Õ1‡´Áy6i[F=ÒÜ×ð?wYÊ6ª¾óä–àϤÑfS0Im6µ•âú‡$/Ý^ÜŒ6¦ ª™ÕD6'æ°åVk(ÚH’ o¶sÅ-ÑíÂë^{9ˆEòH€6mÞ;?©éåüZ8¦T[fÁ¥êÒË?aaýàV±Ë»ˆ¥"Ç>¸š5Ôw6Ú 8\‰‹X"„¸Ž!CÓÑ‘äÅã'ÑÎàË´ÐÁÞ{žee[8Š]’œ›Îc’R;‹ë‘¸¿sIŠö0Y™»< §ql¥cè§vÙ `ÍÕä’7¯Ò}&!ï ;g²BL.ûzÚÉcÃã‹ÉE^0¥ë½\%.Ég•£wEäÝ1—Ìé¯ÜEî™±a~¼ù6MbþXº–›ydcÎÂã¼=Œ´H›2ÓšÕfŠ‰Ñ¹?½þ?>$ÐG•e_'ºGÍBA˜€@4±í££˜%p´sv“ø7¸xq7  °SÏ|ìX¾õÓÄBkõÐÇ>¾Þ,®TæìÊ¢ñÝr®œ?8¢ÍpY«/ý?X‰CDÀŠ·  Ÿ8ïX'Jj™CLûÒÎó¨â°Ò€6mÞ7´QÏ-Æø8z…È7rú‘¯UãOÝÜ<ýÊo=åÍå,†¬jQçâìP3Òƒ§—Ô²XŽ˜—ñô /×­¤Ïÿ¡s莈úQÜe¤ýh-ÍÆ!Õru¢³?ê¾k“2å•#ûɵ†ËŸWOH äK+'ÕÔcGæ>š—¦Ê(Ú8H‚땺oì™øw¿6¥¿ñr‘É"Úàñ‡2Æ_‚ö/Óu¯ÝÅv±°jÊP]’ÄtŽ.ëTJE:ÅFì_^>ð3<µà% i0Kê™'NŒ?ûYÕNå.`¹•ß®ïÿ®áòo WA–e›¤²1‰åÚ ßG ÂøFÙf‰‰’rŠP¹H{ié©„ÈûÖÑ/¿ZÕÉäz£mEˆ‚±Ñ^\yj›óiR MÙ2>̈:‡¢Í­B¸rÿµÂó?˜}ÛwD›=üÂáW΂=Aûñ­fªÆHVÈ¥’¶Z€6mÞ¿(èosÌQL¬©±]àŸ7]Z­9Ä‚Ø…½+ð¦t¥†Éæ— ¬ª§~páq¼*n¬£ÍðçbÆ®˜3ˉ^Ò -!'L­µ=o_UÏþŒiRe7׺W2•bÃ`ÚGtÞ'FVx¸+×>ªe’ûÛ9Lš8°Â!ANTëµÍl&]VâU€¯ß%µ}K¯UÕ¡é²è6›…Î`ÈÒ{ÛFnú>Â[LwÌëœY ñq“…µ¯ë,³/ÜØöT¿B¥µ–s}b:…A§3hdQ`uoL36çûÙ,fáUl“t3Ú¨g¿wf|à®z¡6Æ߸ÛY›ÑÛ˜{a-Ø~¯kÛ#£ëÍô#9ãß«˜óæ,Æ‘AÞ1dï_¥Iah3‚$Ç‹}›“ˆfö™ÄH<õ´¸¡  @›÷mÔó¸OñFÆFÄäRFA!—Å’yE¹‡&»zûh£š\LËÍã° cº—7‹Ã/é_UëŸ{ò7É6wQÙ&áòÏÞ|¶cQ¯vzƒ¹x+Ú`Š z÷¤öx¿˜mãU6‰i77îøy‘m(l.ß>¢.ÈE1ÅçÚœo€ɆŠ¦;F7º»Ê";±Bô>~nDº<¶ÙßÙÑ>^‹¢MIv,…ÐdÚ »kü6o9¾w-Òß“(Ð$Û` á{x¥óD7D&ùR5‡¨&^df7ýÏP´9~a>ÈÝÖ§õ+̃ûR!¤ŸÞÑêïÙîÛvμ…´ÁÇ‹e©I)N¶S™þ&o&õÄŒˆbÃæ‹ùB#³h¤ˆÝôm×Û¼mà3=4–kÝèjÛ‘nϽa)¬hÐæ}Ô¤¢ýÝd.ÞvØ+íð·m—9Lrìþ§|¯„–£çp´Yk9ÛÇfRüH¤78†É6ý«ª™•¾0õ¸Öʯ£ÿ d%(3ŠÙÒ¼‹DºYšÚ€6“+­ƒ?vèÌ«GÖ’¢Cy^Y„Ÿ*B1P¿ìã.vI½B¢š5¥O-z: ݳL%›Ó_º9ð½ ±¨&-ùAH  Ê€G¿üÚº+ðÔJnRÛ;WLj pSü=´”kHb°§ ¤Âè ŠMQÝÓüû¿¡hs0ßÙ†*rö‹pò wöòØ,±«sPVËð}‰õîà“«øþ˜EÈÛfBô)VSB=Ea ëÄ&±0†‘W°ˆ^èˆñäÒÉ߀6Ú…¥`[+Ÿî§©©!¶a”ÓmÚ¼Ÿ;¼¬5^ü¤úÂg›¸yx­þÄ1EPÀ¢‰JGŒéÙ…ÑÓ¤`=Ò'“XqÍØ®‹T$(Ïu¦8¶Á÷¢1YÞ Æý 5ó‹žî~Ê»çÍh£žúž±×GõÚŽI„ºÙú”(¦ÜºÆåc㨿½ ¤î‰9µŠŽå욆8õ÷Dzçà´€º/þìšrr5«ª.Aû”Hï¸6ΣZ%Ç更÷9{™)}«„è¥é;Dß#ÈFÇ›HT·j~ai¬‹& RÚg‘Ôp/È«@e ¡¹ÑùoÿŽ¢Í‘C·Ì­Tsù‹?º£îòåô¢·àiѪiÚ±v¯Ë6ã/œØžù#ë-?³âm·Ç.çŽùuç>=®%ÐRËoG´„ŠöB–;ì&†’z1‹@€6¬ðö¾).ÃƯ¬¯âÔlzYž«o,ƒÁŠn«>;ʦ“*¯UœšI/Év÷f0Øqíc£ˆJÿÂÛžÆlÌé¾Y]Í°a&x„î¡ [ú>§Ì…‡&Ò 3©4YIß+¥l£G’Rh4ilKo~÷`Rq“D ‡¿F‡jf^å”h.zÈlDÑ'Tøi™4¶[ª M¿à.±ÇEÓÑᙜLçz¦©o¨Ï»Š­%‰—ðtžEòòB(,´¨|õ'>U©Áöš[ò1]‹²´·³[4 %¨I­:’K¥x—œ)>6Wrðf +Ôô'êƵĈ¥Ý}„¬¢Ý!E5Vrh0ÔÏ…+dØ'áÖoD1ü­”gÔöă‘â†JÛ>Xvb6·U‘I9‘GP´¹]Ò‘œÐü±zæd´¶s<6îZ©Ä§±Ú´ùC¡ &`Ôw©Å"‡' ª×«ç–ÿöÞ ª,[F»'¾{ß»ÿ»wÞÌ{çN÷„n[ÉP9EÎY " ("‚1‚äLQ$1çŠ(b (9Š%(¢äXT8çü'T"v²Çéîýõ§ØuΩ}vøöZkï½Ö:GÙpóM$6;Óˆ‹æ›­IhÎnzÛÑ(F[nâ"MÍû€@_‡Íµñ¿2‰;æÂc#–6¹º8°ÙlC§Ð=· ÜB"ð6çؼ‡kRØÞàý©)¦Æ\KÏØ9x{á á+ px?W_ŸÍµòDùzùO(n‘é)ó—¹N©Ì¸ÏÏ9礤º¤,S)V/QWDŽ"r7î{\è&­LÜý)ö8'Øœÿ1ŸŸ!Û|è4k/1H€mÛüœÙæDá«ŒäJÔ¶lؤ²½Gÿ1Þ´nï-µ Ø°ÍÏ9¥>BWo{Mâö  ôZ× mePÚCPÛ€m~ŽlCØ'óÚ¾ÂÜŠ¯ã4a§d¡®abq‡W?'v³,øbžˆj#=Â@8©Päg7)6q ªÒæñ%…–*·i†!šxTn+ÂW}P*jëÌ“×øl`ë‚ïž«\ôÌF,å/ƒ´üK³ä.âü5:Ž"“’Œ8ÚT’&…a¾&¶–GlV¹Ûîµn5^TUº¡‹oz;¯‘X”‡sš È”4=š¦ëy} æ4¼·ÐR³Úw{–ûšœÆ·fê+´¾Ò.žQªœÊVŽúrÍe&¾ÆçJ€‡rŽ›èéÐõ×&+ÅÑ‹?}ÙΚ‹Å&ÖV7^µmWшt? gSu¨]:wå†ìGDÔK~Ípðöíl²ZÛ$ª¡ëî¢ ‚±«ÞlÙÂ$£×ë0ŒÝ7é g…íÚDÒR£¤ DR_æyJ"¥š:Áƈ­lª¬Á2[|´#´F$áôE[+.SÏÃf:‡Ÿ}Gä'_ºáhoFÖÒ¤h©r‚·zkB¢òO™êëÒXnI5 z2I+m÷ ѧkj«­ÐYñwº¾­ÛŽãX|R¢õë›9_þ•¤Å=P>#Ä|Néêò¿“uV'5Ùæ§%Û4 ‰91 m¦Ëž4¦6w—Œmø5özlØôVìXÓö=[LVä ,d<¯8Ÿ¢»:Ÿìˆ“†D¸ÛŒ«ÇYZZžéØÂnÕS+&Yoã ôÞÄÜpŠ¶áæKìÊʇ–t{c:±òj']­ lõØö‘%9s»Ví­HÏ:½‡ ‚Ô#Ѻºf¡EBt–L‰JAèK>RÀeÐÈÖ‰iø‰Üú6Cª‹á—õŒ¯¨ahÛ:CŸÉòló#=•™Ó6[ºF66Àû"w_¤ß¼ÁÔ2³MÆNÿ-;®LÓtöj&µéxÚo3ÎÔe§´Ìü•F$65Á)¼ß"u×›êMb„¥´!1Ù§ƒrK+tNŒs%éïOkEx5CÁ©w3®†»YlƒÍž’Í^VVÛ¯n´S³NÃÙ¦V°ÊÁØnËU©U'‰¿Ñ—ö@’Y5à²åô¨T¢¨x¦Ïfø¦µó±!/ =t*¹ö[íª`ìhöÐ÷Uk³± 3‹± }ݪ±oÝ/ wåççe`q”¥esßW“ûpžŠÅÏt@Ûv¥ÇW"á»Â”ØN9qÞ901Uvn”w怎îÊØz8åfð•yt'¾ß#+_o®wqV+²m÷6Øçü&©häãcdèZÕ:éÌùÒ*á-± -˜§ú;·Qaoã{=÷K¼Ùžáœ(Œgú¤»kÇãnôgÖÁ©G³ÉL‹¨ÛBé–¡«Ù:ºûËÅin® 8P%'È¿œ®«ƒy$Ën#v¦ÄU Û÷ïšÁ6õHòÕûî>;¯¡2í´«5Ã.$¹VªðJ\ÚͶ­üûÉÕR¶1Ð2Þ¼Û•é™'Ý8T‡ðŒXQ¬ý¶ù‘²MNËÔZK&GŸ;3é‡$.6”\WbÜ<Ò"Ñ~’^XB£3".aÞ·Òò6i̬îäqŠŽŽ]PÂÆÃù.«¬ŒÍ]ØFkälƒêÂ;öm%ë˜o½0@,Îå‘tHÁÉ£s],LÍìõ¬Së‘Ý©ùË« ´–’®Õ[ëX\ʬG¢’¨t½uüç¹m˜št"‹ªËÝqKÛ<µys ‘Ó– Ä+!qù66+]wœ‘ÇÇ,r7l­Ø–'Rg¾ò\¶Qœö½Õh@S__0.3¾5ÕUÕV[¦­¶œJÖrÛw?KÎ6åPtÌn†™oJ5œSÙ¤Oãì*žÚ—ØæGË6PRIglq׬”R%Zmˆnv§ÝÑPÍ`UB’ì #o¦0Œ9|¸]ÁÑVßX‚+‘é‰4†ÑºÌ'¹2á¿Q¦‘á3x|önŠ–㡺d›$åÊ9&Ézûõ¡¸’× wÞ­³P3®O,Î(eÌT[›5LÌ­üÆikCã-'ßà™å«Ì49Žâ”&ÓÀ6ÏrëÞÛ0×&·¦•T²©Vû«ÛÔ‰â¯Ï®Ø˜ë½‹È6¸•xኃ䰭8«qFlšäóWWzøX¹å÷Fì 㘆§JÝ«Nnôw¤pWïº gç°pkmâé‹ÎîÞV«‚‚½ àÚíK¯“ª®ò= [B6²¬½SkøÌtT“:xK”…;gÎm°§¨;ç$f&961÷1 zo~ESƒr]@ÐxJÑ-¦–ÕƳ™Š\_Ã6¨>[Þm¬¯ëõ(±“!ÿr¤Mbg¦?‹mòj¹$ζ“ÑÉ1L“ÀäZd/`›¯Ý¦mÒƒÎ)$*E)‘uý³;ø ° ¶s¦¾ÛV_Õ,´4£nÆ1ÉìV$£Z$ïEéew9ZÚÁ7±Ï‘‡vÒÙf{JF³¼4¹1t—î#bŒ )åúM¶®îÖ[ °M3rp·9IG—F%Ó(X¢3˜ E×x;¯~ÌÂŒºêàc¼0(³ V[p-Â΢7æ6½w6Òàn¸œ^‡ÌÛîû°ÍóìF$ö°'ÝóÈÁ7½àrT¢S°Mí ªÚŒZ¥HT‡èšØ­‰ç.sèÚþ¹/å&2©}»QœþnB|<™Ü€*ìk“0Ð݈f·'±F!þËЊë•4³\©Ëš g›Íl›õ(Ûð®RhÜ=ÅãD~nË[k]MãÃ;##X¦žIÕÒBómtUòÑ I»^Îe¨¯NiçÕϳ¯fÙ&«nÊÝÆ‚íº?s{¿fÄÖLoÛ Uº-ØÞâ¿ÞÀ:º}À6?î5©‡ó¯I~;Ñϼ۷™ZܽõÒyüº±µN‹Í—<“9#ò%›ÝP…?4¶Ïlš ôµ"ïNEµª[7õèÆ!…PþC|ÿž²›áðudãà¨J,3¿Ú²ÙY—¾!×ßÑœ#àU†‡· Úñ­kõ36§t ›l–Ûð=Bûªdk +ÃrsBöUúµÛz uéÏùuÓëטùäå=™QTž|ŸX°f•‰W±« WCÄ1—ÆÞËÙÆ1¶öè#¥ýŠ- ¶Á é5OL8æF[¯Ž¢bƒœmY“’±'‚c”Ñ‚×F’ó Ý’CõÊé+x"«%´!pÇ;nä:&¤5c™qGÒé:Fw±ZÚŸºŸf°>®VñvØ^¾F$lçz#×ô ¼ºbøñT]ó(5 Û2>7Ýt•‡ï©ËºÓfe¤c±ñ¦i6MzYêžâá>£S’iæî‰âyÉ$ºñöâéü6lÃ^ê™<ª¶^ØÍéÜÚWö†d÷”çO•Té­wÜÃ6öK—½f¢¿?zèâã”û½d^6 ©Ze¾+ÉÇwññ*zC÷íc5|Òž+³ ZÉ Ynúçƒ8-¶ùiÚmj†] L­ Œ¸t…clÅ5µòHnL»RÊbPõ -¹¦òdµ–÷íTüÚ7ŽÖút*ÙÈÚ‘E'qŒmw\Ín†6;S)t®¡™•ü=®ç¾û(Kô;ÚÓ©®…‹AaXm<×]êå|##3CSsÎÐãšZêz¨š)x´!¬¾²Âí616{رédš©µ%*û¬Á‚Ù¥Ýj2`’ØÊEµt‹)ÇŠZvÕÄÀý“Éb2Xl¬HNèÎnê³Ôý³UL/±&eC£ÑXl=ùº’žá¦ÛùmVª_Þ³l¼$Þ>6l3ä¸sÔÒ›t5«Åí6ÙÌ ŒÑJcë± † úvvÁ×%‘Û|É4¶rQõ¹Ž¡·0-&½¤–kh@×33³0c°ô=ck²±˜rå.g°ÑŠ’W¬¹©ëÞÔZ$­ð¶¾¾ÃÀÒÔÌ„Áæz§·eã,“—¯§Ï¡±ŒM,Ì©T†ÞJÂJŒ«Æw[ÌÙ –‘™—Ng:í©ÄX¨E²ÉÇ’A!›­ÚèඊÉdÚϬCDí¤Ð˜\¥¢Ù s«ê͹ثq°W£˜XéÚnº&B+3á\]W-äÂ4!Å%]¸Æ52bPth }6C—J¥sŒíýó{±µKŒmZõUY;q¶ÉºßgfÈ1ôç÷¦Ä1˜~€m~rÑëıE/¢®ÀŽÊ6ÑWž¥Ü‡äKüYÕñ×;ñË^Äbû£ %‡H‚×^¤ÖG'àÄkñ·¥Z^Ú½÷Ñ…=™àœ8• H ¶ $Û¶ $À6€m@ $À6 `›ŸÛàG¼[‘˜üSk·¤~°ÀŽìä#É¿¼~G¼WxܺÈ#;Îtñçuµ`J/¼è±ãRFƒhÓžÔ€”»Ù J·7 I.®Ýœtø>ÞXí3üB|Ï”q·e]ØáÍÙÏ•÷§^®ôÚÉ#V´y•|Ãâ¼·Å{¡)<~]d^ÄéžìVé™ëƒÙ™^Ñ-YMjΪê[·#É'á>îXl I—®z‡Å*ÇZ'*-M8^0iJðÚš¼¿á_÷ˆ8™»¶ùQÉ6¼c¡á~T¶!MÇhî©Lb#zVU—#Wŵ°^á¹q—µ£‹¢ëp°ŽÿÍÇ`’š·Y‹šÞŠ¤dï'é˜FÜ’ðåû“k:l¨f;rš‘Ìû}zT—ø–wìúe6•J7]‹_–mˆMÌ΢ë[ÄâG3o—ptIfž¡Î>[œ½ƒ,¬ld »í7‰=½;÷{ûÞÌúå‘Ò¦, Lì±cL¶⸿v.ó#ÙÕÏmhjt²N8¶Ý>Ÿäà‚ K¡Îž.]ÓíHæɽZ º°Í‰m‘È cŸ¼¸Â«3N.Ôa;ëòZ¥»\vÇîc°í݃ ßè¿Ñy©dUÝm7¿Î1 ’ëK)Û´`^ íÙ&ÁIµRñfó–u,#„ûØY!~yƒä•òLáßr–³ÊY.C¥›¢g˜¸€¸%õú%Ó×Õ…É ¸Ío–Š7³Ø†©NÙr{/3ƒ`›žBaé€m>6ÛðÄ”Fdßš•bnaβÎ?ÍhA‡äŒsRüFq€¥Ž–Ý!l€7 ˜ׄZÜSÌQI6±_½zdgÎì‡oË­KÇý?ì8´‡MÒ`sÍMW†ìLÜ ÍÁØ;x«ÞFöHmÇŽ”éé}cç…“_Ð7`3è,}#‹5§'P]#éB±ƒæÄ’Å0Yµ}ϵ "p[܉³V¦,:ƒI£Ð·œHnB"Ö3´-²Údûfo?a“þæÅëK»~‰¦³æÀ•2…ºõÂ0!BÌÃ6eŠS“ñ‡tp¶A_aëf–ŽõÌQO dÏ}6UÏÈsœ‡²%v}ítè¾\=´Œ&t*×eç¥LÂߎ'tÒ ¯]y4]ºgaî:8ý--îŽÛâ]»CY¦¾)Õ2É?¼r2“É]èÆc=švø­ÙŽ7Ξ¤1–ãêáɽÚlßɇ¸ ‰iævî-`›~*³urc`¨7#qƒò_-t*3«ŠÊ- Ém#&ßÔ W™LÛvSÄ™WiU‚Œ OfÏÉ(o35ЛùdC7 U².e5دJ0ʪxiÄa‘ ÃÒ[¤2UBvYËn_å¸3—ez!Wæ›.õ\E×+;3…äTÖsµ´â£s7:¡oôYÉ°Í@óïÝå¨S¼òߣÂLÖƒ7¦F4ç]w*õ´µ7K·˜üuZ T¶¡k­Š{ˆ„ùSyÍóÈ6,uJp ”~_€¦”[-Œõ¶^&N‰†‡›Ñœ/e=D¢³vÓÉF;J1wšyÍ}NúªúAø-H4?šAåù¹µO­é+,w¡¥åW¾4Ðg1-v$µÈ£…›ױ‚3jáì[7è$ýˆâQ¾ŒL²ÊŸÒ™¿M¿Þ8›m0O°ÚDÝ™ßKœEÙ†¤££ç~$‹Â ¯1Ò5ÙÑ F:`›*“/÷!¬”ø ò‰uÎp%Ç„¦|­Ùwc]ë 2…Áµtqð=|ø¾4FCö|Ϫ‡"ÝèŽáY„›ýFdÿVmý­é-²ç× ÝÍØF64²6_#ý¡3qݵñ8'ìß¿fê‘Ñ„i ¨Êp´¾†­Æ‰¸ïßB³ð¼ráC8¾ðIÔõ÷èW:p­/Õt-£æ6KÙ&}`M¯¥–ãþ‡sÙFB¦Jºkéª/gYî¹!ÄÞNÆ69Oàuæ܈ZÌ£2^!‘‰»tׄfÄÛLÍäÀó£OðB>DöÆïdp6%7lÃtªÈ–À\1Û™‘v7c§“Z‘M«(œ ·1_=u˜#©-A–Ü¥<ìäõ\¶ãSÐŒ¶•¸Q¼wekúµ™éjÔͱ…؆‡¤þÿ[„¾ž6¶;³[d±ÑgÞï52@GJ+¯z0"½hÖ÷¤W¦5 »6¹SmB1çÿ¸ë§­«Ít ¾žmNÇRH^Ä xlB$Iß9W0ý¨Y_2ˆ`tt8ÉÀ-™0Ò6À»$®‰*äf–P+öº[k<ôâ{e+à ¶AKžZ\Á¤R|£éúæóX‰ ×4 7ãœõU|Ûd?A6:k3}KQ…Žpù¾ó܆9k±îù˜ÇøŠÁTÜ«ª2Û`jÔõ{XÜŠÓïóq5¹xè·0oÆÊCüñ®œ’° ¬QÐÚ ‰Î`ÓÉkc®Eœ” E'vëR7$¶(\Z¡l££É ¯*³ü’#TUîÎ*0ÒÛü3{œ$\Ösðø1¦Ž^ÈÅ·1×:îMñ È诘;|, ²'~/“¢ã~ $úæ3úRýw†žóÞ{È"{ðø×O3´H©­ 7ß,¸hhnH憥}Û¤\äÓ4MËÞÅÝΩï°åPL6Ÿ‹-}£{ë7mκ¤:$·ö‘%C×lkQìÞè³eú,êêØ‚(ϳ4*Íóp#2—mp§ð¶À•T…ÅU²kýO¿AßM‡ mpÖ%›„Ü„³åVâV$ñl>S‡p¤#áÖ»¸K%Æ$ §¤7¨âwº€¥«ãÇo/í‹/ns2Ó4¸…-å+سóì8´Éqˆ¹?cG_ö4uNXÂWvê;ËnÓŒìÛl¦kŸ•Ó¦¸7ãD$‰Ì0t‰¾ñ.ñf‡—-é–‘Ý‚,¹$À6—mø5–z i\E]mô•¤ëUž×, ´cc³‰-.uPÂ¥Û+]éd-*Y‡Á±rÛu>¡Bô5[Ú˜£§Œ8$ ‰f˜“|j¯†îº”f%¶©¼ËøRÝÿŠ‚mp­aØÕ^Ÿ¤M²ëDÇrƽžuëW3¨º4*Õr]rô=11 Òo?÷pw ‘´il+ÿì'R• •Äjûí8³­çrdûaR‹Ï‘–ÛÇ4+ {#ŽÆêT¦A Á6eWªø»ã‰L5_{h_É81Ò·nÑ#ÙžÃVÀë¡ø“­Í Ð’°ŒWå>Í”†…‚Î\¶6קQ)tŽ…w|%áR†_ÙÁ¢iú¤<ÃM^άÏô75`a¡”vhó›OÛ,÷ËÊáŸÒŠëÚËÂJe¥mA¶:iR< r•ˆ:-{‹Ó?±¤ÜÆ\ŸJ¦{D.+«½ ¶ù§‹ÌKx}lŸ‘ð Ø36Ë«0ÒÝtí²v³Ï·K¿Aú|l¤4"ùJG¤!ÅÛ‘Gˆm{m3ÂËw÷å*ænÙî¾vùî>Â[/»÷„Ë$ŸPÞz7ó(,ç'wb<£ʃ†ãÇ:pÛøŒÝ}í ìî# Ó¤pU”,V-³ÎzృñzÎR®¼ÀÙ _ÐðÌ‹Ò­ùXù¥¿ v÷¶§2ÿ¡ÌY3vtƒŸ%Ë*)­C$À6€m~Ô€¤ž‰¦j|eè_  ° `›lO®\<µ’z ؀ذ H ¶lH ¶ $Û¶ $Û€H€mÛ€`À6 `@ °Í÷b›èâ×é¦g&!H ôãMüFÄÐ%èŸmîV7¯ò ñSJá&kô­Ý@úé%®¨„ŸC2°q7sðس'òŸ‡m`xþüÜœœû÷H?Þ´oßÞ=3éæ£Ë6ó‚ÇãEü´Ø° `À6? ¶ÉÌÌÜ ð“Ã?!Ûdeeñ~àóù ~&HJJzòäÉ?ÕÀ0, '~6˜œœ•ð3Áøø81Æ€VÀ„…YAÿÄ` ýO‚}ðÙc—I,v,†…ˆFÆ÷b Î>BĨ|#D?W•fvîÚöØI ¢ À“jp@˜*%êw&¿Ú¾û¹óön³ ×.ÐkÀ6m B?\îãïzéѱ2¤Û%¢kMäS›!言oG)aœ+"nã&a ªBÁÐ2q¬+&¢ÃeÇK»ÐÛ]Oísz÷4TcÆ Û|;@(¯ ŒtòA%1J%Bñ<±·Ý#¬Óy×K—­½ö O×?ƒZ¥!`I àÛÊ6°=ÖK…l­IAâid,þù¦­¯m·uÚo궮¾)@Døb8±æ{É’25õ[×¢âž÷Âpg{s}Û3hêõƒòš~ñŒ¯h))AÚ»ç{„T^G`Ÿ_¶"׊‘b¥t­/T”×ÏÚêšA‚ÞåÕïD y¼£üAëô×ÔÃ|/õÁçÔ‘åÕm"Ðs?6M¶ïxdùVÔOü)’H`H’кõµªCxåýl°AŒH`X !vÞ|²Äc>o¾+Q ²(/˜™/Iò_iæ³[Ô™«û§tL‰jP\Þ‹¨¨ ¼ù(FV¨ ëJ±ÏGw"ú ùL–þò_ˆÊ¤yl¡²äF¬5tÙ4ýú$ùïÌ¢¡…ËÜýųo¾wo8mhC¼I{¬mRQÛZñ¢š½!{ ‚Îû±ÑP(3ÚˆøO"·u:ììðÜÓì: Áˆ% D,U´~îb‰’¨!ýgŽ/ š`ÿ'nÑÓöQΙ)Œ,ZÅ~$fíÔLIýÔ_ìæ±W‰#}}š•o<@þÏÿB>WAüyó½„DÁ6³e|n‹Š²ó”…(ôÐmg»PŒ$mYW+š!ªÌb›/ç° qMû…Ãú¶qDÎa fÆ­Ž…ä›EÅ@X¹ê”/„”(*À?d u[":\ˆNỄ¡†‰[[ߺ†wÚî¾~îC0Õ Â­;b4ý<[ˆè™½-žö$’ÓÌý|m„%¹Ó›N&QÉ[ïõ=¸<ð®RM]³ð^Í¡ ®zcw· }ÄpÍY •Ê`0ЋC+‡dúþÙxK}:™LæÚ®+}øV:Nóÿ¬aúôQyØ[‹É0u/n€¡±uÆ:4“Π;<Ž*ç×›,³ÙŒ^þ¤ ,¼àõ‡e(,D¿C<“ý¥ˆOš9ÙØ«aÒÎoÿ„«EÔæc›ÑVd© ò’þù¶1YÝ‚&—HdS¯:ÎïßñAúÃ7GãMëüÁ8þÉ\ÙæKÚÚ]Õ µµ´Ø¶þ5Ýãx¶³&™ÆdÐét‡EÇj„A7tòDèµÜ­÷NÄl2â0¨$Æîü;¢EÈZš³>SÕÜ/Uצ+öü§†ÓFeýYÓ¬½êˆ é+»ÃO$µ»þ ¾r{Œpý¿˜{kÁÐÿ(è66:Z’º…jh÷l@„ ×3è ¦sd÷øŠ†£‘dÛW#b”¶ûjcµ5ÝŸMK¤0~ËÈ¡­g`||âUõ}ùøc|ŒwŸÐЦr½3ßO ¦¦Æoìv!;n¡œ÷¶˜¥®w£s`z“'_;–zòÚb‘H‚Ñ‹D$“ö½ÍȯM±r¶AáµùµÒ3ˆŒ "¡šÌe“ß ^92«^v͆dty׃ÿ€è8a¦=ù/¢S>è¯óãŽW÷Ïe mº¥ÛÎѱ‘Þ„•,º/ƇH|*fµÕ¾)Áôðc3þB`ÚRCMæך{¦¦£ïÛ]8!GŸ/ÒçDmGÔi–ÏdlóàÐ2æêa´phê0ÌWÅtŽNIÄu¾d¬Å5)Éݼøüò×`àÙæõäˈWW† Ä"qboD×ʯÕâö`ÌÎ* ÅP#J@–LÚŸ¾y4ï΋‘–"tR.똖êOÓm&Ú´äÊWÈhƒÎL)},ûÝ—4ÈFÕ=Ø´>Þ–¤­é‰÷õ‘õË6_•ÿÄÞµæk·ŸÆ¯?©¦©WÔ3Ip;ÜýŽm‡ÑÛl5ý{¸ÝFY“‚gµ(ú÷ûûK<¨,EI u5ò/Ÿ)f˜‰3ˆÊo~ÉBªÎ\Mê+UÃ[ãÒß¿µá Ö–qü›K‰^\›(ìM„]N,fÊÕVâŽÔ­Fƶ;&eJ qµ^½O}¶9©¦Á:Þ1Nü´¸VÆ6@“ú¨Æˆ¾±7Žgn¾=±µÓ.ä…ÃÕÞl¼9$øNbPI˜¦i¦çšxi–l÷¨”Ç =—gŽ„±uVŸnAÆ 湚^™2R¤I2¬ê›Á6Â&+mMß6;™XùïC9)ª$óÖA™5øI—$—nñ ¶ù8ŽX‘~V°M FAò¶!_*± ñ¡4äÏ›Ïñ3E~ù[ÄÐ16Æ’{BùØ7­6Ün#«dºzë—Œ#‹³Í}óÀ«Œ ÷ùs\ý’ïÂ6ªºfMÒºR° ÀÇdxB8²³Ç5¦;`_§ÃöWü7ûl J„ŸZ3€”mö˜£lsQj‘UÊ£ÒLŒm&l³­ãv² oülÓh®¦y ôÑöVm>îè†ç²ÍãoÉ6·•EB#°­HD8òû%ˆº²'™ªÄ¸¢Yv4“mðò#¿RA G”ØÆùÝ2äÞ}¤ªJ–î#ÃâoÅ6} ¶ ýFl³ñºœm®ìEÙÆoê»± ɼm°Í?—l#DûzÖlí²ÛÝ嶵Ù~„ˆµ'|Ã0h¢žnq)~2M j½yµ¢c`¨é2ƒA»óJ$Õ¤„íÚ´ø{/1MjQ¶ÁWÀ‡Öé- ¹2 —ê'FÆÄD›,È6e(Ûà+àðš‚”íClì[[,ÙÛ!¿SA>×D\ýa7Æ6¹ý23rïlMêe ¢òÿ‘’ïüëÿ ò½ãd`l¶õnQMê²Mêµ6™&ehâ°oJö¨”`ë5{… ØP{Õâq¿€(SÏÉ-_qÖÊÙ¦u.ÛMê#Ž"ŒTDºWïxåþÂ¥iúžòä ÚCÑ«»O°VhÇ•¢ŸÇ]¡PÙç›zñkOÓ=ú"qMEÎvšÙ³A12¼ ÛL<Î$}eÙŒOÖGw{q,=ÞLbˆÇ;\ŒI¡9m„Ýf~¶™¨Ð_A?ój‚hœŽòÂãW+ç]DŸe+±íï‘ã ă·¬˜m%Ža!ÿj¨hyô.m¿&ÍŒ³B>]Žçö qÅÙ¼¢–¡o.Û\IñÓ7Æ>‹{\X̽gªelcÊ`–<Å·¯d©f?Y¬Ž–ëiÐs[ÞcåmZi¬cèµÛ PíÅ#—êÁA¿Ä68òµûö×½¯V‰%b@1óÕV)m¥ùΆ …Lf[¤œ{@lLõ5ïp¢3X&ÝÚ3´ì¾5w¨FUUýD•láãÍÅÏ¿$ß{…„¡éÞ kÊ2UݵyOhàLb8›Fa±™t–ITA±•é<òß_°šúelÓ~è÷_Xvbrøx˜ÝWªÚ¦›²ÐËÎùþÍbÓ×7—Ž â‘$eîˆîï1ùåÿ‡ì:iRŽWÚÿòF³oXˆhüNºþ%©x9ß<4±I÷6)OgßÛùûeö »MeÀïÕ¼‡ñÏýÍ…Fº_ihP²ëÇ«Ò6¨«ª²­}†Ä˜&et19b —­£¦snìëæ½æó‡8dª‰¥íjÿ°Æ{Ñ^nýV<»E÷wü^Õ‰XßMûo£¨Ы?Š&%‚Æ÷¿^ÜaÙ:Y ¬Â‹VÕ\ š#Ã3ö[ËŽƒÌ/½Ï»5pæõ³Ôxfq•@éîGíœR.òÖÄá–¹¯üº¼ÀûÒ;d^‹¨xžÓ s‘ºEÏ"¤lþç,<,ÒZ3wýaGžÝ\süèÐgÁ’ä§a©]øÉnÈ6ßÉ~Ž“à9Û,Îwß„mÁ™­¶÷Þ @“} ¶Á¤™1¨ B ãÀ·×3ev¾ïßyâüu9þ7fÝÈNýLðÃÒÖ<Šâ‡–m~bP>¥82+TÀ‡ æü‚$°X¬DA"#X Ž¼|(ÙÂâ*@°D IÄ‚…æ…Pˆ Ò À£l3‚E Éu'™šFÿœ†$xè:€ïH,ŠÕ¦$b¹Àãñ]¦q—Å Š>ÛÀÂá>Éô0$–[†a‘ ÇQÎÂPE˜3ý⳯z\ìeÜR32ðÖÁy׋ˆ™àÃÍTáÕ)•Aqo$™†ðˆ ãæ¶Ã**=A"D`ø0l3yåÊ6cK– íÛÃÓ’iXÜÿ~|é'“¿XòÚØP"kRPÿP¿ŠŠhÉ'CŸ…í½"©1ã¿Y"QQyï !Ànóˆý{¹úŸëœh¼÷×Ï_j’´T•–UµBx ȾÂkÏš¥Ñ~± Éd_Uõ“s%Δ^{$ë¯V§¬ÏZ éŒ™ßí2,®±d¸ë¤–OÝõ¢Kp®ªy¾Õ!1ö §êºÛ+ |¸æA# kð§™ë¯=;ï,X¹ÍàHuAg^ÆN¯~ÈQƒâÜ~Sý€б¿yµIÄÂéòª‰OTÄŸª¼SU›Ø.Rùdjé§ï™,°²ràÇŸ­T2'æüEœJ‰ü\o«-)w¹CYñHx¡{_–¥3Mö#só±AçÞ!È«|×õ™Ð,¶% k|r,öNN+™ÆM~)óÃEŒw©¡©ÿÏ®¾´C¾Ëaªëñ5‹lîž Ñœx˜å™ŸYµV÷N–d&áÖ?ˆ‰1ïùÉZQ2©iYg“aVnNUK ¯"V¥R_Lvjp.Å$¥ÖÂÝYmƒÈûRS³]“óv3Øfv½cÅ…"8´óíD,òG†+æ¯ë¤·ùd¤Y?g^ÍÍSóâŠ%È„ ÿßúéðo1ø/ÿ{jÉÒá_ÿz¢¬TK 1°£jBßñÃAL2I[›´rSÌóa®A@-%¹Î& :“I¥„&ÆÅÀgG­ÿâTÐXœâjk¦G#[xíéÄÇÕU:…Á`1Y†6/ÈÈËêík­é(¨ Ÿ]Y]£bbx_Œdhù—^ˉt°2áPtW…eÂÈ‹ ?*É`2Èô#ØÔÝcÿÅxžèCK–°m7*ðT§‡'–£L‰m Ñm;Ï“ž™3†¤|ÇøØ“üÏÍ‹xuŠñ‚/l½Éû»eãÝÙ ‚¨±(íKûׯRE¥óRòÿ8õ¼Å8¦{›cªí%ùsºÓ}ÒÈi(ƒ žIfåÏ!ÕÉ2 Îù¯äŠá«ŒÍ™ädôÓÉíþÝ’gEéáçÞ`ϹûÕò·;¦gË6Íõ¼Oñv±)šËÕÖìÊÁó9êRL›c` ¯Ç¢Ñé ‹r«é8÷×”›7θÚêÓ]ÏWw˪´•ÑœÏ¬*~1œ¼Â£ËOâ.÷.ÂæWlÑûW?\Y“‚‡ø;“ÿlv&¨`hP¤<ýbc¾ªˆ·ÌêEÛÄŒa‡}.úÊôDlÅœ™ºïÊFWÒë‰?^ìÛ–ÅØ(˜Æ.<ºœõ_6Ϻ¤—­Ð»rû£/Ý+ÕþÚ@ùå›~»oîÈï{Kô%Á]Ι¼ íØ!ÞëP ‡$Ø[`'fðïy˜“{¤gtv<eÃdeÝz‰Å‘ÚWÇ^ã7´XǪ_¢BÇÔ“tmµ•/PrEŸÕ}U‡D£y¤¢¯*‹Zò·jê»vOŠ‘Dª“,5V‘ÿy1’K÷+E?4w¡±Ì/4‹„˜Pwv¯!Ëc!ÁÀ«üœœ§ý`+ì×) Xï‡á‘w£*Ÿ@K>þâ7C**’e¶¡X‚ÒÍÏ=ÎÌåÑåSDm Ç»‹¯•¡“é)O2+¢P>AwÜ>@Öv|Ž±·:Ùçl Wòlur±#ßä`‡vN¸%=PÇÖ_ñ“ÅÔe&uø~#ÕŽn1*»=}«Ù†«(¡”å°Œ11ff<ɹ­£`âËÞ³W-Ý’þœ®ºòÂêýÕÙwÞ,>²Íë·sŸ i06ÉZ_4©b¸ùÌ núr‡\5‹tu/^)Êð*õ@úï9¹:Î` :)Õ˜B¬’þ]ÿ†ôæü Éÿi^qSÄzÖ§«‡ôF¨éWWÆ A§±‰w—LÝÒÿfyÚ—¿Â¾8<™÷…×ð›¶È,+qTShñ×° Å ¼CN/ý(ªþ¥}߉m\´­Så%Ë6‹Y?a“Ä'G;?ÿJüéRÉ'ŸN-ýÅ„³< !T²•üìE”m*¹jZ§{g Þá`yÛô=¼Ä&‘ʆæ²Ó\¶9¶u¡Gp×ë7ÊÆ}?4ÛÌUgÒþf÷âñ0ô¢"óK˦Û=³5)Áó‚¿š—žj);–úG½”?ê%ÿ§é“ãïOñxêîCŠ¼9û'î­;ï1͈lx–×¢ âò“¼Ï{Ç‘¶V©¼”õ7Ó.ÜÌ ''ÞôöôMM ÝG÷ò4N#ÿ¶Áßô?I-àÖ·a›=Jlc›)ló]Ù•lIÉÂ¥*‚_ÿb|©Êô'¿ý×CD‚),B¿ûÙŸ\Þ¸°WD;X0Mêxn^·9·–½$—ùŸßØEÒq}‰,Æ6¸!ñ×ÑÚ³6jYúL*ˆ@<<]oÑüiH8xÏ̈gv-eçN·Ô?{½ìGzêá£ÿ­w|&ÞJÎø£Ãó“¢ÉÉûƒ“Up¹nv?ënãgçõŒH¾©l#|jK¢Å–´IDqgy™Ñ½X ’ l£C¢Qíöõ %ÓÓ‚Ò_#÷·Ø¦¢{ö«Û{ÈZm“ˆH$¬N£ëêÒýn.Â6‚þ—¹|þ“÷"À*ó‡ ¹†ÞLª,…?]Ò÷‹O¡7£¿\*^ò«çŸþodj3éØløþTì&Š¶Ž––îÊ1/†…D >¾sÌÍŒMg0èlóƒeS¸«ëâÊ?Ñ#å’Ae¦ÙF‰x/„_ÅPÔ–‘™mýÈhgíöµV …F¥8ìoz=Ftþ¢®ªuŽ|(%SYž§Ñ?Ç_UZÓTUUuãËDZð/ÿcõ‰yuѯ´ø»¥+Gˆp´ãHÎ)ŠUÊõSÿK?CuUY\Ñè°D.̈ú{ÚGå/3Hü+éFgÖ$v¶½›%ZÈ'퉶ûÅVnŸ™dþÕ¸Àr÷‹æ>BG‚!ÁËœ´£ªf™_˜güÝæÚî ã˜qÅãOSbsÿÎMý“Aúr·Ê‚j1A*’éi1ÙŸë§ý÷¨ÝÁî£È|ëÑÝ·ó4)ôŠW³ :Gw±tœË«h··®iÀeb£FUº¿ºšÇu›P2²Û³LUÛUñúŠµ©Ü›· ƒ]-t ÍØ­°éí"+àØÆé¡Œ°U2ÍÈÔnO^ÅÅdÕ•çѯês-ÿÊM”‰cÛ+àd]­ ­`| •@Ó,@úlÑ'ÿ2¶DExêâ´@8ú׿ TT¦—~2Q|U,D0çÙt/´¹žqÄ`†Îó5*éìëçþ9Wɘ§`3¿Zd»àÂ¥Zh.¸›qÞYèŽùòáy+ý_¶£^Í;x¡ÂÓ²ÍýΉ¯ùů«X¶™o×ßq7îÕN H- Ú@]¦FÕÔÅK–¼øòsl&„§‡£‹TT •O ±¹‚êø(˜zZÌ°K|ÿÙ®g›WcóšÍ¿9Û,ao=Ûêà8°Û,¨HA¨¢„ªöÃÆb•%’ª ‰™@½ýÃïÇÿå“qÁÕRX"ðQ$Ê…eªo‰®KýŠTÞ1Ã,<]³‹­gh2ƆWG?ZQª-‰…Y€§Q•»èê‹ <2&€a š%AFS㇫"YªòÎÈ'~"´…,º–÷½d€¯i æá| 3ñaB ,‚0aBàiHØùr|é/ÅK?èªÃ"àqà{± ÕÆG ‰D"‰u !,ˆE¨2Õçî&PQRW‹À¢À÷`ßFƒFľ…¥l-S,‚ñ~ï»{—þjÄÏ[C@¬øžŒËÎËü¯)´Y$ÕÕ“ƒB`øø!-‚b D)8À?„q™{dV.¨&€A7B‘ $†Ä"% Áˆ™‚E0X“ø@² Œ¹±Á¼‚BJNAÅØÆ4G3àˆn°ÝÄ4‚ùº*…dL£òÍ4š N.|@b‰U¥Ä0$+4) ¦DMÃøi*€ Ú *,x ‡ ±Ü2 ‹„¨Ä3‹!,ŠÀn/þ¼ì­›³²“x ox•Ô× ƒ0àF¶A×®O«¨ /QõuC0XÚª¨tmA€m> ÛL\*œRQY²täÐAH¦aÑÐÐÄ’O&¹äµ±,ÁšÀ‡Q¤ú†UT*K&¿ÔšÂŒÆð?eâ·KÄ**ïVo€`%þg)æsŽ(©ÃòËæÞ8çzdákæyúbE˜uû?÷~­™NÔçyÑïYüžÿ]¤‚ïRža á…[öÖFؽÿrùÔ§K'TT$õM0½ù?ÿKø‰Ê˜Š Ôüó°ö‚h°«»oô»µ$}ö¢w¶ÛVQ%å÷Ÿíoìv70]½O+ú“¨çmÙ K^å¼Ï“Ôîþƒªã{©÷_¦¦)‡––ÖWÓÌí^(ì‚hßJΚ]Âç©_þAç梑;£ÈÜõ—¡9/"{÷¢³_êê¿zÑõqýµ‰lû½ÚªÁYÅœèÑ'yâù÷þh‰×ïuƒ§¿S£KÆûŸ¿zÕá@Åòšêû¾%?‰•åQÔÔ Êô‹Ûnæ­4a ­Ë4?|â®úGúFbátéíÉOUDŸª¼Ó%O%ÄŠU–N/ý´WUŠÈæƒÕõív_ûnS›Êct£]³Ç7<”ì•òLôìNÊ*Ÿ‰’—¢äõzlÃ%¿z~¶i<ô%}5:æ%‚‰ááF‡«bÔ9kß-Ôæ0ô¬ª`•÷^ÉØ3;×ÊE‡Pâ®Mð5h΋´ì0õHáŸEcÏMhž½µUÄu{¿`ø Í–øÅïúzG'>@0µÑ²À/ô#¦¿S£?9½ßpe"õdð>•Æ*l~÷Ío†Ec¼ìMÝV3[NÝ—ÓU¶›¢Á>Yûmï÷mçÕ5Wyñ«m,ÌËØäÈÿýwø“_ ýöýÿ÷?&—|2úëߌ^žSõhH¶ïuÛùc9<^öÅÒ‰LDè¼s‘ö†d¾r‰ÇÞ\9u„Ç˹ÙÐ5u'HÊ6Ø]†ÛE¹ü¬œ#§ê:ˆà¨ˆàyqÚ‰»üþÒ±ìŒÌìËeMÄ3ß”¯q40÷AëêEw-•Æ¾þxðyea6?»àTQ,PžDðîTvÆýÎÙ:ˆhüõ¡„‚ d:”CQb›ª´m{/=“×UYœÉ&ƒˆ®øâÆiþ…»?è` !¿wr«¨Œüâ·‚OU$¿Péú—_AÓ“°ÿÜcebýª¯,NS“ê¾s³7‡FÛvé1ÖÊS½n¦ #{·¸”´m>.ªÞŧt^^­í|0ÔÃ1ç|Ñ™ôª6%¦“ÓŸ_ãÛšpœ½ÂŽ=;† —ö93ôŒ¶JŠŠð×#iì;ÛFü^q¢5}MÊjß“…ÅùQ¾Ú+èG;‘ѦÒ0;&Ë5=» Ùo×ëk…\îGY°ýÉ+, gûÉtøúš Yôk¯‘bo]Ç\¹l3ç¢Íâ:LN ÷± Ýá¦ÁZÓ?³ƒ¾('YDMɤêùJw=j{+@à©Þ§oq`$ÄXËïä›ùØÆÈdM¬¥™ÝŽƒ×;k-ç\DÞ–Ÿõq51¶XÇÏ>öäų´ýkÉ:‰ùÇî½"OóÔi&›m¸›c ®œÉu0¡;¥Ã‹Yàãá–,®IÈν®&Zj&÷ÞbÂxOñ~ MŠûæ}i)QnÆ,5ã°^¼f: w£ù!ûÓ’­2dh˜nïƒfË6ugö0õ,Þ#ðä[jÌù—˜øX•JR'9îIKÜç Ç x¦á&\yÀ›å1Ÿ8°ÅB“kî—šàj³ã ›ªáv\¶Ò‚,™F{ãRö¯e‘urË»ÐÜÉ{[Ô¸«·ØqcrÏË9lÈ¢nÊÅôßw•Ö»›qM¼²²v¿FÙ†µ/ÐÝÈnÝ¡Ûí é–Çð¡)mwâ’+'àùM1£[”Øf{‹ù>T“]ķЭˆ•,¯C?ì`’à{ˆßu«¨@K1õɯ&UTÄyÇa??%úy{ïÀOX‘7¤IcÝvU¥39žèÜÐœh«f¾wDvaY¢ƒ®áî1,Tš·¶ªþ-©,€GrÉk.àšÜä`¸%¾ùåqTÛ¦~idÀ·Åáª,Ÿ~üóTÕö©,Äw¬ÕjÖ÷îäm`™ì‘ÍÈÐØðЄši $¦{A‚3{ÛÅGØOËÙFnÆj0lZ‰ÁlpP×÷êW6> Zl©Ì‹ˆŒñùJø~fOÆŸž' PâV3S×Ä úX馡R’µ}¥íÚ búm‰×Öò’ªÏŽ¨kP#J:¥ªÌ“lm5“êñûÞØ ºÓ“QâI;ü® ¢Q/sÒ†ä*i GŸ[qiŽÕ"‚wrHf4ø‘™-ö\“œmÐyâÑÙ}4=ËÆ>ÞVR¶E£ë,)òBÃ-ô)I…Ï1ÖäØðèÄÜòuø­Ð÷}+­’ÉX;ö “h=†ª2×v¤—=?å«f´ %.Ae˜êrJj›TÙ¸·C]Óí%þ¹`ï* ·d1¡IQéÞi%ÒwÀÓ [´àE…Ä£ÃÃS¢…¤Àl#GKinpŸ‹uÀþ‚iGÂßhlòÕ$ü„ÔØè J2K-ùÕ„šºžAèW3Žjþ¿fÃ|ù®÷yŸ÷y¿ãCíü %œêÖ1ô½01Ò^îiÇÉné— ¶/ás£Ò«Íc-’l½“ïÎq:ÝF6„Ú}•`}ŸqÕÑÙœéý£Í‘•!|¡Ð­W.?á6nŠ6b×¹)ÖjÀXïÉ‹_*Ú˜J5b'âvúµËÔ§ÂP*ÚT2çpúÖ%^Ët˜e®âÚv¦Jlݤ-NaGžZ«ÁìáËF›^Ub*ÚDSÑfç ¢-Ïÿ®Ê`Y%E˜óèè íPõ꣫‚}Â6 8óNnËh9ã>–—ßjý?ãÏA>_­?„(ŠDö.EmÖãgØàå»%™‰6ãù®!ÏÉUöëm¨zñø½w„Hä6g[òÐÛmü!H<-f¯uǪN/åI ¸ð³§ôÛ¥.ãy‡Ÿ’*Ú¸-ÓXN/\Wã7n̾ºA¢MµJܘeÏñ¾¦øÍÑfàûûÎíá‹V´½ú'R£(”Ôêll´#þ‚ŒdÙUþëÁ»QºlC¿üåý7¨æ–¿“í{}©ûÞÛyÖ¡Ë=]Xõ “ÇýËDâT\¸{ðªA¿îU¢"eæg£„ ¡‹«‹³w¸'Nï^!šÚ…˜· -kÕhá7=#)í…‰cDe=Kr _þª‘ßmúæ6÷§é°£f¨n—(Þî6/z@n󋯓Ýч֮A'öˆOA••ÞNöÒzkn£]ï;až%·ã<5¯æyö¶¹œ)KUÌFšGROŒÕ¾ŽvëRCïôØBsncNÑÌarI„Ÿw̾AºˆŠ˜/œƒŸ[N/¼óâ„/Ç˃D›üWŽ6Ô¹ðøáò§jëÙü¤J&ä‹®©ßF´avšbäG(ÛÆhcÓòÑ?Pú àäýë*³ÁMSRïw‘˜ÀtQbþ‚ïÌCæg—Ú}.¨2·÷Œ´ÞÚ)œŒ÷㊩¶1L´Y>ÓkEâIú«L²çøW6™›¢¨üŸä ú‚håækˆPµ)5Ýøðçÿ¹ˆñs$5Ìï­§ìS¯·2­Ù*v˜ÐS·QEòX£ë•¼é/¹†ýF4íÊÎnì·D›qÈpk´q˜ÿÜZ·Njά5·ŠÊ]cý®ãk/$ÒkØÌ”;ô[Ä¿µ‡H´3| oQ¢ybï¸ãëÁÝq‹ CÁ>¼è}æ«0åõI"îÞü»–ºM„Ê”¯nðçø¬ËCûÔm4‘þüÈ]g-›«‘g˜Ü†úx#÷W(láâäJ*éV„»]‘­~Õ{W‰©æ»]ì t÷]½1.|¦W\âBAH«å”¬Þ<Å1hw¿ùŸ¡Ö°/uô„±‘L•áå¢MþÎå\ѤeË¢Jî!ÝŠ/gFHÔÖì§dýq{ßM_OX¼11~;7pÍr¸9)2uƒX òŒ\¹6t†çx{ï M¦ƒUžäìÀ ŒÞ’”°IìæÂÙËÌ·”&8ãÎ]±5)aãT!ß5t?“ôž“Ò>¾  ’ n“úž9)Õå}\Žß‚U»vn ò:º†×Ñm¿°mK`Ì`Í£u¹·ƒ‡—8vó¦ÀÉÞ "í&¬cêxûWø <'­‰Û·*ÂCÈ=QÉä6v^á›f £6ìؾv‘»€¿^v•YPñž5<ÑĨ¥KŠ/ž*ÚÕ·g“.ö¯W«je‘ß„F„‡x§ÍŽ[ºî‰‘Ô>¯òvã»OòX´hêd/×ãø-&Ðágbf¹†Ä¿‘6„ÓW ƒNì§g$ÿfÓ±|µQ«Ó}ú :‚møðïÝWªPSù=¯3½„¦¡&7M&‘gTÜ|ÜÓw í—Jò$IF^I}›9Àh•Ϻj ŠÛ'¥ù7ÍYHçƒÜT‰,=¿]OÏÕÞ½RF-R*O;_ýˆ°,óIu^ê©ZkÖr³"+§ôéÙ­¥9©IêÍ&ª×ÔË“Ëê^0}PZZp[aÝ é(+È”¤ÈJ*kɮڲÂ.Ë×4œË’©î—öµ†}Ò×Ï•R>þõ|f^y½åêfì\QZéÕFú£¾éT†T"ͨWaTúõlžT*+¯ÓÙò¦Ök5×Îä¤Hdy¥Wu/¾Þ»QQ’*•¤å?í"zVã­ütYJŠ¬¸âfIâéÈø¬&/MJ-¼äR nTk®LN=Ým kK3’³/ ¸>?Kv­NÍüQ×T{2“Z $·ä’Ú|å-¡¸V6ÄB:‹rÒ$)òó7Ÿ‘íW§•Í_g¼YQ"—Jd©™—o5XGRŸ‹VêÉ®²¼´‰¼äÒŒY =QØRDí+Iú#Eƒ\žö¨ÕrÄ»êNH³šµ¦”Ù Ì•ÿ¥¡ÿÃtMWäR™L.O¥Èå2¹L*ÉR¢Lfü´´ K&“e䞪mP[Öšh¸”97bóiA}¿7Jè5ãöˆ;#Xd·Á¶é³p6e±»¾]M§y¼ G¶-êÐã×± S•ø¾Êøò5¢?¸#l?²h端='%Z®}ŽeKAXÌ×¾cMýŽbTŸcìäp0 ýù'*‹ÑZ¼KÝÌb?°Q°Xdc+Ití `˜SIÙÔŒ¾–¦? ÚÐ-ñY™$…ꡧ)Ôp?ˆv6·tè_}Ãßhƒ¨›”êî×Å™hƒá‚¡íë7?øøŸxc£#’¾ÕF·jYÛÇ,*5‡Òöƒ&Þ‚Öªí‰[ô}†&Ú;'â·ïØ9PÂîºßc»‘G¹ÛödþÄGÖ4’BI\GýÖ©&jªH#Žôã%®)/Õ³Y›­çqèËnàù6€ßl莊“Šuáݦ׼ z'Œt2ÓðégF¶M»ý¸ê6€WKmHœ¾ %$õCÇúMu„Q‡cŽ!e…:«Eàj„w.^)Úæk*M3mÌÅ÷Ì "3ó†#ºg~b¬8ÛðÞß¹x Çr·åÒïžGúîÄ”í@‘ð&ÇY¤õ†ŠÄàò1]²¤ endstream endobj 1018 0 obj << /Length 748 /Filter /FlateDecode >> stream xÚµUMsÓ0½ûWèhÏ4ª¾?8m´f8”NDZƃc§±Cé¿g%ÙI“šœ,¯Vo÷½]­ºC]DoÓèôœ+d±UL¡t4CZ,,Gi®ã«í¦Ê³>KfL›økWnÂêb[e2£$> †Ë².³® ?3L“›ôSt–F÷…`Ñ.°&å«èú† ìŸÁÜôà½VH(ß]E_"2$z1¦°ô–a&–bké N?® Aï[8(ÙCJŠXl¨”Î~e«uí2•$náÛ/Ãz»Y·Ý~Hœž+öƒ©á‰‡[öýúv ÂÜfweÓ‡ ‹•£ÿ›½.ÌðÕ{N‚rF¤h E0(‚™âN,EÑtyf¼ÜW”Rl¥dn æ Ú>áNÈd¡íö2åmÓ;9}„U[Tß aÐ}"tœe?lV]øBÙºjî kDÜ·ÃѬχ<»u™{˜<«ëÇ`Ëš"ø·Íhj›=-¿õ!M?Ó¦¼ß–¯1šQ.±!^ë¶ç¦dŒ“™42N,þ‘ÀU)½ÎnÙnŠ°‘gMX̽'¡•†­jØÉÛÕ¼j²¾j×Þ9‘`ZoÊ„ÉøgÕn;GÄÙV œ pt¯¨ßÛ)ÚC] )>¯¤ +cÇÊU×gM^N”PhlØèw25Jby,Z»XtåÔÍq CϽ(°5tthÚÜ ?àÈ×pv™;}Aü×qü(ûBIéÈil9Ÿ7± VVÿÛM¡|—­k‡…ÏЭ°ºõÉÀ¡pRS”»ÁÀ( 5Žö e„a"ùÿ›¡¯p–X v8DÇauüÈHCñ¯ß˜ÉGPÀ¦,SÌ—— ŽÞÕéÝ2[÷ãs(à¾+ÆŽžËËm]vÇ™þÆöÚ! endstream endobj 1006 0 obj << /Type /XObject /Subtype /Image /Width 302 /Height 123 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 28382 /Filter /FlateDecode >> stream xÚì½XÇþ>NŠ%¶D£1jÔÄKŒ½÷Þ»Xbï+*¨ ‚¬±ô®€Té‚Hï(½÷§pÊûßÙs§pÐäÞû|ïý=ÿ3‰{vgggfçOÿ, (Š¢(ÿ›…Oþã ©©cñ¡Dm¹Ç|¾l»ä ¢Fø|ùµþâÿ ]—x¨Lû‚_²•ì$_ò™|Å:P”ÿ2ù­ˆ¯kѱè|[èÊ[»"‹¸:¿|É:b¼üHhmP²YA“2µõÿ²5EQþ[ ä‹q' 8EkoòÛoR‡mOÉà¿3Œ¶à‰ym»1±Ç°Š¢(ÿÞ*“„Ò¬¤@ÿàw1õláE[[•ìøVXüb²¹¬:_ï·oCBèèïç›SÚŠR£&Îß%<)ƒÁá HË)ÎÏMÏÌcqx" ÅM{ÿ.³²1ïc¢·o`pHÄ»wAAAÔC‚ÃÞ唕'„ûøú¿ D:ÒP_âçOýð÷÷ ýÐ$¯¹©";7·±™EN1‹ÃC#+y­TŸ/ ~<Ñ`ã?¼/­¬—ä EQþ«H¦Í}£‡ŽœU=«rìб³©4Ùñï^¬\´æ´úÅ çéræÄ¿–†¼³*GUÏ;´o÷Î]»Ï¨ªž>¡òÄ?¡•ÒÖå$]³ÚÈêu‡'8×Âjr³z|íγJG´þW6­¸QéeyL太ÊÑÍ›”UNž¢¢uU? !ù‰®ÊiÕ ‡öîܺûàÕsçÏ©Þy`“í¼vÉúsš—4Ô/œ8r@EãÆÇr—âüøñ“’&ÔæÄݹ~aõâõ!l þš/zjuömõc;öñ OnGÆUEù?çNy„BùÜرzýѨì‚Üììüü|“+‹–*gT1Àg¿k²qç…èâÚ¢¼œ\ªdgå–Öò¸ÌÜœì¼ÌŒg—Îk^‰IÉ n,­mjm5+ÞkÑâÏÜb8\Š²ØÂl´15:¯}¿¬©¥‰'çL¼ö®’Û\“W\šîk¿~ýfŸê!yùuMMe9¥¥úg÷k›Æ¦fåæ䕇x›m?x)®°ª8?¯´,GKyÍöë¶T[lF½“…±ñSæ̨‹§µBÞ»-9Ù›-%é ôw¬6´|}~ÏN{Ÿh…ºFQþ‡ÀXë=c¼Wy-­'ZšË**[¸\Š&¾4Û¥r­Dú>!Çj|mfxÕàvy]£Xæ"WX±¯.ÛwÆ#¡'â~)$Úš«é>ª`´ q¬3ó&]‹¨ühŒóݺeGbfŒhédrYÅȱ¼‘CH4—èerPõv‘AUv'F,R”.)Ô]ÏðfŽ˜°·"±­1ƒ'‰D…¨(ÿ#Ìic°Ñ¸9›Kp¨¯ø™¼uéüGžI'ê­Ù¡ ·Y²Ü)¯-[ „ 5%Úª‡´®Ý©mb¶êIZ˜ ¶f÷´mØíh̯QûÈcy>˜=yî¡Ó§UŽS½¨íJÕá°êÞXëß|`/A륑(äA…D»ºX’&ò¶ EùoÂPÀRÿðòOnXpÁäu=“#¼Ä,Þ¾b‰…_Ab Ùž“úr1Ìjô0¿©cp§\š;­)‰?{xÏ5c÷&"'š_Ðy ÐØÐ¥éôü)z‘­r¢ß¶m;³HÃÙäÊ #' šhvâŠI“d_x”Xd¬º÷¹ošÄ銕#§¼ý`2ššš„ݦÛm¬,ÑÚ·Ëém¢$`T”ÿ"w*0‚ç}p;xàˆþ¶ö¶6/ïh«œ<Ÿ_>+ÌûÖä©«M_9ÚÙRÅÎÎæùs7!˜ Žw.©j^-©i@›hrøœÌ@ó+æßy•Äæ‹-–-Ìú§·uŸ3(ilµb4í=P=¸JÐXÃûWK¯ˆÉÈÚüDöw«›§wèX–6ØìírkãíüVÑHÏK‹Ü´vkBÀ‚lO÷W¯^™Œýù׋֯==¼ò J"¼ìžX;UQ›'Ïþ¥…éƒ5sgžPÓõ +¨mRøÙ(Êÿ€Ò†Øï ]ü”ìngejjòøé ÿм¢r.ŃòZr?†èk뙚?6£‹¹¹©±±•xVb˜Ÿ—o@=ƒÅoõãqŠâ­,Ìb‹jx¾Üæ‡Ð·®žÁõ,®‰lG#ïl!¬YiOŸÄž0q!ocë™\BýxìŒäPkÿZ±Î‰Ô¬(LµzéʤÛ)ÉN·³zñø±Éí›·š=~ñÒþSNaJ¤ÿ+ï·µ .Z2Í<255½klt÷¯³ªy $*Ê›;E ʱYÍ×Ìàp…†Š›ãr9Œfª Í‚ƒ&ñ!£ÿãrZ¨Â#\ŸP#~9ª%—œãµªI¨_ê<©,DuÀf2[¸"ÖËe±X¦$¸Fê ì}š'è›Ý“`&Éiê$«EØ §…Áh¦zËd2É¿ ‡ÃåŠÍ …Ád6ÓÿPƒ0 0*ÊQ]‘©¤ ÔŠ*ù⓼BNñ/'pYLò€Ú:„óùz¸TòZks® ¢¤½kÛ„HúKé”EQþ/¹Séž8‚AÂwºí2åK’TQYð?µÔŠ9çùíÔ–Ž‘„™äã$B­øm.6-²€—y„¢(Êÿ%M'O(Çñ‚mx6™%Η&gRu%yLH‡/¡5z(n ›ÖvÑv²è†ÜYêÈo‹â‰b”²@úζÞã²cò ù ²«(òh"Q[ú¹zd7‹Q“œ^ÚÂåÉ2rÐi mö´(Ç&R¡È(É«¶¥lfƒe£"ņ" òeß6ÎJb+Ç}·¥Ì²·Rqh wbN½o²•…Ŀ͆ÑvóáË ˜/}¦ˆþP”ö˜5õÇßž‹——Åiå·|›[¸rˆ8ôO\"\]’‹Ê$ªñd( ¯rxVˆÃ”ª‰ >~þA¹E\°²(Ôßóm`P`Hx^y›QyaÛ–ëæVq9åÌêü€ÀZŽ˜!+MŒŒÉ% å°™iIiYùj)²bßG…sÉê¬-ÌIŒ­n&Vˆâä„wÁA1‰) rÌôÄ„OÔ-D—Ë‹~X&V2qJ>%¾ ðñö)(-ŒŒø@üÊ[êÓâ#ýü½½}¢ÓÉCy´õ$3ñŸŸ¯Ÿ@RV—F{Ca²—WPhx|B|ÊÇ|êÎ½Ê ³¨[škŠCÞ¾õññ}‘Äb·Hj´ˆsNQfXß/Ș ìÜúŠ|Ò _ÿ˜¦–bÛaT…‡½KOM ŠLÈÌÎÉOLˆ õóù–¡ó¼‹Š"·ä®=Õ:ŸK¡¥‰†ƒÕ¥ý™3¹(ŒsÙµmï3'·'÷nÓ4ˆûH–·…Öµ‡önÎöo_{ð̵0/îÄŽ-ÚLƒR‹ªsÞ_Ó¿SÈ‹UîêKN?¥jK?éjŸËûéÍ[÷y¤’ÆõŽï¹vE}ÝŽ^êª3ÔOîÓ14¯£`Æ Z¸`áeYÑz—.Þ·°yùâ†öÉÍÛ3ëï¨vî‚…•™ÁÖ}g‹¨ÆÙ®gOŸ5³v~qçêÞ—rÊëÀ,ÖUÙ­¦oêh÷ò‚Êžs:÷¬Æ}›i$²ë­.«_6ps±½pöÔÓ7±¬1k(O7¿}ýú{[ åUë^†|â5W?Ö;§~ÅÀÝÍQíôqc‡0Ì’Èy W=vòt³½¢yNM×ÈÅ3ÀËñþVåc9²J#EQ)$.6fÙÆ-Û¶*oVVÞ¶}뢉#6< iLÌ?ð ˜^SyƵóg̉ûض©ƒÎÚ'ð溊Ì, ÀÅê÷ØF$2Z8-ÌÆ¢âRO‚ær¢çMXWHÇäh­ û.ܵ-­h 1>£bõÁEwòÙ—à3Ÿê]\½zçÏd°Ê6Î_–ýqï¬9Ñ ¨NöÔ<¬¬{åF“—÷ôøb•{Âfy¬›{çµo¤”3Ùì€ûçf¯ØšYRkvã¢þcÚ‘†[w|ýÒË/BÁªyzéÀ•¶Ô®ÂggÙ¼Þ2*·*Òzþ²µõ¼–ºò†Ž_¼ÑÈh ‘˜]“ÿáÀž‘´o_¢÷‹ÝÇn”T7 ÙI3ÊÍBó’NBVIK 3ÄÛý]Jqqæû[vø¤5Pý u~¸v«ZQ-ƒY>qÖbϘ>£ÂìÚ‰ ú÷ ªê9\ÆÉY£?Êå£EQ„H\>j²yBYY^fffVyMÙó;¶= ã¢fÇĉ2ˆae¤©ma_ÏE¬—ŦU‹æ­ÚbüÄ¡´º¨¼xh}TZ«çv«1D°â.lš|ã=?'ÁC碞…ƒ}lA¢Æ©“ÞÉEì¸'ÓWﯮ«{xÛHGçÆS¼X«ùʆt¿ºê‚cfÂ;S=ãÇ&ÙÕš;VÝtI nÌ›»×õŒM«šg¥:L]¼9%§èÖ•S–¾á‚N<;¼eÝ•'¼† õ]ÊÏ=Ã{txÛ§ÔÛë˕л'ÀÕTõêÝÆæz‹“íÇøcå†-ÔŽ´|þ´¾¿NI-¨Ð/£ÁáÁmm½» Zâãr¹œô6Ê»O BSJcüÖ®Ù”VZÇ,˜»d]R9u_ýó[ºwÛÕ3‰«íå¿_zχ‹ŠòîtÔ4ûR±ÊÏúò¡¿LB¹¨Û3iüÍ.]§Éò¶ÚåÇv•ÄKœxÑ”|Š<}`û–ã†åMùZGöÛE¥q[ýl eè÷4PÙrÂ"ÎãÊmKÏ7.¯- o8¢’‘[B±®‡f-ôŠK|juß5(ÒÖÚÅ^kŸªs4%¦G¼ük§¶­ë g_GÏÝ"ÂBÖ/Yò®²ÕA½Áö¾žž‘Ie#ƒz#Þvú‚ÄÛÚ*Ï|BÝ}°oëÚ+5÷l~ê$¸Ñhÿ–vÉÉŽ+”Òmµø;=:{Õ˜Fâ|ÇÜâ'åÝDzxÄ/‡CB4…¾y\Fã+S#}£²ºfoÉK¶Ý´S%þQå³võúÔb‰K×%SæÕ?»uÝè‰}=“Ä„è¯øýR¤"¯£¢|FwJÑÄ©ÒH<¸Ý$ˆÚÇ­Tæþ¥íOa–§\?sô©k0¯¥ÔÉ5¤Éæò¸å¹ÑúWuâ³ã®?ð<$žÁná¶0«kj[xb›ÁcªÕ¤ÙKož9çŸ\•æt`õ’§îVwSÿ[k6é>v¶°b–¦û8__»B9<-‡ÇCiNâÚeóŽ8F%WøØÚ_×?5u›)‡Çã°•Õ5à²ü_kèÞÌ*®¡pâóàü‚5Û³Ëëß¾¬gâRKHVÝîÍ+ô_F€Um­s芉Ssò^å ñå¡Ï¬Üœß nSå‹[j'4o6îtþ Š;-JÚ¹y›Wl…¢‚Oé©ye-\>—Ë««*ojnNxõXãâåZe¯uâÄÛúâ´ÝÊÛ½b‰l°ó½õÛ.–Ô14QŒD —Њä+(¢¢´Ä¼Uc¦;”‰Ù&›+‡wš38¨È =³ï/ãgö&·tÔõÍRJ¨U^~nëfõ{Ïl_ZÞ»yýÎ#«j&ËÅøò.Umk¿äÊOGTÎç°Dúa¨Gõ)£•hRX/H Z?{ªæã×ulr!3ÆzòÌŽ¾qesy~qæº=Yù¥im¨,RÝ0ÓåçdG¼Y¿pÊ÷$ ¡9‰Þ;vKg¡*?ኦúõ[­o_=¼xõöb&RB½®¨«™[Ú˜ßÒ>yîR$'3%øü‰³÷Ÿ[éjŸ¾|»Š$Û)×>qàÌ•ÛnÎ/ÏÛ~TƒBbãþ-‹ ²Àjp¸¯sQKËÆÎæâéCçŒ\뚨í¥Ù`Û ¯O`”ß7Ô9wùæóÇw·í=ä—TËk®µ¿õ’öU;›g§½ùDÉÈ,ßB#ñù=Š‡p§+G]~¯ppUùV A"[“§)b¦))ÐÃ5:—M§CdV¦›ßzjçQÖØ"° P¨ñ°6»yÛÈÆÍ¿º™PNM®ý“û=âéÏ-íÊ$"åi¯Lœ=#‰LWUâùÒ99#Oà÷ÝP]fke™YHhJFB„³{p]“Â/—Ùœâgï™H¬¹ŽÏ_fWÕP­.I·¶q*e‘©±áOMï=Åüè2yÁ&A”civ“{fÖ¯hæS(¹–ç$=y`dáèGw–â­Ùù£Ÿ˜š¸yù»Y?Ô¸ñ°ª¾ñ•³Uxª  ^t ›á›aI‚‰ârY–æþ)´-¦©ÊËþÉ-#“O5\á ùìH_ÇÛwîG¦ê·4ZZ;”Sˆç±â#Â"ãRXR9ÜæQ`¡WEQ¡LhNZÍ%/rÒ·µ\Kšã[ÏÉ8–oçJÙ÷%]¾$ãô¥2K\ìLáÇè‡Ì|‚c¢?ܽxðÄåÇbÞZ\Ÿ'oà2 4/Úû¿} ¯¥öÈÒ­ŽÑÒÚ ¾œ ’?Ò¶Ö~ש®óxâG(`¨(ò9™ëùm>3!•è^¤tò—tçËÉ“/gµJeäbSÊ«Mæ–ÖVsm¸ÿksÓGÜ7yá_Ñ ÈfÞ›çÉ¿\FlÇý{Æ÷î?xaÿ:¯¬V2J£í³$3¦¶¸­ÃžL[£\ íG¯H (r¹S9`'ðåÖl…!$—§dËò¨˜ì”XÒòV¾Œ$+»Ð¶¥¡¾®¦¦¦‰Ö‡ Ov'‘ú&†¨ÛÄÑ´±¾¶º¦–ÁbK€_ÎH¥‡6»Œì ð[w*!ùé¹3©( (â3ß¿øìw1þ£;Ôc¾Ì¼ñÛ„LH3Õ_h¤5¨RâÑÿjË¥Óñ z§(ÿ*éÈ{4PŸ®ŸÚ>y„å[ùÄdòä;*K|ÜEÑ_|’Ü“<©OÒ„£6éòU§7qÔ¶ÒXû –$êìŒwÖWu¯¥çWC¬1jó«6áR|©ø ™îò%TO²…U4wÙ†¤üºGw®Ýxü¦‘Ýî8ål€Šµ§(òVõ§ÛÙ“'kܶü”›äb¾|ú$ ›w,._ðe6UZZ¸"uÉfÁåq8l‹Í¡#§x<¹Îå²Ù,A2 Q> N ¹™Íåñ[IU>CðÖXžÿððÆg>Ù37+«¢ºA˜1ƒ-x&‡'üb‡MöDí@‘Ä.OœŸƒn­£#D"ÕCºŠÎÚÁfs8Â<‚Þqèn´p¸¢HýârùtÚzP"åñ­ã·öœ-n‡$Þ š³dcF%*Kóó‹*¨ûÈÀé”!åKAvr¤“½£³‹»Ç›åTë²C^¾IH|Lµïææ›AìiÑo_‡%7²x’H¼ªs-£°¼:»—¡É…Ô3Ër’^¹:SCpñ ,©¬Ä@Wæ&º;9Ø;:º{½Í+©§ª¹;¿ôOðñò|õÊÕ; ¬² aÛÂÌJŒpt°£Š‹wHEmRÓʸiɱ"Þy¾òÌ*®„Y×T乺¼.nàJð|åêäèàäö&§¼YÌ+Öž¢´áñšüu†ÏÙÑ,ÒzHêêcœ ¦/P~leýÐP{çÞc~ÑăYuÇäÙ›µžÛ8¹Ù<Þ·ç€ËûÜ4?ƒYËvkßzèøHWuÏék¹M·'wŸºhåèôäáÝ[V»ÄT6%]9{LíŠÞóÛKf,õH)Jõ¶\¹tÅÝgÞ5ï.œ:nç•Ä«ˆÝ¼x‘º¡‘µÖ©tï•5¡(HwêâÝ×ïÜ÷öû@çìÁóúyL¼÷¶~èZÇÛõ($^Ó3Ì,(ói¸ëà™ØbVsuþéÏ:ØYÚ³W×Ì£ÉåÔå]?¼úØ延6–§¹úÀ‰–òªYË6ŸzôÂõµ½Å¾»ž¸…q$¦ª±ªØDçÌym#Û'Ê•z¼gòç.ݘ”WsÇ઱É3Í#{ ì‚´ƒÜ{çk›\ÎÈϸ©qòêÍûö¶:‡WmQ{&¡oR`QQdKÚƒÓÓ6©ˆ¥!±dƽ´lìÅWƒuý½Ëª7Ÿ»S(Õ9±b×™'„–2koêݳùl¾hþ¶rÁe9‰g«¸¿ ×R9|×Æ+>1)%5Ã\sóÒm:B\Ô4¯ç7ÖS£Ã¢?–65–RÞò6±Ìt‹ç½?GÞØ=eçuÁãKÓCÕΟûTQýpÞ¬M‚,åeŸ¢Î;îS+«]å³?FØ^Ó¹ôàÖÕcjz)åÄD˜•à³tÁJ‡ÐŒœìl§—§-Ú›SÁÈö3›4}I@rAffº‰Þæ}gŠ*KþµòØWô Yv&·¯è›WÔTV”—––Ô62YŒæ؈àØøäâòÒÇšûwÞr«f ‘˜œ_ovWßÔ%*ÂÕlÓ±›eu,.³úÚ®%½Ób_™>zÖ/,*%õcf¸ù°~Ķ'ù*ŠBy Ôú莜ýW]«R¬R¨ÚWgqõä G.Ä#Ñb$ÚSH4Z°åf‹D¸ç¥E¨Ÿ;ûÚáúés¯ÃÒkkëjjë˜--ÌæÚ`«ûzEõ„ŸÌñu· Žo¬ÌÞ»Y9 ¾–B"¡‰1%aë'ì¿/DbV†ÚÙ€ŒòÒÈ›³Ö°yB$j´"Qš&fEX©ªªºxºUÞd@dÕÌø7«7ü]‰Æºš†úÆfáÁ3_Ýž¶z;5ªºššúºÆÆ&6E÷o]zÖ$€D6ÃÊÄXÇðARB,%6º»¹|H)ÎMtUÞv ‘$ o²ÒÛó—g[’&êÝ´ð¥®=UY«ý¶0òá®5š¯o³Z:7²‹ËëjkšÙuÕ$}²`R€QQÚÈŠdI¤ø?;eâ9ó¸¤d{“u‹éXú·ða­1mþXï»vpGRFÐHü @âíVš¸Å°‰çOž‰Ëi¤¶ÿÌõ茼¬íÃïzçÕæDœ<¸ë–¥o^zÄê©SLü2š*s·Ì›gþ*u)ÚÕÜ>¢6|þ˜‰F1•ÅY&WO©¨é6¢ìáÌu7Z‘xQõLHBmFL°{HR#Kdö åDm뙥%‘Vs–(G—ñ˲N*/׺ëPUSþø†æ…»®5Í\víÇ= ¦]zâUUQøÌ蚎‘%›Ï<¼ký¢µ’+Ù¾dÏ%:/ácCì˜"§v.W: "_ž¿:¹²‡D g‹KØ)y|ùšN9>6¹ìäP>‰éùù|É!J=Œÿ¿´‹Ëvõ?Ô½öÿCï"?Íîo”“þš/'W°ïÐÖ\ÃÒyÂù|©''œ2Íòd\¯!þü¯œ )/u¯½æâ$Ém¿é´È´ïA¢C$<ådÜáE®¸|H¹s‹š$7ÏÏv£µ‘œ÷ppFhŠhn ñÖvA`s¾°=¶íR[þApÜP‹VðCY£üwýy@áIì‹í°õÙ°±Ã+Oä Ï”Æൠœ]P´¡‘ò UŒv`çd—ã±4®£ŽO¶Ø¿OƒÚ°C¢îå~ÄÁ{Ñp²ƒµ5ýg‹bñŽ-Xü¹)pr€O(šyT€/H¢'¶í€Û¼vEd2X¸î„’|ic`ôŠýÐo.›¢®7Nâ«ÎˆÌù»´ ‚å()aÉuÑÞø€Ò"šû¢ê4">™¢©mL)‰ø˜#<®.Fì²”¤#½@š¿¢—ܤoÑé[Œ›Œëfdã‹Þ µ“„¢d$#¯\Aã¤$!=KØÅæÅÄ‘WÀ®@l<ªèý·±¢çp¸y ž#Ëà Æ•jAÆÕµ;‚ ¥«'¡«9&ª_W‰Ød–QßÂ"=¡˜(¤æ“M/3± ¨(ÅÞu˜±” 1\EH¤ ‹‰øhäV _-—çë1h" ð×DÌܯ0ÄÄ :y /º+ÇCi qç::|çîR‹#ÊtUû99v¸‡ï¾Ær¼á7téÇ4fáà\(/E¿ï¡ô¹ÔP„3›1b&þ„I›‘U.»ãI®Æ?•ðó8„ /é%{ÖîÞ{°3º ‡G‚ÔZMÁ‡xòNëK‘˜€¦Ô—‘)˜¨ùÌÎDj6X$©øL¨^V Þ' ¹÷¼÷GI³5%ŽDU *íУ~[ŽHlÛˆ=jòšð.;"1ÛÇbètÄ…âêZ|3/]ñBƒÆÁ"°¹˜/\`éÉHÍ®gŠ™LˆCM3šk—(;WdK÷Á´Þøf>Êëè÷Û‚—wðõ7¸á‡èÙê÷ð. !o°ezÅû,d`H7LÒí6ü¿Å¾ÜGöœ¥z"ˆy`J/(-%ä&Þ¼¯èÕ»n?òéœK•¾øî;|Mì„ÕGQÅÆ›ëè×—áëXs^vÊéµL ·cÎÕ ¯¯.ßá»®Ø0Ó§àŒ1[ÎsôëMêÝ ó"›7stŒ„èÒ:cìl¼‰ÄS]ôèDªQoª‘â®=aá*µË¥=!ã± çáC >¸cè˜Ô J_$òš¡•HŽ_cèNrKÑ'Ìü‰´Ù±3¹4úš€#C1|aEŽn’ƒÄ;  ¡îÚxÄù†ÅJØtŒp5óGa“šeØ3úg²vÁz#zΣðëw¸`„ Jqc>º„_ºðÖ3»ñu7ì_B4[ƒfÒêP¦DL¥qä »ÅEÈŒÃæ‘4+È£êª0ëL;Š¸f©ù™ „.¢‰úÇIËOÂÑT…y?aê1Ä7I­“#]Ð}$<¤VÑæá2Ô+ýðs&bÞn ì‹.] •§pV—‡½k1w ˆ‘—…ÙÐ}¹ËÓ½»ÃÔ%1X1J Áie~8ð3Cïñ6Gf’.EŠ¦ŽE' TYCNºÕRã‡þôÿ&fÙªÖ¢‘E«¢,™m§QÚ(C.b]0åWáÊqˆÞ±c1¢+ÎƼ d©ÿ'Šk¤¨ØG_Ì샎 @›ž mŒÐ¡nyÃB—¬ÍWš”\PZFo;-˜;…<‚MSù¿©;’Ä%dUPÛæÈy("l0ci®ndwôŠbâì1d®{Ãõ*úv€RØxq†ô–KHŒ€ žXŽ®?"ºª8ïé¥åqôó ¨(õäX•Úð+1ü|5‚¬ÿXO ÿw`÷½¿ƒÒP„'à¾*”¾Áuªf.¬![tR&![< ÔÆÏ¥VAb'¬8ƒÍCàŽ—·0r:V ƒ¥ïH´ò8J«q}yGÌiÞ¯Åy0ºˆJ0t gvýˆŸ†#Nyµ8¾#×ÞU÷El>¥äपò1g~èIÞuæÏ娖ؠñ}¨ÓN¶ Ýû®¢^Bt¯„¡Ó/zMå‘øó7ÒÎO£¤ù½L!QÈE¤@y&m"±¦éU·á Rï½=$6”c”†ïADTýÃò¸¼~üT؇Aí] ò[Ç‘¦Þ¯Û`ÊJdW$þIõ³·PòÚ·³áôQ|õÞ”C8ðºK€ w˜Bµó-ö­#­õè‡{ŽdMò²0ögôü©Ð 7¬䃾½°rzu&5'®@ù9˜1k w~¾ˆyÛ² c °!÷È+ÖðBa y›¿L†‹Îì$-¸G ×°€Ik‰:.HÂäaôKŽmûñ‚âÐ؇^DÎÛÖ·£Tü M¼.Fâdš&²øØ5„pM4ü•‚$„©¤¿Œ„³+ÜÁè!8} è¢u{zGj@€Q•„D¢‰â†}‹¾¿#3/Îãç8MãeþhÒOsÙ¦ü Ñ[ çŸ"žÇÈÕp±Á-}LúGµñÌ”à’Fs2™äøœÙµÖ¡ÇïÈ*j£þš ±šáÂn¨hâÈ*l2ÆŽ±d°¡”tL‰®?Â&”žŠð­6’‚1±îʾ€DÂ'× ! ÁA8¾Œ(äŠȶp7Õ…Ø»c'ãÌlœG®ß.îj€-z| -gZIÄý°ë jyâeC‰¢Î"›’àwÅŒý ß~_Æ£J’•D"}ªR‰2ºVþ—‘ˆvê·‹Äßh$ÞÇ`jÿÑ!Œ ÷9a™&+ƒßD#qr¤‘H힉®ß“<ñà#4´ÐÂO ‰Á!˜4–T˜°v/1~ÆÎÃÇR”fâðbü:Ó¦àÏI0wÆküò#¾+7œßFnY¯!«9P¥Üh,…q³abÛÇø¡ æþ…²,|¯-SRÓÛ‚Lû=_Òs;[8:!8ñž˜Óæ‹‘hmŒSúŒ –‘†}[êõ§÷ÛUH 5„÷V‘íýrò?°]zž$-Ì?.<á‚aÝðý.¢yk(Åžõ˜1¾Â€Ñð£šý€ÎУ7¶mÁ¦ÍØúì¼á¤IhôCz‰Æüaøú[¬ß2¢õÈÊïþ#úP4ã·y‘(gÒ“ìÊ"/%ì.t$HLtGÿðãïØ´›7cÏ!ؼÁs#²wÅ’U‘L&J•Bb34×$æ”JØפ­<‰¡êŒ{Zø} ~î€×É81F"¶šèð#‚éÝ#ƒì?.#Ç%±z&ÎEDžpB>ƒDF– Ç7½°f ÆÓ{ËûBøR[ÇÉ!C«Û(ivh4HFbšËŠóDßÎØnF#1¿uÃ)Zõ!êÿ·Ô"œ-äW©çÐJtî‹S;É"_$¹Ò 0m(”Æ‹OÔ¦cËh4!ø¥Œá’*‹”Ð{”˜û=¿ôÐ>^Ú^&QŸâN{Œ‚OŠÔZÑŠÄ{üTîQobÄ° 6Ê àé‚œr8˜ Ý_„ÄN$2¡±~Ad [PWw䵑;â‚7BŸ¢—:EzNOr§ÏÑéœ0DI=\/“Gl¾Jš5Ø=pã1iÒ îì…Ÿ†!.[„Ä&1)ƆºqjYPÛMFá—†k›Ðg(¨}±,GwAã&Ò²ù‚\¹eå°2&6#fæG·iÈʆ›×#)Jô+%Ì€à ±NwˆÊëÔCr|h1”ºàåšÝªBu& ‚ÒhTR|u1ªj‘ˆ5#ðçjD%£‡OÅ£–#¥¸¸¿™tIE¥s¸Áøú{dÔ€ÃBØ% NÚŒEÑÄ®CðÂÅÈÊBú'!Mìõ«‰¡bLÈy%¤‰Ô|î]†_þ„Ï{¼³Ç€žBšØX…³›1nÖÎEï‘L‘°mÑH¤¤{(i†«rR±…¢ƒ³ˆþg'-)Gd¡(7Ž£Û/xd¥`È Ä¥!ž\¥ÄCj‹$Ú$bJ-‹ò,²ÍÎÞ@ÔkÕù0ŒÌJ¤Å$êÒ4ÑëAâ]_Òsj ‡…#: ŒB\ 9äÛöøô ‘!˜3½GH¬îaÜX¼ðFv6r3ñäÙC.’è]¨-%·˜–ü]îTðÒïÇïƒñó ü1bÙ.¢§n>»ƒF`ˬY‰sáBëZu1aÆÏ%BмeˆÊƒ›ÝOÙG¢û·øeµøŒÇC²ièÚ¡<KfuÍÚ-Ø<Ÿ0ü'î.ÂT£`ÆbÌ™Ž™K™›û¤qŸ¤«™‰äøèUÒ”Ù%"bŒ£ø«r$ù¢s/<°•R§˜’ʧ½Q›‚ ý‰Þ€’ÝüAó@}.ÎnÁ¡˜?è«+‘\‚¼d¨P[Çô¹X´³“ gs'té‡èLì[‰qsPÜ„ÒÈ®G`T`íxô€Ûqt¾ÿs×aà×LS¨šB¢èð3ÆN@ÿîÄò:q/ÐO  ˆvÑË £Ƙq5ÊÇð±L )‡‡‘U_ƒÜw˜ü †ÏCA5]e†uƘ%x½c˜;N¨R[´ë×á´:&Œ¦UÄ]1~,V¢¥“º`† ¢¥lL%éX:}éüò †!ä‰K«.§wÃŒˆi”êÏú)¿ŽÀ”ɘ0¿E^=æ}‡}ßß«iH#Ñ…ÔE¿÷ç·ÑûüúT(Ôt$oŸ*/t‰ÅAÏ¥i˜Ðƒf ½\,'ºß$·?s¢ö2Û€ßcüxbÒ2"<ƒß Ì…ÁbÑ< ý»ÕP\·/0v(ÆŽÃoý0q1üP–es±CÅâUÑ€õŒÿ³`âhLœ…ð\¢þ¥Ø-òM@¸›“Gßô”]É1~Ø4ý~ÅbØüö; ,káusÈTŒŸ€ ã0„bçŽ"ž–íWÍ"Måþ=Á$“¯ñ6 Òº—qQ V.(¨²4e¹xùê¡¡ `ÒßØmiFü[\Ò„®ÞÑÌLÆ[èh"ò“¬§Gvô. å_Á™Â,^†s(êàgCdÌ6°ÔBß.8nf.ØMˆðÂåËн°8ZÇ…KZÈ*&ý¬)ƒÎ%xÑBaŒ  N]j@q:Ô4'…ÄŠX\¼ ß,pš`mOÒÂsh]ªA*‹Èù çpû1‘7ÉžYŒ«pé ´´pQjZDÔu1€á=”Ôà•-LŸíh¾7t´ð*†îÞ{\Ó„¹=ÑÆ[™BWôÖLdÁl(ƒƒ4Ô }Éù¤o¹ïqSn¡´†p/hià® jdyHCBûž¼FE:._Ä›P°¹ôU.B-q颢Ãp‘êðe\¾‹ÐÓƒùsœ;GÎ\ºuUè8føüvL]XÈúÎdÀ’z¿jлƒðX” MõPÛŠ™ëË•Ú´__ƒ:ýuu29*§;ñÒúÆ …‘¸uïh¥Jyº™ƒÐNdÿ :HÌÀ£ûмF ®¡}0¿ ˆ6îµ|i_^ü…ä`©µíLsæ®»m Óµ˜Ú‘(^¢´JŽ;¢\‡RAý²êvç ÒnørŸ/Eâùm¦T&Ô¢­OµØéZÞ¬r|ãÅ €ÞaÊÊP]/ÇÑ·Ýü·Ñ^À…à ù †tÅ/‡PÙ$å¾øwÔ§|‰ùùÌäÆTh>hçåÊ:´Ëó2åI¿Aƒ’‹ûÉ“Š#h[§õ4éäµVæIù\I¹ÐC~S|é ð¿ðh~;Þü¶ÎŸü/Äàp%°xD×ÿËqFmý ?sðe‡g~»m'V2TE6Þê³Þæ|éЭÏ÷œ/=Ïr7ávÛN`WÛÛk§-lÛµýMxÁŠ"y~;n«ü/8éç"‡v“ñÊ„xlý®R`3p‚M¸È’]bÔ 7 5K'Œªp¼‚ó¤KpbÂû5ž?CP²,ÓÒT WXZáu¼xo¯È…³=iÙîÊ%Ù·†ÒÛ5ðÞ©¢üww€/¦A²D¬ô( ¤¥¶M*¨©¯™ÍBÁ–ÀðiçÆ&pøB¿Ö2·'ºõG«'/“VJ$må9y;›cõÓšþThÄk¢rßpNhí¢„w† M6Âná—opæ>1/67‹Üƒó°i&"F:¢§ C§À3 ™xnŽ°d‚¦S,ZFü!©[2ßaÜ8èyÂý0yîÃ0}*&LÁökds08Ž®W?]¿Á˜…ðNö9É?w#õWëIqƒï¡~Œ6v(a¤–ìŸpj#º÷@¿>ÄÅNU_ˆEQ¾FŠ²øÞ#Kë—~˜· E‹îz¸q¯< ­C£GTýa8O½ájŽóšð ˆ‹û(“¢f5ð²ê)¨]¡Ýrh:ØM ëÕ Å|v—^®´›±¥Z¢SG<{…†&8¿ÀùÓPÕD =~C¾ÇfUÜ¿‰saKÛ+ë ‰]oÊ"dçÃÙ˜XïG*m?-ü€G÷ð!ÞŽ˜Cûóœ¾Ð,DÝǤÉð,„ÝQbˆ’Ek]-$ªhÃR¨› 5.:ä–-´±²±[VaÙLRÿ‰Ôææö{OÂpíÖn,¼ds{â¡5Ò’ðXFh/5E®oEù{lu$fÔbmLZ‹‡0h Ì݉º€*gûo¢µ;±W?õž˨á!ǘø® ]ˆcû1{ñ‚ó¢]zý„žƒÑÀƒÕ Œƒãç±u1NGZ9š+°çW XˆølÜ<€å‘`¥¾kÉÓÍv£Ëo𠹆ÉóĘûëø¤#Õ #:°—g1¹/úôƒEØÕØ· c'âª*tÇîSÄú) ¡ïŒñ[w\µ÷ ôùF¢>3pW¦3ôíD·¬j ýë0}Š,:+/y Æ̓PêsÒ؃³˜±Žzèþ5<”¢‰U„|ÇŸ¡½ªîÐÆ‹zhÂq0¸Žk×q÷>Â2„œ†ˆŠòwÁH¯•‚8²®ôì¨u†•#±õ¢0”ûL/|ûLÜP“ƒÃKÑc$RËkD*O[„z&^=Åq枉½~EVÖNÁË—‰€èò ®Úo@ë«èÒ¶/°qn¾Ä†1PêŒr>Ö÷Æ´ÃxɃ0s?"Sñ)ŒvX:…OŽ¢„Í‘WŽrrÒ ðY8²^«uè­fäÑVrŠ›íˆ3Ș&Œ&ÑO ¯«Æñݘ±õ\¡{üw?cÜøæ,;ˆ,Ú­%Ù„øR ž£c”ò0o nx"Õ =($>ËÈ­²ó‡Sb$6•ãâtý £gcÛr|Ý‹·¡F!Ù)Ê?’1é…ârŽ¶ëÄì©ø¡úNÆQžíž£’Oª‡ÒOˆÎC®1©¼ü©áý°T“ë Mü•¸RÌ¢Ò;w&ÔÁhÚ·<ÄC»àè †'þˆ¾@.iD`ð·P¿…¸0ârF;â;:ðpìø;bx'œ¼‹fÚ¥óW2¸¸]‹¯ûg’9“‰÷Ôó(!M ¿A‰\I•ÉK š›Ý¹¡–‚LDG!1ù™¸~‚í®Ã,C\ôö k?¨ÝÂ--l9J\㘞øák¨:•¥< XI"‘¢øjÊè>N¨¯ƒú:tþ . îTQþ™žœ*#”ÃÙo0B¯dD ‘Øc8üÓ‰&Ó@_ ÎðB$î#¢Â0¸¶]'«T€Ä”˜3+΢¤I¨Ëü}ŒÆ’ß1²?-À«4 ”àtÐ:âüÀqïðó÷8j†šâí@ø: YÆüŽ_#>Þy£DÂQ‰ûÊU?Ù%¨À ÞPúÛA"%´'aÍ<Õ'Ra Å…ÒNM\,ÍñMw¨Aï!R>ˆ±Ëè超X¶SIÚú7~¢xÞxmÈi$!E½& ”ŠŸªWêçá ‚¨(ÿ Œù´×ëªý“1¾Ôs ‰ÓËYzë>Anÿ†ás‘]‹<‰£ç ªÏÎUŒÑS±œXBqƒ«0äO„'ã­%¦N‡t]™‡=ËÉó6â­`™Ò•üìÿ;¼bQ“ŠµcÐk2‰~ÊòGÿA0¶Aª%áNoAzž¬'þÞ+Nx¨}+ñçL|¤£–ìŽï÷>ƒ 袌0P„ÄétÔUX-"]1ï7¼&'w¬¢ý{}Iâ…5¿a4Å'_ǯ?a̼O…¹º]1Ÿðòœ=qO…â»Aõ*[fâ¾IeVR:òbŽÉóÆh‚¯ ~ìõû(,!¾þDbù?Qb+ÊÿïaH•cËÐ÷7¼(íáÅ8¿J½PÃŹÞd{Ÿ9ý~BŸ_ñÌ›P„U#àIïõ س]:à›2–´rÆî‰þøæ+tê†U;Q"ž¢* ý iî4Ücº@×Ïï`ÈÏèÙ?Q;Ïè?Ï\ˆ üLƒ~"!WçàÒá +`¨(Œo\`ï,VJé/ÏLIª‡s}Ðg<  zE40‚"@â:-’âÉÁ•¢¼4o]áøJ˜õ®¾î¶pòJ¸\¤Æ“ÅÈXâŒM•´(X¾„?üGàP™G[Ø» f IFĬ|„£;m©ä“T-aoáüõM´â—˜`f'g$&ÁÝQéBÇ`OG8¹ <NöB¯KZ½‚×N°u@r®xR?ƒ.D3 ײúl8X“ÜT©ÈÆk$åàc2m`m[[ØX“¦2D™µÒ>™L¤r¹ $*Ê?@¢8ˆ„«vk9ú-:ôG`¾r³o$ÎPù\;2O‘]“Ò©nÁ“Ÿ†÷3t\üÜvªñä”Ó1^»½•IÊñù"+hoȲ— Þ Úí?ÞÏ·üÅçÊñÏ”wËÿ£®qÿCÜ©¼Ü°­«ÈîN]DF•ÔJ®ôÅî¸é ¥}•r°—hP°†y|9 h/};Ø‘û¥^û·ðÛŽè3nù’½’ç /R!Ñ+>_^¤@›¸ 9®Ñ|ùYø×€yÚííB€lnùö6+ÈýHÇçÃèú×t§¢åÑÈgTÌ*³QÞþÏBmؼð öÛnhIë’¾Ù®Ð/´Õ üï¸Ù·ºsË!dmûCÎ'7Ä-pxÒÁ;ãÆÏhÝΓØ$žÎ•þ4€ ¾’ÃùW¸Y9abm$vŽÈk]&Í”LÎyI‡ü¶,MëUž¼W©€á¿FÁ_c FÄÅkˆy‹å«aã%|eԺ߼ë! ¦§qXE•Âtî1X>~¹e#Ö¬Áúõäoí’Jâ¦nÁüIpL¦Û¡@]s̘‡ÏÁ«ÆÙc˜¿µÍ*j³Q4}Ä¥•D{Y܄—ģì¨QŸžÛ‚}‡EÞ5‡ É}—Ï`ýZì—¼C·~¸i"KGÒ°p5ÌÜ…•kÒpj–] ¡š&ËðÇZ¦Éîí}@J–´A”´Y€ˆ¶U¡Öº$IWJ±P"Ø:‡U‘ÞšJ±w/Ay7^G ·‹Öø5âRì°h•(í¿hÔjX¿¯Ã%ªÀÕ¿ATñMOØ¿E¤ ~P­GB¥Ç)øº+ô_‚™…íc0d2 …2”·#qu6w"©z÷ ¹ˆ¿R"††NÐãgìÚ­cI–¤Ž õz Ò°z2ís¼b4¡ÔõË ÆÆDìûýç’ï50Šál’qnÛ<Ì_'ôùÂèDíÛb@±‰°sw’¿¹­×sUWŽÝk0s)òKå }¥¥ §† ×Dø~RFÁR{F»ÁßV£;a”¦‘íîÚt ·x´åÅÿÎ'Qç®M#©rÚc\›jqb'–mBYùÜÆ]謓ñŽ¶¶T$aí ¡çÒw=¡í ê¹ 647Ñ“Ö:Z5˘D'êúºö†‘•Ä^¡ÀÕ¿@郟”ðÇBâ `H¢ î˜óô”:à/]Z6LÆÖÑøm6Dˆø-î:ˆ[›× =BÛÔŠ=Ò„”Ö@ÞÍO:W¶ž·#IZ>¿ÀHÜK!qq>oiFq êQ[,DbNšëPP@b w]¢ä磨”NmÁ·àJ'ëŒhÚ¹Q†ùýñóP¸Ñ>6\&ÊJÈ…$7‡ÎÿÐXCrèQ' ‹ÑÀ$_Œ ± Œzä •Æ\ªËI5ê¯Xð\ùf‡ÒW¸ÿB ÚaOÉðOÜ#q|?(M"±Ë(؇“|Ýy…hfì2›ˆOlàë È+ ù"È»( óP[Kú_„Fyb}1i|ÖZ:÷K5ÉJ×À SaÔ!¿•µ$ŸÌöUP>Ö'Œ†5Ú8Û}Æ!‚Fâ3ZîOå_•0tÒ$ôfï¢Ç¸lF’m^y(ìÿË3Ä=Þ8˜„Íì†ß¶ ºNà †¢Y+{B[öÏК’qÎà.Ž- ³¨ÝV&HƒÁÓñ!55¨©†ós‚S ‰­3?«'~A‚ϪlIRÎ*} Ý×d±Y]Ç×CðÓï8xJ?CHÌkD6íQ°è …s‚Ä…›È75Î-&kþÈC°ª‰ëx×®è÷#iùY˜rñ€v®³ 2Q^ššKrXQÅÝ?tÄ ß1¨/FÍC ½ì]„o;C*uãî«hª#‰åç¬$Ÿ‰9³„<ôÂKro”;Æ ÀWе™{´ Af2~ïŽ×è(‰ºñ$^JÒN˜M Çus°ùxG×?@ÓPsZ_ýÚ¯§¢6ì~ããì]’úrÜ Ú¥¶¶¨CΓ©ïLdêì+´Ðpj±bö¨¢® Éôv´ÿ;b¢Š ¿KrãºG2MÄm¶¢ÃÏp“Û‚p_VO§C„ă´'R&—|9Åþ1ø¾ l—·W”/KûÔ[ÞJøÌsQ„‰ò2@ÿnÜŸä£Ös«Â†BâÎqèÑÊÛqð ù[µºã^ûHÜ0 iµ=b x (ÆÚcXº»T>Ge8­HÌ¥È2tÛ%ðê°}–,Ãù½„ÌÒÆÐ×æ$PQÍ”8šÎ§ö! cVC<´¿ï$BkxµÐºŒ[·ðÈŒ8œ—DbxO|7ˆ~M9§‡'wðuG\z†æz\9€ÍÛñáŽ)cæ’÷¬s/èÑ!Z•ùØ:=ÆàU4ò0q0”º!Ÿ‡ŠL,þ“!³I<Ó¡$Þ’@b $vÁÕȈŊñPúyuˆq"û˜íâî`BÞˆ'ùt_ò”ÃÚðrÀŒ¶éÕ$#4Õøâm4”ÔÑq I?K ¶v[®FRMΞŠs–`ˆ¦ú@WpyúŽD -;»]·Ýaç+6ôJj¨¹8°‘ü,eŸ|}tì7/¨þ­rq%¾êŠ'¥Ä¹ÔËý¾ÅðY$.Å{,:† Ž‰»Æ¡k,\‚uë°n-fLBçï?‡Äõ¿aûC\S&ë*0‹|³ÀÀ„„*ìP‘OåJCRH|Nç¡Õ"_[8° ½»Ðá}È÷_(¤[^!Ž¦ëwâºùbÂÃ#ZBŒ\ÞG¾%ä—@'·ƒcÔ0yþ6-ñSWü© M5œ:…%ópÖ'w¡÷dD‰Ò;×5\|‡”ѱýQ›h¢¹ßIè×+4 pmÛI<åA!XôW¢†m@B…iÞã´èëxÅ4Er"ù ÝNû,K¼1Ž‰êÏi$š‰‘x¢7~øöªÇ…e2™V¼§?E±…T°RCÇ_pχþz—‰ªH¶Ã¤°óBû[‘ØíÝè3 ÉtžLw |Û²¯#-TŠ&€Ï„«.:ö ßyT”‡&jÑH4+¦‘h@46:wÁª…æZ¬3"/´:EÈþí tW÷ÿ½”¶3¥mL1ÖT"æÈ@sKÌÔ¬¨!´jn«¯·Tkh•–R5ÅXc•Æ<Ô˜„C$‘9‘I$¹Ÿÿ³Ï}’›ÜÜD×ïÿÿÿÖ˺gYVîsÏ}žóœsö9ûìýÝß}é&ÑÑDG±ó—çh§½ìp^@´âò}oupØOhZMÌ’Ä’æ-JO%.V§(Ì)‰•óHâ0g*7”„E^eˆÊè±a‘ˆö’5\õåüÎøH¤d– …uŸ‹5飯ô Ú ëÜnêVdü—ìþ…ʯÓdWþ–ÄjW¯rã3S¬ÔÌL áð1üo1ö}¡܇Å…q]´P_ìŠÓaœäëÑŠ§ ÞM²¶W6¦V_®G›zúÆ.ùÖóc½ çwPE“…aÒ<±Ø¼ÃïŠ@uŽ"¸ò˜+Ûåc¾†mËeÙÉ–DÛºœ›É´î’Åæ†6vJLœ•$n™E±â¬S;Ô%×®SرB¸…³RZ™`CÅæ\WgÏe³(\ž`µ ÌkÍ;R5câtÒ­„û©Ð¹µúG#繯ê䥔¨)øá‚OýÖRð9qÛp‘©ÑÈGmOÔ$q™"öO~ÌðŽü«,ë’Ê€zÔhÇÝ,Ëá;Åb£ï‰ê>íl)ó&Æ,‚1×éSƒN^-åTSÎ5í<ÅÈàÒ’Á³l§¯°fß~Ëòe,_o8—~ãw6ý•ãœèˈ:¼ÙAâ|uít†t c""é^"¥Ùx€#”ҾʙcŒí…‹—2Xf™¤]ÃÙ^Ns#F˦9gÝÛIòŽÙkÅ,ÜPÓ÷ÞÁû,ǽquÞŽ•"¹ý?áä!º;RÅ^x•'ô¥µ;!éÛPô·#!¤Æ0^“¾²üg#û7P¹$%ZIbÍ°Û´«IÛ -š;±| NMÕ¿’ÄI)[Ï$‰µZá¯û;z#GÂ8°’òEéô?.ºlmcuÍšù4ôà^Œ Z9Á±t.Jé|ã-¹Eö®•Ü}Góåg²rÖr—]ÛGמ*´?‡³q…b>ŸÀ™‹ÂAti‹ŠFÎÒ/¨TDÎïÑV1ü¿sa<;¤–M•@p»²l,\¢“ñ†úJâ¶Òo±êÜjP¤¶8Œ>îÝUÍu¦=±²2 ½UÏIξ:ãd‹Ü„´{”/™;ò¨0s¼Y?Dt¿Y³LèšZxžî(T‡À8î*ûžóp2bpnDýÜ!é–\´±ã~ÛþCµ²òQÛ&vœÍÅ,ª‰åƒÌjz¢CW~ýp•säæy:Ö“•¡xqú|,Ÿ&°â ±ÔTô2öì9!ÒžíiÐBÌD•Œ«¤¶×k êÂ+*bë>œ¸%O¼í‡Ý+|´„§˜üþ™\=Lw½ëH KBª°R¨]yƒN}©ú:¥ìøÕGH½Òž°@emØ’¾*Òv…ã}_«\†£ÁÂÑŒWªq9P^ÐS…Ÿ´‹³•>S±%”©G[IFyÐq$±2nI¦˜"¯˜z¾íHn…³m™H xoü‰ÀnWIÖía­‹$>Îî:M[X|\lJ{¿“„AÒ™½¹ñ|Ÿ”µ°/»Í±o·ävºDÆD+–ìLßò$–˜X¹ò$žØ¼:C‘?GÇûS6Ÿv|¬˜U3 zdí‡ñÉâx–L´¦s*¨LB¼°Qi',m-7ûŸ&SjûhZ•ÅM»¶vŸÄ8bãå·šîªÕLL”m–;ÀÂ\Í=cÉCDü§®Á`Nß«+òí,,§XÙ†5ÆK‹Rv‹Lãù­0/ÍnhÈ´ìŠÍ9Iþß¾¾ÅÄüc¾VƒÅ¶å³“Gˆò#œ7Ë…j¦À› ~© ¹¡ÝäYð-¤ŠøÿÜáÏ™ÏË¡`¹‘ùÀìóÿÃGÜf|^6aÌñÊÁwñõåþCS¿C8FTrî­°@õÃ\ ´X?{Øàma[4Kp`¶6’Pt‡‡y’>¸çO@IOMw{„ ɺ€˜ qD·ïèùÇs‘ð½0áøùœ«mÁw¸û@ʲ.¦DãïGà}5ÝlÝ~šL`aÑæ+ö ã# ¸É›‚FÓŒ÷ض›G‘yvÒü –õ<X¯§I\>ËE?=²&"_Ƀ–]!-‰À[…™‹‰q‘ÑŽð·nü(·0æxÊíæ“ðß„FåX©žñàŽDy‡G™TfÖ8Ü6¬…</‹v*èÄpV.•Ð‰wìppeÉZRÔÐÌ«Gݶœ ± ¦æ›’Ã`90WIbÊXº³¬`11~òÃÔs |Jœä(lV÷‘\ÊjªÏï¸:ˆsÂ<Fš¯¨'¼éå„}#!ë¾™ëÌ«þetÁ®&ýÇq;ZE‡%±e›2já1Y²†iC°¯Móö,ùEHBr&¶‹ ãó)4¨ƒK_öœÍÊb0‰ÀÙ#ŒìIýºØ×£×N]• ûÖS©ÇN[8#“'y–E1Ì8Iþ»ž1KÂðy}#Éo§·+MK>tcˆ ¾˜J#{ÚvÇÛÇ$;zÈÉ=掣¾=ŽÎì;KjîswF<«—P¿&MZ³b³.G7/2Â&ÌX¯7#6œÿ¡­£dí<”³WsÕ <îM·ÖØ7dê"B¢,§7z9´ScßzºP²m»°b½\xý5:LWà¤ÒØÔæ\DŽ_ýƒ°ÄçF¸“AÄcpæjOÀöóËtŽ .ƒOÝ…sµA%*µä¸òÅ?ØK7iäÆg3¨hȯuöQã&øSÍ–º-˜ë%¹tg~-ÌÙs5ìýÞ£Ž#“‰ ÃñiÍÚ~”²¥LÚwÕÝßZé\›²•™³Œ‘®ØVaõ^•«QÝäY?ΤL9>š‚sKÊÕ“X“ldräWT£Ê{Ìø”Ù³p¬!Ž†]âý£xð°Á(h}+¸Ïó¦š2ýͳ´¬Â¿7qò ð×µS Ûî K’À¨]O¾ NÊÛq6-ÇÓc™3@ ŸÍcX7ª7`ÿ¥\ëäº)”´áƒéÕ‚Ùv«›©S‘ŽMä½¾ÔÛ°e%J2΋•ËhX”ƹizç¤?y§¶ Xè…}-&|I|ês”®ZÏ~-Sß‘e$fÓ—‰8L-G¹ºÌþ’¶MhéÆÅ˼™6nLXç}Y» >K‹¦4jÂû#8¤dáü&ÜDZi½ºàäÄœ¥Ÿ¡^ ¡Š:pMöıí•KÇñp`‹òæ_X+9‘9á ?Ž¡ë æ-ÂÕ‘®c„e±‹ƒ$ež4MŠ¹DǪL^-¡Í?Ìeß>n*î3… ™£<˜Þ÷IŽ`z*7æÌ-Óøî^(†â¯’NßV’ûn¸òG(—Ÿ÷Ï”.ÃF…º¼{Cr©k÷}ʦ½ôsxH–$R¬ZñýIRŠL¯gôÐz5ü]êÒ|0¡©ÂXU¸ÛÏ›:<ò>ýÛQÚNÞ:9Eˆü}T’_ŸºÂÎïv~åîhÝÑÓ{JR( ‡2ÃúÓDÅ=…¥m+6 yK¾ß¥'÷ùº+ýGI"€&u¾ˆËèïA{í&Ÿ(0ƒ½›eY¨mK+gÍé#T-Ζ\»Â®Sì|_šÚGQr=ÂÍnžD¥rnŽ¼lÏ¥¦W¸qûR8Ì•W6¢à|›KFjØP£¡ü‘žÀ¥ ò襛8«ýª)¿Ñõ®¤lIT ¤ú»K5Mb2SY¿âeùý/Ó{Ïò x|BÉLdæ »Ÿ¿­/AéÚéf¼Òšã®iéÿ¢HOýWqá r7I¢V=æÍËHå¢6LYL\²ÉjqÛ»7½H&çÉØeÒÓ ò÷¡n%Í"*%‡õ^}µm•„W/9,•›OúT°4#›Q¦ŽœdO_,Ò·Xæöo£LQú¬tâär^=ìÇ­ Ô*Gçéâ=N€ñï¯eÃ2ŠVå‡cj¥j!wÖ¶—Ÿ=©Ò“+O-Hâƒ8TcèD´o)öŠme—›„fvéqéÿ‡wDˆÏ%‹5„ôß)RX‚YZté¹|-ô&UéÏf’H*óS¢… SñmößÎ¥~7o$•CÒ䑼ٜ“÷^FIÌzåÝE[µ×tåñC"btI,S—“šÆàÕj͸¥Kb—ÉJ =È›¥»LϹæó³BláÂz‘¯Õ¿¨™ß›¢o°/R€¬=;ÒÉ“¤ ’¸Ã$‰fåĦ¼aO §wÉd¿GÝÿŒ<ú«ïÙò9-Ü8GÏ£é™FI<¡öÄjO¼¯½Ž¶'NǦGrè<_áÕ²¸Kæ¦ô¥a®ÜËâÉIdÍ4^­È.Eþ¾Bt_7Ú9³÷DãA&…â…¨ÚÐ$}/ÄG‹Åk¼Ï]êUdà\¡‹üó7ÙæèÞ€+¼û¶5ƒ³\ÿÏRy*9â·¯Y8z\Iº¿<}‚™á mL“.ÜVfí5yyƒõJ¦NíäíT-›¯&‰eêqþ±ì¹v•¯°vçH(e÷³þ+¹[…Jbj Ý­‡ãð|ƒ>3Å `œÛ>Jû(ŒwÈ%ÚÔÊÚϨ=±»éöo¡Ô+Ì>,ýzKtÚq t ¯šÂ[¿¥ü~ž–ñEœ²r¬Î¥Î'w³ÛDGŠØâ}Ñô§Æzÿ§i{âPj¶ärÐË,‰¾ë¥'k6#(Z4½È`<]é:NHÓNµÁ="`ãÚÁ¼9Ñ:xg/µI•)×v4Á±;±-ÄŒU<5°HÁû?ߥï‰oÔ“sß)£$îʒı`óÇãÞOe‘S°´øP¦6I<¦Îƒ_OTùˆ{(ã[ÍA¢ C¸ä/{ÇÑod›˜¿“Ø`I¦cŒ8ö¿Æ…+r·-«(QRhU»¶WÚQ™iD>T’ØE¼<ÚM2wËWï:Ëã´=¨á›xzqÿÏq?‚è`ú4£a_îƳþ ©¹÷’©ÃcCáŠM~Ü/Áñ±œØNÛ–¬ßÏîµ yè˜Ìµhû0q¦.‰M»r[’~ÿ·tÂ<Å»¾ë'á`ï¯öÄ)å°UÈðœ’xá3©Ük9Û–RâMö¨lQÄÿP“OUâ¹ µ¦öD¥É„‡àÞš.ðè GUÚ”Áë´Í‰kçxœ@ÐIš”£ñtÁæ]?ªb4VËYàìÂcÅ$U¥˜ä¸Ôpí0õ*3xŠ@%Ó Ü\%•û©=13„©.«*$ÒéÏ8õs¾ßLd7¤ÂjO…X>/ã;ÀMÖÞá`B/“ítÖ ÊÛÒÈIiß’Reè9]x0Æ¿ÊkÕ9®¸"ù¨£`¡¢¸¯V×v•rÉ¢QØVdÂL|ŒÝë8 ,†?¿-k¹š-“\e£ÜñHtHwGÚô%ñµ*é<6·ÏàP^’O›Fç6rçY›µˆOíyíþ ௭rÒ¾]$ÑW¦-dhW ZP\â«ç1mMKS¸œ˜Œöúðð,-ê Ðe¸'mñZOT“:`çFh ia4¨Ì›õâIå7Y°Fü›¨¥, AÓ³ µ[2¤JÑt€tÑÖ¹|4‰ºÕ©Xñ£Xí#ÒÑâmÊ–Ãk¾Ë•eÕAŽxQ÷-Æÿ ÷Ùº„²e„m©y=Þ|Ðè\.‰;q°§J]úf°§h5š²óO~[)/xà¨ÔŠRá#'KèJ¿ºÔv"@퉨QYl¿‹IÊJvœUTcŠÊQât¾ç©ò#¿ùŒ"×¥<:M³jrŠÿ|.Íߥû4‚U‚°¥J˽|š%Ëñ¬+WÞqaÙ·ø\âÇ…Ô®ÉѼU‚êÈÀÿOšUçó *cÑxQˇĽõ9é+4évo±i§Z GR¾,=‡âÞ\:í磜ßËë¬øsÚòÝJ®Þ`ý—Ø–CÓóp¬F'ždº'½†¤Iô=¿…M F ¤F-f~+Vî—톭yo ¯­ZáÒK2r“t¯èFŸa\},¢ñý,aAѪð­8¹á•1š%œ`¸´aâ"UºŠ¿·ááÂn;°êºõâD4)1Ìý¯ÏIy$Ü ®=”g-‘]ëèÔša3eöìÂGĸºa#¹ÌUúvaéI‘Ä ?œ]øágæÌbÉ*á{‘è&ñËÚõÎn´lÁܯILÇ×GLíœøl¹d‰J¹!VwÇÁºŸýÊa†÷¦­ Wë6™~½%Êè¦ñ=ËØ8¶aÌ,|#%Íë¼N´rÂÕW7Ú4cä:’ rh2 \»³xÖCœYDçŽz,I\+æÒ¾5Ærìj5q¶?1Ežâõ!Û‹ysðDÎúË@ß‹s'.^‘Êñ÷iÓžo×Å—£ùðåPS²|Сý†²ë„¨µZùV –_4A·ðìË7[e-½±gwfî §gxÚ;2b>þâíÜ“¿TfçCÞxt¥£3]ºàì„{_¶n„ïæáÔšC9vE™NÒ­ ßm‘;Ç…ñ/Úµ£g|üX~f“̽ÅŒ–ů+èØ·ü¸KÎËû—ÒÕNNêèÖ‡}eKýù+\:ãîJï¡œ¾IT$sÆ1ÆKRõÉHÅÓ¶X´’ˆsÈßËæÙÏz¯¨ÇB‹iòk½ö˜TŸEx„ LÒŸóRTxsZŠP9=#ãdN}¢H’ÁQÄ1&3CEfºò'†eðŸJ\’D[±ê½ReR•?QY!!êCÕuÏRäŒFc0‹¦µÆ'ê=Ÿ’(õ#cu'iªšƸ 5®„?”9“ž©¯ØB¥¡=H«i„?¥«^ÒÞÔ8£´——AÔ^Ö¨°i㨠q¤,â_Üi>¯fNgmÉÍlBiȇdžü1ŸŒºù\4üjë‚Û`ñcæóà‘ù¢góÓȽ-3ôÌáî†aQõŒáùMÊ/$ߎʛOá¹/h(p@->úy#õ¿Êýß—D,ÅJ`5ŽÅà `éÌÑc6,Üœ¼ÏÅb  4Xô-‘ÿ,Õ4ƒØYè:K?ÉKÄm‘äÜ"úÚbÊC>0BC¹ –c(ò>3_yÞà/KÍ0äAßY¤dÏ/Û‚…;K˜Éçæ xù´S3˜½>*gìä¤ÏUسkæüUÞ ¹n°€ó7zÛ³'CfîYšié>9ßHo¡5jÕZ^í ¾ Â÷:ׯ óíÓgr%èËT"?|Éèñ‚sË%‰–&¼ß>&È1•i71š ß³v«ÄPÜð“ ùç¯p&*6ÿ‘ ðP”¹Ù1J<åú5ž$g Zö‘Nð=isDÖ!Hû*6’›~øÝ”›dZÓ4XË µ'’ÂÚe´°ÓYJÞjÀš=J2-èð;«4¦­ÅêøÜ£Ó…xt`·òÕÞ¿ŠK †Ž¤_m…KyUüKØ2V‡þµÇÚŠ5±“’¦ß!Âw´Ø{N7?² ¶Ç·RG±ÖÌØ¥?=èš$þ.ªn2~1éæg¬ÅZþ›·Å _dêVoÁá?Øùî-hÒ@~‹~ @ⓧ¸$†èÄxœkHåé‡Å¢eH€¥öíß—õÄÁÚÖzƒ«Þá^1 ¼©øä \=F+;áUëÿ.û³÷NžÄç¤ä#ŽºCö8¸±nC-Ò0å“ÊLäëبdG.å7ÈäÄ&Ú¹ÒÁ^¾Z¬ÐÚÉ1L@ÙJ|þ-s†ŠÇÍ'̪ZË‹$‰×æË|nÖM¼)É‚¹ð·d[ˆ¤ó{4t :tfßyþÜ#¡’_~K¿ãК5¡g/a!þ`.OÒI‹c…:ãÔ•…ËñþŠ– øE¡¯ÿð¦J9~X…›=góÇ)NŸÒ}FIQøüI€‚þÐM±ß+—ܙݸ¹â¬nç”Ä4/sùÛ' Ü—Êk©­]ZÐÅ“g„ò°‘ ÖÝÐZ^íá2è¡Àötíô9\’oÃ/òé|6î´C=Þ/þ¸^ï*rÅ3â>>´ƒ¯×Êø^rñL8Ïb˜[[5ý>€Ù¶é‚£û÷^qoÿ‚r­øi‡€4^±¡RUÞ°¥c_ÞÐsÞ‡!=%yý‡Ÿ—)Áݺ0d&?ýÄk…9pÁdÉÉ]“D5Jâ­Ó´}‹òoãøUªãò„„䄵kùïÚ³:6‚_`ál<œ(^˜·;)`Õ#&ÃÍ ‡–ؼJA#é(B÷‹rûú쥇€[jT•‹;oIʉ… )^•íI…ßgËžµì€ÄÎqÄaÐøÀEÖ=ÑZ^$aL½DÍr£É…‘tÝy˜ðŽ.*©‘*7¦SG*VÆÖ–]¤$q}¼Øs<šR¶"u[JµÒűoÁÕx–¼›K_+Ä7¹wšb¯ñËa2"™íIññZQE›ÿ.ÛÅÎ3m°î}Ðþ•¯ÌºS#ÿMh^PöœÑÚíØw™Ó[…†¨ê"¤åªó^;–ŸæâN‰5ÞäõJÜ|jõbXË #†ÙNÃÕóñèF~ü´Ï„Ã\5žpÌŸø ú÷`û)–΢g7Ž)ìnà{°X%øûÏ'¸u#0•]Óc—ïËÅ‹›ù 3û®p÷}ñ·1QQ¿,£·Ã'ô,ëI©lZ.§Î£¹—¢`ušcÒ°ËŠçç!xNæú}.î¡Ÿ]ºÓ»·|ÛýÖ( ˆû—ùh4£fè±$™Ö4 Öò‚ÉáœYàÎ|Þ ÏÈ°ô«Ló*?Ú±l[^u:ß'æ¬çDky¡vÆüPúŠq~\Äùfy #¨YCþ|þ¹.æI0A g« ZË ²)æúû9\Ü9ÅÐì<ÁóX© ÏK>bùbž{ùÂj±±k±k±k±k±k±k±k±k±k±k±k±k±k±k±k±k±k±k±k±kù•ÿôâýY endstream endobj 1013 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 238 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 30786 /Filter /FlateDecode >> stream xÚì½wxÇ–èùþÚý÷›}»ïÍ̾÷fgîõµD‰±‘’ H‚9çœsŽbΙȤ²¨@Q9¢Ä@ Ê–eÙr¶œ$Y‘DoU7‚eûÚºž««îï|üšîêTõëS§Î9…¢ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,ÄB,Äò“‰xÄB,Äò-q…-q…Í„B!‰Îoºvýæ§ É-vïm”B!Ä"§ ’Îö7N›N¡Êy”B!Ä"‡î ’®‚6„BAB!„  AB!䯤M»Éj!hC!„ü-dÏ ”ÇfX-™™™Ïž=#hC!„¼YÙ{uð*¬–¢¢¢Ç´!„BÚB!mÚB!m!„‚6„BA‚6„BAB!„  AB!„  !„BІ¿QèL*ª^X#ªÒÃدð/ØwÃ[7­k²l%,Gm(\©‡eÂb ÖÇ®Og½³å2 øFâ´!hó#±!¾v;Èö;Éö;èµçe:ØöAKïêiÙùÞÿÈîÿÀA=¹HÿË¿Ÿy†ƒ ¢ûÈïsgÐŒŒXçìýFÔÌ£²±/Sòrè6ö;·;ùç–~²ÆTrlÀæÏÿ+Jö……BŵÅö¶6àJHövŽÞ±©ò9üJˆwDІ Í?†$Ä„ù¶Î÷]C{®¢}†¼ÜÙ¾ÕW€Ê¡4¢aA‚¨ødNò~5F‰š–Z²[©Ü  ^xáé´3¥çcÕ<š•—î^xÔš6&ª‰Û\¿¼CÊ%´÷ÚØ{€M³‰’ÝQáûд4ÿØ FPµfÁ|TiS¥0I¾ç:Ú{ •Üðqâx•©Œf@BІ ÍÛO›pï† 5Î ÚÖYiçØ Z@µSúNwÉÂלÔ†)ð“Iµ„†ú áí‹@E))KgE(5‹ð¨Wi`’š"Êܯ5®+3ûØQú ¬4³w™6¼Ö…'N;íËÇàyqÚ8'ti ø•˜4 O<¿D*lì‚BІ Í[Oh$Ñ£Õ9”¥z-ÌOŸŠGL¬gTׂ 3­¨GÆi;y  ;¤vÜÜÍy•6ê%Ôó§Ô½?*­ /šÅïmÿ”}®Wµ5ò㺵 hNq„oÑ9õü+´™‡SXçž Vë‰×DІ Í?mÄE‡Nܪ¼YÚ­`PH¹‡¿Ò,™Äœí%§_5F~HëÀ/V,˜mÅ…åy²]t÷’jMåx•6šÅ'îÔ?åœ\µ>‘zñ¥ãOi‡ž¨Ñ çm)û‚fœ3—˜±ò¥­h3–5— c;5mÚ´ù¡M×7!$¥48¹4¢@Þ: 7JöJÈ$Š@$¸¸;ŠÜè¤m'ž*¡&:AKômì&ݺ9åUÚ¨Ñ`ÑöxùýõNΤÕƱ±)Aeƒ§I¾Èîâ†v$ì}¸m hV¦‹wÖ)Ñ“"hCÐæÏn³ÖÌÃÃ\£d×û0ƒmïu´  Ý%o@q@3m¤oc5ήￅÝf-®,bT(ë£Û5íQ¡ú*šžä[ra÷Zá5Mü¨­q6æq¨Ñ%ÄÆ!ï"ñŽÚ´ù¥Î¤™»ÎÚáP;a6ÞBµdt”jãÔ2m;[ÒF”¡i;¿ùOš‡¾ÃúMÏ=X,÷ÔòþÍç>Î-Ë#SØÅgV4ºûÜ;‹/¯®™¼N³a×ÍÚT9FÕµ_ü¬åü'•ª½ô;ŠÏhô„bCІ Í?ˆdää‡uéUVšIuC0í˜ÚhµÛ뛵çSˆ‘™ë.Ž¡€<–_ ªë\¼‚\¼ÍÌp k­Óò sñ‹(?"‡£Qh“f¯SL7>˜e#š‘Óv³R"‚r<…ž!!¹ÝµŸ©0Bâ´!hC!„´!„BÚB!mÚB!m!„‚6m!„‚6„BAB!„  AB!„  !„BІ  !„BІB!hC!„´!hC!„´!„BÚB!„´±ˆe64bZ4B!h³.s+²™ç²éç²™"ÌóÆÂ-E>gRÌ>ßbûÆ ^+‹]®Hm°F8Å «}Lò¼´[•¶Å©eÓàÚV7ì6»bÍ4°®c×òšdØ©‰ºJA›?Ž6X{l;t„B¡1Ù|¾³3“ÅD¸í&Õüc¡[ä+›ÅÙÝ;Jócu]²3üׇЙ/l{@é˜uÉ+‘Žö\·ZëLþÝg˜ü`«Là«QÎd_í£æŽ¼p6að=±u¿ü¡g"wì¤îb„ÁpÆÏî]¨¸2örõ wó wäs-Xö‰›EixƤ d0¯ïj\°€ ±‡xå~Áž¦Ä¡Gíÿ’¨«„´ù#uÉ™)™Wreí»¯Gw5¤ó¼s4ÐÆy§}æÐkŽÕ¯Æ wø+Üâ§ÙÇ,Ù¥è¦õÄj[ÓFóÈ¢ê¤xRÅí_lVEf>´‘Yºf£CÝWf°©igtJ÷¬ bä” 9 °SÃOÚûMˆ3o Ụ́剢øž/ÂÝ…m!hó‡ÒFä‹\cöª6j;¸¶°5m,Ý“×ÓF>~ŸJEÏl˜]úÓ»†L­eö§rC¹IÇ-¥¡Á[ÓÆ|`¸»3ABÚü‘´QÑá_;¾Â•Њs«fÁh{R.~Î8yFwY·é:{šÆà76l´Üà œ-‚ ÈïÓmL² G:C6U2.‹Ö9³jѦ^C”  !mþ³h hÓö%®±Ô*kAÓ qi[øíºMc[$ƒçª2n¦ÍFÝÆôÛt²¾€õ‚óOáÌÝBèIÖ–j‚6„´ù{ëI—û¸„ËÔÖšùŠaÏ-m~Ñn£7¥yÚqœÓÕó?O›7Ñ“ZëµµÅk?°>  !mþ®hºK²¡’’1øÂ2”,¹ #Qœ;mtOH$~üˆrãÔÒ3Ú@ à±*Æ^¼Ž6 Ýúý´!„ ÍÒ˜l¶'G¨*ƒÉ¸ˆ`7ŠéXpâ±Òb·z9¹YÄÓ#¡Gõ3´Ñ¡ŠÉ¯(ZðÞgJúÑÆð‚‰0¤s&üŒ¡Á"ŸP“Év ù§ü¨6|Á¢;tL­].<<þÊb²]ýÁ¯)‡¿!j,!mþ˜ð5‹ëª|n“UóÜovem»EV-|PÌ­¼ªf€-r¸UlÞOa º‡Ãå¯/m㿦M¦$ë3nº`ÜÏr”b‹_‰JKA"NŠB!hóŸ$@1 JÃ+ëóèúº[Ñc;X¯ÿý¨·Ú#„‚6·ò±ò=wå¾eØxÁ éÊ$ \ù³»r楒×·y*¨ÒÖ®»æ(—Påûžp]5£¼Š*ÿìåÒwÊœ^¸ñO"åØc¥[\åƒiápÝ-Wy…Eu­N9ùLù'W(ƒ+ öÀþÝE9ô­2¨ +ÄîÌŒ…ëNiÊ[¨r»\oRξ„{‚ö,*Ë+ÿ…OA¼JBÚüËìŠrê¹Y7+ø:¾_ŸyW¦ŸÃ¦±AæŸ)q»“eç9ë_Zøî¼õ϶:ðÙN¿r Xz ü¿¨ÊeâUòÎѦ¾OéR®YSòUúÁ|RÌáÕ¿ÂÈlüûÊå{â7\¦uqj.=ùã:ƒO‰fBÈ;H›º)Ï¿h6†ÌmQý¿–6JýjœˆZ¯ÿ£oËåˆÞ8mœÔêá?Š6àYº©Ô-…‚6fÚÀAçÙ‡áÑ,ŽÀ=¶¡Û`+ï:1ì&vçðÝÂk/ªhn `qxq'L±îˆ_××V…¯„:±3/Bç:ùÔ7L®K6H-¿Åæ xÂxÜo§2ËïÑŠyþ˜Òüù‘{f¹Ž‘ø˜xu®×­ŽÏ£AN‡~RŽý¤ì¼ þ­ëlæðž»eG[Ùþû˜ Ÿää««ÍE6LXô®”œ,ïìŸÕ4¹ ‹Ò¡M —ÏwOR(N*žJ…ÑBhË-¬®ã N¹íÓ«ÊMNËF4»¬„Ëå{¦ª¤kåç”—qyµ¢:¿‡îàÜ6öD:~›/`QâS·5ᥭt?V/=P߯»¼Š|G{G(®jN)¨IRLWLˆ õnœ·¯^F]‘?W¬=œ±ŸˆfBÈ;Û“Ò®÷¤^b=)SË¡lÏ|»JÿÜ—f}®wœsæ[à™%[@-´ÙÊ ~}Ä  Æ—Ît®\ÿŒÉpTÏ?EÀºj8üìÅî½üLcGO®—äÛŽÞ\~¦FRôpÓç¥g÷qSçºöyt|Ù½§›:›jÛ°òßEAYÜc¡VE§Ó©&T²½W× Kæ­áÓŽ Xd¹A­ñC¦-©eÚ\~F|„°fR{ZaÏ«V`ñï‰ÑaaÝFP‚ú*êÆøså°Éì¥ã[NJ´B» N›ŽÁ!ºK˜6  ÛŽ¼ÜY@1›Øõ!¸͸ŽI±i›\‘ì« !1€ÚŇ>²Án£G„|ÏòIÌ~õRä̪¼ø“Êð$¹¤³‹è pº•Œj—Ðuƒ=-UjDC¼\¼*'´‹hÏìm.ù½Ê ÏÕ'‰6SO•ÿ‡ABÞEÚhÚYžÙV=©ç¾äÿ~Ž€ËÇ> ô£ÓèîÑ5]Ó+Ð:¡[-onb3ètÓ+£GŠé U ù${‡PÕƒÖ¿‹›7¤qÀF >¶·µÏÁÌ8—çIö¤ªYsÈg~˜=ŽuUVcmh¼ ‹FTE¡ƒpï”x¡-…U‚‘}jCƒN¹ó«ÙYqT Ù=QÖ®I¥ùÃí!íÇNˆ\Ï-¼efÖÒ™³Obâ4Š³orãn-1åePɢ趎=Edñn@˦jè ú"5'‡E§Ò9Ga‡K³ø-sçÿj¸üóè{—I%Ù:UpÁ1&¸“NxDWƒáðê]6HN›ø0¿àN=NÒ¿T ¯pá~€„ò.ÑÆÜMÐ[Ï…®¹‚˜ÿùµ‰`ÖöWš•Óú–µ¿ŠW2Z`ÛͦZóº%çŒ/Ä\¦B‡nþiýtغbZñÿ9˯|TØ÷1~ºò¡ üƆsmyÁkw§û¤°çC|Ku®?'ofýÊu[Þàú}m,ͤØâ  K”Õ¤ZxzyóÃÑ­*·{‘ „‘ ï2‡ -~Oa0ÜcÊýbÃ)­ oÝWQ(xc+×°õ%«ulÕµ§PÕ‰.ò¦RlFŸ›ĉq °²huà²ùØõ³,Y­^àÒVGØm!hóvÈÿËWü3Gù?í—¾ëªå)}Š ( uüg¶râ‰òðm¸òßYÊñŸ`<&Xÿ¯t<õ¾'XWü GnXQþ›³ò_¹r¿råuTvræseŸäìJ¯"¸ñŸ(°@$ ®ÿ? tùg7¸.ÎUÞF•ÿ ×÷.+Ý€¿‚ûo+£š”ÿÌRþŸ$Â)Î7_Ém,˜¬{@àü7¡ÛBÐæ-ýšàÝ“MëÖûXïüÛ4üÍ$2NòNҺàqÏUT»„nÊ'ü·xºž«¿³ ƒžå?¬ÃÓõ.ÃGžt„&j>!m~5ó¨äÜO  Øï ’mi[+Óþ¾g:T1óÐ%H¯aî©ÝŽ†ßU`—:…ê}èkõòþ;§vå2ê¯hð{¢ÚBÐæ—´T>|æ@M=ãz€†#Ÿ|,Úáš<ˆûÐj€Âs í1+WQÚÎÖÂ}æžÒè¬.ZWêËðUrÀƺºp¦k ŒïMGèb9fbm¨ bDÁŒ²‰‡’é•Wi£^ø–G·©„®zh[GÕ³[¡‡:[sGÝ[lïΡ¸·ã[ºsi ÅêäÄòn»N ô4WgFîà·4ÀÑ¥„ª“@÷X˜,ªŸ{Zh#v£–œ|XžÃ˹¨ÆFÀ½\)Ǿ“ìîtÉ ðD»;HŽ»äF¢uòNÓ&Vø^`ëW›æ~‚MõèÃ=JkÄâ¤ôODövé!mHd§ÎE¬¿0ý ™âÖ:Â#ãÆÞ¦Î~Ä äÂe:›ŸT!OØD* Ò³†Ñ0žCHÿ Àˆ[unc kp» N›P>Õ¯ï‰ÙÇoô ƒáa¦§Ûh’ôe ž½ ÝVv@ÿCBRxúG\I‹ øÑMØ5È“ÊwÑI@i‰÷ò¢êÍwUÐÜ$zÔÉ‘^rî!®™ÄùŠ}ewÌ]H¬—èWÑ­yø8Š<ø<67kx3mNü 1 ¶¢ª¥ÚtéÑìäV`A"ö’+ëé;y挄ò®ö¤ ò]DQZõüºã+ni9ÜÏǬŀ?;ìŒÄhCqîÆmÈÖ´‰9‹ÞÔ)ˆì>‘Á÷l:ùAý‰Û@NÞiŸZ áÂŽ¬*¬f®|•6lZÐþg8‘ãS ÏLßýøQ’Ý™ˆgÏëhƒÐl³ƒXîux ®æÙìêO|Ðpâ80ÊC(n˜´ÚøPZœiåÍóèÅù{xI?Šõ8ìÜæ°óOÙ_×U§Qœ‹Z.ÿ ™xR™ÆÉÜ‚6 ;æãÁ(<þCqN¼¸fìžå\Ðßh~ÔޖέƒwØJ Úïéq{2'ïäKÌä ½éq®‚ðÝò‹F¦·â*ÆŸ©¯¨öìÚù_K9èd1œdËfƒjMÿð·8!HžÄºl¦¸Àà´3¦®Ã­,a5d¦MY2—³6¥o—:á™iã³om€V¶Éœ uŸC@ñçÑ|Û`0xm=lG¨ÚðCë8œº·®ØŸ|‹P~l{@áäÄŒØû%žB,â¦ùöøŒX¸Mòö•Þ†–íÔßK¸¥nŽm¨Ét®˜ör±Ûuþø·¥µ€äѩ¬ÊjãOMC?Mƒw{¶Ö:•ÂÎÖAèæçìÄaz•K Ú³š™ìËõŒMªU¹ y¢Œc ‰ýJÚ€b‹Šâ˜Â è •€•Ÿ Ú¬|ü.ÅÖ^UH¡ùËõ¨tèÁ*h‘ëžá´QLζµ÷ÍèHÈ/g’v– ½TlI›y4#ÜË£þÃ-­Äª™Ï½rlE5ÿЙjïQœXÖâÌuˆR¤Ä¦v¡“\ËË[yò mwap¾",:œdëÞ9³a©K[Meº&Õ¨Ü]yEÙ$0ûèWŠÃMicÒ?á±ød^ ŒjÝOã _g¦s`VbE—«Í·rLEä"&ä÷·ÁÇs'¾k¼Y;p³ùÂ7*Ãz aÛÙj]o¾ð5¶Uν¨9vKn{ë7!4.ß­?û^šôÊÝú3ßAˆéÑö ŸÔ»VêùZÔ§bê»úku'?’êÌ]¶¦7jƒÎjíÀ 9~I³Oܬ¼Ó1±ŠÃP>öqí©fcÎøǵ'¿ÆÞS7†7d·Àvûï©už¹YlyÖ|úp-—Z$×7ÿˆë3NjíÈ㦓à Üêš6môoĞù»à9´>n¼Þtù'åä5ƒ_‚ŸO\ïšZÁ»¥'ÀU=\÷™Ô¿l9óaíÑkM¿µ}%„"rá­I¶ˆJ—~»È®¡gú®1Óï)ä7á~LA›·KvÏ=ü¿ÿõÑý—ß!ÿúÕÿþ¿ýðOÿüû ù«e¬@ª úV„´y{äšý/ÿeP3þvÉ}ÿÁ¿Ûȉ7HA›·FîSmÞº^ÉNßþÛ6)‘w‚w‰6 {{Bò÷«×=pL™‰‘Iû½©ò[U5>1ùjÃ(J¡Ã©6†¨[Ó&.6Ó;¬N®³˜DLêÙë¾)%C¿vLÙQ8í¬Òˆ†&&×<•ß-N9ñ3ýÕ…“ÞEW´†{~aÉÞáf j›·~‚qXKÏÓJk}bŠòú¿Ô`övkÚ€»xækëÛí-‘/â.I&õ²)::,÷Ð׸ۡô줧ZÓŒ¹LÍ2šQXÕ|YýúËSÏÞ÷öMm²òóiï?Ҽƫ¹~÷Áà’ý »ã^­xCT¬—•…Ö\Ãsn€+ ‹O ÉUJ-¡gçÂ’³¼£ò ­ZKð¨2¢™5ÞÙ™½¨Þhv‚ˆèô‹Ϭ|ÏúE$Jfáà…vÍ­íòLöŠÈIî‡Î¨“oDBלéï-üäí¢Mµ´Ü)¨ÞRÁTSŒóûÁò¿2¨¯3êž ét%é ªÔýî«û†Ê,ØäÚgM_.‡I¥4N¾´$#-Ïð`!ôì3¿žŠÑ[¥‡îÚ©•ËT9ˆä Ãk½• RÃb´ôŒ_¢QënÔ½ ¤~£kz õvÜÕ8T{lÙ݉‘ ®;ë´u[÷—$l˜€‘§Á¾üàæYð:â ˳9amJ,$$¿¼ˆë¶Cj§±ðùË×ݸ ¡wˆ8¿_ó3´™¹lCj¬hÓ¢ÝMó.Ò¾¦WÙÝäY¯±¾ß™Kö•†7SÙºÎë+±xùfM- ¬DB’¥F+ÚèÑôŒˆ€:8ÉôœúG¶+;÷\yn˜ì jš‚8WžUwD½ø-׆R;CãT陟Š«J,´Q-¬ÆÇF>ý•´i?2ä©R/ümÆ>GÕAÝfü#Ø&åôGA1)~©-àÝ+¯l.Œi¿‡þW·G·}ÜØ'ÉÛ§ÖCe¬íðþÀT™µ¦Ô ¯ «»®š{ìH¢•Oã*©éìç­åÙŽÎYWñVsw$7`¤ÓQ%KT†ß bò˶+0S}aVj„ì‹M>cš™¢2‹@%Ìï€ç+èÚÛPs»VÖã–¹kPýŠÂëh£9I'û*Öü%Ô†Kz§å˜>(ä¤ÿžÐmÞ8mä#·hˆ°ràvÉëQAˆwí*ýËH1Ó£ô\éó* XÞ¹°ZB?–8 ¼fàö+=Sfݳå3ÅÌ÷T§ ¹Rê^zðh c ƒWC<†~O,#$rÙ‘›õÇ\©v±û+t«‚jÏÑxø,Ê—éVûNVó¹Ï@³-ÝU§ùâUÚ”Œ|Ä 9Ëæ06^:JsW;ñqÝ&&ØÃ)¹·þäÝjMîØ9mê8w¯áä ʲ½Ø"ÝSBrïQ.n¦f|œ¼T|ðFÉ›bGFâÞO`. ã=%F ªq«ƒ÷þ†C—“k÷Wœ}¤6l!ÏLŽ×áOX»ø ÏnGíø:m4ËÏ\(ïWŽ¬åå}OMM˜æåBJÙó¹Ñ0!ÆÂWk´1çT/¬Ø@›Ô̼²ÓÏ~%m:'CŠ¨¿D›Ë‹v´ ÅUT5~“Dfz§hZ.~µ«« ¥h—ÐÂ'¢k8mJ Eîù˪¹GbdGPe§°©HÕø†6^Uííœ:-¿r—ÂõR-F¥ç‡—ôÈ—á]·1]savŽe4Ö‹æ'Ê—&²Ä_¶j|£ 3µbñ5¦Òò] Ú¯­?jÊÉk ©ôðúWš] fèîMe|³ö\kú4ÒâÙò±â×é6*ýXvT¶°–ád-¾lï.Š¨›ÐmÞ8mºOO’9>m:˜»F©[‘ÍšºÏÏRøþ»oc9[–VyvHµV*²s×ìæT{¦Ðh<,G–)'œá^ýøÐËÆ? ³@G‚ߎÉ;tŒ6Y4׺ÏA±0Þ¹>·œ‘0Ê&Ìß„´Ìšd'ä›êûÐàÙu6Ѧx䥿#³ë'û;¦xŒÓFeü‘M·oŸ6Ï¢ëíÌKx€w÷´Æ/xd›]Cð×ÑF1û¤kÒÔ³ŒJ§žVåFpó/ƒ³wHŠ‹GáJgŽÝ¶ÕG %‡¹t²_£ÎúƒžÒ1¿–/è… íO•—¬h34è@I®ë&Õ2À¡¸×¨—7(íV´1‹5m:s¬«âW÷¤T¯dòùyÚ8ØòúFoÙS½dW·  lægGÉü˜ü,ߺ«›,-8m$õ4C”Ð[3p#¿®‚æ‰GˆdeÆ’©B#¹$kz±Èߎ»8±¶Ö±#Pò%>QàÆd‰¦¬ º¨ö3sý9¿áä™^xùø“éR&"˜Ÿù¯¡ 4£»b¿ý=¶£§wteÛœYƒR>a’è]³m~+m$e›hí„÷¤V+»•,Ò_ØÎÞ™Jå2Úvì(Aæ!Ûl‹?ц"èÀ‹dd)8¥<$µ,²bVlU!“ãšP.‰/“Äf%3¹Þà£/¾Ìàà§SÌþD£³müTK¹ „J²ç*u«€6-sæÏ “4ÍXÑæµvvñ¥g’}UŒÀ~堋Ɣ̢8m4sK 2C2kžE7ÖÛÅSgÌT-¡Þ"jBï'æ®ßët›¹»b[”‘Ûä#âf¦èšwì,ªthS¸eX3z…fƒ´Ì¬_ar\¤68üué{G‡÷ªG×i#Ý/³snT-®SºIÙøìò÷fÇ«n[·ÖŸ§ÍÏØmj­hÓ¬í´Ñüz»mì)^¸Y[5~Ç,–lM˜A¨(Û…! íyѧth‰ÂtS`atªùç")ýZSÇ SC#íì“ܼ—¤P7ö¶¤Lã-]zöƒ¬Ú¢¯ºêǤm¨?vì-ƒy•3÷BSAý,ÉPà´9mE¤Mç̪Ù܈ªç_¶œ¾•S’J¡M|§PÕâK.ݶmr• Ío“ÆÝZ¦grï‚Ù®«Ò?ÚïL> ëèÔé¸x/9ÅÇ9j÷©Kˆ(t÷58¥ËÔÛ¤cv¸lò«’Þ±ÒÞ±òýw”ºçî4RŒ|²¤g“'2-ï2*»b@¸"¬ hó†@Ý&NHöÛ»‚«YÂBÝOÑ°6¼_¦Òð‚‰Ð:ö×±“FÀvœ6jý}Õ®{Æ„OùäâÚû9¸Ç”¸·‚ó–Ž×Ñ&#ÒGP0ž€LqZ8'sHsu¢“[0»Š¦þÃG+LÚÅûlÛ “ëWXWň?û,@š¥ìðèЯÓFÞ¯´s¬Ái³N_gÙÑ*/­(/M#ö¬ÚÑuõã7ÐFc|à¸ã½ì3ë wµVò£´†7Eg¢eÜD–ŸÌÆuùèmÓ9.”.ýbÓÀNåÄg$º‹Üœò…7Å>ñôj Ã.æ¤yB.ÉÐeß|›êª|øñcøœldŒÁõÙ*ÖÌçBñÝýrcýÙ"¼N9÷})V?Kú®Ã:ÀgyH¿±Œh¨'G2C:‡vž¿UvîéúHÇÊçÑˇ~Âòª=ãÐvvL™Úü&·ÐçýŒ½cgHãTïM˜Ö;=;ÎS- -öx&ïÙ}æÏl—ó¼›Õ3ß°lHYÏ@‡B=û¹È?tl­ic-’áY:G¤²2 ÔׇsýÔÊ™¨fÅ$TzwíŠÆí6í½Uˆc‚ë³×¶”xÍ(·¤Íi ˆÕb31µÕÕœÿikÚÌ£i×Ív*bÒcz¿€Ý@Ý=u[Ã苆¶R†o³ÓÀ¾Ž69Ñ>ŽEÓ0KüÄ5‘ ‹ur÷Ø Šk>XS[O性Ñ{ÍÉŽ#»7‚CÚŽL¸‡5ù¯¸ê®áÕ¾[hR¼¯kÁ9ÐŽ,´Ñ^¾@² “,àCÞh˜73¬mA…¥+¯Îaø6»lß{ë1w;¥i&kÅi_Z³Ë£hpÏu¬·«7ÕíŸlÛa \^NnË3»]‡ö]GÛœf;lK=íœÒÑ/võßÞÔx+»¢[@§€rUŒ,¼–6ËhEK‚K”¶ÜÅü<÷‚e•þE°»ç;ùØšƒ y£ §j~5Ñ×Á³x\’ìôE*Ó½€'s#ûú®Át¬…yþLÏN ÆÈ®\'ÓçàÆ„G^â0xJ­GçjÎopièè«¡ âÔxýi-õ,œ~]êëš/é—Ѩ²sÏÀª'ïŠhnås0Wd_5…áUyá9|×ÑÆ%Ýξ} ê6êùÛ N7Ñ“úI'¤#·£bB¨v!S˜~9}­˜µ(´É™©t ¢"Lç°ªì“*9oðö1áxæçÔÚ±Ò¹™6¦ô^ò˜Å7& øÄÎ־ˀ6öíCl·±<“KxO ìPÖÚÁårtŠk|[´ñ®vÚ4¯Ñ†l»½qÎîÄ´¥Ò¥:4Ái»ðÚ&ÚxPl †ŸÁ“ŽœvØ!–aJ)ã4–)ëʇþž,›ëè›s3h;è æš NÞ÷™´7ˆ/´á1ÿ²ëücùÞ¢íÜv€ÕÔGž"ƒÉqOì’ê˜ö6àØ`é5ni1¢µÕ ª½ÃŽm®±MípÒ^´ 9˜±ZŒçѶÁW'Ùâ›@ŠY°-´Q/›Ü)»­Iù To8‡8n›ª”Ÿ«]@íDÏä uûûdû¶ÛHö;í·#þ `…dgã`gC¶·eì齺"vøï)ûo ¹]•â–..ƒl·Ã†ï•\rä>îûÔ¤T9¸foêRíj«²§€‰} ¸áš‰…÷w¸+€;vmÛ6Ámnm{ŸÛ ³‰/}=lG7q\Ca] sº®²6™éÛŒkGõÝT— ë/NE¹#7n K€ÿ]d¤?ÉΞåV6ø 6‡òã„ôD:…ŒP)î X€•§±ï—fC¡Ð¼söaÓÄ›ÿ!¬¸»)¬¸¬­Ó\âZá±€6š’«™0m¼ƒ³üÕ´Hu{ÏŠ„|ûï1ùiòs䬭R:2Év¶;„¡%Ø(´ÿH3)>û +ñïôšUWD-Icð¤å¸jª6®«â  €-šE³Ý &ú^ÚìiƒçÉÑ7˜ò”æ=W›N\×\ÇJÐý@g°kg[´V粞kF³´^,¾]…—¯3ݧ8Út~€vÞF%÷Ð.lü+ý[Á6v`^ï¾ ·K>Bñý¥÷à¿龃vÞ׋Zûû¶Ï‡æ_Íûß^“;æ’»æ-]à\­ïN Š²rÓ5üÛ{o¼%%)®Eç@ *¥fÁz–dü1⋨6ü‹ïSV]’{a+W(½ùÙ®§‚]¶ÅGžZãF46«]\¿Ö/z}£Î|%xžX –È| Øya V·£ÄµT9«K­ÜpË’U梵Š±V3±cÇÆö/¬—c6y-˜Ÿ9>lk²uw¤•œLŒ€¿=!Û+Ñ>§ð’ŒÖý¾~ÎŽ)ggsIÕ€6o£ÜåzË1cŽÚðÈ•Ç.?÷ôwù©êÑʾIůvÓ]þ¸âø7øÜao #SÛ¡aÉ~^ºÆŽ2~ì>Å<áÝ÷Öþ «Ú;–/;[vð†Úø{ßh°G.ݧÛÄ`žÓ{&²á[ù{®+‰ð¿[Ñ£ò32JD.B!DTæ[Bˆë¾ëp’5Åo:ðUàƒïµæÚ³h.ü«}õß-NËéÝX Þ›Æâ1×ö1®ý»6Oܦ^<¼©ÅÆ,bIÄ׃mǼ7œ¥çÚæñ,÷}\Ö&Ø©…ô¼f"c¼4•Nÿ§]X7…Á ò–Ì1•=lhÏuèQv°¾f\Àvõ|ÎÖî7xŒ*nS.ýbn@“B g_®J¿õ»ûÅ7®]6_ئgø›kËfËöâzU±¶±€3ZÒõ+uVU« ÝßH‡¯¿¼&h¬¼"¡ ë*6JhÜêùcs;öÞ°ª$ø–ëØTÔ歹¸ṳ̂­Í{î9ãmG^1õ¥­-K²UŒp~‰sZQê^ˆIïs¢‡Öþ}éê`ºo‹ÐlÅÜs²½}û¦îÒå³G<¬Fi@ã"½yÑ ¹ÎÔÞéo#<½ý•’†‰µÁ_#Êp°ížE=4*•J§A¡‘H]3°ZƦ§QI»¿ð½ã[§W,VSõâc>â l¹©ÚÔ@ŒhTÆ Ú+n«,ëè g.ô>ST =16ãN=2EeøµN¡±¡¾uãxŽvêy[‚ê6 ^bL°{ÅE‹S¥féþö)»‚yÑ(v[²ƒÙÞ¬ÛÛ0çÐŒ¬Dûí;J‡×‚[Á)®LRlÞó-: É-ÎpJÕh~Ñhsñò6‡åu4)j»ï®kªá‰möŠ__íñ@¹ÊJ—fgó¾íûïñ=b²ö©úÕÀQL~¾Ó–ý‹y6š{e ¿šÍ·£{Îݱ#kĪVL~D&S3[»Bhþƒ¿µ‹dŠ,8òsÙ”EÚÑ9 kBE{B¶ ß³¥U\[ä8ÐH¶.¡’Y“bÓ÷ËðmH›ýûŒŽÙµ·6{?ÀÏÔG*"HT}ðûSU¿}º-Èzçy!ꥵö‚}_4ËëPó‡ × Ö&¢UL}E¢:KÍC‡øOøI×é# ¾/Þ ä“_ÓGÇÛì×7ý5átÌ£-õËkcsÏé³Ãê,pã•‹"ÆO‘–Æ”@/}Pù—н7QÕ2#bUÍšÕÕ•s4L‹çÊcVO®°À¨ÀªPŠ¸Q±¿Îy)~ôÈÓfS‰MsóÝÚooòVm¨J%(Ã}ltë»…ŠéÿQ2´~åYyiB'¿Ê!Kn¢]¹\¾g@ÙYPH~y¾(k·æ«îИ-£êÖuè[¥¼4mGÄ}zÁy1õÀ<›°YmÛ„Z\ÅpN¨þ ¼/P+j{û¶Ù–\A-ƒ˜ø[[‹[W„°*hó‰*”.™Ç§à¤Ìºõ}°Ï½9¥CFÛ¿óó  {îH¡å\¶¢ÍÔ=„É´‘D3CNÃ[¸nž™…÷ˆÝ°õµŒ%ðD–‹ì[º‹°‹{0 ŸuZ%Í^[7©Ç†¨Îà±Ô–„ˆÓû‚]£ö}‰‰4ã4ª_'¦Þä¤ø¸U7TƒE”Oáõ0ìøfÚèÁ×Ç5¸aܯfúLj5ýΨö·Œ6 yN}J·´-¡Aìí‰æÀ’|¾cÌA¡G¤Ø[ÌrKjšƒÈwÚós “<‚ã8LrHÙy•m€ö›ˆðܸ–ktÔ®©o)Tn+>QÝ€Š¸Ï™ÂlÃþí1y1àpÉ©ó"G¦ÀÕƒNwŽ—ß…ƒªmŠj 8!Íâ_0¸N›y4/?‘P¯4šB‡4’äy´¶$‘Á`8zÇ‚ÉØ+³Üƒ{¿·ÀçÐ'LZóx=æó3õ¦À|S»eédï½ Œ~’rf€´*ÓÏumth×ÙOÁ=&ÀÛByŽ[½ k,ô 4nl•@óé;´(°‘SŒ6“½K¼øö]˪5o·×ÑfMÕyáNÿSá™uW½¬¼Ô¨Šv-O÷³X°©Qùåþ=m€n“šH ¬¾¡Z£Úð"Ä“í³k\^cï—åèâÊàzçþníMÜ¥î@JÇ,],)ÍäsxõÜãÈèhßÃf¹'´)±ëlÝÝÃc’Ø\6Ç#µ~v6ï‘´~˜a~o¯€M拼š ºuÁì9/N`ï†ýŽ¼0Ĺì¶bî)ŸJ-º}ÎUSwé4Z'®ÛÐQ¹RBÿ-¡ÕM™0Úx”WçÒY ÃzëîP$Ò mD]ÙÌ]ãfEÈ…4O¾†Ã¦‡$$ú <ÂSTX" š{cò«}Rë®<‡¼‹?qIìÖ)SU†¯ë+º .ë´Ñ¡5QŽ¹=ž~<6% «¼øxCO ¶#ÿpé^ ûXˆ'Ç¿zÜ:6<91FZ¸K–€Ibe;›ôþÏÓ&¼UáGÎìƒ[£´•Tÿ6Ú¤§ñCêoa´‰PÝDScÅâ³Ðçäò5:ɱn ¾ÄîãgÉì`ës¦ÐK&~%mb£s¹ÙUâÏðVš›Ã°a3m:¢PЩGYL†OËèK³Êb;fVUzé¬BÕ$ ‡EµÐ†Ë¦¶Œ¿÷åÆG vؚ̯6áÞûæW¶ð‡lÓ6µù™k­h£5Üdìdµ¯ÅÐå§D:WMþÎÎÔÛ5Ÿ”Êð2˜·#á(ìËô辡98µ-à´ñr‰>¨Â>4mÇŽ²ÅÉšéOI$Aë0ûÜ“d—|v6Á¬â’3Š Š‹95l§TÐ š¥©vÕÜS…ÝaD»OîfyÊ•sϸd¤| •ÎƒÚR¨¼€uÞ…Fϼˆé6tF Ÿ„Jµ‰>ö ІÁ sÛ)ñ»X¸Ó¬‹Ø̲Ë/°Øº ª©Ô›Ë»‹ûïZ¶Ÿ˜dÐl+GÌÁ/ÅÇR*Z.‡áÄ+Iα}ŸC¿ú_C›y´$#ŒLñƒ“ð.¡Ò*7Of]aŒ¨·=ïˆÙ•%!*œî°-²¤šJ·L¬mœck³Úg¶BÉîØÃý%Ú„5L6u5 Rö€Æ’–'û¸°¼ð÷Ò†[X“éקÁ¬² šÄ-²D}¼‘"ÕqîN˜…f=@àÈYª0WUs_ÑÿãØmÿ³ƒíQüQµá¹?}»÷®óxȨ,á{•vŸ¼Àp ×P‹¯Ômh¢*YË«N±ëüeÄÑKk0ÇL¹“HiçñÓ­&¹Ùî}®ø•ºk»ÙÝtlŸÐù5´Aê¦Ì3±Yôú‰—Š3:+_1¿5mÔÆï™wéܺÉÚš6Á®ÂØýŸ›½äR¶·Nþmzt‹È§Žµ Ù’¬hAé¨ú¡ Œ€;;K"‘hÐnE¡S){[ïÊë8m\S‡ñÝÚ™nQZ@Š° ÷u׿ð¥ÛFZhcò¢Ú{HoÜÉÌŽÓ0Îeô&㢘üáúƒ§*Ÿ~@c SÒYÎ@)•Œ",AF~ÈþŒ–CåÃ+m˜-k¶Ð>´ÿ'L·A眑*‰R¶f*|•6Ò=åì´)‹g¬å6c<œ<åŸB¯Qƒ¹«¨9G³÷ê>¾—Ž„äIÏæKÏ$‰éÚ|,wÍÏЦ¡<žz +ܤ]ü‚coÛ<µ¡·îáb_zâ1ÞºGí$àCñ®4ºKŽd-§ÓoèI…5Lô>ãÚñÛŸ:’ZôhÁï¦ ÙÞVàCãEvcãƒ5 )Ó=2³yí4¬·jÝ vd·Žes=_»ŠÖË \ãj OÜI;}Ë™+@Ó,ÉpÇÀ ¦{ìIp+ñdqM¢!¢6Ìj×yú4Ó9pÍ üÒ—nvؼsAɳõ++Ýæ…L…8K,Ìäm„ÉVâ´ñ?d>ÅÄ<˜i~éUÚ4M™#¸·¤MÛFÚÈöW3“¯X?CkÚ$ºù*b¼Ë´gtÎlJ³¦Ö»–ióLõiÓ¿C=)=ZTàåš|ª«9@$'ÎÑ…Ñà3T^éíP£Å*p“ºŒï]¥žú”äÀ(žÂòÜ#¶½dr]·É&¹UÜÂ]Ü•ó%øüt@«!1Šö4 GÍ©´èHùž:¶O/ömúœÊàÊ×LÐ-g¿Âfé…ºMΈy£‚ä]Z±X‰á𓶋Bw¼J›+6ñîì,dO¥û&&·Úo±0^±€wøûôHïÖ»*|¼`ü"ÝŽÛ>8’Þ´/­a/¨¡ ±=Uvk=Vb+Ú¨‡(”)öÉÖŽ^¤îuê6é6ˆ•n­Ä€B±!.Nq}J#ú›i—”è•Ué˜Ü§1þmð(y`¶ --\uÍÍuŠWkÐÎçIN‰XVF“Joj½øU'Ð{%ÜÍNœ}Ò2ÚzUE¥!.ч@'1Åw§oãÇxÏ>”êPé#™ã£¹†Åâ]¹W¹ÏÜ“ºVÕg1½Ë„e—oRX®J¼À¹',RjVVn³ï¹uðKªÙ)ù¬ù{a@«ªbLezRL^n?—— ÌD˜Y‡âíº8VðZÚœV›i£]oZèƒëLꥹe|%Ñ›ŸuúáÖ´Ñ¡Ý=•×n%v=ÝŠB²¨(Zª… £áÖ´É…ôâ3ñ,F"RÁÀ·¿Óû­¡ ¨Q3_0wR‹Ç×ì `‹îG{ûì!H¶(!¤âh‘䀀²#áÐ3åħd*ÇÃ+:O9’”B$@ecÍJ,šcØ“ ¥GÅ»0éÇæ¡“6‹ÇN5«ÇhM‘‡ÇŒ:üï(¥'rËs•—ÒJ+í)>R³Ý†ááœ#¿”QVDa*¬Ç¤ðo^$Ý%¼e müØ4ü}ùG¾e3¨Ý³f+\ˆ'Ý%º*£µ?*1‚“̙C—©¶ö¥êô:µ ËγbvC>„µž”zá±»¸u6ö2Ù@FËaOW¡[fwfËÁ]g¾WѨ ž(¦*³e¯ˆC jYÜÔõNŒ ‘,Zì68m š¹ (u3à¹ýFÚ]´Év[Æ!'hE›^@fFÞ´zLº'4˦aÖá'¿d·Á¬Äó½øvѲ;ý³p/¾kB[z8>-‘æZhýú<Ýs㓹‰Õ½Iå^Þ"ªS\ÕÐshÕ95‚¤–Á‚î~WŽmŒæ Õü‹(_ŽcTSN×Q/JhÇJ‹•xþe˜˜ê[¥SÍ¿ŒquŽm.ê‰MŒâÕbÏç™#…^>¹AJ²#}›gJSr­6*5Åž,ª¸‚e;ìŽb¸¦í-VžteÙFöÂôÅò‘Q*Ù©äÀbI·Ö3Ò ¹ ØŠ6ª±Kt*?»st—¢Ä4qÎê#úˆð&“ TV“Üe¶𮣠&¸;ò<òT-+/<`ñq¶óÏêH«‘Ñí‘R,„ª8/C\1?s“w3›f·t!dfrSzãqpŠŽ=j2Ó7©ñ`tœ?׿I¦ÿ½¾ôo‘n#þ ¥õ̦t‘½ûr´÷@OÊ-g®¾ïLríî’C©õ&@ª«Ìø0«±7­åd'ž>qöqrÝ!9¦ «¦?Ïï8”R··òä‹–tx.µá€Å²!»r5µa_·~}Ì´vÏHZMOF×ÔO÷2µ~¯Òð$§iwzûÙN¬*¦î¦ÖY 1 é {òÿ(=u.Ur ÖÑ«iõ}…G?L­=ƒÇîa_(´\}6µ®/[6Šc)`%¼“ݼ7µñpÉ¡»ª¹jÛúr‹ždÔiº¦aµ,l?˜R×—Z¿'µn7(ªø$L{ KV¦Ô,=ú…zS<ðMßßMÖãcR•Ê“…G?]wS¼´”´KÕ6‰VkN¾§ZOåô,»FÙ²fUWò꣫VÑÊJÜÇŒgYÕýR¬ÒxðrÑ; †ƒ#kWˆIç(Pl2’B“lHS¬œø$±þ HMï’#ß‚šX 9— ÝLlTà[…æljµ6[9£XØ"%#Ø¡j÷pzC_z˱]Gïi–Í酕ؼɹðqí¯>ûƒzÞ„wfËä)u{J‘;û( «-¸Drý>™†gVjϧÔôöÎkÍ¡—²Ñkt–XeØìÔ¡åip³ùª1ùšoa×Ñé=_6N®í+Þw[­7oo>8œ\­ÉÑ,(‡ÇS¥°ž€jÓ9k¾#°ÞåÎ*î<˜RH6gRŸçµïO®Ýß4‰f7íéš~ZsJ±–ö<¯y_ªUM(=UÍâJ©b0­u°alGb½j c7–¨mâFjm/ÜÒ—\µO‚Ù:N-d4ìÎSÍ( o`²æ„ÈÌnã–5³±®~J¢Šˆ)~Q@§ÉÇ™”?øÃfÌ£ ®›{ çÿÅ`j0+Xñ’˜9ýÝ Mi©“sÊä¦/£Í6A›_ãë®] #®Mc«ÿ‰× YFßÒÖÚ «gw¨ D]z'h£À¢9´‹Ö±'Ðú,‰Ïͯ{€Ú«xžvâiüõuoñ7„ì´!bÀ !„‚6VÝd*¹x#§õ@jÃþ‚žy%>$=ócRm¿ìj³'2”÷~óáéõ»å˜¥W³ˆf6ì©y¹®HŸIÒZO4Œ™™ÔŒ…gE²ãi-Ç믘6ýŠÏ W»4µnoñ¡ÖìÆP‘“œžI©>(Õ­‡g6O«ëÍèéZÔ¼Ú1I©ÑÈæ°ä„S_æuL­ß_>ð¥ÊºòèÑ‚¶ƒ¹Ç¿Û²›×º¯ôÌ÷ÖÖuåا…‡Ò[NtÌ oР÷VeA‡¨),Íppà„æ¶%UÉC|ÈŒÀúIT9yßâ*Y|­ï7t©:ú÷%v~ð/uî „ GOÎë\™;LFÂàÚð®á… s{h¡<­FB·¥T¾´~›*ãª+Û&8Oš^+CìÈ—žm 4HŠ;†—g4jÜ8v¡Ò;øÆ’Æ&¶8€nïÔ¹–òº¸(‘㟛§º”^VN¦û´O­Ï5 ®ªM+'3ý’›úãR"˜âŠ #›0æÑ)¦ ‚"‹º+$bÂõ-íšC5g÷Û±òå oò!o)àüXäª8ÉWT„/[ä-JšýsŒhz¼;?°,½e¿§+3¤~v hvŠ7ׯ$½å€˜X9¾iŠ¨æÝr2MœT¿?,6œéW Gèf'¥Æ±ÄÁ<Ï<‹ P×™ ™›Þu.¯½ã`—}ê¥õÓ“O~É¥ìˆÚ¥MÝÕH±ã5[Í~‹ÍÍñ£ c»wZkVç‰ôZ©ÙîW9ýškÊð';%È ö}öóN­Ð5«¬«kvsŒÿ–Aó•Ï£Lk< ê!ø„íÒÀáÈ\Õ´sDï8v*÷Àwu}`ã¾]Ǩô/äÓ;Îá#¶ÇOgi>VÌ=Okê—ãƒàs/ÒšÝ}â\Öî¯öžO­ß[zäK€ˆüöií§ºqÓ‡íê-äå.€BJSã«.¡<–™6:´µ=™á·ßœ§Zž‰ø÷Yµt´½;‹îÝ«Ä£/Õ4o•µÃ˜frŠNö’ã³âNÜ®8ö¹*­„äõõ,~È°à´ú€ÐѾúâS³¯ ½+·$%ðp¡Ÿ4{mùˆ©yG¿±Î_VœBåÉŒë¹}ÂÂü3ö|¤=hS ¿tžÌ®K2¼q]¾–Ò­oœJnŸOX=÷¨Hr<Ï¢}7ðYÞ*T놞”IûSû›Fž)Æ>:U–|Ja4ÇH†ne·Èh?Ý>…Tƒ—;2KqÎÒ,¡mûNÇ+nÕJÛ„8m@ë8?í@U`yo”#‹$Ä} ü:¼@¢ù›½M¢{Ze1©æÚ;c*Ýóâ¾ ãuŸ_ožé<µÐF–f D¹×pxÖ58FžØàéTà”0„s¬¾.DÆ&Ý'v³ø±Ú5Q5};¦LkþéüµÌƽé-Çká䃦&Ån.âQЛ*ƒ-hìYM{ÓZj.<5³¨y¿|æóŒ†ÝR)³ùÔm@­Ø»‹“1 .Ò™ƒÔb‘˜©o¨鸋¿5‰2ƒ$Rš+žó(ì¼xñfÚ€{)Ê/>õ<6Àk6z4&À-\óTÉ hÕþ™Î©—ï¢nc@s’Xî)g-,ÜLÞ'Søþáé§âÒá , ªC_P¾¯WxF×y¥a%&€çÓX º›¸•»±3œéžß9ºK}ˆB¥…F”XÊÌ‹ax´-´±%˜=E¥sñ>>tCTñ ·Ô˜Öáʾ4ŠCˆHѾ…ÜÒªS•9ôÀ…^8²k8¦ ð˜Ý&Ú•´ïGóG\w“AáˬF~ã<ý{͹jôw$v÷ìú¯Í5Qì̹æ]Fóá’Cã=)Æ^­þ¦…6à™ø»³ûîkaÞª'ŽˆMõðsËç Æ/ØÙ5O™=Ò3¢<g,. ååFJß{_iõqG_ Û9á^Q9Ý'|EÂÌcàÉ«Ïö“yQ~ÑE™ÊíÂn{ÿ|m‘꼿§£[îIЋŒwrôHÉêÑT•“CbË*,…:ûWŒ‚‡Üv ŸÊpË\Ȫi¡Që&°„®6Ïœãj¬æƒ ¨èh®é6u /²ŸaJm|âfo“{iýù4öíæ›5<;ìÈZÿUvÁHD¨§?ÉëèÏ×Ì(×ÜÂÁe´9ĵÒmꥅ¼ IÏ2tÒN cz7ܳú¸¿ dÚÅž4?=ÉÅQ¦ ÈÒW‚¾7W–(4FîÞ몵tåæ³ØÛ2Ó:Îä¶õ2ìíªÇMÇçü¸tߦ±ŠŠ‘ ûôÔöÓyí{˜;+®@WI&ñù§µ•AO?zË Ü/fåA_bjûØW•{&ªŽÝQ/¬OÉ ®¹gÑ”é"®ZÄé‘' WݯÎð~…6&3–†ùlc ["èë Læ%æV<3Ô²Ië‚“W›¨Ý;Lýã¨S GîÌEçÇ·Ü’‘lìEO£—Q!váÏšF®Ûÿôu¶®3ÕÎÊ,0Tg‡ÞR¤6„•!pX—pO+xîëbè´¹R®Š¬™¬%2ß4IW‹øFÖ™¯EL6ÅýëÒOº{Øj-€Yv牃½‰¡µ›­›Ÿ¹!ß*¦uLm ”Ýmqr43°r…k›Sã¤bîNP›ŒÛ·¸F›)éK*¦<¤Yfi¤x¼—~ËpdÜëàh8ïxz¥È˜o¼‹|U±%ØÑ:±5[Ñì²Ô¦Zl*P‹¼4L}ïãfëZ—ñOØ’*v,5t Ï®Z›|ýÑʽu²~r3yµá˜%’!á¾™éˆHj¡“¹àükjs“(§Hm’áPØ£Èå+R›+ÔË#Zm6…X¹dMèü—W›Õ>VÛZh‘¼v–§í“*§K¡þfÑ tgÝÍ|.Ë=¹D®Wg×Bm×<²}gW4ë0µãï)P›¬Ê.=-¸Bú»ú o7û¸Ê±‹O9ú:íDÉÏÇqnZm†\sÕÛÓÚ~ÃÍ1s-ûòןëÉÊï%ÎÊ—SÁr*ríú0ƒ%{©aÔÙíú*ê äÕ¦›V›RZmrïX3g„ݦç Î}ç¬K<–§ë+ï:J^mâöá9…f“ ‡Ì’n=5þ&9¿áñÇÎqg/•­í1PçFÉ÷êÔ0.5Ô˜M‘=GmQ¾"µ)»òU/Щ—p!_ÇÜg|"Ð2|‘†KÆ ¥Æ '³ôÌBä*#žxµsÛí±¹ óãru·•€@ Ëõ5DÑ% ªå.ÚV1mã¶M dÃ4 /Ë"׆x茩Ͷ‰j³%ÌÞ1µ‹ÊÚ==ülMìÓ»¶-Š¹IõäàÙ•D3œ¿=ΟÅ164± ‚¾@‡¯oªïŸÿº³ŒWZR–&̨üajÈêâ¹v;ËÿÕ¦ŽG0ä¨:EœL*‚3Ñí¾Tik æSžQðFµ!g}äjêl¸Iú#»VÅæ$T¾•Ú¤ ùlhØ®IgNðú?¨6|þöbòU)5ƒw5ì%ºçåƒÃ«oÝàò=“Êá < m¶P­!Ñæc5©Ð¿s—뺛œ!a¡¯™=Ùšxó±j84¦´EÀân¹ ï}côRŽyLj=éÞÚ&¦I2å­먇‚.qk½•Þü½ÍeÒ-Ǫ’îÁK òwpÙtƒh¼dÞi0`in¹*M—Ó´´sçyj‰ÅÄÁ‰m?vI­µêÄsùwR Ô†¨Î§O0™ÎÔ&³ ßyªz9OÈî3GfËÒá,‹¸· Ë-¹Gþ•MÔZgžex|!=oêöÃy\®>aû1ݲ‡`ñ»^KXq¦kÇS?3m—ô>ØÏs³ÞÀ@`ú€(¯© °Ñl-=ÞÝ,uåWÄpr°ÛOôZ‘W…ëW8 \ˆæ-‘˜›w¬bó—¤VŒÏN³ÜÑ&¥+—œ€=áB}ôwäälð"\í}sÛs(O|¥`e»ÙòcD)Ê)°0ÒZu²ç]uÝüê<ó¦ÞzìâåÅQŸ¡¥®¤cìwúm,hQS3L¤Ô¦ ]]MT›.u5ÝÝ2›<îà!¾©­ƒžžõ’8-Lì.7}ïóTu¶PV !Õ&åv‹«G$ûÖXøGm\Áåš9ø,°]¥­ÅÚ]âÓý¸G)µ±ÑT_v…ãVò’ÃÒJ+êä0ÍÇŒUK—ÇÕ†“„s8ÄB`lÑ„m\+`khkiÙÎO¢¿G-kã¨NK(ĈŒˆŽÒáÀµ6ñiô7$ÝÚ*_ï¼#%~F'&èk«ð¹LCû íwà„ßçñáÁY¦:—«Í!߃ïÈÙgb m`n+àhÏžŸš©OGù¿6]!ç((íñp·×æ°¸óŹ-¯Œ 'ßý]°s°e*OÓTW5´ó_}âì~¼°W…³ŒV›‹T˜A©U„ìVa-L­¢í¢µ±±úF¦Ö¶–Þò¡Csÿ¹|¿øRmºøßhD“j³3%‰ãC0w»ÜÝu -õuø¾±É5À‰?3â–ì‘ ¹ä- ËãrÌç%y½ëä%S‡Í6˜½(æizåîÕ4šCY¼ g¯™ 8¶¾Íü-7`ÍÚy䄦ž õ©yòµÖ–lmWÏfIö²Ûy=œ. žBƒÈ ƒÙ+ 'õN‡½Ól¾ž©¡žŽ±ÓòØb8‘¦7ïl¶u“& ¶|õK]›Év^yH~þsªçdÁâ`mu._ÀÑR1²›rvë%9nÀS7·µ7õˆH<ž¤­Ážw|ÄW_Ýë(ì·I9ʯnfkoâº:éd:WƒétˆÇÖˆ•© ­¾óÞ3mMÔbú]aÌî]†:,ŸËæûÄQï"½æ²ÔT¸,u}›9®ŠåU"*ÈÂ|gýÅŽ‡ o1œjÕÅÆ”Çå²YDùdó¸l¯t8QIf•ÄgŽ›Íåh ÜÖ姕½³/¥…>à#ö{"ç}uÌÇØrÚr3f×P#¬Iï5Ô<ÒÐeIf)>æ´En-Œ¡§Ë.{ÕIœ‚²ÐÓÈ»Œ¹w½+½ŸŒ¹Û md–›ÜÔ^irn8äüË­-”_•1%ie¯úX! zÂö±³P¡gƒóÜQC§Œ‚ÁSUôîò'OdÙòDÇ+8}ñ²¹è©ÇHï·ä]< Ü¾ X#û¸®bÂläÐwŒÌÅ } ²Cï2qº{ò½äØåc7>ÙÚÌê‰e bbêÕÊ^óUʲ¬RvR™—z ý±|-éàÔµSo,Óëà|2T!! qÌlÙ\²¯¬%âIw9²yÎÇ‹Ö¸Ÿ¹ùØe¹Ëó5ß¾pþ™b8Ou5ÝÉ#û´c Y²GÎ(}—ãYÐÈP@\@Ú µAÚ € HmP@¤6HmP@¤6( €R¤6( €RP@© ( €Ô© ( €ÔP@jƒÔP@jƒ ( µAÚ µA~EjóWUý7ÇÂÊÌ[!YwP@…æ°ö`¹™‰Ñ»Ulj¿"¹PÑй+ã ( ðO2oÞóÎm›W(--Ý€@ Ajƒ@ Ú ¤6?¨6‘1‘÷¡6%%%ñññé!ÇÆGFF@¼¨WØ@ @ @ @ @ @ @ ñnÁÇG3ãpd3P² ˆw.6R\ˆK1 ÃqL‚á"!Žq(]Ä;7lR#ÂÚ°æÔG›s¶ % x§RƒÓRóëÜÕ±î‘Kh«í†GÞHmÄO5`h3È-Ý58!6Í’ÚÐFÇuM+[]Ö>öºÜv ¹A ? 6™q)FÉ !2øC|¸#9¬É9ü‘ãòVÛÔ†>Šá¨—@üûÀTDY5RBSÄ’¼¶”­6¡Ív›õc/1 F£¤ú5¶ˆ©ÿ~¤µ;aÂΕJ¥ä_ n ‘‰ô•"#ßþ$˜PO7jÇ`w¸NŸe,`ø+· ƒ”¼6ÙÕÃ+Æq©tÒÒKÞ>I (HŠâ‚ñnšRD®‡?´,*§O.å÷ZÕn¹¦Ñ5åÑz²›xÏįŒ=þ&m?FkDÏî›{§ÈGvUí1´Ÿ÷¼0ÆÌ>€aÀ`€¯þcÂn¿ŒOÁè[Ÿ&Eè€ ÙZ€“ 01`|ò¦6ºËÁ•^КŸ™3É0䵿ºÙ7_ÆoÀ¿|¿ÃPW[›†Ýzdm”ZõLá]­y÷Ú_IÖœ€cÕ]Är[nàáòŽ_¢gãCämÖõá[R˜tu‹õ®¦Å¤Îá âúµíöá½6mÇŘ'"ÄSGró >ˆ¨‡‘ ú‘„Oˆšø{2÷;ªêµQ{à¯Ç_ß©£b¿ªüj ê±²] „ÝfnI´Ú¨0@ ?¿’Æð)ªÍØgY&û8‹\–cvˆBµ¡öÅdPw1…D(YþºjÒ* ¿u¡—Ãg·3pñAÜáú^aÁš+­ã·óšÚÈ'ñ/ÎÇöD ¬ˆñsíŽVv(H%|R«@þãÇœ˜+d‡Ä«%û!‹1…Ç}%·g o]0úf«vÒY /!äIºni]@1}Ò¶UOìÖ¶¸x² —â2ãCÝ5¿,ÒŽBmM¶£ï|;cŽ÷šl"FÔQÈÖd{,Z³Ô׉©ïÜ ‹O•’žç³ä=û—¸èz,öIñ¾M¦NT|rù¸“¾ˆgh¶.2ÌÍ^šMY0Ԥ·Û6×(!{ˆ§¾w z±ÌÙÄbNÚžãÄi£MU—Ÿîö·>x¼hx2D”Rm ãÀ´ úâšÏ·€‘”m³Ž¦Lîî0†·¾VðqÎÎ0Ì6S>‡Û$«"ÛFÒ ÷âšÞ4¸@•@¬ 0¾ðœ ÐÊž Vò¨ÿj–¥W`ü+‚ºÂB¥ªîJ` î7åjt J'ª ?;ÂÝÖ+ÈÃÒ€©é<€çy6¦z‹ÖnÉHK³3×_±ùDe§´4FÓi£¥½ßžì$ Cí˜ü“åÔbgöwÕ}ÔòrwÎùŠ^0XbÌbÎ]<×NS˺™L¥ø…|+·õaKuYîAe‹^¨¿zÁb§ëuŠ]>/Ü«Áä…DxÚ› ¼")Ka­‡®‰Gp€ÃÒ5«”°¡û¼Ü@ƒé±84ÐÕ†k³öôÎ2ô÷¶LÍÝ¿ÀIgNè"înîÆø¤û£ Òxfô•—¬0¯«ôÞÒ:K×Þ·‹jô‰½¿\ŒàèõÓGCê|ÎÆ£OÈÅ/#›ûH÷c­Ê¬¤ÖžŠ¶y T+)ñn¥ðiÙL\· ” Û¡:•) \ÄÔ¦ÿ‘Ë ¯áfU^~/¹ËËGÊ<;b¡ñò:‡€4ù‡äć©6Â!ØZ¡°ü\ Õf°¶e(D}PCDc6´nswèMjÓQÈÔãpŠ(87x]… ÛTÀÔ¯àA`ø@Ý»¶ß n5—ZÈ‹Ä'¶NÙ6¶z¡ùtsÍŒUÞ1L,¬t5É«§^ånz¬ª^{E¬†Š^u/­ÔÕ=ßVm^í^îœOÅ´6Ô½–ôßL˜i±žº¬ñØ,Þ""_¶.7÷; &oI=©ºQÑøœÚi‰àÛóí ·p¿’EµözV˜šñBba·?gÓ±*ò`¤UXZè-ž5‹wLxiûíºdî4q•Lºçòûµn¶U¬ØÜìwº-+ì‰óº6o²«ƒ (dÒ| ùh*î¦>M b=Õgn¥ËeMþn«…›ÁPÍ –Ó•¥u3™ÃrjÓ|‰ÕÆ ë 6DFkò.½„j£Ä´ viSfZôOP…jC0{*ÈìÂÀø=QŠiµi>~÷ï²b%‘åd“Š(L,˜w‘>ÆdjCì5G| %%²nó—) ”Éö:ð¤6lbY€¡?¡x*P›NY¢%u—ld˳ù·›^N¦6Êzabz§V#U­–Ñ·¶mÄ 6|¶Ž¹SÆÉÛ2þÂÖ`g¿¨H˜£VóTt1°u™QÒ¹“õWÀ$m_ã3›/€ðXš‡k¥¥‡·Ú„§Pk…ug¦ëÖ樇–êÜUd6¯\<×Ù3, ¼,žÎò¥2¥¯l:Ëut‚Ú|àÞiðýè‘uOÜ×·8¬{ì0z ÔHqìÃõW!Þ̈sÖ©NúñL©—ÚÌC­€êM«ÎO4¿ jãL×0j³ßÀkù–†vÅjò¦ ÷«6Íùàߘ 40cˆ²K«M¡6’m)†‘T Ë0r/P“©Þ§@°ƒîÞÑý„T©¬I…Ë÷`IŒ—È•OÍ߃²–”ä&`ü HßJmÆz‰ß¬6Jk%²¦£ÁÛ©M°©6äK=qGvôm¦Æ¥‡£¶.sŠ;𱬀ºu©aÆwOÞp©!æÊ;Ï>d½ 5þ–P›âƒ1³#èœ=<7]g¡6njJçºÀø¡‰”ì-žÎö¤mÌ_Vm`{ ,©ZÓìÚèöýóãôPL6‰s™ë÷Ý'kÜ ·¦Öµ!À\“UEÕÁ“›¬ƒ6žýÕ“¨a‰ÚK”øNBZ¯„wnW“Ê1‰Úø'ɻƪ F4¦¦ €õRôjK ¾Üz {‰*Úr|ú•L(Þ¨6_ê4LŸ8`DèÉÿß—¾‚i_‚Ì&úàGlƒ;~eÄÂýHð¥LÐý/0= À¹ÚwL’,ﱓO$Uk»­kv$1#–›,M¶çû ˜ë c¼÷1Ù¥cå\¨à žâ“ªÍðÉTàëßtg ã/€ùÿÀ¡Nº¤ŽÖÁCýÛ×à_?‡ OÉ{ÕøXy—¾åÏÀ”ß‚?| ÿ F_·lúÍùZ¯õ+P›¬@G®™ÇÊì²ÜE.Úfî+2ïªmN›mÌl£Ö‡ ØÛ.=œ,§Ê’kê¹í;¼ÏÞÜËËSÿlyo_A:›¥=eDè"O¦¯ú¬a»æÛ ÌÖ­5Óa­;pïml›äUvÆN¾V˜Ìß‘niï¹øшh¡¹¦µK`ØB×à°ÐY:óá,]%FšLçy+VÎsÓÒ¶i TF¡Ú€Á9,Uk×€cÕQ¦J[¿ÿ@½ÄŽjúÄ©VX*E/º?FÈg‚T""KpÙ< 8&%cÄ=&‰e/_Ç—©Ɇ.‘ˆÉ=$²+.‰ÆÞ×RËD<µÜ^$K_ûømTÖŠÀ¤@({/,ÁŸ"1mRËò¸‰ˆÈZ/Á\¶;ñO(„ËÔ·|Ôöò˜R ‘Búã@x®Q ÆÆ[X"!<¦¸œkÒ5<áÝq§cþ-S +–À©¬2v–u<ÑÀ£SOn*–×ì'œLc˜àÄ™ìD»†Ì;‰YÊKÄd2Kèô…Kñ7twÀæ™ßð“~ò ÉcãT©7œW²\%Ë|©˜>N®~SÁÀÁ“kÙ±…ÂT”q|@ÜÝ°6ÒÄ?¬h뙯“ü¤Ç)Ñ’"Ô—«2oz0ü¼Êø#Ž<\ÍSÖ)"_)Úèé·ñàO;iRàìgÊÊ „éQPHmÿ ZƒOì¾ùQjSýw³ò{ºês_©z½~èç_çÖ¥&¯™¥žuã…âޜǞV,6oqÌAéOº»_fx³Yã—m3qc)@ @ @ @ @ ˆŸÉÄY˜ÑMñÎEF 'ì“Èf'ÃáXU)NÏY@ ïJl ’A88]H‰„C¸D ¤È¸A ïVn„pvPè(“Žâ"ÒKJñNÅ`#}¢‹'ÁxS ½OqRñŽ´qúê3Ji`Kª´´÷DÉ‚@ Þ9µ_|ÞËø »W Â…R)hùã¿ôNeЋÞJ!ˆwËðòaƧýÿ5]H4ªž·õÎ|Ê ,xWÀ©ÚëJ>gô~¦Ek–”1eà– ±Aeã}N'ç2ûCòIÉG¡ðÞVˆ$X3cŠtêgÍ,ö ãó‘)Ÿœ8M´ªW©_;ç7=ý1uRÒ×´hí1ù¸Žò4¿§·#l—¿óË:¾$Í!ÿC$„ðS™;Ò~Hc–åÂïÈjcfšÄ¾¾fyàFÊ=ÊÊù„ÿ˜µˆÚJÃâ.}°Ó ãV|WÄ`<ÿäSÉTÆÐï¡2 }Ý÷18®ÈäÀ'ÙË[]÷åëÏlŸì)>ôøŒ}`΄D=6–+€°ÛÌ>VñÅ)²D*ºÆ¡¼à çïõM?mðfgÖp•›¡û(¶¦‹E ö~¬ŠÅŽ×µ›¯5üùT é¯Ð.šä¼ò“ã“dÓgå$ÇV˜à ¶ÂߘScû¶dù¯?ýž,ØׯcâÁƒŸ|)ýô3ágŸô/[¿-Æ‘Ú|Ró²ÞÑTOÏÜÖ@ ‘|Æõ1ú¦^ΖÆf+á\ÿ½Ó^i«\"¢6¹šsCb¡ û˱¶Î‚å!×_€‡¶ê üü}x½¸ Í°,>™®={_¸s؆M^VÜ ˆ}x_Ë\OKCc‡ðÍ»Fò¾^püùho㥺Á¡§Õ7[àO¢CRÿÛ층ßQߌ¤¿Î†þ7¥ÃÇôÜÓ9þÇŒ<²õ Råž0ðLgû7öÈÖ]ÐOÞJ{BDê_OØpNOý‹!Œ©¸òx®²ùq§à´¿YŸÝQ)_«¡‹«»¹93Œ÷ù¦ªxÔ·Šáb·röÌ49ê°"ëkË# OQgÏ2©X²ðÒʸ쯭N¥Ö5Yzmed†šso?±Ko^A ´_¨„¶ÞÅÅfœÐ«ú~¬ºsJ€½™›‹-‹§w¸:]á¦Í6^²&t‰§6Ûhñ’•=̵eî ™ï¿4"ÈÕˆ°÷&ñU",Žÿ_3ZŸ%)_›DÃó&EðôMýýæèèv…· ú*ÜMtm=çšëé:…¤Ã˜æãÓ­×­và›-Hš¬TdExèê™øz9òFç@o\׌øÚ¶n^¦–þ»¢íÖî¹OlVx0JO_ß®'Ÿk{ÞQÞãùaév>Á‘+ü8†ÍÐoa•‡³™©¥kdÂþ¾ò¼éFÞï»HabaèKþ)CøÛ¯0€â` µù(Øb´:£”,µ­&šØ¬¿p]YrBŒ–l» ú«••8'›a¹—tÍÒóë¤]eÃNÂLí©cr¬:Èüw—©ñfCtÃÍ*ªœ} ÐÁ5ÖW¯"°'¿Þ! ªåÃ/_ '”¬¿#égʻ䋋»S•\êØè›ã|˜Ú %zîžÙû‰…™vû©ÈömÙ–¹¸x õï¶}¤a1X•6ÃvÐjCÈIη–=¤«miú·ýbùQzXö·]äZéã³iZaDýΙaÑÜFùÑe+™·=ƒÇÝ£asãûnò”§Òþ¦ß?«ÝÝÏí78 ßà¡—}C¢WÔ†©Î}<@>ë.Wuß #{Ïij@‘í» ©éOíèfà›rÚi©›îþÂf…¹&*Ù=ÝŠ6–$•iÓ-å‘z°gÕP~`FZŽ/&þß2Woç™:j³p/nöµVÐyVE‰u½ŸÔÌmOÜ•CåÂÃÓq¦+v ñ~ÚÔ’•¹ÎHE5j=Öz[ëBù:ytYYÇ›HÁ³»ìgn¢³/˜º^ü½ÃÁ°ùŒI„/úÞka¦œ“·ÍR“|2Eô9cø ØŒ‚>ùPKê£`ÄOkæÉNòK(ºè ÍÑœy ‰ú6 T]Œ·]†jfh9 Q•©_Þ¸a;­E‡¹öîÉÉÉÉÝ“n¦Î½6HzæeZRí¬ ~ÀÒ&íühº“Î ¤¬tl°;qš3Q/)]¾+¥.FÔr%C+ˆ(¶—UM.ÝS‘’®ëéjxušŠ+máK‡S§Ë©Í`MÚ ëÒäCT88úì‘xü¬âÆôi6&çœ^Òþ9ô3IÆ|Çv¸^½¸íQ·ìz!‚·#­Jû«·„ü¾c™×ÁäúNf¢%e¼IJ)RÝeÓhè¡©ç ¡6PÔ^²ãG©[  ?¯¢“j»ì[鸿ð­Õd¯°7°v‰N>ø”ö8ÚëÀT‰LÌ%ò%gOîj§%)@÷ÙéÌ9#o¼ØΚ‹‹æx»¹º:ÙZèúê1ê«5ëâ3º„$°¢4ÖžÝͳ÷¥2}_n² ¯D Îî´]_@Ý%Qp–í‚~ïZæ~ôƒõ àµ5¢ÏÂ)SG¿ø->å PvoD,%Ge¢^â_œ!o ¥sO\ÀMEéX=Hÿþw)Æ`¸Fp™Ú4ÝÝ«ï𠺲‚¤²²ª[¨Øø›Õf´ñjo1]r†Ÿ'þ݉…sÓŒ¯WÐÝ¢ö[éš^Äì ӫ%´«gɳ»éª®xoIºŠ½¯t4õ[›qµé/K›áÐYRÓY CWéý¾~9‡ÝÂéÓfc˜\g“¨&ý+©”Nk<Ç3çŸSjóŒ2ž¤Õ©+!Ÿ–Pm’ÞNm,vÐÏ×;ߤ6μó5Ï(éàª9>¹Š•Y‘Ú@¡h®?»?Ñ@›å¶0'ž[©ª-¨•åKåög ëì·üŒɯ´§è:ßµ¦ãyÿÀ`ÓÅ4Μ̈́µè¬¢z­—Þ 3X‡P›Š“;VËezå )¡66!É%Ôfù ³?œÚÐO øçÅïÿ›Âúò QX¤xÊ—}ÿ= &¢ªþ1°ÝUeëé6²¦‰6ùx€]nªQÇš¨º÷]¼»_øA0P­@mD´Ú 7(xÈ.XÃÃv&S›µ©ò&¼üóFÜU—¬æMEŠ[o&Ï„-©‡¾CË©‹é?ž%ØN,4úYí[QBE[—Á‰ÁGÚSgÙÓ„ò"gÛHR¦[‹d}¤Ï+š'6"FÒgXŒÐ=¡§ˆ–ÔhÆ óA mííS³®o¡ÔæéÛ¨B?tŠÕæ4Ñ€‚"ÓsVSC¦6®zë.ÈÚ>~æ W(ζ†Ì醑”B>Ü1Ózq»wŠÉV7é}«K4ð‚­UŽ•¾ .åY{+-Ôùjs{O”cTµ|z§iÛ€PãéYEÃä­ ÎÑV&ZRy³ÌÉnSòø1lc*V›ƒËÂLìÙ~çbC”;|—C †ø3†´ BÒþLeH§~sL$D¶ÍÇ@OUžª–nøækæÙyFAûûA>[C›¶w÷æU\žÙ#¢Þö+R0ઢ¿[òcyxÑÞX\TÜØýƒ?®)«j„Æjף⠻†ð=+ubOwP/Ø[ꊋŠjZ©\yÞRÙÐÖO«akU}ËKrŠaMYIyíc|ôéB÷¹ï©MaÂÅF‡ê§|Ù»cç°T*"ì~ù³ß0F?ý Ëñ ’¡£|ÿGÏHq¸š•¡ü#Š&ÉÓ÷ÐBŠSéá´iþ¿à}t_| úùOÛ—P›«ú&*ð¤=¢?÷1óÖGþ.{Íê„ó䃣Í\•u³÷§œQØVh´ç}=21\Jˆ qù­O&&ʃ”Бèƒ}ÆUåHo¯öYWÝ8¤nžúw³lã5OŸc?ªNÖeZ¦þÝY~)ù&ÅE".Á$¸b±T,ÉÌN2²?U.„ ~B¹ü9û~D €¿eÕüÙZúãŽüñ§.Fµ¦ §_/â¸þêÞƘ ú»‘iƒ@ ÞMK õ7!!èE¯i xß*¤ø@ @ @ @ @ @ @ @ @ @ Äâÿ—ðeò endstream endobj 1014 0 obj << /Type /XObject /Subtype /Image /Width 265 /Height 124 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16385 /Filter /FlateDecode >> stream xÚí}\WÚ¾éÙô²I6ɦí~›bŠ¦Ø¥Iï]z¯RT@ìô* b7(Š Ò© Þ«ôÞî… nŸ÷?gîÐÁ˜MÜ¿û}óüˆ™{fæœ÷”ç¼ï{Ê (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P ð¿ 6s±è Ãæ>åÙxjD&?G áù û½Ò-ˆfæ {Êkä;x\Î8cœÃãa@V,`{jœ9Åã °Ç®lÙ°ÿ 'Q'&ù|Áãó‚lÁðï5Ø߈[ à2 G€ÿàóð²eLbÿn ÷x“£c ]óxìq<>&›/PyÒ}\sáÍ­rJÉ%MüÙv¿¤jçW7›ӆµ£9?ÈÞ0Þ£¡¾7ýÖt¯‰-TS 8%$Ör* [ æ<Œ1³â|Õ,<›û¦æˆ„Ívس96ßRr-¾ÆæÈ KÆŽ.¦zî+È+œÍÄ$ŸÐ“Úbz\°dy-#ÛÌ%ù³Ìsåfó^^-ã·cƒT·¬38H›àÁ2eú˜%ð5E‘Nˆ¦‚t )¹ÄâFþl?ÿr€‚µw-¢¶Lw-É´±º4ñÍvK7râZ°|ïøx6Ó‚ºcf\öR2q8ÈÄóË¥ºÞ%ó¶äËKª¥EOsúîIKI‡gÒÆÝLT,E×vcðø¥¸(´ÔíÖ›ôrÓߺ[q“kHx]Û0—'˜ÉÐãåõq•9Å‹9Ô¸©%-?Ÿ¼;±Š6>µB­Á¹}ÜÃÍÍË'0!»”% ­]öXWBxˆ‡»»§O`Òí*üõ¡ìˆ&bêþáÑ5½™CC¯Ö²yó‹‹9w§«,3.ÈßÇÇÿpNéC>É@öƒÑÞîž^¾áq#,`õ׆úÕL͘9r;:ìׄì1¡ß¸ƒg¼½Œro]ñÖ°ö¾‘yò°ïÁ}/¤ò¦“êªÊ;äçåá|"¦ÎEA´šó.¶4üpÐ+ºÅæßJ¾àëåáæ˜r¯aÆœj)ù54ÐÓÝÍÓÿØý¦¡™ð¾¦¢3G¼<=¼ýBr*»É®„9t=ꄇ‡gðñȪê|EùÓ—Šs/ø(m×wÙs0ìêØc·“Ïûx¸»¹û\H½Çä mW.äñC>áåcÂ2bv'Eq;àv2þ.£`ÿ—L;™Ì؃6 [$-í¶)ŸäÍkíüÉ7/û{¹t÷M¹Û0ÓÅ5Üñ÷öòô >Ý<ÌBÏWœ½p¹£¥òJÄq?¯c‘×GØÜšü” _/ßÐsõ#ÀiðÿÃZCSZ)·¥wn`YêI¯š¼„ÙèlÝá—’–šsÖÁTß-êWîØÔ‰ZF{O¤¦]MŠ>¥«¦¸?²„ÞP¼OWLÊ<ùAe?}(ʧóùbœ³î$ú§ÏÎXADÍñBµܜŒÈ£žzŽ÷âM‚sÉ{‡ª±clbÊդ˞N6~ñCÝ•J¢?úfâ¯Ñ»j•6¬·öªëDzšÏü°J¯àvbÀºÍŠûNHJŽ VÝ,”…Zlõ­cCËc碮¦¤„¹è™¸O gÚÉoÕ²;}>2>¯ãÐδ³´Ûy)1-5þŒŒ‚ZþnGõ e¥þG“¯¦ÅžÚ-'gvgˆƒˆÕpo¯½eà‰ˆä”äË‘§4e®öŒ&uÖ²Þ}1.955ÅßEOLF9<¹±áN¼¾‚¤UàÙÄŒJꜻ¹²ºÙùÄkiWΪiü5ïcúkr, ¶z¼œš–²s“ÔÖ»­|Öè¯VFv“®§^ŽØµ]k•˜Y7‹]p)T[ZÊÅ+ðfA«Ð—™VÉÌŒC»}1qq1Zò^JñÐi'u¶¾“’’r&h÷V£ù}7,t%tí®gfß¼ž¸MGÒÄÙ7""&ïvº‹‰ŽþŽcã3f¨Q˜©¯()&))#; ñ¿ˆï kœzÊþÕ¢¥=“Dq n^:$%c]70ŽqÛ Öüp¬NX†ü–Úš¦.þ£(ÎIRñ “ðGY“L&‹',(çAg-SÏQ.êü™ÝÅΦZç3[ >YJ\ôÜ-¼U£Jo)¹ª)«™ßÔæm¬jv ‰¹ij­¯ì|êNi²2|å¤öDá .+Îoƒ¼ÑÝê6>JH³[\n{LµúÛª¹‡ß˜$t!5¶×Tvgð]à:joÚ™7Îáã’u•¥)(ª_.öÕ0½ç‡MŽ¸%ÄèkÊË/¤O‘’ûJe~%Z•vNßlgí‹PcÜ暊¶!³.×ZM)æV5Ãpï¸öæQQé³™ÃÀïqÕQòÌjÂ[1îWÞÏyP= Œ°"Àl“Á.Ü](O9ª eYÉêê±ÒÂ2“GëªÐ‘• ½Ñ/|8ÅIó[1 Ü m­Ü®ªp&íŽ`vØýËl¸e§£ŸW‹§.À÷[»†ö 5z˜(øEf29|<|r´ÛFKr÷¡t`Þ±R;t³’…‡ò¹ ¡¶ÒÚVEt¢%Dzn’Õh§¨1kPm••õ?{9;÷V.¼üÜ“žvrv-lHØe*¦kGýScN‚Š¤lzc?¼öò?oÑñ=z®°®‹èÃÐÅñˆ“K;€Â‹A'KeS·ëÂ^3\}ÐnëÙ› • 'ÄĤЧ}–Îj{-ù#w›Â·‰è;  àj¤ëÁ'BüOd<ÀÍx'ÑA)Õ¸™’ë­dr ±‡)Œ?=LEÆ"šÞQc­$¹Ã;äJRJbbb•x'C 3ç`«ØFWåÒÝz>1ºU|5T\R!èrúÕäĤ¤Ô„èC›VnLDí„ÓR–î½Çi›Í6{;•Í?ê‡×â¡ãíE;ôäT lŽž¿R×3.ÌU}N¼¦ŠîúNa'ZnËHÉ„gàÔèuÕUöÌnâ…35ÑsÔÛqÛ6[;{S‰uZ;F9ØHÓ?)›8…ÇÝ蟚ªÝ5É 2é#d©Mfº|µÑ Q£­ §Æ¯×î. ®Í¼¬¥nô ¹—ôžˆðÎ’\Cyùø;•ÂÑ>—yÜ^ÏdoðÄè]SëÀ‰Ì¿vz¿–ñA"žá¿M²ª54 ¸1cPiI+¤”=œx/>HÉƧF„£±”c:¼=?Y]Z,¹¶—P¼ì þºê âÖŠiî,hÂæQc9 î´T2óÊ€9Ôˆ¸ÙP&&¦T1AVËDO½“®ŒÇµ KÛ¸^³~„•|f—_BCAB aÐÍñ¶«ë7Iæ¶ 'Ö[ÅÔ£©wJ!A¨¡Ö*s9 IyEihoÕÙtz|¬ÈÆ@+± ‰ ÜO Z÷óz% -âu Mí­š[/wA}ÖÉ5ßmp >w÷AYmsÝ~™•:áõ¤À#­§}vh©*ŠmZ§dîÓÍƪ3/«*6u EŸêº++3Ÿp˜ƒ»46KêÚÅ\ϯyØr}¿A ¢åÓïµQU”ýå»ÕÆ1t¿³RuMR\Š0¨f©AïÈüE4ŽôÚ!ÃÍlö8“ŒqRpl þºü«‚ÓiÍ RÊId|Ðú«ù7"‹´Æœq¤ŽüD­[udì“´ÞêÚú¶ê{Ö*2²ËHŸ„7ák¡f¹ï—qÇtšŠÿ5l}êp¼)^v“رÔ"ÚØ8½÷aÈ~+ Û#} Ÿ^æê°÷N};>:Îè s0Ô° fð¡$ÁUd˶kjj²¥º¸äá0‘¯T¸Ö˜KS©Õ0^i©"æ”ØOéOðUÑÙ^Ò†êé^¸™Œ³§“‰C7ÞÍŽ—n7Ó×R–Ðd#o†x뢵+Ëì »6@¥ õÝM ó=—#à1Ïï7Ó°ukžîi¾uHIüGUïl¼¨½“r¢¼¹›6::Üßîc®bàzžM¯Ý­§à~*±kp¤¿«)ÒÏn³¸ü9‚»§©Áè¹#³fã™’þÉqZ݃ô½– «ä,šFK2#]=Ï·ôŽ2èƒ%º¿¬ ºYË~h¡(êš1Dín.u3UþAÂ|‘ÖÀó3óª U5Tãa©¹+ôÒÞžÖ“®º:ûÙ´³ûŒ,÷†Öu ŒŽTßMV”‘>u½ÆrŒu(j<Ö”_ý«2k7].¨›3åÇËt1ØW9„FË®GÚZ››à;öÞÃ[;^Œ >`dbdbldllhîì‘UÖ…†\jÓ×­V°ö¸]ÕpÄ^EÕ7gŠ»`„jÀJGTkwiŸ –;ËŽ+BÖZqÆ^GsccSSk‡=I÷ÙD—7XžøÓʯMœÃ„CÉgì5>ùÛêÄ^b0›¸va¯˜æ®ún’WÄ×hžÁ/=õ'|\ õMŒL-Ÿ«à=[WYæÒÜ× Œ>»2+v—­þ‘…õö¨lœqXgÉ ;U m}—}W‹s£v¯Z#“>ÜSÄÝÙÔÈ/ #³ín‡KZq»‡W{ÉTGCKGßzûžsçÂD7m»Ú ün;Ñ=éõ DùÛÉȪ˜YÛ{†Å4–'jmÙ¨m´3½¢ÌßÉOÐØÈÐ5øb7îðX÷RN©Èin5pÜ’ëøé7ªí ?,3—Ø–tKXš_Šì¾",×®ªìÝö:ºzº::ÖÎ^…ÍHã ·—t65Aåif¹íd|nèOSWPL-kR#éÈNY ¡¯1sà»õâ•#”¯1íåÑêªj†Ç'±YÂF»jš;™a t4•—VÔôÓ&f]@.³¥¾º/¯ìŽk`ÝRWQRY?Ì`ö<¬©é¤ó fù8-M54!3œ‰ö‡õ½ÃãÂÔÇ:*JKJÊ*Úz‡ù¤Ý€ XŒšŠ²ÖÎ!Ò¾éh*)©›Âˆé:ŒGì¨mlŸd ™ ´žÚªFrl‡=>\_]^RR\Y×<Î!Ràқꆓ³ª  ÷´”£ì•·õÒÉÌñ¹ƒ%ÅEUíxŸÏcŽT–—5¶÷!k‹AÆYVY;0Æ&[ŸÓÓÚPŠ'Tß:ÅaÕ×T÷Ž°AÀn­¯é O ×tpƇkÊÑk½44bÐÕT]RRÅ‹Þ‹ç°¢¦q”ENÒ x¬Î¦šâ¢â†Ža`õ––׳Àšh©­éVJwuiUûðt‡Ñû;*ñhÊ*{F˜³ƒWôZZZßÒÍ%‹ŸÖP_O›` MÊ‘¾öºÆvÂéîPgEu-“KñbÑìè¢ÅqKOŸbšÇýÙÕ…«>槴ÔÌ4Ì_á°ðe~bËF7Wªß“efŠ±å_´¾eÉ!¶¤ŒØRÓ÷†=V ,-"FMˆS @ ¿×¢ZZ¯?òÖ“€9Kv±å™?’_XzoÇ“Ê+¶0êÅÏŸœS ¼Ìµ[y<.‡Ãåó±yF'öŸ%Ç<: Q$.—'øód@r8üi_ƒôMY“x*O0£é¡ñx¾`ÎzYL˜?"iÜùçr­«¡ðÿª¨-Löt531µ°4·Úæt42u€>¹Ø%›ãý-Ó!/êòæn®˜×èañLؽ &†›‹owSŠ áÊú. ÁÂ(~{ËÃÜ ³CxìÚ{przh‡u÷JØnß_2±e“Àè”%öß-_3KY{šKØ›¹”˘š&o¢üFXÈùkh|p(ËÀØòVÝèÜ[69jkÅ“¤ÅLÙ—$QÞ¼ÙÆû×Â’’ò²’ì”s†²t÷‡wr³{ÄÊòc+‹o-½×€ø9ÑYjo[øX¤Ä쩨nšâaKÆ°\Š‚9;1<ÒQ’"½fSB»p®[PŸqLVVçBf{Έ¥FŒw(iIU‹~ñY—ÜU6lÔ¶ÜÙÔK'àÐ3Né:ãpGjjëfö( ÈA4Á¬º[¢&€š‚xÌîxª»g©*¶ëdm‚3s³¹(}§ãîüæ>aÅ”ç\ öõ =UÐÐCîÖÀqa—ï õ7Ü ôr>Ý:†f¸ã=á§îՔܼèåîqúRú8ŸK®¦ðxùù„œŒlâ 0 ®FžðóŽË,ÃNœp5‘ß"gcçr³¡ß“ã94IÂg–g_ ð=tät~ÝÑ~p"u¤]‰j Õç%øûz‡žˆj¶zþDfì™ó¹¹üy§³4Ua“DRz¨»$VQLühZ¥°‰ åzÃŇ}ü‚â³+Y¼[øœÉ¼ä ÞÞG#‡Yb?*»&ë\R~}oãÝP?πЈfæRm˜(lFƒ«¦ZTòE'CÝèÂ&¾°]sèY§Í\OŽñ•GŽžjÍ>áw¿eVµ6§xG•C﬈8âë”t§‰HI@‘ã qÿ÷NÚé-ú… }Ø2ýa‚›Ê/Äwxy:[þ´jË™œjá6á€ÊªïUŠ˜s-Fr_0xM7ü%4mhp#ÈJÖ5vœEìßš¡þ`o†͒iU“¥gu¥ƒ§¦ŽÝ¦*aås´áÎñµkM¶ï ðÜ%·þ;•ý×€âÅ“²§P·u#Ü]ÊèPC?oÆò™kç²îø¯\%ÙN.°ÊŠrß(»³yoÕØ¡[”4íÉEpå¿n–P)jãÐÔd7ºøžª›¡+v_mÙ…›õm¹§7Khç5‘ËIS<Õ~Ô9…GŸqØBÝ6pè±–x…-ú%h«JÔP¶(iFV7Tú½~k3×Z,)¥žVÒ'Œ¡ê¬Ù·"6h…Ãxe€¨’[ü!# D^JìØu4MÌ Ð'Ø ÌœJb²g³nhoøÞ`ÏÙ9¶ Ò`{4×kL>ɪM–—R¾Ý<€ßiŠÝ¾AÞ¶™\RÌö1“u¹?rë°ü/jNEäòn#¹ Ö¾7—5=d£nµ?—±§$QVD)³{ æj <¾Ä"R©etZÛmu¥ø&BlFµ¦Œˆ{T5Ʀù™In?–-Œ‘[½þç ×ë;ž50VÚ©ýrV‡›†ÓÔ˜7Ö˜âj,¢c;6M•ºìe ÙŒ‡ýBjè8§M;·ñbâJ9Í#z½†’dPT I¼ Ïo6X÷aصCŽ2[M’î×<(.O‹ô\õŦ|Æä!=¹½'b80»š¯öº‚KªJ¦÷jûg¨Ñ4¹¨bæRÎ$EŒåI®\sƒYá¶MãdڡΪT–— ‹o^.ߥ״%%å•vتªéfÕ Îz^ãUj?~í_^Y\XPXTS•®·aý› °hoQÙ¶§ ´¢°ÿ§,d»Ñšõ:}ÀËÕÐuçN—çamåþ¸$ô¡Á¡aü?›‡äšè-Tß”1ÀgOrû+­´¶l;|kj sÇûw›¨ËÂï·äœQÀæH©ÖºõnqùÅ Šªê3”¿þnÏ•b ¸ñ¤¸Áω ‘Pp¬ì[r'ÜÎHÊpî~ui±¤Ú^ QCRgOyc0^\\)—¤†Tðer÷§ÌsåFë~vÙ{›„¼†gèñ`¾=Ã{4ä=ÎÄsæ%Ë«+ˆY@ÆNn”§ºåþÆénü‰råÕßÆÓ™¬p³×>•Z4Wš—sö;KÓTÄE¯£mP1~v¢vE­d§Ï§ß•ùá'sŸ£Ç"†„ø{zD–öâšiŸ¢¤œ®YpèRú C‡Ÿಳn5Ü3ù9E{÷‘¡'-3K3m]ç’¤¿ Bu¾Y¹ÆØÉÕi»ã®]2×­U¶§óÑš®EÔþäÎ:öÞ¸X1tÕ½ÒñŒÝ–ù~Í6¯ °ÐB´ €€KÍðÔ'ì¿— RT%Ä^+Ÿ;«À¥w ¹×=’ínºVÃjtZTe]–•¿Õ:$5²–¤FPLó\j `Xö' —Žù•Èí 6’s>Åž®àÖª²N&¯áAŒNº¹Z£()TÑpg1múÑ¡”M_oJÆm.f9N“©3Z£b.5P!_c£ÄU´¥ï³;·©iYyw3ÿi²Iû—¯¼Ë—Ｉ¤Îþã ƒ¹ÌÌP5-§Ó“dar=4ä4wO²‡Ócc“S’ccÓ»l˜¬ÔY÷‹Kè¥ô´«ÉW3sbU^w¤d£KP°öâTS]«’²êZ)õýxÆiuÆbg+X‹Æâ(b<©*ÀQî¦b"’q÷Év@kô6W”4Ú_ÞÏ…¶èŸ¾\sºX¨SxWYn6 é¤s„ÔÐ]ŠšÊRÁs¨ñí&ëA´3vó/2IEíÂð»g]t÷$á÷ó.¸ˆ(o¯A~ã~˜ˆˆQ­ /)È›”µ‰V|½A§y”×Q‘!/*}év0†Ë;~Òò@ šQîæ°õTê\ƒJ:,W'X[}U]×è‚ #eiŠ›¶G¨Ð˜OK¡«©‚©G ù½\c)K?¡G$hÍu´w-'ö¼wßöûeFN¹|5ÂÏÎ./®©[Gä¿5¾YKŒ3«ˆ®Þqj!µÊ/¸¯“-¥Ï ŒqSÑ:‚ÇsÊÜh÷)†¢Bjàú«é¨¯ƒ«‰žåî-Ü=ºCQïYR»·Ü06³¹Û2A5ä'6¯!48h—¨ʈ­^µzÝúµkÖmÖwp/l ÞâËž2¢›TôLtUå·¨mË«~U ó²Z£ä˜NFÖýÓÏâ™ Ãœ‘ZYñµÞÈï½°‹ö|ü­!2ŒØ£yç÷‰‰ˆkè¨I‹‰Ë\oBm…5üðäõ"’òÒâDd|¢ï"ž5YH¬ùe톀«ÍÜ"V*6àÆo,7ÒGJRFßÄDMFZVÓ$«Øu3Vâj&$ážS¥â›×Bܤ»é‹)øäÎÝ0‚l¢DÑï‰k›ñŸ öVœÌ†^ÈbñÕ•oª*'.£ ¯·URBÂÞ/zt’ƒ†iY£‰Á6b¢¸üz*Ò"’*ö%t¡:©+¯¹í ¡‰‰‘Ô¦5 ºî] -8†½ÚjIó¨™1Aaª}÷£þöë³E´Û'u5#­Ñsù»UkŠ„kïy¹q‡þì¯v¡×ÇÙ VtÕ曩ËÈ(©êjJHHظ]š¢üŒ'Äy E0æ­¯·§»§g`˜.üx6=p>1:ÜÝÙÙÕÛÏd 'ј}¨§dz8o¢§§o’ÃÇøœ¾¾^ú89E"`Ñ:»‡xÓ»&èCÝ]]=ýŒ)á¼J™Ïeôvvu ÒÆI©0þäØPgG'm‚#`Ñ;»8`ÁòœeÞ¡†§(<• N¬c:¸ÖXÊݧ@áÿ0;øœŽ²kéÂiR¼ø_XÁ‹-l¹µyå¹üîWÚ"KFû±+á÷=b‹ë4} KáI–öRw†Áïqó°é/$`‚ß½Á[ÞCøÝ›ªfÆ¥GÂf„‡Ç[昙ÿúúžHi“í`²/*d¯¢´„ˆ¨˜†©Óµ­‹}éÇA~¸®œåÅßÝ¥ÍQ |=.t¢”èúbZæ®ù‡áwnªš«½fO©xÔ^ò¥›?È{óžâþ˜Ñ–cij•QÚI)ÿL7Ôv/^CäE3—³ÑqÉIñÇ}]·¬ýÉñHÒ0{9…²T'Iü¾}J]Âøü"uÉ[Ì«^áïžâ ÑU2:ö1W’“y:üôí¡I¼åO‘Xv8 Ým°íz}«`ž™4çH—E¸aó¥¤Û¢ƒ:°ßH둧y<ú *l©2 ÖÛû2Öše¢oz³¸ã·À–0…Ç·`„…6Õz›æcŸ˜¹M¢½$IKRýZjW¼©±îŽ¶ÖÖ¶¶Ö¶Þ¡Q#›»€KêkkmiÁÃh !¨Áæáoàáýà >&ncÅnoC‘töL;P±ém}d âôZÊü i65G’®OQqÌ4íËe÷vw¶···¶¶ö Òˆè<¯ÁþÞQ:m°¯·»» ¿;<: ­-ßTÍ(:÷~7mw˜z;zÇû»Z;ûè\>8̾.<ž6\¤îþabÓ,5ø,fw[+]ø}æY¶a|öxoÿ cŒ>Ð×ÓÕÕÙÖÑ5:ÁÞb3=H4”ž!:‡8@m®­…f`øü±a¼Z[>ìîæ sÏç1FúÑk¨Œ»èLÎ ;ØSãxœDxJ…SÃÐüƽºþÞ.ÞÑ=Fœè€žœ }`dŒØ˜µÈ´¤ð{r?õÜ ­; ýØS„ÏeÐéS¨ò†#ÜlÔ´õ·Ù;X›ê™»äÕ“û›:ËÓ 4 Í­,M 4õm¯ÜEKÿòN«oPÝwö¨÷ÎíÛÔe¥TŒ÷6 Oá,zXtÍÑXÛÔÚÞÑÎF[]/$>Ÿ‡-tvÓ¿ù^ù.Z%DZÒÄ|#¿­¹“-.søêi/#=ÝmŽ;ìmÌ45M£ï¢ý>0Ràd*ie¿7$ÐÏÓÓÍBGÅÄåH[ß@bÃ梶þ‰÷œ1K•o%LB÷Û\Èeñ&¯ŸñÔÖ5°µwt°±00±ÌªâLSÏÅPí}S)É Y³¬ äa4¥éh+í9àë~`¶‚¬sPì:I¬72p—ž±ÃŽöÖfzÛï5-òêù=uy»mŒÌ--͵¶†g4â·úêrÍt L-í팶ªÛºŸ'Öâ9wÔÝÈÐÐÆÖÖXWËÌ%¨~˜Çìȵ57t÷ôwßçbgk.+&¹çHÂ$ZlÙ¼ÇÐÈÀÖÂÔÈÂ%§¦¨å?Ä NúY)ÿÆ>îÒ¦³Ôk¯o)ùTî)g=óãéÄG1­=ñÄÜ-+òÐîmnç'wJ}ˆæÕ´Úßt]^b㙬¼eºIZ^ÆÛs+lÝ&•Ê!6Ìßž³}Ë[CæZzs,AsQš¼”RT.¹¦77Hg•Œ’k¼2Ð^BvÇâp`¶æI‹‰žÎcÁd‰©²Nfë°PÝì5Û¬máÖA($v驵?KÄU sÅO ?(¡îR;ÀH·j ÞäxKCÃÐ(æi `våïÐ^cy8E¸]©ë†ÿziíÒ~¨¾qRRÎ0§Q¸¾‰èg¨dz ‡5×±ÁøCöiYzF ub^ä> “@œ ãÂΧ±I_¢XîÛ•Ç VÕÞŠQR6ºQI¬kr4Ô9‘\5ÕwÏAs­™ÏE:Qîµ1{6ÈëWAeÚqY5›»m¸9q¾ÆzŽc”AõïTÄ¿¬´“ûä¬4 `þV¦™Ê®Ž8ì¿aŸ¢ˆ²WòÞO±µ~þ>¸Š|rb¸¿½«—OTâ:‡IÛŒU¤¡$u$¹ž;Z®²fõöÓwr2Òofß¿±åÛ_‚ ºH”l.¶ÆòäBGZxÉç܉V2r.›¾=œ.¶rCÜÚ¯án«v$õ—¸ÁF‹Ò&v£ÐXYçz}§€ Æs {¯Ta|7˜mÒÙÉœ^N\Ÿ—¢&¥”Õ4Ð7MåÌx¼Ó¶Øª•TôP4Q±^R» …žâ îvyxŠü,jO}‚¢¬^V×¼U²ô®j[YÉðœap3µµ¥ É `×ÝM ôrÛ»oßþ½»d×}皉GÄM?ë®±ëDÛYSCí­}´ F{®©–fRq+YìÕ§ÖIê•vŒ&Þ.eê–t-ã&Búå3{dU­‹†y7þøÙ1‡Ä•wÕ´ÏÕ³ÅÙ—©'-¥kïyåêìÌtwk 5ÏDœØÄ}éo×D§œÍëœç†³Š5R9Ã9â߬Ò0µ¶±²D°²Ô×Ô Èïi¿Ar“ˆ´”˜´ºSC?»2@ñ+É=œùZƒ\6‹±3#=5,÷7’Ÿ¶Åm˜rå¿ižÙ¯1o+Ó±¤vé±ušŒ=R;‚ …r…;˜Éšïg ÈVÓq¼tJmOoú¶Yj`€-üevä˜_{ÐFöñuç×Kn-lî‹ò²1 ½Jã—`}͹ZòÚÉ•uGöÙÈHJÉH‰ê9œªÝ*&s¿až^æO–%úÉHix9w-=##-^sÓÊÝY85&“Ží2ð8×Í&‡“—tÃÇjN¯—Ò/kï¿thÇUs K!ÌL-vûÞïcS6ÕAõí%q±èü&>6ëó]§ÂŽÞjLØk)¢i݈OFzY©ŒGZƒÕ¤óów~Uäû£¨k± ëO5¢Ï&³8<—ËLÐ{+ËË+++*«›qo’Ó½ñëÕ>÷¸0ï,zÞ1«ÔÆѲ¤`eçÒéã´x#Ù߬¿<´ô~ijè,IûÍEôÑñäÖÅ[)êRJ™ÍKj ˜¯5r, ÓæQ×´”  ¯Ø)rbgC²’´~Nm £©¡¼®©o¼·a›Ì–3ĉ!3s(“Ãm®ªÒÏ\a‘'+·ê®ûš /㬻ºëqôUô=‡éª–EÔÔ+ëMð·Ó Lìa‹—Íápyüßuê;…%†[Ùvd—þf ‡¢Æ.*U‹9’úëAqqâÎÑxW3qí#ÄWAò¶«¯–ܓЇ֑ò|7k8' ‰{i¿Åz%ëA.–·ˆ¡IÕîÄ1 Ÿt¼†ù|Œ7TqþBÊ(‹¿X–£;”DE•³šè.ÿã²Fj­Õ+˜ê*½¦ ¯›Û*\oZzFÿG™]ȼb,C Æ%­¤ê6_€ ª9ÔàÜ Y³^%·eðq÷þÚY­]ý³¾†€Ë¦ 1§8 l)jhÝkáÔ¤Ÿ”·+mæòxœ©ñœ£&J–ýìùê™Ñá¤dã;FZtÙó›¯Eo2öªÊøD\ZƒEQ;×ýøƒKrÄknÅÈÉ™dWtqù|§ÇnÓ*sÿæÀ]S}“ùÔÐ-éäU\;&!ïPÖàr¦:«²SÒÉm;þÈÌ6ÖzÈÙ`‹Œ¢Ž‰•Žº’‚šq*1ëÇ+?/%.a½Ï?ìÇö]î=Üä4ƒï⊢ûAœÂq{×}Î6ÒŠyíÒ&³ÔÐT’>’T·µ–üh%I)ë]îÁ^fÒj¶A4¶p¢„ptC56‹Kë™Z˜›ë¨Ém–7½Yvvð™C±Š†~!G¼\·ÉIÊGÞ'f¾åîó·2©ÈKMl¬ÛÛNOIßÆ-–Ïç£[S]E'ƒ|½ŽÞ}Hn¯nÊ»X@&Àm?u,·‚©ÈŠ÷÷t÷ 9YÜDžÇÁ¨½ìuô~s¼·õâÑ£  Ø´ÆK‘«ÛÈS-¦ú ‚žmêºÛŒ¼¤ ~Þ^‡ÂÎVøœ/¨ —”£«á¶òðPOŸàÌŠ.¡ü6óvÂw7è,ä¡”gú ¹^&lüŒ;W/øz‡†Ç÷05TñBTmû)@ï࣭CBý4‘ŸrÁÏÇÛ?øx~MYj=þ ÖX~ÃÅò‡G,}¨L·dlîw÷–ùôàR³ãØã ‰=ú¼ Á{7¦—-)û̪¥OôÀ–=éc9Ù`þn’¥¿¹Do%”bÑ®ïß/EŒ?AwÀ£>Õ½`IÇë—Zºˆ/‹Xºa,½òv‘hË[ƒÍÏÒì:Àå²·ÄI0óVp`ËepQû\NÄ¥–7/J[X¼°Üa7þÈêg (P @ (P @ (P @ (P @ (P @ (P @ þï`ñGn(,.¤™m_Øìwî°åËò‰Ê°`§ÖÜŸ8ñ`¹×),.¨ù[õžHµ.Y nÕ,·µïO¯÷åŠ [t„“krØòò,'*<Þ+OCýTItï:\½]´'ÜÓ>7³ô°Egy<ꤾ?5;#5Uó“@ŸD„®ˆ‹ƒÚVàcr¢sããs ê\N…‡ý ŸäÑ¡è&D¦ÂØIJmLÀ‡ûW!5ãIÕøo-““01õTÐVñxã}ˆ)yÖÀœF;ÙÝ6°±G'ˆHqÞì]ú(px%aÒðyÀ–)¼ H= Ö¦`b i¥>;„±=8+V€æîéÖÈ:ƒŠñè–Û`óÿütñ̲ˆo5²ÇÀõcXñW8•±°óa–ƒÉ—°â-¨k[Ö ÂV} Þúâ‹Ÿ.ÅAJÒ NZ°ý0°xóoaÕgÂRgÄþÛY”~^|¢Š–¦öÈß©Ä;K@E^^/¼ _ÿ ž]ϼÊ» ‡øBùÀUX½’–`™ã`oGÂ/« ¡gºÏæBÊ)xýEÐ4¹oàýO!¦{ºd°ß§Ñ]’´zˆM‚¢Zòç)+XµЗQÐ݉‰P߶¬ÖÀÏT[ Vhn†³9D·Ï…š ¸rÚ¾È,ÃÏaÅ+PÛ²lT85䟇¿|—‹žFŸ7/>y äí¡»  Ñ€8ÊAøec…‘`ó`‚´1Tìl& !Ž˜m*ƈ'§Ød´“è'ÛÌß &&Ñ“ üI:Q2S(|Š3[ª2oÁKoMS)l£“/5 R¡fçã±ÑfûyèxZt ÎË ÅÓ£Óñ˜`‚ÿW{xq¬µ„¡a^• bÀŠ— ½Ø“°O]‡&ŸK~u‡5 ´§ð¨qLXÃ0Îe„5 ®F¨‹Î­ âƒóx_z@Þ“‡b0 à¥g@4|NÓ"^Gçžó‘´£ ²•’ŸïfyƧÏdǦ?ÎË)žÙéïñ&Q.“HTlV}+Þ€°¸À‚áa˜d… ”œ‹’à “Éžå)—…âœ$ª`| eG¨ 9lž_}øß(ñaäóûáùpàŒ!ÞMÒaˆ†R$iÁEOŽMÁT ˜üV¼ŠŒº™¯¥³&@¨5^€W¾€Ø§ù9¨Ngþü|п?oáWÇhðÑ;¨´«i`ô,<ó(èÀßß@ϼòœÉ%#©Î‰oàÙgˆðÀ- z[Ï‹Yøg¹ ½ðË?aÅëpÒ^#^yá8ÂÚžKŠdù’Œöù×ÁÊ º›¡Ÿ»Ïñ8¨Î‡gVÀCèâÁ`øç{DBÏÀÇë!µœ¬‘7á¹çÁizrw„XÃs+@|×tÃãÃ`tß‘[ùþ¬¨&0pÒ >ø ççk!øžaª1¼¾¾õíÿA·^|nö­MQDë`B -¼údß½ (ü:}¶Ìš"n*:ÀšOˆ·^½½0Dpªã¬úœŒêÅ—AÒÚFÈvuPÞx™¼õöç\Š‚ï;£ŸFÎÐx ¾šþÙ—a[6d¡ëýGIc â<|úùÀ+¯ƒ¶ê‘pʆ1˜€µ"*üú 1À»Æ¼sKTߺ pâ̜砅 .oÁŠwàpJe¨Öý“¸õHˆ‚2~ýA €áFX÷)ùâ m‘¥÷tRƒìuÙpÎY2PY‡lÔ¯VÀk_B‘Ü#ðúó°J°)°~›(·uxl•Q3{ñKÄ ÉÐþÝ:_œ^Øô:¼ø>Ķý«àè.»ÀÅ…üÛîWp-Ü¢_åó&DÜ„¢¸¾ƒ¢ÖYjDãÆ9 ¬Tá™— 8†jáã—áÕ!ñ!ܽ¼Ÿë:Z‰ IÛÑëÞça(Þžyî@ÛmødüC*(NùQÃÆ9»r3D\‡;‘ðÅ»è­OÖÁ‰ËÐðz‘B]AH~/¼¾‘0É…ú³°ê}xé ¨L?ôÊFmÀ›êm{xûxùøèK0·…›I`𠺛|ˆ“7ðâŠ@E„¾úW8S€+`N‘}çY{xƒ¸åx®‡¿½ŒØqê@üåEXñ"h{Àƒ[°u=zFÛ˜ÔƢ땒PÑ·ÎÁÂë*Ààp ×uFѶÆÁÇo¢¦Ø0„´” •ÑÏïÔÕpüÐ3A©¤éèBPã8î†Ã—D‘&Yî,€¯ÏjúR¸ž YEP^[¥ÑcÈUyµÆôEZ¢†º+LvéX/|º~Ò‚–2Xÿ¬X‰T‹V¸õ Ùfp|ÿ"ò^·AúY”Í×ß‚¿  Ÿý¾_»½ ¢ "#áÒ¥Ù¿Èh(ÀÆù V<uDòÇည!,s5Jþºt>}Þþþõ%¼õ*§DôL´#jBjq@Ë'úÕ(PK]¿ó|‚‹ñwøÇÿÀÊ >¤Æ³/ÂÅÂ…¾gCS]øì-ôî™t¨ö¼ðœ%lÅör°U€g^@™úŸ ‡ý£-p—…¨ñNIÕi¨¬7¢J‰6P—†®’[xáØw˜]ðÑ øZž|§ÆK¸ØÁÓ.|z^Ê” v›ž!ÃÀºÏ`Å?¡uø`¬¿CrYÁ.ßEÏÌ¡7>'¨Aœ™5MSÄàÆÏðÌóp ‰Œ¹0>zžY‹L!5tAx S'ú¹Z˜t81¯ú¢/¡Þ‡ïÂöNDÎ,5ð^¨>ÿÝHÄ®‹/ 7œ(– ÞðÏ¿Âso—ÿ‚·^Eºÿ”Rciç ­±‡ðÅ0äë푇wV‚£&¼ƒ+ý8â»ÃBj¼Yä[¾Ïã†Gd^ º{¸_ÕÕÐÔ0Ñ ûŒ—0Võ]Iƒª„ †` ö食á·f©q¹æ¿þ¯ 7ï@{7¨}ˆ*Ý9…hŠ-ðÝÛðÒ—ðëTòÁD ‘"ŠDí4<¬ƒšZhiƒö6˜¦ÆK¤ÿ€¤ÓÈ ›S!èÝÇßSƒÔì"L‚m' ¶j+P)}( ÷Ø$5þª»•íDØ…ˆïq ©'s)xö]PÁÝ—áTÁÜïBã3Bj¼¶ÞZ íÀGâ]ÿX( GŽðËŸCñòMÂÝÑÏõf0Æ»1` D§kåuè•B>”ìGÏÞAhæb}Iƒ ¯Ò¬}èú›á!î MÀî­è§²zk–0K \kpY›;¯úòò ”¨#o‚–'Ð wšÇ+A8ÚfÇÑulÈÂ}†^#œ»¯psnÁjB¹øÜF½‡üSL|\½¾ˆŠôí·á Ñï U1Üñ…ôMSãMdíÿí øäCx“´Q™î÷ÎîA…ðê»ðÉßÑÅ{kaèéuÕ›°é=xõ=xŸ`œ©73H¾ϽÑe@¯%5Ü:zùM8ìO Ú¼GvÔ€çŸE2¯6›õ ,Ö gÞý>"J^Ï4d>@OF> lÌ W_‡wÞ†W‰aŸŸô¡…>m–¯€^gØk,·—Þ†O>€×VÂtk½œÕGÔxKk:é)Ø©‹nýåyXsØÃð=áØ~üüý¯³].nsÊé!muÞ^]Ÿ~:Ÿ‰nö_âPAøᦄ`ïÂß?„p1~€¼b¶å1L÷ |ú9*äꚃ×Y“Fà3¢ÖÞþX¤@Îat½ï81JÌ_YôóÍ÷à#â™7e¡›ŽF¨J‰nPËŽ¤Æbñ[åG5˜“»Q-?û |¼êp¯ü]T›a׉±;ÂÃÍ×÷ÿß~¿|„(š×`¡üÖ{ÀŸˆ¼ú<ûøVƒÎ‹ð§óà©\%‡«§A[ôm i‚¬ëSD'y0•Å% ªOáÔ8v”U! zž//, @]ÜŽ# ‚姄Ôxšhpv¨¨CHŒOÔû˜€ž äç¶4Ý#PÑ´ 4á ªúNxèx×÷ÒóðÒëM›7ò t5@[.\ŸMÐ×´õ ¯yÎœžt èiƒ†&ZB|.‘MáªAءʈƒx{å8èh€õAÔr:JÀ@<£!ïº0 °·\¬AEÎâ1Gá„* ]3¸rŸh3'AKFIœ#&V  ð2*vKW¨êš×(O3]PÕ„=‡¡“6>Õ@M å%4& ¯¹1Ä” pÚRªI½­ k ×›¡"ää!æ&ÊÈ3Ïr£Á@Tµ ð"šº¶æ‚G€p®£!åÂ%è‘ê$œv °=t.D™´š"­µÐRsälF¸ÁZ5h%û˜è›­°Õ2Ëï ܶŠäÂa}з…{ÍOãB‘Ç8Œ¡±‘M¸ù‰Põ5>‚s·ç¼+˜^ù‰-=öµ4;„ÔxÊû¾2o “`éùYܘbÃMOd–¬:§¾–8¾bႶÄ* ycX<·Ô ÁÙ{ää²Ð×Ðð{¼ÙðåKrnasü{ÌYïÅy&XúÅ…¥‡Í˸`¹™wÁo‹ôT-/\¼xoxª?À{¯"=Üéu›S40~9§³.#Áæçö·W±vÀÏŸã9}ä{ _Y´Ê›sÀGA ¨6Ï»ŸAbÙœ…LƒG‰÷ï­ÿ\²Ñ.ÌÂ,qgïž$Fä<~;9lÑê¯%RÇ–]þú›¼À,ƒÅ¡Ë6˜e;%ìñV="Ú§pÍ‘ÇÝÆ`iGc`Œ;+-‡‰†L­öC~ýN†^`c cÿÎÛU9°Ë- L)]¢åÿW / vZÁÉ@á¿‹-¥õ8ö§%ñû¢Âà1Nqú/(ä§Ó„ ðU¶HýaØ“Ý…ýþ'±ÿ~^`Ø¥ü(P @ (P @ (P @ (P @ (P @ (P @ (P @ (P @ (P ðtàÿ&_» endstream endobj 1026 0 obj << /Length 895 /Filter /FlateDecode >> stream xÚ•VMoÜ6½ëWð(ÍoQ9Mݦ@Ñ&[ôVâz‰JâZ¢âúßg(J²³Þ8îeI ‡ofßKÐ "è:ùi—\ýÂ*q©˜B»â…ÂRHTEÉÑ®AÒ÷Ó`ëÊWYÎ þ=š!ή'Û˜,§$} ïLkªÑÄŽ¦Ù§ÝÛäÍ.¹M(D$ˆ¢‚¸À)PÝ%>Ô€ý-"˜—ÝÍ^JÃØ¢÷É_ Y²½M˜æXÎL\È&Š3IØÕoæèg{beå£Ê‚«¢˜S‹úÃyó:ËWéÑeL¦wY.(K»©>†OÝ!Žþhâd0·“ýUÝZÓûhÛ»æ>Îìl?žLíMóØÌÓÚõ~pm»Ùûô@ÁŒèÀB!àWh…(û‰ñÝ5¦èã#cÀ³´Ìuµvô§-æGBØÍ4dT¦•·n :B‚ác¼Ð{Æ¥æR¬°_lõM¾{ä ^b 9¥¸”2nZËIyk;ëãÖ³@]¬Fã½íoðB '`AñÀÔ=“rnœIÇØlNh…Í9ÇZ-J>zú<úÊ®]cž+Ÿ œ _*ù'$µ”Áû\á’鵎§¡Î"h…ùêÄ1K* w®±áØ ÍDl-¥ v\ r ãɣݷ¡×Š[¶V¾^r "œaêªmï£[Õ7qÑõÑf ÂÑDï»ÝŸ $?qy­xeÐØPfNö³g‘N£Y–ì²R»noûE¾Áp7ŸDp†Ú¢é4˜ý‹uÓj ¶(…=®x y^ÛH£¡µKŠOV@+(]®‡ÕX`¦¯/©(°f«ß«‹}¢$–ä¬OÜᲿ€Ç%hW=(p©éêл:\¿ßÁ‘?ÂÙ2üÚþ89“@™¯ñ¢ JÊP\K΢כÿªî4 |áN½[cUÿ§qh±¹‘ä*‹|a6˜ñäú.ù‡7ˆ‚vãÂ×÷ƒ“ º½â™÷ƒ•‹B_.kcÁä4 СÏM‰†k›¿¼jܪ~ýÍÝuþÀJ—ã‹ßקÿÂ[ ]NP`í¬Øv9Àëþ{h嵟YèçðÛŒ³„ Wá&'Åϳý <û endstream endobj 1015 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 321 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 34724 /Filter /FlateDecode >> stream xÚì½tÉšïéÛ·{ßž=oÏîžy0;göÌÌ}s»Ûms‰™™™™ÉB[Z–ÅU%233[¶eÙb0[fÉ bçFdV‰å¶»íîöíøw´œ•”¿ü⋬ CBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBúóêÒŦæË—P@á.]¼€:é?†êj ½Ó|s¶ €Â3ûeä—£®ú -›ãë®Ú1Pøc†¤Æk…ªQWE´AD$Dmmþ ¡êBob‘OB7ñkv·Àøðm›RpyÐ3.?¸á ܹ˪n ÈÝ[ÛÕ€¯Úá_QË3屮ÔÓráÕ~Ÿ¨BâØ™ì#ìÂ*Žw‡g—ƒ\ü3sŽÕuƒxõ> ©‹³VUª„â°¢C…ä"u¾ˆ6Hˆ6_c¨8yÍàúeŠ‚³…Á宾Þõy1ñmž¨Œ¥cÏäT´á=ýL;—D<(QÞ‰¥¤‡q,ã…˜èÊe¶suóìô!j‰iQ$-–Ch¶Z©gX,‡²Â&i/@@Žœ ù,[¶NxU›ŠB¢Žw&$²ELUH¶00m‹C{¥gÞE_FÚllÍÌ-~6[oÞ¼Q*•¨ÿ"Ú|E´aÑ K®NÛ!–,nÄ%ÌÇt¥›`€Çf¥Ÿ´+y³¶*“Åu®Ld8y‚¡ÁN: ¡…iÓŽåW¬£0-²¯sE&<ÛÉ£j;U¿ÂwPŠz”F˽j²™ìœsb˜ Am²ßÞI^:±Ê—ØtVä±?çiJÙÔæìé_1[UUU¨ó"Ú|¥´!†Kk’-hV‚.¬úà~Ë¥²K ÔçÇ4‰º ÀÇ™O5_{G؃¹9ñí“Oˆð¤ ØÇÇ…nuXÓ>ENi$W×· 7cªönÖfûT]Ç’}¹ºIm€rsh3eGe'š1MJ«;þ¤´±rpËš¡ÌÌÌššÔym¾NÚ@ ˆ:¥Ž:L“Üë€-щ>¦~B`“.]a“ùùWTÃœÊsÝl+.%”b˜XÙ­Ú,H›Ú¾1kæÞ ã‚¶žœvlýÞ#LžAÙU Oh¸«eøVQVuî<›fPÜsY€6í؆ÝÕ,†Ý†VDDD›¯ÖoÃäZy†Ûz†Ùz†˜šRôÂJ¯*êz^™PWFŸÀê¯Ã`cÊÜ‚ad‹23̓NÖŒß;D |¥Mïˆ%ýŸM“s2-Ýw’ Mm÷3#ŠFÂ<—>ÌBŸ¾é1ÈeAÚ”î°è6ˆ6ˆ6ˆ6_1mèüÈò㉕G*­ÚÒ'è…ñÅ%i‰Éd0th$þDØ«¶OÎìahšµbS㣅GR½˜§–]RËœ‘T~m>‡ïXÕŠæESHÚ³rqªã¯GR«Ó­é†…h$…hƒhóâ·iLJK˜“ž[~ë¦[XÃM6ßÔ#­L8ªšHª9µ“¡iRxmú¨Å¼Äék3†n¥mØÔtRmû{Gý•æ«ú@.6æ|ï²S¹lê{¤CÒL=9›6¸o¹¦éŸLóÙ:$lG´A´A´ù¡ ´I._âhQÒ/`Óþ–ÌÇÇÊ6~7-¦&#õÈÛ’Ó/T¡ ²¢¶{ÒÓ†Ë`X&ïì‘Eû[,YzŽqp¼é,[›ž}Q N7SÇŒõ6^Ÿ®?ó²äô˵÷èRW¹Ö´ÏxPÑÑÑæë£ÑlÚ(ýÌ™[j{f>9ƒm¨-ÒfTôªhÃÔšKΞ!^Ø€bÖ» q›¹¹!›Åâ›zF5ÜBd)ã<ôY>ûEݳr)­ÊÔæFÔô™’ɪ„XL}»ÐăڇmmmþÑy‰¾?k$Õ#gwmõžmÊùG˜¯ÑMÓ/ÿT ›ºòÏÀ·õ¥°˜µµ ;Ì_4®܉­i8œY¾îXÙµéꣀhƒhó‰AlÃaúfù§”ø¥”x†'p´ÌNÕà0©<ÓgÎ×бôvËvK±°0 qsNKakꎞ⒵¬üÒ‚²EñÆzT}_aM¶¶ºÂ+n­w\ž­…1ËÔÛ'!Ï|LÙ2‡6 ýôp{û–Úlñ´µ²Î>YÛ9ìÁk¨»üÀ3:¤ãŸÉcR¬ƒà¶W\AÖyiHjÈÎ'a‡¢ç– óŠËÝü0£x5[ßTÊ/¹Ä'6ËÒÊiRÖU[“m·dTq²ÏN_›Ïå:ä]¨í˜ÇÃN,%Ù—iäí›^åêíÂ4 ÛÐ1½R ˆ6ˆ6ŸJWÑC|yøÂðê¦v“¼ö¬TÔ#q5^iâ[_ÛMÜå1QçÆÑw"º›¿—‹EÂÎúNÐûà›Ãº˜é&Ÿœa¨DxpêêºÊ’GiiÈNÚ7<ÓZXŒ6õjûGÔõΈ¾4î |N‚¢™§ÞO¶o§bÒ‹rtl¢…j¥îú„{©Má3ømæî¤(z l›'~ì~±Ÿ£•ýÚù´ÁjN5ShÆë:qs¨óqa8dõ"Â Ú ÚüjÚ@¤Ô\yÃå02ŽŽTn©Ñ¦Ú—tãk¨­áå;l#☠| ðæyˆT,‚«âÎYåäC´¡õ9jZ|mVä¢ Â,Ì“nvîÜ=jDã®iÁˆ2ƒzù:XÙ/`Û`yB!ÇÜW¨Â#–’•ªï™WÛ ƒhƒhó«hC¬¯T}ê8›N.¸ˆeg§2íRkg³BÔ-ñÔÕ0+x?¶<±2 ³øFÆ6žù‡Ë€ñÓ9kU”Ó¦b{ÓãàL§ NkŽ±¥‹¯¥³*èëéê†ÿJÚÀ"5ô¼2#ÿä,…ß,£ÙT‹f,Jµm2Jru­S¦>®]—ϲ«ëBA´A´ù…´1p‰r IvIvò áPVxm¸ °“‘™Ìr\5‡6Ân¹¯¡†ÉꪱU‡,O{ºzÒJMcïõå]ÓnѦCnÏõßö|ŽcØ6&¡¥éõçSkñPwÁÇÕVçÒf5[×Ö+8Ù9(ÎX®ãVRƒ{¹ã}-]K;D?O›ôâl]›UÓ¦NI!Ë.ÑÑÑæÓÆ,¦:fÝ®èâ1¥‡×áŽÐÒšbmŽoeß §h›²¶í…!‰ì³G ÉÓ… ‰ÑSVÛƒ ›nšò53ëiÉ•\ËPa»Ê·œ¾&KÇ-sfñP@´A´ùe~›™Ó1uíOŒ©?9ßuNÏ狪é\«rˆqHLBê‰j*|Ûƒ¹8±]³[„aÛ”Ÿ¼ÂâúT´Íßùr~›i†\íçÐl×ÏÎz&mà—ÄZ™Xå“T®Mî%tcAAæ6q'…íhÑÑæ3ÒvÆ‚ú:&ƒiŸ~¸ôÂPÙÅ¡ÔÜUT2Í[øV€Û3þît=×Ì#oÊ.Ž”5 ¥dEÑÉÜ´³ÓËÔ.J›lí:_ÝØ.Á¼LÚ”ŠbاUþ¢6EùÅaP~/;KÛìã•—FÊ/O°¤g­ñZß0+ê–ùšSôB÷—]-n¬¦kf·ü©×áE´A´ù5´±fÐ]„æÓ†hT6 úù³4m¼¾è’\5u…÷¸Üºmf¦ú :Áбª)¹< )a®,_á|ÚˆºÄn\­øÓòùåñ°2³Ì<>“6±.ܺ™´1 ügìhãÎÿ»uÙ›©˜U™\Ëð¹´éùSÃv¿&â…Wt´ILP;: LU×.YÔ¡·ãqÂ×â™Ö\ ‹ - k•{V‚ð‚hƒhóË€ Û±š‘Å#Á˜îƒ.3Ä!ª¯ÔßÎtòðç§Ld*˜—)1Xv̈oS fÆ@¯‹úØ+¢Þ³f‘Üçd]CxŸ:g…#)Õ>u ÌÏDD>9˜ÜÀ×Õ¿M¸ÂʺŽo¿Úè÷{ðí^|»ßî™qøTR8©TIuà_M%¾"’êž—T7¾Ý‡owÍHª}FRêRuþÎ?¦@´A´AáÓè¼™»ÚNŠ äÆÉ—²‹€ä,¨º$8÷^Àôh9ŠOÂÞÍ h; ¼òánN™-{Uäƒ_1Œgx nb‚²óp›æ!8ñRÐÐ Ó!; vß…0¡º ´9ûÍ“`˜l”b±L€É†W 4íúa$)[$'xÔåqÁ©×pÚÞû0€HðUá1A²mm¾žÐ‡sðÁ"¢ãüìþfq‚Ý‚¦QM2Ü^…æ„ý*yœ F­ŽÐ ïW·ã`< ا¾ƃí3ï;oÃmóxÁ‘AHËDi¬ ä´ E"pÌ€_eøÁÃÄ@RiÛf±×Õ6Ç`<(ÌU)LÍ/Õ¡'‚£Ï`$øX׎hƒôÑfþ$Kͧç³Ü,¿$wå¯Éýg7+@ЩS·þ^}ö¶á¥q/PpnÑé«  ¸ÎE=XjA‰‰™™Ž©¥ÿê¼KŸì­Ü’Ʋª¬éú%¹ »°üº-V6V:úF&.±iߊ>ùwÖø†Ý;7]¹5‡aQÇ5³}Ú¿§‘Е#yN[j>© gß ~0ƒV¢ ÒNªµ=57béØ'­ÚÖ›»·/aÍj*…å%¸/ú”˾rS,Åp]M÷' MY×;în§Ëà8$4væî½±ª¢ŽKÓ¶IØQ×ùiµ(TxÔ çl R«rsª¶þÚY´œtÏäüi³®ÊŸaUÿi´VÍß Çž#Ú ýáiŒvY€5‡ãZUÝ==A\R¿Î̽¨ Ÿ.Þq:0¥Ø7©,qËCøî©6ÜéƲ{ý“‹‚ Ž”o´Y_~öfPj±zÝÚ&µÕÔ6šT\ï“XZ|¬ºkî0˜œB3)š•îÀª3¶Ž."¬”¦þˆì2ŸÄuå—jzU;Ää–dÏ,oôN( /9Ù°õ­³£ŽY€_Zuu;‘]²öÄó¨ŒÂˆ†×pŽ~:‘‹0‘´);Þã—!¬&fš(®‚H,F«8pÕúÒ+“I…ÕÞ ÅÑ5mÄOVA­ wœ L.òM©HÙ90k¦^Í7ÑÕ×qyßäÒ¸ºâ7ªà¨üÍG’‹}“+Rv='fØ ‹.½b»_rqèºS• )m7¹R¹©°™ø…²öÚ›ø|hÃð ç„=ó†Z¿÷Û½mm>δÀª/?c±YiÇG¦¤!ÞÀ@ü3·ªˆL3ÊßS(2`iù”ßÀyl¨Ž]xXáv/_g¦axU¤ Ý8ÊÚ=2bÝn/?ö¢U)ê±5¤›äÇWòòõ¤'–]›5Ø=ÑÖ‚â™×>ó· ÷:Ü꨾ÐË"“\’ë*÷¹8Z°mW×àóÔöö|c«`¯¼Ù[Î[èSm‹nTŸê÷ô³7°[•ÖpìcnÎ1³ðwK©IÚ9TÝÔÇ&“œ“ja"N–,›ì™´Y¿ïŒ‰shU+>m'€Ú•5×&ø|–¥•gHYSVÃAC¦–g#h,37žÎ³):[X£ÏÐð®y(œe‡(E¯Íø4ë°¢¨ü:+cºUF (múê*Ç6´hot^%Ÿª±u@a’„zé»&Dnss³àÚ­´a™'Zx$E®ÛéêfÇ6 ‚Ïù´½6æ­ÂJ*÷»¹90mr+[g´a‹D{HŸF´Aú£¤*Ïö²YÌÂ&™`!Gé±¾ÕßÂتXÈö­ªëƪÎÝa²ÙÅ—åðGšÝÃîΩç mh$óuÄ3ÆM÷è ‚fYAnź¨îþt\f¢Ï‰ÜúD8ëà1SÖÒ°-£ äÞ‰¥ú³Ù~øËYZ±u‡ºòÌÛ`¦‡Xð¢ÔvaåÏѸf•ø8uݯ]œƒ³.AÚ0™NåDž¼H¦[“oM’-ÍeKÝu¼ [GtX¬xkPgz†ðÛ Ú }´9wЦà‚tÆCÂÊ©[gÍåAwg+–Z\¯ŠÚ¬ôÐa6ÛZ)sý6ÅÄpLxùƒÎ[{Iâá̶ðt Ku !ŀǵ-nµ+ª[åxPˆz&ÍØ?…4-ðˆrǤ#›æØ ú‰¨kÌŽ¡é²mÒÆžãWz›ˆ¯ØM1(ªžCsVˆðnBˆ9tǺ—„±gj9o™¨šï·C¹rAy“Š6pðŒ¬h{È_©•|oNÌÞTŸiS¶ÿ •kZÿè ®oÂÛÝ/éì´YkMwÛ Gg¸‡¼`ߣ©ŸÄÂpU*ÈÚ#¸"F´Aú fÀÁuÛ1êæ OÓ±óͨ‹ÌßääG¢š&®íÅ|ì¨FU›.EùDzRøþ;¤!^f<çUñ5§BãBi:~•] ÒF*êxnÁÓ¶Ž­Kk¼³º€¬ÅÏ959w¢eD¸;™ÌòH®Ž,Ø—@#Ñ+{Á`¡úü56‰äWx4cã//žóZ¢û/@›,)3–gœ,8YÕ>Mè?¹ÐÊ&i‰x{;qÖÌœ/=xÑÚ7©Š°ÐN½Q¹[¢ H*5#†iäPלZ½Ûˆ®á%x4ÇK\Ûþؘ­i—Ð\sÈÅžg}R؇9˜h[EoÌÜtÁ/Ô;4Úf—uäYm焯ƒŽžW^BÍÉ Pw¦Y2æ‚´¶>0`h:¦nYÕx1rU:‰lZtI6ëy›¿›¢çm¾–§ûÀíUÔ‡­©Ûëšèà·zO¥z6¼æò€oD¢½oBÂηµ=â èx·U»„ÝXra…£o¤[bñZªª}"Ûˆ}5„ËâÊK¿¤âf4~ZßF¤æØûD¹ÆU_Åx>G\ºï‚OTŠ£œgJmÑe%þtî½9wÝ/2ÑÎ'&°øœP}NJˆÛ¤ò‹VîÚ†ïù /?ö Št -¬jÃübâ“w½To˜ðü ¿È$H@ÑYaQÚFë°ï¡f‡Ì*âѾí·TݶUì·úÄ(1À)¬/tN>_ƒ?oœß¸×Å/Â!(=iç«…gÀ¯ Å¥ÛûÅ—\ÄgÀ±ês·½BãìýSRŒ‰:G|Âã¼ ÎÕâ?*[]ìà噶•xŠ tÛ‡¸Sm„—nÛúfl Þ—Ø2’nçéž\¿¾}ÖÏð¡ßæï&ˆ6H_ mP ~'¥~Þæk ×ä‚u§áx Ñ Ñæk ½¸ß&JøUþz=݇„hóu…SoàϽ¿®2ƒ‘Ôæh Ñæ+ ›záëh¦¿éÄænî.µ91µMxo$D›¯j$Åðè…À·TµHaU‚ÐrÁ®»‚¦Ax5|MþQèÛ‰«ƒf솇dî†Û ăoÁ>à(°?8 nW ®H`j`ÁUøTLD u<|ÕvŸÐ÷I…T"ªa‘jÛà>áUÐ|ø© ´~¼8_4A$›D²~D´AB´ùŠBúNø¢*ÀŠæIø",Ëø¢ª #ð½7–‰°SßÀÎYpÛ§îþ‚mâÁ·`öGc­a: 5â]X¥ç IlRàn…' C$ëW ,U%ö‰®…‡[ão媼ãÍã vßS%{nÎÔ›ÆÀ;Ñ{‰‘mP@oAGB´AD$DmmP@ÑÑmmP@´AB´AD$DmmP@ÑÑmmP@´AB´ùÒ¡þâÈö}w·ï¿‡Â ûîŠZĈ6HrÚô:GbK–(ÿò¾\-|*¢ ÒŸœ6}aãÿôÏå·°êι¡î&|©Ëüø_=Xí ˜xÝ ¸ ÂçJVt¦)êýœEß5=°ØÕŸHU7&ÿî;½v»`Ñe5°º>¸¤Åì%Ñ•5Xýõ…ö%Vˆ¨ï›ûâeDD›_ ×ggžù¢´©¸1ïz¾ò’N%¯>ó9—”…k3]ìµ±·¢ÑYº†& Š–®…_ò)ü¥âÝXhlÞ†®Mª¸<7íЛ©¥×sø6Naºú–©'±×ýäÒ^y©½üûìSã lQ «×ã¯É*-w]Ê.žµÐÕÏœi’OÉ*é„Ëš3´ÿ–¸çíÜc÷U® V÷-œly]¸¦nÑÇ”ÑÑæ£.x|µ?VòIq}7V{«íRÝáb¸}p­%aVßp7;a»zÁµxÇ‘pÍî6eMÛâ´ùoÿ¯àît "|Õ<œ6Ê©¤ðôaâóKR×­Zp¡î:ži‘)\誾®® þ ;Äæ)§A¥@©@j ©Šce+¶ñö°Ùªü.VÛ¡$¯¿>³ððVÞÐ×Ò‚eèÅ-ùq†z`¦Âö ;=󂲶ËÌMµÛ+$l†.xÈTR"Õ Ð¨ªÎÌÈÕžµ]*›aÓ=xÔÆ;&ãÒ;\J¸Û|WU$X˜Ù•ÕìVÅæÊ‚´;7Þ‘˜SõJncµ0#¢=áªS'b¿@‹VݧZDlf^6õ1$£õ‚DD›Ïº°DO“ÅbsùÖù§]õþÍ.ïjU”ÌÖàï®%Óâ¹LÏ^þ¾ºú,¾uüŽAb•–ìJ‘ŸÍb2t,Ã2Â×ùn8~oÍž¹{§Ãšý}Žá¯¿YÂ?ëê¯ÇÒwK;øV8“6Øê*¡‡Îb1™<ÛØ­5Îzÿf½¦ª$Æß;­½%l“§ó8Lƒfàœ¶ö ô‹®/w×vØíïgC6J¨ë2¢Ð‚vŠˆÕ*ñ•(AjÂn……HdÈ :¾’Çg¦q˜t&ƒÆ·Í<í«ªI+ŒŠã’}©:NÉ:x›ðÌS÷×uN:r˜™ç$Âk#îNÆëúUwÿšðú…‰k3õ ôÙt¦oIk þžÏ¢í‡M AV&Ç4¤º‡X±¥òìM'S&‹Í¤Ómc6–ã«”R´–¯nš´3¢‚x6‡ç»O¹¡Òk9¿ZWG¢’ãXt:8ÀÐ=+ï\’8'Û„îu68*RßЈÉ6¯»m›©üÛo÷ÅÏhùë嘳)L–Ãá{îåЖ&í}—Fm~éãeOc°uͽӫ µ98mZÅÑÉqlI§êÚÅ­>-A´A´ù¶°CbÂf'wÀ¬â|®M$\cÜÏ£kÙ­ëÁ²rìÙlnñULÔ…­o¨!sÜÊ{°Š}µ 4Ãûuñ¦z&Ϩ¢U™æ§kd¡o<x=®Ño¾ûŽ¤oWÑS(X—¢­SÕ;M›º §8“Ì+0)ÑÙC,MÖÚ+XΆ®e0¾z&V{á$]Ó¦¸+å±t+@z±ì‚,¦Y ¸Ë—oŒdÒ¸ñ{ßÛr–‘hǤjùœ.9ÿ¾âŠÓ/´»ê/DlKo@{ ro)—ã^Ú ÓY[µ–£ïQ îæ{óhd†ÕŽ°Ci®Ã‰Ýûª¶SePå¦Ûêù&ñ¹,眦:õp¬zó*:iepÃk`6®rÙ´ô㣵çÏ1VТC³°¾ã‘>sYäæ·Àô µ\aµîy-î– ´vÎé\y [àôDÕK óÜVÙ %›V ¯c i~:6‰À䇤ÄûS-²„}XÞzO6“™ß [²¤^DÕ÷“¯ý‰tÉ’ÕÚ3ZÞ4åàÛ†«mL £b`_µIôtè)ûß&1ÅQ×*ã:æâ`DÕ¬¾Ž­ß²–¯P ×bÆÒs“øÖÑ $ˆ6ˆ6Ÿ?´Ž³Ù ‡ ½QÛÜËÖäe¶Àø´H7“¤ ëeæØrM‹ªq4Õu ¬ÐŠ<……X±L n×â/î®í6%ÑbOII½ùîž×Fnõwù+HIçgØ6¸"h•®;1X|ú>sEêQ™¨ù&[‹›Ñ SXãm·³¡O楿ÒV0ÔÕwè­ §5õ2©ôˆ õؤ¦]YºÿŒµ¹.“Ád³Ù|“Àü+0‘Ú G²JºÕ.PÀŠ+# Ǽƽ 3€JáÞ’¶{)>t´Jm¢w«Šç K€ Ǥ“rÎÀE*«ŽwØÆl»UmYE¢øm i—:òyÎÕýÙYIl×lÕ¸¯óq¶³N? Æk‘Ú\ת*5äa hx{ñ0³ÙE„m³R/¯"Nå·éÁ½™†þ{aã\Ç<í)º‘‚› gŽ–}ÍkP‹ú®q/W#–‘;($¢ ¢Í²`'s ]ß4fŸÞú±ÂõÁ,=X" Ø6—:}kk7/ïšqJ„ÏY{zy09Ξ\&Ý&|» [pIý…í-Ôѳµvug²x~e"üi úšðä)=6U×.ØÌÂÔµü©ƒ½!ÏÐ%ã,IqY“N[sZªš¤¾6bogËà™Y8º²Y·¬³Ð¶i'é×t«Ö}+ÝÚhl¬G¡Ðt ŒT-ž‘Cð¦wp ØõÊR‡Âà{T¿-ßZÆ£k˜¹ëGmº©Ã¢¹Ä•ïX«ÁŒSѦ]æaK¡ëš„o©ïõ´·¢k3L¬í˜,®}h²‘>‡©gm×Yµ5bšãæliáÀ§i9Uâ£Ñä¬x.›eåÀ¥±MÃw²ub9ñ\†¶‰½·‰©[×>å$Iñ`Îéñºîw¶ºT:ÛØyÃó 5ZF•°_¸cnbÄ5ó°´³æê™Çï~ ­µÅÎLÛ-jÚœÔÔ6ÿߦ{ÈAŸFc™8Ý×á’’÷½‡öÌáKzº\Ž±£¡>7hMª6Ý¿ê:¶®.ŸK×°t ÖÑ7NÞzK£šzg”Š"µô×!Ú Ú|Þi)n¢L=R²9e^YÝ¡Zœúm<ÃQ@¼_ ¦ž·i‡£ƒéÈE:Uùmb®ÍNAõü‰j¼3ã+b›˜d/ÝVÈ4-«îœWÔ™™â13ˆÃÕ>ÀäÀWœ¬™‘‹¨cºä¢.üQÂXš‘Îü6MgªN¿ ÷Ûè­\Wå%lŸ~´fFËàmÕ6#/‘ìœu¨ŠA¸‘§*«ª˜¦Ê®*ðb´™N/0ñpñhÍTÙ¦ª<³AD3=KŒhóå°#¸tË䤞O-KЦæW°ËGf±À73¯ä…K’ùÉy}è˜_æ'%—ùKêõ³åøÃèSÑÑæ× &3kÎÍë÷¹êÿ0%AB´A´ùB<ó#nÔ®’ !Ú Ú|±AÔà FÑé·Öàà`IIÉz¤ÏªÒÒRÔŸQ¨«þCÎR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!ýá¤TÊ1 ¦À” €ÿ±IL þ›_ ¶ABBúÌ‚œ‘ÉR™{+9ór‹\Ž`ƒ„„ôyí%0d¤€,råüõ¡—5 wŒ"žØO`/m>³]£P(ŠË“G“ïº$=tJz葃åRÈ•Ê?g”˜äi×Éæ{Ÿz”ìÍýý'{gǾÔÿ—ÿÈìœpc“w][øÀá;ß/#?“}î+]Ù~PàjÆ£Ð4²Mצlûâñƒ–ó>²RJ¥lÏîóÒ©,W§ûšZÙ›éæïºòyJ;t÷_ÿciÿÌdªå¶[ü³žà“’™xºmÙ÷¤×/Žüý¿k\/º›¥îŠ† Oæžñ'§ZúU'¤çèõÁ¡ÏP¯Þâÿ©¨À°ž*þ߬w}jçyÓºÿáðâÕø—•Î²Mƒ¿KßÚÐ’ µÞBUœ1Õò3Á>âÌá³ï=y6/eŠœ ß›‹_ .–Ì­—æÞ*H Í;Jloõ1ØÔúô£íÅ…+?]/ÿž­ø%uq•6ÌÓ‹xªËF>û(å"&í¬XW úöæç3gþaÊ/Ó/7½YÏ^•¾b²þaQÊ#Û”®[­SH¥ÀøQ£F¡øºìÉð“Uþ64*ÅÌ3¹ÿ=Áåý : *…æž70¯‚¡KÝwö«0â1˜l£MW_€ZöWjј,&ƒoå o1×y˜ó)šcØÚWbÕµí¨µþà­ ±® ÃÈ%vpTþlï ƒÅb²¸Æà8‘ê¦å³ì¹=Òú;ž`ÝtBqoïßhίž°ÖcQɬüÝ×f\6x!c›×„²@f4nrÕI‰»·7™±ÿÔ0Þ\ôo4?@ùä»Ò/&ÆÖ·Ý{ š¦JÙ8—®yõÚ 3ú²œož4s¸~båôµ$o8‘è°vú®à£|üYV°=JerMª^'2ò4ÓØxô¢ OÓ1ó8N•"¯Ô:÷7Cîïe:ÖV=9BaùMªÜÉ`Ŷ³]©žft:Ã>¼hDJ4”ü¦Õ: PVØÚm#xe£ÏrÃh@ƒu{ðî_¡E8*ë¯Rµ¼Žµ÷‹}®?Z7‰O¾¾ïiJÂ5v:Ò…s`èö2mö‹Ý!öT2-pÍVhvM>3 Ýv É»Œ\Õ&‘FçÞ%mv\¼¾>ÜŽD"[øe K•÷Êý´ñ|uí|/E2`…t»¼G3ØÖÙ­ÂT6“®kzãôƒÉîu1l*‰©ïpôæ;¡¦Íõ:Km÷Dš|y+ÉË’J£ëÛt èçMÿI6zÙêe©C%ÓcÊ€¸½>ZL›Á » Ï/œ%~ÙÜ{ÚîoÅ×&1âË©¸!¯Í fÑ( ¶~îæ&¹RÕ³^Ùi¦09&-Ï\-{;ùÿ³çÅWÒ\µbkºÇž\Ñ"SŸ})Ób÷³²Øûø¥®¼.¹?`ŸðÈzד*LMbÀÈœ¯È°‘=µÑ¢^|!‘Hú÷­ú‰éN곫%,¦ÑÓ¡I©LqecÕÂÔHÜK£Q¶6?‘ËåonŸ¥sõߊaMiN!Ù{”r¹d`‡ÄìGõ,d›8Hñ +%Ðañ|2é¡p=^â1y¬*Ð> Z.“=^:Ôp¤€‚ËM©ËáqO®Ô¢8dž–Â}†|ôW®;òd&mªSì"K•2©D<j¤“r˜CÏVjÖ©Ç=•1Α%àÖÿ·AßÒ+•I£7ÉË‹¯N‚Îf¤ÇÑqÌ{/“ËäJñ«T:Ë>¶äéˆlö] +Œ°N,;¡”ËÀÍÅ™ÏJÛß­Iå÷LWПÀ½‚]u9–‰/àƒVÊÑëezø^àXùø .›³*ÄA‹fÙ< ™jto;ªmÀh³=2 “J%··…3i¤íWÞ\Û¾ÆÀ5Fu3_a-5¼ F”õuǤŠ/Ô9÷=Å<4õR ¥<µ_u×¹áeßžiQ}5¼¸´…f款åHÞíŸÄ”åÖšn[«ÚVñÀp)uÏ+@›ø•¬¨1bDZÇ:ïÖ0¼Õ¦;‡®ýE±Õ“ißpWð¨½&ãÄkˆý”4AÑ&—c–€Ø“‚`û@áB# µžûIàO©Úccª¯kz-66M‰7dâÑÑÑËI¦º™‡Á§3Už¾Bü±k屧ÐÜ¢é™N¥zys²µï:L!6Öc7¶>!¼-Ðdxv§$ÙOsùOtŽ®“·àh±q¤urÅi¢x“p¨%›ŸNÖ9,÷Ùñ | qåål¾LÔnòv™1®j·ÑÜ[MM’yî1a;Šº†”8mØ{Ú‰zÉ^fj›¼Å¤ìÖ_›$†gØèúü[`œn±Ô9÷8Q¹T*d˜AuËcS´¹½¯˜ê6Õª•qnÞk¶`÷ÉTn ´ZaäÎ\c×´³‹ z掤¬8eÇoу½(vµàB¤:F¬=D~ƼMW‚ÍÃEfîëÕçñ¶þ”“ïõ²XÑ:ý„hyå³û÷^:6Õq¬à©cr=,²··`ï¯-×Ö».S•´8Z'¶¬“Û2Y'-î>7)*çØ ÕH¹y{†‘cœrò.]»÷µ‚¨þ‹®jÛuLµ”F±C Õ­"¶Ó#Á‘ÔP'UCï&nÅtm4IÛøÅGRvðî¦ØGæÃØËœGþ`Ýg.‘+Jì«u w,ѵ™Ýb#~$Rn÷”á?J]–Ñ¥´YaR¬²ÇŸPéÜC’×¼8šÃ`ñø:¸tuùZË–'^…ss)þ¼Ü­ªq‡äZÂrõ²™´YLO-¥9Œ¨?,ŒÒ)‚GM›Ö}ez–oxljZZ˜_?Òfüþ ®é°+zJ´ì‹ALÿåz›¥£›AaXøbJ±±.óÔ­·ó®Åàƒ[ÇwV°W÷?ApŠå›³£È ƒð¸ÄUé«ÜuÉ^Û ó0Ä™]yDå$Ÿ¢ Ж(·‚#JÅ€Ûú 4Ô+ ¯o>oFÃ9•¯C6ÒÉ£ÅOL–j|5UŽÇfš?{½èMõ·þQ“îâY³»ôƒ´9]f˜¡raØÑÜpÃøõ˜ø‰ÆïW™m»óÍ\SO~äåý6—U~›')¶5‹Ò¦ÐÄ&ñœº¼qÕþ±¦‘Då]¼´®ÑÙôú\Úl[DãptÕ'Ž¦¥iS°¾¶œbúB}PIœ~̆–¢ L©[Ç«Ù6žÊ¡&6‰÷xRÕVCÏ°YÜ·lkŠ¿}fí´ßÆ\å·ÙͲ[ç5ÂlY›¯¼úÒH½ëíå؇æ;žD?uKîwy-{¢€Ö›ìëê¾u¢šcã­òªê0‘ÈÖŒ»<ª®ô·•+Kî`8mŠ§t­1=âü»ùYürÚ­^©o½{³C-’6š¨ióΙòcÍU¢Ø¥sôÄó>SŸ”ß9&ð6Zº?Ÿ´î`ÙÏ=•rH›Ó*Ú(‡_?{:6ëF«#ô@6ö¿í`1˜ýêÝÖËgЦ.mäwu– â‰ÝÝ•Æ´Ki=Z®ï“¯IÙ2'î©l›÷—9dÖ Åk{¥›©à°úË4/L·åhˉíú¤´¶mZrt|Tg˜1éV©•Ø$¤Í½±_L›§jÚ|6¦Öá{՗Ѐõ²å[ëHý†Z+›ßμä0å<ÚË 3K7Ñövmô>š6¼[p"fØ}¸TÇ.P9ÒÁ¥PÁ %Úê]ÿAË€û3ƒÌSª¦nANÆ‚6¯nbñìåâ^ÍãÍ—½€ôßcÏcX$<²]õÀñô˪9üÔW‰0ö|xA‹jtk /½ôï?~<6Œ]É7gy6ß=¸‚böûm\BröB+¢ÞMÛ¦Dåž½ÛT¿÷ë,J»€j"R:1:469Ÿ6ËWÐJ»TÝ{•¯nbùltj$õØl¹æÑ—D'egÈÓM=Hìù¬%a[hÀaß”¿ê£Qù¯UVtßŃ-ý#Ø,Ú`»‚i4ÇÒá)ÏŠr\äÇÔO<‡Û66‰å§`_œgÓõ_â¾ÏÉGç˜$²ûFØ‚gÓ†B S#Ø+WMÊÞGª×EXk­¤ï¥öÛØóÝr·Û„‘¹  py^ÌÐõ—UýúXòrN”­¯z¯¾®vçyenÄÆfÒFÕòS´™ìݽœf; v$D93³7¶ac÷–6J…lhhxþôÆ"´q Ï= ¦ ¿¡å>’²Ð3õ"òÞhX®iótñ)P_SZÉÁ[D›E0–§\ÄnVÌ¡ÍÄÕÊŸ˜^/ÕÇÞ¶ýÑ; önQÚ}<ò¡9)*sÕU‰¶çXÙ…Ôcòqsmw»*±K칎•àò~¶7s™a$q9Ê^קká´WÒ[[&{K¶µOcë‡ís=—!Ç&c>tÌ~â¡PʧMð¯ù1¾æ*_6“áÄçЃ ÷ã³m¯,ù<#×Ь”p>…W}ƒâ–¸Æ ÐæLy2™k,ä>æLÇÔÔ3ÙÒg=qëJñãNÓæ* M.¸&{–R9üÀà!‰òT†- tÚ°íò=8aIéþ–|2Ýé®Le#©¢(+¾©ÍêÌ6WÿÑé’–~ÞþXøñ6‹}t*¥»»ã8LzplJ ƒ1™mÛ5 m#5mà-CüÆS‡Ç¤ÓÌìœį́t†¹7>‡XFâ‡$ä`Ê1+}¾±gDfœ¯®gfÇ&76Û¦¡o<ÌEEh\ÓcÑ]OÜ‘Ý9µžÅb9ú†úØéÓ™zNÖ,®NDTÔŒ¤X1~þF!©1þ 6ó-xS–Þ?É!Óì‚“R£¼8LÆÁ^ȦýÙ6l+2>9ÂÛŠJæ{¨˜iÛ-“6xÐG“ðƒÑS¡‡ËOËÌ´åsYnk d?‚6cƒ­tspþœ”së¥Y´>·Ò2×08&UŽ)×»˜’õlC ÷*µ0ò)fé»d¦Ç뱩1Ž} \­bR(nö4=?X´ëåçFÍòƒÑh†+‹§Ÿ’êlÀ¤ê„¼_/HL’eÌ¡8…”.b³ ß#3øeþúžáÉ‘–d¦eN“7góXJ`BF˜» ÛÀò±„T‰¬h<]³è&×ßÊ‚½õò3Õ…Ôè¤S;Tïv}ÒBc²ŸË¿% Å&c˜$ôÛ¾Â^b ì@ăã£#ïß¿ŸrA)å’‘¡!9:!Vu%éØ»¡ 5]åïßɈÉ7…t|ÅŸ Ž©’šº’G‡ÆÅ깘È8ñ$ÜÞ0ÉøÈf>m~¤;‚QÉLohR*ŸÊWŽÛ¾J¹tXõÈJv3ãÎlöé‡C3Ï“ã£ïá¾Ãb˜ôÄ‚ÊIdŠéÛ­Raßidt\®Tªäxíð q…tÏpD îgr)Ø“*@ËMHäê;Žr ¦1$Ç+ÅêLaá•r¼e ›ØÛ†±ñ€x$ Ê<9UH¹d’(Ñ\ø™Q§&"™ÛS-¯Œ¼«ÒQªÏæȨœ˜›:„0VLJGÆ$ó®Iƒ+ïùøÜkzdø½XªêM ÉèûáIåì3®”Á2ƒÌšØ¦\”LŒâY}З‰Ï‚MŽãç_=ÿ/›x7”M¿‘¨ž†ÕÆk?‚_l`!}÷~xª”cCcÒ©S32.Y8?l¥úŒ‹¥S®q HBua(¦éQÈ$ÄU Î#8dRÝc·ª(ú9â)·ºRRçÂ{9¡ø2°Á$ØhÌ}óâ(L.—cè…_RjÚ|Ò ºw0ƒÂœP`XÇ=¤ÍùÁ?T‘äÃè:É’_a¢C/qrÓÌ6ÿø§û>cý_}ÜüóÖU—¾õöðt£ ݧë¤H¾Ì¸†HsÕM÷ñ#þ)›/¨'ÿe™ÙØ'2Ú¦OÒ¢ût½ûC×ÌÁ`™ðôÓ?”;wãÓµ/‡c}vV£÷MM,¬æÉ&³ùKUäÁV#có¹ù™¯Úök[û„ Œ¢­‘°þÀô#È_ä']óO‹RåKG¬ù :€ò˜®üL÷²/ÜÐH•ÊQhÚ¨ß ¥‹}$ …ñ é³I!•Ë¥0d¦ÇRr¥€H)G탄„ô™L%0`&ÏŸ•+ÇÕ¦ à£c¹C´ABBú|ê¿ýlÉ_^¯ÍQ¨WðÄúïþÇßÄÝ2I!!!}6 åM~óíæpù %4lF̬&¾ûf0:ìO;)5÷­‰¿â¨‰áW(Åoûï=’ý^í)y{çþàÇÝ9Oûû_ŒË_*?¼ÏT$ýTo…ÍðÌû#6ó>©\$Ç·V+ žÏ¹NÞ³1ö€µqÔè¢7àŸ/Û5š·“Ú¶š·'NñÏ7nëvn¹;„ݫά»¸pî*ÚŒÎùVlWrPµÀV—yé­bÁ–úÀ )󿙢òƒ-³X.c± ³1 [ì ¾mæ´Áüææ+#h36ó Î-zÕïB—ºL&~kj%þvÉÄÿõ(&$ãÿõÿ”~óݳÿû¿Á¶’)¿VÔ Ýó¶5aè[sHfö1OqxÿÑ\c6ÉÅÛÏŒË6÷ÏkNJ‡™tòæµÑ¾áI)ádûË1ŠÜ{•ç~ð6ÖÝh­K³u÷1×áÚ†ä+àÈÛÓ¿·*Xë‘š•åkÅ´vË}¹*Þ‰Fåø„Fn¹òÔýñ_÷\—¼Ðv ó½büÑÞV¸XXy Û#q£kXVFƒ§Wyê&QæÁ3E¦’£§¯¥×Ì;íýìk^ʲÑho;ºŽ±¹.C×< _¨êÞÎt=:ÝÖÅÔ-(MNXùý‡m X:f6zL²gH‘T m›¥ºÑ[ÖxX9:ñ5—›Ø%¾Å¿s´È˜Ku÷ñÕ¡±ÝT+Î˯쬕a]‡·ßy´*ÒùwÃu·æÛ6»«SÌÌ­-õÙt}ÇË#ؽÆ4=]Ž¥£GzÍ®–â“å\j÷`÷2k“c’Ó‚l¸6qÏ”‹ŽlÆ»,øT#K“–^?˶yÓµT‹ÿ¿ ·Ds¹|_™U}~û`ËÿâlÏrOHÏ säëYD½PbãÛ=œMØ,ãà ÈÉEm½À¶ú†NÎ64;»îñ ZZ¨K×ÔÏÇ•Çà%UÔUæ[±¸F~ž.v¾Ù\³ýÅd”­Vöæ>õ¹š°¦ÿ}ßɦ?Ðd. I®Tˆ;º'€1ó—¿Žšš|ó¿ûÝ»² bLöõNIíJ·°ßAlgyÄ Ïcoº)šÜÓêå]s<èM˜lD—Çñª¼DDŒc§¶àëž -³‡ ªL¾0 Ó·u«ÖºÝàÏv-j‡×Öõµš?‘?ÀHñN‡CíÇ$­´e&ê•d÷ïÜÏíW‚tsCÇ(bûÙö🬋`C÷™Ú¬Cýª.±ÞŸåœvbÎí¸·Î‹ë²žØÞ±ÚÍ.R„)ÄkS’NÞ'F4’8öÊôVÈ  ÖÚ=„1bϦn»õ{ \¹Œ´þ±6âˆ%_ëp÷{ìÙ%Š†ÎEÕ±¡æZùÍöxÀûü›Gw¿Ï¥ —í°úñ©1ˆnœ »|ª»QÉ^ÂbMg5½Æ ãÇV¬ gŸ{OìœàÂN¯¿ºàmO)·dÑ7]à $~`@¢Ÿz­œ1’êѤ‚‘Ôdë: †Ç¢3ßá3HmƒãØÀ®å?‘KÕë§{k64AoÏóæ5£Ú6Õ¶®Á3ü4µÖ.#ÛÓôñ® ²q"q2ÄΑh:$ØëÑËyQD[¿n­á°­OÇ{êSž™*ßXWÁJ½tÐRÒñ÷wú!ÃfAC@,†î™wÿßß$ßüutÉåwKž‚¿“cJ©R®üJ =Hþ±äÖ,åý‹Y¦JõbÃçë3Œ}R0ù¨uþþ{âjlßä¨ç»òèíÒr»pÑöS,·ãúÛ@wúoÊÑ7‡iö­ý‘=I\Ʋ1=>ó\ÿ{l´™¶ÌøáK&H3 Ê=KtdìFþœxp}>ïÙÏÒ5ç/[ûþ"=ûÐ9CŠ ¾Fì¥Ñ™:þÏXgsÓ¾Ý;wìÞoªé³ ðä¡‘ÖŠæ·˜r¦ q_øÙ{D}£9sû•ç½»‹Y¶^V‘àãž*ø¨ÖÅm› †ˆÔ®58øï[InFE{Úqо³¢³ÎŽ´ùQÛê…ºÀÛSlÓ… {²‡:¸4ÚãñY%ŸO›ÍÖÆéuúa±ïܾ¢ÃË;ß îþìü^]Á`gvÅá»0ó¦lŽaÆý6ÖÎ5jwÚs›ŸV6>ÅòMh¾«‹<ì£MÊï›Ü`iW~Rå{˜|Ëç0 ßFqÓhýnW9ëdž¸€ò³C)ÐkÄ…E’ï–H¿ýfâÛ%Ò¢%üAƒûZÍÁç6Ë46>å¹qª’oé3å°hßžÏu ã:\æ凪…;69éùî˜I›—·ö°Ø+k•llm]|#U´á¥¨.cœ6çï}$m C ÕËœÝ(ø‘/¢uGßA¢ „Ý:^ͶñPŽ\eÓ¨4Mƒú‘ÌŸLÊ#†OS³?²g:ÕÔ/ãą掞ε+}v<Çä]¼´®Ql–ÿa¶—Ø ÒæEó¦5 ž®ºj¶v¶«?6S^âÖÇŸ¡ Ýe\]C 7,ì~}–EÑ}&Æ”3ˆ:Ÿ6E®–Cu¹íìíSÝÁžíþê1åH ùÚX†ŸP·Ó/éÇu·¥‘lFJÓÔÁd2W3òâH¡“¹CÓ|/ñ¶,s×ôÓJé.›ǞȦù $r… \@ñ‰Òo¾Å¾Y2ñí‘Ž¼‘(”2¹ü«õs‰ã9?d\ž$z¯\*žÈZv0ŒmjÛæxu‚…_´m>H›áG—YÞ;ñ¼e?+m^ß8ÎÐ1—©ÊveG–‘c¬ÚeM¸åëÍ4}ö¿PÝ[eÒ‰IÉØà6]ç¥j=sñ*þrŸí`ðÒ‚ºìô")%¨ú¤L±mšŸõ®`ÚÌr¤kóSi£i6Õ&µq^®9 §:r‹O'ßR5‚tr{óis$ÖÎ8w?6gt4hãþ‹hc­ïX®¶m™þ ½ï &°£;nº£ÎქêŽxGˆ•yñµ1ûŒÇf´y׶‹bî5z»†ê²QÖ~ü9)à~ØþnÉ7Ò¿|'ýnÉÛo¾ÁFÄpz…üë}žàDy ¾c4±áÀYUߌ‰ê-£”¶·Ù7¾œ¥)û1é"´yœü½nLÙ‘h‰{Tòæd+ÜË°G.H›ñúüëê{âÙ£‡†CLòÜXƒš‰ð …ñ—…m~4çÊ}t:ƒÅ·':Te´‰côÉëv“Iø?Û¶®17¦Û—Ãnähä¾f^°çzLúáÃ؃ù´yŠMÜÐYJ*½ªªû*Ãü=wçÛ¾wšŽ\º7ü1´Iv3ÉÞqMEk߀„ ÍJ ’GQåQÝÅ,lc+$î\váÕyÓIÕf·Œ.`Û3†¶‚ÝDÌü)^Ú˜]½~Ú<¹”Ëæ†c‹;n.WÛ²ÙüG¸ ÿ@Þr=_pN‡Ú‹htË—ø©¼Ò@å*±±‹é+4múqO‡À‡Å$hR‰äÜLy;úU 2ñêÑ‘“M;óçn€S†~Z:ù×o$ý‹ô¯KdK–H:¯ŠeJ8’R|­õÂdÛó£´5IÚZäÄõ{Æñs?òðJˆ—Çc²Jv]&n¨$Íåçï^™Q6á•–d¹ñ~\NÊ>õ^úª/ÙÛœÎd3èÌðÜ*ïGwú?kEMцª½üÔwÀ©5ùa9)b÷ ¸N9ÿëîêÏ)[Y Ý3»IíùÍúgb‰¶H'C”Í oó¹9óÓø|·ôˆ0“N"kkiû¯¼•Ã¡Ôž¢mSßÐ|ýþÎ+•Ë—j¦_|…=ZᨥE&Ó¸¥ÿ{çE—çû÷ÎÝÝçÞçþ}wwö†}fwgÞW”LçH“sÎQTT ‚Y `ÀœÅ,‚b"‰‘œ3MÎÐt«êVèn £¯º÷uÞó™‘·»ºêÔ‰ßó;¿sªNÎ[l‰fûñ\ Q[Ϊ+%˜”N¶—¬u5¥³Ø*kÇÙ|©–É_(ó¯NÇZxXŒôW•ª%úí[ªÏu4ÓÚóÒ V­äá^ÓÒ̵:« vå#ƒW0ü?>;îdÅ5^¥¿ùð=ÙÒ«í”ãIÁvÆÆ&$¦uÖ3Ìá,)‰ü#cî™­üÓ Ú0>'Õ\|ÃÕŒÆ`±èl›óOj°òê½þO¿¸hÔ&À^ïà]lM:ÙjG]ihĨÖîx¾‡Éˆz±gƒË òÜžÖ _’}È’Í`³ÖžÊ:T.£M ôX«ô›% ƒU%]ªhz´É±™Q¨üM½EY:\0'µ 3Á*1‹ž?ÁœÃøÁÿeìïþ›ô¿þC¿){~ Lý°“RŸ·Þfî*Ž9—ÀËíÒ Ï]p3ñÍü•‘Å]ê‚E¶s¾h_ú²|Š–Š£–3çÆvéA“¶#ˆxèuÄÓ‰…5G[¦i§'ïgª¯dÙ»,õ ¬m×ôåÖÛ,›ÀÏ[ù£m½ #K¯Î¤õˆ—óÎ7sâ ÜåæfANÉaXËÇW­Püô÷¨àÌ>ȲqRüᄨyS_‡½ðk³ï¼?—4!¿Þ!Ñ“÷ m®ÚÀˆRÜß×?°þì{Õt© ¿Ñûû…â¯íL'†û*óO둇æ虤ç]âÑà™o#ÃbTpÉì?ýOÅßÿï*-PC£üïþ ÿé¢ø8Ô—‚÷Û¾’¾|ºÍü‡&†  ëXYxî¯ÿNQPVîá™[.¼£9ûäó±¯ ùÌÖ{Ð# V/‹·m`H6û/ÿ,þé'ecµRÉÓ}ü_²¿û/Ã?ý„L ã` È(ÀWÐ ÇY˵ÊïÑd—þF!©YÞkƒ­…‡±wh ­Y×eLB³K†æ)kÊÇþÛOÊŸ~Š‰#)ðÕbƒ?±€(gÑb±|vR °R½Afþù•ø{™‹=Plð ³0¾¢F‰(• %ú†F?ÈgGã¥?ý4eÁoîß@m°5©ø;ÐÑøÚlA¬DP+šú»ÿ.Úš(Ù¾~$«žÊA`Õÿ4®.tPµµ)³ 0”ßYŒ4oø^àoßÆ_†C¼;ˆØ ld¾ƒÜ@¨ÊHäˆR J2‰ô*•0^‹¾µi#ÇvKÁ>׋K÷w„Çv¹Éà `Ú€o+5öbt¤nÍìMJnóJîöˆòœ„Ç€Ú|ÁHtþíg-þômî®%>ð÷M‹öK¾2]Ÿ{¹¶]fà¿’ŠEéùþvûâ=h¾á=á/ÚöTkö}ט»iüévDlߎ?ßÖí›Üé™ÔãË÷8Ô¶V ÏþFR ¿âeb}Íõ ^ÿîvª±¹¬åðÏâ .õšgaëŸuŒ»f߶T•’±[‡âMé$ccC+6ýê¸:I-uÍòÏj¦§nB‚Åí^Æ:†Oüä‡+u…Ÿ÷Êê´0õ‡«¾(Þ A Û †”<ÚÊ;ßßÊzkŸ±ôbîUÏi7PáÕ½²‘ž!9þè=ù2:ÙwëŸ~v-:,è¬)U—t76H¿Eé¼Ì0e„å£ì™ÿ~áÕÀ—^ÞZß´Lñ‰‹6ü‘¹ûWUúëÿ´ÒUŠ|W±A‰RÃwÈT@èåýñs[ºîhõBû>€K„¦>L9S<Æ—–MIYü ›ŒÅq[|‹…† ?çgZ t^¼áÏNægª ª,D9«[.ƒ¤ˆy0r6~À9¹Û%‰ïóaê•‘"вmÉ®¢‹®–\Ž•GNÅ€*W•³G“Ãx¦\+—ÀüZlVX6eeÎíØîÊd™nØs¿\`Ãd2˜,:ãdö=çP¢%cåèÿ¤f”Èoù‡]ÆþçÇ[»ZqxæN7«&ÑÓbœhèUl{w-Úó »³Œ·È§êòì ayŸeÖ‚Nlæm¹Ö–•Âår=#öNÈñˆ}Rd²µ8ÜÓžË5õZ›2"E…_i¡wäõŒ¦Øã¹ñ}É'ë:YpØæ‰Ç?öÞ 5K*»½o-Õÿ‚ ÚèQ«û´\gE“³¨q3ëfÉFãɤÒ/ã;·?¿àacÎa›­ßy‰°®fŠ(á¹onncxD?Šd°˜ ‡³úR©°ädpz¹l¼Ö" Û\¸ö| 3h×⬗N4‡»[s¸6çˆÅp µAº›™lÅãX:ø=¨&Ž:3ŸÕt¥­ueqxkwd¡DçÙ ‹Åb[{¬ApµyÚØ6ÁŸÅ6]|šèßç¬Ù·¸Ð+rò Úéh®VÔNšrd0_¨$Â^ÁåwñVîæ« @Õ†â?!æ¯q5çr-3ó±½}Ïø“Y ‡ËÝ\Èt¤cåËde4!c×SÃ4>?eÅeZØ– )—ŸÀâ‘´HSSÓà„£Sxjƒ~qçd¿Q冨¥`µ‹›m{ø.Q cùëYQ/Z_·3c[Øút¢Å'ñ°baÅG£_êF–TÛÃüê;Nl ÿÂ^™F[š Î8[ ©±H:ñX®’¨ô|ª9ë’2ØtçgZÐÄDµ©™Å˜"Þç ÖP8v½2¸0ŇsãëgÞàù»C§‰ÏX—#¹c§âûì:ÝR[&è@¤Àö»ûaÆAU÷ÓX½ý½MÎ<ÒÙ‚v áÒÖ_(á¿q6Ñ;R$Dä"SÓÌwoÏøÔ´hh›µnØu¬ïší¼e¬ëÜ,œ‘(%[ͼöÞC¯ê|ãjlp´/»ú4c*{×Å"P4ÐRȤÐ;JYßSÊ*ËjÁÌ´S“ûw×+•rj&Âú˾ñV +ÿêþ±)ÁÄý-®ÔÕ§¹¶ Àä?Œrjú‡‡‡kï¦0ýÇaäÁÁΑªæ#{ÇÒ1oQ ü·è ‹Ú®þ‘‘áÓQžö±ÇÑŸGž…ÑÍ=³ *†±­«/›ðœü_Ö.0ÔaQK–‘¾g›p­PÕ™úº–U]Ã##Ww;à­XQ‘Lb;¦g½“ ºèŒ;5|¡X¦IhõSÊäxMè/»¿ïâ£Eu½Ã†DÚû¼ydd¤Õ+ WÙ7 Ý9ƒh6v½w7Ö?ôqú:qèNqãSBÁÈɪͶ"H!;šàžrmJ0…©5›gö¾c`x -ÖÌÀû4¶#ygÑôËùÚÀ¹jƒæÖDÉŒ6m õ_½>§¬“8±íáÅŒÛo«ž1+ "½w`p ­ÐÒX/¯Q*­53b½êɔҞ<Ò*Ûº©tÈ+|ª"çD^ÅÔ”°ým‰a5$QjÝþ{¼)äÝ^ 4²M•ÍQGÊ×ØPq¨æ:©hëÉJ´ŽÀ BX¼Ê6¿TP3%5½Ê"sÄ4ÝzÙXÏ+>å’jCb˜&½74<\_r…J3íšÂ^EYIlûàîÁá‘¡CAV–q×1ýÉO¡3<Ûû†F†zC¬MWËy8“¶ÿƒÊ¤l(È0wŒCs­õÁùŒœ÷_ß6³Fw%vx©{ÁéÂûI|·Ô.¿ôæb¹›W«l~”í¥ íÖ+’žOÚÝUõöCëÀDuž‰¹“B]/óŽ®s OG”Ó¦FnÓQO>\p5[sû4ñØx•Û06v(§2Ù3êpnµôØ‹P¿WÇÐo”è¹3<½¤s ™~CYiÍŸï]PÿN&XÆ^T!+cü̬–ÌQù̸@ŠÛ—2‰xØ‚fX7ªDúžê9 âAÕò³Ú~=á ÓʈC=ãs´'}¾–L[3£6ÃaÅÔ­S»ÍÉ::†TÏàõé§n«#9Fz>Ä°N)™šÄ“'“ɆËn‘l}±ƒ•)ºúÃDߧºÒÝSKûç%±ÿõu²—æ„D½èSõ’у!PŸÓöl§™ó.Sæ¼*âTIo6ÍØ U× [½#vßW¤¬™'‹;ˆ\l»éMó½-oÒϳm°âc0˜¶Á; ß•¿y™ëh¢»3x™‘Ô ]Ëzõ &›~ìa;"ë±0d•ãFá+ÒJû>ÂÓörƒ¾qà¤*‘‰z¢~Jk]ä?Ê4qÛ Îé‚W“ZÔ>馷:G³ßz{·FD%›Œ›fˆK…Md³nÔ½c¤ë½Ì6Ÿ¨Úèê»ö«–ËIü̃ïÑGmöóÎSªÊ!, ÿÌCëÌA»•!¹#DìŸfê°W£õo$?ÊØz/áä;îm˜ôB#¿Úù¼P}sGǶ;ãÍž‚†¶ $v»äLj‘iBPBä?ÎVvÃn+õ.÷Íké/Nqƒ4œò›û9þ‘4mʦ—ñ…Ä9•W½ÍB²¡9j3Ú|—Ád8:9ØZšRÍ<°%Hõ{á$«š&øæÊ.³À˜Ejãµ@mÆÛŸ0Ù6ZîðëÕ†·n©:';¬WéŒiÔFù*Õ›xP“ º¡6mEgMí×ÃâÅW a¸‰î‘EÃvLmÜÎA*…|J ÐØ Ø_Aƒ‰× ž«6ÊSŽz6;KU÷ûC²Q«ùnůR›ºÇǹn¡šûî ¥¢j#ì~ÎdX,žróu¤])ê&ΕŽ—2ÉŒ>Ù·SÌmÓMg°z„r¢Ø{?d3­=”KõÎó½Ä}?©M…Vµ±Ú§N‘$žM‰.Ñꛬf!‰*Î’j3³‘¢¿·mᵸÚW©è ÔF‡·]7ù6KæÆ|t9⡧“Õ­™æÀêÞK4ÜD?­V¡xÖ^ù…$ÅãzÜß&&»²îƘs߶åçu^ŽáÛ‰ñÉ£I=^‰ÝÎ=ÓÍøÐéGê>FñQ7¢1¾®»¯#½e†tëA¹*A§­W'ßA˨ ÚW)]hu­S A†;*[FeðRj3ƒªU—ºÞ+ hQþL°rZ³]5Þk:¡§ë1øÉo[ç™Gü:ø"™NFm|¢JÒeJ6–éx£‘øõn,Ë.^=©¡),©[ 6U÷õ¨Ví³ŸÆö‚æçF ë%¡6DuGÒI;ËUCœÜý~Ÿl›ùj“«ÍÂé'Üëºp¾¸*Ïëªn³ýÞ”•Ñ§ê Q‹Á¨šU©"¿ªy«Ô¾Îœu§ ˆƒC/cÉŒMè˜Ú캷ŒÚh½¯:fóloä0ö•öß OÚxÀ6 Æ¶l„>Kmä˜Ú|$ÆÒ˜ÚØõªÕÆHß´…¨â~…Y0$Ö:p˜.¿¶’é­k¸Ýl…nñ´¿MÁ®Ù¦'ª8)Ç_¾ªZVm¼F—îþQµÑ_Å©U™Œ– F^;6FK ­;Z©:§üÀJ“`4VW w—áHÔ3]­š“ê¹`h³kk0íb‹J%µgÚ—Ïß” ÎÆAØ^¾„Ú mv††ž¡‘gJM76ҘܸR7RȦO¡%Õéw7Ðs Ž:?¤ž“’-²mÌœýÍ=6eÜeÍ!Çe•ÍõϾM70¢'¦ŸH w 8úÆÒŒ±.~O'ÞÊØ¢ƒ‘–qU]Ö1 H!q÷ïpâ‘·eÏS\ÊÎl$38V®þ‘Q›<œmdRrN >–o°26ö ÛtõãLÓå Û"ãØ1öñë·u Y;NdIÊç¨ "cS8îk“Ï/H‹–9)ì¶Ò4'}S+×»R-Y®kÖ[GŸ¬Å24;ŠÆàÄn?°52˜Já>êWච#ÂÇÇ}mÊÁql:ítÖ(gl¦˜;mÙ¹W‰hW›wZç¤äý±«W‡‡‡›sXî~ëÖ†¥ËŽcÓéÞ!Vû8‘¶õx,޶ĜÔbµA„a&æ>›RoÔ£-ÐÙ@ßeuÔ‘c—Mܶy9¸¤=âÀb˜m’Bˆv/1‚\Kt`YØ%§$ÚšÑCåk³mÐ~­cD² Ž>˜¾ËÕœâsqIµ­Œ|Ã"³Þ µWþâX×­!Îû33׺pÈìõ3xÓÍMôÉ!IûîŠ5%ëŸ)B d¼ù±1…¼9%>ÌyCÜ}F DŒ07Éy‹&UßdN ­|CHgl—ã¾×öN¿cíIØ®™Ø&á0„ü à¾¢áúšêªÚ†±Y…¦_ä·UWUÕ5¶MˈgM•uµ5SUÚn®k%òv´§¥ªªºŸ°ëïDCª®m™’¨¼3½åµ|µã D ÆÎœ쨮®æO "#k¬®Ÿ…ûm6«žèm«ªªjlïƒaPˆÑÐ%ø²ÑžÖªÊªæNÌ›!èm­¬¨á±­>N³Ú&›³à–L6ס©©jë"œQòɶª¦¡¹+s¦FúëjÐ(Õ54 f5™3ÔÕ„¦nP„M£ð[Ð;v aUw ­®º¦I)âWÔõhZŽrz°¶¦º¹wbAZ¤“ë×&k™ðUŠ[j«ªj‡§•#Ýý"â¦ã]x6Ö Tf€¯5çýà`GceUu[Ϩ*ÚrQcMUMCRc}Íø´L½r©µ¦ë"„ýÕ­=‹fĵh(ÕÕ58è‡ÆŽ>Õ…“ƒuµÕ5uãÓr•¯v Æ/éÒ¤cåÕ-›©£¹¦|Of/^ë¦CýmhÈ=jÛ¬r:#•ŒÕVWÖÔ·Ì@Ë/ýRö´7¡¶t'N 4Ôw`&eKcõÈ”LÕ ¥‚–ú´@[»‰'Ÿ•S• ª‚PÎVU×Ið¾n˜ß¬.>-(&:*›G䳪¸M«d»P&n@ïP]Û;:ó©’ ¢åR]ßÂWÊ…•ÕÍJuoup½Ë–‹¯5ÁN÷Wù&_ùú–)GÄÑ]¶É=©ž DªÚ@Ï^~{PµÙYý¥£r»Œ‡›“.4‹Si‘6\ NÍþšPµ¹õfè??梲}[®½ûšpµ9…,?Aö=ÝßïŽÄµPOÃØ¢qÎsÂ×i[o~üzCU˜˜N›Ä·WãUo•|2#ia•_tÉÝcQt²áúm—ß”#í[{ÝÄĄʲN»ôTªŽÀÔ¤àów`–OOJ•ØéŽlâ$ >¦軈–º~òÿ­ä .jhŠ™I©BuX8¡ø-±ó–û*÷›è‡$?ý¤‹-_zùô¢Âš—µÿ‹´á×ìS=úîßtMÇA|.b?ºãð_%â˜ñTé¡rÛ5Ðt§+Çol©&&ê0¡šv3µQÝær0™é™&”Ê …r¶?ÖÉÄ> ïpE.4ÏñÏ ºáÇxÚ=… IW¡O@ ,¨·cÏ,•A¹.Éfhá¯ÐÍæ“NþY¹Ý‚Ùü-Ô†ŸëOÈAC’Jf¤ò/YÛ¢g™Ä×ý 'æרÍØ]Š-P›ßÏëaªî­ôö Úø¼M ¶·•×¥øxy­‹{Ó9…“‹‚|ûE‚ãÉá®nÞ;Ï<$šCt#“Ævqq»Ò}~9#ÀÇ30,¦¬CDXÈŠšãŽ1·gzKÃýܽýÖ>m£§íYcϦ±\Ü=Ž6ÉÑ:·Á˱°K>ÝôØrãCX1Ä Ãzá«»ý?ìË;ïáá±iûY´ÍbñÒ¨ ŒˆûªR6†zzyGnÍœÆÒ!Ýáo“U)Õ˜öâ}Ï=iG?Hø¥qáþ~7^? $ú§W>;—êuýf­K}zZóíCžñÇ´ªÍ(2“¶yµ——߉G5è±ÉNfL¦½«{BÞÇóí94¦‹‡çþ*QÂ:Ï·íç·„»¹{o=‘·Ì ?]?”âëí¹ýô$üImÐ'¶ú|ØM”ûÓ‹ü}<ƒÖƽãÏÃYÕ§ø{B~Q˜¯›ÿºgRôàöP^X'Z”K©ÍŸ9ñBAÍÆ Oßà Eݳªh@³çöÆ{{y­Þ”R;,Vç.Òþüb°zpWo_ ª6còÁP·æ1%ne"°t2Àß=¿éfºgÂIÐDµ–±‘Âj“£Ñÿˆ±|Cf—³ÿvhyqŒÂt.|WQ^–oI3¹^ÖW™~i7j›ªJrÌ /W‰¹È”ÃtôŠßÌè®ÛhªýpMÝPÕc=‡wüÞI™üx¨}̱ꆦÊâ\+#“­xå¬ßcIJKN¿Îï¨+½A5bvOÃã ¹d]‹âÎÞ š?‚=ñ‘åý ¹dZŒæœbV¬Ä2íD¼%Û&ðþ‡¦¾Þ®Óly‘Yól›™7ŒŸõŽ?~W__÷èL4É|ª‰9ûÖxÄœP©¨²–·’U#Fkr(&¬G¥•M Õ;ƒl=·]A.XC· K¿”WÑ€6=e¦»upbEçÄ3£ïãIc}·]½92Õ”µJ‡ó¸¬²¡¾&#ÒÕ9ò4f¢•'™˜ûm;UY×2ÝWkÏ`\.©îŸœ‘Ί¤hd3¢±?¿wèæbµÑ7aú¬/úPUùú®­ÁÊ3QO­“y©¨r@0#hÍgèsŸµu‹!_'¶©}DqCg¿i»+É;³|éîC”êÂ=x»²º:7=ÜÈ&Z:Gm¶¯al¿Ö†êJf°µcüI´°*Š²-H·;0Û®Ùa̱O=t«»°¦ð*ŘÓ? Õß"ëZ•võŽJà¥ÔÆ€nµ&bgyuméã³4CÚ‡>ôž#ë-Èa‡ïÕ75}|y…eD{Ô*Ç,Ø–,’¾éã·55ﶆÙQXöã0¼Ùž·ýQ­*W:î1hž"%ÒUp9îp6í@˜ä(!j¨ŽÈ'î÷P*áß¼Ø iŽ:±&‰±*?çþ»aýc#ž£\íÆ»{(Ä}ÝaD1ªÍ†QB?ߟsá…åaŸ&¯rCGRâ¡j “=¥¶úNŒ•÷a,€ú½:zƒx`°|šÇ¡—vM!Óo(+­ùó=„ ²êd‚…_ôiÕâWÔ¿pëåŸÔ– ø½˜8(•J¹lÔ‚fX7)Ûïë’Ý'ñ Úγ㰺zÜS7ôúˆz÷¤cÓ‰šsÏ×’©þ""t´–§%od­XeÂ^·37¿LFœ?’c¤ç3®òÉŒtI°;*”£o²Iv>ØçÊ==Ç~¢+W ]錂î©e¼¡ ÔFÏ€õL¨úv8’u´QŠÜ™Ìü.|$%®céòˆ‘”¯k÷Ýr", ÿ2ÕÈmb‰¡‹ ±À˜ç PÝwúú‰3mÒjÓ.îûHf™Îjn@M›²ée|UÛ¨¼êm’ ÍQ›Ñæ{ &3 (gµ·›ËÊBèßû 'Y®v€šqéEí‚Oj³4'ãL#~PësÐ×y84×o3{uw8É„amƒbÍ ׌`¦Ô~§UÑÐú ‡Û²sËQ‘›02°ô&bâO]exeS—ÓÊEUz¼«öÂÁ6Óu›=8Gm”3Û×ØÓY¦66¶Öf,{_W³ªÔ-¥6Èr~—øX‚yäá7Kªízi¿Ê2ù‘M¦tÏjµµèÇ.`Á<Ï|µéª½Mg²Õ…ååb˱&Ôf…éV•SL.ä²eÝÂÏQ›¿07ÉÔ]ƹՎn'_•_Ûeœ rÂ#HAÆfËÍéèh7†IÙR¦vÕ ¿Wûm$ÞL»Í2DÚcfÌí–#¿ýAÁÿO»B–òÅtNB«WB·gBw@rŸÓ$2ñ›ø¸ŸÁªSDP•oë«ól{?Qfo¯íán^¤6^ Ôf¼í!“m+[|‡_¯6¼õéoÔµ®ËVwUþˆFm”owûxìVçþ¤݈P›ÆgGÍ7ò.Éy‹ßTˆ‘ÞáŽE“!¨Ú¸ƒTRÉåSÿ;Vm@æ5Iæª tÙË›¯žMÊ1±Q«ùnÅW¨ÆK|,U›·Kª#íjq/‘²ñ2™Þ+ÖjGiËÖÓù9–õµi¸Ë4uP.6Á~µÚ06H5äàs¶¨úfšY`ŒÆf}´/Ò:&U›86%¡dT5Øí/Ó£ÚÒs9Î?üàýñŠÛ¦Nq`J\¥Òs-UïýWÈ4%oôJ໦ò]¶uúd÷œ„‘Ô‰@ÃÀŒ*¢®=رÞ/=î*2`Ú ÔÍ/k›c@Ì5l$¥]mj#Ÿh§2X"9a(L w Î@]m–IYº®Û«2<º/êë8ö|òÛ@§×z'<ÕˆðÃ:·mÐ fZ™dË·|=ÎU¿ÞŠ ;o§6`DU5] Ôf¼2lê<¬)b´It—Ò-sÕfv•œV­Jþã£!L‡%Ô¦G¸0)K¤´ª›JmÐñcS£6ÎìÍ—‹TZ÷v+™6½Ôag©!Óz\Õ}L†Ð)ÙC GRŠÑF2ƒÛ3«üL¶ÍÂ_cÛ¬Ôa¿‘¨¸Ú‘{$¿~æãõU\_™:ù»#,£>Åd'œjšRFduWq–1ÛAeèôß6àÅÜÜa‘T$‚—É´ß‘Ú@ˆ–CЧoè_¹b™MiðJæ{líõIíty8z~V]Ëo_n&èéQ"RìK^g²ŠZØ-A›ÍgS—  ×n¤Å¬1bº¶Îbn íj7XèE¤îË®˜*;D·rË8uéXZ"‡B»ZW­jƒðVê¯NÚëæFƒíLŸ·/4‹NÆ›ÛyFzoÚsýòi/srø±çs½ÄÏvèR,ŽdÝ:”ºÖ{{ž)‡–´ÿt>¸x¾ÕŒI§×ˆ‰V?Ó÷–¤k¾%ãòÅSk\ØŽ‘gæ© >——hIJ^½1~ïÞ´ÍBÌhÆϾÁgÔ*yú¤¨mûÔ‹+ŽºÓ­}.ß¼ê¸÷è©•F¦'³ó¤åsÔ‘l ‘Öm=’ûqAZ®¥ÙDd|–mƒH71ÈkSä¼GGè8×/~ÿÉ—ƒ~NÌ@WïˆmÇ.ŸN·¡›ì-XºKTÞÝâÀqôËÈÌ\ïma’ŽhñÃŇýÖî‡N_:º;žM¦ßhœYRm»•ú¡Éû/½Ö>Y ÕÑ5ÞäåvúÊõ½›ýôõðQžâìFkK¯ðËׯoß`À êÅKX2TL6¡EmÏÈÜèëE¦ÛŽ©ÃÙ@§˜ùͪ{žúË»l7úÛ6”w¨æJTx )"Jk[“Ðç’Ðë´§mã¤÷ÞAŠD“±HJ†[ÞÉɹ÷¸sB¦éMÞæܾ—_8&Æ'.!Ùý{w…*Mmy–÷ªHa{ù‹Û·s«±Ÿ:kÊîäÜνÿ¨e@¨2\&*nÜ«òhBò¼ûwú§0£{ ¡$7'÷]7ª ³Orov-Z>v2ÎtÓñ~EáíÛ9ùÅÕJBdS9wî‹ðÅom寲³³ Ê0—c_ÅË[7ïã³ßãõghfÑRÕt+þOÔSð ÷öíÛ…ï›ëEÜ[”ó´žÓ{´V=É»››››÷èYKߤ&sß ©kA› üîÅ£ììÛo›†Ðãu…y¹w ä#ïo>(×øk£õ÷ïäTt/”ôÖ²€5[æ½täVÎÃYu5©}ó ´ Y1Ö€RŽ™~ãíoïäæ–vNû9Rï|¬+y’};·¨¼í¯Í€#µo_äæÜÎ/ü(Å“!ìx‘ûs½~(¼û¡E š‰®zÖã¶!‘Êûxãþ{ua¡%~wP„k_]qNNîûíƒ7åpåÇåtèáìÜ{OúgaµÍ U—¡uãöÃg¥B9ázÆî2ÖVqïNÎý'Å32QnÎb=fZgFøÄ]ÒØ5-¯ýöþžSW÷gö$¨œu0Ö@tG%öÙ%wú=š¼€@JT~ Lˆàë@ÕfCfõùêñÿN§8§œþmizïÃàĬ¯ Á×zëÍÐÂ~b™.ä;L… ßõŽ’ºÉ£þ9OBôä…¤\ý=;n®§Åµ»«²W)?Û–ÜíšÈ÷º7p–+±I)%ŒýN®¯æx4kÝáª/ºäÉÅT –±WøÞßÖxÿ[<äeKºY6Om¾Ç±1ñ‰ ˆ‹¹ñú{-Î(?™¸˜øØÖé×e”N¡ÒÎ>ÿ¶™ö£“;x<ºÓ·3árq~\Ÿ{<ßéÁÀ%•{Ï:Ts€Ø|«žôó+Ûß®;Ö–ðßšmóÝbþãÚ6÷zÏGó­ÑaÒ¸r<©Ï-µÍûÆè"Æ׃ ߌ‡m×bºíÈ@jWÀ–.ߘ:'–æ ›oÚu‹~“,ž»‚aqú%¦Ô—YVßùµ_7Æû*óPË'´¦Q[Ιó{k_Øê§Éw±|ûkƒ{¢{’Û}'ƒJH ã3á¿[µyríæ¯ðÉ–å\™œämv ÉÊ_ÚrhÅ¿›coœÀÖ覬uwó ¶73?’_ÿ­"\¸ªë÷[›S÷èUuV²Ó½ú·?7ŒK¾$‘Ó¿ý[2ïÆÏ|ð91g„aëíéÿzª o©ÓFJ®´Lˆÿsäýmö1+:‰B%Ó¬}ïÕ‹~]PÊ;þÇŠPl J"8sñ91¹x:ž°£x©œÿž]ÞkN3¡PI,‡àç]ä÷§6SÈhL—}|·ë–.·ùøœ¶ðþaåf‘ýkéV´uFê…ŽB'ÖÎÖÞ#á—IW“Íçwt¨ÙÃf,¸›…‹°Û‹N[]À?vqŒüÈ’ÂÚ#°xQê¼#“|öß©™{åâ”j]×Jë~s4³zb¶éBÒ©gZójÁ¥¯O:Ynz®©(Zï…þ=áLÞ/ÖbÀ°V³€(2­'/.‘y§M¾b±ßc‡Æ?fQH¼1 ¤e±å<« ^", ÙpÃb;ñùâV«ð}eͪ\\T÷–V60²ùˆ;¼ùH†ö£Òß—}ƒ=x‡Hb:m¶ð=wò1_&~L±!ðz}}‡blHæfæUk-$É!NT …Ʊ=ÿ´«d2ÉH¯ª±"ÚÏŽJ¦¸oÊÀŠ(¼LMè ÙØäX;‰ÇÆÑÐŽ’es¾ žÈù›Äµ?ÒRrÑÞŒI£°?jBo²6D¯BÃÙ^-GA³ÿçNƒl²öaPF%,íöÝ£ê[^·Yý ¨:C²ÝAtš°\H3Ñ-+/]ëfI%SýN‰Õå0ÞZâdJ¦P9v~/›ˆÕÁЇ»‡-X ™ä”Ð2†u‘%‡ÍhaUÛlI4ƒN³Ø‰Hûuõš'°¹•‰¶ÒPgˆ­ï‹F|¨ÿé¿9ñ_ùÙ›RMÈQ™ñ\‚ ’\øÓʲá¹Õ¨qäýÉúpËÛ_2ZjÏ26aDº_tÚUô §Åª /±åyŠé=ž4v4ö¶ h°y¡Fx¤h~g^"°èÚž:‰D6¡EìËžQOxwêè‘»»Þ­ó°¢’ÈÉgU(É'·¬¦˜Ñ-¼ž6ª¦¥&ZKÂ\ÌHdŠ¥Ç††a|ý2¦ÿ/‘÷Q9‡ß$Ûší,PEšñc0²[ÐãÒPÃ?&?šgxÖä`¸FIj?úÿlßG¬#œn0Ñ¡ðßfü‘´IÄ/6$QѸ“ É-R\mö¾¸±=„B6¡Û׉59U§Ê=ÿÇbÿãM's&Dßw§o>Ò(£ÿ½ú&&÷#]>V·:‰—ù¤yì÷fÜÈqt—M|§«™‚¡¿…4•dÅZ¸Fãe- r fäÔ"ò>;Cò¶g„é1ÄX±åÎ þÆ 3ô<Þäáîz^ÇñuÕO. Ðt(ƒ¾þ2>g­ì¡­Jz>…/ M362<ü{^@&lã0(M£rÍ“ xw6{çê¥ÎI¥ÊQwrèy9™m–àË3áv Õº®˜17eQƒNMþRÙ"áöÛÔK†ŽIN‹ {GðÑœjXÔ!zužäáº:òb—ŽÖó¾9á`¾é%zÉ–ëÙ±ghtVë¤2uLn5c@STƒ—­³ÈX±¾‰û®bæR,•j‹÷ÉÉh§°=h7fÊa¬˜+jµa½W+òÒm=žCÒ.3ŠAýhbhP$‡ Ü-wr(mäqÎ~ècåfkÞÍšïwƒéîYÚ¼²Øâë¦ñ}̸€\Ö÷ÎnHG]õ¡ï{?‚ÔÖ¢6Ûl‚³U9S»÷gVœ|žÚÿÅØœ¨ÒÁ’ö zdî ¡¶3Æzì¼Ç{µ„ã7ýÞÔÓöæàQù°Í?Žr]©¥o^Ko|~Šë¸Z3J¯¸µŸã·ñ¯>>Òt‡Á`0Y*èT’ ÛékÞ8±Ëƒœp£J!l2¡Xô`£ˆv ×q¶áÒJ;TZ·æ38<‘9à½ï¦¦¤.„:º†Þ²øæa3Ò ¶¥CDÔö6üÑŒ¥ÕF‘ä¹çª&KaÎΙùˆ D‡ä¤Y3·gƒiʹŠÏÉ\ao>ƒf=!Weoéq‡j#vØì«£OröÞwÀ|ŽÚT?:nΡ¯‹KIÛ»7ÁÛš{Y¥6TN³P•£9zÄ?…„¯™ÆlÔ™[Žé>ŽT¦¦@˜FzºAÙµsÕ&ÅÎ|ëcï]yÑ“t·cI¯þ 7Ï“ˆè%Ýû,2˜Ç ÜŠÀã–TV—PÕhS›¹~›¦ŒŸ™1²ù¶Í_Qª1 ¬t²¢çU-|Ýì»»™l}*ƒuðf’%'½¤ówç(VOÌjsÂýˆט¬8Ô8ÏÙQœÅ´óR%jí° Šÿ«j3ÙñŒÁ¶Ô’%¿Nm¤ï(zÞ„ Ôgmâøïr,ÒO®j$Å¥?k!:Fd¸!—ɱCÕè^R°í¶KšRJ÷¶¾P¨ oŒßµ½.{ýô²j“—j“rNÈA?‡ s/É_©6ÓEL:{TªÊÚüTεQ#©{ó4Ô‰q¸hŽÚƒI?§—¨2üã.?fÌ\µ‘©ÕÆS›™:.‰Ô*šç»½æäu¦xi‡?ü,ÊÚáH±Úå+a2.Ô-ÕÏ×Ýç8líºèu¨I†ëàx=ƒå-ùj³õ³Õ&riµYP¤\za‡¬þûѹcæ›K|>fç¾ç2\ab«™R•ìpÖÚ}/—|ãÄäcc'Ì—:ÛÏ¡0ž«MŽ¦Òœ'U£ÄHJ‹Ú̼¡èX¨û*åÄè¨dáÖ½ŽºÔgªG5£=, V1>ÌáisSVè¹RDe0x±]*Ц]’¡CQ·¡“)ûãPSáÕ³÷ÔU¸Ž³Â´ižÚØì%ÔfFå·™y}X‡<ªº@äbNºñ¦ÿµg&G'ç¿ž]1ÝÏbÐK‰÷^Aþ$½yj£œ<µ÷À *k§Ç¢=£Ž#ÈÁ|È!Ȩ›®îuâEòñ@GSvTÖj“Cg.õR)qö¤¯ÞÏõbÑ‹Ô•œMêW,É.""¶”à_16öâãîQG1•j:ˆ{¢§ÆF§¥ÐB¹u1˜œxkVÖê‘K‘æÛ®ì³LzÜæª /úõj ÇG…l)¾¢-Û1`/± ÷Ý Ó3Øüè³l#Õ,&ÝÖÇÓŠJg¸5ã-ºáF ›F‰JHò07åú$Jp‡'—E{­V›Š+ž¼Õ¸Ú }^ cž­Gú‹É‘—»Mé$ÿu›CÝm¨\÷ ¢®Ô§ý…¤Q›†¿qb,„iÄ°öLºÛ ƒ6ÿq¿iá³6eW¶3htàpOk:›çèããD㘇mÚ¢DfQÛfßzOç€ ›‚Ý(lÛ—êu>ٗͳLJŽ·$Ól6_C£'mΤӬ>(°7ÛˆÕù[ ÁF,«Ð„ƒˆ|ˆBcb^b´¥ø±M-“ã­(4ë¨+XÇŠW;hÔfwwËÙÅjeZÿât¬u~…Ÿnq¦SV¯]gÉu8r"À<{ÇK ù nÛ” dRÉa£×ù;©¼¼NÌ5¸Ï™gÄuË|•³?€Í³HMŽe±Ì:K3ŒõÙ©—Ÿ"Ò^ ë“Ú´w{‚ùÈKr¨$GŸ`[Ž‰“ÏÂó|0ғƵÜãÈ21wÛŽ¹_qéO±'‰¦{%i5™Ìtq¶%Ѹ{^R-]GýÓ¶üÉE ”§Y‘($>9|ÈI3!ѳz°@ šCÿÁ‰Åև🱙To/¯šQäBªeØÞ×jµIÿ #Z6'ç‘Öc¦oÒ¨ƒ%-¯Ui,íßòGQI²¦s̼]lè¦6/†å µþmø¢`H)ÃQBê÷Á°B.ÇÉ!õ;ÃÐ/šÕR.“+‰/Jv¦¿–øŒ¥„Tv;¤ÊšX sÎT(ñÙu™T iYö£P…&GÅÞ°‡&ü6eB%ñðÖ«^m«¯Ph‡@J%9v¼O–&árŧÔi †¤2™&~è¯ ¥–ùÈ)~™ßõ¾E™ ‰^¢É4ù§¬Öäó§0a,~XºÔI&ò–/ˆª*ó±ìAæ„*mª‘0¤.Fâ Ž”ÈvÂ# ˜“„5Þس³TËòB<6rU&AJ) U„¥èqªÕæ·±—{\Ë„ -b[ wp‘XßõÛŠ /ôÂþ¨ƒkÍÛ™0ôûät€¥ør™NŒ endstream endobj 1022 0 obj << /Type /XObject /Subtype /Image /Width 151 /Height 41 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 2051 /Filter /FlateDecode >> stream xÚí˜kPT×Ài“4¶œ6™ÖÖ/5“š™NmF›i›6 ¸Ø@ÂÓ‚¤ˆò¬"o—Ç.$†u%yQ‚ X`awy,°,°YÞìƒ}°ovÿ½—å±»¢Cgʇóûtï¹çuïïœÿ=ç @ @ ˆÿ'F³K/¬f³ªŒÆÓŸÊf‘oÃJ7ÓðJ¶g¼Ì÷|Ióâ/îk}ßo½(ê÷uñáêVÆØ©äŒßT‘cCíí‡;8&œ‡c󫯟÷´w$`8.§²#dÒ¾îgµz”àtÄÅÅ+r**…¿ Åë6èÇŸ”“K ws>ñ ¼ß1ü´AáH[ ÏGòîYËR‹ #~õ3Øf îgaNŠ'ÖæÃîð“íðÏ P`95ð€ oí„W¶Á7趛†)GGG§e‡#n—²î¾€6Ûìä}I±dØ2SѸ(ìõppZ•(á1’ËélÓíDÓm÷ÐT‰Bi0–g*Ösãä#â˜wçüÊçn­ŽHHcñ¦—K芈A¾—(Ø•^«)»v1¯’Á¨.8é—˜\Aï·j_Ê®9p1;á\صrë¾å%Á·Ap D} ¯Ú@tÌu€í+pÐòÉ`û2d‚€¿~ ö»AF¼±>|½ÄÛ~‡®|<™ØhšÏ,ãf Ì<:è%ßjí]9jì•õX·„\F|bB9½×ô|²ù¶{Xê¢ʼЯ“Ø%\¹5IdΘnYeû?ŒÆêÓ(Åq~ÌÐ)䳂‘ìôä»û¬ÚWŠ„ؤ}HI ½j%Qý]ðð1Èt n…ßþNeCÞ°±º :ðüüæ¯07¹y080 >ïÃ>š²’ÈZÔ;Ï Åõòððò¾z«VªÁFjÃA·h± »óί$•Jœá“’è󉵪{ÔYsóÄÇ^>¾~×?‹ÿ›sÄV“èüÞ¡tJJ½I£å’}O‡}ÝÞÿ$¶UGÄ;9ãZF£ÕµßNw ËÆÞP2Úèá—bÊ#æs2Ó¬%® ïºüD ‰øÍt¥€¢Ø»v¼ìYH;6?€Q-è5H€»@¶ZäËlxíe˹ÁR¢}ã¸D"áHÅ“%×S.f/÷‰ý/¿ æ8L5Û{]”˜$²¾ú»OŠZ#IŠð Rë±fýí$bÆ@Ï‚C˜cXJ[qò{„o5‰.ûísK«+ËË+*+‹?Ï:YÕÖ·y‰#OîŸ LLÍ Pòs2‰ÞŸh˜Åjn-ºWØdÊ#ÚHâH\î oì‚?ÙAó V%já´ÓŠD£ héðËm@ð‡Ñy‹â¸ÄÎîž^žžGOœ"^+¸‘•B­ëZ~¼”ìO}ÈT Ö%ŠÙ¸D•Z|%ί¢-}m¤Ìì{%%aÉœogñrüºƒÛj=ÜÇÖâ› ?)9iퟸ‰ÜöšàȨ¯ªZé-ôöN‰Ú¸¼ªÑ¦‡xÕhWd†²Ó/—Ñ6ìE=N¯UXLO£xÐÁ^Q¹g'üùäœÃÃi»ûþྦྷK…©ðs[8²%ë1€Ktä,­7¤ò3Sâ¿xÐiŠØ)!þ7q‰M˜Ä ¾,2¾´’Ø‹IÌÊ®Æ$&8|èG¼¿Õ$γ]í\Ì6=±ñqw[Ö6·> !J¬$Ž0B}¼:W%Ñ«ÂâÒBóÍi>ÖÈ⃌yÄÙ¯glZ*™¯Í·ó&bÉ1ÇËÚp‰lz‘DîjyU^ß. iÄ¿8ÝRUnd@ظ~%A&̽ñyC×t;×u?<½@¶jÖ×9æ|¿då–Ïl"ç OXHœaTþ;·»Ð¨­µ¥W³®œ>—B*©ª›‘j$œ–ø,Ú¼LÍeÔS©—c"Ï^H¤5³F×·Càï {öÀ›»Áîдü›Î…?¾ {ßàͽvî‚}ïÀ;ûà÷¿g?àðÍ$Ά[lŠ'†¹WÒ)…·r3Iy¥µb+44rÂg7ïÔÜ«.ú‚|:†¢ÒÈŠrâX"<Î0(Tê·óÒúRJ )“VTŒå9v&mKm1–tJ.gHµÚ#½zqbbB,W®L(™px|JoÙa­z‘ÏQ¬N^•\Ÿ˜Tªµ{‡YÁÔ<¾ìÐë4|n£»‡Íîeöt³8\¹J«“‹†xlJ §x=X"»·—ÍêéaŽÏˆ-6ìJ)ôtBÛ*Ö«æ0áI'H—›O½ÚÛ¡­ ZéÐÝ ³ aÔ ÷szë}ºR*dwwõ óu«¯eÔÊûXÝÌ>®N¯ä – úiO,ÇßP)ONM*ñÖtcÜnÖ€F»È×o•­þóNlž¾]K}N‘g]|磞5Ï9±1>ûÐÆ¢m£yŒOŸÀlr{ø? !@ @ @ @ ¶ ÿ›­ C endstream endobj 1034 0 obj << /Length 753 /Filter /FlateDecode >> stream xÚ•UMoÛ0 ½ûWèhªoË;nk»õ´µvèŠÂ±•ÆXüÑÈ^·?Ê’Ó´I‡`…"ŸøHꉠ{DÐEô>NϹBÎS(_¡”¡Th,2Žò ÝÄ×ã¶.‹¡H,Õñ7k¶~u1Ö•I”Ä'Þpe6¦°Æÿá˜ašÜæ—ÑY=D#ˆzpS’¢²‰nn ªÀ~‰æ™F“Wƒ„ÒðÝ ëèkDB¢ÓËɃñ 3éÀ„&8•Ô~n´D;ƒ)p!˜)îE[90^=ѧgR²À_ˆ Â<ÿõ0ôwv(†»ÆÞOŒæ” 2Û+A &Xú¸ï‰ q=¬¡™ˆ‡µq±§çŠí…ðK I½rÒ‹€«âéì]ví`ÚÁÃ7]Uÿ „AsÄÔN$î7kë¾<î;këåÆ„ŒºZ eHÒö¦œ`Êb³ùãmE[ùE×Φ®õxŽÓdø”ç_d?Úlì±@ J5¦0O‹©ÌÊço‹{ãò¤ñ2a$W “ñ Hãd!”Œóuðø™À˜™„ÊøÏ£[vÛÊo”Eë,^ÏÑš°U‡²k–u[ u×úÇ©)n XzS¿5îô_u7ZÇÒÙ(.Äx8öTîioWnë ›:¤xØcÁ%VŒÎm«LÇ6—eXk={r%Á’d¡Œa̪jÞ–æ$L±~:ø¤À™Þ9t«•5à  •z3NÛ•NŽàhÌŸ¦Ý Ö!UX§»w­‚>¾’’œÝp3 Ê"RX¤8ãA¾Î~M?ͼ„¹YK^c•¥ÿq i–ÍÞnÈpá?á"ÀjklßµÖ¼ÛÓ@Êj9s÷Þ çKУ _ÊË—¥ì¹&s¨Œz…Óôõ·ý¸…›þ/Æ”À}Ôü­”Ó{GyѾ"KÏ~L´x§ß{o€ Ão~Ž¾QÞ$Z‰i¸àûÃóa]ôÃüZ ÅØ‹×ìjÜûLÓ×_ö¾ï endstream endobj 1023 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 319 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22984 /Filter /FlateDecode >> stream xÚì@Y–÷i»{ÂÎì·³3;;i§gvv§ƒø29ç ŠA2ˆ€‚D’x$#欘*9 %JμX÷«z ÚݸÓ휟ÆWu+Þº÷Wçž[U!@ @ @ @ @ @ @ @ @ @ @ @ @ ¾»0 ëïïù² lA«ª¬ÖÀÅ÷—µíúMžÁ›<ö‚Í7“õ;vùù(–E¶Û<3ªPz%Øv¹ÅÍà @±,Z·ÕY‚˜Å``` Xð¹Z  Ð h´Ú€€6``@  Ø‹6Ð-´[NÚœ¯³[ïðúõëªÙêíízmÀÀ–ÑB/¼&SéaaaA³ôÚ€-/m(4Fxxxð íÝ»7..è´ÚmÀÀ€6@(T``@  Ðh´mÀÀ€6@00  Ð h´ÚmÀÀ€6   Ðh´Ú€m€6``@  дÚmÀÀ€6@000  Ð h´Ú€€6``@ ÍßRŠ°w&Í\ÿ‚ÿ]x,ez±é™ oáýb³çcsv=ó9l ®)Ðh󃵃ÙWí\ƒl]Å´5ü¡g(½tUnݳvÚcYœ^†ƒ1 †œw†;g'΂@Ú³–n{·F?ÂkýÞ„cv±Q/æ¾åôRÎÞ”3›¼CñÚ{Çz¥—'•Ï&¾åRs<ÑÆÑ×ùähꌫ™VÔ´ÉÑê˜í<»ÆÞ>üTpÌE  Ðæj!‰‘42EÇÖÍlƒ‹™ƒ‹‘¹…ª ¤ ãmBìQðü¼(4U’â†p! JP3XANÝý\oZ !"#öP©*ÞXøÏn4eË}Ïöj’î˜hÈRêêzæúVëµtô”hŠ ïÙ3N¯\¯&K§STM¢J Î/,ÑX»VÅt‹¹ƒ«ÙzG#cUUeEµmiM)%  Ðæ‡Kª¼F`>J+Yòà S²šcfª ‚§<ë7וÕ÷h¨#k²¯™)ðyRË‘§›1IÅe‘¨ •öä±–‚¤ñþ—xÒ´Á¹”ô ÞH‹¢lèz½ŸY†Òñ–bÑW‹- )4g|•)÷&ñ$“LSó Ù«@× º11ÕÎÂi£.)cw¼ûh%qÀøŽ<êòÙãIR¤o=R3³M´ÚüÀh£¾ûÑôœÔ 楽VuwB)áÆÄŸ?J‘Öz†\¶Ú*ë{Ljœ™¤;eÚª †Þ·’qÔ”Œm7§QÌB\¥|›RãE–UòÊÀGìðàŒ=K§QÖ,µ§Š¸.Îë•tüKÛŒIòÖÑ%éb÷FHÛÌ6¼é4Õ:K/Ýl¨L2 9  ÐæÇB›Jâª.£±÷HJ«Bî6dºcîB$eÇ+´w_Ôe"¨r0ÆG^Á`÷]Þ¡ôš‚‚KÎ ‹Ñ¦ˆØ ‹¹”¢Å)fÕìX1Ž‹’N3eºÆŽTáœäçíFJߘÄt¥W¡ÐPkyÄJFæÓFȱ„ãr’º»£T¸²@ Íµ%µç)J+#,µ;rç……¬ã‹·¤Ró®ÑäéNé¯ñú›Q9d§ºV'8?£Lä¤UbN¶tŠe´•¬¦×“´J1@÷mÒ+û×)­V x–Q>7)­‚ãjÆ XJ #:}—¼üú}g&áv¾š¼ÔÆl¶0V¼0mð¤;è«®rÓàÒm€6?Ì(1…®e¶AßÂ^ßb½ž™ª’‚‚†GÄ.³˜ïàIS³>X€2«Pf Šdú+Êo:P"ê­Æݘ„«÷U”¨tcÏè瘠Ͻ‹6ƒ¶Ê«UýòÓ¢‹ƒj™Dćì5H:þ×Õv]ε·ÑÑ°IJ\’6Éy9´Õ$çë<  ÐhóCí“¢™ºrðÞïà½Ïag´Û‘‚äJ¢1’òbØ w6Èd U mÜTÔÔ( k¬âºÄy‹¥v™j¨êïÈH.šÑc¾8mðfš»µŒ¢qFJÕì芰%¥D×tM'âÃÙÇHd2CYU¸_ÜèT*UÃ$ì.{QÚ”¡Ø$g³ÐçøÁCÜh´ù¶¤v?AD»I`L¡ëR‚¯dR×0\/tEÝj‹¼IØᛯíÌ Õ,ƒâ E=Gi&ªzNiÉE³º¹‹ÛàM¤ðÄ Š,Ùõʬåñ­Å圥ÓÈÑÕø¤›÷f:Ã!øæ[á~#o¶ÇÞ¼§)£`—R‹fá(qI·•:ƒa™ —h´ù‘D‰…‘Þ´JÌËŽªh—\>#œ[‚bâüå©F{oŽŠ:¾§ ]Ùê`!Ñ=-² ”F<}‡’5›êѺnÁWz„=àée(æj‰¥ aà{¨¥t™ª®Òôt¦‹1…;EþΪòzÑG*Q†€6öÇ» {À+PÒÃvw¯m$’ªËÑ6èÚm~D´!š’–ó©fÉÌ÷&À€6@›ʹf·cDþÜŽ"ž·óˆ»Í™ÝOM„GÂb­¼. _4H-ر3Âñðý9´Ù›xÂÎ=ÄÎ-xÚvøí86  ðÍn0óìfŸ0;·½ëw&x­N©l°œ·;`Ϻ<¼Í5g×)ù}Ž»·®J-nÙì´_ÑÎU`N‘×?æ§ÁƒÄ@ Íà­Ì9¯@ÎjU-ü¦¤ Ø’²Ð‘)ïÜã"oe¦ˆ_‚m‘7.÷^5@  Ðh´ÚmÀÀ€6@00  h´Ú€m€6``@  Ð h´Ú€€6``@  Ðh´ÚmÀÀ€6@00  Ð ÐhóÏb)Å(¹ìƒ|h´›¶",¹=Þ•TྼöÔ;V8Ld2Ðh†[b5j¥ê" ‰aoWÉ'¼à3Ó ™i¸0 ;e>'&SžWÿÑ3µ€˜L/b>c>,YH,SÈgp‰Å„s yÌ»¢Máñ… xLæ Á¦ž1ËóN3U0™QÌ|Æb>-Œ/ƒï9›™œÏÌgm€6`ÿ(‹¯E¬ÿ÷kœ ™†OÞìX.Ëx<Šo“ÿé§ñ§j˜_ê0ÿ¬Ìüƒy²’¸â¿§“¿UdV fn-ó÷TbòošÌóÌ«íÌ¿¨“ÿ¡@Ðæéó7òÄä_Õ Pà0ùB…˜üBy®@Óï›úEf by"šüR—™×ÃÌzÉü‹*1ù;2q¦÷‡ˆÔ}W™å@  Ø?˜6 ¯–y³Ó´ÁÑŽ˜µHôÕtüÇ+Ád1R¹hò• µDü»V¼©©Ôbâëî¢ßÂ…§R…›*›±p‰`W3R+ó?ÉLŸ£Ì   Ðì#¥MÖ+æªÌWÿè3Åác¿y©åGTä€6@›”"”^…2ÊÑœRËQ~-ƈU [Z J«X8)³Š¬ßÎܤJ”V6óˆQˆ E0´%¾XzÙ’#§k‹•/I›b˜9á~ÓË…C6`¢AJ‰#!’*#M ±V¥øPÅc¾LÓ¦ ¥¼F©¥‹dHé[ŠB˜9ÄQÕ ¼£OÔh´I/í6WQ3Øyzö|žÿ.†Žåþg(0ÀˆÆPf(©¦,0ÁoEÓåêøŽmZ¢¤Ù©E=ßG(³ä•ž"yj&CIYE×vKô3b –é89ëjï©¢#úÔIš²õáçi%‹á‘¨_ Wh©©zž˜¥™´IºùÂnƒ­’²’’º±mðí#¥Ó<9x<ÛP_›ÆPÓÛ¸/â.G0 Yñš¹©gʦiu)‚£¦ió”ÅÜ{>(!Zi꬧LEÓódχ½^Ê44öjSpÎP60O½d–‚o´ùѦ˔N×ó>5‡6~>.T “}OÐᬠ.ûN¸î?év(MŸ!£dÀýÐI×ý'\öe‡?䆧åâ¿]œt‰ˆÓ ¬ÕØ–ìvHÝqöàsœ6ÕÚ2²:;b<£rÜçà+:úïU#¯ÖØt,¾Lôl ³è­1•äz‹Ÿ–ßéáç­¬¥§F¥ZÊ_˜68žî SSa¨ÑiúnG£MäÝ»Jò2zۣܢι„Ò Ê©®IxánIØ~_’‚Šýžc^±9­I ÛàG˜`€N,<öYFÆÌ=Ñ#úÌöž”µò¶ñ5¸Ç2M›/™P L‰£‘UìCOç>e²öçM|Øëu¿DU…l»ï1îÞï(L¯tˆÛm>ÚÌ?7­bÄNu¥FPiÆBý )Ï[ )_ÅõÌl(eWk¯•µJ¨JŸq ޟƤ“eOŽ“%(ér²¢’G\ ŠŒÙOÕñ~ÖaLR°XŒ6Å(.ç*CuK؃ ½EióéŽÍ*‡Ó©ÂÊH &î%K6½;‘ú°BC•jµû‘سb;XÈ+m{€/™òbÄÚX^uÃ¥dÁ)às<4äÔ÷'V „™Qâ¿h¦ÄRIÚAu½æ¶€ŠæÕ÷îPÊü­Í¤Í¨L4  Ðh³mðŠ–t퉊’Â:¼Êjt°»¶ºs:Ñ8ºÝ…;[TýËPÒÑ@²iè]Vô©³ ²¼ë¥éHˆo¾ñ`!¾$÷ÐùòýDÃJÔ+e/KóI›ó-LÒ†À¤˜iC쫈몮¬ ¬i ªª¤b¸Õ%ýuŠ S)îˆój9«ÈGÑÂ×®)ÊImIhÇ÷ko#Ku¸±ÍÍÅÈv‹Ž¶2EsÃÎsoS‰QƒQо@’ MÃHSÏdÃîD!mðü Èb^iƒ(1ÐæGG]ÏãÉœ¤"K.`íòޱܴa!þÜMešÜ†ØNblî’SmCdùTjFyçÒ¾è°ËÞAaŸTJ/¹€wý™ž¦ŠŽCbb OI Êë=^%<ê•®¼çþÜ1ñóݨ½F}çýôò-©z‚‡ÃÚSÜ•³œ´)A3#×|)½zµÆºðýù¯Ë!ñû(òaÓ«Œ¡Òþ7§ý¢K®”íêjMRÚñ€…Ãgš6÷G˜î ‘4ŠòºÝiÛƒS¦-ôxTßÍ\Žºñdz•¨·(óɆiˉ7éeKÒf‹&C7,¾LÐÈ*Cû#mdTB«P —I{}äc¾p ôø yÊtmðL6ßÃ̪†(1ÐæÇ×’Ú™“QAôOÙn_·åñmde)dE²¢‚Ð(d*MÍÊ÷ú¸&!Q¨ ÏèUfi#êÎ.G1—žšêiÐõ¶Gå£ÄCy“3âH±Q8mnψ“8;¨+Rí÷<ôÏyºˆÛÄѨ4%5M妢iz¿ËŒ"¯z÷åRD§Óf¢(iS“Y±4mÔ”lÎ&—‹žú;·AV)0¡íØ`­dâó\œÉw‹U•IÓq÷TˆÛm n3Ó·1ô?|òYàq‚s^Æ<奖nâ%ÈÅYKugyzÅòÓ&¹IôÐNŠ “ùì¹ÆZ¹õ'ºͤ)(íz0‰ ÚF£é‡<<ƒÏ|Zkm@¢šED<कˆø¿@”X'¤@ðÐΠˬè2%Ë„ÝO/Ó¦¢ÃŒ´F/êå;h³§Í¹y´Á¶ÛY)›ºÇ¾m Š˜6ÿIfî<´Úm–è“š²Ô’3ª¬ó5ÖL°,@›Y½9Ø{ÒÆvëöõ‰•éâÇó2Jëõe%Í’[R®ÞW¡ÉmNë÷ !w šö¾xÁI¥´­ÓTvHIªšÕm4M›Ü¦´U`òÂQâôJ–£¾Ãålºø¹»ÌgÏT¥Ög6ãs˜Þ2Ô ‹ïI<{‘öÚ _g{ª¾CäSLH„ ·Uf¶¤.4C”h´y7mð»ÿÕdEºct&ŽÊ¢Ìjt²nØ”¤`Sz\çItyÔîw!ì6Gøl3¾Ø‰Z®­¦Š¾çéÌ—‚Åf8!Ú¬póÐSPÚ´û¶ ^ôîÝ¡ ¨íwm8½xpƒMÙ:,¡ {…Ž\<«&+c—Ù/xl˜çæaK7‰+#VÁ÷‚¾ñÔ™q›ĬG‰Ïí/ÃAyd§‚¬¾ï„n»†¡w&‰²q1V^Zs×]îçd¼D¾þÛiÔ¥h_‰2BdåÔ]²ŽãGR‹vîÜ@#Ë´g‰6?NÚ˜P)ºž'çÒÆÛ™¢f¸ïálÚ(¥X²m Hÿk;—6šRÒ–ñ•óiƒC#ØUGys\² ¾¤ñÝ}w¨hè¨j¨“É$Š’ªª†6CÉl×}"rsá:CæK;æ0Þ&Ú„'©jhR(d ¯¢¤lèv+ô…¦|›¸²>s3=ª¢œ²¦2]žÊP3ó¹TD4IRŸ<7Vgäèjšª$Š²¡×i¦ Ì’œß O—¤ÒµU5uðÍ L›¡l³çÉŒðçäLUbÁLo„{0· üÖHêB§™R8¹/»`ß=ö,¤…g¸7¶À~Kx‘çÊößèM)…g£®V‡d—¬Tø#8«4FÎMzÚ–]xè—xºïvý¼ÅJçóˆ?:p¡*$»8$§âÀÍÞ”©7p°<íÛw¶,øté¾+í8‚„í””‚ñˆœbñÆE|ª,¶`FKêd5óOJñ/úC²+â x•‰8ë‰ÈËÕ!§‹ðýº3’Z*ê­­?âLÉÞ¬¢ðKmÉca9¥‘÷'ñ¤ÈËå¡{RÄ{äÞ«½9MÉ‚è~TÎWŸ.»Ør¤€ž[z0o”ˆÛüžÂô΄¸ Ðì£þâÄàpá› ðÅ   ØGL›ÜæJÃÄ'v`^ï„(1ÐìJ›'Þ\hDIËf1MÚ¬ ¾8A„g‹øÿðÏ/3_Š?ç´Ú€ýƒh3þ›ßádøë׃_|¹\†o ß&÷'?¿ÕÇ\Âl|O¯éÕDaÂØøKñ¤5âIaÁ¨ž:5)$F͌ԙ —ÌÞ” ;Y‡˜Œ-Ìã%Ú€ý£,©Ý ?óaèÏ_^üâïý““R ˜ÿ­A|gøZ;QÓÿ¦ÁüøFqüæsSÚ‚ùGñaáôBÿ¥L¤þ‘A¼>y»ù1ù*3ññ=áÿÑ"þ;ü•žhSš‰†ÛïÈÄ$¾©ÃÄœ¿ªᣰ‹ð]b  Ø?°‰A¼ì™?‘ñdly-ýé8ñ@ïæO&sk óÉ8A›À\¦]8s{óf7ñóàsÄ<‰ñ*©öÄäã1æ3¶ha—$f^/QTöd3×ïg:' Þ•à3ýN R“™÷‰!ü³ˆuñɧR|[vM!’ð­ù#ì9ÞÊÚ€}̆c¤R<Á9P%˜^ú©É9©ÅK¦ [R³NVˆž9)L­ø‘åÐh´Ú€m@@00  Ð h´Úm€6``@  дÚmÀÀ€6@00  Ðh´Ú€m@@00  Ð h´Úm€6``@  дÚmÀÀ€6@00  Ðh´Ú€m€6@00 Íÿl·z¤•£´ÒÙVFXøå& Ír)poðúmîë·¹MÙGw=3[šº>U ìŸÝä¨j¡¡¡@›ï)L þláóoݺ…gï^$Ðæ)//oÌA Ðhm€6 д€6?Ú„……A¡€6Z÷îÝ @‹+99@±\Ýâ½ ’úúú ~PšœœÄ« à@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ^þaÓS˜ð- d0>q0Œ‹ñ1†!>ñ9ø.ÆAò-§SÃÉÃçbl¡É¡ñµÞmcM¿|´,Ž ÆÃ=Â¥ás«tøÁ¡ú­þͺ®íOûÏ pm@ ÐòÑwlpÿ¥n²òÐk×]M6þÍÖþ-¶¾]&wß^ß½7L¦q1öJÀ…7 ð¿/󼫌÷´Yù7Yø¾±ðj4?\¿µs¢uj1z'o¸|œãl¢Á$öføÄObó1¡#¯wín² h4ÛÙhìÓn^éP4–7Ž ó§(@ïåÞp0.âcìiÚ`|.Nbñ'RÞìôi6ñk5÷i4oØü¸ïìÂ=‘S¤ùÀÍØy¼`ž ¯¶€«95g¡$ ½Ï¼9ó1ðgç\Èo!zÃÝÄ.a0QLŸàÆ6x{·íi·òn7LèÜ3Šõ³… Ã×b·`eüŽy2]xçn€ÓÈ<u«•U—.!þT0,Ï~‹Ò¢‡+ò @— g¡žrá\=Pìq4:å{ ’ÆêPT0rwG{ö£¢NAïù•ì¤ŒìÑц”Ãq÷^÷,qˆœæËûãÏñ—>øÅOdù2yé-ïkñÞzûüp³¶kÊÿ·RPÕú}u[Åe§ ŸÃc§µ…x¶ìn6 hXw³ó$âóð¶îõðcÈ´9ê<í®n“0ùÝê‘àïE'¥“EmsÓ&žè®’ .¹ÇÜA¥ØÖáÏjGÿ}ö3´F}ñ¯HB©-\—FLþËŸEý|ú3pDIõ‰¤Ïÿ)( _ÿ”øUŽ#$Ýo“ªÁÆ·½´e(ïÕ-qùž_’;xï>øô *W?D&ª{þÎÅ,mvæp?ô%¯M•RÔÌ{Ù…ÿ[iw½•w£ÑvÜðvÕƒñ+»Z-v7Úîm0½Ûy…Ëöúxþ+’hëÜöWv³ñýïÖ—"Si ™ª¤S:‚&{ëy¬£*ÈËË‘ üŠZ…¬CiÖ’$âRdH—º—.œòË1¦êT9’¾CÀó¶ qGìÄýc¡ºJ$Ee}ûc÷j¸¢&¿îþ1s5’¬ÅÆãpÓ‹$é)ßãV\;b©E—'VYŸõ¸+¾½4^K“‘>Q .‘b*}¼š ª'ž!>ÖÍ~Zï°»ÑƧÙäjç1$àÌ©?NÇÏî¾c +ï‘z£¼²êyÞ)mŠœ[â ¤%Ç”¤eüÝ«®­«)}५¨¶-r/=½tšº±ó™'U]ݯ ÎÊ®ö¹Ö‡oj´ý¥·½¶Áºˆš¦Ö.ëlÐ&’Šñù‡%õõµÏ®$hÈ(|Ò'Üqr€MÇ:,ùRc[ggkén=ÝçqôVžPZK?rýy[[¾«ÁæÂ`¿×_±Æ \•ñ6¿– ƒÿA?Y‹ð"_œBÐffSìR1çÍìº,Ü€áÏÑüßñ‘áIüœù¬¡á1á%®Î‰ñÝŸ20ÉŸO)’–­•ó姥/+K’½×)Ò ‹:¹Û#>øÖ–Ö¶b&EJåø“ŠöÎ|ƒÙ!ºu£‡r^·¶·7—ï·&Ñ7Çs–,B“íEÆT×Ä•5¯jªJ²‚ŒWª»÷ñøCõ×õ)Ô€ÄKÍÍoÐDÕzÊÓñ¥UÕ¯ª+³#·ÉRìKYÄê#-/6è*oðL®olå.^0îõhWE²AνªŠÒÜ0[IªeI'Ž÷‘dws²¶íÍgåøå+¸•ª%³Öç<‘‰“ '”×ÈúzX[__üðÒöõ:$º¶€6ìKÛéz¹÷ŠðU^\OÖ’‘ ¿ß)ÜSOùÝ»ó[XÀ¡N6Eíl6¸Þ~‰‡°¨†íMVþ¯ÍÎ÷2œÆ„?B7ð‰Ÿ²´}‚ø~ʽ³Û58ojdáŽÊ–Üi7 6Fz¥Ú.ê¬D§y&\Þ´0ÞDàfª¶kžÀÇ Ù¢g²)i/“%Æ*kwfµNíèZŒµ¼fÄ°6»uèÊŽmâm7dÙ|¥BÜöo©J1rJÛçºß‹9û’à¶Ò IöwrþMÜVèv<±@é¼Á9o$ñst±zþe¹·ù-©•+'ÚÅþßËL’êù¢·hÎÁ÷œ§­V½Ù,ò4rÂtIŠ–/ÅŽçu’ü—j·— êt—]R•'g7OÍoiîâân÷D¹ …º?»@€¤Þ’‚ç]C,Á[|ØXG™)yeh¾ lÆép2TÙtvé¸ w¬c«Ö‡”&ñ™¶ÚÛg”tqšŸê2dsßLeþ™ƒVdº+îÆÝu§K¯‹ä‹°â#Þ²4¼—œÞ+5)—Ìévèýd;ÕàÁÙ¹-)!OÊ8w|šŒršŸz¿³ÍÄ·Õ<®Ó‹ƒcD¨†G¼žðv? ª*XÄ\Ýð§Ï¯ÝI^róÙšéªÇi¹f_þ|¢D§>+¬¤Æc‡:«h;žçΦMGù95—øœÓ"eôßFQÐ/¸ÒÉþš ÛS7÷ö뛿fìêŸSaßGCuèêe„~÷[¤±á÷äûAHâW³i“@Цd6Jbl‘ħˆùü="(óZRŠ›[ySµ3WVQ%÷yû;hª¥`|„%Þ¬ÈpÍêÐ ÎR~çh‹‡.‰¢eésõq{ú¦h#8€þò¸½;·lrØà°ÞÖZIA*ðÎÈûÓfüíc]É5ѵSÑüæç'•dåsÚ¦ ñâô~E½pb2T‹b²ïô8X…ñÒ$­¼êáþº«šrk·Çæd‹¯xÔÞdYí'£—y.%µrª|š Õ¸4Û4[Ô®àvñø,AG8W@›ïÄ»]©ŠŽ\G"vLwhØJJ{^¯Í'æ4n”ýÚñv"hu¾V”q<A›íçy³ió¦ø”*‰¬gfe)–•µµµ¥}þ€6ŒõÙS1‘mÞŸ6óòè8E åT*IBŸ Žy-©)' ›D>*è“_£Óeß5h~Ÿ”6ÏÞE›M…uÙ|ñ±óÇ*Ì×~å[È~×)_I¶³2ÕR¥I®fÄ\© >>0÷Á:nk¯Y«íàw>ïQQIé‹»ç É«¿mÆ:n©­’e6Ïu!_?I§­¥_í™>˜²sQ4 åñÀ'b{øìÔEÀªSˆ(qõHOõY5’îÌ+Ž_r Û}€—y® uñv6šìz£ÐbZgWÃ}F4 0Ñ„"þ|”OÖŒÇêËk‡Ÿ5â§ç÷²:^1]µ9ú_K‡¢ÁÇïC›ž—×5d¥Òš®Fß—6hz¡sù3ætH ¹†Ú?ÎŽN“$Î@%&šŠÈæôËoPåÛïNÜ·Ñ>8&>}þàCͯ×ÆÖòÞ¯CŠ;Ô×]|f×Z)ý§ƒ\49E~^¤Eݸbp †ŠshsniÚLö›Ê~TÈ™³×ö¢³ªòk3ê§/Ù£ã{©dÝ ç Y/ôÄTæ åí—¦hçU 5ÞÓ–YPÿ>Ý^ÿìÂï½¼öM¦~oŒw¶š¦·„ \qlø£|^XpJ5I–+.¯EÈ°Sœ åuñ{ZÞ^m)½ˆ©ûÒ› î«,*†¹¨oiÚèoL îÙƒõ¶šŠ#îL…Y«]¼üBäš/J›¡mo…©ªâŽ˜'Së¢B³LÄ+ÖZ­³«[”ÜS~ "nƒ´nÖS\xcŠoµù—/æ·ˆŽ=900Èâv,á¢~œ6¦ÁM6 V“hñùÿyãÅ`â³!EÅhÝÞ‘~Û-äV‘_7ˉÎ"º¢žýŽäÌcÑ{=Ôå%w¹Ota/AÄbî°"©ìÙ»÷lépó•½2’ ë܃SÓ˜A;ìÈrôèÇï  ªµ“’Ô\ï™úv 멺i®­šòb¡nÓ¶[è3 ôûÿEúæH]}.~«‹F…¹<‰ Ïÿ’‘…!ú¯A¿Q@ƒQ×NžŸ}ƒÌM‘‘‘ÈtlÑ®>ÿé¾mv^]c¼oA›éƒO)µX½Fgó®ÈäS£|Ü·Ñ&[îÙln~(931ÂG›&·ñÀ¥¥ƒ¦Ã¯ï*)’Lœ£™I1áëŒU•×í&.@§ Y^ÉlË¡ÈC×RÖJ+ØïÜwòXŠ£¥ÆŽÃ¬ ©†ëü.U÷"4f¢AѶ ¹S;±xÀÞä––”·Øîy0d½±Mǹ8k~õ)oiiÊö èãG“=mMdè¦:øq -È’ºV[#ãâü¶Y¸û®W¤hÞx¿úíÔ–¯¤ïtßoªÊö¾ˆÜà‘*ô:žóvuòÜ›Ø;^?õÙ±õLåZ°Ó¨ï%rµE RÑAûNÍòR:ó‘­¢« ÷ƒhljµN¤©€T”ƒ1m2jèíÙRž¬k¶¹ct.mX/¬w‰îºõŸ÷Oò‰¬où,1Zô-¼y/ú0êìWxfNÎ^å=zÀl-øD+¶DcxnKJØÄt´r`/NdÅìéÅ^%¶Ë}WÆ£wåÞ™¼pð|ÞêßæYb´ô³ÄKð¢«óûv©«ßéÒiÃç°&5¸?辉x|ƃ/òý3«ç^Üᬲå*óh#p]ƺ›››[æ ŸÙÚ5²lw“ÉÞæ¦öB¨£ÿÿÌŸhxè{à ÖŒ[B¼™wwÈ—ÞÒð^Èûêänújó¬¹qà«Ò2 äy")ÊËl>·\çÂ~¶sµ”kèKQŒ¼ – 7‚oºa<Œ‡Øg&…¸ÄwoX‚ᣠŸ@ Ð÷÷m0>F|ñ•ÇEl>w†Ã#†Ìäs1ÃÀ»@Ëb| .‹ø@¶ÀÇcˆ‡&&cñy‚!^@ è{Šñy\>bã¤árÑôw£ã}ã¾ áû@.@ ehIñ°IÁØ A—éÏO°¹‹ËâáÚ€@ åiIaܪ²~?Öh/âL÷CñÇÆy/Ë‹Åçm@ ÐrІË40ëýä“Ñ3Y\áÇrƉŽnû÷_^»ÅáÂgCA ÐrÐf|rüïÿÙχMup¬­*Að¦ÿ_5ùÙ§-v6ÈÜœõ™_bE·ÅâóÇFßJ­ü©WBbÀ?C·@Ë„F™écŸžÌäŸþ8Ñ7ÄzvwDâSî§}XGÆã€g¾S ÷nð[òÿØŸJ°~º‚sýÖ°ª ÅçŸ|Ò­K4£0ˆÿ#o G÷Î%–qïß6iö¨vpgedN)œ‹'%$¸Ÿ|>ôÕ—}Ÿýt≞ù«¬˜¸‚ Ü¼[“Ϯܩâ~WìÌz¹îíèܤñÛ ÿñ…ï³á«‘6«WÕpÆg•¸;ÆÿŠqD-ûOŠsËwßï¶ Œa7\W¯¦u¿TùråÖ¸+K­Súǯ4 :ÇLì/¹ZXÛ-üÝUp¥¢uàCöhõ;Ï^¿ó6Éj)¼t«üCç!j¿%-µæйF/ÆÇØ,6··säW¿á¬X1üÉ Îç¬Ï?é’“æ²Ç1îÚp$ï!þ³ƒ›õ’&¿;l&ë‘O—´ÏÛð3Àñ@éðÈë+zt‡Fýcu9¡ÞÊ&žÿÀgŽ·7êK·Á1ÞPëc+šQñ(ïÉiß#7—Z§úÐ7ò&%]ã ¥ñNÙRC³ „$cš‘ŽÜ~õ!®ÅMO}‡ÝgßUpùEñ.šÖ±ºhtÞcЩqWš¡’^ËäOðØCZ†¬Ï$8Ÿ~:ñÙç, ÎÙ‹‚W¨0Œû±:6‚óâ>¿}éxfƉܫõ}ìé6ÂD×Ãkgff;™ó¸RL€‘æ“'Ž¿ìœl-¾}<#5óhö‹×½Â”ÚËIŽ¦ºFNÉ)iÅ‚ÛõDw͵3'ÓÓ3s.ßiæ‰i¬èöÉìGÝ“½µçN¦§¦½z¿„…!ÞÄÀÕ“tå©žá1'Ï^ã¢Ñ®ºÓÇÒ_¼!)ÙgC~{¼<›n›9ÚRS{ô¿5/î=YþLÁçvÖ¿:~¦(!«ìD^w‹È;âÖ?*HÉ›d‰îðØ@K)3·½v ¿¬­—r+ï÷±;j+SNÆe¿ºó’‡‰ÆL%îø UUé9Eñ¹¥Ý¼ÁBÚp®2t#F*Ž2‰¾\oïmùÃc§²ß ñ¤MåàdýÓ«GfžÌ¾ôª_x œÇ9‡Í¨Ôž¡é'ŽF*Rv<žuv€Ú sÓ®¼ÂØí—Og¦¦ež¿õbä}.-ypíÄÑỊ̀ǮÜ-ì§ì|œ½¦Š±½w*3ý• 3‹ïŸ>–™‘qôÜõ½¢Ó|}5ÅÙÊ@Uo[3­ ÿ];jÌ»ïæ̵G½¼éf»»æjîÉôŒŒ“g¯¾lAâqúø=w/eãWÿÜ­‚ñŽÇ³h3ÒŠ'eddœ:sµ¦srjS“ý-¹ÇÒ7L~¼¨1—…ñF7nf}.ÁÿtWâ§oÉÄ—(pÒðy|ö±¢†Ï tЦ1”¶¹{ÙëÓd¥uν!æsúëìô”ºþ¡ûv:ÚÐ)Šî‰7¢ç!^l\½ÔmýOÉÝïj(½Fãl'±¹š³Qfúª:E% ¡‰¢#ôµòjÖÎfÊJŠº[^‰î´G|Õé[Ó·ÙXÇÏÉ8è®H¢ùe½@¬Á3±îdšS@xêÉKc<ÔUzIƒ´6êñîÛ””Vã¡»±ªvÇ«+}ºwÆ_Ôs=Sžy„|Ö“ÉÕÎÐð¸}žjž´Ò¦º’àÝäå è¯]‡EßÁï§~­÷üb7~yì`’fyòœ¶Ó 楢€]IÓ¿“ýRÔ¸h|~BZ7ƒäxÏïp.Åæ~°KÜ7î8mú[kʉª1ZòôÅ ±I¬"}·¢²ö“fö|Ú¬¢˜¥î2WÒ²ñÛ媯¤HR°*#2•j»}W||Rj´/DÝ䘔ž=ˆC,ÕDÆ,h§¹zpÂÑã ¡êÊÏ)/~¼‰˜%çA»\Ô•Éú¶AC ×QcZ8EG'Õ±Pþ~óµrtçAîÚT*Å&Dȱº ±VFjªv£ž÷/UNXM÷4é4e=3O/W}5’’ê–:A3q¨ ,OҰܶ/l“†C÷â«>!P¬S$“5½BöyoԵ߼FÒã6ÝÒV$3 íB÷…9jQT´o¾í{°þ¾Y2øæúx…ñÞVâ÷v üõ ÞŠŸð?ý„%ñî;“‚ð0Ÿ'è‘Â>JØ –3Û%©[*D.ÿxÈFMí Qx9ze.­êV'®F•é[WQ¬kF¸¨ï±fè'ÎQoSiƒ "Áovø6}Ó-©DÒXËfmªM@¶8n0¸=IÅóšp"e¬õ¸K”ö,Ts•i4q·¿§&Å8WÕ#òL&‡êëûƧÚJ3®÷uÖ•óësÙÃ75 ŽY›+ÛjOŽg-M›m֩߬k{+Z§ÉÃ4V=S¸ƒ:/‹…ƒâàQß-ªq¼”'N›ÙqN¢LLt׿ngóçÓfÍyëƒ7DÙZ}Y…®y¹X—[mJ¡:S*È°]9ZÚƒáb¥™r’r1/DÑžÁ»A’2úO»Ç—Šº ¼´_y°R<Ýý44<¾i?õÞ†ªÛƒ/ j=¸Çy©X+¶^¹§@ØxâG»ëÙ&𖈶 æeúèЭ¢…s LÈ A9…ˆ3ìkE×Ù:ÕvƲ¼Õ¤õàY×sÑm¥¼ÉÃ.Q¦ÝIô Q)m0NôvM¥uÅlãžñÕ’³4k¬±¾þíèÇùÀ‰à68PˆßmZºc+$Ø+>åüTbâ“Ÿômw&.ãáí(þÇÚ’šH4RРϪem`Ê*Ó´’é*>™¯ý•ldù0ÀiCݺDXÝ0+ÄIIÛñáµðFC¶è™l"Ê^oÍ Mù5q<+öôt(EÞ¦NÕÉZtóÄ ñÖÛ®nüšáGÜÏo©J1rJÛß}áÆj²þ¤üä%Q,¹=Y¡ä=˜œª§üÞ¤n±– Í³tíã\ñ*}YÎ1’X‚Z~{5ýtRÕÔ¹ÆïˆþÆcŠ6ï¥êC+×ê>$š‚Uš2%ôD%‘Ãå&êþlAÜfô©Ž-åÎ+1mÌW“ܺ¦†Uš®”~Ö³TLiôÍ6­µz.ioÇ8\.oú r:œ U¶qáG(y\ö`w{cCÃëúòíÊ_o<-ðGù“‘®ÆzëÞ·iÛNúrû­>4k4s4ÙWb*÷u@þtÎ7=cR$UòFÐ'CºÃÎa&Ì€ñÊ‹tN›Vþdü—n÷†\Àu¿Ì¢|£ùøãm<ÍjE B3cÌÌñÏ%Æ?ûŒûÙ'ŸJpWüäíç?Å/Æwoøï·ûÞºQ7¹>ÏYo°“”ö¸VįŒáí~Ùoœîô¢¡'8m¢Î׊2Ç uVÑÞ~ž7›6oŠO©’IteUU¡Té…ÕßÈ ,Jö×`¬Ïžª½×7ÍØõiÃ~s?ý·j Ó·â‘’ëéV.lD¬+‹Óf³iºÙÕ)§¤ÿôœ6“Bwï*×Ï7Nå '/H·ùV´!¢ÄSnÉ@¡:A›ŠwÑÆl•nkz+­Ûä¿Ù|½}‰â‹ÿßRtÍw£Á*ɵ:fv»‚¢ÕΡ †²Â4ø^´é(?£,­Û³p®/3mÚŸý½ÒÓ—ÓÛ.¼˜ö_j%ofÓCü×÷fÓæÊB´i;ÿ…òåœ×S¦ñ3¾Ñ_¹Út}[Ú˜¯ÒŒ›Îô×ë¥W¹ÜéXâ^9O.¦Ùk*ªš”uM̤Mûãã *)6oj;Cª_};Úðª-¥Vù=ž³×ñ®Zk$£k§s¾£,Gy­LV7ÎV_Ëqï8Wt»â6Þdд+2\³æ@í"ñÓÚ³áÆç67÷IHðW¬•èuÚÜí³“½B‚#±¢çï’üÑâ;¡i˜Wž+UÊ.nêFY’›t0/Uéë¤ÈW§ãM)2ߨ\j›@ýßA›ÍÉxo-0`Hí¾Ð5UŒ&†û†ÙØûÐ&·¬}N»n~9œIÞð›sR´sÑ-SK¾ÍÙ“ðGÇ·„[ýwçþ!Ž0eüÑyæ×ºï¢ û)…–æ?•'¯lc×xΧÍ̃¾mÊpÚÈ™¦ óîm,¤¤Œ xâíõž¡|M=V;¸dKª«´ºsÆŒ—–’òQù-ˆ×±Ý@Åqï9¼º_8LUÐÈ÷ 4W•\¹1GD›C.Fz¶qïjI¬Ô )ûb˜ÿá«EØX‹ƒê*fãTο¼è±VÊ?Ÿ»ŒeM݆ØÂ~>Ôz7NÄmZ0ÎJ³èši¾ðGz‡'çÐæ##q2<þ8†á—cäØÉI Χ+´t›Í©iê—˜Xñé觟r‹‹¸<>ûhÃÄMYj’ÒÞ¹/‡GGzZŠ×é’íý¯àyÒô8†.­p$¿ktttl 9ÔDYysÈ8ݾÅiÃÛïh¬cðfpd’5tx‹Ãpce{¾…áþsYªÓya&.J›±ÇÚ’¤×ËÆGGx|4ÚYÍŒËoá,íÛ >§ÈÅ%uí¦¶Æ!öÈ»­àÜÿ(Ž®;/§þVçù“vÞ$‹=2øbûFæWï¤ êÈô=ò;óÊÊ!ÖÐèг›'L¥ŒÛ`ÝÅyñÉ-ƒÜoáÛ°k¬ÈøË#ÃCh¬ÈH–´çÔ£±âùœ6 dʆ=g{GFÇG{Ž9iËê;wŒq—({ƒ¯N¿¢§wÔ™§ «y£¾ñÞº©[»Æö7Ü?©DVˆ»ÓŠ_ˆæÇ›u-Mtä Cž ¾€ËŠu·Ð0ôneñ—('2wQéÙECCCwäHÊG4"ŒàÀP7/hÀ7>Ú™ï (iûŒ¸&¯Ž(®!]y9>6:4жY]%ƮĸS©jW+‰cíJu¢¯1‹æüdocFBì½ú‰¯ªa|>K€ÐÖ=ᘄÄÈÏ:p÷6ÉÇoH[ûÉÏ0‰Ïú¬Ì ”s?Ζà‚Õ<8¹A*+''«Àð‹¿Ø˶:XEW’m´étƒJUÞĬídBϽµ’«#²«§hã¿A–j—- ·¶ä%*I-)¥xèá(šhωòQ¡(P¨TE²ªOô™·,´cÝIR¦Ç¦ªhÛEëßK» ":ÜË!ëÖ¬–¤9¾A…9²ÿsèÝž:ÁF«2ÿEæA…˜=/†]¥Ç\i¼jÝݸ»“᧤±æÁÔ¿i¥Ë­Ë1Û]ãrÒ²ZñkßZãˆæ¹© Ö{Ìaÿ{Eý4}¥»|’ÿHOúƒ‡ÄÞûûþfCïÈüå°âx÷ÕTõÇó{À+Cþð¥úô³ÄýÏeVû§•ƒ¿ÏŽìX»z%‰að¢‹u/r“äêÕM›êATša¶Æ$áÅ8+=5²‚Ípë•ÒNlñ§ýq‹¯%¯Ó¡‘Èx6“úëÓo•sæ5¹Á¤5_ËÈÒO¿½ëI“_«¤¤b±}oAûÄÝ÷Õ+¥óðÅÚ¤©È|½FR>ôÎàRå„3tûh¸6UNAQž¤f–|¹˜%ê>辘 ¥D¥3è†ÞÞ´C¢œÇ}ª(=’ÔZyŠ¦‰Ã{gÉ’köå nRœÁ;Ç÷é+“(4š¢"móî¤úþIáYö×ÜR’þ*èúGØÎÇ„N ?‘Ë–øÍhl”ÍÁy31Y^:ù³ŸŽÿbÅà'¬ùxÕûhïÃn?c‹$,ú 6·Ý½3ŒÍšÍœ½Êâ~õ\—{ÁW©°%rl±Å°©çûÞWÂfÓJãY±†Íig-zŽDK*Ãl•~,ïÛD3î²ÆÞ7ò—lñÆìwËù… ›Z1ÏÃ$â9ûc¬h|ÁÃ{ÖÕÝ(-×»?¿{±…}TNœôÐ/$xŸHt˜ZÀxR 5Vp„¢6¸LÍlmâ8ïWý—1Àñ>lú¿©ÜÞ—:jŽu]mÄm0>âáÎ3ŸÇBoÛ9Üw±9D7 %ű$$xŸ~¢“ñ¦|M ´¨_±L7£’4ã/µ£çD©¸u'Ýݼ|’סËËV(Ûoz.¶—Ô‘ÿ›o Ìö0?¨ŸÇÅpêp'8l$èíæò9<|&›ðg;~ý;ögŸôË­áO@å}h÷5Õ4öÌ©güѶêšWµ ©¦±{Ù*åäÛE÷òú —·ÚïëÜcÒñ‰]ðÄÓ®Äs5ÆÅ[V„[C|}‚ƒ!ΕÜ^ ‰~ 6Ÿ¾ ú@-)\œÑ‘±œlþÛ´¤@ Є‘ˆ9Ä#¤|€ úžÏ¬‡N!K@ @ @ $î'Ÿ15÷£ ô} C|‡‚øñiQ‚7Œ?AL!šñ•zÔ b$»AÔ×Ão¾î‰†ì%ˆ’ÓçÓbÐféÕiÞæÔ0VE ÓK„qx0ÃlbcsZ ß~ØÂà6¼ªíçô¶Õ×·L Sy“¨±••¢²JÔÞ/n Ò&Qu%*-Cu͈3u…ŸFµ/Qi)ªªAýÂõu´¾njåpGjë»GXK"¬½¦þ [úà?‘åË䥷ü½¯Å{k²¯¶®ad’»<[ã±ZëÛz&°å(ØxgM] ëÝãÜN6×ÖÕÏP]mmïAn_åö¸zoq™ÅÝ>Ÿ‡]èNöhÓõo1÷o±Œ¯öç¢q.šäcø`ðŠù¼ëxæ;Ž$ÈΧQN7jÞÎM¿KÿóW{^Œ\Ù /oUKm2“Dègÿ*øûÿçEÑÂÃ÷ÑEÌü ž´é:!.&é õ£oþB$ýê߈¿ú=iC;ÞÙ’ªkÿöímòߤ#îÖ.qŒOÝþ[~K;ïÝ=bÇÓö‘‘ɯ3\™×ªÞ¹X÷…={âïð>ô%•²JVõVUÿòlm¤ÁB[nÛá’ï\µz®†úF^²_ìÿ7ëúÑw‘[¬¿JŠª¤¢.– ]ùäëêÜ €:+ŸC qÅ‘~ç¹_‹u@“m`ƒanK‹7JŒÎ,ÂÿH¾ú-G¯[øN9•r'ÄÁ`“?û^?{gKûƒcA*ä3•o§¯ŠhEVη¸ª¬óž.c[+>'VIüŠ£´S@Ÿý+z5†°¤ð;ô…z(íg ªÄ•‰sX>ÿ/T/¼Ä è÷Ÿ 7‚!íyZ[:¹Øã^G7Ì+3h“ïù%Ù±ƒ¿à-uæÁxÒh·ÛÆ÷.Þás,8Ä›`7ј¼/·d¡£›u-ru7]D‹]‹y.Ù¼ë¿ÈàƒsæÕ¦J)jæ½ì_b$»Y£ .}š£6ú$ç˜ÒÅJàç"œÑÝØÖ'[䈖ìùJÁ®~Œ;/æÜ#óTתÞj]*g–ÛEÜ[eå]oÀF£ÂA¿;9Mnµ&»›wµšè8‚;y<ဠÄ` lâ~cÂJJ¨—…麭¾·^ L]8¬»ô°¿³¥¹™•ÝÖس¢»äÛgël¬.—õ埈°576·ÚļýJ˜rg—¾š²CYËP×àt›`Ù²+»íLLÍ·x…´ŽMy¸'"ÖmŒ­î{uÃu½¹‘±å΃'؈3Ôêm¯§L¡êÙ¹îéc£Þê;F™Ex{‡¾Ñ¦f„Ûy÷ˆ’û-ë‰.=›.•ÁHâçè~ ê(B?•@±Ó%{/­ÐºéÈÏ%VN'¦! 9‚IçýÔ/ãÅ3ÙAëI^êø/¢=LwwÏû[@§n4v2ÜÕÌÜr½Óž'Ķf¼±¹¹™…¹‘…¦kdâ…»ä—"m­#Júên8Ùš™XùFåò—Æ® i´6)ØÝÊÂÜÜÚ>(.ç-Qi&£¶j«R©:úÖ_Ž¢ŸK²³033µö Oíšà 3$ÇM[AWV×160½ÝûŽ{Mù%ßmvfÖaé­œéšÛø蔫ƒ•©©ù&àGõýSójúm·31±Üsn´:sŠ6Ħªn8ÙãW|³GÈÓÆ‘©]´=汶ºZ39¿Bc¬®#{œÍÌÌ·øD½êl³5цP_EÜîx¬sp=ù°yjko.yèì8Á›|²ÃÖØÔ|›oL€ë=uÔ e5m#}ãk½+Åicß»pØËÂÂÂn«ïјòXÅéÃö›K; jÏ’—׺W¿ÀpÀ]…—ì¬ÌÏVŒcË]ç¢*<¼ 9ňp¾vòk²ôi1<ÞÉãs„\Eâo‹bC·· ^5Z·I“d¸Ù+)ãèáÝŽ «£îwÍ‘¦ûZ$Y‹{N½p"iŸ UÚ" ‹ûu½tªµµ“sıü ɻÈßÈÆ”žDÇóË›Í5tL¼.]¿Ý<ª³ýe¤©É.äDx8(tn4 wœä§I³ÚãâpãIÁãkiftÙõ1·¼ðòš,=(9ëþ“âI>A›õf†mø#­m=Ä]èmûoþ’…ÔѧEÍ\T–I83M3Ïá ú u¡Y6ûüúÏu„ûÝÞÚ‡CÞpss§€/8mÜ·,H›ÕJvA =ÃNMr2WW¤Z½F|öôÁß¹}÷nni­Òþ羨Ä7‘¬M6vݶÕëʃü‡—3Ö©Ë›d-ýz°Ö–®`°ÅïèéܬŒ¸íJÊöã|^u^²…ê˜wûÑ8¯ÿ€ÙZªÁƸ̬œ)®ÖZÒÝ‚Õ›6ÓR²Ü¼÷êõ;“Kþ«‹aÒRT·è£éGÜש)j86 ãuû$a«¤œŠTÚ… ¹‘;7Ëɨ¯"\«þgfd) §½Ùç/$…{8n7U¤j hï=,#Ir ;‚¯²ß{3IQýRÝ°p7í³­,-çÒ†PÇ^CiSÇÔìó§’B7˜©©‰h3ôúŽ¦¬Œ…ËÞìsR#´ä$}=®Óv~½´šíV3ë´K÷Ÿ=¸ê½N¢åÜ6‰ZŸäZ멘Øï¾rýö6â—îYM5Ûã`´#0æäq¦û:9½‚>!m"Ím7‰hóêȲaaCO[c]uÍ«Ö®)àâ´Yga¶Ì´(ãõ>Ÿfý¼®øï¬î –{l[wã7.LðñÇÖÍ-t ¢ŒÖ† ‰ÃeL¯uÆŽð"ru'CÚ,^ÜPACv¯–6Èïç ¾ÇJtÚ–ˆÓâ°Þ˜¿¢®ÏCa5t‹¾É¦d1Äjµ†üöرˆØ£C¶L¶o’wëÒi65â!«RL¿ÑÙG$ å©J1rË:Dëð¹ÞÜ!1¦½‚º ´êïè?‹Vj£2Á-üQ’øW4<ã4óâþTÌ»£—¦óÍpƒ¸Ÿðج‰IÖ|÷ƒ ÍJÅCEƒ¢†_A²,YíR©`×3¾÷mµê­Ñqä„é’tòÅžû‹PéU†ãKF]Ê.ªÊ“.ˆ#XØXóý‡¥“8í'ËM(ÔÙ…‚Ý·\È>]Ö"º)½yf¨°úP‰àöÍít2Tq :Ç[¢%…!þdŸ›‘œeøsQ2«Ì–ʈ{Þ†:KŒTä=“K§ò$=@—ª‚;+…!Z«õŧ»±]ž®“÷r€?Ô´AGÞá`þ”Ï6T_Á4QÈ>ƒ_Êù£àu]‘¡éÜy%ʨ®ÒsZäµ8mˆ:èÁ·ÏœÂSû—UÔ­­‚ói¿ä°f%%íµø^Ðv†&Í8VЊx½žê|²¸â–Ôª•Š!DÅiòe.…JK¿×A\_{bb’'8ž‰§¤èÚZT’‚¼‚"]YÕ.â:_tØD äò–ÛµÀÐó‰«>MFçZ®weïl1ôm±ˆhß<Ìï%†dÀøåh¡x#j¿–¼qäÑ ú»=É«í²ª¦+!¯Ìè©àÂA4ˆÓ†™[)òòxìgemÇó\Ÿ²EÏdS^Bº+/©ËI…Þª­©®~‰«úÕÙD?ŠœI… ‚œ É°Ng‹·Þ~}Ó׌]„§>x ¯°9¥íï{øM9ÈÐiÐЭDrð+…îíA¿F3+ò#UŠf÷Ѽ8~)L÷Û&9Ñ’’ßÐ<å_µåÈ(ªä<ð̃ï9Óæfóÿoï΃šºö8€Ó×7×™7ïß÷Gg:oÞ›Wë&,Ù¾DE ŠVÙ¨¢)àŽZ­XZQ±Š¢"»@Á…"* 1ˆÂ‹R„È"*¬BØ’›{^n’@  ÅÎTŸABî½çÜoÎýCÔ¦xÎnŠû÷º"Žr@ä>Ïâ€ØTwäÙ½@ÞÚ=¥•5:¥úËö!"mög×h·뫯®ø97+---5ù +Í|ûõ™+ïV¥MÈŽ<ÓÒ!©hiÞþ¦‰Κ;kË4‰>†«Ó÷0én £òÝcOº®c V'’è.eâW/•ºX™o+~øp¬Å/œÚA'{ÖššâÃJ¾]Ïr÷iÐô&„õ6ûºØ¬û±AudÃ(sýŽ_okÖ>Ûƒú,û9ôô.L“6s(aÝúÆëZkIË»‡ð–©Ò&C®«ÛXùŠÚgï)c0XÉ—'Ö_‹Î­‹Œ>šSlÃU™ûl) bÒš”ïîe^‰$ò†Í’E‡nÞÕ¹*¶Ý?¶uyó`=ŽË•H]V¾—+øžG2¨AÉÅFcúV¾ycq‹ö•ž¸¥mµÕ—¡W¤èUµ*m ´786²{kX6>m:ë2ìét:ªC¡ØÒJÕ£€Ÿâœ8+³u'[wñUÚ¼|Ó´ÑJº¹—¸\ºÔ‚j!³Oá¤Ö¥"mZ r6 ýÅ mÉ{‹ÕV‰u›Þ•kEµËN—6ñΔ€l]ïUÊî/#ÏÔŒšÞµÑ—ÍI›ù •Å±ur^^ÔÐ3>mˆ¯¿â²mœüž8—ÿsáù³É)ïŸyÚȺKíç[¥´M{Ub‘Ù—¤úÑ^C~"‹Á¬zùj#‡Áÿ>O×að'ˆº¸_*Îs¤Ñ&´8ÉÜæB©Ù Ì-Á\ÏÕÃcMÑßæOT‰ï!$ö%“4ƒ§£RHóÌ·Ö kÓÆn«ÁV*`[ø¦©Æ{FicX%î¹¢J›cFi£^êb-¯÷ú¸¹…Ǿ«ù“i/ýئ(>œÍók“iË¢XïCõØF•6ÁVó¾®z=éÈ´aD>×7aG°9$·a’±Íti£[¾4Ö?TŸFSW{Ú­“)ÞÕY§À•R¬k³d© kñ7ÞGÛãhû¿¦Þãõ¢Žsy»µÇYQ´#ÄÉ/\õr”·žJæŸÕ5ÄhíÞQuÝfú´}Öèí`uB¬ëmÒö‡­½Ú«ð¤Í¸ì3ê®è33Äè»ËoDÈœ¨DÃè_EÉúk@š²=­}ÜÕDânébd²B;næó­ÓÆÜ mö¸Ó¨^ucu*Ymü¹¼›&ë6¯:êrË æâå ^ó(iGЈ.m°Â}‘~ë°vƒ›‹¢éd‹íåop%… >ç‘–íº=¶§Ï6²m6\nAOD\ëØ´–±?ÌAçâ½èŽÛUO]Á^è@1œå"4uE_K€³epÒ}]‹÷=ùõQÏ Ép¼5-ÖŠë!|<¤ic©ø¢ëXÝætˆ eM¾¾AäOï6¶ãci³`'󩮧/dŸµ#LúæcEáÎï¯:Ƕ[&áólW RÇ­áœÝ2 †ú°nAÛÒý6?òêÃ{Ôï01.øÞ»ÀQ·a¯Ð‡Aò‰;VvíÆÅŒ(61g‰—º -É?æ ïÔV•d¯äXzo=+W]SšH|è‡Ð¥\Þš¢Ò²ûO^ÿ’jÍpIÎ-ÕˆÊòO.ãV& §IyÝâä„´Ê›·ûGÑËÖ[›×‡4M6§R¹È¥QjJ>€þý7ô©êP÷íS¡Ä6@çN£ döjלØÈò1ú‡3ÊÎD©©Ú” $›äÈÜ;³7|kbïöcýÆ×È_U¹ÏµŒ:z¾RX7BŒmÜîë£÷]Þ¹]‘æhé¶!Ui2ñ:oŸ±šÏØq2_u(„U)»øÖŽ¡#ª^(YE¥øE¼~½¢.çÉšù]zi}ííœ#‚ àmΔÀ¸ìÿõ¨v©/f‘ƒ+S镲æù”Ç*O,­Ù in\+û)Ö—Äh"ÖÑåíXIá.I/¾QW+*<¹‹mÅ:r›h¢áÖ,{ ҺĬʛÕ3…®ñ¤±4sRòòC‘ÖTû¤ìbU‹_)<½ÜŽp°R;ô¬½u½Õ¨ˆ#«[ÁZ¸8bß•Õ¿d ø<.—þQîªÍâ’IßgT EÕåE[—ÓüïúqmÚ9‹ý×Tïܺº;ȅ꼶í7 á¯vø¸8ùD—•=è!椦H¼ùÒ©õÑqb)ÑŠÖ‹KT§@ÔÞüË¥%—òv†-±´õ/m#õ¢±|CDDIóð,Ÿû’bí›{ÅH–ÿ,=Ž”ÄvkV¿Œt×mñfÓi¶nþg*õ¯§ƒ’ë1«³™ ®ó’ý™"m•¡·ŠÃb$æëÓ&>œëª™û@#¿-³µ¡PíŽÞ&Îáæò”ž-ΰ÷ L-kÒÍH¨Ò†½"KwÊ>)^3‡óffå~v,—IuôÝØ=€žß-t¤’«&ßôÆKÈús"X>úyÇ Ã{‰Î ÏÿŽÌ>BT_$ÑõðÇè3âþã>>A“Ì?_‹ó³ö ~2`œ6þK—6–nŽP{é§Ûø§Ãèæɯ9Lºëê]¯1uÝfE¾¤!/ÀC¥±¿9Ö=lêSs³ônaß“Åd28vA›Š_(4·?­HpbØ°üêz°†¬Î\&‹ã¼åÔ %Â*’"­¬™›.·þú3ž,kÃ%O.µheôUñ‹±•zxkeº¿+›JeÅë“Ðl.ß×–xÚnœ^áÁ¥3v¼€ã—c'KŽ³˜Œì†!ãÝ|~WèN£3y›E’ŽàÅì¡f#Û*A‹TG€eç“Tô3¸’rŒ—öÕ ønt‹·"®®W{(e÷3¼ØÖTºSz“R•6_PøiSÆ`0ÕUbeͱ*×åV§6‡Gú%D¯°eÐét»5±Gº´·wÝ8gË ¤ÖÈf7 0#Æ6­¾»žûöbÏ”˜òy÷Ï7\Klün†?ŧ.> 'ü1‹Á·ã‚›|ªI_©ñ©v á&ƦO©¿éå¯y1<ÕiV\û~ª×V‰s§;ðhº£7éBØÉç ÚbÊ¢ŠéµÄ&6xʇ·öâ^èœÙnN¹§¸.m¾°ß&›Ñè5>Õ•2ŽOþâŸü˜·}Žd–O:UÚŒŒîi ÏoOQ l0Ý[O€RwNDà¶âÙ*¥¦+±©(g­ó™ü-Ê?¬ËÏs—%ÉféÙˆ´qØ6ðî7{ðáe{ïÄþé’öÛ„x‡ |½’#R/æƒ÷Èú`ÍúPŸ‹¥¹$}ÂÒ«ÑNÎîÆxnn›Šgk_äõ{íÜ<&ãrBùGÐÙ=ž]ç}þIÙÔÿnö,†n¸œ7úÀø]Ñ…]Lß}g¥ƒOÿ¾%«8þnBàú?‰“øe endstream endobj 1030 0 obj << /Type /XObject /Subtype /Image /Width 151 /Height 50 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 1589 /Filter /FlateDecode >> stream xÚí˜{LSWÇ1›¸è.‹nÉ\Ü’M@´…–Û"B+ ›/€È{èdQ§ˆ¯¨D|¡Q¦ËF©ADØt²It8t( ò¬(ò¶€¼krë¹½ÐR.,щ›ù}rÓþî÷žž{ÏùÞßyAAAAAAAA—=jwRou÷ʨן÷©þþÐøéð÷÷׫Vnx’{|µ/«²²<# .ØÓËÏW‡ÏæÈøfhšmFAÚÖ#WšIÔ]°Ê÷—§ fÊjBƒΖµ½¨ý¸žèçýåÆeÍÝLy­Øq*r“—·ÿñ‹·t¥Q°?ÜÛÛw{t" úg ô´Ã§<ôß Ú{þåUUƒ‰ ¼ë1Š¯‹Êƒ'L¨ÒŸk: gÙÛ÷ÒtY1¡¬4W&æÞ+ÒÆ÷‹ô´Õ‘°äÇpYè7åe%ÅÅEÕMÚn¯tšn“vïaiiYiiIZÜ&ždÙcöeì w¤ò5Pšëä ]FIR”&¶œw‰<¥ò‚–¡—å¡+–†+)WdgkEåÕ÷iÍZ?¿+ñ׊ ÅÁàÅk£S™‚­k¤Âu1™ EùùCk¤î!ƒjén!Ýk2ÌÌØcÚÇ/ËÄ)«ÿ &ö sÄÖJUŸÑÏnX;wwºP)3·ÉïÔ'UÔËÉL½O‹l\¼µß×äÑ}š@k!§‰·åûj;a×ç2.é ßÆ6¨Ø”ÜäpêgE[N ÕÝøÞ=4i`ôæ4qàn;¹L4»k—ZQùpõØ–Õ‡/ ´â ÑŒôýЬý‰ºá®@æÊ‘‰¦vÆS]c´: 6n`Ru<Ô¨ a‰¯>bº$–ÄQL{—O†±Á‡A2“ˆo‹˜W_ ¦&0Æ"¶Ã;&£o¢§@ÈŸ9}†Kûç3Ñ̦¤ÿD‘“$äIÿR‘8uóì#wzúgyõ0™8’‰,]×Ó¦™Yˆâ³+´gÉQëBNd±Uf–PLëMïmöu‘ÄýV3hy¡3ñ÷A.g#1$ïM"zM7)Ó’Jâà8½’ÛÄ“Iœ÷ŒÄ>SÀäMèÈM$b`•w^ÉpúC£á‹©x¾LtØPb±D"KìÜ|7\»_Çt`ÓBkƒD~uÔ©|àã":}³6ãpÈÚ˜è ™e~ö[¬»±ÀmuòJ‘ñ ‘j€‰ãIЩkcŒ5©pÆcx'³\BfXmó.m'.µ“>«ýωf6÷ûŒ×›åÙöž_à šH·f^Êìbfí‘u(tytÚãÔ(iØÉþÄ«’YØkH¨ªÏŸ+¦² 9–øìpê`¬O@ôÖ^]U$žËšø“‚Ôsk÷`ß361ë)SMjh{ô,l ùã\ØWò<Ãi-ÈZ˜Ñ1[tMá¢úgåwÏ—Å•ª wºÞwµ·LÈ©Ô%Ý&‡})ùÐ]ìȳÿ³‰ÙÂ$G:xïe6HOýdÔå‡4÷nsNÔ^Ïf¦ÂàPSþ|_«€Òý$XÊ~0’‰Úg¨¾ÁçU5°yîè›èúÉŒS•&vÖ&*Å–æO†˜˜³××."Å@xHM±¸ÝaœB;¤—›™~ìQ:Yñ)Ê֊ψlmmÅIÕ¤Ó:™/> stream xÚì@Yšïi»{fvfgvöí¾Ý7ow¶'µ‘x¹‘xÉ9ƒ%ˆ¢‚bIF‚"*p‰ŠŠ¢`³"JŽF$'‘$ùÆ:¯ªî½%Ø­ö³ÝïߟtÝÊuêœ_}ß9§ê @ @ @ @ @ @ @ @ @ @ è'†a ”šŸ&Ñ’8œÔä¤Ô00°ù,9©²²Ðñ㔕uZ^ÕÈkgÊú0ØÜ摤e`&?B¹9Ùf"SkPRØ<–R…lÝ7m~4mL=÷&W"NØ<–TŽlVmÚmÀÀ€6@00  h´Ú€}†´±]µI(B?  ا¦‘ýšÂ‡ÓUTT0Ú€}\Ú¨ÙO×öíÛKKK'@0°IcûÓ…Ï©¨¨žmÀÀ€6@00  Ð h´ÚmÀÀ€6   Ðh´Ú€m€6``@  дÚmÀÀ€6@000  Ð h´Ú€€6``@  Ðh´Ú€m€6``@Ð h´Úmþ§[©àpáÈ4{0_,Ä%–b‰Ä ÄjñGñEñŘd«þáû#GŠEâÕ&÷V“ÎÇŽ<=\ÄM,á Ò=cñ¹‡Œ’Ç;ò/^ù­M‹¹‡ð 8Ò“! ‹/;\8*=íÑÃÆŧ/J„Û ´Ú|†™íÁmõÅßS©4&ƒŽCYNQž¢c³yëÙá”  ¥(©Šëb"«$¿Ä.¬BR<³Ò\¨î|"¡–(Ý$°¤J,ØßMIY×7ÿMjE¿Ž†ºm`\ñL´)C©•ƒ>!¡FF:T¹EÊŠË”–-S7tZ±=ëP ±«I\T Áî ² )úQ‡k¤ÇÂO»lx¥…‘2EAÇO›FS\J¡ªèÙy­Ž)L(—Ò h´ù¼hsOs©¢Ëé¡ô„'ZrJ.|î`©B§Ø…‘ëà…7ïƒe·ÆQGmyÐÁG‡tf"Sg(¬8Ü1áÞ>‹­A³ô¹žP†’ËŒ ´ÃÞ¥ ¯ÒA{C{yÈ¥ƒ¥äAK†ý¶{3éÊê«NÆWM9½¢NKMÝå»´XJ«sExÑÒfÄÕÎJÓrËÁ2Éi'Üy¹ÚÍ–IgZFÙ—R&¸{êŒ:KiEl'‡(ËÜ ú쑇ϧ1ôý¯Ž$á¡J)–\>âåjÀÐ÷Š*âNr æéªE7 ‹&w;;mˆýï;š¨JSpˆyšTI>äA“kÐÞăjTÙåÑœrI@tàL¾…áßck¦­ïvüH9JœJ‹ÍûMžvJ- Þ¹…¡ ²îŒ`‚K`@ ÍçI±ïq$ÿº¦Í~çc¼h'\+bkÐíw>Iªá­2Yªé[œZ-Frq)}©~HiJ ŠMðS¦ú^L&¥YiCÄeh‹‡U3ôà”ÈH‹=ì°4Õѱ 9XBΩBþ¾†Ê&ñ‰Ñ®`wºŽãî[ñ&oÑfâÌî4˜èÓôÝÎă{´Ú|Ö´!Ü Ü߈LMV£Ë»Á}Œ°ƒ,ªið}"¤ ÙΠۅ=”ºåhw|$‹ª¹.¡Ð˜M3Út6¡TâfÌI%W®d/R÷¾›R=µÖ—<™ ž·³ ÓØ-òQÿœú¨Ô€¢äÄ©ÇÏ-¥ðž¶"Í5½)¥œŒÅf¢ ~þI%Žv&Zæ±%ps6@›Ï6ËWëä<â)?ò`p÷ÑL59¦Éþ¸jÜá»[Ê«zÜJ®![¦.Þe«Sö¾L$ÜI.ë]afÀ`Ð,]SÐ1mRªºlX‹uBËR«Þ9™ QÀz;ºžËÞÛNÚ¶†ªé°ó:—XT|תӬRkÐl¾ 1¿tØÅÞRÓìíù`@ Íç@-EEÑ Å ©®gëx*ª/û(ñ|2Kžb¶9ú´wÔ©ÍQIúl mLjCÅR·¤qÎ'3å”S:R+'[ÃçômÆ\u©®½Ç_ïø6\/'k–éªÈûxTõÊÆLOÃÐÉ32 ?´wtΚ-k™ L¯‹8jf¡ ‹=êµµÑ׶ ‹ƒ› ´Ú|¦mRƒiÕD EX…´äVñ·8éÑYêjš¦®¡ÁP± ¹1š$í“t뼚,}Íéî”ò÷ðmJ‰Ú˜m›õ©Ì‘Ó@AÄGZ-L´ô"•¢ØÜËZª 5 öÔ£«²¨†kÏ'TÌ@1èŽTjÊn*J„z  Ð泯%ž¨qM¼^¢­Á´ ¸›R‡ÒjI«CGk{lUë‡VqYÀmÈ:Þ˜SYj « ;IU“ H®E»íRQRpMéÃã¦@? ŠZÀ'ÄAÅGOŒü=™ú®ûʆ§Ñ†¬DJ«åmò²R¦XÞ&ü¸¹@ ÍÏ€6¤Ó¥Bcmº2ÍÁ uÀW:mÕÞ‰=ÌN-ÇÐØ‚øG¼ K(ÁˆºÜrîf:MÅtÓñÈ;ãñøñ…¯}ü=hÊTƒm·’«QJi1EÎ$ªΦF[É—1ÕÖoI)û6ÞÑ…BbóG‚C×jœ¬ôéL-W΋äò·c40  Ðæ3 Í-ÖŸÿêx¼7uºo“T9ºÒø{ªyúdoai7àج<–âß–G¾”t}¹y†þ—%n™¯¦Ó¦ßVKMIa™ò£,ûÛòݲÏLJ74.ÙÊÚ”&¿PIa©’œ¼–õÆõ‹âÅý‡CVÊ*é_žúÑ°^#XcºHÉ*‰S3¾ÂL_IQ–JQ¤)+R+Q˜F.¡[Ž>K„¾Ä@ ÍçgâRIÔÕ¼õº“¸¥‚ÈŠï”\2z"‘«Í¼ÉæoY¥d‡7‰¬dž\Z.ééGT•KªÞ:4±mJ® ûí¼»É)ÁÚmÀÀ€6@00  Ðh´Ú€m€6@00  Ð h´Úm€6``@  Ðh´Ú€m€6``@  Ð h´ÚmÀÀÀ€6@00  Ðìç`¥Xb9:RƒŽÔ~NVƒ6@°/ËpÔœÎ}^µÂ§Îj]õçaVk‹×ïJ¿=À™ú-D  ÐlF«@œðsœàÓœí§8osjgßeÎöÓœà,Nb1€Ô‰Zâ'n;󈥇ïkâK£¯qŠ…œ‹äʧ9A§8ÕŸøTKDú;’‘ùܬØswb9ø6@°ù¬qþSó½ç/zÇœˆ£»ó7}Îß 9Î{ áù›1GÕXê¼ó]b©¾7ç!Ÿ“TÌù«>±Â"ÎÓO{ªÉEÜþïõü]>¡% ?‹{†pÚ”»m€6`óî®ü3…säA’Zòsåuˆó„4ñÏjéÏÇøOA'ñÏ:róJrú©ôç§ (Úü7A›øêÏ%õ¾ÚmÀ~ˆáÑR§(œ5±œr´Úm>»:O²€§=F)åo–’R‹ÒÈQ³Sjȱ#g²är”<çR|?©ïÌO%Ê)6q8bOº³œ‡¼DòÐâ}&MYg¦3'Fo!μBz槟r›q–‡q*¦´‘«¥ÖJ†¿$jï“&&¹Jrzä)!é@-’Q]fÚjmRg¼ðÚO=æ q&ÄM©‘\8Ðhós±„ÛrÔÕg¹SG‚K©]cª¡±&.±L¸ÚU[UMý]cÒ´½.­_­3ÛRÏü‘ôÊn[mmbŽšØÔ4 ¬6¥E’¥[ZEwjGâÿÕ‰?|CŒ >²vµ5‹n\8kqÃKYRÚµ?”EQu;Ñ%9óœzÎR ŽcÄ„oCù qø‘¾–ŠŠº–ùÚi ‰â1­ðrZ2â¾C‡­®¢ªk¹åè"¹gÉVÑ'2ÍLôð­Ø&«¼R^$Ji,¡Í÷ŠIÕÏ ”©o_¸ª Í4!¡æ?#½±·W×^}“S¾ ÐæçE›«êK•ÜߦÍÈjcu÷ØÄRQç”×îc^»3¼vÅé±Øn±÷eàs›b±ã)îÕ$Üxl M1Úx3Aº•¯'›¢y¸M÷mžáG·«I©˜©`©t|OÒ¤gEÎ'åÐ9±šØÓ“ß9u(O”( x“¤£|r€6@ Í{ІˆS*ÑZ{ Íò4ÑÞT†¹ ÊÒˆØ}Ÿs¯?æò+<ÃÇÎAN9v ÷^öSËê¦ÑæÚkŽözŽ_Æd$UÌ;p½óP‰´ž§øêQ %I!"Ö°³bm€6Poó.m4¬Ö{í=¹qaÞûóCóz’kÈUN×Æà‡þ'âݨ¡ þ÷™´ï±åDéžè·ƒtסPº¼QðC´ÞÞBÃÖ?öÑD$ÅÛ°ÒFÝrÓþ‡d/ž,wž9™3˜¦~¡×yS;#½I-O|yüJD´2—Žnð0S19XN8*©RûHóÓt ;, YÚΩG*‰óO«nZ«KÕˆ«"²g¿…áUR𥕢 kìjFsÓæ`Ò>*½>­8ŸÇ(:ý ºò2  Ðhó¾´)E‡s/«³èÞÉwÀÿ['16ÁÂÚÉÄÎUßØ€ÅdéZ»™Ø9/8}¤%Uñ7¯4ašo>ð@„û!®«ÖÛ¹šÚÚ¨0¦¦v.F֛Î5Mo“Âsµ Ð׉Jcªêؘ9¸h²5tM÷ô–d’lÃU™L¶£©¥‹A7 ¸•DÞÁ¸ wuÔiê:vø™HÍÅÐjshá{·I•£Ø£‡˜JT-[oWÿ½fƆølÎz%îÛwåžKm·cSìgw'‡ÍkL}¿œþYiƒC©zxµ…Îd›® ²u°Pg;ٰٮ×6@›Ÿ×«R…Oܽ÷’¦äÕ¤ ^`XŒû[ÓhSúf“˜çɾäûÊ–nö[¢gêÒ¤ò¡ÍA±ëâî$ÌôÞPÌ™;n>ÇcËIÚüÅ ŒrótÝåæíæã¶-Êu[亘ëx–T! ‹Œw Ï9ô§Mï†àXWbiÔÄj.[îºÁåœà$<˜ÚVž\‹¢³®¯ ŠqõZv<$ïµ´gñîCdfÁÚÀH¿C[Ój9’&ïCO<üñsˆ‚´HçÍwM¥BbuϺÍ{·d·'—ÏôöY:r¥|Cèç­{ÝÃ3+®SŠÎ¾¹ÆoÏÊÍû6&VpîU»úÆí¼:Â)ݲg¿ÇþZIWdYÙ+ήÃ|`Û¾DWß}îág" 1ÿèCk¢kÄkm€6?£·2gšž©ìôŽ(ï³tÊ~°ww8ùÞS Jü7Fâž‹œªÙ^ŒšrÎs\NÅ´¾ÄomøÖ™¼»ŸÄy¾V1%’šòøL¯ŽÎô>i)6÷ù'N_sr¥³¿ oemÀ~¨áIç{”s­çƒvrk€³b7Ñ°_œÚmÀfÿ´¸Ä«ùOܼ՗h´Ú€½kxÉU²çœzJ89â÷ÕI?ÄWNv¡ÿg¦vÊÒ²)KÏ6r™¾Û—ø#Óæ!¯ÿ»EÃøÏ;Á©w9ŸƒÝŒ8AÐfÕv  Ðì½¾KüG5ÎsÎ~bZÞš£`á:qîs®tsTÜ8ò6„¯%Ø‚ÿÄ—âëà+Žs´=É¥ÖœÀLΊ]œ˜‚OI%–¡Þ¿É†_A/ô9øsäh´ùÿixeB|ùüZáç°×rTW¹7¹òŠcâCŸ™QM°Èh ±TÍsë çþ(Ç&˜£âÊQ_ɺJx8UŸö»ÄDoŸco]Š»ü™Ø僗Φ?┈`„  Ø{Y‰óˆ/)/øDLAÜdüH0ù“X*˜i)ø:úORÅ”(þæÌçgðm€6```@  Ðh´mÀÀ€6@00  Ð h´ÚmÀÀ€6   Ðh´Ú€m€6@00  Ð hÚ€m€6``@  Ðh´ÚmÀÀ€6@  Ðh´Ú€m€6@00  Ð h´Ú€m>±r²N«Ûyï<÷"ìÌ“©¶#ûñŽì:00°©† ª¦1ÐæÇI$mØè<Õ¶ùšYX©i°Õ5µÀÀÀ¦š­mhh(ÐæGðçŸ>}:""b'š®ððp ÍG—ËÍÈÈx×]@3 h´€6@hÚ€@@  ´ùÂÄçó333£££c@ Ð{/,õõõ€Ž'7 Þ[sô'@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ úŸ& ÿ0ñô´IúÁD"Œ‡ÿÅ„ø?9$Ã0¡ 0|>n‡@€ñ„BŒ°VnûéæýõÃO|ô±Hƒ ‘ˆpiÄäkA §)(¨ÁÌ»ÍòDs8},‰pÒˆˆ ›agfGlÐKçÀÛ€f›­¯¬Sw“°â€@ ÷ ’¦Ôöb“äÀ°IßF$z-jô¯´ nsôk°ñiµÛÚâö¢¨ëF†R ô>¼ˆp¤ðxÀ„IùBRG€ø"²øRgzH½‹_ƒÅ¶ó­ífµ–'»#ŸTHA¾ÍOz¿æ}x|ÂCO>ƒfˆ¸g‹Ä±Ÿæì@?÷†/"Æ›  ÂDL„„H(²;öok´ l¶õ«· n·å4lk>ãK9ÙgZAû±é1[Ä÷\z)=(hgã`GtPçüCbyÆdi‰Ìͧ›ºÚþS\í!'äy¡±c»Âv§žã÷m ¸Ú24×&Í9·E5 pçNºOÆ9oö>ûþ”ç"™!t‰:FQ—´?ˆ¼óDˆt¦#Þ·Ù,°Ívk‡IH«[ÕÀ:Õ8B nǽ¾Fa‡~À}è»q@QÕ¿ÿÌ• ¦bTÙóÒE—½>&—Hu_S$³-SD “&/‡Î·ý—êü;ô×=„Øš˜nˆävžÕ‘WK¬ík“êð…ÊÖe]£3.¬?hcâ‘Æ#§_²3ZÊû4î`¶;#åAÓ¼+·ŸØ b5 yúÓÇJX튌†è g îíœ{•°©Í  Ù: ÙvO×8z#Dã"lLˆ!áÔžŸ«?‚Íô\›a¾ø±‹Í¶rÉíØMšfQ³Æ³íyÊúÅ©Aªú;ŵ`¢©®Îp‰¥ŠÃ3 õn÷9p™XâkŒdþñfq’f<úÔ™äÉLΉæò·ÞÝ›„6HÐ|ÔymÌ8†ÎŬËk|3W°GÐƪ¬klƤKu3^áwF<3ÍÝÄÉ7{Ž€ÃæõM°Y`ÓïEcæÔõͶó‰óÉ r6Z™8çÑfÿÎϙϛ=ðœšà_àC$ØZoøÜV:C$ÄDUã÷üš–69¿4=Úxp\ô/BßQ,*j‹ÂÜÍñEL5“ÃW¿G®Ô]K´7TW¦R©LMÏéíÃBnWírM SE…É kš97£¡¶Êðu6Leee%šñ Ÿûõb ¡³® ºøV*Æ<›ë0ÏŽ™ÿÙ,îuýEws-:fàñ|˜_w9ÑV_ߧ£çÕ¸„æ…Ç]͵”©4*CÍ-àP}Ÿä91ÜYî﨧¨LÓ2÷¸ôøÕ^O ÆŠl<í#õ ÿ×ìp×Mù=¶ðaŽˆ>|ÄÏ^QǦgÖÛ›-|[,Ž´îFˆ'Äì ž „èg]7Œ?Ùùc<©t£jª+ÎF­‘¥^®ëÁç_ØïE¥±S¯±QËI •¥gé}îá“Ž®®ÇEY&ŠK7ç÷àKF:^Dx™køU7µöŒ‹ŠŽ…Ò•˜±gïã{¨¼—í@“w;xERpo¬•gê:¬ÞýèYKgGs^~,‚&áhWcŒ¯ªö–Êæ¶×cxAäß<˜pOçñ‘¡Qü``HRŒg¥ yKâVd8˜‡ÊÊÑõè×2H}+~cÑããèk÷|ru£ob1qÕÉü-µE£ÆznOìá>YZ¸/Ðwß ïtÑG¨ø²“EÿôúA›¡7<ü€Â±Áá1±Tut¯ï¾Ô®è]ÚÈR4­ÍÝŽ×ÖÕä%lgÉQÁÊPÓC7ÍåëbŸ56·Õ»›²í<ÄTfíϾ[÷äi]Õ£#Þ:rV{ 'o¸ÜY“b±!ª´öI]ùÍ;=m=†Öz"Ÿ¹¯Žy¼Ùý…VÜ °ÇÎÛ^Z÷1LØË}µç¹Ç¶fkŸ&“”–Oâ{Oº†?{?Øì®·Ìép½4ºÂ–Ç\­E#múˬvWLø±¯nú,[bQ‚g¼¶LŠ2+$ë¡$4á»±t<¯+‰xñ~6lÓÝCø$·g‹©¬qxéıúïn[¢èò‚$EÿÍõ‹é\˜¨y™Cgª&\iF˜èX¸£ª^èz»g†¤ö5A2ÿ5 £žžI{ÝC¸hýIéåLúä÷œ‘ÌïP;=™6ø¿EOF$ù¡9ýRí ®ÝÚ,¦˜Ümz#=ðxÒjk¶½×+î\‡«=©+/gåæÍÉ|ôdJ#Ý$mȆ‘ž*ξ°­›6zzz®[ãʦÊn?~m\jôIÒ…ÌßmèÙ!”P÷‚‹¢VQÅo¸l®$kä¸nÏáŒûUuÔÂkÑ[T´Ì«†ÄOp$ 9(¿E›/5’Êê;ØhSØ}åbwæÖ—F~-6;[]ûDDu0&š·nîg§¦ ì%”Ħ·Ÿ!C­—µ+y9ùŒ}Uh*¿0¨\„:Ú¿'m÷Œ†­×|—6Ü×7 •(šºúú2ÐcëÄÔ Ä´ù;kc×DbþHÚµÄ3¾;r•€ÃÍ)»á—sNu¡ú¹i³ H# mnÓ‰žHæP×”C8ýöGÐfZ›ÔÐS›÷¤ Ͳ¸mXºÞ‰ ¶ªv«;Ææ©#æõÖîÛ¼BWG[Eeh8ÜxÞ;6øƒã¼ÞR¶ýæç <¼{%Û‚±äÇÐF3XZ9ŽÓfÛhc§4ˆ$hš-}b5 t××ÓQW¡)ÓMÏ”á æîòRÓv|:.=sÁh¸‡êÿÚ8¹5| §Íñ—»Z—ûµ,÷o^^9xW„ñ‰Æ)Ä'«…¿¨kî(4S\Z&x«…a¤ë™Â¢àÁij|¸í{‘âá—ßæø½Ö¹iè´VX\5óq?mf©%æ•l9Ù5éŠ _$æÜèCϧГÖÏK›cÛˆÍë§ø6ª2?m”Œn5H›‘6˜Ïãòø3øÁóÒfk_Bm§ÍG§ÔÛз,}4¹[¨/÷JŸãΊ¸%—3Nßh˜ÑU›¥¶Tçî ´É hÃ;ºÉIÓÒ£U‘•ŸXG——õÎï“Ðf N›£óÕœ¼mDuw²ÓÎ×Oìe¬ëºöb5<ÒíÌ ©jåUKzE5å)Iêmðƒòñ›/ü2û³q1AéÐm-6ÛZ-·µX¥tìàb£˜´[ÂÐØê„•™Áòr´ ‡2OݱÎ\fQÔŠg1QMN„’Ý':õò•Ké1A:J A§ËÐÜ´Á'ƒÝjf1œ´såý×R—)­ ‰={þ©äg}Š©¤ÍA›s‘ž –ѾÄô3%¸çÏÏõYá´ã˜à‡ù6ä~óC 8lAG"?WbÚ3¼—è?dÐi üë(/É/AK~ƒSæ¡ M/”A¿þ B{¶¡?þ'Rú=úëî‹za¤—÷îÞ1á  µÔQ7uMNK-|Ñn£§nâ’”šz§ž', _F×Yabå ãòåühߊK52ê¸sWÿߎv[¬¤›r.ÿ|NF¼‡­†¶g*±°Òz©œÍ–½§Ïœ­ÌܾTw¢àò¹½>Ž®ÛŽØ™2LWEßyùçÁáu6,mÛCÉ©—j†>Ø·•õ[$«á™›w>÷dò¦•ºj+öûå>Y§±L×Îûø¹K¹i{M—Û©‰i#k Yiê—ÛþEÒ Š¡[~Ͷ!ÍË}LÇžHÜ»‰üÅG|q¯ŠOyØ™êê¬Ø¸§ªr~_Õ9ï:ºzN^™÷[%‰Ð~†­cš]$Í‚±HSKï[Ë ô2ñ3\õõ¼ÌL›P{ôû…hpö`¢ú¢þýö·è;%t¬lrþXÒø;úÇß ¿k¢'\´M1Ènl·íÑ?2Ñ)mzn¡ÿó{~GºÏNdGC¿ÿúŽÊFP8 -‹˜‘67–3­¼ºÞíoSE×r©ê–Òfø…«þÖØ"qÑä=;³Âˆ­¥cžQͼ8»Ò˜­¥m~¬Š/*_D·®jo:¾ÃÃPOÇÄzÍù'ýsûâ%Ï ’×Ú›êà©ojš?,”,x~a—™¶©ÓÖæQT½ËÂHOÏÐrO‘>%;´´õ·’aËuw3m¶–qlá\}Ã[/{ÑÌvK×àŸ ßhnðJJ›«žæ{óÄÓmNlXa‰ŸŽ®±Õ¶è“¯¹’k = ó°ÑÕÕ³ßù|X°{ª–×u2g5y²—9¤4™±• _ÛÖlÐhs¢ãà;ðZ[õcûco}eãŽÆ³ug}«a{Ž×çjŸ²læž3÷%žýÅŸ9š®çè쀽ý"µlvÞÐÏÃfKèy“nZ½ YK\Ú6:Ïm{ÅØÜÛa³Þ»¹»OqjÿßéïdÍÞœ7ÜÚð|˜?ê!? YÓHIÄzkÿ¦­wG¾È‚' ʇoø6Û†v8 b="!¼Ô ú1jÎðXu[ø‘ö&¥Íðtlˆx<î,ç >Þ÷ODîølâ E\DÞÜÖ§(;ïÊçñŸæ*/egu’GæõosßÔô…~S€ êßT‡¾\“Ó’€‰$oA@?ÔYœÕ¹úqÙòQÀÿY¤û°exÚÜ‘æu+Lõg”¶úæô}Ô§kjêÎ| »»/F>,­È0ºü¬§­¶¢2K…®ÌÔwJºZû®üú6Æ —¼¹9Àï'¾t.€6 Ï…]o½§øC6ü˜aö\á×gþy_ØmqJ¿pÙ@ æŠ=gêW#Yca‚@ Æ9N”P$@co-ñƒÏãÃAA ÐGñm0r¼(âs}ćù&ÁÂÇb_„aàÝ€@ Ç 1‘pC\Œ¦ô´bã\Äñ0!B:@ —H$äãŒÁIÃàþÍä|!ѧ˜‡‘ßC@ um0L€ Ç°‘‘§&{Üp"o_Êàk1ú8Èé‹Šîv^ÁîŸ:p‹°£}üDâŽaB` úpßa}ÿë¯dd•’¡Àɯº­j[ðõ›“YA›ñÇ›-M#J_Þ>¬Í°¯ÌuZç")–ÞÌ…›ªË¸Ò*þ¶7Lq©eðÀ ÕßVUZÙþàH‰Òù"ñ|rôa‰¾‡ˆðAÈE|b‘d‰`<+ÜCÓtg?ù!D±ï1eØ”= ˆ.Û¸C)9®@숼 û7©ê…ôüÇÈûBX6øÀDc]+B·6&ÜÁW:—šÄ é¸"kœpfö g´€nQþðMûÑØIÚ+gíõ<×6†zîëéõL\›P4m„ï&ÔX‰é2öµ– ßpŸÖ¼ÒÔ ‰sI“j" æóz$ ¥‰+ML„^ÜãÐ)«%)3åîà§,ueˆu…uËåU2K[ˆ<Íu(yD’)¾ÒÛŠW$ýd½ø|Òó™˜O.nLº^|r)±¾øÊ,3?DDyâñG{ÿøwþ×_ñ¾þzì›oÇqæܾ‹§1rû2¿ÚSá½B…ÉÔÒÒ i…:?$.G¯+wmvQSU317×dªX­ ~ØLŽô"ù{YzüŽ»ó*µ«-ØT£•¡OÈ¡ÔŠÂíÔ5TUU´,̬ž ÑXã¡Àõlu|fê UûáUcâbÞ•çð_:A…Ç·»¹­^½j…ššúúÐC•íqÔÐTUa±ÍÍ­C&qê,ü»m8åt<<•[{$—÷Gµð‰‘g»{ÉN ýsц˜'}EœyKòi¾¨/#>}P€µŸ?T ö^¯“ýÆŽ’i£lŸš—°ÕÔØP“©¬¤n}ú!”áç÷Ülthtc+GG{K]ñôê`b”ÉœíÌEËSOî[ïê¶ÊÙÖ„¦m›],œ£¶‰\ðªöüzk-¦†®‰±¾*KÅmk\3†š3ôt5tusk»kõh¬óPðj6¦gh¬¥Ê2vðQ.ªP¾×¾Œ??Û2)ʪû/ÖH¼lÁhèU5ù¦Œ.m^­¹Ð%s²äb I”ÅfÅcbÚ¬_(kYÌ•¶õ©zäbôqÀ±÷üîþ¢Í,AÌ»,“ÒÆLYÅ£q"Ýîoý;ͱ®Ÿ,§íÇqÚÜh'ëm:N0—ê´ Iic¬Du}1ɱ›º ©Š;ç<Í‘]º‹LÃÏN ilh„KŽØR“OÐFLîpoéÙ±(&¬Ù·RÙØ©~€¤rïyœ6Y•ó 1‰ÓÆAÝÂ=i\ržØÊ*­9Q,¾%ã¯Û3o)Ç›-ÕñI~3qí#£ã|#ü$+y Ü‰‹+ߪ¬"¦Í[õH é~ ± ‰¦…Žeò£ß~Åÿúkþ/eFeôÉ+„xõ%Vò¿i¹ª³T!®þíùCmºKåö?›Ì3£]w e—î¬ÅP;92ïÝÙÇ'iÃí¹g¢(o²Î?8(T¿¯K–û\€$#ónèœmp1mÞW‰6h¾Zb‹Ä‰À@T¾ý{e»šÞùhi¨`zxJ8ÑäNYâ~¾aîz´úuT™L5öº è[U-|ieÏTÚ`¼¬¨š4:K*5ÓÏû…?Œ6ö*¶7¤~ãK‡eÔ—k$HéyîÄZè—x6¼®:f¨BÇOWŸ]—Õs%çÓ¹NY~g)üò# tí·hšá™†/b¶Œ%3üÍ7ÜopÉHªó·¿'ž÷"Œ¨û"iÓ|Qk©â‘Æ·ˆ¡Ö+ÚKâ^N¡Í«û&r‹¶ã1M‡xð¶ùhsË@NÑ=2-ãh:©´ôô£GÓÒ »…hÎqÀ?_ÚLi“zoÚÈ[&ó'ŸòÍk”»ä½œ;7âû«òN¥ìôß ÏRÔ0w?ÿxä-Úœßn*¯¹êôíòÆÖö®îW"•~mnN£Í•ÚwiC䇎§³Ó÷o1Ó¤0ô—>®‡2e]ÆýÉ>IÚÌ]q!@T„ñ{ºúÿé_x¸c³àÛÁïþÜûûå/X0,#ÓwêQŒ¯ð%f7úªÜ†ºpëÍaiqÀ¸£Ã£<Ñøër[êÂÍׇ'ªJÞÔŸTYÈôÕ/E ¾’‘y½»Uß÷ñÎB‹-ã“ؗ͘[nŸÿr û¤•ÁwŒe—n9ù Þ9hj¯ˆš¨­=ã«'kB°£u.Úñ³en' 4wßj]5›]ÒÜÜ|ãwø‰‘ùi㤪µMz\QOãÓ§M¯°Y|q±¹&g|&äü”…¢Áò²–²FÑô¡©;2âÿâòj®¢ h{^÷²{ô‡ù6'‹4/w‘.LçI|úb'o¢–˜®H=XØ')Ï'7,£™¶ÏuS†K¶ºl(x91åè}s÷ýøïšóþJr+šˆ™Ý”—8¤”K¶x~ÅÑXeäÔ †\ßyõeªÇ«ºç)ïïE›qÄ´j]Néd²Åo²e›âæn{™žŸov¸1¤µÄc=mŸ¾æŠ0Óe„\ÆEüoïñ¯~¦ÏʟͽõÇÎØ‚o¿ý…¨¡^ ³æ DõpYª •¡bhãåµZWƒ®mèÙHæôѪšT†Ž[Ä®0S}–†Î©’47m0á¥ÈM U[‡•;ò;±¦ z &KßÚ/8ÔËÑü·gÍçÛ`·âY**–ËWåâ‡à'[3éîÑ3öó­?¼÷”ÞêÓznœ…ÆIŠvøô ÍõÕõÄgëË LãÍbød3"Ör)[Ãå”Þšc4ëÄï2´=ð5¯ì½4SdÜã«ñ½AT声n¥²<ÝÀiCHÜÈh­31í¸!x]Œ4R¶ô±R_»-t»·«º ÝqKʘhÖpñìœí&tÍnÍÖà€•–Z4ŠZj5q Öâã: ªŽ¥ë¦ôªG).teš«ß®MNjÆε×vÊ+ª¸n ºÕEx>ké T]» ÛBûîÛ܉´¦*S-ܼƒƒƒÜít•™QE0G; m5)êšÖÁ;VªïÝJ‘DR¢Š#[©ú· |ú͉ÈZ8~·¹ îÉtþê~çc¿cƒË°_þ“ùºÏk‘þ‚ñ/²ÎŠpð_ÕåeKII˾x¯G89_ÐûübVFRrrFÖùºö1IŠ Ö&§fÔLt—ñï^Î8qá±$ÓŽ¶Ÿ?™–””v«žô†š®åžHNNNË8]XÛ6±ç±ÆËGÒ¯OºáiiGKž÷’¥ ëÒ©ô䤴ëÏñGµ°âLzÚ…‡3¶¤¾ºu¥ìðɲÙåñ§ÊdâÓ%û3[»‰ÏJwfž.Ëz(é×WUsœXóÈ)|Mr““uWªg*òcgCÝÌãjß]ð¬èTrvùÄi`·ãSr»Çâ$i¯ºv,=åxÞÝqê¨. §ïàÙåb¤¼Íq®°ë©tNrÚ™«ÅCs‡’…_SxõD:žlÉÇs.>}Í“¤›`ôþ…Ì””Ô¼RCzÏ¥Çßl–`þyÉÍÌ£øéà‡Ë¯nž¸Ã­UYÇR8ÉG¯—· © t¼²^¢¯VuÁ3Ý[Mðjá‡[ÜÙ• èÍO$#3ÌÖŽp¸Ã36”“ÍûúkêþZFPõaã„~ñº“º}ûýÞåŵÄ6颙À9‚é92OýЇb¤½òLþ#©û‚5œ ¤jÞk&@Ñ“UÚVuÃPo3ý¶’…ù"ÑØÅ+ÏþåîêðÈFqlt¸÷?þmð7_ ¾’ét÷€·ÿHx??§›ðl?ν~—6DŽn.+)-›QUOÆø¢•µ‡»ž”Í¢òg¯>|ÿ}O¨,•õØ“RpûÎåœd6ÅtK†¸NjäùÍô¼¨µy§ÞF$@¢Q|j|Õ”ŠÃx^Ä’·‚:Ö­âÉÈ¿‘áêé`D&èCi#, –Uœì'3U4=çç=¼uô²4[9Ãa˜ %çŒR~º+/x.7Ra2U5MBRnò§ùNpÿßr&ŃÖý„EBÁp #ûÕðEb¾@„¸ã2¿â» ŸEŽCŠ~H(ƒÍ8ù“DRØOIaØ'Øé]oCŒæ‚F€ø¸—Ãbd¿!†OÆ\††7¯_° OW‹/€*/ôã)‘xlb¬LÉËþ’ßÄ[š§ù%EÏ~ÿ¯üŒ$Þú 8úɈ#yÛ“:±BS¸"DOu^ èSß’Àµ@ @ @ }rIÑ@SA™œ‰à½ôñh##0ˆûŸsAñV ùQ!À}4‰ˆWÆ14FŒt‡ EBÄbφJ±1 úþ@ âÕˆGrDÄ;œ˜€ø¼(O4ZøæR|ËvßÖùm àØ€@ æפ!ÆÓD#•Ã…{ŸmÚñÒ. ÅxC‡ÝѶxõ½¯÷2ñçí7é± ÚàÎÍ€°ûx{̶gÖ~Ͷ>-v>ÍN/ .·$«r A Ð{á†|#J2˜ü}Ä3‰aÂ1¬_ùb‹oƒeP‹…³eðKëðç+.öàN°½¯„"¡HÀà¡ÒDS·xüñÕ¾‡ƒ×^Ø4Yoo²ÛRo¼§ÑíÚëSý¢~‰3„Aøÿ߇Å'}iv²·öîg‰¢çž ‘”ˆ;J46õI\Â_Áÿ UÞ l²ôm²òi3ó®·(èÍÁ†‰Q_ÄÈvH#¯­"÷|é|ìãwÖžÉ{Ä}§äfír_&«VöªN{áçݧˆòûìúã·HFéœþäÖšOÈ¿Ðþõ¿6ß齟ì¶è¯ºÅs^êÅ(í?³£Çg¡×Ó[ùMo$ ŸÝÎoÿÙZ4ÖùÜÍÁ÷ ikaÞãŽAÈÃ?p¸¤´„ÜìÉšxZÜ"T:\°ù¥É¶Kÿ&ˈ÷Š»BÄÃ] !ù.xnM͵թþêÆ»> ËbOOïTÑ}gd^ ë}yÝVż|XpÿT€wd.‘ê1îHæô˜xÂO~eí—ѯdÐŽ$êKÞ¾v磞±¦kfªNÕsùZœùôqÀ§î¡`Õ‹/ûÉC¡:*ç_ô}Šgè`ã==†Kãü°5a¤6B&þi$@ÂÍ/ ·?µ—†Qļ õÁ­+ý›mC-b냄ˆáÿ!ž¸ï ½ßÇf?×øƒ¾¨·þæ¥sÙ9g®Ü)À&ç zn]:—••uöµږI¶ì’›ß>Èk­¼““u*ûÌùÊfq‘A-7OnsµV×]}ôTÖÃ×d¤‘öÈ=<íEÒ*ø‘†™—*+»yþÔéÓç.Þj&?Öß~çtÐZ{¶[Úéì¯xtûøjî™[•ø¾ø/rÕ "Þ T{Ä&<û1væ2¢"™ß PæcÉõÔÝEñÑþèd>ê‘–òê,”‡„ã&=Gñ‡P5É³Ë èB z‰’¢èX”sñ¥O‚íèDŠ‰E¹·Që ’6Åøìô@×›£ü—×ضÉþ¸òNž/{5#mäMŒ£Ñ«粲s.\ÔGîŸ×ß~1{¿®¢ZhüÑœì쳧èáÓGÒó®ÝÇPKY~Ö­fŒÛy=?ûÔéìË·Ëç9Qªµ?-½x.Oíü+wšˆ# TߊöaR-â³s žgÈïo¹_p!';+'÷BñÓ.qVŽõß<g¢ÌòÙŸ{þÊÀìßÄÅc÷¯)¨èo®8›•ywd_âtÕÝ?“u*'ïjCßØÄù¼n¬º’?Ÿs—n¼èÈWÜަϞ>s»¼ñÚÏåœ}JŒeŒõ>->s6¯ùÝ÷Þ¼ÈÉ=×ÔÇm¯¾‡%+'¿¬¡GrÙâìú¦ùîÕü쬬Üü+• ½hÊh¯_–_:›“•sînÙ‹©÷¶¹úAþ|‹œK7‹^ˆ&Îm°óéõ gñsÎ=çù¾)Gá×—ßÏï&ûìÝòzl2Õ±ÆÛùÙ׊¸B쇖=ß'~õf’3ÂÐ ÖÞ²Ö¿Ñ|[£õþfß^AYaL„û4bòç?€æXU›ÉR7²^¿ÖMKahéÛJÓ‘ªãl–Š†©}`H°«©.SS?ùn± é¸]3Äs­¶ƒjÆÑ`w=EE£sdQ{–¹ÜB[MÝfÇî¨k"ÔZ`¦¦ÆÒ· ^a¢«ÊÖ=UÜ%N®×WW/1öç¬Õ^pàXê¡å&ªluøcõeî']ËÐÝQ—ZñÜÁåXÒ”Ý"ñ©W/*Š[F‰‘koÞy…? Žx#¹¿уŠ)!Äø¹H Ù£2èwJ¨—ô<âзlÄ•z!OOKãžÓö¿CÊHö?Ï´Ö-X€ì÷"IGÍ~´TÉü™Ù¢Åÿ„ä)èbߦ¿¸¨œ'B=M5â1|Õÿªµóጴ¡ØŽ^«cíê¹ÞÅZE…å¸éШq»_Ƈ¯¢QT׆ï‰Ý¿c59vøØ9|×cŒ(v{ü—ëE'r¢·³5X˽ gÅ€œÿüÊN6MÙÈÉ30ÀÇVAS¶¸Ò‹úœñYgI£èì‹9YÚ&ì­s6UWS7Øàã·n…™ MÙ;ý)ñX~±o“ªâ¶906>£wŽðÛ·y…Š®G¢›»Wʱ4/+CU=³“±lŸ´Œ$/e£í=䊯Kât”):vk·92•)FY­DÊ FÖ›1YLmo?]•Ñ¾ ºzÆÝü2jRƒ”YꟾQ¶ž¡2Tý<½µ–û¦d ó0PP4Èn—Ô®Ž?¿ ¯¡®n`é²ÆƥΎÍÜ太>&n»_ÔT×w`S*ƒ'}¯«‘ÌÿBâUrÔl<.]± ýY)DIhó ­IÚ<;‰¾–ÒÆõ߉­Š¤oüýV ÏÖx$óP“4 mÓ$ÖÜQŒ½UoLú€-uOÚ‡f ÍakºmÏEÉe–Å8-e¯|ÑGæþ\•¥Zmä¡ÎâÓW[$cߌ3§Ê+EÝ“Ä£½Wƒå• ^öÏýЈÒ[d›<1¦ðБ¾Q§Ÿ·ôv¨¢‚;9¦2j.Œs]øDz 9ÛUV6Š¯~ô¦¶¼ÚÉÒŽ©W7SÅ\¿›Ž†ŽÝ3ñÀQo ØŠÊJö{Å€öÜ3–]óŒH“d 9£½—&j)2c‚“poÕÆ[-eºUHˆ2´ÃÙ©Ê>q¯?èèëÖÊ꺱wŠmÇ9:i¸ñ°ô÷h ¥¬NÀC²n•`½žªyàD)Øa¶„íÙŽßÃŽºJt¿TÉS çöNyYƒ=B4úÄwíºØœbiÊÛÈ.ñ+Ä}],×…©é7q؛Ƕì¿ùs—’¬ÎñÉ-~]|Lƒ®p @<²4Ößø¸òi³ð‡¶Jchßóõþ ÖUýx²s;‚ê—¿°hòèÇÚÉ4¿¿ý¦}UjM]P8.½$wlŒ'@c=å6Ô…›o M”ì7õ§T²Nà™¢-“BUç</Á£;Öªë¬Î%Š¨ˆïgÃ6ÝoÆzìDû~ãÍÑÉ@µ+_íïì«Ú|Oq~.¶#ŸÎT=t¡Ï=ÇÂUõÈz›©M93«û\‘Ì?#r8_¿ Aµhòž#™ÿÄÞ¹hãò/èŸ]'Ë×e$³ àÛp‘ü?"e[ÄÃ${+Í@ßH"©Ùš¤ÞmzºvÈBQÃÿõD‘+Y¨lUÚE¦É«Ó¬¥Z—H†¼ÊRYʾPß'¥©ûcò5ÖK¯ÕÏwSìå(V!χ¥Ç";£â/ ¶+*º‰y‡‰$EâMïëî×ÝÅ‘«¨z65¯É”¸¢%¯zìÁ|õ68m\ÔMÖœäI’¬ÁI^ÙûD¡8yƒ®*ßo½E\àÙUyãM½R,KÎgä€1ÅpWŽô6aíy»©,1mÞiœB]õá±YNÄÚ¬©¾òž}Dã/\èß»Ÿ=Y-ðê¼Æ÷4N¿>gKEår«t&ã-?˜˜ ‚‘7ݸ^7ùjo—Jøí··h.Óv¹Ý<.½¡âsæpÖT[¿gJ€÷Ú[K}uD¦›Vþ( Ò:v6ÚÜïºv¯ïZ`‹™³íöÛ.~#Γ ö… Êõ¦ù¢Ö¥„w²ØPë­% ‡ê'“qôÕ}¹Å!•"Ô‘©DÓ8~¯M ‘Ñ°õš:îÙoцÛsËHIIÃÐÌÜÜŒ”¹™‰žÜß–†×ðÅ´ù;kc×DZv]`à´9ÿ|mæÕTÚì°G2¿C=S–î_Cð§kNÚ8ÿ3úóŽÉM LÌ"Ô‡G’½èÿÒ[&*[.NÔÛ¼¿ÄµÄ“AMÄ"ŠeIçÈ<´9h"krxJ4ÓîE_êtºvîÚ·Á–û«­)²‹´-V†íO½YÞ"^8•6#¥¡îÆŠT-;ÇÎ..öFÚ*6ÕÝ?6Ϊ¦[®IýfgyjHn‰ø°e•ê÷›oÈãõUF¬·§Ë-T3²ß¾/ñêÃäÝîôbPÝ9×&Ê&öì…¡ñmÞõmh 5ÎÕF)¸1[´ÔWž$F|sß`‘ÜžZþDFVÚÈ/ÜZ4R˜¼]EÅðÑàtÄ»ž®¯Ê0°°]éììì²B—.oKÒqë÷oqVS\HÕ¶ôˆ»p§šÜo ®]SËL*s S%EƒQ¼x;¡Ã'm2#ƒš¶5Ûmm°.zsQ$ˆpÊCN}iMÝoZ®ê.“}ñ¶1ÜV »TŽt‰¥´éºm$»8¬F„ÚÅ´i‡6½÷ —ÊE” ÆGG¦H\™öñiá„d~¦ÖÔF­B2_¡îwhót:m¾ ‰6}èÿ€tÖ¢‰çÙË|ôËI›É6©êð÷¥qìøäã²Ùƒ²Ì%§nÞÚ~¡€?:Ô[r5s““>ƒFõ9Õ46‚T%Ûè¡H 1ѳÃë”õ~8m\TM7_•–³¦·hã&¥ ‘„ü±‘7Õwκ›Ð(×D<²ëöfþ¿öî<(Š+¸»¤¶j7©­ÚÚTíV*»ûÁa†ááY"k•]oA"°a#ÞÀ@¬°5”h¼ˆxPƘ@TpvAÔWí¯¾ÞÎö6¦xdìyà¬É= ›}Ç„W÷ -©A¢M‰#Ú°t{¦zLZE[¿^}‹ž2Ûǵ6S?qKj÷r!“©¥\-©…r2j¢ð¢Ì—ü2PŒ6â}TµÛÈ/†Œ6,‘ÿšŒÓÆ‘ÍžÞ.Ì5Ò–Ô Ñ¦Cˆ6'œÑÆ3ø˜«%ãå›ÞèÍ;«2ßó¤—P/G,¼õ"U“Ó’¸´uFN[ܶ»ËŒÖ>^úU‚ýo5_¯ÔFøtÃúâTÓþÚØ'6 êËå²À§oÛòÑMYñAÓÞ¿mï¹ìøhºÌ^/ömv䦨Öˆ€Ý¹b–2$¾¾Ó¾Ïj×i½¢óº½ÄÏ‹6»W¥¨²I ×xúPUí5ë¹ uAˆ6±ùŽ¤­Fx›uNxýÃ|!íisä6©£…¯†ˆ6„TÍ £Þ µRéVþ;©—ØmÅùáèþãW:G–Û<9à¡ÜÓ(F›®ª@Å®Îh;eò¤¬û)|æã™^ê¤ËéÁ¥á›¯Àµ_;š¾\×âäÍœ¶3­ùt¡ï¸¸q¢¢ñÁyGíã<çv¤Ç¨üB5 ÄNw*l‚ÿÖÚæ!NœáD›3Â]M‘äî®sζ6+*8V¸ 5íNçVê·´/HT*½Ä=M+«Ž´÷qÃÏmxžÛU¦ J¸dïDï^0%}µÒW’ä~šœri[šöÌëx‰âo}¹A©PîÿŸ˜YZVÄFE†øD¬ºj»Ž~ Vg®>è\ìþ¢¹jy§0 °Wå1iy•}çèn|55$°¨RjòmçUž¬³ŒpœçøýÙœVmÞ=mvKÌ-ÃUÇoO^ƒ±îçè¨[‘™,“ù…‡Ë”aËVï•¢6yr¹`^ª*($Q›¬P%ÍÏox(ž&­»=<åµmÎh³2C®LûB¬²Ök•U² 2yÀ¢Ê‡„¾µzÑì…"Zè–8÷àÅvi'v×d¼3)óïªN^^>›«n w÷+ ž2ÑW0ÿ?¶«¹e[¸Çí¿ÜßòqŠœ}5õÅä/¿%¿y›üùdÔ¯Hj¡ã´é#Sß%£Þ$ªP"÷$Ù󄸱îšð­ö òv®«ÀêP2êOöhCLd¦—0å[¿'o½I/^gŸs·ÝK&ÿQUøÝÀ/NlŠ¶ÙÕos%ïÝqÓê¤ÝHž¬Nëí?==»ËøxMŠø:méC9»5Ú[[²§(#!1)6R- Š*ª8Ç¿qd]B˜Ÿ"$R¬R&ddŸC¶®íüÌ`Ÿñ>IÎuÔ•Æx+¦'i㣓®Ò|t†ÂW¬ùBH}tų#ÆyÉ#2®w²Ï¿$wÿ#Ù7|þqG´¹§í¹â€=ªXúZR}Þ™RÈ0ïŸÙž<-À_¤ˆN]P-|«ùáºù±>c}b’’4)‡nœloIñ ¥KÆË”GoP9a¢oñ±;ŽhìÍò—%ýÛ^+z‹ÍV«‚´Ia*Íœåß4÷I;EmßMèD¹*$pŠ_¸¶ø«ËB…Ð7åg&NQ(““µÑqÚÒo»ª‹çLò”gn?Ò]_‘ê§ ‹‹‹Pû‡Åg~yÓ~¹½XµI᧠Ò̈ [¸ê@Ÿã‚} Å×#féˆGÀþu2»51÷nžû›¥ßI‘ך´}VÖB(½ž2Ð&®ßcPyNú\øBú¯Pñ÷Û®¿åyMQBÒ,e,-ÎabÄé…–»øž2˜,,ï|RKë(£kÌÐÊPef8{ âÊ…x³ÁV¸Ùýa0Ѥ·Ï~{Œ´Æfšôõ’ž^¢7þ[˜ìŸSF[ù¤·×ÞC÷]¿ºÍH¯^¼¯Aœ‹³]Ÿ8M¬œP‚Ñýix¯f§¶ôª› e6è ýVž3éõÖ±Ù¬ÅHQzŠöƒýµÁÈ‹ý6žqe¶%Ÿ=(ƒõÚˆ{Öb yæx‰C8&Ú`ûŒ6³¶×f£Aš€ åÍÂÑ¢¤…cLâ:Ѓ æò¼‘¶­&ã˜ÂJëõ&†uâДÎñ%Ϙ¥ƒ/”)\ÞQá¤Ja4³œÐo£>ð½=C-OQ¿;`'[½P=¬ÎÍ5íUÎQQլ߂¤¯X‹É lE›,ÎͲ2BµW@XW+k¦Ä êšÞQc]EñVçî5¥#b_†ÕÔ–=w©ŽY´a9ö²þô²ÖÄ‚©=Üc+Gð÷˜0‡ÖÍÛÞðôe%¿R´átÙ,~Wž #°½ÐÀÄÍÊœœOš1þÛ’Å~ÊÈ bšËß?”y—ù‰uºúiKÊ™>r†å™;ºkÞzÿ𣶶!g¿U`ˆSЖݱ֗ö€ÑFXFç…²Ò²ÏÜÚUÙI±/©#tý÷PyY¹»Å”ïñn²R„xÕÕÐÝ€ú«jIñ¯ %åf~<ÿ~þ§ãÄ¡ endstream endobj 1044 0 obj << /Length 2064 /Filter /FlateDecode >> stream xÚíYÙÛ6÷_!äÉ*.oI ЇöKz=Ò-ú,Ók}ÑáJr6Û¿¾3$uXözw›ô©Å«Ñçøq†¦ÁM@ƒ¯_\/®^ $$Ñ\×Û@Dš(©‚HÆD&"¸Þo–?šv+”õ&ÿRZK´ÀÌý`Ž`!Õr_·m¾¶0JÕŽ[¦]æõD°b²´(îÜpZmÜ`]õ¬º·e 804 ŽÃ!‰Žhmíô¶›ÓjIV¡Š•EÉPH¾|·skè[$ëfã²´rÄÚÎdËCküPîG²º\çUÚåµgÜZÛãd؉cí³âjù>¯-îy%¾qâØhR;6˜´uŒ"÷*žºRRê8é]³ÉÛ.­²sX.#2¢ÿggD…R+¢hâæã©Þn[Ó‘'‰µ¾$PÂyÃú U¥­¹OŽzHΠ9ÚŒÿ°{¾˜.ëO0”RÉñÑò}ÝÁ¹Ê(ZîjôÑ-\ˆeyÀÀBÂöÇF2ú8»ÂŒÁ˜ÁtÅ6ºìŒzä ‡Û1}ÝÔE1ð+Ç¿«KtÂiŒÀ'%2ÖSæÌ×€-pE„|Räë<.‹bHÝÀ s¯°j âË„a = z±ïóÔÉìVly_B)AQ>‹¤Þr!Z*,ò2ïΖšÐÑ{]^Ýo˜Ç‚íiÃ^,(aÂ'È·«ÛÎU„p€p§[Š–ºuãÀ_=Ç_AÙ}ø‘è}û5f¢•&Qr »(øv“vqÐFòèã¬ÒEPˆøìúEÇc“ëcŒGÆŒ éGc<»Œ¥Q2L¸ŒíêÑrž€É‚M0YB]Ê(?uÒCÍËý‡IL„2æ¼›±í°N¢ª=ñïã§@ àweÝ`t øú;7fßw.îYæÕ¦ËÔ $÷âM/®o|lÆmïü¾=ò+7YÚwLû´ëLS}4ì‚0ÐêaØæí;æ¿k§¾áœH66‰ùDøЄM<‰AûtN†ö1axT¬¾ÀÆR@Çwg,ε•e2i ½°ÿ¬k:&”ýòöÕ!®Ø¬)~ VDË!òø ¤ÏÇ,œÆL‹ÇØ%”pÄr› Œ<¾àƽ½kÝkêk[u±É·P[ÓÜØÒ˜ÛpËRÎÞ@84Gz N00§X]CU»3•ó€”ÍøÔ/ß cËê*_äKÅsÇx·uŸppº[4 Ç›Ï»ã<AÿÐ_7¤MOøýºZ 9Ø£»ØØ&ÓÝ;øÌË;2,úqW ëʈÔUƒ àýøŸ¾iWùÇ.£¨OxÏ0$Íüz!]gÏæ¼w>û OöÆiL€ ­Ï߸OøcÅQv–bf€Y¡¿%LY•®¾)AÅÿÕð‰»P˜ÂNåáüò= ž‘òQp­‰ÖìòiG“ôÃäŽcŸÿñ<Ë-k„„x€„ Zbÿáùº7Ç¢Q÷ïº{5§Ð‹5Ͻ¦ÊjXÓԟйJE(NâˆÍšÔÔ¾Ÿ€0¶Юu<AäÂZB ðLî¿+S§µ°ÏÔ=m·‡ÂÑí®nºìà'l­Š8s¿/îœy­8W·¸·ÑØv¨›¨‹õˆV£rþðÕòø&e†ÊýJß^c‡…°]~ŠÒ§•Âq_ø á5jˆSü……ýMî.M6Û›Ø{›3ý_ ÿïlá½û÷Yó”_F^¡élæØÛbäÛ8¬#Öõ¡ù tRE(vÖ/>[\ÒK°é³²1{w´Üâ&xã…¬/‚ð¸üÑ4…{û².¡‡ðw®ðþÚjps(R¿ù—öàÍöÞGfoÃ^vzcÈÑÀü—2'¥~ôe§?çÉ c¾3‘D>jÎ{4Šbèº0A½ù8šÿoZ‹N¨„å»Vsmÿöªò endstream endobj 1038 0 obj << /Type /XObject /Subtype /Image /Width 302 /Height 69 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 10334 /Filter /FlateDecode >> stream xÚí]\“Y¶uwß¾}óÞΛí;;[ÞìÎŒлQQEØ°w±ë8PGÇ6€Ø»ØìÒI!!„’HO¾ûÎÍ—„‚è83Žóï/„/_n9÷”ÿ9÷|ˆEQDEQDEQDEQDEQDEQDEQDEQDEQDEýà‰ “†‹† øÕê¯;Zï úîÞH·ïø™30n‰Íý4îß@˜Üû±¹¼å;Ôg±¶å”0¾¯,u½Lx“z`k5„V«UËe2©T¦Piµ¥T&Wkðe•R&•«àÍ›^7šZƒ)ÔF‰²¶xÂT<ÞY0›ñºs3_c¿‹–AÓ¨ ¥Þ¨”r•Z£%zåÄ‚ÇZ~µœ¡î.­B&“É­öG®Tß&뉾Ë&^Ÿ‡XzerÄÚœ.f‰B‹Ò¼Ò–$óA%€5äw¿MgHhÅç·Fx8»z­?ÕØX´esô…ç¤e¯ô2bG—\ƒ,íã@l„ù=º‚;ñNA³o"dÍè’¶\÷CÞXú´”£²ežûüÖW¨ûõùf3¶Ù©ÅÊô]éf#b<.c´¦nÄÆ– 2öo”b~uyU—\mjxÌP-¾¼}þÂ}÷ªö=ó“Ž°´VÜ¢á;ZãÖ{q‹[LdŸÑûL–üY7ÓËÝ+*é~]i¼§ËÄôì›î€@æo^Ê[Â|NšÀ/›;hMÖ >Ÿ x†MÈ«h·ÂmÃgÉÑñé·­ `‹!†)¶W,Žqý²Ò|²Ä›tPðCÕÍ_n<ç‹üÇ%Üi· âRÞÝÆvRŠr׆8EïÆšhÕ”–L´°Z–ß$Žr›Û–'0^|¸,Äoìöî~¼a²MÖ\ a}Fé²Ù©¡ëÛÿ±qv“V]",ïP7½Ëi¸½ÒÈiåB¹ÕQŒßTtÔnX¸ørR æÏ]S%ÒØðWº‹Z+ÿs7ß —JÖFµÆü"¹’¹0"rzq§pï„wÙšRŸøÂúöYã‰MFimìPȨ7xRÞÙ·rbò*–Xa°H!(žë;eã2Äø"ZÊòƸæŠm†|s€ –tÖWç'{¹LÜy–ÛÀŠ”…¸¹E(Uh²3wm¨Ó˜ RñT²öV~C}=¯¹µ[¡ÅW´}+c(J-o47Ô7´tö Ž¢¤Ñái··HEmMÐiCcKk‡®W¤U*eâÊ•£ƒÂã6T¶Ú{”ä0E· ¹±¡& è’ªôc"•ðy -be?2/·ñ›[DÝ Ãu-9·<7.|Ö!‘“¢´jI¿…±§ÏåpšÆšžžö滉®nÓVesÚÚñErnJ)¬±ž[ßÔ"”©ôÌ· xÍ0¢¦½¥‘ƒ?mW`•¼½îô®E¡ÓoW7wÉœyõÀ" É$dm%³Â½Ç­>ÖÀ¹áæ¾úx¡RïþÔ"!Þ‘úƦ6Q~+°&nwó‹¿ZÙ®‘‹šÈU÷(É¥áÛ`p+› ä‘>Zˆø Ím µVÒÞRÏå4ðø: oÓÕr‰6¦¡QÐÞ¥ÑqšnQKC 0VÕÎçÕ7µ)Õz÷Þ-Â546µwÉ ”Ш䦆æN©e*CÊ›v/‰¶ñŠD©72q{S#'¾°C¥!…kbJ¬_Òæû0;!¬›×ÔÚ.Ñu¢cˆn»;[±„ðâU¯… T%g9G¦7ƒtZU~™RûF"þÑ~-#.ÔÓæN÷ñ Ž\—[ßP¸ñcûçž Zd¢‰Z ¿âPzjH¿·7ÍÝoâÂ9bÓü¥¢“×⦓ÛæÑiž¾á1Ó²rLM×k¢ZR|í`òH7Wwº'ÝÝ;|Éžó =HÛP¼~J¨›‡;ÝÃ+ 8bÛ} ÒÉy¼}áDwwO/OwOßq3Ó j;ÈQë¯ì÷ùøW_0-& c¶FYqý«¤Qþ.ÎNn4רÄ×_ðH^KÛ˜Ù[ç…ø¸{xùÐÝ=ÂâfçÜ­Å»§lÉ^òÇ°]Å7¤LŠêE÷Œ›·»¦C#}xbR¤—n¾Þ!±Ó/×´âÆç™Ë’€9^îžAÉ«öWò%x¢sÇuI>ûä즄±Ñ‘!¾®^¡K2®êÌ«¡ó·æÖu‚ž÷¾˜·é)ùÙ;w]¯‘ÂM¹!Ÿ|ཀྵª ½È üCÌŽŒÃiIqQÁnn±óv” ºu¬icm›7ÞÃÅÙÕÍÕ;4f[ö©:Îm‰úSøçO¯ rœÙØIŠöû§wMìëëKwwŽž™_)Sã…w²Mòk§%7lH’Ö?Líõù­ÖjÕ5·Oqòô¢Óý"–ì¹Ð"Á&41uBàä9gvÍîíîèààŸy©TEÔ¢‡gvƇ{;c ¡EO_—_Ù¬Ñ ¢UJ¥øŽÝv¶KfO~}sÒÇÎ#¯V‰ÞxÐ F¯‰Y8ÍÓ9a×¹Æ&¾¨[ÉÎÿœæŸW*„8Q¯‰ ZÒôeÚ8ßQ3Næ?eÕ±_Ü??gÝ7iS¥¨ß\Þmñ™e4Ç€-9·jÙìÒ‹kgE{Ò]HMl­¹:1Ð;qýág•L6³æî©ÍÞƒÓÝÃ.DŸî·±¶£S ¦@Û–½6!hdò™‚çL&«ìáÕ´˜Àä­õ*¼3žܱéë‡íV¿ðEÖW·é釿¨*^°uz }`jI‹¬òéÍSÜ}Gy¡ †UW[V´3u”wìÉRP¢ö3™ÓÜ}‡ÇÏØ_Æíè–]Ý;Òá“éûŠÀwÕ töHY}Œ'–HÕ„¦‹³51Ôwܼó…¥uu¬§×s§ §Xz´¶¹§&=%„0vÁ†#%¸ƒwyc¢ÓZÆC¬§ÊNö‘õüBSî–±ÛzÔjyËé]Þ®Vh³K—=S(Uj]ö@¡Ö`Ÿ[W˜êî·îÈ•J‹QùìÀêIv.c®6ËÁŒ3ïì ò ßy2¿¼º¦äîÉAC½&n¬Ä±Ÿàð‚Qv.£÷_y\YSUt1s´§câú3"¥ª»›­Z)WªÉ¡%Üò£;7.XÝeÆñ ó;-ýÚSFkkKÅÝÜñ^CG§_U„¼½jí¤°„åy÷žUU•^Þ¿ÔÕÎcÕñu_?œê82nü¢ EÅ ®P£U—œZïçì¹âÀÅ &›QþôȺižþÑ'žó1èàÎؼÿË<ì4¼aßÛá=ñ/LÓy/ÉŸ6~É®G ³úæ±mÐ톼J JæOô¢ùŽJ[w ¨´¦¶ìÁŽéÁƒÃ?…èGSqq³÷0÷´]gŠË«ÊžÜÞ˜èå6ïY#Œ”’’)ÞÁ»®”«±ÿT3ï_Øñe.S(û6âDE{žsrV‘ÎM¨˜·¶¹ùMÄšhð‰ÝJ¢¹ð먀 ½ùõÆ/·=Þëf¼÷£…² µ¢Ì»ÀÔ}¼ýUί"éö¤&ö´×?{R!îý®hwøg! 39 •¥DùE%î!¿G¨%¬ŠâÚÆÞØ¥äÐRŸð¸Kõ$êѨ”J}ªÐlÂîRÃ'òÇW²ö»Ö*ÓXI c `ÉX=1O€&îºô\¯·DÏ©-“Ý<“_(ˆ¦ÛûBÃÝkÔߪj=ûUfÖ•' Ô}ãèl§Á»ŠõnEÓR²j¤}ØâS=Æ~»Ù‹âB§¯?§ ´*k<1l®òöÖp¿i»8:¹ÐJ¸¿*Œ+lK Ù”§†`RP2wœ[@ÜÒRçÜlGZʦs 9o×d×ɆĜ‚Œ/7vo;ïoð›p½V¦·ˆµJ¥Òñ¦Ñ)–QÍ—©Gîʵ8Ø·ÔD©Šxœ³Þ×Ý{Ñö¯r²á_αcÇïYí7„¶üë™4š›Êj縚¼ûl›ÇX1×&†¹ãDQýãŒó&Oœ3v8Ý)bÞN0–(™5ÂwĤ #&Ôm7³¾H:yBÜ32ØÛ5,þT•²ÿ\B¼•>Ã"ï`+ ç}¨1ôi|v"ÂÙy :B?7$«Iõó³h·õ\Èœ<ˆžÆR<«‚½#ÍÏÒ^ìé:Ï…8y¤mÍÓɹúòºétï •»ËÁ”››“±yýSí÷8HÉ\;Óß'n¿Ì37g‡øÓgm»¯¯ëÂÎÄ€ðU­=}2’–9G GO¢VΓs«f'OÔqdìHÍöI¹ 0%Ö´°¬"Žñ«ü²ãÁŸ¹ì¼WYrrg€ã°5ÅJc˜¯ñÒhL…Ë2‘aCÇâ{áa£a彯ӽ݂O ˆ’¯WDÄßætò.„n-Òˆ¯ž1ØeJq—š\±àÅå8çAás7=v< WNöÑ}S£BÆÍÝÉÓØ2G†ÈGÎ]éç4oï5)ÝÃ.µï]“–˜@r$:Èm°×Òó ì‹Sb¼Æ/Ê%7Bg¾j“ãVd°y•³½‡ŽÉ¸!1É‚„ñtÞ²¸¨øU¥•”î?щjû×D¹JSpx•ç;O:îi$š“Ë̽—Dýi%Ç ¶Ÿ{èŠÈè6›óG¹“šØTrar»[X–¯Žçݸ•óÒŠÐasv™k"öÕüƒ‹c]|g®Ý}úÒÕÛ·oZžD>þT¥Â"³Þ—EšÚdG‡¸Õûx‡ºì‡ì½ö1UÆ”“²qm= u=C!½¸gÒg¾+”†ÛìiþÖ4Qš½4ÉÝÑÙ„1žɺ ±›w©J§‰~¾“²ÔÆù4ç`MÜz¯& {Œ:6  ¹îÚë[}†ÚE&->xââÍÛù—mé1t ©‰ùÛi>qŠùÆlZ[õåh»¡k¯?½}x‹÷0—ÝL­Qî²v˜`rnkJÌãqŸzM¹QÒiØõ“ã[ühô½,åƒý‹ü#“Šš$æIVÐăÓy/döèYÒðôt¤ƒ­û0dl@m==ÚÏ©´¬:ÅmДÌsí]N $º*/>ÔY§‰='–Å8 OyÞn¼½sWÄ ÿÙ»™ƒ&NÎ$ñhCÁáÇ!ËO1z~p©ghÌé—ûÄÖ C‡/ØΔóè XkÓ³‘NίWâ„-é¥Õ³|éQó¿àà_®‰:vhóÖO÷‰ˆ*±¶þîê53^ª‰ «…6}¢-5DšÆ š“Á7€’Îâ¼Xú`£Ot§E{È5Þßü"7è3·Œû5•gv9^þPnÌÄ¥s‹êõ¡Z·pujÚyf§¢ñajˆCÒÖÕ?Êç5˜¶à<öÖ­%sƹů¬6ŽRwÔω6{Ûeµ¢)c Ý~Ì&¦! !®Ë_=wÙ=Nó½} ½èÓ˺‡*Fò:àú-iâ\_×ä#wzM4äNAÓCu¹S•„›1{ŒgxRî͇5ìºÚÒÂ]sG¹„Ï-¨“÷—<ÕÄg'Òœü6~}½º¶æYÁ™eI#¼¼\#€O”_û|šS@\ö²z.óá•Cs¦ÏIK¤;GÌ»££ºá¾>É—K™õòβs1ôaS6Ÿ¨ªãT–XŸ:#a”“wÄæcOD*˜ñtß–ôƒEmVCª¶²ì'‡ K3‹J«*K ·Í¶ œUÌï!Ô¢ Ûgzzúòâ}—[[roÓÔpZxRK…ˆö³“ù­ì£‰ &ïmWŽlº±¨†+kÔÝ5ëâC¼G¥œ+xÊ`×U=½µvj„ׄM5j$­8ÑwR¶©&†úÓSôq¢ìÚÞTwÚȣ׋ÊëE*9ÿÄçéoT*Ôê·úM÷Ú‘1n˜[Ìâ[¥¬:fÅ¥ƒkç$'t›s¢µ[T•Ÿì6å«+Yn僳Óý‡ú'oÇ° Îcçä¿ådaUmÍÃË{Çø8MN?Õ¡ ÌŠb°Iá¼8¸-}ÿÝÛ¹S¯èÄ¥g ŠëêX/í‹r»õŽŠ@òöêu“ƒ=FÏ9wçIuUùÕ¯–»9ÐW僵»qhú`ŸE¤&ê:”?ÊYãëè±$óLI ‹][‘wdch`øŽ+ØKÊ:ŽïX—Ij´YQ-çÒÈ`ß%ç…FÕ|°!z°{Xæ•’úzö£kY+çLŸ0Ò}hÄÚRnc;¯táD/7¿è¥Ÿç”0êëOw&õˆÊÅ9QMùÅm>Æ%mÌyZ^]ñìÎæ$Ð*nmæÜ@Ÿ—d½èOÍ(8»5#‹Ñ*{ÃèTו´³zšó øù¸¨M«ª½¶aˆÛØ‹Å­HÕ™µÌçÓðÏ»ä8¸îæWJOàçããG÷ðˆJ\vñI=ÑOí¥mrQCöúþî.n4zЈ„œ³_ÇG¹ùN»„]ïÙ¦ÔhÍ30($*~ÎùÒ^á΀aƒ¼',))˲Vù» ìè•–UN ®Û_¯ ó¦ùø„ µlße^ýó…1¾vvžo1êo ±ÿÛ¨½l+É[<Uùõ/'Eú:::¹¹ºD&,Í{ÑHž'*E §w-3cÕµÒf]Fxrû¸\r{5‘¹5…æ>n'ŸŸ+óÒ':dçsä¸iBÒø'~昙±NÂè຃küÂ̪¶Ñ´1 7Ïu¶³wuwó ŠÞ|ô>ýÕˆ®ìKø³ól©‰ú2¯Î“;¢‚}|üý¼Ý½ƒc>?v¯ uìÿà¶ü¦EG”e¯¦»DÞ”ôbE­¸tËìqî®´€À q)g1Ÿ_Ùêjï9<álIiʉ«NŸÙžàIsõ‹œ¼ïj…ÞBjD…§¾ˆ ¥ƒ„Ð\]G&­¹SÝ*aLp°[¡wë$À–ßØ6ÃÎgü­Zñ·QªÕÈ›ëXMÝ:—«Ut Ù^— ü‚FÔÊe5´kt G]=£LÈod1¬ºúön•i¥’íÒ[²8GÚÂã2L^+,A‹MšõP@ÙÝQφ.ëZÅ:¯QêYLnS7àtBÚÌe3Yu±\Ç…°‰Ë¨epyB% †„tÒÈ[›ê8<‘¾pJ'u\»YØcÈ)ª; L£¡­G«•7³™B‰Æ$:²Ä¦aJOŸ·£±KÇ•¤Ãfqx‚®®v6· ªìje¸} ¡¯±‘¶4rYLV=ÏôøÂò4ªëļè„<«ùqœ±ñN.¨‘ÈD|X›ËËûÔب¤¢&`‹Ítkl$MŒ:¾BK«!Én%í-°A &«I(Ök¢•Òf‹ÛÚC˜›&­¤­…S׬2æ;uë"d NµL¶ S—%UHù uL&·S&ƒ7-b5ÒÊš8L`Ysk—!ËA²[+6Õ±uõ<’WJ©˜Ëàˆå*“¼Ñθ·`Áê"N7zÝÂõ—*ö­õµ¬Ùµ—ˆ<¤Aî<²QßiÍZý…è¯ÖXø`bиSÍZ³¯½FÝ)a¥–™óÅ2³a³~Õ¼D–xÉ·,óNR©ÐþýhϲYjþŠ«¶íw”̈ŒÉá(¬[]îtê­]¯WwJØÈÆX•9ÂÔâæRk½—— g¿ 1gŽÎ0ÔÜ:2{ÙŽº.åÎœšdcÍjå-žODV‹áÁM6מ>qÜ*åæd]|ØbÝtÏW–ç¶Èz‚ÝìÈ$íäpøJÓ¤ü€ŸÅxÙc&O1ô Ul?c`y¹ï£?„­/Ùš1ƒþéŸÐ¿þ+¢Ó‹e6³|ÑoIÕË=0g»V&æršåº¦•ŒÍñØO<“n½¿Ò³ë5*ýp¯ÏÉŽÅÂM`Ì!^ªŽ/eHß:w]¾FÚÙÊoíÔØ`È÷GÒô<<½2",8Ô…ÐG¤?ÃNü%ý.>züË_bM$•ñßÿíÚ…är]¥·v ÷ÍkËr.Ìòµà~¥äÛß ,W«qÓÁ,ôo31€ãÕïUµ˜Ì›{ÎøÇG$ç&ND¿ûú—A?ù‰^%ÃÂÐ;H¡¸xã‚i*ˆZí·/–R)Z¾­[‡¸\S‡Š(á",ðeGª¨@æñÕÛg?~XDVf]º„†Ç‘ÔDh|€¦OG¥¥Éœï Y‰h¿åÑ!R&no¾þuv~/&èíµØ$´{7 AúÓ§‘í 0õG«•°j@¤4šž3`¯ÌÄã§?Å»²55Y1ò”2ö¯ƒ¦ï!Jª®ÆÆí@ÿöoæ|&9ÿþûèÙ³w…(5½÷^ŸµÿÏÿ ùóQy9fÑÙ?ÂÂëêÐŽÈÃÊ¡6¶aÃÐÂ…èÔ)ëLþ‘#X3÷gFOž ôt‹Q™-ö‚§HH@YY¨»ûÝçÒ;hÌ+܈ŠBb1%E8T|ðMš„Á¸B«óŸÿ‰† AAA¨°ÉdH£±b÷~$œ4[¬Ù’Õ77£¹s‘“úío­xÀŸüDÞpéÒ^f¾Kܳ*÷ï£O>±.`$>ÿѪ¡Ú”ËѪU8NüýïõQ¶-cîí.\À€J$¨ˆ¾cÒ¥Õö^UˆuïZ¶Ìº)Ǧ bð?ÆíÿW’„Ο—uИ‘¸v ¹»ë¹ý?þ£OLô׿ꪙ‰Ö­[hÓ&ˆ­:ˆeilà%—,A[¶ Ç±omkë=)³å1ß~©3›§å„Áþ´¶b3~äZ½%%éEËÔ÷‘Ç3 úÕ¯³3ŠG[·bî’´r!!¨¶örˆ¦Û È` mÛЈ½:V胧'¶ZFv-^ŒË©üƒ­œ ,ˆtöïGqqXÀ†“||e©›ü#ruE¾¾X1ÏœAW¯¢çÏ͵ÒjNãíd¾å¬¸\”Ÿ@£Fád×gŸYÉÀüò—ØvÁÐMP@еÔTtò$*)Áy ²çÿú/=££{/¾KÄã¡Ë—Qrr/픯ááøÔ ˜ ‘-ääPjøòüøJã¨={°h¥ ¾¥J‚pþâØüå/8??e š=Wy±Ù/øï@7m auм<|Ð3u*?9:bAzï=s÷g4DÐÈ÷¿þµþ  €®žž>}ž8,ð êÆúÓ¢w«76¢Y³°ÝþïÿÖcRÁŒO›†®\ÁG«d\E¨Õx¼HQÿ òDŒlÝݘã:.R&™¤Åë' ê [ó›ßàú\BpçÎ@ÑUiàŠlëPP“™31züÃð¢`ý sXòßþ†Ó/ä=\/]Šêë1D'‹KÍdÉ7 ×ä×!§N}u˜ß’Å ¶Åôœ"â÷ßÇoRR0&7Úò…ñ8•Ï§4ñ„Öj¢^&ñ¿?fûŸÿŒý‰Í@8APûcÓ(ÎË ­]‹ PYYo+/G55ØC ÎŒH¸iÚÖ*lƒNAƒÝ 1‚X¬¢¢O·€œ·oÇXšLž¼´AL‡„åàñ ¦ÔV‰õ·ÿˆÉ”odÐþõ¯½o?8a l20såÊ>&Ü, Ô§Ÿ¢õë­÷ÀdbÃ÷ÿÄÂfQjøMBr3î´<ˆ6lÀ9üà`lô h‚­Xœ‹±ÚXø4@=°ÈP1àÀºóçã/ì¾Õ¥¥¡qãp5KDŽæÈì—Žb9%Ð8˜?¼ÂÌÁÔƒÁwsÃâ¢Ex¹¹}jÐÀÊK€·%µ!~úÖJ ­Rm• +Nv6N¼1 !þ…ÍòöÆ{df̲ôæ€`@…™ùáBô·Ð]š}ÔÒ‚ K^¼@wï¢Í›Ñ„ Øë Š& >-dÖÂR`w¢8¯ÝÀSƒÑ†ÑB3 úàWðÎ K ¼àï Ø{’”„ƒ\dÀ18̱e—‚¯?îÍóx †¦úb:1XxUN­€¢Á>’é;òȬ ÄÆ¡É“ñvs8æü±dÑâÅz`Âpûö;•=~;=¦±ð ¥ZßÀ6Ap eΑ͘³àïÀº‚ðþ˜ºN3%­MM·Øv߬ýö·}žz°l?ÿ9¾z€;á~@Ôƒ£€¬q³gc—zà>ìêÒÏ^MÃäsôCŒ·lÁÃ]¸ðöúAÓü9¸?@ò¤û#1 Ø)x¯W ò…{$Ì«ÔCvt`†“ý€^ƒ¹¦èûŠîÍH¡À˜ÜÂBtý:ºxçi³²PFÆ€!”Xa½=úÇ?pô§?á§L\$cUøèñ¢µÒ ;9á2?°ð·naO'•ögUÞÜßn7ïêûxlÖ¦·Bº!Éy<|Äv)* Çz¦èX êF Ã…ؘÔÕÙÌõÙ"P=Š …€¢­Ò’ï-ûJ®ÿ'%Jœ®[ rVD¥±¿š5ò"Ÿõà1“‰àرX=ùcñÞ_þ‚ììpZïøqtîNìôŸ@þ.MÓ· 7∳gõ¡ððDÇä‰'y p;¸¿„ìÐkj0‡M‹ô^i!€‹BCõ§°A4}Û€PÿIÚ×nY>œ?_/Wd6Æ4/ uÐ |è PùÈ‘FÄߤÚöÍVêZefÿFè  þþ÷Þç•È|& òX ®“Éáü|œ_‚ÀÖV:}à $~°¤Ÿþ3™”þ2Bß<¡ l8ÈÀ´iúà ˆ:¡Y¦tÀüìg8~ܺŸ›¼à|SóU 6SÔÜ\\fænαê?þg“Hn¸Ðà›C~“ÕYÂcJ ä9^ˆ ·oÇ×ÂÕGCZv´,`#ý&Èð¡C87xïzôÙBA… Ìí|—ë‚á@M`hr`4Ÿƒ¯)*Âó¼/:«¹¯Ÿþ/ö׿ÆptØ0äà€ÿúÜ„ ø€¾ŸÜ·dO(e¤rG$=x€µì‹/pjÈ×{Qˆ%m=#Fžràôoj*Î/Z„( ¸gÏpÔÐÐÛÈÐU(Ä•2FËý¨-™°…{àΞ}©9|:®’¯€·oÜ@Gâ?Ó¨æ &V…¬¬0kdÄ÷Þ{¸AÔ · JJÂL{÷â"ᎎï¡SDÑa^w7NÝÔÔ`ϲgÎÆÄàø¢È>èã.Éã~ÀrÆÓOp1€uÁ·BØõÉ'8Ç ¯Ðò ŠÇ1'ügÌÀµK—â‡8¶lÁúklðëòå8'™’‚Õ> stream xÚÍXKoÛF¾ëWðV °6Ë×’Ì­ ’)P´¶‹’ ¥¥•D˜âª$Çÿ¾3;³IɪmôPÐξf¾yìÌHÒÛxÒû8ûévöæC¤¼\ä*TÞíÚKC/3ç‘w»ò>û7‡¦\]1_„iæÿÞꆨ‡r¥ç‹@úW´p­+]´š&‘E0ÿzûiöþvö÷,aÒ ˆy,R™zËÝìóWé­`ý“'E”gÞƒ=µób•ÁXy7³ßf’J>)Báix lœ,^U ‘'Ièt ¤QJ:­‹¶ûs_tnj ÒI‹ùÀÒ[„1ðMèÚ‡yøõO¤_ÖkÓ슮45-wæÐÙm5²}óA…nL„” p= b";E†îðý ­Qþã’¦Y]‘¬åV/ïGbÁV¡ÌÐ i ßq¦ÈVÓE°•÷Ù^´Šbó«‡ï‹,ç¹>!‡€)ce²ÒÔK½E”‰ý±ºØé^0Z,IVè‚QoÑMEq2}›!”_8bw¨ºr_ÙY 8–ëÖ†°Ým‹Ž¨;]«®MÍ÷Ž²ç*ñѼY6Ê])¿!½ï›–!/ó^Y36½3ÍcÏ1¤Ü5 KwÉ`î°~µV¿ô5B¾ÆÁ643ÛɽÑ]>¾© dÙ,réƒí1‰W`µ,œ¦§;k½›x¿¨tÃ~x(« ©> stream xÚµXÝoÛ6÷_¡·É@ÃPßR‡­A;lÀ{h‹T‘阈,º¢T#ÿýŽ¼£,ÉŽ›mÈKDûÝåpïÁãÞÍâçÕâú]”z+Ò0õV/ÊR–ĉ—Å9‹‹È[­½OþmßʪìÊåU˜åþ_Z´¸ºéåZ,¯î¿AÁGQ‹R |‰XÈ‚å—Շů«Å·E'r/ð²œÇ,ã™W퟾po ògQ‘{«µóâ4‡gíÝ.þ\pBûmæK¬F$ÆSÌÆy`<]¿ßå…÷‹ «…ªQž1^mDoE(ãÄR=.ºòq ‘|+ñQ+õhV©_v¤¶%Ïœ‡­&iÛ×bæï ëWêdEÛ’ æ,Õ×k|}hËNÐY„­¬EKúrsÑ~WvÕö ZŸ¨ŠV @Pe£Úc4! ô*X‘$HÏW.RËŒïe§ß.¯"ž¹ô›"£6n§ÑÃŒ“Ü_9õ}ßî•s©çŒ:I§Ì3ö«­¨Q4ÄQŽh Äá×ʵV²q¸›³öqô ÒøH" GZ–i⛈‚Ü¿U†ø$6j-)ZÌI”á{#ÄW”rÙ<à{I‡YŽÉõʬE¥ò@ÌÀj[ÎŽn#ªß²Ûª¾;‚*—¼Ñiï7Ï(ž¡Æ(s¡ )w¶…?­ ”i«Ü•†‘íE%ÍA¾›8¡r_Ú ‚Äæž÷m÷­Ð¢!s锶´{š¢(õÿ ‰U5¤ÌŒŽôCdù1Ÿ€ªlc6RdKÒLª­ÃVkì6W¤Cû -¡`ߥê5níKrD³ékCN]ë™édü iÀ˜m²39ôh:êĽ’ÍÅ=!zàžæÐ(µÃTJi*© šx §Tña¬­Ù Ÿ±"¢kå}‡ZØ,°i-ïk²Å´s¿×$8­(Ð-ËÆO[ÒéÜ ÚÇòàv>ÀÃå–Ó€E¥v÷²qgni±–ÔI-U‡L4•¡XÛXœpµp¦‘¹ºÒÀká–:~¼Áy Í],DËÓYxW+ÿ€^骛]_`ÆàÊÆB<.vÛ°tƒ»'¼ Ú5*RýÆ”™È°J[Í7;A¤Hy-[acF ;¤q·v B5)ç÷zÓªjVµ$"cß À‘B ‰l)‹ËÛ6 ¨@¢#ú²vÞí¹™m@!,¢)G°a« äBwå}-õÖl@›Âùq”Ïg|œç¹pHAƒ‚È2¬ã"BÂA Ë§T-š²ë[²Àñ>²p)‘¢st׊rçdõÓ9J>ó„›½;T†×K3Á)ß|:|¬¼~r½—ðFœmè[jY7aG 5­Tþ\¥rú~2Yª¡0  ·³6‰Ói›ŒátêŽêîBkÅKx ;Öä÷ñYsRh¦¸¢å㢌,<•]‚zEç"àpl¾­á°ïöÄö"ð˜¥Aø߀ÛñzÞÁãÙ¶7<÷Õîœ'1ãqö*ЇjÕåÎzí´ïŽŠC ?#<ãËÓ”d,H’ר¯ÄŠJ/ˆNâÏÆK±…ŒG—zg:címÛ4br>‡ ]OÚóÝ ‘eœåIôoXw_¤ÀaKdâ÷šUnÝDܸχx9>8a|uðZëK‘EËãÿØðñó*¡ÎíC#…é‹ìŸþKÂüÌYPÄ,ƒë9 Ãã—“ýwÃo¶SèF íå×–L/NRV„ôL³9â[b endstream endobj 1052 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 420 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 40245 /Filter /FlateDecode >> stream xÚì½gXY·ïÙï9sç™óa>L¾ÏÌ=çÎ{Î:Ù&ƒA"G“s4c‚mL69çl’Ž8`ÀäœsDÎA(ÕT•„Éí±Yÿg7]ª\{­úíµví*#@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ }L*qQð¥Àf³ÑÌÌ¢¢Bå–*å Š‚?hA!a –·4C4C¡@rÎJˆ’å­Ì¬ì?&Ùñ¸éÿa%½ ʹ+­H\Õ\dTô“²yÞô‹«ZLkÁŽ  ”sUÐ?¶b6**h   (P¾ÚDÇÄm @ò¥ióžâzõZwwOó¾:;;¿P1Ð ”óL›¨w“2²ò>>>^ûºuëÖÒÒÐ (Ÿ—6ÑåS$…àà`\~~~èôêê*Ð (_ˆ6(gø´YYYÚ@h   Ð (@(P m @´Ú@h   Ð (@(P œCÚ¤µpÒZOøä:Ÿ¿Øè¼z&nú6ÜI>©yâ`›´} ·áø*”¯˜6HrÝRPIWPI÷~é¼ýt5kÔóÞ¸Zz:DA縤ԯ>šLÀóiLhf„=éªØûÌgÒ‚¤µrrúŒ4_1mZ‘è%¿ÿANU—¤ªMRA‹†º}fj;bb ä~o:_çH+ÃkhZNœ›ž§j=»ž¦r¶']p6$öYõ÷"ŽéýÈÑF‡·ÚÑ?£iQC[Ñ*a6£ýäøäð™pN:«C,”c{¶v·BêÀǾrÚWÍÀ§Ùñ´Ø*:j¯ÌvfôJÄ+J|=3³Ikf§£­]‹|9]¾ŠN£ë¤ÖoF•o¥5o†—­Ä½j’õBiƒ®‰:FbåBÄ«)Ôâ™]¨ß²Ñ•Ó6£Ê¦bªvÒ[èQo×ÒÛرïçj™èq*i)¨WTÒÂ_LÅ×ìâ®ÎŽ7[Ã8ˆXZØ(ÓRë7"_ME¾žKiâ—Ôfêf ¨ËMÇÕ0Q÷C׉{ÙE’T»^:PÇû~å´±Žë8ÜHñiÓ¸nãp…¨ ¡ib#'¯lß÷´BDÝ#­ÉD¬Ô…„\’ºìnÄD[ÁöîHV4=:jŒÆEEÙ¿kùOb-Hó–Áå‹ò.]¹-“:Zê$-su}S‚Œ²Ó] jåЬ|9²²Š¡=‰¤¨é’™Ô„Dþ¬di¦&kó ¥¢ £M’Ù͹pHÖÐ0u“'k{–¤¢$©èS&eÕMUu¬Œœ®ü@ŒÈ\‘#üÝ0l*«qtеôж¹ehe)!­áÿj%£y[ŸôƒjèPfûAôWòX^Ž¬bpEES“¨l\ƒdu³Ý¼\d”ô4Œmˆ²h¤Ô•9€Üô´–P³ð¼þt.óh¼ åk¢$Ù2ºIn sKJ#‹G›´¨¢§Brד{°ö%¡¬CTH=´nMVR7¬Ék «(“­ß#YõT%™ð{i-à g6ËêRú¡œ6Ûff$ÕÑ)‰ŠfIHf'ó¬ýÖ=Jfí¤‚¬”ßë5´±Èébê뼞,Ä>z!vAÜ» É@3© m´’" å÷;è̬êN¢Á·|ÓÛÓLÞþqv/’ÕÁ¶µÑVM½3°ª¢"e3“Õ‹\»FRõ~‘݉dö#î. ¦áÍ(d’j–˜¼ì©…“ÑÁq2W|ŸÝƒÆ],߬÷aÌ„Œ@QÒ•¸;HæËQ ˆªÔZ*QDùv’™ÔWM›Ç¥âÂÂ’Ò2Rx‘””Ðð,JÇisýá¢otéÖë¼N¬›.¥vQYü•g,k}ã¼õ¸‚²nŒ«£¡U%áéÒµd@ÍY¥Êõ¾ìš’š…·Cì«ð·s(sâJßJ ‰ZæÙå8„ÞÑTWÖIèK.}*,å™>‚íŠK›ŒAÄ'𶔪U–û ¹ƒ}ÛûÓÖº*&ÙC9m4Ð M‰QK¤ÍUw5ûŒ^”Né]ˆïmÃÀ*ôdÒZx¬HãÆ'mHdN&AZYïjŒGVc|ínNâda*©nvåöûÛ¹.Ñ©R?‹Ü|JK­™ÁhSöý2)«Xtº™•Ú„4IçÒæÑ¢OT°¢ß[Œ6-(m–T%´~†ø†Þ"™zúX\Ž‹ÈI$_yêïm¬âû>­íP%”3BSS’ŠWOV’Ú°^Úáè )*¬Úÿô¤Ùïa_È“¬”öDVíÆ>,’È ÍrÓ? f“ˆ»kÎb¤D´.·¼¬b‘7œæÎmHxV¢ˆúQÚ8dôsiãd`t”6ÜàŒv$±rövá{c 3 Éó鮣…©œ©÷íRÞY…>H¨§m¾©~›ö“úmÌ…çŠhG¢ÁpF’\1,qI!°É|ö\š¤­¡häSÎÌxת¬f¤®¨év ›6=´ÉlZÑÐ êö£ÉHFㆮº¨êõ¾ø×ýþ°&w‰¾›!!e•T5"G*ßÍêÀžD<íO¨gG?8J›ôA$!7S„ UËA‰‘×2)/)yóÍš›­–šC^?’Õƒ¸¹Û«§MßÚ¤4î¤4±÷‡qÒ[·‹š¢?°2»‚1ÄTW]Çëax¤—¨ŠKB3ö´"³y-à^J3;¥°Rp3‚õùÀCð¯˜6$IÇicn&ãY2“Q7¯ª G6vwIVQ _ö{‰ú@nÿ¶†ÔEa5W4´ÎíÚ¼¬"#*cÙôY¡ ÖrÍÑ@DÞÌ#㽫ƒ颊gwÒ½‚K—¤ Ü¢¯øňš>Uè=~#À]B^ÇÂ/ÃÄÚRRÎ0â3úÁã‹2¾û´©¿(ížÞõÜ:X©È\vrÍÖT‘‘6ŠMnCb>"y%›XZªŠh¤¡´QR3¦`´¹¦lŸ¾O›@]ƒ€Ê̶=KcMÃ„É n/1Øp<=ÌEdu-}Ó-¯y‰þô³ËÃݬ.º‰A^ßÝ>(UCSVF',©I­[R‘W°ºíYLÁ¯ƒ³}£ûÞvÚ&¶>ÑŽÜŒK ~½ŠNçun¸‡&›¸]ÍlÃaNz7œ˜à[…&ì]H@|–mXeF74:gÆ©š9h¾s#"ÉÐÁϳpÄ'%Ï1m"£IzÕjs#ÌäZص»ƒÙ=Øsm8Á¹OÌÜü-ýîFãyJ›.s¿W=ØtbŸ¹O)Š lÍNÄ;.ÇäjcR= ìáu;–_fæè”1]œ#ª•“7¸ë{ýÞ*ÚZf¤û>¡q})ün®çÝáŒV†gP”kÑBFÛÁy¢qQPö3÷ ³›É·ß³s;¹OÀÙáIÆWƒj3ñcµr"Š_™{„{?Yȵo. Q†¤­Ç Å–?ÈÀÛ)—<‡§Á g"¶áÚ‚gµ6<%á& m˜¥¸¦Ä-»o¾NÜü?b“?Íß!wWimHTQžªYLæ8R8Ž8Ø^VkÉíÂÇká/; ÉhÛßO;ïˆK¹C[o}¼Õã‹ïrØÉw lÞÊ„rn§´ÆC3Ci’Y‘$§ïWÇ@gBÍm€6P>ó›x´“ÖL¯ZŠ«ZÆú~y#a8@  ”Ïœ¯¥ó™sø¹ö7ÿj|Ú>o6@›Ïß Ò ãˆ Äu¹ËYÕ›iÛm¾DÖÐÌNm;À”ó\PO(*|š^™Ö´Ú|þØ&¹ yPÔžÚµ8ý6´äIV Ðhó%h;†¬ÿÿoFÃ<{…´Ú|¹4*¥yvó—¿=‚L Ðhóå4šPA¾û®Â/'¥êh´Ú|©‡¼9+ÿëEiC¹$—ÔóU>÷„´Ú|Öyx·…õ?üÎwß¡ÀÉhÜKƒGá@›Ðû@ ÍçŽmän¤Ñ!ÁQƒ–N#×ä.¨  Ðhó¹Ó¨Nì8Âú×ÿÂE û»ïÖþÏKo¢ÃÀ›s>Þæuäã§i@ Íç}õ2îÊn…þeþÿSáÓQx~ÞiõäiÚ{  Ðæ3Æ6(m¦…åùi8Õ^É)ÐW|Îióh´ù¼´É­XØùŸÿAÚ …öwá”Nè(Úm>6Þþ‰µ+ÜO*qK”SJþ‡µ¿Ìê Üv»@Ö¿þk£gL6:*í<—Ìnämì³™Љ¯ïä;‘¸ª’‚â—¦ ‡ÃAÿÚ\±×´÷׿Å+îQ:WõCµ] œP4Ý"ÔÝ#¯_cüË¿š_ñA¢å+®.çP=÷m×0°ìow ×°pec_MM—°¯Ñ”­o¤‰@lÃf³ FmuU}ínimª 11Ô736„rb111º¦¥Áúî;§ËZfÆ_û嘛M§?Ä$ÃädLM¾ÖKðõõõÇõEc›ã*++C:Eþ1×®±¿û.ÒÓj„úÃ==½<33tâ+½~Tó¥ûmŽëåË—|ÐŽË7 ÚÍ ¥M„»»?n Ð9÷‡b]Ý\SÓoãžÚm@@›o’6ÏŸ?¿uë–/èÝòó‹tue}÷]صk¾>>P!àE::ÙÆÆ>~~ßÀåøøøý´áöä $%%¥‚NQJZÚÝö_þ’‘š’òí]`zzzÊ·x]_HÉiie¶¶¥®®¨c|W”““³»»û6§uƒinŽó—¿ ³³P L/^ 55P ¿ 5Àœ_¨¨éiìµ…ÉI¨ ¦Ç‘÷ï¡@_D8m  hÚ€€6   hm@@дm@   hÚ€€6   ´m@@дm@   hÚ€€6 дm@@д€6   hÚ€@@ÐôçjuhÚ€þmom@@дm@@hÚ€€6 ¯€6P  /H›‰ ¨ ¦§O‘wï @@Ð׋HYThÚ€€6   ´m@@ÐæÛ‡Ãáÿ=˜)ð÷wÂAŽïæ7œÈïÚÐæ‹xÈIÎðÉÂ9dÝ_mÞ_ë‰@›³Öü err‚«©éÙ›ý‰ŒàìÍP¦é{¬lÀð³ÃÇ£mzre‡ŽœMÔœû؆ÍbR)Óû2A™g41Ÿà!Œõ‰©™=&ûWzwZY˜Ÿ .¬ 4K@›¯4¶ÙôÒQ!((©«««©(‰ˆŠkš¹/m1¸îÄ9Xóx(„ÿ1©§¡Ø3±~&‡WÂþ2Ûò¯ú?`óý‹Ã[§8ØNTD"¥qb›³ÛÐ7h–j$Y%5ÔCT•DÅ%MC6˜KpN“ûõ‘°Œîô}?>ÙCPÑJƒ" Zü _¡³ÄWJDJUCMŠ y#£öL;@›ß®MgyBlÝÌþOF˜•‚Yj-÷}c ]f©ó,Եؼ¶fmižB™YÝÞÃWŸÐV‘ë_Ço‡‚·b؆[ë³è†´s6“þ*ÜEÓ<†²²!'WFÙ]‹Êö1ÑM¨†~›³)ú:Uë¢Ð³Ýýß»ãòÂá/û¸¿6–ç)ÓÓ´ùe, bóÚ¨¥9*e†ºÍĹ0ûàgIÍ)Œ6ÆÎ:…2Ë`aó·×—± V¸A cg%É\Ý=òéü¦@”;÷òÒ?‰­s©ŠDĉCstˆm¾nÚ¤Cßôò 0ø2î'x̾ò$²©Õu²öõ|îÚ}ý‰²d##=i­÷Ót„9É£ Â.ºeaà™¸ÃFÖ&›UÚæ2rVÞ±›{È¥×TCVVþrpñ;~lƒj}~ýa¡´9ôÑ.ž=H>DèÜzŠNtÜ &å­¯\Q“—uHüÀ]ÿyÜ‚‚†‘¾&YÑ¢mk¨û´áÐo›*¸dÔ óæš ”äd,í D¯”—蜩†R% 5móäêþX[ËÓ³,6ŽŸFqIùžÉ5 Í×N›ð÷7û‹Eïh–ìý¤7Ð?ÒÑ»máÐ÷ľU4qGšJü5­â6¥Me»ýi¬‚‘ë<ž)…ÛÈG¿á½Uä§C¸_eIù¡6†w¢éƒ¬)Ìhs¶c›KB:rL‰î¹hʳâïæV9¶…Îb®Éþ,T»ƒ0:1Üdaë¥ùY]ñ}ˆ,<þYJkvi·,ÍÍàfkIˆ=éßÄ÷6«GkB²ëa š‡eRì#;óªwI^J¦×W™g {hó;hã¦NV5µquuuqq±·Ô!¨÷ÌmâÍÇRVèMkKssS™  ¬Þë¸*£m¹„Zœ°™ŒÍÍm„1yYü4/XQÛÊu2ö¸Ú?¦äÜ¿¿äÁãðëævoѹYzW2ØÈ‘dhóÐÆH^Zßñî .–zä‹ä+”M&î;#×]P136¾ø| )q5йGç&G»Û›;{hlsQR=鶃†eÜî ³Í%ÅY…Pyôä‘ýeÅЊ!4'sÓS̨æ÷êpiÃ%χ´kòúžÓØö‚=C@›¯6ªòzW}bcccbbÒï>^aáæÜ[±WTw¸ÝÐÙ7ÖßiCú)à½:=P^Çn•<`Ø›ÐW¼HPÖQSQi™ÄûŠ™½rÿù½•ƒ#.'GçghƒÅÊ °Ü§ÍQ_ÚœqÚÈHÚÜNˆÃ$öΓ\²6¦5E/Úgwõ ·×)I ½  é¶z&¾É{‚þ³þþýEM]E­‘e,*¯+»$fãàÌõ×ÌÆéôÁPp°žB„½{/Ђ ëJÛarwúç?JÚüÎLª|HpjÏÕÙ>ù‹bUxOðÞ朎Äß‚j™+eñ—ôæðxc¢#4,†NŸÖV&6 ,w—%I«ÛÌb-Þ–­ì…¡%:g8]hl£oŸ}0ðBÀiÂ-´ê‡ù‡ÚœÁLªdá fš(—&Îã3V¦k¥E.>§ =Q¦R–;x 3\V™‘Ðÿ$®6JÛ*ÏpSwKÁÜi¸‚H$Q÷0÷p'C6®ê)eÖò}€ë • Ö69› ŽÀ£.Ȥ¾bÚØˈß.ë9ìLcuÖ\YìæÆѱÑ{ñ²?™…U!ÍIY. «t ¯ó¶ƒª™o)žR':ÇѼ{;ÄJÕäV&Úz½Î¼¡ì;4:<4Ðj§"ö¨qˆK"]ÉNmc4ga ÷t t¸i+ܸûª¿³}zub›3HµŸ~.œEŽxÈÖL¿¢œlQeßè`g”—½¬”Päƒ>„Õ£-AÈQÕÛVk¬!ç›ÙŽÌ?ø§ˆêÔü.goí YäÆývÔîQW.Û„Þê®®H$¶O£þ³h®náßCY=ȵûsÿãŸ2¯kÛ:ÚÛ;::Ú;:—¶è~m~“ðæcïMqAÝØ‘‡½0Ú^˜›™_x¿clqº§6;·`re—±6óüAaNnÞÓòæ4/b­=¼_8·Šùg‹R”{gnƒÎaî´V¾ÈÉÍÍÍ˯ïž`á#3KcŹw^4ÞÆÏŠó²³³sòòrrr²2³jÆ—38êæ|·aÒ7ææõm"Ç<„5Þñ!77§¨¤tbi«·úENÁ£5:²F¹_p7'ïnEó –8môgç?\Û•±ÖÜ;%«;löîrÕ+t¯wîÜï™\â&æ“m¹i%5£üf®µ237/7‡§ìì¼Á…õ?ßC€6¿ 8Èa ò²cÎ!§;¶>Ž†Í9Ò«‡gÊ\Èÿ‰eå; ÍÙò„sÜCÁç$±÷ä¸FÚ¡Ylnÿ̉þñ©£˜6gÔ•N0‡ó «…‹àBôüBÓyܳ!¶9S± râ# }Sýš†ìuO³2çО9Èô  hÚ€¾vmmm@@Ð! hÚ€þ m@@дm@@hÚ€€6   hm@mÆÇ¡@@дm@@›ó)Ιý7›Îxå|´ëžÊÚ|šØlöý{Å™é©Pø%-%i}}ÍfŸ‡Ø†2=’F?°~rÒÆÆ/Yhó›4::ªeëížüÜ-¡ VâKíCï:9»ž“ØÆÄÒÎ)ê!ØýÀúa†ÖÛ| MNNz¤”eu!íPx%þüoÀíóÐoÃa³=ý’Y™`w^‰«^²p¹ý6_ˆ6îI/ÐJNo…‚•´$¶‚ætNhãäá›XG»ó­S¹`áì ´Úm€6@ Í7F¿ÀÛ@›óK›S2©S{r€6@›ßL›Jš“‹ÛÌÌÌ®áááññqΑ/um¾UëW-è[»Ñ¨Ô¡} 2Œ=¥Úm~sëVA•–‘ ôÞ—ÏÜÜÄ6çÁúq‰jÆAþ|ëß¼y3//b Í¢ Q–â‡Ëßß? `~~hsNh#«nr›o}ôoAAÁÇêñÍäÙ3€ Ðæ·ÑFFŽG\@›óI®õ™6ïÞ!¥¥  Ðh´Úm€6@  Ðh´Úm€6@  Ðh´Ú€€6@  Ðh´Úm€6@›“iÃP ´Úm€6@  Ðh™Ðh´Úm m€6@  Ðh´Úm€6@  Ðh´Úm€6@(@  Ðh´Úm€6ŸÍÐœ”Fú÷“×g§42Ó€6_ mN²'µ‰‘ÒÄ>Ùˆ¸?¤6sÒ€6@›Ï[ZÔÚ)’ºMh%ë7‰Ýu‰à˜Ò´ù:hû¢AZ+"½³5wNF+ÛÃßAÕõ}zÇ þÙ¼¤mpÙ.yòtN Í§ pË‘ins†M·aío&:ÑÌ>aÃfvj͘Q;¸§MwéÁš¼ tÛý½¡ÓÉÜXˆ»“6l)ÿ4°¿@›³D›˜§UB²·2q¯Ø§ÍÕërÖ/QÚ¤µ8 î'™Í **DËØqÔ9œ§åˆ:@›3M›$©bDFóF"×[j§Èš¶!圴:Š™µ%IÝ€¤¢mô:µIoG"‹Ÿ*kè)hè«Z—s2Z‘Ä÷Ãòæ ¾‘¾’j7ªg%ˆZÁì¬äfT­±1—× ­ÎheEݾ$$é˜9ô¶[˜è’܃ܩkÖó{•ÖŽ$>¯’#„Wí¥5ClsÆhó¬– qµuR#'ìnñEIëÄ„K›ô.$ª(GVÃ#¦õ¢mS=eã´þ;m ªê$Yíkáåë‰o‡É’ÿ0JYËlG ¶9ç´&Ú¡Í SQÕk'›œnm¼¼ì¥Mü"ß-ż[H­n&^” |½’ô~DLH1´ ª.mBª˜6:2ê·ë3¸~UU%!¤×HU ~·‰"{±P»`ŸÞÒFHšGqqÙÀ·«èùä6SÈ ²þ¯—±b›³E›jáK—cúp[×.*ˆ 9—±®ÝàÅ6é­ÌزqßÜ÷žéï¬,õå¯Wç÷,)«MC[Ð¥™­:ú$íëÍØšÛmhsû-;£î,CR”UÔÐñ¼—Úű12%’Éêºd5]쯖¹ï‹Å¤÷âó¸6lW\Ú„VíꑤRzÒñ™Ã2¢’ѺP:…Wn£üÉèFÜ®©Ø¥õ¢¤BH9Æ¢Üæi²‚œÙòoöI Íì·‘ñNÀm]·ªIüÉüýÚMCŒ6ÝHD^ž””¼ž[¼cx¡±¡6É §²´Eìꜙ-ëºúdíëÐK|Îi3 ,m›€¢¦™“Z=&!¥ŽÒ&­•Ží“™X1 A&šDÔßp6‘±ŠNmÇz€3»L|"ñmÐØÆVGZívCnúŒïÅ/©ÄÕSDEPž¤6s²‡Kõc± F›  ÍÙŽm> Åbù)hl#"ìú†Ç6¯ò†c5’izON'’Õ‡\uµ÷úp—K›˜Q  І?d"¥zš(&ãù|%¥qÅ7:ô‚jð»]s#c˘ºøóñmdÌ¢Ú2ß—IŠÈß,H¨žMORпWÏ>ÛˆKcý6‘Ù bã·´Äê{+uyëô´NÄÒ€`]“\»”/**Áí·’vÞ§ ù€6dY ÍÙì·‘½`V›P³|§DDÖ. ë·Ñ—µz™3„\1RÖô/O©_¹ûPYA‚`ý §}ö0mH@ Mz ûvzŽ¬œ"IÃÊ-«INÉ8ð3¹bÔÔÊR–¤,£¤kS“‚?$ŠzT­®¥I$©*›½YIká$UŒJÊ_٧̈́4É0¤‚ÑξQ¨¨¢&£ iàó8¡‰…n›ðv@KC]ZQÏ6¥ïÚuMû´þ¤w½âd”n”6M9÷X&•Ó<£¤ªðzZ ´9#´Áž_Ç<©×I +(VTV‘U1¿õ”šÙÆqó6'Û¿A’TÞ£¥¥N$k›†Vƽn—“‘1 .UÕR¶ŽÇi³a`¢®s«%cÿY9Ðæ\fRøX—$+h~twÉÄFË 9ý¼™Ù>"“7„Œ"wÐä}(ºEþ’ÑÊImf£;¼3‚­™Óƒ%hè¢ðG­ ­È½)¤`1Óu+˜ÊìÀÖÇÒ7|CÔuѤ¶ w‡y'±ÍÙ‰mPÓ  (ÆÒ绣˜2ÚPcq²û»ÜR<ßÈéÂ&t¼>äÎ0öˆ31ºtÉëŦ!¶9DZ ÏFGÊá™Ü¡YÜ{¼9i‚¶rÆûLlÛŽøÆGK Ý#5uµ¤•Ð¤Šu½´l(°ˆmÎVl#`Ó£†æ®sŠó Ç|hs®ióÅ[ÆfÉ„”Ûù¥:žŠoÆB x+óëê··2AgŸ6i¼| ½”9ø©r¸/,m€6@  |qh´m€6@  Ðh´Úm€6@  Ðh´Úm€6@  дÚm>mÊË‘'O&@  Ðæ‹Ó¦ª ))˜m€6@  Ð櫧ÍØÐh´Úm€6@  Ðh´Ú@Ú€õ6@  Ðh´Úm€6@  Ðh´Úm€6@  øÐh´Úm€6@  Ðh´m€6@ Í¡GòˬNì_4€‚–ô6$®’v~hãìé—ÔÀ»ó­_½$«a´ùššš2»ï}·éF^=¯äÖ{fÕzfÕœÏâ‘UíœðZŽt>hÃá\½îw-£êÀúyõžÙ5ŠÜÈk@+ÿO·¾kÒ[9u£` Íç“Éìíëïêîíêîá–†¦fGg{'{ÇóYìì¯_¿Îw¶o˜6¨æææ;ººùÖomï¸~ãæŸRí¸× ë{ݸ)h} Í—Óòòr`` ?w³o>¶92g{{;>>^ð^ëm¾œ–––€6Gô Ç6Çiçëë F‡Øh´Úm€6@  Ðô«ùµµµèèè€Ð A!|h³»»›ššFç+,,¬ôãÿ€ Ðæwgkkk$ ´B8¸¾yÚpð¸ 666Ølöñu ÍgyHñ±Š}ë´ýjm@@дm@   h:›´>.ÐôÐPÚ€ ¶m@ß m†‡¡@@дm@@hÚ€€6   hÚm@@дm@   hڀ΢jk‘¢"¨ÐôÅÕЀäçC5€€6   hÚ€@@дm@@ÐÚ€€6   hm@@дm@@hÚ€€6   ´m@@дm@ ÏF›‘¨ÐôGЦ»ª´ý´éì„jm@@дm@   hÚ€€6   h´m@@д€6   hÚ€€6   ´m@@ÐÚ€€6   hÚ€€6 дm@@hÚ€€6   h:w´)(€jm@_\mmHVThú#h“ ÕÚ€€6   hm@@ТMK Thú#hS_ÕÚ€þÚ44@5€€6   hÚ€€6 дm@@дڀ€6  ÍW*çàï'oÂÛ†7p~ÇÑ~Ÿüƒ S'Ÿð±iþ6<í2¹ëðÖ-¸&·§ž€m6äœèüŸóÿ’l9rl6ûO‡ó‰„<¥:¾ï”Í9\§‚‡`óZ„SWøå“aŸn/ö¯µb›ßåxGZœý©ŠGI}3kÇï¯ÃÿÃì¬ÌmÑ‚¨Y¡´E¤½æ¯È BЩ­Êî5ÙÊu›É½ë9'ÄE^Èn.OˆŠŒŽŽŽ‰OížZDg6¿KÊ(ÞæðcVÕݤ¢ú¡ýMÙSCwÒâCBÂ"cSÞ7õ1Ø\Yϸ’WÖÄ»D|ÕJKøíð–‰etfÕ“;á K+(ÝeÛÌôÕF„ÅP7ùQÜø«¬œòt¢½âADx˜àŽ’rîÑg[ƒB°_‘1ÑQÜùñi÷w8'ß,¿ÜX‰îŽ’ƒÃá_䉾å¥/7%­Ú¨¨Ø× ý ìÎœŽó¿.P¡>ÏûéÌÙöè¨Äé¥]|Çl„Ã|s7>ÿ]?¥é¾v±‘QÑÑ‘‘ØU…†Ü/kFÅÄt?; òyІºý^Blä¾Ðê¸ûäýò6=»å‰¤˜È—u£ü‹Y™êM}Ñxpö˃Qa/›§ø3¶zâb2׿\]µ¯#c’&¶ùÑý8¥°qâd»½Ø¯ð Àìq`¯Ð¤ÌGô“c›“ë™;í#îÏl_ÎT(sÜ@QNÄW3‚Qé‘êÑMËÊ‘9Ášœn¿÷9ðø>SÈ}èŠ0ýõÛ6>ÖvòöÓò\BÍ©¥½NÍ:º«î‘è%•&R“*­l¹|pÌxi‹Ì÷ÜvìUôUQ RÞ³=½½µ/M.ixã‹hjýÛÿ'lµ"à O}tÿùß*hÀ¼.ÚQÇ9ûùP_ï¾z†Æ)L6çÄ~›Î—©?üç?´œãÙxŒŽÎ©÷ÕÐ +A' Cl-÷ìgpd’µ³ÔÝ…žQ_ÍË|ËŽatþÀð$“Ïú“¬À9¹eà.:°‡}r@÷±€„á/Lj’åó+Ú=tµî¼®S!J&>íD8íÿ)ú®¡íàì»:gÖXè/bL üîrOb¡÷¾¸Ìå¡5dgi²«»§p8ÛÛBÑ»`t°¯§§gr¥÷Ì_/•~hèØÏÔ2ʳM ±ˆ'ï†ú1õu5û™ÈªZ…l±¹‰F91!‚ªõ"Úá§:Õüœä}pSWæ^‘6×p`ìWÅòðS1!Uêî/ß¿oÒ¿ÿçVÁEȾ½žºÊ›çÔŸh÷áñÖæ\'f¯þª'i¢ú^##ƒ¸§™Ü:ÄiÃ9!‚þH(~þœsÛ°Ç:kòïÞ¹“wçM]7…ÍŠq•/ëšÁ—Ó[* îæçµÐ°e;SùE%ým5ÙwŠ»ª_–—÷‹I­˜áïsºãþEµˆ%ZoQ~Þü’™•m„Åh¯¸#I*:=¯8?‹,&–UÐ5¿¹ØûºôÃ@W]YqaþýÒw«{,<®Þw°‚ÛþOÚ ŠîÕôçóìð'ý;u…²j6+´I4–µÎ®ÀÜo´NBXüIÇ2?c–fmS/‹ýõV)Aæô.HXª‰Þx>Ë»júˆ®Š¢®éNã$ú+ÖYÏïõÀIQß ±M÷Ëx›&ªòéÜ9 þÚºщ¢P»«ÛN‹ç‡*%u]·eèÖöRÅówîÜÉ/|04»Ž·æm9ÅÏ:šÞ/ÊË¿ßKÙ Ïöæ>Xßáñ…Úùº¤¼ïxlƒÿØõÕ$Gg•ôMÌ1NÂ×tß+eíkèDˆ™aÅ,B{‘XÚˆ0;ˆ?ÈŒ-mÞ–ˆ²¶— ‰’Iã›f%#”[;+¸Ë71®š1U[ ‘þ)Ù1³zÌÝ6­ RymãU²7¬xIh`Ž>?QO”¿žkPÔÈ=êtË %Ÿ\^”»·îLOkÑ&*VPv¹ûZy.%¦AÛýe'—î­ª¨IVxؽÌóìš‚U^ÃGíÎm7ŸJZ‡ï·ádç0¶Þ<)ÆìUüxln‹·¤âþÄÄè»g órŸU¶2¤¥4§ul‘[ÿ¬í•»wÎuxCiÊR®iïìm6W E>l  ûe¼·’–ic÷`GC¹¶ŒTþ ÂÖ\º$äì›Ù=4²Aë6V’ËW?¿²uàÉ$‰dßÈ‚þ¡‘ûñžr®X›¸9ùRZHæUCçpo#Y”TÚ6¸²‡ô=pþ‡¨úƒÊ®iÊdÖM½Ûeü†KšJÉ(”Uëxów^S.¯iÇ8ÿLs’N›æ;>b¦™‡{Y¹7¯¨Xz²‘%=!Ù§éòÚŽ«8©ß„)[%º*)ßmÂiã¤\;}ZÛt”6¯•µüfÚJËiÍm°ÐÆëÕÈiûáÒfç8ò97 H¦7z†j^äÉ ‡±zÌø¯ÿ![ø–B™z—tCVÛn}—¦#$ò´ŸÊÅl€¡Rò‡ÚJü÷öêBwýK{]’’šqñ‡!8ûCŸŽ,~hf\»À'wñ'ù%æ±³Ç÷¿Ýû@XLÑËDN' ”s8(~ëª{ˆ6äc[Ìc F›;í“3—%F—™(m¤D­æ×'„'CÜÈ–Gô(Ë’:W÷äq„¡¦ûÃ_M›  “è¡×ÉÊf‹Û‡ióQ» ÒFà™T+’è¬ItŠ*BãºÊG‰² 6³ø’oI1Í›ýÓ3³3ŽrÂ/º–;K òxü쾯 ë¹ó»ž|Ý‘ zÝŒíÕ©)ê½4V÷#Ñ»!9mr—äzgVÙ۳ʢŠm«XÕ÷ÈdèÏS¨co$/iL æ½lÆì¨ËJÄŸEä<c>t`I}u~äÅ —ÄÄÄy»ôÓ÷N9mJôkšdnÖ“ì%yÙnYй(3³Ð§+-Û2Ž¶¹ôRv7Õ]AK›„kF"Ò$y9®d¢aýYÝ1Ú(jø K2Ý œÓß Ò¦$ÚIXŒÀß,AÈ3¡åHl³sôDoÖÊevvi†2=Õ×q™ð}Z/Z#¹ÿQŸXÞÂÓ†W?K¨Œ/ -YÖ–°mh-Jdå©?F:-k[hg¨,¡}cãðQ'ëJÌuÕ„DD ®\ô¶a}ƒÒFò¿ýMZVnÿì‰?“¼è{{å£øý¨5¹'Ð#w mdÿío™ýÉÊ\ Ú/qci©)…oË^¾|ùêMÙS;UIû(•0ÚˆX¢5ó:ÆUÑÀ}ƒ%Û ¸ˆÑ÷ÍÁö¿=\!/£8Ž%w¿Ž6êFèD¤¹²ÿ½AÚ|Üî§Ð¦“•¹¸0;?¿„šk¢³IYêb)NÐìr‰ÕCÜÊy«÷¨•±<".i0»ø#/¥ÀG½ülî|jm¢ÚPIÞÁ+(%-ÍW_öò-,'Åi3»µ0¦C’– ‰ÒÒD"Qø§Éìí´ŠK‘û§¹Î»"@›ƒLê‚ÒmîôÒxÝÏDWÆmVX´é}tUÓíþ~ûÕ.+!Ñ°}4µ]ŸÒqˆéjx¥%-ñf±¾(BFÅbjuku Óæær” 7“ªHp“õzÅïænþ:äšœ±=YÒ¹ Ý3GoȲöɬæ,«êÙ®#ì«dmbõo–¶ì¬¯îkek‡yâ3).m”4n¡·!c±—(.W9¾Ýx™Û„Ù9ç×ìnìgs›ÁßÏɱ ¶”^~]QU+82.9.’$òÏô.Œ6?HPW÷ðZx}Q\y„ºµ9Û)ª`¾ÄB:î]U¾v#ødŸM wwõöö¾•¾¶{pòýÅæ:Š”¯mïÕao˜èå¾iqײy€eRßKwOÒøg¿¼ºÉïÉÞ(W•“¾é¤kt=Ÿu¸Gô8mHÿ”¨šZãïgeƒÅáÑÆ/ûQ͇ʺwäÅ.æ|èaà ¸´ÙĶe[Ê4O-´½PäÒ†Þ.'tÑ-0")113=RAB,ùÃäo  ê„;ÔvIqÕž ä…;?“ú˜ÝOmrÓó‚\Ijúá1 ɱaDÑK¥cØ’¬[JÇyMÒŽyÐŒ¦´Á62ö™Ãc@…Dê›Û=ǽ6¼—UÂ$®‚×Uró²êM>mfèËSš"?=9r{l7ˆŽÑæà Få`Ú\ÅŸwðbÖÖ!Ú¨ÙgrÛùñ¢˜l—@ôMîÙ 3w—'u¯b^÷(Îé²UzÍýØÓúm¦ó…Dô§{íØ›^ V>%Û\ vQVV§Ú”¬ƒzÞF¹D¢Yݕħͯé·Ù§ ª®¼«Òf¡nëêüB¿ ç”Ø›¿6Ù%-"öžËìÍ9=âÏ´YÁi³Æ£ ÂÙñV“Ž«ðÖPz<°r¨Ó†E¹eeíæævÓ?ne‡¹µ2×ZSvÍTCUÛ8·¬ãȵ™á‘y4ùÝ 63|fÌ«%Ä­Ñvä„~öš½·ê¦+}£`ÙÑ•ÖFÄÖI´9µßæN;¯³«ùŽ·¸~ð—Ã|ÚpZ_ùÏ$§Ž¶÷*~˜Ýëҽň®W]]\\œ]lLÔ­£hÃ9ZէІëYå±Vrv©¥^ª¿ÔoÃ9•6­íKA΢RŠx=±—'U¥„žŽóhó`Ÿ6oQÚ`aíÀ³y5›Ög *Æ!ôýljçµx/D]Âõ~7æ­Ã$aý[w°¾zn¿ {ÓS—lt»úÓ4Ÿü>„Þ(HkUùÊÉ¥CϤŽÐFæ*7¶‘¾ ;¾LGöh eÛqÛ÷>vûALm”Á}(yû‚j°`ܽ@»Ø—¨‹ÞÀ÷ø‰š'u5GF„±zSSXÉ2€ºÇ[Vãú=éÊ4ö“†Ófa¬{ë]VQªZD¹É§MŒ“^xÓÔ‰8þmðÅ»&ʦæQ¸´¹ñvì´‘§dRh¾ÙF•lÇO»»4JüÇ¿¦¡x Dl…H¢¼¾šáµÍÃwÇa¦ßP&ÄßyÜ7N¥³‘†û·ÿUA纻hKÓÖ]¤&ÅQÆ4Ùë9Þoƒ«*ÎÊà:ï ÑDÓ=Q²mïc± ùéé-Öé½ÄøÃÆ’£¼ˆGNÝaÚ ç·—xEƒ ¢Gò/@mtMCØíå`üÌꨴ©™º·:úœ ©³ù ƒiƒz¬³²”ž¢°ãÝú_´ûi´™ós”ÓævŸUeߺðóGhƒ¶t’"BVû ‚œ[Öð4Y›-K 8¹:iÛ7¦‰^’‰«™¹ã£þ¶ok—jô”/›XYiʪØa#lšå4†f6¹µv÷–8ìŸ÷okJ÷#IíH^/àd£„’Ž“½m9YYÙè×Sq.¢²)ï©#ÏÜÔ-‚Mtœ®˜¥•^,  Ýšu4T#ˆJ+*ɉ«ØÅ KêîŨê9¯²ù£M˜iÖªŽw°£ã}{kÁŽº1! ‚ˆ˜¶©ëøw”Åœ‰¤RÏ jnNU¡?éò•%ìœv®«k·`}EiÞV’iYY¾T.[Ϭí 'Å6½oÓ´õƒèûn¹0ôŠ,%î’RŠþ~œè!!)%¸EuÑù nÕ,ŒT“L½NȤ«A.&JÚ—]‚Ó}®š©è:.öf‰‘-i¼Lª\J^{Œ†wÅï©I]¼žß~ê³Tìñ8ë 69qD.s3⪙”„$A’€ž­¼†aÕð.Âî$ýóg¢Œ€¤ÅìnÜÝî½'"­Ù¿´…ðëÜYÃ(ä1?Ÿ*Oò4Lª8ʈÊ?/÷C7qJFOÝQ‘\Ø1Á¿é¶ïKI*/ѦšÈDûMþ­ÎîTþYáv s¡KRÚ|é€ØÑÓí”m3ë×Æ_Kÿ,LäUµ,¬ÙCY;r/s¯½"÷¶¾Usÿ÷\÷=á‹^÷›~Ñî3/ÉŽ1ÇhÓŠdÄß´ÓUÖ5¾b¬~3ù‡­®¦‰Û"¹¤ý¤…wuéFIOxQnû]«¿+¹ížó7^‡ÕÚÒÜô4ecsŸE*eqkoc™¶Äà ÌØ¢ÎP(3Ô]&nnöî,•¶Ç`ñ†éîmÍR(Kë;üF–Aßœ¡­r½ƒÉØ¡.q»˜;«”ééµ]öÞöÚÌÌÌÚ–Ii{>A#(tþÂÊ& …»õîÖÔ@«¢UìúÚ >:…³³¹J[dŒ]`¯-P7v8CKVçÑýÓæéLþ.™ó3Ô=6b‚±³17á Ýv‰FÛÜŸ³¾è·øR(zþ´¹e6€4‹9GY\ÃÎsméÈ~°ºb²¸«2÷v¨óKìCƒ÷=±Vò m]ÊØ\¡ÌÒôµ*vø³µít¿nú˜–œt×ìÖ‰ƒr±áÚ·?;äÊÒ´»–ZIûê6îG§NSŸþÌÂâÚúò"m­sþ dswB¡qÇ#¡óvPÂïÐýêfÐÐý®´ÎQ×Y¤R7è §ÿœ…YÊ&ú uvÍ|„‚h‘2»²ÉÚÛš™_=°ˆ_}cavnÅØFO°¢éÜ> c•±³¾‚Yœß›ŽÚk–²´¹{²Ý©ûvGíEߦ.¬Fð'àæÎ ezv~ Å6–§gi¨q6VhÜ‘®X¬Ï­mѹWÚ”nå™Q‰üÊ÷€Î]§Î)Ñé #É×<üžÔG™÷r朓ЗÇÇ'&kz†ÊئÉ9ÁwNµ×©'qâ› ‡^Îá;<²»NxŸ)&©1´¸¬ùsQFíx”õ¤ã£¹,ç”~‰/}zX÷üa^BBbHQû»ïJÜÜ’’cÃïUÍþy©÷|FLdZqÙëÐ+ ¿ë2ÿ„ÚýR]­2$<6ñ°R³‹Ö¶ÙŸ3ƒù´÷¤¸œézß4ºÌ×N%>3O8G[ ~Ût0öþÞüíG8ò§¾ªÂ]ƒ-¸Þ_þ‚eëüŽÊß|ºÇÎá“O ¯/Ρ8óÛ{,x=)¾:ˆ^ŽÕ&9sýœ¼cùüK àÂ2©ìOYÿèû#‡^`àœ~“˜ùÒïmì¿z}Ø“¹ï&ø/çËÔùÁ‹ß'¼5Çù…Öœ¿-,ù »¶NpÎïþ”Æ ½,ŸÂ>Ÿ÷a¹—)PKlöIé$ûHî|lÜòçl*Nh¡~GÔ·Þ8¿û†áM´~blÃ>Ú¤œf û{ø¾½6ðZßÔan“õÑù´Þˆ“¾sìÿos<‚Ÿ4óâ04¶ìL3'eUŽžÐÅ9á9È‘NY=s¦º}œ-ÕÕÕTÕ´nDäP6˜‚_Ú9ž> Þ|íW<“ªNo!8y y²óž’áôO©9ÁY£ÍÙ –>ÔÙ™‰‰ñ¡žf²°möÚÅÈû(QÃÌÓ2­ª4‚zÁ™;«#ÖWn.nMš™xl ÜõG0…Ï"~ùl±¿$>Ȉ}̾'| {¶4%'ír(~FÕÑgFó£.ëùîžÏ½Ø“¬xhÆËcEקHWÇ‘LŠÃ9åzë“Ó³{ ÖñËÜÛœ¶Ô±š¤Ï©Ø,|Æ„ï¬öÕô¼ 0ðÀ^‰B˜‹7ÝíÛ[*}®Ú›Ù¿nŸl|šçdgeë>¾ RX§ †Üp1³°°uñ®Z@o$6kûaR€‘‰Ù­¸½õ9N·Ÿ¢«½´wN|Ît5f³Aczä)‰¨ÑKÛªNÖ¼žz$NÙÛ˜I ñ´´´¸â|½¦‹7Ϊ»¼ÐÊÂÜåzu䉑¹×Âõ…‰–ö¦†–vî}¶¶ž“›¨ë±ûž_µ³¶°°Ž-|·µ‡¿<¸8îeobi—ò¼§(Dõ8m$.c´AèÎŽ­Õ~îN–fY/ZY‡C”çÉWnÞ«;è·hѼˆÓ†Ý[Yâhcaan~3"kv‹‰Ýi»+Rn[[Y^qòªïÅÇ)Øû%[] XÞ:pÅ…ArªÎ;û^ÇÜÛéÚÆý±·ê£•¹…U@òÃU:2]mâŒNp7­I³O)|ær{m¶«ÔÏ!òÍ‹¼Xû+Övžác«Ø🭅‰P;c »ì·}U÷n=kÄJ»`ö~í7%¬²Ym¢ÅŒ0Ú0Ö¨Ya×Q[Øع½ïæ½²V•®Uøîaü-SC}÷àÌ…Ö6mÈ/î{qøFüt…÷¡qOYûß+â^êÂh‹·ËS «„âŠm|ÑÖl_øM KK{÷ ö©Ul嚣£ÃÛÚÎPï«––6)OZ˜»+¡^â"ýrÁœí†gYö6–VÖö÷+ºqÚÙÙ;¶7Wù^s´4³Ì{݉°6C,É¢bò6·h›¬î7¹&á/Ñ—Þ†¹&´Î•E^ËDª -œ)ø+d{ÔáŠí8m—¹3ŸçkšÑêJ~Y+öØŠÃ^®ósµµ03»ž5¿¹‡pöò£nfµ†¸¼M5UÂhÓµ—–â…:€µ£×ûîn“ÌX›Ž¿åhjb™Zü"1Ø9(§Y|«kîF[GºßHyPû8=ÄÎÚòª_u‹¹·0ââ_Œ¬;?COª1ÎÃ*(ûà{JßZ*Ÿ¡DÈkÁÇ=ræÍ5.Y‡=YZ]yéÿ×ï ïÛÖÖb,µLn¥£Ë#uE *šfg©”¦BE5óY´öJ<Mýgææ¦ÚË´ä„T±ÁƽoJ}èazÖÉÚÙÞa³™Ûè_¤ ÷6`,;ª=Ó˨4ZoÝ[‚$ñÍ“3}IXµ¡glz¸ÃÙL¨fA[cn- Ë IÝë˜A›æLí¿¨;¾‰L×åHJj5ôOѨ£afò‘Oн&»«\Ï}K£ÑFÞ&^¼ ~¿fødÚ0FÔå/Ùß_X^Y™lÖ HR·m}ˆ6ß}‡t5Äh^J|3¼Mi—Ó0˜¥ÎÎξɺnV†zp ‰²u`…Fëo|/+)ù½Ë§RÿŸ¿Ie<«Ÿ¡Ò‡ìŽ¼—ùÑ. mhŠº¹Ã8h )¥òD¦þqêìX€‰ª…?šrÎè\nœXÁ+tBSXªaj«5ÛÈ>²ýÝRríï[FV×VKÜÕÕ=±àI®J×sÞP©ÔÚlŸ… ÷«]ûhsŽ¢µïòÆÖÊÊ m¢ËLY)¯f9 Í^ˆÝe‡€œi*µ¯¹’xI¦gbm¦ÖE¢YÍÈÔ,•êYÌ¿¸mEöXlkÇÃåJ*»Ù‚ôV­¢ˆìÛ†®™‰wC¢‰O)š®éIK¦¿ªAíÒû:SBZub‘ŽìÎ\V3öH ,®Pû›”$„Š:¬Ù‡Â½ÃÓ{öã9mǾI*e¤ÓZQ$ø5 aö‘ —œ"..¯.Ôª#sôþ¦BqÉ+sÛ[h5Ï6à_á ïì Múk/§_\’T£áã17úåå†hì7Ö¦1/Qwš¥ŒyYëµL­­M·È‰Š[ghÔÙwwü•Üцèg$¥lS×Ú7¿J•d¢äú êNùoÿ·_a9•J›é}«(Aè¥n Ì5Oc²åõ Ô_çÉŠüÍ1¶¡–ü$¡9µ‚t™ü(kÑ>5¿¶¾–ã¢l—‚ú‹Îä°XŒ=|lÏÔ‡§Ee ö7úÜj»]FšÔ;µÆ¥©†tÍþN÷Vñ‚Âì&f¢áX9;?ô~¿,’ÿnzvŽ?V=B]$¾rœë_e·•ïÖ)øcðXl³2Ú"EÒšä½°íuYñVîÛžúš7“¹ÇšÌ¿uI¥ {²åÑ)ï¤E6f»/ŠhOn±R̤ÌR«Wææ—‹%E¶˜sb—F¶¸©LœþŧІ9ªF’®ŸXàÚÅD ÛÓb”68mFPÚÈÊ©—µÏ/ñ¾m¸>Ù#C*§/ÌÏ-¯Pn«»„=Ff2ÿ!ªMYÙ|²Ãû¶áxk¨§ ABŒ¬¬fåèÝÐOᦠ›+ ÃýÝ=½ïüå¬o¡IJy²e@!6F—ò<† a·ÂAš²¢0Ú´>p‘Ö ãÖÒr­·F‹3o &4º¸Í½vÅ‹Óf¬5OLDBU •ª¬”„†ÕÍáÅÚàߢLövww6V¿hÀn„iÚ×s+¹ë.¶´½ýìPêÉæï mµ‘³öÞda¿Ö©“}£“cÏ’Ä•õhÛÜõwœUd³[FúŒš<á^D1Œµ¤£ï![¯$…µ(«»ÌÍ+Ò¾ïV—æ_fx“4½ÎYFºir?øš®LÝðÊLo©¸¤ã®@w4ÿŸ~!LPã¾k±Ù§L’Gió:ÜVýZ…2³¾Ïü†â`9Ÿ'ôµù¹¹¹É‘â÷¤I пl›Ìù*ÑDéê3¤¥ìÖ¿}?¹ÎK—S<ôo¿`ΪˆÿüˆŠŸÄöŠ“¶˜ClB}ð³”Öô Ò^hv%ä!·z^x¨;欿=MWd”FhxîÒF[¾e‰c»…tIm~£ÍHœµœ­ßÙZ s3%ÈÈ“äÔ2ÊúÑFÐNJ²¸s’[WO½”œîÔ?xTGcô,úˈ*æ ¼XVj–‰E±º¶áwyoµŒ¤þ@4™[G>dêaÍ=­ŒJÈèMmѯk+J‘UyR&iš.­u’~&N®ìpíVè«pj&…ÒFQ®sœûæණ‰\õÐü!Ú$ÙriƒùÛà´y‹eR£M/,´Iòd²–¡Ëð “6R##*¦¨¢Î=²,Ñ!4™Îü`:·Î@NßÈfìÎÍRÞ…_’PnšE˜Se b Ø{¦8j)Úø YìüЇ‹Ê70l:*8bqÈmî;ʘgrû1Vê|„4Y{½ä rS«¼^Šâ€£}Vx&³›1R}WFN‹²}Û$]³”W7Lκ{ïn¶ºø?"Xx&¥ZÈ{k£û¾µííÒ?@¯,ËÕ\çjÈŽÀ‡«sÃä´l–Ù¼U#H>¯½UÙÒü½&—6£ÈV—6;+C9e˜”ÉêFŽ»{Ãd9ùî .çWmõdëFVfú0ÚÐôÍÞ¹GhC–ïŸÚfí­Û|œ6‹#õ)×Uwýt=³_:ëø§sÛ›•—Hæs뜱†"ETnl³MëÃb›}IÏWG>…4­),2º´ÍuóxcáÅ6Šr'Ò¿„šâµÞ‡›8ù¤¶@_LìaaïíáNE_›+Šw#èo/ É侊9™Æ§@G$k°ámÝèÆÁÓÿ½959É’úét²qd ¯Jƒ¬ä­1Ú°v–lå…cª§4-¹O.ŽÐ†u@›sJKX|ly‡ÛTƽv~\›“ZÒb];\Ú°Ge……ËñÛq6çe~ŒjdÿmN)ö·2Іl‹Å6è¯ÝÕÅÉ™ÙþG ’*ús¼>(º»º\rÃÛ h>F,¶™YÛelÌ›~̘=\«(QåO¢”Óžàs«#Ï1)/„ªãÜLj¹KQVv`z{ÎÃòÌp«­¶\a;µ9?P7³íðñèI>Úú7ió i~îóï?Nnò.9ÝËÈûe}nPQD¨Œûž}õª¾ä!Úš»DŸB›ßñý¯GêR²Íã È~lÓÊm„ø´A3©gPOV{`Ïá™]Ä RíÔšX]OìëÈR·ŽìOª®Ø7j&[+«»&ا¥öÍŒÃÎ3oD|'Ú´6¢È¥Òöz¹Ï?¤Í—Q×`®]3S‘Q·¦­1W¦;„/*öà­Óã@½¿¨;±….BXÚh¿å:‹¼uÜÒQk™‰…¼Äœæ¬üM¤¤vä0mª$t\¹´QW”?-¶Á¾·3ÙF ¸[ÇͤRä.T-çéÈDS®¹;ïÉÚø‡$õ›èæöŠRn©e8’—Œ5Òß- ”ô¤ÍÑo÷_%º]$ê´Ïð¾êP_rIL¡o)¶SÑôÅ‚·Í™.;]iEsoÜHy”ëE ׄGÜõ›³M¢Þã´q’ °†?:íg ”R=1÷uÔ?~+©9Úo£êpðFó«d×KÙ,¶7ÎDV&É"ŸLà}5?ý÷à×Û\Ú„ñics„6ØÝÚ^UÙ1vÈî /„þAhFï=fŒ›öe§<„ÓOúIøq ¿ÝKÅňýóX¿ª‚Ÿ6&ÚĘ’Qdç­èOÊx.¿—ên¢hæƒCígæ߀°äIGhCé{&&lÌ}¿4Ý_Þ6y4Àf¶J]lœÆ^úl,üQˆ<¾¸fg|·‘DzH{ÕÜƉå‘*q!™ üÕî…¡J²q(Ö è«mÀ§M’‰2J›¡Î¨ÿý‹+Ç›—õ.%áöéudgÞHEâF öv0¥ë¥¼È8Åa™Ô)í㱦Ó#u8ß]WÞØÇd‹ãmpKdX‘Â^ôâ¿]¬õ:'ðûn§C_Ñ|ïZÏòÐóŠBoÌ7Išjª†ÆÆ ª—ã ß Ù}c¶šŽ‘‰]à«{ו1ÚÜwÑÖ *büpÿ‡ Zî*ÊÊHãæ"JK‹¨ØRw‘­‰Z;CMc3S- ÝÔ—}¼, 芊–¾…­kçûŸ‰¦(mЈâu^0YJÞØ@?*§TŠl4¹ëqj€²ª†‘þåË–ž]ÌæjÌTd•µôL®e=,tˆßqãmÆêÕmðG¢¬Is#½Þ)î€_gÝFìû±‡¾ŒÖ¿p±Ðþ+™ÄþÿÙ{Ϩ¶¶,]´ß÷þ¹ãõoô½ïöëÑ]]]á'2ˆ,r9çœ1É€0Î0Œm¢1ؘdrÎ9g„„„嬽ßBH Ωª®*ïoøp¤­½×^ñ[sÍ5ç\ÿðyîaóläw>ë~Z°™¥­»³µKpç:ÝØŽñqrpq··±J¾U…XTØER™Âcþf‚ªG96&F&fzºNþçÛH# :ZyxzùE¥±IŽx£ø7ýÈìÚ©ö£Æ‡Qé¸}~áQ¼'U“â]‚vÏýkæ>7xHšjq66tôò ½RS~ϱ]Il?¯—šáñx¼>NÛÉ/¶}žbV»ò­ÂJ y›ÙÚÜÄÓÝ9çYÝ«{ÉæÖî“4a_qÐý*éŒ?S§T´ª=o‹y,RÜY^øôØÂÌÂÖÖÊ;,X½7Yãé7´-Á½´ uÇ'{¹:Õ!ÓœˆágŸW ̶ÆúÏà $¤Ia6öN®6¾±·áû„ó.ÎÎÑN ÁŽƒ+»ü=b¬·­µ÷Ò¨êŽQ|ÙñJïót‚“g|BBÞó§þÞ D>}¡ÕßÑÜÖÑÍÞÆ<ìR>[Õ¥¨½²ÀÙ ïîædmãÚ Ï>§×ýC²ÛѤ>E¸§5€“ÌËQ¡î'wOKsûÇu#¨]7µï­‡…«»gBrF˜QÈ­iR‹·õÛÚ'«¢/æ·J§ùOY¾)erf>ðßö /=ŸtŽü{¥ÒX Þ=•?|¾D‚Z«ˆù<>úQ"ðB ²& ø\.ú*Õ1SWçVvÄ"øéž;ÞŽ9­è=|¡è$a‰‚ â)€Êü±I JØ”‰Éyø;²>d¨Xìp@±€34¼ Å|¡X@[Ô4õ¤Ä—Db.—'£ú68I‘P]7ÈE©µÌ‚B,æñ¨ó:_Zj8o_,–ñâ„ÿŠ…\(©qü»n.j‚žò5õ-‡›ƒ»OÂËM!Ü h[J³Ä;Ò#×j Üo‘V Ê@º”C!Ò X "ë7—Ãå!†ɇn†[‘Ç—øÒH³ eqÛ‡ ¡êDñBU"€km|Ì,Är굢ͅ±…u–P ìh;•ø*hQ*æ!£IVop[‰…|¤¶ÎMâ ‡‡Kc˜ü}ÀÍösHÕ-‘( GüŽ•Ç®õæëÙ¿©møXY`nlѺ¾ NPJe›/,Ke?ïw«ªß{VÖð¾ÂÙÒ$íqÔŒ-wõ¨;%M91Q7+Ž-uÏÛÓ*õQ’™'8,I¿ýã?‚ííGæô/Ûé¨GP™·Ìa IïË_ښݮ\ì ”"F³P~3À*ôRcSSùƒX=‹À-&8(Ýçô'ú(;hòX¡–ž¶Í2”<¥P Ê·+¸L÷þVr–™’VSè}€ò6RR音%V~*j©6 >|x¬›ðÄ»ÛV×5¾x”chB<¨:PîHµ“j{»­èm/åï–jÐå,k{`xó-ú)d"H+3==½==}‹Äà˜Õå¯0<„Óaîlô÷˜\X‡ ûMƒ2Òßah|žó6M€:›ý—n&ñNOGçĦä„Ó-·*$¼,L uw÷öô÷9à¯téújKQð»rpFØF mŠyKÓ£P§íÞ¦ó@øJ×zÅ:þîÈæ(—ÿ7¸cSàŸîpåÔ¨lÚ~Mt—¯uþSð˜ùºw*‘aÀoÊ/ («)È™JE¥ñ'¾ÎÙóWÞ~ÔOü{ðh>Ê6òrÏçûòwŠc'^~ÛÜ$b¦ÜºAæ¡,ù…a,ywàÏYüo; Z&¹}½óõñþ&ÇmâÃkÇ|ÀÿDµ¤Ðv_·ÞŽ= (Á¾;¶Áð¥þ2U{Cå¿õÌlyéþGÛ\‰²¾€À‰R kèô©Ó+LùUéRóÍ?Ú<€÷x6§¦‘#FË1ªÀã«v½>9»º«ŒsŽÇvûœM”’"r|¼csÆõùñ·÷7GŠÇ»e@¸Ðs’ÖEÞÂMvñýݳ?þGòÓ™Œ uËøN¥$ªhŒ¦øëìþÁbkO(O)½yv~Ùð®À§OŽÏ‰¿‚”¨"Ž¨—PõKÛ½ÿ£›}Œà”h¤vÆhl¾|…-·P™$JeŽÏ¥¡„ÔÂQ¥Â€Œ¯Ð]3ù§ŽŽà£)•bZ |ð¡eJ¤X‚86d$xƒ…/Ž{!ËÝ€ ü¢v Ž».á^1óºÜ\°–=(QtN–¾d9ï'=϶|!à-2tÜh¶²L<®òúBE(sÈF3¶ÚSxÖîÞqyOrÌóú†£é‘}dh½îjÿ\|«Œm¾‰l$ÂÂóN*j:Zªži “áºÛ°È C]´µ´t¬òª¡Ñ±ïzú‡‘M؇\‘þ¯?êŒmÀ&óU7Õ ½œic#ãÚw¯MpçTq7K;¡1°Ø|ýwVˆ½ÏµÕU4ÕÔ}žwC‰Ú«þ[JLJ{ë#‘6Z::úxÛ§" l?ß]‘ki„ÓÖÒ‰¸üdONVÞÖTW…žõ/P"Û¼X}|,jÿ¶Ý³Sõíh.&˜hiëX¹Gô,íÁNŽ,J^F¸”®žÙ½²n<‚÷¢õÌjê~÷ƺžù¡là N'Økkiëá ÏêGÅÈþvýã4 •³Æ„€êæºßªC•s5 g• è{l˜]ñüJ$Þgê6¿oª–Ä<É‚Ò·Ã\Ì5Ô5t4O'>žº™`鉰Íö\o°³¹ŽÎØƧ~vxh‘Z‡X=tןþ×Ãî%ä3ÍõÌ™…Χt_ç]3Æ©«á¬Êû7 Ä{Úxg~¨‹VzçÔ54õm|æˆKj§N5#Þói~š>&øÚëk©û$æÒá­]ÉæðO#m-s§ÀÎ9©ÝÎæd›Ÿ½Tj ×÷C(ÛœAØFÂÙ}‘e¨¯«ohù¤¶ŸH•ÿyF¿ðFª†¡õõPÇS***9Í‹ê¸ÞO?ÍHtÚñÐÑœ£°þþéc›o\KAC/Í ÷°sR$”@²®ot%ÅÃðnMß>±¿»l©Þ¼Ä,Ëq«èY„ÆîÝXW‹„‹¥m (.¾hë~gäOãÎEÝ­¦ííÑ×mõµ:×è«m¹*Î!¹'ÆÕ,ñÆØ\CÄííX„ÏoØ«=ï£Óé»Äá´”ìm¸T]ß.az%ƒ^y#Èv¦G8š¤Ýo≕4DOS­ìR¥Î’]ù^ÆáU}– §;´ºC§ï¯ô¾J»U WéÎ×ííÓ÷wÉinZ¯; RˆžäxãÌýÆ–¶˜Q+$Û„•Á¯³Ó˯¤C¥&Ïx˜hv¬ìm TœÑ \†’Û¥>IqúWxè]wã-\3`im²ÌOÝ*tžÂà …µÙnN—ᨠÛÓƒ³›‡!Âa©…â­®Ö³¸!â³aÙ&sd ™éàª{§ &e´§c4EâÍ·Ý1 ‚t‚¥Ú†¦&éMðóÃ7Õlbø3ÿöƒVaÝTŠÍ¶‡g5,wÁÏ…ñY‰4®@Ècôv÷ì"··#µœÓ_î1Ø÷²‹Zuÿ:‡<­£nѼDƒjx~ NUÏËžŒ["kú§ œ'kñ8óMŽŒmxYVIÏvè ÚƬ·•vfd6ü|Zã^UÏÞÞ>(^u64h[†=ÀùÌînø¼¤¥ŠÒ<´Íclƒá¸žü’•îã¾ed%¢çûT°?i¦‰[£K%}w?&ìÍÐú§¢°'M pÏÛر~jèrþ[`×QA3n¤‹ë_E½qÁ[Á›‰](ÛðãÝÌ/Ümw”^Gz§ä/.¯î2¥.*÷<Œ£Š;¶ÖVVVV»ª4ÏÚR@q¬“É¥ÇÊ•ÇØÆ(¼ä½ñêwË[—׈!z?ÍMåTÓðÔ œðfSIFà­ ØúýŠ+! Pr°’2 «`otꮳ¤ ŽâKqµ3#/Ó‘ ÀgM·ü€‹•g›‰RÿŒrô×Ù†TSÿ'Gzy¦ûj¨ BÒ À͉1óÉZ¨º‡³t¡ðÑDñVF¹½‹¼ÍI3GHàèHsJ¸óÊÂ( ‚Õñn¾¯ÀÕ‚5í7v¹Èý ÷sjï–iÃER¶™i¼jh™ÂS¬ák‘F5DôsEŽå“æ…ÕžbÃøÇÒ”pßG[=oñÒ²f¦{»:»šk:ó;b)Û°HÖZ§í¯¯®¬o¬<Š÷·ñÊ9ÍgÕŒ§¥g_n¹t.;%u?»dÿ ýï'c›oÇeˆmúÙ†³Ý­§fJäHíŸ SíµóHöל%ã°‡ gÝ<ô¶„µnˆZ Clch<³.=«°(Ö5¤zžÔ#Ï6͇’jEÉÛýð:/.*¯o {y)¼sTòœ+²3._ÛòlóÙæ±—QlæGÛ\xr'+4ÀC[Û¼°aWðÿùsBÚ%4ݬ˗ïÖöÁl“éhW'ÓÛ˜„WÐêuµ­I<驾é^2ÚS˜‰z €àîjï)£„#l”]+Õã6\4 x¢¨W—áÛ ö¾¸nHðß•€(Ý]wEü %;îæfͳ´{üû%~¨­QÙ ;ÄN+·W‚èm<ÈûÈ9Z 8FïÜËêÈ1¶‘§äkÑøÒµREŽUaóÒlËCûÌ4cë<þ\jÏÈ] %ŸÏ~Ôø©µ½±š`€;`›\1}Í\G+"ëÚ&ÙY™¹…o@FÓ9-‹%ê۵劲ͱ­ƒÉª[FÉ5˜–ÃÙFÌ\°ÖÖ\Ø•ú&¼¹êŸT9 ²)®ºøY/ëA#ÀÌ«q´)6ë…TK¬«Ó±€Æ„²|mnv­lvJÙ&ÎÍ<ù^³œâ¶.§ï -\¶ÕÐh[§—„™ÇWN*$á?Œh'“ËŠÏʆ²èéEk»d)}̶ÇGUŸ!–¸s/ÕTì˜fˆþÙñm®âÞ—a›‡Zâ°riÐDGw‰.Õƒæ'¹e6-Ž–\"Üý$ÕoŒÔüQ;ökØ<ªqV`ï¬!R}¾¦©Iš)V¨™ÁS$šÙû8Û¸%V&~Pí´¦º„¦?Áã|aÑż?jVièd»3kûŠ²M*_Qd=Ê6Ms›ƒÚA·¥wðiŽêZoV¸=opvÈêQúÔ´¡¥®T¶áRÚ?#Á-GÄ×ÑëåÙÆÅаkqûØf8ü:Ç2§“m0(ak½¶ Õƒõ6àƒX{¿+Å[äí¹¾·x ­qX?Ì¿ê¢ã\Û»Ëå%û›û»¶, lƒ×SóŠ¹1O$Ït¾ÑUÃMS+m¹ª0Û“M}’ÌlÒëuþí–e1$&„›èä¿íØØÜ\©Õ?§5¸ÁÜ+WÓ´lYÜÚ\}šìuñ5õ6¢œóЛ¥¤ííɶWúZúsTi¢îì9«O3ÄÍž8£Ó…·~î&Xº]Bئ,@žmÌáµÓµÏŠ> )næÐý4Õ‡¶¹kî•91F ±zö‹†mòVËóLUç ¼»´7ñ\CÓÐò"/æýæ­´‡•ÄmRËã„38ç-ì†ø€Ï·ÜÓÐö[XÝß%ç?x¸‚xE_69d›«ÛL‹èÖ×Þ ’Éä†çYÚNð¹ÀÜù& UͶÉõÕé¾äȼ‰~óøúB×Ósö¹P ¿Hv×µšXÚX™î÷47ºÕ@Y*Ú–lCs×ÖÌ{ßE¤2%ìí¢û¨L:/TÞŒH©•™:`lóknî¹¾ƒw2f?¤¹%•Ã;à‚ý'Y1v‚“gxëŒ4üùÝMs¿*ì³PS`cï5KFz6cÊËÇo¨ûc°»£µ­[%rØúFÿ »(8ÖÍþh•½™±$!ðv£Œïvò‡<™âigooïü~h]zbtw¥“-ôÒø«ÏØÈp¥ •L´ƒÜÝPÓÓÍ|PÞtX¼——êàèštåqd8ÂlG©·‹=”²wtÖ<â”ðÞå_"X[ÛœU#+ ¨üAdxNZ®¾7‰>éuð"G{˜aggçâÛ½„ÚùHz+ïÙ˜š{†¦uö1ãY=¿{Js’S¶ YZê¸í‡øó6\ô°NîIÔ03ÉÁ~ª+€—Ÿåÿ`Î}-3ÆßÞÁÁ7:k Å]åSb†Å£hLæݼaå"[Ì>³õIlxSàæ@°÷ŠØ€7ÇËϧ?A’\RZ°½¥KäôÊ’3Á®YÙdú´ÄͨÏ,Güß9¤‰‹!îöBPÜÕM†Í\oÅ]àž¼Ì7¦Y;…µÖÂ^ ¢gýó«NŽöŽÎnO?§ƒÌ['ÿ5*WѺæ®%Þ8çí”dÁA7Kæ#IJµ{–h f݇AqOêðœ 9:nƒqܴÁ΃ùÌ!1ŸOEv€o÷Ûùšì}îèHjãRŠÊÛQù•árµˆ‚Ï'Ë'ã/c¯UHäkXÙVJöœpvÒ‘Š)œpºÂ¡‡ÅgÜ—>ï¾s‚ÎIÏò®ÄDÙp¹)MWuñL!ðç÷ÍÂØæoŒmà¿ïÞ÷î¹¹µÿ€»·¦ÃÁüGðç¿ØKïßçe'çýëÿymBèqvxþão{£RÀ÷fªº¹9Yî¯ÏÂAx¾7Ç!{i ¶Õá’¦l ŒëÐ@˜–ÃqÐh ‘nmýÕþ ¿$@$á—B×—wFGÈÃÃûsKЀxìN¨ê8œ#þßÕAÏrÑ@î>yvö½ÔÆ6¿@¶0Õ¯TqV'sˆù€cÀ€Æ60`ÀØ 0¶Á€Æ60`ÀØ 0¶Á€Æ60`À€±  0¶Á€Æ60`À€±  0¶Á€Œm0`À€±  0¶Á€Œm0`À€±Í÷ù×_q£Â=ò‰þ},‚÷ƒJ Ê~4D8p4D§Ò0ãǾŠ¯>)Êó§ð$(”ë[+ú¯(¬æ—ÏdùÕÑPÏ&+wBØõc7HÏ#ýÊ:TFÿëÚë0<Æ6Êž'¦loÑÙ¢/wPe=àïÉ»b‰2$ÙYÀÚ=Íe{‹¸µµE¦ì¢· yŒmÚ¾ü£ ê6-ëw’}zd›B¤%‹¨ä-êCÚM‘ÿD|ÎÖ&‘-„Š)ÙÝ&C¯!Êa‹Æ>)wB>scs["íùpZ\ú•Å‡.ìQ·¤C¤2¡7‘HHšÐËdêžäÏÔz‡Ô~Òø$ÈÏ{;ÛpVHÛ|¤¦Ä"™´¥ý-›/ñYkÄPîÀÞ.yk‡)`ïJï’•k“¸ÇáKÄüméHu2¸¨_ílË]ß"18ƒâ7¶D‰l@‹˜4…&‘u,‘·6vyß¡l™*úŠ ðè›; \{qv·wá>£¼Ý%B.iëh{Qv˜ló+û%p\8þã“Ìuþýfã8'ï¾-ùW»W™òw “þE-ˆÁS8qr3n¡‡¹öä§Í’_& O¬éHG ;'Âéßý` §ës_ζÝÖö¹,ÿÐ G-ß’1ô3mm<ÚÇÉØÈÐÄo g`açó~˜%ÊÙ[7SûIÍȃ*wlvó£ðþçÿ¨œZAv˜úZºæ031&dÕŸTm‹ƒÿßÿ를“•ºù²‹ý“~ø”ne²âÇs–¤¯èæ³­7ÿùþïœk²š©Ç—N(o÷ìFÎf·£5\.=Õ3ÿù‡MÌ,LMLÃn¼>¬½£l(m@A>¨Ðw±b: ‡Ífs$èeÅÍFçn5ñàF —Íâpù2IýÌbq„ZÞ¼bdC :œ¨EcÙgÌx" ‡Íâñ¤Ç\2Éóæê3|èm´ ÝŽ9"ôˆXÀå‰hêg0™|4tnCþ+‹óp‰»uîk÷=® ÝFýí(u¥7ß*ú–|)ZEWN!s3-ØøLæ›V62UbÁüûœŸUñã›tÞþ&ÁÜ7ÖÝ°iŽ"Î…»n.6ºfïgס¹.ÞÂ0µ¬ë«VR ¸4úÒÛÉÝÐÈrŽÆC{YÇ­`¿’QˆmÒ,Ãï–'t»÷´Í·yGÓG?H ÙšÅâò…è#<ÆAjÅd²yä!ò«”n êãpøJ³ÈÝ%æÜ*ByRºÌ$ VºCŒ/6tyWô6;0°hIÀÓU–"cðù9u“i ·ŒÝ²ëäGMe¤¥cv©ìëiÊè´fÿh"Áž‡–zÁì¡Ð8ÓUª‰³˜áBÜnr¯¯©Qر-Íá‹x]ÏhºXšùŠóø¼Â\]‹*½´>[«‡÷ØþŠ~>×Uéí¬m@X…¦+$µlªgNjw¦ Ópö~GU˵Ä6ùùb‰j/ž@(›x\®=<6ƒÉF» òÉCÂ…nKÀïp%q¨ónV6N+ Çy¨G!lsa›½±`7W[ 3ïèìm¦K™ù½žGþÅ#ŸKïoÇk¨iØ9{>\?\hŒeÿ¬ï“æäDP9£~¹° îñ¶çT´=ƒ‚#]ÕÔµì ¥óì7¬þ`žšꯧo^Ú³*?>k’½,‚2ùàn”µ;í`„.ôä[ÇÞ•/C~”mÖkNã#˜"P‚2²d+½`–PÜ!aMÔ½j›o'Þÿ€¦¾³Ðé}>%ÖÁ¾vf›8 ôŠÞ¯e›áÁiÅ­ùÑ.)èÉ’ÛÉØ&2·ò¤tÖkj›9l±•PÑðûiÊð´f‡øh:(Û<žfÊ ÎÙœ5ÐÑí‚:£Ã ç=Z‘³òßãŠØú²Û¦­Š_gKrÝqwꥧÆ=Û̶?ºXØð!Û#ìv zEÆ6Ÿo÷©‚‹ÛìðŽµ×ì섃™©¹³‹‹©¡Qòƒ!Ôׄ+½?ºÅA:Ø×ÕÀ"`ŽÉ#œ¶O—(Ï)ýýjË;Bà»<¤-ôîJoÉÛnôJm–¿ï³PrÈ6Bô ›gÐ_+.ÛÜ(ë“0WU~~8@A$„]ãú¹]ù™N8žógÍ'·àÓ{÷ÓϘì°$ìÝs¶%Í™©ë¯Á´< S5òÜBZs½%[  qÅáêNH‰³×Ä[X›Ø5ŽKE楾MÞß×ן¯Ÿ)N#¶ î¥á„ôñ̆&4ÑðH'ªä“MÎÙNì®k[Ç S{“év5Û$Ú™;yFDD„#‹í_¦žToÛxÇ@‚ôŽ“¶vñEžm.¹ÙêÙ8†¤ýiü‡•² qÛ»W3d:Xýpç&É,êR»ÖOêM;0gî­öŸ6Œ„êæª7.¸pæúº±‘ÕI~5vTý)pזǯƸ›d<~‹‘rÇ—dxj˜àUu£Ä@Yí3ÒÒòŒˆ–æ><,þâuKˆ®$fZ€­®Yï<íÈ™™GØf4m‰Ór “¥“x‰¼Ï‡ØÆ]S½háPè)¹ä¥e• §wà5\Ù˜oŸýaZžm ²Vß4w½ u“ÕÁb‹€Ku~Ûœ¿Qò6­Ôuk×…òlóùvWÊ6Èœ73äì´HC Â]qÄi.íòAÍלš_ÒcÝt"ó÷›n«š¸m3á١ꪫMRøÝž Tv×ÇÒÜ»÷îÞ¿Ÿàiew£¨ÛlAÐþÇn?).‡Pñ.7;Ò>­d¯ihÚo }K@‘±üJê´I “HŒy?êxéB„mÈÀ›5S7^…µv-OüŒ¼Ÿ ’%Ÿ:h¤f¸Î˦MT“9ÖùÊRCËLOÍÀ! ’ù—{üž¿xþAqIqˆµ^ Ì6ÀË GiŸ?lÏéæ"пmrÎf/t¯÷@s몽Ùƒ—hmŽ²M‚‰ëùŒ¢¢¢BŸ<›GÏ:?m|bÀ…k½§fäO“€7ØÆÅÆ6ðü“¢§Òt žŽ¯P?Ï6è Ý'/¿(ÈϽw7÷Á=;íá u±å´þyô&eFçehæý]=SŸ]¸1ZJ¸"‘ÛÆ ùdD§¹I¢ œfàµÌÛ‹sÆßí‚F3ÒÚ€]%IéO»Ö ¬¢Žh‰-¥Zbö´•ÚÙ·}ó²nÏÞ²S=Ý6³Í§oBl³‹¸“–z†aŽÆ×{¡”Åòls|ý~RDZ ô+“2Š7°¼‘ðêD½,“؆CêÔW3ÝF&yÁÖ'Üi‰-ÖŽr¶ûò|Snç9XÖi"cy½ Yû2×ÑÒ08>gtƒ¥¨´ÿ×|'Ä÷<ÒïÇ…-î€+#eÚfwwf ¶™PÖK¨=O©Û­Ð¡'*ŒµµN*†7‹$ߤ·èmä#Uõže†œl#FrɈ°4xvÑÓÀ#Êú»L›ôÒaY"üÙ÷::fk p}¦VÏÄs÷+LÆ6@·Oê6´ö}ï”ønæ‹í~Ûðº^ÝüsD²Ü~«y·Hå+cXÿÌÚžÓsNi|~µ|ô»Ý’õÐÖ;>8û ×e¯ƒ|<²/Ei⻧Ɯ­´o¿%"»‡Ït,2sŸå_K³Ä5O‘…{Kj:.$´/I¡ÆÚÎÑo:Ve5)Í1&¦¤{MÖ…Ä«U‰ÙÅ\!òm§ñ|Úý}lA7øþi|bJÏ koòm\DdÕØn{¡YTõtë«èÈè¥ã8è cµûJF<^G?áò½Y¤Ç‘æ›®={/¿ÓõYßÆá˜âl>»íBRâåëÖq-‘öNvâõm$yqìYYÊ•%×® ©K¼ºu5)ùBÒ!#ï1•± t¼Òþðyý¡)…˜ñ =2¯â[aŽ›‰Šé„eîÈ$„¡†‹Wníò”˜_³6FÓ’b/^­?ÖÇ>ņ%t¯®^È,‘îhÓ7/¤?b£7 ÷Üt ªÖ8'o(1¹>ª­ƒÕ9›y·2íLC¢/6Á3 º˜•–*Ÿûø¸Äʾյžg—Š[A9£KÚLUrfçàý}EWoUuËvvÙ{›×/§'Ë¥“Ÿøì}/p罹4ore}O̤e]Hh%ÜÙ¬”{,¡Ô °‹î]¹ùäåìÇW©×1ø ›ø+¹×‹º˜Ôñ‹Id¹‹;ß¹"QjæAœnxQ#·\b®e'Ǿ$~±Ý7>•¦Ý|Ä(T2¢·YfÄ$'Ä^º ïJÌuTÅD_\ ÝΨêØBue¯ŸdTÍ¢4>L0óÎä~ß'Æ+éˆJ´ÈÀ ¢ªLa ð“¼“âÍJ*º¥ÀZvlÈtègîÄt¦ø¨ŠôeŠÞ€Ï9›Ú#÷Î>îKõ¦l$ŸqP4ï¾NAt¤ ¤Ë±¦Û¾ÙŸÑ_VD>Yùà‘.¿ÆäP‚2wÔžø¼,­¼êäz¤RŽ?° þåZÃ.~©Ý´×±WóóàÝ»ÇRQÒµÙ†AÐÒ­^áÿ²Î†áOEuÏC çß~¾Ý¥ŽÙFBßÖU–—(‡ø„ 5ˆQÐ_^ †Þ(âP“mµŒ»×÷ÿ5×-ð÷1Ðæ ­ô¤^Ph¯Ä„¸ˆ¬ò?}!¶¹}û+²$zÿ솙žzba#(g×ῤðX4Ê.û3—Oþ¢cYÝìmÉœe\f¶öYüÿªÑ) )dÒ.ƒü)jC¾nÿÔ ð“ÏÚÚRh/¨Á6È{zÝìW° J猽2eG |×;QŠ£÷ÏU€üÌ©\Þ>ÉuûO÷vP™ëèÛåö$öoæåËUà+Š€ò¹ú¶ÊݩೞÝÇ=z›âRúxaAÅ •:™*f øL>ßÃ~I”±ÍÉË÷ìÿŠéò¯M?,óXÏ_¾¡ ÿl”&á¾}UËEÕeMЪu¶»ùMuÿ/VåîÇêâ–šü5úÂÐó7•LÁ';a{mE]û˜LíˆxÍe…Íóœ_IÈQ_sMaA~á³W ™ ìkŠ4ÑYQѲöË^¿2ÒYX›±=yRøâuå<™‹`úbÓ³·ýb¥ï„ ¥ï;6ä¯m/¿®&­ ¾(ùÀ•(”n{eèIރƮñ²î/*Žö»ºìÅÀ¼¢».}âIqƒ#–£ýÃDi³õÅ5#’_Þ ß{Bv“ >}Š-N¾©–+3 ;O±Ï~Ÿ›Š•ÍG skÆ?· -E4@_˲£# ¯Ži©•'®l^8!g²‹â½@G͸¼9ù{ÖªsU mˆ,¥ŠHùä¸É–~ÉOd $Ó.ò2Ϊé„EÇDEEz9Û«©éÔŽÃ(kµçìo’AŠÆI 3ö¼Ø.ÿÃlÛS}c·±î"]C_ÙÖ$º7 þïAq©%%/0¹|¬/)J#r]z]Hq4S¿YETèˆÄj[èí}!RÝF¹ ¥[i¸ìžT*>þšc•yœÏ¥÷ˆ‘.þ,à«%|ðþáðßÿïàî.¦ùý"Ö»ŠôŒ¼wP…3ë?1ù¼Æ겪í (Ø߬,+m韂­àš”Lö´T–—5vÁóÚ({+£Uåå½³$6iôc;¼Ó·:ÜÑ:E–ïaÔµ~Sº—54\„ÈíZœ¹[ S¾½ðÊx”øǶAL¹F[ýP]Y×9%¹µõƒ²‹ e´­þÝ»:¨ç³>4ì³™L¸Ûöñ]EUí–:PµçÂÀ§²²Ê%"9Âà ññ¼B©û:"”ðÚ… ¸õ}9Tl÷ipÓ| AiEòlou6®‘”Ä»-ÐK+«G—É)ÅöâXuTŠtïC[«í\2æß|“'ÅÎÖÁWd¦)Ô¹Öôô[ûä7&©¹î]EEõâì°³6U7´.}ÏúÔ³²:ÝÕ1 WòîRwïÂ>ks¬ôÍ›Öþi@Vöþæò²·+4îHOóÀŒ‚\×TpÉØ.”uðõc–³ÍyXƒºþ!FÓå¶PÆ¡jÖÍtJœËQÙ=[óýPy‡–/Œ½>gK}Ô'8Þ¯íl'L_Ï´ga`íæ]öÕж¾™û„ô•lµáÿø‡lóîÝŸKíøwD7"6ÑDÃlp™>8æ8g]«ÐGòB“æ9Í.X‹•^³Ëý²HöÚ§‹¤ËÁÐÈœ\÷Öñy4ŠŽÊtG‹¨×°äÁe³7ã“ô‰GØî‹Ä>cÜð&*ðb J'ɯ/ëF¾Doè(¾ø¸4èå]Î972¢5ysSEËle¬Ïr Ì• ù }zöW$’¥®êË!."õ¬;M,PÎ6k ¯¡Z<ŒøÙp6Í õjG_d›øû”†|u¼*!p©Ë#³$¨]µ‡6¥ú¯»Q¶#›ÔùFŸ´{x ++Xšr_ÝN4ÒÇá ÌÎgÜjîž@_Á¦­tô/£)L¿½eyå(Ù &h¥¼„/î­ kÚ'AŠ/Û[à{j¢ “ÑŠ›­ÍÐñ.YD œÊ«Qø›4KÐ;•T° È6™*êZNÎŽŽ&85‹€KtäÝ2¶™îÚ‘Ÿôê^‚–œËçì|Ó‘rHŠR¬mšŽ >!iwøÛ¦ƒnƒ)ÞžªýÙ< –dêrι‘ÐÊb÷ëªèÎP7ƒ »W( }Í3À7&$|lu_´³fi€ë£²¼ìôóž!IñÓƒl¼^€Ä’S8"M âMÔ̧‘:æsX\œõÙŠ0NP?·‚.²Ô!ˆx%‘ÿÙ¶†Ö>k°TÇ<Á_|=‚f{¢1Ç6‡EŸz‚3Œà~å^ zCHˆ”jþÛy<ŒM¾îöœª¡/ œu¼‘Yç"l©J^ìÒÕpB#ìMVåZ^­ƒ–5•×Ïãôϧ}h¡s…€€îSË;ˆЕïeôò+v˜”°ÍZÏ]Yâ|šèõ~¾ñfXôÛ1t¦!OÖÿ„O‡>ȉ3÷Še¢Ó¹Ygº±ÏO¶Ô#ŸÏ¼”žžž‘¢¢n1º½j¨®3 Dî솺èž$ÛÌU==ë "Ôóˆ–xƒª~ùÜ‹¾„`”mÐPWÒ•Ô.´fJt17¶°K¿U02µ,‚ ž[u~>›x1ÎÇ¥Kž6&aå£ûËõ§õÔ8r6c|öÞâxOnV¼±Ž!(‡ ­è»%·\<½¼,ôS`‰hà~´¡{ ‡ß¦g<…HFòâ€m¦ÞE9ǽ‘2mÛ ç\>eN_MU¤vCœpGÊÞTpÙÀÊo¸½¹¹¹<;t9Ô1 뵌m ‚z¼<Ü=<½|¼ôô;ç)0ÛDYøft “Ãën6•ÇwsB´®ÙkàV÷¤I)ÛT¦GXøÅ1¥ÛIÂ(œZñµóŠÝ¥Ú¹½Å6ÏØ’Ñò”ëm‹Ôù:=ëLÜw³ÁÝ*[D›jœ®½BØF(d!¶™àÊÞJÙÆ+úP’lŒ7H½Ñ=8Á@‚ô–^614ôNoèÞaA…ã…hžsˆ¿œµÒ¥¤˜msˆL÷&ã ÂYâoYLMIÙ†@À›¯4÷©áöÅrl³Ë ¤¥.= g”m&ªîY^«“*ÿ·Ö†Ú?¦„¹j:¤°%\œzþ‚tìþl³ÞS¦g`K’±M‚gdí\à ˆmÆÙÆf›÷9çÙfû“&Ì6‚T+ýËïç§ÌÌÌÍ/WÇôelÃW2âØFßz $±É!Û sk¦¯ƒOÊáAs÷B ¾Ø…îI Ö–ëK;˜hßøÀ"vh¶ŽÎddvmG™«?mœz\W) E¹]æ‚‘fï³%7Ú0ômoŸÍåWÞ1Jy‹ü¼l¯ª³Êe¦[hu-CƒC¤À6ñrlãrŸG™ÕW3“±óq¶¹dD‘ÅSRft´ñC[àF]¬¦ë]@²ã…;[Ó9Eg² R§šüÜ6G•²Í¥Î¶qµ‰ü¶©†ØÆ÷üÛ"uÔž ol—û](ªNH{?Kû`_3]™U6 Š)ÛÜ._A¯J ± ¹®™mP3ó­õåÞÆŠ GS»àL²ñIÝZî®Oðw0rbˆyáÚª÷Zd4·‡%Û=d¹íöϳ ‹þË¿ÀlÓѱÍWì5BqIç¼ÁSÆ6š2¶É…ÙF´Wù®G:è$,›Sš- àš»f@ªà¤;áVR,–üJJÛX¸ÇÊï*¤A¼nh½ÆŠ°×«ž¥?O38_v°’Jý ²’"–]V5÷ØFn)½­¤–©`óUg÷ËïÐ;䥾i¢˜¶­&^ Â÷ñ(ËgŽ¬&dZâÏ° Šå’ çŒÜ\òÞŸU!@#<Ûý¾MºäÙ{¥«ãÅã]4:æP§Ipn´Æ‘g?a´^ª.Ø¿_'›K…äK=íI2ÿqŒ{âG´JÅÎ[j%J£Ì5<ô”¡o¸KaŸa›\I4Ç©”ª}µ…®¤ŽÊ6òZbÒX«º¦ù e›{bî„ÑYý-$X,g¡ôìOš½Ë»ÇØÆMžmÐBA+hÑ1cz㳆ÎDRò½NmU½]!uÉ9<<Ù˽wyGL]vuòŒ‹îY¢‚|ŠA?:§eû‹V¾Þ€›%R¶añ*¦“HGä±™þáJJÈ\©­ë9èuS†?©«ß}äJky×áŒF?™]{Á$æQ ziocfd^DïNäë„ÁLbJå ¿ngÊÃü§wv0ªùº‘éºÚÏÑËYÓÒĵ.À+©­ùv•Ÿ¬Ñ0y£å7 .ׂâÝhO‚•“{jZz »eä=xè5æi©jE'gDù{§%ÚšÃj–Š4×;]Ÿ‘mÞ\Žúᬚ“›»ÀØm6Ðñ4ÕÐŒz9Ó‡`æu#™›¶úZ®щážÁ?š£{©ûqfç^a©‰—3"µ -‰\þ…ƒ_dZbŒ¹¡a^ 4ZÚl“¸„ø_7#ÜQ¹Óò™X­ºsg¾É‚ØfYEÍxte› mõ²^ŠÜ6<<¸ªn…ám [+ccóŠ؉œ3ûÑP盞’`n¨“öV´ŽÖÜ506L¼áeoj¸A’¦k«w|bd“'=-M-müƒ½Üìõpñ÷ßÃ:“¦Gš:FI—³=\n”¦z¨ëY¥_N ð¶6S?"Û||úÃiU/_??_W';C=Ýôb˜FVß…þls*o¦¯>!0îrr”wfÕ³‹&ö^‘£ ÉÅ`}×äV”m^dÙâKðgmV ç„Ž$«æ?Ÿ]ÞlUýFï"úHIª‹¹“_ffº½‘NÐõDˆà$;žÒ#lÂ=ŽuÞZ÷Œ±3‰-yd;5{ïÔó.&EøªªF î¹Rø›s; ?ÌgèZ;IzâO€c—ÓoüÎ:ÞEÔ‚Ž½WHFZŠ³-Þ'1W wƒŒ-½ÓÒ Nimãq~‡r¶§œÍô]‚c“χ›½êƒ[“GêÀýþGßèž©U‚‘vÙðUÊâ¶6‡¿ÉVç;–m ?u·ý,#Šá™LÄéèèDÖ¶ —µÓÖÚ‡Štâb÷*æð&ºêë>´LÊl?Hócõu§6ƒ…>FÈ|·95Ð7O=¹±€Í¹‰æO-Ÿ¤hùÔÞÍB–ØD8©]#s2ݸÜÒð±slc£ógëkðu±XÀgt·46w»]8³E¢8ÑûÚš>Ö7ÍmîÉvÀ—F»>Ö5®î°§‡»Ç—öå3ÁÙZjíê…ÃÑ ÙmíÝt²ðs»;Û‰»<ÅeüiyªõSs{wÿ6 vFta‘»Z?Ö7N"‘ÐýVêêtS}ݧÎ&¢zå1ÈMSòrù¡qÈêmnjüÔÚµ²ÍuÁEÜ#5¾¯ß€³c]ƒÓ¨•°>×ß=J<Ò®Ëåyˆ‡µ„ÝÛÒƈ¹tRS׌¬f憻ëêêQYBÚyfzÛ»'¥{ßã=m}³bøTn_gËú®xª¿­®©‚š²×šÛz¹p?ö6g›ššV÷8+ƒãkp³27GÚ–áwH¸C]-uëûÆeïè„®tôOðÑ–ƒ+~§êX Ÿ–ÉLYfV'{šÚw¹ü»^fÏç¿nQ©àØÆ6ßþ¼Žþ‰*5ìWf­'ÛŸi|žjç•7¢hßWWåjã‚¢M˜rë³.õA'Ï5šáÝ™¹êªÏCd„ßgehÝ·÷±ÆG 8‹ =1x‚u߉¯Vê«J}”¬ße/PfÝ*õ4?pËSn»¨ôÔ?e™îÉÏ[Ai@YúwKèüìÓòaCʽåŸÔ?1¿Pÿ€Â)$_˜¡Nºs¨ú^Íô¶’ê:á pBšÀ7fïk~úâ•Ãë|ª»g:ã“`ør%!±%G^{%>ü‚úå’n¥[ÚØÛZ™'å–ŠþtõŽœ<Å[eeblg‰wÌÞaòÑyi¡!`måèdïàÞ½)>!4Áßèä)?‚žKÔõ=žèk-…Ug+a^öŽŽÖÖv-K'’?zFËËÁÊÊ_ó¨¨>5ÕÀ¯Kç¿üðöØñ (¯øÚ‚@¯¯Çç[øà= H„ÐÃBág%šÏM&'Œ©X!‚S—æíðàLä*z ç¡/ÞŸ}Õ©dŽ>"ÿ|þ¬áã[uÇÎVJ ’ÃÂ~©WËV¸€D7‹H ~Þ/úÏ××Í?àà/ ÷õoñß/ÌÿÖÆ#QÊ I¤m¾è+ ‰X°EÚ‘ü&¾ýÜj¥^zb±p›Hd ÅÛÄ-®díS¶w¹ 'Ob*…Ĉ¥A D,âE$’?HN¼C"±øü2‰%Ÿ=†œN%r…â?±—þŸÏñþ;ëþX5~å’— Nô支ež‚sÍÜÂiœ$<¢Q¶®E<ÈSÔôaŽvPÖžÊ"F|6ˆ»=÷Òö“8Eé^l«l_Ø’×°h+¶%‹TuývXvÓÃ5µE¦õE&{¡£+ûà1¥0Œí7Æž[»òQqè>8ݪÉñ`sÃÒ‰µ£9QˆÓN6=ñ¹ñü?q þºG"Rwö¤A~Äš±=ñX”ím =ú@‚îË0÷iäm #uš„ŸÝe@bþ6eWÄXÕ3°ÙBt?€xo~šÉÉT¢lÆt…'Eœ}|/€½A‰`‡Fƒۥɔ¾=X^DÛ¡ò$%à@1 9TÊöÎz²ê'ʧQáŒr…¨Ÿ( ä1i > â’É$Ú¬ ¹¯cœ½^ìp¤#MßÛ&oï39höøì½]¦@ÈeH¤]:¼+â0ŸgÆ>kا3¡—ïS)|xIÂÍðökgƒY!ácB°$ÛžØ,â³ ×3:%»~CKˆ¿‡X°»CE*Ap õ~ù³¶#‰Æ¦Q¶);{èÊs´æjÕÄöhÅ¥÷Óë ª¸䙓ÏÜ‡Ê -£=È@ûN7 ›E1üÊ6¼E#›0ô€c€±fmã®v掞ÉèI=oÒõL!A~¦æVÏÛà nmÉ20³8ÉIÏ)¶O҇ؖm„÷“½m\‚ýÜM nu£ðÄ©‚®¦ƒ·¿…kVÅ먂Ú‚¾M,<Ú9#V‡›É±ç/^ q·ðŽ»Ï@Öæ^[ýý‚¢†„Úéfkaçäl®»Z·€Üåhkg¯OS§ÈÄÛg©íŽmÌó›ñ~W®\&˜›¾™Ø¦O·ÚâuðfÎ×>Œ@)}*¹ci¬äcˆ³xÝkP»^„ÙD<‰¾š•l`Jx7²¹Q{ßØHÏÉ/$¯¬ zM€úÏí³€Ï(­éK¸o?vCég9˜äù:Ù{¸ôMݺ7Ù °‡² ÀÞ»ãmjbíçA0´ðžÛF¶8È/OiZ%û8º{èÇe—@Ùí}÷†ÆvÕ–ï°ÅŒµI}ýî-Ù¦'ÓWßû!3âÛKêÖ!4îw¯Ãß.xÔyUï„m$ôCËá- *XÏ5õ¹_K‰(iÛ×^ŸþÉ µ€[ý˜«i`CdJø{+f?$½D¬æ+l3¶-™­N9‡C Vú†jØÅAŸoú¨Ýic&ˆ§Kÿø›Óu“‚ÙsA°ÁÑÓ8›U‰^$Ü°ÕÓ˜Ü`‹ùœÑ¡a™Ù <¸$¬x'|`vœOÑç¸ Àǹâ½sP=Hi²­QØSH.Xè¸}æ¬v/baåÓ£S®PYÁ„èìЕýÍ ] ãNDúàow¨zÐ$`竘Ÿ4,©ˆuÑÐm7Ý`è0/ÉéÔÊH<72¸Ï(.ŒDÅ×ýUu,·§Þe9á¼@+#˜m–¤ùÿ ôâ$çû(ÛüûïÕžuÂù¼Á]³eŠP~y(â±G†GŠ[ƒŒù‘ée‘ô$¾Y³³ºÃ4 k‹áoŸmô -7ÅwY§Î^ºS4‰-Ân³^º.AÕê?|¨ëh{…?§Û½Bî-iª[-¢ÆnÛLPø·] žwJ¥á˜ÑYC*oÝYEmšÌDgäg¡Új'ØF×p‰æ O‚Aß"MNú’+.m qº˜(]Ã1öv9×v=ßÖäÇš ó3êoV¸=%!F^y¨©%I 1Øóo†VêˆÕG¢â«àg(בF+uum÷…û²•ÔtGuJltDD„¯³5.©e›5íÖi=1[UµMçˆ,ðP+¦Ä踱Ó5‹SåÛX¿Åð7É6”£²ÍrûúÐû°/S}-¼w:E(~æ¥alæéííåååééÓ¿¾±†ž;zV¦”m¶¹­ .TŒ›+UMsÊünž*õËyÕâþ»q¶Ñ3ž^GÖGÙæ,ê’Å9•wt9±`ßG[õá¬Ô}g²NO×d³ Îí¡ÛdȳÍTk>ÎÐÂ.oW×7óìîâ cÿçÀÛ¨Ûɳ͡–XQ¡-*Îv°=ßpðöúz¦Tþ¾Ÿ½Áð k¡­HEÛìþ놉éÙÙú‰e(Ûü¤å°‰žPÏ:`›ã ûãZb¹`¶O=U^t¬`ýÃߨl£¢ï³ ð·WpZ¦k‚] ñ$ùjš“iìýºñ»þº~é2ŸÇ„?òåNæEÙfœ"ªŒ2¶»R'˜´*•³ºxÏOýÔä/O=|?ñuls8Ë‹èdãS9-d·]PõèV‰—å¬òR)w¥ýŽ–^ ñLĹ>8Î6—`·Íõá5ﻲâ£fB3—ßhá[†çÖVgÒñ~Wa¯ðW„ÐÛåëëŸ^ÔÆë?þ0Á§ÎœÂÀƒ7¬­£?µ&e7k\ïM°·}çúõéy%±èMv”‰½ßÐôR_Ó+5]?h¹2\}WßЮgjee~4Ì\;¹ VþÌ·^ÕtÊ•²Í蛟ŒÓ 7Ã3g¶öE,²/^#éeÏêÊJóë³F¾;"°ó™¿¾ÏStÞ ÃÔ³9ן—{çö{ål<„œÝÒǹ7ï>hßj¸GxP3!ao_Ï}ÃG4Ã÷î= í¡ÑÕ˜ÅOrW©l!ƒggP± 8ó‹ÙƒÍ•·¡ù p‘ŒŽIáÜ`óý{·ïÜÉýØ;ƒ*^( Ÿî>Gƒ>{›Ã×Á‚wmðvNæýjÄͶVZ˜{ûÖÍûùÅ+H:Ëýoî¿êC‡/c¡æÖ“z”ÎÒÐíëW‹k _Í\P`Ø0¯ïý㺅æ·Å·oÝzVÕ‡5Ø%…¹ë;\1‡Võìþõ[¹¯ëúèŒýgo¿¨é™C9w ÷Ùˆ{áæíG”}¾œÉ$+’Âí,Zˆ l³ÞTìí¹ˆP; w5Mܶ¿óC¤1üÍR²9ò¨½ªäømòîƒGeU8g] LvV¬í¢"A†õÙ*ÙZàðn8 Éᱬ¬ žS‡bÁ€¾TrôÉH$Gü&%Ê•ºFŠvÃÇjM"QæÀz44“B¾O‡•0"VîANWXhÌÅbV‚'þ|Ñ4ˆÙÛ`ø;&$ðDÇÇ#vÈÇxC]êkcb@pö°01òM¼µÄ PÊn¨>T"ä­nì€Ç}±¿Ò–XégeÇ8+;›Háˆ1@¹–ø¸×”òJ8 j§„Ä5ÃH©×‰´#…ìnlîÀÛXÝo2Ý.<‘(¦ŒÃ_º»á):;ÿòèCWôAÔÒD¯ûÀª¨’]QþTW€|¤÷tHú.8]ñüPEBaíSE`k( NGǤ"lnþÅlbU‡ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ 0`À€ ÿÿFÁ(ÀÁÜ endstream endobj 909 0 obj << /Type /ObjStm /N 100 /First 928 /Length 2052 /Filter /FlateDecode >> stream xÚ½ZQo7~ׯàc[À\9’£@š"wZ´Hr@ï #°M¢Ö– Iîõþý}C)Š¥•£õz/ñ©!9üøÍpH¦86ÎbC”ñ%ã™ð-†½–Å~+”ŒDýf#E¿Á¤€/t²¾ÁsqR¼vÄ5ÑϪ"†¥œ¡(§‚‡ Ã4—LF ’<*|‚ ú ºÉ…'% ¦ä‚šl¼ó*¢³ñä `\ï s4>¸A ° B†]ŒVѡ爩Æ"“ÂèP&¡œÔœˆš\k œ“ èPÁ(°cZÂ&À X¼ƒœ ` ܤ$(Gü))˜ j‰Z“MH OF«œÐÓŠ{I BÔšh˜´&'¬†.CÎ"Ð@Kö W‚aH Ǩ5h•3-b8;Ð<­R<Œ…¥r&ºõ¢yuH’ÀìRLô€UÙÄ°þ1šÈ€ž¡©0«D`$~MóôZ)KÕC/ 9ï°°PAèä8MPA¬RŲ+l@2Ž:h%6Bb%žÚŽˆdíÓ•”µ-ÖH²rÅJ²$H0c€2‰¢ZŠÉ'_TIÌÚ38’b®’˜$^ÇS’ÄÚK†TÔ&¥Ú覔«ž7){1Ð}*u ™]V À,ü¨u`x¤s‹Édv0—ñeÃdÎU+˜Õ_¸”¥âÌ ³8=4/法9=5Í Ì7Rg^iA¹”7ðRY­…ï¿Ÿ4¿ýrù{{µnõòFÍ(yû㯋ùÕëveÎLóë/Ló¦ýk¥jÚçæ|õÍo[( rÒ<‡ílµ„ãGífÒ¼j—ó»ÅU»¬± Výܾ›^ü0ÿËœ9T(ÝSñçîb¶ði·Ö{6›ÍÑÕY6j“²^¿{CW½IóÃ|ñ®]Ô>Ýyóæeó¬Â¹Z9ž± Ök l½²˜UöGK.AïõÝå }6?Mg4ÏNOëͳ«Õt>k^7ÿ|õRÿ}óqµºý[Ó´3ûŸéÓ[/>4Zj^‚ÅÉ-°k—Ë·Wó››»ÙôêB»øv3=‘uˆÀä½õ ŠÍ …`)ú¯jùæL·J§ßþõo¸ü#Ù fÍÏÔCP‘hhpL[‹e¿§÷tv#¼»°ÖDIw-7 ×}ép±f ×ýÚBÝ ×߸ùʸ¿Y}S—ÿ0Ÿ¨>ñ‰2(®ƒ$ë齈õºé¤dKV ŸUÔ^›æïó7sƒUúfÙV6Y¶T¾5PùÑ–`#¶#c—²š6„RÐ?6O²Ž‡ ¹»ül æ1¢1‘àOš x«h8g©ò1ØX¸1~í4õÅð³—ÔçÀíù$×7Á‘v(>$ûáNÖ1¥>K®…ÍmÒhn$6è{-Y‰9£³õq7z=ð¢QÌ¡ìqþl©³‡¯oŽW;°7‘·úòË‚“:Q}‚+ñÑï•ðÜ×3øx ÜQ:˜RÔ³A’p\‘± ;ÊQEÂDBÿϳÜúA?ã¨1v5†áŽº¹ô¬/úcúgXSNÀĨob©XÂÎ,ðöá+?GmÞÈÑêÿ³ðÉ"‹>KÜÏ9¹ã‘{:D䱧$’mtÒC1˸ôð BN|—˜âzóÀiPèËøþ’y0 endstream endobj 1071 0 obj << /Length 987 /Filter /FlateDecode >> stream xÚ­V[oÛ6~÷¯à£Ä,ï¤òØv V @—ºØCR´MÙÂtñ$¥YþýŽDÊ–äÌK»Á><"¿ïÜxÚ!‚noW‹7¸B NSh•"Í‹„£ÕÝE_ëlc[/™6Ñ×ÆÕ^ºy̶.^R]yÅ­Ëmœ_pÌ0¿­>.~Y-þ\P¸Œ ê ¬‰F›bq÷ -è?"‚ybÐS¿«@BøÏÑ—Åo €’1`1L &\{ÀU™??4mS9[ô †ÓÀ5•s-àKð“m7{€/ Øðÿ»ù#Š®m¼¢ÝÛÖK{3}©Œœ×¬ ÇjpDãŠuî¶áÓóp<ì|¶^vå.+žp\¤Kªq™Ç[V¯¤)¬Ø9MhŠ9M~¤)Îh ¸6|øŠ9_øò¯ñG¾KÎXô{,H”å¹ß´]œ@ÎÀ‰@KÉE5ø‰âD*Ox—ÐËþ; ÑS÷‰•ÖvwÑ×èRêÿJ¥´®ŠA²»Â•ms™J@ä©ðcêün05ÿ™HèO1BË€aýÓcÞf‡<Ø¿'„W1“ÑS(ÜC›Ue¶±åpyPTÅRo{®«êPâ¿lf¯ƒOº_½C^¸½™¶1e°¢)ÀEºØÊ4$¤–Çv6±a(CÒ@¦ê‹6â,PÔýšÚ¹ftK'éø–N/4‡¥ vk‡Ò Ï{ï¤+† $‹¡+b0ëV]Ò¼zºn«‡MžA8ÁÝŠ€—›Ö®ó¬ÙCà»ð,2M¦gà…ùîêó3A3´÷Ðó^e²ðáÜÒ¸^"1¤à{óãñ;ˢ΂ÖúG²hˆIÕB ¤âX éݱœ­k]]d¥íê#ÔJÚQ‡HÒ‘£°"Ç·b²y¯ÓX&tØ»uWn›éz|ðuÕV›*¿žôœ®Qk¬å¬Æï“Ó}wK ûÐÕéP´«wŸ½`‡â.K·9Ñ{ ¯Ê©üÇlüÉ´uõÄH»‡7"œïšœ}:PÛ[ßøði°a†cÙG‰iðJTÿn0 ugXÓ7¿ Aï«‹a30pqƒ˜ ˜ŠäµN0*ªÀÁA<Üøå=‘$¶œW|}ÿ6Ð+¿òQaâCX‚´>íh`ð«{v–'>ÅàSç²r®¨mÚõihØlãU}ßïJÈ«$¼Ù!o×@,LJp[sLØiRàNŸÀùÌ)´¦Wœ/ÎÄæYezØZ€ÑÇ'òÝÞÚa:0Þ(o¦Óóíc\fHÿXˆàq endstream endobj 1067 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 370 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22792 /Filter /FlateDecode >> stream xÚì½eX[›¨}þ|ççœßœïºæ:3gf^™Ù{¿{GÑFšÆÝÝÝ  ’@pwBq#J w î.í]ë«ên ±ìd¿ä Ͻ×&MuUuõSkÝõ¬UBÀÃ0‡cƒü«EJ&nê–^P @9ŠÅÊGD^wdxè„æàî[6T¹ž  ”£WRªiž)ãccÁ6®ÞAI+õ (G°d5"ÿì²äÄøC³Mf=Êü ”#WÀ6P @ù¶¶9ˆAc° ”#[Žf×iGcÇmã›ùâBäùÙÙÙÉ B8`(G¶Ä¼»øôã‘*1ÏG3ê9‚AÈnBîIeeÈ!!!Á\‚‚‚"##i4ä6P |•¬&þÍ´¤Ž“CÌ=›¨â#Rì.ÞT² ¾ðxxGnãžôH^V&<<éÝ|â«Æºê Ö1)~Àâ¹h~?GÍmâðzU8@L,èÄ÷a‰ôz,§ {³ ƒ·8–ÕÂí#ºÒÍ[“ÝLÍ"6ËäíúAb×ãÓÓë89(¿¹^z6ØFÐ$M¨°ø^""öK~/"Â{{R¸m® Î¥5 · %èÁLf=;2§PNVš$N’Ó÷ ¶|éÚ ²e<näj$*¥w1£ å´#{c5ãŒÎ¼FÈm>kT$·“¥#y<Ϲm!«ãéï)©ì˜ÒÀ7>=õu»wV}×6ÉíyMܽӈRÓC…(Ö±å,þ~¬GÉÏšô ´ÄI2jöI܀…e\•“¥ˆ“Èj)±• |Îôê%_ ’¸˜¤†SBl9#³Žpé²´´$¾¬¢iÐ…—kÙµÃb'\òð]|>§XN–,.!-gtþåJVòó‘7 ¿oco#)A¢èøļcüCŒì„m6ÇÖðö›ÝDü$²ÇF”Vœ/¥žÕºë]®™s;‰ªB\%;ó¿_ÕDhá :ߧmdL/^B×ú‰1¼´oØæá|ü­§"¢Fá¯Rª—³¯ŠÊy%V‘dœ“›Ñ•¦!Ey²„Š[L5Ê}?£¦*Y¶–Y÷q°ûæ•Ã6Óü‰µëz*þxÍÌØ8ò*Lv˦m0âª6 ÕOf«£šª‘Œ2S«–_v˜¸^¼ôÅ]I'[E½˜N©Z °’ÔH~¢r¯Êº\ɬ]L®š?›àue0éIµ”¦k\Å >[xfUL]nø¬ÙýÚJÚÍ Q ýó¥)ÕËç£}…ålâëPp¸¶„nÈåòÕŒ&†›’î¹ÊÜt4mCØ»´1ƒÓo;„¦y¤¼MÇoÇ-¬Í¤ä,ž¦âniA¡Ù÷CÓÝ“ßà9jFբDžËd19 ŸØÈJ”‰‡îu[D¦Ó…› ÕX¯—úcÛæF¡¨ˆEQŠ¢€IIIýóo²›8¸m‚/Ÿ<'øújÑEJy;*+$äù‚­//åú¥–ÜÓð³44ò¼¿œRúF–b–T‡§CúãÙ&£fÅHUH;f„˜ã³Õ°£…vø؇­Q÷Û‚ÓŠ¤¥ÄM/Ôg6m¬°Žád§+mx1òá`Bù:ž e7s ”|ŠbžÇ<J|^&qBöÒzLq©˜´_I_lÙ\zžP¡äÒ’rΙ —_L¥ÖGáÌšQÜ6g®¯xZëÉ»¤§ý/tµcDæ¸XÈKjp¸¾Iä[bøºEÄ9¨8ßÂí—yDs,«nÍTOSZÛÞ&8Q[GMÎ.;½zÞÄBWRÖÊ5½<½ãd«CR4³:§¥­&i”–ÕJ÷9ï/*ªdœué=J*Ê:)fègáè$D2ˆ,ç­ýØã6d¿˜W#±/bŸã¥/¾|%»‘MئtÅ'Ø[ãbMq†¥•Oªþf÷ñ´Pñ­ 8ïªÚzÙW-øCäeWY× ‘?žÛÔQ­-åìá®ØÌmðù(§9:[ÉšúÛøÅXúDÛç„ÜÊlæÅKír@\¶¾µ³¬œ¬Ö™<¼_lª¡B1p5=iz&‚(Þq—ßÑ2êYŠ^š9{©j¨J)Ù…?]ÎúÀ‰}PoíyVCOO’¢ë]2[ǵMÑ‚ŽºOA:w¬8¿{UMädà“Õàp³ U„qÛÄ;©:ß>¶AioGåH'œîÃe9¬ð›}ø~ñ?ïCщ#zRuÔЫÒÛˆq³œšQ2I4àÊ{wŸ$j”PÍάž×R6͘Ç{Wû—Ÿ½¬yAFÓžÛì?nüx)$:RÚýá•bæ”׃äS¤€j””›FVq2ÔÒõyÎJ¹ûDQÓÏLKËùêHf‚ëÿ m°sÑÑ¢Rêß±²ˆ_‰Ä#þöCEïÔF¢'e˜Þ[ØÁ&ÛŽóuì¤ò\SD§¦zZQ\̵høŒ•ªr`inÊm#žá–ùx8mZÍ*ž¨ä¶"|æ  žjîW³>0RjØødqs› éçôžf·Õžž+–O¹ÅU¤· âí‡e¹S¤³UxOÊ[F;&³Å?x&¡d“ØD¼{!7GTD„°Íë»â" Õœ¬ÚE]u íÐ&ü]<žŠ+C-mŒ×ý¨÷Ia¼ Ø~áÿjÍ\%‹{ /«QàŠ¾Æ¥¸sfñ‡À6Ÿ6ËjÚž òvA÷”hÓ®h7죚ayÞ™VbÁ†SZ»Vµm¶ÍýÛÀ? »9eÛüÛw=¯‹Ç»P‡xýrÁÃA¯šÑ7У¨é;ªiiÈÛed¶ ˆ”4¡ã§TâÞM«(H*{ê[Zød*É“äM#Rªºeý¤¨mê}Ÿ“r÷YRJÍÂKφ$©áûpîÊ„î\Ø7Gm¤_¸Õ”ÿ.ôVo×½9ÌÈâšs%ÝéPzùdpAyÈ­A<-L~ÖTØò%>ëʯŽ«D¸É«gB®V_­K¨Á²°¯{‡Ø ”¦'•±‘ŽòËæý;ü_¹Yïu=ÿuÆæÄ«û—…Ü ° Ü• ¶l¶l¶Û@Û€mÀ6P €mÀ6P €mÀ6`(PÀ6`(PÀ6`¨PÀ6`° (`° (?€mŽHÉÛ@òml3f|6»d˜øû‡]º¸åÐ?÷ZòÊ| ¶åm“ðv椼¡ªÃy%›s‡\”íBÕœ"ÿsUlCÄÔm.–Ž‚m @9ä’T±ðfúðKüÛiÜußä£Ëçwá0mãæ”\±  ”£Y²›Gòãñ•ƒûùû—žMn–˜Ó1/f ™2ûjvú‘-øÞ·‰(¤¥Á6/_¾ ˆä• —¢ É9Yy(?|¡ÈÊ“eäUÕe(£[DÅI>>>¡m0 Û=ñæÍ›çÎ à(Kæ s›Ý”””CðàÈjlØ°Íƹv횟Ÿ_G•°°°CÈm8‹ÅêéééŽ*}}}„#ÎÄÄÄ~g‘ú,G Po†J8á€s8„Äft B08p®_GÉÉÛp๼<ú§ÛpàÂùÿƒ(ÕÕ __¾m!TVÃd¢Ÿ~âÛæ_ÿÍÍmŸøŠ¶Fÿëñmó?ÿ't¦8(JJøªá•óçùøº¸¸ þgôÿ/ú·Cý+’Ûðõ»Q›V™žF}}ü×Ä€ƒ¢½?b÷/p ttÀø0‡AWª¬„0¶l¶lØàééAååÃ6ïÞAÛ¶ÛðÝÑÛ ¶à0èïGoÞ@8 Û¼} alØlÀwÇÀzýÂÀÁ‚ahp½z‘àÀÛ|_úç=…Ûc"öûO¨ßšžiÿ{QÚÞÏÜ9ØÁGÛÚÎ=êØøŠÂaP×—7YY¡3ÙŸ]Éñ¹0}•Jgý^óÁ6͆¥Øbgm+¸Ë«këúç…—Ã^YYes>9;Æýoë¿Ø4¼e8ŒõÕuÚ£°Í÷˜Ûp$†Ë*(ÈËÿ‹‰ˆh[zÖ®nÔÃGhl·ˆj¯ØF]­Ý¬»;ò%ÁCùû[™³«Œ eseØ!Í‘%%Y<¶xt)Ò"²~ h;BµW ç½Ç^Òбêgï—¡å©¡WuíÛ÷¶i!Á×{îÓõÁ*;]E‹L rà •Så©ná¿ùû­H )]Ÿ5~eäÐiT*•Æâl’ñZËaáÓè oþÊ ý³Y¼:ʤÓðÔˆÛ0±$¾ ×"Ä_*œs#SºÇ晜5al|†ÿÇá.Kg°ÙØ–û,š‰’ôÏñ[îÖ?V\Ë ›Å$‚Kg&<,}#nˆ½4 IÑéœeq÷‡º¾ÎæýÉGî.À$^âÑc³[Þ\O¿Ïf29el|E &þšÃ 1mÊÞøˆÅ±áéÕMá,¶©“U.d&é{ÄüPÑÇmóò%´ðïÍ6*¦Þ+Ü:Š×qúT·I½}?žR .¸«iêèjYž í[$æ /…:éÉ«hÈk_+mÀ+gE†Ï6ìÙfSe•7½ó1dFjijšêk;†Î¯38«ó1þV""’Æú&eó›M‹¶Q¹ònx¹6d«£R5´øÃå6‹f"â7Z†6û’Õ±ÆR6™¸>æz«ôÔ´ Œä4âo”1 p><¿j¨JQS’3t9?²BçlÙU]‹2òNYÇ_­tøÛ›™™ëiiE½'ö®PCMNICßÿ|ü ‡Ÿ³Ìõ–©zpE¥ÉZn©ìmºç£ï[±Ù £®ÌϬ¶ÞÔqÛmUSïµß—ûß‹’õ‡VÑx]¶š®7;1ÚXÑ.ºQ|ÞÐ3—¨¨Œöb µþyN%n›ì*ÄœrVzÔ‹¿ÕW+.g>Â$|’ì¦txE)!¤9¹†7*w\™h|Ë#•Mû96ºuÞPÿܽN5„mLEÄo¶lþ~Ï[UÕ¯‘džZþ‘›¨´(o_^o“>Ey3Ã[Œ‰ÓÅ;ˆ:„Û¦{ªÈ§ÈéLQñ™—<5d\ãïË-}Ô&ýšX…OEõ·¼Có_ tg‰>r‡ºu D6R¢4N¯mëÜ÷5r‹¯ØMã|°ñØ8`8%QÞu³{Ož•––>¸]h¦(â•\Ê{oª¿éöõœܼ(syMßTü°j!vªyl‰×Wš¦=)ƒÈ¬ÒhWÄ{õ¼¥òÜ´Ì twu÷Ô¿»-~RƒH_VŸâ¶] nÌa?ˆqÑ´õ×0ó›Ç¶Eü8¹hHFѳÒÇ¥¥sâÎþvZñíÀ2‘ 2©u¯žäåæ^1•«è]ìyW XÀíaLæÚøô<{yPRÁ¤òí ûöYBßK#mr$‘Â÷c½=ÝýýáÖº–¾ixþRSì’ó|gücN:Êžê~YoñikÓvÆz::ÚòÒ’dŠþÂÄÚsb‘ΨۇbQiŠ­£“ƒƒƒ“›ÏÍ7í¼*×ÿ*UDHæBÚ•'ÏžgØ«hø¦!4¤|ŒÔ1µ"pŽ Õdéž–¤Pd²ÊÚxµý‚•–Œª†ž.=]- ½÷´m¶A‚ç[Ç+$Ný-äV3<™þCÙFXËÌÒÉÑÑÞÁ!0"i`ž;HŒXIg´ŒÜ¯ß}øüÕK;Yáòþ妧 —n ú‚½4¨¡ .%M–Tµâ.7=ø^ŽDÒÐÓç…ÿÇ+2…¶Í6üðòVò>ßãQ…æîžæ°VV–ש«%^ÎÑe«ëkËÜ^Û‡Ú“2ó¡n›†W:ú9ui¿Ûüt¥ÀE[ÓÏmŽÇF·ŠöÕUϲPU†®sÌã…iq¥Ê bl Ø[ÇéZûÎÏY!l3²@øbSÏ™*<ÑW«šdï<ö£ô¤nwŒí úJ“ì)éáUÞPÊ´Þ©å} •×IÎÄ»ŒA[®oía­~$K+½ë[¸a®lKç Õ±ny ‘7ó;?¦¦Ø3$çÚ®rêÇ—Šò:÷Ó¼Ul£ñe9‘}àgì_)°#x¹M±Žë%sRØ`›/ …_¹M¤§²‰×ÊöÖ€Wó•õŠ¦§§?”?p5•Q´ Ÿ¤¡ÒD;ゑѱ¡wÇ‘;çÙ•éº™Ä @E¿¸ªóM4“$µ+&p^]»¨çƒ;nóŽô+¥¶©cv•Í½B„¨ÌíeIj1ø‹æ[¡dm¿eÂ~´›ESa±ÍC;'Ó‡õÅ…Êû§Æû“ƒ}TÕ(÷*Zg§úUÅÄSßôŽŽ^ Õ· /BÔa íÎYÞ…òÔ‘¼ô°¡õH+u³€”¡‰ÉÑžF[}õ´øúênØGNOM§y©'sÑCû|!æ9SùŒw]›byyÉ#<¯~ÓL´•©þþåϲÕíÃÆF‡‡Æ¦9?F쇆УGп—´†[1KÓ¢l½£Öv ˜°–Ï»››]¾òŒµÒí¬«þ¤ŸZœ¢«­kêè_;HœØ­¿î{ƒWuÙY>&a…UD/¬æž“…‘±‘¡oTæø*“ç–»±n*š7;ø§ÎÑ|“¥¡qÃàWnôDó¤g=?\n³ä­«ÿ¸k\°Ä˜í|[lbblëâû¾o±óuŽ¶ŠþÛE´8Xëïh¦££{.ñúÍY64sî_ R ùÞZ}óÚ:b,ÞN 3516³´+yÝÌä®qi¢ÃÑLÏÖ3bÆ`Wi¬]PÆ îLw¥¡‘mÇâ¶aÍsî]e1Úš:zzü¾¯µ<íÇÈmÀ6ß[fÃÁ¶ú5Û=$Øê7_s¶OåpøKñ®êØ|½Ûi›ïr; ضß1ls38?PnÿÎmkã{ýŠí ó† öy½;¼;wà~Ù{5h¯ý.¸‹ ·¾znƒ>ÿ–Þ {ÔvÁÛöº–xß{ƒ¶µ„Ï¿‡è,È;»ý[î=H"˜lÝÉ„í·Gж˼±ÝŒ½÷íž;ôÇ·Û¶àGbxÝ»aàÀE7oBÛ¶Ûÿ ìs ø;Z!Äùï²Í­[üoµ»Ýp8œï|…ç?ÈØ**‚Ȇ†Ç´ôܼíݼ ÅÕËÅÃkï‹iÿh4š†¶ž“»·£›¼à¡ÐÒ3Z][?ì?>Ž ¡á‚¢\Sž§T.'•/BÁKJÕŠ†Sx_w××óÝ»w4zôðþ%%%4íÀm“ lóØFÛí’£ƒ]HHÈ9.AAA 0nóÕmcU¬kdºçàà`<æ555`°Í‘²³£}èxCHJJÛ„môŒ-ÂÂÂxqÆUƒ¿~ÿþ=Øl¶Û€m° Øló¹LM¡¬,hø`° ØæÀm33ƒRR áƒmÀ6`° Øl¶Û`° Øl¶Û€mÀ6ØlsDm3;‹¡áƒmÀ6`›·ÍÜŠ‰†¶Û€mÀ6`° Øl€mÀ6`° Øl¶ùmsù24|° Ølsà¶YX@QQÐðÁ6`°ÍÛfqED@ÃÛ€mÀ6`° Øl¶À6`° Øl¶Û€m° ØæˆÚfyCÃÛ€mÀ6‡a›  hø`° Øl¶Û€mÀ6Øl¶Û€mÀ6`›ïÎ6++èìYhø`° ØæÀm³¶†¼¼ áƒmÀ6`›Ã°·74|° Øl¶Û€mÀ6`l¶Û|™m|| áƒmÀ6`›·Íú::s>Øl¶9pÛP©ÈÅ>Øl¶Û€mÀ6`° ¶Û€mÀ6`° Øl€mÀ6GÔ6t:²·‡†¶Û€mÜ6 ²±†¶Û€mÀ6`° Øl€mÀ6`° Øl¶Û`°Íµ ‹…ÌÌ áƒmÀ6`›Ã°©)4|° Øl¶Û€mÀ6`l¶Û€mÀ6`°Íwg6™˜@ÃÛ€mÀ6n CººÐðÁ6`° Øl¶Û€m° Øl¶Û€mÀ6``“KÉÞ¹59ÍD+ã•ìoT¾áG –ܤããôµmóàþ=½€ÌÜÖ­8'ß÷›Å¹Ù^¼©glþ l£¥ ÿ›˜Y(¬l¦í¡åtž(ÎçÕìCUíB¿è¸]TùŸ»£¨Ù‡ýFRö<ãñumSQYõWEm—HM§ó¼¢îŽ‡úð‹†S„†ÓùoòÑ‚ÿú¿‘µ,\7dsX¶ÁQU…†ø`¸çúøqptxˆW>ôGœsws9üâáæúM>wwññöÇ+ÿײ /ÎÃ8CC#¼2lÿÕCýäÉ|Í^ApáTWWx-WP€–þ ?|ø0---ý; ##ã{Ø’”””ÊÊÊÍø|-:;;q‰%à äåË—WWW¼¢ËÊBcÿàp8„O¨øû\ÛçØæ‡kP?^d >?`À6üHÈÉA 8 ÄÅ!€mÛ€mÛptƒp?1lØlÀ÷k¸Ç€ƒFHlÀa %1à0”„¶l¶à{DQbÀa ªŠØl`À6`¾;ÔÔ‹aàÀ14D‹‹##´°alØlÀw‡©)š›ƒ0pà88 ¡!Ž£#Ø° `€/Æm8\]Q_„€Çϵ´@8 Û´¶BÛ¶ø||À6!!èý{Nd$*/‡0p¶©¨€0¶l¶à»#!=} aàÀINFC8 Û”–BÛ¶ø’’À6W¯¢¢"NA*.†0¶l¶à»ãúu”ŸaàÀ¹{ed@Û¶Ûð=Ú&3ÂÀó슋ƒ0pà”•¡èh`À6`›/#Ø|ýé97æçÿ+ðÏ^ëÙœ€}z½[²ïOÙöb¯E·ds³W¾ÿöìñÆŽ•í¹U_ío¿—÷Ÿ„ö ògì>싦cÛÖ‰!lÇÆvE}Û”OoÏözˆm¯`a`›¯ ;=Ò­yxqÿ½±Qï8œ­ÿwªç¥¥WÁö‰ÏÈÙÛŸl‡Kµn¶¶ÖVvnA]Ót|ÊHs©“kÈkk¾g—ÏæÞgbõ½œ{ùœ¥…¥½«ßãÚ~îgã“éñ^.^¡YÌ5ã?–¦»=l2oÓ§ùUž…¥•••5ñÓÞ#`juŸMdtXkšV Ío~‡¥7ùNA–Øh¬ã¡…¥µÕÆš¬­-=§–c¼M,-‰Ivöö6Äú­ì\|†æWÆ$üŸûxsZEI²­5^"2ñ&_;g#°ñÖV–Þ‘ixÜó¼ôï¼Ü\p¥ó•­Óøh§§ƒ on;{;Þ÷rpž§£šGé¶Ûãéä}nf÷>Ã㳉«_DÛûÑÌ+á®A‰«tsé«I>–…}[u¥ÿÙC÷È9ÆÖ·¸šQ=øiip7˜ïéœøD ÔX/Û‘EÆòL¿›³µÀþ²¶{ܱØRäejŽo¿µ-þÅlñX››YÞiý‚Ú—ÚZ|tS™­½Ã ´¢”÷Ìl?¦ì<²ó¸á¢ü¬cBÐ#MÅ'•#w×í4íc†âœS•9Áú„Ãx¿ÍÖQ(J‘Ñ ê®)ýŽ «4ÏcýR2F3Ì­eŠœµõB3¹°áú;rÇ~²v÷‰OŠŽ Ñ‘· ˧rk—‡ 帘Ò{Þçr?¢ñ~¬¤Ð‰³ñð×ïŠC­¼²ÓÓRù¤då—,Ó÷©[´÷¤ÿË/š!k«š»s^BÏfŽ…úk³¥ÔMÓ32R7É.\¦Q¦¤¤¤&ÆDʈ ¹Df⟓‘{mf•¾å…ÝqÆöM„0A•ï5+>¶¶Æù”ÕY׃L%uÝ.ŸuV·9ïn(­â’‚Ï㤧ïž•¾†”»/él4ÝóòÙ¼•{„a®ú™RÜâ_"Îܵ¬ä”ÔÔ„‹aâgc3ÓÒR3 n®³ÑÓl_e{ÿ쌭xf_½µÂ@ W¤” ³ó rrr³³2"κŸ¨&j=Ò\︘TaÕ¿–Ñ–?ì¤*ä–ÖˆWfwUy›”ªÍw/{©XÊÊúrmóæZ°MfÙçvthµªbZ®Ê2Î wÙÜ sw#$õlqÛôÕd©»ï{}fHtâÖð®<„{<}ßÏÝÙõL`E÷1•³œxéܽã(Áû—M›7•y½Œ>>M¶Kj@ËC%·âA½d¯ñºw×ñjÀ¾b.kynC7ý4.3ók£]irýòÖ¥ÞÎ…5»#0ð¡@É:T0ª7ƒÍt£ßà¹M¸‰–£wYV§…ÉÓå’׆mˆJõ®PNÁìõÍyýHÚÆG¾mÜTTSƒä4œ–˜¼:¶æªÂ³M‹Ì R%gßö‘j&ép­ugO #ösy4&ØÛÉÅ=ín=o'2–ƼÂr˜¬™'gàæ):mjÀßÿlÿÆNâô;ŸM[¡skÍѳ ÎTmáéÓ’Ñ™……Y1'N^«Çë'{#·A7ƒ>¡Qt;'6àga­–%¼Ûðâ”°¤•¹[r~q_Ã35鸼›£ [¶i.!i¸žu±Ì¹Zàe¢ªL<Äcð}!IX:çÆ÷Ïïʉ’“KJû–˜=Ed|Bâß×VøšÈY'¿ÚhÄ>nzDÒqkíl1rˆÞ´KžÛõ?.¬/¯¬QWr´ôÈܦÿ]á1¹àíGsìuaYÙr ±Ü”•ï<»®F1›'*3â̼ÖS± 5ÒòáÙ¦(Ø"é!›¶¾ÊgeÆÜ÷`E«U1¢M¼¤ÛÆ—wØFÕùÂ:ƒ¾µ*cs5듸mJö°Cÿ“øcÂrñ9EWÒ¢„Nž÷ãyÓ¢£±´­‘Yú½Ê·wñèõ-`w/›…ÞzÏEy®v`ÖžÃ<}½.NÔVU0q?ÿ¶¾uv‰Hu6G΋zÉZÖôÒ£ª¢ 6qÕ›ËEÛëž{ÜÈÜ Ãê Áæ&_DÿÉOK>·(™rZþÃä2¿CÊ]ly¨"E®°M¦]öK6mms=TkOÛ\ 06I®$lc¬‘õ2%ÀÐÐ5è- Úc¦z(Z&5¢¥vuY©–‰uÞ§¾m\•ê†ÇB-Ÿµòs› ÛPNŠ¿X@ë[º¶¶Ž÷ú7v3ÉTÒþJã^뜰"ýì™\R”oBþÍ8òÑ]Ÿï—U7ð´µ{\Ñp+Åÿ´´é,gÍFY:éQ;O6ŽšfáùL^ÜŽšm¸õeivtbžß~ì©d‡wo9\Û̲Çô¥Oän¤-WÏYx\E´7§…¤ÞöòšóÖ*òïz§¶õ¤šo ëq_/ –ÿFöâ:Úä…dÛÇ}ZC\±†›t=’Tq_çÎ9Ý÷Fü”æ `êÉfÔ>)0V—=%*eåì}÷=ÑJ{˯ýíØémœ²:Ÿ‰WåÚ[1”àÛ[Üí{™O’Ó˜fÑ]•”j>Žùê)— [{ßßÀ;óiœ¥Ï6å7Ã…NžÝàô/Æ~öMnhµ Bz¸µjK¢Ýò¹=)¾múërDNœá¯FLø¸†C:kc={Û†›©ÌNŽL/ñ{—…vdë¼x#vÔ#]«çE;‘K[''ÛŸ Q¼xóå;H^©èßøºÛÕ¸‘Ëpëƒ Ó.éêëå<ì}]ŸʾàE;%© ãvù#ÑáÄb] „„D6ã tòלVÞGà .6Éþ“U¡;Á,t·mžåˆç©Ÿ-‚_¶i¸Š÷¤r¯æçççåf_rVl™Ä{htÜ6ç2^ãG?{y¡Š¾Û`ô¹!²„¯Tä©~æJ×ö¤\_÷L.õ”‹’µÚçmÓª&#)²õE¥äu§¨ñÜË6¼ïM›éæáÉa$mëY:¢/ H I¿›æ¦.«Ã¥êafï]_iýH:†Ø‹ºdá’žUÁÜOÈ'Û~•Ž÷VxÐ8‚­ÎXÉ®b ZYD}xž&xJl¨³¹þÇú ëô ­p–ç&ë^ß7ÖPŒÊo#ß8B¿+Ðvºäk«+&c¾€a—ìt.ÖŒîŽïC§8˜É+¨÷/²W²Gn“áív«i·U¯JHȣϖV†:ŠbÊÎ#üƒ°M:‘Üv¿Ë—°ŽÁØ4ïܦëE´¬™W[Wwk{OÙÝ R ö À6Ýcø&Ü4ÔÈÁ§lŒÛ´È'5ì{êiŸÜ—¹”áD&STTU•e¥ ìf¨¸múE¥MÇy‰øú°¼¬b9ž£ÒÆŒdÅ:f£-÷%u¢·z³> ÀÀ£•Ûp¨Òvéï¨4:awÝ”õ£oÚfu¢WUôÔÕÞ¥±‘‘áá‘ñ‰‰é™y´òJ˜¤Ü;¾¶Ë6˜€m"?×6é¼ðÏ´Èž}GÝ:~Œt4̬ÐØ«Óæ.ÄHÈ»«ÊÆq½5×ö·Á'Lt–‰žTlÆxã ¼}Ê)‰2§ã‹3qÛ”uSÇ[e• «ªÉÚgC7æÚ›=)ë´g»`ŸÈmpÛ_°.CT¨µ(\’;JŒ÷¤ÔÜ.ïy†è¶áЗ½ÕÅܯ5Sé ÆÊ·¡XfÕqmC©îåÛÆ · áççm4Ý.¾HñQsÈbm³öêznJjZrJFïÌ1Ôö6ØÕRUÏ:åÊíž¡ :{ËáÌõ¥Úâ|OÏ£»Ds²rsÒE¥‹¹K}¡m¸Ãˬ k%òÓþI_5a~Oêé}·i~'·Á÷ÅÜo|‘ÊÂÐÇ‚P’¶Í†mŒ·Ù¦8(™‡>x™â“YÞ·U©ºº›Û‘#FìUwyñK•ÄŽ Mw+™_ºOØÆZ–·¡Î:ëJy§¾ÇˆsÝô·îÔ ÑЪ mf­”(Ï;Çg+Øa›“džmZäN‘†æ8ë“broF‰Å» Këws»R]å9ÂR®ë•¸$@>4ÿcmÚÜ9–…8E‘¦zþj ¥(»l–ÅĈž~ µŠ¶EØؕäõÖ?—<-þh”MË””ʈúF 3××SÕ-lÆknß¾m¬RŸâkc ð©qa®m¸3Ü2ô³Ó•3´ãÛÆ5†TÝk=\ÛœÜm6uÁZJ8¥øö«ã-ºÒ¿Ù¦WáØÏm6mã­ðkD¯P&«K‹å ÁS$;2±²Œ@„’ʽΌ£µÉNaqí¶9Z÷£DÛøZ´Ò­§¬Ð1µvÙ^'ìyçö0}¦Õ©.U’Øun/€µ>«KͬÜl“„m¤wŽÛ8æ¿Ã+Ò¶8¶¹¢hunó:„ž;gOSìfĘÇycs¯øË÷Þ$‰HiJþÝŠV+s…d´Æ—¶¾Ý»cy—<Â6Þ&Û·‚ÍÙo´—ꪨD؆û¡ƒ¯2HJ®ÎÖª½³4î¸ é-?@ |á­^"3Ùl·mˆ£X¾‹‘¾_<;Þ~ÞÍPV×fzgÛ(ñl3Þv‡¬uÖÏY{hž¶U©pÛ¸º±Ab¬á^ITÜÄÌÜÉÿbÍ£èÿþó‰´Ê_Ý__vã˽¯mõU4u õµÕt,}ÛæØh¹ôßþ|ºs„­H®·þ1!‰°Â­s=ßçýËi_ÞëÙþ·ÿò“)÷ÐÁ<¯G!Å¿ŠwPûU\.îÙèàó Y“ð þöæ&zdIù’úk·ÐÚl¿­^Å¥(Šr§°áuÔ]–ú_¿ÈM Ø&ËH’ìÇ;EÂ\™ÈŠðP–““–’–10w~ÑÈ÷ šœñe¾çŸ>)'KÙBN½ahfÛ”Ÿø7ééU&ok×fzD~VÒ›a¡îŠÄÿüÓO2²[+’’”{Þ3Æ?w3Ö#ú—ÉëÞ=xÆ~sõ¼¨ˆ„©™¹kÐå×Îý寢7êÛÍ}ÓÉCáVÇKÞä½~¡õ›ñåÆŽíÎÄðWæfÖ˜;/+¸Ö‰U{7U]Q–"#M’’¥È+_¸ò#ĘòÓiq8ȨèØ-¬Mxªž)ªÜ\ÛxeÞÿ$\=¼ÈûäÅþ†¿ýôó»é­/u/Éá/¿ž–ˆ§œ’vëØroMÚ)uÞч·1Ì3’öYEFZRÚãÆ>•|ÝøÄÉ'í#ü•sÖ#MIÿü“p÷ uv¸A觿 ‘·¾±´”Lÿê#bó¢”þK7­v÷™ýÏÕ)bz†ÆÖÎÞMµ7¥~ù«uâl¹ï?~RáUÎÕc;ù²k…mÖ^UBß'™Á¸zá¨Ù㧲˜´µõuÞÎdЩt›É ±9›™2F¥®Q©´C#›F£¹ ÿmJ¥3Ù›I7‡Í¢Ñ˜üúÏÁgflT6u}Éæ®Jeq{RŠÎÄ«õµu‹³½iðW°¾0jâpq}ãÚ@ _9]ðB`ƒNg²0þá»Aø÷Ág¢3RcŒA§±¹Mœá྅/è î²lƒ¶ ö¾×ÖrèxÇ“ƒmÚ‚Ø:qgTÔ]ëÙº²‘ƒÿÊâì}ΚI§­­ñ{’t•Ébs·™|°Øü%Ÿ¦;¥?nÜ·£·yÉ/†¡½NY kqÚî^¶º\±i)&þ‘; Ó1cu•º¹¶±… {c¯pv„‹¨@»ãÉÁgdÒèŒmgã9¬5|åDÅÃ÷Ûº:Ñð °9t*•ÉÙª›{“…¯kûÖâµp¿ŠNçí…ÍK¡9L|/œÃÞù…©4ƒµ:øš‚Þ¬øsmmÉæÆãbr÷/³qå+ØHÞZ²W“Í.Ù¶;Ž\nÃOÝ«“¾ß%'Û® ßþ.¶ëð¹ã’ñÝëîztVÑùúÎãüæñzã¬ÊÓ²ú]·<`;·n¿^ÏöQQÁíEØÎ1ÁKÒÖ§§¦w0¿´¶ã*-ì“ñxÛ+Š;‡m÷ÙIü÷×'êÄJHh -Ð÷½ÑàÓ›²}×- |xÎ9Á>ëª|ÁøíÇ…­UüþŠ°÷¹ ½nxÙs‹wÔØYçÊÜô.–מ@Ÿs=ðF†½g Ùõ?u‹ kfrô~z Åì"sÇšŽÚ¸Í73Bý¯.[…<üTc¸µ ;ì{Š°W×ôu 02Ôs¿PÂľYÔÊ <•tìk>®¡ßWÊç©ãS¾ýÇ»žãu¶­®¾‘à.344Š»ÕòÍ6Š½dolì4±ÎÚiÒþ~ää"8¬´êwgŸw˜>È´ïÐo½I_Ñß0ÈT£¾hoø1u¿Äwb™›•¦¾óVæƒÛûØö¾Ïáìùí6ÛÝïú½‡·oí^kûûëßïõ÷›ïÅûÝ&ú‰[³>ñd€¯¹;±-“îj÷ZdßîØ^7ŽâQ¶oOý+|ëññ#a›@-·Þ7´ñš¥Hóç­ôiŠïä:zxÑexž=ÔP았yõ‡b÷¸’zÁi+£Ý榖m‹¿¿ð`u¦[Ķ­}ìï‘Wÿ%i€à˜÷–´8ô…ÂøsúÚZêš.gc‡iŸï™îײ¦‰,Y[v·1ÓÖÒÔÔÒÒÐÒöŽÊ™áüsVGÍÌ;¦öbªÑ°¸,8ÚÁ¦/xêjuNœ1ÐÐ3÷•÷F òÓY¬/ZcR×iÌí|ÚAE§þc“£ŽÁ›Ñ…þ§a—_ê1f½Lò_Lî¹ÚÎGçsßmŸF²5½Wîl}¹èçïÿ¶GÄ6ÜÊÍ\›2VRºÛÃüÝè3¦í7ÐmoàÁA ÆZg–ê«ÊÐðŒß^%ö|È ö™™0¶ûx³}Re†þÙ¬mט-}l¡ÈÈ}˜ß_ ››þꢾ{¼àÚ…[Ä•ÿ^¢¸Wþ³5ú„ÿ`„ê“\ÂS+ß74ÔWçDûüMÄpý }`‚·%PÇŸ¾mßsnì÷vÖÊl¿º˜XBYs]mMåÛ²0ÍSÊŽ³TÄY”‘Õhgì‘™Þ×'åü·MçPcsZ§ÎXñoãÝÚ•{>åbsäÿ÷v41¥íI^jiýž9ß~‹T©›‡<ÙZz°SYw_f°ÍÓþÙÎ[.÷¶-Ř6Ñ”Š¿7¶ç±¸ñº¥ÛågÛ?…Uš˜õèiŽŸoì}Îߟä¥Ü¦½ôœC÷ž¯wÙ98÷uÖºšéêYyµÏ2;Ÿçêh»„d¯ñvËÊdt€“¶®žWÔx’ó,7J[[/<ÿÍXc¾{$1Òû0ÌÁ=µt›óY•"¿GzoüUºy|¹¿*CýLü¶ƒ÷´ø½´PC=]KGÿŽYþݽÓ=åvfúÖ®ak3&¦.csÄ1˜>Õæcc kìô~h⌃S wS¨“ÎںƱŕü¯Æ¢^ö×Ô1Œ{ØUŸgx6s§mdÈ<Û`ÉaýC‰~¶:šºI%lÁ+W¸¶ÑsÛf›0 }®m°Å®Pw+=]·s‰ó4þÅ{C5·mL MíËڸ׬RûœÛêJ ,ˆG¸lTÊÕ2Ò1å‰5Öf¢ÐÑÜcy®Aß%›[WØùuÕ½t0ÑÕ3q*ÿÈ?uþþN²ž¶–gtñHÏSSÏBÁ,·ÒI‘ÒÍ›Æû‰H(ôŒ­a˃dŠzãa›¡úGv¦†zú& 7kyËâ¶9!¼¸Ôîha`bãÑ1±Š0z”‡w÷ 3Á÷LË,bM·Û›~œclï‘qÊŠâ ´µ¬½£G74ÖùºØÒPG×À<ïÿÖ(»¨Gïï¥êhY{^c¢‰aÒr JjnçbÖ8c¬¤…ÑÑÕ?™Ç»Ÿ®ïÅ¥€Üú¶géFzºÎq«lÔóòŠŠ”8™¢t¦ä=¢ÍZj¦TѸ}Ö gzvL£¶›.¦!ë&éëjû\̧sˆúd¢)¸`ry¬ÅÛÎ\WÏðlÒ=Þ·Àmã“öêý­X<˜g"riÜÓÜñ鯦*.™Ç>ŸãÞFªQÿqþïÊm,,~|ÙpuáO9y§‰{ê“Þ¦H!9øÄt ݈°øMRû\ʱÑ7U1—xâxk.œTôáCý­T_eÛY:êzzIRÅêeU]qÒy#Y]Ÿ;ølå9ãnUq¯4ÃØ«««6ÿÉƈÜFÀ6¼ë¬¨ñNÊ*v¡ÕšJ ã>&[‰oÑb•ì¯K-y^ùâ®—³®„¼ÁÈ ½6mLöIºQ_ó"ÐJÿ¤¸ÒÛ^g¶NET$ñú³ÆºwÞšÂF¡%x¥xWà¥fPÝÐX¢¦%š[¹mÐ7²¾¾ÃÃ÷½Ão´I§ÞuM ŽÿîkÚ„–ð‰³¹ñ€ä^òV󻆿Õp=äW!õoßW>/‘»Ö¸ˆXÝjŠÖ¶^U­PYCW‹Îò§â¯v ŽÍ.,ñ.Xá^¡±ì­*XX_ÿ>#ØRB7‰°(;µ„7=¼O¿ëô }±÷é1Þ³ƒfoþ|LÂõ\j÷ÈxYþ¹S¢šãëh°*GHBëþ›šÇWL´)¢ÆÙ‚ß·ò)‘’êÜìÌÌÌäÓô`-‹Ày:‘Ûà¶iš`¯ >!‹¯?}÷¾â™©ä1Ÿ¼*|³¦{ß’•ôý}Ê*ªò.xŠ˜Ÿ¾Ft[Ø+4Â#ÌùÁ¨s!K,„m¥ao¯kØú?[q=Ö鄈îø¬Ì!)â!ª¯xb!w:ú~!·?‹jGå<JtRTuŠ[[\H 6 ɺ3<‚÷qtÄ=.æ66}È0Õõ[dáu/PLÖ(¾àÁØøPœ›¦AÜ;ÄwÔUp Êœ_çЖÒÎûÝnÇ7Œ±°Œ;‡±¸BªÚn¹‰‘uB/çTU½ 0•7¾ˆç-³\Ûà‡†>ñÉEêßWH«zäâß­ù†EÁà|òµêÊ27u1+ð½´´Œà°…%žö˜¹!¾]Ë|€}~éë Û,¿Uîà^ÌhW‘®àÞý·<ø„$¬6ÅíÎ3Võ#n0ô–øS~%ïÂ$´¸HÜ€£%”ôŠÿ”^êZÞ·Àc÷ëpõíÈm0´<ÜB––­çwýi*ÞI*/9ÊÙñ.çºyš¢72Ãœî}-iàÁÛÍkC $™ŠÚ#?-ý‹·7VX/{JmMõ¡ÚÎOïómIA9ûÚ漃ôÕ÷ü;¬‹B®¼îFŸ“ÛÌ (ŠŸÊ®à_8»°¸Æ^Ÿµ—?~iãÖ¾škáJçñÔA•BzÒ>±½'E|ëÕÙgÄNþ*!£``æø¢}’?²Dì:¶ÒõVYFf` u½M–Ö ãF‚î¡,Ö>¹:ÕŽÛ&‚k›[¿ +wNp3•ÕZ iùN¾£’W ?m(Kt1ÈÜa=iQ1¡Ó¿ SŠkˆÍãÙ¦qœÉ¦¯®ÐˆO£1Õá†Jgâišî{{ZH—·û×g:OIZ-lËNw=}“»+ÝdOÕ òf¤÷´wâí7FûtJ¿ÎôÕf+øшÜ&@HÙ‡w])»!â¸âíbGnƒ3ÖýJZ–_“ñå®:é›D¥¦¹Zšø'ðqBR{d†=ØT¢æÉ玲 ÉË*V~\2V—RÓ¶°´´ Ji®®c6MëÓ>&Z7ÌÏoËÓtwÛlÚ&ÜIþe'ßK%‘ªeÛîïÛm›‡=©š›i:*de]ÓKÉãKôÅQ#y)5Sk+Kâ!˜&†x‡Ô“ÆP‘—k\üÄ°ÃHÇû´(ß¿ýåäµÖu„-DºàÝSsKKc} 9µy6snT•,VÚ‡͸vüñî— mŽ‰k ñÆyiõRÒòÃskg5åSkúx»`àu¼¨ÑNÛ(Þúœny¢$tüaëZáå6,êXƒ³¾’²†MC ]ŸxÜ=DOJ.€ß>¦»…¥,æ÷@ÛúzýJÇ%º¦W.[6=%r¿c”×^'»_Kk˜á¡}é'¦™ßÓêˆ>.ï¶ÂB’ì’K w?¸ ,)cnieaaamm©¡¬zµu²÷Y€ºK!o‰š aÍhžm^î8y$kÜ6z¾·yç>6PH¤†Õu3^nC‰r5”WÖÀ+‘™¦’œŽåcÛ¸MçÓ@‡¼Ý§÷°¿óâ£c›¶«§dô†7m#+×6´¼a#¾m"•}iü‹ê©sSc­ÏR$¤µÇ×–=¥…¯5 óŸ ”b©éuës>s·mfúj¤)*Ý þ(\¬¥¶}LÞu_k]ï üœúÌÒº#3¬‘Ö{òvç¸9Àسƒ²’²ƒÔlK%ËÄ[KË+K8Ë«ø± Ï5L…NU ÎñêÜÓ³2g³+?a›üS7Ût Î9P_@¶ <ûà¤åv‡ÿ7uujl¸ìvš„´ÝkÅLò·ø6æê2±!«këÄ]ÌÙæÁg¿°•é¡†¶nÎVeDûh¹Ùõ8CB^op‰èsQªä¥(ýóÄ×½í¡êú ÖV3¸€¸UaoÛPë$¥å‡fôå.•÷òÖÝyû¼ˆáNÛ(y¼´å…gþr®ñ¯m·Më=ÙRÉ*áƒ{Ä›³FJž¶‘õçmí*aËùß=­ŽwR„N·Ž/£­[E1OÉE £¼éz(£a‡‡f·^ ħýÒÛÔ¤Éè[/¬ãQ]\Z¦Ò¨t u>Ámsõ¶ÙSì¸mt¹O"Â'O ÖH‹Êõ°ÖpÛ$>šxb¯h0ÇMêú¯] i˜oØæé~¶A_åò‘£a":k¯DD”ºyy87·Ù² Éh3·QñIFŒá˜ÈÁ‰Ædöé"5ÍÒú*¸%”2™ŒõÅ>'u)â¨1?:€Ï†}Ò6jnÑë4ê2•Uöò¸¡<9£´ƒÎ ¯Œµ«ÉKf?™¿NHÑêãô*}}!;ÈA\·Yk—Öm\cÐiu¥)ÇNRÞõ1¦žŸQrž]Æ·mºãYbÖ#¼ÆdÙKÄܬ¦Óik m†¢§Cóª>Ç6%‘jÛlƒaô¹a51©ŒçMx=_^Zh}"Ai›XY™l »2¿NÜ 5ÞW'#¬'Ig´´Ý ñö@[_~~#ûAý$bsmóqç¹öÁë¾?‹iUwŒà_uuer ÙJYìÜ­Ñ®{IJ¦#+Ìõ•¹[ñn'$•;&ˆ{â¡œ¨²„´J·ð‰Ü¦{’ù6ÆLÛç“Å ­N†Û© fí·9-zg­¯=\^趖8ø¤ ­}”Ám3M3QpÊ|Ng0æ†Ûìõ(.—ÜsR¶YÛeâ„5c½¿§ÎÜö<üL7…˜›•¸ui‹õÒÿþ—Ê©õò8ûó×ñ>N¿e`FÔÜ6âú›¶áç6Sì£J*X &úøPJB±¢}õÚtGB\Î"}OÛ0ýŒ”=/Ý]e°1s¸¯{j…½óèzËUDѼcvÎ`Ö–„’õ¢Z4Ñ”Lz4qÿ¬•ªcع2;áaˆ'©Ã«;m£ê˜·«:sF{»WiÌ?ÞŽm S¹|ZZ· ˜eyá"'OË«êgßÃç~ÛCÅÓ¡²Â%YiŠŒšýÓ†âuf*R"’«€¬¢xm§è'ís7b¡¯þ¿ÿëoUÜ{»=õ}Ø<ÆÛÞ\¡äÇ-‚çqñÃòtßû`gcQ¡S§…DŒ*ÚÇ8DãZ¹¬(+M‘!Ë«½&ú_Ì¥ÑÔ`;|CdlýbúæˆÙ~ê·_êzv]HÆnxQl¥§,,$,",¢¤cqåq ñ­™³Ñ.ZbÒºf.Õí]AÆâÎãÜ»cìäµcÊx;n¼éÎÿ{Ò‡ÛºòÏÿ!ÞÏ}LZ¯üË_mXb, ù™(ŠÈ&Îáw®… ö¤ˆ'ïMwKþí¯¿ ‹‹ŠŠŠˆˆHÉ©Ç—­±8Øbïÿ,ü~”µÔóJGFDFVÁ%4u¢ç‰èþ»ó¦Åþ§ÿß/v¼o°2Ñúþ¢²ãÆxÚPµŒ0©wš!¸·W¦{ümuEDÄ$(j¹ÏšÙb®Ï¤œs’Åc$#ë’>IÜAÚþ‡t(ðÿj¼@C½U7N?fà²ÂA½wÔåÈŠ¬’Næƒjü3ZîØ ¦ò>©çmÌ¿Š¿k½qþ/ÿ÷ßÕÃ!êŒÖññ~²†¶ß_›®C±MÍu—‘”U·¨YBô yÑ?‡ ånw=²¤ÙÜ5äãÇ:ÝÓÖˆ,mÈÓ0¾Ëû”–»§uS9î?4«ãá=M÷²²‚´´ŽÄÕ6øž*»d}ŽûÚãÊn[ÛxÉÙ-+úêüúÆ)Üê4+È2ô{‰åîõ왉cÜÇFÌÌmüé“–ÜSƒ±EÆfMÏlä +ýŠrݶkñ}®áàìq-±à´Í¿SÃÙ~K)¶÷%-Øï_è‚q8;.Cù½ ‡8û='Qƒmµk>Î"{3ñ¹Ù»wž¥®/.ñoåGíw¤\ïîl"{^¥ó9UFà™/Û/ÉåöC£X¼Œñ ®·ÙqvAðSwoÆÖö¼ÞJ80´cW þ¢í•bcNÎŽkC¶×Œ³g;¾*nêŸú»Z"…r†mð0²©s6ryõk‚ÛëfœÝ7ÀŽ|¸FVÒ¿QZöøV–¬ð©§]3¼“Lû šíEÜ_‚Äî0‘8™qãMÙc;•“ú!w‰'Ô1ݵeÂSß¼)»àc*oËÚÕÞ[a»ÿºÒÖ(âÖ}[×Àö³áÞ÷Êo^¢³×ýé»otÞ‡Ý oër¥Žú×1Þ†v¨´×};—î~L’Tο÷ìÅÃkdÑâ†Q´í!ÍŸ¸Qþ“·“cŸ e.¼|þŽí¼czçŽÛ"³OØÊ}o'ßÿÙ;¾ãö« ÷¸Ål‡áv†hÓ«ÛÄÝRþd‰Êú»nš#“BnË£¯ÌÒÎmzíËƹx‘o,Í33002s,mœD_ífþ~]›éös°Â×}íÝÖG®Çø;ééêûDåÐ8ßä®ðC†ïoe´Œv>Ùa3pLWuÛÆØÐÀÈúÆÛntðw#bÛ.“ÆÐaóI‰g|‚m¶=O }ÑŸ‡ÝóOëbŸ>pþ‘~ÞÎ ½×ß‘ýÑë3¶3ßv¿üÞá aGG6û…÷Kq4rl¿¿£}€»G`üuß#ó~ïïåiØnÍ®¾ÏÎ;½/u͸¾ãïÂsûŽÂáì]Øìm…ÅBL&¢Ó‰B¥¢õu¢¬®¢åe¢,.—/,?—–ŽÄ¸ 7¤mb5奲šß]ó² {qàÇ c®¯ô Ží7Ïè‡b‡üm“8Ô”0sï”V4ÿBLFsp’¶{©áÆ" ûì/ÝžU™ZîÅ‚Ç©'~™¯ºÑçÜŒýýÈ/áù.À F¼Ñá­ /³³Ä-Bx%ž(50€z{Q[joG--¨¾žøÓ'55¨¼œ(oߢçÏÑ‹èÉôàQîÞE7n¥¨åç%7¥¥ñKJ Q’“Qb"QP\ŠG±±(&†(ÑÑèÂtñ"ñ32’(çÏ£ðpâgX !Jp0 "~ž=‹ˆâï|}‰âー¼ˆâé‰<<ˆâîN<‚/..ÈÙ™(®®Ä»gÎ3‹ãk %JDÿ£ñÍHJBbbG$ô“üµ ²¯ “ÍT<îâµ÷CœöOŠö>qƒÐdûs¯Èkû5àÕÙ§uS¶Ûf=ÊCÙ*êÿoïÜŸš:ó0þ¿ì;;ãº3-ZÂÅ\ \$H %€à …*‚Plk­X- (¨«« ÜDˆ¨"h‰ @¸_Bn „$$yû¾9Q¢ÐqÜÑíÖ~?óÌB.ç$yžó¾ç|ßó¶“t3³Ë¦5œ5Ô’ïÄ=õþWû¦úS›ÂW2ÊbFÜwçÕ‡›ïÝ ›Þì˨Þ…Qš™!šž¶ kd„hx˜Ø û®¯¨·uwa÷½xA ˆ—D؆­­¨­,››‰žzDÔÐ@Œ‰USƒnÝ"*+C—/£+WPI ÊÏGÄ•Ø€X؉™™DØkØYØØØ)”•bcÑÎ(&EDÑÊB! BÁÁˆËE‘·7b0“Iz›7áñÉ݈"#ÉóPOEÙ[¿¶!¶3vv8òòˆ.\ ëŒWøêUTZJT^nÛ®ÚZ²X8‹¨mÇo +*¯¤R"üÊd$Äð+—á÷‡Öø8šš"ÂÎ=,üéà&ŽAÜØÀ,ü R ‰Û'¸­‚e2}+–•}þmÃÂùô],g—€@ß#Ïë~ÞƱ¦in4ç` 7˜Ç ©nAhöO0¢&³5§9¼X¹ŠœÀ¨)Úwßšp¢ÂZí¯›:÷Í^>Ÿ'ŒÜó¸ß63»RÞ¾/:,ˆÇˆ[´ºÖ[|=ÙÞ[b|³ˆ,uÅÙüà `.?óâ]ª@ §cH~gÝY!« r¿tæ²,fîóّٴÜИѽqqêÔáx ¹¼ð«÷»Ì¤¾+ßYpî×úB!?'Œ—Qr$XtӒû¶óù¢ÇeJkÉxëlZ@@`tRNÝ­l*mš³â‡Îê¬ç·îˆãD[Ä‚3!.Ž$:š¸ŒRHˆ¶n%nž %ĉPTYâ½Þµá¥ôtâ)¼Ä†Â¦Æû5ÊæxŸKÙ Û¿¸˜›ëÆ ¢›7QUQu5zð€ìÖñ²±55‘x¡üµ:m°¨DêìD]]$£ð²§Ç&ì;,lÀ¡!"ì¾ÑQ"ì>Êzx“)ë)•ÄzXØz 6ëQý§TgÁlFÀïõ%?´]ú¹÷Ý©2·= Çk-½½áÎÙpkÚèRCÙIçï¨Ôjyç'×¥ñÌ~N©¶5žÝáÔ‹2aß‘áOJ‹H¦‘e>•ï›u}F¥î~tƒæìùÄZƒêçpíás•R)çzùÇ*Qóõ¤ø£Å:ƒ^r÷´»O´tL1;Ñ'bÑŽW‘„ò–K®t·£ç*&³w Ó7ò²Z¶¥JLcú «Ñ­$Ÿ¸3*•r¼·9œ$ÒµºÐ½s «&ŠÊŸ:Q}1‹L¸É)¯²E­ž½——ìì+šYBRñ WN\ß´f¢¯-.˜îVD^´¾¬¸ê±‘:¿üJìJó•‘”³ü ¾Øÿ']¹¿ÔÑaà¿üŽ,'²hݤ’öNn¸ïþªEùc&[>gûæä%‡½/ë¼r,£²-ÍFxr¯5ÕÿTú-Ïïòp/³›‰W=ØÆô èÑ"£Ao1-¤sÒ ÉdÉÞë¸Ýb4’vò§KªS÷eÝDÖ)`^i5£ƒý’î—E±ž‚ì*Ò“j)úÊED]|e^Ñçåà\¿ˆ²¨´©sd´)Mðæ%huÖ²U3™)e¨µ€Æ>@•±NKë¾d“ñƒ/òSÁ¢ÙE³žLù1%te5MÌl÷8\AMþŽž]Nqyëj 6Ûrw¸'~¿ÍÿpÍ?Ö´y¹’6S]•,&wJo;ªs;{wØåNmo5=®dY#eï8oÐtsÓ‹Ñ«!VP²ý\cR1Ãy/4,„äï—VPŽ#F5Ò‘¸ÍŸåí)J¨hêÃÉÐEÒ†L×ßPâã柘r";k¿køÉJê¸Í†@ª>éT#<—]EÙûWÒfprÉ Ÿ>“Ër÷n‹>wý!Ž0Ü“¢q 5Ý{ÏÁãþ¥ôÛ4†› $”¬0$pkPíðXš?;·Ù6>Zvÿ¤KØûãNÔò|ˆCiÛ(|9à“¦Í¼¬žÍò·ùîbÚöC•¤’ûѹµm ÿi@º™`¯]ý ÙW]å·RÖÆÚÌ•poÞd2¿{ÎziA;Þy•áäÓ­X’ØÒFŸäã’&¢îpyçfAÕ¶)Üè~2þüì Ç&ž·oÛlœ´]…bY¿83!ùy”wO´åÓ¿6b*mÚr¹ ãÕFë¼°¯×$GÀ>*–QÇ”žÿûˆ}ÛæÍ!äÜ /n?C¡25ø_§ '¡ÇÆ®@÷<ñS­V«yÆ÷¢·ª‘e>)̇³;MÜ!GÝw±üðŒÄKbÛ¬ôí=ãshi&Ê×ýĵFµF33ü2y_â“#2ô$ìØý¢L­Ö¨;_¹IKÝ5ÛS ´SG WŸÎÏi{ÚÅá~4^Jɼ ·^rvt-iÖÎÍuŠ }’2½>nCÚ6cíÉ„Ø»­Ý*•Z£žüZà{C2¹:mHP(ê=]ØwŸJñ*)¤ö&dÌ.¡ö‹{¼#³g5¥b0%ÂËYXH¢Rú¬ùE¿ÉV€£‰rqjR@ØÀGëô“…1~㺛]dÞíò“\f Ä=?Ñ“º“Ï`н"*Z¨‰V»~Üñ· ÞÒiR>ßôcâ?6°žª©çÈÞ²!é ¹èÊ¢Bvlo(“Áp÷¸XûLob·ëáu/{ƒéá^Ö2d6£¹‰_ý=ƒã$ùž.t–çÑÂZE_}ý?ÓÅÃãάÉo-Ïñf3<ý#žÊ•È²˜C秷!åu_º L¦{[÷„ûÓé Û÷ûkõ¸'%kÌ]çuœÚ®Éîš¿;í¥’bJÚËçЙÌÍܨÚç#Ëfd2¨Ï%G:Òœ·F§Õ•ŸüŸô¿îÍeÇç‰ÅȦlt ×ÿ°ù¢à3Œ›•A±f»aÅkÍ`°r®Ób~«êæ͘eò¸Õ~W 40p™îÊ0m3z§¶²v+oYýû[›²º‡> stream xÚ­WKsÛ6¾ëW 7jÆBð AÐu}è4ñ$·Æj.n¦‘Ä IÈ eÅÿø.rôªÕÍÀb±ØÇ·Ø%A DÐÍè×éèÍ;.P ÁšÎÏÎÒ å©ÄiÁÑ´BwÉíÚÖ¥ÔxÂr™üÑkf7ëºÒã %ÉE |ÔV½ Ž¦ãÏÓ£·ÓÑýˆÂQ”3žâœä¨lGwŸ ª€þÌ ‰6ž«E©06èvôûˆDmïGLrœy&%Î3T\€ ”SÌ2ê¾yßýfÜ9LÁ(‚™àNº È‚ #âÇo~ YÆœ#@M^ä˜K|ð®1cš%›º¼M[¥à\±ã?‚&,±Y<åÎ箌$u77¶UCmº‹@±ZUa6,õS lGÇá/ÆŒH§zžÂ*E°êV¡;ÐiÎNh·Wj¡q”ü½þ:tXÍ9–"â¥À°ö¯¾þÛƒCŸá°©÷O£ 7ç ŠT³ŠŽ*8©\ê>nta¬š;kÿ$„•O•¥±UÝ-"‡ äa{“Õ.H‹º´ÕU ©Ö¬Á]žÑÌmö8„Û8L£¬gmõýZw¥ÛݺiÛãñ„“Ì™d½ œ­Þi"تlŒ9d ¨üàÔÐV5ØšªvV€ ³B)_ÆÞ»pìqã¦`æeôµû¹èùDl/…Ä‚rÄ Žæ¥4Ì!Sóì9÷dHÊcÎ G^Aȱ”yA‘ûnaºSv®)0¡t÷GOsŽ‹\n[æ'%o1w8ú| I€¡Hcº3 ¶:<»Ø\Cì!ÉP8¸÷Î-†¥êžI E`¾ŠÌîû—9‰œˆó †ŸŽÎ AÔ¿²^+KOêègÆþ‡€«­€½OŸ>éÞa–¥SÚù9†*ˆà²8ª{±Þ{r\¬I#ß{¤á=9#yh!1)è«’‡B9£/»…‚¸å©ó|ÉnâD±?&q ƘszøöëË+è´}*›ZwÃÓÌ Ë']ãi¯/º®Ü+7¯wáí¼þùu;׳Çá• : úÃG0‹˜xo¿ªvÕÄÇß——Ý xp‹Þég~Û+„QÅnbÝèËÿUÉ¡§â¹’CpÙÙMÊwNmŽ §,qõŠSîôtË•ÕåÚöî…qKW×üèàØn3sUÐ?)¥P)k5ktUÿ%pnt lê&òÏ"EU¡â;®ƒ X¢»EÝÅËbÕ} ;½ñ½g2Ù,ëry(^5Ѷ(y¹_ØcSªÕ°¶Ú5y©„x =–[ä‰êª0)M»³z߸ÀÚø«Ðg¥Ž;qùàîŽðE‘¼™ Ÿcšm¯éÃ@“Nµ:0×½ZÇýàê(îÖâ£YGUÎxeÇ4±zGɆϭiDZ«,l‡~«ëÎêÊUµ öïÁëð{!K´ßý¹püQ"Rø¡Ÿ)–`±`ìß(Íà{‚1åEq¨Ö?ä.#Ù endstream endobj 1068 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 385 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 24590 /Filter /FlateDecode >> stream xÚì½÷[TÙº¨{ÿ†óË9Ï9Ï}î¾áì½öêÞÝˈÄ"9ç¨dPPD‚ "I‘œ“d0Š$ÉAÉ9'‘œs®**Œ;fUBk¯¶XÚý½Ïh+Ì9æ7Æxç7ÆœU ð…Åâ0ÆO‡÷5uaÑ!±P @ùó”ȸÌçÙß•÷(Šž¾áÍø6aï @ò§)7¢Ê”LG>}ú~r*…rËÉ5u%´¡„v(P üIJb7r ~>>>öý¤7Ø6öŽ.I}(¶ŵ@åOQšQBrÌÛ@l ”?mnd~þH݃B¡pVkÁ6P @ùVç'Èô^”·—WPPP0ÿææfÈm @òmÓ‰Œï„;::xxxx²¹{÷nyy9Ø (`(P €mÀ6P @Û@l¶l¶ Ø (`° (PÀ6P @Û€m @ÛükmÛÌâüÄÿä)Ä?㈟,ö±°N?tÕã©áþSûõüCØêôªÍ­üAMxç÷F’u8_óâýö:f{d}ñ,ÃOö{¿.†}f?ì{[øúVˆý¬­¿á‡cÙuûºÃÙ¯ë×µ·÷o}D?fnÛÌŒ¨œ ..c—ñ Ò‰èFFtÝjHåzl 딳 Ü%¢j–C*böÇN#¬b"¼Ž×J)!jÈ®ädØû ökˆF~Xàì|åØÄ?qÛçéüÑuK¡U±¿óTE´uåTx õö:½MÁe³1ìæøJKàV )ŸŽnü£ýG ¦n1¸b9æ Á':Ol3öOÛ$´Ó5ÕELœLœüq1v xO÷{,¬•˜ÔÏ5sìþÙ¡…÷zä÷oÅ·¢{þ÷EÈ6QmÜÜ&¶~CCêgÝèÍÌÁ)±ÿ›Î 3—@coeu ­ñ‘]Ägíoº\•4¸my'ÈÌ%ÈÐÊV\ÁØóÝ&gRVƒ«ÚŠ¼"£¥$d´¯y;ø¨kªHëÝ ¨¦†—ö2îãô(vä›y³ ƒ¸ñäE¬¸6äd%¤Û†ŽËîX<Ù)Û'å#zŽ/ž ßÇD$•M|뺸§ò„Nd 'âövþ -ûéoÆ°½~÷á{V\'òô5Ð÷,Oh?hâCÉÒá7Æ·#{¯‡~åq{)1®óÈ»W2“z÷òŠC]èð‘òd5 Íëjj¢ºñí‡2´Ï³V^ |¾ÙC­ÓŠRKÓÎ ¨UÑŽ¦+Ÿ%¢¯"{—Ò?Ïvxã$ßæ¾òp;†';]óˆn>4d>‹Š(²òËÇþÙ6ÿ<¹ ¶™žžšcr\Šoã7A;s#¶Ã~MèûmBÈ ¯„x Û¸Ð꥘ÆÝÒ)öˆ›Á½%î+œó#ÙF_OíVbLë¡!ϱMÊ ËÞÉ^î²Ë€çöN –ae}Bò–ѸXÚ¤ŸI–щ(­kXâ‚èÃâõ¸?¾TòÛˆz½[âfm("åñ%)Ó°Â6z]ÉœóBòó2щÆÝì”r›fV|r÷°T¸–ñ¤‹›’#´™Y¿Q6$.§sùºçuÿLC“Ë*wŠRzу°eÝk~O­œ=euqoi™ÒTU3¹{õžŸ¤’¹oË7œ°Í“>äðHJ×-ðÃî]/ÙË^7ü3­n{ˆkyÅtÌeBò›ÎŠ¹Ä¶®ëjJª›ÛFvᔆ›Ût q%íëW=µvv•R4®eD–w+**›x¤Þô¢$¯êðr10å%IHÒüQö£÷ôædEs ïÔëCÈb2÷ß.îçc ÝÈÞÞÄÀ)Ôîq†©…–¼y$>Oéi ÝÏ[Š,n‘•’1ö~jç› ¡§ k•mUÚ¡¤ `æ™zÝ;JV^çn)J(mVTV3÷J¹á'+#e=ßv`m}i{×&[¹x‹KizV¢„š&’¤™Gâ‡ÑÒÒš·_/ú„º )Ün#Lò2KPP9ç··ìT-Ü ÈÔÓ7ÒtLŽÞ“Û6Ïϓпj矬® «îÕŒÂKzdH—=Òíü•Õu\sçÛ(×l-äŒ\ì_ZØßV~À“ÛDW‰ŠKêÚ:FX9:ËÛ$㣻ëëM’Òºæ—iåò@ZÝ%´ %w¯èki]q‰¸v?PRAß-w'"°ML;òO$©Üô+ߎ©TUT0õHÆG$'«áR@¯ž³²3‘Ów¹Wnç|SÞìÑǙ殒Fá =_îÆ?”mô•®ûN<Î%Jáö0¶¸AÚ“¦aQ’ìÃJB Í Ò"b® *’ªîU¬¤ò*’œ†¤Ò½ˆn™#¦lÞø-f¿Ê6Ü¥47‰^ üÀ妄 iIh¤DÕQ"ßOkÊJé?®Žk=½eí„>dk(gø¸íI;wî°¿Ä^öQì¼Àý&"á Ío¼—н®${É,n-¾ÏÖÔU¤Mƒz|ܯˆ›Æá”æIÓö†ÃŒ1¿ð›$ÔÀgÙâ2Ú! Ø`´+ªW’§ãš™x¾\¶Ä»ZØzIÆ=i¹ØÛÈ™ûE·´¶±Á¥+ £)Dâg¤/o—=}ÿ®µ‚Ci žßµ£Ç‰e âÚWÈ" j6§·¿±ü­§É8WìE®ÎªÖQ ­Ü9uÒ]KRÐ3o>¦™õ¤‹ôn>¾J{oÞ÷r•±+MëGOz‘ãM3ˬä>dMQÆ¡’ão;)ýø€¤’üåà:b"¢r1ôu?åØFÃ. ìIÓŠ’’¸eÄT\í´×óþ¨ÚȪ“¥²ü„úiY)qÿ**nb{[UE×ƸÂJ’|Àûݘ&”ÚÐ.*$ãS²Çc›ó—üq¾×Žžd HÛ„Ö2£k–Ü3‡bšiQõô»žwäî×&Õ‘HR^¥D'Œ®èº$·gâØ£ß"]¸àZMLöcjæ$Ï‹{6bÉw{¿ž‹¬ÝÆy¾’䙫9(ø±ˆ¶[${ø;8ݱŒl O¿/¬ö(´ †,)TGÇ¡p¹©F¾žÇ‰‰{ 3I#4¶ 8?M‡ç m4Y‹,œð«LÁå+_³ ð#ÙÆÀPJÇöª÷“«^ñ¸Xûdâlm›ŒèÊf1ýbزâ[©ò"—Sfíµ5Ç|ÃÉ[¿µ0×´ÉcÝr¶P¼YE̵¿ÅLÊ-è„¢#±nÞ ¶Q0ˆÝäµ g–”\[ ( \ƒîß‘R’SÑ–UÑ–S»lú0'¢ÅžÖÕ4Â6½è¦™¢®wÓö¨l9˜Â‡— JØë6Ø -—$"›eÉ$ %=Ye¢Â‚?ÿ¿J·âÌu55=Þâ¡KŒbâ«Ø|Â.I ýÕæÙJÛœA¯ªÔ5Ô$´õ탕oÅó¬¡Øæ&a›(žê3©Ëd·\bÝÏ:¯ÛšÄ´1Õ5~2ØFT24¯RLÍ6ªiMZDÁû¯ñzlvùaU6g'róÖ· oáT Ž³ ”øTAAFJÕä²stPµŶñ*ÙºqÝR?¦/¹½nî!cm³k */*§Á9R qá‹"ê‘[×]ïŠKÉ(_v° oL@ûWˆ™”®¬wîK MËÊ*R¡ŸÛ§ /›jXº™Ý ÑQSºû¤]3Ó6Mø˜Ô4M–Tòª`ù=I¼( £¬ƒw$¯¡uî?ÿæør,ž“sgRúAÕ»¸w%Æ HX†Ö0¢ßÏšZ™*Ý1u ÑÕÓ’s©‰+o&I¨´²³n”$¡|0“"l3,L2 eÇ!¦nMUüœU>z”š§®££Ã×ÌÉGRè¿®f!; EÛÐhv;&tOu¿ ¢!záW“ðnlªø6ª‘š’ˆ¬*em))±ó—”ÂðÄ9Ûæn,ÿ§…*ÊJRJzŽA¨qMÌ?ÛLÊ! kŸ»pfRØ61ÕíbÒZAœuÅÖmQÓÌ…€¤di +k-«7to?9ë|=UÙ›¥ì7¶|ƒÜÆ+<”$gÛ´‰½äX·ª"~Î< eô̤ˆÉK;òºg%ªy/²…˜IÆzö¥ô#|>Mh=ÝË߸’8OŽòÒ%f7œ5ÜÉ#«füK–"°m$m£{lÕ²,-$p¯¥¡ÔA¢¤ "C •»Yœ+ÈÑuÛQMÈ'Âù‚¨Î-_w «Ð¼¢×%õ¢ØSV7¯ýCØ$¼ý¸Üæ8Û\¹Lv};û'ºvÕøJÒ';K}Øޤ6NBrÞ‰kÜŒj^#óØÆèa5×6^úV­Ûp9 Ï ˆÂV]Cmqµ[xdqlcwÓZ'¼'¹…û’×cW"·ég)Œ3VÓ?r4u€X¾À/HíCž±™Ò"?©ÞkÞ?Oqmó {ß6VQã·­Õ¤,bŸt#Üoï\S“wÊÃ6 |šLÖ -¬ÑwëF)ÏHrñÄö9;JhãI¶¤eX=ºè'fú4c%⹪»œË‡¸Š6lü.Üñ>Œˆ‘”ŽÚFL‡3bjW”D/ØänkÈž7Œ\À]îI㺊ôl'3Yëö<ŽS·ÕÈ Oó¡ˆÜÊŠ’áÍQCGl“п«¥(¥í^‚O멽 ‡»·_n„¥ø]·ÄaLïßÕÓÕ¹ž2ΞI¥&ö {U‡§O:v®XÜõ©#•6@‘<'êQâ¿Î6&F圊žN ôº Yð^ÁªO¸IÇ7qeŒ"'Ge‡7 ­ dAòÃ6”ܼüÍŒ|ª÷s›}Ûà’ÔÔ§cì‹›c½h«¼ ÖÈžI½ÛðñÓôOf·šžŠ±nÓ‡îyÛ‹iz?aKÀ=$ØÄ¿Ý+:éòÝÜ”(c9ܱ#køÄ´s' ۲͈¾ŠòWɸÖ|R<¯t»(©ÅÖŒ“UMÌ-ÍÌcºžàégí€øE!·wÛ88ɵz×¼ƒ>ÐâÙÆàmЇ÷å½Z³ÆQZÛ„ŠäYiç¦gÝS$a§ì­ô”š|þ¼ÜÃÃ3))¡¿EŒ¦}Dqú.^Ô jÜV=cSHHPæ3ÑsÿŸÕ ”ð&öÂ%í|*`›^6}ÜžáŽgR8’.žŽrfaq}È;ÀEDåNB?ïȈËëñÌÑ7ÞGÝ1+m€ndæÐŽð^’;7Å~÷é8hå?Áp‹+&š·Óöm˾˜û()JÚäiÒ JOW7±•“2 iÂ~b?²Ð’‘´ !ÎPýÛj‚êî9‰íßæP,;+Ï)“& \¼tñ‚”ªÕÃ"bý9µwFöüEq²œ¤´~\LVÇ!{1©Hrî;Fõ$µŸö}ûmÍ™ÙÅ–µ«¨«]ºx^HPP„$­ï QxÙ˜œ×6…í¢ò÷âQbE¥Œ¤´‚®•¼’¼´ŽOdqÚÖªŒ,YÞÀ;²ùF:I§WÀæå%É·^.ÞòV6¼&##¡z;+±ãàrv軥‡IŸÐ§[ŠÖAÑ<·ÕÅw SK«×Ì¥Ô,处•,#ˆ«±MkFFº’ÊF*êRj×ëpÆN175’P·ËX|bcâWC,,t¢ûM¯Fµ³ÓEözx7rv1‘RU3²“6ñ+¹±‰ŠGÁRlÍœ†¦’¸Œ:YZÉ䎋âÕWxÊ“Ôºah¨%®h ª­#*eì[+;åå¤Õ®¨èˆK(»–rGû ø¦®‘Úeß>¼ë„¦u-%ëÈñ¸Â×$Qq “ë2šÖ¾ÉB—È6O§°pn^½|IRëq5g}(09FŒ$¥btUBBBÏ57¶moÝÛ¦<[DÚ4˜c›wOD䯇ֲBóå¤n’du\’K%E%¯&õ{úÞ!)jh+èÙK)Îm>’”¯[Yé©^±•4 mHlgÞt»/.!©®§¯lêqåÚUI%ËÀztÛíª IIVQ¬lÜ…"Ò½IÚ8æñKªŠd«¨Þ¤Ž]S}’œžªŽ®¨”w±Dš_-.&©|ÅÉæž—˜¨°ŠÑ5i2IË»"¹óÏsMŠ¸„W±À¹wèî¬õàŠM<)Àíõ~%àÝ~M:î6øõ (¾•\:Z½Ï\aÄ¡Íà(…”ÍGíßÝǶ„ID; .ž *ÃH,7Å·Ðq“M[»X2ÝÈ âS6C„š±˜º• òUNGªž,íƒc ވcÒ@!Ìf&ŽjPÙexHâT±z¸•ÿ Ÿ\8rÙúÈçqÜ-M”¸÷Ýý Á7[á“æýWž,b¿´°>¿Óþ_)œƒÈì×ð³#já{ø[ ŽÒ㎶ÅÞ#{w÷±ÃÅ:r+Úç7ðï¯`anšÄ­oûò|”`§GŽ‘Ç{¼5<“–ÏáéïhÜ>ÛW3ω‰ç‘Øý½Ÿð±ˆ#µåTãhïÝß¡$l#HºÖ†>«ä¡º ìáv<úŽCݘ',<­ËÓµàS™P ü% qÞ†KB}4|*lÊ)ΚÁ6`(Pà'À6P @Û@l¶ Ø (`° (`° (PÀ6P @Û€m @¶ Øl Øl ° (PÀ6ßÔ6· Û´h,(P~ô’øÙ†Åb1èô7nZ¹G›ß 1¿Ë.®!Z6žWÝ¡ü ‹õ}]; kÅŸ¿hÙz‰Èh¸¸¸|?¹ !ƒº³³_66Öß»{ÊŸ´Ü üEÊ}·{ûªùr›Ï¤Ñhaaažü)ø~r›cVr¨Tl^%ð'lÀ_Ó6xnű 4 üùlSQQñ]å6L&³«««€?uuu+++ßUnƒø±ØÙA4‚“8ü¦¿EGs¦  øHa!ú?þîï øÇ-úú„mÒÒ ðQ5¬\de‰G ·€Oqmó?ÿ'Z\ÛÀ—܆ÉDBB\ÛàÒÞ¶€/ÌÍ¡ÿþßl£®~h†ð­hjBÿã ÿõ¿Ðûoè矉_ètˆ ß~&Åac=~Ìãß–…a€ï,.¢à`|gyùûCà;++ÈÛÂßY]EžžøÎÆru…0p¶qv†0Àw¶·ÑNÃ6¶¶ø•ŠÌÌ œ†mLL ð:ééA8 Ûèè@à;L&RQ0p(*B 8 ¤¥!œââNaaˆ§Áùóø ç[ˆÏœHpüÇ@ 8Üæÿoˆ§Á¯¿B 8 Ξ…pˆ‰A 8 $$ ?¬ÿ¨éÿÚ)ëཿùRÖ—_|‹¦<©u¿Øû¯`±¾ü7nY_×;Žyë÷ìæ‹(+# ZýGƒÞÕØÐÐHÐÐPßÖÝ¿E¥sºÃWôf_WËÆöîú‹¹K£1YðçšùËÎæ|S=§%1MÓKì˜pÐÎúlcçø—O/L¶ûEY°xÏd\Ó0ñµùñƦÊ79Zuu´³þ£±¦ñó/÷Bb_<þìÙ³Çî×´?;WžÐi©fêB-C+¼O°ŽôOüFÍÃâÖäþ9‘ç÷UYðu|êz! ©ñ4ëÕóçÏÓ“cu”Én‘EŒÏZíó\ÿ>Òö_*!¼Íp¤=8ÿØýXn}#b¯ey7]a?Ádò´1þÁØy饡ªpæœâÔ79Z##´´þ£±n((ZÔ?Éî1LDÛ°S»àø‚ð ec±¶ª¢´´¬­’8KâÄÜýÔÓZRR\×:@#ºÕÖ€Ü>¼Šß»µð±¬¼v‡ŽXtÊ@GCIIIMKß.“xÑhÍa¥gUuóë;œî·»³^Q\¹Ì>óR·–ËŠªÖ¿ê ü#=¯ä¯Üaì¹a¡:CXZub…Éb1Æ:JKJÊ*>L,ípLÁØ^lüPQTRþq ·k~&¨ÅÙNóûŽñ¢uW§k*ËJJË&–ˆ·ìld;Ë*ß(oØ3k¼¿å}}{§Ì¡Ž†º–&·!×o©i/lÒ9ޢλxÄ--~’מù&GkjŠfg¡ÑHÛôMrÏOŒûÆâÖaC 銋†§qßÂÈÌÆñqP°‡±’Ú _œn+œ—_£2&éT{#’¡:YXÙ†“µL6¿<{QKGG[GG__GD@èUÇ(s“×6û«9h¦§Xè§ÿ'¾m÷˜Uà÷3ÚûFDPT]S ·¤–¶Þ½€Ä™mâñÙÎWj*Úw<}‚#Ã/ˈU ,7çš'V"îâ-ÁXËK’¼²ø…JîZq”Ãe 5=mmmMUm[ Î|Ùq·À¤¸YkÈj›¯îúšlªLÉxšõ*M,ÿ$53=ãÅÈÒçLò-mãꊺº Ñ¼ÜFHìÃÄž$k¾ƒgR†2Ý£ô•~EQ±7=«¸C]–Í|?L̪fZnØÝ™]ÛŶ‘=/Ûïõ¦ä»²úwðoÁ¶Ê™ßè&Œ¿úLJÁøOâÁ§£øÙœ6œ±°>< +ï™]ýÔ$$¬Úƾôã¤Q5<ÝöϤð?[3ïŠkÞÂ'’ÁêQe»%:G2!!/‰v¯Ïò’Ót§ºF¹å®/óºy|m¤†¬b;¿ï8´vS‰»J¼_™•ñ–C¶ù#Gëç‡jk¡Ñ8Ûè]z×7yøœˆcÜÁHQFFÖàªëÆì{™³¿ÜÊêdnŒÞ2”;{APTéʇA| ¤^Õ•h&®_ÌÖ& «O­3×Çj¯¨’%¤eÄÈÊ©E„cX J¸“ÁßÏK´r³ôõé^q…Æ â÷•Ñ–K‚Ê›Ð<·É’6ºÍ8ÚxjóTBœ¤¢ªþèMÏà»çψ–­¡ºœXásÏž±öˆß¦£Ñ¦Ì ZÜ9”½ê<ÏÚÍ÷"‰ K‹‹jZÞ›Ú n“Ù«WúEPÿþÞ^˜9þ–òÙ·ÐÐ] Tléì”çà 8Û)Óå$Á ˜‹Ο?/ a°ð6<•”@£ÿP°Ž¹ù…õµyïÍ¡'¯Ø·e}ËÞËöÄÄæ7åq”¯mÉÃ+jÇ'¼±öæQÇtžÖÝÛøñ÷9ÿ¡&ŽFïÞA«ÀwÒÓQV„¾“‘^¾„0ÀwÞ¾E‰‰øN~>JH€0ÀwªªPh(„¾SSƒ! ð¶6ôð!„áû„÷#4ÓOo/rw‡0|·0Œ`g‡B¡|ÏÙøÎ*•ö—á·šix¹¸À þnñ׶•7¹-oâòW-·Íî\’Õûn›©££SRÍØÞ÷‰Ýø¿l±÷IP7w~•“b˜¦¦½= ê΃ʧâZP\ë_·<é@~/»º{¾Ûfzõú¾[®'ÑRÕ߆œS=|N^^X@×®Á þn±v~P:Ûü—îÆ mÈÂçyWw÷÷m›Ä„ö¿¶mZ‘SRÃoÙfs“ø²Pl¶ÛðÛ64º|5Øl¶á»m0šš0¨Á6ß»m|Ÿ·wtò^¥¢ÓéßÏU*°Í¾mî?|Ì`0¨<|'FM 5Øæ;·Íµ€Wvvv®®®wظ¸¸¤¤¤@nó½ÙæNZ‹’†¾Ï6ÞlÆÇÇ9w ?¥¥aPƒm¾Û8::zxxx²Á¿DGGƒm¾;Û¤·(¨éz{yí7vNOÏÅD))Ô`° Øæ4l£ ƒl¶Ûœ†m””`PƒmÀ6`›Ó°† j° Øls¶+à`° Øætl£§ƒl¶Ûœ†m `PƒmÀ6`›Ó°±1 j° Øls¶13ƒA ¶Û€mNÃ6––¾äl¶Ûœ‚m®]C Œk° ØlÃwÛØÚ‚mÀ6`°ÍiØÆÞíî¸Û€mÀ6|·Í­[`° Øls¶qq!¾ÁÛ€mÀ6ü¶«+¢Ra\ƒmÀ6`¾ÛÆÝQ(0®Á6`° ßmãá¶Û€mÀ6§a›‡Ñö6Œk° ØlÃwÛøú‚mÀ6`°ÍiØæñcâoØ`° ؆߶ Û€mÀ6`›Ó°Mh(ÚØ€q ¶Û€møn›ÈH´¾ãl¶ÛðÝ6¸ÕÖÖ`\ƒmÀ6`¾Û&>­®Â¸Û€mÀ6|·Mb"Øl¶Ûœ†mRSÑò2Œk° ØlÃwÛ¤§ƒmÀ6`°ÍiØæùs´¸ãl¶ÛðÑ6œ/?ñl¶Û€mN#·yó-,À¸Û€mÀ6|Ïm°mæça\ƒmÀ6`¾ç6¹¹hvÆ5Øl¶á»mòòÀ6`° Øæ4l“Ÿff`\ƒmÀ6`¾Û¦ l¶Û€mNÃ6……hzÆ5Øl¶á»mŠ‹ÑÔŒk° ØlÃwÛ””€mÀ6`°Íiئ¬ MN¸Û€mÀ6§a›‰ ×`° ؆ﶩ¨@ãã0®Á6`° Øl¶ÛüIlS]FGa\ƒmÀ6`° Øl¶ù“ئ¦ŒÀ¸Û€mÀ6|·Í‡`° Øls¶©«CÃÃ0®Á6`° Øl¶ÛüIlÓЀ>~„q ¶Û€møn›ÆF° Øl¶9 Û47£¡!×ß,ö·F»ûG)Û<ÒqŽÔ¹‰ê¹D›y%›žjI2÷N5óN1=íý\c'çÛ·¿[ÛÔ74ŠhXÛ<~qÍï)§à:Ÿj”<“ͽR,¦›z&ý«š w%Kwý+–^¿a›–48£ûûÎX]ì㲾¾ÑÕÝíâêzï/ˆ››»»»çß•m8ç…ÍÍ­­­mNÁMuçîÝ¿Z+áö`s¢mZ[Á6ßmns„ÑÑQ777Ï¿*ßmns¤±h4Z||<¯ÿ‚mt¼mÚÛÑÀŒîŽmxô/«ïÊ6Gø+ÛæH3c›þ~È?m<ÿò€m~TÛtu¡¾>È?###xvŒ»±Ç_žÂ6ÀQÛtw£Þ^È? %›Í«xï¯_¿~õ/%++«±±ñ»m&&“YWWWæååmmm„›‡W>À÷½nÌöøž[ àm¦ƒÆ‰ Øþ[˜X´Á“)~ƒs° §žFuuA8ܦ£Âß@õõNÃ655øÎÐ*/‡0Àw†‡QQ„¾32‚òò ð±1” a€ïŒ£/ ðÉI”’a€ïLM¡äd|gvEEA8 ÛDFBà; èñc§a|gyyzBà;++èþ}|gm ݾ a€ï¬¯#GG|gsݸa€ïlo#kk|gg™™Aà;T*22‚0Àwh4¤§a€ï0H]ÂÀiØFEÂÀi - 1à4 “!œBBNAAˆ§Á/¿@ à/,ñóçŸ!œÿöoæà_nóïÿ¶à4øõW° §ÁÅ‹Nˆ§Œ Ä€Ó@Aøl&¿ÑÑ!¾ €ßèéç€ßXY¡©)|ÇÚMNBà;NN¨¿Âß¹}õõAà;ÞÞ¨¥ÂßñõE øNh(ª¬„0Àw¢¢Pi)„¾“”„òó! ðŒ ôú5„¾“ž=ƒ0Àwð4*%Âß))A øNm- ‡0Àwêë‰[nøMOzøÂßéëÛpLM!|gzšøÒ ~³±ll ð­-tí„€Óàʈ§ÄþÂb?54 œ::ƒß!gâÿ¬/¼Žû‚ƒ×±>/ë˜kìcwË»½£;bû–Ãî×ô`;'TâK»?²CÖ?ÛoØZû[=6ÇÑIÕ8Ô’,Ö7­íá­q«|¨Í¶×— mö–¾\sÖï|ü÷£¯"ùJ†*Âd­Ó¾ÐqØ :ßß°ºMã}.?DóéûÁ#íGoïYÆ¿¬N Ï®o±Ui+ÃîÖZÂB—. ^0EìaZå¬XûäÒþkòîš«;=¢°“¨ ³òE”Š¤àÏ¿üCPR%úe9I¼f®ûõùÿ<“Ü8Ê©.{·sºÂ­ýˆ£+Š~pþâÅó{œ;óëÙ«É'U)Í×J€|muÿ˜6Æô¥F7ÐX_žÈüæsûÛ‘×Y*ú¯Ÿ~Á¿_¸pQè’~îÜÙ_ mv_ds ÑÄ2ÙZh¨(!$," Ⓝc³Ø—sñ§_ÏüÙ¿ËÛà0§Þ¿¢|5”ŠßÇdâw•…Iš¬ÌuI !^& (,$ˆÿÿëyXÒ»6Ù./!zpì.œ•š§O ”.]¸„¸x^HZ#½¨‰¶b¥*¡u5„²'ÙÞje”ýCY+öý·_Dk?Îí ÍË@Õ1öí-0Òõì—¿‰”L±ö‘j*˜Û9E]2T–Ƈ· ÿ$÷,ÐBÍÏüã ñ °ðÅóç.\8'¦h²Hûvírù2häÄóâ ¶ùìÉ£xÈvN­óž|òC´ž~øxämY¶Ê÷žßBÿÊÏámÏĉI GbLê)çÌ–š˜;¶)ƒé—å¯xc±¶™8°Mîžmc'ØVKZ˶uxvgg{~¸å¦¡¬þÝ'¸{Ïwg‹üC\Ï>r¿îO.ÊÝðK'l㥨o·¸³»½ÇõD¤ùÙ©“/Þ /âÆmc\O‘Lئ÷­¬®Ýê.ë`#;“±½½µ½MnΑ¸„Xx[*ubrqRbÂu;ë7NÚXž™]åMJöÿ¤Ì+‹ Îû›èöÎ_“ðÉé^È×™Þ nñ<{Óó6Ê¢éï‰?¾F›¯‘»$Ö6µ˜ôím úá‘œ¥ëâ¿œFg-Œ·I É´ï íƒ­`IMô‘•Íç鈲C0Þ–'uQð]÷4¢-›©ëh©J´q*8ÛW­Â¶ >DÄܾm(oxÝGïqþ^ݱmÔ¾Æ6Ÿº^¨H‰‘5n®Ñ¹!J5âØFUPøí¢Tq‡ÁdíR¶·¶¶—Ç{Å…ŠFY”v«íå[¬cšçØÀó4÷ÿ`›rçõ™¾kZrÒ2"bŠ©e=lÛ„ÊXqs›ÒÔG22²òÒä뾩xü¢­i9å0w{’‚¶ï-ó‹‚¢2$É<ô8?L÷yVšµºœÐ™_ÍÝb¶éh¨ê¹”¨YFÉP_GJ\TFN> §iä”iðý[W t5 F·XhˆÐ7,I¢/gQkÂ]›Œ)D]™^ÞƹòѶC¶1SwòÃgÉéî"aA•áƒ¬í.ɉŠæt,.ö¾T”1—WÔ\ã<Í·Pux’tÓ; ÿã]´§¢þÍͯšK¡D¯ù-µz’âƒó[ìÜf\WÈmF ÛÜ¢žÞ©®B Û°Ï&,Ä å%úJ‹ŠÈHŠé^ó^ÛÞE”-5…˜äW¶Öfª 2÷cÞ1–‡ÅɪŸ¸¾žõô®ªÁ㚣bbÿci¬Í\YDÅÒ­¦gúð|±Ÿí «Ì#`¢W6¨«³TæbßqqÝ…Ýc¦±Ë#ÍbâZ£»è¶¶„kj;ï°j ¸.guo‹Áý'¶„ Ìç§m¼ÿ”²Å:OM2­É^´#ÆŠ–˜îû¾J -Nõf{«”Ý“9»^›î4Ù˜W’j¤pÞJóÒWuˆù²m†ÛŸ9dDÛÈGvpIÙËmT„ 7×öÌ°"I°bîL·æêÊIÈÊHK)¼\d·x=IZ%!ô±‰±‘„´B|^×je¨ ²Éâ&“ÓcÂÌEKº¦¸[13·{ö,|r7©æñÛz“Ì%òÄÖmFË‚E䯮҉qrUÖ2²1û$D^Ö°7ðQ^Pz`~›w„…*Šé¹/ÿ¤\—»PûwsŠƒžBàSâïyÝÒÎïŸÅ¿Œ½»ów¥ÞEb˜æûÉ_KdòœÍ+Ó½D%”]-µMCj(tΣÓJ¿<É|™Ï¦ °Ð×TKÛÙ¿¿ñ¹¿”ÓÛÃÓz ¡ôÕ䚥¾l%åÛÙ^zÖOˆ½ï®ŽËk;u¿µõLdÛÆ‹¬b˜[ZZÌæ]QÉØüúI±Jô´yÓ;Óší§t#–3“âØf¬7WJùJIeE1w+ùµS¬“l³×¥W¦»Í®8Ì°ÿígu+»1ç Ô$,=SˆÇÊ I”ܳŒBLdœ^tïÙžS‘PîØäÉGV͸{¬Ïµ·2ÒÔ6Ï.ú°¼ÍÜÑÖ½¯k©Ùš«(fÖÍp]è{#*¨ý®ŒS뢢¢Öé½>Á*‰q¼ ¢jx/éˆ|?· YX*­¢ª„»•wÕýŒ=Ûl콋²Ü«-*šÝ6‰v—µ„Uú(ØZÁ<¸owfß6µ¾ ´ˆ)Gˆêa¢äV™Rµmž^»—L_ë—6š¤²º˜h`á{n ‹‹*kšiœiö1¶Ù;\úªÛU‹ü>bî?ÛüBÚøñJž×Ç´_wAJ{Ñd„ªûÙ͸Z$.¢=·Aㆠlsüô…ÉÜ¥g§øû=ò÷Q”&.0ömzYÖÈ?½¹©±±©)'é¡Œ² ƒ1()Nî[a¿}@APºoj•·Oæ«'UöqFE²‡b^;ž7mÚë*d6áGíµs{Æ Û:ŠjûrN­³o%ÉÚs»Ö> pºÿµ×6$YÍðèØh6‘1íŸæNZCŶÉîA´EKYÑÈŠOhkbß62ê±ñœDG†<-èÙßÈ1¶ÙKá¦úãÃC|ý9šë¨=®ÀS-EÉç5ì®K™R‘}ÿ‰2Û’A–3_a¢éÁb=ÛGx¸ŠÌ½Çpc®ÏÈ ¸†×óX‰Å¤Ó†ZK-Uå$É’¢*–ÝóÔ¥þá ’!Q1QœZGFåVüéꙚԟþã'çä*Þ©Ù±¶‘•xÃ9ö¨ˆ”¬jüäÄ@±˜€€ Á%1 2YN=(µO#™4lÕWsN\gzÊÚ» ÷»×mˆzP|L$¯ÍíÀ6Ø<ÔUK5 ‡Àš>é¸WyX)_õ*ØÚÞ$i‹ò!ÓG'DŽζMëplY'Û?5Õ+m’uG6·cò¸u›ƒ“Òq¹ 'í,—Ö°Úâž/2Ï«ØPöm3½u`› bl9‘o„¼“·ÛŸ‡¿ØÚ‚YŽËm˜÷4E¢Ÿå×UºÚ»ëÉ$¿©m+ %söíéUIéÔ×ŪKo_–»S˜=BÂâ}œcN_H(2%³gæ AÈy¬”VÉí€OîJç´b·P}ÍÔ/Ûû5Ž®¥x;„%¶ÎŽºü$¨þäYní‡ÒëÊ¢wÒ;jEßòµRÕs‹v±Ð÷xæwÝÀÀ)Ï·dþv¡eüÀ6oœ åí¼)ì¶mË ”’~›þ67ïeR°¼”dL)qÊë|*!qwʈÌ?þÍ*’ȯ>¶=3¿Kôüð{BÒZYùy\r³_•íœpÛEÜ=‹íÃœ QWG5ÅÏ•R¶é~-$¥ý¶¸(oŸü¢¥ÎÈìÈ´ü|Ýfðý3’¾KM}ûgÁ׌„t¼Æ&ú”¤Ež×.°m3)E"Uƒdc¦WIð'Ý›I{ëZ,ÞŽóÐ짖‚ºÁ#¹Ìþ‚ôÆ€ž¬˜W|–†JpFž…¢¤^ÏRßëóÿÈÌÙ?ö¼WÙKtVcº»’õòwÙ'ßÇÐÚÿù~<ê}­Ä÷m3?Ú"rN8® $o#oßæO®îŒ÷æ K_Þ_Û«‘(ï™G»KÊçd»öÞ>W—qæ?þoÁ;éÌåA±³bµ;óÌ¥Ñ&Á_%û™È]KAÛÞ3¯€½‡·9ï;FÍs†ZÓÌoÇq£Â¤ú_Óø»€PA'¶Í¤âÅ ^•ñÔ0ohaÓÄ[Ó¥ΔÎuÑöÌ ¶}FaMMÅkgÛ›‚R%-Ø6ç$‡¦Ø¶YÍÿù¢ÜèQãÑWþÿùÓÅÌÚþCÜë×ùpoÕŸ`Ým.N¼+È/.ÿ°¼Í˜lÉ-¬œš*®å^Å^[/}—Ÿ—_ÐÚ?ALo+ïÞ¯mqϳóƒ9¯^÷ÎÓ÷ÇèDOÅð,7Oj+™X&† mñcÞ›×v–ÇòssfñLJÂ$æSOS^nnuK?ãІŤït7U‡9™è¹¥×µõÓˆ…âíÒœ‚¥Íƒ$b¼åCYS';øXëË3ïËŠÞæ¼-*{?µ´Ås;+#%%DïfíÖ—Lm3ðK7–FëÚˆ±9Ùßž››{`‰¼Ü¬¬’ír›Á¶ºÑåƒ;X:ß¿-*ßÜE›«ãoy7‚móÛ†³‘­åÉwu½Ç\NeP;ë+rr šú&©;e…¹-ýŸÊK‹FçÙóIÆVIQñì;ȬÕËR²¹7?»lr蜱wWÛÑWq&G´9|6¹®®äŸZÔõi–X–XË{ÃSïÜì—y ;Ô÷ïr;f(œ+Òø»;«9s{)ÐBw}qM }oë”Í¥â‚<ž¾ÍÉ›XÝÚZ|WZC㙂}l(®%æ¡´Šü²ž;ƒúªr ZG¨«ãyU½û7rµßÝ©*)èŸÜèüPɳõ7Um#ÇÆ`}éS]ËÁ]^ÔÙ7¹“Ë[ êVUIQnÞÁ6rrr‡æ×8 o¯—æÍì|Þ<ÌùáÜ7Ê>´R茮úŠw LúrAaÉú6{ š6ù¶ l“Â`E¯Ìy¹áùÍCsp{{Äd‚_>ï§ÇÞA°ßÑ1¹ö1·%°ßýÉ:|ÂçÝc,ßAÜ$ö¸Õ’ƒórßÛ˜À’å#w;첿\³ÍiXˆuÜ],ÇÁ¤ï¶»ËÜë978ø‰Ï‘ÛhÑoÞ´Ê8&Fí-ªlyŸqR•¥9ÇÞQÍsú¡[ëÒo;:¡q?»µ˜õÛÇ~äH>»‡œul…u§“·Jg·Èaè<Ûýª[ ÷熟÷ë#ƒâø{o¸¿1(Û›o=Œµœ"hGn®¼u lóHŽ˜hg›þ]%ù›7Ñ3t:ãß?ÿ¥ˆ ‚TDDÅ%y–Rí[E¬SÍŒ‰½í.X(‹Š(™öÏm~"¾¸A}—Éb±~Ø Ÿ­NiÊò¶Ž¤„øëú¿¢BôÿIófÐ*ý³ÖqrB  õï£Û0;Á8.Q9z1ÿÕu8zÅðè¯h[¬¾ã°¾œžZU˜‡÷}¨·oƒmŽC}ûfb¡#“'Öq÷ÄÏþÁNptí‚ÅúºÏ™²X'ŽMë[†‰Åb}q䳎ÌßÞYÇÝo}üáóÉáÑW}«ã?4½úÚYïg€Ãœ¿õIáÏõÄ©ÛW«‹uÒܹƒètð oWžj¨êžàÓYos ºªgi®µ¸qd1ç³2_oÒNÇöôòÂWó«Þ‡ºKß4|\üÒ™­UEÅïÛ÷ÏYŒõܬ§CË¿[$û«ÜÏ~ìxõâiFffJÚÓÚŽ!÷“¤_fº#7}¯àï…²¹ôöÕËô´´´ô´””ôÒš¶möJïÊxËë²¾¶˜•ýzy“÷þ£¬ä§+kŸž¦¼à]Ÿÿ&¶Ý^š¦î2¾^PÔ•-*7l« /óß/Mwä”60é/^Q-5Ñ›ªrJ›çÝ`gMÎØâ¡ëâëˣϳòg熳ޔ}ƒÏÞ»‡vwÁ4¾}ý*=9©q8/Ði«¥9Ï’ÓÒ“RÒšû§™ì«6ï ^&$§½*i›*­ï™ÂIÀÛÔèòa^™ÓB­ìÜ‚ïÚ]¹ø¡v‰órS›»¼U`l-fg¤¦¥§d¼ègo¹¶0+!95»¨yj¨¬¦sœ}ž^-Ï}‘œœRPRUVø²¤‰¸‹osvàY:>u§¿*ªÙ`·*emö5®cƳ÷ÍÝ7ŒåÚ‡Wy8ÑZÑûM7þe áMvÕÈû’¼—/žeWiy÷n°Ã3ÇHÛL¨K\Ì"lC©}÷:5==%%µ¦ýçÙñ¾†ôÔ´´Ô”â:vúA›úüEKuIbú‹Õmæ^Oe&º_×¹ê½?’–Fêž”²¯‰oÍå<ÇÙGjÚ³žÉu´³ò4#ml…›XM7¿}VÞ7Û[ô¢„¸‘c¾¯¸¢¡·º§ZiÏò*¶pVÀbÍ µ¤ÄŦ¦=méIyQÉ{¼ËÓ=ä‹m{ce1ýª€®/>ØÁò`¹«Äçß©K£¯Ÿâ§¤f¾žX¦pl#)%_ýáCfjJ|RZûGâÎŸÚ ·±5Zq´óÔêîâXgBnÛaã2'šÓ“ž$<©n&n/`1>uÖ¤&'¥¦$ç–7ÒÄጴ¼Íªøø¾$?ëå³¹Õ8Iê«y&+ ßCÜS@m­.JǤe4 ²o7š¯OÉ*©­({•õ"ùÙ›©UÚrG©¹®úýàغiÆÖljBâò6swmÌ7ìåîÆHXZ Ú•·hz–žò$1ýãÜn2¿[Ê–þD…‡[2R ² *WÙ9ZÌ=åâú†œÌÔ„˜ØÒ†~â>ŠÍ©Ûn ê¤[à+ü‚–œä¬ú‰~ˆyz"*LÃé);ËãªÂbeìûG&º D„/¥VMl®/¹^•Ñv›£PÇšÓ¥eLñÉ¢"ÄæjHîêÊâ|_)ITzh–ñ±ä¡¢©ûÜÊJ×ÛHA’Xø«ÄÜyé_4DçõS¶6·vðÍm*1ZymÆ7´JÖV»J’$eµ'ÖÐp¹¿œ¡ËôÒjoa¼°¸ÈãLœ±2‚n*kÚέ¶”gH üÍ!OFµ„Ä‹{–§ŒU,'ëø{ZΩ›«K5)·º(Ó9r¼mr¢l.Ji· Í,ÍŽÝR¾ŸÏ{><Þ6¯>¢þ[¥ë'gçg>µI‰’J‡¨Û¥Ò²­ÃSó3#7E|J'½O\DÀ90k~q‘Î8˜ËÏøÿûYR\NÃáøÎ}3Õ+ŽaÓóKÕ/Éd£9„îªI{¼¬ãœi•¥c«G[3¬¤¯½ Òз7ÑoŸXܦnøi‰$–16¦Ô…„’[g76ç¼u/þ_bwØFê‚ÄÞŸ¨NZ’.1eèÀ6ë²"O«çWÞøkÚø19¹€­OêÒòbE¬‡”ºùü6ÚÙÜd±˜[›Ä¼ûcsÈËzÞ”ey²M^˜\2´²8=pY^¬öÓòìP‰”„rÃèÊÚê¬÷ey÷Lâ#äeÉvgIMƒÓËóS®Z"®oæÑFƒ´ t]÷•ÅÊsSÒ1šZî¬U–ÍÃÇpØÿùŸb9õ}ë+ÙNš:n)Lꦛ¥êóÚî­}s*"(lq‹‰ÏM¸k1é4 ±»úIMVÐÐ.rzq¥¥$á¢ú}¼_Â6;«IìÂe-ýKsã÷.kÞôJô7)ÙƒËs#…ćfw˜ŒÝ- ÞÚîU÷4"­jäŸ_bðöÛì3?\{QÒ™óûdwþ%ñ›œß“=-ÝKØ÷õQfõeDGwPž¯¥Å£Œ‘±Éý¼$\W4®š{~Ñ}ÕrÌúÛÑ5Ö£¹ÍÚ "‰4¾ÊYÀ Ù¨ †ç®H†•rï*Œ4$ùe6 ƦÂyßFö¶)k×4Eœâ†z#mIWœÆg—çæSYÂBz›ô%CÑK£KTöÖ¶ H—Ú?o›Ü+Ó0vÁˆóÒ1p-ã©î ¶FÁWå-îwoïÁs;Yß¼•åÅ…Å¥æ\_I¥;ˆ5$%Nj˜X8´¼Ìþ$EWA‚©®”$ÙÐôjDÊëÅm~b—²4Ø;ÐÜØX_Z G(™A›õÁb*Ž[ ´5Ó-­`0ÇD-V²¶/‰u§··ŒÝR9ÛlÏ0½Ÿðai°”t•øÓöxóƒÅ?‘\Û¦WIRLó²¹±±±¦’¬Œ¦uÇì&mÐöÚÜð@_cCÃû‚7¢ª&ëÄ·;t‰“$Û¦Ùú]/» ¦2:·óyË2yfË O}Õ>pj©jß.~deÛÄyz¢3SNÇ™PUª­¼Q ç–¡§ µŠê—”˜^cm/[)]¸Ÿ·°¼8¿¼<ía¥iã•Æ¢ÿ!a²Êþð?£ýÁ7Ü^¾¶š…=ã脯óö‘¸(RǾ™±³¨qA°h ù;rrÆÚÒdOgGcsKû9k7œãźÛ§9GáiEþ00Â2ò?;“òñA x†ÃTgÑEÃN¯˜ìÊP سM çøYC±O«L&u-󱃀ÀE’98·ÓNZòu÷Û>Äê½lþòúËg¶Ùž©–Q›¡"öpD—åãÛ?º)“Ÿ·r¶QŸ`ä“V‡h+zÂ"¯9kÌ-KYç¸þ ›s‚‚BBÂ"‚çÄ”æWÚe/JOlì²7FµÑ'Ÿ4“Ê2U»™Ã©Sœ—®áâC¹Í­+fN‘ô½Ó7uq\]B k¸¹4㱈 IBÚ=± w`}Õ‹Â\/ ÉènÒ†ÉdÙþ‰cGƒAßÙÞÚØX‹»­)f÷ ?íl-©¤—ú,;#‘,z©d’P¼µ¶d×äNž¯Q@9þwsú¾m®ùår6ÕöÌÂ-¡v²=Sß+…›cŒ·—¿wt&% ÑHAô]•JÝœªR )ŽoìÛfÇËTƒ¬{5íYÖ‹Ô(ó5<žw»$$å¸ë6›Å”Gç¶^F:|ýåm¤³ÃëÞ¼eäSÖϱìÜ`„†)Þ\U²µ’ÍsNfé8ìÛ†º6wEYFPˆÉ g~Õ¿å‹F¢ÏÉÚ®SØ·®wú ¨Üe°mSÀþ„ïõ¬ýðî® ‹HqV¸Ô5kò¹°!f€Împr5¨)(rõŽ_vÎÛ'7u”®ºcÛÄÜQ,Þ[·ñ¼&û~`î„kfÿlnãë ¶ÙßTwÉÝnnó¶YcRw¸]®§±@QH¨snãŠXZÓ(çÁ§vR!Ù-è‹«jŸÙ†¾Ô%/&5±ÁyÃQ]æÕàt ¶dBÝç/e}3êÑä…öª*¢mØë‹ãܦãÃ;˜Ñ[å\³Ø¼"-|bn¹oÆ!Û°ßùÆÃZÉòuï@Ö';HçI-T´KÙàØp{¹ªÐù´†©D ûWƒ‡ª°Ûǵ͡ #´¦²œÆ±Ý½«¥h}¶ãŒ€Õæö¼¼@1û*ÙîòˆI°”ýd¥Ñ·o¿h‰²×{?¶ð[¶‰ÿ0×óVÁ9–“Û,~úð«¤ëçë6­Ìƒ6±•½Ðúi“m›Ì­‰6)MÎrs¬ADÙ”ø²1Â6òƒS¼¶Ù9öt¿ŸÛT§zë„ss›•é‘‘ÝW^æ×3¹_À5Ù“#£}s—k›ŸÙFv`f±µh,y.íÈ…£áðcmó®wâóÛör›a1aÅìϨÐ)ËzB‚¯ÑcGå«A•~v²æ.œ|õã«òWÝq•bîžl›o’Û p ‡¥ñ6aAómN¯èλ¤~¬mHS4ºûÌ&ÎwóÍkJˆ×®7Æ°³ú¶¬ó‘oZq^•÷ªmæä šÄºüáï}ÝuÕ'?.$öµÒ“+*B^CM‰VÚÎñDæÓ“{éÒÅÀg øeþšú7¡ô—J þÍ)zíÖ ÿ,Ú=C|ìoøÕ}icÜ—˜‰ó»îgwÿöòIë6¹Qfêö{¶ñÖ;”Ûkçäÿü5,ýQÊÔMõK&Ñ•8Çñ2ÒðLªb¿hËHF<íýØ|k²€ç3Ô¯ëÞÏG¬Aii9^ÛüÿíéWTIšÆÿŠù2óafNõtõ93Ý5§«ZTPYdIAEDLö]qAKQÑwTq7À ÐBdß‘-$Ù2ÉL2oLĽÉ&Twi—ÕeÏó;ïÉss¹÷ÆŒxâO©“Ñ’öÛ‡¥U¥X;'ß#ÃÝöË¿Ëæ{»rS }w‡?–µ”Û˜š:­ áãòu¦Ä2 GPÿYj³ëäÕ`£Ñ·æoù\”îcøË£ç«Ít'ÜËs[þ¼Â¹KÁû6~5=µËLlÛXÙ«ˆÛèð…'›84Wm æÖ¤XsOóÍçõ³‹ûžúB£Åf?²˜ž q2¹[Ó×^~ÅÈÌUȺi~¢Œ„-@$±å5“ªMV’û:¦6M1­î§'žÜæm絃…erؽEüõ÷¤íè·«fÔf1¯6ñþŽY•LtÊÁÛ7nÑoçªM«ƒéŸ¼°™æ²¦‡2 ¤ á"IJUeúvc—€qŽŒõ6»™Š6EÓ8;±Ãv®Ú| w\}ñ'ïú>=ƒAmf)·vLºÞ|éù*߆ólsÔEá»ÛI¹U¼¿ªŒ ñ£Io¬óuT ·o`°—·øDÎ5G úáä(ɹO/y¤5)õHŒÓ‘’ŸvµuâÕëÖ¯wXãá×6 Qõ×džù„„Š%aªØ?K]ˆÔ^þÁ[\yšå³ÿk“ÔöÖíÛæçŸx0È{UØQ–à»ßÜoö Dì©êåûz~ ÷rõ’$fÜ:rpgÝû9«ðÝN?]Ä´èÙµ½Q‡Š…0Ý8½+&½tvÏ3Ò]æãè°ÚiýÆÃçïju|Ó‹¬:vK€_@°Dì“|ö¦ šÏnœðöùK"âÒeL©Ú‚‚BÛ¥Šy¥äxnÆ!×õ=7®qq‹?~Y5IsÏäÓ¼ÓâMî!ÁAÙ+²Òb%a±ý -á侶&Û3K„Óëî'„ðUª–âÔçž 6ìû!ú“\Ù µ®ÁÁg®å/ÅÌín öuwssww_ï²Î7rO _|w¼Î M¼OcúfF¼§opHxQCÿ±ØÐÐØ#U›`h?¯™(ʽý"»esþÐÖ²ë‹%ggI){æç·ÏùxlðØ°>å|>«ÇršG—ÓÅ>â‰8&5S¥a ¬üNBDÒ#ᬂK±;ywèÖÁm®ëÖf–ÓÛÉN'ÇHü|ÅI÷ùzþUÏÐäq5;W×tÞkËqáÕ.mpqM¾R:9TïíêÑ!ŸS´i†;ý¶§•ÝLÝäá]XKËGõ…ÔÈøLZœIî  ŽŠMRÊ*‚7º§w>8YÚ¢uê@HEÇcª¸œ-Î.ÉÅŸ^“:tˆíÏ ¦œÐ’$±}P"[QMÇi§Fìë(ScÓtZ­~`ŒŽj§#ï¨(«z¯÷…6+läOÔþµk§ËÔ08a}ÇðûÊoõuóLß'Xç/×VYü¨”w®4cþv‹öNL•Ô¬ù}:þ#Ž?øÀžy.þHß‚;s<§–0*7ïCvÃYÕ þYfžñƒme¦G“a›¹7á‚ÂÅ'™íP›µ¹EÕðt#³nê†3AA«»sç™PAÖ>\&9öÊéfŶn¦j Óÿ|hõ1ÏÂÆbl&üìX÷Á4IygMdö BfŠÏŠ„ÙÑÂÍŠ^ÃçÅ97€©ûMG…°áô7B€…’B€¹yñ,ÜF8}:¡êo«› ‘NŸHø‹ÌJ!ô“ù5¦¦é{òj>=‹¥¦BmfŠ%½ª½’µ—ùÝX¸Ñ)iC¾£Cô÷ 1[|Ü#zÆT¿Ä ~v‰þ懫Ev;ö$ÄEIìÜB»FY JUþI+s«Ýû¶‡ù¹¦LÂýÓ­ÂùQ\>yx³›câåòŸÑbÀi'†wû8¯Øš¸¯§«S^ùßÑ]ûó•õõËGÿŸ,ÛÒVY&›à>}ºÆ±cdl R3¸é«F5.U~TîJ™‰ñi_Ÿ´@©ÖrùEÒùœ+KªÉé©=Ê1¹T*íïTO긞4ô¥ü'Ú¡Áþ~™\û·Q?;B7©’ ÐØêçtŸwZâܹEÜ?þø;[‰ÓÓ¡6³ëBþìZ™;®æçü'?½»ÚÜvNN[x“Íyý#“€æ=/GÈ?¼¼ææu1sy>ùužâW»Ñ—ΩSddÑ0ÅÔcCíJVÞߥPO~Î{q m0ƒrDÚ%Ûª¬ì|ߣÑåp¯|lÆçIµ¢³kðã¡SuuuMïîAëòÒžŽAòÎ' ÎoVs´Zfj5ÊKM©d>µáa"—3 ýýÌz{IO³Ž½µ´0kn&õõ¤¡ÔÕ‘wï˜UU‘·o™ýø£Þž=#ÅÅäéSrï³»wɵkÌ®\!çΑ¬, ßfÆ%PÈüV¯°ñØÑ*çÅïz>X$bAÿ[h¼&Õ-ôQFLôØä‡>”ðæyÆz·ós>zò‡oŒZúÉ«Ka™˜³ÜS÷à«¥‘ÝùÐAPV~ûA]ÇLÛ]}Aš‰­XªÐ}©5³ÉIf4OÑ„=>NFG‰LƬ¯e"š›:;I[io',ûP«®fy‡šk^½"ÏŸëíÉf’û÷™Ý¹Còò˜åä«W™]¼¨7š§„O._fÇôõÒ%fô+š×Ο'gÏ’Ó§™ïàKlA€²ìPC+±Œ?áÉ…í«Öì&ã%‚ÚY“–[ÕSyË:ì¨pÖˆ¬K>®îk~fø…0¢­4ËÀ™íÙTyÄÛ*ì¤ð³þ’³Õqš¡zãZ)Ç;\y×Èм©KÁiµÊ µ°¸¿F!Û°ljÖo¼€/å`§½¡Ñc¥^mž¶Èo åÇöslÞM¹©™uëØ€½c»Šl_ëò¢¡eƒï s¶tmž˜isi}“½|•ãÖ-l;ÍÐà@ƒ?üñæ!êÆp;K{—}©¥5üÀ<é5ª6Ãjf¼7m—ÿ:×M¾þ.Ö&g^ó5)_KŸ ú*ÞãLS[¥¼t©±^m_Ã)wúºÙØ9ìN:QV惙®I1A«¼±Ä>ž${¬6]ëÎoìèmláÒRûÐÔdu¯šìXõÊ•¬&5Ó`Ä&os2ˆek®äj~µ¹—¶Å÷ ›ÄV0h)35Q™øÞÙ6çÅÛu’qÂ8yV4ÕºøEÏîõn¯ÈmK—JýR©B¨èÔCC=OrÏX/M¿ß!ø6cÉ?éwC£fkˆäï÷ñ;%¨Ÿ¥÷!` Ι‰ÜTsÕ†ïkPˤÝ/ ®ºÙ[\+kh.žQ›·¹‹yµI÷´—ÉÂ"“6>23µëQñJ"«03µhìš»a”Z±síÒèö ÀgTÃeSj³ª¨q°¹èüÇa ’kû¬¼Xݤ&;Ì6$Úg{6=ÎûÞËÿ@ÌÎc…Âd=à õXo¡±kë8¿¬Ì`ÇÅ[¬ÅõenFæ=ýòšI^«ÃRòˆ,o™‘;ÍçYßûEä2õ˜nÛ-‘üPÆפ Vºu)ÙEr’¼ì$'‰¢ÄP¨I]“–WÓWûèÞÔ^¥Wbwç” µ/šíÛ8°)á=·£ · Ë‘vWä<ª!£-vÆF/[Xï@Õíôņ«hMJ«Vvt÷ó’ÃFäŠÍlGŠàs¡èo5ú¯¯ïñåüþÍßæWwÍè¹øpsss[+·ÐÆ>¾'¨çÕŸÿõ_’Ÿ°>èöâsÿùo_Ýz§_>qçò¯ß«¡>Ç‹ëǬW.·³³Yi.ÊäwÖW[ô}¸àŸ)Z —yÊ *R|.82wðêËîqó·Âœ>w=2fæ¸-0^X7oáò…¯> stream xÚÅZmsÛ6þî_ÁæK¥©Ìã ø–ÄžéåšL:¹d;Ó¹iú¢ ‰5Eª$Çÿþv±ER´ÕR;ÀX,»Ï.Vv¬•åXoÎþ}}ö¯×~h%vz¡u½´"ÏŠXl³Ä·®Öo“«¦ÊR.ùôÜ‹âɧZTÔ{Ód 1=wÉŒE.x-hàÛžíN¿þùì§ë³?Ï\Ø̱\bÎìȉ¬tsöÛúÏ–cûIlݪY‹…1´¹uuöË™Ó4ê:¶ãG$è뼜zÁä6+äôÜO¢ Ï5¥Æq8©eYñ•Ð‹u6\®ü™Ó¼r+*—EM3š:+VÔý‚üx•ñy.j{zÎä­ÞŽ– ½Ù¦I×Dϳ›)hIïûÙq|’jžI=w>õœI£ÙÜfR/¹Pƒpüs×µ“  sòÅ"Cé@Ñ>캤¶ ¤¤|ËçYsQ&¤¨3c9«Î%ã©4d.ÍLjA—bê“•ºuÅT™k¨T±ðßð"Û69hcÆá'“¢Ôœÿhj³5¨¾ÒÌ„¥úN8ùu£ÊFŽO€ÖekБ묦޲¬¨Ã©)šÍ\h’R´_ð<¢ºk™,›¼åS¬ê OjuŠ—fž–M!•%(viÚT•(RA+"u/íW½iÝÌeú½wYŒSGN¹(i‰ïX•¨×e¾h)h"YA}NM-+Á7Ô7Ÿ*‘sc(îD–DÝ4¹Ì¶¹ ‘1€²ª•æÙäš´©¶ÉsêÍõle _·pÏtå^ËU‹±ÊË9׋ÒRÏWI„ŽæQâ²,fcG¯‘%ø\MUS—î:àbpÇ€+€n×eq<òV½ˆtç3›Evâkt»^kõ]!ùWêgš ×í²l‘äù“Oƒ¿<5jP„¥/ÆæÿGÀ ¯Ð;sj4´Ðà³8ä20¨ÄŸMNDW³-õ¼t-Ò£ ®ç—†³9¸UYËZ9\WBïÑ=t°–½¤æ‡Ùùìbv9{9»¼˜½¼˜]\èïß]P{ùÿWåfË+<çÑa å¹¦KQeL”Q»“ ˆ¼¨õH5ŒÁH;W`'-/ÐgÑß ¿Þ}ÓüYW§ü?–zO‚É=†c GÜCj÷ ©•ýxÆz²“MŠoM;“ÂxŒ^»;5 (àôÜlnXëq? t ‰ƒ%­ ±íÑØx±íì[cÿhÌßf¡‰ù(•†À†oÜ´eKjïÊFŸUÁ]!‡êh iMæKcÈòNÏÎ6¢î¹,"TÁ7{Þ&Zµõ¦ƒÊ!×Tµ(ÁsxêêQ5š\¥ù:tà¾í¤mݾ¨Ô˜™R²^ÖÖÿqºC=©âé ÌCgÑäíÇWD¯!XIJça´—BV¨r1ÎÚð¹QԭħP?L 3¯ÃTÞÙLB¿R(5ŽZÌ»N"$:ÉOT•’èFqjvñWèàÏ(¿Ó“»?ØÀxè¸V‹‹Ÿ©våzöVÙtB :iuŒ¾Þj9Ù°þÒäøŽR¿™ÜZIÇŸ H ÇU÷[ ŠhˆäYшþ[­£n¾”¢oG±@J±ÙšçWûì4ÂBˆE“›Aže2ŠLòJó<Ç÷IY›„6cî#ÈÏl1OÉ :Ûô²b|œ¬À[ˆÂäÈYÁ•ä†§F›eÇR3a ö/ßš¨…¸dfªD²r ']œ¬´t¸mì™(²ðØñÒ7Šm0§ÁC­ ƒÚGV@äà:G0ˆ´—ìÈûϵ¶‚t'äà7›ÖÝ[J6(ÿ¸ýíêR?N>4§_U˶Žs¸Ð&Œ= a'Ç€Ý6'Ã7tlÇóNZ.~§Ò¼Óy}V?îô§«'n û6 ,XÂŽçô^hû¡¾Tý—ý¬½OÛzqçá/:…gÔw¿ßt_ææ'×oõ?HÁÜ$z’ÿ%¸pxj÷Ûír:ïsbÛ‹‚¿µR:p»ZûPÑ ÙWªþϺì1ßë[̞݇ˆEÅEMÛÿå˜Ù^öÃñà¯Úþh¤> stream xÚ½ZQoÛ6~÷¯PóRu8’"))m ´[—¶è†®M m1(2m ³%O¢ëdÈßI$e[rÜ(¶ŠE‘wGòûîÈ£±3q°sÑ{yÙûéWW8 ÎåØq=8ãŽÇ|Ä×¹9Ÿû—Y…*œRÏïÊe¦KËx$§÷‡ºâƒœÉ0—úÅE‘Á×Ë·½W—½{4b‡8á yØs¢yïóW쌠þ­ƒ‘øΪl5w˜ðá9s>öþèá-kƒ k Y#ìzÚÐßÓåýè縿’`Úl¦_'2‘Y¨¤~ óœÉLéb<¶ýô3ÊÒ<×Å/ÓBò·á}óy–Nb#d\è ã™im«ÕÔ4Íù-©L†sTÌ é”x(p©¶ýåÒØ1“êñ€ó~n-ÌS+æfÛÂõ§DÊÑ;2ÛÃÔª°Ù ^F‘Ìóñr¶14«>±‚·ÇjõmLC8V%2J•¡*GÙÃå‚fG>\l£AøHf"Ø‹@ãñ [2|BÁA–¿Wv(C˜#‚8Åئ `[³fCM€0!›jŠzæ¹(ð|+8“Îx§d âú³µ Ž Ì€ZÀX11 6+*0Lk´Ð…0¹©NŸßõå æxžOÎN~N—‰Š“‰®¾HÓ‘.½+—ûä©~‹ÒDÉD˜•-êÖ±­¾—U(Æ(à6v¦™ö³¥ôUºÅP¹—ÆãÒo@á4(Ó}O³só¤Çàvk„4 "tk¢D-Âè©òÝdãûö¾ \í×À!¢#v1ÏG“ÃØÅ]äuO®JKgÜb…*/82·ÊÜQE‡Ï2™›ª´NAƒJÛ.’ñ7i$­b ÏÒt4)½õn­0<ôèÑ}©µÁ€]Ìj¤»Fk$5ñ 8']±…1°SÆÇ(WtN—µšîøârD‹·£òÅÖ¬ãLZfØسšJs˜•åGMuQœìÜ35`¼‰õïQdëTq÷¾¬Kl0Ñ]A‘Öði¢DxîÃ" "T@[ Ç è!Ê!4+?¬/UC.àhĸ>L~èÏ«Ü›>økñµ,,Ày&ËgR“ \&yUVéd2“µ4}4•Ñ?&«—šäC©ÍÜ?¤™ÍÜ/lnbšæ&h;Ä‹¿aœ·ÛwöBè&Qáu›Ô… Ùwÿ \ &¾“ ò}ïÿ±¡fÓÁÇñ.s+åz6¯‹õ9³±du‹g°ô·%nK"Þj<>KÂ9> stream xÚÅY{oÛ6ÿߟBÔŽ¤Ä‡œ¡ÀÚ¦ïb]ì(Ú¢•m:ÖjKžD7É·ßñ!E–³$®í5BêDÝïñ»£„ƒóÏ;‡_Ÿ…<ˆQÌ)†Ó@Ð@DEq 'ÁÇî`U¤ãD'½c*d÷}© 7{¾J'ªwLp÷¡#œ©¹JJå.BDé}¾êœ;ÿtÃqÌ#$°Æ‹ÎÇÏ8˜ýU€QËà®Z—0΃AçÏöŠbD@?Œ(ÍjN‚nlÏþkK# ·¥ÓËd±œ«~ï8Œ¢î¸P‰öjû]/ÜdÔƒýÍ“qâî·yZj»¥J'7Äàà˜F sR«yÞ£¬{¬“̪GX×)âùÔÅj®üÚ4ç‹4;wW:÷Üà”„ ¸ä»aža¬‹ŒŠF"Pz'gFlâÆ´€mSw©£U²Hôxæ¨yæH‰»tÒ`RæSÝ#°+°LRx¶^~™Ú§ÌÓS­<ƒU©&Ž˜zÊ(×%ãclƒG¯Ü‚I‘/Ý])¬‹dj¬h{2ϯöõf…›_/G©~àh_Gɤ,gj‹3ïi^x«Î¼ýË|UŒý<]ý`‡/uÓ[Ë´¸vͺ;gðtßG‡ù™è´?ˆÈµàq<â0Ê[Ó@@¦V§ÂIhÀ„D°çÛx`³–bâYÀü@77Ý6) 11„4Åz$B Y1.T0½‘s¹­Ñæ'§„Äá‘ÏO J­. 8„xÏM’ìª59~äÆ_Þ~œžýuzæ.)uã'Ìð¢<ï==ûã#ÍÓQͯʬ£€0iÖ“0²q@!8Ä †X‰}¬Ìó‹¾Î¿˜DSÅCUêd`0S““ZMdòââ»Kƒþ‘g@ 7àuæ&^Ë~©ôCÇËŬ¿€èó/¿”ÅØÓ• E7á_¥G:éGØÿ±°Å`+°½©ùÝûáðæitÖÄüg˜XÔ&¾1þoÅ…ˆHùI¼%†¾EKÖ’q­ŠA22#)E]:²RNó¹/mum25ÄÃh %íÊÍMŒ]—=ó›u­ñR§g‰Þ(r­;Uaͳöÿí•)ßÛ 4c¥”î†Ð”#ÂÄíÎõMÃ.}-¦‰Ðžñ~šEE’<¿ùýÉë7/ÃÓ§&©#zh¸ÄNËû¦öM9Ì÷‘Ã[»y3Ú(ƒ}ÉÉáí[cªDà`çYð*’¡7é³tî{á×6ÝlÖ^˜þ&Ó¢•wµÀ5À´}vˆErÞvO0½HõÌÍàÀ©ïS;™;¢G˜}3mf¥1JL< 1¯[V Y€ñ»a™i¾òk ²T—ºªÐ©2-hÄH³…ÛµT¶¿lðs̯ªmd†ßùª€¾ÖÚ°Y#‹þ›±öoÁþí&ÔÀéôÒ«6ýsÓ¼°y÷õ±s°B½KÂIî{+gŠ,Y¨-Ž2oÕÎzÝkëÂÜ0¾ñ2¸Êtr¹ þBÑE ì¶ þ†‘@4ŽnOL"Ó]ð·!¦‰¿žñ~ð7dÙ+Û-¥Î‡ýßJ]@!}t²€mo§Mw ³½5!¡’*jëûáCb$b±[ø`ŽîèÌE»O%d-tÛ=…ÔL)X+tŽJh}´kèli£MGÍíÿSù® ChVU>cî ¯÷ŽžŸÊü»‘Æ‹žä ðI)AD°âŸbƒÃgCÌÁà“BR^瀺ÔûBÏíÍ´é-`ÁåþГÈ1öãèI$—»¡'áwV„}DOCÌÁ¢‡8üp¶=G/ÏwEÏím´é*í{Ì~’ÂÉ!jâç"1múy:Þ‚¦Ù4/ Ë¯ñsžŽ‰‘àÞ<(½*²ê-Ã(_éÐõ˜êm­`ØáÞ+nüôQDˆ? j ÁûRxÎRŸÌ’¥®¾«Dp,ᔶ¾»œÙwô-Mÿ`áéþ endstream endobj 1102 0 obj << /Length 1837 /Filter /FlateDecode >> stream xÚµY[“Û¶~ß_Á¤¥f,,âBnõ~ÎR;ýÛ4zkÛÿA˜åÎ3„¨~5Ž“ÍAP(s;ÄÒv«aqÂæóòšà0íÎëJ7ö¥ÂzœCi=æ5$]¶v},›ë=@7=mÌ'V ؽ__ÓÜ^'A¬¶é)œOÜi¨'5¨çŽ•ù+æ¸ÏÍûÚèW¾©±Ÿl¸ÒÖŽ% ¼M^¤PûtÂÔu}‚ÁË®Ý<»šï‹‡jŒz¹•inaî¤uÉ÷ñm H3B £Ï;É»òÐ]ýÌM÷N¤±ÚMe­.^qñX Ò/½Ã€Á¦9 ­íà(;ö¯íe9ПºV• ÆU¦à¦Fïüè¼f^$ŠS7¯dðËRáE:ììEÑöè.Ñô;PþgE¡šÉ0X­f·t§[‡•¶“R¤éßëCØêb”‘O‹uevù“þ)†<û¸®¬ÞÇ>¤²“Ûp:aÎ mH2yQh“ ¨–‘ç–BuÌå%¡=šfÚøJ¡!´%Ÿ†6üÏ—µÊ?:å³Ó<ɦ#¿rC{k톾œÎWë‘uDÂÈ‹y`’Á@=DrHuaÑofŒÇÕïýÉ[ñqZgÏRî«J™/÷ý}4ÀÕTΙ]d4~gÿêˆÁøáÊ°¡Ü<Æ{¬úJzÕÖ¬†‡® è;}ͺj´+‡R£{ÓXÕ…¾>ÛÀîÙî=æ7ðlíeòÏ›ÖöT1,¢ÜawA–ÊL('0lXW§† L¸¥=ÜÊ8  À:™T« уs‰`ƒmíÃÖ–£ ¨¦(N©ÍY焤ýéÌEçåÆÿÁãàaÙEÇå»YÆtp¯C'gH°@'´L œp^BqOóD‹„\0œ2§ENgsBaW±µU=PvòST³Ìò’çe¤’XcZ:“¼Ì™&DJ'(Uá˜é4¦J)‘'%+–J ^ò4Í´^¦%].—i1jÛú4JQÀÜDkYÒ2K^Z•r†±T)I'(]ÕXsÁ'‚s}ãø Eäy„Ïqâp|zâPj‰?ýåéøû@0ˆ„ØdPh_Jã7Õ@YÿìQÜϧÇèÜoáɃAq–Q:ìd2ÙY€=uó endstream endobj 1113 0 obj << /Length 1905 /Filter /FlateDecode >> stream xÚ­Y[oÛF~÷¯ ЇR@4žÎ…tÛÝÔh€ØTû” ^†ŠtI*Žùñ{†sF)Å®lCÎåÜÏwÎP4X4¸¹øyuqùK¤‚„$Š«`UšZÄD$Q°*‚Oáï»®ÊÓ!],¹ŽÃÿô¦s£›]U˜Å’Ñð›øhj“öƽD„¶øsõþâÝê⯠ÌhÀqA4ÕA¾½øô' ˜P%qp7îÚBÅð¬ƒß/þ}A'‚&3A%4ÒNÐ÷»~æ’†¿ýKþ¸2ìÝkÚ7X·mS¸tgêúj“Ž¼»uào¦‚«˜(šRãDŽנŸ–{&4bÆ%%I„|Œ ¬‘¸F,°?Í @¶ã™6 ¡Œ²±óBG$ѱ'Ü™ ŒÒŸKEiøƒ{˜¯i>Ô÷îVÝÀáü‰*{Hèí5ŸS[w&l÷h_†MÚÌè¦Máý6­ëã@ðQ®×ì Žz{Dè;!¡ç§Úù!uÙ@‚JùìT³Þ_ؚñÊ|hs¢;`0d–Þ¸é J{¢Ã_L†­½$‘/Oî f E"°‡©¦Å™¼µ¹<,Xhl Ù)(ùç…­j…Ûœ™> stream xÚí™mÛ6€¿ï¯Ðjk…Ô»à€\án·h“=Û)zhŠmÑk]dÉ•èl\ì¿r¨•lï^’î~+üAäšáËÌðÍœ‡9gÿšŸ½üÞœÔM#/ræ+Ç#7 B'7H}gž9¿ f»:_ %†#/NïY›ÒÅ.ÏäpÄÙàܦ²¢‘¦â»žË‡¿Ï<›ÌÏþ8ã`‘9܉=P¸1‹åæì·ß™“üG‡¹~š8·º×Æ ¢ž…3;û÷£Ñ2ÝVß8¦0½èh7â¾óÐMxô¨æŒÇa«½§#ážE©ëûÁc:ŒÏõŸTp00S€K:fR—qÞ5ƒò öÝ4N¬âZ:«“šï£ÿÔ[yN[¸•¸Ð v31›( Y«á(bl –[SøÇ7?¼ýyrýf27uQîMaôOó±›út\®LaݪTM¯ý=c~5ôÂÁí"W燲¼´2©–îpäs ›ª!mè’Ui¶6T^¦SZUõFf¦ºÒK‡ÚÄrmJ ×,NM¨åZ6znG©ò&ï8†¸)NfþäÓf(Nµvt~œ²z„ƒjkš0+^^ÍLӦʤón9Šë¡äåRQƒ˜F±Ý¹ÌL‹ªŒf…½6Ò-Ô<6ø0ä¸z¦Ú-+Rh¼ÅzòF$­DP¯Ô[f»u½"j3œ™Îef19å8{œ-¥ËaјëE>b¤3ñpzqÈ#»Ê>w“˜Lê$ŠèðÞóü"ßä AoÏ‚˜iE~öb8´ YZ‡)$Ø5Ösp‰w˜õ$Okýz_í¾†˜M]/2 ¬dÙŽcÃn“ÒÛ\‘ê¼ÐƒÛj¤ê×ó4Å7¶nP™d›ª±½I„zs2h'ŸÄf[È1-à£Yš2lÈb7ìû+üDÜ øsãÓ½•g£§ …E ã#|Z+µ=‰GGøÔ ¾ùa>¿º¾z;Ï ¨w³ÉôúõÅäíq øR—Ò’Ó§m'CMl`˜ôñ¹kd©fžó »%Œ™\Â+Ì4o>|T©êÏYŸ?‚WwŒP‰;ü4½†cR!fñÏÕŸ¹ÅËÀe÷S_V›­PÈ}wþÂvœ]Nhz.C1Ž1}lS˜ªÿC`=Úâ ;f #/uH;Ghh¾ Ê8:?‚²mUäËýèc^Sm˺¯ —ÅO€e_­G95xœ?•02Ój^–ö$·™]âih2ÛC™‘wÒ'eÔÆ&nCpYK¦°nßÅô—=šiªC~™HyNmÆ‘±¡ÏwígRÁÑ/³¿!ëAÈò"¯3:¨ÜCÖZÈÂÊ=dé·4WC¡ YºÁB–®XÈŠ>„áyYX;„,kלÿP¡O‚È¢yäEk‰ ^Ynö'(üùàŠŸ¢+øÈ^?\å}—„´¾ÈK¸ð´Ý¦m=ó~™Ý·ß“_k­¥(KFzÉ8ÎÅš!Í-œµŠµR?)ù¸y^ø—HÉ‹B²Ýs£RÇ̳±’Ï<7JÒ‡¯šP)d;¸jšü:ŸLß¼þéOÑÒ/o/¯ˆv…Ê·öþè])våêüOIT2³§²ÙBN‘tàÏ¿»úÒ‹¥sü"'":¤ 0óÒ³„0~<k-“[µ{T¹ï}Ý ÃþõRxŠw|s½°§¸^òy‘ŒPJn¶pÖ²ªé_/uú#ÆDO€1_JG*¼À2Žñ‚Øåœw“§Ÿ´T‚ŸÞ·ú´EáýW»%ê\½„”" *(‹Œ¨¥¬@Ê­é»-ð83÷E¦q!%iM<ÞµŠÊ¾„™¸õjlÒ^…®WÛ3äð8«m´äá¼å,KL£sU—–öˆi Ђ^Ôc¯¿Qêa”:]¥BÖA)MÏ-Ju·«‡Rz~¥ÚSøà2¥ƒR8÷J}×·òú`ã»ID{m˜&y [æðÕüEP£ïIÓSZ´œn†`Fû[,Vuf̽¤î• ¤—žíÅ0Äu–èQts»7"½×ôªµ+H•=Lu-kT’ÆÝ¿(FA@Âé@šKÀé}›|òžã%]K>‹éK7èse½.‰ŽL#Ö׊(QFÒ¹(G± Ž6‹HÊL ¨6w¬P¢ѯ˜1¤aä%œ(N[/ÊõLLz¹( oM’ìÅ^'W}˜¥ÀŠ½¹ËÕ·Ã0د>}O# KÀ»²}»¢NŠ7Ãp lRûåùîŽã—©°”+mWšB_ßÉ48Û—J|÷âáðÏØ0€˜ûìÿbÿ1Æ/v:Ê<Á#ϳI¾8æ].ÇqaôìÙ+•8<âÿ« ¿D endstream endobj 1131 0 obj << /Length 2096 /Filter /FlateDecode >> stream xÚ­YmsÛ6þî_Áz:wRÇ‚ð]¾f&mU_ÚÄÍYºËÍ$EBkŠTÈŠfòãoñ&‘´b'µÇ3&‚‹Ý}vŸ]P®³t\çêì‡éÙðg/t”„$t¦ '"NäÇÈOyóO¿GðCî¹Çq vÓävÑ 3\´xŒ\*™A‚Q$ËŽ »ÕÀÌ·6dtA­2:Ú²ò¢¢¢€ûeõzÈ(§)ËVCcB{én·Cë"c5¯B­ÍW `*Ýb?Ló»‚×l?$>#£5ß|ü\|ă2å\ì7t´£óAºÙ”²rƒC©à ó:/òìÝè ÝÝ(¸Tý$*ÿjҺǜRBè‘gcò ‘)/%÷Ø$€„K³•ÉLÖ£t¡2Xq ¯µ¹_×Ì,Z§"[Q#e•ö‰Û»ëã g×ÀÇh®ï${•}1!‡ðE(ñL§õja1K‹e•Š­Ý™S«¼yþÁu½ºO‚Þn^ˆ‹î\QÙ9*2ÔxШpk¬J+ð°‡(ÊR7”-j¶¶¦,¬+Žž«ºbÕö 2…²] 0à4Š4-ûo¶å)írÖ÷ƒ^½±î«·‹KnhX½UeYß‹zô kŸš072-¬Y¢>X%Q4–mà€½ícé=kejFK5]A¬À©°b κÂ) ¶ºˆ„žŒàPeÔýÉ›+ÝC‡ãùP<Á9ë/F82ÉýÓõD·Ö¿êxƒûTÿ@cM·w2" ($‰ð±0.X½Ö*ßäÚÜïÆätEepxÒT;àõÚŒt^È‘as;‰„2.'| ÚB?Ü×ÛŽ¼mµ.M×EYTjN¦ÎÃ’!º=÷6æÐ!Ÿcf¡ J9ؤKjà n,}ùðßC GwàpÞ«7ß*|÷eæÏ` [C'¿Ê4³0` C#½ ´IWW–9Ö©.“v‡$?äR'ù!¯²Ûvúó Í”/2´L|&1¡°oPRsõ&úKªœ@LXyÀüÄ„U^ñÙŸ[I¢°Ùþ±x„x/ßõ}·'‡W†?ûÍã(Á( [í{½²%ÓQr(ÜÚvG§ Ä £ð"zVÊ(6å’¢’N4¾$I,¡Ó+ŽÛª[ƒ]z-@ßù@A¸wkåë˼zU^(TC`ô1ÉhW®ª€}ÓR7²8ú‰¿°ÕpˆÐæ…áúw+jiË-ÛÙZd"ˆùÖ²¾Ê-é—¥­&K#BtJFjl‘nÓ3ó½]jTé Úu¡] H똠ØÿP¤*åð7òŒðð {ø@ˆ?íG?Š? +Sg# \vÙy~Ùr’´¬ëeI‹}j »,|ì©T¿Dª  › dƒB’x_5<ÃWë„8?ÕÐÓœìeH!ßMÄ|Ò‚Ó±ÙŠw@?³ÓB@Ó\ؾàVÌrý9HbÌ»1fû(L6 –öŒDm©¾ÇU2(Ñë§Û®œ“ÉëáôõóUÏÆ1媵6›¢¥›5éOݲ´lç>o7$ª—Ò‹k“µwRdÊŠzkÖnX ]š(¬wµ/ql‚ͶG…vseÊJHÜ{ÓlbM&chþ˜ÄÿD©+ª¬ÜòÂ*Òîóž«xˆ’Ï2Õ€ƒf|;WýÛÔÇo¬Çܶ2é"Uí½ÚÄ·-3¡eÞîÈIëÓÿšo?1ˆÉ“>þ$°þ±cØÜò”?Ç]šß~ŒÜçùøƒÝY€ Àl»_#~¼þ^a€C ¦Êj‡‚аÝwúl}Zâ4¦‘¦``fÄÈôýŠPpIT©}ƒ/-á$|Gõ!€ÃðÛÇùÇÔ›5wh}ÐØdŒŽÎ‡ÇUßÏ/Ÿvžþê8¸ ?á8 x¶ §]u¢Kbµ³éÇŠvóú¿‰(²ÛF…žKÞÚ¾èïí3d÷'„Àfùâ_NþÄᄱ1& UPxàô8Š¬Æ?®Ò°?vøÀœ!!Cä•w5ý?©T‘ endstream endobj 1127 0 obj << /Type /XObject /Subtype /Image /Width 338 /Height 69 /BitsPerComponent 8 /ColorSpace /DeviceRGB /SMask 1136 0 R /Length 5598 /Filter /FlateDecode >> stream xÚí] x ×·/$b«"ˆg‹T»ªõÙboŸµöPú<Ty¥ŸG±5yµ>Zµ†¦¯-%ÖØBD›'örÞïßsLfî;!÷Jãü¾ùî7wfî9sþç¿üþ眙˘„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„„D6Á‹/¤$$$$$$$²¥QÑ›ô_%÷‘Ⱥððð¸~ýº”ƒ-ðùçŸ?~üØÎE%&&+VlãÆ‘‘‘Å‹ONN¶…d´–,‚Ó§O—,Y2%%ÅFa°®7‚9rœ9sFZh—­ñ¢®]»†‹W¬X±xñbìܽ{×7™ÑZ²ÆŒãíím•‡eJǬKZ½´ú×/êáǸxË–-¹sç~þü¹-n2£µd}*~Ó¬Y³¼yó¢@Y¸p!®ùý÷ßÅooܸáââràÀìã¶k×®-~®ÅÖ­[6lˆ›ôôôœ1cƳgÏÄ©'N´iÓ$lí½÷Þ»pá‚8¥#®öíÛçP?ÔoQF‹êÒ¥KÍš5-µ½{÷nt?É=­Cá`æ:t¸xñ¢ÐðØØØ>ú¨T©RŽŽŽ¨úСCF„£­E%g\õêÕñãǃ0£äFñî°Z²¶õ¥§/ ¨¨(8¨[·nÙN&–겪6ŪU«òäÉ3mÚ4xi4ÙÇÇ_…Õ£±5nF´zõj__ß5jpŠƒ*S¦L×®]q|×®]hiþüù[·nm¼:žV­Z)ŒÖ£*lß¾rï Zk×®uwwïÑ£‡¸¬R¥JÝ»w_¹rå¦M›pdýúõ8øÝwß)á\¹rÁ”°·S´hÑÔÔT³7¹mÛ6T„.ÆÎܹsù>?õý÷ßCñzõêµá@1 —/_¶*®sçÎíÙ³„……a‡û ýe¨(t\‘"E,µ!æ×_½}û6Jãq¥åÌ™sòäÉ;wî„К4ióUׯ_¿iÓ¦áááÈÓ!UÜä±cǬ GU‹VÎ(ö‚vñ’ÑXüüèÑ£VKÖö¯¾ôô¥!Ю]»Ž;ŠXl ™˜­ËªÚp’sæÌ_§L™¢2Ã-Z>^e† Qâ,Z­4ÃêÕ«W«V-$$lÇ·7R%«çNfÉ’%g^†J9{öl~ÙÁƒUÕ1Ÿ®Ç5"Lè×ãJd:ÚS?Fß©îÔlܪ¸´ ´Ú"ãE½RRR¶,X0a„N:¡@QòæÍ›•Wîر©–¾p ŽE|ýõת’ÁÞ­–¬í_}é¢2Ƕ‘LÌÖõ¦À³xP¸“4N¹áNAìÁÙ΀÷"ê|fbuð¨âK ÀÇÐï–LàøñãÂÒኑ‰ƒÅY• èºê&à¯pJåßP‹2"èˆKõ5£-Ê\«-\¸0üöСC‘CÉ•ŽF™m£Žp Z½¶d$†VKÖ6V_zVÕòòò7nœdb¶®7>îªtS0[ãV¯ŒDpÅHrëÖ­›¡êΞ=«ªN9Z^$Ξ:u ûH«±BÚÈÔÀÄ°ƒp<~üxã2©ºh Oý²©<‚Ò–W°úŒ¶(­ AR¹hÑ"qääÉ“J ŠŠRµiµ¾p Z½ªd^ΔôKÖ6V_zVqøða•²ÙN&ÚºÞ8|||>ýôSñ¦aÐê“““K—. ÃT¶®Òju³fÍ_á•U+VLÈÄÀÅY°k''§±cÇŠß‚i +Ü»w¯Ž ,\¸ùÈ‘#¸ ..NÙ):Ó¦5kÖœ9s¦ø:þ|èç 6£FR:–Ö­[#47Uqm‘NQœ5_“€Ÿ‹Ì­˜8q¢RÛ4i"F¡yû÷ïoU8Z¨ä¬-¹mÛ¶ýúõ³Z²VúÒ³*Aƒ5hÐÀ>2ÑÖeUmuëÖ!~ÏÀëŽ9Ò××× Õãžëׯ`Š6‚EƒêÃõõîÝÛHuàÛ¨ywÕªUóåË'ªèÙ³§‡‡HÚòåË[¶lY»vmåÙeË–!­=zô·ß~‹rêÕ«ÙrkÉê“’’z4jÔÖª<N‚Ÿ[;RuÜ$ÞöíÛ¿øâ PPø~*&&ÁÕGFF¶iÓº'VmY5UWWW¨JDD>~øðá°Øλﾋ&Ž *9óìÁ…—ìïïk¤dKýkIzúÒXµj¼Ío¿ýfE&. ‹ÅJƒW“‰¥º¬j`ö†­—ÂͨÜ>Ü h{Ë@»€?\¼8íÈ‹ÌŒ?*9g‘eŸÍš5ëӧϛ­ë-×@›j4¸yóæ|ðêx:uöíÛ÷Öû Åè-:€åÎÍš4aññt’eæÓ*9g«ç“Å<ýƒue? Ìa™hõÏŸ?Oy ÇfÁ©âââBBBÀÇ´äð•çž²œÉê¹áçÍË.„h(â?Î2ÃôUrÎH_¿°QÎ;sæLä öyL@§®·\½½½ïܹc¦× Ù¾EÍ2dH¡B… sÕâ ‰42ôëÇJ–d¹r±|ùLæß®C ©z¦š^åÊ•Å3zÖžþ•™kýׯ_W¯*yøÒœ¨(–œœ¹í5S—„U *vîÝcÊaJ?_0&_Vñà1hÛ6Ö¶-znõØ\]r"1Zõ‡´íÖ÷æb½k 55¼V-¶z5ã eEíR¿ì‰¸´-b¬lYRÅÕÑJöËë ùî]¶d +W.Íð±•)ÃdaaÙ_ÈÈnÐÞœ9‰ó8:’²ñÅ?vuwRÿuj*›:•yy¥SÅXÆ4æü䉩S^F|3Þ@BG¼B«E BÕ³g:i Îõjvì7ß Ï$¶ãàÆvøZ¡cÒØG3‘dýå/¦^€V©bþü‰NŸfÊ÷™ufý¡Øð€ÅÅ‘#õð`yò¨åÌ%ïâÂ^>›=ÙÎ;läHV¤Hº¶;9±±cÙÏ?“ˆ¤ÕÛ­G.^dÿü'kÜØL›¯/›0mØ`¾Cßò,@ÖUøïÙ?þÁzõ"fkI¼ˆ€ýû³5k˜±Un)íÛǺu3#Î_f# ßn}ÔþÈD !Þ¬r*ĪWg­Z±èh’U>ò¶Ù¾ª±ªºqƒÃêÖeîîf"{¾|¦¬ŠGùàà4af'é™U‰C‡X•*æŒç8vècôˆMŸNy}©R¦KAÊÏmÙB¤Tùâ}sÈfš¬œ#†Ù‚¦<ȦL1ï6Ðá6 `•*‘ó,VÌ4„âãÃøãðÙÕÞÅÒ®]¬Q#“4æ,˜.¯¬P~c‰Dfö”R÷ìa³g³–-)ZA]µY¿Øý'Ofsç²~ ΔÄT‹ÆµL ëk¸ê>µ7 _wû6…§ðpöÉ'lð`“+c:Ÿª}BöZ¼8«WõíË>ûŒ¨,h÷¨ìå£1ÙÄð•Ý c?wŽÍ›Ç:uJ³wx„ÿÙ°!³ä¿ùè‚?¦œ›«^f$±3bå5¿ñO0%±\?ò,­> ]³“SR®Ú¢uqùòï8¿…!À(tLF¹ 7kÆfÌ`û÷³Ÿ~JÛ~þ™Ö ƒf$&RЄÃ5Y}ìö‹ švç‘IäΧN¥+ÙÇüù”ð5«rp87žÚ€ÉøøPƒÉ£Õ;’¯ÐÏp•rãI. ¬P¥„üϤ ðÿæ´iéÜ;Â:šgèíÍo‘JWÂùóä$q=äD%MþÏ2\£ê)XÖŠlÖ,š·jÝšœ9’\¨r7Mñø‰XœiÐ'€0ƒ]#³'D¾0v,M4@ÓÌn85nëуVÁuè@Ù7øÅj-Ú[‚uãþñ‰;GC kØ2ú‰©Lõ¿lF–/‚#Eð*È÷A ²¬¶+)Šò&Ÿ>%#]»–p@Û”… SgùùQ©<¡j¶©"œtæÏ›æ¼å4@uêÖ-Zvò$;p€Í™Ãúô¡h^£‘0g?>¢¥5=h‚#}å Áµƒ`cS&éø Ö½…£@Gr ß5x0 J ñD\>wŽ©þ]NeVU÷‡ÒÆÁm²àÀµÒ6•7††ÿò »Á¨Ñ|h—OSƒ!wóõePw+_a­u|Ò$á2ˆ?R‘†Ÿ=˜€XˆZþìí@%Ì‚øMô‡Òâ8¢ : ¤*‡ …‚Á*.Á¡iª Öêîžîé6íæà@W¢\‰ë‘•T«ÆȺG"ª°lͼ§¤˜îŸÊa ³RW$sçRuŠ¿lÈŠ&Ïqã…udC<¬s.惞Â>>AÆ ¡kþ÷?’•‘5ÛÉÉ$p^|BƒD6´¤ S†ˆPÍvïf[·Ò|Áš5ìË/‰KƒQ#õµF^««\™ÒFXkÙ²ô›rÃA>¶€SeÊQ  Ê&êÖ¥¥Èˆ\{öP7û#™þÐVöÊÓúd%À´iÞíÈò;Sn®Ì€ R˜*&ˆÐ„ ä¸^þQ]Ü ÌœS,$HÊ’’¤•dÛ7·ÅeÐÆû÷)F@'} – ô©ÚøÁ›7ɇ Å8žXt÷îä ÄX“X`üÎ;¬fM^ŽŒd›7³ô¯[·áÊ"#nЦÂ×Ö‹\lÓ&Sª™€G9:šVð 88Oä>ëýûQ9s†$¬\Hœ¡†€ïµicšÑCIzÿ¶ùKp™^A$~ú‰fÞÇŽ5é0©SŽÏƒöûøФááFG0^çéƒÌ}rÁ¬0õ,l é•—WÚ3°|\lŠOÅâ8Ÿ¤Ø»—ÆŸ>µ8­c¼!`8ˆï±±´’‡¿ûZš¼D¦˜ƒV9› ´Ð·aÃLvNN´i‡ûã  |ÿ³Ï˜þë×t”49C«ŒTDDÐRX¸>4á[™õ Õ•*ÑH#÷‡÷ˆXQ½›î•[§M1¤ÉKØÔ{(÷‘ËÏŸOï¶jЀ²×²e‰ÿCùµ‹l9€½„…ÑõÁƒ,&†¦)ÁraØàL°ñq?{¶ ÕÁ$Q5¿ 8(ä8ˆ¡‡Ó}:D Dnv\4~j¬›Qz__V»6½Å·O–þo§lõ@åë ‡JHdJB}äYô‚4lèïOQæ€ÜßÒsÇ|A@MCŒIó'1>z”òÖ«WÓ6>Ôpç­zø2Á'p ®LM5=惟£ŽÍ?‘³|ó [µŠÍœI™ înŒ¯’Rm²~W×t4€/Ý« :‘/€3 M®R…æð‰ ´¹F zuI§N4ÉõᇴŽ(8˜Ö›;—|…ØðuêT1‚L‘·];Zh„\l¢d¾•+GnGŒN˜]ÍŸ†@.S±"žQ"¿f ¡ÇÅQ3SRô²iøÙÞðµ ÏÃ.â2"o|<ÍñEFÒB²¿ÿžA.SÆâ£07ØZñâ43%TäÔšop|C ªMœâWŠ·™¹¸ÐŒ¤§'mØAÉÊe ¸²D cïÕ‹À|ù%­:X²„-_N“k§OS:ƒ†ð ÝìЄ$ÛÒè[¢äõëä Ξ¥Áp|FG½Ÿ=›Ö§!G@|GЇyÂ9`ã‹‚`˜pà |u¢¥ gùA\_ª”©þLÊÕóõÉ !!¦õ/Òý€¥[øë[+:Y@† G,MD†~ë‘ê_~1=C«sµÛÑ£ô< 8 ×›}|/£c˜2‚KHdîPÀ¡Úï1–°µxýk^¹™KHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHd%ü|ǘ® endstream endobj 1136 0 obj << /Type /XObject /Subtype /Image /Width 338 /Height 69 /BitsPerComponent 8 /ColorSpace /DeviceGray /Length 106 /Filter /FlateDecode >> stream xÚíÔA 1‚5„Ló7È­„{\Ü0NSÀn»°Àn»°Àn즷 ÀAì°Ànì°^‘K€ßluœÆ endstream endobj 1139 0 obj << /Length 1306 /Filter /FlateDecode >> stream xÚÅXmoÛ6þî_ÁfÃwŠîP`ºb]V`µ‹}hŠNµäD˜-¥’œ6ÿ~G‘rdÉqc;Y`À¤ørwäÝóðH‚.A¯/§ƒÓ߸BÅšÎ× K!‘!†£iŒ> '«"EU4 ˜‡ïˤpµ×«4NF%Ãg®á]²H¢2q3LG§o¯¦ƒ/  ¢H3.°&Í–ƒ Š¡ý "˜›}­G-‘P!” 4ü5 ÞZ‚)I0SÜŽVÐÑk|w».J±‘’Ù…Yµ”`µ[Sµ(?Íê…aõ)-Ë|Xcm À´6† € /Ýô?£jv “%NÏ&§“É™û‘UzNƒýJ\ÓïNv]·=É"ÆV“I56Üïò«oÑòj‘”co†ýÙÖ?XÔÆ.ª+Ê‘’!–ZìÜI ›­åz77d„”!Åa]Œï’A¬HêEPd`›«€mý––ƒ ¥m5¶]hŽÁE‚æ[%¯ß)k+†BðÞÃJ¬¬¿[nœû|(ʳ*ɪñÉßù$½ÈN|s–Ï pýGZÆíQ5þ>+’ET¥×ÐÕ¸Œ@L™{©˜TQQýš/·*¹šÉøä´óãéI­bëì )8¦ax€ûá"(Û+œºþ¸EŒõ•Ø˜íþ°‹í`ÌaHâêñié0¹âŸI•ÎþQ9¼q ŸGÝÕ|Ääpž?a›{sD— ¯=à‡ŠßÚ\féÃ$)®­ñ ¼– ?d±e×4χ#$'XyÇp„$ *›#Zj#$£X‹Mÿv›§ågIu ;„‡ ÷¬ÐŒ9žö÷\?€@£êÁXA„!&¡è!¬,H826ðÚ{lp›3dyõ9™[µy‘Æ ä«KÏoóêe2·òÚTà>Òlc62]d±W°–ú(®à:„ìÎ|'â`[…9†+Zj6¸Â ~®à¤qï·h;îP à*QvÓ©/îê9'’,Ë‹ñÉÒ@M k‘kÏ7´pN¹¨½ ”¢Õy‡‹A˜5¦Æ„‘¡?¿`„øº—U¦ñ ‘ÏÁ z£ìïß^˜Yr·ˆ»åØK` ¡ït4¯½lÃò/µ¸§2ƒ|Æ„Ç] ”†ËdžrKÍ£A™…pÆ)ö?A¹vü¾H®ƒo 襲‹[õ¸Ýß™ý˜‚Rsõ¸ep5QZlÃmbÓ€oWi‘Ä÷®êA·HªU‘ù£*VÀéüÎ;}“´TãQÀ)dóUәȵý‹+˜WvØÁw¥qZù &^KŸù²3|Eø˜~_F{ 9¤uGñú£€rLàx?´Ô´ùÁ ~~ °V†T&ηGæàûoSßY BÓ'91)—XÉ­'æµÍ~mpd*ÕÂ’ Ɣ]ÜÁ wÐlé*Jí=y¶¸q“¶A8lA¥E˜× q¡M9Ì«/)°W­÷R)ëSÚßR¬]ý› •Xáû1q~»<'{vÕAÛ–úAÀ=àšb±8Ç81 Ѥ]fɯ®ò2m¸$Ÿ{«7.a FƒºÑ¾íeB@°f‚7‹j G*ßÌT6hÈÅC÷ùWÒÔ½_ûoÔö É0¥žøèÀyÉØp29;žMÜûóõsK}Eüêniö?®½ˆ„TØ°õŠ´îZü®Ä^á endstream endobj 1149 0 obj << /Length 1154 /Filter /FlateDecode >> stream xÚíXKsÛ6¾ëW ¹DêD²ÓCê¦n2Nfj©§$ãÒ$$³¡H•»þ÷Y¤DQª+YRO-oûøð hŽºü4¼þ…KäaO2‰¦3ä2ä: ;GÓ}Nª<ƒ2™«†¿:·½Ë*ŽôhLÉð•\ëD…¶8f˜Ž¾LßÞN ((#ˆZp»ÄEábðé AÈß#‚¹§ÐC=j© MÐdðÛ€4†’ú[>G¶s}ÙA• KÊ‘KVT>‰ì‚rW¬Ð70ëÃ.{F3¬<Ú@Pd~`˜í€aÛ’ŽJ»jŒÜq9ö\ÕçÍv"¯±ÙÖQ” )ˆ¢tÚ( hŽb™7¡ÎË›û ‰£êÈìÂï;y#zÂá˜*õ 'mÇ s‰Õjј‚n‚™äf†¬—°-¼^'7¥Ø‚5~‘`‚#ÅÊ/øRšŠagií—VÌõ:…AИ9-íÌAÞA² 2„yu›jƒ3ÏÊ8(udeÓ«ÉëÉäÊþ¹7ßun4a£Ê`R{œYÌ·‹e¢ÛÁL ƒ¤Ò…?s¨³ÏŒqŠ 4Î+;ÄJè–„Ɇ‚U1/—Y^Ú±AµVÆÍ :ži®P̱uÑÞ1è â+É×þ/ªÛ?uXîã{±åû ÿš ?Â` º]‘·ÞO:‰ð.×Ô±³þ÷Sž,†&‘cØ#îQ¤#ˆXÿVOC:5¤cOC:Ð<%¶‚뿸øøcív%1q]ð=ҳ㾯?ÌÁ˜µϳlžè vœ0KK–8Ì/Ž£®Ã]½q€p賨Ë’·¹Û:lë²h?¹/ìÆ # qi'6œéËUÃFkÕý#ÍB˜÷r'â•åºPThzvÎ×UýéñÁt³ÜV[)eCœHosê0AÏOžÂ”¯&Ä…ÕVÞ5¦æz™¡^˜$9’ ÆÊE*g›§â¢¨`«`d¥Õb²zWkøùã[¬¸K ³ùQdÅ+=7YuÔœ¬ 0ui?ÂQêgèê²æŸñ;àž<ÕåøMUÞey\>ÉA‡{p;! ;qg"÷ *oš"ßÁ@p¡ÎÄ@®H²a ¶ÎOÃé¼¾té|™ÇiyÀõšüú†®9(w”õ¬Ïd"pO<Š‰1g³›:jÎÆDŒ( 5½Žô,^yÈhÆ}‡øŒúŽò]è„>§þmèß ?|Æü ò%÷#i„Lû·0^úšù"8’«÷ñv¨ÂU§;/Q%°§:/9{‘UlîbG0VS,Ó–-ÖÅÜ–V-¾5‡‹jf”Íêw³’†i’̈Zq¸¶0³ícVÙ΢*úVýãäD—°»5*fYÞ²ÚŠßðš<Îq÷+³\p˜²ã÷"±6ÆQ\|=Ë]ØÁ†÷º„ÞØûkçCœ{mrÇUõ"8¦‚ûS³]Ü˲}’ƒÆ’±Þ“Ýu•è¢oé7$š§Í endstream endobj 1159 0 obj << /Length 1978 /Filter /FlateDecode >> stream xÚ­Ykoã6ýž_¡A?¬ DŒHQ¯ébÝmgÚngÛN²[,2ƒ®,Ѷ0²äŠT2úã{ùÒËr'ƒ1I“÷Ås/iÏÙ8žóöâ7WoüÐIP’йY;~¢€NDcDß¹ÉÛÅuÛY*Ò¥K¢xñÎÝzÛ9[ºØ[\ê÷¬d)gºã#‚ðòãÍßÞ\ü~A£ç`'" œ¢È‹œlwqûÑsrÿÁñŸÄνšµshÃgé\_ürák=„ÁH‘З³Cì4ðÅÑàûÞ/ŒQD:&Õby~¤}â¼ü‹T0e¡U«’A4<Ç%„zÍÍV;z’Á$œ  å3r'â‚Å¡øi qcK,÷²Y7ùÒ¥^¼Ø¥"Û2.;ÑB€J5ªeªf½ž|w}ý£nduU±Lu…–nûÊb5w_s^¬Ê¡0®Ûi3ç”Cå·16+ V‰ß¶¬,ëÇ"Œ"ÛÉ—3ò\(ðÇÕ{b‚Åš;Ö¼@,€‡#?±Ãça ?ê·éQaÆ´SÂDQfnZås¸ˆö¨ÓVŸªú¾š‘E1Šigl\{‹ÿ-±ÄD»týÈ_di¥|ϲb}0¶$ÁâNBˆ5i))lí/ôîÊî}!¶s¶I(&³̘• °ŸðÁ ¼ŸÞÕа›4B‰Æ»)jHüÀ[z³Oº¹®Ý$ÒuGX~*ˆrëƒç–›P¤”Aâ%¾!£«œÙ,ð€næ·û}ÝÝ)¸þ¬j3.‰q‚`¥E™ª,Ã&.Írfh‰D!@&q¬f: ãܪ…[!öüõÕUÃò]Q1TïYUTëš³l]·U®LD/6Wç-ãW˜øxÄ:O'6Íj@I4$† ü%D‡æ]¯¤«-× ü/ C1DRŒüŸ?Æx 0"=ã)GwCÑПe/µù©Ù’•YÙr»©ÃÕÆ Á,ÐÔµÕ±o œ(ÃæÝÄ–†ýa¸ô4Æ’Ô6„6YwT;=Lt´¼³Ol‹ÓN¿ÓÖ¤~<ìB‚ñ¬[7ðNEaÝVŠÀOÄ@åó$y˜Pæ[Ц_5{/1-/8\ÊÃdT2¾YÆøvêùÒJ½sî\ô~]RÈè“ÂoÑpÂó=ÚXÌœ JÂþ@Ðœ )w„c ëòd»Ý˜ªj„¸SAµÓ¬ç­UÚe‡JÇ80ÖÔ¹q\±d™[VÍG‹x»rO-¼ß2«a¿/¡ž|:êŠMy¼ăMh~®›Gó¶ƒúóÌØ·+pc6kÄ6“œ×³-xs&ãXÙØËãížz…„§=÷Î6±•¥2xìNôMÌU/×>¬ü¼5LÖ0êÈŸ¥œå²Ò· ì‰.YöS¤‰ŸÚãÏ‚U¼wj›¥w' ééÐÐ…{˜sŒ/³dÓÔí~bø, ^ONËר =2.|è„U­®r„ª|s ÷Ûš³^‹>±í™”– Ks³-›¢¯í¼jŠéötµW6¨§Ý3k¸Ý¯¯ “«}~~˜ÚêD .m¤ ËÑ”gàoëu+Ú¦/Ožèro„uÚ[4Dq‡“”ׇJ¤Ÿ-xäŸ,éÔ”q£ q£ûŽïû(„°=t)Žà¸‰‚îb<’câÊòèAž<÷âØ‘`›n€mÇ#5 ò0ª‘ã4ò¡bŒ­à†9ëYÉ]¹;ùT·uØl¨;Ú˺UAQUÑ”Õg ©è†Þðd”½¿Þ¥eËþÖ•~ÜG’§®ºÔ= „/!ôöÕG³¼G«ìþ¡?†  [ÖÎT/,ƒåÉ´,•…³‘~qõ†{Ìùp9B­áGÑ9¨mûø¾ŽD¨¹P^C´tþýÿÕ_à>‹w»É-pæ¢øíçt·/?' I@~abHìᇣÁ\Ðó‚$¨&¡üe’PÈ’ज़ÈÆWºÿkSÈÇ*Ù|S”Ì‚8S|:Z~^†ÑS K—.&½þ7u“­?\03ë§JÖ²õN•Å²%iÿ›"ÝT5EÆUíñG9Þ”³uÑ%þª7b%OaÙþ»®É{9?7µ¨³ºÔ½kõî3šð_ŒðÊ?Ó:K6Ñ XÀuE®k¾¡uª`èÍDu³Ñý¬ÞíZ(E#Ýñ£º5«Å´×\T‚5UZvß›VÆõ€£÷[=ïœ4‘Âs^HFÜÚ™¦_-†Êx½c]öi¥®7J\mȺd›43³¡bÎÛLðS¥wÝSÔHÆð49Ï—W½3Á ÎìŽ5‡¹ù«VÌ0Cè?ÿt9ŸèG%ùb§ ääS Ço ~ˆÂ¸/ÖõûÆñKÑ¿•t/Çê&÷¼£ÈžvÝ1—~qØO®=óO2’éä]ÁÌ5µð½¤êã þÙW.¸'îºk¢çó¦|Sð¬aÂ~ý}µoísì?뢴¥½×Í÷úÌ—„ÞðÉÈwu™w×çÑÄ|#OŠo“V›‰“ižCÆð±kÏ `Úoƒ`£—P¨@ÑhÅôg43 Ÿü+Úño} ‚B¹ƒM(T>ò×BÎyHvh¢„tI%S›ÿ•é+Û endstream endobj 1168 0 obj << /Length 2081 /Filter /FlateDecode >> stream xÚÍYmÛ6þ¾¿BÀáp6Ó¤$Rò^ Mš4-Òîe·Í‡´0d‰¶…Ó[%:Îýñr(Ù’ïzwÛ;,°¢†Ôpf8óÌ M•C·ßÜ\Lßx™‘™p…s³t× üø3ϹIœO£ëMÆ‘ŠÆ7G?7²ÆÑÛMšÈñ„ÑÑ3$|™Œ‰/q ÿvóýÅ·7¿_0ØŒ: ™û$ çŸ~£NôïJ¼YèlͪÜñEÏ̹¾øÏí :Ê(¡^`½-TôåÒlJ §zåààÃÛ¾"$‚yN@) Í)Q6à8=!sÁ=B©Š.D€NÈ‚9údÃÈvHÙÛfF(cûÛPÃÐ#³ l×ÒYåÜZoø4Ö®‚5…o­)fŒ0ØËX3/“Ŧ¹O¥£(ŽeÓàøy-£‡àc[§J¾ÐvÞàdÆge‚³IÚĵT²é-‰Ë4ëSÒ¢Ú¨e]fIZ¬úÒ„ÿkižÙ=“¤Þmú9Ê6ÿof;!¨2/u½“!È}°0|@ü„±à. )?'ŒO¢Šð|" Ç>L­Ö8ÍŸ»|dôž#©‘Jéð%T¼Öö×/eOµ–8èÌjfk|v í;*û´ï Ùm‚!“>í J}.Ë2ËJ½Á¶9…Ë ¿£ïFRâ{ÞëóÇãÞ6=`DÆOŒLrtˆ^l0JÇOþù%ŠUv{$ŒôÒ#±>\óü…«yî±\AÐ+uõ‹ZGÅW˜#µ°øÐäQ–Ýñ•;)<"Ò T‘ž/Ï]Ê>?à|™-ç‡Îù~yš…ëùO8\@±D]´Ñ·_¢¼ÊäYñÊgPÅ=&^ýtæ§Í"†ÁcÂu·Ë~´Z¾O­2ÿŽTŠ™Ôe{ö¡K®vá9©Ù$bÍpÏŸ?"íw¹ÞækÒÂbДø|ݯÞí¾Š™|ˆf{¥ üSJö$yµ«>·ïm‚®´9Z¡$ Ü»¬©#t:D-—©ImåuL-NéaÑ…é¹G`oAéõ¡^]v9j >Ôú;¯µê*mú‡çùp0>t Osœ=ûr=³ø+å4^Db`áèÜ1ÓüAx­Ý4u>M"ÚÆ.m% G«iRÆÍô}GŸ¿¬ªL÷ÚiY̯êR•q™Ías¶ðH•,mB@áQ:ÓbOßøû ¼vÂÒ-`,•¼Äe=]]A<ªbV½ìJS?0‡ïú¢ÅH ˜²BZ˜Ó´Zâ²FEµ-5Yá“Üg£ëßSËô¶ÜÔHinÁ™r;Ûàì¦Ù1²«4÷}Öb¤ÃÂõCÍ ' iªa˜Rv7ðj+>°‡­»ëpXLƒ µõ]W7äÆ  ~;ãÆqYciÇÐ2j˼ÿéõ7cxÿùéïA®h…Ë`Z·š|óêjúî iïtiËB'Áy{£§a„.À8¨ MÓ–ÕËj—9|šhSé #LüWË ee…[KkT¡g¬èÎ …ŒQ׸¨daŽæ¶Ø-5BB-óÒ8 @RísKœCÇ‚‰¢TH1'hYÖÄYÙØïL{äé§F‚Œb»ëάÓN^UGE[z€ß¸Quؽ§j5òÙñV,Í«²VQaÉF`lý^"«¶q4!µ?×(ˆ®Ç0‚~._d»Ïnµ)²4‡ˆ³½žÆ#ütßÜt1[]âÒ†Þú7ÃYçÏó¾ÛÎÇj`£ Ý]ŸÂ¶¡ WcÑYé¼Æf¶Ýу ‚zš¢•MíxYË"^žæ½]³ß›M¥ÖòÖøfz ÂBš™œgÈ—çÛÑ ìØ4)Y•›ÏæeYO£ˆ*§ÕfѦ‚iU‡qÝÉ1G\Q5À&L'àäh&ˆ¬0H‹d“Ê ˆö"w",š€ƒOv‡8í%ÌÕò»ÂÓò †J ‰ ”¹ñ|(Ã=¨Æm/óúÇ+ïƒÐç&õ¿Û­Þ|þ'MoÛˆ/xöFòÆ„Ž-W0B—åÊ4פÁ5±®wô’…ýhƒ&@1ñ sWƒ$c@ú•RWf-Ô²H9üzóܸ·N­x§„ÂŒ ƒEÔIÓn}]€ãýkÌù¨é²èY’Ó¯±ç6Ì Íûд° Eí?q¹ ïgnáà¼7ظGBa<)*o¾Üñ]' >#D{²Zã¶Ó’J–á’öØ€hl$ÕPCW@á -HûÆGúq´,7…åœÚIkáP—=¿CöW–%®ã@mª²hÌyû,½³ ÐÓBëiðySÉ85ž”‹×Ú»Lñk4^Éã7‚íß.uÜæ‹ôÄ·"ÊåWrÌžöæÈ“‡vïÜ%Üñsi¯×ÿý¸ë|;—ÇÒOÕb1Hè¡ocÿ#ô¨ò¨ß§Ý5zçß—ý2 È°á Æq]>(&&ÐÕŽ^÷‹¶…T[Ù^£Ó°ºœ·\â r®©eMf#ý=ÛªÅ=-Ô›ƒÝÅt_×ᯨ܇@½÷¨Gåõ]˜0ÄëZœ&g±}Ë«uT©ö÷^pO¸îà÷à¨7†’þ dÔzS endstream endobj 1175 0 obj << /Length 577 /Filter /FlateDecode >> stream xÚ½—ËnÛ0E÷ú .% fIê½-ÚH¢mœUŒ4v èáPTôë;z´pÜ.b䆦e‘g†Wž«adO¹òÞm½·Ää4ODB¶;¦ £˜¤QF£<$ÛŠÜù7ƒV¥42؈4óo{ÐóìjPÎü7ó…oPƒìaþRAyð°½ö>l½'#‘NR›G4e))ïî‘ ¯_FÃ<#Ç鮆DI†Ÿ5¹ñ¾zl‰–FFÍYF³7挲0£¾"™ð¿×aªùÉ¢i†?L7—]{ϘÐÍÙŠ˜Í¼dÃSš‡bEƒ¬^ WŽZ°JèQâÒXEtÐò‚4Ö(Q)i—¢ÂÿF­¶JSMU±Ó?Áè’¤Ö¨µPJ¬.vOïd[©…%MaTQ¶Õ*»º*4ôFj»…â õHÝ8©V%k…çX^èˆ%‡ÚªZÓÉ]†Yå¦;8 È@0ÿGÀcÿų§ï­¡•5CÛwµ*Ñ}+˾կæ­IOö½Ú·Xqb×%¡–ÏEƒ¯ƒ¶[ Ñ;]å 5´_±îu¦-Ʊ¶›WYw=¸¡T`œö`L¡Ú]gU&9˜ïø<ŒŽ“Üäc§PiT b¬Š8ŒÉ9©‹/ŽSÓ;í@kËõ£?tmoW´“ú^üxÞSÇÉ«[ê¿Ü"Â~/ÇQÓ`“á¿ÿü%œ;úO“¯ŽÃóqôÙNc5‰â„æâO?÷5ÂØ® endstream endobj 1179 0 obj << /Length 1105 /Filter /FlateDecode >> stream xÚµXËnã6Ýû+¸´˜åC”ÈiQ íLÌb0M\t‘ Æ¢muIÕc’ è¿÷’”]ÉNÜDN …ÈKòÜ/ÉC´FO~^L¾û•‡Ha²-V(b( $G‹]M/Û*]êFÏæ,’ÓßkSùÒy›&f6§dzæ&3º6¾Â1Ãtöeñqòa1ùkBAAÔƒ8"ZÞN®¾”€ü#"˜+‰î\¯[„þºœü6!¡¤opÐ7˜‰eÀ”`Â#oõ5c¡S¿^ªÞ W‚×Y·ÍÆäuÓÄ•©K?SèK0 ¹µ/¤¨¨Ꮰ¥X Á,ø<±dšsî,sJ’¼äqš'Ǭ"hÎ@ ýÅ&­!œ‚L¿Î ÎfFÅôá΋*ñ ·ºYnL׫Èý¼ñ…÷Ÿ>s_JóÆT¹Î¶µÄ:[T¾zM×ëzÛ¶bRäuWÓe™Ù±éVÙÆèrBˆ)¶óœbÙMàåCÞèûA°ˆK‹æ>@äV(qH9 D0 Gó+‚ŒÄ.Ç’2$Å$PÇ0 7ÇD±‚"ûm¾¶Jzj&”öÕXyq¬"¹® Z=Š¼¿$KÒMBHà[ËB P5ÌÁw?¬2½þñï3ÿÇÿã"ý˜®£1ÇTÊ;˜7¡–â%Ó6ð{°Ž¬ßÕÞï?6¦2ý\ïR½ÞKõ\ßv¥bµ×ôÄz7ÈPDCp‰æ4ŠóÝV$†½®æ‚ÀJʲ¸nÜJª‡í¤`Ç–™®ë˜ÆfÆÄô›Ý`{Š?Š½ ¨Ü˜$nR˜“1áÉŠ¥Îâe‘7U‘ÒŸxÒ¥‰£½ÉÌ©0°—6ºjÆE£ˆWm¾×mYOýO`Š›?Ͳ‰Ûük^XËîòQö”º‚å«"6UGÉŒA’Ä73F¦íÊÊV[X¹o¬ì²õÆŽÒ£³ Ž©‡Ø¡÷rÙ6i¾·ðŠìak˜ŠªjËqÓ ©`*ï]³Ó!Û‚qì@`ô  wif·6Ö1 /t› üuîF …~gd}öÒ,­Óaj·çB¡6 žÍ9X¼˜IPê¥;Eq±¢6kÒ2ë† €¯‰ ?}zßé~(MÏZh£–„²hÚÖÝà>ÝrñtôÌÇcµ%>F; öŽ…f£›Ž]µuWºéŽçÊ+Òœ÷ú®G¼×Nõ)D‡; À¦ß˜èôԼѡJaAÃ=¢Ó?d¿?ã¼> stream xÚÕYYoG~ç¯èÇøA}UŸ !€lÃŽ56œ »‚!ð+L¨‚CÆñ¿ÏW=’-öP$dDÕtWwýuÕŒÑÁ -ŒZ8ƒÿ¢Ö'žÉÂæÌ#^8ç˜ á1EÈÌ“ˆTx²ˆIBÉ–íœHÁ‚HFäÄ#‰:6Pc,ËJ^€(³¤Aº!Wæ°?u+±ÈY;-\Ñ ƒÏ¥2+Þá1µ2öMÐ+üçñ“Md ?¹Ȭ¹X˜°šòÀ(c;Ý0a-Ûf4 [41Ú M˜ò XªÑþ„M xS(*l$Ï;Ñò˜Ñ‚tðaœ «#yP>Ãœe3 ‚ˆØAP–(²Tc9c:§‘7¼” fPÊónû",`±o‰‹1Tq86¥YO¨ãt·KÅ.7DÂYÍ+È GÎ øÚQb ÊÙ(çïÓœ/Ü6ƒòeÌv¼Aø\Ììd–KÄ2vMÅIÙ°L„Ïe_(ì—»AxMŽeDP±ì—„7¥A·mõFxÒl6ðä …ô¤T('¼³e…UÖ:ìç kŠà{Ÿ dxH‹e ©ï'• Ø9Ãxð9~d».þ‡èÀ¡E"X_ÆœΕ1/Bp, ËBÊœOÙä_4%ÂpB´%Âp|´Å'³T|‚E§ÙëHÛØåŽ]ôE·`y!ѺÁùù@½×8­ÇùR¨_þû?>D6“´P¨^Ífïß__5õRœŸ õŠfZV¼B¢n÷€8¤%?`•úå?£ßªq·êÍ áð‡ÙÍøªZŠk¡~|ùJ¨wÕŸKæÞV/Äg±ï>Í+0`p ^@…ª^¶ŒE㺬ÚfµWm‡9eìm5™Ÿ7Šk×ÄlßCàpÕÌXT|P<õ#ÀÉ>J† }<ðÈè w`¯ÍÃRCë¯ø&4'òMØöMtOóº¨ë»]wÈÍzmˆ- uµ-Ëó¿§õïõ¼YLªEÙ\¿W?¨7êŵ)¬ì½ÞIª%pÛ&+3àŒ’–1:p]—\ õºy×Dç»ë¦M-LÏØ;kqóýqÛfž˜(ÉP?#ù ƒ{2hzú¡y”%;ƒï°{Ö£#ÙíÄHúðC“ÌÁ‡æ[Øic¯m;’>¹#lÛ7±ÒFbi'ýÎ|Ù`D- ù®íeÄu!“N[3m»5›Ã±$ëSbI4Rk.0 \Ï•W¯ó$QÕí“ñ¯Ãù²ZHC[X’íž!_cä{X÷3¡z÷{/£#`ôýŒ( ¥GÑˈ*GâNø;òÇèmÈ1zOÈAmçO>eþ °“\S‚“‰(È€Ú‘,bð•Ëh5z¸ I/ÍfmöK£uF $ÉõQ/#_Iè.ö èZ ²Ýõzä èšmtà†ãÐèrëÃú”Χ#Ì·ðbW€QH ó%À:ˈª•ôè/È{ÉDÀ8š†÷Ÿs¦¤Œº8?/ÔE‰°ºR?]¾á¿ï~].çÿRj4knå´žMëép,ëj©ÐZ¥ƒÒYµ«Åt<\Ïî&þl4ŽŸMÛå´¾UϾ¤Èq ‹ÖOF´%dP• ””£tžIí7˧$íã\=öäép¸ÑxJ4è]QýÀ± åþ£]Öµ)ynöàuFdxò2x×ÏHQã\‡~F€!ö3šè¥?în^;Š[=ÔAçÒšç2?í\>6Úê=³ÆÙ;èã{)fé#õ3šD¨ÛÃ?ûh‡í}¬^/šÕ¼{«²‰…6ÜC ­µ_>uë€Oïúó¶ãOB½¸R/«?¦ãêòõstb¹XU'9î^GÜM¨´PJî`ïpafd*jSÒÔÓ¶ùÓáÎçŠOËòZw0ÿwÞHré)z”ì¢}›6Û:I6÷3: ¨s®ŸÑx4ù~F°Ó:Ÿîô¼¶)ïµìi^MÊÛ‡†âáÀDißø¥þ’}“Éç,SNýŒY™s?dÍN”Û`´ɺώÆóõC§»†C·#²îˆÈº}#ëÖ=RBõóytOÆõó9Ê8龟Ѧ ½éçžK~Õ}Ìù=8J~G”ü¾Q vë’òá¨òÜ¢ßÊ$Ð< CE%+3 -Í}zZqÞ¢:_T“»i]Éf^ÕÓúCäÿЬêɰ೸UÓ¶]U­2–̳«Àï›p~(Ù` 6ð‰#Ïé)Jö3 „Ã3 Ð}™R> ^v_2:"×»%tü ˆK hH¨üBÊ['m|rçöñãGy×LF«¶$¤·êmy¾¹˜ÏgܸaÝ |ºlÆÍìægscF$ç“_kÞö¶/£f(!É/Ô(9t8¥ o«¶Þ¢Õ¼ys7ŸUwWgÏëÕtR±1ztœ-Ä*î cøR"48»t1m;•·Íêùa¡§õ¸RóÕè!jR-»Òíl2­Qʶ…D½{6«Ú³öS»„¡íÙ´ž¬ÚåbZÍ0øЂWK0‡íYç1u¸å÷%'9’‰¿¾:´®™ßÂ8Mú2¼ ÓýW¦~œ[c„½Õ6ýŒè­mèg4‰»ñ(F¿ Š‘žŠ í¾¶ôkâá¶í¸òc<¶ž{ò/wP¼ endstream endobj 1190 0 obj << /Length 1697 /Filter /FlateDecode >> stream xÚ½YmoÓHþž_áŽÔ,ûâ]Û!Ýõ•“=Ý@Èu6­Ç~iˆÄ¿Ù·ÄvܦmÊ ï®×ÏÌ<3»3“bïÊÃÞ›Éï“g¯™ðb *¼‹…ÇBxÀ½0ˆP3ïbî}ò?¶U–&M2Ñ0òÿ®eeFoÚl.§3‚ý³ðAæ2©¥™0D™~¹x;yu1ù>! {Ä )€(Ä¡—.'Ÿ¾`oëo=ŒXyk½ké"‚gî}œü5ÁV[Œ(‰LíÄ«àÅÞâ‡1»”T‚f¡5iS4É­Ý^‹VúÀôô„y"PÀâ;uÁ¼oõïaD„ƒ DwaÀn†pL-ñÔ?ÐÍ @·ý•Ž˜aBºbÔz2‡‘®¤·EÞñÑjRõ" U–Tqĉ%u^¬Ø×òòßÓWUÙ®^ž¼¸Iª,i²²x©©v'é<`ˆDÑ#Ûw\„Q|7ÄÐq=ËÁç½p‚‚3…±üŸkY©°çØ·¶›IRÌíêÍ”rdžyë¾ÉŠFN ÷¯ôÉ‚³;oemæ—²YKY˜ `SÎLš·u¦¾½Qp™¿÷¹Ñ‡†sN•™Ø›1†"púοsutÏÍ€ø†h™¹¸Î´ Ìÿ6…‹B›¹Y«aYÍÍ‹u–çf”&­¾=`Ø\ÛÁ¢ÌóR™´ÎŠ+µøi |y_®£VFSšç2iÒkû¾Vr–Ôµ\^æÒ*¬V¹ºà2·÷rJ±ß.”Ô¸„sMg Ö.v c¦˜P&ÒŒÉÓ0, €õšæGm6?Þ½gf´¨’«¥±f묹6£³gö“J.KE¨ñ¶ÊüϘãõu–ÚÝeš¶V’ÜEFµ1KDXÅ6¬áK¢nrBlpá­sÔiž†H¤år•KˆÜœî'&2We]g—ùÆÌ,yÎv—K3Z¶y“ª™Y.`”gÅ7;J6¥¬ä½xeEÇæ…’£Ò' ùåi¡#æ—¥W…{»m ÉÕJVÔͯGÁgŒ©Ì·G¯uëYq«²H“UÝæºìíŸ)6´# , ·0°Ü*3bjÌ€UÓÀ 1eò#[¶K3Ñ/b>3Sm‚ÖNÒèÛ¦½Æ æ•\U²† ˆë°Aq¼Qú€>N·ž1¥ FƒD¬W)•ÿº:; endstream endobj 1198 0 obj << /Length 1624 /Filter /FlateDecode >> stream xÚÅX[oÛ6~÷¯ÐžjMR¢.i1 íz]d·—´H‰Ž…È’&Êu³_¿Ã›,Éi×)#)ÓçÆïœó‘عr°ózò|1™¿ò'Fq@g±tBê„~„üØs™s>=Û4yš´ÉÌ¥a4ýKðF^oòŒÏ\‚§õ‹¼à‰àzâ!ŠÈìÓâÝäåbòÏ„€2ì-ÜG!t=9ÿ„ Þ¿s0òâÈÙªUkÇ"xÎÙäÏ  %a/Ô†~Ä §K¤”bDIR}øÈŽ"§1{/?¼ž8ç®>¬Ú¶>™Ïžd¨Þd%J«õ<«f”M·eQ%™ A0ç—Uu=2ùöÔ}— Œêl©UƒµE*0wIˆbjKߖ˪Y'm^•ÀOí³]q=¨›ª­ÒªÐ³41ß_š¯—Õ¦ÌôpÅ~r¸Ï4ê|.ò–7I»i8jªôzË‹"Ù´•¶OÅ!ÏÒùUSmjÑ[ ÑI7k^¶b¾­ç¼ä­ÛùJPÌíë¶Æ˜\¸¼të½aD¨4Žž4. ÚâñK°Xa”øÈó*÷”xŠI¬•¼õ€R ½gu­ï“ÅÓ›l¯íï3¦\þ»ÙÊ/«FþÏÄQfIoYgÌ"¢ÍJêÚ-FÀЭÕÃìo_ïß Œ‚ÇÓÂþHÚt^0 ùTp‘ƒŒ·=µ“_Ÿ¨8ߦñÎÈ3ßCR÷ð°íñA»wgf4@ĺÿòk²® .‚ P‡GÁÉ@2º;.Lƒ¦ž–>š´ÜŽÙ7Á$ÄêI—ÅÊNüÍ¥¿´…¸ïÚe’<;œo¤v·„ƒ°éòmz6s=ŸMEÍÓ<)ôä‹lïI±ázúy)«´ŠÅ#ýF5^9¸4K6BY9‚®kY—óòJÏ*óƒ{š=ý"7_lW¹,ãr¸kòr¦kxnìlA3—ÅlºXåbdÕ ö’›q¾t_¶GÞd›¨¸(ÍH4mõ‹ëRÛ8j';ÃT·1}d»â¦ï¤¼i“ÜL>_‚•få¦}dVTe–Kg„žkK-7;¨½"t×ÈнçZ-4uP«=­÷﫧g{» §W¹ŒÏÅŒ+›Z?­ÿÀx»%MbĤ@„»2hø :ß‹†í÷#¥lÄ]†èU­éõX¶Ñœ4ܪ–0ÞõûÒ `7Õs½£ [##@ÓÆ:|?{„âúRƳ[ã´CëãÙzôÜ"@ l›d)#™BSãˆeR˜0JJÏÑd€ä诧Fy‡èt•”%/,Ñþ?ýÆ/`ÈmÁdžŽäæÂî$`6-6¢‡3•Çî-ݹ¡KTa4‰0A£=äíòd©6³ƒÌP96nü Pù˜«é…*Õâ:‡ δ¼A:Ñ(F>ñ­Dë™àí¥{MÅgˆø> ¼1Ç“jÅé¥ Ç1ê^.ÃÁÆÔy¸Hºl»¼UK}Þ€Áûç>•"’Ëb”£ß(²#|ðò*/ù1v G%Š££(…ÀÅ$üÙŒ½§æ§1vJcD£àöxª37€âP&k~,e?¢&f— Én¶œÉ ßY3Þôï5«EövaûF[AW1tsÜ[ª´ÈUùR-e§Æ0iˆáf…b`KÞt?²ð–sÉåö š¬.F³á=­mR\«Óœ¼YXÊÖVƒ_œ½±4¡ó…±)d|sÌ|Ø•{_ߊŸ"B ›Š|•rÀ? CË_^ÀQ¥µ×…>D! ttþaslé•®¢Õ endstream endobj 1210 0 obj << /Length 1575 /Filter /FlateDecode >> stream xÚ½Y[oÛ6~÷¯Ðú$ C‘ºPÙå¡Ãº­Ø€®ñžÒÀP$:&*K*)-5†ý÷Š”l)‰ËE` ’(žs¾s?b°sç`ç×ÙÛÅìâ Å! ÅÊ¡Qˆ?p"Ÿ!?¦Î"s®Ý«FŠ4©“ù9‰˜û·âÒÜýÚˆŒÏÏ=ìž™…<ç‰âæ"‚¼ùÍâýì—ÅìË̉ØñœˆsE8rÒÍìú;¬¿w0¢1sîÛ]Ç\sçjö× [´y#R½;ô /,~ÜéÅ@¯Ð×zi©F˜FF¥¤ªòdN°»|.—÷R?•ÅÝ2’§µ(‹å'Œ‰œ{«êe¦õ×Êth@@¼g8ì€Òˆõ&+7`êS·’e]¦enžÄ¦Êù†u¢%(½H\Q˜—;;ë§u‹ï-ß²²/$ÿÒFÍÅÐß‹zݽÒÛïæ›ÈL™µº´×µeÓª¥jóYyÄíõFóó€Åî¢ÛÿÛbñA«®uô<ѱJ¤ …»B™kR˜k‹ãk¢µ5 åÊ\ëµPÈO{Î;‚ç3î/‚;[ÁŠ©5+uyq!y¶GeÅ Q¬JÅÓUÙYk[T‚ë˜{w!”j¸ºˆc:ðßË£iJ†bÄ"úD$e¼;.+P­ï—e‘kƒlá†ïìˆxúÐG‘6¢¡9ÛùÖÜ©&M9Ïxf½Òo°^Ø÷1¸ï4ªÒúð¸Ù:ÑÒ_ýÙ-i· =m<\;žu=Ñ¢þíM¹ì_ªÏ¢ª@ÏodÂ{-*±ªu¼Û‡[ž&ÚE± ]Ì´:b•…6tG‹­¦ ñ’yȇòŠ ¤·‰°pʦ67iYdÂÔ†ªEb´g3Éüž¨Ííœø" ¼>!†ç-÷W©U-Š»çL ´‘%¾ÚBûzi)ôOCi ~ÐB†B:~¡0 ¶„ºFômaÀƒyÄñ¡­hãà») £aá9úØÌ `{¸²'&FØóöÅèu?¢ 8ëKî¬åÜ×ѵíUà‡A¯ò¡ýB—4ÖÌ›äòú»›T뉕Èy‘løOß·æ}LÐAƒ>EÔÕã­õÐiÀÂá´ÖíIˆ°oÓµm?m6¶j›{ݺŒú6mEžwijkdnÑ@Ýûôu[6²ËûU›êMnYÊ&ç6ïó25­£ïv{MçQ<ë®ds–X«³a+…°»WM±Wrú*›˜Ë&©ÓõpcW¥´ë³®óÛi‰ß¶pÒ^ŠXhÓöwƒ’¾G:è˜/ÊdÀÕOÊdŠ Pr86ƒb‡’É{bö3Ù2>:“a¼Äºòëò†h0Xé&SHóA¶S?vªzÜôÍ£bËzÅ´šý*¢xu-¢ Â}ŽÎõyˆuB8‘w ®ž ¦ç•ipiËâÒCdŶhA.壖1ÀG "QÜá+`j±ù­8û§0Xù؃ÿñ1þý¯ÍÞs˪•rݵð Ó*´zVZ1^D´žBT¿Q5…M!’Sˆø¢/SˆšWƒ§^͹Ë)Dù"1…¨x5“¿÷æ´òò’Âh ëRÕr<1]l§Y‚}ø(¦]½¬eÃUWâ!hñvóiÅ@; è°J^7²8XÞaž-ïÇCb3™EÀ Gòâ'ÏÁÇÏG`A³8j& æê`4v>5FÚ#¡j.ÕhF¼ÕßÍÍjNwÅ¥?Óèí®Ä2ÔÞ鄨jp@ðs#%/êî|¡ç¼*ó¼Ô|ïuœ›1Vv#¸9·‚—ðy›Üæür˜^‘̆Óõ'³q7°¨ÓÏí)@÷@HhÏŠZtw»Î:=Ò¼ÉzhkždÚ:Ý|OžC°ÍË$‹nK¥}µ€'›]Žå?c}Ø…)N"F2ÑQr?‰>täª^æ¢à“ì8àrÐ!ôxFßN¿´,? ~:ŸFq¹LîôíÉÖº-³í)ˆTUŠ?jôñÑ|àÃã‹Oæþÿ ýŠGžgÕƒ:Æ ’„„> stream xÚí[moÛ6þî_!t+&o1KRï6 ºv¶u‰‡}H»Ž‘興-¹’¼,ößw|‘cÉŽË×mB€¢xïŽÇ#}'bëÂÂÖ‹Á³ñàÉ7ŽoE(ò©o'V@­À ‘9Ö8±ÎìÓE!bV±áˆ¡ýSÉ ]{± Ž¶tà ŸrVrýà ŠÈðíøÕàùxð~@`0l î¢V<œ½ÅVí¯,Œœ(´®T¯™åú!”SëtðãFqƒáh…á˜uB+ a'ÐL¿¡ÔS£×dÖÙÈÃØN«jŽ ^Îó¬äïRÎ^”¨`CâÙWMlH€"‡î‚xž'×›aœ]`â<¿\öj_‰×@y:‚š=lW)ו—ãñk];Rl/&CêÙN7¦L¶þ&Å4LS1«DžGLfžM¯õ«<3]c–hÓ ²rÎãŠ'¦ùºYÆ…˜W¦©j¼ªÄŒ#->"0{Qß‘“ï«}¬5ž¼ÐæIŠ<Êé…: }£ŠïXïTÛÝd‘ÅRš†Ž±²+9€úІQú!ò‰cùØGAn5Ìl7ð–ÆÙÀ µÜȃÒ߆½ÁRà_cKþsºÌ­·¬Œ!LÈê8²Ý ë5rÁ­ÉFèöjZ–r]9Žž‹FˉYy¾k…°ò Ð®Â‹Pž«çb³ò¦CN¬èÕ5Ç>]Á•î‡H Pg0ÃikÍØo°‡YqQBIô:¡> £Ö S‰4)3¶æ*QÌ?ÅA£åD-C–á—mÖïÔŠ!¬ò²*DvqŸg†êÕä¾l´(@ûQ‹‹{¥]ˆªƒÍ»¡.DE"Þ…è}¢ÅÁØ+6¹ïºM»‰.DÙÁTþ¨½þßÖê^Τå_qÓ›‰I‹¥»ÝZ˱ÂY|µñ«Ÿ´yÝÙ[~Õâ‡ÈmÛ“Ýœz?_m¹!Ä;»Ù–fØu¼å§ lwÇ=r(‚#ÃVoÐœ=Í°ìx"²Dzøwî¿t!zÝ…è‡.D§]ˆÆ]ˆÌ~Ñ…èÉv¹;ð[gDçËý|wÁ‹ˆÇÛ£ç;áÌÿƒVöò`Ëm|0¿Óiåƒ,îBôé9Bìs‚ 8@^äï¹QRì"×qš;eÁ«E‘í|hí¨j#_î¨dßsÁÈ‹Yîé¡FåYÒEhpŒ´)r' ¬ ">œÚð‡UÛ-ÒnŠ&l«x®ƒHv Š¬g$†O‚]‚3·G  䆞–t\GÑVCW˨—™1U'&4Vè#4ûÖДi¾˜&·’Áá²µ‹ó,2b"‘:–¡;Ö<¤<¾4!¼I=¨Š‡šÀY^)ïÖŽ:>Ï*Q4d<6S{ŸÀ˜ë¢C¯Àõ <çˆd(×Ý'0¶2N#0fs]‚(¥™¨Ú±dùëªëä6…Ó¦y̦Û~©_TK·”qž”ûEàLãŸéŸÁo0¥FéÃk}x­¯ýÃkE€¿«“­ÏÕõé¼XðmÞUŸHMçýœ;õÀ:Ícò†“éÖSçª{˜g—óuŸƒêsPý&Ùo’ý&Ùç úTŸƒêsP}ªÏAõ9¨>Õç þ‰Tô1å ‚{êã̸uÎŒuÈŠ¬eg$†ç¹]2c÷ÿ»¾&@\ä¸>59J¨âL©äû¼˜±©øC] PŸ†¡ýl1™È¯³y!?=oïNû|Of~å§ï£E!ôˆ™aƒ­ZI@i% ßÈúÄÖHPIY©+Õ•!×l>ç¬`YÌÍ[‘é²¾'!¿£w¨ÉñA»¹\ðn‰Ë²ÄàÖ]jžy²dA&]熫rÎbSÕ‰@¨p ü;›Í§æNYBåœ×¼%’'ž,“‚R‰¾–øJT)ŒB#͈¬¤R7ºðˆWCàZéDÃöc*óžžÀÖ*ÅÈ®1¼vë;E¥»V©( R^Õð$LÉt¡¤;’"GöŒ³lI£õ"cZ NHNÔءʹ*(Óyž—¥8—ªÐç‹‹Z¼¼!¾·Ò›‘Êå±xƒ1õ³ä’užâ¦<®ôu x 芚|(™&0ȉ¦¯‘GUåJÙ97´ËQV,E¡P3ýAÛˆ‚ÚˆV©WŒhƒ´šPÞÄXæù„ªøÆ[#&¯}šµ2ÖMFnî‚”wõk`xÉ’V®¬¤ÛBm,”uPϳ7¦¿Ÿ‚GØ#»TΨÒÏ`±¥(%ëò)Ÿè²¾ ¤XР Õ7ld£b[uå¬,ùì\Þ˜‘Ï3¦ñM·z”¹l¼nŽöYš~—°Jdùö†Ór±^¤¬ÆaYÊÉå¦ùY+žUGõw³sQ_ïi &xs°ufŒàç´¾ÅSð™é%ÊÆÕž˜M§õ´,çë×íöÙæ´K;n8ïö-2Ï…-âÞ—È6Þrs)"Ä$èC_q.…APïò_§l^Õ÷Ý\P‡Oië>ÜÉbÊË6§’ñ’ endstream endobj 1233 0 obj << /Length 1118 /Filter /FlateDecode >> stream xÚÕWK“›F¾ëW̪ÂhÞÀæ;ñ:ŽËåx•\Ö®‚ÑŠ FV9¿>=X‰UìËUN.04Ó=_wt7Ý!‚®OV‹å3®PŽsÅZmO–B¢TdXä­*tÝúº,L',Í¢ßÝûÕõ¡®tœP}çot£‹AûŽ¦ñ»Õ‹ÅO«Åû… ¢(e`\à”¤¨Ü-nßTü"˜ç:º];$T÷Ý,~]€öý‚eK·ƒIÀim "B­­åÏ;@üc*Þ±üÄ1»UH,Á®óé‰.‹ƒƒšËÈÄ4Ú†uå…U=Ø»ˆÖºnＨíú]ÑÔé <æö˜ó½mÇma¼hܧU^b:/YëïÁ MìȨhÃskt¿ïµ)Lݵ8N„Ñ« C€361“ÑF÷£…^_í<Š¦±I€˜%”â\JïÿóÕêuòg ¹Ó1•ÑÇ£]v}5ØTJõÈAïÖ;ƒÑn|½zy“„åÍÍËûåóqù ÌûUÑ U Î”É /v!˜BžfŠ[&(ŠzHúá›kOX*0ŠÙÄ‚_<Ã9 T… Ái$2ž„O»Ý‚·®›Ú|ô'6Íïs’r%¤ô“$M3œª‰§§ê˜æ9bÊË?e‚ ˆœò`ÂñVœ~iŠy†¸äXIå}|Ú-Z3œ¹3£;UX€^BSœó›·ŒÉó`F2 (p™òAŸ ]Ð!ø÷Ö¡6¸ïs ¹ñþ|´gÞ9FªsfLõu`ºÕó—˜Kà:'ÀuàO£Ê~!ÀúÒÇó1xo2 ¸¿ ^¨Ænÿ5ÜoÞz°%µ0ÿÀo áÝq]Ͼ°ÿ>ä+è>èÁ릶P¸O!œÕ7) ´Â/(Pg%ҪÛ/©ㆲ&¬\`š ”CÉKQ¯Ñæü@‰óL>Pñ'xÍ óøf2@>y, Œ¬2>Ê©G2Û#íÕšñ¥Ú1K!4(íJnüSJ#¡ mtõ!tÉML3hˆ¥ÑcR€ÎíÞ}x°{ß×®ÏÁÒ p瘸V:k$ô€àÍë (˜W„ûÉtO`ÆvpÁ#ã&"½…vwØYGdßw6 `ü«ÎMJc`ÜÃ…9#ì*Z?1 Ó—5]{§GŒ[7 ÁŠIT¶E_@”ܤc·×Áº{ªÍd8ÚKÓëYxzs “hø Î†˜VÛÁå¨Côý9vCYê}hƒ÷¾Û'Ñ Ù›<´éÛŽ¼‡V}òð2B £Ý)ßΛ=ÿçfO-ÿÐøŸe¡Í„ðQ ÛDmÙWËe¯«]ÝjÜíu[·›nÐå¦;´•ŸI;ïÞ²†ƒ–”eôbÕœ¼`_ß]m¶‡u,H„Ën·¬Û¦në¢\!“Ëý¡i–T¤ò"°ùÜ'”ˆGÿ›<üƒ²?0þÑà'Xƒï2QŒ}~6Eþjr6Õû,Wð¿‘S? endstream endobj 1217 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 342 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 20967 /Filter /FlateDecode >> stream xÚí`ÕÖ€O: z -zBï!ôЋŠ¢RDD¥ ú) ¢ˆJ•Þ{“ÞR7½÷Bzïewʧìd³Ù IXüÎ÷"owvföΙoϹ÷Î E!‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ü'P R#ÐÕU MÓ,‚ Õ„aNumC* AÛ mmƒ¶A´ :mƒ h›×È6§ Ój,(µ¥·o€ñʶ„Q}Yn5ÎSÕ5ÿ·*‰ÑðŠeéŠe-+4­ãS½bÍ«~[Å£ºæµŠ¶Ñ•mÈ$y^Ü_ßÍmj µšv[·ïj¡r?Ò)AïŸÊþ®¹Æ¬æVü¢¨Ÿlaèö7à‡®äÎg`Ôµ„³g24YíWaµÎS±ö–zxëa¡ðÖ@Òÿ–[VáP>:“]þ7#€9Ï U']ÜHöþ“\öggÇLùÓeßDÍMüå‘Ç¡OÔ&öö•o¥±æåY¡«Ç4!óÏÔVòìý«Þ1à×ÓÐ~Êý¨BŒm^ÆTåUm"†Ïè·?ã•Ä¿¥þ¹˜H&Cv+„ªÔcz‡’+Ý¥a­>¿]¤}–‚¹Öðõ)ÙUï{×ÞÎy+ÿæ¹è]ÍbÔ7Pë<š«®!ØF‰§ë€Váòš¯*bòŸ˜M°údφd»—Ûã¡× §öÓÔ²)q÷ö’)÷ã©Š«­øѳ£Ÿ4 ‘V™6­=€AÿZ­æ™÷=fÖ-7ƒ³Yš«ãèì~аG,靈«lŠÐ6U– Ë’?Êߟ^¼˜?žéÛ—17g4ÿYX(^lnÂO3z@ÃîÑ%åbÍÙå__Ê‘ëÈ6d­).Æ7"È×”žýyÍ„1#GŽ™°æç3¥Ò—æ†nZòáÈ#&ÎüôŠwŠ˜g9;;û$¤üºì=G§‘ó7ž$ÓƒÏmë4lÂû_†””engw½ã>IÞÓ.kÁªw1S¶7ɪÎêÎCþ+Ü¿iéØ‘ÃÇLxwÏE?þ|zä4´@í~Æo²!ß´Že»—¿?|Äè9+~É¥”õSÿóÊy¤~¦|¸äad¡XmY¤~¼#W¼;bÂ&o6òî7™e†?²ÿºm¸í“ óœ’eóoËjÞw÷·ûž>g oƒžÛö±‚¿„‰GH~ 5À–kÁh›ÊC6“&2’ºqƒž8Q«[*ü1;¾Ø6ÜyQÒ¯ ž{º|\®©A°Í±l--;U° ™/âÆ`<8eÌnÍû¬Ù²óÇÿ}Õ§…^“w~åf(°1„¶Žïîúí÷ճǒlË3þÊt#¯í;ôþ|÷ÙkÇ~$‡w»¡wŸ¾îæëŸ ²‚zäðÁعϺƒi‹O¿ùa×÷ËÛÝÇûø¬ä’ÒéÚc÷雇7Í#ë™<°ÏØe¿ýsõ˜ƒ5ØNý…/Z ‰ëšõ™´yÇ®uŸM×Øz;’?¿ú@]ûA=ì;qéÄÏKëÌ<'lSäcÖ.4·õ§?îe3r­ê¦hŸ‡lÌœÎzæoüiï¶ÕóÈÁ?éÇûl~òÿh´ýØ™§Ér6˜Ø¦Ñ¬^M§.\»yͧ-  Ë²SÜ¢%Ñ=Ì ùÀ)?üòëÒw‡“d÷T$ÿóáÊ¥­º8Íü|óÉH6h½Î7™|÷êðÉa¶Yæ[½ó³.mðE!×É<‡žp?ueµ*W9×5Ú†›¡àI=€ßžK3έ½6]BÛT–(=|Ș˜hUJ%¶éÚµ ± ËÈ£I¬:ëH «ÚÜ©‚`’iÕmÞÖF…¦½—V'“:¹¼µõœÇ,›7ÁÞ»—/ž¹% ®ÞÜ¡þp¶´X,îäÊ`6™Ó[–;9Øæx"m™cG“Î#„°:áá_z®laðU2ÏßniÂ*YŸM}Š…¬Äð¯çüÁÌ$öhºè°÷—:BçQÜ×å†=|*ƒÐ? ÎìýÜý‘¾Æ甇ñõíCÀ`Xÿ:ãâ8°ÿ¿zœÞ;¿Ç—ß@mó0q{ߣÎI´ø]é—&t %†÷ ;•L ¾–‰ÕöƒÔK–pYÔZ}.µ½_f­W•(ëgÄ7زÅu½ÉYž&— *´Åz6%ßmV×ÒÒ²ž€¥eíÚ&º³ ÷}.’-rI-W«ì‹lÃ76%N¾YvŒR;»€ÕÂÃh SI =eJÅD‰ÓKýúL›6l­ZÜ[ÆÁž3‡^½šÞ¶þõWjï^zÇzÅ úï¿«dEd[€¥‰Ç’"ª‘JÝV>ò$¶1Xú÷í+*œ¿î©¨†m &ÁŽn‰s_÷hà4cþŸç)³üëAû5g¥ƒÌû Kêøå‰gÓ^.Úçr€õ£ºµºXøÕËtãbìGI¬ÿE¢Xºy×Nžß~YE~—WÝpqB«ðR1$ ðÎï÷…oðÿf´sÊŸtiÖ¸‘ýûö²wphk¦Söˆ§žÁ„\eyü.~GÎ+oî½â{;ý{ðÍ”¡¡Ö­"õ Ô<Ãü:½·iÏ ŒR’³þvm€ÝqmÓ$áM‹ð±~~º!öËÍ>:ÝäØû¿t!J¨Ð*äI•ñ;ÏݸvU<&®^ÿýÛ9/g›%&ƒGÃ1zpïNd†ÅÇÔkµ*¶I>LÊÿOqÙ„ÝÝÀrþ!´M™ˆ‚ccé¥KÕ¢ÆÔ”©U‹±´d;t` b>ø€Þ¿_AÓBKNÙÃP|æ%¾®R&UÔ·! þ캩|œÚ’Øæj°.Úm6úWгËTv[zžÛ5}ܶÉÙ¦·ò¸Œœxc ÷æË’m‚®|O>rÏϦ?<vùúQ]m†}!Ì&ÙFvf ùùë?|ÔHž#G=f‹Oo›(щܩ÷þTO=r”¸n#+¹hÛÍÏ||w:€Ñdå©gñ±¼¬<[Äòäù[œòâŽïœ»AÛ¯Ô7Õ2ÃlvîiÙ÷1¨ãBû§õ6W´MY+qö%Î6¥l ©ó¶=ƈ›8rÔè1ÎÎÓ¸>–2K‹ër“=òÙ ßt7tEÓn}í6œmÞÿtéž•~p‹)Sö²ZeتdRù÷Èáu(Eš»hqcèòí´ §^ôôéê‘Œ±1Ó»7£§Çô마W(çÔQ8—+­ÝZR×DqX3]Ù†až|=´~ß9êSˆÑ®Ï%‘³Ë~ÛêÎÙ/-ñäЀÖÊßî}•Ú&æίܞ̲jc_^|ê1;&9Xôš¢l‚*YÙ Œ¥zè¯\¥Ëßä,hZÌ&=ùK,ËüÑF츩¶d5Ú湸`0tp”N-*a?×þ™õbÛßçM ¾ÊïrY-VÛ6ÕÛäX–]Vûÿ[¶)ß'¥‚T«LUb.Îîi³§+çP’÷}sÎGÛàœ·Ç6äè ÷íò&©)†éÔ‰¼fÆŒ¡îÝ#‰öTÞÈCQÒ%ÞäuAAAfffrrrZZZjjjzzzNNŽ†kÀIÝg>íBöqω£•YAœÛçÎäH8é.ÙæL1Ëjo'Önî´ø W‘kݸ/+|ÔÕÒöŒò˜¦}HøÑÄ›eÓ®¼Ðè–8p"wfs¨3íœt6Uf›D†Í !ýØMbÛEÖƒí­ºMHVTéÔ;2³7t-Ž¸ü¿¦–zàø³òÔƒYûÄ–÷èþ#9+®oh4˜Ïý‹B›æÊo –y¸š ÙÍ%§2Q%;‡[B'n[Š}W“J;K5Ø&Ÿe3n-[SJeÿgýíçžgjd›jm2›u m"­qÝ¿j›²Z-Ç#b›eE£½Ïýuðv pdþ4¥½Q‡IBËÍã]3,½2k&›7Â6| M÷èQÏrySÛ¶Œ³³"=›AËfJ†Ä’‘‘îåååêêêââBþu+0Ec‡QI’ëè] ËljÙ œ|>Tl> SèiŽÕÕy“JlÚ`Á  £HhNŒ¡ì¸²q‚@ýmÛµ¬† >ùó©0Û¦ÙŽµ À®{7sзöq†Ø:Ãõ¹üv7^Ø嫇vhÒÿS±%Öå(ùèA5»îìhe W·…­M=ËO¶\á °–ºâ™›Ù`úÞ{B‰üV …渓2î\û:úШc·MÛŒ^šyÄTà0g3wê5½r|›]º6ÔƒÆ}ïr? ô\K˜ó˜kâN}v N ßt*m pÀkœGàá/[@ËŽ]›×3µ¶í{?šo&)ôîT‹|­é ­lè:bÝPåè¾ì Æåñ¯\0ÆTZuèdeuÚ9=Éåw_?¿Ü‰Ðõ&{®u4è± õà×V¬iCÈÖ™¸ººªfL"!’a+ ‡Ð6òÖÚ†^½ºlÌ^ëÖŒ©©‚ä>Z6¡¸¸X­›)00üÿ* È›a.ªÙ²¥,ªiÒ„2D¡)÷z"""¤¼‰äP$oòôôLNN.--ÕØ ƒ¶A´¨š'ÄžnÆÖ–5ªbCj+¤ooo___’71.zBÛ ÚFgÏÊÆ wè@;:jë~*))QíuBâŽñAÛ È›jî76Çï‘jôhÝOd[ÒÒÒ¤Ñz2™ÌËË+66V÷…AÛ È›gR¶Â²»]ÙØ0ƒWŒj„†šøøx!¤ñññ! TvvvU:µÑ6‚¶á.L˜4IL ¬¬˜Zµ¸!Ä ,µ 9TPP±ÍË4£mä­² )½~½¨šöí™víåú ­ºŸ<==‰g"##<¯*­CÛ Hõ!QÁÓ6\×v\œ8`ØȈ56¦ž>ÕØ-´ÕHªy¥ •®·B¤Zü—mÃêé‰Ckzö¤ÎŸ×8[\\œ”@y{{ÇÄļ¢ A7®¹fÅ 1‡jÞœ7Nc'Tzzº”@Õ$&&êdD ‚ o‹jȬt ªÉËË“îA(Õ j©nËcg'Ž®16¦?ÖØxBâaQMDDV‚ ÕÍ¡¨;ÄÀ¦wo’O©®:›ˆa„暀€€ÈÈÈÿlë‚ ÿÙ¨†JO/†27gõô¨¬,µŠˆ%66VÂçËóê:»y“›M›¤'³(ÜÝ© #SSSÝÜÜ„(…=P‚Ô€ÔTQ5¶¶LÏžŠò7È†Õ w.ƒÊÍÍEÕ Rƒ4Š:Tºÿ'%“UÌ¡¤æš„„_… È›oÞ6b`Ó¬ýá‡/½ÌÊÊTãŃªA¤&¶aYzÈ–¿H±´¤ÂÂÔ’CIóõõ RÝŠŠ‹»¢êÖeúö­Øë.6D5ñññØ\ƒ HMdCr¢£GÅ4ªcG!«R³tƒ,3Œ HÓ¨²ÛJ ¨µ·xFºÄ;//Ajý믬òÎÔ¥Kj½Þ¹¹¹B`ãííŠÃ‚Ô4²Q0Ɖ7mÙR­Å†6~~~Òós)ˇ HMUS–FÙÛSÿ­6x833ÓÕÕUhŽˆˆ@Õ RCÙ°,½q#§CCÖÌŒ*ÿ|â–   iä06#ò2¶nÐÇXX0:TìønJœ“’’‚Õ… HÓ(ÊÝ]L£6¤bbT³KÓt`` ÕŠ‹‹1B¤†²!B9|˜Q^†©:̆ˆExä¥`›°°0ìŠBäeÒ(ÆÚZÑÇŒ­öizzºôh] »¢y9Ûˆi”©)½gê0ò‰pg ??¿   ¬+A^áÉtB&¥Ö>œŸŸïêêJlCœ“’’‚ ‚ /3~¼4ÒFÍ6aaaÂü¼¼Ø ·ž@©N¥`Ú´áTÓ²%}ð jo‰d¼½½…›¤¤$¬*A^F5\l#6]ºP÷î©6Ú”””Ãl|}}ñ^ ‚¼”l(îš126¦TFîI·%9”§§'v|#òR¶aYzêTN5uê0µj©5Ú-6„èèh´ ‚ Ú“¤*$>,ËNŸÎ8;3Ó¦1_~I©Ø¦°°0Œ'**êmS æŒRÝS†X‚EªöA´ ÚAÐ6hAÛ hy›lÃ0Ò«Š“ª¹*öe×€¶A7:¶I~{ï%°‰÷È‹ßî%V×1 K=¼õ°sÕ­.t›ÿcy#mÇ/³|êS"™“X†...¦èj¯Ž) k¶Q|QJKŠJå ÚAþ³¶azíüÑ[¯$?;¸~´ÓÐqS>¹K gù÷Þá-SF1ÒyÝo×åÄv¿3m‹ß½¿V ž²¸ˆåßv9áÚÎ%#† ¾hSËfzgì°‘Îïß˔ҷۧéä4ö‹-G!ç‘l“äìì|78/òñá‘eŒ7ÆiíÁ0-‹³ùaœ†v¨ÝoØ𠲂o]w DYòÂý›–Ž9|Ì„w÷\ôÖqçËÁ Oй>ó¦Ž:lì7Ü”6mƒ ¯Þ6ÜÙ6ª«Q#Û±ƒfo¼yçöš™V¾Ùä£Ò?ßkul–nܵ燵]- ÁðuÂÂÇ—5»9ýúY½å÷–[ܺÃØ)«¿sýèà`0pù ‘3ÏݺóÃÜîÝÃøï8±¨'€õ¢u[~Ú¶®oscpX_¨Û$?!/?MËŒrÝ)ðó@&.=ÈjY\ž•tà£m?væirÉH[púÚ…/`æœÎzæoüiï¶Õó¬&ýxLÍ:?êÛ·ÿ ·.þ±ÊàýËiÛ È¿Û0£{š¶ú¹n0 y$\&/Ž¸¦ñÁ Ãm%QÄ5ÎBì©•­Z„‹gâ螵솯Ööhÿýg)üšå1mÖùp³¹Ý>qåa„I$?9HÖü(‘Q·Í“”²bFØ ßxU(¡æÅY¶È{€]ßn3¼ƒ`&nï;`Ô9‰[Ó/ku eÙìKŽ7 Åoøë# pømƒ ÿ^» ÑE7ý! /óÝ9 ›åNÎå_ï>º´ –WŽ” Etxï^>g›Í¡åÊIVÝô‡~v]èr;ù59ýã(^\lV€/*„á_~ä8x€ƒ½}÷Ž6ä+îDË+±Í¦áuôû®ÎcxÁ0Z×h†ùuzoÓž±™eso×ØÏÛÆpržò+N®h6)Ð6òoÆ6œ.nˆïEÛ$xŸYCRª€©w9¡€ãÅlÞ6ÍÀn;U¶¸Þ°%ÿˆ­+œmº=§…xÛƒá ‚ :ohšº]ÄÒ©Gø×úzÜ+K›/y* ‡]'Ÿ&so-mШ÷‡ÚÊríûÖuÈ*j‘EZÙÍbXÝ9çͶløúúº»»»ùøxÝ»—1j”ÜÚšs…Ê=Õ+ÿcªði~×®®¾¾qqqBW±ž3m$»Ïiîö å×ã´™¶[Ø—ÏŽ~Ð4QÓ.’^åx&+ñÌU÷˜ ~-ÁÜ­PÓnÖ03«õÇ‹©ø†Ñø#øÂãKËQÇj Ì”KeŒ5ƒï¯W\ƒržÜ¡`ðXν:¹¢tÚFk^Ï Ë̼ðaY 'œ¶m—jzó8[‡™Ô>å÷r“r¶)þ¢)XvDuÒ/]¡öÇk\ÅèÔcÄ1gTÖyù›áä89'nœçñ/ á"RU?8Y6µŸü^o»¦ƒ>Ѽµr7€ûü…žÙʨ͂ÃÛTs$*“ɸGlzx¿À£G‹›5ã†ׯ_¥¼ØHúú£G“¯ÈÎÎÖ`*¾+@ËËä “ä+‹Íg´‡êÄÝÛKŽ¢ûñÚ~Æ™¼+ ¡åîqÆ)®ïhËýÎÕ²ú`ÃQJyj<¿»«k#S2¹~‡!—RÅCÀuÛg¦ÜÐÜ Àh袃4[´}f/2›u×Ê"Ñù «¦õ3ÖCÓÆ‹{,ldâ¡>`ûm¢×¾fäÇP¿îÒ?ž1Å13{7Ðë<á›LJü†è»ûì[Ôåº.{nE +üã}3ç·~™o¡O–µZ}Ú[ÚEÌ2ó£DFc™&ǾŽøëÞuÓ?×Ö6‡.;®liÂÍUkeg¢J™?ß+–9a/°Ûèq™ûR{x¥éäÛ·vÍ­MÞ[´9é’zÓ¾‰ ©ŠéNK»ðÉï_´07"³4î2úIt._ ù°Ö0i³ç³ú‘€ÁĪóßyÊÓªd@#øòAilCmëf3÷iÚÅ>ls(YÕäy}êÁˆ52QP ì‹%3Þ?r–|þ½sͶa˜ ïÇC“%JûC~ƒÐ6Õ¾˜‘‘Áˆƒ»}ºŸŸ÷;aûö•lÞÌÚÚŠÒ°¶f7fMLªááâ,k묡C…õËåòr?| ›ï‰¥û'jü%}Al£²ªJmÃ}çîÉ];OÙÅ29ý-ÀqÕI/_?/÷ûït‚º3.9|Ï-'‹ï8÷(00àî±oÈ)þ¿{ùÜ׬'Ó;ýÆ?úyèýäuÃÆý> ›Õ£AË+ùõ‡1ƒsvyøx=>ß`àw×ÈÔì CÌ'¹?*.Þc߇ä íØnÔ½€˜ç!÷:¼ÿçc2OIðd+N<öñõyrj ÓÿŒá2ÔËy³e».DÆÄù?þÛ `á±x¡>üέ…ºïåh)3ÃЩž;ˆXz…>ÏcO¯lu:¾ûõ.O/Ÿç¶c.»šË¯Fs™3Ïc›‘–?uqÍ’³'¿nu[þïðÝç‰Ï/|ifÍÇ/ ŒŠ‹uÿØkw$?=ú}:1Ñ¡Ü}}}.þ8  õÓbRã´“‰¾U÷?ïxÆÆÅÝüm €é°ngäücváö·°—“ÊO\Õ\Ƕ!žè[F®õâ¿>²3ÞÌf¤£¤Ûì˜ì`Ý–pLò«‘5ø1’eÐ6ÕNQQQ@@€àÑ<îî®ÞÞáYY¹qqìÊ•¬¹y âœRkë‚öퟅ† *#_¡iÇßÿœ27ÃKÄÝF¥ß¿~í&Ï[r(á8\R1-7ì¶MQÅ؆ü¢±Ša-aÁù§pRMôä’`n Þà³ÛE C9u1ê4j…¸tœ-À¬}\cZì¯zcvUÜK÷2¡Éâ—µÍñiB©ìä§$¶<ÀW¹üÁrh0@^–kµ Ù„NÛ [R6EMâ㯞ÑÛÔØ9iiibˆãîîíí¹b…ÌÁÁÓÞ^foŸÒ°aum#·²bôôdx¨H,66Vµ’í'GÔÕ`e{JþU•fß&B3‹ÖLªª± ˸X@o~Ÿn™dÇ%-û¬ß{9—ÖI&½{/_Zí/Óz›ÙOTÚ¦5ÿNÈ"ÁÊÌ?„ögÆÿ›QÐΑb™“zAÝFÓf̘>y0YÿT6û’#˜¾§,u`€Ÿ£DA’‚oæ%1À‘5Sj©œ\6s¶YTì¶SÊòì}§O­žÎü›¤~§RI¡£´–YÕ6\»ÍV…òxÝMÈÂ+Ü/u%e6˜(Üâ]vŠ9_öE=0ý§Xühyc°ÿ=žoÊM^1¡›¾Ê&,¼”ÇÙ¦ ýì†rM[AÛ5gÈÜŸ6‚Å»k²Í+ɤL+èkñ1/¡:¼ïÐaä·ª‡S%¶Y5®õÐÅeSJ#lVºa&õRÂ!GSÂ_¹ð¬{wÏ=ˆg8á88x{ö ¶µ²³+ )Õ‹štH%·´ô½z•¤f’À<==e2YAA²Ï‘UÄÜ%À–k!ÂL™>òNX¾À6Un·I>6~/íØ×ÓmŸØ»1É\¦ì&áVD€°egw_ãc”¶±QJ‚³Íûl³m‚}­ö.•qùòÅKQÅ‚mf«ØfW´ºmn/hfƒoù†'$§æ”ä}ÞXÅ6ÝvÓÊòüþ.)ÏXî¥ç·PǾ€O…´–YÍ6Jk©Ú¦²2›Ì(TµMןé2Û˜Ý)Q·Í·ýôÁv¡GhLrJZZzTg½2Û ûâ®d›9õ¡ÕªÓlŽ» ùqáö%óïØÆ`ÕE÷G-¿âg.ÑZfÞ6÷*±Måe®žmÂIB1×] þØÔóuIls™·Mgƒ·ˆÅcɦMÞs?éÎO`Ø+Öp’þ ­ÄåÚKü€ùýR–©BlC>J;>juËP.~~2Àðtl%®QXCݺ¥Á&&ÏGŽ$¶ñqtô §§²)ÙÝÍ×W®ì´ªø—ß½{ô7ßHQZlCþ );$ }Û™y³Þ÷"øž.~pxµ Ôn3,‡.wV2N«2Ûd{›œóå$S±  ÞÙxñ =¶¼;Ô›IÎË»»§XËÒ¹ï+?[`ÁÙŒªÙ†øò–ÀèÝB·uzNKhú‰¼J¶¡¿·½‘[ùƒM±bTŸ6MÀòCnýGs£~ºÃÕG®{k=˜°ÍŸÌ4¡‹ÁäŸÄ~+­eι`ð{¥Ý6Ê2ÿ⣡ÌÕ³MþôZÐúkW~QÃ4¶0‚é{bùvS0k+Ëã–ŽºÍ5†Ÿò“Ÿ]Ù¾Î;ÿh<ÝþMÛpûòÚdè´VmØžhéàb¿?Î^ñ#¿Û²&׆æ#¯å)îdoNÚu{À«§²“¢¢˜þýË]¿ §ÇØÙq÷â5Š¾vM‘’’]TËùÂÝ肨ÃÕ×—. é¯ÈÆ&kÂOooâ™ BT#½Ž‹‹“~— ·/›^W™Y7í:|ç±Û™¥âïÈ£ýs5¶.=ê*í¬è[?‘)·c5Ø&ê&9Ô›‘]rû¯[˜‰kh7lŽ{ ÿ»¬È?±yN=#ÐÓ×30o»ù”2!÷_Aì.þtgô˜ø‹p²0>Ëûµƒ ŸK£;Y ël?|¾,‘‹É²Î:LPž=~µ¶Fˆ+:Ù`úoœ%mNNƒºM;íºë{rYÀŸœÿÂvožïTÇ„[çØe‘52ÅþäÝÅØïÓ2dNëâZkLýz#÷ÔËLŽÕq*ªßÎÐ/ÜÚ©#8.RnÃj/9SqV¬p¦²5Tœ™©ÂAÁhÅȨ$Uÿ‰¶QS Å?FO¯Ü…¶¶ŒýÍ7/¼Ý ©–b"ŸŠýݦ¦ ““×®Ó„d› þæ~:ß_o\+±Ã¯où¹Lª# _þwå[m²IäWfófÕ{‡2]»²Ä3K—RÉɯûêkÈÉ!¢ ÆðRy ƒØ,lfFß9|ø¬É3ÂÛÛ·o“¨&88Xh´AÕTŸéAÛݯµmú4†^ ïã®|{mÃ%Åôûï—Y‚iÔˆ±·§¢¢´…4$‡*--ÍÈÈ ®puu†Í;Vîi µjµh|àÀ?÷î].ÐÃzñâÅøøøxyy‘R j*?ð^E¬þon–y‹lÃ]%djZ–:Õ«GlCoÛ&vKiñStt4ß<ì®ÚÁòǪ¢èË/Éü¡ÊaÃ!²"¶AÏ ÈnšVdfJªîšÅ6jDi¿Y©˜˜¢ˆ²K¨xÈëð_eU1š¨†¿3É’4ªÆÍÍD5$à AÞ`Ûp>ñ÷/ëã®U‹iÛ–ž2E[ I²²²„ Ã%ÏWx{{ûûû‡……åææ²×¯‹kkÝšéÒEì¸R(üüü4Ú&00011*yÃc›€€²8¤n]¶^=êÈŠa´Ýƒ"((Ƚü`2…9iiieó OáìÔ‰iÞ\¡LÄHu)©y†,N¨àà`š+y#mÃ=3,ŒQÞ‹iߞ؆zô¨bT#„4)))RH# ý%ö ®P½·°eQ;w²¬ž•œ,­Š|ZQ5¾¾¾$ùÒvï>AÞØ&2²,jÔˆiÖŒzöLc+ ÙÒ¸¸8777ébmâ’7ÅÆÆ2¢ ®ÝÙ™mÞœ’ɨòOŒR ŠHòEl£P‚¶A7Ò6ª÷ æT£¯OÅÅiS q‚¤ÞÏ„††2Z²-®o«[7êìYEùÈz_IM=$:*,,¬Ê]Ðmóúácê×£š˜¦M¹î'Mö 6PÍžˆvH@"ÜÕSëæóëçÖV>°!ÿJÑñ YOnn®Z²†Ç‚¼9¶áËLó—Urª±´äÚj¼½+6Ô‰ ž={&ù„4•y¦R„ÇHÖzþü9>™AÞ`Û(„&\A5æ欙õä‰ÆŠ¨FJ|Õ$%%•5W{D+ŒÉ!Yy-=%mƒ ožm¸â>\vMA³fÔåË/Iž˜)Å!~~~Ä6$2©±j„u‘uúøøq)*<óN° ƒ ˆ¦;5½~¶).æ®G›NèùóÕ®J¶(33ÓÅÅEµ¡¦¸¸ø¥G+ÓÞ>>ºR %öŠ³¸#äOùGDzjÊ6†ðùûûë*Bä-2 ‰a\]Å+ÌÍ™Æ+^%t ÝÓÄ3žžž$ÎAÕ R½¦¨Hl®10 åáQqtMrr²Ð\# ñ-((@Õ R=ÙÿNŸ.{b‚ƒCÅ~¨¢¢"¡¹ÆÍÍ- @º A¤¶‘.½42bll¸ç]–|„a0BsOXX…Í5‚T?‹¢gÌ›6mè%K*6×ÄÆÆ’Fh®ñ÷÷Çn#Aj¦ÆÐPl´©S§b•““ã®|À¥§§'6× R³Š^´H lzö¤ÿþ[Qþ*HÆ9‰müüüÒÒÒÔ.“D©JTCeg—9\X¨6K||¼Ø÷ꤰ¹AȆüwé’Ø>lmM:¥–F±Hg!/ðÚ%AjœF1uêpª14dlmÕ†ó‘Œ),,Ll„G«`!RCîÜ‘.‰¢gÏV»§Daa¡t'sØÈårÌ¡©Qd£`ÆŽe„F}}µŠ6‘‘‘Òm²òòò°Â©™j(’FpWEÕ©Cø¡šmŠŠŠ\\\°qA—• qËñãbÕ£õàZ"´Ø*==Uƒ HmÃ3ü3v==E…;Kª!¶B!‚¼˜à`VÙbÃ|ðj%´Ø¶ñ÷÷ÇÛè!òR\¸ Þ5ËÆFx¥ô‰\.WíŠÂ‘¼LE÷ê%Æ6vvj-2™™™Òý²0°Aä%m#¶ÛÚ2S§ª6 Ãøùù w– /(ìŠBäe8rD¼ZA_ŸºzUõ“ââb¡ãÛßß?""Uƒ ÈËÀLž,ê31Qf.4Ú^þQt‚¼Ýy”‚éÖM̤ƌQµô<áÂ(ìøFäeTÃÅ6Òã¢Îž-ÿ¡B¸AQMFFÖ‚ /Ei©Øtè@=~,MV½âÛËË«  « Aš‡6,Kõg==ÖÐRynÉ›„Š¨F&“á0A^Ò6Lýú,ÁkjªÚh“ŸŸ/6Ä9IIIXW‚¼¤mľoº|±4¨Ï××—Âa6‚¼$¢m¨§OÊ^'’7…‡‡ ™”p A—⟄)¶NN5ʆ„FÛ ÈkÛd¹“õ9Î< »rDg ‡É¼†ØÔ§GÈGOSYVQè#Ëå3&²Ùš‘`3„{—qÀìn7=Óó™ùvd©í\ß½nÙG9Ûô¬e;z¥˜ñqÔž³)*¶¹< …L™%ý½¨>tÞE^,h-Wù %a²æ×£m䵷;ûñB³ÈúQ]m†->Étãò(‘;Ýsýv·6%6ƒKËÛÆ瀺~ù,S¾†dRC]Sý®_ïÄ”³Í%G0ž^ \äÔŠf`»™eã;|ò´@¹ù°6hy#lCâ þ´æmóEyÛ°¹—L>ýùrL|bZZÚÓŽÐBÝ6Þç¾!¶ñ×d›²Vbm¶1™Q¨n›èvŸ¹*×C A7È6Œ&Û$±²3k,ƒ‹Å.¤S»Cë!’mîñ¶Izr€ÌüO´\Ȉâ<ͷÛÔÐ6…  Ïd1“bžw6AÛ È›o›Ø»¿’×Â8%¤?ÝÚ»e-°êG¬’sÁ`o,¿ZyL€ösör«Qdôo ýf¬±mh–=¸ ˜ Màš‡¨£ï6l·A×Ý6™Ïȉ¼ûŸ8!eùª_KKûO„O2ž&Ý{ΰTîîyCÈkÓ:Ãì,ÌtélHÞ´+e6mJ¦7zw™¿$þéÌ~M…†ç%{Ò)."Úéññ%ÕïÚq#ŠMzÀ+.‰3ÐY€1R»Í‘ÅfÐh-qLifèœþœdÌê·]uÄ}x½áËŸ mäõµ £iàœ0¼NÛ<ÕÑy•ŒÓ+?Š¯üwUœ‡Á0´´HiAV†ä V1¨)ŒßÎâè>y}c›ÿ*W¶ hœË_èpe€Ñ™L¼rAÐ6:¿–“¥‹R·Í.ö¸[uùõv(^'… h›W$œW}‘ÚAÐ6x 8‚¼%¶a^uH¶A7Ý6tU 'áÑ£ä9~œ¹{—æ{ŽÒ•ÓoøÌyuÂy1D/µks°32bÌÌ|àÎãááAÞ*Þ ð¨@ÿ7#Û̘!>.S_ŸÊÉ!zñòò"¶ñôôôóóÃìA '%E´MÆԓ'D/BlC„ƒ¶AD‡§"==êÜ9Š¦ããã…dŠØ¦´´kA]Ù†±³ÛaÃHnE ãææFlãíퟟ5„ ˆ®`&MbxÛ?Ë>Á6>>>YYYظŠ ˆ® ÷ìa•¶¡%z!9”‡‡NZZÖ‚ :Ë¥XV̤Œ™©S‰m‚‚‚“òòòÊÍÍÅd AÝéFA={&öLéé±­Z¹ûú mÅÏŸ?ÇêAD·á cj* ÇÌ,ôÐ!¡í†#¢KÛÐ4#%S%mÛ>ã¯bðôôLJJÂd AÝæSŒƒƒtŠ˜5k<øÖ›   »ÂÑ­o¥ðFneå¡x#—˱rÑ¥mX–^°€Q^§™=x°«ŸŸ‡‡‡ŸŸÞ€AÝ&STt´tU8ù7èÀw~àM~~>&S‚è6¼¡Že•¶!ÿº“dJxÈÖ‚ : o¸ÞðN¤æâìÜ==ÝÜÜòòò0¼ADÇDF–]˹q£»·w`` …S‚è’4:%Ù†Ñ×EÓLŸ>Rë mbâsã†ð`;…7üz¸çËÔ¨ÃK(ƒ ¯-˜,”kÀiЀQ^?UÒ¨‘§«ëóçÏuÕ\̵HŸ>Í­|Ä…R>Õ, Kv‹ ¯!¡‹¶);£“’Tû§h##7WW]åSœÍ”מS ŠšèA^cÛÐ6åÂÛ·ÛÂ)nÙÒ+4”„7/_Kœmš5UV«UPP­ðmƒ¼ÂAÛ¨9Þ¼¹¬‹JO¯¸I“ˆ€ê¥…ÃÉÂÈH\­¡!½e‹¢:×›£mŒmÞH˜Å‹Ëº¨xçdÇļ¼ÇTûÙ¹æâê¿ýÌyÛÍ̪ÔOÛš“·þǶYÜŸ~8wæW?Êcþ9`ª¬äUUÚFkÕgŸ©^EEþ¨£G¹þëšÕ˜L¦ÛpÍÅ'NDÇÇËd²v¾:Ûp§i Í"j´l–Ç€1¹•ÍíÔÙ‘üß²¾÷§ó¿q,›òì@ëÈRöµîcã«.ÁàL¶æ Q«ŸìKŽ`2£°¦çê+Úa_|ùɤ&}Þ/ ÿÍ êÿSŒ±ÍÿǸ?¾ G5Èaìí5»¿ß;mÃèëG<~ìîîRyW{%¶)7¦AãDq²†!ÂÌtÆ€ŽQÊnJM³h]ØãÄr0Ÿ‘'œ ê¥à)¼a °Â§øÃþÖvN+„i7p4z\Óz+)?[ùp¶šÛ^Õj«¤âX¶Hö4\TÉÂRý¨Ú¦ºû«¤¨”ÑTUU¬¸JkK¹/RÿèÒËÐC:;Æ°Zv%Úæ§T¥7nˆ‰¤ˆÚµé;9çT«ê®^e*؆k<Ø50ð…žk³ v¶{óº`ZßÒ ØŸˆ¥¹ß«œˆq½Ûƒ±E×nŒÚ^“ËïîÁ6Ðsê¶6ûM>¹…´ë³0ƒaóÃõëÒÀ¸[Ÿë= Ù¤›Z[ƒY£Î훘OÙüXø¢Ô£Ðò‹­3»š4uxg+¨ÝéB t|]ó&fuzöèw*‘eŠ}-Þ;‘U®ˆ¥!ë>ûòf¢âô¯ßíØSˆ–µ‚OŸæ“þ—¾mN~M[¶oÓØL›n¸ä/,ôͬA&Ä€]»×Óƒ†=§Dð[x¡9 üm¼ãÀSF8|uæï%GMšÖ«‰‘QÛ±É4¯¼¢„÷t£ÚíÚè÷š³—Un{—ñ;ö9}\o½É¿ù~0¼Ï„éSÚõÐ üê™”[Û[Z™šX·lßÂÀbÆÏ>Bab÷ØA㹫&Úv3 9XÙ_KC›óεún¼¬­Ì ÇÊêçt o›†ó~ùÔ¡qKs¨kw.‰ß_šËLj=&o2ƒÚö³…nd‰/ߟÖeÐøñƒÛéé×ûöðNúN›6®>€ý'ç/xÿüùözÍÛµnPˤ^óí·RÉŠ>°ùyV×nýœFõﵚm»&ey¾:»ë¨{´óø3îÛåádµS¤b&õ¯B‚áÈÈÒ X•”J¤GT5Î!•|ùrÅØFø ß±ƒ„7>>>•„7lÃÿQÓ:Öî8i«0áðÂäg4‡eO.ë õ†¤ˆóEڙˆuÏÈÎÝÓÜ°I?!L. »BŽÞÓ^9Ü›u]’y{Í´«ÛbÄ×Â’iO!ó\ â~™sÈ™°èœ¸ÖoºC­É×É‹{Æ€ùLJ(ÿÚåà4…¦– •„ àš4‹âæ’XJ¿îÚ²6Žß‘É)ç§4¹%¶…ÈçµáûÉ«S+[¹óÓç’ò8}çÊÏ“Ð `ÖCN_ÖôË ·–zµxŒ°ífmœ„5ÞØÜŸ,»_–ͯþQ]€=qܹ°üãæíæ >½  ¶/”$éGæŸZ<õ~e ¶ß•r…ˆµøãÑsV{™Uë'›¯Ãé;Ý„™´ã ×´—™Õ³¶Q£AiÂÜ™îzÍgíÞÍìÛŒ[Æò¯#®o$nô'[_1ÀÖnÍ…@ažŸ§t3ï6‰[«ûJò½í¿~&Lw[i &³…7eû¢l_‘}ÄÐ…¯_ J.ÅØæß'6--kÀJê–âœÁƒµ—YÈg×UmóǃçB¡×êj3ì 1êq;I>z”È°tæ’!]I†6rêÌù LïIä,Ù¦m¬òb ]H–´!UÙ8ºï?&†‰ŠŽöxú4¯Gõ¦ce2uû6•šJöªšy8Ûk‹m„¿€'<<¥Q8šmSðÌ àû±…V99¾7€óµ)ÝÚ>ÑÞ¢×”Š¶Š¶)xRLL×Ðs¡áL±Ý\]ÛðmÐöu`ƒÃ­¬qçÙ¥?Ç94‚ú3ŠYj¶%´[}FZÄûìZb#¿’ò¶É¾¨fûßãIJÕàgŽsí¶Éâlóˆ"b3€¹ÇÅ!ÛóD9ÛLÌU–ÇçÜzRžŠý~8þ,$$šË\ô"ÛØn&I˜ö2«ï¯}šmÃõQu›Äc·b…b½×Ž‚’mZ•*{¶ro×ØUn_àx›ÿZ¯8—RÅÆ’¬Çëî]ªvmÚĄѨ°õëÓ'Or¶Q&Y‡öU\ª´aC—  ÞdddTµÝ†Éïg N«Ÿ KÀ%’¿× fØïûƒáCʽLíjÒ{úžÙ¦ß'UØ¿Œ\ë¢Là .»–Ãõ‡Tj›ÚÓrËwˆTrÔÑ)䇸O‚˜´ÄØ»¿HêNɽeÆ7åì“ù  é§´r‘£K[ƒå‡ùlUlÃnB¶ý€Ôñìæíè\º ¶¡™Ü›¦&Š+<»¶w9Û€Áq±…=¿¾;˜Œ‘³MÀüY¡(Ñ'ó4—Yµ~´ØF(óAMe®žm¼Î­hT(î÷é ôl$ÛÀ×^E¢Ho¿GIµ}¡¥§móÿÙ'NÓ)))nü³ÃÃwì׫§®Õ 0cÆ0Ó¦Ñß}Wy`#ü%Í™#<”¼j± w,¸í&GŽÁ„y_¯]òAc±k5Mõ:BŽ®áýûÞ] µãn.™š+ÛЉG F}²âûËÏý-$Ó',X»{׶wÙ\–*¯Ä6.Üüó¾øò´WS>¤¥åºÛ•E:ëÚÖž¹Où.ó½ÐÄÞqÝ÷;vlY;Ä®NíÁk¹Nš¢àŽÆÐÖiæ/{÷~ùÉhŒ°U³M†ßi’!öš²ðçÝ?/ž6Àxgnl£`è\ûúÐ|àÌ}ìygpkçÙÄÀ0cñ&ŸÞ6õzõïÐqÃÎ_7}1d¯Ÿ\L,¸°Z Q(›<´•¹¬~|äÚêP{™«c›D¶(ü:yá8gÍŸ{¾ڹᶯF‘_Ÿõ¿L¼  þÀ¦ æ­ûq×Æe-  ÷ò3öEùcKïÔÆrÕ•L̤þß…“™™)“Ɉ\‚ƒ£×­ËïÚU£m4„=•þ‘`ÉóÉOϵ|ª’ñ6±Ì?Úiì´ŸÏyHÍÅtüÃeNv>röWÛ‹ÅŸ–õŸOXµ×S\,?l¼³óUŸ!º>¸~öÈ‘c¾½Îý´§ù^œ?cœÓp§Ù_ïHR&@nkUÇÁ>:ø‘óÂS\ÓjQÒŠœ‡;?PÂÈcgø˳íG\Éž™ã~¿ZÖ?EåüþÝΣGŒ3þëíG‹¥æ-K?1bÄ´Ù_>ŽOÐG>r^|I´MëøþÓ|”)ûgõÿâº2øH÷XýÉŒáNNSç|í‘,6@¯ÿ|üê}ÞbÃÖ£Î΋ÓEÛä/vîÿW·)ò¨óg81vÛ9?nôÆ9CO¸‘ÁÛ¦îÂü<ïySG 1qûi®SéÖö¥ Öþ­Ì`5—™Ûeýœ ¢´Ö¡Ö2«ï¯›þéB¡®_üÉjQy¡œ2¹2¤?Ù?}ü¨QÎïžð$©tñ®E“F÷h €môÝü©ŽNc?ÿþDi…}¡n*yr3øøLÆ6ÿär¹ð0_þ?ò—NÂbŒ X}ýª¸Eƒ‘ôôäõë»ùú’UáuRÿxÛÌ¥^ß!Ï\&Õþ9U=9|ÙÏvW¶Ûü‡Zr¢££Å‡Þyx¸y{óÿõWÌÚµl§Nœ=LL˜víXKËj 'l÷n²6;¡I{mƒ¶ùwm#¿{×]·ÇÚæ%m#4ãxÏq»§§K``TrrÞæͬ³33v,Өы=£|jgÖ°an|oxBB‚4ÞmóÿHÖ½åýßÙõÛ&ì`ÿ1óÓÿ_7c]9‡È_} GÔŽ;gjj*3iRU’Fц†\Ó ¿WWW)ŸBÛ ¯5hÝ6çååÂ)‹sÜÝÝÜܲ|aTSÜ¢EQ‹²GT…åïï/ XäuÚF‡A©Oɨ:GhFÎáèPÉ_iýúÅÍšÉ?öP‰Ž„ÅÓÒÒ0¶A0¶A´A2 ___™LF2)b¢V­*O }}¯»w=Ê'bR.FÖ†¶AÐ6H%¹UAA u¼½½åÚTSÔºuI“&Þwî­xT@ˆ‘BCCñÙ.fRÈ á*ÚÐPseeUÚ¸±Ïõë£Uḹ¹¥§§ãáŠ`lƒ¼°AG›j==Ÿk×*W ù7 $$XmƒÔÀ6Œ­­¼aCß«W5&Pª¶ Çv3)ä…ª¡hZ]5 ²Mš„]¼XIT#¨Æ××—6ØŽ`lƒT¥±˜Š‰QW¾>îñ"HTƒãm´ RÕІe©íÛËTÓ¶-Ó DêßÍÍ­ò*$$Dº )ÚÁL y¡m˜ñãEÕX[3VVÔǯ—J(???¼*ÁØ©žmÚµãTS¿>kdDÉdÂD+± ‰jˆj¨*ßßAÐ6ˆ`Ö‚iÑ‚©Wòô”žSTTäêêª1"”––V¼,X3)ä¶Ñ×g© Tï‹ž––¦Ön#$P>>>D5U¼ :‚`lƒ”ˤ¨{÷Ôþ¯v{ Òh{àÚAÛ UoÃ=ð…aÔ&GEE©Þ•" €6%%%•®A0“BªMxx¸tW ÒxyyÕÔà9à‚± R9aaaÒ5PÞÞÞÚ(UÛàeàÚ©AvJlãïïO¢šâââª,‚õ†¼G>V¿_ç$¤! ”L&#ªÁ]€ È«³pg?´=‚ ÿBl#ÜÿkAW ¶˜!‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ ‚ È¿Æÿ{èvw endstream endobj 1250 0 obj << /Length 1216 /Filter /FlateDecode >> stream xÚÕWÛŽÛ6}÷WðQÖ4IQµúÐ" ’ºëôe\‹¶…Ê’#Éuöï3¼É–츻‚¢0`Q#r.gfI‚Öˆ ·“_“ù›X  g‚ ´X¡”¡”K̳-rôÝï›b©:5±TFZݸÑÛ}‘ë錒èÆ ît©U«ÝKŒ¦ÓO‹÷“׋ɗ cQ§œã”¤h¹<|"(ù{DpœIt°³¶ˆ ÏÝOþœï(Áü#˜‰ØÌ5ðáLxw ‰Rœ% 1Q‚Iœº˜~ŸÒ$Òæïé0e$ªóŸßNg1ç\êÊ:¬Ï߀î#FÍ{‰S÷×”R0F[ÔU $$R«)•ÑJ/;mUÃWU–F/ø— ÕÑg±Gü]åÖßWuÓ¹a·Ñnà}³ãFUk/.¼É¢Z–û¶˜²$úÇÆxä^å1™FÚ WWu‡{c‡^UÛ]©o=$ægÀ·?|a!± 1œ`ÁéÕ,§PiÒgz CR†“8É®ê &Ë2ñ(2?pÍ Àµsɉ• JO­9Ocœ¥Òëm4Z]TÜ—åèi‹O0$!¹‚ûÚ1Å)͘.ƒ·É«_(±€^R~â„ǘJùr|γ⌽$Kƒ@Ul¥¦¿SÅ4ê¦4r…L#õX›uUêf è;Úªn¹qÃwïZ¿z£|½ªÆ¯X7Zu–l¨Êë®r'Ò_öÊ«ìj÷LFSJݶÃõ$|¤—ÖC„®ƒ„ÀI‚i’26ö?êN÷Jû.| ð4M6 ‹fŽ©ÜRèAF¿2´g^/÷[]› ›º'‡Âت \ÇÏ$1d†Ì«ñ8M☦¬O“èÓ$Žg>Mâ4MâsfS!Ú☊,ÌnÃ`‚Emí–³^ÔUùädàÏfäSæ×ô‰›žæN O=YÊ›A(sǧNûT”uµ¾H•÷º§I×'ˆ Ìc9œõ‘±d0 Ú†šŒCª ÿ ¹íî6 ‡YBH´éº]{;Ÿ7:ß•ÆõNWEµª[½\Õû*WìCö5ØÖó¢m÷ºSNÅÈìs7ÕñŽ: aÅ1–ÀwÏØV‹¼R‹gl¬â‡7Vð廵~êÁ¨+ˆ”Òп¡ãê•ÙIW!ý^Xùv[5õö¤ñ°óäÚîíõµÚh;Õt!(/#¡ýu`¹á¦}i ÅÔO§ÿéüHHl¹áðXtíOKªý¶kŠºò0ÃgWè C<5I€§<…¤Á ­ ˜àL8‘e°Ü½À17/ªµ{q$³»Fe/>l ‹Zj÷n¹f9Ô˜CÍ}ªÔV{×”î”-˜ïœM} ÁàL´ .ñÙi ‹1¯õ¿÷›Pÿ“#å_À2ûjK"¿v¨´¨ý¹QÒÿŽÍt Yù¬¡É öeÑnîŸÊ˜×N‹¾@«f†d,{‡ÎŽ”fpL’0_9àíQfØÓÝEk‚cÉEX½*ëà '=ÿmÂ`Sv~vÓñlºßí 5tŽ /­ ‡”?ûÎzñRÍê‹AJÛ1äeš¯Û¨]®×¶ÁØèú}·‡CÒØÓo –×Ú endstream endobj 1257 0 obj << /Length 1245 /Filter /FlateDecode >> stream xÚµWKoã6¾ûWèEjšo‰¹m ošEw›¦î^Ò=06m ‘%¯릿¾Ã‡mÉN é€I ‡3Ãá7I­"ÝŽph¿Ž´8"QJ£”`$˜Œæ›Ñã-@þ!ÂH)íœÖ&â2ƒ¶ˆþý>úi6š¼u…”¤2š-#®Ê‰¤¢ˆ`ÍÑcüó/ïîgÓ‡äËìƒS'1.©Õ'Q‘EcÊ"Ä«¿¿û<µº£él)J¿6ºž;¦RE’0Ľ·‡„âøÏ_§É˜¦Yüñݧw‰ÀñíôãôÓÌEµaD%ƒ&ITCæ΄·£hÌ(qöÇ’¡T†õi%g,DéÄyãÕVMBDü·Þl ÐE‰‡ý e™GשТëѸïŠÂ„ î«úy§C]”W?ÉçÀF` ¶êÎæ ¥]»%BoQÍ;‹hÝæÕaÐøŽÏ.tª¥o{öÝ÷.·è³½§ ¹0ͼΟÌö;EŠ1ß,(V^óÞÃ[ÌZ!Deê›°û³ip?Xú€ed†€€F’ÀK'LÃTvdš”£4¶Øȸ@ é% ÍV4˜ ‘ýAl¾±KznÂ@™=7VÎS`Ò4Û®M´|Õ2>9ö­#M K`)¹å .1¯ô©o:[–C¹nÛñÊ´þã° ö£Âç5÷·Ap† óúžo%˜ òª­äbÀ»6,CxŸ‹Pé,£žXde,o|³unjËDvÔуi-C¤8íÏs¼™Þ±>C8ƒÓ ¤‘dñÊ‘U™­k£Û0ñ/,ðtÿÄ_Tgñ}]…€CçóC"1TTÊ]qƒÄ·ÕuÅÝgÛ°ìAˆ®|CëiؼgFèã±’Ï°°éñ8ݵôÒ†j.=/ÇjûdÎ/O9$•eÕ•‹À`°ÍùŒù«S‚µö„!•Ñ7qË’Š|oé¹ùnÂF8àgݶÛæf2ñ‡&܃j Ž6À¢4í¤ÚšrÒtu>×­3D'{-ä'µºF«ÞÆ.×g÷|“Á¿lâ*v²CL(Ÿ&›„pl«BˆÍ«r9¬ ½XœžÇp7yP~éƒÂ«P,2DŠ¹@.ç™"þ6½ @ììþOæ Ñý¥ûx–º ½‰iç“ãfùzF¯ÍÝù‚vÙÂu¥)¢<ÜÃî =ßs¿o~Ø_Ê}Ö•{äôî~Ç[a]ì%:èìÁ« à‚ÅËažäõ‹€C¥é ÓEîŸÇê¸ÜhOߘ‚Ûîâ…ãòXØw…k¼I@J¦N]þ –€ª© endstream endobj 1262 0 obj << /Length 900 /Filter /FlateDecode >> stream xÚµVKÓ0¾çWø˜JÔõ3¶¹Á+@b)'ààMÜn´i²$)°ÿžIìÐ$»*T]ԃǩgüyæ›A[DÐeôr­Þðl– õ)†”ÐXŽÖúÚ×yj[»X2¥ãÏ«½t¹Ï3·XR?ó®\álãü†c†éâÛú]ôz}(\FõÆVD¡t}ùFPßß!‚¹Ñègj‡D¢a-ЧècDÐï‘`3ÙaRu"X ÃJÒÎÚêíÎôª%ÿ*3}•€‹5ÕþU_‰$EÕÕ$®òòvg›'eŒÓªÜø?®ïýzW»¦É˭ߥm]xé×3¿nª¢¨LÆ?]6Õ ‹-ÃwW·,–¼HzGÁ³–TaÃß×7[éTÆ¿Z¿Œw^Ê¿¶UU;Ûë—,¯]ÚVõý²*#Ûf¿©÷…kª×Êç}Iïòz‹¼pu9 i¢qB9€œ|,ª ¯äŸÈNLh "Ócà,Â}Šºàòàzøet‡Á„ÒÃÝW¡86J«µC›GÍœ¯=ˆ4°,ˈÆÊ(ÃfŸApBâÝ-Ä‹+צ«&dÕªwzïçÇ.>êy)8¦ZŸê·‡¡#BO‰ÝÄóDã:Á*1Þ&ìu§ÒŠ+…"Îâ—@wÔCŒc®Ì9Ô]3&W0ü4ìâ[4ó®M³¡þT‚4söÊ[¿_^Œ¨xø3Ô½þDõŸÈzz0rBr¬›8¯\âZGï´·e×Àx(‘ J$l¼zq\[aký’úÄWB8,¯ÊÎ¥ÝnNõ]àp¼vW»2u³s© 0®ŠMµ/³®6+:ÃB>`ª6A«jo¼tcŒÄ?º JÐ.®PàŠôϾG– ,/gÍb ¾·»Ðþ:È… =ãUhDM5í€}ÒCï<)ï©ÀR™÷„b¦Ù_*#ÇÄœÕRF×LšŠ7üDy%>‘lž×¥-ÍÓi¤ÎËדø0–`‚hþdù p€¸Ô;ãÅ0Ws 7ž©^.*ŸœÍ@t(~6hW›™•#Š¶€‘+MˆÀô0ùíR Æòf`¿Ø|*†ªÈ’ŠÚLÜ4PÄ.%•‘ñŽk‡™]B¦&ŒÅWû"Ìéïmi; Û~’w;xÁço¤qÎü endstream endobj 1254 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 343 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 153242 /Filter /FlateDecode >> stream xÚì½u`WÚøÿÇû{÷»-J÷ݶ»â~Ýâ!îî.Dˆ»‘ÄÝ]‰» \ …â-^$Dù™¹¹Ü$77 „ÝîvNnçÎ9sôùœç9çL>|@Ѐ4  h@Ѐ4  h@Ѐ4  h@Ѐ4  h@Ѐ4  h@Ѐ4  h@Ѐ†ÿ¶0;;‹Ѐ4 áB‚x„xQATPAåËɶ¿?vtlµŠ‰Ž¤Q‰’¨ ‚ *¨ ò%;uêäj!³—J! ‚ *¨ ‚ÊVô“!Œ©•Èâ+W~ïjã_Û˜ÿåK—öAÊÑF‚ *ÿAòå µ€D‚#N¡à¿„Š ñD¼€][¥ôªðA"Aðâ$"îߘàOx4¸…DÀb1âdÒZ¶™ˆÅaʼnD,J(TPùsBj±FšŒÇã$x 2‰@ST3TÁK’ñŸ¦»XÊÜ™,¯¨ *%A!ðx ðP ¥>Wû”_É$Ðo_Bá/—¯O–H$Ê©«+Ia¨«Ïþ¦Ü 5¸:V¸Œ,«¨§J“¡âV2 Za‚!öIÉi¨+(Ka((¤PAåÏ )"‡Åax,N O¤™îrö±–'á)¦áé½)†;i„O0O ]‡Çâp"#r¬(}4yÍý‰I’8UÏÍ/ÒI^’ˆ%KË)É‘!u·²§`°ÀcDKlÂað"8’‚[€‡…•J­µ½h‚#pD–LÄPÈø5‰ªYYj))¹âØ€öÆÐKT"Rà«øÊ)¿H@­‘u}üÔ%q´AŠ¤¾+¬)ÛÍ@¨l/ÖÔÞp¢`A÷]ƒúÉE5…LT4sËÍ4!“HÔˆ *>H($‚¬–YRC÷`OsoWs_O{s²—úN¯¸¤Ü`žj»¿ìD¾¹’$ÑÃT ~œ– ñ8—ÐÂæöÁn(òÞΦ–$'e)Öó I%ÃÔêÒrOYAfWRqk¼®$d¼¯<ÙÕL»ß•„uɪÜ`ª@†ÛI?C"%5rJt”¦‘pŒ”°Iô“Õ£¼c »¹¯»e°·µôT§Y*Ä–z4sfaY˜*<Žê´¯°$ÖZSdÔžùJæ‹)ô¯d]ï„á _åe!E HÉÙÄf4$%ġب$]çØìh}š8y~")$¢š­m}j„™DÄ3=—ð…üϨ ‚Ê Rda§¡}õp{äncC]c=C 9)FXDHL„ŸL‘´ÝWz<Ï\@Š„Çá±,š#À‰R`µÌ~@îÐJkí*܃Dn¨k &#I…l7 “8m§^zUI€+"*"&ȃÒbó:JBÌvb%Ä„ðâ‚Ëgà[1T¼×ZG"áIœŒž}^Gk„ÅNNBPH‡Ýhx ‹ÃJà±b¼8ÆcDÀ`J‡˜0#L!qP°ìóE¡T̽;twæ8Z›»ú…Æx)IQð€Çb¡ò#áÄÈ0eD%Ä1§/F!a9€Ãã08 F+.L‹Ãf¸K‹Ã34õœƒ‡ãeeRB"H,cAJž¨¤§oj¨c_98X¶ÇÕÜÜDWCY ª+,xh…v0¸@ÆÁƒ°¢F®èY8 þ‰²OÆóPT‡0?‰€J ü‡…2 a2 `*.ÍT‚ۡȉXRCå>+Uzçî‚úcÖd11R¦M¹{Ì$Å  š Ò —!¯jëWS—ºÇŒwd@ÏŃ’MÅ5ñ²¢‚ *|HÕ ÔØ*‹‹ñ HHˆiŠá¥Íqú<)C‘wMlloèëìmʶ¡±Ôå!•ÞÜo©,.,È',Ä/'q æ¾Õmí#mýÝíÇ6AÂKï®è=›£,)û¨ÌƒÇö6µ”$jaˆäe|Sòº»ZúÊCm!ú¥ \cû[SÍñDšFYoÓ^{y‘ oà^QÝßÓ6ØßZk)')ŸÒÔ‘êm ƒÃªZú·÷Wï·&âñx)ŸÖ‘ÎX)I;HQ)ú®ûÛòÕD„E„ x`ñ‚c±rº!©ù]­}íÍ…{Mwâ©TªYh^ggóÀ`OGÉ^["‰L5ò‰íîin/ˆ°TÆ“”Íbó+û{Ûú;ª2<ôhRê¹'.ž:ÔÒß×5ÚW—äc(K” .ƒiÈ^#ãÅe¤¨ zû:zê$‰x‘HñÈ=P–äªHÆ¢B•?ÅœÔàw)iIJ’, NJ*΃T®©MÊ5¦t¸>5ÊÝÒÉÉf—£•µ‘ÆN)ü •ÞÜ’ä¬G£"³ó$¬èÎÀáÃÍ:KS4H©\){©"?+e,‘ˆ%¯`a4‡¢áTÒR›êgã¾7£«*Ü€&-À›ƒEÍ­º¹±*ÆÅÑÑÆy—½¥ÉNÎVàNöš²xõÀÎþÉ!ή.î…Mu1†RùÖdžFÆŠËÚ—¶4e8«ÒHS€)G) ^^Û©º&'F·JHQÒºaµC¥‘.NÖ.»lm¬´eµÌsj¤äˆ<•©FRó€ì†üp#ŠYV=¼©¿?ZŽ¤4‰ ÕÀ5n ÏKCkWAMUA¬·»‹Ë¾ÒªÑ"{2RÞÆŠP‹ZÞÝ—àx• ‹•’¤HIÑ,ƒ ›rÃLUÒ«š;’<@²m¬MU%5íýjjSÂLIRµ~TV'uά«LsW¡ B•?ÇœÔ`«.•F_NF H*1 e™Pr¦Ö]…Š7ôŠënÉtP——¢ÈÈJÊJá–ÛËC‡TKkÚnc9€? ‘$©x ^+¯»¿8ÂJ]žºSÃ<»¶ŒRÒD¢qxfGÃ>w#YiIŠ4Y|y-D!Ò.I¥ÍåÍ­y^JxoÃÝG‘ÑÛ_QÕì¢!T¢¤‚<¨tY%¢¸²­¡¹1Ã][Ã8,«²u´o(F]’´ìê>"‰&§¡*§ M•’‘ÕtÉ8¶c·ŠŒ_nmOe´£žœŒ4MV–í,³Ì?=Zâ¨N¥Òvî).+‹ž)*‡#©D–Ô7dú(I]-MÆ’%ÕHIRð :»¤¢W )‰"·+2cð@¢…È.UNž*IÆʨ›-) RÆdRÍì!?ë¡cÕÒVj¡(I“qNÈ,r ãÚžñ£MQ–ªðòÈ•-œ Í[8n"§˜Y6Xì¯+U“¼<4sUßšæü0ÒÓNìh‹Ó“¡eTÍó[šsƒ e)xR¨ ò_)»ÊÞjW ²TŒ[RAYuQº$IÕuïðhCŒ½”´Šþž¬²–%yé iÉ{üìvÒË/œÐ Hnî¨-ØŸšIœ›:£ç‘x ¡ª,g_VvnGkqš£4€”Kaû± mY2VÖÔ#§¡¡±<+-6À]Ÿ@"/· è=†fè[70|¤)ÑZC¦Àû¿hêùmµá¶rT Å`wDuc]mARjr|v¬•<^œDÀ©{%w–éEn¿'ãôù¶`UܲÛ|¨T²Š‰gv^ZNZbFFúŽöÆ\I¬¬±{Fe]CEVFrBJ¼—‰2™ªêXÞÖZ•›_ßZªC&JÚÇdçZÁ‚LªÚÕÖÔ¦¦í‰rÖ¦Iªg Ç;@–TEUVÔÊ!åžÝڜ꠭ öiõ­•™iIñÙI>&*5ÓÌÊÜ4WYR’JÆ•½õÞˆ%åŸYŸfD!ɪ…6ôöî•rÎkjI·U“"êyî­ªÞo§CÊ%¶7ÇKOÃdqeCqêþøØÒúÚ®tK /gæÞÐ۔髩°œ} åš[3VjIŸƒ”nCv˜©FÙÚ§´±±©$55y_nâ.mY‚Œ¶eJM}M’³¶†Ö¾¾Ãçz Ò÷Ç—Ô6¶—Ä:jJ®ÄŒ *¨üGC (4)%[g+ yÆ~…JÓ57³7›,¥`åê¾ÛLVŠ‚—VT³vv ò òq0×’¡-7f¦r:†»¼¼Cƒ| 9©`ß°[5iPŒ:æ6¾þ>¡A^ž»LõÉd2EÝÊÁÓ rs‘)4-+ðk §­‰øiZˆB SeÍì­wYªHÁ¨…@•²t²ÖW¡À³H4MKŸß° O/{MYÈfÄ‘å4íìmŒ•i4 Q^S×ÕÅX™/ËD¢¬’ºµÓ®À@_~ï]&²8hç‘ ¨¥ïâåäíëj®.OѪZúøCy÷w·5Ó”¢RȪ†&n;ç'\þd5SO?ŸÐ@wW3Iš´™«³‘*4`’W¶µ55”ÇS(ËC Xµ’¦NŽFj²$h°A!É«ëºùx‡û¸›k*P$eÌmÌÌÔ©ð^'"MZÞÆÙFk'+i›Ø[è(R°I)={'Pou ;G3EYAAS×ÖÖPUŠSA]ßÅBc§$a§–¡›—ÈW Ï.{C9h6&mlçìa­"/½Ìî9PêÖÖ ¼™— `ê`®£DÅHVÖ3ñô÷ ññÛ¥¯,MMQÓØÊÍÁPS[_×`–‹·¯o°·½‰:†®?G•ÿvH! çæ½”†k°…g˜7„2mêd;Žý9cã'ýFâ¼ ¡”9uM!0VJÌýºR-ĸk^ª˜r±ð‰ŒÅÛô[è›[çV–Yò½(ýˆú1³s/˜bÞÊœMF±ØŒ|¬—åÒ³¨?–s ç½zˆù뢻˜JŒ‘B$óÞbÄ´ù—ÑN(˃Ѻ>¾æècœDÚâ†1·ï˜¦¤ŸØ-œ à°Œ=Ũ¯Tþë_‹„ *|ü’Ü©^Q[è)I$ ïš@R¨ ò‡‚ÔÂw £e‚ *ÿ¥ŠB‹TPA•/©Où˼‘aaX11TPATPù¢"ÄË{âøñÕB*ØÑ×DN×JÅØJTPAT¾”Ëê\:ûÓj!åkævÿæݩɩɉITPAå3t¥©Ip0}ÇSSÓàßz¾˜3µTƧþ+uȽN§–/TVRž333Ÿ©Ç÷-{Ù,üovvvfz ©©ééðꀓðü|rÔéÌÌÜÕSЩÿ†€¤•ÞÅ ô022ï"æËàŒ §YD‡Ä93 ¢ûwå ŒÚÌô$“›šFÎÔ“kc£¯¿‚¾Ì¼xáh}j~iJõÅÇo§g׶eƒ¾¶d„ZéŠÛè²½tvòíícÃ}C·g–ŒaúÝí³uÇ^MÍ®I¿˜ë•S°^ùw×õë»Ç›ê+RË{{.¼F{ý¿#¬R°vŸ}ÿüÞ¡œ8/- ¿Ê¶«ããzScœ ºóffü·£Åí?¿~4Ù#aìæÐÔjI/üù +ä­1G9y÷pGönwM[?×Ôá3§çP;ïÆ©ñ»c])Ž»Õ¬}Ý2^úurv©$‚S3Ï.*°uÎ(9ôfm;Þðöçþw{«]êVNê6Q¹ÏÇ¡1yëpqTn÷áÇpK›|vëʉÖ£¿É—Ÿümb†u3]Øz—ÑÊÐÓO®ÔÄçtŽÜžZâ¢ß¯ —Ä—\y9µt‡û¨ý§ÿT“Û{äÞôRqª2kúÉ©%ãšzÒŸ%#s÷ýZõŠÙé[Í¡–éwÆÙ•Æ’CIö׬2ܯŽqÕõËJo;zíÚôÿÐú0óêÞP¸…‚˜}Cÿ¹ ýŠZŸ¾¼Vìh*É-›Ú~eòÍݶ— ì±wÛìÉ­^‚ñÜÍÞ g€£/YvºÍÂôi07ûaîÌ,ÃŽ›;ɸn–q+«ôþÚ“°OñPgW¡«¥ªdÀùû‹/œÜ‘˜S36<ši®­ª™zôêÛ¥88õòno´¯’wÈW(¤þÄá÷±Ò5ó¤¬îó'Î]8qîÚ§“Ós6øÌÌ sãž=ë) Y} †ÔÂæ:ËøŠ4õÙ @÷–ú8í¹>>Ÿi³Œž© 1 >ñdbÎ*™÷ØÙ7Ãék-¹^.Gn#XÝ,b›!}úÎz¦žæ*¤æ:,r1ý¤÷²Êú¼g0N‚~9}1MõŸ»~~3K?;3»8§A4Ëœ~¦‹gækfvþ™™¹3cú@W>ÓG<÷vÜz1»ü ÿ^HÍN?>Ýì!e’ÔÿêãÉé[EŽ¦D%ÿæ'/ï´C:º"H}˜ýýÚñL%}à Oe-U!ÓªcÏÀ8íÙá†D3œªÅtï¾Î'o?ÌL>H–—u2rwSÔ1Ùé^wðìF9—oeª+¦¢ƒ3ŒË~øû4ûÑéóÓÝaòf§žÌβ»ì÷Ce’ž#‹‡”t_Îåöâ$¿¸¼Pgo¿Ú—(¤þÔ* Óuk8øÙ¹Óí@•–r®ì¼ûqµRÓãŽwÄë`õ¨Öù×ÞLB?ÌL¾¹uüä‰ã0*Ø»3¦ß48&fB-púݽ#-Ñ:úXE}šMIïíÉw÷ZbCÌÄ$¥ÿNÐ&k›k„ y6=ûaüñÅ ?WS¢šÅtÏÞÖ'SsízòU—cJÑØï ¶É߯vzI*i‹*éÈøôüô\5u£=ÑÖHqÇNÛÝýSH ¦¥ÊJÁ]RÛXawÍÈ=p©{“7:ò=u|kz/ž¨‰ÔÖ²¦ª8è;î¢Èêk%ýòzúÉÁºxc#œŠÍ<6¹çé;hÆàZg®»¬¦^ÍÚ °ùìóÙßoØãmŽ!ã7bôȆ:icž}˜yýKwy¨ªŽVÙXÁ­áè¸ØÆœìôü¢M-LHz±gyJ ¾NÕkáÜy4§‰Ù¨Ôƒ¿>ÿµ?ÎßÛ¯ãõÌë©AÆÙn>ºÖ•·KÕ«vàÖÔ?ļ!éøµ¶,7u¿³÷ÞÏΰñÌ\*‰´7O=rõ5KD_éÎôKê;x¸3ÚÙ…ÔŸReA Êö&AIÁqÉ{ržz4 ègÞžoŽ0 ¬h¿ÃR³³oî-°uŒ(=ÿû»ñ_gÙH»ýzföÃÄóë¹:úºšÏ–ómMÜn Òòì=ÿ<ð÷›'²mc*/¾~ûöÑHŠLè©o§¦g=^l4öðÍ <} nÛïæn—zøüG·n^9sõÕ4=yï®7úëøÿü|{uíHŠž‰_ê‘Çnú©è”Ý}=5;3=ùêa_´³çRId©ˆä‘_Ÿÿ6àí×úû‡™gC¹JÔý§zŠÃ¬~y=þö\u”£YÊ@s‰µ´×ù§âätš/ýþêæÕëWn¿xõæÑñ–(ËÝ=gžÎL¿­°ÐNÌ:üäÅËG7¯ß}:MqMMŒŸMVý§Ó…çï' ™âéßÎõí³pËn»þúÍËmQÖÊ W!gæø€§¥™J`ßÙ¯_>»s÷ÅBHAöÐä“Ã¥F–•CW?|pùèù‡O^=:Ù±WË2¾ìÌ£Û—švš:¶¾ú0uÈËÌV'îĵ§÷†«‚ŒŽ_ýÒïúÚyìi½öÛÄ4›Y@4ü 5=q¥>Òt§ßéñSwN7ì÷Òâ3ì¹p@*,²¼!)Ú/¤¾1Æ=x–Ô±,=ó½ÐØäM«•®jþ×Ó¿þÜ“±/ÌÚÓWßR_B¿zøÎÔăd5ʾû3³“*£ÜÊ¿¹_åfï]qj1¯ÎÆë[ï/9új)ivêɹîdë]ûKN¿ùÀlÐ3w|ðÿ×·E™º·\|59ËÂó>q»!À?£èгß~éŒröš^‡7þs!¥¾Û!¶01§(¥êäO¿MÁMaâRû^‹ ¥!5óøT­½¨¬¡öî @SSåUjO?÷ÎL¼¾166vø&K ñ 3ô êxôzØT÷ÇÊ­…eŒuÜáØŒ•·k4ýô4Ìg§kBÌBwœˆßËõ4“‹ÏÏ,hüÓGõ|Ãû~};b»{¤ÖCÙµálÙOÐu9ö` næíoƒq~.^!•ª¢SÖ}ozvêRM´‡CÑ£é™çC¹*¼Š&${×Ú{¯¦€‰w®.Á˽áÆé/ˤßÞ?-UW«:ùòÝ£Ki P×3×ÇÕÞvN_¸µºOvFýÑS·ßÂ(¨©ŸÒÔ~t¾ôfY‚r¹-Å€OÎRß#ÀÂÝÏP_UÌräÎ{©~ÿÀö×3L™Z`JM¾9Ÿ ¨[÷ŽÑ]gß_jÎvÓ „ÔÞÔóá]Rе÷“‡¼-ýB[½ùðö—¾xþ Oá«'øÛ3Ü}høc[R“7ºÒ¬e]ºÇomv¢F=çÏØ;Fìo=3ÒºGÓ.ÈÍ-4÷è»_»Èæ­?2ÍÞÒ <þ;+H]=–cd× l¼ÓVW%÷þë'qÁ>65u£õ¥aڦ巤R5MjFÍÎN]¬‰ÙíPòà÷»¥»ìB¯CæÝ¥d#«„üC/fX"jæéχ ¼ã’ú¿ý°Ð×þÑ-=ýúαl[‡ýY#¿¾ššë¿ó¯y4ell­ádéh…§*bŒ’Ú®¡ú3»ûBµwUu_{7>ñ~|bjnY(KHy@z2 {žŽU8ÒÌ3Ÿ<46pøÔعG`T4;»„z‘)õ[ŸÖ æ(‚¼é»#E4Ëœ¦#plGN=ÿëkè9tH=œKÄËBuõŒê_¦Äö¨s·¸AÃégSÐZÜ©;+ÝT<:À¿_Ï4²;|÷KH¥«ëW =Îåú‡‚‡0¤”~POIw×öé8ö`jzü|}¢góí³]¾¶©O&^ThªÕ¿ÞáïcUW?8ZW¬m^5|äöõýŸûÊJ³ƒ½L¼Š:®ÏÒ!•ªú£3<'Íÿt`Ÿµì®²ö±c §ƒGÎœºüü(‚ñÁ`ðøƒŒQåì‚ôÖï§|”-º>êìø…†4WýðÃÕ:óúxŒÎûÊ»‰CÞÖÁÑ]¿¾ý0~} ÑÖت(¤þà 5;óìç(5Àœs¿¿Ÿžº]c!dÐ}îl>€TR÷ƒûW›=õ¤xÔCòŽ¿<îCÑ.î»ùöÍï§K#íõb®¼_ RÖñtHÙèªä=|~%ÇÒ.*¹œzy¡+LN»Œ¤Š¾Öæfà×ñäÍÄë‹m>*ÇY¥ø÷›ÇK½}¢£n<~=111§H¹Îé;óèù8¬6¦^Ý<‘cnæÖvë××ãˆÂM°g7.ì:…¬ªzóâ¹3GNŸlÉr4²6K8}÷õ,:úgž“Òq­¼3Ã4ùµ­«]ÑV!ÕÝ™N^ VÈê…l„Ùٙ翌Dkšƒ& X2=þòñ͇ï&¡Åé%uôØØØR–bE½;km`Ûp±öggžþÔ¡n™Øz ØbÓï^<ºõðÄ›ÏÎ6ô¸Ãè“Ý>¦n>};ùîÍ‹ÇÏ “jöÍ™p‡ÖGôÕñ3O.ô„«˜'¶ßŸž~w³ÐR]*îò389“/F\}Fæœ*RL*D ¥ˆ‹ºþâYg¤»—wÉOwŸ_8°o>¤ÔëO5´ŠÍy5ûáùéÖ`9ݪá;³3Ó¯>zñòõ‹û—Ë]}"Ga’ÎL_ÉUÿÎâ2y6;uw´Æ_ݱpøñôììäëgn?~¹2 HíI88¿Ðfž^:s¤ïìãïá)¼÷w›ö«H¿ûzbòýËG¿½yûöÖP•¯šcñÁߦƟ٧¯­žûøÃ$)0š¿†Bê?R îß==[e/o»/6?ßÇÁB-ää‹…ŽNI=Oß¿ý¹uŸÚ_ý ŽŽO̾½28Гå$g\9ÜâÁdÎÛ>wSW»¸²âÁË×_L½{r"3ÌVÑ-+µ¬,!>Ö«ð¼x}âÅCcCÝâç,¯@›||ÒŸdTpìÉ}Óßìôï§Û©¸ç¤––ÅÇÄù•Ü|9~{sÿd†­sО²îÖÃw…\vÕ8í Ï-KÎ/Ëéz41;uÌcPzæåÔœÏ{êùíÞHO[Í€¢”toŠÊžüKo§'ÿtæ`mm²¥™‘Ö¾žŽá‹·žÏL=ÎÐ0¬†!u ÖÓTž)áÞû™·×F÷hÚîË®ØçëAÊÏ. @ªRK½îÄ­þ˜à ÷¤¦Ú¶š_CaÝšÑ;³ÓoîÍI.­NM 3õÌmü…nç½8LPŽŒ«li9ýàÉøä³{¼œt ÒKJ¢¢öGÔ?†Æ˜ãƒ!ž{͇ÔäX„‹¶ˆGÿÙßUÿO.d›ÚÚ%–ef†ºòøÍÃK¼w™ì)NLt'k%¸?óaêMHL7Ý’²óè›s÷8xEu¢úãCŠî>›xuµ¯±pï¾ô„òÃçšz~®«ëà±ëïf?¼}|c(3wà̽əãO~é-,ÈŽL«­;ôàÕ$+]>;ñìþéæö±kÐ`oòZGCí™—¦ŸÝ|øú›ÉSÏníè½ñ+2C0so°³ÿеãh‡ÿã»ûØ ³ìoe‰<ö.øå€É6q³K;öW²ÓoÑݳ³‹cEíŸ3,h³l1‹O,/œ]¶éÎŒ?=ÕPÑvøÎäô,øZê©ËvÏéw¿­)ï:õñmÓ7(­$¦ÕwÎÏ+ß•ÛÇ_‹æ÷XÝÉB!Ͳ(«ÙÙÙÏÓThX3HýzÿZh@ÃÌ›u×´æ¶Ã¢E‹†?z´öj);0Ò90ÜÁ,ýì¤}NØ_Aì#a6ÑŸ]Ã|ÌR†Úûç_ÃúÑô¶Ó“:ÔÞ;ŒHý`¨½g¨½oèãËd\Œ$•-KaŠ°U„ ý}ƒmj£ÇI—6úIF!/áÖ(ý­=Cm}C,/@nlë["; ®ní¥Ë —ϲͦ£°má• ‹´\Ó»’6R>ØÚ‡äŽQªƒ­½p™ 0×ï ‹4ÏÏ&«Bçû[zà*èh…’ÔßÜΪ¬:9÷uÉÈá¦çä ‰ÐÒ;4wúÚÚò¾>¶¨¥Ó¼|ŸetÌöt8 ózú\–éøKÕZ{’Ù!PËô ³ÍìPû2ùZ¡ê`Ó[‡@CݤN[/ã+›ZÔÂg!u ZZ,½‹¤oþO+é/«ÌÝÀ\ù,_§ì/[ðÜ¥;Î’ šú`½wÏu>Љž?y¶ZHEºS¿§ýM|"ŽÙ re«y‹(ùVŸ‡.Û ]¶l„n!DðÜ‚”o–¼‰Šú­õÊ7Âà“­S>‹²É ù13]¾¢lá§~#‹ 8¦|%iîW16ÉC„ôœT­(¸…Qªóþ9@®_,  ‰›…iÃÀ‰”@bciîvðÓ‚È)@6 Ò¶ðJná£ró’6 ÍËàœ@Ñn'nY*#dP¿ðS ¯às‹•“ŸÊ)@©Ú*>?Ë¢”o—¯e¨¢7J…3…™ËÒäègÀ1Ô¶.ßA¦À•8.Ap@ûÉ‹0|¯˜äÇø‘¨KGÊ™´E„eÂÈA ƒ @ ñà ¤ZÁIâ&ú×¥[¬8£âH[DA pàvÂ&!$N¤×€Â\„¬ªG(#à€ešÙôVÚ\×^Igqûß責Š`û+†¼E4HX7 ±î ŒÆ¼œö€+QBÔ­«ËTû›A‡Ò'”-B ï!mX*# =€V·1¦“ I@ñж Á"¸HóB@«P·€)²’’í™ÀÈÝŠ5óç_Z#Ü8!YJE€F+(‰%úŽ~³q‹,âsb"_ñœBŠ ‚i? áæ#qÁB?àš‘“M^˜!…‡µ žƒϱ @ Öð༠¢ÏH-Ó®`HÁ_…\[ ^Œ¦òùbª8!åI0¡PGÄrò¯¤ ¾&~"HÐàÒ]Â+„ã‰âsa oÈÜP„]Ëaè[ðh„Mˆ€cæ¯Ì"µüÉ$Bêtþa˜P˜€PY°ÂR lB $lÝä:†|ůãÁnä„‚;5hüŸ)F2ê ‰ùüJ! 8@`·¶b¿1×R¿ì»¢ÉA-³I»¡è\üpðƒÎÒ†h0ª é%~0¦%B$â>9yHæŸ;Hð1,ðy.h ÌÉË>kÈ'2Ðb£™Jž®™³X…>ž™;`?VaŒÞÁsÙ”êR-„>`ƒ4'ÀP‰BNA,T¹B"ÝvbôÓ-)FK^!¤€¦Ånj€ ¢Ä)Æ'Ž“…–³šeo¤@] ¤hø…‚© /] <Ñ 8yÙðH<àŽ“™_ ĬRˆc¾‹Yåü™b46z ‚ÁÆm$N@¨m„  ³@%ÿ™úØàAÊ ¨G3¢¸V)F3@:8AFnÌ·,ÕAî>Pi§À1C±¤ È\[ýH( §0ŠjiH4/<'d]â8˜¾ H „â’Øø‰böŠ0nd®úe•Þ"KJxí,)@(À©•XRì»Û¼®»L ggÓGG£‡²ÑÏ‹!õ±´AñrB¶Â&Ènâ„™ÅÉ3/˜Y€RgVZ‰ì#S]Ó…Èͤ˜NÂB+±D–}î’âí–h6Pª¤`N Â>aáÿ÷YZ­%…@ rˆqìUÛ±Y¤V:ìAú€çGCiNx樴iÐ'Çvçv"Çvȶ´§qž» Ö‹;ÃS·2Kê£/‘QÝŒg1†+Ÿ )&ÿ']âÀ˜aývÂF ;ðOÈ8óó!5Oà5sSY!¤'jˆ~½0´:{H1ì#–‘0?eM,©¹Z„Á!σ@Ù#FpË%,±rЖp÷-% *‰ü°Ç)jãGBaò«…óŒ¹ê² KŠy gœ1JŸ/Â+†/3¤X– ò¸•@ê3TŠÝÿ¼O²žxÅÖï@9Œ±Í -)è<£¸8y!Ÿ!d4mŠˆiÈí^xÈˇ°i;ljm'pñ­•nd¯óίr|Â^Ø@Jl¿‡ lOA.>Dp°%õ™úK ˜p]ð ^\ÌzˆPx °ò… Ú9xI›vÐÁDgÓª8ÀñvðI„”6ïRÊsÎÿ&¸U Ê„y µH1`÷tfL¬ÕœžS@ü«A€îÏ ÂçCŠÉG͇ä¤ ‰îà|HV)6òõv ¨Al gÄØCjQ$tNÁÇP~7 }>¤€)!¶žö±C<í€)‚X.!q(°ö^ÜÀØ@JtòÛÓÙÛP_|B(dhô)–KŠy¸µlO_ì-dD²`šƒy¾ã?R Ë@íäëí"_mƒ&¶àODD¿Ú¶ZHÍ3j¸ù‘ym")#X'p @¨‚ÏÁ3çÚCŠ€ #çR²€VkYzKCJt¿84f}´! м9Åa‡ƒÐ_~<1zô_iIÁâæ}¸ “ »a6| HÁý]ð#¤xBÌ(†1~…m(ˆSÛ!Hq,)æî¼@¥3›Qì …X.L 'X6 F±¬áœÔâ¡2£*×RàðGœ@!(C“, )DÛ,Ì/!B¸Mü+‡KÉb,™ÀmXK !ˆÇœ/Žù ÃÏl/¯Rlj™N(aл1°mÅlF­RÌc$æÆha±¿zH±lÿ"Ÿ)6¹ø2B¼ñ"8~)̺د·K€äsÝ xlgdáD${H1«ÈyKçÑ©¹ç Á£zˆ\%õe ÅðÃ3Ï3FËÿH‰ÁÛ yü¸¡¶ ¾‚“‚ÿûã'/œXù\*3¤@K#Bqó¸ùHa7l&Õ²¤ þÎ5)†g†0ðËÆì!…èðöa,ðcHáœ6f?“K_ç°zH!Ÿ .,¨²ÅãO€çH‰~½cR|ˆ1¯©ã%o…,)¨_Ð=KAje„‚ ™K€}93ü®+)‡Ï„´ðö·Kpc¸„è„bòò-¨Že!…å€m(h„âå‡M*¡fÔª,©90 ±„ó jÙVÊXˆ\ óµ"H!„BÖrBÈR"fAŒµ/)æéA k­Û_σ›[¸‚_·l(0¼¡¯jc=È\R›æ&¼ e-Á"pñ1扰3ˆ Š‹­t# s‰É´V.¾•/œ€¨´rúaé„‚XXÿßçBj…¥ñqNŠ(+>hx𢠴p‹ 8Ãó¯IùÌA q÷!lÚ¾P8æá "ÇÂÒb¬ …M~pŒ˜ ‹E#ç‘¥Îà“½É€¨wès9–-Ñ ÙXRˆŽZI‘‚`¡ÚX01±¬%µ`™ŽaP£féâZfE+5Äc³p)|äJöb,/g!ø•y!úg¬î£ë +ÂɳQ@|?Äú¯KÒy)ÁÁ²î&¿8ìVE53¡> R <{Œj] ¾V5b'0v.@jñ ÚQ²Iˆ¥0 ðµÑ«skn 0>ùp0¡ ¥­ÛA_c NÂÆcŸÈª!…<Y¨•6?^ÍK@¨/N^"´è¸ú‰Ë.’Y°°“ÁÙ57HÙ-A燌)Lâ€MëùžÀ§Øz¾ÿùç…c0ÆìOX <HFÖÄÒœSÔ°‘Fl…©%æ¤@òà` •$¢úCŠ¡÷ØA ° ›­ÀX`ïIp¯Äz^DDþºÍ^Ù¼±¤n1¤wIüFñõ|xîEW.>ñ¯y±œBÄUãL·Gl½Àg[ĸ ;Ä×ó>Gé»uãvÑuüì4'·€Ä×ÛEþßbëø›WæèØ,„·üåŸ"_ñà¸W ©Õ(:A<'°¬1‚‹% ñÕâþí"ró‹µMø/Û 5 Ö.·fÝv ‡ñ_š ‰u<  Öæ¡›„°ëw€Æ òWü¢7C~&§à]ÉÂø ÛÙ·j"'Ôõp\BDT+¢òß) Qyæ…8~gM›ÆâZfH±²Ý„pëEÌý+›S#My绸hr‘MÕ!JR$®Õ½P‹ô½´×žÚÁÊ:Õ?& :Æ­µnnŠóÕþñ=ÀpT¢jî'O—»+me PqøíÙµçž<{p´*F“›°iy=&Î!ŸÒpôÑëW¿tWxò b¹…faá»L…—ÚÄšP\BR¢õ.äþx^ð-9(çD®½:íßêc²ˆû¡›¯^\o‹óØÉ­å£þ¨”\6š ¯@Y™ùÉŽFÙ,R°Î%¥•©æŠ¤Ï†#èø¿+‡Æ÷ÞzüôÆX¹åw"X.¡OöÓ.^µuÛõŽö¥íRù»‘å¢2>Yõ¤Æª<*e­ÜV‹Ë TþõÂs8$WÆDúkzT%¥XÕσ”0ù[’KdÝÉãç¾tãéÓGWÏž¿tìp³‘ÓÞ–Þ‚8³‚Xh9.}6ƒÏkèkåd&†'rÓ—µ8°ù Ë¸„–¢q“ n3FWyw¸¾2™CÁ Ð$Ð;Š¡eá‹M6ºnçâ“øV98º¹ÀÞ¿²à¤œ’û{Ó‚´øøP˜­xzl‚KGÁCqÐÚ0A5¿_®¶ø¨üMÞGÏüŠQøÅåÕ l{fx°>ØQe+?ò7A°y%àŇÐû‡9…¤Ä¬{ú:\%Äžæ‘ØÀC ÆÁ+Á)jh¸ÇE’FAfr™ë…^}ÐV‡n#?”Sî¥G›¥Ä‡åDÖ“ÐÏÐcÛÌ:6pøÿòZgž<’j‘”ù»ô~fP2[ð¶æ!vx£À¡Á5ÇF/|nø••È!´ì_~›½Z‰Ð› ùá­¤ùqð…Ë+ë|Dpðæ&¸jÀCÿ©âfæêH¡¹æ²Ï5¯¡ÂE½ ǨÓMKx6ðíÔÚÛÞT—¬¯,ÿŽŒ¼ax#T/ëàzAj8ò¾¸õà<ÏÇó „ú+àø…TÈI~ÌWÛdÂB Ôe¶B jÌPÚ´A+œ9øäurzZ+ý¤i$n¨©C 憺\)8h!“ œ¯¹n5מáêc: ÷\Ðf¤Ã›ªŠlþZHL@šôÇN$0׉„‰PJèçᶄ •µƒ”°”ðWâ^!¹~.NF Mñ.Jæ Ý}¢2|òzXU;ûÄŸ® ¨êàT¿ÇYïiê¯(LôŠÈŽˆ RU•Ü$¶¶RxvLVŽ¿‹±0žc…° £¥ì™‘½?TMKñ[áÅèJ$>óp¯Ô¢˜Ø=úJŒ‘­ävUŸÝ±Ù±)î^–‚87nWÆ[íO¬9rí|WsaBv¢•*u£˜SRß@Qz¬wtNx”üNô²zaÊ?v;EgŤÆYÛh~/ÊÊðºELNÔ0Ä?9'0Ð3úÚ•&)—˜–‚s\xZVÈ7Š e“ ùo’žþ¹­c×o 4¥'GÙ˜Éo&Œ~ gb^|f†Ÿ·™0‰ ŒAugs7[a1<·ˆ4% Ò\[ú{y"ÚÊáå¤ÀWñ]©i—oß>V_W¢£LžÏ)U›‰»<*ÎŽ4G+¨Ùïm?w¯ÕSCr³a“„¾ªû¾ˆôŒ€`”¹¬„mWÿHFPTÊž¤HC#%Pà›Å¤%våÄfìv¦Ájäi3½€ÔÈô¼èø0-uI~§˜¾¡ˆù¤¬ P'¼y‰Á&Ia“=A©ùq)±†*ß‹8E1&aɹQq!ê*T(6qCãÀs÷ÈÀäÌÀ { hx/-¨VØ{é·ƒÍÕɉA:ÚRÜ¢òDüøÌÂÈP, Ù³ç’P§Ùdž&§zy;ëú{)Ê9ÅMÜ$¥©›…¤„ }LmUÿO ¨MY™]‘†úNÁ©±IŽ¶zØ )æÔÐßP[—™•B¥°¸q“èNQƒPÿ¬ÎþKÇjJ}£Btv’7ˆ8$õ9q¬9½ ¾ºÿXcŽ)¯(q Þ7ò@GyyѾüÆêÖ kÎÅ®aš ~LNß±öú’äÊÑ‹/iðVÜ$¨¢YUÙ\—‘Wœs ·,ÛFGÜJv°‹®¸üKSQX¨Ÿž®ìfQUíàÊô‚شêºþS^ ÅÞÕ}Y* §¨Ê®s¿t„¨l…¶õé(‡u5”ûó bà?¼")dRtö—«ƒ¹)¾;åH‹Ò†ÛLØå^~¢³|÷6ìf¼YÄ¥›)Ú[…4ôê«›jRrKòšz öoÇH‹Ùôß|2V[^’V=ØÞ–e©Iæ„ã·¯kìz‰‹& Þw/)fQZ”™ŸRÑÛ?”¬AÂ-P{áüHkNP|QIGozˆÊßEX8 6‰J‹Xµ;\]\Ÿ_•e!@·LÊï>P]’}àÐhœ"÷56´ùòùÁ¦¬Àø’²Îî$?ÅoEh<ÊÏ>ú¹¹$3(h÷N·ˆŒ˜Í¾ÐÌC'Ϧï¤@¶§Õ5¯fh°²¢$«ùôåÛ{ )ëqÍê= ¤6ó+*Å ´TXmÇriø4Þ¾p¤+73=25Ãk·NÊØ> ÔT^lVS÷ÑŽPs¥ï‰òöñqNŸ9ß›çîkK ’¸ä°NQQõ§Ç:³¬•‰°™ %aUÝv¨3?¿¢¸m¤.Ï_ŠBÙ¦žØ}åþ`yÂîèÚÁóá¦Jÿ'ÌjÎHÂÄ44»lèÒÑ‘¦Øˆ0k+åoD¤p ݇:rs+K;F«3½)$Ü)qÓô£Ïot—ç„ŦD¤+ËR7/ŠSÌ)¨q°¥©"µ¬£­§ÊËà’ðe« üöû'Šw«ü]J­ˆQÖðõ›]Å qMcWº}µe¹yå´³º›+Tõvû• Ôï–Ôì¹ui´½ýÐé£#åMC-UA"¢ÒÒÎi%E±ie%íñÎX<î[iGŸêãC­…ÑiEÙÑd ñª•Ž{ZFÏOgŽW†DÅ:;ëñŽq ®é¨¬*NÌ;PÙVä ·Iϱ,½ñû…îÚ}É){3RÍÕý|''*ÿe"úÕöOX‚‚:mwXXá‘Áá†ä²¡Ñ#q1•©ûkóªÿµ—²2 )AR¸õ"–áMGG‚d¥w’+ÛîÓ’#Ás»D™¨®–ŠuiÈ‹²YLI?íéõ&OŠ‚2ŸŒ:YúaË5ŠÜØo©žQ-Gó(ëøá?^Œ‹«½Ðë®Ç/©Ì/£ü½8Ë œ¼â[UºJw™b×ïÀlÄ®qL8ÞSêN¢)Ëù¶t „HS(ü®ÇOæÚ[‘tËt–¸þÈåšÕ&q}ÝØ¡ƒƒiŠTêû¿¹Öà%·U!¶üÈpþ¾Ý²ê&*Þõí#¥Æª—â°Û×;˜à­ÿ¯ÄÂfQ)e )-}¬²¹uÁù#õኲ* ^Uí½¤¸Ä¤®´CàÖQ‡ Å …”-ŸÐVýÆ¡áduòWÛ¡©üEÙ„,)÷ò“îÛy±›ÄU :ïm°Ø¡–Úx²?m¯“”º¹fH{ß`–²,MÌvôÆåLsM¹ʅƵŽ–ÅmåƒÞ–¶™Zv¥Ô†·0ùšYÏŒ¤ª/iSzô‰€šs£EáÚß +«Æ ´UÙðcñ‹Ëü[’¹Wó¥üXÊV¼šÄN™¿,²Gz[¢e)’ÛÕBó.È÷”Ûˆ i¼8’ ñÂjÚû‡[‹Í¶Kà¹DþGØïÀϽ>Ær›yä"þN!ýÀéTE ·0–›èâ_yX8‚Þ¡òô£žRMç!Hmêo)§CÊ»ùþµž(%*}‡“ú#/®i)©©'¡b0|÷h–0´I²°kÍ?¬è:^Ä=Tܹª®1džÔfœ¹mÞÏÝE6"i‹Š†á†`{åíª‰ç.æØSþò£‚ÃÀí‘D3^ óßëaLÑb×ñk™'ugx ó‰®ãÃo&غ•þÒ’iΓ–°«kªñ±’ÝÈ+%n–qü·#ÉnŠß¾ÁÉ|/AZÔ p[õëþ\j§'÷ÉÞ½òX[¾ùß…q\‚âÿû½vèùûU¿ƒþ½´¨qvÿùc f¤¿ò¨z¹;¡óòÚY½==õ% #mUa²’ÄõÛ¨š=º’œíAíT%:¸¤WtU*aqÿ”5“Ò1À«˜èEìL7W§mÓˆ,>~¡ÒOk;EIDIí{Q´Ši‡‚ìÞö†rÛ¿ñ‰¬çÃs ·9tŸ8WìlcBÒòö*:º´aŒeñí7—ÊœÅðÄMâ2ßc©ß|âövTþ‹E @ê“,)çÝŽû»j+Ý2Ú›b B mÌ_8Aw;s «À²ÂBK,6ˆXíiê+N°à$ó&É4Q¥Às’Šñ=m•‘êÒ$.hgUÔö@ïØá†úêÄDeU¹­K-J&ý ë×~,ßJ_S'fëV>Ú××VP˜æælȇc9‘Dä$üC3rO…›e³²pÂ1©¯/3D÷ŸTÛ¢ªÁh%iùÒÛ¿Þ9l†ö¾ƒGVú0­[@ö¶|C°u,:ÚUêð÷X.Qݨ›W=åxl†/ß8{|´½w¨cðØÈÁ*)naÜFqç”þ‘$Óíp-lÁh(ùÖÕöìêè¿ôôÞHŒº²)U,–KLXRí!ªßBóA:*á]sî>Ćù‡iËÈhš‘® ëE#ø-¤]¤<èj¿wæ€nwÏ©WOŒ´÷ u .R—£‰Ùõöz“I8nŒ]ÎÁæOh’…üwɈÊ_J]µ$¡Ò"R‚za{«†º‡;†Žž~tºÒ_žã_uº-ÌFa«€œTHGsƒ‹0¿01”ïd| Ü.0Ã|EÿÃa¸ÍïšCµ6ßóඌ¬[.tghnÆןm0—ýF@A~oOK„<ì:lPÓåþ@ •¿ÓW‰œ¶C-»ñtª©"Tß·ò‘û;r÷êmÙAúAÁ/ïr_”u@ꀇ¡ô%RÖÛ$pœÂš~­·:Ãy%?NJúÙÜ<¡½e`´³w`äîó ®âD2¿4Ö«¾©-Gad<”Jð¨mhʱS&q·R=‚š¥ú[ »U6:½»'5ÔXP%îÀÑCî2bÝAPi¸q¢ÀNÏrMKÔÀ6 XÙXQh>ëoÒQGb\å¿Æ|»s_~_g‚Ÿæ&) óÔÁŸË­¤\KlCàæÃñŽ?¼‡JìSÛ¹w°¯-H€[˜°~‡aÄOG v«}'¹ˆÅL2ZtÙQÅ×ñ’tïK3þAHA;côü¯Oï\»Ô•jö?n#M«÷ÔäÎòŒp#³Ø¢î]²$ξ¸´s¤³°çÔƒ;'ò $¿![;;Ø^P\àëf¸C™vTUŠíj®rúQÿ 5ïæ“ûgú@'í;|¸¾¤„È?¨§ÖŽwRØÌ'!0z¨+^SEMγ²½7[ ‡å×ò¾È€”¶RXgC…¿ )äå¥?˜¶ 3 %Ì RD¤p[ðFçn§i 8µË2T§ròÑÓÆ%"+a7xxÀ—2ÎnWþÁÆ×m|LÒÂmÂÛ9ç´WšDàÆûŸ¿x H~£„Õ©¶P…oH5º CŠü´göÁ;åöÄuô͸Md÷ÀªƒuÙ?òá¾!™:uoOQÛ u¦ÉÏ @j'¤0Ìšû[ŠTfH}#–Ð6Xkô-ùŸJÁ¥W!H­Ç†7œ?ài ¥ªž8Ô^A‡”ëõº#q\’²¢¶ ‡Nu»ê×ÿˆ•/½z®ÎM‚Cʳ¾±-†ÔÜ2y"|Cqóo8‘¬òwÜßb³zº’ ù!Ht“ûjq5"|+鳧õX¢ûÎoE°ÿ§œ\8Ðë­ÎÍ#…1Oíý©Ä„LXbá+‘›»Íûй±(i*H¤ºJìPo³¯3¤Tç •Þr¤Ó‚Y@*†TVßðhIp|m߉N?ÚÆísÚßC*®¨«ÑDÍ;®óRI¸ö?D0Û-êZú œ ¥8ø ›%vJúæ¿?y2LKv+ )Ř®¦ª] HÒNos›{Ÿ ¼Re3©ùƲ߈ xúÞŠ»æ.>æöðÿ³÷ÐU[¢ö¿Öÿfn0ŠG‰ @ xrÎAG9çœsN(ç,!!¡œÊ9çœA 26cclŒmì›çÎÌ›™uÿõæïê>GY 0¾÷ÍÌ]«ë¨é®®®ôÕÞµkï÷†”Þ$¡l¥ÆÃ=½´¯5!ÂPA+Är¿ ú;@ è=.2…yÓ#íi†lÊ xÿÂÄ›k ­ˆ7±Ìß\èÎ5ãѱø…-Í”¸Ñ¹c7k½éÿp‘¤0‚•ÐÙZÆUÖɪ_/df*Ì@¡égŒÓ ¦fsù(`ƒM9RÚ¬óÎc7?i q3½È4¥ÚxØè£ösŠ"X'/,TÐÈŠÆwþ÷ƒ—ôäXñUk›=Ua,ÎE¡‹‘» ØGí†4ã]´mYï³áa?Â:u<¹^`n¨Ç lÝèö3 )èåLÿþÙH2)SaÌØÔd¥1)‡GŒÙH'mz–nõDxÈk!æg‡BêÞ|o"koš<öä IVlinFÛíkWü(\]u}wwësdÑgýûWá®æX‹+µsË5ÉfÐÔ' ¡™Öö´9Є)¡I–e„Æ´®ÔxVej¸4ÝþãÇÝ$u,H1h¶-ß¼XÈäñ…Ê<=[£34×’Åå¥J#‚séèËÅ>ü””·C ¶“T§Ÿ5¨¸{Õ^HŽÁÉž¡kó£9ú:f¸™ç¿™ÉpàžÀ„7ÜŸ¹¬§Hóí~p³ï ¤ n©G \[.cb´>¢†•ÞþñÅp$IÉjòpÁ=£ó•¦º"3QÐÕé¤Ðî¾Áj]ʯԩ²$;§Òg›#—Ø|cnØèÌJw”‹ÞÓ‚÷TŠ³OÝ‹ž0×D;zza¹-Øž+¡!x+¤Ph*ÊðÚÚà >fêz1Ycw†Êl:éÎZ§~¼Q¬¯"ù Iê ¤¬kfFZ£xº.Õ7n­$Ð<‹rµJ+°£Kj™ZÞûâNS€½¶"Õ‚ïà„¡3åX—†ÿøU»—ž(Œ‘ mfz4“F#K·¨ŒS6}›ŸõÆø˜«2IV>FvrÐ ú;¤þ›@êøž¥ØèCAÊ”èß2»”dÕÚÖ]êeÍ”Ð8xNjR&f)?_ðÆÂ:óÉŸ^í¸ê©ai:WuÞop7a4kZýì«ïþü—ÿïßÿéÇ—÷§;ÂUqBƒÄ…Íç¯_~ûý—%‡X)ãèû´Pn’ÔÐŒ®ÛŸ¿þã¿üåÿüÛo_~ö ÅÅŠ-G‰+[{öìåë—_<Ó‘ÈåÒ=DVãd{û‚ÛŸÿðêÅ·7ª½R„àªõÕú ;4—Ð1´YhªË#88,Üúâ»o¾ÿþ齑¼(#”ÖHa§…A—Úîúü³Û7–6ÿõÕL‚±"†§åTÔ¸ôìËï_õÕÓÅî02‹4ö¤°šë·ªSÜTa1PæèQùñÓ_ܽ37r÷Ç—E6Æ,EAh\ÿg/_=]Ÿííÿñå|¦)û8–ŠarÑü«×?¼\oöÂPájd¯˜ÞG_|÷›/n ¦¹²%÷Ÿ0¥É3ƒ£ú~ÿŸùç¾õéý霳Sh† Z@ð¨ê¼þü«ï_¿øòã©&?-š6ÙùÉ÷÷6½xñý“éÖ86‹yJ'¥föÅóWüÿüß¿ÿá›ç· >µý÷¾þìéƒå…Ñ¡¯ŸŽ¥éI’“‡žÌeûé+iéjg.ÎMFàB .¿²nXÚèç/¾ÿñ»o—zchŒ3ÑiŸ~ýú‡ï¾ùd¼ÚGMùˆš1ñÙTŠ‡)ƒË«s#Aðù×Ô´™—é^&g@½qÏçu¬¿|ñÝ¿üå?ÿù7ßõÙ:Ä>îE‹ô’ù¯^~ûåëóSŸNe9ñe4 ôs–î}ùå½ë‹wŸoöù\²Lû~<ÕI])öAXÊðóç_>»µ>ÔóìÏߎE™,HÎ=%ŒÉ›xùêûo?¾^á®C—Ö¹:zÿ‹—ø¿üÇ¿þþÕ“ëÉxåŒaVÕÊWß|û÷/VªÒÝ4Hu««“ï\~y‘a6ùúÓvì‘r ¨]ëkN¡H1¡*:oz¹éúËWPnÏK’œU 4iŒ6Õ³zãË.wö¡+?±V–——ï~ùúõ÷_lŽ_6×g¡hn~å÷?{ùúÏÿùþí÷?|û¤çR€ űvîþb@Êqó·ŸÔ¹œÃèÙ7­Ì÷'jsXÊúIÅK/†2-]6>Ìtu©Xì¯Ïvõ(êZ™pâêé§^ðü‹‡Ö&o|õìNK¨“ð¬Ntáü—Ï¿}ýêÕ×·G“˜46,är/š_¾¶ùú»ï^ފ᳡ﲶ̚¾ñìÛ—ßÿÙéâ3y)¯þßþ©ÝUçïúo©"C}@H™ã øgi\E’@™ÆS"P¥´Ž€ÜýÉ:èð)°fŸ¦ •©lyþY&ÿ$ú!¼È5Pç¨ñ õ/0¸Ðÿ*’…*lCè¢*Kp’ÀDªëÃq•úðSð³áI"ô*”!G÷ô"ÜÑg¬°,P6ðj½sDh(qÎ0ÀÙ%(gy¢à,ƒ[í2åIÚ*l¿* >¡•{иš¥DÕ¹È1¸ÈžƒÞKï ]*‰Gï<#œ3Âq”:Êd¶¼xs*ÃE®¡*GxŽ¡wÎS¬Ø'iºÐƒ™‚3,Ýsp‘ÀÍxÎ)(CžÁE:œ¸È:I«±u«ã3ç ©"}(78sP~ª:•TZÔ:Ly¢ð¡Ü¢ÜNE DÞy–@é“9Jü¥ê\ÐÙÄM”Vg¨ÎÕ9Cb+øç˜Â“8Ä”*8/ Džƒ†³ø[ÎSXJ ¨×‰Ê¦Dä)3´¡·Ë“„8 {@5©Â£êgú A¹úç©¢C `tà¹gp1¹ ] :!jŸ¢3ˆáŽ}–­–Àü¯ã‘éï0}³Ïíâ#eŸGîŸt˜qM/+Š¯q(¤DïBnÛÑ¥oÿÀÐe0°r$ÔÎUç¡žÇD{(ÌaΫwŒÃßÜÿw½Eô C|,”±Ë6ã1vⳈsEÛ$¨ßîâNÊjìKûï‘E»Šþ~”ௗ¶=¼=íí´G‡äøpŃºÍiO‡Ô²Ì’Šä´h}=ÖRAü½ÅÕâˆ7§©ø[Ô{}ѱƒˆýw¨ñV7¡ˆÞï=Ò¾þ¶;¾ öço¯Ý|H´õ÷Ô´õÔ¶#©»ºuax¦½¼éPH0¬»c Ë¨Ñe.2dw]Zewðt„SÇrå*ûa\qËÿêñ^ô¡$ßwtµ)ëðE¦hõ¾'F*}×?tÊbüd_ß«‚*¥A†=Q¤Ñý©ïç$Å~é!uïŸû6²“vgrt‹kÑ.ó‘_úA+ W÷_ôîú+ˆ]cÓ¼k¬ “Á¥Ð Á;™É¾¸c»!E–Òx×æ Kk)è æçßã0okic¤}`”CP”}@„] ô;Âú`CÙO œÒ•Ö$žP£"¦§°‰]V!«ÊD]d¢.ÀI•.£²?ô1 µâ¯!‚u†kŠæÂ%o¼S¬§e`O7µÂq¹ò?GÌÁfŸå›¡9‚“ø¿ÂB ‰kÉ’ÇïNL^[CÇ蕽û¢nwà‰£Â•ç÷o b¾÷KQXŽŠ®™&“«ðAZßVr²ɺšBãs„ýê>y¼à‚À\“Îz y¢PM×–nfKð‘2Ëf¢Üò4sª©=ÝØH…Ê‘Ã0÷¶øQé -þ<Í6Öä”v Y ªÝΗž¤êki*ã?³°q‡uì/ÚýQïn›½'}ÀÐr"m< GGavgþ®%$I¡‘D”DÃþ• TdI£ Å”;ÔáŒ(1v’h§ÀQ°‚ö—*w×·ÞR™ÁIȶG…o®ÅÕUf˜´¨ýÎWá _²ÖÜ•oã.´‡’ÏÂøf u‘){)£’,)ÌûA l‚¯¿½wbÊh ¯ _+c³¡!|Äm HBŠwËÀ棷§k“ÌNᙶòxþ¡QG 6¦‘—2¤5…Öµ×r}Ht–îç­`vR¹$(Ñk}qzâOÞ¾q±{Ô–âQÍM˜:êzV8>OnûKæÏÛ‚‹¶$ìò¿Óã8†¤ºYðäTE„Åyó'—„®Äsàëž$°`ÛÚ¦ sq›K–Ú]0hJgø„5ÎWò$ÐïRK`rãiÚ×­>¼õ`£¿Ðá< ôœÓì€KͳW} Ürú)»–©›Ÿõb6#Êö¤&CîXÝc›SŒó9s ̸V­ "¬hþ?%tâi+â/ÕeøT÷N·Ø0¨ÒXæÏÖÖLJÔînü®ñµáG0ÐÌO’Ò"I‚DÔ"K£?,¡h2X¿”ô"ªô; zTD†Bʉ•Ç…$z¼RÛ1ÖA’Þ“¨»~#µúHýBåλC*+$LšàY?\ZbŸ01TçyM=`˜ÍºhšÒòõþûÏî?~úðÉ£å©DCŠ!s!©%¦ŒR»Ê 4„¶8œåö]g¨RÖ±„ü¡#Y`³qÎQ®6êÄ´ Z%ŠìPõp¸Üä$09¬$xÖO¯ä nžM+CJZ´—¢9$¯'³ dÖaß×!Ÿ¨±*8R ]wÇS¼õOáwòß%|1öê‹vÇ>RÐ)ÐÂæ¯Ù£4è¢oßßðÍKß÷^”¸nÁS&JLPGÄD;"sð¥2ZÚ܈8+3HÖ>¼&®^ùýÒ“÷üw[ñ$&|,^€µ+Þ\ à‘$1{ÚTdÊ÷I°2æÈ`™‡}ûQK)† ÎÜ<åúÒˆš¼c—¢H1×ö‰³0b#€Ã~EJ¼Ü7žçp ÔÛ{2Öèp‹ï·RE³´ìÂíÜl5)LñX¦2ë~øÓFàŽuÙþMã«= ŠöMõ¯©=ÂÔ»C šó)24j 9MV¤X£ƒœØŸ)ˆ&PžD ©ÃPd°d1ï A"I *…!H ©Ç¦Þ ©=‚Äû8p|:4côöŸ R2êè_cSëê"}}ŠFsýh¿T£iĺ`šT{ûq²‘"Q[™&8ì®)’X˘֖þ±º²$!‡%©AŠ«e–—”\S? M†—G^O×èPeq‹Ç‚k^@w¿‘šÓÚ6:R–cäœsµºf¸¿(+/¡n $݇Àd+ ¼¼ {ÚFgûzëC\u¥5(§­.tll}ñýWŸoMLVgÚ©Q˜ŠôаÎéîᮌ k5²hT`ûUŒOŽ”åúà™,i¬Í%%¾¸2± ¯s´?+ÂL^óÐ š:ôhÞ•Uý“ÝÅNz ÐZéê“ß~¥jt¦¥ú“Ç–Ñdìy‡@*¾ëÞbÕÕê²îñÚŠX¾˜¯£ð¬€šÚ‰Ž¶'[my†‡S\¶¹S¬P“ Í‹Œ´U!‹Ù C=çRY3xûÁ×ß~þxc`t¤(Úà$$}ã Ùuu“­yö6£„”óœ~hhùhÏØX]yË’&ûD^M1ÑçÊc…dßü¨h«3Dš,ÁTÙÔ<<Ó;ÜjwÃÑt©ª½±õÍo_~º2<7u5ØB…H—"ZêEÔ5 M¶]»lgÆ‘Pebk Ë:Z+¢³®¦×¶¦E™@eS±¼Z02ÓÙ[îdpšˆè?¹*FÑIÍSÃ3SÍu ôvº4Ö˜X^10ÕÑUæå R£ NäqH´ ²¤UžåëU69ûøÿòãý™…•öÒx#!’z†¶nçÇ”WMWçyªY²ZtMïÂÜùŽ–Ê`[XBƒ:䩘¤f4õM •—Ä°x‡(fåð<5ÃØ‚Á×?ùñëÏ×FgFªSm”±Lt@Iáà\{s™¿•87< ÅN/šÈA ¦ÞÈ0¾µelªµ%ÓÌT(‡Þ+aàv–—r]-OÁ£Ì…™9.gñ.Î “]£—\!4¡0,e½˜è†éùÏÿù__oÏ-·ä³9º ¿ÆñͥܤƆÑñ«Ég0,¹m¶þÜ:œé»uï)Œ$R )@êAƒ5?A½K†ùCâA ¡Šñ¸™ %„ 3Ž(6¤€0%©÷É·‡f{+¤ÀÆßc9Q‚~Óÿ: Œa±Š6}õû?þùŸ~÷›üó¿ýé›]…fRjô½–´R5·´…SÿŸS˜_œÇþJ•økU›¢™¥•ÎÔÄÜìÎ{7ÆÃÉP©T8TÏ‘ûß>Ñœåèhé¡ÍÖ3ÊúäÁJ]XDR\Óælž• öŽ¾'@ªzÈÈÜÅk-ã뎷4VŒ‡»P¥ˆY­wWZÊÒòFf7&SÜ8Àųã›{õqRDeXœµµ9Õ6£zùve¼cDÙÀ‹;MáЄsPcM†:ª†žá·ç›bµ¹ æ‚<Õ7wüŸ~ܺje•Ôyg¸$‚Ag*ÑM¨©ùýzÊÜyÖv$>GJËÚ¿cuy¾>&µ¨|òþì57M0!뙦\ÿì‡Ç}•)ö¾¶¾Î  :"ÒGžÿq±®vty³+ØÍ‚d“\Uí=rïÛ©H}®ÝŒb—Ðw}ª'oî@Ó§Tä z†>ñ3f+‚éLPxEšcHç7ŸÍ_õ­î¹õ¸/Ç M12NöÝÍúì“°Î;ßM†ër`¹`÷7Bð娚·Ì:]’U¹¼¼ØâkÊRäǶlýéËÙL}«äò¥GÝinZ†,¼`vÝ‘¤ú>ùüÁzs\f͵…»ƒE–ç\´}÷ʧã…ÑÕkK3un–¾—šVJcyò`›’z⢑÷ÔJG–£yGu‰ÂO¨Qä »œ+“k½ ‘S<‚ûÈõÇý™Éñ7–§ªœôé`Á¿O¦ÃRO%çOÜ_)ò‹HŽÈÏõvåIÑ3G D9h+ Œ ÇÚ½/’˜X×ÁÅ­ž”¸h×Ø<¿ou I–bÎtŽO_|4w-cáDáñä°ºúi}s[“%¹‰Í·>¹SlHd»ž~z½«fàöã»Óµ ccS5ÚTŠj¬! .xp»3Îä4† MAgø¾ñc_ÜìN³õMˆ­(ÔåñåÐ:©½c˃yé ÁWFçnV:éQ%´àˆhŠ„:ˆbAWCßÚ²æ‹×w¯Ø¸¸3 ŒT(|´MÙÊ×?Þž(öKê½ýúãJO£38ÆI¶9Ý)·|æaÏ%¾¼„–Åf.oôÕ§¹†$e¤éè )–ÕhUswn0ÒÀÚêH Xæ)®%Óµ jî^[_¬<Ü )(+‚¡Iæƒ{« á‰1 7æ/Û²ev¶«€YœµOåBsq‰@‘Ô¢Jc„‚„‡íŽÊÁ}·Àö[ m)†<–,–¥H1ÄÛ;u}÷››†6NT_ /¤û´ÝûáåRO~@úijºžnÆ’ÒŽ8eÌ„”,ZÌ í$»~0Å÷À³åq!…ÜF–Ê=¨ðR°e)¨BÈ×?ag ‹ˆQˆ‚Ž(…ÁKhÁA"Þ!Ø«¯ ïFa`¯ Ðo- ¼9…Sûê>i̓éà‡ÿl’T"M‰ïá˜6ÖÓ_”Ù30Vèï@reÑŒý2N¬ö—?}ûìÁ㧞ÝêJ69¥^3¿Z›ítNƒ§nYÙq³ÝÃŒ#¥" ¸Mnm6ÙóAÀk ó” ­tö~I¼Û̆åÛ>¾6’j¦¸'&;€”FØðÀ@y`@æÕ‰ hõïS±žĹà¿|{3G‡M•Á{µÝ«sS‚†?Å£ãû?Ü,tP!B}ž­D±5ÏZX_®±1·¥™9šW>z¼‰C“bwévà#Òš˺ՉF1¤h~Ùc¿ӑѤc§ûò,õØ`Dõ «ßªN'‘Q’ŒÞÕÛs¹‘–gqBZHÏØõ#=ºVÏ4}ëÑÒUÐtáthacCCáxAbÏ×ÁV‘µ«cIÁ–çIºšúvtS–MXÞӧÉ&J`1éìZ;×]㦨‰hVfLJ]Ç¥gs–sÞ¼¼s+ÚšØ٬̛w—¯˜™Xš%¯¬68ñhrt׌§Ÿt†ê+ì]š‚ÅÁˆŸyom,œBg$_žZiʶ9ÍŽiÜxÕæËøµ:[·üÁZ[4‡ÍB¶hÁ:‡Ä¦¤ 'ô<\©‡Ødb’»0Þã¯Å47¾òp¹?€@£ŸÖμ:½X•êo›·ÚsÅLE˜˜ÛNeVßžÈð5>³=ù AÌéòÔè®ÉÚ|p6Ät°w¨x4}ÍEHW6¸\=?W–`*³[…¸µG Òú§ë|,yò8¶™w’@“ gŽ/è°ƒÙ‚ÅQ)#híÖrŽ•µ‰GG™I÷À‚K‘ãâ7rk ÐPFš(ÒŒð´¾ë}õ¡X[Å8±ôîÒe?¡N×ý¹ª§Œ¡Þª@·ôšéiG.î„:îÿ=c}óVg¼¹2X ²Îë^*]ÿr"ÕF•£wÁWÄSQ¼Ä‚Ñõ¾†x=S{ŽkVÞèze’àR új2âÎÔ'¯•õé7ë1ÌfxÆ®lúþÝB–„–žïêËbU šO²‚’ïwE‰ %Cˆo|0[ï„è«0à£ÍG©ûˆ66Y6ç-:¬Š<Í Ï¹Óz(¤à!)L¹2u¿"ÙƒknÃòn]K7WÒdîšÓ€Ë_~ÊtS¶­E``^™‡¹•cÁÝöl]E]Zƒgtuq¢5†2URh•_¿èuJ“øë‹„ZB¦ëÊ™X3ºÚøÒã¯gSå5‰N1?¬º‚2[nwリò]zéãC ¹‡†Ìùˆôv‹ 9E Ä\ S˜÷2rËP0¡€$ Ä‚„bù@{»˜J°½„”ÈÐ"AR )Þ[z,uŸX¿§½'õPØŸRiAyþ^‰¥Wzn.ÍvÞX_iOŠq½ˆC¨î…”IRݽç³%~lK7…KS4­è^™È1•=ÃPd^ŸŠvåK«¨cã½f,ª„8ðrÖ´²óþ“™±¾ºŽžÚΑ®r7'#%ô!êî¸âã•”3¸”í`ã^zãr˜6õò[Ó—ˆš´–¥yáêl_´*ÔCHß¾lváIƒU+EqsoxòüÓùú–nèu=ƒUe^jX²¤IB,©Iƒ œÁªC+ `œ`U·2Ѽ ùªÊ“)­‰× ™η2`H@¥{‡×oÕ¤ð€¹†xÒ±cþVo˜‡ž‚&[Õ±¦sµÓÅŒ†Âé™gܘnŠ0‹Z@íí @s£Ÿµx–¯Œ§…»².— / 4tÍ|ûl:×â$Ø“rq«ë©qWBÓ·¥) ]×Þ›¤PXž†K×ôf¯)‡­ßÎûMÝÚjtµµ³Hꛘ*5 Qå¨Ö‘>Š7RÂïƒSždiÕø`ªÑU•@“§Gu®õUù©²/Õ­>ͱ€& «èîF_‚€Íœ $D¯È~ Mþ1¾óÎXŠ—P^]›“89<‚çÚ»´Ý®rTÁ“Qôˆ„ÞÕö«A¼à±±ÞX~ÈÜWŸVzG5ÏoÕ;[0¬ýÂ2i¡1ÝSu—mQšdIu¢ Õ+ ÷NÇe œ5:­¡1ßAAtP .H"ê„_©›¸\šJˆ ¸0¸H>AÏ~ØfÃ’RÕÑÉ™iƒ E=­—Ò:Õ34ÒÒÝbwC€Þ«Èqõ½ÙYGâ"ô NŠ“ret¹!ßé”*Y–î6z£.^O§íöØoëäîk­¥¶ •Ó žܯÕpÿxÞ<îöVW¢Í¼¿C53H옜ì­-¿ÄdÑO›7¬?½»>RÛÒ]ÛÑ­·Ùßk°2ZäÔˆp´b°Æ0YŸ¾Úˆ!29râ=©‘Í¥`>ñ×ê ‹©¯¶j<5¨@j>ÅN¼ß-† kižÝÛ96Ñ9Ô_Rðä“>ÀÀ!ÙÚfo 6Ùªlwë /"óHçÆÚC‚fu‹’–{OçÆ¡!ÙUÝ>ÔÑWîêd  ¹=«ˆ‚œwïè¬Ïꟛk-I¿T5ÌAxµøÆW—ÄB6¡¨Œ*)e,Uj/´Ë¿ibµ×‰A–@óÜî¼\/°>µ ö«ûdш4±Ý‘óP»ÈmÏ¥ ñi—ãJRr@†lHA(!ÃG! NA´Ø”MóŽ;\;Z>’Ô¡(ˆÍƒ40Ï8¾a*byqz*ê¶~’(%âÝ[³z»ºœÙAT|¼óÉhíÞÓÿ™ •P—R5»þâÑüÄÂ'O6Vº³3‚´°TÙýr¬îÛú¸;V[‰3…!Êê¶.Ï\²’WfžÑ»\³6êÀ… EóîÊ7¤‰ uJÿJóêR„OÏR loë¿Rö6¥7 Ãø¸„Í;ËIL:…wp®º>Õ  ¡çÞñêë¡<šÓˆRGÇ’õ•‘--š­€lÊÀƜФMn`9AJíH ¿¨ð`Éh4ÃgfF®ØC’s¤°D9‹ÆÉÛ£q¾Šš-÷¦þk#: ©±ºX.)°K.‚F ©Š•±ŒØøàÒÕÅ‘L.‹«DµI|ú|.O)w I¹+BeF¦—½‚$©‹¶Íã7g`GU+réÎf¥…µ9©ÉR}¤ž)†ÑÌ°ôáB§&‰¦ÈŒH\ë¼êvŽ]¿ú4 ‚”¦R|ö®Ü©´ðÿˆ‹ëØNôȪòY “Ãý!8Ž•MÕé&W5Yž›9²Òœï¦a^=²:ײ0YU›1öèÞX¢@›#{¤€$e‡Ò’"»z6?(³8¥E”ç&LÎW§›KªWð²h4‰!óÀGjºæ9£³Sù&lˆªÈÑ6ê jêà£þKŽ|9-c³‚¥‰v/R2šD²9Ó1&¢ruv²ÂŽOø¥ ©á}º’êðJ˜›Ý¿ÖvÕóœÅôOZ¹^¥¯×~{¬ÀÃ2©ûZK™' )/þ„&á)Iª+ÁJ…:’,š"¥ÅR1ð0 ­™üê“:½sú¹Õ3³•¶gÐ x¨S%Ä:¡N¹kVÙtöãoÖc »  'ø¤Ô™ÓRš!…(ĈzSëèæîµÕ«a‚Ÿ )Vê•AH’²?Ž±0• ók—–c\¸`(ƒ†O”h"‹:ÄždAvýèDÓäl{uiýÊÚµÎ*[ÖáÂQé•_¿^ô¿@ KAùhH‰ '0|R–'¡ˆXý~`Ijÿ¶ô з€u‚”&¼LÕØãñ¼ñ6¬ˆe. IR êÆb{‘`‚0¢L+ô;º°}ƒ*Þ‡‚ ½dNz? ZÇ×F‚f‚5@ ûP <ðŸšû¨° Æ2|»ºOD(ÍC9µ~Và –<3£~µÜÅ+·²·9&Äø$6{;ĺ/¹îöãžXíêˆ[Š$Ñ3ºky¤'×ÆÆ×%{fa-߀˒VнÆGº/Á‚&Ù=¤ùÙrwº¥#Çá’O¤S—'{`OJ#|¤§³È×;9wh9ÛÁÖ£l³(’ÆìÚìÃþ”p/¯’º™åªxCYˆ;X÷Îo¿®¶çÉ‚…7Z¶Ñý‡¯/Æx°Ì]B½| Ðà<4îNì‚”4^G…eéÑvc¾#ÕÂØ@…ÎQ úåŒ~]é ¥1;;VloÊk`ºwDÃíÚTR8àü6f­¯1ÑÌ1$¸zu~,šÎ‚Vez™×ÇëcyÛ ëï„ Õôy«—a`åêxFl\àÕÅ©¾T6×æÓxãO_Ί eg]8?9£«g¨\¢±È:*L› ‘»óq†PÙx§ùQ3_Žû³ÌÂ?^ºÃ♚%÷OB’@*êã§Ã û!oL ñ¾3ë[užÆáí}‹£é¾zJÜ؆µÏ²aH±‹ïßèOÐÞÔ¶Â/ qwG’<´QªNÒÔèP(–!¤…,nlVx»»›Dv- $x¹—ê·¾¿}»ÆÞ¾±çÅ6K¼pT†ÌaR ø4, ¶$rµõÎÉR8Cí¸õµËŽNñƒc ÝQŽ¬_÷t¨ >RC¢¨O¨’U¯6.ÌVçxsÌ\õ=ü„&\Il`ñõ™²D;Œ~djÿ£›ý¤Xªº¾V¾n #W«¤ñ‰±*'ájT9º½CÃÝÕÞ šŽ‰)ƒ·u»:3=SíãæfÓ5û¨Óß«Û}w¢‚TOKk™§]bÕÌ¢·6YŽ"T&»¤Ý¹7˜åBàjŸ!sNRLõ¼Cõ,ÌÐF‰m7œ$9ùTÍLŒWû{:³í‚#9:”mHIjPe·-ô°Äs¡ëÏ×»9Ø`8Ú§‰Œ]ÉèÍ¥@R3_ß©õÔ ñ”X“¸¼ÉO†SÍϳt”É,ÁÖ2,HÏÊ–îW=½RùFHå\j†!šž§Ì4À™%M?ìM¹^ é²”À„öåκCc3uKžæP÷t¥7ÃÒÎeáæI0%@šM½çš8psëéHlTtÆÆï>™OÑãAK m–™SíÆBïe3O†”fòƒï[˜™©Q¡ÉA‡éß<¹Öëˆ@êîË3-IJz÷†Ñ‡…Ô6^wsj7v ©mBÁ>lq' d"¬Cƒ ­I{oZÇÜ™Úmm()‘ŠŸ½%ÁVyPþȆÔñrƒÅ1XaåƒØKáÌ0%­õ“Õ}owŠ¾]?מ”œAqCG„¶oQ~i†)[}¨‰8ó¼ATîÄby0OB}Ûw ó¢eZVûòìòÚÔTwR‰’:CFOrj­¯L!H!"![Å(1§kqzu}zi±£:Z¨ÇÙ)4IÕ·¹¢"ÃÑ9*¦¡?ÚÊÂ6s4ÑŸ§@°·Í^\Ÿ[™n( gr%Ð%[[9–<9±ŽTžjiÓÚ³°6³²11s-ÁOGêŸÀGÇŽ$%¡JV4.i^\¸÷äþ½Í¹™Þ+™®ÊDçKM73™Ð ©æÛÕÚœifILÕÕëÊTn8Ñ)Äǹ])Z_[k õÔ; &ýØ‘ÆÂP:. ߃÷m©ªòÒd‡¬–Ûëzeö·EúÙÓl3 —FÇG›®Õ”n¬µ%™* GãPP5±9·0[—m¯Ná©ÙUwÍ--=üìþÝ›s3™‰§°|’Wuûüæâ檄 W%¼~T}S[ŸD“£˜ûÌ­Ö…é+îÙ“YM+1ü‚ª¦'–6æ—ÇÊrü tÖI^ØåÕhcÒ M5}v .‚ÅaíàÀ³=)¬t²9ØA€R0";ê|5©t%VPxÝìÔÒúÜâHQ†7–J“§Úúu<¹Ñé*OI«ZÚ¼hyˆ®‡@JŽ O÷­º6·933V|IOÇ8Í ‹nœ™\\Ÿ_*Hq×$aéƒ.£4uÒH›BkK‚©0¢¦a|ujqy¨7ÏÖ”'«¡ÍŠìè™™ílo­\ì(wQ!r´,/—¯L,®OÏtgÄ8¨`' å:^ˆu®íYߘY™+ ±8‡§Ö n˜Ÿ][ž.NµWV£s«§“ô#j‹Jsì,"²Ú{„†Â¨žÁùÕõ§ŸÝÙ\›-÷ó2>Mqô-›™_›^\jMð8( ð“R66¶²6µ´ÜÓ–¬§C݆”Ĥ€!Š43"wtmnu£·"ÁXÈW3Ï®ëwåOh0ô;n8ª0]³:—nnŸ·Å&b}„<%êðŠÖÎ Ž 7 °h_ 7«¹»r>ÊJü@j{r˜Pû¦š·8—{÷¥HƒÉ¶èI+D.¡$ö½=/KN€À9š‰á`kÎ ýF¤ì8ˆŒÓ€ w¸'0¤5@Ï_A†ò < ÒPˆá(–.¥ACŠ´RÿÅZü°S¢GνÛJž}ÜM ©Å@!dÊð‘ú¶Ëª †ùá—ÈpâACtŽïI ýVu˜º!ÑFZäÃú Ò¶œ"¡Ó€†Û-PÞ¶‘פÈÂËMDXö‹QHÎÀjB<±cgקE _ûY ¶«ÀÿRÞèãXç¤s$‹ðH @dgòóAêø¶Ž‡BŠXR ä€&ðUèߟ)`˜±Kç) ]±í 8µØV‡Â1•èÈ=bÙj»¸Ä2åEñ v)Q·…z4XÆËí¼ yð?Roídžv¯…Ð>­ÏÜ׸°…¡¸Ñ±Û GG<‚aŠ¥H†ìþ™¨fE¶JåÆÞܾxÒƒozQø÷N¿Â³P †Â±ö÷ C…!:Ý *$cÛ+8 Çü/ÖâØ?ÞR ±ûVR{üȈŒ«?ìaÞwû"ø‘ã@ Z{hB 4r€°4Ñþ8Ê* @ƒßðVH!ó6 æF¬ÙÆ c” t´³‰v,ÓŽŸžÞR"N¡0"e Ï~Ìæ{C[¼eâv{÷}ro|/8Js¬žóöþvh©ä>§Þèi¯ë¤ŸaYr°Å©½Û£o,ù;9T<ʃӶw¯wò~@±y8¤(Ð< ¶ÔA:ègù“ÿ/EFë­u»ýòˆxïU)ØÛ ;rLHA Fžæ[ÐEí­:Vd.ñAéŸR q 8Šˆ;´Šqdñx oC7/mCmEÜ6¤H@&<Ár1°~A …¦BWDAÓpìS Sª™å"¶ˆzŽxägõ>*Z?oƒ þ4]‚-–ÁùÙØ´g³E±`Ûùš¸¹³ŒôO☠© ± âœçYR ”qÇ1vÚVæ37tF®  ¨â{*¤Žú&R>Ø*úèÜp,%ŠÅÜAƒÌøÐ Ô‡iˆçÏí™ø|°°P§¾•ÀˆØ•Û!ÓøY-ÝÈäùpÏW°>}¼©#‰ÅB½}µs¤ HŠ†äæê£æsxFÕ¤É`˜?{_ÅóU´] Ýü í´X»×“ï©ínüf³û–a‡šŸ#Û£SFu¬<÷Íð„³î¶óó= ¶?>¡ù¯ï‡B ‘ž@¨Ž7lHíñ….Þ”Ö<*è!ôû‹óïôP´'%‹Õ¦ØêÛÚa ¬]M1ôÃjšÞ¹XÇÆ®ÅñæΆô0“SØmÿ·»¿‹*­µû €4‰³O 4=…G6m…÷Šþ…NY ³©ª 84Ñ•¸¾vAÞt!µ³»ÍÅy%Ï5EØj+þ5 E•e‡„æ÷ô-ßiÑÄRQIŠ*…1±LíêéÎæ‘h2o×-l6½N‰îÞÿåt‚ö¯5Ä‘—Uþì¸9âc¬#AÅ^Љ^—j{ 2ãmSÆ:‹•Ð4Ô>³ˆ‚šdi™¶9Ý펡q€ùt ©È/.Üv~C ØÎB ™Zù⻕M*6‘Ò¡yÕMÞteQeðˆÑ”(è¼XÆÙŽî½ÓXò"äCãm1P;î£w¶ v=…Ú¦*[·­4zêÊj‰^ˆ,/w*›½;Ø·ø¨‹¨»sÛ]¶—]°]ž·bçð–©“íqh²ÌÑŸ°›¤¨ý/Eìv©¿±~v"¤‹G7Umj“98:’/$Ña³Fñ–Êö–ܞܶµyˆ‰»kÌÄ«©Ú¿Ò`ˆí¾ÞM’*Cñ ©[¸Vd©Œ§ou­áE­°û¥Œ]ñÜ·÷"Å‹¦ÊÐü¢šòLOs©íB²å\0Îî¹qó’.@JÜ.;ùï´)ý°®µ+·=«e²$)¨ìöýú(«sxQ@aØjYõwÚC-ز;Û¦{:jW(–]•I‘¢†Ö|¿*Äü n{{ko×±TôÝu¬-ÕÉt™]µ±ëçâK–ï5û³¡¥Âî™M/2É¿t×ÿ"žÿáC äÒ¯~\ Q¾¤vÙ¼ít-Q0)9Ä!Þ¶a*^–`˜'…©Å#™|Yô¾¸³“…Úîu8d½½ÿ®Ú‡6}>öàÈ¥ËjQPÚñ©]©Ál¹íFÁŠ·’ò¸ƒrÐîÿ ï?ë {PÌÜV÷½_ڎصßÝ KøÕÅ÷z˜’ÄPdè£- Ëzzr““"›k“-.ÒY(Ì^ß}8îýð”k³3[ß={8q­ûZN”ÙI¢KöÕð`«óÖy£KåqBmhãamòR ‹ã²ªJÛzJŠ’ Œ¼ ;{þñÏß,µ÷ •¤ø3ØB²GÝìƒÍÒÌšò¾‰ÆÒê{ÌSo×ôƪÎÞš†"/7ý“@Žæâí Ró c³ªËÚºŠ â8TŠÔ™PŽlÊ ¼ZÒ1ÐÒÕ™“àtO“À;ù_©¿\UWXßQVïl/”G³±!õãOžóÉâìpuu‘·[ÃÂø6•¶ ´t¸˜ð}^9Š…0¤¬¬càZg;8zƒ£Jàœ®Öf—çÕ÷Ô6¹;jË¥¨™ ´¢¤µ¯±«%--K¡ŒC*ƒÕ¡¹f¶¶e5U´¶ç$»\D8…µ2L›lÓþ$áÙ oÌó/.hîmèlLŒóÄÒè²}^PÙ•–殞ò«±B]<š*G³6ˆ¬¬èìoêjÏËñ¹B£²Ï釶Övu—UeXYòå ”ÍÒ$¡¡ªs°¹³91ÔæÅÌ:}hvc¬° ­¶»ïJšÓ9(7-¶ŠadXQ{]wOYEš¹Ô –«e“–TÓÛØÕ[VœhbÄU !ü ceÑœ›êƒg°Ž &.­ÉÄx•7Ž_ rd£0Úd—ŠŒ4›‹Dš";È'/ß݆'…áiÚ¤e5ö_ë鯭O×ðåÐ4I´±ItiVAFÜÕ®¦Îδh«‹$7οöÚh— x£ÝÅ>­¹¶£¿¡£6<j,¦ŠQvßíO«Ó »&®Õ%òy\Y-Ú*:º²»¾«¯¾±$ÀËH t!ÖYí¸ø«¥±iŅ׺«ªs¹ª½UB]EG_}kyŸÍ‚(¶,4Ì1 wÖŠôøYMúÝ@ß‚ŽÚ¶¶’úÞÁ;­!,´ïš—ÓØ{­«-'#€Ê†[§Mñ*Èmìoìê*Ì áXHˆahÌÂ6>^Ëç±Ø²Zô“_ìkõÝ}u W¼œuÐP+˜æµÕ ŒUe±YtðÁÔ$º53/?³¦ *›Ÿ‡Ù,ý©)I²[`uKJ˜Æ6=¾¼£®µ­¬¦èÒÕŽºÚD¡Kgï˜ÝXÞÞßÔÞ˜–è§Ó•x^½þô/¯–Ûz‡JRý,š4^—윑ÑÐ×ÜÓsõr0 Lti¬ƒGnMjFfJMosGsˆ Y/Ikê 2úzÒµùÀ`ï×Ë+¯µ®»¿®±ÀÙÁè ^HpÉI/J‚lÍ]ë:2CM•0†OvzÔ‹º+*2m¬ršÓžëàêeè¡#Ðã]Z˜Ÿ¯ sMo u »Ø t÷K]ÚӭϨRx;¯Šù……k1±é_üðek 9SššT¿µÖQ‘ìS×¾¸V›dµ²ŠuóäÃ[ÍW’ìýS“"̈ñ³"Ã7iàqsœÙ3·Ô“S·v}=Û€ÑwNÇѵruaàŠ½.l]‘‚~øÍý2;?Ï¢•ñ®\S>CÙ(¡tùa{”‹}ѱ=Ž¦_ïøæB}u÷ÔÖ£±Úâü®¥œpm¢gÀå ÷€`«°jh™YÌ—#êjèZZµ|ó›[`H u•‰< ëÜÚÅëMùfÞéå[†³lÏâÒøà’¥Ï?¾Õ~)ÈCècaÆ…e"Š4+ºxjª$Éê<$³Pl\K, ä»x…û—®ÌôØó” â2VºJ=xÁ Ož¶;éòe1†&‘é! —,½â—&B)d]ç_Þì¯jXúøþ\GQÝÄP_á—7ùO¯¯çšùøVnŒµ$ë X2ZtÝÄ R¡'K“Ä9…µÏõw_ñ ¼\:=:’Ìç1èù­w'K3Â̼£¡!I¤Ó¸w;þ¦ÏÿÀ´[’úéiŸáÄûC ’¤(zÝM×r¢›Z{ l¬uÏQY°ð¾óhtY’­]Îf_­Õ9x¯\ç™1<×Xà åPÒt£ÊÙ†”ÿÔÍ•Jws–„: •?µ¤F‚ }º¯iñöt„øK5ïÝK¹¦gÍ+{7Vj Âõm<ô*gg¢=8r8m^øâíÅc¦¤Ö¡È(¢µiæêúB1]‹(©É¶œÿúa·ë)jXùÒF{Žƒ*–qÞòjÃB—‡5оž±j]n pבÖé0¡òÈà‚+?ŸÌ¢£Hö6ùk+ÓyM¢Fè°ôân›£")¤jm¹>ÅêšG îî›Næñ˜'9Õ#wÚ‚:úçȇÛfC2Š^]mvdQ¤°kŸÞí÷PÁ#šC *‰¾ øÑ­Ù,kG7¡sJRËêHkäE šÓœnå!´uq©´5š®¯# ú× ¬eØbµõ•ñÐ’›¨èÔ»þ`<#Ö_×ÖËäRÏèr—­yÿ–y’é=÷»•tþ/Ôóš4ÖÔ&k|y¶Ä‚N•£»§?~ÐÈ=é6´ùp89ÒWÇÎÛ˜Èò Ð5óæùÍ®X0BÓåX¡qƒ{ÊC \µ=Ëê§ç«r\N×^5ËÆëµæ\I–ÓÉ©š]©Î´WRã`«–¾ì 6¡ôš}ø¨Ò\›)«ejV´6?~‘ cšýÅ'Ã>šº4†.V倦]Çèz©©GK’æ¥WέÕe;)«ÓΙdTl'úðå0 4W>1Ö{ÅnRõ¯fòL ®©¹vôŽ7Ør•õãK¯¿z0u÷îÝrp3¨îßÝÙ[è—1°qÅÍÒ&ïzyºÞI,÷œ¶ÇÖCè|þìI‰á‚ݘhæ&°ñ²KY-4ê8mluÄ8z6¯ô\sö/oo5âygþ8É–BNÙuN¯·‡¸ë¡4h» æ9Ëæé;óEéÁº6!ó£ötvùнΤ`"4$I'ÑH¥DŶ4N?Ü\išpçæ@^šÚ~³G@ ïµ )õ]bŒõæ›q©Râ“,‡Aªnòú€3ƒtBƒã|óÅêKŒwçă'7W§ÚÆÚ[ŠÌŒXr8¡ |f¼#À-ÊíâdgÇ’Í•¡¸‹ê¨z©ÕOžÎ©ÒÃÊgK­Ïc˜§ sË'ç£\Ž)9ª‡GÕæ|o”Š:„§þÉãIßsäªÕ™¢h e-)¨³w>M[@—#ØÛäŽͯϬÌÕ^ §1•¤LŒú&g+ôIi—œýð“…P $ì’¤à ;fŽãß|óx¡{p´}p´­§!&ÖMéyíáõõùžáÁ{?~½˜e¤Ë’cº:ŒM¬¬Ï¬®µ•hh’Õ£ï>{°07Þ>0ÚÖßW]—Áåh>,û´ ¦ñú7µŽÄ_#!qtiœ™mÖàÈH¾€H“g8Ç>|ئI\ûøó{³Óã ý}•Õ©L¦€´~k6‚Åm=@ÈSb¸ÄÍÿû¿þæ‹7—Š£ÌÎàh²Gí llò'º²8P `ÅêA •S %”Âh“üê;7çVoN [h+BKe´]PÍlO…½*q—k‚½sñLßµÊ ôI%np$´,_ܘYÎItÓ ².˜äônÞŒÒ!üJ•¦×ñùíÖËÒ4¥âÆÍ©‰ñî©Í­/&³|µå H™5 LÕy€®…‚ú‰0!óŃ“ƒPií*÷ò4?¥I‚–ÆÙ ž`CrÚ¼¬eaý?|óâñÍ>_SŽ,š¬æßÓÞ]àÒ»šçla›{£&C÷´0¯aõÖüüt÷ÐÒâ£Oæk@JžäèPýéO×;ûFÚÇÚú: ¯øj‘¤.Ì•Fj+à¶[*C Í]®ËöÒÆTlUûºÞGOæg ® ÕÛеöËVVúŠšTYf@tÿ?ÿç—ÙX<Ô!©RD7ÿšù¹ë«C#ãý+Þ)6×j²wmXh-Œuð-kl7×öÉyVâÅÁQ†µ#×ÇL•4aHõL¦…HÉ¢I*þ£«?Y[œÓEÿ@]S¾¾.…·µÌZX›Y«+¤³h²çÔ;CŠ*­õA …äóÓ!•˜ççß1òéFG]çÄÖÖH_±_€ËE,í¢Àº¥ Í6º©£Ù§ÊÞÛÕÛéÍ7åí…TÅóW ‰ÌHÝtaBâºHY¨XÖ nL¦ë£Ô(R¤GRÓ£™šôBm̳×7æ Éê ºÉô‹ûÜNIêzw®ý ýœUIóZŸ· ©öÑ¥_Wá.—)û$)G»‚ë«Ùu‚¤×zîËûNJ$µ:[cq†Tß\š6ÌW’šÜs\kžW]×ÒL–Sr Ijtc­Ù™C>æëw>{0äyHRÈžT¼º Xqã t+.w{^Ä$5Éð±h¶†KÇäZ»µMJÆÍ»}g6ÇX#¥I•DsÏòlxÞe ¿½žeLWrí¿~·ÝËŠ#£¼s|„DCÀ”¤|ó·˜Èþ_ªÀ—¤&U 5:š¯ C*‚T8ÿŒçÈ­{ÍÎ&,éÜø÷¹;›):|HºÏq aIjò7[ÅvDß•ÛwìŒrèÃì” ÷²R¯Ž]3…­Q8Kks}Þ¤”õ jgÇòƒt Â@IžfŒ5‰,½õb,ÝYƒH“€ U;Û]á°),ó4/§rr83@_Vܸ‘Äh«ê8[&ŒON7ú±ÏAºuI@J¿óó­_’izÑð|S‹²íŒn|ýgóy¤Ìú§êÝ i0¤ œð¤Ñ»•ñºòÀåè’`”±TŒã«oÏç{òaeY^/¯fj¶$ÙZþ"[úhôYg$Iù,ïJ…!å âÀWÖO(ßø¤7ÑÑ¢øÕ×ë™TUͯ{RùR׫Rô(Y›÷¡†ç0e´œ‚:7ÇÄ"–~ùz)’rkÓìµµ©\Œ*ö„&EBøk5h K‚.ΖD w …ei9õ OV{ZóÁ:ÃR6.j^Y 1'KÀ}æתÀ_œ4VŸÞ9u{fþÖ·ãiÆ(M¢‚UÓØZ_R°±‚:‡àsmt«ÔR )·†Å¶+±Ž~em“ퟬ±ßŽG³$4ñ§ì»ænv‡{êËiÐäuÒ»¦RÁžTD›Ö¹ÛCQîBYuQG…j ’œ³\kŽ{mçòLŽK Ãø;}ÞRïm5±'Ç‚TVHÅÌn]+¶õ*¬é©‹ô×W<Âà”}îÍþ:RtI #纙±þ4cs§¢­¯?¯t0Aj´÷²™R°•á\äÍWŸÕ9ÛXj2yJxRõS7]HÝúj½ÈæÉ1¸mme¡.ØÏ]è™›ÉÑ…^*DÌŒu¾R8Ñ£zôáVcºnÀµ­?ܯðÖ‘&‡–-=y~¿9$8<¸j}}>ËgÝⶕ¥ÊL?2O÷ l¡é©pb_Ì_ ²Pgó•ˆBªoýăêdoƒÐŽ;¸]ì®-Iº+†$Iñ¡‰:8$+ÊÐÆÕ(²gte8Æ–&u¤ bÇžÿøq_iˆQ`íâ÷wª ãÝ€Ü;¹<áf…årqœ V]ËO& ’uì#|R²ÌUL+{×#mùçuŠW~óãj¶®mkbãbt©ïáof´ÿ?{o]W’¦ ÎœéÊL§-FK2ÈÒUÜÿFÄ_ü?œÃdÌîÎܾææi˜™é§÷’3)~ÊÁw_MÄù{p]o…Ǹ賬ì3†ÆFoKHêÑ£îH9Bðí¥ÝéžLGWOÓ ì[éÞWÉTu~víÖ½¾ª § ÇÐ6N†*·Ø‰Ö’y¿Á¸Ç|¶ÚÍd³^ ¹#¯/ ]Êq©rpX ‡è5½¶yÛÆÂN7wïá$x&E´w¹•ãæîDµÏézüy[´½6 )Çàš¹žÊC’¤‰è±cƒýé|6º„<Œõ­°„@¾¥¯[îâìx…£€yÁ4»og7ZBR_ï·úã £“»—»«C)|'»ü½?ÿÓTº/HR:– ýÓ’ë†7'î>¼×z=Ð[à–•`ç$”Ù‹SÖSIÐÊ øŠepε3C]ÉÆf®NÅþéwmÁ– YZZÇãõæü³€’¦Åݶ4S`V¿ìصòù^MF˜È1Â32DdΕ'ؘg.î,ÝÂÃ׀ˆ±õ®]\^ª  ([Ûß+°à1°¼ tS‹Û³3ÃÞÖ†ZTŽÉ)¤öë®dSˆ¤:z MJË(¾lõAs óSZdý³¯&󜡽Ýåž1É}k¹.Ö &•b :¿¿oelBñmœ¸ÿùZ=DRÂ…ˆÝ?~]ç|’Là“äê;u<, ØxÛ%–e&ÙœÇAšÔèÜQ’RÀ8»”/¶”aˆ’ˆ|JdGßšïž.•º¹¸ }²SroM…:6™Õó+u :öm÷þ°gÃQu¬LåÇ;aÅ!7:¾ü˳bKHRmI5,¶Ä9û—·O$•9þoÿú¤ÎÍ9"²õÑF_º‰ º»ÒýÂëF|YæVºdÚYœ{ìÐöÒT¹·‡¡oj\V(<“ ÍŒ2±s3Šè>É8GBRoÍbðõñ‹IêMIœ‘[æÏpOK‹13åÐ/}œ<ÞBÞ’žhª[D£èÌãoÕ´w5Ý®h,lL€ÙúpNe9¹Q&Uö¹(Š,5(®m¼or¶>+„ÍæëÛ¦æ5S•˨i´<Êâ<–©a˜ßÝ>6Ý=4XzÛϾٽ27+œA?*í$”(V†QõM£³ƒã£™^À:ü 1¼|ag|| y`ª£»Òß]¤tÈá,Lã‡g»;ªBØ TßܡΑ™‰µÕ±©©¾Ž3ž2ÙÎ$¶±ytfpl¸$Õã žzçY[æmrÅÖ¿–›^JaÒ•©!Q Cí#S=-Éq®zdÚ)–Ÿ€&Û·òp³¡n¨kj¼:×G/ ®{žëçW<Ò79^‘êp•,e­ ¯×ÞéŸìŸh¬Ëvq‚i¡â:ZGê[ÊSÇ[+™î“ë±õcÝcS½ƒ±öšàª’­mW=Ø5>Ý5Йàx™D;u¨¨Ðì3ºÛÇgÆzsb¯RŒ…¡E9EQ´Tn®™]­£Ó½c£wJbÄÆ<-q|ñüƒ¦ëÂsºÒ¯ÍÐ2Š/ímîé®ll«è̲³äÑ"ª_YyïäÀø`yÁuzËx3¸²¢wªlìNQ¤@Ľhš\±¸w'D)ò°4º†(4¤d gbª»çN˜‘ª>U‘ŸRÒ3Ú7»:½¸84Ú[rÛ÷2ÑÜ&i(%ÐP K¹h™“Z–aoÎQçDÔtÝrb}ªK»êÕØÙŸêVœœsËÚÆ×+·!ÈÒDÞ"T%ûVô6÷÷WUWg5uåݲÏÁO2 ¶u¬ø$³CÙlºÞ˜áSPÒ3Ù71ÛÕ{纷±*–.‡s *ª÷õZŒ» }·íº›úð-05„!áeƒ=3½£ƒ¥Yt¡(ª¾¤$šD"Ë`D†·‡›J¼tÆüˆŠÒžáÆ–†ÜêæâÚ8—/®kKô°4I®MŒô7t¸•TšÃçúeŒ|Û×P_?6ÓÓ[âæd¢Ž¥Á¾œ¸k%S½c-Ñv|E4SK^Ò×1L}™(0EÕCŸä`kÊM7}2íí̺~ð?‹¤RƒâIçôéJX*Ï“&§çay ø²Ìá=*˜ÀÀT†½}Á4.`<$ ¬*˜GR"‹a*CëØWÀÁ%¡ÎÄž¨@ŸŽ@`I]÷2œq¿ù{û^þöqõ¿¨ï®lÿd’ ˆÅ|téeAn½ ŸC‰i®Gñ½ÖDFŸu‘ï,°·ÒBÃIÿ¾&Îг£¾9iïv A¹?Ȥ´÷÷Nßfä°"’?…ùw÷±üàç…E‚Iê§8Ýc|KÇvoTÚ© È^ç)/»ý5O_çqGÿôòbºïáÛ ïì˜øM÷æô6æ…ørï奿©ÆÂÇs’çÅ3wÄ ÷o?Ïpâ¤èY;Tò ÃBE¢)Å!ÄÆ?ÈØB¨Šeü’1#J z ƒÀ,)BþibI,©cÕ§_»° 5p¯.ɺÀwç™päJÐ*¢%Ë)ÌÖ/ÐÈÎPùƒÌã+R=úy–ÕÒühÀT¥;qmŒ4ñG ú$ñÆ4{ ©ˆ¥ˆó<šqÉÄ“ob¨güŠ&p¼Ì9ŽöºÔ7Ô±†*ÅŠln©Mzîõz›©!t3ö ·u³G3Yp@E ö5ž•¡:þg¬©^ó¡'ÒÎB/øˆLM/ùKmi”èVLç`__¾1©-1 »\#2XpH™KBO+ß0kkÖëä°@ð·GR49´ˆëi}Ímîîg"só±6Œûè2 ïÖ7½7ßÞÛ”~ÃB÷󇨚¦ÊqµŽ‹16c*€”OqEó+M9®WO+IÎ+Íïù³A:£Í紇Щd0KïKŠÓ5àEÏõ—™*ê“νžpðˆ™æëÖT·ú—y©ƒ:úWü™+'¶gQÿ ci6Ø×CÀÓå6»µ‘ÀeHœú¥é˜*´ë%» !VÜ·f ú‹ «Ç¶hýú õ:ƒÅÿ¡)çXEK_õ‡Úq•ßPÇjä÷uÄúˆ%aoÔOõ\—î¯/Œ7–Ç›p¡Ä|’w_O—?žÆx;%Ĺ'ø‡ÛžÇ=o”œ>× k¸­2NÈùå/&‹20ËžšÛXíï,¿`¬¥1•Ãzeîõ']B†.b‚SN^çÆÖ£•48â‚¿#ë>é™10¶¦=#>Ì2a¼%ÓJQŸ|Š¢GüDÏÌøÃA w¸5 “,þí£ýIP%ßîÌõáË€ù¶ø(×ñÅ…X&EÒvE(Ø8dùƾ$_ ÂQLÈ}•%d§Ééƒ6TPâuð-œƒ~PR°ß ‹Ri`&tðWøúéé9”p yI0¯t+Ð@©’GJƒúí̺qÝ“õ†:‹©pR°üûªè,ƒ¢6á\‡çq>ÕMs¢ P3OÍÊ‚”ü Tï°C {0…Ãv¡À\iP+Àƒ-VÞÔãK¦œÞóbGë&/ ¶T|õdIz()˜‡ï¥É>§ÄÛ¦—E}­t9iÅ$oC“Ñ12Èšìð×ó›K‚´ÈéQ”(FWXuüóFA»Hòî ¯O(ƒz…ŠGþDß5i`¹&ÓWK…;S ˆb\_&I3bè*† i=S©aå#=)w´ßUåƒ×¤Î\ý9$åƒ=G4';WÔ ve'&Ƶ,×$Ùé³Ù Çà°\‹¤;ó|ý/üíÝ•­ùÖL{-,ó‚ÙÍÄÖå•Ý…™–H_± H<’{}}ggyíÐèêÆpw¡‹|Ü¥Ž®H°Ä Oï|õÍ?ýé‹';ËÛ9î9¼oîÄÆÄÄpçÔݵµ‘Œ¦j€†…5ã‡7´Ín.o-¶ÔÄ øŒ¶ßA"P¦Ú™'öŒolílv•ú¡ H/òÄÀ¤¶ñºê;uSÛk«Ó‰,E|@pßÆÆÓ'“%A4¸TÄqôœJ[ﯮ´LìŒÔÇ‹x4UQphÏýÝ{_Ì[ª‚ HÊY¼oZßD{ï@×ôÖÂ|gŒ¿¡*š¡B‰HêYžÝÜ[]+ÉòÃR!%ÇÐyNR‡•T3@¥Kc/uæ“ý:{G,è`x¤\FwžÍõ¯.l/Ô‡S@/ X)Ë3övïø[pá]Ýܬ e0!Þ]ëk?›­¾Á•¼tö%0¦ÇÎÆÎÁâd•«‰:N@r-j_\©«›Øx°Ø‹JfI’q= Ä0UøÙ훾þáŸ÷Õ“õÅþ‚xK%4‹99¼zwïa÷MG!œâí8IÁ)<ØMãšææ¶wf§["MÎãÞWžëŸ”Nîhò£½¶oÄŸGR¾7pW[:¾xöÕÃ…Õ¿þ|uº)ù†‘ì± 5`—*…:FAå{#-¾tCs}&C–àѺ8>TèéX2¿¸œnÈŸî?ñð·; ¹aB+®½‰ E8JRX¶Õ„â™_¹2™o‹™]¥ÐÎâ|s¦îÝ]© Š -_^š‰eÓj¦U½«­1!.LÛ[ñM³Í9Nj(ªÂÉ(蟺áåâXC¿òñßß­ 5QHŠU³ñÅîLѵk4› ðAq5Ùþ]»sM±6 20TÙaiC_MTÝ0tN.˜ûÓwSÙ–"¦Ž‘ïáYúd³ÕN J½tZ½ñ`c(ÙÔÚÛ«h~¼/ˆ@HÊÃ)2ÈÀÆÅÀ§¢vb4Õ› ª§“M +Sp Qü™«–¦ó#Ý h ®|}—¹ßÿ0SfZ×:?Seª€b¨1­ˆV·û×wÓž&"Xš% Í®÷Ɔ8¤Í|ûïZ‚òì„;«Ë­e±Ö9e³ß=› ÁÑøX¯¾‘ù2O7gaqïHaŒ¥¢>CC7ÿ?ÿýAo²¹­ÇÅ‹)੽HRX3ãàkw7–ݨ¦¥î*gm²!+lë÷ß6{ºZº§:oØqϧׯ|Ö–é/ð,é}ú/Ÿ·†Ó^ )9 »îÁÁüôêÙÍÉ¢¬ºŽé~[>—¶¸¶^àèœ2:6×îÌ=§Ï¾b–±ñï]kŠ[8r\ÝÉ|GǬÞî¡ w¡ïíÒÙñœ`C•ãùgÁŽ%Ù;ìֹ鑗,ʦ“ýŒ/%WL­—Æ{2Ì}üšö—[ÂÉ ¦ úZtÇÝÏu\t¦šûXU¹Ëß?œjL°ñJNëÝ®ñ¸D67OßÛ˜+pó öÌ›š¬õ±æ¨ñÂr¾ž+ô¦˜{ÚFDl‚“gÉPWO«‹«8¸¼vº3ÒM¥4"·¯lŸL‹0VF½8>_J4¿ú{»Ó·¯¹úÆùú™ª’¯Ô-LŽ—ûù…øäO.nÛ0ä¸U»Z¯K÷aØ$ÝY¾sS &ÓèªMͽ¿Îĸ;…†Zd¦ž«Åu¶JX[›§Ð™ ûÅ?¾{y´÷¶›oL\ë“;‰™Š‚šå'5׌š¸æݲ1Pbfµ ¹Ö}ýï߯Vz¹]c;zóŒMôøÎ6QfN,§Ä†/6›hEW¸žîUK3# ,#s4PÀ\<š;ÏÆ­ùŽS ÚôõJg‚…sĆ½¹ž ‘!Õ·}ï›»uñÎˤž|tÇ[¬ ºCJ<È +M¨‹:Ʊå ;-EÑ|‘©L©F7G‰o6¿Pà%RÅŸBR@KeÈI}“õ7-Wð IUÌ­6'ƒI-èdôø6µ« I¡X—më6Ç\Ä49ŒÀ${{s8ÛÊ) ˜¦ß]i¶…IêS|hÕÚRM¢íE4ÚÝ7“ÈåÒq–üÀ̸¼ŠÌŠÑ‰½í¶t39]ªü)$7NÓŒ?sħ:.îu«CÍÁáü’àvßìÁv†‰€®Dñ lÜi»¤Ð1Sy³ùÛÞ8¤hÊŒàë­›cÍa—õ誜°¶??i à^ôÞØoö´(¢-lr—FCð,K릯¿¼×WPV‘^>0¸q¬9B[—¦!Œþço[¼… §§¬e@c¹ú¶Q饩…uw¦m‡cé"VØÚæÔ &ƒv^˜–?>‘dŽöYÙj1 Ï¡Müû¾ÞoŽ8E“Ò¥²ë÷gj®;D7µô5‡8DŒ.ù›Y9ܹ7\í¬M © R §jÒítXWÌÓ—~Ø/tæBYh©Ê¼¸ŒÑÏîmÜ.¬H¯èìÜx2Tå u"I:Øol¼ïÌò|ŸoÂèë+0e I×ç>?¨-+K-,Íìûâ_T™‹8²èk‘­«3-zH†*Ã*˜û|4ÉÝ@kȈ™œ+b ünôó¢yjéæT’W[±ô¬-Èš£„up«_ë/±W—vä3¬‚†}Œù*ÏÏv èÁ3ó“ad¤Hªå]«SYQV*zª_ÓìƒJg¤î,>ºã,HÊÙ«y­¯")¢kÝ·ÿ²’l¨rP¯2TȦ ïÔØüÊô¢êÎßþq·Âé"©€67¾==Ü|O…w\ÁåŠgZ²4Ñ‘š¡a”]³°{ó[ K¹âÑ7³ÑæiÍðišÝòå’Ï¡ |ï¿œi£º]’œKÜÒ—nEý²ÇW+S|ta è)ò8ÿòoçò=O%)°«Õ[f=šhÌ,¬ÊiZZ¿?âø:Ó>ãyîËwÎðF®œéìUÂY]*BR¯÷ï¦OVDtAoÏÊãõÉžµÇû;Ãùºü9ð¬ÿ¹#)Ї¨l^Ù½2™yÃ\E‡®i’Q¼4çÍU>Œ‚Î¥¼ÿ|6TŸ@—'F–LÌäòŸëqÔs:\«j Iɡغ®ícÛ F<ªšÉJZÀ@²€&˜•DAÌ2/;·lLÖ7ÔfWŽLìïtçX%)}ìш‡Ál1]‚:ëâV³2Ü~ù9IM®.'ðXT’»{ÙÚDW¼ž>ˆ&©Xˆ¤T9×ã{7û+=T®ÐTèî·¿~ÒÀÓžÛÝ.·³àÊ뉓§Æ‚ ;ñï>Ûê¸]Z•QR•Q˜åæc§ L&ÂØÉ??ÎÑdN]烦Èón- ô·å•ÖUO?Þ›‰ÂÑ Xa‹óád*@+É·'¦ŠÂ­Éá3«+¹](.)O/©Î(*‰OõÇÑ™²˜k7ç; ­/àȲú0IåO=í ³ç)c„ø áéÅ#£[£;¥7MÎc)ª™åÓs)öjh¢W~aÇHûèêôôgŽ–EQÃú“õéÖÌ" n)·Ó,l@KW`æT2-h˜›Î¿i¥†:’SøPïÃñPö…c;ÉFèÿ~ÎäKR6.l^˜+¼e«¦K?o—9·”!Pâ–Í=nð0a+aì®Õ­ T:ªaiGIJõ0‹1ZH’’†¤éÔ0¸6˜l,¯ÃƺUvïT^3b*òa’bÂ$ÕSd­ jR ßü©ÕC¬&9Ì2 ¸W¶-lt6×fWµ÷§{u.—$$55Üt &)XG~NRÀÏÌ %-+3þÖ KjصŒmÄ8°}ÆWºèd4Ïíàû|;ˆ á>Ò98nóI)HR$p„¤ŠhšŠHBRP«Iý†—íu×eUg—'fŲùÒÓÒÃñ|: @QÚôO寗Ýò²?Nh?~ \+è”>Ý~‘¤~‚´_v Uõ“¤ýèS^³?¤nù¦8š4?Y¨)mÙZio̸æáxCüq’Âey鵋+À"ðš­ï\ѱ×éïjR'¢ ¿„¤¨¦‰ÙÓÃÉÁl0Xîs’Ò–’”µ ¿¾·œÂaâ>¾L’A±T¡Àw‡ŒÙuÓÖ¦)‹ë+•B"E+öZýî ÕE M•!€$u;ˆ+½ 0{F›e^¹:QÃcÒ€zÁ²¼{c9ÄŠ!5²)<Ø·ûÀãu”‘IÚÝå& 0§>‹‚‘”€]º¿Þ ‹¥(Òbòf¶ºr,A’ÂÒµ#öÿñQVêýqüø ûñe`ˆ2•ð6fi³£ýYd,Y^BRsîåÛŠÙ*ôëwü4ô¨À2U…×ôMw´-Ð ª"Í/¸~sº;ahˆFÿùa£KÕ¹{ånOˆ«HoçZ¼±9‚gš›”Ü]èñGA[(’ SÃÒIêaªõ¬Þ‹ƒ î*AÃo|w·Ö͆#«kbž»¼6…H*tqîI™ë¹wÏm´ÑP¿¹b4øÍ š(íÓËR’Šj¨ïn Hjl=ÜÊÚ®âÁT‹—>‰¡e”[97_ž`)’TÚì÷ \†ôfÙ7’{V{k‚tP ЫŠ˜SëL<£g1ðENcïVo¼§@ k@ \Ú겤c>Ò¦ÈaÙêDÐ2A ©¦ù6¤ˆgu˜`ÄVá—3¹AÆêxSaÊìÜT:‰ëØô´§Àþ2‘qÙº²my<ûº©‚KÌQ§\5ºÙúÍ÷ƒQ–—„‰…ãËù—P¤sz$Y4 ¾nòE׺®ùÞø ±" NUpü›Å±´Mj7ŸtFòÏéÑ•©÷4e)}£{·‹-䮂$ÕøÍ›<Åê°~D´³ÊYYOB¾¾ÙÍǺ_ë ‘”™8{j¤;ä"Š"Ï9 ‰ Ǥxq¢5ɘK=§KV⥖Ï=Êõã:&pla½9ÐÅ’îÓ0¶Üã ‘”;@RyIÁ[ß(Ø#ø„&奃˜ V9i²¿²ogó< ”°P (Qž{3¥s>;’« ‘”’eõèîXR‘âU v‰È’là„zbšH¨†?•‰¯†tN÷õÉëÕ¼\?uŠ>q ´¯¾/² ä"%©£›ð-¯#ígTàè-@ó_F+§Jí[dô^vËËþôâõŸ¹ÝƒþlvçÊm ¯‚;¥ny}0â=d5M“?Ó}‚¤hçPV5 ««Í±1IIíw÷æ㘠¬à5H ‡Ê¼Ðè®{Cw|9–6h*x&TÍ’²3”¹]¶{îܲõŠ Í®JK²WÒ§*œôœå¢ zî=,‹t¸9öÅ¿ng9(ƒgRÇI ˜åH"]ž½oÛîbwŽ³….›§Lu¹Þù§G£™v¾%{ÿúýd¦…ˆ­L6Æzz•<Úî ¤›£ØL8 úÑT|¹º¾aaîd–4wþ\ˆ¤0tuËÖûNŠà‰EøCÿÄCM ˜$Ÿ ÈÞõÝ]Š >“šùËÿs·¥(É+ypbm,Å›'‡\åÛPlrû7žìDªżëís÷KS£«ýðßo Êâ²v¦º²¼oV·îþù˱`•uźuéóŪœX»Àô[Å%7ÂÍåõ˜’ÑÎé½d±„&)XÖMì &†:³<òjV~ÿ»eX“Zš9BRF€N—?ûEO²=Ö®tà³ûº-Œú MJJRc롦 ¬÷äî“ÞÄèøðŠõ•Ùz/Sú94û*@R¿_Ž0à½\9ŒÈàfÏÜýÅêœëÖ)ñ¥aþ"% ãÅ:ó•~ôγoÿñ›ƒB1˜Xš‚°œ…ß?Ïuò uËh­+÷AÑÁ3))IA´Ý·öǯw&‹|#Kjgw»ó,Õ ‚¸­G[o„'Ä6î­Ž•:ˆ˜j,ÏÐüÊ_ãà†¥ßÞ/ö6UÙg.L¦†Û„d¥Tåº^ã)¶\nü`™‹Sº#}bs’¦H¶±Ìßÿâi_lh ud~j¢&Áܱlze³3éfÂÍ–½{"]Ž[>’Ö¤+ÔOjR å©’Åú"ë„•õ¥d kk¬€§€sh\^Y¨½›q{ê~Râ`ÄR ÄUíNÅ{q|k‡÷Í”='©æC’›ó£Fç—ZÝ,ÌYaÃOÿÏÖ¹\$Ú™!íúðÔbw»=Ah >"#”ƒWýæâ`‘§£¥G B²v«üî«õ2ߌü±§ Mñ<¶Í¿q|õE’’¾80~ ¼%rb»X¿ñµ¹V8ãøæï×j¢\)b#-2 \ïѼƒªïÎtÝ0uq!22hÛÀöÍÕ–˜aŽÑÅyÑ,!¸¼‘!…ÎýåX‚@Àz‰Zô2’z»šD¾DÈ64¿<«C‘Xr¾Mê$õjRIþÑè3¼ŒÌÛž4”ˆø`“fq’ÔQPåôéòxS~PUl¤‘dÆ„¤zyäMÌlnŒõäX›° \Û\¬}AjÆu&ý„½ÄIs(¬qiãÂþæýÙOœ£o~YD ¥š¡my+®"ŠÃÃ\_¶È*X]ÚÙê.ñv* _ð:ÇÐä°xÒ†ùýÍñìPSEØ ï”WâëÀ‚ÌÑAÃ' «ú©ýƒÕÍÍùƒÍÙúbo-=’"7,©{wy­³vüÉrWš¹È˜ê]?¶ó`mkc(¶¿ÔQvMƒàV^èa¤Žbé9f$™tEœWÀÙ©µ¥Î†ÊĪڛAFrúpYcÃô±Ù»÷‡ó©À„ó\zv’xŠ¦n›Ü9So&Rç²y~~smI÷ÂìZj¤&hșѹ¿±¿·°²½¼g.×Ì„#·Ewö¯nõ7æU|y¿ÙÏ@ MWßJï^Ÿík^éÀЀg U3;«;kÝé6<94Sí“1ÔîÉmÅ_¶c/¯'dÝhl_ØhÌ(oÌÌñÒ¡ðqΕ¹¹®ú$š*+Ð/¿$ðšX»^´L/Ÿ>X˜j*虨HpCÓ^8“Ò§ân5dF»ñÜ’#Ó’-Äîy56|§aLÿèÚÎÂd¥¯«X ìÖapv_•=´B„¦tš Ö„TÓº°·º½ÚUS$dCæa§}q¬Ä²þÁêt'mÈb¨†:?$¶umíî½…¹ö›Vˆ YŒ•]by\„ 0U*Á6ê´ëYMÙUCcKÍe¡d´È'ÚÙeOoîÌŒ\³3óaѯÝ]°µ5[–èx4¥Éà, #›»–÷W6—š+Ù\ÐUA‘ìQ;~'?H}Êq¼Ó%£ƒ—%XZ¤NnßÛ\íŠõ4=>"·kÙ#S›[“ÅΖà#’gÄå6' XJXSQüä èLŠz–Y2’oÊçB6$B´cq÷ʃ­¹õýõƒí©ö`4‰&Ïô(ŸœŸjéèY)v4ˆÆ€è×ع¸1Òq'åNsÒu30oÞ:ªk8ÚJ¨*™Lèªt'çü‰™­Í¡–ÏúáÊxk VXjL/ÿ²¹Å½»Íá,CÕ¼jl÷`mkk~ccw±µ"à2š,Ïð ®YYÝÝiKrä0|¬CJFy¶B‘ÅpŒê‹ÂLÕñLØ®OŒŽK:«C…×or'ïüê0‡KI©0¢j¶6îî/®l-í=Ø[*u²)q­YÚ)y#{ë{Ù.*»‘\]s†Æ€Oty¬(ÍU— ­%¸–ô6æXÌ—ÌœïëL 2­×…\>¯>½ mxþ]Ia‰g~¶ŸÔE*D.„3WqŸH´§#$Ð@ói0 4æ7—¨RSjpPÜaäÑÒ\·P@ã÷\€| `W&8?ìç»øI$@œ ÷±6ðrqZ–ã¢$ä;ÎIé%ñœÒ‡¼HPÀê”}Å؃È"¢ãÒvÐWA%SdQG‹Q Ö–ˆR¶ö“ôìú$eO¨!ðuÚ5 ´Bÿø2J(†ûDÿ‰Ž‰0¢´°&†F‚gf‡»îÐã Êó.^Àœhi¦¦i;Õüól0Ÿ­€æé[Ùé3h²dÏðæ;*»ËÈÚª³¬¤ÚÐÆ>èCSà¾üS’4N¯)YÈ£¥.NP"$¥Ãîj‹’¸;rR &gH’¿Cê3Ô9ÄOuȲPÿËK6ñ¤u;*ä…&(¾Äزœ§I]®`EÒu‡ãP ~/G÷ %w¾YØɈ½_*ìø¦(QÖ«!i¦â‹uÃ2/ˆR“« ®YråÑ/Vº ˜£tŸêÎ^Ń™õ]± Ñ‹’vˆ¤np• möÃ%7Tg…çÍ”ÔAö°&h¶¶±Þ€+13ϘYY‰g‘¿Sé;ÅHZ*¢é‰c, ð"í·ç)'*u;ú¦ U(²d€;÷ą̈CüTË!=Y;>Ž {šÂá1£æù°G#ü²`3¸‹À‹h©ðcdôˆéh÷JÇ'0ÔO=“úÛñ%"–ø‰ö/ ‹Ï¢ðß+˜ø~A;êW–yJõæC¾(âøŒ¨É…Ïî=|²6^èlc Œ~ñÁ`†:ÌS óQ/ÖŠµð¯ùí€þ%‹ØÔñÇ?ûìîÞJmŠƒ&š!§'eLÞýìþ㻳ý·í-¸¯  —kúïà´Õ Gi{÷ßËË6ÏßÈ*‘©B2Òåj^ö h÷0¹6”.ðM·Q^ŸE «iÝüìÁ“Ç›ó­‘ކʒÙ^j¾¯É ÞFt(º¤ùúËÕù·ñêßã°‡Ÿ~|ãWâ)öΆý»ÿÜÇ.€m‡ˆ¿,vß!I2•ÌiF¸ øžH ÌžóFÂ÷š¦B³ ™;3-ð|¾ ö-<Š/ñ) ¥jNP«Ô™+ŒŸ4V®P&‰ôŒ9¶®,sË+d´¨fir­)V®kG¢P¨ö*ʃ{ò=ÎT@?¼ÇEÝÛ$)H›xåÛž&£Û¾¢j 3‚¹ ÇÆ™&6Ò"0¤Ëu8'øû%©÷øêßïÀ{<ðÞ#I]ý\Éç${›Â“çËx$ô3P½·’Š Ü|·ˆ ŸêϾ­l_@¯ý|<Õh‹þ³âEYŠ?—zdú’0žð.ÐRÈ$ò]‡‘­ÝàUл?p€b`Ásõ»·? oýéÏÃórôéïøÕz¸¹³[íÅ>eNW¢…g l¬ß?kI6åÒåAi††7z&iC™b5£ªÌÀŠõÇÛwŸNÕ†³ÙtHš©qTËÔ£[ë¥n̳`Bj¦ #*otkýÞþpýM›H“Ç™ÆLí=X[ëKö©‚Ҙꜰ;[Ovî>¬ ¢2Ai2s‹›3¬o,æ_£ŸùqõÞ%IE{•uÞýý¿ÿ¯ÿ÷?ÿã?þ×þïÿýŸÿñ×'«¥ ,Qîä4gRŒ‰–N '“©ˆ!Cšû2ߎféH›^&@“9PLL fNts[ Kº°ÇrtéNT±ø^Ã3U©&°4<ƒ •.òuD°4c˜@5‡jF4¤Ù`X,©4žž $ÍÐPK*MfJ¥9âé y‰4®¡=ÝÒ‘lhtñy1sXš hiú°4‘HC¢›0Ï3ÌÈ–@1, ”ñµ@O Hs ‹ ›pžnI¥Y£èLXš"Ž2u¢[8S ¥i0Ì!iö*]" 'Ô;€Ò DZ’b, &$ÍÌJÿP^€6H¨Ãª%š©É²¥™Ù¡©4©4”‘ÝÂ$4ДJÓdYAÒ,uià„¤ ±æ΀4²@ &‘ÆÖdYR@i¶( $ ù” @ðAiR7Érø„²Õæ0ÿÔ²¡žô[ÚdŽ2æÔµ$_<~å¸4éãžß(xãO—¦ø‚4…¥I6ʧȗJ“.í”ß°4ìkK;LÇüòO<ô¨4¹—HûY¾r @ð–I*õ1·vb%Í"¬¾¥»<À‰+zÅžÏaú*Æ‹I`IÎY/*œrñ¨´“Åþn¤1~¾4쫤)¼ž´S‹!@€Á‡ã'õ1Æok|™ïÀ´°Ò¡2^{EX÷!@€‚·î'õÑEŠŒ>kBõ“N%’B€o]“Bb÷!@€„¤^§œÝ¼q}+Ž¥ty}ê%§¢ºÕo¾ýrµ5ËJA¦ðó¨ÍÑ ZþòÿôÇ/»ü\•õß(`(ŸC‹&:¢½ÄêØ£f‡4ǦÉÆ4w4…~Í$E•Á؇Ü.+Lµi8¢(œ\–³õmoóø³ï¾¹¿··ûÕŸŸmt¤G0 “T6HR®‡$E:£ÃåÅv.LÔ5¶6MlŒ4ù ÁH}†Éc ÕUu·«î$F[*cEâë-å5i…ÍÍK yÁdª@×:&¬``üÑ^osVhâM+1 ©ËÖažY}£;µþì3ð„I‰É›Yìj*jœj °aÊS½’þòåZ]TByÕèzëí`"™*wL!¢ƒ›]ú&¹Cc ÃÕõííÓ«e×®âÊtO—¤ÆñÏæëoÆEYÛ Oñ\îE™ÄÜýý¾†’蔢øL";´byº0ÚJSŸK jïžIæó€Ùžtœ¤JSó´•…™®œ¢úº©õ¶Â`2~ÉâVöèÆXWUrQ]YcsŠ©:‰{+»£9§¸:¿yj°¿ÔIL•A3ÔØcÿô?ïO´eåä%ç¹Ùh°<=Êæ–û‹Êªr몢„çˆÑm÷žî¬öÕ ¬l4eYjáèÊgÃ𼺻ŸÍûà© psÒ±nxyÀš?§OÒ\Ø\,´2¢3KGæ»Zïd× OlµYp+ |P$å…U1ML¨ÛX\,l\XÙ-ȵs<‘ªã’RÀàÏPoÜ_o/ÀÑÄŒ öу: ¦1¡fg¶2ÉY—Æ»À2CóùŠöeÍÔRŸoe’º83^îfÎ<§CV3¹•=ÝwÓŸ)«K•ƒ7²Ð´ó¼˜ÜñÝú€¤h (†–ÇÔîý '3á^dòÐN_±£ É3eø_¶KíÏcØÌø…éþ<;#¦,êD\Ò9vjÃÚjm–»>Õ„54½Yh*¢) Ég0¾ÙËeIî—õ)²èÓLD`’º9ôð›Ž'žš¥NcËC«Vg‹b¬´’ îì›K¼HRh–¦qvÃòÁíp;4Ï”1¹¾Zïå`Dö©ÚÍö6Ò¢¡ÄÆçOùIê L4§XÙb…æD»¼ŠÙù²ë2út5Ήÿño[%®Ú¦2E¨Aà’|*{7f ¯›k¹¸X.¨IµÝÛé/òÂ2mms§ú±T nÔ3ÚûãžÐA›©ÎÊšþ®=˜þ]󀎣Ex¶›GéÂôX¥±)Æ48¬ÿþ\£&²é‡‚ˆ¤ü’LéÖ‘¡%³ý=%‘Õ“c#¥ÞX(’æÕ$…“7*i_œÎŽ2WÑ¡kšd–®LÄxr•8U‹O›¬˜rÒC(E‚+ ¾v`²kh¤oýw_ïÔú9ðdthšf‰¹³·9 èçfZ¸Û’’×cá2ö÷f¢ dªÖÁ¡l}¶çÆ’Gòàïƒ8òh2:l||¼ÔÕ’}œ¤¾ (Ù4Nl Çú)é0.Ù•5¯u{Û­ œ#øçN®T¤xé`^­")Ó›} K‰||*D>ƒ?FR½GHj`y0Ê")GÏ£{îÙçS£CmÃm£ë nö†—Å‘·ºÖg'zJïT„ù[ka_ØîƒcÕòo&6vuŽnï<ÙlM5“ÑHêúØßUÛ° Hì`xvãøÞ…•ºkŠ ć"ƒgR{Ó9!Fªz|fìèðh$‰™Ó{’]‰hl”÷싉@5bZýâÔ-_s-Öõøáo¾y²ÒÙ;Ò68Þ;·Ò\îr‹>’ŠóÎˬ¼ûä¿{tïÑgßÿãOW[kâpXòñ(è‡$uPéJûDžº±²†- ³·c­Tuè̲+×F#Ý9ŠÌ²Ù'­¡vløh^EW&MݯIqÁ°”°±ÙÅúGˆ¤Ìsfúã!’R8¤˜˜ä½½ù82 àœ®U­Ït…_"$õ»Úž"DRãen§‘”¢UÝèÖX| ±².SÛ¡¢m£ÓÃú'‘TÏÔl<²‹î:ƒ ªX™-Ž·û(¡=C 0Iå„ýË á„2Ð'(¶ŽKûÄv¯£çéåí‰QVZ–ÒÉ=ˆ¤l²>j 3×晣 ÌõyLYR`òàZc4Odk;0½WnL}¸È¼¥¥– ºÐ-v`‰´Œrkæ¦Âœøj$k»¼ýg{ €&¥KUǦŒÍ—Ü2Ñ$sTÉËTÆs.‹oLî5óe1L%4]Ý~pýQsà5K¬EJÁäf[–•É+ ©@˜¤&&&^$)p»ï,-¶ta½½,„aàh65¿š)À$ðz$Õ{HRŠ M KòÔBK¾;ŠakŸ»z°•ŸIÉ°Ò狽0 ¾:ž©.¼U:÷E[š–k¬oìeæbs•ÎÑbY³íP,᳌¹=È·á')ØÏXT¾3Ûê£Oâ£kG¶ÚÓ¤$õÃׇ$%fê»6­,ק»b8ÆhS'¦˜N’Ô(LRŠ8¦ÊÄol²4€Êd+Caª ÷´»ÿôõüÁ@­ŽB‘%8:åÍÌÎ×yؘêð¬èN^3 WM IQЫ‡§o…ÔÔ¶zÚžœðIJ×*sôûÿÃÓƒ•ƒµÝ½©ét.®ïZÒ0w{osgþNº=¸Y„½jZV7wæú²£ÍUˆv9ë‹kó½C _=Ý„¶ûôh d»ìõ݇Ó+ƒi.|E²wpáÀØúãgøë7Kƒùæ&L‚wpãêÚîþúþîTo¶¹ˆ¡@õNømMWul»ïD…åôù´Ðú®•ƒ­ýƒÍ‰ü8 ðô‡ jRËå)ž?ªIMÂ$KÓãÑ£»F66ÇFÚfl/%ó’‚)­r&ö,Ž7F:sd±²oÓÐÆýõíÝ¥í±†HŸ¯o“\:½¿´¾½²}0ßw“Bzq»¸Â¹l]Û½±6:9Þ1¸º|o£EªIýÖ¤`ò¥Ê-ÅqC›÷V7·æZc¼øg‰Q-;  ºš>Ф†F#IL.Ê¥®w~uïýÃw—fÛ“cíÕô(òx!3ë»ÿï?× ¢Í!{u†–8<¦yuý`wisoa¡%ÆG¤„N @€àCó“Òæœ'±” `h{êT/†"Ž­A3¸ÈàX«ã>¹ÂP& Á_i\8€d ÀR# .Ћ|u2{ãi¿Ò¡ ò”ç¡” <-: M¨&sg«S@QéÐ#è<¨XF“&D'žMLUÎœ®ˆçžžAþHª!Ô¢H“ÑC·«‘yj¦"æ%wI“ªŸ'Cå!pœóT°dø'éCÁDóàu JòùpÛç¡Ý3 ßÔ)`5¤½ñ²‡²ÔÀbM ï<”ÝnÂy*_íxj!(ÊUÅe©S$¯Uhšžô$ÿ<‰©;‹×Á7õ¼¥À-`÷žì% x³À¬ý c÷IsäýÏ,ÞY€Y²ŒáÓ« @€à× ½ÿCsouû—ñ¬Ò9ÝW(pÓ»')$Ö:üº·ûÎ\ý…šÀA0½tL @ï…¤˜J8 @ð+ñ’”PÇ:€6ô°/K` xÇ$E“Çpu -Q\C-†ÍØ@é¥vÈI!@€‚wLRTYœKXUWNZœMÌPW…»ŠŠ øHêãË4evRvsc|X¨GétY”|,… x¿$å{Iœ[}ü‡?ÿõ/¿ûö»ï~ø¿þøl®6ÃLæ*Má”l¼I!@€‚wGRþ1ØsG‹Ø¡Î¾"Ϙ¦Îá;>^V(6K^’ΉtN÷0èK¥ÆžeCÉÊ%$%a©X*x&ìß Y\0• ,iNsI>eqwëÞ³•Ál{c0@ºZHq/{òÙþÃϺ#Ä*X¸˜ïÍÖÕÍdžËÜ éPÞCÅ£npçáÎþbU¬õe"ˆì~{îþîýg˽©Vb¦<˜¦PÄô«œxútÿÁÓŽ`‘$‚90©{}ëñùþ'2'b´Œî?ÞÙŸ+´¸IS¢z-?Ú»ÿùRg¢‰!¶TÌ®›zútïÞƒ&?’ˆ©D ÍØÚzü`¦;Û†ÏçsCAXçÄÁãÝ©‚0(hS™î_¶þdÿÁç -1|Xš‰(¢iæéÓ݃ƒZoŽ .v=wdgûу©¶Ts| 'GõMß}¼½=–d¤Ž‹©±‚ª·ží?øb®>‚Ã¥™™D·Í=}²³·UáÎ:ª±,UftáÄÞö£ûM·ÄPšÖØüÖðÜÝ'Û›ƒi~†j 4ÖynxÝîçw~1[LcÒd±–·ºi;+Å.ŒOQI!@€àƒ"©›>Y×c §V¾~4?6»öôéúRWFJ–"J: † IpE`ªÇ³Ð¥21dH“bj2LÑ"sO¤‰—hR*$C]¡ÚÀô M>˾Ä®X ¸Âó’˜<@1‘žÈc`¡CaJÙs‘}Lš–©JhsMõùfWél©ÒÁÑX`E–hžP/ÑÔ(†ú†–ÀE°nMŠw™k†1*Ò$ÀÅXj#}‘%¬Û¡4î!$ ¬›TUŒ2´Äˆ,tÈ‡Ú ï2Ï’f !•¦N•J£J"%<ŠÃWÇK‹Ñ`iæ:d8 ¯Í‡¤q›À:O3FÒL´),%©´«°4žÚa1º(ÍÀìê¡4¼àŠDšàð¡tHšñeŠTgÄóu`ilžªD“bŸ§£iB³+4äSB€Á‡µÝG8‹K«_«t÷Í®êmºa®qJôCPdõ Þ¬“žIéŸ8ºzÑøÄÅÃXåGâÑa_ZLK†¼ŒŸï€I·ª‡qÒ=. ¤}òb±Íy}i?z£äâiŘ?½ïLÚ)ò @€à"©hÔǬüÚöë|Ÿ¼ìâT[3¶êÉà  @ðnMЯ /3¸jÎyGÃxe:!„¤ @€Á;væ=»!) @€BR @€BR @€à×MR 8W”Ô…ÛÚIœy!s;š<¶îc€?cÈ2 IW“!‚iy_Ì“(½÷hÚÄŸ”£œ$µîc*h-¦ñEó¸ç)l^.¾Â`ƒ?ã~¡)5$j$•vJÐŽ` Íâ«âÙÅIl±¿¼¯® œ­Å1ºD=—•N¯¡$ɲ´ß~°Ýþ%¶H“>åÖSâÀi߀´è?.¸È4Ð$žð¯l ºè«‚{ƒFŒ°Ó:ÿ"Û@ƒÀT|ÓÖûÇŒKÁ:M0º$ñMø9æ¨Ñì/¯ÛOZo¢·ORüŠOÁß4IÑäÐ|¼ËÄR‡ïeêhª0ËqƒpE,ÿªù ÏÐ .›|æ*MÓ2ÂÅÇü<û‘®1ÅùfPbš¨'žA;‹¶´¿•‘’–œž’}ÃÈÀ蘔‘’‘šçGrÐt…§'Ý”éΆn®D.WË‚æ•Øóe¥Oé¨Õ4øÕˆ¸×'º*íA—¨_8%‚’ű3ÝÅÖ wÒ‹Ò°LE ç‚e÷ÌbŠE?t/‚>[ÖU§7wCe,ó­uƒ£BsI~|·)H¤|ÊœÆQåØû:é3Ø`¿½æ䃡ž¥Æ·ï Æzªÿr’¤Qºöú£\ ÔÞ>I]6/©îŒuáÊ NMï\=ÚV{ˆ§¿A’R@³®X¥Vm·†X±ß4I1”)Bo¦!OòþV"9V=iI0ÕÀýä&(bØ]b2¯§¤xzY¿Ré*tc/Š€«€yW|~à†‚¨ñÎ2; !©¿?’¢Èâ½®Wµe$DYßnÍwT9®ˆ·4ÊxòÃ÷嚟Ó"cóî?[Æà9Ìð¦þÅ…ÞÁ¾ù¾*wm¼ShUsIãÀÔ½ßþöÑZogGaqŽ‹•KxË_¾Þì¯jn/oîª*›òPôÓbž$)y}œ¢¸ª}º!؃F›,‹f*Ó}Ò†~WëÏ–ýÿÙ{ 躒+m´3Iw»Mbf–.3óÕ\133Øb¶eI¶$Ûb‹™™™™-Ù’,s·í¶Ó”étèý™ù×[oÍÿιW²eëªÓ/™ÌK:òªå%³k×®]õ}ªêÛzè úx0èˆúxš+ÃŒ%wI³“„ö¢ö¢>N*r4#^ÜÞc€×þÐYð >A‰áÎà3ã2àNE¢Ä „ñ&Mݪ{n)•EÄœ×ÊA±! '!Òª¾xÞë ­‹½¶Qäˆ#ŠƒBpb@úxIáH†!\¹  '"€&\Ð{whî‚.Vã|íé~sˆáq4‘4€)¸ -ÍÝä›Ïëà+4A_ l&I4¬’;î $x°¤AkÕ wQ¨ôG&ÉC+ †w¥k§/Ö…)¥9l  ©÷€ý\1ÀŠCp`ög}Á ’°O!àmb`×àš?”opä6ÁÓ‚ÊáŽD7‘ å^5Ú^}Áš ¼$)¨ñ‚ û„Òd@ób[ a7a¥çuðêæi•Û-—¬h"§ý·º½k»@ÔAKOèðA(Z’š‘?Ð’bxN#%É`B+Ÿ·¦Ë Ýüùˆnb‡9Ö§$jrþø\_okq}GEcE¨=UJàEâ¼Ð%ÞóÀƒJ@“‚ ¤¹Eõc5Áž¬³àÝpü4‘œÇ€ ö)î ëT È?†Pt{ 8rÜ’Êt7†Sö0’z7ÀŽ*p@O`„ ÜB<=ú÷39' ;gÀÔ4ÎÌm©¿\>Uoª‚%I½wž)Kã´í¯ódb4…†ÀÂo?x¾ g\ÎÞ諉 3ÌÙ‘ÝS{Õ.æt%Â?§@BkF}ñë§+óc5µ¥¡Žti¼wjÏËæì×›†ššó\Lax¦»sÑH{ßxYŠ¹’mFVↇÜn­ïî«i,ôòàÉÎϨ4Û©••%]ýÕÅù)å½y‘4&E‘åã^ H-I0•?øTBÕ²Hˆ/ï©n¬É,¬L¿á 'PÕ­:îµÝ*l¬èjÏLõ…bÉj&I‰#ÏþôÇW³-}ƒùqHâ‡4ÀÈC¹…ß©L»]’[ßS]sÓÉ–%܃2¥øçå4õ6tÖ&ÅyBñD)U•šßÕØ×_YqÍÌŒ+'ÊQ­’j«ºz‹‹ó«?ßm<RàÜ‚2¡%¶t.¾ùɉ‘êÒL>YNÓ2O¸R3ØÞÛ[šAefÿðѤ’:vVšëêËÚûJK¯òùtP>Ú‚z§°¥¯¡£*æ²³.–(% ¥á,¨mB\YOCwoEI’ —|ŸÒý`¾ª¸¢°u ª"ÕÔ„&§hp#cÊ;ëºúëòý},ÕdeF`\iGRrAAûPCe‹Å^®Í5yù7«n»óPš®Å¾Ó^ßÝY˜ŸÀ5¤‘(>Þ·:êº[‹j¦FfO©°ŠÉ‰Ù¾¢ŠžºöêØ0K%Ifi™RQÔ6ÐÔÕœ•L Si²$w—Œ¦šÎÆŽªðG AÉ2°ŠOªèmîï-Î"Ói20’'Ðïf[u[kau{×Vcø‡ EcmIžâí•ÝVß5PW›åìd¢ˆ iò"¯T·&§–wÕGâ‰T™{$e@Ôõ+¯ê»ÿðõçwWÆj«c<ÙH…T<é)¿y½®¿±­$ÀÓB2(.ÂþJjM_K_Oá­0ìqip²„ :û`·ØÉ’§N2E˜:¢©iŒ•MRKjÚÍ̺ÞúæoW¾œ 1!úÜÎklëîÈJrÓ|8•D8{e–¦¤¦¥Võ¶´7„¹°`aÀ|ø90$FkëJÂœé’:à0VœÈ;×’]”Ð4¼+Ëîøê¡(Št_ôºÊ®ÞªÚgžˆªLŒKîÕYq™Uåí]·c©‚çRÄîæžú–'{S`€+²½]ïCr¤8Éì€SFQ5ºž×ÞØÝ]V’jaΔ…QÙé·‹Sóë+:Z3Sýàx¢ô)‰Ê??HùF tB[§ŸÞœ(‹JÉÍíYé­òÖÃ1à®SõÉI ¾©Mõ½-ñ¾†R÷?¹^éUÍ“oô,ö·åǤ„]»âê@¿ˆ»Òÿt®¯("µ¬fb­9ËBIÓ3ÊNõK Ïìì)v7¥©ðÒúýv­>–ï‘Qµ¶Óç ‰±´Lï™ïÎLÏH®ß~ý›É gº8.,½¤ª$Ã/êúµÆÉÆBO-œ17nni©..1+£ýñó­®“@*¸|ùùÓEÙi‘CÓwk|ÍiG÷ô̸x˜Â’Á‰Âcy$ 8±°TçŸææïª$«ÅÜè]i,Lq KËÛì½í®KtpÏjI½–Ùýèõ Á–Ç")À (¾qòÊÒ|M\üõk KÃí™–†L=Û¢…¯ÇŠ#L}rzžÜ/ 0SA~RÒ z˜‡7÷®ÏVÅ™:yRX4¬cp寿¼×˜tóFÛÝñ–tMÓüJÞà|Mn’ÛåysNšhòqR œÜÞk÷uÂpyªh‚”,ƒwiùáÍRž‡oLLÕRmŠ!¦c“Yµp·«4Õÿjë‹•[>ÆŠ@àƒ ÍŸ{z¹>.æ²CèU{+¦*ÏÓ*¦jk¼ðf´‰“;qüS'Ðv £„þ‰©C V Îõ˜}¹Qᢊqô-éon-º“Q8ÐÑu•ËzŠÃ‰œøj£¡ Õ=4Æ%(ˆLá™Ýz¼3šëzÝÊÎ\NÅ› íãâkŸl´:ª‚¤d1„KXóÌð@Yì•[9]KMAHMóc7œ]PlCeôñ"¤=}‘ZdÃËŽË6¡SC×"íÕÀ"&¦iÛóu¶ HAÑrvõc½±¾ÆrP¾Ù•É•y!HõoÝ˱ãQHWûæ+ã$ À‹7Sÿå«!7E˜h®!H]®Z›+O´Vƒ±Éѽ=ƒÑDª!#g÷ÞBoPˆu`vv×ê@] Ö¦ràîzFt ¥O mêÜîn£ŸwTxõÚXK´>„¨ÄIøa¿!Xôç>iZÝ{|}9ÏÚ’! cF-»êáÍy?C´„HHßØY¸Å7¦KCE€Tçî|Y¬…*‚‰îž+áq­l*÷WDz<B¬C Š‡–ÚJÕôïœ$åð’ÛÇç*ù_.`eGâ/à¯öìO憙(ÁùæÙ3ƒÍ>@&‡5Ã;Zø„:ǵuÍe«pRÛ6ŸäÛc?Ó!óž¬TáLâÓº[Š|5 hºÖ·Æ¿šJ·')û o?HKŒ°ñ‰ò»5=?WjÈõï¾ßtÓF É@¸µŒ-vžR¡•óó½× I$fHÜøF]:_F×1vçy†Xù¤¤tÞ¯sWCÒ©ë[s·Ý=±dQ36¹º>Óè.:ÃÐÆEý›iáæÊÊ¿¡{¥ÔÆ”¬bÞ³¹›cÍ!ËâBã»g+Œ%!§ Xÿì •è›êj’“ݾ:>X•Õµ<=^æ¤à vô½RËË£Dó²ÆŽ4÷šGÏ#©^5=“é—Íä2NÍ]ØÎeÊŠ©ØÖ߯æ8ÃX&zL2C)dV'ˆë#?ÓÁKÂ~dãVIR~½#åþŽÎf×—†S °’P,¦èñËÅ$Ž, Éœ,Œd˽Ûú‚W€T„¿‘„ÁI{_ñ²tÿºÅÁjTÐýïÝBðjží_ìm- OþÜÓ[jk.ˆ¤¢fF“¹”ƒeGE×±¨afkrrª½£ÈÓY¸W|o<R(Ç–©ŽpOž¬>EÛñNý|» Róë<QÙ5W›j.u Rÿô •à“œ>8ûb»¿mpáÁîÔHu\¬Ÿî ú‘Ý}BOÕ‡ÛF5o·Ï¿|µ|i~«~iµ4ÅFI‡ i•Ó°;áA GHýn D°ñ‚—„ ½Ž$ƒb(cÈ"¤Þ¤Ú¦ë/ùJè¿©Š&R°ð¡á!‘ îA×ÃJ à–QÕkó#a8ü Õ€Ô¥r¤Ì@ºq ¤€HJÁ¥mz³3Ì-¡kÈš›‚T÷!H…€ uER Nׯ] ¢Ó3½©¬w •@¡ó KïO7º*ëÁÎh!>Õ€ŸÑ&ëº6­v™bt~¥…üLö±Rt¹n©¿*@Y› Kô¯úf¿1ø$ µ¶”geqIé86NlŒÛ“açõPЄ•½Õ¬FR!Yù‘œ÷Aª¼eºá’Ÿ ’ RÀK‹)/®cl±¸ ïOk|ZÖºzx­7Ú“uAù™Ð}¨‹àN¤¦R8”·{c€‘‹¼ˆ4AZ]Nîz<]“À¦؇ %ɯÝIô7–Õ%ë{T¶¯T;šƒ µ°~G#‚”Ù)Hý›È8Ráš­káôÚz]‡§Gùó?~?šêHÃÄTííÕÅrùö,ÿÉžêXSó´û«ƒ!¬™Iæ΋í“@Ê1¸|훯'oD»™Äôl|ÙaATò»·SfË%©Zå4¯ù¨ÏWÉÀ:\ ŽpAÒo.ÏÜq`UM®Öï|»Z‚cZ1à soºj]Ãëf‡Ûâ¨tK‹œG|Ót¤À] æv9/^nÞ²4÷ö,Ü^Ÿ(s3eêÚþT’¥&ß^i¸í¯‡gTm¨WÛêf×£/'‹0,kntÑíLGµ?k“¤!e÷ºê²k'†WaãÚÃéJW%¬KÔû ågÇ…8Ý~ò°%Õ íT±ñç/[BùJàšÔqÂɲnÖÎ-•¦ºi!à«æ1÷÷ìAHÚÙå;¿ùÏßÞ æ Âj¸sÌÀöÆ\±‡“Î!!:3šnHú¤Àã‡|ÓÐVºô ÄÞ§“å1<^\0$¹É«Óõ6òPpHž‡{]›Þ^è¿fáݼ{w<O œ‚ÔÏsM*z–•W^B÷¿•~+ÉœG9Ü ®N¾;{‹4cÅt·ÖGiêÂÎb¢ª7î/ô…BH)Ê¥˜êåõ½Å‰Ê@–4<Ù$5¶Ïîn*ˆ¤‰à«ÆÞ¯`ëþÓÇ÷<º·ÿäÁVS°·©œ>A ó£'>D$à"I–âáz{tj}}t ¡byä¦'GVôæg`f¶uÉ™¹÷d}¼6ž"£éÙe—O?|°¿3ÑvÕäÃ@Ô w¹`t¤¶}|rkgj ÇÁÜ(ƒ±6KêZßÛÚÝi¿élÔ„?ÙH׬ü¡û›{»‹£¹Ž¦1ldáHU€[Ê¥Æ4—{jcÈZf™Å“› kÓm-=ÕÝõ ~ÆÊŒ¨œî‘@6ú¼|kº³ I$Ê1ƒËæ·7‡º[ÚŒ¦;2€— «ŒœÞõµ½ý•Åþ[ ÖÊH‚-4ªni~m¡hº³»,ÈŽ&ý¤ˆ[·Ì–æÁÑŽñûk›£·ã¬!DI„£{ÑØÄÆæX_kQçhm¾›*Šw,¬™Û½»û`yº*Ì× Üó†dAnÝ¿÷èñúJ_V¤µŠ¨Ä‹Œ­]˜]™ïëï­Îw3¥~¸»OP¯<=$º~m}çÁêlu¨7îÑõ,¯•ô´9S1ôH†uK]7œµ±"AŠ$…àÑBk:–nmN^âÊ`lܲær#Œ”xM»Â¼ºw+šœ‹qÏ©œÚt[[ê¸b®Œ<R0¢,'õvÏÊòΣ{÷—ÚªÙ, .sôÍ[¼È–CàµËîÔf;šS%Qf̈†þõ‡»»ë­9>zÂÝ}HŸ˜ª¦$ÖLg‹ké_twu(+€) yœ Cöó/Ú~8Å h˜¡—˦æwnn.6Ý D‘Á¡”ÀÖòÜ ‰Ž¤Œ¸Q}k·÷v¦û²l-9²#²_Íè60ÀŸ|o¥·ÒSNVã§\ï\¿»woz ÀÍ–%£(•6õÆÓ)$YŒ—wi{f¤‰ô¤~礴hŠŠ, ÌW¼ÿH½‹bŽ¬I‡ëÊX’È8AQ³Tp ÄYm¢ Š¥Fd«âirˆÒ 0¡!š¡Œ¡Ê!Ëc˜ªDŽ‘£†J¬‘åÐL,倢ádZ$ (UËÕ ±ÁýŠ–¥(8㪄£É#A9j$àŽºà5<ðv9 S¨ü•.‡¹< 6J K•APñty$EÇP@SiêG¥á¨Ò0ª†¡œÅQ%»xäÏ µû±`FB vYÁWt,óí ¯4(£Næª 6Û‹Ø÷… *¡ÀŸApÂô‹ 2ª ƒˆ¢(àØ€(u"K#È«ˆ ÈaƒsÔ %v7Š®„ö‚@ hLP7%ߣa9 F èPP–*{ KIH”zà4A‚†¡Ž>Š"–¡øgˆÐ_åª ‡äI(h¾`0’Ïýõ |ò­&d9pb9ÂZä@gã Màä÷†$Y0À‚v½ÀQ… †¤O)òo‡ä):ü|¸û„´H¤"á='q÷”»ðxÄÃòAzúŸÄÝ'˜1ŽÐÅüØSfý#DÝðSŠ¤>“_YÖ7Ò>8Ñ7Ø`¨p$Wà‡UÀÿR&AJ~ð”PÚqMDÜ&ý£ÄGÔø)9A>ü§=‹8Y[„s‰hÝaŸJAIzNWRÛÇ;FºG'êr=4¡¢‘†ÿUý{_¤A~j¥ä“}òñÑ_Òùˆ%É?ê!¤¿¬ÆQýJƒÿxöÌ“u¥üû¾t’w¿GT‹à?©ëe'ÉÓrJ0û3'˜%IC)š¦þvWcãì],5Ñ$©ÓÃìWƒÃHŠ4ÃÀä€øÏ@$‘(;pNËi9©SzáçÈ^)ðW pÇ^ú÷8Æ.\$Šú&I”<È•ü?×|A,¶Wâ€H¸„'4éJZGLÿÇèƒþ?S¶tâ[bè!Æ[ŠÈ)SÁi9-ÿØ ;i‘è_¤ÀJilw† ó¿ƒSýõQ5RˆtkcUÔQüŒ2&8ÛÁ”¿;‘øÑJ1<˜…ß;ÈÄÖXI@±+¥é[¹S¸lEä?qîÑ–G¾šÿ³ L=©lªÔß¾²Š¥©± =B,Ü‘Tª¯X…nO±°Òà ÎA ¹¦þV¾!–nVà¢Ì?ôý¥÷o0ÔQ\¹Lv‚|Q›Kÿ[;-§ %`Aç]yÖvP^ˆ£§ù! ú¿2H&ÌöŸÀ‚þ7@€$ŒÇò¿–[œšS˜r«ðJΫ· Bœ8ºÎãë«WX䣴xàW/ybdáVM˜ã¤¨ú¶Ùå³û«óÃÕ¹žº8¢4‚(¦Ëóè˜nHuƒàþ. À"> ÙÝ•-ývo¸:ïèU²ÒœÈûÛ÷hÁÉrxW¿ò{w7æ:Û³Ýl™à6!R[ÝïfD‰Rq¶¦1Mí«ßÿ?ßU›ßúRH–¾eDðõ¢k¹yщ!$ Mö¯¸ÎF±ã…†sL?q½R†àb•«()=ÁÊ–$RTUº›udvÂí;)W¬ÌY2°Ó¢Óò7± ‹¡â«Ú2S¢lSGÛnÙÊ~È‚n×EœÑF‰ƒ_`HÒÔ§šˆóúˆ³šèÏ4à«A?Ö@]0Ñ…¢?y›è /¦ƒ8«+ïˆRPÜymØÇj_©Á>ÓÅKÂXÄÏk#Îê2¡Àõ³ú ñ¬¤ô—Êúÿ¦ ˆÂIžÌ¿-a€9«þ‰:ìS-¬ Au<ÎC’‚`Îi è”a˜Ï4‘gµŸ¨ÃA¦ ßòÄ9]”à,$ú¢àT…4wA~ÊV'P_ ñçµ…G&Q!üÛâzˆOÁêPgÁºH? ¤¸tßÔØ[¥¹-Ï_=Ÿª+ˆÏÊñwàè8ÎÎÄQ°Õáguñ.h’„.ì œ•­Œzû*K×C~ªÞvF'ur]RPì9-¡54Ú‚Cç4ag´…¼èDq}ð`ìYm8h]‚`Ÿî¬ÔÜÞ•Ï0ÐùH´9`·³êp WÜ:E®wVºé ÔY-àY@aPÚ9œÐªµç!BÞoì9mÔ…5P¡déCÅK }FR~ÎwìÙ,`¬;#à\{M%Ž6Tǽ}É+= 6è>ð¼9xˆXÐõx¶yNŸpB  €,ú.*o`.Ê\ï#U¤ ³ˆbÚðsTeK )\mœ rÞnüÙƒ>÷¤@—íö©6†¿¨‹› 8§G  ÷8'à‹†bÎé`. zA‚ úå œ ¦ ö)Єóз Zz¼MäÖA¦¾íͦõ§³w’²ËËFz®Øs„‹:€7‚§¿ß“f€HC] ŒRá„óšðs€®ŸÓÇ]Ô†‰³"SÇz’üЫÀÏEì“„•=:'f{ŠJ«K†îo¬´…Ø%Ep÷ñ)ÁmƒƒwÊ*Š_ýæU/G$€‚œêŸÞ(8þ ƒ<ј§å_¤>Ó&)q2sš*¢ƒÂ‚ÊÆ@j#¤¥œ(È„(ض‡²6Ij‹ÔÐF\ÐAË8v.¯g±I( rDbËÞ_½y´ÞæÆÏx2 zær,AêH—’±š éã2@ Y”б÷è×ßûz¯;ß[GP£*àJëDCye×ö×ß½Ù- cʹxߺ¾í/_µÛ_C¤E|åé ™!•= M¥-^ýë½ùt6Ëÿz_oVŒµ:” ó*©H5d’•Œ+·Æ;Çî=~ýh´> G$Ê’|RÚ÷jÊ:çžór¯5ÔÝT‚S5‹½¶ú‡ï¿ûþn©µ˜xsx¦c`zqÿͳ®®0á rVwß¼Þšë˜Ë ãˆÿ„~Á–fªšõ¨^œH³!‰#¨rH†žSïÜvëÄþã׺KCáX‚ škXôꋯûæI0’&i¼“íõ‰­—ß}óõ³™ÎQo΂Ù@×îvåÜ‹—_ýzg¦Âß)£iÙÞjÜøæûï¾Ü¬aH—€ñÍ“šû»GñæéH©§Š.þ<&¢båù7üóŸÿü§ß|ójgà W1.¨zôí7?<ÎpÑÇ ÞáQ,„wÍè“ß}ù¨¿iùñ$xæÅÂöZKC] I§ºG/Npd`UÖõ²þÁŠŠž¹§_¿Ü¹lATçgU­¼xñõ·/ô]‹°UC°Ð¡ƒKOûßÿ÷üéß¿ýáëÙë®ú(¼®_qÍþ~óæÙ@² ’ßa˜®åíë_~õÕã©öd›"ä›ÄOôŽö m|þÅ‹Å’TWðxé‡S+QaívsüáÿëýÇþþûï^?n‹÷aKêZ»ö=ûüßx<˜ã DR胔ršx¾/)áþ7ÄáVíÊ›oûfs(Å Ë@ ²ŒË5›ýí—/7js\T÷ð ÚÚ%{½&ÕB ‰×°¾SÒYâH‡âëÆ~û›ÿúáê. F”!ùø-Üûò«/MdG[(‚§é ±-£;o¾úö‹•‰>OÄô.ƒ4ç$O/ÍR1M™ÀVA."\cƺG§'7_¿x:s;†/êfD ëœÜÿêë×[ÅÁ(’àµåTp÷I}rm÷Ý/¿ùj³üj´{ÖÆÓ¯þðÇÿøó~÷Ý7¿Ýo5Q<~ê N”As4IL% ]™_8±Ö’f* ûÀíÁÍçòX¶‰©ˆ¡)ƒZûz,ÉB ñ!ù­4Œ¢íß?9™Ê¡“dq‘ÕYΊSœ:©÷YÐ/#ô£úÇî¾ùò«Ï·w>ñÕëÕžÜD1Ý£ùž€ŸÙhÏŠÁõá`6âc ¦ãàÓµZ7U´}`ÍÜØ`®‡Wh@áüÒâ5.•$Í©œ¹_â`H–F¸ø4¬tçZKËN%£¨Ó]¢bMllqöi­_îT)—à æží,•y9["ÍØ\ª"¯¸kµ16Ø•d“r­u¦!ËAJÉÉÃì|ô‡š Ûžêh­C Οžº“b¯¡!üëÚæ³L9d~×ÓoG3#\°¶·+Æ&²|éRÄ€›cz9Gd¹úUlŽT&°¨DI]™ì蜳»TÀ‚~Vº¼»6pÕØÜÝ=gz´+…£j:õ.ï6E:\›¼»¿^k(þÓŽ· ŒÀ@¹V -Œ§ZáÁˆ€ÔØ«ï'o%…ÛD¶õÍ ¦¸R€ðGgl`œÞöª3Î\“‚Ñ°%«9Ž8+?Ç(}¸Èó_$EzzéâjsQ‚™c€MÐ%K#%Ú¥ìÉ×S¥at›Äœé§àdea6öèÙHj Î¥püõLŠ9] NS£8Ú¥ÀbÃæÁA0$Cg={oè–ȧª_­\ú¼+ËîZÐõè÷ÏC±k×[Ýét¤è>W÷6k eaTUnÞøógSÍ©f–6x*¦Å ÷Œô¥™¹˜EwvŽÔ‡XQ$,]#ŸÐ‘sÕ®:dcMH•,ÎU\µÓ€1ðám]ã) ›Y²½Ð Ã’•™W‹'*c~*H ^5A^Aê8=2ôF6ÖÒMXdjlÚÀtI4O¤ï É“âë^t‚áUÔ¶y¯¿ìŠ£§ œ@”¢ç”S¹ZéeJ^»»;ŸD ÷[™Ýœ›êOÔ‡b%ЮÕ_|ÝèÉS8¤z†UÍ F—†ž`'bmm¯÷vvßñvàÈ¿;·û–¸ï ’’ÅÛò“ ¬¹)QÇ…¹teYieKßþn¿ÂÕš){šþ餎§ê¸æáÕ>þt±¾²sâîzo{n@°›&üXú 0O.UßþFÅêäìæWýW,”àðó”+Åse×]4a4ˆsqóf«¿Ušvgl§Ü͘$…ˆíÚèËRÒ([‹Kk×10اz ûo6J]„ •Ý?™+)°F ,qic6‘„ÃœÓÆK!iJQ,2Œl›Oãà@ê<Ü;kbª"ÍAƦ\êžXùzõHñ©‚8ÄÈøÚÖ\­µ üéüqb0É·î® E`ñT5^fÍÜbUìHÉà,éöÖÄÙ4þã ™ €TR Q†[ûE{Œ Mpœ‹hʮˑw©áîŸV®šÐE±Ñt­»¶Š K6³Ëìè»ÁÁâ• c«>߬<©–‰–PË’!xú·Ü(qP…`•M š@ ˆ¤Ü»öfË­dôNc±<Ê9°nèû¼>^Ò-ëй¶ßâgÇ–G˜›eÍN ÅAñ&׎䧘„¿ÜÞÕ[æmLná†!$lŸ<©±3f &LñRÿÜR=Ÿˆ>¯‡GÐU@ö$Š†¡Bäéñ|ܲÆ7ݱ¥’E€ÊÒ-÷ñp¡­:‚ õhœmŽrcJ@©Êx–*Õë˜=ôÝë–`cUnÚ±éÒ 5ìE’†(!h*¶:ÍŠäž_·°^Í‘XA‘Çñt(,`à™5Ÿ¹ %zR|²jÀôýûyæšÆÍ·fu¤Ñ_UIÕ|ñu­'OñH”ù é£Ã×/Ó¥ÀŒº$Q„„d ]F±ýU!f*(m¯ORh3Š½‚B,Á†ŸÐÔ>RêÆ”E ½´Hx ‚¹=’B‘:)sÓ+Cíím“Ãå9~üiÎ÷qú¯ÿú¯®¤'ÀÏ`r:Wsm ª»ª.ûÊÀ(àwãp*ª_pÓ÷ÿçÿžò1gÊÂ1ç ÌŠ¦¦çÛÒÒoful-O&PÈilrÙúdé«Ëõ;ÏgKídëªï”+fhf©=ØÓË,¶kûÏ¿Û¯qÓ@‘%1yc w¢Ø25Rä·š¶[*³üc2ãóJ“ãíä™ÑÞ/d ¸‰Q\çÜz&xpEbî^73җ뜘Øòäõþ-SCšªE÷êNŽ›,‹ ŠêÛìȲ–#çL~[áK•„Љ‹ …ΖešÇ-6®ñÕÃÉ Oo†[Qµ>'ÑV ÆÂ]êX¼ÎeÓÔ-§Œåe])[ß{~¯)Áܤ„¤*Ût¾úÃÈõ@cy嘪o ãY7µ1wÝ–xüÊ6p_]¹Ê¢’å)±©£+uW̤¦8›óÀŠÉß.–_ ã;[k¸(»˜ø‚ÐèÄàœñ½7=¾LšHùòÔ¸ëc÷G;K#â3"Ó®yxš*ýûßÜÊõ‹®h¿û¸'ÛB´vÌÏåb‰rägÏzãLå€ÇQ&‰CCeFx¼ÆPcºqœ£sî½XoÏòðu'ð Õ8Q·&¿\l½á•Ð4öå¾j½Œ'³Èõ=˃YñaÎicOÿ¯{Õ—Œätu£;] ]—mÈQœ£mþÝÉÞ«¶î—ƒJî½øb¾(ƈ}dð–&¹{6 ¼C¹FE4GÏÈÝÄ7#ê뻆În8]s9gqc¨-ïRzmóüzà +%¬¥Í½™fo(Ž¤f^T53r#ØP*Êà¾ݨžYµÃ 5‘Æ[ÓJWÖFnÅø1­Í[(ñ©×žn6f¸z8#Èt5^ìí©g+}y‘WÂó‹oºkâŒÙiI¹Y~QéÉuK«Ël‚È.æ0㶶 =ü"C*ö¿xÐçÉU¢ú„ä”Ç$ĺ%µ­¾ÙÊv3–CXÚÞžZÊ;â›\p£äš…] íQ”w9>Ñ'µ¥gaòzC„|”1Ò£¼¼±&)55$£iôå³ñ\geœß‘Åæ|œfàZX¯Þßš&M½Þt¥µ<+<«kpyæö%.8¸°žM_ÿ®Å×Dñ­—"Hò¬°ˆÖûcm vþþ4&Càÿp²’M÷ö·Æ;îD¥\Iˆµ¶3”%Hñª÷¿\c®Œ&Ë LÈa=ë¯~½ÒSp))#4%ÉÁÎP”À…»5Íß]«Žá‰A@,V·¬ìÝnñµ„:Þ©Ÿ»~‰/ Ÿ•]>‘ÔQFº8Zá¤d_U?Wü7 ”ÕÅÞÙÛ†ÏÕTQÿD¸®-µ4sð¶25#q,‰H½3ªÇD©~& Ó¥»8¸øXÑ íÙÈ9ð:F5Aèjœyw§úEu6ÃÜËÉÕÇÚ̪«}FBýŒä‡åS -9=6•E“>¼(¡vF‰B0ö²·µcq̈t¢¼¼ú9%6KRSûL ¦MâãຟÉÀ¡4{¤& AUBß„J%++ë)@,l]]\¼íý]Ý<ÍØÈóÒHË®¯{NBCB›M`âeåÕÎHê*!¡“•‰¡¥ ¦˜Ðü¬ ×ÌÖ¦­õ™¤U‹¦„:ƒÌ6¨¨}¶Hã¢ÎÄÊȨ}&ƒÒ£˜¢ tÎ*’©|?Ww?'·@w;C 5m15ÞÄÓÁÕßÉΣ§õ±ø ò%TÎ*’ðÆ€…­M¹:ꚟJ¨U"ù¾în^¦,œ”ÐѺÊpC2•$+¥zFÖ@×ÈŠ ¯-ÐYGÎÀ@¡ÊJ«~ è&¥#wpò pròvp pwu áágÅÔΫ3Y6N¶fL+:VFVõY¸ÉÑÆÑÝÔ44Ãèhž‘Ð8§@Á38šÊjŸJôË92‘ïeïäbÄ5#³ázÚŸ­P?¯D¡Zú¸zú›á`b€(‚ƒ£G€³3X©›‹£wVBý¬*“fæåìâjHÃJÉ‚º)Â,(xÈEiÕsJdÝ¢¥ù‰„H›hœUÀ£i|mÀÕAŸTâ˜:øº¸ú88ù:»úØòiÒ€_S“„Yðø†ºªêKnC$˜x¹¸û;ØZa!úç$µdôØ  S|mÍôÔ5>Ý jŸÊa†^NÎN\®%Ézá3Y„ÝÙÆ9ÐÕÙ…‰…ž“ ò±„ÆÊÜÑÏÙÙ݈‰—“WÿTa:Y;ù;;9Ðñð‹Ò¢]è‚ Ëqµs puvãQ1b’€((„b‚EÂ.J¨]P§ 9 5e  Mqm#C_'°ï.Hƒ^ú©kêˆÕÐ~ßKµ¤uŒxv~®žlˆÎÙc-´=±³µ÷vtñsq pqrâà À±&©ú©"ÓØÆ«<¥vFJOncmôp›¿³››1Þàœ@gqu6‹g‰7Ð&¡¡@¶ãR‘bR€d=%Œ9“N’”tÐiù©EùSqœ”ÁϤ斗í?ûlãÌ™ÅÃ2ûË_N}ôÑÄGM þÊôG¿8±üâ3¿üÕü¯€GÀ_§À>8&(À³‡×?\”©¤}ðím“Çtx+íhÇËa+Ž^¯¼UcòðÊä±S‡?ïÜöÑÑ…eêP±)QB€¦ùñÜ/ÿíh½?¢ê·ýuòÐ㇕UC óÁÇÿBÇ»æÀ c‚?}`´©#?0æyk7¡üÉ_üjþã_Îüâæ©Oßë—#†z§ÞÔ •¾ß„Ôþhò/™}ò]_¿'ê¨À£í8´Ò䱶OüŸ|ëäG[z´]"-:-§å´œ–Óò3(+}¤~FêçRQ‡ uùW¿Š]ëgc.Ü9ä' ÈO”°þ):W ó0œúù?GÑ>¯èõÑ/~Æ 5õÑG1‚üqBt¢$yN#¦È@÷ƒò>Á, }ídYœ_Qš˜ì¥ÙÛ¤ÿúB‡››G&Ø;+P) *vÀŒG:Ø äS8øõ¯(@{ñ‡)Š.JÃÀ̱ÿÈ°•DxXìï[‘”À ÒGÌ®@ò°Žˆ37f(°.GܪË++¸n®ûàAa– ¼äO²$YNU5ŒŽÍ¤åñ`“Y$ÿû»O˜¸Dè-?õ8Qgkt©¼°¶úÖͨ ;í?´S!èÚFA¾ 1$Ì_ì8ò©ß>Ǻƒ(Á‰@Q(òΟxÛSþñ‡çÿH¬d ®ô‹ûW©tq˜ /4ÑÙÓo{åÒeyþmþÜ·ÌH‚£+8qìE}0$}eÍóɹÝuo}.‡€°eþµTç€äóÿÛ³U×]´™•3Ñãä!×bùL âáÍxý°êÂt%8éîÑŒœ¢Óã‚$ Xûä›~Îo]À³EH[qñ Yâ=–›#bä9•uñ ^¸(ŠAb©÷“½¾£õx+ö]žâCýaï]—‚UM#‚ÒÂILâQDVÿEiªq$¹°ŒKôÉŠŠµÑÀ¼³­ 7óÎØèÍŽ,Åß3¥¬hòŃQ£?w*R\}‹o»šÒE%w>ž>•ªÌ ôM­,~¶Öí©öŽýý§Þu(ñ¨ÝÞö©'2(5ÙÒ„zè‡ïn;â "¥‰N×{pF%Z›\¹äÅ”<ð@²¦ß%Ê`,èÞiÉm/þøª˜Ç xü¸nǺþ÷c·‰èÁã&’yÏßÞæÃ=.ƒ÷®[ò$a.BEéöî ^Ž–ojq0$EÔä…eÕÞiì(­. ÷±PA‰‚_åèa¡·k Ú‹+s}­…Î&2»™7Ð3-ÞÈ”|x€ë0©¨–ÑùGGÇûY}ßËþ~\ë_ ¤â`ŸªpœPÕ”wÙ.m¤>Ã\ BV£šë(€ÈbyºtCU4èáòX¶.“£A²Âòí0<¶ö‰*ÍÀ·«àæÉ t:AÂ@7üÛ,°ã å›52U™H1²ÅðL5pd)(IjN èšØÈLñÁZ)²žÏƾãÛß®§p,±,®2Š¢€ãA¸–¶5Žo£ÒE$×>êóPª¶CqÃH[ˆ=ù¤ˆÒ¯Ë ‹u·ÃpCºá»Žp†:Ë cl¦E  ÈÀ± O4Gð¬ÐÏR—`Š0±#˜šë94[£¸öµæð`{<ßB+:õX)Ùej‡3ækJ“E± xºD>PÆÔL O‘AÐT©hS[›§Ã5Ó9ä‚Jzh\ãtU¶…*8½ÐTiV¾-Ñ!§xd(ÓŸ)¦½ç’Òïïú) Ôµõ´ÆŠLÉÙP\]¦‰. h‚=ÎØLCQ$ð è ©ÅÑf˜jHAqbHSfæöj·‡*ôÇ¥€&@»áL-tIéŸd€Þ7´,‰64Vż{†3cúººnó™ YcáÙÌì±,0dÒyݸú†v 30YrÎÉT§[bø@K-õ)tQ3¤à6ºðp ïÌuItYð]ËPŸc¡Ï°ÄšÙ£X,bdE‚1Ä0‘Àµ0B6`ÄÐʵƚZƒ-ž«E24Y6x RÀ¯m98¯òÁ•¡#¸©’É”ê†di2ÁñŽæ—3&[RýÚÇ6³®ø`x–$ŠˆƒÆHc¬ÇÒ†ºô›¹iuÏ^G˜³d?à™¼2);–Õ¶V¦fÜhX˜k w H~Ó€pº*Åš^Ù²6˜ïˆ7³†Sœ¢L2…Ýg‹â zY@E4Õ§é±,±|[$ÛP)Š AUŒ4‡§ÍµÐ':šÛcæø ÎìÀNAê¤üc`bx[šWeÝ`ÇÍÔŒ´ŽÅÊkÎ(ž[HùÃÚX%VÇ­¡©¿"ОvAŸ…÷.žx4QW·´ºó`m6Ûœ‰9§ÉFö œR á¹<ÁcíÆ°ucØŠ#‚ƃð2/©áÕ‰©ÉÁåÏ÷Ì%[(èSÑWçî>þî·ø÷W/žm, fú²TL2n í=úÍþïß¿Ø}ütª,ŠÅàêçž<Z^Úy8ßD!QØAU$Ûs|ðäÁâLµ« M~ø¦ MÊK´R€dÐFÔËí“÷Ÿ=zút{µÚÊ) ·ó/›^_è»·õ`«§Ô[ ¤g4aF·m>~øxgª;ÓÒ” ¼«H ¬SFŸ •µ¶Nnï<\«ÉŒ±‰è»ûâÕüͯß²Ýe¥Ž&ŠÁÝ¢êç‡úš¦÷<¸W›j©FÏîß®õ6§ËÀ,¬ ¦;Jœ•iRÚ}öR úÁ{ÖŒ^Ó½öxÿÙ“Õ‰c–,”¤fžœÑuwçñ“û;³w2T!¢èdádU“´ÂÑݽGOww'®Ç¹i"èp§‚ÁGÝMs{¯-æÓi’\vdeëÊãÝÿ—½¯€Ž*Ëóî‘iAâI°h¹»[ªR©TÅSñTÜ!N O ÄÝÝÝ•„\§é¦…éßÝÙov¿söûÞ{U BËÌÎìçÜS'<î»ïÊÿÞßýûÇ_Yí=+3“õ•ËO/OL¯,]½4Ò™)‚Þúìs*¦oC­§ÅºïG²ñ>Swîv5ί<üêÁò)åpº…KvñÈõÛ÷ï_]í9)1²¡b€-ù1°%¿~öäáúÊH^0{Cî÷JÒC sŽaœœDU˯>ŸL‘½S]} Ã0÷âè†húúѲÙÕ¦T[×S Pôñ.²Ì…K÷¿üê·ß|òäî•[Sùž±ýÉŽõ{·îÝY›oŒ íw+_”4=2Ð×Ô»táÖñŽ\[2AûÕ |t/'$²öâµ÷—§Ú;ÝéˆêXK½ª¦çoß»v÷Éã/¾¾ÝŽ£ühú')U ž¾,î<\:ïf¾HåŒß¼³zÖÝÅÃ9{aíü1¬me³›[Ö:YâIÿ3(E¿ã âÜ“çÞæ¨, ZH!#¼ëγKå1œl”¹žNd8šb€ÁÇôß}r·;E°ÓzC˜ÇJ Ú{“ƒ>ˆ¢‘{ÀEœ“ó£mQx"eŸ(³tx$Î8™]ñš1½ázßÈÜZÛ©H Ý%v´&É”¥FO§ üz,Æ–gmë‚e pž…µƒñv$0gÐQ¡.‚ ª¼>ŸÀ5":ð‚ý­ÄؘÚõËí¼Ø>kq¦/EdZ{M^Pàb÷iè[]( çì¶n­±£¿û¿O§ÒÈ#¦I£ë˜£÷ºž­/ ïÂî|#ƤÈãb‚n|\ᥰ'©Z‡W§s‚Ù»m¨¦œ„éûãý‘x"‘bÌ’Á™Þ…³.Ôù*ø©ç¿ù·Ke*ttõ(!q Ó=5¡6Ï‹‘pS¯Ý^Ï–ˆÜä9ënO佤ôQ”_ËÒ•~gf78½`ô©'¦ã‰dªÍK³å'¬Lu¢d ç†ñw¿RdmŒ“WñÄÄÔ97 ÏJž^¶¶\~X mxêêZ[®Ò’"D;úã9tu^{òA¿Î™¥³N"°'¦œˆÓ¾^Ê‘ê#ødïP,•¡t ®<ïZµ§„aáR>õ¸+\HÙÍ85òx©$Å !NȽ9VîÀ Rǧ¾þåö@'`½$p¶Ð ŽÚER,Öcü‹)ê#PÀ€”OJÏÍw›ýT-¤ Åa0NOÜi ”1õáN¥KUJô …bÃÝÎô\^/ ³Ýƒsôïr«=Ô#r.ŸŸ:ídË>ÈS²=dfµ(¬'iÃÕA¢¨úh4ï˧SñDÛ\èKµ—™¡X(eÅêã{©‚¬|Î}òùPœý^Ÿª ’¸Ë’ì…G‡æ.Ÿv`Qô„Mw±pæˆ&0®s­»ÀÙ-p<û«OF£Ñd¶¥ØŸ*‘š"98ߺKŸ=ì/ð‚‹Žöÿúóþ([}\à‰±KÓ=©|[7—ü¥õKyU× ¾‹}®iª.Ô›þShKªï êÞnhu_^ÒŒEÙË¿»Q¨ä!ßš.SNÝg_Ð8;žÀÐF¼)î#í6GØ(¯ pÁ¼³FÖFÚò‚Žâ}dׂ…Ù‰8*©”Õg/V âœ÷ayæ9Œ@~5u Ec/9>zájo”«%fêó?>ꉵ5B‘µlp;-°†¼ÃisM§¼ã¤þv 'âÍßÓcâ‚ê 󃨡egÏEÈ=¼GtýãV¤–¾/AŠ¬ª^¾[éÎ"iƒ†¸]`ÒÃo)õ^#jÁˆÚ0’¦Ø@½ÿ¶â¾ñùÆl÷C6T¯Š–¥¹xŽß+­îšmŠ êØlênäÊO>Ÿ >ˆQóø"fDëÌJ‡¿ †ƒåÝ|°p‰®jŒ}œ@ÏèÃvb†ŽFˆ¢Ðµrq´)…âêjzÀ‘[ý`"3PÐêFLbû\eB€GÞåÙ¹‰]ãâÕ¬À¢Ù‘¦L¿È²öÉÑôàð„¦õt•}ÄÕÅ’È°£½ç‡Ê’};‡ËyXÜk×6€‘´vËo¸üd} $::‰Æ¹0]+5±ˆ1=½£IT¦€]tc±+È L~ptûJ_¹Ÿ±%ɘ;òËçM`Ì[=µŠFµò­hœ>ç$Ûþ¦‚ÖÞ®ôæt“¯Š OŒLì^î<ëmhI6á&L|ó°Ò•SEôé‡v­v•ø"ÑÃkž_¯ Tƒé]Ñ2ÑŸä΀Ҁà©ê¿Ö]ìhŠ › N5̼“hÊêÛcE2u@x$}ŸàLßbw²’²L·AÒA‰…‰ß RDCÎÑœÉçŸ>¼42>;4»vññó©zwرÛW—:2Óc"ÔêÒ+ÇäåËÙžx ÜCó‹þåZ§År8aÊ5¬j²JÙTt$ÿêØIªiØìÍ«gì8Tëøôìdƒ×B)N.|¹˜évCÖQ«ä=UôÈùÆL‘®Æ(©¤öÅþ³ 30ÝHá»iß Rúh)?ýò“ç¦Ç§''¯þê_”ð¨\î‰áÅ«U™Þ>òý0àÒ|‚ieŸU2<;8=TèjŒ Ŧ'Üxz®ê\†§§t`8ÏÒ‘‹Sa ÌG–ç…Ï.žQD‘ö "ÂÎ tÏ_¸÷ñj_M_XþN¥§  ;Þñé©¡“4ƒuìÞó{Ó¥Å'ÝÝ%¦( 5Á¯zâÂH0ó¡%U¹ö|õ´Ã>iiÏÊdF´=@<ûò+Ï÷EyÒõĽ’ŠöÙæØ ‘¶ „§@Á¹%´Î N-uÕ¤ˆy4ÐÌ××ûå…š` ô[ÕmzÜ.BHRïBGe–¼mì>€ìÉsÎM5‡û¨MP¨ÀÍdŸ41¡r¤wb~êòã»kÙ"@r|ñ±µ•®T>ƒå]%¿ŒE6 †Õ¯6†›Âëâ=Ï<ÚØÖ2¼Ñ'ù…Õ.Nõ§ÒHdw:©¿Š÷+¬˜¸öéó¯ÿÛ_¿øì›ßÿî×ÏVFrID§H H¡ö{´um€T`åôÕ32"”!B>~¤ˆo夘eU×ÃÏŸ~úÙc°<öå¥sG•¨íÄ}cÓ•‡`4˜OEór¡BôýAªyr¹Õ™ˆ×‚¬NÜx°’Œ#¼¢߸× §çGÒcMà›º{2,åÒ³ëid" 2Êòõ:51ÔW“|föÎb7iáÒ°Ü»ud¬5£|bi¸µ¦£µ´µÁCΦMõuWÖM®ÏԤ׎v×Eí·Q§=}eô±<„ã‘ðÓÝk_>»W!!’v‚ 5‘ €›ÛÓ;žBg‰D•7f[¬°$b`Xãò@Mˆ™R1#¿x|Ê–¾¡É} H½j “+ê®×z™cHäðÃmË=å*+¤Æ^ÜÎRÕÉs؉'û—ÛŠ•†ä=ô ‚G×kƒ qÖÓëìtgm †oHò‰˜¸Øš§0AQÌø9çÆ!Ôv ¥§t+©Ÿè odAêe€Y°Ÿh¤:Õ •õ62fMœï*aعÓä4$xÎÓ÷qý]’ËËG®^º=µ0Œ±ràê­¥=×P£Rgìçûº¦VVŒ=xúù\œ›ÀåV5ÞU‡G‘Ílãò¯¥+i‡â–o®Ÿrèzp!=y|f:—€ÃíF9f,|Ú}Øé †¬¹ÃlRÞ‰-3 ÙöfõiLÒz+H- Å×€”ƒ4ÿÂÅù‘Ô… JáN‘Úš )†D# ãxÍäÌíG³!pH¥hB÷”…Ç{GÅHeSð+C‚”˜}¢zvéþŽ³‘X¥,º0@Çî°¢ µ^⶛ٻ:Úçîîi{¸¦}½^¥@ªnév¹›è¹”“25=z Âée¬Üôºù•·›O‡ qlœoåÈÊ€7·Ó†æ~áù…BÅ!§êþóÃÇ#¥FÖ”}²œ’ù‘8_†ò —UÈ Œ÷ŠJòðu“Èêô.zD¢‹3=Qx í³œWîTD¼_Lëù¡æã"C‹éΫ§×@ x ¿›™V9·Ú]{Lîâ-?Ñ?´˜' %;?Z›È ^¹.n9‘ )¡1­†jT{,Hדžh@JÂNš¨÷Quï 'þv@êh`ª++nº<˜}ülóôDyq Ojg‚UU?É–îAÐp£sóuá®jª@ÊþbÁý»†ÆËødœÖK›­¶O{¨.ÿ(Ç huq ¤ò¸ÆˆíAªâ 2–TvÌu$„Úê@ñ±!z#àÏ=ùj)Ò ÚꢄŒˆ®K·gÓ\:h‘Çø“ë* H…½—êÂs÷ÙÐIÒvüÔPG¦—¦­ªP ¨Áe÷ž´Dˆ!qE-éX~z½´,#¿ûbÃùë#éb}zjÝìjÿÒPavÎÙËŸÌwe±>½ë_Ý)OÏ9Õ3ß³¼PTª­Ž‚Ntµ ðÀÒÕá iÆxÎA:ߌ$°‘gÍüë"Gú •Lcpp‰ëëó) Ý”“’;v¾)ÛQ׊¼©üWAÊ»¼q¦F©¥+ºj+/cÓCè®Ä2¨ U$Ú–™víÂD…J3ãŸ,š\¬9)×±¢˜B •¾RzäàȺ•ñŽd,šn.?½ðë«•*0—® /§b¼75€£©‡ôqNN¥—Gk½!©Šªå1 '…RŽ_¹»a½±ÖÚ('÷ÓcÝÍ!hâ&oõJtHä%`Å./ …a ”ƒå‹£¹á|-ÜqvœŒ+Wƃ, y£.%"©my )‡ Ìhƒ ®œÍ$g?;úX÷¥ÞÓÒ½h²JÚyôtœ¨6õ¤ Yh3"Û”R|ý³Ñ£.ûq¯Ôx†Uß¹ëâÇíÁÎ\c¬‹GÉÊLo„9š ‚Ô³ÎWAʈ1x±#O¬k­¾i@ª~¤ô¤]ÄŒÁ»1Î =ŒwdËúd¤PZΣO×(JD‰\Xërã;ˆjDY3Y(º)™wÂ5%Ëmû–®*èÐM Š®™I’à™cFV8¤/Íô¹pYpWA꜋¥â\ûÜpÖa;=K!´yþ~c€©¦kŸô§ú ÷╾•«“mä½$Á~2ÛŒâä’¿6Û•+cs0>¯‚T‘ã^NzÍârU¶—š ¬ë½\<øqYÛ\gb¨XÇŠ)¤ÔÓõ­±1¢z*óFÆ& ]¥,#,Ý­Ž—þŠ– ²„Q* f»rìyÆ`â3ͽQà,ð"0† 4jÝï”}fªûHMNÒcŒÜZ§/´Gûðt¬…‚££«WòÅ|5H-l)58]$*%Ü’d=¼Ò³xin8›‚£˜ŽýæI_¬­œ~HQX=Ö“&2€ßÔߘáü}Ò™¾¥lyhImGY˜7¸´è"Ùô¸ó—ÛNfÊîºÿðrc”;c‡—\³x»Ä´¤QÍl3K'®ö7—'%(DÊr¼7¾oØŽ¾a‚^0½P—­@ îWÓqñŒ“-ø\—zødÏùÑÁ–ôôT')J„7õ¸þxº¢´ôp¨;‚,¤…¶_ÿâ“Ù¾†ÓÓë÷G’=PPÚ§mõÚÅú8þ.kˆê0ÑÇúÆN§¸@m:\0ñ±].¢á7mË™X¿²Ù¯žôœu£&üïÿïz¶œµÛÆ%~üö+çœ}Ò—~y«O…ÄÑörê.þëÕ‚8Qúùõ[s'=(P6=ª‰¢ûóÏ Ü"’ —'œhè,*«*hž»t­Æ•NÞ=Üxe¶à°½)ŒMŽž9JgPM…çç:ZšÊºædž+|hZpê^Öá©ß~V(Þ)àÒNÙ+JÉî[è8›’•$å@–{(1+fìæµ >vÙ@&jÒ’¶•ÙÖ¦¦òžÅÑsJ0ó,ÍŒ—4ó›Ù"5H#åSB+ÚÏw·Ôé8óÅz…Š§cÅçeôµ¥Ó¡)‚4)Æ®™¶Ü¼ÂÌæ÷îÌ„°ÁO(–µ[ãÌÇÓµµå±¾²hÒ~Çì³CÙ‡EF›j“:Û½Ð-ß)$ÍÚ¹a`uðLáéÔŠÕk·¦ "N h‹ònŸ½=^]]í%1ÅðH!% ÓóÝõy•­•ÍE*OŽÂ#ì\CQUunUßôPz×iõÐj‡ÊQ`¤>X´½4¯Ð3Ý%••YåC ×'S½D†(×ȺéæD"Š¼OœPtg:×¥ Né[n?Û8<47’ ®€³9+_õÇ;o€”š#p’å­­¯5gž pȸé›Ò¹Ø’/Ó€’¢ðO^l/IÈjì\´Úäe €’°‹”X{y}°³ñDb0•A3‡¶_œŸh/(«;ÓÖ]šéf† ¢ N76å—6T, wDà°oJ$€žXÁUgërÎ47Ž-6ÇH,´gÅÄ•™ ¤\W^Ü(÷8ÈŒJižêî®HÎ8SÐwóÑãÆ@“ª¿ñÍÝ™ÁÖâ¦Ñá¹´P¾>JÈ‹¨;×P—}¶¥er©þT8ŽÀÁû×N­úQAR^ùÅÕsn¦h©"·x~´¶¡­yü|C(†©,©‡Ot¯Œ µfd€[RC'[ Zˆ¿óÕ×·—zÎV7ו °5F½iÝGÝç3ûÉoŸ¬Íô”Ö6—õêZ-’¡]óÓ[,‰–ìA«“Q’ ÙQñ-—&‡JSóN8 )º¬”ÓCÓ-g3KË&<¹~JqRÒ§“Y ¥ž=‡Žç˜> ÊóõPŒwaýüÅÁκ‚晫¿~Ø{X¨mí7|ëþÇ“å¥ÅÇò £Ã‡ðï 'þ†@êBD@´ Â!ÄÉß›@X]еրêëu²,³0+4)+<>”É¡iÁæ¶Aª£~H¤N R”-% ;­´&-Å ùHémÍA¿µ¼îßDÚ´·IvvµÝ §˜ ‚=°TÈËÁ@8%Åæ×äd{ÉÕ EÖÁ¸8?—S^w,Æ MÒÚ¦¯Î§'¤—•Æ†:šjˆ“y@}"])gN©ª™CËØJ‘«DsæƒVp´ ”Þ'IB=øKß®¯Û±“îÎ,#nJzI •@ÓµaáCŽ‡ÄºZÒØ!ÙÁÁ¶&(ª!.À;=N(曉&ÆÒhj'hŠ!ëÈñ³Éö–ú†¹íåšz.³¤:§(ÇÛ]d€ k¡\““ìe\#Ý\vØ7ÖÝŠ°?"‚wFJQUNaº‡‡Ý^H†oHpVʓѨ/A <D$ïÌcg«sŠO:ñÕ Å±qHŠOK–‰!í(Y“}³R‹«² N¸º‰¡ÔT#²«*?KB¡nL>”ùç¥)KÍȯ{tñ¬;C‹’Pv~4/äô6D—ú8^Ä©ã…g’Ò²#Síméê”Ox…8álnUu‚¿ý~‚ƒcv__®˜I}©IJ€ç‘hS“¾l ï$>\ ¢±É'‚’ìí˜PŸÎÂU–\’[Uçk¿KÖňI^Ç «rJJ“R‚ÈLšB ÏJ.®Î=Wå #Sô1RqÚÚTg–¼éƒF5ÄK¹aùÇÎÖæ—œp5ÇSµ‘B¦*Ñ;Èå’lLu‘K”é Õ±mLhvyî¹¢¨(¥ Im÷.$œövîEm™p$ó  :âtU~ey”»È ŒÅŽšâîÁ5Fo\×lk§Ô¸‚ÒciÇüR²Tò@†1Q¾é©%ué)a &E IAFY^yMf~š €­À5FœS‘SRq"#^(fêm“ŒøeXÛ'DæWæ–V¦¥GqDlàp€䟒Hõ`\BA”¯x’i% Í)=™Ÿ–ä“FcRô„5K÷s² O–EFzXÀ»\‘sª*·´âø‰pŸ¥d†$ÅQðDm8•˜Ré-2FQ ©Jù‘¢Ì’ò´ôÃ\!Ô7€¯ArÐnÉq599^ †î6&è”kvÆÙš¼ÒêÜÒê¼òâh?‘jë>SÇ< N^P­6¯8'Ð[€H™ôè”sÇœe(•ZªÏøOV¿4ߘ%8 é–“_š–“”pLç‹íñX(çcnV8½„úx1b>V’"·c@:h}¼˜â—™z¶ò؉ŸÜk äi#ìS ²ÊÕ®HŽu2RK~RïïÇï´8hÔû±ÇAôÅÄ]–@›¸V@!hÁÕ bìGæ˜êˆ"jÛµmp;,0;@ÞŸü'ûóê8eåH®Á »¬J.ÜN ̇‡p;¬ð»á›Wt²–5n‡%v§ Q%bE¶L.7KÑÈ÷-p»^:‚A$vYãµàêø xXivº‡–¼Á•PMùq E9<&dÈñR“KÒ‚ÞÒCvZÔø: S<Ø7münS'i·º“Ânk‚ÎKŸð--ø†§ØØU°ÿ° û k‚:,è"d…õwø–à0¡ä‰škünàŸo¤5„jbwXâµ^EÀŒmn°0z[[ƒ“7|¾€o$Û…a3¶MéEà;0Û–îµyI{Y¹ç’8\u÷fkÀ¨AJ°Æ¿ömõ*Àˆz$/÷cEqÑN&6äW]¡‰P0×ZÃ}–f7455µK=|pO€ïªÅJP7À« ,Ù€èª8Q©mø·˜Á¿ZM½|0HZ©0ùêð y@í««©í?µ­A2{=ìfM}8tý{ÅVZpŠoN€S`g !hšÚm¥¡‡ P?7Ú›¶m/=Êá³aEÔ«¦6OÇ· ŠÁ´và \©ÝÀG‡Âº¥[¥rHÐH©­a7çV 0²ÑEÓ$Ö²y³o¯oÝ’¯’¨.\½ê¢n²ÍMŽßñ²¸A6uU[6Ñf›5ÙO3áV í¶Vo"hCÁ^OÞ½eKB&ètªÒ,ý*? ÅšóDÝÛ6oZ\¼©ÿ݈jÎà˜zûÛ dKX¤M‚ýé&¾_¾|å[R± (ª²æ2[Ük>¯ À÷P@눗§´Ž{€Ê4@Qþùò‚׃²ø”îÕ…Õ ÓÓýY1RCÅ(8Da¢©?dBÔ/,3 Ï OÕCRþJýF¦k‚ý«}ôﯫ¬Ç;Ó=—oÇ¡¾=Uô_~±PL²È’%¶ÚR,i,ƒ¿vlðc& i=¿páâìÜxq²“ âïqû¿©¿#RË Ôa”ÞJ?ðƒ­ &AÖ}wÎÿ£äÖèXÿ+…¬‡u±(È‚”›²¤š0Cà jbé»àqÈ%üܤô¦‹ç/̶U©!ÿˆ Œ­a…þÀR‚áHýõ@ òˆQƒ´[Ø /ŒÐ$ׯ¤D“é=Ëå'„†ð?¤xDÿêñ }žêË®ýºp1çhKÅY_aC»J0åŸi-öóäkCªÿfƒ[-Û_•i€cãüÊ*ÚâéŒÍˆåTCBPdUwN” öÖ~n ”!mÃÎÌöG ñºÈ×<7ƒK¿­oÛèS¾³l ®¾m˜îoé9ð«mÍeW§E¹Z¨ÛWCmÿ\ëãSÜ’—æ¨gC‚ª é‘ó³ƒxâ¦Mæ÷ëÆÛz‹ÀP Ž÷&Ó8 ]ø¡€‘ßÚýõjÛYàR]=jFÊŽƒî·z[ #u´¶ñùu!rÆ6ÿ~íKo!Ã~G·ü¾Ò ¹1êÛI‹ª÷-“ ‚ xúØÉ6²a“ó½Ö]. %4U–ÄÞB–[é†ò­¯®ÍvÓµáÛ´¶Ý²n×Ú÷Ùøæׄ¨Ê-p¤ï†¿ÙÔ[6ÑÛxÉo‡ bÀlÝ%§ï}s#¶ycù>„ú}–>–Ã>sq©ÖÙöƒÈþõÿ{ŒýŸ ¤,ì©Žrsä‚AÑÇÙâ]ƒ"|”:s{½0è2,D;Ú«Â%nŽ–D ó,k§±2ÄÎÍ ÷y(±L:ä–ËG;†(‚"ìÜä‡ðàHu‘ÌC\šƒ‚ìænë$6CSô‰T÷p{/¦Â“"áïÁP ðrªo”kDŒT`Æå àDx…?ÑV)VEÚ»ËÀ÷ºhŽ¥­ŸÄ?Lä¤À¹zâ©T#–—XUT6{eª7ËÑ/T(åašIuò ’úù‘\Cu’¼-ÍÛÀUŠü"ý<Ñ`Ìsæ~Ž‡À7BîïOá2ua@oY–¶ÞBßE@0O&½Š0|¸"ȯüÞóÛ8x¸£( ß–!Éž¦Œp Š´÷t±$ªíêßÐ# %WOªÜÏÎ?ÌÖYv¯6gäùˆý#|=ql–>‚nÆñ¶Ì-^{¸ÒsÔ)0B( Å51p~ÚÌ¥óljÐC’‚á¦dÛ ÷b@f ¾'ÝÑKà&óö@3jvÞ`Gv w ÉÅ{!l±;ÍÑ›ëîàëKä06CßëÁH¦ò¼òá¾Ddƒæ¤2U¤Üß—È硨Æ${Š£»ô4<(óc‹À¾ÛaçA+èÎ! ËxâîvDá*·ÂSÕöx1Ñœ9^ U_fwO5Àò²»€(Ç€ †P©>É‘æš”Øvim¹Ô74ÂÞMvGÕCñ‘@µH…?@¨<ã—,EíT9S_‰Æ‘´4c²]áʳ¶$Ù˜îLq xðœ\ˆÎÁWé~œÚ—Á‰é&W²ì„8R¢{‘éÌö6Q…Ë1B1÷q”"ÿH;W¬›?ÍÔGP÷‰}m»ªįxÃMÉpöB[ µ:)HHîÍø2|™R»ƒjÆ7Ox´+ó Ù:³½# ªÁ‰á(Ù‡ÆŇÙy8L0‚lwóë› Ø7¡o3Äq5î'8 Þ)ØA!óV¢™ ýmÑÓöÐ\¹~ñ)³¿úåZ¶k`Œ½­†jD”àƒÁUˆE`]2Åxw¢­+×ؾX*eC}€´H Ï(…Ÿ'ÍÙŸ%™bh¦Lg®ŒsP”c`¸ÔË“@£½§þ™@*þs\ÑÀ…2w~—•Üùìl[£!œ …r-ºôl¡»«¢¾½¶³))ÂÅEÔ£‡†Õ/¾“Um6#¾ 9¿øX~q*ð{ª(69Š€pŠüH|«—?l~ûj­;‡fÌ Îéê[úðîDy]cÖ1%K³<{®ûÆÇÏnÏŽw=àÈÔ'©Žu}ry¾³¸ª³ix0ÿ¨/a VÊðËO9"Sïš ™ ãWܸÐïÆÔ…ou#”á­“ E¾6xu€Uó“¯æšÛËÚëºj¢ü”v‘µ}ãUö‚6’ï·v{è8ئ>Êtlp¤€cŸS5Ø90Ø<0ÑÞ^ìé@×AqÉÑ}cs“-­õ~J™É›æ0c«ªûFÚú†;G Òœä«÷ÖgçW./N LNTdû˜!ùÌ趮ѱ–ž‘þ™á¼x¥5ž¼&u<9¸x}¼¾¡½²±ëLa†(Säö ÌL·uõ.ÝYlF’ÈF”ߢö¡»wÇOù¡Hàþ2a._øt¦½2·zdòüÈñ@ù>$ÝÆ%½ppe||¨±ozñáR±/ÓÔáä±ÒñÙ;On­ž©ªI —˜`´ˆù[&›Ú»f/ 4àÓ‰Úú~AÒÐçÏÆë[€y«í<çã „;$¦6Œõ ¶ MöôfI˜4-¸KÀ™öºÞÁæÞ±ÞÁÆX®1ÞŸXS7÷ù7ÏW;º: r%|ª.N*>9>=?ÖÔ9ÐÞ_&ÿ ƒ+Ðœ”Ö{ëâPwcqãpÿxgb ÇE;(NÏïmïl™l¨8*àp,²2j‡'~y½ç\CC’Ý>Œšðhûmã ®×Gó´¬):'¢¡ÁɱÎá™Á¡šw–>VášsåÖÍ‘ŠÚ–ªžáò¢X*•l@tvÎìjê^èNôµ5D»…Wή\«¬n«ZèoŠ@«óA¤—ºu¶&2àœ[:•ÔOuöô7õ¶'Åù˜£6N§:æÇULì+ŠtàÞâYK™ÍóY{H¶–4öäwƒ”–ORØ]×=ØÔ;ØÔ3ØÜ×w¶ä$›øšâ ).Á¯~íÉšÅ!vtÍçOûŽH÷¢HZVaÎÄ@Kàk èì\õaqeÇLC¤?o§èncH Îþý£ŽÀƒH.f|j¢Ülj :ƒ"«>ûÅbˆ9v¤d’—ßÙ™‰®x|Ó‚¸Ï£¢{¶%Ú—g¤f»HAÝ_ÿáA_"•ÎÜK[R¥¢Øæñù9‘ …Ýx<á°÷u®µLKÕØâÚ9/{¸8éXëbW‘¯)ZÖõ»»5>‡ˆB„T‰bòŒ‘ozÜ´Yi5Ë3eÙAD®‚¤ox²X"r¹¼Þt"&söú\mflNwg÷i?¥döVy¢‹ÍŽ{|ñât±³”µÛÆÞ5gúã§=1Þ\$לÉ2‘ô]›)>êÇë¾g,O#î8ÄõX. ĪAŠ“X¿öÍÒi¹Ž¥HÙtw¾"’Äòô>3¿0uÆÁÖŽÙ÷à÷—ËU|}Q­ k¯=í¬eŽÓ‚StQBZÄ…gkƒÜ$ŸºÎ¹Á4/Æ.m¿ðØÜï¹\®²ÁÓM˜b º—_ñÄèèg©.KȘZïÈ´7BÚÒ=}¨b‰70¬îÂp×AIDZ/bõÎJ:›Cݹ·ìegͽœ§0!ˆ°Žžp2Ä¢Þ©ÌñG+ '÷ãݪVJ÷‘N]šHæ‹$·sµ## ú–8=Š»j`½'_´Ûœ Ia É‹9ñ#Ëó瘼6œ -(›¼7žåhËHì¸ °¬“#áX-ÈlFíÀóõÄóÄ6âä¬á M'ÄN™¢cÍcfÍLt&‘žZD m»0rØÓÎœåêÓuïZ»Šyxpxº1)±¸iîr}bddåJN s¿[×âõúO˜ 2ºvq°:x?œ KðmxöŸŒc³Y{)+†“8ihi­;ÐAs«¸ü‡Ï§Re{ÑT=8É„›|jd¥<¡)cÛŽ;ŸwÇ{ öÐr†ÊbùFœä⩇ LJhG:Ÿ>œÈq¾¤ µkwº’iLºI£ÒMí»–.f |Èáž…úÒm@ ã N˜XhV9I¬„ªèáÏW{[+bÇÖÆê¢é\¡­†Ç6Ü6M°;P,AãóO]u-ˆZ`p ÆA¶ O©ÄpÄ(§´ÆOo×òôÁcêd×[cu1*àOáä×9)=$ã€ý©Ö՛őb3FLþü/tÅ3@Ô}Q\½JÖ/M¤Q°oS(ÿƒTÅ&H¹—?x1vDºJj¦à$¤ÂßR øN5ã:â%Ψ%N¾­ òµ˜çÔäÚ`ýpº­²tÚ¸îêÂí%y“ƒm!fH‚î†åÆ+fÁ+JHæÐçõ¡ =F_ZÙ·4.5´3»a±Þ¶Æœ@–Š¼ò±™L?Ö.MpZ’R¡ª_è­Š£Ñ5B¤z~ñU§?¦!H:H7æ%HnRPÔ >¿ñÓ/Í·uõÖuM ¯\jM„!yâœë7–{Oæ…z (tý7”º0ܾÀÁÕ/L Öwô7­]¸Ôç)³º8W¬r é[j8éy¤¶¹¯Ê- cöþƒáÞ®ÚÎîÚáë÷î¶ú»òu@‰&!÷jkìȉ‹ë•n2¦¶•­øÄää`8š ¥“°ú­h@ŠnÊI¨Y~”/G}`E \[éLâËŽv¯v•ø"ÑÂ*?ÓDA7ÀG6OÔºé[oꤖ–F"D¢ëxÞÈxA— í€(uê×O9P51ÕY‰'‡Ÿ>º5×ØÖ[×=Ò·r½·ÊcRÌŠ,Êoè­ïX{xe8†@Ò…cÌ£/Ü]Íâ ˜j”ÉůæÎõÙÖ¬¼,_ù!Mˆ*ê+¤2†n÷Å{°õa¶âü¹ÁF+vXÒô®Œ6vöÖõ,.]]*Ïõ3³"1¼‚/õ–èÙ¼TD3"S;/Õ§AÅ« Î,rþæÕb0÷„€uljvòš$SÜ/u1Çâõ˜Çòf˳"DÉ«?¹ÑÙÞ]ÛÑU;q÷þõS,¶÷‘Æéîª(,’¼_z´ørO‚; ¤U”H|b¨·»ÀQHƒÜc™ØÀ¡¹Õ‰ªŠ¢˜¸ ‡e€b#\Š5 E–m©ãÝ‹ùÒ=(òfª_8ƒsbtx¤°rÿ²/ÖJMÑ$¶A5¦ºÊ’kËÚû:zFž}«ÎÇGÕ…Ùò2džº£,°DÒãâZ]ÒÖWß95}ãÎt…›!°—‘Ä]ø#µ÷¦sCÀÐCúXEñ­'×[[{ê:ºëg>¾¹œl—0ÐÙVà—’Ñ3ŸéæäY¸VÏ£•<~ñéJW7ÐÚhß•©Á 4§ƒ÷múì›ÁP>´‰ôpžžek³Ý‡÷›ãv#eÏž e9ßí¤Œn©ÖóWO;°NDt,6T˜;W÷®v9ñ Úp:3uia W!|is« ©ò™é³ÑlHPCÖA~.®ªÆOïŸoFÚÙײp÷Âh„%\h_8113pîlN`˜ŠJÓM¸a£ã‰›?ÿlÈææËhûx*ßœ–êξ†ž±¹/Œ¥ÛÂc*½ia$[Eß …AÐ}½5Šœ îŸ^©fÑ»l˜²²;ZXL¸úh1+¶gt¡ÍWLÚ {›^ûŸ ¤~†;7y ©VNʪÕMª¼ÿ¼I%Ù‹ÜL\NÔ£…†Õ} 'EÚm)ò¼uõㇷï=¸uïáÏMTÉ)ØÝpò6:)Ðp»ÃŠ¡¼øÉrë~¤ÄjB¼R¯€TpæàóºPRHN°7‚m«Éu°Ëïo?†Åh¢Fs¯]Yû\_rˆÌxã¤^|ZêÄÖ$•F‰8ÑÍcó ˜©*ìÖ“©t5HÉxGÇ:^‚”¸ýÖJÏa†H†8 ùv–tàöE1 H¨þéÉeÓ+oÕ÷±A“Õ }Ͳ‰@ê`øðÊ¥Ö˜`W4ß%Á9BS‚")׾źQž‡kZú«•Á“kÍ.b„¬†à Mq-¸½köÐPwµfƒ3¼¸VêbÏÒ±‰Ò&FûßRK÷20Y©WWº“„Ž‰Çz–ÛÏx™“Œ!gžh¢ o‚”ÞKš› 'H{8ÇóFÇ £»!šüb=…GfƒhÄIÉZí©ˆÄ²eHhBÌI$}‡Ú©kÇTd‡[ÑÂô`”¤E­Þ]ÍÔ€d¼‡ªà…ç¦7®ÝþüRn lêÕðõJ¼ÕsØc 5Ô`ÍL^oÌ÷Á Ô« >Dfê#HH ­ ¥«)`Ú٘Ж®ÑR) ª kƒ=»xs½@FA0R&f¦²pD™²ðÎx™›9©ÁùÊœhé±Å ‹E\žZ{›£Qnœl¯ŒB#)ûíS‹/÷&z€ eDKÎê8“湦‰ê å!#ò».}<ÒB'1¬ ANŠ €ÕqòÙ¥J¤Pþ©³Uiâ½/s½ RNŸ/ÉÍÐæ+ïÑ·¸>‘ä‚äÈ–¾¸Yï«)nÆØà&HÁˆ¦¾£—oµÅ…*ñ¢°˜Žµ¡ #P°@@¦]yz)%n6À¹¹ž½¸2–AeÛˇâK­tdLG[¡ ©¹ w'¯¢µâ>»æÖõ©Tž˜ °šƒkƃõmþôËZž¡:h3Þ˧bm¦#ÊÌ’ ”¦>z>ýVjY¼rJÊæ* ²c©9CaéZÓ·Ú,ç(L£§,Îöm€ÔËMô¤J&Ʋ‚˜zšÄptSiçâz¦A6À‡Å÷n‚Õê¥NŠlHŽhZŸîH$±¤¡C`|“!QFóKK®Ÿ¾q½µÐù z#ŠZ£Ý)Û¦ç EÖŹ»åÎ-Í×z8bìT©7ŸLgI!:Y7ÓŸâIÛêAµFÓØÌÀÙ˜°™å: §cHJn¯6 EÕ†Ñ-œóJFg²#9úÈo1€ü§2œ€ÿ ,oðFS˜#I ”Ôue¼l¤>kÔ€d}'êRTšOÛ›S½áÀIQL˜2´P)Ð"àWŽà÷lÏI½)O¤ NJ*Ìœƀj,Èäo,)o›ëJ·Ó‡âí@â¾?|\íeŽga£Fç—B”<]ÈI¡bܼDFjM.‚¢OK.Ï‹bo9ëlmÏ5§òèP¼SÔv …äÑB«†W:ý8DRPÅŸLj@JÊŠ<Í ’ 3“…ˆ]Y?Ÿ#°÷à¹æ,‰ Ø,Œƒ ;s"UnëQ~c®*E…‚ñbl Î1ÎîaUW®Ž«Å}¤|¿ÁõáB ¨Hƒ@êþV∃+ÏOö¥Qˆl—sk¿…¢ ƒçU`XÃLk‰Ÿ) ò€¬û¾ ¤H:Ä€ðê剾Li LGjEÂŒš¾´rJ§êa•Á5—.OB …À]¼s©X&aC:kªšmÁÀ“wÁI³ŸÎdyÃðÀBP ð,Ï({6H?Û”ÅçâöTs(žÆÜCZsÄ:ÀòÒ=z¯–È4Ö}$m¬otãLs±Ó¬zÞð:²–•{ÝQÀ ÁïêÂTgÐ~‚\YøÙ³™&›eé\Ñ2?œëŒöiŸ¹<nÏ4Â2MéöKí¡)ÌVB°^í½£ç”¶äÝšxï4ŠØ’Æ4@²IaCcƒå>BÚAû¬Ž‹kÇìqÀ]þêZ•ŸÕv  Á謴‘¡ÎS.< χ'8þàñâ Ÿ»Ç3gðö‘% ƒÉVXm‚ïé{¿¸Ó )óøèp šúXéX“0¹ëWÇcQx²!ípîøµé¤ˆz¤àêσm5¹6ìØGF.ty ‘²ö3íÑl*<ºï5:“È6š¾z½ÔÍž»Ï9È´ƒ±@;+5HÕl€”F!N›Yš¯S©{xG'þU-îã­™ñžY)SÑ>²ÃiªAÊþ%H9˜2«æ¯gª8Æ8Gï²Û·ÇråHÁ!Q‰<ÊU)0T‹J@Š R`,zÚ~ãܵ9nÌ:~nf¥ù¤¤(Ã.üâqÄ4BƒnÅŽ9³ó3l†Ž}¸S±zHæ!–è `eŠ¬™é¾P,ŠŠ–0¼".’}8ªÚö¸xðk>ýbZµ¥ "‡FÖ-ôVìµ ™ “»^|2™©©Ú™þä- µ&eûFÉmÍ°ÀÂ<äTÑwaå°`<ãžÝéL`0€S+4¾ea !†Û47}RˆŸˆë¿03Þ’_Ö7zýÑR¥\Çõ¡µ[Ý'/ÚÖXÐH,Ø6FääÒµ™ö¾†wŽ> ý¦upDhƒ)7 œ¤»u9°~þÚˆ/R>7¾º|Ö ä¤\¤oýÀÚõáÎæ¬cžh‚®C Ki¿¸¼4U[^ rd꓃3_<¾½Ô;47írë)€œÀütÀ¦Khû÷ÿw#ÒLî@Ѷ¢SÒ‡²E¼-)ù0 9#Ù‡å{¤MKQ}RèÈï¿®váh„–”vI¹7VÆsËûVÿðåb¶ ÷ŠbY;žª[¼»0ÖŸêf…®^ñ9£¦Ú¦GÛ³eú(¯ü©ž‘¡ÆîùåË3¹1®æhjõi‡óFÿã?–À”âHŠ–­8½bmeht¤md®·)ÏrŒ¸¹Rì9z±-+Ö7¡©w¢J€ç‹NÎ_¹¹Ö?0Ü1q~¤)ŽÎ¥í²‘)OMN Eâñ1 Ꮎ• ˺§&®z¥?EfZ*²ój:&>ýÕókSÍõ!ÁŠ¬¤¦õgy ¤gï^<Îã°Q^EM+·–gG;&/ßøòbE _öÈ6utþòZgsÝÑ;Sœ³º2M$‘örÓ‹fæJƒ uPœ¶ø›i|µ4è×cã–U:}åüÒXëÀÔÀDSR0G—u²bn¹·«¡ ¦oèÚçgb``ð:ÜÜŽ+7fÇKN%Ûñi†ŸÃµ }Cƒ«—¯Ç+%& šÓL„ù}Wÿõ“VgèßDΞ|8œ¨äÀ$Ò¢•é®@sÅBq®cõÒôähëÐÂè`i¨Ÿ@ǸßJ¹©ço=˜ino:êkgŠ Y©*[&Z¢¼Xúˆ ó„2¼eåüÊlßä…å•þ”¶>ÎIyêö§Ÿ_™¹pm´éŸA2 ++ׯ_[èìížYè9ç}€è•Ø¾Ð_‹ERÈÒÊnódéX»©Úf› }¡7TÑ|VXkûäXs×ÄØùóME‘xшÓy÷ær[ÎÙ–‰oþíaƒ¿5©Àôó´&W >+îXYSÇÚ§Ÿ=¾2ÒQ™zÔg?’`ȉ?5}guaªc`ª»á¤B.†»—´-_ꨯʫ\øåù[g)‚m£¬èZ¹1ÚÛš›¡ÂÉÆÒŠ¾õÙ¦†Ú†é¥ûW<àTÄ姗N‘ ´ j ‰o¿rõÒL{ÿXïüdC¶7:Ð{6Du,oh%OéâWr½ò8לÔsaéütÇÀdßX_Ñ 'PxHðïþæ7Í^|C(ÀÔ²K)œúøÊÊxËàâåß}6}ÔΈà©L-+í^¹þÙ×·'›O'±xTcq×úÝb9©ÀØþ‹Ýyú(±}Æú-`ŽzFGoþòáH6Rd=JXj׿ýו0sÜF¼JBrÕüì©Pæ¦i!!¹`nu´¯¹ vnõþõžl™.3Ј“ÞõðæüÔpq¢šDÝ/Nȼ²~a²­¢vðLŠD¦Píjm˜™Zž:{àå »‰-·ó«™T6›¦‘Û£Öªá»/.ôtufE¹ÚíyqCççë«kŠÛæ¯þöÓù\{#¤¨™­Ë£iÞ[8)$a1µïÑo~1Oc€­]|JnÞ½6ßÜ=>ýðw÷Ûãht'¾÷æo¾XŸê,ml/©Êó’0ßä'E7ãzÙú†JÜ”4g_ºˆ©#hÃÙD@2•0P[@‡d@Q=ÂäAÁ,6UçO÷“¢™P gWK4 ¸#Y¸¨8B0ŠpžàÄ8§y`¤“í>Œ&¥)Óç¥ðó§²èäÌÁ§åq¾bU„½§+œÊÐÜ7Ð<˜$PêÌ9)$~7%îÜìLé ×C˜ oí€rhi-ÏŽGÕÝâÎ&tï@™öR‚áZŠý¤ª0±‹#A©bñÔÁý( Å¯} ,0R¢™‚Í2ÌØ|ïp…*BâÓõPLs­_¤£*\ì"3'hr½—@”}°DÎãÃLp»ÃˆÐþvþáö>þ [®’aå쎡0­¤6ÿCN’ÊLD]¬ë$SEÈ|üéBž1Š¤£äºÒìxÆêpFp°5}¢ŒâbëR<3Øìk#ïaxÙ«ÂÀ¢ð÷£‰¸(^á‡ÂvÛ÷ò½Øv"S4QɶùØú„Øy'U=¾xÆ…´¦'‘dT·Pÿž˜m€ î¥¹3ìùÆH¢.Ú-sÃЩÚ6$}¬-ÃÓ³-C=!j#˜¸À„„ÉüCDÎrKEÛ†n.òú„ˆÝ”T…7CÊ7D¡LÍ,k©¯Ä?Bêæ'’´,k‰Ÿ´]âÙ ÷¢É`›à,‰‰Š®ˆОŒ¨…Ó\m€; Œ¶çAs àG ¼m}€óåöæx2D¨C¢œé& åòéºXïÈÚ™ž†Ã,q£·@û#ŠÓ¦Š#f̯<}µ¯:ÚÁ/Xê­Ä0™zà-‹lH²¦×AnïíEnÝ–­YÈ7†õq"¬³3 ×VMßl ”|QÓ>œ¼—êÌò •„Ú¹;Ã(4] 5  ‘_¸«ÞMÅC iÁ9;w<ØkêŽuðÎBßP‡€0`ùäþÁB…t“ö0\8^aÀHe’ýX€GàÁí¤~!¶ÎrŒ‹Šg ,Ø‚Z€v²—8ÛÆãÂeþbß`‘³;ÅÉ‹&`êU mš’…ÀrhÃ7– ]éÀ„„K==0tš1Ý™,‘Z’EH;w‘aÎ÷IJ(:pÊ`\!À¸Äî®h: ì0‚CòPˆÍÖt`¤ß0‘KÀ©gŸô‡ ôQ"‚c  $Ë0°x¹ZI:8ÓYº ¶`m§$q $êáÄ$×0{_?ߢ‹SMÇÅLâ.€V¹0Û[´í¾¢â\QTòÆGÂ4úJ|ƒ…ÎJš“'‘M)LjÏ´”Ø«"l¥"34Q N7e¸°½Ànع» ( í@ÉóçVè(¨ÚD-ïè/i’¤ž(0«8Ú–ìœQ"‰¸vêãÅx§ ©oÀX?—¾‹ä.pé%½­ ‰Îþ|;þ”æ¡Áž®fÛ7¬õÞ|i8‘D5e8 ü#äÐΕùxá)”-£ÛZ¬v}ïGj2û¹6EAzKÍ¿‚zÿà•åRá>>ü¿ÿuÄ'Êêçû°ÚÖ-+Œ–5ðVǯ ‹ð7Ló÷–²QÙµËÒæÃèÝV8›?¡`ÁÏAƒ Z¿|¾ÙÍr§9j—…¦oŸ£-Ws=I@5mà­—ƒÞµÁÛ xá!Ia€Ò ø ˜*1Eà^»uüÝæ¹æ ØùšêISWØòäÕ¾©[Ø2L+hêv6~Õ¼2ÕtÔ]z9]8-K*Jé˱ÃÄ‘ÉugÒ„{¡¯¨ßzõí—-oÊV°}”DŽ„Ù²xùœ-úÍUØüçæšU{õï-ËjõêòYc7Ikk·_’ÜÖn}q³¯ÐVûÍI°Æ¾õ]ð!ZŸäá|8Þʼn­ÿ:­jêhfiç’±ÐmgGí¶Ú:´ÍUØìí+¢e9à‘ïbÁoÛ¾Ö+µ9!/‡öÆL¾²|[ÆìšWžlٹ߶‰¶np-+œ1Õ[™Cg{÷­VÓáÖ½ðÖq½¤.¨‘$tŸ‡VVœÐéË$ëm!æ7>ñrta$+‡‰\dNJh;›êmƒDkmsP¼…·Ò›Í6ôöÖ¥ÙžŠÔže–Þhêå$l¿;¶AACº¸É=Ä>|jh2'L~ŽÑ¶Þºôo¶°Q`‡víÞ©}ïëоgˆ€ÿÕ‚ùÐüûsR/Þ{ÏçÀx.WadÂüñûìŸ~¤. üËw”ÍʬŸ~ÈüñÀïæ“¿PaýôöO?„¾üî”ìµP™€ÿü¶ÞîàþløÖO_}õÿ;Çø,àt£ø •-ÿ¥~òCZû€·{Ÿ ŒÁ©l,廵Þ>-¯~èÉû:r3X„Fy›ò~òÁþú+CøK—?ásšW¸ÿ²$žïXúB]3?ó}Â÷wp~0‘ü ÖìðÆžú‹öÏvKŒ­±¸` ÆÿÐ^ÁÏ>üþSÊÝ¹Ç Ð36n­ÐèùÿŸYýa…¿ÛÔ‰ Ábaö;wý ‘’~úÁð{ïý‹û€ò~ô£ÿøÑþðÞ{ïÊ»ò®¼+ïÊßWù÷÷ÞûïHºx1øý÷ýÞ{_n”¯ ®êôÇÖòæ“mË‹ï]óÏ)ßç+/þG?÷WËk¼øÞ{­ò‹ïñ¹öÐ^|ëß/ÞNEß2´7òæ_|n¼ø Ñwå]ù_)¿xï½!HÜ÷R¿þíoƒ‚x2ùTâ(WcÁ~&úÉ¢Ÿ¼þþøã[à÷§¾QÀ:Bè¡ò¡ð'ï ~üsÍ[?¸¼/ü±ºµÖ„ßÞˆ¦o~kÙ2„o«ó²Má[ÛÜh øýŽþ EÓá.Û×LÅ›u ™Qõ?þ@ÿD½FM½\¯­omæ5¯ƒ¯l©¼¥}õ»¾úîÖž¼\ ¨‘-]ÒtìåW^&H!ïo­ùêˆ>Ü %MßD?Ýà‡šÊ¯vxsà›íØþ䃷 JóšÛþëø®¼+ÿû uÆOÞGì>øw‘^ä;Aê¿ÿû¿ßÿúÏÿüÏ?þQ]€'GUqˆ÷÷wË;ò2SäÑ-e{`É2^êAqbù?þþ›¯>}þÕ§_<»¾|ŒˆÃ|t eMÖ…ÿàbHñpÍ›^ôåçŸruµÖWÀÔG¼¥2·ËøŠÆ>|Û¢ #ï“Èi ÷¡®7ÛÔ!ëÁ©{Ä K÷<ÿêɽùò _òS~£¦ 70¬aýÖ'¿ùýãR2–¤‹xëwx!C\ îN ì.k’ ¿Ë¯ýZŸá$0N¯v‡f‡9v— ˜o}‡9ú#àŸ˜Ì1;, ÚP -+ÌG‡p`ºyÈ‘MË »Ózåÿ³÷ÞQQeùÚð·¾õ¾w¦[  Š¨b"TÎᜪ¢(B‘sF0 ÉŒ#ŠH J(’’Ì©í¶í<Ý3Ý3Ó3==áÞ¹wæÞw­ïo‡s*@aî·zíÕ«<œ³Ï>;=û—žŸ¯òp¤v^bp¿=¸Ÿ«`ø‚ßr¦çó’ÛÃÊA…2G® f0‡¹~`±ç˜2Ó‘ƒ—ú(!ël-h†Â‘O0a“`ÍŽéoø;¶ÂĤÍm–Â6{‹íà b _ôFoƒ£O¡Çå ˜ÄU ÿ)³ÇUë9øx‘­d Ô0¹’ضeŸ‡-ςχù$“+w€]k¶cCNÞÆä¿Á´[yÛŠúŸšÑòÍJRÿÛš·Að³{ÙÚmÇ6,MÙÓ}pMƒGX&âì^Ñ›k|v¥$É[Å ˆdk5,®ð=ß`At~BþʸÌ®Š„™/Omª&&U·(6¯ 6#ÅW ‰ˆ-\ÐEáþ«;~:´5+ÊGŸ¿µ$#ÔÏY$ŸçŸ´0|áÊĬL©Ÿ!”vº.-xþòäì誙‰‚4óóÔi†¬‚´Å¹C¤ rÉüâ3×V­K_ºDïïç*²ä¼B.è³Ò«+ÊVEÏÜÔ5öá½9ZÇñœ`°…32â ËÖÖÜûøI­ZF8 ß`âL£PUŽ’¾ÉáÆ vQñ¯(“+Ûµ#_ S6ðR2 «<<<°PÄT7¨A£H„’|1UÂB¤¾aøÊ<’ŠÐçIá&^!¾å1X#¥v{_% všoøt2)VÏ—ÙCÔƒ4§Lž Bž'ÖšŽÁ#h(cB€¡a1_@({øFôE>¶àSãx €’L¾Êà¼7I óý!<¸ŒÓ?±@·À¾‚Í€è‹ò¹ðQ¢¬",%ÁBÜSS¼¥`pY\ˆwLÁ¿R¶;[±•w´¼"He¯yå׿üè£/?¿766öÙo?:±¥ ̉c¾®!HyGo>z÷qÓrÅÿ3•÷¿f ~î N×rÕ©‹£×Û/u\º~çÒ±ÈÙ@æuÜùòã«çOí¯m¨¬.‹Ñ*ÆÑ"9K"Kn?¸¾OéËù_sð \a'ÊÙ}íÃ'.í?Ôx²ûæå ¸à½²U%Ýc׺.6]¹1p­.+ñȳÎýîïŸ \©=~¢¦ùøêü…A +v5Ž~ñÁ•óGJ”eDèÝƦӆ-.Ê ûn7m4‰ÀÙZÊ<&W+ȽvÿñO Rpÿt„BSš!è]oÏFh0” o)ƒ‹@ Ò±"þ¸÷*X0„–)ði”øG_1ânÅ EP™†Œ ³@J!:RÈG2WeL7i‘|œGƒ”ÐR¤¤XBy4H™Hž]ÞùB¬d ¡@ÊGÒÀ*Øäà‹‘EÃñ•XQo @çàfäÀ £0Hq¤vF‚1æ*œ= 4Þ·§BC¯€¢ ¤lÅVÞ}Ê]+t5¬]u`¸w mסîþÑ‹¥Å+"ãXx?©Û©4^‘›ê>ÿ?þÕÓ{Ÿ<øøFÓ¦0buEçhSu®HBä5^|p|nŒÆ™¯'òº=>_˜î!ö›¦ œ.‚»Ð¸Ì¼Ü”½§}ÿÙ½¾ºCűáþ.RÙeWou×-‘*‹O]. Ó‘žó®Þ}X0C»jKûóÕÉ.`;’/lùþ?žÔç ‡2p†\ëÊ'gÅï¬ê;S¥5Ëkf™ž"à{µN¸øÌ¥S‹bQŽkÉ7þ¢üÞûþ´’”d†Aˆã-qàÒ¬Á [Ig­ˆ#qàÈ!H¡ Š3H¦‚9HAñ ÊGr6Ô:°')¤l»· Ü š1@W„)¨]{;OõS€”w@c@ó|¡:ŽA ¢3EXAŠA”ªùè\1Hq1H êôñ 4ÿ1 ¶h¼ƒÍ\<Å™–„j¤&ˆÃQÐ Eš9¤ÀSNTFcÜí“€ˆ*¦ùÍ‚‰-S¾r‹Ìæ %zH9? ¤›½Q¨|£ ê„v.”d5rH™¿Ú¶ [±•w¤ ³Ê7—7ŒÞùæ«û7oßûâë]=RµZ T°ÆeABê¾Ú{ŸÛÄàª]ÅjÐ1xoÓ`oùÚh7ÕŒˆ]Ç®¬žïç,Ыó¯\i-ÒÓò™'ø††{ŽÒY¬›¦K¸ðå“Î|/ENywßѤæmݤÝпZ$;mjú‘½çVΠõÛïjÓ‚ÜèD¤ $Õ²b¡ÆYðŒ¤íZ¯Øòýí—«wd‹^pžY‰ÆUd–€¯æõÞ|””b=Ò›)5Ú{MÖ"øOè„ÀD*8d“’C»‚!{o¥îãÒÛ29L´Iù(œø¦Œ.¤(«…M ¾NJËeˆH“§ÀB% jeŽ|³OF …j&h{™ÂIhf“-\&¾h#H!%´‚A›[Å2eNGÊ%èSÊb 5)… ¤ 4cB{Ø R.&BEø:H9sQ¯R2 Â‘§b m{…­ØÊ;¥î+T8ËwÔŽÕ/Î/=|ñÌöÂd•¿›p¢;©'g×Ú³‘bJ ~_š_Ô>váÄ]`lȺö¾û5IaPݧÎï¸ü,‚¹é½C'.Ȇ²ƒ³Ö |õAë¢Y@*Þ@NK¾xãÉñEIœð¢=Ý·[JãœyPÝwƒ +Î|bzdQEÏÕ]«‚<ÜñÉÙÒqB¨öðßT~e¬íø¦Ðè(¶Èl%æÖ#\´«‹mKŠ p¥¡u3Ô±Aë¯?~Úiõ&ýp¶ˆ7RˆÅ‹ÒÈA—9£³Túq 0ù G~;r¡ï˜Ðòe¨—ƒ =¹#a=ô+€+Æ}_x³#WÎàbí€6)ÙpI ¤ÀŽíÄ‘!uzOÅoÁ¿Ùøuf¬¼P[‹0” ªU ]"€W»°çrŠ°óT’f’4®Á·p‘«!W†4œJ'àÃ!´ÁwQ¦1ô èX¨b"“™j³vÄSìʈ´‘Ðu„\ùà8¡pð­tÂΠmØivHütd‹‘L9º¨`Ú@ÊVlå³Iñ~FV¾²Ñs ¦®r~¢m·VWdáþÑû «Йš«ì}IÑ¢Cõ]ƒ—:»/õõ¯HóA"²ÏŸk. ÷ƒŽÊÖAJ"™WÛÜÙßv¹ó\÷±;§ ÒÄYÅíû·¥Îái¸5Çû*b ¤³4ouóµË]g»/¶îM Wÿlþɯ¾8b”¤Ðé˜7oßõÞÖ£§æǸYóîóÎûöŸŒ tŸ¾ØsöÜñÂÅa,´}¹Fžþåî_& ý‚¹U=]7¿ùö7O:;Îî)N%~³ ¥‚á\%òj£³"BO6%ƒƒa‹D¶*‚$%ôô"bC_8è¿M‘ú‚½ÿ‚zàv e4%~ ׌\éÐLžº c]¤ÜÃõÃ=ýFEéd&Fa±…nþð¯˜Üéá'@<ˆ ô[Æe2EוH÷ÁÍC¬›ð7ü!À˜ÁjqÃÀo&úM_§Ùõ¡Ï§ ‹EðY|*‘M ! $…­… ÆP¯P9Û@ÊVlåÝrA_/x) òTG Bgɬf+F 1¹A‘,Ò Çp£çUáû¾zï t}Ê<]L´—œD›†z*#õó—0—¤@ma¢ˆ¹ú”…AÉs•An`;è9!q|?«€tS† ÃÂfHA š©d´<&SŸ* лQ.èzQlš@©q±Hq¨®‰W'- NŸ+Wk]¬JR~©ú¤ù© ƒR³‚’Óä:J-&Ö$ÄóáS8e[/zapê|}ò‚ ÔLMxû›”¤ ºÏÞW=Å[íÀVݶ™|õû^ð¢ÏðpÜŒ|Ø wƒ ¯€Â䛪µó1¯M=¡6œ’’ÂÅû^@`19ï9N¨ < ^Çä“Æ7ƒJpmãn£ÚF¿”%0S÷‰ÞÚÀ ›MÊVlå©ŸÏ6÷mx!»¿3©WLÕñ²E΀:¢a‚`aD"€x“›ÿ{tÌ8þ+2|€ {_¥ƒ¯tŠ¯Ò·ÀšLp´m !B=¯6 C)켕УD Àx<îw™¤¶qx7YÛÀKÇÕf+¶b+¶b©w¤˜|lìÆ~6Ê2渀…ð'ãS0ªæT ó NJ=8±64–µ‘S¼Áã ± ÉàPB-û˜jýl>0l=£màʸÚlÅVlÅVþQ eŒ“²Ô›*ØÛbÛÇŸ终&’œ@dAz*Ò,æ×âÙçÕFºXN¾^/'ål™5¡C§$»ÒW5®I¦ZD˜pn?´2#±ß4E€§R†Þ µÔ‹÷$¬F"ÀÚ¦Z©íuÆôÍ‹š…/úˆ‹Hã.Ó{ª<¤Ëå­†oØç®b¿©r›èù}øüZ›ÒϵgÞfñR›IñÿJHäç/ ¥‰W„»>kRÑ{¬@b/_˜U|þÒЭ®¶m) ™|uRÚ‹2×7œÞ¹.i4ܘ…ýÊÃÅ¡QÞ*­³Ð’IL Î ˆ t{•£;^€AÜðT¹ÞÏÙ,ü4¿d2"rŽ\ýS.„û<äé ÝÅa0©Ä…L(»íÉáoèS§b™µ´ÍŒ–FEÍVü„„/hfø'©Âƒ=Ä&wtOýÆ­'ÖfzoÞyâÚå‘[gÎ4¹ƒbw ÒU(ŒO“j4/ÎB¿YáEM}#c-5©Óù¯ð]PNt“GJ#ø¤†õF‡~Ž4‘"Ókä ?E¸(Òâ7·¶øÑX‰Vë÷ÖƒT€8m÷±óõñ„Üñ9ŸIºÊ£åQ±lµv’˜DpQã¡ŒÆf…ÎËOŸ+ÖhЊ¶Z[€oXF`zvHr¬·J3Y/QpS†‹¢b}‰·îmå')¥£(}qusIѺصgOìÍðàÃ0´[ª‘‹¯Š‰õEäi ·S°…J¸ gAŒÿšÎî®J•LæôZ ¹û*zúk‹Sgãý…Ž²xb—'®ÔæfØyã&©9bIÕ“O./˜d ÚÂ.Ð è&\¸ŸqºFSKÏ]Úž§§ýíI–(,zWïé#…þZ•×<äÑw£°#gã‰yV#¶ãEä .°v¶DÎÏÈÙ“Bäuô¿7Gðo3ù?óÆô$¦Œ˜â£Š W9â¦CáQrGü8&\e+g¥Vº´;2 C9M¹Œ^Ê@O9½Üa4–ÂÉTv §ædVDRqRZEgÃÁt/í n›PRÝÕUžà(ðŸåŸUõÑG=9³Ía’ jgGí<õ¸}EvžD.âÆ—¢ r¡§:)P»Jô³2kß¾0†±6c¿áO c~qOR4ƒ¦1õ秫o;º F#‘-oC¦@ðR\›bbmŽxa£!Oá„cÐ\§gMfnkïáÍöÞ :Ì™D¾ñÆÛд¤š„|Ýá+ü¦)ý|–ÜøîÓ½ÎÄÖ% ŸâQÕؽf_:q@'ÞFU…£Tm {MßΤ&¤ zãÃiŒ_:¾6è”+ R.<ÖuãR¦Jü>[ΰÒ6ª6g¾Ô%¸º®ãXÞ|jIZ)±A’q ¾c¤kàúÕÑ×Z¶ú«&oñ‚œºÎ®¿øúÃÚŒD½Uº6ΑO‹)*¿t,+UÅàà—š–ƒ§2æÃ0€@/·ÉWzO{<î ´ÛÒiÔ·ÉÝ›p×m-mhÞ¶vÕ¢ƒW­u“†ê–¤ÄéÝD*Ïà¥iËò´' m…äfm]“”S¼¾lßúÍ E É”9âüö+WvORHìiܤ~¦¢u› õB •]Þ5Ôr¼bÅ֪…Q1zg®Ú{µ7?øü^ûÙÚ¢-IQ~~YÉöVßüã_>;W²·fU~š@åï¶$§hWÖª]ëÊ*ósãgŠ)³ Øýf‘AžRµš,n ±¾µí|¹A¯dÑ[‡»zëÞŽŽâ•iÜ üÔ¥9<&š%&`Mù¶ò­1aóªÖ;¾hå¶]…%Ùl1Eå®I ]²>!Îß2Ê Õ •¦®,­ÞR±{ÙÊ´™`uˆâÖlÌXV˜¿µ|ÕÆeþ29$)—ï¬Ú\²91%Ì9%\ñ™%åiIkòwìÛRZª_T¶ëÔ»ŸŽœ¨«ÞTº1*Pëb©´¤tM’0eæ¶Õ¥U›wnŒO Ÿã¿Ôù»JÓRÖ.Ù jÛâï¡ŠÑeï\W¾gÅšå)[·Ä‡úÁÚ0ÍTBIõåö¢¥nàŠ,& ׆ŠÝkv´´ t•åêᶠו>þФ`W¸*¢"+ï<°Ö— Ãë<ˆù)RsÖ,.Þ·qû†'¦pA^Ô, áNfD-[®ƒ¡aŠØʇ·0Hás…4\™^¸|WÕ¦]ÛSÓÃQçûÍ4,ž¿yÏæÝ{WoZFè5f;êÜšîæC+K¤›ºdQQÕ¶Êê [—JI-K¢™·nÑú-Ù*7–îÌÈu‡o·-ËÚºwKEYÞâ4.6Ø°²4cîÒÌÂÝ›+J33SñWí;Óþñ/î^;²y÷žìDèL¦0< »pÞâÅ÷n«¨˜—fðP.X°i ©M ’df,ƒa ±ó¼¡_>Ýoð×Q0‘nŽ!'s˾­{ö®X™ÉQh\¤+‘dÈ/^_Q½iWQrz˜;ߪÐAºª’"V”oª¨Þ¼kKtbÄ4¡fV`ÖüÍ»2ò·­­Ø¿vu¦¯LÍäë¸1KçoÝ»y÷¾µ›W†ú»€ÚÈܼEÙëw®)Ý•“ŸÊVB€s#R£WUlÚ]½©dSD\˜‡0P± ¶ëÞõ¢¥[ *jÖ®Jó’€*é¦N‹\^º±bïÚËõ3ôÎعµöÆCjInMŠöc——HóâÖç®È÷‹ˆ#5|ø?_6ä„zX×{Ääæ¦í»~÷þÉE©Ö@ Læpyæ΢ý#ŸÞmkÙ¿¥bGR¨ŽÅ׋’Wål¯ÚRQY°._è‡Å:Aü†Ì¼i+v¬+¯\¶"K(S±&hõ]äªyÛÖ”W¬[’\´sn´?‹ì·dÇšÝû·ìÞ¿uÏþÕ˼ä6½âÛR=¯®®ãñG_|rsäÖíÏu¿¯nËú%«N~Ûº%ÂS¬`gµ^êo^™¦³ç©s>ú¯¯zšlÞU]´wµ^#}.H1ùZŸèmEç:[Ú¯œ‚¥ãÌ•¦•Ùq³¬TY÷£t®;×Òÿ¨ïL®@¬öJÙ¼öÀèýOokÚ¿rƘp?íü¸U»ÊG~üó'Í›wU.^”ÂS…j—]øô‡¯»+ JO÷>íܘìW„ž[ZÓØ°aA<ºÓ2‚£béÎΫ‡¶'Ì’PÖ7gž7ïbÇÕ]QÁzŸÄ#g®µÍV8‰ýÜÁ ’õU>þö—ë‹søb ­›$4²òë®]úü¿ÚÒµ~ØŽæ“Xv°o¨:GçÀµ)Ú'~ÛÞ«w{Z¨Û_·Q$¿/YÝôè“ûƒõ[Ëjk¯ 7W%Í‘h< {›FO75<7ÜÓypn˜äg^2grUïýw6—íÞZU67)Y¾uSýõ[O*_µmM¨~HQ!cs"ž¹5xº±áPëHÏåšôpÒ‘¯ñ Ü8üßÿçÃ+%»«v,O‹‹ Xz¬mìæù–ûÛîýâ/ÔçcÌuÇ&–··_*6hÕ,¡^0·¥û^_]}ãÑŽO>ý°§â %ÒÎŽØV÷£ª ÒŽ [2Ó°ÿêç_Ž\nØUY½µr_ZXhpáÝëí¹b¥jzHÅÁ¾«{– Lj RLA ‘Ws¼³§áÄ±Ý Wk³¢uNÜäEÍCW;›w×);¼'.ÖÏ{kW}EãØÙµó@û=Ôéy Oî÷6ï=VÓ\¤g R–ÖÝüü‹þš=ûv5 Ž–‡¨GIî¦K#ݧªO^éê*[ipN¢„’ῺÛsäàþíÕ5Ëùů^\ÖtöÃ/nvU¯..ÉŒ3L á‚-íO>þ¨ó`MÕæŠÚ5ùáÓü«¿8»8VçÂK©½Õ}"ÓS¬R"ÍŒÀ¥…-7ºÎו8ÕvgôȺON½®©mðjCÝáÒ#µ…[ÒgñÍ µTL"øLåÒÞÑ›—û'-ÖW47w]Øšä,òW¯¾~ûf{Õ#Ç-ÎK-ÒËæ¿ñÍ7½gëÊƾø~hS|‹W~©k¨³þdKóµ›—óE2´$÷_¿ûéísÍûWnˆ‰D …¸Îh»6U°Ä§t”fþÓ·—WGNµRp²9úˆæ,¿4t»!;m2 •¤n-<Ò3øôÖé»WïØkÐ:ñ"‹í©¯+;Øt²s ©&“D~‘!bëí§_Þk=y¸hOÍÆ­ký ¥Ó8HæW5Üï8wboËØçûUÇÚ0~:o늒ʪ³—îÿêá…\‘ÂRo ãÄ:¹(³¸ûÂåã«vµ]¾z²`y†&jÁÊ_µl Ÿ.Vø.8ÝÚsrYªÎHäÔÝÿuûÚ4?̂Žÿ’ÔTMJPNAJþªdTRóó5Áîk Õs««6_"Pä6µ–Eë2ÈcçúWfÙt:¾\yô›_÷åÌBaG,Qˆß²s7t¯WÙqµ¡ç>û -ÛJOAâÌS£÷oÖ­¦±ˆQ*Áª =½3ü]”ÜÁâ'/º|½¹2m¶„ô ØTÖÞ_>?œÈ>X¸4ÀÕo_çã£{ÎÞ¸xpCTü²ÅÅ¥‰a©‹ëžÔmX¸ïÛ’¤¸ØmU«ò3ÃòµôœÎÔÉÐÇÛ<*Ê_™W{ñvç–´w™~¡sȧH ên_?Y?K¨Y{ñÂ¥eR2P^xïÖµµ*9MWXÒ5ÒP9eŽÂݯ ëÏèßæÂ#Xb­›Pa7G:+ãpCïøhU=Áâ,×mt£k•R¥ö ØVyu¤¾8ΉMN\ßû—ßvoŠr‡¢–ÚM¿òäÍîÓë…Ôʆþü¨6;”rzøö=—ûj‹âÜ8„‹,)éèG}§²x2=/õäÕ[Ýå“tÚvãvÏ&6_ö.íŒàý]ûö¯p.÷ÃCÖßèmÍ)TÓ ¥UÝåK‚'€”’¥^±ñÔPkýj9蜗×x»­*Ö•—_}øø–Do•ÿt¥ÞC‚É—H'_?}ÍÈàùu*-lÆŒ€‚ªÑo¯¬3¸Hôž„ÞCL8Š’l/ T’3#¶~|ySéœ|þÞ'-‹âôîâ„ä7ú/.õ’(œDñEC?|~v¥B­a‰´î é(Ýý­èkÜip„`BRó7ž»=va‰ˆW´îbÂI»÷êǧrbHÅ&¹tlîô å" #W\mŠÕëg¨ôâ·?»Y¤TEÌ=ÚwõÂŽ(ƒ~º­+Vˆý=‰ Yd §\ý.Äaq»¿ûèl®Hë?M0M¦u›mÆ‘ÞGcE1Š÷ÙA9·¿)O™-ÑLU{i ³‰PUö‘æ[GçEh\Bïyfe²¿‹(!aßpWËòYâÐÔ¿Ò¸€KúOSèAm.¢ ÅÂúáG#;Õ aÄê¾Úå°óÄÈè‘â¹^BñÂã­÷$hœrð#§šVælJ› ðwš*p4K©s›ˆšÁˆ‹WŒýö×güü¬«û`V™oÁ•áIA k?T³Kô6-™§fññ(h¦“ð¥³T‘úu­úv@3‚öÜùdì@zŒ?S v“ø¹÷!œå™™ûÇ.ïTŠ‰©»þýëöUH삤YYß>rnm¦ÞE@Ú`åí©-¹›ô¾þy vw4Û¶èÀ•sÍE11!Såi'¿:5¤ÈœcjH™3 : RÊÉAÊM.ŠJSG§’¨¨cxj«Uu_wï‘ésŒÜ}¡^uZÔñÖ¦‚œ&×è8¡ j¿ùuÞ Öã…ú/k¾:z*^!wä+|¶<úüæ&™Í¾|ŠÔžgLÕ¡bHnïk*ËJqÀœœ.aGî}ß´Ààç*"Üȼüãý-û‹VÿæÛþ<îüŽÛck ë;ºÚkV—tÜ}8Z_V²óTï²ÔÀøŽá¦ÝGú?yÚ]µ¦âBkÛ.13ã™Sé*§¯(¼ô‹o¿¹ßyñäªE‘Sù¤nuíZ9§W®:¾{µL\û¨·iž—Hé¢ÈYÜ0Ò~,Ë}ŽÜ]Wpåw_ì !˜‡Vaç%Ÿ“y¤±¯&1ÆÂdÞí.²¸„†ºë2½$*WÕÒU-£çäLg¤º÷´,D2U©<ôŠ/¶T¥»úSµ9»¿ø >”(,hÝùKWŽ&ÁD`¤›jÁòkwNUÄM‘3‚Kkº;'S÷A¢nMùÅû–”ñHRÁÕg{O¯ŒCW /bxȆ½çžRSCvT^ÿÓÿçŸÿãøñß÷ ¶"É“jØ=öÁ—Ÿ ¶–mÏ•i±™Cn§Útá‹á²Ež  "ÂUYùðÛß}}sàbù–…‚dS–ën=¹V.$f„­Ýý¨§x®Æ{ÝØGwv´Î|ƒ¦°§¿¿B!“1D ÅC߶¯Iœ#&X4]ÕÔ€ì•c%¡,.þ(RN 4•FÍ`'•£æ@J±çéoÿüï?üøã?þñ÷?|ûäN¹Ž }2ž¾ÿËÏ4Õ•%Ç‚|”^”Þ|ëwÿþ—ÿøvðà"‘vwjÓÀ—¿{z áØö˜˜ wRs^¹Õ¥‘Ú±ÉÄ¡oïœ;[jЭ:uåÃß~ûÃ_þú§/êĪ¿þäp²´´Z(W#ó 8‘j\M.|„oú¹ŽÞy©ÁÎ<:ìHœ~ñ»šÎAû³,5~Ûåþ;Ww8ÙÓwnñ±;cõ‰ž5çû»_¸Ö^_S;tãì™=‘a:ѺΡcµ{®ô¶ºÔwv_†+—Ê]è&1&´ëKá( $®Ê«¼úɆ’¤ºKiºÐ½V®ò#+>>—å#”±äygGÛ¦3ç(<H}ÿÉ®`’:`šw´±ï@\4aæÁ^§_J©Ü¥1?êo^à#R8+—ž;w Ó݃ԓbR®~k6·Þj;´ÐÃKé®]vâ×Ôå@rS¬Ü|®¯¶8Õ}Ž«"#û½s{=…äÌàŠã½F óÛõøÃîE3¹ù“ ^}î|G™!@EËV¤ªN÷ž^Kƒ”(Ì°n¬¯5TÙÁ«¤!HÅ*ݺ0o:¬M鸵²c¸¾,‰5Sbç+yßKlÇû†ŠÁÑÌ2d%¬?qöÖæaSÅ$“§Rï|ü¸{»¿¿Ÿ³Ñ…CÌ0,JX×8ð›_4ÄM—$/9ÖAJDÔÎ µçâÁÕD¨™ƒ¾¨àÚ6‘Tî(JØ9üËs«çHL å@ªk´¡8îÉB Ró6œê?Ym)YyõãæÜ?g^|Ú‘Ñ+Ç1H‰X™C¿zZäÛæ"Ž6l¿~£·Äwï}˜TKôsoHêîÄQº(ãüŸ½÷ÎÎ`6§ÌÖ†øøf+0??éÄ•8*²Jv_þx ­4ÜO'H Õ³H ¦½:iøÛ»5É^‘»‡†Ž—eÎæ)g'ìnxИ@ªáÖÓºá$“iØ9Øß±C ”18'URPNÙ¾îOú[Š‚5zé‚ÚΗæ!J»õÝ­}ñ3£¶æÀ4³âv×Þh_‘0B9-²öÌ@#¤9tö 2«C¼ýB½Õþ˜“)ðç$—ìî­. váS.%“8EH¼€€yûä¢g|à±²ˆˆÙÉå5}‹ç!RhÔ%¶®ûnwÙÚ¸ilRÛxalw„ƒÔhgý?Re)hjýI™]U9KNÞînZæé%gÉ3|÷õERài^AãàÙ£`8½ÙØÿ¯Q÷m2Ä;êo™Ÿ]qôBÓ¦Õ±³d~®âˆ´¿¾ß˜9SZ|÷éí“KR&)?vZcÇõ+‹cýÜ$ä„h)ôO±ÿLMˆ·©{ÊÔ.‚)WÃþS×ûö&MÇÌÞ(Ę»óÓ?.ñ#5L¾Š) Ñ.m}ú›§­åé¼° ß}ÓS’è ñKω¯8ÚÒ¼9+€ ÉEœ:wÿõæšå2…Š)¤ž1Çî|7´Ä@™¶Y"ƒvñÉÛøêLí²ù‡¾üä÷5æ9Jòö<¾ûøLÁš¢=ÿüaû %¡Õòáß>?¼eMÞ±;£Gk–øcÖw°½‡/N D{‹Î7d^bþ"™¿A0·öÑÿÜÛAÚ©žB‚TÎLî¹ÿôø¢”XUÖÉö›ý»óµïy«H}Zj0)ÙôÄ';×-P3¡+‚iƒ|þ¡ÆSGÀ0A÷-Q 4oøƒÎOŒWç´\¹ÑWšÀàª=1HQ’Á”&¥Uöݨ_´iø7½w$;È™çç;¯©µçhZÊ A<"pÓ­±ž•2Y€|ŵ‡¯R6)I°¼`ì˧%AþS¡‘]ÉÔ,[ßÜ[¿7i¶Ék}H õªüáÛ£›´ê@IÞ•Û»+–BbJÂ4ëo?½¿Õß/`ª˜`Š“2ö÷Þ>µ,#Ò' =rź„T=S»,WêZXÑõ°µ¢TÎêu5Ãww/Ÿ)FiBÍTU|ôâ½!Ð3`Cóçß]X—0cH•Ì×:é*¯|1|pó\ITaiçã®Ã)ÓE*'R­ ¥rÓÎÏ>ó¤¯.ÙòâÎ@ –¸°éã®’Ü w}aÕµÇH %ö¡ßµ6#j6ÔÚéyi.~øôÔötŽ:\>okÁšxO‰LËÉLäø%Åíì{ð¸"‚‡ÈòÄÕñiÑÞDjú¾»C*cý­€”w侦¡ÞªÂhwQ|âÞ{¿ùåÉ…P’júä÷O•g+£·ìî¹ß^•ä! T¦¬‰IŽô"Ó~4t¶$ÜO/RUIS¹Û»îôµm LOÙ=|çîîÈ@˜HÅ-¸ªq¸ooaòtž’IëÌ-Äð¥)»õß¹p´@#2DúXš; óT‡ê¶÷ÝzÔºni[íµ^¯_3ÏàŽ%5¾jztñ¾«C»W S1y¤N\½{©0;ÈU1?ÿÄÇß}TAKR– …æ°GHeûhí²´ WÁ’DGlí»w~yj¹¼ûë¿u~U¨3'$¼âòå‹q‘ZgÁ‹pïØÊ?”ý}Ýæ¶5Ayª—¦ÅøarQŸ¤Ã§‡ow÷´¿p»¯ëТD7@¹`ÿùë•*Œ/˜qBåJæ,=vcìî­ u+ÔjÒjŠC+e‚ º½hÁ¶s÷nN™ÍÓpÒ«w•F ?­“$1µüJÏØýÞΖMóuh»V8Ÿ¸yoäÖí³•Ë´~!êÅÍ7¿üìJû`ïý†.îÐk°|g¬ëê‰ÑØ"æ·ìâí›—‹éøKÕK êúÇîŽÜ¸v´r‰ œ+„šég>½Y„A ~éìð՛Ʈ߻|¹½ãë»G³yÉ‹ÛúOí[ÈQF‰é¶î»|íjkÇÍþ¡óÛú#r­g`aeï½n6lLcËtŠåu-= KÁyؤ´ÑÎ,«m¯ËŽ"œèÝlZà¦Ò‹7®õw4œé½Òߺ-'Ô×C‹ªî=;±>ÙG¦ö ^¶üP÷Õ·nÜìhß›‘ s¤åíº|ýöà‘‹çv'Åh]…:IvÏð`iHŽŠÙª§ª3ó ôŒÞºqçÚ…²ƒŽ)L\TÝVh¥TDxVn¿Þ¶)ß)ˆ4l:saèöÈíWÎU&EûÁpaÜÆŽë–ÅÏ›Ø9X’P"ÿLÏÃ;C7,‰ž) 5wűK5Û"=Å´ç3?&ª´£{d¨õ̹“½7Ûö§ȃp&Hʪ¾÷ £®(&XÍ”ÅÖ6¶ ß¹~ë^ÿõ+Õ›¦‹ƒõ+Õ÷ºÕß¾´0nÆÄ"øÏ m^Óé¡[`" ö·l\ž8[¬¤ì9uí|†FfÏQÇ\yÒ[™:S½íÔÙþë¯\ItÀº§¿üÍÓÇ÷†oÝ»~§÷ØƘ©V½ûÄY‹FF>úæ›ï¾þðaï±}9³ùJ¦På^ÿä÷½{—…ã0=‚ŠÔä’kƒwo\nÛ’ìÏ’¤Ì­¼pa`ðÂŶ—†;»¶‚ElXßsºfµšÀQ3”—ïô˜æÏþй+7©õÀimñŠcÃ×ïÞê¸|æÒ¯?¿°ÂàÈ›»­óáÓ¯>½:G©uS„óƒÂgJé˜,Bé£ÔÐìñÁœd"6]ê„°+ð÷ч@Žw>鮊àÙÅS:KÃÅ)DTŒ/A2Øb;_%SäÏ šÉ“:°aV G˜’IÆàk=5 ÃÓÕ1q\L/ÒN%"%†(¥šÎA¯®‰SD§‘Q1lRëB9äòÃc½%¦nwW†ò"Óˆè4ýÂÊKßo ']Âw7^«ËMƒÄïfQºYþ ÊèdEh¬Ð>ÍHµä?'(‰ŒOWøëÜU™ ö¶ÖZ!¦djwu•¸a³e¤)x <DÄ$I 1üàH•†ªM¬÷ JVǧÉuzw1„­éêhYTš:6EnÝ¥†NãúxðQê˜Dq@ ‡˜p•'§TöÖU${Á—Ò ûÏÑ'(cÒ5±Ib=:*øÍò‹äê=D02×Çé­€£ï æUx*¬M€”TÐËÝ;(žKø™2`Rƒ&ŠLÓħJµ˜“A7Ç?Š£ÑºŠŒæN%JU…Åð‚cy~:ŠÆJ žª‰•Ç¤¡á  ÞIfà…¥ªãÒ‰H04à4¥™FF#RÕ±©Ê°ˆÙp¡Y3ÙC 1J™o ›)G@y/8r&L7@zÅ‹üt@ qWÁ"¢DA‘œ Ð™RÂ9¤~øɉEiÉ ÏEú4²šiD”×:C†Ú¯åGÌ€Æ8rFp‚H«ƒ ðL$bÀKÃQŠ¼FÔÓÈ( 44'ÔC¶aŒØtuœ2*•ˆ¯%Yªm³ê‚èö™˜T" D’4çß²Èh6¡¥¢ïÑržFFË¢ÓÕq‰0g@Ç‚6D¦q hÜ. ÿÆt2š¯ ÊHˆ­´áòÈ(0ÓŒ œ­äš´¢¶ï?¨JÒ; ýÙ†hm\º&.MŒj°ÁÊÛD‹•F÷QŠm<ŽÐ±±V¹ûL"Ò«sô™„,óèwŸ#×2,ׂJ%Ôù©Þ±–89 –7»Í¬ñ8q|ÚÒ¨Dƒ‡Èd蟦ˌX˜âm™#~òov™Èôbø·:rd(q¡ qãæÁ¸B&ÒÞ£¸Bã Лò#±åTC¾e{,{c’O˜Hs÷Ï9Ñ+ò÷×í¬Ü_Ú4<عYÆWMÏ‹ŸŸà ÓAZc¤™ô-„«2V37' <Àyb¤˜¥òd’Ú&4øFÁUEÎÏÑû™‘)‘Ï>õ³Æt’[i›•Û^u>ˆ¬÷ísèƒ,4ëÕ‰w‚¥rrôÉ‘¤`õÄN˜¤6r²;­¶ç…h‘¬+U¬5xü$™Ä;Èj‡ ­e»s¦!'k߉Òʪâú¡ƒåZ©zòål+6ô×'˜… pntÁâÍ2 %ãOš&ƒOGô›6j´ßÑ?bZRù¤¹<r‰ÓJ p\Å2ù&¨\á©`zà¹%'5·TUm P1¨CøëåðPLœ‘âà4í‘gŽŠ)0S[™°?«—//^,'ÿ‰>ÕЫS›Ÿ»2)oe".¹+ãÓ#<~r¶L+p?Õ/=¾¨þ`Ó™5%q¡j' ’l õ³ #.˜Bý˜iÐìnï ¡|‘þÀéqþ œ• àN ÿ@ñ\ò)¤ÞЗBßiŽÜ¦S´Êoc+ÿEH3@ ÿ‰ Ì6¤éçù'fÒež_”Áý RÔÙƉk›ö6²¥ê°Þ@pÃÀ„¯€ß?ŸmÊQèsµÃ$ƒà"€0ãEðû½9ª÷¼¤S¼%vìwŽmÅVž«4 ·u‘ ¤l õÖä“2Ïü>1 “ÕÜLØRàbS˜ÛŠ­ØŠ ¤, Iáȵ%=|ó6)s„šøÛ„Mp ²áÔ¿`!'ùý–HCØlaðúçµä§Á„Ö×àë¦M£ˆ;ö'©g$=´Ôë‚”¹&d½pê"ëÎ$/¨œŸlÃ1ùŒKÛd1Cž•÷90j9©¬lѯ¼9Lò!“ÕüR/2óÙ›Ôç¹MzvŸtyÛÒÓÞ)B¥#LiA‡ñ¾šêo2I¶úñcJµäÅqŠ|±‘ÂQ„| Ü˜Kå5&!ñS ”µV=sɛԪ/¾3¼‰f{P:ÅÛ¦î{G@Š¯rÄ.åÐçœÀ^¸L¾Ê‰#cpi¢œ ‘/G9näÐ#‹ø% §:uѬ#>³qŒ·É¹ÈYQ!1بÀ;•è°¹©ÁÍ0»"×”ÂÀèÄ3=±eŽîŽÈgž‹Ó{á; HpÍV˜ùÔ‘,ž©ðul9Nb…IŠé›ÕlÜ ”ò+ñ¡s>ÊîôªëW„?DåÄ“Ao±r˜9 ~ߊÖ‰+sð#‹½¯¥$ƒy”|¥ø"(phãÜu@gÊp3p¼Ü9ѱéÞà*Y/âB…¤Ë@ :ÿ£3ËÄUÛ AJþ$[·ŸÖr ¬dѧPø9H;áuAŠÆ}s2®}Áf Ú©ÀGV'JÃf¾_A5•Þ)‡gAý„²¨Èìàê¶ÈŸ†þ_¤p–4Øù\Ò„Y «ÁËU ½„yH²ã`*Z9†4Š.`“7+Ÿ l9L¡s¾”Öˆ á!)á~(4·.!½+Ry9òðó°,,DË{*Øð¯¸I„ -ÕËè- ,Šâ^å)ͧxªÛÁ ‰¤'_9M§,à eºÍR†àÃ+Âb&STJ¬+sĺDsÂßBu—ë´. øpÏ8C=œót%p¤èDóŽ&†gKû ¦1ìR¸&‡PÎr>0~Õ3H™åàPCx!¤û“Òà‰©ED”‚šù·@Ý>S(y¡Ó#ÒºÈðÀ™)Ì@Š^#Î< ئ€ØªIt<€£¦E‘`«ÀHI°‹&•¾QW {i;1HÙ\ÐßMIŠ²)>)6R;ƒ`åòðI[È`Qû`5i:ÎA¼’‹„Á7™›ÑšÂ¶ X“¤è5nR˜øœ¬˜"Œ†àAx4ž)”9Í®‰í| ŒÉA2Ÿ^w¨cÒò‹HÑg¤„/L–W,$©I@JÉâ d(u,*Ðö¤Bz´„ñE_ÜÕøÀ pðCÕhQ…€»7Tý™QŠALA-0í«Î“X¨±øi‡ÄO£Ú, °&Çh¤R QjÔ$´©bÑÕà  jW XMcTŽpþ(œ0d ;?7dƒã˜¬À13F‚wÇ‘\Œ_Õ}Ø® º )Žà%v ,Æê)<šP¶Åˆ/0'¶£Nï´®ö³ ï‡xŒà#@ å @Ú:H!û# ½Â4·©•b³ V2‚‰Õ S|À*‘’Ô ± JP~AŠ0¡Îœ PLkh.4eßb>¦àA©ñŠuøTfç›ë …zX‰ RLŽŸô,}~TXÙ΢”H’‚³NˆSPÑÖ&P€=[Ÿ±Æ Pu"H©ÍAÊžƒðŠ~¸J¯>غ Ï$ø`Üávæ!<¥€™€”?¾øÃ4= ¶ ¤þuAŠ2$Á]foôEs€v€Ú6í€%z¨NW™"­Àêð3Mâ@éáÉ—)0Ù”k‹‹6p,:Qª Ðl0oÄDøë°Ž‹D«òõAŠr¸2ç|3ÿ'Lë "_¤(=ˤIÃæx°½ˆí8Æc3u|uä@+›QÍe&„˜LñCM·åH‚f°K‘žŸ–Ci7'º4ŠŸpP 0 ‘Ëž£ ›¡Æ2²ÏØuhS‚9R",ÍÁ½)Á°½Ƚ{h¦–£/Ö»bU›„⣰h•ÒÁÛ¨§…Jfk®°ºO I ̨‰¬*f eÔ›3€QÄ&0/¥±÷°òô6˜Øp ñ©ªœaq|°A–œ ¤Pg"â¨Ì@ ~„W-2˜P&uÒñ‚¥BmF€ËE¶$-:@ÿ%0"Øâcš<‚Ö%’fò/Z§fÓ,J¬¶)ä´¿ J»ã@ ~2<ŽÂ9Ã!-AÊœ°uµ%H¡TnrtÜRSgJ^-…E±ÊÖf¾²&)¬îC} —¹Šáƒ¾ïEpQËœðtâ"ó4¤~%gJP³·Ô²ÍÕ}o¤¬þ¶Ô? ¤ð)ˆêt‚sC‚”!hæƒé ¶ú¨IY‹ØŽaÎ&O )šÃF“î‹€Îcˆ ÍX¨:@j$š™ôíØ™æE;$¯}€k» ÅzYIŠrúRÒá .‹þ'aPôE$)«j|€q,@ íEöÞHo)šH±KUŽ6mÂÌA` Rû˜Òn2é–;š9þY‚Þ@¤h×¢5{|X RðÀMÞ¼ç€Õç¸åFæXRvHÈb¢c rþ4v/’ŸRèô2)HQ˜‚æ§Ê\äœÄ.íÈŸAET|,xBÑÒþ éù½e?=H‚ý!ÍÂRÿ(`µ}؆sLZHç@mkl£>„6"`Üø˜P+hò¼HÁÅ®pÂÇ3¨kBÚ0Ä;Øœ¨P/MIs´{¼’)¤ Ï´I½8HakåŠ÷ÄOûx[a¥{!'¬Õ8àAo9åMÝÅCo‰#Òð(´±áÏ™òœL ¥Bz<ÚQ2BÝ…?ÓîJxð–0Œ …Oª/ R8Ú¿ 9—"ÁÆJ'>~—y¤Às@ îo`âMR$mTUYý ­vÒƒ-«Ù”)ÎFˆƒfVZk Å0)3 wÊn¿ˆG;ã=¤,@J> : {!<9eíâ›%È~.H!'èC O›2«6):ûeصb“Bn«Î&›”²3 ¥œRj”!*-‘q žA' œ ˜NðÓHÁ{¨8”Ÿ¤¨ƒ+“o©ŸÎqBmÕqE?-’PÚü‚:Sá“´¢%Ã'Ì’H¢³ ­ |&H™K^ …üÞqìi´€Ãå •äý«DºhìøÓ]•Î4?-›@-sÚ»o‚ã„Úªã„3¥W§î³LìbD‹ÐÝ“¤°v rãÓ¾ÁBlP“ÃÞã)i«=A­q¬h¥ub OÌOƒ|v³)ÒäÃ,°ôpÆÞ&p%)yMcu"Ôñ:!õ/í€M #+t …ôØ 3¤°Âm)fnðXgÇ6÷¨·Ì£[õ\u):œÇR[a%ô[p$© kn‘Û¹ ;lgÒ^*¾H!˜V0ž RÎÆÓ¾™$5ŽçŸ ä@sá3AJê0Q’bOT÷AÿO &œ£ˆÙ4F å`¤N |æo¬£˜èÝg"ÍvðçaNЦ% ï¾7RT"Ôçƒ5XKý*Vða“à>ÃGhE9QØÔ}ïº$EÙùÔ1{æ8SZ5æÀÇÆ&¨ÁÑÝÐX¿„&´ðrTT/˜Ê ùî*[9¹ºÞö±¼†mL(…aÞH“ßšÛÈK–Á¦ÔpÛôE2Ý¥â±à tÂVf_ì@R>áP°Bs±`h“ЋòÒ­D¢QV$cg °#Ú¨ÊÊK±¦Ë‘rW#ÀÉâUÐ,Žƒ ‘ó3êì;¡` ? ö¬@7Е£0d2.óñEÉB«û&M½dæ8Á09N`EÛA õ*FÇ JÍè@™­¡ íÈSÒÑ4”²š¹qÈ'ÀbÜ0´ÏàÃ0¿`Íq‚KP{,r;¤‚  ­GÃQÚH&»çÑÞ&Ð<‡o–£ÎDÀÍGá~"øH)Üè8)ö…C~ Rªù”êÏ‘Ò6ÃÎD‡•)¯7­euà“rƒ µQhëƒü[¤1.ƒ% thtÒŽ8€‹vœ€Gy TfÒÓ$c*SÐ‰× œ 0aŒn6Ȥ(…(&ÂôTœ”e2»”àä)§FÖ(”» ŸôAÇE¼¬à7⎥àüFÖ.3c+vÅÁgW:å+´ÉR[|ºy`±ÚGbôu‡Z8£”F-r­‘C‰6Z" —rÎÁ¼xѼHÁ•ˆCD™|«ÙyŒž'Ð6 œ×)¼ö)EtðZ e´ÌNîFRqà+p"á3ÐPjBc®¢Ÿ¤h§V*\AÛYpð;}O- 3Æ Ê˜ÊhV8v`6ŪsFÝþ$ …܉¹¸9V9ñ”´Æ2 ¾µ‡¯ÀèÀoÙ¶[ÌZ¢p4j«( Ä䀾íœÆÁŠ”W#fÁnÃp9£Î¤âjŒ½7¸R1¼pî¡Èbc_ac½Eçc»¨Ü@_MÅÞšiÉÐ*æ›6(mä‹L!“ :A}tõ—㪜h­šiLi²4pôw!ºLã»MáØ#•u1#ŤÁ¡²€™gidAx•9`'7ԌިÄ3„³sò±ž¤XØ0Š7=¦L1ÎtAçâÉl9?1# 2>2¹fŒÔB–5¦ŽÔùë eöÔÉÇA“ÑYž‡¨% Œ×XI刪a"ÏI8èR|öù76†z©…ã$´PËAùº3ù¦ §Æ=Ñ°àå€ØZØ2h¥â(M¦C37$êäÉÆ:v*·î(ês¸˜FFNhñw¡ž¤¿ {×SÄ)T—*èˆ »"vÇû¢ú¹(ÌMñcà¸`&Ï4¬àYê44 ô‘ÔCZzÐ$Á뀔ÊI$OÎ ŽO„åÅ¥Gº ÆžÀ®›JÆG¬Ý½fû®ÛJVç®Lš%O Å—–×ZþÍ :%Aü¸ 7î*ض#{E–惞ð '£—£°<‡<Ò]“œ›Mª-ô?æa˜jW2#fù¶¥Ûv-ÛP2MBZÉ|-„)³9‘KæoܵjsaL4ÎgýS€”Ê"öí•Ø/_ŠŒî+x†´ªî{19åµÚðR\y/O öR•¿,#â‹é‘¯ô!$Íu AÁ¼N1æ<(LS@L7†“ŽÅx›yä‘ñ6#  åmVkƒRàäe“ÔfÊ&cñRä?Ň`pHsû5h9¾ÍùÅø`_r¸q€*”XÏbFz“¯/ÔBtv.ž¸ÍúÁú¨á+N<ÓƉPñ€§#änÏýlޫϬmòQ3›hw}¡ÚŒ=`¼ÍÌX`eªXÎÉkó*’œ uöî,L-¾ÚZêÎW9³, 5ÞÑ[¾úÛ¯n´8qúPcSÅî,_1)¾Úu¼&Ð2ö|¼”þéÏM*¯zÜßqæ`C[ËÕSÑzW!>¨Ÿ2ÚQ„_ã*2eˆvkÀm®b›\W;óÕs’Ê]?¿.Wç&‚wNà6jfe4_èj:{éÜàƒáîÃs#H¦RÏŽX_ÚõÁÍ¡¶“O>{x8V£uyclÏ”¦Ë'‚M´—_b”ŠÞׂ»ÏVþùŒC´ÈãHj‘83&(l5¢Á+gÉ4Ï•i¼Í·ÚU&ÞŠñ6ðcbm§^µ6Ä%‘¼@Š ›k»“ùmÎBµeàùXG˜éÕynÂÑ$)Z$Ž’Á%í't þmÞ3Æ~W0d˜ ‰¡B‹½¯ä}/é{^Š)¾¤q¼dm¦9`lø?Æ«µo{…Ú̦1˜'¯J‹´Að³™R¦¦¸¼áØšÜÅ9G;JrÕw‡hHm®½ÿñ¹Â`GžÆBƒÂ‘-´W®Üpêãoÿðý÷§ú3¡T¥Wf:yª¥¶eìé÷¿ûd´.I+c˜ÙôÁìr–$D_ë­P•Îb¿iªÀéb¥½hÁÖs×Z;GŸüîWŸw-1¸p gA¨f契/~øñ×w›ö,dË‘‚Z6ïØÇŸßÐÜõñïþüÃC[ÖåxúÛ?ýýoÿç¿ÿó¯ùó_?jÊ qwîÅ’”<ØK­Ÿ*õŸT||ðfãæP§ñA²ÄQ¡;Gož rV-ØÿÝ7ÝÛc§‰ß”Òo<”¿œ$õúÜkãÈplñöp·qŠ+{i<Çâ¬ÍïÍ¡6 SL˜“iæ ®€þd$~›¾h¬ ܞ·ßjƵ™Ÿ±'Ö†_:¡6â½9ò÷½MþÒ¸6ÐfóOÀI<ß H±ŸV¥:¿mÇ-!-`räv¦H1j8ÌG ôÌdý n3“•H4j­Lëwâ?^¬¶ñsÀü¶‰µ“´¾xmãfŽdñ…ÿ6óþèËKR‹VŠ¥üâÇ¿ýíïýã_þëïÿÛŸ~ó ½:ÖÑw\ºÆ €ÔÃ/:Ë3„†DyDœ@­œÂÏoº9Ú_5wnNÎÁ{ïîÒ‚Å¥'r:žþñ‹ û—)táÂÈù*Bå$°)…}w^Yžåë4M ûv¢ì²îÇOoT„‡F…néÚà§"]j¿é.]•©[tââí[WÀªä O}÷??<­Ÿâ6Wb˜ÎWzFïØ{­eùY¸ž•“ˆTÓ‚Jêú‡ª—è&8.òÌÌš{£]å„2Œ­ ŠêøúéåoÉ›)Û¶l+“MñG£ 213ædŸqÛOPÛĨzé›ê¨·úàñ¼¡|vw½à½~m/>j¯\2 n¿‚ºo[ÞZßÿwvd`Á™Ú£[âÖŸ<Ù¸="*h6¡¥,;B£_„Æ+jÓñOÿë·]¿tu°càòÞAn»êúª7'Nc“^ñ{ên·-M×:óõd^÷Có¢Ô˜Ïy¢ºO ž®[˜]Ýyy`´»o¨õä6ƒŽ´e—_>U™é+Ððo©Œ а×Ýz0²I%W8 3³NÜêiÊÆQ°ä OÿcßÆèi"cØ13nç¾¾Ó+³4ÎÏA(Cš±èXoÛ©-:¿‰*/ÂU¹0§îþPçѵ{ôŸH müòÓ¾|é» RÏYÅB[Å·ï>ùˆ8 Ÿ“ó·½ñÚ&ÉzF¾¹¤/dy|Kç­eŽ‰=d¿L"Ô7VÛÄ‹V'Ï+×FÙ«¹ oȪ(ÚÛ2Ðÿà—Ÿ}roðñ×_}>Ö|d­P¤`Ñ.1] R÷½ÿÙåâ„9šp¶>lŽ\Š8Ð2Ø]²:ÊMx†ï¬êÙ¥sèÉüŽÎ¶Š‚ÁŸÜqB@ºÊ‚Ø¡†…[ª|Ö(}š,§¼»¯vgºOÛ´yt_\Ÿ¬üÁÝž|±ÂI’¼´ïü:o®œ)_xæ·ßÕÏ v3†ñ‰Yq;«úNdi]ÏرUNÒ¤¹Õ]ÛöÎt·â‰A¸(æ-8|¤³2$yØVšà.Í­¼6X·k.)þ‚c§oU'„®{Oßí9²gÇ’’s:wæÂpyVÛß×¥»„GàêM­·[¯MÊÍÖúù¹Ltœhf¦œ¿û͇ÝgkVmÞ‘¿nUTl Ò ª\ÃŽÝûúâμP1ÉúñRÊŽ_¿×^Wºj_߇__\®w}ÃÞ}ÿÅ ¬ˆÃËËí1ùæ?ñAÄ,0 ×j¾Z[±[±•·¤Öò§h‹wíYDÌÛ¾vÛš`µØCˆ3ƒòVן޲ÀŸ››ÈQ•›³çòÅþþÖÓ{2œ¡~O'JÞW¼k•†TZúKX¸ {GnØ|¼óbÿHO_×ÑÊ%"Á¦äî=¸jqì ¾Ú;vËÆÃëtzðx(‘{¸öÒ@gϹ’Mó8 ,ø$o¹xyu”ÞR0¸)LSÛÐ3Ü5ܶ55ÈÝHy-j½v}ôêÐH÷àXOWKqA„3T‚®egŽ.ŸŒ€@˜ '³ë¸~µ§uK~„Ç“ÂlxT¼6•#S£‚¢ 4®*Ó?¥ ÓS"œ¤ ÆÚhÞ9ŠbêRyœ¨ÏÁ™æTˆœó'Û‘­ØŠ­¼u •·Aðó™²)>0m–=ŒS&'ƒÙCìyFÜA´HsdS¼Äïy‰Þ32}!;¶âé;iøàϽÄS0A7®ç>ƒœ?Ÿ%¤üïüÿ=Kjoâµ# uó8Ê”aŠ7¨SjÏ·¢îÃ)ÒÞƒ­EÅTH)ã¦xCF£‰ 4Vå©KÞ8ãAEs#óÊ AÓ™Aœ¢ˆGLŠI†ˆFQ$8¦ Át.0¦[<çÇáS45 #‹ÐÈBÑÍ¡ŒÆL(’­ #¦ß®H[±[±”-ŸÔ?‹»‰è^©Lm˜{Ÿƒ½(†=Ì Ï ˆppb>9¤’ƒT0 '“‡ˆÐ…Ô_ÑÁ€pĹ;äÌ4ùÒ$ õ&CòmÅVlÅVl õ΃LÊ€™ü1µËÒ …“ád\ Cf ¹Å0H!F6¦z†‘`bÜñ™hž R¶b+¶b+ÿÚ E[F` QŠß’õºð„è¬ÑÖý/R*””Á,ϳA en¢™cÌÉAÊ%Ss€d•0 K0.œ„DIZÇæ={½Ø¾i!—&"V½ðQiw ×÷¨í-*TJHª¬tâ“ï€~ŠêJ'¾-†ÎVÞRaŸd'˜hÀHÜg æ}AIŠ`ñTî%åµ Õ·EÅ\y¯…SŒšXš»i_ªt´)W:…=>(ÃhS¾ÒfKe^0ÏêB@6cù¦9Ç ƒGÑ>?W’räOÈ”¹V„4H ösxÿ6G†“öZ%>¢rš{K©\ŸB*¥)ëå:YÎ0.B©EÙ»–,Š÷&âó««êêw•­”k‰‰¢°ÙâEzN$Ybè²ûëêv–.“¨‰Wí&#à?K!$¯¦ÒÎ _|õ>Ñ[·lÚwpWJZ «à­Æ)(z‹¢# “R#<_ Ö-IÕ³‚Çq>ñûÞl³ž4 ¥Y·Ma[®ÇñÓ÷Î"›ÛÏ¿kì|Ø‹Ú¤¨ü5[M eçƒAÆc$?R žp²N:e§ÌeoGn¤Äñ!kÊ–- s¤LQ#ýøµ3zKìÁ¦ñÀd@¤•/š„âü˜¦]š»«l^‚¿7™\mdýÓõ+TºiÒ†U5}ƒ7N§E)Y–øÈ4‹÷nÚ˜0SJ8‹žõ"jŽI"U©›ÖkŒ5άt¾õÖâ¶ù5îZ•üÿ³÷žaQeé¾ø·;3ÝŠ@‘U%UÎ9UE‘sÎA”¬ b *Š€Š"•œs…6tk»Ûžîžéî93sÎÌ9÷ιîóv‚Úm÷œ9矧>`¹kí½Wxoü½¶láøáf_nzS¦"#G枎µeã¯cJ{ÝjF“ìrÙsâÆõ‰•æó^Vºæ)o¼é«i Ö~~ä™ü˜w§r·ÒJ†'¯F9Ðß4!TñpKm™öHnyÆ Å¡‹Z‡Úûº*Υ˜ĄMÜÂ\_ÞÝ1ÐWs!Uì$Ù”þ~é.I=—•åoIyÕ¦¾b{oª€½ùóhþQÙ}¿ÚÅÚÊHÊ­½]”—|v¸±Ðׄ´&´`+Üvž=Áv¹Q(0Â@ÊVd-t·)‰Ê®»¯_hBflីÐ=Xœdµ9H¡~p oµîCâm䦀 Õ0µZâåIUùQdr šÀŒ­"*ý‚îüðçåãÎÞ!,'—L鑯,ùjãýᢣ!\_"OdB“ÛÊ=‰ÎÞtuS©ÞÅn²cõT2fÌ¡†ùÆ ‡X>ê%jBãïò¯]ýa8ÙCm'sßÓ˜i6ª{_†Ra©9Ú¦L'¹/Så¹—'Ò¡ ›£ÔÉ’±Ž}ˆÏI¬EîT…7ÅY¹ÆÄ@Êœíê褲•¸‘]ÜlyЖמeH‘ï•yÑžŽ"± ‰³ X¦¢í<Åt—È“®ò&‰1$U‘Ô¹'z–šRr¢4f2"¯)ø¾ '{g†Ò‹(`/E¼Sèæ(S98p=èNN–¾³°`©¼ˆNžŽ™¹¦ÞÊ„ìÂ>Ðz§ÿjˆ«Sƒ±… »2ž!MŸ,Õ¥ñECž¥wU]s¨×Z¢pMe‡ó['¯žõÜÄx—ÄËA rtñçxøS¤ÎÛ™ÎöNž6 `òX‰½È¹%oäÈßî_sk ÁO­)ì.ö.þlš³uZÁ$¿µØ‡éÄq÷qËÍu‚”Mç5®Ü?Ÿì¿›. ФÖbo¦{ vQ"Ö’@wqTx8ʱ/è`4De#Ù%ña¹²TêÝhæ,Qán'‚?W«ws•öòÈà Ó³³ç½ýÙ*×]L!¼Le/SÛK=nØÏÝv1±¹Å^Sl†mZ–Ò^¦ÚͶq#ïÜm»¨)*(ͳya¿b»zìå"^/¡9[MVp°EqQí`n&WÁÓŠ,8®Ø*p=±…PZÑ…ªtÔÝÑ ÛŸlµ§-½‚ÌFîÞÍ›(’š›Nº[™'Ý [hõ.6¼ «¦€Ñ.JK©â¡©eÉ×@z6h9Zpܨ®`4G‘¾ÊQåÔþO]9¤bç†&8˜Nk$JK¿ÐtõÆÕÓUmí3z¯Ç’Y[êM™žÞE+«wÛO6´ÎÜ«/ÚG‡GÒd-ä™qÜ(ªCi-÷&{Ž‰ÝýØÖ¥cwt²uöceò²HÌþ@—9(}ìynu ×ÝÛŽ'6Û`Â#¬pP°\½INRl Í*Š{×û` êaǽéP• ‰ò8ØØ:6Ts¡â\ÿrky¢D-#×êÿ4'ZHYãPkˆSãE^={ŠüwRh¿²Î¬Ÿhk®½Ú9986|*IaAe‹N]êz5HarÕ…ì»ß#ö€—æãæ·—µ©%Õ°øÅä­–þ®Ùû}mgÕN‚Êœœ£“ŸÿÛß¾081s³ð€Hî-Moïš}öÉ÷_­.OôŒµäÉ YûÏvNŽ 4õŒuö·äöÜÍ+Í•œì쵇­ßæFd­ªiž¼‘¦0%á­âÌØžáõßÔiÅH<ÚÐs<-ÌÕ1ÑœÙóS““ŸU8±E°6o§kzNçGÝ9¥°ýÜù†bQQÇÍêdŽx-Ë"Hª—Rb.VwOOMuõ×%Dˆ ¤vþM#÷{n4õÜ›lªÉ ¹Æ4gVܵ–ñ¥ñé¥Ñþêè@WK*Ïìî×Ú5Þ\Ý8Ü72~³:Ay¾¼íîÊËï¾út©k` 2ß׆¹Žsvjc(xIuí“w1Sg´·"ÜW‰¶ìpêN÷È­ËM£ý£u• 4–«,ãVëÄRÿÀ@ËÈbçÕh{>!FÔØÃÃ׊ÂvÓy¦,wEvÇàÂýÁŽŽxTŸÊ I¢]Wê×€t3Ê… -ƒUÞ é‰1Å=þÊRGÝ­«-C}C—Î’¹eWNtabV¡¸bqàʦPD ‰mBj›‡4 öƒJTu¥gjhzº«ëJB¸³9¿Ý)ãhãÄðÔÜÐdOቺ¦ù8MÂÏXZ>)•J$¾µ[Fö±‘Ù™ÁÉþŠ²˜ÝŽÜmüÍ÷§ššï4 Îô]Žò—`ÒÚõØ™öéÑé…ñ‰;§³#X<#Š”äwºãé̪Ž¶ÁÉÞþs¡a™‡*F§ž~ûí·G&ÆZêrTRì5¥Ž>U ƒýµµ­ÍCwÚªƒ”^g®÷ÚÅàîö­¸ÔV“,ÃSQlt¤ÀK‰öxdd]웚šè»XéˆAÅK•×vglvxj¢¥©X¥Ø´¾žoÆõsÏ¿Ó?3?2=7Ð["á ·ÑÂÓë†{‡»ënNUÚY댸#7»ÆçF¦F¯å)]„¦Üˆä++Cý =£=Cmyi!v ¾)/È» kŒ6ÛßuVÀÐ⋇îMLô7õÝš¹xÜvœéÁEÝ=Sóã³·jrd2áveVfíèä‹ÿùï?€#ÙP”" ֹ頎ä²W캇/5gz{]¾Z)[R&T‘¥ÓÑŠñ¯Ž8HRéñÅ¥ÉÊ/©ñ:qDáXy9Û8wïÅw_¹Ü;z6Fj*9R>óýä¥h’,éXßçK·r$bÁV¢Wpñä‹fÎR[Òݨn{˜<-:¾n´©2„€g¡ot¶ˆv8gW/~7Rá(O){¹Xw„'|"/̽øÝ؉ý®–LwšZa­(¼ódþza¼(ôLõô×÷&¹°‡8‰gvs`þF¬fQJlzXäëAv•î¡ã=¸Íò:\=泋Î3$:¹öÏßLu'©£\cƒv“¸‚²é¯—[KÂ÷ 2ZîÝ)õ´dyû—>¾â¤Úö¥öÃaR#jV͇³×Ž‡‘üÅá ‘Îð7£iÛ· ÷zäÕ,Ö{ÒßFä¯>˜Lc ¶ÑbNö¬<™-õPºŠÓ:&—K½¤348=I¢ö¤ùž¹4v·.WiÊÉiýËŸ—òYgþ‘‘Ñ¡+Q>ò=^§n>|v;Ï×Fàv0™Êâc U8üäÙ½«1‘1¥ÓK‹ ¡À\Ý0÷EßñänèÅ›³÷êòÕטÌäTýýt¢5IÝÞ3Ó‚”Ö“À .›˜>ÂåmpâQD»}®´ß[JðuÝæt¨nõvjŒ«)i£íÃ7&ùû]»ScAÄ·½97&,=ž¯ôb‡WÕOOž? Ç`ÅB˜ÒùÃÿùzæ¬ÊÙÉFÄ’:YÑ׆k)CÑѺ÷Û*“eAG ûr&S Òú"<•yÝ=ý—ÃÜ0=í%õ‰I‘e£–l¾\íž^W{ó˜³Bd]ÐkÝ}άW€ÔÙîùö³*ØN6 ç¼ ¤øЛál#Th?»yGÞÄÝ×´ð¨ÜOÊ6 Å$·.µyÈ<*‡í«ßMîßÃj¹ûô f;u¨zv¶ödЊÀÚ«ìêdoR0 è0ü¼ÒËrÓ#(|¡&ÖÆ7f¾üÑHѵ…¦q3æéyêÁôíXkÐR™/<;5Ðx&:ùR}_w~BrVンû|ÒÍV<Ý:u»"':»¾­¯ñ`voGk"I]:ôìFBHöµ¹ÁÓiþ»¨k3O(<{¯èÆ…™‘ú¼¼4Wo…™í={±}ÈÐâ\ž“ˆk.8’ß;]“íaãß0¼<,¦n%2ìR§WÔ„úɶ9b 547z„ÏC u@Bš1c÷Õ·T…›y›·”¥H"Z' øò)[éY OTúyJ·1›éKfrÀhFŒ]‡ÆWVjÜ0ãÎÿlf¢3‘@Šo@ôJê½ß[½Ÿ†ÍÅ™•2¼p÷ºF}ßÁ%ºíц4þ+AJʈ¿Ñ2|;3LfsEŒ)^‡n¿¼W@afLïV´¾¤"koÆÂg_Ýo»uóü•†ËÝ<^mT ¹”ØùÕÞòâ¼ ¨G.·¹(2bà­åÊ7 L/‘IrZûǯŸ?äÀÄÔî6aéðóŽ#R’§ÏÅÙ¾‘{¤)9]O®ç»YQXŠÒš©± G}öRjHùÜ×ýn|Lâà„H.‚£½}ý¹4>WW’’['fk÷{ó·’ +3(¾ò Å6w¿P¿ôÙý©ÛåÕ7ÎßYýàR®ÊŒz°hîþ`óùý©‰BàRC΂O_;wýViIºÂ¨X»U饟ßk-‰?¸/Á¾án¥Çœêi.#R„!åµw¯ÇxaƾŠ{öXEݹ«]žŽ^ ±dGç´þ¾+×ÅœÊ4UWµÌôö±Så–O6ßT—œˆ© 6Z|ñÈ\sI¤IHŒ¬¾µX¬:}øt1ËÁæ0(äêÒXûÁ]$Æá_ùú‡™ý6tä-{(~Ù'oÞºX{++ØI2#ÐÜýW›¦‡NPšm ã2!‹mƒj;ŒÆF—Nß[\Ô?óAov‚»9iS[20°j¼³>~…‹Gé^²eUuåׇW—Û‹|D¾…0¹ë‡?ö$È!9Ϙ²!Mfîˆë]ZiN’Ú)•yãYB1êíη ¿|{±ëä!7Ëwµ„ÿÊŠ½x}üñ×ßüáßþú—?|óÇý·¿|}w¨˜Kc¯[GÌ’Š¼þúþ`&ƒÌ5– ~Ôžâ/3%{zWÌöÝŒ²•>>xïbŽÛv*ÇÂåLåÈDuA™½„r~âEG¼„g¬mÿT.R9z %#6õ ^Sr )0o‡· HqM„±Qz µ#àjëÂtmùaep¼2,NB‹1ÈÛë–šXÜܶøÉ«‚@4„@SÊ÷KÌ9•Í Q´ÅÎãà¾smíKß÷MW´RbHÃ@j¢þ\¼#YäZ^{¯6ÎS`pgéùPÙ‰Tˆ£yÝ®†YzYŸîbAc™(.Üš+ÎòßN–;x>PÞ~çÞßÿ¶=T.ÚÜ}“×ÎFÚ‘E¤¨ê†ÅªW!£äƒGã .v÷@ßòù±®;"&.8¼Ëë@Jj«Œ‹ßÛBz´fâ^ýòReRÅÅ•ß­vœò¤=È”Û:qSÊY0% ±)Ã?¨dzìN•#sÔTz>)ÏnU]˫鞀¯‰êþså¾î¤R´ e‚@ªn¼õr”&5é[š É5íBÀìñ»6°rÿ +sI *]}:Sâ¦èø‰iÑu÷I[b ³)-$þò½»½‰D.6áêËMÔâ P•“bÚ'–Ú\yŒ­$Ï”î/WSqò­ª¼í£Íít9wc¬ãh”TS„@ê³î‚hR˜@ïRm¸ûQ¡7ã×.w¾xÜ–ÆE PÓ4Ô⊹LH,‹ÈÞ‡6Åú:YÐEæ ‰K ¼It‰%SlÁpaFµôŒ4ô ‰½÷©ÛŸL÷!¼À,w†Ø‚)6g8ÓëG_´páÖ€Tÿͨݸƒ·>½s>`ƒ¿ÇçróüÀÙ4õ6)©8 ßXÓDIRyL†ÙCR< Hasûñ@…¿ CDŽl˜iÉ@ %ˆŽ¨¾ßQå»ð%² ò‚ê±…º’h;lºØ’%±ÀÖ‹&²da/%¶à:Õ}¯1O±.Ȩ9žb°‘˜"Svô対éMU›1b×TŒ›ˆQúpuøƒ+4eí;Öópäz˜%;*»õ¯ªü­\›Ð[ýK9ûÝLIp[b³Ä‹¯ûþëŽ$%‘P ³ûHE U ¬÷Í?ù ÌU*4gÆ$·Ü¸mIâ‚#YõÛf“5GR¸¦ëU[wº•\Ÿœº|Âך‰½ìžøCKYvÅø·©2 ædù ÷&.ã1)Ùy O ìJM."©®†};)häò««ómñv ¥0·|ò^{©¤¾û¶ÊJÍóÈm¹ )ÒBMý1]³?+ÎÕœâX<½<Ü}ô€°K«ã·r¤áëû¨nZ§©;øåí¯ÍžäµÁ²5/þÖ·x›:»5·£¾5 :éWœ‹] Å>û«ëîÔŒv6!ëgkkûI w«Ž}4Ñx2*»nòŸÿüäj©ý…½s×r]ô@ŠkDŽ«žï,>sÌÏSb¼IÓÃÍ›Lm’ݧjY|Zî-Å@*.å΃®ó~&$Lf²­Fž5\^RàÈ e!;”Ù²:ÚUššŸåé"4`ªšyþÙ³áË5u×ï´`ðPL*¹däó/FPL [ #õîËÇU"¦ÖŽãYº>z{®ýbàväd ò¶ƒrGŸ}øørP\öÙÅyÞƒIuÑv§ú•R‘§>{wåÙìép1+${ðßÿöu•PtöÚ³¿Þ¿z˜ÏヲðЉÛß};½Æ%P¸$ßÈ¢šÒËUyçnÍÖ—úÙÐåÄð‘¥Å<™€g.Ì<9´p3ßÀ N¼ññ㙦‚²¶þå ±d6o+É;´tx¤;™Áài¢!ØÌ{«Ïô=y<,Ìu€{öVvέÕ/?j;È€„Ls~DJã'¦Ož»3¼²\›éÈâ}c*ÆÛi,T_Æ5 Çë^h(¬¾Ó½òÍãÎD"‡k)+­›é͈õ°B¹¾¡•xÿ±ÛOû¯ŒÉmúâo_µ¤r|àË<ÖòhèöÅ#Ç9IDÆŽ®Šâ‘®æl.Ð uÅ;½ë«Á31$&ôcrI™Úþùîâè#—Zžÿõëž#¤(˜¼Ê8Ýùx åÂáÜ$±H`Hͼ3?>ÒRr¡ª°¦¥ò\Ìn¦”rþ|ÃÕüÂËïÌ÷¶œqsŒÙ¾~V¦ïE%ÏàŽ Ùþ¢âºeÕnÏÏOȘ˜%unü³ÎÔ@ ¤¼|+‡oEî¤K¸çV^ª½Ò·<ÔzF-ålqS‚/Ì~Õ• æiK{LÈR‡ðš¶Ù…š §âSÂhlž1IBj»©â€°)vp$Ü”™»‹¹ÇNç5>ûüÉíì(9¨/`x:gN,,7Ÿ=w6ÒÛÙ”êªÊoë[˜¨¯­<^Ñx¥þŒ·—О˜SWWxþb~uïÀTwn´Ä„º±X@l㜔u­­´üü±Kë_ŒfúÈiq…ƒ³Íˆd‘cxEýÊÍ/ÑඉåÛ§Žç§”ôL=ÿ|éf¸©~x1z©âƵᕡ†|©x·ËÁÜë­¥çÏçU=y9˜ê&ÁãÜø\}I´=YDŽ¹Ú²|%ÜCHàæ]^˜ëlºZxcdl¦3'J8Ç:~ø“¯G.”'D±#¹&{r¶¡(·rþëo?¸Q[SXyåÄñXšý FÖðZcšJuâþã/Ttôß»[[Ë$¹Fì„#uß~?ˆçQ°V‹2zFçGJOŸˆŒö´aŠgî6äææ§]œ|ðÙÓ¾ó~¤Dûÿô‡«>b}Jg‚ %¯íwߌÆYÓy ,‹~¸unb¬µ´º¹õîWÏFÓ8\¶¹¬vñ‡ÕΆò´¼³)©J¥˜ðcKÛ4‹EÑ'‘ækkyšïaåú›kDÒ~ O’¦ Fè?6E›Wˆ¦Ñ—üW$Õ#ÎêuH¾· Ãéÿ $0~—_°'¾úoö®.¼U«Žß°D ${%$Äp%"‚¾Â¦ëÌ R4éaùYe3²“ýO–ˆT˜“h¿±õPíÏñõ–˜ê@ ›=Á.åþ¨ãÇ‹N…ùn)œïtãg³bÞäÄÜ“cDöïÏ u1AC¬à€ü '.Tg$‡SyàD˜Ð]hÇÒK/(?ê&ÚÆ>T=½Ð|óbNQEnA¦R-3C+N÷ñH+ÎL 'ƒ˜”ÀB´?¿û«ÛGÕ¦Ï\%IkêmIPƒDk¼î^ÎÞŸ·/-Ä^ì#Ûw&!Q½ƒ&4gÅEd(Ü»\Óã2‹D<݉“P‘—åkN ô8\쵋_Šå§J:Ÿ“êaAƒMˆNÌ̤ӗNœ;$+‘'±/M9資Æ5a(æøɱ]m) Ë»têüÅÌŒ(ª@„Y‘FDÍ?-bŸ§5l±êj±?yÛ¥qáÇ./-KŠVm§ƒ/ (9E©û½wÑØ[X†$‘µbLAåéò ‡‡y"°y¨ nxfÔ>¯Ýtp @±-ÇÊ%9ödEΉâ3-KõÑg^òôÔhŽT*„†”å:v»>p›Û¼ÄÓÆzXÓXØVJôÍ>Xx!ç䥔g(<~s¹ÿt²«…ªÅÁ©¤:Ë’ #üT–D,ø·•WFZIEÖу~YÅ)‰~{Q¶ ¶¦Áyé¥Uy©äabÙÚ)!,ç\þùÊcgN„„ºZÒ„»Ä\Ì?wéØ©L7o¥%M¼×«ðæürQ(ëìåSÛSlç–~´,·¸<çd® d¾;*&?U"›RœÈ!YaÑ.GÆ6º·sRÑѲKy§3]ÝåÈåk%ŠŒ9žÌ‘,]ɘ9×O™\œ[R‘},ŽÍãر-DIÙ|ÎVM]<â›Qv´èÔ¾ÌSû3:¹@³š*Ú!‰ Í¿x²â|b€ÒŠ&0ãøÊ 2K+óKË’Á”BouZaViå‰Ò³ñûí95[htðüÔi%¹eÕ'ËÊö'úífð¨®)ÙÁaž;©Âα9ûù¡ ÝÏ­øÜ᜜È삘hµ'&§åóÖ '°órìL¦Ê]aAXñ<Ž”-«:YZ’çcMçR=ÝSs‚Ý1£ÏZ‘œÏr ì$þ9‡ÎV`Ïï¿—­9õ¬ ÿ¼rìHf¦„Óxãõ)è\‚01òØ¥ÂKÕå•'Ë/=M€04ÄÚÙ¤¡C4å4fzg^8YzþHF,["1%³ÁV§zHcK³Ó\Mˆl*0täš #r.ž8_q8Åß–%4c…úd—æ—ÊÌÎÉ Q`*·Û7²°Ì³†`Õ!¶å0mÊ„å«Ø_–æi‰N(E¸Ã91âØ…œ‚¢ãµý©\>ߌ0³<í‰óUù§r|Ü¥º”Eêk@× ¸w¶BÀ™³»¯Ëuɤà`å>Û'Ûì9ØÅà^–ˆž ümàˆ=0)°}债— a ½ŽiSVðs{†qmÁ>¦ˆÚ³¶9roƒx0¸Woö‡!6¦=  ÿå@ R•Ú6o…ú+›•…å·*æÝM#Àe#€¡¯µÝ09†½‰àÛ9 ˜HHãFºпð-6`ïÁ°=õ²F¡Ö¡M%©œ-¬ÔËÓãŽú[ƒkxú–>|S>ôã w*³r*J2=EŽå£à‘‡}XÞèá‡| µáŠã¤s2h]gšoÖ:%PF ¼’€)0ѨŽ¦k‡ÂæÖŒ¾¿r¡0QnFÑèokü'è·ü5¿Â ü-¿&!JÿšQ3ýFè'?€°ÊQ®¶—¨lE®ŽrO²‹‡£Äi;®œ½vJá:‚yf ‚v²¾vk!2RÕ€éãZÒ‹/@ÍÄÐAÆϬ¹Ò=r§ ¡î´Ÿ—ØÇPýyƒ¡FÐÕšmàÈÑ(EšÔzíÔ@aV„$Èî$˜:pÀ):2ARöZ(¤ó´Áëõ{Y ЋÄA gû¡ðMô]R4ÍÃã' ¡O·aôA á;¸ž .#òÖ­;>Žž1¢?-köª>v£o@G!RïXÐ×VÒ$;Î;Ù¢×.×¾õZJŠ·åüi ¥=׈ÄOR°o¶õ:Bút`i¾Ä¤Z78";‚–M _™…¤Ÿ†·a=Héžl{–1Óe¯ÄÍ^ª²u€‡vÞŸ‹OV4ògiŒY$>a‰ÜŠ*][–Ö„„,¸M“AAÔ‚”v~.Há↤´ *p;èx5(â@{/C’¾ÛaØxº€B l©G©z¦YïÛ#–E=o 6Cʶ)Ôj¶8°·›ˆbCЃ (Ï[3ཇd\|3†ÔœœN~<}Þ0ÈÐK`|`­AŒß-˜ÁüQ<0?`@ìa°º-½„kþ˜¬Þ†ßš š¥Ò¬`Òg3顃%§‹Ÿ,N?]–y¶,ýØ_™1žËÇ1À,to̓ÁÆš ù6¡Úf¢¿“Q0ÂÓ6G®6ª®RHr;Å0abÛ’M`:ÛˆU{…òí48žØΤ • ~d@™âíð€óm›#ÇÌ×¢¼‰¾’ ‰1ñ& ñL ú>´áÌlRTèÿ¤ % Mù|pï"x/ôØü´B¶O¼Ç6ÃØs2²àžÜ \0Ä: `Ûý—V ÓZR€­; dƒ€{ÿ“b\”À-âöx“;0d¾Êà­5†*pÒ2Ñ®Cý2 ¥ƒª òy“ Â?¤^Ǭ¥gb¼‚é?’ó|MæÒ¦–Îω@Êq-H9 1Â~?"òõ± kC+è÷Óm9Èþ§g¿#àôSŽ`«j»7nfIé”FMÅËœA+L+ð”Aÿ!‰…@JÃëËÖÆyMq^wú;.À5¯ÄmGpH54ì|=Â%Ûf µ ­œéº /¢RÂWƒ6™°QOŒÛ#R)RZ˜b™„"Ô¶i@ y¤Á•øñÔùÍŒ¡Ÿ l+‰G›³íá9¥4kÇ7r€R:BA}q[ ¦mRˆM4®Y+6ó,ø%p ,f yFØ!?$îeâ‚X9²¬)0ÁÈ1$-õu6ž-ä¦ÀeÂý´Ð`ÍáºÛÃa!Ñ1xSÁ¨5¨Y[´Š:< ) Û±uÁæ 8úì9[íi¿ÚM{ß[Æ{6”ßØAf~¤Ø1 >:5˜`ǮيÏ3|e2g«=²,ôá§ÐØ!냦HQà ƒ ç"UôN0Üí`I‰ ÚAo ù!Yk'¨Ha¡­am"CG½F E w Rqr ›€{pÍAæ8“ÆŽ¤ )µ’ zE0H]ãîî8rÈÐ1/ÈjôÆ`' Œ&ГKëÅ…¤ˆ°G*lfý6|C‚†$<ôÞ‚„üä Cîl§¢ð"Ó€ Âa×ðíÁ3üe,)pN·¡ð‘¿Y݆àØÀŽ&g°v;l*þ1 *°@ÀÓ ãHc4.Ž.ÒMÙ@æOÅõ|HM¹>8¢)ÔW”©q®ÂX‚îuŽ üa(x6Qx‡ ‰.z ¸ÄkÜÂ@VÛ£†qk@Ê®2à‚4kA &NÀì6ʚЀԺÚ.¨îˆõ µÕº=Ñ^ÝRø$¯É|H¡˜4@a¢‰i€o8Yv@QÔ÷ ýN:À54xqÇ‚.&õ³Xз‘½Â‹ë ²Ý÷ݸv)a™»Ö/²g]™ûÝ÷þÓÿô÷ßÿñú—ï^vnµåüƒ¢;ãetÏ~ñ§?þÓsÍGÕ~éùíã5¹j°¸Á­~êAE \¸ÃãDéÀ§ßüᇗŸÎ\Êóµ¡ þ å¦Înž¬ñäp^ R Ãʯávw‰¯·8( Hµ¾h¨ƒÙRØvµ§oÑl¶âÀ3Æ•L]¥† jüa¯Ñ Ha‡‚&JÐ÷…\.lRpŸCŠÎi ¬˜K€·oؤh? ¤ «äG¡žYРAûO]âŸhIQõ‚:w[¶^Ò |ìŒÃÉë(îõó`A·e}7 ¬‰kdÏ1Ö4ˆð‡gj[5­)íÓB Ò°Ú®)»×‚”O7ç¶,c<¯í4.L}Á]1x~—#Lƒ($5 Eݤ|3|HiÌ‚‰g†ØMqü‘VR<£ µÆ݇’Žp7” ŽL=ìÐ]†kdýÎ;@Êö¡"O»>HaÍ3´ÛR:Ì…¶¶ÕQj eMXê• …P5±ã¿©»1oóµî¾µ°²ÆÝ·H¡ðŽ??¤¸@JAŠ !ô0›;Â0NÜ}`WVÛè—©ʯw³ Xiy×› ²Ó‚K†¯2®µ-Z¨€˜é¯ŠÈȸúÉK…᱉ª_6ý=;‰µÈ‡åæÏP¸Z3ÓÈ¡ú$Ù-ñ¶ãb Ä7ã¸:H;Á•B ŽšìŠxžA,P©Ò]bo†[S鶛-иµ ‰Ré2núý¯~·xáØA÷ø‚¼¢4…ÿ¾øÚ•ÙŽ#{í{–^öìó{9 yVÅäÊXGqDܾ€ôó™™ADÖ¦pS†“ ãd«=öp%‘¹®D/¢Üí@“¢ÜuÑ¡;Å5ãáOwQ×f,5YéEQú±Ü|4ÍÙÞ%€ G³áˆ Hµ OÝ UzÑÝü)‰ ž-&Ù%õe»ûÓQY±x»ÄS|xrùaÓ‘CQ,…§’ÈNö ®gK©´ûj×dÜb䀚IA„‚†°ñúÖ!ºæGpóü4‚Y¾H=ƒ ZsؘÇNs+‰gL„j$Ž¤œmkµJ¶wÄA åoð~:HÁP²&+ Æ”×þógZRTmÐ_ k Iqd÷2ZërÔ:Ox  2áuf‚<#=KÊXW£ËŽ3ÁgXkIéa¸Ao´¤(AJ\¬:KJR[ð·ÖXjÚ)E¸7€á• ¥=øk-©µÉ'ÐÈØŠo'ì !hkZÓ`¹"5Ï jÂ}H蔞ƒ×aØâõ§ƒ”ý¦ …çT „ϕ˯)Ü*ǦŽ®ÉQ\—8¡— MB‰|ýÄ ”Šƒ À·)“ŸR°µ®#ài' |’QâR¬_ ¤3¨Ûýò—O,ßëmooYüx¢¹ <ÜE»Ô4=DGƒæéqtõÉP…ƒ¶uéÚÐÜðøäÐÔ蕳A64”²¤L9Ÿ^;èlNa;Ä··÷TEûˆMQ1USS3£íý£]½ÅB¶Èˆ(eįìëí¹z>Ò§ÍÑYR O”|ªÿÏÓ%¾R˜ÒÄ–,‘ÓÝ9³gf©1€Ç6 xd?ÿjºÔ{§OíàÃñ¢473ŽUdÁ™m’A ™ÔÞ?3ÓÝ7Ü5Ô| ÖoU!In˜ýøƒÛõÍ׺ï­Ü«ôŠ Iž§nŒÝïé8“鹓&Ùíßùè·‹·o·×Þn¹Uä­Óœ¹;†fgºÀh·"¼·SÕªÌ;÷?ÒÕÖgæ£'‹çU\¡£‹$½¡mlf`|jd¼³ UmEwáfÔ7Ž}ùíô]½\é%ÜF’²SºFæfºzGºkÃü\-ˆ,Í‘„Ž¨Ršà +a+d­ æ¥ãÛYRÈu° HéÎÖ€¨æ@ÉEúå‡d.î² Â”xØ,X“ ®7ÖÏIƒb4´ìx«G”8AÒ¥fé\µz ¥7½ÁÖ¦ ÖÉ(ÔÒ~MIa}vèiüix†9Žn0]{*ÑôÐÔ¸û((%t–A©Z'³)YR0EÄ ”µû>nI½âEhxnŠIjbR˜tÏ’=TV€Å€À žb$ŒÀ³ÖŸIAÂ%äV[ÆV¢f¹‘«ÍÏöÔÀOÅÛÌݧ“«¹U#C ¨;aAò£:8va:Š!¬Õ¨°@Û‰ÂÓ…~ÐëÀø ü„oBÓy¹·èYR¨ášÉ«Ò¢(0rDä®)ªPãîãÃg'Â^$“žRÜñKÓº7A’¶!òŽ®ñú®c „1)í9¢—¸.9$ã‰ôz)èk•FmÏn;¶®32OAÇcmZ¢­w÷ÁuÙR¶º “M@ ï2¶¤41)¤L©øTtÎè…5$¤0} S¢¶"W-ågƒT:Í:¬âRçã•Çs­}÷W?\jk<—œ 4"ꃔ¦ÃÕÀT,™íFú{ÌýÇ;:ë³äÊ·œî±—üÕÂõÆ©¨Ü¶¯Ò\,(lÇ}ݽÃ5ñ~r[ß³·®^Oqµâyð‚‚÷Ð8Ûé%}£5ç“85+êÊÍ¡›Ñ~B¨æéE¸Ãí\ãýÏO‡‰ôî""†–Ô-Îœ‹ˆÎÜû_ò½¤ÞÁÝæçú*ÊO…Eúìa6É°ÖObÓ¿|t#ÊŽ¯$»‡Re.æT•<­ýáó‰‚(gKÑ+ß>oLR™Q™¾¡|µÛ¡¿÷©¡ÞþLHl4úÅËæƒaêÝò¬Ó7Ïø›ÓýRîüËã+a6\Å#”*q2Ã@*«ûƒO¦ øÑ|Ž·~÷äz¬ÔP˜cqæZqÔ96Q{>šÈÙ,Á¡t=ûèébWYyqBR8U(2¡¹:§5ÍÝ â±·Q”ûž~1VàeIuaEŸ>~íöÖî¶é/q–‹÷ ܽ{Z%á˜áa—æ†Z2ì¨ Ò§Oç;JÎÅï%ñ‘»ïöøôu?.Ûî‘úá§ý¹Î–A­Ó«­IaN&bRì­îÅë^ l­é;Âúææ+CäÐ)¨‡ßşδž)>èÀi¢“ún˜Â·†Sn9<ëlMá¤é+³û4²žMW(±±’]“ªMÑ5nṲµÔ.(BÓxçÈZç¢ÛÒÜ m%©öÞ.†ˆ¨]¸: J´Ð ÎÓ f¿5…·Ö‡§)¯™jMÒ÷ótuÄx)±©6Mÿîš¾7ÔI‘‘žÄ…U’Bªîq‚…gHÄTËŒ½é6À GqCäkŽ¬qÚ#·¡#eÔãyÐÖ?‘\>‹n´k¥(Œ3Ç´ï ˆ¶PëR˜CG>þC2¾m4¿Õ›XßÚŸ0ÓûCwÝ!"ãçÅ„&|3Š0bb•1ÎCIGÚ]*ŽIèÜáïS1÷…ûàòñ‚b˜S‡ +)½×áA^ tâð÷‚€ 'Ÿ¬Í½á‚œy’¦þ þ\óC¤à)æÁ"ÍøàŒÐešeEçî(4™:_1ô3àEUšÎ¶hðŒ©oR9q¥§.µ/-þÛgW¼øæÅÇsW³¨4ÎfvÇz2v½Ø4=R”áenÏÛév“ÓY±ÒÍ@*2§)gs ‡¸¯§o¸&Á_lH‘Ùy$Çœ¬.o»÷øÓÎD•Ð:¬q`y²º8Õ54AëhÏ[Ÿ8f¥8}mþÛˉŠ€½Ä3fúùê=~èæ_>½ºñÄb:ÝÉFàšÕ1pÿfˆ'îrYK±%°ªSKIÚò½«'bI,¥<­ix¦Á—Ë1¤*÷=ùbü”»•âìõ‰éÆšAQ¢KG'‹\œqRb Å«Xnϱ'rÌEÁîiçN\éyx·êh¤=SíšÝ64qÕƒÍ1fx¤<ýlð˜ËŽ°;³+·‚å{‘Ct}çÂM?¦™³vEöÏ/K ùZ±'´‡y¥Ÿ/¨ÿ`éBF(¨‚§nÂöÊÇPḎ¹»ïÍvÊæ­·ß2-ÿ—g¹üIƒ¿öúO^3oz]Î6Èí‡âÛð[íÁLjKZ ªÐ7BM¶ ¸l‹øèe °o°+Q0ö¥þh&›¦›ëFÃþKo4üKíM I¸L6td¼·—¿ÅN ÿlÛñ“_µRë›þ„\œ€‚½MÓ¥ô-Öå—`vÝM`é²±9Á&› Í®]\ͪ¡k š ÿ‹Ï3X52Þ·e¿oËßb/Ð_ŽW&|ÅhºÅÕßQØû_4šþŽÒM°n4ì2íhëöçúѨ€qâmXЊ¬Ågj–Z³ÓJjzÊNÇ0¤.–ÔÍÛU¯s÷½ÏÍ,Z¼U±ÊQðöÕ÷¬Þˆô™×ƒ” 3à`ýïO»[Òœ¤¹Ówg®ÅûIMh.ŽÎn6‰¥8­ý_ÜŠw2“Ÿª™ž«-§ñ¥;xj²ÂÕšÅ_ïîÅò!ÉúôÎa®ÜÅšïFU¨vs„ÆD)3¾ºùîØÿ®–çËæêK•¹Xs\¹ûºî¶Fûn)ì#Ý#õrɭؾ‘W>˜¬;ê$VÊR›FôAª@mÑ2¶Ô”åbJõö>3½ºZäâ„ÔØ‹ ÉÁªÝòôü®¥;—",‰"l4{¡ÌŠíŸpóÃÉš ‘@­ÌÂ@ªÆS RyJc§s+㥙>»᱙Sb)Ï„ÊÚÚ5{¯>1Be†[ý2[Í’”ÒöÉdeª€Ç7þìÄ&x…ô]üˆ ÓwŸÿ° M=„ž1’iq0iíì$0™þF $|¼B » Éô%ÊîÃ~ˆ.ÃþÀ.€Àô†ÑÐÑÛt4x/ÀŽµÕjs°_¡Ñ°gÆþ@£½o ¾A·ûÅ*A*dᣠ^¥Tü#Wº¯±¥ÄLc H†kçYo×̳v±?°yC/«¹Œgà€êjA0T;v½v4ím [>ôxëí_d´; Ñ[2Ú¯w¿w_ép/vNŸrÛW]ÛR¹/ •{o®!` åqôƒ§Ã¤XïÛK¥¹íýóãMÍm­ËC dÆ†Ä H¡/ÎY~´Ô”_P~®ïË/î^ósÚ­H;ÕÜ[]SSÒ0÷ø£–h…ÄÈQ¡Èkï_˜l¾uã\]wSsž“R°¤ícp¹ûñ³±Þöê[ýwšNxxˉ<+×cE“ý¿?49ó@ŒÞH~ülãpgw[e}gçìÊøT¶pÃ{aÇô*è¼ÞXWXÙÑ;?Sy,Ê‘©”nmôC õá—“§=Ì¥9%½Í ™…5×'¿|¹Rèì$¶ xù—FºZ«oÏNŒ7$ù‹Œ>á…Ý×j «:gÊ3Cm˜%Õ>2‰ƒÔÁ^ w'½BªF'æú¯7uwÏ.ÔùÁ6%‚ô䕉û}·oæ祫"¶LYïõ›µ…Õ=#÷§ËÒ‚lé|ÂÛ‚Ôæôþïpê?ÏGœ2&s¶ÚiC:=ûZkÙ2ZY”7:øk¡´—aß`ßoMÿ2$s´£Á(øhZåpãhåÃS. = $C|4-B¡+±bÏÿ ‚j±jBšþgìEˆ».OL¯Å›Ö%è1ë›®Úå@ó¬]2ìlžµ‹«M°ÎÂ}ÍhZõC3ÚúÅÕß?i4´£Ö¦5¢×æÏÓÁìÛ° SÞ£…*Ýö8‡H||¸¯ÞHn¤¶ŠDÏ`…Èâã:Rã bŽ:’žNŒ7¡“N9¶SÂѸ´÷¨ê@_hÆvçG¤G¦ç'NSªåˆAˈª¤ù¦„>›vÄ3ÐÍš±>»Ocðv*âýSó2²üB}ör`l”¡fø‰ˆó°Bº’ê½/àбøŒÜðÄ(†Xd²9w®Ô^½/ 5?!3'8ÊÏŽ+$P%6NaÊ0ä[“PbR\ÕrS²h·2Ö÷`nTr²:<Þ%ÄgKbÔ3{ÿrò¡Œ¨#‡”^J pXdŽI©ù‰™9A‘¾Øƒ¨Ò½.áÊ0€/&4)5æ€B)ÍP8¾ÒèÌØôì èÈq÷‰³÷Ü”v<î`’L.$ÐäD¯AiØhÙaÞ6l!á]÷êÿÇqê *„k^ïŠÜô²_|´MÂdö¿'‘Ëßeü_NåÐ{àWLà›gþǬÚÏmã—›nž·~6Í’ýR´H?†»]©O‹´ž÷rCcŽW·çÐ#E$l¤µÜ”i==κ4ZœN ï(ý:Z¤M¹•ðê]uüæ ¤zgN:‰´o-üq£ñ_A5¿iƒlá¦_¾“çï>ï>ï>ÿ=:ónF0 ɨ·¡,P˜‹2HQô ‚Ùÿô6òª©k>Âçÿ$œ¦ÆPËŠŒ©º"´Üæ€ 4Ù"oD飿PÓÌwŸwŸwŸwŸÿ² ËØ™[ÙFš>\0‡ðH­õÌÐe;¹óŸfÚà W€c“¬é¾+ã`¤R “K$¨Ç´„v(rYŽG˜çünÿû¼û¼ûü·)­»Õh° ‰›: ^R|ýFÆxÂóÏ'üy^Ç‚¾ /ú[¶ØlÓ”ú#;˜üTÒ¶tA­é[qV·­ÚÈ1ƒAîý-v¨ j©©!¦½‚þïÒ^ä5S„fFd†ÿSdFÇ>¯r]þØ™Ôøf_3ÚÏXÓ_x*~ü„ãÏ_ ÎØr‹xCTåÍ«FÝ4ö öW¹Ê_Ë1òzW¼ÀôM#¼òùÿî‡èH½%HSDÛùŠÝ<¹[i+”™lÞf!ª7‰géUVÝ:ÔÓ_“íaN\ß±÷'}d©´ äzŸÇ1$­ÙKw’Dj¦ Õ Ì˜N6…5ûíÊ‚ëj/vÞÎÐUÒ™PEÖ2w;žø—Ë Z“Ò€'ä4ÀÛã=\`I8 Òdáý@÷Ÿ vSšd‡PµW 1ý;v$7t'±Ê†££ 'DÂcÍåÇ"É¢Õ¡ku]C--…ÎÎúÝBx/Bž«ÎpøFqÇ#°‚<Òk뻆šo–Hy„·]S+‘»£PjþK‡×±Ñ,¸*[1l—ù&Pîàsö\CK÷­Ìƒ*sŠà?³E ¢hA çª'ûÙ¼¤4GÒIêë¦Ú„"´äª}èJ/¢DnIšóÜ¥r |«í„2s†ó^™7MåKWy“e.Û™Bšd;ߢð¡«|i ;¾dѤ6R*¸ |h.ÊL¡…À“"wÙ ²Càj+rÞ%p§ºbøP>hLâæû{ñÁßû½©·)®!Õ?ºäÆñü ÷”›WÊ¢¬È×vK'¬kŠ—ay²)×z¥ej¬47ÈÊ‘÷3AÊ\Õ4ûÁ91{«ÞÒÕ<ÒK——Û£vRP#xLTr·»åo»*0Ìi}º9#²^¿HÚ¦yÕIžÛÓp%×Y.ÒöË6aGœ¾?[ž 2Óë8i‚sÀ[Ót_ÂZ{ž>E¨¹¦¬SÛpÒV|ÞÈ\J ³·ì¡iH{U Ãt<§ÑkÊ5̼]¼!õ™¯—'ÐÂB/´Uœ س^•ý‚¯ ꬭkýRo´5—ñôûƒc@³[uº¤©>5TfHÆéO ì…î7?¹WŸÆ—8í8¥¶vM¶†yé“Ã%£úúî¼v!Ć ‰þ(¼u7%µ-‰a±?Ýi$È%½£ê–¿Z[Z®©”×¼Ò¨apíPzM Hn1M‹MálM™¼ö2<Ù›g¬×Ópíh|ýþ¨¬^ó=ßÈQÆ8T_[È‘ÍÖ?ÀËÀdêm9Š¶H¥‰,¹î¬àc¹íÛ/z[‘u=L Ú_é7=ѽéknùÆxÃt-S_³íu4ë¦çR ¬=z£!ŽÙ­ô„ÒÑé…‘vðçk'd݆aÑ‹®tDï hŸd#BñÍQáE]]³çï.t7áKÄÄì™ñÞt&G`Ê ­ºU½ÏA]X=ö⃕s÷WfÇRã½wq½Î,>}þ|ñÞƒ…{w»odñyü­´¸Ó=Ë>~²´üp~yyºÿ¬‹RÂ-zþÛ®ï v6c„”õÕ]>–Þ4òÁÊüƒgŸ}óâÑêÊÂÊ̵£!ŽœhØ+øû”¶U—…˜9¢C$Ðj iƒ¦OY·{ ›;6"Ý7ÚÝõ¤~ HqŒyY7šNf¥…—Ö亂VÔëŒ}šh»ÀGbÏýöúÆJ•bR¶r’[¸ÀÝ_’äÇ“‰L©cÑ©K½CÅ9?¤(@JÙ0ýèJ|x”"<ÑÉÛm'C`Îõáï;Ð÷Ý?­œ IHQy¹ïa;íQÄm¼ýpâRqŠWL¬@""Е,ß(i`´"b¿:$ˆ,ã-ù¨Bs¦ÔŠ!ZSÞNå›qÓOwM”çFî¡à¶Œ ]è¸oò÷ß\wᨙ^at©“9Ž8¢òhEhœ[¸µæh›qÔT¿}‘ ¹XÓ1G°S"òpE”ékÝ}B3Ž'7 Á#f¿*8À4L žŸÀ'€ïç/qƒœçvL#šŠáï³_é絇Ç„“‚=ÎÁ?ìÊ}^1û>®6²§È¢sÃÆ»N{E$º¸;[Ò7!ÖÀVÓ‚ç-IòŽÅFóØä6Uf§ ‘øúóý÷yÅîwñvÝAZ ýÅ¡Ina‘’€(±» 6.ÁÈnòc}í§%|¶1U´](<à‘pçÓ»ui|‘И$Úp¥~°9T¤ÀyVzϤ9YÀB’GŒP HðŒIº»íæºsý£È,pöw¹ÅÈÝU˜VlBÛ„Ô65ø!‚†­9×›è›èâï½—¿¤+Hî±êè$Ïèh¾Ji©%m£±ÍÕW'&û»Zb¨ÇP`…]æ+R»˜cZÃC)òvÚ¯ ðÙG3e(È^qîÑIîaÁT`€Ñ¬ø^’°pž:Ê5*É#"€(öfù¤¸6¿°x56i¿:ØÇžLElCxŠ¨$·`ŽÔN-pÁôv¾ß—ëíOˆ0h0ÅF×Üm»èeEÆP±g#ª£TØM#ÂYr©Øfâ’ yX’gì>E€ïö+ܧ4ÉNi<ü€wl’:Èg ¨t¦z†Kü"œB÷»GF²åRS0š Õ;Ö5ê€gTŒX­ÜÎÀ,bg²{¬Ø'B±Ï-4ˆ,Bæƒt—,Ø9â€Wl’k ·5‡TñÐt}E¶wX’{xS/£J¬e¡ÎIØh"W…3*½yÁ‰I=?üùƒs!ñ)®Þî{X‚uB¶xpQO.®ôŸÎˆäûíÊ8À•‹(§>úp1Çå›2¢âï6"y^j½÷ /Γê™~²÷›ÏFŠ½Ý#ƒ/>¼;Y¡tñ•¥4=ùÛ·}Ù®†ôU‹ú¯Vz²Ý™Jåv¦LTõÝÿý?ŸÜ,Šv`‡GÖ,µdRxjš{ 7èòã¿M]8ÆõðÅ^Ö‚¶¾I“™0HVp¦ïÁT¡oT¢ÂK±!4c¸±ÜbxFFr]œ- YœC)ŒHà;;E`/’)–šoÆ›a!ð…ìw ‹–DŠ®Y5%WëÎÕ Ï3e¹üÍ,)eãÃïVF{ž¯.ÝJðX¹¤ªìè~þ¯ÿó›ÙÖ®þKù‰<©§0¥®~hõÉ7/§{:jSý¤Û؇kï½xññtóþΉ©†Š0;&Tfèþþ9¹Ñ4¶_'ö‡ÄÖ·½oº<ÈC¬éŠ.4ç…çŽþuú¸j-©dèþÕ“ñöf-Ӕʒ¯^<¼ûÃÿnóå‹¡QÉÝí{úââ?ÿë‹GµÅêí(ÛÀNêvsa¬éˆ@²®¢gèà"?Ñ=´´4<:Ü9Ðrø&EåŽáã/ÿ¼t»­£iøÁôÐ¥gæ¢Ru|~õÉý¡±•žŒô³&Ò~mëv~æÙ·÷zºú[:‡ë®$ÉÂÏž¾19ÿé7Ÿ}8QßÚ^œí»›)بr›±½|J–?]_}üd¤`¿ï.Ï€ì[µøìåBw×@k×ðª}tN@tÍìâêýÁѹ¹çß}سŸÄE´3|Cæá²é¡ónXðCãkž>z·gxzáë¿Âãq É2zhåêÿþn¾«¯©£ÿvß…È°ÔÄ¢ÎÞå—/_Þ»ÓÝu¥òˆXb%¸uáÅÇSý½Í݃M-×"Ýü⮼*÷³ap÷†Üê˜í8-7$®)À¼'e%\º>²8>=5¼°Ôw;C((aqõ óK3}£cmw.y©7)+I̾º•Gg°U¼¬ ·Ñâ ‡ž~ülª©m°ae¤i…. 0SN÷LôŒML-MŽ\ó™òâó;ÿùwÕ·öuÏÌÝ<—Ââñ,¤‰W=˜î™¿$ã hñEƒ«+æºFî-=ýp¸.Ö»/óÀÑîû‹Ks£ +³£W"=EVÎi)=Ïþío¿›méê¯<±'¬%­‚¦ üÜÚ{o—†î¥ñ— é µ4¯¤üÚÖɭ䃧3Á¾1!ïO÷ß»‹lÀKnüÓ3…žÆ¤–šNøîp ÿf/ý=;Ž©'/¿ýj¾ãŒ—{lø•Å¡æô½DÈìÊ?sïõó–€~së] €JÝʳàxÍØôó¯?>ÕÐv»,/S<¶ËNTM÷ŒL ÍÞì(õVðŒ0ÝL–>þ?ÿ¿'=}Mý£-G¢Ü­éë궰 ïZ99¿º<<63ýÑïŸýÿí}g\UG·÷û{“ØiŠ(Nï½qè½Ã¡WQ¤ØÀ^bbW¤IG)‡bÁ[É£Éó$O»7îý~ß)ûœ³Řvß<÷îùí°ÏÞ³gÖ¬µþ³Ö̬յJ¢P,ò)ÙZ×z°ÐðÛ^îËјÇ$§@ê]©:æ‡n(=5:0Òz°²gøîCûÖÆê|ÍãN€¿ý„';Æ:³•ÂÙ4•nøõ­ã‰.¤r÷\<ÚXÀ—Im¸¾Î"¸VõS 2L“·wÝî#ë÷àëðª9<é¤ UóÉŸjÖ¤9)×ìh»sysŠµ(Ÿzý¶w‰3PøÈp¶aJEî8¤¯.È”£@ú QAùðƒîÊ\ŽPÍÊ<_?|2.åþþþoûCTÆœ¡¶¬ÈØË7›NeÓ„2CN[53£axìb€LfÅ H¬¼Ýxlu`pF\á:mÜ’3/ª·®8ûCßÖ¨Ÿ•›’ã}³Ë.w \8ÑS[ï*IÊصB,IØÜÝ_¹-•1Î’âHgÓ’· ŽÖˆ_ÄÚŠ]¡]KOî~þô@|ÒA³ù`Gï‘å>¶Þ».ßúlo†ÂšQöôa÷Ç>¢éaº½=Ï?;­¶a«¥Þ@ä¹™‹ÏwW•%Ùx²aŽ_5P»„¹vÿ³Ýij[npLågŸtlóóSZ²¢Ó >{\–®²akÅ2‡¸KÏÚK—„9«–®¹úäaÛR¦9èèfiÇPßþð jí¥î‡£Q [é²ýÃß}VU4HA~pÚ| ­÷Üž„…hùÒ†‘_óÍ7Cû#‚µö<íB‰?=t{ÍOÖ fѤ~^Ü«.–M);¶Ø.öRßýóéQj+/oÞ²†ÖÖ=R™Z½úÁ'ý«¤2É\žŸ‹Â[RÀŒ]¨Ýr´_¿my°#L¶{¤Sß¹7BóuóösàH-z¾ì9´2Ä—Q9Ú|"ÞIž¶øìúó9\™–›qµy¤ys®¿%Ý››xtìßYì¯ùßE¹5]+)mni]ÇÙŠíy˜Ps÷3ýâ(G0Ãù;IrŽÖ¸/€”»î\UwõÚô‰ %±V­Û×ÜU±'Í…&´ñ^»ùZÇÇ+}mx[j^´œãàu¡"ÈIˆwhÈ,Õ•+õH«më¯*Ì fÄî¯{pïhªdMéê²XR¤ºî×–x{‡hŠj¯ß:å£X˜Úýè³SIa>Nª¢M­cMÇuó`JY¸ü›ïû—:±±HâT,¢™ µnÜYpÉUhy¦ãÉèÞâèE† ŒvœÉAªîÑo_¿|öâ‹cõ%ËbÜ¥)‰Ç^üã}ñùËg¯žÝ¸´A£TÌá-?qó«ïÿöõç/¾xöâóѦu*oRF»«®õ6o.ZŸwòæ««=Y(Ë’r×ÿ¼¾)F;oÊàŠ2kVbò©îÚÓéötBˆæ hjÕ\ºÐZºfkkßñÕsY GïâöþÇ£ò4˜DUì»Hs™§ØÙ†Wö<íÚ–é¢ÈÊ?ÿàqO‘H!Çyí쯬h:[(’Ëþ÷yü~!Hå®Ûr“¢¶4Tž(‰ßUwù|i@ܶ¥wÔÎÆ¡ó›æ™òbÿ4HÁÊPº6”a¸hÞä–ÔУƒ‘ÞRknÖòšÑº½Ñ¶l€#yå›·}ËÜJCº=¹kÌΣ½5Å9j{¸â#… 5ØW¾9Á£t ÛWÑÝU˜‚}˜Þ®ê0†Úg@iØS$³ÓîÓÿ¹¡0Öwž!é­(9»ìa[yÄŒÁÅ)íê¨?’¿©®ïVÿñ¶^Z—”60tnÛæC]OîÖï]ùq]}c¹ny}CS±(éÊçkX_°ÿêHKi^ÔÂqÀJóóÙÕw÷ÓÇúö K²ЦÓ2’¯¬SJ%öòU›[ûO® vŠ¾ÔqûZ¨”9‹!tÏë¾w¯29R9Ë3B·ç†¾µP*1ma²fç^ì©>‘:Ÿƒ…¼5ÑŽãÍʼÖw§6T!œËzô?~p*1J;—~¸»³n_ŒVñ˜"zéÀý»Ç¢C56Œ°ˆ=}õK¡%…–'ݾ}ns2 `.Ç_ºJ?róˆD ²bú$\yyçÂTî>@ð ŸÕõmgÓä(¡©ÈÂú¯ô{s8"9Ji¤qùIRØ0ĬmÞüýŸoÿüõ«×_ÿéÛï¾|v9X!t=ÛöéWcƒ-G–…øÎÇñFxâÅmC£ÛüTx"gæTÔÜÿò“Ѧ£Öiàé3徎Oë âµö숨cƒmç2<} 7µß;±!l!W² `O¹¾çøæøy4 7ùðÀWÍù~rÓRË_±¡µ­}=OnÈaÍÕ²®ÞПΕYáÇDºÅ? Râ…Ñe—þÛûêOo^}ýöÛ·¬ rà¤æ5|ú鳑Ú+G–fǸ‹`$AòNýË/¾þþ³ÑÓ¹1j®ÜQ³¸°þõw¯Fk.ŸXš¶/µägíhé¿th1“£¤':{çlv”ÊŽŸ–U1xëÓ7¯^ÿ廾ªL^ Î,­~sem€OdtôJç®51®š¼µ-o¾}9\uáXvrˆ# úâ½ýç÷¦ÓØ*fFù¥›'ƒ”¼÷—ˆ¥@RâÝÔ_[ãÉ”Øò$ò“ßü0¸Ì¯ÂÇX¬9ÞËÏßúþ/o¾ùKÇê [Ž`^ôù®g£»‹£²l9¤º°%5ö¼lKaÚ¦®[Ï[KsÄ))e>¹]½lùÖ}?¾Õ¯¦™©ÑGýµû–ä¯Ò-/ŠJŠpiÕ'žŒ6¦×_;sj_í­w‚ÔÄí¦)i•úú3YhE»ìV®­¹÷èå×_~ý÷¿¾½Wýq¤5C±Ð»¨õû·gbÕ6òê69Y¡Ð£H?6v*1ZkC ÚÚq£­H¬ÄY9||öô ö•é"a*UjMê}£ øøDÃý'ß~óüÑã§o¾ýâ³á˧JyDt6„Ÿ0½üÆXgŽR0ËK6úõm¤–îhè+_ç7k ˆ„AêÆÞ’úî>QRJYß¡Qý0¾n65móS+'©Â5Rk^V^Í­º}1v¤Î¼yÛ»Ô¯$ÒÊŠ… U˜­B [¤†ÎnÓ¹³NO÷w®L&ÕLÊÄjÇó 9óòól¡!·#Kå¥Û_Ñu­8-]qDöÑgZô­G¯ê;kÏéì¾\S®oïêê9SÑÐÛS{¸^_w"—VVÝ}>÷Ô;U•ûoŽt—¥ëüíؤÕ|¼¢Ê[²ü81ÙÛ/]«>ãÄÖÐ!H•(%"IÑÆ–Þ“ë‚b.wÝm–3¦{p\òzîß;™¥¶ G&îiooX!2%VÌæä^Ô_=žbó!’6‡åhõ}cMárž%“ïY<ôä~EB$©Žæª%\ÚÏz®éxïDL¨Úšµ·¿»‚”-GÊXÖukèdR¤\1áøK »FFŽˆøB+¦6ž Rq'/^¿š.±1Px¾´ ¤Jfo– Û°q‘YTÿEó¶ &‘ÔRã¼­úÎã AüY^² ‹/ïWK1H%ž½zãbLÌÅ`ÃÑ7>»_‘Áô chƒ=”¾hb£q^¦[w¼¬å~wËÁH­Ìäh² šï7Œ%6'æäùx…,M,);Ú|ÿöýA`Ií»ñ¼.?ƒÔPÛ…LmÁÆÖ‡C¹b‡€½'{{Ê6ÇÙѼ¹I‡z_5ä¨å6¦LǤÚJ¸2©aÇ©ªæ)²¹4Å甊vH=tç«õHÙ)H‰XíJñ‚¨ãUÃýå;2Ø`îäJS8‰ žw'ø.Ù²¶¼³ûŽ~ÇRǫœÈ ¿¤ߘ(š„Ȥ¶@ç›»m]yïãïomKð³ ÕÚ{ñàb[EO> A*\é¾BÿàÁÙÜÌ®ï²âº»×O§8ªyÛXê?+°>^=ܹkuŒSé¨JðÏÛQzªÿÙ_‡7Dkçêè;³+Ë­be–_=‘¬doødh½DF3!á©Uî, .Hýù‡þ\WÓ^nµ“*Z’׈YyïºzoìÂgøºEÅØôäéͱ̖Ÿ–sùNÇååô°²šÛ£+¢eö¢ä%•:/®×ú¦%»7|}-wŽ8<ô‡S},!HݮݕB‚lË õôNÓfäÞK=Cm·é§)…!A-Ù_Aª®2Ã%…iž¿lËíû#ûbx¡›÷u\ÚAJ[Ôúݛá*.yO‘IÀH¹åwß»&9ZkMÙÖÙÕŽAJEO½Ü>Ò´ai”óÿÒ¸1¿ ¤6/Ý \¨Ü}áÎ傃çÚ¯íÞ’ÊQû;˜b IÐi)´Ø°¯þáíã„3Dç_7vbJ²–®ÞÛ<|ñP[¨$mY'YRÀœñ‰‡é$Ä×=ñ'Ý81 H‰àxõ÷‡Åb…5Î]–/ŠØvPß³»Pc ÓºIæˆ N ={xc[PP¤I[ïí²¨`hq[ âbášTWAÜ‚ÀÝoîHð›Gœ×Ùããv_¿Þ¶V&ÅÖ–ÔB\tbàáàýÆÍ›v}ô×ûM«aÒĺO~|qjë¦uWn÷<9]d¯(8¢ÿbôE×êÄÃÏþñ¸zcÜ+h/Š(ªØY1Ÿ‡ÒR3}ÅÑ __GyFî©»}5i4>©ÁÞr±­¤hCSÿéÒPŸ­go½¹²>ÜQ›~þóû-Ûü}•L Rù"± ¤À,4³r¸õR!cLZ-³¦dí,ÛX”à÷2©œCv]ûêš°…âÄܺW6jµÈÝw¸£…)èR³ +ï|¦ß»*Ž¼j{óËÇ­K˜@‰2Škî_Þ C*i=ãË[îŽGðgps÷ ýåÓ+…2•Ò–­\vàlWÿÆÍ|Î.êí•x¾¦ó\v´ÊÚ°ÓŒ©í™,v”©œýV¼õúÂÉGÌ´}ß½¸V$Q©lÙ*§Èc—õúµij{PZÞñ¼÷`i2S@É Mrä«Ý}S}bÃÜd‘~k:zz/- ‘Zrýø9>­NóA+#P}ù0ƒ“¼c£<>Å ÷þt%S#Rí3\dºôŠ—·š‹Þ¡ª•-]Ã×ÖeúZ2¼y¤4dò¯j¹Ñs,P+‚ÙZa/ HµAŠ¿ÿ‹Ñª žŸ¢¸gìNõš4RR[iJÒ‘‡½5™t±zÙŠ-M·:®mðsQÇiSÓE¾*[~¤OŠŽ«ö÷ Ù^Þ;v¾Äw²|ª…²(ïÄTžÚÇ9`Sû?¾¹º4È^0¤Â”Ì-wŸo’I$ wœz6p.XR%5?þ0°EãªY«º¼<9ÀQå”ÂUùºo×ÿÇ›‹Yþ6Ð’ê;³›R! Çøæ{¯ª–'‡Ò‚·ê«Û7R@ÌÝûÕ¿=ÙlIsý§»VìØì £#½9©á4m¼6IÇP(\²ž¿<“ÆÙzP¿áÎ5üx-©(˜w–ÑÐ7Ö\’WulløúN.SlÃŒ«ÿê³Î•4qމѻ‡—Ê|‚=5pƲ€@ª%Ï‹“~ñÉ‹?¿®Ÿ¤VXþqiÔžÜÐÎD]ÙàšµLÊÀ ò-{|»i‰'Kî¡«¼þànõ®HH}M)8.]ôªòíkÂçÄYb›ÀíOŽnHdä—Ö}ö¼ºû¨Öíië-ß–ÎËÙ©(z/wßZÖ å±ºŽMÁËNT\8œ¥ó¶aO–çŽ ìÜìüKw†{ª÷—«ûêÍÍ£ ΤhK¶Ôt]C)™574tÓµæþ¡ú«§ S´ÖŽôbÇ  éš4ô©ó]·÷†ª¥ÖÜÌ¥—‡®ìŽ¶ƒ\%ѧ:žŽ655\Ÿ#Q]$·Wdféh¬¬©X¥±‚–ÔÓ‡úëÛºÛz+÷&y ÑYÑò=7^¼ìØèw×Ø ‚w}þ²»„nLDÎU¸Go=x£ÿÔúP{‚ʹ´þöÍ]ºÂ’–/GªÒ¥£úDç7ýÛ…¶º³ïVÛª€nÑKªÿþׇ[’‡F^·ÈˆPXÅÊÍ5ß¾nÏX@Š#µdƤí¿z±åzUsWkgö¢ÐE<-=±Y¯_¯QÈç+Š×7è+JC`ÂÄ-£uMƒý#-[òâÜø2+VDÂΦƚåB’%eÏ U¯¬jºYWseûª(WØS‰¥´äâýW« %*%[¹C?x«¯®yh`¤iýâhP;:ekýÅŽÈ‹›|äúõþžê†­w_Ý® ¥p ?×8r>+>`>¬ çùºÔCý­Õ‡*ëÛ>ýá“sùRŒÆ‘eÒž$]z¡®ôZmÕÎ’x/±Æ3ñ\Ý@Û™óŽ^êí»?|a;)Gï‚k¯¿ØB)P¿ªèãk_Ñœ '"v_ P;µí-·_Þm)ÉÕž‘WïÿíI÷õÆʪ†“å»S¢4ÖjãÄûnAŸÉÕicBÜ|uŠð(šdªð¶h5Ç?3zÅZ]†N’–âmËâÍôôãE¦Ë|Tv&‚G0æÉc½3Š“—¯ðPÛþÒ¸Ð'ø%‡;Ã,ö¬¨,MÖ௠”¤¥­×%ÆÐÄØ}§qõ͈Ì[—^´ÒßGi @j` òðúä¼5 Ù)Üæ 'Õü q|nx|„Úƒíè³jwëË5†M ;AxàºÚ¦ëÇÕRœz¥W<–éâ$ dGäøFú:ÀuÕuZ2Oí½@•ä£KbH·k<#VFëì¸!¢¸%Ê€G< ¢—GÆùÏãaG‡––±l]ÚÊ¢¨$Å]µ@‘ê¯ w€‡C± ? Ì/&‰Tg®É(\é*‚QÐa¤ô mLÐ"¾Y؇²hMúªÔ‚µ1ñp14`ùaª”e¡Ñx<ò²J£½³Ö‚Ú"u.¸6®–œê¸ÐP ÒBmJÐâUñKÖ¯¿8Òt&ÅKì³¾¯­6O ““ó$:(uÁ¹ëRrs2óƒ#ˆ¯ØsÕξéáy%)yÙR¹Ô.`_õhuqº¿ƒÙZ€7':×;ÀÇ«'8h’ÃÀ[KÒU©ËC¢Œµi\ý2#——¤ä¦‹(1±8J•R˜\°6qéMï|žr¡R石:ÜYœ*Ðh@åtÝ‘ªþîü±%[a4:\¼u~Ù«}sÒ…j%L,+ˆòIKbËUö\oÐ m„?˜Ûòü91ù‰ùk§ðÕìR[¨ˆñËHf Ég”ö‚^ÌŠÄ‚ÒäœD6´¸Ác:ï¸8Ì„ÈCå)«’óW„¤,öÓ%òTXŸ+çK"•é«ÓŠW‡û‚™¼ ׶$fźÔüÂpæÌ ‘nE|þºÔËýÂù“§Y™/éVêV–¦ç¯ôõE^€06] o2Z‘ϔٷ"!Ulz†&1Gê7_š]ZýêüÖܸü5ºÅ)•hZqˆ$© qeIZ~¾o°=ªM—®ô_ÀU:ªbU‰±4)b'mFxîšÔË|Œ˸ÜqJa ɤšD1™¥åÈÕ?=déÚÔü¢]¸ Ügå혵 Ô–ç¸ÌXdqê¤L¶ kovLvP|‚8*Û?.r!NÝÎôÍIx‡É—'¬\—Z®µ)˲8J¥sèâÀØ G˜’Eû¦çÄ„8àW‘KSù2•½¤Aü¨¼ˆø€ùF÷8Kjqjáº8]ˆܨ*M)LÌ/ŠJÍÐ$e*´@$ç ƒµÙË$¥Yyaˆ(&/<ÖŸUÄ\ I ÈBT²öLKÕbŽDé¨H‰Ê_“RP’^Xšš›£Ôª©-è?眔̔.œûÎ0)Ä©Cü°Eœ€gIËI¶›xòWDíÃ5‹,QX$3‡ñW.ù¸±ÂЩ…¨°b°÷èÆxW£¿‘Ü ¢~•³ßŠô5KÐÞ‚WíEªœõYáóYr»Ÿç2.ú:NMb8ÿBbcâ>)ø!Ùx$/ãšGP'wS1e|!î¸'Ç÷Ôô çݵ)l˜êâMùyùGN¶w, Z( UlÐéüæ“eŠLí ½ âÞ³¥. ¥Ë‹SY@9pß"Élì&¯mL>€?Yk¶î»0nˆMhÆŸÐWÚ™Õ„ÈW^°1³`EÄòe­úÛ#œx“´–r÷ýò³?Õç`ÖŽ+³d®:yª`)dŸÈïÉ’LΞK§¥~‡˜oS¥êøC$k³aú{o¬m¸õôî˜þäî,¶Ÿå‘®‰ŸI;¶ïÐþoœ1BpœK¤§ÑLY¬KÛÕZ’á3Ÿ ô»‘V±îJíÍ'c÷úÏÈÈTl ¤&“DN’þÛEó),bÂÙžü™ž‚9 •fñ¿™øSüýÛ3á\Œ½o÷sÑÍ.¼w¼DOíŒzÏO›|;ïÿú»ÃqOÖ‘©jþ¹™VÞMáÉ￧27Œ»Â°tòc]<â\© t,Á1%ì~­8Œ‹»>qÈÔ3ääþ\ôÇH`Z7ÐG¦ü£°Ñµû{L6&kÕ;Ežì)ýåŸø•ôÁ¿Hý뀦‹šCÃkmhseÉZ1 ‘‘Û†-ÂBYЀÈHÑîNŒhAÍ¡‰ç²Á»(…" ‰JŒ‘ÃðZÐГðC8}•Â–ˆ)²ð‚9AŒV’)ñGbE6? g嬙b5±Ìle…#ÙòŒ'ËÄ– ÔH”ÆÑ‚&ÁþRtD gxDm3ÕŒsi‰¬àIÒÌð(Ĺ¡üÎD%”ØT9 ¦ &0ñ-hVÌñ.!ôB¯¯Ø‚tæ¦ä˜ \/´ á.‹çâö\Ù\†ÈpSdŽGÂk"m¢€d.CÔ_D7äûBj™-EëŒÆuXBŠ¶D3sϧN«m˜…BƣˈBN?„ã@ÊàÇíAóÎô8ãS_!_ºØÖ0¥D–äè†E˜ W¸ C£&ûF „G@´É¾A2H)É e\߈‹p¤^ibôYÄò v¼>dáIfxÂ^³2±‡ÄŠNÔÿ\BëVÄ")Ü!4zÏ`&_O„5R¦*ä/2Žd‹­hH.èÄ<ðgƒ[dA—»ÅdÃEîkdI¡f‹ ¬4 /ôqa˜ N)›ŸRxi:Pi;þ̦|¢ÿêý@Š8ÞK:èŠ&\AÆËR¶…aJˆi3ò²š–ã™xeÆäÑhÓÔŸ2ÓId³Ðôäó¡Ä²>¤Ç`åÁÑ—; d#é0¢a$Åë2ع Õbî‚Ãü*+Ü·Cã##{ÀV ™íøVI-=~Z¸v:yFw4v,h¦õ}èO6”Âà7ã#û§l“†0ÍñŠ6ëH Å ¤ lÏ1:Áˆ­>¤2HA$‚ Ï1l£5o'»û·™&CÒüÀÆä˜Ü}HóãóX2ÌÎßa†±Ä+¼$öB˜Õd‚:©%^ÏeIçŽ)Obä¤Ì=¨ØuoRÈÇ"FkU†¹ 30h¡ÁÃå'ŽÜ°Ì÷Âî>D[€kPÌeV^¨ïh‰¯dYCƒÜ y¬Ÿ/Ž#®#¹û~ HmÈ^íõ‰ x¶Ö„ÂS_ð1ø¤wºýÿ.âÍtoþ×gº+ø ±±ç_ü=ÔæOwaOsïšÏöâÏpeNsãÏÆ[˜r怟àMô¡ð‡Æ5Ï‹;Í…5ÍC``ÁL7Ötô9ð“w¦'˜ò g¹³§9³gx q÷àLUyA5‚zÁ›îÊšæ&˜ƒ>=Ûõ¡g¦§p®Í•ù¡3w6wÔÃúÈüJY/ÎGÎ,@rÛäjgºsg k¦¶ù_è!÷Â@ @+¾8¨mžœ\PwHOZ˜ÿz4Ëùg`<:qt¾ëÄšá)4ÿŠÇ‹ó¡kšªè& oš3ãCWÞ,/L¸-d–Ñòî¼YžB2©?tæÌðÂõ²?„ÃÍ™î_ ˜æÄœîaà6hÏtÁ,@10.hW`ð7nW¾¡;ŒœØ†`^¬9Pr¦wš3`3𷑤<4^üiNìé@µ+À§ Ù ¶™^ÂY°˜À¨ G}è†÷§ƒ Ø™‰›aa¤‰‰ž¼nˆ1P×>ìänä:Ìí¬éž¸Á˜OØ&¶we.šå…é Ú¿2›nJ0€ÃÝ€Ò}áÏ"é4 ”©\y³!‘‡°‡ 6c‰€÷Á¤ƒ?ÙkÆ,Û™1Í•_¨š<ù@⦻‚Ì6:4vl: ^×Oö¡qŸL¤Fu0L|K£'þ†ÉVLœkÕ˜5{|ƒÉ¿Ý4YÔÎî‰c ë̯îAÔ~Ò¿“uyÔŒ8S}nÒkȬ͓pŠK?8UÉ2‚‰ohy—y…úñß…Ý4=fNIã¿h,FMc„ÓßÆÒað¦9°ä"ŽÂ×9I!™1L7™ &¶gS{<Åôƒ#“³ñŠQíàªÌc\g‡Ì¹hÐÄöÝS0³~’q%ÆhØðñ¢bf²iÞþqÝž´þw´”<¬š“†ƒ,ÈÓU2B&5ÑlcßQ=õÃû2ymú‰7ɤ6 ã(™·1«˜˜gÐÀrƒÄ}øúÐÍ jò®ÁÿùïÿEªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U¨BªP…*T¡ U~iù$Ÿ f endstream endobj 1266 0 obj << /Length 1640 /Filter /FlateDecode >> stream xÚµYÝÛ6 Ï_a /ΰèôaÉö‡µE ÃÚÛÃÐöA—(‰QǾÚNoùïGŠ²ã|ônYîpÀ™¦d’¢È)…G«ˆGo'¿ÞNnÞ(å,7ÒD·ËH¥†éDGi’±$WÑí"úÜ6ÅÜvv:“iÿÕº†¨·Ûbá¦3Á㟉ñÁ•Î¶Ž^“LL¿Ü¾Ÿ¼¾|›ÐÈ#¥„',åi4ßL>}áÑøï#ÎTžE~Ö&JLÏ2ú8ùsƒµß&Jr&µŸ"µd©Fi‰I)PÚÍ»M®£ßjøˆ–––†S“œ)‘Ѫn§k°Uó¸uŽˆbIO7•:þ>:vÍ®[ÕŠøSXmÝ|méÕ†ç½_÷âgzk¶½ã~ñnàÞðfñáí¡cLÆŒP`#gBËG“‚ÿR=8è@F&`Ұ̈ÇdÀlÅx.ƒáØFØvÊ©Éb¬ùIªXžf½àÆE˳’ûý<~ú-32Ê`ËLÒo™L†8l‡84œÇ³9=o\7¿é‡‚íì¦  z>”¶âD~æš× Ñ®[sx§P=gí£»¦ÅD–ý—Ÿî<ˆ0‹8Þù×D;Ϙ–9ùîï©ÀÈÝNgŠ‹ø¡(K¢ªº+æŽèníOÊØ6׎3Á†šméfŸ9—¥k‰³‡/¨)ú®¦gY[L%’øn*y¼íˆo{`HààðwÔj‹ÒÞ•ŽMg‰Qñ»0^É÷uÛ0<Ö#ãEÑÚ=s]ƒý°¯à¤™,ך¼áкÓ7‘qùšˆø(xpènGÏ@[G0oà© }‚Q4žw¿íöÓ,Íy5Ö"ãeSW‘õ’f <†6g{XB{ºúž&Ž ˜$lˆ¨©@O¢âûƵaIó®)Ï­|ÎnÊr2ëõ0]dñŠL—y|»nœõþ—9l‹*¼mjÜ3)3ïÆÀìÖ¶" wÚ-ˆ.¯7߯Qí×C½@<¬‹ùšÈAnFñ¼“°8Ô°«·ÍÑÇ9Cãæ]Ýì¦FC:ãWu®¹žU¢™6æ*xVJ²Ø¾øwõAŸ­Ù·w­û¶…-ǹzI2ŠÔ°Tê«’Q˜„ n^8GZ^*…IYÆÕµ¸P“ÁÉiy]œ_ì»Ó4àþ|5XÀ(M“£8_…p´eyÒ¶»Ã¨F]õ£T šJ˜?2îî‡VÙ5î¢(Æ“ ϯ‹b™0­ó'vBZ_Å{-Qìå>SË”™,œ¶|xD–\ð$×Wí¥®:Ý0 ž1f¹V6Üü¾£.¯© »TõëÆÖ"­£P>…#L$Ì}‘ô#*´‘È"¨ÝoË ¤,¾"£Yw@î™Ê„¿ßÂQ¼ßÂQ[ú#pö7]^màî»7`n¶eWÜ—#ƒÚ°hÒ~tï1nÙŠf¨Lm'~oÛ¹Åa³gCYo6–Ôõãk~ §óŸoùO‹À+L¨ñyÞdÍxÊHþÎâßmeѱ+ÿ+„ÛÐÉŠnMÔA krǹ86û_ÁÐ endstream endobj 1259 0 obj << /Type /XObject /Subtype /Image /Width 427 /Height 337 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 83167 /Filter /FlateDecode >> stream xÚì½wTÉþ¸ý÷û»ûÝhvWwW1!C˜Ø“# 9ç(9gI’ArN‚d¬äœsÎ IĬ˜sB`ßž@PÜëÞu×æ<‡3ÓS]U]Ýý̧zªºÿøãYqˆ¯?þøCJRâ+ ¸˜ÄW(@&ý£ Ѩd@’‰8!u3«üeЩ•N¦<‘ÀdÒþ¢²Àþ;7â/  ƒòahT"\€—çè~>ë?…LøèZ UÇÞ¿ch`z¨Ú]GÕ1µ¤.ÙG„AúóÒÉt…N§1tÆzM#³ "Ó…%””d™tòªÒItL&cÐY)  ðõªdÿ@ÒiÄ@!ãAûÁùaúÚ'=],Í‘H~ÐdîÃ+Ò¨‹Ç $\B¥à‰xÎ,‘„§±’ÈËiðx…B`/$RÉxk –´”l*)©UÒÙÛ‘âçf£ *Þ6Ü›,Bÿ]k%s*ˆ•J¤Xùƒ/hTüR­ðX2…@¥åu¬â2Î6Ö–ÔTÕÕ”U§;ê “q8ŠBÑHoóÙP O3$I}{ïÜâ²áÑÞ¢Xg&§áÖÐÕyqj°³<ÁLI˜LÆðX …øá–€€øBªì Q<þñ^D¨Cu K€5¥Õå…H?/Œûƒ+¢ ª{LZ~^V]SÓ…¡sZ¤¶}àÈÔ@gyvuSÓôTW€& ‰•.ï©+):×3:Ðœà(‰cv-}]­åÙÅ¥S½§,„q ‡E³A‰(ÙvMö•¤e&‡êË+rÈ$¡å +::;*² KΟïÍtCãe ú»Z #¥ðXÝÔŽ ͉ L¬¸šC÷ä@MNaV”ŽŒ”gQGe¼—EtáDMJTxÕùÁò$o〬Á–Üc⊠Çzj ²’c½T ÅsmmSÃÍU…¥Y‘Všb‚FÑ—ÆÛ#•q(䉴æKÍF>çúº+Nª3±¸¥v QiòJJÊòâtž!)-)B!à0npˆÿ ñ8ô]‡€óº¹8´ÔW4Õ–µ6T$ÅÇ°ò}pEŽ@·=”––XTZ9y¡ù¤8Š-ÀŽ@ÜìäèùÁôY* f‚€ó}®Ü þRbX3ÑøÞ‚„SD%Ô%0Ðò K²¥>ñ0f[Žo5+'‹Ó4 ·#`ѬRÄ18 ÀãIïfr³B£VrC£áà ST£"?×éÆš©ÇÊ™duq674SÅ ÊY–¸¹|Àï÷Z…äÿsu@c°¢ŠJ4ÔGW+)©g“ê.÷áJ.· XÉå=ÂB ¬ÍMTÓ,ÉK™ â‹ YR)(>1ëÌ. m—àŠ 9†`“œ_ã-ø©‡1€Á*ú½Í0ÉÛP¸rj`ÔêÃÕˆXÜ1Wv)h¼‰d¬1n39+yF»˜H±Kg/Í8ÌÛ’IòËÊqÔ¤à?Óé~%ÈëÛƧÄg¥ÆF¸ëQPüÿ¥¬¼ È›«YHÐ+ömëe‰÷=®NÁ!ÿ̆`…Næä»éÐð FÕÁ¿)F“ô1Ò•õbýµÉËÒS2v·WZg“-=ëNë“!B|ñR3©ªŽ×W‘SWUTW•“  øáüpØA @\  À/~$BâÃaàŽ(€`Z2TpÊBSEA]UAIŠAÄ¡Q`Tˆ€ƒ]#MG–ÁþõR)d·Ì¢2Wa4ûí‡ëÏ4J¨Ir&"ÙáF!²©à”%-ãçE#`¬Û 9¥`Püh¤ÀQ^^œ\. ç=z€u/ØGl fÖÔ^ì §ohäå¤EeÝìn<£|84?ÿÀY·\ã ’  R€Ý>(0"â;ÂJB° ùPü<,¦˜cÙéïGâ1"NVIIC]-¢°&ÎÓTS]YŒn—KÇ¢ø ÜB’U‚÷0Š½M(VÑ|¬»7 Y±+l Ö]¹à0~>œË— °ö ¸ ¶œõ–•'F`ÓDK˜ºv•¹ÐÑK4óËŽµ”·—µÁ"à‚íƒâpÂ9-VêC|‰, óe?‰…Bëøî‹‘Â/ AáÌ“²R3ÒÏŸõ6– È 0ÕS ÉÇ#ÀCÀù0h´º}@aÁ™¬ôÄÒšªŽ(0Ä‚¥ô³Ja p <>%1Ú_ƒôáú…”³ËÒu…1¬kV$¥¢¡îm`„TÕyé’1h”²•gFFbzjÊÙô` !¬AxA´ƒ è=5› ÖTsAT±ïm‰þp)TµÀúÜ (Îôa,CÒ;&.7=>;/+7̘ d’RNŸÉH¯+Š5âÇ`ˆ¦É¥õ¥i™gâ<•¬ \pJFavRfZ”£¸(ÀžÖ|0œË/:w.ÜHÿ‰¸ë”Zì¥/Î*]H6 >!'=>çlvnˆ.ƒÒô‰k¯ÉÈ>ªO’×Ë/?—›vº (÷lvʙ东³yMg”‰|h€PÓ`HA£©~çÊ+Î%gffçFi‹âpdºµgHZòé‚‚¬ ‰O +‰Ÿ‡Ó=çÀŒÝs2â32ÒóâÝÄ1¼ËD+Øx·Õdçf$+È=l&N€ñÅ °«½¥®¬ ¤ØG xO€,3¢ª1Î"À˃“r*9ã'Eþ¸G{jÁ kól•8ås5¹vê *™¤ïÞþ¾Ëœé–ˆÿ˜$ט¬,s!bš]è –% ÑËäÇ*egh #yùlã³,D¤ } BÍ Ò:¬dº7AÅ«âÔ­öáR4ñàŒs­5gü¬UH(,¥jí[¢æ? '(”ö7zIÁQ4ÎË/€sΫÉwŠGÝ@²£(Œ'á±Q­± "•J$ãP ›RÍ™L Þ#1³À’Àê / !áÑ;ÒÙÞ°TÏ)†Œv^N N HÎÈ­Ì ’Ç:‡ŸS'}¼­ðiM£èôsgC¤Ñ<æ>éCÕœlA${¨½r¥tE2(À:εYP€eéN`怰Nus¾ †È.•=)ö `µË «ÁÔs -qU(’~qiuu¥ÍM5Ã…NäO`M†¬¸‚¼ˆgL(@ªFhÿ@sKýR Ó q«Ø«@bÝ›£Y—æ§CÆ"¡3âKë ._ÕÁ²ÕÄ 5'$Éåu¶Æ›2¨$,™„#qÚ&®¦{ÉàP` ‚ ›VT§k2h4RÍÞÿ]’œÒ +ÝéëÙÇ$e(ži¬>ídxîl” ¾Z€H!‹šºL#i ÈX2‰£Š†ŸIs×uO‹sTu>Ýœv<%5RMè#À>;G“DNå•eª ¹Ÿª4¤0`ÎFr)…E!Z4•a›Uóžq8¢CxZ¹‹Îf]:å_ 'q â§‡µ H¬ Ö¢€¥Ò±øД-À=©Ž‚0¸ÄMAÜ4¾0ÎY’A”5°¯Éy+@ñ'®R]kÎ…H3°ì–À–çBi²ˆEòÃáXÛ¼ÖD%Büžjz§Î ºˆò~ùMÙN†**ZºšŠü&®ÆÙ¨+Ë«(Ë+É2 (ŒsjMmªÏ1y·Èä户$`±ÊÙÃ1¦Ç4Œd€M—ì™ÉîC<û^¦+Äb‰YõUÉ^ZÊrzúÊ"D‡Óò‰ŸŒ·¡cèúS}U§„œ€Iû@ -UESGßæž ¤ šecg}¢‹žššš™ [PQl(/%íu®nÑ"®ƒuöÇÔ55u…ùþ;¢™Ú½ q'tÔÔÔ›‹ãQØÿ^€ú¡Íű:òbǬ]rY”³ñé­‹T¦òý ébq¥õ¡¶*Š&Fòd$¿´©[Gý)*\Ã=r¼#ÕÉPÕÊûôØ`µ4êC|Q¤J*ù›P1ðebdMí⎠ç2QL=(*ÄT ÔQ‹Œú!qŽš$ÎÙÃáeômbâ3’#ÜÔÁV4 w’}…Á1¼OYˆ#7!@ŒŽóI#:;7œ´Že«ôèpge ¨:y‡šÑ8{!­êïª fŽ¥ËGx©ù¯㢠֊da®DÀ[ÿ“Z’`Nhys?}Q"…nîꛞz:=9&ÌQ…  ×àpoCʇ(¨¢ã¯MY>ZTMÝìÕ…Ál…dÔý¢Àëg&ˆE袎þ!&‚Ç<£FÊBcâbÓãümU)è4„€¦ÂA|-³`°+סր€ñ• Pqô¯ –¦„@@„€€€€ñ·~˜‡â ÉÍ ñ• ñýáâŒ|’Ì‚²ì¢O ¤ðë¦⟠(@ôOGÿ€þ ¿äßâââÂÂüÂââò›yÖß"çý¿g ¾Ì-úBëÆ9(æç7Y·Í pñõLGCqZNñÙ†+³ÏžÎT¦—M]yv¹¯cøòƒ'7ÇZÛ'Þ,,.¼¼ßQZõùÂÿj{çnŸï­ÎÊËO-léºúr½b枌ÖU¦äçÕ_¾õtÃVY\|pq¸<­ìê³H._ØßÂÓñæüä••]^ûhñQo¾®föÃyvŠg㧌Ì$÷ f\xýYJ¼ÐÞ -ë~6ÿ`¼®°ëéüÇ3¹ÝW;<~wáÏJâõýK6!—Â-<¾X™ÙüèÍÇ>ªêé¿9ÿgë¶ðêqÚ ï™ÇŸ²¯Ue6Üó—)¯úsÓ=µÕÔÄ].=ùø‰¼9Îß*pÑ4HˆËή¬u%Oô>ÇÈúÅ…7E–A…ç/7Æš'¼x³øæî5Y¥ìÖüÿèÌx=›jbçç›îç©ÀÅH¯»½v›_Þé ÐsNŠJ 7ÖÓ1HzþfýfY˜{vÖAÿ³ìúâƒRokY°2H•¬2°3øºÙÏR&zXØ;¸ìá‹ùËuÊG°ˆoŽ2Áº‰Çés7ujy¹0·¯ëâ•;n_É0QLÊŸ\xsË/ž]wùåqwUÛ‘›Ï®µæê+{Mܸ?Q'Có˜Ùø°4 €ˆ.¾òo´kMéæÚaæÖ6Ë“Ñr+ ×¾Áf=>H€_¨IGÔýO†»–Œ½fíÃÅ­©¢ôÓ p¦&ÝÂ$òÂõ7úËŽ¡M;ï²Ó½š²ä-l»ö¡@ånŸÍáü¡'à¡ôäró Ç®±Ù»ÓÝ®²U7ç×D€ ÷ê#ÅŽ7 ^8{u²šó<ÿx&LJ=¦åûÝËLùøÜ¡gï_¹tíå›Å Hö=íñ«G·î=x–þúΔ»Ú‰e¾?e`¦;}ýþ™ék×ï/.¾¹:8|söÁñ'•ã£³/ÖD€‹Ï®\»öàÞþ(SqÅsœ®ñÂóÙ=C¿š{캽ª2õiòèÁµ‹3O_-l @%2Æ©÷âƒWgoß}¹Èêk>ŒÔ³ì\àü S]ù€‘™;÷¯Í\ž™#Šk7ï?¼> eÜ8zwM¸øâÖÕóç/?¸4ÕK=ó`m×xþI•%0ytnáU•ƒz\îèÂâ›kƒCà&ßêvQµ¼þ¬)Ì <±¦B áä]–&+ãÛòtñs ðåp ú[™ž‡ó/g§«bMLã\ÌÕ%›·† 1Ϥº~B¨=óæ…‡:zºyOæî´$a¨Ô_1Ä]ØÄ.P€þ²½3ÏæŸÎ†é[´^z<íkïWº~ÇÞî5+m¤¦Å×*\LåmÍmx…oáAŸ§ l^óµ…5ß4 ÏoÄØœyöúf'$À/V€‚XçêªæöÚæ±É»ó›`s¤ a?xtQ÷"Pÿ‡LyÅ õß}ðò·Å¹‰D!­ª§ìãäF­åGe/šºü÷î|ñ¾_õ:눚÷¼z÷°ºÙ©¥‘øhé`[h 4åW:é–80Æ>l @š‘×àܪ|Þà⣳‚ȈÜË«¾â:⽎à©{‘˜Ÿåš®®ödnáåÅF]!‡e2,B'Woâ»|R$IŸZàÂÝ †IÇ䃹Ç×4 W Pgêç”cahÔzÿùÜÃZO*€-ÀùæˆãÁ m«¯4^î<èªNÕiŸ|òòºó¥{¯^ßq”³^ ªªëèÜ ðy½,¿SøðŠ½î5˜¢•«úgçß¼L6Ó-è\ Úð3N¡/«|í ]Kî>›{ÜØs‚#ÀÅ…yp-,2sO®økYWijd{án• Õ uüÞÜÓÙ-P€-ÑV™ÅçG…‚RÆš äŠ8¬°”tžy<ÿY¸8ÿ¨ÖDð˜î©áñK§mŒL—ø`îf¾5e+Þ·àü½ÑJCQ‹¶¡+£%IŠDÛ©µ×`×ðÑÝN½=ôŠñg¯nõ8# !ë ðVw¡ž˜m×Ô­Þ´I¡ÀskÏŒg}Ñ:Žumã×f®Ü»÷Œux,ÌŸM¶2̺÷f© #5u¼CJ§§¯\»<ûŠsÍÝÍ34Í)¿³ÁñüÙÓÇO]¨?Æ#?ùäÍ<ä¿žÿ˜»“$%e—<úàáóù…Åë͹:b6uýWo]«L*¹É 0æ®ÇºµŸ¿³QI7»òìÌO=Y6Þó½bÇrkÆo_iÎ-¿Ì>°ß\-P?ªÖ>ódnnž%¦ÞTé}ògë'n_ê­x6vr:]”ŽŸ¿ñbÅdS5uS3·gÇl$,F®>{v¹ß^Þ~êñÜtiœ¯Å¦øÇÂ¥{=…“ƒS7¯ŽMNÝœ¿Y`.ã2sÿõíî¸KnšK8LÝ}}·?_ó¨ìFüãÙ€ƒ vãÐÍ'O_/ü×d×ãQ®¥&}Œ×.m»6w-ßDØnâÁüüó™|¸Àâ±Å¹§-§Ü™;y©GdÓj.¬—Ãó&s5‹„«,–š˜šä?™Ÿ¿”ã.Ë…Å™:èƤö,¼™ U·¸ ðNŒùñöËçž´F»Ò·ÂáÚUÃë´/.ºÀ)ÀV[û"Ö%è…×]¡®¸ÿMö{v¹Pv9°W£ŸsäõõP6ðTçêÇ›ÙnS@µòÔþâx5ÑDY1ý­__ñãYÞ§[Q.Ñu%>Ê=Æ`VÓ^ý1ÿbøL°Ìð ^ßäÌÎÙûê‚B¶¤ãú_ö¯ªìOeŽ¼½L²øæR]Ö1n°©ªz}IEO«lU¨Û`-óñÇ:1GQÀv‚GDûóù×S>Âvnõ«bÂ×µnzB{øq»iái]/æÁ»Îßš°m¨d¬(ä:Í`¯©øñ¨©¥M|s?GEzåÀV•÷¹ölaaîiµ¯c7Gµ´íêââ›2}¡}8Qk3%Ë–«l§-<ëðФo‡„؇ ‹†Ê x iIrèìë¹™Hu£â'oñ¹î@3Ñ߀mxïÈÆÇs‹‹àé“à)´­!i~LÊ~œ-À7mmï±¹åKse–º+u“$ÚL>7u¾ý”³Ø¯Äß%2ÊÁ0õMk°¥Ø~¬í¸½ŽiIÏuÎ/PC!&B`ÝÐþ÷ŸN6ÛáI´Ã"–ú¤Ã×Ø|8Õd×î»õ|åÇæ«Å±Â¼v—Œø¦Òù§$lm¡jÑtña[œ}nÙؘ§dø™ñsU×R¶ÿXh‰°Ú cʸŒþ‰:» ?èoé[úa˜®ûð­×ÿM`áÉTˆ¸nýô‹/°±øüJ¼¦yñùçÿΛçë-‚Úþ¢ õ#$@èú[¹.üìÁÝ'oþ;;,¾yyïÖù/r4ýâü«·¾þ§ŒôŸ»›%%¬(b×séñ_T(ÀÉáñ‰á±‰¡39<692ÎJ?4öIL¯÷zxéõäðÛ…¬×ﾘx÷Ó‰áõ3Y~=>9¼éŠ /3461¼ÞÂOÍâŸG€ÈŽðÿß¾o¸>È~6\ðo °ï_Yòþþ?®Å&þÏ~Þo|ÇzÍûŸýü`Vß²²ZzÁú”kùSÖ o¸xÁµþïÀ;ŸþתdìO¿;Ȫ ¸ ˜¸Ö·ÁįØ7\àV³amç?çŇ[ÌþÝ!ˆïAC@@üùr±±ôÿx_€\lÝ-Ã^ÈVÜÒ8Çu,›âèqõ§,¹±¬ÈÅ·j T"Ûx`z~¶ –m¶IàHýiáÖ› l4ôOG1[@x þ‰|’9ÆX±Ð'ð?ì˜ê?l×ý‡½£ŽýØiÀÈpÙ<œ…û9Å­¼xû)Çllm.Åoœô¬ 9¾].î›OŠ¬*…  $ÀÏ+¢ÛÏû¶[ºôvÕ®UKö/õ¸ß&X'ý» ÷/¿}ç£Í×p“êƒ ð+ $@H€! B„€€€ â*À•ß > $@ˆŸÁÓ⣀  âß'@¨56ƒÀ·!B@@ü:C„€€øÕ ð;H€_—ÑÛ‰‘ñþaŽƧ!‚7 õŠ:íi.´å àg¼µ–©ÈϼìlÉÎÞÑñþ¡¶$@ˆ/T€[ø…`‚®Ù暟X& p8Ñ\_ áÙ®Àî¡øœð”ÞËÏÉ–É'Q”«. âo 7žWRKS¡«KiÊ„32Çø,_qI#‚îb%6³LÊ_%@Ü/xe0½ä1në:™S¸…õ¥í*§âL Å$H[¿‹Ké˜KSvÀ–’må?ᕽZ€„_IjBšÆšŠ0<ÀZÂË€‰Hi‰©)D¾-}'?vëß"ÀC! þ=üáâ{˜FD÷Êd“>NaNLšITãa,(1…ò©*oæöµ„[{”ÄŸu?U‘a ¬ÍœŽw4 h»œíî⦫FÛv{PÙÓ6¸»©Pý|"\ OÅDœL¨ÎLT;€À’IÏ­ÊñõóŠ “ZJ¶’nI¤@„€€ø¯#@^ˆÞõî‚K1Âø£ÜgÚØQ£wX·]ÀÁíL––,Ûf¼¸í|¸í¼ÀJ;˜iöÄJ‰x.±³çÎn(@.›†ª\.~ÜNàdعt)0h¯MßÁ l…½­ùN‰ò©ÉH€ŸC€]SQòø-› }ivº6#¯0 $+HŒÍ`ònùUµgN룱N€xRòÌå±Ê3œl3ý)àgò ÷´Æü¢’ä´“âBÀß  Ä¿P€!²ËÐ ­ŸñÇn‰7L/ ÐÄ<¡ÐRkiÝÃÇ;zjõð­Î ØÎOüAÚ-ðöêÜLjÞÂïà‘yNKj)·s{Ý9Õý¼ïÔs›ãMßôôt©ui!/ý ‘´“ Äç LT#e¶?шªW}õâ²å}ú -EU¥#1[Pž©½u§ƒÌ¤ ƒNFZäõ‹xG€¼ô£B*‚•U•vB2Ò0žåI˜º~ôh~”…¨’8hEthN_e˜·…¬iD`”ÉQ4&íãàe%©é^<c¶TÃ]’U3ÓAr¢ÿûC@„€ø· 𨠨•§ñmsÙÌÄ?ÌÞÙTÆÉKKžÄŽè€_H¦ºžQ®¾&dø–Ä%|Üôd”G°¿‘±Ôïðõ‹Ø é:ÈïgŠ[jÎQ!Nêé1v°Ò`¥[™øD9{è`pà[êIGKß(÷ ?=}Ñ_øp¿’MŽ¹éƒ-­W~Þ†·µvÕäÇþ ü Ä¿m À·ÐLH€_­B­±9†  $@H€Ÿ`‚ò3ßØ\¸]HÌOGþ­Do÷ ©¿¢I;ù SàßLX%©+IŸòy³ý…nod&¾c•¯öɹ0¶mÞ`ü.§{CUEþµÜNr L¬­ë¯´7€N H€Ø_b‘ŸwÌ3pX·w²ÙxÏ[_a1~.–*î‚øú§ í B@üHœ&+éRÕ4|qüBm„§Ôo|ZVíãcc·fGª³®ŒT˜qÁp¿3=CKFÏOOv5FJQÙCøPî5³ 9Y=ç‡+sôùÑ¢¢¾í.´UV–ÅéË€9Û:×N_}4[eMc½cÚuÖÖåuMdêÊ€V$òjäÔ_ê++¿×î!´mmÝø´ û'.NŽW†»ƒu£üzÆ®<ùôêèØdUŒècÓÔáÉÙW¯ÍŒŒMæ§m1ÅÝšÛÇ.NL×æÚ¢œ±@n¥c£SÚCÔepK%UÉ.¬ñ¤­'@Ýä‰Kŧ*ëû§ÆGB¥ˆ$n¥˜¬Öñ± -¥.dmdljjx蜩&tAü;ÿTþ,ŸSÓî%*LÝO;U%#ªeÙxÖÝÚ:ûvk´•wf[Vß*±+ÂAö0^’éqéVîï,z6=iŠtþ…ŸºHÙ/—7y'QCŠÉ¯‘?tõ4[€àI'fTzó­íº µöó‰ŠyMÕ‡‹î@Ù•Œ…™Hq3=Ò®/@^‚²,7žv€Þæ#%´™Â+®‰¢2ö‘t\ZÆsÀÒyÅMkûËOiñ¹…eù)X–û’N—5µ…(Jà·po À 7Ûµx0ø_)ÌTÏÔÖf-ñƒy¥ÄöÒhéŸùµãnÕ þ†‡‹ îæX0<"'‚Û+˜’UáŠ#H9w¥ªäý';2•wñj9å<ì“ÿ ®h^t·ÆŽ¾•OÞ£wºè„Ä>@%'¾†Ù-‘Ö6¥$IßGv9™Ÿjª±ÛžŽç à{I¢0àϲY ½þR¢Ô}”€ðÂXUiü~±üŠ™v€*χΠˆ©QNõÏž=}ö¬Ã‡±îÏ@Äìü›—ÏXi^½zÒb¡¤e^“h¦ª8]é,oÝÜm(×ûòå V&O_¼Y¸wÉ fëQ}5F}鮪X—ôígÅlv‘ý+7*[%@»Ö40z$ lÎwf(ýF‰ÏiˆÁ£Y1ϱüûKÂ;Ùµ­3çÌ•“S‰ž¹ËªÛS°8V¶Ø#ï ¼#@Ò°¤ãꓧϞ¿˜»Ú&ºe×ð¬ÒN »º œ>;777?#µãÈ]`P€“ƒ!˳ª÷)Töݘ{ή۳—³½UÚx™ 9×g/Õ§žv¢°2ßÎÌ®n4#1Û^aÅg•…5%UûÙ²¤Í¥Ò0Ôí cE€—B•AS‘ÅRŽFˆmç!Ó#®<¾Û}.ÝWŽ –……{Ý\˜ç쎗/ŸõùZm^OU%,Wõ£Ä¡ƒo-ïå—/ŸvØk» YƒwGÚ²¼•#¡3â_"ÀïÞ Œt€&£‰B¯™îÛÓQ¨¶ïíZ@&˜©*\¨t–3Žnî1ô¬ÈQyo¶Ê£òJ”"u)ÛÉ#–‡ÁLN$l Àã-©~KìÊTú•“ÙÊÀd’&%Ë„Q±j+ÆžbŒþ]§yfÂG˜†Ýs ïˆÖ`Ý©{X·ç=®ŠÑ;Háym-Ç•»x*¥—ÚÂŶ#ÍKÖy(àW 0y<÷„chõõ" ÒÖ8Ñ{R Çyû«tQGO$–ÿ½ÖA(Ÿ8~ºghü$Ïê7¶ZbИm(ÿ˜ŠL9!uõ؆`Gv5[‡:œ°8¬´$Àó‘âì4Tni[ÓжKÏ2´éx˜ãðåN“ÃïOŽÆîBwñ­àåè•[^ðëù—_÷³e¨_] ž~\áò X~ÏþÁªc\°w®¦î©ŠšFÇÕNä¡“âß)À±C(©f<ÓV_ô0ÍPÍZ†{_€ú$UÝS3­Y6$!)@í¤‹“(ëØwˆÙ)Ó}¿À^[šb×:s}SÜ 7rË¿Q䣎’?U2±~˜Ë°}zÀÀóÔO]:Å æw¥º‰Ñ(AaÇ’%€£ÇG®÷Gbð;`˜”˜ü–b{âê½{—'êBÍÙ¦B:å J¿½sf\Ýsev ,7£?VO³KºtâÞý;.œ$‹ÐÌË£ÜÀs7í¨Š—ßɃÙ#’7|çÒع¬¡;-΂ëÜšWÃ,g|êêtK^Î©Ê Eν¶à*æÙo޻ߟ.¾““ mÜzmöÞýf7ú:Õ¡}âÖÕáŽÄ€º2?Öð˜UúäÌ­Û—‚•Ä±`?=¤ÎWNl.=³„îS6„uȯÑYbUÇyÙ9¢þÒõ{÷. &[¨‘·ò*Xž›ºuöR…¯s'» ܶ78®{NV‡‚d¤¶‹<ÿÜØñêÇ¥ØoŽ±ÁÜV~öˆn ßðáqÀ°P0ña`Ë€õâãD¾î‘o¾5éÉÇ Kÿ`~¿¡7€›Ê«t:µº³¾)Þäu¼rRIaeWEz´GZSV˜ünÌ6¤†^Dm]gsv‚É>öZ¦ÁeÑ®~•µíMgbÕ¹ð‡ÔÓ²ÛsO‡¹§»K3ÁB-m‹zš»jB´8c̱:©QI5í…îT ˜ r'Å%¸¤³²,Ú;«.Ö„¶õ=Óã@ '¿©=ûT^v;[€0YQ‡ÒÊÖöò|&«Ì6Œ¾qTSsgGY¡?l9 l9¼F€H÷ 3~®ÑMÍ5Qž"¿="2 øù‘?pÛÚĘc‰ëpR];¬¦®³%'Éì({üóNº[pa{sgk^ª7äIˆŒáì+ukÕÇb .¼p$ÃFŸÁ#s¶¤ÁN;fÓZæã×ø¤/+ ¾´³H!£:ÓšiIÑ·È|:+½\éÙüâbIœò„\B˜‹î×ô°Ê×BYÒ÷ü „¶¾ÔïB(jDÌ”{‘à=fŸs¿í”!U3§åÒÊ@è¥.6»_ŒØBŠi›Íw4RQŒ¾xw*P^·W´ ±?BEA[3t´)Cb'ŒJ°î«°ÃÓäiÚ'ð†5±÷¸]ï¶&±ïñH²—ä¯HyŒåZ|ý #‰üáh@t­'“±V€ÒJZ²­É"æ'OË—݈×F©)8ó@÷Ùƒ€ø2xø½ ªæ1ñþ1 6jÄ5D¢€¹¿6]y LS]ßWn¨ e^“d®®2Så¦`ÓÜ¥K÷«›(ÊLˆI/¸ñú†3/  {ÍÍD ŽE1‡-ÆŒÛpƒ‘¿kÆXÜs;rC[xh›ói2?ã"Óë2…Ô0«ŠûíŒ-`ýùõ¬¢NûEŸ6“@“ó8 Ït‚a¶ BÏõƒ¤ Ý[ò%öð¿ g—6„ñ‘ц­ ¶öæBb”,û¡~<„üüdµãë\™”åèŽònp ª™(Éfmrعë/¯{ð󋨧_;_dh® pÐ!ñÏ ¯0EÇXZÛ„ÁÖØ‹ì.6Â0Äyh’¼tæ5s™Á±µ™Új’¼ )>A •¼ºW\ŽT sòœ/?è1ø Þ`¶ýqž ‡´>ß•©ð+ùtv}$Åz’zî½6wÆ°òIÝýÚìe±`}~<Äê>³ƒÞÆ•¶Ú€Í p;Â/ª&K_Üd64ÊÌ´Ó"&¦üÚõ+ ÒÐíS þ\úÅsU˜{Å~,ö¨Wtt{1P?† ý²F€‹Y¶â¿#‰{ñrX&‘ÕÍD€ŒP ³rø‘õ‹BÅ•[ábTò~‰ä¶Ëž Œg P~Ò-²¢ÛA‘ú Î"¢ãA«%®wÇÀü¦Q5:ì Ÿ…қσ á°~Ce±ž–Ô®®­6ý†û#v„HÞP1N¾SeϹû4ò'”ž²žèÞå_Þà ´tØK˜ˆÚNJ¯èòb ½K¼äÒ•(A<‘5Ř×ÄþL”ƒä~å7¢V˜´•‡x&qCú…`uæJg":ê þüé(âí5ÀUö[¿ÓÔ‹¬­nn,­kÊÏ0GÖÜ @æQŒ;SÓ^ÓÔ\^W“ä.¶ãè[.eÂ'w,¡µ©½1¿ ¾~”î M*mèºþâFoM^Ö 4ö=*ì8JŒ+›{ÚKÊKÊ&îµ¹]àK/ÿŠ!pÌ,µ¶¨´0õloÏ (@`;ÚÉ;¯£®±µ¾µÀÃô­™v¦ª¥´¦µ¶:N™É¹û4îw¥æ™'"þÝA¶ß ¯ŽyFkuUnôé–ÆÎ¥p+BÓ¡d°½­1Á…±•‡tT!&­ª£¦©¥¼®>Å[|¯„zH}i}SyCg}É :ä ¾("¿gY;õ{ëG†Álf¨ÌÛñψå!Ký‰³m…±ÇÒÀœ“úCU73žù7â0êã–2/ž-2X}‰ò³ Køî (@ð?§Âk· ñ¯ ïöÃþß¾µÃù8ÊBþp˜ï.ðSÎmóùÿï¸|.äh\òQ p²á {F°Çé!Y‘'·xÈi¯€Pï”ʼ­Ãü›©3žO')(2Ü%´¤´,Œ†Â¬Øï§Ïâ"VVìM;næÚÀ Ä¿L€¬ùë „^¨¼k'qlìÀ·«p‚FŽF°¿35èÊ:‚ò2‡Q›} Òn¼$µ®\ŸÒ‰Ú•p¹¶ìëc\Æ]3Ãv«‡UÔ5ÃF ¢âÏöGªI`¶eu«i -a¦c7ûl²­ÎíP›·î–®¾ó0NŲ¥IKU„ãú ù…Ûmzï—vˆDù™ÿ­+¯ÇªÐ–ßb\;ž¥ª‚Q(Ÿeøp:[€èô”šÖü’ÕÔc›#œßoðípÆ!AóÀ¦Ûy:ÐãÈ! þîk€H÷„®úÄðãÊáÑÖòÚ¹ÀÂÂÎC­‰Ö6Nƾç2#¤w®y0úVŒMÊDsJ¨“EÜÈ¥+¬k€[2D Ÿ–;íÁT±=üï p¯œv̵—¢æËÚÜ×»ˆ´ŠènÍ>í¨jäíÄ#pÉfVÛxa’mSašÒo¼ /ÞœÎs´­œÊ¶§³e‹Ý+“_Ùl`¦‹'[྽eÉnÆ~u#Sá `+BŠ `r¢øõX”!EZü78k̯²Åç/æZè‘—îvµS4f6ÉXqò){ô×Ç{ëˆÚTŒÞä³m^7‘îe#!Gß #óªÕ¶ç8wÐuMRÝÍ#,b‘àìb¯fRÒÓî$‚…]ˆ¿ûW`â~!K]— û“žÚz¿ 0±FÚYPÐÎœL1µCÁ1[$¨úž6>A6ÎÇÅEI,Éð)(;jò!ßÆ™¿ Ûy˜X„§öGj‰b¶¬-|‚ì9¸êr#ÉGDm$eAK`qÒÒb€ºÛÓRq ´v9á×t»zýG‡àö5í}NêËD‘x4ŽË)“·ƒëbtÍ ò³ºÀɡǽýL,÷¯\çä•gšùÚù¸Ê3Y6ÛI2>æ`ïé$-Me=¯ofîhç`çhçjdzÇò SM|ì|‚Œ4—ÆílŒœu0+Ï8æ“WvÒâG½Ýä½ÂÇM8°A>(–ýöc~8‚þž õÝúóø€(&r£2ç6/+êãD€pöåØ>¼‘–?‹¡ý(໯ñ»ÑÌÃdáCxÂVèȇ€ø¸9ÏG|wø~?æ»}˜þ7äÜLõö{®Õ÷Åz71LX9¡#^²A>Èï‚«c~<Èà@®ÒÝúrl[7àÊrœ¶Ü••È…;ã?\·sýYHÁ™×¥¹ m,"àwé@×ãÂÛ?gx)IÖ‰*»<;hqM ñqr®!¾?üÀÅæ :ðÇCl®°I²%ýt_hP\Ë×Ü>5D~Ç…f…\˜ï÷£àB·½ÞU;V¸Ã£¯µÏdGƒ}óŸÀHõ Ìù§#a¸ïC î4û¼]c÷çî_ÿ¦Û} ÄæxtY€ï¹@À8þíA¾ÿ––t­¨é9ß?RyRf¿–UûØÈðÕ›çk³ëf†+­Âð\b¾‘¥ƒýçGÛã±?Aý„t«žmÊÍlkïí)>£Ë‡•hï;ßP^S9™ lm_6:}vÕT¸®ú†ì¼¦‘þÞC9à'"ŸæÙúá©îŽ²âÑ{­nŒï¹ÀúpnO͉0ÁšË©çŒÝ˜<ÉdÄÿ.UÒ:\r®f w¨ÂÛ¿…‡$ ’–Û6Ö?<ÔR"ÅãgÕp¯®°¾ºc°©Ì„¶¢|zžLW—·6öô–1dc¡ã šj*¢NWõõö7xëâwbÜsF†FÇz;’ Uq[`êf§/6ÕUW´÷7ÕFHpîç€t©¹Ûš—ÙÖÖÛ[–mGÒ%s†G.¿‰YÁÈoP>Ø3|~ /ÏÍ’¾ ¦¬Ñ9pùõüãÉîþÁ\WúÂA©àøj°%GZë¢dèëÞÿxXº¸¦%%¹¢··¿9ì8qع¢Bõ#Ø}âgÏ•p ¬ ‘[!êL#+Ûæê@q*X[ª´ièüÀh_EžÉèî4_·Ù2awÙ½àïöq@»½U"¯ªÙL¢ìÂ…åEËŠ³lÈsµ²Ìœm‰4÷Ìh«SÀÙ$w„ØJÄŠÓ]gfëõ~{ÁpϦÇu¡Ç;¹I¿b‰¿ËåOÝŽW‚©æ\ÝèÁèýùêûø„E<§"„·ÂíŠ}uEö]º´ºR¿;ÀÿÍAø·Kö[¹Ì($~¿Û{Y€ÒåÝD"…_³¦$Kn7 ³§ˆ¢íEË*EÜl Û °ñi³—Äî#’ê™cõ’?>=Ï;Âh;‘:NÍE'ÍI[Avžï󦑉;áÂ\HA´ySi®6^ŠéÐÛœ¯±`üÍžxÅ_ù…Eï\ÊSeM*Aº5=mŠrù…Ÿüž¼›%:Ýeª)lY€¼bi1.@WáìÙRc~ÌûàÖÿŸ½ók*Kÿß³t)–ëB ¤7BBïEšT‘ª€E±c¯¨¨X± `齃Ø{™§¯3³»³»³¿Ýïó;å&„$„XÇqâó>>$¹÷ÜsÏ=çsßsÎ[¸i«Š{6Ï  Øù{æÞ}X7M-ƒ®ÞÙ6ÝqÇ“,´€¬•}kbýÉâ¿×»‹#&³"v<î;–á=EäÍö÷úLvF'ZòW´ÿïÿýßÿú7;Q„Cô›&4¡Š[¿ÿ¿ÿƒùß?[ÓÂcSkŽ,ˆŠÜú¨*gƼüæîdm}ÿù>üûq=Á1f¯©þ"?Ò™f‘FöÓÑ}—´ßLx‚tM°/(®ß!àq¬Ý£ÏýкZjlÅ2ìøàBÿm[è`b…gÄÃp©ôB…mG ,--‹ŸÌ~î{àìõ£ºýߥë®jª¥ˆšÜ{·9Å ð—s3%`¢êá´­¾p‡ûx¨6_> •M§ûç×ï_ï4–.šp©±m+ j€·v%AÅïóØëÿøbÌÌ[yí냱nŠÞá¤ÏÍ<ûâ§úÿß?ne í•8AºïôÍÿ'kÉÿò4‡ÅP ÀË•ggÈŒºÅ£p’×é«þOVìßž÷/´a:ºüò—{.žZè¦K㮓?1m¥$g_g_2Ê:4†&0¶.0¡ M­ùFd;›Ým¥ÑH‚¿|·y‘T|SÜ7ì¾rn¦¯WaZ̎ľmá½—·Ò€¦ÁÎ)¼¥/pÐxÑž“uGœ…cºßÜË?"2 ­í'Û{[;ù8ü14u`À¥Kçe,O˜ÂHJ=Úš¿ (9R‡Õß<>ù)œ½gº½)UÄZqãNm\ à(¹Â©’ÑÒQ“*Û}&=z¶a¹ý€ãíw«=3ÝQùñ™3&­”‚)pÙ¥3ÁŸ>Èv½Î••ŠIÓ/•Wb ¦Äw~5˜Žø™ÛѲ–NÊÑ~\éA‹æîh¹ûÝpgÝщÎp(G†)f‹ ÏÂ3°;tõvñÂx¯©â”¨…³™ö*¾Àñûžv_âì$ŽÙ²n¥ß8è ¼êê³]!R”$ŽÊ뺧óeùòÙÁ®YϾÒ€¦ô„åç_Tlç†TÞIÐ Ì‚ñ^†|WE3ç-<^·nß”•‘[ùëw¥€ÿùæÚgßìüyŒ€)ðƒêqva»ÊŸ]ÈŠ±7S #¶®±1ÇÕ+>~÷ݦ€qp üýwݼýÓrJØá?Ž>:©‹[Ëb¨l§ƒÏ1…Ô”»ÿþbT,ùÖYÑ ŽÛ}&ÃÑ3X¿qE–7Úö°›S^~,ìSõ—/k\*‘ø¸fÞk&8Áÿ܃o÷…ûyLåÍ9‰ËKê.L•x;ÍY·(Ãc,# jyº«/;²°ÿ§Âx7‘nŒèD@U ÇôsgndIÕÀ—OŸ]¿|l6C_¼3nFHvë™Tÿ„Ü‹W£ì„Â9'ï}ùÕëW6Ï“S†kѱÎ5^b¦øÛŠ¡OåSÊ›î=k¿T|ªb€pÂôK׿|ñ ËÍ=.^NóÊvä€é˜=+¥±lŸ¯ …5ÎcÓñ®g·úŠŽ÷}Û˜-5¢‚ÒØT¬øÁEKs÷£=òBî%G‹§ø;x(Ä’%šæ[x¨pæD[±UP᥾ǃý\ºÓzhœ×=?œ×Ô÷ô^Õ‘øi4ž)o}÷σgJnÞù¢÷DnðDxãÎü˜ û7ˆå»ÀfìØø¼ž?ê­_ãé!„› ·‹Ž_í|ö¨¹4ØDà,>Ñ»5@¦¿sÍï’×íqiNªØŒ±pUé›÷z.]>~n!×É‹]Quÿñ—/ê7»Áõ:»”¬’÷AKö—®IrCäô’.hl=)‹_-!û?¸úÔ¡°Ò± ù·îKªêûª7O÷¡¡8©ù G×o«oíï.=‘ÀrÌ,êÚä m]fÎ9³5:PY3BÖ4´ö_»¼Æ ŽsX¼î|wÏ`uÙjŽŽ“:ÑÉï @ ‡½e7N¤ÅûqÂKJëÖº»Ä-j­Þ™»¡þ—ÞÓ Ê;Ë}x!Ñ»5œH“zÏYpê—‡‚¡É.mË¿–í'ó|Ùþ^m­?Uå.ˆðËüöÅH¾Àƒ{Vr9¡Ñ»_Éu5g%dŸû±iï§YEO~R—]êqâëûå6\øûý#+æï©^*/œ·8†çšÛSuÂ'S ‡SjCá©™­‹¥Ø~,{ÑÞþ½1~Á —úò£Ö}<ÙWd†|]½$Êcªd–ØÑ™Uyµf­o¸ÿòžÖ‹ñ“Ô¶oUó¿UŒ¢ò}ØþÞ$§QÓbº‹ç5^«ÈrrŸ¶ñNOñ¬‰tÏ༟+p õš»„ÃÒõ[èä=kɱS{ÊŽuPw¢síÝO«žÚ[ØØrýjrhljÍÑÔè¨OªW…Îß×Ü•èš›Wÿ°ê",¤ ò›ß^¬„Ž±ü5µß™ãO®X/¼ûòÎ"€ ÎÊ“wFòî8»CbF—ßî8:Yº÷Týo±ÐŒ˜vE–˜;o9¬íÉÌ ࣺܨ¨½_—Îö]V³i©Èœ¸ìÐÎ#E‡.>¼Y?gŠ2íiW/›âQxîbŠ pÝ`Ž˜/eÌÚ¼öÀɽÇÊkŸ—¯O‘˜Û¸Ú'µ6œö4%¦ÀA‡ï]ï,Î?vj_ÉÍGN:ªÕÍx+k¿?>o:aN£E^àØÄ3ºš`»í¿pÿÅãö,WµO5Z’µÀÕË^×ou¢“w@†‡xæl¯™‰R'µþPöâüë]ãmí=HPœ'0Õ$F?Ps"*àNK ©†¥Å|{‰Ñ¾RXÛ±X„ø°fMDÄž¯Î¥û,­Ùšå`=·¹¥.ÛÓÇ‹UYY5wª2…\\¨Øâ¹²¦ïêÎèM }•3É>Ew¼º")&‰Éì½¼i¾PÑnFtɵ}¹¾Üb˜uN-]á´JŒ~éòú¥¸Ýˆb-Xî¼Y[6—Ü{üU]’³ÎCM':ù§À“gV´÷äúz:Näûr¼½'s”˜ä´ ëôàþed¡³¥S„“?J,>×*1úDÁŠ¼+«gyNsÌÜß=Òx·e¹IwÔåyjë.IílÅLŒ¨ytw…ØN “¿óÒvUÝ+ï9´|õµâë7K³Ýɱ½?Þ_Éa‰>sÎ-ýúŠ:zJ–5•žŠcŠ¦ˆƒD¾n8z•pv|f O¢€f¼ÅW.™ë'žà°éÂÃS81ú8ÇüŠŽK¡NXàcðôõí%¬„NS%!b_ ºÄÒ1ØFâ4É.iSãçãu‰Ñu¢“ß{„9+vWmmGg][{ùéTžD51º-dOáµîæÎîºæúc«}ǪЌ]ÐÖÖÓQY^W{D癦¶}à›}{£¥âÒ*‘X%1:ÝE4·²¹¿¿¦®¢òÞm«´ ýßCE /—,»;POh€æüjû;ºÚÀŸ˜¢ÿüÜšÌ<ßÿ¢c‰§…]ê¦k]×j®œ*>ñZ P4A¼d剎&Э-%ùapð͉Ñm=§ç·µuT¹çÐÁ û¯T\ÞìÀã™"Y¿yStÔ‰NtÔB8FT†‰¡þ'k¯8a`ʳ°ávS\ÂÄQöþ~#§°TÑQ0 JÂp ¡çÓÐêÍéÇ6²è¨è8ÚðgýH@´Tü¸(%oŒÍ0¤jãº;’ÀàZÈËøMég 3¼ƒ›µè¨è¨N`¨û‘1ýXdmÈ3±ân(Ñ f2RŽ¥àê–sdÑŒQ÷:AÙ(øÿMÖ0ÙF~8Å'øƒ?ÆFK:Ógœ>wx¼¥.Ntò‘/ýé'Ï¿¦Ò¨–~H TÎÌ+4³uóÎ=³"bÔÝ ˜ fD"ƒÿ9F GÚMò*8?ðÓÏÿøñnËow¥_¡6«ÃJã?´ ÀŒ!%Gµ~s-S—iW':ù˜(Ï’ …×%SœC,OȘ-vµ· »qâÒ£ægÏJˆw‹_é6–.4gy‰¢2b22gÄø~FGÄcø{Ïu MÉXí>‘!øÔyNhêÒЙ±n á ¸P cÊò„Å‹}]qXQ)É-Ù{f\ð‚¬YÉáV|´q,÷›3o–K\†¿»Àˆ”À!›sÃÓ$.‰]˜ìè!µ ‹§¯ËX/ñOM;r·é¤Ï8º“ï<ŸYÉaiKÂ㦲P B@BÑ5Á|c†û$Ìt¹$aÑ"ÿÇñ¼¿D¿)0ÚjtætK¼â¤ÍŠ4gy #Ç-^0gŸ„û¤,KX¼,">`’NQÔ‰Nþx”é~ˆ~hÕŽgÂZ¶­ª<×Úô­WΟŸÏÇ.jo?WtþÆwçŽW55ï·gy¸,j®¹¼/såž}WoYìjÈ[Óð÷»•§ÖÅ/Xž˜l%™¿§·åÌ¡9GnÏa3¸Æì•OFòî¹¼L‡¥¢Ì;íGC>o/¬»dÏ1¶ [Q÷²mµ›™ Ó&ž&õ 8¸Na Aõƺì±7Ú§-++Z+SÏس”ÔíȺepä–»eëE†4¶åì›_t¥L¶Â› rQõ9‡[ïnœîAœná4 ÍYËr/Ô-‰‡íÆŸ7ðË£l:kƲš¯«³§[Š?ýp¢¸PDæ6Št¢“?§Œ @Nܪ³—ŽŸ½˜›ho‚éU,yüd±8ÿñ—·/î9xl}k\\Ôø´ö=}t{#ÛvÍœ¸ªêÙî0g. €™óìeÏœi@½´y%_à.Ï„î6óÜm«]ÆXñLØó×_8vöìò`ñkÀ]Ï6{ÀSIóŽ_É™‹§¢1ɇêÏŽ·å ÀD;|c×þ%\CóÓÐæ/î¯cÒñ'E2@Ö5¼•m‹¥vÚp,wS~sßùbÔ&@òâÉ 15roÁ…Š3åu§-äñ>òL(B3u¢ ¤‹Æ²ìǃ) Ÿáp{ÊÂŽÞ†dë!­F€É.+¶–7¦óá>/ ðê³¼NÜ1èã´Ùý/Ÿ-g1x&Ü åµòž$ÞQXW"àòÚ—­«Ü̬ÁX`Îä›1½ à¡ë߈†›+¯–¤Å2#còn^90‹Bd‰Úr¯z‹½G›{÷ë¾tK¤Ú¸Q¥ [<æT´.’ˆd÷h¿·fp¹£€gÂØSÔ‚(ø,¨áë‡ë9„˜µáRÓ¢på–Çq%¹.>ñ¬c[؇˯—ê:¿Nt¢y ð„cLÅ3_•¼û[ëŽå/_²oûþ ¡£ª/°—GVw_ká²å«Ò·^8µËÏÂð9 4€ÂO+¸Ñtb÷šÌC7=ƒk€æüp˜¥ÛÚèÚ“æ0•¥ÀãèþQ;Ÿô—o¿æR\ #4hѧpÆ8º÷Ï›eÇ×ÌÛVW_¿ÔI*¡Ä¶Ý{rió¦ i+×'§x£Ã5À/œÉÊÞs°êΉÅN¦p„=!¸åéÍÎÎ,+˜¦ÄL8€¬%»šKÖ-K\Ñy{Ð-ìW]¼ßº?wYP ÄŒîẤ³§õDÖò5éÛ.ågÄl<¶rUNÒÚ²Îû§b]D:êD'¢0•×Ä ë~D™õ¯tšëÜ™™ëä,Œñ™Âöà'ÌâK]ÒRÄb·9éЈ|%±Ëç®X—²x«›ØÔèN í¹23kþ§Îó¢3WÆÌÙy¼OŒàÉü9+rS±,‰µâ9P<xÃ`z¢©‹#¢\-è3~Dà•³3–¬oü¶*MbD#š?ÆÌÐY†àoªÀÂù@×W'g¬™Ÿ“æîã`AOöÉJ•›’⸹÷ȶ´øå«ãS¦Ob°Ð´—i"Lš™ð9GN¼èÀ9þŸí\8[fÎ^–9k®_b0™‹ ¡í©ÁK’WäÆE:"%ÐÇ>Ýrfº§—ÔœîÈÉLÌÎ]½40Øe,]7Ö‰Nþ(ŠÓ€ªH¿WM„¤hB}ßA _f ¾quÉJ²stá¥×ô/pµr…³_èBò.¨¾Ñ”à ’U‰ÔT¸[mît óéf7‘†B»÷,¶C^*p Wÿ3ÖýFLØôqx‚è6At¢“QˆÔ?èeÆ‚úïÖ³¹i…AèB䌫ãŠSGΗ?ºÊÏMdLÕ ­”°¼¼âò“%G'É‚Ø`»h.2䛉åžËÖ„SoÇ9{Â…è¾@M úgÿ $æÛŸ€È²ÝR':ùŠ² ©lck´+ª€¯8è†)ÃrøbçbäÔ'³Ú€ÔJU/ß }•¦uõ†r £´ÅV#B4M0²{òG@ÐΊk€°ÝôI:ÑÉŸP4i€FVL07Ô‡~òñþšôS šlæFì\l7Ùa:/Ò轫6Ë0ø^ËúH'Ûp¼™Î²ˆ °ºEê0žñî‚!ÌØÞl¯ Ž‡ç$ö² ¢%ñóÍú›%–`ùÇ5zÄ]ȇ囮 †]`uyÌMßDá±QK-9±£1Œ™~°µ Ññ]BÀ_š°skéã/†ç¶àmØ|dGø8Ö!kÍÞêºîKqÁ#E6ex+T¼¯:„-ÿ‘ûîÈý–:¾{þn"Ïw™ôî½ÆÔ%F—Nä‹-Þu8,æÒUEç~? L‡í« SÆ=¦üƒeHÖ~¸É±)Ã…ÜU ÂÐ'³ôµ cètÙº éñÇ’©ÿzøvZAL]#Œv"Š³4JÝÀC!k8f¨ýGÔÉlÝøMȈŒØXUÓÙßÑ_³oSˆ%;vaûíþÇ_Ý­+®yx½z±•­„2}ÛþŠžöþ憣³¼$p¿ºöû–sgëÛÚÎO`‰Bw·u \«¨«¹…}Ó2.öÝþþ[W¸®ÆÆ3EÕ}]]çç‡Ù™Ñx³KoÜnm©¬¼÷£º¤H±.7~¹~õjãµöºcyPí2²Oõv÷]ïê,^š$1W@1?«³¡óË{- ÅöD9=6í¹:ÐÑ×ßT·mf°”‘ÕÒUOÁÒ²Š®,ŠV@vâ±{ϯ¹\ÞØÝÞ±Åß=½°÷z–¨¶KtóÀù7 U2cã¶ÕÖu ´÷VíZë7™)úÌií¶Kƒ==½M-'¢¦¿‡MåndÅ5¦áÁQÃ?êYrŒ©,’|õX“Š~2¤¢€· Š| ¢BT¼ª®™©I±dRá‘h¤ÃEièÑI ü‘–µ5+«€Ÿ,C ®Û`X9ÃþVù¨pÇSbÕU]G¼ä’Õ^eDíCR{Sòº5^3Á`ËãF0 s )J·S±V ½buâ}pbÄźÖn®NS·î¾¸†o\zÃÙi©§¾iÞ=õɶú0ñ¼Ì¶Íéþ$‘cö£ïš’`úKþÚ¦_j·/vÿ”é8ÅÎÁ2¬üñ·B½Ý¬ÃÎô~1Rbôþös‘Sžžkî7ìñ/X¾³rpC‚Ù%ûpßO#ðÐÍŠ„Š-ø«wÖˆ •Pâk«+ç ¥ÞâäúÚ+I*ye.ƒ§«dd,né-Ûi-v!»ú[KD¢ÍE}ÛfxðÆp÷][æ €¿jÚEå‹'JܦŠÒFàäèÒªk™NÎ$÷½‡Kó<¹qMu—f‘øΖŽ$Þû tý$6Œ€ðdlIá4e4||A­‰‚¶éA «„…5⸃×â’p àÜašÞ5ƒW*<† åᔑû<™gl%C8ÈFå °žlX%ÒÐ% ÒÁßsÈ\+¼a§Q‡´$ZR_F!#P¡:â«0õ á÷¨4ØDòÅFÁM„[^V-ˆš ›k„šNŸLT›( 7qu–¾€Šc„ŸÓòÛoÿþí·žMnꑽ8ÿûÿý÷·ýûßP~n\¦ê ¼­ ï_  tÌ¿þùõ:.JŒ^ýŸÒEÝ /5í²´ pYó¯U™>v w=+æÐåµ Ÿ/¨)=<™>’8°-XL„_à @{é‘þûÿd-ùSMœ·hŠ×±Ê»?ßn+É]>ƒÌ}ÿk€(¾"•û€+p *Ç ßä ÖÓˆrdÔ' !«*@¤j@ÙU¨ø*,2eMÐÍÕ@P+ªÕ€¼ ¼–¼G.¼.E¡Å†ͯ Q@­ÓY:Tß¿3ßßÚ=51;‰­œ¸+Q2cÖîg½¥K]<íc¶oZã;–¸ БࡅÓζ——W$¹.ïùâ+ @ž‰wÒåU ÕðSöœœóß×숳‹8Zýp¤)ðáû¿vÉ áGŸ­éÛì%ž:½¼±gkH`tĦëMgC& ÄèüÏÞ}±7ÌÏc*GéN^‡nö]Ëòð ´‹Nò@LûÔyßÙöoúv½˜Ml‚Xد:×W¾%ÙÑ\-3²ë^Td{Muß^ûí €¶³Ó_?˜ãOC“›±®'joŸ^4ÇŸî•‘¼<&”R<Ò#gÒ$ó2O>¾°Rú{PQ1#Ad‰F…©y'PvÖUÈÔ €èŠÆVrýD¦RdÕ v8ðŠdHBc+ž!I3Ñœ”Ê7AÉ0dð’£L­ ž&£åÊ× ‚â¼þ5È"k¥@K ”;AáH4¦ _[@øŠãÈ[TÚõèÎý®ó‡l…³Nl‰ά;1×/vå™K3„s~ü‚C]öu–®Mr3·˜rj^ç-‘[¿Ø['\¼vý^}Éé“}û¦ Æù•´?xtKÏN'©§Cò¹MËOì™I×Îæ£ 'zn8Òò ·£èDÿ÷MËÝÌÕð@ï÷-g+îݺ_¶&ÕcÈÍ…™3sÊ»çka-àê‹ÛRœˆj°fn¼V¾Ð{hâ<%øPùàÍ–«»VU_Ùꌳ§>ßýh }s˜øèi—tîJߣÛw;ÎäϤp%ß¼Ãõ ®_;·P$ù=6A¨Ã†whéPÉ8²E3› XQ¤ÀH˜h âÑTÛð %дc‹fs²Á`‚…f²Ä¢œ<ácR¨,™XXC VŽl²É‘¡Fv–òÃd—Ƭ kF&ªÂ¼Ïâ‘ži _$¤Êö)àµà‹!‹c(ÛÈÀï +Tg„J.W¸W·¢“pÁ5CÅae ¶´7èÀ#•3J±,U vè¦X¯p9ËQaØuG©Ø¨­aÉ:L›ÖS¹A¥:È”LÌÛ Jðõô‰<÷ôëŸþöÓ²œxç±6ÚP*XØyïû¿ýõ»Ûw}¦.ËÆ;à8¯Ów^Þ/Ýéfö±ù¿ µzÚ°â­Xô½ù‰Z2Íò͸ýæÛ¬–¯øF­yÈZFÀQ=p‰L6¯@  #}?ß\lq虀ڟûø¿ž+œNtò' Y %GóM ß·W Œûgh¥*#Ú+;:ášXƒS¬Æš?ÚÝ}”ÔEщ.Œ6Yѵœ) @k…¯tŸÙ¥Ï*ÒMÕ #T[+‹ÛØš4:Þhª£- woƒ#*pMl‡êÆ1¦i~¨€3f겓_¿üõÛ[5 pªtešX³ ošNtò§m¨6x ä€Q£ÓO–e˜¦@)32ÃÇE4fT҆Ќc¿×€ck àðkƒ„Ó?Êsej«~¾ màƒ ò Ð{M¬u±1uòÅ { ÐÁßp;Žú‡ŸDó‚ž kfQY÷Ã[·N/žã2Ž{®©©ãAwiáöKW…}j-0çÅ/8Ü3p°ª8f‹Îâdj=¶yW[ßÁÊS±6,‰uü…êëwkÎÜV¶1Ô[`j¹²áá݇èéraÿ±ÃzîtÕoòp뺮 ù^wÛá•Ý§ÒņT @ÒÁG{ëYg*{ܾ_·;7p²<¡å­pëvûÉmn¦VJÐÞ£ nßë)?žlÃcÙÎ\z¼móºòÚë·kN%|nƒ¸j K3Z!tâÍ<³7/sCå­;·ëVǻڄß±ÑýS[;JhÉÑ}¡ãÕpœdɆòÁ÷ú/ì‹#Á/í¦…»Øyÿöý¶ã»£¦Ù~c­¹÷ò­ †1x"6\#+¸P` ^74¡)k {Žæ惑|Þz…‚>TðªRþ‰¨%pQ3 `ï…~ÖB‚Þ/îàsA΃#+Øøf6<¸ÞEÇ”Í5i¯[8(Š&TyÜ‚14Í=PTck-g‚FT9Õí´:í+»~l~¬/;´è|M®‡k\FËÕíkskî9µ~YG™7wƬ¼׎̵óˆO.üéѱ @÷ã®mþõÞŽa$®ÓÇä±³ý§ÊÕsC½Võ½€†Ð(æ*Ý7¹âEõB'3kì <ø°k9›3#jçã«\ÌØqËÎ~[³3Ú.âXí£—­«M`L{ @>ñZa¥íP¹1Õ‡æ‘àç8–·q_}û¾•‘lϹÑóÃ>³ub.‰ˆ¢»¤,-ùº2ÛÙŒ={{Ý?G’Dó÷ÜØ-À„É1‡èjŸÜùè«ŠŒp÷©ö3E®ìثŇ¼'2Ä61M5ç£?U 9/iSý£ c>©k›{JVyŽcFïø¢íPV€{¬JÐÔ߀ü1ãÁh <ZŽQx°ÿ€W¡5KW o%4…üǘP¹Ã»îEPÆØÈ;ø[>qPZa€?AæF  Ã¬‚Æ4dHLæW„hXþɆVmjnA`BcA‹8š€ïS 4 Á!mèùʺ¬ËÁ÷æ°~‚=zâ„W‚úÂé¼à5Iyï²~.02ºŠBRÙ£§s@ª ®ØHdÒ#—?¤øüÚD‰:ŠX¹÷¿ù¢¾¨ÓÒ~£*%46µæhjtÔö'Õ«BçíkêHpÎÝÝð¸®âü‘3çOÔ|÷Û×+¶Ðîڋó¡)2L1Œ\á2¬<ÆòÂ[W8%.é(Ù.1£K‹nwœ˜1Išw¢î˜«€a`í;ïò€,#ö¼ÕE &g²CÄ0Ûˆmâê–îŠS“D1„ 5Ä“<ÎW_Kf †\ù&;¥Ïß^|äÌ…ó^`Áœ³½öù¶é\#šCHùÃkkP±ªLj­/ò0%¦ÀΣprÀ¥Î‡÷ËΖ,j½ßYcÉœ±¸e°áܶyéq‘èÃXÔ@ð*çžgÊ|Sk6ò®f4Úp¡-±:©Yƒ^aР.Þ×lè‡ ? d½!Y©íüBx] „ynÊß›e•Ê3¢èø{=.AÎj±Á;ÔD€* AÇ ‚ã¡o†žšÉJ»™5¨‡IqoáÁÿáë˜ #lPxh.zùÁé ѬÁ70è1þ ™ÍóLlF ט.¶ñ™å4#Z ¨ Xœßß~6ŠÄ•|ÊXl1Ì8%¿©+Ù}ÛkG‚}í'°‘°„0>wÕ•§»‚%x1MÄB‰Ñ§‚¡d½hWß$\áìyÐnªÓÁâúÝ"CßÊ-úÜ€@U£;s‚CíƒfòD éÀHDe¼pó›ëõ)LŽý¿²šÊ›¡ÀqI7/í‹°JíV}õà\söökOÖzr i’ Ò‡uœÇ¨Õ“Î하h @‘eصž®\žô3.” ,H< v¸÷¢£§{~|:˜-æÿ!È3}˜ÆÖ'=¹‘R‘ëÙèä˜ØL(,}+<]…ðÔ#ƒ1ì‡Fpï ôvø?¢¢öRªêêlªKS;ÁšY«› Ñú?Œ,êS0Êð¼>b5´A!Î(2S_pfx_ÀFí#ƒ E=ÌgáLN ÆrðÔXÞ[p@tEÌItîc|c0k iX”[¡¨ŸOŠ,oíÝàã4QàÏóóÊUàl‡yKN \L:[:Ït p0}žµºêùî”hI01¤ìÑ·{ƒÜ(Á§»žËƒ!h`è§ü¬•½kb\&;dîïS`cdÎg…w7ÀY ~€Ièø¹ÏñªîRÑxñ’Æ‚¸÷)B_¶‡ÛXzúÒÓ3â„æ¬ÐÄ#?y)ðá* KKÖBú9ÚeÏIt³P@›ÐË—JÂ>gy¹-¨ÀLšuíz×bX ý|6÷vç&ú‘Dn4¯p;O‰¹­« h:Uä8ÍsOÕü·÷@®ñ+Ђæˆ„xû¨Ð& :$xóÕЀÌC™Z‚SÀ‘|ô¦ÆÄ‹‡2R ÍÔ¨yhòV¾Ê‡&Mt4 "Þõ8øÐOxÄAÕ†dê‘ùctYðÞ÷˜«¸³¦ @+¬±ƒžÃ†Á+P¾!ØÐ$×Ôf„Y€ |әؠ=ô:V8Q0Ð —(Û …sjÐKõ‰~E¾R)š¨¸ ¢æ{sfDĦچž¶ÞîÊâTž½2Åòô퇪ú:®·v4Yéi*ÏÜêˆ&P WÛø‡äµu^ï»v¹¦úæÙü±K[ûnÿ¯îv×_ÉÛ+0ÈÂZ™]Ú48ØÔT^~÷û–•‡09gÍåîæîξê}‚¦1A³L÷Ȭ¸Úy££»ãüþÐÏl½R+¯´¶\¾zþdÓÏÏ/`>XåÁ5²v.{TG08|óó§‘ÔP8Á>wWåõƆò¢Ê'å„hÎÏÜR;Ø3ÐW˜âlfëÄI8^ÚÞßÑ?ØÚvjy²³32«´³©g ³·ñÔî(*ëßAÚÀ˜KZ±"Í ¾y©pf ½SáŠ7wø´¢@Ô{i¨Ã+̓¨xÞ4|;¾²Ò';&ÄNFÄj¹ â0‘Èvu8³Ý[¶”KV-S'ï€6C]NÉhU¾¹&èµñ…Œ–Ã…D%z᪙£—ž À)°!ê„mþ•Š÷Aàßp…†Ù{—l. ×®ñÚ ä§6Ćª2ªŒ¢ ¼V|…|p(X…oÁÓg9í‰þm¡®Jg)»¢àuž±llUVÈ¢Êç%ñ‚aôÔ²Ò>mßÔ†e(·¥±F§Óskhw™ÃýD>´˜£î›CE P)i6ÄsAK‚"3ÙOªppºAã›ÂåZ|æÃIŠam.[‡¸ÏÀ!`¥2ÿ…€ï±`ŽÁí<kÙÒ7ñžj¡oÇymëÔ¿÷nô2>塽*Ùäa5è 4ô¸¡ÂÆ5¢Ê¦½pÛK‘ ±n¨›¡b©òÑ›š&ïBÐx€è–p.04­ê±ð¬W2„ÖÞ=M €XßÈÒPâ$é84™»ÿîÓù‡æŸ½z2?Â’¡€à¥-ýÆØس“Š NÙ~äjù¥5"  ÀÐI²úŽž¨f£#h(—€<“WØÖ‰N> ¡¿žõ Þ,i[ùz‚ £PYQÖrÌ=¬B5r‚ØáÀtqŸÌ g¦ªæ_@ äšs]inþLw_ŠÌ†˜T¦Œ~¸L-(‹öM°`ëhEùø¨º •sd­ü©D{‚lÿò9m¨@0¸Ps‚N„¯€YlC¶÷c!+#|$` Ë:ªŠZ òs4ùøƒ!üÅRaŒ&#žõ ’ d¾®(^Wµ&j¥á`†Â1#ÕvÔÃÔÞ ÚÓµl Æ<-A›¯õÈTÏÒ¦‘žÈö%y% cê54@Õšéçâ±úDV¨½©"ï]¨ª¿#;íªFósŸ¾õ`z°D¥Àáb-PñP~m ,ì¯Üùô…}ɳ¥êø@Æ›¡ vç¾Ú¡±V¯@ÆÛà«D}mqv_uRßPÜü·À×r£xe ÐÇicÕ.ã>àx€ï€£ø.¨ÍØ©W ZʽO2å¯UÑx/ '~ò:dŒ¦–k¸-_I£¼jµ{¾J§¹Î™¹n~örR”ÈŠÊ{Òqha€•Äù3æS`Àã¿ÜÌóK4ZĨœÛõó×»¦ûÚÎK:|u[Ž½97ïlÇöèP/²tœíÇ· òŽ¨~ü¾³õ¦3;m¶iFàwôv×ïl PËöëSà‘ÚùuÈŽYv²¸àdñÊ8‡£?|6xfKÞþ\ ;–;:+'FŸë¹½ µëÄ1tÍÑÐ=–¿¦êy~„3áP¬=swÿ$FçÎ_ k{f±ÄàŸW¹{­›Ã®Ö+G‚'ÑG`Çã}3d9•ŠæÂñûöž)=s¥îdA"3}w6Y–¹R€nê(feùïeÛw£6Ù¹.8\q†_vÑá’ò’ªâœt× ¶:þ!øªûÚð5÷˜>j2_€Ì·@ºÈ‚) d„ñHNoïkL¶a”½'Ù%gKYóÂá'Bî s–ÅÝÿòù*.Яø*žhÀðIâí…uÕမ‘C ]4ÕÖ‚¨­ƒuèå gsNÑ° Îf$>Ú" +~˵/·M·3³õW÷Çqšæ¼êÒ‹“ó|±&l?YìCá ømÑ9gÌÞ{çÐ@¿Éè%][U°Y¦ÆtþòÝ&{®’¾mÿ)σ~¹¢t÷®(0}]`†v³Îw±‹ñ†Cø]k€D¾;3-ë¬e}˜ZùZÝòMÖ³óêO\7wåÁ] •8GâéšÙÖÕrjÕÚMËòJ‹vŒ·Q ¹`A~_Ëé‚MË\¿ÿ´Ð\8+ yåî®{ –†ÆÏøœ­ À ŒÀ¨û*öfn*k|ò׶Õjw &HöœèúáÏ6ð!¢EãűɫÞ~Þ¸734.h’­ éÁ»Ÿž_•vðòãg€Ì°EG¯X³váÎk]ý¹bßoÑÞúÿ=É÷³P @º³ÃâžöòõQswiûïs€Ž63Ë/_Û™ž5ÏÙQdÆŽ^Q×QQ²-måîM‡Ö……ŠÌ8+îÌÈÞ°òXÃé}Ó§2ßÿ&È»ƒÆ;•ß«Jo¨¾Ÿ6y+«©ï®’¯±{ò.*ö&»À’)γC,OX¼8(ÒkËɶw±ONØy9ÆÌe²…æ,oQÔâ¸ÅËc¤8»I êÅ ðFÒì&º$‡§gG&l/ìßã-´°›½8'Kj™+%¹%¹BíK4ÙuA`¨3ÀÝXa¸ï¼ìØ‹ÖÕWæ¬VÉ1cøKgfÅD»…êŸÝiÊ,y± §ØÂeCi\ºƒÂ ç8ñ¬àôeÑÉ1γúûHÌm8Ñ9 éó\<Ì2¼¥ÑYaþSb؉¼ØÍq( úX~¨WrvìüDøìÈ G¬mZ°ƒ]²Â#Ç gú¥€Ë"⃬à\>À)~iÜ¢ìØyQ,‰è½›Á`.r«ÄÂ1¤¾Eåã“W]ýc¾GþpÔ/oi³ìýÛj/n9in>þNËêûºñ¸Z™ß0¢r£"X!‡«¯×ÆJÕš4¿â”ÐFûÓ?>O ,òÐJÚ'–\uÔÐÕ9¿ÿ7ÑgÔ|/ÛßåÜOF´ÜÖ~²¦¸ «Xì;g‹ÂUÞ4Þh±W£eÎk›<½j'ü è*]v4¿è\AÁJ?{íNSgìÜvâÜ¡ãû$8™Ûð¡GLåÆ6„¹X†VŒáÎk£ þÓåi`àG @6h¿X²ôHPôI@ TìKl}2Û€‚„ÌÔ³äQYzÆ6(¥²à% (à\m¬ø@MˆŸ (\C²–úþžehÍ1 )oÂ~‚Š‚!©ÉL³T_ t'½¡/A›¨­ µ ø_ICÊð 2lÀÑüø´ôøSó¸A}èpŠ¯oÄ€:Rk3FV±”.Ä°[6 pPkh®ŒjýÁðäSåõu4¦ ªz9= ×x¨[j¶‡Qüø>(0¥:1 ”Ç…Ó"MõÜ!]C"+æ+&:gàA Ü‘1 åùPþDüÄ X6¢’‡9d é>Â92†!ñ+#eè`Ê1‡•CA¡eßÈŽT2(ÄŸQŽŠ¨X&:Qý;]•iD”EášÐ`èuôKáêV,<:ôȸ2C+Q1ÕôP‡nÐ'aSÀ°ÿb˜£–Á¸ãÂk ]¡’¤XO¶>‰¡ÐhòʢФ¸¶>þ‰DÜ…ì0è"jŒbÀ¢Ù‹‰AÃqã«ËªA’•CbËž)Ë€2ô\@™Æ4ž!Q7ÈC2[@=ÅgMT†©§€8f#Õ‡¡ð\²ºÁœãj^LL=òð6¤âN8Ôh¸êQ@ÿ„5Ñ'+4/QU†Iþ\”>Ž @ÐýúêåUgš0–‹rJ_xJ9‚Ÿxšk(K9_xjÒ#aÛp`BLî(ÚÐÑÊÛ} CŽ>y¾x J Æ¼ÀtgŠK¸$(Œïî`ñ!3pØ  ¹ÌÇ~ÙÆ0ȤòH„oX¢ÇeE›·âà1X±õˆqÍCÎØÃU&ù@†ú øé8ô2û³z¢´bMÐ¥±¦(<ш F¥ò%ôÈè'ê …d‡GÝ€à Cµ“Ð%((50Žº˜Aè)P^²Ê¸&q E‘ jÈBGâ+â0Ô8m ¨¿ðWC‚Æ,YL$Ñh(P’ºFƒº l(4ž‹ã¢ë²PQtTL3 ‘ŒH0õ£Ð¡GFèP:lÀ:ckŽ>q]x¤ÇIF÷€OU(‚ RОÀ&X:OŸ„2€Àxõ ê4¨TËÚŒO„‰®ôP3šXsÑ;NåuFB—ƒc¾ŒˆòáY(ñ‡5Þ ê„PÃG’Às„ÜF=™­‡ßèÑÀ» qpÇ3¤2µ ¦Æ€‘BqàP”9ן7±~¥u6Pa¸^. 4y?Œ6¶žašö%8ª <ô!DòÊ× cVæåáî°["èÙþås9A‡yuÚ¹ÌÞºîÂíÁ?R^` @¨ÆÀ‘G:øCÑ‚ˆP{Hk–ò¾ 5¦rl#+B@}{˜B¨Ä¤…¢)0Sz°W³Ñÿ8B>fÎ0MÕ€Š«Ä† ™ƒ†G>ŸÃ•@` &mD©`N MĺóÕ…>9áða!âqQ¶Ø£ ©xêhŒßCÔÇø¥ñá p0$Ù*ú0¨3„¾:|× .ÑgSSq ²@K|@4Oô8FÁÌ‹‹àÃAèS ߘ¢ØŒ²ØݨpG SK„q¬aRÀs!nÐÍ Ið]€k¨4Fï&C+ÜÚ\ð8`g€Í¨¶0e“ n™OÀð¤7¾>AÆ*‡iôÄAä¡g! —Ja¤à©½–Äè“S ê]0,í•È1*d¨T¸2KDz&0„¯@(¯¡ Dzx "ÝÐþÉ4¼þÆóÄ×™ÿÑ£ᢘ¨(à¤5Š²«-e]Q@¨3 @åµv 9±Æ³¶QÕMfá4œ© @}„M=õkò©(šCý‡˜¸É¯1M†_òÐà5€«Ñ¨–ÒCj…+SáäS`Ù%Èr2ä-Ç U3Á¨‘éQrRØ d7hÍ5 )´6@¶€Fê8¤¶Aµ¿Dˆ¶Bš›ËˆC´!ÌÈ& z1©.MÀ[þË19ˆPLƒÁ®€@f™kH–‹¨O§³d·FܨükpºVS`Cù¼UZƶáQ›¯^méhè¼v`[(™»°ýfoÏý/ïÕWݨ^jm+¥å¬hoè誯?™è'„É;8+k¾o9{ºª¢¶æÔá(kľÖÖÞöò²†úÛÈzþ‚3íß|«è ×ÒTt¬¼­¹ýlj8¯=7ércm]yÅ]˜n ÔHù°Ö€ljF×Æd*DèüEÅ2…cù™+Owµ¶w·´Ÿ[>OjN·#…Ý_ÑçʼnÔ8LômRv^û±©´¼¸²åÚ•u®"¶ºY°«}RSCÝÁ¥ ×*WĹšÓÌÖYtò|=h„îºêÍÓa(W×õ5Mõíu…±$Ʋ ìÛx•ï4@¨ ˜Èg7 k‘a–c*SÕaVjeCÊБú®z•F¸Ú£§¤¢q&>h…‡©ZItèkx°eG 8Æ©^°æx²L|Ä#OWåËn\cªêå0¹P“´Â톒-Rd 0%,¦ ֑ບ…±yÐ+ƒ Ã7Q ò2 šòƒ«Sd'ÒP†z¤¸*ð“!Ê—ï @ôð؇“>¾ BŸBPüLÔhkb­À7æg¢•ÏÜñ²Kk•1 Ví4@=b¶›âN šÉ*–FÂoXeÂf'£¤3Tbñè–ðµ ÓPQ[“É„ˆ‹õMË&K7í<_ê—ÞP’³`þ‰ošwÍ]y¢µ!Ì~þÒã­¹ó}?xI–>ø¾-qš àšÆŸ®lL“ZØ '„“C+ž~“7Ý]jx²ëùž Kû[ŠC'3ÜÜVÝ­ßëfÊÍÚQÙ·j–û4ÇÌ0+œ PZÆÀ`˜g)L#á†Ò{Â]…f‚]%í«½œ%ÔĺªŠž½§pv]mU2‘Žœ™¸uðØ‚é Ålõ¬çîªý{írgŠËôÃ7ö{˜¨ ý £ßêÊÙÛe¹Nežxœã–³íÕóƒ=¦ ý¼òZ¯žÈN<ü]õ¦D—‰|š«óøeô´ ŒÖöU¨°È"VÎ-q§eÄÄz»| ]Õ  m‚(©Ѥ¾ç£«ÈÊ!’_—Ø p™%_'ÇKèòI…SÀ1D†>’‡6)þB‚ÌÑ“oIÛÀZÚ’m^ÈÏÂe2›B6å'vÒõå»3°øWâ^ôHjÕæaûJ¸Y™Š-ƒv‡d{ĉè#xYc]e x¿$ŧ k ²BSñ%†ž ÞГ¼ò¸ó(´¡úþ£tGŠ=JÝÆihDÖ†D£ï5Y# µ ˆþ׃Û[ð´Y¯Xm܆#ŸUû·¿ýü·Ÿ[ÖIˆŠä ö|ûŸÿíåO?ÿÈ·×Rf({‚¤xn/èýû/¿ ~zùã“åL[¦gåÕg»ÂœˆBl—?{Ù“0€Ëvá®>Í®pvœ…7;‹?“,iØmÇç¡{Ä\ø±m‹ pWû/ûù—ŸkHLàVKhì¹KK)iõõe³,m]¥;›‹ó}>¥‹&º^jÚ+d¡9µÍìm7Ž.ð 8/¯æÑJO8[™œÜ}§9fÜV£–ïµ¼À}_ýún¥Ÿ7\Š!ÙºùyôüIsñÉ 3üÆþ1쵌»¢3ôý0½W°IÌÐÖ†®©G7ƒ±•~îàEupšÈÄ[ÃhlͱYÝÕY5•>¢/pŠ[n^åÅ?ÕšM pg°#Q%ýÎË;©T0{e/?~[Lç¨+ò´ã™Ð§§VüغÚÙÔšcljëN–ºLfb3WÎœ«EGf¯êmÝŸêlnãÄ_Órá°ÿ$ºhŠ×™ËÍL˜cNßjÎö›GçËX÷;˜dÙäܸ]>Þ’þÉ4¡Ói2W4Bbt'Vô•’#€VBkãE"/ð´¹­µ„8yúÅö¾Ž‚ÜmÓ6ÕußÝäëðAl‚ Y\Þßî¸f¼mÛéw¸õmðM↵‡¥ºh𴌆ˆd¯j'ÿ.Šš¦À¦6œ2C@Ea‘î»úàâʾÖî “W¤p¤*¾ÀÒ³ö|q£r…‡O $>oÇo3À+€ÄœÚÔakËËŠÕsƒÜW÷õ•6œnn³äì÷ y±âÈc×¾Dk€ z(‘%²D› ¢É®…g»ï|ÿãaãtŠYSߎ°à˜¨­7šK‚&ØÂL"úÔÙ22 lÀø·[—ºLÏ9L€âë½´³¹0dœzÚSË*¯$Ó8a‘»ž>®"8!ðâõ{[}=¦±…æÜÙ¿é(œ/ñóÊXŸžêfÁ MÞ”îêãÇO¼Øûx[Àï@˜iE6•Op´¤Ü«:ì¿2?x¾¶·ì{öþãðÍCâË’¦QáÆ«>ÀÈìî81g-nºÑs½ùT~,]yxCd``ú•Ã³}b²Nœ  -q)û›ÛnÜhi,ÎIt4äd§î©^îf—£‘)1gÊ:*Nž8Ñ—Ÿà/ï{²þÆ­>,-[$ö³‹Ö-†aœ­ãJ ·zŽ¡1,\Ví¹6Ð\øpÏw Y&ÄŽ°â.°ÀŒ3oqÁ@ó‘ÐOñF†mhÀʺæ¾Æ«ëü¼Á7Á9 m×Aå¡t_Iœd“²³êqþ†òêÞ¶S;CÇYâ P^®©µû‚dtâDß²B,ß6çÌIÙß×ÙU~°°úøž²½ˆ™{[ÛoÜ*žï7š%‹Öœëì¼q³ñZ^ü sF`¡¦†¾[=§—Íqÿ=âäóǨ‰#["S» E–/þ¼ÞøzÛCOÍŠœ|Á ›Þ±õÞì×ãX#˜v¿bÀMÊëô&$íoVC—Ð|‰¡ } ’9“¶­ 7sáÆI©2¬ás¯ @¶1aûô+œ4 Ü14&g×8Ü`òq¹õ ´D2{ÛȪHL=~­¥«pdãj¹ {¢ÛLž“øSéÒm½«ý¡5Ñ«ÛÊ ÿ°íǘ1/ïÚÝ%Î<”®L~ñOà%ƒÀ5+œÌZÃ*¹¬² +­àý!·±'–‘%?¡7âå}5ƒ—„ç×CûøH½¡ånü«Â1I-š÷ïžüHÚè¤)­ü[Q'"ˆkÉ+Ã6 *ÃCùbû°m–>YqYžø¨Á-E¾€ÖóÕۇýΡ-ÜžŠÛxµ_Å[Ù:BsJ…í¡ç¹$Ô¤„£ë/ŠûJ$ù^9¬'˜O™ ~+´!‰-o4t"ÜKU >™£°9%?QYCƒ†RØ%›&Òx†$Ç"äÀ¢§´«ERëX„ /ñ¯lxu²Ü/[ wç$¿‰Ø€(f* ŒFõÁð‡fÏШfˆ¥îaç¾üë?ûû——–β7ÕTšÜDÈYØõø—ß~ýùÎùmæ6ÐêU mFuȃ÷nÎMÝ[÷ ËÍÝ8¦þàâã ²#%bAŒQ¶I€ÏݘÂøäsìÌŽL¦©\C+leÇ‚ö TÌ+äq f±]fü`…ŒQÑ+B£# û‘mrF@¶ÄОß@ ³4|`?—ùžÀMX>2‡@ã4reF‰È5_‚‚L;¨\”ùb@¿]l¦‚ôd@¢?ä/†Fp!\h\MÁ-ƒÍK¸†j‡pÓ@¦&Ð…Ü/4`Võtƒ™_Êm?i ÚKÈ}¢­Ÿ ÖØaCK2Ã*G¥Ññ<³…… Šý 2¿O“ØǦ&Ð8‡hC›†KØÚƤ¡¡È­ÙåkŒØy·›BeȪër¸ÚÐ>GoLEw2ëÐ!³R*¢^—“YÉÉ)7©Â—2ÍBFMÈÕ…¤ô2 €h¹yj°Œh¯ë Ï…ÍÔèo0ºåø(×¹À”Î7¥C³¨1Ö2ÍAxB-ŒEæ #!pMlxx ¬ËØìYnù¬Ju¬b‡}dä«Œ‡ÿƒÛp*"+S P›õÈغTÈ)|Øp ¿)9C!¦Á1ÂÃЀDh=ƒ`È°Paj˜i±ÜuTŽMKl!†¬×È2 gªÜeOng‹ Æ(„Oª 2ófcŠEnÆ1æfÂ6´’9ÐYqõ Ó5p×ÈÌl¨ò*F‰2[k 2!˜3ô(|+åùÞ0;@¤„î Èj¼l£aöu²ÐÄóBÆKTìèªhZ)! Ø’J†Ð¤, ™©èC¼3C+&†Á(~Ê„Ñ8òZ…ÎÄGìžIÅ?±‘o&ÊQò±MU¢b_u,j(w•R@™Ã\ÁL=’ª7èHd« aÄ¥g9*™êHR@”½_ÑÜcŒU#-HV • ©C4€ €”!®sئ—Œ{#WR­€Ã‚¨`'ˆOÔX@®²DH¤*P_A#%Tzìê2dYúº$–8#XËk @#*îNL=å°0¿{8,µÌ}g_zR®>Ò©Æœæ¯0$jSϾ%bY9jæõ*…>‹¬}úÝßýºÐÎV€¶ËúwÇI_å§Ú;MxýÈÏ‚qnuƒ?þøcë楢·@ÂC\¡[*y$É=ä#Zæ;(ëWÈsØ*™Â˜D~ˆ\eѼ•¢0låáApeˆC5Íúðm…÷)ˆ¹˜<" (G$ÁÍO üú†É¡NeHƒN+†€ÐŸ”+£ù^)¸ìYa–b=éŠÐ‘†]UG(¡½ `$Ô-±«¬ªÈ‘½J ~õ°[ á·•j´À>Ëf -,PäWp s­:e‚g£p¡UÎǹè„Ã`‹hŽ €ç²v@3Yè+ oPÂ#^ð*2U™6d• —.)r˜ƒW^žU[oÈ-’ ¶!x5PäÛXŠ+Šs[eRYÊ3bÙSÃ5—?Mlø-±öA.e„§y:‹ßå%ä|µÇ9ì+©@º/~¶Dj§}!æ¬õyWvøx¿á-„‡ìªØø:ä™(ïc§–Þs =²¢S-aH/·¼<Ç¢´àŒÜáq°A¼¡°¹ +yØB7Úé€ ì*áãpl(¶ì,Y¼#ùéŠ['¸y¼¦a7È›m‹d. ëä Î8l‚Ü}ž¸A™3væR»õÀB›rç;âHÕWŒ¼A°ÛÂ_HŠÆH°’ð¢¡T6…ñÁ$†‚£SOM<–ÂScÈ.AT×S!K¶ìFüMÜ;j+â ’‰gdHüÊ=²!ÇôQîÜ7œ< Ñ·†Z†„o‡cHœ(‚쑼KÖiå'=nÅYÝo/ ª/îlõ¯ž<>Ÿ•â:ž™XÖÙ=ðÅÍ«E{®Ük<ñ]h!˜qòÆý/4•.¢c§Wî’“½§óôß{z¯þìl&WJŸSÑ|ÿië…Â=UÛ¢ ÕtvnÇWϾ<™ì„®âå4ÿòÑ¢ã•7žÜhÛæå ™è¹ådÏó[}Eêo]Ìt3®YH6œºvÌ…°=M 8St<î3útÏÌÚÎÏnŠÇì;Wr¡ñÁãΪ‘ÝHºhâ¼#ƒ·ž>»Ñº1ÄÇN€Ÿ9í?Új[¹a&¡ZÒ Á-7—-a²…fœ¤íW{òw5t?xÒ|j™.²JéyöåËŸýù›o¾ºÛ·-ÒSíuCÒŽÝÝ—zôBïóg÷‹cÝfÎß×¹"T@êºëNÍzï±j(¥¹ÐóÅ“§Õ[—ú|¿ \Û6øè‹÷.-N›¿QV8-såhióªy4dFæ{1kÔ¾ µOÛ§ù,¦ÖiM´L€ò>S¢¼ª Òëp¬kÁåÃÉÑ>ÌSçjÖ{ºÅe´\Ù¶fmõÏ='Öå—vTøñÃãöÜ»Rbç?çÈËÇ'Âà¨ä¯mùçsy3,¹Þ ²÷žÎ—å9I¡9Ý_Žd½tð~û2'$bÇãªnæ줾½º5Þ>â赇?©IŒÎŠßÙy}Ýt‡©Ò:ßY˜ÜraÏçç+69έ¹v9•Ì‰ÚüôÅõí~¾É©Ç¸~8d‚š{tñ;v£çÊR7Ÿ@û˜d±z ´âVûDœ<4tÖÎ;WϵsM8øã“áyi…?tD%ÇŸ´o‹’h¥2"V\þß_¯oîåLöž%´Í>ód{8¨€£oáO·÷øSàXÇ-—ÏJògLß]Øx ~†hœèHiçΈ`o†²ƒŸÙ›ðM2cj™«Ksº4Í?z/< ðaŽÌ™©îmLˆµä•–yO>äG329 ¹¥gJ+¶$;ª¤vìõ¿Ñz±¬âLYOÿÝ깡±©5GSgFm\½2tþ¾æ®Ùnv7=o­……œoþá?߬f1`V¸Ú¯'úê™Í¢{/o-¤Ù ÍØ9…·Fà’öâí€ÁâÛ'Ã&;ì+ª?éaÓ\.¨”åæ-ÚŠj›41—ÀS÷¯­›7ÿýŠÕqA+j¶.swÙÿøɽڳeÅW“`¬4¿X9÷T R ›9Ð{¯gy€B\¢›Îç¸aîª €e¿œˆÈ>ÆdÆtò+üYÀ°àrÚqsï=kˆŸ6¼œO%I±ë+Ÿ=/Ýí<ÎVÃ&ˆ|™/Щõ8ÀÙ4F×õ†¶?ˆXvoÛ•Œ¥CÆÀŠ¥÷6G ‹0ãyg)5õHÚ—7…™ŸhȯáäËEÂW.SŸÌ3$¿Á_…›S-+3ÂB‰=B DÄÂO´ºYµVÐo´ 21¬´¥kˆ¿ódQ8hú4ž2“œR2OÞ,\n-v£ºÇû…9[¨äž|éáw#|Ýl"Jz¿Ð €Ÿñ³¶WÜÜ2Ç—ìšs¤OÝÌ]ò»ÿzkÿæ™מ47l ö’Z'ÕT_Ítru™& s ñøäfi Ó>Èã³ûå‰SÔPhzzcßå=3éö®d×ét©.0þöÞ;*ªdí¾¼3sG2Í£t:çnšœsÎH¬¨ ¢€fQ‚d ’0‡1ë¨cǹ3:7¼÷¾¿ï;uêt‚F0ÌÜ ½V-VwsNªê>ûd³ž\wç™\wëù½MÜ&SÇ@tc¬öSG®Ò£)y®nXÔa HÍ%ƒí?tÍœ© ÕöäÕ¢ä2d$Lt%÷5N>û‹.I¨Š´3¸ùÜ`É¢ºLI^!Š®\r ' ª¢ ªô¿rŒ9e'ÅœŸ‘)@Š›hš €Lu]M£82’·NÀÒri>’Œ¾§6¼Ù £¡&—š®)Q”’Ž6@M¾¿rLrß…Üί|ÃÔñ2Õkt ÛÃao±,) ÜÈ ] § 6&w–4Í þðèêŠ_“üåÔ]€–’œìÈÛ¦¬në¾tãÂÕ ÍUóØ¢‘Æè8÷‚íÍW.Þ¸98صw™«áÔ£yxo83pãzgcKãU ˆj캯åÂõ;ßÿëõý«gO¯[Œ0F7·bÄï¼vûüÙ†º›ßÉUfŒN›·ùnÇúEbÓ…¯KçqØ,>ikÿ¹«7†.Ôì ™Jñ ]{åtGKûå¯ûö„»+7¤›l·jcã•¡«×Î÷lóB_`·—¿¾s££*#°¥EVw\¸ñðíßÞ¾r¶%‹l.¹­ÙÚº<0Ô]–ëj¤ õÌýýW^¸vµ»m…=ºuÂ_zh臡BWC¥h.2›}âÌõ+§[«^üQ€b¢÷þêó7‡®ìO÷êQÝ—Ô·]¸~áú•Žº¥ŽŽ|#ÞªmW¯\§$›%°`ªÉ2jl¡Ž—æ›É lŒÄé’@$yAhÖHæ{0Ÿ¤ú( fðXn0útîEZÒ‘Áø,,©ÇÂèš4éH^I{X¼*¹LM¡¢¬iz³<¿Ž¶½¥9$ LÇýZQ‡¦Aš;ÿ5lðáPÀ¡# óO ËÒhÑaþ'´G‘SŽ•íØJs±¯^ÊæVÇìÞÐ|T¨p‹ñPÐÇ+ø/ÌgÄIŒg„gȧa«á!ÊýHèþ÷Ó`“y–“hca~ÅÅ»ñí¿0m¦2†Ì¬æLJ£Å¿¶’À“ ŒºTP’²)°D¤$>z×ËN¡kÊÒø±)°‘£C`H˜¨<;êN+Ÿ¢ˆ‡&· ò¿´A“%RÀò1‰^&­aéÁšhî1ˆpðßÁДè¨#1I|I³ A~™úâÁû*©²a¢¯£tM€9~$h!ÊR’L¯XzžšTŸ„z‚!4c*L(wèFYš ÈìÔdéŽRkªán,R¡iI¨¯€®H¨…GýSHò ~v¡Ñ&U2hPÏf¿Sp £ÈI\08Å$îQ3‘a¬^™Á&Ú,Éu‡Ù}jòèŠ%6£ì ÌývðÙ¤ñ0üš°¯F—,Q¾P‰¦,‚äÀ@)â¬ñïÒc{**÷Ö4íߌWn°˜_UVUµ½¢µîø !ûÄ:¤ä?¢Ù¦€æ©Œ òi ›cù¨&ãÀ #PãÃæž¡±î=5oB=‘Ñ ¤ûò¦œ€‡äªÔ £ƒ½JG†&É»£*ÚéÂÌdªR× Iw § –x©ŸhJp[¤zj8iD„­~‰‘_ 죉Ðdå( -7N”_Æb×÷@¤íÒÆX„ò› )™ÃPµ”Œöû êôGD`Aòâc1P0‰ïD²r!‰m§ÒÇÃt X¹­g²‡¥£YúÈ…oæÅl-Úµ¯XR6lÍtrf«ÏYÕ¹Gî£`% rÆ@,øQ €2:‰Ò%‰úc qxdnËhƒ:”ià%D&ØÒâD9$ºÄrÒ`î®iä"?ô—„î[Ôü!]RáJè’!Ú +]DÃø~8ÒTšVÐ%“G)Â{Ìè¡4 Ê++RÛ&:WÆ“#ê1Š­ÖÂŒqé2ìÄÉ“Ëà: õ[EÔ"I->‡ üPî ÅGñ„„¸P4†jèD]ÏdÃ_‚D ^jê„= ÇPâìüë¨è·¬€ZŒ¹£&q,]2CM0‚f˜¿7¢~7$} ÆsÕ˜³|Ì4Á"¶6à‚Nà…ÿpˆU!w± C}Ö0"ð• L•:AŒšè‚“R6På‚ÌÈ[mXz Ž!aÉÑÑ;š äû¤–:à‡J—læÒFßJFÑæ‚šo’Å%h¸Æ ÓѵAt 'Ç0kr õ Û$U‡7ˆ’‹bÒ%šÄa}Ä6ÄÕ°ù/ #ahÁ,.1 BF†%HŽquLµF®ïxY³µäž>¨$æ˜,ùRF¶œ¦¡Èî‡ß‹ÄÄ\a(G›.qê”ü‹ 728Åâàš›”“¨À ’k6ˆŠå’0¯¤14uÈ‚ÄËNÔÄ®ˆRá†×)9s’ÂÞ¥C¿zÙÈàÚ&ò Uòˆ‘R]¤œÁaÍ~/ú¨xxûC ?‚‡…D^U Ëo!WZ›½Ûš£ËC,ß‹Þ¥ ²øº¦|-"LULÆùlw$…+ã‘™'ˆ† [©dÖHFðo¹†âå›·¨+ŽøT¥®~ƒnVþ¢— CA›/M~_Êú}HÕð´OßÜo§1ã/ã@P0ðƒËGðÞÌŽ&BˆIF CξŒñ¸c?²p° @âªãXj³<ü.0ÚMûq4M˜êÊ+ùíD€Ì¹H}ÒÙ¯Yh¿|ý´ßö¨Ê/TF@0£Ô1…B<@3læEg¯ÏX‘jïba`î$œ—3wéºÔÔy>óWÇÇ:™óôî6q+䯌Môf† Ù' 3Ñ=<'mùª9 ®Ó)üiŽ âóÖ&&%zÍŸÍœÜ —Åë3óW»ÀÔ+’ëÂÀøäèe©™‘JÇDg­KËžç·`U„—P™˜puðm¶2 ¦„ø''™JÒÞ&‹SBbÝŒÌmͽ'//H_š °8¸oCzüòµÉiÁ¢š€ ß,–Æ,†º ×È"qvvAFþÊè8÷© ‘Øb–=Òå‚EËçÛ#̓`+[îçšU¹|¡Xêi†6ÒØjQZvÐWž;Ð#mõ¢U«¢£Ý§@¾0;.09Ê+yu檼À@ e½ÿrßRï0±ß†-'EûE¦´–¥Îßø°uEPÊöîþHëœu'»sç…‰}ƒ2¯ÿü OØöbÿ<_6\œ{ñõƒl:•;‘_{wÇ(\àóµ›,(ã/ºÑWæ7U´a_{c€˜;‘˜ÝúúLŽÃDýð — žK …‚뜺»Ççúæ´¬‹òqÎ8½-Ïž»²¯éÈ<ß0ëȃ';Ø0ýB n·¬·E'ÓÄ«Ï./!›#“hBÙ(Š"q .%¤èι²Ìšý4t‡švöÚ¹§*6{«Ž‰ð§~u¤„¨Éë˜áÆTºÖCUäîÁj™:¦0š6z©Êß☣nú›P¯¨0†òCñ%êA I}Å ¿lxG£SÕp 'ª½©¡i»ÊŠwí]*ÖÃTFjZ‚-·ï]Ø—W€LW‹³ó‰¬”£oï>³k[qvAáâÕEY¹¾Sæ6>( °„k€<0FŸ…TN[¸éÂŽqPá‚gÚì>Ò¹EÈE Ô!¬‰t‘°·pë¾âûÒ½,L£ç ]ªÙV°÷üåºuɪ%8ººz®}Û²¤1ÅÙ«R)tE.ðýBhAkâú©ÏB¦Ò€ïLßXT^}¨©ûȾxò$Øtçá¥}¹k‹²ÖlX²j¡È À²U ²åÊ>5C6Úºì®lÚÀ¥côÁë-ðº«c“\¦€°¢®1†Æ~7ø§C¡&ÈØ(dç?øþΡðB«—8¸‚J¼³n?\¬¥jq’âD[‰ *…ÖA{¤ø$šÀ€îŒCT`¨õŠ%‰UDéæ£bz ™gBñL4k.ÿBî̺a)I¼A³M€2ä:I”öÁί俒pÝÎGÂ$g¹ÜWp³°µ1s /•(g ¡ ¿4‘‰‹JhSÈ šHR‰L‰þ3J A>°l4ü/¼È*Ô$JeŠ™À‘ Ô¥Ìýƒ©)p<™šX–¤?0µM9#‰9ž`¢ÈpO "GNi”cÅ"s,±S ¥¥Èš¦Û¡ ðZÇz— ú±Ð€ˆI¼¢é%`§Óñ#Ê”feÍ8¥†Å,¸Ë]XÑœFu¬NŒOL LQÚ‘B†Œ|%XfŽI¶:ß¡ „0=ýšÞ‘hJ)È,˜«Ö!JwrÁ[“y}C]‰f4eh¶ðpL°]ZPۛ ‚ ŸÛž=ôú›&rÖ4ÜM–µ·‘.ç´¾îͱÓ1Ø60çÉž±{ÅÕ§6¯Ÿ[|öJU݆Pokvî™Ú}ÞÓ)òbwÛ7Ø!hiž|ýÛ ð`Aþx"Õ”æÐ,¦ˆ–{zpž»7·ïr_²UnàóŠ8)rõ‘/Ý<±þô±ÝN†Þ$Çò®«'}ùŠ©Vµ ÃÐr–¥‘ËE !4£âQi€.³H©pÞ… YØ)³æôsgw˜;E`ÄpäFw4Vx¾“ ŒåB 7C]çT!̃ä¡YøѨúh¢Nbšƒ©(£YX:ÐÍ°ÀÍǵ©“°hmE‹Cu9+%)h`ÓsœTZË„YvÒ”`ÌçÈ H› ›ìcÑ2)pò—`ÊQº}ŒÑɲT_š-1E‚0§QD°lj´Z:Fõ7/PÑ9 ÒˆPjB¼3uI«@¤!'ÄLª$Ñ‘)÷LQ̺'ÈRÇ$¯±fkà¤ÿ…õ°@(ÍTÄ(ç|¡¨Ú?w,›šD©E‹<GÊ23±qôË’}¡RYl0PÃjH”"/‰ÏB¡ŠÙXr ú›ÄÑäò±9: y EGÛiö»P׌…ºÂÁŒ—a:ó\=fFaKûÁ=ë¬ÞS²-g9’ ìhÞÙÛ]¹º pÙ–š….‡ [—•´¡¿çÈÞ¢¼² 7îïˆóæðc‚Sów ¾¾X–;;)ÇÁ¦zÜhØ™½®¶ãî«že6Z³˜š8ÅÝXæâc/‡Jsí,ŠÜʲò'YlØÛÖ´}ËúÌu;J£§ƒ5ÀÛw¯[]P¶ÿÔÀ¶[=hÐDÒSZà‚²}+×®ËÚÒÚ>Ï^ÀÓc-Zwª½bïÚ´•{6íHX@ÀÛå­}ðóËžu|Ð$ªgèÖ çÚöä®-Éß»+w½™‹ lgŸs}¨® fAé¡KR1~|s]ý†´œdkK¾3.¯¹»úð†Eù;7î^êâÎ7âe/ßµ)sù¦¢ªŽùÖFïZDC5Sd‚¨ã¨ï@æC$çd1’[¡°j$@- ‘' W’„|ÍL5)DTIª˜,T“ ¹Ë¨JðËa‰Ð›-’!‡ M.”@Ì–C]‰cN­²%hŒR•‰lèÅ£.3¿©ZCÅl1!”‘˜2b;r.Ð*™Ë ‚J|:¤®( ÖÄË‚aôà‘º1MŒ ”ôQ‚V$^Ÿ8Y–² ÃÑÔe ŒÐ!5 ¤£ttÌ¡g Aêh)€Ô¢., ìÑ#y”@&^úU €Ø¢ – ˆý` ´ÔÆ+(磈œòDMÉÒÄ‘^¢é–n±óâçºø:N¥ÛQ((DE0yŽ‚à9ftCYþsçÎ÷Šä[r@Â6ÉÙ:ÂsEšÛlíŸæ¾®ìBI„ Q~s„ÀhÂϲ‰;!qšM¼‹·µ¾K—æk7;= z^N˳Æd±° '¤8pf‡s¬ùFâh·P§© ø±Â;Äú$.NLrð´60·"9ÅÚøGz&Î÷ uŠz¥é`¬+ÅR+ª_²rJB¬…=ܪM‡»ÌI JLvñs˜BC¶¢z̵ó$©…Ññ!t ¬}¦‡Eøü ¹ ü£C" ®¥Ï²õ·›"’ÑÜ,ÃS\¥ˆgÍô›/Ȫ5ä8ƦÄ„[†ÏwwÃ@×åk=¨HžˆKA¨SLzðÜ`·Y,ž>ÍK‘”œæéGâ™™ ÒŸè»#@Ô„¤” 2¡?¡ß"&®>\4‡R9„%a1Œ€&˜ˆ`Á€ˆ!€`n+±_€˜Ùš11^!åüª!! e‚à¡S' ^QÎzxtÄæž(ÕEaƒQFy,„nJx)È Ø;€ØaJb’M%äYÀ’È SZ]] J¬KI0´f£$A,IJ-€$ˆqÓÐ-3xEÙXÝDéäŠi@BŠ” ‚ªåŒ±Üf”ù š`Ö$’õy¤C5t:?:²¨×”±}¥³`)Â1Ž3‰²GäšÚÛç,tóñw^Öv¶w>ƒ1¦ŸW×T`°fvx ?pOÓ@]0÷#2ñ@>kBa† ÿ©Ä ¥Bzw(g‚¨ÉŠ©M’ªÑ䜿F1oE€3—ºc`ÜÌjSɦ€tY]Î’óO×ØIõI$ TëÀ¿ YX ½äF#A‚‰dU\f”I›0<ÇXjă.I¦oè- ]†`LJ\E×å2YæĤ1ê6.]Âw7C§Ë\É(ÖáGê"B¿u@mP“™ÿÊ9¹(>Âä3\.LiåX{Òá•5k'쯬Né³ Š¥ßú¬‘**à•²,¥4 ¶D:[K”Z±KDº¤Ñ²¼Ú$æcˆ)óÆKâë‡ZK¿kœw®Z¿Î R?¤g‹Ã~ß‘¨ü´æ§•î>P\’éhËÕ›\Ì{Çnùy[Ë‹·mˆ GÂÆäù…ô,“ªãÓ,c=£çùÌÁŠwT0ÍB)¸ýQ©p² ßÑ2ë¾T®KÿÑ$Ùe˜3n|åøp=GSdM(~Lu}ªü d(ÈÍGÕä—˜62%ØŽ6†$ê¸EæÇ9†ãɨüx1êw7›:nI|¹R"“8<é=Û9¬Ëp# [ŸQÖ¥'Ž€0ê3…O _܉ãB.ê3U#Þ]Æ£®öjµ€¼¡”B"šš½ú‘¡7:H¨™0tÌí Î$KX\H–¶Ó*;+ïËßP"´|Fß;8ÅïW¾¾2®^ÈëšJóiÅðÿ»zò¿Bü'J•ÄË ·Ž³æñ Ä@$Ú”»ýÇ€£»™K‹<š¥6¼K8W$x_à÷".0tã{à™æ_ÎD ƒp†Ñ“?ÙØáÅv¶’OÆ3d{ñýc½I|XƒïÁ ~äè*±Å™ 72IÌ;&²ýžá–îVÚ¿ ü”eDî÷/õ¿èC„ö;i6íW©™ú±¨ ‘òÁ€óžÀEqò/=½9Úêú#{åŸÝ¼€#‹fÇÛµ@Át›â‚’ œ,GÅÑaQoK펥+-íÑ(Ž¾›»·Í±Òÿ¯­Ž“AÆ™d—‘ºåëïï,#ÿxžk¿˜¨ðw€¿fѧ (¿è%>ÐýC§À|Åî„&lZÇÿu»<6nœEÏ­ãÑ?ªŠŠ üž÷-2zcS}GgS÷©ÅAVdzß•sý×Ý>]ÕxmèT¶ÕÒ< tO}wsgï©öªdoKÞpòÚ^õ?Üp¼¡¹l{$M½çLO÷‰š®®0:!¾¬ãÜ“gòT¸3=wélï©]*ԣ؉æ5÷ žklnhºõýS$®¾peõ…–PÌÌNHmk®Š˜ÆN]´«½±£«¹³¡p©ƒ!Àk}= Õmçºz§)Už±¶^yêt_WcGÛ¡òghàÊwýÕÕµ•Í Û ýLèüÉ¢Å9ûN7u }<™Ÿn‹´ÄX4oñÁ3íݽMm§v,q14r²škÚ^nŠ2…‰œ¤¢ú3çn}ílsÕ‘þÞ|=³¸Ø²Ž³¿k_ˆù`°#£‹Ïœî9ÓÔÖZ¶ÆËX UÄ#rKëÉöîæÓ}­µ"ßÀfûÕ7—êjNV6:¸3Êœ-œîÝxñ^[euãñ–š5‹m(B·-{›ú[ÛNŸ¬ßåa; R·´Þi,¯h8^W»a¹ÃdQiûå,>ù×ÊâSyÖ`n8@N93\6l9~º¾½³±µ"Ñ›;Á„k_×ÑßYßÚV},ƒLúÝÉL©ÊŸ§|8N?ÙÙ•)¶O­.:º+Ð#*µãð’ä¤}ßvmˆ_º¿·3H”’u ;/Þù+ŽÁׯÎ&ãPcô®¿5­I±5¦Š§r-f…4?z¶ÙÃÎï¹ïì£ÑŒÑ‡º*|§Qìsnu•zór77 . q˜i¹ ô¼2W8ªÿâÓ_ï wDE¸8YÏï*/p4Ÿ×t¬"Š*°Æ»—©/â*ܽ¡CDž«]îýíI³Fö‘¶õIi’ý¶ÑÖA!CûŠK÷K‚غŒ‚­ÍÅ^®N‹[Ê·û¹6dÿã-Í«iT;û%__©Me‹­§ó=Xv0aO8Ó©êØ ‚†'–­‘)nñµ/%(¦„4w´d ­l¦q]i¶JçÅ–dwßjš ,çëöâ+#›W¾¯˜ë+4`f­iÙŠ`Ë`ß" ‘p–{eus6…ig~©«ûçÛïž~ûü1RÔÇú*áïøáå ô€oŸ=¾±Œ£·<Új‹…gÌeßÓXÊVôæž­}Ùl)Þtýì®+«^Ý([¾º!g¾£ûá—o|ñ¶ö^jŒ.ÏÞÈW"ÈoiS|õÞÝ3Ç+7FÙSÜ×ui±ŒÕÂ¥•µÉÁþá'¾ûñ‡çXµw÷Ù0âKË&åú¾èd3¿¿~Û;–@¹zT7¯µ}<{òìÅ«ö•-±5¶)xRäâÞ˜¸½My)Öœ¬ #1xF%å­G\‚Y^š®~s¶£2?;”Ì5¬ëK°$[œï@ôR^aÏë—/ž}ó-7–˜’8”ÔÁGßÕ/MŒ´ÕÅ«æYªò;œS,fŠb§Y,å ûÔ¼óç"qÔÑÑíWml¨‰òx‡1:ŸœzãõÍ…fž3çàqùÏo9ØQé*†¼©RctËY µŽ3htZýFGIqÁ±þS›*Jc‚í¬Jºª¶ºNV0F¿~|2||ÔÀÓë+hT¥Ý´%¹&„,«üv[ˆ˜Ÿ½žç DÆ*{uÝáhoïíí;ò­ eÇ{†mxÔ^à¤ÿQh'L8ÓzÀÍ`tœæUsåæþ@'KCªkÚ3(n»ð¬4 lbúñš¬D:š¢),Þdë]GNï´ä‚Ÿ, ²ŸS´½íÁyVRÅÓØrüPêæš3i<¦$µ€½©õr–A›€[»£@]—¶‡7sI0™¸xÅñc1^Ã~Wl#Q˜ë¼OZ:1T7šªüñÖ Ä[›îÖ¯J÷¢8-œ·b.{$XìVòøÆ©<÷›øí¥…^Æ#| ­ ºÿÖ²:%ÐuÕ•gOÇ€“éÑ‹¼>S'¯8}_¹1º/¿óÍÍÝkÜ|?¿7”ëb-˜îv¼óÊþäÙ>,ŸÜ%ùQÓ>øîö6?¯ù‹«^+ñ4R²Èé—°.ÓÕÓ“}äê«¡6ºûSÏæ¥ì˜æ®Þ%–––f!Íg·…øpVå­ Ÿl&$EtܼߘÀñ[–•åfô!ÈŸîTV74¸>%„í± yï¤m›â~üòíƒ>" bèɇÿìßpÇ­^Ù‘q¾æ¶‹VŸ|rhžà¯šþî4ž@9N gï»RáƘÖuëÆr€‚Mç¿­›çk7…‚ãâ±òÞåSËì<ùá%Ö¸jãÝS–y¸;›znízÖ‘á¨@Uù#n‚˜ÛÒBwî?5Ð}¶uÏÆS®`éŠO¯¹ÕÛ¢\Âî®ðæñ 8³cKZÛÎ ´¶\mŠ™²¡n©ƒHZ‰ivù‘γÇ÷”¸PãÉ3vÙÛpn°–ÖÕ"AtÙ²T#æQÇw­H5Å>§¸þü©æÝ{^vfÙ+Y"£„&)Mœ-˜X^Ve ÂB7«äÊêîΞúM+<Œ\M=¼¶dOeϙꃩL®RM*·  õ½ƒ]•Ù‰Nè྾û û tõïJŠ°60åN¤x9¥×4ô ttÕfC)+nRyUç@Wgõ²h[#^ÚÚ*IwÎ5îXBûúfN Ä.dì²[Öå¶5V–`X(aÛËÛºzê :*•Œ¶Ë®mèé:Zž›TY–gedS:ô]ǾC}g/Nt46SàÖ³U-çZOx#`+6õ))­ì>Û¶KŒ)›OvÝs¤*ŽÆ‘ü$̲òwGšQ¥¿[NRuMÇ©² Ûò¶%søpé˜Ç˜_]ß¾2ßȘ†¬ijé?×ÜT¾(ÊBgm™zìØéóµk9êªî2Uùcà')Ö̈ ªÈÆ,ôPÇÅ\;áxNâ\â,ìm¿²ÉÙÛ1ÏCø«µÀ΋‹ù¬ß"ÄÀ¦ôüãBG™î€'jªÃˆ e,å‰ÐãÊ°ú’„UEUþ´èvüéßþõŸ¿?©^l©g6r±7}ðÁ›ÿüë§›Ç œ >YK¤€ $Â(‚ŒÝÞöÁLó×Àamãl›¾õ–þ‡ëdª/‚i^Ç«…è@…S ª¨ðWôé6cj‘¨¨¨ÅxPš 6Gj~@±%{.ŠN_:'='.#'>3'.=†oËÿmp-M\ÎÉ­‚%nQ¢µ³ð£®«\ •WÔTW ª¨ù—&§W^> ºM8#eÚPLc(èj*ú  þ‘xJc?}Û]uCÛ£‚œ ®å•-kœ¢Ò{Öåæ5ýp~Þæý œ˜-7j·ÆñìgGï|u¿"h*ÊîþùÊá"©ævD[Ëiv[νªÎŒñ³Ïê{ôd4.ð¥›=‹¨ ŸÀ»-kmt© 9ÇŸœ\ÊñÛÞøõëž µ«“uÁÀrÓ™‡ëÈëìõÝC=ù“Åå'ûÖùz:SÜãDs|¼W œÜ—Ì· *¼­*| ‘¥išÖú»M»f›ñìÍ\]q#Hè!A fsl˜a5õm©B¡='¹«½)Ud??³òùã¾F” È’k'·Çóì#fo{qïPÈ4öü}_öm ĉR÷Þë+ +‰ª†vÆ…8’æXy[*@f‰WOÏT%±DÖ$w/SqFíÝ®;Öìæ\îÚ™nc0Ó½ŽÖ^ííå%Šmlª_`Æ°¥\ì?™Â²ôàû¥°yÃ=A´ÈR+FÕXUþôÈŒ[ßÜ~¢¹½$ÉZ ’ôü»¯ž 44·W7]¾z§5)02¥uOJXhѽ–œ€¹¥Ýçbí×lî~2ÐÛ^ÛÒÞpîûÿ}–¹À­O·G:qÑY$“rëõÕTì½WGÀŒ¾Ã… ûeÁõ³¼&ñKÞcËcëRÜO¾êͳÖ!1´˜‹65µžhn[j© yFü’}½‡÷®MðÁrßÂœ¦o.€¶Õ÷½xût=“ÄÕ¥§¶üt|W ÇÖÂó”m…ø¸/­Õ–íèd7Kbä6‰"šiÄw¶ŸÁ›²ïÛº DUTønD E‹8J!û».ií¹z÷Æí«mGç±E#Ñ-f9¯ÚÒ|ãƽûW/÷ìYêb`ÊÔ¢ç6=,ö±~yÀ!ÎÔÑqUß…;·Ï45Õ]Þ† ‘Û¡îw¿ùÛÿþøøöåþB+ )Š NÄ LÃ*;®ß¿4xòÄõ=9bME Ü¥µIÒÅ|/ß’Ë7ŽœªD"@þ$áÚÝ·¯Ýº}y ,y60Ål—ä¹Úvõ̕ΑÌæ·üXkËCcB¶6~¸Ý° gÓé+ç/œ­¯êj>ƒD€¼I¢eëêîß¼s¾µëáÙ _#sáLç%  ËW®ô–å¸)@=s_Ÿ•CWnßèYíï¦ÿ%7¯Üº{ýrÕ’dÌÁÜÈnÇýÿ;½yžD p"ñð¢ŽKw¯œnÜ[ö°Nõ̬ô\¼{ÿ|k¶‹ gFÇ÷~}ïú­‹õ{æӬYá‡OÞ¿qëz_ËZg[NUTe D€N“ ¼¨ã8ø÷âHL<‰0ãº,qŒ¹†fÁꊡõþ¶c¦ÐçA=ºÍTS‡¼¸ùþþ¶: €x¨Ö5,6eh‘ÇÎÆÑ4á‚Ù.‘ƒ&À04qL-dFOâHµ¨3{WŒÅjGd@q¶[Ø_]lû;·Å”·TžƒüH¾|oTR\ÉGØ= ®ÁZï§ÉÏÔB¾kò/·ñŠn$ kÈuQÌ?pH᪙p´IcºXJ@ÃŒ…@Ÿ6™¥x w¢¹£WiÍ£Õõ{ gÑÆCáQbŽ¬®.;ÚZ[™A§@gsIÀ}^›L×$q&ŽíUÇÖ³Á~VXš8ù·Hy“E99kön8vr{tÐïÛøK^’܆3AÀxjãåpDz‰ì-]Þ„åd¦Ô֤ɒ£‚¾ÕSRMÎz©D dkô™U8X M‰‘KMAš4F!¹E].µ=K9<¢ ½©Ø‰Ð—\ñHzì¤Úá”m¬àY: FE¦0à 'õÚX=4¥È– zu2GG:GJ~mSU~oh‰s^47sÞú w±¹‹å‚üE+7-ÉHÊ(šŸìbdÎÓgx9Ì]·¬hCê‚ ¯`Z/=8rEz`ÜÚ¥…E)©^³è¯\—¤­-IO›”+Óp¯ÜÍË7¬‹t‡¬k3¬ðy©Iù%Y9±4TñØX8'rù¦ìé!KÖÇù*ÇICVˆgÚÆÜ¢¢´ô‡?Éb~h¼ã*o²Åü°$WLqq_¸&ØoaòªÍË×$s8<=šOTÁâÀ¨‹×m\”Ddð x±áËJVGF8cN\\Þ⨅Å9…K<½,ôMm™±6Ô¾zóàh~Ñ–´«Q4 Bü2‹rŠ ã=§šó¿ò^µÀµù°£….òô }$¹/ž¿fsÎÚt{‘¾¹Ù}qDÊüÄü’%¹q Ï€°x뎇7û÷®,Ú0ǘÙY$Dç•ä§-ðŸ¡ÜQ݆´"4$6<§dùº\G ;†_¶/ÐÆàÝWÏv0T@$ns=MZ„Æú¬µ+B‚­uÀ½É›fŸ1ù–‹–ùŠ'¥ê2é(†ßbÒ2¹ x ‰­‚Ïe«…˜údFŒG1 ÇP¶"9/DÜïk¬-é³ë›š¶¥dlØÜòãý '9ï?Ñ]¶|õO®–™GÌÞS'·-+(]_¶fv({)vñî9«×åîm>´Ëo†© UE€XX5Õ"Ä.<Ù+:ÖÖÓ~ ÍÆÔÛÛ”gÅ ¦píؾ$äî¦ÙÓ‘fÔaSZÁT‹K'‹_r Ì5FzÆ${…{Mýo ÆQ¬T¨*"ø†ãMD0p&ò M¸ºð-øbàøU%±µ‘éPbh‘i@ºŠÔ´¥òG¿-m%QVã¨Õ™!s>H÷€o¿oËJWCS þ§m–T|êÎ2”‚A Ò1-üð¦\Gý_ ­S“Öö^»¼GûoM©c!’ UåOšHÐú€„‚ (0 òõq”‹ªOÒ„†TUh(÷Ó§ À‡ÈL üf±µq\A-=sº™¡mÆÖ£ ¯ÚH4HFsÛhà)¿•‚TˆÖLãëKóßÀ[ró¢bƒláA ßšaDHëѧ€JOÐJøúT±hÝ{ AÆD)2{M.i»»ÔQ¨o.4ZˆmW/(¯"}L™ >zŒ¤ZåHk€5VÅ—vDŸŠ½˜äp°­Waµ ]¦bŸü2› *TŽ@i¼‡{\]<]ýC1_Ôx¢¡åDë©Ý›BI¬Èô¾Ëgz.=¸ÛYUwy°5‡Bµ¢ïÚ_ß^ÛÜÑÐz4ÅÓBÇÒ0Íkûîì±'=QZLâøÎÙ×ÓÑÝrøxWïÍíh"tlôö¦žGÏä¨pý½å›´4uÖ/ŽêQ¬ÒÚzÏwW×Õ5ý}ßr{}3 Õ&/j`¹y臾ªƒGË›zjDš1y†œ…Y{[k›OÕ¶5ç9™‡û¯Ä-;WžÆ€¢™ùë+;j›ÚêÚêVÎCÆÁ‚}¢µçtmc˱EBƯ€òoU¨*ºMd–ìD`ÐE?ûq`™ê_ßÙžÎãZL¬\wdO°GTjÇ¡¬Ä„=O;‹b—”õv[¤fìÌŽ±ŸÊ°¥'Ýø~`.Δ£C[qúuýÊkCSÑ$šß©Çß8Xò§:íî}4š1úÐér¯){Ûe_wmóœÄ[¾µù\F€x²`Þ¦þú–ÛATSº–œ´å–{ç¸ó Økw)ðq²¤Ìo>z ÂŒgiⲧª~#ÅÖª;wë 6&`ÇÏÝ9^_±Ýýöß8€’;¬sZw@äNl89×ÆR8E¼ãPÏZÁ«®©>–ÂOå9N-‡‡ÛùSÓÚy¶ÆT‹)l‘±Å˜è給µtó ¦µihÓÙŽ|=5Ý”¦i¾ dhǸ¹ÀÅ<6KÇÜ9 pdép š?yðøqu‚µ2ctG÷ÃÏÿöêÐT¤\;àÄXøl€Dt_††D€V: tMy¸yƒ·ÎÎ%ƒ yä›-¼p*r ^º¶á`¤/×X”¿¥ýþ¹®êMæ ­FÀœ–§;fÛI涢10.¥éÅËg°Ö^)Ò…fÑÍ—î]mk<˜—é?“öKl‚PQˆ€IÃ,Ïê%(¬¤AµA™!@×Ȩj¡¹(@žòǼ¡vU"% óeöÄrJ¡£ySöwßy"K›ŒŠÒKŠùÞǬväÕ•¼ºD¥7,}c…èQÞqÅÑšGGSŒFkÛhÍ-Ú‰@Zx¥úŠãŠ‘³T6œøŽ.¼{.0¬ 4§h<'¢6 èïPÿî/433Óà3ƒÏuŒÿª7éK}ù2EkÊW:“ghêOú«¶ñ_µ'ýUý«½ÕãFDø™ëÈÎ2g:3Éd«¸î:›>ÃÂÖÏ—‚›ôW=ã/tÿ:Ñø‹‰F_ýìS·“Otè1óc™õ ¾0ºÏq¤áaU&t¿äöô àõ¬™ÜPW«)H{Œ91î$Í©öîÁ³&OúÒÏöŸ&šþ¥žÑ_õ&kNž®=yš†¨aÂT»°Dë™È1ú|ëP[2núTÛPO‡Y œl,Ž‹÷#©†MúÒn4ω8©Ê@='ˆ¢£7m2cv ã,´%“taQat=}d¬,ì‚œH8ä€IjƸÉdÐ=ÆÛzš¤æ©Z“§ªH.d, Hr$O—¼,ŠHw%OCÚÏ´Šrc›NF>TŸáæ4;ÅŒâhÍöuLÖ˜JþŠæàï@š¢ø¯÷-†_è"-ŸÇļƒ Œòvñ ÌÑÁñPÖW—,ùÄ„£K?…X%"Ï-¤o°tA3CÛ8MëšÑ4ˆãtò…, ¤ƒL´6I$Ö¸½Ú¡­0G›ÀÖBŽ³cL×ã?¨/ð2‰ ¨¨A•ðFG–äl:?M™ñ™® ÿGów7,ï@‰ÿ8r§ËùŒO”~bú¾·?„– ðÒPÊãt`ÇU‰£ IË0•­÷jï}ÎRàï(š!µèU :ᣒÿLÈ5ä–œ¸}óÉ¥ÊÍ.“?òv£eŸ.t”“°.ÚÕ}÷ú­Æ­‹môL‘àMl™y±!ßNª63ž2ÕÖ‡a%” ó “•;Ý>RË€•[ØvûúíÞª|gCP¹7¾³ºÄ­–;% fðöË×ßìP> Ú˜¹ºš°•ÿ×Xléb9)-ÑÃÛŒÇÿp&«xlj&û=P“æÉ´á#%•5ÅƃdTÇ@'QZ×…{?ÿߣ…¸¹I-LllŒLG~î㶴ïâƒ×ß_Múê#ï}œsRÛé’®\òsPÜ¡«×nßêßå¦"Œ.»tGEöÕj1|8¶\5ù!,ZלëfõÉïô17zÂéÁÛw/vç:Ùc]NhêÙÉ]¼ùpú7´bæµV|<š;s= 2–„ #²éÈ?[ʱ~e;ÇÖQô>uŠlË{k·¸šÉ)KóCÅn×TÁT×c'â|‘Uò‰x¶•‹¬Z#ËÒªÖO€\#û­õ— Üm•k2—<ÿ¹/b²ÙXB –+šŸU&x?©žŃ®†SŒ‡ß ¼S.Ô!Iu¹&!t6šÓBž+'„|Nüê ½ÿbßÔQT† ˜ŸÞzáÛ·?<¿°'ÓÉ`$R<æ”_»÷êíO/ú¶eC_o7›ŒÞ›ÏÞþøcÿÖ®“€üœ¤¿ÿñÇç«BÀ]ÌZtëî÷??¿Qì9){Îÿüó?þý¿ÿúû›·Gó Ì\£Ï½}óöç EÎ’àMHðÜzxðÍO?>è:N`Z¼w»ôæ§7Ï®¶-Yò&YnÞîÍÏÿûŸƒJžÖI|±G ¨äæ!ihÇL8uáÉ›7/êòí Œõ8Zwædûµ×ß=9–:[&0â ~û÷ÿûßûöv÷f7C3K¿vPíÕ]®ú£ 5 põÕoþöÃã›;Ã|¤‚ ¶D+›Écð5l}*nölõœ ÎÕ*¥ýâÓ7ß?¯ÉJ°24Š;òòçþßÿûÏ?ÀÈ”8ÂãíWœ¹þâíë']E v’öXY¯yõôx(díÑb›¿AêjÕÖ ¯(‚©.‡«ªB‰tþL×CÇ昇‚°Õ­÷ög×ö>øéÍóCÖbqèàÃîdÍ´'ÐÕI1óÊï?yýãÓk…ÎÌ „˜ÅÕž¼~óÓÓŠÔÙu'çß¾ýÇÿýhÛÛË{l&˜ðÍCœºù槿=ì=5]–‘Å¥¥Ü¼V¤7‹úå,ªcGå©Í¥õÏÞüxëH¡…®`ûñ–833ª&uÃæãóèìaâLuZ|võÃï~z6Ô˜‚C÷uíKk®½Fš~¹5G@Ž(*ö¨<¹ÎV ¼fMwÛV5ôæÇ¿Ý9µÇÓõ°3– òÖÒ"­sè雟^ßjÜ`ˆ6UÏy_ó×?üôæñÙÚ¸™`—ЖÔ~ùéÛŸÞ ì^ëbˆg ·îÿúÍ›·ý[fsÑJ<Vßyþó¿þóÿüùíÛ§ÕÞÚ³8Âb䀷÷Z"‰Ò—°àð£g?¼~0¸ÒÍŽ>œ[÷Í·?üôýƒ=ñÁ5¿€²çÈHþ¿ÿ ?ã·¶Úë8æ©wïÿöÛ«+=$àD»-Õ×^¿yu£jµ«® U¹ªóYÏ‘“ß¼üÛåCk]ôЇˆdQBúšGsòìã7?¼¸\‘k£6‹¦-ÌÛ}þ»7?ÜkÙíg€TKYpüÖ…òý×½zq¶õ­í‹Å¶.t¯8ŽµäN§/Ý1°1ÜEzãÛ³ã›Ë·;ÊZí—ßï)rÁ¨ËŠZ;6å˜[G¸GùÏdŠñö‰ž^$qÔœm÷Z ô•G€bjX[ýHÚ5°ÙÒñäÈÂhwÎìã­Ck<D3½›¯^[ïjoÏKìj<àa¬œN+œî[S}<„ ³º“§Â@FLcmí"k»Ôî®Ú¹³àìÕµúþó½IïœÂ;mk»T$SWc— }EÁ¾®Ì ÊãËÅâ‘ %oÁõÇWKÃü=h^©Q±°=F‚ÜÒÆ®${T8‘–²ýnÚ¹ÎÛ0›—)á4·ãµ5ád†`–û±ãuñÀ‡…Qxæï:2,,,qNt.ˆ Ø¥OÍãrÑœU²µçþË}5ó6Ÿ0¡kÑÛ=1”amOö©<ѾP,Iøø›O{cŒa–)ÎÂÌ-ÑÁËo¿èÈ÷-™ðÙªFNYz°u¡šfj2+†ž5åÍu˜Ìp7·âëY”5vÍe09Ü­{šÒ˜œá ºixÒ®GÖEP­B·?¹Qî¥GôXØýðÔ‚…}lÐL3TxÇžä¼·ïæO>ì’–ojk[Ÿáa" v q7¦°µI쩳!"![ÇÔV²ÈÉÕÁÄj~Aïíò8þ¼ç²‹WŽä¸~%ð²Šô˜„ÔI\¸ójUÖ»¯Dt¡£2YhçÁ åÚ0ÔÌ‚¼’BÖÎÌðÚÚ†©„kžŽD€!z`£“ƒ Ñ'³·žYಂթ©Û¿._Èô^{âÉé‚h¾wýÅ¿7¯JX–»°ÆÓŠ©ÃÖ"3ÕÁŽK›Ì7ñ:ÞÖ_™äaæ˜ë¢O‰Ê¨zÙ¼>Œá’½¥ÿÁÑb jfã³GW¸NfT=?ºÀ›§MfiSâ—½ºÐQn‹ïšÚs©<^Œ<èuÉÁÅ—kJC(ö+J;ÿqs“½†2üÿÛ{¨¨’´ÿÿ=ÿÝÙý+Ys„N4tÎäœs(UDALHE%›‚"9'A‚`ÂŒÄ0ŽãNž™}ßß­º·IP'sNÝ}»nÝê[ŸûTÕó<ß(÷cáN+ â ³B±Ð?ݼY€-C`)#¢(6¤=Ðué÷ÏÈÕKä‡PR§KÄÜ hðÓѹ º Œ­#Ÿ*™ êÐÏRDwQ‘³c4µÙ~·:ÙDy¼)°>oý©Óuí m×o¿*‹_¥=‹‘|ñFcYFD”•f‹KÍO”w]Ê?šh³Œñ¾Ô>Ñpi£ž¶Ä´TãæÃÚ.uÜùz¨Ò šLã‡é~r=œl° 1µ…¡+µ—Ù—U–zQ]à2ßÅT «~¤³¡­³`Ÿã2úûÐÑõÔ³ÁG—›Ú:›® ½*0¢£Rw¶þ.üqheßW½×Ê· 8éOß¼ºÞÒÖÙØñðñÓZˤ._òóêHCéÈ€áS[rz9Ö“”QÍ·/ÕåmÝÀÑB8Û_ž Hn‚c—ëJ?»ëÄ’¸Ó¬Í¶œ/jl¯oyx¿/Ù ¬qHkî¿èðQÁÃÝUw‰YL©–ú‹—.õÿô"ßF®þÍ5Î/8ïG¤ƒàbuîLîɺ–`6›0Ê ŽÕ¶‡2¬Yì¬#uL`JP‰zøÊ‹ÞËíu-íÍ×ß~ý4’¨näpôÉã®ü‰aú:,YÔŸoå¼çaåN3%"wrÜüšæ6 #Enxy<}ŽÀµËˆè(甞]ÞZ×réêЋ«é&r8C—3ïvÛ³†Çc°¥ñFkeVD¤‰AGÆ)ˆ€&Ølìê9W>a˜ƒ`Œ€‰Œ,tŒKPs}ÝwíX¢lüŠdûØÒâ¦ÎÆö'zcôô™ÈÔR=p&æ4}<vìr6c#œeRÒ}ë° ™“ò NvUçY¨p÷\ù<ÓŽÏ'‡Æ·e®´g1Ž§î—#„uÕdëÊ€`gÎ4vÚñÆKÂoדÁF·¹ô͵/ê×"L&X¬¹Y“ºZ{rjR@ÌÙ;QæÃxýx@nDÆŸñuB.ÄØnïÛé£u„Î'0À Òf´‰<ò$RÀS!£Òå— æ˱âÔ|AŸ=Ð-²øQs @A"î"PÀ?Lyd Ê à Ÿ ®Æ x$J¬ XÂ… €æqwK†% ÕcÄŠÈ]`_ùé·ç׺̦¸…u•íX££¬Á›Ãñ´ `öÑÚ Ð¤*;ö|+ 'ýhC¦>ŸŠH™¢ ®OvÝ™Tüâëï; yèÉYU9æ:¨QA“ãÔ5®b0%H›íÙ…P•h G?ØÜ¿µñ,‚ÀôØPO¦©DÊèD-@*IÉá¤Hjÿ±4Ôœ!rf[è×z³7Z_§ÂJÏkˆÕ×G(Á$…=€*æ×ndñ)àÂÏ»ZwÔz6ÀÏö[r®‹kËösFzö‚)¡©qDWyº`º€œý'Ï1cxÌØþ¡‹^ è›ëžWèÐeðf«nÔî]«ƒÀðn”ÅXŒŠ/;îå€\ˆeÊç×G 逢½fo;š“žÑþ^mЈѾò@É…+Ð’Í›Z´ ø‰˜÷ä&AˆÔ#Œ,Æ¡O=@Eü8äR|:ºZSí¬ÍñžæÎÆpDë’C+ ½4zó¨iâÍ‚ºÊ²<Ô¹jFÖ>›¸¹½­Ìm‰†ŽÆŠÆk×ã ªA÷¿ºA¦ ã}ʳbóoö¦®²R3 ϼߑ½^[ЊËT” œ†›OüþµËu` <‚KuKkšµ¹ÁB¾«¡½ž‚FplÉà±[5ÕÛ†šv)Ð6×>¯ ÐeÊÍ‚®O€^¾ÝG­—ðÂ*¿»#šã–ýÿR(F‰™Ìl#g¯6‘ŽÄ3äÕ9 8ø Ö š  '­£¸/BˇÜ]Àö“ *Å¿(´%( o‚È“í“:z¿xú¨÷ävËÙ˜'Fr^çà“¡öL?=–wdùíÛú.Ö¿U ,@FdÚ…þCOdžšÌ¥èà,r º†ž >¹ÙyÀÝ’¾Áwî=}óÅ¿ÿõrhàaËjµœcœÙñôÙЛŸ¾{;Ô¿hãÄp2f­<]Öób`ð^sþJ"Ë€êq¶æzÿµç/¼|PŽEsLó*ï={2Øw*H¶ÎŽ¢®Á§/¿ýæ«çýOšswYÌ¥ØZÄ·_{ü|h°9c»í"êûp¶~JýgƒŸþûÛ/†úû«“·B5aS“èëO>}~­z_‹7›½jmö{Ïž?z|½4Ëy®ÆÖ©.[{jÓÖé‹íFÊrç»ûŸ?¼Ûx&Ìg×ÙtäæÐÀ³ÁÆ$UörßÜ®›O^zò¨ëì>§ù¤«âª‘xþ´¿$!LN€w¯é}òü³ïÿý嫇WcI ñCQï°©t0‰£mH-èøò«o^=yz¥ìÍ,5ªBŽ”…GʨŽ¬T"‡‚hŒüU…›è¾"‡Þoª £$¿.ütŽÐSåc:Bs:ôÞŠ°>¤ Üy&™U—ò,¸ï{ `rʶŒóKyvÒ‘ª|s÷ª_TfY¶uFi¨s~éM•i˸r$ã9šY‚«OÖйµzÂ÷Uÿ®$^ü›Üøk £Ï×õ˜˜‡óxeÏEËÒPEã½#AÀ²Õ´eüiËX»°eɶšúú²¿æá'Rb»0õ´¦ÿâ'š*Há-¶ÎË<_wª¸©¸0^Àb ß_&@Òßäþp×õäÎÔ˜à1 b¤!–<‘:mœ,þ3²,“>f¬ÃÆ)#¿ÞA&>Sed‘èçeïÑQ’?ÓÇiê-‡Ç65„ï/‘ ñoò“jÛoÚ±ØË ò(Ǧñ—ÂàŸ€,E1ŽŒO]è~@›L$/šâž)—®G•>€ú^Îü¯ÿFáT2¸­&Ù8˜Ã‡¦V¦Oú¤ ïñØ›§ïîÒ_0îA0dq¿ÕïÅ}˜ù‹MSË{.¶e{s ¢ˆˆ¯MYUP~©§¹Àw1ºMõ +Jò°˜T -¿üpQgÏ…Š(]xá+¿³'¢\u{x5 ¥ýâÕæÓÙn‹Ï]@o8…‘ èiˆtõ¶´ È öªÐ„É$½KPCPxÉìè(HE™ ¨h~à±Ç5UŽ»ó`yWkÛ±5¾ ˜ïH2Ëh÷|̤ÌEv9§Zºš+£tÇËÅš’ýýbu’²M0ï1ìd,·ž” ð|¯6-FxYUgOCž½"¶¥±)+F|#9Äœü…HðEÖÄRO Ùì#â%Ÿ “ CÜõ²Žj<þ,2ì5˜ Ä?Žåà >uÿZšŸÅR¶@¸ýê´<9ÂÌ`R¹VÄ•¿-±ZÂÒš…™¾&Ö»wyZŠ£qU×u^oôWûPí6î,MS£Í·šríçŒ~€_Hiþ¦`þ»LP]²kei‘×Úø¤C×bà‘%¼ª8 ƒ¨‡›€îtórò€ɱˆîýá- JS6ód¤þÕÑ•4Y"r^þBÃãU«ÈLÄ\~@69<¹E•Èl4Ÿ›Œ¨Z06mÍ“Ê“61¡0“$`Žt肵 i!Y"J—hfµ£ÿBº©œ0³úpz ׮Ι9ÁU3)› ^Ÿ ·\@cûœœ$…ž % Ž"‘f3†‚Ph³G¡¨ü¢°LQ‚ö!Ø«…‘ À‡MB?H”IOö•8B €2ä[T,LF¦':&L¬8s[ÓÛ3ÁNF iBGD‚¿×VO 8™OÁw/Jra;aÛàK(õ fÒã(‘Ðè3º‚ºª„Œú?Áüóu!3à,Àü4{Rrb"ÁÆ ? Ct)[‘H•]àH2æãoä%õM‚•›MDo6áéPS ö§ð>äÀ@! –Ž[Ó|ܶE¦Ú“¾žÇå©pÜ]£3“²3#ÂœSXJtÏÐÌ¢’Ž¡Ëõ‡wï·0G~qþR“-R'gl³³×C]DŒÖì_é¼ûàžý1F¾2ÓÑ*|ÿ®ìì-[<–!@ ;{Ŧù¬NŠ9·%Üqæ¾ëf‘µ++g{Œ]s¤8ÄmÞw(i_”¹•ÖÙ]t)ž;¶í?¼{o¬“•.rÌ\½ÐàÝy{¤úy˜ ¸Pæ®O‹_µ9{wv’·‡ÑMÁ|½-1GZúß>*=vxW¬Ó| ‰ÅŽé‡“ö®7ÒÇ,Àyz!!i’"VìH pÔyjeîº-k.÷^wüð®]¾4wo}ÀžÃ{râ]ÍÇ  ×Û#&kwVFø:‡EØ›‚9 ƒÅLþ;HÙ”PT°ºÓ(³œí¢$egmŠr[Já-0‰Ýº·¼æÞ­Æê#{²·ÙÁh¸Ù,/§¨œÝÙÙ[·zhòDõx¬{Ù@Ó)1zNìÎÕlm€,¤åv[v¹9G­ß·{ïj*•&£éb•ž°_È+dБÝBÒ}CSãÒ÷®öGªšzs~n›svØb³˜J—!³½Râ32·ÅùQ¹"K­Ð·ÃÁpLŸÝÛÓó’‚µ´™êUô6†ïÉKJÛdiÁ“UcÎà„m Üžµ#-ÊÌ‚-«¦E´ÙôÊ«ï/Ÿw¦ëñ‹SíuÆ{ž¸^“fîµv[ …ÇSµ-®l:àã³nUú†CöÊD‘Z¨(>‚‰[Óy¯ÿDDH€]DL€Ÿ@–¼6÷^Çñ”Õ.±-=½[õùÌ™†¥÷žç¯]édÖRqÜj6‘¡D5%;½óÅ!7Ku A„<Åœdz¨°e“¡6 BøŒ·+2"ýöÜzûïêD¶ 燛ç Pj@Qø-ðd& 8cE•ˆV<Æ ˜{2ᬆyP#v5XkÂÜÎPr'Lh#…åðbÊ"$ mFžwL ˆ…Âcêtè¬C¶%E‘z$Ø;TµK32ßäHu÷ÅM«CV{ì»v½Ñ{ižÃò{BAZ~—¸±ûNOªO`ˆcàÁcõ%΀g¾½–l¢C™›Zu%5©$Ä3éÁ÷ƒ[©<€w’ícÉ,èJ÷©HCeÖúsŸ•E{ŠÌ'>9¦»«%Ñ+0Äiíéó-çœÃÒá*±v6]ˆÌã(«ŽÓ•d!ŠÎ˜o]zïÙi+€Jc–Îüݦóô2.?ßלּ}_[š›5´Ä´âk7øèHÎgפßÃ8ÏøhÕ¥b3„$4]=BÒœÍS¯ÒÕÁfÍʬÐ}õÂõ¸âMªãöÛcpUA{_ÓFГ!>9ÝåÞÀÖtqÙÞp.Ùvöxsm»µ­™[Œ‘cfó“óš.'F€J¼Rî¾¾½L1fm.~–æ"&¶…{þí†ýv0{‘vÈÕ‹ÅÍœmI|þ u1gµ¬Ï"4™à‚™Ór;Áʈ£ž˜,8‰0r̽ȼ¬¦ÊÏd …èŠTŽS ¥wȺSß<9f­„MK$¦À̹ºFžklWîÎê=¹‚ˆ3´:0xí¨ý,ôNpÚXüSo‚¼EÙ3(^Gï§xð|@s%< ÀŠÝ[øJ0çÌ‚•ÝŸdùù¯µ[™˜p®":±å²Ï^LðseéÎ"Á )u†‚¦GxSÉŽm8;c)Ð×ÖýP¿Ó›ƒj¸Ï±o~6T¸Ú/ÈrÅ:ÿÃmg˜ÌÀ1ikKî„›À!Œ73H¹\SáèìZÞrù°ðúãóaÚ²ÊúGk»Âýƒ,½W»ïëé®õXÀŠëùϹUFLŠ­Ý'ÃݘÓ){Ëoì´6ær'9Ù¥_.>j¿2È.¼±§7“¥.ZÏdÿ^KQÓ-±³ÿìz=EÌ8¤ª8·}ú<Ž­‰ü¿jsc~˜/k–áÙ†&2…1[÷T~Y °e¦ÎÿÚkÈ@Ú`8¡fÚ±æ(-X1Ç¡uàQ Kƒ.G :õ9@®<*Ó&^~¤Ë`ÁÒFïñhu* J—Ã(ú:] H€€‰˜|àtaèzvæè‹œ8‚J{H„ÂÁÐh@‚°D" -÷¡Á&ÐÊ€]ö;£IùøKíJZ®UnÙ¸q«D„ó ÃY€ÏŽ€Àõ]/dÞpé@覘UH‰ fiCžþ¼0@óUã¦æ^lNÛ @J¸ÓRnøé=Q¦Àðóéì)Øj<[°ãê·§ME“Am½c·{›ÓB°jWS¬Q,ÍC3ãÒ26n°Wc‚U¸èóo ýuEÃ|©Ûŧ÷Ó8`KÇàDgI¶õÂáÂèï ‰MQCG*Lä­ƒ/È\³. 9uÊ ­÷ _myCO_é¦Íh'lrñ1›7±­–eµÏ’  «ó|½œüÎúÄ8´’hÿûE#¨•rùu®§tüÝB«c-×O8h£ÝËŸ§°"þdvAsuó)+Ö0¶&)â²´ŒòÎp>›õ¶à:<0ZÞ<5‡šªëèFÂ1—íE§“ƒ7ÆD÷B ìpF@ª‚Vréš)q™ÇoDù²‘º’ íLËyW-t2…L"Ï~™ïÁ“Å£ôŽ8þ Õ1NPZÎĦÀÉ[ypÊÃÔØúôí½ÜÐ[|÷ø†­âè#°²1ÎL>\QÜZƇú쌅µwïnfQ`£Ç£×}w~1©úõ½~tb}ä6PBMlyrÈ䈲zGñpct´ZØŸéi(NŒ€' õ^ŠŒ;€=7wÛ²Pù‰…¶åm׋7€¶ùGD:yÌdÆõüû¤›6b–xD\>½Ñ‹)Ã=|¡7J›%ÊÏìáþJéé¤Z¿ˆè€õn ðû¿hçSמ軑dËB 8xéKVõ½¹ªF€ödaIôZ†’^~yõ ¼CEçø©Š`©¤ 2Q°äѤ=¤Ô#M[ŒuA˜í²•7†®GâóXÝaûƒªD¢Ô#œ?EyT°˜\9le)/ª¤ Xú©]`¨ ‡"7l—J$'Šf‚i)Zî44"ÔgÇÄ…G®¢÷$¦ô!ÚÌkh…°mÐTD3e¡Åxìì’»À2DQ6€÷÷:aYIçd—wµ®Ðå †(&Ð`ÜŠƒkb; ò?gÙšŽÞöC"öðM¾MŒ-Ie—7¹ «R™"˜Må)³‡P…¾êð‹ê] ŸMÕäáÂ;[+}IôqR X¯8øí½lûy(| w®yAß‹-¾2Å<¨§ãD‚ÉœI¹äÜ²Ë N\¾2ÓïÀͧ£O'@î’Um7Z‚0Ún®é±–¾wm>Ú °ðJg±¶]wì,¦Tçгß6n0®"&dÕ_Yg-îIX‰_pIÁféá'ŸmY¡­,ìÉYš–‰ëö˜‰3AwÔŽžû^µl׆÷‰-}±×V0CÓ"¨úYkbãQ§Q3Ê:ÃyL‰Í\€Ùß÷lCó\1ç×Öâ©pÝä2Ú–X”çhò„8fþûåY€f¶§KS7óЇøÒÀþoû"´$…åÞ/ØèƒÀG—»æRy¦¾x¿ïQðöØrˆâ ‹\Còfø°¦ãLÜO|w?ÓDfmœPÍ–C3º¶?ˆåÐDr9è©Umk*ÏX)#“8‚cxÙËókøâjrpíwE«ŒèË™æUO_æ™0hpy\¸¾¤”pþN¸:îôX[Ú sL”¡S ¬Ÿ:ˆðÆN–‘U]Ù]ë £É0wæ#Ÿº‡wNWß]Лâ Ò­@kgk±«ãh²Ž"rR¢„±D0 êiÏ"Á¦âí6µ<­6s.àú2˾éùë*òH|ÛÉuÞTY-Iâ(à‹r|€û éþKÄ”ÃõµÀËYVõ2µ(È\8´ä«šDžôÖ-UÚë‰:bsŸ:vFèaŸŽã@­ò±¼F­d˜×–ä§ ¸Ž:Vã%ËèDŒ.›—._,HË<¸÷äÑz #8ƒžPÚ|® '1£ðàá0®Þjk¯­ij-ËÌ9œv¼êTŠÝÜ‘ÔÔ£‡–W^8·/óPJÖf+d*ZÙtætÞÎìs‡®Vm p±mæù«­§LÎ=ž´Ñ|6Ý!àÔÕÖÚ“é';®_O±7ૼ€¦Lטõ;ò›^]9—›¼!Òq!ÍÞcßžÆÓ)«Û‡Wmšu–™E­KÈ)ñèâÉÔ ›<– ¼ÒO=Û]›“±ÆAwÕÚ)¥³ãBÁÞì£Î‰ 7ᔕë~6Pä:wŒÄÔK-O–Ôîã‹r2PL ".´µ•È9²ïdÉÁD4낽E|KeyúæëMô‘.5ÕÚX]ÙXzàPjF„±O™¹c_ùQOq.n¶GöÞ#‡v¤Ÿ+ª«Þ虦j¤}ïV]Ɔ¸¼sw1NÇ(\ÉaúGïÍiýq ,e]”¯&—*C ιTRxhǾ#{vØ*âÜÜv6ÍŽ_³íàñÎ>ŨM ©­®ÍØ”°ÁT‡¡¨›^yãüθذԆ«Oó7ú0§ãB6œXã.q“#,DȺÀisC¯^®=°~[Öñ®ï„k€Ú$·’’ÚܘäpcÆt’Ǻ3Í%E9ñéÇ3l61GFtTÌáƒñ)yçªÓc´pÌ–g«k(êãH @8–¹­õÕGwî?œ~jŸ€ ¶í;“·;³¢æÐÁ¬Ygó¸(žHi¼±YlGû…ü=òÒNŽ ×UÀHPÍÖ2¶¡´âHBj^òž•$6o±iæÑšªìììÄì¢Cû•`UŠÆå†xXc†Ó|§ãe—*²s2væìôæ˪{F–·”žÍM9ÝZ[¶†Î I0G†™€ÈZ謈‰©o¿[œšã`¨¤îRx¥¾äPÒ¡æko«v¬à|€ åïSÌ”e&—_WÓÚƒ"©OA7¥Úz¹yëÚZ©1@à0½|;‹§ÀÈð×ZÀwÖqõ7õX¡ma4Ì@u‰¦+˜’úT#²å c—åtm­Yc¦½ 5[7&º°F1Õ´Ziâákho¡h/ÒvÕ[îoêî-0ÓŸ3º3‰`±›¾›¿éòåTæ °¸ø™¹{q àî-ÍJàd ’þišjÚX©¢·43®“³æ ¢3òFf†'Ó¹ [«Ÿ‘˪Wœ ÒÝ6£jZ¸á°tX‚ùwcwa%.–Âé­Ñ\µ6´ñ”éæ ;äýœìIXçèŒWè›ëŽ±ÇmgÝz,EOêSš1bùžt¥j¡¦£`.×Iô¿³&T«L3£Zûšz¬Ô·5[̨yW–÷&1ÅŽy\G3r¼ßÔ`¶pƒ‘Q·â:ù8XÌ]é|háM(fº³D. dk“—ž“—.Rì-P@Š]ªÃÆKÏÑ•¦Ãn!4–­‡ÀƆlêÁ×GG]NÝ‚nã©çä@¢#`/ÐsÕrp㘘Ì,–Ò¨3­ÎU7®Ò¤J>å¹KôÝÕ©bçY²)ÍÆSÛÆZÝ܃£Í¦7&[ í±ÃÓ€)%¯iI·FÚæÎ1ÕSF(‡3$™{è8yjY›Ì×D*·³kÍŠæJœ6ÕÁr‘eH&–ºNžKä[°8-5§%âc8sxN|/]gªÖ& ˜;ªiHTKÔ'š¹ë8yiÙX.¥3CŽå`>ì#ð–€K†\R7&›#wc @ro¾ÀEËÉKÇÞIS‹-L$kŵ1ž/®™»@ÇE€œÚÎb1èºÍ–mç¥ç`‡g1áÜÖ‚‚Ô†Ø$$s²¡–l‡h¶3VÁ´#uðFÈI½añà›Ý|9ª5ÛÎS`½zÿÓâÍŽÌß·(Ò/*ž5Ž ª¼Fy&Á 0ëîOÀ‰ë1NÑc¥¯[dz¾ýÚ ;Áo b­¤cü•èh†Ù:èŒÖ<ÉP¸Q#A†Ýxh’^l~2ªp yâ0wAô»ôÅn¡ŽµTð aW˜¨ŸzɲxÔ+˜* ¯î‹òê¨/\o¢ @,@Qð Z2Ú2ɨë´ôðØxˆV–²¶Jdqa‰åáMêGú†#w‘¤¨þˆ• Ï.Žï“ýÆKŠ%'ˆÒWD®Q¶F’ütñ$xüñ@³Éh$ÒlÔ;3Señ°gˆâ¨‚0šO OGú»œú'òä*hþSiª¼³hüSé+ä/Z4AùÃ]…¼Æ?È“Óøøé‘«@îä¢ÔÁ @þDÜÿPDþïü]Ž$|üÿ7XàûØñÿô‹â"ßDFºK^ôZ¡dH~;`D‘UÛ&þ"R‰Æ?Dÿ ¿þ‰°ñ¢Ëù;¸Ã‘°‚,ÑQ!IùwyxàH´r´âJ$,n¼¸Z‰Ë^ Æ?$Ú)l<ìFñUHvÅ'âN÷M})<@û…&U­øE?®Ä×¥z\²ºäO ûP¢~ì+ȵÌùÿþ)™M™%Ž_$ŽLA™1[qJZ­=YD„‡O4à- @ªp:̀Ƥè¡&¤(0/QAaäïîÿùŸ©2U¦ÊTyïò" ðl9W€{Œ‘©fPùh³àRwƘ:yŠè í E2@]B-6byH(1+Qˆb:¶D‰ÿ?aû§ÊT™*Så½  ' â@¦Ÿ`Ö,ƒC³«I$ê…±Äk0ø—)‡-úqOñ®¶æÉÄæÑXŒ 42QíK‚„Yˆ½ƒú2aºÊ„âé¢>4mÜ\ÆoúŸÿ™*SeªL•,z‘ # Ž!ŒËøM 2Õë£Ý»wÏýÇÌyÿ˜µ`šÊ"™9SåeáôÙH_!ѲHföð*”NW™ÿÉŒEŸÌ˜ÿÉL¤ÌûdÆTù(öçG>òRèÓ–ýáÊÿýßÿMíÿewySeªüµËÿšäΛbh¡OW¥…š©2UþråW Èqúã–aPúÕ"Sþ‘ HËù i ("M°n,G`Êס˓¸˜30‘6mŒ˜£Ñ"è %ê¬6‘x+©½?yâ¨ñÐÄVÕ‡¤¯G.‡)ó‚O©cÄRLj™Hî‘ñk Mìë´8ËD.:™¨º?zùu"é@¦ S˜ DI²g!£l €@<”Q AÑ âŽA]LËn¢8"]VèÓ¥÷æ†;BãX3ÔÓEŽÓ0õ¥¼8ÕP#p,ѧ2Xþ^¦>©ãæ¯ûX6Ûð”£I6VMð÷ @– Ë""!ïpf’§8þ _Y € e.¤šõ…:ŠHBÏA¼•‚PYL@4^x 9`”¤T³\Î4ŒVæ‚ІË÷¾úi0ŽJ• ¦¾Möw’ôd?>1;P‘¤¥îZšŸk6Aâ°tÔœÊJŠÜð¢Ëš^Ëw´]íý¼;„Hù ÎÓZab/ì1Š{pöÌÕZïªÄ’nc½„ù1Ÿ2ólO·Ýxöbàœ½Ñp9x‚}Yi±÷RºÄ%nó•YÁ{ëâÌù€ zd-I‘œ8 ¶(! ´&ÇIy·`V(pRyîè:¼Ö™%‹fç bY\¦«òW7Má S¦P 4óÂT`ñP†`B61™GÁòŠ(ê–U¬P§³„ë“@QÓ_|PÂ…4OÓ±L/ðÿ4é÷§Çq¦‰Ï8êÝD@ý í¯ @–ŠÅ‰Î+ÌÂn_;ä2w8ù„ {?¼Þ …‡ÝÏ·Üi4ª¤ã"·KŸ?úõÎ2—ãÂ7ÓžIæÎÒ@ˆ˜‚ã”eAW>€ÊúG¯;N€ÊôûköZY~d»N…³ó@iÁ(\”àDá0™„¨#“["<´Æ1bd!l8’2éÜì ô½¹Õ±,>f©*ê”–{¨’?晆ql$$uHÖæ‹5'òEŒ'ì·1Î8U~Qr)Ûº.òõØ×ÐW{¤ Çh´1ÞÒ=ðåÏ?}^é‡eÀæ{ÏÝýñ›7Me½• ³+~÷óÏ_=êˆ âGÂÎɾp6Ý@~™ætõí)ç‹œô˜KÌ—ôýççŸ?p1’ÃÔXSöyO~æµÁ/øòI²…–ž}ÍÏÿýïŸÙª€9KIÓ/ºúùçßÿüó¿j×™Ì,oºÖÜ5ôãW¯ C¼GàlÍYWÞþû?ooT†‘á%,r.ê|þÃÏ?¿î®ZK¢Ž ãò3_ü÷¿ÿû¿ÿ‹œü¿ý'-”!OæTö¼ýñeï&è. çÔO¾úùçoWg¸/Òäkl€_ßùæyn€õ[nyEûŵdìt:9ºÙ-2ÜqüÚ7ÿýñÕåB <ÂÙXú°u–¦‘ÿõÖ¼p呤ø­9öê«_t7÷]( €/OæÞúþ‹›åA‹¡§ •QtûÛzZ“ã2o”]ιüô!eÁÂDFt©^MU§,g‘€WÌLš£CèJ®±ÕåDé•k#€öus2 k»XŒ£ 2;$±òá‰mžtã•« úZ²æÓ–ïyríô6{¢¾«±¯ãRÊÄ,ÀÜW÷ë·[¯¯úîÂFceŠ™‘ßzc+k Ë͇^Úï§÷n »çlwœ™®ÏËYã¼¥åÞ!ÿ5ϼ¨Ý»’e•Òòº!Æ|67ªüÑÅPcÁ,M〛n0T@-œOCkËVK?ÿÜ'$ÈR°ñ?ƒe¡‹5Ñõ’Mfqc‹Ôl²TÓ_»µ®$)”?b"ÉÇ»Tœ9lªB`-uj¨.rURÓÓßü¨ûŒcBµóéÓd©ëöÔ_ËŠp èx¯:w¥4Ùd¶þÁ[_­÷´â·<ýôèè\ÓÓ=Ñ@×Ù&öö•"we‚³_ÎãÓaZ28C۬׽Ì&d–ß|tÐw¹~ÈźB»Ù$KÓÍ úhòíL·ô]/^1gÄ_Ž½ýìݺ¸U–jz«7ÕW¤† ¸¹×^Ÿ ug* µFhñ´ˆ¾uÕÁl]_ÿœÁ{eÖò˜šRÈÞÞlK¸sM^Ñþ¶s¿íËÛ1ô¦3@õÝ44:Ò~6Ãrž¦®ºKm]¹$…› >ÍpÌ 3–…^ï¿Äö»þö«î®î¶+׺ÝÌÏ0š1 + XÎ'³…ä’};ûn_8”ëâ €©b^ÜþèÕ5PI÷¥=õ>ܧ?< YF`ʑóûÀÖ³|„Êf%—z0ÔYª+º_ óc56y è›VU{á5sôÏ”ù.&¯/ùøhIÇÍÏ¿}µ—AnF.òìþô‹ÁÐÚÞ®G·Î嘪ð2[ïÅêaÐØ´Æ #S‹ƒ Ù;´åÕx$÷ u…c°õnœr]:NU}eÑújý?ýð¤ë*RíÍk{òviÉOzl¢‰õ ã7á=†6S:}èï¨ÀÔÐè²ío"ÔÂ#HPÅ£ýñÛ¾ûòÍ«·ß}ýõëÁ›;9´wN©[¯vÕùâwì«?á¤'¹ —w¾pONý{3€ÆÎy? ×yj¶ÑÑÇû?ûú„«€2]=ö4Ç»­mÌß²’1m™£Ãž®óÙs,õ ¾žbg%À5åok#,ù!:Ϧª“6Êðåb¯ ƒ\,µ€,f{Ö '€U¥$o®^vaËys ¶É]xEÀÅVuíØÔanÅ÷MI«xöêeš•öèÔ ím PÏxÿ÷‡å6ô]‰ó5G5ò¸p³b§ùlÀôêqèå¾· åLWçá¼ì²öž†ÍdíÔà eÎúÀ®cÇ~~e•7²ìÑÅõ€¦kúÚ ¹*œÄý%"™žh=³Ï|®¦6ѱª²t,¾ÜkÇŸA¦/ î}t5Xkõí7}‘xÒ8ª¬|d \pÄj&G͹± ÒÙú¡«ö´õ ôÅØ°f[”µ]J$‰ï1>dàûÛA‹‰lòÚÔkè˜*±}LEXx u–ÉùK½™lU†²¾àIcRTCåY·™£è‚MdzZN@:ê[(\D˜¦Üo‰Fð†s!ÞÔ±•èKV\u+B• ^ù—åf´Ü‰Ö¢S§©Å¦6î°46³>ZŸŒKXÞTS`# `ÅV Ñe5ömR›Ú•·+b ðkžüp?x ~¸N®,Ë5ÚöCž(©"J‚åÖ“<x+çŽt¶"iÌ?±¤|À88ãøÿÐä„iüǸ@ ™-‚¤¤ËXÜÜ §Mê%ššU¸ -@‚¹Õ¶ËyÑæÛÎØcƒç먼{ Ðp¡ÍÙöÛénöf4Òš¶h}}¸ayîÉëc®¦F ‘i)míæSÝ)k ærÃRÐ)°ÃÞ*ÐZ [ñ²~«m4r)¾MU—Äé3—î^™ ¡ÈÝèê“ùr°Z ÀH)êRÅäÖ]íï ¥0´ðn¥=r ïÞÝïæ`£½º©©. @Çï\õðq’™¡á:O…¹·ái~ŒUÏ’éìäa¨B57ñ÷fé›í2.¾>`6ú.0!àÆë;q\®ölÊ(\fUx±û¨Wk‘Ibé³;•(i±ÉgW{èÌ¡ñGS_²0 k¹2xi½YâÞž·]Ù6³«·ž<—àF1Z[÷¦c·õlúÊ̾™† bÊßv œÅܸëü¥hÓÅl-Š6! ¶²ØGee¼åf_ý˜Sà'F>¡eZöÛ,ÐOkjÚ±ÆjÏŠåâÁ5æÀDj¨ÄšÃ»Äâ|I±7žnnuëF @Þ=Ž±Þ<ÖªèÒ·Å|EÖ朶Û£œð\c²­Ÿ©o¦Ñ©»o2íôù‹ìò¯½8âÄÄ4AÈlÌïg¤ríÞå­{³Íׯ”ú.a Z:ûï¾zteÿæt]z{•×¡ÊQv¨:æbÜ ÈK–²q!@ƒü‚ÊUª;븫¥Çü¨Z&D³UÎÞ†òÒz"`¹’Ÿ\ý¸9q­-ŽoÁZî-0eÊr³kNŸÍ”'Å¥5!Ô¥®m®) ¤ky¸§ô÷•ÙÎ$!–Sžš~-7Ȇ‹ÜŠ´à¬‹’Ô›¡³ÿÒç•Û‚¬Tù6\W7†>P‹ê±"îd¬¿Žfwªb¡°·Ž&ö„éò€– itÊàE^Itø£€0yu‰‚k$ˆÉñ°$xX >š5TZö¯hwž.`H¼d õ›hèU€ßÓ/‹~PÌ[‰)LƒÏÀ´Z07)ÊâQáG a£«éA ¦ðì°÷ÂÎÁ¡ž ¢l„¨Š æ ‹G¢×¥äÑ«À¦ÀnÞ‰g‚Ü\=ÏÞè#Í&m„âê”Ô}ÿù›O‡ÊãCMæ¡Kd4k÷£÷‡Þ¾¹šm¡¬©…sÈ+¾öìÁí–Æ»p ¬fêšvýÎЛ—C}•Ù® ð£ïóÊó³êov¯ÐF ¼ä¨Úž®¼>xçNÃÙÆçwKQWü«n£•êÉ6[7©âÖëOßþûûoß¼xÕq,Õj'8®¶ÿáÓíåµç¯¢`垖Ο={R´1P8Ÿ¥y‡–<~ñù›‹q¦Hk—Z%»<øüÍçOïUì\k¬Bs +¾÷ðå篞uçïq]J€*üÔŽ—¯?ûìr¶¹òÎ¥9xèëzÜÛ~2çÖ Ôœ¥io{íá‹ÏßÚëe1²·µ5<š/÷l'h®‹:û0/ ùEª¶Š®úÙë+¥áT°æ©E iì{9p½õHîãvt ŒL{ëZû^~Þ%ÞΘ7‹qêÁýÇ·/u>¾Z9Ö&ÈëâÝw^=ï­‰¤Óc†§ær¤ìú‹o>½×êéÀCn cÎÐÀ2úÊQÂcŠ_ >í,¯}p© Û¯ªåþ›—/]ª£ÐaÈ^`¾çÄåÁ¡7Ÿ=¾å+Å ˜ºû‘Nh®»wl KF¬ "Ú¹ØØ^}yðÓþ[9v\%2¸«åµ\Ìñ¶G³K‰”aò:8Û„Û_¼~pu»….KÙ¤°¬Ü‹€L ÎV®ÆQ™3Ùk78øæÍÐÓ®üDs%S,Ë1ª ‚Ifˆ™ƒ <±Æ ]ÂTc*’EsI&¦j„Î|qB­H*,Æ …È«³†F–(«’èj …&®W ¢º*0Ï3–|ž® .ÊÞ ÑKhquºÈ9ªŠˆ “©B³7 ÅDFÿ‘´q,x“PåPa)4Ã3òu˜åÓT´c$ÔèÄ)¦pŒ,îê ˜,ôãµür¹þ”¡pð)LBCáÀ­"K@Åz ¼¯P"a¾b•œ‘ÏhàLü ñ#CB$¡‡ åÕB%D¤‡‘J¸K=Š›[Wkj›ÎÐå¥V$ä€ë ø.r9r¦"vEL0êB™¨Ü˜ âæq‡š=E¨2°7 7Y{‹7ƒl®ÚR®£¨ú1 'ªê£;OÊ`òR¢Ë_ ,&cD“%q’’èñ°Bé)°”‹8AòÚE©æÇ š#é¡bõ¥Ê9zè¢ÿP7K‚dWCu<Æ4 nE)=IJ€b>òí]Ð6¡²H ! ‡/±kìR*ÍzY¨ "ƒÉ:àÀDFï1¼ hd²áOY€Ø‰ÔYr„)þÈVB¡%UYP Ì/*@&Ô©€@“KæÝD­ ª´l Ô·¥8»n¯oí«ˆ_¥+5^%ÔpDRkÂFÿR( fÀ°O€.$ˆG¦ƒo‘Ù€~ê"©JÑb8š«h Ãxd)NÇqgs·D4•Ö^¨¬ÞçîÈ€tqX h2Bu6© Ä¡²h¢t9TZñs PRžoL e80D`kD±š†ÐX2š"8 CŽ†I^‚³3¤ˆ>¤p@ßÅ£4Á ü¨TC(~äÉJZ€êX$‘ ö=Sv¤žl¶,íXÔE²g@™<ô‹ð%¼}»ß¤ˆŸàT( ‡Ì$#A Ü­8“C(JŽ:BcúŒ²ÝÈÃXŽY6œ‘{X‰$’ƒ¤¡Z“ò8¡d°ºDzäÆ&Š'€Rb¯ÃÕ3ÁÐ*,¨Þˆž3@³Œ4ÈÐɯY¤¾ Óà0dL@¬ª¡óGС…FΠ…›&ºÂ&1%º&ØQ­ò1$€@Cí  ŒGWä†Mð¡ÅBi ŸDøaÑ1tÉ„92˜]'b šŽ û‘紲议15Oú°³‹tåˆBE6¢¨%¢ÅIš<ã#‡ˆ±T'¹Ž‡iøJȃ³-U&4ÞD Ñ"kpd 8 ‰^‘PÉš!ŒÃ®>,ÐlBlTÙ>V>7q’âÑSœ ç׋eGoÔµn¶’ú¹$M,È(YüG÷”kßs츳qc|Õ‚˜ò@RRè$ ¹¹^ܨÿXË7æcÖ&œÿi“!LðC Sa”„¨¿# =µ¨“ûÖoÀÉ8QeþÈóg,@öWf €SœDFèß7ø’a¹ÃBt§I%IøpÌN•þ›8]­Ö‡ðôÀè˜g¿ko‘ªÏòÞ“{*ãPæú5ÖóÐà I÷Ûv8óhNØãycÊò݉¹§3ŽîY±ÂP˜A{O>m €Süˆw韀Så÷ ç°¿->zڱϗx-¤Ø.Î 4È­{Ô™èçxÇ®}u¿ Õ›ahîd0±=·§lg¤»ž×Õæ   Š^jç«Öìõ†ÊRdÃmîX¦øa6ùð]à‰O6ÿZœ* jq‚{›:Ï£ûoο¿ÏK{–¦`±þJÛUžë¶íîzؘÝwyÇÚnʉ’ÐãvÆEúèX›-:Ùª¢rjl\¡§\fÎvpÔà󥈜B´‚G™®:2é§Ö·K茾§MÌ*›ˆH{_y‘_Ú'7õ;;pâ­šˆM›°P m\8K$DºÿíÛöŒ}„u*¼ðø«Ç3Ò¶¤V?[€Rd®?S°?ïhVqý±ýŽªp<ÛàÀ­ïºŽG©Lp €ZNP­c¬—ãœn|ÓŽöûàÄ??€¿„üñ¨dÍ Û ìm'%5AÑá߀¿¨àH wÈ_¦¦ø{[¤þ…wß)4I›€Ô8mòàD&wãS‘6±=‘‰ìËLÜ]sâ;&´ÛWš'»lûë19$˧ø§àDöy߀´±Hýu8‘¥ÈQ|ÒþD‹š¨ß§øà{KëR?'®ÒNûØÁÁþÇҙݚúa>ÎSéW ˜„34$˜§ø{[ﶄ ”@¢ÉýâÇàØubŸ~<R'iŸL€t’¡N`õïýÜh“q\™ˆ•Eû°@Úd–'»ðøÛE‡¨°I’üèe €“ æÇcÈF‰Ð—#r”`*Qy¤À…&~Ù5e' @SŽ0fZ`©ÄJÃÓ€€,^Äèý ùWO•ßÃìà×àŸ£üyò¤1äGIQóv%•}Ø@K ‡æìEÞaÉã¥oZš@ø2h27²H¨‚©ž€XÞ94Ÿ›:ùŠƒLfj S©|›Ré>씃©2ÑDäßNtlª|<NC.yÚ„_¾ë£ÿòYPt endstream endobj 1272 0 obj << /Length 2234 /Filter /FlateDecode >> stream xÚµÛnã¶ò=_! /2(¼éÖ·¶g»HbÛlÚƒb·ŒEÛ:+K®$× Ðï ‡².v’úØA€h4"g†Ã¹’fÞÒcÞû«o®n¿—‘—i$"ïaáÅ‹U¨Tz™÷Éÿ¸­ó¹nõìFĉÿKcj‚ÞoóÌÌn8ó¯ qo £C/2ŸýþðÃÕ»‡«?®80c'â*ˆYìÍ×WŸ~g^ø<È4ñvvÔÚSQÏÂûxõó šNå,`2&AïÀ:ý§j‹@â×Û’0òòËZ7­>èå,ôu^‚à’¥ý„¹vcÓ® aôºÚ–-!+ǨÞ¦!”#û+=ÌÿsÆCßÍÌòF?& f7*”þo3*ë†;Ž RÑT„2%ïVà8Ä ‰vìumP± •΃4 iù2ÿñ‰ž™YÌ€ŸÞ- üOE_šj<Ò” Ÿ¼\~mwÙ­¨—÷ïÇû%AÄ%<’ å/ïe Û‡ûýÑH¸ð¢8 `Y/Ñ€Ñ"PÂQàþh€h‡˜—4`œ¹ ^Å2HãÄÑ­·8J¸3¾éÓc$LMÜΖ ¶ÌÁ‘UW T®zø©Ðs3¡´ç‘—“/óªÆPJ/›~j'LÕë* ý`^•h™'• a¢ÎÄY11Œy ùÆ%È€Ë[• aB@z% öJG…/Î }'«îp‚HÔÅB_‚d¡pEñ3Ånû´9±ÔŧItžIpQ½¢,$áYvÖsÙ™¥{!;ƒlÅð uLñ‚À×dd‚q¦ÒðL»:UU‡b_ή G,ìRªÆãhæŽ!Z¥hbÏJ;C¥¯ãj[d4´È¿ ÂŒcóÑ}×Ò”®žu½%†àªiòÇbHÆí“.àÖÐ(æ›b Vs½w#™µë÷+ÍëýZ›®HÞèZ·ÓÎTw)b½ÖÁž4æRÊ‘I ú@ª€êÖU–/ž¶²£F˜ô¿Ç„o‹9,¾gÜ7¸:©ü|J“ò?ƒóxÓ =ó²ÈKs{÷ÓG‡/³ A2…7«k`>”P÷‚S­ëøc,­2´+Ågaj÷u·2™;ÌZ·ó•ÙÏÈ ÉpÂÀ²àu`Y±t& hg’YÙá™ÕÕÆaºA=§ÉŽs>¨Râž#mPÏ©Æ=­1ÀsoFGõ`ºö©(*l¸v'Æn² RçõMJ&A˜ò7ŽÝ.o»•‚¸È_èš.Zœ¬¶ÃÍ 2‹ãJ°@¸2ù›v¡!R9xUmž;Ø{ñ$FbÌ?É0aå,Ug¦L#(€Õ+"° gXæ€ÍÈ2‰ð…L“ñ@JWVŽmÊVöå³ÒF@¡þî¿`œ²βÜÓõz°½2 ƒ”]®´•q ƒ]iûpPUìUd{±.ù—GN®Lx˜%`Û¯)¯tŒÔ}õ¤&™¯t¹4×]KhÂ8Á»ÜjšaØè„~@«¬Úü ß$;×ä ôh‰š8mN‘°ÉöšƒòŠ@}‚0RIäª_6™n©‰ÿ ÓLµuWýQ·=“½ZB£°¿‰Ìe\Æ·ˆÑE jyÂŽY³ZYT:Ã2É ‡eÙ_>³a°ÕTgt”L3¯óÇŽH?ÍHàÉâxùòØò` ,–ˆïËK©¢çÕe&¢¸Pxä<Âæ÷S"£HX ÒóR¶ˆâ ‰Å·õ.oÕÖ h‘Ãè e cû~óÝ ]>xþ`ô¼`y²ª7(D±¼X¬„Æ&¡æ#‡DÂE)¸_l; ª¶Ž"œY‹Yà'ëÿˆu‡Ÿ.jóǬ¹xšEÐŒÌnBðÜwkØžøK?pîà ܻm†\…ÍhèÄœUçD]Q1ÿ×ûY„ay$*IäÄÜóÏ1†v戣û7<±lFíRøÿ"'Ä7í#'Þû9ƒü&ÃøícçoðÊúàùaWºûáEn—àî/tÄðz¼#ž£âÍhÍ£¼U7¦Xt©ÑQ¢^³UWüå튠®û»ž^-éúÛVƒùrå&>:ÔʛŶ8Ú×~l÷E¦vß=;q÷‡óÃ#2Æn5G3ø±Û¥IæuPã3Ûž„‹¦:íbŠ+Uþy‡c\2pØ·>py«‹CYÅêù«¨æº¸Ä½ÓÉ*;Ü8  ÕåÉ8ÄxÁ]ôß:oÍ1ó½î¯Q) – WPdý$¢H4EÒU9N¼w—QÞ•m]eÛy›WåäîzìãÍø‡ÖÙºç‡é\B¯‹ÍéOYBò_ÿ’åèOmÀq@gÄ9èÖqúß­ô¦í~h‚·GðïÝLâÿ¨K¡oi~c ‘µS9ÿÊrlx endstream endobj 1277 0 obj << /Length 2015 /Filter /FlateDecode >> stream xÚµYmoã6þž_!,8»X3|•(/pºmm¯‡^’½Ã!»‰¶…È’+ÉIÃý÷Š¤-YN²¶ˆ(¾ÌŒ†óÌ›q0pðéâû›‹ËŸXÄ(iÜÌ…HpD\"³à& nG×ë*KT£ÆÉÑçZWvôi¥zK9æ‘ØRïѤà ʟ£»Â1u$H`þ@0;Á†361„tÙ˜y1GÒ®t0;Hy§Œþ³½Ê®2äæ*¢qˆdÌí-Öë´OBŒG…*ÜèR7Éeí®w;@µÌÛ›;Äÿz·+8CDÊ”8¼K Á¨8æ.{Ê`qÇ®A¡äˆx“VE V*ðh©îÇ`ÀÚ¾ÜhS®+;ÊËDå¨Z纶_0¦¹Û–¹9•¦ÚQlJ÷\¸=yV7vTÎì³%†Œ†AÜ ‰PÌœ\ÿ(ÇTŒÇ¡h1Õî-ì ƒBÃÐ@­½(³}É ›¾˜w:+æþ³ˆÜ ñÒ¥º E÷%ÎWö!1{kpuؼ¸Bp‘$b\þr ¬&ÉËð²3û|ÌUÏCÜñš^01=ÄQ8<[ ýlÌ“Kož<òæ s3A•å-„`¥…Ì}o‡ÉB'÷v5ÛQ² 5¦xô0&bä.Uªíšr€ÁÒÍ|a¶o z¨dT¹£YaŸ¾NL4ž0~ËZÔuWSÝ€àõóƒÀ¥rVVÎõñÅBX½dÞõJ'™ÊíK²P•J]ÕïýªJ´IÔ*k†[í;˜ÜaÏ¢ÍÿÙxNŸG^Î'ÖËy÷æÝ¢.Ô]î=ÝVô®adþóŽ…,Ôž·LʪÒIó´ ‡wYºÙe™f³Û <ߨ÷ ¢Ã¦ÒpUÓ÷¨ß&òÖÑ>ç`ëu÷TÏÖy¾éúÙ} åt—–ë;O¤s'‡xÜmü‘­¯Ë¥nÛ×f¡Ü§Õ‹r{WÙ|®¹¬é­CçXÐôˆ` Eàω‚Äàå[Ç‚›7‹‚‚ç¹[]‡`5‰8pÜþ3*íÏ›àÖ§zˈ̎¥p¹OáAUGО'pÖùmH<‡ÈLAîtôÔWœW·Ò!V€¡ñ«ÅU1Šãè ?õhbÍýýWí;•<ë.ƒ/©ñ<&H²óÜ#$$y^Á”#,È9n Ã¦ëá×q\RWaäÚÄÍEÓ¬ìH›½ÁäoO­|Á/ëùôݾl+½J›èiFó²®3G;¼™@Ðæ“euÿîÃÖу¹ˆØŠ•”àé‹fúî:QU®›¶9ê ”îî%ÉU]7›•ž®Ê˘jЈ<•g°Ç[ë4@"d'µŒ0DèöÒ™!±)ÆþäÕ®iJ8bܘdk mã”8WqeëíˆBþ_÷²’=7š‚­GdÐlíÖ wÛB&O÷KËÂ¥÷ 1ª;}&—d x©¦WÕ,}nm9Ã|.QÝ·¯ÄV Ì”BEj‹ÖëKÁåvdó¢­P™9ß?½®·gm kë"ûÓ,ë7›¶èæ£/t1ääJ.8ê4ÂœF˜×ˆ[µvº°\kÇ׶ŠòmïîNÕYâ¼|£W[-»+ð…ý´Ÿv’q&ûJý®`/9@"7ú{éKáBÛÞŸ«‡ SÏûGðY4­ ¤ÏüXuS­}}Þ£šê wp,¾C0Ï }’Ø×­¹©•k–zC߶:_f[ŸÄ÷·'zÀ*Ï}ð6ž¿²^¥àjÓ“XþTùnÂö3ŸÔ#PìÚø IÞ­¬02 ^V¬ ué ³«ª4} ÷¢<ÄÜDQVKe;rÏÌJc]ÁŽ€’c:úÕÜ„Ö+»Ö6‚๴ý±ö\¹ž/L×CJß–0¨7§¥Ûô© ÃÐ~ã°£ C×U6zYV®'2ó­¡»²Y> stream xÚK Â0„ïù{LÀƼš4WEÁƒOÒC°ñ­øhñï{EýÊÊú﨟¬*öä"¡ZE2ÉÍñôìoí@šS’i!ð¦«?t+õ$’ŸzþЄkÛ³%#ó åO’ endstream endobj 1287 0 obj << /Length 2125 /Filter /FlateDecode >> stream xÚ­Y{oÛ8ÿ?ŸB,°Ë"õv±Wä²n›½6ÍÅNo¶(™¶¹•D­HÅç}|÷>$K¶›l6A‹Ïy‘ó›áı––c½>rÌ÷×#_ÇBVˆ­9¶ïVš}üìXsÿÉrì8¬µZ•[^Á7³¦Gÿ9ú×ìhô –ÇvàÀš-,/Fvä#+ˆ±ߚͭƒó7gW³ÉõÉçÙOj9òl× °\}ÛÁ®5Ä®#¤—O/~–K&³¾pÚ¡ë=V¸7×I] „\ÛÓÌÞýûâòõɇÑ`:¹œNtóýÍÌ4^éïÙ[P;ƒÙÔ¨w´ñCEx(EŒ éÿ®H›}gd¤º¹JÊ’\w¨øþÄ÷M//Y%’¬L?9^ÖÑ=V›éõ* ýÍIRpûdè"gpÁûsœT”Õü¥ž½&9ÁþàNþC3|¦×.N™Ž%ãTP½ùòR¬ÆYN—®r3·0sp% Ðøë+鎭ßo‘¦…d`™qèŒpÞ@ŠHhFæߘ‚–”/ìC0ÿŽ5 '•ßÂßÓ¬d´¤â}dÜŠI ©{ңص}Ûôð®" R‘"% Þ ?ï!_‡áž;h¸Uü1¸èa¸ að$\Äql£ûiÀjŒíÀAOÆŸ0ÊσŒÂvhR$“Iüi©ß½yÿnòå²Ë¤ØèÆðŸf~ò3$“—go·k¾{3›]}¹z Ù™ø„\O;%ÐgŸØ5ÏOŽïôùüæúzr9û2ù¿†ÀÙÐX7yb$˜®ØÉÖI%qºÏÇ1<"Íc‘±õ˜p‘Üf”¯ ‰ì ¤`w¤2¥ÏBŒ_7R4$ –&œ˜Îœ”b5ö¾ÅÍhÔûÇñÎÜüq­Ü£’›Æ‰‹\]ÑV¼QY–#ÐAÌie—«ò%|8~€@™V¶ÊéÑÇdøÛçßñŸŽ÷§ƒTh«¯¡/Û’‡ü*>£›‡8¥Y¹ؔd,â“bi½£bóÀ¾:Æu•RžÚ\æάZŽæ4©6öJäÙK.Xµ¡óÂÐ EpÎR›@H’áHè@dDŒ°ƒ/Ek½^¤•.éð–£ôŽ¯É­ ݧK>êß涫.ôŒÇ}+r7Æ/ÀcÐÓò’¿`{@Šc€‘0|¶ÄGŽyæ‰zÑÆž&vŸ$ ô7óÍ`Ó²m:]Wà0»O˜& ÞQNÛô¾º'H>&èà²Ï0~ZÐqÛ ï?2žïO‹8-“nÀÑdŸ'ÜàÂêcþ+ž~È3pèC!à9ýö‰Î÷ȃܿM@nÔóyŠläÓNuÂè¹mJ ÍmJ ™àz¸ç}0šQícH“°ŸŽSÄžblj‡.œÉ “#zà+VgsCºÉ÷twÃjÝPÎ <ÛRŒIW4»LC.\qxIR*—§ºþaÒ{ œ©y›Y³ª[p‘Õ¥;ùãT¦n“TÍãp—&.¶Õ‘0„(/¥ ƒý2 LrQ%t¹2+]ô´Â.˜N”º0#yAs²O3Ó#*'‡ó‘~FSÔlntó𠜈è鲆ô(Í6'ð(“¯ØÜðl +þU[K’P6?`Ñ<Ùî뼪HD[8ãu)Ëkæi‡ÁáÉÊ~)cÛâPqÐÜúM¶ûzØy„ÂÈöjxîÊ ªÛàRx88­ôê½Aðpë£z®„(Ç#•9q3 ã.Ôä`í<)Ô*y6£î¡DR´¯þ5-?\Ÿ YçHÄ”à­î}Jd ”¥šÙÊÏ 8Á‡WÁ!xx*:ëžÌ|¹¬&yYŸÓ§êúÂ÷—š›–Vm ·r•rŒí$”Iª!¨Ý¥)±*º\™Ô,ÐYBñ½TÐ ÝZ¤`õrev³þ€ašplçà,8›3,©jU28京‡?NuCÈlãDõÌTfþ‰HNu·[rÅJ®À–¤,ÏI1×¥d’)r~Û2Ñ êS±Ò­E­@Äß±¡Ü˜”à²MõÃ<0Î$i³ÌÈ¢ :’ãÁtYÓìöÍõÂ͹U@sºûæ7²À>¿j@—ó¶*ÑP¸ùñª­ýºmÐå¦pzÛæl2¢Kí-Ýýw†ïÙ8¸?½÷_->†<Ã{Û™úLìï²ü?^“* endstream endobj 1185 0 obj << /Type /ObjStm /N 100 /First 970 /Length 2113 /Filter /FlateDecode >> stream xÚÍZmo¹þî_Á—æ’C_ ã€\®n´h¤ÅµAPÈÒÆQmï Úrý÷}†’.–,G+Én ÄÑh9Îû WÖ&«Œ²6‘òV>ˆO¯,91*¼<ÉŠ8ÈV9r9 à”w‚“½ò‘Ï°b c³ ¤¤8—ÝQ…˜åIPIPlº±8œ€C 0|#dÙ8Y{Ï9±<ÃB  ðBˆa!šB Ñgy†ÿ’êϲˆA&*²^žál"‘š,)räp†u€BYõŠ¼šä}Ac@©0…gL¢+ õ'RÈE’c äbõH8&BzJLrv¦,4³( pgCÙé•s" +ç½0 9ga‰¢rÑÉ^JÊ¥( ÀàRöBNmá ØÄ»*г÷¢lr H,é”g‘‹\äy©{Ï©¹PŽ€Š|/ 8ˆTvD ¨×§, ðA±!QŠ‹Aˆ­b—ä\è=*P(;<œ£‰Ã‚ŸpQ\ŒC1{“˜{seÀ„ÁcÅ^"Q3 b»`Upâ×0 Þ ,ŸÊ*ð8gœÇ A\™ÀXˆâ‚±7MÁ"Xî¢SÑZ9,z@,R$Y„€¡£hPPÑYÙ ^£·ˆ9z.‹ ¨œ&"ià|1,OÈ*Ʋj‹1Š„.æˆJ(BÎG<%A¶8092ggÕÏê6! ßªê—üü€s§3tÞ,no?žýøã㈎5DÚßÐ ½ÑrÔ™·(^¶M¯..Tu Î]Ë—0>ô´ú;¹°¢u‰, n*_@¢z3oÇïê^}PÕ›Ÿ/Uõ¾þµW¿QÿŸY…Ñu}V½ÂIuÓw’ Œì?«ÞÖ]»˜ën™‘ʳ¿Ô“éè§öWõA‹™>â Ñ»%v¨ Þ!òUP+VÔ)ìÒÈ"(Ã?÷"t¤Ô8xÍp‰ýˆ†8€"’„Lƒ,vÏ.;ÞHé¡‘r8ÌHÕ˦iAíòÀ?¥À@ê‹[Œ”-gÕOí|RÏ }ó±úSõºz…/È…¥1„IQ$“h‚NP»‹A¤g„«Ž)íÝâªÉêÏÓæ¦zyqQ¨^ŽûiÛT謹½}-?|îûÙï«j^&z¶˜4zÜÞU“öKsÛŽ&ÊXU_µíMƒCmªþðúÍù+üýÝž[môlòéø?NdUí$Û¥„Дœlt†’CFL3,Ãí´¯ç£~1¯5L~ó¥¾½-úön$èE®éd\]ÏÛŬ»‡ iÇ‹;±{õeVÕMÝŸ™cÿu^7ç³ÓDŒP’‘,Šd.ëÖËÿ—ò•@Ìq`FÙ@D²¤sr‰ö#zÔæh/¢3I›0àh4k:9?ÑØjXúyêAöaönPú!¶Ótš«¬OÊ:köY[ô»?†'ÁðŸñ0îJÚ™ÜM›Z·³º™6ŸÚ®jÍdéÒíüºšvݢÝcQ¸:R•3w aË—ßòŽ'íÑ+²³=-]Ëãèö²˜øªþؾo¼ã‡nq%ÿê"Çït/ÔfÌHW?(f6©ÂÛHÁm‡PãµË<uB†¡½ˆ.“66h·W5n«>£­e8ÑIB;Ä ÷¥¶CÍg·û#£­çýˆhƵ‚ˆ<¤e¬=\á_Õú4I×;{|"·JBäׯu~¢u{Di äà¾Õ0œ0åkvŽ´ ¹‰`P­wȼ;,£_{Mæ~øŸÈ9-©]²PÄ@Œ.S›(7’“Íf£{Ìhû ì žÊ4˜ Z4Lý6ktøƒ¸¡§ç† ”D¢oÌÝΠû5Ôãžä‘r UÂcR¦ÿ ìD´]åf(k‡ €>=L;ü(;û›Håš.#d’\¡_Ê¥or‰ž±°”ì‹S¹FøË%¡`–Ë‹âχ3}=í?/®–Íws;m¦£qÕ-æÓñ¨U3¤ðÊ"Ÿl5ØrË6¬Úl Ê­h@çö!¢€=¼Tø< ×ÁcÒ@ºd‘¨ì0\“uŒÃè‚)Ñ0º” ûFl(ÒáÅtã è^+#Åô—¿^ý[\IH¼¾+7`6~»ÔÕõÕÞ’Ë;ÚBßï×uÕŸÖ÷/ƒ† & uØyÖP‡ÇŸêÎZí–·Ù…kG¤Ñg<+× ª8¦Ú`ú!óßîæ‘vvó~ûN õ9‡ýˆ„JëN¿þ“†óñ!Á´ v'…FE ryŸ‰<˨ÆÃS±Ep'•’îót~3i¯K©'³v~sò”—&%¬êu¾Á¿9ü¦°Öݨëë¹^ä<¿ÖMÝWÛ>Ïa Ïo >æó[Hvñû\Ϭ/xïûd0ÇOŸÁîWÔ²mªòÌ?M¡ a‡ü@ ,ùÝÔÿ/4 oÆ8?âˆæ0 ÜÏK!?éx˘kåÕ:0ä2>åõ3¢?‡}®}p½íÀPÞ@¤2PÇë"Éldó÷‰ç¸£ÆD>Þ›ãÐÄ7sš7P…ïòÊ‹’Ý¡„|¼’92¤—`‡’i}a•üI­!è’ü,€Y“üZs·LÊ!hkýﺾÓõ]=¿ž6×ýçy=Âw)Àw£éíݨ)Ò¡Vk¤ónzÝßBXÚȯp\Ô,¶”ë24ºÚ&{x¯³a»(O¿2ß5í¼ßæ|éZCã+}£±ø/«ì ê endstream endobj 1292 0 obj << /Length 520 /Filter /FlateDecode >> stream xÚSMoÛ0 ½ûWèh‹&Ë_ñq+Öb†m­{j{Pb&6*[™e7Ë¿eÊAìП(~¼G‚í™`7Á×*ø|ä¬äe.sVíX!Y‘®yZ&¬ªÙcx? íV*ZÉb>XÝLm Ñ*á'rÜe —<Žž«Ûà[ü bl&XLÅS^ˆ‚m»àñY°ý·Lð¤\³ãÕ±4_£Õì>øˆwDË ¢±à")ˆèug¡qì¤ Á=þªî ÁÑ“EØîèG‘& „ž„Ôô5jûÚéKÏ“™|é#l|¥ÃA»Öô>ÅǪqTÛ—Gµï®yiûýò¿4óv“Ö„ª«_,X{.ܵûÆç É,|uò@i7aÏ*Žy™e4/!¾>¢Œà=et €ŽY¼ kdžP*R½ñµvfêk­TU5³Ò9c&Žh²“ÒúDTAÁÏ„j¹Ñ¨VÃRðÁ'çÙ¼Loû¢F 8Î'ËÏ‚ ^&~CnÜ4^[3Ù…¶|ã…ª"£—ÂY"FCö{¿Å•î·Þ}ö`z žÑ&’¨ò<Ù¥¬m̤ýüöà¿qYü暴ÑÉt—°¬òåEd)—ù‡â¿›âµÅ’ÆQæîsQ„W:ŒË½æ8ëè‡ò‹ˆ> ýr°f–æÀŽì=g¢V{Éþj¥ö endstream endobj 1299 0 obj << /Length 1361 /Filter /FlateDecode >> stream xÚ•WÛŽÛ8 }ÏWøm q-É–íîÓl›v[ — ,Ú«I”Ĩm¥¾tfþ~I‘Nœ4X´/‘DS‡‡E*q° âàÕ,æñÛLÀ"Èd‰8J•ÖõìÓ—8Ø€üMGE¡ƒ{¯U‰Îa¬‚³¿f¬fO_‚zZê`µ ’BDy*]ÈHÄi°ÚŸÂçÞ|X-oç_Vo¼ºH"•h‰ú‹8Jò$XHBúÇåßËw¨<[®Îéé4‹2•ü*½‰½Df‘–Y …Š2÷ayûòýíÛ›wÏ—Þh ð%Ž¤Vð«´ZˆÔÂÛW³`¡ÒÔÃ-´Š2Íüo‡¦vÛ‡ˆ“8Åàrà¹<´åÚôf¾P" ×®éÊ®ïp¥C·%igç2 ¿ÏEÚÖT$ü÷n.ãp(«MÙìHÿ®rë¯Ýo eªÊnhÞï[k6ÝX)Å«0*Û‘†i6„ñm°ƒí¢ù"qx3ÝNó’¹Uå×9hXÞNáukÛy÷ÑO!¢"åLè÷¦Ÿ/d–…íÐt4s ††µ«CoÛyš†@@ñ$:¨Pò¾z¨úrA¬ì¼’yvnòñPYZ±çl§õRšu_žBÊû‘ÔÚzëÝ?ap¼Î™0±ƒiûkNãÊDy5¶C†]cª²œkò2ÎÃ÷%…£‰$!¸Éµ4±HöÁÔäÛôËÆ®endc³¦꟰¼qýÞ¶çè 1z»îON"kÌ šLvº‘,n½æóÐÃ)2:˜çH=¡DëµihrÇçÂùƒiëÅ4Ösºñì ‘x1ñ"< ¶µÚÛëÖî˪º0gN¶ƒönÄd¥†âÞOMù­ÇoÝ°ÛƒZ*ý¤‚.ò„s¤Ô‘sUÏ $Ó ø‘Ää+LÆ»ˆ}ÊŽÖàS qª-wªB*=iâñ1}bqraÐþ9ET£Ì:ãvåÜ=™1ýR Ss"{P²gmvec9÷?ÇiÜYËõWÆ9Ù, °;hª¿—Â[¬©PrO5U@—*JžÊ[ó°8دÄüÁ@}úŸÊœë(ÙÄñ½ùsäADAáÞ ú±ŽœîLZR©)uAr^x9¯·§ðÊ#©þˆëa0î CLRy~ÅÃWùL÷La’W^”Òá«+•PñUÃ*4àzÊ)_1иǨ¶rj2Rá±»x$_IÔØ]·eÓ¶¦ÙYVéÝÎrµoe7º@ÝŒ ]-<Ü|£_låôNð8’û³RQ*õE¹ÝúÜimãk@Ž 짺<¼=4sûg.à PŒÙƒ“½s¥¹¡ÁiáüýÅÉ–Æ^(<´vc?DZl|„N ˜bI"ù¼Ðž«k: XTe3š9`W¢ùg)uOÅÑK2¼whùž—pWk%-(š²2w¾¦h5¥£’,¼ñ5o"Ç•¼LyMm†ÆÔö>]vè&ôÎnwå‹Ö^¾=xü± ¢%ÈÒv=Aõ¦ûJ³’­RUÒc„8üŽë‚ŒËó.j¾b_qªi GjyÆf7Çp4ž¬û½:8„Ž–þdaìÊ]cú¡Å(ðYT(NÃå±ñOöw˜l¬ÏQ•œÙg§·´’^Ó…ŠR|Q 53ÇõÓ×5<£_¸ã»yšÈ¨)4¼¢3"òº¹°}Ø¶Ü b¼ôÔ~ðaxJÔGAŠ*Ê"Zo]U² e?ÅK›ã6ùà8¢Ðg{6^^²iÏŠßÍË?)x®³ËÿªÈò¯NŠx)á/E$¿ã‹ìÒä8“x² endstream endobj 1295 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 258 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14977 /Filter /FlateDecode >> stream xÚígP[é~ð7›ÜÍL2s“ɷ̤|ÈdîdÞLÞysïM²{¯×»n7ÀLïUt$$„ @¨w‰Þ;˜Þ{G˜j—u_clL1¶ç}¤ƒeŒ×6¦Ypÿ¿yìQç”çüÎÿéü2ÓÓÓ„PšS(ÛŘ‘méIÎ-¼´¼üN›äéÓ©^vÒL3l¼)qã6N'çW.,,À)`³~›š áfª.cÊ~£NœêG)ù•‹à7¢ßR ª–––Öoüêê*œAö¿ß&”££#ãzîÞ½ûú5ÔÅpü_ûØÅÂd2¢££Y,›Íž˜˜€ÓÀÁð›£/)<<œN§Óh´ØØØÇÃéà`øÍÉ—D¥†3 ¤8ðà7Àoà7Àoà7Àoà7Àoà7Àoà7Ào€ßÀo€ßÀo€ßÀo€ßÀo|q¿)úVÑÿª }X—Þ¾~`¿Ço²Ž¹è\mDJ;JQE7Ú_VœÎÚO¨½»™ßØ ¿i1aÙ ¹³¿k¸Ø#Bléäy‘˜(î|½Q\½Ë±ùÜúÙOþ`\alåS•â7¾¼ß%½g½bÄ è±¢ó‰­‹ohæuEŠÁVä=¯å=Ë(“w½ò c’2nèc³·¯ë?¶*ï]F¯(zWÐ/Qi>R­ú2ø #ñ[´¨ý’•z çòí襊žþ´Ssk G_E?7­ä‡£ÇÌ |aÛ<™«8sÁÖÄÌΙU(éYÏ­9giwü¬åÅ°´øìšc'N˜:Qc«§Àoß”ý«è+ UÊEr:7=÷˜ep|ã\|^ý¡?œëÂiljᄬ¢í‡Ó®Ñ•Oø#g͘·-LORÊæR†—¦ÿ©¾åLcøÊ/k¡| €qøÍ;FÒµ¤kú잶sõ ͹Ãä&œ%fk†0Uï´_t¾¨û5¢ä=ä&eó”èôÕû‚,­¶Ü<þÇS\-–4‚…qÌÚ…PßÑ ~à‹ûMXvùœ#Á*ñ I/8¸YÊE+ÊÎ{gϘùIšý(´³~‰Ê¾e_2ÃGÜ®ÑÎX˜ue—“xÉfîÑÂÎÕ`JÐy9U™obÈë\eF:°Je=ËÛŒß « Âr¨lÑoý˜¬}&2³‹¬n@‰‘wUñ¦k‡¨î¦Sæ›P!éÕ•=ã º ¥Âö׊ŽÉ€XgtV|Ãú˜z`™"Êr§kb*Ÿ §‚Ê_vVü&z’|2~Å°¿­_¸Œ©ñôfü‚îu-†Ê§xMšBß¿w­V }H×W©ÿºzPÿt@ÿTÿ®R»åÓ••µZ Š`Ëñ›1?½{÷.‰DÅpÀü† íéÓ§T*äÀ‹ßp­Ý¼yS¡P¼|ù¢8ÞüH‰‰‰¯_¿ÅøíÀøÍ`³«W¯FEEmxðÛ¾Žß 6›œœ Åøí€Íß‹ íÑ£Ggqqà·ƒ4?9.´ÑÑѤ¤$hnðÛ\appP,CAÀoÉo›A×_¿Èø Ú³gÏÈd2È Àol}@\kwîÜ‘J¥/^¼€(ÀooýÓ¡¡¡ÄÄDhQðÛAòÛú®¿ÑÑÑ^ü¶¯ã7ƒÍžz<;;KŒˆr ¤»1Pr$PŽY81w<ºtÌÂùøy—mþȆtÈÔÊÎÑ™F£íTüf8ÓÓÓ¡¡¡ 8Ø×Z[XX¸y󦿿ÿW_}…Dñ‹ž›ápØQ‘̨ÈÈí¥íÿÂ;‰…þE2zvpýSüàÃ9Æ_>­¯¯ÿ»¿û;ä·¿þë¿ž™™ùPp‚üÆd2ÃÃéF Ú¼¨¨(´©;^„òäI``à¡C‡þùŸÿùöíÛyÀø冊]ùùùl6û׿þ5òÃGJ^KKKwïÞ¿nÄ Í»wïÞnÄWè@]‘H´²²ET0f¹-,,äææ677£Ç%%%x-úÇØýµƒ;Hhhè7ß|ƒûíïÿþ裏§!€Ñ^û‹‹‹2™¬»»ƒ–ÁM®ùùù¢¢¢óçÏýõ×Hq¨¨‡ëKÝ­öþ°Ã‰Þ/áŠAn¯GZÕÇp3‡Y®½½ÝÔÔ)nrrŽÌžåê™™™êÚº‘‘ì Ý‹§gf.•WUV×C*«¬ÛþÀ¯ýR£Ù¯ìéÕÏÚ©W¯^I¥Ò;wîÀø£-_týýý©©©p4võ /--Ž\á+Rƒc,I2JÖˆGB™M‰ütûÎÒÒÒžåÞ•••ŒÜbvaXúeRšö‹'rÖèy×`´UÛßµ†ÆFs’šœ9d ûõ~¢d³ñß|žyùòeNNNOO\DÛ+àÖ°廵ÊáW/ÉY®ì‚„¦¹Ä,qS`šA,yã·½te&§åW<чÐ{pIŠ*êcËn£ P_þò)i #Ð;â·–ÖÖ侤£Ø¯÷SòÌ6˜³Ù<³°––ÖÒÒÅR`ÏÌfÈf÷ïÞ^|õâ}㽟^½àˆÔY—‘Ö”ý˜¢o%|:üz‹È橳ççf÷&~+*¯cßPjbN õæÁÛ)¿iºÕÆ:Ê6AìMÖ¹%$$ŒŽŽn^nûH€àjc>/­-Í^Aán3UÁd]¿¶!¾|1¯Rk‚HÔ§O&—_¿Ž«Y%76˜Í /’’;óK«V–—ÿýF  vä0~¿Ù¾ç·÷oŽ(r‹øðáçÊíÆëm­ÍÆœZšŸ={&1Ú;N;Þ_Ö€2ªj@WâP`žœ\…:wii©©¥Ý.(6®vR5ˆYûÒÅr59± }ø}³m°Šâ|Ùi??šØí{œ±ù '/x„©Þ ‘Hð91vÏo¿x—ùŒm6ܧt>oOÍFf3ÿª¬WwvŸ³Í膛?&ÛžºQi4¾§ %==}½Ü^½z•““ÓÖÖ¶…³ÿôÉã„´jY÷’qÖ=¢„.nÝ“Ô‚*ð›–ëÛ;{B¤Uè~ý ÷z-FQV'§e83SSÆÞ±º6 Ï¤\ÁLÃètzee%>Ânì‘1úÍ)È0œL&ëzÎì¦ßP¨ìáciœÀÍv wãwêšZõÓ0Ž¬}F3¤{š8„ÎËÚ[úêÓUtÐG±ô›Øù“6‚w¾õɳ¬ÛSw*óÍs*•š™™¹¾ÎM.—:ñnÁoÜÔJqûKcž¿7®úQJ~¥Qù ç‘+ãI™ù—Œ6e–_ß½#ðüùs"G-êXøPaGÚµÀ©¸#éxµåS~]eÁªVWg&“Y[[»#Uîà·_ô›O+1ïò’ªûÑi;~?FWæœwô¸à/õbŠî!l‰™‹k|“z`•*I3³q¾HJ•`Âê«6.ÞVq§ŽÛ µXTRñy ¾ ë!úGü†ËÍfo§ï¾ð§úQFQÍïâ¾tä“ò«ˆÉ=œÊûœŠ{Æ™X£é™Ù»w K+B’>xᬿq^MÎ{q  mþ¤‰ITTÊÿ7nÜ€øm×üæ’ó}cŽÖÇB ï»'ˆz0FB‚MT·¨Ë5ê͸®!|Q?ÆL,õ¤+¼brxmK›ÚSðøíó¯~ÒÍÃ+55%QOQQÑÂεÑ\¹2æË¿¤Ü+W·Ìòž“ÚÌ=i&&'w¼ü†’¬ë•¤}%ÙZïLÑ»,i!ëYÆŸÊ{–ÐSyïê›·æñ·}«²Î—Ò®%Yç‚âÝom¹ýtG¿`¿%Ô=6?oÉd2éz$ÉóçÏwêtuv’S:ö¬WüÚe¢Õ÷ªrÁƒ<>>¾7ñ›®[Kﲬ{ OkW÷'z&¯Èß8á#-/ù‘/â·/frðøm«~‹ŒŒÄ›T*ÝA¿õõõ†(÷þªANPi1yßj`Œúþ½{{ã7º4Ó.(Î*q¥ð}yU¢N}dò¡ÀdýNœJ͇Ž¤mFÒ¹hlñÛ&ï2›ï¾~¿íS¿Í?nM'ìzûé‡:ÄV>'å¿zùrGJ©÷[P8ÕŠœ]0™ÝmgoãצÒwvÓ]žjý@3ÕåµÉ5Ø$·ä7^Ò°®Ò^_„û.ú°j£‰’òn'~ðè¡ßÖ6µgž™Ù'èXFw™9õà7ð›±ù WJ=NÜõú‹@¿Œ¹±ÒºsoGêâ>î·`z”»°=qHç+¶\qÚ]–8´É5µ°9cQp_3‚qóÍ­íOÛF>äWõ"¿Q¥™ÞÜJ:MæÖv¦6~Ô¢‡¢üÆc'N˜:Qc«§öWü¦XôŽ…ÊÊìübÅP>¿Øø qëö]×è,ÍàátñÒÆ,¾iïê]ZZºý¡©ŸòË]Ô¡pÔ=cggåÓÈJÌ8¨t-Åf×]ô5\?vÚ™U;—ßnå£Î>ê%ææÕš»ÒZWÔí׎™ØÆ4¼âwœ´ t,Qé>RíGœc¤~ëy`áÏ—ö-»¸ÙÆtb*ðøíÀùÍ ‘[·nGË­Ï¿ÈÞ!í$_ÁNÙxGDD$$$l3K|ÂodÒÿ|wèðQ“ÃGM/ÕôzïkaÓNÉXH¼ÊÚ/–$H¾Q¬¹Œ)z–x S‚ìKß›9ž$ݸ†Ì̇…öŽF£¥¦¦~dy¸íÇo^²þ´ëºÉfñ‰p™ªK²Gdj7Ë!˜ÂSÚ0ÊÑŽ+û–ê&Y%<ãÅ*²t$D×-0x‚.±ŒŒîˆ”–€¸nûJˆÎoƒš}Uÿ†Ž '¯Ã¦p ø êÉò2Qø üvý¦IN!ª›d½ºÉŽ4ý3î¡Ñ¤Ü‡ºæB-&«tŒºôÎÕ¤Ÿ Ýúu/~fIVÑ:á/,¶½üÐÔaA¼÷ Šâ:;;·<úþã~ ¤Ò]y͆öPÝP¦²+·IÑ»@ŠãŸu¡rJµÇϹ1ŠïÅd6؆bT™?¸ ’‡1bœÔŽš)ªè9bz‘Qús\n“%A éY ¤PÜùíªýT>E[Ȕү&¬^¼xÞ2$Q9üéáóà7ðÛ~ñ.·ÚšŠ¦Áx$i'LOœøã W¾¼´ ò{ÛXÍÐÚ_VªÕ0^VXêràMkãÞÍ@ïé'º\û0Þ*§è_›'SÙtË*“Ð8‹w°ßÐ-ÅK®±y¡¡!h‘ß”J%:/[«…û¸ß"“*Ãso¼Õ‘V9EXzÑĵÎA ZÁO±™µ6^¡–Þ‘ÔÜ›²êOa#ò¡¤é_|‘ íeLFµ{°¥“ší]LJÑy/Æ6Û>>ünÄo %ýçí\NYÚÛ†©Cèôâ •â7ðÛÁ‰ß&ý%/´Î¿ÍŸý?›˜zxSI–aùšQä·ªÃvlä7iÛY’ïÁ©›‘´>¶wt6wg±rÚ ’ŽÄa,*¥Ž¨Ñ"­ñJ{I‰ÊÞ—dIžWT ³ø¾Î÷¼…MœÂ"¿øb/¡iNÖ>ÌÍŒo|¹ajkÇÈôÐÐP|‘¶œ1>1~Aû ýrqE«´˜Á{o¤­ü¦û„Áoßí[³úGz‘m2~[XXÈËË»zõ*z°¼n÷õºÛÙþ!*ý¬Œ†}Ù~ÓÒvüöIÃßÀoŸ¿µtö*šP¿õ?<~̉ß3kmkG.|"+®A~Sõ/z)Ž´’(óÄ©óô²IŸPº 3WÜ0pø°­d`Ù=€ðIÞ‡QÃ=jÝýCm”¡âs[gbÖ½¤¶þoYXb¨ÊZ¢]:êèîá)ìV½SÂÕ•Oùo® …Bijj:¨ã³º»»§§§Ÿ½ËÄÄÄwß}÷ÕW_ýû¿ÿ{TT*¡?xðáz?ØãÐxùòå‡,·Y¿é«ŽUú™9ñ´³}˜ÁoÆï7”sÐ^‡Å©Äïv¼×û͑ױ’K¬„ Ye‡í8’ÖŸN™žñˆÍ äYY¹È*'sSBÔ½jq9˜i.û²„ÇŽÙ°;–/Õm–„xq×2ÊWLuž#5[ÕvùÛ¥#˜ºåîE¯ kóï-#“Æß™Û_×~:Š™yGá{‡þ/++;~CW}FFFuuuÕ:ÐÓK—.ý×ý×Wëøío›••µ¾ò`ûÍÛÛÛÚÚZ¥R½Úm>~CLJ¡®ô  \È|WªŒœ6ü~ë0^‹¢úÔx+Ûðf—¢Ø§~3¬D`¸ì÷ømîù¼U˜¸õ÷5ƒß”]3îA42ë{[Ž¤i쬅³ôVtÁûÒ­„¦§!ÑÊ`e*{2âN»E K¼‚½Ee§­ÂÙ%ZÛP©X7ðjtFµ#9IÑ¢ýöT*í*n]p ϸpá\`ƽ þѱ=iéÂXwi |Y¿á·uÍÇ«øІ7ÅÕ O?#~ëíí›››]zúäÉ“#GŽàfûÇüG<‚½uëÖʧº¿®6 »Ð7÷¨Þ¼nl~›œœìêêêù(è˜üîw¿CûþÍ7ßüÓ?ýÓáÇÁúé³6ï7”«œãk#s´š*K÷ÀÄaC‘9M_Ï°WÔ,¬Sà‡NﺵH=¤«^Ö¿k½çIÑͺ™ö—ýè·µžƒXdZsˆ¤*¶êéÚ ,£bCµù§ª>´ØçÞ‚wÜo×Ư»'lœ3dÍo}º À+j?uêè¬XòΩ‹NîQ•Ï“¯ ls>0ã>1V¬îQh1auÏ·¿;æ/ëIH/üñÈQû˜:MësöA±õsªþ• fŒ;·)©½ÿÛÓjä·úÖq¼æ‚¢s_^ÏÚ±Âç-÷ÕB ~‹ˆˆH$[««Ù¿)úV⊘…w×ÿ:¿QÉ%Q•/ðŠ8]ßMAtõÂÇkæ7Yÿ†Šf(zquuÕjµËzÞßGƒßðÌ}ÌÔìøYû ¤aô‡˜i•ü.cŒß=z„\ÝúQÚÚÚp¿ø·û7Ëz }–ß\œrôÖ `qée&Î1rÝÔ ¯£Òê}c³ãž+z^y…œ²ô®ÒMòYÒçY|¿xEõ·ýcS¨9×Ñ×C˜ÑÇLìhÅwFP>ÝÂjõŸð›^Gò¦gN?ãÊð¤ LNšÚEVèTÿîR5°BW7s›?ÝEVÜp?"ý²ìóRìßj뉩{Ý'öO˜Y úÖ2I0=꤇ɇ.Ïâ5åÕ=·Íñë'ùÏð©TÐÇäÝ üúÇúo- _à×?å×Oðê§ä}˜¼gQРŠ~ä—VLÛfùÔÔÔô/ÿò/ÿõ_ÿå|Á­•OßñzÚyóØIׄîr,çœ#0NóãñsôŠib¬ð‚;‹×¹­Lmaœ~SR?fzÚÜ‹“mffTgŸ6÷f7Ì*Œ£þ Ý)ÊÊÊ>|833³~úëå™OÆo‰—_Y[[¸µ)WtQkbÿ´™é1Bê=UÿkQë¬\o9QÓ¤¬û¹½˜1*ï]6L ›§¸Õ…-óú)&æôE6LÑ=Ïo~ÎΨµôçÖÏ(ûV„¹ÕtW}ÿÇz”í¸ßÒ²r#/Ý]_ÖÖ÷éÕ•wð2Ž.¬Æ’G×–.E*ã7¿ÐÍñ‹‚ùþAãSYïŠîààcÒûuÝeñî"HŠ®¹„ú§j}A@÷ÖØ›øÍšè— «¢§Ñnîø®…‡‡ùûû'%%MLL<ü%ž={öûßÿ¿Ëÿçþ'úÊ¥K—ÆÇÇqÑá~‹.ýIÒô,/•1ò¯Ëú0µv9*£%XXBÏ—õbª¾Wôäº`q3«ŸUò@Ñ¿ÊÊnå·ëúÆæ¶p„õwãj¦]³šê`Ñ%FÁ ²Æ—hã^Åå4³õ Nàöp›–ÐŽó*¯%¥¡²:nã MÿKfÁ8§°?TRž6 ÄÎnºÈÇïËoý†î¹µZ3ç°y#w4¡~ZPÒÚütPê!˜îDw‰«áä6;²ƒY¶!jqç¼ox”SßÌÖ“Õ¸De³-¼cìÝ}ÏØná|kïð¨ ]ƒN'§Á–Àt YÓJ¤-7O³r!sÏ;ú“óðʵ¦§œÃâÎ;P‹'Õ;\ÿ–‘‘ÑÐÐð!çoÙoI½÷N˜8ÄwLŸ3ù ï gö»z:œ%æÆ嵸Ӳ4W1 “?¸ Z=¾aS‚*ŒI¶g·¥]ÇÄU£èKšÆ­˜²áÝ*Ÿ~n'(¡Pˆ²ý¯~õ«~øÉd–––¢»üôôôã·LPØx܆&XkšA—-[©øÑ!W1hÇkÓÞíO¨ÌÏž±ðˆæ¶ÏšýðíÅ +Wÿ³NdNýLp Ÿ ëAù\”—ý£m\8O~äôE_Y7¿¸ÝÂÁÇÚ3ÄÔ’Àn^TíaüV^YCÎVlª/ù裚UÃìm(‰¯®ïJñÉEŸ‘?  {'7:†ïŠÊPlfeeWWWWóK477ÿÇüÇú²Ì·ß~‹÷Öoõìâ>;Ï`÷˜œ`Až=²j:Rª8ï,Ì»èF-¸Í2÷Ž å[ÛÛ_ÎVô¯Ø;£U® Ã{xžñMŒ(=íD&Ëž–Âϱö ªšóö¿à­™HÈo5wð%¦_ss7ñKŸ‘Ô]w „ûpòü¢%–^,qûcs{GZ*QRlëE¢äÝ;ë²³ý{uùpãW\!IËücÕÖ„~æEôd÷aÁ¡!Ù?i´+žAþvdM/ó¼­/»}…¡) ‘TXœ?Tøœ.&«*[NúÈ“†1²0‘˜q¯HT ‹‚£ã¿w`KÛîX:0䣘´¤ÜÄW-¬±'ˆ”c˜(?ßÔ?%iØHû‡¬÷›®gEÏQK’¤ëÎñC§C’;ɪºð¤Vzñ­èôZ7j¦fìåño$é^§hšèEw|‚\ Ê뺵˜´kIX;båH—n«ýô“C‘ºkß¿®}}}(?ggg#ç£c˜ñ†ÜÜ\777$7CÎÿæ›oˆDâÏ?ÿ¼5¿!wE'›J†¥”W}{"”[=æ.Bw|ôgwKfÝkwŸˆÈªgŠîY‹S'(…OQÜB¹QDh”Zt¨Å……'½’D•Cöädy?FçD›¸Å#s²s{¹­K{Y>»â%¨Ü³9{yLÖ(fOÓØØ;2ô×>>xF£¡ë"44ë………W¿ÚþÿýßÿE'÷þáPIvll •RÑy\_ÿ]|UÐ4‹N¯üª­wpxžÖâ¬-³þR:§x”[©=vԚݶ‚Ž%AhKÉE~sr·¦Wéüæåké—ö„&Oò‘t{¸ÛY†çðÛPÁMyó ²óMž”5?t%ñ¸ÍKž¾æÓLU¾-CÚ‡)zÝÉ)­æö¬šiUÿr˜@í/Óžs ÝY¿¡ˆšÎ{É®¦Œé‚aw7kbÙK/¢»ó¢2«Ÿ¢­õ"FPrÊ{æC8ùœê«ö~\^Û’Ñ3¸hž)R…¤ÝT”7™“25Ú×aâdRæ5Üo!¬8?ù€¬qà„»@ÖvÇÚ9JySU5÷–«GeÈoŠK•'JtoZké3®þ½xûBpÑ,:8Êîig‡èjeÿ¢µÕYjÙ‹Œ[˜_¨Ÿ¯æVLF;=ÅoöVÇ}SfÜĨ©§¨ŸÉ‹?”™z ck2·eK¯ ƒ Ùnü†r)‹ÅŠ}6›þG·r‰D’ššZXXX[[ÛÙÙ‰rÈíÛ·ŸWìDùt›snaåèûM—‘0QEÿs{gzR?×ÖÕÛ*,K5„ koÙù„ú‹*ý™œÓöÞÑ Ë¾¡L¸2QçìÙo*JH=efYý‚¡È´ò‹§¨ªl<=-à Ä5cV¾LFñ=¦DyÆ™JRT]tñÉzð‘Ú°ßPy?%÷RdéÝš»u pŽœw‹d.ˆµÎ½MMMÛÿ­¢!*³ÕÄñŒL"°Sl}IžÜzNvµÝ=BdÄ©™ai²-\ÂÜi2+'7kr*d‘âøÖ~±>,­o`XÁ4+­,$y˜'±òõ KI˜ê™ÐfhÎ3EûSR$AÖH#…Ì+Ú'½©qÎd¡+‘åY¨ì›v S Ú_)û^3’ËÈ×w¼þímG#}}Ã4zêw[©.c†[ØÚbíÚÿxÓ/¬};X¿ºUúIÛxÒò5ck=ÁxÕ×ý9Õš‘µo½nltåÓV‰ZÌûßp÷îTíøî¼éóó¶¶y3JìYÿíÿ¦3Ç“pUU°”ž;®Z›=c•[v%XXD/¸#¬¿+îÆUã!‚rAçœÕrîXˆèRLÕ3t§“uÎëšê¤µ‚ÖvåcUß#¥šs]¥]Lk äÑóoãYe/ÇŸ^õá~©Nþº›ìæÅ-ñõöd¾QÞŠ·zoYqoÚOoI[§bK®ÅWOˆ[ŸÅW?FTPw?¦dœ×8£ÐeàU^Õmvù½iš½m¼ë§t<®ú±¤íŠ®ÑYÓõ¬è]Œ¯¸Sr} +IëzKÙ·"¨W3)ny*éZAׂ´}–]:Î.¿+íÁTýËÂæYy/ ìW¥óèþø¶}?­/£è}-jy¾ÖyF¿ä–¥ožÂøú6~amZŒwZñìx+ü©¼{æ¹ӜL³®s»a3~ßÄGs¿ýM-ö±UNvm~Ë”ôÌ°¤¶=÷þ8RJ£½-Ú/|Z¤ŽŽŽí‡ñ›ëß»«èêß4ÙvÔ‚Mèü¬¢eû³þcoû¿Ñ¿ÌüH›Yäëc;‹gõ OÁoªãOu+Hv-ìÈ„¨»:¾7ˆR¥&«¤]K†Nø{æ:Ý°a¥·—¾î!‹ÅÂvb!ÔÏ¿€ëvµYwÕ;I¿éªær[é…÷ßZøæ\¯¾SˆëßbN¿Áøz£šß—Iù¥R’ —’¡eÝê§KÚÅ%`§=Ì7=ßÐå°a`õÁ_ÿeý¦Å¢ø"ù º)®üV\Õ„~•ígRýÒφûÒ^LÖ>þtSؾ¤ê_‘´=ç×>v,meOÁoà7cZWÜøµ«Ñq|7Ê)[_Å^Õ¿¥\ÁŽœ³ÒNñ1Y999ÓoN_Øo,¡Œ iŒUû°³|hÜ ¤’¨8²ø®æòK/:·áq`\r Ð…È©œ$ÅJl9‘U³à7ðÛX? WÜÕ«WX¬(Wg'~ÙÞôû•ö,›œ>‡ï¾ò‚\.?È~ûRí z¿ùJºxu‚†‰p¾à<¥ *±ÀO©åeæŸ'fG¥VZ8¹Ó嶎ö6ô<¦œ9†¿¿ßÀú€8½½½ûÇó.(£îö%cŒÔP"ÉÐ9ù í×÷Û—ŠßD2o~[Ý$ògóÏ“óÔM×Y®nÃ+¨ò\/v·öçøª»üšû1*VùÌO~;0~3TÇÆÆ\ÜÜ©Ù#»·*þ³ò>ÌÜÑ•I×Ï’——~Û•ú7¡Ô!\å™[þ©J:K%Žbî~ÁG­¢4#XLf“k¸<ºô–;Á78i,(FU~¿¨øÍ ¸û÷ï{£y-ó»×õ]¡ÁªŸÃUw~kkk¿íFû)¯°;²èMSåÏÍ KjæK´Xp8Ñ[sU×w·çU„ºÜ›)RkUýKQÙ=¼¦çà7ðÛ+Ÿêâ†GÇ|cR6Ì^¾ƒ‰[ÿĉ@¡×\ P(7oÞ¿íJÿ7íÚê9xNÍÆPžuç·/áCð·Ö&²Ûê‚à7ð›‘ûííè†Ë.d¾¼ouCgØ¢Üx¬Ÿšø¯ÃÜJ&ÖžDâÛÙzñ¢Ñhëgª¿íæø…Uy÷’´kÑ0Ÿ1¬¿~¿íßð(nòñ„o0Å_X.j{.j¡è]‘t.š¦yõO¬”+ïDkžQÉ>^gÌ.xǤ…§tP’;h9#1å÷¨YCáiÝî ÕÙsf‘ ú¹áƒ³îß¿¿#[~¿ßÀo›´Üâ‚F­&†{{zø³¢ÐVD"A¡ÿ­lüåêAÝH„ÄÌ““oïì®iåéîæâêêæîéNõ¢¹û]Ý=ý ¾øPúõrÃ7t!,,,l?xÃÞÌßG·Ò嵤|» æ§Ôqì¬óŽÍ’ÜŽöÚ~ n{¿.ïèž^ÃÎzÐ>ä·mž\ðøm—¢¸ðù|¶AMTj„‡·ß);ÂùÑi[B@Du£¾t±•ñaÐÏ …ÂÌÈo¹EÎQ¤¤Rb;Q—ÚB5­¡š¶ÏL­ÄÄýw·•(i}8i½#~khl4‘SºÐ~‘¶¾_ow”ܹ½_Ø°§½8ëd˜ïÊà·OU ~¿})¿755%‰ SPxã¨öm˜ÌmÃW6´) ââânß¾½#5oÐÁimméÐÓÖÖÊã%ØÛÛ9;9}nrqF8má‹ë““££°}¿áǧµem¿º»»ÐÃÁÁ~;Ûæêâ²Í½Û°§þ~~Œ÷â·†††ââb|û·|–Áoà·]UÜòòr{{»X,f³ÙxYtt´@ @ÓÚÚšŸŸòó†ÀL­Vp8ôašÃ" è´;‰‰‰=ÚY¹½ÿSõõõøŸûR0×Íá¹ømYYYèHnsÃv|O &__>ÍÉÉ1¬µµs ~¿íAs:\ãããHhÃÃÃÏž=Ã׶˜œœÄ ¶>x×H¸~ýzYYYQQQFFFBB:é …åüžžžmÞÓ7ÒrMMMxx8Ã8ØA¿¥§§o¸§êßÐΰjÀÎ8ò[BZµ´{ÉP§jlI3ˆ%Ô?uò 36¿iòjb«'5ú|u+œëjË·›väGÞ$aËì—õÛfì×ÒÒ‚üþ†ÊÊJÚVèKKK/^¼À—4žžÆ—ÁÚm¹aú™Ø«ªªU"Œ"‘844´#»–ššJ¡P"Œ´mÈÀëO1Šÿ CŒ?÷¼?|Lâ¨ÕíÄÔ~”ÂÒ³†Â³‡·“¨ú¾C‰š3â/k´tô6*¿¡üŸYP~1 Ö“¡ôd(Üi²‹AKÿXËö–“UÛ:0ÎÒŸ½YŸ,¼éVÖÖFâ7ÃH® «f @…sÕÕÕÅÅÅ<0|æ#9y·å†oÕÀÀ€L&S‰d§zÂÔÖÖ¢HXe¬ mC[¸þD£ÿûúú’““·¶¿Ã#£õÍ M-Í­é™ÙžÞ¾N.nÛIήîÛü… ÉÁÉ9$$ÄP„1¿éC‹×/^¾zùJ—=šˆ‹§R#"Œ*­/ú[üö‹²Úwí_¶pöËá};ËËËÑM¯ÖØü^løäO?ýÏ4> •3Fâ·  „Çãdb„­ß`“ŽÊÎή¬¬ÜŽ¨oܸÁáp6´ÈÛu ~¿šŠ«ªªÒh4[Vò›Í¦1xcóÛÔÔ:naaa#F ÌÍÍÁÅìkÅiµZ‰D²5Åݽ{W&“qw”„„„ü5T|V((^2ªƒ¿¸¸888ØÖÖÖnÄ -„ËØï–C  -//ïs» í¯ª]ãÙÚ}tÜ ö8ÔÕÕíAOH€½¿Gnèú ¢àÀ(ú%žâÐÿ*• =vuu½~ý:’åêëë9òÕW_™ššÂ1àÀðòåËÈÈÈ¿ø‹¿@~ûú믻»»¡” ÀÁ`jjÊÒÒò«7œ={Ž £|Š˜››kii9|ø0òÛßþíß666BÀ±þ ££ã7¿ù³³óÂÂÂû4röø¦·Ø–«««›œœÜðîììœ*-/£°*£°ÒØRRvÉ•ñ{`›õ"™™™˜˜€lûNqï'µuõŽÑùQ—î1Š2ªÄ,¹¨é’¥ämˆ9wïàÌÏÏššš–——Cž€@SsKXj¿fH·b¸q¥,¾öqjAÕâ®ùm}Ø–™™yèС?ÿó?ÿío ¹ŒßH)½Æ¹Èu\õ£”üÊÅ]ŽßŠ‹‹ó›ßüêW¿ÂšñÙ6  Ào»í·Äœ²¹¹Ù=‹‹‹;«ü×$ÉŸýÙŸzÑ,//ƒÜü¶ë~«™ð ¦ÅÇÇóù|§T*§¦¦vÜo77·_ÿú×Èoííí 7¿íÍú§Ž>D …²ó÷–!V©THk>>>³³³%üvÖw~ýúµL&»rå þÉ ‚7¿íw¿á+geeõõõ}¨Ð ømù ×’[YYYEE ÀoÃo¸ÊtkÐgfâ+*îñ0Ào»á7Cƒ‚T*¹øí Åo(rS©TW¯^¹øí`øÍPçVTTÔÒÒ'ÀoÃo†:7$·²²2ˆÜüv0üf*–â‘È ÀoÀo¹‰Åb¨sðÛ‹ß–––ÒÒÒð)A0èêà·ýï7CƒBiiiMM ˜ ÀoÃoë;ñVUUA±ÀoñŒ¢oU5ˆ¥\Á’õ)idíE#ôÛú:7èÄ à·Oú É-Zž|è‡#üþ‡?~ÔÜ“#èD¯¯*úÞq R‹i?¡,ücêÁ]ŒßP±T.—_¿~äà·Íø-J <˜’6Ž©^GP´b(‡ô¾ê]–u/Ê{WT;½Ò*H)íZÒ{lE÷zÏò­­È»—d=¯Ñc^é ]`·avgý†{lqq1??¿³³ƒ:7¿mÚo&þ‰Éú’)*¨ž?ù]HÁsEûS¢ Û=BìW”Ð0EŠáŸ8ïš:¬ì[¢©ËÐëQéìºUÿrtV›]âNW3‹ï3å™'-ýd;è·õ# çáäøí³ü† ˜šaÌ'ÐÆÛF$¹Çæ³Ëo9<« DVjå/¡q..»ÚÊ/.¦ì.Mª1±a$ÔÞ²õ$’R´4eÖ)KRLÑàE_VtùÏ;å7èÄ ÀúÍ›`éÛèâãmjíqÁ-ä¼½Ë13zV‡mXŠ¢ $8mcéjåêó?ÿï÷þªj'ršâ2¦XM¨~˜P~Õ‘$á7ϲ…b3~3ÈM(^»v äÀvʧ‰ƒÏOÿøbþc÷°Fñ=EwYÑ»—UgCJ–÷aTš·´W¥ÅÐë²®W̤r†Bÿ'øU·ãKÇßxMó;¿-..&%%ÜØŠßø‚£nñüºGœÒ+îß3¾‰šÁåf¼§Œ×0Eå Ì ‰ EíVAëKvJ®¹W·q6&1õ°Y¯æš75êÒÏ ¥m'Ll¢+î8ÅÇVMnÓo†…ââↆ êÜØ‚ß0nN“ÝÚ‹líîÉ.‘ôaJ-&®¿ãëkÌOh[•5üäBŒ NRö-Ljì"­ ¬˜ÚyUßU–çcãC Ë»§ê˜ò¡óý¤íÛñ›¡A!33Ó0BüÀçúMWQ6€%c< ¾íɦê_·=Gï¢Ò(z*ëz‰÷AJ”¶Ï+´º×ý˜=íx!ëÁð?$ï^”t.n3~[^^‹ÅZ­äÀ–ýö1ï­{lèîûÞë«ŠO}lkåÓééi»á·/;> w˜ €ƒç7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðà7ðûÎoä4mâ°nFq”èŒ$i±„ú§N¾aà7¶FsK‹M¨€¢®SÖ ,)'$x_>ùñŠI–öîT*üÀç‚Oî=62tetèêè𵱑¬ôTgG;7#HÎ(Q(d†ðÛ¤··7<<œi4àf¿°}ºººÈäµÉ¨¿°#~£4-&&üÀ–¹ÿ~vvvÁQXX¸S?•ŸŸ_YYùüùs8Gl}±–(,x pÀøÿxBp endstream endobj 1310 0 obj << /Length 1948 /Filter /FlateDecode >> stream xÚ½XëÛ6ÿî¿BÀ}ˆŒ¬e½Åݽ´lZ$é®ý -Ñ+¡z…¤ºpþúÎpHÛÒº@¯î‹E‡3œg~´ï<:¾ózõŸÝj{¥Nái˜:»ƒ“…Nç^\Dήr>¸“hJ¦Øzf¹û_É^OMÅ×›ÀwoˆpÏ[Î$§Iä…^°þe÷fõýnõe€2ß Hxìe~æ”ÝêÃ/¾Sýã{Q‘;Oš«sâ4‡oë<¬~Zùæ _VQ‡Lò\3…YäIœ¢Ä8N½† q{×™óÝɲbnYæ^Ën×AâhNâ»Ý 8šþ0ˆŽ©fè‰Àöäh¨jÃT]ÇúŠ&mÓò0â6iyú’‹¾é›ÅÔwCÅoh&9׎ò½ÐÏÑY ¿qž:LF¼½r>è¯.Ïðãé ïÌ´Lã=°Ö3JpHM#”š¤dI%:-‚Ø‹â4DïùÎ&ç…ä»÷ëS®Cßý•+Šù+6ªIð™âÿU_!NNú`–“¾V‘–=kY_¢S/õ,B ›C8zšÐîÝ:‡ØÀ~?wõqýÌ„({. iäBÇâ†Á ÒËìΧ¦m‰³ç¼"šˆA%BÓáóÓ.Ç ~Åò-cä=©»«I¼ü°÷ÀKÕàà7ÌLÞÍÎziÏÌ”Q[s°@dÂÒM­jÆVG] ½™’ T-8«¤¾«¡ËYYÃ(ÍñØ&CaÂès˜´™0YIÇG­)8¨¹Évd×Ƀ q¼ädÂIèY†$!1t´D!€AiRGO:®ê¡Eid}”žÝ ÷i7Àèin¬‰· ßE¹«ïpdƒ]j*i¢G UT¢ÙcfOÊl2»³…-(#Eá M¿¡˜h†IÚ4ÌOÝw½=‘häXKLLŽFøÁnlŒºæ$ŠžS‚^q&©©EÚ:øRöÃ`?¨ÚÔ¨ã†K+ÄŠGŸ¾ hÅ“­Œ‹B&YÇ- m»ù¾r‚¬B%¢_% U$}æÌ+"S”w¸' C÷ÛÛOï×|×1”º¾ß!9¢œÃõ÷·ŸîïÞ¾¦É)ªÈBQ•´Bv"¹fSŠ­ª5.£‡(¡áQq¬j#òsÙNRÁ±AÂFGþ¢a†ç•†©â›kQ8`Â0¸šÀ夾V䧳—_ÐÊSÝàuJô$$ãTb¶é½ú<08Û ›Å—Òk&kí$ê2˜Hÿè'~b6MP4` Q~ž™Kw!b(òØ«–B&¢„0‹Ý·\ul„YàVæWe§‘±€%F ÏBt¬šÄH7³iզ魶;#¶d½aâD`U…u‡’L0¥+ƒf9}’ºRáÜ kÃ0úÜî_\3R C ëñ7¶iØÊbh?ÐÊPÓ^uÓvk¥FùÍvûبzÚc^{€#¶íÔ<6¢ùúuØöÚm[%8ßv =±eã(·í~ÞΗæ߸º½/q\á…`bøy€×¾½‹7FóÎÚezYVXæ{¨á½¢ò{å"¹¬YÿˆQÒpL\FÿíÅ@¥²ÿ›Þ¼ê åxÃÈ{Äf’—‡aê+Ð<Ào4õm#åÄå6ȲlîªMz>@¾yu‚GQ`ÒY×)¤Muég okb ]Ј%Iº±³#ÑñÆ!m†t\š ¨ãÿmú?à†ñM¶Ä~7×Ù´8*Ê‹ƒûË‚/Z©‹¶)éÌô¼¥ù?ÿ{¡­ëôF8Ÿ·Ø‹½ }ycg©—¼œï‚GÁË« áѬÁÍæËÄ'#ûíÝ+išŠ©{ie¬íiŒƒª¹y´@âØŸD ÷+ÁH10ïÂ’ý©¥õØ8!B XÏnä婱Oòç‘íý oÙëçÇîƒ~™E~ä>®Ðå É:“áËhMñ²î›/“Ù4I4GX‘ŠÑ Âê…’‰ÊÈÐY> stream xÚ콇_ZÙºÿÿçÜï½çÞsÎœIµ‹Š, öÞ+"*VD±‹ôfM5šjÔØ»¢`×ôI2™”IO&ÍÂþ­½ÁšdnÎïê(d¯×zùÂÍfÃþ¬g½×³Ú³!MhBšÐ„&4¡ MhBšÐ„&4¡ MhBšÐ„&4¡ MhBšÐ„&4¡ MhBšÐ„&4¡ Mh2Ö¤ÓéLõŽ­¡òîõ/1%…왪Ô(Œý¦LU^“¼/4¡”Øõë_¾|©õÊå+¦‘/_žŸŸ?Pöp}ié ¢°iäÞžîR5>|øÐ| ,äÊçÏŸ¬ïzéâEäGš‚Ú/œòäÉ_ ÝÂüœ³wPzÍpªäš ä$ÁÕxçíÛwÇ8c“˜,E/SzÍ$r'->oddø ÛÐxÂ=º CÙ›&½fì9SÕç‘3<:z0ݼÙÙY%‚]7dR³d]AYr^¥øóçå½ÖmdhÀ7.«f’¨u’ £ÏÕïb2KŸ?~p,3">U> ™€¶úVÐpµõÊAV(–FV¶*LB[å,Tp¢³§÷`ÒutdˆšXX³h RK5PæéivÿÓ§O{®ÛЀ_\6¢$4î nA0ò:–}0éjôò" º6¶µ¶0º½Ýªæ  îÉ®LWZRaí’)˜± ÐõÌ »¨¥+JW”®(]Qº¢t=0t-{ùòåWGæ÷eÊÀôèÚ~õ*J×½ kgwïW'µ÷}ªËéúõ‘Ý•ÚôèÁ,¼~ãÆÓ-éÑ£Gûh¢&F×PNCÓÙ3 ýÒkûäÉ“/^ìË-Ó£ëÀÐðÁ\ ejt==“["ZYYÙq›kkk»+ø]¥D½&_a?[?d-}íœTZZ&Þ’ÊÊÊ´Zí~û®:P²âñU±q*¬ÿýàoPnMB|œJ¥’#I¡Py>|¸¾«ñ Û­z ü~@×PÞ™4VF]]]íz"ëßµf i ÔkFjÃÀHôtÍ97O MP*•µ[Rccãú®êÕ˜ªÖðâæpžñåÐÂ3 ¢n±zÐÕ™œ’’¹žÒÓÓóòò&''÷wÜUª .ýQÒbŒò†œN‘õˆÆ?ºä¨(Þä¬,v’€¼iii¿üòËþеêªbªzëËVD”œ7:a#@u+jUÐ5¬ø¬¯€^ÒÔÜÜ| Æ]¥“º°¢³ÆhÆÅ-9µå½ÏeZ(·yÁÅ;Øí†Î,‹Ëå§+Э¬û†š˜uz”}BÍ>i\y"½~ÌÎL|Œ¼v¡Ç¤2™9ë)+++??ßé*Ÿ‚B¸§¢+.›¶pN’´ãƒ2Ë{~t ÌQÑ}¨ùyyzy³³³îÝ»·_¾kÍ<ÄTZz„\œ3:aóÏÏ_^Ñû Ü k@PHnnîVÓm=ˆzºÖ]‡ÀO=Fð+¸4kt”Èk™qËL–öΠ«-$3“½UêòòrýF¤]÷]]K;'„dɧ>ÏÙȲ«WÝ"9œ®ÀÁÎ?ËøäÕ@åÝOÝcŠÊ»ŸèJ£‚îàê¡kŠbÐ52¯á¦ñ [¦—÷¼0Ð50$gK:€t-ï~Ž¡Æ7Þ2>©ë– €\e’¤Ç@W* kæ_LW™æ“1\‹Æ–]#ò>]óZnãD@Yçâ¦+Ð5"·þº‘͹€_ xåÀ2*º¾°¥ÄFÁ褮Y€üsI’^”®(]Qº¢tEéŠÒ¥+JW”®(]Qºþ_èª?þ~‘ ku¾ã6uË&ׯ¦CéúåšÒ ·º­e´õÈN×o˜î¦5~—¶à¯a¯:JWèߧôoQB²MjÝà»Âoi×3«›yzu«h’ï"€N>³*ŸÒý¯RÃòê_o¼0iº"æ´&Ÿ^ݪ°L«“Nl‘â;ä•jV•3kHXž?•ÎßEð];„•O­Âz|—Ýê«/™ü3Ó•l”Âþa|Wø­©­”XÊË&uÿŽ+΄ËK¦ù3^WøÏ¥>ø¾+ D§ÂìèQ+[kŒƒ•µ-†à%Žëô·¶ÅïÒÿ»ÎƉMU¡yïîú3‘9£ÒoaX·ðõ×[<ÛIH<òº¤õÑØŠäO!`2¾« ç¦‡ÞÌÊÎã`mkg…Á‘’UÅ]H5ˆ˜[ü®­Å´U7ÙTRøO G~}S^ÉN¯x½î«WÊÛT¼ÿ©ka¾kíâ'/«#fÖ,lº6—€ÜìËÏa56Mt‹Û¿Í3¨]röª¥cH~Û»­Vý¥°0~5àÚõ⎗[Ëèñ]•sPBRò‘#G¬ôR[[Û»…&Ô^ë$¿tg÷á˃â±÷î˜þ-ùôÆ»º¯ž Sbà÷âƒ?qŒ…®¬‚ +,5ãÔlþÙé¼ÓšLQõ?þáW1¡ß¨˜‡ênÀX‹lÒXÙ4T{ÝpPOW/÷ãsªX™Zp|ÒG¼…?~RLŽð/ö¹ãªáOýYÛg2töÜrwv¢W 4Mç™Êiì÷¡¸Z{e”ª‘M|ëJÖ-Á4غn åZH6 •Âa eKˆÃ6¿…xbn³tôîœlj%(8)éÔ PâoËkt%;ØáC¹ù-Kyg§sN Ç°6Žo` µPÍ¢AåÌúÀäº=ƒDÌ»äl‡­s$§íü‘)ø8î‹­—Kí,µX­«»¥ø;™½w!ÙÄÚWM×4é: Ó51…aiGJo¾ (‘{j2­JjsĤr¾5 •òÄŽq´ —Iç åÄ›äÜ|œ›—£•–~ªjd H'Ó®qkÏÉ'7²ûlå¤Ô~ðò@èº)Õ¿Q܉~E=òY¨ºs1(<çNq¡'¤ùÈ(zJu³¶°ÂbqÄÔ°&O×Þ[nNŽ‘-/•Sð:^`rÂ3Mfff 'Þëâ¸âE&;É®þiì‹/dw÷vHL Žèé웚}é…¥0ì#LWÐ~eò88JZÑPï#«¨ïá÷ ùç^Œ¯Ig ô8Š¹%Æ‹óÎ×L}³Ê˜]½±öîɵ ¹‘!¦+úÅ ïXw¼vÎú‡…9ÓuŽS.‚`´N¾NÌHw$¸á(q©'ïÁ¾k kLW TÞtÅ…•wå(Y`ážÞÞN®^¤dyé0Œbv…ÈÞÊÜëNŠ)(™øúÈ¡IÓ5ÅX9‹4÷ÀŒg¡Ä1±^¸1þ">#ïæáèJñ/¸*D>¥œ^Ë)\ˆžŽ¾!ÅÝBµ®á‚;À£þJö$E Æ%Sÿê¤o Ÿ£«§«zvë[å4Tq~ÌoeaåD ùgôëÝ0#¦«5.¸|\®Ñu(/ÖÞœT©ºEFYࢠڟV´M“Ý]Iy×"ŠêÏb(é'æKZoúâI¬³Ò =]çn/‡ú:c"›$Ó¨çgãŨè~’-<±sd^|#›\ά¬´w‰Í¿x_ þ!F`ºâ#Î=—k ½ƒ$>Ûbfa‘xr¹úr»Õ¡c‘ w+;2 ʬ1~E#+¢g>TïŒ&ÞÕßØU"KznÇr©(ÐUyâVW[bHœîϪ™Ï) JNaÛ£²Öë~þ$·œ~`ö•mKž^QÂñÊáe“t%&©@›"…ÝKH<ü«7Þ>©þ®JsgqˆÌh(ízYÖtÚêg뤖K©þÅ¥]¿sDBs 笎·åÍ×`º¶”.á,‹on©G-ã­ìyHµv-Ý„±{îGRÊ9þÐ7G]L®SúN“N61B‰‰À[òsµÂÅr;_Uµ« –Þy ×Î)´²£e_xPÜ4àêêP:"{ø®¿4Üþìëb†O¾$>m¿Æáè?)%Úª¾çÅå–XV¤Ô|ˆMM²uÉ,í{#TûÈ@¹µ“?÷Ú“Š®Ç]OË.tÚ±¤—öƒF„ßó ðòãŠÎßÊz_°RBÍüJírll ;ó¸kÐÜW¶k#y—%ãï`º²&ÓòÒ±~E@4™â«-ÜóD“o«ßÉÇÒ}½Ié­ áË—©°nŒ²þ>ýmJt%â‚k—ªz—w=)ï|bã^ Þyýð€ß÷¸¤ý7^M‹Æ<åÂçÊÖ1— ‚žUÉä]\Vu^ûëaø!'^yëˆ3Ñ+éÌ3jaÇ,o—ØpC0ôN8ò1WÞhn\:àü”ìMM¨_jþlbËdèê+¨ìYÞõ¸üÚo™%ÖŽ!œö—RõDz¶ÛÅmOËÚ~­~„ÿRù‚ìR§µµã¢z.*„Œ Èæ ÅÄfГª• ËՃ]m¼RÛœÙ"Wn,]8¡§kF'B×iE–ž® ¦™…5Î+@O ‚W`PQ;B ˆ£lò¤Ð=‚Óè‰^x L_4øØÃÙ1ìÌ92d ü[Õ,<2@ö¶ÃºPvÎeÚ¸åPº¥3¤ö#…ÄÛYšã£Ê=] D3†¹Hcw­°v¤ç\¸^ti±ðÒRIç3٠·޻î;R~eßKñÄfFYЫÁÕ‚ü½iÜ+BdþÔtP@0]½¬)iÁѾ<É ð]WÓ¹ûÀBÎÙñ¼3j¹¦ŠÚ“M®í ë02@$8ùKÆJ./^ZäµÞ¨‘Á«)+?Ëš’WÔþP0ò¡êtÖÎ&ùürYs‹g|ñ0¤Ÿû®½ ù—#s ΑãܨɧŸÈ4ºŠ jœ6VØ®——Ó¬å¶LU® wÐõkZLÆwu‰,á]½L·èòÍÊÁ \dZ¨´î„ÅQ е羑.@AØÿ&—Í—7^´¶´f@H•‡jn@5ÓPqS—µ­}xa«Õß©Ej uÍÂKⱿ{”Œ·L ÚNµ.”õ½¯›y±ƒ®?ØÈÃÒž’sõH}i©´ëL Ð?¸édöOïb ð•dJ ÄZðÅCO½\±'~—kàÁFx&qÔè?ÈžæîQå>$Gû©tR-è"è$»h1¯EK}Z]xy–×öÐr]{d\1É6ÞBî…ß6ƒÃØÅ·}VNA5è4·ãt¡rf-%-*®…͘w¢ ç›%y£ŸÕªâM°ÀeMƒRã©ê,“øS:pšbz{zº|à“tb¦+‘¿þÓ5™&6«ÑüxJ[•WLŠMˆv͹¦B.•%¬µ4;’rþÿÚÖÁ“}é%Êfø ÉÙ9¾á<2€å*oALÓŒS= Éz¯“Ý£ ¨!~×o­Ï$“:„®”„†%) 盓†¦3«•¤’Íî4éìòRKR2‡XÓyþèO‡ióµÝ#[ËHÅcå,øìg?W,It»úb'¼f ã£ íªõQ³¸3@s`nt¥ö6láÊé7lÅè©ÕÎ<t¥°»•s[Öþhã®Óð ßfã¯R±þépR?T3ÕMÜÅalìBøJÍGÿ 2!þšbþlZf†c´D¦þÏj ïÖÎþâ|äožEóõw BnôÏØÙ ØßPήæ¨FÊGà±ÄL˜®’¹m+s½k™•S ~Vk[Ät?ozn2¿Å/‘ž~ÜŠš¤*½<éâŒ#'VÆä \]p!%ýrÍGOâQôYàT5]´<ô¯åÅÄ øã™qeç"™lK+|ÒÉG SVTÁΆ˜V‘yù³~†© ÜtutߘÕZW ‘#–Zc)QecóøA qöö^qRN÷û¸”h{¯˜Hn_Xˆ%³x*†þìÀ•]‡jg_û“0!õ’E(_$Áà©Áù Å5DwWç¤óN4ô2 Ї˜%»/,4iß•l!&*õ³Z›ïj Ñ¥.+K ³&±Hà\HÄxfóú_°Ø)椼ºà˜p+\XÉàJiS» !‚Óö4F¬œ$ 1–׻ƿÒç`yÜ3Y’X~Æ—îfŽ‹] ä Š—-1:¾ªµlð‡[œláয়ÕÚú®|ü¹—›-Ö¿0¹ê´wdQ2;à˜%yj[Û„Á`h©’(v¡½ƒsBímÉØž^Ø0ÁmùÅçø¥JùÓ°k),5×'.;I9#œÑ|ŽË͉•=ÕY±åñ¸~Ù§„Z¨fê]ZIµOtª“ÏéüCŽ¬Š‘¿b•ñ©i­«ˆn&GgòÒÛßʶN…èjWÙÕJZ43”ÓÄ×@EªS´VFT;õ!½BFaåž(ƒ@W´êŒÒ'™cèèÐúÇ3YÍïTóPə΀x&-– SK4únÔZñÙ^ÿ˜äPáÜŸQ ?–”×·ίl› f×”ô~„ ~üetJVfó=ø‚}KÌ,jTjxq›p™(}„ÞÉ xf »¦tøÇwÖž+:˜.åk·¿‹PBÒ=–œF‹çf_ü]>õ>†™ÊmÌA‚«ãA‰é> Üôsá¥2ãŸâ9ÅégŸ–MC™ÜÂÈò6RM¾N)(¡E‚Â’—ŒÀƒáðÚ¹±G±l-./»ú*%Œa'¬N¿pZµð•iP¸û£ßw¡˜6¬†W­#’꯯ӆ߯á ËÝUó¯ t ÀiàSúH²qp‘ÑÔGô÷«Ÿ@Ùq³dk 'B5‡¸3ðk¹fýø,£ ¾È0Nð/²…Y}½`¸  );ð)匡4áƒSÈ5gþl#¡ñï„–) +Ò·Ÿ¦Ó+D@¶ÀÀMloˆ'¯6HÍúRöy¸·«× ˆ)Ÿ2âÃE0·)¬1{Õ<$›üFÖ·ºÃjl›ÁŸØtÃô4€¥›„  ­v =¹àŠ0e(/xÐ`Ö@ %ÕFA¬×Cu0Ú‘í[Òt;wùmneÝKä+0·È¾uTêË3·üfµ¤_ q³S^ÉäÎàÛvo‰ý²ýøŸÈ«3íY­Ám¾ˆ{³#rŽNòµ°ÛB‹|c'¬d[QnÛÿÃEqù&%všîWö·nâò';a·ToƆB#¢1²Ð„{滢ÿ2ß@øÒu[k¾Ó5Úêžm Ë ý¾ÐX(]·iø¥\;ÄßÑé˜@éú¿˜®ôûLÑà»~駡tý÷)ñ5ÏS÷÷øß¡„)û®:Ñøò×üÀù^¯öÌF Åß:¥ë×Ãë­Â~˜k@½˜Ê¹õþ¬á|Ýwö‡õ]%ˆz_‘F¬tE¬^ÓÛ®®Âñܾ/ÔJ×”ƺö5Þ ÄÚ:%Ö`ÃþnJDº~}|X·%ÂíWúczàoÍجýïü[ãÒ†·ÀÇg¡*qÈ!{†(v¹;¢¨_: )Gn»{`ýKfeÚm߸mÝ$èº=ŠàÖ(Í_4Ùß¾ÓbÅü„)o 6åÒ@ªI³£?…Šž©¦?Æsš*ç¹gV•Ã‹¦aKþ2nÛ—ÇÈèºÝ<¾ˆ’ý Óݾ*U¿>StþÔ1+·Ì áu›[¯t{àï)ÖJ§ RUMjý]Ù ¤¸$ÿégLVë²\û¿wßLƒ®[‡²wJýeìÜoI šþ±ö6ÿ¤Ý×û;Ö#åa*ªÕèµðÂ~éT;²hcõ½äB•/(1±^•]µŸ@»7Êp»¬[¦÷'WÁAÃkýAõêzó½&V¯Jóõ” Q×àÀ»“ðrÍ ¾õ‹Ã'ÀM•&|ÊÍI³#WIY]ÃùêµÍoAü[ä#àÛ×ôÿê/^]7t[•l¨ÚS'™ÔmÑjUÿî¦é`‘áwÕ°ùÁ;^¿"">²¨[Òwà T8¹*ÕŸ?¥¯é;Kvà_¸w"ÖR©±Ðu»©¬çµMaÓ…¶ZŽdÝn^CTÕÁU^4µ%o½^l\~K›n$É! pL†,•‘M#Qb&ôe´ºUXC5ÙRFuKFK× 5Ô[¦J7-±+ý˜É6J¬IÔëʨ ¥³nÛzCÝZdð§®L àkö+;3ÎŽ,”.B›†ý5J ½føRä8Px¿éš-›xÆ*•PÂRÈ!)~ì“Åýúp.<Ñê‘B M Îo.‚ LÐ÷[L‡ÂðK³ë.ÓE¥½+ÒÁ{´ðDÆ©·&À -¬ÎñËï«Ñ<ó‹IŒ’þ&ŸZáÔ\¤G³(LZ|qfó¯àÁ)¾g\]É…Q¬•=…žTZ4ð:‚ÉNPý"Õè=wb³x”È4JDzdEwÕè2¼Ÿ®½Ë+"7UÜ’Z@ K +¾Æ3’'n_¼SÚÔÃòzGqÒÎ>„מi a÷hV>)8™Ëc7?@»š'?C K¡Då&(æ£s8)u¿È œ&5{T9×ki[g(›Û*%n±­ŠE¨úÚB$«€‘F O‹,ï¬Õ)‡oy‡Ä¥ÈoÄ3âÌ;xEg'~À;yÉ+áœX o9WvÖ'ŠI gÐNûk)òxâVbpéT OV|óÔM¸âƒM×éÀÍ0F.0-JxfœD-Ô×úѧÌb%4‘ÆN®Yñ׊N´ù„&zGe'ð[‚ÙÑ¢%™f-Wq’–~¡z®Î¢¾IE¼žâö~¯NAǪdøIbn19”á–Ì9_9²&U¿JÈÎMoù-#‡emaåH ‰ªY”^ët Ìàv®)´ËE'Ûý¢SAYÐ+Ø-÷@C&Ëà•ÅTv%qž±lj ·°ë .Ðèè_;óG2§ ØŒw#ü€@ Žê=<É+8%¼ä_ ¿c)41ƒžœU“PVë“vA¨^ã_»I‹åqÚÞ#Næû4nn‚|V>þÜ/*6NñL9ý1KXOHõO¥§8W_´)ª‹®Škp8¬µ·áÅê¡ß|"â㔿+f ª¶¹ðÔJ‹•/"MXñ™V¦ŠÉoLÊo¥ÔLÑÙûIW—ˆÂb•ÌÆÁ'AÖÓØCuÇ؈$óPiãY °²sŠK®Nøè‘JÍŒµ'%¦Õ § ë=I[Fa窬oÁÖÆ,Bú^.8å°ÝÃNÕi:bÍ(·c.ž´èÊËY qÙEn•eã_~Ä‘%}L·#fæ_º!ºïI”ÍIÕCÂüðÙ¬úáLiÑÅÞ—Ó!åØzòçŸÌH‰Òœæëù œ0–Ê_=b¹®E-…Ííž8zö™ì“CÉœ¼ãlj9£Pú!݇ê™(`)»â2Ó­œB8}Ÿç/ÙYÙ„ð®d7´…DǘÛà#E7•×¡ÔDŒMग़%Þ¾q¡ñ˜>û*”Sšð/œD¹ø!"ÄÛ=Š—Q?”.>A ‰I©¿£ÒZš >âÕ+-»1š¦Êû?dUWw.ÏêJj•8R4¿=çDoDbÆ#¥¨güZ_º…515Y>»<DÇZ¸¥¹ÆU”÷\º:3ÒÓ=cK2†XÕ ŽvØXå"ðm¬H ÇÈEWZ¹Àì¿ÿ'L~OÜ©v´'øqNeŸŠÍʵ2ÿ‰ÆÑȵ«i¼|[jUÕ Qç8Þ•Æéx+ºpÆÌÆ3·CÇHò· ,ͬÈR^ñö¦Ò«n+µ¿¹EËçù{°6Ö4FcñÀgùeÕÏG°ÙmPùé –æøà’朓#ñi fv~ÜWÑŒ`K¬_Dåµ¢ËK1)±ø¨:G#£ës Qvò„“gdŠ²/«öª·Ž˜tZ<•ÔH#Fñ/eÊZðÖG É­²©×!¡t·È’ÌÆQf¹ÈoiM‘ 'Ö*Z'1N>™çß"~雘(b@aŸbô¡£ýÏþå+궮Á)ÒÎìúžð¤$"ã‚tÊã…áC…üÎû4W{b6·ëwÅðuŒÍ¿Òò‘û^ž^¤!»q”U)µ³ÇGˀͭ­9f†õÉ8Á¹x3K(#x„àÂËöÓw Í =®X®‘d âæ1Ì°”5àÖ£šƒÁïþ5¿åtú ÙÁ,Bu 6 eqٶ.@×E;;«HÙK=]s³=qgê´¿ápÖ´Â;üK½+|vçZÃMxA{E×s¸ ,ú>C¶EÅGb)ù¤¹ëEq ,_õ/:aÓ.ý¡˜‚¿:_XŽ¥fWCò«gŽYº¤7=‡æ ˆp,™=HŒçxºžÍ?«)ëz œLÙÄŠdè³Ùø6¬ NÅ8û— ¬À¢©?pÏ-ò'!VbÖ]…t—$C÷ ¶‘’Û€®Ìd,&øò:]OšÙ¸ºœ[–|ØY¦˜{ãçjNÎm¯½Gn ½¬ZQ j­­ŽGÊ_‹;;­Í¨¼xg»šoáV![‚"H6$öyÌDØwoWÌ€ýýmÝ¢OIçán¯ &í_–~„p^yÏÓKW—ðlùÄg¸W®^Ž¼£:ù^“Œ?%Xü—ýµðºô5^Ë\I×ë¼Ê Z’t-º¹ØѹӀ®¬b®=½Ú@×® gw?˜®›,ì¼ó»¡X_ÌqšDqj¸?¨´ëtüipˆW´t®fê cZ¦Q,@ŠËµ‡Í¹íŸ‘vq—sð¾˜Ú©nv?éõº©·Ñ)!Î1JÐ[£Ç4]rôʤ‡Ð˜èJMPMŒÃËþÅ«9y,{ £b õ8î˜3Y‡lĨh¿“ß|ß®Áã\³.ÿG·˜üLjÁФ"˜®о± t}ãÄPŒþ†s<ÈÊ«È=Š ,™€NÜ‚äš•²ÎW€Ey%‘„Pd #9ÒdŠ[PíÈ’½y@ůe§Ïa<ˆà=°ª™OÑñ1ø1 ka]­•Spáµ7powô¡°Æ'géê–ÏovÃYšÛºÈ8'¼OñèZ ‰$º©šB¢ß:¡¹åt“ÒüDŽH%µ%&I×¼­tåÞVhÿHÊ͵<ü_–8zP^¯óµl~®óPd\„¥Ôh]+n ®u`ü8†aóâSçí<âJW]Íl½².ýÏ5LAQ±Î¤ôb|ñ§kHa÷âDTlر£VŽž¾Î^>–Gþæ«úX(–Ùy&V ÖOâÃòÎBa¾Þ®QeÕȶMñØGoo|„èÖŸÓUu ~4‰ öøÏG1^ÑŬ†áÓÕúx¤ì•¨£ÐŽU¢éjîV)_|G´° ®è“"›EƒO½Ýp¡‚A ©Ÿ?Æ3mD1‹èdöÏætü§khfžHbma‰u£Ht[ëÀâÑ€Ææ?'ö@J­a`P>µÂÌÉrŠUJ'×Ä“rô¾—·‹wêÏèjOκ¼*èÔ’ÉîG~þÁ?=^2)Ñê$£ºª&t )QËç7èú64˜îQ9¯Ò‚*Õ,-º;8Œ7μt%§]„g44Pé¹ËN^þ,㢫-5IÜ1†=+GÉÏÉ ëä›Q¥ýÃÝü0­îIíŒaTØò–N'ß‚Ž@ÙÄçdNÆGöçtõ+}¨šykö¯ÿ°v +º\1øhÓ5L0êåH•Èn@50]Í*ÈÄ%Õc+b¤â¤ge[ÓsAU*¬«±%2x]AÑ‹‡ ´¡dï]¯ýNL(¡cÿ›Ô[sR]‡J YfŽÔ’Q(4L¬X¬›*H2¾,þ$×ÜÙÙ$5=ÖÓ•+­¶uOÙAWÌœt7\äÙ º*gaÈÈ4ºÂñ¸clAÿÚ·ézCØÙg‡¥æõ­ÓõÄ;ÐH ®ºšÛze]#ø‘ÛÃÿ²qxU‰JûÊÕòÿÑUŸŠeJ[÷> +2/ù¬(ÒŸâQ\­Ç‚úƒÑa ]¯èé*i>±•®Ê›È$Ë $è¾Ëbš[:FŠ´ª¡)Øwý*]—>’m-Êzôt<örv ­Óuxƒ®ÿ:ètr¤9ã<™-¯áàSk‘>x:·K44ù×ÿD·Aª)ý0?ˆ'>°òr"å2@WPïzz6èjGºJà‘ ‚›ï&]/~”MÁ.™pð£¨ÜÞòŸö1Ê™Ûé:±…®ï"Ã}ÝŠ§‡ô#Þû:Û»O4èzÁxéZÖõœè|œR8Ì8çœÂ,{Jj•v™dsÈKú[Ýì%Þ—µô:8Ò ÚŸÃ3€€®¹™Ÿ¯ø®Ñ‘›t-y œƒ»Ã’‰å|Õ9w7»£®<á,”¿ƒ®×7éZ¨RØû `ºê3:fF¦­_¾®î€®¤ëtµÝGºv>óH, üë¿è§VÎÜ…j´/ü|Ü­ðôr Äd§Xx æ ú%ˆ£jöI®N}ö'ñ+›¨A:¡1Q4Œ'ÐU>tËÞÖ2Bp·æÔ°ðš‚=âß ÓŒ ´Ž&K5ʨ|E°q`œÿ ¡k& kDl¸ƒwUÍ/Pí˜~d`A4ô›+Î>¶þ~2#=ŠZƃ¾ « Ùè-h#ÙšYûäªnBõ7 |A•å¡ÿôQA5]Ýö<óÒûÆ›lôQPl^vßgN^´•{RÅ8¬Uus“ÅÏ–QÒÛŠ%(“M´ñ–)ênBÙùiv9ºÊe³o¸gJû>Õ^‡N<€Øùqî©MòÁiØw•¿v´[ñä-Aus†‘é"ÄŒ÷ÀEȤÈÆmAÛÆÖ™qêWпþ‚®¾›®ÃX’Þ3Ž§†oW}¹ÏÁêx`i¿rꓧãÏÙC575.G¥dDV«y*…¥Sx™ª¿U]qÂÕ d”—Ùzä UÁå§Î˜ó,¸ö¡+%÷ң䆂^¨átê7(£(ïøþìÛuº>ÄÙØ„WNÁV}¡kÇ+?Ó#˜Gž/Ù­¶·°Œ=õ[æMtJ¨Qû®e]/œBRÜ­¬ãZÞ4Þ‚j&ŸÐ¼é™ü(1ÊÕ‚Z-Y‚Àñ¬J %¡†ßà g—töw ‚Bû>(ÀÕ† û®•m³XÏŒóÏá‘“ÑûnËÐòa=]ÊîÔ]e6þRr’t YýÃ.wRW°NW ¹#U\ûª½nogî_þ©ÛÞ‰’Ó½R»¨õ6ÀßË=µåët¥î#]w‹)IJ¤›a<èÉwÿøÔÎÑŸ~¦d6—¶/¸ºì=ƒ)a±¶Öv•ãR.G,´±²õ O#û¸ûúØ“XEËò镈@¢­kpD‚’A‹ñp ª­ÕþjoóOrÞÍêö¢«“‹²_R®;™ìè_T2U‰~²I”,@,6ûèQk¯èœÜ ·Ü=l}yÓÒ‰V!ãD¤%ÐB#ípÞI¿H€÷ÕZè¨#û‚®áaÖî)×>]ÃÊZÙ\†ù1s¨|Ÿðh ë„—§…!%¯ýQJV†­“‡GhŠ+‘à\^9²"î_tw8êèE‹ˆ&xD:’¼£Ä·ä³PÙÙsÖfT†(œÅñ ;ffϾeó"ÿŽ©V.¾‹ˆðǸúø$äÓÂ#ì]}’êo× Nûùo¡¢²Á<ÆÊž-YÈVÆŠ¦×øíSD¼k3 )w%±š^ÀO¥yÿìšØÚA ¯°!õo?¹ãÃôÈÎ/–îã†÷KõK"¥E$[b<š_—¨d––bP¢'•dié™ÞöQ6|ŸBñ*Q£Y”  [Œ½pPYS§“­wREt^558Ü ë“×ñFtþ evëÇV<ïEŽÎ¦G'Ûcl©%ó íS?_Ç¡V9ûÑomaçX®‘^ýý–ìÖ5i››#%Ê?…ê.LÄ_S¨_FÄRÝ“šôt-9ÓŒÁ'ÝÈ€½‹•æo…÷õOÎŒŠá”?bæ[¦t¨ìm½ÃÉ¡Vf¶!ŠûÊ™OÉÙé6ö.ä¨L² ÎñSºŠžÏÍ‘–] ¤‡'¹Ð\¸]ŠÑ_í,ÿ‹^ò ¬¾ëD 3ýØή\ìI1à!×ÏÁ·T¤…R±G›{¥ÖU^›³2ûoÞ}ÕÔû¨¤d;W=¥ÈÛÏÏÖ56·í¥tb«”˜;FuêézŸîïeMÎÜßõ®Rõ{Îɱ̺ñ¶çRÍjÑéÑì37àç =Ë;1Æ®-h}"Fb[IÆ?_˜e×垻í}Ûä¢ÎÏHÿë5r…Ñ¢koÝ‹¹Íe“óNrÛÞ&Wu=Ì=1Ê®É9»X5ô~4g÷<ûÔ 1àäè˼Æv£¦rè·i’×ñ‡T*½¼”]?’uBSÒýÖð<ôáGà´*dÈ¥&9—žºEÁŠ¬ ·Ê/ϳk‡s›n ÆתÚoeÖ«K{ßË&—‹Ïϲë†sN/T }Òð{~ËiÉjДö½§Ñœ#D·dð† ÕÒKsìÚÁœ¦[‘gÙUÃPUÇRæ©ÒiH<ú¶èÜ—Ý8QÔþL ‡p|Ý0RÜýY¦Ñ•\œg׶¿æwßÏ:ý‹~±kuïc¸dëF9î‹Ö#ç\y)Õïæè»™,p‹:èë]åco²ê‡²NLW ®ˆ~Ï©(ìþ Ó¬VvÜήÎjÔ– ~Ö?ñYØÿ$aÃDùÕOŠ›w ^¹:¹ZÑv ¶´“3ý¯ ÎÍóG–%C²NLU­I'–yçç²ê‡Ùõc\¤ ËäµhKºÞÀìþ…­êÏ¿òL2ôkfýDÕ¼PV2ô‚sZ „Ík¾ú­ðPäÄrÉ¥Yî•'ú¥ï§E—:¤ߊ¬¹µü£™õã¼Îwõ§‚ÃÀ½‡uxœ ªpÝXQÇKÃáÑ?¸MšÌºÎù[IùvtØw†'ès nŒwíUyÛB úc¢Ž2-TÑ~7§aÐ&¯ùVõ(ü½T= õHÆ?”]½é"Ú÷½ZRdBsc» ]®q2áQÅ›;)#à8¯NjƒÐÕI{ý ú×ð:a ´ñ\<™Öð©mú0’õ·ôWÞ§cø–Ÿ´~‘ÍøZÑã+Ʊ› ùƆhúí-ë7m9¾%&9rã’ñÞ4B„ð–lj›ìë×­ë¬Û|W»¹3h[ij ÚÊ4›ÛfeÜØb£ÙÜýŽ”wÿn» nlÞva'·ÚáõgªÆõ¢¸èºýÌ‚ØY@Z½%oµÒu«Ö@Û,s«°È–%‰þ#[,¿þ&äh”» ¶P2PbKíÞ¸AɺAÊ5+)9„®;ÎÔk²ÍP¿E‰ÉuJ|!µt»Ô†½ͬv ÈQWœýójÅV.ñ…×>£1²þºþÛq`Ã}$“Ã7eÓû›ÈTã ¨Æî{p4ŽV¿! ‘õýtý7¥ÖÉ&?'ç³m(b²‹ ‘õý€ôÝËkZÀ«Yt(]w•®È¶JõjQËxi÷; p÷è Ÿ¬~_Ø¢æu¼Þ»ý±¢¸L¬VtÜÈ;_¿¹¥ë¿OóÍG†¡tý?ÒUßùúθv(]¿ßn· +A麗tݠľØðŠâb”ѳW\#ÑèÙ?6]-¤3È€WÆg Á¥Þgº^{ŠõK徬ìSÕÿv·ó›/^ìf.ïy |€N× Î‰ŒFÍ^ܾ>óÞ푼oB³ËºDº.@ÉÒ>§¦L»¶G·_5°GEöFªYÃPãk7…{˜\»V¹GRïU~#V/SSù Âοž®5‹x|¸Þ)U¤¤JòngøšÉUääʽ¸8ȱÅF5ðÀÒU¦…RU#žñ%ä½Q€”Tá“.÷âânQ>,©pô㤫rTùgǨLiìÖ;…OIìM‘UR¬o*èy©æŒ€®À`GK¢2…{T‘Ú¤½‘Ú†Sxå¾\»t…÷BŽ¼«ziœù…hô<¿6z@é /iV¯†_íÉí TüÞõë¿Ž}@•xàèªPø^Ýø^çÁ‚‘·@Uã¡+$~~¶J ÿ…÷äjö‡®Û‚9g>°t5jU·>móÒõku52mˆ®FmÆúE°ûBWcœpÙ13xéjìòJ°ïjìvkDt5vFéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥ëºîWôû®F®­¥ëÞi‹ÒÕä骯AŠÐ@aTY>eøýÜw¿üT…QÊ«ÓçIWÄn§WX㊑e¬jë+à>ú®ÂÑÏ^ e>, %6–LID”ž¯ü„àE’´Ìà‘¼ GW\ÞxöñÁŒ@(þÄi¤¦ HUrJelu›X½bt#å=/)Lc’šš& Ì­¯è}¹¾«L åµÜÀú¦Ç>”tþ^j$¹àÒ/Äh.¯í\ËöÈ@Ý"„õcµ>(ízfÚ3(ïþÝ5"_8òé Óµ¢÷)©¼¼ç…±-0ÎÅ»Îá¹bõ{£È>»@KUö¿1µºæ5/ì/]sÏ-B2ëpU¯<⊋ZïxºBuK½O²`ä£þQ¤F1”-Ó,»Eçð ÓxSÔT¡\kL€Uýo]Âóº™ïšuf> W¥œ5¦‘í0Þ¹ÜssûO×`c¢+øÆG×a”®{AWJ׿˜®ÆC @×&”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+J׃@×èszDlä ¸{:l|‘>XŸî½¸ Ðu#2ávy×ï}7ãn|‘n=f×@׉ÂBßyïÿ–°’Âê~4º~ƒº½æ¿C‰í»JÔk²iH9)ç y#xÚîÇÕBHÁ}×ÅMÃw7+žØ&¯b’MìG²Ë6‰\\£“¨u&ï»Â÷; )f·; ñÅjÝ.G3F*;d±Z÷cú®p|¿­”˜…@‰DžÐIv•«²)„êµï£Äö]Á½¤óxvND'7Š“O(½Z>øq³Ùl³¶5ß_úºÛê¶øÀúKé8u-x?>lY:±½)üš«l2¾«|| gu$Rpnd'¢5©:ûÂcñÄÚ†°.ņb›ÿ^|UÞí6 Š‡DŤ7?”l^dKmŽ ø®üÎû¾Á¡XŽHq"úxFr3ÎÞŽ­n˜î ·t%t[”ùŠc¶Å7†?¨œúåãÎÔ¨¡¦ûƒø®õrja lÆß”XÑPåÐç ;Üb±Û`û…mïZ·ãL€£¬ªB;¿Óò¥ï’ú€û® Ibd3¬ÈQ•—’ÊOFæðÉt_ŒkXFó# LÀh³€þ5 \³‰V ¸88®œY¯àˆ/ŽÔ.êCÚ®œC>>åÉk-]rªÆàB?Iµæ÷UgÃD|WP7ÇG-ÿö“O~SJUSW˜ŽÅá}s® àÖy œ Ÿ•¬Y‚ôñ¢ V·!û¼Á×Õ7…zÍ‘ƒÐÖƒ ËGñ¦y1Nÿ"™4È® Ž+¦6Ý S¢kUÇw‰)JªlŠ/® M͵³´$&5T®émØö†‰J×»i L¯¶Þ·Ô>^?¿J¥Ù:F × FnvzÝ7Øn½&軪—ãX±Ô上–„²Æv9ÑèàÃÎk}%Óº¥†ê¼n™úö]oÛµ‹¶èžÛ¤Ä:ôÖrFQòg™â:´µ×)±ÓU>øtMÍIÅ’Uó°C ;ú":&̆Êþ°:Qÿ¯Ñ¹¤8ß4)¯oE¶زóƒÑ žÁɉµKr¤8ÓºÌ*±wP9"ÑxKÿX©úCZ1ŸÀ®OŸ±!æºÂxu:$1•̹ ˜Üì,›"]ǬÿiÉìj…AϽ ö‚½­Câ©GˆI¬äJiñÞá¬Ô“¿ÈgÖ;þ&1—K ŒòË>]¥†õ"ó/Ä$x'å·TÁ–J¶¬eÀ/:Ñ;2+ãô =š è ᧴>98š[˜sõÁŒMÌwí¸ã†ÇǹwÛgáª*ês:ôOr¡Z5 )>ÕJˆó M“j`´ªaäïÒxU@Ÿ~Q× ¼ÀAQÿýÈ´LðP“« {—áöX~ïÍиD¯°tÖɪ¯ƒSô€ª\³’U­¤„ÅzG²ÓÏÜݨ&O×ØÔXô3âYx„´V²ÑÇtw¼]@•t fˆ°s!4)’”×T9¢Ówxqrë/ÑÃã˜'ïJ ȧVÒJ*ÉA‘äÈì´¦Gàjp¡L¾KÊÉ÷ Nˆ¨èc¦sUº‚B/9Ûã“D IŒ¬èn uÂÈèêà•\¦]÷ϵðÒyëã¸ìÁUIßmÑ™š*KWõǤ§c=Šz?ä·u;:¸†_J5¹`Íè…Úú;kÑþÖ¤Ô4ÕPº Ñ cë+y\7û‰ÅeÛy%0d}Ìê“n–Ç…Uc+Ân ÞÁÉŸÓ’YÓàPT6±95cŠtµ`t¬*´ë¾Óècß²'³Ü23?ÛÞ="QÒ—&8…·Ç†ñÇÄÀkyíGr!†¥)ºC]l<ÙÕZˆ§:eke\|•]ÛíK§Øû•Š' Š‹C8,6 ït†²+$*ø¨ ‰uö¾bæS˜‰àŸ‘¦f—c,q©Þ ßnjt%ð1'n!­ òðˆÃõ;nŸ"ºåòxVXïxAO†´…HÀÑʵª)pÚÛ¨„(\hQª¤3:#ÇŽ˜PØû^1y—èhGJUeÔ 'dgÙØQ2; ú©›D{ ·ävý`#ÕÖæ'§˜‘ºkI¬ %3U1Z^‡'¸G7üúåä‹iÒ•ëÎ<)XÎ@âSe?ÿË™3 U5÷âüó›3TÝAa¡¸rÁèŠdrµ@Uƒu‹«ºšZYOÀãâknÖ.} ñ!:Иi5Ã,¾Üî¸Y¨ê÷K„‡ûÚSÒY5C)…ÕÎ.f‡]Ê›ïD³Á'º¢-CÞA÷§{e\N|e@؈èªÏò‘E¼µUÄÅåÂrŽ-9½¸oU¢^½ð÷÷ŠkKP²¿™kêx lâÖÔ’ãEeg¯X[Ûg\ùj1ð²2x¬cGÃ*4Ϩ.v±Šy˜9]z)︻zb†Yábê%šÄ}7±¸xù-©ú芙þí.–Œ¿ru´Š©{$Óê긢<¬O^å(T)«:nç‘Û Ï0ÖÌ>$yfµ¿  ØG÷…{¬Ö‡­S;>æ”Ùùð*†a_KØ5‡=j›Öò¤º±ÞÌŸ~qx¼ÒiˆÅ¦ÂjÅs¦¶f`+]áú { ª<§0?î‘ßùÐÝÕ.€[®Ñƒ¥â#ÇÂ+ Á¥~GgŸ¢Þw ÷*zËJm}Q˜ácáž:°åOAt–šÙÊ«Ì:b^= ×ùø"öS쨬çHÌëxÏO~NÊÍÂx 5:éEWä~5PzÌêÅ_~›’‘äzR4¹ ªOstÏèx+W¿ ¦Ø‡U#5BÇHKúªêꎙ٤]\:Ëç¡,n°•SzEû(ÖÞŽÙüTÎC1Ñ>G2ÅâûP:ÖŸ×%=õZqs?ÆÁ/ÿÚKé„û®ú$ÙÖÉÂ*¶m9…cíLóeT0ŠRŠNîy×T×ß{?ä/PÃ(õ`iÃ-(¯Raeç^4 +)›‚ åæÇÌ™­O\pÌ3·ÅˆWŸ+­³rÉ•Ì}ð2;ä@‹ b–0JS83ËÒ±æG +,¯rꈘ|td`Ìæç#^ ¥@^F =2ÚÚ5ªth%-ƒiãì_ª…EÒÕÝ‚cÉDGŸúJ˜Ãjþ•‡õ!’ê++Å5YÉGLNrYÁ¹Œjþø¶±S@n¡æ”ídîU^Þ>‡s°óå6¬+Д*8Œ³¸á¬½G< «ùˆr¡«' kñ6º&•EÆ¥Ùú°ÅÈ÷*5Ÿ©„®:ììˆ1ÅõˆÝžfˆÎ1Õã?Ƹë]õ´\€J*Ò6ó.úàËÓk’Ì? Œ9§ã½tøžó:]AÝ—Ï@u7]¹æÖÎtåÕÖÙعÄIúìíœ]eº&êéJ´µ¦2Ê’«Ï %x6UÔÂë}ûÅìŒQÐ5¥b^wÏG_úÑαµâ ]NQŽ-§b¾k hühlM±%P¹2.ã/9uÁ+2ÛxÙÒ˾º Ú©ŒâŒ#GÃÊÕ¿“q¶ µKðwi¡Œ²âãlÁ,Ä0'$5©–àË*ç ŠŽ§°ãjʳZ©j¸ú\¥üØ·ì«/Å£Ï\lϼ©™‡å•O}ªì~-›ÊE¥Ç1yÈÈ@íõ¾^4ÆÅ'a¡$‡„QPà‘¡^«ÃÖŒöYÜ|û€òÊQ¸§&ìžu8‚IkyRU[cfëœ} ®Úàëd“o«GV¤;À˜ ]OÝæ j–r*¯©µNÔÌ+œÂô#NÑB-\wêÇDìaxd wÔÉÑ£¨ï=ü çYH8ðºztõËŸ¦JW´SBDj`¢ÒÞ%w‚%!¶Y®]‰M‰uŠ9/Ÿ3Tgþà[X“ñÖ†‘ ”'«§q®–+UGÌlÓ[áu,€ÏÙE¡–Ž¬ÒËC;ÖÅ÷ ”Rb¢éðÈÀÂ!ÞöÁC0y¦ ¯ñ‡Þë§&i½+LW¦ !Q?U7Ì’^$“V¸HεW }¯îšsÁ:øåžÎošË6ØÛ;§žùhUyñ¼•S0ïT¿‡óqrÖ`ÃåPÆ—“×r#¿þ2ÎÖ’.y\?û>)#ÚŽ’žuRËVœwÇ>‚çV­VwtÛÛ`C+úò›çS ÌlÉ—ÞË4&¸ÞUOW«¿ ®Êiɬé‹f2Ì~:.BLe%!=Þž”ÀjœÉ?5ìCvt‹SVAÊ©ßÉx 1¦*·i.>žb†O¨Ò@\I•™U´LSx^àƒñ-M@%Mkûˆ²ö¼Sã¡‘þ‡¬Iig(¦ßÐÝ\¸Ùgò»ÜS Ff¥&7«å\`×°kâs¸–fæž §áyíY];ÝÜÁ'­aŠ{Nìeæ-ÍA2õË°Hº]Peö©©d^%^ÐýN¡^$ØXÓó/q/ÜL+æZÙxdtBuããX³C^ì‹Ü–éXF²õ?œ¢GꮊNÅør³ÏÌå5ôxz\’[%¦>îª_ïÇŠÃsÓëÇÙµƒL~£3ÎCÌ(ƒ™¦+n¼bgm^ÑÃižKáä›Ûùõ}M®äIøÖ„†j,«æª+Á1J:_»ôÞÏÃÉ)ˆ›þV~íi»Ã‡ƒkž˜æëCÄúå7ͦ•Šð¸Ã‡råM¨@¥²uòMVŽqš¦¢RVŸŒlVk bWò žT‚‡7ÞƒŒ#…·ƒ^¤a©‰t.FEH4b 3³å‰ ‰Zä¸ìE£9¹û„óǤ3ÈŠ¬©Ï©ùΞdgZtRíu™~gôe+ïI%ÇV²êzHQ’ªQxEVys?5 €àIöŒ.)ê]Ù\“ir¾«||–èìAð¢<½qîdR\yîÕ×ëât2õVI…›·3Ù/´¤G¨1lß=OLĹyzÆ J†àâ>XESÙ×Oò£³OW´¶]X×ìAõq¡D¦4ÌÅfçg4ÿ ñØ«øŒLg/ogJx¼rI6³s‹œ еºûaP\PÖÛš•yîlÆ ð-9òz"ÙïE÷Í>[ |du±lìE|F0ubpFî•úYÕ×## d·^‘:Õ­#Þ>)$^¡JK¤dŽ+'<ñžYP„Y5ðeŸËT}WVy9HRã=½i‘±Â¡ÆÀ7P øWFix’gd!§ã­a½±f5GTëF¢âÉÁqò ùäû¤¬l˜ôDæ™GðZAPGF ‹vò%Õ’)•»„–-À6_X×âéããL¢Q²²¡UJFµv}ÀÙol[ÞoXS½ÕÝ„ê®#{ÖwèRÀGàó·, GÀqxýöúVÕüqxñð |ƒòpŸ9¾´¹IÁ$w‚wëoo* ßïÔf•Ô/nŠ)j6”DÚ5ýœ ¸òÆÆé4T‹h^»°yP_°æÓj}ï€T¬Û(‹õÛ¦´vC"}†ís Úºß ¸ëz­1ÈePFµ°õ|݆‘ëÕÖ[#|p Q[·€lÏDŒ\/ìºåC¦?«¥§Ä­u©Á½ÏêïZ·µ:Ôn†hPÌl{cÏ‘tÝ2°[·èõ%>RYœ¼==Ö—ïpŒ7ŠË÷ï„Õýo;awnáür§§éù®ßÅåk»¿²Sx{Ü’;a¿”ýË­º&ŠË—;^u[÷]~ÇNXêõoÕ‹?dòƒDqÙ3gÛN؉ÿÿ;awÿê~p4!@¸çtE#þU¾+¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒ¥+JW”®(]Qº¢tEéŠÒu']CŒ‰®°•]S#(]÷‚®B82J׿Š®H #¢ë¹ý¥+hú³Ï.ºž¼‹DVœ6†< F>¸Ç^¹ktÅPâÅê5åÌžH±×.ŠkD¾`øç+%UeF‹dÐ`B³%]Ù§góêê–ŒGí)(œw.§ivé ªŠÞ×ÿ²'áƒ3˜Ži»˜ü™ÎṎþ©»{Yíi‰À¨‚­ô`ÓU*€€5Ái·Epôg‚ÙàïnËËt dÆKºGî`Òµ²ÿ-|ï~»o]àöñA»^^à‚¶”X¯øÉÄg½a] /ß³ †ev]í½Êþ©NþiE­ö‘®ú˜32­Qf}Œ²ƒLW„NðÓÉO^ÍfÌÃHWãµ[` b8¢¬1ù®Æ«¶!Tò~ù®“ߌ–f,ƒ„Üw5fmuÖw5¢9‚oik\¾«Qç}¤«‘[)tÀ}WãW¥ëžØ-JW”®(]Qº¢tEéŠÒ¥+JWÓ§kÕUý¬–±g”®&FWNþŽ “‚“ª•uÜÝÈ%í·y­7v7µ^/¼²À»zsׯ¼5\Òâ¼Ã˜Ì´ƒC×°˜äÊž[å-n»Í»ºÛ÷~õFÑ•¥=ÕVÿ-”ä _ºÏþÒUoº"±Ì?¯h[Úq·Ô`·w€Û½ ®„-嵫—Ý‘Ë»¡gƒ‚] ”uK«|¬—ZŸ‹Ûní¾(öTê’ö[ɲvgr@f&[oÃ{绾xñ‚Ã)KdB‘DŸ"qJ “àìêìâ¶kÙ•hmmû·¿ý·›»çn^ö‹Lpv#{S€V‡®gÏžÝÐd±Dš˜˜ìFô ìê»=þó?ÿ GpÞSyAÆ) Fnnî¾û®&¿€ ú®_Ê Žôööì¢àRà‚t9{Ÿ¶¶_û82ðeÒjµgw Ü°[ƒ‘󗧃32ðUÁÏ;·ëv pñ×(¼×#_& ëÝß‘ӣ뎯ޯ‘”®û›L€®{½fà«t2%º‚‡Òõ¡+Ðawo¥+J×Ý¥+¨þiii»—233CCC€nmJOOg³Ù£££‡®ííí 4ÁÛÅÛbffÆd2Ô±Â)))wîÜ9ÚŽaY»—@®»¯7nüÝ»®ê`ssó¥ë©S§v]:N£Ñ€QmÕa¯ÕÖ_8~ uþ t{üøñÕ«W[w/µµµ …ÂððpÀíƒà+:::Z÷8oiiiY]]=8t}þüùùóçw÷6{zzÈdò… 6 î*’Z÷>B\^^>Ú¾xñb×- ”°[@’­Aûø{åÊ•·oßXºÞ¾}{× ¬¸¸¸°°p‡¼€­IúÖxþ_0eðLׯ_¯ªªÚßÁùB×=ú1ÀEýŽVÞ=ú  á‰D>DM÷/øUccc&/õ®ÑÌÌLYYÙA›÷4¥rÉ?¢òînzÿþ=ð îß¿¡é ëÝÝBWëïï½Ók5ö:º–——£–¹w‰Åbí ]M;}øð¥ë_F¶ý¥«‘&”®ÿ{ïG¶åù~~æÍÌš^¯×|¸Ó«§ûÞº}»ºJ^xï½÷ ¼÷Þ“xï!}b…! Þ{oå½÷$! ÞŽ H¥p¢ª@EÂù¯X¬$3ìŽ}~gïçœ@tEtEBtEtEtEBtEtEtEBtEtEtEtEv@tEtEBtEtEtEBtEtå º=²¶ìópXûóü)tåíR‹ ûG ;¢ë^™‘×·ëò½²²ò§÷ÈâSݼyÓÝݽ¹¹¹­­­³³sppðúõëOŸ>ïÝå Úîf!ÖˆˆˆÏÜÐïaöh~~Ü5&&æÉ“'È»)ž»×òòòëׯïÞ½;11ÑÝÝÝÕÕÕØؘ á+2éoµ?ˆZQQ‘••›mjj*|YXXX]] Î<22(ð.,, Øî^à¨`U`,˜”³û7:ì°RâóçÏl6;''¸J"‘zzz wS 7 ’©/^ܹs‡@hmmmii)FKá(111..Œ4ÈÍÍ´QÕü^Á}øðzëÖ­ñññÑÑÑ¡¡¡¾¾>¸Ø‹/oÏ;'##£«« ШªªêîÉM?Äæ}þüùðð0D EEE…Á` Pv÷óìÙ3{{{;;»«W¯ pg§AtÝÍåCñ„)::ÚÀÀ@\\ÜÄÄÄÇÇ( DmmmŸìíí… üslllvvöÁƒoÞ¼ÙŒS䜿»íe»vW®VVVˆ¿\Aw'==ÝÂÂâرc¿üò‹–––··7™L®««ƒ;uãÆ ÈÝ Ûr¶ê H9|÷Ž{]ÜK#l€®ÿñÿ>99I¸1×\\+½ÿ¢&ccc¨ˆiè¸?‹íòê —ûö-äDsssÛC”‘‘ááá¡©©ùŸÿùŸ'Nœ077–B‚ÿòåËeŽˆòË[®·3&JBNÒ¹„333µ]¾|r n!ꀭ¡¡áéé (†X*Ê©©)¨RÁ%^½zµ°°„á-8»9.ßÝñÍ°½}û6ä¹ÚÚÚÁÁÁ&@ÊÀ0—Þ\x¿|ùv€hÊÙÙ°ÞqÔ!6È%¬ñéÓ§wïÞA±ºwïð2ÊÎÎ΢¢"ÈÜUUUutt\]]á_𥚚È4a5È•`Û]ÁóÔ³q´µµº¹¹‘H¤ÔÔT‹UYY ^4†¢táÂ…’’’²²2ˆŠ§§§¡¶ýMG?àìÝîô­¬¥¥¥ à@ÝtœZGFFΟ?€@+44ôÎ;G§h@”ÁÜ÷K—.———C¡€tÊÅ•+WÀ%(J\\'''ø+ Adò;""ÄÒClWc...¾~ýúÑ£GÅ]¿~²?(b]]]¥¥¥‰‰‰P)CÜ+**jaa‘þvãÆ-+å-Û¾Gñž-„(puØS©TuuõÌÌLˆ[%c7\K]]Ä`±±±DÜ5??Ï/—¼¥wí|Ú‘‚·×ÖÖBhi´´´¼¼¼]ddd^^^ss3øÿðð0Ĩr!d…@ð»ås¥-½ Ávçõ———Á>~ü¸°°®uÿþ}È¡BÏÈÈ€<"=ðO¢6‡Ÿ€Ì[ögزÕ÷`†²DaêHÛØØèççgccÅ€³ûÚ¤½½nŸ³³saa!‘É|PìÒ™!ç‚Z"HØ8_õõõ…øn(ŸB„4³¢¢"£¬¬,H·™LfNNNnnn뼈ݢ¢¢–––©©©Ý´bý?~í€ÖLŽh4N‡’÷½9çú– €ê¬ººšÊQrr2Üîûöû´kêD(zëÖ­žžÀ&œp®X,Ü2™ ·*qXáêÕ«£££ÛÝxÈáxJ‹tiüÝV/zGGàNA8Pk³õöÜbØîšý!øœ››ëíí%ºÓƒ¤¤¤„……„‡‡'&&?óóó /^¼'?>>µöwg௖$¤=)YÛyøÒÒWqx!üxôèÑÝ»w¯_¿>==]__EÌÃÃCEE姟~:yò¤C6›ýÝò²'El;hÃ9C°}ïÞ½K—.A 9éÓ§O÷\¿)†‡$ %,,|ùòåû÷ïC6½!ÒþÝ‘ÿïx„qú B.C¡PlmmO:õïÿþïÊÊÊnnn|Z'&&àvß¹sn=Ô¤`ØwïÞ-,,ÀV»y'z®„„´'Ecll¬  ÀËËK^^èa``Ÿ“’’JJJ!šœœèA\ôöíÛùùyuvîäðû²Å ?AX¥­­MŒf‚”BÄAmØ\é³gÏÚÛÛ}}}Á8öïëîý€@B 71ÀÒsæëêê æŒuqqÑÑÑ9sæ °Ôßß¿¨¨ õ'¶ö !!í>ÁÄ8oЪܼyspp"IBBB,---,,|||âââ˜LfUU¤ó]BÐKÌ“à…o»wŽÿ¾'À7ˆÐàèÎÎÎÅÅÅð¢ñ½%ÆfJÃUÖjjj §†«¼î~ÓwhÏ! •Ä“PÚ×®]{ÂfddH$¸XSSSø——¿Âj°2¤!Ûeñ¨å ‰_‚Þí1ÕôôtKKKaa!0*ŸÊÊÊ.^¼XYY _Oy"##¹¹¹€_ÀÂ?·÷ïß———jJKKøÜIÏ~_É-C_¸4FбX¬©©©ïn²³>|‘'˜ˆ0Hbbbvv6˜®p !A£åää0Œêêêþþ~HÐ#HHG*âÝŽ*ÄØFÆ ÀƒÀòùóçOž™L677€ŒŒpWÞ¨-{AÀšp6›mggçèè$·Í·c1΄8%8ÿššÈ߉öO84l g×’šš ×W7;; UÀn’wÄO$$¤ïÑußßÓ!óîÝ»W¯^‰‰144<~ü¸ªªª««krrreeåÐÐÐG“““­C¼zçι@3gggÀݵk×`5` oð¹á€Þ7oÞìî±H>}úà ñð7`çpâXccc€JÈ✖––* ÛÚÚfffBðÝù"¾û µŽ"!!ý¦6„=Ô—¥¥§OONŒw´·µ47ÁÒÜÔØÔØÐPíRÕÅ‚|rvV||\€¿_bb•+—ûûzËËJkkkjk®&'%fefÌ¿Ç»ÃÊŠŠà @X,ÌÏéêèøúødggegeæä°.”—×ÕÖÀÎá-°47µ¶4÷÷÷ݺyãÍ›×|g:$$¤Ã¤éë·M­=ÂÝýI{²À®`ñ Œð Šä.ž°D8y[;{[9é[©èË«ëɨèH*jŠË«‹È¨ˆË©’üõ¬ø19“söîRJšgÅåÿõ?Nüßœ€äÔô4 ”µ5 - -,ìÝÜýÝýÂoXó›ÍÙ«kJËÌÁ»ø-0và {Ès‚®–>±…ù¹}õööŽíf+$$$D×ß¿°±Ä²qqƒ`ªSÍ_莾E¯íÝòÊú‘oiC8ëX“XÞ –7½ÖæÌ`LöZä™3…åNp>¬2&°Üq.qÒ2'±œqŒ9Žož;…чðM˜½÷œ£³Ã¯,0F±¼)ü4r¦ñXcë€Ý#º’û?kZùZ[š‡††…pÆ;a,Ҿе¼UZD:¨'$k}ýSšºÕŒ9tÅhýï=#ãt-Œ<’#ëY£ïl]‚[W°ôž—NAá¶ñôQŒ1ŽE$§[¤w2G8§7¸ _Ä:o„dQu-Mƒ‹Ò‡q>3»o˜{…W-d\m3©¥õÞ¶rvÕ¶öó.¹OgÛî]­}m¬,H$RG¡¡¡ÑÑÑ[¾I Ñué**íß¼Dúö‘Ö]ßÑû_š(«X†ye×9KÉê‘jßZŸ“Uˆ¼[0…eÔ «j«Jêøfc¹£Ïôt-Ó‡9ñ-žï3Æ0gG)a9{›ˆÒ°Âvc}EÅs éCXnGŸˆˆ€#ómzU¥Œ†±Ž™ŸOÞ€wlš„¨|À•úÞµ péNâÑ éÇÑULÚûê“Ìö—émÄò<«£6sèÚ¼Ìdˆ*˜E\[aŒ`‹º¹é’®ùÇDˆÈEÒ®cÑô|äe1­ØNŒV׫¬¢påà º:ËȆ§ctˆZ[jÄEÔC.¿Íëtb½M¯¾$qV4°c c9=75µ•¬R§ð§iƒˆ®HHHüN×vyyYM3eSbQTÑp¬ÄXíÝŠªÆQ-‹!²ú‰ƒD;êJPrœ‚#­ü² tDæžàQ8ãb&i[ò*©à‚ŒZ`Jïg¢Y`®²ªÎµÌi¢Â#e Ò‡ù\ºVUˆÊ¹¥|•sîhé©™' }]‘CË@Ë*ƒýÍONìݺ@ –5ðJâÒ5^Î.‹6þF]XÀ™>açíTù,23LΡ64-M=è …haà‰]UÝ×èÊ~¤"*á^úàºÊ{¤³¿Àsûokë©Z$ º"!!º6/16 ‰ÓîÕ¼Ÿ)¦bÕÌù~óò7Õò-£Îa$O%§SS—¨ú…¬êiY3#ÿt·œq*wôÁ]¥Ì³ˆŽbÂ*A—^å}CWwDW$$¤ÃDWê:]¥D¤ÖŸj­õ¤âеKAÕªÕ}KMNÎ<²"¾îQLQ¹´¨¢ï…§ŒQ,»®DàÄYuÛÔä.ŒÙÿPIú¬ˆ©DÝÛ¯M¦ºº¸ÈJ›º‘’îÛYhÉ&÷by_Ÿj]•ûJW-]‚®TÔ„Äç±kJõž‰cXûúÐ7Oê©m£FŽÁqœÑYÓ–.êFæçü.<¢sèGxoj¨m›ÜHÆè£+.ξŒ´îe¢M€'v•Uqºä£a`¢iÝ´DÅX]Z&VÞ%ó™µÍZ6)™ìeØ!«ÿ‘¥»§ }ŽÎF±+?Ó•W5ŒåÍbŒ¡UÞRÄ0ÜiŒÓûtOê§ÖF0Gˆ'Vøʹ³øH¢ókš3.€Øí/]eÔ¼:òo¯mNì2„ßÕ0þ=q&”Aü(܈®HHH|Ü2ðu(+‡¸n Ëý•{ÜŽ²<ôÆéêh/ªìÚš^ß|ÃA¿™j`oçAtEBBúÓZöwÁã¨Ürß‚ûôѽéŠ芄„„èJôà¢3n ¬R]‘]÷­æ\EtEBBBt=ï&@tEBB:t]‹3W·}6´q6Wڦ鯩[½‰€ûœk‹÷ìç» ]‘HìJ¼­ £á†?¥Æ‡Ü^ý4¦¬9äÂSFÏ}JSZ×2ÑK6¦¸Ù·ð cGqVë£Pf½/¥ÎŸÑ‘Ðôh™Ýó>ˆÙšÔò‰³Ã/ ÚÃ+ïQ0ÚÀbì…?r­OvmXÅmòàN%/ñqƒ‹nº¾mRRœ„´ºEÓ14QAJÜ"u7ÁŠ]‘}ËFÇâÏJëÅvâ¯`öÝRùE;d$¯å²°¸zÄ5]G1'MQó¶‚)-MÒ$™>‡ßÅJfßj©Yef·ÞQTÕó+{EÐÕÛ×Ø(ä*µû±²Ø¯–¹oK`%±ì2²˜Œm qÞD€èŠ„„t`é ûdNbžÎv’šNiœ· 2Æ0KSQÍÀá-éZxcÅ;,XTÞÀÀÎGÏÖ×ÐÑ[FTPÑ¿ŠÚq_Qå[º†ÖgÖw‰Ÿ:®`h`+ûØÚˆˆ©5ássQQËÒ!§+kss°‘ÔráÒÕÊLd º:®ÑÕ+È_Ö"ÆŸVïG½æG­÷§7„^z”Õr[QUŸ +upÑÓÛ§kC§ø‰“fiôkœ•‚òûSºW÷öÞˆ®HHH“®Œq,*ÂSPÎ(¡Ÿg€5pOUôg­‘‚Ža¥Ðú/¹XÎØ‚™¡Ñ2š”$ašDÀçÈ›Ä/_OíøœÙrWIY˯ì9sc /XèË™ê¨]…¶ÈySxË›ÃÝ¢«P‡öq ¢+Ò¡+Óa€Ù5¡$øw5»x·š¾‘µœºŒvÀàù¯udÏ(Úg“J{œ"N ™4æ_ÇÈMÓ* ÊjvîUþ’ræ¤kï)]/ôUÔSÊûýB”´MB.Ážƒ£¼„4mãJ=âiºú*:~—i£[ôÔBtEBB:lt]ïòšV;bå¤ïPõÚÖVJ÷5ƒe5Œ[y„¹DyåŒû§e‡³&ñn”ö[®a †ŽA¦>™aÕ÷©ƒ+Ô¡Õ´«ÃÖ^aFŽ$wÆpdN¾kV/eÎùCTîESç@C§P§ôÎÌÁ/h4Ò‰]¹üñùFðÎWÖÖ’~},Îì‚Ä—ø³*6>{e`•Â™Õ #!g>ÎØUbô+ñ%±2Þ ? à“2Öw‚sxpÑ é(Įԯ€]{e¶…éÏnÖôNù;wê¯gõí.¼Sëà†Ñ[«[çBtEBB:”-¦dc‘ùeAe!jÝÝFó !!ñ+]³šXc?ŽQD"ÿ]ŽíÕëZöv¡ ,i!º"!!í¨ÕUüoHt’ytyjëÛĆçÄ’Ôøç/‰ O#.Î%\{|N†wI¨¢bêbkm…芄„´³î?|â囓 |pq÷VPÑSVÛÇEIMeu8,ò*겊*¢2'Ï ý×±“ÿû/ÿòßþûÿüÿíÿùïÿãž<#(-¯ÌYS]AVV—çlŽ/ÊÂ"¯¤ª®¡D%­ Ñ i«ðuuó—3ÓÓq±±ÑQQû±DEEÆÆÄ$'%¥$'ZYZêêèèhij())þôÓßNøàã㱨»»»††Ä™ÿò/ÿ¢¬¬ìííÍ`‰ýÃÊ°"X .l¾%Õ‰o€Òššš°ì€ÆZáW@«°°ðÿú_ÿ xkbb±1H„ÍĨ}"-ìÑ i7â~O‘å\Àøù»¼¼¼ŒŒŒªªªšš¤ðÒÒÒÎ匰äûöl´³³€ ööÝ#'mmmEEEá(nnn@6â{8[ØÅÅÅx.++ ;„ðWJJ ÎÇÁÁNh áTws¬Ý jì‡ç !!í¬G]ºtéÂ6‚Ÿ9¢ÓéÈñ!.–ÚØØß(J~~~YYYEEÅEŽàÃæÀ÷—/_>wº:‹Åª¬¬ÜrµÍ"ÖLIIƒKëëë7üJ>—––æäädee{MMMåä䀷ÖÖøÃ28æ¦&ضªªêÂVyyy]]Ýòò2ò$$¤´ººº²²²ü­àááaÈÄþùgggg äÔÔÔóçÏ?}úôùógbÍåï Öyÿþ=Ð@ [íf“ÍZ\\ÌË˃è”8çŽõåË8 dî?/**233;uêD°wîÜÙáªw/^û !!!aë½V9Úü+éÙ³g·oß©­­õóóvrrb³Ù[îç»G!þÎÎÎÂNZ[[¿»áw÷933#--ÝßßxçÝÛ†Ýny¿ DEE#""àóØØÀj àöÎç¿ó"!!!mIó2ÀÒÜÜÜäädÈý!߇äwttôõë×¼[m‡²ÈóîÝ»ŒŒ Øç‹/þ”x7\ZZ‚óBÞºukçóÙ®*d`` ¸¸v”’’Â`0îß¿ÖØÎVˆ¥HHH‚ºÍLƒÜrüðððøøx äÎ%%%.\˜˜˜€´zó®~W¹€`À®ÒÒÒ=‰÷6lÞÝÝ™™™””Iúo5¯ *++ €ètz\\\hh(T7¼-«(XEBBâjsÛ Älééé'OžÜ¡•`‡Ð}Cv˜ŸŸûö-ŠF£={V@@ ++ëåË—¿»ÆABB:LÉ>BPP¢µµ522ÒÞÞÞÃÃ>455mˆN÷\蹸¸DEEq)´çüáe5¤ó–––yyyDR¿WWAxÛØØA¾»»;ÑË ì VÛnä£( éPõùóçSSSçö÷÷Cªëé驪ª ¹ÿ½{÷v½öt ÞÞ^33³™™™½=Êwííí=99ù·óæ@ò„„ ¨ªJKKûúúÀÚD'Šo ÒAévE xPP³³sZZÚÕ«W¯]»r¯^½Ú9@Ý[À‚ììì˜L&ï¬}E × D³Æìì,0‚L"ªÜó«ãÕ›7o  »rå X»¦¦&++ Âu//¯ŽŽŽÝlŽ„„tp¢SÞϯ_¿†RL¡P ‚ÒÕÕ‰‰ééé° ¾ßÐÅ}_›‰dÑÖÖ&Nà‡eÇ®¸ ÐÓÓÓƒt~ŸÚ%6ï.` öLNN†£i322šššž={öcîÒn(Á[ôˆïKKKŸ?~ðàAHHÈßþö7Hü¡8óÆüÁ…——Ÿ¹¹¹¼ãŸEîqÉd2ó+íßYmWý-..>zô"[KKËý×…3™˜˜øôéÜÇ #6ÜnD]$¤=º6h~~~rr²³³³¹¹ùòåË©©©ööö¶¶¶D‡üí(÷#Ož8âôôtZZZ||üAÌ6œ@mm­··7dî¼O»öéÜvnºÞÇÇHwñâEˆiÛÛÛáK¢ e‡ØÁ éG>gœÔ7ÊËˉY˜’’’²³³ׯ_÷îÝþY'œ——çååéð ½xÏv …dÃþ)'¹áXkܽ{·­­Éd¦¤¤cX,öýû÷;·? !!í¾¬ª««³³³³¶¶œZ[ZZ ¬Ý¹sçãÇ¿)@ú‘M@-—¢¢"b0×ÁD÷” ˆŽŽ&“ÉØ{µóýZ^^~øðáØØd(UUUpzîîîfff999`Þ]6A !)xnW¦¸Ï€ €yöìYii©´´ôO?ýõäÉ“[š6ŸÉÛ·oõôô†††xyß_§¥¥;wŽ¨³Hö½åÀ±ÂÂB11±¿ýíoqqq7oÞ„´eii ûö Ý–ãïwDºeˆòøñãÑÑQÈñ\]]CBBÒÓÓ›šš6<“:ÈHœÞüü<ƒÁpppàö¹:ø¥›—B³³³VVVyyy\Ë(Fm8 Ha˜L&T¾Ó•””°Ùlàí–³v£¦Z¤Ã¬nàÌóçÏ;::ª««!ãƒB‘’’âãã“šš:55Å_å‚>ããã$‰È¯ù±sO*ˆ˜˜î„]°;O†ðêÕ+Hv³‘‘‘¹¹¹•••àZµµµP_|·é é„©333c z{{×ÕÕMNN^¿~w¦)Œ¯ÚÐxGByxxÜ¿Ÿ¯Ã$.¸àB(Š¡¡áŒ`w†íÇïÝ»ÕôÄÄÄÀÀ@FF†²²²ŽŽÎÅ‹7Ïfƒº ñWy=2å–––ääd* »»»—8Ú<ƒ ¹7÷2ß¿ogg7¶o“üY5ãÐкº:0 ;ð“l7Ç,1Oøƒ˜L¦©©©µµuHHÈùóç¡Nß’±HH /„–——Þ¼yóäÉ“Û·ogeeIHHHJJ²X¬§OŸn˜ªŽ¯£;î_¸¨‘‘“G¦Bºá]\\MÜQÃ|Z rµ¸¸ØÛÛ õË/¿@µØÔÔûüùs¨%w˜º é;*ÆYÙÓÓ“———ŸŸ_^^^TT”””ÑÐÐ@<ÉåÓ”ÿ»Øz®4&&æñãÇØ¡{h²á*àæfffÂÍýîT±?ŸâÕ­[· ‰D¢R©.\())`ܘ;ëøçGýöÃ3y=êÝ»w“““………®®®öööéééUUU@þµ¡êaj×â-Yl6ÛÜܼ½½ýpO©Ç{ë¡6!î8ÜåCP›lpiÞ¾};33ÓÜÜ\\\ ¼…û AB}}ý½{÷xcZ„V¤=Œ[¸êëë³´´”““ ¨¨¨Â@ؤÝO>?Ü@’¬¬¬ÐÐP"S>"e‹Ù;w˜`DGG'''#˜Žl1Ù`–………üüüÈÈÈK—.aGcðéæK#tuuååå19¢Óéuvvò>ÕEqìÑq ˆEýë_544ÊÊÊž?ß¼~ýè±åcý£¤W f›››Û×yPùÔ8`¨ ¡jvss;‚®²á¹Øû÷ï_½zEéÁƒÙÙÙâââ§OŸÞnÙÑ 9¿S¾Y^^^\\œŸŸomm÷ðð°³³óññinnæö®AmDÛуJ¥ñ¾Miƒ¿^TSScffvûömÞ:è(öÜÈöâÅ‹ÎÎΞžžééé½½½ð%ñŠáÍ£iXp(øùääd__ßùóç­­­åää [!^»¼Q<ÆûáÎ;ØoŽ7¶ à'R!®›eÆnyù³³³±±±RRRÀÛ .ô÷÷C!OÛ0¡"ÂìŸ[ü·4~wwwxxx@@“ɼ|ùreeeIII[[Û†™¥Qnò] GGGÇÅÅñŽE†Ú `APo¨•Ž¸Y6áÅ‹ ÅÅÅÙVWWÓét???‰D¸ÜwsR¤¦B•744”““y‡¶¶vBBBOOÏ7^¾|¹´´´¹E·é»ñƇ Ô·ç}€…ìö› AlZZš‹‹ ñ6d½P ÿ~þü`{ýúuˆŽ Z‡‚ ‘m^^í·oߢˆh¿[o¸ý:ˆF­©©)//¯cÇŽYYY•——CºÁ{eÄ@Ððð°±±1djÈÿ8f>|(** Ù×'‘1wIÝׯ_ÏÌÌ@üoaañóÏ?{{{}x3òFFVý#v†ÚnnŽÍfCPZ__«ªªêèèØÛÛû[Û|v°6DûW¯^åõÙpO|8,,,55•xi²çnªøÍ¿BÙwrrRSSƒÈ e€Xàm­E¶Ý½ ·ª¨¨ ‘H`Ϥ¤$*•ZSSõwž" uTÞ;¯†ÌÃòԊ²·¶%lAPPPff&²êïH`7Ä´“““µµµt:=11àˆ¸xñâ§OŸÑvoXH  °¨›gšÂУ–=ULLÌÈȲç>ñãLúgii¹yâ)¤ßÁXB€…Û·owvvÒh´öövd®Ý‹Åb3¡”¿µ¼¼ ÙÁÛ·oQȺ /üˆˆE6ùã°Ý^@k}}=²Ïï¦+Ò +2ž ÑuŸÛÑÑèŠèŠèŠèŠì€èŠèŠèŠ„èŠèŠèŠ„èŠèŠèŠ„èŠèŠèŠ„èŠèŠèŠ„èŠèúc.dÇC@W~|I=ŸÒõˆ÷ø çv*> Ðû1÷ú‡õÈú1×òcîNÑùóÄ ?@óÊ?’B yëlÁE´óIHHøa£ ‚X±‚:«­µõp¶´¬ÜÂÆÁÁÙ}ÿ'W/YEÕs–¶ûzXì]Ü]Ü<l099efaíà챿Fpr“’³upµßWk»xèš,,,4#ÏÍ͹zøØ;{Ø9»ïßâêå'$.­g|ÎÁÅsÿŽWaeëøäé³Òâdbvn¿ ‹¦ž‘†®á~ÖÄܺ§·o_-öâù3 çßBvLÍÃ}\®>ˆ¿ö8v_Á9JJû;I}§ë³Ó­àœÙTƹ¨’غ'QWîçò ®îñ~"±é•²sJnnîA³sVFº_nOäÕ‡‘Wöq‰¸ü îÚÓèšG‘WìßQ¢j;e69z‡ö·µ*óŠoy»¯— KLÝcXöÙ°ì3݃bö5Å{õò…[p|Bãú0†/lþ^ ¯cZŽá·oÌ@ºBb•[PäÅhfa|oía,3‹(*+-=hvÎa1’ëî3†ƒ‘™£XØ…ÿðøƒ`ØÞžn3Ÿøü¹µsãoÃŽ`¡å¡q™û:] ÐÕ5(.¾þ!m?nÞ4–;Å—KÎ8FX-˜Å4Â2]=錌:ˆßb>µvÞœÿjî$f^Xz éšXsüNèħþ œ<Éв)Ò¡k—‰Wlî nX0oÞ ¿–5Ž6¸l,äÒ5¨x临Ž”«¤¾ -RnšÎq@­íèz@ péJZu§4Ñ•ä7kKºŸQ2!÷}Æî@×?Ñà\ºBýe[ÆwÎL,Bê––QEpŽ®Óä±5~R’6tç;Êé8h»%A0¶]÷°w/]-# R/Øá3-9˜‚E@vïA×›s3D;'¡Òqˆ—®ôáUM—¸€ü~Æ(Ÿ™ºð:¦dV6™?ƒÓµ¤¤˜×Ôáõ©_c×}ŸÌÔ–W|çÏYÅ^½§ë™šÙµZ6IÐu™GŠKsé i‹Iý\X.Ô°|f[6ÆÃÄuáB€®±‹‹‹Ëßj ËKWëèR§Ô*ÖÿÑjeë ká¦nRy¡t`` £ÞÞÞþþþÍo9üÓéªã‘×ˉcùŠ®s˜ŠméÂ4ÐÕ<ª82"b`p°{]===÷ïß?(-+FþäÔ–§|çÏ4œ®7 jÈìZ +Ÿ²qñéæ¸4Á?…®9“ع°X€Q|g[ˆg¤ ÝàÌCË'쮬£cõë—°|EÊ 'œàl¸¶ïçÕõq¸éŠ›š5ƒyÙ«ž–´ »ú<­õuZã 3mI½ÐÔ,w3‘8îSýŽÁÆíC ¦^zy¬JåÄ—\˯Ý#ø~™gež=]áz1rç}ù³zÁI/R[žGÐ %˜3p_KêŒm‚S;>q²ZÜ\`dÊÀZôűü õk¢±æ®]_g;—&Œ¼zèèŠ_cð­‘®´¨V4°"½õMÊ•^5©còçè”iŒÖ6)vJ'iHû-+¾ÅÂÖ¬ ·~G¸wa3+¨üCW"ÊénøÛ™€¬€_<‚¥^î²OnLoxè)&¤áLiMíüœXrÑ•>N+rÎ&C Ð~Ç'­Ü5±Ä9¦8¸ü6$T6–ÝtÃ'¥Ø%¾Ä9¶È¯` ¿# áùµ¤Ân?Ê5ïô Ù]©õ7¨×|2«<²šS»–¨Ûøá!£+^‡°‚‰;²ÇO›å>*¹¾–¢²FžÚù“c›>D䈟1*‹ºò0»¾Û1c ±äª}|mRûæàëÚ—øb—Ø"Ö ¤8º_†ÐªáKׄbìÖ´.ÀÅ*Ü8orS³Í7ë’K|UìÕ;áy­¾äËn åÑ×ÞÒØ[7;&ºvN¿|ETÂ4±ý#>áoõŠÈ.²§MÒ»_8x¹É©Û:'T&÷­&”Öåtx'ç;‘çXXzý¬WJ™{Ê×ø2RÕ}Ê îÒY 3Þ©eàçNÑEESàùÌ×^ie!Å×ý)WÝJ½èý™Í7}2¯x&—xÒúɃ+;´íð/] V›»%OœõìÆ 'q;3Æ°ôên›0fBã߸h¡Ójδָ¦ùø²&7ÖÝF™[zCJ7Fí|äŸQê_âWP|ƒ>Šï-«í‰z©KB™küyo&;«oöŸT~Å—Þ–Ûè“QîšR×ð’”×à^á–v5¾e‰¾ýÃâÛîÊ~®!ñ_J¶‰Qu/iÃø|ài¬qŒÚñ, ÁWXDßûü”è Pµ“âÖVdßó7˜£ÏÏê¨ÚFû3}’³d%=..N¾8g¨¥d“À¬÷KÍ”•Öô®YÈ|nç¨$ªêé›Ûº¨£«  ãåEoÉ©ÓÔвÉ쥰·}tØÚ]±œéU{ci5{ߢ9 Ç%˜ãøT`ôÏqtáSb¶i Ío³ŠIÇϪ:Äy2{²?{ûzJ«œó 4RËÔd$Œ’‡ò§V|#¤Õl=É5Ô2]=³äN{5&;ðÄYU‡”Rq‡­š¨œ™]BEXq·›•ª]VÆ0¶]šp¨Ú]±ì–IuéÓZT(éôŽKOb¬Qˆi_¸ø:Éé¸ùR›Ó—C5Díbs} ïQ;ïèé{eù3Ü#“Ô-¯¾d¿6ÖSQ1óc6ú¥¦K‰*{W¼8?tSNVTJ7Ø¿°?4=CJNQÍÈß;¯+Œ^ #©âY»È^Ý|ßîÚûHKERî\©ú md­ûe`bˆÀiMï’ˆÄ|Â=ÎJ[›0óû)ƒ¯­Ï*XÆû³|’ÉrrÊNå‹y£ïÝü\•­£}iu¾ùZNy³´1,,Bù´¤¥;¹™TÔ¢§%!gèïšv5¼¨UKE^×÷elÛ¤à`¶»âÁ6K¹Ôcje.t愨´ºŽC¤¹‡¬ÁÈÕd1›´QŒ9‰…ʉÛ$áÆL¡¦ I(Çöaço`çï`$'S uâKlÕ-êV0ƒåÍa¶RŠ±7 Ç^Ù;ië’jñÀi裫­’gNÔÏ^Nšå™ýØÑhXËkÈí÷œü$Å…%Uͼm#Ê“{pSç÷wˆ“¾¶ _H<õ‹TP>y8µqDZä˜]Vr+¼ƒ‘«¨‚Vip êîBäTÌ™Á"âÂ%­iŒ‘ÕXj„¸–ORÛ"Ô’Ée,QEǸŽe(I%—eµì¢;D»+'µ\Ž/o605<õ«¨œ¶®c´Oþ 'òYÏNR5ÏèHéKIOÞ–œÅ‰Ê¢˜…2ú)C¸) f?»z9Y¤tÐ>ÆVß ³ñ©Å îbŽ*¿hÇöÞWR‘Ñ ¨ƒ;•?õBG^J%¢+cŽ~±Ð•VÏzš7¶í£I¾owec©W†,íEN‰+jÚ„8¦´P§ð—¤Wæž=i’:‹åŒb¾±ÁÂBF Ã8+R4a)ÄAünñÌ'ÐYT5:ƒ%×Þ!áï€ZÏÃßCɯ–:†…ÇÈžKÏÁ£bÿHoiÏÄ~>a>6rfiƒ|×îºÖ œ5²]Pkh¨) ¢í_‘=Še_ʳN…k ‰2Ö ÒçðpË/ @PTBÓ&@ßÆ[ßÆW]WWNÏ3qK-¯–—:ñ“lètÁÄ+;#ëä. h࣫Ÿ¯Ql#žØöòôqÓð+ãÐ;"í®k¦æLG™zeÔÆÅI\BLJË+¡+èkºÕ΃C’ËcO:dLà>“\V U´зõÖ³ñÕ³´”õëÀíS†úB¸­E„Î4c2ÆpºÊG§vâÆ’*+uýSúðƒ&–ÖËiÙDµº®r»`á‘ÕÈJ8£B×Pç쉓ç2†YÃˤÌUó¸ô®%*Ð5ÜTǯ‚ÂÙ0(%^DBIÛÚWwio%%EÕЀIbñy !AŽ…EÅ ¢»qº*J™%Ì2G±¼é÷z² æôY@ ctÕÚH^%ù~þ8vc×õöd܇ÁWÊÚLÌ DEÎJêÄeNaé9@×”)°9æí-¤’E›Áý<€'"!«c틳ÂÖWUSKLJÀ›ZÕ¡¦$‡£BXDðäÊ{×]I±&ªÎ¥ÔQ¼ûA@ IÉ$:c £c‘ö2&iüFWˆ¦zÞ§w¾ç4Êá™w‹Ï-–4‰hX\£ëð]E´YÌ9Œ1Žú K©ºÒºü(×|)×üm¤òÉä ubg¬Óû2:?ÒF–m eäÖéj•‚Ó•ŠÓÕï¨Òÿ†Ò÷1½ý%G^å^ǘ]·”eE­3g †:º2 º ;gMà1mJy¸ €yZWõš/ùš­98¯3±é‰¶’Š[^Ró[H¢IâfÙ_éÚ±FW…£HW­àÒ™]ï‰Þ˜\ÇHñ~Ç„<³§±º†›éù_$ºÄ§ÄKi9BN .íG©÷§5‘j^e^n>vÌ2ѵȘÆTÕŠìY£küÌ:]åÏ1¸t•SM~phé:´JîýÞ½H#xË¿…e–—‹ˆIx¾É¸˜÷ ]Õi ]ƒH±¢ò:žÜ°àÀÌÖàüîÔ¦9M‰s1u©móäžy7_EÏ+]Õ€®c‡€®œBXBVœ¼aHB–7‹w¿„%šu^LÎ2ªy)»*CDÌ&ÒÏi‚®L +ùô\ÊYR íÞÆÒ.EÕ¾‹HcˆJk§‚Íg0z븺ô¯2a·KçÞÚ9Y%uºâÿŽ@.pMYãœ_å‹ÜYüF`pJÛmU% ;Ú­‚Á6ác!-XþAW'œ®lŒÞ»~ÔØÑß!¥! 5Ë'†Óö9(£À•5Š§lKaéL»Œ®ì£3ïÝGÃJ›-^ƒÞÿÂ'6¿/žéáW_@®÷N,¯5²q7ò¢&w~Îl¹nbçíËl´ð&yä>„;ΚXtòˆô(ÈÄß¾ênÿ’5z([ÖZ³s&VéefÎz6¾&^iA•O œr²â¨ç@ ¸ð4*§ÐÀ÷äÅD×Vü ãYy†ÖnúN1AUOñÝl,­fÄÒ=Pß!"øÊj뜥k€y&)?Ó&¡‹ÊéGÁ*³$UdqîBBõé|Æÿ&ÀÇ_pZ\Á¼°/®å<à^ã0Æð/ñu”ó{­ëïÚS|“ býb,'÷¼Ÿ!§ ¬F¼ßÛ(þx‘ètÝöéêa~ªÅy–JŠ1ºÞƒ*,Žõ˜#k¦£ ®›zý'X8–\!hÀ"Öç á˜}˜Ó•np­+ç3Þ7ïX;±íˆæÃ÷T‹û®¥ .½>|†ãÒCxÓ7áÜa̱uÆxoJÎÄ×7ir Š­…ø# ¸ÝÎMdŒã­Ž”m;½óûh|ðÅ Þâ vÈ™âXcxÔuVÀ7`ØoYÁÙdjíW á‡l¼›Ü=†ÖºÌH‰1Ëx2B80>²6Ç¿Zå§þ®<£,y§¼àýéë$ƒ<#a¹g¿ÎLÂímH¬¼a¶â Ï|•gÈÆQ™ÅeÓ$´Á ±Á†ùF¾þ»iŽ¯_n65ïˆîžÜYƒÛx5ïX!Þ‘°_MºJÛdäÍS—P7ì×æÛŒ*:#a·šÅ…÷ò±uVlpàÍ7bõÛYŒ¶vïMŸWù‹®hÂFW4á¥+špOéŠf DtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtEtå¥+§×4Ÿ-Lœ®ÁüG×Ü^bš_>Z fù®ÍOùΟqº^9ðt ÍÉ™à?Vàt5øSèZâÃl¼ð+¾ÍgKÅ#LÍ>2»÷3ÑUÏ+-ºz¦ì>Ÿ™ºú¦å–V>Åt5 Q߃Wì×2·_{NklèGÉìZ8˜t5 ÍqH¾Xù”ϼ·äVþ“5õùñtµ‹¯üËßOüõ¤Øßöe‘øÛIñýÙ³ØO'ÅW§a|DW%«ÿïÿüõo§öÉ&ûeê¿Ÿ‘üçÿóט+÷ò§:]aQ³Õ´‘ÐsÚERßYÖÄSBw?vî|FÁPþœoVϧƒH× Ì&¦ôÿý§ÿýÓiÉý)Îû´gXþý¸ÈO'%ó¦$]QV3:Ÿ«Ø’BKÇãjîóÕr/©á©¼™/¹ï ÑUÛ-Ñ1ùRµGüeê´ö·ÒFžá•³|»â ‚_NOXÙä~-åû²[Rù”{vxHf÷m0'åi»&¦4½à3VÔÞO¸öXLÛþÇÇ®imÏõì°ÕÑ£ëo»[å½M»Ü3ïß¾kêÃG×ÞÒøÕ±·y™ìwsËWýîf«Ã@×Y±Ù¿ñíßV4Ö¶ZÝy«ƒ»rÞÏÈsíøð‡qŒ>Äy=î¶Þˆ¿³xý]Æ»1Æ}3/±ùÑŒ]7¼È•Ææ¼”|xýMÍ›ÍB¼I“½þâò]ãš:¸²›tXc×õ׳®»ô>¢¬AÙ² [¹9}tí-Ò»tiÎVø¥¿ôC»~[•C¥¸F£nSðéÿŰCV6Çp }÷^ð–¬ÖûF¦zg„…„Îœ–R³‰îÂXÛ0¸Æ[ܪ‘¬ú¨ú—ô5“®n5­òÚìà“—<°9 =2tøìzöøq!!a!Á3gNŸ•×wó­x‘3‚ö[2¬s`K¯› )è#÷¯|c´ÁÕmL¿3xü^û‚ñí :"te Í( ‚•…ÎœüUPL^Ç5#¶m•9¼É\ëÖ¦c‰Tj`Å3¸ƒ;fß¼ýêÄ,"“×üñˆ´ PûÏ™êž={VXHDðÌñ3¢*᤺7œz| ŒßFž¸•*'‚‹'(ì-«¡Í)þ>ðÑ/­6¡ãmð;•×A§kÛ} UûòÇP¾rg0J󌑱ÆÙãra-Du†ZÎîúÙõ/àƒx}Mœ·¶rv+œ$÷|â\ûJv÷‡ÌÎÙ}_¨k¦ÀÉLí_ÊêúÕý‘Ê)´¾JBJa_¨}KÛ•÷COWïp?uÿ‹Ì),w c±?¸ù{œýÿ²+zÅÁ#+ÚÐ ¹g·dïçñ`ê%RÓÄ##­í=g…Urïbfç|Vϧõp—Xm9»{!³kŒS2‹O6Æ&Ž9“”ÞOÔM}(éšÃž‘9v©+¾ŽåÍbÙõlq1E»ˆ–êš¹¾dá.½@î_3 sbÙJá´UÆuð Çç‰Ö}~p­€Sú>q\úîÞƒ+”§†rRŸQ–wŽÍ ]?šêšFV1€Ó½ç±•©€€ éÚ<Ø!+ÖQ@d^”žyïèŒsae™Ž»âŽŠ{ø'·"Únð¬®E@VÈ-·µµ¯ÞË^ÛŠcWMU›‚[t0\È(–7úÊLCDÞ†IŸÀ˜Ï}ã³õíü MrÛiKä\)Y5K_Û„êÐJHFŽ¡C±S ±GftýÂhÙí\Bb ì|õ¬}œ3{³;߸… Ÿ‘ÔóJô-œ¢ÑØÕ;ÂOÍ«(›˜û—åMc>Þvg%ÍSú Yø‘Seâàoäfätᬓv…­­«.£ff♚2ˆ%•_3s 6vÖ·%ùÎÒˆ`lðKP:ÓÐÖSÏÒÝ<ìBJïjý¼Œ„¤ª¥Ÿ]lEöð‘‹] ºÚU/åŽpì3‚1‡ÞhHUd÷cô¾ž1†Ž†v¾ç‚ ãÛ–˜Ã+)iâÂÊf>®ä6ÊÀ+Ÿ¸,=»ðy³€¼¤öE¢}&£aÎÞ'DÏÖ_ß.È+šÚýÆÁÛEDPJÛŽZýèð·»®ÓÕ(´,›htÆrFßÛ˜ªHX²¦ à|œÁ2°ÇýÓÈ33úÚ+ú(–Hf*ª©ÊkÙX¦µA©`”;ú9ø8'†\zÁà¼9…ÞûÈ=2YßÚK×ÆÏ!©9‹½$&&§mì\x‹5Êϱ+—®œ,oSÇ2óCDÍ“G0¿P?Qy»€bvìÅA+ 9‡|0HVã ¦†ºMVgrÃãh:E^ÓÎ'§'¦²ßÙ?@Á">¥{\ÑÃßQÞ($¤lˆÄª’ZU,|RÑïòíôöwG´Ýu®ÅktÄS˼¦‹ÇE}¯¼M)¹")¡îHn‰¹4îF’TwLlÿHé~îâë¨nŸ}ùVfC¯Š¢ŠeÌ¥èKcAYyòJÚ—ÞÀÍJÊË“4òÊï‹*ïÖQQ°/%w«)*Y§·§4<¦½v×5º^þ’»öb¼ M –3‰ÊèÃüÃ<ÅämJFc*- eåmÉÀ Jc‡´€°E|sfÇc¯ _qçÀ"vle¿¥¹ž¢K)þ¼ ÷©¥õ9]¿üðòÁ€ š”¬n@õã”2–¨°ŠwþX$hGŒ®DÂNÃR ÒNÿª7†EggʪÛà(¸8èäë«`™’Ñ¿œÕtÓÊÞD߇ß6ŸYY*%¥áL뉽4â$¦lÑŒ±Æ1/_[Q— ²¡ÈÜ2±ã¿˜&¥^jPÕò8ß—ÜößÛ]¿Òu“lƒ³U‰œU ©}¨­"fy~áü ,ï:–ÓÝ'vR)|˼g §çQvÉ^°ÒS°HnÎ!ZÚî«)øWÞ§±ŸkHžu,} õ½š|í^JÛ'FÛ5‘ªÑCs-#8ât]{?6-õË)û¢û>îJA­ÉæÎbçg^é©j9—=d òÐõÈ£ c!Ár&~™ãx¶›;…9{8‡_aÝÄlUO¨FtäNàíá™-êž³ØwµÕÔ]‹ï-;˜úЕ{–£4€ŒžGê"ÿ0/Y)¾…Û9 WJP5¼yùüØuYAa'æMFÛ- %qÛâ÷…s¸Ï3Z;ÅN©G²±ÌªU£è†·œ6Æ/ÉuÒzVYm5Âõìí©^ºÒ8yAÆÕ«"¿ ù¶,Ù˜i˜§t²¦qÿ¤v\WU4 ÄÍ|võ±3‹º–s sÖU ¬.¸‰¯P0µ¨%+g›:Àd?Wù‡QÞGÜÙ+Éuw“šßgµL¨(†6½¢ï‰!ßÅ®`±¬ ÉB"ƤšëêJ’*JšŠš†ŠšºBÇŽÛÕ`ì»úºzî¥wÏ5%DÅäÕ8¿(¨i‹Š:Þ ÷Hž‘ôkXýJ›aŒÞR'rB%zcð¶~áØoÐÆòº…Ž yT8'' ìY³Ì‰0JïÇìþœ®'U9tݲoçQjwX )™“Xt´×i1ýøöON®¶jmäž`ÉLŽ%9ý>t¥°1k…s!IݾBçrï¥5oî“žÐ/úã¹ãXž:ð%«{‘9ÈC×µ‡¹G·Ý•Š?ƒþ`k®¡å]Fé¿){üg›ŠÏô¾âá ¹Œ•?ꪎŸBúA{îÈb@\Äé»—=Íz­¯¥¬âu9ÿVx £Ö÷Y†_¡ŒbÌþ;zZšî—ÞœŸÅ<=• N:@ï{îS‘Ôþ‰Æ^2Ö1ŒîʹŽ¿uÔÞÝË>¥—ÖÑ ô‹|ì4V0¹ö¬ðhöЬʳÀ2ƒÅå_eÎ`žjbIäi¬ø–’¨ã@§?ÒRVv©xQ4·SãCLWé_;·`ewp¿ÍzíBÓð¯|ÂÇL4ÕüjsÀÛocÔšVÛèÊô>¬`xZú¬Sþ£’©÷ZJêþu¸ÏßÄÈõ}V‘uÔ1ŒÜ8¢¦,ç|þÙù›kø•S€_õsfëe1!͘N,ob'´2ºšÅTçÜÄ=0 KO=#éZò5øÁÙÕJÉ™?‹w'pˆ¹”Þû™:ðÉÅËÒ4®±ðf"¦–5o›7òÖ)‚~u5úQWI@Ù£:÷V4ûÅÎÍË"¦Ü>­,§Öó±`j½78¿Æ®÷tu”D4UtL5´%¥¥…ÄÔÁ\ø@:ŸUY!-&&£ko`ã"%)®Ñ —Þ···”ÖÑ÷¦¦ÔOéjÉJkÙ9yÉIIiû–fâ›[$&"ªld§¬"+&mÖ‚§«Ê¢§EÕìÒÛiÃG5vò9+ ¡¤c¢¤m(#''"*mÛéî?m³º:ZâJú†NÊ*òr&1i]Ÿiìå2EøŒ˜š™[T㼋‹¡ˆŒ¶S ª²‚¬žOtëܦìÖ91iucum a)ÇâW3­ÏJé{¥§÷Á§ZSRÇþKTÕXU×DQMCBZFB^Ûãü=Ü¥ÙXZEµ¸¨’±³¾¥””¸žßeê(aÑPZP@JË*º2¡¸JFBœãóÎ’â↱‚ÑØ«‰©’R’JFŽJ ’rqÉ_Xì[ Çÿ!¡jê‘7{4zd-ë) ŠË‚+kéJHɈH¨ÛQ8\ͬíÖR——Ò´1rô‘•’Ô ¬ÈX¦ |ñ% ˆ«º{_èÈJ©š:x+ÈIÈD§pð˜^r^X@X^×BESEH@5¸q‰ÖõÐÐ@CTA"4ÖÄNguÀéJé[Œ. ÊéÀ—ÜÎÐ’‰ôž/ÄX- §aÚõ4,¿=€ÕUýˆÊ^¥ ¬p˜ü¾ -»N…ÒÝù*¼°3ÕQu‡¼öˆv…Æ^Io¸’Ó\ÀNëÅlÜ÷R¯NçvÄÔ<£±æX­•”ºÙ VaíÂÁĦw` Ü99¹cðCtIo³-¬t:«™34`•Ú7]Ö˜7Ñ{øW1Èj )KïY&ö‰ßÄ®—¤‚ÎÀœž„æü†°ìö‡¡pƒJg(ƒGŽ®ôÁ÷¤ÜΠÜÂΤ²©ô^ü‘áÒ`prû£°¼ö@V{Ô•§´1Œã®¥ýN«5¢ò6>wuB¹öáMП·¥Ô–¹6÷Sû-‰rö h…¬K­–B<¹az‹¦.$Ók¢M!º Òh«­¬i½‰ZSÈzh"ªß×ÕÈžêÐv´ê‹º>  ò£/Á¡±å­·÷X¶è .d…ǦÑý0%õñGˆW 3tÍÖ>Ç\<7Ü@*/="fÖÕ¿2Qº*¢KÚÚîbOØæ%Ä!˜²ûtå <µ¤³øáE ;î‘̦ˆâFc” <º¤ÙÆ'N8¾‚!ºz%•¸DfYŒ¢6«9¢Ø(RÇUùÚžÀ켃ºNª|S9Á9#Eˆçhv›‘J&PÊ<âŠ#oL“®‘Å-ÝI1¥mFŠÞè’V£ÔZ1жù[§ÀÆ»M׺k¯=ã‹¿°ñØïHÄ”¹œÂ²µ°BWñ”*±ªë¿¾:~¹1Ùo”bÑ’8ÿÍÒI0úħ‰ÓU2 äZAŒ{PRø?m܃rDà,L® €‹;nýÇ ‚Á§ÿ-p£ ûÎ×%"G±ðzü(\Þà²Y[ò(×hŒõ»ú¦Uæ·)A€!¥³ÈÑ{ˆGlýÄ Lô fÕñ†žc.žesHÅù‡4¾iö €ÛêÐY$³¥e{‚#¦Â1{d̶¤†cà˜8fÒŽÈ‚t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t…t5uºNêö Wé- ~sR%‚tÝQºŠôwÖÓ—zê³Im†t]‹[=‘µ»m~.Í®“X±)¶!]·F£tQÜ@Љ7ù¼ÞVŒ6dTï1ºi;È?Õ–µÛn~œÛæJWíþ­“èþ˜ ž5R+õW¶‘zR»9ïÇ76ð-Mþ ©ÍŒ®:%ÑÓŸÛ&¤·È¥ýâô§w 5\;ÓZà˜7]58k}V(ô„–ÝÝuÃÞÇžÓŸÎñL—®š_N|ìEnÌ›@À9yà=‚à ZË®¢ˆ<5õ‰sÏÝç½þ+Wµ¶C?2ŽÝÍèr‰=CW-ZÁßvÛùàˆHœ³§ƒ«o"'¿ó`¬hBµM<#õƒÏ*/<þéàÔ|K<þºøèÍúéOHm®;nKÇŸgrê<}öNnxOR³£jhU6kžZhL#µgg*.¿üó2΂Á½EfŸ»®ñSª|O¯o%:¸xâ]ý‚2¥ì¾×jÀà§F[þ•§œ‹¿ü…ävRËŠâ“÷EÊ°‰ç® ØꇉN·´ö¦¹Ãëÿµúôàncï–ћשé]¥sª¤”lÚÉRåÆ –rýÆAïX«¹d©¬«±uc‹—µùÕÞê@¥ø@¯ã[î;Q~¹úòSn߃dZªõÁ¯"%OÕ×2¢è*•ŸŒÌ•Õo”K©w±å[€¢K38›ØšED2õ1©Í®êØSÌþBôÂYYhGîÕôÿVÝuàniã™Äèû Ob †·T?›XÑmP[uÖP?å/JN‡f(„³æMWÕš\RÉÑ–¶‡Ó$ÓÜËϪÎ.…E†´ó,ê{)ÙN¢ÉÕòsÍÉ+ᇣŠim‹â‰÷y¢nú‰»ù²sé5§2å¼Ñ‰r¥@|"³íÀÓˆðÜ` o°¶ÿ§˜˜[§8ŠàlùèÇ2“¥+úƒ•o’Hö…=¢õŽA•höÈ­¸ #òvÞ_»— ='òYU°ß~»˜qÁ™ó.NŽÄ\INó4ÿÒ¬‡§½{9¹¦›Æ:âã…3ÑA‹`öMù<ªXyMº­_AEû\0ÉÛCm¹V3¶×芈g6;õ7¥²U¬{n¨Dš''ìö}Õü¸edoo ú(P:ä3ã¾t‘K'…EQºžáM¼NI²·q‰dµf ;}½RäµóHA&Ίآ¸©ÎÎt8hGkxHcP-¿õJ÷–^z©½qÛ=’+‹^žŽÁ¥Jù "\Ód,a7µzèƒàD“…gÁé÷h;ƒÄ† bNU=jkií—.¤Ÿº-ê~ó­OhFrí™tv¥­•]\ó3Ùà”‹‹ýô´EO¾N¤Æá";kOGœ‰4jË, «ç®à}é"’÷Ý÷$±ø†^O×,Âï:aõÏoiçÎÙâü+®¢ ÙäïáѧäÚÎK~D/ϨŒ¶›¢ñ—>žßà|2“*;²øMžnö!Œ3Ò™?/ð©ó A:W'NüÂ:ž×ÿ$"*ØC©íªtݶ[Û„é þþèh]3(Òò^?p¶:trUÑ%Úoí_±FWRˆCòLÛÒÏé§~RÌ"µg½ð1 wó€ŠÒs3#j„S)ÈžT±$SÓµBë@dÔN!ÔÜ8[· Ù=piSí©ž48çôø`çF͸~O,Òp ¶û»'k®uüº‹«c’ä1(|¸°4íÛÃÍM·WsKóü©­ècÄÉ—©‰n”ãàòZyüTrõma®»]Ø1-]ÏöZÛºät"¼ö‹ýQµwéžêP"üî)WÇïÚ^H•ˆþ³ÂªçpN¤ò«oíG¾ÃéÝZº&ĺ„–Î]z€?h¬xаˆH{ä_[%ÿ­é&zshç]R7ºèéÈèùEM×7)ÙdÇèÉ<’WJñ£‘\ÿÄã0¬ç®š@ ·ÿÒ“~}L0¹.¸h`ÙÉòo!ŠòË—\Ã9ýºþ;*‘äšÖ/]P‘³âÃØ} a^{åçmTÐ%šCó‡rï›Å}ègéJ½¤Fé*£î·' ç£w¸\²¨A+özÔý;ØÅ&ªº_ýz½Jt펣¥EJ‚ÒÕJŸ®¶€®-7~ðó'{2öÚ‹Ón^ÁŒóOAƒÜž^^eY? èŠÛ@×@¡dÇغ–jú]÷TêN玭`Aƒvy%Ðæ¼ËZÇ Ðuy%‹•íGi¨¿n<_&¥øDT ¡]ýS*îé ¼Kþ…߶Ò5»©>&³ØÁ½ .dÛŽî0Ëܵ¶Géæt(®é™†®¢µƒÊcgqÎáZº:l¦këõÛxKëDÉ-ùuDÚ-ÝoéW6¬á-[@²3¨6®Áœ«·¼¼‰éÚ ¾žÃL%[4ý®fÜ3 ¡k¤ã>¼>ô†trí9µößÄü{X³J~É]%³ïS3bC™½à~Vxí%ÁÏ1–wS‚>^D¸=—<¢+~3@×Y$½ w¸¤~NoPæz¦ÞRâÝ}2Õ«ÇNh;–gºv¥¥Oñ";%Ôå®2=º7Ð5´èü3 ­°¬Ên ]Ëks¶ÐUµÝ93¥+ª*‡—kã–PzéíºÔJ¤q¤ßfßÄO›‡çQºJ×èÊ6@×d”®Ã:º:;¸äŸWÓ•¤£ëÙuº~QƒÒu»‘uæIWéà]__·€ü+Ò]Hƒ÷WŠøe8ÿÜšá•Ítv6H×òDG×C®A(]}ˆE(]U’É×)Ùi[éú‘áCا«JzaP]*êСhš–Ì Üã–_Úæ#’s}€®ºN|„®KB”®—Ü£9ýè*¦›]5OôÊ;„Îl]Í »€´_0p?ÿ7J‡ì&";-ùæÀaö0ZŠ©_|]¿Á§¨sWÒñsãÚ3àéh×týÀüJ6Í)‚[?…„…àBÙ3ŠEth\%Ô1” èJtuaË|,Û7ßñ®ˆhtÉc©WK}ÿžãmí•UÞtÅÇ‹i¶c#§í÷týÉÌ"P[A@J¦^¦$âÝÓƒ+ÙÂ9væ{\ ëê›"†·-Q&¿ƒÀVI…Öv®jºJ-¾ãßCäÓÛŒ¬3Ïñ®ˆl^•[Ì°´ wþ(ÖŒÌ\@¸gfž¸Ö…ºI¤¾ë„5ÎÞó\ú³¿ð–aœ…ÖëË­“š–5=ÖÉ'_4-¡ÛdÄFí¼Yõ×–{ùäŸ}.Ÿ¹ëËØļš®ÙÅÉj›tñ#3±?Þ}FP{a÷uTí‚pZ „ëHýпHþöø„S ¥‹Î_Æ;K†ßƒö+{êéšÚ/}ŸB‹"•öÉo tE{ {Ä ¸Š•Iªñ„,Þè›À—äá¦;Hã-$B´p¦jéêÅ–€êøè dÓ¦+"•‘Ÿió½'!.7<ƒ––íâ`ç+¬~r¡†Ù‡îV_x’ôÖË1”\¼Ã>\üdëòoá¡þÎ‘Ì´Ú 5oøxy¢cJ’YU8»Ø:%³ôœ;¯ä¬ÆQ «’âåDç#Y4 K·¨Êžò+o÷àlpÅ/k<†wtv¡„RK"hto‚¯­w:½ç ×…71!îv„œ¼–Qrq7áû¯\å Þ *Kmñ!qLYÅÀ[2ÕË’#¤ñZ}½ÝÝÅüI¤úxƒ•…}¢àjž 1(*ÌÚÖ9³}…×yÚú›ïM…?K¦÷ÊS-í`׉dZâA[O¿„‚ð,vhJ¶«›‹W²„;üàØ=÷ïöùg6ЛûH1T'_w[Ùzû¹Ç}Naô¬&e]G£å!WŸ ¸˜Ò#)…ÅÖ_[Ä6?m˜{äU^Ð6Fa²œ­p‘퀮ùUŒCĨʾºñ‘ùÈZ¿ÕÞÎîpdFXfi89ÛÝÍÅ1Œ]>ð}ž8ñ8ÐßÃ=¹ŽÞ6’ZXèðý~§¤ËÒÙÔÂtœgt,·_8ñÚßßÖápj,«%½Bèîd˜×)Y@¨ÒÁïCiŠ‘ôQH¼¯…}2HYs,+›Ã±,)½÷ýGš•i÷»j.¸o+;Æ «Cɬˆ,AVËz4T´s²xg'c€’Ù‚¼÷²ªøÑÕ·A>À99™ÁŽ)ëå_Zp#ÄÒOÍ¥0¸aÔJ²dB šR7ð#…Å#¥—'ó‡ª{.Å2O¡ÃºîÇe0à ÛÊû?챞µk™rµöâ2µ\L¢°Ã¨œ”Ú«ÜÁWÚû,ðáG© nxfUZýXI[gHḫ»r/…Á!eÖs†ß¦ý£*ÎçÔ4EÐÊâØUCïÑïN¼+¬k #—Ä0Û«ú£2¹ÌÞwÒ©×46?”ÆÍ;õd}:Øš ûº¢}(>¿ŠDf…ç³[—ê'Vt׸êÓ£±YeáY‚¼ŽgERµáŽt\¤zHiÅ)u×ê»û­CØço§Ò«I”rZË-uW Âï[N,äFdTS„ƒ¹’®ØÊ ¡RÅ¿x?!›Îì©ŸX5ëžÝÅëCUÏLJ1ŸD) ÏàR哵ctCUy½sq9œðÌšLùµL^k<ÿ:÷ìõØLfDÙ%@WB€kTù(# £–%V_â«/I’k¿ÒØ¥4‰7,8.4£Y¼Ÿ”_A¢qé}ªíØÔsWM4N Q2ƒ÷…*ý)iº÷5“Ú„zŸGû]½#Š/üªýºR›?¬¨ŽLÉÚý©æMðZ¸×fh¥^E? ÔgÃt€-¢©?¿&ÚˤTBdå¨xf]jáÚ„;]©ÿj;uµµ¹gzôuo iýi›CZ]¸öÍ9DÚ-ÙoÄCÔ5«m›CZ3»sB¯(3ïX±¹AX¥Þ¤ ½.^“H¤'Úïêï[wW6¯ àU ¼P×"”Z‘õÛ‚›c6­â²UÆ2Ñþ·¶oÒÉ-PýTK%Ú8K´uøÆ×¢=FW‘5T[§\mž¸¾ ÉË„·ðrtÌÀG¤^€¥_ƒ{.w5˜í¨ô±¥ ¨ën‘ž®ûòkïŠQMóß° „õV60ãÜUl0À µåm$B_ºz{ÙFóo£6®Ì`&-b0wýÿ.²4¥ªþ9[ÜËz½Sk—Á·Ÿãù®¤­«øôãZ®@h@dt ̦r»ù㟘áW ü‹n(ÞçKN²Î¼+wì@æLWݲWS¤«‘×w]»WRþµ¥É ]ÿ¢Èhþ)›ýÄôvH×ÿ+$3k‡®p}W¢+\ß®žéÜîMé é é é é é é é é é é é é é é é é é é é éú§èª·ËëtÅc”®Ør¬ÐUq{Â~>º>ñO¯Œ¼BWÙiW, Æ(Vã(T£ 1FWrUÁÑiÀ( © Š=þñˆ/¦Ÿ¸ ºf× Fž/ðŒÕ7Ê‹Ôt}e‚t¿T ‹bµµÝ1ŽªÆÄEÓÒç¡kíð çˆ<8:R¹ãîŸ^í—^eŒ’Ñ©Õ8b¸6aˆ®AÙB[¿x£h ÈàùGêÀ,þW8ßòó?6Þ4uº'fÔNf)ê€ÂÄL>Ì1Fá.‘Ù¾äÊúkïM®òy$µöüWö¾ÄŒ£4g—˜Á3’°r¥oÜîÓU4¹Z3ð{ÅùŸ8~Æœ×ôÿN½oÅ]ÑUkFß”Ÿ{l,AúžSí'¢)4 0}ºò‡^rúŒxFÓ4CþÐb%brt]ÔŒí_)ëýÁXÚöSØ ?ñþ „ÝeºbÝA¥c…®f µéÓugN}.—˜(]1¯­dw銹žÿmŸ¹˜2][Ú2äW èÄÉuŸÁ¤7/!qœÓ¤kõ…6(ŒY‘åsHqÇ-“¡ëHX&§å¶ú·a_Xæée¯ ãÒõéSraUÍÈ‹Æ%DçÍ·Ö;;ì RZîì|±›Ñù9œXœkjtU©T««+ü:¡Gr9E2”&ìž*질h²aš|dç--£alGË4p”œÖ)ç(º——“¹Þð?/]Èà/[Ã>–&ê׈¬qªlH'†55Åf—Ò1kú­ÞDrWƒ=Þ¹¹¹t:£"3ôDþ\¹«A\´··3 ìF¯¾í8] ZWWWAAÃ,ÌÔèºÉ]KKK·V4vÕ6Mº655ºš‡ÈŸë©–AÓÐÕl„…t…t…t…t…tÅ(];;;]éæb,Ëôéjfú=ؽ‡Õ7¤ë®E—QË×ÐuaaÁ¨ŠRVVÆáp*ŒfšÂzñx¼G™&]AUr¹\Žñ­²²rwŽ288h‚tíèè`³Ù»pú» 3i‰DòîÝ;Sж···ªªªÒø¸· G·oß6ªbüñǽ{÷îß>|¸ GùñÇ·{”üÙmeeåþ®Øƒv§BM$§ÚôDæÕ«WwïÞÝ‘wGç'Ož|‚¿ûöûï¿?Ø¡µ GÚîæCm³1> stream xÚÍkoÜÈí»…Š-•¥ÑÛß\Ç6r—s\{[¤HW­4k Öc£‘²q?ô·—röeÕ¸4ùP°f8’Ãák¸®õ`¹ÖõÉ_'§W~d¥N‰ÈZ¬,?Žœ0­8Hœ õ­Ea}´ïǾʳ!›ÍEœØS²§ÑõXr6÷\û5îd-3%iâ;Âñf¿-~>¹\œ|>ñ€£kyV,€xàÄnlåÍÉÇß\«øÏ–ëøibm4VcQßÚº?ùë‰{ mº'-Òò\ÇõctQo?píuß-kÙÀÄOíRö ®A†2²|¢o™Í„k©ÚÂXvCI+ ΨhØ­Ìv¦7ôÙj&Bû“늜֪––ŠJ¯¬€w˼>r” TåG‚iÀ†®/PŸûôAú\*EÂ8ž*Ëg m9(Ô+(eîyN†tú¥Ì»ep”±]÷²¨ò!E8°ßõìÅÌíªÑtg_Æœ6zv×Ò¢7o/^€`c_áÆ/3/´Aø€ @Ä; ’³oeMD²¶ …ª%ÀžMtSÕŒĘCÇ[iZV%ò2q§4€ŠB( ¾ ŠáS –À·ÑpžÑç胯WÁbxéG˜£ ½ß*¸¬˜!}…­Ö2¯´yduýÄ —ÝȘwS©&ò’€K9l¤÷ÿ¸9=G›ºø… qñ[Pá¤áWàG–{†Y Ô#‡ÕÝZwÚ»ð«A; É)–×¹­Gvˆ‹öŒÁk¸ÒÁWÊL1©ºóe~jÈúÁ¡d[T†cR€¢‚TØ÷3Ï>‹ny¬ &"¥­:túˆÎ~‚DR(ú‚¡ƒ¿àjVW…³Ý;©/hûM×êXq‰Mp‹l5®×Ÿ¦y¶F ¤±ÝÈ¡ì E+uEwO³ó«ßogp2¾ÂËÅ,0<àÚíÕïwoo®‰F×ðærñëù­aÒÒ"ç+ÁÈtp´‹ê0YÑþØÑÄÃ4µßSƱ§PTJ/?'K ú£ñ{2KT`ËÈ»8b6ë°EÜ”•vÚR ~ɵֲU{–x¨zΪ‹YBþò5ã ìp׆& h¶?ÑŒÒKhNw-ªên¦8ÓÉÖÕ´°hpw}˜~£Ä‰<ß SHÏqøb Ž!KŠIÃ4O@Ž† Qð Àö…2Ñð,üáhÂ=‡ìñI×óöù <ˆ}'“-å^Z«IÒ¦n8þê:"Vu¥:"L¨#RºšŸfóÈÅk/‡®«i2ç/ܬXyÛ uÁÒx×DBðmõx‰ì͵¹îöŸHˆÀm/ç m ñšìkÕŒ:›bu÷ál6@s§–//¿ïÏ4מ>J×,«Mj@Š‚I¬±§d‰ò–Y_l´]â Ž1€›üHŸhǘ2]% |ÇK’ÿÅΟùÒð^¦qìo/–½A À\9ˆßCÙúÖj¯fah£Ñé°_›x‚«OÝHLi¸NÆ€Ê|[³”@=5`Å Út¦x/ðc*¶çm;h«‡á‡On较Ôå´%» EÜqP0ŠìÄ—+å|²°ëŸfQˆi$LBÛ 2°¡|zÉQQªh ²}5ƒÕ ‹aALLyˆ$[€é ŽP’ GO’yà©(ô´dPÆòÁ¶ÒòtL¦âAÇ¢EUýŽ ª •éy¾}ÞvhÖÿ5iê ƒïŽXÂÂ$©®tpÎÎǘ ÃB4«iò jÈ;Èr]Có{™÷ú¬@äT¢ÎbO€0[ý`ÂUê8j2“ö ƒw÷÷ÌјNVã)} {/%å(Gx˜f N>†Nø y¬ŒrÖg§§›ÍíÁʳv³J Ž,ÆÓ?j¹»"O×®³5Âéân²€\κXqŽ$ײ>ê$Š×{ûæŠîc"S¿m9wŠ •ƒÍôUgœm/uˉ—QhÞN0èÖPãEh:]=b•~XC )7Š1—GûÛ±YêWIHCüj׆Ê^®Ù;Ó%•ÿßR3ø‘çx~ô]5ƒïÇŽ›Ä/ÇRá;I~OÉ°Çf¿d`Â?¦bðC:ÿLiÏ„B~ èâã{ 8ª—ó#«/˜Å&²×aÕñŽ¾?½¹ü;rNn4ó¾/µ}ûu<· ?r õ£2›ï%Nl^7”ÙD$žGw ìè Á“üfበƒÂô[Däïü€Úà»uØw£n5À„ï¡'‡ŽHx+Už©Ý>ÝfÂaÅ Œ8BÒk^ª;ÝÞ@üª™îa¬1 8ôü»£nȾÿõ^ÖåìôºÌ<Àßu ”ÃÁ×gA4¼§È£à{ “ѽA’Mà퀤>ØBÄ!äý Èúp Tò~X=ºTØ& É¼‘Ã.—â³+Å]€ç× ôÓ]î´—°‘0(Y¯hÌ­ýÑ!ä[Öl‹L÷*¿!ŠpdL<,÷0æ%œ#"t©€ƒ,Clà9ü LÔõíKý7pŽ—°—R3n ›‚Á6ã›Î’puÚ•]0ØæS·2Ùv²º„D-˜¯³¶Êy[µâ3`Cn"llúîØ9èTåg¦a8ü‘šï´7&SÊk'MwiK£ÌT¹íz™2u[às²zC¦F‹ðÝÖ¨Îá\òñOCaöó‡zþû>…ãy¬›Ø¾,Á{f>ø{Ž^ó¨U'ö·4Q©A9©@ZoLÓc1ÿšŽÜ* endstream endobj 1325 0 obj << /Length 2116 /Filter /FlateDecode >> stream xÚ­XmoÜ8þ>¿ÂßâÁu\Ëoc{ dsm¶»Ø^¯ûÔ.ZÅVÆFýVKnšCp¿ýH‘ö¼d^îŠÆEQ$E>¢ä;[Çw®¿lÏ_†‰“yY$ÎæÆYÎ:J½( Má¼wßC•K#—«`ºÿÔj ÖÕXj¹¾ûŒoU­¤VÔ ½ÀË?7¿-^l_óAÂ#oí¯¼Y¼ÿÓw  ÿæø^˜¥Î­åjœ(Iá[;ïÿXøŠfGŠ ßóÃ5)zñòã›e¸ËÈw/±Yƾ{ê$¡+ð¸oß½£þ—QŠh²-ˆ¦¼£V×ÒÐç%X§†VÕDÿ鯑0Ë@,$&1,õ®‰TÊeà»_—"ž˜~)‘'t[’ØnâÅ4ÄÏÚ[®Â(u_|ËUoª®=G‚3VBxY“ÕÕ Ì}6-n¥‰ ïšFØ;êæõ¨ ì(³2w½"æOy½®ùø¥9#b.[šs­è;jUÐéx¤²^ƒÖ^xì›R©e=®Ñ$?tÿViy]3ËëW—ÄÒÝ,ƒØýàûa'‹ªÝž2W¡#­C`N<-áÛsóš¹ož¼ö²CùÍËo_½¾:'6AÒSL@“b"¶–³Ì‡îê'&´J£ö·gh"DÄÎÄx2L´Ôÿ˨×/6\¼›Â E›ðcm†µ 4Š£ÈÝ” £É#øm;úîÔ§þµ´;ŽÍˆµls«´í¢/ƪ6«ª}F‘J$CãÖl|ª¯Ï˜Ôu5µlˆY)ÌTªº¿kVõ¢í`úp*:› 21…:|mÔÁ—v %7>ÉÑt7ýõ†±mºý¦Ñ~^­ÂħL. ˆ=ñs&aƦ‚]‚#{.ÙŸÀîÃæ¤ê¬Ñ,½”º¤FÛ K›±6U?…Ða˜j ›©1g*Åkq*e]'ml-|O¸ú`br"œà÷ñí"òÂ( Aù0õ²€tß,3P¦eϤîe×j8.‰þÖ´ûªƒœä¬Ÿ>ÊÂöÚF»K•¦æ…L4ö²‘lf¯h`sÔÿf˜Ý‡Ù°ÐKN·F~[õªE—­z™cÄVFc AàþÔâi06×jøù{V‚ïÞêMiC'®&{±fv­ºš‡(„€ÜZùÌ_a˜ÈVu#³Rt$M즔æH‚j·U«ˆH1ⰶɉÉïÓ¼I½²Ú–´´ïnU Z×w4D‹ª^ÄrBΈfÊAÉ‚·³é&rè»eÛrb&1"îÜj‚Ɏõ¢Öm5:Ô"ÅaÐf·ƒ,l‚i0;Û­D/–=§Œ¾ïs¬ »…ÁqìrÒý!®+6ñßI ³~t öÍJÖÛn :™ß—ú^æ«kûÿY?%ö.wA¶ôôÒÀÁÆðÒH“Ó¾[,ÙvCeʆm¦zëÐìYL¡n0.$)³ÿeê±ï»avu_Kƒ)«Ÿ±¯?E‡¬#øÒ„|uL_9ïíü_áP4ó¾é<ø@­kØälp0ü¸ *”Q¹ñz[/t²A­¦Íª; ÃÛûFÕØÜcÝçPEtÍÓCQùHKÑ‘Ý]f'.Yö À&æä–îk›=@êFnhÕKfž¤«m+ Ô±<³jin™Ó=S5Ó&lCŒ;ôáé<¡k 'P îAc»ïЕÛ%L¢Ù[uCX©HLËFÓ $™›‘Á(‵ÅæÚ½àIUKcµ–"ø"ò0ÚC2²Ù>‰·jéméƺ`^¥!i¨â…-‹äu ’€ Gnóõf×ESm‰, ðçZNú¢W¨â‰Š`BÕ,m-F±9õM·Uf‡Jq”Q°àX?p0RwFUìì›0ÈÜr.q­í,×’¦›Œ]Êúi_‰YÚ4Pt­b-~å³cøZ!Êp›ÿ„áäwNâŠäƒû͘—ðpL5y7fïž,ž7 |‚²ZщCb‹\2Ÿ]E…¾Ì%'ÕT‡0c7Œ…UÿRúœ3-öprpGNR/¡d>”SÑ£÷ä5Ü×ñ|W>‘ŠÀ âØ[‹GeøN{¾` ÂÁ¨F Pí!eo• fŠýU­C¨ßR–;(çæ¤à 玿ö¢5%IñE?HœM›Fû´ú*ë‘]êß['°µà²8c¸èòºR­YQÖü&¾ïÆþ¼Z _ÕpŠ÷¤ên`…žHÓ§{ÿa €„XÄO‰GßK‚pí…)Çþ+ŽZ®ãžMÙ•C…¦ç¸ßUTUðÙ??fÚ§ê¶Çê±ïgë?õ¶\añ„XG—n3×PpQ¼G³kuÑúé‡qÓ• ›É^ý„ô¹~‚:²²øøi(•9CØÖ̸Ӓ†ûIÄ|H}‚™,¶ ˆê3(¯­U‘©î®ù€*ò‘µÈ E‰{1Ú½f­jðë }«T{ ˜I°Áž6hàúØÊæ‹0-Fò³zþ2Útë9|õ;(p‰óÀõQìEQ01’žtçõC(ŽT±515éq”B¨gÓêíÌÀ½ •AO<;õŽÓ:sÇ·»Á8× öeƒ¾û3ˆr •²õÜJ@2gá¡ÿökçA}«aºÚKN›Îž-”)|# ƒ«_þrt–“4©»v÷ÀekÞAp¿ÐÆäÖý@{ò9 > stream xÚ½X[Ô6~ß_‘72‚8¶ã8ÉJ<´¨¥ðRµ]J%@Ô“x’”Ü',ƒªþöÇÎl²³,Œª‘Æ—Øçæs¾slìävž^|uáÿp'A §Ü¹Ú9AÄQÈB'b1bIà\eÎ+÷·±/S1ˆG£Ø}¡dozOÇ2“`÷‘™øUVR(i¢ˆlÞ\=¿øáêâï ±Cœˆq†"9i}ñê v2˜î`$±s=­ªÆch+ç·‹_.°•#BbDy Wsâôðáhò×½CãT+¦Ùâ1~Úw  ]•Šf’òt6†AIN<°ã0Š ‡gÍÐo(vÛlL‡²]3­ÉÂì°“‚¬œ›­¯) &'á<b·T¦¦)ʼð`Á®íkѤÒÌÖc5”]eG½ÔúåÓÿ»@ iQ6¹Uå¶ý~ÃCm"¬Ù2#%¢DkË@HÐ6Ž nO‚ œW 2ˆ3 ºô}LP VÝÜ/6¡{Pa©ºV–D( èl'†K/ƒQ9˜Ö:[iÚQÉÌô†Ö´Ö zÀÜzCÜ|Ò­ 3”f²à {Kha½Æ!®»‚`&‰@Ž®k{ËþzÚ eeªÁ¶µl†Y‚íÞÐ>ª¡´äßp8­²—–‚hìâçe­í0©¯}Æžõ£9Œ]ßÖ¦Ž#«Ëó"/‡bÜnvQÚÖ~ÙTeSŠÔWÖÈ~7V•O®Ïæ„òÉŒ'‡´Œ{™Õe#QÛɦlv­’é®›Lè88G©Ô(•O"̾bì(æÖ©ž´uWVâĸ{6<Ø„ / ‰ÛµJ•[MA€'o›f…²ß!\ø5ØÙƒ8*”W6i5fR=öGÕûU›ŠÊ·s~¡ü;÷˜,×›`Ò@ XâŠj(Ú1/ÌfínZ”Lz+O ô»ÉWŒ ÅŒ hTYó@ÛÞ~ÜZŒhd*•:€ÀäC‹@6ýÀ¯V¹ŠÇˆ“À i0ÁÕ}ù*‚”…‡œµ¢ê°ZÜG;à‹qb)Gÿ@4ÓÑŽg\„ YrÑó,Á£ØÒí¥³»“ð!únµS…ˆŠ!^8³Y4„¤J"bNI\…cìzÞv,«ÌÓqÿOÞËÎLÿ´LÁ(âpÖ7^äb“êôzeøP<ˆa¼—j:¬»¿÷øB (u²í<@SàŒâgT-7¨öfœ¡0¶°öB™ÄåÕ§ ˜û1îjCMb£XÉ+lg•µmdÍé2+‡C€õóãh/êÊBÈ“B4ùmÚf=Qå–·É‹zÿjúý††{ìn;ÿg¡¬Âšä»J§v€½ÑĶ•GG:–7èES)Ñ~j;$—Fv ÑJk™vïê«Z|5YóÜôeÑïÅV#ÕØ ã]‡=M=kÔúÅ).¼çø׈¯óÓ-t_¹‚5li0ƒLB¾Ïd“B.;Zƒp »s5`…°áÞè& =Zl–Ðj l XC‹Š¢¼\{šÆă±õ ­Å;iº½Èeu:žn¿ãSA’ü?ðxãÚÚb8AsÉuÓ¶mÕ`â£"³1s:Þòøj u Æl4`NlÔíL?¼¯~¶¤W!®w„ˆ` GY G˜=´á¦ôíco£­=%Æh²ð³‚ŒÂ•=„ß8Èl¾YQCÈåŸ ²ù˜½L¾?/ÀN·Ýñ‰à~ß(À(¡(ÀËÚ¡‡Ëîþ¤Œ„v“Gƒªpe:#‘vnF\¥3\VK}i?úL§ÿÖ,n«Lט»/µÒÌš@…NÞ‹­é Ó@j‡zàzzª‚á"haesuÔ²ç$uM<Ú×RkÎC–c8BÙóŽÜ(ÐÏ> stream xÚ­Y[s›8~ϯ`úR{¦È’éC’¶ÛtºM7u§ÝNƒlØ¢’ÍÎÎþö=BÂÁ±ëÖ1ãLº|::w°µ²°õÛÉÙüdöÚaVˆBF™5_Z>µ|7@nèXóÄú2ùØÖY5ÑÔ¦~0ù$y­[¿µY§6Á“gºãŠç<’\¿8ˆ"2ý:{òj~òý„ÀfØ"ÜE>ö­¸8ùò[ ô¿µ0rÂÀºíf–ËxæÖÇ“?N°!#ôaD™£f3bÕ0°Õyõ£#Œ°ãë#½¹«àÄ›È8*;"û]`a8Xˆ-›º€ëéuŸ§žð§S8sžÃ9=<ÉJÙDýËÂäµÌD©;\àFfõS4w? sƒ1,@Œ8ób³—9>ðÏ÷Ö ÚÀµ ‘ïíe0¶<†|8£† –úmº´m÷ ¶ &d¸êw}…~Ð×ÜZîD^ËóÁ³“£VÌg®‘c>òAª÷WY3µÆ“8%×Í´i*ù|6ƒ±´] X3LD½š¥JĽx•Aþ¡j¤81«÷M*®“¬Öóm–'û€~<¡ˆ® ©ö˳Oï^~û8?_œ;}Í7§W¯^¾ zB³NSvñl¯îx®ƒHφ»+÷~ ¨ÐzG™€ã¨ áO càýcl`°Ï†ç6Èã ‘ÌóMVÑç­JË;™¨FU‹¿xÜ „vˆmëYkcQ.³U[wêó\÷=¹zõîóÅüÍËWgï__>ù0ºYFJÕqªÛUÔ¤D;ûÈ=Œ[ÑŽ9ì'R¡. ŽÊ÷»lä{î8‘Ž†>b¡‘%S“Ö=Ù”ÆÝû¯~Üg ïï4vTU]šÒoâYž(R % ­ëÞ÷g”y¢ƒØqfs°€¶ÔD!ÿ1Fsxý¸ÈqA4F&pŠMöñ&[¥ºNøaê@†W/•%‰ºˆÊØÏEù'Æ´Ï,~V¥ùûtPf¨1Xh<°Sèá¥h;  }uúû3ÝÉ,éê›ð¦Uh,Ežëj„ÎL¡KTŠ&©_ºÌžÒJÑ]TäC˜ùKµ~iç"JtOdmlè¸U¹®¨¯Í¦µ(ÐqþáÓÓ©çMäZÕ¨š¹ŠG¦ôQ )³EÎÉ”I¢ Ž+q6ué~Õ„»uàUtl3txïA‚AÉ7á $Ä7-0mŸmZ8$ÌË,ﱸ• ˆmW°±o¢¼åúcQÑ-ܜֈ8ÏxÙØ«Z´•4°ï ý¼¾áõîÉö.|¹Jí¢*lÐô†ÿݘ%QÛìLtàò[ÁáAÓíšÇmW׶ó¬Èú…Ö›=Þ£®6ÛÚ x?ÄA‰@è¡ÐTœÏ”å±ÂùM&yÒ}çp&©v\ý7ÿ©k¾‚8}«L=’&c€®šo³Ú æ¢1ãb©{À鎥¨uÏ`“R÷"á²ÉïôD™ýÃÝæÜtòF¢©í069Í¥Ðà 3)°Î×D=!÷$O©üÜ.“$™Ò†Hy7ß8¤Îc/ GY-:j`˜ˆÚò<ëzb7°ª9ÜaÌפ bÀÀÿû“¾Þ c@_©;ôu#…¨Ítͺ]T(N„t2ׇ„YW9\]¦€íyÛApè…Ií¼ÑÄ28Y­‹…ú$Ç4©a_I²è¾þlæ˜r¸&·)ï 0ëà·.†˜â‹¼„m„Ç_Ø<°)öËØv~.s!M &ž¬o ŽG \X¨«FiT­Åç—¥;ÃùRÿÙÎ endstream endobj 1350 0 obj << /Length 1188 /Filter /FlateDecode >> stream xÚµ˜[s£6Çßý)ôhÏlTݯ½l¦;³6ëöe»ÃP&ÜŠÀI:ýð=âÇ`ì¦öBH?Î寂  "èzñýzñÝG®}ÅZß!î),…DžÐXø­côuù¥©’(¬ÃÕóôòwkª®uÝ$±Y]Q²üÐuܘԄÖt'3LWßÖŸ?­-(Ü‘ Š<p=â¡([|ýFP ýŸÁÜ×豕!¡4SôeñÛ‚ ¬õ÷¬u,J0á^gèÏ5ÜZ’e>w0µE×Ãâ®U÷=6ÙäÉŸ„°(Ìë´Ÿù¦uÚU“š—Þ0NòM??ɌŭcS0„`¦¸³_QT©o:o®»0S¹PÌYNÐ×ا~á:¬['‘í¸½ÇîÂ$“ÀëvÒú¾7ÏÂl‹Ó¢7°¬Š¸‰Œ}½Ø£;¯LTTqRä}œºƒ‹ÆÓŠÊ¥éc•äµ©¶+&!’º®Û>R±¹[AæÃ&íƒnÜ°m;»êÇèÞ¸e_3Š})w1ãX«^•û^ƒÜœí¯ýð‘VLßþ9P¢ÒXQŽ¤Ï°ÒrRÖ“;Eš‚ =,Ä$‚ I%&‚öŠÜlë`ÛÛž½Ûø˜Pºw×-<bÐ;peÐÝQòk<†ÇvAASJ‰~AI­°áhc|õß.#.u°N}ÙËý‡¢q‚ÒA!ËVW ëÏÝñ—03—þÓÆ#ýOÞ¥Åcm*¥…5qPVMÞ®‰=›>˜ÏaB½XßWmy‘{—)œp> ÏÍãŽ,Øl²ò4!“`cëKÀ”ŸÑ12ÎLÖ¸âî“ù¦JéI¥G‘¶ +GTçØHØ(Ïd¦ÚY›À8…¹P=N怋­S.WRuG¡&ƦÂåC µXï ¿yú5 K“A&\§žÇŒ|ÁÝ>×®ð{zø’ (ÑSȤ܊™ pOáÀ©y8Ð"›"™úÞT¹©ÛÑï¾*|ê{Œ61›¦ï@©£rEx Î'ÃÞÄ3i †˜v/ªËyœT~e­²OF<.üW¢ÛDMk º8'/8u®Ã'yg;|’øCAÄÖX›ùÁ#óGS›ž”í9/(Õb”cóÞgàæA\åð5é(nÔ¤Òš&.†ö%0¢½1H’oÃ4‰ƒèÞD¶É†a:ŠÓ\ê1\^îµeX8Îs«2{ó…@ «êQ =*x‡Ù½4žr6}žÔÍØs~°)8é“)F=Ì0Fs®åhdl=ËÁ™×q»^‡Ü_hç%ËÖ°b³ 6e}@dws§ÓFüñô÷à9xI!?¥%{dɺ‡ëÑmèäv\ Ž©Öì¥ßléÁÄY;úíñà{•˜©ÙŸ«Þ~T„`˜Òþ»‡†€1vðÙ I1×Hí8JøàsDë_¦Cþ¥ endstream endobj 1356 0 obj << /Length 1331 /Filter /FlateDecode >> stream xÚµXËŽÛ6Ýû+l fHŠ/yצmÐ,Št2Y¥Á‘)[ˆ$:™òñ½%Ûšñ3Ó >|x.yG”p´Œpôvôëíèõ±ˆ”*¢Û,’4’L!–ÄÑí"ú4þ°qyª½žL©Tãµq¡÷v“/ÌdJðøU˜¸1…ѵ ƒQD&Ÿoß~¿}0†#È’XFi9úôG ˜a'*ºoQeÄ„‚¶ˆ>Œþán£¸ýÏ-£Ð¹y»Ç*$Ž$áHq’Y‚qÉ·ìE(4 Râ$Ž(GÀHÔü`_¡ûz>³g%A˜}+Í<“1J¤êx‰²ƒÄx?f‚F b&X3,æ<Ä̧kä µ)ïŠÇùR¯'S¦0ŸL4¿oRÁ£x7)UÒ L@PQ“Àµh±HÆÁ Åΰ&iü¡<á 98‹Qêú<Ë„†AyM&ló ¨Œ¨ˆ›¢=ÁóÉ›#¥#¸D<‘ÁuÁAyµ 5±Öé„âñãø°uÝzª· tÉ‚2°Öõ—fÇãzµéz ;¡||_½ ýJ…‘3kë|~eBöðe5k:ŠvÖkŸ×>O»qÞ!–¦'Éœ-;–T¯;£ëÌ…BߺÐêlÏL8àÉÀ÷QƒÓbñ²úåIrN wÀ'/)à=3ƒÄg+øi{°¢Èa,ÿQX©Ï¡Æbüš¿¦˜Ð0œNC‹å,NfDu³¡ùs|óðfJJ`DÂü{ˆPÙfÀ8áPðqò*Œï½éÿ"X‰«:yPÿ×ÆÒF­šÞ­õº˜ÁÞ„d”vœ7&ý6k÷+M:!rv=“ 'ñŽ#üsCŠ^¦E×çÓ³´n(ù!1 “ %†+‚˜êDác½ÑEñ8¼} S ¥ž7õJɸo+ëC'¨tR[® §0ª½u=Ân–+4™ÆÿW¦î ÚuPÕ®2E/Àõ=‹öu·‡»Fç6O­þõç›Ð)ugNµ ½•n–|›>6;æµY„ÁNOj´ÍBY¸uC§oƯ¼µE§zv+aà 8fmfWHì³I“„4#§3‰)šø%Ò´3³¯L=ñ#MêŠ1|ÿS(º­çÛÿÐM–ôТ̈́æÿÝC§FDRI2»‡ù:ˆÕ¬S(NL±b">DîŸâ)XÜP·R×SÔ“X2ÂŽpï/à1<³ÇǸՋT×¾ƒÐ1s~HGýxs¬Žp—›ܶó8¦Dò#›~ŠV” v„Ù8g]B&0Pø¨«áS¨+ΑڢÈëÜV'Í S-ýê‚-Ö~3îRm‘©K‡@NŽpfN—æ2ó•ßm² öÚMåÏ Ë®ô‹Ë|¯ïàúw)8ÕÎ姱gyf/C®ŒvþÎhü>¯öþŠãÍ íͼɋS±kÑ€‹xÃ~9Ã[Ãm¶œçÁmò^ˆõyiìÆŸ3`a„ã}ݘ9—ì¶Z^•ñõªõÜ+t‘/«ËÂožóÚ,çKkB3G4bW|Y‰‘ÚÊ;[ÌlufÇOàYv.¥¯ ÷WÒ÷1jƒèŸÜ4ªSoÊ9X(àÙ°ïÕ˜S‰%ç1—¬Op,ÅËîÅ×_fž®áHÁâGÞÑ»vð]‰3x=¿ø³ÒÁ—wF!Ý­†àð3ŠÁÂvúÍJ¯}ÿ LÂEYP:~?‰›KqÖ\a­+u•šÁ{=xð_´®È— endstream endobj 1364 0 obj << /Length 1709 /Filter /FlateDecode >> stream xÚíXÝoÛ6÷_¡·É@ÊõÕ·¶k‚´X‘¥ÞËÚ£%Ú"‰šH/ °?~G‘”%;MâvØÓ ¤NÇ»ã}þäÀÛxw1{³˜½<c/CYLbo±öÂ$F¼„¦ˆf¡·(¼Ïþ§]WæL±ùIRÿ7É;³»Ø•ŸŸáÀa×¼âLró"‚ðüëâýìÝböç ƒÆÀÃ^B@8EIxy=ûü5ð  ¿÷f©wÛsÕSX+ïÓì×Y`­ úwÝÆ3›ë‹‘Ô8E1½G(Åñ£’PžDƒô‰Œ/Ž3ÓG­ <Ë2+{ú 30ì˜2R“¡ã±M§Iˆ²$u‚;î­”ŒC/ö˜êÐe`~–yIÃJMäXU‰|ÙÝ-W»õz¹feÅ‹Wó³8ü@‡DAøPe†_Ý-e½ÚÉÇxºgðh[^3>x£Ã°Nò%¢!Âiúa9Ê-‚Òô”ìra(‘8Ô'âþ ÇÄë}Ma Ž ¤|F(Lcãsù¼kxe*¥èæ$ðE+{9• %U&x˜PPR1%Q%6ó³0¦~.ÅÊFš§²Q¼ãR•ÍÆÖ¢«™*EãfU[n°Ví:ŽnæPνmË–åæIY±¬)¾É¬#.D:"þ ­9kÄzÈ”Þ56㶼/D_J³åzN" 7h”!­ä±&ÞöÒ4©7\o¬-æ¡Gƒše¡ma—ax}¾¼šgÄ=§ÿöûÅþÜ«‰÷=#¦S)_‰¦\ŸÏ"Hío9m|­ÁàfW¯ú {ðI¿ÊE×ñ\U÷æQ®P¬;èÂŽñ©=ÁÉ÷ûSÕ–YÛ¶Lçñ_}vÊŠóÆEUæ¬+xaU5RqVLE¯øÞ'. ·‡‡Lƒ|u¾¼¾üxñ߇V Ū\'÷¬l Ûõ²ÓNø?¨ãÊ id;löhD?ûà˜kñöÊlŠu3|Öš}.vºGší"½²J »³J˦кD§ÛÅ ÝÇ2ŸYîRYÞ¼f©u)¥iyÝÓ^ÚKÞÛù@[”ªã¬–.qvºÑˆ úƒØ‡† ¢$z|Èb’áÁ>#5cìc?‰}×c,—R‚âaÊä­ñ$¢ pø×Ïð åZW“Êˇ`HÉëUu¿Ü°SDÑ*óïÃrÕxèg® ÃŸ" “àH` >"Í:T2¦\ “4›ýn(vz–'+ˆ $þ(fÖéhcÈ,‡z/ À÷~G}ÍÝÎúâ¡ûé½£€[(à°B‚hôàÕ»öÆ’*!-7³ð$W–PZµ»ÍÖj´½È+Ýõ&ßòüFîj'§±tSëfÏ›MÙp³ïvEOÚ¤³íAUóZtýmî>¯‚U†(mû]ÌSè墒ªöÖ¶Ò¾Ò»MÇÚí³«E¿ŸDmIËE[9äÆ 7ŸÊ|§Fïh`X½°³z'³f˜qz*”€sËð%HÅÑ#0€|c¶‚·°ö…+Ï û{G¯‡)\¶ºÏßC2Ø!ÙÇÙ\Qió«reÌ»²USmÏù'›õ‹hJ˜cÃ,¾-ÕÖì~g«Uygépx²;lZî2&¿NЯ¾.¾Î/`ÁnuØÌNÊZÈ*÷Y;@‡†€ƒƒ›Æ]ò´O䎭u*äO¥+IðÔ—}Ú†`&¹4Dí&n¶¬³¯õ¬cf-µ-î<ïô·šeèL?éÍêûPèÿÂîWNª9¢º@«ÂжB*³yÝpu«³Nt7ºýàÔ¾±çÁøRq+|a[! ‘ïj ÉÆýÄiÕã@êP¯Ð¨˜â nJ.ݧ™M™rïm]‰Óký;-ÉÆuÿÅaí+[#9°J:R¼¹:‡ŸÐ–ÛN·oíšÌ‡ãÚIضM´jjÍ¡¾ iÞ´ðªïú€×g{¤gÞš6÷ÐÞJk ueÅ+QY¾ÛzšY7ÛwŽâ0°SkFIæÎg#zhPœkG¹˜õ±¼cõÐ…™ t¹' îŸþ$õ“ë Uå*zôj›F\‡Ÿ™¯ÓLç·<èÎâføBi¸ûìp³aÅG™È‹Ã'Æ^à—¡Ui̲·$$lÜhÑ dŠL?]^á© —WäYi6ß-^ª3Ðéü9üU4¢PÏþQôø§[‚ÂØVI‚ýs !OõAøpÀЬ¡þÌAD‡vþâXnÈ endstream endobj 1373 0 obj << /Length 2279 /Filter /FlateDecode >> stream xÚµZ[oã¶~ϯú²63%QÒ¶(㧤O{6^œ‡mÑCK´-D–T‰nê—þö3ä’|AºŽcd±¤x‡3ß7dB½•G½û›Íoî>ÜKIÊ÷æK/f^&$Lož{_'۶ȄÓ‹“É—N¶X»ß¹œÎ|:¹Å†Ï²”¢“øFüéoó_n~žßüqãÃbÔóQxHb{ÙææëoÔË¡ý’ M¼g3jã…<²ôoþsC­¢”ø %Œz4÷½:Ž?[ò}’Fs{ò)¡AŒ{jDסží¶”ÑÓ-sÓ‘9¨7c!ˆŽp槩MpvÂìlS­ÞyŒíµ?B­…ÂZ±Är#T¶.ª•6`JV C­%ŽhDö4K;ST¹Qa™¡ÅaNm…Î?|rëY!­ììt3’ÿ+¥A=eÑäyÊ£ ™ÎBÊ'sè…]îplY×O8¸,Pm.m40Ú¥ªÛ(a\DqÏ·X7’þÊd£ðÛjEÕ))rü0ŠAù?QÊV½³­mÌÛºyçæ÷ºÁW§DkÅ=jm‡k;¾#½–1IëË?ÿ%6M)ßÛ×?Ú‹ÌxΞ«ò„p?ðxÈ¡L^t×<:Žz—Ý“‘øÌãA@ö¢ËÃè€Ð”Y¾§@7¬€nÇ-£eRB}¼Œn〤qâ·Ò[ž”ÜGØAiâˆ3/Xà¡ #Ä„§|FœÂa6Xúö ñCT;¬üðãAC_ù•FtÓ­Þ7ˆe‰ÕŠå²ÈðcÙÖ›;Uï­òÝ÷øÙù{ÿ{…€sj‡/žtÄO’WÓ±·€Ÿå-{æÞƒmn?$©3÷Oèß‹b…•pBw)[Yeò0 2Ѩmk›!ÎY©dÛÙØ룱¬W¶­ÛfV‚°-k¥l«“Ù©¢´¿’•l…’6š—.rÕº_ S+«ÉÆß7#ú!œCTƒn£ºÛ6 `Ü90þè¦Ì‚˜;ÖÕLTXYH,·ÞUGí}ºe#, š¯ÎØX×*Ûo ÌŠ®sd!ýi,¤… ü^×ôåIè[ØÉ®¬j…9˜°•B kÄo©ÿÿSc#thH9¤‰9C=Uãæ¶ù¾éŠZo›Û5¡¬«r‡µ¬® ÀÀÇrün@Õ™c.­s”Lìì–i±ú¬mT·¹&‚ F´¨{õZÍJfͪkd¦ìÊv„>3•#éí+ëØ%Ÿ1ê19õÑ ¨0:™i{;wï-нgD4"q”^ÄaÊHȯΣe®ÆaÊIâR¯>X tCXü^äX§·ÎWGm™êb÷{×f·§yç"ü?ßäG'¯E0þ*üE‚ €r—à†ì"L]šRgÚןLî©î'ãúµ¡ÝBK8Bj¤™ð# ç°æd…É¿n´ZÈ„ÌùšR•°)g€T«Ä¢”Ø6Ntu_ÓŠšгíì2…¤<ÔÏJÛ˜ðÖM­Ì)¡žÕ¹í×é¦n’n­NÈ—…6Û¶R[»T|Pû$º#>¢.KµÚm7*†G¸»zkÙUhùˆÜvRÙBb¼ÒdH‰Ü £Û…YÏñ¾ÎÖ¾˜Û|\fªnw˜äŸ9¼ÖŒ€~¬!U3 ª\Y&Òý–x'Ñ5³IsF† ¶eŽú›ÄÈøä©{ɞ˔5*ź¢§d-d¿‰ ÐFæpxQššÃö‚lR~bwêüD–ÊZ!ÙÃW½UXy^OÍuD×3 ~a¬ÀÒE¡W¸¹ ‰&…j¯~þ±-ì¤À_*» ¦VC¦abƒÁôVºÛ.…Ū®Ý¸º.Q-Ì< )e eÝXD8ܽó·“^ó¥É!¥9嘋ËËÏÑlyÏ?áú×t#ïÅœùïB€#À;e‚‡‚ÞW3óÃC !6DÂ=f=ÈÆ6„‡{£PjÉ*ï{¾òà–øQ~à'/Ó$±pϹ„ñ‡UÆ„oå¾ á0Sd©(³TÞY¹«‹nÙ{W³WÐõÈf Œr“ŸmÉãóôáLÿÍ.r¥po¶;ý ],…‡þŽœ†œ]Ö iÇUH© G™Àў̂É|š°â(ǧº¾÷píñé-¶ ×=¾³WÅÈ“§0m^Ñq<ƒªp®®ÞŠ0x9;…)ýó€³:+µfqJ¢ø²çÆ9ÄêÕSëÑ2WK­Y nå.sä̾,¤t Ífè38ýeÑ'}¯«ó w|~ ‚¾,⬸ba<8ÖÇÂVÌ& pW¼úÅöÅ4€° óÀMèêP9ÈÁ ¥ÉÆXO–ÃóKs1a>.¸“ʼǃóÊ ûVÒJ€ÈéìTû„µÿê4«€ÛÒZ´OV™G)_Á” ì±*úçƒÓ\¿Ÿv‡J{Úë‰üྶÜZplb2“î½þ‚}Ü=Ý™Tù¨Õr/J„gßÈ…°¡ì"ØðÓd]5†U®~ !” ìì3ÀŠ¿ïþ-»'U7—AÄÙF::*-!ôߎyý8&À¸]ôaçѽ?–ÖÙ³z³.ÿëoh­š­¤<˜€«ÌýgìÆ}¯…Ÿ(ryç‡u]wî–·7›úÔsˆ‚Ñû­<cË #Ã(Üe‰«p’$éÕCcXæz±ú„¦®}lÜ1ÐcF#øwa˜œm±ãƒ<}»0„7Š,*|ÞV§nuÏ£Èq÷&í£gùMAÉË8åħWGâa•ëyÜ ÂþaÔ™Ú¤nö÷^wRewýÕÉUÈNlìoÉf-–e½"ú,ˆþ•šIÓŸeî^Lí#êÚæ…Õv³í]%6¶A#—.‘€Í D]þµ³êÈ]€ Îäí½¸ æé?#'Š8üÓ…($Œó_.œüÓŠ߷Ϫ>åуˆž„0Ñ4X‹F¹¿²ˆõoXÃ]Ù.Ín $•ÉCUÿî0üŸ endstream endobj 1381 0 obj << /Length 1800 /Filter /FlateDecode >> stream xÚÅYYsÛ8 ~ϯÐK§öLMóÔ‘·nw›igÚí¦éSÛÙU,ÆÖD‡«#iÿý‚—,ɲ›«ÓäAiì­=ìüqq²|Í|/B‘O}ïâÊc^ÀCÄ#æ]$ÞçÙǶJWqÏ4gŸjYê¬M9_<{aç2“q-ÍC‘ù׋·']œ|;!`{Ä ((ç(À·ÊO>Å^ü·F, ½[-•{ܡͼ'ÿœ`‹ë¾jíâü¬§Õ‘O˜BâÕ€ñ@tÚ:Bè0E‚òc:@š!Q«‚xꀀíszf"„ é›Q|0¡S\IïjRóÎÃV/¥O½–Òçj)•£±Âˆ›U¬»Uô1ž-V¦]Êfµt]~Äyf+ÓfåmWñ†¹#Š¹^Ü)ˆãu€à ‘0|€Ÿ÷—T0*î³Ü߈LjúLðõö™ç»MB8b‚Óµ8àAd Aª¡¾B-» ˆ Ë #uA:±C`„\Ç6ÀÃàáBí1Ê…cïàTGjûc(®c ¬Ô!( A… ©Žœ„â:& ˆ>„BÃqŠ’êÈPLÇ%:…F\ì PŒTGNBq}(¡ bEü(Ö+áÀ+Á!(a@:($<EKuä4Û1%@¿ Á6˜-ÄbáþKp ÷{ä,¦ãQ%æê ½zLé«1Måõ®WPÎp(™»Y]lTÝ(ð,—q¡êEýQ^™¶q½i‘¤s*f7iÒÆ™á©SfI}:¨1a6ˆë37@³V¾PH!©Ï ¡Žö93s¼kTÚpÙ83Í®¿ÞÊ¢± ‡0µ”$/¬\iÚØ~ª²¥?­8ËÜ´@åªIË¢ÂÃwÃÿlŒ»ÞÄ•ûÐ!¬Á¿™tôÚA¹º7õUY7Ce;ÀÓxéq¼®‚.ÚüRߨû¨Ó\ÖC/¦ë"nZ7½Û9ܺãzK&òbW R9X,ÜÁ®†< XicX¹ µƒ}ˆçÔöçñ«§l g««ÑÍœˆ™4œJÖm6'3…Ü(-LflœÉÊŽNZi1”†Q·Û-(¨ÓÒ VK³þ¦ÌSµ…ˆû¸‚@6Æ h芅“º“þïí^ öÂ,ï"Hªi‡ T›ì¼p‡ ú š—ó€ÏnÖGm]tõ,ÙÐꤊ×ãí ˜Ö7¬å®g¥cYu¡ÇÃÎÍubÛ [KC:€š.oºÍœ» ȽwèÕ{ëˆwO‹®({(‘¹'Meíîl˜Xˆ.ͽúðÉ&«¬\]÷ÐØcÊ$õ Áá‚3 ŽDýÊ1fžk0H)›¦Ùž.—²@·éuº•I£²š“p¶^*Î þ«ÒÀðeãÎ)ã—X¸ÞGvY.V9åj |t„¨h£Àù¯±cžC±ñ™Ê?$*mªÏ,½¬âê‡á•¥ÞšªcUÉXç-\æ6VéFQ*ã©}.(ÆZ]À^ºjÊ2³Vê6m¬À¸IóÒ|[•jSÝè¥W}¹ÌK‚C,’ÌöŠ;s+1‰\Çl/iÖuçi¡z½ižÏ€/ÌÝ&V)3HAùV§  uº‰¶¶ “&HJiGë䬮 _…¾M›‘qoÀy#\«ÅXb³<-”+4­”ÖZ»µbý8«íˆJ&íʱ¾šp@[C’2!þÍø½w>^¦MD÷ŒEm ‹EwP»ÿÞ5”Y¼—™'Ú·(ÿ¶ÛüÓ¥ÊmÑ´/ºìÛt¥OWo@€º^€çR ±MÛñê&ìê»»¼†QÈ÷vH  áÿêçïž™_öüM(,.µëo›ÅZ6æq§[ ý²=µºwÜ߇ûK *˜žìÚEˆÒQˆ¾–IYÅGÃsÝ%¼¸©žŒLcuü#PoKwþgÿ—(uU¢ˆ›çá`„ÔãSzü±Ýã‚À‘»ÜÝ[ƒ1ÊÿÃal endstream endobj 1386 0 obj << /Length 655 /Filter /FlateDecode >> stream xÚÅV]OÛ0}ϯ°xj¤årým#íaB+å‰!Ú´DJ–¤šø÷s⚪TMUeû6>÷öœs#Y$gÁ×Ipxʱ`Sd2'š- ËÉdFnFW«2ÆuFL›Ñu•”~v¶JgIQ}òq’%q•ø4¼œ'“àW@]2$Ôƒ ШÉ4nn‘Ì\üœ pkÈïö©œeܘ‘«àG€]¡ØþV.ˆŸŒÏÖP•E9ÑT‚¡j+²vɵ|F`êªC’‰mîihYAIóq…ù‰+l3²–ÆRºž¦‰ ÍÁjÓ— ™¿ŠüBÆplUTŒ§¢½Š¨ÀXáU|Zåa¤G鲪ã,ó‹ÅcRÎë¢Èª(Kï«V¯×²þMý@S)8PcÞAݦ‚‚3¹‹‚ÏTuþE`Š7;Tû6ƒãËS VJÖ±¥\ Íc-[×U:c/Z{'--}·Õ®u ’ˆ ‡,ûÿ%Žê‡~2ÍÝÅÔ¯îŸüøX&YÏÒå¯Óú¨ÉÒÀQ –÷u܇ G«e½:êŠØªDÇ¢¢ ´µê…$š}÷ÁZš½õB FkÏèÅñÝåøäâû—ãÏ?‡«ªñê…G¸ËŠ3W«EÓÅ\2PF¸møÛCüX÷w ŽNÆF—!wœ–óæ”.Ê<^N‡/ ÇàäÛÄ endstream endobj 1392 0 obj << /Length 1900 /Filter /FlateDecode >> stream xÚÅX[ܶ~ß_á—ƒz€Œc],Û}Û¦IºEÓöl7(’>xg43F|™ãK7Û_H‘öØÞÉžlƒ `DSI‘Ô'J¡·÷BïõEÈí/´¡'¼Xz±ƒHoS^¼û#ô¶ÀÿÑ ƒ45ÞUzÚ$ÐÞoÿ¾øîæâù+ž©‘Æ»Ùy:A Ϥ2aäÝl½wþ‹.½yy½úãæG7\è@i#Ýø@…‰·–*H… Ñ/¯^ÿpƒc/^ÞÌ­3QÄJ?Õº©:"Rž*ÐlÜ/?¿ºzýöúr•†þÍÕ/?;Õ0 Ò(øWFx ¸ëóúõ…·V:qB×F±áUüÖ7ù&ë²à~¥B?+ ËN»Ò‰×Bð@¤°ÄÙÜÕZ…±ß·¶%ª;X$ŒÿŸ•I¨ãïê¦Ìº‘&bSWïÃPîû&ëòº VkÀID<±oƒÃ îΫMÑoívø"½Ý0»­ûfcE[û H)ü|nhìÛ•ˆüYy¹°~\¨Aqb,l\­eúõŽÚÑB%Ðr”ŽÛzÓ—¶êèë./ ¢HÙ±Èr–d³ÍeɃ q*E6\²g³#êãܱÜ.CÿòÍOëÁUȽ¯û¥%Ø]m‰þ×b.}Š@ðºNÁF~c³m»P;U– bó-x Ç.ûèøv¡>xbzÓr1“œªJ‰áT}“}\mµÍ«ýú˜mV äƒíÚÿ—ì°#! ¿¯4¬¦Ã@Aøh@”sÁ ã}ì:[ÛuКýÜMVÝ iU_ÞÚ†hVhR'‚²¢¨W2òïès!”Yóô¦ÞØv0(/û¢Ë*[÷mq¿2‘œËwÎá8f[ãÄo²jo‰·kê’˜uŬ“Ôᔿ³UËCwÌ9€jÈŽöù¡¯¶Ý~ªΞ8ó1UþUG=9Ìx~“mí|î!ßœSw´ "„}náeV!\Hs+ $àˆp‚¡-ë†9¥úžè÷a^_¾F<ãñ µ-ËŸdË9•ì¬NÒä"ç°î’ø¸H¢ÆšÌšæЙeßZ—¥J$Cº8D…Ïƶ0-}ä+áWDfÔ ®u3§Ëqc*B0 „[d2ȃŽš®+‚,¿$þ˜á8mXv "&KCtWÑÂæêÜ‚§‘Hå"\ èáH‹",çS`Ì,Öà䇺ni»£0îPàýàÂÛÕZà!à7Ä%r±Ñ¡ƒÃâúNaÁž»C^°9‡ ³ùÏQ/¬Ï—ûÙ²Ã^üúö›U0ð(ÜŽ6pæ)º¼ÙÒwHA[ÕÌ(³¤ hr ´×$ÆÝ¡.ì ¢<ö¥]·É`™y7fp¢Ü†y…6»}âT¶Æâ[è0kF} 8‘3{P”Ÿ?´gŽqçNcù´¹C7gy7ö¹j öóØ1ÅÜÑ|`àO"÷ƒÓgVš$€ºÍS‘ ³¨UšœªÀXq•àLF"¤§T'zLŒVA˜J!<ümD€m95iB=;Qƒ|C™'ƒàÆz»³’ÃE‰>´® …“JEc4ž¥P1*-¡(VÎÎOMp/Û@±(B©“Ï©{Ôí‘VH’¿á³‡¡Â规nôÁgW,cÙ*ZÐM¡† W-×}UBÕúYe gýwx ÁÞÚÚKrÚÇfØ™@4$”>¨à$Ú¤85o³ÛÂA |Mê£Há)§B>¨>1C¡c†Bç“FŒܾ¬û‚U9í=ž[S ˜œ·„`=9”¸;‘í 9Ë \ä3®À+Ä'wïÓÓk¢€R‰T9ï¥4EÞvëf˜E<Œ „ÃŒ¡Ä‡%²e€†åXye¹¾ž™Ï•ÖÏÝš Jlkk-×Æ®¤N±†Ê´%¯~ïÜijÙ6O5ak¾Ô¤Ž%õ×µ‰š¯jR§Iù†ÎIÁ@–õ]½;~”=ÝS"„Œþ (“ðFüïí±hrùZ·ù_P áþþ|xw‰’)ו ¶KÕÔG,«Ö@œ½Žá0;¬u:}¼Q¼€:™5¥™öHܹ(`¸—hçe«N&p9³p Ç`åIzÁÎÍ;ƒm„Z1¤jÉ ‚Tä8AÈrÅØ´k^Y∊Z†%Rَзùà. ]° 'ç9Çê¢Û‚Ev‡Œ ¸Í÷{WH㘹¢±:Ũ±qÆqÚ`Û¤²v[—¶ËKÛ~âbjÀÞçÓäDÆn|Ù8ÝzéÅ¡å±£±óÚŽ¡õí»ó¥`þà!gz‹˜>lL®OÁV©ÀHùEØ*4LøêõâIËWCV¡a¥ôí :6ŒpQü2„}²¿F $%þ €¡€MÉKoÛც öîÊU÷Ç'ìgùðˆ9ÙõîÍq¨A–¯‘};lƒ±¸Ù7¨z6ŽÈù£éðú÷íÌÄåƒz¤Áñ£.~ôµ?’PÆ%Òƒ+ˆ\[‹0]êü0F“ endstream endobj 1289 0 obj << /Type /ObjStm /N 100 /First 971 /Length 2122 /Filter /FlateDecode >> stream xÚÍYKoÜF¾Ï¯h`/ÉAÍ~?!€ãÀY»ˆ!9ØdC F”Äh†œÈö!¿}¿ê)š‡CŠ£¬rTÓüº»ªºžÝRË“*J$ý×LúH„`J¥/©ˆ0ÌϤ‚YŒÁÀ¤1Ì©ôA2çüPϼ4YX}2,zM„eR®–qëý4ý4žÆ$xp3 þÑ‚ï?- |ȯ‹Iö‹U×’×*š?ÉNŠ¶^6Ó¢]Œ4öïâ²Ì¿«?²3pp_Õl”7˜ àŠ“û¾gg)ú$æ~þå¿P44æyŸÕr6{`¥_¶ñâÄ=âøaâh±ÖÅ«ªª±ÚÙ*R?[Û&À$;]^té÷¿Êêv’}W7—E“²fo³×g2ý ~¦Ç̱È9, aIs•<1pgˆ—WI/§,û¡~_3¨ô«vyÑbrYW­çÙlY^—MùùsUE7ÏY×E6Ï[0å‹E›Í.¾Í9ò4HÆ F ‚…¶„ìÉ£TOg½).çeUðzQTeuUÃ!¯êeu™'·¬›ë¬lÛeÑfÒ{?žopРJ‚_dt«·0*¥$ÆÿÅ|ÿ\GÙ'G§ºoPxÙ""H؉ñý@dsŽ4Þ‹CíÀ¥b¨p’vP¼ñoÜ3Å¿oVlŒ‹7òÏRQ¿qyÉ… º_Ã7PÕ*à EI>žf[0­»»;^]¶3~›—mÇ‹Ëeöûí'×u[×Ù"_M›½?9j?ÍONOùâòjÛ°¤hX@ÔòQp¯èJ÷vDN:¼®¢ŠuçôÑVŒ>}%Ÿ7¥.Ôœz.cP€(j5"Áï/DÖUˆçf»¡þkØYnQ¨‹È©öíZ£8u½@c Wp::. Ô^ _4ˆYÑF mRzIéCLJ­Ë-ï uPˆÑå-ò–3ù+PÊ-Z)gG³ýôü%dJR7Ÿ(šLój|jEp@…QŽØ¡õ ˜Sdÿæ b¦¬feUæÓ¬]6å4ïòlSÉdtö€F:nî¹µÚsjDGsû„:@˜í8­‡ú¶6ýýÅ6ÈEÅ•0€¨z¥Œý@ Š&?(bÏ€µò\!Hö•©½;,TlU(£B…Ù*ÌCÅcAÍP0Cl` ¤œÇÑê—ÉÓvOWh†v…Vïjjh¹lâŽ#/—U/¤-·«-kÆkËÚÚÚB Þr;Ìb6|뮘´3»:pêi:xœ†m\g_'î yPŽ}ŠZ•BªSh¥4šI¯âA©®)ð#å¹£¶Ë»v|~[óˆòîÞxEb£ vî£{r32½iЄԋ›‚ÿ–W—Åb–·‰a%¤Î¤|HÍGóº*»º)«ë£;Èuô9¿¸(?ÕÍQÝÝ ¿éæ³x@éŽ-—¦F>¨qrmé~ú Ùƒ4çÛ‡\Åé>µTt·Î鉦¨#ZIcú §|”ȼŒ?{½ëÏ^Ž÷gwïÏþÞŸ½?ÈŸ•‰Üx þÓ+Š~îéDpÿ’k¡ESӵȦ–Ý•·eö¶‚ÅÍf w~ÕÔóóÊn¼» Lãe‰2ºúãž–ˆÿÿ(ØiU^]!(œ¿Ë§·EמSp8ÿOÙíMÞÜŽq}뢴áQЋãôxŠ.‰{+ÿ–&õj`Ù~©àÛÙˆ>FÈ~ ñtó_¦Ö rO\ˆãょEaв"V‡ÜYOÏãÑ#µ˜'§Ì¢âd $ÙM²’×ï~:ïÊy±mA 4‡ =ÄRiïúÊSùëû2(Ä ÿ2©"ì)ÃåoZþ†­ò7N/È/¢„=/Æz英¾‹}ä!>ëͦ«œâ w*0+éue0:†/>±>Ülî¼®ê!ïÙ»À/Â-З^W·qÆC˜½×¤[@ºÕêÑŠÿ`» endstream endobj 1401 0 obj << /Length 2344 /Filter /FlateDecode >> stream xÚ­Ë’Û6ò>_Á­–ªÑÁè›íl\NÕV¼ö¤öà¤*’°æCKR™Õßo7ºA‘ŽŸ)4º~ ½ƒz¯o^ÞÝ<ûI¦^äi”zw{/‹¼,VAœKï®ô>øïÏÙC±ÙF™òíuG£×gSêÍV„þ-ÞéJ½¦‰ ¢@l~¿ûùæw7ÿ½°Yè bY˜y»úæÃï¡Wüg/ d®¼‹U{qªà[yïoþu² ¡]ë Þ½žpMU ée" ”H?É9ƒÍ³dä>ã¡DŸ(ˆ¥øГ2*aÂÃFì1d²M„BL·AxœÉ Ï”cÜio¿ÊùªŒù×Z1<VLcgÅP™PdÅîÜl‹þ9ZÄa¥X.È“œ–Ï`Öç›m†~ö¶h!£0‡CמO œU—vš9@ãÕ7èù‘¹‘E$£¯1÷¨·@€³‡A”J¤Híß]ãCÐD±jS‘‘^^ìÓ6Û¶ÛD¡_Bt ^ÜF@›Ob TÅÀ:aÒª‚hÉS¿7‡¦ÎîqžøÇ™ý¹‰¯ £4ûM”ø{Ýéf ЩkOºŒîƒÍ6Ž3ÿ—†‘Û=}‡ckã8šÞ‡ÄžqºlÒÄg^wGGÑ:®¥6Â×]mÍkÇ‚…y0î,ÇâtÒÍèA¨·”ŽûpÔ¸!p/è3›¦u1ìŽö42ÌAM Ê/ƾ=w4.'+ íiáK'bê¼Ã¹®‹îBl"K#’F,5¯ÏäTOÈ9;"[´hJÀIB×6Cašžf¤Cìéë,C›BsôO@x$˜gA.9‹`Žóa›@,¾E/)zg;£‹ˆî nš†ö4𙞦î40,:“f'àY>•Ór€¼†öÄ8ý®hÓhF~fIw7P$ôÀB¸úæÄ»í‚H;¤Ö‰níƒî\9Y “°mª -ìÛnÍçˆ%äÜqè$S¡€ÉR­k*ŒVUÿ#ÄÍŠÚÙ\BRIŸ¤”*Bµît×0Ü ‡à7oß?3MeM u[jpdÈàÖxˆÂ¸ƒõÐ5M~ è){B)6±/¢·[®di0d,Rgak1Ä+á0¼d˜€¬»â榮uiŠAW.gHe#‹:·y6&‡,ó›–A÷ŒÚ“M`T4èÈÂÛŸ;8p·IFæ?v®?Üo¨B2Ü~™ßa^Úiƒ’’fG ek¸wsDÂ+h­Ö}_X2ëzÙ˜ãˬêâÐ’ÓÛ0¿¥$òs5ŒpÓзàà7µÞ¶göEtcð ´…õe=˜áH£»WoÉCíl{0;èFw`Î1…Û¤f4Ęàtcú¥çŸO8rÕëßéÿèÝðY¿…ï¾(šýBª›ªaåfK‘Œ#«u“»Ã`*ð6§|Ù¢rˆtisÚ¬¤¸VIÀè±Õ-æT‚'vã*dÑÝ`x@”–8s!B8ȾâŽ}”È {kŽ˜ƒ—8F`dCÖŠóÐBÈ‚Å+r Hh±wƒ.1& A°‰=‘.ÉÅ(mš’}OÎcP®WÁ¿6BÛÂÃÔ0ÒRI®ƒí{=lgZBA~B­.°«ˆÈIâ² hÚ~chwmÕÓŠM7Â¥ „à®±Žó7¯þùv«»®u ff ÓIdX²ªo‰p#S~6F,iæÿÛV{+‡ÛÍfâg”‰ ³1(HJÊÂ+‡|¤÷Eݳ1M* Y:ÝsmÂÔ{ÒÜ9T†è–©`¬d úß™÷<Ÿ åx5”_Ø\ñd$[ÿR©5¾Jf@¯¬QYWé´q@JÜ+ùjQ€–U£¸*Àwè4­¤å‰BÔ´L¨Ñ§Þ@>-w!³XÄÿÛéÓ@ûu§½æ˱s[I¯W“:C:wcSÞ_æy£¤ùeLô£MûK?èšw(¡Ã6ýŒ\þ޹ݡŒ™^&uvgw©'®Œî™Ô¶þöX0Aåtý`Ù‹±~&u‰²çEIÚ¾7÷¦2Ã…p X9åîX4½t2àôFÅûQpÁ;‡^ê½uIèÉÑ›þ9a»;ûèíÔÿn—qö¹g~¢¡ T˜|׋Ü8ƒ\äŸ~)I’ Ué÷¼HM¶™¾H1ã¿æE 2p ‡oáÞMJ|zBË'Tóg©-=7Üõ6\].Ý5l}¹»ö«ë…«‚ßþœõõFzä+È"û¦×,z£Êço¸Q”‰RÓ–]¸Ö…{”(\£Ò3ïÖó¤ ż7`Ÿ± i(˜zF~ÍçH~û‰µ'Y\;ä)âX\·4ö9_üx·|¹óKÈÔ½lŸ ùð--SxXÌ]‡3^z áo¹ït§Š_¸¹|Åsßû¶ÆTŸ[{Öæph¸Hà)èÓh›\£Ô· ðuáÁôGá ~{<ƒŽÚ0zïKQW"ñil+Ñ”‰>Ù6†ötµ·ÇÜxXžPXpÌTŽãû§Ã{¢mþÃ4»ê\jlf•{|RÐáþm¾ÀýÖVîTð‡‚S¼®ê=uyEM¶RtÅ[,`>¹GtE€Ø¹BìiF¨“e¸°ŸÎ3êÝu&w óµÝF½úv­ó#“|yIR‘Š¿«¤(ˆ$ûL²Jƒ./Ø}{±ùjó=r"Eÿë|Ë?'üý¥—Äw¿ø½Õ¿ã(‚ )Dh•(±"ª-øÕ±8 îßG…ýeù¯I{šAyÿSI endstream endobj 1410 0 obj << /Length 1529 /Filter /FlateDecode >> stream xÚµYm£6þž_AÕM¤âõ ¶a¿µêõÔSOUïÒÕõTqÁdQ Iì6ÿ¾c<HrÉfÉj¥5~aÆž™g¡ÞÒ£ÞÛÉóÉÝÏBy‰WÞ<õ„VDÒÓAH‚HxóÄû4ý¸-³E\Ç3ŸëpúGeJ÷ôv›%fæ3:ýÞ |0¹‰+ã:‚pÂfŸçï&oæ“' 4Ryšƒð€hª½Åjòé3õçQ"¢Ð{jV­¼@…ÐæÞÇÉ¥Í\¹ôÜÇ·=©*$Š O3IB¦ÎJÖ \˽ôŒqO)I” ÎÉ ^&“E0ÏþÁÆÜlìx¤§&"”±¾;hA"¶‚Kã¥'%Ó¾ë÷BpH×YÃR2#ç5æ+J§Û"K3“p?ÎMYß[‡xœÉ"<Êp¹)â/¹IîÝ[;S5+ýv)´ ÝRBHã×S»;tÑÀ÷2„…á L|äi+"PòO_GJ*ÂFE‘ #Â¥:D¥ˆ°ˆ¢žš~¡à‹QtØžŒ*hÂ4úþ[¦²‹Wy)tN#v¸:ëm½ÙÖFÙ7Y±È·6‡ØÎ D6ïê…Ýõ>9 +‚Jý’°sÉ6ê%[°­Ô`3.Ýç6uJ°®Y¬‹Ÿ€Ì2[»^V¹öéÁ”¸xµÍël“w¯ÖÙºÀeñ~Q¶,ãڠ̥ŮI²tÆå4‘Eí†þœ1N§?¼ÿÕuÿ¢”çÆ™ÿ‚±[C)F4à \ƒqλ‹ þ¡NKA(÷6’’“Pè‚ÖUý7;vÊ*þÏߘ"ÉŠ¥¿‰ÿ˜=h8 ³ÐúZ†GBHãªÞ¯á¸$´eÑÒ¤ërŸÀ·6.¬Èré~G–7{;²ÌˆmÝR²iùxÌ$ëŶ{`ž8Bÿ½8/Mœà^€ïí!–Û²åè–È‘t oR•° šÀ<„l :wfnÝ€Ô*„Ì›G·U(Ðœ[‘Ózשé‚ÌbHv ú'“Æp-qz,7€s—@en ÉJ8xÈ–Ž»Áb׊ @¥ÂÐ-lx÷h/.qy:Lm.5NÉn¦dSŸ6&χNl+ÛïfRNñ΄fÁ{¤ µ÷©6 ŒÕëœ[Ô,c‡îÿ²¬5øôš«³Å¸òƒƒ7¤ˆ.q¡Ñ¨"¶§fxyjß&ãsñ@1°X>øÛcF¿{< Q üzãûDˆàf œSM8 Û2¡ÉÁëÅxÓ]Ä…{hbÚ~ *³$1í<¾±kJKè9TÁƒŸ£¼õjå":yVàô&.1\†·JÊ¡ÐÅC\,…ìÕusìeÅ©l E8h2»€T1Ÿ…6­º„iµ IJ}î­„Ÿ·ùµ= tð(ðÔ% m’hŒr &]çùÚBþ v–Y¨ õ(,3͉Žäkc¹§æÕ°Ì´&L¡{»|m1ì/N]æÜTæZS?PÉ¿|›ª»qð¿ÞÞÇn2R/*žMÁÇ_o­… åÞ{ËÛóvÞ}WØ;¨zdWƨz·1ÕLq¶Xm¡³4E÷VU—ÛE½m%gÕUX¢ŠDѸ»Ö/üB©'¸|ú*×ié# åÞIœ§%ÅAå¼Ôý¶Bw“L5uÀkÓW[øø#>'‚¿°˜víà× ÊÔ³l8 ª€ÁÓ˜+$ B\q¾¿<’ÝL44Õ˜8 <0uËcøÍþ¤¢Öy endstream endobj 1417 0 obj << /Length 2256 /Filter /FlateDecode >> stream xÚ­Y[sÛ¶~÷¯àÄ/vÇBÞ©‡NWÉ8Ó¦=‰NÓ™$Ó¡(HbM‘,ÚÖ9=ÿý,ˆ/­øÒI§„@`w±—o?浶lëíÉëùÉË7n`Å$œÀš¯¬Ð±B/"^ìZó¥õùìcͳ4‘ÉùÄ £³ Æõèm-Ùù„ÚgzâËY"˜þá‡Ðó¯ów'³ùÉ_'”ÙÕÂ=Ú¡•nO>µ­%Ì¿³lâÆ‘uÛ¬ÚZ^Á3·>žüëÄFCíæ_[zðámOj‘€ºVH}Ñà¨ä”‡~+} #¢ŽÄ”øL†m9±}Š"¨¥þaz†ÎôÔÄĦ´¯FÍ{¡Kâ02‚9³V£’í~ÔÇŠ j§¢»Ä§±Ú‰bOGn•å¬H¶lz> lûl•Iòr­¢R r$öc½4©*V,qᎉ—EÙoÌ„ý8 ì{.¡Qô?„S‰pƒG…sà7fuNv\ôͬHyV¬![cû,És=(Wú)7LÀ_BåwŸÝffg¢Î¥gŠÐmnÌÎsÇ?»mÊ~VŒ¯J¾MŠ%'ÅrOWÝO·VlKŽ¯–™HõHTIÊÀ"%J=ÇÔapeYä»N® 5…Pûúäe-«Z XãC¨ËZ Æ–¤ ¹M(¸Ì&Nà*oMø'!ð{Àz\J¢P«ù)+  K=LòÆ`›Ð*›ÁÛ·M‚ÂXC‡ ç^,AdŽJFÓ|“ái´4¤e!“¬Ài¥ÕÞˆLHyîëðÁCÀ‹Æ“Jœ€€£áfwɶ2óf‹Ž›Ú Å“pŒìq™«s†Çœ|±m§¯lŠ‡>Z`X~ Xˆñ¬ó›At¼F]ë9P×ÓÒ‡:-÷›H·ÿ¨l? ¿1¨ýÒö_RðmjGS?í¡:Ъ¨™ÏMMPÏ'TÄD¡bàwßéW6 «7ÿU£âg:…ý1©‡S³¹~~š½þãò§«Ù{üýêr~õÛìwý#û‘­X!t-N:Å=ô½üåç tSŽÛS™Ý0Ü~ ©ÌËßðE&yÂwúç›L¥ý½Wfe¦6ºˆ¿>ꈗy"D¶Rý„a;øÄÚv'ò ¤ÞÀôWU•ãr4QÊ$½6åYÉ3¹CQ.Îÿw~ùëÿôðîŽÀŽ tÁ󦑭g'ßë'aÒ•o ‰DÏëJÎøú ¸í Mé Æ÷)¡¶÷¬ªâ?£ãDÏ)ëžš~Y£à¨®=ˆ~äèL›¨ö0ÕUlŸÎ7˜ú IË!:µHÑx˜£º=.§ÀkÎ'¡£w«žÛ±NqWýë#“z Kýüb»aQªÿç¡C«}dŒ]ÝGÄTïE­Ñ#ÕBéæÕª-õ¬Ø{µd«¤¡#xœuÓÜ´Mœ¥²ä;òPÎ7ñ=eÑU«Þx¥¬º7sbß7 äbÏ8Ùž W< ïIw,Í®/”¸c¡1“:. ihã#müiyÃø-@‹dhÕí¦•üL&\¶~0Wò<ôx|e¸>®m·•ò`^6z§ó ×.ôÞì†u´kv>ÙBQ“çaA!õðb­ò¡œÌßçdæ™úùîã/ï‘&5DyQɹšfÈ0`ŠIßœSŠS ädWÒì@¦-öDÁet‡6’©ÝkŽJMÞfr£G.G=$ n‘e™V™]+×°–cBr‰ yYóè`Çç›°Bï ¾Õ¸Xú,Toµ ©š–ûÏ€ºGã†é2F"…)h Ó¯á8Múìõí"K¯N"’Ì~›5©©¡»ÛÖÁ:ƒλ|´Ä>"bYLZ1Ø?Õ,Š6ëцҢÞ} /w•}ÎÖuž Ã;Å_‹M×Ev÷ÇÒs«‡BrcΠ«< ¡€ÁäO‰=²ô´âl•ÝáÊ?¤Ììz¶è‡^6Äs˜S-b8ÉuÃø¼”tLù~+¡Xo[\N8Îß$y¶40n½ç<í&Ü´èU ºÙ|!ö_Œ®^%i–w«ó2MrteþÍqÙU±B?œÇ•¢—¹ÍZ‹g[Æ׬HwØ_)pÃñ%ô.°.¿hTBùÅn´§×ç%Ç]Ÿ^€ûð×ûD°‹Î² sXÔú3ÏdTp“WÓ± 8Å[’`ú+ƒ:!±á½'ÄÍŽªä×n[º-—&°yfèÁ¸;!1j&+ @Ú£ªn’¢`ù1Õ×ÌÄ[´Ÿ5ûÚá=ò>”9(æCÍžÃFºi›÷Ƈ¦Àõ¹³ŠåYÑÖFK®ê ©hÇY;®d¾üôuë/@ ÿÃ<ä_537GÈÒ£«øí"‘éf"²ÿ°Ží6+ ›²Î—¦nÍE¶Ç¥*ƒÈË:5ø½ÀÉ‚ÉÛ’_1)-!iÇBMSh•¤¥IÞEiøô–mŒv3<æzj•×bÓÆ S}¶pb°ö~ÃD¹O–!vùLÄ0<‹Ž¤ª"ÛC×M¶Ft…{þ nâÃ|"GK°M¡é=˯»àôº× ÚÄË­vuÛ z‹zùÕËæq”i,é2Ì =´¥¨· “L&¨ºÙ Œ¸f¬vûE½ZÁÆ/¨®‚ا?ƒ Þ"hXèýýß@U²ËËdàÈ0ê:jß5Ëz[µû†¿N ¼#i†»&úh}¯y׋A+ß&ØÇÕš¡óªÑICð@RÞ7 ùÐl«8Pmuê¾Oè“}ÒŠëÐ6‡ö°ëß—Û·,½f²oNä=ÀœÎ_j{§^]JãÍÒLÕ¬Pˆû#eÕ·"a…Úl.Ñ,_ŽRBÙ²ítÛy„™‹oÉbótù°y_þӯᾠþ¡Ðƒ }Ú7<ýüEÓ÷àþýà?hŽßÎB)~è‚A× I9°Q$Þ$•4|T+sõuXýa]ãͶCçýD·hR endstream endobj 1423 0 obj << /Length 1705 /Filter /FlateDecode >> stream xÚÍXYÛ6~÷¯6/YÀRuY’÷-E“4EQ¤(. ®DÙìê I­íþúÅC‡ee›‡¢Éƒ).9óq曃t­½åZïWßïVß½ "kël#?²v¹Ä‘³ 7V&N¸ ¬]f}~ý©¥$EÝÚ~œ¼þa*Gï[’á[Ûs_¯åÄ=.0bX~Žïx·»ŸVow«/+4º–gÅ>Ø­´\}~p­ æ²\'Ø&Ö±[UZa”Àoa}ZýºrZ·ûÝ[rpÿ~ 5JœÈ ¬ØÛ8‰-JŽAy¼1ÒG2Ðù°~»$µ¢Nç%J„g‰ÿLØåÌ@ÍÖq=o FL‡qàlãĦØÊg%»C×E¾•€ë¢P¸Îó7N (c7r’m(]ÇJÞÜÝÚ‘ë¾>cvkoÅè•œÀz,°gmÙj/?ê\þŠÍr”\dL8”Û¾çlc§@Éz;ÅjPÔûý…PŽö{œÉqƒÒ'Ì™ÒQS9 mÕ\ËÌ~!Ué÷\g»ÙŽô߀Ø9|ÂçcM3gnµTn+½Ã\?Ù»ÝG9úÝ~WÓ#¢Hx§Á²¶ijÊåÇãYþ¢,3¸Q¥¬}â ¬©¬¢ÄÔϘ)ábÛõS˲º¥)‹È0ƒíˆ“ZiüðÑ ¡˜)‹þánÜ 7¸êêõyQ•(Bq*ÁjoÏ‘ðÃY]©ÅÂ.ÚÓ¤š¬›5foëF¦Žü؈BOØÍØS\4y[(h\i Ï{˜^P\“ç$Õ7ê¤_±ÙÒ0eKTÔ2sy>ÅtZŸž'å)Ïïºy˜Œ£ñßdŒfŠ©U½ ww¬€Ó Ê:Óᄨ²>zF¤’×*|:vÚ$ùM[…üFSßÌ¢âï¦0ÉYS·)ês‰+>ªÂ g¨²ÿJeíE™Õ4+«1¡êlµÌP›MÓbÜÃzÌÿ%˘3|ON¨V0 κ¬—|wÔ“,ØÅ£b!*± 2:Mú(å-*àIQè°§ m«\—âÅd¨S«É9‹æh` Ž¼¾ê­¢].D GO:‘Š+ΧuÅ g’á9ë™øî擤Xo¾ãÇÛñ.[e@.ª½X…lãMAxBÚ7ɤëw¾à&åš©·ÏÔvRÁªRæœë¦I[ÆëRga(6¬¯–b«f8Ũíˆê±H•m6­/@d ½¤†â*}ÞGlŠÀ1M1žÇ8DÖ—š¶JëRÄÀšC - ìÿùMšâ†Ûoa“(ÆŠ˜jögTí[´×ùãMË5%w6~D˜ó±"BV±ŒC¸Èi],´j_ZL‰©:Õ¢Š![,˜8Ã9j nh¶6ÕkäÉŒ°Žp3‚„æóKx:‹û‡_>0£Ažb¨Â¿EÅ×­1²óñ@RÕ2Ýß+sœ›‹ú,t^቟!Òlœ9‡‘VÕʬÁ)Þ¾„šH¹ Á?5LEÚWãò¤]ª}Ûpªë‰Ÿ¼`ÿ‡<µ1'p ¹D (Åv‰ö$í›3ÛKz˜ÝŠÝžqçm¼©üÞX À5ùš¢é§O¬-µ‹Lϧ²,bŠˆ9¤-a’) Ël³^ÐÏÈ›¤˜ò7Ñìi/¡Ts Ä/å•Îd´V%íE±²Ÿqepǵà¢íïüõ}œÐÄ–4‰û‘VÔy,ô{EŒ#} ÔD„5wúÒÄÝ10À˜&Aqõ¥âÎkîåê &Ïœ³ÑÍÙÌ%NµÄo$Sª1ÒÉHèi̵ü‰Ïö&vÿ,p=z_Í…oôßu½LÕ!h—=¦©N_ÐÝAiµ‰î8YûøØJ}þ,!R°NhÀjÃrèï÷ÇÃŒ;ì FÈ©^ÒwŸ„ñ»«–½qq¶y½þ·‡°¯b­{î“gÑs/(?ÙÐsì»G…jo“Æ\fì ,Šs¸ T©©õ¤-=‚] (Yü¼¨úsmÖs·NÅÒUªíY÷õÎawéI’qü‚¢ÖyÎBWÎJqÎÌ|Lñ°thyÓr“KÇÙY’DS³ÎÎc/.çý ‰Ävlu«ŠÖ!¤»-†Ô46œ Snà¼Në‚9"¤’”ز„i—"¬½›Í>RN_jGOÀ›0p¼$ù†—ÖË_ßñ–ELß{û×dù;z™Þ„Ž½øaúòùD„€Èó¥ÁÇÉ×÷ͺs¾ ÀeÑÙ7ÜxN °[îyAgP Œö¥ý> stream xÚí]Û6ò}…€<ÔbžHê3oMÑ ®í]w‹{HœlѶ.²äJô.ö~ýÍp†²äU÷²ÝׇC€h8Î9ŸÞ0ØaðæêõÍÕ_~ÐI‹¾®VeÕÁýWmS°ÁÛº½ë¹jÜŸlg–§æ)<_0ÓÆXÏwÖÕ.#nÊq¤…̲?1"7εÈôSw:Ÿæ¯8E’ó ý°”ñLÅàJmg*ÊÛ¥ŠE³A×B̦m>„¡Úºo‘íáþ%­zcÜe…B…j˜Fð”%îš áÊ HåH9™EBƘݜnßß²6ï®þ‰ ŸOöx²$…m¼4PBÑž…`w‹c!S \sê¾Ù3{°Ca ®zú–íæt0õæWÍ3MÉqþ˜ið!>ªò˜}P9Ò|bh%aÔH4ª‘HÒêé´šT³•Ìrpœ4Xi)ÀÏ¿¶;ªR-]¶ƒ·K’ŸÀâäëØ]e÷½.ºIî—¼§C°¤aB¢ó˜RÔíò1 !U 'þ™ðM´”‹C mê{‚úÓñØv– Þþí6Œr½xëqUCÏë|w¦Q„Ö†™XðûÒ“Ó×îy³4[x˜Eqªí Å®jXÊ*mw¿Lâ…Í)ì¥é«]ãeÙvH?P[â˜ì]»»M­T;­WÐr]5ˆt¨Áyva ûNyDì‹®$¨¬ú †i¦wP óåƒt'Ž5ŸÜž:WHÜâصÓ÷^›5‹voé㤀í:K'("ÞÍÈQ¿Ë‹"²¾}Jh±ÖÐ>¡ ðj =ê¾`E¢¸Ãk»O´jÛ²AÈý€^S4, jÙ§-³K Æl‹’1t¿ S×XºU*»?Þ÷¿Õ«³ê3&÷¦á§ µô½Þªšólç3,få[ÔÏt…ßd»ô7xÎÍb;M}ø:ŒÈ5!ñ´ì«›U]Ð3pʸ¯‹ Ÿ^‘ÙPþ#™-Þn‰âüH¶3 hhMO›x…î[›Î¾D÷Ï^„s ÖÂRìxJVÑ&š!™°v©ºÿ ]À˜c?wëPËlÕœ\«XC²@»‡`’®i#eé 4¿j¬øÍ ¹/z gÚì©Vh0¬'RwèW2_üc_mö„vŽrf©§9š–¼£}|-ˆà[;RÜAG°†ÁáNf.aôBJQ Á§qv‡‹øl*î;GUÞ½à¬@ h]v¤.™Àù•½•·vKpµªqÁ&/ƒ Îïæ–.vË¢g"%zVƒc9Þ,3p}h.îJTôè•l»ö@YÀ1­)͇éât$4GAƉ·8±j¥È?3B q”r˜e $lhªÐi3 ^aš Öx<ÐÒÊŸccI±!Á… °ÿìÚڬƷÿ ÜËfe‹ÙK8{@îù£² ¯•ç Õa$¥§3m]Ž÷|zxا±û1±K á8¯ÃäÝžä1ÂVC¸ÝáȇzfîŠZNWç„=Ë°Lªãw·Ç«vq «¶a®›â0-PÜŠ Ž]Ïùµð™ûÎGvÈFm¤õ=f]X AǾe{||àÎ_§L­ÏÙµV"Qòñ$Š¡ûÊŸ3±ÄŒ'vfü_öËïà ²²Äà¿6Õ¶‚" *ôº8ºž!,S <#•?™©/ÆMÓëÚ”£!VÂ<ìxTýÀ„GÚÞSYø° Õµaô‡P§0ÊãÇäcz17nn«Ú ¦¯†YÍ^öØ($#¨ÝúiÈÅß[P]¨²°IÔ½ºß½Î*æ²k…eGj5Ñæ,’2žcOo¬ÇÁìŠõ½5Ô‰üñIúéŽü0œ€E¤Ô›¤µŒ„ÊÇcÊ|F07 !ô؆QÓüy5©ÿ;'AXI!»$G*Êa˜bª MùBÇG¬gŽ†ád&ü¶v<\د7ƒŒÏãÉ„" \8FÓ„ˆÝåyB¼ŸS?!ºör> stream xÚíZ[Û6~Ÿ_! /㢦y—äÝ-¦i:m“n[ M{„È’#É™L~}y([²=Ž/3((Œ(^ÏŸLƒY@ƒçß.?Ä$Ö\£i BM”TA(#"cŒ&Á›Ë×Ë2'uÒëó0ºü½2%¶ž/Ó‰éõ½ü;^™Ì$•ÁA8a½·£Ÿ.ž.>\0Ø‘,9—$¤a0ž_¼yKƒ ôÿP"â(¸u³æÔ<³àõÅoÔsKÝX9 °ñêy‹ªŽˆf"™"Ó{)‡°y¨VÔ;4"Æ­c¢å^îh ˆ,ö$X`ÿcØƶ{ZÛÄ„2ÖÞÆöËP8ŒÂ¥ ¦;)¯…Ñ}:UjD°\K«J+hªIKÔb¿××”^.ótšš ï'™)ëa¯Sèýjtcp<+fý<™bUpF‹Ð1‰UŒ„Lž\gf2Äùw¦i¤ÕŠ6š¿†àÛkScãO*¼°ñ½.ð9I+;y Ýí§if,ƒÃîyˆ;˜žìÇÎÄV1õ{4C–ç2ßš˜i²ÌêÕafi>k8+͸.Ê»¼eé<­=c‚ƒk°.7ë-«ôs#p»¦ËÇÜÌ’ë»ÚTn“V°é SRE'˜ò–GYRFÇxTÇ$EÜŠ.`’Z1"ÀC¸Ð`¸¢—ò Y,ëÅÒ·sc&~ÆwI™÷˜º¼KJP¶“ % èRµ°,i'£íNÎF”­ F8WÈÆ XYšûÐu Alâ;­%Û†5ûüq4ú/¶JóaiªºÂ·?©¢7u½ °ÚùQlÈöçxSm1Îp7Ûx߃¨jÌÂõƒa–Éø=ŽX>ì3É2lX†ú0aÚã ¸ |ŒkŒ}ÿhEfò,©¯¸¸¼ªqp\äu’æ~[g÷ -lùÃA`"º¼)ªÚz’ýýÕ•g"ŸlPpÙ6è?™Á¶k'aà$]­Gì}Z”ó¤N‹;nS{*Ûº6ø¬Àל.Üt|ºÍl£‘·}SNà¸Vrè¼vŠçšÇj{yµÎkðæé赋[5‚Ü$‹Z<¯¢}'žf’UÅŠñö™½Š¦´Gu'Q6ДÅrvÓ¼l,+ßp¶æGÐÐ9¬5‡þÊH£¡ov:Cƒ_‚N¹xöÑô³Â h†Œ“Erfi}·Ï\!5q."¨Ó>‡Ü¢"Ç I,|¥ðìS2_d§Hðáì…¬hãlкMk/ˆ¼ÈûÆì§Úä“FV^àCÏáÞÀçƒT0DêóÊê“q´?v‚xC¨TÎ(ZÛ´ËOøaÊ%lQçË(pÊdŸÊ!§C‘HD‚Ƙ{>ÎHî³ð§iq3 Š&Jû<÷õ×8DË ÕÿÚë¹­Aâû–ƒqn¯Q|†@ ¡M è‹dœæuQÝü û®òÚd~~2ÆƯ¯ñù>}¿ãM4›…¨/ïæì' °Øÿ™ëŸÓz Day½çÏ?Ž^üòM“§ßûŒý܌ߎª{} Î<7Ü3M ëû:'™&eÚ¡Š2‘T8=L¦Žw zâRwyg1ÔØ`°Œè¡†šYá&ýoýùc(‡#Ð=LFô¼bâx‡ØöK ÁÁª˜€ œ,|ˆØó qGFÀ¼bgÅ)cPû‚˜ÁÖØ9a§µK'ì8ºudÆÇãQ‡ !{ı ©: ê„»$<(æ„÷„œðŸˆó…(þïF#¥™šÒ”߶éEšÐ0<&€Y秮`h‰âù³Ñá¹b“Ö³Œ°6-‰RÑQGPOá?þ”¶´···ÄÙfǼ˜¢D u Ÿ\øüêîun!¤‰ðZݨrýˆQÿèp´‚ü” â#%‰ŸWê‰Ã5yÿu2 Ï ¹ë]Ú×Ó}  Ñ&¢]¼Ç²M}Ã^.Æÿ×PÏúº§éßò$‹” k™ lœŒÐsµÚ¾‘F±ÀÛm[BU#“F@ä› æ²¤ªW'ÈlMÒ–@},¼2;)~…¿‚®£”e>Bæ¿òl}4åm™ÖPðx27+Š%Üû“²^I£ýůK¶1_:u,Å)ɧÎéýG÷˜ÜóEµP¶Ü: '×ŲÞšùØ`§¼£ƒÁVH²¤d'¼ƒ­mèü_HH± ¸vªõýË×Øø°4ej<¦åà„ºÙª×á,yu:ÐqtE¢tAtÁˆºà™d=v™aÛ±içuÁ-´|­Ø·“‚ϾÇsB"#-ÌîîP,è®ï».V;'ã:u›[Ð'ß$5ŽÝ$ž•kfº²”Œ<ô#Ãnsú‘Ú³Økùžàˤ˜'‚6<ÛB¹¹™ üIòÚ/Bx ZÕÒ Ö-©ð9Úyí9©L‰â,{¿çÀŒºÎü0Ä„bYŽWÜŽ‹r²Þ„*hŒêÝqê5dæ §¼|d¦(b}ðü›@2ΡòlL‘\Ïp:¾Yñ  ÚÙ&©R÷Íž8)+L©AÕju¤¶’†ÍEe’w_{Ñ«•OÒ;&Xw¹Û¼ û±hÙLVz³¶xwÌe˜k 1ï¼Ë0—Pé~©ú„Ž}NiÖÚ¦]›yÂS›q©w^‡i8¤Vó£ôÌkÆo¨PÛ5WRy=mS‘*<êvôÙ,+™MI’kð@b»Å(á zÔåòÉ™aû$¬è6ï@Í0*á4ÈŽLn.¦‰W¦Zyeö+ƒÑ¨ø(ɦ õHÊص|4úº#4%HGG]’©²5hÂv¾ˆ)¡O»$; ¸Ç:ã9«d<>JmK°Íø´KòNd”sòrõY%…ÂÞUŠûrÂå$á«è- ³”ØôÉC@IP˜¼ ú) 6°ÀT õÎöú¼5‘ÇS›ÉL*(6šO}ŠûL$š%0i\L|Ó~Å4™§æÚ3ŽÙ’¯2;¿¸½úá)£BÙ–ÍwJÁm/¤{½PløaÌ@>¾FTJ^^å8ŠU¡à#öéØŽ\( ¹ßvÈämy+o;Ø”o¶íª`Á]U•aÙ5é0ÚÚôåßÿúâÉÕË]_RfÖhµ½~žŸ™M‘8+?3¥ Å#ƒÕ­] ¬¶p³ÒÞa(pes‚ês>TÑPBéÇ¢ù¼òÙ9csfvÎ ¨íoоn§n'î?ó»š^ÔQ”7óÂi)¤ÇèLMß“¤a_giЮär#K?–FvgéM¥œ¥Wn»‰KŸ„ô6ºO|+ù: ž¡£DxªO/ŽˆÛaYÙ/+òÁ*&BWY8™<-r›[gËr•‰ˆ²:*w@©ÎDÝCóãý’YÄü¬ßW¬wi§O÷rŸÙ@Ý'yՀaÐ-èýx佋§ÖÃÃ{ì^Z ½ÜÁ7œ¬Áê=ìvÀ݆©S0ûC {û£e¾Oš§Âö¶ M=µ$÷¹ÞØB°Z¾] °#œÛt&Z¿C“Û6kgË,);Зyúé\0M2ßîŸÌJè>+BíöÛ?ò†˜}ÚHšgç×èJ®þ1úNÜÝÞÿ˜±öV ã|­‰»žk˜gø!ÞþÊnÂM½ƒ*‚Ìþ1+T endstream endobj 1448 0 obj << /Length 2554 /Filter /FlateDecode >> stream xÚÅkÛÆñûý "  °(rù6ŠµÓ¦Ä€_[và¬È•D˜"Yré«úë3³3K‘:ùjçÔ˜»³³óÚÙy¬|gïøÎw7/în6 '÷òD$ÎÝÎI…“F™å¡sW:oÝ7c_RËÕZ¤™û÷Aõ4ún¬JµZ¾ûŒ?©ZÉAÑ$ô„¬~¾ûþæ/w7ÿ¾ €™ïD<òR?uŠãÍÛŸ}§ø÷Žï…yæܬ£%|kçÍÍ7> ê{Èç{" ; œú”JïùaJ*½^…¾+‹•ðÝJ“Àu»§Á;?ö»Bvk€À˜”°Rá|FØwÖ"¾1Ñýç*òÝJVë0Š\}P4°ÔhÖvºjŸÚ‘…dÈ Qª« vy·¬k&#‹+0·ÒX¶åLXD% p6-s.z%5€3ÂWŒRªd¬5úÀº¬úU» Uà[ô¾˜­‚Y-¶Š—,3œ¨z0*ƒî=¯W;ÞÉŸíÐÖ£æÅN¢7´¾ƒb–s4ÁÁIë5©{>ÞÔËÃÐ/š˜O&‘uA€㈥—¼ÔÐ’ñÍÿÈcW3%: X™Y‰V&[™åÍGTZö€n†™G!;,o™Ö–‰·øGI°{º•oÕÙcN´Øõí¾—GZ¿?TÅáÚAc×µ½.¬Fž‚#kïй42Ý‹Å1ÛÃ¥ˆÑ«á ûÏv÷òu9;žÍ.­™‚ÛòʆâTAŸÍZ­>}‚VhŠHfG¤«ªFnkë~˲ øSlL8JrŠ”®L‡ê¿Šuu¬4ÁV4 oHçâ!xr·Ô·îP:ö”5´Ú;I;*,-½ pf\­d¡ ù«nw iŒŠë¹ p‹ƒ,ºâ-†œY ¦”'gMrð³Ê6€nyµo5GX6–F¨¤Eº{ZlÞrI$¶ÑtI£”-Ë3‹â~›‚`å fÔÐ"]RÝ3ãÝ؈-ëJŸvEåwB„oöcUà zNiÓæç²&äç,£¤} „¤ ûZwÏ7›IxC;ö…BNAæî•×(½YdbçíZ$9;„€tFž ã¹ð={.LL´3)“WÁ˜ÿ ÉxþIbQfL#í¦<±XE­ Æû-?ï!d¡ú×ìS5%Þdô‘¥L!ƒ££¢ @°YºíMâq"¤FÀÒDËâ'®‰3Z©9çMI€°sIÅä$MÍy­‡N:g1Ñe9 Ò û±Ð£¥Ç&¼¹Då5•ÛËSÊ{†)õÐÌxÀ¢NL2/ B'sÏâÑZ1…r2§zqA# „‹Ø‹‚GëMÀ½ÈO˜DààÈFí!dÆD ‚9„Gièåif ÷ÊÙ]¥<•·_SÄ&ÂÉ ÖL".bc‘{i–m¿^zÝæ_ðoýêÕúÛo7_ïªZaÝæýQWG5hH¹2f¿&À£G¡Àýr+>!¦Ïø,b:Sþ}‚z,²œNk ¬.€W9"ðâ ‡cõÁÓ‘‹›ç«u `ÃI«Ð–Íω¬mß-*΃ŒPÿ@(?P…ŒC¼ƒøÅÊø mSá2a(¢ç$ù™C#p …CfôE—¯h†.#^D ‚Ä`0m¾*Ã22¯M3ß—7OKy¿ÁËx;Òð£ü·ä¼'>xA}æå|¶ÿXá}í·­}ûsmî7\ï?Ì_¿ä´º.Õƒø¸÷¾à5,Y<¹k¿’>Ô‡À@Ÿ:LnÁô’°}unÐyvÞ5d­FS¾DŠ uØÔÆ ém;2iA †yý óÎ2—¤“½®Š±–}Í  ÙtÕTÀŒàÔâÕÒ»E€OOíõ ÿLbÐÕ~}œ6¯Ð4™DS<íÚ¡ÒªŠ„Û> ô•%1TûFb> Vaæþ­5Máâ,2ï±ø¨g:]ØV3VÏ<øÑdP½±bSª£•°Ý] Ëc;6zZ¼ªÿìŢUÓdštÒÚtÓöôÊô™iC@é *?)m©€6xüBÇpmDö”¬1c3ÏLø÷I²h$‹¤aüoì¸Ç´àglÍ Çþµi >#¥ ~Ó" A4ðÚ0Î ƒÅâdÁ›=š½QÚÆõ0…Ü„ œñ½ÏHZ3µ<Ã?X*†¨œ/vÌÃ.!¥e.›–8ÙLjí«†U›šß¥pJeשÆÚ4Û ²%ºØ[ëØw–¹Åkk òìB¸ZzÒÀvOŠÑ³³ÜÛ>[ÁüóZ·õzÚ•dtz;vZÚ—9IŸºÕü(·#À2© bÃozÈSÕå`~€Xã¹³ºÌ½}m-Á%ƒ ñÜóý@8}]_O¯‰³WD®1>ùcýÐr‘¼±—TT¥íÆοÍôjú%̶ì2/Y#pæÏþaõª«G îƒ 1Š…Q꥙€üò ;mÎ0à á¾l4ò~ìIÏ 1<”ªj endstream endobj 1456 0 obj << /Length 2356 /Filter /FlateDecode >> stream xÚÅZÝoÜ8Ï_a`vè8¶ü·nÛÛËâ°È6Yô¡]ìiƚĨǞ³5Éå¿?R¤ü5N.—=¨%J")Šú‘ÔÔs®Ïùù䧫“Ó¿±“¹Y,bçjëIìFaä$aê†Yà\åÎ×Åå¡)6RËåJ$éâ÷V5ÔúùPäj¹ò½Å;"|V¥’­¢Nà ×_þqõËɧ«“ø Ñs|'À­õ¬£4Æ™®‹V+ã›"Ž@7:‰o8~ã…™õo˜C>#›z·£c‡ÞÖp%ó]Q±¿Š8[t“H䶓zsCD:Zä§×O5÷&ö£¡Ì©©uW”¬Ks`5mXsç¶zÕ{Àn_*mᤩ7*?Xt± +- º(®{/2`æ ?†BЂ0—¦NèvDülàv¾€¿ƒMÖuý}‚‹ — ø‡üÌðEÛ8uc?p¢Ôw!N<pˆÉIÔÝ‹ÔN$BׇŒàžÅn&Rfá;øªQT;¦ Äd®çûC1H“ÀÍ’Ô2n”³å<ÍF¹B,œr…8Ä\ò(FosÐ+¼œ ¬Ø-Ï–« ‰?/À€Ê //ùŠˆÝ4ËÀaä@ÝšdÝ2qá01Àÿr£*šoÎŽÃÕ`u§³#éBîêC¥Yø–‹¢à¼9ïCn!ÎE˜»›ÂÄ5€xÙ´¿šf!õAïz•S Ñm4Ù O¸k ­U5ì–Ó9…gÜxbàCJ—_9‚ rE$wk/mš¼&t ä C‡åü¿‰` âb‡q¤³'F<™žŸÆèñn‚°†íªæ²tƒ†xÇá QAýlÀƒ|Öô(AŽ…)³µ-da#=!éA4r;ô éqp90´ÚÂqÝ`þòðä~¯ªÁ8Å蟗<·vÇ5çó­šd"Àdzc¨fçMt§¹*:Éjng]öèÑ?:ŒeÃY^°÷ÑÙŽÊŠ—'/@Í#ôF^$þÙ@à PÌ>¯Ü·\”?1ø² nl³eV=x¢+ô¸Û×m[¬K5Ž­ªòÉ{ÖàÝOÚA~¥Âç|)æN¸™<'~Bà†Ñë*/áC¹"¢·®¼bÞ¬ò±çFÁ8x›0øA:®—ì—1˜“ ]ìÕ³P@XÛÇ5{vÃ9­‚;,ËáÌ_RÐõÓb{;Öõá¢o&zlå¦( }f÷´‘em£Àyõ^š\rä:ä”C‹[l$Aóµ˜ÌFœójÛYàÅ ô@œÇÆ#“qXíëÔîVwˬW4êìÄþ´S͵ª6÷#Þã­çö@r€è’»Ÿš¦n¸ýE6 9÷~­ažz7´€]qdù¨Ö‡ëWâüóo÷1È æ¿æýÔƒ“Í?6ø–Zï1ÖòBü“Ô\ü£>OçÔ,ª­™ßì$£:™Dœîí(Ë‘ò]=¯¸Ä§Vá~Æ —Zuó½¥AóÄßó‹K‡»‹'™ 5H¢˜”7õžZ£ßTÀÄé5ÏÆÄpf ±¸À3]C¯”¸„^ÿ‘2ù„¶'ž¾wJ¢%(dåã-ð³ã´ÞD>î¤äGp®*UÚMz8*·æ”žøü t£äUq/IÜ0|óÇ^Ê›E=_DnŽßñ4žU2¦á(ømi]1Ëʾ26=ûÁpáËž#ù;úŸQAéÉÿq`þb¥Ï?™§.þ.w‡v¿ °~.3„P”PÅx4Ý÷“QØ›ý±ûY­ endstream endobj 1464 0 obj << /Length 2852 /Filter /FlateDecode >> stream xÚÙ’Û6ò}¾‚o¦ª,†o¿9vœuª¼ë'µIªŒ‘ ‰kŠTxx2¿}‡ÄL6©©6F}C¡wôBïû»oïï¾y¥^©N½ûƒ—i/‹ó ."ï~ïýìÚrgz³Ùê,÷êlËÐ÷C¹·›­ ý—ŒøÑVÖt–Q µùõþ‡»ïîï~»S°Yè)fY˜y»óÝÏ¿†Þð?xa¹÷HTg/NsøVÞ§»ß…"h(/ t!uª¼&n?NGR*(’D»3©0£ŒÏôÖöv×—MÍÂÚúXÖ–¤ýëÛ]]_èmu¼Óûº»Ì·Ú5õ/a¨Ck9ß8WœbØ%aN÷'¸ÚHeþÞ ¿¹ û°Ñ¡?”Õ¾ãqY÷¶­MÅ£cÛ ™iüíÊcmú¡µ]°Ù&JÍ4ÓUc¯‰TE±ÿXö'žz<•;{'`mûÇ ØEÓ~‘™Ö6:ññä;<2žÔ“òÙË Íÿyd1ÜÓùbZ»ÑÒ<–ÃÃü›]ÏT% ‡)ìmz&8›z£ÿ‰ Ú¡²OìlÛ›²®dfÚ²núåÞµÝÙ®3íÓ&M|à—0 ß!ã¦eâ²îzSïì+¸»¤ðË£ûòO¶iÍåbM+˜ÅÉE«³û‚G²(C8Þl(œÀ¿|Ë3?½ý¸½´Mßìš Õ rßÐ`nR$%¬àvÿfZ-;‘Šê`$›?ÈVµµ{¸z8³‚ëÍ":9ñ¤»¦-ø{S¿d%‹0É\˜•˽kÅ»Áw_¢m|…h²gDYãW‹Ñ¢qêÈÿGƒT–hQˆC1Åž(*|ãXu}[²+°Ï!|5_ÖGæ;3˜]àI¸³aµðhè ß²_E¦3âa™=7£Ý$:öÿ +·0?Ê¡´ß?]È"qP=]$¶ï˜ d@û|'µÌãA`Û¸ÈÐ_ZáV ­áÏ¥éºò¡¬Êþ‰çE0µ/ÉK°´î¯DãÃÌüf€yÛ\ÀÍJG^Ök‡ß>“Ùhp¾rddø½Tf‡¦ 0ÌN}¢”“ddø5üqŽ"Í‘¿ ¦îép8«I;æ9툑´=SÅaïx<˜ ]Û‰Õ?Z[óÚ38%«˜†¦Þ¯:µmÁÏÈõöès¤¸žGæÜ xÑ:OYPøŽ‚,‚T‰ñ·,–9ïŒR¹=ÿ æv¦Z&þ0C!'‰xM-köeËÚ~¹šu¬‘”™„ÌfY”à÷]¨)V•šú*:¡Í.z¢jÿ+ö”`7 ŠH^>ÞSñ¨DôcS€+ #«¦ùÂÖÑøeÌùB‰1Ý„53¥óŒ 6eG< ñÛ›ö±G8)´`Ãe¼±¾ÝD™o-³^X sŽ ÇùåÕ):+<Ëž9a2!ÄÔáè¡…”t¢×¬í_ËéFA-eÐDI‘ Ɇâ¤(&^jŸùQ5M5P!éµÀ®~y’~rÿ3,#(@1x²fÿÅ‚¬ø´èJ¨7H ig’•ùõJGw%@Î[®]¤b†.‡N3KòªìdCjŽVÌ~Ù@Tþ!€$%=˜Z椇Ÿ“c(e*ÓÁ¾ùãyÒT+ÙuM@ú¯+¬Jšé‚ð99]å¸#ƒt•+ÁÌI©(ꜻ‹{~€ª©Ü~DC3=¾Qm?˜~'=^HîÃÇÕÖ —TØûWh”37†%œ‘È÷®üYK –BJú*€Æ‚®Ûµåƒ•’Ð7 \)õÛÓ¬ü»˜VPŸgÇ`ÌÏ2¶¶‹| /¤í.uźVü§t"S›rv%àANàl2“ëᳬõÚ'HðôgÛœ±û‰•ÿ­ÝyÔÈo#t& ×Ù¨pÙw2üÀôƒ+]àM ,›³åùù©p,‚düª’¹Wy©ÔÙÕ«J¬Ç÷¨Uó#}E¹¼N1ìn@òvF10ÖÕ/Š_¨!°‚x<¹‡‰9¯±}GÒ“q{r~àöj4h£iÿ`“é0K­(Ú¹)ž‡¬ÊzN=ê*’úÆ?UäΑy@GUE6^QÜ^-Ì9ë Ù)§¦é,Ãh‘ aý(Kº'"G`÷ŠkyéAì¢ »‘ÕŒb~FÎä|a1 +÷7û™CcŽ¬ w<`´Ö¬(œ&~0Å |¬™ŒÍA«ÉÒyÈ)˜ß1}…Êÿü˜¿`,J'[ŠâµºvNíÞEy–Uo¦NØIÕ@ycn+ç7H_ŸùT/päLñü°›NÆH1nD“q#îÆ°¶)Ä%~ôAŽüâì˜Îb&Óà4f·=Ül+[ÔV^Ki *£i³n5.#i$o©æ,MøêLWxR²@ä›_¥Í©JÙÍ•»W7ÀBI ‹šköKµ8rÖ˜þÑ몘eN4³ïæýUñLwÆóch˜M îÀ™Ê¾¤DÙ 7Ù ~d®ÏïñÇÎíÉß™ÃÁHÒ‘S݆\Úxœ©…Nñ_‡Þ^¯]9¿¸„DS]@œ ”ªsy½Fþ¼T! v] ÝÀ¥.”6ï{G5T2ÏÅ.àØóØøpLéÆŸ¢²]ÇXh ./xb?XƱ<\7êñV02EzÖÁ]¿_ªÓÚ‹5‚W§‚›ÆµKhÐ ]‹ÄÝJ½w¹àfJÊ€k*WQ_5J£-`byÎn’Ðõ³âm6Ùó‹VÊ‚•æèÊ`¿›º©Ðù³Ö'…Ò']ûõÒI@1õÿþ&½ú£y¬¥¤ÒT*'­@Ýd¹vØ›“¹ôî÷óCÄè7Ïü" bþ½Qx endstream endobj 1471 0 obj << /Length 490 /Filter /FlateDecode >> stream xÚ”ÉnÛ0†ïzŠ9J@5á¾\ƒ$Frjcõä X´!À¶JFÛ·/)Ú†7n¡G#ò›_³ÀL²Ç*{xá ,ZÅTsàZ¡´0(,‡ª|ºõí¬ê¢dÚä?{ç“5Ù¶+JJòoÉñî–®î]záÈŸÕ[ö\e_  PÐ,Àj¢a¶Ê>> 4Áÿ¹5ðkܵ¡LX—0Í~dd§ö+L"“ãÎ Êã–¢$4Â^WñÔgâãŒ÷É‘ePQÜ0ä\ÞT¡ƒP-JN††à\!U7ÿ„€!½v‡ Ÿ ,AØ¥ç(ŒEBéq˜èš£ÕföæWÉûįcÙŽ+Ëó ‚î*ÞûYQjCH>êuÓ¥ ö¼óÉè»­Ÿ¹d¿~/ë¦ñ®ï1; VÚDjúá©qýЮë¡íÖwáúMQq®Mç‡ëŠn".8W|Þe'­.GjÌtÉe³òøÙüK³žV› y¬6ÕhÂäyþ]¯6Ë8¶’ä2-On¨Ûe²¾2ﶛv½HžÁ\çÎyÙ:s)©»§üò. ®0f£JƒCI;ÜGø§à$¯W˱ÌBRä†à¸R{®î/@"= endstream endobj 1461 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 438 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 22854 /Filter /FlateDecode >> stream xÚìÝ\ýplT:·Ñ (¢ˆˆ€ ¨Ø]`¶bwñØ> ±±»[0±@¥én‹ûßvc"% ±áçóâñ9ŽÛíî¿÷¾¿ûíŽ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAägüýýMª~ýú²êFëÎ~!ç^î§<눇}k†„„„¢N»Í—¿üÚlñ&ßœ^ª¯Ò¬Iã¦}]›hþïN$9óüb½>ÛýºªH˜¸“ßžÞ8]KQ²^ÃÆê­­¾Î$礞.Ùs—àh%¾k(«žÉåÞsÔsÙ¹k`;Mòéä4Ú¬:õ¾ Ë‹ Å_Ž3lOé†õêKÊŒœ3·•œ>‰Ô™2 Oéf J®S¥E‡ÿÝ +Þ8™ßzš5”¨ßXAwÏ…mÕ§òÖ?CcØ®gÖúŠæÇÈo¬™¤!ߤ^ƒFšÆ¶'sȇ%žìÓ|ÀaÁ.Ä<¯'¯Ï$ˆëƒéÓìïc¬F>‚vÛ çƒÊØ ©·—v˜h+Ökب©’Þ´Ý/É…YOfH´_Î["뇣=ÃäuvŸßÖDm¿<òm¨büxçXUÕúõ$ÍûÌKæ¯íéÞé-U¥šH6i,úâ"9gmo}º*­UÛŽçc¹ñÇì¥lmÔ ²Àʹ3DÝõêÒ¡&rƒÈùÉ/Ú´Q¯ß¤I3E ÿ^ç/›ýïx{yÉúMêI´4·—ƒÎCäïDŠzƒ÷úÞÅ}ûö;{3jtýö\ðe§…íw?EõX¼{zÍ}ÿ¾Ó×¼óK|»ÎN¿vúˆ»ÇÑÏ)ÄŃîÑéL"éÕîsÏ8îûOæó ò½íá¾ï¨×õ– ]K <{èþ7ÁJR>ï:|œ¾°ïE2ñÑûªûÞ½³])Þϳc/œ8ä~ðè§èT›¤R¿?äîîqøå×r©ÈƒÚµì7yѵg%TáþwÉg¼øè='é¥û…O䜋'÷Fdp¼/¾âÇoµ¾9vpßþC¾_’ïuóR÷ºÌe 6ïé¥ýO¾d3S#Ý_"2BOz8pÌ+:“Sü=p±J*ÉPEöü§,rêã¹5J-;“ׇiËHÒν#·œð÷\%M3Šýu“ó¾^“–Õ»B¶]ÄËC“iòÒîÿ §¯¬3£ëéžòþœÍdç<[#¥ØÞ;š÷¾:µLIµU››vi¬âÀ½‚63郣U—ûÐÅDª‰ò!_Þ“]Û"§¢Î*%Å}ºÄB©Ã&ï›­.6òô6$RúÓåš2®æÉè{xas†ib±U˜`h6z+¿“0º›.£©ñròøâv4ýVçüBròÙI©˜¿Œç•WÞ‡æ)©›¿¢I^CUG4û±~Òê&ä3ßrЗn¢êù†÷êžs“Qmõ›JŠÝS­É†û1<#ÞWR §2¹,ïyÔ9©Ã“ŒL6S vo¡Ö´Í\ÞtêKi)ùγ½ø눵Òm¶ûA"‘øTBBùJ8ÿ×<þq‹æÍ}RÉ©²’zÁ_.Ás Íá´`k£ŸIi˜òºï¨L“]xà^z“ÈþÒZVqÏ£p^c”©zÓÿîEEÞÚ)gÔ=ÿ¨M½ MVÞDÛ…üµ•ÔþÉ–ŒÖ]œ'Mîoc$e23lS?ü£Òuü cZ¡SÉ¿½Ë‹ºÑÛt™0ÉÅ®½–AßeÅZøÔá&Jí»›äâ` ¢bªFóùžI|Ú¬Ôeôж*=†L"[•Û«{Ëkw?iâàníåZöä7úDø~[Ý©÷¼_Ï5mÑ‹÷ο—²ÃT{cËÞÎãÇ™hÉ[Ï8ô›JŠ×^‡vÒhÖ¡ûg§QFj2†t‰ûË iúà±..£ú+ÈЦQ÷Nôm۲Ϥ7ý>Y§ß>iFëñÎúZ›tqr ÷:AÎìcN;¨‡¾™Íò#_óâ_Óš6³2ÊiÜ(5Ù&«/ñ¶9-L‰®ÌtO-꯺ð|BFÈcš†)CVgø¸ Ã{™7Vêø>£h_M1¤â Ušÿ{öylr–p¯H¤èã.M,W=É ²| ðçåUtçÚv§ÎÃþnk çN!µ¶Ù`ê]÷úÞ¦Cvß+è?J³RT=þ=/½¤”†*x:öR#é×Rʇù%ÇLq$(IÐqý°™Œ…”æ¤ÛëÌŸ¨ÙÈÕ;ŸËÎ xÃÛ‡×ä"_õ¨ùr©Þ-"Ê}pÃù<¤µ¶{’Ú…åÖ†Çü v!±£¬Ê™xNiH©:z Øýfãîd–‰T~OÆÓvßJHÎ/@*\¿ç`Ãb<†50˜C!ÕL¶UdA%;º›úÎÑÂÇæf¥E…ûµVhüˆ‡q’MSå'ùe!ÕLs“¿¢/×wjšõ þÄOð†¡6=VŠ»÷Ÿ”nï÷_ÓrØ"ÒM µ„T²Lãü?5n~J?û¾qYl©¦Mä¼xï숼¤wªt„|ª¥0—U»žúk ¿i4/¯u‹¿¦NS¡’l"w‚?Æ+?#”N§gp¨?íu}”{/zTRJŒ¹Ô³ÅÝ—k¢ñ(÷—nŽâ•ÔÑñ¶Z#¶PóFW{›{b¬uç5ç¨nÍï=ë<ïmõÚží{½(vHÒ;ªH^úÂæ?eÞhMy ©~V:–sŽPKé¯Øzê=ê)’n¬l 1˜Y*ROT5N4]kǘô±¯ÌJŠ×ö|¿³³SC5y9zÛcÞR]¿.tÊÖusð¦Þ:š›››™ì»}tQ‡Þso »þúvbZÓÖbÎ+ê9[¶úç⛂n¢ü…FŠ³Ÿ§e\.©¶¶?>Ý͉Z¦«Þ•³’âægh¨Ó^ »XY!Ô9)©^Ôï?îC”úîúÆÎ|ceÎÛ #ë¹DÆæòæ©BìÞ-mØ’W°_hØsÙ[j«Gšèî¸\° ÌY-ä½Î- ©.û_ ŸîÜX†åúà2‘"’Î[µi­AW’’ÕÞ~í=‡[€Tö£fòfÉ {¿¢þ,RJ&ÂwŽ]ÕøH±îÔ\NSG¯m‡Î²Íʉ”¤µ» ?¶€®Ù¢cG3*æƒ7œ"ç_Z3ÆØ°…’œTKÛ±â²Ñv!m%µ°¿MÇhƒÇ¥¤&›Ão >ü#¡íBý4Æ{ £•+ëgÇ.·AÖvdºÙxG2— o;ëO©f„ËÊÖÑP¥’ÐK-´¦Ú'—+hOŸ]ÚÚ~zHuqÿ"ܶµæÏ'—ÝÝ7´‹Æ&^ÿÄ4+͘ƫ¤’/ÌP—ïé²Ò/8†Å¼"æ}º+ozN8A|ß#¥4LØò|Øg%@ÊBuïüy‰›)_þ¹QíËßL+)e&‡Kmίe ¶“~ÓÝÇe3™TŸ(ñãé~%ý .¯»O{Ê5aì ãÆWÒ ?è܆]† h&Óµ‚©Î³_QË,éÖ~ô¾û+Éè!¯²/4GXIñHŽz%¯&¨¤cŽ ŸnsÇæýNÇ•·»ÓAƒq:XÐ J$>m.ÝŠBJÖƒ‚uræ4œp;ë—å¼f4Ò~[0r þôèó~"ÅÏ,sà '_¬$ÅFZéð6©Ç©]È {$£ÙŽBJsÂá.¬m'9ìBrÙH‘‡:z™!wètÆÃØlö3ª’z§ÖXëMÁ†%œ× ÕœRŠûzm›¢‘-³àµ´PmTRžÔÖæ|½+­ÕA€”•;53ðâ†V£…`™©IÙL›•_ð{{i±$Í1 ò—ž“"ÛHVä‡GsÆô’•SÔÒ1M$9!‘ÒŸA-ðýæ†éjö/ÜœŒô ^ÒÉ?7×-¸¿üœ«§)èî“Л,8ãòf>4¯àMÿ›Ókõ휋"õå'Rö^‘ÂÍÛb/;ò`TÙH °¤í¸Vp½Sv¦:'ÅÍˈ>¶eQ;]eU†Ö¢û)…‘bçç v 3ø°²‰ºs^ÁÚÂN÷ ÕIåàÃ~}c,E{%!©‹tó3ñÅê'@JE×ÅœtÃMº£Óoʼ£.­ÊëäUu 2:8<¤””^ÅóÖësPJ¹uxáWwÿpÕöÔÌlïetE™"Hñúa¯N‘”µçoKükU í47û¶K#µ1¹ü>ÞÚ—®mH!%/§p'‚÷:§~º$¯¢÷‰YsRw'¶”7œB­óÜšþÂsR*Jªù•Rä½Í”Ûý(v¼¥ËIjºo;ÝfmFŠ'Þ¹1Íä»P¿ߟìTÖ6Ì!Ò•Q’Z¨ ¼¾®'­…)…”¢¼âóhÞË‘ðú„ŒŠA·ìsRºe.S5/'MƸ-DŠØÜKÞÂIP¬ 0ÕkÖznÉHÝŒyr…~×qÔœlŸTšI>I õŒÿ«‘viXSíÉÔ»K«ºÓô;FŠÏ˜¯l3†‡à­Y¢…z“>™öÍÔ·MÍʶ ©âÐL4^ÈßYIe8;Îœ~`¥Ûj0Ž~L(ŒTZè9£m[ðյ㿠_V°wrï.söPÞq˜‘Z •"HåÄ?gÐÔ“óÆ_biãÀ[>lŸæDê}>~u«´Q_ )«m\ˆ‘›4ßJ”ÔŠ~z¹¥ÖÃÎüN£3Å1¬žyÖW ×ûK³5tƲKëîcùj6QñÏlžGOÅ_â7su› 9“$`ú‡§¤¤idAw_j>54‚;\§¡ »®Æ¼-öZ6¼Ýèe Eµ£ÿß¡¹"ÃÈÈ&'ë¸ù6ÕÝgë¶Ý@M©U+}™¦rë®~!~9µÅ›zð¿‰Mdé†ú:ƒ·Ø™Ñ<‰ç±X»õ$_á2Çæ÷l*Ï —‘•U9ÄŸŸÑ»•2C×ÀH1pÁ.ù¦*™üî>‹%ÿtДoeÐR¾¹ÌB¯÷D飞‹v÷ñùL3E†NKÕÎã–u—RüÊGªû¦ÿé2TÈ]’”ß|'¼Èzxgª’ƒºª5ÖÖ7СÉ^<>¡‘ñJÞK0ƒÑy®¿pÝîÓ»4WT'wAFŽqöC*E´Ž¢ºž¡¡Íqù™æš‚î¾Õ[Ú¨+’O'ÛTvåÅà2vª¤.­ÒXZÙÐÈHSU¡ÛÜã,.‘ÿhª„ñRÞKžl§ÞX‹¿aŽOl؆*6ÙG¢¡Ž‹fR›.ÿ r¾÷ÖlÜ¢µIÛÖúö‹NY¶V¥µq"·g¦QÍ–íNÇï“­4Ô[h«Ž[¹]JJ—‡Ô­mÿîcøã}’M¤[©É5qÚ~‡Š+rH+)U­F-›7R<÷6mò·v÷eÚ«70có«·W­¡ÉK½OÌû‰ïtÖM™îNëüÞüoþpé}² ¿&§¢o©7Sž³Ýë͡£­4ètßÈBHñzz˜å:öŸõäU€çÖ¹ŠR·ø=I>ó”hmÏ?ûäsÑÚT‹n܇BJYVÒi‡ŸÏƒýMÔÌFÙþ"Hñ`ú|T¹)mοÇýžÝv´mÕRwN꺫µŠ±ýÙû~¯½oŒ´Ðì0ÿ¹!«ìÚ]*9-£È:Û´î9ùÑ«€S[fÐ õè½=EŠˆ~¾MV±Õçî¿~z¥Ÿ±ZÏù'øgHâu›+[}",âëz'k …”¢ n>äÚc_¯óÔ›7ß÷"­HQ¤’¢pLOˆ MʤêRÝ~$ÿ°ÐÐä,Q¬Iøâwâº/'5:4‚W XiKÞŽ`¹Òµæìä˜ÐðLQð Þ‹ú=,äGÂÏã@"e¹ó Ùv†‡†&d0‰2‡;¯¤¨'Š‹ ÿ!ÁÇ%‘ê{6‚|çš’Ã)iÌ«îa\â[XHb6ñý´§+Â7µæÌÄèЈ,>ýÏ–OîBTÒÏ¡&$R]=ÞÜ,òˆ%eæ—½ Âóæ¦Æ’‡=6%›ø…4æ5÷P.A>EB6¹w°Ö¤CDá«&úU3“»ð#>ƒÿF/>,2Ëïú ˼&LrháÖþú‘=ÁªòÉ—Æ,xøíßÃCÿåOJ!mwùöðó“ÙºÚv6ÎõüK¾ñO×üïÆÏ¿AVäú»wí:zÊ‚€¨Ü_þZøÓ)Aw&9ôïÞwÄÉgzªïãòˆ„çkþ»Vè¯8yÛJמÝl‡ŽŸ~ãm´°Y;¼qQ/;ÛAc¦†~Ù²ó8…Ô°kAÛ—L´ëÖ}ÂœõaYå‚N_žœrÙßÎ~ЖSïïÝžA¶Qy‡7-ÐÓ®{ŸÁkvžœ_{´o@OÛ%w‹tx’ ï_5½G·n3Ü…žé¥ãò˜œåypË›ð,áþwÜ»›ý€åÿc eywaâˆ~¶Ýûmð|ùâ¶ÇÝOÙ!UõÚ¼:¿kXß}†?þðsñÖ²Wœà!Õãèû2–ÈÿþˆÞ\aÙÖ/œY6Æ\·—[þ|†‡ÔŽGå\¸|˜¥úÍm§NÏé¤Öyüñ³Nìߨ.#>0¡²;ÁGêÀër.ýÛ Ìž×™a1îø™ '÷oÒ•?ó&SBZª¤~?´•[æÂo.²Ÿ½[P•…ÜPU2H`–¹n — ®–Djð•è2ž®Äóé+ö¾³è•Ô~]mú«ÎOCbÎ5UXà›Qæ1(ùÊlÔ7<¤tÙÜ’X~¤ü·Íp{ü½ì…•´vÁt— ö_âþÙå÷{¬¸ñ¡j‘òÛ4y£O\YKð7øá‰í\\&ÎZöü{Qy ¸;g­¹_Þ«1•µaNîàmØÌeÏ"r… µ‡Ô…÷çüc„©Ž’²vg³ÖŠêÿþܧfóúõk´QR@J‘¢4!+¦û÷ï/Z´H[[[¢ ß¾}+ÁšBs ~ʶSmx%¶ðln¥+)A€R…3vìX‰b¹{÷n¹WÀ¶–“¸óû倂) ¤*ZIeggÊÕÕµ"küH!R@ªÊ‘"ÿݸq£P(%%%.·Ô.»? B ¤€TE…4hÐåË—»téB Õ°aC&“YM»¤H) U~ž‚ƒƒûõëGNÇÇÇ“H…††Vß.)R@ H•S(GGÇ…†‹SBUGGB ¤€T9yòóó6lXBBBµ’¤H) U¡°Ùì•+W®Zµª†yR¤€*;aaaíÛ·ÏÎήyž€‚) ¤Š‡òˆ, f̘qôèÑZ) Š#EmC-nIi A€R5\IÅÄÄèêêfeeÕzS\¸’ú÷ßÍ%n‡ÃÙºuëöš‡‡Ú(H) U“H ‡ð;wNDv¡0R3æ,lgÖ¹¸Sä·±±±q5j ‚) ¤j )__ßAƒýøñCtv¡0R3ç-ö Úšv$ÐÕ† @ HýeHMŸ>}ÇŽÕÝþ“+òüÅýGÞåúzüÌq¬óç>äô“g~ƒGŽ9üžðxCtèdÍb±à‚) U·‘¢Úù/^tëÖ---­6‰ÄŨs/—õ§Ý<Ëó5qã'·SäùïìÝwøäב„…Mw&“ §H©:ŒI†››Û† ˆšê@#Ÿ±÷¸ÅMå¾Ü_s~":Ûö`³Ùp A€ªcHQ {XXX‹-ˆš=¿S%HQN~O˜[Ú ¡@ ¤êRI£G¦>Ué*¤x~ˆ6{qØl´¤€Tm…%1èæ–æWö¡æ9™™¾OO7²§¹…ÕÆsïJ«†Š E-óõëW;;»ÔÔT¢6ÆÈURÇ‚ý]SSSÐP Rµ˜ ¿2òú‡n?{þ躑œÂüû¼ñáƒôµ[¶Ýqéñ“ÛžZÍd‡»ý¶’¢<êß¿ÿ©S§ˆÚÂM"ÕÇyÉ‘Äá÷åú"Ë%áô¡w¼^>ê„”n».±±1h%H©Z>Œ[¦j÷lFÂóó^ñZæÁzM&mFÍd~Ú­"kŸ_½Ø)¤„CøFŒAݪ°ÙìÁÃFºL›ã’õ¥h+woT“1#‘ÊK tèÖº^ƒFõ›)ÿç"¹ä–ît®¥×Êãk*© 9åììüöí[ … ªDnÎk«ÑaDo2cB—–Ò4ëD‚ØiݼóÂ+¼yé¾MžæuYqúË*=âŠ\%U'}*”pó†îïï¤RjA‰ü’¥ËÉ\~kÊ%Þím cA"µÚT¶Ó¢«ñ)é…Hï#«t+³2OSMHEGG;::†„„P7ð­>°þ)aFŽ¤RHz°´²^ « mÏõ¥ÎI姵ÔÕQgÐädh >M¤bcc% âààÏb±ªC«*AŠÌ¤I“‚ƒƒ‚ @ªä‰ßtjÀ¹DîwM95Ÿ,þ49?ʳ±”yÁè>.+Ÿ™›øÉÆ@~îžç‚Ôœ9sªãÈ$$$Hüš† ÚÛÛÿþ½¸SÅØ*ɱRh«¤¨ç[²dIhhhÍKR¤D)ªULOO?|øp‘Ÿ¸÷RгßD}³k²msU«d"ÇZFqÙKAU2oá”oSHÝË«LÒ½{÷ùóçÏ©ê…‰DI144,zˆ·Á1ítd¥›+JIj˜|L!÷„kO£/\9AINZZ²™nëŸ2YÅ6Ve%E·uëÖÕü¸t … @J4‘¢ÆÈÈÈ.]º 8›Í.L 9ÅÊ ³Óh¢Ñªm{šý¬ÕMôb "äúÚÆ¥Ú›[´7`¨uý#‡\–µÐ¨A 3Û“áþ¬T5UR‰‰‰…m²±±¹zõ*9³ÄJéõÞYöS¨é½}tÌ7½$'†´”6í7Ÿ5vÎùJm0«­’*¼UË–-«áû<)R¢†Õõë×jÆœœŠ/Eýï뇷Cã Õ‘øæMPh´`]¼±ÙoÞ¤29Ý’j:'CîY¦=z”,K´I˜°3Ë%5MÝ/<ˆËüÙÛ9P£þ–'™‚Ç°¾i+ËM«ÆJªðN™2¥&ÇQ)R¢ƒÕ ’íê Aƒ„…FãƉZº€^5!•““Sî»úò¸ç¾f@w e©FšÝå¡ÖŸ!q"’ÿ3.Áådê«)¼aV7R 5jÔëׯ‚©¿°’3fL‘35ŽŽŽµu9Qø0oRLxdœ Úºãfß\e4› i5p»G™ÁÍù¨¥¤’NÔR >\x_&?@ A€Ô_RIIKK …ªW¯^-î‚( uvåh½ÞSXùLf^nðÑò¼ÓdƒõeµlÆd³˜y9é›íéªÖ[ØD"EÆÉÉéÓ§Oùùù222}ûöR¤þ†JŠJýúõ)¤&Mšô7#Å/ Û«Òé ƒNSmý9…¬Y¸ýÕš,Üá&§LcÐétž¥n«>¤¨·Ë—/'ŸŸz¥’““«£àR¤D­’êСùþ\AAlúˆZ½“µµ5ÙÎײSü3OÙY™™™Yå·?½¾gÁÊËÎÈÌâü䬦‘RSSÖ¼£FB%… @ª#E¶{yyy:u¢¦³²²öìÙS»»@¶>ttt$DëÖ‡<¤NýøýrÕÚݧ¢¢RäìaTTT•% … @J"·´´´®]»y¯^»4PÝ}ÁÁÁ}úô¥C˽qlß—r\C£Z‘ +2Êeâĉ¨¤HÕ=¤H‰’““íííE¬`ùyNŠÍfÛÙÙÅÇÇ‹×KP­HQ¯TLLÌàÁƒ…Nýøñ£j_A … @ªv‘"Û´ŒŒŒž={ŠšP…‘¢6ÌÆÆæÅ‹"¸µ‚Tá#C¾‚ݺu#‘rqqA%… @ªn Åå‡ÅbuéÒE4[þ£û„÷«=~ü¸¸8UHN^^ž¡¡ajj*B %îH ùŽ;Šl›_|:¹~~~¢7”B$ªŽ)RµˆT‡D¹©/ísRÉÉÉíÚµ}§€‚ @ªHQ½|æææTŸØ!Eð¯4hРªíÚªûHq²&Ú÷ H­À5”€‚©FŠ)acc#ú»PR”­‹-ºzõªÈ–T¢‡T†¥2Ý;!H!M¤¨Ñæ¢9–¯BH ·×®]nnn¢¹;"Ô/‡%‹Tn)ÇH!ªM¤¨OìŠàç¡*‡”p/|}}'MšÄápDm§D)ÞyrbŽ\“’2S6²Pa•”÷dãA›Žor²©/!¡l`{éM,QÊ•€‚©šAŠºêuM qùœQ9/0Kî›ÍîÒ¥KNN*BTò͹Íåt.|Ê"¿Ýâ`Lc¨“Hùα‘‘–ŸuÀ—œéwx¶*ÇA%… @ªV’$¼.Ÿ¸ìBù¯‚Ní”]\\œèìcm#Å¿“o·6ÓÜð ÁɈTQU£jfµ¶`æìVŠ7€‚©ZDªC‡b· ºUµ›[·n½pႈ8% ç¤zuTÝï#.ÁN·àœ ‘2YyN¸ÌWýÖ‹^)R5ÙVs8333òߺ”¦§OŸŽ=Zœ…Jj¸•Î†óüûÜs f’ÿœ‰”ÚXwár'{+uþß … @ªæ‘ÊÊʲ²²Ó]¨ÄM)˜‚ƒƒEáZO¢pNêÞüî f“òùßÆ=ݨBœ“’’Óñ¦zøÒ?h(1nÆ2‚©FjÏž==zôß]¨ôy©Q"}ûö‰‰ù›‘â?Ož`©!¯Ñ¶¿½•¬¦M_åæâyHµ8ÂP]µoÿ>êR úÏ9@UZ@ A€TåÞ½{fff„X”¨*¤„{=bĈgÏžý½H‡°ï{Oü…3}æؘ®¹HQïÝ}‘ZÆ/ B UMyüøñ… ÄW¨?DJØð®]»öرcµ‚µÈ^»Ôùò, ¤HUS*zûøº‡”0/^¼ptt¬ù¡#"‹ÔËeýºnº¤H©ZGŠ* ÒÓÓétz _•BD‘*8å9@ A€”è Åd2Ëß|‰Q%E%//ÏÔÔ4)) •Tù¤H‰RGURRêÓ§ÏóçÏ+¤÷׷袉•9sæPNî]õݯH!¤Ê@êòåËzˆ———DAdeeÇ÷àÁƒòÕ`>R±%úõ³o©ÂT9RÔ6ìÛ·oÅŠÔœvíÚݺu •B Uùwï^¯^½æ•;óçÏïÝ»·DIqvvŽŠŠ*©´fâJþYšµDƒ+¢RIQñöövqq!_bjsrrª£˜R‚Ô1¤øMe~ÈÇ·~~~ï>'ø=i¬¤OþáéÙñá>þ¡ü¥8áA/^¼ ‹%Jï‘#+©+W®TèÙÏœ9S„'MMÍ &ÄÆ{"þt~Z´ÿË—¯>9/…H%E~}ùâÅ«7ïÒùÖŽ~w×FAyçÃWQÙlÑAªÈÎ:99¡’R¤ÊÔkGMM}#ËÎôÔmç\$g¥\ÔfÎÑvúšš6¼Nª};¨µhÝ¥‹¹.CÁùà‹ÒVT‰sRÇöõM:5;;» sb^ÈÉ+·7mg¤om©¦Ô‰DêûÃäiÚ¦–]Ú·nÑDoD&AÜÝ1«•¢Êˆ¹Ë¼ã˜=Õ‡Ô«W¯ŠpL¢¤€‚©ß$?H[^åk¯€Jò=­ßÅ‘BJYA)(™W˜ÄÞÛ%mØK°pêUZ³–áùU†”§§ç’%KØl6ñû!ù‹d;,÷£¾¹¶rtS«$’•23|²©™Ž¦Z§ÞåDzY¥[™•9Õ‡Ô°aÊ %##CTõ°F … H«¤r[jª´é1æ’÷'á,)‹]Tëé¹v`罄`@73#“Í­2¤~–s¿i«¹Dv˜²‚f`.W0""þ²”TÇ‚¸2EW½Ek·Ó ÆKˆ RÔÞåææúúú2 ¡S«V­B%¤H•Ý|æ&E^>´¹—™nc)å>.kHõð¤–ðXhÙÖêö@BI¸UÔï“þYZIï«à™sŸ«R礸ùo½¯º:öjÖDR¿M¿DB4+©Âÿþ}Ó¦M”SQQQUXL)AêX%ÅNx¾qëÁƒ¸§j’þ¿"u{Ç“óÁÈ…œÑöÖïRJ^Õýû÷===«ëc¹œÄŽÒJÛ¿r¨-ÉöÞÜP®s‘¿gã–è‚‹ÍÐÖiÝE‘Eª¸V1›UûŸ“*V¨¤€‚©2ZI?%]-Í [[Û <FÎÎ|±nèÒG‚E"9èJïn–FFmzô™Í!J‚îàà@RUŵνsFtjolbfuÐÛ‰ãŒÞ ôCûu7nmÔμˬí7¨…¯,émbdt$4[Ä‘ªò)AêZ%õëµ…Jôå· ‘ºv횣£cõ¿nÓ¯›Ã-¶TŸ¬u¤øÌM‰ŽˆŒŠ£ºas“¢cS³™™IßÂÃ#£ã¹{ ¤©“H ›îª½F75p"==ÝÔÔ”Ï[ŠB%ufÙEºzK£6êtFŸÿ‘N½^Þ§ÿye]} 5šÖ€lnÉ×-R‚ˆ5R…OÙ[[[wêÔ©Ê‘"'üýýÅñ%¤Rlä%O|ãMå%ÑÕj—Í}½¼_3ÉÞ¼ûÙùi Uú…ˆLTR‚Ô ¤„ ½ÿ~ìر 6”““«Ú'¢¢ž®k×®¹¹¹bWL‰B%5¦ƒ|›nÃÏtF›‡”á\á2/ç·n1ë1B¤n EÆÝݽˆPžžžUþ,EºråJyﻤ~¾¥ˆ8rð|5ûÝ„A;šöfE¿æ¦³ Šbö‚Ö*CÏE)AêRT¹T¯^=¡PÓ§O¯Ž'*~Å ;;»jº'EEŠøa*ÝpÑ Ÿ˜¸¸à—7Õ•_Äåø¯è'+ÝtâΛ‘Q?zºÉ+i†eæ—8ÀH!"vHåææN›6l¾(¡Z´hATÏл/‹4qâDTRxGA_oíjob¬££cÔÖ|±gÁ?'ÕaÙÎÕÃÍ[èê¶1µ>M”2H!".HQ ½~ýºmÛ¶Ôœ 6H¥¦¦VSiS)ò‰Ž=Zô«ƒ•T ïH¤Œ*c … ˆx!Eµc–––$\îÏ©§¤¤Tßö—vY õ')‚TR‚ˆ8R”G”q«Ž»wï^»vMôGPàÚ}@ Aê@Šjÿ/]º4vìX²r!jãªDeßOjøðá„È_+ H)Aª©ìììÉ“'{xxÔ"e EnR^^žˆ;¤€‚ UŽÔ³gϺvíZëíÿoïÌëãããïïJ H)©Â°²“Ó˜äDJRBn>GD¢<ÊÍÍKíñÉ ;cù3¯Ó«ïé*ZI}øð¡}ûö,‹>´ß"EE”G¤) … µ››[&ÛŽÙ\¡‡‘ÊÎÊÈgWÌßãKÛ÷\Rµ•å‘­­­ŸŸŸHÛr"uÑ,¦€BZLÔ¹ LŒt Ú™¼šs÷è†aƒŒ™º<4“ßúó[ΫûVØêò=¿"5׹߃à,ª>ºòßòMZ¸9« bzxÐeíÍä—'×8pòÒ=¹gÇmµôŒ‡;,-O›\N¤.^¼èè蘖–&j‡·œH‘éÛ·/›ÍA§€BZLNLØ–™C;õs xBœí#ÍMGœ8{~çâ‘’Šm^æÜ°Ö l×¢Ï ¯sç0W6uæBª»‰"¿»/½žÁ€y^çÎþëj/§Ùé+¿ ðìêŽÖýָ߸v¡ŸšÙܳDZô¾UÎm¬Æ½òþs¤¨5 >œ‚@[ør"En9)Ô˜1cPI) … Ersë”nc·ù™Á -Œ_‘ÿ¹O0°v>ÃL|A£é¥²©â(yxkã«)EÊHyºW¦Ýpá §w5˜{—‡ÔZsc;W~³ë·YMNûžXÖ¡×Òrn[iHQ]¾|yРAL&Sdmù+)2§OŸ>wQ ¤€‚ˆRŸ÷¨ªôÏ¡ ˆ€sÿ´´uI~6Ÿf4% Að_òϹµÓ•®Û¢‹µ †tU · üJÊÔvÎ3Ác—4l»¦ªÊÉÉ™1cÆ©S§ÑþQ…"ãää$j{¤€‚ˆRéw©*÷Í)¸åÁÛóëõmœ’N§µYÄ*˜ÉÌÍfr‹ •{}Ûd«Q닯™‡Ô\Ÿ*DŠj½_¼xall,ǶBH‘{—‘‘aaa!RN) … "‚T~úG šRh*U6³ÚÚŽ=–sŸAÓMÊ£ÚÌœ¡ªõ6éîËŒ¾±MÖ¸Ÿp…Ã;hmºú¡:"Ó«W¯;wîˆË±­h%EüúõkTR@ H!HRÓ ºùøé+A°ÿµcе­]¸¶r|o•¶ïy7;eÎ4VÖ0âuõÚä¾T͈N0gu”1hßëܵëóúµi.oË.£’Z®Û±à» òœ –|òäÉ€Øl6!ò×»«4RÔ~‘³X,ÙG ¤¤vÃNظpÚÊmçøßå½¾sbö´)«wÿ–”-8 ÅÉzzaÿŒ©S·¹’”Í3"'áËÇo¼Ñè!ÁïRÈ9\‚“Ÿñˆ\fʔ͇¯'ä°©ÞÁ”˜à¯?²O“Ã_Yô¶%3º¯Ðè>SSÓÇ‹O•®¤È0™Ìnݺ¡’R@ AˆBÃ!øí?·Äy«_Z P|ù2ž®™7¸½Ñ€䬔kƒtºjmçðß)o‚ˆí«£d¿Àýñ£{S,TôýWå•”pû}}})¤š5kF–W@ H!"¾HåççSMºÝrss+ó¬ùµååÃòy“¬ø¯N]¥RP2Oåÿ<ðäJ 'Bð¡²/ÝM»†åV=RÂ$''·iÓ¦^½z$R5?ÆH)—Ô| ¹hÑ¢Š>Dâ×Z?>))©Ü;ÉûoJÿ’Šz“¸]¸ñ˜º–!‰”L×#Ô"G–uï;íoQ®ðTqw_ñÃ>jÔ¨+W® ’R‚”SxxxÍ?ûèÑ£W®\¹´ÜY¼x±D);vl^^^ù÷7ýÛ›­Ë¦Y›ª´êÁ¦êáIýèðÛ>SOò‘â/™ššÏ©F¤„[åããSÖBœÌ·þóB¿‰'‡Ô¸qãZ¹JÏVR 4PVVÞ¹sg…*AVÄQcÓq™‚Ç„é5¢ûr"E®âÕÑåš6Ž4„h7kò*…¨V¤Êæ Z³q¥–ž”ĬT ¤€‚ˆ¬PïÞ½kÔ¨ÙÚ7iÒ„¨î¾JŸ“’––>~ü¸p›¹\n6ž›b¤M³1ûÜ…3.}L5Lí‰Â•o5 ƒÔ›µ²ròò:ÖI[£Õ”3D)ý}"ƒTzY¥[™@ H!HáéñãÇ Â’„ÔªV6¦£ûΟ?ŸššZ¡Ò©øþç¦ÅÞ³qÞüÅÇ®=ÏÊã]ø““• ¸¢;¹‡™ñøÌî –^xÌâp nõv÷•¶©ä?1Ý»u2ëÜkÌ·hzR×vÍ77ë`Ñ}èsþÅêwöÑÖ¤Ó Ú¶?’¤€‚ˆu¼¼¼ôôô wš‘eT­Œ+#*û9©?ßÔ_¯éέÄ5SIý¸µ@AFáÈõÇ~÷O¶Õg(ªZÆĽ…•LÆ?õ{ùàØ™¦Z¾DÚ€®rÊ߆§äUx;R"ReÔ§OŸ¨.>ajk{þæk÷•#é}•dçÞK¦Š»ˆ³K*X&Ät­f×]{/œøœÈBwBºäTDD„P(¢öÊJÆ%o,Ê(.‘õH±¹YI}>;_¹qƒ.Ænß{4à{:ÅRR7„¢Ú¥]»v5lØDŠlfkq{€T¯‘"¯¨ý5Ÿ >±E¤ß“onV0p"çÆÉÝc†÷Ui*éá—¤€‚Ô¡f̘áïïON‡‡‡ëèèµzÃA Uf²òg#¨o>z¸6R´J"Ò{´2~P0$~ÃxëñkÎ Ê"*ñj) … ¢#Ô”)SBBB Ï©Ý[⩲“üÎÁ ;,Øô¿UãimuèâäHuÝp×áSÿ-wT•n~ìmAd T”qv¿–ÉB%¤DL…š6mZDD!J÷jR¿}Õ2Cw­_±~Ϲ”'¢F›½¬H‹.öilN­ì¿ðš_¿~‹_XI‘›Êd2W®\‰J H)¤#µ¬µL§…§nß¾uëöíKÇ·(4ê?ïHù›ºp¸Ë×?ß„ŒPyUdV- %¼.ßëׯť$)òaÞþùÇÇÇGŒŠ) ¤€R1¤Œ¤{ùA”OÁçÖ6oaÇ)©1/6'Û¼!ý“à;nñå‹<ˆ?³Øz~EªØ#ª±íŽ6üø±½`ů81xð`B|:ý€RH%‘â³’éw¸‘²y"AÄzÙh/|¶ÅÅRBy2ù£(ÿ‹Ýõ6d÷¼˜@Îqn+O£ÓTTuÎóîÞCÜ=¼FO±‰„D#‹!³‚’¾\ß·DMª‘DC©¡³¶'óѼ(ßÑÝŒ6¬/£ÖnÏÀ"•T„ÏÙ®FªŠ-,=_ÄU_³+m.²Ÿ‡*'RäŽüøñc„ ¨¤€Bê*RöÇc š<¶Ç‚ôCÈÉø‹ýè:´ñ¼bR²‰doFC¹e¾óƒÎ.PjªÈ#'ݼý=ÿqé>+”i-}ãxÐü7½›¶ùpÞîÍRÕî‘GNæL²¦uŸrŠ`&¶•Rþï=rVêëÃjͤ± !Å´Ôl¾ñïcªïÏ,¦ë´åTOu mîãã#v/X‰×îÛ·o_HHˆXS@ H)¤bHµ‘UU”“¥"§@£iîyK!¥ 3Éï‚{¸k¦á Ù‚Z‹ ÌZ¬¹ü–,¶ÌÑ_ñW2¿ cìÕÁÌOZÕ|X„£mýÁ=Rï­Ýw1íó9†V{&GÐè±È¾÷ÄÝD¦©øÊM_ÃWb¨©µ0²¹ñ%§Ê‘¢„š0©Ÿ&jÉ©ygV™#»oŠ¯Pe Eí‘¡¡!Y‹òÞ) ¤ !5W]Âbÿ÷â?ˆ;cSÏê”°z:³b`æŒÞ}{Ñ%ŒÞpƒßf¦×ë`ïøˆôŠÈšb«IkiÖ§§¥”m߃ÞÏÙñÃMäuÛY÷²1‘¡µ{Í{ÿÑyÊÛõîÛR©©…Ó6žké_%š($ò»ûÜFš4WÑëÓ¯okM+— \‚[%ý}±|ÞÞÞâþ‚•}ÓÃÜÜÜeË–¡’R@ ©¾ã.ñƒNį7LÏOøúøÑã°d5‡œÇÊŒyðèY*[°¢ïŸ^?zêǯ~~®íK€ïŸ¶ð1<Ü¢½?ú™NüúQ(j2!4ðÑÃÇŸ£Ò…>V•P¢|móªBŠÜY77··oß) ¤DôòÕªyTž7Û"’g[œ¦à}¸)ùÃ~«Ÿ êV+22–BêE.µ`n;íÙ¿îBªrHQ‡eÓ¦M~~~µ~ˆ€Rµ…Ôá÷Ä‘ûrÝzáé“Çbt$…H}¿9qÊó¬‚fVðÓët»:dèÛÖJÓùþ…¿i•®¤ÈôîÝ›üwÆ ²²²@ H) ¤þ©”/'ÚÌ{VPd» ˜Â¯¤Z]ˆIÌäü%¥S"åííÝ°aC ~˜L&R@ H©J"Å»HV…c÷^GEG^ß2Úrö>R¾9õoZå"5www—(”Í›7) ¤€” uþÞÝÛÙ¿¦œãý²j<,çÍÑ•ëÎG‚.>æꉃ:u2ŸºAЬ=^=00HU8ùùù†††…‘’——R@ H©Zÿš²Ékâç …²zõêäääßî‡ÃyTã‰ÅïR5URä¿“&M"U¿~ýÜÜÜšï/R@ H©_Úèå4nìšBY¹reyª­ü…§™j)á}ðàЩ˜˜TR@ H)Q@jm¡ˆ8RH5!%t*..NRR’DjÎœ9@ H) ¤AJ‡3jÔ(Ò) ¤€Rˆ¨!E•T;vìˆR@ H) …ˆRDíûR@ H©J Åb±¢¢¢¢k0äÓeeeUÕñ§. ¤D?@ H) U ¤RSS׬YãVƒ!·$  ªŽ~~¾µµ5R@ H!u©º1ê›üÓ‹ŒŒÄUÐRHÝ«¤Ä=”MÆ C%¤€B€”h:µiÓ&ò¯¯nS@ H) ¤Ä7'ND%¤€Bê‹.zó·#EuO™šš©ªŠÏcÕ–Ö¼œÂ.˜Å¯¤Þ&çñ*¦<z£V_7Sææ$Å&f1Râ…”»?áñ–p´2PèüŸÇbÞbÝNÓwݘµå¸Ž²â°ƒß‹VÎTÑ4›¶ë攥‹•µ×>Ê£*©ÁÄ´ñÝ•'ÿÐÒES•u¬'ï¸1cí&Õf²C¦ýïúGûŽmm]m¼•ˆJŠÊ¥K—ÒÒÒ€TU ÏûçÉ•“†÷nÜ eÇ>÷cH…§3y½zñšËZ'ÿ\øç[ ¤€”ˆ#eB“ì2qǘŻÆ,Þ9pÔ0%Y™)gâɲhžÛꩇ<ÞðJªeõÚ¬ 8”Ñ^¥‰óYzC8ô°âµyÙX­‘ÿÍŸ=œn8äïxÕ–Ç;¶¡†Ü¢{ÄÑÄ‘OÄ®£kéšC÷½&FØšýIw_^^žo †|ºêë‘#[H&“Ù¦M›º7|¢*).ëúé“ß2×ïÝ6ÅÂjðV‚ÉG*ª˜‚ *ÞÍÀôzÛ´9ç?¢’R@JÖBÕŽ3Ý#¢ãb"¿Îì­5pù=A%%@ŠØ3¡qïÅa?b#>=×SUð|¤€¯î¾Â_Äð>mÔÛt½îüºëI+†é¯ 8þ𬂬Õö¼ŽAÞh=߬ÿù²7-+o8Î=„ÕEU»Ç~rþ¡—ÏèM[ï&ŽS_Ÿ‰ŸyËÿ!Ru/ä»úüü| õ§G’üÑÛ¦c ]m½–†}'nâÍe¦ÙØvý‘™_г—¾h°yK=mvxî÷R@ H‰RGßÓ“T^è#M1­»n[²’ú˜`¬ÐÄù"—ú€Õ˜Ž4Óu7/K œØwçµ²²Æœ{¬ƒïòZ«KN=Á[ì ñÏvZ«yû…HQ0€TAŽ? ¤þœü"j•¹QF+R@Jô‘:øèÙVƸϺµçGèÆ Ó4ûlßåG̛㤤ÖÖaÝÙ±.Ãé*Šëåÿ‚þ†X½¼C½çžWÄ’ý•”t/÷rvFSÕt½ËáWRæÆŽÿþs#Æ•T‘—¦ %:R@ H‰RÞ°ÿ½òy—/·È|wbß³ø©‹×ô·rñùïîÏC¹ìZª‡?g“×£ÁN³Í=ðïƒlÞ'Çl¼›L¥rÅÜp5dÏKŽÇîæ³O†¹Ì8sÏú»©Ô ÷>x?d¼ë„ÝÔ/oð¹;vì®3#(€R@ªÊ*ý‹DÇ#€÷é'ŠÁ¿§Žœ> ˜_Êà -VйG­Ä£êºû8NP'55µ:^gggTR@ H) UÇ®‚^ãÉÌ̬ŽbjõêÕu£˜R@ H) U÷2aÂTR@ H) ¤D0d µnݺºqf H) ¤€TÌÀQI) ¤€ÍìÛ·/** H) ¤€µP}æææ@ H) ¤Ä©¬¬,OOO¯ÌéÓ§CCCkøe:þ|JJ R@ H)ñB*77÷ùóç>5òéjø¾„ÔÕüZ·n ¤€R@ Ý}¢™k×®‰õ¥ÑR@ HÕÕP÷™ë›ö) ¤€ªÛñòòªážF ¤€Ru©êþ¼-—{{{ ¤€R⋇Ãyùòå‹šMbbbͼ^{öìùúõ«8^€H) ¤€Uq¤Õx˜LfkcÆŒA%¤€RèîÁN¹¹¹‰ã¥ÑR@ Hý%™8q"*) ¤€R¢YL­Y³æÇâUL) ¤€ú{2bÄTR@ H) %ÊHÕ[ÖV.»víúöí› ¤€ªD,ºõq^ö¿q‹¶|íîúÏÐJ} ›¹~è ·¡•}x‘¯Ž=†9;9ý¶’JOOߺuëö̶mÛÞ¿_»¯e“µµ5*) ¤€TÝNJJr|\\᯵kÖ,\°`áÂÚÿZ³fÍo‘b³Ù±±±q5›œœQxí¼¼¼jìóY@ H) %"!+…":ˆHpNªH1EݦM ¤€R@J4sýúõ—FåST@ H) ¤þ¶bŠÉdš˜˜Óžžž ,@%¤€R@ª42jþéØlöܹs%ø¡´R@ H©:”››Û?U‘ªZ’ÎòÜBÃá<©ñÄÆÆÖü+u÷î]‰_¤€Ru>NyªrÑÜ°*Ohhh¤²³³R@ AD$ááá…‘ R@ H)®§Îœ9¤€R"R ¦Z·nR@ H!ˆH…Ëå¾ÿ¾AƒcÇŽR@ H)M§,,,€R@ ADÓ©?~) ¤€‚ @ H) … @ H) … R@ H!R@ H!¤€RRÛá¼{ü0*›¤€R"Rá_Õ–=NCõä÷¢¤{…pK˜É-¾$ù]ÉÈår þ)xd™*û*»@ H) …üm9Ò­9Π©*/¿û…ü–•øq\wE[‡%éùjÿËÛŒ´T•iê3wÞåðáQâsz}K5%ºfÛÿn~¡héÚFæFPôD µa›ÞŸª¨3æQòŸÜ~Ê+d¬Ì]®ƒ”•• :y•I­üá&“ž»ÃŽÏîѬó~TR@ H))3ÍQCõPp"›Í!ò^IINÜó4'+íä<+ºZÇ”|"òØô&v Yé±ÛÊ(M»׼çŒ> ËÑßRsCŸHË:øœio®¥®®¹äÀµÐ¸¼ø÷'ZmsÙ<¥ò_l¨§6„C°&êËZÍ>žž‘ùáâ š´ôåϼ>ÆÇ[;i¶kk?ß‹  ¤€B_“7VCõx8¯®¹½b”¾#ï³üj)¯£&ÃóSÒ•ÙýµGm ÍŒú‘˜K9Uåü2Ï 9IW·#çÚwRŸ{ðYÁÜXMeµçÉLrr»S×a«¼Ò^œ¤µï/|Ö½N݆¸ñZìÇÛÌ[š¹R3Ñݤ€BÒrm5aÃeaµ¦£Ö„+_ˆä€-µŽ¿ùø=ÞOØÏõ¡Ó”›6“Ïàöf*GžÆ<œ{z¨ºù†@r=vMÏý¿½; ©ê 8þÔ‹zMˬœóÉ"R›Qc£1Ø@ÉV›­ _²¶J¬2ậØt±±9³‡d[#˜/*Û¬]==Ô͵B2fL wή޻[f‹Ú“n¿ÿÃåžó{Îs9—{%ü¢qEÁÊô¬¼HÖš×ÎÞIm.}µïQþñR‚¤ôFêÐÖg_9Ø™$&AÑ®’¢]ç®&Wº~éü§'Ž¼P’»©îL=±¤xdÞ†H}Ò?–^œ¼Ö‘¿êù‰‹‡#e»‹?v¿URQß” ‰ÔkßA R‚”ôOH}þËÌÓ}—?|#scÍíÔðÏEËûoL5Õ¤‚0˜þcÝ“ù5›×ì=K ܺôUæêÒxjëaÕ†ì½'‡BHA R’Öíkó*÷ùþúxâ}ÝÓ…ÅMÍÖ/Íxª*šðh´gÿ²Ì¥/ÕíkÚW¿,cÅöÓ7s®v6,ÏÊ©~ó`ö-‘Âòó·f6TYž{²oìÞû¤ö‹³3r†~K=†þÙŽM9‘ÂÆæC/oÈ+(«O^ºß-_W;)HA RÒüft¸3z¼-úÓÈïÉ¥á g£müŸù0˜}”!˜¸ÙùÑûÇ?î½3;%˜5gê×®ö÷:º¿ Sëw7¦ÆÒïÒ‹“7b'Ú¢_ÿ=iÎ:‚¤ %ÍAê樑†ãÁ¿··Úc~֣ς¤ )iá)HA R¤ )HI‚¤ ) R‚¤$A R‚”)HA R’ )HAJ¤ )HI‚¤ % R‚¤$HA R’)HA R’ )HAJ‚¤ )I‚¤ %A R‚”$HA R’)HA R¤ )HI‚¤ ) R‚¤$A R‚”$HA R’ )HAJ¤ )HI‚¤ % R‚¤$A R‚”)HA R’ )HAJ‚¤ )I‚¤ %A R‚”$HA R’)HA R¤ )HI‚¤ ) R‚¤$A R‚”$HA R’ )HAJ¤ )HI‚¤ % R‚¤$A R‚”)HA R’ )HAJ‚¤ )I‚¤ % R‚¤$HA R’)HA R¤ )HI‚¤ )I‚¤ %A R‚”$HA R’ )HAJ¤ )HI‚¤ åR A R‚”$HA R’ )HAJ¤ )HI‚¤ % R‚¤$A R‚”)HA R’ )HAJ‚¤ )I‚¤ % R‚¤$HA R’)HA R¤ )HI‚¤ )I‚¤ %A R‚”$HA R’ )HAJ¤ )HI‚¤ ) R‚¤$A R‚”ôß+.êýÅb½½½‹úZZZõþ÷ôôÄãñE}­­­.Ò,‚ô«œ§@’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’$I’¤Ñ_žAp endstream endobj 1475 0 obj << /Length 1232 /Filter /FlateDecode >> stream xÚ­WÛnÛ8}÷WðQb†¤$J*ЗfÛ"Åf7ÛzŸÒ¢àZt,D·HrÝüý9¤mÙnKaÀ É3Ã3Ê‘[ÂÈÇÉ»ùäüC(IF3)$™/I"H¥4ÊB2ÏÉMðeÝ 5¨éL$iðo¯;”>®‹\Ogœg¨ø¬K­z/!”O¿Í?MÞÏ'÷ÆáÑ„%dQMn¾1’ƒþa4ÌR²±³*Éž%ù2ùgÂœ£÷“ ;±Æ)ä’ÆŒ¤óË*ËÈY@9l„Q!C+9éáHùù{iDeÈqï×þʘ(¿é÷õmQëÞnÌ{Ù#3 ‰ó•e$ M½Ðí€/ÍñÚ¢¾Å±¢Çç°Rƒ—tçPTç^NyÕ¹ MƒB¥ê)ƒ|ëÖ¥ö` .+ê¾Õ ‡[Ôy1qð£Èת,¦2ètf‰w; TÛvZ¬pE;&pÕqÄ›),5†ÎiÇÈÛIË®©Œ1Ag¼D]SkTWy1Mz˨UžëE»Úw(ÂTífU ún-pèÐ+½@§VQ˜ïÝDèx€Áªéï\UyÏ´aû§ªZ؉[ãa\]_¡ð•ÅL•}ƒowucèßÔøªÜl m?|oÕûªa7î0 îxÈ}âÍZ|ôE–MÝj÷b‚cÛ,©s'ä¹C)îVz»ŠÒßuùàÜl:?«éõýÑ`ÁJM ~â4jüˆ)Nt¡`{›€—J VæbÆœ‡ Å ôƒºÕg~Ö~‚{=.¹˜Kf‚U:§[ÿš…® þ…‘6î¥.ûÒÐ=CMcΨ|hmTŒv‰ó0TödnŒØt¹›Ñ¯Û¶éì¸áçÁåÅÕ5ÙØËDP,š|'Wí÷^ßã, +µê"G- „½Œ¥§5¿¸F>6@¦§) ŽÐK78Ÿÿéb×9þ=1Û7ÑŸ$óƒ™Ð¸Ù ËuéTÛ,XâóôÙðûäÙiby¢*À­ß¸Êm~¦-Ø´‚Q“’)•<$\&4âÑ£*^–ÄÛf5ÂH¡_ñ8‚Î#ÀÙ!e™pœ˜ø†øv¬Ù3“QÆù¾Û!“fIê;M–'‘};|ÚÆ(I¡©ÉÈ5F›KÀöþR`é¤XÝþÙv;Ò€)r3“Œ³Qç|Ú£EÌŽF¦©‡¸h¤ÁE6‹^m wúacîé[ Þ¾ÄcèÀ£e§âõhÞÆQHyš¾ éŽs?† ásr”<£‘Iž0¦IÆn”p*Êbµ¨ð0TÚcOl‰—•ƒ3Õ¡5E¼w‡Û—“b8€ýO{¬Áw‘zï¶óŒz $•"~U=È8”ùxd€*¸Ô¾¢ìŒì„ýMµªyÂ\5ÏõA²••pF ÅžACÉpâ¶,LÔv3`h4%×Kµ.ÂÖˆª­lT^œÿÏ%ù(Ò xòÛ’ÀR×^߹̆-Û[lÛ'pí³nç‡wÀñ]eÝ»kÊÖðáW”!Ÿü‘uòK(‚/8îê=ÌF/Œ ð©ù³ê‹•j·ßF)\X¤ÁES›ƒz»î”½e¸ù?£CvN endstream endobj 1468 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 538 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 55168 /Filter /FlateDecode >> stream xÚì|ÇÛDZ–¾ÿz miEZ\PZZ*´(·" „¸wwOˆ»+IHqwww—Ó}çn’es¹„(˜÷96·{kwó½ç™yæy0 éÕNÇŸ‰ SÞÒÜÁ[.Ñ0lFï%SºÉðÑC¦ôS¨ä1ö†à†„„ôiÆ‚2°L£Ñúû:;;«ªª}}ýHˆüëøoG]Ü}s×·b>‘ýæ]ù•¼ª«x•VòÈ­~Gjí{w7¯¸ºoóéC?ÿxäæ¥ ÆúzÉÉÉÝÝÝ$2A é%"(£¨ÄïQ”·¹¡‹¬ˆÎ±½¢ŸÌ—xŸÃãkŽ’Mó°=‹1NL` &ÀíçÁðŽ|ð`û¹1.ÆüœíÛ&¬å0ú‚ãÆÛò›>¶¼~ÚKKÙÛÍ54!¥©½ƒ…rˆuHHH³'à]Þ¾»fõê‡;>«Ùÿ~ã.ž¶œý{¯x±ýàÁtð§þ ¿Îx0^a¬Û06zñv ?O÷n®æKö-ÍøðÆ÷+¾Ý¼-8"Š-`‘¦o­‘È”ÂâboG{©ã?^ZÄ‘þí<ì&È7’NÌgÀ®}Üí»–Ôîä,ß¾¸hËâ¢Í‹J6/*Ú –‹73^)ÝÆYµƒ³i×’î=\T~7Â~†÷|ˆãç2ù„ãü2>9Éø'ÑM­m㘔HHHHô@zÉN®ngþ4\Ó¹é-ÊîÅkØhz1°ƒ|?wë–Ùk8Ü×,ÖØøØÆOå¿W;÷—Ž”¨¡ºŠ¡®ž‰¾½¥¹…±‘‘ž¡ž¡±®Ž¡²¼ÎݪÇÉî\%³ñ#‹ oG~ÃQ±£ç"Æ> ”Gàéغ dãùÝßÈ ßN+("ž-BÒĉq]Dìâæ•™[¸úù¹‡|I&ppã*yÃ[g—rüòåêRâÁ9YYMÍ-ýƒƒd …F£±åNoooWWWSs3x446¶··765UTVædfx¹ºˆŸúý7‡þ2FÇÝA†'Ëéþ¡ãRx[wq;oZÊ¿wOfN‚Òm6¸P^Sàsníg ?ô ì1c0ímwþ¦©{?p;²þ·ŸJ*«Õ·u°ìB¡tvv677WTTäççÇÇÇ{zzHKK ß¿_‚)IIIqqñ¡g q11‘{ ¶öö¢c4µ>[»éâæÕ!;?Lß¼¤uçÆÀq|CÝ®+<ÊçO$$§ HØ Eß!!!½~pÙ ah¢½ï›´ É{¹†‡ xÞâ¾%¶_rœ_ý±—™AjjjE}Óè]š¹»»ÛÙÙéêꪫ«ËËËK2È&###71-ÁöùŽk`׳1\A¾¬ N®[ó?U:$¤7n.aQø7m^Œ ðÐñ®ýÜ7>Zয™[XD¥p`kkkµ¦­­ Ù5Ú蘯‹‹‹ß¿ ÏÒÒ2<<<---''§¸¸¸²²ì¡¡¡¡©©©¹¹¹±±,×ÕÕ×ÁÚÜÜÜôôôˆˆkkk@9°°7°O|ÿ ŠŠ"âWÏÿ{|åGÞ«æ=ÌàÜ˶uéï'O±5S‘Þ²‘)”`_…O€C:g žÉûxÒ·¿½åûïs q+ˆB¡YYYAà°ØiiÀSVV622²³³KII˜æÙ‚ƒ¦¦¦+ÑØØ·ñ†ü_995uõ]‚‡åWñµíæŽ*¼Šî=\_¯¨®©ÁP қ银¶ Ÿ;í¿‚ïÅ.^Ñ÷oÝßþ»¯?ÜžF£Á…¬¬,|˜'ô(‘¦«« ¬¯ÎÎNü]ØÌ%ûìêê*(( Ñ××G„>,€Þe¡{¿íÞfôõ"Fhñþ!çºw7çƒõšÚØÂ!Ä!!½9ˆë ]ݳ©r'D`0á¯Á2¹{B=ƒØð¬y°ÐÚÚjcc½N¢ þ”PPPˆŒŒ¬©©éïï§ÓA1‹À±€WûøñcEEE`LB÷øÂÅ‹Ç>æ®WtNã¥íçõþ–KVQ™> j„8$¤×nu?~ÄÕ¿{Ép¤.oÇ..Åõ¸0Í6¼[žD"EEE‰ŠŠâdÃ]Q€5`DÅÅŶµ^Cˆ‡HKK344çNLQUõûËŸ~ÇEgrÐWZ÷–’<ðÄ14 ôºÃ-&1YnÃGÌØ6Ø[Åõ%‡úÙ?Rs󉩉‰ ð‰#˜À¼ÿ¾§§gaaáàà 6üo³êbõ"’ÉÅÅÅ>>>Œ@;¹';&õé|ì >yŸ7fíü›ϵtt¾0#!!½x¸UTÕ\^ÆEãfÞoã’¸~i`p'P@@€´´4q`šmÀfkkkƒÁoØËîºg9 ŽŽp¶W®\ýëã%ÀŠc†óÑùyë÷ðH^¿B¥Òˆ}ƒHHH¯Ö†L²Ââ“sbÌ™¤0¼-d=ç­kW‰fìmƒfN6`¶éèèOpô>çÚ5åääõÊ·n­~¿7ÓLeD‡®âÿï2á^3Ä£¥©µMfë 3y3TŒçáÊ·Ì †7a´÷üü|MMM7bà€[TTTooï\&Kï8Û¸¸¸‹·…O®þ¤mÇâ¡Kä^·àŽ0úJ !½dÃþoß®¨ß±„>”‚’·d'Ÿº¶q`öàfqâ@ss3öêD‘ϸÒÒ22®xo`ß3¿÷$¤ðµ ¥?yò„Å'•””ôññ¡R©¯âµÁebçpõ«wa3q<¾Xüð¡=[$"!½id›½&À²ÿ™= ¾7e5õ„MK˜“˜QaùçkIÞÇn¡¡¡Ä²›žž>ÁA„9›•?ŸÀÐðŸ¸8`ÂLF\œÏÞÿ-1µµG5^¡_êYÚ~~~ÿì!×lì¼ ¸Ø𻱡¹K|ƒ¼gzúûñaĈˆ<JEE¥¶¶vR­ž>Rsr™iiÚsÐxð ‘ß®öñõ››çŒ„U\\ ±fOÑÑÑ]]]³j`”––R(”Ù°ß®þ°¯}ë[ø€éµ•ÿ+ª¬Â×>~üø¡¸[*!!¡¯¯___?)“ß2%%mNy K•Žé++$mæ²c÷óù¯_òDZ_€íŠ²b"ÍY=zô¨§§gö¾™`ÏOž<™%¾93³”†»ýíìù¼ï¥q;À{…—#;77·’’’ˆn222nÄñ“½«¶¶¶ØÈ€´±ö@t|Yx8{?"@Ö¬ ìåfŒ50UžÓ_,•”–_! MÃGšÃ|›ÕÖAäáû?“Mç›c`¬£ˆô¼ëmãaüÅ[—Øk©1¶dz¦õõuÄARYYYŽŽŽÉšm8­p¾ÁU­Ídʈ)Ÿ,¸Ý÷5üçÐ.G®¥Ž3uʵtv__ñ£ô*£Î_ÃÖ…»¿ß¨¬¢ZRR‚à†4Çùö¬¥Œìšðö…ó î »«³£³7RXý¼£ ‰?¾á3Ø¿gÜݲ]§rãBÓÎ%̺ ŒWw6¯¨¨o„ûéìì‘–„c p@AII ÆLô‘öT\d`Giü÷RiX”_àèK ÑÙü„0—§Å¸7'{;ŸÕ ð|)†+Þúéïäåå14AéôO§ü¥…o|ëîîÂwäüßæ¡žnaëàóÄž~C/0ì·ðGŒÏÃÕ_¯7õÏ ~xåßß6ì:˜_ÙßS›¾qõ'ÏÜHË)²3?rÕ²¢(wïw«ÎKRZ íiäÞ{’²yqgî^·í€Æ7Cé»­øs-xÈøèpiqQ˜.çn  ûmßÑ£¢J®=•~¸nVQÙxæÇíü\éêë °Wëì§jjª–¦DÝ;óãŠu› [ˆó ÃZ{ù—+-½ü]L›Úû´E·í?,©á˜’–c%üñŠï3ËkÜ?ÿèýsòNYöë6ï) S½h˜õVÚ¸‡É­Úõ Ü©£;vþ~ ìÓHIlÙò/ójÛgÄKσd²Þé£8oK€—²Ÿ÷ÆÖÕb’’šššÈ„Cš›|£Ñ¨™I±ú†úúfö™©ÑzQ£ƒ¼´´5=…[–ä¦èëéèëé=Ò6Ô÷ôð|æ«­£mãäÑ[“anç60ÐçèáSøÐ@G]]]#!»·ßº»»i4ZVRŒž®®´è}'wOk+}}ƒø§ —=bÚššNžAÕ•ez&´.'g§ À yU5-ì’šgþéÀ8„¾®Ztd¤¥©“œSxfWuž®¥CF|lFfú»²À²ÐLÈV¼¾72!GEøßÜ&Š›™NrÖS##c©çä¹+>¦ºIe­¢'’w-‚á]»8¯ü|øi\•Fèi—ý¼"ç&-%iâèÝÖ\óäi’·­ž®OB[iÒï—u}ä)jÝÛR¡e馩ø µ¢ìÈ÷ß4a˜º¸"%IQP.ë.‘Õ¶J±=Wäc.«iée$qî²Q„µ‘jJt¸šGü vĹ„<ò]+80øïµçÖÿÈûúú¢ˆ¤¹É7K=%i ƒøäÔ¨{9çÊâ#“‡==mYééfJ–Žn&ú:µ ¡nNŽF×ïÉ74Ö«*ktöôzØš¤[‹Èiõöö(j&Y)9øD4”åHÈ(µ3sê@ÿ”J¡hkiÔ6¶úºØë©üøÇé€GOªÛ´ÅEã ªLô4õÍœõÔÕÊkZµԵ­…eÕëªuÌÀéYêiø„„\½sŸÚת¬ªbenâäV)«¬Cè Ó¨u•%©qU”ä­5 ›©=­²zΩqщIñòú`K7ûlji:²Ws:n]ºÜaQ.Ž±ÑÖæFúçâµH_oÏà­Ï8† ðJ}:¿¨¤4((´ÙºÚ*q ‰¡199YÙ`o- ÷ÆÆÊ'±ñúªŠùƒ4¬%ç‚Q ¥pp:YôøOiÝX]nŠºWx©Ø¹ý4Ð')-ÃÈ’2ÊMýÏúÅììljª+ãb ÍÍlÌ4S34ôbØÀ™3·#Âý«Z[ªKrõ-Ý$%îäåý±o à›¢¨<9^öˆrÖ],¯k“í%ô´l*{É#02áqxHZiMiAÜ#¯³°ivÀDÜûê·¼´ïä<´æKU55ÜKE- iñJ-)ÌÍËI¾xꔡ©ž‰ããúÊkW`ÅDDô RèTª¡–jKGOrR´““‰¸¢ù`_»¶–6…J ÷°Jñ7‘×ëíîVÔÐO¶Vó N쮿'¡ØJÁ7M-¶ž¨_C[§Â²r}e{YÉŒºF×¥SKM8e)†šZæꆶÝmÚ¶>æd¡ãtë¾$ðJZÁÆÚ<8:®»2CZA ç£ÿFÕS¸sýÒ¹óÿ‰ºiŠýqæß+Î?MeÚT'SõnÜþëï¿Ÿ$gÉ O©Äb\õ~ûûÔ•[wú{ï\8yã¿«ŽF¹™¾ûðIá¤r¾ÚmK´E„Àntttˆnß¾uõâysGO*ì—«ÍÛ¿ý€ˆð…?®ºéœwŠ#5gÿpðà™ÏTÔÕZª _¾xaçžýé¡®'Žÿ~ýò9s0âgama(.~Oäž°˜Š¾¹¶TYe“䵄¯Ÿ>xB,Ôß­¤®¾¢0CÍÄéÒ¯‚2J*ß}ó…cHê¹_·4$}öÁº;BW¤ Ó·¦tÖäÇþýôÏ¿Ï«í»~êÖ¥“7å¬Çìgœ’Hd²Ä‡3Ü+Õ/ü{ñ2¸!JJJSë­EBšUûÍÇÉÖÄÒFYA&$,ÀÿQ©·[W]ÝÂ@ÃÜÞ“9ŒG‹ v³|è*~û‚›ÇC+Ç £=4ÖÕ76UTÖìím4T761’×2I´¿vó–’¬˜ÿ£DÿìA[ßHJø?_gQ);;[ç $gMßØ ¸¥×Ck›‡N÷ïœ×±ösó Åè;3 k+um“æ¦Æ;7îèê)ØØ[œ¾x]FäVhR‘oŒbïtz[£¯)ÄJ7¾¤¶›9tÂߢ…‹Æ@ß °ªï’èé¤0àD¥»{¡Öš7¾GyEïz/)5µ¿¿?888<<Ÿ§À(—p_È::P¿™µEÙ®a~fzîQø!(¤þ¾A2£ÛŸ†uöô…ÄPïäÌÌÖ¶N–n[;;ðÜØ<Ô)×ßÛîæhè§bbÇ2HÒ ®‘Æ8a2y~D背ÿ††Cƒ½ýÌT2¥µ£sfwe.)ܲ“s¨ºë~îí×+)+KKK{{{#Ä!Í­ñÐ"(¤ææ¦î¾A*•J&3KÒ`ss ™ÊœFM£Gú?<$°ïÇ¿/dW¶H°Á’[š›úÃ|ƒýý­­m EÅè‹;GÄ·¶w׌âØØskKKOoXêíêhni»ìïíèìbNÖ¦y˜k ìçÿíè/Umd2¼—Jhnj ó¡“ú{Z™¥ÞíLÔÜ<};º™ìÂÇO™ã Ã-ÖZWÝÙOz6ÈA§·6Ögge•WÔ›“Ä%3ò­‹‡Æóþq`/•™ÐÛÍÍÍÀÀ€X…*ÄÏ»¾{Ä!ȃýy99Ù¹½ƒdƉÑÙŽ>Ó;[›ºzz‡^&D®<‹anO¡ËŠ 2³²;zŸòÐÙàf¥Ï"çFt6ᎂÃÂ|×á©Eø$¿â¹}_Ü ææf7¤9Ä·Q}Âô‘ däוþÌêZnX󖈳FÆ¿ÁÖËrÈ$–°:1j oÄ4*pJtŒß‹ÇzÁÅ6¼NÜéHhþy¨{'¬êñ‡º‘)Æ䛾¾>, 7uuu˜òˆý-ÂCoÇðe{nÏâCؽ‹>v ߈# ¤žÜÑG"ÝÜ9\Ú¯l;—ÀÁCòòòRRR(Piîð cÉæÊÒ* J†ÿ¤·6l%†LŒ‘&Kü!Æn$æˆx9 G1¼;qþÂht±`„íü³¶®î&£ú<ÃçàÙ÷­­ Ÿ‡žEEE³³³GŸÌlÒécuÏÕî‰ñolí³9"üÖikjÖoç„©“úùyÏo^-)% fÚÛÛQãBš;|çÛ<ÒŒxn VnLh~>z£ €±b¦?? îóô¹óUß/€Iþ:o[ ¸6,, ÏZ ¬8‡Ùè_ƒosWù•ÕFßpc‚Ìɹ<†ß»'rÜ"p¯‚‚‚PÒ+À·iÿÖÏêüÓ™âÔ›Öb¹aç[ÀF¡P‰‰+‹‹‹g#Êë•ãÐöï6bû³<`¥-ákWà]¹ïßæß ë~³f9£ ðš ¬nli¯ÇÅŇMMMMI$²ßàåkhiE¬æ`Z¼¼Õ[þ}h¿²²2tQýüüPûBB|›#|sñôÎÝ çdõòóÈ?5@"ÝÚØØàæ å>}út–®âUäÛàÀÀ .Ž¡’Ðx·òÍ×ÒÑ…|322êííE.*âÛ\à›èÅs}Ìä?àQ¿‹[RVcÖ „pTÉd26;=K¯œÊ b¡hî_O÷ ¸¨‡øNÿ‡¨¸¼¼<¸]à¾UWW#¾!!¾½t¾QéØÍ£™UvHÈ&ÞGàõÜÜ\|ätöF^]ûF£ùÉ‹´ïX +S„­]xàè1%%Æü\p߈#!!¾½¾UÕÕkíY5Í%ȧ¼Š·•9×ÀÚÚ†½ĉ‹‹×ÕÕÍÞU¼Šã €o&:u;†I ò¼¿f£ŠŠ Lø©¥¥…à†„øöÒù–œ‘é´i)žª÷î·ÃÆ+""‚,‡kV[ë«èŸùyy–ï[ Ó%ay¿Û°þ¼(ØÙÙ‰!Ä!!¾½<¾1Ç%$ùl䪳 À%|ì Æ9•Î"%%…ø6ZÞa‘Eï3'¢2j@_Øð¥„ÌPr#w×ècÃ}p,ö}æ҉ϪZºzîï^ǘeϼ{±‡¿Ö56%ò |:¨¡!!¾½D¾9k)Wm]„1{Ò×Ï7±±MOOÇ;ßÀ‚ÍT̶á °ÐP–êü/»Ý;ÿºôëÑ_Î ©É‹8>Ê`k¿AÕÕÕM^/æ+ÔÚÕóߎg|{,¸ÂÊщxë<<Žö›9a Åv-¼-§FäðøhÃÙ×ÇrHq”ÙÙÙmÛ¶mõêÕ­­­l»ãèô‘¥ëÇðO_ eYnûdh|៟À—EÕµx• À7kkk˜Q ñí¥ð-$0 v 7ôO±=‹îÜ»Lä[ppðh¾fWvvvXXXCCC]]]hh(Ʀ²Ë˜)Šg–o/löqbJøΙño ¾ÙXSÛÒŠû§`ÁÌÌl CÏHHˆo3Å·è§ñ›¸‡ægí["|êo_?œoÀ ak¿Í6À7♌Q ‡½žÕÏš¡*ð/Æ?õ‰ˆÎƒó³˜SwUØÚÑÛÇàOƒ±±q?jkHˆo/…o±I)žx‡«AñÜÝúµ· Ñ~Æ‘o#ËßÐkjj¼¼¼À36v)¾ç²ò š:p' ¥oªš¥$ãÙîçï_ÊÿÌ*3€oÜ×OüA¦ÒˆéÜMMMßß^¢ýVTVn´}9žIêk^7?¢ùÆ2^î^RR>DH,Œ8Ž±ÇVöööàYIU³º¦¾üܨ¨¨ÈÉ+""¢¤¤ä|htz€YÍ.žáB¨\?ž>^'ú§æææ3R ñmjêýiïp~K>× ¼ êšD#„8¾€3*??ßÉÉ –3k#€@£uvvÅÅ¥¥¥êêêM ug® +;D×ÕÖИ¢NUÌ’ÙôÀ·@ ¹Öí‹apHÎÆùâŠ*à³ Ž/ØØØ ñ$Ä·—È7 ëþEà&\ñ6®?ÿ> ƒˆñ!D³-..ÎßßRýlp­³_ÄEuaóè³è»Oî˜Fɹç›e`LÜÚÚÚ¦ógõ¶ƒýšž:Ò·› Ú½âp¤å5Ô×£ø$Ä·9Å7[K‹ªíK˜õeøzøy~ص]vØ~“‘‘qqqÁá–œœ Àªªª©a$ :MýQ‹Y*Æò0ÇŸS0Ó4ìôå;ØÜž‚ ëá^‡ƒTÃ\ØËÅ1“ºž¿€²ˆ !¾½x¾Ñ™¡”þÎ{â"aß.b¯ç£ðJlø侸ž¼ŸŸååå•žž§\Mjxôßb2ub[mò0–‡]f‡YçbéØuu§ºúúé`a¶ãCàžƒ‚ƒ-?ªŸÕ´õ-‰s'Á‹þD¾Ó54$Ä·—e¿ĵVÝ“¹ðõ{ØA^f*Zއ߾sç6ÞInjjZSSãîîN$H‡ÛhàÄ%$«ë›ë™Ùúæö—nÝ7±vü÷žŠ’[JNnîL!hVµ{û6ÚžÅЩ]Å‘ò$cNß ò |ý†„øöí·æºŠG‘1{v’vsÂÖšµiáµ³ÿÈ7Ruuu`¶Á{õ\¬µvü7ÚÙÙ‚ç Wÿ«¬o¯–úùùùN^ÀdÊerV©ÒÔÑ%´òæÌSð‹ÀãºíÚêj*•êääDÌ{\VV†âÛ ãK~ðÜÕP&*"òß;zˆ¼-Ò>îƒËßS×E`~K:{X FŸYtÃï…ño½½½ø–$©{ªš½3üz½ýŠ¾_+bSøy ~ÚÞÑÝ ¾NºººpPæ·D“ß^߈Œêëëc¼‘ ò@_WOŸðº¨û¸éûy±ƒ|’rüsé*̧ªªÚÐÐ0ÁC„††ÆÄÄàykY0îÙØÚŸ 6*ÈÜOn ÏíÆQA3ì ð­i7·ø}~ÔÔÔð~Kð»€(xSÙÂÜHÛ>0éŸÎ}Á;i«£^°“.Àì|ÛÏsaëZ¸6::ZRRö¼˜¼™pHˆo/Æ?]³f ///XÝôºúúoZæƒ-·l÷‰Ÿ~€­—]TxVRë?Æø¹aØ[ÄšyV.C3Ô€;ÜRØÿ&""‚w'¢¶†„ø6|ÃÝR‰™™Y\\ìââB}V‡tÄXƒ¹µMÈ׌Q:ÓŠ»¼Œ[JF´V ‰ÂÂÂç^/>•Ö’^U”yWZ-1.ò¯Ÿÿþ÷È‘{ºNNÆj6nacÙos3¿%ÜçÍÛBIkç 9§üÜ¿õ!\[YY)&&†,!¸!!¾Íßp¼”UTTØÙÙÿoqÄALýûírŒŸ •lYüÃ~~eeeiiiå;ÙB3p‘F£d§Ä:{ú–×µÞ?õ«{rj@`H?…6Nÿ[yy¹£££ÃäeooŸšš:dÊ.,¾°Œ›iâ2øïÿõ¼'ááp•……… ó·ð 8§ééé¯P!0$Ä·W…oÄf\¤„„ “ÅÈ×ßßåK8W ä½»lñÕ›·äå'UÍ&ê…ÿˆGs1ÖnÀ7Û~'LžªfcÊ'ã”0LýÞ-*Óyg<öóZÝÖÚÞVOYSSÏ¢¢¢R[[‹È†„ø6ƒ|cÁWII‰¹¹yGG‹Ã8Ž]^ìëë?´½{³ î ßWŸ}*ÃìU ›ôM€OôgI{¡;t }îû§øí*,È×ÿ|(AÝ.žÛrJp`1âiCÀ2111xqHˆo3h¿ÁÕÞÞ˶ÂËs™·õm¼ ¼Ôô­<ÿœü´\îîîi4Û¡ê £ 4—ÇOñ!æÓ[×öíYÂÄ>/¶o ÿª¯±áˆ–––xÆ<ॣö…„ø6S|#šdÀ–‡áØT3~ÿ¼i/74T¨û¸Ï/ã玎ŽØT‡8‡ªÙÓGws›oøÝ»|ízÑwoáÙBT–Ï/(.†ÛJJJâ󤤤ن„ø6³ölSþþþ€o°jš­l×<fÒË¡pßO>þX^^^OOÏÕÕuÆ=¯9È7âYÙø¬çVæçIû~±Š¤¾ 0Þ`:w8²ƒ'KQQq¶?q$¤W˜o£¼¸ñ¬p//¯´´4¼®ÊôáÆèV¢R¯ž9Õ³›{(P_€×uý’ãÇ«««gffâ™g„rsoøE‘èضeöï^‚ 0Œ7ìŸø‡AQp›ŽŽmmmÓ çdEFFN6yÒkÏ7–<Øp·ösÓHº¸¸¸¹¹cÛfðü{úN¯ûÛ?\Båï½ç]¹v=<<¼´´ÔÑÑqœ8ºWoŒ ävjÿn*?6LxÇÏ9Ì-¬ð À î™Äijjvvv"²!!¾c3´·T?ŽN~…ÞÓÕ9H£cc4<36núµqþ«ƒ…èÄ”;Ÿs ìY2dÅä»ûé[ÿœ;WUÍ1ãtÚõÜážÇ ,K^ü'k3#ƒ%ÃrÛÏ[¼…SéÖüJ«ªªðTHpŠGTTÔo/ÒçŸkuåI²rFø˾V¶åŒµìkB?¿åÒ'`500ð@AÑgËÿ†çÝóRxï|ò–ð=Æ©ÖÕÁú€ÓDÜáñ*~9x góÜr£óó^÷9è ÓÓÏ7Þ`6$D6$Ä·1ì(ÆBarä½{Â7®]Ñ1Ô×––·vô‘ºtV×7”:¼ [¾MÐ,!N@ ’ŽµUõ2žúûûƒƒƒ¥TÔ}×-f §SîÊódÁ¾¾¾8c_Q¾ÉÖ70øßñ_7.Ä™…›÷ó¶o_|黯:úñûæéé)--{¦òòòÀ3EÆâK ¶,-•ùµ-ÅÉwÅ5 Œ ž¦ç9äÌ»‘‚âeffvçÎÐÐPØÇë Ä|  &F6_r •Ie„ñ®\¢¨¢V•––‚}bÓn˜ ö<óÆöÎ[? ”ngFƒ@ãŸ[t寧ºg%oâããñ©¦à€\>S@B|ÝÁM Øác§.ý4½4ÖÇ⦄擜òÞŽ)i}%Í¢±ýS@GGG÷ ÈÛÛûرcóçÏçââî<(Jr·2¹w/-¯0ØÕIKKÙÀÔjD†‡ƒ|ƒ“ªÌ Ö,„SS¡g¿ò­Ó§Nͪ««Ø|ŽómDhtFæO_~@ÞÇ=õ·Ÿ1=mó»¼eUÕøçUUU%%%…O5ž©±±1ö*dFB|{‘ö[GGGPPÐÁƒ#"" ;ØZSò@BTF^ÅËÕÇÒÒøœ¬gPtœ¿‹¡[ e ÿ4$$¤¦¦¦ijmm•””\¿~ýåË—Á‰5440‡h±¶ª‚›·…¼œ:züsDÐÿi–½©NbfÜ?‘oàOi%UÿM¼”½\CS‡ùBWsˆþ}¬¬¦¶±±ÜR‰4Ù±Œ—Å7"‘¨4š³“ÓÝ•KaɆ*À[·mÑÕík›Ú;ðÍjkk%$$p¸ËMCC£½½y¦Hˆo¸(Š‹‹Ë®]».\xäÈ+  ™L¥1Û:041FbZSc/À°·‰¨¥¥¥¹¹šmÃ6$FêŽr±·2Ñ7ùï䟖ŸÉÂ7¼ý>‰‰–X¾ˆhŵì\"²îCoß®înggg¶6êÜ´ßàéuöõýzô§ôm¼Ô}\C³nùZvpÞøY°¹µ #ÌêUVVÆáÀŸÏÒ #!!¾ ·…ÄÄDà'‡X< ì1ä€w†¡èèè‰Ç{—á[jˤ$$\l ÔÔÎÙ/o`.yG¸¨¬ŽØÿ†ÛoPξç?åfôÂÁ±EFà«Õ—·ÏŸÍÍË÷ôôüí·ßJKK'Þê_<ßð8¨ÇQÿ®útp×p¾qFïbà7óŽ?N¼WÀ؆Þ(ÞíôôéSd¹!!¾Ú°ßÀ*ooïóçÏà ¦Ü@ìíí°‰M[ePÑa´CMyQJJZ[[‡ÄåâË«KK+iÃœ%ÚoĶìºçëeißq2‡lžòÍ E6~ºuÃŽ?þøcâ&Ü‹ä~>)™ÙòNªÈ`¤)EDD¤¤¤øøøLÍ ³ÆѨ٩É,¹äXøF<ÕôÌÌ÷î¼úÁ¤}ÜÙ›—ý¿qOãâ&Ø7Û|c¹Ãý$Ò¾£Ç|¶}дsɳqÒ|¹ß-üqÕg࣡F–SSSYByñIônHˆoØpjG@3𻈄±‹™‚?~ ö™““ãááA¬<á}ÒY-;Æ@í³ÕcÙoCˆKOÿçÂ¥?–/­Ø1Üsäò™­â<²ê³”Ä„¶Ž‘acŒÏ6Ó€ÈJUM­žÖÑ·çQ÷ȶŸ¯{Wà÷KÏŸü‹øcnlTTq@RÌ S$Ä7À7¢åZTT4ƒ?ý€o°Hz]]¯¯oii)6)ö£~Gó¥igffŠHHþr€_âsÎÞÝ|Ð]س$`Ý"ùƒ[”Ô5ê[ÛÙru6ø6z‚ø/4ê±ÈÙ“¦[>ÊÝ0oÈ!å‡6'OôŽ{‡v3Cøðwõõõ=|ø%DFFö¹!¸!!¾áölAAAyyyĨÚé7âü,:àù² nšbË7–^QQ¡¬¬|GXXpýj˯`‡øð”# •Ÿ·j·æjžëÿž¾+)ÇÖa>ßX˜†ÿÙÜÞ!"§pgË׸ºör3FC˜mÌê|Í;—ÿ`¡½­MÓôÅßìayyyÜ'…–à[vv6‚âηîîn˜Â¸¥ÀÔ™`ÔdùFt©ârssµégâ(cñeÏÕÕÕzzz**ª¿œ8¹{ù™ÛùÚvs[O`‚ñ/qúzÞÁ¥oÙi*秥”UÕ´u9ïöööØ4:ß8@"Õ45%„^Þ¿ýw^ŽúÍ °CŽóÐÚ}.Ùð`9°,À“·ž#l͈#kLÿà?ûï9±Šâ ÊÓ¼-]=_º&õÏqß_·Dîù8îŽÎ‹±ƒ|Ùø¼=Àýd5ǵ¯–ú[§å²€:""B[[O6Ž•:::¶¶¶"¬!!¾±ð øŒ€iii³”ö%ÞÑWWW.pzå`&Ä7h|Á‚§NRVQº{oõª•ª_..gLçä}Æ™aSŠ캃¼åÛ8µ¿\x˜›ãÏ•‰^ú×ÀÀÀÍ7 âqtrjj~QIEMMU]}SKk]CcM}}qyEfNÎÓ¸„€°pë‡*²ÒWwà}ëü{óCÖ-¢îç¥1’ ûŸ’ùyB¿™fËZieU`Üï ¸º’’EEE8«Œ ¿l=_$¤7œoQQQ>>>À[œ½Â6Ä09œ¦sè‰ðxuçÏŸç`êÝwß={ö¬²²òm1ÉC‡ÿñÍ2·õ¼yÛ©ää9ÀGp]aØ!`Úq÷íXØøý¼ÒuÑ«9¼Vͳ\µHç^µï¨®{WmíRõoøŒWs9®|+x5GÚŽší[Pv3bðvÃ~4ð îåjÚ¶ðÉ÷\ºÛ–‹^<ú8†<ò>ôõõegg¢ÂAR³ÍÐПž€°†„øÆ"WWלœlÜÚ£Ól8lùFl¿À5†ý~S;ÐÄù†1k@¼óÎ;ÃZ²d TPT”’>wõú…?Ž]ÞóÝíç[|ÎAÚË…fD’0'Að Ígz EÓ1¬¾Ðãa<àòÞ‘› ? *‚}òÄ­æâæÙ·ÁYC><4X},§ ì[`˜‚3Ä“à°’““áÀ4"â[{&66Ž/Œ†[ܱ bÏþ§OŠoøn`ÄÝÓ§Oñ`ûÉru‚|ƒ{ç oÞÞÞÀï#ÿt(ª¨ž½pñƒeŸ¯üà]£5|Õ{ÞnÝË׳wŸx‘TXÆe?ï³$C(z041ì4°%Ø~pOß^îν¼íüK¶/½µî£Ï¿øBJV®é›ÏÜ €¬ªª*SSS1|²q„œž ¸êãFBzUø6‘9PD¾±= RVV,q>ú]ÄN­Ñ“F'È7–ÁáâØq¦ì7@òÅ‹ãpûàƒàë555ÀI‡Ù6ð)zšš²ä/ܼýÓ?çÿúý·ó;þ^÷¹ÈŽÕJ›?ÓY·Ôün“o8­ÖqÙ}Ëí¶‘Ç}Í[.«çÛ~5Ïò«yZŸq¨¡ÿÕ"ý­ŸÛmrñ„¹È [-UOŸ°„”:Ö@;ŒL&È;::jiiÝ¿?¢7 žÝÜÜÊËËǹHH¯½ýF(Âξ*Þ(BCCA˪©êêêÄÄÄuëÖíÚµ X ©©©,£µùŽþøÞ:ÛÛé6I¾O¾r¦¶¶ÖÝÝ}t£éð ŸŸh¼kı²àèàz¡ÇJììbæÁƒã»6[­ã³\Çg¾–Çt5—ñJN£•œàÙv5çA>O¯äÄÄ´ÔԌ̌‚¢‚¢â²òòú††Ž®n2…Êr> ¥¥¥¥¨¨(::ÚÂÂB]]]^^8¡¸Iœ#ÈV¹ºº²dVA éµß($RuEiqi¹¿«¶®¶º¦¡·§³0?¿±¥ˆ??¿ÈÈÈøQòõõ]¾|ù¼yóxyy;V_?”–B¨¬(O|â'-cÐ×Ýž—_ÐÕÕm #ZZ?ÿt´Á söìY8_u"þ×ø|Ãß hF„@7œ¸V#`$33`˜RàžhhhàViY¹{»¿…ƒ¬Ã|§ß_`fkŸœœœŸŸøÜÚÚÚÎT[[ààv^^^BB¸(###¦²$%%»XœPkàup}€lx‚)„5¤7Þ~c4Çž®Ýqvq­É :ç즧¦èîéaa÷°o<ÜoF>±ä.Ð0Aû277/))!F©Ex9ªë[*K ‰H¨Ë)=próôô Ö–óÉ.2߈Í6''gýúõÐy$Ž«NÇ~c6…ùMLLp߸„€6ÆÆÆ€QàEpÉàL€q p$** ,:IYé]ß g>'0ÆUwòΓ’’`JLLL„©{÷îÁð \€´ÑLû×À±ÀuuuÁEŸÿt&Us é5öOê«ËUä¥ïÞ—®Í¾/_VR¤¨ÆHR=H¤ §ÂÇØ23T*YçEUY¾¤¾µ"7R\Z'Ìßñöí›.~áöúÙýô±ê/L°¾ ~ÐŽŽ—;vüûï¿3Å·ŒŒ ¢ñÆÇLJ¯‹‹ÃA€Xl ûô^!° $¤eU÷¬¦ ðÐYR™)‚—ÏçÐÐÔ”›€F3 Wš)`×988°ƒã"W ñm´ ÿJ~âìáïbcb""¡ÑÚÒ./#“–ejjÑÙ?€§ÈðôôÄ+/3ŠŠ/<4²ó°Ò~pOJË+08.&RTBÎXY=¬¼y:ö6ª8 @kvv60#ÇëBYaœŸ………acä6106ñ;µ¨ðÁ~–ÏÆw8õ äååñ’|àO`’ˆéëëgßÖÖÖÉÉÉÇÇçÉ“'Àÿ-**jiiAßs$Ä· b .P^^N!Œå¼ÿ-<<7á&h_±K†ðéðe?Ù ‘’Šjd¥´•4Nüõ·©µí)•–ÎÞçú§p?}ô‘oqÌœ–pDÀƒfÇÎÐÖÓóýmÛÈ€·¡y/×ÎeïkhiCp544€ JfŠÂ¡†!Ë ñm”––‚6%((ø¿ÿýïæÍ›D? ßj´ ‰ÎÎN`ÅáõFŸœñùW1}û­$/]×ÀÀÇÛ둻å– ·ÚÊ8¯¢‘¥þÛöõõ]¸p!·Ÿ~ú Ÿ n/ž8Œ ãÌrÒÐÔòûa-[¾uìä<°~µšº:±ÏÐÐpü;‰8†„øö\û o&PÐP9vìاí@¾C477ƒcáyÈgVÓâótòÒbÝýB]m Åo]ÿùÄ•‚’25y™ª¦¶qø¯ŽD"±ô¼=|ø®jkkS'IWWÜÀqì7ee¿=Ÿ±å[ÍÖE?íÝ©¢ªŠÛo€–ÖÖÖè Œ„4¾Î”ØÑÑáççgll¼nݺªªª‰»xþÞ´´´ÊÊJlü’ñ/žoLÄuµÖ™éë™XeÆÇ_’U±5Ò ŽM£ O c›Ÿ®*(( Âí“O>Á×ÆÇÇÓÞzyyÿ‹ /'ë·y)[¾|·ðÄÑ#ÄÂ|ÒÒÒ®®®è Œ„45ûíY!’þ~Њƒ‚‚êêêÀŸxÌØDEÌo ž+÷ò‡LnÄSé­/³Mx±çõ¿m߾ȷššøFó{ÞÀ³’’…BÿDd¤$ý×q²å[ʆOý +¼à|óööF_`¤×^ÓaÅsùÌ6ww÷¢¢"˜.Œ¥Ÿ‚þ)>¿¾±±KAÊM‡oC£¶ÏÇQÉà "ž-ßÀq‰pûõ×_ñwà)"ÅÅʼn9½Ç’„˜¸×ªù£á1k8î\»³…C¾IIIÁ;‰„ô:@ {ÖÕ>V ‹G‰ª5ÑÇx#[¾ááaÀl>) 0˜ÚÜèú§‰‰‰¹¹¹sË?}ÞOÆXõ³Ö®]‹ÃmáÂ…±±±¸? 6|ØTOO˜~s¬ƒŠ ù}Þoa+9Ä„…ˆ±»€o¡ÌZ0héu²ÓÆâZ[eJzacAa!œ0Ö7,¾±Ä¡µ¶¶†„„dddÀlà ¦À7Ø!¸¨JJJ¿ºS‚»«·±ç›õ†¥b÷E‰SæÅÅÅ'¥ƒ„ôJ¨¥0þŽ˜fy^œ‰©UYA–šòIa¡ÜâJ/¿15» [—/Å%fºX[fW¶;˜ÊÕ·“}ª8¹˜8°å[/S€6ééé3H¶±ø†¿ÞÔÔãù_!û ž§®®.ÑxÂû<ííía\ˆ .2Á <±m}ÇÎ%lùfôÝûbbb,¹vÑÄR¤×L´+ óªªÚ GC#“ÂêƲœccßè¶Ê´ìâ¦Â’’¦²\ C][Ï~ ½$?£oZ]’]^^ikeßÖÑËÒÖBCCãããAã´Áfaj[¾áA&À\„õ‚±é•gz‘|æî·ß~‹Ã““w秠 €OX°²²Â‡M'¢cëVPör±À ¦ƒÓÞü‰¸¸ ߈‰Ö‘^ùÞ7f€…B¦Rit•D Ó"“H„tÓû£ŒÎPA&“©£æ§»ººfff'[Íl¼ÁXþ)|Í؉‰‰0åã+Á7OOÏÑ1oP>>>Äv€›eþÃ~àUØú…„¤”o÷ïßÇPðÒë½i]lãCFû’c·º¼¨ ¸#÷Ö64UU5Pȃ¹Yéí]#€É–oPÇ”X³fÍtæm½¾"Ünݺ…Ÿ30Þ¤¤¤ |$%%‹‹‹'u9*õ×ïa‚lì7 ?¯Ô¶¯$™;Çù&##ƒø†ôæ nú|#ª»»;<< Ž>\HÔÐÓ752¬Ê¹÷¬‘¯…¡žž™µ†–qÿiœþ7âNúúú +ðÄ£&cÐGZ­/“o<<<8ÜÞ~ûíªª*x²ÀÁLJyŒŒŒ&{ˆ®žÞ _ýv€‡µÊ³ß?ÏÝ«¥¤¥q¾ûPMMmúŸ>Òœen#ÁDúSûž‡††666vRQQÑÿýßÿ}öÙg×®]ƒ ŽF¿7ñqÐ]QÉÈ'‰ýµ±Â7oÕUW—oPÀKurr"®£R)$™NÜrìñ‡À7ðCpóæM¢ñFì355Å',+®¶¶v²G}s‹øW̪ô£øÖ³çêÎ ÒÃû‡Å‹× !½®ÖÀš›››‹‹Ë”÷æë뛞žž7J±±±ï¼óÎüùó7oÞ¬¢¢RRR2úD’ã",môµUb‚ôÿVª¯k‘(«¨q÷òéž2;žJ¼¢¶¶6¢/ÜÞTäà€oÓÚØÈœ'6cù{'%`dÚÙÙg›òññŸ¸Üb9QÀj˜‹`R‡(©¬Ò^±ˆ-ßÚ÷ñœÞ»U†9r#ÔÙÙµ¤×q 9''':tˆ““s"¹)Æ÷OGç²îèèncdd$•)Ö:òÌç†Ú m-#S‹†ÊÜ'qÉd–ò8TS]Ó=8–Ìx 6¾Ü-Ã9%÷u¸ÙYZY>P4)ÈŒWÓÔÎ+.—8ÿ—¦g•à¨¾H¾ ³MnŽ§§'>l žÓÒÒ¦à9fæåÛ­˜Ç–oM{y~Ø#+;br=J‚ôÛo0'öùóç±iM$?9Û! Ö½H–žºçÚo„2žìõzø›©‰ßU•WÕ‹ só 0WW­ï|YýoD¸½õÖ[øÞ=ðñž7--­É’ nŸšð5£”³Ëà)_Ý^žC“‡HJJÆÄÄ ¶€ôºò­´´ôæÍ›~øaJJÊtfÁ“¿w¬ZWxW 2Ž= ¾ ïFåLIs_}~ä]I혧m­,mœ<¬uô („À—Â7ü&{‰È78|WÙÚÚGð\R“þ žÆ'¬â`25>¤j÷^ÁCÄä!ød$¤×†l¸óJ&“322€i1ýñÓ™ÍÆÆrΓ±ßçãc§jh.{늈¤ª®ŽVLD”¬‚‘Šºw^-†ÍV}ÀqΟD"qqqáp{ï½÷JJJàíª¬¬”»pÇH¦`¿ù<ŠÊ_ÃÁ’<Úo»¸w:Bœ\/&&ãO^ƒ _QHHžwšhòðð˜©IîÓåóø4:FLŠMÏ.èêìª,ÈzÙÐÚÑÖP™G{|Ãoï;wˆÆ1ðÌÜÜïy“——///ŸòálÝÊ7°±ßÀ£d;×ÁŸ!&ï<Š Az,7°PSSãííÍ ;ï¹££#œF4'ì·‘(}”ëJáþi]]±¶éÛo¿»ó¹¹¹¸Ï(ggg7céÔ}Ï>yoü÷\Çþü볦3>¾PQQ¡à7¤²ˆ.abö,*k¬o¡~jßFüí€xæÛùzGDDxyy‹/ÏöüÓçú§#Â{‡ïëøç6{ö›¥¥%ÑxŽ!\E¡PìííqãMZZzšÙŠ$%Z·.`÷|¸Oœù—蟂#VWW£æ‰4Ý/9†QHƒ­õ5µµ½ýƒDƒµ°6ªÚÁp4>xt÷ôЇVLz‚'n¹…‡‡wttÌ,‚߀êææÖÛÛ;öÀdí·©i–ì·¶¶6bò/¾øcÆÂ^78¬¬)‡iöÜ»ðOlùf»–ûì•kD¾)**²L-ABššÊ£Nœ»)+#}OâAK{7‹ëD!SŠ Ši#<¨ÑÆYNI…`”Ð&^œB†ÉvfÖÊ‚ùß6amb Ç7™oðüòË/DãÍÉÉ ¿ÿÄò1’’’xwè”uùðÊN¶|S_Íwõ¶‘oêêê0ŸÒ4•çeù¯q,X0ÖTIÎ+.Ì•ÒÛVïíáš”SZ]œuþŸKƒñQÞmݽÍ>žn éyò@tD°·(™Ü÷ŸÐ=*F‹óô ìèÛ›e㋵··ûùùÁ4ã.$?¥R©ÑÑÑ°¼éËôOçßðË/**z÷Ýwq¸}þùçx²Ê¤¤$h¼Áž·   éÿ.ü¹þ+L€]r$A¾û_¿-$*NtNµ´´€ÕÚ&ÒôUàïðÓ5%/·»÷ÄŠk[Ôïÿ‘pïÆUÏà¨gNǤeˆIf…Ú)jû»ÙèÛy»Ëû„„k©(ûz¸˜X:…û8ºxzÝiëhw°0Ì-,ŸH+JÐQ] šp”f°Ïm4ßÀ>;;;ýýýa"8l–ó[Îqû Ú±÷ïß'o7nÜÀ† 7›››ã³±€«XYY9}¢úä]ì /[¾]üœWR–h¾=ÐÕÕ…=HHÓT¾·õi­àÞ®ŽöFü¼™¶\gKãÉó÷À²›äu›˜d#]cùóg| ›0z¯œºÁ™³WzhXO‡µZZFIOW»­…á ¡{d*ÅÆPãÖµkq¹e,NîXÝnÍÍÍ å’H¤Ù‹ß Ö—)++,Bþ)´™çÍ›‡ÃmÙ²eà0‰A~~¾ôp*`¼YZZΈŸ‹ïì0ÌÖKŒãÅòÿ˜OAE•8ÁÀÀ`¶o)Ò›Â7ÛËfñøŸúJ$Eôöõà'Ñ7¯\,¨­ !Waw[L-ØËÎÌ%ÈC_Ö78RKQÆÏÛÍÂÁ-$ÐËÝÓ÷Î}©®î 7w¯_[CGï!¸ÑÇû¸'‡Î߈ €Ségꈯ¨zùòe¢ñæìì ó[ã=o`·x§uP ûý>ìëäSFÿïŸËßaᛡ¡!±êÒ”Õ×Ö\ÖØgÃhj¨¥P±¾öƸ§19ÅÕš™ÖO¡f§ÅÅ%tõ öu=}“_TF!‘²Óã’Òû+«ªÉrzR\\RZ,ÒÇîÛ‰¿V[[ëíí |Fl–cœXê;ƒÖŽO¨Óø/¹®®Ž·M›6õõõÀN9 ˆ)))øâôoTSG×/ßÆyÙ—ùãë‰| ¦¦¦Ä0!$¤i~íaŸÌ³þ±Ã<Qq„è#R6²-Eÿì­­­ÁÁÁ°zÈìYn£í7x Â‰xø†_,???· ¸¹¹áù-ñIÀrSPP×5#ŸNNi¹Â*>ö|àùuÝ Ee¼ÇÈÂÂbFìF$¤1ü lœyåôQ°ˆc};ñ]MMMaaa°& ¸û b<((N5šÙúÎs™oø•ÆÇÇ“ô®\¹’D"¾_p¯`ªÈ7ðçLTRŠÅjNLðíÑÅëéû¸~ܲQAI™8~jccCÎ Šôz[VØlÎ-ší“¤òŒ€Ëƒç ŽÅ~ƒG-4gàMÿ^-û HTT”èœÚÚÚbÌü½îîîFFFxÏ›²²2^{úr÷ ðÿv #9Ò(û¼—ëàž]ŠJJÄääÎÎÎ0"éµ×l|Ð,ízFÜ4… ¸1Ȭå‡D©T*h•Œbô!·ÔÇLJeÁl#Žm~$pв²²„„„.ùT'—½Bö[[[n_~ù%\ øfjjŠ{ˆÒÒÒ0}îŒ|1À³‘•Mòfnv•Oùv/áTTÁ7OOO4¸ðæ(5=+=§(=§púÔì‚Â’²ÑášUUU…“WII  ØCÍSi9M=ãð§)V¦Fáñé a††ºža$ ¢r`VÒçò ÜÈÈHó+§Zšj”#Möò ¯ªï°ñ÷oëîöõ I |hbnò$‰:†_üí7øìçç·yóæK—.MÙŠ{…ì·}ûöáp›?¾ \ Ìoeee|XAMM­½½}f?&‘ŠûGóa¿o^täÄ)E"ßÀç‚Zý›£“BÊ69˜ÙLðÍ8‰ªnXQ^^YYY__?º4ÕÆ)©¹±!&&¹±“”›–dfb‘X]˜ÚMÂs’Ð_ÊÏñXýo³¨Êï¿ÿ3ÖN9íöç~EQQQ°žÔ®]»ðµÄÙ¦ááá3~þ`·]l*Ë`ø¢×/<~æœÂH¾Ás@öۛŷ”à›i ýºœ±´´”´´´¹¹ùh¾¯mŠ|kn†eã€AèŒD"´—û%¿¾ 8ç .€öž••õºú§ðc=qâ±ç àïyÓÖÖÆᦢ¢2㉘¨4š²¸H[¾9¯^xæÒU…gÉ-Á73>>µzÄ·)óM†Ù™Ì·éÿbŽê^#f¾œCöñTŠEEEA³zí·ÒÒR"ÜvìدJMMÅ',€…°°°7œÈŠšÐÌ=ïæí|»pÏ»ð‘¿ûÜ|Å»ßÿ|ñÕÛBò#“÷æåå¡Vø6E¾É2ø&CàÛŒ`mœ¼øa…‰ØoøÉP(”²²²×Ï~ÃGŠW®\‰Ã——Ю¢R©À1ćMuttà̵™=ypYÑ¡ÁÒ"wŸF<Š Š UWxpñŸ“—Ïœ>sê$ø2ƒ{ßðLMHˆoÓçP\\\@@@àä~ñáL«ç*66{±Á!ØdêŸb¯éø‚««ë‚ p¾ýøãxI2'''Ü+ÌÉÉ™ÕOÆC¹¹¹É Ö'Ÿ‚×ÛÛÛQ«G|›Aû 0ªwJêëë?o,!!!/ØQ}.ߦ©9n¿‘H¤C‡Óàà`¸¶­­M]]éÆ[GGǬ~4oðvvvD¾AHK¿„ôfðÎd}VCâ܃ o6Eÿ”>Uјb?Kk¸Â°g,å¥ñmDæ€9Ë7x“ÁåávìØ1ü#ŽŠŠ"æArttœmÓšh¿á)4Gó Ö¸Azí7À.ÓdªiÅ4‰ –ÍRhÏŒºˆ8šY2 BÏl$ñàóXþ)FHËV\\\2y•••ÁiYlx-³TçeÆù!@¥P i4*8…Be cÏFP沺víZ"ßðXàS NXPSS7j¶§|í7SSS¼~ ‹ßÞL¾™@¥Ñ®(Xž3ú󦪌O-€˜Uf•Á`—EcÙ"®í²N¨e:f™ÉØÞ2ƒ±Ö<3xÜf ñ86ßp¸œýSÒøöP~~~ffæ”;»^¨ýF§æf<525³¶uJËÊ2ÓSŸäáìd`h›J£Óæ²ýï­‡‡n/^ÄW…„„¾áå±RSSÁOϋ䛃ƒƒ¦¦¦Ö(ihhc(øíMä°ÐÝÔ4JìV·wÝz\Ï:‹&¬ã"l[8¦wYÅÝ0ªfß9%»\LÌ(È8‰.c.d™bY¹g7¿„[ésù6«ýTðÙÙÙšpsÙ~c˜nƒ½Æ "6Ob»º:Ÿ×.L‹Ó·tkmnŠzšD¡Òæ¸ý~§–/_ŽÃíwÞÉÈÈÀÓ§ˆ‹‹ã1oà·) àÅð 7æûƜLJZýÈ7‹4ÒÑË2RÎYÿIký ì#kbzRÎmÿÖ ÂÞµÇ.Š‹šùü~úºÀUÍk÷¥/êÇ IËÿxÓðÔmI!óäŸÿø °‰éÞ²ïnimmmÝäU__çŸNqÀ­uîÛoÀ!-Íϲ0Ö16µ0²uÈJ‰´÷ ¦Q)•U5ÔaKu®ñ ¿«fffÄÚ¦ÿý7¾µµ5ÑÌÍÍ…ù-_¤ý6~4²ßÞT¾‘œ½w]Ó뚦¯A2ý¾†Å£§g~øþ¤^èY%O›BLÇ-fÇOÿþíO ÿÆ]»ßuN3ór+T÷Rò#=ÿ<ß(d_wG=s u[Û‡6®^Ý-ZjʆŽ¾(T:žÑ}îð ¿¥àÙ¾};Ñ9ÍÏχ«À¯˜ššn¼‚Ÿ§É7$¤ñýSãd: ÕÃìà^ÉÀÆc{¾=cœüË%eïÌ_<¼ã_UÛÔÞ_.ÞûûôŸ'”Âo*é9Tœ8ö›Bh‡i2m¬ñS–å“Òd½T`ò›áÅüFOÑ~ƒƒ T ™L¦2^¤9î s:œ´x.Úo111£{Þà‡ËcÁÂÍ0(ñ i.ðÍ,…¦XmÊ!ÅÌÓ0­€Ü^’±¢öYrŽO/+ÚµŠþUfitR“'-·4o膚¤còOä}*ÆïƒË}}}mmmí“0ÉÆwT‰±vþþþxý…¹éŸb#'šat:ñü¬çfÿÛâÅ‹q¸ñððàŸKgg'`žÉÀÀnø†ôÒùÆŒa`íY¼GãO æ3c!}hahU*ãðÀ#â˜þ) Î?‹o ©644LmŠ=œV?xµpõå±¢ñ ‰ˆ›c|Ã臘¦&Ñx»{÷.>ëÊÎÎ6|çA!¾!;áaº#ç2°¹™ÁÐßg¡q¾=/>ä\½ÐÝÝ=GýÓÉ\Ëœêgòõ×_ãp[ºt)ÓÔÔD̃dee…ïñ iNñmÆçg†‘ÕØØ(&&†ÏƲ¶¶f1˜ß^{¾Á円†ÜÜܼɫ°°pR3kà–YYY È?2ßðûF,Üÿß°rêê{s¡+GFFbµpo?æß²ddd0¾ñññÛ ºÜzðS·œ5›ÚÙÙåååuÜäÔoÔëlî7z_ÿì{£Ò÷fÕ7˜›_{øܨ\³×ÇÞÞÎÞ¾o `WWWþ!UVVþLÒ~ôLNNÆúÂu-rÿÿ¾‡‡ƒÛ Aƒ°øñãGlÀ€[DDÒYU'äÔoÔ‰¨sÑ—®Å^¾¾ÛÚiņ«6íúÂc'ó±ë+•w®^·Éž)”ohQOKK»zõjÊw p \zÍÍÍ?†&lýçÏŸgddpxÈ·¯ó ;Qøš7 ÀÀ@ìÜ£5ohË—öò êw _êŽ=jog»ŸÃÏ<Ù=<»#>ýÞMa\Âà56õ ôoßèß^½z…mª¤¤„Nr0§LÃÌ[\\Ü—N,äÔoG¿²ððpPbºB À‡……u,íd2@¦åû>…ª?†¸øøøéÓ§[[[c69È7ôT¯X±oÞ|||°°~ü(!!ÁMPP=X°(-- ›w<Ÿ;wî+gò ê T»ðòìØ®«¶ö]þ SÆ ;vl×Î}ÙSýzÒöìÙƒ7o±±±»É&""ƒðêhŸ7ŸBýájwoü7öùðზ–ÖO%ÿ¯ù7à´ñp3f v¾n÷îÝØ€…ÈÈȯÿ²oPP¿Ýéé饥¥0>ý ß°3by<ߢ££1Ÿïáá¦BÏnnnÿ7<äÔ/@Üä<ÿ7ý¸H$ n£FšMÓÒÒìíí±T!ß2ñäT÷!?LŒŽËš‹ýÉñ—6¡³ðØyˆÝÃø†%4X³f Þ¼…‡‡£k’Éd___¬æÍÅÅKÒ ùõ»Ì[cmMuC3Ç›¯éR…}ýÆ7ì¸Þ¼yƒŸûOFFÛ™ÔÔT,I¯­­- Ö·ûoPPݪXwëÍû<êÈ”‡7““®ß¥Ðò¢¼˜Ø¸åÕ4*åÁ«·?oimMtçæÃœ'6´Ð ²Ÿ<Ë+º{#ùÚT …œûúåÇé%åµø+ºçù7ðÌaÞ®_¿Ž.¢R©AAAØhSGGÇoH¥ÑsÒì÷:îs8üØ™S§.^»²§­H®#“Éø‰›¹¸¸ÑãŒÂwèõõõÅ»Aÿõ{ýÛ£èÞÑÇ‚ND_¾~õB ·ëúí6ϲ¸y†÷²>qáÚ™Á'¯ i!S*J?-0ÒLÊxû09æâµÛÑÇÃ"£ãö;{¤½åìDÑÃüÛ£G0¾©ªªbíª×„wÀø†ŽçE¾­§ äT·ª¥¦"ñ굪šª¤¸Øظ¤¦†¦ì×OŸyVX´T'ÆÇ^N¾MEâ©4ÒšŸ›ÝÜJi®«J¾x!ábrK+¹¨¨¨®‘ʱÙÃ74IËܹsñÁiBBºà0¸9::~×0È7(¨î¶p_\Š[ý³“ÕéØ|ËôÉ7*•úðáC<ÜfÎœ‰ºÔÔTnVVV`}ä{úHC¾AAýÄáû¹µQìË×éÿ Áz ßÀ³¾¾>·Þ½{có(Š³³3Ú¬BToooä;€@¾AAýê|öìüùóxó6qâÄÖÖVbÉÉɨy²¶¶~ôèÑ·¸bÈ7((È·?oW®\QQQÁàÆÃÃM:VWWçää„Õ¼544|ï7È7((È·ßÅ7Žéctuu±EñññXKðâÞ½{ßkÞ ß   ß~ ßPL)**âù–““ƒ°›M}||ð£M¿>Í=ääÛåßbccñp³°°@ØyÞ€[C§ÇB›MчHÀùùö[ø&&&†ÁH$æååaöìÙƒš7‡€€äG“ooPPoE|:tèP<ߪ««ÑE•••...Xòàà`äG'/ƒ|ƒ‚‚|ûõþ-""7+++„Ý|påÊkkk42/rssò!ß   ß~ßP¸UTT ap“””,((@•””Öaæ …ÆOÎÈùùÖÝ|ÃÒ€ßljffF¡PPÿvìØ149““Ö]ò òíÏ÷o€6êêêÜúöíG&“Á¢?º¹¹¡‘) À :·)ôoPPo2ß°///|Í›¯¯off&šß2::ÚÎÎ囹¹y~~>ÒsaC¾AAA¾ýÿÖÒÒ",,ŒÁMBBÀçÖ­[À§•••Y[[£5o€r‘‘‘]7È7((È·_àßÀ³““Þ¼ÙÛÛ#Ìü–>è€48Å&n†þ òíOæʨW¯^áÍ›˜˜XII ÂGŸ <ÖlzòäI*•Ú%æ ò ò­»ýÀ‹§§'Þ¼“†.ºqãFHH–ç x¼üüü®‚ää[÷ñ leË€ð|Ã6{öìYlVz`Þ>ÜU‘)ää[wó ooPPP¾kllìÓ§7iiilÑ‹/lmm±$–çÎC~.ÏääۯኩٳgãÍØalÑ¡C‡€gÛÇV]]ÒÕ- oPPoÝäß222ðpÓÒÒ›B –6›¢æíÒ¥KÝ7È7((È·.äŠ)*•º|ùr n½zõ AWhhhðòòBmàx]UU…µ¨B¾AAAýÉþ |ðíÛ·$ ã///¶(==}?[ D ÇZT¡ƒ‚‚úóýÛš5kðÁirr2ºøºÐÐP¬Ùà[7§oPPo]ëß8jÞLLL0î=~üÍó´wï^àåîß¿ßÒÒýÔÎ7bfffx¾]¼x] Ì›››fÞ<<<À;·nÝ‚|ƒ‚‚ú+üÛ7ð£M544¾Pî­ÙÚÚ¢æÍÞÞí.ùõ‡ó %XssóäÉ“ñæ-)) ]¡²²m6EÍ›»»;ºóoPPPß^¿~ÍÍÍÁMEE] ðòàÁàÙ°2 |«««û¿_ü˜>8}÷îÂlV¨ªªòññÁšMÝÜÜpðGø†Î_ßMg |Ý¥K—º#s&þ[P¾ußoõ¯!.??¿[#;ð………_ÿ ¬cnsæÌÁ]¿~Íóàfmm––†´ÏóHH¡Pº €½yyyÝíßž>} Ë$T—_Y¿wûèjƒ Âóíõë×è¢ÖÖV'''Ô¼ÈÔÓÓ¿eŒrÝjA»ûtáú7(¨ÆØàà`<Üvì؃‰‰‰666¨y..77—ƒ ØFþR2ü~BAAý®«»ººZQQßlšššŠ.-..¶³³ÃjÞBCCëîvL(((¨®ò-ׯ_çHÒ‹¾O¥RP¸¡|{üø1ô9PPPâäååñ|æQ¨©©ñôôD;¼¡5o ò êo[xx8nVVVØ¢˜˜,Ï›¹¹ù›7o Ü   þ¸Ñh4IIIüÄÍoß¾EW(++æWæ-22ž4((¨¿H¾¾¾xó¶~ýz¬UôÔ©SvvvØÄÍ999йAAýƒ.读ðQˆUTTŒ1ƒׇÐòóóñͦÝÚ} êâˆì¨Tð ’)ðh%“[[[[ZZšjjnƦFðhhjh`<76‚wÍÍ`M°>øø,MÒÑÙø#Ž´]™Ó§OãÍÛŠ+Ðíƒý9wî6Ú¸8´¯/TtbµÍ9ùïRîÞ?}!ìÔÙ£áG#ý<Ï8YEÛí8¿wcÜžÕç6-8¹tò±™ZG&©6UÕ“=¨98HEü€’p‚@ ’p°ªx¼ØD1|’ XóÔ²ÉàSq»Wƒ-€í€­ôóÓŒUv#¹Lyظ2`üüýï¦gWTÖ5·tzß{àk׮ś·#GŽ`‹Ž;†Õ¼YXXTVVB¸AAý-4ÿOv¥¶®øÇìgÙ‡¬š=cµ†£¼ðiB’ áåØÞMº<ÈDd 1@Lcº! 1`>˜/Œü¸ÇzfonÄz“ñ]¦Ìï5hÒá{’4œpxaÿ(áåzjkæÌ9ðüùóââ⚺:jûƒúÒ JìMð©þýûcp2dHAA–œ|ïÞ½hÍ0o±±±Ý—µ ª;È–þâÕ‰‹‰ÞÇw­;8CÇK†ûÀÂÅ^]nĈ1!¡(k£Ê<‘8HeÌÄ]g‹¾Æ·NÞD7‚ã'†P°DĘ¯U‡û"ÁOšà3‚÷àLã;×÷óëòµ™VÄ0“8ƲÍ$ Ûí6Ç^L@̈Uãûù‹¶K÷õÛ¸,öÈÁiéEŸJ°sâêꊇ[XXÂn>yò$VófccóéÓ'7(¨?iøJ§’Úú¨èØÍófz莌Qæ}¡ÎÝ¢ÃŪ@ÃÕ›µy$&Lô™ Ðôx+4ú¼R \“#’çµQ´]}Äþé>›W…¸ì?z&êLô™3'OF† ÷ ö=v8øp¸_Pˆ‡Ÿ³»ç>g»ýŽàáàèdÏ|Ø1¶ûm÷;Y;ì·°µÛia¹uçîM[¶nX¿~õŠ‹-ž?kæ‚ †‹Ç+-S¸p˜ðY¡Ãò¼÷•ú©õ­ÑæA ù3AF½ó(:±‘øê;cR‹wŽWôX¢»¾ü¦ù ÎÆÄ–V×ñðð`pGG›¢•rø‰›OŸ> ‹ÔoÇÞcœ‹ŽÑÖÒt-˜­ÎK@cq ]ì‰ îp °I¦¤—êÜû†ôÕæ!,Tí´×ü|\|æÓ§Å?å¼{òäÉùóç#Ož qqqp` u5}gß·iÿ—‚D'¦¬­­·mß¾jíÚ9óæOÖÕœ0DTŸà:´/ðx•„XLMok§`½  ÐŒHÙªÜn Â|ÜìøßlˆÍmjeeUUUÍÔï‚véå]Oºãlµ\œëØbÌÇ ?ÛÕöãë¬P”Õëðd*n*ö»i&{aŽ–ûÊùk¶ï²qóJ¾û ¦¡±ìóçW¯ò®]»®z ÀpÉ{Â7hû»Gˆ²ÎÙÙÙÕÍÝÝËÛÅÃsù†M†¦2cT—«Ë‡hI/~[¹_®W‹>?ãÀMÚZ:˜G5Ñ’XÇ>£Ä·a ·é`јsç^‚s˜““Rl´i||<•J…pƒ‚údKËÎ16›¤?2WG¨D£â J6åL™Õhz\§GŒù«µ”Ž‡¿ÎÊ,þô©¢¦îYî‹ØØØ'Nøûû»»»ª 4Ãü…þ/¦º‰{(ñîô¬îÞmÛwìÙ¼aõÌ©“†ˆN&ÄË÷E ù˜ ïvãvÑkµéµ~ÿ`=9Ã)ÓA° êÌÌCÜiQQQ§õ™PPPÝ¢/š›[Ž9²RWÕg q-›rD $z[õ ÄeM†Ä¼q|!£‰ÛÆZ»Óüü•$20'®âëׯ‡……orþš: ?¾_?Ì¢ßpçééi·oÿ¬…‹U4Æ­” Éû^‹¿œcÎÖa| X×bHô–&Ì“š5ë?k›ð£G8Ô¯……Ž<ÈÌ:äd·]Vø¡RoÄoQØMŸ¨U/ˆoÆ.« Ô—3_µÔËǧàS A*++ÓÓÓ£¢¢Í€=A6mñ·81Œ]à³Ààa`† àÅÛÛÛ××÷À¡¡¡ÇŽ;sæÌ… .^¼xùòå+W®$&&&%%ç”””$¦Àk°èÒ¥K 111‘‘‘GŽ ÒÇÇÇËË 8Ið¥à‹öîÝ ¾¼ÀO²ÜqÇÀ àÁ€spvÙ°}§©ÙT1îÊâ‰cø>ŒãfPδË>cüÆr­Èíimžšñ”Ú¡’ ªËÝúâèésóuÔèKç¦1k“ÐjsÎþ´à:5äu‘$ öŽ ÈÍÎ*«dÔ“çäæž´;wî<þüÍ›7ïß¿/--­®®®¯¯ohhhlllnnnmm¥P(ÌAó´ÿ{°ÌÑúT2™ÜÒÒÒÔÔ66U[[[QQññãÇ‚‚‚¼¼¼'Ožô™››£\E+±ð± LXc—…å¶ë—O53å Ö ™@dÒŒDï8Œ‚Ù Q¬Å{[[l†®fÈш/ýPPP?_ÉVQY™öðþBÙ)bö¥.¸ Ü•jñ>×: 3h‰7ï€ÏV8ܼyuY4ëˆ2¬wZó`èááhvîܹû÷ï—””| –»ð 0ðåË—Àû>}X>àÑ:CŒx펎ù8Lw//prÉÈz)‹e#~ÖáC𦷭󔚑Ž &¬6ÖÊxp¯²¦élÂ,((¨ïÅzí4’©n>~.ÆcS”¹šuy°ÀªÝÈàC x(õÞ=°ŸÿîÍ â+­fôæzýúu\\\@@â/öNÃ:”i`M”€€Š ŒƬ¦¦8±îãØ·³îKtïcyyynnîƒâãã“Ѻ žÅj÷±)çâêºyÅŠÅ —ê¨mÌýL Ä­üøv™¶Þ&¦MÚ\Wú:OP÷ðõÃÿH°¬BAý°œ<¼6+Jçã%cù7Œ8«ÚèFD Â=µ‘‘•ÌÎZ  »qㆾºþ+mšhà‰VÁ#t÷î]4Zv:‹Ê5×g§> K9â\€å¬¬¬+W®€ÜÒÒ:ÜÙpQîŒéÓ'ÉJGŽèÍèPgLÂ7Ð`g›jDÊÇ¿YFÈ'äš7(¨ŠÂ*këÞº9CiDºRoFê ÜP–£0hÕãËÇ“¢'=ÓÔè>s”%•BùôéSTT‡cá¨RÃ7 €?É9xð À`Ú×-Ó_WcɱÛ×ÀŽ;vÌßßDÜX>ÌÑ9»ºÍ[¼Tvt¼ºH¡&Ù€ÕͦCé†xð <<jÅ›««…­ý”iÓ×OVã£òckâLê´¹íFð‡øú•T|†á*þ*ÛrÄSwT¶j?4={Ðû…™@„aïd½ÄK—ªjY­¢ÇwqqÁ‡¢5lhW ¸¸¸/^ s ôÔ ô'ï/øóøÿéÓ§{÷îùùùíÙ³[-¬¬—,Z¸lôÀ[ Œˆvm¬¬Ž%¤Lå>nFÊaŒ¡úX²_:¨Ó9€  ®¶víÜ™éʽ;Ôc3àF1$Vê“– <‰°û?„„„ m_i8×£—— Û—òÖB}åwÁÞ)--gD©Xøïââªnh²h0©É€Ñ–JÇõ f…®¦1#{O56 PÈ°ꟽŽZ)ŸA~jòÇöÂÃU½cBz­ÚÇSwd˜Ÿ÷ûrÆ´& ´¼pá°hj²N;°EÀ° 5++«©©éK±0Ôw¹»âââëׯƒÍ3àéá±eçî™M­e Æó #ãpÙAáê‡q\n*Rþ~¾_"'T¶ïŠ?¬šbú@—ÎÎÌÖ.µ…!Ñcp¯×—UT Ì.úYÀEàLJr<ƒK¼HHH¨¨¨ R©i]ë嘩 šsrr‚ƒƒÑÚNpÞ­ll T•Fp¡i 8rëÑŒˆUygék~üõ\2*5âĉƒx^ŽüàOŠ–&iöÙùïк §OŸ¢=::Š5óÅÇÇ“Édhغé‡CÆ¢æååùùù9:::Ø;¸¸¸,_µz¬”è{m~ª!‘#- ƒrük¥¹¯]M¢0?)ÕƒÀDzr›u+¢åû!&Dl$£3´y9†ào¤x$<ÙíðáÃØum£zVVVwïÞ-++ƒLûÅzþüyll,øuèlì¦Nžl5J¤F§]Š*ö€Vâ‰aÿë‹*ª â z*Üî?LÕ"‰t’$œQÛvw,÷âysjk÷U çõàx*p)))XR8Üû×ÿ¦T*µ®®D¬¬Äìöö’’)Ê<ˆ‰Í•1«V­Ð%Î$ø±¤ ý}ái„ê1d±ÉáƒÁ®²üÀ¶Ñ8ùF*Ïm5vXHdX\2À¶K€OñUWW×Ë—/×ÔÔ@3ð'ü¸@¹¹¹(å<=='OŸn5Rè0r&œSÄÒ ‰VÒ„ƒ-Ìšø«Aõ€« ¬¶~×ÂÙ7”ú¡“ܵ«p384„°ë†OåŒv„ÒÒÒ'NX[[sdºÀú³ç .”””ddd “À~¤â(Ê“'O嬬¬¶ìÜ5}¼JôÈÞ˜c›v†QOTæÞ³z™8øóAý¥%„!­­­«Æ)ÔèòÓÛ&#&aÙ§ nݼ~*33­Uã¨jâTbõl‡nii§úú¹Ñ_üþýûè8gþwY>Ž¡((ëšuyå‡ -+-ƒgêï-óWS®m“(ÏÕ6í;êßLRd N³Œs^¿«}þü9**jÏž=Vµ€ÔÏÏïöíÛø-C¾ýÉ¿û»wïΞ=ëêâ2yá’•c†?UáÂWıÒfñ[Ž˜˜r iŸë ê/áhíñáCaçÆ ÒX}ð#åI¾ƒGêæltîîîXò |…Ú-$66¶‘¹&>‚|ûÃ#V*•š——°ÇÜb²žöÙÑ\ÈZû”¤d}¾È1‚.ž^¬G…ú«jcì­­N' &훘ó7Ù¾p9­±¹|ùrÇÁØ+OOÏ·oßvZø!ßþŠ’@&“\\œ'þ7w“dïöƒ‹ÑÁ\¤+ŠÜ®ÎÎØ`U(¨?¶`3Ì‚Ø®]=ª¸_s´“¾Uíã0A#ùaÂlJ8~ü8n߀gsrrŠ‹‹CXuZì!ßþ"‹¾lÕêÍ£Ä?hòtœ—6^†àcmÞH£N þÜ[6*m%ùךD¤­5AX³PƒkíâŸ+#I_½zåááõÁ;7´AQQG¯6È·¿ÚÈëþýûæê²Ã^«s3¦œÆµ4cÿQ›ÏL{\ … U¨?làEEMíB]õÏšhéÅgo#&*ö[·y ºÚ“'Oð3Ùq„¥'NœàfùÖcÊɳgÏüüüÇ«Ž½£Ò~h³QµJ›gË̉5µœósAAýö¢[[ß°s¢n©7gK™ )xoÈ@´6æüùóX.JüxR@¾Œ=õòcóä7٩ѧ##"O_¿ŸQ×ÊÚÊë§wÎ\~Šm·©îÙ¨3jZzë£Û‰—æPÊ’¢#Nœ¼rãaM µS~†­Ò¾¾ iN‰?wìxD\ÒíŠ&†¡¾Ê¼öÔ‰§ÎÜIÏm¦¶@EqÞÕ„˜ˆãÇOŸ;ÿèY>…U¿ÆXT_ö.åRlDDÄÅëßçfhËü:ß8Hî}ð°í"Õ€ß잟*õÚ²à¿úÆ&¨Bý2¡¿VkW>ÕàoKÁÎ2c€Ð«×oÀ ÙÙÙÀ¡uìbkk{äÈ‘ŸÌnÔþíCêH¹a º³ßÕ·TYáÛÒšðúö!;—NsAeN¬æÈ!¢ƒd§N6,=tÉ‚eÂGï6utQ‰CH S?Ùxœô0Õ*bò†ïçY/#d¿w–¬Ð+øZ&8¿§¼v% TÐ4ÕTìC’4[²½€1irÔ~žˆ†¶Ñò·ÉÂBý_‚ ®vÛ"}ÕI³fŽ‘QP3ÒËË/0fâöæÎNnØj‘ÁSÌÒ3µxÙl!^.eÝ- «Êäx”å4n>í £…ÄÌXiQÆ<š²Ü¨ñCE¹%å§NŸ&'-&)«¸ÿp"“nôw™ÉµÆðó’´ IªZ†KJü_¾q—’®Îì0àŘ”=¶ïdSc*à‚ú‘)úìè`h(X¤­æĈ¸~0ß«‚B„9ÂË(ŽÏì@SkkëOÔnâºSÑ»æIJŠsóö_°Ùáú£¬wÅ%õ TË®Ü;êØOÈ„É·Š9Cùd ¾o`üQ•wWc¸„´´täýæ¶ 2Ÿ[Šnˉ’þÛ扻gÉACˆŽÒ˜üžÉ·Ý D¯èJ¯$ô#õ%wey K<Ñ?ëøŠñ·ˆ›:á´d ž#¶ñŠüëÒ%¿ûRg¹vªX‘Ik\ÑïÎI “"¨nKé\†®ž &!¶Íû úç½³îHOƘ¤ô’ohä£wè¢ÇÇìEûKì;ÁHðâ«/2pº5¶sÕcgn©$#4rþåZ¢•n}b-Úe:”Ÿ(ô-þ£h%&§Xå¥qL;h,ðH•wéÂMÍÍnP¿qGNœ:-ÏÅ~ÅÌ‚Ÿ7$îWìóþ°BFFF§ÓÇ[[[_¸p¡K&é¾1öˆébWRü]íLÑäë/>Py¼_dm3ã0¬ÅtHŽËÎÖNÌ ÕÝæ-ëÙsEÎÉ’& „* ^ˆ‹ëäçç£Óev›‡Öhý|ùì6ÿÖnÇÈÍ ŸË>eÞ¿j³jBï>‚+C’üaò 8¯X÷=üê¯jÛÖψs‘“lÇ7fg“ý‹ yFnk3ˆÍaÉÄaj“P¾m•%mˆa± Aö2\ãÔ@os]÷C7 XÕJäà[Aß,VN2ÞÀþFƿ˶K ™ò¼¥Cý›žÐ•döÎ>Içu½Ð]ûŸ‚x11A¶„„„ù¹z ˜l°eÔ&q´Ý=oÆÄ‘CÄù…Ä5go*kE*ßëÕW9¯¼–uhtäóë'êÃü€C·pþü[1zßDÚU‰kÅ{í±s€sFCußjêÖ« §èóqT’Éca·¬PRRbccÃÑ €êøñãH×¥Áé&ÿ…¹ý¼<óÚE¬@áëG„—0hÃä Ó9÷Ýüj/kÛ"ÀŒx7I¾1Ôh¿ÈãsMÚ¾%“Úø&'°åÀyìœ8ŽÔ_µ¿Õ^Êœ·"l‹Ð˜ x¾¡Õúo“¥¤¶ñÍp=þ[¯Ø!5X.9»©¾áÚOq|«™5ZÄlþÞ⪚R–ÊÊJ?•|,§‡­Ëß †¦‰•kÀÃw ÏmÇ1]Wø–Ù«·â+&ßП¶òÍïäg€§ÌÓ~žd’àÌA‚GŽGP(˜/ªË-Mymý3÷j}8r±ÞSêèá†0»‚¸»»wœV„¥W¯^Eº4ÇW÷õïMáëí—ÏQ‡vÞA‡ ±‚ÎæˆOßœr"’DÓë°ƒ:gßy|g3ŸŸ8üVûzíÒ mñ)àÛf&ßX³ðXâ³´¢F§±Þñ_o o¼¡ ħŽKê:a_Wx/BHTŠŸNP}FE·ÏXêºÂ`ð0Ŭzä›øv :Úz³QšÓVUãúþ5ßq<)ƒž/DuLÁÞOß"7Ôl}y ÒPõZµ/Áüz)Âî0ò6=q¨¨àð +­ŠÃž]¯Tzc380úý’jõˆdEÇÄ@ÿÕåˆówÚW¦KäU§Ï¿jÁÜ–ÖÖ††ooïŽÃÀó¥K—ºünÛí§•9ú£‡H2HÎ."3¯t:•üæÎѾü+Ã’°ø”YõÆp°ˆ¼Öò"fµPÝ›ª#¤¥vҾП0TL迵^è?½<| Ø(É…5íø†žè†²û2} «®¢[øðäÄž~[ƒ/‚Eg¼7‰Š*?cyËúͦÒ{óg B'78®×Tºó‰Ùe˜\g=O‰Wàgü*mmn,F@o¦OT¹ÍŒ c˜ˆƒ”ƒê*¸Ý¹{×wH/\'sÆ‹&=ž%êò €n­­þþþX27,,µ³³;vìÒ ÙY»µþ\tgÖxYQ¹Q£•••åå† ‹ˆOZ¾«¤¦µ}û)R‘qVUFràP955UÙQê[w¬“–8ý¨µã6¯l8@Bn´’ªÊ5³yúÚ2“ŠêÚó µ@4ÚÿE…åUÔT”Ä —Ø–53(•ŸvYCv€Ô‘Æ&£e‡ÍYk­2b$+>]5q¨®éôq #F)¨ŽUë/¢6kgÒ¾û-óà› ‹oXýŸë5Ö>Ý3]¸¿¤âX5Ue‰sÖ¸2iJu™§..5ØdúÜ™“ F(›y»Í ŠÏ^çö«$ûºÉ89‘þRcÕÔF •Ð3™¡&?ŒÍ7úÏü›ÆnÐåC“?³ÇÅxé=wɲ¬¬,È7¨.¹ÞË*«6ÊŠ"†üøúîÝ*CòÞ1zƒDFFv~pwöìY¤{²ëwŸcq¦¹*õVRTdÄáÃGNŸ‹»›šQϱPõ!ÿú­ 2Ã×1Öl(ÉŠ ?v2íuiÚy;qq±‹ï97ˆÎöùéÙSÇFœ>_T^f¾ÄT^ZÓò¼zpëeQÖW–iäZrÒïŸ9y<üXdòÍ{5Ì R sŸDŸŠ8|4"év&¡?¾wïs™Yÿf:hêjëç˱Q‡K¼]ÝBït Eqnú­û¹ìæS¤©¶üþ›ŸY]|9;õúɈ𣧮ÝJaîصîvâù#aa§ÎÅ¿)quÍÅSá'c¯£ã¼ê>¼LŠ;wøpø…Ä%UÙé Jê~òWz–ûÂb¤02Q°]}¯©€¥œÐ¦»^¾|‰À~¿P?Wí¤44M3þ ÊäÛ?Xaò¾¨È_UŸ’ îYJ„v &ñÚ8ì³³µÍÍÍ…Q*T§%ÇwŸíCÅ^XãÓÂõúsƒE>ì8 –ƒƒÃ³gϺàÛñxü†’ ùö/Ô‚¢§Måñó ‚²úA“WCe¬»»(Ÿ¿ø† õ竼ºvã`^Ä”„UnÐ I1£ûÝHIFÓqäv³µµ=sæ Ò%B: ·„|ƒúÒ]hç>—,µ~h_Vq5°N\¹q 1.]ºáÅQlÖ,˜S®É…µ¿ƒ2C5"œ?¡¹•œ`ccƒOÃÂRâÿ¼ªß®]¶§´¶ƧPÿ·¬‚3†Š"Fü®.å³qÕDP2‹ŠŠ`w8(LždØ åA&²faÖiäŒ'º>þùógKKKŽiþÀ‹ÂÂÂ.´mµåÙJSÞW6vº ÇA¾A]½y+q$7G7ˆŽ#IvvvÀÂ:u  Š•Ñ‘Bõ5ßNe RhÿB5à5-G£#þþþm @ááád2ù'ÊO[v²–¦ÆÆ&rKMÞxå)EU­M ÄQZššš¤óIÞ!ß`¹Úl¨Þ ÇKg ºgÚ ®qjªVVVoÞ¼ˆƒpÏUU•‘#¨†$º1 1bU؆!d?Ïê˜ÛÍ¢´´”£Jäÿ–Æötc}0È|Þ@~.~±96©¨ü÷¹ œ8lÇö C%„ˆü‚š‹œ+Ó ß 8Ë-PBÜ…”±|mÉ»À‹ ¤-¹6ïÚ J©‹‹ …BˆƒEårLtÒ{=£Y¡Q—ÇeÙ°èرcóaÙÚÚ&%%!_mV踨¡¡¡¢¢MwÉ&òüø:>©±· o©“dûËL®lFö+•æ•0Œ]Å<ÕþãÌo`ëC¾AáÕJ£œc„Ï~ XGÖç×32qvvåöæÍ›ß~†ê‘jjmÕãELˆø‰c.È÷M¼r%33sïÞ½ãè]]]›¿<™8ÇûwîÜqtt\ºt©½½=z?eÓªb‰òÎcŒ©Óõj nÈ2þÍAUÀïJ&ºÊ‹v#ÆÓèß :-ivî^ÏX ©ìM&;F‰î±´| ill„pû—eíéóA£jÞ°Yÿ¼¦hÕ56áçûCegg—––öçÚ¥K—V¬X1|øð~ýúõéÓ‡ÀÔرc±™ëYj)0Ó}0å#Š;Fû‚òÀ7G-Ñã÷^²&B¾(8dÌ‹jÈ7¨/JŽ›ÀèÔ„`#T5ž™ÿý‡ŽD¥Bý›w@`§¬õ•qIÞªõˆ>‚322Í82Xüßb`` ¡½FÍÑXÏü¿j‰Ê†àëè;Ÿ_^Îôoö*$טÇè›Y‡÷ŠÔé8¤ò +N 1çRä¸A÷$²!ÿ:Õh6i\­Ô¿U<._M¾¢Âè ÒVC;IP_ ×ÇŠÊpfrrò·ThèêêbpSTT,..îô#ùI¢ !ç®ç¦%-ÐW:ðmÿh‚°‚áÉäôÌÛ1ZÒBóƒ!oP_€`¸á†ê@ ‰ø©ÃûÚ2ï涶 â@`Ü?V6˜óÖÑܬ- µx醬Rž3 »·n..þÌÇÄ à¹Ó2†àšb›šš¼½½ŒŒ¸¹¹Üøøørrr:"‘=›1’ä·^n„Ìa2[ÇA}@¡9qâš~kY°²²ÊËËëxÄêâêëë:n—éééàÏõë×óóó£pûR}=) qrABƒZZäíkÄÓ9vØqâð(ÿ(Ärg³=ÒXG¯©¡GEAÿõM¸œÈ C°¤IÈD=‚¥ ëýàÁx–þ5¥§¥%l—j¦A—÷è¦%ÕÕÕh³)~☎) ñÏáááæææOž<ÁÞ,,,ÌÈÈøb\Þ,,D˜ýLú‰Œ×•ñÂ}g?„ILÄ×ñöFÈd:äÔWµBy(b‚ëg,P¡Ë¯f:Í5 î×èXB¥þ;Æ~íTÓ:-.|Åì3-â…¸ ÀäÈóþµk×:b ”™’’mmí¸¸¸ŽAèw'vÔJãèîÖ¡~ò Š£Œy,athË[H7ج©`cï€àÊÊJ8"õßÑçºúiÜÄL°-¥©€›šôµ»:XÏeeeÅãÆ®®®5µµµø ÿâkþ­³?;L2Õùú¿’o_™ ª-¡½+§Ä‚ú}ª¨\'ÍÅÎ~Ã2r‡ÔÄ÷XX E~}V¨ß¨õ6Åãyð~žnH\`¬û(- 74Cott4Z6Цv2™ l¿››[MM þJïyù-¿x\X"FfZ÷=¼ ¿ù$ÍÖW£Íï¦~itßëÖ¡,vvvÍÍÍð\ý j¥P·ÏŽLÀOEDJUìuîâ刈ø¹•¸mÅmm]CÓMÖ¾9Ås9¹ÎyÓL³µÑ]îß_L'——–VÕ7Ckø-z|ÿ^ä`>ïå'-Þ©ª Ê@‹ñ­[·àã_P~чD³QXË3Ñb”ÈËüŽÑ¦À¼ùúú¢Ÿòg õùH‡Î!=‘oè¡Q·Î&òÍ^µÝÝÓËÍÙa‘©¡ßÄÇ ¸Sê͙ܶ²ù<Æ7¶¯C¾p–èáwdz×ö5×XCeÃÁËxÞ¶ý‡KSÐÙ´ÒíÞ¤ã?ß~VêNª þN W^^¡3”jHÄå-'-’æµµcMD~ðàAxíÿ fþþµä*<¸¹MÞÉÆIIIh·7¬ÙíR__oll <Ûï2l¿‹o@µ7H‚kÜoã#ôè à 2Ëëɬ~„à¬0OL»“ƒC»…¤Cךö/8Ã_Z¶ü@ÉyÞ±øϲzãã>B£Ñ‘Ðüñ:ÿ²¿pè!5·´žÞ´°Õ€ˆ¯uy¨ÜwþòUNNN H;Ùîÿ ðÉÓ?Onø ÂÕ+W¼ØIÈQ JÅŽ;€Þ¾ººùåõl¿™oÌ£¼g»˜H>ZÜv-œT—<š 5€w^%„¯ØÒÔ\â²w·ƒWsOË^< ò°_¿níÖÝ6gïÓVKtéËÇa>û7®_·aˮШ+Z˜qŠ5/¹‡gƒ± ¾Ö¥Q‡ÇDWÛÅÕ ­‚ú@õTóžW*mÕçÃǧûGð¿{÷nïÞ½(Ü\\\,-- ×­[WTT„ÿì¿äßGZ‘´—‡dºÄêù»²^p«fÛt¥¡f‡˜WoŸ¬Þ€ÌÚ]6Ö;V+7K^JiúæŽ6Ï”Ù<_oÔ¸IÞAmÖÏèÏGZæv¦•Ù\sÆs‡x£9kœœ7-..$´Ò#¡·>½ä3\ZÊ`•eò­Çd:r|ÿB ­¶®øåù)âb’W_V‚×wœÖô>Õz‰–œü˜ùëm›ÄŸUÖ_Akªí~§ ‹&KˆOÚv¬ÙTü@GVBvŒá^{§ÝëH óMó¸Ù#"T†b’RâÇ2z`þ 1%‹ñ»xx¢ñHPP…BˆëÁp+¯¬Ú ÝŸ©A—ïìŽÇŽǺ½Í;WYYÙÜܸùÃje»‰otN1² ƒ÷î˜ÀK’¬¬ª±p“õ£×åàaD…` rÍÎYª#&3БµWLL2øòktkÙ‰‡‡ ”ÒžcÉl´k^,Eè-·K¿¿o;—¢w ©l|£Ó¨5ÕU̶µìcѳ'¶ÏÓ“7\Íx‡ÂàÛ\¯èÿË·»î›øù¥bKY®²éEœ¬ׂ#ž>zpèAê“X)IÉ]aWr.ØóóñïôMÏ~YÝHi«Â£ÿõŒCÏìÌ Æu¸^"àñ^‡¼± @œ••:¬ª§jÏ–Mt.ö Ž1X¯z‚ØNöH=`ᬭ­Aa/‘?²=½{øƨ“¿é>l Ä€„ù…vÆ>áXƒBn­¯«þP\ä³f|¿¾|n·*z-›o5Ë4‡I™ƙ݆…cF©Ï¶dŧÂ}ý¯?ÃÁÔ3[…T6¾1ÝÖ›í ŒF”6t°”¸ˆ‚ñZÊ×øÆ œ p|sÛÀ-¤þš=Îã}âq¹ý<ˆ­Áô^â <ÛÇ%Â<ă‡Ê+Ž™ºlwI#­³V‡¿U©éOâД8èí»É˜4W[ÝŽY±ìàànÜì%ÒsãÓ ŠÒˆ1‘åßåLÎiˆZ»¸ã»…€gKKË?¶±©ûâSηZÊí·,œmÞVéÆh ¥7ÕUNU6Ys AšØ|k\­+7@ÓW=W9MYN£oý˜|c_†l¾µTM×–4Ú(,*!=ûEu]ËI§UÀ¿}…oèÖË_'IHI·ñMXã-;hÉR}ø#+¾xŒôÖê;W/ø8Yjȉõ×ÌjÁ×*þÝjhnö”áÆF2fJ2"¹kÉXZYc™"Шªç©®•²[¢`Z[¡‰$=™AáÇ#8Æduíô¦‰k£1/÷F‡…z<Òz™íÆÀ¶–e—î³Àû1‚Ôcñé¡-Ä%F?a×yÑ‹Ž1«ûßh_ÜÙp—Ä3`ë”цk0¾ÍófÕ¿E8-•V·`VÑ1væùgRÿð ìwyê¸A¼ÆIؽO½4wÎôĬ²›ÇXXùÕ³¿ëÓXñ>;#?÷˜Û7…™6bÄ×¢‘Ž°ÇÂ-ØvvvØ"=̼K¸<º/–I†ñ0äaQøÑ£ø„!ÀƆü±Çòëú÷"¹øš o?YÃÐØ[ÍÌæÎôˇ´”†÷>¥¨¦m_Â0xõÙ1ÂÂB¦Kí˜w…†ÿiŠIˆ™oÛPÿVþ.kܾ3Y,Bn­ ʬdüAÎ$5Ë‘Õ¡:>ØBXPòÐý æwÑ_„$9<…Å·ßÐ6‘ mSE¤†9Ÿ`¤Gn-Ïœ>n¯Èd°j²Ïb¢„e Úg˜ìºa27®²‡ø7´ï[µˆ1P˨oñJ¼–»v`S“£³£Bõ<­Z·¾NŸ¿íÖf"pgÁPÍÑïßþðÁ,|ë¦Äúë–¤Ÿ™aª3d€(7W¿~ý¸E¥ëO^p-»ŸµÍd½e¬ uYVj£‡óôëËÅ/¼ÖÁuÞh¹ñ ¬˜¸kY£8ìÈÝ—ØÆ3.Ú+L²®k¦ÑÉ ‡œ¶Ž"&>hø )I5³Å.û÷Œ(© µ¤iÙ6E[J\HÎxy…V^±ÈL[Rˆ—_HTd¢{ø¹YúwòŸ‚¬d§Rñ§£l×âé2Ò¢}ûôá%õWÕ™ýí×ôqË<ã!ÄúõéÛ›Of´šý…ž3O(z§Ã¥Ží‹ïÞyK¾×îë°º—ÀÀÀúúzház˜£ÐhÎ¥™’ÚÒš ¸ŠŽŸŠâ˜jð­  àýõ1¾ÑÙ¹;¾2åM×D=”¦â‚×éi§e¼-*i!Óö(榆†FÃjJßç–TW—e¤=~–W¸¨§8bògt¼Ac]]+¥m† ¹¹®›†ŒVZøúÑǹoŠ=âh-¹OÓ2Ÿ¿e„¨ÍUOÓ=}‘Oe®Im®}‘õäQzfIƒV õõ*có”–溺nÄó%µäý°ËÙ¹o)¸¾‹´ÖyiedåTÔ6#mÙzânݽ{N®žo…Üÿék¹¹³*™ÝÝÝ?}úáÖÃTú¹òÀd Ü$ÎÀº÷+‹{ùúáçÉeÀßß¿¦¦æÏç[ss³âµ›7®w“—ÃO‡ÓÑÜqáÆ¡-BBbçžÔ¡Þ;'#-hò¿Î’-}ñ¯ 8†wuú‰cK;l­Ã¸-zwºàßÀ·—y¯ÃÕ%ñíA9'Âëíã‹ò ÜÍsssá¼3=Ì¿½.,Š7•CSÿ1tÄ€Ïrš‘«›>8¬‹ŒŒü“ã[}mõü VˬR’¯"¿u„ã+ëòšïc]gfg¼ÃæÉêú@¯+ŽNÝÔP?kåöðçÈV¿8;+ó߉8æW’k>¥Þ¹w'5³šÜ}‰á ¾&Ï…Ó1óÆ ÜÍúlܱ íå îàÝW§õ[”žö@S»¯1dñ¬ùo:š]?[Vvvvwì@mmí³ììœÜœŸy€ÈìdÖÓ§¹/rÓ§N]¼9â%rô²Á;ÎÞaÿï]øµï„WÑ/—߶µh"Ö}ÜDàŠBß©s‚[9:PÇÆÆú·¦ÌÉO”û´ÝÔŒITy6®\μ§íǧEÂÆÔwq©óó¾Öv‡Wä6ˆŸy¬v8¸Õã8x±Åõˆs̳ÙHX:=<Ù|m¯íþ¦ÆÈ•\Á~>ú$l"PÔ›õøô\\\°t¾ÝTÈ¡~—nGŸz¡D@Ú|;é”2ÿÆM›ñ.ëîææF&“»c|}¼-NdÍF‘~æqä)rø)ó5xÎ`ÀíÐÆó‘Ldÿù7KÖí,ýô¡+àFçôg¥ôü–<ŸmV¡­6¿£ÿë)¹&ÿ:w¡^Ÿˆ/êˆ QiÜxggg´œÿvÿþ}xìI:íáX¤ÖοùÉrí¶Ü‹ofU êß.^¼OTO’׆eŸÇ÷ÃOÀá'/°ÛÂ?òÔÚÚúüùó)ßP#|÷õòE[ã.œÿ90>U㬥oy/÷Ûý[I~fÖëb* ò­ÝËÌ>«Èχˆu…2!-Qnïè„ÍštäÈx¢z’vª7éðàÇïS³°²ÂÌÚ»wonnn7íÀ/ðo(å³»³9“&M¤R©?Yœ¶‘$*!(5òÒã<ö ¬­ÙëIE¤fífZ° ´GJ ÁÐñÞŽ†#Åy¥äO=Èc¬^ž7YKQ\L|ܜퟛ0WÇøŠ×‘ûD%ú‹Iø'>ùvó²MA}­[Z¸Nôªèƒ£ ™ €…¨ÀËíP´ÝçˆÅ) V…¸û $"†mƒ³(†¤Ýjímíðþm÷îÝMMM)ßÙ.Ùsø¦ššª‡‡Gzz::gÄwÈ?´‘_h°¶î¨y^qì“ÉÜλh1áA&f£Ä¦íBù¶PkÄ¥]í?]d HP[ˆ±ByÞ¤ñ ªš*CdÇ?}_Á'JGh6ÿ©0vÈðù†U×µ4µPÙ)LÀÿ›ÔV;UÖ·Pi´–æ&tp+ß9•Ü¢æ¸ÌW64.‘“@&ÜP}òÂVmíhVVV= qÚ½Xæðh5$­¯`kïÀŸvß$2Œö…ˆô#O»kOÐ4Ú¹"dþž€i3f91GÔÚØØ ávGÚ£ mäᕲ=$*möÁ.Ðb=¶‰~Òv‚À¤8¾íà}°–€´ž=Ê·‰êrf[ìªò¸œÉòntZceÑt5ÉÕ~ñê#„üp|Ã\'¹é£Ÿí¶éMŒ'L^³Åêaq3Òðnéì)ò#’‘S­•ÚL÷7ß0{­•…>Ú¡}íþÇ}‰ÆðˆŸ ø*í±i›>ÉÎή¤¤¡ÇðMŸ@ŽÕïшÔlHZ 5Ö¡}ã©¿¿?:n¥;çãí¹5äæ{ þ·k™š€Ûuw~âq»6$•ŒQîh6¢5cÕ´iSAè?¨C‡‘ÉäãvÁ¡M<¼âGÒrõdø·'Ô2¹D§5Uïœ=nÒÖ˜[žˆ·Ñ¿Õ>RîKÐÚr”Í7YÓm~|– OóF­x»èy¢” zqužü¢_{ÿ†"nïŒ1BFnw ñ´U• $®ó‚‚ÔÖ6¹­9v±uAqi ‚´¦#ñ¬ N(ω—>—Qø—yad‰Ÿ2ºÀVÞ²ÛkJ|ÃÒïCýíj¥Òfp˜5¬ÁYM†¤ÙZŽìWldV÷ÕH<{öÌÊÞÙÅÓßÅÓ<ܼ–¬Þ0y漩³æÿÈ㿦“¦™Ìßtâƒo!©M—î\µj%K9ru‚’ZVV†|C/ŽNùÿ±iã Mõ)»Ñ °º,ÜÀþ‘ùô[ûôø'²üÛÑRƒµöØÙîaÈ|ãê%£$øEä´’_|Dë߀3ÙæWš/É%_Ãrp—íuU7…"UY²íù†îLåm;‰ã÷Yéáš^Å áï½Õëx}p»‚ú:w4ù.ø3És¹èµÇ™¦ %ζ9Iþ‡k–Ðê/Š˜µue|;1VhöøÒ~ùòeH†ž¡Šêš¥ >e®7"5fkstj㛽½}LLL÷&âh¯sgÏ‚bæääøC'+KƒéËμC|o|Ö4›»iÃ:ü(Œý8Äyzz¾}ûöëûøîyjhðàà _ÿë¯>a|‹©Dž¬â¬žUÁVpÛ±¿Êò:*’d¯GÄø¦=Zr¨úŠukW¬X´lùŠ]¶ž^±ŽÅ7_„Rj¦*5mš•·HKB,(!•V–%×Á¿˜1¾!ˆÇò©#´¦”R‘’K^ÃÇ>xYM|“îÈ·¦…Ã)Ï°%³PÕî‡ f·Ÿb7WwÎÊòæÌGz¤Í?+EDŸÏ·ó*‚«7lĉsçÎA2ô e¿|µW²ßêõ‰ó 4qƒOÁ/ž””ôñÍj¯å(5ýi V;8ØuJ6,> BÍÛŧg>1÷v£¢úbWò§+¢‚CÎÜbô¢éÀ·ô/mÇ7z†?iĵ×U>«5•ôÖT[Ö9ßÝJÒ# 7Ô¢­­ÌÝËzx=ãÅÛö|c¶éÖÎ?ÄX]^@bÔí‚FëËò¯J{œ:Y‡Ï·K*¤Uë6àùŠÌ’Ô3”š™åØžoµzÄù†ÚþíÖ­[ßÀÏ7€¹S¬¡Ï`°°°êêjäÿ¤ÁìtþßÎ2ùVü8jØ0 çˆʫ=gNQò|ãðo@;GsmóôןkY$#€íÈ7ôÛŸû÷s7¿…µgä×Zƒ…6ÚžÀó ="ÿušCÔfVW¯”ãW_àP÷Ï÷‹›ffZ9¾/~¢Àk*Äe«VãùvôèÑ?v’¨ïÒõ¼“6¾Uë˜èáù€––ö+¯‹S§Nþ|/Öð> ßTŠO€MwŽÝ£¨ýt7·êßZê‹ÍŠ‰óiÍC—&Úéð™±ÚOh—RØþe¾½2Sa¼ÕýëqÌîþ|}…µß3ÿ|!Åï{åI;Óžh%¦#HŠ†Ë²‹Š>å?Û1}œ°Ø°Ø·¬øtôVo KÁõ™uÜ’Ÿ[ôà#së R ðzÆgýãþ¿iSÊǵãÛuþå+Wá‹PHHHcc#„CPFN®8g|:ß@‹ƒo™™™¿’o=bÌ?üòóó»sçNÇ÷SSS/]ºäãノ¨p~=üü¿*¹8múü[è´ÍTr´ï®'Ÿd7S¤Eìža}É·Ïn;V.ZúÅï¨)¶ÙºÊ28ubUÅ9kçO]çÁš¸Z¿jáÌói¯Û¹Iæxûpý¶U2ƒHl´rÛÑLV—­GÉÁj¦:¨ß«nÚ¿oçÖS©sj-ð™¨3fovoþ· ¼™^žoWUˆË׬Åß ƒ‚‚Љ þvå¾y»§=ßô‰óôÆãùÆÈ«–•õ+ùFû~Ý;|øpSSSÇE`ƒ999€oVVVwïÞý²±>K%·´°€ Q)äææ›@TJkK+M Bn+’¿\»Gke¬Ëj賈?ÁÚè f¿\ðat2Î ÁyóÈêªõÍMuÒdlJA?B nèE¨--[lY±‚ܧ/kŸrs©Bó‹—4| ûïI}¬2]_ÿ¯"°jýF|i ü_{ç×Ôùõñ8!C«­ÖÖúw*K¦€Ì„áh­jm­¶V… aJØ{+   ¨uÖ .Ä…¨Pˆ  K2÷}’.7©o]Î÷Ã'^à !9÷wÏyÎyÎ «¬¬q KJPò§Ív­s–Ñx }ËÌÌìúë6̼{÷® ZÑñ.çμsðÓ "òó‰êêæ€bíÚæ'ÂB¸f›æà`"9Yx†¿?áí4Mxìà@„…è[Âõ¸""‚ÈÍí±?VY‰0W êÛNÍ~‹DÝÀHðœ) êeílµ¾WXÿ6s‚¤¾ÝAWJwÖ7¤ÏþþþO°Hë"´PûÃQôáÕEüu¼ZÞ2ó«±'çO‡|öaɤê[’fÿ_ÿXNµöàà`œxº;ÈЧȊí_¨5g}m¨ãFíÞëæ–••Õõÿ–Nô­¶¶¶¢¢‚ø ³fÞ² 'YøFùÞɧ=ÁÔE²<»¿hV›¾mÒìÿÛJªµ–——ƒ8HÇ;nزÿ´EßêÌYsõÕ׬mKGòùü{÷îu_}ƒ®ÉŸ"&ŠíÏZ§Þ…OƒøTjôm"ŠO¹mCoÌYK´•œ]\¨õwïÞíÖñ) êšš&* %û#a}óQégï*V*ñ©Ô°@åóFSjÿ7žÆž“Uߺ{~¥ÏÿP@X±¨ý-T>vßàùibõ,ë JEP‡å9¶¿GÝÙ”‘‘útwndßÃh[mõ'_¢6ÔÅõ!ÒJ¤Ý²¢ñäüá­-L™n»ÊŽœ/óþë{A߀wÁ‰‹iG5…óe¨úöµæè5|±jððp¨ï•°dí‹ }¨Ù»íç²Â•e—­XIÝÐôž÷g¾ï‚-‡å2©£” ¦‰ž_|”9ìÏ’&ÒŽìËP#S ÂÔÒ~ ù?ýħì8>{ö,èÐ݉ڔPeÊ¢Ì?E %}#OOOênÄ7‚!IϢĹÓiÚòXßpÞü¶®üÓ¿to ‰ôíèÑ£]¿æô è)) ú#I ™7Ï™|Š';c®Úˆþ ÇØým(äºþ;útNÀÂïdæT4<+F±Ïw »»‹uã‡þ½ÒÄûS,F6·½ï,ÂLa–þ8wŠ¾íÞ½ûøoÔyî oÀ›ùo MMßLÄ+0-¡Škæ YGWjs-èO.eï{nÁ“­Vª¤Ç.’8梱Cøžd|ºeË–œ6ÖU¤ž½\S/ÿ xÃàôé³âuVã.³-¹`ÍV”¡…„„¥d´/šÔð¼²Ê}§É‚ÕL)ztB[ëá‰ojèÝ“ù€T߯s?°Y|þÉ‹g×Ç 7Í-­îäÐ7àu,0ýúõDz‹²‰ìü¥1}Ò˜á¾~þÔRO— .À+&M·¶Ùß~×lÙ¢o¢¤9{ó(ÚüÅ¿â.¸ˆÕ«W¿á|çÈÈÈeË–={–ªrí~ äæ÷Ú·õÔ§<*«îðiK„­ o@'F~$9ù€Jﶛ8—¡%»höLj«gÜÛùñãÇð¢IN®kèÉ·•ørÙOôå´´´¼}|±¾ÙØØ‚7ùè'ÐD°X¬¸¸¸/^ -’ð ›[³ŽoPÂb}¦±~×~í©¥u„›¦Bܶkõ/˜†¸'klêÀƒ}:Ñ·7—tûRü7Ö±±½ùŽþò é[[ Õš½pÔ€ö<2Åàã㓘˜¸é?oeeE‡Ífûí·.\h»] ŸJù"Kí¥ëRðŠï9Æ¢´–pÕdù캌¿˜É¢bRñ)ðÚwðF`­ñX‚àn^ˆ5eç(ÖG§QQQð¢IŸüaa êÛܶ:qðßÔ¹?‘EAoò[lmm‘¦õéÓgÀ€gÎœ‘x-ÔåL4VYì þ¬¢ø¦žÆ¤o|ÃR³°ž5 í7lÜÝv l@߀Wñ¬¬|ýšpçi«¸5pXk¸Z«]\©úæââ²oß>x¹¤W7~•~Ju«Ä”ýÃŒ©d ÕÓÓóMJ|CCCmll#—KiþO¦šÛ«—ü`<Î&);g¹çÆŒµDú¶F‹qä:þ_Y›Ý)j?€¾¯{û^‘>–FuÞj¸ìI'º{xPwÖ;;;Sï¼€ÔÀÉ3g7+öjÝ‚*ôâ*MvÖ´n±GüçßÒÐÐÐØØHªÙ+ú„‹F±‡Í“Ìͪ~¾~¹Ñ€á“Êê¾*퓉«ª•… ­FëÍÿ‹€øxmóV4P8D©m[=ûœ}î¢_$&ä"}ËÉÉ!`ýMm`ú'} &Ùº¹ÞŒé4nèšÖÒ äÂeff¾á¯èÜrÈüi¸ÍŒQ£5ŒôÔ¾\èºxþªçM„§aÿæLÕÐ71ÐÓä~ïô¢õg¾ÿʃ‚§‹‡³ ëÖô2o+ö‚¡ô¸-[©MÀ(>•ÈvR£o.ß~YlHn´>ò‡ÒÉ.I'Nœx·¶æ#ÉDÔºòðÀœ DÍK",”ˆ‹[5ctìÆ5k¸ò±×ÖÜn èÐ!Añ[rZ¬º¥8Ä”>ÏX7r}µ8€ó&}â†ßÐ{÷\QíMv¦´d¬ÍL¼¼¼ÜD)ÔmÛ¶½ógsæ ‘’"|>YYÄÀÍóæaSÐh‚À@á×+*MMbÔ¨övú´GÐÔ¶Ú®†Ã¦Tö²žh÷ò ‹ðôô”عpèÐ!i˜°t¤r×®¦§"}xákügù¢5Xd!!!•••ïã­§þ QRãØ¡„+¥µbç´Kv€¾í©¬ªþë‹F3f›ÿfÁŠUQˆˆŽqu•LžÞºu ”MZãÓ²ò„/u„ùQ ^†Ý2ºïâ•òùnx—V^^Þ;4€gtŠï]íä|Ð7 ½aäÇŒlÛ–%<à0f©þoÇŽHШùooïüü|Ð7)–¸oæÎ'¬˜TO¾À@ÞšËñôô¢n=îš6ú´_u‰ <§Bk7.;m\ï(o???‰Y¡¡¡0vAºÙ¸}ÇæQ½ðF­–ŽI–l«a»Š !>>>ô èF˜û„à2(=ÉY»Ô™çSÏ;88PÛ¾!­KHH€¶½RNá8{êýîˆcæ¼Ø|}}»lô àøÅ´=ÊÂm dæ=îý¿%‰Z‚mv.ô½=Œk›hì!߈1Ûƒ½½ý›Tù‚¾ï38]±`¾À„NuÞš¹,×?–†EDHl«wrr† ëoÒM^Þ£¸±tj\“9ÓaÜçî|wÜ ÉH×4Ð7€*qž:Ž(\l!3§–ì¿Tä¼#c|||¨ú†îÝîîî n=Úº:þdƒ³¶% ô3œ¶lÙ2w>Y²„®¹ úPñŒºgÈ 6ì%,˜Jlù{¢Û4uñÍÑÑ1-- ô­‡ÜøÂ#×eê‰urn4SPü±¯/¶ŠK—.¾]Ù†Ñm:lÞÔ—¦ jÃÞƒ#iG““÷íÛGV¾áú^ôé³gÏàuë!¶q?ïq”Ö ÜL†tì·©ÊO›¿/2‰½{÷¾É8Ð7àÝY/~¬x^¾Q±/u™…à0}ô†!»ulÝrH§ÁÁÁõõõà¿õ ùã»Y—!^Éœi¨í&Z… ­®®îjÆú¼`æÔÇ¢nä-lÎz:¾ÎÉvÿþýÎÎÎ=-“““AÙz»ŽžŒAµE©j–Ûþ‰lƒÇãÝ»wü7 kr-ëÞÏÑD CZwrÙ»5ÇÎ¥zyyIT† ²²²àEëiwÀ†:Ï'È“Ûí‘‘ÜЕ›aÉqwwG·<äÂÿ6ìô xÿv‹X¾xA“9C$n­ ‘8,»)¦YÿÜ£n¨'wUCYo4’‚G¹‰ÿ£µMœºpL[ÕÁ.µYt\óôéSˆO®f½yOž°ݺ®Òbº™Ú²‰ûìÞ½‹º' o9º¥eevÊýÅÒ¦\vÂ`Ú¹3§SSÏá†!deú411Ä­Çò²¾aÊÈÁ„K,‘jÉ60œ°F£¦¤¤tô nÊü5®OµÅæÈÔ™1"g[466†„„ ‹¥–½9::–––BCËžl0ñ‰‰§ÆÐZ‡Î§k5™³BÕ89;»ºº®_¿I ħ@W°ÕÔ«×í?¥µt¿i N³ ™ ñ›ÒÒÒpÃjpºqãÆ®c½À‡bº†¢p4*‡ÕÚ·œ•¡+ga çãíÃãñÈ,÷зž,nµõ ‹gÏl$c l®VlK¥/êM¸9µ,=ž>}ºëDÀ‡âÔ‰[•z“‰TQßr6Xïù‹~Å]O»Èó}ë±ú&쮟žž¢?€ààr&‘ÄY°þV¤íÚðúõëÔj7|Œ¯¶¶” Œ§êåKÿÙÖ¸‰¥/ÓRñó5|w—‹/v…û è[Oöß¾7Ôª4”k¦Np6¦/0ÓCߊ¥.»¡'''\Ò¥ 8EÄæmgt8Ñ@ª\¦ž‚¹ÕD7>?44´¾¾âSàƒxnèÀÑÍýšzo²Š »pžŸÑrr…ðxDòô­çèÛôá s¦xsBÖ·}heeåeee¸ÏYЋ>ݼy3yƒ€N¬ ñ‹­]Ú8‰Ö"÷ÇÓgYš#sÊÍÍ•8ô x+‘i}Só‚YÓ—kÙ,Z ¾¬Ëؽ9°cÇggg‰´¢¼¼üýÛ$Ð- [ȯ3§<Öí#¶ÇeíÓ×ÄjbLLLMMÍ{Ž@ßz‚Ä%mˆ:¯Mo-iù¨1¦Ïâ "33Sb| :vpp¸zõ*(ðÿ2¶²òç¼ñŠufL\1Òr'µ`GŒ¦ýý<#ü7à-Š[JJŠ°¥È\ôȘ1|`c3<´öãPdºuëÖ^|tG%MR¥VýÄ*â,Ø¿(~ôóÂE>|Ÿè›t/‰\½•9ÿ &aÍjª€»2CF+œ½p‡ €š0Å|>¿  Ò À3¼Ð  ðÁ¦‚Ô[jµ)Ãl;<2²¬¬ì½™è›´ÚXSSSNþ“Uã•DYûV3®‡ÜÏŒŠGçœ:uŠZÍ‹qâügósûcI–žœx2‹]bÌTòI\|BCCøoÀ³.l9 «fM.˜@o6gµvÈ=m*:E öööÁ)’»èèhP6àMÄ =>¯ª^naðÒD¡5ŸÕ¢rO&0¬µÕSD]RßC¹è›T†¥/k~üÒúú8ÉöGEãeæ[š O¨Æ¢þÃBçïﾑ)ðæFXPôlºâ§„5³©u›36ºtm]Ý+iiï!F}“¾°TÐÔ´ö%y† m¥ \á—ec¨RXTT__Ó~$="##: oKâÎ¥ž_¡ôYuIÛú[™6cêWs½kc}“.‹þ³.Ào÷0Ù¤ež)‡å¯1ðïCÉè¤ääd''§ö›è·oßþn©@²É£ÉÉ‘µì¾o Ž$î ªìüÙ_“Qê;29Ð7iZô@¿.ùý¸J/ÉÆøæÒþ´“g΢Ž?ŽÅê¼!qÛ´ií+w`“ëb7ù ¢a‰kËsqX»”z[O‘8ô èÐPXêæ`[O¡Åa£LߪƸšŠN»{÷.ŸÏ—KÑŸŸ_—;H™}FÄlØ3V¦™²=P¸AÕªßiµ>óçÍ«klÿ èd¡£^Ðô9šŽÇogµì<}Ñ9ùùù«W¯nŸS@Šwÿþ}ˆLwêÅE†§hÈáI»”#ìcê²K~žOˆ–Žßzøú&&ÔØLØ,Yœ2–&nµÂ\sCx ÈÐc“7nN´àn+Gí¤DnÆ?4‚f?sÒíûÁ“¦ûâÊ û©·ud%;0pY3…X5–½›:­¡¡áرcXÇ$†) Ï-"".qº¬Äݾs÷û9s—Œ`UÉSg!á€2#ºŸÆ'¡ë¢$þè[7}Ç‘³åíé 6°¬åí¦¦ØuFò¶*ƒ9‚ί®®ŽE:ÖÞssvvŽ‹‹«ªª" ¡tù{úÓ§Oœ¸ÊÃJM™Ím‘å‹ÚP?Б1ÐÓ.--•X½}ëo1u…ÁZuT–2¡£uâ<—=ž®¯¢\U]N«­­Å©Òö£ç]\\vìØA@×# û\Hâü‚‚uõ ¶©)Ô™1„…”›;zl0–w;xÓÆ Å¢á¼ oÝåæ…Ê«ª£×ýú1­Ò˜..6ÔÕdÎŒQ–]m»ÿ—ŒŒ GGGj'^‡#GŽÀŒ? {ÝßÑ#R¤àààÅ ~ó³Iœ…ør—-0gæL`Î1Ô<})è4ïúÖ¥– R.^š9vè}C9®”z窚 ÷Õ§ YwïâÿOª™D6…¥ÙÙÙ8¡1)Я…}ûö­´w4Tv@]¾ïäÛ•/œá:”öÛ¯‹_ŠÖ–;\}ë*+……+š=‚FæÚ9,‡uQ‡ñÓŒ¯^Ö ß¬¼¼¼   ~Jˆ.róòòÊÉÉYºûuqñâE/߯¦NsQ”£'CM±‘©Õ}Ù?•>Ú´!¦àYq{›}û€7)ü^ä—”m^±j#½ƒmi#²‡Û]™@c%¿èXtrcc#zÓ=<<$ÚTâGä¶ÅÄÄ”””Mº¬*œ3øü¹»»‡=ÏÁZ[=rD/j‡CÒ‘k4g–˜²7< z£„ÛúöañòóÿeÌà‚ L¹¨¼­uWB‹çfÅNTê³xöŒ’Ò2tò³gÏÂÃÃù|~û-ó¸¹ôøÝY¤Æ ¨©©‰‹‹óõó›4}†“ê'ÆËãyIÍ”+E˜]µb%}A[õ%7õܹêšZзVTUŸ=}j‘¡úN%1I¬™'ÍOw3PôÞ’jkkÓÓÓQ@Ú~¨V6Ÿ“'OÂ+ HßÅ‚/_¾Œ¬}…½ÃL+ŽëHù _Ž–»³k'ÈîÖdÙL6Ûsð0!\£ÞúöÞîDè ¡™Ø´%Éö+n²º\½±<îK)Ñ‘¾ÒPÖn˜l°‡[QÙsB´Ÿ4** —·I(z\½z5únQQu €T_>ÈÈ}}}‘ѯ´ýÓXqh‚²ŒDC~rÉZÀaÖ”Ÿg0n™½c³øuÈ»¸aBb6ÎÕ׸¤)[+ÙÄóMB›}plŸÓ¦¶èÕÎ;‘²QWÛ¨1©Ý±cÇ ú눴ð-[¶xzzúLš6ÝVmÈUz½™¨Ø€+ž•³@î#f(m%G7íìéœü'þ4àÍß‘{ R^0^e§"°dPç÷‘…mfŒz k¹ZnaëQ ÐíÛ·=<¥­üuÑÕk×:\É‹è_]5üº566¦]½¶ü»¿±i/‘ól!Ùت¥—8—ý„á0ö{çÕø¿?{ö ¹ßNNNíË?H•óöö~ôè(Žö\]]=<Üÿtt614ðR˜©+œì@N\¢ztÈk0”‰T’Y6Amktä­¬ê›$×åà‚z•ì×44Þ¼s7q}ÄR­‘Qʲµ†²„U?¢%}@iýaÁ&P4ªÙ7ÐhÔ’Å‹ EI„âââ¿ÿþç $R²õ. WÑ9Ô6Gð^=örÃ555^^^B—€ÏÿÃöÏ_fϘõû¦–,1‘Mˆ'ïZÝ f)#S«ïaÓ/V|eñ'ß³C®g^\¯Òy7/ÇÉÆ'‡dêÈÖ›1D‚Æ¢8Éä„uL™öÝçôÃ;¶=|”‡•mûöí¾¾¾¤²µwÛP@šPXXØ¡Ó=ùJ$DuïQQQdÛjoo]ýŸGôÏÀª2eâ\^³ä¢·¨¤Ä’ys\_«þ½œ—,|pçvqII]}}‡á°Ô_nim]z5n_»j?ÿ;£>´,m¤]ÔM£dY®Ú­4VÈ3éï 5ŒçîHEEòÇvuâ¥6„ŸŸß;wÀy€N®JDNNÎæÍ›‘Ÿ€+BWÚó¾=ûgµÀ}^ˆºU´Ìj‰§,Yº})ÒbÍ•=ÍYëëŸý0çu¼é»S 2²ïyúúùÌŸµÉLéèhZ‘^Š-ñÒ‘ÚЫúL¿¯Ûˆ¾~ófîܽ§èyú 7oÞD>ŸÏÇ>[û¦”x³òºÏž=KÍ#ÐÉEŠ¹¼¼¼ððptùàkÊuÍšå+Vp ÇÛ|Öû¶ŽœðR['w á.sÌ 3Æ#…•þèæ­vÝ{4 ¹tézññFxª¦Iì´âñxÇG+ŸðÿwEÒÒÒüýýñ…†.+O¾»ÇdØ 4ý~ÏŒõ¦ÂÎKÔ‰âëH¢ÙF²é£ß_fÉ´‰OžÈ½—ý¬¤´òeMó«Ÿná¤5¡àñeMQIÉ£û÷N>°tÚD‹zK#LäD^n»¼ EÙêLO ÒLqÇŒ@/,þ¡ÏŸ??yò$®[£V}H¬³¹¸¸ Ÿ-..Nb)(¼æ%Lº%ÕÕÕ7n܈]µjÞþãííí°ÚeæÜù¿M³^¥öiðç49ƒ°Âkq™ˆ–/ 5ЊU¤/sd$mýàtÝ„Ÿ¦­æÙ;úºœþ:áÞ‡z:üî±Ô vž~.v«’~žzpºÎnUùcJ´âñ2„%«½D™G3Y¬kŪš 6„æg­³72ðÀés„0¹S›’’²eËôÂ:::¶ogDU6tpôèÑÜÜÜW5³àÿ| ûü75Ý»w/88˜ÚÀùîîË—/:|øâá¬;ºræLñÅsñAN­_i2nþj°`=1f†*Êõ—á(÷r[s>-=¯àIEUõk®q½ëxó¢²òÑãüÔ´+^.Îæ#?3`ÈF(Ë–š0Ñóÿf’.Ö™M´¥×ŒqCKf±Ò@ksÓŒÌLB4íåéÓ§6lX+Nû é?'&&¢ÛD Ä Þ–?“••…K­ðuÇçóýüül§ÏùÑBSÍVuðqMù\CÂ\Tÿ`!qá“al«âY± ë~„¹Â#íÞ§FÑâ{»ë ýÍPÕîKó`žÍΤ-‡$§¦¦ÞºsçñÓB ÞÁ_ׄD¬úeÞ“§·23Ï;{ôØñí‰ñAö+l'™,5TñÐþ<~T¯3#iµ{ ÿ¨I8îfSGiK”æŠþj–À„þ@_þ†œ›Áhûùßï?uöùKáPøû÷ïïÞ½;((yk_$Òè»Ègó÷÷?pà@YYÙëø–¼I°†|¹Ç'''KÄSHè<¼¼líy?Ìÿé§IÜ_õǺ —Ù£DvGŸ(–:¤,L‰J#(Û‘DÈ$8Œ:zŽžÌùq}¡íW—ß¡ÿi¢¥JôWúa3Ì‚æN \:ßÏn…/ßÍ+ È#"š½)`SÒº­;¢¶ïŠß³/iÿ¡]ÉÇ÷Ÿ<½óÈ1tœ¸wÿºm;ölŒOr‹Þäåèë¶ÆoÕòÀ%?Íù*l'æËñ‰cwŒ´_MîÐÚE;¹z²õ& 號Wü™sÄò)mrdÍšÕh"Ÿ0˜æ1B6pÞôÄ ïgSKÊŸ—•?¿~ýúŽ;BBBpnºývx‰vFvvv±±±×®]+--…6xŸA+>>qâu:0> ¯Y¾»ÇüŸ1d0g ì9mF—Ý(jKÒ¾ˆ®™"z-_Ç•ub'³Z>8Ì–süÁh6SxnLÏѧßO¿®#QKþ˜ºÜu¹“êrèøŠ¶<úV!½Ìˆ.tÀ„¢ÿØòsXD{ßÒœMöî Ä’ž‚ÜÒ´‘îç²Ïë0­†~¤¥®~þâEüÕÕÕ¡—ÈÓÓ³óTbì ú422òÅ‹ kðþ}9±à®©éÖ­[{÷î vrr"[ákÖÃÃÃ/ ÀÎiõ”ïçšOš²Ä\w­¡r¤*{ëèÞ7µåf „§ÅzÐqØb›•¸b“qÄ=Vûì­¨¯õÂM]óÕå·ˆ›V°`ÔË_Qï•0Œ§óIâÜIq¼eëbãwKyø¸àÉ“'W®\ÙµkWDDòÁðFÑöÊ&Q£‹âPgggä°>}://” º”ÜUUUeff®_¿]¹è¢–pHPô*\µCßrq±··_ºdɬ‰–fÊçŒüÄG‘~Fµ×#=ÙSárœ•øW‹Üu"Mí$Ž#þÁ}}cQþ/–µÖkáãK#¹{ãh‡GÐ|”ßk)/šÌM\qëæÍüüü‚§…™·ïìÙ³ š^–ļjm‡:88øúú¨ÿ½eÓY“9S`Æl0cÖ˜3Ño,ç°‹ÍÙWô˜a*ìoF 66hñôÉ뢣/ݼõ¸°¨¢²òÁƒÈCCQ$ú3‘˜ã%µÕ¬}[6ò4ô $$$ oM =itG•“¸0srrÎ;·mÛ6䟠HÜg$±¢ÎywžžžÞ¾¾>þŽ.k~Zòû¤¯g·š2Õ’»ˆcÀ3Óô1S 4R ×ý|ƒz¿ÄѲIŠ´­#h»iÇTz_'“¥#›£Ó7OO¦È@®ØP®b‚|•‘|1=>7”+Ò—y¢×7W»÷?ãzÝ×û‚Zï#£i §%~AÛªÔkÇ8Ö^ÎÈCß™ùeúßK¾IømNðòEŽ6+ÙÚ9{xoúkç™ó¯gÜ:›z~÷ž=aaaè¯àñxŽŽŽ¦ : ?Éäª!1ŒŽŽ>tèPzz:ÞTõ¯+tY§®¡¡¡¶¶¶¸¸ îíƒg t¸¡’ü _: )ÈjWä!99¯zJŽŽ.Ž.¾~~žÈóôD^Hr‘‹EªÓÚvt˜)è°Æ}ŠB×Ë—/WVV¢ ´ýTe5¿Ev§NŠ‰‰ D æ*¢ýFËÎ3Œ¤¼ ]:~ÞÞH=8‰ðóõó~ø£G?ôEô!ú®™ÑÿB‚ƒ¤ù`ÎÎÎx3~äÛkðª¢5ô°¦¡g²sçÎëׯ?þŒz¦¦¦æÞ½{dª)Žû$F®ÿ«ƒôp{ÚûœHÐN¢'ƒ‚‚6lØpâÄ ¤id+6òÏ' zŽî¡0 ?666VUU={öìÚµk±±±¸Î‡±;T‹Õ›HYç¿?1ô qË܃æää '­®®ÿQ¾+Ä¡ÐÃ<*/^¼HKK;zôè6oÞŽ‚O¤*ÈÇÃ)K²ÏÆsÒ:LkRcLü+p*ÂÁÁÁ‘‘‘H~wìØ‘œœ|òäÉû÷ï“+i†ä fâ}K$dA Ô××cïÑ£G(ªÍÌÌ<}úô_ý†3ȉæ#Ö¬Á¢äÜŠ…öŸbpÊl Cú†„tãÆÈ+C›ýðáÃüüüòòrSS³íõ €7qó:ÔáVWW—–– ·êÎ;"®_¿~URªôôô+W® côÅ7n ï"ÌÊÊÊÍÍ-**BÑemmm‡?\âWƒˆ ñ2h]?ò…(€äÿYø'c endstream endobj 1479 0 obj << /Length 2634 /Filter /FlateDecode >> stream xÚ­kÛ6òûþ }[ˆuõNiÓ)Ðk/ÝÜá -ѶYòIT÷|¿þf8£‡mínv7R3ÃápÞ¤W8[G8o®~¸¹úÛÏ~ä¤nÉȹÙ8~¹a:q¸Aê;7¹óañG×™2j¹’q²xßê†foº"×Ë•'/ðN—Zµš>|WºÞòÏ›_®~º¹úÏ•; Çsb Ì7±“í¯>ü)œà¿8ÂõÓŵT{'ˆKç«\‰iÓ‰´ÈË®ðcôf{B,þ(„, ŠŠ]m‹J·Ë•Ÿ¦‹MÍÐÚìz‚ª®V¿þþ+}|Y™ôÒ Ç[œÖMÞ&Sñ€•ÖºßB­KÓGÁÈö ³EÉhYÓ•šY­4vmQmijzù?Op:¬<ÏMÃN:#¡;ÐÅnê³é~r·~%¬b›­C“woN­%näùN 7M‚{-ƒñâp°Î Ä“NÆn”Êûxµï  !žƒÿ@6š€l—É6©+.\ù¸"²G¸¾›+µ Û0òGåýøþõ2‹WT=1]üXïárú¾* Vœ¿¶™ÿ¯"cÜ«f)¡6aì ´P‡åƒóH/ëYTB¡H^Ôx?Zt¦(‹ÿa¥’~<• p¶z"¸Þ,e‚ é-j•Û2féO¤EetÕHöJ¬ oTû¥% ¦8î‡çþû?ß¾~ûÊÀ"ß?Bnuد?4u¦Û–·ÁAK¸Ð…r+¢ñT3%´í‡º1ØÈxaëºL¨¦þ÷ ›b¯+£JÂîÁe‹ÕAðíjµW&³.àòT½ž\úü­*DSlr¬;ì¬× ¢2°uaÛÄÖ@Ümav§;ªºˆéÙ":ˆ'°JñÒÅG)#êNVY—+b‡‚#i&Y]a˱ß!@kÔV³àÓ o /di‰} ¯¿è9÷ Vè“-hFB}Z¿‰jx9nÒ Þ-«ƒádïqÛ†“QÏ3fµ= ?¬Åyý”ÊHVóiªï¬ïntó©,ö…¹¦%¹n‹m¥Œmá{W#Õ-ñØñ±ß"ÔÈio‹²$Â5 Ðê*§z9bL/›õhœ(s†iÕžg<ôz¸1ìÒÃT&Š??¯­Ç¶×اû`8­ª!d CÁ5adÝýPê;Ø*Cc]eší£Úºæ=CNË®guYB¢²mÿj_wUÏ3wàSq¦M€=nÈm´-þ›ÉÈS^0Ós%u¿ýiW1ì†tiv³Ów´"Ñp« ‡(x”ÐþÏvòÄ?I¿–IzrÀ6 Òñ5áûmiiK± ¿Y#&gŽŒ(Ê68;¨c yáëb»µ7¿CÛæ€*2èUÁR Fi7¼úhô°F Vµ™³ðZ&xPï¿ÑnV©¼S(ÇònS‚« œ‰É¼PÞy·õ|/˜d¥ð÷l¯‰ú4!}š[–ÏX!Ñ}‚ 8AÙÒ-Kª9o« ÌÎrìVåwñà¬óÙdüÃT™†XdØOÒUNOôa=Ɖ`— ¯;®iÓµ˜&PËÓñd–ý¹bH…±z`:æeµJsþ¿“ {˜e3§€^ûB:ž„t¹Dú„'«;›¤€&ë#î´w@”¢xJ©²£H‹¡ÜRpPÄW¨Né/Þnx9GèÅùWðˆ‘j©6]‰] Â&JÆD°1´ÕÀ›¨:çr°ÖšÕS(fòxbƒ‚0©_({”gÑ|zš§¥NßÕøÌ¢ŽË(\ÜcL9F¸”6·”köäüšH¦aß·;ÍYLrŒã×›‘aöz_7G^K‡Â¢!d5IÑŠ¨Î*ø¶7Ê«rr›Êð~”QÜJ0c­y‚h”'Éc‚¨¯07€!‰+`ZRîáÐ3«2—šÆ¼h¿XÁ“Å¿—>xu„ ×¯®Ì‰ÓÀš8Vü½kC³ŒîT ‘÷ì©w†fM>îM3ì@gÔÑ·8ü ºÖ™"†±O‡%¨Ì¦ ,€“•aQl¡¹¤Ëœ´Ñð²6x`à÷¶"‡àƒ9µå€&õ„â £[t€6äH0*ÉŠDü%wÚšÞIýÅüé+ôî’çOJž¿øœS›W×OEn«œ´.ƒHU].ÀªTTD7¹ý†šjß¾I4û¢âÝnár¸#zî²áÈ;òœ¯™î#•>9°RY†eÕÅlôvÃttWÁ)È9sþÚ^ód wàJÓ„rLpçѤ_Am3ÙÇ`68cÀOèQ¿bÉ(˜Æµ®ì£0³ÞŽ WÜß½P„ ì^ÞTá+«pKeìÒÝ΃Or€¤7ž36E>ðŸQŸˆ²æõ2„ˆæ|l/¢g™u­?EÃØJqnjöªOÎ%X÷1Oxମÿ èƒOx2ò\?xèÕs“ð9/x“]N^±-ßoó€'£À âþÍc¼H^ 7€=‡ÿìËÕ vr>гöÉKÒ×-¼X$,6À÷1Ÿ@hQY´æù›À¾t|ý1g(üÕçY“ö¡KO^ðíâ%H†~g½á_˜wè¶ô±ȱºð3ªñSk­öx)AU’ ¯87MÁžM7>›à²[1;"îs3b×ÌÛ‚P%‚‰jU¶kêªîx!7뫹„‰ŸNÒdñÊ^X vO{cüþžAƒ½ LÈŠœ×ÿŒÂ£¾íi ^=”(êhRi[P cî¥o¾bÁlxÚµê ÖEY˜ã‰hžÛ W1Û³nrîäïӦöìÊ06µœ¤¹MÎÌc~+”<ËÞï$ððâà £gýX8Ùç$Í2ço”hXÌãîýÎßIVûÞ‘¤¾ôìW¸øâ‹@·ªøç|Œ~¹b|bzû21¥Ofvh{âYÖç—­žx^ vO3Yï3Ĺæ&IgwŸfŸ^ÏKÉOð¸ Ï÷Ø=Ÿôƒ'®Œ¾úÏ!fI ¤ëyüCuââÏ‘”ÃÅÄ=.}|‡,­ŽƒªRâCKîÉÓ߉@mÿÓÄ„= endstream endobj 1486 0 obj << /Length 1935 /Filter /FlateDecode >> stream xÚX]³ã4¾?¿"w›Îœfm'q’½[>vaçöpÁú©ÛfÈGɇóþz$ËNÜ´ç 0½¨l+²$Kd³à°àýÝgw¯ßÅ2(¢B <‚LY’GIûàçðãÔW¥Õf+²<üqÐ=Qï§j¯7[ÎÂ{šøA×Z šq$"¾ùõá›»/îþ¸ã° 8 O¢ŒeAÙÜýü+ ö0ÿMÀ¢¸ÈƒGÃÕ‰Ìá¿>Þ}Ǭ¢,â ‹„Œ‘[ò ‡…«Éž3‰³ˆÅ™ôÝ&f¡GÝ·¤m£Ær–œœqƒǪ=ƧH-<©,ØŠ6MIèà M—qØLõXmÏ$‹¢I,,ýÂRöá»ðÇi¢ð_„Š†gÕDuúÔ½u9V]KCÝ«Ö.=Vã©jIwZækeå Zõ Ç@£C×{ºžkí¶7:«Ñ<Σ"µæAIvm©£Í6fEø^·ºWuý´‘© ‚¤‡êتqêÍNÀ~RÁÂ?7< µàˆÞYØX*ŸÀ à8þw i­ÊQ³øû•°ó|œ0¨ìæÓ ÷DížèŸÜ Äå!Ý2Ø\š† N’$pÂÆ E>b°(”Y$¾Ëa©T-mþ«¬'Ìäk`¦žhùÂQ°z軆Vv"Ï—¡8êý=:]Âj©¦ÁŠT+Y4;«ÐµµÝÍsa¥$+O™S0§®‰¨Æˆ9ÌȈˆfYTÄbŽ|£ é-AŽF!}Wj½Çdzsñ±…ŽÉðÖmXþŽžÕ#Ë®Ñv÷ªV¹˜ÈË\ô… ú0«àÄîiüX9SwNíVÕOƒ[7ÁâÛðÁ <?«nô9¶áyHž~6b&‰X2ªšD¿r¶MÜK·oݧ¶ÆÆ΢ÅÜ?gÿaêÇÙsbÕ7¼0‡"Ù¨‚Ññõ;Ààëc±ò%„2 Hȯ}K~E£2sñHD‰ÔÔ› @~ 5äõ× g,ø¢ƒZAÈ_\"?:ÅU1ƒ½Á÷" º·îú‡ª¯ºÉEªÛèvTˆ¼Ãü•ùßWîs`°^~úMz»€ºy…ˆâÎKÊZÿPº©ug ë÷zD¤½ƒ›4sq8®øŸèõÆ-þ°´š”Ó‹ú-óHò8YqÆ_¬á”ù,ëø…Œœ‹@Hå¬xIpÇ+„ÁünD€n×3Þ6EÄ8÷·Áù$‹£"Ëà^‡›’ç¶cõoBLŠ ‡“‰ 1!eÄ3b͹٢Sßl¶’Áщci<{k}&qÄóü?8êú¼@„üWÇuaï:¥h–€½o£‰¥‚‡Ÿœí¯L±âáS7አn`TqÜT»‘8…+LºÚÆ»­„| S¨"Û&À¯vôðB6ŽŒÝúã•w»&¦UÅ)UZ©&Á(·ÇÃîfãƒH7§© k5˜ìÊÂÑtMÛ—…`”IT3K•! yÞ&ÜÆ¢ß!Æ™,ÛÃY£l—Kj×M#­/¨`pz ×O¯ÕÞÊ8nÔHé !s„„±Œ„k‹éFoxäÓ^/j$`/úÊØ–/–ÙCÛðϦVý |ÝZvgƒ±÷Ä7t+5¦å*go(K-Ð蔟½9ÜÚÀ}E‘…îߘ¨„%má}xÃú®©†¸£[ÝÌÇi7è?&·tŲ”>È_c´µßa¿†p›Z5ä†Ôõ€Oj8ý6Tÿ·ÃÙz ñ.ÑcS9Ðxtßxì‰FÜvT»Z»s@UVJ…© lï-láï²ôê‚­Úìó--,ÇjÙížÉС¡þµ€A%í †¦]ˆ¶2 à !÷žhiÔQßÓÅf‡1jöºì1¯¬ Rº7ÙJ÷¡$Öõ°ÔÏÝPvTBí×t®@(ÒàTO41[øæ–‰ÈGZÇžÖÂÓ:ñµÆ'Gw?sΈ/ä¬ ˆsg€ð¶ˆ—«°Y„Ñ×2PÐöÒ kÖG±‡Ú4Æð¿aí»ž°'ÊìM)w\w8F£Kr²'æ2Ü^0.\ +¤ãÊWשY˜r^ˆ+Qt"Ž…Ë8O®9/:®Xd2_¸~B’ÌFýµpÉ4¥-)çfî+OR5ܺ }2› ã«Ë»ÆO§ýö÷4„CÄK Yuû¦{ePpà ip<º/<öÃjiWwæÄ2´‰‰zœkm¸ \¬¬L‚¤ðåb% %1›Žúü̦3ˆàÀˆÙõF€µªÑæ*쿨PÔÕÕ^-Ï*WÏ.v„¦Ä¯Û†§²Ï)3¶ú_°'Q3­Ö/03ÿqžLlvbérоÙ'±£ÿ(Í[Àà0r’]€ ç\—l†”´À‰ÿÍ@c«5[Hœ0÷Æ|”Ìs‚«n@(ú³((™o¨­Aþf6jS˜ËBÿª½~kL“HÈüÔxóá0Û#·éÃ…0¾“,Êrá®ðŸŸÔyt/‡9¸A ~ÞµÊÇ©§ðZ©ù7TÞŸÕ endstream endobj 1483 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 308 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 7338 /Filter /FlateDecode >> stream xÚíÝ \ŒùãÀqÿßoíšX7eÝ,+÷BXv—É?Ç®sQ)EØœÛ9MShe×¹‹ý-Ö•+RQ9ÖÚ"?˲,V÷ñüŸiR9f\3Íçýz^vvª©i¾=Ÿù>Ï3Ï•+.¹¹ÙYY™¢¬¬ì으kÅ«…ñÚì\~E€2J”Ø ,‘VµM«¿[åýJ•ôjÕ·œä­ü`ȳFSÏß7Rþ—ê^Õî¯6ë{úÚ#åÿž s706;þGŠxùÏ«Q±‰ÿ×7’O±imëÊ/ðêmÚÍ Ï›âäæmüKýò#Ëéû“ÅÝKŽK¸þXùii÷ÿwñjfvZ\t|FÞ„èVRÜÕ»™ÿüyí\lL\•Ç[ sÒ“®\ˆ=é¯Ç™âuÿ$]ðÓ§]¿çÏ]΄k—cïfæÏ­Rïœ=w1[ü²”ѯ 9© ±±§d)>–ýÏ• q11ç®Þ¸[0 ËNp9á¼xã¿^û³È PÍý¤ƒYkÛ›ÙùÅPÖJ¹QnËl‹V³›þž‘˜H$ukÖ”t··oV£ÅÍ,Å'¬œ`Ù{nP-s‰•Uk³&v˜’©èTî‚~u%I#‹Æ5Í$ÆÖwáj¨s§Ö6lÖnòLï A˜fm<.ôå·ÌNÖ«Ûé±øcõtò¶•HÌL÷ÄÝ_êaf(13«ûÁf¦F½ìWÜvf|³jsóFuÌÍL †-=š÷3Ê!± Y·"­-ªUÑ7mÙ¾óàQSÂœ/øhA¤ZWºâ¸2)«'ZÔi§Œ”÷ÔVušZý/EqùQtHUIÓ›iÙBŒ{…Š-MUÞƃ±uß™©ÈËæ9Ÿuµ[®¼VU¤ôôª|¾.òŸT±c‚ÿ”V-F¦æ%èNÔ&£ÚÇï¤v³«m=NYԳ뜌?ú”Êw§D—£úx¹Ú»F•ÿ3´ìy'½0Rw˜Tlq!ï3Å%-Òï½mò#åÔ¤ã˜ïò¶æ ªfÜäFjVÁ-§üý祘Ÿ­ÍßBQ•M³>í2l©úHU0ì}?Bw·A¥áG÷ç9|dÏ€FN¿Ü¾ì7¾R¶A»ݸ—öäçgƒ”WY·oÞLÍ.²ªÏHêWßÌ ´0R\*š}úäø‰\áÖöJF­ò#5Ù¢ËÌù_ø×ÁüHå>[2ÚP¯zúZµïÜÒLÿ5"UwT~£„˜&• ÚtìÜ鉮ݺM; ø’oÚ·inQàªiãn᧮ ì–€r붕iÅoâŸìØÉ[Ý'†õÖ¯;!¥ R·dÕ*¶¾¢ü”\!#FúžiÕ‘Ê>ìò™aÛ¡rr³³mrnñ/u‘Êþ9¶¾JýÎOEJẕž~àÂ4-åqVNþ·ÊQ¼‚+ëè7ãõLÚ\ÎáA€ò(o•?©»å‡ýgn¤Ë½eÛÀ´ÃÒ…3)!mpãÊ#¿>¥ü¸tz/ÃÚ©ŽTŽï˜Þí=óoíÞ‘fú•&å½ÖjÓ¬¡ÝìV(¯žÞßlÐü_”—§õ4iÒõ¹H ^#´়ü06¬º¡yƒoëv#\ò?ãþžêï5ˆÊä€rš)1 Ò¡Á¿*Kzõ³з{÷ßk;pÒ½ Åü$lZMå‹y/íY[Ç@¯û‘Cº6´9¸šä£»y“šeµÚNŽÈÔ}ÿªT;9%ëŸÈ€ZÕª2iö¼éÍ­~Ò¥fý“.?ÈÜç6 AËÙsW¥ Â!ŸizU†Oœ6ª÷‡¶£?×7m©ˆÔÙYŒ?}òƒ )‰G»X×ý¸Ÿãè¡fÕªŽóØ#þLÿœ md¨gÑe£Ãˆº†Õ­ÿ³ª ¶€òÙ)Aøûêé°Yè·Û.ßNÍ¿¶pOOö½»÷³²lÝ ;ð—pY^¥~ç4åQE) Å…”Û߅ʶ8'^̸wM.ÿö¯´lAÈ:²U¾;2o&8tËïçþP¹)û¶…‰?kü­TRPþ;õ‚l½bdË÷‡{ŸPþ‡}Û¶ýÜÔR÷Ô‡r_tõSG䩾©ÜÜjn®Ú s­;—Úu±¬RÝH_ßp “Wr*¿€Æ”J˜¿¼º´´´¤¤¤kPíîÝ»Œ(ëׯ¯µlll'P&üýýÉz `œ@™8yòä¨Q£¡ÚêÕ«'•››Ë/³€–ŠˆˆøªíÝ»÷ÁƒŒ(>>>‹¡š‹‹KRRãÊĺuë\ Ú¢E‹~ÿýwÆ ”‰û÷ïßj·oßÎÎÎfœ¼¢?þøÃßß_‚‚‚:¤³Ã###ãâå+—~Õ¹å·ßyÁ 999¿þö» qÉÊÊd”&΂þRÖÖÖ:;<¶ïÚmiÕ¿ßxZúOtkÖ¾ûÇY?¨òç»õšwè?q±®fìݳ›Pš|}}Ézýû÷×ÝHíØ5Öã[i´ S‹ì¼0rºÛǼ^[u¤þ¼cã0OvNе±1eyøž`”¦Û·ooß¾}T;sæŒîFjç.‡%agZ‚b…Ó)õ‘ê;f®ø‹Òµ±áäµ™HAéìî ""E¤"E¤ˆ‘ÂkMðRDªGjät·Ç³* RÏGꧽ»ÙØRæ6nÜè ÕÖ­[wóæM"U^Ù9aàØ9â-/B*•^½z••ƒŽGj‚ÇÆÓþ#ÚÉ“'¥LüóäTçêÏ‚~íÚ5"UŽ#Õoô_}õUÑÝÙÙ9**Š•ƒŽGjü’ Ç}öÌ aûöí ‰R&“ÉVB5//¯ääd"Uî#åV‘"R‘*:0ˆT™ìâ—"E¤ˆ‘ˆ‘"RD ‘"RDŠHi£G?>*ÄÅÅ]¿~H)"E¤ˆT™ÉdœO½Þ½{)"E¤ˆ‘*r¹œ )"E¤ˆ‘ÒLW®\™9sæ\¨0gÎœ°°0"E¤ˆ‘"R‘"RDŠH RDŠH)-Å‹yA¤ˆ‘"RšlË–->>>œHVÍ foݺE¤ˆ‘"RDªLpYõ'˜Õ‘O)"E¤ˆ”' žPM™IIIDŠH)"E¤ÊdŸTFFFjjjT9¼é!‘"RDŠHDŠH)"¼tvI¤ˆ‘"RDªô¥¥¥>}: ª%&&2“"RDŠH©2ÂÙùÔëܹ3‘"RZ©R˜ø)튔rHhé¡7’!õºwïN¤ˆ”VDêÞ½{+¿þºVGDJëfR_{{ki§ Z@@‘zÃ%*7 J¹(„^*\äqy׿Æíä߈,úµ¾J#•|ýz›á˼Vh×L* *W«Á±ŠËE®B. . Ò¼1üô@ I¯”CB~AñiAg‹~­b´(>3þ©ÛÔÙH}b?©O_s •S8ñÆKÐÙ¤††ïê¿[Aïߊ¥rÅŠõÛœò}ÚëÝNLª¥Q…1[_)‹Ñ†˂ô-ÖKÚ©kƒ'.ã¶q±«‹6ͤb·åvFÕ«¶ŸH[øPŸL¨£÷nu½jÎG… ó™ë½cPùÿ”Iï ¦u[\|8øœØ ìšÔÒ·ê˜ÝBѧ1þÛ–W­T¯ß|y 3)aø¸Kw_W¾ñ‘*©k–Fÿ³CØø«b‘¼Þ·scóZVk#ŵÐkDªE­÷·½Ò'ûø¡Z…¦+btt&5hÂB±#JÝÜÜKnuTì‘rÿÚÑܼ®aýIßĆf¹¯iÌŒk¹F("5äÃêMæ_Þü»b m¸ üÇiˆqe#Ç]â@ÊîØÚ¢¦™I‹Ï¶=™¤çÆäNêYÇÜÜÜâW"%6n†8÷ô>pç³a#rrr´ºSDÅ)ãwF„elÀYö½‰¤ëTå6ÿÓY~‘™~§³üÏäæmÙËÍ»>[qe¤òʧ#%~Id¦ÿ™œü<óÔgŠ·¿~ßn‰¾Õò(ÅeÝŒ”4FF 3}÷/ñXZBÑ%)IÉMè;nÍ Tnµ‹&Œý¨á€å5MjDÊò˨àØü/t³¬Ô~ü±¼H5èn=ÈìÃ^~Qy…ÿ=q£^M‰u‡Ž ©üHÉãwaý±ÇÖöU½\._²d‰T‡å7ˆÔ›Ejý–&fõîO Š&ŽîYËTßظºÁûÕ뵶F¹½nß±fV©RMÿý÷žw´0RâêwÎÛjæ=IWÜøÁý­×1¬¦g¨§WÇ¢ÕÌm¾Ùy¼ÕÇí$5Ì›¶ærJw#¥ØË-Ì <²h‘³–̤ÌLÚ¿K§ ßåíi’ÇÿÙÚÐÜiÛ±Zª"• ôhVå£Ñûò"U𢭠$³Ž(ž½ˆ_¾jë÷3‡a©"‘R> \¶'¹k×®ZÝ©àà`Î"«þ³œ»ïµ6÷ޮد­Øµy÷óÁ$5[­:™ôƒ´Ò;æ3~L ½(È£nt4¯l’&–kp·ºM‡ú&Ⳇڴ¨ûñ‚€h1RïŽÿQX°h²y×EûÓ¥â³åÈGí˜tÿr—ô‚Ÿ3yŒµ¡¥£ÏAzì D¿Óš‹Š½í¥©²ý«ÿóö-e¤”³ÔÀhÁÁ}Ó¼¹s‹ý+‘HÕŸºFæbØÜAª8´Fð‘:·ãsàpMãÂH5™wéÛß)4^X°dFÊïš®ŒT×Ó³Æ5k4!J1‘fëW“|¶9E­øÐ7ûÄçØÌÙñÇò=×ÄÅ{_Dý*†S ¾¿ü$Ñ·ZYvû¤Nž8á8uÖ¤/¾*ýÅ~üT»Y«Ä9TÁ}‘æujÚôÅ»:*¡H^ü»¡±ø ŠWŽØÅÊq›Ï‰”A ƒÊïWÊH•+šHêwtÚr^±qXŒT¿«ÃÃ%fÝVŸä17Z™Ï=œ=ux͉ÔÿnÜ°7µL†Ó¬…}†O Ž{꾬=ú°‡µMNN¶ÖuŠ}R(Í}™ŠC‚Ÿ,ù‡áÅ.+ÝëI$æææI­LÄHÉ÷¬70êµ*îÉ¡zOœhÕÈÔ´ñ€)sÔ0é¸"Rqåêm²š’§Ô¨^Õþ‡²ÔêUÞn[/½¿¥¼ ÏEêÉ>©§ïà“HÅ SúÔië3Õ©o“!;Äé¶FJ£†ø¯×ÞmÚ´az"õü‡&ŒjÑg~È9ÅF¿3IíÌ+u•e†Ä?þ¸î{=Ü.Ÿdñ—3í$¶þÑOŽî‹ÖI™T­7ó'Á?"¹Ž¹‘ORh¼ ;/,[êPÙxàºe¤:yÇ e±OJ#U0Ÿrô Ÿ4ib±¬ŽJ.RÁ‘`Û­Aû9û䱯© hÁoך †ÔÈtÌŠ©WYÄNµm÷q®¦—þèÑ£]»výöîÝ{öìY"õ6‘jlPÁnÓ "µÚo…‰QM›Ù!Nîk>lÚ¼‰…yý¾^+"²]–ºJLM:Û;1È´šñàoþŒIm&ù×Ømù û÷jÖ°ûli¬àüå§&úÕ­F.2ÚÞĬÖðµñAâLêàÁZF&goZ~š™Ô³Ë¤¯w888¾}§Š?R+G™ÖqòÉ;æaÚ'˜WŸ~_q¼ôO¿H L]ò^Ìû‰EÕÆ3ϼ0RZÔ¶™(H1ûNiÞÐÄÐrT@‚âCNŸõªgëL¤^ºøžÊhß±«f¾~*,,Œ³ó©×¾}{"õK®ß©ôü—;=sjq´ïÒ¨™î#Ýv¯¾Ù—ðùT¯eGÒÅ/ñ9|Ýqβaså^‡3 n$ï%0âÿœÎô=•©¼ÞçÀ%ÇÙžÃç…®<šw¬E@TÎBï€!Óü¾Ž"R/ؼ³0,Ún¤ý[vªØÏÝpF|L³ /§+_æ&>šâú3ïr®ÿ©t¿Ó9/¼_~‘O>¤¸ì™ÿ¤È?2³à2‘R?0Ä¿©–­ÛjàZè»ï¾#Cœ½$#¥öFgÛúò™V\Š-ü“Qø“ŒŸš>õ™QO>?Zy ›û^¼jNPĨѣ5h&¥'˜Õä™”ònÅo¶hÕZÓöO%''{zz®€jbljgA/‘R®ŽÄ;Ø´óàààà7^©r©üó±ÂL¿ƒã'Là8 ­Ã f‰T¹™I‰ÿŽó ³ÐßÕÕõĉo6¼‰T9œIE ΛÏÕ©eîîîþý÷ßÓ))"U&O•Çºm9r¤rí*Šˆˆ`&E¤Äeñ÷Zµl)Jy§6mÚ¤±¢ž Rå2RÁq§_¬4ÐV¹RÞ/—C‡)]Ž”4F1‡²êØI,TѪ±EøñÇ7B5ñ±»yó&‘"RÚ©€¨\1(Ÿ~±º¯uÏ%K–¬ˆ îÚ/¿üòZ«#"Un"%>ˆóC"-7*Z(%WW× 6hæqéR©Tüñ8‘¬*â/çòåËDŠHiE¤”»F»È>:D¹1çyâÞ»wï«wŠH•›3N,Øx¦A½ÚϪàÞ½Í6%'((ˆ÷ãPC|.ú믿)"¥*R; :']d¥µH£Ÿ}·tÙyaÄ|¿Ñ£GÝÊ÷üºHü÷‡~`&U¢‘²_à_V#(æÙ¡xÑܦ³íÛ·WU¨‚;(N[4mÕ”™™™µÄ)0‘"R/tàÀ»1ãÇNž^°Ø;:õ°Ô±{ß’^Úuìn?ߧèYÐåñ ©Ë²US¨‚½úf©7ˆTbbâÀ!ŸŽ“gô¶jÕ½OIŒN=l¬‡=utñ±û*$²c§ÎÏoþ}~llÙ²…ô Rå#R/Ü*’’’"—Ë===—–°¹sfÛŒ™Sð~RâŠhÈô•ýûõ}éSeñß#GŽ°¹¯ôßOjÛ¶m%=0¼¼¼ºöû<$¡°Ps‚ŽYZ4zéÀ…‡‡s@ˆTyšI=ﯿþ Pÿ|µX|ñÅLe¤”g–1ßw„ªýPE uüøqœ(“HmÞ¼ÙÕÕµ¤†8]êÒï31RÊ-~sƒ[4nø*O]4ù?€Hio¤äqÂÐé+ÇŽuxéV>Q\\Ü뮈ˆ”–FJ¼ s¤G;wPÊûÅ DŠH•D¤B/ý',2xP ŠHii¤6\fîÔ¹ËK÷C¹¸¸ìÚµKsVDP+GSßf…H©g#5sf?‡¹ƒÿã5x­ú­|J§OŸ8-’nDªÛ€áóB"›XZ¼ÊjçΚ3‡úùçŸ9ϹzÍ›7g&E¤Þ&R÷îÝóööv/y³fÍjܶ«£££¸R*¸òùù”r››ç î‘*®HÉd2ñFJz`xzz¶²êѦM›gÆ '×[·nÕ¨­|‡"CêuèÐH©·‰”ø÷þ¸TˆS¶'N½&==]\ç}®.®…\\\®\¹ò6+""U\‘JMM-…‘’’rüøñ¢ßK¼¼ÿ~g¶òíÞ½[ÓöCÅÇÇÕ…jvvvDŠH½M¤JÙ3k˜;v<³AéíÏ—B¤Š+R¥9$ž‡.ˆ”x/Ä.f‹ñZŠ}RDJ‹"õŒ¢‘rwwŸ—¾ým)íŠÔ ”8BöíÛǪDŠH•U¤ ¶òË3."Un"¥<©vÍ¡8*DªüEjÑ¢E×®]+®Û$Rå&R .|­“hοyóæp¨v÷î]"E¤´(RIIIÅx›Dª|DJÇŽÓÆ^&“¹B5΂N¤´ÅÆ‹÷6‰T9ˆÔÁƒ•§ÃÒFR©T\#UÄõÕ¥K—ˆ‘Ò¢ øÅ»1‡H•ƒHå>¡?|FFF ÔÒ‘=wDªDª$©r)€H)"E¤)"E¤ˆ@¤ˆC‚H)€H)"E¤€W§³/pÞº}§íä%n[b‹.Λ¢m:S K©}£g×ͱúÙ)õ‘²0Úck|Á¨pßrÎåÛ³¥ó¹|]&C\Mr>ìs"UšbccõõõkB5÷ïß÷ôX²ÜkiÁ²l©gÿ~6={t/…¥WÏ¥óž_lúö}椬Dª¨ÌÌLoﯗ/++W,·>¬t>½{•ÕÀèѽۂ ˆTiŠˆˆàÍ8ÔkÓ¦ ã¤@NNΚ5kJáýû4 ‘z©-[¶èàÀ R%íرcâz¸TkÛ¶-ã¤@vvöêÕ«‰žN¤PRRRR¡Zff&'Ý%RDŠH)€H)"E¤ ³)"õØ'…RsëÖ­«P+==]7ÇFNNÎæÍ›åºG*•&''³rPãÈ‘#eõ臄„”Õ·ŽŽŽæÑ/eœê\ý[uË{pláîã (ߪª8;;'$$0N L\¸páT;|øð£G'À¼Ð지2‘œœloo?ª-^¼˜qeâøñ㼇zŒ RD PTVVÖo¿ý–ÕnÞ¼É8€–âpk€&“Éd¼‡z¼U”•ÐÐÐÅPMŒÔÅ‹'P&öìÙãëëë|||x“V(ì“”¨ÿ'R endstream endobj 1492 0 obj << /Length 1607 /Filter /FlateDecode >> stream xÚÍXKÛ8 ¾çWØÃ&@­Z~{nÛ™¶ÛbÙIzj‹Bq”Ä?RËîlúë—åÄN2ÙNg ,r0MS$ER©8ÖÚr¬×£óÑóW^h%, ÝК¯,/ YàVäÇÌO8Xt,nE.(÷YäDVZŒÞt¬%ðßZó’غ×R…å‡1|pg-KY‹<ßÁ 'ö&[oôÆ€ÞÊzUÕ…(SÉ&¶ãùFÒ§E^U…ýÁqܼéÄUöU*"SQñeâcÑ9³ª«‚¨¼Â÷WéQÈeÖ‚hB(lÎY´g\8Ú}¢pëø1.`:þŽj½¶ˆ¸}=ÌH³{ðH˜…³Aâ¢`Ÿ™Ž˜»VÌõ.êiÏc¡oTp ààÛ)§g\ä¼où~ä±$Š;ŵ´Vg5w…tüÔ…ºV …ë©°ÂØa<ð)È[Ñ@¶K»M Ur¥•á‚ò‡d$ûd„Ž3^¸ë”d\Ξ …”uºù$òuuEò/ÜõL3_üqóûç}–{k6Bm>a™y%Ä]ÈŸn$øVd%Ö ~k°V‘@y¢ªÕÑ'Ôg7b‘KvÎÜbÕ7Ö•#çþ÷Ú£cCô*ãCvísê¢è­Dï)AœÉ~d;±1—Ñ^Ýbu^٥߷=‹®Ì‚ñÿn'gÏÙE¼ |ñ8þ°8Á,TèÿÌÚ~Æ¡‰8Ì =\ê-œ2o]’P×5ø@^8@žŽà|SK±ÌʵÁ[2qÔ­ ê®JÃã®ê%É8Sô,Ú¼ÉìFë“Kè>Q‰¶Jö…·¹¤·ë黟‘ŠÇê9ÐÄL«º“V•1Õ˜OØ«ØÖU*•‘2FòÊHáQÆg)›û ´úª¾3«Dz‡ Ù¨s}Ieè(eÕª|7N†­”SzSR¯ôP¹\Úè+1d¹|yF/Dè[ÔŒû,ωZt"´¹¤×ª4|Ñ 6Y!Ù £F,ñöÉ”¢#VU[wÞ`jì¢Z¶¹TW´§é„C·ï¼3kÓÏm¦²&«J³‘¥L«e§¹4.ªô†¹Ýæ˜hXBŒ\ì`ÈðiÀÒ™ö4îµTm³mÅû1ãÛO$2? ㉣Ġ½›U„ßL5ýõªä›|釤o–øêß `¿ÿ½ÈÅp>_ „:$Ø(k„ºSW˜¡|…$~Ú åÅ!D—aÑÜãO¡zVú#éýo&(Ÿ{Ì Íõ*«Uc: >͘mÆÊœÝÔdÀƒg]7%âê`af–ânÿMµµéMA4Ê­‘$¤ÐmÌH5âN–†¬öê:ô@ªá¼Ñ –6”5 TYÒ!6SÓšgP¹åÒìt~=µÍ:cª«U–vê‹n†ÊŒ+¼c¥K<Ϥ¦£f£_አªfX]£uˆd›6ÇÓYUg 'ò~´ÏŽ¯P*ß]­=tÐá9Þ¬T[ˆ’naøþë|>5zðÌ"qsýòvzýNì¾âú' >M'g5p4¾cÆ8{cõ@¯ï‡<„»2áa”žøÔl½˜naS/&j¤6«T¶.E ÆK‚} ƒUt#bÑ K¼~ÁŽ…w`úø°]šˆ)qÑîHoÇX4{Ot×·ÏMƒQàáÞÐÍRK3ÈÝ5z‘Ëúý{;*¿a6ÐÖ¯øp8ëûòòoQl»fvM«žxѸ7èéŠó³uÁ$¦—óÊÆÇryþ¦àPW7•.‰ãr=)4îD,tâ'5Èùä÷Žƒ‘Õ:ˆHlŽÈTC¡…èðÅÀº¥Bí¦¹eêád€`ŸÁ¼=o€Nà%ê¦?X|fÝÌŒ Øý†ÈÊb¼AM/u¹#H„oÚŸ{­ƒ“bü²‚/Væ9øË/ðáNõÍÿøþ/‰ã„{¸oÅŒc¨]w5b»‰,r%?àÌ‹áGâÜõ3Ù?¡Ñ>Ñ endstream endobj 1489 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 260 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 15100 /Filter /FlateDecode >> stream xÚíPTkš°ïÝ­Úݪ™ÚÚú«v«¶æ¯š'ììÎ 37î5‚’sÎɹə&g:w“ €ˆ( €(‚€@C““`¼F(‚@÷ù¿ÓÚ ­4}ßǯ¨îÓÁ>ç|ç9ï—1 `+Ë6 7á€_› ´Âv—ÛÔëW¯^½–¥½{oÅv‰Ø"…¯çŠò>5Ù>Ñóó|¾Œœc|7ø|þì̤‹¡òþrrrwÈ›<ž•µ\¼\e ·@8n²}~ç·íýê»Ç²µ_~Zû•L|Þ¢‡³1.zúÁø­l^^×éÚï€Ì@›?þé/·„~d’ëMÅAÁÁnö¶ßüq§løm៹[væìÓÉYâÙ|ß™?~{ºí•,]¢åa_+FŠ6äÇDçŸæC(²¶`o)yç~yƒ¿É|ùôVKÃŽ?þ8&{;&äÕÓÛ.¶Fê¦ó˜ µ  ó³ogfùx ¹€ÿôÁmWÝŸ ~[Kha“÷Úvÿ¸¿²qÈQá¿Áo2Ï`}Ͳä·w! ?54Xã°œGpÒãWó²Ô?D´#¯_OÚš*îýÞÌ3mšOlÉ}ø¸ñù³³|'uµœú.ìù]˿߶áÅ/x3ñÌÕðÐ÷;ö÷=™ݺ2¿-œÏùròáàÅ]ÿó5ëL•úø}Œ‘"kòÌœàÍØ-+‘ßà°ß¶ÕµlrÈÒ?mÕ’ëö.‚Ý»óèÕô»“Xý¿ºä©·P·*³£_}µ#ýXeMMuÅ©czû¿9UYÙÔÒ1Gü¶Jn7ó¿ß¹§¤º­·gîîÎñIYÉÅÂJ·Â87f;as”®×ü·v¬ÐoÀ‡yÝmlljiaannnjb$·g—¡±i@X ™öÛøA†êß°!Š÷^%y¹EäîÛYÆ}-C»ÈoªÉÿþo?=z1ùêÕ«7Ó“®ê‹;YqÈGn bOçžß³>ðç{“sP>•íÓþhd .4nR†b›U^”™¸`æ剜ôƒ»þö—ÿùŸ¯Ø‘ʼ=6 —éÚ³ÉÔ£QoÿÏèÓ×éeý¶¶ª¶_ñô×pÎð]ðŸ?yðàÁØÓgó0Øh½ðÜ쓇÷fçaÐHa÷ëÕ»dn0¾ø\‚ÙÙÙ·Ò ú…°œëåñ£‡¡iùÞ ¹ÞñÒšr£ÓØSS¯ád°.xím©UwG´=03ðX‡Q.;†¤Ùfòû’*ÚîÜïÆnC ø éò*®^»£¦b’Õ‹Y:9‡Ž$U [ÚM¸üÔ=(È9á"*ÌXš†•ÜJ<ËÖÑ:¡~ÞDg¯;k0ñˆâ.¹„–gòßÉ‘[g¡| €Æo̦›jjVô¾±C{,ü­|ã4u *žÄÆxeórº®ïÿù •²•o¼–±-¹(w÷+æu¢YŸ7<£ðwùt(Ÿ M~Óɺׇ±º±ô³×”m3szªi9%\z™zi,¦ˆ›ÞÂ'!¿Q:sºF•Ì“ë'S/=!Ÿî¤×]Þ½Óœ9‚WÐ¥7Rºß(ü]!ý:´Ÿ =~ÓR!•FäRKöíñ/bðøF&:¤ãCé57´Œ]3[~ÑžYͨ|ª¥¦à|$£vTÛÀ6•‹é)ïreôg_US  ÌË»7©ü€tø­ ‰LÔ³ñÔµv×µõ¬˜`wã‚ʼ8¢glrXÛÂ/˜Ñ‰%œ8/wØ2«i&«á¾ŽÁ-3Ÿ¼LÆéz©g §¤aèY8™7Œ¹úzjZgvm¶| Ë=°i¿ û÷vã}ÛˆÄì\ì£Ëûûæôã=~ñ~ øc¼ë¯h{çB§ßwO¹|–°«°Dâ7///Bq`96¿­–DcDcÞ ÞMnÉ@†ÍûíîÝ»öööâá¶ýÇŸBkmm=sæ ø Yò›Èi‘‘‘PP@öü†xôèQXXT¿‰ÇlçÎc0à70Yœÿ­¥¥ÅÍÍ ªÈ˜ß¡ýòË/yyy"¿åü&ña³úúz‹rð›ìù 1<Œ…‚*€ßdÉo"›µ´´ƒßü&Kñ›HhÕÕÕÎÎÎPPð›,•OE6»uëVHHTü&cë×B»råJEEø Ào²ä7ÝÝÝ¡¡¡PPcùåü«ò›h÷GFFÒÒÒDOÁr r#þÎÏÏ¿xñ=hokñ¢Tœè%RàɾðÓ×¥-yÆ{H(~ÅlEEE4 ä²d6Drr²ŠŠÊÔÔz<==}¹¾©²ú2‘òO–˜Ù8X;8o.¹lúÞKN.áaa_?«««‹D"A2Z]]Ýþç~ñÅááá+^×<Ž”2ÖЖ¬ßˆ<{ö¬x\¢€í ÒRSSþùç/ùÐ…|ïÞ½ÀÀÀ)F‚ñq.]º”žž.~@@q° §OOO‘Ü®_¿~?è€8::¢ÿñÿ111y¶‹ÜD‰øíüãÛ·o?¢ òi|||Š744$ñCTUU…Η_~)*¹ ýrãóùèoddäëׯ}|| >TÑ„¶ 7¿yófZŠA?O‚EHâ{=zôí·ßÁíŸþô§ññqèÛEq***ÄÓy!ºx·Ë-ÙßIX]NNNT~?þüö: 2œu·êF§~ëÎû:òÆÄÄ„«««(ŠVÉÆÍÍ͇úío»Jû °…†ùœ ÜRxö7ÿ“¤?K¯ýBóóóÕ¶Á»–Ëãñ<<<ÔÔÔà˜laÀ&,gð##ÂÔtMôôµu˜Ì÷æaþ ™ù—»wõlÕ­|Õ,}¶6©ZúظxKd§4ŒmÕ¤`–'uÿ£ž¤Æoâ*Û»w/\5¸¾Ðß¹¹9¸H¼ŒùÑCJ¼¡¢ò¼k4UÇ’pi¼`ËÄòG°Ó7Ì|Èeg˱ÏÕS±¡îbbÅhÁ–?¼ÅéØ Ì-:[";eN=~së÷hIÊŠÁœHñk/–A̶ÅÁÑûÔSü "’|½‚ ÚèV'>ô˜Þ. >™‡%V?´tpû<§¦©¾.ª¸“Ù‰~Ã'Væž!‘² Ê`woý-Oyƒ˜£ì‹¥nnn(Á`Š `K™™™V\v¾ærë×SÓbmß‹ùããO_NL P¾’’’cËo •"øÐd Ù-³F†úŸ!o#¿Ew1;·~~ V7æ‘!‘Ê4ÂoÒ6á7§e~[ñ樨¨ˆ­³Aazzzjêõ”´‚.pŶ Ûž>yœ@?©ã—\ÿ%ÇäÓ!ɜƆzÑ{îÞ¾QTQ§fâ_Hc0/Õ^´ŒÈGA!·‡62yXØÉŽ6nû§Žâ¤Êo6¤„ÎÎÎ!<˜ãSøMtðE‘ÕÆ|E_|°v¿™9öõöûØÖÖ&ÚGQ?7¤)b~ÚõVP8y„fgœÎ”ûúÕ$¨c»@Ü[Í…ü–?ˆ©9ÅDGûÖÞÞ¾$Gééé¡“¾®ÓM¼YÝ‹݋Q[ç¨mҘ•÷¹+%Ñ èkõìDä(O¿ÀÔÆiQ0&Êù9}˜OJá­‘!%SÏ“·_þe­Z,ÿVvÄ>ÒÅÅÝå‰þœ2ï7=§À˜˜b– ä·îîîO¿å bjr_ï9¨*§ ¯a‘T÷?A<Œù®F,|*|L¼Dh‡qú1OåÐFŒÅ[|Ú.üÔÇüæµ0™ò:¹âŽØ5­}r6‹~†Á®ùMúº.((¨¥¥â7ÉúÍ@W>¢ Jm³ L¡–iº0èíÓêr‡R:1·£–Žù“³­è=± ÁvIµi•­Šú®‰Ì“Š¶éÙWî(«¨D6ÎùDÅÄV>ˆ;uÕ.”C_Sùt¿!”””6y*¥Üo¤ÌÒòse­B®^½ºåŠ³òˆ@‡K:Uî0fëì±…çJc‹'³ycâZ{ÊÂþï_~ˆ#Ç—<*¥J9%5íгw³/µ)((+Êï4ª=Þ{ÿÐÞ‡4-t”ŒhÂ"hl9Uc%%yßœ›)Ÿnžmá7‰Ïo)“~+Á”5õ«ª.œRSSƒ.üÏypÉiì¾O~pð&†ÌÈ'e†µkH²£ëӱǒ-¢þJý&ì’3ˆß(QÊʨ”ÊÅUóДí¹|F–7Œ¿ÊÂûü,¼“Óƒ>¸ð‘᧘] -´ŒÓÁoà·MûíØ ì§ƒJ1ÑÑ!B¢¢¢&'?k×A— 8vï§?8Âë…Õ…÷}EW_dé°C@Jo·÷¿ám"Ìn<€d ÓÂÅ»j‡=t¥³xi?sÿ%ý{ßß"x׃wQYtñ¾ï÷ ¦¯Ú-ü~Û€ß~–;G&ò ™L~õêÕgkÌÏJKÁ…¹@¿``nâ›ÛKô:FQNß»ž®9èi/ÆìÁ|\ÌOòÙxßW"Þcõàó¢àCݹ‚´ê›EƒìxÒæ7<ˆÅû|vË<³S'ü~Û.~«khrάýlr{/ñ0§ÔŠ™YÉôYÍo6: }¹½x$ž{Þ.ñÞ qL^þ †],Þµ˪T>|@Ç» góõ0³,ä ŒLõ½ŠŸä b±ä½r‡Ýh\Îfªøõî];]Ë^°;Wnd”ºø EžÜ7¶NNš:!¦ˆZ8ðøMæ˧øÜ\/_dœán¸ïî&­;tDõÒ¥KD«ÊfF§®ê7]Õð†¬ú§©µc^Q$7J3ëjãa}?d¶Jœ¡…Ýv}ïòqM˜¿·¹²ãqË“o½ÈÉ´vN7æ«å{:§gÞÌXÅ9ïQrI“cÆ%æ6‰ßˆj7êå^SŸlfCÜžÛåSð›ŒûM|Üœºš:µmn+v_€.“oh…‡…¦¦¦n²ae¿ùÛÐ÷²ðŠ6sµ ÎIkš§wÌÅ—p½’Ùø†šRHá>úÕ¹}»‹)éö#¹)YùÑ3K©Ÿ¦µ¼1µµ³ö±&%í±HÎ,kqH­^¥D/uñ— Ý–VúîIi-XΦ»ßÀoÛ¥}AÏÌ6îüwÕìïê£IÔÕˆ¾aùø/¼FëhJyP€?º@RRR6SP]½|ªNîbw ¨­³t®€Ñ…¥å3å4ƒŽõ¦ÔÝ·ðOó :jÖÌé&&¬{ãëc£Ý”™g‘|•ÙöÆÔÑ/ýÊzû$«û «k6îxá·íѾÐ.`öb!ÑæþIûµü3kj<™Pÿ~“y¿=*§eqltAkÉçZ „†« Ì*ÉhYÉTë/ɦVƕߦ  .ùò3_/w”UÐ5RRRò)â7_K 5rÏB¹¬]Àêż=¬.Ó®Me³ ÜR‹*tœÒ®¼ˆ/>§¤ãìéiiQ„å]»¥¸O)²vÒ…êA¿’^÷ÔÚÑÑ2‰›\\osŠÒÆß&åS,oSÝ)Ǹƒ¥Ò’øÛ÷1gÁoà7öŠ‘^MNºÄÒe…ä’úý×߇^Æ»zæ\ÇTþ|·»ËéG1¤ÿÐô˜6¼‘‘Ý%Œ¾zˆæEŒƒ·BbÄd;x‹$øuâáʨáŒ"÷ÔsÄW±Þ¯“Çwb6–fH(·deeMMMm,„û`ÿÞN,éD}hùs⧩µÃN·”sÞ™v”l?,«Ø–”dvœ|ùmJISôe>« #_ =sŸzõ‘wL–u@ºsB%•‡eÕݳöKŠ®›þPÜZüö¡éß?Eý*œÆPsÔŒì-HT?j‘EP• ~¿ÉrüvçÁXpQ¿xt@R²späÏ*ιÃò›ú¡]ä£ö–¹¥¶C|–Ð*©Ç’Ý)W” #ÈÅÕétæA "ºÎxŠ9´ÝÞÆ‚ðºLnݺ%éñ ‚%­'Âœ€vya;zÀX| z§øSºØ«Ëß¹áømvvÖÈÈùûð²’ê‚'±ÂA°Uí â{·Ê] ü~ÛdµÛ×{T„Yè]µ)>6¤ü¡ÛQ rSî(î·¤ÌD÷ˆmzcJù5Å{CÏ¿±Ñ7ô(‹;V­æHÉá½²±W<èYÍny¬aæÍâ¾TQ:B:6šEW1÷ÏäbÉ4§ýšNþ9]Ñyg½3N{‘¼ N2Äâ7böròùû$Ÿ…q÷ÁÁÁCCC’öÛŠ×ûÂ,Ž¢±ÄU¿|:âw]ñkŒßšššÆÇÇŸŠž>|øX ü믿ÎÌÌär¹D ‹ø…/ ¿½7ÀAÔ¹—¾uñÚ}ñ¶¤åSD®ÉoÂ=», §w…I½ndí«vï\ìð¼v?€ß¤<~ËÏËK©¶¤‹;)žì¢Ÿví©Ž®QSWÜ}vd¯œ¢™{ˆ‰k¨ŠâÓÈ2'S ¿Ëóy­·÷)ØQ¹ã®áÑû6Hª¿kx"ýL‘¦e*Ã2:VÎ^‰5“I4wëøk¬n,ŠSº÷àáÿ&¡/üŠâô`vq%Á$"·„„„l¸˜#µãOt:ýä2 ¾xŸo¿ý¶¦¦f¥øMäØ…U›ƒ°…åS‡ó‡?üÁÚÚúæÍ›+*n-~Ã3O÷su-Cʪ GT ½©Ù­ËkD…ݶû?Ò^LçòÙ}x½Ê+–·“ßÄï×<Œh4\eæ+ÙðÛýù«¼Á÷ã¡ßH'úÐOòMâXÒxÚGöD”öÈ©ùÞÁÇ\çôóQ>±50ñ»4‡ °vzò–ÔV×ärMÍC®)žŒ¶´S -«,&>¼tÎÆ3 ±úeÝË6¹ '’Uâ˜Ýå~Ø–Æè !Úñyáþýwÿí5‘[BCCËÊÊVé­‡}xFèMúM¬¼)X¿Ñ†j èë±<~[ñ˜››CNûòË/ó›ßüõ¯­Ñ°bü&,Dó)×Þd_›^1Δ¿={öìɪLLL$$$ˆ[©þÅ‹â l­ÉoXnßÓCrrŒëx.ò 9ìLN°ÿÞïL«ì2ó§ÒÞ¿ÐßoÍgõ`!^¤sœnŒß„•*ó™WÆ“.ÜIªzÕ<³Ú—ùpõ¾”â¤ÒoU#{a+À{gÜŸéw¼í`nç me¥}&5Ì©*í!åò’+U÷‘Î<·Õ7t.G!Y<‹òý.MŸÂWä(×=•"ËÇiMT+E—?ˆÊ¯Ò±tKkÆ©®Ö‰=H8Ìb÷Ô³¬ÌÔL;àÔíwW% )êqu÷ŠXùÍf¯Vmxç·Ê5›Žßh¿<r3[ß›}ˆÚ6Ⱦ’ÝÂÇ›Kz1fè'¥‘Ù%ñõ³³³zzziii«TI-¬Š¯v1íK7ó3q ·#2;ùa§zqõñ0ôcˆæôû‰`/øwâ?ƒ)ª€¯ªÐOnÀn•ÏX|>P·kñ„E?ô€%üÔJ;Ðo—.]*//?÷a.\¸àää$’Ûïÿ{]]]d ñl¿v¿)<˜!¼Z9=óúêaÕ3Lî)«Ä96Ï=ã2½ I¦hYû“…ýIÅ.1¹YuY-|z'B+qŽa{Qj)/l:h9¤¤×¿ÚZ¿-Éklh[Åox®hƒä/¯çiîi殦ªrî¾ GÞhHdü­c‘Å#Äêoï2ø\<¼qÍ÷˾Æv¡ÄsKÏÂè?ÆÊËçmß&_>·d W ˆç–IJöÄÚq¢4«ªË3µ4³ ˾tÃÁ?ÚÐ92àøºÍ%Ÿ¨Ðµ ˆ¿:Ïjyâž\–Ö†±Zny¥ËjÁ¿!îäeÓ£þf¾™±UOÑ—dž¿yv}yJÕ(¹üúïR/ ÅH4î¼¹7988(|ä7tu¬òãûÛßîß¿÷–ç‘ߘÂv[b9¢øu*š6¤“~~ 'MøyD*>Þ"œºváÒ^fÉe#T.–z¾Á=½žqíIäéQ<Îæ‘Oˆ7ŸZ£ß–T¶¯—Šâ7ÚÙZEÖ‰üËíœ#/Œ**¶9Ÿpîv,³ÔŽ6˜ß'ðˆL³ ;FA¿¤‹?VnìÛˆ1®>- "'»3ÚRNÕšy%¤4̉ÚUSO_6q «|No›âTûÆ3mà ©=¨è÷Ì9™ë›éFïÊï_>Sý¦Ê§éééÈlccc˯âõùˆÁº0k'öpx6Û>ù|êÅ;ŽN”Î”Ó ¦~ièžÍȶ‰=›\sÇ)(Î+¯/=Ÿ­íœ–XsÏ3ÈÍ)ñ¢oŸ¡1;¿åñ e¿ûî»   µ¯²ºzüs¼úˆyX<ˆ‡%•]S³ D¹7’U”pyeþˆüËiu íìäM[gƒâèÑe=V>äÈŠ N?Ç¢œ™FŸÍªl Ìë°ñ سG#èD*Óá yøÓèýcqº iðÛØÃûA¬K¬Îeåtž¨$X´º€ÎŇ–£’éb»!^—ËìXX’‰±¸6Q¨G¯¢‚×ôŠ-aÿ®ìOÌæ±0).Ïìj#}-tùfCç”D"577?û¨h#^®133koo'–ùÑ>L;c”áE¹Bi§·ó㊚íƒÒ¼hÍTüÿ}N/¶ b$^ºï—^ÍêئÑxxx’A¯Çƒ“3Z±ÌÚÑ£a™Ñ'R®¼¦qßødUR[¦M]Tt½S/M¼€ÌF½öÜ'‰cD‰®~Žœã›]ùÈ5"Ó9©†Ý'áþoøaïšÐÑÒ1ö§‡P:fY-cºîY¯²Š•Ì‚CÊ{…G;'Wø&ÒM½²igŠôbO5íøf­ñ‘²ŠŽï±s{;]ÿã9gLIxy ü**êúÇžn?xP•ÚÆ×”WpL½èCN¶ÈÉx´ï'/ÚU[óä%¹e“~ûå—_D¥Ñ­¾Q¿¹;±o8¹»¹Äæûf–»øÇ*»±h—‡­Cr]˜•Žc\¡oæ9g²^Â5{k}¿wÐeNk›M«bZµä¦¿.¿mf!-ô©ùùyÏ¿}ûvrròþáˆþ»ßý.88x``åüúMàŸ˜ä̺Îl_P­q\ÃЉÚ-ðð³=÷ŠÑÎw ©¸H¥ëÚ©˜ñ?jðN+>¤¤];ìØŠ>.´|ŠetẺ¢ƒ vY˜“¥¢ªS¶Olì?›ãŠ“¿½y=iéŸÂYà ±™Äôeeðåûò^;Ôª¬!aš‡ç;Žò‰»»»‰‰‰¡¡!ƒÁ8û*++—ÔÆ£ËJt÷ú­;’}ÂÔ79$¿ÉÒ=ȧp$ýì5=·@NýQ’ïÑì¶ÇC6”ÜËú†FznY9ý‚={öR»ðõ”C«0¹ý?$\|©a`vìšwxœ^p³cÂÐ)(£‰E5õÉ¡W_P0 ÏÅÌŒYÅœ έÑPÜ^ékj¹¦†çÚ[ì3Ëzbè,Éþ½í䟜^,úÄUÏÄ\mËðêGÆ)œ.Ì/µ0¼hˆÎ1uòõ¥^ bÕú°ê-ÏœCÓœbrìÙ•uùž¡/=¿s‹Í#WÞÏjzjM¥ tfµOºGÓÃ)òŠªÙm|[—àì6t/ž´‹¡1»ïÖç cœÎWjúvDy\xï۬ߖô„YQð§{NOO#¼æ­““{b‘?µŠD«"̪é·ÍatcÆÚ:ÎIgÐv”Â.¼¶0Õ(z„.jÛ|jý„ÈoŒß²ÐÍ©i||üþýûƒƒƒ---ÕÕÕ%%%,+99™X¾!...+++77÷Ô©SUUU"¿ØÙÙ¡›þFýÆ÷Ž ÷.a ã¼ÐÑúRÛÈ1½[àIr úÍ-"1¦ânæÅz ?|r c¥¡åoÐý".¿Ø:ýZH€Š5ce€´šel»µCá°Á]ÌDu‡QTiF ?æT…+]í êFKêß>s²‰-´µµ#v™èBä¤ts_å—ge”m^¿~-~¥,ÄoxdH.jÒÑ’w=y; Òãhr+ imslîÃ=;eôã'½êŒ†m òÛ¾ƒr„ßœŽj ¿)Èÿ”\÷RCKYíhZêÕ9jë¥å¥±Khz–PZá{][­h{¬oäçõƒ Ȇmd¹‰šOñ§Kã¸iø÷¹…HvüBBÎ9³˜ª‚A,g‹ñV7a ™¥æt#¿9>@m±D?²ašRÿÄ5&×ÍÓî(k ÝÂöþœ}å¾±7™Ð5:'úìÝ̆G¶Q4ª0êö ‹ueßar§4õ-QpkjëÙ§·¼´ Jc÷>TR°d a¬æ›j†Þ("ïÌ, ý{Ûä³{ñZW/6ƒ'ð‰Œ°¢ô£ìí›è̸žYÝk~•ÎBã}mR›Ù½˜Z¶ÿ±ø´}R!{‹I tL¼lQ+êd²1¿¡#ðOÿôO_ýµššš««kBBBqqqkkëÇ‘ëPl†t‡2-ŠÐ^¾|ùüùs¢Ëz€ž¢«½JÌ2ñÿø(“ÿË¿üKOOz飑áêåÓÀ¬\ òÕÅœŸ}eLÍØÕIøí5*Z~˨¾lî›ÇÁLÕ÷… ;öÇŸ¾jS/ò[ªÐoÌk\…Ã~Ldîۨܳ‡UTÊiew­¼Ñç÷q”¾ùîÇü¡-k}£¶ÎšØ{"«áÿÄü†þ®þûïÞ]XW—(àˆŸtÜo§z²h”L=².û¤Ÿð8yÃ7ÔÁ%£÷w–Ö0¼óÇ#”aaÜå‹š6ÉB¿ÉÓº1öfo­Vû-±£µL‡ÓO¨ª)r`1;_~;ýÎoù]Ý?í4e ãUpñ¹¶á¥Æ*¤Òtù¤qÜ5HöÞÑ«³vrT3q3qp•?bÏé·ôñÍí eÕF¢ÜA;¦nljkëAïK Ñ5ìÂí<Ô4õXm¶‘'Ù˜wÊir僬ƧÎ)'¨ÂZÖdN‘ªu¸[t¦Šªºç®±ª’¦]”¡¥…wVSÞÀý;•MÝ”T4Ã0÷P¼{D+†´ø ï\ô숲šÂaeyÅ#Æ$¨o›Ð7³VR×ÑsK£rÙõõÔäÜËž²Ð}ÊÊú°º®¾[R6×£½‡‹¢ª–º© Ý•ŽT6ŠÄä'©[×Ä8ßÿý’ž3›©ˬ쑓ש½—Ñ0™Vû(8=IÏ·+;RÑ£ì«ÏLmb+ïeT_2ób³¯cF¾qÍìÌjzåw”ݬiš4Jçκ¹;Ù$^d6·É+yæ_ŸQW1Ih™Cÿ¯†ÂÏÁ•“LžÅoÕΧ7Mo]ï)¾WÒ‰à @üò_Ü÷ìÙ³æuõoª¿]2pÔÓT8Âl›45×vb&–kš¦_}í“à˜Yë`ª¨Z™ÙðÄÌHCÛƒ–;„ýô÷c.¾I,,ß·O1¼•OŒ­x¬eá™X÷*ó|óîƒGi=S¨|*ôÛÛÈs¬‹U F70•=õÈʨ½©§¾/°|VOÿÿéiÜol5¿^IÇo šÙW'P.e Û@i-o2®NÑZgimóD})¥q"³qoÃßù"«…ÏhÊl|C¹6ƒßVZÞÒ¸|tð)-3¢™Š)/3§moSë&\ƒSëÐ7¼ÁbèÿEQ;Þ1Ci [?¥yŠÒ:/]ã³Dý{û…ý{{ÞuÀæ,¶î‰Õ$ Ûµ»Å¶/4-á£ñv k•7Ñ¿WR Ù/ÏÞýÎUÛOñ³œRÖfz”¤oïg`ïcZÙ2‹ÞL>^®gëkdLI®}’u庺¶]J'fzø;ÿLc'’‰gZFó|Æ…kºæN¾ñ®ÉyþœNVûc5ƒÐÒÛ¡©ÙÚ–^&Îøp?žÔÏúÃwry[ÂYGŸpw÷…m”OÆÆÆÖÕ,¾bÿ·ŒšAm­#úŽžôF'Ú FJ¥¢ ÄÐ-)« ²Þš[˜R5 8Qa`›ÈèÃ’ó9ŠGTuý‹£r b/c–žA\,<;OECû°¶uTù}ZÛ”{bQÖ5AZí ùêñ5]6%xzûS]C#Euú Ê].a±QfQÑ8«4ljr_¬þ-\"ñãý«oé‰ºÒ +t|}¿K­mÖ?ñdv+14· ®dõ¬ñ×–¯:$X²˜Ñ’.ñÒ6~>4"6âÌèÚ‡¥H0E½åèêIô yðàÁ&å&Þÿmáø¿w6ß?YèA۳Ȣa:O4ìté}ɱA÷„7 Ãÿ‹¥ý{J0~[ß”È\~Þ(Þ%‰.­ã³ÀoR;þ”Xjdó30HÉü½™éæ¬Ï>fÓ>¡ô¨³+‘C‚ƒƒ_¼x±ùº‹uŒ_xÈü'ztËâ·œLãçiCK×Ïz7¸¦c…’Úºîqà7_¿]æï½T{Ñš”äžrÜ}9»ùõ’ªŒOå7r¡··—¨þ-//oó»#]ãë·ÌoøÜV:rGßÈ… ~”’ cÌÖ§>Œ«èWѪ[BÎ=¦7ŽùQNûÑ*3šç³/´‡ä] ñIW'ôåvgŒbÖ&þ¥Ï]#h)ï‹š&•§e’å H‰õS¿ßdr}@B,(‚ŠŒ?¬o»Xyþ -Gm5vô  «ÏÈȘŸŸ¿IÐoiƒX敱V…¦‘Elíëhj¢}÷°.™Ö9¥­­²ÿà¡r‡ÔƒKÓ³ãÌb¯°»ÖWD¿ß¶‹ßDŠ«¯¯WQ>œÙôòSïuzýK %¢q0òÄo’,ŸÊ+G\èµ  ²ú1rtlõKjýmµÝr;>Èh~nä3‚±xsQgFS³â-bëÙ]о~“Y¿‰zÏÞ¹}û÷_í(ºó©B8ô'n`ßîQŠ‰ŽÉB233e­þmëú‡äŽbÊû!û\[GGYßÞÜ7Ü,â£ã­•£clåz;?6·ì ¼‚‚ªIdÕdJr€Ah ø üökðzpãæ “`Ö‡;ìmjZE$Ÿ€üvuUÕèèhQá]ÅÅÅà7‰õiãÜĘ\,;>Š/ý“?„¥žï³ ˆÍh[è¡wì&&\7MÀèÅòú×}BÁoà·íå7ñ‚êźFû¸¢c#+ÛŒ˜ýcI·vâ1Ñ•n•‹…\qGSK'66V|ØiPPн{÷>kÿ™Žß:¹ÀêÆB² £Ên‰&íë¹·‘ëü~ÛŽ~r¯§^ÿù»t&¶4 ¾ >›kÇüa RVó›%“9d4L¨Ú‡-¿‰K }–Ò:·ë§½Âe²"ÄÇÔ#0I Ü¿}h^â÷XI¢Úü~Û¦~W›‹“]=±¼+´¨'ê4×* ýÇ}Jšê–––‰Õ·Å¯š‚ëØO*&vÖ–Ñ9‘¥×ªîg6N¡,Š"ºô†W¥ÃÚN!:šhïDm (x«««[òÿ‚ß$ê7¿~¿­À›©)?oWg'gw/G'§?pEEEôÏŒ-ì:¶6±Å¶66ÑÑÑžn–vGM¬õ-œ4-µ¬= m\m]|}}ÐÅÍ& Þ¦§§7¼~‹*îŽÏÚâ„ü&Ùñ§[¾GËSÞü&‘S ~¿}ž(®¿¿?00pÉD”è‚õööùË·;É•w³¯ÍØF322B9\|¦JbÔ|äbqT|»xÉôÚµk’úÁMõ—cJzðuxó ©sCiÃ\Lœ~ Œ_ Ž¿MH>ä“{$ñÄ›/ÆTŒ>ä·uMw~¿m¡âFGGããッƒÅƒ.ô ŽLÖVWþæ¯ ðó&ÚCÅ%†Þ¿¤(ºDn(cœ9sfóׂˆ{÷îÅ&¦&g1’3éÉ™Œ€° =Ó $=S =“}–Hšúf*ê ëJl2~#'${”Fa9ºù¨ëoꇘmæãâIËÀ\KG7ZØÏGÜo¹¹¹¿ß¶KüFü}ñâE]]‡‡GPP¨ÑÓÏÏÏÇǧ««‹˜I^\bèÕŽŽ___´}¹åÐFòx<ñ%/%Ug(bhhwËÆRäF?øî"Å']ߘߖìTEEyhh¨~›¤Òâ>ŠûíîÝ»ööö›¬P¿ß>¿åfgg[[[‘ÍP´†Îéóçω÷\ºt)$$D*Y/·„ÍÄoâœ={Vü8Kâ~C÷¬7oÞdeeî6vŠ ¿I§Ü¤ÓoyØ»ê¥'u`Çob{äŽH­ß°M¼Œ¶£œ––†B2”ÉшJ¦Hƒ¢÷ÏÌÌ  óæͦ¦¦‘‘‘'OžH¤µt~“$è7Q©_ÚXÒ~Š.y”“7p¢‰7ËéÚ§7Ï$Ö>C)¹îeZÃ+©JÖ!T7Wéñ›»£Ê#³%÷Ìsng]7‘Ü2ιg–»nîKDÉ—}qÇOûããâ¤Öo-:¡ÇÓÓÓÈ'(®CŠÍ6?X^"~“’ð…¬}}}›ß£Ó§O‡ŠMJ U ñvuu‰×¦NLL())mlOéLV•‘IefÑXþA¡::úNš:†›ü†%ÉÔÜRÔp& ~{:>>ö¥§( _  ÙL Ýä7ˆ¥ÐÀÀQ½ývñÛêºû áÙz«ã¤êÉÆ­ꣂêÇããã×U˺¼± iÝ ¢¥ ñžN[ë·å¹âÁƒ¨ %mὨc[ûMÌ¶íœ |hi³ÎÎN¤¸Í|3—Ë•’zÔ‘†øm‰ßP/Glûú >ts™õõõÝðíü¶^¿Iaü&üȘâPùtdd$##ccAu{{{RRR¢´‚Š«£££ÒsÌŸ?~üøñ“’£°°P‚ßVVV6== — cQ\ww·Á‡.‡q)†è5!ð+ÝÜÜœ»»ûrõl÷(ý(((mÅ KÕû÷ï‹pA €,)ŽÏçONNúúú¢§•••¢p@6¢¸ÖÖÖ¨¨¨/¾øBCCcnnB8dFqL&ó‹E>Ãd Ÿ‡7oÞèëëÿë¿þ+á·ßüæ7pL%º»»ÿùŸÿ)®¬¬ ²Q>ý››³¶¶þæ›oÄ眑þ®#[òó ÛQw333=ZòR{G‡­OŒ‰,m)1‹ÅÿŒ3€=yòD"ó =Òóñóç `T®@ÚR(½ò—»w>C|‹HLLüýï_XX¹¶¯Í–—¿ƒCr¥qYvÕý_î~êRZZJ´¿üû¿ÿ;N@ÆZ¿E²«>¸·ÜÏ’bll쫯¾õŸinnþDÿà·%‰”UVSu¡K—Ë•¸y¦¦¦<<<¹íÞ½{rrÆêøí³­Ÿåîê*„D"I°ò_4„íüùóÿöoÿöå—_R©TˆÜü¶­×7‡Ã9}ú4z```0779ÀoÛ×oâm¦qqq7nÜ ¶of YÀoRâ7BbÕÕÕuuuÒ¶Nà·M–L322JJJ–W¿mG¿‰<–œœ|óæM0€ßdÀoâ+++»páœq¿É€ßÄkØbcc0XÀo²¿ ƒÖü&~Ù •Ióóó—W¿mG¿‰<ÓÒÒfð› øMT½†þ÷ôôðù|8Ë~“øð[^^Þ©S§ X à7Ùð›Èc±±±ýýý´–øm-~ãaÌNaâáOéí‚åïYظÒK‹oÀßCü_ô¿mc~K«««/^¼g€µøÖüŠ”Ʊ ˆ³ ˆu"OiÆX¼÷>BX+ÿ:Fçòé«YKÀìÂ8=—Ûºü&¡Q©ÔÒÒR(“°&¿µ (W«›ºd5Üͼúˆ—¼÷§#É\\VâoãtÞ;¸ß–5ø^ü¶ÄcèI(ntJ¯FŸýhĸF¿‰wâÍÌÌ„áW¬+~£\Ó°pg´½E¾â až6&ÑçQ–\>~¬-¢¨'³E~±}ïO µÏ]Xâ¹ÁðãmÅ}¡“*GÐÓÈâAj–‘kÈLkžûhu½ñ[}}ý™3g–Gt€ß>î7î[¼‡1ËóT¬’i/<ìé›]áè¥æÄN©nݳ[;ºü—”Ógµƒ}³Ë]½¬´pþìÙ³4(°9¿±ªOªÛ%;Zë„—x§öÏ.:´ÿH2ïÙÞÝ970[kãèRïÔÿìcûÜcÁð=w—ÑŽQžÆU=M,¾êr^"í ¢’)“Ɇ° €ú̓ɥw`ì,,ÌÅ8²ÒBGÏ4©Ú/ëœ_ö9J ¥ã!á7sS+›´¿Ì³øöôRûÀÄ°šÇx¥\ëTê•— Å ›÷Û’YADó¹lÄoæî´–)jËLp*õ§ ñ-X\fˆ¼YrÞ ,ýd‰¦3µ`àÑÞ]fyw± ˜ e—¼c7±DEûú¤2V7¾Ý‡wrËn§µãOÑÛrúð®#tþx3ñAii)‹ÅZ^\X‡ßD£Ð{Úž®d'Á² OEo¦/ì°Q¿Ë¡‚ÙØ|ü&ëŸ~¿~¿~¿~¿~¿~¿~¿~¿~¿~¿~¿~¿~¿~¿ AˆÉo}ýIîlZý‘ÒPš”†dJ¿°šššÓÙEœ¢LNQ:뤽g°±‡4$+‡`ð›‰âø‹¼}û–Á`„K ‹€ßØ$³³³L&3Bú¿ «~ ¿°I¿¡òi¨„ “Ô÷H$bA@€ óêÕ«çbbbBR_5>>ŽÁj§liÈ øÔün¸j5 endstream endobj 1498 0 obj << /Length 1940 /Filter /FlateDecode >> stream xÚ­XÝoÛ8 ï_á·:@ãIò÷÷‰ înë0¶S¥õ-¶sþX—ûë)[M³îzòŠ’HŠ¤~¤,‚Ë@/OžœŸ‘ L’„'Q.ò`UŸ|ü,‚5ð_"ŠË"¸¶«ê É øßïNþ8l¨°sÝe@ÄÛ—žÔ¬ˆ2¹L£BfwJÎAyžNÒoÈ(¤ ²RFi–Þ%C*‰D*Y„ ð††ÝæxjÊHHé«A~’ÇQ™Npg‚ÍQÉÂZ¦‚¢–%.j"‹Š2¡¨=3ƒY !>©"|ÚÖ;Ý™~±Ì`ÔW—FG" aŒÊ´¤½¿ÃnzÜœ$°ü÷®]™¾w»õvK„ùfšÁ1›µ›5Ý@rà0Š7Ò#MâHÅÿˆÂ­d@qv¯d¸áݸ¼y'2‘ŠÙ»oÚ~€zUKÀ g- ÕQ”R;8Iü¹XžÇƒâ G=8&EkIZb—ÔÞ§@*ï–òaR¼Ê$û â˨HR=-7꣕ûkÊ£,¡çÍcÿ8ÖVHèÕV"ïí°[a“¤Nòëº}™ƒ6™LÍ€·K‰R¡ïš¥;îÖÙÜ-åýºnÇf ºÝüH&@Í+>h…÷ @FÅËg…¬#a‰ïwk>‚róËľIâB:üŠ D-€v€|ÍÿÐtn%½‚PXŸ–|á$™‰±‡@‰ØÆ"_LGpLˆyÆbn˜ çûAÊQñøØñÜû*NŠðÑŒÛYÌ­M¦¸8§Å>„›‘~¼èW]uÁËÙ£¸ÊyÔîØФ¯„áfk½'¾lì²{.RÑTƉÑü?TP’jÃۯ鹅|~$€ˆƒwfÆ%•”üèq£+~L î¼°ø¨9Õ‡¹ù’®eÁzgj]Íïèž|¾0®BÁâ¹Ï;ú ²}^æºY2-8ÙhΉ«í‹ ;KìÓO‰ÉLX9T¬ é —ùpWé=)3n2²ùål=ïü‘*ÏȪŸ­„Adx+×õX{¼6Wo'#ö^˜S±Ê=LHŽ²kÝèKSCî,Ï0áRˆÎÊxþ%6>£WízõH«ç9 é0)½ðKW\BâìÆ3jkp““qØS[ýü)LrˆÆ4=%SòÙc1<؉Ãf¬/øcÊ?{;y‹ØÿÀÃ]&0¡5%búd4w®Àåo–mQ‡Œ±ßŸ„ßkŸ­u×Éʬœ…îÜwÕÀû¢·ÛÓ3r>©÷¢Z{ø-8M"•ýçOÁG¿U'ЯI~ÊJ•XÇIå…‚TÚ®ônpŸ­ 8d¥ñiÛ`†^Ž¶‚7‡fþ Š;È| endstream endobj 1495 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 398 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 24749 /Filter /FlateDecode >> stream xÚìÝ\ÓèÃpܲw'{ƒ "8pËPÜ{ë¹÷öôœç:ç¹õÜzž{ï;÷Þ²Dd£  {”²[ÚäM›¶”QNÿ/*§¿ïç#¶iò$Mžä—'I’€ÿ‚ Êw(ý[±ïÒOˆrC”vRôQ±* —t¯8l¥}•ùRíc%*Ì7¨Á«G%ë QU…$*yÿ50éÅÙAÞMêÖRSS«Û¨mŸÓOéNÿÔ²NÝ:jr&½Ž¾H‘–ÒXMmI¸rA%}ôÔFŸÉV¬›W'¶ØüˆG½¹²³SS+Éðu4Úôÿ<>—©¸ð‘–º¢ðºÚœqËöÒa·nk;zré×Ç6W÷[õU7IÒ LOÍßÎ}¬þ±ˆRmÔ4ŸçŠQ«^ D HqÁÛk®,Mëö“¨×É7W׫3hï#òõv5ýöª'_ÀÒV»•O~©Ý€HÁûú̉¿ŸJV&þÁ¥# f¡’.Nòµ»KÑçÁ^úõ¹á¹ÔË´Öêê«¢ÊlvG˜×šz‘§xß¹eŸL’Œ¼¼RÃÐjʼn'’Ny KFzkXx§KWZqa„¥‘ö;¡¬ÿÄgG,Œ™“oR’»ÇtuŸºI¹ô;Ó½Yý7~u{½¡izë8¤#gÃåäê‡8½©7 !¥Ò‘™ÝÚÚR¦äòâ¡-ÆÓu¯d gêí4Ɋ‹=vîŽê_>}<-·„$?Úª5|ŠŒø_wXI²h¬…^›õ¡ò½=ÉŸmíõ¦<¦CÊü§MJû¶7s½£O“ÿ-¤²Ä¿ó’ó$™î­[wÒ…lù±äÏh‡£÷Ä‘²Ò É(ÝPÿ3”mÔ~¯øSCJRZqANjJrjz¦ïx%ÙiÉÉ)™¼<Ùt ùɹDIaJJ=²â|j¨”Ô´Œ¢¢Ü7QqáÓó«­œ†$%§ÒÚx%9?;ƒ*0ƒ.$³3Ròâܬ´´ìbz zŒY9ùô4H"XX˜‘–**‹OЩQ Ó¥#§ÊCJÒ/?+=999-ƒ'þÞ÷º©ïVRœŸFÍ„”Ôœ|bv‰ÒŽiyÅ"ª£07gÏŒ>¾cÖggòªhið³S¤óM$íV˜™Âˆ ùYTÇôl>=:QAfJV¡l(‘ )%¨²ùV˜Ë£j5yüÉä•äçü5»o»Ñ«xY¼bÞÇéÎÜyW‚s ŠÉ’‚¤ÔLɲ/ÊLÍ”æJêaš¤J—5A-|ˆ(Ê~åÖ€}-‰_ "¨¯W\"¦GCÍ„”´têejj ¯PX¦f&¥å*1òR’xÅtUçË*­PQiE¼Lªâ%§Ëê6hðn2©¯ Xq…%eWVz›Z1¤ò]ÍôŽOÉ»·±ŽI'AÙÕG^v%!u¾/“Ñn÷'†UFÞó­Lc33 ‹enß_ –;ݯ1‹Í¶´±f³X½v¼–ôúz«çÂÙíFÍ©baø^jSkkS›ãìÍ+› ü°»=»´51w=i5•@C¼ÌúuëgdfçéfÍf›l •lúÆvâÌXð«ž¡‘Û¸{$!×Ì–ÉbYZX°†ÖKÛŒ$¯©—Å2±µ²`3Ú̼&í˜ÛÚÉ„Í昙s-¹0Íè–Ô®ÑY, kk‹i7è¯ï¹qE-³â w¦>ÇÔ܆šû&¯ùÒŠ—ùÐÅÈ€kjjN-.÷UfqÒ¥-mÝÜ[Ï_sTUYɧ³L++ja2Ü», :]èɾv’™1ÃÔÄŒšíg] :¦îÊzZÖ~M}¡Ãu.T ïNÌÖ3bš™K åpMC²YwÿèàælÛÔ󗵆íŸîÆá4ï9hÇ(2æP}›^ÔP©Wú8Ï:áfÅháéÁb{öY.ý¢%.VF;`ªÏì>jês¾x¨µé²ûñô¸nlíѤÓjWÆц;í\H™ÉȼÈÔrKSÓCùa\-sÿbRõ§%‹ijeeJM˜cÛ,éz´ ½Uñ¬©‰eú̽†ƒŠð]ÊŒ¸Ê4·É“4(*ùTr¸oÌù»ü½é5°Œ.¨úpŸ¤ î¶Mß Hÿ?f2;ŒTyÄKR1òMÆëK¿sìy³?ùpÑÙNký?ï%/…imôô7„æ~Ü?´žÍúÄXNücË$†' BJSCcÕ­ä’!äÛ›2®¾I£‹Ø3¹q³¾(_È@ý{ûp»µóhúý_ÛfcÖÒ¯Ö´`ô½L½ßÃÖºó„¢’*“Nô×oûý%ò£®hëÙFdÖ¹njöóéýã¤G±œ[S%éïÂè±îzeÛRR)Mô´þN’fXÜcŽ©cŽà{Ž©Ë3»ºN–Ä;ÒǺã–7Ô‹qÞ&3öúÓóÿõ®î†öS©ÝƒÓ w›º‡TqZJ,Ì°ãè߈Ȓ¼) w¨£w"CRúš.ѹÒCË‘Wµt-_FHQú6×™µïÝïoãç©WW– ñž²î8ß•»â™tiE—†Ó‘%iÌ…©Çm'’‡ÔƒXjUIñ¨Ç¦¿[ê‰^ÚmèZÍïe¤¹>RòÕòss‹„¢2GH±»ÑÙ  êUÄÕæî=¨UÅÙ‚q.XvØù¯nMºm!Š"Ì Ya9’.É÷2]:akߥŒðËTHå—(_§G(‡”ž¶Z-ZÓ&]¼åK?©²%%Nj4ê õÿ‹3~*×FSìSS!em®_GVz-îü}·éõô“B*û¬¡†gŠ¼™–“ø69Ÿøūɘ=wä ¿âfìU/ÓÈÐejœÁBiÉ)·¹,³u[¶o“ØþëÔÁ–MýÈâ÷Ë–,¦üòÛaªÝ{›µó(Ù9)/“ÕgbéGê¥FÝ/JBª«Éœ=!ÒŽÂYLŸY«vHËÛ¹scK}ýÅ¡Š9(z°nz/ÓÆžÔëf6ÜCþ‰²ã[q\SiH‰ÚZë¶8ýÆËè²[ªïSìžêÜF ¶HÈQdq¼‹®Îì»·Ñ6Îgë™Æ‘§P!µ[U9ÑÛY½óåK?ã}L†€ BÊiÑCÅ,\×\£÷É´Ï)ùrñS_Ü=ßÁ†ÕåL‚$Xñš²MúIÉ/¹ËŸ|,Rž[¤Çm 2ãfF›ÒzK…T2R/é}@â½­¾þ+™÷l¦}ç*&âä&mW]¥ÞlîeÔkkŒ ó¡ ÃdÍ–t¥]6s„¹sGRœmÆ4ð»øahBé1 lÑàû;Ü—òJe[$RÞ4&=]ãí3ªHL·¤þ¨xT„Z5[5T_¥¼9°…ïú˜Ý!’ëx·×Õáx–Ýê^Ü>qðô¥-©¢J6»ÆtqŸºY¹óÝÞ¬~ÊôµFƒ=¤°löní°ôä ùK–¸±Æ^O ß,S³›J÷ûî0›é¶eç®R»vï>xì4!ø¸w—ÄÖ½WJÊ…}áý/v—…TÎâc¤‹º1ÙÃý]VÜÎ{ö칓,'ßêâfbâÐ|ؘi«Ìà¸x’D‰ƒãzx¶|n¥¹Ñ礲01dãâ­œÍÔêê š¶–jž}¿ÛÉ{záÀ„A~,­:ÜÆÞÇßä’Ä3Ó†f+ví“ÏÂ]{víÊþKHñN1púEXvéS!åu8RÑÏéalÏß"”CŠH}YuKêÒ¶9\CCOßžÓY>·å'‡”ü˜dºÊ¢+vÿ¦Vë¯Çÿ9׫Ӕc*wF¨>öjêu+34©}—ÂÄlc×Í;wËfЮÝŽœì˜E=Z5w‚» £Ž&{Âò$NKÁ÷¹ÑÈa¥ßö×;¤ÒÙ¢M>Æ=‹Ëž“*«p(§öÈóÙ²K$CÅ7Óª·:DrNxAc“ä|±t…Ih«_oüÑX¥ÂK†;«Xñ„¬ìœ”Â?óú°{.$e¿š’LÒú~-›ÌÜ_vgú»¾M”HÖóS×<ÌØØÝÃkåÙ†K\ЊÉÞž%iIÙN¥¿mQÆ3Ó:] ÛíL‰º{òâ‹ò{ûCŠ¬,¤¤a³º³Ï‘Ù þѽ¥‰É¥n,ßuè¡ø¯.1IZRÝìÌ–\’}©ì0#sIH}¸vý©ìpOÖ+kûZJáw\áÂ^Þû%ÛñØÔK9Œ$3Ýu5¯|”7rC¼F¥OÕ!Uôþ0Ó E¶¼z\üuÌÞ7ÅTH±û–ÇVÑ8sõ1wò©b 9CÏö¼¨›zf.ªçï‡FZZWÞËÞ\éÉð«Æ’N@ì–îæ#VtçhK,¢¶Ü¤t²×7j´SÏÙ’ƒÙ9&Ææ‹d³(ýíƒã瞉ø1×oÒ= Þ^ah›Š°Aƒï3¥ŠÏ›éÎÚ}-195-5ùʶ©: Û'y²Ã}*BŠ¼·{„±©Ããðwiééɉñ¿ömfè6‚ZKDù9ËKä…¿¾°\ß³ýzpRJZJR–Ñm´¹íãK/A¯,¤¨1ã í†ã¶ßþ(™¤¤àk8zGŸ§”ÛùÞŠ;`áÑ윜”èÇl}Ö?ÉEâàõ: ,/…¥æäðžŸZÄ0m”I5_ËBJR²¨ÈבÓgõ…,?;åM7“úãN¦•Û¥¹¿Í²Ñ ‚¢O)2?p…¡ºåýˆd>?çÖŽiFÎ]©Ñ¬ð4ëüûuP˜ÏO_5ÜÍÌ¥…P$ŠÝÞK]¿í‹øt/sßœ\Žôœb¥®¾÷Ñû>?)âÛ˜-øŽëÛÎmûÌËÈæåð2ÿYéÅnµŠª3ËG4së9/-‹ÇKÿ0ÛÝÀsÙ3ªÏ“ ûŒß$*­µ„¸°™cÁᇼ~â‹#ÚZÖÁ"IKÊXOýðÃh/ûþyÚ&îTæ^©Éê“]PÏÛ0Ú•cÕXuH½wÖÑ9ñ†'} ¿Ç1`v<^!ŸÉ#¥Ô©¡Î†ºÆmdízB,š;uüŸ/?Tœ”Ý£:hÍ>•,=2.ìêbÒsÙ©LŸ—ÞÛ¬Áˆ#)ï.KÇàÚëTÅûðü˜®¡ý{lÎàû=S¹©“™©‰‰‰™¥S‹«ïdí“«³{;Oü£ò#ÔžðÆÑÖV&\®©™…kç éÒï™oöÏ|œ«\ø‡{›­­­LM¸&¦æM{„ñdû⢨ÆV&¡™âJ‹Ï‹¹ÕÂÆÌL:˜••Í©ÐÌ ýP‰Û½)5S‹a[žÓ?~¶×Ô”ÃáZ9º=åI§!l­NÓ¹¥D$·kb/ÊĤï’SÇžs›úJl¶µ‰ÛÝaû5ú÷ËdÚ߃,ýM½˜Ñß~åéDÅ|¸ÿûpsSjŒ¦:äJGQâá`Îa³Yl§ãwš°8f­ÖRßsǸ¦¦¦\.§ÓäÍsÜì‚ó%ßýá¶ñ&¦fÇÔÌzÒ×Äw|NJÚØÒÆŒšû\{g¯ ÙOŠ¦uq¥:RËڹǯôUýûчÜO9tPTi™E‚/ DÆë»—¯ÝËþëa¹’[×®>‹H%Qð}‹Å/à3=þ|®ˆˆˆÍ›7c> ¤R)@H ¤R€úrÂÃ×,Yò^I||¼@ Àœ@H}saaa>>>Ë•P™åïï9€ª !åíí].¤‚‚‚0gR)„ ¤R)@H!¤R)@H!¤R€@H!¤!…@H!¤!…@HB !…!EDù5d‚‰š1Y5$¤*ýþò…G¨Zœ–n%]¾è´©[Å)¯X–ª‰¯úüÛ«ÿËVY2¡²‚øô™£è•¨¬dåyö—è¿.ÓÏœ JÿÿYú…–iÅÿ¯õ¨òz™«*í_fÑR²¯/ܳh¤•)›Áµ8{KqÍI*BplÑ`.›Õ¢ÏÏ©ÅhI6×dË1¸vóÿ|TºÁåÙ[°5[¬,­îòÊ}cÿ¯n6æL–IÇ3cóÄ_f5Ïðbi+¦Í¦©Ï•°4ù¤ fÙë²Ë`Y·è¢¨dïŸýÔÙƒÁdš:yn¹A”Ýe¼¾Ô³µ ›Åtlæwòé[ù'âßÛÛ0X²Ò¸fv³6_”mî$=äõ3Ñ,7Ʀc«¾/[r|Õ$;S›kÚkÂJ¾P2Kù7–hé3ËŽ”m¨mt…OÎo¤41,¦‡ß?aÙò¢âœ9Få†êu2R1„éa† –aç? Å2+Ž³Ô1d³»*:Iþæõb2Ì«q5! _Y±™ò©f5õñ*[$_j¼ÎírsØsÁA2ò¬f…™`¬ÏØôŽòÌج20Y£ä*F÷äè 7;.›ÍiÛgr|Žä‰¢…5õåJ3Ò3Þõá ì DQÂã‘~-ÙL¦e£V›Î¾ »KëT|ãz &*Qä˪µù¥øØ vy,Û½¨áþð¶’×Oj&št›´V [~±NõžLV.-¿-³öþPrÏP³Š¥9vöƒ·¤¨E .Nv±á6ê5+861îÍ“1¾ÇVù_fwåsiÍh2>!5ýàO-û‘EßhšjNH âÔ{:>U*âáa¶Î€e'd=øW.ÃÐHG÷nŠl6Iׯ¬ÖÎæÌ&Ýþ~‘œ»ï׺F&?ýý–nF{ýÚKï§I¦,%ùîÑ•ÔÄŒÛyWú‘`–Ž÷žÐ´´T…´Œ,z #vÿ¤§¥;mû¥)É.ì`ë¹N¹¢Ørlè`lh´áÄíÉ)Ïms`j7í9Mú)R¶M–œçe¤¥¦¥Å^÷µÔ°rèS ¢¿u^_fÝq—S•¤óòªë«ð4iÚufLRzjòû?¦{³¸±<‘¸879E2¢øÐ[l'$.I2'RR©)šïÔÀgsˆì‹§&]<@ËÀüd:½âœôžz•¦<©Ù…%ŠqE^œÈfRéÌϓ/³â8+]#›žU,Û¾R5#á%•e,c‹ê ) C{QÒiKzÿ׊Ÿôæ[CéÙÈó5¬=ÿfŠòdgð È’¢ä”é× £Ö…€Dz&ä—HCÊØày¬ò©¼bz—‰œâeÁul{#0:)>|ÓäŽFFÌ¿Ãù¤°€.-%ñ•Sïæë²ÒDÕžQÄ•žÆº³·œyŸœtçx+Su;·ŽYJÅ»ÖoX.¤:±ko|RXÈ“-¸C\¹·ò²Ó¥u›Úïô¶j4÷lv¦¤‡Ä˜—½í´Ìíú‰¥!U_½\HµcÕÙP\M—–òWo{³û³³$¥¥gò~øÃ}âmÌ,PÚdŽ·nØv}d%ÍÌÒ=U•‡–ª³âdøëêZ‡ è7%=m¬º–Eþè!U{êÍŬÞøS}ûáÒD¿5g;ÿú¬k îœý²æI”ÌkiiÖoƒP©ˆ´W'8FÆOòª;¦2ÚëÕZÿº´‚ämÖ©oþ4OR~'R*;d“Òˆ­¹ëA’¢£(í¾‰žN@’d’N,Ö³r}›«¼mˆóãÔëñÛK:¤š®½[ZKÒ›0Ùóî&Ð#ïè3íð‹,„÷Ût4<•öâY3Çœ{£ø¼ %Íá&•nIÅótÙÿQiŽµ¬ëýÝ\ŠsÒ«#QÕÈSm5Ûm|ekÁÞùî4ùC*RT3Šmhdú’_¢¼ÉÊŒ¸}õ^”ä}ú³A]ë×Q«]_¿ßäôAtòÍoõÛ̼¼¼§Z&•ñ§VN1×o ¦VÛÒÍëÄ‹ôj<~šôè/c§–ŠZ³t¸û°EßfÁÕÄ’Öýô“3k³»S«–ˆÿÍäÞN*:7ÞK·l sbÙf`šRTz\p¦‡¥çª»Õ~¸OR¥†4Õžs BUHQRõnh1¡H±¤r•ß¼zñCv!õnv3õžËž)ï Qÿ¿:¿„ëÜŽz©)…€ù®:­·_:¤b×é©›\OPd‘ù.³ðsBªh£Îð3YU‡Õ§0¾í›r»—•qŸýŠ²Ð5}ó—ÙØBÙ¢NµÕßòœû¥BJ6=¢â s®ñ£÷¹ÕR”^ÍY‹)ÕR²$%èì•g%_+¤v7´|Vé„‘dR âŽsŒ¸IÄÿ7¤¤Å–伧¿ÏS RŸÛ’ÊŽºÅ0³É-—ß­–¾ìfæ7{Ÿt‡.¡‡“q—]á’×ëµôt½'oKáòÖÚzGð%kæžW}Ç C¯¬³pï®x»kJ¯)[~ôbמùP±¢dLôqµî¹ˆz™ðp9‡Û8ŸZ«ßïÑ«eøw†äóœ˜Ãl¦m–°üòx»¾]}ו_!¤æ t¾è$}Nªù¬=§N”;qõNUOŽuµ°›}MEoÕÑØ™P®åNEßÐ`9SÛ÷Š!Uðt’®~éy^_vý+Ž,uüÉëÄêÚxÏìæ\§¶f»¾cw=ñ¾ÜA„JBÊI½ÅäÝôtœ:uü—Áí</ÉÖ“¸FFZ‹wRšÔ“ñ9²¤¹·wœµGOI31d‰AÎkºù+ )“ÂÆfzO’dO¸­kѪ8爔dÜ¢BgsÎ`ªåËëĨ?t­òTŒM«:¤Ì˜F[ÿTäLªú>üŒºÇCUl6¾pHewÐÖ›X\n(*L7ã2_$æÿÏ!ÕxåcùÛ’«›‡3,Ó Å©Ï ©ô7˜æ6ù%•]O%~e©Î.­~¼×똌®’ÝŠˆõµt:Hk®h›ÁOgB?¼§¤¦Føêêl‰«¶© ¾°ÊÊ£—"3÷MïÓvâ†<¤†XhhÔ«+U¯¾¦µcó‡’Ceâµ-´]f>“}rÑù›d.3t›é‘#*¿ö§éÞÀnVu¯ð•„Ô/ƒ]pŒ)ë>]ü:žs”šìÍ,]WÜS±azmUKÿDzù%>Ð0²'* ©Â3õt|¥{Lyý¸Úø)Ñgõ¡'ճ閮©MÖÖÓƒc ©aãÅ(öÍ*†ÔgMkoŤ4s2o3n«üÓ8g–A+ï.Jüî~È‘–&šâX¯ÇïÑô6¾¹•ÞºKò–Rä]M9@ux|pF³Þ[…™O¿|H5±àî ú(¹p‚­éÚNyª}v] ­:¤ÌÙÌŽ”†ðë"Ù |tÕ¯w.V\a¹ôÿ²!%Nz#/¬Ž³SDš‡¦áêpa¹g™™°nÇåüÏ!e¬«Q§½®6`Y:/½I7ÅRŸu¸¯àÃsCŽUJ±H¹ùÃ{{má’ÍDòa}õöYŠÆoêÓ!S( )5«Ñô¼õ3bXØØÚ)ØØ,xUmg:bnîà6é x»i¼OY{Ð’šñ üi@"Ý_GŸÁ4Ôדb0Ù&ÇJOò=‹‘'&Ë\6L\î`ÔçðWhIjk4}G€êÃ}ÄÃñzö*o”(®]zäåª!ØÅ°ÎÔëyå®®NqB×Â]PYK*vk[m×e¢/|¸OXTP(Ý6ʧ«°‡ƒ…~§?>õpŸ$e9u˜Ë®ã¨üpŸäÐSÌ1M]À^ªz,Û|ðfå"#V«7ú…ê°ÈS{y0Õ°þ²!%¹¤RÀ³0aÞzË«ÖÃ}⎖ ·ßJSÚda虋ÞUÚ’Êeϵ§ØÙÞçWÇ-šh©íµ/¾ÜüòcLÙŒðt"¤ˆÏnI=ªdÿFRBêÓZRdI†»¾ñøëiÊÝ®M±â6ý•RR仿º3ͻѫgòýš¦-Šªo¡V„ž†“¯Ó'®sj³ç}›kÐkxH-m©á1úŠ<Ì%'-†[Õíòó-êMÚÆƦ;îË6‚×7 ¶°·5r™ ù±QÝW÷éªm•G_‚ÿYO{f‡Y‡è*¤º]̯xàŒú3ÒÍÚ´õ8ÅU›{F6ÑÑöLJ/¢Èxi^O»í¸ÒFÊ©ÅCt íŸQU•„”Çæò­gÜÌ. t§Ñ¿¢Bªöœ²Ò1þkeô6c-ã#¯J÷áûºX´Zuû[RRY¾:õçËÎI9êÕ{TÙ¦{x£†ÃÖéoSßù¿x›XöËÈÍJŒõù22>CÑí»-R5U ºAÄëÀ—A‰YÅe— QaM©d¹”ÎâSgkÅ»ô(­üò .ÑO¼ÕUÅ©©â{*Ý+(6,ø¥prnÙ%Uÿ-ŸT-S² ãC ÿË7щ¥TirSÞ¼|þ6©ÂZH¨XF•ÿ"‡î–“ô–ªÕï’+¬¿U û#„Ô¢E‹HøLQQQ>>>+•,[¶,$$s~_-1ù|~«V­¨VÀbø'N´°°h«¤M›6cÇŽÅœ€ïÞ½{÷¾fKjáÂ…Ø+ø\TKj…’¥K—¾zõ sÐ’ªÞÂó¤þxžB !€úïMwÖÍ57£R©šCqtWÿFžÛž|Ã)AHÁç{2/ ¤þ7/wŒu5Ó6d²ÛlGH|ݘ’þ˜·Nm‰Zµj±Û¾ó†Tü˜WS­>ý™L-»);É°cjjjôû†êêu¥=P]VFË~Ì«™R)„@¥‡û2͹Œ‡ñ¹Õ{¸ÏÇ^kã•÷enéŸs§O§AÅhI!¤þëÊ¡®VͶßËËkÓ¦MË:xðàŸ*?~ü¢ —.]zøðႃƒCUˆˆˆHT-///_…oõ°¨¨(___™÷v5?™—èh¥¾ýfj™Gu¼ž7uþÛ"´¤R5:£ "¯isœÓˆrÍ+„À7iI‘¼àu,#‹IvTç9©9Ý„”½Wôÿ°8„À× ©@Cµk©Ñ¶žûþ’'Qv+ µzµÕÊ0¤4p »¾Ú­·Êêx®«ÑPQšLó?éTûðü¸£A#Sg­zuúÎÿ³P~TÇÃújÏR)@HÈE*:Wy[$ú¥óÇD•¥É?’}ü.âuPðëÔ¼²7JR·CúBjܸq‘‘‘ð9®\¹Ò²eKå{ÚOž<ùܹs˜3ðƒHIIù !E?™wóæÍ›àsÌ›7ÏÖÖ¶³__ßÙ³gcÎÀ`ãÆ·oßÆá>îÀ9)Ì„BêÿIzæT¸yÞho¯Žƒ§¬Ì*Á'R5%£H’?¦1Ó¹ÿâË_]1ÔCǪgê7º¼!?<ôRÿ&'䂶•»|}w5«³ê-)€¯S…ÆZꊟ4é›5^²ý’<>²Ûh©Õ-û›'ëI;È7GoÕ55?ŠZM s^èki”B­ÏÍzý.H š6ÄW·¤#˾åoGžRÝ žíPô©¡©©x½! !U#$]>u±bŸjˆKÃ¥—ÒR_+¤$wœx'¿GDøíý®&úƒ÷½–¾ãù¨­ª¢…SìÄÐðÏ*}/¹ã„‘^j¥-)á»V&š~ãWÐ8}rrµCsãÍ·J}ñm˜:QùhI!¤jæQQjJòÃÝã 9>ïq¸à놔ò½û £w± 9 Èê½wßž,ú¯–g$µÍõÖí°RÑn‹„ªÉD‚¶f.‡é3i7ñö¡R€¢V=± Ç”y-&[UH)Ýiâ3BÊÏYwý¥÷eî‚^¶8„Bªf¶ ”߉Iшöìqk®“”BHBŠ~ž”›wý<)Ž–µSãR.ŽkÏVÝ’2ç°¹( ѸÙË|juNkjX÷t´=„ÿ\KêÅé_~šñJÔ¿]SzxOÙòM¦!)úɼNæœ?_IžÌëkTwÒ_Ï_(<ŸÊ¯:¤Ì†çî* ñüeŽˆZ³S›Ö;YRfÔeÿGH!¤j¦˜[íÛŠäo‡67¿ù)ZRß$¤IC*Íœkü,!¿zÏIù6ÒYw.¦Ìᾌóž½ÃhI!¤jòBoª—s}ŽÛð‘?¹q4:NËÄC¾AHÉV»gÛûés|ø’Çê ©Ý£Ú›ùý, A_Ê{gžwCç)ŠT„Bª¦Æ”¤º¦„=9}êô‹Øl’Ä'¾jHY鞺$áÿtÃŒÞZ†VÅÒÏt—î›r,0H‰H\Õ!eÆ0¼ôPi€ÀÀ ÈLé*ÙÖD·ÙßbâRR’Bîì71ÒÝp-‚DH!¤! *¤ŠÞ¸7rl$åäèرߔXé±’3ÀÙ¼QY¦ž?+ œáé`úøCiH•ä¾jÒÈ©ÌNŽNÏôÎgaìÀVö–æf&&¦6vvë®Ç“J‡ÿÄÂ$Ëà„B R²Ußø"=$±HBLࡇ?.>Ÿïçç·oß¾½ð9¨Trpp认[·nTNaÎÀwïkîÓO戈‡ÏqùòårOæ4iÒÙ³g1gà»—žžþ5C ‡ûp¸ç¤R€BH ¤R)„B !)„B R)„B !€BH ¤!€BHB !€BHaÎ ¤R)@H ¤R€BHü·BÊ××÷ÀûåöíÛ·£fعs玚jáÂ…>>>)€/Š ˆðððP%þþþS§Nÿ†J%„ÀW–ŸŸ¿jÕªeË–-‡Ï@H!¤R)„B !ŸRTBý ŸiÑ¢E¨?_A</>5ÓÄb1ê(#HR\R”™‘YPB½$¹é™B‚,ÎËÊΗvªt(Anzv>æÀ÷ „""¾½u]˜ŽÃÁ8I–´udYX· ’æØy. U5}ù×'6lµBéëX¦ß‘tÏz†„5aJrºèéåѯ#,5mÞŠIi“*'·P¤²%%,àåR/Âoüní:‹à¿Ð>’<»²{Å°¡CÇÏY™&’v’¶2®î^9lØ°YËvJûüc’Ÿµ1Û·ÿ°ëéb•E ÖÎ8dĘ½—¥ÝŠ¦ Y¶jÖøá£Æ~ö‘îsÅŒ7"èRÉ„+sÇí ­ªùV”ºqÑtjJ¦ü²:M‘»îmÇdvè3ôh\Îèaݹ Ó.݇“/Lþùp<ÕÃì Cbø%Ç×Í4xÄú#÷èrJBw÷™{2ÿÕ%ïŽ-M-4°¹Ç„ƒòPš8pÍól2rwce§#áÄ€E§Ä™¯§üÓ˜™YòïKdï\1kèпn;­ÜÚ€êòǨ&žCvîÝ»b’¯:Ç'­„êV²ÔÏÖÞo⮽{üÔNתC\!ýì´«cã? ‰ÊãDén¬5pöš}»6´æª÷^ûŒ$ ÜMÌ­l\æ¬ûc몟 è,½AõÛ£©þþg¹ôp‘;ZÛLy *£Hâ}®ºï„{÷íùuldžœ®Ôð1[ê,=ÿàm®àÑ­ýf:fÿ~HåÆÕ%Z-’ä] '“vÝf¬ßwdß:G-­ Ó¨ŽÂÓ4Z¯$ó“÷¬™håÔíæ]’ŒwÔÒ{’%8;Šal[(‡njíÙ+ª\HE¬4võêÔ¾ó£'VÍk—R@%uRWÝ–ƒ~Þ»w×h/ K¯Ùb  zñ|uën‰•…ÂÒŸg½ËeßZ«Õt¸¢1míæ~J’m2 UÅ ya”‡Óä£ôk~ìY·¦ÝKÈ‚æfº O†Ðý$_›Ád´/øŒ"‰øzŒY­xëbÜ0 ›”îÓ¿#ËKM»·"É«Òr6{ØŸþØkKËA7 EHQÜØ`ç6žþtd›…‡%¾˜›ËÌœ‡Š å/T&¤6°x^$m=•ä™qÙ¯ÓŠ× Ôk?GÞ~*jdf|9<õ  š[R“Z0&-ÙüòM4¯Hr(ïô¯#Mìuñë,å×Ä”ÛjÅ™ªCŠÒ·©å–ëÒæb Ÿß”Qÿv’t“OB~<‡ÍúXLöüô–I ò2"_ž<¸c\7#­Þ'„”ó\ ,/÷ûX¹UiHQ£· aö‘t\ÕBsè¹l•ß-bem뉲×B¾—š.ZÒ×sÌú‹ò>Äó›ZŽ?ÿÕ  ÑqRœ¹nî(k+ mVH&ytá ï±›+ôû/!ÕÍÍ|ûÍhºPªÅQRR" )ãúwS¤]$[÷÷TH%• ©ð-žU´¤È÷˜zM»Ž?váV¦XàÂÐøĺ”õ¯!%ýö¯,k[„$ùk»fWl@)‡”Íä²!%^اù¸ß/ËË/ó´qú5j@u*ìÒ®¢,±Ä\­Wÿwøý–#HùuÚ£;6^ùõ¿†ÔúÎM:®ý›Þdç&<2·v($ó››joºMoü³B·±™©p¢Bjï£iƒK¼¥µQ!ujá6£ÖÊßå8©WkHIÌêiéܼ³›Ï/e3Šø—JÜœÛÓ¤ÿ z.b³%ûXp2*@µshØ¢û„›ß<ƒ£[ÿî»’ä °SoÙuì­‡W騡Õ<®ˆê3½ºöŠÛQ¢ò&YÆMs}ãqK÷Þ¿qÊÛã:óÍ-Œ 8–K÷œ?³g™×ð§ï¨~'y9Ûzzñ&âÏeÃÌš¹URQ‡fi˜·¾ñ:.:àz{gÃ@÷Ä‹¤ÿgH…_ß`æäùV,mß혦­«·à±€>J)ö_Àe¹½.þ·–TjYåa¬Ñmô²û÷oŒ÷i¢a>€/ª!?#øNPÛÔ‚´¨ÍËfõíÝgÜÌewBÓHú‚íÜ{Ö/ì×»ÏÌ;bxBzãûüøo}zõ¿—E¨**%üá’é£û ¾åè5iOùnF—‚—LÙoÈØ?/=“µÎxo7-žÖ«wÿUû/e\~™ªbâ¨2JîÝ8¸OÏÑ3W|(<ºnvÏÑD$qïô™Ùx9O^ΕŽìcÈÕ¯$ ­ëWÎ%dÉb&3öÎ¥ÇÉ’6[ªÿÉ›’æ¼ÿeü#W¤gÏ„þÛêšu.–Ç ‘îòÄÅ,QÙ)É =vé¥ìµXxéü¹lé²r“B_<­wŸþ‹7’^ˆ¨îœ*sÙ4QIGéëO¹EC™d!¥þ(KyTå‹"ÈO߶•Œæù¾e^mÛ¶ÓÔ=Õ0ëpõ9@ ¶±[‹–-=ËiÙâv¯B¿ùNZj3ÿ½ÌÔSÓ›6«Pf ÷­C¿äW)vÐT32s»“Š6À÷×쪪%%o6}JCé“ˬÞoB|Ò—øÏPy¤‹ø£­IOþ€š*àЂzêjeízÿÅÇ»w"§Õ|Ü¢ª|t»uŸ¯Ü’¢ü9ÓÎgiæ?TR,Ï»ò‚C úÐ\QúKÿÐ"iw!?õMHpPPṗ4ºÏâ¬èЄ‚œ”¸à Àðw’[e|ˆ¢zˆŒK¥£îÝ«€ù>úMppp\ ¿lHÑ—Ù•ÄG…IÊ|/ùa/®¶¥êY¡!Eù –,Î¥Ô»­#Ûw˜±S’\)þzÆv.]LÚ£·>§:~8×£ÑO í¬;µkÆ6Ðî6f&ÛÖ¥k{W¶±ÞÉI茵5;£§¹£«£Õö»qe[RÄ„Ö&V¶nMÝÌ9†­g]ü*-9øo„”‹k®ÄˆãEß)•²•ÅhžºMÓ¨3}뢀M¬®GéGóFîaÞg–$¤Î÷`2¼øÒ[ íŸ×ÝÊ›~•x“—­ß>IŠMj¤îÑiGYW'©k·OU ©´ýtÚ®¢oD$J 4Ò7Q€”YH1=:}ü÷N.ömB‰üÉòý̹F:‡ýÓeÍ+š€øøÆpß&výgÒ-)Fçô'§–í4jý©‹ì|÷JBj‚Ú¬›ùÒÁ%·zmË©wæ"¤Ds›XxŸº|ÙRÊòå‹[ÍxQˆå¤êsRt$ßBW×èR~›ú|»«…»wŸùË7œ;Ä¢¯<¤üN)…Ôvzø òo¥¶Ré‰Îöš‰Ñ!E” ´4»áÏ×þ¡Ý¸q#(½Ëª )’,zwJÑüö®qúŽC¥—;gjLý[vÓòÍ5íóI!5ѾΠuÁÒK$¨¤‹tÔÔ¸•¥hI‰wy›wØøœ¤ÛnDîïKV¾`±€,¤ÛÞR´d(_ ŠÍ!…^ Ýͯò¨~¦{›\õI fØk÷ÿãI^aaJÜ«nÖÝ&|JHMj¤Å´jô 461>rQg+ŽÏo¤Ò9)ñ»}F Y‡ï½IKK¾´e²¡­—¤…SR@’áWv´hݶŒVÍ–y÷êØïÞ+e— §þíæè( ’4ws235³sö 4 ¹³à»% W­Zµ>ÓŠ+Þ½{‡úðEåææΙ3§°°0>GPPÐæÍ›Q¾tHÍŸ?óásEDD ¤R)„ ¤RßMHmÙ²ó!U…‡‡O˜0ᶒ›7ofeeaÎ ¤¾¹°°0ooïåJ–,Y„9€BH ¤!€BHB !€BHB !€„B !)„B !)„B R)„ ¤Rÿµ"¢|‡2ÁD͘¬R•~ùÂ#T-Î K·’.ŸTÛä•GU ">qU®¤ÀϪ¥¨À?RHIkBìß[}›Ù×U£Ôµvë°ùrTMØ’Qã/ÊêÑÒ¶VZú–M÷ÝýV•³Æ´¤ {©5¬­&SK½™ïà×’EEÍBÏÒ×®eØ—¯˜MÒîéþ§ú6תW‹‚aå:eÑnä|Ò XÄÔÕª%¯nºlû ÷Ë+Ov;½ÚõŸIYOúƒ ;ªx«¥££¨ª+£IaÎ #]mµ²úÜÌ¡7B¹1÷øyjÕ—t4¶tºéÕ½àÙŠ>µutcÛ‡…ócµ¤ò"ëé0–º-–n/ÿñ³¾÷INMhENuÒì´ø2õ&îêR-ÍÆaÂoÓšª9!5ˆ]{Öù»ü÷ƒUcZÌ9õMêg )Ní©7 à”#Sk™ô)–nPú™1úžNÑѡߪ³²y&*hÃduÛ¨X.Ò+)v&Æ’°:À§„THvéÆ¢8þ/Ž!3!zÉó5¨µ" ŠÃ{iŽLÍ{q‚2!e¬SÙÞïÖ!m†mTl‚¨ºúrIݶË=ˆ‰ÖL]ÿ$!ÊØ’$¿2`[&‰Ê"’I¿½R_—éâæælom̶þX,mlE¬7öž8ÍÓÐÚ¹-Ÿ,îcÍ´°upwkbÆÐí½êN5îæ¼»½›Ý¸­¢¼õcÚ÷sà›Ì·RôbŠÜ1¶®EjÕ-J a°M¢r„oÖôªm>´ˆnˆ¦¿ä²˜ñ9¢²»Ä¡nv¦cÎ`u€Ï )ªJ¾¥)ëïè,:¤VVlýKHÅæV2¢ÎŽÚ¯&*m8ˆrÅ!¤~äÊ¿Â4·É+!Ê'‹ä­¸ƒî†¿ßÑïO 5åö=CHCJ½¡ÖÚÇ’Ý©˜]^Ìn{èãâ÷×´µíª/¥B.­¶ôè­x»wZïv“6þè!Å®=íŽlÅO»êfnÐi¦äÓ›Ã=MÌúS3^øȲ~½íA’6nVØl¦¯¤üòø¸¿KCÇy%Xà³BŠªG¢¢¦Ü=T ð:sµ¹¦f¥LX¿}QuKÊœÃ6UÄÄÔö©d+’ÚÔ°î™q› „ÔR™We!Uº/$]x‹YÏ1žíÎäÆŸf3<ù"IH©qúK7qÅã-;ŽŸ»ôWj›½dùò®zúË«mjC.­±tï¡ÈÌ=S{µŸ´é©!Z†:ê ¥4кì˜$˜ÈÜþLí¾çe;©SüL»ÏØC½àEîc3]²+„TÂîÎ -c}€Ï©BGsÎ_!É’–”QŸ¯Æ+ËÊ-ª:¤Ì÷ß(ñ¾HLÕÍ4wÃz§"„å÷‘•þGHý¸!E´×zLóˆ‘ró'áþÂæÍŠ’è7h)¯+©8L‡L¡4¤¬FK;çw2dÎùóÂÍ2·nÝ ãUÛ9£„û˜.­oWj=ð—#hI͸/.w€%?òºŽ!S_WKBSSW×ØЩ7µD‹³^sÙŒèlÙå&Šc'ëÚÙØÏý«|VH’†TŠ9ÇèebAõž“êÔXoõéˆ2‡ûRŽ;[z† Ð’BKJr•÷T']÷)gé6}-óÒ–VƒÏ‘d¤­–ÞÓLYÛ*ãá\c“…¤rH‰Öyt?'ki+ç­üX]Eâ5Óä;TÃ=4Ÿýø£‡”Ò… 7·ö±ví^úžð¶öújÝ.dgä9ëŒ,¡ c=L_xtÝ„¥{5*—HÁ'‡”lçÖ _]Óžy’½¤ê ©Ã:²ÚM—n‚ÈËÓ:¨7¥è!õ‡”d;U’vÛÒ@{äòýÁaQ1‘¡{Óf8„Hî“;Ù¶¾â]br\èýV†:cèŒ( )27d£¦ù…§á©)ÿZØŸå1T¹­þÿ&^ëÅm1óxZ6/èä\m¦wò7Ú°Öà¢æGÞ`vín›c”¯ŽXè¥ßzÐ6É«¬»ÎÆš=gmòñ.>îÌòú::FmV‘ø©|BHYëí8yõ åÒ¹…£|4 l/$ÐIÁëd\oäÖ+Ê.ܬ:¤Ì˜†ûN—äÊãi-|ßÙÚÀ¥Çœ§Aobc#o[ËÔÕÙyÿ÷!¤HE¢¤Þók×ÜÁÖÚÚÖÁ£}ɲ}j7¾{K;+K[ç‹Oɶlo:vZLÊw¯žïšâêdoaiíÚap´°:7}’Æ™ ³WKwKss§Æâó¿Õo{jLHÏiïüÛÓ"åN¢ØËÎÝËýÎÙÿÌï­{’-"Qü˜žl­¬m\Ý[/Ø}¢¥½ñì3¡Xà_VÀâÈÎÚµ§µk×üâDÅHþ„ŽÍÚ—åÞc¹ÒÀYÝÛº¿üX+%ya>Ê Ñ®ýÄz«"LœØÝ“®¥nÍ=w=JQÞÛ%„)~m[¼IÃÅ>?fH)E•R:TÒ¨4Êt¬ö Q.ýîùÿ×ïÝG”_¸Âb¿æ…šZIñSó:¤.\ˆùð¹"##}||V*Y¶lYHHæ üû_k·Ïç»»»Ï€Ï4lØ0SSÓJš7o>xð`Ìøîݸqãk¶¤-Z„½‚Ïíëëû›’åË—‡†â´ %UÍ!…çIýð<)„TÕ Ž 'j6AàÃ{åž¾ Α^Ø%]f⨧¥Ñž¼ –/Vêó‚ˆW/O–^X.ùûôÐtó&¨×ÏImëÀ¶v“”…ÎI ¤RP6¤ä7á•Œl®a?Jz™R©¬$Mš[Ìûëyi9Ä54L–äËÛëÛ´ö3J÷ J}hÓ@sÔñT’ /œÿ0§¼9Ãbsž&çÓ/¡BjúÃ4¥R) CÊ‹­cjfA335ÑÓi&"é²×ãšš[(1±mÉ—~V¼…­oìØÜgÕ†ÍÓ‡x™pXC†*ZO· 3fs›øü}Ó¦qÝ›³™†^ÓI‡“„ËD6>ss3ƒ=ïòyåõ7Õ’(cä< €ú!µß‹í²áBªf%¼y+÷>± „µ–H"-.ömY±ïÞ‹ä­©üì¤K‡6Ïœ:méï{"ÒÈÒ£’¿YÉñ§÷¬Ÿ1}ÚªíG£?fÊ»Y q¥Å½‹Kç¥ÅIïbÊ1&. !PóCjñâŘŸ+66¶S§N«”¬X±‚J.Ìø|ÍGuxxxÌš5k&|ŽáÇW|TÇ!C0gà»÷•Õ±dÉì|®·oßR-©ÕJ¨–Txx8æ  %U½!…GuüpN !…@Ha> ¤RÿOôQÐSÿ¯½ûhâîÿŽ‹’02ˆ( nÑJEŒ¸ªµZE‰ò´V«?©â¨ Zª"U¬X­[T´îñ¨¸ÅI+îEq°•)#„Ü/ƒ$ TjÇûõæ ÷ÍÝywïûÜå¾7{àŸá‚iò*êfL„h¯™º×ÕêÞ^m#ÒjÇ#w²Qå#¤ºZÖî…·nf’4ÕNv-¡}»Á¿X¤êw‘žŽZm ¸™!¥ß=A”ýÌw´l?jÇž}«ƒGQ¨-Ž=•4Èz†òŽ.õüæ¾]›56hl``ëÜmÞVùšPphºª/ÛÆT*Uݱíî|"ÐÁÀŒÔÛ­‰%ïë+Tí%·¤›6Ñê נצ;êm 0匩9Õ„7©L½kþÍjjL£µ’?ûXªš¦ò,GSŠ)#³LsZzƒM7o¤š**Çñ?3W«vþyžô&Fµ&»Õ÷ÑÄÝíêAsM=_‹åZÓ©´çtø‰Båä><5ÌÛb(ÿ¥µ½ÛwKË~_r5ZýN*¦þ´ð­éœÉoéà5U¹¸äÓ–}Ķ™ÁÂ#ò1ÜÞÞ»¯±¡a33æÐi«õဒ¯LÂGÇŒÙm³TN¡‚î~C% -£‹2kmeL÷O­·±¦œH.Ðü½ä!‡kS¤®˜ãb4dÛkõpú• ¶&´Ù—”q’âBov±°ÚÒìÂ’—þ6,zR–¨ò­,ÅÎhÉáÄU>áQ¾yäÜ;Ì`Ú³öYú ©›ö–”äŠÊÁg×ölNõYrQ1”ïmi°ôA õ’° Óô©ûòÂëvÖôL•TÑ_í¦c¬ÏW|ÖíS›¸Ô…‡Èßž-hÅ¢>(ÒYII‰¼kmhFßÅqM¼üuÞ-/Gó «±ú"¤ô(+ñ`ß‘þê•rû¬ü"¤ Ý26ó*Pu|A’eƒ=&í×ìQK2e!•^¬Ú¹YH XŸFnãGצ½(Ë¥”6tøÔjj6"»2ùl~w»){+Ë+YHÙÓy[C<\ƒâÕï=Ò¥ëô 6Lý‡TRž&DÏb¸V¬çE²—ùý,-¼^Ãé½l–ÙÙ‘VH1,èxïŠÑ.‚UöÈ—ëõŸÑ>ÿIý‰(µ%‹v-½¼ºs.w…XðœÓ%Dò6•Õ=E‘çy·PmÄ„Tù_uhñ7n#gbýEHéó¬ éRZžÚÇÁ$pmbƒÔë)ÐÈÙË£™ÌI(*.•êª}t†ÔÀ ¤"ã~'Só°ÛRuHH×±úËþü*aÅ®£¬Ìº0ÙÍÈiFåé=YHÑìroØP»fK”[ÊKOºÍ…ÌkuRò}ùëvì#r•!µ¨†‡¡TRO^ëø ¾‹yÄÿRI›¶´Js5‡”òP!ÌÓšãdgʽ•­lA,|œòB*­¼ò1ɳ÷ø¥XRúN*ùÁêý½ÁÍÙÌ®ÿ‰ªrB! âlÔ7–Ö,.—kkß2ð—ͯÅRòîùÍšëjÆ%aY3çî¼¥Z—Sܸ ®¶½s•cîZУC¯éòWùì(&'ŸI—je!e›P"íåÄ9|Kþ΂ÄÌŽý%yWê6¤dŸ]!ìdo³6Q(ùým¨ZͱŽ¹Zs%ÕœËуëpI^”ev´lºû±¤†MûŸBJNœûˆÁâ´@•ñZIwzùhsSÖ®g®J!¤ô\K•çú´mM1u8xã©DZw=#¤ Æ'B,*Í}™~*6ʳ•ÁåE]Ñœ°ÓQIµ1ò¿‘®”ö|uÀ Ë6ƒTÏ€Lica›˜‘NRR^¡Ø—fzRšÍPuÿïÙ;yý9‚P‡qeF70y5ûÃú÷ž~®,çr݇T©Ksî–¤ y%eÕdöñ4ÒT§—ÕR<†å¥‡¤ÒÓË$òSš­ší¼_^¥4"ÿû6!uy™7˲›es7§¼2¡”'a2Nwws0²êpZqª…ÒãÎ@¶!ø¹°:Oü½@¢u:! (iÿ†×Ÿ‘Om èjâ4­¼†"]“RŒ”ÚÙˆ¾9SRº®Iɷ̌δ QÍè4½ó4rHEÇt¾,ìFp,æÂWuRRyFe6çZ_K+Ñï5©þíè¡»îiîËØæÂëv[ôV•”lÂòï²´àȪhÏõœ/Výï¤ b›‡l>Y"i¨Ó0ðц”luʸ¼ÕÒ©‡ÎãX„4”‹]hý—V®ŠŠµ1k“O3Ç@ñÛ…”B^šéÒÇ5…”Lø$ÎÃI[kÚ:«&滟’BŠ µ£oÜIkÿµìu]†TåVw|ÍîË"ù_Ÿ!µí{/ÖçßW(ïS|ÔþÉž¦]f¨ßPSH)ž=ª¹gÀÅð 7;êÌXù¶)ɽÇ5çlù« êÛ!¥'g×O ˜SÈwUt½•4ðÑ“è†+ÃhÔ¼u‰·î=~tÿÂñXK‹yÇžµ©Â¡VM¿ù_‰b‡™ÒÖÚì§u{÷ì<þ€ ^ö¶j4{_6y¯:¢“…`ÑAB¤ ©}S°­­FÌú£ŽBªÃbÅVÅ´ý±c–Ÿ—©EëC©Ê¤Èç3 Ç.'OõžØà 5‡e£5ÊÞ3O³÷b@++×?œK¸ùðÁÝÛ1©Ôµñ)oyºoïü¡Öm‰ˆÊ¯ñ=Øð±‰Ë¥âñ™•‡¶4Öï9ñ'Ö`„”Þ6oxGHA홲ùs4¿{[çÖ­[wêÖ+(æù]øê~?>ÿe©&¤VwŸº?›ÜÈö€>ƒGLRH#ù}úió+úkUÇÏYÚg¨„ö™°„ 2õìG¨HÌô]=ÝÝw&Ëÿ*ÊOâ{ ÌéoNËá{WN“·÷˜)!é„ú¤Ùë)üÏ«LögÃCI#çïÛãzš&VÄE÷ò«ŒáÝoj\å¸â´©Ã=Û·unåèÔµG¯u—³òé¿ò¬!}{Þ})Ö1•çûuîu®œæ!||ç®}|r±·öÇ}ü;Và÷?¤æ΋åðî!µ`Á„|2Çfõ÷ÐC//¯ˆˆˆp¨Ù³g;::òI¼½½±dà£wõêÕú¬¤²³³³ 6âãã{öì9‹D–P'OžÄ’€^QQ®I}p§ûpM à“)é? #¤ênóg­^¥²i×Ñ"Íf(Œ]ùß(m[Î&9÷—GDVù}dDdB!)ËXµ²Ê_¢Ž<+S_ïÈKþsãš_£V®Ü~àt…âcÊ3’–‡WmmEøŠÄý_q‘ÿ”äÛ½uedäêuÛ’žåk~O¬ÿei’V'Àâب% éÒ;G¢£ÞðÛæݲ1w¬&Mú¯{O%ªæ4oí/Kïj•&¢˜È°›Ùă«Þlmíöƒ©÷YÞƒ>ìš6mÌpêùGÂsTRõR¥7ØÖÃ|ÇÉ Æöuw6³ì|¿PÙF~¶i÷/ã4?n=C¤]1ÚO18ŠÇa !=v´àp–¢[$ó+_Ò~‚è;•oómbÎôÕhÁØQnv¦­‡=/&DÉg”­ üFÚr˜_|-=f” î¥þ†3¯ïd›µ÷àŒûjˆ7ËÌØwÉ>U¬}í­Ì=çSts‹úØBJZQ¼#fóÂ)ƒÛö¾˜ŽçI4\%U^Ü’ÇÞÿ•¢’2»[ëJ*UGÏF%œf¯imÚ’Üs'Îä”×KH¯‡ZQÇ˯2#%<.31½ä_‡T«‘Á;c·oÛ¶-&fÛ± ·TUU5!u !õ…””ôd^å«ù£;|9csƒL B Rò3`Ù§mŒäü ý^“òíé0>ü(yÛÇO70pý»~*)‚8Кë>W¢ÙíȾ¼0ŸeÕVÑâ‹NÆÍÖ<#_±*îÃl´"¡¬æR_“Ò–âfl“Fn­°£ñ†›"„ÔWIÅE ³ï2M½âDMâûD#¤ê3¤î©îè)Ê~<Ιâ2:F±9ÊC*4©ÚcËêBêi©ŽâëEìtcJ»Ó/Ô…‰ðw'·ï5G¤uRòï¿Jâ1aGnjBèy‚ ÅbÄÆÊœœìN:ï°ú¯Ùñ‹ÍŒ['–iŠ¿Ú„!èHzB=˜~*ÈÌÄåŽHs)!õal ‘sc7ãô׫"¡PXVp§;ÛháÁ4„@½…T KõÐEs+&§]wU¹‘ÏçR¬hædÍýÉ•”3äê£:d­‘G ˜™÷Ù¦Ü3ÿ>mÓ’æ>ÄÎì©-è66j"O"záÀ0¯³JJññkN<6ËÙcúì9‚]©–¬®££*ÏäH‰¼„Íl“éÒ÷Ç  AÿöV,Î1 ä&ŽŽïÀõÓ ©h¯® Né:GD¼:¿ŠÍ´æºòçéçjͱ Ù‹ü–#ì¾EH})E‰›&3Ù.—ËfXN^wh g–!¤àS )©´B‹¤ò©ìŠ:HÈ#ˆÉ]g¿ÑšªMÕã#Ë Òb~‹ »ñBùIRíqë®#ne˲Ÿ·Ïï_¶dqô–Cùbòõ5e¢Ä¸a¡¡k·-UH¥ZƒK%²Y‘›”TÎœ®”’·V–ptGØâÐu;—”K´[SÌ­Vk©÷w‘ý—•–Š*ˆ†{‚ŽJ«ìÉb‡£{zÞ˜"é»~–>[ûÈB*88Ë¡¶ž> stream xÚÕXKsÛ6¾ëWp܃© Hðå[Ò6÷”ÚÎädÆ Il)RåÃß],(Q#[¶3ÓŽÇ`µØý€}‚ÜZXÜú8z=:ûàúVÄ"ßñ­ë¹å>ó¤g2d2r­ëÔúj_µU–ÄM<ž:Ah®UE³m–ªñTp{B„K•«¸V´p™ÃÄøûõ£ß¯GÿŒhä–°„KðÀJV£¯ß¹•ý‹37 ­;͵²¤˜[W£?G|mÔC‹²gÜ ("ô=»Š‹‚ð¥ý{œO]ýVV4Ö¤\­bb­Õ:®âF¥ôKžÕ Í´Œ‰@l'}8‡Žã%Z C8:t´hEûV™ ƾU[ôAtÖ5u´oÕÇ&Ðgd~îøÔý:Ï’¬QÛ¸òã"5Êâôš´Žë¶1‚Šv5Ãì‰ó™‘‡)P˜[%]Sh=³’~¸« ³îùÍáy{€«Õ~.1î–—w?ˆ®!3é"ýÈ´bê2-ÖòÝîn¨kXÓ:_ …Æý!O:Á°cÞª*Í’WåÁg_Ü0R<æÓ8+õ—z;˜áñ0ÁÜO£,Û<ú'„y©Ï„|®é+ìÁ^Ó.aø’Fa¯aAŠö ˦î3TΠ§Å¾>Ã>ñrè#}h•ÌãßÔø2¸Åž,Ö¯x\S¿€ÏªcH뵘°š#i^ê¿]]|º¢&ÝÚtnÇâEË:V¦«Á[¡;2=Õ»}¦/¿l ½C·’ïÚ¦ü°>?¢™3ñÊfRx‹Âà ñ !|M+ÙÓ²ÓJj¹oÓHŠ ‚6ä~sHq5íj’2ÅL¿^vÛIZãçu¯Ö¹ÚÙ:‡ˆ¹ª'=ttIDý•e ü¡×ñ=…Ç4ˆk¯î½†KG¿9yJ:5LM²žÐ¾ %=> stream xÚÍËrã6òî¯à‘ª’€œ=M²™ÙÍ%Ù±¶rHr€)Hâ†"¸óõÛ$RV;NU¶\eF¿_Kx*"–¤"ƒÿ™àѸƒÍ5ðÓÇ;ÁEôñîËõÝ2ÕI-k½Ê4*ó*Éë,Zo¢âûãØ6ÒÊÅ*-«øßF´ûxl7j±â,^à“ê”4ŠY’&|ñÓú›»¯×wÿ½ãÀŒEœˆçIÉʨ9Üýð‹6ÿ媫èä°Q.*X»èþî_wìÅ*ÝV…³„e%©òÏïîIºƒÑQ¸`xXO²h•æ@· wŸŽ½{±J ¿?ZýaxçŸã äþ@ˆ™¶¢JÏ"QŠ¤`âYK0JYœµžÑ¨x‰ dÕs4X” AíIðÿ@6Ú€lO!6uÂ8Ÿ²Ax^fI]Vð¨¢íMÊÁŒ×«s‰H£ ž‹Ü»Dˆ2)ªœL{½Ü©ƒêíªŽ+£ìb%‹W´ÚÐn«GÚ\^ÐùGV0õY†NÍžn;}Jy4Ë lTÍcÓ^ºEwC˜ÔEM2Bû‹z©<€­²÷×Õø;S¯ˆúFYÕ¼X[cG%¶–ôn©v8ZTºÓ»]Ûï~K‹_Ô¸i_ÎÈ£_©1*3è~óŨþÌ]Ìßòþ³YPäY«ê„ðÓL2õ™4/tõ¼:ž&Œ•7²üûEÅb=þ¼€ú¡òªtgiRåüMé^”URÔüy[A‰ß¿%Ý'l¦éî ÿ9é^Ô@”×ÿ¿éþº„ô龜&&¦ú³ù¹œçÑržroʪ×GÊ“€EYþ‘¬z}wæ,_¤!8`ȲЩ9ÿ]mG‰y·{I‹ôøÛ¦‘¦Õ½ìºG “Vq¯ì ©`;À Jgk ‡AIœfÒ:–; 2µI«Œ¥ñ·=]}POz­¥U7Íqô°ƒ=¾ÞZå‰Ø½ì=0¬v!éxeñ‡3ós|:+‘j3¹3žÅjÁ‹øsk,õ–V~¼xÄS ¯F‹ô󺎿T['b]Æ9<µž¤|è½³ÚßôfÀ’ï ¬ñïn±7Lù>‘O¢9¤Uà Qàt˜Â@â7Ð÷r‘B2 ìd¸a‡Wšf î!ýŽ÷P_ïQ“´(âSÛu„ð7º÷»‡GZ%->@RºÊ‚GÔ×`¡¿á±&Á‘òF… Y©2[yÞïÁÏãŒð%˜è|Q™Î ë ýfzQ"Y=•ay…@PÚÕo m]ØMñ x£àvÏj.#sq@ˆÆCÈ>ìlŸä¬D™Ô!‰×ÖÈ¢‚0  „Ô~T¦ Ijèpjí¾í ‡{-Dò籎§5ÈÒvn<] @ÜØö  Üb3pƒ Ü<¯ƒ¦®ûÉG  ¸¾H t^IK0ð-9ää缜ØlIWàž j0Üø  :< J‚Gv¥€€·ñ7ž]À-ç^‚íps.f5Úù¹h‚`¨wР=uMÎU¢:þ‡F³œÔÅ8ã"Ç/¼Æ°ÞÕ9weWIË iÚ®µNYvV€Ç”‹¸ÙÒêeásÝ9d­ò»^û·^EHE'm¯ÝæyŽ¡Ûs6u;rÐ#m‚{ ;ÀÕuÙÚ3àŒz‘|bú©1|ÿÁ†ï âRbøhˆXÜîÆw†+®,œáð"Ú ®WÀIúÂÛÓ¾mö´~CqkM#G—æeply©@®ÃTe¨psîU¥¯‡HDmŽr¾ásÁBiZµ1É+ÆâœÕ0°¼i*ÎDž¤Eö;_@$-ß2OØÌ>‚‰ðŸ3ç æ£Ë'!?48L¦¥˜¨çrøŽæFQYqk’ uÒã=*s Ë—Í@Œ½mþ|½OžD’`EþWÌŸY %Œ¾Î0:ÕãDc(µØÜ»IŸö0Çm:Lìédúr!®~ŸÂ¶¸8fÎÿ^Y¬GæCð÷X«CS…Ñ+” ÷sô±ºº¥þ,D(ôna(­ì]K€a:º+wè¤Ç“xhwtÆÓSè銪‘(|yõ&õ ® Îò &} ×·¿º’8›ó} SÔHS½ º"½'¬ËH£[¥Êº]p`÷!KWªÓ$·E-? Ϧfò΃>úštn æ ¶×4%Qœ››…ÈeÁ_n†=?ã8†Ý ˆ«P¨Ë|žNÓYöëð3v¼šÈ¡Ó,#¯Þ. Šÿº}ó7ë> stream xÚSMSÜ0 ½çWøÏ°Âßvzì”2¥'J8Q™]³dH6KœtáßW±“–éL/‘¬Hï=É2#[ÂÈeöµÌοKC (Œ0¤| ÒÐJ«¨B’rCîò›±¯×ÕPÑ•°.¿ ¾OÞåXo<]q–Ÿ¥À/ßø*øt €Óûò*»(³çŒ###œXà ,³dÝfw÷Œl0~EÈ‘CÌj‰2mCn²ëŒÍjŸ3á$è˜!G±”u Ÿ°Î´œIò­ÃšØ™áï:›r À±©‹—ªÝ7“VÍrÎ’-©Öù8…º•Ð ©.‘r!i{$UïHeñ‘”3 "éO*tîý¾ÞmáÐWë§ävÉVM3ÿ{ôaÖ÷›1ÙMµ‡p–"cð!y­o»þ•]I¼Œòq®Âø?ë‡ÏI3Pôë!ÙC½¨Ywa€i,8ˆ·PÈy;JêP|Jz¢Èý-%»¡ïæúŽrÿ™>q}NøÆPmý›´ERµ88q,¯ÈýPw»ð%^Ö²%§Ë¦óß»öùEL{ƒ‹ÌEêÖÇ1!Ž¯^©D¥m‡£4é$Æt.쩺¿)¿Õ{ endstream endobj 1507 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 322 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 13293 /Filter /FlateDecode >> stream xÚíÝ|åðeS mšÕ½÷ l¨¥€€²—AÄÁá`*".D‘U¡È”%£@'tPº݃î‘4Éï—KÓ´Mh¶<ßÏY“Ëåî.ÏýÞ7—;"€Ç§P(¸¿êO핵Ü}ôWêo_ZZZ```jjjiiiOq}?Ȳ’›~—¯]»æwýF ÿ æÆÕ+—ãrJ˜G$E¹a!Ì#Á¡‘¥Ìy…$2ìö ¿k,?¿Ð»ñEµü)/Èò¿yÓ›€™Õµ›…Å!!·K%r¬D€&ùäêèèðx=x`ï[/{: ˜œQ —dö³6œùݱ?:°w[GãÉïo®Ð˜Ù½óÛybË_÷ÿyHéÀ¡£åÙA&vÑéÚjõ»UÿO¡¾‰•ÏC›¥¢¢BÖ˜ÈåòÄÄDZììì6lØpæÌ™¨¨¨¢¢¢Çˆ…Æbü~·›úkå=É»ÃÝ&.Ù¥žrá0ûÕ‡ý©8ËÛÆpK”jäýk;Ŷî‰92õd)—vZ¹öΔj¼Fy„£{LF…ò¥*RãcãK•ÏȈ)“²ãóÓSr™ҲظÅã4ך‰D2fÌggg×F†yK:uÓÕÕ544ܼys}þíQW÷ÛMÝ®¬*¥©á"³…ªƒýèg%&¥çÉŠ²¼m Š¬¬F"Žˆ,ÝbÓË4ÓÆÚ½o>iI’}øÚ0k[[{[Û^Ã&å+è—·]NÜJ"*}wPn>o2q™tû¬õ误w i ÑijLLL-Z”‘‘A=ÉõI¶›(ô¢ù‹ïª4êy2-)Ág§¢C‚ƒ‚ü¯ÍÞ­çËs åUÍ&mãQã&Œ?~¸1³–金H&mb3Q~˜÷‡kP­™ì¹æ@PØÉ ¯n¹@ù±úº:tï•M—wÍY~Äí(x„……µlÙ²C‡‹/^Ûh¬Y³æ§Ÿ~jÑ¢Eœñòò:yòd^^ÞcöØÔ6aWDýgh¤ UHKR³r+ ³†t³0aú›Ó¦N2õ“¯~Í*­– LÚX8ºŸ cr;$88<&•$w˜´‰Ë¡3Ûæ­>u›«Zbý}_úà‡Âä@“nïç§ø ¾yÃÄ>ÿÜ+X3ØôÚÝT6ðü¤ Ó*áJ…FÅÖÖ– ™.]ºøøø$&&6HÈhiI)Òœ(KS¸¬jþ7öÍí÷æZ’äyÛlO¨Ùó£¨Þo“^^³%ŤͩŸÞY{:”›_\àßÿŽÊ²zÛÛ¬ýiÓ‚£wïzwÓöo=¬º§Ü—(ØÆÜó²É¥¥¥EDDDGG'$$$''gee–––VTThíTÄÍ/m˜õÞØÞÛàÁƒ™7vðàAf³¬‘3 ²jÔ6ÌÜäßzÑñåw%•Ÿ‰ÖüŸÏ„RQÖ[Þ–»uΤ®´aZRWöYõÍÛ4¥ÏŠ]—ˆd½äÅ·îëw'3ãŽ_¾×ÐÙåÏÙ'jþüṳ̀}ûö;wÖ×׉Dööö}úô™8qâôéÓÿúë/|0‘6O¿O©a‹™âŽ Xx€k7)_àþ¬—^0±ïöÊ+ã-Äf¯Íÿ²DAÒ¢œÿ pß[çLÒ¯~aè˜,‰Æ(I´÷ a‰Ùò’û &òì7òѺ½89-Í•¼#ZõT(—%}Áö½ßRž·MnéÒ¥FJLÔèéé1›ŸÖÞ9ccã 6œ={666V.—£ÚAÚ<9Oa‹’Ë*JË¥ší#RTd§§ÄÅÆeääU6ªe%%RùƒfRRZZíÍ*äÌ97J&I¿—Ÿ”Rªž…BZ\R¦lŒ±sfTÐsÕI\\\œ™™É´§˜M.>>žÙÏ;Çd‹———®®nþ:&‘\\\öïßÿÔ6 xk›§žoš±}f{–ÜÜ\&|V¯^ݯ_?¦þQÇN×®]wìØ‘““ƒUƒ´x쨩ñË8µ{÷î1É3~üxuæØØØ0u§iíG¸áááHh´Ô=6ÌáÇ·mÛ–Ëœ””,œ&T¯rþý÷_¦™Œ´Æ¿gdDGGsi3bÄ,ŸF^©2²³³oÞ¼9þ|SSSuujnnŽ4ò͘ۆ>Ìl±Ý»wÇ2iäûˆÏ>ûL èêêÖø¶ñÊ•+2™ ¿]»v!myÔܸqC$qÙÒ¦M77·O?ýôäÉ“qqqùùùT¿ m3Ü­[·ªë™÷ß?66¶®2i6AAAÜášÆÆÆ\W°\.G¶ÒtéB-[ÖLõÀT;[¶°;—gQç m6TZJ즨«‹¡9 ZsÆÀ€­m )=òò6ð´ÓFÝy(‘PP;7±!$„¸ÛÌûçîjìCµÇTz©ï©fRc±Oid íÊ26®5LÁ³n=ëƒÒ‘6¨mšðµeãÂèôI:q‚®Q™rÌ…¿Ø»'OÒÙ3ì¿ÿ¦  ö§Ó§Ø»ìp’B"I¦ü'g'ÑéÓ•ãOÐñ㔞¯š³´Œ._ ›aU¯•èO'þ©öêìÜ̘ۙêÅÒRU©šš’·7:Õ¨6i¤Ís6MÔ±Ed ¤ƒ§èò9ò´¤!“ˆYNþéÊUÚýö àºr™¢ÉÇŽ&|F×ýèê5:±ƒý$^P^AóÄw¤gLo²õ3\¾LÙ…\þRlµÒ!¡;T^x÷«¾ìÿ-©Êçʲ¡´‘-¦•$ÒÊ•NÊS4ž ÒiÓ4•Vá²( Œ)>Kõ`¨™¿T5í‹öôþþÊ)‰®¤·±7No&cgUQT£Ò;ø)½uz¶¥Ë±ª§}=„ÜõhêúÊâ犪‘ÒØÒF,Õ/²…´¤Íc} Øž&ò‘×ë”Q ™žBÚÓf°=-=Qu÷ãa´á¼*mÌÝ´Zí[ÓítZ9ž&|«¿~0]ÚONÄ]¢sÝd²ŸL]Ú7º´©5l“FÚ mš^à”G‘«9uìH"SZñ#Å¥²#ÚÒf¸µÓ'vàw&{o*W¨Ò†)NÄ&l·ª± ­)Ly­œ¤mÔÉ‚òez”:Yªf²Î‡®'Ñ[ M'…„\„t>ƒ:é6Ò´iÄ›4Ò¦I§M Á<—¦Õø§%ÇÓÕsôñÒSL†öÚfˆ#MÝDáJ‘·©‚bTi÷¢àHv<3Ü£’rvæo¿HF´d9-|—£s™ª´¹p‡v~D+NRîrK’ljߪ٧MnNH›æQÛ(ä9ÙY™JÙ9¹2y³>ËóËK!Ïn”¯‘Å&çÏŸïÒ¥ 8L©ãáá±dÉ’›7obm4ê´Q~O@Ò¼>=D"¡ß1ª²ÿÙܱ³HÈ0ù})·µ oà1ÓFÕuõÅtO¾@dlîŸ×P¯<þ|ssó6mÚèh˜2e “ELƒ+)))++«°°P*•jM-BO9m¸$ÉI¾ãao"ðœÆ~­]ò²a³'réŸ[Ž 6o+ÓÆÚãνúö‰kE~~~XXغuëtªkÕª•H$²¶¶îÙ³ç Aƒ|||† 2bĈѣGOœ8‘ÐÃÜÐvîÜÉ¥M…ú€|m…éíS_‰ÙoÄ[nª~Ñsõ‡Ñ††|C“m×b°Z !ZRm…"]¯q9²†é«q$*#44táÂ…®®®LÔèü— p ·×®]Ë-Ûº'cÿ.òì`$™»¼”/U~AI©Ñ~f<¦Úqù%¡ë"mêî%._2a€_¨×¶ã† É ¸y«³‚©p6oÞìååeaaÁ4¬Z¶lY;^˜}.óP»ví:tè ««ëëë‹U×€+‚i= 8YÎ|>_{Œs#¢ö¶n§/½øæ§òÊži~úàžNL!ÚU`^ 11€ö´á;{ŒÜwèð~ ¾{v­_ñ~O'[öp±éŒ U¶ƒ¦ª)**:~ü¸‹‹KTa6xwww¦é´~ýú“'OFDD$%%J$™’f‹ +°AjËyóæ1KžYþ.\¨³Â%Ú¶ä5}¾×Ewí±tÕxö‘ŠÏ'ÖŠŒºt~ß7„7ðà´QÝÇ«qlOutŸ€Ï>sæ¾°ž{R&1V¬Xajjª™33fÌ`*–[·n¥§§?ü‡ê™6ÉÉÉL°s«`øðáåʳ;ÖX¼ªÕ&¹?¡#Ó no0(¿Æfà¿F·uWc±‘‹÷ìRÕ#XAPWm#211wrvvªÅÎÆŠgÄ72èlè::"54Ž¬|ÿ³8n œ6Ú¿“RTþìÛÏw…H `V+7úÖ£-EGŽa¶Ì¶mÛþý÷ߤüÙÖÀÓqñâE®g¦Æ‘üñ‡æoÖ´6Êšt€½@Ù¬6êÔQ›NzB!Óç;¼²m]xŒ´©l²“"/¶§“)ŸoôÑ'kêójÜAݺuCsé)KLLtttäóùúúúšÃ$»wïþÏÉfìâuê,õôyýj@ÐÍZüÿ=ÑÝÁB,鶶 ”¢ß#mÔ£çOìíÂð?\´²>¯†óÛ>>êDGGל^Ù”–åFyØ›ŠE]ñH™ê¬#µ6¢â»¿´×‰Ä®½}2ËT?«x„´Qny™aÿÚ3 )£%«6jl_H›¦š<š¿‰‰‰áŽt200ÈÈȨљÆL}i‡XÈð“>Ý«jY×Ú')Ç” q²'D²vòIÇQÅPWÚôöžW÷Æ?ÊÝB ñ‚ÍݨO‘üßiSs/üTwý߸«zJ³ˆììì®]»rçÑøשÎæ´åýáLÔDf¯Ç×õ/V]:iÑh_Àã‰Wô{„Õ§y¶¨§¼îᤠßÑíåŸýõ—ê¶þòó§¾Ó¹CGØXÈ7têÿjf!wÆ놮mÔ„•ܼø÷ßûýæŸÏÝŒ?Ñî9—EŸØþçÍGz^ÀQßBIó©vÞ}÷]õï¤TË\U±Ü÷Ò׉-{Äå)QÔ9—{!'-ù†L!ÔÖiþÃ&F3SÉd´{7eeá£Ù<Ó¦M[f[‹„FÚ0û4±H¤ßEϺ÷k)%²zîÐëJUï¬tÑ$oçþcþù×ïÂñÝݬøS¾ºðŸUGíﶪÝ~À~RA1·ÿø|'Û¥Y²cù'µÏPcvUço+¿äÕ÷ 5Ÿ¾‰-[¶pi£qŠöŸ–ñûœ."[³!Ó·<`Õ«Ö`IêèÜíÌy]wF=t°/“AçÏÓÈ‘Ô¶-{•“´4|4›cÚ„÷06q«‹««G·n}ŽøÁ÷´¢²§>Ÿ®Ô6Ìl™÷›®'9imé—Ë8¹i þþ1÷¸‰¥eE¡ ¹Ò¢ÌÀÿ»ñiL¹%-/Ï©(ÉfÆDÆ¥ÊU) ‹ õ÷JË-©üD”E…ûÝÎ+“Qiþ¡ß¾|såqñ©²¢{w²”O’'D…ù¥æ–rˆ¢œ¸¬Â²ôØpÿÀô<Õ)ï/®™þÞ™²æôÅ‹öóÛ(¥ù÷3³²²23 J+TgVÆza^n+³°¸âAËG=«_¥aÈÏW]y–ÊÊðÑlZõñ×±ì4²â¢¢âº•I¤ ¾Ik«mØ·úû;ÝÖºA•—“!…4!.®\J÷BÚ:÷»pÁ‹=mÞX¹›)°ÒcœGMŸýÊèO–¾ïlnwèFbnRˆóè7çLñÉÒÜ,m÷^g‚eõÔžÃ&/˜ó¶³½û¹¨ª(Z0¦O¿qo¿;}‚[Ÿ‘éIñKç¾2`ü”#'ý‹Ï¼e6‚ý-Øoÿ¯ßÐ1óç¼mjå|00•m1ùNöéëó¿w?\0c´½ÛË)̇H2õÊUŸ1E³M…¢v%«xø6Ñ0Í¥›7iìØj £9ôéC`hóq®ëœHÝ™ø$Ó†óq_‹½×¢Ôñ£~ÉE½ ÏE+ò²{®æ! … !f<ñ-å£Á»¦ÍÙx¶(#ÂÜï¯ü ÜÚ7ëÍÕ§òãý̇.åæù÷*ï××æÞ=k?q7æÛ¹vúÇÅîžÿ={)ùâ33lÇmT$^4±pI-f'Hß7ˤßl¦­¸g’ç»?pÏZ0ÎñæÜòœØ…w5³ŽÌ§zeÞøø:sCS²³í&]WÚ|5È|ÛÙpͤ ¸x¾BrÛCà˜”]Ì}´?òq=“ï/轌ÛÕþ1wþ7ÿ¥Ýô\Ä úëƒë/Æ_ÿA$0q°³³µµ³6·îófØÑ…_ì¿Ì¥DEyi™”îÜømÞ¦C\ÚØÿ&òÌz—ž\o û‘èiæ|OB7÷LY¶õ¢*§öô¿“¼o×ÙàfV ?½´áVäíÛ4m99Q»vZ¶ÞÉ“iÆ zûm M`xå•ÆÙò}ðwR;ßõñ¶ª‘åÑb}ýÈ´ž|넬Bn#ÙÇù¯¸¬8aÿO¹©ÏQ¦Í-AŸO¸1AGÎXw!öêO³v¨gVXBAç-úMÕí|?énlfi$›6‡Õisá['WKTiâbê™VA7÷NY¾í÷¬¦ô JüþÑØÛIÅ E³:zí©Ö6ê¢ÙJcbè矩K—ji“™‰¾¦×uÓtjæÃ[–—ÐÓJ4{ãIåû®Øø¶—mŸéLhnžbûÉ!öÚ¦ùGŒÅvÑ9²Œ¸‘×gÜÏ] ¬m„}—U¦Í3Öž.N5»+»uw~<êMÿäÇ_ÙÎWN3cãÞñw¯ï˜ûÝ_Ê´™i;~#G˜‹Ä×bî3cvÌôé6yóN”ióoemÓ;*!fìHõY\6 ·•††Ò½}#ýNJ¡ÐÒúð·oRÙÂæÃ?Û–ZYÚ è߫Ϩwî—VɬaaëÑ¿‡ó˜¹_–Ê)-úß^ÝÝ—­ßWä·bäì­ÌSîžþÑÃÝÃÛ«ë‹Ó’•—@=úѦʳ(|ùñÄ˧v.Ù{û?{L‘6¹[¬¨ *.nŒËHy¨Ý ßëXϨjÊ¢‹$°%‰2mí(¬ÖœÏl!azmG#†Žƒ*m̼Ø.|ºÉ’”%¥H›H›jí Ú?è®õ‹lEÍ^`å-iÁ®¿f–ÖIÕÊb@Ú<¢}Ÿ“ãt’T\Æ~S¿Ô›<߬ڔÌk¤ÍÀª'–Ü$ž-•piÓžn(¨¤ˆŠ”C±rcÞŽ.Vöæ(òÉ¢ íȤ´ïUisø=z¡9*ãkÅkH›I¹\qëêµëaÑI2å9*riLÄ­k~×ï&¤É•QZäãÆ ÿ4öçØì—G)±wü®] ‹’Êd$+¿^¬ìc“KŠÃC®]¿™¦¬uÅ!·Â²So\÷ ‹.—)pˆÒæÑúm¤…ôŽ7µç±2&<²L©…U´Ð¡KwT·/P '§²Í®ËQTœAúm¨ƒéw¥®ÊÁ¢]ßÌö¥æ«Žça^il72íK±ë©³5ûýxr ûôï”eÕûCiûÕ{dxÄ´aÝ¥o ›òÁÁ}¿ö²±_æËþX`ç‚qãf-:°gkO+û·Ÿ!i樾.˾ÚòÓןÙ8ôgv$»Út³ûÀïÿ¯÷;;¯’$ÙÁÖ:€½Ø¦tÞà^o.úÂwë7VξA©$ ê¢×eÔ»Ÿ?²oˆ­ÕÌoOau m§ë¦<ƒN§på—Ý ¹ê¸_™¼jCÖ(·+‡‡®©|¸rÍŸçÃ㤠·ì>ìiºëb “å%—¶¯Ùu2ýÍl\¢R óò‹(é7cSŸŒèó–V®‘9åÌrÿqõ²›™´ví¤~Ó„ÊøbÇ%ªHqwu΢ì¾7v”¯,rÒÎ6éû!SÝ ­ï¤²Gú)®Í1¼«ióˆÅMyõ3rT;œ«Îs7kŠº$Ó ®ª8BàÔ·¶a–]üõ?]¬­\ݺ~ç‹"¢¤k¿væq× vqu2qèžXTñÃ{#,,ízôðËöú°Eñ—»›‰œÜÜ_õVfI•$3i’E§7Ïë5x©êcSrËݺG‰$ÌÜÆ#!“=¹gÙ,‡¬Ãê@Ú@3¶gÏžº¿“ªHŒK ’Eݾùͼ¶ÞsRotr©Ž£Ä„tIqfrF¤8ûßûxíW¾{/!žùl$GÝÚ¶á#=‡iDÙÊ´¹ºãw¯iåÜ3ÓÛZ½(“qiÖ;¥7"m6лU_6=š»VšÖ–ÔëFߺ,•JBö/0óœB”?ÐÆðûÃ~åe…¿Î}¡Û„U¹á‡D&¡)ùeyICVî ]èe=ùË?J%Òˆ+:[M"Êñps Ê *´20øóêÝÒ‚ô…ƒ¬Fz”·-l»U¦Í–C‘6Hh†QÃvž¤§{yyqçÙþù矵N˜û—§‹«««“‹×µö܃E)ƒz»»º8»Íý´rÛGãœ]\\Ç/ÙÍÜ•gøx:2Ïñèé}9*ƒÊÒÆ¡<‘XÚí?útcžêä󖲋¦"bðÐq)9lÚ”ÝZ?òí­X;HheŒæ¡¼aaaãÆ344ä¢fÕªUZôU=·BRPPXí÷˜2iAa‘ê¾ò+²⢢’2)ä…™æ…gTÈ$e…E%TíØbÅc\= iÐHê–·e2Yjjjpp0³›ššª/6ÍÜþúë¯ëü˜ktËWÿÅ“¢jtõ—RT›¸ÆÛ¨ºþšÑ‚´¦/µåççïܹÓÇÇÇÍÍ©dÔW—ftèÐáôéÓ÷ïß'üviðpÎœ9³dÉ’ùóçÏš5kÚ´iL©wïÞ:µ´oßÞÑÑqÞ¼y/^DË¥ñÛ¾};·â˜ÒKƒ9sæèÔM$õïߟɢsçÎÅÄÄhn·ˆšFîÀÜJdZÁXeÐ|þùç®®®Ý•<==GŒ±zõêS§N¥§§k\ÑÛj“Ä¥ÍÌ™3±ú ©P'…-¶ ­2æï¦M›¸ÀÙ·oŸº÷«ï0:`Ÿû´/ÔweÁö¶1÷)òß­®³ˆ‹  ¿zr«±pé f‚‚¤;K«S¡ñaa¡¡Á×Çõ°5÷ë õÓKs‡:->Á<ʺŸMÉ¿9½”WZ«åEê&¡B³§Ñhx~ÅÅÅùûû<;¶¶¶:µ´mÛvçα±±qYáè€ýo®ÒLGK;6m.mu_ô»úcsÏJ¹ReÚXY‡«£xß<¾ç„ürW¸°ic¯ÿUDõ×Hú…ïü2“6òŠòèð«×üÂîÆITrïÎíèf6å%ù×CÊ•Ó&Ü *(.GÔÀsN"‘0ŸkƪuëÖFFF&L(//o ´9P5]Þy¡™KLz—6w%ªÑ§WN³òþ_‘TÕJbÒfˆM矲µ¤M‘Œö®šÚkâ‚ÎÚßãíe[¥akù6ãKˆÂÏ®dÞÿædfRé Ã[i%(mà9Ç|Š¹Ïµµµµ“““ãSǼ¨Ö¸kÑ¢…••Õ¤I“Ξ=û¨‡IåìnY‰ì"ïå&E8Y[,Yÿã7›6­^¾ÐÒÒbýžk¤Ñ’ÓÏU Y‚Žú‰R&m¶ò]FHy}MMó”3ËøÛÔ¼{ž¼l¤³YtížÑè‹®/½w–â¾5qyµDNÚû£ž¿´‰ˆˆÉdO—T*e^TÝoÃÑÓÓ[¾|ydddiiiU¿Ç£|EΤM··V©?ÜlÚXUKÕ¬ÒN ,Üã3J™ÚÆÁÊúÈÍÐ7®_¿q3:9K³Û…I›aö_†‘Bƾa©´BÁÕ6®£Ë3þ²µx©PÕS¼bm“#ýjöˆS1#ûõ ô]ï8pÂŽ™ÃÇ,Þ†- @6wïÞ}VïÁÙÙ™y–––S§N ÐLzôï¤Ø~’à£Öã«Ç•%³²pJ(fÒæ%‡Ôã}5ÛÉëµB¹F¿MåK«g¥ê·±Óßp§VKÊe”¤8ÐAì™)åFÝë-´‰Í. <´fä¼/öI”ØÇÄÒÕÆäÇ+e¨kžmÚp‘²yóæàààââbÍñõ™gEaj/káì/÷FÆćù_˜ØÝxÄÇû˜‡î^þÕqìü£‡öïÛ·oÝ¢· œ/$±IÁ¤½µux‰ör½ÄµÒf«Àe8S{-f³`ã¡ÜûY[Þ{Ù¢ÿ[%2ÊŽö·è Y|‚™jËX}Ž/ÂàÙ×6 },qeQ’<ªO77WW7wé«ör$Ü>>ì…~^/¼àÕ¿ÿè7ÞKcãEÎo3fä¨ØRí³”—Ìã½3¾ú‹¤ý1h¼‚2*»=j`ogçnC¦çpJ2&ìÁ²vvÝÈõÿêؤͳ¬m¨CQ(4fXVZR.•©^BÛ«Ôú-ƒâÁ…X­é¸ÿËKJJ©Vhj›ió,ûmžDŠ©ÿ>áëÕ+*B¬ÀóìÁõCYYY3Lxº ScL~~~FFFrr2,ñññqJ H¨'??¿_~ùeêÔ©={ötqq133úúúmÚ´éT©cÇŽ\Ú„„„`‰ÀÃ7”RRR.]ºäíí­õè\&gÚ+u¬Ž#‘H°0àÁQÃÈ%88xÈ!†††5BfòäÉ;vì8zôèåË—ƒ‚‚BCCÃÃÃïjˆŒŒLMM%üD5Œû÷ï/^¼X/ÆÆÆ£FZ±bENN–4Tàäæ溸¸p9ÃãñÎœ9ÃŒáªí,”.PŸÚfùòåLÎèêê®]»VkåÐ ¸ª†ÉjÀãÿêH___Ô3ððeqÕAÏ81möîÝ‹E«¨ˆ&M¢õëµäbžaÚ`ók~ È‚ÙtØáwèüyºw+Emƒm¯™)-%++UÚpƒ¾>99‘²=Ž<ã–T‡Ô¶-µk‡¡9 ̪ԌÍAW—Æ£¿ÿ¦ÄDª<Ž੦M]'†æ70qôÚk‚žMÚܽKáášÉpãWK˜-ˆÏ'//ºx-hx–½ÄØêš™¢¢jý6Ë–ÑåË”ž®%d°êáé×6Ðœ°eÌ A´{7 mà ’Ë©°°ê['|ýHxr0€´€&Ÿ6 ­÷±o”Lаi£¼Ê’\Û¦ 2H=å£MͲ¶ùóƒ>•gøk³ýb8¶x$»ß¯S·Ö ›~øô•Œ¼ìÆžã´a¿x ¢{ܬÄJ">O4ágì€à‘þd†ž‘€Ù||#^uFFFPÀ<Àºõqï~ ζô×6”rÂB$‹D|»Átlax¡lxä´á uÖš5«WUbn­\¶ä‰#,B¡€ghì=§ ×óZÛ0ÿÚð¶€/[¾þÊpO àužµêOõ£™6<ý®kwûi 7.`P7[‘XlÔµÓÇ[.`ãzÞÒFQ¹ƒ™dßJ [¸ùäÝý[¯cW¦öúVqúŠá‘ÓfõΫZögÊ?±¿¯jßÕH,4êÿÚR6¬ç¯¶aÖxùÙ%ºm D¼NC—fƬè§ÇŠ,=î& q õO® P¹ãºÁoÝI$t<£TŽ¸yžÒ†Û¨|îPo#‘H¯³ø\<ÛYqnµÐ€g¤Ïûàp@ÕTõO 1i#â÷µ@‚ ëyJ®‘Tœ•Ø×Í–Ù,ÜßPs£È¾wÇÃÎD$ä›y(Ç ¼jI¥ù²}žÀÈà%[±Äž³Ú†Í‘¸à¿¬D|CÞœ½·TÑRvÌ€î"¦Ú1ž‹—Tm/‘6k÷\×:AqjÄ(/¡PÐ…çx-[ÕsVÛ(‹–ý³í „|+÷Û©EʬaG_8¶O(4è<þ‹¿ q6|ïµÙËwïÚµSÃÖŸ¾›3m¢³™HhØ…gýw`"Jæç,m¸•lÒªƒH$èñò¬²Êv´²¼9ËoÑN$Ùv{)SŠÃüàaÓF,ñ »V§¯o`$2µã¹ŠÌRíê°U=7iíès?~ÐÉ€/0Ô›ÿÍÅÊ‚GµÓù|¢¥‘@ÄYž‰LAÜÀ汸CÛ–Z¼ÐªM{¦ÅYŒœü~vå6ˆ «Ù§ê(EÙÜQ="q—öúG“¥™éjY9G·, øæ×'ßLÁÃ¥¡~—MFh êÆñ‰ÃúðÙv»AQ³K+°{nj…¢$%ª»5Ÿ©o…BSgW§jœìlÄ"‘H(èÚk:·#¦ÿ™6Ú¿“RÇŠ¢âûwܘ¼14o ˆEiÓ|Òœ‹¡± u/4Rr¹|æÌ™'N9r¤···§§§ƒƒƒ@ hÙ²ÚâL“jÇŽYYYT×Q²’â’ÒÒÒ²2É­oåYIòÒRvúÒÒòšs«}… ¼< ¢W^¡¶m«®\Ï L…M­õ^Ï–~]“Ê‘3M°ßF"‘dddDDD;vlÅŠÌD9L;iáÂ…Zž^3~øºŠÚ!¨º±cA¦¦ÕBF=x{Ó!šÆз/•–Öû|Àdˆ›fDÁÁÁC† a .slll ŸàÏm¹Ù;F<žöÁÐD‡œ|²àab'==}Ó¦MêÀ¡'úÍ57çü|Šˆ -[¨Cí[ïÚµôÓO´y3†&0lÜÈv»> stream xÚíÝ\”uÀqqäBupàBÓÔ\¥o®D·8_W¾¢8*G¹3M–"JâÂÊÈiŽ†e¥™†fŠƒá))pp€ŠÙÏûÜ=‚ˆ8Rîß÷óÇÝñ¿ãùÝÿ¹çPÀSeggKŸ\½zõ¯¿þúð²>|ìر¸¸¸|X¼Š 6ØÛÛÏž={Íš5˯`åÊ•ãÆsttüþûïéÔ+ÊÈÈhݺuddd|||LLL,à•‰›Ó„„„}ûö <8[‹Ü¼Ü^¾V­Z%&&’'Ð…›7oöíÛ—õÔËÙ¼yóÙ³g)èh=%~>ž)”HÅÄÄ%$…ü~¡ËÌaƒú;öí?îãO×ÿ¨JHJ¥ŠÛ¿q™¯ïŠ•û•+&6úrø’e+|Å/l U=:ýúåHéäЋQÜ= RD Dê¥#«Š‹Y5©³±±™R©T(,D–VJ+…¹y‹AÇ.ßЬ—øýÒ~VÖJëVW£s[¤:ñí 3+kk¥Ò¦ßß±q9ýŠ;¾{¡¥ÒZiiuâÒ Öc RD DJŒ”[Ðu\ÁT9ûîòGJó—»b‚?hª«diÝ̾àö=öíþll/[+¥µuåzƒ.¨Ôâ™.ØbªO°9véúà ‹O ž×Ml‘öàAÓ#ÖK¥NØòQC±\–uþy´¾ˆ‘B)Ž”¸ ±²²,ˆ…IõÉÁŸ¶’úçâï5Ä¢(-‡û|—§­–¶A1gwØZ‹‹'‹}vªU±êëaª›+•Ö³öœ•Ökꛪ©oUÓ$Jûíë~Ôž“ ¾ÔÇÒX<Éaå ‘"R RÏ|Ÿ”•yõñ›/©¸¸_?i!¥º¢‡fÅ”ó'‘¥Oü6VXY5­º• RÇùõ×æhÀ—ªxÍÊ,)jŸm5ÓZ~3úuñäÖî?$Äkûþ­±‰¸èªýë•Ü7 RD DJ)+³ñó7îßW½¿ž¸p£ÀHÅÅ]{¯¦æ¥¨‹ö&ä{A+&F¶ÌÆÜÒ´ZÝWo‰çØã*žÓÜü?ç¢ãÅÛáednÙ¤ÍWÍ·Q*ë:G%¨cbãB6Ï7³RÖ´mv=:†¤@¤ˆˆÔK8wýLc3…Riå½/üÉïMH8ÕÌÆBaRmqˆf·Ýõ‹ÇšC+Löœ¼«Jœ;ÔBaÖÅíptTDíJ có½âTê›ë¦üG©´|½×j"E¤€W‰”êZX-sK1RëCÎ<ùò‘:ñZë:âRÊÈㇿŕ•*æZ¿Zš3ÏÜz8ñÖ­©Ýmf5¾8›}ýÝ:µ”–¦+¾=yóæ?Ãl«Y)”ŸˆæŽ‘"RÀ+­¤þ‰l`®YI-ÛQÐJêÌÛ5Í-Mª-ܧÝ[¨Rý1·•¸–ª1dÍýÛ'ÿcVÝüu»ë7Õb¿¶ yÃRiÕÝ}óÝó[Fæ–uZ\~ø@¤ˆˆÔËFJõw/…¹ØÇ5ÕO¼&•tySms…¹‘Uðù$©7Ñç·×R*«·ß¿ÐÈDÑ´ûè›ÚïŠþc¦ÒÒªZ‹ÉGfUWX5n7LÍ¿"E¤€W‹”X©m#ꈑ2~}l”:>÷è>éð¾Ýß±°RÙ¸zKzS•xò? ëÖ°2«îÜÏÑ\aÖgÚN•ö õ¸¸3Mj*̪¿1ld7KK³î®‡Hˆ‘^5R±ªká[m¬•J+ ·­GÔ9¯K‰…‰>öFM¥µµå]¾LŒË99&fnûú–JÍ»£&&ž!ñš³ÆhÞÁÛå­zJíéæ&¶Û£nr¯€H)àU#%.ƒb¢çÚYY*­ÊZý?˜yUu+ñÆŽUsÞ´Õ4§ªiÛШøؘG뢫ß8)VbŒª+ÛG&=ŠQÀÐVVÚwö¶ê›˜ǽ"E¤­ 6Æ•«T,ûé†CÏmC|ü¹º&•+•-žøhѤºôþ»µL,4°ÏÌTÃBai­´¬¬x{÷É¿ãbóþMÙXu|X #ñ<5º¿øhéýëT#Ãêf¦Fœ«ùC RD Ð.…ÄUNòDµ*æÙ¯iÿÜQTTÔµkQÑ1]FÒ­„oý—ŒÜ»e³&ßlfß½ÿœ«/«T±_¤öo¢ÿñÛ/?ïÙrütÞÅ©®îÝóÓž=?…žù‡¤@¤ˆPع‹U'$ݾ};9ùöÍ$Í)†Ö€H)‘*òH-Y²„)=1oÞ<< kÞÞÞcÇŽ%RÿJzzºƒƒеAƒ¹ºº©k„ wîÜáñºsÿþ};;;OOO"õ¯dgg_¾|yôèѱ9ÿ~ ‰›V•J5dÈÉ“'»»»©—´qãƸ¸8:…[(µZ½lÙ21RóæÍóx‘zÁÅ”øqéÒ¥bâ¯\¹"Îg<à•%$$œ>}zܸqDzPR¤ÄÕzqvvvŽŽŽâ”Ž- âåˆOÆÊÊàÁƒ ëÇÇKpvv:t(óP4ćú AƒÞÿ}9ÞxýÿUurrª_¿~³fͼ¼¼<žbîܹ7oÞ$=ÿjU•šššï¥½—&>sèܹ³øTÁC&\]]ÛµkWà)S¦tíÚ•y( ,hÛ¶í36¡zËÝÝ]¼å²øUÍ÷"T>nnn¤çßÚ´iÓ³'öÅ©"6qâĺïˆÔË=1?~¼\BR¤ÄDª¸~Šàà`Šó¢££ «,Dªˆ·vvvDªyzz¶iÓF.›}"U¼?‚¸Œº{÷.ÅyÚ‘Ïvâĉ|o:#R²ˆTÇŽ‰TñFJF›}"UŒ·_tîÜ9zT ï¾ûÎËËËÙÙùiG•H 7Úbë_e£G¤ˆ‘"RD*ßJü$22ò— ¥jõ´gϞʕ+—É!fè¹ß¸{÷îõë×/[¶Ìçß[²dI=-Zä#ÞÞÞâF^¼Ù>ò´téRq ï#gsæÌéÝ»·|oÿŠ+ìììÄ2ºµ¾¾¾rœjñ–‹xyÝfqCêïïÿÓO?‘§' %:th™<Ê–-{æÌ™BÙ7ø .ÌÌÌ”ÑDÍš5KÖ÷µøÜRÖ·ÿŸþŸ$ÈúG˜9s&·–[®»jI]C5oÞ\j“Á!CŠìÚ===}žvž®ßè7Ìy䄺3ú ñát]þŒ‘?ñðôb%E¤ØìëÛ­½}ûvÿa£tô‹ï4aFÇžFNœ©ËmËÌIÓ>¥#:õÆoH‘ºtéÒÓ6\ é±1ð´ Ó±ù’à<~‘Êåîî^Ä v"•ÏŒ3d4ẋTôƒ§|.ßm˦‹ÂÀqDJ‡ä„„éÍPJ¥òç#5|î¿‚LG@¤0êƒ)rŒTzFÆ„™îgÍ/ÔáÙgȨ ŸÌ/ì‹-`L˜5ße¾·ŒVR©©©Sf¹èzZ&Í^Ðkàÿ>š½@>Ûs™ŒVRÑÑ7NZ ãmK„ÐÌLj¢;Ç—–Q!!!DJ#uïÞýnNŸ¬ Í\{4£0DZŒB¾À§Œ/Ž Î&£H%%%œôYQÌn®býI¡—ó,"E¤JŒO?ýTŠ”¸¤zÆ."UŒ‘ê>j–ßI¹ÎüúSÂè).òŠ”óÇ.ò}¨û‡ ½GÏ&RDªÄ¨_¿¾X¨ªU«¦§§—ì•”óø©…µëžH)"E¤ž)Ž÷+,¹£ïÙg“{¤O ]ú þ2}ûö±’"RDŠH½b¤º ›ôÕW_åݶlß¾¸b¤ *V¬Xâ#ÕÞ¡÷‚ ÜóKDª"5fªK¡?Ï$RDJ"å0øCOOϼۖŋ—Â]I—‚H9æûqˆTŒ aBßÿMصk׎<öîÝËJJw‘ê1ò“ï¾û6ï„‹Oìãã㉔î"µ`gÞm ‘*ôH)"¥£Hu82ß¿:·bÅ "¥»Huwš1þ¼|ÿjaXX‘"RDŠH)"¥Ÿ‘z‘º”H)"E¤ˆ‘"RD DŠH)"E¤ˆ‘"RDŠH)"E¤ˆ‘"RDŠH)"E¤ˆ‘"RDŠH)"E¤ˆ‘"R RDŠH)"E¤ˆ‘"RDŠH)"E¤ˆ‘"RDŠH©ŒÔÇ…À š@9wFŠ'fk¿š-~u£øÕ󹧹§ûŸÖ~é‚tFðÓ~U´PÔt;¬ù’C«7í]ó7ȧï ëªW·v¾¿þ¤˜˜¤f¦eœ|êJÊÿÏKJëk"YI)"E¤ˆ‘Ê©wÆçîý[¶rQ5k‡Õšxéöu­[Í»Üù݆í'}pJÐ.—Òêš7rjÃ)im•½>BÙÎüõa!_œ|©€0Ágã—ÆÆÊ¡A)šË<¡”™ÁˆmO}œ¬Ú{RŒÔ’?3yMŠH)"E¤ˆT‘’^KúÜÇÃȦ˪3ÂÚ?®Z[[¹í{0oÊ jµ†¯9£ÉÍÚ?¢”Jkσi~9‹/´{öüÃrWR¿¯Ù¶ÅÌÐtÀºÛ~÷>5Rb‰‘"RDŠH©gGªõç·Ä_ ÿaå!MmMßìå.®†¼—SZõXu\EÅjöŠ_Mwlbñú€ëõ‡©ÏöÈîß´NŸïrœ\b˜Öü¡4±tk=N)"E¤ˆ‘*´Heû‡ß··©Ðlʹ/rÏvZè×δioß âÿ†üekaØ~ŒïܯÏÌÿæ¤Óè¡f–æ}üôš}€‹S˜4ð>œ%Fª¹â5‡O¶Oôy4Ư ÷;E¤ˆ‘"RDŠH==Raû½ÛkÍÍǺûùHãÖ< ~yÞ¯äºtÅ[½'Š (ÍïÑïGÛu°{½þ¶õ›4é0xÎo_{üß¡ÿ]ª”öµªãY];;¶~(èÌ®í[ÙõÌ;š:úùE<¼ðÕûÏ·ìØ{ù‘,"E¤ˆ‘"RDê•G¶´ùÇú\Gîç$»··n ÖÝl¯]лOßuuwküü333Ù¤—ÿ…;Eº¼7ŧ7½G|$»Hõ9=è¬lçæßnåêêB¤ˆTiˆ”¸‘|òÄm۶͟?ßS><'£HH^“ÿäüëy¤ |ÌûøøÈzΉ‘*Á+©'}õÕWùžË‹¬#•šš*ëÉ—ÅJ*ŸôôôE‹¹»»ËwΉ‘"RDŠH)""E¤ˆ‘"RDŠH©çFÊ]¶J@¤ÜåL¾‘’/"E¤JU¤8ð.íرC§—¿uëÖÈtò333·mÛöœýøãòšó¬¬,]?&wîÜ©ÓËÿþûïÙ©R©}x1ç(E‘Ê}8ýõ÷ @"••%ìØ!  ^œààÀý(þH‰Wº¿Ð¯Ÿ¦M¹£gOî@QG*w‡Þ;ÂÉ“B§Nµ)wtî,ܾ-ÄÇ3 F)™™$©˜#%ÞááÂ[oÜ&ƒÁ(Ícï^’TÌ‘:sFhÙ’‡"ƒÁ`0öí#IÅ©Ü}}ÉÉBh¨Ð¥ËSï©æÍ…íÛ…à`ƒÁ(ECÜ6BœÈ­•x{ö}ûæN(xc—>Dª@_ý¨VD P¨‘244,œ´i“0w.÷  °"%~{ÕªU sµËšP‘200SL&@ß"Õ²eKiw_jj*ó ЫHùøøH+)•JÅßèU¤ÂÃÃ¥H1Ÿ½ŠTrr²©J•*1Ÿ½Š”¨W¯^R§Nœ8Á?€þDJ¬’¸˜*[¶¬x9Mš4ø×0ú´’Õ¯__ZL­\¹’YèU¤D•*U*W®œxi‘‘‘,¦z©ÜcÑ ’““é@"%rrr’:%^àÚµk™^€žDJZ:=ºLŽ:xxxDDD°ªûJJŠ‘¯¯o™Ç…‡‡3Õ€âT®”””N:åF*22’©èI¤r÷ï…††úøøܹs‡©èI¤ R"‘€HˆD @¤ R)‘€HˆD @¤ˆ€H@¤D " R)ˆ€H@¤D "‘)ˆ€H@¤ R"‘)ˆD @¤ R"‘)" R)‘€HˆD " R)‘€H@¤D " R)ˆ€H@¤D "‘)ˆ€H@¤DŠHˆD @¤ R"ÅlˆD @¤ R"‘€HˆD @¤ R)‘€HˆD " R)‘€H@¤D " R©â‘ýÄ Ù:º¦—úR7,›{ ‘*5…ŠøÙß¾IÍ2eË•3´tš½R’)è¦S÷~^Fb`P©reƒ‡ÿSfkü‹^Âì¾Õ†,½Âý€H•7~^\Ñì€?ohþ'#ÎÙ¾™E÷y:_Ie]·QZ&ýË•”hÞðZcÖ\å^@¤ŠXFFFÎâ¦H÷f­žöNÏ1_ädBüx±‘¡"$Y³–oIZꃔ””R³4·J<)3%%5;;S:U<1+3Cû¹xÍù57>;Kú®Ô´ A(xM–v뜩¨äLéÓÓRÒ2Þ€ìŒÔ”TÍ7¦¥¤dæÜ€´ôÌÇ#¥=svVêé«O½" R…ÂÁÁ¡~ýú,âë ú¬uó®·ó,jÒÓÓ³´üãš[[š×ªSËÜÂÒÊÞ%K<)ñêuÞšð¶Õ›­Z),•­?^Ú³‘i£¦MÍ-Ú~°Kj‡kß6æfVJ¥ÂÒrˆÏ_Ö#_¤–¼g=*0Fºö›Û› ?U×bªÛH……¹¥©©M{.ßz)M 3Æ´¬oafª´¯Çâ³mx© ‘ÒŽ;J/ÐT©R¥Y³f»ví*‚…•æ¢ïEý·…™‘‰e“·Þé5rê¯áqW%ªƒeÊ×¼œ"1þ?f¯íU BRH•JV«ÎÜOÊ<ïkUµò7ÚÏ/ýº¼F“Žâ'w~™`Øâã[šž Éç26©{>Kx2ù"µt¸Í£Híb> PüìýÆUšÛ—–—a«ûÚ ¹›gwßÕMÞÓ^QÂáU•L[ÅòP""•••¥‡7¯S§Ne'ÞT±\[¶lÑi­¤KU];¿ï‡mSGö®Z©bÃöcÕyº’}ù×à…µ*þ¯‰T%ó–)RßÒ~·x­u‚öœ 'w*ßì ~:¯M½Ž“<Öû‰üÖt03ž)MÍs"eÑêtÎÔýÛ&j?UŸ"•5¼AÝ~}¶tÉ%ËW¬øñúKFjŒm™Ï/h[©ý¯mµŸ®äFêžCu 'Wï%9W´léÒãdlܸqb¡ÊÈÜâÅ‹ wZ†×)3åÛøœC4‡w´šµáä…[·è•{6;«r/©l_‡z=V}XÒìûÛ·ÄШ'"õžõ¨•tíÇç´·ø¯&R㔽öbN>/606<–œ»»/cnS§ïâr®(q³ÿÖ[<ÄÈ–¸)S©T¶¶¶ õU•*Už¦ *4hÐ`õêÕºØï÷Ëʪ×iþÇÙkqê„xUôÑMÕ;z[8·ÛǺEÛ÷¤ÞOþký(ÓÊ•w]Íz^¤„¬óËÌ*Úü“œœüGà§fotÎY =+Rë&5m3pÑ{)I±7°U4¯IZ7n{Y•p3!Æ«GmEÇ…Bž×¤Í6¯Öðø•¸äÛ·¶» ¶z÷ääÞ)}¾yöööùÚT¾|y…B±qãF]Þ~ÍeñŸ\·®m65jÖ®[¯Í‘÷µ§ß›Ù©N k¥uZníؼzMÇ”§¬^ïô0Ri¼nÙMz¯Sbø Ûö’..Ôï£ÚµjZ[ÛÔ~³ÃÑä‚ovÚí‹6¸~'SZ½eÜ8ܸF-keíºþ>µè›Íî¾òÓƒƒkÕª)Þ¬º {%¤j¾qñûM>ò’Ö\?Ïh[»¦µMZ-/¦êûý ²–{tŸH©TîÞ½;33³6¼9¯se‰W—™••ó¿šÜdkO•Ž3Ñ|š••û=ÙBîç¹Ç˜?|Ÿ”æ LY97¾  ÏiÙ9ÿ+Ý€¬<_ck°ô’tQOÎûg‘¤Ï²~5›·I€NµnݺQ£Fû÷ï¿}û¶,–~º&E  ’““iS^g틺Ï4ÅæÿU…5ë endstream endobj 1522 0 obj << /Length 2879 /Filter /FlateDecode >> stream xÚÍZ_ã6ŸOa`..®e[þÓ·Þ^w1noo;EÚbáÄJb¬cålg§¹O¤HÙ²ãìv ÜÍ<˜’%Š¢HêG:wðïíÝßî¾y%^îçI˜x{/ ½4Îü8¼‡Òûeõ㥭vE_¬7aš­~êTKÔÛKUªõF«¿RÇU«¢SÔˆüÐëß~¸ûþáîßw ¡` swƒ´‰v-Í%Qb†Yî‘ÌÀ214 /pwH=Á›ÇÈÚRïYƒ¸tX0Õ\]f0„c†ËBW9¯Ývfݵ8bË#Eó t“&´Q¸#!ªÒçëÿÛƒGć·Sð’d~""O&¹ŸÅÏâ— N* 3a‘‰Ð“"ôS`õ Öñó0cÂÃí¶ÇY&÷!Üe°?N#?O3˸UÞ~‘óL Xz@°$f&“ÀÏEFêÜ×úÑ €Yš€®á¥Ìùþ0ç÷-œ_¬¢HÊ8ŽÂõ&‹¡ùʸ¾P6, CÝŸŒÂìí$\wð@ì › ~Ÿ¸ïÒ)Ëi îŽ|¤>"ìb)£ÄÊ÷Vèæ¼·–a{(˜XR-×HO ùÔñ³¹èh3µ˜髾a.}$:Õ;6êMXK<ÝÀ+—®² ¹B˜¸¶Èá=CFÖûQLNhéPö£zÆÍë²$šžŸÌß®Æè g\²ËgÝn _dÙp®[òys6O‰óØ2AJþÎDkaÃ8u]5Ó>1æ-±58ìíúÜòdÐâîH—;Üš¥êÎUoùòiò»÷â­MÓÝ€¹1Ê•n¯v-2ÀuÍÎ ÄÍI—Ê\3éê¾±£«n9ÂP‚5gé`ä-A¯ƒÙdB‹Ýt5¨=ê– &töÕImô¥ïPŠ0_Ý÷Ô_¢”Éx˜E äW-ó­ 7D,€nyñâphñ2dFĦ!@Í¢Ðm4ÝËV-ë¢eäÑÁõ­fÉÙˆF¡ñ¦¾Á¢SbnÀ<Ò½ÁJšR:ðe)Åí~lÕΉWæeîà­çÒ¨D¼I ßÄpû1½ZbkBÊ‘ÌH×Ð3 ¾4F cm°›i`ÒP€í’‘¼Ìý/kÐ]I}S áT÷œ¢@×±Ú‰ä„B.º†ÉÍ¡†’ÜŸ”}GJ7$$¾í©¨-Žá._íDˆ[V^hÍBc0†°á¾‘pÌKÕžª’“Ò¦HôÄñˆêdëO ‘Ì)И¶µ` ¸œ¿GiæùË x$#@ññó(¼\ë%ÜYÆ…àÌøÏà¬%àiLý}—âûgÀqX¬Íʽw"¨‹â„‰@HÙXúk¥¥ñ3Ýæ=¯%a)‰Ä«ïž‹\°0ѱ1lÛè4±Ãî/ ò"´øõvpkŽÀ"‰åA‹/$~˜D8#1[¸íüðD¡> Áù!¥ºlmîÝG*À?`tù'F÷^˜AÓÀÔ7¢dRÍ”#ÄwË"£‡;ÕY, p¨›¸ÿÇ7…¨Î3‰¥¢³·Ñe{Uª-Á¸ù*29KÌˉÐÕõ¶¢“hð´x§âCN7ÝT„b‹È7ŽÃI¡ê°’©º£eŽ•ÃÁîò„ý€xxýÞVKZ¿xj¶‡¡?ýýýZ±Z,RŽõyP2Å‘~ ·ðêoàÝ;åÖßñÝ÷¦Š¸’æ ^׺ƒlc¬(‰¡›úºùy"àÏ‘¥OËNä´7‰p?pXQuIçÓÀÂÎé|#Šc‘æÀVDÉòQ¥Ù¬L¤S(NÉfBÊàZÞÜ|È#L㊦›­S„•)=@0w€µ·ö‰#(³;r†dR¯pQR59=”v.‚3ØÀÔ§J€Tr&iœ¢74â©4ôÞ–`jJÚ1 ‰…î~¨dïŒ!ñ¼fRÝŽgúD3ÍF„‚5vf·.@k ÜådizmKæ¥3;^øj„Õ÷¡:^- ml²ëÈj€37ßÚÈÖ/-‚ÄͨF|sÿÎ~Ç›œ®k•|µ¿S µüp¦1á,oõî̳Ñ?N¾ÄHÎ' ŸY¿çê3împtÝ(ë^€5¦ßÈgš“/ýëdÚêþ8eÙ±ï›ÙÁPE @{µIUƒ©ÃáÒœk¸Ã)ÌGÛn–¿€øÜê^ïtíÓ~&q887ï_ÿãýìëm©öÆL ²7ª Ì5:Ãt¡ÎÍ¿E ÇÑ‹PtÂøüyð`=‹“—€èqC3ß?C‹8ôe(Æ2öÆ^“z6â-Á¿7€ÂÓßžàâF=ºØ;4€øÑË´ðÙV7é¨)°Rb|ë¢ã)ø5úsÕÏ*§c%…_¬C¿SÜo¢Á"’wnŽAr= ÿ·’»Ä([~Éyõ{ÜÖfqĘ'#0áù¿:˜—¥3_í7a8ˆç9<™ÌðsòsCóÅ¿öYÌrÀ5…à;P„™9á(Ný4 a¢é~},νýeR†Å0\½ž…r7åý Êop endstream endobj 1398 0 obj << /Type /ObjStm /N 100 /First 975 /Length 1654 /Filter /FlateDecode >> stream xÚÍYMo7½ëWð˜Ê%9~F'[-Ø)ÖÈÁ±·ŠG $¹Mÿ}ßPBâÝ•½›•P÷`xv9$gÞ¼™R–2+£,å ¼•ÿF%§¬7xƒN¹èU §È²¼ E\F¼¢E`å)‰€Ebž@ˆŠm–å²â`d(« xkU¤,‚S1É%lY†¼J¡lžT6"Ø r"°¼IK˲ÖÉ ÃdÊ(ìr0ï0à’˜éðHenYÛ•Q12—¹P ²€wA=Âc6{fd/®Ák›“L#RÎ81ÜEHA$øá6PPÎeÙˆ0*ÊÖÃ]ÇQlñÀ0XÁÌc•ÀQöH²¬Œ\,VyVXDVñY‘‰"±îVFÙBò²/K,²Xïƒ"GEÑF‚ ؃£¢PÀæ© ÍX9HŠoF$“›á ¥$X¬— ¢j\J81Í[c°G4²ÌˆxçŠÈ 0Ç‹¹° Ù˜D(PER^x)8,ï`£OÅÉd!岶ÍÅID–Mq2 옂è°ÝÌõJ°°<‰Q™—(zØȲ%$£˜mÅ*ÁK8„¨ÑK° ,FZì¤`h‰T06Š„T0@CÊe4¨ÒŠd ¥"ïˆ9$Ä3#+†‡’X Êá‡5,y!03HX`f0%„²h¢°B’´cÄ.$Y”C0Ø B~t4©^ª äEVŸ©êÍo¿+ÄÅ‘ÑBãùíÍÍÛɳg÷*ZÇ:©†âÉb¾VGGª:Í t(3N@,pjûB^›/Å„Ë–¨^-WçõZ]¨êÕËU½®?¯Õ—Õ_ÿó©ÆÀå´žT/°S=_¯¤”Å&ÕY½ZÜ.¯êÕ¦š”w?×׳Ëç‹ÏêÂ(A•$»·Øèr‰Ù¢‹âG÷¯Ž¢qÔRl:ˆ4±´A‘ìUäœu¤è³Îo¯"ˆªQÜ(Ú¤‡è9KÚŒn# wB=: Öt*…~|@óЀædƒ6)÷+ºu4¾_Ñ2à„j좺I½q¨Ú0Õ†¢6Ö6q¿"Údý¯ÐBÅì åìx´Ðnô¢ÕïÛxwòwâ·¹SÏç ¬v±éŠÄžÒ‰ÐÚ¿hNªóÛwëòüÓlþaR=_,¯ëeÙż­~¬N«¶<ˆaWpÉ1¸!þF§ßXr Ïøô&”#Ÿ¡w\:WÕ‹× lŸ¬nß­0y¶˜kë´Õö©ÀtsÐ"è€ö’9€‰há‚ÓÖøö2ÇÝ5gC…40qŠò5 T™Ô¯è2PË¡_ÑÂ/Ú¯Èc½Ïöë1šž~Gŧß{ß¡'…-=)”žÆk´Éˆ?x专5:<–aö´&ymл$V m笑Ód >Ýn$9iè·’š_64®PŒýŠ„O`öùÿ@ºÔ%ãIçù®í 'úqe¿C •-äÊr¾³Œâ“ »R©}[†‚TÇGGe‡ê¸Ä³:¯~=;•¿'ï×ëOßWÕjz;»Ñ×þX,§µž×ëêi+Þ>ŒwCpàHÜ«DÈ—l¬&}‘‰¼×ab48tyÀ~<˜ö⣤IŽ h*åhŒ“¼NhÞUÝQü6¬@„ëú/ýiYßÜ^×ß­ë«÷óÅÍb:«Wújñ±ú{öaVmG«Óùj}ys3›O§pﬞÎVë奬Ûæ ó@Þ4%Z`3Ç~Er8ˆÚЯhsĉ5?w‚ïr'¸oãÎ]ß „µ¡x_:¶”ÎÞíyb?Dåvjy6]"m·…LJúˆÔT”߉püs<@‘škêWLAgã¥ÀñŽ;_zç»Õ<ÕæñCí˜ûé¾»ùŽ¢Íšö<Û¤íâ7À<ôX~¤mc<äø¾L¾ûhÝ׶“W~è2Û¢!Ï^¬ñ‡If·#™‰šÌ®™zD-6ý Z%mß endstream endobj 1529 0 obj << /Length 2526 /Filter /FlateDecode >> stream xÚÍ]Û6ò}…€<¬ Ä EJ²Ô·ô® ¶×^²w/m‘•%ÚÖ­>\QÎÖÿþf8CKò ›4Eb%9ä|r8²ðöžðÞÝ|{óæ{•xY%2ñîwžÚ$AÅÞ&Jƒ(SÞ}éýì8õU‘ùj-7©ÿ£{š½;U¥^­Cá¿&À{]ëÜhZ¨@áê×ûn¾»¿ùí&ŽÂ ½âQ°¯hn~þUx%ÀðD ²Ô{²§/JRkïÃÍ¿oK+ì^¿÷hòþÝ„j’I¨¼Mi˜¼HyÌ7ñ…úŒFJ/Ê¢@‰ø%“2 T2ÐÃ?Œ& ÙsÈ„O@ðAx´QA¶I/”{ííI‹éå%ÒKáò’/O‚]Ã8ò6" Ò,¢Ë{UÂíµûÕ:š&ºÑý^·Å™–MWêïÊ[‡±ÃDYœ‘ËñÚ ù¶®ÌA—ßn(ø€„Ù«ûªÑëî4ÐFÕÒhtѵ¥¡E¾Ð}fÂÔ¹a”¼ªOÕpžcïêîi¾—ÓðÝ(–UcQ‹WphÐ×´?o‘nÌ9£5Çoˆ“6œm¶ú‰“{H\™ó™ü[:YÔ--—©].gä~æä‚W¤×(3QX’õ’ö§ò‹L£¾Ô4â/Ô:/(RÍßD“ô‹5Y ×qsãHaš~MÜ{‘F(þPü½D÷ „$™(ÄH¬Ïï—²ä”(‘A #%¬¡×y³Öí¾jµµŠãˆÙì+Aë$!¼{ 2ήXÐã òœÖGCË¡Ï‹Gšv;S %¸ÿÇOky­†hÖµ&X­•ÚŒÄ§Tõ*Œýß+3˜)- ÿ„ì:"|ÌûÁÀ5+™ŽTŒq" ù5-ó¶døA_Ü(7ŠIM@4F7ÛúÌ—S› Sjj •2§µc‚Àͨhº¶ºÞЊÌG8Ú"̪cN;£qÐ6"y=zL! Ç©æ\Rÿ!T·’±ÿDGs>P 4ž §„+# Ö¸Âßê×41 °ˆ0>UuíŽÐˆRìÛ üL£«^0c:3^ÔJ¤°ÂÂÞxÝ°htSäÖÏàÈpÈyK“-c= ù¢Èÿ±e»®whs®Ù‡ì'pº»Â¾œ^È’?ç?JEV¡-nO.«„hr< þA0t"©f—NHÓuýy•Ä>X&=R~¾µõÉŒšuTðÇöíýÛ ¢¬^Ô¸=5[m}nž_špo_ ¾sŸ¶dIj~ÏÝÚN8ÅéMŮα>8Šýzî•ä0ir§ÕÉð„ÈD p¥¼°%Õ LNÆZÔ5Ij–/Òª¤bˆCñ¤Gƒÿ®¤ð?¡Rš 9 ¦[@Õ>X]<šSc_;ؘôT‰_1!«ŒU Õa›×ŒÖ•LöéPš:½“ž9ÈÖSmk>o7Ê¡Pí&ò%Mœ"N¾¯Ð¤Óbà°¾ZR8ì»®ÄYBn„~gUÔ´}õêñÜl»&Ǿ+´1¼˜šOÕp TæùÔwè38˜6¶´b¤îÈN‡ržlTšƒ»€¶;¢ñlñ‰Ã\|ô¡ínšAçåÜíÎÚÜœr_,;¸biÈ?Õ¯É8 62y¹nQQ ÈŸh×&l¦íþl·v=>ïÞ x¶xñ³#ÏëÏd^5Òv•%„®(RrµN#lÄÞ6Ý©åž ¯ÆõNëjú‹ˆ…ë…¶çA„Üu4>BŒš7Mfƒ¥ÕùãÇOy]•–ËxÆ'‹}Žÿê¿´Çú»faúkZöúP'Lq#HO‚d²œæèȾ¾þã>õܱD,7_S S›Í \© ÇÓ¢BŒ¯çMþûGa‹Î[‚Ù ãàꪱ!¦”ìÆÙ¶8õ½nyÃÑ€˜"³Ø¿cð±×chl¦<ù8„4ûkRˆD'C1€¹-¤`ÂéyÎ}䶔{V)—ÁÜ«¡Ú¯€œ­*ãhʶ™5̶šÃT(,IÜ×]^R馸t$ ´öóžfQh«€çwIÀ‘Ëœj49Á$˜<‹‹ÙéH5©Ua9•3Âgµe]1À™ª5ævÊ H^ž]<¾döK ´`Ñ·pJn¸ÎqêJ›½z+0lÒëÂi Ûá×zmËÔü¼>@ácœ‰mVWþ[ú²C‡óͦ¤_’Þ¤ÊhÚúF£mõ[šw ÀÖÓôk)K'òDÜ£–ðÇ#å4Ô˜— þªAQ£ y4"”æÿãQóœ*n5sm\qÚœEaìOmk= üaËNiØiW¡N¼Üñ›N§æ«$N{+Ö(7gw†.o ×0…]P½© †Ç»Íܤë+¨Il­•¡q‡Ó‘7ÐÓ2l±:£Ýî%"Dqè ¸9P™X0Þ®Ú¢>•ŽuNtk¬zFF›iµË îxçÜhBdm€ “…->(› ð€kf²pì™3é…ݶ-ÎÀEhfŸ=úKàÚ/˜”°ý"¬m(Aâz(îŒ,å-øÐT%‰p˧˜ÄD }‹ºC[rï¤-5E§S=<ã 1²Oµæ/„RKN‰Ðÿš¶®QH)§–“Š²@s*œb%‚‘ gܲ± óâvìíÁFNË«ž>ô?t m5÷·ý#ãNšc â–vÄšc‚ÚxrºÓþ,]4ó>Ž¾2¸P­fŒ±¶µ.´Ž² í]wi|1'xYQU¬9%¨‡®Q;êÔ­¨‘O³žvñ[ÍknnZ]v•ÏÒ”ökŽ#…éövb™s[ æïNfÑ.K¢ÙGÓâÊœz;³`^‚YèÞ N©!!}P¶æêU<–V*KZÛž9Tc'`qw4î³Z&]»Ã1Œ02rM ̬škàmªRß2[³¤ï¶GoàŽØ}È©«æ6û[N‰ó4mÇ$.|×tÛ¦hJqö˜Réô1eh…£¦œ/SÔx ï±[4r6M¡ñÃGùæîŸh£¡N÷rð§öÑpj½»Æ¯ÚÚÉ7w?=ÇèÝ!å,FÇ´™Læ(œ) ÀbòÁbÁä.áØ؃MEXÐ'Ì,‚€zˆúi+y&ÇxXÐïƒÙ,e!]B&ù0¾µn¬éƒÌQMŽË£Î9p,åk à> stream xÚµVÛŽÛ6}÷WèC% æò"RTßÚÝtë(šØA²A •èµ`IT%9Îþ}‡y}ë¢-P094yfæpf8=!‚îg?­f7?s‰2œI&ÑjR†ÒDá$ãhU¢OÑr×WE>æñœ¥*ú8èÞÏîwU©ã9%Ñ¿ðA×:´8f˜ÆŸWïfoW³?g”D=x‚S’¢¢™}úLP ëïÁ@ô:¯m ¥êº4~„Ôõ‹¸÷ÓÃñåAwUlwÝUÇòá¹-¾˜VPÛO5³v¡Y·¾6:+,FP{dÂ&oKW®¨­ZøgÒ×8¥GÚŽQüÎà£)}Î^‹›WóG$S¥þCð_æ @¤,û79xÄÉÙÓ+ Ã" /ÚÛé1°õŠR?þfz(g7‹»¥—'ÎÊŠ¥8Å¿|Å] :x—BEûÜÞBXqZ$‹Í®Ýøå!gŠcác$ÃLX›¹”˜©Ärp³h(è΀ŸWýãÐZpA¯ùÇü¸pW|³ø=ø·¬«Ò¿ üSÆABÍÞÿon‡ýñê½SËl§àyÏÛvê%ôp(©Žš`Ç}R¥ÜÈW¸QP’…¼F ¿~õ¶è-#¶ïjm›a—MðâGkÜí¯ßßy±\ópüwg"ÁLþãæìj÷˜@ç487('.áy’ lzån7y7N¤‚'X2ÝšÖ^ÅÓÎ6àÙ™­~¡™ endstream endobj 1532 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 279 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 7179 /Filter /FlateDecode >> stream xÚíÝTTgÚðìž³{²›Ý³É–³gs’ìž-ç3‰…Ã4zDEbDci * Ò†5ìƆQQ˜¡IÁ.‘X‘¢Ô¹ïwïÌ0 % 2¨0ÿßyB†;—;Ìýÿyï;EBÆŠ¢ú/äÏÖ–>ïxզܜüºé÷²EƒjÚÚê¯WÕ7’×uHqk}·{XW[[{ëÞq÷ƒnkãã›7jïÔ=÷N›Æ‡wë73ku¶Þ½u£öÆÍg-TW{þ^/—Äü;Oڼ˭gø^ðŸ¾>§fÔ4èé…/ùÞòï2½ù ’™_^ÜÖxûF­äÎv2ýa:ÔQwçfí[M’{Ü“6M57îwI7V¯¦¦ö^ý¦Ã×ÏsîÞ»+߸¸ý ‹o.]s§‡ùšó°ÂK·È ÙÃ5Õ:M›s³‹4—mãš/ȹp1a¥½UÈy檆<Ûb÷Ñ“n¶ bÏHÓ&¯´Þ>£ÃËŒ`ÄÏÜ8ê1ûÎæÏâqøwÛ»ŽEØÎØz®æQ+Õû¬$?p”¥ÍW°Žo½BLT#j§ªx&¥¸tº°Ø7$“âº]ºêLÚì^:-úÂMÉÕÏ·g¡$gRWZÈÞЙ^1gé¥w.eZÍ_/Ý@[ÓÃ.Šô¤l¢ú§ 5ÒFz&¥èîåh[Ï’©–6{}:mH{5[wv‡äþ\9”Uûì%=¶™›YHê©ëΓÌoµ¸hj [¤ ~ù¤¹ƒ<«”¥M÷³SôeÉ®SP8ÇôÁxêioW¸û ziC¨SßO^wd×6Ûàcf\}î’®js=­ˆÄ ÷)&~» HÏ,qÇ ³ ÛK[ yñ­Ù¤Y¾ û¿‹ÖæZ="äAÎr¾íŠ¬nÉw£öš#QQÑ+ÌføDo‰¸ñ¨m4ŒmÎ÷Iú/Ñá›>yÜËÁüèrþì-ÙtÎD:ÙymLÚ¼\Oǹ±«g–¸$}µÅÊtúBÑ÷t­\²Z<·<©¼¸¥­i˜¸û€¸{ËÍUú~T·ØÕc|çûôSòÁäw¿#»v1iƒØû#YJÜïÏK/3(ÙéŸ^Sþd9%ß‚XqÉ*’§i×—¬ V4:¸)ªK,î7øï¾+Ýw“’ÜeÅû%é %¿ÛÒe=÷]¡½þ½;4Æw¾O>aÒF^ü#Ù¹gXÊñàÓÞ?üáUõÑGä÷¿g¾¾è‡†¡Ö‡y}…¢¾*­Þà^Ð;çêO"þóÐêÿ`_ŸNþûßþE)|í[“&5µ!”–10 |þÊÚšØÙ ¡ì퉻;™?°åæF–/'kÖ ¡üüHt4³«+¦´~ýkòñÇ$3™3Ü ±¦&ÒبüzþüMª¡á «µõÛ ÈË—o¾eUM ).&%%ƒ­¢"røðêȲc‰B%$²n]¯ Z©£Cí»\Zô¡JÝC*:† ––„ËBq8L N˜0Ø?žŒÇ„í_ ¡~õ«ÒFZÿû),DfÍËË Og ­cÞÞØm^s&E×ĉD($/^à| Þ¯´AÇÆLÚèé1ÃΖ„ àØAÇFÄÔ©D$"ÍÍÀ±ƒŽáŒpì c8vÀ±ƒŽàØAÇƤá¿e ''ç}ø5F¥t `Ôyøð¡µÃüEÞýË}Éò—÷)%˳Ú+ÊÊfÚÓg £¢]!Ã=j‹ûâet òþ§cK|’’’±ßÂh$,,X}4µŒô­«d²GPzà*e—ÛÆ=å•£ã=ÎŽî>;®p¢/4­Í,z ½Ú^MèÌÁ~ £4mmÎN‘þeýMPJ ð*åÖÜõYåU£$mæ/K/à.Dæ<öͽ…^¥]%óbÚ6H¤ Òi€´aÒ¦ªºï§¿ŸÏR½iãŽy@Ú¼i¹…ìÚž¢@ tvv"múWúUbda“žž.ïUBBB‹üÓH›WÖüÐÝžÞ˃„††ÖÖÖ"mLßdýúõò^ùûûWTT`O¤Í›¥MHHÈèJ›-gî©@Ú mFgÑÎ)EO-õ¹½–›ØÅ— m@UÓFH Ž¥êOâ²x1ôá#”¦Mg’Þ†³/·å6Ææ>ã2Å`Îæ´RæÈÚ²sKWöæÜmžo=Së`¥m`5?¥h,§ÍæSõ[Î<¢ÓÆN_nÖCº'ô}ŒM`ëë» n&ËÚ¥»>ç½\^ñTJÑã‰êËŽµ*,o`l*š6½óϱ0pßÓä`fä™ý¤{lSÁ™¨~YòØ-$ñ{v«s&^%©¢Çæšãç$?NɆ:IÂÎsÖn¹¢*i3ÿˤîû.8û#W[3â¼X±]ŠÅ¤ÍõoÄ™ m$g@ÂG}ÝmùTlÆ:]ËHAQOÚl)"iå$ãY²ØiòÒ]ôSìþãšÜÙ‰å=§NɉZ*•6²*&¶Ö†‹2ï¤IÚULÒ+º«œ4"mi£8¶ rbÏ:D‡Fri»W3ü\}˜ÐiÃ×ÕÑÓÖÐÕÖÐQŸÀ2t:ÕFŸdmÉÈÒ³öL-S­Yâ_Lq™jíœP™QTI·KGs’Ž†¬Ôu\®2cu ËÙ>ó—IËqцä"¤ ¨äØF(6â°m—†Í[µiÞª-fF¶WéÃA:¶ÙTHRJ 3¤9Uh¨©í{†Ä|HËÀ-¹¢g;aÏWÛØÙ-̼-ÛÈÚ%­ÙØÆd¢Æ‚Œªõ{J¥µa_Æ6 ši“x:›­7ÕÇ•I—ÎÒžº­ô™ˆH.#n³7Õ¤æßæMP[´Wœ$›´¡èÓ¨e‹œ«ZÚè °‚¯ýuèÙNÌÛ¼6mLa[…ÝìY^B¬ÌôWx”.9|"K˜)ˆŒ*{ä$GmÒŠcL¶oY§Ë±òɺ›q>:(ïoéêMóc›Ó¥iãq”¤W’ŒJ{ì²µ±Žÿù¤î¡ Ý®ŒÊžJ+CÚÒF–6Éõšê“" (ù¯@DÖ¯™©1%>­¤œ5~œŽ¦ºŽ–ºŽÚ×lSgïôkÌëj„Tr1Ùüýd ¾ú×ã4Õ´|’#¯t??5FÓfÓÉ ùtÚX©×ÒP£{¢­ö%ÇÌiI\>5Ì GTF·KKm¼¶úY©}iç½7½ø÷ßÿY~iÛéÁ¥ð *I²P $i’'V¤•¦8-, –Ô2Éòr" ±=K,MºK©å}{"Ÿ¶Rl—´RKeË“EÒ6xçÂÆ6xçÒi€´AÚ miƒ´AÚ mÞ¿´‰¿ÒŽ´@ÚŒtÚDœ¨K+#H¤Íˆ§ÍuH¤ Òiƒ´AÚÒiƒ´@Ú m6€´QÅ´)¤ À`ÒfAÄÞ„üÎ>•XÐ5Ù=@ "ý¯  :µÚ/Ô¼ Y£%m¦»y§–Г k\®ô¢ó„Ò†¢(éÿqPÀÈ¡÷؈ðpyÑß™ š±±±¹¹™É0ðŸ÷6mèã±°°0\¡Wô¯mjjj2”f mýøøø¾"mèßSÜbÈ“ä5|­ÕÎ=ýå»/ÙrÿMÉnNv ^ûˆÖ£¡¡ÞƒÞ.ÅÃç}ÛôÑÜÜôNõOáι–Îëbbb¶Fmr±Ð5q‰äÅÏFýüÓW­ð²þ„ë÷÷ÒpÎPO'xK¬—£¹þÜ8d É;I›>6ÃJ›¬9³Â¯Ê¾¿´ÖåÞîb.¦/640°qYö¸ML$2¢1æF<{€§½ÒæP¸‹WÜæÖβ514¶H:q­«é.›Çãðø3’oÈSåÊŽÈK÷¥—çL¸ú mT0m$‘@µrY¼'„Ô ôù¾º½££óÉY–I@'!¯± :ØÙÙñ¢,m¼M¨,mž“óÉÞs×gÓßvÔq§xˆÅm;<ô·VtÝÈrž³ë^—¸{@,ý¿äËÕƒ5B;qüÒFµÎ¤æñŒÌ'Ó¬¬ŒùlÿýUÒhˆZ=ßÂÂÜÜÜL[}æKB"fÛì/y éìdF?~¶ÚQÉ›]×~'ÝNÅ©h}ž¡™„‰ž‰Oîí]3{IÉtDø¯²á±GÄ,3 ɳgÏüüüüß©€€€ëׯŠ´Y·nݻ핯¯oYYYŸ±ÍÌõWš›šš^¶uJ!vüÑOmíD|‡«áD§Í—ÉKë§îµo±Ö0®îdB£üDÄLŸ¬Îö6Z;­SÜ'múLú­žÉ?QS)Ú¼ñóçÏß)ú-íz{ÕkÞFöG»ë³¯¶3ó#]5Õœ:©Iö° Ë‘„æE¾}ˆôLêÂsòó• ikéo_ܼ0ÑÔUºQœÇ®ÛtÚÐgR{ΡÌ2õ;vKzÙÍlÂù[m8‚F×ÑŽÀpä§ÙO *î³W=¯:ÈÓç[N›SÓ°ÔJÛr儈³Bò ø†V®%Zè•| þ}æ ³ö‰(‡UÌùTå™T3#C3ŸÈýô¹Vkýõ‰ºÓ×ôÌÛt<Ýì=ƒËÌ Ž—â)ðÑ‘-›7“ñãIl,ZÚöÔðõ6½Ê_HC)lúÅõ³¼o!IÔÔÈÈjÛ6ô”2ÑÑDK«'dä•šªºÍion57“û÷I]Ý°ŠÞBi)))nåæ’œœáÖ?}û†[{÷’””a½[Ò_cbHTÔp+"‚“õëߤ™Æ 55+«B…ê_¿ù ùíoɇ«>þ˜|ò ùë_‡ZÔ_þB>ûŒùJקŸ’/¾ ÿü'ù׿޼þóòõ×ÌtÁ„ oX_}E23‘"CSQAüýÉßÿ>ÀNž>ýÅzò„´¶’®®áÀ x®Yƒ&Œó©k×ÈÚµô#æmà=´råJ4a ÆNM ý§eFª‘‘è màmÄN^H@Ú mi€´€woÅŠh¼‚²ÞyëÖ-4^mšóø[Œù´q÷ÝúÚvÓ50#ôð­ú7=SËÈüEÞø[¨TÚ„TÏe¤ ŒäØ&f‡?‡c˜PH% ‘60BiC'L§5›ã5×À=»åmžI¹/^ÖçÃ爌í±Mü—8†Ë¹ylžO¢°çdjDÓ&½œpŒ,ÂÂÂ6t .--Å_` m<X³w¾¤/˜qÙ¡¹Ìhç­¤ ÛÐ<$$DñŸz/**Â_`L¦@Hó~ÖçFç>9ß°!Ø…÷MNÒÛÛ mTjl¶q×!|Ih:Saé–~Ìq’äY*¤ ('mèH)h6Ðã†å“¤"Yy::¥ÔclÊÛ$æ7ï­è :.×í« m@ÙgRïêµÄH¤ Ò60šÓ†yú)õ*ó¦lºRKH’¯·e§$XÂS·[šq Ìl ¸V®[òe„´%Žmâ~8®Ëš~‘¤]%iå$4>‚m¿5cPrÚPÞÓµ“›å:!äÆ6 ì´épäè®:Ybñ±ÍÒiÚÎ-Šc›Ä"Œm@ùó6±Gv±XöQ—(éÇGeÖÖu‹blJÛÐ_ƒÃü ¸:æÓݬ¬LŒlgG¼+”>¶éóz›”b¼ÞF(mðZb@ÚÒiCH›ž'¾…½þ1)ž“em"“—ðÜ.&‰(:jçEl;*¯ cP~Ú¤xñÝ/1—s‹9lƒ­WÄ8“€L›Ü2Ž¾QL¾X~…´¥§ wFGŸµ »U1j6 ô´áMÞŸ÷”£Ç ¼@Éÿé:¤ ŒÐ¼Mâ…*ÇXþ¶¤ ŒLÚ0ÏIÅÎfó­ã ñ>)P~Ú$äÞ?Ù,-Gj7kÅØ”ž6x-1Œœû÷ïkÚ9û¦(Ö쀌>Ųq›ê¹©ÿrI¥ÏÛó W ªænØùåu¤ À˜w­šv]^×®U{ö³ÔóU¼¼½=‡gÍšµt mTŠX,z×6H¤ miƒ´€þ(ŠÚô®…‡‡?xð x;¡‡&¨ ²ƒ‰Î³{›5sÝŽÛè (×%ÁÚ/'LìeÂWŽ«ÐP¦_þ`=|âŒFµç³ý{ X'8Ž.%»$X;n|ïy›ñ˜·eü €ª¢$=AQøœ q>>>h¼Ë—/GiH¤ mi€´¤ Ò6 ‚V­Z…&ÀÈimme±XçoûÛ¸qã>ÿüóððp´F‚††Æ šššÐP:Š¢RSSåQóÙgŸ¡'0B:::äiãè舆Àȱ³³“¦H$B7`äN¦NžTš])­°£wèå’[an«ˆÄvðZhöµˆ? Š$ E]áû+d?r zóéÇIÅÌvÒ­¾š]%ß SÇÑÛ‰9}·ÏòˆÓ/6c3m˜Ÿíœe¤iÈçú^èY>ÃÌÔÈÉËiáêË,­Ì48n1…’•‹ÉÚ m]¾¥ý\»™n¦¦ ÏX!IµXjhZ¸®vZ°zš‹«©™‘¶¡GÔe±tkÎV†öîó¼äåx:¹„¬X³œké0Ý­{ùÜ% bï"mÆdÚÐc„sÕ,머Eœ™ûBÙh„N›YéuÒ8J©$SLÕ|v>¤¿Ý¡¥k·©Pò³B’r•,v5¶ñØžZÔb¡®µô¤l³t’¬ö´×c/HÊÒffÊíä~·¾b•ÏöÔbœI¨Àئˆ­³3Y”+ÈÈæpâ™p di“ñSr‘4:^Zr'úoO.%³œÙs"ò“E²[”žX%3cÅ´0ÛéâqÙÁ¹í²´I½ÃlM^HUJ&òŸqµ¸ëóéoÅ®fúÎÛŸËϤès«iÎVS¦²´ÕÝ“ké¬H)ÛqÿÏ{w‹|zG^}ÒFD¶<®Çþ&IÚX²,-¬eefê“õ€Î:m,½RóZb/J«9¡€BڌɱMÔþ,®¹kRAGB~Glv<›í!–Ðic2kûÏ©¥$¥”DîÏ1áLôÊú)µœšÊç™Õ˜$’ß"%=Ûê›6BŠþ­&ó¸ 5KÇ6.i÷™­•ÈJ:jZ±f9›Ëçñ¤Åe»ílGÚŒ¹´¡O‚ºÜ-Õ9\nO±Ù¡y]½æm$OTEEùiZE¥TWW§ÀÓ)E²éº¯¼Œ4¶)lärô#.ubÞ@ÅÓ†Ã$œ­ÒaOŽ+íÉŸuß,Íë6,¾ß.ÔuL¢Ç91ÛÚ¿ÓÒgÃIr‰x¾#ËÊc§â,±$ˆ(Ž¾u´@„Yb•Û‘ ³L¦Ç(†€ ¯ˆ£Ï‰+dÒ†g=ÓfÆ\GWCc#–¦NÀ‰Vé:¶†éêêó ÍL-&s9,S×8æsÈE-–ššFvôús-mmèQ’¾õÚøBªûpK®¹¥£¼Lm–m+EڨʙTüÅƸ+â$ùKžŠÍmJRq›·å6I+öbKBX6«,Y91¿-ö"sUÜå6Ù3SÌ6ÆvÿH\^«@Ôóê>zkò«º«™yòýò‹ØËíx-1ÀXO¼s6H¤ Òiƒ´AÚ m6H¤ m6H¤ Òiƒ´@Ú m6H@Ú m6H´a_¹b}_꿳(à-×®’€·£ µ~_¥¦¾!Ò`„PEÝ·wb­óóµŸ6ÕÁ~ÚÛ¬éöoùû}—===éðEÚ¼-gÎœ¡´ •‡´@Ú m6HjÚª<¤ ÀHËÍÍ Wy7n‰DØFŽô‰*@+`Dý?c%Îä endstream endobj 1533 0 obj << /Type /XObject /Subtype /Image /Width 416 /Height 286 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 14232 /Filter /FlateDecode >> stream xÚí\išÿçîvoçÂîíÝíÿîs›oowvwfÇQ$ƒ€€ä,ˆ9‘(’E0‘š¬˜³cÖ1+›Œˆ F#9tC÷û«ªiºÆÑA±‘ßwžÓtWW÷ûÔ[ßzÞ·ª&bñÐOÙð!)r{¿›Íà­ó‡?˜Âç“®.ôFìò滋èNà½ðÑGLüÃ?UUHnß¡[¢s¾;::È… äôirå ÉÏ'7n¼<æçë]²´”ÔÖ¾YܼIîÜ!--äÉ“7‹gψ@@úû‡‡xØOI…D$ÂFž@Gl™ŸJä7Ù˜4‰„‡“»wQÈÔlÿþïä_ÿ•‰ùòñÇo?ù ùñÉ~ôÆñ÷ÿCbx‡aCüÑGÝ}$ñÕ¿û;I|Ç{É«ßõFA¿!m=^¿QзÐ4¾iÐäÓMÆn;ñ¿þkÇO*æ¶ã÷ÆüùÏÿ|ãøå/ɯýfñ›ß0´O>!þó]þ³ÏÈ”)oâ)Sú§MëÑÖkimí7 bjúfafFÉœ9¯ŠÅ‹_ÕÁ¨èRRHe%,÷éîfjªêjRSÃü¤Ù®¨xƒà–/+û!Ak?>ÿ£¤dxˆéO>?+4ôÖâ‘ ÅÅc\%üFA‹ásçÈ©Soôðtð Ù½{`×®SSáŽdÏžïÝ»INáñÞ8’’H\ÜGL }ãX»–øù‘Õ«_?î,]š ¢B||ÄnnÄÝýuƒ.LcéR²`Á‡³3™={äpp`x…ßèW –rðfá¾ÄÄÄꪪ‰9×7 ûúû &rG®»s',*JçߤñÿÈ”ÁTøMM8µ ÞØo´‡Œ___¡P8¡ýVW¦Œ~ûÙϘjÍË‹™ë±Ÿ@q`ùmìë7øMÙüÆ)ëO"ÙÙÌ9µövh ÀoðÛ‡S¿Éž»ÇÕ ~ƒß>°ú 6ðüöAÖoÀoðüü¿Áo`\!~{[·n­zï׿½§$ô÷÷¯^½~ Å>”m×¾Ûx§þvÝh¢¡þöÙÓ§JŠ‹F¹.Z_¾³ ‚Æ; £üÂwØG×2ú¶×ݪ}»ÇWo}êdú‰oe«•ò‹<@s9š•Üª½9fÍ›7kgš® Þ°Ü/b4ááµÜ/r”+¡á°n¥_ww÷ØìàZ²ÂôßÜ3 ê-´=0ÚÔvnî®=c¶õׄ„Îw÷ý7g#’í£éB‘NK<££×c¯o‹ׯ™¹Fî}H²ª•"¶×·€èö¶Ö±ð›H´c×Þ„oŸe×(EÛso“¼+aëbÇlë{†o¾öLI6}ÎM²ñÛfïU>Ø+Á[ó[ÞõY‹‚so^±RDF™ØÍ7²½­mLê7ê·=ë7¦•(EÛ³*ˆû–Óáë6ŒÙÖ_éw®II6}ŸÄ»³Ò{öJð–ýVÇv°’÷ŒßÊÇÚo1¬ß”¡í¬ßÎŒ±ßâY¿)C¨ßb7Âo`¢ù›p~ëÓÎðÛ8òN:€Ãoî~Q]cн•Óo‘ëãÆlWB¿­òY ¹Øoó–”•–Þ¤¶¶öÙ³gÄo‰g½ý‚Ü¿K†¦¦¦w´ƒ+•ßÒùdý±† >|øP¶ù---Pø`üfh³ÀÏÏ7x5kÖÄÄļ‹«g•Ðo^) M,ÂÃÂeHHHhooÿàë7귨÷¦«ªEDDÈnýììl@€]| ~³]à:HHHÈ„ò›‘©eTT¤lóÛeÿ‚Ù‡ì·:Uuõèuëd›Ÿ››Û×ׇ]|0~ dýÆBLL¿I›?1ýÆ5~ðü¿¿Áoð€ßà7ø ~ðü¿Áo~ƒßà7ø (ߘ۟ż’QÆtBú˜}RÌ<à3Or‘^*yU²ªÁèóÜ«ì^,yï8ñÛÈmLãîg^•´N!¸¶ŒðR©L~ƕ߸0âÖä~2ÏH7+»0»Œ$E’Ž¿¥¬ßhÏÌÊ¿¿bCv@nYJÑÐ 5ëvöX—îÍ„gÜ®C3«%=™W$ά!©nùnÞá±>Ó;ñT qvù«ú¹²ùÛ£ãåy®Ïlãžµ³jI:»çòŠzפì÷\ŸéIÛÈDt†{ÌŽØKB^AG`â^Ï™—Ö%»o­Î¨$ãÊoìÆb7YN%Y¿û¼W,Ó"ŸÔ [òÅÜÁŽO¶œ.Y¹ùTb¡DÝôgJ^˪øñׄiE}¡©»Ví{šYö=} ~ïÉoâô2“ÄSWÓ2tH¸ÒÇ0ìÚËÏC}†™…ÓR ÇņÆ&j*vÁçxl•’Q&÷6uº¶¾©¡¥®®®ÊWZ®ÛŸdVŒ›úý>$86VME}ÖlW ÇE†³fi©OS5ö^Q¯ ÕÑÞBËØÎÔÖÙÄÚÙĆþœcdçzº/íF“¹±–‰ƒô¥Y–¦ç³oŽ\Â)§ß¤ejêõ&ÇÙæêšzz³¬ g™iëè¨hÛŸéÎä‹i7X¿=UÇÄ}Ó Vwlë’.”éëÎ 9Ó›^عÈÉhfXÍöêÁê~Jã7ç·ÂÎÅ -  çÍ3÷;Ø”>8Yáãj±æ›õÌßfÜÙHB"ý¦ëϽ, <25Meš[jYF É­§Gÿÿ0_ƒà]Ô ã¥~cü¶a½¦¶ýæ:¦4’Î×.œk¤cá­ŸúÍÎÌhÉþ'ûÙWëٸ͌C©Ìu4—|CöÝ|žF-I-³ú­ˆ¤—õº.²Ð³ Œ<דÛ@vÜ!™E­î+Ý5LØá*ã·Yn¬ß$maü¦c ñ›£á ßP¿¥ò;ÁR"N<[5CÇ.üªÈ/ØÇÈïÌ6f%fýæfæ “¡Ûœ§j°xÃ!¯°k¾ÓL»uW²*‡fo2JÚ#÷Wmɦ•Œ/¿ÅhhÚ®/œv+%iùMæ3Ô¼w6¦Q¿™-Øþ&„™e ªwê7 ]íù;Ÿe—ÊþGñà´Þ8ñÝpôûß«6}fÐÑ'’ùÃ"¶¢ËëÞr­;…±ã7]“å[Š‡fS®TÀo@¹ýÆ O胈ÔÍ3ÅSÑmØ{L}ºÝ:j3vÞØkµ»á☰…¡; ƒyÌÌ-m¸Îã“Ô‚çf:šþû[ÒùÒ9±Ìt´xÜù-¦hh¦þtqµ½!/£¨ÕÁÊÄ&ìpØökkr®oc~†îoH-áü¦µp_çŽf%™4*غ®häéGeŸŠ3ªHt„¯º‰güÕúk*=®•zØâ"C2>åiêØûð.f\ ʼ˜qÙok–Ž®1ü”¼~£Ã“Ìják­¥É•™•$»ð‰­¹¶epYV57ÿ¶\ÓÀÊz¾»õ¼åÎ3M\’ò“‹Ä©7kë}‘.£–ž†+&ã±~ãü&AZîµÐ:êbVqÛl;‹V ¬çºZÎucÂy™ƒÏž¾ˆú™3²22·3dÃ`¦¡í¦®ôå¿‘Œjä¥e½jcû%Ë{ݵÔ×uÜZ’p²"æX9õGK6\êqpªÌ~K¯$q Áª3—n¸ÜÇn¸gn­?V±éøY µ…±¥œß˜ñiÑPR¯Taþ (µßØ2#»R¸t¾­oÀ¶¼À¬KYWöï1UÓ{g£Äo¾ûØ«›­ôÒ*\çèØ_Î(ë[æb£çq(»Jz•ɪêuwó 8üt\×otôÍ»|UwºNÐá'¼‚V{sãù9÷²‡]üÀOçïzν$7ÿ6~ê·4¶½Wót¦ª¯ÈmàŽV\[¶•Öii.ÜPÆù çÀ8Ÿ’äÓÅj“d¶QSqSÇYµÄw¹¡åª}´ŒY±ÚÍlõ^QJ! ‡Ïꫪ¸¦×Ѿ·ç„®Ê—ÖAã/u¤ä ·^¸ëê椪;7ìLçx;£¡eORió{b÷ž1Õžbæ‘™XÀ\bo1k^ÖÌbaJ0• æA‘(5¯Éb†ö‚]ÏsÊÈë]@«¤çOÅ•‘€Ou}GŸíÕ‰ù´ý[/Ü÷ ]«®¡ã™õˆÖälýæ®è·®߀RùMäìúÙô•‰U’ Ü=áÀ±iÓMão ,÷˜óåß>×ÐÔ¢¡®:MSÏr^ä1ö:OfÚyîSöNöj*_OW™ª¦®géùmÇÐãÄoáÁ_üéª:ZZªªÓ´ íç…³¹`€)c ^X«Oùêku5U5U.¦O›®ýÆlwæœHag@\¢‰‰‘ê´©ªÓ¾R×1¶XtàqZ)3M±.3nªºãÆ|¿/RŸüåšS=éíΦS4üËskà7 tóo)7z“ DiÜu›%C“iôùÔbQJ ùFo=I7úR Eie’“¼"öæ,>IÉï£ËЃ>wÃNêø¹A²wÛØ›|£/•½"‚W,bB3À¶.I6òhc¸¥‰Çûý§Ò³ÞÌæ+HÎgÚÈmMºq¹ÓÁ¼"š"ìa‹G—¤=¤ˆé6)ùtyî?J8>•»ý»µäÕû¬Xvöæ»fuÆÏý§£¿q^üaÜ_Ïû®í8BÅÃßõ½y€ßÀûòþ~þ~þ~€ßà7ø ~ðü¿Áo~ƒßà7ìª~ƒßà7à7ø ~ðü¿Áo~ƒßà7ø Àoðü¿ø ~ƒßà7¿Áoððü¿ B^ÞµYKBv6Èýó(ÃÿÁâ± úÑYUÄÈnјù-wמؓ$ÿpóûn~N ñN»<–~óòÙxá‰lÛßcó3+Hô7 ªjêÑÑðx;TUU}¡eº(,Ó9 ™‹9ÉŽ~[g¯Þò^ÂÉ«†¾Éš  1ñ›x×î=v+¢¥mg›ŸäèûæÍ÷Ýâ<ʶÓÌkÚ¸YÙ9EE¾s¿Ñ¶3~ó °Z¥Ð|Ú–7ßjIsFÝ|G¿ÄY‹5µ´Ö¡~o¯“ߪ­½YSÍ}TUYâê²ÌÍÕeìÃÝÍÕ××7L†wç7JoooÝ­¡æÓÇgNŸò÷ó¥Í§ßä¾ö-?òJ\]\\–EFFH÷îwZ¿Ñ­ßÕÕY]U)»õ¯\ºè¹ÜýMÛò›O…&Û|ø Œ^q ÏdffÑ.þžàv걩߆?ÙÐаeËú¡ï«ù\ÃǦ~ΣG¢¢¢ÂßÒVÃoà]trj’ôôôµk׆½dÝcP¿ OB]]ݦM›ÞWóGLÈ»›΃"##Ôø ¼]Þ¯ßFÜÁߩ߀ßà7ðaû-##ƒö+åÙÁcccÇÒo›7oV*¿%%%ÁoØ1ÁÛòÝÁýýý•ƒ€€ÚÏÁØ4¿ºº:""‚~h Ò@Ë×ÖÖÖïš1{»466R·+OÛ醠£‰ÞÞ^ì˜àmMFÕ××_¸páÒ¨¹víÚèWrñâEú}Æfïæ>åÊ•+ôCGÿÍéz.½ ªªªD"ј5ÿ­lµË—/¿­æß¾}û'DýI‡‰ó­”v?ƒ/&fAŸ¶Ü”­;)ç·Âß àÃæÕ×pNÄ+<_Ýde½Ýà=ö\ ”™Ò݉áÑ1±ò¬Žà®™˜ ém¿—¢˜‘˜è°øÝmý1!-ÕWã¢"b»HDxÒì>@ÉÙ3Wý×úë§òüù¿1ð811Òñ¸pÆÿþ¿¿È'䳿þñ—_ÌoLÄ„ÔÛòù~«ÐE>ûä·¿ÖŒÁî”|,ÖÙò ¾áŽ" õŸt1‹L¼¬ˆú{Ü©ž‘†»û'ä`LÐõ²ñNÃðÒðàÅÄì!`¼ø ³+Ûü}‡ñDë"è!`¼v^Ñ+{¯hÂußïßÅðÛ„î!`Üô]ög®í?ûï_ýFž_þ׿©->*³Ô°w<Ê›öŸ?ùÕ¯åòÛ_ý÷¿üÁöáû£Ýœ»ªmøý/~.Ÿßüö~þÓÉa®‡€ñæ·ªC± ›6˳)>6çDÝPŸHûs_ÇìøèaIˆM:Ð10ýö´öÆÖø ùؼ1vCæ• ×CÀ‡4>ÅüÛDO æßÀø®ß¾³ƒr/L¼ú Éëæéã­nÁðáÑÓÓƒðArþüùS§N!¨cQçƒK—.íÝ»y"bÁŽ<<-ýýýÈ_nß¾yríÚµ‚‚äAÚÚÚ-[¶ `|QSS“‘‘.x.7Š¦¦&²ÆK§-..¾xñâ¡C‡<<°²²jnn~ÀBÓ…Ìe>(Óý÷w¿ûÔožžžö¸L[M+ggç䡇€‰\¨pmOJJRH‹­­-v" üI;mIIÉDöý¹ÿþýèGÒ„üþ÷¿§Ƨ?þéO*ë·ÂÂBì;@ù÷èmÛ¶I'ßÈÄžT¡môèѯ~õ+é^ìää„œöάyóæÉÎÓÌ¿qÂÇL;mllìDî´Ò†[YYIwdÜ…*eïÞ½ÒÊ6::~ãe§Þ¸q#í´ü¤?×ð††n/¦#²––ìÈ?ÿùϹÌÔÕÕ!!`¼ìÔOŸ>ýâ‹/ÚÚÚ°/sͧ٠{1w¯%ä&M7DýôÓO»ºº0^ºnooï‘#Gúúú îAvv6Ý‘wî܉½X63/^¤iY¼x1wñ$ÒÞo¯|Í~+‰ƶNJ•yG¾ÿþÏ~ö³ææf\¥¯`þ_üâTûðP’>yïÁ£ºú;·êïÔ)AܺÝðèñhg´ÞõžE×ßÝݽqãÆžžžq´^ů^÷|nnn~~>䔧OZfÚ,˜·&ÝÑo‹“ßÖ÷ÎAÙz¦|™·žžž†¦–†Ž±µkløÉvÚ%¾kïPžú~ÃôRæ¶tI”ºYo½$³L«îá/±ïåŤ…»á]ºNNbÜ:ÓøÒ Á<“.ý\ö]ì“âñ[¿qï’ËLé`Z†ç\>{ée#$œ'9š0o—. ]'—X&‡¥CK2ŸU:¸±èj%9£~›¨~㎌Á¢4çðæ;hyæÞ“tTÆoz¶>¯·%å=K¾Þ²rÕr5]‹ÐÓô-[Ïݲ0P7\¼1êÔãÄëO6{g™Û‚éšækŽw²=P¹Ç§Å±‹ýSOù¥Ð8˜“¿á|GfI-bk€¢ç[ûñÎø¥ž–†VÞ–|£/%ž}Þ7åìºOiÓè{3ªIê¥k³.ø¥ž Ⱥ¾ábwV¹d×K/i L>©s(…ÂÈmçCOwf–’Íß”ûå”$ûñiʵ~‰Ç™Ì¤œöO»qä~F5˜8•IBô¾|™Ô1‘ôMÄYaf¹ ,û¢lÂýSNødTñXq¥Ò®ÈFíÉ£ïõç]?t—WÁ¬“ýDaäöËk¡…Ê"Ë) 7Jç:¸*%³jhP¦Ü~¸{.59›[G²kHN5‰ÝsÒXgºéÊ©•ÔoÅÚ“¦îιI†¢šycF>_wºQøù.Ù—2ÙAPøÖ-jêæ^Ù¥t¯¤Of—‹ÂRxºº¶þ§ûèn’SV£÷µ¶ï¾»2~kw¶1°N¼·½š„G…¨Zz~;yTsºYlÉ©a"ùÒ7Ïùú‹×_êM+ìY´ÀÁ>©n÷m"—½2’UþÒÞ@ÏvÝ…m·åÎ'©§ ŒÔÿf±"{S>Óy¶Õ-§øNNsÖ_b6GYÇ<[Kó5GÒˆü¸ZÓÄ)†ñÛKKm•ÕûÀov|ÊÌ`Ô° ›Y.É…"ÞgŽÖ3lãïo«bæ:˜ù·)“U¦NQ™úÕÔ/þ:UÝ|Õþ¶ì*Ú‹zí´'/Ϩ•L­ Ÿd.+¿ßLƒŽf– NY—“ø¤8™‡z²ŠJ´?Wñ;òDñûs~S™|â©ìÉeæÕÂnG[9ñùt°™*9ó"æ $^íâ~@~S1‰º$ä:­‡ÓK:f©.ˆ/Iç÷.Z0ÛvciN¹bo̪xi?SÏ:ôDZ™ÜYû ~ÿª`/Uq¥Ü)ÉT^Êîä‚~ú8SÞoLí]EÖ(øm/ü6aë7¦xË)®6øê+§ÐÝû+×à/v[¬m´bSÉdë7}ÇP{<Í®$á›7i«ªzæ4fT‹ ¾tI©œ-erS»ã¨~“øOr‹ ´¾RuM)Ë,âkþµËÖKá{KÃ÷pQ}ò9]†õ›AÐѦ”ü¾dIR‹Iêõ³4Ô=“T³EýÉ7z“oô1? ˜“ÎÔo3¦¨-K8º«˜‹°WmL´>`¿IÎ —ô{,2óÚÆã /v2 Ü} \šÕÐ}©|’ÍúÍjíÑ”"ñ`VûR Ò :—8hºäq˜~«”‚>6«4ôÂøÍÞÚØ}Kø¾r.«ËÝÝ–j™Îßà7n’-42hºš‘³oü<ï¨yÞë®Ò˜ªíµ§%«Jvþ9 ‘Ó@üëšzìH-#+WX¯8˜S)™“§ dT‘¨ôoÆÉü›œß8?o¯l˜ùմʼnE…|¿}i±$ÈyE¸$<׸m*¥Õõ›Î_êY03E4¬ôÍ|vÝO¹rs¦†Vðñ6¦,% û÷ééÎÔ327¶rtð9Ê«dýöÅWæ W;y¬•Äò}­¯­ï°~“¬dÀ7ÔÇÈ-W"\ê2_oöŠy+#³ºvöªý)ŒßLŒÕg˜ZI²j``x&³¤kžµ¶AðM:,¥'åúó¹‹æꙘØ;Eo*È*ë˜ïh§c¹hŽg(—Ug¯PKKs3gøm¢û;í~½ÙÑn†Ûµ¬ZÉ)õÌjâå¨2Óã@ºœß¨ÇHÎm²h–Š¥ßAú8vÏq­)_,ÝÛCÇ­|ËÁcšÓ5\3ê3ÊÆ™ßxlä\>¥:UsEÆ-¶~£ãÓgC×<^ÀÖoú‡%åu%^g#¯;¥ˆðòšMµÕ|÷=N+b²šZ(L¼Ö•ZÐíå·H×&)µfp|ºÿ.wSt|ØãS&h6øB66~ûÓøf|º©,§\&«l†ÙúMßjíZë%ö†0­ kÙBÕ9'sn±³H”|£'1¯7áÐ-íEñüþÁñéQöü‚¤÷b| ¿IǧTSª“u®“,þàµF¥dóÁµ©FÑWE¾kVªjY,‹Üæ™å™>w¡“–Ùâ5‡š˜þ_Ôã¹NWcº•[´K(o‰_¸á,ç¦VISúëߤ~“^dEëØàµ>*Z6açIVa±tþMîö ™ù·tÅ -43_}0½R²£1¬&«éXlò›Üü[Ûì7ÉÅiå$õRµ‰Öt÷Ìú´’nþ-»L6«L®¸ñ©uØIî4¨4ÒKEA1¡*ÓLB/Š3/rK/#‰§®hjÌ‹ã÷gIüvXöüš@ø ~ãfk7Ÿ©óßVVJdïÌJÍï\›u!áJ_Â7¼³þlø¥ž Ì)Œ;ßNcƤŒ … 'o­É8ç—rÊ?íÒºãM)ƒϸð›yø…ÝwIn=ÙYOB6nTû|ò^=wþ4ø¼`GÉŒõì…»2ç®kÛ}TSMÝÁ[R9aÞx‹„§d¨ÿÅØû,¹O ó ªñ|’{›ìl [¿¹jk¡«g±)_Ä+ìY4ßÁwwÿ=&ç’¬6mµ$«ü­ß¤çäWØâhø7-+Ÿðs}»ÉÎ;$éT‰óscߤRQféçO×àü)ü6âÍ5Åb™»Š¾çfUù[c×ÃSòû³Š+ü¼Ô5ttõtõfL2Y]×|IJe[ZP¿é|>IMSKSS[Z&þ‡P¿ÍP5<*–; ]N6deëLŸ:EC]}Ú×_jè;F\̪⮫џªë·ÿžôþ,ê·¹vF6I¬ßÖ…©Y®×~ãîÂØzò˜Æ¤/µô ib5Ô¦©ªiÌtŠLàºDaÏ2¥jêêrYUS1wÍÍ®ï¶72° ;ÉúM.«©Ì}óœ­ÔU&OUQWUùJU]ÇxîÚØËÂ4æüiç<{k‹à£éeƒãÓ*ä«mÊÍ¿½°ÔUóÝ÷÷gMp¿M´¿Â+H8Yº3?da{Ë.÷d–±EmáÛóBwФ²£xÓ•næ¥Å[òúäÆž3gT’ô‚—ëöóCwä‡ï¯ÞtU˜]-½¡3|GѦ«ÝÒw¥õÇ(Yw¾'/Þr¦>tmrñø®ß˜Â>ïIèöëlViÒ £O43÷/p7& Ä«–Õ¼ÈCÒÊ¢÷¯;ýô»NñÓM¬†f5twIÌ©–ôJÆ<¬²úc–Ez2tÀå“Í'o…í«H*¢ Öí.Øxµ÷/ÀoÌoìþË— ù¿ ÷’ì2%r ˯P¬¸Ú¹ûO¥÷ ÝΗÿ2Äý§ “6j„Wƒ«ý†’?|X!ŸUÉ…pÅÃÞX,³ Š‡e~ƒßð÷ßð÷‘ð÷‘à7ø ~ƒßà7¿Áoðüà7ø ~ƒßü¿Áoðü¿Áoðü¿Áoðü¿Áoðü¿ø ~ƒßà7¿Áoðüà7ø ~ƒßKã‹E¾Iy­qçZâÏ=¡AÄ}o‘x½}†õ"ŸUÞðü¿Ñ ‹{{{yY[S³¶¤d°‘¹99}‰›§…íl ;§7 K6,F–vslíg‡„„J;̨üvö ÷¯ïMðx~CV¹M~Sf¿QD ƒ! …;wî yO„2j¿l¼Üž]M²*£ŠdǪ&)EêæoÅo>׆R:‘³ZÅüíÍ¥ëvÃoJë·áOö÷÷ïÚµ‹n£°÷Êèý¶1‘7©‡ëJ/~î«mç,ÔЛ¥5Ól,CÇÈ‚ÆèðPÓ5Ò70ŒŒŒ¥ßjjë–¸{³)eÂÕË¡ëJCó±Îª¡…®±•–Á{ΪöLóéš3V­Z¿”Äo£œãÔÝÑÞÖÙÑÎE_oÏéS'½WzøûMÀð÷÷S8jü¿1I‹{zº¥Y¥ÑØP¼&hbf•Æš  …ã2ü¿ßd«Sî!]I@@ÀØV¡aJÅ(ý6bÍßÜÜ,[ŽM+B•-³ðÛøñÛ¶mÛ‚‚‚‚•†ðððo¿ýö»Ô¯ÏØûM™ùa~ÎØûMɳ ¿)9ׯ_OOOÏ5ÙÙÙ™o‰{÷îRnðü¿ÑkäÝ}«·R¿…‚A¢££ß–ßL)ðä6ÆrãÞ{ëÖ­˜˜˜-ÊÁæÍ›ßûwHKKëêêåÖéèèHNNFJe¡Ã ¥Ý›À‡ªn Ý»•€žžeø½½½ 'b~Ø£‡¥ nÜQf€V—¢×Mœ²¼O§à‡ÃÝõ/ûSö|Šãhk#H `Ü MZ¶55‘Ü\¢¡A~ýkFq0NÇ¡Rø|’”ÄhíãÉG1ñ׿’ŽŽwX‚¼±¯ã™úzE¾þšüüç­IãÏ&OŸ’ž¹ ™A«B€1›48"€ïíTJ™™äóÏ&?þ1ù¿ÿ#ú“\ТŽ¾K6&Mbô¨¢¢::dÆ ¹Ð×'ffÄÜ\.†?CÃÒ’XY)† ±³S GGâä$sæ… cñbâî®^^ÄÏO.V¯&ÁÁ$"‚„‡ý5>žlÚ$›7“Œ ’-t\ø09rd(è¯Ç“+W£¤„ܼ)ÕÕäÑ#òü9yöl(è¯ííÌ,Á÷]ìõƒ–å¯#DW×ÑÝ­ ‡E.z{G`„ ‡Q…èïáÀ*1Y!p\—/OOòÅäïÿ~¿ý×__(ÄLJ¬Z%+W2ëQˆåËGˆá’1è’K—’%Kä‚jÊÁØÛË…µ516V *RmmF°Ò ¿ª©‘iÓƒ¶úYô׿ý)\?ùD.¨çû[Åøå/Éÿ·\ÐŒýû¿“û7¦–ýõŸÿ™üÓ?ÉÅÇ“ýH1þᘴÿÝß Å+Ž>?8趦¤?ù‰ä[Iƒþú³Ÿ1_^6hshZý?ÿC~÷;òûßýõ$Ÿ~*ôÈøå—Ì¡P!´´ˆ®®\èé Å£ÝÖ‹ÉõzÌrsS¦AêêrA—“'ËiÐá =*Äÿþ/sPˆ_üBî È=r:t¢ÙC ÷V¦)dsxﳉieBË º±Þúùçï(WH—’l:d#—‡ÁeGèô]àÑÞΩ餧ÉÀt 2†¯÷–sÜä-¼WÄb±äâᯠ=+ó@~ éãž{‹ßQüšk—Yà]|ùÏLÒð|¾ë¼>Øý±ùN͵Ë/\¼TTv«—yEDŸm»_Ä¿ùPDÈÝê¼;[e÷\æÑ@¿ðê½æÒÓtåZþ³6á;ñÛ€°¾*ÿæý¶×ZºóÁ…+Em½¢±H“!Ò÷âAÞå‹× ø쇊!7”ÉoŒ§öD¹hi¨›Ø89;Xjhª›ÙxÕõ1¯–oŸ³$|Ýo“Vêl<À—©÷Ø}‹ìfdŸ~L:órEûðïŸÊüTXáЋâ¡;b< ‚2ù äˆo×ïüBË©¢Y¨¸ŒôåëÍÁ_†ÊÕ×»XGíiK #s‹šÖ.aÍ]¿ L4ïј¦{ñ^§ä÷—KÌgøm<ÔOHYŽý‚µ;ýbÑ@ÿ€H"‘°¯íå‹m]Dpw¾•fúñ»´Øö÷‹è®Öö.Q¿ õÅóç/ZûˆØ]¾»£õÅ‹—=BÑ€ «½³whÔ)uw¶w 8Áôw·Ñ5pŸ5 èkmkë‰ØO'¢þŽövºÊÞζçÏŸ·wöˆÕ(ìëa¾]mýŽOUíË 9Q‰„½­ô…/»û„l%ØÛÞÑ%{ º_¼l˜o(wµµöÄrüN1Êô¥åTßô+ìÝQóó¿úí€1¦æl¼º–Ó™!]Û£-/ÛŃ~£JÙíœs¦šqNçó¬h«Ù®nî IIsìô2O>"O[Ú/,¬ïWn´šç“æ¾lgPÚsv…u§Rm­,^â²*þðÞPÈÃÒúM,~³)Àïh÷ѧí,—®yÜ)¤¯Ý¾~xÞü€çbafÄ„ýÕDÐè¿òÄ®tŸÕAk}–YÍ÷<[ÒH¿do{ÓúsºxxzïÊYû7‰ßyQ½Î×ÅyÁbúMæ. (mêxÙpÝÍo]/uqÝbhlóMñ=úXÐÛâç8÷â×҉µÎ÷ÜH†½O5wöuu”¥OR_Ò2ô„¨¿ãS”epÊþxRél0YßÑëÿÖ³—mý2Ã4©ßx¾3·.cŒw"AUsn O4 ¾’í?eŠZö™ÇäÑÁéÚ¦Wo IuÔÿ~¦•{©Z tÞºn5cZÌ™òâÊ õøƒ%´({Q~@wêä¹Aûd¾‚¨èXÜdûtö×; ý%« ^ñÀé´åþÇ éŠ÷6 É)%ÂæÕs¦i.M¥%•ñ9}ëU‰Ý„\Kq4wßø¬£GÐѲÉÇñKÍÙeií)Øâemë×ÜI‹»ÎSÉÞS6õö>²µ_òŽ"IO’ßÓåî¡i§éªºNêXz4· ˜ïÃüGߺ¸ÐÊÌa{c‹¥%Û¥ç˜Á{’§¦ç†‹“Mg¨©hÍJ;Áïc¥šcvÇö‡•)Ñ~&úÚ3fÎrpZ—y´¥£o¸ßèâ¹Îö[®HÞü¢Ú^wjæ)ê·Cª:¬ßj¢¿Ò›WßÒɬVpÛÉJÛ?¥âþÉ,uC›ên‰r<Œgì•ý /j.êeTHˆ°(GMIjFÊŽ •â¾ØùVIù÷HÇ ß»Úéïæ?’”OWS£õ›Hø´Ì|ÒgÛê$ml(0þrò¶fòðÛlu­åy…ÇVòqß:Oïõõ>úÓÏÜë–MÊêÓ&ª_kIÑÔüBÅ2ïa«ì2Ž‡üÕØ¿µŸËœèÛôµÖ¹èO(ÕÜ~Sm§°{í’k*èxpÿëYK#Û„¬ßBäæßÎ%¯ÔtŽç\P!Có+vþí;üf­R&à®²–¹ª®¿õö"ýéÎìüÛàµlUÄ>ÃÔÐnmS?ikt³·Y›¼Ö?îóš°#ÁÛ$Tâ7s¿Ñú-¤SLr—©¸ÄåÊ·Qž“4g—?î'¢—AöÓÝãÏs —ßø¥ŽÇ ÆÉ…†š Ö&ì9[Jµt*)0€alìõ¬_n`9Ð/èh—£­½C8 ’“rG…Õ”©i×ï³}ºhVÔî<ŒOPžñ)³k¶6D¸9›ØÌž3wÎl sS+G׋µŒ ŠR ­WeQ¿mt›³§ˆ.Þz·x™¥ž±õ7W—€@¿™zS·ºGîïúd’ÆùJ!©ú¿i³ZØ „ûn™êNr/¤ãØtŸÙZº&+V­rqñíè¿Gq<›ûÉ~½,¾ŸqHo¢›í>ûzw!;¨´‡/Q÷I)"‚GŽ&šŠ%cÎŽ ‹¿4ò~ÞMžÔž¶™¡a¿ÀÅÍÅ5&Úå·Ÿ=d\ý¤ü˜£¹ñ×ÞKLÍfï-à&ÇH¢ÕÔßN3ºZ÷„~võùÜ)Ÿþq^Äñpï¿rþûÖ5§“Í ôçγ27ží~ÿEï °Ê37Ð|¿¡ª²¢¼¢òvãþÁ}¼³¥®þÁSú¨ùnÍãçÜ¢}mOk*+*kêûDý÷êjšéNÝ÷¼²º¶½[DºUÖ4ô Ù:GÔ{ûVõ½fûuU¥e•ÏäJêüÙA‡eê7‰5žÜ.kxôŒû:Må•u]}ìèR4ÐÔxóÁ“N"4ÔÝ|Áœýd×ØÞX]÷@8À¼·íé#úÝoÖ? Û+*k;û$×i;ŸÝ¬,++¯jieO4°ƒØÞ¦ÚŠš†}§XØÕv³ª²éi×(»¸èxú ²¼¼¦îN·@ŒûP²òmÄ[,~ñÿðÇÃʱ¬6¥/ îǬöÚyþ&S™½¼»ÊL}ÝþPá6ì®…Ç#¯ü54"é ¹7~Çí´¯=²9ŸP§>¤?*O§Ûjéêékjj{De?éÂu°€Bp"ñH£b‚yxÀøÖÛw>‰ ðÁòÿ±-Ã= endstream endobj 1543 0 obj << /Length 834 /Filter /FlateDecode >> stream xÚ•UKoÔ0¾çWXâ@"±®íøn”GUÚí©pHw½mDK’öß3ö8K¶­*P3žŒ?cc3rK9KN—ÉÉ»\“‚Zh²ÜÜhª¤"FZ*‹œ,×ä:½ÜõÕªËl!ŒM¯×£w¶«Ö.[p–¾ÀÀ…«]98äTPž}[¾OÞ.“ ‡áÄ—Ô0CVMrý‘5ÄßFóÂ’_!«!R[°5¹L¾$,²ý‘H¡¨P!%ç–åÑ$ãäíä¼á€û¦ƒY¡69¯ rs›S˜‰e½ý]6ÛÚ³U,åíy[W­;9ÿ|‰ã¯L±>ã6…Â×ÜÔ{Œw-Ú«O™`é«L©ôõ‡ço0¸†Í‚‰³êgÌç4çZP+ĸÏ‹câ¶ÌÈ{yç9[›öN ×Þm6é]9àÿ±ÃÀ÷ ŽÈ¹-F·å cL«ZLk\ÓõûùT›ÞDÌò¦vÇ M‰(-ï1rkÌF54[H‘§ç#f­Êö1ŒÝnã7¶j[U(e¡l£Ó²év­‡2ʧ†ØÍ~tºƒcÌÕ]&Tú+Ó* 9¬x1¬ÚÛˆ†@HCUD 4ÁºŒ«ô÷ÖµCåñ~ú¡‹ëo]_ŽU×| òÁøl·õÑ_»íx‡ÿ÷Ýc«i‘m?u^¾Âò§ÉQ“UÔ_‰éÍ¡<7h‘8ý¬p϶ý4Jyí6þÊ]=N“€7Yþñ”1³ áþ– sqvÜÜÚRÍs¸åòÉ7puhò# Ëá’ÐT³'!àP”ñÀ‰ÿ€:Àìad¶H3ùl–&§…±¶wdó(îtÝ·¡qµ WË©q4y!ð ÿ6ìËpÄœQ£á˜slnhÂU¹}™-4c©6p+X W“±0|ö**ßÿó'ì­oçÐÊ~0)Ãû¡%P~èûÖÛïá"ðÞ”ˆ}O¢›± ¢‹d8“V- 湄[ÈÇ£0çœÆé߱꼀ÛÎ'%¥dN¹µÿ­‡¢ÉÔÿhòþ=bJR¡ÿù {øÒú— H¥a)‡¶ÔB^[ºÏrèʦ#§ðz`Hç9ýˆÔ`Ëþœ_Þô endstream endobj 1534 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 425 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 20034 /Filter /FlateDecode >> stream xÚíXS}¾çgwî>{wïî½sïÝggî̳3wÊ;ïëk¡&¡÷ÞDé"¢¨ ˆ€QAB±÷ÞVéM 6TDQéäì9I¡¾ˆ ¾Ÿç'žœœœòKòÿœßÿ”&¡P(àóù=ª©©‘Ž&–êêêÄÄDggç•+W†††"'&¼zjnn˜?¾@ D @ •––FVOŸ?FBÈ•¡,--Ož}ñ‹øŠŠ d¨|üªóëõ&hzz·¨Z8ÒÕŠÿt|ã‹ûåo×®ù²‰)|Xýšß»ö#žKãÃÜÒW#|¥™¸ãñ¹îeIa~AañóÚOµû!ìj,’ÉIaqٛƖQ¬ÌãÊ‚§oš¿*'}– ~ømÕËóó JÊ~ê|ý;˜€ŠÍfåëÚ´¹¦6nó]I, 8l†Ñ¼pÁWÎ¥ãk¯æ´ÑºéÙ×ölvÆ ƒÍdÚÔwOxF›ÜéêZ–âÌؙ둙±ÜùµsùxÅûg“ø6ÇBA‹±Æ‚Öp}=ƒ¦ndáìb­ËRWM¼òtb>cMWµht+gQFæÍÕ×᪫2·ä4ÉøuD,›Ç I0Âœ¼;²laÔÙŸ¸`G.›«çæ±@O[CIÛ­‚@î Åd2[Z¾vÏ–””fÀáüÞYµT:*Ï^rîýеŽp v¤’’ݸ=O>ÕRpüÒg 5øpë<‹€ÔyûYr#©57{‹ îù ³ÖÝj43}J!™ÌH%%û¦ |ƒ$cø%,Ï.Ùz“¬R[ët*;.V‰>H]ð³Ah×IŠ5‹UÐÖ;æΞp¦ŽUS§€d‹ÙRñÃIÉ|XžÕÓ3æè*×¥[¯÷M¯ðÁ‡ækzV¤s½ÊüØ|h y6”··wUUÕ׿š’Ôâƒ÷dGí÷UÓñ¿Jδýežÿ\3WÏP›£m:ïtùgq;Prv»™&M[GKMË,ùLQ¿J*owˆ*Ǿ¸zt!m½—mjnª®¦±;›jê›ßºZ몫k˜[Ù$?–­½„Ÿ½$¿-;$?’Z}ý…l“»yžŠCx.9ØüðÊB––ËÀvÑͧ­â)nˆ5ä™á2ôl÷ß~Ò¯’º¶Í—nàùè“òŇjkj˜™1†–RïÄ›r3m†º¦¹¹õÁšÞõtwTU”~îJéûë¤y}šOšHRyͽjtY‰©ÿô3ÕC|wo¤ƒ®odÌTãøD¥óÅS4¿ˆ\ìLgj°é*Vk·÷«¤ê|õTÝ7žõó¯t³dr Lt5Lç.Î{IínÝßâÎÑ`kë9/lëý°»Z¿|hn•>ÞæÇt^w’@n9wîÜ¥K—FõÒ^II÷ÜcLgZm~Hí‰õò I½•¼LÛÊ›ONôú8íg­« ¢]ØŠ½s ïwI$EuÎîbi¼£ú ›ËèªFÅM¢×ó«¬ÔgìÈ=h8¨<Ûùã5…Jªg%;—ëÍðLIm r]¾MÒud»±×:*qOÒTfå‹JÄ/9[f*Ú<—‘Ôã+[z6ÏD§[¾¹µ^mó\ÔbŸ ôé3OVŠJàçÉÊ*ž­}+©¾µ ?}¡žÕº£ÕÝ×#)ÉÚÕç iÖµò‰¦Û¦Z6×$î|í¤ [AmÞîÕöfqâ±+Œ \w D’ZEJJÐaɘ{†š +ÀDË}ÃIñ”Wc=èN«ÅñÞfA[® V¨í_êŸ<~t1y¹–Þ‚ŠN4ÈiõòåK‡3ÚË D’:”'~Àïø¸g«Ëúiw¯AZ?6¼~ýºìÐFº‘s»€¸±ÎƒëÓÓh…j"JR:a¯n2Øš%ïÄÝ0Ýé,Ëw¥KJZì´ |¯¨ Û£<ÛñÝ+$g’z)~ÐÕRŸ¸ØrÇõŒ[›ëÉÌä'Òí—’ãNù›ë‡ï—4¦B*3=•Ô¶·ÅT¹¦/[ÅÅ@W¼‰òÜÃÕ= âGا]¥ZÝG;”U~º^ÎßéN£Ï}Ñ1A6±¤Z$ßœ§­h쵇/•ª°»¾öMíûw[,fºì%«ÁO Õÿ["éÀ“t÷­Þ]y4€«½ô¨ø¹î–‡ú´ÙWßJ«Çr¿³sD›åi¸éü ëS~>’Éb1:k3²b°þe€tôÍŸ?ÿæA8¡®ÉÕÓ¡oì»&¡²ö³¸¡ÍJàj°—¬‰NرcÓ²E JRi‹çZ‡$õÛ¯%%¥Ä42ÑRÕ4ðlˆW¬-H“¥ÎdHQQRÐñ^?¹$ÅÐÔ'FÏÐ4p}Zuc«x»Ä.eq´–GnHܱ#ÆÛéHJJkgyÑU2(+Ì1‹Ü;Œ¤ÄùLð5V6^þºE@|å‰ c()-:]C[œ]3[×ä“9mâÝ•®'~f:4}× [¶ïLMöÔQœKIê©ñ …}oúÏgÙ|-}ã9ÊÌøü÷’}€7µe3ÂPûùo?n¯NRÒ]²öæ÷kݵæ¯>G ‡$%%øøË]âJJEÙýƒlë/º"èüJ-¿ŒAÜ5!Ý}ƒ]átz½Ÿ¡W¤x¸µê˜º’Šc&ubäfw†ÃjÉÑÒœÌPUÝùTw3$ƒÜ{ì °e¸Æ[.ä·8êÑãNIÎü~®:vöžx £<Í–l<×w›ç‚,U\¢¥‡¡RBlÍæÇÀQÈqqqOž<7IÑ^Z¦¶[ã7˜rÕß;G‰¼!±IHì0fk/3ÕeXzm&úœÝ'|¶Ïïgõy/¨£ám^æZ&öQ±1 -uè•â£U]¥ÆªÊ–ó|b/ÖÉ8W°cõâùî œÌX,ö\7w—¹‹n~˜àJjpI?;m=ÛùÛâÖësÔ¯Þ:KQ3,1³ƒà¯vÕåè›.4ÐbÌ ÛOô=»¯b‡Ól¶YB Úl¹l®å¼èØh7SME†ûKQƒ+ø”­£FwtóÚyû£´Åm_‡Ã´²ŸçÞÃܹ¾¥mTI !©®ûèóC6®vÓóM¼š`ÉÑtÚUXÛù茪Ýp®o€›%M‰½ëef™³û:—ب-Š¹_œ““STñ´C´+øXu+ï‘P²û/¸ïfÙ3Qw– ¥ª¬ ;;û^QE“è¶â)j•ääÜ}ÜÐ)»¼Åù9w)rssÉ¿Ùwî¾í˜Àw•çÜ}ô¾uÐÌZŠóîfçÜ{ÙH®¢àié½»÷J»Éíã·V•’™)}ð¼[”™®†û· ž÷F]¥¹7«Ä7[èþ\Y’Gf&¿äA³èÌqUY]QH&üùÇÞîÎîö¦ˆ›~ó"!}}`šñþýûɸæ$55%õ·¿‡oßöê †ÓSSÓŽŽŽÉ¸æ$5u$UQA¨ªÛ·¯_£t@–ßüæ7“tÍ!)HjêH 0d 5gÎH ’‚¤rH}}½««+$IAR9¤¦¦ÆËË ’‚¤ )€R]]IAR@yòäÉÚµk!)H ’@RcKMMÍkéùºãϤ¸Þ¹  ©¥»»;'' )ÿÅž¾Kù,þnA.îû,ÑÓ7`¾»Gw7„©Èʺîáíÿ=S! /¿qOˆ•­CÍë7£û<|t‘oÀw͉o€—à÷Y–…µí$½.€é )Û»«ˆ´²_^)‘RôË“ÉUìz@Xx…·´´Ž0+BV' ‡šÛ¤Ûü~á·ýrjÆîÑ}H\|‚3îÿÂÇ#µx²ffáúW._D«€|JÊÆ= £‚H-ú…Øp¡ÆÌ3‚WòËSÊO¤—æ‹ÂZZ¿BRI÷:UF9¡ïœy2m~¿ð‰?ÇûI¥ ûÖ¯=rßfɦIš™‘{®BRLrIÅžeä2}%UAh;@RCEØ¡r ßõ’‚¤ )H H ’‚¤ )$5Þ’êì삤ĒÊؽoàVäìë)/©ëYWG—$õ-’2^²aãÆ-}9|øð4””ÿö‹ÎóÜû¥bûöíMMMÓ\Rná»y,è—™¼¼<´3@Rã.)÷Õ«×DÈ@æmÏž=ÓSRÖöN²©'%õâÅ‹i.©ùá™ÎNý2sôèQ´3@RÔÄJjÛ¶m$$IAR$IAR$IARH ’‚¤ ) )H ’‚¤ ) )H ’‚¤€¤ )H ’‚¤€¤ )H ’@R$IIAR$I0¹%U(L/E‘d¤x ¥°g|¿}Iÿ§„)=/…hþ¢—¤È«¤zWX< ÚŠ¡7p˜œ xUŸù÷f† rÛoéEƒ­RïL&HRâU-îýTÈ>%}—‡š›äµ6s¨ñ”¬¤Hq¤•!·šZXêšÚù.N”^.i:2Š_šqõt MudCG;ð¤ <ÜYüP×ÐL×ÈL<¶Žeðþ‹K»~GËÄ#éÛÚ¢ñ¹žî ¬BŽ¤÷>›x5OO_}d+»âa.×fõ•7Ò„H7\ÇÐÄÀ:$©\¾\ÛÐLÇÀTƦóÃ"¯<A;Ï5õÛû…Ú¢òN{ËÅ<Þ +)ÊÕ­ §¹NZúæöÁû’û:â;WRi%µfZN‹™8fg²‘sbrá0o\ó\Cãµwú¿ûi¥íîfF«®´òPII !)²åLÊ*5ÕSãÚvmÙ¦T¦’–sìÎ2ªUÌ(y¦« ì°)kuÆÐôžHËÚ|G¸íÌ=ÑÃ[«Ã˜\ƒàTê©´Û[îõÝ‘."¢·nÒ²YGî9§ÈŸ¤Üì­w§Ë4Ú‰—ïpÔU"oqÇsÄèçïÍ4p ͸)ÚÀì­wÛÖˆò°fw–ŽŠŽÿÁ5™ÔSköVèïï©eí¶;{Í®l2i‹CWÐiœå§ÅžâÕêÐ ¢‹ˆ-Žè3•õ M =¶¦ Öø'^.Ф+¸Çž_»/ÇÓÇAÃ"t»L¿o%E¤–®ö ׌ÖÔÂþURÊÅë MËÄñpÊÝw¡» “ó×éz½-“šÕN­Û½«wåî,ìŠ9œKÊ=òø³Ñô[dé†'‰ú?·_(;ñ1þ\yÈžŠÄËW™œe ¢¥”Âîð½wâ³»6Ÿ, ͸µöЃ¤‚ÑôBRL%Ií-RMM×-ú캣•Ñ§ËØ?{îoŸŠÇ¤<9†vnËbæÅÌ_¶ÁwËÕä QUUBÄl_Âñ¸ž*sžÀ’*û`ASZp¢½GRÝ^ZÆQ·3úu÷…×ë¤6îæ± 7îKJÍx“ä'?<.šÞOÓo“’ÒŠºÞ&ÞçÙ–æ#‘Y§ß¹ÃT÷Ý~Ÿ’ÃrWJOÒòŠ9´yñåIù¤<—8ñdœ2Ã3’`X„B¡tPfäÀg'«¤Ò‹Þ˜Ð"ª$§£‹4•!ë¼Æ@Rä óÞh«iEå¼âgŽÅÆq3Ë+|©¯6cŠJªï1)éÄBOc%ÏS}θî')é•P¼ b‰“²þjê}¡Fæ7q9>™’*C");Q%þ½$UH$_+g±56ݦ÷‘q±ó¹'wÝ-\RÔîJ—±¶bÐù¾’7hk¬èu”I0::n¹9.zÒ.;®-q¡}äS ’"[’¸{Ôé,»ÐãI¥DæbWiGpøjM¦’Ex‰äĉÙÊ>Wˆ]dW= ”!mQ‡”T1‘x8ZÝ:“G•èö4ej]ÝSEd” ¬9LEŒVê¨úÈÎàšä’¦ß)`1L¶æ ÄW7gˆ2¹4ÀÛpQÒnQnE]d‚¨ÄAûjÈ·&îà^&Ûpýmª¶Ý¸3†¡b°1gÀżááRK%%ä}±Ñ`-?Ù1@Riwï²èî ¹UCTRÔåÀ‹œ-£‹cûTRB‘©Ý,Ï¥@RŒ†öÚ3LnE«ì¸ÖÍ9çꦀ¤ÄçœoÚ{ÂÎÑ–®ø3]yŽŠŠšÉ¼UK3«2$×I=åþôƒªÒº²‚Lülr^ÚoLIUejo )^‰ ÀJÉaç#ñ¥²;/^2⪰uÍõLü|ðõs )s¼Oó'¶’šga¨ç—ÖGR—nª)üq½wLdÄ U=×A%å¦ùueÛ|OMû5¼oHØÌÐ÷M9-÷WIA®JWQ$ƒ )éÅÞ#x¥ÝZgø^%“Ï+ê^©AWV§+sŒŸn‘çÄ܉:SÑ»üÖî›—æÌÖܘ+}ÊŒû£Oz®²-2«GR)óØQÉÑ·n¢ÛoÞg£j˜š"Ó百QÕÀ—WÔ®­1Ç3©Zü¹âˆž©è’PI0­%Õs¯ê¦T%Ú¥O/ës[¤Ì‡Ôø~‘QÞ{¦zj)5fà]È Òɹ‰U(ZJú}ª.ÝHÈ+£†Ó'´’¢f+:±Ïm‘Š©“v¬‘c¨U­”¹”ì’+#dov”^Aˆõ×ïŒ}r&’rI”¨þY-Qœ±]â›&‰®Y«e»¢z{I…?I¥ˆßë jMÈ–韤Ö6CôÉ¡6¤Xt‘¯ôƒQ(”LYB¥‘W*IfïU½%ÔdÔ'¬ÐK%¯%w v?ì¹#$À´–n0‹Ìâ³LbIiÐY^ËCVö²Ì˜Iƒ¤ )H ’@$Å¡±WoÚßÃöí›ìت$5ñ’ú¾Ý}è )TR$5E$…J ’$I¡’‚¤KÚÞœTú»ZYIµ,£ÿÍåô;H ’‚¤ )&)[$H ’‚¤$IAR@R$IAR@R$IIAR$IIAR$€¤ )H ’` xšùXyIAR$À7JôçsÕk=ƒeìäWðæˠ悤 )H ’àûÓöò[‘v(·º®®îIþ! :ã̃vTR$I œðP㮽!íå[élä·å$IARr@ó–Ú’KÏ¥‡£ö.v4^,·’2u\¸åÆÇ—k¥±éò»MWúGè¾"-‡Åq×>õUAÍáò»oœÉcËõ:Ž#—Ô²à•1ç^ʦBšøY[o}ÃÕÛ|¥î»¥‚ ÷¨ýÖv£””ãÂÀÍWëûgFfæK“¯Ì_¹‰Ü¢1ÉÌÕúï™» ­˜N´,ç¨ù]x&•Ô._y–TRj抰hi¬ ™·ÈßÀÂ^ßÜ®O˜Ùê[õùõafëúí3y˜Ú8GôeIÕ7¼—M>KW™Ùºó10·'7Ÿü;†ëfdåô=S¡mdµ>vãè$UúàI¿Ìx¬Ð3³•Î\oŒ>â0¶vÖ7ûž™±\·n$¦W—°ÕŸ“v÷-vÐ]žxYn%5›7nDEEENÈg„’Ù€'$$LÕTŒPRƒžóóèQUøÚµS83˜Ât5ÜÑRRÚtèZyYÉÙô:Û¼°^öžèò.©¬¬,òk1Eù*IUWW“ÍøTMÅÈ+©TVV†……MáÌ@R`ê"²Q}q˜ï<3sKï-uc}:$IAR£¶Ô%µ£ )H ’‚¤_ )H ’‚¤˜ž’º|ùrlllÌ%:::==}äyŽ™º[÷ìÙ³Q|H***ÈÆ| H>Œv9””P(äóùß—ÂÂÂﹸÇünŠ¹¹¹S8äÖú£rï޽﹪EEEßsqBhjÃJ È*Û8m3€¤|ç=Ó‚¤Lˆ¥ºÛöoXÂe©«3Ù Cw4¶ PIn¬ÔÓ]yèýDzâìf;¤@Rä¤Úë d%ýmAk{'ºûÈ…¢¢ëý]7+½9* ßÐM·Š«:øÂÉu[$SXR’ ª½ñÒÞ8m6‹ã`Ì—I ‚Ž…wÚ»{dõé{¦^U7$@hÙ`«n·|ãÕ›Ùwï\OXe«é–Ø…J € >út"%ÚÍÙÁÑy^äŽcãpy>$`ô–ê7•€i$’ )€éMÏYãùƒ;€Ñ)ŠßþNMi~*)ò&)>¿þé)u5Ïš–¶v>$@Žh¯­Zåo«N7\±:"»’ G…ù¯íÁ6ºkÏCH €üð¹<^•îûi<I€¤@R€ï$©Š­ªJnÍ¢áq:(IÔÏÇ7•˜rT4´ ¶Ý¯r ’0ZM ñ’0 €¤@R$’ )“‚!~]íë~tMØ3¹p,~¬Mf&B¼A@R`zScò·•”%.›ž}èøÚ¹Tí±øÑb×È$DÝõõM‚¡õx;e’’òËV¼;@R`šóÆf–JlAC[K3É—OïÓ—(©Ú?|]óø “Šãþ‘9Šh­-bi,o¢ŠúR´®Jc³9¯ ) )IÍR‰»ßÚ[Æ-nÚ3#Ž¿[êîé̵!«BWGÈyAHû⚟ïÚÆ;vK0@Rݵ7BWV}=óñaêæÈ+Cwì¿(VTsÕm_WÛliÐò{ûû‹\º6{ûÉk,H H €>’’XÊÏL)$ó!ìÞí¯Ç4[yøÄá]ÛÔ6œ©¤¦i¯6eнÂ6Ø—îkö =,+©Î÷å–ÊŠñ7ޒß_ÜbÌV^¶1íüÙ£«Ü-évë>󉮵·{1˜®g¯Ýªmï[DÄ¥HÛõ'…oò!)0ý¶5ÓÚÖ I #©6éפóÍÍÙŠGžB¿"ÿö‹úÊBA~„géNrŠâ(Cš×IáÓY>ßnáýN©¤tgúí}"ž×~oUƒÕw%3î¨3ä°Ž—Ô’ƒ5wÖ©qúu÷‰~–´6KCÍáŸhyžIéGK€êLEE…™¶>» )Ä’²SPÑ5µ°aan¡+†È—<ùå~ÈB'##C=.‡ë—@]ú¬…GJŵô¸))Ú¼}¡ ´=×_ê)É=TçX­Ø¼mÛV’íÛâl8ì %ƒJŠšS×»¹\ÖÙªÔw’Ó°Ž÷’ÓVR¶³U–ì¾tûæÍ7nܺóøÍgñ„ßVkÅRY¶ýÔ³š·õ õwÃí>¤¤:Vj³|N”IÝ"‘Ô!g}¶÷\šÖÜIeT碨è™xäÄq 'Oºù¤~ˆJŠÈÎðáúžÞ»TŸí²µ“zJ°Ùlæ¼}5R™5j;’”Fp?IåìY¸$À_„ïÂù¤¤y-:UЄwH @RŸèøp_—¡|îÁg@P{/u‘£Í>šßõr[vêá>¿«,Íc6'ð³ìÙ}­Õ¦êÌÐ OÉÁ‡—7°ÙzÛøÝüO/r˜ ÆõÇ”tÞänR§¹¼ë"ø‚Á{4ÐÝ$€¸¬1üãëË\´DÚC((8Å¢«°5ô"÷f [+mXstç®"Ÿ|–sÈZ[]EUÕlÁšÇ啕‡»Í0Ë¿´ùÙ%Ú¬9G‹ßB~Å¥TM5:Æ5u½PþV(šqwsÍ\m¥Y³i{JïÍk®Î™£ ˆ‹y€¤À4GzPià†:Œ;`JaŸÛ"É<;Ø<…#øùQÜ ù”ßAr\IÕ×vvÄ;H€ –”´tÊÎ&LLˆßýŽøÕ¯¨€¤L¸¤._&¼½‰ßüFâ&i@R¾¿¤ÈÒéÓ'âþ}bÁ‚þb’ýû‰ªª>ñèÑ/ÄãÇÃÅ“'ÃEuõpñüùpñòåpñúõpñö-Q[;dÔÕ CÆû÷ÄÇCFSÑÜ<\´·CŸOC|ž§ ëS‘Ô•+Ä_þ2œ¡¾ü×ÿJü·ÿFüÃ? ÿý¿ÿøÔßú§ÁãþOjràý¯Áƒœ€üû¿ÿ÷à!žÉ0¯%c¨E“ñ?þ‡dšAƒ\1r‚¡‚|vÔ1ÌlÅ«4Ôö’ñÏÿLüÛ¿ ÿþïÄüñûßþ3ñ·¿ 3gJJCNp¹C†ŽaiIXY äxkkj§ËÃcðX´ˆX¾œXµjÈذضmÈHO'Ž#Ž<Î#rs‰{÷¢"âÍj_h¨øÆö€ñ5IwL;GS{¾Û<.é¼bWÇX‡ìî#¿ 'OlöàÖÈÏü;2Ô¾=¹çßÚ:dÕÐÒB|ø0\UB–-¯^ 55Ä‹ÃUadG†ÃDI Q\'))²F`ª]]]<0_üj˯<—î&\⨿*i"%%Þ[#k«Ž¼=`ʳaÆgÏž! AG¬ÍåP•´’Úæak™9Á’B¯€¤bƒdº*¬ù"QC£ƒ¾Êæ¾Ó1) )H €aë¡ ÍÛÖˆkb·fu°¡CÛ;¹k¬oa II0:MQøêjkk›ø±ïjƒ¤€¤[ ) ) ) )$$$$€¤˜(***:Æóºu!.9’“–ËW®,ò X8EÃÎqnGG'Þe )0Iñ X–VJ¤ §dÌ]“~ñJÞe0ywÜ=Å[ì½p¡§Ï¶½—ùßá÷¤3I¥ýBÓè:/ͼÿËSÊU¸¬É€¤Àd§2}ÓfÉñ ײ.Zã¦ez•€¤JJËa1$Àw§;ÅŠ¶èpyÏöچÏc~œ’$Àèøüp?‡ÁÔ6uˆß}¶I@Aw€¤ )䱚^åߺ°)ÄkÖLº×Žì1_ $&‹¤¨ó Š‰ÝUDF 5<Ù%5/,3™—QÞ—²²2¼ï`òXŠßX÷š/­œ^RûÉà©’Ó¶’&¤‡+þð'»­µ)“¿’r ßåã¿$¾/Û¶mkhhÀ[&‚÷îj´#-ÍN,SÕ úŒJ LKI¥’!p0Õž·x=ÇØ7™¬¤zŠ©É+)7E2„‡‡oß¾½±±o=˜,t5×nta©Ñèê §€˜šOcé_UUUbb"R ä¿’J¾SÈ¡ÙÇ—|2Sc†ÜàOJ ’“›ÁΑó³ûJKK“““‘l ï’*%B¼õ ×æeT‘1îš®§SJ‰H €©N^^Þ±cÇ Ï’¢úún?á08k/~J)$^.b3ÙÑ7â?H €)LAAÁÝ»w‘ וT1½3–Åá²%p48,—ÄŠôbTRLe„BáñãÇ[[[‘ Ç’¦W´:h*ºîý¸ó^GRn{Ò½®„ÃqtV`B9$À'))‰ÀOù®¤âR6+k8ï$ë&Qÿ^J!Y[u›rg¸'½¤˜ÚlܸIr-©B!¯ŒØU){/uñŒJ"£Œ$ÀfîܹHóJjJÞ ’`$èèè ’‚¤C²³³“““q@ @Rrˆ··÷û÷ï‘IARÈ!...H˜$’ê9k¢¸'ħùARL{Ö- ZºdËî1þ‘qßúõë‘e0 $U(ä•‘Öèhªk™¹X883Ô5M¼3’pvI癄ømä§v{ü¾“…c>÷ŒŒŒììl“¢’ŠÛŸ¡¦fºú|Û®J"½‚È,jt0ÓpÞXÂC%ÀåOú’&…¤Ò*o«9¦›ÞñŠ{1­œH/ @RL-ÈêéÇ;wîD*À¤TFù -ðš'N0MˆŒŒüüù3úúÀ¤TzE‹SÑû¼€I0 ʨææf¤LI¥–+¹ó¥Šú÷Ä÷GŠßjÙÞ'8&ÀÔcÓ¦Md…<€É"©”BbgV9W“åy=!»%1»9þøy-6Ýgw]*ŽI0å011!pçs0‰*)ÑER;s|ý8L:ƒÁ4ž¿.æj³Ø_S ''§ÚÚZ L*II<Å+%2*¨H/ÃżLA>|øƒ<€I()Ü €© Y: “ÖÖV”Q’‚¤7ÈÏÿ‹/IARŒ ï vm>ôðÓ˼í›b6oM)¯ï K¢Ñ•Q·oß $p¾€¤ )ƈ×'\éæþ^+®ÞÉ9°e‰ÒLnvðk=%¾¿„…… &¯¤®>\w¦I|³ÙÔb"þT麳uâ{¡CRLoN¹©(>î¤äB²ÌIÙö _;@```CI,©bmŒ Çí&9@>Üzô(›­}½K|Ê$ÀÄIj¾‚᦮žŠh—¯ƒÙšÔ¯ª¡ZZZfÎœIþE2ÁÔTÜ® ®Iì.œ‚€*)&×'œ4Mþª—búüù³®®îÉ“'á)05$%=ü$>¤†!)&©_F'š+W®XYY!`*TR¸-SQp¯^½ÒÓÓûòå  )H 9TUWW×þð‡?"’‚¤CHOÑétǧ$I0ƥРÅÑ(ê©ææfsssx @Rcg(êW9rŽm3Ödp48,®yê…2á`æɬ***.\OH ’`¬h*ŽSWÖ)þ zÐRj̘•v§qt¿{HrðàÁªª*dL¼%’îu ä4\{ÿ´â§ü¥èüæ9|E¸¬Iƒ¤À$‡ŸfO7K,VUëæ™/Øxøê2¢©© Řܽ{wEÈÙY³V×ÀXS[·oè±9šäßã¿.tô4µt¿q&#5+<<’“™f†Ú²ËÏ¥šýTÇÎo™cKKËš5kY0yÙ¶m[ÔT!¼¯¥ )0Ùh[£E_tê‰XQ¤¤R½ì-Öò¾q¦nnnOž|ˆ‰‰AÀäë_ S¼Åˆ™1czüÈ'‡¾qã<`tt·4¼©—_ƒ»iíÚµH2€ÑñæÔüÙV¼ñ›¿““’ `Ô’šc6~ó÷÷÷¯­­EžÈ¡¤òòòbccqX €JŠD[[y Ÿ’š7oò @>%<OI%''¸#:ù“é¦'N|þü© ‡•T~~~nn.R àkùòôÒž3ã-©#GŽ ÕäÒÒÒ””äLg]_î—Æ3üjLuuuRRò¦3ºl&«Lu–ÿm$€‰åÉ“'aaaȘæ•Tyé@JÊž¢’`â%…{¡ƒéÍp×_àê ~ñÛ1®_H à›I0:jN¸©8îA%À¸Òñ¡Ð«Áí‡&‡xÉ`Úß•Ý)~ I0¾’zŸ«6{æì~Ìúy¶ûu$€ah®Î:|¹ ’`Aw£¥æ˜ËÛLH $@R )H $’‚¤È/XýÉ`|oQI¸-€i$’ )I€¤€¯bÀ¹çc2:$@ß²²y`$_òÏã»­u*ªtßè—ŸºPI0®ðù|???䀑Ðü(©¨WP×Åtçn±SÐYÝ I0Î’Z²d òÀ˜§f–XDUUÔ£/e%÷›ùrQH-a©-»ò|\—II0*ÚVkÓ½Î<¡{ϘãS' ) )FÇÝÕZÊ®û%fêx`ÁáÞmB%$€\Ðýù]Ù#dÓ¾])ÞÖlûȳc¾H H €Q!êÙûô8usTÈê°ôwˆqøÙH H ¹’’’’@R@R@R@RH H H III0èlþPùàa'_H]/%¤®ª~\ù¶qŒïƒII0>Þg¨s²^|ß¹OØYcJŸuö9.æ’`¡dtÖ­v]ü¸áââ9–Ûc}‡YH H €ÑÑñö,KQ¯ªl‹0P»óbÌII0ºZJÈoŸkÂÚ~î ¿®L¥õü“`¬©’’`´–"„ñ.A»ž_b»ó¾>H H €oûÎÜ7eê¹›jªéÙCR@RŒ¾–"ˆÁ6 >!ûû¼í(‘”x«¬=¢oŽCW$$À·TQÄçÜm ʶO…ãä(H H €QÑñÒLMmÛòliíø-’’`Ô•ÔÀaH H €i$$$$€¤€¤€¤€¤’’’@R@R@R@RH H H H y’’@R@R@RLR„"¤ƒ‚‚dŸB~€¤˜pìíííìì~øá'''›úúz¤H y€ÍfÿJ†ù—¨¤€¤âââd%¥ªª CI '|øðAVR'Nœ@N€¤h4šØP¿þõ¯‘ )äŠãÇ‹%eoolI ?…Âׯ_‹%uäÈ$H yã÷¿ÿ=)©®®.¤H yãСCÈò†P(äóù•••Hòé©~wI@R$’ )IH €¤@R$@R )`ÒIJ(vvv¶† ££-€¤& ïå‹–®A ýÂ3h-GÇèãÇh¬$5Q˜ºîyD¤•!ˆþ‘YIXùE7¼Æ @R…‰K@æ}"µ@ô´RÂÂgÝ{H @RIIAR$$…@@R@R1®’ò^W]ý¬I†? …B4_’‚¤ˆ —”™WÄŠ+"d ¿³çÎCó )H OI={Í€¤ )’’‚¤H H €¤€¤ )’’B )9gÈH €¤ää´L3s 4­’B )9$sÏ>#0s3SÔS’B )¹“Ôî}þ W.†……ÁS’B )y“”Oüù´ÂvÉÆ={ö IÉ›¤R …äÊsl¼Ïœ>z @R$5 ßÓûöŽ?G®9é)rå \————Ç‚d6J(3ò›f9Ô‚ XHjòIŠÜQ,&Òï»PA®Z19^(þn¦–HÆ÷‰Jê…™{êäµÒ fRJìª Ä{¤ÃDJ!‘ùH/J§$Ǥݗ¼–W6øâÒ+†_"™¡ìÈŒ ÙÕ¦‹V¸P˜"^VÅ ëß;q‘$KdŠx¢ée×<½R¼Da¿ÜŠ×7̶“ `‘Q>ÈkyåÔ²~1oÓJRÍÍÍz†f.^K]<Ç;ô-œ6\z+ý“ë¯nìrêäÉñpemiºâ,Í—²ãš<æü?ïë-Ÿ/,™ñóE EE%EñðºkÕéþ,ñƒ9’‘?ý“ÛAtÔž¢Íž­B£SÐTš©ä°0¤¨¢€¤&™¤È†—WÜ•~ÔÒ\_uÎL•Ù?q çú$ÞK*’´Õ[ŽfЕf©*ͦɆ®[ra‹6[QüPU‘ Ñð,Uóø‚¾K)!bc¬9KýÂÊd?`ýù/^çeG üìu™;IOmŒ²PQ˜%]UÉ¢•\›«ÌŸ%^Ñðœù™/v—¾Òúñ¯ªÊ tE2Tgé;‡E^üÂ+[€H9ÎSÖt#×ÔtÒÍj{-šŠé¶üö¥âx–¥±]U™¥ç|øµd&¢à•t{+Îç=N+Ð2×rg©GæS©jÃWúÙúî#_Ûošµks·ðŠ†{ít“Ô»wµÖž«Åûã}÷RD»søQéÒÅ‹cÞt¼«ØÃR3zÕGRŸü3oµÈŒi0¥Ï¼øf—Wì\Æp •ÓQwŽ9Góqïˆ/ÑžFÚ¦]aO™5x]%¬Š2n@AØžÂKBRÔH EÖ…ݾóŒÕÔô}Ò“_@^ ±a×M5:Ûå`r 5Müñ},5ÃÍyT3Þ'Š$ieÄb¦öÊÛd-Ðó”ìž?¹ÿÙê¬ÅX~®‰7 ‚-FD’ªÒž­ä{±¤\­¸~™¥½KL¼p—ÍT_“àõ]“ä;U\uÅÐKBéøŒ’}å…';ÓDâuúXЕ̢òDõc±"ØÏÔç 9°o'[…iÅæ8”¥¡ü*]µY RjÈ™ï8¾‡5Gmù5ÉLÄ+¸7„ér4½\TsÉÖ>ÅÄH™Ïf1ôlüJÞ Äã«nzÚ2™L³yËë$3¹¿óG¿÷U4*gË›‰ö†„• 8,&SC7dÇ©îžl¼ÈÞgo ¡®ÆZ°:¹Yü‡¼Ÿ´<ß?>Ìe(/þ IAR#O±éJËO¶P {¡P¼¯˜xõaÈþ; z%µéÞsà•(I­¸9x¡Dj(«ÉÖÞ’ÃO+'Ö%&[Ú»˜Ø¸»Ådñ*ú·É¿,)Q$œÏ&%u]ÐoY;o=ä2C.ò{g(’”ljv^O¯´ÍL{ö¼øq‰çd­æ¾»…|j}tʺ¬îÍû÷ .©b"z¥µºcjú}‘ÙKˆE -Ì|ŽÉ¤©ùϵèf EÃÅ„›×¼Å™Ï<½ ÏkjH¦¹«ÙmÊzû®®î]M’?WkÙ5r’{×±´,Êž½©¯¯?·XÃjQk·x¹wŽ*w®×6ò…ÍíH ’i”á:tÃmÉå2J½Çƒ„=’2Š/¡ŽHƒô‘´^Räl7¤¥jEì$Ë–EjšA)7V§]´5×2ô>":$+)­YJ‹¯™•½±ÔÍšë;&’­s)a©¯8wÃSJ EϵUÍ7Sãy¢ùoÜ·{ˆJªËÝTÇ2úVF‰d£B׬à:¬äɺ¸H`e¢î³÷35\LØÙquLÜcO­:ø.íâ15…)¥”hÜèišú.ˆËŠ=óØ/p!K×c§è˜]€¿±yô+ª%?—AcšY[{í8w‡Ym«¿úU–áÑö,c/—°ÃÑgž®Ú«®¢sS˜ZIM€§â®½ÿÃÿûãÛ·oÇPR6cÖÌŸe˜©B§}‹¤d»û-ï6ùšk;…u÷­þB<¸î¡{$]Â*ƒôƒoDçç7ï(- øÔ²Âõº$*^ìš1SëV»¸Ë®;B÷'ï=e= èjë$'î6øiùùæžÙ¿1Rb]~ÛJÔìÿy÷Fë´î냤F¼2Ÿ¹*70Gâ—Baü¥ÎV‹#!·K$©ýlƒ­©¥! Ó>,¤•Th`ý†lf·œ«ˆ¹ø…ªh „›wlgº$ö¯¤t••Õé4u5™`²tü¿IR Ou§—Râ ¶ÝÅRR[q…z61sÃ%ƒê¥ì™~HI¶Ûêh9Çç§÷T.ë£Ã˜–þ²… i®`Ÿ¹V+N¥‰*);3ÿŒtÊ€ÂôŠf¦zÈ‘¤êÍOà‰º:/žWU7Ë£6$fG×4,¹H¿°[U½ü–džqŽ°µvˆÊ·ˆG¶¦O¢È¶)9µÌà£ïQIMT$d·üý§c%)²’ú0¦•—ÁPQRTASg›Ì]þ\Ð_!î쥉ÅÒS5|賂óÚ¢íDüš²š®ž¾†šràÙbIýHsl虺&¿¹Æ¦Á긌òê·¢鹕’¢±ËB‹¹sUh«²ë‰×û¢ÙÕáÄ Hê«%%\l¥Êñ»™V&Þ?8Z3˜ &“Áb±‚×’°¸»oc‘œßÝÂJ*£â£µæ®èaö³¹ŽVl‡-‚cä’T8Xwßy¡Ì²ºæY~KwŸ² ›£Á‘‡ÅT[\%:½ïc«ï_˜V4IQ’rŠÏ“J*j}ËjqŸÞ6ê4Œíj¦kxåâJJÃ1¢@ÒŸYJ¯03F¸/жº#/L˺J£m¼'Ú¬luŽé¶{RRÊtû-¢ãPT•tû!‹ÅÝp«[$){¶Í>ñ!ªÔÜ:M æ²ÃuÔDSäßM—kÉÚ§»»ûÛNÏ1)’/¿‡žóH*¡°çQã"•Y!…mEæÍ1 "Ë!€2O„á½’¢;9KB à·7>ßÌP¥[ÆæÄ+ëÙ³“« ~w/|xEJÊá=$I}m”Ñ–tÎÊe’î>²Ü …•QüÉ€Ã^*#©Q“"ÛØS{Ô |ÈÆ™WÖeo¤b²øø–¬ w¾lد®?„¤Æö˜”¢²óÎòØSU1'«bN?¿ÕÆõï¥ÜkÒÕ¤­:Ûž*³CKªÛËRÇ4ꆴ»oåÊ m§°¾§‚ÓËÞ›Ð4"òÅ’â8G•JŸÝ´k7GoER‰HR˲%v¯¤„iems¹´ K­¤¤Ôœ¶Ia!¯¤s¾šßÑwd OIÊö@Šø)HJ¶(öB ÁÚ¸q£üŸ81!Zsƒ“%Òi½Çü™uáƒ0ÁÝÆyÃÉ |Ÿ³¸³gžï/)¢ûKiQ©t>5yé,†ó‚·šåÉ«î±ÿé×”!)Hj´çŸï¼Y¬ÁPZ”ò<£¬÷ĉ´¼Zm6+ðÐÛo•TìcìÉ£=àÎQ\vSríÕª°¥,Ãï")™cR}ι–ËfÌ‹ï{vwI‰Ž—‘Ê—KqÝ馛R+E°Ê‰ùsµ,—ÝèEUá³PË:®N"©u¥½²¾QFD›ï —UmE­wÒ .μ¼WFRÔŽÄæ­ 9~Yé÷!)ù’ÔÖøq¹ áááÑÑÑßROMœ¤´µço?–URR¸=ОiHν*Ío¶Þü›Eå÷nžóX¸:p>ËfÙÁ':‰—2’"j²ý·îÏÉ+Ì¿{s·¡Åò“|‚xpq»*»ÿÂÍâÂü›—ü¬nû¶IAR£ ªÓ),Ô›¡¢l·ölÜÕwñWßEe7ÒPÐ2tÜp«Kr℺~äÅ÷ñ×ꤱåjýÎ_«1"y›c{•Ü؆¤rü{×…‹CÏuŠ6³ÑTs¶ýº;[¯7¬ß¶V]Õ<2èw =)µÈ¸ ÚÖ±ä@IQís»‹¶zÀéÁ%E¾$áB‹¹hÇŃ²’"Ç'ß.fÓãË )9’Ôö;_þí_ÿ•\yÒPbOÅÅÅ …£¿£Cã“vÖîo;eÇ} ·Ñ‹ÊëÕŒ ó‡•á•ü//ÛµÎféÙ1ï¯Û;>lû%I¹³V¦•]KYccmåýªKr^ýŤK K÷ Ä›‚––¶ñ…‰·Çu­›zN$:>ì\dkmeeï·/KzN~ÓËþómÉ—/ŽH‰IH¼=­k¹ø#$Iª˜"=•x¥ÂÕÝ…I§©ÓèË÷¿ØÙsÔiË±Ý ºjŸ3Ôhtenx^¯¤üÌU5—]XI¥½Ôš£¹¾@|ò±õÈY=M5&SÃ9êvjñ' ƒi—++©‡š?þìs¡¤;›p¼x}$uî6ƒ¦´nIUrTf¬º +©W:?Ït?Þ_Rieíó4ýOõ\ºUÐie ¥®Fg[G§1ÔètEõ ëäø—ÚÊõ>Ð&îL¾Síâd¥®¦¦k¿2æzÇàù¼pI•i’X@ØXÑ#Šûhq£gqž‡‡†Ù’Ûâ‘é×.))élÌ•lHÊÝ:C)<#YAÙf›L#œRЦ§©°ô8e©n±·GRïØ Õ ƒïxÔw?•YAüç3Äz.‚Ç㣺xjøÛ"Iž•™í —Ú2œáP’Z–\Ñw]†Ü‚>‹8Ñ óÊ^Í;íïÊI}C=E5 éå¢tp ¥—ØKÆ÷Ô"É¥¸T÷W‘^:øÒ{/†êUšè†Ed“Þ÷òUñô¼¢>·Eê?sÑ€è…}ïÃÐ3^öþ â¦÷_7jéå¯g<Õ­7`yâû ‰'ëºxÅ:NêÖI¢"§ofïqöjCÒD!ItC %yHtApØ{¥sÏv‹æP&ÙÒÞuÃ)èß×P{ªˆŸT8äVÈJJº-⛥O¢¶x€¤$…@à³ß$)«E¡÷©i¤— ¾+õÑԽAŠ‰Y }ÿ†’nÎÉ“'¿¥ßï;s„·îàõè’B c"©††e:ËÅ+h®çRiظúhÙŽy¨ióJ{ E–ozs—-q¿ßó1½€¤ )býžT Is³lTVV®Zµ*t¬1·²ñO¸$9€XF/ ÷ôô›hI%$$à1À TWWÇÆÆBRÄtûÑC²r!ç1ÖØØ9’’÷ò™zG™›GFFc(’­[·øaD0´¤‚ƒƒ!)’CI‘†ò‰;e §»~ýúá;úâââЃaxûö­››$…@@Rc%©Å‰WÖ,e0˜QQQÊ,²ºººPCaøðჿ¿?$…@@Rc‚µƒ©gÄO3~þÅãP$ÍÍÍh„Á/ò»ßý’B ¦›¤ª««W¯^6ÖØØ;ÿéÏ#k(é± û]ÆÝÔԄ挄?üáâÛöBRÄô‘IeeåñæñãÇOŸ>•SQQ±eË©¤ÈuëÖ½xñ½|`„øøø´¶¶BRÄt“Ô÷¡³³3>>^z¿>ò/i1 Œœ´´´wïÞAR$5®’êÉ“'huÁWAŠ¬Ç!)’WI………Ý»wÀ%Qà+iooOJJ‚¤Hjü$EêòåË0|>_YY’B ©q’T\\\VV F­­íëׯ!)’sA^^ ¾…ªªª}ûöAR$5NÀPà?<¾¾¾I ŸLàü )’`øbêáÇþþþR’CR$À/bcc3!]Çš¦ÎëO<?X"5û C÷æ#&$VSó9‰°EË…ÁÁÁ·oß...þþEÜ™3g¶'&$ˆ#iG¢ŸŸ¯¡¡¡bÂÈÈI«055‰ŒŒ„¤züÈ¿¿ýío'öf³b²²²"2· ‡¤ !+©ëׯOøj\»v íCIé\L™™™}Q$$À ÔÔÔO¬§ ) )†*¦¢££ëëëQII ‡žêîîf³ÙXL={ö,###È {öìÁ;"?¤¥¥UWW£±ÓÙS¯^½Z¹r%;n ¯_R|7Á4çÂ… »wÈá~ù744ôÒ¥Kðùdùòåû÷Èg=qâÄ x €|z*//ÏÑÑž Ÿžª««sppàñxHùTÕÉ“']\\HUUUUõ{ jkk}||ÌÍ͵µµÏœ9ƒ„«’Šè¹7ŸÏG% ‡üïóÈF endstream endobj 1540 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 282 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 19438 /Filter /FlateDecode >> stream xÚí½\]š·=³ïî;»;fgvgßoö™üjÓ>ËÉ,dØ”40ÒiYîåagoo×IPDÒýæÁ—Ñ{{ më}X)˜þôb†¥±Ã©7ß,#or]mºRbïä1eÉʨv®tŸ—?°Ï(6ó‡Ó£]lÜü6œ¾9Dj×ñ>ÒÕÅ^¦hÍŠL©müÜÚªoüvpE«ûwHþxSyxÖdg‡9ÑC¥¾écjéЙ!g÷ØìãâÁgèÞ¡™æ{©O(i²4_ϲ3x¾u#"4Ï1Ò³{òè‘ÇÜ·+:Ð^‰cYÑØ1È£-gÛáÕ€gOµQ½ðºMîè7¿ÊŽô×wr)ó÷¿üv’zyL¨ÌIØ}‚$äÈáC;6&Ypǹ‡íjd½–¹P×zA®x`Ç«Ò}ª¢ðùÉoW{ðæí>ttß–DeVø¡›Ã§h5èh9„&0EëÀÞK¦[)óíjÞr15)?qÜ<ûjsõ«Mò«Å©( “6î=vôÀÒ[U½I›†‚¦ªŒÇ¨ÌË9zä)i‡÷lÏö1VÑskäªÝÜæ¬b¿a€Šêh}&Tu}Ù[î펒¦Šòѧ¨ÁБ”®_ÆI™!•ÖÅúŒ–—1o¿{ù¸¦²¢¼¼âÖƒg³Ðm½§n“©Õ7î½w—yWüþZYÙ—’þÕþôþ-2gUÍÍ7ïÚ™ƒïÉõÓV,þÖ¼’›Ïºõ½ÞÔœsš™L†&£Ô¿­¤xãx—>¸®lfkéܯo£W_Üúàöu²E•Õ×_4¶uµÚ;š^Þ¨®,¯¨ª}^ßSRM/T”W·tеÑsÒ)½óèSq4×ÕîN Ñ2žSTV^/£î÷׎éLtxØ,fòö`“Ó8Ý¥-ÃJRþ›ódŠVKˆÎ8³øjéÛ/UKŠÖí‡ÏeŠVÇI©¹yÿ½¸»¤è¢õîZiÙ½WLÚŸÜ“­k·ê›;˜=¾~Ò\Y°³ üÖóFÙUÉð3š³·Nº;ëoóù¼cÕ/†@Šª be?éÛ´^7fÛTÐÈXêÙÃÛ•$AÕ^¾ûÐ?lm¼s£º¼¢’äMÜSRÍÏ+JÊ^7wÎy½º¬¬üÆÝÚIIkßP|!‹£îr±²úñûžŠ¢D;ÚD´â‡¤À”””Ãó…œI»I‘­+Ú©ÎæÙùÌ ›;M[]ÍnysPœ‰wåñ¸~AVú}Ó ¦ön=©‰3…fžoÛéywDºð„Ú GyZqŒ\žHúg'RæqÔùÁËã·åßíÖ“’žw¸a2zèHŠ>v›oŸUãê”={'©î„<žÁìp/»‰<=óZÚ¼Të“-6WßÞk†§­††VrYc7IµT;¨*-8ø˜®XïÐbiºE…Í©©º­È%)©/?èc!Ôrˆ‰K¼÷®ÛàSe=Üí1ÁtUû°”””]³xBŸdkž^Ú ªÉsð›ñò yE½8Ÿ¤aæÝÒñÆŠ=’CPR£Ôofp'8®¿CB¹[R7žg¦>/ØÎè=n¢Z*w±4'ÖÔKæn{àÈagU½¦nÑ’zMQe9ó5½îI*€¦K«Æsow6ض†øï§5ÕR.RÒºÚ(¦¿II×îöéd®–Îã·ÔÛÛkã×ÝajIª=ÎDyò>ºŠÙ¬kMAÑîôpÐå5©ˆß•Š”„—ß´õ²Jß^RBnLÎn:#Û·¥¯Ž²”æg1ƒnâ†{·oNNJ\“”`¢fµ¶Š¢^ûªŽ(n“«‰¤¬‚.uúÄë¬Ú³FÏßÍd$¿´ø´­Šfbq;uiS ÈLÁPS4?)ŸjÉŸ¶lOûpºp‚–”ý¼Ò¢µ)ËßV›m5ëµTZå®OOIHHˆ 䊌ž4Q¹Ióµ]fHöº¶²&eßëúÕõšBÇòºvæ½mAÎÚÞ ÊŠ ˜¢µ5q¾¶ž'}õíU"©B…$qû®´äØåK&;ÙÎÍil ™¬2Ú*IÐöíÒâ-4Ç:Gì‘ïŠ_ž9°3-9‰¤(ÌQWkf61÷2CÍIÛ+©îW;I±œ7ïŠñÔ÷Œ•v©Æ9¼ Î)§‹ %Ê¿<ÃX/ ý½Wª×¨ªú¼ê^ÆÈîØ6ÛdR Iž )0ä$¥cç>wÎlš9ó“·í*ü{¢=غ–©;Ž\É/8¿3•+‘ÔÉu õüÛ™SS]ÊÍ% u¾>WsŒîiÐodÎôàŠô¬,¥XYYÛ9xÖµ Ii«iN –ddVHäÊ«w¤Ûú,W{Œ²]PÜÉܼ¢²â•V*VÉDRµ¶ã”ntPÝûA™¡&\Ž†±¶ýâ­oT›²T ͺRbimc%vQ()&½Mµ¹ùjsÖ¥†“¡Iië9z3E+x~ÊÎ ]›°)̉­o“¹ë)Zg7'°%’:;ÓÐc.“«[Z“¢¤¢.)Z¼sZ˜qáµ¾<ýEËÚÚÁÕ—î’*’”üUìíu^âù[Ca¸Ïd¼ŠõT¦ Íšºdÿ•Ò~ÿÄASÝÀ}ÞÓ ¶L5Ð’j äsfºFuï)ÞÜæÂe«éèêèÛt^™[7I•¥;Ñ¢+E6¶6™ÇJŠPkWáúeÓ«W¯^¾¸gÁ¿ëzcû6\††Ìpß)ÍwªÖ~Â¸Ø é9Ç»$’WlYƱpoë O”HÊ°¸ƒ¼&=)5‹êÆÖsÑNJƒ™¾3Q¾Z~‘=[´C_R¼q¼+ *ºk扜ft¹­+ •$’zÌpª¡k>±˜VfˆžÅômímEJ!›*™ñ.W–)øRÅ’"UÊ“K\•M—7Cu÷mÉS$Œ{ÖãÇ­©‘nνó9Œ¤Š2¸v~Ì–KÞ#%‹>'5JÝöæ»ö“áVÊ¡-’… q®TP´÷¤êâfÏ:QוÔ÷|ÏÍ…CARôpßÞc»Ô“ŠÝ|Žè–ôÊûŽ¾&‚YDR©Öš–©]Ž"%MÌô¤L–7SÍQV&Î;*I]K”ÞxïCÏìE’*K4f©ªkvÂãóÙjœbk )0d$uRÑ[/¼X£BÏ3Âyæ¤ÃŠjßQÔÓ³ì±ÜŒbIÜX¥§¬²¾š9'åøZrt,rÓ²Φ_ÞÝ¡6Vk÷-©ŒŽ'ÎH¸Bû÷¥¢ñü3o»5ejàÚ‰£Ô7S=¦UI]VtÑó¥u y6S™××%è‰Ø†ËËÉë#q.Z–s˜3$—3§×ô«—ž“º@ÖþÉ…d–þyIv’gZ˜úÆJ7íéU¯µMt~.m. d;cdÃ[ï{êpR¯¾èá®á#©îNtòÌMeTÔe&açÛ‹x"Ã$ ŽjŒám¨”œ”zS¬=^e릮sR¤ÜÌs¸…o¡Sp+GuœÎÁûÒTì_å?+¹PÒíÌŒ\l‘/9ñnªFž+™‚Øtë¸WsKᣡ"© Þ¨«>Ìçjݒضùî cwJyýôä|U¶ÃuÉAùúÒÊQ?š\c.œpÈ¡ôè2Ÿ¥‘UL_-Y¾ÕŸ­ï[×y¢yöÏcåtAjªITàüJæàêqˆ½·f•Þ¨(†¦À·—T ˆï™r\á{çsji(»º»›Ù)½a«ÃÑ3s+}KÝ8k*TÕ52á²Ùþ¡ô À¬?([½bÚÀµuUUâÎÜ#]Ým¢¥aaçd¢Í5ršYÓ,íÄ8êŒUÙG’ýºâÝ HNÀc³TYê\>ŸÏ›¿³àëg¤ýåaÕ¿ª^jPÐN§^»›Š8¦N®öæžQÛž Q›Àž»=Ÿzÿp–§‹­m¨ÍNô8ñˆî~¦ó&ΑŽžˆsUáû<{ßA½© p±T9Ù[ ø¢«0' íj*ëèè»ÑÜõ…wŽ$c© øPW·¸>l®AošÂÕô͹¨ ¤Å’,Ôd¹¹»™Ù)¯²ÔÒ4´ò¬yOUì[f"`é›p8Ü™‘9t?¡*éGÉe,TǽSZ*¬„ ´_r7E 5,팅—à›mÌ¢ßFÙi‘¢åsZ¶kòîq©Ÿ«åø jZ| %¶ÎôðM-C¢®Ðúatú}E%­åÕ\OkM]ÓI.væ“æÕW¦r&¨NZ”BÚP !~6ÛÄXOCÇ2ëâ]º½´Éf´EóÑG‡BÇŽ3¹ú´…jk\èÉæk;8ÚkijzÎI{ËÜ'ÕTc«­ªÁ-9¦x´BÜþÚDù/‡ž nC™‡÷ôó™¿Ôå+÷¤ú~,ÌÀW²Ûc‘mo÷ä‰ô”zdŠÖ Š5Ô‹$îwõÄý”ŸÎ·úßdqIÀc‘z!9™º$}ž.PC”L¾[©ŸýŒúÏÿ¤fϦrs‘0hnÞ¤¢£©˜űb•–FmÞÜklÙB>M?ßkäçS÷îQwïöd†O‰û÷ûŠú‰‡ûŠÚZêÑ£¾âñcêÉ“¾âÙ³¾¢®ŽzñB.IJ¾zÕW¼yC54ôoßRMM½Æ»wTKK_ÑÖFutôC³Y„ãús¥ëÓ[˜´¤dcÞ<ú°jnF# b™üGêÿþß¾B®Œ}ÖËüûÍâïþ®¯ø‡è'?ÿôOÔ?ÿ³â o‘ø—é5~ùKê_ÿ•ú·“ ±ìŸäÝÿw¹º½ËÌÐ[ôöAÙèããýƯ~EýÇô¿þu_ñ›ßP¿ým¯ñ_ÿEýÏÿP¿û]¯ñûßSþ³ÂK‚5Š7®×?žÒÔ¤Øì^C   û kkº§àà 8œœ¨©S©iÓz Ò¹ˆˆ ÂÃÇ¢ETB=\Ö[¤§SûöQ{÷ögÏR……½Fqqûýû7nôÚ‚jlü 5 IQÏ#îç?§ ¿»;ý-PòL3§ÿÃ>ó¤;P_ßWîL]!Ò]"ÝÉ>¢ªŠ*+£ÊËy‹ô¯^í5._¦G9úÒ=y’‰Æ}ûRlm麥s uâuøp_qð ]Sõ»wS»võÛ·÷Û¶Q[·ö¤ÓGôÑ g‚T¶ññ½F\µ`A_1s&åí-¾¾…,V3©}|hYz²·07§tt(‘HqhkS¥¢B±XŠƒ¼õ·¿QùK¯ñÃýX˜4˜–ŒÂøÅ/¾hóìÖÏ~ümÛ‡$H‰(Â" ¯_¿žMZ×à“ ]²äUSòÐ7w^¾ ‰Šú²ßaf¦ØMúåæF·âГ$õý±hÑ¢W¯^!ýHêÎ/û²ç¤~þsúä¤IÔóçp€¤ )H y*’úÅ/è ´jké«q 'IAR$5D$µkUP1H ’Ô“¬ )H @RC¹'$IH ’’‚¤ )H €ï€€$¡KR3gÎD>ˆˆHª_nß¾½`Á䀾©ªªúÊßø‰?þEIüîÝ»Ca§ˆ‡ù)ïòòr1ÎÚ÷Gkkëõëב0ì˜ìãç0wòôÙ_'|fÌùjßEÂÖÙs×ÞŸ’ŸGŸjéz™ÕóöÿªÙPúƦ<øô‚³ò[mŽÏŒà/ýžSƒ’’Ö~Ñ#qÛö®“§}¹M eØçÛ•7²æÎÉý¸e+b‡Âáü¥Êÿ” ääuß*·®¾A®SåýE•”×’Y>€9‡R,Ú}3hÁâOÉOqy•ÙÔ¥™Š—ŸHrR1Ìr"då½Ã’‹ >½ ¹M›U9€od’6Ü•RDM›ôEÄ…á‘ñgëGÞ1ÈÄúÊÅ'hKÊÛ?8«jW}ǺRþ¿Ù¹ g *µ°ŸH¾Ò*rð'H¿s©ÛV1sAä§ä§¤¼j¢ï¢Ô" O/¡´í¦gW³œÈ…ç‚„¢¢ÂÏ!©à´âþ¿.«œ9ÌH‘R±6¯ùKK*$<2öij~ŽA{ÿ¬òaYÌ2Ëèªf$IùÏI/ÞUA‘xéý—.ÿŸER:N”œ¤†c}ûm%EŠ®S $õq’ŽÇ $IAR$IAR$IAR$IARÔWÔÀ¯Xþ$U¬HRƒ½¨’‚¤ )H ’lDì¨2²t\Þƒk×®ARtQv3–úOŸ&›œèèè¼¼<ô¤ä$Å×Ò‰‹‹“MT|||[[$5@I ¬W®\)WÒžwýÚ$5„#éÒû/]þ¿gIé›Ù/êÎÒ¥K¯výH($å¿ÔÇ{²l~ÂÃÃ> IÉIŠÃ×Z²d‰\Ajmm…¤()¾eTT”\I«­­…¤†…¤z–²7?cù‡¤är IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$IAR$5b$õé¿ì IAR$IAR_+k›wïÞ}¢§ )H ’‚¤ )HêK`1)ˆk`yÿÞ=Hj$I*¥@ÌTqÒ ¯ Ä)Ì[2Ó‹ºÏSH¥õò–tÒÓ2Ó‡ƒ¤ÈÚ¦0Ù(ü°ÒGwîÙÚü]­CŽfœ.ÐÒ•nµÌ†Ù…¯L êzK&!Æ“Ó¯e•<·ÔÒ¥ÿÔ—„¡©ý¬ì„«B$y>W 2tX×Aï“Åz&“s¦+XOº¨ÇïònÝéš…gC²Î‡dîÕå(¹DŸfÞŠ:òB®1œVøXWÝ *xô¤$’ÊŽS›}º[-:ÕFO7xVþëL: a9§m´• fîÍ&8¶¹zíñ²…ä­ó ÖmÑâ¨zÅaÒµìTcfñScU5›¨£á.†­¿’~ÔÕNÄÖñ‹éLÑò”¡ÉÜäBjþ’Å"‘Žçžu¯‡¤èÒ¾,q5‡«”š‘sÖÖBÇdjfjAgb¿íp_)0EÇjU]Ï^RÊÅGZ|΢ãí©½T®Nš.ðÝAj?¹í]›ͱʠ]<²%%N/i›è©>í±uAÆÙ)‡'OqUWåON¾Çìß°Ø%]›ùç?‰YçB·ÝHÍƼÞpÆQ_]gꆰõçéRº¾$¹{ÒÒKÛ}L4§îmôpXÍ/©’b $ù×Ì'tu|ÜGxjð’g”5ùxX¨«êù®Ø· óìüµ{]\&jòMçî~ÅxÊw’«Žãœ0ÙŠ4ë\øÞç©—žJ*RR¥œ0L˜8ïS‘Fl¿%÷-ïmùšóÎgÃ}Em.BŽáìU%D%Ò^dfÑg'כּ¤’d$e»² £]VðØ€=zÚŽÖ^ë„-Ql»Ìt²bEËw…ÒGÓÕ˜Óï;à0$$UÒ9y«‡î؉±Óz,-9÷ºˆ­|°ýCé"’b©yl~‘Þ9“UÕ`Áe³â]ÿ”PA³¬MBo¤•6;¹Ï]yµÍ†ÇV$)º)å`¥é°¨$n]Si‡kh¯¸Ü1$†û ©¨¤UZæqÉ’×)WB×_LÌ{³xÃÙEû_L2úeÜ ËX~kDNnü…Ö¸=… 3Ï…o­J’´^Ò¯– ÕWJÒ»îLõÂÍ·“/< Í>·öÊ}5ãe¸r_^Äþ†5Ço„f Ý¿òÒÈéIÅd¦ipuæmË(‘‰éåÔÂè(»€Õë$I <’ò{]&qßD–Á¢²Œ…Ç)•–[.àèÆæQn®«…Å«U†fßR‘X0r$eÞ))’CÒ¥r˜½zmRâ`=5HIIöÎ?u¡ÃÒ+ôØt÷•Q~Ófº,=Â,Êw’‹¡ïêôÞÇ2Êß;²Yûª—j–J?ºCS4e])Eºlq*HE’})úèkr¨ª"f=©s7ù|^À¦i½éUR2§Bú’”˜ˆi–“ÐyMIf™8ÈC‹Ç7v \jçìÀãr;|zRíŸORt†ÓÊ(Wk5³ÙWS$…Ó–¯|®sÉÅÖŠ$E×äE÷ôUÇ“v2Ë^Yh¨xí|›6zRÔº£ç9BÃU—:è^Oîu.ïfk¡gåå³öi|¼·ÐOf)•rõ­¾×ÎÑÏprüìø}=žYÀfzK‹)›‰,¿mt)Z·%\Ýxž‹©Àzò¬˜ ”Ç!­1UbóÙóL…Nkõlf%ìuv1ærœW]t'kJ*­”šæ£­c³vì©Û®Ü>%Õu$ö-)²Ø¸ìþôµEDRZá|m[gÿyzZš"‹°u}4 ¤êêê|ýüfÍšý­bNp0ßÔE¶$‡ç¬”ÓaaaƒòÔà$EW˜bKsŽýüi…âùý"Ò›¤ºv_Ÿ’¢²há4#ß”ô"qÄ\gMM‘Í´%.Þ“ùJ¾iuÆxIjÍ¡‹|wñÑf¦á‘B·ð©¬Jit÷ µ­&Û{ϲë [¿èÕîI]~¦+à†ìoL»ü< *{yn+ÑAF9åoÍ6\|5³dˆJJ[UÍÀaŠ¥«ogøèj ô>‡¤˜VVvq¾êOnÙïhõÛ¬¡R&m’õ&)ú­ËyüñÂðK]ëÐæ©?ÎbmtÎo|uŸ8½ø-Ÿ³àh‘fÚ…›<.Ï6¦€©#]ò¼Bºû*²Wß-ìc¦¯I ci$KêêÀiV3ÒÂÝ©®Ä<ÔÁä6lY¸®C Óå ^h%¹Ó§ZH&ÏTñx¼°ƒ # '•^Ñæ¬3Êlñ½.¡dV~8Ó:‡ûxB]ÛÉŽD;¯³sjÚ“*&Ùs4œSFÒèæ®'²ZW$9eü[Mká™–´OîIÅįqšŸ²êô‹o$±²×0gún*¶05¸§?Ü÷Ò˜7Æ;ýu×î“«H™á>¾µlEjç='êÄÛö¤ )g‘{Bmj~ëÜ•ëCw?!U‰…®BÏøŒ’Û“J8p–H*ò„Ô/i§¶kŒú‹êøQªJÊj‚¹‰eLOJhä=cÙzÿhiL[¶;q`Ã}dg­9’ÇçX¯¼J¥#âÒ½ÀÈd™‘nA‘ÖF\Ѭ³tM5$%¥¥¬æ±Ù?zƒ4–eÛiROJUÍÔ?~JD²_D²Ï‚åFB%=Ïuë$›>ÏÇxzfz‘´-Ô—¤.ã-ºÒµÞ†ãÌž Iщ\hj¸¸œ2Iñçî«£;ét ie¤:mG-)}î”u7™Î{ú¾U*l¯É)§¤õq˹i$Ã;—°4&¯.—6S“÷îgëØ%]Ó’Z`®í´udÔ4íâ>?ï‹ ©Œ º‚²XñXºg¯>Öÿ#kühÖ„qšlÝÈ‹ídçIñEæS—nè:ý—f†ï® ¤2*ZµTƒNÑ»ÉÍMËbÆQ¦Q”QúÒRCÅ)çU#Q”TìªÄIK6Ñ˧SNåOŽØ‘Lp‰3+»_ÝÚ{ƒ4tk™¾á=5xI=1äŒñÝÐ(ÍO^>÷Ç?ªÒ»o‚Ûye)Ó“rYùÉV¤¤b‰9û~ ’’\øÂ@C@¨t¦ðepL¦çì(×ÀEöVÆ|§eé¥#VRÉ'+ù|î¼Ý/˜+ˆˆG²«©ì*u‚&¿KRŸpNª˜Š^3“ïy’)gJµ”UL|âæFí®˜nÇÊ’úìç¤LTÕô=æ»D¸Îˆp Z>3ëzz¹´Wåh-š”ø°ëjᾆû ªDJêsÏIu–QþÖ‘?ÁacC7IùL^ñÍî“J7×Tu"/H%õñç¤ ¨Œ“û5ÞÉ¥ôQIŸ“šW(-œe|%«ôº/))ñ‡{ >ZO̵܇ö؇&•ÐæBý˜ÁT k.6g±¾Àp_«¹Ëyi3.G"[²ûr.Ôd9tJê“ÎI­Û½ZÃtuZ•r¥ÞL‹£ã0nÖ•Èes¦9rG²¤Ò mµ¢2ÊdÊO•¸#î³HŠÔÃ~U|v¿%5yäšÕ|=ûÄ«’C²¤Õg"û»’”ì9©® ’œ×ékò#.~8±ÒGO*­´ÝZw¬GZ}ªä BÆÅBK+ô|û¹™—><ó^èTCŽËIJÒ§N_ƵŸ^ÐÔ‹¤èjgš›¦]zcZ7IÑçkBtMãXIÑZ±ˆ§cJ߆ s**ãbÑg‘Éÿ’pýÉ Ìé?77mói{¤=©â'&*j^;Ò>·¤˜6XçbÅôåS¤w}˜A,=Í-½?Hæ­ÎSääßuWÚR:˜YT¥¥lWÖí%é’]‘%½˜¡„úÃOJïß¿ï»?õ— ûy:óí¦•v;µ—qj—¦êçT‘xž‡ŽmìeR'8ÍWç,–^ã'ž3Å…7¢{Rô{ô¸Pƒe9#eu>•]E­¯¤–¤n01äkMÚ˜R*•”}bÕÆúÝ®èhíSR⌠|öÄø+ôågÑëÖqu,“Š¨Ì**n}¦ž>Ÿïwb}õ nLi’bfÞ¯iº&µB:xžUEm¨ÛòØ“6×m¨¦˜õI+n Y½%ìÐ;òzv—ÀrîºJºÃ;g®ŸÀhúºž÷IED|£ž©…Z]Lõ¼+Ó/v“ÝQ*¬ÑQ5^‘ßjØ‹¤H,^¥e½.eg”¬¤HÄïÜÀÕ]B¦ŒTIÑ×Ò\yæ 7^d>%ìPãzÉá¶æp‹‹%›oºRrÑ’2ô"miÙ#‘DZçWï’¢Kˆ«£KÌMf|ÃÍ]Ÿ¯ï’XNeVP«7­×䮸ØöéW÷É÷¤Š¨ÕÉ^j6in¶::æ —ÛÓO]636àéÛ›Y™ ´Œ|ÖÝOͪ«6föQ¦œ¿0æŽ1òJdÎŽÍ cR(63VµŸºŠËÑ6 ÌKÛŸ¦¤î¸¦°ÑÅ͆«©eæ0}ï{¢†Ðeá"¦‰Ãd_`à¾$¹Tñu ä([{¹…cìxÿþýÏ():ÿ*M¸c ]B——t£ª¨ØíǬ-õ9ƒ“ˤ’2šš¼¡F~÷u­gï’§^ye(äÎÛE¿µöt¾PS-ô$½ïÒNœ51p­£èᯑzuŸ$?«v³svâ°Æh¨ª¨*+é˜Oš´äpŠdÔ7­°Ñ\CMMUYSME&”8ZsÖvÕ·t”˜²]AOjEb,Çp*Ó‚J»ôÀÁÎŒ­mfdjn柑¸} G™e±poFñìI]æüuôÌSÝ$åkÆíÎ*íjö´ºòÿh¸ü"IÕðUþ:û€¬¤žè㺱LjJ±x¶Û:®Pš„cyjª\¶†ºšŠ††:y¡c=Ÿì…ŒŠz3¥ßšÆ<¥UôÂ{²»¦² G}¼Žåô°½<©ÓS_ÿ±H±Qn<¯Œ¬Ë75TY ö}8âÒÊ)_» ¶kéj)û%ßf*¢ô=1ãTœ:%µvÿIuMUCÆ©ù%ÉHjݹ;\5•Åg©Ùsôùö;:%u‹”ƹ»ëFÊͼTjþ‹É3E<KII]iWdj˜´,W:CÈò0u5¹#Q…5Á ºøCOÊ[ï'Qh‰¢sRuº*Ê ÎKO:Ù(›LÝfbbidnÎåÝ"Ϧ æ~K*1{[•°½.$Å”«¾ÉôM¤‰K*Øëâ5µ¬ ÄvV:1Õt¤èNš¥gìCæ$+éáı¡/ ±²ÖѶH­¦¿7eO:‹ëšXJeßËV¶Ž¯¢è“¹û6j²ô矠 äúÊ+ ƒàÂÔ¢Þïº-¢&hY\ÈÍý¬7ó}T¹xûð5Æ«±”Õ”Æ íœæ嬾*ÕÐdÛ© KÙqÕ‡*å½æï-Ö¼ì¹ðÄ£—5Yº1—%‹Êoñöóäð´ŒÍ­ ç'Ø'TS6p[”œ/©=)é^+¦‹ ù,ùW2÷á±H’é=CÚŒYeVR]çýe‡³ÒJ(É·ˆ»îÈf¾BÚa¯”º!Ö“JéÚ¢î—姓fg©ì“IèÌd–P ŸD>ž&“23™’QÜó9'ôbÓ%Ó™s‚ôå@2Iî|*ý]Ìí3L‡‹ÙYÒ)ò’òþ†ç¤èÕ+¦²$÷‰gU0÷Œ|x+½ŒÎ!YyÉ&S]›Üyú[Ì|Š^B…lKXÌ”–´"1i3Ó9‘¼Õó+†ÿc‘è›Q.-äèèÚº®ÃG>*?ô¤èâTÑ­”Ê,Ó—HGÕÄä+HáI/•–±´A>ig0’ PÓô_#ÙÌ´Âû꣦l»&·žÄº‹5úJAÇÛÃfyMÏ ëáoâ‘\àa(\|™ÔBOŒÔø¡yô­¬„Îáç˜+m¤’"+j[Ù*V¢ã¹Ó'Ñ&_l,¹)bõ ¶Oß7‘þÔÿ÷—±½]GññEbvsx–v{,)ü w_j÷*%Ca•RôaÎÉeHL ÀG0‹Ìâ³xÀì•ÔpÀ¬bIé.]WÎ\²X$ÒÔà²59ÒÐÐd);mnJ?”©¡?;­ô½•Þ¾ö¹ íl×½IÛ·JÃ$2MòA+K¾Ûò iM®HRS<\8\§kÉšj®ÁªË½ªdÍ…·ÿöëßΛ7o÷îÝ =…ÌBRÔ—””7$I %IE¯“ö¤îê«Ž™y’.6LdWÓ#0åo,Øü°SOãW¨åéBÛì…þö– fI%åÞ§¤æLõÐöYS%],Ó•{¸®ôVÐqÔ¾›?Žc…††’u Û°aCOOAR$õe{R$5Ä$%¤r´ä[O/¥·Ôó5Þ¡›’ èÓOÓ¦™‡fò¬6¤”RëŽ]æ ÌLõ´¦oxÎ põ"©ì f+$£åksâÕ4í–^¤˜,IÛ˜ý0EÑ©¨ðí?GöuDçI[ò">>¾¹¹’‚¤ ©¯:ÜIARCAR3ºzR)Tò¾]BMM- ?G_-žº‰w6sn1rU<‡Í¶N¡oKO/|a®©ÁV3ˆÊ“žÕµ²äõîË(¼iÄa ]âQA®|¾ÀÆw¡¹™!‡o¾ðŒ‚ëÏ÷•;Žì÷™Ë_O‘O1]*H ’‚¤pN ’ù’"v¸ødùẔ¢À¬»ô:öðïÄ|•Â<%¬€L|³âàÝ5W˜G%‹ŽÞYqèYWWhåÑ»«ÎIŸÌrùÕòCµÌ[kN?"ˉÏe®+n_}²vÅÁÛ+?H¸Ø"÷£KäèvÈ]J’ƒL$åáåË—èIAR$ITI-[­ëYC­X±¢££Ã}$IARTItû?¢ÓJÒ»ÏÓÇBd%µ¡†¥*œ>}š¬¡"z1ÔÚµkqá$IAR$Õ«¡d=Õ9Eæ¹ÙúèIeWRIyÍ­A+HºH…%«½aÃÒ‡’½U ’‚¤ )H ’‚¤zª—÷# ¬3%‘Ô¤ÄKï~õïÿ±¨Ÿ!>BNNnæ…¤ )H ’‚¤úë[ôÉ3IñŒÿô—¿’•éÇ}’U:qâÄçzÀ,$IAR$5%uèС-_‹­[·.X°ü+;1))IáÝ»ùùùŸ÷³$IARÔ°“õ­ÉËË“v¬dîÛ-))écõ )H ’‚¤ ©ïARC‹/2’ŠèäñãÇŸý—y!)H ’‚¤ )Hê%úæÍ›~?IAR$IAR_SRÄPqqq---ù$IAR$I}5I………¥¤¤ ü#Ô—ÃÅ' »ŠþÉé¾cÝÕv]ç ìÊþçR±hgÍ'Jª¸¼ÊÔo1)~=žQFé8¬¯f9‘ ²]v3¢?—¤ˆµûýFR„†cA"‚ø ’Š;Y××1˜ß¡ë4üRÇi– #I>}zÓ¦MƒºƒH*£tW}ÇÚË-ßPRËbã'MŸç1}nWLš>WÇÌIÛÔ¡[L´Wè‹Lå§2t-\È¢>q!ž¾epHä§Hêí»k—É“dòãé?ÏÈƃ,\dê@çÄÌñs®óDkòï×ÉÙ ¡~HHȧKjÏ¡“²Y"aï5£ç¾&Eè³$RDE_«1åßÇ×oñâÅ_NR•Õ×]ýfÊ&ÐÙw¦Ž¹Óg?»–FŒ¦_¯¤Ù;¹É%pÈJJÜÉÀ?²ÿÐ1¹òoçéÿ™+ÙòoþµË¿¯ß”žéב”Bbcc–,‰”‹(âчxDÑ¿Vþ)’RXP7n̾9Q”¢ˆO””£ùÞ½»¤J‰DÏ»;?£¤&°¾þMüʸ:&ä 5”%õYvß;·—/_6Üë‡>Êÿ·•Ô²eË\%)…deeàü|\Oª'×®] Á‰ú¼=©ž<{ölÅŠŸø<ð!^ÒF†¤R]]-7¼9ò*RH ’‚¤ )H ’‚¤¾Ž¤È±5`¾è9$Åü\Ú@RÑs仕ÔÀ‹P¿?WIAR$Õ³†asù\-}Ž–^Afàò…#^R!!!ã”X}§‚Ɇ½ƒÓWöÔ•TXxÄeG¨Ëêô\-]c“‰_!i$I$I‘)²ñ¥/w/î+²+)#÷9á_òÀ$uË7—”÷d›™ñéÅýd#³œÛ’.××,{¤Vš’š<ÏØ+$£¬Ÿ¤­¯¦„FÖd/ IàZŽ”4H ’ú8.^¼xüssäÈ}‡©ýÞŠHf0™Lf>þÅ8tèÐï"ïšššO\‡¤5 V±ýÞC—^BÙzäææ;vìø×âèÑ£õõõŸ^ŠÚÛÛ<øWlæ-Fž ú½e˜¡‰vgÏžýÒ‰:sæÌ}*YøçM`ß2vúôé¯YÒH[¨ëç×GŸ½ü÷»ûN:uü+ò¥Ëÿ7¹õ`¢[à@$e>yÁ—ÞôožÛÒ’bóéË")ÇÉÃwÞÞ½_k4i@’ró›9L·qH•Òáž@l¶qP´µµ \Rd摽s‹ ()¯ H¸uçþ%åê„t )H ’|w’ò^0â³1pI9y¢ð VRû¾‡áÀW”‘Û옘˜8bccwïÞý}JJËÄ>!!!®;¥¥¥To‘UAi›Ø%%%­’”¨ÆÆF†€O—”¡Û,Ùßn¦o Û¼yó÷))‘Ü…¬û÷ú”ÀÐJ.i¤ݽ{‡!àKHŠüÙõä|H ’‚¤$I )H ’‚¤$Iá0@R$€¤ )H ’@R$€¤ )H ’@R$$I )H ’‚¤$I )H ’‚¤$I$IARH ’‚¤ )$IARH ’‚¤ )À×AÜÑ1pI‘zx± äÏáûóñb±¸çÄÒâ¢KÊ6zéÒÅÝñ’R˜´;÷\RK»'´sîÝ»‡ÃÀ°8r‰:O{ʬ°ÉþÁ]± ëBZQ?5 ™!8#WËغ+D¦vJB_0|³Áh9Ož>eæ߀`&ܽ§.;ò¨_I¥QV~aZ†B&ÌuÍìÿ÷O‹[9â‹Ðoûß“¦Íò œ÷!i~KöÞì7iÄbîsWÉ&MÏÜñW¿þÍáÃGp`ºHJNÚ¦S™TF•QNW¹ýWË’š™4†é¨¤ÖWSV+…:»víÖOOo»¹ë6\“¤B’”ñ@²Af&y ‘]E%æ5 ¬}Ý&:tè{(B–ö®“–îȹ>¸¤‘yH”IÚú*þÌ+ #§ÉSükkâ¨ÈÒÒÒòÃþ¸hW é °NîªgÈGbO<ûÝÿ6{NpÄ0?'ÅxêäÙÜ¿ŒSO8ßÀlàÀ³ÁDØÖòþüSäâÈïêœÔæ­ÛY"ËÄKï>.i3ÖùáŽ^ºç¤ kæöööðÈel3¯Ì²V2tK¸˜²¹’¥É N0ÙhjjâëN H:‘Q:ˆl™Uõìí#¾³ '˜¤½xñò?Ž ÝR:Оxg#çG«¹{Nf2Iú¨g._¾<Žk{âizqÿ5ÌÚ+­ãæŽNNQQQ¤zIW÷1W¤§¥² ]³*PÓS¡[ËF« ¦MŸÁ\@òÝ^Ý·(2Šm9e}õœ^FÍN˧¡Eúà]Iƒ¤ýbd¨ïµt+éRõzi©^ÒsÿðÇ?GDŒðKÐïÝÀRg‡n)K/éµKE_‘­¬¢½”©i¿óKÐKJJÔчî÷•´"ÊjÆruuµåË–átÀ ºT„]{öþe7ùJ«ì)æźüv®©‡¡QWëWNRäãíÝQx¡ò0ʆ«‡—ýìÕÌrÙX{¹å£YÓ§O_¼H’œ}ûö‘…tÈ0¬³1¨^9‡Ëõ‹ÙZ  i«Î¾þÕ¯;sÖì9£%uçÎŽàÀ0 !>>~ÅŠ ,øëX•ù®f”~hý.?Rû»? èi(¦Z^²dI´ K—. }ýúõ0ÍÆ«W¯ˆycbb¦Mò§ñl¹óqÞ˶À"‰b¶]a6–u‡$¤­­md¡'OžÍ$Isssÿ“’ ëž;’4òÚan¢›Ò[ÒÈge3FJÑòåËq`d9zô(©FHu!äqôÜ‚³+© 5”U@œºš*©x æ>_Ò±ª¯¯Ö©xûöíæÍ›‰ªHBÆëµdÉFJ¡˜gécllLRÔ³¦U˜ òñÇ'åçùóçIII¤ :+ízôhW/Ìv=yò$%%¥NSÙnÙ²¥µµ…‡IÚíÛ·W­ZÅd¦¤mß¾×ò>®ž)++cÆ»zÖ3]OüþZ¿Ì6îÚµ«ç:&3K—.eº“è È%-##ƒ$M®ü0z"I»uë’ø”J¦¹¹™t"dÛÃäEll,s ß÷V½¼~ýšX»+Ì‹ääd’%˜Þ¸ÿ¾ìÐó‚ô:¿·Óv€/éR1íáððð#GŽ|ÏÕ sÂ…ÑéN¡¦í"qÒeFIÒHqBÒŸ·KÕÔÔ”Íü>Ý÷\½0Û~ãÆÌÌÌï³;ùÑIËËËÛ¸q#:P€/WÏÙl 'ƒÊ’zCüᶓ/?LúÈefòMKœPß{Nú(B=sƒ"øl´ç³?zë“n“Rì…Zá[¨—E*”Uh”•”YJJ’—*Jã€G{¦ŒÇüMf`)3s©¨„ï/¥¨g6£Æ*«i²%°ÆÿÄ5°]½{x=@µFô¿?%ÝîVAî ²Óô¢škkª2;A©+'Ê*ÎÏD#““ÎtMK Ž¦¦Vä¦ ]•ÖÎØ mÒåÐN[º¹ë÷z×ò+Ýíj¦Cf2°ž|ìzƒtSšß¤†ù ylŽÙÚC•Ìï Š3ÒYx%+ÄEÉbဓ2Iµ§Û¨›'(úx{Tba‹œ¤fî)‘)Ó“¥;ó¼ì”æ¼è¿éÌ|ó范¡@SC0{ÍþÎŒµOY¨Çã°5ù“毭ïü¥ƒÑú†áù)ÁJÖ‘äφ›Ç½m HVd꼫¸3ÿíÍ[cf‰ølžÐpù¶|f?ÕäØjøŸ<œ4CEÒ§ÿ„ÕÀ$õv:裏$«â/¸ùº£›¤F©¤Ýý`±¸ÉYO%n߃n;)ËZÙë@ù±D&—g˜~îVç ½Jœï)`“‰º SOwn`û$3Õ5{ -ø‚9tÚ+§ZêóIA3wŸ]ð¤Uú“‹oî.ówâq9"c§ÝW¥íªåS8SÖ/r3PõÚ„ €o ©U¼í6m“§Ñg–”õx·˜ YI½¿0¥Á›¶ìÀ‹Wo^×ÝðÖ¸á™!nš©¡GDíã'Ož~úôiv„»¾cH‹¤F?‘dÅ7tÛ|®ìÑÓ×ÍÏʵٚû®ÞzöìÙݪ‹–ÒÎBÒó­1Y‡o¢sò &@WÃ3•n ÜÝïÁѵ[½õÜ£'Ï>½c@Kjœ ²ûĆŸURÔ{']åU»õØïítc D+·_yý¦þ齫&VznÕÞàk é½åÙÓ§Üð1К™yŠYŒ£¶h¢ÿ…[µ^¼{t ZÍÈýúÃGÏž>©8?JÕ¼®|Í5G •Y¯>yöìñõÓV,åeyô±*ØPhì}´üNíóT|}I±Ô”ÆŽÛرÊl®éÒO’ÔÒÃ}ecÔÆk}Þ}çÒ¼1ã̪;G´®™al7Ô¯ž?n¤kwq[[ÛÝ­KÔ­|™Ê+-ÌÄÜ5Š‘©ÍÍQ×6«~%]TëúöêÑ©–¾]×z¼¯JPÕ˜úš¢.eØ DÓÞn æº¹KyœLNÆŽUÒ`~’¤‚_ëúûƹ4Þî–{ݹÄåñ£Æé_m“º½äÀb¡¶WCÕðòÉKI+‚ääiî& =Ó×ÍtVN­µÑ6|/ÉÉ›Ûç8\íÜÒ/}ûº¡µƒz]yTC zܵ"7¨LpyLQ÷x©i¸>ÿLƒWDR"{¼L3f,‹ÃsþIuî{6kŽ’ŠiY÷¦Ô½Ýn,u·§[±ÔËÒk éé´?{òH²¬’®¢E6¼€df~_Gmÿ¸=Ln‹“‚ض3^v—†× bª<ÑOÕeq×ò‹wÌÑš¸˜$oõ\#ïXŒõ0rzR,u 5sŽœ¥ª®chšp¸RîÔ‘ÔOZs»~íïÊÆ¥+wR¯¾¨9éa"àkéèéë늴6¾Ì¢ÓB ìçKëï7Ë=,¸ªãM\ü7Î{úšÔÓTnv$G[ÇÛ‡Áwò$u%^é{êRº­Àecûà’òEzRêÒ+.TXjZzFaY¹r9!’ú‘ãUßùçíÜõ<‘áófªáþÕé6"žPDr¢§#˜½d$•d¥3ik»4'ï×Nsä«OбñÉØ}¶ö½G¯ŸMçò“¼}¥IñvV«~â ‘”'Ë<±í3• /Ñ“2Sb©KKŠªš¦™Ýþk¯äÎÝÛå¦d¾¶£³»µu–‹aðjòê~Þ3!G ÒÕ'EHK =c­TRüÈœ²Îîýƒ`[C ÖÇ)óä–¼zK ¦û»p Mý:³åjoÆÓ²|%¦VÏÑs?AðÍ$õÎIEäÖRm­-„ÖÖ¶öŽž­P‰¤æ¼g*ŠÊ[¿DhíÑN½tÕžº©²¦ãþŽ(5‹NI…8Ì?!îœ_,&íä–š¼C.F-²§m—r–h[z5¾o–…ÌIKÊmKÇ`%õÎIí, Ú%9i!9iïy:_")Ï7Ûxó\&Odôšj2çµ2¯­ÎÉó‹›5te$åµ³£s~²¸¶¶Ö;ŧú˜ó¸ì#ÕM·r3ùÚ¦[esÒAI$e™Üþ™JÐ:'µîfkg jmWT„$’JlïÜA箿(ÓåkîÈÜA>ÓÑQ²Ä–3­SRöü¨MTWêèhinÊ?¶ÙÙTG`êVßA­t1#škkù¬z'Ò’Zt’`$IªëœToIkPÐ.­yvÄL2uZL5ˆÆªŸiN\æηQ ©†§× nt]Rñ.@‹»üì­ú‹YJÚVõ]U¿¸þEÝW:’’;'Õ"©ÑcE§ÞIsuk–Îôê†Ñh•í/¤O§ò Ì{Jêý«{—«ºÎ˜ˆ#,õæl8ßróŒ:_ûÆë¶Îúýí³×ôÒ‡…¤ºÎIõƽÝnªª¶:wøw“©+öÔßÚËS×»Ó"½¸‘t—´HêÙ’ëZ;{f&¨mzÐz7˼Å\ªS‡ïêê%½MH €ïSR*|#oÿè²ÊâÜíY¢ŽÓ'ú]DJAI‡kªÊ÷§Î pWX_©¾ÞÚ]R•‡bÇ«™ï?s¹¼¼ìÂá \5î¹;¤ÿñ*ÂFh:'éjIyIþ¹{ ÓÐÃÃNRغÎî óJ*Ê.tиý>EµÎš¨ìµ³ªºâXÎâ__Gïd~ù»î’z\´qüx½-Ç/–•—_>½G—­±õJ-E5­šd¤ç·4¯¨¬´ðârOö´ì$)w¶župtfYeÕÅC)|e]ïšëª„šªkv_¨©,Ή7ßJÙ0 êA­¸»¤.óa›øžÉ+(/+=µu™ª¦ÙºÛ}ß[¤ê½¥¨¬¢ðÒ1/}eïäbH €o-©2kŽÞnW5´oöwpˆ? [%:§ìz¨@Rïî:i¹#[áÕMÕ1ˆËÞ¯¤~Ô]ôêùo[C#ëuÇ*%* ÞÖ÷²55žh|ü6™kõTˉæÞuíÔÆeö>KÎuž“¢jó¶ø8˜ÚzÍ:{·¹³ñÛºuå8¨ÏÛ-»IJ'¤]neäoœì±ø^~C\ñ«Ý·o0ié‘“Kì#'= 4ÀœÐ’âù¾’9é£õ(=¶·{9p÷.ZR6™òÛ&·x;µ—Ñÿͼ°ß=%zJ JRð¹h©LŸ4'«‰•Ô]ñÍHÄÀxš»ÜwñQäà“‹‘CÔMoÞPW®PžžÔßÿ=²àÛ‹‰¼èè òó).—úÙϤñÏÿŒ øÆlÚD©©Q¿úÕ=1ñË_~¼õ€¦µ•Z·Ž25•“lüýßSvvÔ¤I”··|ÌœIw‹¹s©%K¨+11Tl¬|¬\IÅÇËÇêÕÔš5ò‘”D¯¼\¤¥QYYTff·X¿žÚ¼Y>¶m£öì‘ýû©cÇäãäIêÂùÈË£JJ䣼œº}[>îÝ£^¼W¯¨övù€Ü?ט`Äðô)ååEý÷÷*©ÿó(MMº“¥¤DM˜Ð-Ƨƌ‘Ñ£©Ÿ~¢~üQ>þö7ñ§?ÉÇÿHýïÿÊÇïOýîwòñ?ÿC¯öÿûÝ‚Lù¯ÿ’ÿüOê׿–ÿøêßþM>þå_èáM¹øǤþáhYËIKfúA¶ˆl—\œôLÝ?Pù‹|ŒG©ªÊ‡@@éëˇ¥%åè(¤…@͘Ñ-æϧ–.íQQtû$;[>¶o§NœÒl¸~ý“âÆ qó¦|ܺ¥ )Bâî]qÿ>õà|ÔÖ*ˆ'O䃛uu ‚´p^¿¦£­ ø^Zž¤´¿|IÍ™£ 6ûÕ¯¾ì ÈEG‡‚. ²†=ƒô[Z䣹YA¼¯ Þ½SMMŠ·oŸ?H%VQA÷ÝdãêUêðaùص‹JI‘ÄD*<œŠˆè R~~ò1y2ecCY[w J$¢´µ»‘”²2ݘ‘ Ò’aÚ²ñ‡?ÐúûÍoäƒ4 þ韺QçßýõóŸw‹o®x²rÄû¿ø…‚øå/´|HsH.Èlÿú¯òA¦÷œÈÌIþ‰A¾GŠŠèê‹_ARãZß Ò’ Ò>ih/è\<|HݹÓ-H§‰t»ª«åƒ4$Š‹å£°º|™¾zV6.]¢ÎŸ§rs»Å¹sÔ©Sòqò¤t úÑ#ìFð]W€äqq¡ÆŽEJ ÝÀpäÿWÆP. endstream endobj 1549 0 obj << /Length 503 /Filter /FlateDecode >> stream xÚ½TMsÓ0½ûWì g†lWßGJÉÐ{*ŽI”ÄCœÛ¡À¯G²Hh¦´ZKoŸôÞŠ` “ìu‘]¼:Í5 0Œ´(€bwùtßT³²+Gcnl~Ûú&E“}5÷£1£üeJÜøµ/[Ÿ&9²Ñ}q]Ù猅b,K4d`Vgw÷ó¿Bá,<ö«jÚ†q Óì}FQêÿ5KHÁÍäU[ÔL€a -ÓÏ"›PܨŸè'–qÐŽ¡Òê9 .‘ Ä/KA ö4sTÆ!1v\&æ¥èŒ=7g‘éX5ÍÁÕ´ŒªYŽFƒ!ÖÉ$\· Z}ñÍÃlµß|zh«ïþÕh¬‰r®4™d_¤Lµiw~Ö¥IS>¦ í_Ö‡iìÁÚoi,‡Qÿ!ìVÕ°(ÖFăYÐ)w 7[W~ÓýozÑ“çnöw{øVIÌÚ°Ç—F¡ÿÊ¥§²³ÓfÕÁ;\ š_}-ëÝ:ö ¢œ©4N»f$LÞßUœ³¶õõÇõ·_M*¹B®z‚[T]…†ËÈöâ]ÍÈÁ›í£“ÎV¹þãÆ>ûòÈðj„.ìÏÂï}#¤AcyØا/Wå®;!" endstream endobj 1545 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 438 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 19884 /Filter /FlateDecode >> stream xÚíÝ 8TÝðz[P”}O ¥}ßw¥=Ò¾¢ í©ì{ ¡Eei}+m¢´ê­´ e¯´¢!»1ÌýŸ™Ë4¡’Äèÿý<§yÆ™;gnã|ýî=s‡¢~‹õ³õЇòÅ,¾ÙH¬Ê]úzoú ð×%Téãó®ýÛK5mÖL¢}ß]g•Òã/«N‡ß['þÓ\°Y¹æÂrz;| Jøhü·îØhÅcf……—··W^þð‡„YŒ•ìô&‡\ÿòòzY©Aaœ[âäµ}]Wݸk:KVËŠûã—W7:·•s ˜6ÔÎ~‚kCK*,¼nÓ«Q(B àÕµÛ¯¨òWŸãNÈÈ÷ÉgƯÛ7QMäTSßÖ^köÏUì3¬\±¾s½<¤4Íxoó×î-¢îFUÞéÇùñVêX¥…ìe?ímÅ⬇©oûPÕã±? FÆuîÐ]Ç;ʲJ™_²IUUª7k”œ¤ìðñó£K¨°=ƒ†ÙÝéÕA¦Q÷änNzŠÒb­Ä%Äd”&š\§»iF_©Ö"’’â­¥†^bÊqÖRêúózÉ+«´o%Õfîn¿m%;µ“”–sð‹¯ß„çkµî}LüØטftï *Ò¢µ`Ëöª]Ÿ$‡fGžëЮp‹V­[´íØ9äcg…© zµm%,)"¤Ô±kXjyô{×*ÊŠ‹ˆIˆˆË Ò;G?ëY+]y)ÑVbââ²JšVwØ‹bÌ¥'Ìé!§¬ÒŽôvþî Ý”$TÛIHÊÈ9]b”;û·˜e·UQ²•ˆP 9¥v®×^•‡TXñ»Câ­Ge²{À¢ #î~›P%éo_ÄáÍðKÈð™}¶­„¸œòØIš›¾Êà–¯;”URT¸Çy%…{/’ÌRꥈüˆ¸,öÑ™ÜÄP%‰[‰9ÔSóFB£R8ð%þšœ¬Ò—bR¶-šÈù½'רÈ‹eeåb3ؕȃÉýôwV®¤$Ujk/\À1sê˜þ³·¤p*ºÃë ]áE×0÷œ¦µêºš¬ÑvžÜp½ÓôcLVV÷dð1V­C/ôšÖ©å]ŠÊW—pšO–ä'K‹Ë¦æ—R1{…ÛŒ‹Ïa|Ë~sONJêQZ!kÙ¢‰ü¥öëzzDGN^áyû^z㸒+»µTT‘ÌÎ=ê™·^3ñÉ_+)F×vâAñì]¦Ñ§m”F,¨ðêÞ<ûo6€šäû¢(âÁõ}ŽS‡uýG@dÖ†ÃìÑ™zѾ©ê:¤ök?ƃŹóYCÍ^³×^¼pþüù ÎÍQVÐõÿzä*ýÛˇ-ÉŸÅ`‡Ô?ÊúôòÔgûÛ-`rÖî¨ÓmùŽÊ!%5`º×ÁlöƺrÊýÃ?’Hø2^LpÃÑÀó—ü´i!ý,·üaŹ¯bž,Ôn„{Ÿ[‚¿ms…în§®&gs÷Ë•NWš oÿ(æ=÷¹ŽéŽé§³é²û%øùÑVvåÍd*ÎòúBÝ•”•pö†ÚÍï®ïÌ©þã|,ßfÅSä»<ûzLjßä.šûï‘Ûl§É,rý¶NÌKIxwÀ/+Í{xÿqaé׃&ïî••“‰Éd|RC;,¼EßÃaþØ^£5 ØÖ¬]¿ÞåáGª8aÃÌÁ"âJ#ÆL\¼lù×RYM¯6åÙ>Åö‹è¹qaß © ǤtûwZu2„¢â;7—˜·fýŒk ŒV¯ŽÏ§âïîÓVB¥GÿÉZótû·¥CŠ¸ãc;}ü0‘f }&_~žI–$…jÏîÕQ¾QQ=›#Å,ÊdÊÐ~ãf•¯píú naŸÙ!Õɨ<¤Ü”TtK8ýxb;¿'¤vö\òõ˜ÔŠÂ× ¾Nœx¾CPN›* —èü¼â1¯4¼Ñj¢$¹­¸à“ÔzXe'UQšŒ¬ü½OCjÁ-º’:¿nÚ€Õ{¨²É¬'wo'ç•œÑSW™kG¯’ùåÍo†ÍA½ûÔýw(*{‚˜ÐþWå1Zœtó EåŽkb{§¬  ÖUÆ ©Œä×o?dÒ ÿsœ*$>«€*ˆ‰zY-_¢TäeýÞæœ\>vØ–£e/UúøöíOL*ö'!µk€ÀëÈòž¥&Þäp"ïì¾Òam[lÓÓî2ß¼ÒV.À àױ׃»ÉŽÝ’—ŸŸŸ——sÍqšB‡yLrÓóMUž39;èÊCŠcIÿJ4“9“]TTôéù%9YÅ·Ù¬ÃËÇ4p§X%Ì⢛;&ËË+¤”þfHÙíÑ×ê2¹rÂllçÁ:ù………y®*–œ¢¨ÏÃ[µØSÄ,aæe%õh£8Ìí>¹§¿Ã²v£1 ‹ ^›×ºyö×]š ì É*,*Êýü¶ƒœlPbõÎK¼©Üù9EEŒÏ|¥åÛ§”ü<¤µl£ÔþmFéȹã[ôXA};Ý~úpI ó +ÏuÌÉHÁ» à—SŠ<–súIËÊÉËËËÉɶí21¹ì«ŒI]$Ä[u¸Ç¤Â÷ i?ŸÞÝǾx°C\Bš}¥c1ÙœŠìÍh ²DF¦ÉéP%99ÑΨx‡ÆÊÜÚ«À ©Ú]—;T )“™2߆TŒÕ(a!ÅPvµTh¦ÙEŽÓAé~‹3‹9Ùql£˜´» íÕ^ž×––s¿Oj©Ååè{ÊJw‰þ\Dîâ³^TJ–³H~†Ãt~Dùš‰KÈ…²ŠíOÇs*‹ÆËCê‰[enHÍ£Iíè+zèÑEyö“ŠÉ|ú™}ó5ëž½ Cé³äѶ&"#S¨JÜ9o6€å{-.*ÌÍÍÍ/,â.cÏ›..ÊÍË/e}iœËRfQ^nƒY¶„=J—2órs ‹Ù£qIQ~~aqù)+Xßœ>¨ªó Uµõm)RFååpWÉé3{gŽEŠ@&=Ñbòò鈡ïYÂ($½-d0¹b/,®ø*ö–ª¢·¥ìm’Ç»rn÷/3rû±ïÿ1P/IŸµ`¦†\+ q•?§ P¯!Å8sòxPD2…ˆ€o±(ª4-fǶµ‹/6Üêñ‰½ŒÅ¢Šžœ»Í—Ÿ{žsC{ÉR^º ÝL§>„ù,Ó__Âb¿Šò—˜e<{îÞHE-_™T@•¾[9]ûQþÿø8¡XTÎC7 ÑÅ›¬÷îÝkµAGX@ÔåárSácÇáKÕÆ“ä²°WRû{çTûÎnn®\.»\"²©Â”§¢²JQy%œxb¿Æü¨sÍ¥z|àt¦[Ñ ç9TiD»Æâ²ðàkZÛ¯8QV>QÔû +%¥Õ‹J¹)öµ ቶJ‹è‡WuOŠ*%(õ¸âBÖטüáš9keñ<ð›’é:°ªÒ°pi[±Qî/¸‹.ï^ØUm …hhui³áßÇÜñ™ŸzæÜef)UüßÊF=·±—–úÚ-nÕ´™dõ˜˜Ã¤—²fÜo$Ú5%æB6¢M›¶Òs¹D—JÉ‘ãz¶WêísûY²¦» ¬œœ„¸ŒÏVªšæQú¹J“n5éÈ$±qECjyÀE»ùÄgåÅ_Þnœ1¸¹ €¬êÈ‹¡‰ôLT$ÚŒ­\IURlIËLÈ+‹M–~çf %r‚!Ð`aûîÖ1ÒRâ݆Ï>{'*7?ŸYR¶‹¬8x]‹aVì€p˜ªÜO³Lº)Jµè¾žýÈÌÇ­ZItjȾžû ›¤€×ƒl*ï™L3q³k9·»ÊH…³ú䌔~ÈyºO'4åæŸ* ©ÁÂmú‘h+¸1OVEIm¹ýˤÏõyª”Ь7ÉRƒ]•DšŒÌ'×ßÜ?¼Ç˯ŠêÒ?;ûKÖW9¥tÔ|P’—Mf?–J8#Ø¢Çë²â !ЀRŠ]l¤ÄØ®«(.)+'¯Ø®“o|»¢) ©Ô~Í%ü¾ÐFEÙLhÚeR-D”#Ë4Í¥àø‘b¥¤¦—ï’cô—jv;\ù9¿„I‡TÁí–¢ý3¸÷y¶µI'#:¤„${s'Ç•…E%=ðݧwçN*rR’R"-«RBÃöÓ ïÞ,%+-QN´•H÷ïuŸ]IuXEìr|¹±\Dj&‰Û5#D ¼ãË‚!¤滞íÛÆç” íìKF†´¬üM’RtH•<ìT¶¯ŒE\[ÙDu-7¤ò¿ ©””{Þ­ä»Ý KIË$ ‡ÈVUI-à„‹*~{KX©?R‚ÃÒë 9iÖUmå³ô›úÎ1)Î2»É‹<ˆ¼$Û¬S4‹;Q!ÐP*)ò¯dh[¹y—¸ËÒî“‘’O-(¯¤(juwÁY.aô­Ôºv[_uH]I»ç½¥Ûxý²E/µ¸—Å ©òcRŸOi÷·¢oxp…TÇBª(>PH¼ÓãܲuŒS°¹Ï~à›ÇwEURÝWU –½¶ #»ê£Òq¾ϼ!%q­´ê* ø"¦X,拳C•E%ÚöÔœ®¥6¨K“m¶ù’ʉ*¾­ß¨ »ü‰¾ØQRhìliCÛ­Z;A ›1û‘ väîîÓ(ºÓÿcñû»*­f®Úbl¨£:rn'%±©zûHm6K¶é(Á™,*ïqI¡aZKWÍ3`â QIUö쾫Zúîá¦æU›‚ÍÄ,]6HQ°·¦eç†e Å1:ÿæÖ>–¾5Ù$„Á…A†-šýcy:öëŒw*¯xÓë±$¤ž*6jÚ„÷‘¢‹‹ñ†à¿œ"—ï"îõõ½qïYù2î¨^’ôê5ƒ*½êw6ü#3ç‚Žô¬½wÐg±¾ùû¢ðŠß™ Ð·äZîë'ço„±çÚå&9ë— +•Œ+Î܉LªP¼Ð+)[Õ—W~gÏ>ŠÏ¤¾ý Ö7ûý¾_õpoaQ®°*ß„J  Asž*Õo™wFFfFúû!vÆa›¿ÔY¥yn†Óåää: 8ðß»ï–!uŸS•c þ°’’’¢¢¢ââb&“I®óÞÄb±°} ikk7nÜXHHH\\\JJJTTtêÔ©ÇŽËÏÏGT@ýÒÑÑiôÂÂÂ;w¶²²ÂV€zñøñc}}}--­.]º|/°F}ðàAl.¨3UîÊËÌ̼r劣£ã˜1c*D)¬üüü(ìþpúôéI“&ñFÕ„ ²²²SÀ?ÕɦÆÓ9Õ²eˤ¤$äðUT©ªª’ú矄……YØ8À?.\H×S ØÀo%Õ¤I“H1Er •ð[Nùûû“„jܸñš5k’’’(Ì÷¾Bïñ›?¾™™Ù‰'JJJSÀžwÕ¼e††ë6˜™l=xÀãVÐÍ÷ïÞ!¤€èo4Ÿ½bˬå›ÑÐÐê¾™¦m´çÚ ©7RyÑáuì%åpåÃÊ]'/3í8pBa“gi¯41·òöò¼z%0,,ìCRÒß1Ï!Õ°hê®;OùD¡¡¡ÕG‹f`ªÇú^ñuè)åÅÙmxô9åò_†¾³ÿÝ-í{ –PP§1ËÌÂÚÏïâó¸¸ÄÄÄÌŒŒ¢¢¢´—!Õ°LÕ6bÿš„¡¡¡¡UcÏaù‘/¯Êý~¾¡ûÕIK¶©öÚ\°ÅÀa£¶m7¹˜‘‘QXXÈ`0*Ÿnˆ !…BCCû?l!%û1öÜÏw½óe½GÐôÕ6FMïÕ»ïºuëüü.dee¡’„?´CåóäIr9ßÊp¸œ`q&ÎÀõòœµ;ÔµöêÝ»¿¾†††çÎø&'DHB ­þ÷Ò» #ÙÇã<ž”î¸úqû‰ð5® Lƒ+o(Ð?Z[[;::ÚÙÙ¹»»>þ¼  àB !…††öwÎjˆc_1>òxæZ§ç´–RTîÖwèHµé3f®Z¥¿aÆ-[¶˜˜˜ßÊʪB}EUÈr[[[’\$;bcckë»HR ‹†Îº£/)¯¨¯Í' ­îÚ!¾9-)ˆ¼#ÙóëŽÇ³?Ü´Éûþ¬uNýÆÍUî3ªïð‰#ÇN˜:UcÁ¼¹+–/_kd¸mÛ66R YóFR-âf–y9R”Ñ5×???„Ô_oµ‘žÁº«è¶rÍÚcÆ1fÈH44´?Þz÷²É3¸îO*ëUvRÙÝ·³6{?\°í€ÚüõC5— Ÿ4gøèq#G Ÿ8^}þ¼y«V陘l···'u ¤?F?N(zo¡)©­NŸ>—P£oAH5 UÖËnnn¶P'ôW,±>ñçöÑÑß-E"É)(}û‰p½ççlÞ3e™É(ÍEý 뢪2tÈàéZÓôõV’Xppp u F?ÞGWëIÄ #zoáîÝ»?N ¥7n<{ö,99™ÉdÖÖ*„TCçääT7ïOX¾R‰Í‰ß £²o餄±ÏXnã÷jëÑ5»/ÏZ»sÄ”U»ÉHŠ÷íÛGScÊêÕ«H 9p*#kkëŸ0úaDO¢ ‘D:àìììåååããsáÂ…°°°”””:˜æ‡BHÀŸ ©pö1,÷ûù.·2v^OÙâó`Îzçc´¤¤eÅDEûôí;MSc­‘QÝøF;wîtãðõõ%a”––VCB !¿R¤Jâ¶ý!Ì­GÍ4tì1X½EKa9…͘1cãÆußçÊ3ñ¸H2’H:sæÌÓ§O322øpˆCHý!u€Rÿr-Ý䬩oÝe€ZKQIå.½†={ÎRmÙ²eÛ¶m¦¦¦$%*ڨ΂‰žbG 42V\¸p„Qzzz~~~QQ“ÉäÃ/BHýeÎ@Øå¼»iK‰þ#ÆÏœ³`íÚuŽ;H-b¿aýúíÛ·[[3»»¨Â4z&IÆÝ»w_¼x1,,,!!!555;;›Á`ÔÁÁ#„Ts¾ԙׯ_“t¨³²ˆ”fôœ:ò¤îîî¤2ºÿ~ddä›7o222Š‹‹ÿ¾-Œ¨±øøøÚ © ûèÈ%] íÙ³Ç××÷Ê•+wïÞ‹‹KOOÿ¿úë!P—!UùÌ ¤>²µµ¥ÏÌpâÄ ’GÑÑÑŸ?Æž„ÀŸ©ïM½ aäìì¼wï^ÿ¨¨¨¬¬,„B àÏ…ïoúÒÊÊÊÑÑÑÞÞÞÍÍ„QLLLnn.’!PÇ!EB"aKˆÁ`0™ÌÒÒRþŸàÍÿž={F‡ÔðáÃR¿„äN…óÔ!ŒjÙ¼$¡š4iÒ´iSÞ¹ý)àça¡Â’””ä«W¯^½Šð÷Ù²e ]LIIIqs !üF%%%/žÇ¸8;o\¿VÑœ¥F㘳vÖú݆{ƒæ.Z‚ðWÖªªªª7&9%""²téR;;;„ÔWY”••{+(èÔ¿'œ×¬7ž0kI×aSúŒ›§e¸ÓÀýú®ŸŽ½d½ŽO4ûlÒôiÓ¼¢¨e«Œ°=þÊQ‚üÚ³gÏFå:vì¸|ùò7nPع &‰˜ÅÅ™™ 1117oÜpqu_¸T¿Û€Q¢ò*&ÌŸµÑ}ë±P¯êèsv‘+‡Â˾æà{ !ð×!šššt=E½uëVå”üR^XX˜››ûùsúÕ«×LÍ-G©OjÙZ¢MÇ£ç,µ=é˜äÅþnRýÎs#¤þr*;;[YYùŸþáFU“&MÈåÆ?|ø——Ç`0P[ÁJ¤·oßž8~|ɲU;‹ŠIô5Ek݆ÿ¹çî{ÄØÿ˜éñ¤ôÇ5B ~<ìêiôèÑ‚‚‚xä"u–°°pëÖ­EDDdeeÛ¶mÛ§O¶Ûÿ›Ç:;5½­¢|ÿÁÃ'.X£½Ýc‹Ï;ÿ·;¯§ºÞÍÞÂ<ô”S…󵤨‘Z¾zo™Ìâ¢ÂBüOü­rrrbbb´´´š6mÚèûæÌ™ƒmõ·–E)ÉÉW/[ZXLÓœª>v¬Æl+MnóÐsòßâóÈÚïµël¯Höwë°wÖ=ýãIôƒF:0]ßrÒ‚5ê³WŽÒZ2lª6ij3–MÕ6œ² ­^›¶Ñ(õÉEEEµ8R1ŒåË—wëÖ·’ª2¤8€á½¡gÓó¸Ø çÏÙÚÚè-_ºd¹Þœ¥F“o¿ÄtÁöƒ†{n0òxRJϦcÏaxJÕK ý¸±'øEPÞQhhh|×ÈбÒxGAAA­ÄShh¨ššZå0RPP044trr:{ölHHHlll|||rr2ù†ReddDGE^öÄd§§§‘¿BŸ<¹|)`§“‹ÎŠ5½‡OlÛmÈTÝÙ›ön;FJ¡£/Ø_~íù[êÐÐÐÐê ¤è¬yðàïüsYYY]]]{{{î9(x¿kïÞ½©©©U>)«0 μîÏ’’._¾lfi5f¢fkIyÅN½Ôæ¬YjzÇ•¤Ã±ìB›»ƒeZ­¤®]»Æ'‘Í›7“Ò‰{¿|o}¥;wž:uÊßß?00ðúõë%%%õ8z—eÊÌûûRéÍ›7G]¶B¯cç®-ZŠô9iÚ*›oï{TDÒ‡Û*¦Áoÿ„T Jò˜˜î¤---O5øŠI^d,­óã/_k¸ÜËK[ŽÞÙÐ#iÈÐaòòò½ ÓX²i™Íq³Ó‘N7>¹ü—é~/Ï#¤„w^7 ÿCJCÛÈÍÍ­f㡤¤$RË–-ã=z BŠÞHŸO©neOä|¥‹Y˜“Ïhè!•˜˜øâÅË'~~íæ/Ñï9tœ|§~#f¬\`âez*Ò;Š}Ê îq%ä?‡Ôä…kììlk0~øð®¡HTU3¡¸ydbb²ÿþ   øøø¤¤¤>~~~uÞ„3¼ÿ†{p*ÀÃb†–†ÎˤNÍÃøTLÊéæãù%Œ[úôî¾—×[‹Ê8ùœ8á½[¦µˆÝÍx²ÐsSŸ.C'-´ö¼ìv|™!Û.ÿG¬Š‹‹£"#Nü×ÌÔdébm¥+g/[§±|»æjûe¶'6{Ý·¿œ@ ®¯ŸuBñ…††ÖB*44´Ê¯¯P¤nrvv~ðàÁ÷ÿÈ/u-7v÷SöMåç8váö’´'RòmÓJée”ýå©ëHHÉHÉ9E—Mó°YÔ~±KR2ŠcŠè5¿?ÑX~*Yxq±’º[|ùS†+6oKž`{áù§Ré•:èÏ6?LQ9“ZK^áìî+*)½.Í—žøH?4ó¢^3²r¯Í}ûOÝ\ÖãàMûìø›> URR’››Kþ~øøñã›7oBCŸøùùmß¾mö¬#GŒl§¤Ø¾}û£&M^¼EÇÌ{í¾›ÛO„“ðr¿—çY~ŠWÌDCCã§zòäÉ÷BŠ{¤ÉÕÕ5::ú'sËKòÈË_IÈfGGùÝ’Ÿ8*(Í.æüD.îîßÐCc-Uœ"#Óæ]^Ù‡­ì–ª.ÙýœRšÒþ-{äGߦìbLë6hØpŽ‘#‡J7pKéЪMD1ÅûD•])¤^´m¬øôkÿâU„dŸS^{LÞþ¸,¤B×6ïçØ0? Å,((ÈÉÉùüù3ù¯¹råÊÞ½{I‘Kÿ¯™™™ñ(äýµ²²²¶¶¶µµµ··'xèêêŒQSSéØ©¥@Õîj³Vê˜y’ärLtJgOÒxRRáü{hhhh|Rô°vüøñj}ô‰™×[^þê{:¤(V)3¿°8ù‘‚ÒÌbE?8ØcCw C:¤ÞçWROSß„T¡z+ÉS™> ôF©µR$ƒ*{"&#¿QUHŶýG1Œ.áØñ[H‡3Ø!5e{hƒ )²ýoÞ¼yêÔ©;wÒ¬®0eŲ–XqhLÚ»ß1 ©–­z Ÿ4ÓhçŸ{ía’ä:PéLæüP|‘^‘¾¡¡¡ñ[#ãä«k7¤èqïÚµkÕþp.s[Í#±ôqgmå‡Ï,M{$+¯VPJ/tÐí¬it†*ª~HQG&Jô3 +?­Ï•Vͺ¤¨¥m[-»^6â¶åüŽÚV•[)¤XKÛ7Yv®ìË°ò‚ÖÈÎͧpHæçç¿}û688ØÇÇÇÆƆü‘²ˆD"­xß ¤4311ÙºuÛ† æÏ_0JmlÇn}ZŠJ¶íÚ_}á}'?§ ´Ã1姙­§£]>ÑTÇ5tØ~n={õ[ƒ<ÅÐÑãííí­øÛ¸qãÈU¤§§§©©iÕ`Í›7OWW× ê££c-†Yá©S§ªŸPegÿKˆv6Û ¿Öäæ³we³%X.ûè­´Ús2)«½¬´8**šQZ¶æ”÷±ï?±g÷1²ÞD½*ßµWœù4úuÙѦ/öÚnÑ[½ñbpLqù%¿|b³ÅpÍfë‡/RÊ>XrV¥þ½4+'!">•îTRì«M›­Ä&ÑÏ÷ùCÜëùe}ÎOzö<õ/˜ÚWù¿‰Á`ddd¼{÷.66öÑ£Gûöí#ÿ­Û·o'•—©©)oýU+Õ]Ö‘úÎÖÖ–\’ðÒ××[¸p¡æÔÉêãÆPŸ‘ôÍ̪b¥ì'â½Ïuõ›Oþ7ÊÊÊzóæMHHHPP¿¿¿···ƒƒ /³rµ¾óüÁCbËÎÎŽ<ÉG}½•³gÏ£6º_Ÿ^ƒ‡«˜mýߺç’äúÞ)sR©¿/¤V¯^=iÒ$„B ~,555,,ììÙ³û÷ïwqq!•‘ÅwÔfñEòËÁwºº:cÇŽUíÜE¤¥`§n}Ôf­\´ÍƒýÕÀâ¯%»ÞÍöxRzô9û˜T…²à?$¤Œ- +VhhhX4X$¤´µµVŸI%EBÊâoQ‹'RP999±±±{öì!o¿]»vÑsy¿Û¥Ö‹/ú,}ükÍš5šì©òâ­Ä$»õèY!¤\]]¯\¹ÈO/^|æÌÞ%¤t lÈÆ422â]âïïOþ÷;;;Þ%/^$£?÷™üM¨¯¯ø·¨Ùi]RP[ûKKKKJJ˜LfQQÑÛ·oïܹãééI×DDL•¯¼Z___~ÛP$Í¿|ù»ä¿ÿþkÿÅ¡¡¡^^^¼K^¼xñúõë†ò½páBPPP…Wôùóg~îstt4ù ðï>Ѐ‚z’ð"±EÊ®ŒŒŒ„„„G>}ÚÑÑ‘ž‰mffV»G»ø?¤²²²bH‘±‚üÕªßÊËË#¿JÿWC B ê1¿Hxeff&&&¾|ù2$$ÄßߟüJÒŸ®•©ò)„Ô_R¯^½Š‹‹CH!¤ Þ㌄כ7oÂÂÂîÞ½àååeooOŠ/ú;˪9U!…úËBŠlðçÏŸ#¤RÀ·ÅW^^Þ»wï>>NNNô—ÈÐùÅ^)„B !À'’““Éûùܹsd,=tè‹‹‹ŸŸB !…BHðmñÅoß¼ŒBH!¤R| !…BH!¤R)„B R)„B !…BH!¤R)„B !€BH!¤R)„B !…„B !…@H!¤R)„B !…BH ¤R)„B !…BH!¤!…BH!¤R)„B C B !…BH ¤R)„Te·oß& Õ¸qc---„B !…â+t%µnÝ:„B !…â,‹¼^’PMš4±²²²°°@H ¤R©z'ryëÖ-aaáÆ“7noB!¤R)„T}ÅSffæúõë•ëܹ³å·R)„Bª.³‰HLL\¶lY#C‡µ³³³¬„„ÔåË—1¤ ¤R©?I4ƒ‘““ãíí-((HïÜ£5oÞÜÈÈȲ*çÎÀBH!¤þD0]ºtIWWWRRRDD¤Ñ·HT‘zŠ›Gß )òžÄ€BH!¤jɦM›þóÏ?¾¯k×®ëׯ§ƒ©Êxâ233Ãx€BH!¤jËâÅ‹« &RLMœ8QOOÏÔÔÔÚÚú§ñDßÁ××ã B !…ª-—.]266¶··www'ï%òÎOHH ?ÚÙÙUø ÔOêÀLR)„Tm©pLŠV\\lù+H<™™™?~ü{+„B !U[ªRÜCT;wŒDBüTAAAî¯ËË˵²²úøáwI~~~`` Y^%%%µ2,äÖÈÝ»w÷îÝË»äéÓð¨¨Èê<–Á`ÔÖ–'«ªYÿOžü÷Ò¥K¼K‚ïÞMHH¨ÎcÉFûýž“ÿë_ísHHˆ““ï’¨¨¨ðððꯡ´´”Ÿk«*CŠž¹Ç{°µµ%¿)yªiì„)“–šLÐ5®³6Xc‰ÓßsòÛ?N{S]ö|â’íêÓµkkËë¯ZCVX—ý¯³eù*£ßïy¿¡juÜó>cçòùìRŒÿøP” ©žè‚Õ@õ-ZaäM «»fyî…£Óîß﹕µµÇãâºì¹w5Mר¶¶üºMÆÞ‘uºå<)Õ3Üðû=Ÿ¦cD6E]ö|ƒç½“ÿžàçߣØØXÞr‰077'KLMMÿý÷ßää䢢"nÙ…a ú®¨ëÇâìóÚ ©ýuR‘µR^uºå=ž”ÔVHyÕm¼n8Äï!•’’rêÔ©ÀÀÀ;wî„……%&&¦§§ðîÄh€BH!¤ê!…BHá·!U7!emËž¾Î+77·A„”Æ"ƒÂ‚ ¯ÙÒõRKõ srrx;Ïd2@HyÞóò}šÿCj³÷Ã… æónv;;»—/_â÷!õBêå$i¾OçäÉ“ "¤FijÛpÎÉÆýðKà ©c&ZYYñöÿßÿm!åópÆt­ 'eýÿùöy„B !…„B !…„B !)„B !)„B !€úI e §<ŸUlÃXüR‡HWé¡e]¥¯Ð?ÐBªì¿€ûBø?¤„ýò›!5«¤¬œÄÄÄ$ÅE¹MLH@ï¿WRdH¬¬Ø}]×Ó¯ ÷ú”w¸ßÀ*)G³em—xÇ6˜JÊ'4Z¾‘Þ-TRðÇCÊz÷.¹c>aì{TTÖy„òÿî>–Ë®y¢v?£Êê¦pjµº¼œú©ƒO©UIQ;-õE:­lP!«$ ¾ !uRê^ÏÞ1)Ïgiª²‚zÇ¿°÷;…²>ú¬$#·ìbNƒ;&…BH ¤þ¶âM›8´w?ƒ3Þœ=~».Ë)´w}Ä ,„B þ–’éÐcÖ««,é6Mo¿û³PI¥\]V‰Èj¹GSŸQ[–÷h3âаêîëCH!¤ a„T»®St×OÖ.kãìp‹hSÐYÞÑŸ»K5Yt¬Ð+4½›¸øÿÒ†8!…@Hý}ǤØí)5{ú‹í=(Ù¶ÇSê`(B !)þ©PÊuŸU«öó×[Ìè4ÒùW?¹ƒBH@©žêÞϪ8âÓÎ8Áò‰Îì//"+%3ûܯ•Q©ß ©ÿ*MeAH@m‡”•“]«V"â­[~mÂÕ·D7˜Ó"=¥–--ª4Ôã×OÅ/æ5]ܬŽw\Cú0¯BÓ&¼ï!¹¥û£PI@m‡g"7 *4ϧ ¥’bŸzâÐSŠ¤C N+Ä/§Eªiÿëñ´Hß3¨¤àTR8Á,N0‹ÌB !…BHB !…„B !…„B !)„B !)„B !€BH!¤R€BH!¤R€BH!¤!…BH!¤!…BH!¤R)„B ø„úd-m‹# ¶{rÛ"SosŸŸ7‹ÃºGªuÏo›Æ*»IÓ?¤LLLæ{ðö|‰gu: mæ­çx®=_lu|À­Ú ©z«™æéÿ¡EfÕÚòº‡—Øœ¨AÿÉ ûšÕ«D[·"—5èù–-›y{þ;!•™‘ÁÛùWñ/÷¸»UgË«3xÐÀšmùmÛ¶Uè BêÝÛ·¼=‹±¶²¬YªÝV‘TBHqãÆ ’–Õ`dddYjR•åääTʪdll,##Ã[PÔØï„Te~~~Õ鿦¦æ˜1cÈS×JÿkR”––zzzÖJª!€ªÎhY+C}]†K—-[¦¢¢bkkÛ@Cªÿþǯ­EHÀßRŠŠŠ666 ®’"eÈÂ… h%emmݧOŸaÆÙÛÛ#¤ðÛ €úÁøÖ·oß7þþèDžîÔ©SuRvvvdß²eËÀbH‘l4iÒäÉ“ ~Ë#¤ !†,ª ødÀ$æÅï!!åíí][!õãçÒÑÑÑÒÒ¢ëz”þMdUµR¾¾¾dSüøé:tè`llL X•Zéÿ‰'~?¤\]]úDµÒ[.„Àÿ­’’’üê)((˜2eÊû÷ïéÓÓÓãããók¤¨¨è÷{Îb±~ü,ä>šššôÝH·W­ZE^¹N†Ù={ö׬ód…µ²å«Óggg²­ ]\\é…$| …!¹rûöm___¾íùÔ©SIÕSe½yîÜ9üÀŸF†ºqss«­}_µ;N>}úTWW—û#ïMcÇŽ½xñâÇß¾}Ëoçvrûöí¡¡¡•oˆˆ°´´Ü³gþyÀM(¦UnX²ðرcøõ€:píÚ5ssó÷ïßçææòÛ8ùèÑ#mmí Å{UUÕOŸ>ÕÊ ÃZGjCC訨ïhxx8ÉßÄÄÄØØX¾Úì cÔ¨Qßëytttrr2~w n¤¤¤ôë×ïøñãUÆA}ðfffû÷ïÿ^—ÈB’ª¯_¿^²d‰±±1ïËã<‰N²I Ð¥ëׯ“¡^MMÞãWï§;о}ûïí壑¿5PÇ£Ó€¸½©Ç“<õ‹/:uêôãq’Ø·o}…Ü_\\œžÈ£=) ,--ÜR­\¹r…¾®¥¥µcÇŽzÎÎÎ?îyDD)ýøpÿ*üõöîÝ;kÖ¬ÀÀÀºê¹ȤI“‚ƒƒúìd¨¤g#Ð÷|ÿþ½§§'©Jè)ñõ5„ÚØØ,\¸0''ç} —{{{³Ê‘Ož<9f̘K—.ÕWBÙÛÛ/Z´ˆ”~?í9ýö¨ûÁŠÉdž;wŽ&3gÎܺuk&Ü•Ÿ8q¢_¿~7oÞ,..þ铦§§‡‡‡WXÉ;w222.\¸@ÖãççW—#|øÞ} yg¤‡……­[·ŽÞò×®]«P¦ýjXMwôèQò_©§§GŠµwïÞU=ä>ä±µrv€ßÿ{»¸¸ØÛÛûÓ§O±ððp ‹‘#G.\¸ ûnnn¾¾¾$îß¿ÿìÙ3RY‘”`ä ùñÑ£G7nÜ8þüÌÌÌ–-[6fÌCCÃëׯ×`¤---%5ɈŸÞóáÇä)èsïð®ÿÖ­[d´'×ÕÕ%)¹gÏ’ÅÜÎGGG“n¿|ù’î|HHHPPÐÅ‹½¼¼lllHRLš4iîܹǎ£9ý*²1>Lbî§/™ÜíãÇ:ÿøñcRoª©©‘Îoß¾}ß¾}¤à%/“¼XzË“ž“C~$¯ˆD9ù¯quuݼy3©˜FMêâ_=iÝR÷‘R¿ÀW9E.É(MvƒÁ;`VcÓÒÒH={–Œç‡"WÈJ*&úHGÿþçÞ™T$é˜Lf5ÿì'÷$÷çÖ,?è<ɺóGŽ!='ÉE.Ix‘x%Y…ûÿjñBߟ dK’­Qý5û“ª°å+#/088˜Þò¤Ûdã“?-ÈäÑ;ñ~sË“¿{÷.Å7ŸM¨€ŒØ¤¬¨—É~ä2;;ûĉôGG«ßúž$=Écð¡Ô?Ts÷îÝ«Á9%èûùù‘B‰{:Ö:xܧ {€xþ/©JJJ.^¼HÛß?óvõEDD899‘Š€X5‹¹/_¾¸ººVbF­l±ÜÜ\RÝ‚ˆ;ç¤fë)..&Iáëë[yïåŸû¿>yòäåË—«3Í€¢ª¨¨èýû÷G%U»Ÿœ­pØkß¾}÷ïßçžçüwž‚ûØœœ²æýû÷Ó;¯j7°¸ëIMM=vìÉ”>Ôâ O¶ü›7o¼½½ýýýé2Õú–/(( …ÛáÇ߽{‡ Ðp£Š.ž?NÊR[ݺu«šúFaaadl'%CHHHJJÊŸ(y¸kûüùó³gÏ®\¹räÈÞ§«AžÒ•ÎË—//\¸@‚éÎ;¯_¿þ#$ãùåË—¹'IA‚‰žáPÇÃ{fffTTT…Γþ‚‘tžlö7ôdK²ÜĽyy`tt4ý±2€ÿ+¤¾ ãÿ»wïÈðNO&>ù1999//ïǵI½#‰C:OÊC’>¤Û¤f$/tž$iÍ&Ÿ×¥Â´´4Ò[’M¤çô'Èd!vâð-ìÂ~vÈÓÓÜÒÊÜâk3Þº û»€hêzGR!%ܦgs$<,[ø ¤Œ|¢©ƒa_›¾ÝQ„ ¤Rðw„Ô*»cÏžbˆÔR /w7׫<¸ŸÌ¨ÇÒ5=¸|ÙRsfffÕÿC€?R+–/³ä„B R)@H ¤R€@HB !)„ ¤R€@HB !)„4\Ót×V©•+–[q ¤ Ž1Œõë7˜š[XYÛŒÐXT!¤–ÛíÛ¯ßè1c‡ijjŠ€:Ö¹k=÷ó„²HãM(Òè…$¹Ú+w²¶¶FH@+--6eWU!¡èvè)5q©‰±±±……B ê‹Å:þÜFÏ{•Š”Qf§"F‰‰P†½ï£Â¿c/¨n}ÛÚÚ"¤ ‹)&“9fÎ*隷5¹1kµ¡¡½£RØbPÇ9µÇÝÕpï n1å|볆†wò9ÍÜÜÜßß?00ðܹsiiiØnPg´æ,ôŠ,+£Ä¥å,«bÎáèèˆÍuYLefd¨T?Ni­±Ûºu+ïŽ>^¦¦¦?~$÷ÇF€ºtñâŇîX[ÛX~I®àà`l(¨ûbŠ\nÞ²…\=z´ÊJÊÜÜœ{O€ºÏ)úÒÑÑ‘7§,8ÒÓÓ±• ÞÓêåË—&&&¼!åçç‡-|âÔ©St1E.mmmYØ,À'¬¬¬èœÂŽ>à7QQQæææžžžØ‡¿lŸ˜ÿÅ‹øø›L˜¬9Q{ý„…k~3š¸h¹lXÝ?ß`Ífs¼ª´XíáXÊ+­~ÚP–ΪMxTIw¥‘WdÕß$ˆVmß#B !…@H¡!¤RMHiëo,---þæû ¤ø!¤FO™cgggËÃÙÙ™ÄÞœ©z©Q“gsÏ‹KÛ³gB !Å'!eõí7a!¤R)„B !…@H¡!¤þÏCê@èw–—]aøzOVå+Ü»!¤RµÞ¼£³†tn¯¬Ú· 1»{ìIxGé6‹¨ƒÜ §–êÌï6Çöp4e¨ÕYuî}öÃÜQ–éfþ•Bªö›OtF/©¦»ž™ŸúÚlod{FQ³ÆÉ÷™îs¨¼JòŒ¡†¨¶Ð°ŠõŒ V—VÒ¸Í~øƒr‚ò&R©?Rœ®â&ËVÒ]Æ{ÒÝey_ó‘ê`þ˜:„@HÕoH…²¼î?“o!µüzÙq+ƒ9c&¹øD!¤Ru¹»¯Ù³÷sÛu‡[yä¦C‘ÔÒ‰2§œaÏ‹xFõï!;Ï%öP !µà{§wæ›Ó>—Ÿ€šUÕBª:½dUùŠ*½@~8Ó5?‡To9å^Ã{ôç¶ÁzÇÞâÜêpøœr0ÊëÑ=…Vr÷ØUB jÅ™ÙÝZ‹K”—nÛk—\)?åÔJ¥F;â+.Ü¥«0Ãñeµ_üLºI§¤J •õöÑü1}ÄÄ%dUú9žVúËé‡Ý}e{ü<¼S“7 bYê“{ˆ~ )¨çæ÷n·ìpIqA^^^~^nÄw9¹m÷Sù§‡«UšîzUq¡Ë²ösœâ«RŠ-ºø¶¶ÊÚ),¬hs>¼ ??ýõƒ¾mzžåܘ1N²Ý}&*©j‡iÏ( ŶZ×úvRÒöyG—W)¨­j¯÷/O…ÁÚ;JVv~@{Àè›YUìN«r_«Ê½nv±U~ «âCŠónHU\EåN–FV)Âv逎|íyÎMÉÆRQùìH% þýŒßì-¬jŸ!ë'»¿Þ¥ò}ù;¤éPGŸó´¸¯ŸØu½xFN®½¬¤¬}pÙg¦*„”¬€¼uÄ7=ÊBHÀ¯‡eÜCvÐ.Î8]ò~阾-š7iöР‰s3JÙ£lvè‰AÝÛ‘eÍ7ï5zz:“ÅyXÊÊq}Z4lÚ´Ç虜ßéë»×+ËŠ4mÖLDFÅüµÍöO[鵕hѤis•Þv~oÉF°¶Ü‚Ýsvn¥ÐÕþôÕÊRòbÍå:ô¼óú ¹ÃšNK]v(‰ 5mÔX¥ÏÈ{‰9_CŠÓãý†såZ5oÒ¸Y›.<聆²òL"ÔäŸ&B¢s×´íU!¤¬— é:a5Oâ”$¾{Gê'ÍîòÒ²Ýú÷ûD1nÎQ\un“f·F¢S(ªh‹Ö¨Öÿ4kÔ¬Ûõ§)…ôSßrÖU–j)$ ";~íqöÚÒo6Wèç¶x˜¼¢|³VrKö^Z3^UJRT µÂÊ=aôFè¥,2ËõZCª¤b>wiÕ¨•@£–;¶äŒEÓ{ü¨ƒ³[ Š ÞOþŸ–WR+‡7•R¿Á~øý@Éæÿ7ÿúXÁvæᨤ Z!¥0RÛi—ãŽM+gö™¶&Áþ­´™Ûk¼ÑAν»õQœ²ŸŒ° †JÍ2÷£÷£v—Xt3ƒ\ 6Ój3u3]·¬ë)1þpEeõ–ù7*—,zwÝU\©y,3ÚE¬ÝØèLö@ÅUTZ9™¬úþ21A¹›Iì]lGÖiÛå9»¢¡ŒFv™²'ˆ}¥{‹v]'$svÁ1%¤²´€§’ʼg*ÞuÖûö­aÇ· +"Oyay…‘FYœ µš;´•ìÀß–A¹q½…[ˆ¶³ÔÈÍçlü§¢òÒ&¤ týšÿÓ–”Ù~øNn1um§–êä­œ'¡ÎOnÕo-»;éÁI]I,f/Í|¬*,t7“,ü¯¥ Äßì]‡×ÖI ìb =¶¶]¯ñtbž†Ä§|i@!u ”:Gù¶å9÷QçÑßœ É3¦l ¹õÈóo‹J ªRrý'¬Y½ŠcžÆÅþs>‘ßÊσZ·<J„…=¹wLN¼ã'÷@OAJâ‹õ}%¦¤“ŸÚÍí;#8âEn1wÅ_úÈ m>p%!õ 7ÜǨLÚq*2<Œ¬2"âáIQ˘RB}é»Ü?¶±ïXcº¶¹¾¬ßH§ëd¡jã%ÿ¦s–‘–ÞK¢ÙµnH•Xö”˜ç}ëi{Ñ1÷Fˆˆx¼ÉV—óÿT\¶oí­¯€HŸT»ë_;µaùâ1ƒº 6oª¹Ñ‡óâ>”¾Ë, )A%}Î *˜#-°íZL(GLT ² äÃœ¯; r2ÞÆÞê*Þüf;¤$ÒqFI5”Îé÷§Ór=Õè1)œ`_ìîãÄÏpy¹ádd}ÒAXz¨Ú˜ÑjjcÔÕƤQ Oõk+%ßV¹wÿ!#•eé"Ü æôîÖ±u ¡¾š†o³™d]©÷ØWIV¬¥xG÷Ë‘dõ‹:«t0TM­l•cÕÕ-Ÿ2Ø!5À…^ɽcú©›Ðׯ.- ©Õ*Mv¼üšj…ÏÄrCª`’”Lï¡#¿®SmôÞˆâ2JoòËg?0žV:&U’œ_òõ¨Paôe©ÿK®R͇ìáÜþ¾§ èÀÑe›‚½1†{À® ]V‰ ‰*wê2x¤z[Q¡²’TT¶Þ›R‚Ã28W?=FH!¤à·BŠ®‘Öu•]z5‰¢’z¶»™Y>¡8ç}B*»¼’lvèI6}×óSÊ*©ÂüÜBFY(ì_ÜUªóF&«8;'^’ù씸d»§E”õðŽó…•íXc•|xŸPÈ¢8!åüƒ"•Ô²“ŸÊ§|î#ÑüÖgnH¯ë"c”R¾ÎâÄw ÌâÏ]$åRŠÊ*¦Ä³•*©¢ Òv‡—Íúà,š8HÞþlDÅL‡Ô—‰¢Âûß•Ïô(-xÿîc E½¼ä,Ùuwü&Û´:!Õ'N ¤0PðOHt–pâ ¹¶V«ëX½½ô‘¦Ýãå;¬$‘ñJUPôv½“+IURzÚ%vH혧6`µ;ýø>Z²Ý6QŒ`¥b÷Ò8‹²ã¤ÅÚ’*¼·N´e·œìúøÀK¬}ŸBêç!Å>&ÕobYoõtßXÊsL*5@[JbPg¯\Ì)ÓVݦ+þ‹”¤{ÐIá¼bdkÙv÷¹ê©Ëœ‘]þcV°µt ±ûìÞ~.(\1¤¨3æ#º^ZÍúC$&³K¿ÐS–ÊÃçÒ ³ïZH ±CêÖO+)w‡óOÞ¢’BHÀOž¦"©s„wɵ…²Â]“dŒMÐì!%§Ô¡½’œx¿%_ŠÙù]«ÖZ¦m—Î;t›|Ýi„¤|»o¿P¹Ñƒ…åÛvPnßFL¢kt&;3ŽŽn)&£¬¢"+.6ÇñFYʘh‹É¨¨th-ÑæT4ûpã΂F]è[ïx­V²‘¾0OµŸ} {è–iîxÌNXJ±C;EA±~ÑéìcG $§Ú½àÌé.ñÔ"*¥ ¢Ü¾¥T—ëo 8u_Öüî¢Ò mÛ+JhmsÜR)ñ›R¤æ*Úo8V¨•¤R»vJŠrBBm/D¤ÐqlÔ£™B».'R(Æ™z8—•c̬ êm¥Û‘(ØnÂë/%œKÖRl«¢ªªÒn²Éyµ>òç2rƒ t+ ©‚«zæ\MypL¸Ã@zqŸŽ­g»]CH!¤à'*ízâÙE_e¥%'}LÍà]”NÑ5ëCb£¤”ófêǤ¤äO%<÷ÌÏJKLLÊÌcÐOE/,ÌNOLüÀ9dô͇†x®WÑ1yTRrI…Þ–ï¬ËÍü”˜ô‘Qö©²[Ù=OË®ðJyWËÌËLJLü˜šÎ*¿ g7désaé·[s ò ?~úÚGΕ䉩ìâ°„¬-%£ê×SõËÄî>„@ƒBH ¤ÐR)„B !€BH ¤ÐR)4„@5MÒœi|0hÓ¾+ܶÖ5`ó…Ӝκ\lHþ¶­Úyf˜ºB  J> ¼ÀÛìmmæÍ™=ÒÌŸÛ€z[±Í›³yÓ&K„@õܺuËÜÜÜê B !…@HB !…øpãÆíÛ·›B=111Ù¹s'B  JÅÅÅŸ ^¥¥¥UþR€zñ?¸_™Q endstream endobj 1554 0 obj << /Length 1534 /Filter /FlateDecode >> stream xÚ•Ë’Ó8ðž¯ðÑ®"K~s`B %aÙ- (ÅV&ª±­ ;„üývKrâd²Tjµ[ý~%ôî½Ð{9y¶œÜü¥^AŠ”¥ÞríEYJ’8ñ²8'qyËÊûä/vZ–¼çÁ”e¹ÿ¡ÚB/w²Á”†þ‹x/jÁ;a/a„_–¯','ß&$†õ2Ìc’…™W6“O_B¯ük/$Q‘{{CÕxqšÃY{‹É_“Ðiûm³„°Ä°"CV1‹HRdu3k( ½ Ÿ ö„„¥2N©§Ç#äû“ (%E’0ô°ò‚Ð(·æßn·5Ú/Uk-»ã ýC†®˜QèsÐÄG÷àaLtÿu….zS0ºH §K×Ò¯ ÿñu­y#:+üs˜„­@¡{‹NQJ€­y[ 8 ôôL;Y\ÈŒAŸô$Þ&¡dFQóÞˆ<·æ\"Á|¿êzÍËÞòXÚžÿ°ð;Ðz¬ÝÌGÙÙ“Û£ëÁ®+{kU?n½hô®ìwZ¸—­£®DWj¹rè R™ \4”f¤ˆ˜5ôcƒØ~ƒî‹Âì±³£0÷û@þø¤ÒØÍOÁèI]+àçmôi0MCãdãßk’~êñ$Ž…áòûîz5`‘ÉïDí÷úã% D‹˜¤Ì•ÏsÕ~CvoÌèWËåü4Úk¹ÚôÛ_ÚŽçr(x­¹vÍûΰ:Ÿ¯+!Û{ Ú‚7H÷`´ú*hËuçØ£ªÓŠ}wµ”?ndÝFØÝ°yx7¡-˜1ƒ.(Mó,œXh¦ÿåG¦…ÂY 3gÚÃÄv¸ñ¼²¨iú3@fD‰CÀjÇq¿‘¥c ø9Mí…·ªáµî ÍðJ|lËõ!š&>A>á)Dê\ç)UÓ KÍ^¬¦'eÏcv»MÅ‘Ï€¾X™ÔV ƒ^ít)Ž|-ðˆ;}%z5ŠÏD'‡¦i¥?±—Ùlqj¥3Øt;l³zw3ÚÓnß,Ž’1­ùÿìT:oïod©U§Öý…ÕfªYNu=}h:~ß^ÝOîäƒÙßñAîr¡ ÄbªºéVÁúb§*D mMq7´DV"œÍViØK º&U~V5¹«š|H4gó)¯* vÞ2«”Òî\ÈP”¹+Ê3F#%6±`a™µ×6•qíö=(ÇûöØŸÇâb€¢öÔ©ïZÄEJ–¼®‡æ²Žª…Šê]9\‰Ïóo·AÃvñ„ý¯j—‰ó#'‰ƒeÜ/ÿt&1´å_þÏyµiÇð‡–:ýrBÁÛ).~.Øä`þ6µ1'N(ü‚1`Éi]j÷ øíã endstream endobj 1546 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 396 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 20380 /Filter /FlateDecode >> stream xÚì½wTk»§}æœ9kÖÌz×ü73k¾uÎù¾÷œ÷ì­’ièÈ9gP‚‚(" b €,DEÝæ¬Û€9³0 äÐÐõUu5Mmz7[ü]ëÞîîêîꪻŸ~®ºŸzº  H$ß³ø³+‘ü]¯ûÒÛJþàªþܤI¾kùŸ™4 Þ4¼Ñ™TÁ¶'ùÌ6I¾o[GžüÇdz4B0E蜧§ÇàðD"¡H(déÌbZGÜøÞµœÛn* <'ù¶Î ³dlþ-eýÍÇ]a®ººÌØÊ*žµý‘:L&™4¡PÄcjkè üö÷}_ÿÖ]úÿ‰6~cÒ;[—­Ìé÷È‹¢G` Ïе÷[öfpªt}!|]6WšC![WM_h±6õÌ÷:¢8݆1ûÈ7æ°§î즤‹ŸUT£Ÿi¹©@EÖþ;OK‹# Ò%ðÔ4´­œŠZ¾s%Ÿè0X%¯º¾ñéw­}6¤$Ug≘Z&F–Ð<ùTÝ„%ð9I-àñÖ^~&¿ÿìz*w–ÞþFeGiÒûãš#uÿBœµIðÉèfìë%²5^Û¼0æì¸c°ÁùÆüÈìýLfBõ'ÏÚÁ˜EvA›åwZï;rYËO7(ͶñIë¾±l†YÌW’6¼¤¿å×`íؤ½½ÃúU/ùÚKú£ÜèÈ4ÝpkŠ4¼¾efFa¿•Éï·ïª3ÒëÅÊÕ%ÊŽØ©»%ÙNܹǿ¡áQÿ/ßá¶üª¤÷&øðæÛÚÄìWUI]æ©ñªF6¼/y™«¡Ýâ!rã•´%eu¯ý›+(kî]U)irÒ…} ˜¢§£ŸCþïÕùXÃÙO¥LMçì"‡Ð‚?YR+Ï>Pì 6ºjûÇV’÷;_ì óbéé3õ¹‹¶¶ÐÏ4ÜØëlÂÕÕcz,‰míT”ÉÙx¶™ßÇ~ 1Ôw%?ƘÇbê±üÖ¤½é¡ÚrU”=ƒÍåq¹B3çn±bÓ÷äå{òP/POJHÊfÁ&Å%÷#Œ´Ü¥ý›¸ëdÒJ›©ÏÐwðßðô£l'?=/ u7Ó×g;/ºû¬CQR$oî&êªñ>Hf¸áÖ7s¾>ÓÂ=´ª¹“|ôÃÝ:úl«¯Å¸ðV¡£Ûxäè)1ÕMQwk~óåÚÄöOIï¥ÔdÇõw©ÖÝš²Ê—M6<=¶DÎû~YÓ|Q|ÄÃœÏÐc:Å<û4 ()’[¹¡úB×æ.2wÅš ØL=¦×Ò¸WT•C-t¨|q¸ÁçŸ+nÈæ ³ðÔ’?2ìÀ”ÔZµ ÝOÉP˜‹‰ÿ¶ÃÄx ¿g¥£ù‚j4¦çIWÛ¤äuÿàÐ@ÑV]‹è~I]O[Îs˜ß- 0ñZÖ3(‹‡Žlô7ð]M¿E\˜cÐÆ#CƒƒÊ~§ª¤®„q§È7÷.ùì×r ­æSrî-1Sc¦”|xq~Û,–[³‚¤ºž_4`éß|F¥í]UŸ),kéJ^•ìpùum”ܯnäˆVvæ—Œê]Ò7”à é™×0…*©1’Úá¬î¾­–¼±)ÀÚce†dP< Ø2×Þ{S>µÍ‡xꢫ/úÅâû‰šF«{$U~(†kîöALåä\òRûyí}dOZ*p’&+ÓlÏ\²=*ö¨Tê>Ý2­ˆê·)$©¶ë¹Z"—òÖÛãz¿pN¼“­k°ùŒ`&÷ÜGj¿6ͱñZŸ/÷u·:˜²Ž×*Hªm‰±V@v-•‰ÁGŽZº«O6’_T¢û±/K#üÜ{éwñWݸª”·9id43½äMâJ_#‘ßÊÔ÷ŠúpßÕò«³I¡š:¶dË$^w—tìz°¿»§»4Ê·8¼wÀ‡c›\"k°ƒíU•u½´¤_l<­oÐØI?ÖîÃû5­ZþFŒfïöR·â—8.Š:ö™í™2’²[´E~÷QQ¾!‹½¯æ•ÁÞ®>鉡žžžÖûÇY†æm½’ê¬U¬Ù+†ú”W¼í§$õ«Ùæîw¥Böù‡ôi¸¡ ÷½òƒXh$Lºò¼ñüÚ&¶ÁªeCwÇwÌ嚇t Såœ5Üw¸\¾W³Wëè˜ÑpO·ôCÝÝ=5‰A,¿(òÞÉ…†f[~î);«+jÈÖY’EJêDóÕ$¶‰GýGzÇ{‚E¿ÆÜ•'á…¥華ADÏö Í?Ž X^H§IT\R<5nÍð½þ¶Ë\…–ÉT#îíì¡Ú\oÏÑ·Üø—È«]’—Ölõ3CôN6?®{Üòž–TÍÇÞs…³·ÐCîD}a4Ó%xä‹z>Fd±Šª5;oóÔMjÇ~C} ¦ž×+ëŸ>~˜âÄu_+!LŸª¤˜L=CúÉuñ =WÝJ59 q÷·×ÉËÇ?À¶•¡($•, –ðÙáÇ®_ˆ·9…“ëÙz¬j¸¹ÖYé1Œ­liìì¬tg¨o ™.’ frXdÎHȬ™;ÌŽ+¼EQß>¼ìgóppŸçàçåÂ7²x×Küd²eÌ7™””¶Éü¹v +Ÿøa×|š¯Ïš[˲fkÃÕÕñιùIIWر{©­ÀuÍËÁ)ÔY’2f2õ©†G¥í0'èÈÝ&Úg2­„oÿ€9¶¦‚¹¤¤Öš‰‚•ŽYKI¶3Ïa¹ËXu}xÔ驽®ŽÑHóÖSÓØPÞ«LRÔÈâÓ£kÍç§Ð÷nu·ÜòÛ¨Ê^•$eÄbI¿¨<‹Å3Úè½zæÁ`›ùÌ`ÆÖŠ¸Ü9Ôq[¨Å.îÝ(IñWú™ýªëúxx/Odž³…¢á&gkn"Òc[Pƒ©Ê%Õ9W8kýÞ§ÃÙ®5Ÿ©wè5:RðçJjÍ¥&bÜñåP_£Gû`y½¬j³'7˜”T„ ;ðÄ£‘ÃP™¤ìÆ7Ïlch˜Ýl£—=µÖÐ8©Ì6Ó£’² ŠQVÐô¯3üÅsW¥¬K¨>Ë2¤$ufËbÓ tÎäi#%¥«ÇßsÐœËI½OÏ;—ñtW÷Ž7‘RIQìÀ‡µVºV¡bbjºP•TèéȶÿµG-¥è¬JM[Ìô%%5¸ÍVä½çd»ðD–¿ŸÚÅÔ4ºÐJŸÀ鬡¶ç’·TRI öÚ™q\||¥¸˜pÍíüEˆU´’âU)IXÑ]×ùÂåF¿P’ê*7Òѽùž>c9,)Ïqõþ¸•Ž6swÒË/'­4™·FÉáÏxII_°Ä^;êøkúô4A|\ÀTÛ^‡2 ü¹’’Ÿ“Rd°<ãWtÑqp£©UIÅ›Lu¼òé+n/5e «zGÎIØÄw ¡×°ÌAgeÞÃá#®O÷ï?”K*ˆ’”dJKjÌ9©aZÝ5´Óew.ïà“’j;·u¦Á¼Ù÷¼-€¥›ò”è¹>Ã,š¼ÿ¾þ€Ã.m¡f\]+âžî‰ïKr”JŠJࡾñ²ãS©„RÔ˜sR2Ê ÕY×Ûe=ð_ká<*Õµ;íÕ“dû9Po¥Ï¹Ù)='åGðe¬æÙzÓ"b&¡~“ª£Í[¾5mÿžŒ W¿²¾b•¯ÀÎ'-=£s@á¸ðÃýmÑÑÛ¶Fš±9îá‘[·Äd½¡²Yû¼¤ˆü¥F†. >´vÓúiZz‚ØœŸû¶úˆL=$§¥†y[¸®5»oè|¤=Ó>¢‹¬Ä>Ôéêú„Çìß¿72ØSM×µ¡ê&ÞTpØÆ1;vÞi™šööî^¦Áê˜-[6³=§kjLþ¼¤ˆ¹V,·MGíYàaq8}©š¾Ýžó×$â‘žKÐêÝ)q>¶|¯-gˆQ³ûz|Ù¶!ûÈd½)Ù§£É ‹N.Ü›êeÆs\×/}Æé¸Pž¹{JJò»îAeï+™B'y{nƒÓ4.ÿpvüZû%ÙëˆçFÝxÕ_U®Ã5[¿#yûÚ… 5î•ÆÅÙ}ïkOê0 o·’>é‹Í ]üwçïOÛ¶Ö˜ÍJ¾K—±jšÞkãv_hU»µ×yp5½ƒV$ìÜäh¨ïùÛ˜q&¶¯8œ”tºþµ’bŸ,”Zª²Sv%¦—¾$•úŽæ$¥ï;'ѳC9iñ IÇ®TÐÏ~p-k÷чҟ«Ý­u I‰-]T]Ðñ¼4'5>..þÐùû²ñ(jîlCnr¹®^Å#Ö÷ãv%$&&'''%&&$&ì9uSe³V~éHöoJ~Jí`ÿÇ#yiq±»ÎS¿>+=–»[:ç¹÷ÒÑ= »våþö;=µ¤¿áä¶ôKÙ÷»woò–seÒQªžçÔââ² O ? òƒ}ÇsSââ’kߎt°okoîJ$³%'!aWÞ‘”ødzÚÑÒF¥)|÷0owb|BêÝÆnò™gö$§d¡¦˜õ´ÍOß•øÛ…búÙ/îå%¨¦s8ð©)91þi5XÚÛZ•¿{ÙðöŸ¾Õ/oxݯö¤Ä'¤ä~êS~ý†–ß÷dü^¦¢ ë}œ¼#éy¡ô«Z{õ0ù5Ë,¤ú²ôÙ¨Ýoó~C=­sÓvíJ<~­– 0»0©Ü¼I|ø€4PEÖ¬!þámmbÇâÑ#ÙBœ\›tðÉúõ”¤äñþ‘ŸO´´ 1“Ͻ{Ô‘ClìÄDv6QX¨qéU¿OzܺEùñò%;Ÿ%"b”¤èø/ÿ…øË_¨’>žÇQý¤°hõAüÓ?MLüã?Rk£cü'®ðÑK¾ð(BH’†P¡øÛ߈úzãgîë!ˆ…«V!÷_ ó+¶féŠ5S¢|€¤¾%ÇÏÍÉÓð05ül’â[8ÅDGGŽ&==•”<„VnÑÑQŠùÙ´iÓ¥K—PI}5rjŽÐ8&&F1{äÝÞÞ^Hê«´ã°“£ý˜ïæ±cÇЗ‚ŸNR1ÑG“‘‘I)JŠô¸b~Ènö²êý9l••ÔæÍ›å©#»Ù-[¶@Rß()gGņGfïøñãèK$IAR$ )H ’‚¤ )H @R$IAR@R$IAR’‚¤ )H ’’‚¤ )H ’$IAR$¦Ž¤$ä¿yuÔ_ÓH/‘Ð ÉYÕÔByHW%I/!†Ÿ@d”SÝõÂZBÚÕK¦Ÿ¤ÒÉN£v$ ÔžV#Y"rëFe‰²VþPíH†*IQ{-o-²¶DÐm‰|(»†È­RÈ y£Œz&ÝÞ²k‰œÊ¯çmzKJ޳ˤßÍ*"·Fžê_*«Ò,eVP­ô«_FH L!I‘ý@òÉ+zÚ³˜v»Óɾbø9‹øêéépØL2ô´Ô„žókÉGéȼ×ì*bkéhÎÒÑÐ0q ËoÊ®yù4©¤J\ øúz 2 l¦C—iîš]Oíi‰$§ìhæ¯zºZL†öHèhD\È.mª6cÌCºfñ™5?]%E5˜[~‹‚…,M†–CíW¡¹‡ïæ«é•2Où:Y™-ÎÎ.ymüáãL=7‰¬jñþÿk¾å¹¶ŸVRé%CN–B&CKO[Ûï虊°%ó…NË3iC•q{óØšÚ¡û[2ˉ¨´í,Ž]Ò}TR`URÄêµî†~û yŒµçåeBHH éÜ{ꩳüĺ˜µ\AÜ-qF ‘y§ÙA nì´2úòùyP·2bWG=0¯5cÚIÊÃÜÔiÛí‚ÒʨJ¼2j£P_gNrUd•=2T× +RRIe—½±ÔÕó?>D&ð'¯¤2o5ØpÔÌ<"·]§þ.!™„˜ô CŽ¦ËÆÒn–˜çábµt¢¤v=Ããów’’ªûš¨Yïxù3KŠ®¤ö=î°ÐÔö?6@–™KW„{¬§³—ðÛaž6kÁ¾N:E1黆îɘ6’*!rJÌ´Y˯HæØY¸Åe÷”¤|7g•Éª­´³·Ø\ãÍ×úÈïHÄÎõ|c»¤{™Ñ¤ÿ®Ø¼{Í‘æi))ǘ+Š]hLJ<×Ð2ñÎ))# àóÊ.v*•”ßÁOßÒ»NgI|±2"L`é½»d¸µHñN=!öieCRßrN*§²Õ\SgŒ¤Ò/_6ÔÓ˜—õ†Ì-]–BR`šIŠ,¶ÄÆpí‚2ʉ”=›‚ÐÔIùm'{©S ˆ•kyÁ)ÅDf5±ÀEÇ8à =î'?‡•Q6|cZKŠö¿QÍÓ營ëÌ-§*©Ð«T±I–“²¨¦¬ IÑ’Ú|†eØ}ÅÖ2b«áJÊzùiÍNGÊ™KÔW$å‘u«Ò”¯˜þ„:*?‚‚¤À4’uèUIx» œÖÜ¡$RÕm'RŸ—×A÷!!! 9\¶ôœ‹©5“ɳZ~¼‹ü:dUxÌ°Ûú꧘ݧ¬’Ê.i5×cÎ;ð>¯ü‘‰®.Kñ„CKÏ"uw…´’bèÙ„%Ee.Ü$‹Ðü§Yå?—¤¶œ«vüê’ðN¶°ø}ȆÄÀˆT2"&—Ó’rc3uš³Z²ÐÓÑæCR_””ÈÊÙ’;“ŲÚøû@†Â‘!$¦Y%•uí‚@KoÑþÆÍGë7{ì7ÏÍlÎvºCž“ÚYð€:@V19B¦^øÉOÙµ„¯ÅL‹Uõ£×)Q8BžÖ’*‘dÝm0ÔãŸhÏ“VRa׈üzéÙiä× WR =S`—ya.seá¹³8»â'“ÔùG^Æ3ì65чúY÷_yÍYDæÄÕg6‹åW)«¤lVÚûp$‡©ç® ’ú¢¤Â¸"ó ¼Ö°E>l«°]÷©&—Ii()É {®À@d`$”†ÈÐÃwÞ1îœ=¿bCˆåv,«–X¶ÜÞÀbuZ !?'E~AR‹Þ$Ýú*©ÄC'Y<³­7rqNêk’Š9ý*8ØÊÄi{z‰Â1 )ñ«'Y W¹¤pNJ©¤ÒK†Òî ¤K3FJÊLS'àø¨sR™•„·—‰‰kTúð"$¦‘¤²Óïwš2ƒ²_ú ;jNZ-1×RÝzãSò‹0zâõ³© ;}®ßò{‘tä´>K07ïmöðXrjúœmØöKOdNcII]œWÝîi­/rNÞ]B`âÄ7Ìî{šPx@) :ÔMÏÛ§~¿PA$dog0Üb!©/Jj÷Éã,žÝfjF„$çæŽÍubÔĉ"óî3{î,³ “é˜Ý¦™¤6ä%ØÉÖsÜqŸÿD—lÿÑ)›ù†^ÉŤ¤ˆlýoÉ&#j÷l_}}Ñú‹=Ôñ[9¿…©¥n3w]ÀúTÿÑæB Sß„Ä’i9qÂÌÔoCÈÖüà͹+cÌ…º"爸bi¿QöÈXKÇqefÐ&ÅHßx¶-§’ž‚^AlŠÛ¢¯©i™¸n§ÛOà 0¹”žlI}FR’¬Šþ×*(pcš³£¹Ð1‚6‘âtRúÉg®òz>© äAcLz_h1£¼5f,Î~ö-Ùƒ¤€ªIÊ'2seX°û–š,ų$%Äî«œýWl½6°v[’kÀ2×yKÈp™·Ôo}ÁŽ;à  çò]}´:ÊÕ‰[PtxAcvÕW~45%%^´x­«ÿR:n‹¢–å>È®‘UÙe/g{/v#KVz‘]öÑ×;dÉ©®ÌŸþ²HôÌÏÌëƒ×n¦r¸6(ö|J‘5<'méš¿—²:ÒÄs÷ÝÂwÝ!2+Ã-˜›ýîç¼,5•´´éÆmnó–øl8œ2.möš=#§ƒË‰]9»œg/Ú\Dì8pœúÚ*´F÷ÍU™å˜¢ç¤pí>\»ïO—®Ý÷wK ×î$IAR$ )H ’‚¤ ) )H ’‚¤ )IAR$IIAR$IH ’‚¤ )H ’$IAR$IAR€¤ )H ’‚¤€¤ )H ’‚¤$IAR$IH ’‚¤ )H @R$IARPAI‰ý÷>&rk”Äò¬s7(}èÏ‹=õ„ÀÒY¥$å迼à‘ò­ Ký=pÛo?8Eyµ„ÐÚ}jH*>~Ç™†/ìK~áž°íÜ˯ïxõÄdoï‚g`:%$•”Y°4½Hù^<&¬üד-á·½]§œí!)ðÃÔÒcó,=¸nòà˜» ¬=ÉPgþM“Ißþ–0°÷þö'.„6^&–vÑQQ*")Ò㶎N~aŽ¾!t8ù…š:Ï¥·VMOø‹6秈 ;—¨Ñ)RMI?ÞÂÙGž::{ÆŽ¾#ûbãõ×Úz¶_Ýe3÷|+ h`¶søa´‚âUVR—®ßYº(fÏÞ;˜Þ ‘íœù™k¯oÙe2o†~Òð4˜¢ùóçCRà‡!‘HÆ/$u%%((ÈÛÛ;ꇳQ“%)¥)"ûÞM›6‘›èçç§ )RMI)ÍÞáÇå;BÊÂÙÙ9<<üGfüìÆt³ª)©ñÙëëë£wÜ`sss2{?¾í‘邤Àä’šš:¦ª“%)¥œ>}:""B¥ò£š’RÊä LZšÊJjAB(-•ò .ç2ƒ%Ÿ¯ªHé¥ú˜m<÷ý?XRoFŽ5%o[ò‹A¸ôPq ok¨ˆÃ511bò¬“Ï=”õºO~t4àð,Ž(:ã¼x”¤ˆ·rô5x§w“·KOg8šðÌ,-Øl“˜‚ä’Áž·³í 9¥•M꣑@2$~×ÚÒ/‘uÝ¿‡üb1=WiI=îéöÚ/í˜Á÷ë–Þ=š´ÊˆÃ615Ög›mÿ­D¦±—·B=ÍY\>‹É]´g”¤ˆ¶Úœ™:…ïÉÛ¯íó´à›ZXrX†kwŸ‘¾ºo±‹!›Ã·´±ÛZÞ¥X«Îwá%žz>% EKÊÈ>p`hdICŠó «8J}ã×øó¹#ÏÈ¥àv ý„Ö²#³-¸|¡€%´H>|—®¤hI‘ÔÑeÚÜn¡šÕ¥=;, øæfžuÒÉjrIÏ‹rks—#´4·:Ò¬| àål}ÓÀîÁi2 ÀT“”ì{W¶ÃOÓ9ŠúÚÖ%›ù¾’}ÿOðÕ9¥ÑûÊF—½óªtqç#.÷Ô£÷D%©OäÑnósó@uŸô+}¥.8/´kpçÌÜqU걶Cºž”ö“’ÞWÏŸ?,¿dmb™zùáôÈ°‚¤d;ûhÏZM«`êÖ³|SG=½¸³È`ã"iq‡Ÿ·î`¥4!ïm ÙY׈72I µ;0µSnwP¾»ÀÉÞÿ.ÒZç‹Ô–k¥2ÚuQ–móØ úر·¤_·x®›—ß®W;ú‡Õ®¤†%%ÛÈKKMþ{ÉMEQ66!´åÛJ3¹úf¯ú¢½L4‹_/mÊÏ~×Ó3,n’H%EjéCýa!ÏðÖK*WÕ),}‹ªOtÚKÍ™jÇj©•‰Ÿ¤2ôõJ‹2rIÇr#Í”é`$Õ&;^zr»ÐœÏØ| Œ>ñ>ÔßÝÚÜüêÅ®æ©Çƒo«Ïp…­Ýô×V2(‘7¨JÊý}ÿ+£ð>}ºièXˆ½ÙÆBùí‹ðZF"Íûu5Ü[•nMï=C 6‡ë²pÓ«N•îB¿WROeµªäeÅ)¡Îâ¸Ëò KÄ}­-Í­o_ÌÌL/éï~]"bëU}Îð xpH"­¤,^õ¶y›hÇžm¤×u5f¾(x›ü®d­±öŒ¤æV|8«¯fÓ8vCú<-ضs×=}×õñe¥•‘Áüª^I9Râ²ÓÉB»°ø¥Ü¼âîö–ææÆÊ"S×&yx"k7{P"Ql™ÒJjÉÇwe>÷΋NzUYn\§¬RùÅxÚ.ϸH}Ru‰ ý O„ò2ªñÈf¾çB©Â¦¤ø<®¡±Ÿàã·©Csò{(nýÝÝ”mç»4>19))Ö˜¥u걤ñn_dÿ~`ôµñ¦¾«9“Átlê—ö!’Á­®6,.—3Œž®¶È{å—%E¯S"î)ߪk°øýt©¤D\¶‘,Þó /WÐ;Û~ÛÛœkê—”’–hÍVß]2ðéÙž¾QCïè ¿¾®­Ïw³`kéZVtËzé¬PÅ 3õtXæ^T/­\R±XaA×mÙŒß^«²¤6±ùy¥3‡;cwIç«B»¾}t†IIé ¶)O_áhæK/;¾v®åêT%o)•TÓè÷“(|ÒÛ­nZ3RUx €tâÄB%£nDo„h–Wf½¤ÿM%YI‘’*?¸]àè7$­Nå{KJJa±ÿFÕ2;Ö¼„"ú;¬8þ'Æ·Ì/TRÄP¹÷V/Š(&g¸ï’Iº½ë9ÁGké;õ‡B9 í“ŃokølþÅGô9¥Ž`–Ú² Ä3j ºôÛýÜ‹;kÝaªïk;>Ë T^ Ý8}¤â…ô4BË~]u—–Ñ}go[¥€©}²J6Íðý½Ú6õƒÓ!Ãc&N(šy§³©ÏnÙaÀ‹sëX:©÷z%ݯ-ì‚[/èu­©Þ¼ü[Ä»Z,‹—½dFÞ.4ÐœŸYE>Öymû,®Oóp–*‹NÞ~Ò.¡%5Ëêé;õÕñfþí@µìx¤õJŒº®K£Š÷ž81Lû"} wd¿x¸šâËãRÃ}ýõ'´™ÕésF-³~ÙZÝCTnÿEF-ê­¶bªeߢŽ{sçhZÇ Ï):Ux°¡­_ZI%1ôæR6¢×scÍ/†«Ð_ B’"ZN…±˜œÑ;y™ÏM¯ð´¹ù.¹ÝFÔ,ä°9>Aaî–\Ðû}ÿ¨Ù}ïo¦©éY—õP·7Ï·æ™X¯Ûíï`¬Ãr«–.$klôum<¶ž{­P_ ]Žqg²¹–N³½œLù\vÔ‘Šé‘áÏKŠh/ŠÐc°GîŸgç¶ëþò¹Æv. Ï¿zyb%‹Ér õ¶á³ô›ºFÍîë¬9¡Å4¾ö–êWsW;ó LVEF¹Yê²loË~äÓèÂÐ6u¿îp“â€Õ…ÍÞzl®•»ß#.‹wæ*çíó’"J³}yÉËÃ+fé{>¥¦’öη3â[ºDFmò¶äëòü_HŸ!þpØÃr÷ž—{wÌ¥$uÛ<~Éè.øñôu¾®©y0¾+ À›VVV>~FÙ¤½¥±¢¢ú]õè»WÕUUµžvчñ½ïÊ«‰‡{×õåµM¥¿\éùôaUUUMýãO}Ò3]ÒÕ¾yþ¨ªªúÅGñèa¢­¹©¶ºªº¦îyëGbº\qb°¯­º²¶GI† i*“~Ø@Í–ìzû¢²²ºUªò­Ïj¤yk§úÛ+«ëú†dcu­+«ž¶IW0ØÜô˜ÌpuÝ£÷]òËL|h~J.kjëó¾onª!3\]÷ª­KÅ3ÜþöÙÀ”ÿ¦I2øìq}eeUC3Uz¿þ¨²¢¦]z–gÉ–YÿøY/ý{§®Wå5Ã#œCµe›¥µäPO“t uº ºe’ÿ½xB.¬~Ý9æÓ’t<XÝðݾüeœŸ6É*þÑ#i’ÁÁ!o_¿‹B¿‹B¾åi<æ/ ~øðátJòû½ýæ©T’Ý=g÷÷÷«rÒÄb±»‡×7îNàIšß¼ùÍ­¸î?”ÖÖ×¾«²Ê‰ŒÒ¯„÷úìðÌë_}ÚÄ‹—,›NIÞ¾+yÍÞ²¯îxn a2{YN5ñ’ì™Wtõ²*'­²¢Ü-lû·ìKfaäJfïÏNZô‰†Å+"Ðiðƒ%eî»*ó[%u ’úÓ%UIÉ%µMÅ$õ’’‚¤ )H ðYIÝ{}¨*î6‘^IýY’JºÔsì!™aÅ$CR_’T‰„üwÇ©[ζd–ŽÊ$ÀO#) ÙlZåËa³lŠ2FwÔIJ’U3äkÍL¢‹úPI}G%UöÑÒˆË1H¬D%ÀÏ()©’ÄÖFŒeÇY³Ó†_¼¤B—­¿©Swö¯¢¤È$§îOç:¬ÜºÓÛhÙ½¬ŠI“Ô­×U9Éc%UFÄí 4 ¿dêÛ’>I’ ]µq:µL¦Üp_êÑ–iLúbžcnawæd ÷%Ýè™ÅÇÇïT 77w:TR¤ôË?[׈âÝ×ë,Ó­7GÊÕ))ßyóý3¼}ûö’’­¤È¼Ýo·qÂ{›Å·Ú]"‘çí‡I*ædƒ¹ƒgll¬bÞvìØÑÖÖ†ž€?]R%’̲>? ¶Ovcv±-/Žg‘:I’â £¢¢6*@v¡Óc¸/«ø¡‘ž0òy{ÀÍÒÀ?­.«tr$å=ÇK1ÃGŽQÙá¾Ä“§y<]ÅDvé 3&oÍ•_IÅœl4¶qÝ8š­[·ÖÖÖ¢'àTR)çŠy|þºCO·ŸiÚþÛ5¿ñb$5q’’±q©wvbÜÅçÛÏ6Eo гܚ^C¤CR_’”$³’óÔ7^ve繦ç›—/±ä{ŸÊ¨åmr%µeËH €!©JbÃ'žctðæÜE19Á›ó|]ù&«ngWBR$©"ý^‡©!ÇsyzpL•ä­ù¦|­Eès”rI‘y;Í6\M%ŠˆXW°åê7H €ŸARÙwë õë®Yy7³‚ȸq[ o¶ùŽì¤ $õG%UF$Jf Ã’è K“¼"Üß, 5»ŒJ2$¥\ReĪÈE†ɲ¤•“Mtp®-Ï3±šÌ$ÀO"©¹…Î!ñ#¿@¡NLKü‡.É{JjB$•Y14wþ¶¬²‘ßþd߸gë™TŽá¾ÏJ*«ª?À{ö²‹£¶?ýÜ!ë¹¹»+!)~šá>•¹âÄôž8¡"Wœ˜r'TáŠ$IARH ’‚¤ ) )H ’‚¤$)Éø/¦üwýÔIj\’‡¯=I}ARé%ŸÍ$ÀO")ÒGYUÄÚ‰vÎnæö+²“ŠG:UHêKŠìiÓÉNõÖ³À°¥æ¶.. &—eUËz`Hês’J—^N*íÂ=Ÿ€ùf¶ÎÖ^Ë–í}•U!Ë$ÀÏ )êÏFÜjq²áZ/ˆ[“SáÝ°Ql¾Õší´§ © ©¤ödrX~›G–Gä^˜ãn*ôØ–F$H ©ÏVRDôÎ5 ¦Ý¢]7,_—~ÔÑTËzÙéŒ TRü4•T±i¶Ð!>]z€J»®I\~àY&*© ‘}Å wAî³lò¨ ”JrNM÷¢ð¸w1Ü÷yI•—n³7êw|¥T5š]Þ°~ob $ÀÏ"©ìê^/‘¶ÿ±¾LLœøÓ*©Ô¢2ËxÛ"'¾§’Ú’–"´Z¸»DyÞ )~ IU~t`é‡_Äì¾?OR)—Šxú®ñ%˜Ý÷}’Ú´k‡¡íšÝ%˜ÝÀÏ+©¬jb¡ƒ–}üë̲‘oeVqwz¹ìô4$õÇ%•v£IÄem¼$‘ÏLK§b »Œúƒ¤>'©øüŽ‰GZ‰lFÝ Óʈ¬RLœàg‘TF±so*‡iý{ov¥ô2³Åí®|§ WèkÍARXR¤›|\̬秖PΪ$R~/6ÕÓ_{•Ô$%É.i¶è{Ä–d”KóVAÄ>Æf8l+F%ÀO#)² -“¬[íÇã0ÍÝC½„ò9<“€üÝ•¸ ú„URdÝ”UÑáâ`Ê;/XçêáÄe3ÒžfP“( ©ÏVRdÞÒ®Õp݃×ÛÛ[ð…ëÏvd ’à'’”TFeDÊq_Å^hÞUÔž®ð“IHêK*ƒþ£ç%‰W^Ç^x{±5éö@F~'õIÉáýÞ]—[¨¼ýþ6åÞȸ$ÀO")\éO—.‹ô÷I —E’‚¤ )H ’’‚¤ )H IAR$Àt‘Tz‰$³’È«‘ŒN/!²k‰Üê‘«OCR\R餉êˆ,é•3¤›Í­'²Ëeó'!©ÏIŠLT^ýðÜé»È»™e²¼ARü•T9±q««¾Û…ŒréÅgn¿t1˜åsG^dARPIÝï2ä¨-ÝÛFÏÞuð€+Zq¼ •Ô—%•u펎×ÝA2odƒŒÚµ™c<{ÛµTRüT’ŠÚéÇ÷¹Bý^²øµ«±–G ùÁ*$5A’ê67æ./|Oíæɳ|¾qÔåAü=©¯Kêz1›m™pwˆ¬¡6ÅEñ-Rñ÷¤øY%•[óÉÙDwNr£âß•ƒ¤&RRÚwúMÀ7ÛVÔ¯øg%!©¯Hê±1z¹ÐaErñ¨?Ç IðÓHj.ßë ‹ ×jÙ±üª‘N’šPIñ×%tuƒÏŒêi!©/KŠÃ±X½Š­-Úx“þS2˜8ÀÏ'©X¾À*t÷1S®(¤ð혿٠IMŒ¤LDFN«—nßÊæÏ‹¿7ê¯ÉCR_’”>Çrî®Á¾Æ^ñi£òIð ÷ù‘7RŽgqÍ7IOLãœÔŸ0Ü÷!³’ˆXçÉ´Þš¬0¦ I}q¸Ï*ñÞPf èkdp0½ç¤ø)%%8‘QFì((àˆ,·Ýĵû&^RÒ‰%ýA"Ãù{³j0ý[$%8A*©ä½§‰ºmdef¦ ðsIjd z‰„üâoÚ¾Š%ðÜ| ’š@Iɧ K¯ˆ^Þåaű\\@ÿ /Hê³’ºvGG“ž‚.ý \7ž˜2fÎŽ¯Ì*‡¤øY$%û1o­üǼҟL> ²Êd³’úã’¢”š5üë]2ÉÙ5²œ§CRŸ—™œüú‘y&ô s«pt~ IYø­Êªø†Ë"mÈ^žyýGHêf×O}Y¤ê#©ü© ©íßtY¤ò$©Í?œ–Ö×Ó⺅ĸ.Ž–‡}àÛ€ucBK`͵ž3~96ëì#>÷èw…¥ï }{:Ijkl‚Èi¾b†m²õ_;fÇíDþ»:Ë~ÁgÓhã¿Ön‚’¬Î³òñž£Ú’ª˜Á)& ‡…‘6ãòf°þ¯júdö>·³Õ2 ]ƒ , )~0>¬¯«­¯«£ãñ£‡Û¶n Z¸pQШ024tt°³P1‚}áÑïŠM›6EFFNII$òߺÚy†É¸{çöø½Y¬§Ç ÿýRr&(ÉAA Ǩš¤¨¤)4K:òrs.ßð´´4CB~',iÑÑQcZ&$À§  `Ì7‘¼Mºcã$1¥+©ñ´µµEJ“䘘˜1 *(©ñ\½zuÆ c¶|róI  ’št~IM.SWR“ $$IAR’‚¤ )H Õ'77wƒŠAvÓLRëׯW© “ÛsðàAÏÛ¥K—Ö­[§Ry‹ŠŠª®®F§ÀC"‘<þœLrÑ$ïÞ±±Ä?ÿ3å&y˜™!I&bÉâ/!þñGé‰KKdÀ$ðááé©DLbzÇ?ýÓOÿüÏÄûoJâ¿ÿwêp}rãü¢°vÅë×Dd$Á`(o̦¦²jkÒ£¿ŸÚÔW¯ˆæfĨhj"ªªˆÊJÄظu‹¸r…¸z1*._&Ž#ŽEŒ Ò¹¹“dG>wf*:šø¿ÿ—ø¯ÿ礨¢§††ˆînjæùÿüŸÕVCqíò@um…ŸW05yyÿÒoG”pàL%®: `r¹¼Á›ÁâŒGÃ6aÙ0©|h¨½sO w+ž#9&“/þ!! þÌU•þ€ÉåÂJ×Zãùwã8'`r¹´~Ž.“=u›]€ÉeH<ÐÛ§Œ~1’(ÒÙÙ988ˆ<PA6mÚôü9þ/UdëÖ­/^¼@@R$’ )IH €¤@R$Œ¡»»»®®®¾¾>,,ìüùóÅÅÅ%%%H áFó¯ÿú¯È ÁÔÔTQRnnnÈ U@"‘(Jª´´i "ôööÊ õ—¿ü  RÌ™3‡–”——²@¥¨®®¦%UXX(‘HªC__-©®®.d€ª±páB}}}ä€ Òßßøða䀪AŸ‡‹Å8!@e=˜NT×ÔÕÖÕ#y<ñ ×ã@(ºyg&×Úei< Ã}E²®È *!©·]Â3ÊAGn a7o%:TERË3J AGN5)©è€¤H I!I )’’B )$…@@RH €¤€¤H I!I )’@R$$¥Â!É(£º£¬r"}xaz ‘]M-¤#»ŠÈª 2J$#Od”SËéG3Ë¥K”½0³lä…äú³ªFyšôåY•J¢×I­¼løíª¥#]Nÿ›Eo¼|ó¤Û–S5²#䣲͓>D¿i…ì%äíÌRúµz3È7"ŸOnmöÈC’š„ »â¤Ìu:ê¿8mIõÒÒ…™¥6 –>ƒÍÔc“ÿòŒ=ÖOº/¡Œ&í½Óï÷¬35ä°ôtxFŽ±7RïI;üòÃY3Xúzä Yzú†vþ‹Ò*RîKè7Ê(p31õuÉ5„®ºõÖfÒA æÍÖóÛ`ç-1õÚâÞ)é–¦B–ž.›-p M½Ö3ì©Óqç}ÒtòŠŠÝÆ2vÜ]"É®î¶×ÿ·Ýí2ÿ–›S–KW®c’›SNì¾zŽ5“±ñ–TÖÔçα9,O#÷¥¸„ûŸ³–]A%€¤&)¤¥„§³¹ã\¡}ˆÔ#´¤:¸<·„òÔ›íI7Ú/?µ114ôOÏ©¤\“SÑâ`ƘúGžztýSì‰[v&º"sŸ¤{¤¤M4u~û”|£=ézûŽ#Wm ´ùBÏí·¥eKÉ€§…™Ý†“Ôj¯’GòÝ!òM-˜kê·5åÆ'…‡ÚÉWåT¼s5gñD^N´’ /=[°ÐÇ­9ùQj–g‘K|©¢¤¢wÅñ,=iI9ñõÌ쉻ïu“+ñsu¶\V@¾dwÑEžÓ-Y±6×ÃIä¹9­Œzfvq™P±’@R“WFeÞ©3`p¢.Ö tD7e-)ݲ‡ëv-Ñ,M­¡îû8rÖ&—ûQ+ynï4Ã…ÎÜò&RR NKF*íp17°Xz<‡0¤$åuIQ(ò %eæ—U6z(²”X6k½(±LáíʉÑÙk¿¦Æ¿SRtø»»Ž‘Tfùàâ@OžSÄ®{²]†¤ ) ©IŽ2"j#gNaö"ÜÇÙt“Üeqh %Ï2<¾Dvæ ’‚¤€¤&s¬ï÷kl]£ÈûD~=‘GGižîêó’Q'¤2Ê®#ÜÍ5××…Æ’ù®L‹Ð¸bê$”l&ÃÝf;¾ú‚Â×y#'2¤óå2￵18n¼LIäû'NNY³j1ÓÄwç=ê'WéÒ ð™DòÞ-zÌ o—TF鯿עôg´[g»Ú8®:J¾—Âì>rµý®Ö<‹ÀœŒ*© !)H Hjò¦L¬Þ¸Rh¿H:3\6ì¨]MÝ6œÏ)“÷í*M¹þ1±èCÂÕ·Ë—ûêë›®½.ýAnåG+.ÏÐaõ¡g Eïw-²1Ò6²O-–URþ‡ÞSg”Š>î<|Å’«-0&Fi‘ž‚¾þxÊõ Ô©%Y$^ïJW.)ÊSYÕ}>N.Ï|Eau*êò«ðÈulŽÀnÕÙÌÊï˜Ýì?‡m±`[Q{ÜÑã"¶nȾÔŒôaIɺåûUæl »5·èJJ¤Á=Õ5²©×ÚÓ!)$õçGVu#ï¯ÑôšÜ±;kr¦U÷Ùê鲨a@}é` ËÚÛÖ«}ô$pê%Å}»ÍŒ¸l}]™çâÌš´búœTƒ‘Ú,é«ô©‡Ì=ƒRÊR‹~Ìkl ]­bèMÖí.%úÏ6öÝ6NRÔ ÓKÄ[s÷ÙX±õž‘KXÚŽ¢.©õ¨ßI9pYNc~Ì·eâ$û1/óßÜÓésRáëÃy ¶ÐaÙ—²ŸMcÍÒ“þ˜WV&Ø««©3'»-§¤T ©>jSçì.‡¤Ôî˪¹^âÔnê‚BÒGÏ ÑW"Y$:è8ùeˆ_8þ²HÙÊ‚šRXIPSÜK$ʶ–9¤/X$ߘ‘Ë"U)¹,Rv•Â£et(É,µÁ²sOÕ×›¾Hu%¥²áó_ã¶3’@R$€¤H H €¤II!’B ) )H €¤€¤H I!I )’’B I¾YR®áI™e #¯–”ÔJt¨×nÝý›®ÈÆbÒÃ>0IP…°[©Í5A瀊ÐÔÔøìYbÒãù³gH‚ŠÄ»·o% :0mÿu®?þ‡ºÖ Q…õÀÏÕŸwžÓªë7üÇŒ°ko'deýbgü›ö½®?ºžöòè_þM¿¶wâ?¾Þ­>þ0 ¸œú÷ãÛæ'?yÚô¾K,_S«æXî%,¨O«Ý?·ÕÑ_sëÝÄHêQ2S]Xú‡%%þøàì™+íƒl¨öÊ}f<6KOPØ¢ø±JîÄÏaq¸<˹ÖÐ"0å E2›?óPÓ˜ºjìsÆ/ÿÂ’ÏŒ²É—~a8Ž^ ùL¹÷¥RPqTR«GKJ"‘ŒsS¼+ùüº%5ò’Ïo’DÙz$ãw~ü{_§Dòå7m8¦¡euëö^ö,–\Rä“:_]ãsô oI?×Áî«-µ —~‚¥SŠƒÃã3õfNë%ij{GÝÌgþ2Sí— Ï”¿¤ûÈÖ’“ Ü-fýò«ÚŒ¿ ¬¼ò/ÕwžC§Ó#͹ºšZšz+âë§{Â7gü?¬sõ7M35C¯pœåºwØ Äлu­¸Û¯È{7÷ïp0djhiªiq‚£2;è^¶ãºÖ¿hoªqækýÍ9ö †"ÿy|)oŽàoýëLክ{»†èJŠu¿!.ÄEí—¿ý2SÇwYì‡~êOÏ,PŸeÖ2\8Škbþó_™¥½TcÇÐÙ~¹¤`½ŸöŒÿüÛj¸.ˆhêUII{øö%6Lãy;»¿°E’ŽÔÈ ŽÖ¬Yj³féòB#ÓÛ¤qí›gý;ç)1Âø·™2f¨©“™ÓÉ­}Kç¦ölº—•@]]]m–ŽßòíÍ}zùíµì_þÃa|eØz¯Ú—X3Y •QoÍ4}(3×™™SÖ K¦Z%õÄ\kæÁéÍþÇ6<í -Gé‡÷­ñÅvy:D‹Ï¶á,ˆ9B/¯:´¡ïüPúê›;}4¹—žI{á×wÜ„Ús¶I{ä mÑ\_ד÷ë¿êº”²’mç;8ü¦¯&ñ„&-]Dý¡ê,³ƒUŸ¨GºÎ7Ñ7Z|˜zZ_™‘&'Ð×jÏåò'/¾4j×û¶„Ïam9TJmþË›–ÖŠ½w És[]¦…(ÿåÁOµÇDNfÑcòvã…%¦c«\Rõ;uÕŒ*úHÙvøˆ„6¦üÍGª©ÚîÙˆôV§^UIIzS}¹Ç Ÿ¾XÜ=ÉrÖaÏyÚ'½ÓùÐÓZ³ÿy³£:–©eR?úœÔíÜe<3·7ÝÔN¿)?¬Í$ý.ý0$m«D:îÉýô:Ol[¾6­Sy)!>Œ‘Ô`’­– ü¦Âç,žk¦™SŽF˜jÕTµ™ö,úœÔÓ47 mÏW²ñ)òÏ\uf-ÌAÝ^FÚ[Öɺ<‰|øª¶+*ÿ®| êfN$)#j]í¿hª/În½ËóSš‚ÓöÙã¯gè½—|Åz/¶ÿÚ#òš¨áf>×À¸…¬…úÊM4´ì¢Ê¿:ÜW¼ÝRO@• t S{² ð"Yå½°ÕÕ³ÜV*[<Øáe, ,¸õUI –‘ïË_k÷Èl¹¤ÊˆË±n<žÇë¯Í|¸Â×´Þ)›© I-©½#%Wã©mšú×?É^x`©ÀÄu—|ŠCÏ›ëLÝkäÀWÇÇJªs_Ç>©Fñ) œ8+âÏ£½¦¬¤÷û¨9¥)>¸ÑFÍ-ü$Ù3^Ü9wƒç6gnTâžÆvùáù3;ÓÖÅ{Þ0ÞÎ6zB§·JRü™™ Ã|ÄàNu‹ w¥=è=¾3ë)ùŽü„:¦¶^ò—ûz¹pøÕo{HIÍÒÚX>ðµ­§ØéêÍ=5¶ —ž“ZycXŠCÝþ&~¹7¾*)ÿ}ÅòUošëà¸>]&)M“Ä´h}¡}S—„øÚ™þ7÷ XÚ¦¶.AK"ÎÞ},߲ђ"‹µKf µˆcO‡-Ü»ÆXShî.ÏÆ\?oGïÀíÖ¯ˆc%Õ±”§ã˜Z7VRqgÑÞSVRâ CMÏÅc5\CÑsÍͬ¤ó=lfý:ËwC¾XÚ}[ó!‘ûØwàXÇ%)Þ }Í#«ª9½A tþ(&ê 7ëZùÐãƒsxšî!IŠ/ß_xàu×€TR:±†¾¶õ}[-Ìƹkô쾡îy&s$õzDR± IP.)>›Ã6µuèøÅ]'¾<—›~¬ý婹á|­_¹Ö¾·Ú%%­ùÚÍ8³7QP^ç2¡†Ñìmû ³YPÿªãû%%Ž·Ò­¹­0Ü78ÏBgCV Ú;`ê÷Ý\a¢f¸¶GÖmRsÄ gÎÞV>f^Zo]¡@C-æþÙÓºél?X=f²œ„®¤fhï{5Òs÷7—s¸Âû¯Åq¡f>áûhy,±ÔŒ¾,ªSœz'•ÔίKŠ8 Ï°ŽÞ¸þ­Ï›?CŸ•TÓÅe¦}Ë€ìùÝ×õԌ¿*)¶–ÞåâMy—ÃÌʹúbøÇL’Óû NU>—ÕŽoêï+ÈÛ³ïvm Ñß”Ÿžÿ’úqWßÉ‚=gkG΢Ý8õÛá¢2ªÀl+ÉÉØÓ2 Û´î—ÓÓrj>}!£ÄÛ'eG ÷’9)‚½„Ï¢×{Ü¢ZBpr0‚#mHqtm n×É(1œÂàþ~ð?|Ãá?œóÖŠâBòMú¸È·/w_†ýnwÓ›Ñëêkàòéºõ>vO[B~jÝ=oGå³ñÃUˆÓÛÞô=Ë}‹k{Ù¯>ÿ_¤ÌÊŠ#›´ONËç{Tkæq.©ù}鬲7ÒEýÒÊŠS¤–‘þÎxÄßJ endstream endobj 1561 0 obj << /Length 1620 /Filter /FlateDecode >> stream xÚµXÝoÛ6÷_!ô¥2P©$õ·®ë²ØÐ5.Š! RÚ¦c"²äJô<ÿ÷;òH[RT#M1øÁÇãñ¾ô»OÄ»÷ˆw9ùe6yý[”zEX¤,õf+/c^ça\DÞléÝø×»F.¸âÓ€e¹ÿ© R—;¹Ó€ÿ2>ŠRðVà" YH§·³÷“w³É· cÄ£¨<3’y‹Íäæ–xKà¿÷H¹·7R/Nsø/½ëÉ_b%=‡‹ŽÃ98å^FIH¢ þÂXb¬»cÞMâÿ!+¹áe‹xÍÂ"bçÏ^ŠJ@*ÆÏFçÏ^ýz yIˆÿ…$d)VSHß• –ôy ¯®ïâ;òì³É÷β§œ}¾ÏéOøœýÔÙäYñ¾ÙòÅZ<Ë,½cwLï™Ôà´wöï)$Ô;]4…¿à¼må½¥+¾-’ªÆŠ‘š—õâÉz…ÿ­PJV÷m8 ¢"ó?¯¥–V£ZËÖÄz…=Ë 8ŒnTKË•²Í¬ÂOÕ[€V$ÜùŽ—‡n8:r/I‚1ƒƒX W¾\6¢mEû Y•P{]uópÚÃ-e¼b+š¶®x)ÕèfW¤ßv¢UÁ¼^‚Rn¤ žt²?CùÄÿgJÔʺ Ú­XÈ/„°îÌIt%öªzÊBþ—/Ty@ƺ»»s$ q:3¨e.Ö|ʈ5nºX€±Ù•\YÿÔš+~Ÿ|¶-%æ#1=f/Ër,ùs8EÌ¿|÷ç»Woõ"2ÀÐL“?M¬vj×ÓœŒ>“]¹´rÍùš!7ÛRlD¥pÉqw®ô:HƪnÜÞvÛÔ¿h‘«Q¸ÙÀ‹Bœ—»+ :´\YO°H‡áj€[üì×¢±ð@„±¬-ìj Éî“íà鄉ö@᩵#cQWúÜý®á Ðe[¶Ö0d£”G„[¦Ð.X¬†¥‚kȧ‹ ËÛ1tÖ®±!àBZy`ˆË+Fãú}6ûòiæ*J/r_—ÕË©Æ4nr“XبWJTÈ›Ë{s/`¾‰6u6!¦î+þ 3erd–µrŠ¬”ÜKY-€ž¦˜.z௹s׺bx¥pP Uj X7ñk½¢ÑI…¬c@Úðj!t fÔÿ&V endstream endobj 1565 0 obj << /Length 1580 /Filter /FlateDecode >> stream xÚÝY[oÛ6~÷¯:HKÖͺtOÝ°)Š kô¡- F¢ba’èŠT\ï×ïP"©»â¤Ù˲hñðð;ß9ç£ejwš©½]ýº[mÞ8ž¡g{Ú.Ñß3¶îVóÝÀpCGÛÅÚ§‹ëªL#ÄÐ¥nûÁÅ Åeóém•ÆøR·Ì‹u3ðgQÜÜ8†mX—_vïV¿ïVßV¬hj–æÛ`Ü5|Ó×¢|õé‹©Å0þN3 ' ´cýT®¹^×L»^ýµ2…·fý]y§5>¼íXõóÍ·¶F`y‹–}XÜß*ë=ÞÙð|¸dÂÔ<vg„¥ñ?p¬ùŽG:Ë„†iYeø°ë;FèÊp‰µdÒr FÿZ‡Ò³µBé¹<”hÓ3‚Ðm¢øÓ¥î™æÅo¤HÒ»ªÄ´¹?î1Ûóˆò›[ýM3D÷Ím´G%Š.ų¨ÄÍVbÄp,FÅ·ÄÄ<Šïr\0|pb„Û°çÅ0ÍHIf`·Ç§Á"aÍR4×›"ý.¦Ÿ(Ã9] ¯+6˜*g|L‹˜io’±àÖU"ö·Oå$ÌXZÜ57rè6ñX¶_Eû>4/6¤ÀŸ-ÇeG²aûãý4ËÄ&ð‚_)îq©g¤cvÓÚ,-Æ_G>¨§ïQVÉhëÍå„%v™ÆƒïFWtÐÛx½Rä<Û2B ìÙ$ƒÍPU,½ÇsÄpä‘XåX˜âXPëã?· Gx*^À2GYú =ïÓ(`/ZÚ2ïëpÛ¨qŒqDbÜý¾»`?ü‘OdnE%-nqBä¨Ä,•‰ÃÐß2v‡ EX¸û†ˆâï(?dX ™& {ÒÎúNߢ~پˠyTúñ}}¹ê´Ù¼´“Í&!U9äqþ=°X›”áçÎL°Ç&æN6Å~ikù!9 ëÄi$rrOŽ½ä-p/M´°AwŽ*ùCV’l)sçÚ ßª* iÑó ÄßCÖò`Øb"!V % ŽØYÔ‘éäÆÙQ,€¢ p(C¬¢_]Ó¬³C*!¬hl=±àÏõ[à ´Îè¦ÕÓ2lš 5¬:OßCJeЮ^uÜè’ÁVi>•’éf÷F:}¾­È$™Á\vñ?Õ¶LÕI-I(Rd§ÄÎ4u1¬Î²&×î‰õ®Ša¿Ž@®ç7”dèŽÎey‰RºXÆ¥ èp(É¡LÁËõ ”õKÒ(/r$é+¯ç>›[3§2zÛVSZt IK"^ÂÁº5ì:¤íÊK寗wÚ­¦…œ‚–Ä04“¥ý$#M9ÙrY…”溢鉄#èá«ç/§õõŠ%Á \ðv?]Ütšb¼$W_P$C9QæbÒfÇ°*^]]·óŒ¾ú}ŒLz Bk=S<-ë¤V˜ãÕ3/5¦Ø2J¦6Ü _{":¿o¡H›ñªtÐê–âoÀì4‹Î¼ 推”¦¸Ç˜Š”ÖTihù¬‚—•ÞÃœòöRDòYY)§*ê(Yê»kÎÐ¥ÃgÏþØÚäñ6-êÎ$ªß‡÷²´ĤãÎèØÈsÞ«ÓÖ"þG!(·ò`21dJúu5_­ôÝ¢ÔŸN(G»\”íגüøzÀe9³V–ŒÅñBøµžd“À‰ ·¡¾:ñˆxš¦;,:}hç±ÜMÿ´Ñ&Á¼J â_úb¥Vv]±¯²-1@9ðߺ±> stream xÚ½YmÛÈ þ¾¿B¸bQˆÞµ-Z\ÓM.‡ôŠ&»ý’lmáôâ“Æ»·ÿ¾ä£7{MöPøƒ(j†äÃgȱkm-×zsñ›‹—¯ýÈJ4ò"ëfcÅž‰¤¾u“[m±ÎT¶´½8YÜv²%êÍ¡ÈåÒîâ1ÞËRf¤ßñ±ü|óóÅõÍÅo”¹– á»±µ®.>~v­ø?[®ã§‰u¯GUV%ð,­ÿ¹pÙPWk·ïߌ¤F‰ ߊEè$":+9åqØKŸÈH„g…~âˆ@œ“£ãØ âˆe ``Ù1g¤'u\!Æzľ“ÆI/¹•Öæ¤hw·È³ˆ[˜¸¹‘“¤ÅíOK;rÝ…ÚI&d[u¦Š¦&F³袣gÝ("Ì_Ì$ürûŽˆÕƒbÖ}Q–Dµ²Ê #­fƒa›8i˜N,ÛgjçÀò€þq½–{%súr—•ÉÙÆ°Z¾˜.ļw*S‡îKàºsFàœRzíúPÚmvoï²:/‹z{5¨1s<á¤"™˜üAªnæ”VîËl-+Y³çÖ»¬Í a0Ohd¦æÎZÉÁË<ª9v&ʦëÎxq%;eo VQeû=¬†^6mSu[ë&—cÁ¾Î¨4Ê;˜ZJ{o§Z™UsFÿ1ô7Ù°¡ª¬ýuºµúår“JuÖ}`Ýi¥T¶àh¢s8€ŸD/ž˜úª©UÛ”lÏ}—Á×ŪÍÚ6³‘ýHi66Ïõº9Ôƒ ³úœŸÏxD·<¼©KÖœ=ûæPæÆ8z~rCW:[gžª—mÌÍöb3Ĺx‚“î`XȬ¼ÏL³_O´óÿb´šïAK%û­oØÇÛ|Ý´­\«òÜÎÞ·2/ÖóQr)ùQ"™je·oêN:ôúvžW›ƒ:׫! :GÏÙÔ¬²• ”Iãì¢+Eò*ºÃzw: ÍðÛWl¥±oo^Ûɹ}<#"ŽðÒXŸ? 7‡Ü;Ð6·m®&Zô¡êàšŸß“Â |G$É÷œ¿Gu@èÇNz^Ƽè« G@ä:^äãŒH¯á˜ù~(œàLz|‡®ï$1;ìºÞ5×CÍAíä›o×5«ÐÝÂ!.ïšíª°­Æ}Ô[î“ëzÛCK§ýX)ˆJg¢P’( æ^„§Î–åEvíª{蔬èÛ·;òó¢x n†gry¥š)—"\üŽ»“¾e%¤BÇpÛ!S.½pq‡#Ëᬱý@,ÞòŒm1|å‰E½iÚŠ -•µµÉE%™¹jŒ„ôÈ$·ˆ–-M üTc>óÖƸ¸Åp§ºAÎðz9³Q¿Bõ¬ý´Æ$Æú éZuØc ðR€;,D“§€{¿+J3mwPêQÉã5rháÄGÞ׸$Ø-¯Ñ£ˆ0^8ñhV«’]—me÷‚^eÛ6­yÉåjéæê-b¨õ~¾7ÞQ¡ÞQöx#k—uDt£-Ð `£¯ew5ÑÂ=Ê5š· ¨)÷˜Y[ûÄ©%’[ÇëѾ‹_%iÕn“1'lêí唉Tê!›Žu¤V,TV…Òh­]¿¡ç¨Ëêíïhüº©ö÷üTTï µ£)Ê8ú“çE²†CJÚ3£\à¡t^9§<ªãúb3ÚNá‹×pøUL+3ºwŽžã™4šâa9¨W %¡›dâZìDpâ¼± ¹¤^@ÎeN6ºÀ>å¼B=¼,ª}Óª¬^kØð ¬fCÏîøfwÅájÅrzÐx–.þÅù4YRRê–z®¼ë•ôêXvS32X¿àFâ‘)º—c›N¬¾Û ˆ¸‚35qÇAàÿ6­A›„Bˆß‚CúɆYɬîhû'aø0ù™$ãü¤”‹ AÍæ…$œ8ðì-¦ýe,o°#òÈ•(µ6õŸ—"Y¨SçÀJ>†a˜1~€ÍLT¡æðd‡q 9†€š-Táøåa…¸øxúÔt¼X·…‚¼/Y:® ]±–<†rXѵkº¹-:ÐHPì'òâ °‚oRA¼báq¼ÇùtÂúhóýHûŸP³Ö[­^ þ¨¯¿N³Œ÷Ãdd<1³²k¦²ô'l[乬USUä'x)õ1êû1-x<À~»+Ú¦¦æ™wª¬-¯N%ŇW_ÞýûÍ—w×ÿ½~Gépùt¶zåÂÓƒºÔñ³. ¼Ðsâ(:_CÍmÜsîŸFjÆ÷O,ø«×OóçÉë(–ä¦ìY>ÈëÐV@ù>é.øV€€;Y^™~áY-Å·{ô8° "ŒâÿOG1¹Šõ<× R¾…ú§¹9Á*Ÿê# 6˜búdzJ¥ÏÉý#ÌMÓá¼öõõ‡>X€Mu{ÑéZÞñ¼ÂŠ ”˜Ðìër=€4]èÁç;üÌ' K¨¤!w^¾Ã'¼ÃP»Vf9½xñèHåÖa8ªK8ƒ¼»àoúÄõ ¤ÓEVj*a  ¹>h\u©”<‘ì\ãrE|ý{V힘ï"u2='ßEä9B_ix='Æ3ò}¤frßL‚ÿ˜|Qä¸ çóGC7ùLI,—Â}鹂¯l¾˜â*p¯Üxr[û¡ãsËY_^ˆq§oÅšãoÃ8¼s¾ÚæJÒ\<™çp ê’ñý–p Ÿ0ßÂãáueø=C°‘NaC€iqµ<:ê'iŠþ¾QÀü% ›ÍòDÁ-J7ûD¹lÇýxŸ«ÀÑœi[£} ƒG›œ5 :çO5(ú‚ I<÷M×+ÝÇ‘¾NCnß!Ð+4Ðx§çM`¿Q½ ÔŠ…Œ[y=ƒžt݉TÙ ¦Zæ˜1 •šþ. \»²(5Õ±ÎpÐ9Y÷¸i©¹Eä¥I aŸòsh@WìÜIG"L– mà#1ÁBM7€±¦i+ìTkŽõ§¢¦ Ùh¦Â üä+ çCñá=3-È$¹ d¦¡“¸ÉqDæ臗é¥:‚ÊËÍÕe9BÈË|„—ctäI?<í¾Ù÷G$xXßSLñsò‡r@õäÿ“OVY8w{ÂtÞùA êÁDÍ~µËöÊü÷à¿ ž‡–> stream xÚ­YëoÛ8ÿž¿BØ¢€ ÔŠD½ƒÃ½¾E÷ÒM³8Ú¢ %Ú&ªWõH6ÿý 9CYR|y¹ðR|Ì g†¿™¡kk9Ö‡“]œ¾÷B+±“…ÖÕÆò¢ÐüÀŠüØöϺʬ/‹Ï}#SÞñåŠEñâ¯V4ØûÐËL,W®³x…—"¼øáÙÌv—ß®~?ywuòóÄŽŽåZâ¾9‘•'_¾9Vã¿[Ží%±u£W–ÆÐæÖç“?Oœ‰´ÉHZEËulÇ‹PЫâ8‹—Ølª<¯–,X܈ GÖ·ØrlÒoxÚÁ|<Œíx;YÓÖ"•<ÇBðR–[{¹òàØÀ¯!ŽÜt„ÜîºÑίŽÃ ÷VnËöLëÄÑm¶v.?LµÆvèzVä¸vÈ’{52£`ÐÖ„Fì2+NèÞGV;0&DõÔ„ÃwwdÄ'±×óQã~äÙI”am’6æ·ÚÜ!³b0w蓹Äi×ÑæîÎÀ ¡v…ë©nݶãE=úÆ/3ìd¼Ê–ëƶ„x° Ãæ\œáZ78uSæ¸~¯¨qÝ3ß9s"MguPm¤ûÔT©h[ÜyþÖÆŽ¹T_Á{iîfWå$l{ÀÕð;­ÊV¶-¬6Ø}ÞÉÚìévàYkk™œ©0rP•^4“åüí”®,3y-³^yýC”‹C”‹*ëX%/ñùêÎEßÕ}×’yÞŠN¤öE—Ú°Â=Ä%3\>VÛU.®E>•X_µLñ+‡E°¦ìF|ß5MÕ¼2çÛTÔÍĺß>Ìcø¿—¹èßܸ—‘äÍj#ÍÑ߶ê›T+fBs skô˜Lò‘·¢ xk6Õ|Œ2åƒNd)Ve_¬0kʲÛÉÒØŽxlHòWw¸KÃho¶ ¸R§;è"å ¼¾L;Y•«rPÛbo4ûõ§¹„’{A5ð=Ûãç âdqìø~sd¾7Ž1Kfq,ç-ÅuE¨ µ“4°©N9 E—eNDŸë¥,D)µ1D6ØC Äù¼ªE3ºî‘xl.ø l.8J9±_Ó‚J‘BzM#³Lм,͉„­(†3äàËÓP=¬xÙTe1È­¤æäkÙ**~óýãŇïï/.ÿx½t]wq…×vAÛŽÍBO*Ô®swœf–<×f.l¥âz®2ŒæhÚ™]a'ój€;ÿ£ä§«É"O©p«^}ÜV=vP‘ÐiE‡3PÍ8ÁB%"Q2PÆuÀ¡=¼ã!N7;™‘š74¨ É ìŒ<¥ìVp âÖîª>Ï°¿ƒ÷¸€¤L¶uÎo iSýìžÒÏ\¨íë:ŸfjàÓÀoÛçœüUÿ]7*JV´OáÅ%.Äi ÍêõÜ¿ndžO=ä×É¢qÔÍÌ›1isźt'ðª<2§ócÈËüãr:? ìâÀýæÙNÂŽIéFl&)þ5Á}a”ÑebÃ!§Y‘ßBȯ…k8€þ/·Xa"SUwÚø“ÒrÔG.¢C§ÎšVƒ C ÌŽ )O7È]¿Þý$žQü ²™úBØ–í0óž|Ú ÿ?´~ OøâÓ÷÷ç— [\½»ü5!¸}ôšJÍOöá1ƒ bo`FŸæn– >¿5:Ùà(¡Bµ×ì÷5 ®ÂÑ1’)fu- be²\WãšZN 4np¤M!Ä—Û%I4 «0’¤¦ž”†‹?€ù)î’ù+‚þkÉ ªo[Àm=b:‚ H˜n@O™îŒ 47ñÄ ž¡ÅK%b‹®ªrœÛf*C€Àη¢ÀT\Eª—ÙÀöahMS}køv¶¨º=YÒõ£w0®ÎX Þ‚Cµû`kIç8y3ä$À’ rúQiðH˜‡ÜÑö˜̳ ¶]/zUTªGÇàüˆÏç‰ò¯z¸Ùš :$Þà3¬Ã;šÏ«}Ù[éÄŽ¹êûÅ]2 þ„äxƒt!¢oæ­ÌµHÙ¦µ}©ÒÄŒjû[ÖucZ®†3FûðêåÕ¾ÆRÂzþ\ض«šyÅ÷›+sY)‘ÇE.«î€ìóª–JB"~zÍ›S¸^§-½MØðSš)|g)æRMMˆ™ÒV<Ñ‚ÒcÓ™–¯!Û†ç+ãžF˜0YÓB5Û˜W Ü àYÚ¦“÷í¬àßg#1ŸfžÊ\v·g{¥æð‡óÎORÎÔ‡z&g#N‡ÅÐõ ñÛ——òvÿñ2û'=|‘é~á\¢˜I.VÍ$ÙßÑê†Ö ³#ó®g ä¤fªoŸ•x=>¡1Oí«a"ƒ%`t+>-=0YºdÎâdñâuú³—­Ôšg;ÇdR,Ø[üÓfÕ¨¼æ™T8~Øú½¡ê•ÒÈ3hr¹nxs‹sÝN¿¨YYÐ:¦¡•\š}ê‰jžþP‰˜ m)¯»¾!¶µh´ç”)­g®wØ¢Ž0^œw“}ÄÂ"RjôlJ+½ôë'ÊêQba^ßTŸ”D‰±TµÆF瘩yÌIó¾U¥9X}%³Ù‹Îx²»­ÅSêL7ðìØ;®ÎTÛàL÷Þ./€â˜ìcÏdœ| Ù_“z¸¾o'.¥õ-2Ï<è¢À>gæUxç¨,[a½–?Ž‡ µÝMÕüX ¼H%Î,z1 ¬ô@3atÃË9åÞbþoÁœýª×CõÌ-†Ÿê5w]øÞ¯{\Uo¹, Ïà–™G /†˜«þ¼PckžºÀð(Z3‹Õ Ì醠Šððåhâ“œ.^¨Õ#¨ÁúwWXNDSOq2•µúßJOitÑ‹iÀ“ð«C†‡Ž]°¿>ĂadÇÄ  #H–´:çSCS¤‚cúŽð Ët€EèUÓiÔd*œ.8êG[DsÍ72ý”&@„úRþìI,)GË÷Âèy]¨ëi­I…¬1ÔÓÄ[«ô€>ÊêNÙ'Êíð>xŠÍÔ_Kà8Ãk€N‡ç‚=h¢Áì …Tªèeö$ôÎÿ)|æþ£üîßùêˆÙ®K÷+©ÿ­þ}´ouÒQäZA~àÚ^ É.‡Äj.Ýÿí/Ê endstream endobj 1585 0 obj << /Length 2023 /Filter /FlateDecode >> stream xÚ­Û’Û¶î}¿Bv¦òÌZ¡.¤¤¾¥í&M;çÒ3ç¡élh›¶ÕÚ’#ÉÍÙ¿?Ê’-wÏƙ̄‚ îô oí ïõÍ÷³›¯bååA®"åÍV^yi’I{³¥÷›ÿöP ÝêÉ4J3ÿ]cj‚^Š¥™LCáßâÞln }ÄA„“ßg?ßÜÍn>Þ„p˜ðBž©H½Åîæ·ß…·üÏžâ<ó>Y®—¨ Ö­÷öæ×ÁŠ K«×÷¯{RU¨0öÒPY¨þVr ‡§²“>‘… ˆƒTý­ àƒL²„Ðà ×9¦wJˆ0쟂ø$ƒ<ÍXnm¼Õ¨à£)†«õ¡Š¼ |¨çC¡‚,Oȇ‹í¡iM=-–ßM¦J?Ï­oÆÎ85óÀ2‰ƒ0Ëžo¦sg©Òç8kpß8ƬÊdÄ’îûïÕC]”kÅ8öº$`[é%As½ÕåC5Nü¶Ö«I$ý÷BD ¢šn÷žDMÙ„M0™Æ"ñ_n·DÙ½ªêÁ^:¦Scn.¨Ã_óU%3V+VôÓ²­"¤…õcs‹Ž³LÁÚ¹äû£ˆ8Ê}MK]Ê¥玸Óe‰ÉŒpU6ìnWx½Oç{ÚnyWmxŸ®…:“½cˆ-9‘ÒcÊ$%cZî¡1µrªuÆÄO…Û2g©Öš}S(2E϶ ¶¨«¦qðÇCÑmQ•„h7µÑK¦Z£[¤!€.€»€ý(–AwläqDÇÎ6]Ìü`}ðÀæbÙ™™Š†VM$ö-áÈûÒ_M[óI$üCÛEÕ^/þDnÓ²Žé£sz2Ûbú;¦µÑŒ^lcïNØ÷BŠmAb 3v¶ô÷[ýˆ#V_è ‡Êž…ëÊl·](Á7î†|‚ÃB ‘“Íäl6ˆ>ÀwÑpÁâ5-ÉðÃ_˜Ž¨mwØÐA ú¶;îS´pÐtª Ý*=aIE2,V 8iæ‚é(ŽÃ­h³å£àFhÎ샋¸X¶NìGè ~ jM‹ ¿© ?@°-mb+x¢ðsÕV¡ä•-VæiEɽ#D]Óc{Ç z, þ2MV‰0§M¶}Ün³cÉUß}¾íÎ\ˆ"D$?§ñŠ „~+‚HŸCÙ+œ#ï/Œ•R%Ǽøç«_9îHöIG‡,ŠÆÜï¨!Ç"³!•Þݽ»CDNÍžÕó­iè«>x‹½!vÝxc!ЇÉ$›Ñ@pó.¤l’IÿÍŠÉ6Ѿ«– Ú‚Däþ½X˜}û-ßm=žÉüÔAaÇF7cÅcn ¦k"Yq„lÚÃڛ˓ğ?VÓ‚·'È2‚ån â íƒ oV¶‚¶-ÊŠ9 *ÊfoT}º’«iš–dÙŽÕ'=ãtcP¯¨ÚcN[ Û`_W Ó4®êÙsaí¹‰+kÍePw-+ÃuÛ–½ÊQ«=vþfXK1¸ˆÅF—뮾®¸r¥^š¦¨ÍÉÀï¦7–'wåÙ¢H Žå©ˆåCmöFÛÀ‰Tè¶æ']]‹È¹EàdVË’ñÄÙ ÀêrÙßib¦Eù‡ó+r´'jã,V7Œå¸’9ÏGyç[ôC¬üÙ$ÃuÄ;˜´ÖœKÌIß꧅uX]í\ÿ£àp]u ³ý.·(êåû@²SWtiÐ÷ñyŸmþ,öû.ÒÌBsaD{_ö»pœ"t~”õ;¬äwÁQ,àJ­±n;ýsaœ'Ê«B,e â'~K7¹*ÄzÇôCŒ™‹3¤2§+Wm²z¡ B̧ðîË?phÐÅ_±%|ýý#¡aš¤IR¹&…öyÃHêNŠ»ÓQ–^üÂ_}¬¤º¢Ž¬¸åàÚÍ4®Èõ”ëÕ)Ö1œLsÚag(DYqgV®3+î̸¾qJ"º½QséJ¨„Ó{ªêzªµ®Tà_9¼Á×½F;vkªíÓѽÝí›ãíÇŒt,ÙÌ9#ýdçhDÙž¥ÜbïÀ}z`ƒAW$ßÚ™:-¡t{âCû…ïg÷ˆ¡æ²œÓz¶f[Ú!†7î‚ë Ûósþ¼ô„øcõçÿø ìÁË:‚7= :d¦»ÿêÝÞMa×m œ¿²û'6¾§8±û/ôÓ?äH¨ïêÿþ;Îè/I„!ÿbÆ™u}œ¤AšE°Ñ¢Øè}ëþæ”Á@§¢Èÿ¡*ñY²>ÔÚN~'jþ?~¢˜ endstream endobj 1592 0 obj << /Length 324 /Filter /FlateDecode >> stream xÚ’MOÃ0 †ïù>¶õœï„#b›Øi¬œ¦ª5 I­6ö!àß“´cª˜„''–óæym¼Á”Ý•l4‘ñšPB‘(ç«rÆÆ%{c<þHÀÁŠ(®Ð’…uË–+‚:æg@(½ƒ÷®ªe\Œ ,؜љ6jx‡Vw%B ÔIL9‹šx=´œs¸ßÆG5ÃÖR­ñ¨£rçjüQµ»&ÁjÊD'óD›â/ nÑËs;ÚmnóBFßû° Õq`r¨{@A‰ôPüÈGŠñPþp{:†Žï»‹?‡¡ óçY\oLjk4?C;ä˜FˆËÖàg.)«Ú&a€Ò¥“Q°+çÒÿ¤û·—ú endstream endobj 1582 0 obj << /Type /XObject /Subtype /Image /Width 265 /Height 310 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 29244 /Filter /FlateDecode >> stream xÚì½e`Û¶.úçÞó~¼sî}ǶŸ³÷ÚKY ‰»w!8BœAâ Áâà$„qww·v­ªWÒRÝéX›Å!PE§»jÖœ%ó«9ƘcŒ‚  @€ @€6 @Ä}Á¾ƒ£Zá^‚–pm€¢%?ï %v^ È‰à.#ö]ðeãÓÕî!i?pÍ%$ð)Ø!JXÄ[°]x`ƒjqß×DºÓçþèX{màßøŽËˆ”±áé¡e6ºè•'#Osë6sanv‰Dáà×äß~PˆuJ¢ÿ.{einf~•‹¿µ¸Úèä•™©)*÷ó5à£bÑÈðARXœµ£È&MLLÏ-.³^ä;‹Nž™™!ÑØhqîòÜì´$ÌÌÌR,´B„Bð6“¾º¼47;o›_X%SwÅßù#ðQAm;mgœ~íb'Üm!úÌAÑ¢"“4}#ÀÙÊ-…Îàà('¬£úv´¥±Ñ£Åu¤Ñ'©ØcU ·HâúšG0îÀ@Q¡NT.’  ”ß´06¸×»(þãé ªúûœŽ—wω<:îpM¡•¥mzñ0Z–ráÈncSs=mQè™Ý¬î47;Ö•—åå|Ð@W[KKËÈÌú¸oXQI™ÃzÁÏyˆýG úDWÈQÇȼ'4{è‰Üß Þ¦ò¸ø‚©e ÿ)zËøej¬L†xZ©Ø\£ÒÙ¢’ïOYÆy%i©[óÂcÁ–áÚ7â…ˆL""¸ãi­ZŠ“_¼âžâ4E™íyís.ßpÔ_þ¾MNNáˆÜCØL¾²Lee÷úÑr¤SZòª¾7âc££ðˆ‰OjâÿLO•×Syy%[ÇcW®_»~ýzxH€­™Î)EßØBn´&úí'¤¹,ÆôÄØ܉ d@pO€Çé~ÞnÑ2< òPÒ£›GóÇv©ï¾! †XÝåYájòrwæywÍmJá „m"DÁQGRïY#JªM²âÓó<]UQ¶ C5Fb¾ùIÎPß@MÓ0£¤ Ðàö¿ÎVW׉¹Qƒìk£§¦gô–³þÀ=Ýåï`¢¨c‘ZT6<½Ê_ÍèkŒN¶ ò2Û¶nÝ!#«®kû ž ¢Ü¦Ïß¼äµïôÕ®·íLµ¶üôã6)YK»Û¥m|òÓï'†êk©ÈJKmÛ&eã|® 媚’üº£Æ•Ëé/{jïë+n÷ÏFôîõ©ñzEò] ϺXèïrn›ÈM¨e‹Ç·á òŠ w?c‹Å— úHËQý3 @[™8¶OWAÇHSÝ 4¶ ²ì¡÷ey«£çÜá†Ag´EÕc–+ìôå±7uûÄU&ýÖ—_¶«^Ê*îCÍh‹I§3YÀÍšC%MNL¬²0 QV« ¯ÉËÉÄ¿Á¨qó’û6½Mcó˜à0_ßJ46°©ìžoy¢½åŸý¨ÇS£JÒ/ÈIK¿“ë ¯)nßæŸ]‹˜|רáª:ú95C½-|´¶4ÕÎ!“£íå»U¶¸…ß[ @x³Ïd‡ˆ“-z ûÝCh„0õ?J [íƒ^ uDtè)wmé¡ÉHWA©Ñ6:'„ç‡Ûïßʾ|ÎçðUEóýu305¦Îß­nNg°Ú1{v$ÔÉFý°¬×¼Á¨Ë^+ƒ—½¬åt÷‡_ ¿€"<<<4ÈÏÊHYVÇ{~…¹Ô_èyPMAJ]×âÄÙ „Œ›oÛÙ¨ºŠŸé@U O¿yþ(9>:<,ø¸»£þNu)Ùø—£5 .¸Ê[»öN-òŒ·fyAV:ª; ËVÄå!¼WíÒpÝÉöò¿|¯fê”ÿ¨¤ª¢,ýFˆ…¾¦†ªÂ6­}.@8Š|bj0§û¯úˆ+zAc£Õ}7æ_7Ñÿá»ïåµÍ"SGWyÏìæW…6†Zæ&ÎÞi¨týÄÎROMSwïþýfÆÇC 2¢õÔöx½¨m(½÷´m¾·²ÐÓÎFYQQÏlÏù¸‚Élzk¯ÉÍÊé¥óž¹ä‰ŽØó>;Uå¶nÛ.-§ìxòBÓÀ$2W o£ÎæD…X¨où駟Ù¦cº'"µh™ÎÛ(âaµ-¼÷¸¹£ua6W–ÜV6¾À¶Å¢ÎÏÍ-­Mx'^@ü.LO OΠîº"þ‹sÈñ Î/Sñý µPA,ROsuQáÝWojçHˆ ?ÕÛt¿ènM2‰ÀbÐ(T:—Fÿe³˜T*•Ãå +ãÐçgg–ÉøË¢Ó ¸ßx_¯5^ÎÔ$»!jªåmbÓH3S“ãã³óKž³íAâÅâ¶E‚Ÿ˜ ø‹ªá:v§³$ñh]§C‘uë<ÅW d \ÇÃ|£M¨›¬Ð;%KóX Ç=6ÉŽ­ƒï„,EN=Ú5a’=Eƒ6:~€¨>éÀ¿'Ôå±CzÛÍœ×öw7·hxˆó$í8¸Ž%!‡O6h‹¤Ø&PÒóVä;®!1‡t±ãY—oA¬uñB¸Ø^É‘.ë€ë<¸ÄAôÛÿ°h+EÙ $NN­í 8ÇW±; ŠiÈŸ„é¾ ½sß+Ð÷ó{pa´`‰ŽúéÈÞl›Í!žNŸ×¸¾éˆýeHSµ1‘@âòžwu½q‡ÏZ u…p¯¸Øo\4ćômÑ4 _Th³dY‘ ý—E \ǦJÐP?¨sãÃîÖS‚7û¨KhÈ_,5xÏÅWOoG_¹œU1 ‚ËŽnÔôª0*:6ën)x_i ß{{ªcãâ;Р¤/©û€¢šA/PÝ õq1ûæ/ÿþW5/4U ÛL=f¸í/û^ÙÚw…#¤Þ¢ºÆÐ*ROÑ¥o¾ý.¯e7´‚﯄€ëdÐ|ß([ H ‘u ¤Ú×·‹çâ°YãÃãS‹DŠÁ/ÏøA =u@^AYzË–ˆRäÙàTfWªÂö *Æa$®¨† B: pí¿þ'Ñr Šw;¦ñB^‘8³°&a”„$e¸‘Ml5Î?IL ›ÅÃ(!±H!A9Án”Õ©sn‡ÎEÞá@¬;¾PÏßgkco¤£²Çí2[´Ïåº[Èkï;án¢½/˜Äª ¢,6еjÈ+ˆPCtÎà'©A‰ £ðók€¤Ùwñüg¥Âd§ê¡Ð”¤³ª»ƒHüÀ¦“†ûZó’cnÄ&—Õ¶“¨tóaBSÖÐI -Õ/ân\Ïøbt‰ÑûXH ´·”•…Öʧ±×¯¥Ý|Ð?=Ç`q©rÈË CƒƒS $1J`[9læòÔà‹ûùׯ\IȼÓÙ?B¦ã© 2iäÑžÚô¸ñ©¹õ]ÃTàçç`ÒW»+Ó¢â3nuŽÑ˜là©Vlm¼»1/-îFBúÛ®¾2C@Í•…©á‰6›>Ú×y3-&6­ ©gŒÁDœ›¸ä™–¦F×]†Î'o ŽLRè,IL lnjœu³Üã—;ùäòv)õÔâfÁã·þV¼º²J^Eª¯‘2ŸÔéž~Žßÿ÷7Z&–¶V&ÒÛ~6³?Sß7…fxgúkOÙû÷ôL-u•d \ 8¦¤¬Ê5 No]±³…Ú÷Û¬m÷ë(mùY>4ñÞ<™…1¡0öôüë¿[ú¥Cüì‚üº —E{]«.»]A]o÷Þ½¦ºªÿõÍÏa‰3Tž‚ÀX¾zêÀwûÉÐÒÖÜPgë9„‰%Ä‘:ÓsñÄA©Ÿ60³1×WÿöGi﫹+ „’äù‘Ä·í[·êYÚZüø×o¬]ëûyIþ{þ®í’vÕ_nËOºfVúêòßÿ$}æjÞ<¢—ÿ(¥¨ CEANm_yÃ0¡l|Ôp·´ôˆaC‹Þ?Lcaë¹äÄ0eÃzüq]•ÝAdø¶³“Bܶm•»r·’D&“IË¥…Z NGÏ“˜\úÒ%/›rZIª—É*måYÂ)E99%5-Œsƒ »wªY{Ôt’H䥹ɂ(YiÕø»•L„w`GÍÓ àœâ5xÍòX‡³Á/¶'®÷M.ÀuSVgò춫èæ½éÅ Ý Ü·EJ7»´L¡—¦oF“ÚºíR~¬0%žÙ+-«WTC¢3¨ä¥¢ǾýëöÔêAˆK+J8'£¨}ëåü2‰B&wVÞ1ݶË=ldQ nÅøkª«ÈiØ·ŽRÉp­C‰A®R;äcî½e3©cƒíð¨áz6qŽLc±9 Dè_5¬¬Ü¯®0¡¦<Ïmê»)…2Ûçi¥nw½V£Ž!Ô€Ÿ¿³½UŒ4lN§âögÞð•Õ²n^\¬6–ÿÖ>ô¾úWSiEõ¢Ž¸×¼¹› ®¼ó^ݸ`+—2}î°ñÞSW¦WÐZ•þ_J½r¡¼G˜ ‘]þ½œ^êd˜ƒ&iÉȺ+ØJl =á’ýœ:T¢¯¸Ýædº ³&‡4loyº°™½:~ÔFûˆ">ãm^€¼ºáýš~”~2Ûv\}Ô.ØÊšm;l©mãyi™Î¥‘¦î6:˜ šÆL «‹döâh‰¢Ôµ§Èsx æ¦ººåËÁˆ¹uLOeO0‚úÊ Ôä®=îpJswiš‚’΃¦©ªÔÿµ5»u¹äÖf‡ÉÈ)uÎ@ ãVŒ²î¢§¯ëyh¨«)=wl¯®íÉ©•µ†`AŠ)Aà‡Aèn¨¯}v¿ÀÇÑBQÛ$õ)BîÌPyUíìWmBC—±87µ@e·ß¾ª°õç •üð%ô +³ã‹Ô¹ÁZ Mécaé MMüCªq¬zÒÝ„Q§eåÌZæ(8k+ÖÛNÕÒyt‰J]™„©áɘÓn|‘Ô 1Ù”…'ãÝ^×àaãîeoK·ÐOöâ|=e™ÔÚsEûïPã EÍܪўW‘?üEµ|l?×0ðà†¬¼B 5÷Êi5Ue3 k¬ ôwÚñ@³Ü¬5ÞòI,zcI¶Ë~KM--SË]Ž®Ç}-+kÞ¾¸Š›7ä&žpT6?<¼(>jó_쨱ʀûÌdõ C}Ÿ3>-,ï–·"º%FÝÁ°®1Ý[¾ÇXÃÎ?›Íáòdk.óaÔ9y-ËÚùåÑ&åo÷œ½hç=ÌøºPróª²Ö¾êŽ)¾ä²i«Õ%÷ŸW6S™‘LÈø¨RDŠ¡”^·ÞnèÖ:´ lVÞ\øQžG  9CUAÙ/þ1 ùg*öìܪpèòTC¡®â¶½çžÕÒàaÿƒU:Ę8l¥}êâmW 3ÝÕ7ïÜž%ñtÛ¢^ Ž\hsÙ­gå¶HeQ–'Pjdqˆy/¸ÙðA_W ·+ « øyJ§Žú0øYJÚüàñ¶140œ¹|ÝKGiW b¡bÎÇœ=²CA+ö^ÍÊê iu©­²ÈVOi¯w$,zÌÕë>eäÕ.e?Ÿ˜[^šÈ¿~FUAV^E½°JÆÛ+ìM4-]CZ†§—WV–æg^ä]“ÛºÕ/ö.…<ÑûÛ*S’SžÔt -S˜Ä¢¼º¶WÚÀ©¦ u88äåÉ+9-ž®Y”»Ù ‹Üíd2‰²:w?%BCA)<ï Ì„Ð#fŠªz/Û( •¶|?9Pê'¹„ªˆMɾxLEË4«¸a~‰´²²:ÞñÆ^_NÉؾeœ‚Y¨àãW7¶{Õ6F‚Ïvz8íâ 9…Èür6’—'rúæ½G·³Ý8ìê !+kòJÇ02”'šŽ4QRQ75·´¶0QUQÝïqax™öXé{}d±²²ª™•¥©¾²¢ŠÓ¹Ø¬Q‹#Mç\÷¨©¨˜XZ[Zjk¨Ú8U ð ÂQ§Õtöœrݯ¥­knf®·SKAIÕÙ/z‚ŒLðQ–§¼÷èÚ)xøzz~•˜×ø’¨&œa/ÎMÏÌ/ 2±™äñѱE2Ë×ÊüÔÄ æD‡€±0öôNöå ¡!¡’²ïôŒñ^ȇ øÌ¥ñï$&Ä¥dÔ÷ƒgb|œÌä’ ·×d&D…†‡G\¿û¬|Ê(߃íÕi)©ÏÞvã&4xú—Íhzuë´‡Ó®]6.ÇòKèÜ•ìOëýι1b’f‡îå¥\ ¿œ]ø|†‚d5Ál[Ô™Þ;ÙÉð!‡…Gä=x…6Ê“hÈéd]F·%eÝꙌX×OÈi{N.ΖÞË… œ,xXº@GžðÅâ°èewî2Ñ3w«mŸ ¨ñ¥QCrŒ÷*°¶ä}cƒÍ|-×4®}72‚ÑH°¦La &Ùs³³4DO6>°Ú$¨ ¦†¬¦óÄ2SÒ¾¼álvbxx|†!P}IÔÀG4IÈŒ ÕKpŸ*®›@‡ˆv$H˜Á`!þuô¸+¯$ÇEAÞd|7‡Äs׬óæïµ~ÂwBŒ·rZ.c‹Ô5»JÍ"‚6¾05\O=Æ/ˆçš)/º„ÖÖŠß"ÖìÚ×Ћý©rÄƒê œ[!ÎUxíë%|Y?¶C`¨Â¾ä\výQîÐJ ï,šæy„ ðå>7øÇû[K+0Ã2¡I °F:"\ U@凸.J¢*B°ƒ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @€ @à+öNxÑUÄ+° Ä1v€‚W¼ @°û€Íb2˜, ¸A€ ( ü¥þyQAI%Í%® ‚ `Œ Œúì7õ¸’Mbrˆ C€ m•‘ÞûmL·ÿ¸õhT>A @”/nÙkãxØAKNáè<‚fÀÿ¡AŠá´ëhd:A rðup€±lgáy%ƒ ‚ $´Ó‚Œ…˜‘5%Ê?N ñYCÜoŒ„Ÿ"%AP8Ñâ6ò¶àŠa31üš@¡õYò€â-â7 ¾‹)_Iì¯hëÂDÎWBëþYDL}ÔÐ7! =Ä—þåmE >•€(¡?®=×aq-âvowp è¡‚½ßë|×숫œÀ×1j ¶.@ð {øÂ9vàâJbS+®‚îÈß —Ämm«×"® ä—°Ù&r4 hóhAPøcMëàú­ãNÀÏâ­¼Ø,”…Ô°·<ÊWÃ?ô¢¥™Ï üNûWOÓ5¬ÕŠ1A—æ–‘m”ù´¨+±´xÛÛ’óAwÊÛ°¶{ªóÏ^ižF-Ô'ùWünL 5/Œ´DG†Å¤=`"¿¸½o‚BKë;9HQÖ›‡)¾¾ç›—Q:Ó‡3ã.]ˆL[àÂ\™Ž¹ûè5‹mzs?( èIm?Vë̘ ðèáUÜw§;ŠNû†×ôŽ£CyRpÃçTøZnyª7éÆ…˜´"“ _“åÉú ÿ GošPVù£ ß“u‹läcê^æ•óWÒ¦(t¸=ÚêtÒ• ¤¼'T´žæŠ‡ÁE•=„4µéØS#è ™Gb¼ýO6tJòeÏoþóïéÝ+ÈútŠ¿áO Ö•}H—£-î×ÿYÝÄ}-ÿ0ûŠôÏ?xÇ=BŸÏ¤—YnùAó~mò æ.ŸwSÿö;Ý´äPý=}õ&ûüPN±[_'ýðݶè‚bR”–¼û¿þ,U4vNÒ[;%µýØ)àÔ@±âw®Aq+lD†)LôßòýO¡¹h­ÃÞF?ɽ¡B §»øôïþ,ŸU†6,†zêýåwruh¹ñβ]zÒÆûNÏÂÇÛoþôÍÁ‰…(©qA‡þë?~ÈAYKéðuÐÜ¡¾·canoeºÇFý‡]®¡Øù&oýá{ŸÔ—Ÿ5pª¸I ‚¿åˆŒ Ú@§Qi &*€¿æ"ƒ‹I'“),ø¡J*,•B¥±¹\x+€Ôÿ¢£’âÊH¡P,6Ö8›E§P¨,ü|G& ÿä¢Û¸\6J¡Ñ*Æp8,xG›ÍW"-R(lÓ8ð)Àmðv8ð/:rFèÁ0ðŽLÚ©A.> ƒnã²d2Ò:Z ² > Z ÀE*¡Ñ˜ˆÈå°ÑÃfaÚ “A£ 狵ïH¥Ré\ôú> :º#„œ ;ßÏlÔÀ[ÀMûhÅ>?fÕ ýì×Ä|€G×a½Øž (ºuÍQmP­»¸Ñéï(®SôÃÎü¬ú•¨Up³²ã㟞¸¿¿¦Âx»ÙŒ·Øqb„…Å…ù¹Ùùù¹M¶ÌÍ.,,ò­&„G࣑ÑíàÕëʽNÇOÝð:±¹–Á78y566@]ár¹ñi¹vç33Úi±UKqÕ›f‰­^Jk'»†ed¤&¼ ðÑS#.5ÇñbAN/”X%5lš>Ú¬ÈãRnZrüo dˆiºbSÖa„ÿ¨Pã&L ¸¿%7nšecjüÊAD ØŠÌE‹+üD‚›‚éÉ ‡8Û$êÃ’—g;[^—•½ml›˜] ž¯…¨s.‚Ÿ#5ÜóãcnÀ'B"‘Èd2üI§Ó17ž_G¾K0Õ[éô°Í>;¯ãÇìöZïw>qëe+È#!PÔø¬©‘Ó9§:Ù|üøInnn^^^vvö“'O˜Læ?(P±¨ËW\Œµ­<­n™˜šêë¨ôÚ§§e´¯´s•Pù jl jØ$êj_ºt)ÅÙ³g#""¨Tꯦ°ñ`qô•¦´BdÞÁ¦¹Š…ó@‚565“ôu#"#ƒ‚‚BBBÎ;wåÊŒ¿^ ‚©Ñó`ÏAÇgMãèT<ë~¬¡,˜tµd ¨±é¨ñëG ÄAËa³Q•£;;ÔCQQ%¿rš4j|•Ô@>E"ƒ¸ì•™þë>.ªŠòΑÅ?‰è95¾*j@|¿V¬ó“æFæÆï7×7¶>p=÷ßvûS~„{áæŒ '¨±5–F›Î¹ïÓ7µ¹”˜×5¶ÈçÅ8ùŠôMP,¸+-d ½Î×Ɔ §A‘hÞ\ˆÑèø’bÑÙ hl8(ÒÜF±á‚ÈvñÖA‰Üâ%l;_HØ21j|ÖºBLúÒ]æ‡NTuŽ°%ÅJ¼ç]DÕ’Ì|¨´h ø±M”Kâ1ÝàºAå"ÑÙ h¥âáç¢1ÞbunÜ:(ù|!ÑöÖ´Ž/ùù‰©5Ä;3ú\h½©¢ª™W9¸¶À9À£¹óSÃÍM­ t4ºœËšïmëè#3XðF€ÃìníêAãÜÀå…©öÖ–ÑÙLÏYnníZB£ª!39ÜÕÒÚCÃÎ)K=]m½ƒhì@[mmm›^XA»wn¢¿¹¹}™‰åR{;Ú»™(±Y rogëðÄ,ñ_šomi\$£ÇËêií襰¸pô•±¦æŽyz1‘Ö{šš:±+Ë¢‘ú»Û{ÇYH¬"Ȥ.´µ´NÌ.¼Ö›šÚ(¹¸ôñÁ®ö®‰ æ°hý]­ýÓXŠ¥Ù‰¶––ñ9ÒghÜ ¨!q਌;õ·¿ý}‡´´Ò2raiÞßrË¿×äØ`Çû§OèXBVÒ¦b¼Õþ´EÿuÏ(ü“¶Ðo®üiM‡´èÝ´óßþùn×î¡$$'ÙýËïenWu Œ³tÎNê?þ Øˆ–¨¹­"õ7MóXlxóËè?üç_#²£±áÔè3&ÿçÿýææ Ù¸Ze£õË÷;,ØHløD_µú–ßô¹ºŒ‡ÑÞúÝŸü2JÑZÝlÕÿô½ZÕ4ÞùÐóÿù¿?¦” >ÿà‚Ÿ£ò¿üÓ5h¹Ñ¶†Êß©›!ÓáómÉúÓ¿ýÑ7º‹ ¿îcýþ÷ï3†èÙ·³•ýFʼu~Dò-tHÿÞèÐYì|ó£}þû÷8ÿL¢HPã³¢†±ö·Ew‹îß/x´ôŽ~xe쾎º{wî ¬0ѧ/½¿ùÕÃgå³èÓ˜Ã$U¾|TRV‹¦'†ºž<|ØÀKâÁž¨½û dl~•ó˜mµÏïݹ„ñmqüÕóÇ¥•Íèp,Ïô?xð¸gxMÂîo­(ºûxŒŠeø˜¯*+~ò¼’‚ÈH 4_ZüàmK/5Æúš>xØ:4‹ÕÚP]úðÉ«yx€Õ‰Æ;wŸN£ ‚Œ¶ºWE…O±.M]™)ù¤´¢‘ŽŽÔå‘÷¶ö¢ã§·¥ªèÎý! JöJSuÉãçËè(É¢­”?𦶲`´¯õуMýÓ„…jSPcã‡×‡ÉÄ¢ ) ®ˆÔ¾Žrm„DÔ‘EíIø÷G‰'{ ìEµñö%ˆµ.æ¾/Þº¨¦‰ªSø+CPcST’»?(1˜ã½Ì¶ ¸Ñg$qäÙ(ö Z›DE˜5R"¹oãmªÂ¸Ž·â¹ ÅHι(.q¾«uèƒ.*AÿYŠ‚Ô @€ qg Ôø¨Ôä9úM¬Íš>é5¾FÏ[gÉ”lˆ?ؽA/Çx‹½ ‚;71T_SñêUi}KûÔü*$ô¼%xAP㫨x™v¸ÜÎ×7]î9àè|â„×>ë#ÇνèDÞˆlîüÙjüz þ¤®z˜hîó mꜙé¬*Ü¥©df0 ¦¾nÔøgÃg2·KÉg½î¬Ï ݯ ®[<á_JB€ ÆWd¼E;>y¢½ðîýáEŠ`uœ·™œ¦EúP/*5¾ ÷Bá‹G:ê ÒS#¼ôtÍ“µâä)‚_35@Áš¤0¹ýl¬A Hì´X1øSd÷M%PñƒÎÀò[ fêšjJº»O´N-r%xüøº¨ÁïÌ Òñ•Mp ²Ü`”p_xƒN. $!ïþǨïø6“²ºØY÷Æ÷ÐÎljÇéЇڧˆ´ _\Ú^¯n‚RšøꕘŠ¥Øjjró;:<¶>±H¬¥ÇÖPëy%“ÞÁ” 0ûÞM¥O1å7=ÔUÛÐAcr›¦^e¨ÊËDd•ŠßÌ÷à® 'Ò&¬áÇæ‰òÃx‘T³xöFúÁ£¾{ÝNð öŠ­ˆ©E×c¸AØçEFŠzvDn¡]`î¤Ã'‰3Nl¼À¨$Õsñ¤KZS9ž5¿Ý¼ŒêŒPÓ]Ní³dÁª…ª|e9Åk™Ï%w½õ«[Kô)Ó&@l”¸à#¥MXï|uŸhº…M•6í„)õŒÓaç öùyæ—ZrúzŽ­¥cÄ«‘’pæ BB p¯Þ«>ó:æ­kÄ…(l¯”f(¾là°×Õ°—³)M"2U¿Z±Ñä7¨à1¢!Gz‡|taµ`}¼÷.9í»-¬¨°43õµs4$Vä²fF;[»WéHÌ+—MïëhjëÄ^¼47ÑÜÔ84½ŒîÌY™¬ol_$¡™öø`[}CmœA^êhkêìÅÒ&PWg›&ç–±´ 3c=uu-‹L,q¹¯«µ¹½— ogfÒÉ]­ ýcSXÚ„…é‘ƆÆ1t®®u¸¿³±¥‹Œ¦M -À•Ì® f:n½£¶¶³Ù1i«=íͽ#XÚu©dz;ßé±ÞºÚÆy^ÚÚH_[s[//m“ÖÝÞØ=0†¦ƒ 3cM #hšˆÍB L¼‰{=`mm4» U4àþÌ MN6ßs2¢œ‰ ‰ <Õù^ÏÀ`¦ U=7¡Ž› HÏOB~r’P%©De' ¡–—Dd¶(¦¸ÉDo¿ïãIqš Ä:\CÒ::Ëo"PñÙÁ¦SRýívÈ(»ž ‰‹½îd¥%¥¤–RúA¦[\Ú‡ý_ÿ†K› úÇŸôÊzÆàŸÔ…~s¥?KiØc1×E©aÿÓïÝ®¡ORRqÒ¡þ½ÌíJ^Úøˆþý Ø› ÞÞVÙñ7 ³ãXÚ„¦—Ñ¿ÿÏ¿FdñÒ&D1ù—þæ/mB¥µæÏßm7ïǧM8ÃK›uâÿùdzé´ üN•Ÿ6ÁãŸþïÉ‚´ Jÿü¿¿Çcm/ •¾U3ó˜!Ó°´ ü×?øDñÓ&œ±ú—ÿõŸéCh¼;¹ÕËVæo;Ìøi:õ¥~otÈ;ß‚è3ùÝï¼â6UÚ´sÆ—ïÞ½{—ß­+¯“[¡Œ(ñ-åʳñÔvÈë¨ÙN¯—™ <¾„ç›Ûyߨ\Ü»Oßødž­¥º¾KqDNŒÎnÿ+•Pz+óTè=cm}c£ÝÇüïN¥u@Áq©Fæ–:&:;õ¬Od\/[8vú¤š²’Þ.÷sw'’jœÝhééìÜ©cîâS0Ì'à'H¶ÃÓ9LÒÛEçýO¹¸z^ŠI¯íožù0u‘=ÜÛRü¤xdM›À¥wT–”¾]€;’6\WùâMU3ÓhFûJ_Oí„®$ûʪ‰¬‚R۸ǽ[OŒ«c‹™‹«QC`¼]Çx%ŒÈ~_eCLÖÿ•i‘¥MEr!¬I\ <ÙH›€? @ô°Áu[ß(m¸yÓ& ª4* µC©õËçâò¹263QU×±•Ò „©q†G‹05Ü`jØ9Ûš{ÞOë†k`]HŽ1rˆLlã:ìß³?´™àÚâkVBsª¢ª9Éõ̸ʙ«ÏFà «¬õÕÜs“^·™êò{:’‚“›ø–U6qåù°›«ƒÅñ¸ØZvrƒˆò›Œby@Q;ã‡lˆ›¨ð½éפMß'm(±o„´ Ðzi„uë¾$ô3H› 1!Æn$P5B±¯§Ï?L¨Ò;¡Ìn(©–ìyÙÐÜî|1å¤Ï!Ÿ705àñåÒí×»\Qj8YYú·d´#Z BÃWëgvÛÚ8]­On†¹&6BimPòÛ¥31–\ô>³ßèdyÞ³æbfžé¿èêe;'k˳Bj8F$´AÎö6»Î>ÈèAJ&U žºqï\Tªž¹£OîÛèÚÍ ÈÑDÞ54¹¼ÕTß> d,grÝk¨ëtýjùLötá«“‰ñõœO£kø²©JžE•ðÌ“L Ô‹‘jæÝjbµÇÈÚÞñjÝÙð“†ûC.?r?uFßÊé\ÑTü«æÝ»máÊ­&žKÌ66ßë‘ДÔÄ›m!¨ñ<Þ…ìøˆ2,2Ã`œ »ºóÀ© °ð¹Ùi1)ë=gÃQv‰ `j+;ñ--º|%¶†™ÚÆIi@ý@a‰‹óf5¡ž•Ú ¤´ ÙpÉÔdd:£‰›ÖÆAç; xkâ[zôJr3'™õ€÷åÄU‘âj©-°ÂŒ«¢&6IõŒ˜ 2¬ÚÀcVJ##æ )±ƒ¸©T‘ãj¹É˜…êŽâzèo©i€ Äì€kÌJï:p}Ã2Oe^3%I²`½óT׺¾H²ƒ½OÏ–\1„Ü?9pßN ,ðÍm<ävº¶ö-‹Åd¿Çy‹Žèšd†Žï¢ßù&,¾óÜÕÑù>Þw [‰ß‹§/4< ùåÅ&õr‰¯LÂñâ·¦Æz–¥OG œ»Ô'ªõŸ´ïÒ.×* ë¹£¼óq½naQ©ß¸°A+ðz2…’»èJLÒµ¸”´$GŧÙ:x…ÞëÏꆢ*ifîa!¡¡ âöùgÃR¨€¬q2ç;èâ>QZá)†“а2hB/wQ¿)0Y@C¼S–`ÇO1j🯼‘3Þ×V×9ÀýÍÞ‹Ì·–²{›«oä•Õ÷AÂéEdÓdoýÍ›w{'YèdßÌó‡·Ñפ ‘››{ûÞÓáiÌQb–zZkÞÌÎÎÎÉιû°¸µ{Âà ÚZ~r/ÿUÝ„Ày ûdÎ6åÜiBÖâzã¡~Cf'”XÀ½(orŠ¼ãèåßÔÜB!¯âÙú…2ë|Ï’àú;‚ï¬ö·4ÞŠ< W'Ú},ODr ßÐim“’~ì§oÿ[Ñèpó”àýÎÈ–Ò ÿ¿þ}[Ú+äÞuU*ü¨¢cîîá)€‡»ûéÀKõ=SwfzcÃNší9hïìãÈ=VzÆ6Á1Ël^SuEZÒÚuö%‹#rJË5¡þë×ïtCÈ›&ýÔÚªáêyô¨°)OWWϤ¼Ç˜_Wöu¯?ÿ÷÷Y•±Ë—düßßKeU!Ôhx–&ûózf{puxzx¸{œð«éÖ8à•Ý½}^—3r ìž¹ ¼@æìPñ: » (ìö¼˜s=.µ«½Epï‰(¿äæ“2/Søå;5—0Îo®|ÒnÅëéh*+É:›HÅM:V߉PVÓ¿U…xOöÕí5Ñ¿”øp…B£Ó„ Ó¤'’®³•SÔ½õtlv‰Šl¡ÎŽõæÇù«H˹Pˆ55ÒR¼ÛHÁír%[”«Qò*Z©OàïôÕé°£»ŸŒ™‡ë¦ã›¢1YlÔ´ÜM RPÒ,¬¿à·®Ù+i6 …ÚÊ ô´tSïÖPi¢ Ó9¨wâz·¦†{XRr3„Éöi×.©-Pì[VðO¿‹½==Õ/@]8Õ÷£÷Z˜Ùè«êx†jDÓÒµHμ!'­”ú¼Sp(“E›ô°Ôv¿À$Du~tj¨i6Óäá7ÖjÒv K¨QwÀTÇÑãlZZéé™yM“PÏó}†jÏgƒk ^ˆ^=æºÏÈì ×šh{75h«ÓOØ[¹$gdf›JKÍÊ«é˜@w{?j”jkyù†gàW“{çñÔ}½P{xegW·õ‘3'“^z'”ð–ø’ãqÅÇc‹‘Ï_µ‹}v.¯.½ƒÇŽ¬^ÈÌý¼‰™µ÷ñcááá~~~/^,--e±X5Ö> á\ýAü9‹ÝG‡épš½än¡íÎý­m¸|j4 þêÏÓC”•´S +jÜÁQ£¿ÞÞ\]IUS_=#«ŒÂJÓ3›ªÇ¢ ÝWdÚaÁÛÁÒÈÖ½gšh/R\3‘§m¤¥”ô pMéêÛÄa/Û¥¸5n™éªihêàX_w§Ž¥WóÈòÔ`0îߎŠŠ‹A—Ø«W"ÍÌL ôŒ åbh  apþáPZtõåìÛíí……… †píÚµ•••¸”l‚¢W¨·úŽ‘†Zê³XûdL÷„9›i»†,¯.¯’iÀ‡Rã}Ó&ˆQdRFMÍìO.qßF⪽F;"³»ûú\¦r€Îg{ Ôí/ðG ±0Z΄Û>cóß‘Q梆ãcÃŪóGmö»…· àšê^X¡­5p1ë⣆ž†Îõô'}øZúú†F&èLκ†Ä•QQQðƒýò¯Edd„­ƒçÉÔ*ÏkwÕ´õNŸ: ÁkàïïqùòésaG"ïÔ€pžæÉ>Ö?Ikº=æáááåvÄB_SÍÀÂë¨çµ´GtîûÊSkÒ&Hžé…™=ðÔ€;0ÝòÄFOóBîëò;WÄt™/%ÈèÜ{ 4wŸžcỳÉä=ÅÔ*=ÅýÇ®Ág0Ú‚PÃír–*<>JB”GB]ÃùlʺÆD /j ‰Í—ݹvHAÝàv½P×È{Ö¾ž-pc{¾ÀÂÂÜ“á§zð¯ÒI‚ƒMmèXÚïÝàœßÙа° t´áùÎ/m¹ûÛµ{5ðsoÍåÓÒ`q8%%5-3)ÚÁJOÝúPRZæ“Òøº†hµD²ÌˆŽÈC˜C»Ÿdd±ÿÌw1 Udê3G47ú«évˆô/òïÔ 6Ì5?=æu<÷IUîµ£[TÊoAtûéÎ7M5ì|Ò8B_>t÷Ì@Eõü·Ó"ªõMÏ3"å”b_Œð{9ïü®º›©hì,™„ªGà{{Š¬°¸¸°Ìò«€uy¯c'Ü\]B‚ƒxDà À_àîtÎßÏö€“ëU‚"ýàr8lÔçî¼ÔIX×Øéq‰¸ôäð†M«NöÕTÕLS±´ Ì©¡¶ÚÆŽòêl.›ÞÕRÛÔÖƱÒnFS×2jĨî¼<ÒvÒ~—ššŠ¢ºÁ-@ebp¦Äó‚?ô/yXH+hDÝ«ã#'Â[G[[IZÚ+¹Œ·Ž9ìµ_^Ýøaµ0¯ï|g™ƒ©†¦Õñ±öÂÔ8º ¦™‹Š‚7e<ðL_CQßÊ£sIxMï]×”ßjâšÆ³'Õ¦^ÆÃFîÚZ>0 5.\¸ßå Áè0!¾’ÏLÝ€›¸YPxøò-‚½ãÐ;°O}û?6}PòBAÚ„˜`ûÿïý+/m}2Æ[åHÚ„QM›`¦ôg)u;Ô‰‡šîµå…·$*þ@Zž¥hËmûûO²™¥$d6¼»R_I68úƒ#9’µ4yÖ]iÛC[ÿ€³'=õ4”ÕõŒ´µuO^JžÅ‚Ë[®¯“Õ–Ÿ·Zr  :áj¯,'»ÓÌþqíö ­L;ëüõ¯[Ô444Ô…PVR´u ê™b` w=NÚe ¶m‡Œƒçéà svÖ†¿ü"{À= Íš€4ÕôoÓ3s,‚5¾b ¥ÐYœm $¥¥³Sw'mcËý¿nzƒA/A ѹ8vqúEm›Ì›w‹ ïÜ—ÛE÷ž,¾ËàO€ ÆËûp(9×Ü,Ý#†¡èE€ ÆW¥†#Q~´¥˜“Æ.—²á5L&ƒÅÆ"ü/È Æ ‚_¡ç-ÂÆÊl •òGç}¦Ò;~‘S7º”rw–Îg1hÔøJÕphe¶Ëôçïä v%<¬¬|“sÝGfëöÝžç§=ƒ ÆׇŠ¶:’šÚ<8/Xÿ$ÚSV^5±°ùƒÉñ¾±á"Ó±øûëE]vEüú á›™xÞ˜_”ø¼¥x‹øÍ’T)_Pìlp;ˆ´.Á·Pø'±óÅ¿”Š Æg;¯¾jí×èí-ÖP’;—ËíïÉ5Yš%ņã_c/p —˜ —žßéÅ_j¿žù`íKíq^¾ø<$’Ü'ø>Š–ˆ¶Jäß(Ú$l™5>÷Œ"K£½u­LûÆV¾ÔTVðÍç~Èómƒt ±Eì˜kºèÚ:×IÐ ¶ xg‹ë(¸Q{àç ½×ù~~s©5 rzΖ´y–Ä:(»²H22Јøx)ÚÐ>?ú:YKßêiÓ˜`ËÛÌ 9™øgC$PñÂ$›ÍxñC öÊ€¿ ýÅüb³Ù\xØÂmx{"¿ØA€Ãas¹Âá6¡ëX¥Â‘ö¹üZ¤=ÞŽÚ"² âz¨¿uä`ø• ›­sÑZø9}à3äà[¶ÿB‹¸‘Öüù E¶Ï‡ðQƦd»F=¼; e÷A9ýÈ’;å"ùÕ?ëeº¿¹^*0ÔÕŽü¸Æ[¢Ízɨš~ü¶—F]zšvQOMÆÈñ‹“îßW¢¢ÞJÑVÒ)D#ó·®;ìòlAÒm0–ÇN:ï;Œ¥ð,½Ÿjn¤1}Á=@©. R×?ð¢uõ%ÅíÛ©k×…–oá¸Ïôˆ÷5z{j ôuM³W°‘¢Œ›QÇ5ÔÌKfÐpvrëW[˽'Ç9ðуs£­GvéFç’Є$Ï ®èÄ>@3@} ,ZèÈ|sYIݺè-Ú ¸ê ®hÕ†–›é¯=ê`qÄ;b‘Æ€Osª÷±¶~LA1:¤Òó¢Ok(ê=œD“ôPû#}˜íóî[FBkIóƒG÷ëyÆbçûüf”±¾^äíêÏm eJËÊW4´u¸nwú¢ýé‹vg.Ûz™;ù˜;ûšùxw'k·s–.~æG|þ¡ª$/>»ŽîP5°¶²ŒˆˆøˆÉvЗm½oC½tµ””” Ìlü.§Ï0ØÛí{鼿ô'7cÚz6†$­™KO3ü†tL :>ƒ4uÑ÷ð ÿèU´hÍ‹Ûn‡“Ö ûÓšžGíu8YÕ=†Rƒ’å}ÈþÌZrº¯Ê÷„‹x¥ÆPëc{ç{e h²tÆã¬óûö¸VΣŠµ;✗ۉði.BÅÉÿ£v׳PPjTûW³X–”‘ÔÈ“.'‡W‘¬Òä¥ñoûШZOÅã¬#öö©Ïš>+QŠ—#¨jc}}sccsSCsScKSclLôaGç#NÿðrØÅùˆËG¨gÅéð'§ððpŒ'4(L™Æe3çg¦FFÇæ—V¹Ðº¹ï¼Ð°$Â`09ü c›Åd²¸Ø;W@ùÁbc¤„… &“Éæðt.‡Å€Kr1ù à°²X9üPƒ±XLk‡ÅxGL0CZd³‘±Œ€4Èd *xGL0C[d#Û¸Xâ¸$Ú&PqáJ˜°\8\> .–µÀZç×Éåb‡Ío…ž/v9áÃfb‡&‚àÂÃb‹¶ÎáBŸÙ4êz7úyII@``è&–DK–ò‡†$W~p½ˆÑ÷ÓÃÅUVQSl¬´âK멾ü×ðï5%ÅZĩḼ ë¿ÈŒWnƒ:qÇòþ­Àç%MA’BÑáïÏž=Ãroà³Ï}¬y ‰Ç$f÷\7mº 6~Ñ&¸&±ÂýM’ ù •¢õ¬M!(^p½:%½°sýÖ%_ûχøŸ05à>†OºnšDøSly×^¿)ðÔ &­ |tëþýû§N:{ö¬ïúðóó;$¶„…"y}ÿ'ðéÓ§a‹B¡¼ ð[Œ#)))éë#3331!Áãèñc'ý½¼}½¼Ï c'/„‡gffl°;ú“ßIII?†5;‚~‹QƒÍf“7NïéhÛã–Ü0óf*¦‚·ÄUÍúç5¦eåÃÖÛ—‚‚üÛ€D"a¼ø©!æõ´ž.Bàk£Æûô€Þ®½Ç/fv£oÕlä-)-PPaOzÎÍÏdøûÕ6*HÄYIÌjKƒ ÉF]`°¥F˜X/ôkJi‚‚ît§gßüˆ}õÓž3pXL2i•L¥£žD>ïÆFÔ4j°9˜ˆ™Ëî¬ËI¼á{ÊûŒHÞƒWÓ«l"”‰À¯¤F3Lžø”LX›X]]±Šþáðæ^7ÁØÁw¯æŽµ½r´4ØuøDrVnÌ…“ªò GÃ2W Á<Á F»½^'}ïܾ}Å­[·rss'''7‡$Â{32È¡SNYÛù¯°°-w¯S×6}ÚI#Tq¿’E}¶û탃ƒùðóókkkÛ,B:ïE³ÊJ‘Õ‚õÚr_oß "¸Aà ÿ­hÈÓüýý1jl ‚¦ë3Ôt «{z+òs²nÝ}Ô6ˆøƒ—§üjjìF©!p&ÁSc³ ÿÁ9Å}‡lÕUUÌ­­•d¤•µ ϧWAB=œ¯‘]·/nûy«é¡Óݢam)ÄÑLQUãfÇëDÚ„Í™6 ÆZEÆÀã«RrªéÅH€ ÑÔ–Ûª òÁñ·ÄÞö>œX3B¤MØijHìÎ3íw”4nW{Õx™¦Š¼OLû«[®ñi qJàÙ½G=à$.Xï š˜6øRÒ&ÔX3p GJ[p6”÷Ž~$Xß”¦  ýVô!&*ìŽ#Q~L¦ ÿ‡ƒÈ ²  1AN^Ô?ÝòãåI@Bâxï1@â옼p9¤$ÀDù¼ð@&€kB‘‡è!Q~èf.—îˆB-*ˆòC6ñ“6°Ù,~°/TÅæêd2laëØù Zg¡­ó%¢ü°Ô xG.~A³E_45 Í™aŠ²* ÷¦æçJó¯ék(ÚžA3|H>ä I› ¨S8ÀO›pÍIßÆ£adþI_õv0Ú$xÝ£ô~ª…¡Þż2ä@©¾¨®'H›°´Og§]7ZI›°×ôˆ÷UAÚ½&Y+÷uCô›ÑÇÔUÍxi(-g\vYðÓ&ÌŽ¶±Ñ ˆÂÒ&€ü´ X­ábiÔ¬øi–ãBìÕ-i¼,œøi¦{ëkëEߦMPWÐ}8‰N !iö›í=Ñ¿LÂÒ&xîÓ=ÊO›P\e¬§yç³K›@PcNž»›ry¯µ‰†šº¡¹ïù¸¾e^oÍ…^\ï¸Ï©K›ÀZz–äêÞ9‰¼·IžŠ p÷ ‰ÇÒÔ•y¹¹¤>©C÷§µ¼Œ³sö­éG©A.ˆ?ãtÄëœ}5>ž!‘YXÚ„áö§.G<–7¢i˜Ïr/ÙÛ­Z@Ó&Ðz®…œˆtýÞƒ‡wî?yö²,.6öÐÙØŒñxð‡Ãzæ»Ø9rtvpöôA€{÷îYñ‹«e¥òØÁ[ëÀÌ.È#æ©ÚN£Ó'½±¬››Ž*N`=[ ö½¶¦ÆÈÖéRñtj „ ‰õ@Þä–½SÏ08(0„³!FϹk ´Ø *Ö€‹{ ÎÏÎì:èöÿ·wžQ$kßÿGžÏóâyqŸ=gϺÇUQÌ®€¢(ˆJQ’AHFr6`$K@rÎ0äÉ©»ŸNÓÓ3̸àîÞ»Hýv?jOWWuÍÔÕúº¾õj˜ØÎ)±ѽ䮯wÜßߟÒR½DÓß¹i÷¶>þäÉúÖÔ?|pUWW‹D¢¿ÿ L#{ïý% }ƺ>Éå0µ‰*è5€66ï š “ÉLLL¼}û6ÕY B; ??¿ööv‰|ëRx+pEäËïïéZzŽ.ññQr§Ú"-‘âË£êÕôý¿AÿVÇNs![ÿ°EÇKyyyžžžD—N."##GFF~“2­Îqïk}´aͺ³0íËø–¡uÂÅÞ«çLb²ªˆH4UUßÄès}6ù_Á&È„ܳZ²ÕQ÷·ÞR];-Cݪ‚‚bÙbÑO«i9ðWZë"÷UTAõsŸ@"›G›ËïVZ`pΪebÚ|X?À&¨¨ï_‡M ¶UÙbU¶U.ÒÈoÎ`þúôµ®¶6''gnnN~ úJ†¿1ÐR{ökWQÓù¶^í™Ýw,ôìï'²xb¹!~Sï£ÂB¾Slü÷Ä&È­â•ÙŠÒ-]£T¡D[žèc¼.ÈÍÊ)¨iî¡ùäOÎcÍÕ~z—›Uô¶lh†ÄsWšª>æådSÊÍ/èGOöµÖ—çeáæ¾bôKÐO™hZÔ( ‹^½}÷þmqA&ªì¢“N·Õ´öM7T¼Ë%òÌÉ«lêd 1[&B`*Š ÈÂrr?TÔÏsDø‚*^ ·»õsa.z]QCÇ ˆì4¤KS£eoŠñ<³2³r>Õ·¯Š¨‡üm*´Ëè¯É?~èpÜÛZ½+ݼiˆÅB'çˆ|IQÀ€>_ "ž¥±ˆÏã‹Ä6AˆRqvbìH %° R‰=’±{R©=“8l?bz!ùp Šà´D€/”QÐÑ{“%B"–”¸7©Í“'–—.àñRÙnÈO §(HðÛ&§“b…Ò!‘^_¿L+‹ü3± ´a$Üñ!iÿŽLœÇ©T0T“njjvçA`ßMÏžu{”'‘í¼<Ýsÿº¥£[Hhˆ§‹ýù‹¶oÚ°Èåñ¶rkë+>¾á¸ÂÂ"£bªÛûÐ6noldûqT$ú±¯·û… —ókºEc5hʈˆÈÃcG¯y‡>~þld•#Mú^¹’ô¶ÌÖÒÂË?82""4È÷’ñÉ~q3l Q‹È˯¹GD`†úÙZš9Ý™^ÁvcGØÑn˜™]¼ä×âÜ™[é öý6&›ù†G>ŠŒ~p^_×#4ƒ‹|Û“ž„I…ÜühÏ݌˛ÇÜt7ýËQØ„ØG5´r‡IlBV„5ŽMÀH¡|ÖÄÍËúlïO…ñFzº/?á—cØ„ƒ:æ)lÂÝ Z2lÂDçÇ+f6®tl¯)oª lBf”Ë¡dØ;“Sf7)l‚ÍYm ›ð>#\Oûøã¢f<ש@O½S6í 86¡*x/…M€XOî[Ð0¦° ÎVF6®ÁrlÂQÝèL6!ÊýÐb›0êin`æ:°‚µµù§ ºtl œ?›@("b~¢¯­®‰“•™Y^ÍqžÉ(ÐÕÒM-ÿÂæ¡Ïî,#__coTÍzJÌe%x_¸|+¬w†% Y‹³Iµ¯Í ÈdË[sWߎÑ9<¸˜¾Uº0è¢öÕ”V<XÄe1ãÝ­Ý‚¦–yD¤3‹Ùe©}0¥…þj¼-h¡%ýÒ‚þ¦W–7ï5Oq0’Œ€3ÔÑtÝðཉjYœ Ë©!‚ Ñó-Åi'µu³ê†ÑSIw-Ž^®˜æòÑç{üK¥Õ‰ƒiõèÏV—ûÂÆÁ­{AŒæ‰>ZG™Z¿h¦3~Ï>°°ˆÏ)N ¾œ48ÿ´^ ›PZøÂáòµò)›°Ršîç|;¤w†À&0ùºx?Œ#0-•Eî.ÎIïð† ó¿|Šµs¾Û80…›77ÎûšãƒQ<åÜP£Ÿ·[@dº7±®ÎŽ®okÛ$øâÁ‡¬p;[·†%›0xÛÃû‘ ›0pÛéyÖ;.]ÿ>ÝÙézNU‘kòã€ëþ+6aª-劭gE'^ ÄÎ÷µ½|kO·8ÙöÀ# 2•%À° ‹ã5ÎÎÙêqӾˊ²³r®ž'° i1>nÞ‘86»2âã›CÔ·þCÖ '§Ô²Ž?s$%Ÿxò—Çm õË‘.¦ž Öð™GÌMc›{RÚoü)%(4³ =žîÈøU÷\y×<õkòÇaAÁ]LéTkÉÅ›~Ý“Ëë [h;¤¶“¿>µÇÙÙÝê™X%>à.ö^Ö9”Ú& ¯&å‡ÞÎì],ϼäö€ÁP#žîªd³‹Îøû4$è’Ad¾œO¾Ö^e¥$¡n„Û]°_ãxÉ€>*î-MØ»û×z>Ò^osÍ£ŸE%r?ñ“oR×·,(É'G(@L ßñDÃF&Ø#„†M‹åؘŽ@*bœ?@Ζ¤ô`E\HŒ0±\ÄÙ ½ûÈÀxrpvD1£ ôn$2lÆ[ÀkI”ˆÝ©XLr¨ …Òe·MLLðÒ%r•#1Pؼ¾ðºÒñÛ–ˆiÐ,SYúŸÖcP3üѦôc†v3\ñÇ$“+ž#L¯ØiïzR>‡È·VÁØØ»©¸6Âñ¤­ÏO¾ú„WûuÆߘ»tO­¬7 ´×¸–ÑM6)ÿU¬Ÿ¹ý½‘y>i =V¨i0øò¶ Í{zø£–Óñî¥%j³jf6=ÐäpÙ¼¦s ²0ˆ*n" ± ŸxéšyŽ-‰Ëb¼ŽÚøÒÖÔðr{-ôvº¦Ì}L³uòX“ÝÝBµîÏ;—Î+­ nþÿí¶¥r¥hýº‘º£¯OJ×Gsob]þ›JD6œð›ëû'¾¡’Ýr¦ëakÿì¡ZUlalò¾m ›ìßÞ-¤-Â2|œ8ÇËÆôæƒyùJDq!&:kíµÿýÏýøãÿú×è»öéd½EçÒ0£3®AÙ/SRR=üï ½˜¼OBÙÊÝ4ˆ³eFÆÝ'…è?%i2Ó ×€™#m×­/”}™D_Öß±cVúÿ?ÿñÃ>ÃÂÚ~ôó4ÇsžOè+øcÒÆäðUÿºÑÊ<“ÓgÂcS^¾|™ÿÈøàÎ3ŽA+ o€¶ç‹>Ú:§Vë_;oEĽyýº 9òâYýèœ*H4kutW\õ"¹„'\™lhlB’Š`ëÞ—7 NgkóøÂêdë;s7¿¾éåuë«‚0;c=S;\n·ïV¶Kh·¡`øE‘wsÐÆ·*˜fƒ3ƒv–ëú—‰^#Pa¯ˆã­mì6´ xå©c _Ö$2]´Ðßåš0q=½C¥Ök,öÙþªÞNšFéËÇ™µxK¾T¾2760>gjnnnzþÜy³K’KxbÒ[ ÌúLTa=5K`wUÙŸ=ž_+‚öÂX„çÕSgλzzy¹;›œ>í”´ÌÇV \îô³Tо¾íýÒ-ÛÞ]ù(粦&çĤ“1”—¬,0gWxè¡TÌŸí-ÿ¶øÍF÷0›/‚)g æ,3õU¯‹‹K«ê§°×Aغ¢¿Àœž˜Ÿ ý×ÂòzÕÊÜÌšVã×$•çgfˆ×ÜØœ€µÂÅ–ý°7B>—93…æ„ibbniU({ù‹ñ¸ç˜,ŸòÐÅ‚Eæ Z"¾„ˆVpm´·ãcÉ›’Ÿz†&¹ÂpÖæ–DÒ? »¤«ò£¯”më B®aj¡Ð¤t7Bê7&ÉÝÔ¥æcXÉ)K­C "”¥F6TʼäåÂÔ 3Lwt„i®iʵQAýþ î–ážܵµ5.Û<‚x›ð­¾'@e¯A³º«³p”¾¤¬´ûÖæ–óaõ½ ÖͳsýR·Ò Q׊?ÐÕVû÷Œ sÅ-š·Ê,/Îðó¾åèpíν‡9%Uó)Ý'h[=eëŠx¯žx<¬íùðqAa~¸·Ã}Ý" ´N|[@ÛÎ4Ðéÿâ°å¡].¡¸k ¾”öÄãìžC'*fé©€€¶Ýðtu¾×ø—ÿø&~ >Î µúeï¡âA°N´-ÍB6o‘ð×’ï[ë›Ø”ÔwÍÏÏ·Wæšê°¸õ”M[fÚn]±¤ÍayÛŸÞµ[CsÿþÝÿù·žu0æc É—4À·´ ­C"X‰÷±øECëntzsKý?/½½?èº$H‘õÏÊfM› \ßÿlÐ1¦Âû«vþ¸+ùSõy[vˆÆŽç´"ÈF{ µÔ›ðW`€~w©ö‰Ç^­SÍSXdé ?]uDsÏ­¨dñ†Mù:àwb/ü*Ž`C)!hc¸•Ð†¿?6è0ô¡Ò˜ŸwL¯ê¥>î) ÓØ£œR¹©%*â ùl6GDn@‰„<—GÄÄA” §±HÈá°" P&p8\"&Æ}lØ…Màq8<¾ÄHDG(“Exl6WL–(A‹àpùD$Ž½Ëá …‰8pØl˜x› xX®8á’Š…ô¶Å´ÒÙ\2TÂç¢Y ˆx@©TŒß6½tŽX(À“R˜´tô¶ ß ¬ty}iüýW¨kÒÇBg¿ö¹øüò¡¡WI!ºGöýzÞ¹‡-E6½,/+öþ ­Ü!6!ÜZ÷ŒcË(ŽMXwµÒ7³¹Gø—¾0<®óÂ&øйð±Â&˜=v‰äM|)½lzÒÆ5ŒÄ&4dê(`®ÜOÃ&Øž52u¥° Ög´½åØ„°ãÚº‹ lÂäCOë㧬eØ„ § êñᕘû–û÷œ&¢¸™ƒ N–FÖ®Á‹$6á5†MÈ ± /£ÜîÑ.ž’cNbØ„5 ›°0ìh¦ãäó˜¨ïûÌGúÚÚ¡*6è]¡BŸp‹ã]±!>¦gôõôM.Xù†ÇuÍ°_œ JPþ:ÉåêŠi›À*Ïv÷‰ì›Å‚á…œ¹˜À[¾!‰¼øÖš7^n/Kø¿«*ÁÉͯehšÀ&& »çõàÉ<ŽMXa…øÜŒÏûˆcàƲl÷›îµD´Â|Zlˆ»Wð Ã&L·§;8yWwãÂì‚ä@Ç«ÞCxº¥©îG^Á1«86aiâ³›‹[^Y#Mø˜÷ÔÙþfín˜‚©ÌX¿Û¾1“lMˆô½ù(¡€ˆsh,Ë»åæ–YѦá[Ã8Çet( ³YËósó+«|TC¹ln&àLjDb96Ø€,—ÀÈ Ø8 ƒ!@lJ„óÈs!‡8ø…rlŽ~Q‡M !¤Ø…2lD²p§ÐuØìfdYâ¥Ë± BéD}eëdë° òú’x©4¼-1Ñ o‘®°ì¨ðNÞx7¤æhF@劒ÚÛT—éf° .qÃY"ß\_Ðú¶Š¨ðW?!ІGTôå*eç  m=ÛP:  ¶õü›ê2 ˆÚG„Œ½WXÂ_Ðv³â•I¸« Ý­5…Å%½£«\f¿cÏ  -=ŽBð×RTÒ÷ùÕåÓÚ{iŸ16ØùÓÏ\»f¸ë¹€¶Ñ,A8Ì«Í®?ì›e­²FÚËÏÛe|-|En@À4€¶cÇÑÿ*l—æ±7mr¨o}ºßž=s›WðÞh»ÚªÏ±w4~_Â?Äü‹f*ÓöïÙ•^¡˜hÛX>Rùôüçÿh&—S¡HfˆÓþ‰…ªqv@@ß»aláÚôí wi‰ˆÏ­®ø~×ñО]ûöχÀ·´]‡T„Oúêãæ%£Ã÷ïÝ»Wû”õ»ŒxmͽAÉodѯ´¹½ú@X±áÈ_®XÜ×bÃå×ņà 6|+Ï5ðàO)` û;ÛZÚº„2]»of\Q禦JEô5mWB:…›º^ÇÎV¾¦¥”[ *¢ºDõÜï¯2Àé—*'\_:²ÑÒ¾E¬ý‰¸¬Ñħq­C Ôç w/þ²ß°vfs“pâ-ºê#ewˆØBZeRÙËxU)!¥” %ÒO’;FÐóT(‘vôÕÒaåû„óT(](A©t´XÇßÛ4„ÇqÐÿÅøZà û±Z>$hýü£CôGZD¼±ÌÐ?Emõïc"Ÿ¶/â»­I8ŒÊ¬çIyKX¨¸˜·R”›šýŽØ€w°³>>öyY Î…„£¥õM/â°üÚw©Ož¦3ñ¬Y3ý©/² +Dø&ÃsãŒgO_4uã{ŒˆÕÑÑñ}kD@êô«ìä„”¢,”f/Og%=+©náã°½­ÏŸ>¯é"–©Ye¯³ž'dMsDh»^*|œøel¿5^ÍûŒèÈÄi<ÝÚÂX~F|Va9W„Åë­Íw?ò¼šÑ‹·uqKUqtäó.~+Zøô:->µpž‡íÆÂg/æ¥=Ë/©áÛ[3ªbŸ=ûÔ>Š€…¿­0¢Â¶ú”JÚ?$é>i|î¢ù9cZVî˜| 5oÌ0ˆ¿¹©Ñ·vþcW:±[¢`.5àü¾ã– ÃXÄ_µ7Ùo`êAlÍþ!;æ¨æ^Ÿœµ ³«2ÝÒ0,iÄr’°Â= ví6ƇtÈXÛ[““‡Íì°ÝÑÖØ]—¢±ûP\Á'›l½ãßGÞÌàà‚µÇ zÇNÚãØæÃTwÏÍàøU›ð*9`ßž}¡¹øNXȸ“é¾cç[çy¨ ”Ýûá'¬|™^ ó<ûÓÿh·áéfúj/ŸÕ2µ»¿ÀŶ›î)Ø÷˾àä×D,zBðµŸþG#o[çôú:9i×·¼ŠÁ„ç¬ 4®¸‡Ø„WÉÁ44|Óª6>ƒúK{ l ñ;²_&'$¥¾«l\ZãS1ã›™j`mzb¸«¢´r’-ÂÅýMUu­Ë¬‘ˆ¸íMÕõÍx#†ç¦†k««zˆ5$Y˜êüTÕ0»ÂƧ@¢¡ÎúŠÊÆUÀøT^ÃOñ•öæϵõí\l_,XÀ]i®«ìaIáÙ‰þªÊªÁé%Š{:šªj›V´ªìùÞ²Oµ“‹xh°«±¼¬–Øñ”Ï^b4Ö6·õ pom¦ª¢j`bLIÆÚËK+§yxŸ%a÷u4ÔÔ·­áqå"»µ¾ŠÑ9(Ä{ÞÙñêʪ¾‰EÐilµ[Â:d¬—ŒpÁ´½u6>×ïÒN? 2WsúZÒu'a¥¤êK„Õ&UÊ‚ä‰!õ¥C¿U‹¯Þ=S0×Ø݆ŠÕWäˆ Ê—«Å®ÛHó«„Cå…f•×)Q”‹ÿÊÞë–TWh=àpcY®K©êKÚs…­”>¤ öÁ8h;ŒÈ¶J†ióWÊ¡VÜ“¬Ìm »Y‡Ò–BÄ‚¤ìI'w[_ÐwÝ[ÐýT_gkß¾;„àœd‰XÀœì]UTÚ°¸ÌK jC`@ß¹mÈz)o>àªéÿX–@‚½$G` ùuœï!ͽú†gŒŽkþ¸S;¥ì „¬÷<ú§ßèìbyrðCQNØ=׃;~vŠÊXa¾$þRúâ Æ~ÿ¸‚ùöÊâlŠÿå_4O}žä ²] q}Ïu—f[Ÿ;e~ÑüÐÎÝ×£ÒׄÔ2„œÅhóãæ7{f¸Db³ëÜáŸnÆ}&Í Ðw=ÿÆvµc¯NONÎŒ÷ܹ`è–ŒšÚîÙ‹ýWÍNØü7Š) ÒÂ"î¢÷•“fW#$ “u  ïÓ:䛜Š–}­N;…&¡¦~º:ΰ:}ìFX,á cQkQ.f§/y,v: ïy@%ÿS°øÀò”Ü4†[.Ôòx”À•¥…øìçî .ºL©Ø‹èû5%ÓcX:æNôDìÝj´‹é©KîsòþFÁÄd³µ›fl¢\2ÐÖ3 b®aë='$ s»W LÂEˆŠØX5p€uØD5Fà+ØdØ„òW .€‘ßMP[‹õõØ„ïÌ40>g)ÊÕ\ÏâVÿ Ÿ°áRïy­î±µ´‡§ÂãR›«‹©P(¾qW:¤C Ta`HM÷´›+a`•ë° ðW° ëë«îHþV0¶Ê|ƒ2û—ŒC1Ó@?”Š»Þ¾8¬±/ôe)¾+öjš¿½ÆcÙ{ XU(”¨íó»˜È› æ0*2Ÿ%æØo¹(#6%K†MøRÿâùÓÒ–üH8ÚQý,µŸÀ&@üš’”6aeº/#%.³ˆÂ&´>{×Ô%Ã&TDG½ ° ÅÙIñ©4lBâÓ· Ø„gÕ6!óy|æ4GŒcÊE'|Å Ä° éQ 8RÇ&¤ÇgÊ° «óÝÏcžU·Ò° OéØ„)… 6!õiþ»¼¾H£*öéÓò6€MØzÖ –lÎÝ|”Ê[]#ÁRV¤‡ÞqýKW¬­-Ïë;]ðAèñk°¢yqS£=waØ%-˜K{x^ó¸U#ŽMà­Œ]59``v‹Ä&äÄhØwÀ&@ìêL÷{JZ±&']ð0Ø½çŒ ›PrÎàˆÙU ›¼Oãð‹‚ ›lóóOGÞÌàæ»Öêh®wÌà*‰Me˜éi¸…$Ø„×Éš{5Ã(l‚³Ùþc¦­ó| ›P~ÿŸ;t²IlÂ2†MøA‡§›é«»brÌÔ^ŽMÐܵ/4…Ä&$_ûùù$6¡ÏÏÙèˆ}/‰M¼l¸×Z†Mx|`ï^¿—Õôï hk¬SI…ƒ­Ý#“b)‹¸K­µ¥éi)i™y mýB1$ŸT¨ÈC25Ú[SYƒ=Š±Më…SƒŒºÆöe¬Q!ïKëçæ¶^›0?3Z_W7011$KÓ=ÕµÍs,Mîi®­meãYóVçMõm_Ä8‹amy²®¶~|v‘À&L uTWÕÏ‘ØVg[cCÓ.~ƒÞ*£±¶gxB„UbN~®ý<2K4U^£®žÁ± œ…þÊê†i¼wC+=ÒÛZ]Ù@@øœåöÖzÆ—¡Ã&ðÙ̺šºá)&Db":«+kgIlg°«¹¾é‹ ›Àio®ëèáß.sr¨®®v`j t[¬ËPŒøG”R)IT€éÓo奒 } 6Ú6RM€Ô–¸Ql¤›­ËS6‚6á;ï5Ô-žÀë#Ô§ùó° êÁÀ&ý±úÿl.3& endstream endobj 1588 0 obj << /Type /XObject /Subtype /Image /Width 265 /Height 314 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 16286 /Filter /FlateDecode >> stream xÚí½X]—ï;ϽçÜ3çÜ3çžož™3wæ›¹ç ¯Ø9Tu¦»irA‰ŠŠ"*ŠEE ¯ ³bΊ`ÌYA‚(ÉA%§Žu«»ª›&)úªŸ¾¬ßÓbw¯ª]iýkí½«×ÞÀ7§®ðÞã¼¢¯[æë¢'wsß膰öÔ¿¹w÷^³ê=!ùÕµb謼ÿÁãWõ-¥Åî¼!Þ·Õ•ßðp î?¨ï!—×éˆs£,{ùìÑÃ=*)­P,à?G(§ñŸ\L×{Õ>}ù–ºS4C‰ñLB½ßôƒžO/èسÁ¿“ÅAY6èÓ&-¦ësVL1}Wï OüÊFù·?,:ëT]¯. ³÷¡ÖÖ &“Åf³Y,&“Ag Ó”‚<~ŠŽoÛ•vz8K†ÑiV‚xí0–üKåñÄS’ >¤4 ÚÙÚ¡n0úÕ²¶F2¹¨ã¸ˆ¬ü ÂðâNúOáDï>ùÃb~ÑÍßGŠ„\Ç5Ú>Kê]qi˜-Ù_} Ñéú;Ó›zÁAn½ýwuèM~LLF|Ô.›¶ójÙG¢.㯆ÜÕw…é6â1ýWó½2¼ÑÅy‹Ttí¦ƒÈñð¡´èYÉkÃåѾ,zú²¶[ÓÞu"yé²ø}g®Ö·© ~¤-.. ûO‹‹ÛÕZ¹ÞU•ž9¸+>.nͦ÷ _i~¦—†"A«i¿sáÈŠeK“RO¾®m19¡¹4ôߨ; ï\^—Ÿ¸i×Ãgå£ÃëÞ<=´kSÜÒe;¦W4¶¡eý’Õ¥OíÙ¼4.n㎴‚W•ÆÍé:ªKŠ‹ñÔ½x|ßÊšÍ{ Kkɵ KÔ—?OÛöë²å‰ïj?! Ú…çí ý%Tº{eO¯¨>K›üè\‘GÓIâ5í•l6¢ðM·üH¡Û¹êßi»½™l÷¥™L[º½‹§Ÿ—€Ëe3é…pu¨¼<=Å|>/õðpËoQâ‹¿<>ŸÍæÈÝü¼Ýx("ž±_kŒ §ÅÞ Tbïâçë#ð8të­Y¯úE ½o(ëåLOäåëïãጰ™NWkŒnsmçL Q¸zø;JE,:rªT9X€Ð]Y7ÅEÜð%Üå·ö6aÍOtöNÉ\½CB‚Ýì…<„•ôà±òÃäél."’9ùùùÚ‹ºo¼“”ÿidä5b9".ÇwÙaSô(“eC¶ŽWl*Ë?róWC»Ý“ɳs‚ ñãIƒÃCñ+/¶î)ŠD8j^¡rZgZÑNŒrÝLÏÇúq™¶mZB<ªˆØa4¶Ot0mízÿ0£Ü8¨ä~¹Ü‹óq5ÎÙqÇГõµe.Øk,¤QF¥º/xšÖ·6 ŽGÔ!Ó7ÛüQÄÎ$ ý΄l1YB‡?KƒTû!•Ž[ÑÛžróx¼JC¯©óë"ÙLÛO>þ>°Îe±9f°´Äóú^®Ò[4;rû‹¡.Gñq(_Z~ùãIC`çÔ·É<™Çç?ëÖ hk¨Ïž9õ°®Ë´d÷ÍX“VÚ¤&¤Áe0J[uüoq2›ÍÚv©¸O…JU$¦ÒcS®™‚Ma<®÷|ý»¦ÇT*3rÍ•^ ({z”ƒôùª»>?qúy{oÕ½ô ?_,Ó™¤ÁÔhÉÛ6þo«˜Ë Uë°ksìQ.»¾KCF)üoà >‚~JúæTGÄV<¹u°¨ÁBPwÿà>ì¾®¿´=ËÁ¥1ïHÍPýPoÎG ¨ä„¯B%sO49ªÞºŠy<þÚ¢®þÒ0ø’º§£¡®¦ìÕ³sÇRD<>Êî•ÑÓg;-ÞN¡ÓéÛ2‹ËËHÊßV¥® ¡óÆ·ÖÙ,Âï¸<Ù¸½§³ÞV×u©tƒömŠPv¶ÖÕT½~žª6w‹+*7€_þxÒ¦˜_5­² —FÌÝö=T¹Çãt:88¹xûø&,ðEX½Ò HãÔ}b‚˜9aÇesi|ÈÙÊà rç~Èìƒß¾èb²¿—§Bn‡û!•~X;ˆ.tšŒõS¨t—/vrqóõŸ°bŽc?ih“Æ ¹›=¥ï~bÒOF ’äÅãÙ4úõ:lå¤aJC‡©ªeT¦kØ’Azïôÿ©bÄt¡½;¸åX¡²“Oís}w—FZ¹ª¿43(ê¹`ŸiÉž»‹Í+T Šã­ÙEWر˜«ÎäšKCûò(B9Y¤¼×I«Q©TZ“‹u–Ovä³øî-–­¾Ÿ„ðøӶ䘾);6áÓÒÐaÉ2.KØ¡Æz+TX¹œ Kú…|î„„ø)Òá÷PY(çp¤÷[ͺ¨t݉Ž¯Z”íoo0ÔkÞExî÷#6Ã’×f5¡}¡(ŸÇoÑöokT¤¡\V£±–Žÿ«>6ƒk& ÊÞ§ÂTÎÙealýÎ[eßfø{_„žxŒ‚¡$Õl¹¥xòrü]Í}c­¬¶<î!Œø7%9[˜l»¢^s}™Œ's7¯\=Xë2itÝ_Š·Ð“îU™LwÖø#Ãh†›ÄQqa#›‹¢(o˜ÒÐß$ ¹lŽÐÉ¿YeÜ)m×ò9‚ R‡'vmaüÒàóEø%*¬lxÿ®áèòç8çq©ôÒ°_¦3\_eîJÊ=VX£·hÕ­U÷D<.Ê¡?§2HÃ'SðX”Uû³*ß¾Þ2Û‹ÍE\Ÿ4uÞRm ·vu×B.‡¾òp㇦¦÷µ ánçÀãv½­ã¹€Áâ)¼ *?|øPUrKAg<¦<„’“SžÝÝwzIk5Êʼ“t/’*?% œñÎbÂ\´ãLEeùáUaD,ò* &£4ÖNw@y<†Ïp£n¨{rT€ß;XÜ›¿(¯zûªpG|$‚òPñ_sK÷‰‡›Àw"s*ßÙ'ÜÔÖ°;°}º«DÈçrHâ±3Þµ·ùë»riTÛûôN7ÑÓE84•F£ íd_]ÀEÅ¢Zܯè:»{ýê“OŸžJˤ"¡ÐN*[vÈtKoyr~áü%o:É&õ…MÑv±þGG¸K¥{®•™º’j±“Úáƒë…/)5f*Š‚öõ“F¿Ÿ h_|L}Ç*ù,µõ¯Ñ|¼¨¡E¸Ó~‘5T ¤1"¥!rlúðˆˆîu‘n£ÿÕ]O-‚òWvõ“ÆÕs|~ÀµÎèN†¿;c|y#–ç7«BMÒ0X·Gû¢+ËÛ™ý¢×K» Å Ž8|õÀÝë,ɶ¥‰s5ØžÙ®(=YGu'5á‘;2cC&Y”¶Ë›Éñßòº";‰Ç7X¤¬ò^5è×ížã-"VäóÄÙeí˜ÙÏ3ö/ å‘6Gð¶EÿCâ⸨>|ò:oZ8ÍH’† ëqd°]ß5yQí…¾P¤Ñ)Í¥‘b‡tZsïñÃÔ•“ñ÷lÉ%9h 6ÃK·Z|g¬¼vóÚŠ)Î×噢Æto!ËŠÙxøÑÛ3|Q2g—1ù¨»@@c '&&,ºtåÚ©\D6mîCC"Ó‰ùrŠxF­¿ÿèÑæùAxƒÈÑÇ7§íòb°ÅãÂP?nç‰ë—Oyã"äñ"OVvßѱÏC¸›\|p낧@ßÌÚ•ÿØVÂ8'™‘ü(/ÿüábʤ¹5i±ž·NÙ$ä²ç%n?tâ*´7F”4ð&ø£µŽB¹‹©6Éã ƒ`Úž^iôäã®äµ%ß´nóµ8Ê=R¢w-MÑAfô&]O 墤4JRç²Y´ŒÂ&ëž…AL:¯ ƒøºN£Ñ* ›'ò‰0}ÓZz“ÁæNÛÝ;ND<À¥UÒàñ„WÞ÷6Ÿg¾@D §•5—6RÝÝ›)>E.á°ä†/œD\ç ÷L¦–+‹Ø êÓUÿ ôE0it5>â ÂÛ_Õt×âUˆÃUZ™4*Ò&àB¨ïÑ`½Õ.ÌÉŽ/ˆÑ†ppª‡Áªï2UOôk8"B &9PìkÌ3M«Ò™4jJNÍÇw—•ÉZ|¬ÒÎì á=ÚÍ‹ên`18ž‹îÒ°S„˜—Ðõ*¯ ]iÒ/-ð‘€}:³u{ÅñÖ«f}÷œF¯Î^·¯?K£¨^m. LÓåÄà8.Ð?†¨»4ƒ/ë³2̤‘)BNFgÞŽï$¡;¯Ç}>ÖÛ‰N êW²çÒ˜ê†ò"©2©„²×Èý¤4(4Æ®’ÞoNFé+ý2™yaR>u Ù…éôÒPLØe>(Š¦ëµ¾~õßµn}óC(鳦oùܨí V©*ȉ‰°ÇwN¢ e4@zò68 ¥úÄ7>GlÈË3“Æõ¸4¸Ýš>Õ‰G Ýe.¢xÕ·³oád“4b:x ûî—ÔG{^™Ic&ŸoïväH¿¢œ<ŸKJ#`‹y/”¦ë%.¥¹¸4ºpiØÏÜt ?û߶éO@ › oÂ\&$¥)(­ë¸·‚M§€4@úÖð»<¼N•ý®‘ƒðUê“õÌ¥ñ.3¯¨¿éÒ˜9žÊAÌ“Çë‡Ð|ïÃeÑõÃ&˜*+7D2j, w¢xõÍëÔv7Ô7t)µÀëªÚñz”êñrag>ïJõhH¤¡$*Ún&WhgÇI´¤Ó™5Ã5Õx3œš‚ûÿï¬à¡œ«•†ÕzKP Üh*ya ¾.!·ÇbY,ÖÑÜzÓº;ç£ÙÊÞôpeàŠÒè(¿Ge!áëo˜–/=Ëå .7›šáü•7LcÙ¨ù(Ÿ/%Þ÷–*pë‹îÞm…9ŠY4Ÿn-Vsx2¦W´¨Mc¤dÆNನOA#•â~Â4TþfADA‡Œ÷ã.‚˜~CU°;åñdöQѳ]<>OsRkô»›B8*–ÊœœäR±-:9$ÀÁg7ùª…ãí¾ÐÞm\tô W¹C_y2¿·ó–ÊL\õé¨aØRNR(ÂãË]gDÏñVØóÄaÚ^Sç­P6žð\|¦M/—ñ:ÒÁ—äغn'ˆ½CæÌœâ ó¸ŒKeiwÜÆë‹’„JLÙ\êÅf±ñúñ'† ?·c±{ˆoC T#²£­­½÷¾­éikkëTö}€lïRëŒnùáÍɾ :&pwöñ[ÓÄÄ߶ÚâÄù3ÆOÙp0§K£ëêhïèQcÆ1ó.¦ºJ*•æ_ÑÔ&”o¢&Nš¹æÐÀÝS6¼L\½î~£YíÉð„¢ºøZ°»”F£IÜ‚3s+´äȸ4X“·×=‹gO£Ñ]ƒç¼~ßa¶.¦Sw_NMp4#dvBuS§i7Þ^ÝÎa2ðèƤS§­O×bí.B&›nóHX„»ÍáX2&Â#?`0>cJ죿Á0·]¡Ò QðE¥ñ±j]¢¥Quuu)Õ¤âµjüc·–?N«îèhïìVBÐ~>†! i`¬i몪kÛàL_Àà3ètØГ úýGV0Ž#ô±Y}û3Ta:ìc[Áúm¥Ï¶ßi øÚXÁ/Vc~ù+Á/£å^¡Ù¥=·Q/DG[›L8ùëâ-¾Ê¹¥­Å(â»ÑVÌi‹6N¹Å…aúž ä|•Éeo,ñ¢ØZ{©ŸÍDÎ"û…B£¥ßÄüË__t ¶ûMߌamî4‹±da¿ð>û²žæÒÌ$ kkÓ&¬‚…[N˜\=/cG€³_oŒ=(rIá;ã0}·,m)ÆÃeç|±T d‘Æ2éØM{?glš*v7¼U/•Ø.2È*[ÝX‘YÝÄUÓ/:çRîd;}…a[†ˆ˜Ÿ‚í+çÏ=gnõE-KZÍâ‚뺷aÛ¥WÖêK}ßhzó8CN³9–«Ÿ¼§ìâNnX‚i¶ò["kÚþýøuy‡ç3…n× Ë {Öz!%Þ†-{Þ£T[Õ]ÄÁË´ÖµÔ9¨À .?ðqi¬»Ýiº··–Þ¦JýIiØÙÆÝS*ˆs¦©¬tE‰è„#„4BÒk¯º4_@lEug¹6¼ÆÞ ¯Õ>¨Õ“:•ù²[#Ÿëw§Õ—1æF]o]êÁþ8á”_Ii„Ä›¯’è06îdÖöŠm‰fÕõÓõr¢—ÓÄ͘A\…§iw4ÝïY¨ä\àãQÃl¦SkÃœ£¶÷Fü~“4HÿÞ5Ž/šu•ÆÄ‹­e›2f{ˆëçÉòVpN?3 škÐAÞqÕËd4†å/fM ‹bÃŒ¶[ÝY^ ¶¥êIY»dÁ}Òf˜‚ÁWȱmÖÔøÓårÔkw÷ê[½jFx"3N. ¼Œ©kÓ ‘†^w©cäµi0™Œ¿ü…܆…em¦~~¬' ýç$Õ¶–Ù°[ Òàˆí÷¥íÅw:yÇ&7®Í¸Ø#pùaG Mê|¯™‡?5ÜYžó¶ì!H=øª™¼5tXíQ›½#e_ZZÚÞ„©ë&bNÿ¨q8&HߞР5ÆÒFÆ‚t[ª#¾`IÎNYèü~KÙXBừÒHMI&ö:=;wþ,º­QB6~Îç´5z´­—y0ÜÉnòÊ4ûprç×Z¡ ]at×á·5:ƒ©”‹ï1UÕK¦sUßîâWâäÞ3ûµ5às¥Sýä¸xÜÔOöP %=T8ŽvœkúI²È‰¥Ez³Ãö—îÏ KŽ<ÀLÒ0ë¡*}Ô·‡ª4:BhVG Äûg9Ú¯l7Þ?ËâÙ°Ž¼Pƒ4€/ÆBä?nô΃Óúúú(š¨Xß5;à¹Æ_ÿÂœtEÿ\Cfšþ~`YŸküQ‘ª,Þde)ïИÍR{Üö¯–åú™…ÔN”ÿ[KFôy~·«4ÆZN‹Ùs¿¢öÞiWzŸkØøÅšow¹â—U†Â»6F‡ZXØMœà.µbÈv_,&$ÙVqËF €ë “óì|dáV`øøj}¶ÑûM¿‡æŸ|®ì ù^Õ\û¨øeEïò€ß“gawïÞ¹÷³Ñû`¢¨¨¨øÇú§ÈÈÈï¶Ý)S& <&¹LZü½Ü§ÆÿË¿þøÌA«Õ.^´è¦tÝ¥šiS¿ÛvgÏšw´pw.ö½ÒŠ±±–Và3#!Xܹsûïþ¯ÿ¶üÔsüºÇ~âãí•Ÿÿäë¾òòò@_zÈÿÁ]¿'mmmöö 鄹ûK°]uøuß[„IÇMWÍýº¯ýÿ~©¯¯i|20Ls~ç¶2%xë÷ ûÒöþýþ-¥€Å7}‰\AŸ) =ÊšÖ4ÁuÈ`ÿ.à7ðÿõÿþqÊšã¸.¾;ýΤ1jŒÅû÷ïŒ ; ¥E'“ס¶ „#i|üÇù[°¿Êß!^ü.¥ñ/ÿúÇøøø¥Fâââjjj¾úeJp?~¼¿¤ñyðàÁÿüÃ?®½Xœª/‘ÆòåËãàꨫ«û6­o¬õÕM*¤ñ½›>ÞÞt©Ï¶»]¦ë¾'KÈx³*³üë¾Ø×—/_~0C«ÕâûÒø$-¯n€4þ&´¶¶üÃÿo1©wˆð±èÀã?üá çë¾(4îBˌྴnÝ:ˆ ?|ìÚµëýû/I7Û–ÉgÐiñß\›7oi€4~|ÒÒÒV%$üøï¨ÛD:H¤9qâ~‰ñË=5""&&¤ñ{’†Z…£6Ö¢Á?h´Æ‘¸Õæ&­¹IcXÍܤÖhI“Á6¨Ik0iC*éMj Y?Ñö7á6£IÓߤ2šˆ6öJ|õc]]]«V­"Ú ß“4\ê©"£t ‹ÉØZ@ö†: m,­„›ÔdÒ¨+.?#L±¡ ë±âÂôá"ÃÆ6:%‡0íˆõ²±à¿ \¾ýÃÒ&tÙ~Âtnk°­ úˆxvß]Ê´°õ'‡ Î?I£qsˆÑÎTï+Š39pwíÍ… &û41ª™V)¡18ÈÒ-‹Y,fZ99]…;ŸKµuW{U¶Å oÎ%Ï|¸›Øƾ™0ÕeR©ËÎ#'cË­NJªˆnÊÂ%jçÅÏmtܼysÅŠñßÆ0i+½+–¹ÝéúòBÜ]ìÃÕ„4ÞîuvrL{F;ì-“Lh#Ü©á´“B±ùÆK´&z‚Tä[O˜š¯9ÊäñGo¦ý«'K%žoOëÈw”È¢7ƒ{gï%—¹ãíõ¼uË&ÍÛJ˜Š/,V(ÜÈ12ÕMnvöãB–’7¬vtr¹ØDHCå§ptu‹"LÝ%[NTõ'zº)ä•Ä±TîwvtH)l LóÂ|eâñ¤ÌÏ:)ì7d“2ß0/H*ò©%L-·¥ò¸×¾ UŽ³zõjóðqæÌ™S_›ŽŽè¼~F^¿~M„üï·Û HøI;u·lÙÒi— H¤|7@Ò€4¾¥4tC~@#8_CÿRwÞÍÊÂ…Ç㲧n¹ÍpHƒÇâƒ|DdVÙ¡Æ`ÆsHC/õ*?. •^+k×a.@}^»c{ò±”Bý+ùÉ°†’×ÁWÑ/ü“G9[éˆãóžßª ³@£3/ªïì9?¾é›”ÿ“J÷íÄmëù|”ÃfqY >Ÿ?ûHÃîOªã 3S컦z˜~Ž«/¹Û“«ûѤ±7ŒÅ—9Λ;'ÚŒ%kö~AQÎŽ2»P2¶(gÑ-jôD0FÓé´~ˆ\¿dV G6ÓÖÚÍ8lÂf:•’”O›¤àYŽ–‡M8@³µ‰¿DºÓ‚ ™Å/ã° ¨–V³’³ ӶĘí)c,ƒâÒSfÒ+ ¶iØÚhK×°ÂôäD„­ +Û8l{ŒµÈì‹®¹1ŸJeœzGHC)´¡0Ù„©«0?{Ã&¸ ,+ã° [ñcÙø¸–0MtXŽ–’Ã&Ô¡ÙØÄe’Ã&ÄM´·Å7›p…ja¹ýÂÏ+”+§˜¶Iäx5IµpÝÚ»ØÎó—Dë’ ÷ü+·…>ËRžbó—L;Ò6}ê„ kÊ- Ú\‡¯²;Ûxô„££³Sàâõ åäa«“S]äÎþ‘»^îÉÅ…Ë…|žØÞeÞ5}ësvu“9úLÞ”OÄ”¿Qçíp*HP¡¡ªäÂn1M$÷›¾íî®}ó gÙ®KSi\ºÊTÌI)ÆæÎw*œ–]“£ž?ÏaÜÚܺ&e=_ê³îZÓªäŽÀcK!¶þÐ&¾Äó׫6^*±YW°wš½yÈü¬Ž±íçöñPéê¬w›rÊe(/"½~”ü˜m÷ÛoIQˆñæG,S„%$ç !.î3ŽáV¼­AH#ùI·‡…é›'yÚÙQ³c¯bÛ®¾Y—Ý…ÇŽälŽmüQ ^¡òåq*T;n¼]s¥]?&v>¶(Dè•Ò Ò~8i:šRòÉÁÛwÜëXwè(J¥Î:Ò6DÔpôO,Ûý¸W{îW£ ŦB²­ËA_ÅÊUO™1]¦p <.j. }uë 9wŽÜÁI$òHø1£ÆÊ•KdsO§õ(Ýî|,<Ü.dÍ£]™FiàU ³Y¤4ˉ*2j“†„í|®ïtŒ¸Æ *=O°™!\÷˜«©XJn»˜ÁYtóäУ²1Ü”œ×#CÙN`„4–ÜÇßhýEÜð ½ßœ“DàÖ>hK¤üm£þÚp4Ï´ˆìDb1‹Êœ–ü¯\íÉ׆øÙ¡"¹D„†®Jc¦¤<âg |–¿!ŸkÌæ{¯ªÒ{õ½zw;ŠÐN!@™žq×ðu7ÚËdñeÎB»ÀØ¥~¨Èu}éMãKç]öeœe1Q™£+Ÿï·*ÈVÝÑ@Ô~u¢”Ç]”|¤Ò0¢:º>qù¢Ùˆ-ÝgbLã‚4@D®ñ]g™„Êô‹9 T ‘- å‘M‰Ç²ž› a·ÅÑ/|¤1£Æz[×IËÌ‚G÷dÍ#ø×Ï;Êô{KeáÒ(¹¼žÆ'%0ì>¼f:“Í;üJóõ©ÅQ‘S§,#sÃkÒ§ELM/m!LëbgO [ÐIf¹æL›2åàc²,e킉¡sÞ¦¶G“Âw\Ì#L)Ë&…Í"óI»^D„MZ»?‹0ÝO_>)ê…ŠìV›6)nýÂôúfÒ”)‘yD&«º5jâ之¶¦÷EÉÓo·>hÕs§LŒZM†Ï²#Ó¦M»\G¤Ôbq³fL™G&óÖeàÇrú%9Ñó†%Ñ“Âæ·;Üt-bÊä}÷ߦ}âÇÒH˜ÚsñcÙšù¢ÆO;ØŽ&cË|kK+kkk+++ “¿/ëé—&§S-Ç:‘îôz£­µÕ¦'dnøx)gô_ÄäP5ûl,,–^$·3^òËŸPcnøy«Ñcfì&»È¶Ä¸Œú «„È o{`õ×Ñ㧦³›üÇŒ¢? sÃ_Ûüy´c09Mjޱɴ+ÆÜpÚ_ÇòäÓSÍõ¹ÖÖ”ÆÜpÔŠJ÷#L]…ËmmlRÊÈÜpGÍbŒC±Wo’ðcYÿˆÌ Q £þ,j"sÃY[Œ]t6Ÿ0- ‘þò'¤’Ì ¿l5jLÄÖó Ÿû7TšŽ·eoÊ«ju}åP¡‚ LX@3¤ `äðe57ðû&9%533ó Ò~ßÄ2çÉñþ~>5À‰ÜaO–p¶ô¿þÃÿ¼|ùòðÃHcx•ÕÞ¾Ço·‘AëÆæóC}üšê4hýªïŸÚ ±Ä EôÝÝ0Îæ ÿe´åŸGýZ¯ù·ÿM¸Í¾g˜Ò¨êÁ®nŒ Û°óê•Dun€4¦®â’s¶4ú–[mƒ¶sÏ@nAŸ# aåÐφ)Œâ¦Ï}G¶5Š¿æ˼6µï9†zLf1«V­Š-))j—@ibœŒ÷—ø.Àߨ꿣4 ?qâ"æú.S 5x|.Þ 7cLdâÜT™“J¥!ÙMƒ÷=><‰-öÕ _<žmßÍà0çßûŒ¨ÁAèë~%ŒñÝøñ“àé3î?þ2ößÿ<†xýñO£þùßþôÏüò×ÿóOÿJN1ù›³ëúùÏÿ)::šp›eË–ážsêÔ)ˆŸÅÛ;mQ‡—†Öíw–†þ&V~VÄ¡­L:P ÄçܵkWz¹œÿJì5×Ò(4Î¥÷ƒKãÁþ`ŽŸîs*Tû.f]éËÍg>Cl֊Dzú–‘ýðõguë~øðaõêÕ‰‰«¾ô•8j¬åî<½ÏˆýgÒ(¶x°Àß—… ÷  !.Ò;+› ÉÎëÉ8²›ÉFbö]:wéê÷‰8§V„RmÏZ†Û ×”gQ¨ôuê°~Ï ÷²%>á©PUžûm !üßÖÖè¿W••æú øë‹i÷ÿóÿùDEE‘bà2Dø8zô¨Z­6©¤18ÚwáîžþFÆùx¢(Oáà<ã;ICz‚|É”m›æ¯‡ª;ÒŽ¦3¿ý>Í9ú°¢]ۘϠ³&ÿzGïÀÊ>•é·0»ßs¹’=^<±L;4?µ±a¨êÓü€³m/®Û2d7O;¶TÆäE[Û•Ð €7·÷±Tâ2nûþ£©I+db6OöV âF:u%W÷8CT£ Iu<&ÛsÒN83Ðôé\±Gœ`d£ëjkiïì“3tqHâ§áˆà ½Ã ™èÿhš¼ht¿¨C_ÐØP û·tZü½ÖØÙ¥Q«U}L*ÖhÒ¨U*3“ 7‘åÚ>&þƒÆdÒ˜H˜È$p¾š~Óf&õ&=F“Nc¾ÃEóÛŽøÉb†~¤„l—«ð_Tù®µ¡<Š»×~Q+ÜåÒ©žÆÜð-l&ck™ê,²µt rñÚC,mååg„iQ¨ƒ…¤–œùÓ–šC˜vÄzÛX ^ÎÛþˆae¿Ÿ0ÛL±A‘“#—²,m=ÂÉÀóOEÒiHŽqrdÄš*u™E˜jo-d29§ßêRÚÑ\”Œ]E‰l+­œLY÷ 4Š»’Ø«²íø±lÎ%ŸƒNv—ØZÚ7¦ú£ø±,;W@˜–Mv²±“7g1l(3w^7ûyÕÑY—ë%µ³“H$vv®>ÓÞi>f‹“\F ¿•§8(ìS‹ /ÄfMðýÛHw:¥É6^I˜gˆù^õ„©ùª½Äné‘[„iߪ‰b{)áiùöBɬ_O¦¬Ô(;±K>!žr…@:g azz.V&s¾E Z jrI}—¦úû«ìŽˆØ´*o™½“K$aê~žäààp¬’¬[†º9ËìB”ıT¤9ØË÷’Ã†Ì ñ’Æ‘s 7¦+dÒ_³H™ÿ:w<~,¤Ì[nÚ‹íï¿ >ö«£ Ó€â¹FUÑ­#GO¿jÔ?†g€« «&—ÍFQÁAy<—€%pZP†5°èa«‰Ä×æ××élîò;]9€.Œª‡Çi,ÙS­)—I}ãÔ±Ëw^ÃÉF8×vð=Âk€À¹F4‡gðæoñQ„Ëå „Â å§à´@J ƒÏCÜ'oT©”8ϳ’X2çx5tS#œýS¶]€’˜ïË0ã×f7ŠÜg*œ`„“•ä%ò0ÿ&;^.rƒa€‘NÅýÃ4®Ó[¢Ým˜à>’Gs÷¹å˜åCé°>sÐë~*Ó7)ÜìçÃ0+üÔZìø¬Q…aëg¸p8‚óuØ´5‚]íeÉØ·©ŽŠ½ÏÈØÙžv¢S¬ƒ\¾É˜»zv€DàmL€½¦°“.3%À&N’{`"»YëÉØìÔ™R‰k™ûÖAh6ט{>V.w!`ÕM.b™o©ôú«Nš ´*¹ÂÙuaê.Ùâèèpܘæî"—†’ °•ûöÉÆؘo;¡¿1ö¬ƒL¶Þ”3A"èM€UH¤Kö_/ûyš騙îÊa0õ0¸¢«¥-_V”‹acíJ›ðz3j›”O›dZŒ’’Ã&Ôì§ÚXÇ_*&L ‚dcÔÃ&\ XXÎÜ“E˜¶Íw;ŠûBmøÐþÐv´EP\aÊÜ<Ár,û!9lÂkê( —ÐÂôäD„53Ë8lkŒ•Ðôÿšó(Tú©w„4”[ËŸ0u®¤Ñ¨©eä° .\¦µ¥³qØ„­4Ší†Çä|XaN|‹Qvä° u‡©ÖÖK2ò Ó’0û±¿ðÉaš®PÆZFn¿>öóŠƒðåîÎŽöŽN­)˜@… *Tðƒ‘½iÚÔLŽŠ…3Œp2â}ÝúàîæÀçÉÜàÌ#™AÔ*däHI'¤ù€I'ø¿­ÁïØÓp2 WVý(™)uï†Äp0ªwn,Û%çj@`ÎÓ3 xÎã1È ó¡ýàÁ°¾ë)(Ì©É;AEËAЗ“s„ò€¨ßXH}MuUuÙRQµVUUµö³r7ÖÕTVÕ‘ÓkkÚ«ª*›;‰ =¬©±¶²ªVC˜´]Õ••ïÛºSë‡úʪ2mPÛƒ››Ú Sgk#nê!gèVᦺwdr¢²ã}UUu™”¥©©ª¬©'æ|Å4ÝM¸©SCÆÊZüC ™‡¨S6ã;ÜNnŒ8–zòXÔ}Žå]Ÿc騮ªlê{,jóciíïúy«S˜¶Ñ‰J ]šýƒ† Â1Ÿ7œe>o¸“ÐÖRaœ7ü “F]aœ7<6ÔÁz¬iÞð‹ JtŠiÞp/Kþ‹aÌδ°õO$Lù§"i4nï¼áV;gã¼á72Ìæ —Ð\¤wÞp–Ù¼áî|.ͶwÞpƒnš7<ÜMlcÑ;o8“J5Ÿ7Üz¬qÞð¦,†-ÌþS£í|w:ýln¥ò7V§²ÏŸËȸJÞNÛžŸËÌ|þô´ÛÙÏžÉ"G!è,ÍÌÈ(¨n&L¹·³ÒÏ\ê$L=U™gÏ>|UC˜Jr¯¥Ÿ¹@P z—™~öv>9oåó[gÏžG8¡¦-óÌÙ«w ÓûòûçkÔd¬9Ÿ~örö2ÖÔçffž{Kì”N{)#óüù›„IÝTxî\æëv24\½p>ãlËÚJðcyöŽ¼ÿß͹töÌòXºÊðcyRIF¥'wõÇÒAK ~,JªÀÁà«¢â=Œ`U¦¶¼tlOìÜÙ³ç.L>rN ô€^]‹Æ 9<ñ²Õ6¬‰w@(|—™pb 6÷•Å?QF~TÖÞ§39+îvÙF8%×v2ç:rÚpÖUC§1§¤¼…3ŒpÔïŠET›IkÓ»õÍ‹ž‹»0¹¢ÇР±u–]`²9Ö––ÖlDt0¿ ÒÑ. ën(”ÚZúÌXq;¯¸øÉ3‚hÁ½z¨áœÉ{OÃLm L3ÏŽîàgÙhâä6㦭7ÿ*{™Täæ§á¤/qä9Ž7K`nBèÎA‰_PT{[kk[YÓô´¶¶öhˆ =¬Sok'MZ%nêV‘ùt]í¸IkÌòÆM]=*ÂÔÓ…›ÚÈT;7ut“YتžÜDfaë4úÒ;Ég²Ó̤ÕïT;y|Zu^ˆŠL×᥷¶u’uKM7þIIn ëhÓo͸ÆcQúXº;õ;l~,Æc~ºF¸²ñ™¥óíüӯܸvùL˜ A¥wš¿¤©áÈfÚZ»sÃ7Ó©”ÞÉ‘<ËÑ2ãäÈh66CNŽli53¹wrd‹ÑˆirdÊËÞÉ‘“&XYôNŽLeéf69² ËlrdkQïäÈó©T†ird¡ …É ªŸ™–jÌ wAX6–.¦É‘ñcÙhœy¢³ ÏäÈ6Öq™ÆÉ‘'öÙ &Gþ©[âXOýŠ9ÓÆùúúDÎ[ZÖõ…#{®Š]0wÎZò¾[waþ¼˜ å­„ikÂ’è™+È©—›nΛ;çD~%a:´uÅ쨸&ÂÔþ$fvôÞ2ËûÒ¡µ³g.®Ñþ33zë±ë„éñ…¤èÙ±¯ Õ(ëæÍŒ^³ª·ìÞž¹s>®n[8kβU©„©éÙÁyóÜo#CÈÒ¹1 n&LÊ·§æÏŸw­¼É¯^´pnôj2ô4\šs®´‰0íX7;jy±ÃÍ·çÍ™sìq9a:¶#?–÷„©£?–”ËOÀÇ~îàÑO,Àß³þZøU!ôJA[õºpÿîí»ÒN¼ª~úÃOmUëÃ%\žÈgœÿ8‹¸ú œ(ÌLd!âËä†ÇiL¶0« Š#m¾—I‹ÌÝ“YTߘ   `„W©V;ÛzL^aÖðPÅJ¨Nã • édo ` =ëÈ\¬µì•ƒÊ¼'ÙFz3¼£ÂEYltnüêØè‘·•ûL“€:0L}ø×ÎÎΦ.,WaInÿEpf€ŽV£RªÔ½m m³ …°ä:œ`„ó$#Þu7L¹­ï’jxz–Á^jþ’þ)G£3&eã´Æg‡Í“ÖdÒô3i´Z£lõ«Mº>&í“1]7À„ÛŒÒ×öÊìƒÚdê»Ã_t,Ú¡øÙªSÖ^Êg±ån‘µ­/n¦18>S6}Ya®<.ƒæeÌ ßÊa1·iØX˜³˜bå`œ7ü›N_y…œ7|Q˜£­…qÞðKL uN*9oøÎEÞ¶V—ÆyÙ֔0ã¼áç·†Pmy󆳭(ž“W¦üS3ètÄ4o8jM“ºÎ&Lµ·bY,îã¼áR:AƒS×ÓD6›½Ï˜î!@éTcnø6‹™dœ7|²»„b©0Î~ŒE§ÅŸ#3vã§8ÛZJÈÜðæl¦-uÖ.˜7üçmk`Ê÷ÏÜ„"±X,‹£6Ǿô‘ÆxG…8„̧.O–ˤ)Å„bQnBž_éN'eÉúk/SB”Ÿñ¨'S­s¤BÑ’Cä\Þ{W† x.¥„§u<‘ò„Q뎦+É‘"¡c>)r* žMfye.Hn#…¨šùbÏñdÓ©þÞJ™Lqž˜å[«òHŽÓS÷óMr¹üheñ1ÈÅA" "'¯Ø‹Ëî‚Âè.D}ÉÙÌÎàDzö 9ÄÚhâNÑr?–Ø´𱟼%>È{àoŽ±×v¨9Ä¡S¡ÊÀ°¶qîN“Rô?;Ü3ßOh@î­‚œq`ĉBOiÎ&[t½Óô¥v»?H2žT4–>²grÄ 8YÀˆb«?G,ñy<„CJC?÷e]>ƒ®Ë#8ÑÓôŒðóa"`E–†šÚÚºWwÓi,SÔÀJ/ÇpÅ®*"¨èçùëñc°íÃÃùFXëkyuƒÊì•Æµå2‘‹y J»Ë›ig?Î0Òè'³©{ˆù™¡ ±|<œ(`„Kã\jç>Á<¼œÂ¥' áÒx´Ý]èèmf׬R0¥óàD#\5y)¾¢ÁÔ ÑtJ˜×eàD#YxÓ\×QM§q&¬¾OôQµ>KæòD¹]+áeñÓ§¯Èv}O}QQa}ÙÙûæEqAá rrXÕû¢ÂÂêf²¬ªÒ’‚Âçd>º¥¨°àm#9olCåË‚ÂgÝäDäO J«ÉŒÚæúÒ‚ÂbrVmnzQFNÚù¡¼°ði+‘¨S?+,|ö²‚0©Ú*‹Šž6;¥Ó–>}ö†ìeè¬-**z×C¦r¿zö´°è™óÝÓ€KñXÊ^>Ã…LfT}À¥ª‰¼¡T—™KkQAAyC ¸Öï+jè¯î›œ_™ÏÃÇb€»áø$|"—ÓCÈç°|ÉÜð7ÛQ„»£ôäpw)ƒâBæ†×AØìUYÏ S\¸ ÍFNæ†7]æ2˜óÒ®¦ÝKüè‰17ü1—Ê_y0]Ø>‘Iå’ °o Ã'b-a*83“Í\%sÃ?©,…ÇÂT{{1‚ðÓ¹áöl®@J˜ºŸ®EQôÀ[ò9ŽDÀfz“¹áå»P.gk™á%§Û:sÃ#,ÖŠ dnøŠ7š­¬Ú˜ÌË¥3£w_×úÙѪº«kj»Œ`™°Íõeûwl\·yWqå§'¨¯­­©i —QµâZ•äxïêëjªëÉ›°º½¦¦¦¹‹pk¬é]}uuyÖtá¦md@ikj¨®®%µ¦í©©®y×ÜN††Öw5Õµ=äØ*ÜÔðŽ¼?+;ÞטD§©­®©«'²Á1uwnê Š®ÿPÛH¾²ßávr?°ócQŽ¥Çx, fÇ¢éÐK'y,ÍæÇ¢íÂ÷Êt,Àï øy!¿+þ„N]ü endstream endobj 1598 0 obj << /Length 974 /Filter /FlateDecode >> stream xÚVK“Û6 ¾ûWð(ÏD zæ˜çl¦™¶»ÎLg’´2m«+‹EÕ»ÿ¾ ÙëGwÚŽ„ à#>%Øš öiöv1{ýQg¬äe¦2¶X±\±<)xRj¶X²oÑÝàšºòÕJ_ª‡CFýàHB6Á£ ºÚnMbù\ù0YИ,lgÐÉo*OP“þÄ ¾ž¬Fæaêðê{ nßôS+zjÓ‘lÖ–ØÙajò†:³n\ E½Úb‡î^Ù¶µcWâ!•‡C@]ì'3Ó­gÀÓžÎÄM÷§©)¨äx̬'çô)¢Éçøü|œ ¢D¸Ô, a¢œ¦B¼¡Áž0@džæÉ<Ï žÁ°ÔZó†öK3=‡±Ÿ§‡¹~‚QHÅ´(ëEŒ0ù9œk‚,< Û¥æÙ6%R>ß&è“\ó2/&`gØê*òtœ¯ã’)VÀ%t…h@+“ ›!ÔbÌ%“‚çtŠ€,Žcg°ÒpÊãPKñŽ”ÀZŒ¥¸Ô‹ÅIÍeQüÌ^ Yþ—ŸfHž^²ª”\9&áÃcµÝMm(3\oÆÌÌu³ÃOîâó‹4Ûý_ÿW\¿ûá§ZqŒJ&cÚ™Nrž ñúØT;?ýaìÁÍùÎvá ­‡pk¬> óoNŒQ· endstream endobj 1589 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 332 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 17185 /Filter /FlateDecode >> stream xÚí½Xݚﻟ{ÏsöÜ{Î3÷Ü9sfÎÜÙ3ßÞûû>¡s®î¦ÉQ@‚¢‚Es FDE” æ„€€&Ì ˆd’sMNÝ]·º«º Š¦ïý=-võú×êêE­?ïZµêmøc!Sò5+Ž÷œžfù¼§úºì£¨ì2¦Vþ"œœÀOÆ­e ¾ÀtP*ûd÷~úÉJ¥ÝvL¶ÐñâxÊöÌX2y²øûm–ºë[¨$Ò³æ1Š’W Âå-ê“¢#,'Ø]IJpÇŸwT>eó±à-85äHؤ O¡ŽÏçË ù|¡ŽŽÃÆ~¢~RýW.wÞ,™À‰ÝQ‘`jfñ¾g]à'p›¨ñÝæÎJ¾Â\®(:¹Vw„Û,*mEGOa5²VW„ÇãòÌW={SŽ5”åîYaÌáb>e\Ò¢`8ÀO4Œš¸¸½ô/Ì·¹³‹@Ös¹l^ak¿ª!Œv—ÛÍy—Kë¸lÎŽ›…#âÇÖ7Wu8ŽÙ¶>P?£Û¨9Owýƒ;I©¹¥CòÿoanS:Ü1pý`vÚ£ÄÄä¬5ÃFé6ØÓ®šww’3Þשv'5·Q¾˜÷òqòýGõ}jC<hyòàΔgM1IâÅ‚¬ÔÄÛ‰iÙª#ªãÁÜ´”;žµK†ß›¨P\ñ 91-·ì#)…ÛT·—é d®ÿ€ŠK|–ÛôÞ¥ÑÙ6.A£§ò­Gû³ÙôsËÀo€Ÿ†äe&KŸ·ñ´Ð£¯½uÖo‹F&‘H4ƒ¯gÝŽÝÛÌ$‘éØð¢­5“µeP±ï9ßµ—I!‘´µITÑ3}Û'ï{¸Û8]ܸ̆FÁª"3˜L]S›ôÊn¼g»b3ç’·¤’ÉÚ$δqÚ&–à ¬´{¿ó\&†½ V“ÅZ².g„‘µO_À¦’±ãѦPi,¾áá xQÕÙ•³gè¼y£Ï¥khj’È4‡çs:7SÌ37-³g±X2™D& mî[Kû¨ÛTöJ .®ár˜OÊ'ÛÜ ÷`1y15c™§ü•RsËpÓy8EŸ†{.l¾À w›6¦ˆ¾>‰gŸ’]ÜÖÖú>=i.Bá­°¸¤·­áCzÛ<*©©©oÃÔ’7'¹lÖ*ßs5mÝ]%9÷çré† Ö Å6O7óÌ*¬jkmÊJ¹¤°è:NŠ?Õª±MLJk 6oΆSEÕMíÍi 't¸,£Õøá¥]ÚIgòöÝxÙÜÞÙÞRàˆ ¼»õc¹À36™néä]RÓÔÝÝUU˜µ\‡Ícë÷Iä­ú‚‹£Ëâ˜$¾.Å‚šÎÆâu6–ÀªEÑ·ox™aÕn »UÕÐÒT[¹ÕžÆârhäº<6r5Õ¥1 K;Çá6bî¶ç€:‡/=Ç!n†hQßø¿š5öB²È«ÎQà'u‡ÿ¦Þ±W¨L¦kpþèy›’K{–8-+íþÓ|ÓÏŒoµbÈmø|¤rª*ÿìF&‹vêN‰úHªß[—*ZËTFgI{–2)Ô§Õòçç÷˜3t— ç¤ýM¡aa‰e½£?HkF‚£Ó²Äªá㩾YÒ> Å݆ÍeÜz34Vy›Lgê½– ’ŽJ:‹§³à1¤Rìîj#ú´Û`Êúûz<öœÇŒm8ŸK—G‰ªÌžì·¦p,V}äW³i… •îÐ ç(𓺠jݬ2Í¢Íó°—ïå6#‚IMqÖK®ªÛô<°ZUª*6e1\‚nªº¬»†Îä˜zgªUÖË¥SÏì[,Ruü¢r`HXœr†ÊÐ{-E[‹8<~p±Dµ®‡~.tʧcL¿×‰I'_N¯k$Ås»ß7ÞtYàB&ÓhåG~5^‹õ©ÜpŽ?©ÛPD[ÕCwé^S²á‚UcºMþ“øížÎz<Ú¬Y³gk3Œ …ªn#t8£n}Kté6þUÝf ¥ˆÁA¸t­YªÌ&±XÔñYŠw¼zh£©ˆC‘Ïê­Ö\»“1žÛÔä?Þ·}­™W^‡¦–™©ŽªÛ0¨¤l÷r›†ìP."LïCU]¶úâF*™ôI·QB}‹M½eØ ,øsæm®ùÛ°Ø&ïÔ’˜—ÿ:° á~V·¡²Vt©ÿ½žŠé¢u#Üû—îNg2m—¸…^ŽËýP‰½xk¿¹Zlc²K=¶i´áÑÕc›Á¶R:›kp'S¬¬¬Ìªfµ¿êõEYgŽù;/²âñ8.Þ££¼¦.õ¬™n8wÉá°«¯ò P´)aÉDܦ¥(–Ë\¯W«-'h5m± î /By,檣wÃ×éMÐm°·(¹Ng3=#Þµ7n2¯ ä3Û½¯qX¬­ÊIøù܆àf7J”ëéQYC:“Æ\¸îòèy›ysthf~ªaF´¯©Ú¼@Ð%Zš¶?;ÌdÐB’ŠÔæmÅÆ –hÙÕ?뽕ÙI·oÕub;KžD_Š}ðBu°4Ëã²—ŒºŒsÜË€©»t@åx*®;~Úm$è@[1ƒÃ3Ýr_y òÝ·-6gÓ&ä68!›íXL¡µþ„cì]šœGϲ¬gèÃÉ*®®fÑI'îd-4×¥3tßuÀú>à§u„˜mëÇÏpioàZS›£r›7Cnc&à,;«U8q©ªnƒð¸F›®wôÉ{eW[©Á¶«uMêÕ!k¬ó&h$Fný]+­ hG¼—]†0uæUôJñÒö*=µ:,õAŽ¸êpæx¨Ì$un2`anÓ1ø ·Á,Ïoáón¿©ÄN:Pxk/kbפÐá ¤ÔšÇâóùIÉ£½7·‡+ÐYR×; ˜’Ê®nÂâ7ÂcÝ/„Å6ÀÏÄ]Â7r¶þ2[ÂœciF§1°Ó~Õž(üœo/¿‰õɃ)UuØvÄšy\}ËÉøšºÚ§7C„t–±‘›oö¼¢E&ëqà"ó§˜ê ˜t•Jc±¹XOLÈk"ªÊŽ§³¸§K±„¤w‘¡.¯P¹vstÏÉ©ÇûpmÚe—ÇaÒ…f¶v–Æ4¤‹¥£»á‹K~,Ën}HyM]öã3ÕÌÌ Ñ™¥R™Üm(ÚY*]¿(%‚B×}­ˆã¤ýõÆú:ØMq°t=î0BImËmîºê航ÔcìhÞß<Âèð¬×nSõ”Íå}|-1¶—¸0I_OÄårò÷ÆÞœŽ}^¡ž‘®PÀ¶ÝÚÜnü<”Ý¿|ñr¬TF¸ Ù`'öäò ¦Fú–óœ¾oZ+뛋D:::ˆ™?¾ºï¸Ç<‘®.öÐ1´{ZÚÝþþW ÎS½ “ytǺÃgâúÑ᥻ªS»øÀ'#.ÄÞÂÈÐÀÈcçqñÀ°F>M,.Û³n¹¾¡‘±ùöÃçÇí¸èƒ`/ùñ`ÿ LÏ=¯‘õÕêëa›Â¢¶þÎw)gÏœoìÞ¡­2/òÜÕéЄ šžpn£—‡wÀI•>>²³º}{Œ­¡Ëè£w㸅U¯“¶¯sµk³ÌÕëòÝ\ùK=ùsu9 öEÃ) ü”àn30n¿è$#^PíoßäøGÏ3ú¡PX–D*ƒyàè6À×6œÒ&Ü€ïˆæºÚÊšøk ðͱD6~é¤2rï ½(¿nG&“IÚä–Ñ_!€¢I'–k“ÉšËÉV?Àcí¯|_;Ž»0­TÆ.V|³œÛ:ªSö¸ ÉXÇÀaÒnc$B–Ä}gºãFddJzüöà+» ÂçÛŠø ÛÓªwaaNß»XmßzáOç6Uf$Òºƒ÷á·_Ýmy×¹,FM—ÚÝŽñÇÜ™î7Îr›¡éqKSC#q;‘ÊœÌpicS‹t”Ûàʾ.qCCcgï :ú»Æà¨Íù t64¶ª~—d{ksCc“¢²¡œ#ëT?RüW‡¹×á‡Ä+CßUÕ4úC0•nÓØ_«/à†dÔªôøÁuÚ.~QI¾&¸Ûà°¡à¡>€¤I9›.UI ÓY½@—L£Ó±R EïEe“‘ˆ»üVëÞæ}Îæ$Š|_ ™¼Äçl—d¸_Û²èÚ³/i“Œ>ȳNzs7u§IT&ËP¢ØG\ùÊaQGBÖ"ï8sPy!¦g ç«Ö°ÝBïo”U½Ø êÑá¿ÍÐæ l&m¦¦N5î3U9BQ•6åxB¦ ¦ÇmêÐÕfúT»PÜ5ä_©P¥­M¹XˆÆí1Šmz«S8¹åÌ3Üž¤Í9lm_`°',>/û¥ß*+GžaFÛô/7çð…:Þ!7 ߟ޽Zˆpõ-Ö Ér„S.Ãm.»²Í-yt®õ<çý‘ò;Ö;2EW¨gt.)­ðíëí®óø\ÖRŸk¸þŒEßl™j {,É‚õ˜Û 6§Ü½¢O§;­9|ïþ“ìC5æ’™<£9Wî¥È¹v¾a{çL‹ÛôK¢V±éÔ’v"J‰=°–l°ëù*n3°Q‡ ÂnâÎd¹Ìg…lZª5Ý<`Ãa ‡S.Üò4r›¬ã«™ zTVÛо…÷8\äxünmÙG¿gü²+ár·'5+½õ·Öç0¥íÒ¡Ú"½m™tƒœO¸Í¨yYø|*_dÔM¼³¼*_'K&…ó¾ ®ZÀ´¸ ŠÖ Ø!ÏËð××™QV\GUÜFÚÓÄæ"¢ÏT}A|o?F9û¼ E»\Š±“—ši ä‹ø„Ûx-1"íP \ºË™4–ùÆÇŸSCC“od{âÚðz<Œ­KØÍ[Ó1†Û<:±~‹¯ÚwÔÊ¿¦¥ø¸;FÖÔÐ6çróyª\,émòœË¥Ñ¨$mmMÙƒ“ò.tÛ>”uB§Ófj «›ƒÍÛ]9TìCi[,XOTã(ø†Œî‚2ÙGŠG~ ʸ;OäÎÙ'jù5¥9¹ùuâÁÅŽƒòsß”JÆ»Óü”ˆ›šdÐ L#2™ íÉ¢ÿ=g€iòùÏ®öÖ :U/Ü€é¢Ï‚9›FgpyÜ€éŒnúû0úßßM"ƒÛ0í]ñÕ&Ûn¸ ¸ à6€ÛLIoSIII[Ÿ߬¯./*.''K{KŠŠ*jšeOc1¦ì'”uUe#”•uÍxÑ`w¦+—8×VÊ•ƒ„²SVÕ·âE] ÅÅ%íJeMEiQq¡”tcÊê†6¼¨¿³^®$»º\®”Ê.¹²QŒõuÔaÊ¥²ª¬¤¨¸R©ìÄ”5MíxQo»\Ù)‘?—Éd•¥%Å%•RBÙ)k[:à€©rñëÝ,+üÑ­6,4Òž­[¦è€hWSƒlµÜ/jzáƒ)Ï–öà›îvúÚ³õªpegC“lëvˆ°—§Û˜,ö…Jâ°œ­tI³ jq—êHÅ”^Çñ¢Š›˜Lö¢ ]bªCÒ0jÀ·ÄZdÇ­axQaòz“Õ@öYÓ¤W¶Ýgh“—í>½‰÷`08±„ó¡¶"„¬eÖ†+[’0¥óþkxQfÔj:›ÐF¸%ŸKÑžÓ+›â$Êê 88Ç€ðŠ¢Ì7nµH'_CSV|||˜p†—’c¢;ð¿ïƒÍqѱ÷Ÿf‘@ÃkLùA4¤¥$ÅD'uáÊFLù 5/ê®Ëˆ‹/ê"ëÙ½DLÙM(ëãbb¾x‹uÖ¤ÇÅÅeè“;·c£“{ð­þZLùèÕ{â“V½Ä”J«C&ÝŠ¾Ó‹+ûª1å“ÌB¼¨µ<-..¡¬—P>H¼s·ŸPVbÊg9%„–¦bÊŠ>ÂmîÝJ¸sˆ³zËãbcSß”Ã9ð#‚òZZZ“’’“’¼GÊÇ2Ùw%!áÖØ°IIIÐ5€éà_þí/–«|M—{ÿX³>ÿô¯ÿþ=7ìµëQ¿hq¸†Åzž<º0åü6Kûü{4ôõöËD5™:ßsÃÆÆÞ4]áóÃ5,ö8x§ÖØغnnn€Û€Û€ÛLbîpÜ ÜÜæé6Ó3!/¯SÖÛô01.>éa³b•¸Íwè6¿“¹‘‘‘*TWW?W©~\·9\£©¡¡Ú°!!!ÓÔJÛ—ÌA.‹‰Áâ!ˆµ‹/¸Íwè6¿i³öìÙ³[…ƒBl3%nóëßÿ®Ú°;w©™ò°&÷ø 6“rí¥âB©¤ìÉ2ƒå~"üÜÜÜfjq·3¦ØCñ/_P¥GìéÆNë W‚Û€Û€ÛL-—#O†ß¯:‡s؆j¶x#ôJppp›©I)gØäOÏËžbÒ¨Ûn”ÃH ÜÜÜfPKoíÑm+™$-Ç]W`–ÜÜÜfêFÒ$Fî2µ£×¾A§ëR;nnóv¹«H÷¯0Öbê¹|8ÎÀmÀmÀm¦zõt¿•að²n@ù•à_:„?WÙT[.¨^ôm•2õÞ2åˆ!ªl¬&··ùŽ¤ìÌÆ;.|xÿF…ü‚’êITÕWû8444³¹ß¼sádð9"‹ï@}XðÉ«ñOñ¢îª‡¡¡aÙ­D¦Ð¤¨s'ƒÏ·ãÊþLyýv^ÔY‘‚)sÅxÎbôÖÕ³'ƒ/tâʾªÐà“7î¤ãEâÒû˜2ŸÈLŠÞ¼yòäE"ûh_yèɘ™xQKÑÝÓ¡ao»ˆÃŽ>&ää%"§ho ¦¼ù8/j,H>}:ü}7¡Œ:r™È)ÚS„)ž¿Á‹jß&bÊ=„«\=rê*‘S´» 4$äö‹ˆmÀmþØnÓhÄ¥³™L†tcÇ-“¨Küz›Í/TfA_dLÒÐ΂®I¶^á5¿ða±ÙgK‰„¿îö$ ý¡,èL-²ÝêÃD/~ºÅâ\TfAw±Ò#i*³ §aJ¯xQEÊfLyu( º™YÓx( :S›â´È‚^”¼žÉägA7µL‡² cJ•,èž &w( º.BÑ6Ê‚Î$Q\ö_Ç‹2£Ö0ÃYЭ<*i( z<“üeA··ùFWÀ'42‚‘Œ¤ÀmÀmÜÜÜ···ÀmÀmÀmÀmpppÜÜÜÀmÀmÀmpppbHoKnfF~aþtIppp›)7•x8ÐHZ³gÏš­¡Éä…Äç€á€Û€Û€ÛLy=ØëH§¯>‘§ï“õ4Yç@ãå €Ý€Û€Û€ÛL1 ,‚­ x”#OàW~ŸD¡íyнÜÜÜfjI}x7­¤yh³+ÿ&‰Ì{ÜÜÜfšèËxú(öÒIS}Ñæ è’à6à6à6ÓÖTM®Ös¬,LØlÑá«Oe_˜Z ···‡!o©K‹dÑig á²ÔÓmNg ¡™hX–ü=9!›Àé*×`ú‰‰ÿ@n#oLÅ‘ËÛ3E¦.á‚Ó_Ï[d§Gý²¾–ÛHÚÅmýƒRo‘ú‘lVî…^ùtì<<Þî湆Ë$³YÜy›.¿”†NÀCN'Þ%!K"ò'zÎ㞆ÛÔÏê6 «‘‰J¶0ÓgÑ)B§M×Êä/fȈ5l&êwÐ^ä’1i÷®jâ{ÅGjëlSýe}µÜ}fæñGTBœÍú$;—€ÏŽ ›ú£gÓ Ë•Y±­â°s_½xöìõ®hN}ú,¯ˆhçΆ÷ÏŸ§5‰–Ñìô´gÏ3•Ê¦ÔgÏòKëð¢öº·˜²q€p•¬rå ®ìoÀ”o˾ÿØ&<é,“ºðx6u„g‰ÍiÏ{JA†<ŠÀG›¯ÈF²ð…ª,<»Ë‚ÎV¸lDéx¦¸ØæDü%D s"]ñqŸ1"·Ó\G{Uhé™ÜCò·9àÝÚxÃÊÎd Èsn#½×èèñô·syohJÑe³„:ºúúúz„círÔ¬M{¦‚ g ;ñÍÍKÌéd£r"/q.°sÙ5§ïFþù2"/ñº&t²±2/ñk.…á°6˜Gzî)/Wy‰ÝlèdÓ:"/ñ .•á¸ñ$^Tñp'¸¦ÌK¼ÂÒ€N6oÄ·ÚŸbÊ¥ÞxQÑÝM\ž º‘8l'S=eN ‘—8…Kc8û^Ä‹ÞÞZÏå â”  ELª•W¶ÞáÒ™n‡nàEYÑŽð¶2/±­®EŸKdko¾Åe0=N$|ÿnñäB§xEµ„gá'ªìTú 槟WsøF§²²,Ô@—¹/e‹dæÛó\¶ús˜d§­‘ ]Wù Œ yñy¾‹ð…k¢Z±]ù <._¨Ãcs‹ §ß¢[6» 9\‹åÛö<ÇÆnÍ:".›Çç°„³ã–xÌÖæ6™Ò5Ö £­oO«›íŽ­ëÎáë7­°¹–˽÷¥£þ‹E‹B±ö14 |ÁÚØ6¹Ï?NÕçc ˆ5$GÇfÓ©\yÃîö·µÜ•ÂãrÇûø<2-usA8|ëe{Žb¿¦»iX«òx.›#²XŽ‡ša~>'ðxˆù–{òé¸oÛÈÿJ÷v½~tø`ÈÙ¨’ygš\Ì/èlnnî$ú{‡¸µ¹©E‚×$hnjnwª*{ˆ2´½ S¶[R…²øFI‡º²EEÙ/Wvt«([z•Jq«\)UQŠ•ÊÁ>…’8ÌÊ>ìíÄ=„²·]UÙÖ2RÙÞÕ«lC¹²OJ¸\Ù<¤ìUU~׳ęèŽ]ë˜t†P×Èpî2°lìœËmX¸Û8,4Ô]~üT†äôÝG¸Û„D1ýrðà2΢$lèjmÁó¸Xª~\VÙoKÁ>þž}ó†VÁ/N+‚L"¶É)‘Ç6YØ(]bËrØûJ±×àªùL“MY§_¶òÄ7¥[1KÖf¤CÙ×þmÝFÝ[àÒ÷øš”bÞòTZWàÝòûŽêrIˆÈÎ?}|·q¬‰¨”¿ˆ»M>z ò€žõþ0b|$ zØŠOcF¾Eß/ÛxBÈ y&cc4åHJüc;†½hß{ñ¡¥™¾‰_ÚOá6½fL¶süh·9Nlß1<’ t2py„‡s!—6qnŸÉ)±˜K¶;{wö>±pñƒeûÏä`ncgäš2"ðIEf–éh!~éD(x㊎ÉÚSwâùü%§2ˆ]í}~ë[º nƒ?ÂcÖ_­ S^éÏ\9Ÿkî~7t<·™xœoVu›}'×ë/º„°JÂsäzçUÎ,ŽÞ|ÏÛν²ÍVs›×hpÌ=!ÓÌi‹Û¸«ì} ·É”yÚ2ôÖežVŸ3ÙºÙS°2ôü›¶1çmp·‰ÌÌE¨ÆÞQï|£råùûnWa# ÌmŒ=sGÍnsæe.OÛèHñzPÂ]Ѳàøp¾Îú¡¡œ—Ë¢¹ûS#n]·¾¹Ûìßã´ ËSÌIfÈÂrP¯•ˆ¹ÇSÜmNgÉC‘ðÜn]„6žÛ‰º*4qŽ/ÔAò;çXÛ§— iÂC/äk<"Þ¡ D¿«»Íà!sù¥¶ðl¹ŸønXô“¸ÍkôDbÑ?2<Í‹F¾.1äiºŸ¯;“Óò·‰Èï1ä})~ ™è®à ç©Š‘ÔÇÜ&"·Ó‚1{}"±WÀ O]ëÀS³¾Á)|’9µŸk°êLaXÄ6À7wYxf‹‰Õ|™ïæˆg;Ï=ZµÁ‹Å2Ü÷ }Ù*¤0¤N*\²ÀHÀcŽí6Ø ü²ÍŒCš¿õú¾Ø¼åËlø χåvéñk#ÞK©r[·’M£¬—£»æÚ©Œ–XqynóW&b¹Ü/Êçbš—ß„f¹1k·ˆœfC2cC|ËÉ×c¸  z¹ÛëX¹ï¸úÖûD˜€ÁÙ~OîKã¸M‘*ÜØt*Ý곆oì¼ãÚ[ïàs:LÖ†dihÆ ½ÍÂå˜oì{Ï­›™L›#/¾ñ,1n3tá5,­~ÝÞ@[Ç•V Ý–lØw¿ŸZ9÷`á 7«Å6\­ßx9(U"ŸR¹ì§G¾ï³ŠÕ‡ï†e+þˆ§UºlÜaéà¼ÔçÂIÅŸõÃW–:[-Ù¸áBùÞà9‹¼ƒóÑÝGYÎ[¹; }Õì²aëœù+—íŽ>õ0Ýnáâ­1 ?Åê>æ“—®Ýdé°r¾ÇÁÍ åM¤x}›Ÿï»UþéhÐÍÛëÏÖ㻜ºûØýT±üšT.ºåÐ)ÛEËm]÷SÌÕÞˆÛp¾qdËd£k6m1·[ˆ[³¥Ûœ²]¸ÜÆyçæËåaŠeÃá¯Å«wøZÍ_¾`ñOåƒÜÇoÜŸ‡eƒÛ“ŸçŸà•ÄOÜ'¥ð–ðìï¯bE=f/†ç -äøèêÖ,µÝñ œp|O¦¼ŸŽ–?Áç“q½R6Ö[|}·ùÜ+³cÞ'%7pŧ Ï^JtZåãäf¢Ñ>ºNx¨þPåb§{áSp#ò_¼ù7¢®O¤À]™Ÿ$..nñb§A‰ä³ îÊüL3'þÿ ˆ?ò|Ä©aL™Z#?ÚÙ'V†~´’Oí×YS I¦/Ø¢1{VKKËÇ=Üæ“xïØaã¾ïÿúÇ~ñ"mâA¸Íç™À@cøÑ£ùÓŸ·ïÙ&¦6‰–Ý:ÂÚ¶Íÿ+-þ<ÿ¶·&I[KKSK²ëµa£èzy÷êŠy¦ÚššÚ$ú×-²‹dª6S1ë׿¾;²ÝJ¢lµ)ôNü,j¼Aù&rfþN{©XÞ\{×Y›DiP®Zb+ï7]/üynÂùÑjŽ¬èïÿ©ßüU¼g¶ó¬Kþã¿ügʃÛ| ;wú¬ N¾øåY»˜™™uvv‚ÛLyX²ÁžÍ`EÕN»Û¼Ø© )hîW .Îï]N6ÝŒ?wןƒˆÏžTçRJî&’öÂùO ²w\vøxHÐ]ö¶V<.‡i·«K¢4œÊ ,åìúP·ènÓ'ä°7ù;«þFêSÿpÂ6Žr›^&4Ëøó7É~DwôцFÄŒ^Cœ˜|ﯿkþõw©züm†Ö?ýëœ{‹ß‚„Îuß÷׿ý­½½}Ì¿Ë?ŸÛü¯û¿a0uÿçüÏmgÓð÷=ú°õÿøó{•žþÉ Üf‚^#ï/WwÒ9‡Áü:nÃç D|DèuS¦òKá6l¾qå¸ÞØãfBãò­ó”7”â•tåŸ"{ùY)®š Û°q¹õãíÝ;Úª‰}|,¬º\‚FæOå#BýNísïÐ?ÿ÷ÿ÷ùóç£ûÈOæ6AGº¼1µ‰=To>=“‹Z­Ù÷Ûï3»»»Ám¦Àkš µÉ§O'‘_Ém„fͶ!<ö­-C#Ÿ‰º Šf†o£Ói—rûÔG&òçÅa‹°jÓkº>#¶ùênƒÅ!_á,²[wèßÿò‰Dò3»MÐQÿËÓýî˜ç„¼ü/ÿõ>|8^n3±!”t¥Û#äÞ@Ö%í¯è6ºÁ\ŸE3U$jMÔmG¼s¥cîαû³y_î6øIõ…n3úÌüjnƒõ‘³oÐ?ýéÿ·™’ÆÄ~® L ‘)ÛLšcnóhv~Øß¿®Œ¯ë6R*­4r­Œ9’âòùzújð¸+±¬l•mžï¹q5ÔÂP‡ºðêg¸ —'ÒñVúº¶nŸÛŒ>Z ½ qß*¶ÁzÇÉ}úÓŸJJJÀm¾¼1óQÝùÿõ·ÁÁAp›É6UÑ[išüwbŤÇWwì]‹Ï»²˜Ì»­c¸ "tߺm‹ ^›ƒI°VèÑï¿2Þ¸Ðs›yç>Çm8N®ž[·¨±Õ/øó܆'\«~´Þg^|}·ÁºFDªÉ3!“É»víòõõ}ÿþ=¸Í—<SZþËŸÿaýúõØ€ÛL†·F\züÛvbóM”¶6#^<™…”“ŒmæàfmÈä/mk$U5ÎHj“W´:h³‘éò ýž}ÖH*>¿á‹GR&ÕIýõo¿rL˜†vCªÈš*²ú’‡ÍÚ€¡‰Í©=ÿõÿþGwww¬kìR€“FÑäÙ~¥‘n↺Ëég×ýWLp–øÒngÃèí r’Xñ_Ma“üié½þ^±Î¥ê›F‰L®•F;!BÝ®‰Í7‚ýÿù÷Ÿ{u_[[ÖYv>Û¹—…J‹Æ3=“6\UÓ ª¦ü¦Ìú}AP1a[Ò¦C›–RwR(*ÑY.»“[;dj¹·vh‘H£ªÐÐøý—»ï:§Ûm°}ýýü|}}?)Ãzë¿ÿ±Í'ÀZ³åOþF0Á–-[ð%”à6“Xå§þdZFRãÍ?­ùøí™øTw{}~Nvþ»ÂNeºÓ#¿¹W½YyỬ¬ìâÊÆŸQ6F!4’Îoó²²óª›»U_þäŒú'ë5_â6§¬¬l†Üæ ÁY§Nêééy›?6²I{æ·âèÑ£û§š¡QösÇŽçÎûYï“æþþþSÛ˜C‰±}ûö;wîÀ5) .™íßw¬ëý¬ëm&²äàËiiiÁ: ޞǎ€õ6 ê6ÞÞÞaaa#: dœ˜õõõ¸ÛDGG£pŸŒš jhc%¸Í$hjj:pàÒ|$p·þ SWãg*·™&ÀmÜÜÜ··ùƒå·s _nnn3õ,6æ U@8Èzè”à6à6à6SN¥›™œ[]EPYY9;{ppp›ÏH¡M7yíÔªA<Û€Û€ÛLklÓõpE›_!ýäLnnnóE¼ÞçÈ`™º;/¤“µµ) +‡e Yõ0K nnn3åMtÄÑ’N%íŽÊyóîõó»îÆ Žè^-ø ¸ ¸ ¸ÍS˜û*-_‘§E¦ÈÍÐWjÊ Ù»ƒ^ nnn3ÝDºru\ W‚Û€Û€ÛL)oór:zUNÎ\CǵÐ+ÁmÀmÀm¦[®ÁÆ‹Š§ ÃézgH¦8ûÝ›ÄÄLÒßÝÝ= ÌÿÙ×ÛÓÕÕClÉ$ÝØFoÿØÊžî‘Ê>B)•ô©*{1e÷倪rP])SQö)q%:®²_]©l‰ÞnUå BI¬L’¨(e2YÏøÊoÎ/Ÿá{³Èûröt<|®æN_ÍùMó{v›èèžÕ µÃ¾‚=r¦äá#ÿ9eµx¬;yÿ¯ýeÚ¿½EßD®çr‹·””ç>O˜«Cá-Oj’Xœ±“N£…~ ò¯sÐ×ø]XFä%ΦÎÔ´X²/jJÛN£ÑÏ”YÝæŠ4~שĕ¯0¥µË¼¨öÉLy¾’èþË-„3tkq£hN™¥iïAL1•ßß@¥1.×&âh„hÌÐoÀ·Ä0å‚ͧ‰©ªDO*•qM™Œaž.Ws¦a3®l½G™­¹xçY¼(ÿæ …ÝL(­ùl­YÆm¸²å6ECkù¾«Ä¥½ë«Èdf\+á6榶†i®lºIÑÔr Œýzvlïß»­Z¥òpe2èØ/nJlsªªýàq¹#ò©~Wnƒ±dñb7·UC]‘hª>;Cþ;¢NSÃÒ¨Ô|û¤°~úôÂ\SCC#cã…n¾Ý“]rÓ‘dmmuµ´ ßô÷\lb¸  ÷žwVF¦.›‰ïCiÍ:bem}£²ßܵz‘‰Á"ÂCºr-LݼÃð¢†W­¬¬ck‰À`›óCGÂC:31åZå÷óV§XYÍ'ÊÐ Ëæ›.&<¤ã¥¥±©×ÂÊûYZÎMTzˆ‡£½©Ñ’6¥ƒY›m ŠÁ‹>Üßciis§•Pº9Ø™/kÇ•m,M̶ºEøR¢Ïœ96Ú‰ílocn²²Ké`–¦f>‘÷¾Ïv´¾¾¾_'+ò”ó½¹ÍΟ?¿ûÇdúf‰Õ½®|ÿ±··ùšn€Û€Û€Û€Ûà6à6à6ÀOã6øÙõ#²oß¾ï¹mÏœ9óƒ6¬Ouu5ô`Êéøa‘H$ßíMÄøµÿ˜ˆÅbèú”Ï¡=˜£Á~äÜ»´mýÚ•.«÷l…„ZL×ü–ji±×ï>´ßBÄš¯é‡E~Lq`ƒ¢%—:9ìqµk°<…ª¡±þ:\ü`Š Y1—„xô 3²Òüœ¢Š&h¦–EÖ"£½Éè`GA~nvvNIµÜg`Þ€)ÇÞY|ô”9G[d`bj¬Ï¢‘m·œEáÊS­>árŽÜzo$a1žç ¡e˜âØÆ¡.EU.B°$/^-ÀÔâ4WÏho¢ê+½Dºó]¡e˜Zb½æ‘YKÅøDü_‹#‹2ß5ðsëQ_,SÙ”©NêEßV)S?ì)Sª¶Ê%œoÀìô—–˜ò˜úŽ[k{P´§f“£“!zÔŠNb}_{ÎACCà ÅøæNW;ךÈ6Üo€<kÉ044ºRÑ‹onYf#àÎ%2 wecÊ¥›ˆœ¢õ/|1eT5‘—ØËÑJÀ³©'2…¾ÒG„+w„ãEUOwÇeèšùs„<»&"ÿgª>_¸Ê÷<^TòÀSÆ+/ò»Øš ‘y­DãÇúµ¯áEï“·éëßn!”Ë,MuøD¦ÐÖû˜ÒëØM¼(7~³žžÉ1á*Žæ&"ÁÂN"ƒq²PgÓé$8Ý𛮊T>].´H-ï˜\UâWÞ åt±»‡½hæ¯H)‘=‹ôÛ,3§=xQSê6LQBdAwµÎüU Ì‚žŽ)-÷ãEµ7‘ÉÔs„Û,5Efþ*¬Qæ&ý>ËÖý(^T~Ï S^TfA_hÀõ«H™ý!¦œ¿ñ^ôáöZ‰vµž8l;ö¬ßô”YÐï’fÌvôŽÄ‹òbWk“h7”¾dÉcÎþÝp( :iæì¥~Wð¢Œk.ÚÚô›Ê,è¦,ºÆLceôXÒ¬Ù·càdÀoAŒ´½­¥µ­]6ü Œ¤`$¨ñ‘ °8€©ÅB@U ±ƒ–`jñßê¹VOÏy¦\‘Ý*h¦•Î·ñšT£¬~ÈÝÀ´!÷—NæÖ o¡1˜Vâ®8nE!)1ÓØ4?æik_yÛß\À´²ÙN×UžU¼€i lz^êQ5Ã׃Ù0­ÜÛï®Åvj¯`šYk‡Øø^ýÂJ¤ýíµµµD®Î¶¦†šÚ†AQVWSÓØÒN(ûĘ²‹(C[›ê1¥DUÙJ¤•È•uCÊ–FUe¦lj%Ò ö¶aÊn‰RÙ€)Õ”mJe®$»¹¡SJ eo]mM³¸ /èiÅ”=JeS}]­º²¥½/êïV(¥x¨(“+뚔ʹ²£N3ÆQhºƒ’øá CqÆN:ú0 /}Â2"/q6u¦æœ%{‰n›¶Sž)%: ›Hc†Ž2/ñ+L9×õ ^Tûd Î8_Iä%^a!Ô˜¡[«ÌmN¥iïq /*¿¿Fc\Væ%v4ækÎÔWæ%~D­µpói¼¨0É“Je^o {ž.Os¦¡2/ñ=L¹xç9¼(ÿ¦;…ÊŒi&”s­ÙÆʼĉT ­û‹~}}…ŠWæ%¶à²´5Ì”y‰oR5µ\cáT€Þ÷·öù¿©üÂqTOeòáÇÓúðÍ›çOøoÁ{\õ¡}ûÃ/ßÅ‹ºÊncÊ—Í„‡Üˆ ð?Aôâ¾ Lyæz ^Ô^œpøð‘W­Dxq5ìx€0ñ­½¥˜òlì"˜ùwèð‘×bâ3\óhTa±2BsÆ2…q2wZ€©Džî\¼{¥%Ïd~àÉÐãwê³èž7 a˜j³ÁܦõøÖ¥T¶Î2—Õ΋í4od ÓÄL5~ é¢yUDN´5/†G¡¬ ˆ–`Jé²ÔamIPKô¾œ­¿Ð š€)¥ÇRÄ^•E ßZw‰e°hͤeÃÏU6eªã2õ¢o«”©ö”)U[e„N8àÌ'sÅüM£â¢”LR™z‘Dgº½œÄÌMSv\\Ü1‘ÿ3ýQrttR'^Í`K|t̽g9xQ_c&¦,ì ò¾HI”D®Î¦¸è˜©ù„Ö¿Æ”ÅD¶áç÷cb’» e¦|øò^ÔYóêf\| Q†>½{;&æN/¾Õ_‡)eàEíU防LyîQò­˜˜»DVÏþš¸˜˜'YEĸ²âÅÍ›ñ彄2%1!&ö^?®ì«Â”ÏrKñ¢æÒ4LYÙG¸Êý[ñ±±÷peo¦L}S'ð‡F1Kìd!ârXt ƒËãÛºíC'5K,ÎôEÞ™Bâ« 6/6£‘ ˉ,è¹\2ÝÖ%€è›/wóxÈù2¢{:˜ÐHÆUDô×\ }þÚ@¼¨î™7¦¼\E8˜›­!dR‡{OÇ Lé¸ñ$^Tñp+vð׈ éèò9út²Y#‘/ý)‡J_º#/*º³‰ËåG7‡ídªK§Xù“ÛR8TÆJß‹xÑÛ/G§Ì‚>ß@‡AµYГ¹4†Û¡(¼(+ÚSÞn#ÜÆF$`ÒæÙœÀ¥3ÖO€Ó ÑwÜšw×.D^º‘ØÔ‹NÎj`$#)˜ á ãtøA æ–—UÖ‹/À5p¦Åj’#}9M 9³sV¼®êÃ`ʽ&?Ò“AcíŠH– hwýÏyflã…=°Æ€©ÆÖL ¿%wùÒúŽ<.‰´%¶Z€)EŽ’Ö[è0E†æŽNNöV¦TmÖ嬖É-îgîår¹ʼěœL)ZʼÄ9Ífå>¼¨ùå.LyN™—Øc¾EËP™—8ƒM¢Í[s/ª{¶ƒÃå]Ræ%vk@Õ6&rw¤aÊ…‚ sKÙÂáð®*ó/³Ð£j›y‰ÅOØdÚâíá„iÜÙÈæ 7”áÛ"cÉ\™—ø›B[±÷^ô&a›ÜTæ%ž§/ ‘ç å%Æ”®•y‰o¬e±ø·”y‰çêðé«e^b6•î~,N7üFÒÙx/êŒÏïS—â+š»ÐÉ.$ì¬ÈÎήSÆ6¥ù™¯óz•qHvfæÛÂJ"bi/Ç”õÊئø]¦ìSÆ!˜ò]Q^Ô/.Ô }„²ð-¦ÌïWÆ!˜ò} /õ¶•fgç4*c›orU”âì̬e¼ÔÓZ‚)›ú‰Ã~ŸŸ›™™? ŒC0åe¼ÔÕ\,W*c›wy9Y™oˆØf SVñRgSqVvN³2¶y›‹)ß±Í@3¦,ªn†“ F¤‡~h”—¾U¯€ËÆ|‘Ù è@òÕëÍÒ!o‘›K_W[JÜåÐÈË% b© €/ô9}¹ç44DyÃ/6äœgs‘HWWÄGÃõ×d($,`ò(IOë½Ë‡t9\&UpÌRzj[Á EN?YgúA„ËŠÍ«»`²ô[óÈL&“¥ê6(Z“}‘èåôãC*¹Ã8XèrÜn@{0Ùq«]ñÕ& »MF˜ß`Žª2t™…¶¤š €/c„Û$x""3;UAš-lP3MÀTºÍ g¦žùBÕ(w¯"¬èƒ¦`*Ý&q“ŽÈl®ªàÉ6,¶1ª„¦`*Ý&÷ÊRDßBõúSàBK2wM´Sê6ÍIL®ÎÝöá}ö¦Bßûãí>"%—ʦÚ"õ¢o«”©ö”)U[e„N3é6òU8íŽY`³½[ñÂË ›¸4rZeçGÖÛô”'øùù=­'² G…îô9L,Nî«ôóÙ|./ê,‰Ã”©ÊœWNÞés¤•P–aÊKwñ"qa¬¯Ÿß‹"ûè…àC»|‰ÌÀ½Å¾;w…^OÁ‹ZÞGûúú§·‡t`×ΣDfàž˜2"æ)^ÔS¾n';ìÈþ];ƒºpe÷;L™†Õd_Ýë럥¼wê`Àî]ǺñwèÊ÷ݵû|r^T‘qyïÞ}9Ý„«ïß·{÷ "Kjg¦¼t?Î1À)¼àóÛïÜœá¿Êý/m Øš³5Y”Ù$ Ïçj.úѵ}âŒt-ôC¾¹ÎA_c†°ŒÈ‚žM©i±d/^Ô”¶F£Ÿ)%†en6":•DôW˜r®ë¼¨öÉLy¾’8¬åBºD¦óöTÊ,M{cxQùý Tãr që…£¢1C¿È‚þS.Ø|šø¤‰žT*ãº2 ú<]®æLCÂ[ïQfk.Þy/Ê¿éN¡0£•…­l­YÆmDôÛ ­åû®âE¯¯¯"“™q­„Û˜s˜Úf„×5ݤjj¹ÆÂ9D03j,€?{Ÿ™úðIZÏŒ¤`$ðƒóÿó ä” endstream endobj 1603 0 obj << /Length 1257 /Filter /FlateDecode >> stream xÚ•WKÜ6 ¾Ï¯ÐÑ:ZI¶üȱhlnÝL I[Þâ±'~d»ÿ¾¤DÏ»›$D4E}¤øW°G&ØûÕï›ÕÝ»$c%/3•±MÃ’<ã:Õ,O ž– ÛÔìSôq\e&¯U^DvÔûÙÕ6^Ký¶µf´á#áŠËøËæÃêífõm%A£`’å ÀSž‹œU»Õ§/‚ÕÀÿÀOÊ‚={©K³Ö–}\ý¹dí·•*®½D¢^#XRf<×ÁîîwR¦ìq 7\e Bg’ €rÅ|8:AJ^j­Ð ›)^EpÀÃÜÚÑ_e±åçá/,ØZiPT‘ן…P— àXyq,È,{Kõ!¢Ú5±ÒQcÛMѲ(òØ€=¯oÂ:¸ñk ¦'8Hy l8µ1HÇJDßQθÖl[©ún2®sÝ#iìhc±t×/úsä@—I´YÌ‘;(ð˾G·u­›^Ð9è…¥à…©G€2rÝ8 sæ&pè$[aï™À\Äñ*]„Á#m{“ip;œvÕS<Ù~égÚŽ!÷MGŠü-¶½!˜€"óháÒ©.¢b g ÊtíDÆ>Ùp¤vƒ­¦~¸éåvZ„H#¥±¥Ý¦Ÿ»šSªáóÖÿ WÏ 5+x&¦ò’§ÅëÅšC=çúP°g…T B˳"} C°<ç™H B2ümÛ®9'jJ.¤> stream xÚì@[Çפc—Xº[%DQPQ±»»»»» •PD}ê³»E Ré؞ovgvÙ%,@¿§çç;³wÏ™æþ÷Ü;sïAQ 1àóùVêçüË1VBèžÿµ=ÁËï~co¥ÊðËÔå2KN¯™?iÚŒéu1uÊ”½¯RšpØEÛWÌ›VÃë´é󖬿ó)MJ_°ˆPLèi—Oìž7k&VpÁÒõ|‹ˆØjÒ‹+s&M”¶9uÖ‚Þ·>4±|P/œŠ¼yMU©ÚuBU×íÖ„õ“™5 ½‰¦––¤S-*USC]¡µ|ßù'h,‰8„Ïyí»N_U‰LQ×ÖÕ34Ð×ÒÔPUVR·ô8¦P2^ >·ÅPUYSK[G§Úª¦†…¬¨iÜóU\Aµä€ìÀ/S›Ê¼ùÎæ*¾OÞ„†Ô$888±°² ë$¦6Ž&:vþ÷_ˆ¼úüÈŸƒ‰® Yk•ß[Bø¼·§f*)(RL]öú= øúîàÒÑzTUŠ±S`*]Ü2ÃÔÆ@QÎrþɘˆP‘ÍOo_ܜѯ“¦š*ÙÀÖ3°PÔŽ¹€_ª6ʆÖÊêéWw†H¶VD¯¥Z0x§±½ºE:.âKv¯0³bjcèø*­ ÆûIwêʵVê·¹Bøivib_s] #‡{±åbG¸¡k›Çi(+;o¹ŠÄC 6 ²6ëoV›Düå#u4(Ö®îå¼oöÐjó$±¬ÎžZm(Fzz6‘zYV˜ž–^\É«–±HE¸¹™é9…5G¬6¯«ÕF¤oiÃÌZ’Œçr›JâŸ[ë)šw_^TÉ«¶Šÿκf¢D"©Íd‰>O¨Í†[ÕæÉᣜ‚iN¦d]óC/ÓQø-jSolƒ–$¾ݯßÉ{¡…aÿss23l{­˜ŒÊŒOg ëìhkiießÁy¢mq¹X‹Eð؆"lúSï­»wjkmeÝÆ®G¿'ï†0QTWlƒËCiÄ­Näfš#vU ÷¡4ª±íȸBfµ¤ÿÊ#C>~ŒãÔˆmDjS#N‹=9’$GµòŠ„ð«ÔÆÈ&¤´Þ2a·µTg­^Õ½6©¹’‰¹Ómš`{qÄmW{S%9—aÓ6n^?²›u«æòúVýžg0Dµ›í³Ôª"£dà0Õ†U &Ped)ºæóÜââ‰Pmt:E–°%="ásw“W;ü(šØϲ”aVÚd½N}&ùÜûX]©£yW§ÚˆF’¯I¦Ãص…ðç€_­6fdªŽ¶¶n ´UeGì ¨Mø]K]5 5µî[‹ÄU›—·z„•¢¼êâ ábkÎÔ§ÈZöÛZÆ”K¾¿R–¤`9hISô¡ÜW½õ›«Ú_ζÁ²8šRµµ5¨ZZZT -ª–:™L¦PTU´ç~Ưî â'=9`¡¦®©©©®FQV¤öŸ²âö›ÏÙy… 6•î ªGmˆH†K{ÛŽÔÌ`à¬üýà—«–Ž®®^ t)­û全a›Á1‚V Q©s‚Ï‘Zt[p’ED ÂvSEöÂÞÖÊzm‚Ò*PnÉg ŠAû;±Äm%ácîí×Slæ¶æ !ÔFKG[WO__Ê·Ž¦–N;ç7C³$£–â´ÿ#›úv¶ÖÖÖR£¨***jꙶwrÛyá­0XB¾Ûˆ¯ôcÇ–$~3bÙð÷€_ß’jVVK*ü®…zëŽÓ—³ÅÏ´ð‚›ßIuéHÝRGJ Òœ\fJÕPÓöŒG¿Ú’">Vú~S+’r¯iûðç€ß¡6õܯV›¾›ÎWŠƒ„sgY×–d½!Sm\¿n­4+W­{—ÏHÿÐÖ€lêØcÅšõkk²rËÞ e¤î;à›M‰7ÖReÛöæ¡è»‹ û™~çc”‰”Çk‚#•"7xóçúÕFüŒïÚ—–½9Ç‚PÃÿ×jC´¤>x'É꾟$¸/$F\yù|Nqls5«þK Ë% <©fQÝÏÛ"pp¶žj3—…±×Ï<Ç·&)/õ~Å“”ÑëçË»hQd‡n‹®Cm¤Z±Š‚:Q©&_$Ñ@làÿ=¶VÑüÏW-Z´ì½ø S´EÐÀ¢g-ìe¡jd–ËDyôU=lÈï'ä£aDôí½:r¤á³ùâg‰;¼É,®Ñêa¦½Úž*Û‚| \°cA—Ì4:NŒË¯ªu aCl Ud)'’¥[RïH–âq˜¥¹ÆX“Õ(j«äƒÖÀ ¶VÓÒ½“:*)k[q¶ ïÇåóLUjÑaÚÙ*¡.åì×l&£ç8üvº$¿8ã¨Gi­çú(¾B` ¿'¥kÔsÀ ‘#ª:¨Ÿ­¹¾’¥Ï²ó¼éÄ*Ù5Î^FYͼý€Ã—žå” DŽSQôî®÷ðÎ6jª*NK.‰% •©ïÐmô(‘ÕáCûöt1¤j)‡ ;Š˜Õ\Ð䫧2q¶êföÏ“èõõcJÇ6â!JUÙïGtiG¥(’Z«š™›*6o¡¨¦iÖ}n<'¾gýàÈ 3]MÙV-4ôL µT[Ê(ê™Ùn½ôðÅÌál­oT cÓvÇ-=RÂáWûcfnœÐÍÄ@GUQ®‰@FAYSϤÇèE… Dt »¸Ó\KÓÀPʤ©¥u§nnó¶ú ä ÁïÈÃE¿Np7'%>:6¡‚Å«-5ø†ªüd¯c¯¿‹æT·>½ دʢ¬{çÌ7rÐàÁc&Ï=~éQn9»zФ Jsâ?<ܺlö𡃇 ¹dÓ¡À˜,D`G'!ìô¤¸˜ZÄÆÅgäÒª¥MÜÌ«J ðÜ¿eîŒ)cÇŸ:sÞÖ§C¢é ¥äó¥ùqÑÑ5L&$¥ÒY"›ÕÀ¯ŽmjüªKpø’â$ª¥ÄÓzH]åÅ£ÀQü†u-Lj„¯¯tžð%/ùÉZ ˆèéA‘âÀŸþ‹‚$±]·Õ!M5…¬.Ë?³7u* @keLøÞOñëµò;vF<Àÿ¿Ú \æÏ•CFM½û)ý>…¢Ü¢ˆíÓ†Ž˜÷)¯ê7í;7ðøÒa“æd”ÁÃ6ð€[é½Ð¥…¢þÑûÑß­4(»$a€‰º UWSµÝ­¤Rô·¤JᳯÏîØZËâJ Lg¢ÚI~ã«­¨8xÑÞÈäÌJï÷4d@mà?®6Õ“OÕߧõø ¥µú¦3¯ù5F4ðëuUG‹Ø‰ÔF¾Äd\µJJŽ‰àס6uåUOêNÈ¿Gm$“3 ~0‹âⳊ*jH@^°7¥¥ÚîKa5¢ÚâðQ™âĸh P¢±ä(O­D$"uߌ.—T¾Äþ! Zb|\j­†RŠ-TdÆÇÅgЫ߇~føå±M€ÿ²¶®ß$W\Þ6ÝÖÆÂØÈØܪmÏq«?ç 2. U™“Göhok¥EÕ²°±µ6q½1¡—îC¦¥s‰)…˳çŒíÕÙÙÙãz¬X·2üV:ttê¿êAíØ&?ôv—¶öÇGf½:Õ±¥~»Ûå(3!À½ƒù¤#w ¡(Í ۽৩kÅ6X nUžçŠ1v6–ÆÆƦÖ݆?ˆNçIL\‘óll÷ÎÖVæÆÆFfVúÏx“ÉàÃð;ÔæÁÑñÊúvû÷W”Qu7wãú•ýM””UMû¾O¯DY;×,5¨«&E³³Ûàqcç‡äæMvµU׶¾—ƒ×yZê{GCªºº†ÕàÃ"MaìqwS%k­}[+üA³/hÊ©/ܼÚÑT½µ¼¦m‡¾Ï*Ѫȇ]TH®.H†>ÅYôUÚôÞ^USmzÁ.I×ÍBIIÙÊuäæ]»—Né£Ü\Vj¹Å?Ÿ ¹èù+-Š¢œÚÀ+öìÝ5cx Y׺wtbøõjóðÄ$M²šº–é‘ç¢y~QÖ¡©.ŠŠj×ùás‚&¾"ÄŒçøöIAr$•31ebµÙ Ta%eÌ7m­eÕýàA¿ÜM{É‹½ª«Dž½ý&%>Yk .×géS´®SSró.‹/2¸Õ¬U$pE u§97Q³RDƒ•´¥%‰Þ9M­9iÙ«üjƒkÇÓ}nrÓƒ÷ Дkú*#O Å‘öFªN7`òte~OÕæŠÇëÚ)5¼ïKbnÐU›ì3eÉT}css3IL µeZÊ \xV`§"ýÄêÉmu•H¤T=cûÎ=¦/Þtýe$¿îMhzµimìù8•H0‰qÛJ3Òª€‚šj#,•þÑ_WQiÆžk—wé¨h]|ŸŽri³:šiÛ)¨HœêbÚÌpvy=» PEÒwY¾µáMmò|¦È¨Rí†-<¼×Ni¶mßyñQ0_$s…YI®¬™;¶™ºª²Šºéæ‡ñ( ýÄðúm”ZÈÏóyÁ•š‘˜¾{f—V$­„Òj#(À.ŒêhLn?jÕ5#”uÛ„æ0P”÷|m÷–Zmý/Ÿê¦/çºý.ŠÖÝ;"ŒmHCöש6Ej#ø`aÊ}{}UÛ:ûm"¶´–£tYö¤Žcä ¦OGxœ²ZIY¥øî;—]w»ºš†å´Òº‚.šZm4UM»/É-çŠK•|¹ÛM«y ›¹Ù‚¬qu´¤Pnù¦^Ö†útÐ1±ŸV(H„‰|Ú§ÒZ­“óCuŸ7Ih=5º¦Úˆz‰])$çµçx%£¯m0Ô’·ë[g/qú Šœ¾Õ0Ž¤Î°ü§Ø‘ä©û_eq²£»QÔ,J%'÷TSÓÐê jM §Òks3½#’j£¦¡AQ°ðHV“Íbe|~<ØÉLA™ºØû5QëRÃÔæŒèž”0 ÷™Ð\NMS¥U×¥w9ŠË+‰¡CR§jj›uËe õ4Wð~›± 'ñE_ƒæ2c£J ½a燸wÔ¡j(Ùá± Âþw–c Mó¢ ñ=øtnEYÅaàüO)El6›Ã®¸ÔCOMÅ¢ûô4:eæÏèÛ†BջɯˆÁacVQxnå(M Ùbœ M)hBˆ§oÿÙ0\ÏÜÑçE‚¨ßf¢ÅÊ}Œ»µžrófr:Zª$R+5ªvO÷-,^%£ž$·ÜçW« Z–ôÈ^®¥B ¥M/S‰üò=S-)d·õ¥ÂÔwu†Y IƒEj#*U´}Zg-²ŒzÛG¼.øßÑÙH¥«{O+µ6½ñ؆ó`õ »nwh(žëŠ]¶uj_5•f-d¨úFäÖ-d”(Fý®¼ÏÃ<;îhª¥®"ߢµ¬‘±‘J늪dÓC?Ðm-¸" IA*K 2³rÊÄ£0Oh%oí÷:-åÓÃm«N2u®Çª ÷ßÓ˜¢|»|´4'æÊÅ«á‰y¢Q™BábÓ_]9}üô•Œ2–H3ø‰¡O½N¸ó1á×ÑiCÄûÐÖy³¦Ož:9IVÑÆ÷e wih*¹‘jºÀ]š4¶©ÝëÀ·áóñŸâßpJh± H M×ÂZFRJ. Á iÚOÂÊ¡MìÜÆ}½7Î M 7Â0†Ïãñã_ÐU%Yá j@S@~µyéì1ƒºé’ÕÔ) 64EdƒýÏîãfgéÐÞÑÁÖ†ª¦j@5¤Ä¯™jÊcAmhšØFLIÜ sPšP@mµø]j#ý2_D=ëh}ëßú€´‹Fôȯçn¿ÆIã×:„z@mꜚUë{ëæO@V ¾a°ÑŽè‡w’ 6_#îµçRå—_Dððõ²÷«<–lÜíU€¯"—Nì^¹jÃË´"|CQòÓ kVî<òOQÁòÎÞä1o]x¾Î‹ ¼´xÁRß—‘ø:»<ãÀæÕk·Î,gá[¢_ž\¼pùÕ€(ÂcÉ» —lÞwŽp€”_8¶såêƤ‡ë׬Ø}ì*ƒ(㽃Çüõ_ˆ=àF¾¾€y<ÿ&_}xtÑüå·ƒ“| _/›¿dÇñ+¥ÄÒ}n]µfKP6 ß{{íªóW3~Ì6l•ÜfT!ÙÝ0‡GCRð Qwf` :L!äˆóÚFÛÐâ¡fU§–» N‘ç B“h´"5SiSŠŸ3þ©…&X~<¸:? NUɧ÷ïb“s~mc‚Q’õîí»Ä¬"â{™ûþmPpX ŸÏIˆ {ÿþc e”e|úð>ìK‡OQûùS`À‡BB­’Ü„À·ïâ²5â±Ë#‚?| þ\ÁæáhY‘oƒ’rˆ(+7èÍ»àð8&á‘ÿ%ôýûO9b¥é¹Ä„•1ŸÞ|,"Ô )ÎŽÇ<ÆçjTþ%ðMPjAnŸÏÈz÷æ]hd" ·°c>‡|øœWÁÄíWÑR>¼ŠˆJ!ì#ô/!ß~¢ç——Ÿû.0(1¿ /Ïe–„}zÿ)$’Á%¢§ü´Ï˜Ç´ÂrhGÒý µô½è÷½_ÿ:Þ‰Úô›Ðþ7z‰¡ßàÛTg‘ªqƒ'€F›úFü‰ôô 1”F˜Øûͪ, ~}çÀÖµ‹—®ÑnÂþ#Ñ7] d¬Ö\³4v4 ü§BÉpYå™i©t&ŸH-8 ýÖRe=.BK hD úzãîÛwý½Ë½G™™YglCôÞ |Ñ $íÓMg} ­vÝÃs 5@#R^QѵßÈ! ÷Ž\zø¯]úÏØ´|媿:ªjJvLÐöùÃuUä Ú÷¿ü> B_ ‘Õ¦¼|ܼõ^á¬óÑèù˜¿qñ‹A¾*ؼuÛßÙqƒ+ Qâ¿o© UV^Ù`ʺ)4–ðI¤:€ÆP›1³WŸ¢Ÿ Aφþ¥Ë¾‡™›¶lýëÄF»p cWr$µ¤ŒðØù1>›' wÄÝ8jjÓàŠ²KÎì"GÑ=ðà _²Y%Yæ'ìþ‚ /5š‚MŸ¥ íÿ3…‚Ú|]mþà/wüÐh‰Újʸ.½Ú¸‡/˜cœžŸ–šVTV‰àV¸©©Ù¼yÆçåe§¥g”±8xMã0Ë2ÒÓ²r‹x¸rðÙ…¹™))™•<¢ö1èEi)©ô*aÌÅGx¬œÌôôÌ\ÁkfUY^*æ+@x,OOMÍÌ)¬ö˜›…y¤W{,xÌ+{,ÈÉH­öˆTÑ …ñYÓù¥¹©)i´ &1„ŒCOOIÍÊ+â;È-ÌÉJËÈ,göÙŒÌ~v>G|€•—…ƒ¬*âÑ&¤¢¤@pŠÊ™¸ºð¸ŒìÌôŒ¬|B¨ME æ1Vɵù“Ôfó¶í›ÚàD]Ýa¨¡jhmÛÞQ ;[»9çß6Äò“Cn$RË©{þ%r&äxÊšS-éUx\-åäÕ÷%á’ÞlÕT–µpšB#2¼DpÒ"‘T®âﳜH"5±ŸÈ·ÂȶÕU"ët - 2¼ÜÛëŠyœ}ø‘3!ãDKI§Í°dÂcþX3yEÍÉ ‰¯6¨+ËX9O/! „´× ‘Toë¬Û‡Æ‘HÍÇ}€¯_ÚØ ³¿Ìï ‘á%~?‰D2í2¸ÉÉâ` ¯¢w6"ßûh±ª¼Œ}¯eD@2‰¤ù€È ÃðÝ438åÜ|½4í™UAÝÀ5¾ŒÈðrnµ#V`õ•F>)PlÙû c¤)oÞ¼}øðá#!ø ìäüáý6(è·­sûöN;H‹£};»>¯$ þ0ï.Ìlki¿Áç Q÷ ®µ·°í1hA¾ŠÐÖLÒÁ©Û¹"Sfˆ§kgÇÁî뉺ÉOZ:¾‡•Qç'%¢ºúÏZk³vKÏÙ—˜EQ£zurqM#ò3øNoca¿Åÿžû ÍûÇÁ¼ÛðÅ™„˜¯˜4°ƒSwÿ/ĆôOÇ»uv:i#Ø¥¸£]­M\ž뜗VZ›Û®¸D¨Áƒã¬Mí÷ß !Ô&í|[“¶§l$^q =Æôqrîu=ñ¦¾Ýãâä8zÖNB 9á“û»´1ïþ†ÈfǼu£­•ý†[¡DeÌÒ£c×¾SÓÊñsÆ¿uxœµ‰ý¡G_?â‹Ô[öÜOwíÞsÛöíëE¬÷‡wÛ üoù¹~é>DzzþJ¯"½k|éò»eòÕ~›†yä×åñ[öù ²_³ßFx„R!¶ùCÔæAzO·Þ{÷îݲeËV![„$&&þñ±ÍWŤ¦ÔªeŸ/ý^Í,VRU®n[|éV®ô¯¦ôÈÿ–}þOÚ¯ïP¤K,áè¡+w'ï÷þ,],D*b9"µ`[¼#x‹<<œl=BE$ÊühÌó·«è«ôŒÇþ/ZR^áèÜyn6}·žŒ%:a¼>£«7Ï×·»+ Ó"ä| ×KÐ\ÂÞBΆ#ç£yÂþž_4+ïÍõ‰À>»ƒÇBB ȹh®_ ×ç3‚·•ÑK8±³à.Ør.–·`Ú3ÇgcQ¯þiaß(¢Œ  ‚7Ö@m¾Wgji ¿žíð[ÔfÎ,g}‡©»BÐóQ¨W˜`ãñW9ë/GE}¯ŸÔ5n»ñ1C´D {=wª;,<ðõ¹¶ŽbÚkéöºjä[“wíGq9~.V¢x¾J>b€–Š¼’¢jÛÞ Ö?­ò C½Þ&ŸáŒIãºtš½ë=záKÁ 'ªŽÃF¯tñŠÉškVž‹B÷yÒQÖ™öO– îä‘fíœú‚z…r×ìX N¶^r»ô|4zäÒ=%ê8¿´óá?Ö˜úkc=ÅHºš¿õ#ºÝçʼ³É>‘‚ØÉ+¸¨·i«‘ÞéþѼٓF˜:Ì?.ØÞ® ×gŸŠÆËxG²Y´èw2Éÿ3úC¡Ú_ª6ø¬}‹úZ*kZmñ}&ÜÈzqnS]e½N³sª¸’­-ø-±°›…ïÆ÷þŒú'¡ÇŸÄÌZ¾ÚÖÆPÛzÌÖ÷è¹õ©Í:%­.;^1¾"«Õæ€ïMM·í•‚Ü!‚èè\´ OÆ;Œ³ëŸ·ó·Ÿ9c‰“£YÓpì9)µÜ…Göþû~ÁNïQ³—;;Y‘Õõ{‚Ú|ŸØ›HÅ wÌ”IçùW§“B¦u’׶|™L‡ üîØ=\0Á}ÖâÛ%¾ax?-z>=|é UÃdÒ‰Ôs·N‰ÕæÌgtïÉ¢~%ín»^±ÎK©Í~¯uš½w¼©$nf#'Þ–ŸþÄôX2ÕÀÔ¡Û¸U“6ú¯ò}ãf¡0Ê7C:¶a¯\7ßÀÄÖeôò‰ëϯðéo-7b›é·)Šz8¦oÝÏq¼Ã«ôYíÖZÓüyB)Tà÷÷‡–hÓ²óÂgçãQÁ]'a'Éѵµmføbj£kÜvÓ#ÆÙ`¾w4ºfÍ<Ší|QlÓu'¦6ұͱ»wÍT´Þ*jzìþ;‡Ž=Þ+ì¤Gí·;kšy…£Þ¡e}L[ÕP›ÓAÙ]Œtz¬}âõEÐ’òF[¶ª úm¾¯)%œúÁ£_^îeª¨Ûev¶`;è¹~kKJxOjÃÞõêFýù®½¼íßЕÇü»»X÷\s0õuÃ@M³×òk‡J¶ŸõµµÖTµ[¼¿>µ‰E½ƒËÇ hkÖmÑškq{o¿Ú×N§ãšá¥=¬4ì&Ÿ=ø–qôIÌøq½T•©CG^ˆAgº0j7vïëŠSï‹úÛi[Ú¿/ êØó„)S•4zï ñû½ÄßÛˆóc¢hîP5yuMMM ªy—‘Å\àÿ ¶Á#îºm« µÕ´ut´…Xw[¸/ˆ#èÒ‰Ââ™IºÚÚZTM-ÓnSw×ë¼LÛlPÑí.T¾@mvŒÕèzBp<=õ2º[' *U[KGÛÀÚmëK†wºóÄASmU- ªAŸµ/fLn«¨ÜvÞ¥ÂÝÛkQ5¨šÎ›¿ ü|-t•©XM]×å/ÌuTQ1Ÿx4álÄ4¦àYb¡¨”\¶ÀcþÌ^Nm ÍÚÍß}¥œÃÁ~{/1.8Þ‘¨okb0±V•W(Ññ‚5Ž?OÝ~+îD0z.õÞÉ G/%¢â§þ°æÏÅ8ÁH|`æ¹/ü÷cwÞM;-l Të zö}ñΛQX˜‘Ó*wÝI>þñŽB<ŠÛq/Ë‹²>£^ËvÝŒÚÿš•9ó‘¹ëvâ±÷<ˆm¾³!UÇkvÙ®I]äUtΦA~{¿ÍÙPñ¨´Öpþ©‘|ñhʯµ<+1¡¶ýº^óÏ~« ¨Í·šRüÒü´°ˆ8:“Çç‹L¡YO=-d&ž~øP˜ßæÏàé‰Eò-¯~ÎÉ@m ^ø´Ui=îÔÓŸšÐú³-ñ¿7Û¿ž÷ëÉ'U3jk|ß*þóöÑoä“âC†P›? ›8õéQÅ–C¶Þ•¼¨olŸ¤¨ qüi\ClsX%%%•,6QovYII)]œ ©*§—”–2¹<>‘M‰YVZRV^EÌ0ÎçU–—ÑJÊØQù8¬ªZI‹#º•Æ+/+--+çâ7Õù¡«ˆ(a•bË+y¢›oµ=–JzDy•tl%=Vb+EÙŒr̃Íí À~YEBˆR)Ü!OdŸÃÀìÓ+¢#âV`GXB'úÃñSÄ%æEG¸˜ÿRz8 > óH#<‚Ú€Úü×õ†Uš6ÙÉH…j´àÐr¬–ñè×÷Í6ÔQ5¶—Fç4dÔ‹SCUåÕ¹MdxÉó¥ÊS,:Œ!ÒGñŠfꨭcvìS ¾!5hŸ¹V‡^óK‰|R±“{Y*¶0¼U„¿Ïyî=GI†2ùø}|QÖÅFßÈÚ-¢¨ßòøè 9Åž Y^²dk—I©„ÇÂéýuôÌ=C‰ ÉowšPú.$ž+B"Çu3Sjit—Xg?<9CI–2í ã]ÛÙ[©µúú‚ˆ /IÇÉ­Tú/$ºpòÜ»·Ó1´9IdIx¾ÆPG«Û°•¢Œ1úÙ©ÈZ<哺´Ë]UA}Á¥ |½,ã•“¥Ži»It"ŸÔ¥-=[jl¹ù¤@mþŒ®›üØçÓûØS”dZ·jÕJFAE½ëp Œr´aw¤žŸ¤ØZuî¡[DÝÏõQk­lj?*QT÷gôo¯A5:ò‘P›”ÀÝÆ:ê=æ”j3¡»© Iç†Hmž)×ByÂÑ{bµél¡­oÑ=\¤6÷Wh¥êqòHmÎ[*Y8¹‹Ô¦`jo;M-“!"µ Øf¤­îˆéQàËhcY’þ"ƒûþ‰ir-T¦œz‚¯_ÝÞS®9yíåw"µ9ªHR´í3O¬6c»ZSu-Î}!2dÅ?]¥KUw¼\¬6½Ûé)´4yBä“bøï«(CžãÿN¤6/Û›R mú%‰²×]Üä*׌¼éz0䓵ù#îJ‰ŠR>ß»yíÆÝ'Iy•¨8ƒÒO]âuç“âK­64»Sí|Rh{üÖ5(Ÿ ù¤@mþ’çmêí±ä7‚éšjDVO …|R 60S(€Ú€Ú¨ ¨ ü‰{Ò”µµ€¯@£ÑÂÃÂj(¨ ¨ 4:>©é™ï?pÃfóëz ÔÔ…!¡3w^^pôÖ¸ióƒ°-›ó?Ó¶µµ©n¡Ñ2ú•gÿÍ ?z€h÷šÿëý*Mf?üKäÔ;âÐïÊ{Ž]¸y˦Mªï?‰ 6 65.Ü:^7X*ø?³+õöü|8_sä#ÚÂõóÇØ8œ<{náÊÍ‹×nkŠeéºg-ž»ÿ†o¤ ÓŠw:÷àQg¾zùü'ºq@m@mÄ5¿pŠ³â^}ŠbòGºj<…ûcA–ðƒaw<' íå`ïо£ó¸yë?¤ÓZ(„#/+öqµ°8«„Õ‚óóÇØhŒŸ³|׃ÌïJŽ¼.m¢Åó#G4»‹`š—ã•®#f­[³òG»q@m@mÄGPóßö2Ñ0/×P›ïýg÷=ûCéï‹ö¦"ååh'Syy] û¾öéᬯ¦,ÓJuà‚ýeìŸ o¸ôUõ­Ç¤1~Þ^yMë5qIDùïŒm&Î[uôMaS׉é¤/°PgîëCGŽŽüþ ÔÔF|QúOªMõE÷p¯‹ª¥ó£B©ŠXc€DõÏšV°yKû´£(“§{Í]ϼÊÂ¥#Õ(χHÚò-ÕƒY=×Qá¦F| Žapêé(YÕNZ,¹öïG²]ß7¥h­ñÐËôL˜·êH@a“Ö_\a$çÃηÉ÷ý‚¶uî{åê¿Û€Ú|§<ˆ«ÈÓ(ZF¶æš¦?¯6Bc\vAaÉåMNd §ËQ´¢ÒrD\y¹Œ‚ÜìÌÌÌœü"Nu¥®Q£?¡ÿtÔni2ÓGr'¿8ÁΙfÔ‰x@A/ÎOÍ,ä"|Q”Ë®ÈÊH+¬À'¥AÊò³2òJ0eáTÒ2Ó3è\>½0/§€ÆåI ¥äTåç`{••WX"Ýó*X©,+ÎÎÂv93ÛgÑŽ \v~A‘÷Jr;·Ûq´â²Jq.c.ƒž—#øDVN‰HèßUmêVž0ôL(ÏãØ}·Þý¿³# Ôæ/Wq5Èz¸C]–ºØû宾JCÛpr¢¬ÕšÉ(jêP5[‘Hf ߣg}X5y ¡†BófÍTuÌÇÌÝø)‹#–’† _úÚ©4o»ü*ZkÄåËSÛ·l9™/ŒTŽMéNR‘Á¬¾Ús>ûb^{E ¶ðÊ·u5Pë¸$=&`š› ¶3R-.†Šæ#S±–”ðôì÷+'÷×#Ë7kÖRËÔaÎ&¯\ž¸×‰~ÿô–>N– ­š·hÑ‚¢k9bζϹ‚œ¢ì¬/–d’œvŒê-I¤nk½ñAÚ©oü'ìBU’mѼ™œŠV×ÁS/$ñ›òN߯T\jN#ÞüïJœN6tNN†|Sp@m`Æ ,.`f¾q3UptßÇFè«]d¨6|6#êKÔ±ÅÓöÇžFÅeä -{™iȨ[Ï_·ÏïÂùíË&k**š;øBÃj=RGë£øãж%5³Eû.¼H` µZ* OÏ@Ò%Ñ“uÑ\µÙx¿8áôzûXhØu³3mÛmÈô ŠÙ»úZj¶Ÿœ^,@nêƒÞfš úŽ+võóó^9uª’b×ñÛJ1DXOW‘•ë4tÖ±³ç.œóZ7 UAÖ~äv ᳫ¢"Â÷ÍmG±éâõ<2!«sÇ9a¬ª¤eÛgË!O¿ƒ[—Øh«iXºEäV4ÝÝöIóמüXæ…ž/Ñèù˜Æ\¼Â«CšÓ!ȹHtÚÖ {ô›5sÆÎ;±ŠóæÍIµ©ïPAmþò™B…7SŠ× ²mi9%Smu—†¨Mu‹çÞoS„«GÅ–Îd-‹c¯SÄWc”ç$UÍ~Ûj‡6xÔWžZ*5 }‹öGÌ\yëM4Gª79=oIÇ=SZmÌTš©Í¾meÈÚC—{•áG„”oëm©é0)½ûLÙšÑÎdÝ6WÃòˆÝFJ×릦×öu"[ž;ÓASÕlh2Eè2‹~`L[Šq¯h1ûÞõ-Èv}ßý6<¿qš«š]‰Ì®¾¡¶s˜<ÅÌ'"½éúp†Ÿ6uÝñ9Û¼çn÷Á—Ù[½&­9:quã,“מØ÷( k7ájƒ©™ƒÛðÇã•e‹OOÏââ⯠¨Íß>wŸ{{ÇŠŠÑõÏyÂŒªMݽļ‚Äž¶ºÖ®có™’Oˎז1°’/U¥ž´a&^?w|Çô¬•eeåÉXláöØR.Û|[mÚ(éÛ?J.é‰XmX¬œ·¶Ú¶Ý§ÒxÕ‹Þþ»yëÞàÊãä¤&¦dÑ$ŽŽ±gTŠqÏH‘ÚHô „Œ–ž˜’É‘8uÁۆʫ™ž Kkº¿a\lìƒû÷=| ^®^¹2mê÷ñãÜÝÇ7p™à>¾ÿ€×9^ˆGç¸ÞÖ¡ãÜ9³·o߆×qeÙ¼yóöíÛë}¾ Ôæ¯mr>ù©ÊŒ?@TnÉê.rCg (Ú°Qxjƒ–¦|è`Dé9|;Sz†(¿qZj&NO«êŽŽjvØ2‹îxnìlc¬¥¥©b5-ÿ{c+5«¡ Å•¢`N¬6œ¼Ä'¶:*=¦\àI܈’Ú>ª¢'„xÙ1Ë}˜± i¢EÏÈâ:ÔŸŒËªÊOº~îÄŠyS]ìLÔ4¨Ú:fM¤6õýu°Còbn sç{LÙäëýuì5ªk—.Û¶m“´\£Ê`>|S•:ÃP›¿»—˜sfYY²ÕÔy‹=<.\èá±`vs5ݶ¦Ï_4mã­†LO)©6´¤·í ȽÆìg‹û¥…W⿳(FvwJk}"ÜÌØO_–0y5ˆ“»cœ:Yaæ™Tl³´ÚoœGùK©ÍKõ6c’Dш¤ÚdÇßµ¡*¹Í¾%@©ÚËc>>³®YQEÓ¡Kï Óçï:plÑ õºcÁç²ýút0—•S6o×qظ)k·<½ §Û„§ýÊ?j#«Í‚E]GÌqé5dÚ”É{öìÇ3uƶoÚ´iÇŽxOÄ6 6’jsãÈ<—ÎÎݺ éÖ­[WgK}um#óN..íFŸâ7’Ú02£»Xhvì?—&~úEX=w9)h›õŠ¨ÝEÌ«ôYÕ¤ ÿ(–Vã!ìgü«ZdŠûšØëÓóú“t&j#4šýî˜iü·Õ†MK êhDqº!1ü€_uóæí°ÜJzâCkªR» JÄ-*nÕù¹• {Ô­6•ìŒ l:ý’'VÇ\ŸÉ­UMþÓj³xñ’î=\±F,2_±Œ7©°<ÔÔF2ÇZ 41%%åEiK;ËêœEc”Ò«ø èÙ¨• ÑKÌÎsw±Ô¶êô2% f”—¡¢²Íè5žšÃƒ›Ë5e†¬>Ϫi˜{v¦#p¬{@ÇŠyÎÐLÑ-†S¹ßØúÜÙ=]WQNNYÛ+y9Y½¶=. äáÒÏ­¦$Ûš¢clgk£¢ ä:~ùáMc囵VQ¶ú7S vo|ç( ŽQkôžkíº²ÅL]V^EÃÚÖNGUÉØiÄí[¨¤æŠŠºKNÞc7}lƒÛ/++;sæÌñ¦¯,x}ÁDfÆ XH“——÷õo(PP›šû!x.#¤!UCØÌùòìêž=‡‡$W?øÅ) ¸y~ÿþCW}`p‰/@~í¨ OÓÄcU¾ôï±Cö>qãéÇ OznAÁØ€›‡ìóý÷E“‡'íEÄ÷щéö$µÿÁ*xxùÌþGî¾e#ÄÐ*üø˳"Ï<|èä¹è|ŸÿKZRâÇ]šìì=}útãÆâßÏŸ?¯ñ¤ ¾,>tcʆ³“ÖŸ©½L\ë9gçÅù{®4î²pÿ¿óöüÓèf¿™´ödn{@m÷¢—Þô“:VÇ0ìj1‘¾WU_ùïõPÛc­¤xÒCÜïµ¹ÖxwÉÐíO˜+P¨6<À¤&((¨ÎSô•³øöâ¿K/`ËåKþî“gôp_>s÷Õ;.‹—é;.ÏÝÓyФÝ» >lø°¡¸Œ‰™Ò¸6p¶lÙ²Ú*Ú@Ím¬j¤¥¥Õ×üýw%ö=åqò©Zjù'¾É{áÂ…»wïÞõÇQû IPøŠn40ÿÎÎGæ¾ïž ‘ZÎÇ X‹cÎÜ9’O)ÿI@l¿¸kH¬6ÒóZH©Í¨ ü@m@màÿSmð{î›6mÂ~&$$üñqñ·Bæ?ä6 ðÿÙìú!µÁ¤fÛ¶m<ÐØrà÷yÏÈÈøãÅFð]žžŒ)k¢ ‰ÉL.R4DjÄOÔ—ç‡Ô Nž”x)ìGå§KµZY¯¹§øž«A)“'OÞä‹·žÄê!œC¼%—º²ƒÚüͨs?ñE/ÐÔÝÍŒú5Ž—½E5ö@*I¦Ty~ݶê˜ù •šÓ©©<ò¿eŸÿ“öë;)ÿ·7y<Þ<¥sö_¹[3Jù¹ÔæOåËcì»ø‡f£âœ¸(ZôÚ§Yfä‰'èOÍZcRs|Šc 5@øR³ט'…/. ù6"U‰… ׈њڣ”ˆÔa¿Žüžßm¿Ö1àG(åñÿöºpá‚óð¹>_ÐÓÁˆd`jÔЄüð«æ”æÖƒÖ$ÏÛpËÒwLs•S1»‘WçwùwGÑâô°gO_D§åõ„•ýòɳ€ ˆJ¢;:$èÅË€´R"/oUIJÀ«ï‚c8Ä7zÅ—Oož>~ÇÆßGŠ2£ž=yþ9½øJe•}xûêõÛOe,î±0-ôÙÓç1…„GfæË'Ïß|øÌyŒ ~÷ò囌2bC-óÃ! ”G| À<æëHaF$æñKžÁÍM~úäEBN ¾ƒHeÆóÇÏÞ…Äé^Öço_¾z“UNد,JxýòŇ°x.Q 4äÝ«gOÞù,x9ÉŸ±ŽÎ)ÅEË(~ÿæe@`H%?~NÒ'Ìcb^ÿÿ5¶Á÷êС#c–ô¯n=Úu\)Ü Ÿ%ýäìzݲ{ÿ¾Ý[Üû8È´R³ñ*iPüþôhßV$¹™û¯j‘sF‘$£g3”˜ÅƒW8Ù­­²ªöÁ÷Iø†ä7;tÔ•l\¦—u3fŒ³‰¤ö/¡.œ'§¦6#µsè¾ÎÈ q4¢h:‡öà@¯–$¹¹Çîj‘yJžÔÚÐ~4ñ`¯À½»µ2Y÷è§|CÒ«ÍÚ¥vÝf™‘ÏC;è4#iÞ"ö€}÷È„æ$÷ðõË›»4'É­ô‹«?áP+R+«î3³‰Ìádªªfäý™x¶$îñr U¥ýÓ‰A®š-Hº5bømÑ’$?Ãï-¾^–ö¼­¾ª¶iÏ„2üœñýÖu&‘äÖ]ûˆügaxž:Ùküâ³a\<¼iˆæ€ÚüZ#¾V¸ôÇçöŒî×ÍÊÌÄÄÜڵߘÃÿ¼®ª£…òcDÜß:jø¸“·Þßì´§îÃÆÌZ¼›Hg‡”Û¼x¤wâóð y1ÿÎœì¾hí‰ "tÈ<°vÖðÁS‚ʈ˜+üñ±‘ÃƸ÷‰ˆ•J’VÌŸ}ÅÆ}ÏÂ3PTrÂh„8‡Ãáœ9sfÓ¦MXxjówÆ5Ø×Σ •d´,Û»¹õ°1T—£˜n<Ä…ÖÐØA“ɼxñâúõëAmþB±Áþ¹¾[_I¹ÏÒ3ùe Â/I™ÔÙ€lÚ9$» B cñè±›7oùÂY á$Þ=h¬!kÝ[)›/~Ä&éÎA3™¡G£½€F"'ÈÛ@…4hÿkž¨Ý$”›{®¦òóýàüÐpð ¥4ë“Ž¼Ó‚ëlD 6øFVØÕNÚ­Úo¾Ž6B>)´®|O¨ôz">úµ\Kulø¿emý:&k­a®Xà¿-8|aÐÖoG6è”^&ÚZå·~¬’œæ‘'1?}c–+K²âãri¢!X¥‰q ÉiÙDÂ>//3511™Æ 6pªŠ“S3òxÄH-vNFr\\R¹häVeIn|\|6fP¸á2Ó±¤d0¹x*´‚&ð˜W"òÈÁ<Æ'§çˆ.¹œx€_AxÌ)©ÀÕƒ^”Ù/ W‰v°$!.>%S”~ŠÏÍIOÁv¨”)²_Y”˜žU ²ÇÈLIŠO© r6 ô¢ìøø„¼²*\šxìÊ4Á)Èdñˆñ±e……å Ðà?Ûß¿Y/½Ú©+(›õ8~õÉÇo,®¦¬`ß{q®àœŸï¶yv´ok’ü¬ý7ˆº—sV‰$k`3,_åNéÕV…¬sð‘î)ùí]uå6]fˆ’ÃEuÑ'‘Ô¯‹óIyNmN’+Î'•âh¬F5r‘Ì'ÕŠ$?ïØ}Q>)O’Œ‘Ã"}·`BwkUŠÞÑ`Q>©×›uÔ•m]g‹óI ï¨ÛŒD­Î'utb ’ìQ>©6wmN’¯Î'•x¨5©•uÏYÕù¤:™’5Œ}Äù¤ž,×$+u”È'ÕÝR³I_œOêüÖ­šÉÏç“JÞNŸ¬cá–XOÊó¸îßÿß|Rð#z#øöÀkXÏ:ꪊJ*ú涖싣qц“zi~»Î[Ï?'òIÞèbçÔoÔ¢*"%›æŒîêÚÇÿK&¾!+Ì«o.£¦n¥j“¼zj?ëžÏˆºÏ º¶É¡Ó*ÿ×ø:³8fÂÀîn§Æ–µ÷í…¹l;ï¼@xÌ¿Ö¹ÓÀq+³}£­›9²«k¿ËQĆÌÏ>Ý»Œ™±½œØ¥„¥û:´q{)R‡×—×;Ú:­½ò_tzZû¶?'Ô&ýb›#fm+ v°hù¤!®=ÞJÈÅ7¤tëæ2aÁ>Q~ªÏ3‡¹9Úö{Gä¿bÝ;½¼ƒ}ç­÷ÂñõŠœ£ûwë=tNz®—ü»Ç§8´é|üicÖ€ÿ~KJœ¥šÇ­ÌHŠ‹ŠŽË-.ç F…‹òVÿl>)„Çåp8<Ì‘:‰‡­r¸\q¦%.WP©ÎÍľÏgdàˆ2„ñyN„¸âGR Èzä!Õêðˆü¯Ë>öñï°Ôeý®h‡ñ”ô—+ðGZãrñ¿‘ì×ÝÛ ù¤þ¬|RðM*é*7ðâÛó4Â\Ž4ŠÚ ‚±ô¬ÌŒÌ:ÈHË)¡ ±Hº³S†TÍ°ÿºËàqy£%øYžó¿Ÿ¿¿ÿ/]òÚéa¦¡8|Ç}8K4ŽÞÔÝ'S~hzgcçé™<À@cÅ6’j‚¿ ¿±KQÃþjH! Z@ãKèIH#¹±ÛoUÏ}‚@#‹ öƒí3É^ÕzHL^%h MÔ¬Âd¥4ñ‘¡eêî»\hCÐdRƒá?ÝRM¿k £Þy£ÚŠÂþg]4’Wê¹á1Z;! @£‰ ïâ¼!*Z6wcòÐïÒðqSþ$Þƒ™B¿r(0S(ð¶¤ÐòÌ]-Œû¥Ó'¯ Ç™I/**®`°‰±V‹VTL+-磯 ziqq ƒCÌ"Îã0JhÅ%e•¢9ɹåe%EE4ÂÇ?ÁfV—ùÂ-+¡ÑJʸ Ãt¬@Sì‘I+**){äU”•<Šæ-çr4Zq)÷ˆ <–bKXx†>Âf=2ÙxUgU ìW²8¸}>OhŸ^)eŸV¬¶_E+..-'ì£|½;%¢È«ª\°Ã,náqJ1¥tbZv”Ϫ*+xä‚ÔˆÔðÑ‚ägúç¡{˜Ä÷i#\Û/NU•W_pä‘Ý)×—*G±è0& _åÍØAKÇôØ'"»SjÐ^3}ªc¯ù¥Ä7zìd7 …æ·Šð÷9Ͻæ(Ê''žpf„uµÑ3²v‹($òI=>:HEV}ñ©‡„Çl/u²µóÄTÂcáô~íµuÍO…’ßî4Õ×rê»È'Å‹ÛÍL±¥á]býàä %Yò´ÓOðõk;z+¶V_ÿO‘á%é¸j+‡þ sˆÌïÚNÇÀæ|d¾!áÙZCj·a+Ec>ô³3R–5Jdxa\Üé®"¯>ÿb¾^–ñª£…®I»It"ŸÔ¥Í=[ªo¹^€?Cl0âî®°2P›x<EÑÆê²y}v¬Ž†áÒ¢\rùŒ5ôí»M&Ä…Wì1ÊÕÔÜÖ3$ ßöá°•I·AKµAâg ²×T¶ºWLÔÕWç=´(z³N?&êjaDoGKÇ‘ÅUø–g§F騮òzJä“Ê>o¨¦çè63]¤oó‡u5³°ó '6¤¾Û×ÎÒ¤ûÐåD–P^ô”¾¶T›‡Ä:ûÉÙùZjús}^àë·öÖ"ný÷#¡6)§uUu\†/#ÒGqò§õs2·îp)šÈW•ôj³¹Ißñˆ|Uœàa.6:jö/µa^Ý?MGÓpéÕø:=ëMw{óvF¦Ðñs†\Ý9€ªj¸ón¨ ð‡è 쬬` 35–]¡ÍJ›È…"œÊŠÊª*&"jI1U••Už¨%Åc Ö,QKŠ'(PQ)Ê/…p9,l•‰'¤hâaïWU1x|b·±–V€Å‘öÈø†GFmDÓ óȬöˆµŒØûlq)„-´Ï"ì#"ûˆÈ>—…³Ú>£ ³_%¶Ïa O‡‡ÿ„W%<"„H'ÅçHx„+ø3b©ñ M`­³£z‰¡—à?ˆpˆ_z L¤@#ëŒp¤‚PV*sžÞºâùfdVZ= ž) qäF %U9ž«Ç*ɵRPRQUQjÝRÆqÈâଠÐSl*ßÕC•ÉýHÈ/¯¬*ºst©…¦¢IÅù Èð@£Á ¥Œi§­k7º#ŽeX‡gw•Ó0yW ç€Æ¢¢(º¯9ÕÜyQ —˜ã å3.ïÒRÕøNxœ¥%øÁ,Û5¾£‚º±Ï³/ø´-¹Q¯G´ÓаOÌé3ÐP± ÊÊÞ6®ƒ®q;;; c}£Ž£Þ¤ÐÅŠÐÐàF(&…ñoexy~~™¹‘õ’ øú½£ÿkïN ¢¸ò5€£YdßÕ€È**ˆ(n€,‚"qK ¢H"qKˆ‰“¼dâsIj2ÑFÇ8ĘdW"‚k#ûÒl*vÓ, 4½UõtS·š-j$¼wŽœïçQÏ­.êvÕ©ús«ºº¾•Ž¶“¿8ŸO^¸'\l\‚#>jd^–ñ¢_ð˜1ïlq3¡*ës/÷åo|ÖNf¸¹:ÈËÙÎû2›ð’p0Zµ‰ò™¶°!w‘·Çì€Èj!³ÍèǬp°™“x /0 ŽòŸ¶ÒŒ¨…žæF£GiijjjéèÚOñ=’ZñGï©B´GèoˆI`Óë¾5¡;~ʲrrhó¢‚ÝM_Üw­’›Ù»m,Ý|Ö7“<©¢pïñ/hXžã‘j“|,JSC7ü럙¶¨ñÆ { ë Þ7Ùôº‹{ƒGièGb¬êêkèÚ{†± VÖøO61³9˜O&T\Ù9ÎÂxªß&rÏ4ugùLM ëóͤÚür RKC7"6‰iŸÞé«©¡ÿç¸lRmÊ¿ÖÑÐv ØHŠ‹ôÁŠÙN¦–ÇïjVšü¾•©Ñ¬Eï±éu¹®Ö£4l/‰Èüðé í‘£7œºÊ´[kÒÝÇ›s*o%éu§>žû‚†þÇ?^GµaPjÈ9ˆDÔXVâèÁ#ߥ痴Š$½Î«¹“KD­Ýɼb’K+5ñù‚æ6C+Tåä Dê´&i§@•Ì+”«“y[|^S¯œ\!ŸIæUtçIQ²A“@ÐÂœ¹<¶Ç–6ùzlRöØ®îQ•œË¨{³=*zçä2±[ʶLÄçñU?Î.¿M¬+è’©ó§:Tɼmílò¯´µY |GêdÞ®Îîðâ.ò¥J.iV®Qs«œRÅe)¢«£E¹˜,`ì°0,.ÞüÆómèß¼ª9È’örÍW‰žÓANÏ1…†=°O¤`HË Ýëæ…¸£½MØɾÂ܆mCTkT÷¬*ºj¯¾¹fY€ß<_¿Ð°™åª{í•/aŒCvEÓÕi'Z[ØMY²"|Õ«KÜ&XéX¹}—sçS0dcZÑÙ\¼Ü}¼¥ãÜ<® {,Cñª ™h5~Úªšvê щ”‚›rÐZÄÊCyä M)ò´coëXŸÉk`†?\Þ‰Œ5Œö^©¢Õ±à EMÒQçѺ[ãs°}`¨Æ6÷Îí¶Ò¹îûö)ªÿsO|h¥­²ï"6 Q±Q´Ôfͱ5籨¤b¦Kù7CgL016³ë'l%šz£º¥Fštxó}ñ“Ã×Gozm¹ƒ¥¡§ÇtGKãy{.`ÀДæs)JV{÷Òk 7ëú?wYi›üí?w‡ê|­o…ëýžÝ÷„UÁ³û`ø”å¿‚’ý»>ŽM¸+W¶º‡«u}×_×Ü%½¬epCæ ëÕ¤z—4¦Iõ9&û”¼þ30ÌÓ}HQt¿SÂ>o`è{ìÿ,Ÿ~úò[þ€u É“‰{-{,<ïåF$(}ÉÙhô„ù\’kR~팧µžûËt?n|yR [œ”©n$lj¸>-19óêM@K8ùWSS3ª›É7³:›+3ÒR³¯JÉoôöÛ×2“.fÄÓÒzÂë$o¥*ç û-¦ù¿ÉÌÅküu4Æ%ð™×¥©ßnÐÓ4\sà¦-ztcŽËX[ÿ[lÂË¥ý‹ôG™¾›È&¼|kªeè2+Bð²6ÈÃrŒClA53¡2ë3»±Óƒ¢I‹œ6×^w„í6áåâá¨ÑZƯMfÚÿú,Po¤éÿü3‡Mx9h0Ò`ê‚èûä > ÷d=Îå{Ix)KùÀÆÚÂ{ÉûlÂ˵`w}-Çd6á%nW¸¶é›q侦ÖÚŒéŽÖ&…”·1–ŠÛá§;ÂtÇ¿ 0²ç¼ÖôŒÐóÎþ-Ôw¦‹“£«›çÒ¨m7êTyk‰€äâ >Xó¯,ò›½é?‹CV­û¤žýEÿåöõK–®ü±ˆ¬÷9ñá//Y·%FHª ÷³wWÎ{å ©²ü _ù/üô\.+ Jߊ\¾"òÝòrô^ûq{pÀ¢ý ¿’y?‡ú/ŒØô)é@ÞòùÖ7–. O(yÀLh¸s2ìåÅÞÛGÒå¨ÊÑáóç­¸*$Õ!7aOP@ÈîóyL;ã‡-Aþ¡ß¤rÈÈ£þÜ‚y ¢¶í%åP&ع9ré+k+Éè«.ÿè+KGKª¡ìÞÖ¨W‚ýï“Ñš8ùÔÎóCcR8d,ÔxsêeaQï×wôºäãïÌ÷ =~¹Õžû¡ ;>ï?궵µwˆä´¢'hj°µ¦ïEZA?ñÚéÀv¿Ÿ§û·û”ÁQé~Kø==>eOz‡t¿ Ul!Úò³¹~£|_ †ÓùTÿý;7<¯ÔßýësûJÏÿØB0$µ†TJ&“S½¾OÝsc¤«K"Sô*A¨?0¸qò¯8î/ïíþ!E¢¾›µ»®tñîÆìØözÄêµßÙw"QJw§PÑ(7ðLU¦ç[r~Ád+£e:,b;Ê¿­œ³>vfæ¶3½}¼¦Øéê˜ø½y¨ ãxÖzC1_ø“ßJ9¾ØÓÕÂÄ<ìý£]êZÔõ0ÜÛÁ|¬„›\™\.‘ˆÏü%ÈÄÄ":&¥žõ êþù¯Æ¾ ¡­g`fiiafAªM÷Ø¥‘sÞÁÜ(4zŸˆ½†#åÏt°p[õ û!18€ßYn”dm µ5µµõ…—O;˜±cU¹nbb½=î¾¢ç{Í­ÑÞn–çß®oÃèž¡ØôzšCsY†“™áJõ™”BñËVWcËqGÊŠžÏÂåñ‘³õǸÿ\þ@¡ÀéüîrÓKsIz¿jsj…µ©µãY¢÷#[²·øh[º|s«›g`µù~©¥é—„Ö>…)w«¯–…SlA-¶ Uµ9³ÖÎÄÚöäÃÞcú⦹ºV“N6`‹ÀPTUe¹úõ<#ó1{²ä쉗êÀ¯Ï0?+›ËWÐO¿lƒ<)äI<¹Ú0mWdïµ62Û¸;C¡~oWÃKÓííf‡Uóeûüûÿ!Ý©oÓçIÑOÉ“¢›'õØ5°ýV‘Fž ï3)åÎ.n,œmo겞Kb ÜÜ“†‹Þ>ÔÙs»ñoi„MÜÂÂ{õ¼62‹´¹¸ð^Iy˜Ì!kà–•ð;I¤ƒWR\T^Õ '¿Ñ»êªJ8œâVöËYBA}!§°–OHIE•¥EÅeU¢îô%åD![ȹ×À'¡ ‰ ˆs¯´²NÝc}UyQqï©z¬¾O†ntWm¥²Ç’6¶ÝÆWõX×$dFq-ª8œ{š;È7)—_VÝÀÆQÉj+ËŠŠK"6SAø°¸¨¨’û€]^guyI!§TH*ÕÒX«ÚDÍÌðE.i¯(Q®W,#=4?Tõø°¥yR0üª³¹ÑÊíÌ؆ÁS™1:/Œ^¸aç/É)â÷γ31pÌâ+O;‹J]j¬gþöþólžÔ +]Sçalžc¨×˜±Ù<©êœ/m­¦Ï‹¤9Qů:ió›'•öÝ&ýQ&‘‡.2mÑ£›>“^´s ¼­Î“:ð’‘Žù–#‰¤>5üÝ\ÛÄuN$‰’óÞX0}Ì‹NGn¨ó¤v9ØXÍ ÞL2d(ÎJ_G}M;užTâ‘u†:¦QÇR˜öÙÝAúZæŸÎ%yR‡ŒµŒ§…lVçI­öskëzR'•úáø±V¾Ë·³yRy =ì uœRØ<©øÏWé™GÇ“ÌšÖÚL/çqön¡$OŠŽÛ ¯i¾3yR0Œtÿâl­Ì ž1õÝ=ñbõÀ^õWôÓÞ-îN6–æVc½æG$Ýk&¯?±ÜäÄmœ:Éó“)¤Ú<úq†«Gà’Í5äÐ|´nÙÌY~'ïc³îƱ€¹^K×|BÆ.tÅÖˆÀINÞÉr¬^=óÑ”‰S·Ê`Ú]üÂWCæø.Œ(£÷ÊÉun®žŸÆ]&Õæáéé.SƒV¼G>ª—7ýùõųfÄqÈ„ÚüÃ~s¼–¿ö¿¤P%ï„LvòIc«Cæ?>˜2Ñcûél¦}16rŠ‹gÌ…¤ÚÔü0ÕÙý¥µ;H|”Œ·%|á,ïàs%¤üT_ýÊg–×Ê{ÈÀPz{m¨›K@6luÝâ>Ùó“Ÿo0maïËæÏö_üFäIß¿z²‹çþKw)Œm`xŠ¢$b±T&£zžuÓ^MËÛ•åeU5:%2õs(ž°÷«FEr©X¹4¹œ[®lJ$Rrƒ¦¤Reo9E&P”LÒo‰r‚XÎ^! ”õLP¾.‘H(æ² Û£L®žáö('«@^—«fËäêÙeªåK¥tŸï³üîd½–¯š '7URrY>yÚY#õûôˆ=†Óئ÷g(ÂÙú]þ½»?>“ÂgRÏR†°« gÿ[(0 endstream endobj 1609 0 obj << /Length 2243 /Filter /FlateDecode >> stream xÚ­ksã¶ñ»ëë)µ(|Jžiçr£$—¹$®­´Íø\MAŠTùNÓö¿w]R¤L;çúÆ3Ær±Ø],ö…˜µ²˜õíÙ×ó³ñ7ŽoMì‰/|k¾´anh»Çš/¬ÛÁM•«8*£áHáàçBæ}[©…Ž8\ âZ&2*$~8¶°ùðnþýÙl~ö¯3˜ő¹k,°âÍÙí³€ÿÞb¶3 ­½¡ÚX®˜X7g=c¤(³9èÇlá;šÚçV×Om‰3›9ni¾Îe±Î’Åè#c"‘FÏZ¬´Ö2k$\`íáÒ¿]6PåZ¥Ã‘ã±@BÙ¶TY ¶popÈ*ÄÆeTÊz  •Ë¸Ìò~Ö<÷k¯OHËS•‘R% B²“åraG>ç°ÏZ\á ¢*)û%Sm½YÎí‰G›Ë2tþãF;ÎR­Å íöÙsr* ÌávHgò.‰ŠBi¶ Y|Ρøõyj¯ƒ}œ2iŒ%Ì&qŒphO‘Å5¸‰~Ó¦’D\Ö¬·U¾Í úÈ–8æURÆàüùÐóvcÉÀž8‚‚(Û襎Û,0Ê ÎüZ%¢–YŽÀ6φÜìÔB¥+D©f7f_p¾óZ\BÀ ÔÝt˜»ƒ2Ãqo< O‘Ð8hG"¶Ê*R-WÅoR& B\Ö2E¨áÐlãAj]Û~D糎bä±@[[õZé½€ ¯ƒ  ¸ÿ@!Ê\áëÝjÙš°^á°ò¡¢zب²Ô¢ ëLu`BŸG{Š7@Œ‰~¡jZc5T•0Å¡(åf-6*UE™GeC’õÙdD`®Jäxr(à¼õ¡Ë´,zíóV»_« ÉÌ« ˜&;,5³O ‡æ´“ u.‰DÛ b¬)h+€„ 7ÖÒ4Úhc;„ž\È"ΕÉuˆˆÒ´ÞßUY®ÊC[ªdTÿ#óX½…:éšã°ŽŠãÊžì´V«µ4£Ã³‘iB<%OsO¢8É´•÷° dó®‘©Þý2äpúƹëü­4+U,vu&h™ƒA.Ë*O1j)©wTÀíw´ì=âÆD“Èœ¼áŒ™ò¨³«ùƒŒÚ©­~hûܱ<Æì€Ož­¯”àÀkjl‡GÈ…åÇf®û Û |âÁ-ýÊ!Ê=Æ´äLlÆy[ŽÆ»cO‚°áœKkÙ˺¹œŒ¦ôû ¡Rø.•~wÂí`Befö)ÚlÙ”;ÅCœƒ²¶T«*й}Æ(ÿ,fŸ)"7ªˆGQ\ª8ÜÅð…øåt¸“äëê ±æˆ‘Coøãw?ý0»ÿq6ÇOÁqý™¦gÿ˜Ï®|ûáH¥tPmŠÕô¼ž¹úéÃûw¿ üÍü ÙJÑoª8–E±¬’#ƒRmÿ( :TÎ/›Xa‚T}™dûé2Ï6÷P=v2¿€ÀŠÈirq©'¤U²¼˜Ííe¹µ+ ´-ýÅµÈ Æ4e›l%÷šô áfáSkð³´„¨šž ‡!æürçrú‡óñ?§wû‘;nñ§Ÿof×z«ÁO=јà?À_Ï‹ê7…ñ”ò°•ÓŽ{¹\B©Jc9­òd‘ŶÜÈl°Ò¹8‚Oe9Œ9.g½ü;.öû}/‹x¥F*Ç»b/løjUŒÑh¸/¸ÿÐ:‚B-¦$¼Ñw7 .õŽû !ã!z›wz Dâ#ú‡Ð:Òžµ3Ý‹þ6=1£Ìjâu²G í¡îÌuæ0š‡0³¦wäÚ‡z Ø´‚¢VQÐ;¤‰S÷“¢×J¢sVú;vÃàh‰> stream xÚ¥WYoÛF~ׯئJÑfrIæ͉•Ø;²Z HƒtM­$¼JRqõï;{P"%9©ða¯™Ùó´B½½š^¼áÅ8L ùñPàÀPèGØ9š/Ð'ïvS§‰låxÂÂÈû­Qµ½Ý¤ 5žPâ=·3•)Ù(»à˜a:þ<7šÎG(ÜHE!á>Iˆ’|ôé3A ؇æq„ UŽ|Á˜¡ÛÑÇq¯%æ¬^!;™½íI”£8¢â›’C¸< vÒ2"ÊðCòo‰ H„8ŠB'"ýÁ»ìÞu¼Ó»%Æ„ÒÞ-zÛ9ŽÃ¨“[+´<)˜ô'ŠÀqÂ׎óÅ"ŠPHŽbß:îgp™ Äû*ëTÞe kw  g¦"Fà9±sòûùÍ—Ûéì÷éìö¥e{öËÅõûé—Óù3ÃH8>^=áüÃíÓæÓ+8zÏÙåûYlMž2çaD B5ð9¦`Ó'GÄQ\j JX<Íã^ŠB f£ðe ù/mì(í”ÅØ×ià©¢MaiöÛÒŽ“§zRUÐŒx“Dv{ÉZÖ2iUÝàCsæü²Vµ¦ä‘'»Iû0†B …óØ»O‹Ec÷Ë¥¿ŽYà¹8lÀ3œøÞÙbQ«Æ®êrS¹¹,vrSÖíÄž`Í#ôÝZ¥­½è®l×–r-µV]÷¢µ›42w³å¦H´)Üý f±RVÒŽºÞdj§4…ÀVéÆ.uö~H³ÌÎîœÕj(ZK«jÑ ¾-7µJ-Nö²øÐ<Å q?ös%kw‘lštU¨ÅðZ«—>Þ[/ GVêú L¯m^}e­ ›V¶ô©Ó«ïâ¡zHÎ:‹••öBó¨ÌrhØFu/¹\У(Ûζ ()ëíPHX­©T’þIKÆy¾s•#[—›ÌY ’H9Eÿ’…‰Á_–ß+#®ý0þ!lòã³(þv) ÇôGÀ©wMœàï¢ÓáxŒVPÃ_`ÖuÕ>Í_šÀŠŠaa¿˜@Ý\Ïæ; ˆÈi\º˜^]½¾>Ÿ©z„üzvöújHKFOJ¾½Ð1öcÀòtwE•Aâÿƒ,S‚™àšC Ž7g§ÚDðŸ/&Œ:ß”M;)›IUfi¢q`ëÃ^u€``UæƒpWX¯d›+H.zͶiUÞØÅ"]ꢲ4™ë´°£­R01¨#·û]‡ °ªê2±ËZ®r w(“{ͪZG`+¢¾¿­•Ì ÜÚï}5—ª—e}ü8œ¹[R¨•}ø¬–²(s™¥Ê,ê[KBìYÙ3,ALdpO½4×É#;Þƒ‚G-þÂø°N“uW}OÈ·ó=H]ÞLzˆA½\Z{¹¥nNhY.u å¢%g}ûÁê¾(µ²]®íÊ.ZDZw,nÓ‡·Á†ëXßm€ìotÑ Šd^4… Eœ;žÉ˜tzªüÎxN:¼âDvrwRãá‹L_Ðe©ïµ¸Vg²ªœÅ5fo³RºJ#&G2§»w íxýõûß-Ÿ˜¦0øÝ tÊRY盿£—9¥:/¡ œl1)ا~¯-á]Öw¡¹Ôà¹Úè8*‹‰^dJ»Þ'{ª]œMö9 R\ËzY » ã±ÀûcLuÿ¸±GÎèB³Ýq‘ ³AdÉZ§ÅbðÂÐ+\Ï'\Ú;²ÏšœêñvÝçD¯èRà .—xPíw÷¡0ü׿ÝÓÅ~¥©ëáß L&Ø>·ðvÌ¡æ™QÉ(æ”oKN}~øº±„ð^ endstream endobj 1613 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 326 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 26470 /Filter /FlateDecode >> stream xÚì½XÉÚ°í÷ï9ßÙ÷ìÙ¤»ksNˆ"¢ˆ€˜EP‚€ ’£(Y²äœÃ ArNC” YAr³"9gf¦þž@F×=»‚»>÷UŽ=UÝ=CÔÝOuu5B³!“É“¯sóg/~`ó‰Å‰7Ûâ7öô‡öñ·®£VÓo­Õôß_òœ…Oþø“ÚÀ¹%$]bßœD"M¾%}hwSùsm6©Jzþô3Ï>TDþÍ=`µ9Q¯–ÊœjšÚÿ<‘ÉùfJˆ±ï¥Ž„7''çQŽ£ÇyEÜ"³‰3Ä1ëTšÃÅ}ö’Wbõ7Â(>{5ÞýøüN†C*.Á~^xœ‡±ºôá}û |SúÐ<§èóž;×ß ¾xÃ8¥®}æšhîÛ×µ¥áAMï»g„jdÒØèp×ë2åÓLm]ĉ:ê[op™SHݾ›ò[@ôUS6}Ù>ÀBHjϺ+IÑ[¤œp§Cã ºˆ-5v·ä8²²ìg9.¬TPÿ†r’>6˜ê­wËdc¿zôêyÏ‹¼(LR©»°ÆÏÇTUÃ6ðm7eo¥Iž|<ìû÷³œ¸p-,³r¸û•‰‚ðÖM›N (æW7MõJG_Täæ?ÈåØ.è•5ò!Iq\5Ê~;™Ó+ùù¤B<å$!;ø2ÿñ}ÌûØ8ŽkZû¶õSÎ.šës´dXöícçás ¼‡ (HG˜&©¾÷µZ² %Xô¾or1P`gÙ·ŸõˆŒGçàHiŠ?çžÍ{qÝÔõ˜”Ð`WKFtpzI MdiR—ôŸµôCÅ° ’Z-~=ÒõÂ^•Ÿ…O¯¬½××ô§€BvyÃû—Õúbܭ‰$Ò£»ý{FæT>©È¼!pDRǵ(=B\Û2³±9ÞAùØù+95/±3ðá×É\Lûm²߼nŠ°Wa=Â]ÝU•ê'zA<ñþ#Òœ¡i$âˆ9/óE|.Ôȼ’Š±Wã”2Ëi¦¿]IJŽQ>è5y´LàÈnq“À÷mÍ…IþbÂyÏPwý-i~i «ÚoR]•vïáÎ~Ü¢{‰Ã±p´ë©¶ ›ˆºSû0vÐÛ£Ý4x…3«ž?}w‰{¿¨IÂê5<)mî×ÓÓOD•DÂÀÎOF:[Þ•¥ ä1Á%ôS#-Ý}|fI1­ßz”_LDXPàâ±Ãûv0±{§#4V_U\×ôfddŒròìp㨮/q¬ÇX€CTËÚ÷GzRš†÷ðɈ–7²RS—gÝsÐ7§z¥E_ÙÍ£hÙO$ ·¿}¦#Á{Ã"¨"'YFL&§æÕ ?MHÊŒw/HêC’Š÷4Þ³‹é¯à%aa çö¬_Å.¦ßI$¢þ·ùùù­=ÃØlQk ©dq·òQ’¯ÐY„¢ÇÔmû½o¥V¿Ñã¶%‹²í9*ÑHí}_rWýÌ'B!‘L9EÉð5ac~ÚÕk-Æ«âK¯£icøÆß=vW¹¸nÅÒÍûyã4ІN ¸&Àç¤öðÉß¼®¨ /]ÝènQÍ=­/ó3SÃýìLµ¹w­Ú£0ÖûLð(Ë-çÓ%Óô0õÇŽíûY÷33©ØFuöcë“زa'ÛQ1qq‘KÂB|¼üVá²dÅd²i’šÉg•Ô_ÿ¬áx£½ûÙ/J*]WV”‘’5t 맷WËâc£üpÎ7¥/ì:Äa™^•huþÂõêP–É1•!f «~a?qî(;G@Îk,§4-˜eÙrÎs|—/_ä=wV@¢~ Û “”Sìä£RD"v²1N‹¶ÇZT/ž½Ùð®sòÃߟUR2s,ÛžX]¸,çì”[Rb,Ëe0>ðò2×þ›v´u†0=k*Mã“ Ìk,‰µåâ<{·ô9V¢Â¼ñÂu›¦7ož44644VVT¾kï¬L —“Í©y=Ÿ¤F1I |¶Hê/~SÏpŒýM.yÛ¢žÙÍEÑ|\lŠz6‘ñ)YéwµÕTlSK3ƒmyùä k[hë¼®«xÛÙb(¾óªãû®í‹'D4[‰èQfØ™]û\£î½zýòÉ“§µ5•eUXð5j%rîºsÜäQÃþkÓàãæžWN?»x_"$|õîãWDŸ]Rùv­‘H˜lÍiÿ·”gåtÊ%QuãoòïSÃïìyçczý¦~b´¿ø-ëô§ýušÉ_¸¤áÔ2„î[\éŸ÷[ÁOU„SP:26sh2ÎîNò2$)ïµ½¨t¶0PS×´Ã?~?øúESfb¸¯µ–¸¸’ghRBJJllL,•˜˜˜Ü¼L?kC« ÄDBìŸNiié_¸Ž¨ñnSÅýØ{EoúÑÜjªÊŠ2ÔVÓ¸u;"µð~^Š•¥]A]'y¤->ØMK]ÍÐÌöaS¶Úã‚ÔØ ªäȤž7 ±‘áUÏ»ÑøP~J¸¾–º¦®qÜýÚ1"å²SKu¦±Ž‘UÀà´O!uæÅùèh¨iÝ2ô'äõPï›ûÄy™þ؉:õl™<5GÑôÙÞæn3O#:ÙjηgÚî±p&"*:- ”R“’’Tâ'ˆ‰‰MLMOKŒ‹›ÊûsÀ>¥¬¬ì/]GóÌåKž;×Ô'Uôo\››9ãä5©y7!Ïø.ŸÅP3Z­éÝ}3[³™«ÌÓN‘gïvÆg×ÖÖ†‡GPÅD˜4Ô¬×iï@R–ËÌjšç”cvÝ‘i#ÅçÖyžêœíÄ9' 3&—…î>þ»Èè‹‚H$b’Šˆˆˆ_pþê‘üêé @}}}ddd…ø…Lååå_BÕ@; †àÍë×UU•¿'Uùxûädg×>zô;7ü¤T]UYYQžœœŒÃã}ïøùÞ¹³éο‡…¿„vxll´©éiEEyõGUIIq@@@~~~MMõ税/'a¿ÕôôôÀŸ-|=XXÛß´ 1öI3ôºû)ɈúÊÉ'¡h‚7ñË4ôJùÄ ?=Q>Ÿ¬n,§ç¤`è&¿°IN×!(,zÑO×±OßÒªil­ffì“ú‘c¥ã}BXVÕÊ«D£?».¾œ„ýhz‰ªÆŽiiéðg _ZfI¯ñecžÅ£ŸœúÏÉ›GÖøT’~ÏVŸšpÅ£‡"ÉX„+Úíâ2Éš‡xF| ‘Ôë7ï” -ï6ãKÇ?r¬³»nÚ›Ç7y•ŽêøB®dÌ­ WË-!&&þlàëAÛÀÜ*å­wò*ûÔ„/áU0¿]w§[þ~z£je­"”â8ÉZ„zF~!’R1t²Nkýxí8çö©;Z&¾ð®ü,uñå$÷Â!m÷ĘØXø³€¯PR˜nð¥dªƒÈ͙꠩·Ó$eö™%5nùeIjG2LJÊê$%¨æ@‘¶ZéßSO´_³H Æ™ÀW )²ÕSxúëäMOäIÍ•Ô¤×&¶šL䩦fÆÑôO™lˆhi®¤í©±'(N$j>šh+LÏŸ‘3=ú “TP$š~Ðì»@R‹(©¤Øظyk$sI•P„‚-x—Sô›ùvºn椦Ö)Ÿ–ènšY4)µòÉxmú[Ê'âJˆ“’R¤ÊhÂ/ t›Pßbòšæ „9¶J˜HtÁÑ>.)óP;mï©477·´´ .VwHjJR‡4]>¾w:;;&k{™{«2»HŠä~¿Ã6µÑ)¯‡E4X›p¿Í.í©S^?®„ô‰’ò,t+è™H½žÅã”°ˆº9®dܽ ×½pþ¶hؽ Çãá0ö¹Ô nÜýA7vªŒ+s/ìu+0Šª£GR4¿8&*ÙÇÉ[GÉYGQ+ºžèVR°‹•·‰–·U K*{+G]Kò61ŠŽ‰tMîCIÚ,H¿ß_*>>>8nágóIÍ•”GÑ’u˜’’r@@€ïîîîMMM3fgàï)©=kë_~úéÔÍ0räW‹´, V¯\yF=É¥4³Oožî>Lj~ãŽþç¥4Ï\U?{Eý´„†˜A„ŽA,+#ÚJ/\»ÉgœØv§9&_RÔ½dn—;äU‰\I§En\±ÍvH­AÃ5œWBæà ÁƒÇ±t‘í¬äEí—LL^Šô샞’6 ¾"cdh`HEŸJNNHê Ô°¼y ÐmcãÉÚÁ^?~ ’€¯ARúvN køt Þµ(ø)Òw²Ü´i3ŸNMR^¾&E¹˜UŽ‚jFD® ýüã·k·ìßÃʹmûæe?ütX:À«ù”ö«üøÏ%?­Ú#d‘íùá³ê¹Ùw/ßÈ¡úÒ·z\Šç·?¬²*rNˆüáÛÿì9¥§—ôFÁ:‚1Å«Zyž:ŵný–u[÷lݱ‹‘‘ူ±¤C¦¢AÙ)ñ¦½Ó÷ÿúç®SjRÎyJŽÉ¸@V¶í?/[¾qÇ­»÷mÞ²aã®Ó·’”=²íb?~e “”ÈUY“ÛF·©QÉÍ]èçÔƒ¤æ—”E°°ð%SS“ÉÚ166IÀW")LR«VrKÛFV›ÅÕÊj*­Û°•ÿÖ§J*°zD\öÊjÆ—LsìÒ_ÛĤì^³‚qÇIýRä[Ô|‘ïØJ†õëö>$je‘=†EjFÎNNêgØD&m\ñË®“7m ‘;!rÅr†Lõ“^c’ ¥æ™vYêòšµÛ‰ÜÖÁKáÄEW­XÉ&é­ì™©ê‡éïÀÁ½v3¯ßÆÅgŒ™(GÏ#àБ½Œ›9ø5®ù\Ó6=ȼnÍÁk®eÊŽñ )IIÙ;¯\ö-Ãúm[víߺ›eÃƵ¿¬ÜqQ/ý÷HJb5æË6E®÷;\Rs™Ö¬\³›×k^â“woÙÄtFó¼”ìö¼a”›z¼ ›/ðÙÀ.Vðâ¯Ë– Y—ûÕ’c"V,_ÍÂO—”¼m¼IDú©ã‡6½lqÝ5õº[šºƒ?ÇÁkXD¤Ü¨Ú òna9{QÕˆyÛúWñ2®…ú¸ÀCG˜·Ÿ5½«âœ¢ê–"¯,¶|õ®ó:±*n©Švq )AI9­^þóþ3Šú¾’Æ~ç.]`X»_÷÷DRrWV¯Ú¶Ÿç ÏÅ}¬Ì?ÿÓÅŸÚ1õ›rk6îó|¢gç¼yÇ~ Ûl|ò­Bú®ÞÛ¶îdXùÃJVm»"äS1>KRr¶IÁþì˜öžÖ•uÉÂ$¢`Ó.èÄ1¶[Ž^²ÌTµôàädß~R]Ë'ùüùcY/‹Xfè{‡a’bØvü’1uÜ…]¼æmƒ+ÖŸPóSrMW²SI¤ø v÷12¬á»ïý=AúÎÖ›6oáÓIý’Z½ãàÙÃgDŸ;¯âiž=„Ëyzœ‹aãÁËÖ Ò7µ×­ÙÀsÝ×¹ˆìS‰ðY <'9–~Ï „ãWíŠ&)†Ìô)פ"åmÍC#8ؘw¿!锩䘀IJÕ6ðçUÛ‰ÙæÈéÞfÚ¹i×qya5KN®Ãë¶±Ó ×ŇOH*QóšCÒ[*+Vn=«¦â–®d’I𗌤×ðjEÓF÷ݲ·Ø´y+ßï»&%±šq£˜UcÎ;ÇÌwnǼËÉæAwwíØ°|Õ†mL¬[wíZ¹ì» '4õRú}ªPPy+ߥ3?þ|P?kȧŒ&)Ê5)–‹†w›•lc”œ’5p gO±¯ÝyŒW;\Ù%MÕ-õ¦¥ Ó–•›ª)¸g*k+üúý÷k7ïÙ¼sïºuŒ+×ïæ”q»åBéîÛvBÔ$EÅ)é¦sÈî]+7s‹X>¸î’Ý} )þ‚’Ö57ùîÿý]R—eÄW­Þ(éö(a†ÂÜ4³^³òçcJÞ7]’o:E ^^¾šYÔ¡‡Iª¢õü¥Óßÿ|ÐàÞ O9=’Zþ믙Nž”ÒåºpãܵKf‰Š¦6ÛÖ¯ÞÀÂ{ZÆø¢ŒÇUk÷Ÿ¾•¬éÉǹyÕ>‘SJΕLÅT5™víb0ÕôŠ=ÌÁ¼jÍŽƒgd¸ø¯;͹üÇe¯y*â •ìatH €¿¢¤H.÷^éúX¤´bm–ã|ï…^@‘EJmö ¯N‹D‚^="*)òËrF ÇjÚDX¾{ÞAÁýËVòè$÷bÎÂÌeì±cíÒ}"ζPHUë9cÿþžY/c€&)§è°e?~·léÒËW®\¹bÙ~d¿¦ñ躞îÎ[W3¬]½zãæý§TäStm´V.]Å}=P5 TÁ6ö†c˜À©} LâWLØØ™~ùy¶“¿þ²rÝîS7eÓ)½…´¾¾Þ'’IðåIŠ<-MM"1kN¤Ï8áQ8à’ßãQDœØŠL™ÈâAk~?ŽþáŠÇ\ó»Ý †1÷áË°Ò>ç¼^Ê2e®dÔ%¿Û9§S7°Dòv€¬E¸¼-¦•eG §èkúþòN™ò”.;‚’]´¬E„¼[A‘:’‚M¤¬U”‚}œœu¤¬e8¶9%YFÐf¢Pšœt")1IMoæŠé“çî›ñ–ww#Ã/{y®IøHá¯ê{ÈÙ%[g÷â©·ô‚¤@R )QRf¾>?~³äÛo¾YúãKúñÇÿïš=|jQ/ðÐÝ’I°˜’—pENÙ¯³_ÓSÖ+§Ü6â1ÜìÉcAR ) +)š†Êç¤yf8I¤@R,°¤èãÌg¦é#Ï¡»$’`Q#©‰ÇU´ž@²Ì‚’I°xÝ}˜‰,BRY˜÷ð(ùK«ßZ³n§¸c>®|²•€û¤@R )GR”½¢~ucí5kv‰¹–èÚºì\¿š]ÖÇþÁíyRpM $’`Ñ"©2ä–ùœïÓ÷?.ßÎzœ™eߪeßm<"­“ðž2Áì´û§@R ) I•[ÇoaüuóqnA¥ã"ÊÙYWod³-r/†i‘@R )OR•_2 ¢¥²bÅF¡Û nÅžÅCÆ^;¶l8rÕÁ6gˆ6?H $’`Q$…+ÔrðR÷2Nèð­A>•È=뵬“¤e’]RÐÝ’I°8Ý}øR’Wé˜wÙ8åòS WB¦ä”y•OŸ $’I°’š>í9™~oÔT+AþÀ5)êÌ~ÓÒäƒæi›ÏÊÇÿ1I)Ú( öEl™š”¨9ô|êòd¥[ Pòí§ògí $5Y5sjsZ…ÎWTFÿDüÌ)ˆAR|I}z‹1#’Â(ï‚ÿÌŽ;÷‡éƒé¯WJòÉïÈêô-Ãÿž¦ì#‘”¢AÁ!^Å&RÃ4HÃ"JÑ!AqÂS ˜‰ìãnX†iš«ÚÄ)R\F+ŠW x*ö¦e¨†Yèu[lM¼†úz#)ʤ"”ZÃùæ÷ùeuúguøewûŒzM>\¬„äS0à—ÝÙáŸÕå{ˆqSOi(Ÿ[ ’àóJjÎCçyâá\Iy–eHIŽ/Yòšß,$kW6-¼*ê)eYŠ–ü£úV*®švîMþ”ÖìÃ’"P$å–(ɇ–,þéœQp½´]MRòI7‚JXwaEÅR~Êö‰´0J‘Oé[z52­Fÿ\ž,tÕ-i"(IQk«ëräY:ëä×xèPÏòUƒ?ýÚÿóš¦ †ÑI}UØùÆxPD^¿@ÇêÕƒ?ý<øãò·’wýŸÑ7¦?á$Àgêî+G>UÈw"ùTÌèè›·»W‰¼S+q -YÒ»S$1ôŽÖ¤”’qØÞòÛ¿ûC+XÛ84‚ Ê䥟O}@R”^;,ŒRu )fÝ9ÀÀÒûãOÙ7J¸aá7ÅË9'›X<=x¾cÙ·Df-]»»òÔˆ‰ªª8]㶌«V=:®£è™¥`GëüÚ%UJ?sp¯G¡Þ~¿¬h±‰HlñÍëŠô#¼Üôk;»öä}¯îÑá½Ý[Ï¥6ú>Œ)¨=ÄÔ³M86¹_ö¹.M‚¤˜>p£ Ã:¹Ê*¹Æ*©Ú*¹Î1·?íÕ¼‘”G5Št~»yOãYé–Íl·Ó¼K¨S ÙóŠ3þ¹Ð4¢mņ,¿7îUhÖ„ê¿GR”€{•wH04uj]ÉP¤ûx;ÃÓ½r7¼ÊÙÅb¥ò.‰rÏÎëåÜÔø÷J‚až5ÂÂ’ª]D’¬P3Ë¥ u…Χ¼«®8DSÃ(t÷ÑÂ(çªæÒã‡ßðY’Ü©§n (ÌÕãÍþó„„áH{³Žõ‘½Î ȳ¹6"¿Ø&¶Ó^O1ƒà¦]‹Ið9$åU:fêã¿rÙ7Ë–ýòë/?ÿüË*¦S*!¸2¾l~IùÖ ²þôëŠL×î”V²37]²óÏ¡EL®u}UÿÑ~ÖŸUýzÃÚÆk¡î&¨Òÿ2’R´“wNÄ©+®»héœxõDÏÒ½¦éRN‡„N!\GïW¶ÁǼ\»´þˆéuÇdEj¡Ž•wíö÷/Ú¸ã£ÚV®Ëã÷’ÂgP‚©9Ã'¾Âî>ÊÕC¬jÂCެߑëXˆŸìÁ£†ÃØ©Åý·yç9Þ4ölD¸éEˆ: ”Œ/…|vI™ùø3¬øiÇ¡‹| f¼—%·¬[½…]J;ö=¾|þ'|ê‘wZQõáÝOdÝÞ¢å+}[.Æ$½÷ÄÚ®ää<ü—æù½s.ï,>q¤m¿x@òü´¿¹’¢…Q v5\| s¿µŠk†³§cçwËbTC¯¹¥È9&Û˜[¾ÚÏN³S ÊÉäÙ׳žËÒ*]ÛÊ6gfÒ³l£¿VâuÇŽ=/˜DŒ]Šdb•ì Ð݇%zìäѲ~o:®‚:†>® ‘»hâžZxéÂØ’ÿ­°*õ*G®HÙü\èÿþT¬’az§œc×èÒ=™Am.µýB¥¿;’¢H´vÇu}³¤ò¨ßeõ)µÖ_þçÑ ³›î÷å=S¤%»^þàèÕYó|ž¤® ¹&ã§ì~/Kâäè?~M½dé/¡ÔÀ¼µ÷gf7­(i—dEMRu(Àß²nw†g~ò„³ÕþÈÐÊà¸êNÖ—Bö®ô ‹RG¥ÃáU!)ïñ%$èî`a$µ†‘ñ”²Ÿ[)ò«CVA„ÝÛ7•r²Í›oƉØßÒ¶üK¼C?o¬7,‘7-’Vk[õm÷AÝÀÂÏœ†Wk—ö0‹•Èß.•1,¿,Ûµbås ?ϧ´þ¢ß¦æ—”AÆõn¬âåño~(乚|âR ÍÞÝÝ[Ï9šeßðŠ+:²›a_þñ+IÇ/¥œæoýõ?5‚v*ÎéÆÉ^­üm»ÏJ$¿”˜¥cýºTI7e·{s{ü¾Òî¾jäžžùlÛÆj½4\%ÂÑb¥rä›ýb?Ï=Ç»Ê"íû%ƒ+‘[ò*&á+‘GVyçÙû&ÞÅDÜ´Y³@R|¾î>Š¤” ßjdvy÷vö+Ö9s$enÛ’\þlû®|VFü²»ðŃÙWE‡¿Û˜Ýêå;ô9o}r;ý³»ü3žçêÝt6.¹Uÿöð‰y%%oKPóϬe^÷n»”¡CŠºY¦Y0NE§sýæÅPkW»wÞu¹eŸ¤f¨j•)Í7¸EÈιo+3ò? ¡æ¹Šæj¦¡·¼k„Î5È¢y§á*(É£b$ÎÊràûMsÝëéÏ£ÿ½£û¤l“‚½úÿýݽ )—ǧC3×Çûw=¹ ªªÐµÓóö]I·‡Y§dG“¡ÿ¬È´Nx´iY“ÄM|¡ up ’gJ¤ŒTÛÞcw \R¾vIÑ¢ÚR2® ᲪŸnßÞ·š©VÜ8WÏ©Žódßw?ÕiÞó¬Ež…íÙÒWGÿÏ÷ÏÏ)çßr-ïþîû—¢¸ ü1|‚kR,H$ÀȸšGÚÕ&³Ï1ýÉeIQ†5».YÞw+š:ßž”ÔíȪx¿äuŸà‡´á”R·Šö\EãÓˆ -£,ÏÊ©ëÈ/¥¶@Z/õÀ«bÆìIŸ&)‚’=AÆ1ÕÚôÖ=ëÀ:9ÛÚ”G7ìÂ}å´ãEo†ÈªÄKXé8eÈÒo€Jа &œ S·Oå¾® 瞪`GéÜÃ1/ÁôkRQµ~c^‡hsSx•N̆TÔïýpÀ»°_2>•O™´–èõ°Ï»häSƒ}à>)‚²m”Šm¬¢#u*${ú=PJvq*6ÑXR¶¥ÜÒ«85›AÙ&Ë¿nE¹ xb*$Ú:*¶1Ôõ¡»MÎ%ÏJäUØëŸÞœòÖ?»Ó«„„ {¥Ý+¾“õ>(åmÀ½6ï¢1Ì\Ôy‰at )¢=á!¿”Ú9)^)ísRzbúÁ·[p¥èC7óúÖ ü´YqhJ—S3˧æ Z¡|Æú¿o:5˜Rt Ì8AwÍĺÓgŽ¥ÉKivQ‚âôÉi§oB“®IÑ:ýhÃÎé‰R_äIÑj¢ª™Ex˜¾0°džÅiïgç~t?dòÔês·›,ûÄ}þ×’¢ÜžY<îQ82•ŽQÝDþè£:fO í59ÝhéÔÝUùä‰I³ÿ‹î¾‰9Ï'¥©ˆ–9Yä0oÑ„¹fåÓõê  ¹œ{˦N'¼JgœoÐï¢*¼áwFW0H ¾EÑÚi~oÐÕó;}‡ýÿ! ‘§kìsJjÞD‘T?ëšwwß<‰g> $’IÀ降…®%Âœ‡U£z'þ>îè^ÜÄ,ÙB‰°»ûH¤ñî®îÁ"–12Ø×ÞÖÖÕÓO$‘' íŽÔV—õw·Qt_÷“‡WDDìS&?á¶ÐÁÂí½#ŸïÇ™õd^ŸÊÉ{êiI¤@RðW’ÔÛºŒÓlGoßIî›øûè~Zâhïúb µ×Dëظ•g†ªÞ0º[ÒÚßüÈËÖ@BLXö†~JaÝà(i*2¢JŠ“i—!MR—DlSO~Vš¹ðzå· ")’{^«~`nÀC]ÿB]ÿ‚[~F1/Ý ÇhÏ@I¤@RðWéîÃjnySøð)[w¿øä´‡¥UïÚ{©+Œ?˶e>Ä*ÉwLNß=+·ÈJóÚ!n>m==±3œ¬'$óëÞ’Èh²»oš¤Š® ‡ õ÷´·w´·<Õ8È*b׉ERäOŠñßJÊ«lÌÌÿŸÿYòï}óó²e¿ü¼ôÇ~ÚyÊØ,½ ©¼J¡»$’€¿Œ¦h–é|Uìn)sEìâA!AAq™Ñ9µ£ˆü*×y[@e¶NEz°°¸\ò£Vly¼­ÁÞÔ<·òé8ib¤ú4Iõ<+¿væ(·À5Ý[:šš2"gÙŽœöË®]kR˜¤,‚×0®`ã׼ᙥ…OS÷LÕ }ìR0Fo%@R )üeb)rwg[ï ‘{;ZjË‹¢ƒqŠÂ'vâËyÚ÷îó‘³ ”+I¤ÁøgEM³g}DÚ¦£#ÃcãÄ©‹R3$Uvõ,÷™+×m¬-MMLLÌíâs+†‰¤ŽOÿS%åĸf%§„Yò[»Ô&›»/\îâKášH $¹Þ>T“¡iP×6:Y4Ò˜°iÍ*ËàÚ÷¥GøTÇ©’JôwRP3~ÒK•qäÕ“º·m]DÊßÔ<פ$(פêçùÄÏŸ-’bXõ=ã†]»X9÷àØÅzJÔúžk1òž9ƒ(H $’€/ÚSÔצ1Üܧoy&¶÷‰˜vˆå1–kÖí+én.t:tVyŒ²©<=THXÂ'­{ó¾&SVL<*·jŒ8½»/ëÈÎmúQ}Ý…—…¬kçû´êîc\½t+Ë™Sšg$ÔNKè(z—¹Ó$5ß“yAR )|±‘ë tÐçá书 g`pS^œ›ƒýªIdÏzýÀíä%Mª¤Ð@K“³žâÉsB†f²¢¼g®h–>m™8A‘TÇã¼3‡YÍ }=O‹e¯^s¼[¿?άî¾5kN*úx”!ߪaŸÊßj2ÅP%dˆ¤@R )ø yŠ:áîk}˜àëí‰ÃyyûÄÞÍ}ß3J¹\Õö$· ’DƒÈ¯SbB½ð^w‚ÂË^Œ“§î•"“Gz[ó2ïÕ½ëï(-*nlîýŒÓoFR”Z7½òt|3µ¼2nU:Üš5ÕH $’€/\RS³Fˆ#ÃCƒÃ#ãDÒD)‰H$bå¤ Ž  ŒRgSš¶9jo!eÈ ‘¾´@†š%)ó;¾Ë¾]òãKW1¬YÍ°fÅòå[ØÄ4c^á+fÌ>’I¤à‹ïî#hB½Y³óͳҴÓ §Í…¾’*%¹Ü{®l®h­DMŠ6‘ªy¶9ýø2H $É S䙚™ŠfYgþ-ç>ªcžMFR¸Ê„çÞåD¯ Òdò.'Qgí#Á5)H €…gÖ³´¦¥éM@$’I°˜’úȆðI¤@R,š¤È^ehN$5õ¨Vxè!H $À¢IŠrM y—OK”W¯©GôB$’I°X’"yئ¾¶½ûÚ†šlÓÞ9ç÷ÓFM€¤@R )QR^¥ã¶1YGNž9ÀÍÏzŒï×.¾³Ê¸Û)]xx2/H $ÀâJªlÌ< hŲo62ñœºªÃ{M•…uÏr†]¦9®É^pM $’`Q%eºnÝšS*^µ(ì%2öpß´–ñ”Jˆõ‘Rð<)H €Å•ÔÚ5+ êiVG”‰+Èmg9~Õ‰2:DR )‹,© 0Æ•?¬^»u;ó¡m;v®Z±jÿ£Ûi=^pŸH $ÀâKj-ã¯ûNÊH™G*XxqeßÂÂ=ü%®œ2pF÷¤@R,nwߺµ Çå<]Š_-Rº.¿~ãnq×Z÷Ò¹Ý}æ )H €Ï.)£é£û‚VýrLÚݵ4 ëjŠ «7Z•¸Ïš+i䜼‰qTíÔg—”õ§HꦽeâsŸŠÏU_HIÀWˆ†ž©ÕÝfï*J#`GÈ?& uÕ2ݳù×!ßÈ“‚ÒR…˜¤|*©PÐù²®·EâK,Úš–ùç¥JÊÓêoÇ<–³ŽRvJTv\Ð$mréÊ"©·JúŽÖéíØñ*§§¹ÇÊ­`øši°mz‹oõç©Ž/#a¿¸’qyËP!!a|=šZŠh8*Xʙț+Z‡É˜úIèáÄu=¯øHÞö»fè}E7=a¥UÌEµ]®èãfý¡¤—˜ü]OAU«³R·ÎÉè/p:}E]PDÂÔÄdÑ%ÕÜÒ¢ n(ªå,O©¬‚dMý®xIèâ$¦·Ëº×-Å´]ÿ̺˜YÝW ðÓkg±Òe÷" —ÅÅÍLMARð•ÐÝÝýöÝûwï[héùËWѱqZÚ·44µ5µµ5µ¨¯s’–¶Î¼ùjÒÑÒ¹µIû–î-]¬é[tI·µw¼mn¦VÍûÖ¶Ž†Æ'®nZsêåsWÇT÷'$ì§ÖÒÒÓÓ›^; )ø{C}¸"yòaÁ###ÙÙÙ&&&´?ÿ¯™E—ý©ÎÔD{fWWWPPT H ¾&CÍ`xx8++‹öçûë†Ö.–¤æ¥³³300ÐÐÐp²•†ÚIÀWHj ©/¼v@RðµI*33ûÃÇZB#ÀÈ;999_Bíttt`ßêe²v°W|U’¢ 333‹ÅÃÜÜÜÒÒÒÚÚÚj1À>û´oB;………_BÇloooxx8ö•&¿ÞWv(°Êjjj¢Ÿ¹Ý×üÍ ‰ÍÍÍ%%%EEEÅ‹öéiii¡¡¡ f””ìL~“òòòööö/¡v°Fk>|X LÔNiii?ybl W¾´?óÆÆÆÈÈÈÄÄÄ„§ººú <>ÐÃÁà a||¼¶¶‹kâãã NYYÙØÏZààð%Hjù2%€¤@RH I¤€éW¬§_¼žy!ûã—µg\ûþý’"Pý2é:Se )€¯ÜS¸ëŸ„L &l¤I‰ã>,)š|N™È!ÐõŸ’r7---%9‘G_’øÊ#©GA–›V.ûþÇ¥¿üüóÏKZ¹Ù24oœ)Í«Èson!ŽÖ…›¬Ý¾7¿½h¬£AŸÑ2â0â¢"£ã°w4OaBÊHKHòµàç`úué2õèÌâ8JQDR@]¨óž=&¸,IÏHówÖß³–AÉ!‘4SMibqBVÄÑÇ1Ö;°v¢çuáIf)Š*’¸8Bƒ$Qåô†„¨ˆ8ª¶R’ãcÜnñó Hk[889¨]>ÎzNÞ;>Ÿæ5ÀWNmˆ 3ó´§­“9¾ <,¼Šïú"´¼yV^\T\ZñâmÛ‘".2‰ØÙü²²¬¤¸¬²¹³ŸDoˆ¦Jª ½yZç‡s󺟔””sw±³uð ŠŒMLJ ˆq×Þ²†Ýÿau$OQ<”‘å "xÓÀ*ònvjzz~²ßù,j.Ñ„Ä$€Ij3KbmËDä4£y–ùŒÂ»žñº¼Á3\ÇxNçâ༠œ\ú+Q™©tUèô©“<ÇyD¤´*ßö=#Øa’*éE¯ÊïJ‹ _7÷%¤g§Gyéɉrqr9t˜ó8¯ºkBQ4NA˜g횊¦ŽáIY ñ±˜\Ò’ iQ!áQ„è¸øø„ÄüäþClj®Q„ÄdPjËÌÄŒOίk PšwnÿÎ+øÞá>_3Y!EëNl¥Î'’<¬²á=ýV ¼b:nïx&wúªcâã×],‡%µVjW®Ü´ˆË.º—žì¦'# «í›U_[ê¡!¸c/§Ktþ£ O–íçóº‡ ¡„i£&0=%'Å'F‡ø[©°pKx$P®[¤¾zI…Ùïݺé÷™ ø¸³ +”<ïGäÑWMõUõoZ›_W秈óì•tˆhjȺtöBNå3Ú¶/«ï'dUÇ9­ß´éœðEV6Ns_ŠpWehÉ\’P3±sv1·°ô0<´ÙÈ‹P•æ¹ûùìö~BDØäH¿Ø8½»±An¦Šb¼lg<£b“â`à@8±k—†µ³Ÿ¿¿ŸßÈÄ7ý”üñ‘¡òl‚­³›‡©îáí RÎ15.\¸ZTû†DFCÿHOblV1®» ©|CYRRÓ:49ïM} ‰ §.ˆIËÊÊHK‹KH^“V°»Y~×}ÿvÞì¶>BD8}9¦´Ø SuÁó¼çÅ䜓SîÞ%ÄÅN¿‡ $ðÕB¹&µ5óE׬ü¶×Õ N+9†W×=yßX­-r\Î5¶©>íâ)þ¬ª—´už§Þ‰I/ŽtÜÁÌ–ùb¸4Éëì9!}„¦úl-Y 3߀ðè °¤O55mßðäŠT·ýÛùs»cÃBhJI"„Ú©É)ªÙ܉ÏÈ/.-)ÊÉÎJNü}} )€¿³¤‚¬öìÞWù–H»uwâ.¨æ¦RÁÃn…!4V•zb£ ¡OsW‹‰ ¿¤†MIý³gÕùr¸ål¢kNÛ÷±õ¡÷uù×…Ÿ¹ª“ží®+}B@ÖÎ7ênb´£šÀ^vñÀ”ŠdçÝ›¸ßôeÞMŽ£J¿cp嬰¨”…ƒ‹­µ¥…¹……݈Dˆ¤¾j&lÔãqòäé´º÷ĉù%h%#ý!¶7Ùs ‰^WQ:Ítˆ7¶àñó²T s§Îœ;w’û•›µÍ=/S=¹Îðw¢¶wϽo ã·»W]˜¨~…—ûØñ3'æ¹èu?6!ùq~87Óaƒ°”¼ÄxŠ¤ 3‚oŠÞ¶që~û˜˜ŽÜöŠ…!èà)ìe¸«µ±ñIÏÐ(iòþ\ú­º¤Áîæâü{Éw3j_¼{Ù˜›•óì]'"¿y^—™–’z/ïÙ›6ŠÎº[ž<í!Õ?~à—–v7)&ÄËÍÑÖÁœq/.663-)ÂßÃÉÕ36)ƒz{o|b|Lh¿Þ ?çÝ} ©YSËRÞNÎ(A"Ï¿}“ÉÿèëQæî{ô(<"21))‹’ââ“1’°WJßeŠ B2Vš0mJÙø„Ĥä`›Ç~¥@RCCÍ'+2mFÙY“ôM_aö2ýÝŒÇÇOÞE˜˜ÆoÚ\çñ3§õ›—x¸&ü†¿h¡yF¨5[qô jÖ£:& 3'&šz8ÇßàyRó`a›âßl„‰Db]]Ýb=ô°¼¼üK>8Àg H$Rgg×Ûææwó§÷oÞ¾½ÿ  00,<K“4ØQ’“„ss²±µÇùGT>mžg‘ÀP€¤@R‹L¡±N_ù#ìÇTµ¬­­”Eï;r.¶ª+ïn®õÃ…´R×Û8Ç\3߉>‚‘!FH øM^•Ær8d–O?š£=FW89ÅLùeáèîSõˆò³q ÊëØèè8‹¿È$lixxxttŒöÈNê+–9‚eŽŒŽI”ø‹D#’ˆÄ‘J.-‹¶‘D†9C$’æ£&j²plLGƒ3J‡I$ÚóP^WçD¥Ôf„Ú±ö—å+ž»œ‘“ƒs7u Šp7Râ—Ç=y7<Ô\®)~zݺ§®Ü*{ÞI‘ qôyÅ=e£k×°’ˆÉ«ÅvU›á|LÕ+…pçìÁ훜ͬ{[•êshÛš‡xƒsëç|@R )`F/[ïËr•Kœ,ǬÜý3ó64½¡LåAì~Ÿly`gì㷽͞6 XH\S¸[ÛX@à=Ê!§m¤#yv7û…²—Ý/*Dyöžº¢¦'#xðozeóÓ‚î³Â ¡a:’§ÝÎÂwIîNX¤®¼ »pUËÔ€¤@RÀ‡4E7Zjó,tÏçbee;{QD×µèñ;,¦jkL:yðÂ3l¾çöjÎ(˜?ÅÞÜ´ÄJš”5<ûî}kcæ…}[ÕB ‡ZŸâ½î”=éª ø^>}4ä~UC‘ÿ®çÒÛ°ÍšîGnúecê[Ê'>Ïá?~,íI'Ô€¤@RÀ‡c)rw[K{ÿö¶ãÝ˲‚Üp?Wc,\—4;ÇÞÕÄðà«ÃÊz-t”Œ<([ ¶ëK]:'!£«o` o`bz[Fˆ_-â!"Tç'Úš™YX¨K sqrEÕ6<ðÜyÒðQEFõ™Á[Ï6“i¼13BøÌ©ô§ )I¤€ôö¡¬ 'u‡ðW}S†^æàÖmÜ—PÔú¾ž€IŠr騧Á\_ÕÈ#‰R<Ü®%&pÓ=îõû¶ŽöŽÎΖ†ÚšWí½O‹â³ÓwH½_Vë« x*äAMãÜÎãúUO;°íêîmaAFL$÷y7T€¤@RÀ‡,EUoûë̤(7g'''7|rNiç0¥|¸¯%!ïÿú}ë³'õ ÏßO„`c¯ë‹Cîx¹¹¹ûE=zцåôwÝ¿åéæûàáƒÔøˆ¸”ü—/s‹z(ã-úÚ^gß+ê'!2©¿ímiÑÃÖ~¨AI¤€u÷͸vdh°¯¯ohtœ^N ‰86Üßß?F$Mz41&8:Œ­?:N+¢f‘Iƒý}C”z!dž††éÛQ>„4Ýó-’I³ºûæŸöüÙ Èóoð[®™¹Å¬•ÁS’IöÔ\SÌ?ñÞŒYÑçq ù·>ä#óþ’I )H $’I¤H $’@R )H I¤@R )H $€¤@R )’I€¤@R )H I¤¾<È3È33ÿœÝÑÈ´ç&Òžï;•O&O¬5m…?ùg$Ï^ø]EŸòƒÎX&ÏS„fý˜’IŸÜ†OoIäùóçÍùͽÍxKšþÔ_Ê‘窊ö–„þܧ÷~ä›ÿE´Lò|º!OX˜<ŸØÈ"H ø] øØ(¡.“fÄ$A#£3äõ‘€…¶·ñ14<ŒÆ‰TÍ´¶7새¤)ÐZu £Ñ1zþŸ(©É/†ýŒCCS‰þCQ?zldZÑ0§ùƒ{£}uÊOJÝŠöóRöG3,©?ÑìþÙþHêoßÝ7Üì´ÐÙ+èu×lA¼}Št•ÐuCô¬í·{é‘Ÿ£s‚(ò>!ÍIÆûÑ-1$z•¿šÑŇQ—®‰"}'Ô5ø¹~X_stQ]A—.!¤f€ÊŸQò{Ÿ#{5t†’yI]CÖ^¨¹ûÃÏÄÓñùØ#é+HXIÊ!¯HÔ5L?JC}(%)ËPŠÄ® kOÔÔ<d¤€¯HRŠ3“’=aÞ|J‘aÊ8óm5}óÿBRxìµ”L[˜L^´Ljþ¬"üœ AR í§ÉÆòI>ÚÁˆ–,Afy3blüD´r ZºEä,ŒBÓâ‹îj$ÂJÙÛe ÔÜ;CR¯2)ùß.CF!³wàx}÷¿èW&TðlžøåOáÊaÄzÝ/B÷ ¤ptfb“Bí$Ô^Š.DÒ¨¤#/côÃÏÈ6 ç÷2ý ¥³hÓ.äà‡ò²‘±<úi)2ò¡šh ¥àÑê¥HNeç!OS´‘Iê¡–žßˆFàï%)EûxÇ„‰jjš^”8Y„i[˜³V¤øÇ")|)3®bF—SóK) 3ŠÊ©ª¢* ‘ÔâÄPMeˆ)âE¼ìè_<¨w|ªëC&hïAÄÁ…TíinC=ßÞR|ó&IJ±ñ£¢ÇhzC»Ž¾ù]UB.¢–‘ivkF瘑˜bÚ…¬"Ðñ³üÈÒÜHèÖÔÛâ4´u*x…º*‘ä)ä3Udr‰é þ± !U´y'J¯*Š5D»Ž£·ƒèeÚÿÒ¹3UTäxΣ{Õôc’¾I]·‹Ö5ô2Ñt2Óp2Swº­áªk§ä’¬`§ji 3Ñp¤9ÞÖñÖ°‹WÄ|dOа 1Òr1U§™ª;êû©9&):$(~8Œú$I•"\òÉm ‹© ¯Š «Ž ¯ Kxå[8†ùW:ê—ñ&"òQTxuTXUTxmpZ›W –ù‹Ý}‹ÓÍGo*Ç‘$7ÒtA)Þèÿ,AqO¦¬ò® nCxä¡‹öGÅ­3¢y÷FêF·¥» òÃ#f&–Nm–iQÛ(:±qé¡Â´~-J¯ŸÚê¾+Ú° å7 Í‹ˆ[½ïÿ,Í8&)~544B¹ŠÔ߃’CçITÓ†:+еÈ&˜òU±ß«.¤'€nÚ£Á± eü:µ]ÐECSG ·¹¹£×(\}¿UwOm>Ò‹ÃPåSÊÅ8ø:$¥à”dh…Ï?r²˜õô½£|œüÅ'K˺™gÈÙÇZ8•²-b=—ÆÉŸsìbùÞœ+–‰2ŽI:ê5{¸s¸3Žòåñ\,纘 å¦bGñ×””g5ŠtszÉzN¥¸F¥èõ:Þku¢ý ‘kå»Luµç\"Õ—5+$´ª¥ŸòȦ㫱 qeX0’ZŒ0ŠÖ~¾LEû˜PT"5£Uß a‹‰uFQªú…¼A¥ híFd5ÑOHþàÞ^U Ó,è¦"÷!±ÃHÖ uÐÛðgaèÛŸP^?ê|„ŽìDÚ>Û¡ÐÑ«¨m%»¢_¶¢ûSc*þDŽ£û¦ÒÔ@×åѱ#è†#%¿­‰³!¶3è–ÒÖF’—Ðú-(¥äcמ¡½«‘q$öÝé—®&»(GúÐ3hÛÔ7qX>8ÜþÎ’’wN¶2·íX³­ð‚¶Ã {u‡p=›wëV?å1WuKsÑ0ê_»5WÌÒBÃÙI×-Y\b`g¬J ‚sZ†’Ààa?½@+UwǼ ü[xÜ,Òåœ>L}Š¤ôjšÍÇû‘³%JÌCÃãðû|U’jÞÂ’¨à¡fKP¶‹Õs /ac~Îm¨ÏvԸݶ5Z#BÑ)IÅ)ÁFßìÅ®)êáÊ®˜¤Ú9oZà •l¢Õìc=5n½:t&Ðþœ#5’²ÿ£’ê[}<ªáŠÇ¼ ¢qQGxr<;×>/=ÇÝ$êXHÆ•½ ’Uߔ͡FReóx $õyÃ(Z{[ƒÖ­Bj†(,£:¸S¥å:¢ïEžI(<…G#GU´m=òÉœh«É3ZnÚ»ú\´ ”A±Ñ(8Å =Œˆ] Œ£ _ôÏ!çp‚BC‘‡3Ú†…f·)[Y("äH)Â>ÈJ-ù ÕÍÓ¯øÇ%%¢?õ¶û8Œ®9¢Î:$uy¦Š3ÐÒ­(ëñ‡g¢@ §ÑÞS¨¡mª¨: ýºå7Q†Iüçþpª¨¹íÝOùú˜¦€¯CR–N¯×mh]½­v+sͶ}¯·í\}0È(SÎ%ÞIÛ¬›ay Ãîêmûëwîo[½ö÷ÿßÞ}ÀEuå{Ïæ½Ý·o7Ùl’÷6kìb7Æ 6Tº ‚(¢¨J/ŠTE¥(M;j¬ ”aè `WD”X5Ò”Þfæ÷îa€¡ÅDE^òÿ~n&3÷Ì-3ás~9çž{Æz»WÜê]ñqV Ÿ~ÉØ|‘þÇðÃjIõrcJTMn_asq·¸­$È„÷±h4äÖ¶Û¤z²P4EÞË.ºû¼œðÄ1ˆyÔ¶r§>>é›`«Ž‘ËÑ:jïu%Ìça¸,Î_À¹pÞ߶IÃc ý3Ôý»>ÊÛX1Õ—ˆ¸8ÄDa»-FCÈmvtŸîTvÀ|JâýY_Ü—’“8I6Œ‡ìX,\´›ÈÍÅÅh(Ž’1ªyxUMŒ•Ç™DdçâÎ*CN·sºî,%ä÷R~Ï¥Æ<œª¥¶"\Í0N{eÞ·“T¶·ñŒòwØZ1TêžÜÒ0ÍU+/«-.™87fÕ¾õ>qq–Kk‡É×±W]ÎÑ0ÌÐÔ{1Uë¤]äjßáÝRœ· ©†O‡ý`xÍrÇ s¯;º«ò¦©_ö»»'+/cBŸù·Ì}¯Yù\·ð| ¤X0}MxL5;ºûz¿»íƒÊŦ•ð>Z~[Ýûôf+áûCÐÑÀ±‰õ„ôWã^~Çý´„K íÀ*[”óÚ¶*I†Ú|œŒÆ:œL®M¹ðIG¡¬…=¾Ød‡¤[ívȃ«1æ¢ï¸Ñác…ir˜¯‚ùó1ÔµàŠ=Jõc8.ƒÌ ¨‹æ*A{’3ÑÌïv£huj(cºTæ±}˜ Vâúã–7æÝÃz=L%eÈÏ„ò„§ ûú4}ù#u÷ùŒœcd»#Â|Ç9óÿm5ÿpËÓ~3ÛÝg²> ÚlG¸åžÐeÙÒi&[v&Ç™-)S°òÜwÍÌûœÅŽ0'ï#×”ó¦Ûo:š¾vgÄÛ_“ª tîzóôúC7Ž&ýœ¾lEþìG/>¹©5çç%~'®5Ho8xãõÑøGÙã¤2Sdaÿ-êîûšëQʉ™š›ƒÒbä壦AâýÕ•ÈŽº×]×±|ÊKPX"1Ø £ü<”Vây.êÅ5¼°¢®«a[ÅE(.F]ƒDî•#'Mïº*/+ÄÏ?ãÉ“–%'¯„Çå½Fñs<¯gž¼(j¹“ü®;KEŸŽÙðù3dÝFF²îáE x­=1ßF!îe!ã&nßAös44½—i éÓ!µ³`Ôä(³ƒþ1&~\“ÀdOŸ µŸ÷ºêµ ©ig7FïM4ö‹19ÀMP•+—6r÷L`BªtŽûá̵~Q&Ѷg®ª©L°Üxøš‰Ï;©êóCn#( ûîààåÒ«FÆ…Ó­]`BJé©AàÑLý€}L0¥W<ÙÿŽÃùý¢¢–ÔhQ Ú.Nµïl?{žÄÌ{èib=Aû Tm9%±‰ í Vû½u8Üû˜>¨Ã±: ﮨó~Ú÷ûu˜‘Oâ#£e.ÄöOÈï:¤<=|Š¤¾½¼ÈÑÇ&`»µ_ £ïSYéªáó\}Sü6l©>>eùŽí÷xØïµw«28s¡§•Ob‚™nµÌÒ`—“Ö¾;íüm6V ‘fÁ]ãÏí®¯ïÍCŠëººþ‹IɧŸ;~2#Ñi{ñð÷7$eåÝÒ¡l}â‡sg²ÎžJ¿²H±nàŒØÐÒ–Ñ}Ô’êý„’È&AOurY&è~oí~©CÐÍA{ž]¼‡Œxö× ºé/ta‚N¡K®¡œ"€2 ˆqñ>”*¯ôx Tö€áÌò¬ÿð{“4÷2­'¿Èm®»nMö¬ßìRÙý‡=8êšê&W÷cÿ˜£Nîõ¬ÿ0ÑV?IÉÄ,ñ0ó‰2}Û‚ýwºoO¾´|ÑX™â1“˜¥Pfn¦Í‰ï¯ vß-L¶ßP0zRñXv}ɘ‰²º©þ×d D'¨%E!¿§b³Ã7ÂÒ+ÔÊ3D¼„ZúÆ ïÉ5ó‰°ò ±òy…­ó‹MßgîfíÙ¶•¥wØ:ÿhSáŒÂ}¾ÅÜ}Ì’Þ|©6ø²x¹RÏN—ÄN‹Ä?t­>øR¸¨&øZ£pÈ„à`†pî>jI‘Ž-Á/¿‹Z$„ôá2ões§Ã²Î7r§óúÖ¹g»*M0õ6Ý}¢ÉÌÙ f;-­³Èv\/Ú„ý¤4ãé˜==öÉ€n8"¤O·¤ºoø¬ï7­³ItœV¢¥—oÝ[w÷µý6‡äún£e u÷‘.cˆýwCmUΓGY·oߺ•y'ë^öó¢†&vÄŸ/èÜŽ¢–!}.¤èGÉï_8_k]UÁéÝn‹´TÕÔ4µ´¨©¨,2X{<öFu£€úþ¡¢"°ÃOÀ«O;ã5uš¼÷ñ„’ö«²œ{ÞVzSfi†_ý‘ ¤òÒÂÊ:¯¾ª°¨¬™' "„BŠBŠôJD±u…wm5'[ïæJ”U?²ÒV0r9XÅ«=´ËuoÄÅ w+KÇ€¢5¦¡¢"½TÙ×Ãfý.áÞ ˆ/Q‰"(Þg½†¾}^Õ ;cue Ý•&Ç"+êùR„PHQH‘^ ©»)ÁÇÊ_ÿ¹T¢¸sÆIk¡éÓÂ\S i¥5÷ó+Å…”P„PHQH‘^J©'—CgŒ’IyX(nI øÂJÛc­¡k•]þÜvÕ-›³MÍ-[PHB!E!Ez% Ø‡ÚüŒµJc7¼* Ñx?4å¸-WÒ·Ûý²¹Üz…‚ŽCtC#¯õ–*Ê)B(¤(¤H/ôõ1aÃoª‹ ÚðÝ4µðô\qAct ý·ßÊÇe5–Ëåu6rëÙÝÕK……éݘÔT亨 •¥¢·ÆÍyãB¥I_ œàv4®†}K•…<Ó’bCŠ2Š ) )ÒË)%Ð÷êeyçÄVWGïÝiêE-'4\Må&ÝÈiæQ;Š ) )Ò« %|N}$ºÅçóØ~ËŠÖgÂá|ºE……éÝ jkNuì”hmµ½›B!E!õ{l³´=ü¦_âÇj»+B·¿“ØÍO ÞÕ˜½îô&çÖS„v÷] zÜ¿€•PHQH‘_W‡ :¶`Äë;UÝÝÕÞï£è6º=Ðœ[·¿VÜM‘ ›Ã Úý8/õO ) )ò+*p>j*QR >|Éš™×Œ—•¨x =ô¬‰jà¦F”—¡¨ˆ] QRÖ¶·×u(-i)b–ò*ˆöǺ®%Å-›¡¦Ž]ÏœÉ;!ú85U£ ‹Q]×RÄkÂËröè¢s(.…hÄ {Ýüv|k ñ›PQÆnÅ|¢ÖÔkÝŠ=b!JË!üyqNQB ) )ò†µ·ð±é%vo‚ö”TwlXec‹ì¶B4ûP—ÁÑZëæ?„µ)´u » µ¡gˆSñ¨mþq'aåR,^Ì-Z„ÕHÊVòõàƒ-fKut`Ù}òßiB1Žx´œ›®.tõàäìrv}u6üì ªÁ®_´zËp0¯ºiµk½ªçLØ­ÖX ú:^5µtè57!=æX¤ƒUŽ@Q5…¡¢"¿:¡¹·0y$>úû2$kQ[Óú3¾ƒè›í*ünªÙR1b0¦ÌÁ† °µÃUüc ö'³oçâãÿÆjsØXÃÒj 7 )y@\1q ÖšÃÖ–¦7*¶hä¿ûÊ||kkv1]ƒ“ ï€Z ,º2ž » °±¡ Æ‘x4ó;vÍItÖUÃÇÒÌNVÂÒ‹Õ!5ûã…ÉÛŒ+§1m<”µaiÃÅ-§TÔuÌMB(¤(¤Hí QeÉñÇLũþú¨­ðêpÖ£GCz*œö‰«éî¯eÇwÒâˆ_WcîxÈ®@õkp÷࣯Q#.)¸‡)£ áÈ>ß`;o4‹‹®2ïüùÍï¾2_¥=綗‰§0|,Ò_ òŒæc/·-Š,gc¹Û,tÙ±)úÒ¼0z$‚£[ú-›jà·ߪ ø5J@i$V¸ Fœég=!¯Ž hÔ¡¢"¿"§Duæzu˜í@ÈN|ô'aëFx©ˆQú+¦ÁÚ;,!§‹ûUí¶tRÒÛ…T=æL€ª%j›„!Õ_˜€¢^ÄG˜%ƒÕ>L«ƒ ©>m!•~ÿBÁû )}׶—©g1i:î£âV©â@»®rZ€µ[Q×ÔÅ9´¼*…ÖdÌ5CY][ÑËú3{AêÛQø¯0A÷óÖ S*ÛR0á[l=„†zTV¢ú%¶ëbø4<.CL>î‡GE¨¬`‹rîc¦j#§›M`² ÏŠQU‰ª*<¹Šo¿‚IÔ»ï[£us”W ¢‚*5³&Ã#•÷a¤Œ­Á¨­gO9Ó­‚ »¸Jôêy&¦upËU6QžÖ¿Ä©ƒÈúÎ 1l* Û}ÏÍ ?…+Y-ƒÛ ¡¢"ÝçS[¼ÜÇÈ~0°Gð÷8|gBñÍ?¡å&üs<†ü[ŽãÄa?ƒÍFŠÐ«­°Øßa×Ù¶5?îÀÿÄõl6¤þÔå­ 8fƒ¯¥‘þîë`³µí†.Ñv/ooµ";´½¬Êž }Qñ«æ#0¬­(û¾‰”G>fëWW ýYÕCAU[aîu „´Ÿºý$>lw¬§˜)‡=áhà½ëOE……Ôï2§„õä¡M ‹‹ÂÚ¸I8N`ûR ˜ˆìjØM‡´®°Ð¦f­{ŒÓ ·%ݶqD-)§@#'90ž†ÁÓ‘W˜½øãæcäf#7w.Ac"&ë¡ø¶˜`• ²˜¢<Ž‹gðÕÃåÒ»)c%Ì_‹gÏ‘gOŒñc˜Š—÷±B ŽA((ANržÂc ƨãDz®šQâ¯.m?F ó^ÇëFT•ÀÏ“æáÒ”N„BŠBŠ¼QH1j2¡4FÛPÕ®êÎYö†)kS|ú¸„Hl´yþ5©;6ÇÚ¶MÆWÃGãË/ñÅøû_1|„qêÃîöÓÏÙõŸÿÿø s–"3xgC|ü>ùŒ-úìS|ò,ìo9‡¿Zî&ëâkuøÆøí¾"Ê)òÿ7¤¼[BªëöÅm&¤~‡·—[RΧnw{bïc¹…?Á€BŠôÍÖ¨ SfItJFü›D9!}?¤n\µ÷<à›Rxð6ÿ­æÖå»ð2K&Ÿ )çÃLH­óç®c²£×¦%uêöA¦‰—ÉcN¦7– Û’r¢"„ÞõÂþÖݬÛŽ¶1®Ç¯º»,Z§Ú%Ø%²ËÞÄ•nÁÊ6 Í·/±õ}‹ž¯¾ŸäJ#·Ã¶û’ZΤW‡#Wæج1YÇd…!„|X¯^½Šˆˆ ܳwï>vÙÇ<îwØ´IUUU]]ƒ]44”çΛ¥  ¦¦®©¥¥¡ùÞ ---mÍŽ+5[N£·5æ {û ›…(¤!äÃ6¦:{øðÁVwwOáâåééíÍ<´¼|_‹§øñ}è—ÏÄÓÝÝBŠBúBBuˆ*æeFF†³³³››Ûæ?°-bR„ҧ‹ )—öõ…!„ôµ¢–T+æ{ "„¾ãæÍ›ŽŽŽ®bï$­¶¸»osßòµpww £"„¾Ð’*++»qãFºXRRÒÙ³gÃßBDDø©£‡ö9q.ì×m˜˜˜È$fú‡ÆœCvv6_øó=ºsŸB>hH1šÅÊÛBoÎj·sœhÉw±oŒê¤u¯·oßn2“P¢o†þB!ä&T‡5< ©è¸ÄÔ /]º˜šœÀåpb’/\H‰Šdqb“˜1ÌÊø¤4ö-Î'ÆEq"c“ããSÒ®\NðX«9Ý`Sh$›A1ñÉìž.]L;ŸÃåDÇ%$&&%ŸO½xñÒ…ÔäØhfSf§¬ÌÌ̾ßôGB!}ÓˆxðàQdø™ƒž– ã¥þÝo°¼®ÕQNŒŸ®ô7ó]™D‰Ž=ë·|ÜØ9;#¢WÈ í÷õ±Z¦ÛÎÅÅî°\m¸aêù2Sæ™m\«-gèÈ„TdD¨ß&ý Cû÷ë?xªÆÚ Sîv¦ÆËõÕ¦ôõ虋<„p¢¢8},¤º±O!䃆ï§Ç÷m6™9qê"KÏàý^:Ó&Ì3õ<í¿lô°!±ñqnêãǨ» °=e¦íÎÃÁþªÓ¤u­·¸Ù®‘.5s±éÎýGÜM´g,gBŠ{ú°ûì±Öl;|ò€çÒÙÒó—Ùûì°˜0|øì¥ö{™iLþFÙ èd8‡Õ×ZR„Bú\HñOî_·[®¢²Ìò7ñ|JÒ÷›WNP4>s@Â0-§SIaÞ c¾[½û´§ñ´ ò‹7ºmvqq4TŸ3_gÍz}miM«Ã¡ÜóÉÜí&ZŠ ?ûýnÿ€½öx;¯PŸ¡®oîîf:w±¡Ï‘sñ I1ǽ'Ïqø¾v÷Békx|ÁO?\¶X¢ªc´á47&61ñœ·™Œì²ÀAfr“Õ¬ƒ\—~#¿öTøi‡EcÆË/¶°±6737³´Û¾k¯Ó m…Õ›ŸŽˆãl3…7$Øk™Êlu]CS#­9²šË,6»Zè®\»ûø¹è˜Ø¸ÓZ3gÙù]”¢"„ò -©‡·\Öj*júžä$ÆGú˜/œ¨jràdĹ#.Š“efÊÍ^è¼/&âŒûú¹ Ú§ãRcC=7®·Ûìé°ZWÁh#Rñœm¢–'f¯íô1S ŽÄ$FŸ;¼q…’Š®ù6wS¹yZŽþǸ1Ñ'ýìe'Ï߶絤!„ürH5ó=þéû]®‹åç謶³4š=eúJGŸÐpNTÄéõ ý?2×÷xXtTD°¿‹ÚT­æÖÆ åg(Úûð0[¢`äpø RÛM…'8ÑG¶ëM”™cåîåbm¤ðÝXEÍ¥ÖöƲߌ¡¢oek®!÷ÝlCûcg#9R„B~9¤šïß~™Žªê3·€nT‡¹ßËÂÐÎ+TüòÈ®-† ÔÔu œüÅ&'ör¶Þpò\dL g¿—“åÖÝa‘œÈˆ³Þ6ËUç©,·tñ ôµ7Zºd‘ÎRãU榆:šjKÖ9 eo¢"„ò&!õàÁýÐ踄”´ ¢û¤¢¹¢ áÄ&¦^HIäŠ"%Š›ÀÞ'uñBZrBlTd$ó2%1ŽËÞöĉMHfž3á˜ÂìçRêù¤ø„¤Ë—“Vjèï‹¿|ùrË}RìÞht!„7 ©¡¡¡QâÖ(D$^q$t(í¸R\à ߷ÓÍÞÙýðé°Îû£"„ò†!õ>tJ6‰" )B!,¤$ƒIxÿ.…!„¾Ò’ê9Á(¤!„ôR÷ïß a"#²×ݺu‹þBéL4“jiIÑ´®„B:çŸÏgrêõšŠBHw!õÁ‚~ʼnB!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!äæÿÙðEq endstream endobj 1620 0 obj << /Length 1665 /Filter /FlateDecode >> stream xÚ½ÙŽÛ6ðÝ_!ì“ D4I]”Óh‹M G›Ýö%Y,d™¶‰È’«c½Î×wxÙ’WëîLr83œ›Cagé`çíè·ËÑä9 J"9— '¦N0$¾s9w¾ºm%²´IÇ™ûWÍ+={ÛŠ9{»/4à ÏyZs½ðEd|uù~t~9úgDà0ìÍ<@1Žl=úz…9Àß;ù s¶ kíƒ1w.FŽ°«½jéèÉ—·®Cñ˜„ˆ‘è$çÃ=÷F¨F¡Š`‡!"Q`xGþ@2=ÉîB:ç$Ò=GƒØGIÌöœ+î,YÌÑ•#ê0ð#Ð?â±$Ð~\•u㕵·)s‘í¦Ò7Á(Žð!JÂD£mE1/·õtìE»_1R¿ ¾R¸<«çñ¾ýëJ,WÍI¬2Ÿ_ç¢hoObõ0ˆ•‹½Ð’@¼ "Ø‹#:¥~H§ È4¦A8=ÇOqïïì^©ê2O+QŸ”ëçl:%à W›ö–àa^¬ƒBN'*qÚNë4+OK|#ê&=‰a‚€~÷{hƒñxœ–½|Æž’VwÒ[ò að˜ôÞg "PÜ€<ò%E¤t¸ ür¨‡„€5Bj)¤‚ÓÆ9/–¢0e.-Ò|LBwW‹ÚBæz²©Æ»å7Œ)„îRÙÏÊG$’ Ö§HÝ©¸!pXŒiè.xUë5TXXßÈSy§+àv u8ÝÕ{5Jév?äáj¹áÕ¢¬Öi‘ñ>^Õ漶$s=iV‰[ua.ššç ¤uy°M.ÐÖ'ˆÅ]kz=C>ÀT¡¦¾TR²Ø-7( =ç–Æ/ÜT¥ä—–‚0WÊW“2 ½Ë"mÚÊ°ßV¢Ñ€E:+ÛFOW¥tÆV/:~“UcÂÜå8›ŠÚºçkx‰øÊ@ñöy¨"O«ä»qºh¿£Ä77óñ]º]ŠHwÍ i>×Ë]¸¼š)éŸ ›«T©cHC~p°š) H~eeö6iB†V™ ÆíJd+=•±"}§WYj0À¶Ù Á±ç™æñW™²üI˜jáÔ‚þz_Ž%dSÉvk®²ê)4!ËzGÞÉMZM ˆî ÝD%Ñu—jn+…«‡˜Ü«WšÇ…°cA©g°7 Êàj¤ëŠjÃ$+Aî¢y}Íí›»(AVª6í$v’A¶*7“àw£“FáK¸Éæ' >W¼-_<“Š¿Ë¼]7^ðJX¬OízíޞǪëtÏó†ÀiÎ+£^“£¤Åîhâ½¾oGf„í,eg/ûâžAçµ\ ®!äÈËnÆüG`F%û_£òé·ÏãËìÝÏ…ù˜=és‚{ß5Ã^½þ¬9øÝ5 ˆó•2¬Ä(fuÖ¬ÒMc?Á2h­#Je*É^oÙVºoÁzÿ @k; endstream endobj 1626 0 obj << /Length 1048 /Filter /FlateDecode >> stream xÚíWKo7¾ëW>íÃÇ>m¤@[4rik«§$(è%Ù‡Ê]GÑ¿ïp‡+­ìkå’´(tXr8óÍð›Ñ`ÈÈš0r3ûi1{õF&$§y"²X™&4Žb’FrIKò.¸{°¦P ç"Í‚?Zmquó`–:œs\¢àV—Zµ7’ ÊË·³_³¿f<2ÂI*<¢)KIQÍÞ}`d ò·„Q™gd×kU$J2ø–änöûŒùhYf×·7#Ô$£ —$å1Íxò,r ÎÓø€~‚‘qA„à4N£ç0‰òˆ²Hx NÜ"ÃDöT2ò“SÆùØ“G©¤yš­&«Ih6N^"HÉK"—êÎˬÛ6數×(„¼w°é«åøËGþÜß-‚pNÝIlí ¦Å¯{HEæz‡4+üŽÞ °ëü.5Ôbej»iB;ÜèÇÁç­®[㤟ÜV#¼…@‡VÓp.YÜ5Õä1.ÐÜîÿ[»niêv«‹îÐ9´ž8F.ðæqtV­B‘ŽÂ…ü{¢àô”¨8A¢àj:Œ˜÷\›þßäÎWõ–ºÙ"J>öGÍ SÅÇAÕ‚Y¥êÂëƒ×ûRWÞÖˆ­n›òÓi£+°Èƒ˶A¡ó?qÝc4,ØYÓy× ×µêšìRšK9tŠjkðö2£*9v¦Û Üel~•“îLY¢æF¹ ÒäÎT_SmUÑ¡Vãe#> ‹E"£C–»Ú (h¶\’ÜáÒ´ ˆ\z©?u&AF]øë«ÉÑÓ_HOR³3øS¢ZsçC‚ Ë-™“ ùsë5Ô°hG·´®wöÈýµ09‡¿ùãGwAçyñ›{²/Eð ‡r³Œr¨«DóM÷}[ªÊžˆ(†î™A§CuÅ£ûÍDAJ endstream endobj 1632 0 obj << /Length 1996 /Filter /FlateDecode >> stream xÚÕY[ã¶~Ÿ_! (`;,oâ%}Jé6A‹l'ÎÓ6(46ÇÖ–\IÞÙé¯ï!y(YynÞ—b€uxx>òÜ)ÓlÑìÃÕ‹«?ÿU¨Ì«¸Êw™æ™–†H+²Å*û4ûíДˢ+æ×\›Ùï­kâèá\¹ù5£³w‘p㶮h]|„6ÿcñËÕO‹«ÿ\1£‹Â%ÑTgËÝÕ§?h¶ú/%šì>pí2© <·ÙoWÿ¼¢¸Qæšu7Ž¤*C™f91L=)Y¸Î{é#†qxP¢è“2h&rBJ`™ÿƒ}Åìë1åÅÂJvŒâéR bµA¹Ëî&ª?ƒ Ï ØPÉdCªˆ±2ÚpßÔw嶬Öß{“dŒ­20±¹ÍaëÚaÈ£iW·[·ú~~­(=¸6˜vj‹§V™?—‚0c^¯åG¶öä3^tb둺„»¼Rœp`§]lÊÜ8§pîuY¹8N´ªîâàкUÝ>ÄçÊÝÍ! ŠÃ¶#ókß‘wYTqPW[d¾u§bÊ»ø< ¹#Üe½Û—ÛÄ{_v›`¯çtž–ƒê©½,8„…§yÚlLjùEÑ1ÀG ~uxxGɆ^QcÊÍ™R©˜ÑÑ'®Q×/—ùhQö)DOŒ¥8ó61C<_†¯¶çc·ŠÙo‡œ™tþO·q)ÑûkŒW,7qÔº¶-ëêÝTÝ—Û-hÙî·ÅÉXPç¿(åA¡QXWteÛ•ËÃx‘X·@>š…§më¦s+r*…tª‰â8ÁÉgu³òÕCŠð/OH6[nŠjí¥yb ö¡È‚Øëܨ¸¯°xS—K\—dߺîÞ9 ‡ùÜ‚v„ÊgÅœÓÙ—õ1i¹qéEÎvÅ×0‡ÈnaWtÀÖA§£1¨˜;[×u½“™êCƒI ÷ù" Þ5õ.Ž6åíÜÕhˆzÎóÙýö~FÅ^¦a³bW*o3ƒûZWî\¤”RŠÏ>s»6’ŠaQ-HJÛr]Ý¡q^]ܘt˜ºE©ÅjWVà)MÑ…³ø©‡8•<´()O¥@ÊœÍF‚ßï=Š€½Vi÷`2¥ü_S­ò,ãêQ§©÷êÉÁ;z]¡—‹8ñáoÿ=g 丅 X6`µ“6øѵ¡GäB£ú„ìÄ` õÞÇ%Ê‹óÁõ<º^¤›‰^ïžoÛÖ‘6ø38üœå3×kw"Ù´÷ûrwØEjÜ°ÅWß EÂ>tÀ@”3eˆâÙÌÕ ¥rOx°_²ïzeÿ½Ü•]j6:×€Ÿ¹öDb¯á#¸ÁiÇôûM™2h¿~È~çÜ ÝÄèKéö¶è{˜Þ+zi!!Wô*9…ŠÁó‹ziÑ왓sb 'º W9‚9îUPð·i奅{ E¯ðêÄ6¼ÀÞ;ÏQþõ~‚|ŒÒËú„×ëò‘I½ˆœ}»~]*A„Áhûék±ÛoÝسÑEO¼ÃxÂËû}[ןShÆ¢ð—Wø®Ì%áì²>[@Ðs}” œ÷gÜhGÉßÈ{eN¸ÅŽî&¨_sðÊELóaü'¨?žïC€þBÂË?RÎW*¼}Þ¼¥-püðe=åû‹ã €#ZhqÄÎEDFµVpécP†ý;%”‡òS“‘ÐókH4gy.„Dn˜µªs9ϘUwÍÍ…•’ ßYn‡+.ˆ% ¬ÆzzÀQŒSP›ÄÑTö§‘P¾…›0*Áä”" í£(3œZ„É5‡Â|ƒJƒI5Àè\KPÛÌÄiX®·>ÂHC\êÕôi¼¶#Œ]3®­`d>> (YnT‚ñ9Ñæœqd2×pų<Ïqþ8°q!a—Ò“¥QJhÂò3¶áé4\ûM[-_ŠBskEâ=åšÙE«,³G¦áOèŒ* ü*¹?¤g%9ôÓ0¼w4ðGðh.ÕÞ€á~÷àœ FYE~{=zC~|”§½ Éù[ % ê÷}áW(/î§Ä›3_W¹±DäXÎ?Îò¥ïO?».~;ýØø×áJ:úðð¢"Ä!“ë\^T„´÷:þŒŽ­B".©Ą¡àoS‚¸’ÄŽßB‹%hº} EKÔw±Ì|ì?±„×Ðøoý.á“h|۸ƽC†C%>cûìGÐm¤á¦ø‚‚Š©ÃMÀUã®nvEµDærÛOòïpkýwÁ@­úË€ÑúÜÜkÊtö]n žšîA ÒpíÏîîü'ΩƒÎ`ÉÎ!PTö¿}¯Õ’m Ê„ âQ=¢â1B‹æ^D: j0^R8›¨¬‚®†3 Š¿Ÿ*¸ÔDjv¢ê¶«›ôæz’¥Øïáþ6Ò §ø÷Þ¦-ùïÈ„îP¹û w½dµJVHÝæ©S=’ÙmŠä·'D¡Û¢íÆJÙãT;®Å§]¶_Ðʇn˜ô`ÿîpܱ¡ì_ãêÿËH|{™{}~ü“XN„o*røývçï6êÅ?ÝMV?è2ÃTÌdl¡©‚vÃÂ@~¿)ö]ú™ÑÐ&ç³÷uå âúÐDŸ>.Š ½ÿ ­·! endstream endobj 1638 0 obj << /Length 2506 /Filter /FlateDecode >> stream xÚ¥]oܸñÝ¿B@º de‰”()oíá.õáP¤}H­¬åzÕhEUÒÆõ¿ï gHIkÙç`ÀüÐp¾8ŸÜ(¸¢àýÕ_n¯®’*(ÂB Ü™©0MÒ Kò0)dp»>m>žûº*Çr»Y¾ùÇ {š½?×{½ÝÅÑæ-müª]š2a¼ýíöç«o¯þ{Å(ˆƒLò$Ì¢,¨NWŸ~‹‚=ìÿD¡,òàÁB‚Då06ÁÇ«¿_EÌmd¿õ÷M~}?êòPÅ2Èâ4Ìcõ"æ ˆg©Ç¾À‘dž8|‘·(2,€ !ˆü¶hl=Ý™)Â(Ž'"¸›d€/ËÚ^‡U¼ÑüÚ”r¸6•àµ2Lã"È"æEB·¦Ûò®ÑûwÛŠ¢Mkࢠ³7ãQÓÞ Û}ÝÞÓÂhìÊê‹yïŸÊÕõyÑëö`úS9ÖƯ›†Ò–i!ãPJ¹dýÍ0š^ï­‰¯]Ö¥µ.Ü Mdçù«­í‰É#‚4Š_cò ;’ÅÌýÁ9•’¡T,â‡mœn@q[ðqTžH*ïs RnàåãÈG ´Áð0Yƒ…ni8¨„å©Á­xs·Ñæìàx¤»À™i‡Ô8&ýsÇ;Í™&•9uµçjÉ,êñH³ÏB(bßÛh ’fO6œ……äøx‹–(Ótc¡4™*®ëm¼iiÊ&‰Ón¦P»ž+Ôc{„ÓÖ$íy«œÝ1r²>ˆ¼2íÈ4™áÞ‘5xÞ)‘nnæVŽ°5£tÚñOóªl×ta©'rSî÷¨T ÊÃÈ€[Ö!qÒ”ÃH³…gYØcÉŸ¬Y ´J¼ú¯hmëQ÷¥SjczFwXP›²ë †Ñ¦éIê@¼VÇ3[Ã(=³‰þ¯FR?ƒÓrIj‡Ùݪi» éw-=  Ÿa=Köf4•árp¯G]±2“Ø—™{N^SiWBêí)½ÅL:¡ØB%ëÝ ´§6±²õL»¬3ãÍí®“DruúèØò­5ëŒê¿\—5+夓2RÎrBgúÑ%„½Æ*G·#ÛëË÷I$B•$¨EfB¼ÜžÄ ýnxFgÞ;Ì¿Û_ŽOdhl$4ɈJ‘fxgïºL-ûºeãü¨‡µ¾Õ_Ûoj† –€#BCB ƒ`qν$ÁüÝJ˜Æï|ËZ¡ë¸žœêÜÐ5òÖ©¸A?ŒhÞ‹ù1Ë/zM¦]1í}H뛃ëé»r–}¾¯XˆŠÛžúæ²ø½`ìëû{ÇС1/°@¤.è»çZ}ŽÒÈ‹ÅÏ °‡èeµ8¡Ð&ŸçÁF@GÍ&NœüU—ý\¸6ÂØ×Ê£´gNeSëaõ¡ãMkvÓ‡AŸÏÒ¸¾ÿùà;<ôI¤@©ßó‚ðíÌ=5.\R¤E˜$¬ !ßØÇD—t Âe0yW¿—ܲ0/„ïÆma¡r.ù ªa½×6¥q7‘sR,R"ª[AípeŸ6¡“d¦­4â ÷ÎåêeO8÷>E'°«ÛóŒLõ…;Œ‰Ö[ï\€šg®šúTûD Õ?æ%`ó@ÛP8©Keaªà~\ñ<³J‚^(7‡Û, =ï^PšÞ4®p°l§øbÆ5jmÎ=W‘` ¥…“ ‚qÊ5_çÍaE†‹@ñÍ2@õ‘y‰é±#ç·˜P}AAª0V©;3öç5Ä_æŒ}‰I©5F´óˆk¼`Kî8qÀ7Œ ¿ !¿£ ,“Íß íÎ=‹*ÖF"™P'@Vmcj³I¡i¦©\ËÑ>šP”Uëê…c"÷Âsx*¾,B)‹…^“bÊ 2ñ¶{I)6 t6üÕÐ?ÆèqÒ ë=ÀæW™‚¹ /ðG]³>+¹ý!çSÏçMï/c–Ýxî)î þ)‘,‹´“Ƶä¹"ÎMúnw½MÎn!â¾Ânóli·…³Ûây»-rwæyxÕp‹0Ïó…å*ÿD©"O‹ô“YÑËÐ3E§þvÓ)È"{ȈúŠNß…TÖ\$H!Håjy%7ÖÀ]ôV®o…=eÁ¬•ˆ,Æ÷Å•Kˆó0“‰“†ÚzEKI&…wƒúYòTR,8™~ó°Nês’âHžqNRPè׶¥VübãÞpVP³ŽŽ@‹\Ý»Ò.V2¢¸x^j}7¥0ÚúÒ’g9ãâõE»ÇÉc¡í”K!œ`æ±ô¢íy…´hÿÜKC]t>¾^b¯b-ÚäÀ!êuí¹«.oL€û柟þ( (Æ1g¤<Œí“úôsBø¸• ωêʧ̽—CV{¥Àÿÿôµ™Á endstream endobj 1647 0 obj << /Length 1919 /Filter /FlateDecode >> stream xÚ½koÛ6ð»…€}¨ 4ª¨·Š¢ÀÖmAº­ío_Ú"£%ÚÖ¦×(©i†þøyGIv¼4b0)òxïã:Ì‹,×ñ"þú³ä€ÃÅ·§ ׂÖéâ»ÕâÉ~d¥NÁ®ÕÆŠ=+'H}k•[ïìóAïùòÄ‹û·NH„N‡"ËæÚqá­(ïN|ÇsØòÃêåâ‡ÕâïƒË\‹!òÀ‰ÝØʪŻ®•ÃúKEWšX—zWeQci/~]¸·fé8+Ìu\?FV~iòõÒsí¡Ó”À©tvʵN¼†xèÛ,kd^ÔÛ剺vßàøËëï¿[ó¿Ó\tߎۚÇÕ‹7OÎÞ |Vµ¥¨DÝó¾0ßIŠ ü9îdéÇ¡]ô¸Vt8J‘5ÍE>'ƒÙ)„hiu'Æk‹ŠÆœ4$^²¦®E†·{žg7­¨F_ý!ŽƒUÓ „F/´?ÍyM§ê¦G@dPìÉʦ£síÞ4Á3ºuèE="•¼î¸&ØÆ\fŸò~Ç U6÷ø³ú.’¡«¶‘=¯iY c'Ì‚ž^é¥àÕI.Z-¥ÍÍÁ–j²$=ç4uYTE/r‡,Lý”Áêéž7D‰1ߊBÏ ÓèFˆÁiâpôŠ= ó¬ˆÅŽŸÜèU®å‡ŽË³ÔHCH»¾2»%…“l~‹ZbßIã„ðJamŽ"6~v8j‡<+׋rØ(ð(P…JÌC÷Tk9Ž@Ã.h8ÅÏß,O"׵ϵ¾¨ëDµ.¯pÞÿ„´É)‘>ÆI.6|({œ(KQ£;šÓì²¹U<í;ÊðjE–$w×ÙuË ìf ‡–3*áÎq}Ë#=…‰¯7cŒÌ— ƒò^g:¢@xÝ*Çݵ·¿ö –«¨ /,þ'ø÷0OF‡ñ^OPϼ_L±“˜ù3Ò¢ãîŽSÀæ8t*‚m)(WPå• è…ÔÙ` ù–ahÓù?ŒG0 R»ûqߵׄ³¨"ÿ{×õdGäx§”6»ZÙd°í…6DÙbðJÊ_ðPÑ‹¯ÊÕtó}ûr'*4ÖÙ Æ¡ÓäûK$e sI‹¼,(5p3L Íxˆ¨1È~hâ0LìÕÎ\Ö´”]†|×˦¤/»F%±KœT¼VL^'ç»-ðkèsÆ ±“údg“š(ÙµMSRÚëL…  7—òì¥Êz\Öºv˜v3{ ÉYâu:÷Í*1¯KÂÞõ#Ø+ûš§c%¢„ªÑ¼ØƤE™³â´y£)( ±ÄGŒP–nAÔÄBsÈ¥¨¡ê9*±žcubò-%ÜjÈ(­îÙ[Ïó,‰ ”¥Ù™Ñ×Ô°+Lj'Ñ›h<>Žû>²@¸…2‹OETÇçd'^” Ùj`2[=¥ï›¨`6$1ðäˆ øJ…@9p’õw™,Z‚9-©+Ô†ÅäOj¥ò:’~¦ª& &WÞ¿´úv˜.:á^]ÈûãÅ`åQÅ’fÅ•"‰”ø“bX—¤(­ë¢ÎØHqr( ›eÃÍ6¡ê5® Z©¼Ö¥ÑѬT#}ì‡Tª¾î–ýAäQ„÷!AxÈîiÙ¬yy²±v»¦Ì¿˜àhLgg‡ ËÄP­*y Z¦Zhj²·ƒÔ:…•‚v “° äÓkUÊåG¥W¡ÊµÞ A,{n¢ø‚ Êu‚$B–eë>øe·Œ”ª84g¸Ð(…-‚b¦:Šö'›M¯k~±˜Vì]M´#t)¡.–ÄÇš+>bZM=j¸Æ‚zAîŒÞ@ÞcÀÄÉ¡{ŽYô;€¤¤qòé–=G¼_ÇÉSà'ðgF±)”Vé…d¶rO¿Ÿ9­†…¼Ñ×SóÐ9¹rvÜ•;³\‹Ë cGú NF ŠJ4ƒAF³†;kÿš †Ýïá‡Æ½Gù0€pë7ù£á!ðƨêeA¢5ãà)‰õò‹o{óÿƒD½5@ÿøb¬&ðY|K@xÿöq% endstream endobj 1657 0 obj << /Length 1599 /Filter /FlateDecode >> stream xÚ­XYÛ6~÷¯Ð[d Ëð)*(úP Ý$(‚t×mQ$ÁF¶i[,¹’\7@~|‡R>×Ý]~ =¢æøæ¤h4ht=øi4xñ³PQF2ÅU4šE"UD&2JM’LD£iô!¾]7Å$ïòáOuü[kÜ]¯‹©^1?GÂ)MÞü#'løiôvðj4ø{À@"X”r`ž”¦Ñd9øð‰FS ¿(™Ž6îÔ2J”†µŒn¿螶َ¶–£„Š}õo¾\•æ¥“J«fáææz_¥‰b"J)%øœÓ%uSÙë³ÇC3)MsqŽ¸ :É< Ùè†Ð혲#&#”±]1–ž¤‚d©ŒÍNrð®NÅ# pªÄé2F2‰h6ygîfEÙY+J㹩îŠ)îÙs\Ûb¾¥QJ=¹kòÉÜŽ¿Þ5ëÒø“z]uýñÀÄLêjÚ⨙H¬'#pqª"ˆ3P-CÝ*³¹Ë']QWx6/MÓÙÅÒÔk/DP §`92„iýß…˜e¡xò˜ë}ED:%\ û†r&o¶©¼ïÍD)B6w™Š.Äü@9E#È^¢Cî_›Ê@ Ô6å‹)^ šÄïêf™—åW$ÛhàBÅã!§±…ÞášãbƒwëÖ´¸ëÆêââp«Ó)I˜èG…ôä@"Ù/CkÛÉøëÆnëfê%Ô¸¶Æk•W5Hõæü3äbgí+ü™EÞî¿=ö–y7YϺ¨ì*î1‚sÈ$!z#zàì’hÕÛAÐ5vûϯ§Y>‚²– SŸ£wú ¸ê¼Uåݺ±¦KÛ$·«ƒFR¨´ù«…Ámœ£Ox5Ý3,mïój©r¿W/ˆ)(&Líd«•Ü/Àè"0XÀk6JËBÑs$ †¥aÔ[ÆN ù#¯WxbÝÕ@©l›É X¦mçy.‚˼?Y YÜâvZWþÈʆµ}éÍû«|:mL¤—×uÏ8ÍŠÖ•Y0ÙêïË?d©wùÌe¿õ9Ô|nl o  –îMÀh¸ó‰nc¦{6”2öƒŠÚݼ¬Ç¾xì²ß‹  M÷=ŒmçáÞ}·^ŽW«žíĵÛ-ŠÎÛ46 ½Ùª"ì¡9ˆ¬/f»Mõ8ü¡cð¤ÿ ±Î*¬V¹<  ËÃv¿HøüpŒFC!c赨$_Qû€ÙÝ¢ð±±Y“Åy€(‘iŒî=uX'9©§*c¦W£+¼›LîkôÎÃCÏ*$ oàqÚcÀÎ-ìì÷ÊÕ·~šyDˆkËfk_]«r_šûZ­ÊâWú¼…ò2³ü>RÊ'Ás¦:‡Çé{qzPd‡ Y•ù3lÔaT@”¦Ð@9¾ðû1æ:uû˜éžk;W]4Üs˜¾Ó4;?2`’±K†û1»Ã½gü}†{žJ…€þà&æoÓ¦^}[åmû­1™I÷ãeÓòãÁ:v°ú)ÃòÉû!—Œ$‰ö)Swp9tÍëskMæó£ò¹ñ¹¬çÊz»^­ê¦ és4î¬ò¦ ­b;ÿÂ4}”ÛKéÒT=7nŠö;7¹pñyj ÙØ_Ç\׆Ë(ÿ_ËLîR<¥$lŠ² |™U¶uŠä¥p]q*‰ÊÒ}ÔüGƒG ö‹qí_è¸ÍÝ(7 nLÍ«ÿáõAÇe±Ä«E Oê% çʸÒÝî¿Q¯<{ûÚ‹2 ‚ÐØ‘ÊÝÂÎuöé=3· 0|èþv¡µ>=s Ê™±)ëÐX¬X¼ÞHW2¼¢®ÙÀzûç;ܬììkÇõ§I˜,QZí•nTN•kS‰öYŠÍ1$ÙyËRvãÏÈc ”Nã7þx^áº~ñ¥®)æsÓ´ApáéK7¸!-¼Ë¨WÁKÞž±# >Ëý£¢Zwö«FBÓ`ŽŠmQ9ᇃÑú)­²¿o¡&.9|*†ï»ÃªôMÞiÙúÖê9cgݹë½Ü þÃÏu2¬zð׺ãoŠÀ"á„1ßÊAë9Îãkw ¸-ÀY‹ºÄá3J b Ý×–d‡ÚýbeÿR endstream endobj 1525 0 obj << /Type /ObjStm /N 100 /First 983 /Length 1595 /Filter /FlateDecode >> stream xÚÅYQo7 ~÷¯ÐãºDR”4ÒÝ lkÑt@· (’Ôè²vv‘8Xûï÷Q²Øçæ.Ž J‰%~")\LT\‰øŸ1ÈÕˆèˆ';ÒÆRÇB6£N–3ÅiHF$§¢ À/¡L@ˆ«¡ÍDW%Q\ Õ¦ÔÆ*6±iHì"§FA³dãÚPÕΰ,Û2aEšÄ@8e.ls8T![aÂUEŽB;mª šœŠ£¨«0N«ìˆCãPÙöÈÁ‘h…RŠv‚ }íh)cEªm­!ÃFåä(GÓ’1Wb“ƒ¾’'(Õ¸š+Û 6Õœlq¢áRŒª†UÔ±%;&n\•[£ãåI¡”qR£‚ãåI¡€——Q«ã,2‰ÀÍÅôá¸à1GŽ+À%N‚k—)¡£pÇ‘7‚ÂÁA'ŒÂFÂM¦ Hì TV8¦Rlê2¨¦8B±r[€¹Ü ‚vɹqq€sÕ`VŠ.±ª[»Ù¸ÆdÜä™÷(ŽØւ˵qÅ%aãbîOŒ‚;-(pµ­…Û'­CKÎæyðËTj[Qáçm_  Ú¾°Æ7Š@5- –+€Csl» ìm€Ã/!+W„‚š‚fm§BP¨6‡ ª(°@3@ɨla-Ñ`IPWÌáU}Õ¢C'Z M&Ýóùlá\÷ÜÜkÀ)àêË´± ?žt¯.ççGÓ…;vÝ«gÏ]÷fúeáN&`™Â7_?OÁ8ý0tO¡|:[\Y6¨¶~Ò½ž^ͯ/ϧWËœÑæ~™¾¿8}2ÿâŽ-Ëè¹Ò 6:½ÄjÆåâÿvxæŽ[&j‡{ûûNžSöçœ]útòmA8_ ³*ø nÙ½‚ÈÖ pë¿Ýál6‡¶ãeŠµó¬mÛ&ÝÑõÙ¢¾˜}œtOæ—輪My8é~ê^tOcØyÎaIÌÙŠö¡ZÆË^-T+û’ äHG®ûqþfî€ïwW×göë/æ³ï}Lá‘ÁsûX‡oj”Z¨‡MW#–…ÒÍÕ¼}yö—dú^ü—O-emܲ ß}“Äå=¼QáþJÜÞ­…¶ë wÇï:>öX ÇÝàS̆°#|6„½< ì¥lÏŠËÜr¦MØ[)i7$éCh$©ô‚>Å;‚~S”#ù»xåˆÁk™“4¨ˆ–CQÊçä&m´¬Ñ4ýÝa ðî¨ûíõ ûûîÏÅâó]7ù.>^|6;üüòCg£îðìjqyz¾xwôu¶8ýòî×ùâÔÖ¿{9›>ZK‰G&òA² ÄÔeƒ‚(i|B0(H‘¼~ÿÌtg|µrKt7Τqƒ3Õû9Óm4ì(9ï DÐÔ·Mù¶É.rÅöælH}š`ÎØŠGW+žDx¾ñ Þy£‘¸xáý”PYû¨fÙÕœF¢º"«¤zN2,(}.#IÄKâ‚‘}q?AZ6iy@‰ÿŠ ±‡«”9a¯ Ø ‘J}Dj‰H•"5nŸ¶n—ÈkѶþ*Yc ü_Û7j*e7¯T- Ñ@’G:ÉŠ b‚½áž‘2T+¶~N©;NCÿsBCÜ8ëÞŒnU¬ùãK䂉<å¸óšÉš_5íÔºÔüPËXPWŸÍLaXH¡Í:Xƒ‚¤Ù×ýTjû°µ§¶F4Ž|„W­™ƒ—0ñnuW´f[ÜM»@)l®<¸:¸ºV½¨1 JI>3í¥ÖSÚàf4ÒÍ”zÍkC‹Ö ®=jÞý€ÀýòÂúÐ[ƒÀq$+‚ÈôBI{¡lAï­Š.›®»jœJ&¤!Å—!XMð}”ÆÌ[mnœ.[¦è¯wL•óØ+Z-wR¨>×a9)Ñ˦/ÂuAÊê¹è°`ŒÕŠûqéwÕUÒöÎ!²Kçà½ý˜Çø`,¹´vK„Ùß…t§s’tÏ;DGzÇŠ ÙoS>¤8,˜àÎp¥‚’}”<,(Ø:'d_ËcHeXÐ~ÔÀ«¶Ÿ:)mðÌ”î»ÿ”~lÒ endstream endobj 1670 0 obj << /Length 2016 /Filter /FlateDecode >> stream xÚ½ZmoÛ6þž_!æ` ͉’Ü¢ÀV¤oØÖ-É6]aÈm •%W”ãèßQ$eYv“8òŠ|u"ïŽÇ»çŽç`gæ`çÕÉ/×'׌;! 9åÎõÔñ©ã»rCæ\'·ÁÕªL㨊NÏ© þ’¢Ô£W«4§çÎ4áRd"’B¿0D9ýxýöäâúäó aØ!š¹‹|ì;ñâäÃGì$@ë`ÄÂÀY׳ŽËxfÎÕÉŸ'Ø(ŠëoåÌуËW-®<@œ0Ç' ¿“³Â}¯á¾Å# Ôá!AÔ#wñÀuãžaAõŠé(¶Ki‰ &¤-FÑ]Ÿ¡Ð,ãR8Ó½œ7ÆØ~֧ȩÀ)rמ"æÈ ô!F™(«ÓsŽñ Š—zå·Áùsýüá·÷ã««×ã«‹Ë¿/.5Rýü{x!g£'/Š<q•¹á[è',Ôð”Q>yjÖæ*pF>wÀoPè…Z»iV¬GU1Ö+Ì‚iÍäèêŒPCi2 ‚à)h =kŸ}ºN²å}žË ‚GòŽ¯)Ø£‡øÚÖa±p;ä¸OQHµ9.£JE‘§ŒiV‰rTï÷žÝYÍ8C¾çõ‹"»÷N¢WlÄt¢@1>NpÏE3XV‚eÇÓT™TûÔLäã4ÑcrfýlÖÐÀß µ*£ø“NnDzŒ =.V¹‰,‚-y"õ ·Ô»" ëqÔ ¦¤,–VpºÅʈ`÷týƒOv×Á€ÃÞc\#åL­àõv‰—ßÈKûˆ2O›L®–ËRHiBC èvÎM›T¦—€™áp(ƒÓ‹Àà”†ƒ‰Ð„•‰¦(DÛÝá³Âa/Wo‰i»ºa|WwŠhÀïóÏ})˜B „ÿž4l’âw#î÷óËÃí¿ëÀÂ'ÁÑüÒõ }[;^ÏSòë²Ñ'•d,–¯,ªWsKJgyT5tcÝ.›\¨ôpsJ¼A}ßóLÚÑCø³2Ö•á,ÃöìMï@Ã`Y@6ž¤YZ¥B…’÷˜`ynÐ/¯°j ?¸û°™Ó'ÖZRÚ±¦ù)Ô(C÷jP~¹ 58S¢òª‹Ù 3m·.˜kÂï~}ó⽿É'Å*7pÿ²ŸWÂöu.Œ¿ÔÌÍʺnQZ·<—ÑbRT[Œvúž”Ãe/ÜÓø²Š&Y*ç"yj{JyÒGO”`Ó ¿ûÊ¢¯–m^Ä‘O•—Ѷ”N–kodÌv»4:7_ú÷·@ ¨öîТS£<£U™%EŒÄB”38¥ETI—È¡)E­ ²HJ¥îh‘Êø\5ÇnÒê¶Õ Þž_Š›ÁGh<»! ,¨ÇŽVõS 55%&Ñé*ÙömÖâGUð[L”Âf‚6f¶±Ø4„dÈ-RÛÔ¤ØàÖƒKNËÜ€øÛÝ·‡4ìøÞ†];)ÙL‹IšÛ,¤0x£¾ì7•Åž|¸3;75‚6x,–u»î,'ªßË¡´F÷ýTÑûZ²òÝJˆû´8þ}¯üñéø;È%G•ûxè;Ô×vý0BŽ|êzI|c¿‹¨î?¸á ˜ê§®5Ý° vF“B…«®Ý4ÉTŒ0juGàÍtG`´é‚ÀKR™ÿ¨JöÊ°ÔeGÍJ—ÞmÙ²X•±ø†bM© ãTZaÛ’úÎò¦ÒuÿÖÒrCõ[xm€z»·ƒs;m»ÿo”n·k¢¦rÞt`TýÚ`š>Šî/öº”?øû½¿Ü¸°]b®/Ä«ÃrdI? vw/æѲ²ÿ\€Y8¥ƒE®ày¶*£ú"×Qó?ò¥·3 endstream endobj 1676 0 obj << /Length 1889 /Filter /FlateDecode >> stream xÚ­YéoÛ¸ÿž¿B{Ïd†·¨~Û#Û¾E·é&~ÐbÓ¶ðdÉOGÿ÷;ÔPŠd{Ó\bQÃáp83œù‘¦Á: ÁÛ³Ÿçgç¿ Ä$Ö\óU "M”TA$ ‘±æËàÓäº)ÓER'ÓÌä_•-±õ¶I—v:ct"áÊf6©,¾ ›~™ÿ~v1?ûÿƒiÀ‚ˆƒpI"‹íÙ§/4Xý÷€›à®åÚRxfÁõÙŸgÔkKÛ¾r`ãêí@ª6D3DLÃôƒ’#˜zm½°Uþ)3Ï^5©oí‹ÆOƒÖKË"ß‚ù|ø<œR|:P±$Æ°%x¥b¢!<˜•„‚,ý’ü>˜e˜ßQîë¤we8>FÇî ùÝ÷ÔûÅÖmQo:b™,þç©û›ª\xú¢hò›¢“l!3.}iQ}\RPϼªz½˜ÇëÈè)%5iùºFÌÒm›A«á)™zYí}r”ï5aûj¥WIF„dhé‹d±ÁdP¬úŒSÙÃZSÚ]–,ìAN&WE»œwË:ƒYo ‹ìÝCòÚ¼tþ›<¨U,"±ðâCQÛ7È6Z-×Zœ9[®ƒ|Þ«št«\§KŸ¦;å«žâŠI§}Sõc»Ðtmz8v}ßåë‹ËÛ^`^ô™y·+ÊÚ.}±ø¹ñ²\½°¦Ï¼†•ý*©í“J¹/isWM.½|ŽF äHÈ›f@úäþL“·æßØt+<²´èžÝ‡ì§ܴ;¥-ÈøSÌ[ãñÐë¤#9äWc³Sר7EåÙî6Ò’Òz®¶önÓ,MJÏ“ÖìsKðÂZ\‚¼¨Êuú¥¹Ž…ƒ”¯›2©ä¢ÛêïL qZñv'ž€»ƒÑÉ=`o|´mvõÁzkë;Û! ¯v;(÷a:8a*z¬«‡&å;ê®Ì~›Ùg…+.¨AŒöûúßS Ú•irëìŸÙê á:°üãq` Oðá.áÀÍã‡3~MåK€Í`š!°ñ‚_Ùp õ•"Ý}u±ïjâ»Ë?.n>\Ìñ-É÷§jø€ÿâ¿ó‹«?½ÿæBHGæÌg,—ï'ŸÏ?Þ|¼¼š_ãû'CCÃBP5T±ûaLYÈ8§!“L†,’ðj ¹€.€›ÃnB'ÛP )Bi¤ DsQà‹˜Ta¤¶Dðq_qh(¥îËÀH6”»–S€׊* ZŒ øj5ƒÙ ñ†»WãÇlâ…×Ø ˆÝXøba,9†OȘˆ`Aîó唵Ff¹~wñþý/—¿^ mó¡˜ùù æé!~´Ó8 øõ@ ðI›îŠ¥«÷5ã1»ŸC™Ò/ÜýŒ)¢cý°ibC"½d÷¦î~/øuv?§Q§S´ª…XDR¤Ç•,—îÖf¶.‹f7`ƒ~ÜÈÞ1]âxƒáùý'C å(¡çL‡0¦ý;7°k]vð/ߟ ãaZé$~÷c7™RÃmœ“ºOJ÷y¦“mèI5v^¯‰gþ.{z(E´!ãèÕ¶YÝXº]õ×ýí”Ý]vèIÒÔ èʲ=r.mm5v;S{Ie²rࢻ Ʋ½ZOeÖ^œ:N<®èî$¡Z§")õϦ²•ÃÔ<š\Èä¹uï]0\¶t´¯næmdã;—u„Üs›”™?$¾3Ý:EZx9"×côð±Çaá‰3‹ÜÝ¿éN/éêÄÇõû¢éï”Fhp ëlî蟻•„s«Ã ”Ôöèß ŽÍ®`0Í àÍùSÑÿL@X(8’³Cuÿ¦¶& endstream endobj 1684 0 obj << /Length 1370 /Filter /FlateDecode >> stream xÚµX[oÛ6~÷¯ ЇY@Ìð"‰RÞ²$-V`X—x{i‹@‘h[«,i’œ,ÿ~‡7Û²s±£"’!Ï9<—ï#IÐôiôëttú‘‡(ÆqÈB4!Áð#ìÇM3ôu|³jò4éoÂD4þ«•i}Zå™ô&”ŒOÌÀµ,dÒJÓá˜aê}Ÿ~]MGÿŽ((#ˆá>D t9úú  Æ?#‚y¡=k‰ü0‚onFŽˆ5”` öÌB®f‡5ð½ÁëÍ–(Åq0·'J0áÂìéR¦Uæ6’ºEÆ]« vAH¼å‚&ÌÑ–UÓá´*gv‘ú)“ôÌèí;ŒpH9 Eˆ}që¼#‚õö{""ÊE˜ˆð%0&ù<°2(R?°Í4À¶ý‘-=1&”nëQã¾à8ÑZr#ÑìIÑëxí|uTB†"phèÛ „¡À"ŠŒG?x“ñMWÕ¦5—¥„Ü3L‡Ì´å½,»öL9^…"±¢’Ïí’¼Mî yk–Þª8›ëXBvÐç4Ÿ›©º]•Vé5X³ÍIaF¦_씺˫²=Ôž.­aÅí¶À§ŒGWݵU!;ù.†9aC=6=]Ò—t |‡Ú6XU·PenÝó‡vŒévõÛòÊš9м¼OŠ<³úùÀEÏ[’ïòd]¾PÏ1Ôö[àeåüHàHˆc`®‡=Ø”ð’„ïp×Ò~L–ÅÚ?Ç|Ÿ¯2^$­i”•ù¶µLóo„°Ôô³5k·co©ŠVñÄœFI'3Ó±.7íFšD¨kª¢p“îíÊU!ìi'¸V£v¢,*ã/ ÆØðÊÁ´·ËyàÎqY¹XÈÔ’ûÑ®–†÷I™y9?„ô¤Ç#ˆu,±äµ´ä˜Älém©é‘žü>œÇEÕìs Rѹ]B²màkP=ï¸ýøNÞ¯œy¦‰cËù/ƶNœ§\‰Û<Ö½ª«j~hïÓ-åε vDŒèªœdr «ÍÔžpHs3mÑN¶hÛ®‘‰U/Ëy^ÊmÃL[sŸÆ…ÒâÀo_ž2ß¡C&gÊôdUtgÇT 1‹†aXÀ¹öÅas*®šíⲂߩ¸(З»¹˜(:VëSº ÃDóo¢ßVÝ£d®Z–ÁùL;Ó~hªÒU,¬È·Çû~?@D𲈣ê“^û®üô‰e]\êÌ¢s6Éú©ì 3qlAd•+‡¼[8&n–Iñ*%žô¹¨k"9Þ{4«sn6̹au@ÌÇŸ@Ÿ{¡bø¼Zµ†=¹•¾yÿÎx¤¾>Ñ›Ü> stream xÚÍY[o›H~÷¯@Ý[Z&saˆªJÛmmµ•v÷©­*‚ÁFÅ@¹$Íþú=sv];vÓÊ’ŽÏœÎ|ç›1¶–¶.'/瓳 &,ù‚ k[̈;Ür9>³æ ëýôº)“0¨ƒ™M]oú®ŠJݺl’E4³ žþ® WQU¤o¢ˆÌ>ÎßL^Ï'_&Fı\ Áäb× ×“÷±µû #æ{ÖòZ[ŽðàšZד'ØÌ«ßÊ¥¥W—½¨ÂC‚0Ë%yDìŒìÂà.ï¢bx„ZBøH8;g‡-‡CÊ|‚XòÓ ˜Ø¦¥7Œ0!ýa¤Ýqò]¯ \FV¼5òC2FWDá™ÇòK¨, -Wf¹!ÿ !¹Ür1°@žïè•þmf Œ§æYœ,›2Ò·U…Iœ„úîÝ_¯t#ȺqÙZê\_Ë&3=³¼¬we®q-ñ#›‹2/Š$[껢Ln+¤Û¹qYçí$’,ÎËuP'y;Š6±Wúæëu7½4ÉŒg^Èî•å!‰G@9ò¹ß¦éøfž2ÑíóÔŸ–ÉâüGÅnƱ·k\aƒÒåCÄóQ!…*C8ŽwH¡âiù=Ò NƒÂò<­JŽ‹|f¸l>óÀP\eE7êU¤æ6nÀ-Ë2oŠîבÿJÅCŸç²™ëèÅ(†tëÅy®Ú=GW Ti0@Ez½ç„uL¦H ƒ±VkDæðèŒ X(•,(Ò(@`”Hè@fò¨ I™N;ÑaV–K…ä æ”ùÀäA#(¸7Ì€‚uৣ`Îa (ÛEÁ‹(š´n O­¤áÊëú3^ÕßÎßú‹[*ÕW…gmNŽƒ0z ý^½þãÕÛ×?“S½oóžÎÔù‰g÷hæ<Ø›õ!8€æTÌÉ1&Þz’¾ÒH»;ùÜWÚ¦îòò³¹ ÆMšN…Œëä}Y¯ aÆ-Ê|FøôVéÆaǺ âåÓÓP›n“*¹IÒ¤¾Ÿ >=ý¨/‹øG3¡ã€0=Š ™‚–º?š {ÃüT&t`‰|oo"¼)âOq’FC¾ëh-ni |€à:¥y· L ºNØ–Q®¢ª'*ŸFª›˜cû¾É¯©NÛTÿ2Tzxel¨ !èéD(s]xin)Ãp)ºÖé6%úòŸ  9æ*Æ“ø”œÊ¼idÚ~iƒ–©`(”ÐK„Ÿ%·?á—¸R£QÖQ½Êò­Ü¸'Š†¡ŸÖ­rHJ¬¨Ý}>³v¦ÏÕ}ô~v´£š¼ê«ÑjÆSÂŒIkè=‰™uS©z“f3¬7µ/ºD@s®Ñ•‡Ú5FmKÝ…ÜDr£º#yó5Xà܇LºÎQìLE®ïìÆ çJJ;‚œ{£ôÉYÇ=˜›rňwaP(¹E*“”-Õkã¹¾¼á® ø+þ¦‰ã¨´«ä¿ÖŸ×u)ÝêÜ™š²÷³:,FgEDz”?Di·àòðsÕ¬mÝ0¡‚¶‰mƒÖ+àÿEÕÍo«è—uR…Æ)Û©:'ž‚壙î`”m`]Fà> Ñí¯·ÚÃD]ÚÔ ‹ø4FujþΗúlp‘”QXË »ßGˆñ#„°Uˆã^I ÃHp±{‡‚=¦Ô{£ôK]Ç}:F¸@¾³ÿ iš•Ð®ëýH€õDQ«Òº>u2‹Ð§ÔY鯫³ -ÄÔ ÚÍÒwO&‘¡ˆQþ ‰´o=cºUÏ>ø³ï¼ˆÃ¦ˆ}zL=?ŒÒ/g÷4[·/ÿK1/µ¦(m‘­P¤ uv”g`:kó}vÜ~tpê6"vº# ×l/óUbÎ%nåIB6FJ¶f}ø ¿¢²L‹(Óö›ûѹ®î<˜Eƒòÿ½ÅØ÷þwkó?8ùLTŠ~*1ùJ©:éƒiÀ<õ¨¶Ru´×뮘f dŽ”í ä8ÂÆÓýI§cº endstream endobj 1700 0 obj << /Length 1701 /Filter /FlateDecode >> stream xÚÅYmoÜ6 þ~¿Âèìè)’lù%X dmÚµØÐ4I?µE øäžW¿Å²›uØeI>ûÎI{IŠá€˜’)’"©‡”ƒOv^Î~;Ÿ¼p}'B‘O}çŸ]Í(ÃÑÂ=àÀ‰óÙûØYÁük#7 ëŽ+w<|¢‰*敦þÕžT<îÐm0¹jó1W‘\Æiµ=N®Ìn®±Ýµà«e’fb¤¶âR¦_ÆsæÄ>”1]LǶðú2mj^5,ÏÅÓ'À™µbc—Å•¦Ü ÎCÕœ­ÀòfmÌ“cÅ×kaáÉNeeùy èzPï·ÖͲüÅPŽìžÂð[«ó\DÂð.¥h§$* ö)‰xÔÂDㆹ ÑÈiÓ ¯<ÏÔž;÷(rw{†çkåhEð,Ó„:I ètº^A½ô Ý„l« =¸T}E›fÍ2UÅ……¯š_ŒÍ\@šS(\|#B×M§†ñË‚°¹Pù8]–R =º †CD¢ûu.t,¢w{ˆ]Ìþ}ºžQ·a$ïÝmt¹áou „#sònv9ç1ðÇÇri‘§uÂc[wD³ÆýàåË6ID½”é?–ŸøAPâ÷©7b¯… Áp?jbƒÑ¼0P£sKQ”=š”¯EüY¶ùRFo¦Ø›µÂ]ÙÛ7ÉTÕežÊØ0Ó’dÁ«LV#aǶ¤1›“*©ÓâÓá”[­&_B‘šœWÅ©{qwìºCbï07`( éƒa—Ë2{S3¯Šá‚2 DØ>v8§b ŽÖ…4™c`Y È·® dˆY—JϵŒQ1í.<…E€q¥E#ÃY³æò¼Ka5PVÔúî›Üö5Âïº(ô jŸ¶j_w¹«NWË7W: öúqª¶ýîã‹“EDçG BÈüüw‹Ìà5^§ü2coIÑ<6bÌ̵°U…ËÝÕ²/fýš×½ƒ/ÿqc£ÊðÙøKLÈÛ~mïòªp„c!¥•ÖqíS;h@£Þ½j‰€~ãˆò±wŸÒ1P3,FðÃTÈNFu¾@i.€]V©dPC„j›™ÛˆÕ¯9{s±»L–ß^yrz|rúæÙÄrï± ÀáˆüM‹8kW¦ü¹p•1ÏЪoZ&rQœYò¸fýï›% „îÓûçÐN*+ìv{¡4Êá†ÑD‡9FºA—ú1nJÇïV"QÈÊÛ¬QAwpõ+}P”‚˜Nh4‘”Y¦ñ[!†šQ°®ž\?²TÖ2Ù–kÊô«Ì Ðß™S £«(€5WÀ¤^G zÛXT5Ö Å}ã,‹iÙ`ÐÃg;À‚©-³Lª«ÆøT6PêÌ’äÖ% …=wXÓ<Ûé‹›úZól³NS›êYl†ÙÁš¢é™Í€ë‡[7%¨¯+Ãe¸–¦8Èjv®iQÀ¡æźi*{©õ·WÅÒÄû 8¡ R•Ü ŃQBo?€ôA~tßhb¸‘û0Nˆ< LpÐÔ![ªP/ÕÑ2}ìxøÀžÐ›á¼[¦>^H}æ•›'oß@XÃu3 Þ9÷ŽÛNö*4î]pÓ>Gßÿ™MÞwþŸüÿ„G!W ó:º^€h±ž~¶æUcÿUªïº”ªÏÅ£{÷°uçý“IñW endstream endobj 1706 0 obj << /Length 1440 /Filter /FlateDecode >> stream xÚÅXÛŽÛ6}÷Wð¡@ìbMSÔ=-R M$@›8E \‰¶ÕÕ-$µ› è¿w(R²$+®³[ X`M“£™á™™3#´G=[ü²]l~uã8 ÚîØ÷|zöbmSônù¦YÂ[­i-ßJ.ÌêY“¥|µvÈòÊl¼æ9g’›/.¦ØY}ؾX<Ý.>-°HƒB Ê=’%ÅâÝ‚RØvãݵRò‚>sôfñÇ‚Œ¼Þj]ÁÄ £Ûƒ¶í“%ÿÔd+ê/oõ?–óR™ýjg>kÁkQ%\ÊJ˜Ñä\š%VK^±”§vݬà¢ö¤¬DÁòã“fõž Z·—&íMÄ™Åëgc‚Ž‹BBp×8Eh…~ÇHGäPx.!fgtä8¦‘Uá ý¾™øvº30câ8C3zß ]‡Q§Xp´›ÕÜEoúÙF3 (‚hžf;8öM05®ë]ÖŠ|ìF’ b#±^­B–)Oª”‹5¿…8Kl"©Ÿ ³âR ΊK¥JÕk.fdg!9›>íDÑ=âz’^Z…^Å4½ú8aŠŒ`¸ú‰ ½Âéæë#‹8v=ˆ¨ %ñ°§ËTô²Ú[†¨SYUÚ1¦&U àRÈŠÐ9a¨±„•f±ç%Lõ¥:©ðªQu£®ÌY™ÏL=ZùþÒÖyVÔ•P¬ãe… V²½U«ãÒK²%šbÀZfi"“²éÄî2u0«4“7r (ÏʽùÚÔ¸O¨Ç®eÜ'æô··¿Û dû²ãɧºËr+¹«D»›¼ªy9¹d^íí=gzú™u~”:–#|¾‡ù|—@~¸b>h÷ÂóâPŠi>„úv†Ô×iþo¸Ï§ö‰MúÍ-Àx#ml7mDâGàÇ$Ë=?Éq°‹s]qš”¾¡É¡@.®‰ª¿¤©W(K×Á®K-ùEæük{¦wâ1-v ¢Ýpçx³€rR¨næË*© hÔr–r qÐ=s"ÐÀS™ˆ¬V³Ö´ãš>Š$îÄóÍuVnnÚBÒίÛBÔ«ÞŸŠlESöØâ:KAÂ1pÍiæ¥uÍ":Ûßk÷(Š“âÔ:BHƒÿ¡o¸­ ŠWM®2Ó9¶«Æ¯’•‰žÃ¾ŒÈå6A=døÔöÈéئòóR‰–ÎÓ&¹¤KãA0öTó©õÒ/ c7µî4¶iäy¥§Ò;Ù“t×$vzÇEOðÇÑRr5ÓUÎ<`&_a˜ü¹8ÒáÑ×üsåúO^½ühžOûLÁ²²k>yO©[0©¸€•×VO{¦hkêjòx_l_X‘_u­ØÌå¼…¶ÃÌÑÎ yÞÍò­E¯uÊi»ö‘CÕäVêÚšc)¼Ì6Ä7\) ¯~à7` 'À^;ªjQ‹˜ðÇRïÖ>iúüz¼‚4„¬ærSÚ½þ©›(,h­ÃçsËhÛ™øü-GR¾ÓuÅÀÊÎô±¾0-ÜU©G‚ý(:fã£ùÞÍ+×,¹y4¨!õó½®"á-4Q•°÷H3Ñ»¥ó­/¸¦Ì>wóabÞî¬X°º{Qlß!ÊÝ(Éy—¶ŽÛ)¾ÍYy/ÏÛN!­ãeS\s1k?‘¥tÁT^M˜¤fBg{>„òøFÛÏžÌnJÅ„jêyÿ%òÎã<““1ÜžOØÂþä@õèœc˜v­pÖ•Ïð¦0Ÿ±¹6 îoSSµ*¹Æ»„õÁp$ž’v_9CgeÍ“LË'=Û·Ä2F| ³—¥RÁêú”›ÎAOïC›ésxOòñ=h3ÿâsú»¨ð(vëd„= #¥óo–ÈóaPÜÎMÇ÷§ÞýNž| endstream endobj 1712 0 obj << /Length 1178 /Filter /FlateDecode >> stream xÚ­WßoÛ6~÷_Á¦{p‹!)Y?ò¶e^‚"kºX6¤AÁH”#T‘\Šjÿ~'‘R$GVãtð©ãñ»»ïè;’  "è|ö[8;ùÃvQ€—¹(LÇçøØ lÆèf¾®dqÅ-æùó¿K!õì¼JcqlQ2_hÁµÈ/…þ°1Ãôø6ü0[…³o3 Æ¢ÜÁñPô0»¹%(ùD°øè±Ñz@ŽëØ¡õì¯1Ž’¾ÃNßaJ|ì»L &¶§½þ̘ۘo÷A”AoS3ƒ…FY‰œç _’yŸ[6DÕªB¼,‹(åJèÏÇTÝ…{#úžñ¼2öëŸÜ =¹>âúØ¥6òÁ>3EŠ¼yËŽ˜†O°`×q¦0b6Å„ƒ¢úÎé 8÷RÒ³`BißN-w<žß!K’QèÝL2 Éð!%®cŽ P,uzªL¥V,”ˆÔiM*¤{.‚³:V‚lÝe¢NžKÈüI”"*½/áŒFªF-N%|êùû—¢Bê±IêÜÚ>µ¬à±¥Ñ²[R¿ËÓ±í–Þ—¶±ÑŽÐКå‰?dFIZײfƒ5ر›½Äöa³±í°íì>_|»MóÍ$au:¬gÖ!{0Vw(žŠjÎg#àþ”甲Wƒ7$þù&ËÐÒ±1õý·Ôµ¬Æpœå!µlP uJ³¤Ø¦¦…m¡ðÅ@ÆFdæ@5"Á#S¶£"W<5›ëaË¥JyÖ)|&„m*ÉUZ䧔tÇèx?UÒ=`’²élØ.ÃK{ù3ýÙL¿ ·ÀÿOAwl¸0SÑM­] Sh›öÙT_‘p¨öúCV™oyÝhëÙ½FV÷äz,—‘YMÚŠÝ&i&J<Ú LyJô˜ªÅS ³d$i–éYV_õŒïzURŠ¼ÝQȯPžºŽ2fß„jÕQZu€æ|"TtRšK×I½:ÚÊšmMt{[¢õLcÙ«h®)¥Þ€‡‹ÊR_`"¶"J“'o®å}‘ÅF·È“tóÌ´žÝ=uLªŽ…£nkãõÑDJÚÌvÜ>§¿Hv–~àÐé”™C£ìw*Ø´î(ƒ[ašÔ BìÇêí2+8äy$,­³²ÓœpÏ{A”¦»p™Öw¥²¥w§¶jy¼3ôV¥ˆ‡Ií˜ù&ÍÅè_ , OåÈyë9ÔAò8¾t#‹jÛyüg·@pënšÎí:Ýä\URL•è-¥Ø‹.…’©øÞˆ! íÙîèÌŒÄ}¥ìv”ŠoÆ}1{¬&ü‹»7 ‹«?W_>®Bs0Žnhýú<‚N¨»¨CÍÜ_P¯^Ñ ìöh씬þ W×½ì#¾û¥µ1ºc»ç[Õ¾ï} 436?^j`ï?š² endstream endobj 1716 0 obj << /Length 1299 /Filter /FlateDecode >> stream xÚ½XKsÛ6¾ëWàVr¦‚ð$ÈŽ'‡Î$™É´‡ÆÊ)Ε ™ŠRIÊÿ}Hñ%E´ìZ‚ vØýv?¬ Ú"‚>Î~_Îx€",@Ë â*ÀRH¤DˆEÄÑr¾z÷ÇëmR”y\&û¬cÄ¢ž˜•ÒŠåÚ§Ò3¢àmØÞ¼ÔYœ•°eI¼»dýΞã]úÎè5 ¨ÂwA{ÿ#ÞR]ü挚Ÿ9Aõƒ]w‚„8 œÁS\ Œ‚Ø)Ù§£#¤ I%±/— àˆ…NEæ{³ØÛp¦e&„Ҷ3/Ç‘ kŹF›QÍMt{Ï 1C!Ä#0ã8ˆXŒ&!µ;5§ØD£ 9`T˜u„Ù4aÞæÓ„eGX…à ª#¬áQo_DÓ0|dÈ5*¨š€ÜNè;©¡—Ra*ë†cöól¼>ɤ€,nË1¦—ýÅ„HzSŠ5VÚæô¾N†I¦‚ðäæÑ4õ™µôF Nõë0¸ AŠ—Àp:»u+"Š…¢}r+NäV½çÇl·_;†~ ’VñÁ¾*dïWº(’l ßèºZ>j› Î4Œ€W¿ûp7Ð.MãÆÚü–jxöÃj¿ÛÅÙڽęüí í>•{û,à–±rJËÚn;!ë…IV†+݉ao}éÅ°ªœB’JCtG BàÉßš#[fÞŒ#…0¶\WáÝ$©v‘Ç›M²¢ØºÜL-Òý¶ ‹V¶ö3{\ëë`‹ Õa\ïëà‹šK¯Ö!ú:䢦ԫuȾµ¨™õ¦ê5UClƒŠ‰À‹4ÊCÌÎê‘þœCI€*dF$²Yi¦Œo|&=Sʧ$u ]¢iê–˜âa‰[cœjW$™)fÎ!:f:æjp³æhua;™ƒµÎ µ§1Ь±`úw‰h*\áªÓ>öêÜÐhpŠC×Ðü‘<¹²nÎV˾VõþúJþÁÜtö¹Ýcš'=™©ºÎ¶çJö1ÏuV¦Ïõ¹êQlOiSÓ㦘ïŽi™Xî^õNÄ ¤rÒñpØç¥^ã±Þ¦a›]\ÝȪqu­F™Öë¢K±!·ÎAj–NêºG"†¶Ì _½jÀ^Ø.}œj@YœaÌ]|8ô9óƒdý‹/¥WŒ:öÌ=wþèMkGßµ¹¶éDOîÚƦ܌嘰ۨ•FVü'EÐؾîjm™iS«Sü:ÔʈÀ”Œ·Ÿ§ˆ´ÚPë÷j‚r™L÷ã œF…ä¯G&4„+ní³=Ùÿ„UªfÝ7aÕt‚¡|ë>®eæÍ9pÌáâ0ÞœuÑ*h…¿«š¼·Gýäˆ *T¼êY„)zÄw¿#K½›a3ÔÜ;Ú“Îçd½ÏtMæ*‡‹[Í¡}ÑÙ6É4îpWÿ_½R#^ýŸÞñΖaJ]Ö‡Xbˆ5cÞŸæþ`/8K?°Œ¸2íæs…$!)æ!P±•£Rõ·ùªÿdÞ endstream endobj 1728 0 obj << /Length 1637 /Filter /FlateDecode >> stream xÚ­XYÛ6~÷¯ЇÊ@Mñ()@Ú¤ ¤E›Ý>Ù ÕZ´MD–ën~}gxøX»Æn¼ð‡crf8Ç7¤h° hðvòÓõ$z#d“\r\/‚”iœ‘8Áu| ¯ÆNÏ‹¡˜Îxš…öª³ÔÛQ—j:c4üÁ2>¨J½²A8aÓO×ï&?_O¾L(£³Âc’Ò4˜¯'?Ñ þ»€‘gÁƬZ±Ì`¬‚«Éê ¥„}”p)pµdA1?ìŽÄb"bÉý™hJâ8µgzÝM9 ›¶ÕõÒÚû{§ït¥–æ@ª·Ìƒ?íÕP EÃalͱ¼] *ßó f<#9(4Š^]§ê¡ºŸÊÄø‰Ça¥oçE;3šYêÞŽµR¥*-½h:K”ÝÖH˜µžò$DC§, —Êmmj;î… f…³È¬à Ìò<|ƒ›½k1- {¥¶†ÑK_8£ð:· S_FÕè <3c$O{æz\ßÅ ¿ã©´Ô çŽzo4ZºÛ¶é;±§bïÔ0;>5ÙªMI.œ«mz'§ÔýÐé[ ñ8è¦î-{U çe(½äØE.—„B(©•¶ ’YyãDžmWêÚŠVJ;û;Õ6½šN{[g,áDðÌ™ìJëzšANg —aÙà!7uÕ¥å€@$’pn“Èr­ý]¯1èÈÀðทV8]tÍÚn[p‡*Öã$w1ÆEÕ76• gXE1Ÿˆ,³¥õ ¥|4;WÃоˆ¢V5m¥H§ÊU1y³Žúe7ÞÞFΔ“ɱŒ^­Šz©Þ7˃:¢¦öQ±ù²à‘L’æ$ñYðH_Òd 22ƃ$æDæçDÐ@J"ãÄI`þÀ4K€iÇœ=-9¡ŒíiAvœ …ÌËíT°8)xçÃÑ`¤+@‹”±ƒ4I)8Å¥ÿf© C€õØè@$¶ÔŒ’”dP‚,¿nÃF!l¹•nÐ…Ïþýz·°äãwÏË“;N-%Ѽ©z‰@sâïuñùÿùF‡®»ªÊäÖ)ÿžÍ²$„Aª?9EŽ%ÄùSòô Ôx¡N84³$sÝk* ¨EÆBpÚ ¥Ýf88ës&’$,êÒÞ;f²k83è‹Ä}3:ª…®¡çcU¸y¯l‘ þJ)4ã¥1¢E&x<`Zð@!¿X DæÀè[Ù¯U«êÒ4ÜH·5즨z°ë®©×€“è*q5¶»rãÞØa‘ŠÃ¡±œ¢,-a° lS=¬f«-$ë߬@vb¹ÛT;)§Öêz^¥_Ú´¾ÿÀ¤w›žæô8É^]:\ॄ,_8=)ãœA—!e,Sè‰ü|@fÒ„]•{jö±Ò ~¬Œ3nî‡G cQmæãø0ä/£±ï¢ª™Â¥]~ÃDl”ÊC$:å3b_’ã]ROÎq’ˆeB<LÅðpH©óòo¦¶7_nV /Kœ¹â„ëX7:Ž#·tPˆRø‡ìÊ ´1ËíxPŠ‘¹4wÙ5ckÙN:å 9 ^’©~ø×醽eø3§þÆìÄ@DÝVƒÀÂÚ?°cǶ†œ¨n‡»zvÔ Mè°ÒîšZôý¸V~b‡zðÎ÷–vZ¯£¤°'O t”‹ðžX<ËÎg „æü"|Ø©ÙÇ'ø™ðW|ƒí·Ñ€Ãk7j;ªaE=l`0^ârÏ0¡°œËŠûÉ®=0ˆ ÙóÝADž@.»ô_S™kêL@‘kS­@™G…åíjO¸Ž+°F¾²³Þ6:á/H¡K#_Ì0oU·Ö}ïú(ª°{b¼Ž81ÍVœÿÂl^ÔŽ=lÍÛtzP‡éÁÉ­š¥%°WÊq7+=_íŸ(ë±á>soKñ}P®.ýÓ0ºC$,ý—‘7’<¡Vá8-/*V!r"yz>£DwI­îiÙ¯U+÷yJUHÈC»‹ÿçRû§IkÇèî§ ®Äç«fS»}ìØ5ÍðbWËçÅø—ÍjÝ”‡b g|;"<9~ÇYbž} øñàK^%ý!ïä—Fx%1ÿ‚e‰}Š8%iÆý÷•W«¢Ý~†ËÌ ‡¯¶åãwxï?ËQf endstream endobj 1733 0 obj << /Length 1194 /Filter /FlateDecode >> stream xÚÅX]oÛ6}÷¯ °˜~Kì[WdmŠ-Ë2ïahû Ør,L–ôWIí~$®Y¦S&ƒ;×™{?Ûª7c‘Ué¼ÉÌ°¯S*ƒ´þÙ#äy;¢Nnòtáz7ß½5]N)ŒÚæ ö 7ûpì%…Š1%±€ÈE‡‰ÁuÜ%F$pÉ]rìaÄ”!q|>ARaÍb?"óu¹°®¡¥çBcÙí]›ˆ ᣸­R´¼•°µK{Á’˜/årgÏsmþmb8o%ÌyCGD³–˜?MCEˆ=wÓ>˜ªû2©Ú¡¥öÈ]…ó¤IoË*Këp™åéçì,mægõ¶Êàïä,ÛÀ„³n$n¾5Ï_DìédR)ì-f“4«‡Wð¢û6›­ßœéVº¦ÃÇyVïÇè¾ô9J)8¦q<2÷‡ôc Ç„Ž¡ßxÞ5Í\,g.P÷§œ§<}Š *3[¥^ÙĈ—r6f¯“Í&+n]§Ø®oÒªÕ³ÞT¯l_&ù¶jJ×Ö«²j°ÃóˆèUhE%V¾>z@CG”W† fŠÍò»Ðäþ:ÑËdY•kO•–Ÿã½eøá`T¾æhýåe²hÚÁŸX{°ØTºú$2ÛÆ?š„=7?Œ„,2éÍGîßgSn|‡§i[ý œc\a)†êÕ’âé|ûgJ<Îüþä5—-à—Ê¥³ì.1°ÙKÇ™í•&C< 9‘ÁEáþš'uº‘¸nrS—ù¶IqãXn°V~|çKYÝ9°<›ãlþ}ªd`žx”0¹ºËêtªC-yÍV@zÄ M˜leŸ—Á4^d^j óÂMZì´¡½›—e5 ØN‘øgƒ6F*(<H„S¤‚ c-ç¸ú©è¹éK…~© F9RW7#‰y¼_ û2ø&Y¬Êº©wEðaÕìÇý[”wÅmY.X¯àš°˜PÒu¥õ³µhü9 Ó ”V¯ E”2l{&@Lœ_à-BV>õ ž~uSî ç¬8 œ9o2ï ük„º<V§98hEꊯ –¦RX‚üxß»{ßmóðõ“ºã/Ž¾“ŒC:›7 ì‚E¥>ôù?Cr” endstream endobj 1747 0 obj << /Length 1687 /Filter /FlateDecode >> stream xÚ½ÛnÛ6ôÝ_!&1GR÷´Ëò$m­]ênmQÐ2c •%O’“eèÇ%ÙÉrkaÀ$ÉÃs¿ˆ: ‡:g£_¦£ŸN½ÐIHòЙ^8w"?&~â9Ó¹óÁ}·©²T4b<áQ쾯e…³³M6—ã £îÎe.E-qáNØøÓôõèd:ú{Äà1ê0DFNº}øD9À_;”xIì\éS+ÇcsçÝèíš e”P/BB•kY̳b”…·Y’ŠÍj†Ä'ny°eY75‚*¹Þ4¢Éð^ìfÅEY­Z@âf5nˆ1§î嘮Èr1Ë z8=öQqh_MÜ•3w•Š5.E17/‹z‰ :û× X‰k-Í,pÍVSâÎL*¡‚D&Œ‘$õ¬H+%û9Ñ"§„ˆ(ᡧ$2§!îÏφº´#±((´óQ5 t¸È ¯.z2OÜœ{Õ&—“ qÁÚ7X%›¸²PâœkFn½ÕfÒ³B"ïßs+ÃE!rœ_eynUªôêí>}'î°›—E^Úw¯²fÙ“xˆœ"º€º…2’çŠÓÚLõÓ¤½‘ÄãÆN> š$Ü’ºÚ: ÈØœ4ìpfŽmÖ@»œã¶6¦eш¬`,¤²Û+<ª8&ã‰ï‡îÔÈÖ 3í9œ×j‚ ´Ëª† eqÁ_KYì³ÌVN-ƒ0ÏŒÒrµÎe#pÙÑ1¬ Ÿ0›¦Tt¤"ϯÍM5N7kÛ—ÊÜ>cxQÓ-/}˜ ÷¦P˜½ÄG4pÙµµñ‘R®Õ«6‘8žI‘?m¼¾Ç,߆¤’×¢¬2{QáþÕ"hYü8fàä%¤v§ý8¶ÅBš×¶’S[õ²Ü(xh#{´RɺUóÄñâ4kc¡ _Zàw Æ¥¦V¨*£Ì‹v{n ëV-]ÚË:­²™´†Pl‘ ¿œÆŠ©È‡?‘ß!øu>è‹:fÀx>xüTie—Osk-òAFUq+aÄ¡±S ^qŸµÖ‘çú†RëU3#îM=b'È5˪Ü,–ÆKM> stream xÚµَܸñ}¾BoQ=Š¨[‰a`mØ^ï"ÀfìäÅÙ¶ÄéV¬£­ÃãÉקŠUÔÕòìÎÎ,0©b±XwÙv­£åZï®^}¼úë[?²R'¼Èúxkùqä„AhÅAâ©o}Ì­Oö‡¡-2ÙËݵ'ö¿:ÕÒìÝPäjw-\{O€U*Ù)úðÏ»_?þtõæãÕ—+'º–°bˆNìÆVV]}úÕµr€ÿd¹ŽŸ&Öƪ¬ J`,­Wÿ¼r™[×À¤ëx‘Ø‘°ZX¸ÞlÉ…§ ×qý˜Dz-{ulÚBuÄì\×+•æÖÒ׺ö8 $O ¦ïÅ6(FíDhjcjz~n\þ ªâUIC%Ïç¢>ÒÇAõwJÕø„å{‚ÔCuåZá~ÙÝ©i{^“Ÿ(ëœ&ecÈÃÙY[œû¢©Ýuû}ÿ—]ÚK–º¢:“P\!œ4dq_ø7(*tY´¿±¦ð ÿ@ñ KG‰ ߊ¢À Cñ µcpˆ8-¾ ‘ÏŠB~ˆ ûŽ›zLAXø¬ÑX»„ÌNIWˆÙ)bßIãÄÐm•u»IxtÏÕ¨0ò¬\( Ø £0t"/%¥¾(ò—ûlÃÈuµ ’£µ^jEoú êÃÀwD’<^o—Ö nôã-ä_„Êï{Nê%$ÿ›oýíQÎäùN ¡þg ÓÔ a|P+ë.8í¼ivÌܘð3¹“œ$¤N±%ó›®ïö?×Í]M>u9MN¸2ƶ ±Ínèíß5ͱTó]G ™6>Í ¯ñ Ã# _øÏæˆa"€51Kæ˜Ý*ù­¨†Š>¾î¼Ð–åÀk·MK“Þ`/4BŠœÇŽÆ“l’5¹â©ìiŒ\^ÚVÕ}y¿‹BÛ¡`øÝ¥nUçÀ´¾p®r7ê<ôóÈSªòØÎ)e€æeŽE¢mcwYÓ®µHîHÚª¿¯X¨©P±|è1¦Š5;‰+–ž_Ô(½í%Á^gȬ@3.²ór …ØI}.oØïÁ1&C·¬ ük@+2Ï[ÕñrÁË$¬~d~7}¯+uC AaÜt:håCH«#½AáªO|ðb®PÈÚP¿8Ý•àâh3-O¾UæG ¬|¿Xj}äæcç‚‚ÑjvuáÅl=öõJÉšiÕ 9t–Ζ1þ@y¢X絧”‡ºSáú¿‘¬|' 㧔‡Ù1‹ò@„Ÿ§<a:µ¼Ð 8¾ìÅ^¸b«@BÄ¿}´O’§åûÇ«ðÒ’@*uƒgË÷²G’¾¿5~J£ŽvücZçîUª™’˜IXÕPöŘ.b19×C“7”¹‰˜)oššp‘ç vyL_T˜Ÿ'`@ŸNO ‘üÙ3;æO ?I8ô–ñ€óP¼x¼þÇãåñ¼4$ˆ&ñ¨xñÃÈ ’È”ESfµžÅ_úïV ¬‹‚·§QÉìD³»¢?}/ÖŽUÐüÂç½U‡rÚsÓ-6‰)œL„¯;“¬©ÎM Ýá1Ç}­¬?ëKúœª!ö¥ #'Jqdz·Øù¦>µÞei¸)K•õûEift=¨¯ý"¶‡sŽz†N"àÛ¾ëÛpkìÛâ°ó\{0‹sq§¨{U–ÅQÕc˜” ¿G™€É üΧá°:°;7Ÿw ‡a¤ÍNEì-CH0D•eÙ`Gq×Ñ ªg£ýÈÀ­Ä=±¯û‚ƒ~Mòcòaè/°ôãp€oA+}CÀQy×2×kÂb0ÑØEÉPÒaNZzÀXè yP½,ÊŽ:aç®)Ò GM‹Kí3Y`mCÊÐïºÓÏg^ت;ÝÇá(wGK(ø£éŽÄF4j¤¡¨³rè¸Ç(a}àg:$7Œ¢¿'x·ö=žJ÷ÕIÀ/¿s~ò GCèm«¾ à?åLò;Íäì\ŒìlŠº^’8õ~Ù^λڭ¢È2a‚XÐΚ7‡–{ìï¶öiªc@Ç;ÌuDè#ÆÅ…)å^àèc8Ž~LŸÜï(;Ìh-c !-¥ÄhªÍG|IuÚ34vÖpøš99Í06YV2ÝÈÀä°V‹¾Às¾"#::#ýÇzân_$ŒÈÎJÙuª[{9@§¡™¤MF}Ê-o[_é‚85É%²!mœjÈ“%SÄ6¦+©+¶[ð[ð¼¢ÕϨ.ÞZµ)n%ÿ«c#»E Túîï¹tƹÐÂižÈmÐ#½ –uÆC*ø8kÕ2Î;6n£ipÊ¡­Š&{ªEdçйmú²F÷(²Oﶤ£lE€rª2„X"U˜ò4L8û"H"»£Y½÷Šh2€´¡`ýBEìŠCQ‚Ó¨‰>:Û’îaN :Ë–êЮš|(¡êšžºñ z{×Vщ ôáóÍ×O±gçÌ@Λ!¾›hÏùG£#ÉÇpìõ­° ÝaÒá>ÀÀ£2ž¤a¬B¸6U!\bOðu&˜³Ð1…²U2¿'”¥Ú5å• OÐ48[õ»_ŒEf¤nÓé5 Òc¾’W.À!ÈÅê0VTa¦ýþ[¯ÚZ2õ[¥rml(žìL]6“xj^5Ç—™‰©`d*™2Éœy2$õ9K>·³Ö(žäC¼7Øý„éüZ‘Öá~Ô+Â2U„I]½PÜÒØRÉ™…ÀËÜ瓃‚ÑîTq<õ†©€ŠƒZ[%€ÍwèÔŒd†j½%,I¤oɵ<1˜7Ò„ª Lؘ0Mé_pÞ5¼¯¦8¨¡!F^EÂýRa;#†äÉÜ&-u¥óó²SCW«97=· Ú7Z)eBU§ëT9™Äê`®:¦N½éá$õ&aS]¥5G)ë5õÙ?ð£.Ü0Îà!JVôEM7׋™¾/8¸ÎÚEÊÒ\pðK05f 8«i4­5 (ÇYç׫qSµe{ꢼ8¦W©»©±|´ò¨h±ƒ:Zš9ß’—o±¹TÃL·1»ÑøÛ¯ ©kk$¦O‰c¾È úºÅ1ë:‘ÀÌÜ Ø_­—86Õצªˆ<ÎCÂÙÒ¾Édô›çL-= _ÍÉ„ ømû¶m*Þ;¶E¾i‹&0ÍÙÀÁE‰Æô†ÆE‘AÔu‘1¯è ŠûŒÿo L%ÊumÑôPˆÀKS ”kO˜ÎÒî$ |T¾FohY[ œ×.ÑJˆx§ ¦ä•áL+šT8kÁ Ý‚3<ì7Sœ.PÛÇ 8úÀÌ£íÅ»!èÊPxeª ç‡_Þ€ŠV°¬oÐ =ß³‘8V•®§›†F†þç¾£"9‘80z®;¨ù ×ÀpÞzü&‚à[Åm—Í0ç;m³ºÛR¦b·}‹‚š_ÊŠئZ;½™XÓ¿õãÏ—æBlöì¤ì$ë£Z¿o­ÞÃÌ(Í“ÔÍ·½õ;ùSHgžñúl󽡚½C®ªfGÊC3ôKú7ëßÿhéxn‚¯šqÿâó¤þYt ¼ywe}zàkÎD‹ŸBçýós7 nuÆøú¬'±²A¯k‘œ`ý_±ÂÀñ¢ßý?±6ÿ_Uà9Bðklêðà?ª6ÉœQô‘ ŽŸø@‘žÐ#±fïÿ×ÉÏð endstream endobj 1765 0 obj << /Length 211 /Filter /FlateDecode >> stream xÚAOÃ0 …ïù>¶õ'8Íu&í §i‡h ¬ÒckÅß'4ô€Ä“í'ûù}¯@°RË FÀ£/àœmÑz¡ƒmµ/ý>±nصÕó5]J·û.Õ¦ê¦Oé˜â5•Á £®wa­îƒúP:?#ÐÅÜ¢#û“Ú¯Ðø>§­Xis=ÂF=*ú :×_^·Yþmõ'«Í95T-üŒh$á|8Éw‡xflu#Ì™ö<qèßß&Ê9^¦ý/àN endstream endobj 1667 0 obj << /Type /ObjStm /N 100 /First 969 /Length 1633 /Filter /FlateDecode >> stream xÚÍYÛNG}߯èGû!=ÝuéK„,a[$–É2Ž”ñx(d-‹äü}N5¬Ã^È Á~0Ô0§««N]ºz“\LZDüNÁ²ßx 6ÁžÄvÔq$ÉuT² É1Ó¢ŽSá/P§¦7G§b¯29-ÕÅ‹KÜ^±³×—£m“Õ•`šsv5ئ¹¸*¶i®®–4Š¯Ù¦:BjªŒ¡Úß`13»`Ó^°‚ÅÔ›­œË„Ì3IÌÙTñ¨`¼ bZª-k~Tì‘›#š³-KfKi®Th.Í—Šµ9S+ø2o2Ì hîä@DGÀflL×∌ê v‰c6)ƒâ¨¦‚¦Æ#œ@nhŒf:b®¤¶ü„’Û˜«²Ñ(R62BX°RÐÔ(ò¼%DV¨3Ë A]ÎÙ¶P$4óPn(3@±>p[¡.Åܤ„Úh®¡“R„Ô"RLÊf|NÚÈHf…¦ÑÎΨ{ë­ õüÑu¿ýþªÊê N®/.G¯^Ý„æD^P!ýÀ½"7z*äs Q2ùoúQ|Ô@VñŠ÷‰ÕÜÓ^WéÙ›NængÇu{ˆ£ÕA[±‡ìCÜ>€{E°¬ê>̦'ûã¹;p݇·{®û4þ2w_~úûrŒG§ãQ÷ÊÇ“ù•5¸`ëGÝÇñÕôzv2¾ºišío¿Œ?Ÿ½ž~qJ(ø\éÍ°@d»ïú–êÀY"ô¤í±È…|•Qé>  ¡õ“+[}£µ=Žã´Î1ZÆ0ŽK\ã8ë@Ž—€VáÉG‘~ †ì9Š¢¼Ò çè‰é;F‘õ`à°Ü:˜ †c Í8{A‚R*÷)¯Q%øˆºíƨƒËç¾®„œ]!Ü>@«Í4 _åõðÕ¸}ø* ßìTõ6áõ¥To‡t/3›/Z~‡É§?rØp&ÔòŽ‡ž µ(‘Kô6Ü<8O—8|ÚÖÛ¼MÏÛÒf3û Ú–v”Ïœû\Éë¦^°TöœS?*N˜\Ù4ž ÍÛ¥o-1lŒûƒq£wÜùŠ5nȺ80ë2ñº£C³.j±®‚P¼^(Ó\~ c¤‘Ú£<­*Ï4cg*ë!¢ô°u»“ÉÚn.ÄfO»ßtãíŠ!mɨ{=}ÏšþpØýܽëÞàåC3éÎpÁt–qñ£ì5Øõ*øZíÂX†Üþõñ:»÷ç“?»Ý¶C·{2?ŸNºýî×ïìß‹³ùüòÇ®»O//Æ~6þ|v4÷'Ó¿º«ÓÙõñqwq~|rtùÃä´{sv49¿Ÿž¾„ÉÛY‘2 GµLžìæLH ý&6ßîèÚ–›]ˆíaáÈõ‚ˤ€^*h´–¦ _b¨Àí¶ÝwÝOÓOS‡Ü~qrvt9Ï<½tÿšÑržòÀÒ]n(Ýç* ^æìÓÊÖ½‹sËÀûz× H³‚p,žkêJ$Ÿ6]žVÌìíëP/T¼”G^µ~C“äõݾ7Ê¢%J\´x!ÈtË×°-±d§1øöÕW1ûšh58n¬á«ëã«qkD¾úèùn)?Òä|À7Šúdß_…}¶OÙ8(•hˆ5ñé¬áuö¹ûÖ‘ŠÑ4>Äš'ä†q¬äuÉÞ>åâ°0S‹§*ÏLŒˆxûüzcŠâÈÂÅv¸%ë½_~›]b"+âæëé*P²k?Pjö¹¤@®hB¥HÈš!;Û`ÿ¿óMÎ2­ëLóöLCžêBHOÚ¶nE&Ïè^‹>Q0€ÔøÜmB’7²nmª˜ìb =ee&A [ì4WÔp[x­6µ ¬Í%à}cÉ H“"Žß(é“®'}âpÿ’2 endstream endobj 1770 0 obj << /Length 598 /Filter /FlateDecode >> stream xÚTMsÚ0½ûW¨éfj!Yß½µ IÉ!“‚{b88F€§`S#’æßwm‰òÊL:>¬Vûvµ~û$‚戠»ˆû+¢` ¢H%HQ‚“(_Eã ASØ¿G#ÑK‹Z!.5Ø%Eߣ¯iÔ»¸ÁF&¥3Ä ÅZP$M‚)(¢qçúÛ—Ç´?ìNÒûN9f\& žÌ…Bq°¡ÔÃÓþCúéqsR(¬os§q.¡‚B’2Ìýaƒ‡AÚ¥;£ëáà1….ÍÁOÅLñ6/n:Ð!ó¶KE§ª!YΧnB:ÛÒm½ÿR¸Eˆ¬7.«Ý'ï¹…õ‹Yµ\VÝD²œû­<+ýâ)`¶;õ«"DzÖå½¢,\o³­‹> stream xÚ1OÃ@ …÷û©1>ßÕ—¬ Zµ䘪Qr@¤µI*þ>GŽ H L¶Ÿìç÷¼ÁVÝ{u·1VÂþƒ³%ÚÊ€ïàÕ·¡o›©É veö2†!uÛ[ß…¼Ð”­’ðN¡C 2êüè÷êÑ««ÒñNæ9hÏêp$袾BS•ð9oÁJë jõ¤è'èRy­-²üÛêOVsjN¨Zìwd0kAŽ‡³üðÞ\¦[æ…0g»~JRÝýegÚ%f¤þŸDP. endstream endobj 1783 0 obj << /Length 1292 /Filter /FlateDecode >> stream xÚ­WYoã6~÷¯à£ ¬i%õ­‡z±H³‰SH÷A¶éXˆGǦù÷r(Û’ÓtÝ- ˜£Ñp8çÇ#„‘«sëóˆÃÊ'¡ !g4Š¬óÑÃF6ÀÿHcE^¬TN|Áš‘»ÑçÑOËÑtâ1•Pd¹%~Ìip¢bA9 ÈrC¼Ÿýñf9»Y~´âܧÒWÂÈOb*2’Æœ£ôìÓì÷ٵ͖}óTÒPú—šwržˆ}êG ‰Kêãyw³årq}5žˆ0òîop]ÜÜMן×3|žÿv‹°îÿpžÄ'ŽO„VóÄØ9Ý‹v1å5»´Fê±M7Ú÷’f2WW=æ÷×>KÒBoµ+ÇDšÒísæ•Õr_Òf‡Ô][¥ë¤Ið)u‡gÉ«®$îL‹ t#?/7ŽJŠ>MyµnÜæ}“¬2í<Ù–Uç\Ò µo«}YkjâY˜ðÆR`(æiU1ŽºI*G:ÛZ—ù>ãÍ£è\s/AÆQòzþÙéi÷û²jèx"}éÍMð¬M uSµë&-‹Ú kmkŠQÁécTF© Θ·W#ò`7ޯƂymÑ´¨hª“,KŒnÔè: œ|Ë”¼¬4îL ˆY~Øh#Äi¸6IVekÂ0ç"˜ ºØÀÇoXdL}c~¤œ7&x3+~R¯œР!Ø`Ï6žú2¨n$ô©ÆüN¸ (ƒôbš%¾[Ž#(M4r½Óë'gþ×ײEb—˜¨~5ÒŸua<íü.+¤º"ÿÐI7Ú½ivNÕ¶Ì2¬d¬'cK™çÌœ—æg"eÒ¨ˆ>–Á*‡`#ãè6¡OÃ08NOEÄØÓ zOÄt 81?0 0ìœsrHL æñÃöCÀÒ0rj+M¶oêeƒk [-fVF{å›Ü‡Æ˜†PR6Ãu2X>#Ç?[|=ö‘bÌ›ô ìÛ66cÕ¦Ùæ‚£Ï5˜.´¼·‚òn]¾¤°áÒ¬žW(¿¤´zùéõ¦Éè~ì`¤ƒ ¼M’ÿÂ&\éæEëbØX:iÚJ×}„´¾d¡Wµ‡j±OâÒ^YöDC˜ëzZ Ž^ß@ÃiÜyòd.AÇmkjË­ëÔOžq-÷vŸýˆ{K{[yËv{t–ÕHÞõ­Þ¥ëSs¢ÿ nuëBU´ùJWµ‹¼ÃõzW¶™KOë.ÊoE#S«ïƒ#ý˜ùÿR¹’²X| é!*þŸ IÀ-ú$m , ÈËÍBÎשnÖÓîÕ ¯Iž9Ág\ÙwÃÅñ=O3¨apþÐÀ(fˆpiÁŇÌÛ«·c© ¬)7¹šyÃtÎ{0ù®ËâOÆÄc[>H‚®­p8úaÿ§}‘ºv>†inFº¤pl;ƒû©8L¦êÐV J¶æ1m²oFÌŽÉØpð˜¥d)Ô ¥‹Mÿ¬®ùÍ0§Àš ¼á)a7õ‚ü>©k$àº1(3϶f4y&Ên`¨µP›8¬Hv<êBCÈ»hõ:ˆ'ŽfXœ"’4Àâ‚dÀôéà0Òˆ06Õ5]äfÞ_Ê“ ê}l>Møn!¾û)ÀGŒL§RÎ]%pôê ýÞÐpº endstream endobj 1779 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 171 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 10642 /Filter /FlateDecode >> stream xÚíWWÙš°Ï™537snæ/œ‹¹™‹¹úÖúæôqw»m·Ûv·ÛÙÆd“sQ$DHH DÎ9ç @ählr09‹P³¥ÂjµÁ˜lÞgmX¥RUíŠÞ½«jo à+³··wÄdz,ð‹‹:{^|[ªÙ\ËLMJJËšX’Ÿ‹ÞvÕ¶Î&CÅÂÛê+G×aÿÀµb±¯ìç{ÏE…ey¢DÝ/z&VÑÈ­µÅ¥\:{»ÛK‹‹«ëhxwgk}cseyiyem_;èÛ…Õõ-4,ßÚØ’o¯­­õ¶”Ö÷Ì*<¶¾¶¸¸¸%ßQLù1Gq„ß­ï~,êŸ׊æÔÀ—NL|xmnr~es~XJ¥Òy!Œ( O|xXdl<›É’ Ï®—ÚÄbqˆŸOCï$šƒEqFÇѽ)ÒáYe2Õ_œ%)H¤V¼_ë f†$&Ä1C#ÐbU!SŸLX ¶€kWšÚŒöøùö-S[×âºn4‚føsn×2¶·š“,k« ¤¡‘£Ý vÒÚ ÈÌ%Å1Ãu±>\¶·Ñß?,ßÝëÉb›¦4å…Ùø'¢‰%‘!Y}ÿRiï¶|+U(nêS+IíÆ0h%`¸f | 9ê ÆZâÚfÝ›7»åûßvÔæ<}úÊÖÖÖÆÊÒ6 jm0—@Cã§ÛÓ)œÌ¥÷V†Úîdº·­¡™r£„˜ØŒ¾Í‹"!Û=;Þ¢øg¯<3"¼°E-O° \Gò"èy­øp~9J\C7ü%© ©`'€ì'•5z2cßÉ—{‡gVúEn›4*/·--X—–Œ>fø[¿ñMm)à&6©l“) I‡ÐÇD5_Ú§ŠlÉì€ÚñµÁÜ™€ëQZ›"ۙܽûóí;wIþ¼e9¶õaÀDëÑí»÷¹™µÈ9‰ŸGÏ^¾Ò6lœ]î˲÷ŽAsMÉR=YéØú˜þã»ÏtÍêË~»ÿ(Ðà߈¾‡»gôn|¶7Õ×ÑÖ"ú V6wöë‰åÃnÞ¼ñÏïnÞþYÏØa\ÕX|òøÍás2éo•Ä6p½ÙÛÛûcH5ŒíË2Õ€-ÍŒuõ(å€mm¬ŽONÿI* í@sSÃsë°oP§6ýãÏ»ÆWÑðäÛÎШ„Ý=5Ù(þûšYí|)èQ—‘$ʃ›;pèW\[Êâü=ü|C¢·w±‰¡–0vÛë¬/ xñi’eù^múÍÜc……ÕöŽa»Û’¤˜î‰ù­u±D²±µÕÕP&äó¢2fV·»Ä9ÅuY"qÛ™Ýí,ÅFD¯ìÂN@a›X:#¾‚çïY;0;3ÜÁŽLœï.1²÷ž_Ýh/‰r¡Çcë}?ÝxÙÔXâÍÏÚ“¯»¿ù-8«eci*€ÁúÐSöTß~dêC[Q¸‘³$3HÏ1xfa%‹ç&Êú§—J!¶@e› ä:ùDë¯ÚNCÜØÔ²(úw·îéêêê¼~®cê¼·7~çÝÝy=Ç€åAnî¹0\É/®Kd؇f+3oúJ79!È?±}È‹!¿|©méÆØ:Y}WÝ6Iµh ˆïjäìÏKÊìÌ ³g¥ãß.¯mcØ»Û7^£á@;«Ônnc—!%:°¸}b¨(BÏS ˜n¥G÷µ•(%ˆ‘ÒŠ>‰#ÜíYQ,rQc/Ä6à IÔèJå ÜUç®+nwcŽæjïI¡¸»8å7 a؆þ›ÌÄ<©(ìÿ}÷ˈ«Œòúç½W³;¶½@wµ÷òöq±³É¬é/N Sc›Ð‚ÒÙÖŒŒþÝ¥woôŒº¦7`'  áÙ¶î÷LL³b“ÚzïF]1ØîjeIqumCœŸ+/§Ûxûò…ñ.†™¿x<´»®yA ó²Öéx?–æ·æe?þ`°²ÒŠ–ˆAd×Yi’9Á{òÃâêòBNý‘eufHß‘*—oÕäDþðÒa}mчBž^Xï­Jö㦬®o4•ç6umWþóN}ûðr·è‡§ú=#såQ¾ÁIÅ»›óÃG¡iŠ2ÔÄ@íÝÿ½Q3²û®{t£Œ7duž4*Í7!«HùZëNenR0‡WYߘÉË®é(ÏMâ$ä£Éó3â8œ¨Ä¬T²Âvâxœ‰¹Õ½¥®p~uk{uZÈ æbÇ&†y‘ ë[;Ë\ˆë[r¸u™ôòç€ÓžuG¼¾<™ŠƒÂ Ïð´RÅÝsØ­—'™ÝÕeLû-ãÝíåÅù½¹úÒÀ<À·Å`[…¨°z÷Q_PÇç.öÏ=Š¹±±ÑÒÖAð j9ø=² Ò£Ä=#p´ü‰¿®žþÕÕUõéwvvæ JÊm\½ŸZû>s 3ðN|éÂbIµs§•W/-/ïí?þ ø¶~má‡ò4ÌNOÖ×Væ—”—–tuÈä[êûVµWÅy¤Ð BT#·Ê°p&lSþ—a¡M˜-¿ŠÂÏÎ/,Æ?91.HÙgSûø­ŠÉðé3¶cFLé!„dG$dNMŒaPµWÚÏâÜÜ7ö^Îa’É{vÅ»r‘]¹à“ÞaFæ»Sü¥Mês‘©¾~’‘Іm^3†·iøcXŠ…6ìx¥tc’šëÉBVÕ ©šL}z|n3ƬX¶÷èžg¶··ë›µm¼Ý“»aFëŸ À—*ÂafÉ.±t÷ëìîA¢”ÌJæà'’9$5í¡èå•»ð5)*ªûK4OXÓž‰;;; €oª8ùÙo÷U#ߢ±Â ‘µÂvŒßr¸pó …6î¹FÕÒ‚x¶ÌìÏMüÉŒE3fŒläœã¨F•8 »V^쵕e8”ð xfo·¦º*88ˆL&S¨~ÞTËmk•~2ùs+N\=˜9:Eva·uœ=Žé rz¯WZïñ=£Š—BëåTÿ «Þñ6ñθbgïÔÔTiuÁ›õŒÀvˆj ©ß(ë`Q ®Þ´áVÁxEÊñÿÂiÓ€ÌcÚ-…@lj‚$Åô¦ÔX7tyyù«œºr¹<5-=6.!6>ñSdTŒ¬½ãÐß½{——x¾‰Ë~˜›;4ǪªªèØøóÝ@”"¢b677᪼ª™ž ÷Œ,ñHéæµ(n÷ Ë\eü¿@9>¬ sŽkudf<±ñcU­ž¨˜Ã©Û:¹:N“P.¤¤¶;w!Ýæ>|…:œµµuGf:·q'¬A~Ž) h–—$94Çü¢âàâéóÍŽÛ¸ë/”š#‘LC'ÉùæÈoÆy¥íÐö•UM}}½%-&¬a[¥‚Ï9A}4ý[†=¿÷Ò1Ë8'Š…ÎbšxÄ5¦ÉÄ7å•ùììÌ% GaV&ŠýµOÅsþÅsgHÊÙ? ¥–.p?g›ÂbfÙÚöš€³e‡çX:~J\;sò‹ÍÑÝ‹†‚^¾c”-úŸGŽLå—£ BÖÑ ×æÕ+~îlËÓDyF¾©‚ÖÄâ5áí˜Sd]`ɇKWNšØ5hÝ„2E¥±I˜[X¾¹¹qɶ´b¤„æ ~|TzáYRtF¡_h,1¾%¨bùhÛpêånœÌðÉsŒÉ,öPÅcnÉÝGØí^ÿ¢îþ|4ýsDÉ•™Ä®ÝºÛ  sllLÖÖÒ.k½©¯·g{{[“5¸-—³ø1Éèœ9õE}ÌÀæ«$UÚ@RjƒŸ ßÚºÿïÛ¦ s/y7tööôõÙr ƒ+WÚß"Ü6(°aÇç¡Í<{ŽEeUÎqmîÉ=GÙ¦óÌ|+œËN O-`”-´ÍE2´Ì—VdBD-AXu’…jcS³&G\’¢rbR»ÆºâÜú¥á_NÀ©n›©‰ÑÔÔTÚpp X‡ä³ª×(ø*•Êd2766ÔcÜ6{{»ç,9úúÒM-m=Rº½2ߘZùúúâãE"ÑÎÎÎAÛ,--ÒΆ±#…Y¹jÏ+³µ³§+ÇP(”ÞÞÞ º¬è1øbW ˆ‡¥-m«šÁ~CJúÑ¿œjÛ¯ž¸Êg 1ÒÔ´ŒKŽm¦'ÇÂÃÃ=<(†qw÷°QÆ6f.44ÆÛÛ]Œ(œ@AÅ¡¶AžcXXçäpÃœ܉É]^ƒVöN!,–§’´´4Uý€ºmæçQ‚V‰N§£µ=ÝfZ¸Ð˜•+È6.®nþþþ¸mZ[[Á6_¶h°±Yºóª.egNúÚÑ•³bñùký‚ ­Æ?Ô6H(X99«««(NÆëmBb²———‘gж ºTY,Ö©7¡¢ºÁ)¶Í-¹» ¤rff­üqlƒ‚Ÿõõõ•SÁMÈe”+êmš¥-¹¹¹hÁ6ÇL”´nG'†t触¦4§,$LV¿ß}­»vó îää$‰vww/3¶A¬ªrRzûúqÛð’òÐGtRÇ6(Ì8—Zâ±±ÑcÚ&++ë µÄ…x-qwo_aa!Øæø‰œÚebº_ütvv~ûö­†¸fqaSÖ¸{ Uƒ'sŸHggtí477_rl³uÚ»Eê÷¤Ð:_QÛìß“êîé-((ÛœÈ6¦fæxi×ÅÅEsl359á—ÒÀ½®ªAåGK¿xä¼ÞCuOl¶Ûœ;ãcôĺkØ(bj´³³~\šššÀ6`°ÍEÜøF¬./ù%T^ÏJåëáÛÆîL77Wt\ð ö"êŠÁ6`›kh›?^_~?kJðyI`…5ì\Oá0+–´móòòÂmƒÎç……° ØlsÍ^t|%µS·¥zÀƯ`’UµvÝTƒ6?¸|ñw+_+ww7üv!:¥U,Øl¶9K 36¼rõ6©.³å RòI›{Fž‘˜{b‡‰™ì… j‰Á6`›³«¦µ¹É<(+¼»¶uÂT×T®h¹ñ¥Š`":°göAöv6è|ŽŽŽ†Zb° ØæìتNÎ7TP&)Æ=?ð¥§ËKÑZš—§h6çü… s‹kaV,«·CøóƒGD¢ûøø8Ä6`°ÍÑlllLOO¼÷¤¢³]FK︠­3spuKÄ/[tÈÓЖ¨Ž3$lUˆ^ÕÎŒ@9og˜¯6žßºßB:oí(Ñ\Ù~«Âç^’¨¿‚ªìBŸÈw°³IOOÿÜÛ€mÀ68mmmÿó?ÿóòåË„„U«Ñê—LYeu`ÁÄ•¡,])ÄôNaó¯$kºPÏ)8 `RÏØ螎;µ`!XÜ¢kKÖq ¢¯†”M:2SÐGbò€#;Çœ"4teûΣ…¸±ô|ÞC[1‹÷ýwwcÛš.éѲõuuÜÝÝËÊÊ ¶Ñ|Ûœ{i×’vemóþýûóÝW2™ìßÿýßÿò—¿üõ¯ý×ýׇ644¨—âÊz¿ü‰ Ú:…m2Æ89¹wž;²0*§ëSèäC4ð«‹hœºsO/  É­»ùÔY>vÿ• ³f3PÔzïµ-§aÇ;F¬O-`f<µ “b$&ÓзXXßsëg³PÙåÕ#=ê¿1EGÇÏÏïÜß™Û\DlS__¯§§gtlŒ _}†çvþªðûdEþŒY:íŸ7\±ªðÕg~ÐÙ•ó¬ê­#:gÄûY;—ÚuÛ ñûï¿ÿðÃ?ž–›7oþôÓOèÿwAÍ¿üË¿üåÏܸq£¶¶vÿ›Šÿüñ Œm”¶ylΗa̬ìW®éNTÀffí­Wv„lGvÚý_^xIFu]8a»¢bŒ¢-Ž´J=ŠÈÙ“ô»¥¿}p†µ¯@'¨ï¿u×<¬ýò~Š¦ ÌlÐÑA§tqq1”¤4ß6ËËË}}}ýÇf@Éàa ñ&dÁ‰c›&EoG.t¿W¶ KzŒ–©°•'ÅT=(z/RVe=©„˜>ƒ×p¢‚^(û¯WLÜÙCC;Ãg´œƒm\]]Qà1666rZFGGÇÕ˜˜˜(,,ü·û7\2ÿûßÑ¡©¬¬œœœTšæ¦Æ ü‘‹mrs[…óÛ0Vf––[Á‡hÈh Ë“þøÂU1Ï(šôÍ}˜7 ëÊÝ·»Ò6© Ûxùû¾$¦0Š¦EŒÒ%a]Ï­»ü®K´M᤾‘9þŒŸ¿¿ÿîîî9 çÏ-…þaTæÝ;9 ÛôžÀ6{ʶûÐ¥ŒÇº§Èñ$¶ÉWµÝ—™™yºßD½MdëìÍÿ½¤œ1´zÚ‰[V>d\©èG |Àš]çŸÕä™6àÀÌôŒ)#e΢è%(·ÃÂ;Ü5®=¬ «_wb&šyÇù—m0DM·~¼o$âH1ŸØS²Ð=±çtáÁE×Û´´´üÇü ,»»»¯F^_µ¥…Ÿ¤þÜkR¾ùƒ7'.7,ArÒÄMÌ£°¢ˆ mxŸ GØ&´^îÂÉ M|ôí¼Ì\|ù)§È‘—œf¥IÆÝ’º² (žs¦óƒ£² (öd'*‡—”ŠÃ%NA‰ìº- · Úd# ³×ÎaN‚rªhD€¢qIÁ?z‡wc<±ø‡ /ðçç®”¬a{Š‡APWH~çc#Ϥ6#g:9w–µ`z'–ܹó,¸rò§›Ï©ÅóYõ:®´ÌΧ/õIùk|©ÆÙf}}ý‹ÏÛÄÇÇ{¤öž´íc]ª9ý̪°êiï¬(†VMRsÆÒ-Èr¿¢ÅˆvŒ]îÝÌkÅBkVè9ïÐ pªé¹£ÊòìšxÍÅ.ŸråR²GQtŠ>dµ3ÞžhUý ¦,Yy>¢·á²“ÝèG§™[lmi¡ >ëëëÏ×6N‘"6nØUk!5›ìZEbU¯3O•XÕkhiÁ•+¼ä¼ÃmSTÌ®\Rv/¸‡¦Ç³ ©ÝdV*Ǫu&Et`ÄÔÞÏÙ†H¦EtahÏãÛµŸcÍÆ)s¬^m؉ìÄœ"j4Ö6û'Xã5­ÀÎÔµvÔ§d‡‰K¾BGa¹$ÿ§×,/¾@‡V‰6Ä™NyÃìñ‰É6 .C «ß mÀèñ’çFN†Ä_îÞñ¯\¼}K—ÝqJ‡µŒ zÎÁ¿ývÏ2~FØ¢Y¶QÅü_ þýB„¤Ì·§} 樷TÍÅì/YùøÍ~›ÊoøjÓ21þ|Ž²T‹×˜)¤ØI›€Âikv®Wôñ£84WT7vëá+²~|<ÝÜÜJKKÏñ­®­é:øÚ†Úr lC ¬C$V,1JŠgH&~i!ɇÚ&/¿ÐŠ‘¡šÒŠ…ç(A¹Ÿ:;»°ÂÎayEå‡ÚÆÙdÇ-ù8q>¾Ö!ygÙ@{nñK‡ þÁ·Ûpkæ½Òñs5´våµ¥+3]òý*Šm8™¢[È6<¾_úÁu¢“‘m¨qâ7hÆ°ú-lë׿£V`‘]Ø“_núU Ûè°;1+'w«˜÷HP–övVJÛœôjÕ÷¤Ð¹áéÇö/œT5ÖwÅž+Æ ô ëQâB¶¿¸øA¥¡¾þn&n›ó½ŽöüÄÔtoß@/ºrÞÐ|ý­¬mí }ýƒCÃïÕÓ[e:fzûN¾£ø} úÄ6è@£E£ìPB“9œ-­m¶;JRØ?cDx8‰¤è!++K¤FŽH”­$Gt,“)§÷ññQ·ÍÁ—F£‘<<ЉX,:ø¢"9nf•m>Éqvv–B¡  BBBrssEg#'''44Tû\À#pNÕ‚¯h€–Ýï+áÔï(Þö-ñÍ}\6ã—?Ë®œ *_C#Cʦ‚*6ÐUÆ,™¢‰ýó'¹MXHù ={ °d‰U2X2T8JÏ}Ï©YóÍòËc•ÏÑEoC›¾UÛàg'”KJîôLí~îòÔ>X˧íá“ý–/½:%£_Ï+&\vT?æ(麰‚çGð†£WWW/î(|®?)”»¶¶¶±±ñI{bÂß'Um±ÍÇ—ÜÏÜÌê±:333øðóÊQÕŸÔ'¶QÝ2ƒg‰53¶io—£kñ[ùxTƒ?§tebõ··¬Bò©9ï>[¿×ŒÙ…æëêèxªÎm>Ÿ¾wÀ?Çã¡ÂšûPÖÈ6FFFè²r?!ht:]Õ{Ý' kMó¹Îéð+ú½Ú%%%ÚmÄôô4’Ãk‹gwÒmDNssóÁ*ÊÑÑÑ®®®³/°ÍE°³³#HÎ ©^¿-N -ò/œ²ã–~²ixÌ®“z u´µ½½)ø/µ*¶©¯¯¿Ð¿&&&::::ÐÓÓ™™‰®Î“ó¹‡è|;4G|.±Xœ’’‚r?iŽccc‡î¨­­­ÞÞÞ#ÖeWTTtÒìÚÛÛ?‰9ÓÓÓoܸñ·¿ýÍÁÁá,.‚m.t°<øâkÕÃÂZ²z•8Þd_pÅòm ;{{/¯ý^fU¶a0ZŒ:ÚcUUUg©2:tá_4g[[[yyùElÎç@Ù œ.;TL«««344Tx^__ÿÝ»wïÏ€)Ex%mƒ?KŒÂ¿÷—‚z¯%K+«¨pq}ºÅDç-9´^ÎSÞ‚­ßf”Îé{†ß½wiÆóÏàÚ‘ÉdØwÔ{•••(¹äL[[[Om›ÓQVVÖßß:ÛÄÄÄü÷ÿ÷'/éü×ý×ë³ñÜ.à‚ž}ýº¶ñòòBeó×—E__Ÿê`-.¯3Ä×È6RŒQãšÐê×jBO2pòÓ5¶°³±Æï˜|R€"‰(´øŠªÛ'ŽB%¦µµµ‘‘tÔþó?ÿ·……ÅæææÖiAóZøD^Õ’ÚÕÛÛÛ[—‚zyviyÕ<(çZÅ6Vì‡O^ZÛÚ»º)ªR==IŸxFetÅáû l£±±ÍÁâ[MM–––Ôk`½'?÷úÔÛ óÇØ/ƒL&j|¤‡‡N¯®®Æ4°ÍéœsÆ{ˆ`› º'ž’Ϫ^»&M£’¸¶3ëÐHFu‹6==Yþ¼ÞÛ\Žm¾úÓ}`›/ÒÑ.óˆU{öÜ2([ÑsÜÉ SEÓ~ùçØ~:,Y#£7¿0ñä: +ÜdTñh`éBpŲѬWzŸKt½mpæ+3=]²²ÅÏOTƒþK¥R lÀ6`›+oüÜÙÙ™žž®©©‰ŽŽöññ113`àÄ®ßæŸðɜІí¦”ÈÎó± ZHHͺŽò™$'‚£­½£ë {m›×ƶæö–vÎvNv¶6$¢z° "‘˜™™© ïm4×6>¡õÛœÚ 6J5”ÖÕþ_`"%¶˜šYh mjGÅøØè£Wú¤äö°ÆãܨÂÛs@Q %sÀÈ7•wÖðf¿-t—Èj##£ƒñúÈo%àãU½{kHÍüLOM./-^òŠ-ÌÏMNŒ_fŽ(»Õ••sÙcçuhR³%‚Ø4a\:7*ÉÄÖ奾ùE¤W†–´ä?å¢oJ 8i²m=ÊSS“úº:ÚV$k¦È[ôN(Stá!hÝï@áOU4RÅøˆŒ&™0"r~}¦í‘Ô~–Þdw±Û1׸–'/´È^^¤?7¯‡J|Ÿ´Ksðí'WWW6›ÝÖÖ†iÆ[ f(߆ègO ø\rð tð 8b‚‹HÊL/9Ç#'´ròZ»ÈV†Ž@¾µ%<=?µ¾!ð«Cóm£îœññq´âŽCSëû¯L~·°`åùÍr›=SDtb]¿ ,]tŠlxáÈzýÆÒ‰@@—ûo_¸ÄJ‘1NWÕ,hÁ‘õ¯õM×ûŠyØlöû÷ïÑ,µµµ(ÒÑÖºyçþSsO+F%­Ó_òÞ_2BNé°H}jFº}ÿ¡¡š /‹¬õ …kkkßôAÛÓ6aEú:ZnèWÇUñ»£*× •s677GGGÛÛÛ‘IÊÊÊ òòòÐÿââ⪪*TÞÀ’ðYÐeiË“Dt·¶´xc ¯¯«­ýê…Ñ+ O"*ôŒªóÊ””¼+„oú×ÇĉŽJ”üHG%å:òJŒ õðóÁÇÇgvv.½k+œO.yôq÷#Ÿ|«>ŒÎ&“I$¸awp$:åêêêíö›ÃÆ•â&(pãI\¹Fª=þ«'sßD3z‚&¬É«ä—ôØÔÃÊbÿM7 µÍÞÎ܇³JffçäÛçõ¶¯â __YÜØÚÕœ=(Brrˆz±ëð¯üüüâââæçç¯ÌNX__Ÿžšš™žž˜ŒŒpt°w°ÿÚIÖá@rttD‘°êæ¦&ÚfkÔLψÃãóx</frnéSeïã¡? iû<éHã\XYYéîîÎÍÍår¹xAÉM >À`0’““›››§§§¯RÝúV P ¿ÇýpšæÚfcÈHßviGñÊBÑïVdEF'Œ.lbÛó)âºÞ–²Ø¨¤Ñe9&_+I–wö¶WŠª0l·\œ•0±¨¨j託H»‡ KªÑùQ%NW´p=ž&UMƒ(α†Š]è0¡ënyyyjjjll …1r¹ToBÿJÞ&ÀmCŽ···fÚF_ËìíÔtêNÍ(V/Ùß‚š$k*ýäéØxßÍ;"’óÒyÞLQÇúì{çwSZf&ûšó2Y´¶º¼·¯`X Ó䕉w÷ÈL6ÓÆœ.­)zñÛ÷éµP1~?÷G¼z¶IKK£Ç€J¥jâ=©¡ßn=æp9ˆðøuù¼öÍßÉߤ‡¸æeß¾÷f葆g„ЉaY2—f˜ÖY+WuŒuV=)ÂÈí_nô¬`i!f¬,EwÌnK•2¶ãÃäjˆm€srï5‘‘M[¥‰‰ Mlq•¤ ìVðp]ñYnpûÇAe'ØÉÁ®âÑí‡6xoñð•8?©m Çð‰UV²`prÂøÎ?›§3Ù>ø®{Ke™ò%ƒè£Õ¯·ó°¬ï'×@l\`P|Kl êjY¬|<œèŸˆë,L­¯)#ØXÎLõw× ÿRjû»®Ý¬‹#뾶óXÇ0Gqµå’4½ç¿ä6Ç3 CsДy|¢=¢¹®LëþwIUS°PÆ,ë½=;غٕ¯wµ·I›¥£3¨8´Ùھ߀ÏÆü„¬£gçÞwõ*^\šmnnî™þ0>Ð?<>9Ò7þAñúðž|­½¥©µ£wx¨sjaö1çÎÿRé&— endstream endobj 1789 0 obj << /Length 1425 /Filter /FlateDecode >> stream xÚµXKoÛ8¾ûWè(1Ç(Q»§Ý6)\,Ú4u°‡¶X(6«µ%W¤ý÷;ä¶;'| 9ÎÃù>ŽHƒ›€ïO§ç"R’Æ<&ó áA)¥"˜Ì‚/áç¶Ê§Y“ G D¤*¸µZ« Š´ËàóàÓ€º…þp%ˆD;""\cRI’Hcët¼b, Þ–07•ö7%ã„(¦pSã9,S°îæ ó¥U[yqƒÂ²@¡Ó¹Ê0kôËðv›Ï~»¿‹YßÈJgEƒÝ¦Ä¿ÖUÙè©.4J§åjÝ6ºró®õ"÷¶šEæ´÷»¥áï²uþ+™Î–›ÅßæÍb뎢7bŒ¤2Æ@|¥”Wµq’$a=ÕEVååFóôYèÚé56J¸|¨qTαmë‘N´a4Í ìdËÚY¸vf!Â×y¡g·/fó I…#ƒÉ©ÒsmóU»tâ¼ðNüRýz?s7“G>¤NÓµµ¶00’*›}“¬Ó¾RoymOe@-MT7v.ßõY(V$f",&Š¦2Qd•È õl(¬B”؃lføŠÐ”;,0?Xv`m»’ŽÈ(€QÇ‘G‰ i¢¼áJó½–=yÞm-AÆ> stream xÚígPkš¨§vìÏ­;U»·¶¶jgwkïÖLÍììܺ÷Ι™mŸcÀÇ6Ø`rÎ9IH$ €ˆAähr“s2I$“Á˜œ£ ¡û‰™ØÆ`ƒÁïS]r«ÕÝÂÝý=z¿,•\1{{{—ÿEoúÒ½ìí]ÚÀ%@<ØÝVQ^VQ]?½ºóñ´83ö¢o`uSüÆ¿çàßíŽÆꊪº—³«§*€kÉæt°7Փɉ‰‹ç‡ø™›w¼:SÐq†HéØÛÉÁÖŠªš™•7Ÿ~o{s.bCò  ö#º¸>kùÆ/àZÑUkEôj1¼¼¼¼¸0[Ï‹*hÆ>šlÏÉÎm ì*Þîo¯ËÌÊéš”¥þŦö¾…™—Õe…yE•kÛ‡J-W>ËËÉ+ì“Élm©¿§¥ûE_Ss{W— ©ùùüšmêzž›•YÑÔ->"¦½=ÉLg±¡•ûØÜÒâÔPJ¨—•kÜ#¸ŒT%>Ö1É«ë>x/ÙY]¢¤ßUghKJJô¦8Ñà ¤»k‘'²WfF2Ñ —\Ô$ÝvÆãpVYUM“`ë/ÚïmMØjª²ø‰) D›œ–‰•éOG-{"»¨®£,?96¾¸•É"º{§eçrH¶ø€ôÍíÃ"š½áêôÜŠì/Ù]/Kö7&‡Ã=€‚d«,#Ê\WUñGe{"-³XØHv7¨z?ÄÕMìno¾df Új¨8»ú—"ôiKQ<:>Poªg”\Ö"K…Cùßupgt OaÅF–÷îdõÌ‹÷Ž”óìI^Ôgé鶌¼­€kÅÂäØÜê¦d?IKö¤Âœ?Ý6žßš5¼õUÍüëÝZ+2í-ìzפâm‘h{{G,•nt˜8×tØæÛ{V³"q[*ç¡ cK,ÞZ[)‰ð6òN\`¸Y¶Îc¶aøñž¥¥Ûºù´ NìŸxÕøî÷} ’CŸìIÄ}u©Ú&­/—”èpíÉå’ìi½¯–°”]F¾kìµ½·hÿØ=ºmêªN72Æ·õwÓœ,Ój†Ð–î†âì¢ÚÍY‘)þ˜mêã|T‰<´amºÏVûGczÒÚÜàQÛx±z:q–ÖOK[D;2TmÆW6«¤öÖ§; TÕ[§·‚pàzç¤öËmÖ³"ýU()*)Ýþþ®%ž>0³‰>Z›ìr4zrWé¾–‘MeÊõH:«³MuÔîß mìPÖ6*Ýî76#Ôvîgvko?°™îì. Ùé1(9#a~ûr|<*)K‡DËyÙ-HÃZ¥¡ÏOÞ*;<¢KêU4£á™˜111€kÇâÂBCsK|f±³_ß-R—ž†‹m£æ¼¤θgÙ†Õè{¥šyF“ÙYϪ[Ûós³òcgffPHcÆÉG®kÃ,ñZÇô)Ú….VÏA‘µµu®~1–Ü ä¨ðýcJæÔEvx‡”×êäÔÓÓ Â€ëÕHÄ»5µõÜølZ”Sl{H›,~@ù—ðvYò—%í¶ý ¢S¶7KQ.É‚Ã˪­oØÙ …B7Ê&´:º÷L®Ç9èÌæ¾¹J:v(Ô‰ê>ë±òÃÑŸÇ(ž³¥wtt€màjË^ÞQ2³ÿvyi1&)Í–™@Hì:5t2™cÙJj¿%=&&5/:.Ñ„™‰©æ,®Ÿ'¨^¤† ò.œFY§³{ÌW>ESFØ«ñ1\>[›ë㣃ý/^ôv÷¿è™ž|µ'Þ9Õ<(7ÄâÆXøf‡ìG/ï] Ð%vC¯4-[¾àmŽ:uá5‹­‹Ì}³#»Þ[5G…ƒ·§^ú?Iß\kÀ#yÂÚ\_­ª(KJIKÌ ŠËåIJã‹Ù eÌØgþ ϸ ¹‰™©©ií-ÍRÉA“áÆÍsŠ¬GÊûºBn SV&9¹ ™ç}GÇ:†×pwÎᙟµJýj6üÓâcE">^¦©«£-<*Î'4Å+±†[çÕDzÚK/˜b–.²+V™eKôüIB‚ÙàWçýŒ–¿0;ÍôãbŸóïÒ7FÓ®¶k$ÿÜù Vihë9›£§BQ1¶EËÈ*+3cffæ,™JÞË3ý½ÝÈÔ°\÷ä6·ôà&IxÇ~Ñî~KËèUVÌÛ.«ÄA‹oåùi-±™ÆKýBQÿz#¢óü¶AG±ŠgÏa ùþT¼†Ë§hZÍÂUGC5’>7;{ɘ ®É¾‰{aüR`ª{J'»l ÓËÛïRZeæA¯^“”ä. b¨‰OZT÷y¾<>¹¸1.¾ ¿ÁÊ/WAÓFYÏÆÑÑajâå%?ó»;ÛqÉé® =à3_(Þ³³³To†j^Ž =|ÝšÙe‹2ɼgz—[BL8†U>²ó n]¹1.˜™rŽn4òNe•Ì£jmÝý‹ŠŠ¤{’K r¦&Æ}£²(O;Ù%s¬â™Ïw)™µääVWWCj½ªyÞXçHçydðš%È3çÎŒÈÜ°MÏ“í:ÛýG˜Å³^ùãH;èÿâW¹B+ññ ÜX_»á¼z9ê_ˆþÌÿŸí‚þûNüš²²2H°×]5õ5•Î¬“ çN§‡+ÒÐO Ct¡ÿK³DîL$nã®gÖ Ù{yyù„ƒÙ†ñl:¬Uz­/ãE—V©Sx5Ø溫¦§³ÝÅ/ÎëP5¼´$ä:ÛæX±³ü-2³Î](~ì2°ÍQÛ”——C¡ñõUÍÆúªG@9¹ë¥Á°klìšú‚éÏÝÙÙ¹„œØ³M|\ÜÈÈÈÐ>£££kkk¯üèx\X¹¬: TóžÂáwHµ)Ñõ Í53¶‘ÛÆ1¼Z[[ËÕÕ•B¡Éd´’‘‘IøºÐÑÖâžÃ®XùDª›¯ÝÂHo?ÔioïH$)°ÛµŽŽ¶»»»››R ZÉÌÌ„T|]ˆKɶ㖞£É.,ò.]æœC㬬,,K¶Û'äÄúÏîñÓ*½­ø÷±±±C8`°Í (®¨('rsÂ!°¹`xÓ!UԶÞÿôôtìÚ~@á€mÀ67€ü’ë€BÈF]pA™©‡V>”ýBK*•ÚØØ9)° pŒì’:Ë RlX.b›Çö<%__ßÕÕÕÞ€mÀ67€Œ¢jË 2°Í‡°¯ ‘ˆ%V\\ ¶ÛG“@~E“5·À–‹TK)SÐã%Dppðlò¶Û\kÏ숄cÃ~Aa&Œ lðƹmƒ.àw´°ç{e±XÃÃÃ`°Íu7Æ›æœ=£gF‡‡Ò2²Ã’óý“ÊL)¾Y`› ö§ç½| üÈí” ¼¼¼šššÀ6`›ÀÊÊʱ‡ù,ÚY[]‰ŽOòŽÈÁ‡•âbZüj„9£VþùÌ⬇,ç°Mt¯ô+s<žpÔ6žžž';‚mÀ6×@ð¯ÿú¯ÚÚÚÁÁÁ===o׶¥»SàΉ E×Ñ ¦d“ÒvÈFNà5Kœ£]Sº±NR°¼÷@[)!öù]}U5u&ÏIyxx”””€m®Ö6Ð7üƒÐÙÙù³}~þóŸÿîw¿SSS ŸjÐÊc%¹IÀ¿zýÎc#’ËA%¸úEÛ\¹mŠŠŠp8œp^ìííŸ@TWU9òJ.O5² šl¶—›."RRB;¯Y|í  ±YòÀ˜DpÆQ©Ô;è ØÊm®††$™ú§rpp@’YXXØÜÜR±¼Ì#kPIQN§Ë&e€¶ÄP'u#˜ŸŸ/((X__‰DG#™c­q„›º.Açž?KuŠÕï߶MžÇÜ‚Íö‚MÞ.õLh°¤„ñdÓõ ¶y0Š ZÖ±"ùëþÊž|pΰv,pÚ ë¦—šyçq*…—:Ø‘ëyìÚ¢ìÕw?jШîl6«+ü Âù`¶Á$ßzpg Û{ÇLa-¯' 9óèÓåv€m®¨ß[$#§¹©^yÉ¿ûÈ6jŠ_Ù$Í£'Ó-"š;ç”lé“BË_ ®š0¶²½{ßÛÔ* ®œ$§YxÆÓr&yè‘®³ã6x§TYúUq+¬ê8VžQŽ¼ª æý™êVÝ"ó-<¢I‰=Á(ÕTÏX:“ŸX™rJƒê·?…_nãÎ{† —Ë]ZZú ÂùP¶Aw$¼uۉι{ïþmÅ_ßRxdÀ®{GôȯjSÒtqM =C£,^í¢WšÀ»hù£´àÛ\][âwŽ…›•EMí¹*Û ucó?™OtL\‹vÑþiZö ÂM×À@-B4»|#ôÓTYÖZ2²FC]J=¨™ºxxó¡l.RØœÍ|ÙåË܆m¤—0´±MX5§­ó£MÌbd—Å–Zæv”䦮ÅG ÜÜ¢Ò5ˆ”´1t89€¯ôPõû{Ô§úTîðV,î(=Rx¨¡bÉò.˜ÂQé_~õ•¢!š?MÉQQ×¾û@õö=m»Ènn“‹¯À67’ö¶Vû Â«µIàúéD¶1°4pˆ íÛ¦_jïÎüöë; õï©êÝUº×" ¯øE[Vµ=2ÛüàÀí@¿¿[^1 wµèž©åßþñ‹ ýî«|¯K¤æ/¸iá£0Û|ípš%¤Ø&MMud¬™_nnî'Tnƒì];®®£©¨igäAˆzî‹´Ó$ ªž×5xd»„lã“Z£ksK6Ç9¨Ø‡û·H£jŠ.nYS!Ïj¿U0ö.EöHíIx}V·¢OÇó{. ,7srÖö©ðÏo3p¢‘ÓæbB{FœKb¯]êÄýÁ؇S¹±ÍMÎvIÄÚNìË/%þ‰m‚úØf-³Í ÔÑ¡ëéß*êÙ/õm“FTÖ­hˮޔۆ‡Ù&:þ-ozZµšŽw£4ºWŠõ³àwJI?™m*6±Ø&ä|[®Te:ì¹Ï ôt©TY£b2™Ìçó? Ûì?m²ê{Ï„*K÷u[JÖüîàÚÅÛtb¶qvK4Ã{y…u”Û¸çÌz…*ZÕ‹°‹Ñ!åÖ­¹†ç˜ƒð>uÌ4=Š8¹-úö®ÄäWèSVN§­O´1…k`aõõWßÊ5°Í .á‘Õ€\ë„—YGŒl£z÷ÏÖ‰s²r eãÀ}Û”Žë[è:D¹òâ”u)¬©gLž¦•›SD+§lÚžŒ‹í-­ùê®ëÀ6ùºcwÛDÇÝQ÷ñ«7´v0eWø•ÏƒRì‹ý›¤îÜ0Uk¶[ú…¦ç5íÌ4ÝrÑ„¹;šÎþv6Xr@™)6›ÝÝÝýéÄ6~%þµ;áÒˆ.iT¯”ä÷ÇìÖômâ–#»e¶Ñ1wrG¶!2Œ}JÂÚ&8TÁÂ?°~GÖî~Ó¯j̓úÕ=sjö+ß¼~ EZè—×¢ïàJJ› -íz¬kià‘Î*_¥‡ßÖñðÅb›‹\a°Í§Mk[«#å°uße'\ 626vÎXFëv®ÎvQ/Q(X9cíêNL÷ÍmS×ÖÓ¡$ùÕïQùj†6÷5ŒÔí¹>eüšNe#§v Ù†W\÷£á¡Ï·O Ôì¢ÑcÏJoÐ6µ½¯a¢jáEI Hƒžõh›Ù>´ærª6ÎÛ:Hê™3BÏe—Î_|ªPd%];õõ@7(KUYYyÁ¢›e8¹¹ëº§{å½â”ͳŸM}Ù·Ô½7 MÕü:Cš6IA±*ZÖî郦o#ïg˜mÔ ®YSÁ¹•wY»f û•Ïᙡ–¡-xUÉ.‚×´í“Ö¤edò˜˜ÆÌlԱƣ,33ñÙ# wBbopíš³§ç×*N^Es!ÛÜôðÆÅNM￤Vpû-:"z¤ü}¿aÍ*R»d’(E£\Dç¾—:¤èÇå¤"»d™)ô(¢uy×Ù:ÖØ£]¶›¬õNûáþݲSa§•mé>SkÓÝØ&uO¡Aàx$¸>íFº8wÓt§bé{…{4Un‰TPPð‰ä¤ÐÅ÷ËmÖ0qÒÅXxF›RTœœSÆC›D.~!j6¾øÐ"Sº†£¯GÖ¨ =Ì* 6 ÝÁêU 65g2¢kϖ䡉 ´¢‡«ÚS²æÙ©%õq6¾éÖ^¡FD¶ª¿kb“‰®EŠ÷Îh3§°õI¡6>Ѷ þ}M{Ûðæ‹V‚m>yÛl¬¯9º±ÝÒ^„ï·‹ƒÞRÇÇùl“ E8ªNv¼2¿Ê•stôÀö7c¤`=Áåݸ¸¸äåå}*ímöÖ´î‘ÔäYIŽmáÔŠ#°qb›·=kIq­Ì’yvá°õ:3„ùl!ý@4®z¤ÔÈòãhgúÓç.‘5¬ ¿]–üÙÙ—ÈZFéZhÓ&-©…Y²à_Ötù¢Ñ5Øæšgme…“ˆóM°ô/ð-_Œê’=XÛõ‹—WÜ áÈ~»;¥ö!åñþUkgeC ¤ºäp}]lˆ¹mÐëÅñƒ~R`›kÇ–pSÇÄFÏ#Ñ* ÀÊ?߉_KËd>›aMÖnB„#Ÿ®Å!´RwÆñ 1Õ࢛~TV•߇A¡P˜LfGGØló¹ÁåÇâ£ø©{Ú [n©CX•Mp‰MP1’Oá$ M|4À³ðͱ,B¹Î·‡7˜j¨™C÷ž‰y<ƒ­Éäééi° Øæ³ÊLµ´¶™z%`ÕɲÞYÃWvé¼wþ+¯¼—Û[8˪ŽþÕkoIàH5HG´¬‘‡z¶6ÖÖGóPrÛ¤¦¦^üömÀ6×H5'Š·_Ía›ÛÃÖů‡ƒ€ÁBÞðšÅ䤄SÃlKÌ )!¾í‘•¥å1Õ`Ù(ƒe£>‘~RŸ•m`(­«b~aAÍž óF½WÅ «dV p,ƒ‰‰š¿_}£ï¯ib‹p;JÈ6ñññGˆÛ\‚mŽ]ꆆ›ÁÁAÏ¥‘WPäÕ%3ïY£½iÃ-!Ä>çi‰Ö£{¥Ä„Ž{z†fVx<þhõÓQÕøúúbÓe~:ãÛÜ`ۻȭ­­á¿þë¿þáþág?ûÙóçÏÁ6—F@]±yßÅ3{X?3Þ.kð,kùÕ¨¤Ó2²°wp É'U#ŸOª¢¢âC…ô`›3Æ6]]]...¿ýíoþóŸÿÍßü|àîÞÞ^ÀGm`sŽPà§1ºÝušÃ¥Uê]0aìŠ2M¸è&[æ÷ôu MpÎ$ =ìoR zÍÈÈ8:íØæãÙ²,??ÿ7¿ùÍ_ýÕ_ýõ_ÿõɹHþöoÿö¼™_üâÿ÷ÿ?ÏÀ?þã?þó?ÿó/ùËù—ùå[ù÷ÿ÷ÿøÿøÕ»øõ¯ýŸÿùŸ¿ÿýïÿ÷»øÃþðÅ_üé |ýõ×·nݺý.îܹ£¤¤ôà (++khhh½USS+((ØÝÝ=ù¸ò£â|žÍ†¶‚FÞ¯GƒëÓÎÿõ«ß*>xd`lŽÃHd²,žq}£g°-)))Ø8®0 úeæ¤FGGÙlöï~÷»“¶‰ŽŽnjjj~3èÓªªª²3PRR’›››ý.rrrÒÒÒ’Ï@RRRLLL䈈ˆàñxÜwö äœ &“és¼½½====Ž€®<ºnX±ä1ªªjlyeáPnóžÝé)…;ßɇÆ:Àœ,F·àhL°Í•”Û  ä€B ê`¶r›ËÌI …[,hXi',g>¢IìZ¦®ö˜F£¹½¹…Ð+ò¿|ž…ûlƒmÎXnsìÊwuu¡(à!º{ÔnA»š³×IùU®êm¬Ìå}ºFúé(++K(~¤f`›÷mosL;èùÛ\¦pFFÇÔü !ßÙlFÑÔ= SêñÂG%Ã`0P&}~~þ£¶(Ûœ»-1HæJ‹wcâ“ë°á.y°âkØ W×ÄÖ{Šw=<<äy%2 ‹ÅòóóKKKkkk‰D—pïÀ6ÐsáÚ•äìîî0üyÄèúÀº­×³‚sNë•É©XV1Æñ¸£Q ‰DJOOŸ››»äP° Øæ: G¼»ÊrðKgM"çÎÍz$¡éBu}ó\í{uà>{¤¢,l°g›H$ÖÕÕZ2¶Û§þ76Ô;P|l|ÓÝRº½ò_Ôl"ç`ìaCºÕm±Jf¯©jПí[¾x¾A•±Šor’àîUõxá0ŠmZ[[/ÿÆmÀ6×Z8+K‹$ü÷÷”5­]-½bC‹]¢kI±¸ˆZJR'º§v¼2^³øšf…´)g ëØÈ´äÄŽ{êF8'‡cݺÉd²ŸŸßÈÈÈå—=‚mÀ6×ÞÞ^&Ãs46Ô¬|_EEYU]ë/ßܺ«O@÷Ô¿zíšÆ6ÜÆíûæžgo\„^aCï:„”+ë˜ÛÛZc-úŽÆ6(•’’²¾¾± Øxßg{{»ªªŠN§cU-4š§‡‡³£½š±£h*üÚÖ•ãZœ"ê°IdÞ9ò6¶Xd·”ž7nê÷PM ïìtR5 ]¢æææ+¹_È6‰EìÒy¾@ö×~¶ úÁEÖƒm®©p¶¶¶jkkY,úáF ÓŽ™‰Ñcú%ý =ä9”K6òŒ‚>^‡DzÚÒfd×ëä%ÀX12ÚŽŒÑ%uK0g¦é;x¨«k¸RÈ'ÇŦNˆ_YY¹’&ã/GÝüc­CªÈ©ý¤”hA+Ô¬áK^hÙ£Ô¬‘ËÿÞ£€¾G’––ØæÚV‹ïöõõ¡<‚‡‡r‰DBÂ162|d‚§e cp]PAõ"BLs„à2„éX¹­ø@Oß@ß–¬‡ç˜0Òˆ í¬²%dÙ´w=²×p”SµNˆo3÷Í1v Õ³uÕ50¶·µ¡Ñ¨§öBׄÍf£«tUwJ$ÚÊ{V›–ò -á©Å,~ª ÎÓÐz™‹‘£Ç%ãÉEÃØÞÑÑéhÇ4°Íµ+4^]]ííí-(( Ń2Ð×{¨maÌÌFÉó³¹]ü«×5ˆ¡œŠå:w6J°š#ÇÆƆF¥âqF†úÆ–v&öd]W-ª–§¶ƒ·®C×®kënhëbjídbbâäè@uw;Ö=áhá°——W}}ý‡íÖý¾÷H(.²²²ÜÑÞN&¹àœœp¸Ë[œq—úu§ÿ ÎÎòàls}…ƒe¬fff†††:::jkj’âþ¡l™ìòeÙì·çuÅþ¿]·èèÞe¬˜c÷TžÈŸF*UV‡íBÀÛÙX››š˜™›™šš›™Z˜›ÙZ[ Îîn®h÷7tëƆ1÷ôô¬ªªÚÙÙ‘^]3ø“ß;66†èöYr´Øæº;¥/$ŸÅÅ…ä”ô{&žIÜf‰<Î9û´nØ°T¼f‰&™¯G‹íûðÂÁ†æ=ßû^ÍÄÉÉIþ@ÊK÷ÓxËØòÖ5L&³µµõjUs*£££Xñ¾Ûg Øææ™9‡flnsOÝDÍ)^0ýBÙ)ÅfK½&~‡Ìš„`5mƒ'VN‘ Ñ=R8Ø©"»¥÷Œ\,,­O䊴ÏYÒ&Ö 팢š„„„ÉÉÉ2ŒùÇ° º°‚ýÏôßG· lsÃ̳¶¶agggë€{¬eøýc#5ç`\T£_õFD—,¥Gv,²ZžÎ÷ÝÒ€Z¡Uà3 s +’‹‹£££ª¡­sÌsL8w8¡o|hN31·:éô@²Ù슊Š˜˜—}FÞôô¢ÐH5±±±/^¼ÀF~’ýˆ‘m ÊLy_)بnWº`››ÇêêêÓ§Oñx¼ ‘H œ &÷”Ÿüð@]AÍHAÓJIßYÉ€ðÀ˜ôÀˆˆÞÞU5PPÑPQ×3³´%º¸`?Cs»ÐJYAÐÅÚó`õÝAõÛ÷ɦVò¯8¨ÄÇÇcÚÄÄDyyyxx8 ¿ÉûÈýƒÕÄ!#¡fffD"V&,ýT‡, !222888t¥ _á·£ÿ>ºX³à†e¬Ðo=JŒ(mb¾:p™}cKJŒX~ä•ò†FFwࣛd…?gëo.Ï|!GùU®<²öQVÕ”ÏètrR'*•*³=“obá€O'È©¬¬d0o*yK¬u°Y,uMí[Œø5ÁÛG§ >Õ3òYWÔìÙ·bóá¾e°0¬: €kíœÍÍͺº:.—K£Ñä©þ`»!¼zõJ$=}ú”B&««?ùNá¡¢¾³¯Œ]:Ü â6lË–Æl%°fƒœØŽ2_ß=ÔUTRrpp@qËQ±œ ¥|}} P€ãÄÔÔTUUUdd$ W|||ŽÍ;ƒ6ÒétôiPPPuu52vìÚÚZbb"U†;…좯§{çÖwwîÞ»uïÑeEu³»t¿½£ôí·ß8NTöŠÊm€ÏÈ9çÞçs³ ®ÀÁÒ½³«ŽŒw©x± l•ÛÆ‚¼¸¹‹RNR2爥’ÓlcÝq8A_¼—#›Ÿ>·×€SlccFI÷2#9~Ñ“½ÍîÞLd›ž’xM=CWª'‹Åbøx;:â‹ÚFö$â ÿ™LݶÉ'ZYm8‹m¬MÝv¤Ò•±V/w·(n°; öÅDwq¬ž•cüӴ‚¢â¶ÞÑ=Yñ²8acÏÍÝe§ê¬Î²5³îYÛp&Û`z¨ËK ?Q¶"7Laå6³«ÂŸdE%’îbþÊf#«2×HÖ'iŽ´Ðm)Ø€Ól³³]æþ#Ž‡ÖÛª² µpNÙšã¹™ÿAA½®º#7TÇÙçåìòOŽÜÛÛ^ŸKâz™›ëëë›zú†ö¾z½OÅÜ#8ilÀ3$ë‹3£S²š$áÆê«ñ)y%ÒòüôàÈË ÑŽpua|zn{W|òpÑÆòÈPoooÿàðüÒÚžTž¯’.ÎLÌ.,ïB;ÞÔsáÍM½©§ÃOw9Ö‘*¾¸É™©ã9¢Ÿd†Î™!zß“@¶ n0’ÝíîÚl =Õ/ÿò—ïný`îLoìßÿd‘îhžV*:Üs¼$RÁœ±ØûÃÛ·nÝúæ«/¿øó—·o}§¤ü$®¸©»6ãËßÿ÷mÅ»ßßþîö]œOÄËùM©tÚHY½H0²{x’ÞLÿ»–ìùŽô/ÿò:ÉW_þåÏ_~õÝ·ß<Ô1/h„Û76¶‘ìÖ¦(Þy˜×´?Á„XXï§cl^,˜”JW½œìÃÓË^Û¦4JÑÌK¸sP9Õ’ÌV%ó?×&X[Sæ±w ª•>+¦P,ž1}¤Y$=b›kÎÁÑz^˜—m`Ä6pãÙÞÚ`Ú¨x'7¾Né¢ùH¦+‰‹”á}šm6·÷§–ˆ˜Ia‡îÖ&ZY’¦ß„¹QY1‹Kcfßh›õålž§_*ܸñ¡ÍÖú”¥â×Eƒá X”>åáIÞÓÂ5¦óOlóê]¶17uZ—77D›óA®¶ìÈ<‘hÊl€Ì6÷¾}6¼+=Ò2¦<%ÄÙfs•qÂ6 æo´MSI²Š‚ +$"<,ÔÃÅÞÌɳmxN*1VÑ8´ÍØ>ßœ”hmõ™üüõ&ñRlÂŒ’HÅ‚]`|Áæá'ée_álÓø,IKÍ ³ª±º²¢±­gckF¼h­¦šÖÐ/oˆ\EU!„€màsC"Þm+ŒR×µ¨nššš¯ÌMÀ9áóúeYªxŽ“‹WUË‹™™é‰±>w+mfRÅ®X‚Ù¦!ÎGùÐÈ6uñ––¤ù£‘Ó~¨”ÌpÀÑÃ}#ÓSS#ÎFªÜ¼¶CÛ,eri–œ¸pÃóQX¿¦ÝÍÜH¦=! ˜äÇ"“)É…õX(²»6Èp§yñx!L‘àÉZß9è %‘täðm8Oå¶i«Î¥R9s'¾@´0È¢’é ßÏÛ ïÊŠ^“äªv7WKy1Ep/àÆëF^á¼81TWS]ßÔ:½´ñÓÏÄ£ý]µÕÕm=ÃÇzR­LvMÈ£¤•…é¾¾AщoØÿWôBÐZSSÛ50~t»dwgîÕHßËY¸ðyç'Ûö¤§·~9¾ÿñ6Â{§ì =MAÇg°‚[WÇÿµû; endstream endobj 1785 0 obj << /Type /XObject /Subtype /Image /Width 382 /Height 120 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 13809 /Filter /FlateDecode >> stream xÚíWT[YšïgÖL?ôÃ<Ìó¼ÌL¿Ýµºç®¹wÝžž;wªª+ØUeW9›œs–„$@Šä $Jäh°É9çœsÎQD!@âÜ-±±1Æ6×þ¯mÖñÑ>AG{ÿÎ÷íðm‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚út¤Ó‡þQò@AAÝP€\®Öƒ fmM–ššN¢2ñt Ë̃îDdRYÁ‰É)k2Ùáá¡þ<§IŽ[ËË+©i4V ‡¿™Õ hãé‡#û±üjëö÷÷ÁùO,(¨/É\ÛjµZ©“J¥¸ûÞ˜Y¿°Ð70äîEêÉ¡¤÷Çt"¢®ã$Ôý¥eŽ<Ás]<)í]=/ϦÑìííWTU;zÒ \rz?¿íøýá‘M*A•G _gtl\?>PP_s=666V×7GÆó‹+âS³$IÏR2sšÚºf–eë;;ÛºZÿú±«««á<± IÕr(éE„HL;"h;Ñ „ˆ¸D²Îô¢¬¬®‚ß:ºº±´0gNQt«æÇ¢AàÓ ²53^´$ \½4„ÔÍu¬v¶·¦fæ2rŠqÔP#"טïÛJÍ÷+X ¥ ¸D–“DV„àÐè¸ú–ιùyå)£ezfÆ‘ÀòÍ•ö¿ÂŠ³ ýHÜ„”ËÌ=è€9YyÅV”vÍ. Ê;Eñ%éCˆ Ä~_ÿ„Ô 5uTʃ‘Ñ1ab–)í•Ô£3-@Òz:Z lV€=,aÕr«€L*7»¨jbbBkí¬,ÛáYaÕ; Û9Üx-ÓrjåÿuÇÄ)ä àÉEù#íC¨/¦ˆ!±>PP×Ç€¹8v¶77r Ké|JƨG ™·z“CÚ‹:§È2Rx\]c ð›üòfI.ŽíÙZ5¤¤N zBÜà;L·ñ܆oÖ8%ÔGl¥A¥Q«ÖV—§§&&'Æ&ÇÇ–çUûoýˆ !"¯ hooš=PPWæXíîleee±ÅéA ¥ÔøZOq1¡“™;TºZ¹R±P´ä܃Ö’cküãË"¤Y©é™}Ý/ Ê<åÚþëKYVs~¿õðrܸî^#péÙ“¦6Î))É«ºÎ2(¨OŠ#:>.ŽÊId¦´R{ëwD݈6ui+5à‰>¡MÄÂ.„Ûp@}6LKjöO2p$‘Óúâ/ÕÌ‚&NÍNdÃÞ%Ž=Ûcþ! ˜=·žÚ›™Çð£¯| ¡¾onqê@òg=ýxK óŸ>„<N>½½}ý'ƒØ9‹Þ³%ôèó=&ôÊý½=ÔèÌ2™°bç}Râ#®ŽOLù\=Ý< Iz‘ÛFÎÞ>Çòöö šžžþm"æµð2‡ªùÎήb_ßó§Q«vårÅÞæó[†~\ºW|«¸bç½ÍžÀâ%'jda~žJ¥ºzø@ò äùÑØ…J¥Òtaaa³³³Ÿº²oa¼é óÏqòß7["gí•Wþ§T¬¯o*U‡'9µŸîm¯VäeˆE¢ø¤´öÁiÕÞV{M±ˆ-NHïŸWkŽÎœéêPÙÑÞFåsê÷ L.7ÚÇ“gdj‘—— 8pÅðä¹òG]ØÛY˜Ÿ_^YSÿ¾ŠÅ…ùåµM] Fä[²… õ»·7×v4šCõÎöÆöŽ\&[W‚š¨”­.-.¯©OLÃ]p†¥Ùá«%ç`ohgksq~~C®Ÿy´¾º4¿°°¹£Ýs¨V¢'ßXß­Ëaù…WwŒ×TÈÇ™xuôô>“Z™[õ-ï·—¦º:ºe•Ö¤F1œ¼ƒ‡æÖß„Ä+Ò‹ÂrϘJq4x.9½‚’1hƒ¥áqØÌÌÌ+†$Ï•Ù<{ë³é  ±Xü¢°J®FÖçG²RâDb±€SÔЫF’¤ Ü†ðÓªž‹YÕ;Š­¥tI°8>3»¨jqm«¥ª@"Œáó¢ž5ì*÷72“¤©œ4·¬Yu c]UqQzfnZ¢”'Œ[åJÓY•#Å‚ü±É}s›òõù4Iˆ8!3÷EŽhniËM)ÜÜÝÓßs˜ÓíèmˆJ±æ3J-lKŽ O­Ò}¸áíìž]Û£þLŽ–|{K˜Vä҇Ư€é½g‡u œº={r„«³™L.((@±Bò|aä.à}k€™XXîm­IŒK˜^ZKåèa½cÓ­E±†¸¡e9ßûaxFŸG­ rý)±F¶³:áíx×;(aze£«2ÓÇ›”UÖÒ]Ÿ‹#Ìl*ò¸ž.LñØôÜ@{»EõȦþrIVfFqÙµ++óÁX‹À¤Š­©ÖG ²«ÛÆGS#)–žQ‹+“^¿RÂ’§Ö*_HˆdF]×Äá±Í£-~=å "+'/?IM÷ ï‹ ¢¥Võ —ˆ&:ˆrëåŸi0ÂØÈph|aDÝ>:n¦Ë•|{*ßÖÚ’N§ûúúööö¢ïÀ’çÊÈ3×Qäìî)”&”Ö´¬n)ó,:-­ªW÷á>ÞÄ0§{.šlÈÍêGɆ½—R·È@¶}Ѥ5<2£ýƒ¢6u…bajZ©Ùq¹û51Tšž––œœänyŸ$.Õ_®½<‘ê84/Û}ùfL]bà}|úéÎR‡Ñ§uÓÁT‡¼Vítž¾êt¿È±ù­ã‚§»ÊH}†³“;_îO£…¸ÔgÕýèIÄd{þ‹šÏdôtw¶³Äy1Ðàù°HvTµ¥ƒÁfOTT”\.‡í<_^;ÏH{mR¼”Ë å ëëý™ÏÐZ¬ñµxšÑ6åó4òù –<‡êp̯(yB¨Ží2)%‚ÌOÞxù:Úµùá›à¤œ¼Üܼ¼¼¢Òò¶á—ýqíe‰þÁìáy­ë4XkΈ.Ža3%èíl¯Zýr¿dhŠÍp-éÔž¼§*ÄžÝ8u× Âã[©Ú¸v»²9$ΈãJŠÚuŸªƒ<“JZö>y:ü$BØ«õ!%¿OK+-y@±÷ññéî Œ&Ñ%!³HLç$묔A3C«æÉ51Ã$ ¹U×*4kóË_Ó6ŽÉÓ¦ qP•E¤Okϱ:´¶äðkhnzþÞÆò©5¥þr•)..CË`;/ c?›mLÿæ¾ê7¤Ü3ÄŽ/N‡ÒyÖÀž®ŠFPä̪âTßØžãíÿHïÑ^ïè`+ÜÇ!<¹¨8…G ÒâK½Ðæ䄯íÿ\ÆF†‚ã‹£[!@.Ÿx-‡vd®“ƒð¶@ÉfO\\œZ­†äù’È3ÓUâîìäIôÂ{biÁ¼©õ½Ñ¶r_O x¸8‡Hs¶Ž&›2Ì̬Y!\¾›õOÒŠ•í•1Á,»iE ‚µI1›éèäììhçIç-n, ÖÝ]°x"‡¡ VO…öì¬L%`É´@ ÁÃÄÜ¡²gæH-OŒ`¸y`É>^X,1·y|m~A´ÊoÕbmu¸cgfE›[}ÙXÔYçâäìIðÆyxÐyó;굩ÞpÁÞÞÞÎÎAQ¶©P]M³Àk—˜åGFØ궄°çI×·EͱÆм‰x}ÉÚÛÛƒí<_y4ª½¹é‰±±ñ‰‰‰å5mkF}°²0;®Ý5µµ«õZŽT{3SÓ33s ++K3rÕ!ȳ4·­@_CG;«ãcÃ#c«›r]ñ8\™Ÿ'Z\E[€Žôí<þ!õàš“3‹J]7ü¾|n`zvQ©AÔÊ}pò=µîöög§G§æö•jýh°S{Ïããã+ë:ãG£ÞX]›˜ÚQ!ï=œç£/¨}…\$ºû†’cŠ‚³‡Ü8ù¤¤Ø·uéñ¼pp‘j~vDâÑ…ïù¥´¡¡¡¼¼ü‚£(õe¤§Ùy‡çOFToEÖïàxD—»G•HàxžKa)[}êäkceÁd2ÑÂþ’H¤ÉÉIHž/x ó§Öìh{yUíÊ–êÞ‡Ãù‡ø‡ú§rrrª­­=Ÿè†@ò‘Öóš”zÈ€ºãŸ;EÍèç·B˜\"F½Wló7O]Í0$o´Ø£60‰!y®!yàLÒWDDÄßýÝßýÍßüÍßþíß‚ € ¶¶¶Wm·—ÏÙÁÃ;¸hþlØ 44x.1z™–1`ä-hCl˜ æV¶ô“’O¡Pô‹#Cò\7›gmmÍÜÜüÔ¥ôèÑ£?þñ€9sFÿò/ÿJ>º@§^>¾ €㣅ëé@ çŒ}ù³ân$ºåÐÈ•áäèH§ÓÑ* T*aßÖõ$B¡ …\¨K‰Ïçß¿ÿ4yþþïÿþ÷¿ÿý?ÿó?;::ÖÕÕ¡%}í–—•…‚VÍ`çšDnÿÔ)¤tå –í›Ö‹Îw“ô xi³­‘Dò®Vff&ìU‡ÞÖ—*‡€ó»ßýîÿñÿð‡?ØÙÙUVV¾ñ!»û†G5î_¡U ‰n:à5©ÐÀÅŸ*DáiQ»}…xš”¸˜*¿œ‰ÓÍò’>ä©3ÍÝÝgppÎÛ‚-Ì_ªD"p¸lmm Ρz}m5-¡Q»ÎïU•~ÃŽoLFÒ…®hŒú&ÇóÂ:~ýFx•üå¢Ã'4z:ô–þSÁ™=ÂN„S±Y¿§ÛsEMUèUÐEÇNƒTÚ‹8„ç:y€ÙÓØ؈Ú<Ÿš?‹<Çû»—Kª½#FÜúü/JN÷Óÿj<7^ §Mú·rNd·Zv•¾Otͪ›7Õ€š *cd<ª^Á©\ -YŽn9ŠiUQƒã’«vt™5e‹a¥ËQMjPŒ£w#ëåœ*§VY³vr«VC‹¸ ªãŽm‡lmþ•¨¦CPM­»¶NÞ®!Yœ¦Ã«´yÞ·Mkü %šGÔ©µ‹€) *»¸!G ¼ÓQCüW»³GgéÌ'ÉÉA:€8aÃ8€W§2ƒ$ê¬VÔ²`léf˜sltÒúSw<Ñ ” …’••u#È£%CÏÖ¯·n{$ÏÅ!qCHtå¨5ŽÝ¤ ËîÀÅtˆOš7)±u¬Üå ¬Jl­«<õù*#.—ž³®ýîv’CêÁ-¯U‰ÚUénqŽt±§¸×†øÇ?ÿþ«ŸìüSBêyUóØx'¿x`¬úm\býYHž!ß@N¸Ž,úW÷]qœç˜Ð${—û¶A¤øS‹U¸ ¿'gJËá5—¦£ë#›°훇îÚüa‰†–vØüž= G2&¦%¦ûêÚyΫ¿ýˆ!>‚àEÒÏÞZYY¹í<’µ½³Ó'Ž_á—;Ó£å°e×—ÃûÑ*Z:„ˆê'ÌÜè.¼.và/¦îö¬Dÿb…­ý«°>ð佃‚žºGà"2lðLKêóˆÊ97f”S@†· ÇÀCÊœ HÌøë×÷\"òÂê54~¬‘ï%,q¡qÍp‘œv!ÉóåuEFq«dŸ‰<ëvÄ@‡ÐJa"­ïþ§\Ž£`Ì¥À÷'ø’°ðõyFåá£òiφ)’, b«pçž4¬%«4ªQ ìvG·'6áÝ ÿm+º.>>2š1Ó¾aîàã!h\Ig€<Æ@}ÈÏÏÿ¤fÏÇñ¶@ÁèD8¥cØ`©51ÈØÉë‘Î]Ð&ìTÓ¢DwíE’A@ž)K\ › — {ìÆ«Q‚ßü.¶ƒ‚–Çw¾ÇgïÇö!ÜòYzÚ ¯YÁJm$ð }DEïýdËm¶Lþðyh³2ì¢A|d¡WL‘³oÈ}C{fµÖç‚äùòTUQFMhˆnVoËŽàZqš<’›)³BÚ‹Šc¿}B # ÃHxÑ(ýù+!Ë‚ª'«$ò„<¶ìž‘ôc†xIBBó‡éÏçb»×MmXq—¨ï’6¾íñ Î;ˆ<´'yâ §«Àõ·yÐŽ'ðÌcZÂKçžøÏî?6õNŸgð%wíÅ:òLëÈÓCŽ1÷M ¯9÷ž§i槯¾g4h©~,ðBŸ7[c¨YÔÔvSãG¶œAÃÈ÷ß™Õ)mj,™bäãW ‰}jfG/‡äùBÛ¢Õ®ä^“ò ɳâB =¦d'tˬ<¨6Å€ Òºöo²g•l²ø¿Þ~dJÏå7¬9`½XºØyºúf¯³bSŒ=XÌ9¨’ƒ 5%­ý–¡=üºE; ñ¡¥‡ÎÈ#Œúb9¶qó¦Ý¾ûÄC:Àk¹ìÝ6«¢š¤}a”‘¨ylÁã=õU€Éd.//_wo«‰*ê±ó{ÕzÒPÜ}dnrÛžÛÊ‘ܱÅŽ"Âê s†{L/ 5=¼Fù’<-›oÿ71ÿغ©£h`0===׿GܶafayÏ–áæ£óì<½¾¿o\§LÉýñŽ)cØ‹-øîgSa?)<ÐŒœ^­%ƒó}kvLÛ!NºeäMY¹Ì|ŸÑ$Ïš:bcjÝü¥Þzä.­¹õÕìÂà Ù“»_™QÄEF¶.¿¹‹‡ùÐæùb;ßéþ!ÌcÂÎOŸWgO¼Ü)8=D°upN ì8w Fòr8tÇ™Á‡§†«]bÜc«†]¹AÏ~èŠTÄ "—˜?«uµ’Ð ƒeŸv":~zïµ%ÖökØò:1EŽt6º*¼fO·s‡&És`Ä‘ã뉢jÆ‹ùÀg•Þñ]‘ j@Z_~ùÙ²6[£ÜW˜í@y ê¸MG‚¦mª¤À.¦¤†æö¸°býËv˜Ò\'f\P¥ŠSØçÂc"KBËd4Q.NPÇëÐõ×_6Ó’çÚÂçððëåKNíEÇÃy£ggs°«6C_XÑ$=ïýˆ´ÖWñ“‹A ¿ž<ÍÍÍ׿GpŒnvrŸn~Ÿàeƒ“=ÇI£'3ºýz¶ãÉ,/‚‹°‚ w^©GtH`ãdÝ(ÿ„ÕÜ2p€ä¹Î–câݬv@þ¼Á¾ŠnVyðJ-é h„Æ >42¡­ªƒ+–F}iðo«««ëFØ<Ÿ.›äŽ-ï H’œ¼âšÍiqÿó/ßøúúBò\gþŒOLüÿ¿¦d1·nWûJÒ¾˜40Dž3ÀùrŽÈsκˆq¨ŸÃÅÌ™4rÀc1îú(úæ¹¹¹ß8y–ºGÖ+Ðy^ïÎ=J܃ø¦õýû}És±£V«B9ÔgCsÜ‚~q`Øø§áÅõÞ ­Œç#QÐþÑ6n×ÊÛå“Ðv~lj}+Sdã .ÄÎÎ]õFoð€íÀÀÀëß«~5äOõôDàW¦¿òÖ;z­•× 8gj øÈ©=<×½“«¸Ô%¢P¢›\þŠ:‘ ÂyOQ-ðµ©ý¼ß‰×°ÅJï È›jTcóÌÏÏËåòØØØüÛ¿ýÛïÿû×–hùÃþ`kkkývOíííÞ%GGG· ƒÁàp8Ïw ǃ"äããC"‘|Þ.ð)ú•éï“É ¼€Àsc³Ùç d@W 8­èèèøøø·µjšãC!OÞƒ<=AÚøØ™a¶Æ2lݽ,,,1nLí=?‹°ÇËË ØóWóŠ¹-̺úõ[Ö–¿7 „µ"â™+ÑóÛ‡XZΚ¤a‰RÝv4†æ™4ÁoÞ}úӘѓ)áÆ.TBꌶO¶ëe‡ÈÛÈ377Ü«ÚÚZPÙÿô§?] ì&ë9üÊ Åû]1pç E €û»ä¡ ™ó»äêê þ¢ô;GNNN  ¨ý¹9Ñlç \Í© 4øv­­­o,¥öxÆG ñÛYÑÀ!,ÏÔÚÑÉÁ‡õ úR@Qòl«*PJÁk(++kccãʺNn ·¥k1k= /cfM´mÅšðâI¿“QM‡ÚòÙ²øbÐïù óÙ§^)h; Êì *˜òËðÏ™D#Þ§okwwwll¬¤¤ðáü£žÙs$@3ƒZÐœº³Š:á¼­ŸÁAC'RhéÊYøœžÒõÑ@ÿ|Á¾.w¬v$¤ÁÂ{ÖàA×’¸>¯Ë›EaçƇxÏ÷Ôcâ)åu!!YÍföî­ÜÚÓ)YóѹÕO‰Í\I!ß™F· ZT*É„YLçÇ?0sylånN–²›"#ÄÐÆæ+?¬JNIë½2ò\bÚ×éwÒ{½Ÿ>ß³7ÜæÙwë{Ý’>óæÆ:™Æ4#ñÃÊV£÷yͪ³ŠnV‚÷Ël¢Ñ½/¹¶xZ¶fŽõs´·=õmÛ©­­½Vï‘Ež]QûƽÍü+w#ë䙡% ´@›*~« jð<4³öŽ©w@ÙvìÀ‘á½ÇÔ²}~£ÌÐà©Ïó±§O-ý*•Üâ;r¸›°Ë'(Ð’šѨ ¹p…6¶úh4‡û{êã Tß“¸ýË£ÿæWŸß´^ÁÍÃŽ6\¼žË®Úˆéx?ï ä.^´ðŠ024ðóczÝÚ$o–ÍÓªð1Îo; Êl|bh€KœÆ2BØu¢.$¬xŽ]«ˆÎ«~€å—ë~»ªžŸŒ}1îØÔeNIÿÇ€:$¦YZ2Õ†àé gn§åŠÈƒþî;«KË«#=þÞ¶EZ2(÷äK ó+²-ÍI¹Ð(K‹ ‹K ¥A»jK6®ó[²¶–¦¦îqðùÆ–ü`_±¶²´¸´ªµ›t*¶×çççWe›ºÚ|-„ú…Ê‘±Þºú¶ù¾¶ cS¶òȶ¨Ýµ³µ®ØW®-/,­®+_i0ßÝ’)Ô›kËóó‹òƒ—ÔÚÝZŸŸ›_ß’ë0¢w¢o-¯mÊ7ç¾ß:1»wbÈÉes<º³WHB_g0Ã`K×UÈls¦•GzNiE~ÒãûOÛfåòH§¦¦8·¼åYLf€?ëÞ#JJ§ä¶Bk‡Ów"\ƒbû/tóè äG5Û œHæ¦Æþ~~g'GH$ÔÕºVðÙÚÚv£„Iú/¿pä¸ä¡{·n7¦yÑÜÕË+!FçÙ“#+•©ž¡x~‘­W81¡WÔnFK«ÜÖº½Ýˆ³;æ-5² ‰nØ&EXÑ’ œT;º„U"§°XQ-·õ¸oë}Ròè~ñ¥ñŽh;.15)1Ö‡èRÙ¿£XÊIO‰Å¾¨²mè@}t´'Ë}–,•J%q|ê‹ÙYJ(ñî]ÓÂʒ좂Ú>D³$‰K|–•ó"“ÏaçÖd-µ‹¢ypŒDZÑ2´µ6€µ3³pm™m©ÉÎ)iR(‡šË$bql¬T(Œm[VìfJüŸWäf¦ÄĈJj;•§î·*“+IÎËÎÊHŒ‹²6gÔ3CmR!_ ›Ø:0ƒì/HâR’⤱ÏÊk_DßþêW’0»{\¶Wf†eCàH¤«<žæ2³¥‘mÙM¨Ç˜æä%(»ŒÑsªŽŽ ´¿­nT_ʇF¤ÄñÇ€bôÊbÎkçë{–¾é}&’ÞSs|Ú_‰5 v“|ANí.9¹ÓÉ/þ‘‘¥»‹£ß›°(Ì»»»×­¿X­æ®dÿâUfÞ¬6åÎøÌ-/]e *^>ç¢a•wìè´o«Aæ_GIl ¯UsEØ~QÝ›sy¨‘Â`54â\0EíºÙåê‘;ß™.ª^2A¥Ø*N‰Äâ)B¡€äå” ¬ý‚¹m^Ë0Ú4’uÏ;ê£ôªTª‘‘‘ÂÂB`+úûûç‡ÅÜ7°°¤ÇG6/¾y9þhÉS!³f%ŸÖøcu¦së·îh£uùRl­-Í,¬=È6„@ªÀ!vò‹sdźøÇ;ÐÖxk7#3'G{:Mël¾q*(j ë‡ ^·1>‹‹ ËK‹ ­¯ËòóòxO,ƒÃb¯,yžû)ïùÿ¾»CJ馿¿`bæL]0'+wÚ&(ËÐØôÓ®·¥š7úê¯ír´1v(ˆä”ú¼6Ð×Ó7Œ_RX—_—=º¬­ûóCíé)‰B>J¥·Œ.Ž´dÛØ1@µ•“gÚÍTÞ6¬=Ñzý_ﺮ+å\¼ ƒ—R][›÷<ÙÍÒ¼{u/'.*€„’'Lš_eAãÉ÷öu I˦_U6³I5K«]ÔB £$ÀŸÖ:ºuÚæ MlP©µ%¶Bêg¿=ßeýÐpDGÕáV Ë¿º.‹õ­ìБç`gîT;öüh›§eÂև¬~îEZ\ q±L«é?У!‘et9oëüQ«Õ+++ƒƒƒÍÍÍ•••Y™Ïè~ÎŒ¯¤®¸A‚{‰õ7µó¾Cžc›mšOäss‚;4À…»¸8ë׺b2¾dÆÝ PÈÂÌÄÒÂÜÒÜÌÚÊÂÁ΋q§Q)LÝüós¦Ÿìíí]Ûq鯩¥¹™¥ “¾Ö5IL&ÃÆÞÙK·ñd^(á˜vÛ‹e¶õd;à±8ÏOK÷諤­Ñ3Þ–oahQÞÐ'¡G¥Uê>Þ¯©ïØÞSwVÖõ-i¥œC4óO¬œh϶¶6Ïa/4LGwwŸ²V=yÜ6–þóÿ4èÂtŠ Í6T9ÒˆNØSžÄ æL¶Þ}ê4¹©åÀæ`þ··-fåÀæ1M«Y{†ÛKü^!OZ¸ƒ9!u‹xø§´Äz…lŠhõ8»G{™Ú,"‰Ùß߈Á+Q›ç`àö¬œê7›nv26h[ÕnO4ça¼¨Às¬Sñ! »Zž©Èæ¿HªÆ?QI5nkk³¢²ÒÒÅËÄ;:¤\?„¼×*xú ¢1ÈO6¾ÔŒO5Á³q‹*34µÒì:½Ð'ãu]túyUU•~îÿlßØØì·7‚ô3Ê—Jõöööº¸Þ3ók¿ÝÇnaÖþk͘xzSÈ’››]i—lª»šJðÀzzz¸¹‹³7ê­É’§Ž@ôöÂc”Ž™Í…áÃ[ßû…ùÐüƒÄ%2icƒ)lОVVõ¿¿¶^Sî'ú¹Û¹1ý¢D±$gJD\^NšÁÏ?I Z“£ÉôˆÙ–<[ÂöÀbÉ>Þî®îIeÝûŠÍÜý„ í¤×Á–|_ ¡ihó%yØŽnD??àálåD•)õ^SA¼³“3èåŽ!¦· »CVÖ%-CèHÜ“»NØæéã7ìþŽ,GâèäŠÇã]œÝã^TÈUˆjk:*À×ÙÑÙÑÁž"ÞØ×|ê—é‘FSUYaçèlh‹yâDI÷j ЮXñövãcë¨Cë‰G·j¬è±Fv·™‡–­~\Ÿ ]*‚’1øÀÔïÓíÃè°[|||ô-çÍ/ ‡††€zƒ°ƒ’€|YêçÓg¿úǶytkÕìNŽOÎÎ/®¬,îì*WgÇÇ€&Ö6åÚñ~ÕâÜôØøøÄøøìâê¡v<ÏÞìÄØôÌìÂòêêðÖ”óó‹; ߤÞ›œS!Š­Õ±ÑÑ©é™ÕÙÒ,Ⱥ#ß™Y\ÛÜ-¯¬m·I©Øššœ˜˜ŸœžÛWiÕ«‹3rmáÜWì,//)Nõž§„ØÇVLLLŽÎ.ÊÐq>ªÅìÔÄØØøÔìÂîð»ææÀ _pu~zdtl[ïpíË7µÙÇÆ&§gwöŽÇ2É–ÇGGGFÆÖ¶Ÿ´RèÏ|ppPQQ|v7¬™ó]c§§¸pAUhź¶Ý¯_—ú^MýHìÙ¤r‰,}hCppq§PÈž8Ü­'Ö!>>¨µãûlø±µ‡§§çY’Û&))©¸¸0€Kd2ùt½8=ý í2DEEµ··omm}–éçNžÀÀ@ÿ€Ï'pŸñêà»s8œO1žçrÈzãÀ÷ì«8z¯‰æA‰jÍyCÞBmŒ×˜vþüë#S²˜F—ð¼P^iät!æ¾Ò'¦ÖÀÕ?‹Ôàyþü¹þ‹žï Øo›››à822ü)PM–——÷öö”J¥Z­¾é+ÁA¼µ“A0йÇ‘¾„ïsê[,--%$$¼1úùM(Ǯ͉5bçàøÝC+Rr·~°ô…†ŸÄƒ¢¤öþhà`emýZ«Îé`u¯­­]¤zžý‚‚º~êééár¹úˆè§õÎ&\4ðz|þƒ‡O~2q'Hêíˆ. ËÑÛÛ«5 Ct³Ò'±ý–ãÃG}¼½u=YoXh(00°««    ¾,øõ÷÷K¥Ò   æÉúSï È,‹e2ð}âããÉ$Cƒo~¼ÿÐ……V…•-GÕïFÖíFÖ+tIT!¬|+(»gO¹uÏÀðéc ™Ä`0Þ8½ ‹Å*++ƒØ‚ú‚ù³¹¹ÙÖÖ–––¼6› @t¶wì ŽˆˆàóùÍÍͧ[D|‹˜ †·—™‰É­ï¾½ýó/·ïÜ5°ýé±åG¦ßߺ}ëûo-ÍÍ($m¾·0Gp¹¢¢"è7AA}Áüy­j+ŠÙÙÙááa`õèÔ×׶ÇÆÆ–––Е7_;ìÌÉÉñóóóõõ†“v¼ŽDL]—`KGœ·ç4vÜÏâ òê5øh4`5ñx<@ý”ù 6\ëW‚¦NBB:Z;PPPÑêêjaa!Êý0›³­Ö§G«¢Ãÿ€'•J‡ŽÃÌ‚‚z/ø º•••‰‰‰\.?…Ž ÒK¿9 ++«³³óÏ‚‚ºqüÙÙÙ™˜˜hll,--l‰—ê›’’’››[UUÕÓÓ3??¯o ­((¨ÂT …B&“­žhkkK©T¾ó((((¨E!H(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((¨§ÿæ=J endstream endobj 1786 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 122 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 10052 /Filter /FlateDecode >> stream xÚíçWSk¾€Ïš5³Öœ;3_çã|˜5Á¬uîÌÜY÷Ì=zŽTŠ Ò{‡%…@BH ¤‡„^¤(Ò{ï-… Šbáˆ(ŠtAiû¾;cQ”Žï³^³¶ÉN!ÙûÙ¿ß[@ @ @ @ @ @ @ @ @ @ ]`MÏg÷Ùá[ÀïùÆ=cØ~³¸ðàþV£íêUwöi;zT*öÎàí—ãÏ?º¿ñöüÜìÐÝ;¦»OÓÑ£éêÓöªµµêÉÈãµÕe(ä«ã‹îñ|¬®¡9ãfu¬¢".Äñ øE~Ü‚pQSY*Ê,-®jîX[]1B†çê´ê²ê†”‚*†¼")Âó ý¸7qü¢Á-Š¨€—^šWÖT[×ðòÅsèä8%A+KožŒ<è×õk†ïÝ›™úèΆՕåºú®òf°°4$­—ß² × ízIÒ Ò>„Vô'ª¦'•¤åÞzüðáÕ†2òKIE8aExvbûRxŠá¹ZD®EØu“AÉá’òøÔ[%¥e«ËKP8È‘öÌý¡ÁÜë9â´Ž²€“^›QËÎnŒK¯NȬHL)HÉÈnkiÂÎtã¤NREIVN/z,W! "ëCd½ˆ´g Ü¢½èúIh] gtGħô©Tà¹EÅ% ˜ Kiç7Ï£nQðDlyú²ÀZ‘…ÈÊ:¾,cäÑ0r“&UO'‹'f¤T2 ÔÔ¼Û‘7ïÇÕLðgZ^sê¦bÊF©ùƒŒ‚VN;%>9%%õõÜÌz´²ÂI”’Ò:ío7»Â¸`Þ"ÚaUŒyYáÔh’´œS;î÷oõÄ´£îB"r4T~ê½»·¡p #ÒLN¼à $dYYtá=^ã fìô_?ÓÁ=ïe–2 ÒüÜðôìëyAÒ:tçÏéÂX©ƒˆ9É3®@Ô¹´!úìÓ±D¿5ÁK{2…` òÙG ªèc¨×5Âö7½H{¶ŽLzQó€âë'i9½þ²}ïKuB JŽÖ‡WÂoœ–És?N/™7'JFÖV p ‘Ì›Å]¿¦¦¦ª¤¤¸¸¤¸¥©qlôÉG£šG³«Ç zÙfpbØ8ãšØúz›Q¡Ã¸³ò I͟μ>û$Ý«”ä†üüüíÈìŽgÖÖêêêBÂÉö¸¨«xŽ?¿˜˜Þ™Û™«#¦vºÒR-½£<ðd~B“'¿bÏxüx„ÀÄU¿øŠè+ü†é«Á|´N¸÷‹ ¥Ðê«Þ÷½µT ŸzàÓX_»²#d¯$ƒÝ¾|ù’ÅŽ¿äN V´`•'ïë[zßW¼`u/ìšvd¹[1''[ È ÏÒWR¤/+}Hdþ ³lä#o÷%ÑÑW«Æð1¸y¶6×JJJæççO½¿Šcðí÷oY]™ž™áð–þ,NÝd’«Nù”7°‡@ò"íE¥ gÃåM’®ìþ/=ñ±VéÝ1Æ×ðÖ -‚—ÔžºpÙÓË'//vvöðüXKKK¯&Ÿ¿˜ùð·OMMÃÓöH_#Àa\][çK/~dèÜòEqꜞ5/î-+‚€Y:œsPÆØa±Üc ì#Ó~ºdŸ’‘ó||Ü8ö;@îܽëy-$Á6„ÿm›<)ž¹GW5ÓÓSBE†W\ž }i‡µ¬É:$¦ø‘3-mò>ŠÂéCx Sa©¼úÉ”AÄ#¾,ˆ.èÓô¿yóæÀ…£Ñö‡$¤ÞE”ýßhI¹8á"àÉ{DUóâÅ‹ØDe ´^®^Ov’†`Ñh¹ƒË†v#ŸZMl}-êx‹ú³Il_rŽçݪ˜Ÿ›;Xáhûu!üÜ$-rt¿Ûph¹à#áù{m359'L JjUêv­Âd7+l¨êf½ܨ¯ròmă}Kžž÷zþ …mlã¹UÝ#äЪæ͛Ťô\œ¤¨GWûãPÀ· ª‘(Óð‡ƒ¶¶q /.,̼cqq¶RrVVVš[;<™Ùr5T ²ýËøÄÒ¢¢¢ƒºžBÛÛ˜Úz¥§¥&ëQ(åååsú rh™››÷&Æñš_õ:–}.‚Ö÷0¶FÝ·¡ú ÚfßZ OY:S#(d=D"Q&“½|ùžÑ‡9°),.ÃÉ•Z¨š/Žp¨×5Ž«««û,hÔ6—iQQ‘z( o ms¥Íòò²w8K íñUÈܺ sg<ƒN«ªªZZÚ×9¸ m mŽOÇž]%”ý0°ùÛÚ|XYÞn £©©i?#hh›#GÞBRŽî¨ö¾;pçô"Ô¬î+–f4ÉdÂL Ú²ž@xdG†fz^ÿ…óg£££ÉdrZZÚ«W¯ö'¼¶¶9r"¢ä˜FíÀ6ùºKL¢£éT*G£ÑÀL Ú²¡~Û`²ùR˜Fí` Udv¯ùEÔ6à€'‘H999ØPñ½v´ ´ÍQ‘ `yyiffšÎ`ÆÕ¼”÷Au|aÑGƒÂö7þÜwW'øˆˆˆ˜˜˜gÏžÁØÚæXJcû—QÃn/ÆïÞ®mî§:øñ²Fl¸7,_Ú&_÷ÊÂA&b|øžžÖ-éù`ÉHpË®z†ÍßËÊôˆ-ðdú°ólíì£étÌ6 ¶ò‡±Ía‹mÀYðäÉ¡ä ‰ýûßÿþüãøá;;;×ÑÑalõ±§£LazTÁ]¬߆¤é£wÂò Õ$ëa•3=C¡FšfíðL7º^8 ¶yô謷9„¶òððð„|! rttüë_ÿúÝ&¾ÿþ{777̾çÅ…×¹·ªŠ8¡Ä®¨FÙxs‹£Ò­¯±U>#r´Ö.¾2%"¨;àa øa³Í›7ožB¾œ±±1Ngbbb,™‹/‚dJ¥RŒGÞð›.î^ÛÕ¬¯w©ZŸýá*„”ÙçÃ+ÆâÄþFQç²7#ÍÅÉð•••ØœN0¶õ6dž‰‰ SSSà™S§N)•Ê;wî€{ŒëŠ×'å[\,¬h$¤t+ö«Ã°´k‰}SMÉ€­ö²ÑEjdw>‰~=…nË¥~÷®$¶Ì ÛVð\AÙjïîO&[[[÷g©;hØ&µo¼~ýº­­ ¤¢sssX$óQ“GòSÄûx HÚ_‡F³¯o$ëÐ6/,×Àê¥A*Ÿvݕݦxù€{Ї°3÷ÝÎÆ·Iïæc—ê;î‚ÿ&­×2!ÊÄÙ)‡ªfmßâ¨Í3-£K_©võ —V€Ÿollì£Göa˜]±aâeì«Æ¾íOÆÀë“3o¯®o}çwWh›#ÜÁouuuCK÷æÝFÇžùÒŠ~ðsï›mæC¢b,ÃóS´ËôÜ>j¶&"©Ô'&'¶fVT}ßÁÕÍÔ‘œÖ¤!hxÌI÷ã2+^‚O{£“V  I̧¾ˆJ¾I/}I‘äû2s¢ŠÇѳ w•S¬Ã1“q‚:^ó8ËhòŒ_~2qJ‰k9øë¬B‹øĤ¹¹ºP©T@°ƒvn,ò”t.D“M.š;ÓS›Ñµà?:Ã3´Íñâ×ÑgNIØÜæûjbAšfÖJûÅ¢ì$0XçœXñ•O\}œ-ü%1åϵCæ—Ì\c‹ƒbe–.!¤/#ÅbS 'JjLÕ‚Þöôå  eYškrÑ:ºa¤Þ2¿æî'¨ñ!™ùðÙ ¼å'þϜҕØy(ªŽý¸nž>àà'‘Huuuz@ÖLj-¾¤Çô¼eDåÛÔADÞ>æàîïÐ(ê^Ùâz‰î%A+Ø^µ¡)$(âÎ%qײÞ-k¢öAë¼ e^ŒÎ$°òh¡þ¿Â¶I7¢P/88‡†$÷ˆ{À·´"l›Gwnw.F@ÛFFLjâýœ,ë½m´³¾Ä(ÇÈÒ$¹E}Ú"ˆU¿€'8Ðëä½klöY/ Ȥ¤/}Éq.ôb¢HzÏãÔ¿Vêß [z-H¸D­ÓÎ^¶þÂ> ÃQ†fX#W½B³‡ÝÃ?Ÿ°ãt®íg&µUQj?~‰»Ž‰õ+žœœ<ü™” DŒE-¦"+g…­¯%Ýk AKUãçƒ8 sh=U^οÎQDí¯ìΛ9Sm R¦ÜžÀcÕ®H†}Ï_¶?kfãÎm–ö®Æ¤Þ¼`imzÕÉÔ&04kˆ®È=ûËÉӗ숷^ðK»/Û:]¸ænjéàH+’j`&uÜx:öÌ.Sm|"8®1r’ܪ=kȪ›¶±§×ÊzVÃB~­/ÞÆ•«º°eÊÕÏÑ›×îîç}Â䪹­§™Çésf™ÃòŽ{À6ìŽC19ȤžþAQzÛ`áÍž®Å° ™Ö Ö:@&ž»êîB–‰kE#¢nD^ÓzÒœÈmÔÛ¦ àG³hQÇ”‹¥«1ã!%G3)N ìcG«;µÞ³´#q;V)’¬ÔAi×°Mû¤‹¯sPúÓ”ÛX½(¾eÞöª.óÈ’d}Hê]DÖ½ÄÌiò¢Ê¼Év~Öññ-/¯9…fÈÔ¯DãìEKò  /^0!–# ´Í±béíÛÒšf?Q;%SÀ6*Í,47M;ãMb9ÓKõ¶QŸºèǬ cP/yñ£‹ž$·]²ö MëL¯÷f¤Q ž’¸vÄ4njï€+Nl•Þ6“ΞV8Å}ZRž•w4)KMU9GdÅÕÎ({GÏýbŽWvòZ–¿út“t¯`í_;tøÌ^Ñ©.ÎÎØÔXx³§Gþ.µI­&T=Š.y–|]È<$šf…WpoÔÛÄ7/€/‡Ÿ}ýGsÌ6.AãÛp[ìm¬ýRîJûÐä‹SrŸ×0jarÆ[®µÏ‡sÄ×üÙ¼Ö `›°ì!å bkibϬ‰¯ŸâU˜™œ%U¡¶ÙÉwmsØÚ­Àíã‘B\*Oäìƒp¤oèŠb?Iw²z,/ MÑÊ5ˆ¢cÄšÅmZH(U;à"=¸ àÃ0ÒJpQÁq~üªÄN„™],kKh]‡.Y ÉWLqû|h¼”zkZÖ9GLÌt¤ÛããBRµ¢ÎU°[XœØÖŸA¯\üºùy$Ý«¹:‚²•×0•´“ŽÖ}Hbë‚g„ÀÏÇ+Jðcóø©TªÃn›îefFÉ%{Bx¦†U<S ròŹ0Š„õgÎ;„_âÕŒ’Bÿ÷ ØÆÉÛŸþ ؆*I¶'$°›p:ÕÒ_H»y?:³üª{4»nä©S!7žsŠÜp—œI̪ÇÖö¾^œ2AלÅÙ“>Ênå£P^òÙ³§p£2˜I;ۀ𦸲.PP*éAä}{+ìÅô«S¡µX_>ø$èCz EÕïîE‰ž2kr5ºÿú˜GíûN€ lÀúØ€G±ýšõöV…ýoÒþ(JŽÆ“}Ë{+4µó넃v2zÌÑ:ú„RHëÝ€mššš} øš¨e<ˆ%wOôŒ”yPÝéY1IšÕ–Äž†O( æ+¯àÒij8:‹|cR©Cb²*ü87¹MkâÆß(‘GT’;‰ã'h—t¿ 8‘d¸ø[Aü\"'<[ÌNu"p£J_QEéŽD±\N   Gs)Nì¶9†Â™™–§çdõâý-µîõ–¯û[Ðgé‡r‰Ç‹sË3®à+Sª>$€WèàèD§Ó°)ì௯¯?äõ6XŸIYïj|åóÖPlÙaçêú] q%÷Y¥O€CØ•/¤=+üÚ1AÛ² Mo§yõ“â®Up´ÍÄß­x.Së»óu¾Ž-¾Ç©~ ^œ_3ß0#j›+æ7/Ê{WØeX%#âDÔü*®ìW1´Í1ÎÔä«Ì¼"_V&»öÖËwßœ#jC/¼q½œÔ»\®÷GæßÞÉPˆõðIƒZ_JjíÈ L_Û|Alê fÙ;?r(!(êÝ‘$b›uáèOùõþÛª÷£B° dìžõûû>è~l\ϼ޵øÝ”ØÑ…Þö=ÝhÏw½‘×`½Íñ³ &œù¹ÙÁ¡a·@Ê|<·n8GÙ¿>`ï&Y’/¿Ì™(®Á‰ªw·ŠkmIrJŽv‡ó*££ôéAÙj"H¹½­¯b½¹cÉ;½½q`ƒÕÛO7tXûÛÀqR½ŠpÔ=A±ÉÄŒ>gz¦¹œ+#'<½›^x/úÖ0¿iV¶s¡'÷#཈½Â¶…Ä–¹Ý-‚Ö…!ꜯ¾g˜[Ì?±Â—_úÙ&<Ã%žšÛñ²M…ŒIÆ`‰4== mmómªfrâ%[žÇ(~~©„æÙøúW1%ñÒz^ H"¸µ{²ò8mÓ"ó“T_yDÉ?¹œˆFð’º]Y눰mÑŠ¸­o£‰«|vÚÌ–D 9”A5X@°§ó…BÛ@ÛfÛäÜ"¥´Ÿ˜àüw-£Ã^:—¥=«{Ò¥³MÞíõö÷¾÷­TØ6VK€ŽAÞ”ÈK»—"¤…ñ[ƒB (ZvË6á°«ŸƒÀ/e`Ëð»d£'/X‡††ÕÖ¼l6 ›…¶¶ùFý•—^Ê,jhß|*íI½‘md*„—‘ù‹[ºÝ½“’uÆÂ/ì£CÂãÝhYñmˆqD!é|ípíRdËz ¸lSåí®Ûf}zó¶gZ«|ô£/‹}"ž4¹L 3ÆØ6t:}vvö(Œ“:ζÙ0rÈiii¯GËB õTeµ\³SO|$¶éE=cç¾ÌjG»…LmH¡¹©êi÷¶_b øxôô:ßhE ¸Eйlcou>8[çËHKU‹?Vµ»¶¨Æ†(MÖm4³¾gÕ—WôÓϧ°ÃÜØ3†À¦±±ñˆŒ?ž¶ùp•Æå¹¹¹±±±ôôt+++±X m°×”T5â%µIû¾ä÷±M|âíkå¥øUÜòÒÙÕ'+qfVIª\ÂxEÏH¬X»p9ØÙ?$À,즴{ÁÆâÄ5r=³ÑÁ/ÔWªV¨qÇ[ýtk{Û`¯Ì©ya"Hî_E#é^¶-R¯kO_quD[ èÔ©ó‰d~~9 ³iãØfeeåÕ«W>ÌÌÌ477ÿíoûÝwßýþ÷¿çóùÐ{QQcLQuK€´Q¡ÙïCâÛô®dŠ%S˜ú++»-<„ì+žON-w£ÈyísvN8»ÀX/ºÒ'2îŒ]œ¸{ÑÞú¹IQ/„%dدsʇ 7IY:aûÒÞeR ð¦ÜYy¢Ž·’®^Ã4·f<\ÙlæJ¸páB…L£Ñ6xÆpÀ³X¬Ç•¹ûŽŸm€au:R©¼|ùò÷ßo¼FÀý×ùúúvww7mMsssË6hmmmkkkßÛ [OOOO÷Ö€G{{{û¶J¥R«ÕšmÐß߯Ûƒrûöí_ýõ£‹׶Ê›“Ø6úÒvïôYç0¾Ð%Q%ª}èe(ôa)WlpAŠž„–ù„úgqU/Å “²>¯·Íb(?Í”Wr'(>Ÿ˜®èGµïmšfݘ×Cdµ!Ò*[<묙Õ5««1šNüXTÃd2Áo·ª¶ÙÊ6SSS£££8îoûˆd6¬Hò›ßüæ/ùË?ÿùÏÿÞšýë_àö‡~øïOv¯óÏvû÷¿ÿý?Ûà?ÿùÏÿ~Žüñ§Ÿ~:qâÄOŸãçŸ>}úô©Ïö1555ù`333KKK #À•7&&æíÛ·›βÚf‚¼á€3)l2Iâætñ´•Wd-"ï˜ ¦4÷&dÜO½ƒ„Æ°]hYÔ Yœ˜2 íz}íâÜ;èõîÄ8?¹$¥}¿úÞÞÙ&¾~ò¼=þÂù3¶×B øh:®÷ ¶DÝGUÃf³ÁeTmóÙLêÞ½{à¿ÎÎÎà”ÿÓŸþ„Ùæø¸"€$kfk¦§§ÇÇÇŸŽgÏž+û£m0<<|wܹs\ª´ŸD# tÁâœOvñRÛ6qˆè?GCCC]]]­ÕÕÕàó|´›GccS„¢F¦:ðØu]LZ‰3)S¬A’ú–™¹Mžôvý[t‡ö‰ n†OLŠGT2³zVÚý&ˆÆ––ùF'ã*:о7Ò½o“Âêm,\‚X1@34¬/ÍGS'pg„¹\Ž–­ÒXh›lY@JJŠHþüç?ƒTÖ´ìu½Íè¯8©%ÌÊçû3ïÄ'2)tl‘~ô76¿\`ã¶Ö{ãô£OQ¾ɥСÁ zV¯š½o_¯%®~nzÙ¸&r 0ÏH¤ØØØòòrp±ÛOÕ@Ûl³Ü° .ÁàB|ãÆ pч~زro’ÓÚeû»ïGêmv¯ì]ls랉ÉùèhúÃ$WÉ¢¢¢¡¡!C꺟«¤AÛ|uï>¸˜Ý>„:/ÇŸGp“˜e£_4Ìù´¨ã­Eæçíi<¦H†H$†‡‡GGG§§§ƒl÷ñãǯ_¿>¨ÚæKmcø mö\8úÛÁ;ƒþQBNýä¾Író¥¶Ù¼<ÜVkeîmš¦O™XÒi¨dLÕÕÕwïÞ}úôéôô´¡óÞžNumG.éšœ‡y‡ÇDÜUh÷|*¿ ¶‘kÐ ¥¾fFf¨¥Á&¾Pé‡MiÑÿ¢µ:ýï—?Shкt7Ýú¸*tf?¬&Gµ'ã¤ìÂý|½Z’É䤤¤‰‰‰ÃCÛ@Û áÌÍÍ Är3o§nœéèéÜ÷Á¬ Æs"íPGÛ(tH”XyÙ=ÔÊ#Ð*@*ìC„O=ña—]ƒ¬üY”›ÏdÕWJܼ‰kꯔö¬J»—)Üç¸ú˜ô¢+Nþ—]ƒ½¹åb5B Æ:/(…Ëƶ1t0þêUÀs#rû/\¼ˆMfn€D"eggc+`’PÚÚæ¨guuupðÎEsË_®xØR’¢n Éô3ç£3gêûä'5Gݸ+éZÙØ&ÿNêí·–œéÕ3ÒîUFf#»ažÂ90ªä}kQ†-5îf™c(¥àQ’jÎÂԊѼ"éšw°½œ}ÇÑ-ÕŒˆªœ‰üðëñÄ GÚ-~ó›Í™¿i&*ÿ¸ýÒ¹z0ÕÄV<ýñäÙ  À‘H¬««ûhG&hhÈv´“››Kˆ ²¼|åÄ/§Nž¹ðËEëÿ9kuÖ‰è—PžÐ<·‹™È}èŠì –×®øЃ’5âŽy/œ÷¹kö8š/Ù‹[ÃÉk¶ IŒ©{†PC]ùý‚’ê³Nœø’Ö“ÿgjÈ°ó§Zð£KÇq¡)ja÷†L ¶‚~óž§Pض°MÛB  Fñ£6ÙªóÞÝ»wÕ/mms´X\\LLLgSTT %ŠM·±sH(6ä&»•Iw,[^ù ••.cŒ@c¸ñ:“uˆ¤{YÞ«¼ãjH"³âØGRÕrÖ™AôIæ•öXZáÔHR視k)I‡àR5¢mƒvãQ!Ô¼_^ ¶¦Ã¶&ß{÷7ú *N»Ô²yX7™LV*•X¥ÍáiÎÐÛ&Oñ­ÛÆÚæ…7“““"‘ȸO>5‚bneªhÞ•yoÞeRw“U¯¬]ƒðÒƨ¬6{7orÉ<;¯ÆÜ!˜˜ÑåëÍ­VªmHRVåK,§svt4µòáõ!¢Æç>!gFI”m*ˆ®š"…ãÓûEc4> Kiw (ÐAâïfêÞê¯ÀjÈ­ Ì’G+këÍ3Õ›ÎÎÎÃöói4ÚVZbÛ[^Ó,ZgA,šÐ<¿¯¥E_š¦ÚOšÙCÛ-áÌÏÏçççÇÅÅaM½à–zÉÊ1<µ}ç-V†ØíäÓ:&* äßbTÎ(ôMð¼²ÛÜ€7‰H2žîÚæ5TÆÆƺººŠŠŠ€yR’•^Þ>xN5ÿ&„¯¨ÆIÖ!Ž‘iAòFN°«Çã*Ç>_ªžmk·Ê1võsOöMœ¨h'±õµ}pœ¯—;M?Ž2H„IÀãœìÌ/œ¿dzÞÜÜÌ삉ÕKg»`|4= ó pÌV5Ã<o``àð´zô'3~2l é·ƒñ5Úæˆ:»tÎÎÎNMN–¹R½Ù±UÏS/í„ ÂBR‹oB¹™œ=Ó_Pé—XñÉR ¬òÿÌ>뼚5%úÖ0ˆsüxEVÖ׌èõÚ'ý-VûA§£ÿ€„¶1¬›‚oppðªf+rrr6,ýðMms ´hij´±spf¸ÓÓÉ×°ÜXÖ³•y QHÄÝ«®ÑY&6'Í@Jb’ØòÑÝ*àÕ@ø–ÚenåA!mNˆH$8·sbþûŽŽŽ!Õ²³³±š·o¬¿7´ÍQ7¸mkm ð÷srvuö· Œq¦¥Rº¸õSŠ~$å6bžd¬èÞmÜFï—ô a*ÇðD'Ïbx¸§§ÇeŸHAÛ¢¡¢f§¥}—°ôž+ŽÞ!ÁA®ì`D4%%%‰‰‰D"Ñ Í`Ç*Ø<ëúõë {Â&FŽÔ¾¬¬¬h,z; öÝÁoc›ã!œ·o߶··ƒ‹~!È×ÇÇä ³õ ¶ò »êCµÆ±®ø6a"{’Ä&$Á6„w-€aåM¶ñóÀýüq2 KjÀSMìüصØr;\¿;íâÍ+µvñ%mž+Ø#77wffæùóçjµ:??ŸÏççõ„ëÁ¶Ái’’’RWW7<< ö?ržÁxòä‰F£Qûî}}}<øè4¹#'œåååÁÁA‡C&¡ ¸%‚ñx<>(OÅ‚BÂÁFØB “IDã~,QQ‘à—®¹yr‹+¾bj/ÌQJ-:㨙OŒ“§XXèæú ®€;>|hø@¸211ñôéÓ¡¡!•JÕÕÕÕÓÓ£Óé?~<>>$c<0á(NJ>óÊ· ¦8¡Ä±Ñˆ@®ò¬gÎ61®¹E›×CCܽMœC£‹§n·µ ÛA¡A·qݹ+®~2ys] ,,¬¬¬lqqqóág|Vn¾Ñcžbð{8N?¢áw1ÀíÛ·ÈJ€s¶jÜùl},‹{ñ²™gTdÁ:Ñ„Úhøö¦YnÐ.7Z´ožŸ°ú”¥‹“«Hƒ6HÌx¬ARRˆX6Ÿ8áQ Ú –X) ¬ÂÄÀg%%‹AŒ455”E „X^±:qÑÖ:TH¹Þ/î\^ïÑ÷® „§ý¦®ÄÓ¯ººº’ßUönÕÊår‡‡‡¡F c¦ÉÉÉÎÎδ´4&“É`0>Ñ+&&†Ãá455V…Î …À4Z@°²²>qâÄé —¹dsþš÷éË.g-ìNü|úÌ™3înn Ù0uçGûãaՀРª9®éÆÜÜ܃´Zmoooww7V ¶FFFÀ£›Ÿ;11L… Ã0-Q‘4ðßõ{h\°A5`C"‘Ü¿ªùF¢mîiÎââbUU•aXèö+‚Œ38‹•——g> U@¶’Š²²²@ª…Q2hgó`ICýДR©ìïï‡! Ù~\444tãÆ ±ÙlಊØ=Ø""‘(77xÆxø}B í;çÅ‹Z­¶¢¢¢   --M&“I¥R  °‘šš 2&ðJ¥zúôéW¤r²Y«««333Ïž=b›šš2D2Ð3dÿ½@ @ @ @ @ @ @ @ @ @ @ ;äÿÊ‘Ð endstream endobj 1795 0 obj << /Length 1181 /Filter /FlateDecode >> stream xÚµWKsÛ6¾ëWàVj&Bð @2·vb{”é´±#OIfJSÄš">ìúßwA€0iInl%£– `w±oW­A“ß“·ç\¢'’I´X!I,B¢0ÆaÂÑb‰>ŸÚ*ÏÒ&ÎX×µª,uÑæK5Q¼±Œ+U¨´Vöƒc†éôëâÃäl1ù6¡ ‘ Š"ÂC‘eÛÉç¯-ÿÌ“Ýw§¶(”1¬ú4¹œ‘µÉÀZ#‹Lxd ]LchP/HP+e‰|e×ÝZb“N î¦Tª?Ûø3•»µkÒ›BÕö«j=™éªR™;¿Mo§ðü^L[9jà1#ËK)˼\Û´\ZB•ªÞuŽ"Ýë«5²ÄÕÅØu2Æ’r‚cxúsî‹ÀÑð.Ɉ)ƒ%Â"~Næ˜$ÌI ÈüÀ4K€iûœ–JZ ;Œ8N¢¸—[)´:(¸÷Óµ‹¿d(†øËÐÅ_&'†¿n—|I†Ñ3_³»ò÷ο‡t=ëqrLãøåîÚ š‘Àcú’ =›÷\ÌÂÄ>|^ÚTj6.ÿ”IîÓí®PO’?KË#õ±K3›ÌK×´Ïæ島ÐëµZ⾬E-xˆ ˜ü6Á1aØmÈnKÈÈ^’¤g¾o)#轆G_z™3:H=èA%xÝáÔbc*‹0Xª:« r]†ôÊnt2D[«ñÎcÊn>¥#ý•{ãôÁqõHÜoìÆ}Þl,gþñ.ÄŒ{`2žÜý anHËK‹Â;Á]®[gÏÞ¥–&à©5àJ ÓÛ- K} éš›´rfÕêï|'­~»9¼vÞŒ,-j'`§ë:¿)žˆ-z `¶Q[6—t¯í6÷vj—‚M•®Ìk¿Â2ìßá„û«>+÷mrÚ|œ†–u^ßöÇÇoÛ¢É}½”ªéÄèêÖüBñ˜Ì^uz2ÕVµ¬áu®;³å÷î±²˜ca“[H …ùË`¾ ¨­‚}XÚa§"9© °Xâ„$Ïムô”60P3ìNðéœ0Ìú9àh#˜ÛõüÏ«¿~½z]U³!Ž£=‡:Î?výãüòúìúÌg&ÊKNÓI÷t’£:_ßÀ^齄3"¢×Àˆ}Y;$è0Û•œñR_zy¹kS^nK?né¶íùwÓ—¦ÞÞä0Ÿ”|²˜@¶C²#³ ÒÜ`W¹ „ŶXÚϺÑ;K 0¾,–a‘ ˆTx`˜æ$qÍø#Tt:òÎt JÝXÙŸßTº]o‡BÁgbØŒ«}C³«Û^Z7åS)gyá–s¼É¨*íQ×»ÚÇ`¬>ŒóƒIþûļyå4Íà-"¡'á(MbÌö0í•ü´Yš†Â\ù?xv~½ÔW{3(yõëèߨ1“ßýgtÿ/3ˆáŸ.¤Aç7Ó–»©sã8SVvÜ€ÿÄ™.M¯Û*u³)ø\TF.c­}à¸ÿ^×­ endstream endobj 1791 0 obj << /Type /XObject /Subtype /Image /Width 567 /Height 160 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 48100 /Filter /FlateDecode >> stream xÚìTÛÓÀýþO¥CÅFKOvÓ³›Fï ‚ ¨ˆ‚Š"(vņ‚Š ÅŽ½÷Š TÁBA¤Š`¯((vóí&ˆ€¨ï)¾ÏOÂnnîÞìÎïÎܹ3••ùy¹gÏœdkDðo$xF/ß…ÕÓyzÀwOæipÖ_¯õ6eÁv?ØÄí\áÕ@ ÿ­Fï“ÀxÂ1Äú,•|M Sˆeü¼ðõhªÁü¶ðtI¢¿åc¢’¿³Tþ!åá·èÖ RÌß© ¥u¤P ˆôYè‹¿éO ˆõUú–(#ÀÐR¬jœ¿%"ò? Æ«´®Jþ-"€–Æù„Rªb¾ ªT©ÄúyB!˜C\5˜*H©ä)˜Àéc7(¼·¯%èç68Ôc «þã±tž•¯GW~ÂÒ$R¶õhÈQPX4L¾•§Kÿ=OÒšSáøÇL'’»?_ü½/DFÐP[;¶-Îâ¾. nëï"}þÈF¨ìžiEré9ØŸmñcFz+À|R"ƒAMÂÿªŠúóî>RÈh«`ô ak©Ü}*ù{@ Ï´µó<)ʃn!Á= Ç3ÑHR£OÈöÚWò{¶Y"úC6þD$'@é@ºàʃ¥ß½JåÎÕcÈÈ}¯?yõ¬è¨–ö]|u)ë&:’„›x@æ:CÐw¿ElêtrùH‘½F  ¬Ê+>Úf_Èȹxï|–C)@lÀ¶`LM_ÉÁþ ¤„ßwCŽ›ïãA•%õ󢂑 R*ù%R3·³›x`×ñ[Öz|plôÖÙs·ŸÝ¾Æ‹@èñçN^³ìpÒê9X ¢úœ'&>½sê)ŽÑÊð¾4ãÒµºÜ”sG7¸é!'3V¾ò Rld™°áè© +<ñd.o^ä,Ä YK‚½µï:dù’à #‡OíݯÿŠ3‘A¼ÿ3ÙL+™Ó3rú¦œ‚û…'“ӶLj5èÃ7Ý9á#ÀîTOƒµ*çÕ©¤ÏȽõ'Lj㯴D¾T쀄á[˜y<çø¡ óãl [®%!v‡¼ ~ÿéý‡gJ¥\m0,f«›1KHöß"ÁÑ¥¡'›1''{]jŽ¹O;™xrSx‘^kñh#ÓŽŸ:3X¤Ë€q`à´Mk"—œÜ½7Äåº<‘òìUí¥CI'æûA:´ÁC—ž:xb_ô8  ©«{7.Zsbÿìp M„gðMÇ¥}‚”@›>xäê¤C'¢\øx¯+œ»dßéýGg[[ñq@›BÆaŸ„;yV/w!€ºù, eúl:bÓŽ¤í‚%À1xçó“Ãÿ›RÔϯI)Â1UN¿¯/ÿ© ¥’‡«3±wðÜ@@èæ<ëÃÅ©œŒM·åK,¹ŽÁûŸîÀׄ²^Ô†÷0¼îΩ ŽsÏ{¹<º²ÆÆ—Æ÷vBLC ÓQ B-S+Û©£%æL…Šˆ&HñµÀ¥iÏ£ì,Üã늗‹4)’º ¨WRƺ‘ì_øæê![R_Žlù¶ 0Aº7¹øzFÁ‹‹á`BÀ˜¤‰ÝI”ŽDAšùìÖ¹ÃOï×$ôubb{ßh¨îÍwsä…Õ6dÚë3xZü½¯ä œmµ,2ùYõé˱„± GssϨ+lœ< ìØÚ¸CNpŸS“;Xlb?Y*a«ƒñ…õ~$Ÿ3õUÙRHC|©ºzE²¿¨.cy ¨‹ã½ª´¾¦’õö´„ZVX ÓÈùåÕù"M„eEž«ÍZ:4t¯/Ýl¥Idv¦åÝÉví€cªÓ„ºÀˆaS»qÃV—çÄöB uGþ4’/Š:Z·ipO!®¤ ÀèƒFZv‘žÏÉöÇ‘]¦—ç®.êa3IfÉÿÂÔ‚qLäG`¨b}dnà^¼o[“ê:öú¶¶£ß?K±ïh¶êrmÏá? )%§Ú RÊ?§¾"ª5)•üŒ%e&M)¿_ÿêÕ[yýËÿ£®¿ú¨g^ð<>¤ ¥¥ãkÓa¯”ôø@G÷½ï?¾mxÙðúõ‡âLuúÄó¯ß¾•_˜ï…/xFÏ^³oLvâ*£Ç›AŠm<ô¹\þºáUÃË·n:`ZCªßêòÔÉöÈ™M‹G÷Yyœ\Úߢ֥‡ ÔÍB¦œÁ@Ý}BËÂù"Hdêò°¡ g—>5u%“6_Û“ À6ÃÎç' ’òc/F géRe6Û’¦ å¶f ¦ú46BjÚźUNˆ L}PaB„  «÷òúh›Á¨“2$lW]ëWoäù»'#*;ºˆ¥A…QÙË&±õ>C ÆÑÖ¨øø ¾¹\¾KB†mÖ¾~swÏü(;Ã/à ™Ž.‘¯^¾”W¬i †^JÎ?]ðØ£çaªƒUÄý¾\u³áÑ×#Ø} Rôör÷©bÑU*ùbj@¹ïž„Rht¼CãäÖ]}¨€T¬RÎ%òu°×ÙôøÁvök“‚œM:Óÿ¯+C“†Îx]yRCE\ÁZyäÊB²™°ŒÜxšÃïØñ[wr‡î< ÁÙ I<†È7%+a ©5egÂ,F¸жc‰2« [B<8Ì‘¯/…#1%e•ƒ`B€ƒN<ûÉ$ñõ%å¯oùá¤õOq¦ Æ„7YãAúl‘≀1d>±­È°ˆFV`é,u³UÃC'Üç óZÂE¨i,2±7fíË“Yhq…/û‘Xa䛲¥|“I×R6ðq€mh:) 0#?v$Cƒ$qM<>q0~ Ré/6x xAnmuHWsR…÷r½5M‘~²ºŽ(-N’ê˜ÓlöT&NC Us>èHä³—^\8–ƒôÜdlZüT–…Ôñ‚E&xÚoÆ”]ØXÒ2zØŽÿâÌLž½uä†>ùQ$è[1 ^žyqΨ×ùó%:(¤î.ëÇÕ06§RÏN …0 Ë„ÿ“V@»D¡7EP¨,)Õš”JÚRYû+Ǹ8„M8$oHD-©¢Çî(¤Ö_E-© Ç:wiÕp¸«uéÝÒ¸AÓ&®›aç(À·ÞâÔÓcÎÍ)‚ñÌ è¤òu‡[Û5Èã6ßLž75´ÿÌC;—IµÉ;Î^€Ö\xzyE)ß„Š”Ñ–0€´‰óV§º0–íÊ-½|¹`Ç¡ÙoàÆœy£|![Xî:örñá"6>¿ w4 ZP|&fâúÄki!R„†<-þžòX'aë¾1-†nz`áœåÛ f°» hæîúLÞ4~ìæ› CÙˆÃâ+ãý¼ÇÏ;û¦d©H¹7µ`(äº7¯6kå`‘¤°ª(ºïˆów_L– [xñ€Ùº¯cØ›Š„>,<yîÉÝ”­ÃV<9;Ò¤ÁÞÞÂ[›|úqa6Æ#3/݇çº=ýAñþ©"#—š 냆ï-|1× êœ®fœnßÇÚ´îµôù­s㼂7lÚ9Oî=nCüС£ª7‡q´ßœ`Ó¦¾‘¿?é)æᘎÖcÄ£S:–ƒ@jûÛµS#¦O°ÿƒ:¶-)U˜Ÿ R*ù%î>u¢¨›Ô‹ïêδôd[ˆ°€=à Ña#‘ ‚q,†%º ßÍÊ•$@^He^7o®•«uŒtƒÝM9M‡õùî<7¶X„C¦÷Üž³‹¹9Sf"ó8;m]ÉH³ ŒlçlÂVF_[ F<ªNéoJãà8Špq@dÀëÅséóBÚA»Äröæ;Z+Í7}.rÈ‹e)Ro#M9°œmº²[»3 yn,§qÑnDqë5)¤çÆÈ xó, Í ½.®4kOPŒ|VÚCÚ›ïìL³w%ó‘£f–ÞB×^TXôÅX‘m|„®^<ØÔ´‹Ï×÷¶E®Ô®Æ/ê-të @0ŽiE²õæ;;mÜh°ˆÀq£Z¸q]=™1^IyÀ–jï#p²@º„l(vÞWOÀ9*é!C{Ëw°4dµéHQ\`#¤`<§'ßÙÚõnIºB$>ÒOK¢µ[bŒü ®H‡} žî&ÿEHµo€Â)’¾¯‚”JþU›ya, ¢ù­Y±óàò%¶(2Ú3MÄHGw¡óÏIaYQùYEV ÕfÞ¿Rª0?Uà„Jþ ú7¥}hùØ¿ !FsKJ%ßœh_Ÿ*Ìï+ã¬R2*iGH\5Óog9àh˜Cuÿùfßî$êúÃј¿êÍ/ÕHðà÷ýÚf^žÉT£þSRLˆptP»}P+ÂPXÚLÑ/^–R…ù©Ö¤Tò+ c©}ÜÆÄÏ\åë-èl­zÕËøk*Ò&¯;îŒe|Û~‡q€gàÜåScb'-XêÍÇÈfMšáÜ-0´&Å°ÃÃ,›±pqø×®T©™×d[>†aÁ6Œk9$*~fld!ü}  ÚJ‹J€ò»+¥ZmkQž1 ×(†"lø è(2oÄp¤·6,ï˜I —GF ‘>(0°ž»lJ¤k6òÆ &™·xt˜ºR JMìb"Î ôé1Z@„Ø‹Ãj9:À×zÛÏ%ÔËø½%¶‹ªOM—¶eà´/¤”­)žTRI{ì“2µpØü8ÿСÇÒ„5öië®>ô$A6ÆB ªÕiW lÝ«Læ`e [uS¼F£ ¸Ö]¹ÖÈ_ºr`BëPkÐ-|ÙÅG'ÆúrÄ ¾ï¹üÌ@'z—À;ϳ­µ¹Ks}@ç©kJjN.¶Ì»jSì}’…øÙó<ý¥þ÷ªûqzöãˆ`\ëà[ÿíw¶ù!G#.z@–Ý…6Ʊ¢·b®5Ú[žbßàåeT†IÀ6r!–]9ŠÎ£=òlOF®K¨hmPªß*¹À#>Y‘?s \dŸ*­=1~P?ç1S]ýd]Ÿ ²éÁ#' Ê\Ÿƒüj¶&Ì%aø¿)]‚@JÖ’¡¡,Y7¡­©È² 9Óª{Ů̉DŽ1_¡cÙÈ`ÚšÀßó_¡+‰Ü‡«ÝI±1`öî9jvßþ{Ï{\“*Ñe-¾ü$uúï^óÅéL´üÞÙéÃ"¢ÏËËF!µØR8µºø„— ÇÂnÖ­«Çgœ“›~Ò pòߟ\¼Â; ÜÕÖ¡x»tzÕ‚™—­´á ¿¹áÆ‚áÛ®Gõöèqª:=àkÓõ ˲-1ü¬‡·Fw5…õy7{ë@Yïúw1¦wõmxwÙãYZ“+T7fp=,Þ.Õo )á𺺚5Qée·¨œ°…g2†! )vSV,øÚùn?R´ºo`˜«¬Cë3õâ¹õq1Ñ{n™(Ò0ŸŸ»{zdÌœ Ñ…%Ž%„§ÄYÊ_\H»ÇN(©‡üÄ*B©'TòóbhÂ…Þ†‘(©çÔYŠŸºv¸¢ØºÜ –æÀó ›6caaÚÊPtóŽióñ,g%¤ü—zþŒ u5iý ÈÈPøm¸2Ý þJ--)t·ê´—Mff9DäÐS6ªèá³>¦ˆØç|éÃëEÕçC ß R+ÊÞa²Ù5﮻듭^3GM›“^vlš/ª(:ýaé SÂðm¨N¾wçj?­"<}Éî¼ ÓÆÍ5åØ¥òm0 Â’ã¶]mD ,X¸¬zïÌñý–l]à›Se¦ƒtLî3üˆGR$X†Cñ›ZQU{fnˆÇ¿!¯pßòs¶?“? 1w¬þpgöæk¹«¦Ýúp³'eÔâ³QéÇVW±0h )hDýÑPV'S·Þ{û»€ÌqÏoï”hÂ)S`dü±äèÕÇw§#½åé;—ÊëWž·^Ø RIn›AÊ/6ízŒ£òº‚£#¾œ¼Ý7ìÊt‘DЙ†|‹ é‰ü£•ôž"RØÝ=3@m…)„§ù \W=Ý•«ÇT¶ã“r#ÎEአĒJ®;9°ÏZé´ü¤Ð/Â9+©èi*½‘h :æc–݈dqãl‘ =ò¦“×£Ì[”ÐB!UúfƒÍ!¸–¾­qÆ»Ý/ïcÆfÂë«’g‰Vå7ð4±‹@êÍËì„í¹íEXêºÄ¼&D!–‰Zv–¨¤”ŽšÀ~Ó/—Ô_g‡X…MŽ²V®?‘žùШ[òOÿnEõá( ®KÚ–\¬´X˜Ê» Šî\í£+)úP7À„Æ3ñ­ûoKèWY!!lÖÜûedú­Ý}÷ÖæjSzº¬Lꪃ‹³êú÷?tyÃXeo› ÅïÞûÎÛBw<¹E8 6„…,ª¬•'ú ÐkÇQûømMìcÇÃ_ìâiH©,)Õš”JÚ/Á¬™Ûðs•Çâ]Ì-ÆOœn¥Fo©y¼îáÅÉk‰Hqç_Œ%ÄÑhk_–vèÆÒ¡õB Ó6¤ÐÂ&Ò€¹ç v2ã) •o‹#­ÝwãùƒËJw¬EW&S’‘j³w¸‹bŽÖÇ{9¢¹a¿)ž>}GéîÛtW¾kPO[Þæ΃4 ôŠê@oâÖ[±~hÎ@m§¬ÊÅf+DÃÓÿÏ,÷ÒVCp"kŸçô!rý<†ºh0ŽºxóÅ[Ue.Ý€æëkh¦&þŠk'ãņn·a×óŽCúÂÜÛwWz9;qû —9BßúÕ¥V^öÁÍؾÑgo%ø¹P,]©2<qº~Û@ „k´}¾)ÅŸõÅ‚¼Y¶6ÎTKk#À ‘9¹[†—<~ÚÛœ¶9·bi¥‰SÎÛ#ŒZ$ÈE µ²J~$¬«×2yIXV|’ñ?“È×ËÌX'‹nmìã`Iì9Dê$bø¿)YÄ×-¯hÊê7öpÝÙ…öÝø#‚§ö5 #š|Þ†Œ2& Aƒ±€Ï HOÀkðÆ÷‡ õ†oÊœïé Z/H‰ 8².\>}ü“'ì èÁ>Á"û^²UJ½°t+Ù°¡°mHÄ{§sÔh^î öº»aÿ0~gúÆ+µÓÅÒÈ•Es{‰[­I CÞ½Í`Ê_ròñ4±ÂQ]\7Ü“Ëç i"}„;”iKÓ¶Ù² ªÉI{·gd_©±]ô¬™6:´€€ñö†ÌaË ªâ\Ä$ŽXP<– A„_UG^µaJ)•üªè>=røä×ròN-#RgÌ\—èØ€£Ï$„‹õÈ£§í+H=73xcÂX)É÷JöµìÔK…9 >=mí#ƒ­Ú¤°qÛ|º¶€„aY}åÚÅK—SsKö…³u]ÚbmÀtóŽJ;˜`¡ËY¿a­H·qS-¢r‡„®+È/8>o´ KW7„ŽlŒhÒÛr‹7Z$ƒ°t˜–r>/'ù€Ov¯ÀE¹é9yÅ…9Ó(ÔÀ…É1.0ܼêâ„ëYÁ_8ú`Ó óé™ùyùó¼œD£.\̹vñülg J¼Õò-©…ÙÙñ¾½Ù[@jyéÛ[’ŠÎêk@ê‘C7ç]¸–°7v¢"¸Æ»³ 3RG‹¥b’û…Íc¥º;áès3ý9jôÉ»ò³®žß°À^¸gÐù+…7NFÁêÏ€UÙ— ²Žnq# ¶‰@O¸å–<ÖÍêkYþx¦§®¶ÒgøúD¥§å^Nåd@©dêåÌk™ûœº"a‚l×ñŒ¬#í¡Ö,}Ï]λ°f†X›Ö*ºÏìwhâÔÄóÅÇæŒ@¬-ä/R3·Ú²mšTeÌž ð;{© *yžX‹&ÄÂëv§gdî˜0H¢C »£ ³ }Ë[]Òy®žý‰²"û.à—Qè¿RªØ Uà„JÚoŸÐäõ‚K¢–o¿!¢¦´QÒøìjûS§h¶±ñ¦€½f'ƒ_kð3u©Aöô4f£î¾ëµÞ¦¬VlÞøw»­ü¬´;¼'­l }åB>±·Ñ·†¨ i{¬ZBKiy´õ–1R%¯©­ALPºøXÍO+_|ª¦$ÖoÖT³*KJ ÙQpf~OomµÅÐE_ñkãõ¿ñ¶Å7Š¾RòéÓQPlÈ {:q°G“Ë®ùg[žÜê[@»^1»-¾fÚ¨üT*QeœhçŒCz躄aù÷ccþäþ\Ïêë79ÒËS€þyCûõ‹¿pKB¸öÎ8A¸­Œ?S “x@tH¨µÑí f°àŸfV•Ç¯­ÜS*wŸJ~!¤z´B€Ø;B ê¿&ã†ÊÓS)É¿ z+Hý-–¥ðL>†)úÃn:€¯Çü±9 ÔÒÜV­I©ä—A €t¨ûOsÒ¡}¶Öñt¾.]Dø}gZzm”„ =#OûÇð t©ün¾oƒ`hŠ ¿Ž¤?1B=ªbhÓÌìs#ÆÝ &üu+8:„îHÿ)ú÷S Èfñ½3$ß+#‚<ÚȬòÓOJØAõYÓÅ:Œßcbóuš¨Â:äÕ2ÜŸ3¨ ¥’öÍÝÇélÌêlÂèd†V‡×¡=ÉY‡&Ô6µh°ÑÌ|a~b,õ7c>긦ŒßzäVk%B kföëY|ý7´¼ žt4WŽÉêha©fÿçoÎ þ¯ [›´#Ô!!í0ÕÈJÅËS6«Nþ¢øŸÑŽsù°´N‘>(Ô6güfÌèd®Lé’™T £1£3FžM3úo¦MS2'DÞj!'÷5©8 ú‡§L3£’#¶c6?¡–9Sˆt‰­£¬E°ÔÍ‘Ë¡ÿϘ‡`í['3´·8*Q§WüŠ¨ƒ!ØFM(dÌO¡ÃŽG.“ø¹Y<þŸAü¾œ¡ ÔNä/ûÀÓ0æ»8š(–chØM˜IíË,!2ÔM 4 ‚$@‘dÒ1à@¾ZǾ'‰arGb»º‘K3C¾”Õ˜Ö à¨™2;šò±¨jå«™ _-Æ3˜)]Ò¤±‘:›£æ žÞÕÈÉôdä~cv45(JEÊ×£ÿŠØ‰¿R0–†\&[¶øYúd µ¯Ž&L5âˆLö›ª£1€f³d 4{ð¬lèAFžSd¸p†Ó—/UTmê&, ädSžÂe é ¯‘;Šˆ¶ƒ§™c ϲð]9:L¤Y°Sº³ìÓj ò 2;ê³ÐP^ôé4HÍž•¨äCŠ«ÎÝóH~%³äQMÑ !G¨MA å¤Ãœ¼©$5:ÐÎnÕÝÇ/Þ4Ô=¸ukŒDÌ7´Ù}±úéÓçÅ{W~‘ìŽ53³¡ðBFýÓG[ú92 Ý~]boÈdaÝ ß>vbMºU÷âý‡Wï×î×&p¦.:ùèiÝìã½MYC«iUH³×&ˆ[5k`‘VZÝðêÍÓ;÷Ÿ_š)ìH žwáñƒ'«s'ñØžé¸Zžº4·ìνKûÄ8îÊC×^ß+?|¢nY_G¡déžÜ'µõŇ×Xé3WnϨ­}õüþýúë»dš´öYØÅ3‡Æ§7¤'ݸùàÌÜÑB,S  ^(¸¶î`ÑãºÚX;¶“]TõÃ'ÏîMáqYfcjêëß|ýðþ³“³{·ÈtD`#Ù¦3•u/ê®îY`¡Ï²(åÒlÕƒ”ãx()·âåKdîÕgÅ´Ž>=óÉó‹ž¾‘/ð´FákàP‘—•”yëåýL3F»  ÿ&°¦Å­«ö gïî ‹1uë8êfÁónMfÅ{ò¤¡îáÃçeÇmõ~,`„tu>œsçé“gy 1è^6JàåOŸ>}¸1À“« ÆVÊ'"w,=Xþ|»µ.ÍÖ&âcÚŠó¹5Š/:ve9ÙO½^óøÙã;ËüzBÂ9kS×ÖW]ØëÖ¹V;çmÕÔ_V‡¥÷´±öɳK)%R'K°Œ!#×Ý}ôìIEÆ(GdÀ[¼=«öÙ³;ùg=ºÂ&&>|ôòÅÓÇOo\r3dq„ _6¼–WÏE,)ÚU$¿š|öÑãG;ûÙñ´hÃcÓ?|òøföD‹KòùYï.2¤]¼)Sé®°ñá®6;Ókž¿¨ËÚ%!A ¹Ï’÷Þ¼S{16 ³©T±Jþ8¤xÜUõþ$‡6öþ­£:äÃÉç'ξ²#ÐC€f+b²XK²/(²úX;Ì”_Šàª‘ņ¼¶ õvc€=ÔÃùîË«>ÚÝÇm¸ÊÚ XÿxÏ@ËdyP{Æ CCŒ KÖÄ‹ÓÑ:™ˆX³F YN–gŒçv&}Ù¬ – ìHΪgªÜ|$éÂájY¬ÈWc¥X†£_üûëK-јÀ‚5­hé¶0éôÛ%žV‚7œò2;²i¥§c>dìéY ™‡·ÛÂ/L½¹ÒÒ£îLÎ 3" 4´ÛU¾† ˆÀæëYœ}úr™%N|û`Ÿ5†ÆéÞïaCº.å ƒ‘æÝ{iù4Ož6yâŠòH@ôéÛkû@º”-DzGw! õH+v_ Å›·¹ê‡˜“}æßžï¡„”}UÎvHì:®tópwˆÐ>®‡ãùz —ìã‘֒лËû#2óúXˆ!{<gkËÇígIvýÖ¼NÎ×¢Iƒ³:ûáV®¤«¤¢:ó31:ÿíX>[H |sk½•ÍÆ"üãíÍvXºØ€#€i…Y} ™ÈeÙtµ‰9Ò“ÑÙÄÁfñžþ=!ýàÏsêËþÚZ½lœgáã.ÝYÞ‡žŸŸÈÓÈ<²1«™F¡—,‡{Ø×®æÿÏ\d$ †'ÕÒyßÖ!ý[éAä'³ƒÞÌB cX‘WÞ­ò–Á$ï—e«-´iÒ®\ž‰ÅªË›'Ã3Ù&AȳlnAÃG…ZÄ„£¹=QHÑÛ\2Þ èÔcîÖòs0`YæµXw¤_LvÔ¢¨BþTòcÚZüе;â{—ÔÛcÉûs 9îÉÖAÁÄæ Rn‰HçÅ9:óÂêh1¡Et™ÂÝ÷6Æ‚-À‹.Ö=mnædY0Õ}þæ´(š0cŠÜØgm°tKqô8\xìàƸõ›—¬šíèÈ%ˆç.;|>93=až„ðEJ@,uçé¬aÔyÈ×á-9\œ¼eëú„ÔúŠ ,ÝiÀòÚ žB 9Í®çýÃúqu(‘7–xJÃg]JOX¿)ný¦%+'ñx=bиÓQ,¡ Ÿ<´$5c„7nofÂ×Ï¥Ÿj1«`xW½*u5dpºö½ýæš›ÛÔ=†úEê'òàö8Šxz¤!‰[ÄýçžÎCXÚ‚m—6¨†¼rÏ•Qú$ßvècßØÏ*:ÇÖ¤Z ÊÛîÓ.0;öJÜD– V^\1ÉR4êîrŽ†Ù`¤ ,Å+àxœ½€ð­BNØÁhd³díñs§³O/˜xg«oN6#Šô¹)•c Ìc ZBÊ2üžA|… Ò•^½²—«…†ˆ°dŸÁÉ9»wnZŠÞo3,-•7@»S|=šrו²5R]à›4öîd+}@ìÿW†Ê7ßTÛdQ¶Ú±¥|+é&´ëÆât¤$fd[ë°Vf<ÜÑK éfQY}Ù£³ÙÄôw“Å<<úãíFHÕïäë2Ñ¥| ˜z5g@7PlÈ·îÎv¶‰.[4Ñ=ÄÖ]8Ê]í)å"TSÆZäí_ÝÇÆöʹwÝÁÑsøîç©ùúý‹/¶4`KºBöfXŸcgÌã©Ã¾œl%†q4kÇ]{Cûó³P2E¬!o f@šÈŒˆ™ñz¾56ëU_³C„÷¯z˜f‰£9ôMxU¶ ×dðýº4{|ãÖ{†ùÚ#¹.X:„§º±|jO°³IìÎÊ1æà ‡Ã*H©ä'!µ¥üÍÅ¢GMå°„Ú”¤¬<mª€6înÅY±“¯ ïÍ®­úxœL,ã.©~úêUýù¥E­ ¥ÇšsM~ýbÎÛú§«{Ù]ŠGîy”¾h„@¡ˆºœÙo¿lxwpr/˜À?ÿÄó—o^Þ+›bi%á\¯zúêu}ÚŠ)bBÉÕ{®}ýîÕ»¼hA'Jø¢ŒÇwïž=˜õþÁRÎÈ¡­Þ¤ÐRúܸ}EkoîÞykao{¾hÁμú—¯ŸU\h‚.`Ùò‡Ý¯«ÿX} ýÖ¤€! “ï;òüÅ»”9#‘«F u)ç<¤°¤óÊÁjÚíÚ/\›ÀBÓ: õØSwÞhxõþì<ŸVkR¡d]rÕë÷o®îŒ±ÐgÆ¿ŸxèYýûÔùá(˜ðÌ^>‹Þ6|¸¶¸Åš2‹Ð¶:ûðÝËòw /K’6ˆ *“V²5(ÖÁ¥ûÇõmKJ±&5yÑäWx˜½Ë³+6’îÍ}ôüÆå#nOŠ!`Ió«zRÿþö[E3Z„K±¹U™Ñy-À|ö)_ ° ž.9ÄW¬ì4Ý}*àZY­ºûüÕ«ºã³F¢¥‰.UÕ½|Q»Îßù¬¥xöÃçuIiògÛkRc? B-)Å+;Ë ÅwêÇû¹Aú‚é+SëÞÔ׆q‘Þ¶3¤šZûkÝ}"ÝÛwõƒ{÷3.ÝnÈš&Á2†®yXÿúõÓ{ë†õw³<“sïõ«e'V:¡AP’î®ù·ëÞÜÏíiÈ·æüë¯äòw¯ßÝ×4³H¾È”ÇÇÚýÖj䈸ÌÇwî&ïÏy{g£ž)ÔãÎ>x y–Mî)#Ü|\ÿA.¯¯­=4Ì—c`µõÂí×ï^g®›&!Áë sG¡º”›ÙK[µÃW%?êî»vßcÆèd®tƒ°ÕuxñtPMpÕMMÐ¥D#¦LØ:ô/2!|5–º9C|…Nïq‚=UÏ£Ÿ3 ´ÌÐУOÑ}Èkf'3tå«©Ymz›·1„¡0Ñø=4ñ‘P‡ÈìdÂÖ$2;“QèQ€ÆH94ÖƒÄ7ï`“öj’D+Š¹£ßÒ™(TfŠÀ1€N&ŒNÄv´¤‚âR¯²¿s>E÷±Õ‰ÍÌ@:òÌÎæM… ZæH—XmF÷iš1‘l’cOgqš‡EÁ*³£‰rZ “… NG SwEôÀR$aˆ\=fûF÷LAME_ôÎ1:¹ÚD¡b‰‡§C¦ÿ_7ÚofqøzhJpú‚¦Àý‹œ–iy‚UhæX=*íÿºQ:tãè*" qtŽºÐÉL݇FPƒMÙš$@íStŸV³¸<ôCNVF÷¡7ÔˆÊ$H5·Èš¿nÌ.ÒìÍíS2&æ "Ž¼;™2;›ñ…D‘Ñcv2En°OÉFe0$ŒÞ–ÈceŠü¾ÌŽfK aÊÇbS9¶. èlÆÑ"êUž…ÚæÈxrt‘É!T|z¿|MäòYj™³t…V!B*=¬’ƒ”&wíÅR—n`ûÞð4;îȳçàé0ÿ¬kD-©]gªß¿©K™éé1þ”}OÀ ècg„0¾]÷^á™gJ „~³_©Ìû§e µHðãÒ X-ƒè˜?¿ÔÕ^|2RM~Î6ÓCqu(M­)mO%ñ•NEå—6ü—y¨¾ ;U‚Y•üƒöI 1ôvÖ±Êf‘ Ëü3¯u5>¶Ì?-ØFôÕ/ȳñG›ýä"û÷$ph‹ A;mJjÇÀ‰f#@ÿô}Ê_ VTÀTÚ<]ª’DÍãÛ[õöËCÊ¿|9[PŽÒŸœZP)•ü‚ŒL¶Z£»O KÕÌÙZhbKÕÌ·ˆ <“«‰¾æê1¾ôË!¦½âL3º‘ù,¥nª“š<]0ŽÁRø[ÐÄ­*KÝ 9Š–¬Ò%+k"/PBKS…£nŽîÌÅ£n4!ÝÌ«ì¨ND> !í¨™³4)Š5 šÒ9cÈh±´Æ3ÕÌù8€¯EäaTMr¥­Oí¨ý¬#B¨GàþÒD¨Û“$øõ‚0ål\óá¥[ï—±‰ÎQ¸šÙÚŸké~æ†t2¦w4`ÛðjÂrÃp´ÛÌŽ«ØÛÛÉ´E³: F(š{Ûù¿ãº”š_9&0ü=ÖJó¾FœG¹Ué^þ4JŸI‡üÏÓ"²Ô‰\Ý6wÏ|mrT€ÚÊMÁähÙÈSÖü W¦é!Ï2‘£ó¹Ù¿uî>DKhRÛuìÍ6©MÝÆ… ®ª¾Ú˜…â鈆D#xñtt´ G£QM)4"…*Xt ù½¸ …ÆÓBšP›ØL¡ˆ>W´ƒ¨\´ì8W]©ÆÍÐfñí8—¦7©ß_ )ÔSdàvC.ŸeN„°ŒÉ±)rù‡»gVØcˆöÖ«ÞÊå?|Ëåúºóz¸&_«•Ë_Ð*pÒc„œ~§¨(ÏlÇÖ¥¹÷Š{úæýÛÇÅ“@ešn†{ø;yÝ0C3´ÆÀÕßÈ?<*ò5%GÌ>wÒ…ÇÕ¥Ž½œ7ÝS ÷™S}‹‚·ò½á^|‹ò·w†`»†ï@{ôñ£üÍÓ 7#ªß U rùóü=’%onÅâ‘€6ÅÖûÌÉñƒl]¦ËÑÎ#]zµ€Ã]sîæ^ÁîѬŒˆãÏ¿T´ƒ­ì‡%þˆƒÆ¤Ìå‹„։Ù[%{ÿþFtï˜>ÃqDN(”uáü’ÄDŠ4ãR9dl²mW®ÔÌö›©÷_E(®.Éñj¹üíöÞ|E E³/¥AÆ^^¿yTÐßäsÄã'g0`Äæ7rù¤Åv¸Vœ…8xñ1¤Ùw»Âú(ã7Pï"ž_QtÔº³™°»Gî½×ož˜ßåÔï7OZ8Ãu©Jioc“j͹óêý‹²SîxJ«E@{¹Ý‹·M±$¢Äx‹íWž|”×-öt‚Z&¨Gf°vü[ ï*Ïxwa4 ²CxfƲÁ0Œ4[º3Òß”úïo#<‰,æ¼òŒß­hÐæg¿¨òð¹öHŸs#«¨­ “ÞgJê>Êß%ÍAc« ’J_¼}w<,â[T²»…}”?ò3@âÔ[%GExnÎmTý"jª|ù#˜·»Ñi¹ “dxÚâ}EÇíhB=Ò椊éÆ”QGïRh5}1²rùk?c:Ïlàky‘ƒýÐ3űòêË›Åàk×Õ¼ŽCÛÕšùÊ•îb7åÉûuW÷»ái?ïŽû¤„xá+g2/Î43ç˜O*KÝ!ƒ>‘…çbü![Ö…ã$ûn¿B¡Ž‰J>;ÀF€a­;VæÛªž”cxÒ«X[¡*ºNª%;÷ôes¶Ô>î]õ:ŽÉÆ9'_M¿ó¼r˜¡©Ô¤WMr¼T‹È'¤ʘ§Á1˳ V…Á-C¬ú²Üg$®aéJ‹ë«c»…oz0]f%é“qØ:Î×ʲ»p¼Æe\Û!ãF_ µ)6^§#ÚºÎz}$X„çXtአ̵§ËvJQH¼X:Î4î\Ö+äê,ºpD?:¼0Ž¾hõÙ{÷_<ºQõ g»L‹둃Ã7ß(-?¿,VgÎÚŸ³g_ZÅ¥ã}õ)þ—@ ÒÂ'®Û¿ÿæ¥Ã;'[KÄ„_)ÞâíÉKŽíÚ2€Îùü{ˆEã;z÷ÃB=Þ©¬kîz”æ4äj‚qùï£íÅ66S>-‚ëXá×R¸=ºÙ–æ²Ã³†®¹{d¼w‹ôP¦oèö§[ƒ…ºÜÄÌ õ³é-Ýìч©.Ê}ë,µ¶ÿáZœX“üójZ?jåÁkçU<,2gæì*y6ˆÆu¼ãٙɰ­ù`Jˆ¾OR—ÁšôI{ŸÍ±·à7ÏAC×äÎõ–v·-)NqÔ¦6ÏÂ×l/©ΆzÚVŸ)U†mÂy·² ÌeDßÇé«dzà„½Ïö´SDNþM!…<­¢Øò[O_¿¬­*»1ÕAáè'ìRvùõó=º³úIHY_t­l©·KëÝ”x¦ØØýtÆõ™39 WK°zûé]I…%'Ö:é˜J…ófß4 ÍVÍp±„ª^jÄ)j¼NHÈÈc a€äÜ?]JdÒÓÃ!N–ô¾ÏËvXiRZBjÔ¹üÆïðÎÒ.Ͳ¦äÔr+jsÍÃÕ„N”ÜîcÆí=îl;pÑ/ƒŒ¡ôö_µ¥'œp¢Û|RÅ…m5bïI9(½X2‹io¯-–ê#fŸ>ã/ct¤­¿øb›%hf®¢E7U^¿{³2ÖAÆÓ¢Ž˜sfûÌÙ붞>l‹\òäŇã`^Á£Êa=¬Å‹óϤg\)ª,Lõ5£…GžÊ^uàqòbfÇÖö2bI忨9±ÿX4SxM ©ÍODÇÌ›9Ã߃,¸ynb°)³j2vI8-!å2ãMÎú¨‘1a\»kZAêlý¥„˜9aÓç$Ãüx”§£Aï ã‘$:é7sÏ”ºn«Nßdß…7!oû\…æüTGYŸ¹ÛÙ-{ïŒ9K.®äÒxz4'ÏùÖ÷ãjÓØÇʦNß}bvx͇›} ˆßŽåø’”a~ŠKúŸC(D˜]«æY“½pÈ´;µYÖxÚç1Ñ%Ù;n82`Ýþ£žNÛO…û(¤”‚Þüro¬ñ .Ýv0½d¹™÷!N÷Á5µ×Æ­ÉŽ™~·>ÏÑ)Ôç]ª òâÛ;l¸0&(áà©ÞN;ÎN äþÍ!…ºû¢‹ÓPEg::Ny±gO‡Ñ¸çqIjfˆÆÑ–îËXÅ¡4/‡ŠLæ{úx}ÿúžÙ“¬#B:•™! áÐâüD´YzTiæ¦Ïž4Ô¢g*«—ö¹çÉ™…~Ö¡å×Rm0‚¬Ú±!s Ö†æ>¨ëÞR%™{œ‡^™=$®\©‚Š¼0‘;¢¦\zЃ&]Úç*åé‘û :pið:úðBÌäÌA2{Æ¡µ%U~o8¢ë¬ûø°Ä-LR’Ð{+ú³ÕL‡Ì¼>žûLB eñ R‚Š¼-N²éOvúí¨ØéÈl)–IxUÉÙ±[‹§ö›[S•,ÕÿU˜y/›6Ù´yÙeO͘bm„n¦@æ‡6c²2V† éŒ4à Wó-Ñ”h,SÄîÐ5.©:¨{ wá IF“žoŸ“`ûÝ}qÝK¥ ©}]hÏ ŽŸ»lÖÒû/Ÿî eŽ­^BëlnátðÔè~#¦>b϶è¹îiÁN¨-HâÈK.<ô¡:Páî› ‰ùX&2 d­Î;jÑØVÛoœŽ3¦\Ÿ;”¦n.íuö@¨ŸÛ¬W°Õ)|]4wÍòS%»aSŽùÁôë#0æãÎ5¬ï ñti|]úϸ&H†žÍ¢kRXfÿ†9!ÝãiQ¸Zœ5åoélÀ¨ïƒwE®úôo>> È€#5âH ”Þ`Plˆ¾U”_ÿN %2=[[2Dð—Õ(T¤wë&°ô?Ãׇ"€{:'˜Cë`¸îTi°> ]!B—õQÍÏÖ†NÔ 27cšø~xyÂFu÷Áúl‡.Wq~•g×;t— º|aq¨P‘ Û¢+Oá·d„EŸ*)Dš]‘X6ÜÂU3‰?×߈ÊÇ08ÚÂcuò’У÷û—§lµ¿©V¡øMùÕÛ1âw  a}ùÉ+=3&NÃÍÍ M9&b0-€15k‡›u0t›p}MÒ%tÏ2³b ò éÆ1/GƒtñúÕþTEH ¹FlÔW c{±ö‰“>™-ˆzsg»ž)±œù"ož)&0­€1·6…“;twW²9ÀS€WÆÕü}!ÅfÎ-N[£œBXËÆȳ§óÕ(B=ªÇ¼èBù|{¡Žù†“…Qæ_L˜5LefÖ!÷Öàtž/-iÑéÄ镹»Ñfé³K3Ö‹>¯X².\ô[p4äî]ËèÊ×2^}¤l ƒ±¹òÕR)™…î?¹ÔK‡ØR9a»´Ã9×2÷#**MsÑ ¢/–Ú×oSñh;f§3ŠVY‹£¶d%ZšóµLÖ'GB ó ­g›÷þ…OW «‡Ãû+¶è‡¯WX"7§.º§¾…ºS@êîr¤f¡òš¸¯|Š…@ÓlGR¾RŽRRýPH9µ„”ŽKÞ­bH‹Ä¶Y÷('^üË,)¤“Ƚ*Ô%nK©˜eb*ԥϊ޵~ÉŽG·¯†˜£¯õ€Så‡f+Cò$ ß±õëwìË«L\ÕJ± â]‰'¶Æ.OJ«<ê¨qWž¯9¶dÑö#…›Ã%¨Wœ! Jêo Ó7BŠKwÍ^”^ù` Ÿ=föù“®<ŽºyÔÞªC…Ø×><Þ͸WÏÄ‚ Äv³ýY¤X‚ôVT¿Z~¬ôÄâÅ7k–¹Ä]ms‹ò6EÅ](¹;A;õœ%/?¸2jéÚyKîÛMwòŽ-Ÿ»¥"m»Tƒ>!í͵k×D/[7?Ö£ í'Ý4w·…%»–Í8PŒaðº Ê/,X59zßÖe¶é«oÊów®Ù´ëJÁ‚>æ—ä#ÚûF÷5­ªü9Fr­Ÿ†ÔÜ¿¶|þþëÉë¹:¨‰ä;r»üI‚X›"Ð!9IÌ?¼yûÁ¬¤`KŽ«ÍJx(ß7Ê 5¸t(›“ŠcÝ«ÏCŸžžãymEÖD˜=¼æÁõ•ó÷•¤láéÐAÊ”¢Ô J_¢@‡l?èHAⶭû2N·akÓ¿]öÏ)Sõ{ãáµÌ§§¥',=y¹d»Á%K›(—Ï”JЫÓ\(.ß5weùÝëÞ&t4ò¤{_¹<Ͼ“)ªW­æÕT^Y¾ôäÕ‘tû-¾.ÿ]n´ "LK»¼qʼn‹%{}ˆM±`ËÅ% "(ʇ ϕ￪ü^©?üûN° Þ™å%³‡OìMã ðâmw“â­X°6ˆÈ47©¡âÒÒiÊ.l·L, Ô¡]x–¨=˜ùøœ ÃKvv5ÿnÕjxšœ wåü§ Âgœø2ïA“™ üã—aiÿ¡cÃoÓ®«^\[øGƒ·*ß|Sí?m”ÚÞÝæ†/ôfënÛ‹.úvÉ°äf^ í®|ž`kÌo•Fy-톎§T™ù!J˜ýåUË 5R«LŸ5¹!þãÁ~hU®ewÔ¶n“9.ùñÎ^_-Œ(À2-ºq…¿C“ó5̇-¯òø\íÍ’j7‚(vE}­Lü UJçç§ÊÈt¤TòSR72§T]^:~î±ãÛí:Q×]}àˆ3£ýfÊÇ¡gr5LéÿëÁT#A … tìw!] SƒÌü­ AiÊC÷Œ¹}ýئE“æÆMrÙ‡­)9·rÑó×/DØ‚]ÇÜ¿•;'bþ¥›6öwßq_>„€M AUÕy ©Åú7ò·1T´ûæ´›—c"—,8ô { ¬#¹öþõžésŽ¥T täbZÒ%ûÍ,šncV˜Â3us £1S¬¬-ÂS\ K‹†¼ê½½Wíuý)=sºÓΘ«L8\G 9ÙÔ¤‰pT@Mio2ÀÎæ­±ˆ£Ãðê7òw‹HoA¶‘Of̓ÍÓæìܵ{ žÈ%Ž.+»º|BôÑã»\:ã*ä{çÇ.ž `qä½;¹±Q{ËŽ¯àþ?{ßÕDö¾í®¤6zH™ô2É$¡7ADD±¨XÖ‚½¯½7P±÷^°cTDéUÄÞ•&Õ’o&""ëîïûÇs'!3wîÜ™û>÷mÏ‹cÕGg¶ ½1§ƒÐÎ T>2ƾMF;3­ž@8íM™íÌDD¶œ9°*/X¢Eá¶7â)‹±ò:ÓÚtŸ#,f™mH+öÜÖ–DùÃBYdœ´éBkÓ•ó=9ß}yÓ¬ÐûS]:1Áúø5éÂË=.–p?\=†˜@g´1)éYmº qT -Ûw_emˆ@|¢Pׂަ ~ý”Çð´LàáÁo£²âÊ: k] K‡ñ³¶¾ï‘ö´|€¹¥êü}ÿ7cüjL~Ê‘«i-)v;úú»Š•.bxw*бèpwäU_ }Sðr§»HŒe…º““”v/+~—‚'_+-ºçŽhR,O¿õŠ;§#.'Ý‹9bE®ÇƒT¯ÅÿÕhoÆê`É!yÝ+élpiÅ×eÆãó¢vÑÚš{ü™ºiô¸3%£8ÝóŸüºÈÞØÀûƒ>ùâÇÅ!ÑúJº¿‰Ñ‘­ÃÍxšå‰3*ß11Ü*Êbܼüœućâ~¦Èðä&ÞoŸÜ‹ÆlƆÜ9 ¾˜ø ¤jÌ}[>D…AJ¬K|¢p:$+YÁ%z–»Î¥÷3`ú†d]Ÿá¬¦Åˆ:vË/Kë¦ß;-?ÆFØréÁiû½R¬/+©ZÀ¢Ö¢ {í½š)©Èß"mϹœ›m¯Ïë?1¢0)9 jÑö¤½t3T/ ‘Û/fí÷ò/‰_¶ýXÊZUÕi(ÒåmÊÿZ<Ë^þH´‚8‹þCO†{õº•tyˆï‰ã}¹¸z 5áìëK“E$^âóü@B§>só×ôr´u™SrbˆCçwêñº2¡›®H óÆ%îXÈÅ3Ænl_(´ìSžºB¬M× y÷#Ÿ¿˜anÖ|xj¢œÄo©º«£SñëYÃÿKU;'šÀ Mûbj 㫾Neµ ÅÝ‘ñÖØ+”¬,N[âo&¥¬=iê‚ä¸-A0 Õ©kŸ/qbÌmË 0jR‹Ÿž>Ъ‹È¦3Ÿg:úmq†SGÏ(àuyžÙøü˜CPg«£w߬³c8Ú† 6æã]!§‚ü­f)¾¼LM+-}äÞ‘½çÆýÝR†“tVΙµ,œ5 Râίª_ ëLiR~o+’]õk@*ÿÀ.†.ã.Š_8lrøa{¡o9jjÄN‘ˆ@ïß۱H‡’[=˜Á¯ 20(hÆDû9‰új¾-« Å—W鱩Åe¯¼Œ8kÏäFz²j@Š,Ž|_½d|©ìOcÄRxN:ñ`Mêâ“Ûæ¯]16ÈËq·}¤€MáY‡í„ÖÖ»Ïg/´°T©Ð»• .ŸìšSý܃,¿˜œ·nüÔɳ®æ_Z Õw¸cÃ’¢>) eõ³¸[©ûÜ9",eÇÙ̽ÃFOó š:xŒ1ª€H`HÍ)Ι¼§‹h¦qÿ¬mãÇÌšG„)¤ð4±|Oêé]“M÷7Ræ$ p† ^rêdÜ“„ Ρ‡‚ÔL ósÉþs¤…ß©:œR†\þŸÐ§jn³†{–‘)Ÿ”¦µ¤¸í-†m{vyÑ›NÂ^V=¥Úì‚V§.YÎM>¾š©M±éþíMãÄ$¯­Ñ®s ŽÚX¼ µ´):1ÙG¬ü#_W~ùUE WÒÝwWUæQ—ñùÑû–Èn÷ýˆ©å°÷ŠÒ1fªK×{9Ÿ±ßÅÚΘ?eÁ•Ý6Â1÷w€–‘q.)¦¥8£òC•Ù·×ÂwÖÉuê …µŽüPXkîó*zuÉD83íP ——oèË {ý™'ã(<1‰áÝ;äÆH7)¢ b©ân¡"F t¨ðçÀ{;ý{Cd¾è"#³…>¦<Þ5…£[ßG¤Žš|îp{[#þ˜i—¸H•$­ïÖUà&ps$1®½›°e’m'§¬§\øR"Ô܇$5¡ßÕ¤`(ôŸñbG€¼£mBÆîHñAN=Mêbµ‡£\<µòÝY©Ñøœ;G¸Ú …±.Ì“é óRÇ2„²Î²î–Œ9 *g%‹Ð/¯à¾›!=hõÕÔÙ}¤D–› »=‘ëD«öÜZ@¡p04ØóºËñVN Ñ£„ºÇìÕo–W*R « Рñ¯,„tÙÁQþb U@4©Ó/Ö‘t²¹ÿüŽÎLLâÄ$Äݾv ຽøœã3åcéCß¼ëG ˜2c[ºTl èi)bµ1]tµdƒÖ˜ûb醧ÁÚ““ã¬x|϶Û˜ ˜s¥ò“¢âuÊ&â²Ôå„ä|Ýèã"Týƒw˜ɡ·‘¹]5ªÏþ X“.<»{î²âkõ¦^Î|<:è³"%/lz _™øU¡ÈÚ5HL|ü6Á*}¾´§³ØÄ9>·~Ùîl›!#ÂJÊÖ?7x$ Ãh:Ó°Âão«üÛ(ZýÿªR)Y¶q-)ºÆܧi­‘'…è< _qgˆtD’<]ä+òÆR„£ x3&|Ú„D`ðñˆf⨠S«$xªÏR±Y1ùð‰‚ed&_^›u…œËÇБkéRÄ$¶H ƃõ€§ÇéQÑ8Cˆ@‡G(ÀX*‡J‡M悱ɸ{Ä’¿X1÷íIÿÓ¹/etz›‚ºÀ92î V:”—¶Dï‹«c)QF’Ã×E†vòHùXÐÏ„Ù0èž.ôÞ!2ZåÓ‘®tièÁ ŽV7·ð ÖL † «oð½C zkü¾àÁëÁ#´Õ©¨5÷U 6£q1TtK Æ!Œ¯Kbáñ ¹Qð…øð¯$ŒÎ|=$LˆµäÂÈ,¾Ž³½)K‹Ö8˜hìf,-*"rõ(ðg¶–ªñ:{UÇ»“, ðê"sué`ßt,8:ȯ|Bf+ıŽ¤¿X+²¬;R¤<—ƒAÎa©Ê‹š p*qµÍYH·Hà<9§]ΊME”ý¤þ¹4Ûf‚zõßÉ”þÛ®R§-¢‘*¨OPRš¦aœPK•âé1D¡®nŒæcY¿Ô!ŒPzòÓÙÏö °ÙÿÁû±¼yÇoûRêGW"!̦¥t¬F©~F Ñÿ0&¬ë[Ÿµ‡Õ±åW^[4Œ«Ó@ÇL„ÊÞ:zf4ÿ‡øÉ›¦±mH“ŽŽ¤aéÛÖÅ”†Ùpõ­Ž@£IsÍ,.¯VйÑG Àj@JÓ4 õ=’ÕVvëuõK46¼æ² ×¨½µüuª2³¡pûžÐ«S êZ Y…ïÇN™ºjõ߯Ë@¡NB¢ü±ÒïT†m4¨ïŸP.š R Ë"Ãÿ£ˆŽM9{ß!øk¹Ìè ë’má ¡ ziÕ稂Dßò»kŒ´µ(N~ÝÁ ç_SªCÓþIbC`Áì•ÄR£M“êÿ@bKˆœa `s¿Ë2DXí,ZÆAÄ×6•ÃûeÄBˆ-ü{èó “ Ð±ÉOüÔzøí#ƒÐdÞfZŸ”ÊKÕi¢êè¯Ã‚ºŸÐ¦JÜZ7¤¼¥ˆÈn±ò"DEåwH¶ÑëÖmÍÇUÍîß)5T­›Ìº¨õïÑ·6dQ|sFž;P®r-5@G¾Âÿ©|ÝÓäȨ½N-÷—*ÿ¢æDSÝ MŸÉno)&±ÐñCxÆ´éë‘4 ¥iÿwŸ˜À@œžxx9p$Xzøõx7,C‚ØX‰Éâ„fG¬â¥#†-!(Ã’k+“Ö51;?©r±œ-B$³Ð‘þ‘,–Ñð²¯q¶XªÒ†Æ†{V†7£hXÛ-A½[)¼X°”ãqÙ#õŒDJ‡DTžˆ¯QÞÔY5çÂý >}þ_A‡|UŽal뙟»„-à㘭ÈסŽcX ×Æì‰ LôºHÀY96t*È,NçþåŠdG]‹Æ ‰5£E¦\¿[xô̶ÍO0âaãiNn‹sAD> –Y,©~smPªŸÑƒ:cŠ¨ûO©ï°ùß&I)îHÈdB8‹^WC—åÏ»ê¶ý¨–Q¯þ;É™‚'¤È}!îñ`"wU;$6zruä¥B>KÈJ5 GèQXzëÖ(i¾Oª™;xÐIPãÍh6H1øzT‰ãú¢Ø™rd¢¤U,ôÅ€KÝWˆ@µî~îÈÈþ<<:],±±óÆñ}eÈNyýà[èÑ8¥Î¥r"<±lãðZ¶ÃÑ$ˆÓñbúÍr¬)ÄÍê`/Àš×˜¨º:4MÓ~¤„þÖ„W‘‰OKÜ`H+AÊUÞ{ÚõØ5#]÷”}úòåsuåÇ’©¶r!A¸hoZyuuæ5êr©;å7ÏFW=ŸÅ±†åÞ»doÀâëÙœ»—ßM0¯D¡øúõse•"|N/Xèõ Üù¾òóÃóëõáÕ'\°+¹¼úSö‘™Z·mSÞ}ùü¥ª¢J‘½LÜžâ7íì‡âò‚¬KÞúH(E·~+m—ü´ø}B˜”Èž¼òê—ÂûëV§-éé(³G/Š,­ú¿~*Dfî:“ó©êsuE…âÕYkFëìôÈlÿ…§ïî?TPTºXÉ}æœ:ujÁÞœª¯¥Ëì¹Vý³^•æ]ó6`p)Ó‹j'!fµÚÄDþÌM·+¾–G. ”‘YƒÿËÛwàmÑÇC£|„ÒØ_>}©*¯TÜ[iÓë¡$Î|nè³òÂws]lð5tŒ9v1»¤8åpwF‹¥%ŒõõÀKŸí7jwÉçʼ°Åvº42w¥/¬ÜùOO˜È.ßžT Ïme¥¢ ÆÇTÇú@œÿRKÓÊÕ¬<–]^YugÃßb2Gˆ· »õª¼øÙl¹µÇóf¼€'¦ ~“j‡g8X~¼cüåôw%â\ºpAŠïµì÷U%/–öp€‘}à„#EUŸ³/•¿-ýgÛ7hÆ3¤*“_§þü§T{ñä·Å•—%¼»ƒËÍeÖÓâªwIa^†4©>o̼ðÒOŸ^%†÷èh9yÞµÊÊÏŸª*¿~ÈôèÈåC¡ ÅçâØY2x GäNxQññÍB±X„c ™y®°¤¼ ý|}:Xðm-ÿÝKÚQœšS\ý2ÖÑñá[ÎßRñåãÙé~ðòô_q9cû–÷eÇFú ÑPš¦i? R:‚Ã/?Mãr@ë•EåzÔ³W®ñMÜ=ÏZ o·(” '–1Û›Áúˆ­ã=[Nn»òf ]0xÑå÷sxí¨çc“‘©ÜvƒÆjudjÑ¡©×êê±èÙÊ^öJr~ò"Ö]ÇxpèÛCº5ߨ¦UÕ«Çk%†žî„w3àNØõ:l¬—ƒ|ìËÐA|móaós§2ŽQ·¾gWʤŒTéÏTl(çë _°jÓk£"a†@‹Þ‹ç ‘yŸ{=ÙÓšêýîáEÇv´%iÕ“E<1= êÙN¤¬Ç}-IdÂYÃJŤ¼ÖVÆŽÞ|;á¸Ü-“8m:÷uvc'>ø§“y[¼7ÔèŒ8Ú¾g¬kŒÍµ×EþTÁ¤õ·>\›Üâ¯_´ÇšËí6Ý>¼2v*}xDú‡©ßÛ±3W¬g ÚÙ5Гނ(¤$:—2¨*} Ë„Ü9ñÕÇÿrP~ÊX%Õfx ‹ÎܦÇÖÑSäDº%y ¼–¡vÆ ÞUrÚtÚx*Å)VŸþŠŽN–à¹Gb_süCn==ÄÑâ¦%_²Ó¡kl€šÖ2ڟ󶇗Kîs·0Û‰@=–ø¥ºðÍÊnö ¢°³ùüà¤3k”)QlQ× ¯K2¢.,÷é‰Ö¿¨oî«^fËɲø’wAf¦=Ý×G¸ÌÞ½WBGbÎ͆¿)¼ê@ "Í¥ç©òŠÅŠŠß\Ÿ4˜ÝÑíÖË’Ì+Wúzªu‹Ô8ug$as•à™Ã¦žy_X\T\]’·Í†¸ -Ú×GL`Á‡9õ8~j´/Kë=ïq°—Õ¸¹·>—€[aÁIHˆ¥ Ÿµ+[q¥ÙÃcFA  KØ* ‰0œë·"ĺˆIŠgØçAÅ=÷ŽLAßU™î† qÿ·å±.z›!mèèãÇݤBœ¥ÿ_ö¸H-‹J#•«ÄïÑ%ê¦c·ÇXJ¼Oï·òùJ¯Ê:ÂÃÐ톤ê+Ñoá)ÕgJ¸+n¯ŸÁ'0%â-q¡Óm¥5 5T R"­·ÿ…g'Pÿ'ˆÇu»«ÊdQßô÷“.†Ï÷pƒ DWž<™eA‘ ¢äX,I¯R¶A姇Š°ˆØ”àäé ÇEº,ÄdŠµèíwécIIч¢¢÷o/ú»£ô¹­RA¾Aª9A ª8Õ š…É2ÿòå;¶Ü5´øæ P°¡RQ¼ÿ>¤ïY+ÒÝzöôöµãüm 8Rþû‰ýÃû×>2Ž?°º¤*—Ûñ!³ž%ÏÛkSgœC]aÖfd-ÂkÙ±¦4G¢GÝ®)}ÂÜ‹‡í Áhüœ«[e|¿Ðĸ‘Dd\‹é©GÕ€”¦µP“zTäeÌe™Žyûᆎ~#Ñ«‹ý³9C;[ ‰E¼uI§W‹Ñ²D€çØu–ÍsmR‰ŸÖ÷’ lT>ô3´”š¹¿Kßs>\†¤çp”/v”=‘Á«Zž2ß¡MêY ðL´[ÛÎЛÜ ©#QwFàÌPó΃~Ht1d‚Ö‹«mG@jpèûí½"1lÅ«ç¨Ã| ö²6áÄÕÞŽ.C k)‚—@ œ|e[¶¢yÖ¤VÇ©¡+"J2nœ=t-ëÌË„A*>ùºD©IIðŒS.¥Fž¿q+óäP{ ‘-"ʦDî;¼Ôש^õ(}¶Œâ™|/÷ÒшÜäË.ØC+ͼ‰t{~³²Š0bڱǑÇ–Œ€°LÕˆðТÕ{Φ|¹súȆÉ㤆."6ñthöy'¦ôkM Þx“ù#Òo„¾û8{¼€/5uÍxqpiHtvÙL±LBf:AÓÄ]>¶f-ÒT"­jôr“ãÔmjüÙðS‡£ÃB!"ÇÞcC^vBøé[·ƒÇŠtéîCÃï„ݶ%RQtÀÇpt˜üõìpD“R¢jà¤#÷ã"O>¿r`oQG«‹ ׎œˆ85Y(ÔºÛ~¤êK~SRÕ8P>aÍͳ›¶žºò¬+9Ôót@] _—Š©D% ‰¿0¶x£¿tÄXK®¶…ÇB"Ùðtø3WÇRLRë¶Ñ:r0†¡Ôh\Š@ÊSrV@¯&{¹¨ŒÄ`·5º«`~79,ùÅ8ªòDj-GB ÁÑ¡µ¢OjxHÌí¡|Ž¶EmÜ[ KS¥ÝP’ZPëÌtè^‹Æ(&Ÿ°H0dÀʨ¤@!G«®[%‡¶Ãhx¢¾Gm V{S¾2©îA©†ÐDv+ÊF ®dÒ¯“>DM„p vª6i“Üãè‡ïEn«gÜ™J¾„vu žËšÀBäµ`é<]e˜üaUühd§ƒ)«½Ë@ù1àùau0â¿£J2W qê_©úvÔo MH 8 €çD¨Gåë1á9¯Û ¨Œ&*9Lw¯v¶‘ùÄP•ôb´ZnK±>W¬gYCW¢œ[~ôp·8ú™:BÏ"Ä#~(~í‰Bä1!Á~Ô6]„Êø[ –*@Žát©Ö´”@[pìi™‡1·u«¨ uE»ïU¾:³À Çøm)®Ráéë ß¾É<ºØ^Ÿù;ê“Y#¶$fŽ‘´ræ/™5|]lîx©¤ÙÝ*ÀüwefÓ¹´j:Ô÷àExF½˜–^±QR+tþ‹šÔï·õ5ÌËV¥ã@ß–ÿ‡ÈÆ MkÍ<)~SIë³+°yíŒÙÆï¼GÄi¥e ´5á(II‘®×ú9 b]ÊOvÛ,Ɖ¥©4ŠPÈ®¦–Au秒v›fêCs“›yø;3¤~YŸR–5i |o¥¦±ìiš†IÓ(’ÿUMJ•rå.h~øŸjŒzóÕÐ,ëܯúAÿµaEÆÿ) dí>ARš¦)MS×"ÿ-?~ó d¨¦î6Ô³~ÈnÚü‹ªGO¼ýEÖÙÿÂôÖq«bú¿>0 º¦i@JÓ‚T1øª©ACƒ[3mnuvŸ².Ö‡9Vó¸Zq0¿ÇšÚô k@JÓ4 ¥iÿsßÓ'¥×'k@õÓ”­OPÁÛLA¤,À×ÐfØZ õŸrH©TëêQÿ¶~§ñIiš¤4í¤ÔÔ¨†± ¨‚¨’øS†¾†œçßS|Z¬Iµe_k™æjÈÏk ›šÀ MÓ€”¦ýÍ}™ùŸU£T‘m‹lãµÈ•&»ˆñ†¥o›è§ÅšT‹CU›´ vñ§6ÿžR#d4MRšö?8ñ½Ê}jÕ{Õþ®VeéW"ÏÕ£Z¤~ª†:*ÕB]uXÜŠfCÕL´ÿHi|Rš¦)MûïN´¬ªl jÝ~/Z½tHׂè¾èwMÏ@«Ä9¨rzüÊj@JÓ4 ¥iÿßû¤¤ßgêþGÝ=uÚJó!¯ õ³éQu³ñml 4JT×ûÿ”j@ã¿RšÀ MÓ€”¦ýÇ'Z†P¿Â5TÃþÑÀÖ×to?R-ŽI¨ËDFì{ ¡å³¡îg'¦VQE5šö?J‹Ä×6ÿ¯‘Còt(?0)©\™mM8zߨ™ Àì@ƒþ?5÷IH?))‘ÆÖ¤ÿ0B5³Öùc$8*Çn©­©j냰<»a¢1ø3ZW‘ð×I¢emª &ù¹¨ûÚ{o•<)4A¸®µ ºC„×ì„5í—@ "1ÙîC}|6"-ÎþGåž&ß#˜e‹u-÷_JéNüam XHò{˽ýl{ÚpÄdQ_«žrø¥ý宎‚^Ž>~¶}üì}ìzXûÙøø;ô(q±ÒgÙS½L‘ÅëÈèÞ­ßÇÖ×ß¾ï Û¾þŽ¾¾|Hª d¶'8.Ʊš‚2àÛoÍë×eé+'òhl9s`uör©îO2 "ò_Ð×®·ƒ²¨™ u±`ëãgãagˆðœ[™9 ¶÷$ëfEb;ò=ýíá[óâÔˆÈt…¼áÏþ¶^®]9¶Üžu“0Ä®§•>»nJ9ÐIì-÷âÐǃ"„¿vç{ ':øøÙ÷rÐgIôE}¬¼ýí{wëÂm´îaó'86^»¿$Ï”GìÀàÕGênKfµL²9ñ{õaÉat°¦8°ñdÕÃFŸ¢É;8¦‡¬·³!S„ct{²õìÐ×­#$0ìh.ƒí½½™_ŸBŸ=pÎÙg³m%¤ï j/ÈÝŽÌ’ê×8eêKþo ¼ðì>%ùÌdOµ:ÅÍ'˜ý¡{ë§& XSת5 6ßø© Rè)"| uRUE¯Åq,Ÿ”¦ýHi™AâÕor®Mí=úÀñýÎè;2Þ¸R9:–h©PYPƒ§KWì`óu,DDDÂ#’º žŽËPãý†LßÕ÷Ò¯þ{á™w‡GÏûeÏ\;³ø´‰%%7<­Oö ÜŸ÷usPÐä>ýmŒ=Þe ìxèvÙÉá=§†ÇõX‹i«S×ðÁ€Þ͘²YqÇ„ÞÊåj ‘XÝ&%Ÿ›Õ -,е`(\ ù Ë <_!˜…õ&1eFôò‰|e)‰ß#zS5Ö!,R5ƒ«Zd&O­ÈÆèPÔP¾S.sA™¢ì‚»HHdƒïVš4nÎŒõA4Ç8àáÇ÷+Ù¸ËDUr3xʤ~£§øúYëÁ¹Šàás—ž«xá%óÜgÄölÅþ™'y¶V)RûtŸ>xÙ´1›Þ¾ÏëÞ…ÓËjàä~£'zÊ΋wÂã>IÙ9'pàªi›äµÂ¾l!†OK‹¢ÂÈ}Áš¦[£1¡åxD…´öØR3)¡UYjŠ#Òƒ¶a©ËÜ~”ÒçÏŽ<=ïB:H)1ù‡r‰#3²Oºý,íðJ>ž85xUà˜yóOœÍÕ¢#¶,¯U_‡ðXœ?-w¦½›ÞoÔDß‘žiR÷û÷os|åùÇy2N=«—>»ÿ´cw'Ë8Z!)e(ÔUŽYY%0C½–ÒïOCx´ˆz‚§³;˜²:X•:”P—¢< ª9ºyZ„cKÕÝXÿB/Œª?Ô4›O¥v<ú Œ~(d7Ôò¾Ç]¯)Mû‡@ŠÝØùX±Ä^" ™&Ðáî¼ÿ5êÐñäÜ'güåb=ÖÚÝWÏï?ž‘5ÏF ×ÌÙøàI®R“by Qä]Þ±ú`Æí‹6äzÕ A}›äêÊ TKQ'Ç·ŸöÑwË/}‚‚TqqŒ‰!Ô²œûi´¹®•iςؼöBã‰oNõ:Û µ*e _ $6Ò1_& ´é[M]’Eaß/dSa¬bd ¥_άÛrùVNp©ÔP|66#:,<ïAª^tL‰åÌ:Q‡ÝIñtµÃ@Ô±N½£oeDlúFô?-„öÚ¬O>SKžôU1„ÂêP'^û:Ë^ë©è@€eÛ/ºV4œ&“XbƒÏY•x`)ŸÀ]óñ@o›ìTü Ì^Y¨NËhK®•*·n½p#}{_+©>¸ç`乧’2Óÿâó%úಃ©©—Â/?3 Ë=¶]Ÿdç°$ýÆ)¯NL[·UIq×ωHÝ=$Ølܸ÷eÑë³ÁÛöLõ†°Ô‰‹"cO?öÊ"þ¶åb=`ê愽é§ÖðñŒ&Ì?:q»ô*ÎÜ!î@‰Ò›G–Ï]t3X R»î}9¹í@È°~<- nJ žÂС½ã¯­-ÖWƒúl߉û˲cψ̉>bMâ}P¸^Êð#=ŸË”lX¿ëiÁësÁÛöÏè'Ô29ût̉S‘Ñac»ƒ8zèÁØëGÂ.†GŒ¢ÂÒ•#%Rw¹3¶3²õR±¼± ¡~V7Q³˜©ž®ÂÑBœB_€†.eÆ\K"1”úÐÄHš ÓšÀ MûEbb Œ/ÕA–5…ù„ÚÜÝw‹<8Bë5%I‹ä$¦ÜHÞ[èê·yŒ„Œ˜ûö^¸ã¦©ž‚‹vx ´L—ìÈÜ•£ªq€]Ý^}~îß…*6´I«(ý‹Ò]¤õ™ †>'îÓP ÷ƒÔÛ¤í=î«N¿‰ã=|ÊYU‚7Éöò±_§ˆt†7"éh•Wœç¯OAA*>;^¢ÇdSg]Ù"¦çajSƆýÕ_DªRJs߀ŠÌ¥R]DdõßöædP‘%Ò£‹q–~ ²ÙÛ¸Ýñj“§˜ ª»ÁŸy×2nÄñcŠ_îb>,(˜E™ñôA„·ÐÞ_õdÚˆlÏî»aý©¢’‚iR·—ÌX¾;n¯€€Ts4šj%ªajs­8Ì7W«U¦T3vQIÍ _ôg¨:›gãAù1šŸ ÀjÌ}šÖrâ¶7ï¿$+aëL‡®â!}‡Yi³T@j¹Èlfzø:j[ꌣÏnm'&¬6wœ½mÛÖ„‡cx µ´qøÁ)_uwµ›ªx¼_ÚVõ¾jOÒÝ{û§ü­Ö°ØQ©ØÜötD¶“þÃv¼Ùhm Úñl¬WLn¤H‚­9…«!ä\ÄÜWònKÐgBLÖÁ©RÓ¯c÷Ø93Øäã*&3%Æ™‡–+ ²s@= ǸWEÚVÓj‘ͱ6šÕõ½8Š:Þ U.)ø³Hý0´¯ÎüŸ‹òG©”újÊäø³öCOJÓ~5º,Ü_]Y–wb‰¬=zã^#®\ôäúBŽ¶hGréë'ç]¿¸f”5cØë²O% +*ÊOïãÒgiÎÆüïà8¿úæ>Xõ]¯ç¾/}•5œ‹e†£dÊ£÷¥…y×ý»Ð D#£O¿øv¤„AJnâ~ÿÂBN d(øxvŧòÈÅ)‚m|9Ôe6ÆƲês1bU€D RñÙç²ËŠSÃ<‰ˆ…aÔ¬Óå_*3÷ϱ!H°™½îX¶¢8¯¯7hý•¯eÞ—~U|˜cN‘àéS—EVV–çk…c@$ö íOo®ª5!Æ㎿™ëd%A´Û¬ÛÅZT[ç%ß–?Kö3ã‹qÔ¾Ãö—½M=ÕÇwì^ÕÇe°Ú x;Ú€²,öíP¶°’`wöÝ4[H]“"1úyox÷¾>±ªìÕD¦žœW^øÑ„e<¡ÈÂÿv~aYÑË`W[!QÝÜw6ùIxzÉÇìsÞdª”ÌÙ~ïã‹Üµ3oîúËG K-Ùìü×e%Ï“Q„V®ÁOΗ“ã_Ní*Ô︘_ùñcÆ‘¥öÈV™ÛcðŽÂOŠ7§HthÓ7Ü./+~c¯‘íðl_~W:”"„VH.?8~ß>ówÈ¥%•¥¯s§%t—Ž5Ÿ¼èê26‹‰u<ŸYßfúþ…bm*ˆ¶ž¹_YòþôXOP"þMÔ}FoÍ y[R>cˆ‰`»x­üœ·ÞFÉ­ÉÅ{݇jEå­ ÆÒ˜ñ¼´ºèÕ ýdDî¦9U•ew/s€Õ}ŽˆØ-æü!#mF ߦÕ(U³[ "íëBš®j˜Ÿ«|sxtkR´`Tú]ik|= HiÚ/æI±%D@iua)]ö€R£aÕ|E~$Ê^Ô V x—KDíZÔ0µŠÌ†7ÆȹdÔ_ƒž ÔY§%„š˜@åU/Æ›€ŒGyÅÚsUP» Ž·eí&Ç‚Åæµ›QB]:¼„”Ñ}xeÕÞWM`|-“§]§È@‘èÛ$À@ÐQÿ®`Õ²¡!N¢LA/šSy¨¹5åhIèE™èdÖ]î¶î–Uzc4ÌJƒê:Qv‹Pó\êöèO$õ€|ÄÜw' ‚g€ª ð}Áž w(AÝ1úl$¤Y9r¸1‰pƒoAŒxšÐƒôJƒ ýªŒîCb¡Ú³ôUÖV+ƒïJ-±2öCpNèQz4‘ŠáЯ€ù‰ ‰ÊL!–Yg^OHâè ’ ¤Ï…ˆÀÂí‰ÇœùÂÚm?ˆ§£])%*þÌ×£ÁÊ‘QEkØú8ÝGŸ ñ¶US£~4ß‹<¯¯ƒ´÷©ù§  › lªËqnHvñÏ”Æ'¥iÆ Ä•¦Gƒu..ÿ{‘„ÈþÅü\'˜·7jÇBël*`ÜÄ -X##ÿ*ãÄÅ™ÎѦK›Ž…nañ‹Æ=5ªô°°è>g_øêÙb<뇆²†F*G9ß-ãû#²¾&Òˆ~…ú¯ ;Û÷À-qø½K«Fž7ÊÂñøÞ5 ¥iÿ4H)½ö-¡åA=¹š©þ"˜­5µ0ĺµÊ3©rÕ+T oû):‹º€´&n퇊O]&Â/ ü†º‰q€æäLÕ düRUlƒÍO«Q”ÖðÝ«ù£Æ'¥i¿¤Øcó¶Î*6:)‘ÊѦIõ€>wÂþ„)".ô} V;‹–©<|-s°&ü×4&¬…1—ý{H OBÛN‚@Ç\üÖÈà!ÃkRô G+Hÿ§ [¨ÔËû¥Þ’‡m ©¸ª¯¿Ñ¿jqÞŸuå¨iBUs2•~…èIÍ4×dW+8ò=B! y%d³ãwŽ’üˆ™Äšqtiµ¹QDï—6^Œ¡ÿ°Ê ˆ§ÒÛ˜ d†HÓ¥,=冼™Ò´„»O¤k)ÐEˆ$dŽK¿ïKûr0ÂG¡ï(›ACÆ 1;?©rÄà*é ¤d&C«ápÀXB$€fPö5V¦e*ij4ÄÓ‘~ôè1ß롼Ð2 ‹ÍÞ¡#WIg$ÁÓà#y˜š@q!ÁàK()2Ø Ž@„£‚ˆ'! @¹ $ؾkÀÔ› él¦NkÒ÷Ip4>¹!*ôÙB=z; ‘ ‘ày¨-`è÷-W$Û´74bW¬™dÚÉÈmÖt‹g"Ž'­®[ΤÑíÂÁ4ÂéêYÈ%c¼é©’]Aˆ¥‹ï CªßkÃÂMdžÁSÍÇX¢DHÀ¼2Î"Дy &=_Yk%£!©»Í–Û jU4)€¯cÎî`ÆEd)âêZ2Û› p° ´ÍXw­e *ech\ms¶–Ò žÎÕ2cw0 ñ{€PÂlgÂÓ£7Œ£þEåè§ÔejÊ>ÖgIªgº¬¥†h¤±’qEhR;Â" ž=¶6ED@:êRЯð%„:ÆbÇÓ†ô¦µG§‹Ê&ˆgôv+§K€L£9_—Šf™A:üèùzt%}“Bö+SÄIÚñôp·œvƽì‰EÜšð¢c¶ë /sä5Æ©¼Æ9¬i-)¡Ž`ÿƒÏqYo>¿MiÊ+AÊUð[–zgýhg·ŸŠ¯_¿*¾TÍ°“ IÐús¾*÷O†ªõ€Ôò;WŸŠVØÈX]Ÿ}¸íhÈâao~xë*\X¥ì>÷â|/øU:5¬B¡x»×µ#$IBÎ܇zxv«L­ÛŽvYÅ•ÊÀW]%nG:ÿjågEùÓ¸!ÆÈÊuZrbVvAUyF¸ŒÈ¿=IQõr÷®gk¼]DDÁ´Ð[ðø3ö-’“™{/ÞWŽà«¢ð¢µ½ulædö°5Wßž?[\ùùô$?ÅNTÌõ5Ç)_V;ñì8#—~®~•4Ąť̬¨„ø~ª@â:Èàò#9ð]ÞÞ0Y®Ï Xv©àÜ™¢ÊÏ禈 ¤ /JjÎ|ºÒ®G‹áÌlyŸ¸ÔÃ_CçôÈÈkª>?¾Ô«CÚTæf}¿?}góŒ^hôŒ“ðd¾ºêBf8[{½i_Û|ؼéBѪ=5s[g‡¡ý×PõMeHm¿ò¾éŒm x€Ot¾œ[úõKá'{®6sIÆç |¶ÀÒïÓË]Vº–¶Vc‹Oξ~¯´êe²£!S HzV¡øR¸ÚËIH`š~_ÜhM¤©Ú¬~H5z§†S&2U(&XuÄGê…§vs\TöEqóBZAÌ ŽÞ³×’÷Ÿå÷"úu†·mìik£¿(…ÙQîú¦“ܨydåw»“™lq(ü )rˆuhB=朄ŠÛ—bŠ²uŽr–1|QtÕgEÙãþFX\·–/ÌõÉ‚Ìü EE–‡RÇ—¡à3àž¢—÷]C7Æ??¾ÿãÅåiþÂ_ökÚÿY:ü¬b4ÀŠæ½¿·ßJz6*zô¨ GKq ˆÈ`0V%žZÁ…÷T$–ó|EòLîŸæ»F@*¡úä„>2˾…%qÚ&sO¼ÎÙzm,Š’@'¿×"å:æ"<`ŒI™ÈjÓÅÞqsؘþRÛYŠÔ9p·ö ºE2vuÌö_NªÝ…§@$¶#ÛYØÁD ]Zž8_Ndvë¿þë“#ÝôéV]„ÖÀć‰ñ¢u)_ÖzÙù ½=ÖhÓeää“!R§cì1—Îaë2Zm±ÙCWF¿<2J¨C;{#i˜¾%ˆaǼ.˜ÌI"¹¾üÔ‹ê±|‘£Ëò϶ÛèLƒ>oÊnØÖ¨“õÌ€ž+^o)Á±W†=›Ì^ùæø_Bmêñ«É†TŽÉúÃñ£ôà½k#¹c ÆÌk鳕^ö(H=¾wÁAۼ»‡wÿž-àŽ#¨îÉÁÚPÆú™PlI§~÷¯î—á¿%÷OOñu}ª©ù¹Ó@™HÏ̽ÿ¹566 ¥Ró+%Uä3`ç½ùÓõq,ø}3“‰¬×^Ÿl#îâðüÑ5ç6f‹S«Pªz¶)Ù˜¯=àG` c‘)ã¾ÄPâf :BÓ碵1t÷Úµ«w7.cTaõ¸_.hfkTQEÝ‚jìC ÙóÔZݾBu¶ÙºN·Þ¾ò2f]Yxu*ëé0¿muN|Ø Qgû’»»¸m:C¦öðžMˆ1‘ØÞ9¨C‹‚jR<ê ª´ù(HÍŽ¯Þ7Ä ¤ô«ÌYg…a8qœ…ðKkµºôÖßV$èä¯e¨ƒ «Ô¤þè¼éT²¤˜¾C¶¾Xç'%жœ2Ú”ã¿.áþ¶!]΄ÇÓŠ¦iÚÏkR9oݸrŸ»…9NDjXÒ§w¹w·ùtƒ÷Ÿ°(ãñƒ“άAÙ\ÁNΧoå'_»¾gÂ04pº¾¹¯z© $ËâJÞO07sw^;ÆmÁŽ˜P.UBfó͆¿)¼ê@ "­›ç™7ó3“2²î$ èË1p8w/åÚõ}“eõ»E®B¤Žº3’hx®qœ)k®ßÏÊÎHQro» €5©Â=½Å|˜“lj“£|ùXš×ß‚½¬ÆÏ»ý4-#+9#óέŽbŽ2|JÔB®lÅ•BfŽI)H@HXÂ6!M„áDÇ_ë"áèÙyù©ÇÉÌÀY»“î*O“ã£Fv¦/ÈQ¬u‚AÊKQ|ÊN‹½ìHæíËQgNf|y¹)¾žhk웬„ÔСNR“^‘‘qo˾¤FÇnêë)2ëy5óqVZ^æ¹-6úìÀÝÙi㺞ÔKO“<¥i-©ì×NxS áÌái)ëð’V{4XšÍ×2Úšˆ`•„°Û™špõ„áé³…L8Zæð‘JÞ¶˜$XŸR²Æþèˆ0fÀŸÆ\=&ò+Ö’ù§1ÐÎLDD” vûºn5gÑàƒíiRŽXÏ‚ÙÖ„«cÁlOEpT&†YKWαïX¶1 :^ô·K~ƾ"³½…¸†`µ5f´£´¢OjxHÌí.|Å6WËB…úÁjkÏ­˜\ç?2þ4â4BKˆxßà~8xX+£’†óߺ…!®œjƒYœ¶F@[cf».lmøW6GG€·àXͦ¿¾—g„†Â[q¾¶)«­)[‡†rSðµûbu0æã: Þ`·7¥´1A€£œrßPGeüÑ•Ö¦+CC¡‡õ'ò•«GGãèmºíLi˜+ÍzTzÚ·áwæô`e¸šŽ­MÚÆ<ðo!Ôoh",…Þ¦+³1½âéÁ_»ÐÚqVøU4‚'¨À„ÿO‘E›.ßÁ„ŠÙ…Ú¦«ˆÌµL‘Üg}«¬º²„:¦ðL²:˜Òÿ´@ÏåkÓÚtf!khð%è!Á“8&übuÌ™mõ¹ºJÂLŒ9‹,=xQH4rXÓZRÚ‚Cù…FœÖ ¼`À£ïvI°¿-ô”-5ž¹õV¡¨JÙdEdþŽP"2+pC\Ê(I+g1ÃÊãšèŒ1ä'ºýÆ8ñ=®¹&ÂÑ)5} ýPçÖWå&EÃh1Zý[ÊÈÿµ†n Xúàê&VÝEø#æ¨úŠ°†qBÓZ9OJˆÔ¢mõüV¶PÛ¼N øm¬  …£exÿ®‹Š±Ôš²ÿj·ªŒ¨/¾Î_WÞHµ¸Ã[s2IëÑ}7º¦ÁŽÿ9„júU .Dø–°Äk’y5­u'$„Z YeŸXÉõZ[:– ¡”­µ•d¿‘©þ×j8ck¨_ëˆ2Á~ûá8%¡¼µLÈn@Z‹pÛ"$uxªc…­¥®­ázU’»"´´H/r­:\ÊVx<¨Í ‰³"×g‚ýEpD¨\ÿU" ¥%³¤šÆ‹º ˆæ².ÔâšÒúGo4:ú‹@Dý,Uˆo\ÑSrÕÒWk¹gÁït˯߭².!Íœm¢Ûÿ<î0”wMoô®A”ø×øœ L¿è~¦.š¥6¨£‘n‘Üj¢VדØÒÿ BÈ«™-UôØPù@±µ´zíïwK®ªbšx‚~$v‚²ý ½!GÖg”•~bb 8*Ð$4vm?5bS\Ëþ ÷ÞèÞø›øýç@ Ô¡/¾UTˆP|:dC ­§²*?–¦ìœ%Gø8ƒ'+ýZ»:PF`Jð€÷ˆƒÅUÏ"÷Êõ›²‚XÞüýi¥¥åÏoìF C$†ß°Å•¯oëm@…ô¹³×FW|®Ì;ìH¢Œvú˜“@„µ6åÜÙ½@•"±ÕõÇÛºƒ†Ö OÒüHÆ£7>ƒG[ö±¼èEvÎŒž=¾)/±ÑIφ÷wÂüá\,ÝÁãı¿88M}ÿ¾´¾µêËy‚µ'îì’Ò "ãàÅÄ Ž–ãO>TÖÔ(ÿ¬ÈéG¤´ü1¨ƒFžšÇ‡À;Áu).C¢F²%u<·iȨ+™§ªLýØÝOøZÆCGµ!Ó…õCøDÿ˜0çcX³v¦V|ú°¾¯³ˆ Ñ ’í®ç½/Ìî¡ÏPO&0<ú¬|_]‘¹gšCUëV€aÍØ–\ñ¹pcÿn5õþàõNâ&Þùí7O|Œ‘©ï³71ÎÚÌ}yŸ”ýTæ]ß)k­í4™å(ñ¨¨ìùÕ-¶z­@ð]Ò¦¯Nx׳+KBæZ°A}Ç)ƒ†t³°^yµ4b†‡•EŸ¢¬07C04¾úo;™£Ë¼²¸C¦ÍAÖ$HIˆ|_W hØß—?^-Ðív÷a²³>«ïœÌôÝc­hà £7@ºŒq»>löv7/ê\7îÀ‰§ó/„ ‘lªÃ3°N.*|yb=‡`•Súh(±kО· œìL$Æ"žmòÃ{ý)âÑ³,É]9š£Gsè}ùÜ$?G÷UçFÙtM$Vú¬mQ÷[Q!"ýT\Þ”Ž–S¢ËsBªƒ²–Z;!2sÊÄõѱϒOœ:¿e¡Ž h}½þ>¹çè–±ƒ ]ö˜¹;–ÍÛ|býwý±Ò#…KøÓÿÞ´vóÝc!¡‹ûv“pÔȺMüT³Òü€¼Á5pù‚5»¶$†.ßçè>ïóý>ßÅçÑ…\GæŠS/Ò­²×„–yúêú8‘‰ßõ –’Œlè¶1É}IYåOS‚Ð ùvÆJê&‘8:Œ£×êã †ZùܯÛå®Ï]Vúr¶£uwòø§¸'Y|VÔ¤ÜUZ/îÚ°c4_»wÌ‚s²¶mÿq¾ë ª—Úʘ [×m›hcËÅÌGâv_Ÿ½cÉŒM5³ùýéS&/·`Sî¼T;uS91wgåÃ; »7ü>V$DLIr ¼’Ë*kÊôãéðN76¨[Äo½}lz¨=7îiÕjQ<RTƒø¶ÎÎê1ihjSí.ŽyþÒi=´LÙ ¤ºˆÓŸ—,²×®;ù(™Ì\°µj¯=«iöKÁÅô!ñùw÷sFÚ­2µ/¾~2„È2 k]åÔ—´§ášÇPžx(Ï΀)CRņ0lExôÏY¿¯M!Ä‘]Ý’tåñ´ðãFÏrÑe,ž2sÍOÙq®©Ûæ·Ò+îÇØQsw,…;fIÅ•5‘‚÷Þ3R©ÌsÿíxöüAõ^Rwƒ$ê˜Í· ’¬ªšncnéêpwŒOlêï‡æ¶>xR¾~ŽHRZiÇáºpÙ²TGŽ*%÷pyß-s×¥-Q¶Bq]Ùîš{ÎÉ?DZiIS LXÜVº–Õ›“Îѵ®~Òrb_AÊPN]¤î.ñôå¸ûRLRæµ’lmèîhÞõ²Í– ¤f¾‰cÎÚS»í(nf´7ÕÌ65c¡æIÓ×w¶G‘…ŽÄÀõôMQ§†gOnغH`fË·ÜT¾n:íÖÓ4›þó‰|{ª«mÁºê¹æа 5ö¦–§Ñx]˶®óI4YàDô½ßÙè­mòAŠ¤íßüè’+Q,¢Œðð¸6]1Il¹¤bòpK“Ïþ1˜Œæ-åW³¹¤aÌ—’õ‡ ÿ$ÈZ¾ÍOšÝ‰b+rÒÃöS¶ÚÖñÖ”Øúå£)ýÌíE?ÖLecaíä}`_R8K©.ø©ZRÚ&C¦](YIécÄÖ"s \›^?ë,öwŽ‹4fŒÈ<Ü^³ŽÙ‡Q^]ê¢.“ÌÈVe¬nè\à,žµ®æyÅ,Îwœ’Ž—ÓñæÞieç³GÂÞRz U2,ì¬ÓÖÞyÉSÕ.Ýš}­ ÓŸ;¢üÈï öñf±X^d»†‡M£tMd!•x¾úlí½Sö¦ãHÕ^:Muðç¸; &F%úY15̆>Tl;ws%RL ñ‡4;––R»/Ý ç¸C¯zù²";ƾü«ÔµqÖ™ö FPZ^cª WÝtÃî³zì¦Û5“F-ï¼´lUéµÌ7qÑðlõ¢®^;eOr1ç´^É·ð± }—õP¾Õ@¦|Þã"h¹Æ ûÖƒ‹¬ÔL]Ü6ÜQr2ÐusQ’âœ37 ækâço¨ŸI¢s•¡“"Ðç$Û}òÊ‘–lUÚïÇê–E'äžiý-Ê^h`ñüÉÙa)E÷’9ôø)G:/n¹Ñt6DËX¤žÞŠõ^rmϤúv ¤6Üß:%=mä„ Ã\YÜU͇×pt(4ãÉ×+vŠ0r›þ²|ejxrFTœ³> ©#OŽ/Ϙ5>cx ¥6é=Ü}f‘‰EsÙú Pâö?ÞioéYýé«Ÿ…[Ðè<Ÿ7y TF™ñ»[Ÿ¶wT­ =É*Äå?zøtíHGe7ðîÍ[àì1¶"I$äZ ez¥•v”öwx{µŽ͛̋wÀ•àäjÆü' ¥aºhÓ¹MÎ^WÏ[ðó©• <Rt]·«¯[§.ù£dÑ„¯¯èÉ@ŠE[\±zî¢ÃÍÁâU•¿Í“Y5LçåœÙìäqå…s~<¹šE`iÄÎÓÛ÷ÄrÔðt]—æ×·§-8Xºt|Ëë–`Ô°Ÿ¾ÈƒF¶´UMÞÖœ5vú­Gçìp(Hi˜9ºþzxtøö£Çýœ7J¥ªË@jWeSV@ì‚ yÇëg™¡!EyýÁùÉ›/ç$N½õ¤Ú‡gö5O-¸Gg pDGç_K’¢·–”8ÿVœÅ”@ê“Ý“‚]jä¹O®…(ÙÑ1õÙž6\m€çc.=v.AÈ×&¬È+_A5Gï1G´>«rÖ%Šlfü]3‚Ô¡såm ePìŪ½ð°ÄYå¿vyÒànG /¦X¤ÛS®ÁY·Ë·L5¿±l·¥÷ÜÃÛ‹Ç-¿¾=¥âNK’!Rõgvø¦]̾ðŠRÕWê3‡Ç§L¤E§Îu³dišE敲›óÛHe@Ú{§2gÚ”¨”©á! G,¤šïÏ™’>rb¼££ŒÉAJgu½¯Ñ¨™õÙü€T4¤8Wª7¹XN»¿-ä‡-W¶:‘Т M¾ZÿGÚÞÛ³Ã3[®¶ÒýX‚ËYÃY'D¶Í’çÍë¬tˆvüäóUE.ºD®AÌθº<Úä+}·„ê ÃÝGMÚ]Ábô7J™Sš#`p”ÜäãHLU ¶ž€O{õxÏ8½©h Qon¶øjÉ[Û5e)þxcžÝï%“Bc§†n˜ÝÇì¹Sü#f3ÔòºÊ·_^‹‚-©;©\$“L<®ålMHãç\;ºJD™zq~ ±Ÿ©•×áÝ ÃQéχ*ȶ̶ˆTË¡ŠÁ‡"½·fÀÁ-–x_±>I€{ÓÖ:µ®²¦´‘£aa‡÷Dhü#%´,&.=ZB6ûJwU~CÂ@3ÄäIN„®.„neG ÆôÿûE‰£º¤¤! W‹ÀÐÙtp¥ñWÙ>‡O,ÇD¬E¤[¢yòü¢²0*4ì² IæÌ~Cn,O0„ H¢« Š;^EÆëy=qÜYý³‚”ªSåÃ[Öª†xÒÔ§·vXjº® ¼ÇdaÃHkúiÔЯ¸Œ­\ê °‚]¾]w2+Š¯æ:ã¿r¬®.Bc¨ä&„Œ\j²ªCÅã;vê†xÂäŽ;»¬à{€qš6B8š¶ô´««âL¿ä[¹%ÚŸƒûÔ!E'g^<‘PÉÞn«’– ú›.Ô¨%Ç/N·åj˜eï«Yˆ—©îBr½£ZE¶]*®«ä«‰C&]©Ú)ÙêšÝxæAwO=$òþBNaÃâ VÃÕù—–H;n<[Ä2"«sn>¬Ð4Å@ª¡boà°#›KëÎí„ u¡ñ„«Š ìQѶ±­r´¥ïЈÉç68‹fo:—ocÊV3Z·ïâÄæñûîíüA€,htM‡š×O¿· úê¬ÃwÄ=õW¬á—ðlLà)IN)¤üSó.¥YsT;P Cªj£3©­ÁѤ\È2Òô¾p£–£2”Ì_q·vè£YR =¯¼mk'…&»ø (ŠÇÔ°¿xïö Ÿ¨”à¸H®µ`ååÛWæ'Ö¶?Ž"ÐD¼ÄŽÇeã<*®6yë+s÷1¿÷ÏÏý%mxܶ£ÍÍkÂYjöU¶Ìò [}¸íè‘"³ðû-ÇS\"óêž/v³JœþG+‹Ñ×ü§#÷~²â£ÙAªæYkÌ÷Cüs;;ÛFhŒÛЖ.q%5š¸ª„­çZ³£¢÷Ô?Ü1ÂR8ØýzsÙŸvÖ=ãlåì1ãÕé¥I¾cÆ 2¡O9p÷Øêøài7Ùª&}Z¼h|JPì„àQNúïaIéàýÖVdŽF¶@Ö“ÉøMåIÎ!Ë–-vT!f_ï<·,--³ðnn _룶ýíÊ“BwsÀìC}n"ò„é÷OÅ…,ºV•Ï‚ËûàƒF¯ï¼±R¨fÁV3óN¯9õó´YËK.Ns¥«˜j´¬k[b½!ƒ ²‰öW¶ü:²ôî³Ù–p@>]UÜÒù§·š¼ÇŸÔñðL|ðükç Ùêʠѵeyˆ™ÆQ3–Zu&{æŒÔÏt§«>£+Æîg”°ªiÏ„19/•ÄðÙšDZ_æÎ'S…Bøìô—[¯Ìˆ¯}ü8‚ Wœ0xÙYæØǘ£Mz­{P¿7vdöõ‚Å”~pæoÜŠÓí'gðµˆì~Ʊ+®ä§Ž]_2VÈV7›žU¼ž¶p}àAÂú[MóƒkÚŸÄPè‚O;O ~d}syËÙ΀ÎÖµ=ÖÖ±1nTRôŒhSƈy…/n•ÆzLºZwÐZU¦°G4ãà½ÎŽËN½¨„Ý}G:: R¢—\?6ÝKâû ¯¿^ÂvÐ!üqu=vÖKÜ}ä˜Yû[ã5©¹õ¼º™}Ì‘«EkR&涬¥«‘1j¬Ü}ïöÒÛmeÛ!HÕ].uW5CJÒYQ†?~t6Õoâ…»7}†Ðüâ·>._Öt¹ÔQ˜ßv6k¼ …D;j“f—üµsjòÔÌ}íE“ØßPö4ß››46ÞÅëîÅ·®D Õ0‰-¹,i¯ZáJýáÆóRMÕ› H=ؽµi› :`€ÂS3µ½eG|tnùŸû¹ü¶'ÅÃ1¼~‘âÀ`¦-ºwÀµ ˆFŠƒü(BØhîáèOâIî (Hû _"_ù” a=¹ÞÐ8ÃùN–pé<²©C„}`˜ÀÙj\Iωâ¶âHb ça†’ÿ…¡¶ál)þºŸå0;]²p o¸— Ž(¦x9|Oïþû¡XZ…;¸þäÏ |cOp† fZ qd‘¡(Ì&:µHû@/C:W‡áÉóû»±x8ª=Ó;Ò:ÍÀ~b½÷ÁE Ç ²ië*„ãÞIbx!Lkv?úª†g‰Ž¾‘Öž¶ðYS?6¤¤½'¾Œ”%Ž&QLv·óuLCâ7DC­C8V’ÜRèþŸâ#ô.táw…I“œØÞ®C+€(l9ÜÎ?€Â‡Cvá-9ªŸÐMˆ?×$Ú‘àa] i-ò¬Â¹~¬n&<¬·ÖUðù!žÈÅ1­üB8b®$Îœ­Ivã{ÛéSBU–&öab<»+?W‡$täKBˆÙD'ú°po»äR[[8ÐÈ¥æâа\{hXªšãÙÓ…lU‚4ÌOhd7Â)8€ÌGÅ‹~²É¼ð"æL÷‚V —¡ xMûÞ2Ô&0ÂÚÃZ—2jiIå8·pq § ;h¹Óç‡Úr‚€¡³¥ ÖI2¬«SÒÜœdå/}ðbÈôâûFÚx™qáXqmê0¾_¤­—¬“.aª+àÀî}[’[Ç^€£úó]$ëg—³Åžì9ê—Ž¶cŽ©<ºÇÖÓŽÓ=»4=_laåi« YÄTOüR$¼ »`'DßóƒH\Èj¶Å{Ø¢CÃzòý#,]}.Öh\±ÈÀ2„Ʊ¥zxbš­P„ƒx¡vÃ9b¾6™ÿÑBпAÿ¹"VXˆÅ;Í ô1¦ö5AÉøcLŒÕŸ‘s½3‚ÆÿG.GúǺN|9 ­Úä(·‘š9¸½­Pa8,Œg-Ý”ìÚô”­œÏÕþ ÈäÉ*«Û‹ê18 S…_\[%ø_tÈâ©[8[GYëQ¿¼æ\_0¤ÞUÄo‡tvv¾zùJ*èðãpŠÂQ·øÕ<C )ÐÿÌßØ$þ™VœàiØÚ½üµRØÐÃñó€ŽLûná#Þ*ý?C_aé|Z'.é¢.ó éÛ!wþ¼ÍT5g©ãm\¶ŽŠª û™š“L8“ˆô?Â)P èSŽ"Â\ºÖÔp&ÏC¼bÏчËH¦ïºƒÆ×&YÓCf$ÎÌ æÁÛ:DW^¤ IÇækƒ=ç%fÄq…pé=þ„1ÓÃÂ…šo­ÅAᨙmœš@úZfJ¤ÚZïðP¹Q›Wþú¹C ]`¨'ñtºú—a n|úêöè~3—L˜z?HéÒDútH]‘ÏztH’CÊ›C½®Ã®7ëÑ°? ‹.ÅËgNó7¶M{IZ¹§l n•ˆ„â‹Pãõ$™pä$,P—.BFÖ¥Ú’ž\ÚågHŽŸž_àÃgkYÄ¥ϤrùÐGtHâá…·J·F;…Íð³ú™%ýzgw|xæoµ ÓyÚéoAX.ŽÿÓîÆÿvv>ª-´×ó©¡8rQÒ&VTb¤¤ª´]HŒÚbek¥ŸBìyËB*èƒ=}òAyúÀ>(E•‘ro¥•t>˜BåÒÔ9%³•¿]i­ÝDf¢hΠ :Ð{AŠöIpFÞæ¹óW¯.¨^Bý†²ñvg^ú䟷—Ÿœ(fõçŸ}ü4{LÒöŠÖUÞ\Á ÑÉòÓ9é™{Ž5'ó…2½Ëq'«ð vÜþmöäÈh±6 )žºÅ˜ÌÒý+–®^¼*k$[…{¢¬˜£NâùWýš²¦ñÅùÂc'­í?gyñ0œEÚ܇¶í{tdl°]Ě͵ۓ&¦‡†ð48·[·Ìÿµ¢(?ÒˆJÑt­yÚæ¬iH0K~ö¨PŒ#q4˜ó÷–§,á tm<ù[C² œ…ÇTÇ»y͹»ÜççÄÞ>ºÒà )øšëH)6@x]ùS ¢õÅV¾Ö.ºk0FÒv$­7+¿ÂÝ@…-1_§°öø›^“¨Æ(òÝ1dº'÷ÜpYÊ)åU°zš-ú"ÈNWøÕ, àîzKJÅ”3@”0ñ‡9/îþný5þ—ºûîƒi,Á¢Ç•syýy§Ïdô#òüŽž\>ÂÞfÅ…œ‰¡ñ© [JÓ¢hêdÏaÉiQãcDBØV‘<½f7§¹0‘¦(HÑ]}q+#"!)xV˳fMvññC ÏëЙœ8RÁY—O/ôçBïü{SAˆ·ôðÂD7÷ù¯N'qTŒc§™NbqpT®žíù¿þ[4kŒ‡xRç¢!7Úëg<Ø;cÖ­g\õaHÍÙq"‰'âjÝn¼|óbñ¾y1©;Ò~`›6\©¸T¸-ÎÆõ‹w÷!€Jò´0ý§Ð–zAV¸€+„šGÒUZ" W~i·)YBJj³¼uLIWJªÂs—ÿ”ôtÞ)mIÉŸŽBJ‚=) ÷ù;j^ëßYþÎ|cŸ§m»m¾ÆçÔ¶yÒXü…«@:^²­Nâû9¹"ÊÅ'/w„G—Žøåà<)¶_¸­¿‘-)´%E7Š»ÙVâ0qÒÙª¼âã…0¤|ŠÊ×J •}é$èŒþÖ[÷íÍô³g™„Ü?‘ˆ†ÄÓ3Ï_¦ÌyúÖu݈øÞåò³›îT–yüã¿JH2º}õ¢A !t²z,o¾+¢ ;©9YyW°ÙÒa©0Žèþ¿ò®°ÞC Îf•ƒ”Ô™†ö§)Œ‚SbIafˆ| ©""oéÈ·¹TTˆø;tœ”^Ä Ur.R@Rýx5¯„éè:»/î|’¯R¥+c,ÍÃî×í 2¢» £`Ùp%ý› ¿UN’ €µ¤ÈS7Ÿ; gã²TÙοXàî`iä6-9YØŸXx¶ÊöÉÛZÊVŽACŠÓŸµí„@ß)iÑþ3g“9ýL¢Çìðû˜sµ©‰yíEépÑàÎû{Åÿ1Í,îXâ&Ž™ùÇýM‘|m2dIÍÞv,‘+âI’²ùHá,Iú°Ý'ž/ÌNŒŠM/Þd—-{Rÿ­(iùA®ma!­!å½pï)y'è7(„¦°<†_˜]*…æŒÂt9)P¤÷u<äçŒ1¸Ð¯¢g¥j`O è»ûú[ÛÍ®®½\ôKöÙ¢åÖßæn-v5 ±éOm™ÀSãlÊ^ ™<|‡u›SCy:¯ Eµõ×.80Š*×ÍGv±K*)fiu=Ïâ_XqýÖát^`à¼ïX]Ë…êõ ÁBb`Ð’«õ5‹'îÚœÅ'=}¨fŠ!,jUѸPžŠ!þ[#r_\GÂlXñ¹Æ¶³¿Xö'°5xöU]©*K 28¹dèúGyCíÞlu8O‚ÔÂýUã…–r¥õ)Öxï]«ß¿wjíˆîû—CJQKb1ò! R)L4„ª(W¤üvú¥Óg":.BáÜ䧡Äq*»)öj²Ózßè>ébztŵvE·vŸ¢ѱ¯Š Pd;GÈ «ðP:lwù;ŠoȲk÷;^Ý©v“”DP ;Ô8ÝuN”Íœ39¥J{RÿrHI×Uôª‹¹†Ÿ¤ºc<¶_ wx]õr‰ò>·®@GÞœT£)‡次ñÙš’rIŠ ‰¡Ü}@_ZÅ ¾®bBU1ãèú ЯI>™÷öÍVÂ׃¡ˆ~Y¼@êKMŒB-¿]­µ•¿'}À ž0ŸR¾'%µƒ¤=”{%"?&r ×5à{XRÿ!ÆCö¤€@Y¤(JcRwnÝ–êÞ»ô~¦R_¨1%'釡À[!% AG¯ÏrÉÞ&ÐQÿ˜Hõ–ðVZÉ㣧ðŒÞ@ †ê,OR)I%z¿"]ÝûÅR}þ'ö¤z´/$Œ öÔ¨ãR{HÉïõñ1 …9¯n‹’¢ÄùVK }HJrw±}ìIHH½+§x’©èR ò™GR2_!ûERp|XHI?‹qÊIÃùÐS’7¦Þ )©(íª‰ @R@ÊÝ}Ò¨ å»6ÝA}ØÄ^LQOûA¨ŠÄžÜ}òÕ!8¨H4§Þº'ÕS®.GÒsº¾&êI­ÂLOþ¼z‚âv@Vú¥òN°' ö¤Þ‰JèJtTÉ/¿ÈÒÝ‹À ¢|„òè>ùD¤^îIaˆ¦$J9+åÑÙ{KJb~¾=óýA) ) P»¯7Rn>(‡”|=”ïëÝBÐ1ox{tß;æI!¢ýooí]ˆ¹=8î¨=å+“£ ) °'Õ«87éË“­8Ѥ0¸ÁxÛz*4ô!¥¨È¶ö¬ÂŠ˜ô(Emˆ»Ø'Ÿ~Õ“%¥Ä4Ã<) >°'  õnÁØè’ òu¤F“<zªOÛVÞšÌûVK ídC§wÉ”à†‚ o@B•§€aÞФÐïWèx”#@R@ p¢÷ñØhïR$A¾ &èNÞRPØÆBaüû–RR½7•ÕÑ;\²ä"+¾=xüäç&Ÿ%ï/•ÿ^¸sØ“½6¦ CCaØ9êú—,Ÿ¾¤d/F¾`Â2J¹{ÓO ã®T1(ão|óª’Àu%^Gù¹õæ¤ä‹QHH)„”`I®µÂU{ˆ~Fùáç8¬¤74Ub.‘P+ù›DTÉ"OW8æÍÈcd‡H¤'G`i7+œ$VGGÅå/²Ó½$?èyèÔ¤—í—ƒþEO=,„cé7²àšºttf.ò<2¬dnè@GjOÿ5И设’Í>sð“’Û“2ƒî`!qµ¡ÿbXÈ!ò˜ë:„Þr´d™êðcI]P3é8’þªf= ø‡•öfXhé° òÃJÌÐÃBË&,†š9]Õ\¨ ?æj#‡2ÃJ¡a¡WYð;¡÷CŸ‚¡@åg‹V~¶’Cø Ð;!1ÕÍ»§r´ Û}©»†…V~é·@bkšËζkXäU…§c&wà'¥ß‚VÑla±5{¼¶$37{R@R@@@@@R@@@@@@R@@@@@RR@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@R@@@@@@R@@@@@@R@@@@@R@@@@@@ï£ÿ1ð** endstream endobj 1792 0 obj << /Type /XObject /Subtype /Image /Width 378 /Height 209 /BitsPerComponent 8 /ColorSpace /DeviceRGB /Length 19896 /Filter /FlateDecode >> stream xÚí\[Ù•ÿ§e²ÉlÚlf'u3ÙMþùÿ“ÍÎd'Óí÷ Æ`›Þ{ïõ.:„ÓÁ`z¯¦÷Ž± ÆcLïýý¯ô@–ƘâÁp¿Ÿ;šçÇÓ“tßy¿wÎ-ç"@ @ @ @ @ @ @ @ @ @ dK,‰ooð-°Þ ÈÆEæ¥þúB…@ž§ s3ÓIWâ=¹Tv(•Iô vㆆ>î{øYÊLOaûúÓ}ÂÀÁtn ƒÆæ r2ÓÀŸ¤Ü$²Ï}ñ?£bãµ¼< žê~íZÀ¶_Õ¼>ã2‘î2>>.>~aa!($\Ñœî’q? þéñhqθ§jíd+ÉÒâžÛ5mqin‚¼›€àäÄ‹¼œ˜]Q×ÜÙÙ9;3-yü­[·ì˜~„¸ÎÐ6D ’ 2hA·ƒ›ï²i=2¿ ¤lfzª¢ºÎŒæOK½Ò†<{>ˆ*56îQ¼ªù€†5tCRs›Âå3G>´\а¶Î<ó–z|º£ /1é*dáãËÓgE6Jû'Òÿ¬Y‰#kllÌ‚âã_³$–”uÔÈ =±Ó’“6^x¼¸€/cÍËËÍ΀‚ì~æçú÷Ýî¾Õuëæíî®{wï  Í°â[xjjÊÉ;‘|;¸EZ^ž'ÁmÈ秔3®ãÕ‰ü Pdi ò½0:2lEöàUÌl"`A»v¡Ô,Éšnù´èÛ.r˧ŒžôÃë¼b¯fjj’Êö(l8zÍ ø]ÏvÇs+çí\‚{{{¡‡¼Jµazp™¢¥=¨3Ïo¦ö,³¡qæç à@ ¯Fj"ÂCY)Ý/Õy½ úc}+fT&´ä024ˆóMý»'°±åe ø~“““ÐÃ@v”‚’2§”®ý¦3’‚ã]<¢¢e422Ù!¯æ{ îCÇFÜzÌ-ŸÖwpÁãñ¾¾¾ÓÓÓÐ* `ff†Æ‹ã×"ûÖ·AÝsV(ëH¡PÒÓÓa.d'r¢o¼ a_« (f¬P P&“Ùßá@ ;¢6Nì>WÿšESF ‹¥R©!''²-ˆÃ„‰ññÞGˆìÿ}Ûh# £|Ë&õí™$"¨ ™LöôôD`[1²M:ÓÓݘîžI ÊÑgD° ‡ö³oã™Û§®¥K£ Ápo¡µ@ [Ç×ÏßÑ?›S2Æ«œÔ#öטÉ]û³O üêä¼EOG“F£¡jC$GGG¡@ [ñj¦§§ØçŒûËcùD ãsm„ûÓ« l@ˆÑMÚ´pMk« ì‡@¶¨6ÞüpjR—ä …­¤¨zݽPÔ+ÄÀ°v„‘Ü­ª¥O§ÓÚ€Wh0ÈV¤&22’–t+°áïã6aÉÂJëÑ¢„ ÃÉ:aB0G.ÆÞ–D"%&&"°•Ù,3SFT~póöH_ù„OÉØr‡šynÙä3ãEÛþU³ü—ð4Di‡KGÑÅ$ʯ|»hPT†yUóƒ·%¹V‚ ¯–ÜÔ‚œ<+G¡ïܹÕÙ4¹¹¹ìÜÞíiëhF©¤G.2³GÁ?ÙÙ7µì]¸Õ£‚[‘àa–¼ VÄËåµ W€˜¥qe£I˜±Sа|$Ú|ü ° ^5ô“@À?Ñ4;õ ¦öy#ª>ÎKÝ£‚§Ú¶ù˜yÀD_C‹àook±°ÓúA ›$.9›]8´-Ž P,ƒ®hé¥K ñ«^òÎéÒÃyû5 4~„¼ªž¼έdÑ-®øøác tˆA¼Ä5(JÝ1XЂÐ8VÁmÞ©54 ´,­jõˆ)£¤±|¬g®ËÊ]ò¹Z hæÅ[Nï¹`Š¡b“BZ‘À¢ë‡ÎÙ‚“ì\låšqWCM™L&_½ W»ƒ@6ILj>»hh»|,ƒfàQl`K¥¦=öÉíÖ#ð8eGΚú5#ÞñIG.‘Ã:ædÏz×#ºw9bd¦yÉŽË©Ft´dÉÉ}òÊ&neHPÕàyU ¯Ê%5Ý‹ø¸ž &DÇT—Quö¢ð”–Ó¤/˜ãèê„ [v¼†©‘÷µkwN/VQS§Q© £§§š ²µIÊdnŸoC3ô®ãfÕʨãÜsï’ùDwÎq ¬­W‚-;ò¢š·~ZFÖÀ»±bò]2ÚÎ)X:ø%º^­à×­voÄŠd럫­¥E•¨ ‡ÃYn M3??/ˆÉð.“¾õê÷lˆõQì¢á52NÔ#ÜÊYS—e%%&“‰ÆPbÒÒÒà`dÓŒŒŒøéû-³„wñˆ5L8-T"t nA¼ ‡ fææhZIµ{àÊ ÈV5ãdï¥ö™ åmEäL˜àU2–&9øì9y2™L}´Åi}dÓܽßk¯ÔàƨãœòiVêrtƒ¹KÄy%MkK =¡ò")5$)!!J ²E?2ñÎÞojÒ‚\²e«ÙÛàÌ,¬l¬-Ñ15R 5 5ñññ³³³Pm ­nŸ¡á /C°ßÔ¦9oLaÐ(RnŒT%Nk¥Ù:SSS^YÜŠÙý“šüÒÐvä„‚:“A§®€¯¯okk+ª3Pj m!37ß%í¶ ~åB÷,UTVO€B»Ÿ€Â</êëëÇÇÇ¡Kl;vD–Ÿh,ß~œÀFD‹B$’¤\àÌäååõ÷÷/..B‘@v¢éfYpHÎN©·ùuËÓ£öðÜLvñˆ¦ x2↗ÞÞÞÕu@vBpæçS²ò )|Fòí°ŽååÐð èOp3ظët# á妎¢Ë(ÐB¬­­$www8ryÅN_ßc5 ­ ZŠ6^¸Ëµ^…ÃMˆ{NŸ9^³ÛjB+õöÆ¥h¦¥o–ºšŠ8‰Cq¹\=A3€@^±æ€{‘ˆÇéëj)ÈÉ;tð³ã= w›oü.+^®GÞ㊠êžñ*çLÝâU”Y,–dg7©233a¼zÁOù””‰:îM]c NfPó¦•aIâUœUO˜¯Ï¯á× ·7wfSvºOéDPÓzHðëˆãå:3¢hmõ›ÉÉIxé!eeeD"4nI Bdýæ:­Ð–å÷Š PÿFaÉu̼ϯßL£ §t⢞í¡Óòœ,tf7ÚŒƒº=`8c $ŵR1Õ34^=N€Ãáàu‡@¾/ÁA5gll 89ÞÞÞÎÎÎ4*UVNÞ!°Ä#/9ÍA˜KÜÄ+•rõ&¿ -ŽNéÎuMè:¦8ú›jLü—çƒFFŒ+×µ´´œX,sSãSgeÏiYêýl8©¸ b{ÿS§ˆ‹Æ„3r—Ô”é4*ºh‚T—7 ..Þƒ@vƒ“QÆÝ»w›ššjjªCCC-èþŒ”žà– d¿ù0¼Äç’ÝËU4oV±ìýäÀÜÞCÞxãú9½ØÄÂH ux^>ßYE ‰t( „|4ª#ÆÎÂÜÔÌÔØÜÔÄÞÖ†J& ÷Ó×0 ‘‘‘0†‚@v•àHîéêêRVÓT²÷ñ«^x^ƒ ¿ñoêLpéD AÐÿ×Nÿäóo½½ôÆ@gÆ?ü}RxM@õ<_täfòE´!2:x‰wâñøüü|qد5²;õ§¦¦†DÀŸþëgˆH^Äeú‡ïV|~TP1ãß(ò|Ä2% ¦ýÊ'üÊÇ_èÕÒ¥…ZZYII““Çc0è,'Ê*Ðýà°€€€;wî@@^ êëëÁm눱×ÖPÓ7³Õ³"¼õð>šôÀh}âÒ;?+Ì’¨€®ÿú¯P}}UsF¸pÊ9& 9À*zÌNªwÄ»…gùæÞ}Þlt´©9°Qwð621E}±»‚ú*à‹uvvfggƒˆÏÅÅìÄb±8Mîîîááá………ÝÝÝph òz…W>ôòòBoyà3 G!HQqòw$E-¥€ãPunÉ)Lw_ÉÊ`y%ÖúWÍ>¯-]¶Ò=¯ÿèy «## &CCCèb2;;;555111222:: 6À?çææÄ_z5Èë¥9333W®\qvvÆ)T*ÇÂbèç?—ŠžÐòä—¿¤ƒèf%öa0è$<–BžáÅ÷+hD¤WÛ\Y=“W9ç‘×oâyîüÚsZcÖ\0j ²Çœœd1™}|€<ëÒHS‡£‹À‰×$‘ˆ–F$®©G.¢Á«x4¸ i–À&Ä#À>¤ÂØ%Öë¡®kdafÂd0V7ù‚p)11GÈžœåõÄGGg>úhu%Y¦~ô#O[[´ë‡ÃeddܺuËÉÉ lcq k{%uݳ *gTOžS<¯¬¥ª¥ocïˆÅ 3άÙë„v-¥¤¤ RdoËður‘—_V•·ßFþõ_‘µÜðÚ÷ïÿÎ ‘Ü=œWT$ˆ×ÑÑÑüü|à®Íz²æh4gXXXWWº   ý"5Bùío‘ˆIõxÔÞÞ/Š§ÖlÃýÉO<ŒÑìU«GóÞ¸q#55•Ãáxyy¹»»»ºº‚ 6› D¦ªªjbbŠ ²ï¤&>^:#wïJ*@ww7ÁH–•]xóÍ¥ç4àT|þ9›Ë^çC§§§ëëëŸýp¨3È~’šâbäïG**´ëy¥ çÞ½{nnnd …H¡Ü>ÏsÔ[ÛðÈH­¯>Ä`0@v È@ û<þ©ø¬Áèè(—Ë%“ÉL&33;{þÎ5#)tgëÿ7†F«zµ®»òàÁkkk 6°Ê!ýèÛˆÅmumNÎÌãp¸ððpL-`mÈø8"'—ŒÅRŒ¦¦¦§½E"wùê«çuˆç?N ÑüüüÖ¤ôõõad¿ë ú ³o¾9ÒÕµ†—RU%lL^ËÃéø¿ÿ—&ÊDÚÜܼŽÚhiiAµ@ ˆ“ÓӶߖffÖP$cã5Õfðý÷ÙÖÖ %44tnnnÍÓ÷ööª©©‰;¾!È>E @Dù%–Ë›o.ñù+2³ôTm¦¦„3ÖŠ§ €Ú°X,àìù =RQQjìkº»‘ßÿ^ZC>ù¤»±ñÖ­[Òî ³¦{sU^ž"š^\\¼fCq__ß… ÆÇÇa}C û—ùya?ø*‰»péê |’g¾{wÍ~ð†O>¡ˆ’qq8d­ž©Ç+((@µ@ ÈR2ö¯ÿŠe±‚‚‚žæʯ““È—_®–¦û¿ûY´ö _shq¿œœÜØجid¿¼ŽUrYCÑD*//zØâ"B ¬>rä§?%‹–äjƒŽô[­6222Pm ýŽäÜL ÷¦ío#0ÀcA# e'2yë-)µ™}÷]¡ÚˆòH„‡‡¯¦Ξ= Õ§§yvJÔàûï;c±$29..î©€[íÛ„jk‹ÕF*• "šW~âĉ‘‘XÇDÈô4ò»ßIS•_|A%üôôôù]Õ ¾ðÖ[aZZbµ)))‘:ñøø8T² ÚüÍ7’2Rÿ0ˆDt ͽ{÷–TU•R›¹wÞ ÑÑ« ºº®$LJj@ž"N‡.*Ìù6¡¶¶öyjŠ»½=:䜛›+uÖÉÉI 6ëç…@ û ??I iúŸÿ‘Р6ËÇ()­VaóÎÊê-999«B´iIAµ@ OIO—ömˆD !$)B´"ƒYY)©éÿàÔ±AÕ&//Oꬳ³³'Ož„j@ž’‘!)# ¢vªhÆ¥Ïò1Ÿ~*¥67ÿügŠÄÊt«ÛmæççO:544+,#Ù'Uýùçh$ÔÆÓÓSxÀؘp™†gç8ÔþóŸ’jSUU%uÖÅÅųgÏBµ@ O­).yÇŽ¡!PwwwáÈGIù6©²²’jsãÆÕ'†j@–A{ÀUT$GÑ$ÉËK«Í͛ȯ½zhŸ¤Ú}ïÒBbÒUp<=¢Ì!´ŠštË5÷ ¸YÀq‘¤ËnyàV|òxÏ Žä¯«¯«uqq±%:éÙ1ôì˜gNkKó3µ-:þNÏmu+šwñ°Í¢ Y]ü«xÓê6¬æ†:p|AAž>‰çS2ö¯y<(¼ÊY÷¬6$×)ÑýõÚT{\òƒˆed@^žà䄪 ‘HŒ‰‰Affƒ¥ò:Dd0Pµ‡=“ g¥ªg§§îÞ{°¸„ô´f8®ùdtòYÕ™ÍOKN¼š³õb³–/®ðG½¹¾>xš‹¾MÛ†nîH§1ÙY™b—<ØÂLoó«š_ÓŒùµKÀÈ-ÙW/GD‚ƒ‡‡†ômi®÷€y?ÏòÁñ>%£Fd^k[Û^ñzø°78"^ÃÁË’_â_5#Á-ÂØŒðj–Ìyš^‚°˜{÷,‰æ–V 7¬c¹nŸWç‚Ú%p*kÝÉ‚›Ú¾ÞñèŸêߪye Ú]Ñô¢×£ÚŒ$•¤Á Šr÷¡3 ‹Š¡!ä_þEj>f¨¶¶x΂8SèÒÂÜÈðÐظPUg§+³ÃÔô‰}ƒã·›Ó?ùêâÀØÄèÈðä´pÕª©Ñ^¢¥Þ·_}vô„Ö,ŽÍêÌÈÈHNa©1ÎM“ãS6¸bùA-ˆ !Äu\°ö¢{ðZÛ;§Eë#Ž`œŠÙÀÆX28^íÉá«Øº³Ã^çx´„´!ê¤ÐÌì| vOIÍÒâ¼_`(ŽŸå’Ý”T‘¤  `'øðý°‚\Ÿ€ÈÎëÏ~­ð¯/¬@p€CH…CXÍúWçªG@±÷Š»y£ó5¨G $¹Ð‘7߬¬¬Ä¨Úàp¸û½½HVÖê¡BY £€ÚôõõÍN ÜI&Ö¦¦æÙ57ê²ÎŸ9~äøYKç˯ç|qD)Ô‡©¬¨hlK¹?2=ò !6¥ÀÙPþäY¨6›{Ȧ§§‘¸WHqmMHPÓÖЀ7#¾•sø°J–_LIQ>'$ž]<*¨ß1»dÜ7pM÷Ž`cw (!­6¸4;¯pÏ¡â&ÆÇ@Øâ]<‚VÅúZ-zEüªæÎjÚz ¼°ªÅ.¥Š#/`cWGò³8¥ìЫ33ӻڽ߭£C2ŒB”•22ˆ¢ÄhÛï0£tu¥Ô¦åïÇ99¡í6hâ>ð3K¯øºh2:5ÝRzõ¸¼ÁäôtÕDÝÒy`dêvsƧý÷˜¢{7ëe~âu¥ý|Žù%¨6´|©¼}ýè -ëÄõ’Öˆ†ùVìd^Î¥†_»¨ïÃ.ýó%ŒGNÒàà ä­º;ëyrbüQ_uC«7Ȋ䦅qS³÷T·÷4#ûYìÄ´Ü{¡}sss,Nˆ{ÞÀú:#U|˧Ôp|àjnð-^…ƒ¬ÔÛBw¥îå (sŸÌÔô¬éééÝ+5w÷g”¤¬ŒÎdRVd$ 0pj~~õdLqÊ>´%9** œK@2:|JÎÚÚÚÜÔèè!Ùh' M[Ï™¹¥ÛMéÿTîñøÔÌø°½¶—ÕFÊòççfx£ûnp䪻Á[ÕÎ]ë­ëàæHgE&\¿u»¿¿\I¸šFŠi~©‡ p~mÙ¶dpfBTC`ÃK|„¸0ÓïSX»3gãrÑÜLl\‚Gh.°VÇ©˜ú‡ÍËlû×!ŒÔ»–ÜfHVpt’›»#å:mTfr—[ö£ Ö9ZÏ›ªpáÓ¤jAö¢zhH0šÝw—:9}ßÈþgß­[ ,BÕ†L&§de-&'KMX˜üÑ$§~G]&”frFË®pãÆõöëS‹H$ËBÛÞ{q énLûäë‹ý£³ãÃó¿eµáZ*ž”1Üà“}KMQaox2)0Ë.¸Â=(  ‘4þ€FÄ£pØš_L ʇEEEÚpÒz¼”YÝ° (Ù`ƒ€ø-›°|ð–Ðv䌎ƒ—‡{{ûîj4F¿I~^¶Ö˧x˜[1»Ú ”Úö¯Yô-›°ã\´öäULoÜ·‘jÏÙÑ‚Æ°²ä3Õm¬,¦¦vY/úM¢¢žQ¡ / £¨¢¼Äu7n GŽH96_}….ì"£zzzÀÉê ¢>ÿü»øÜò„@79 »©…¥x«#òºmwZ3?ùjEm´ÚäÎÝËÎβQ‘9rüâÕì¼Ûý£ûSjîÝé1´&¸¤v¯{}£E›@„î’Þs΄éœqïe|›¥¶6l£åM×y䬒’b×­›»ÁòÑ/011kí—6sm\7€ËáU0¨`åæY0°‰Hçð‹ÌØin9}vÁ•ê&ŽÝ=wæwOÍ ù¯ÿz*#?ûRUåÅf¯ÌE ºº¹õWW¯ž°`dD•€Çã-ë[œMä)]W×3¯»ñìè½Q¡£|^Í–÷änÅ9Eóá‰éù©17GvLÕÐŒ“'O_RTyöÔé¤úžWÓô±{tfqqáZY¥.9@Ѐê_î‰ Œ_ÅÁ×!´â¥|ûWYÀ7T#< ‡ÎhÚå–ÌHŒ[û¾¸wç6Õ;Œ|åfpóf$TÕ"”¸VðÓvgû”Œ¹e÷ ]bÍË Š¾:;;³ZÏîÜ¿ŸH ¥þø_SÿåÇÂòÃ¥ýõ¿ÃÃ.ëè¨kj£ÅÌÒ:Ý—úÞO––]þÕoô•TÄÇ€bï€MIËHM6Reç_+(*ÎÌÊ{Ò³r À? Ò2s‹Š‹Ó22S3²r KrssÓ²òŠJ®ƒÑ’-:~+%áJÒ”¨“÷µ`anÖ?4Ú„6M›±|ðÚ†àÂkv§å£Î5¾Út¬jAyõå &¬öeÛÕ÷@µƒû‚šÐ‘˜ôýx8è'ŽŽ&|ùkæC¨6¯ž‡îëÓ‚wm{ËŽº:¼ªy'Ÿ ÅWÛz9ô¤_"ŽQ¬[ÚWu¾¬ó5‹fŒ€¬Ì äÙÁŠ¯NmÎKøÕG®9ö˜Ú4Õ×îæcôû˜Øýk‘ýãØH †ŸÏõó_\|u3—ý‚ükö›ÎHlh¥™¥m||ü÷àØ„„ o¼‘ðÿg© ör¹‰›Íöðð¯m¢é»Ž¶L@ñ~sl$‹[îcmcooï±±±WPá³3ÓTn,x¾ï7m¶Îû ,„ÃçRR^…È£qãò›ßìIµÁEÔikª¡ƒ×L’¼ðõ}ÙŸD4J&Âá£þþþk&DÚ^znw»ÄVíç –DQÏŠ&Zk»µµõUH ª6ŸŽŽ™Ùƒjs¹NGK.šO*¶ºzöO-9ñ¢üªç÷­ñóEIÔ}Ñ /W¯^ÝéxêÆNä¶ý,5 Îƒ[-spS ‹ì¬o#>ùéÓâzPm^=“cîáYû¼ !¨ Q' £Ð±Xì£GvTp:¯_w¿Úº¯›:áØÑ‹Zf4Ñø ‘ØÜܼÃɤ’ï%üþO®¹}Pm^­ÚŒ»†fìgµA}e;/ñ|ÞàààÑ´²Ý÷ð¾[\õ>¤\³ûôÌ„I} Lf²ŒŒ€ÇÛ)…GÏI$JÍ>H8.㺱´Pm¶q2… ?DRûZmZK†Xq‚Yp½&&&¶·ªÁëôôLvn¾¹#í‚…“9„_»¯[‰‚KmìAuG©ª>ùå/éÌïçè(2âèÑ„¢ ׬^¨6¯@dæççoÜìÂSYŠæô3z„çåçÜ/ý#9}ºföT‰…:;;·±Â§''R2s1^Ñ„˜¶À$¬C¸­“ãt?Œ«¼`L4ÇØÇ*)-½ùfõgŸ1Y¬mžãƒšúð0¢©)%5KG‚¿D'e8g<€j³ÓRSV^á$¸bé—ÏoΕ£wí´¾W0ÞÆÐ9ÖØÄÕôuÇ*ŒSÙÁÎi=üÚ§©MÝríÏèUèI6!˜à2u—øè£2óï¼nÿHUU‹5;;+é nC÷ÓƒÈgŸIKͧŸ"OžŒŒŽšÚà\³BµÙÙqe!ôø&NÙ”X^€cã–ý0 ~ŸJ ·bFÅ‘wAßAÔ`¹¬6ÛRÛÀ‡tçG¸åö?/SÍ~+ÀÌܲ{/Xº–z\]üÁ»àöýÉO8ææ@mÐ[\\œ™™ÙªÎ ”µ«î-ýáÈèèèø¸‡‡‡¶±5ø&Pmvȱ¤eåQã[×LÓ´?opNëâÁoç”OŸ8sŽ!Z°¨ÍÝ»w·Å“LÍÈÆ„Õîç‘“R‰^)ñmŠ¤ R—ø¥èùÃÈx|rf&"Ê}šššZYY¹¥nîööÕi„…RóÝw@j†‡y<¸Ä:&6Pmvp2ÔÇ&ÎQ›Îú¸÷Š{nŸ*Öϳ`Ô pïmEz:ÚàJ¹¸¸lK…OOŽëý6žø…MÙàTè8Ì€&$H:á¡p¿0Uˆ°Udƒ§¾]tÎ5æò· “Õo¯©€à‘’ÚSiHY|ëm4WÞ’(ëfëŸþ4âã3uïÞåädƒ1;7·IA,-‘ßþv ©¹x™œ|ØÛëééI& ÝÕ1¾Í¶Ø`È.ÜêÅíêÄ [~ãN[¾pQ¤Ðv$´ãéí¶-¿Â%ó¾gþ4· ºv’’-ëXRR²-½±‘á>e“ÛcKMˆ¹ù .¯FøO²o¸¿&`Õ1xïD¿†åzÛHÔÆ)êÕ´eú”ÍK\…å ¡(÷*>N°­­yü:$Ï%~ñí·—$’s.Ihƒ?,——G–Ñ´µ5TE꺀‚#'':]jî§ù?MME.O;¸)+«[BµÙ9F‡ ¢ƒš·ãw5#–v–ò¦lÔò©þ1¦¼rÁ–-ß·¤_Ó†ê]:/!Y¢SÕÏY“™G=ðÝq%+ŽOå6ã8ðsÌLMØlöÂÂÂÖ‡îá÷R)—×W+G»òFÄ„ž€z„Â0Ô Û@’› ÁE¤ˆÿ:Ä'«éø\dKv?¸¯=’[]² ]¸”öµißü;ø |H©WÉ”å¤Ó•&BP!+õž¶½3§áäÝf$ÝFW˜ ÃŽŽ?©í¥!{Ïl£{¾U¶ÇÕQsÍš ¹ýßÿØÙ!ññH~>rÿ>²zþÚø8òø1ÒØ(L,¬¦¶ú„Ëçùõ¯‘ØØI),(÷ h[¹eñÄ;Bzj²[îãmi jcµ?¡`Dˆí'¤òcÍü*BËo!#êý€åg7/[~VŸÐòSZÁx¯Gj»dÚ·à.jùžÅ“þUSNWÁ-ã”þPÛŽáSŽøæ÷0»–¥¦qÉÔÊLÉ1FÐ,ì8Æ{ptéÉ‚ë>#Ç4YØ`€§°¸úÙú’`]øÛÕÓÔÆ·òH8§Aöo©M@7«VÙ„E¿rÝžálèy—[ýÝ·íý¯êÐ@ëªh°„Kç˜9¥uË+a#I~‘2ºîœÒÇòjZA%.÷µ<8y·.ªSS„W @iihbSFìXÞ¸˜›Û˜œ<&ñÆÄ¿YZKÖ.ﾋüùÏÂÕå.]B,,[[áà C‡¿ý ùàƒç½Qørr@©nݾíïïNT« @ ¹ú¸çômî©„^áB ë®4*¡ç¼ÏÔ&<$H°M-6@mlðx ÷+rš$¿&„ÔÆ¿š›S¯dD§_é´gºè»óòj}{#HÕ¡Ä€ªÖ7VUgdð3Vj·‚²±cDÙ?ZF×Í·l@^MPìšÕ«qñÉ뺨nHMîE/¿°ëôE+ßz$@d«àæå•Ïìܵc¦ö˜Ù Id0ÝÝÝ[¬s¼3w»ZÉ„jƒÃacà$ej# Ö2¤•Àd(Xy‚‹±¼¨ :Ô€úÞÇ4|+Uì8üÚ1u]z,¿òÁEGטüÓfÜaü;#{ä$1ó‰¶Ë·|ŽSôHÛÊîÌY%zwž“ÑxVÏ|s§Èlu|´è µ´]jã߀<ùË?¤œ™m,˧ýÅ/–bbæ’’’$]TpH$RGGGRz¾ëfÇÛð®=¶÷Œ2¡‡¢;žÛVê³è¦5¯2 ñÅ£Ví|½Õ&:2üy (lJmpÑ÷ðN4%r+$É"°‘ÈbÊ[x‚Kp~Ñò„€ú¾#ß©ûV«ÚûËWSÒÑe-_AÑÎ5®ø´©¯ÈògÏ;MÌÒ¶¥ù”΂HJÛÒ挌2-g:pÅò¹Yí§5("gæ™v¨¡Û5û‘‘ 5Ȩ¨¨-º7Þ_ÿÚíómp8‡ˆÛ¡­ó*ÊJ:8o«Ðv<ƒ¦`á¼D\`-ázPí= 6ˆ¶)•¤AO6Äó*ô\vlö)®°í«m^öè1bF¿Ž£»où¼oÑ#yeuC#mfv@Ór» Þ;LAÛLÅ«jêxø´ºgÅöÕpí·é7X^Jûíw&ô#ä9m8›P~ÿû%“¾ææâª*&“ |Éè x8^^^]wî CC ª®é÷7ñ+¸ù]ç” í®Ñ¢*4t M­µ³>%ÂuE+§…U^Ã^ùƒþE7müª€ÚÈ3ë®Wá(\p¯ ¹¥ßñ)vNq÷PÂ^áU-Ö/‚c€»µϾÎjÓÞÚl…®!²åûUûð®ÐÖeE]Ï2¸ 9'¯IÏ ­`ů¦Å¶íœoÃJ»klEŸ€x<~‹énºovZøfoK.Pa[™ƒ½}ø-àr°3ŽüÔßä“^u^Ævå:Æ…cέ k~rè‹ãä´GOÞIÙ ¸Ô’—߉s²ÄŒ¹àê~Ù‹vaõvÀ)M'Ÿ’>M[' 6œÂ‡¶,nù”¾‰‘U`xûWNišcœs†Á×iG0d¼ ³@Ô9µ^XÒºÑqDÀÎò\^ îÁ§ßù™˜$ÊË7üñÔ¿üËóšq6Z~ýë! ¦%!!*!ÁÕÃÙÜÊy^Ù1¬Ì¯j‘W>N ½ÆeOýòxUK~•#X¿\nÕŠ'YÔmꆺ=ÏoÞ/›”3c¡+Gl$˜ ¨^^è¶˧»ùP(dá2pŠ¿±qå—_μûîÒ‹4ç™ýo¾9øÑG%ææÎ..NNN’“¤Ô€×ââba³ÿ£GÈ'Ÿl%㸴À„3gN‘Q1`^áÖ".qE:”Pcn‰•:”xÿ¬œ“—0@Wý22NiûúeUÕp nE|²o᢯ó+Ƽ ‡¸38–‹)¿Á‘IÐs« nBÜ2øUϱ“ªÏê³6ÑÜ·ÛzÀ ‹¯Y ®m½Ýµ|§ÌA‘å/PƒRÉWAü»ä™Ú"²üòËO±æäpòï¡–ÏËë–ï'Šaù僶®a–ÞY¾s¼ò1‘Á/øULCŠ¹•‹~åƒ÷{bl‹gt!™D@¥L£áY,¬³3¢C‡ºÿøÇþ_þ²ïÃG~úÓéþpö?˜}÷] Eãï½×ÿÁ÷ûÛëùKšŒ ÇÊÊÑÙ™ ÊÊ%©0¨È ÃàÖ­[Âëqó&òñÇ[Ëo³ä_=žwÀñó-|h‰ÃS÷pO"sE¤6U:d 6ÙgµÙ­Bµ9­ÍuÉ–± i^2`Ÿ.ÑÙ š–d¾ºž‘¹ Q¨6îUAµcÚfö*–ΆŒ£*Ä€ÆÍ« S‹Åjjjú~'I9qB=ò^j©îïÇò›Öîxá7GWƒµâåê2"É]+wÊÒF~(F¾Æ^ãûøøl½Î¯ß¸iLáq«¶}°Ü®š®sú]MR +õöúýþ¼¤Ú”9ú›¢ l؉T2AZ"h4“ ^=ìì\|ÍÍõõƒuuA ÒÓÁ—»½= ŒårŸÕô<À;õôôlhh˜ž.Sˆ¤¦.ýÇl=›–Kl±6%: ‘;6ñ€,Æ=­V ž¬Š‰©ª6§´|E­ß5æw ì«•Æ>evD’MøȈŽ®ºy@›§çUï—ÙpRÏ5ò6â›{XÒöÒ¦‚ª–†êñãÇ?úè£?þñŸ~úéa Ž9rtÇŽ;¹gÎœ‘Y…¬¬¬¼¼¼Â*UVPUUMHHXk9Bñ $%t†¶ïÍ ;¨h€šg™z¥˜z¦„¶nôg #…‹t`½+jãëë»-R?33M¤»šx¥J8f{s87xî¨âüןíȯGb’nÞ=xÖ¯fñø9¦h¶ˆX"h+^ ꩬ_V‹Œ8Œb0‹‹‹ËÓ 6ÀëøâË/ÿ÷ÀŸ¿ý åÏY³KË_ÇÄ fAßa÷ÆÓÛׯznM;ß“!¸ ˜àRR­î¥BÿJO¼~þ¢2õY/¸å‘‘‘[Ÿ¼¨¯¯wKéÜoIl\3è;ÅŠ;–;àB_4"š™ ‘’777///ooïÀÀÀ @` |˜ˆˆˆH1+$ˆHJJJMMMIOÏa“Ù%Z4jiõ ¬7Þ˜ùÅ/²ˆDU3[8+óy*17=ñäÉÀÔì–!ñ÷U6ðKÃÚ9¦øQ+¶|N餙Ç999à¤K5€‹uóæÍm‰v‹+ê˜)Ýûm±oàÀ\´òeÛâ|KNÙ”Î_ÛÄÖÑÑm –¬pFÕÖÖnÃ3õúuÄÈyÿýµ'{¾ñÆèþjmM¢Ñöüð©ú\mÌÏYùIw½£•1¸/ ­‰÷FæD­_›QÜÖê‘ܾSf™x$¹ç>ûùA-ˆ©Wš†)Ö‚Á K5?Ë‹‹C§o‚ŠfêýVçÀ«Ñ$‡D+‚š?oL•»¨B\ß+%5D"]Æk3ORññÃÈ–òÞ{«Fìá<þã]V>{Ï«MvJl|Läí¡Ù’Œ+)5Â.éþû Ñ—»‡æʳ“®æ¢)Ëf‹sÒ’Šúï¶oñÞÐ ‚L»ãL(YöõÝ·Ð>>999hmK »¹ù'}ßùÙß8Èùõ¿•üêwŸü¦á‡o%}ô§Ï|Þüãwÿäç _|uò›/leN=òÝa%;K㯿:ŒÏ,æôÑïµ- Ìm÷pî>TmNùÆ)¬A¦)zËêtܾÍ7”€\™qµÒüî¸ò‚P,t¾9¦Ù?‹Ü,Šÿæë¯.§—:Ùë*Ú¹O=&˜©)ãùȦnÐËš•‘JŽkÙ® –¯Çs¶9yI—Éxf8 jù`ÛÝÝ=..NìÒlï¨Kôl#æD6·ra?,£*<´MØhƒÃ:JJ››p³²²ÚÛÛÅcðžÖ6ºqãòÖ[T›Œßÿçƒ,ÿúÿ0ÿøÓC‡™¿{¿öß÷σÿ\‘Ô~rî³/´5œœ™JçN8,kmiôÕWG À§©–™#Gæ–³ÇÕæô±oM°L µoÉj|ÜU{îÄ·F +c­‡Žù'W#È<Ù\çÐym{êØwêfÄ¡y¤».ïÒÙ“§ÎÊÊ)i7ÝÚt+1zq=|ˆñAMûÂò…3ÖSï(+]’Œ¡˜L¦@ HJJª­­í_i"Ø¡ÑÝèiš™½|J'÷Ãð—¬G—Ô´%fgf```vvVì=®-ìÊÊOh“þûÿüü»¯ºßykøýöô›o–üê?>ûæ=~ÈVS:üí7Úf8&“ª,w¨­Ù/:P¨xû#>óM½ž–]°‡W¯GRñ•O&dž†GF–û•gyíÑäØ0ص°êŠl¦yD‹…,ÍNL‹i–'ÆFÁ?Ç&¦–¶p_,Ý™›óô e$ßÞû«½ˆ&@¿¤¿2ÕRhù8®§§X¾d÷ŽN$AO>:2Œ¥{8%]g £ëf ]úåÐ#`÷ÍY[NqS·ñ l¡Âþ5K(éI¼xáÝúzäßþmãjÓù‹}ó­ÿ¿ÿ´û§ïãÿò—†÷ÞÍùãŸ|ù­‰bgcyøà×ÚfX¡Úˆ|ÁñÄá ê†X+ýƒOß[HJÏÛãjãïtôÀg 5#â ¾×^qòÛF– HTúÑXý;uÆ,^äòI!EžùOüªç_Ë©o…N‹3÷Jµ¶µ—J¬ôäÉ“ïežàjâ Œ!™gâžh+(!Ŷ²ÒîbC«ŒÜ®x î¶ÖuJ\+ºÎg¥…¶#FÎÑ¢eŽŸ'|åÊ•õÆ/¡•cbò’ùúÞÌýÕomÿß_ ÿñ‰ééãQŠ—È–¦ çeeÎ7·´9/{ÆÈÏ`PuTeäTÈT²— ÝÞÊÔÈÌ*!_8ø$!-oo¯Ì›“ÞÙûtáÑÑ'â¢ÂÚîKÊþüµœ´¨´òW`ùí­†öºŽ¦®±6þE¸Èzr75ẙWên[8 ô³ðÉÜ`(\ôª¡Ä·©ë™ 3ˆÅ–¼ú-¦ÝâÄظØX ‡'8à¦6*ÚÊ8¾oÙ$ýÝÖº®M ÷«šÛàñ¡mÈ gtEu©Ù555/J«Úýrù‡Eeäç?O=uŠÁЉD FM9!Ih#ye.?‡/¯¨˜›™žššžFÍÏ«MuuÍêÙR{$šÍvðé+Žšê뱎Ž8<G YXÛ›¾`À)›ôݦe׶±›ƒ]0¨C»¼¡¼¢‘óv¥r —¨«Õ€çì¶÷=½£££þþþ¨«`0ÊšNiw¶žßoÛÕæ¢':ïi‰uà¯þ5‹®™Îëblm¬¥f%€mOOÏË»@ \®åg?CÞyçy Bß|sV”»oðý÷Kð71!0™$:}ÍD7hÓ4“ɼ|ù²x•ä-µÔæûŸ.¥9À¿MLL‡àKš[Z[r2¶n½Û¹ê™hú¤‘{"ãj×óR€.œ(d ëÓÃTTTX,–”åƒ[»££ã{Ÿ;22D} ç›ãñJú¶n¹7—2¼…[1½í^î¹å5Œõ ñù–Ï,çoiªÐ|°Ò†pÊgìJŒ(þê:†XÌê P8®®®î-cèŸfg…£‚CC<16nýßÿmþûßAiúøãºO?ò’&#¦¥Å¶¶Æ³X ,ëÌZC@­‚øøøå¡k}:T›ïð ¿víš‹‹ GGEh˜Úò‹BÛ7šfSÊòý«ø5‹Û^™ç´muí,¼S]²;—²üàVa;>ªÉˆ¦ilganJ§ÓVÏljŽŽþÞµüùùùÞÞÞ˜˜tH-ð.ÏÈ+c#6±n8¿vÑÚ/Ï=·o{Ý[^–¥¥%p}m1Ø‹jºgUŒ/Xº+9úë;Å©m½Î¨]TÕ±µwÄJtvKV8°¨ôôôMÔÒ¶6&…B'‘ÄM\¼NÖ>ñZQà*'$$ô÷÷£C”ŸT›ïëQ *,,_X>‘@Ð54Vvà¡+w¼dY"F7R¶yî'%¾ÃØÂÜ”G¬¦žñ© Zò¦ % Oß9NƒrÑ–-o€“¹¨ffeçà°<J `‡À¥Ÿ­hÿŠ›ˆ×¯y ömmmyyyàYlfaiËÍä”N¾lC=5¾Tº-.åòv¥Jº”•&/` PhT2‘à`oG"âé4*سÎØlt¸å_¶¶Á[ÂÃÃׄ¼ú#Ä€ ÉÃÃ###C*¡ÖóHLÏc$urJFÐÂ.bîDñÞ±3KNÉ(ðôt4i¢þ×]ëÛHqïÞ=àꀧƒ“K糉Žïâ}VŒ¿¨Ís[Œ<»¯nog+ÑÖ!´|*…¼wÖÜÀ“;×1K6› â—]"5ëô¼ÇÆD«›ámx9ìâ1ñj5ëT#šÒÁ¿fñ¬¦­CpEHË64þ6!J–L+‹Õƒ®¥öAªk T8p*$]‡‡‡»»»[[[kkk®_¿þàÁqÜ´íÓÍvà÷‚ŸIØC³²²òµómP³¦ÅårÁO† ,ŸB"ØZY˜êê p#`ìéT c¥ÙPä{Óôôtµ0®ô«Ý/UƒÝrûè¡šÚºT Yª| É5k¦§§ïÞ½ ˜úúz`ü@ƒ-9Àãõ²|ɯ ž¹ Äb±/l2}6œ¤X[[ŸWÓ7÷N†`ÏÑ6pŒoÅŒ‚)ÃÀÔ»*'º ª÷u”‘·Kƒ{³lç)--¿î(åååhÓÁkÊäädAAÚF·AwØ)0] Æ^MÇHÑƃ_+”‘ç%^·ù€'²>+ZYǃÁ¬¾›€ngddˆÍ~O¿”H©çñxhöÊuž’’RWWgldxèä9#篂߲InÅ ð3ý«üªçyUsÜòi°“~¥CÞ˜|âÄq‰¸z´ úÏää佪3{XB_ë»ýæCCCÑÑÑÀÃfMÃuáóù7nÜ`2èGŽS±ótN½-´üòi`ùÀì…Æ,¿bìôÈíSwä9)ceiA_+º¦ó»8÷÷ïß/..•"D777ÔÇÃãñ¨Û ž œäp8èõ*))aÐi àRVVVճв¢¼MéÆ?¬»º©£’†®¦º …D|^2CpæLq‚@vX*æTWW'%%{ŸÍfe[>Úr öxzz§}Ë­[·Àm©*]RÕ1Ö0Ãé;º³7¡ ð^:64S%Å‹Žö¶ÀòW?dÑ°ÚßßM±‡]šõŸPsss@lûúúz{{>|Ø+âÑ£GÀs÷£oìèè• ®J^)DeŽŽ \"àqT¡DE[Øž×Ç„®îºß*² l€ðjddäñãÇÀÚ%-ì^^í} ๠tIdßd<Ìð ™D£®gù@Äâãã'&& å¿ì•( @Ò}áx9p°‡‡GOO¬mÈëkùàA™œœÌd27nù`ÛÙÙ¹¬¬lÇׯàÑÐÜÜ ‚,‹#/Éh'#ê`„……UUU½î?‚rïÞ=…IŽ•²|t¤(Ø¡Snn.Ü`¥m]p€Ôƒh«¥¥åêÕ«|>80hð êœÇã%&&644€M> stream xÚP=oà Üùo©&Œ¯­’(Q‡¶¦S”ÁŠIŠä¸ù°Õüü `•:t:Þ‰wï$ώ̹†’—Zjp{0Œ²\•9¸6´.aW÷5ˤ±ôóê/éµBãY&>%â÷¾¾ú4ä\rÁ¶nM掜‰ˆÇDWÜ Ý‘l¶Mä×€> stream xÚ¥Xß“Ó6~Ï_áášÌ\TË¿}OÚ2 à˜V±•Ø=Ù ’}!þø®,ɱsIÊѹ™ÓJþ´ûiµ»’â:Çu~™¸¦ý<Áкvbω±‹B?r²jòá“ëä0þÜqQšFήCUN%Ð2çÍäÉ“åäÇgOQy‘³\;AŠQb'J=„ÝÐYæ·éÓ_¿Z.^Ï>-Ÿwp ?ˆ<…ŸƒA7ô¹ç£c_¾_ü>Ãؾ[¨9“ÅrÌ2 cûÁCYÌ F®ç;öQ ¾|»|õvÙÙs†Õ¸È‹|øïGØà«{ƒ¯™8óÀM;MóÈGqd°0Ä­¿]¡&ŠQ†Q×™ûÐK¬â;:›{q2}þæå -½l›mی̒t°' Ãƒ¥Gf7Þ´¢ÌHC`zèN3Rkk=L¼Ö¢i¶Z¢3/œÞÍp8¥uÿ9¯å…¯ ;ùÕ˜©s-|t]Q-—õš›¹…àí¦Ð¿%¯‘Z¥ZŽQêû&X 5Ѧ—Š¾N3^U¼Ö£»ÄÙëNÃuÛJª‘MQJ=dÛƒQøülä×FQQfÅK4J±´àÒ!Û­àÄ‚wÆaÌ¡ÌøÆhÛp*kK“èF–õ¼c×Þ‡^»ö2›¯þT\uK£´‰Áîa€<ˆŽ£ÔñÓä:q€â8ìÓg¤#Áž“¸(JÂK*\Ç}äM­;ê¸i¸Ý˜Œ‚Rp0£†P˜ÆI¯XPg}R³{TßlÛUÈþò" T^@% ‚ù8ÖÞ¼šÍ#×.¾4´–åJd׿ƒˆÕâ3.*bänèÖev[“Šæùn£Xwèaì±ÊZ·:{•´ÖíÞB ÍfÞ«™Ãü›âaâÔàR£5ªù†ï©)3 uÉh³ßRƒtÓ2"tçÊô¾Ê½K_Ûºüòg¾¤Ò¢lYм<«[9á¦'ŒT²ž‚^m]—_ òÑOµ³.ºÑ0-«d0c[ZçãAÚ¥ÙÈÇàu±?iÜL-¨u=c|¹¥»D˜ñ;ÂJcr×ìØÀyÚMfÒŠßÑ“Æʈ”ÍÞ®Ošªûè$zM²’ÐŒg„…'‘ üË ì·®Tv~³Žãr¹Vð¢¢bCël­ûU7òSQ6ÀŽ]w&!ÿR?9²k“C.̬÷DÔà>Ó{ÁA½>03âÏtÕn:½ó‘bæW]\ÝœÙ0ì)‡SqG…YöbW„/ÍØrÑ|äÇé%hÅs»±¬”Í%wB`´TÞ«BÓ5iY£²ß,;+H]SvÉô-µû-û#yh¾k‹±ÎQ tgÙ1ÂjïjÓùÄxÝ%¸^w¹¥¬¬ûÜÔ¨l·H ËÂbw%c6óHï+k›×Ì,"7#f‘Ÿ[*ö}Ÿ˜±]?^‘&+æ²ü‡ªÞ ÂÊ{„dÁ[–ÛDÚQq”÷Œ4* lEÎÛÌÖi³ãâö¥ŒÃFdMÉMy°‡Bo$ã6<øÚÐâ•ùVÑŠ‹}Ï›ÚÂcPO­Y+‹~ÊjËh+¶ç‰In‰ôî Ms(rr¼=+j„.ÉŽªkQnLumY¯ËlOèb ö!tsêt˜ô13<½F)ÐÞ©ØêÑýi0 âkͧ wLf+;æR·ÕÊ“ÝT}ØŒHÜRºŸö«v½†‰'l«SÅÔ>Ž£ñWsè.ãçÏ[ªÈžq2rdœNÔ¡kò¶Úöaæ?!’FÁ…03³æziC¯·«ÑQ^sŽ+ÌØy#ÓÆIãâaž$Cjæ>ô ܶnÒjÕCŸàïöI¯îPmûÃïÄ]î˜YvK›!$ø:©éó»²Rgô-ÍfÍF y®à«ÝE=€…~vë-)ËO^ ›þÖ¡îz0Ð=Ïè7ÕCÊâûõÃäÿâ/«ÿá 5ùØÀÉwÊÅ÷Zø'Éw<¶î½ù@EDyò¹—~#R/È(¾¨îâOD¡lx{yÃk²s8ŽÒÑ/àŠ¦ØÀ” endstream endobj 1808 0 obj << /Length 1685 /Filter /FlateDecode >> stream xÚÍXKoã6¾çWÉ%,U’mÉÎmÛîE»Íº@mP0e³‘D-IÅv}‡âCËZwEw¦ræãÌ7Òw¶Žï¼½ú~sõÝ›y䬽uFÎ&sâЉ+o±ž;›Ôù|û©f$Aݹa¼ºýc¦Fok’â;7ðogjâçq¬>æ^èw›W¯7W_®Pæ;¾ðb?v’âêó£ï¤0ÿÁñ½ùzåì›U…³ˆVð›;Ÿ®~½ò5P¿ùÛ:jðð¶#5ZyQ0wâ`é­‚hRr Ê㥕ޓ± ]ë×S"|'ZÀé‚•8ò?Sv:ÓQ³öü 訑Ӌxî­ã•Ì°“Jö»^‹Bg^‹ÒkA¸ôb@û‘·Z/”ënîÜÈ÷o_—è)Çj,vzÓí–”[õA3ýW´ÝâT+”ÍtFH©‰vȲûf&ã¨/7q•j¦–tBïfO5€ ³ ššpBL[½ ’KÉ3> ;Ýr𵡭F~m¨‰¯GCJŠ¿ïP¼r Li’£¡n•ÓcK1ªÃ §¨¶ÿ JmíkM™÷å4*«1 êhÕÜR›ÓâÂìÏÿ)ËØ3|OF˜Q0 t Žº¬•|)©ß5ñ¨Yˆ lƒŒ “>JDò x{’ç&¬ú©ÂØ*3Äex2šÔjsΤ9*˜‚#ÏÎzëB´ÃBÔ/‹@Ï&‘RhÎ'´äÐÒ¨ðõJ|÷ãIR®wç¡Æëþ.Wg@!*•J -ƒÁ"OHû6™È²çÎ}iè¸WÃÉ0Gší#µ”°ªP9ç¼Ã’š Z˜, ņ·ÕRn5¬‘§èJ^´ïR&yë Ùh—ÔP|@EeÎû„mñ86¢Æã»ÈÚRS— -d\¬1ÊÚþŸ_% ®„û6Éb¬‰©gBå¶F[“?^ÕbGù»±ñ£"˜5Ò’ŸçÁå¢`4ŸhÕ¾Ô˜[;LªE%ßC¶˜0qŠ3TçÂÒlf«WÏ“)á áF‚Ij>^ÂÓQÜ?þü©€¨ê]áâ[T|Ý=;ïw$Ñ-ÓÃ6DZ:©ÏRçÙøé"Mû™³i%ÕŽàNðöj"í2ÿô0‘i_‹ƒq©ñm%˜I¬ñu~ŠœÿòÔÄŒÀ-äá†^0-bø‚Û¾«ßÞ[órá…ÑÅOÍ£oá @„ÊzAì7F†5lk&Ø¡J˜Gñ ” = oQü’ö4ÈÀfÿ9n.ö endstream endobj 1812 0 obj << /Length 1983 /Filter /FlateDecode >> stream xÚ­ksÛ6ò»'ùpÒLÄ#øf>]nÚNïÚKÝÞ‡¦ÓR$$±& íª“ `Á‡D3±ÝñŒ .»‹}/ä9{ÇsÞ\}~sõϯ‚ØÉÜ,öcçfçIìFaä$aê†YàÜ”Î/«;^¹Ì×?IW? ÊÍêMW•t½!Þꕼ¥5Í5/ë»dýëÍ·W×7Wï¯pôâ$>ÝÄKœ¢¹úåWÏ)þ­ã¹A–:÷«qÂ8…gíüxõß+¥õô7¾wÌâí›Õ8uc8 ‰Ü”Ä‹”`žD=õ ”øN 4²pQ:ÏÉ27NqÔÈe ×%dÄ%s=BÆ\÷Ivích¾D¢-•–î¬ÇœÍ$£0pIš>Þé/BOQ€¬ñ˜Ð›xsÒ$‰(K€nlÎz‡õ&ðp.Ê%¤›À÷W) š®j¶G•…A¼¯”ª{f U+™ÈC% ŒµÔ€Þyž_Ó5Y½V­~§kø·&ÑŠºÖþÃUî¬nú½¸Eo/òÖÁ­[ÚR9rVP!”ïkðÉ€Ž€cÎ%Â$cµÀU·kH¬´·<Ë£6¾c{pyêy+vêùÇ{Wû€çP¢çúq ôk¸‚'œå~à7|ÃåûN;ir¹<MHô6;3ìõC kíõó5h‹dF/jÁšZ+3¨gÓÕ²:*†$…!¬ú:¹ ÔIºi ’êœî»:çq"FCrM,ž2”â“›GËx£¢J­íÀ¤)IVßë\¤…`G{v§sÂDd,Œ8 ð¾Y(EqdÑ^ÍPJ\/-ÿŸ¿•{ž73´¢ çAZ›0ŽÜÈËÐS¢Q!!UÎQ…ÈõÃÐRÍÛrVõnš$ƒæËJÌPò3PIj±\“< dOK”¸Yœyx¬öª×èV‹i sL˜yÀ'zVy÷áñr¦ó}è]¢çÔ÷›q}GÂ-ðçÏË‚)2L „5Öú]US¥P¬v6FôËK|û`œõÃàkFò¡·îy©Q´Û¼±´éI‰³UéÈé®ú1_ü« v× ” ¹F³í@;Ò¶œ©Nýj¥ÂÌ€ZÉOæ餎B8Û–¤†ÊXµ¸Oų-ñ²¹×ùZ1m6mÙ=)4¿­¬äÉžO`›üb{—U=`׬Èëh³ýÖˆöM»C=¼´ŠcBTÛO¢qm‡s­{¬¶8½2ïŸa­Të/x%AºZçå¤YžñEל3Ž»þ—óÔ‡oÿa@‚¾$Ãå—tÛíMÌÏÖ~õúƇ¨îFŠ;ÊñćÄdiÇ‘q‰øqdK¨ +­aëJÈ%ušÞïùy%ÝåP¯`IðØÅ!o[Z/±¾¥ÖÞ¢Ÿ¡ÆÜá»YØÞÙÒœ„@'è…S K]I·ou€›sWGZWm‚"Éîèš…ittŒT¶£‡,ÐëÊòfm‡(‚‡|ßQ~ê3ÆYÄN;ßw^lsY6¢ú‹ª·~_+Å…@âÀºº´t?Ì6*r©ÂÀöùeWØÉc{ê›æ{ÆoD*Bwâx(yƤ`Ö=ØÅb µÃNÃø©—›ÚÄcÐ2ÛÜwâÐÛ j jàÄ´\L0+H¯*åäÄÔ<[j ‚²³ìz¨ö˜]%Ïw»ª˜ú“»‚½ =Û~ØûL9ž Ç!Ð;ÞœoõØ}5!ükäÍ ’ f37•¥íš­u&kTSl&BÜRz´¾…Jîv;3Î>}{|crÑ)A?eûô©áòÒZ?ˆ¡ûÄVDÕP9(ì“f†hØ%õô˜J­£)¬•ÄaH£ã%âê{ý¡«qW£ MUÞãLÅŸ" g,ßNjÎgÀ«+Íx@®“$Be^B ¨Á’Ä~È…¡¤3|}sóŠ C4ä£'Öɇ¾Wž"¦za¨Û”ç*òõ«:T­†øµÐÿFÁÓ9è?•ýžÓ9'>àgËþI<ÏM A}Fç<°7ΖðßÓ9«2 ¦—3ÚN߃Ù~!?Õ,Ÿd³dt©4ÎOe×û´Œû¦iãó\Ð8\Èõ¸kcòË8u…·ÛI?ÝäØL+œi›°ÆL5­à8“EƒÊ»Á¹öfÂÊväU+Õ©Ç:!OÖIOnhyjèÑNºµ±à‹Z+n©‹“†Ÿ Π/µ}`¯R³úÁaK×^UkqÑu¡8ê~j,E?B s¹¥Ï[ѺœËäôb–xþ#ÈZ|Œ¾‡§ÓW·Î£ß> stream xÚµX[o£8~ϯ°´M¤Ác ¦o{éŽ:š™Õ¶Ù•VÝJCÁIX`€ôòï÷ÛšK“¦m86æóñ¹|„ 9"èÓè—éèãï®BúÌGÓ  <½ÐEÓÝŒ¯WUGM4qX ÆÕ²ÒÖ§UšÈ‰CÉøƒž¸’™Œj©.f˜Nn§ŸGÓÑ…Í¢Üà P¼ÝÜ”ÀügD° ôЮZ"ÏpÍÐõèÏ1ŽLÁ?‚™ïªÕ>EÜؘ¼Úu$J0q}¤ß¾]·®YlXö–ä0ÐøzµÃ8W2.ª¤Öƒ¨’ÚÈŠù\&Ú.òõdÿm—mèÀø±’ÕÓÇ(¯ìŒ^†•Wj{àÐ5ñÿgBÿüõ˹ñYý«³·ÿpÞA€}}ê"Ÿ ÌooÈCÀ»@0eˆû cA"Ä‚pƒ@‘ú×´®mÎôv 1¡´·‹šö‡°¸•D³­À]U<»¶¹÷Lß3¹÷½ûœép:Ç'dœäuOÄ(æ4„òP¯ùI¯‰‹¼©ŠLTšÓ|®ÅL_U"SYëA”'ÖP‰­»dn"'r­²FždýA[y¡¯¹&iÝerP[BçÀÄq X^æíc»ýnKº€-;èSô·`Þk¶x9ƒ8?,Òx¡Í«+Ž§²‹qÕÛºn7h”e}OMjRã]¼ª›bi£nQ—2NgéXýˆ‰ÇMdRÁŸ1ãMžŽïf!¼ úfYÆÂ3缶¬&«çTÔ–Ž}ÃÏ8¨z1s󲜥ÆïRQ”¦Æ®tÏ ùÁËŒe;•3«Â?ÜA…ü|[g[¿.nFI’6i‘9¼Y¤–“e¤^±ß)¢»ç2+q¡h»‘™U^YFU¤ÆÇð2ã œžÄË-¥/Ô^àÑSxy½Í€— ðÛð2ƒa®FGðr[ŸŽ*7 çg̳Æƪ,Z‚܆½&‘“[±È‡¹ÍùNé rD5ø;9ÒAäH]/ÞÉ‹lÝx½DßÆl>Â+Â^?KqÞÉþUjëoLÔšŸhÀÚ€ºàCh¿ ~]DecßÖ)ÃUÆÆèoŸþ;;ÄìØÚ»ê endstream endobj 1824 0 obj << /Length 1469 /Filter /FlateDecode >> stream xÚÕZQoÛ6~÷¯ üd1GR¢$ú-íÜÅÖu·aH‹B•G,i’Ç(úßw©D²Ý8Ž½º‚DQÔ‘¼û¾;êÎÍA½ÓÞO¯, ,æ é5²\s›#×ö°-,4 ÑÕàr‘G_úÃs½Á…Ìuëb…r8¢dp¦;ÞÉXú…Ô7f˜?L_÷&ÓÞ¿= 3D‘Ë@¸]â¢`Þ»ú@Pý¯Á–ðв5G¶ãÁ5F—½ß{Ĭ–TÏòÒw ©Ž‡j!—rìQçQÉ.Lîò{é-ep!Ø!Ê Èâ˜P#"õƒué¬k³§1‹€7isÕo»®gäæ]oLš†sòÀpŽ­ ç1ì:È%ö„­Í6ŽBe\Œ>i2ŠÓÙXÙ1Š9 ‡z°LüO± Çú•,ª‘¤=è:ŠaÜ\ŽÛ’1H® ½mÁë6kÛ¦ž·¿Î7,¯$Ø;0µfù–2-Ñ``Ôqf0¸Ú÷«!åƒT¡ž“Á<-JÝJe¶0ír•ÉâL·WéB7?Ñ ? ÍË‹¸Œ²XV†Ø¥zk”DÄA æ0À{\½®‡éA¾Ÿ£ h-u' ×¯›W6¿!˜qJZù…F4€ÐߪA¿˼üŸðÿ ›Ö@£m¿ëZØátÜ-ˆUï;ÀÕc‘‘s«ˆPm|rÈÌ°îH ;­ òðÀ„hˆæi¦µÄ2Ih=èºf÷ò& n ½“xeè«/E”Ìb©Û ã™4ïDIQúI`žD…½È²4/eˆ5×1…‰ ¬ÌRªp*Ãlv‚IªL)˜š3µÒ‘ ÎÑáhdY؃j-Üš0ûúò·7ºõ*Íç~i‹ÖæÚžB̆iœZ“þ|O_d{Àu0Û!¾ˆ ÏÝáì©ê qˆ?jÌÓôHµäãø$âåÆ'}1–f°{l1ص2s«æØÊû~ËvOs5(£¹øͳç¼Üž:ÆOßÁUåwžµfFˆQ `œ2:fî˜Ì-›q~”Mœ=}ä·2)?ª@‡LPÅ‹.j»ÈƒQ—ÀN|ëƒzWõ­âØQ5NU¸ãDyý:6{4N‰MO¬€Ük·w‡ï [©³‹€«ô}:ÄyäÄûÏò´L;„¶éË·§‚™w€šÍØž‡?v¨øA¥I§Nqº”aÝÒ, OO}ˆf‰_.rùñ8¨6µÔç…/¶ë!—·§€øQÐ!G3™j§üëù/¿›è›Ó‹Üÿ„ƒt®ï/³ÕÒ‡mU7?§Ë$Ný0Jfºã<,ºè§¿”³4_uÈXçZáod¹LóôÍ4O?«ì¹j/ýB7BYÊ ìfü(ä­Ì£rõC‘Ñ–È×o篿–N~FÂo#ñ¨d8î³ê;OϼnÖC]†w±CÌQóe:Ÿ§‰Î·^ÊÍã×ã ×ó86Õ¢“,6Ù[PnT’L ù¦rOtPϯž–ù"P~yŸ.ƒõýô¸™ÀUåï°§…‰`åo¦iåoµàã¤oå˜rSæûÒ¿O¦öÇýo')ûgý‡œŒœþývÒ?Ó. c\.²XÂUwœéÇã/÷ÏMñTå «V‘É ºŽ}¤I ²×F=”‚{›l9 ‚{Î÷a`ËHÔÍSë¾ð¡´£¨™²ƒ~.öêÿ1LkÖ5Y”ù¹)&ÝøE‹kï a26…Û÷ŒYrÈøàVÕ‚kãC¯mX›Öµ PýWB®ñ¼Ån¼_©Í°ÍíƒøJø_±£ G¶¸{_Ó´øª‡¯ÔRµ½ú»“…‡±dEmÚ D8Bœ N SLl%Éx8²lÂOU±®Bž:oýÆúz¸2Ê“ÿϳuõsJMm4L•ßcl0ùsRKlN±åYu¹–ºÖžEUXò—sìö endstream endobj 1832 0 obj << /Length 1810 /Filter /FlateDecode >> stream xÚ­XÝoÛ8 Ï_at/ P»þþèÛnëº Ã­·fwÛ0¨¶’x³­L–û1ì?J”b;u{mw(ÐH$EþH‘”d×ñüØr?à{_Ã`ŸøátæZÀ°Ng,gG¯‚ØÊœ,©åÊJ|+ S'ÌkYXŸæç/s"ÈÂö“tþ±¥G§]YÐ…í¹óC$| %-ÅIàøŽ·ø²|;;YÎ~Ì<0æZ*ÄM¬¼ž}úâZÐßJ\Yj])©Ú ã~+ë|ö×Ì}°KÆ•\‰CãŠç:n +¯JZˆä¢dhB‹³A\ ԄጵmyQI÷"w~¹ð£9©:Ú/ìbðÙ÷RULÒ¯hÓ%ISà@J\T,ÿ¾q-æ¥/q²ÀG;'פÞVôXC“ÒaõNŽ¢§NìVEŽÆ÷F4 'Ñ.ª#©ç[qè;Yv¯öœ4Ò>J·÷ 4$Yò˜½—j6.ÕØ8ŽÐÝç˜Ô¶û󲕿Á¼¥ ‚áït¦£k*ÚêUI¼S /™--%6´WTp¶í5}Ì{ô,ømûæì 5+¨l$q4gyWª•ílÞÈ’çd‘†„Çé7š‹A1*€ÖÖƒË^ƒ;l±î)'—´ØSÄÍ–Êv†ó×ËåÙ¨¹<ÒZŸÒ² ¶Xµ°v¬zºy±鸉A$¢ÑZ듹؛6¬ ©©Œ–njËnw†‡3±Q»#å¦Q™N— /šc8€d„ˆ¼¼Xøî¼T7CHÆŒ½&xÎŽWˆ?¼3V ¸;0+Ù‰Á–çó€jÍC¢&Äö+ä"ÿJÖàùTð$Wzo+ ¤±ÕÚ–­"ã÷#î~mÎ@¾ÊtÂ+éc”–/Œ8oÌ.~v#—Ê=¿Ö:Èv[Éb‡";º¶×?Ë-ˆxO†›3ö½¤»“Ò6)=L•7²EøÙœE©»Ÿb³*ÄWÝH€ôÙu}Y;²ÉÁ¼\í$p€Ž@d 嬨Øz]6kd«l–b [€–(›‘’tÞêfçܺBž´[Ñ=¹3xgÀàCLEŽÜœ4*ŽèhÕ²©~W6yÕöãq4G1{@Ì+Ú¬Åf*/tÞè|-Ò;R¹o ¬¸yòæ·‚ˆ®éõ"+‡ãÉÚ·œ –³a+9Ó$´q„?/<Ï›SÞbj üíáÜ*É:òïîä÷X«5VLíFoeî€rz²\$¡º¢ûìýùpúúäùËß*P…‘ÓåSC=`²b|ÿôèïà{¥ J;t‡¥zXÚ¡É7 ì.°úÂö ®€ÅŠ¨)ä«zBÒ†±–Ž­`¹¤¯8«‘&ct¤B‰¼k…‘1w‚[•`äú‹> stream xÚµXmoÛ6þî_!øËl`bEJ”d£(¡iÖbh³ÄÛ—¶è‹–ÕÈ’KQqÒaÿ}ÇÉòk›¸µ‹¤îž;ÞöœÔñœ‹Þo“Þ³W~èŒÐ($¡3™9~"P' bŒ|g’8ï׵ȦL²¡K¢xðWÅ…]ÔY‡.ö¿š…+žsVq3ñAxøqò¦w>é}éaè9؉€(ò"gºè½ÿè9 ¬¿q<äbg¥©NÆðÌëÞŸ=Ïjëéw"uÌàꢃÆ(ľaŠbEŽ@xD[ô Œ'„­cÃðœ0ó õÅÌÛ]éˆ!㮵D>Eq,¸3Û‹ìu]'×…r&E dä…(Æu,ÏËx'ô¼Á´, >•YY¬$/¤Ë‹i™dEºµœ³"­YÊUN¡àh4¢#Üñ"•ómÎÂeWÎ"¡[+DÇ—Kn™&›!—,­ì8g@ÃfOšµ¬¸m†­.{¤,Eyÿà²ZÎA–ŠñF€à3.ë©àÕ¼I\3Ù¾‡”¸S“="*.ÝiYÞf ´,Ë[N˜ÈÚvB½LKž;&ìpÅD¡ÉöÈZ­Vû6sïÎÀHsT¬Ö^¹ß MÜ6ñQç뾨ÛN½œ¦p?!uv28 "4"ô1¼‘þ¨SÍ Ö„dYa Ùd®jìý†üƒçY™ùœ û¦œ©'ÔÙ,Ɇ‹1ÜCX&<1+y™¦-]fÁdi *nù²YÔ0†f<+Ež-–97«!”VÖ°˜Çå»ë‰ÕÔ²-¹˜³eÕ…ê¤:XyÉ’6`0 5Ñ»¥^˜§QAýði-ÙÖ„j}k(%fñ_‹BÛÀð½}uó y…ty !¸Ž„¾r`¨#jwbIŸAëB:úŠ#[ÂÎI*j}½åh`!T=ëçó;½…B¥V™œ›QQî–iëű•p4Ôm˜Ò„{ô¤ƒ&ˆ "ø§41O9h¶Ÿ»d   ÅÖúý¹”ËþØT™uØŒ(m«þ¼¬dÁ¼!íCùBI–fKTŠ´¿·Âõk‘÷ ù¸ÿûÁ³ÏP?«²ÐcaúªûÂ%(D’ ”~Ý‚Œ;ê~RÕïv…lÕy®:÷L­½8 fµGÕ'uTµÌl¹Ì3sòhmîÝôk¶ìkwŸ9þ;­ô>>˜vbZAxÇ!UzƒÐGqL¾‘’?$ záè¤tô}° [ Š£Sò±#§› òIÈ PÍ =1!“Lð[ÉÑ]ŠŠòHBŽûH}Ž%ÉÏίÏêÇ@tC×r«¥±æÓ?ªðè=êÙ1˜—ó2iq.Î'¨¡³”å´Ì[Òß'“K >Pˆ*Éd]5áè>kÚíþØÇÞO+%OH„„TÞqŒCµäûû†Ýë+D>éiSuLÅ먊ð…ƒ—o¯7š‰S: =QÒ^eB7©Þ»BÖ}eMxʢФ¾.Œºî ]𪂬·š›»œN›ŽóƾS p`¯¸P°v býîKÍŃz…6Uò¾_ç,éhü¼à¼1•9‚–pßÕõäÅ~ äÛ„På³#åŠWe-¦vW|Z {ȽÂÆßÔ3X&fÝ[.Xãs ëQüä½ ±å±ÃšM†±7âÚYžÁÇß^ÛÁåäê4-áŠÏ*ùÒüµ¡²ñwÙä“û­×Ü\ª279`}/Ë“4–2ïè;út-¸«mXºdëœ3âfMLÛ» Õi½Ia> stream xÚÅXmoÛ6þî_!øKe ¢IŠ¤$ý­]ÖK»Æ$AªÚ´­F–‰Š—5ýï;ŠTüÚ4Ž-LŠ<ÞQwϽ ;c;Ç­_ú­îo¾p" *œþÈ ¨°±ÈwúCçÌ=­Šd«¸ãÑ t?•²0³ã*ÊŽG°ûÒ,|”©ŒKi|Dé\ôßµÞô[×-°C s†8ƒiëì;CXç`äG¡3¯©¦!Œ©sÚú³…íEq½WŒ3ùx¼ÄU„Hß G!r@xÀ﹯ð u¼:¡ì!ب‡ZÄÑÿp13‹m®,‰‰&dYŒ^g¢ lÒmå¼PÆêX[QP'+ ÖX FÌX±=ÌÊv¯ã ŒÝoÚ.%ˆ“È¢ˆG–JÝÎdCÖ¾®dqÛ~YSã5ÂdØøÁÛ‰Š"‹§ ~jž(% 4ȧí0hµë}oÛ%¿×°Ú¦œu„¬@3‘0|‚…7€&X€"ÊwÚŠ¥ühÕßPÐøÛ›¿ãé,Õnı›Ì›áõÉ©}ÎÊyíˆ0­NšU3¾ýpÃÌìs\È2¯ŠåXÈA^ Í\+ÛÌ>wBìu!î 8CZUY¯Ö÷O´Ûh†b$h°— rŸ€„(Œ#ûxà’”e4|。ˆtüéh¬ü€Â÷ÂMßÛÎQ©´Ý  mâ^‰"D"\ ñ|Ž¼3N6ÐÊ} ˆ‹žâÇbˆZ*|}BÔo°¹øq‘a çÔbƒE<°.c³æ»Ó÷'föùëõ 3³ñ ´^hįÅ0e P~ý‰æ'ˆûõZÔUyžš•¤4ãM‡p»ٯJ9ª,Å(/ÌäºJW©¥˜ÅE™dc³gC³zŽ1MVI‡¸f“6ïdõ®,QÇóƒKÙš×X®Þfg*N2»Ó¡Ü‹$¯ì¶Ô—mÔP¯ÔqH'¹¦ßc²Ö±QB¢L4Qñ‹uð²ÃõÈÙ9/:œ»¥Y{ct„¾–y†î%@ä÷ýe5kÎq™ 쩸°‹Ã¤T彬‰,doņ¸óCË“žç”ò*@јb`pÀà¾Úú"Í9ó8xßD©YÙëvçóyGp•*žV¥—I5ï@±–W¥Ž]Š ïbÞ%a7Íó+0®+¯´Šðô[{Rkר!S¥+pr æ÷Ò$“ݵ‹>Ö#Ö N¯Ñøs£‡_ó4/’êúÒ:G^©Y¥Ve>*)ùA€¦{%%_@= iãÁ`C€I´WVZ³œ•,ãä%ŠŸY¼Û¥&j{#3ÊyótgHj¢ϱ ý³_ß]«›Æàó„þ71|¥jó¡j ™¦2”žüõúýGoOž‚SxSÊø^8¥z)gÏÓ%1χSÌ ÙÏpz· ›%ô¢¥«_u*ùP¾zÕnŒÓÖ5îþðÝ]Ù6×,0çÿ|©( m²ü”%ÐíÿÞïXoöÆ&Cx°)'¤öë ¨/à€xv`/Ä<°)#u“Tk’ícân¹Àö:»¸C:Í×?—PÏ—PReêân\äÕìòËm| ò»i<Óß®ämá‹—7qZÉ^Mp—Êl¬&šî{M<*òé%0*YÀ=v6Ù&r€‰‚ƒuÚ”„ úÓº-¶EÙ.e–Oe–m¬tÝX—UÓX©z¯¼ …—ªÊ®€~Àƒk‚ðà0e¶“Í?÷_èªæܨCu¹gìæ$/ŸRA‘#íçÀ„éŽça0P îã¿ )ËîkùÆ}¡éF¡/6òRÕ7üíèÍÖ?—ÍÔ¥nÆ!cAÙ>JóyÛ¨/=ACYªËd$‚ t !¶NkÈA_n•öbpëx8Ô¢î²j:šÚpãy*•ÈÁ¶vXïçú;{rÀî¡!bÄ~ë8ɸ}íÆ÷Ý¡q›Å§¶4W«Ÿà¦ršC¿¬[*sôYÂÇì Ìš•3C^,Bç”Aì (%,ô9]óa3®içPNŠGhßZ$0]ŸÛV¢ „2/dû´I> stream xÚÅX[oÛ6~÷¯ „ °˜åM·¡Ðm½¢ÛºÔ}J‚B±i[­"ªU¯Xößwx‘cÙ^â$Í?ð&¿sç9A DЋÁO“Á£ç(p$ˆ¢˜¸À1‰ÑôbprFÐ Ö_#‚yš •ÝuD”ÀX wƒ?ÄKK0! f7»#ŠjøcgñxŸ^†+%˜ðØ©ô«*s­¼Uf2ÔnªænÔK¯I£3ÝXMÖ¢X1 {û–=£G”£(XðôZ=c0E®uía$”¡(N±Éu°@Rê!(2?Í ÛîÊ›J7Ù˜usœÆI\K4ß‹|eþh1”€"á%ç€ïF㈀ɳ¼pÔxîFùEâ*ÝìÒ ?ûMS7ž‚#¶©>%!Áp¦Ôô×J>yXo°N/±¥ñLNÕLÖæõâ>=®õg(8¦IrgìÆ@0q«˜øFñ‰”pÖU6Ï…÷ÓBöâÿ“êwˆvNq˜ÐûE;…ë'¥íWl.ÚÅ £ÎÞp{ÝõáQžÓ´ò*ûZ¨lf¶_žÃý 3v‘Ï ¿µOvC xÊþ‡ áÎáŒ9/LF ªÊE9%>Úe£ó2Ó¹qŠYx;°ËgÄ]®ýƘ‰{%BrsþЉ°ÁæÁ! ÍTÜ*H€y¡V.þOpU+­ŽÜ¸íý¡Rµ>³ Ñå™´e¾f°±>.ëË¥ÌfÝ "ã^ s{ßí†@„\ü7 ¢p^óî‚© ¡s×›Ö7}¿·ºju/àlº‘l8:ö¹ö›Òò‡Ñ˜Cs¨—y(!Fk!UÊ ‡+7q\€h¦u^A6.Ü4A ~1¡KÈÎ vn“e…j°cóJ»ÕU^Ž:—×â䥡MÅN³ƒMçìFq†Ì+Ï9N¢®a¶ztÍcÝNu[Ë›Œ^ˆ¼ÙŸnšÃÑ3yJ+¥·¤ð¦hË©¹¹oêºÚ#Xê¶òt¡GŒÙÒÁå,x‚Æ4Æ)÷œ2öwŒCâ8$Ø9 T£áp‘7ZÖ^¼ÕRÖÞÊ®‹ÞÒf©Ô§¦ó‚V[;_-ËE^ömg¬eee×Ëj-°-ìLu&¬d½ËN/k{¬-¸Ÿó V{oó…¥Å:°;·Ý Ü»p  //ÏÒ›\z—Ÿý™]Tä©csHqãä<‰îUÜL•Ioè¢Y(ìezâvÅf³¶uÀߦ¸q /‚®¸­ n ‰ó’+c!ÉêEcª•u´†!MÁnÿ *Ô4óO¡RÊYãÈ'nøëo{ŽôØ}'­~SUg½3ÁRë*Øw®†À®ËM^6BöI%ËY‡§Ýû¡¯©O´ƒUç…,³ Ù÷ÝÏoÔâm¦—Âwå{mý °G9ÞΚZeƒš+¬*Y²Á7 Af[‰µÔ¦W×Êöªœ+s4x9™¼uÇÞ˜<7ÄóžF[’v¼vнÄÆO=‰É=ýwÍA~0Œ?´uÞcþ_H},?·ÐH½¯óãlµvÉésÿnßóhe÷¼‡Ë½\ Â#xÜ–ŸJµ* ®ÌÁþÕ7âA†û/šöܨÓíéàûiБ8ØÔÕš9Þ^ªF_c±—ð÷ÁöÚÀºµÁv䛥«0ìÙïîíìíoë¢qz·o~ì}?f,:øóáÞw¡€¦úþ2ÌLª2¶¯ßE"¤Pñ ùó»ã¸W•Áfÿ0£ endstream endobj 1867 0 obj << /Length 1428 /Filter /FlateDecode >> stream xÚ½XmoÛ6þî_!Øfw5CŠ¢(y[.X“Ú%î‡! 6E¢!²¤JÔŒnØßQ¤lIVœ:Ù†u:>÷~<[+ [g££“WÔµ|件k-–·-îxÈñ©µˆ¬«ÉeUÄa ƒéÌæÞäC) ½:«âHLgOžkÂ…HDP ýB‘ÈôzñfôÓbôiD@¶ˆwÇÜ ×£«klE@caD}ÏÚÔ\kËq=x&Öåè—6Šâú[±²ôâ⬅êzÈ%Ôâ„!¸‘9çl‹ÞÁðˆm9Œ NÈ! lÙ.E>fƒXê4Ó ÐlŸÒ’ã# ø-9Šîp@äÞ¹Ör·ãæÚ–qs7Ÿ"F|‹cy¾£c'ÒHÅv@œÏ|M¾•2ÿí6+åtæb<ùA?JYÄé ­Êêæ#fxËô\Ž›%i m‚|âµ « |´3!/ħJ”ò\‘(”„±J¦ÙË•He¯­j¼Ô]\œÆ‰^È[‘Ö»AfÛÓhü}¢%Yªô.Í6é‹q2€9äÊú#«`ëÆÕ!7r +Ëâåéû ¼r¯Åe®€ïõYþ‡(ŒŒ²ãܬ£Rn×y‘ɬáÙ2ä=©¯’l³¨òDôŵC¾Œ1ß±z›âmôGȘÚy4Ô^ö˜¯tDmŒ§`!b®1ðÙ³úØÌ]«E¿¾_ 4±Bñeî}BÀ±‡¤Ô)CmqÏ?ƒ’9C‚þxëê÷Ìû<ù ³ƒ–x.Âœw ©Sç)QŸá#¡NºKñåÈe=ÕɳLªòöPŠ)?vRsGøV?È®p‰oå¶KlY¥¡Œ³Ô(/â4–»ŠU¹Õfõòôm¶z.³ÝžñùbñÞ4¤"HË Æ7•d«•ˆæ÷f¨öÝP5× “¬¬‹P½íl«‰§·A.›_¾ˆ­ævÛž¼Óc]O¹µè& endstream endobj 1874 0 obj << /Length 1275 /Filter /FlateDecode >> stream xÚÍYMoã6½ûW9Ù@Ìðû#@ÛÅnÐÅM÷”ä ز+Ä–TYníoïH¤)rŒÈ²›"@DÑœ7ô¼7ä&hºü8\|å YlSh2G\+,…DZ,,G“ºÞn²häÁhÌ´þº3׺ÚD³p4¦dxî:nÂe¬C÷Â1Ãtô0ù6ø2ü> à‘ Š4p5ÑhºÜ=4ƒþoˆ`n z*G­PžKt;øe@ülIùY¶@®qsUCU+Ê‘¦ªö"kp®e…ÞÀ0”Áƒb#Ì> ‚8Ǧè (*þ`b®k÷ÔÜXL(­»)ú…æØj³ÎB4߉üŒæ³¤R1d€J% *‹@…ŽÅù&žæQÆŠá2YÜI‚l±†gÉbKjŠ­´Îj™Lƒ¥3Y‡Ós×Ú@Óµ~pÛÏ×Áô1Ì'Ñ*\çÁ*-°+Üñ.à0ž•âØõ_óÜScà©%—B ÛE.UÜ1…Œ!˜)^X¨ò+´;ov%0^±4>½>_8Ó#CÄÛ<‹âE ­G±5aàC9O³¤,©Q h#HL@q9|A,Çä‰{.ÂÜwüºFZÙ­ý'`êZë@¿²›'Ù*È/GcÆ”^0qÁ±cj.¥¾dSm²þ íåwË U˜t㦕ÊÒR ~÷K¢Bí“Ê57õTöÀÇIeE4ˆK÷Iå‚Ò7rÖ‰£ž´‡çe÷ ·¸/ ¤ýˆ¼”ò’Ù7sdaíK—a#/ß'ç":–Ó~ræ–«ý¥Ëz©¹òR³Ç=Ž˜%—Vå(ý#ÌüƲΦQêÛ³u^µÓ,É“í˜j@êxÀ&Zý+énôÀìÐW~8ßYåAÁì‘R +Qm¹‚ÂÌ5Ýî­xy^&Áì€4†Á¬y¯4 Taè©ó ææd‰P€é£}\9_%GÇt÷·™fØ#iJaÛ“leXnsA¾'„'Eôtˆz©ÅŠ±^êå JR®ö‡RJ¬Œê£Þš›ºz=ð‘Ô ÕÅΊ$Š£Üµºž1â0œ5Ë”¿þ.íHÓ¤ww–?§áÙCcüÙ|™<í²ÉÂ|“Åu?§;œtg¹%¶Brý{çp¿|]º„yã\ò¾ÔáÅÉ\÷Ë°ÔæÔë~ÍÍÉÖ}s+|„áÀœåùúH«?°õtì’¾{äÛü×QÒ3 ŸÛRsbžI˜)íWÌ3IÆN-æ/'Ó2kó¿)æKý¯”ïLS[,€ÀØGŸXL%}-üOiúÝÕðåEOv/@É{n›¤C»Ú^Ë’Mÿ²nßͳdõê®È•`¬(Á”bwgôÓ|`äã$ßšJòæ%­eÇcìâsoẽޛß3Æ7q5^®  ÇrÏýåÏ`¹ìpKE¥†=¼ß¾f 6‚ï—˜Rp ”}V‚/õ•Àãg% Â`½•ÈawTý‹ª"§KÙ>r…Ï×˯ʼhîÌPÿx¬8ò…&¨1®fÁš)È·^¿: æuöÖÄ4 ÆU“ÒÒ©-.$»OðÏÆ/8°ÿ1õîpv_40L©?”Q†¬p´~ßøŸ™~Þäé&/ƒ*$ÅÜÀrçGkÛXª dÿ´=Ûe endstream endobj 1885 0 obj << /Length 1355 /Filter /FlateDecode >> stream xÚÅXmoÛ6þî_AøËl æHJ¤¤½X‹6iaXš}J‹B±éH¨,ª•4ößw)E²/ŽÓLŠº7òîž;Š +DÐÉäÅùäÇמ@Žè|†?Ä~ä¡óº˜½«Ëtëx¾`A8û«’¥ÔéJΔ̞م3™É¸’öÁà Óù‡ó·“Wç“Ï Ê¢V¸ åfrñ ¬¿E{Qˆnª òEc†ÞMþœg(Áì#˜ ÏP ŠJx±³xvß–(ÁÄ Ü–^¾ÎÔœòÙÍi\ý–5;"3]5ö¶ AFÔ“AЂù ‚[gR×e^#β–v–®íøžOÍh°ÏIìHcЦ+l4‘4À‘çúÕ—xSdò'g…ù™-6?ØÖàEˆõà!Ž"º÷,8î€wç9R†xžòÅ> …ÏŠÌl³°mw¥§&„Ҿ³îŽ‚°\J´•Ü¹klœ,‚ý á;' N†ØiŽs]çKª|¾„Ì2uõžp—WŒMd"F1§8àˆ;.pÔGë#Ë÷«šˆi£E¤Cœ„ÈJ0!`X¶%éDæZ6äY,,ÍJÙ±R©“4¿j#2_ݽë61|9zœ{Êû¦aøˆ˜Ø MQùÁ!¡ùD©ÎPí¦ú;?,Ã…å<‘ºMïÄew/?Íð¤vÉ çÜL.oµ#Yª:oùŠX†h ø àœ°ov\‚S‡ÝïL !;*ÁïÔôÜ ~šç4Ä̺GWË\?s©UTíÓ²÷fÙ¼±'Ž}0¬ûkbj°Ö  —õý8q‹š0êçÿYv°cvã^ }›,£Ñ€Èú u˜CœDëâ€Üz“§.…nRRñ|_@Pó£‹HcùÞsç‹P“=5ý„p‚Ÿ&!|/ÀaÛ© +^Úœ±™í/|΃™ZÆ™¥Ï¥\ Ëß?ÿŽUº†îbZ”J«¥Ê¦|:¹OŸ”„p¯ñîZôÖacØñƒ¾mlÉrÂò4ùÖ± !ã†LiÃÙ>×ù§\Ýäϧ_‹vôN¸º_½HäÆÁ·Qî=øÓè(Dù`uùpÕœž6DÀÖ,¾LâB·qIḛýQë¢ÙY6 endstream endobj 1767 0 obj << /Type /ObjStm /N 100 /First 978 /Length 1690 /Filter /FlateDecode >> stream xÚÅYmo7þž_áP)^ÛãñK!m¤VE H´Q„.ÉB$»ÑÝ^Cÿ}Ÿñè½Ànî¢D*eöüÌxfüÌøCPFÙHy+g•þŽøÈ^9g•#–¤\t2â1‰”gщÐÍ2”œbwðKT!ŠVL*e±Ÿ¼²†Ä ~6s.+kmQƒ[L¦¤¬K2¿(‘(Å•õ¢áål`_\ ŽYÔÄTÌøL¸d ›ƒ 䨜1^~s8‹',c€´á£鋃‘w€’¸m¼@aRVÎç2CPŽIF-p¡Ì`a.bH°=‰„8KèÉå’D‘,ìe0‡ÍŠæÞ9ÉË(òM&+A‘ubÿ#7DZ"’9<‰TæpÀ•L%•L%— ™©!6â½s¼øL˜#8ù ) X49  Ár*¯’—´"C”%ˉ²ò¦èz)$ÌâxkdÔ;HlD>e+ ‰#‰ÈC—¬øŒP½Ÿã0b‘¢ò‰ÅŠMñ”A(“À¨z0¨!¿yHAfcVì¬èBpQÜe'dL ‰¢ÌŒÐRF,³p.Xf/V@V9„Á S„XŒDű¸ŒÜpa`B%p*SÀ Î$£ˆ€s”QÌŒå9ƒa‘àE°$ËâG Å2Šb™S Õˆ%¹1C*ŒNFOâ(Ê$ø$á‚‘ N¤ ¾€À½½ê¥:FÁzö¡ªÞýù—‚S‘£–¨›ÙååÉγgøªm:µ·§ªWX%*­àPa¬z=iÏŽêN«êõËWªzSîÔWµ7ÿ^×}¬wª0Q7ÝTŠÝˆþNuXOÛÙ䬞ÎÛFùí÷ú|¿7µn¯ëfÜ|h§õÙ‡vÖœ¯ÛÉÇêzÒ~ÂÜÓj:›ŒÏFݨº_Œ«·§³¦›½?h¦Ýèò²ÀŸ"¦uaݺ¤ŠO룴åãK”è{":˜Ó,{¤IÚ í2‘ö1·_–úHU¿´oZ–<™ÎN忺ú“¶Þ?Ußü)4Jn`-×ÔÑ:7F{ìÇw/8éòf}õ½ûãTr_L\Y[N$ùÇÔl~ÑOñ¼†âqó"MiÃ"Ý"Q|¾ÅÊ·œ„û–óP ÷“¯¼¦©å-šZö÷”¯¦ÈÉ¡3Û¯)‘ݾÝSJÖP(oA¡œ¸Ï'³Úç“Øç“áåäx=¨Å,¿Ób–AIãÚÃæ@µ¢í÷þdÒšŒ†-27.“ûǺÕp¬Ù<kdˆ@°ñË•­èØã$ïš &lž­5‹o·X|‡f+(§%” Ž S&ίfʹÍ3åh`¦€òNaÐS|?w4͸ömÚãFÙ´°8ÄÇu°ChZSþ´EùÓÐò§¥òGRƒ €ÑhyÝ/÷×ÝOÓ¶Ù­ÿ‘¤íB‚ÆÕ¨9ß½Ä=¸úÞ¶?6kp%wI9ë$¸EرÑÉMðîÑu7㮫'%¢«Q×&ͨ­o7›V 8ŽFèÜd8nî¹#£ƒ< ÃSë‚=A^R ×ð·óüú¢{?n¦×˜©|óžÙ):¤+»§‹wuy#Vú~ñÍ‹-eô&|¡H>ê8è’,|D{ÊÖ#Vïlòº»qæ4p¡€ß;¢-B`-ÿ6Ò4N;æ~ SB¯ô8pÓò1æ¡)ÄÕE ¼ù"}ñ´w‘€HEœ¹è‚+ͯh‘ÿå ÷¡²ל¹£Û<«qè™;Ò«£f;Èä‹Òõhííp èå¹êkol?Ð¥¤ÑÊ]Ô&ùÇYú´úx—Ýyéÿ3k6b endstream endobj 1895 0 obj << /Length 1020 /Filter /FlateDecode >> stream xÚÝ™]oÛ6†ïý+_9ÀrÆï­°[Š¢Ø°Ä½êŠA¨•F˜£¤ú˜ýúJt"EŠRÉV ¾DKï!Ÿ—¤(J>J.?¯ßþ*4qà4×d}M„Ñ ¤"FZNõ†¼_]•Yò1*¢³snìê]gõÙE™lâ³sFWßÔ—ñ6Žò¸¾À}X¿Yü²^|^0ŒH #†£¸C ùx»xÿ’ –¿!„³dWÝuK¤¶xÜ’«Å jKa%)p-üÝš‘ ÿè^öµËGe¨0u“^ÅýE\\ÆŸË8/^ÇÑåëú¬ªˆPýP´Õ mA3A´“ …l‰ÁÆõК–†eœhé@¡Ö€%>cÜ FüëVŸ`ݺ%0(cÍ0¾\Îؽp“ë^åÇ|´UŠ5'S¬eH±¶ c„ß`Šÿ*Méê‡úЗö?©¢KÕùOŸâ´Xâu… †A´À)Wë%×µF[7§É¶>)nâ´zš3¬ŠkKôUiùªÄØ‘]”éßéÝ.ýqYÉœ÷éÄ馂¥/]ƒØ()€Y;¡Ï»è¡„–xŠÞ‘Œ¤™.å#å÷wiOwe ¥>ÈIÊ|@ g•K@ÀqR#LÓIAø8NRŽcç‡#Ÿÿø1·ÏHÍ´WNºªn®\ô}Ÿî³dOzãþï‚ê@}¬?HMç}|ÏtñÌéðŽó!ÞÛ;q¼MÒx슣ý¹= vª§ÙÙa 3윂¦ºNp¶˜1|¾=µ]ºm?ÝṺÄ?Ýz¶=ä£{¤ JPãN¹ïXJ]ï >‘r© HDèÊ¥ÀÜj67å0³Q.ý’Ú† gùvh<žs÷çõƒ/‚žƒôñ½Ò…CpL;锂u¼MztÆÔj×~À’|öÁÜɃ°Çú•bnìafÃÞ¿Q ÒÝôRµ3ŸC?ÚÕW­±>(=ã‚›#˜`|uQш¢”'0ඒí5Ak)?Õ ³d[Ïs‹$q=· aæs•À•|ÑÍÔçãV:6hNóû`|/u`ñþU÷ëû€+ Zõ®íßeIpÄü¹ÄÁA¶1„o;ÀÄìC0³m qœí™hm eÉÀ:¿ÊýnÏÿË»Ab¶ƒžTdùêklïÛbÌ)pâ@L °Z>cšßî²Ûh›ü[m Ç› æa¸Ræú°¹ƒQbxgö(æy 3›y˜p öûm_fž}Ä›ÿ³‡Fwq—4”`ÓÖ_áØú°¡p’×_ü]£ÿíJVËŒ÷35ç«·eøúò{YÜ—E•U©‹f w[Öòæì?O» endstream endobj 1908 0 obj << /Length 1026 /Filter /FlateDecode >> stream xÚÝX[oÛ6~÷¯ üä Çû¥ÃdMš¢ â¸(Š,´H^8²*Ñ-ú²ß¾#Qµu‹–Øñ–†AùˆüÎ…çã'‹ ¿Ag£ßf£Ÿ^s…,¶Š)4›#Í ËÑ,DW“ËUß.88bÚLÞçQæ¯ÎVqQ29ô†i´ˆ‚<ò?8f˜\ÏÞŽNg£O# ΢\`M4º¹]]‚ý-"˜[ƒ¾”³îPƺ]ŒH(Áâ#˜)^ÌVep£cœÞ—%˜píSzã\z¹iôiåîM„•“¼ xí±Œ¦ðR~¹‘Š2XQŽ”Xp;˜Ž†Œµ\§ÔÀ0”!%,–€5€APQ6¦+ŠŠÄæ/ ¶®¥æÆbBiÝMašc«Í7à,Bó^äM=šcYgÅ:+QÕY >ª:CÏ(B&¿ø¡¯êùïDøÒŸ‹Ò,ô¶Òúõóeæ—&‡~üì‡8ñcÄ!( ¼-\–HŒB¶ —fqâŠéÉáçrA1ñ¨of”„e+ôc°)¤à˜³ÅŽv ø0D»±žˆ+ŠjÌ„hq%O—IíHB±j'²H©°¦vßd©¹ÙY¤e€&ÉR/ûÊ–Çoi§³ Éþ²P ¹ƒ³jÃB_Š“w—MZ<¼ECØ[&7%>Ir膋U”ÅÑ6Äök'Úqi!`6¼GÚŽhWsS§]ü4´š– eeÃ$ÿ)ûÚ _£Þý¬«ÖÇóŠIMœ¿+ $^ø w%÷r­C]wu×^z)Ìš¨Y–wQ#/w5öÖñuß’eîkÚYQØ6óÁ‘¥¦vFøyEtã‹÷§Ó/½aìŒ+œ¼ù{Ü;«rkæ•OSh ûac©ª¨_¼(oA"ȹ±_ßãb“c¯ J4–Vmç¢<$9‡~c­=ÏÎOÎÇ~–›2˳›8m9xÙž“öFpôko"pj(kšy„¹ûW/aºQ 4Õ¦W1ö$'?ª:çeAÔVzâUÂ6©¸€«?TYäVYt`’ª_ .øsùËå¼fªÎúT„Slt]DŽÁ5<¾}Ùþ)ŽYŽÅãŠÓ‘ª6p"ïg¥e=©ùièI…ü4‚ÂŒÀRlô$Hr(oÞ£(ÇþÎàs\]QH{Ô”`×ÿ¤*uIunÑ™ìS ãw—N§û• É°‘Ï]‚àq™“VK¬ ÛëTr¬íóÒ¼’ßþlq¶uÎØC)ùdDÃ’?:àd²r·Ë,vÝ¿3~l¿5”Ü<ø¥aïk ¨å)¡†• À¡†–•ÆW·Aê¾½Þ¤¬è%Æ&ç+—®\#Hîbÿ¼ endstream endobj 1918 0 obj << /Length 1340 /Filter /FlateDecode >> stream xÚ½XÛnã6}÷W~² Ë‹H‰)Z`»IÓ,¶ ê8E6(›vÔ*’KQ»½ ýöŽDÚ–lÙñ­E¦F3Þ9CaoêaïºóÍ°óÅ·LxIA…7œx,ˆûÜ üù’yñ÷л+t<ŠLÔ?§Aػϕ¶³ë"«þ9Á½3»0P‰Šre0Dé?ßw®†ß:,bxå> pà^:ØÃú{#&Cïs%õâù"„1ñî:?v°óWÏôÔ³“ÁuM«‘ Ì G![5`<à í !¡ÁsnÓÒŒV+VñÊ?ðÌNÀ³õ•š‰0!u;åº0$ƒp¡Y+oÒªzŽæX%SP/„d ¿Lfj,P(}›Çqšÿæ¹.0î}e‡Ë4¿Væ-,g:6±Ê?bŽáŸ|Yæ4C~‘äÒªˆ'ö­¦ªœ®4NìÄ<«´zĉlê˜dÚ‰Ÿ9i;Ä©gQ¬+/æFJoœÙl¡•6•jF/ª±3óе«ÝǶ­hmþ˜­½Q®µË“¬ ›d) NIHg%;ÓqêvUn¤ûö~øÝíàføÓ…]ìÚ!§*oþî¶JÕ·¸"ù`Ã'XJn#.œ×oÞT`#l¤öàqƒePZm .ƒm”bçL`äûá†è¶Zå 2ÜdT¼¾¯\âÙŠ‹U™Y«ç_·îBøˆóù&\ÚǹyÕÊxVçJ—ˆ+PéØ>lƒŽ{ØZV‹c£êrŸ!†‡·µ"[êÀàÙE¶Q£˜¬Ô(¡ ÃÀ¡R™B§€Êq/²ƒ‰že§Ù¤¶”W±Àˆ€*Œ¨`¥¢ŠËú"Dd…볌 kÙÂÁ(N«ôn¤FdçA!@˜Ì?Šy|AÛ΋¢…$=ŠxjfêÄ㟆w8–pz©ËiÓuÒ©b½ÝÔ5ìÅ5ö8YAü*®Vͯ”qíü%Çapÿ4¯¶Ry¥ƒÚ‚¾Oá ðÍL 7É ÄdjçŸã²¨àøìð©´.Ù½œ¾¨<¦êÌ×­–i;j˜U£B÷ ïåq–^ª<Öj|„™„Þ—Ò£ ÌZàÛsË€ÍÄQ®™©CØ)> „Y Ñ„a-ܵPÏÜħхÚ «ÒàêÝýàîæögñêîfpuÙ]ræB‹û§mýô€ ¶]Å^dpI¢”m†äS–%}*‡öÙa‰‹®N?Ü5`³âTÙãú ÊŠ›® Qÿ©–Õཿ Üh ÐçGÁ–M·x¥’r$Bq Ú–V|iõžlUë>Ïö¤HGð5¿Å5€Dzš/ÀІ…$EŽS¥Æyƒwÿú»æ*¹‡îLg&e啦þN×$y·õUãVkj á‰ºw¢×hàsw€­PÜ ²Âu™Ã¤,¡ïªO(PoÒIÆlÜ9zþ>úµO€i-êFJ›ø#Æt·§pÃ~‰ì ²L|êSÞ‹âdÙK›l…¼ó‘Žgf¾¨³bêè}átéo†‡!@’¹3{õ{ô2KÔ>€0‰¨ÏŽ*AyS‘ÛÏ…H@9¢,­Ô €Ó{š@¸MI[H²éøÿ¤*nvŸVòâé52îWœç…ÒîÇú8¥küëðÞLö‚Ü·tçÎä.ý9Ý©=§ÿç•xï#´þÕ‘""ºÏÇÆçQÄ/vþ:ÚZr 'óÛ¡ˆ–ß(í}(Ü7ÜÛÂÌ SÕçp ¡†9é5j„ì_†õÿM endstream endobj 1926 0 obj << /Length 915 /Filter /FlateDecode >> stream xÚÕ˜KsÛ6ÇïúŸ¤™Áû‘™^’Iä’4R{q}`%Èâ M¹$eç1ýî] L=G²Ì6À ìîoV$ètÙ{=î½ü•+d±UL¡ñ i†´0XXŽÆStÕ-‹t’TÉ`È´éÿ^º"ô.—éÔ †”ô_„Ï.sIéÂŽ¦ƒëñ‡ÞÛqïï…Í¢A\`M4šÜö®® šÂøD0·=Ô³n‘PÚ z¿õH4”` öÌ÷³E¼Øüüx$J±•’5g¢®ã™FïjÛq˜o[W@Ð “aöû<­Ò$K¿ù³IÒH«ù«¸Þ?ÞúÍ×N« V”#¥–D<±†KÑruê5 CRŒ`Åè! ‚¤Äʨ(A‘À¶ÐÛ¶GZÛXL(moãÇ…æØjÓÍv*¯œ´ÑÖ®P ¸Z%¢'”ÒXîv¶Ì'UºÈCEH?…›½?‰$IqSB[‡bKjÄxÕ†ÅÙb’da~îÜ´ Ý_BóýŸz‰KLXRÏ»º¸+Õb²È.®×Ö\”åübmYÜ©pÕ²ÈÛ[ùIÃ]F¹|ZÇÆ®[:-RpLy‚«·#$c§DÜÓól ÒÌ}ÒÕiVÎ/]5òÄLÜ»âS1`¤WÿÇòÆ©ì—ÞûÇ'#†,ô9\w_†_÷^Óµj=°,Ý4ôþúÚjX§7/ŠÅòfõãã”OEm7¥4ÊãU hly¤åÛ/Éí]æNÁƒä cσÐ@7!ÇŒRX yZÛ´ñ…Ÿ’Áu*½ Ùâæ:Ü7QÐJðG§6 “¼àJl#÷ÓYX»®ó4‚*_™ÂöÓƒ<’ƒíGGT9=B¶U@xýßSEp ²jUF‹Yõî PQû RzÍèƒîórdÔRÞödœp£0§ì,œpj±/Â:ÆIk›Îpµ»Ï§Iƒl/NVQx> stream xÚÅYÛnã6}÷Wy© $,ï¤ ôa»è»hÑ6vû’¨bÓ^a)Õ¥›¶è¿w(R²dn|Û`%E‘CrÎ93#‡ "èzðÝdðõ;®P„#ÅšÌ× K!‘‹ˆ£É ÝÇUžLã2]1m†¿6÷½ë*™ÙÑ%ÃK?pc—6.¬à˜a:ºŸ||?ü1 °#AiÆÖD£éãàöž Œ@óÈ Ïõ¬G$”v‰Æƒ_$œ–Ôïòò›ëŽUe°¢i*±¡j§e ›kÙZïÙ0”!W4Ýeƒ ¥°7y¹p0߃mŽt¶‰0¡´»šÃ£i çÍ·Z^9£ßÖP*†À¨RÂAéM6‘ð(ΫtZ&Y:ºR„ —ÙÂwîˆ$q¾( ­ÑBŒbI#°âHF~m‘ÍËÏqný’o}3.>^Ûòí2±i9~³y{8£­AÒ·•Ìýò5›Áhš,}§ühÓö<¬o"·e•‡‹zÒÕ–Y6­Þ­ß(¼Üêáušõø+ÇÔ˜h²ÁVgBL{°µ…S,ÁLq·BÕWؼYiœR¸<¸È3CQ°K½+Þ%K[ÔÎh¬Ã‚¨@&Àžôó'#C†ˆ\’aU«]ÖpùÎ!lú@²E’.üÛŸß_®Í-¦yòT~5’rXø‘$MÊ–<õÈŠ¶î)µv¦–Y³Iö)ô’O#Fö›p™8 ¤¡˜ê計!™Ä d¶“ RbeÔ1£³M7bç‰R3̤Þ14{„Œe6ƒ”hÐñÏ¿Û"C=ïöŽp]þõd]{ß[åFæ@V×ö֛Ͱà÷<Ÿü÷Ç|“z`‚DòËÈ¥f@2;&,ÈyüÖ€÷é|Äœ¬»qàeZcÁôQJ`ÊånwR8uÄŽ‘Pg›®„‚áÓHJ,Ip®£k2» )í¹í¦ñ£ Ý"ù»é>Æ‹dÚôgÒcµý¯Æ¹7çC·A&]ðÂ` oÖMʇ¤6 £Àí\B|OçhΪ>"ºA è&£dÖ'"îÞîÞDLpyP5×´½ßø¥Î¾ø'þí¿R0LipUeÚ„¤˜H˜mdÏëà´ÿ 3}e endstream endobj 1945 0 obj << /Length 1453 /Filter /FlateDecode >> stream xÚÅYßoÛ6~÷_!äIŽ¤¨,°—¦Y—b[»ÔCÒbPdÚ*‹E­M‡ýï;Š”"Ù™Ûñ #MïÈã}ïì-=콚¼˜M¾û!ˆ<ŽxD#o¶ðbêÅ,AŒÞlîÝøï•g©N§ç4Nüßj¡lëU“ÏÅôœ`ÿ™í¸…Hkaˆ"2ý8{=¹œMþ˜0†=b•3ãØËÖ“›Ø›Cÿk£€'ÞçVjí±(gá½›ü:Án¢˜F4 ŒtD</¶:¯ÿmI#ÄnI×M!.Š´®Û)ö6ZûFoû]£ÉG ŠHàEœ!ð ˆaqØ/b¤#!–ìÒÒÂœ:Ä3˜›mÀܶ{f8„ ͘~ˆÇI§X oñ æ{ŒŸ­g#ê%àÙˆ9ÏFIˆBâ<›ŸBçEa[·îm^NöÿœRìËOS “NéB*ã³Vë8»V‘f+±ŸÉ²Y£ó) A }a_¸‘US~B½šñÀÑÚUé$,eAK.ìÓ.c—8½Ïl3m—JÖu"N‡™…Š*ÒªvÂJt× §5Í2©ævó৖î¹rƒV²Ö¶õæ}ÖBk¯‘ ‘Ç°V˜ˆEñQ¬’E4Ø·dXx k Ì YË)~Ö a­!s!µhÊLç²´4•—¹¶-ÃR©ZÖSy”Õq$ 0±ƒ ™¥…•/…˜×#Êûëï>öÌn‡´r7gú®gGògu‡ä³y¡…Úª³êÁAJèF•Ã¡óÑZœ¨€ÅÈûGÈv ‚ FÙ!Œly–O~ÆDáøÔ; ƒÖ­œßmá½G#¼ÍÅ&®›òk^U= ËŽ/DË?=©AWîÌ¥UU@ZıˆYÂÛóå3JMè©A<0s238¼)fÇ€˜ïâäi@\)©e&‹ÍÁ+­¿=Ž÷’íX8 þŸÌj„ø€C®Oºòå¢OŽ^4‹E‹Eu@ÖÀ\ ‚^@9ïöª)h| ôf†ÐsŠŸzzÞ—ˆcèAnù(ÌÙ,mTŒ¶J¨a•°‰†•øòû¼YWFÆhêåNˆý·n;‚@åߢҠ> stream xÚµYÝ۸߿BH_d æŠúV>¤ArÍ!EÓËö¡¸ Ù¦m5²äŠÒm ôï gHK¶wïn±Àš’ÃÑ|þ8 ¼x?Ýüùîæö}”z…(Ò0õîÖ^”¥"‰/‹s‘w·ò~õ?]µ,ûr6³Üÿ‡V~ª•šÍeà¿&Â/ªV¥Vô‰PÈÙow?ß¼»»ùÏ„OzYÌc‘™·ÜÝüú[à­€þ³ˆ¨È½{³jçÅi¿µ÷ùæï7K B"L#\J¯ƒ‰3â/—Þ O•¢Œ_éíÇvói~ÙoöØXŒ6Þ<ŒoBûÞ}Û·æ“Àï·<¨Û öÀL07üCùÌÈ4QBš‹TF^ŠÚÒG‘®²Ä)cÂ#—¡—†HCùÀK‘æ)³þl4ÙÎ)£c H9>éq‰"Ë-ãNyë‹œíN~…ÒÐËAÑiÌJÓL$yLšnʨ7 ÿOôój]êþ_õP Ð÷+Ô2ŒZ$mYͲ¯Ú†ÖkÕ{~ ’ ì6~Gz¡‰,xwλ«ZJ~fEf»! Á2ݾš ƒK¢ó ãRCõȵjE»W ­¯™{ù tRÏ'b3gÕ¬ŒÇ]Òý£>˜Ä‘yþ:÷c`‡á5~üô –Ž1¸ùL’K6Q4Å"¤Ÿ7µIS¦Uä·í"´ZTuÕ¾ôà™Àþ$ÿE2ó—eCƒNèiø{Å“ú`Àáý¶ZniXiÞÁ«g2ñUw §mÙ¬x¸Ve?tŠÚŽTMß•5=8ö˶®•qwð–(Š°Û×UÙ,€/-íÔ¾íH øØ·Vë¨܉Üçïþ*P]¡ÿ¡Ñ}7˜#4R¤¡…3ZV«Ò`¥‰Œá†£!$,Ö퀲 ©â)Jž0'å®&Ú— k&Ÿ­ÓŠc©÷[Õ1ýÐDs§.Û9m»ä~[öÌí°W—Þº]Sg“âÐä #5<´ FGáÏ Cï$ îgP Û¡æ=uõ J¸3QDì©igaâß+üÏî0‹MgÆ—6²¡_ÚÁªZãâ5Ì4=‘´uwœ.ÕŽìTDdy¤Ž‘z 6 üîËNÓKÀŽJëAiš¸¯ $Úíç'_îJ– ¤Ýè4DPø.ßö`+}IÏ$X–8“$GÖ0v¬a<° Òœ¿ŒòÔ¿#—xxëºkw—˜Ÿ&þJA¾]‘á‘œ*±®–"ߙ䪤ZZÓ MƒJ»äCÍ ,ž`9j4F4Ž3ÈK;Z»îÕéV÷60®zÇ`¥™Ä¿MÛ?²ñ(™FcóÃ[÷pÜÐ3Ôôð}5ª«³4ñáüp⦬m4rv"‘§ ŸÐñÛýP— +õ(‹[·'ë’¶LEåS¸ö% ““Da!€Ü´€ ³˜Î5Õô„5ˆ±]7wI€•{µ£ñNi]nÔTboÃëà OrÀ„›“ëˆ̳"¼N¼s?,kÝò†ë¯¹{ûi&¥4?~~}â:&9²5[,@+ûÔ«nßUÖ™¸¼ê&A‘ÏÐM÷ˆå€§Ì^T5¨›ï¨f7Ô}5ï·*W-~Xa((Nä½g(èëÚ q ÔÕ¯®Qõ£¾!²c駹öCFpù€7ž ¸(5äÕ’©ul°fU+›V‰ ó© ÜÞ<…›LƒÕhÑ6Bÿ—Bœ…ÞW6äIXÄy _Ðø€øšœ9gÜ ƒA3Þû^‡(u íX¥ì@Ÿ„‡Ñ=¡<è©–P®@ØÂÃBŸ¨Î =¾}¸ÃíÌ2)bG¹,|tFe‰þxEë*Œ¸ògÏj]…6ÈäñÎ趀µÏh]Ž·®˜ñË´®Â;ySËõonU¿¼­šª«K=¡ZÓ²ÿÒÏ®éܹ"[?««s½nÏM ,¤LŸÒÕ¡^M1mÀÊ"Õ¶÷F¥£(|½å{3Ž•¢vK‚àØ’½šöjZð­»³›ÝEµ0¹T=^«§)±Â'9Ⓢ–Â(æi$Z(9"ƒy×ßÅ¿Wí  ø(¸xÅ¡¢9Vå”íÃ58.8óÆ9e^ ¬MhV90vÕ‡o¯°€·ÚŒ{G¥>+vP0²)(ijÀF ö€@§7Á B+¹ÿïAó¡gú3ûKŒ,ë¶ýJ#‚1XKËå˜ôOò5m¯Ë„`J¨-Š¡tµž^O)qZ»`G$ƒZ®Ip2òg%8'À+{<e$‚âY ntÌ8Á1ã—Ip2†XιÆÕ(U¯^OOV×ëéÜ\À"–ÙË%«0aÎÞøæ´£Ò·û“òë2˜éÔ¨ ,p¿£x5mÁÆ}?²ÅƒÄÞHÛÜl+¸m"Ú•¾Ê‡e°éy.Ä"óÿ» y œïÿ¥„'û=!;uó ²à/B˜ø8Ô€¿õ¥éŒ½ÿ¶ûJ9v Ÿ W«üÜðÀ" ‹‹†<qÁŸN?¶Kñ£Ò| "ÉÉ\>=D’Ó¿!õDÚñæ–(›êاU8µ¬ÇRóþ–ž #Åš©#¹04F WF¨…I"ý7¦«3•²jœ”ÔŽ€‹Æê‹”FWp/´W2иk>?`Œº.£8”3N*½‡aIäkðc÷“Ž†K:Ç;âjÊ®²­²W Û¶œjYú,#¹àÔ8éØ8F þ½Wu=‚ÓoÿI W¸þôñC~,å+ž E„Ÿ^Ãðºp+Ž‹Ä—yv*íÿ>©(æ endstream endobj 1963 0 obj << /Length 2426 /Filter /FlateDecode >> stream xÚÕZëoÛ8ÿž¿B螨h’zXòÞí]»×6Yl±¹6h‹B±h[YT))û¿ßŒHÊ’í¦ÍëÃ!8Q3ÃáodB¥CWÏO&/½Ð‰IòÐ9]8SîLýˆø±çœ¦ÎûñÛFeó¤N]>Æï*¡4õªÉRqè2:~ªoD.’JèpÂ?žþvðâôàóeÔaZ¸O¦têÌ×ï?R'þo%^9—í¬µã‡Œ¹óöà?ÔJ û(ᡇ³Cæ(x±Ã|³Yc$n×Ä(¡ÞT¯éÅU².sÑÚgÀ7qÏ Ôq¹"ýÅ‘P¸2ÎÆY¥Ç¤Ð£8dÁØÈk—«nn½2DωðT‰¢’j(xiV,ÍÃu•KC¯EU%Ka¦eF«ÒSRý´jÔš>;ätÜÔÛ¿x=T¨í.żFµà \²ö™^rR€t{ã2QUk>€Äµ¦Ð=€AçÚ"ûÆ"ªb6>.ºo»¹íúžËâ¥|Ù¨¤Î¤™‰œ\X: MÕTIž_5OD=×ÔeV¯zÖøF@‘¬<;?¨š'ã=ºû–ÞnN@ǽi`{ª¹([Uµ~HÒTÚÕHÀBR‹™þ VÛÀç ˆ„Ìs€“ o Š)ÄÍ4èc #bÜ ½ˆÄ1»IÌöˆOC#‚9ø¶ilÛåôÔÄ„2ÖWƒ|ê‘xYÁJ8‹½’»8ÞÛh ¹BÃÐ7Áú„žÞ‹¿Yº!¥ÌžêÇ'¼9ý2Ò[U'Ë›y|4ZWËÙlV•n¶p 鲪v«²ež´³ÏÄ·*£XÝÁÏ»Û "¦7‹ØÞî¿™ ýÅ) ƒX;ìt% _Qpf­µÜk—iÚéê“‚0è×AµÛûe™g"½Ð!ÌüØ¿Ѓ8"œòïnù}€ÞS³tü@@§÷0¶×À$ªÖØþ”,ÀI@¸? ˜ÿs—aïßÛ{ogQ¥ÞƒÁ7˜Æ$š2í…?‡®Ç¨ Ânéz…UËãþXÁø¿ &`¤da& 12Ú†DVë/³<לRɳä ë >™ÒlqÃêwa¤c©Áñ¬ÑB ¸|:¾È”,ÖÝ´T”¶~k›ôx¹JÌg{jMšˆµ,*Q6`M½ 4k¢©LØm*<<¬d)M[u¤f•^\,R¥ÌŠzKXVlE¶Ê–+3)Ív² :°¸óÒmtM~ÈM…¹ÒÀûWØ2¹Öí᪮KM¡W 0/MrS;¢l¨<3‹” ã®MOŒÔ·ØCÒØ3§b‘"ÕŒ³ëݯõØØ~Û2=ÇØ÷dôuôowt4½žÞþU“ÑýbôõO÷¥T—‰JEŠÔ_™}FÎ/EÝñŽÌhÌ­ÌؘÑ8aôÜŒÉlTjÒýÅ°žÍF'OöY - $bco!÷MùI\Õ0g°‰®G¿åö¬ê¼e^›Ï÷lAVha÷5GF3£¾.-0”X6y¢{þ©†äÓ ·)²«OU­D²ÆGýÂÕMH—ʼ¿W—pû@ßÉ7(bÊ®Kð `ƒØt ϺÎv'ûváÖå]›î»bp‰%G6¹‘±õVbÞ¤XØÛ§–gôÛä_/ˆÏƒûå_ŸæùÝúöÔcþŒ3Â( Yl¢^¯åhi’I@è&ÉýÉØÏúéÝYSÔyø=+š+“a®º˜AçEÛŒ×2^‰ù¹œpÊ(üÞKè~òj‚3]Æutzz2aÄ~ôâTMEæEAæ6ŸN.²TÈI •ž2—Rå)êàÚ.s•s9?¯Üs ±ìB>XIY¸g2O.’EN2È/WäjkÁ`ƒ&X¡!cØ"@t’l挱aŠdÁÞ‡„êX4‹è=óÁ­·‹lõü»äƒ]#w¥CµÂø~ÑÅb¨øÑ£G×FÍãE÷Hè›ëN: /’0ö:$ý‡Wµ’—gÙ—~€Íe‘®¥Tuå.”\»ª˜»À¾€6Ûøj(Ä üv Ó(Þh4zÜ@»5wCDÐiüp…—Bc±tjKdžÙ+P{«š].Ò®^êKi|U+(¤æübO¨û«ílp tXH|/2'.S->p g½wÓI¢6ïc!t 6lH,¥\梅ä@=ýAûŽö½ŸaUž(Y"óm•]pÜIáúÛ _‹z%Ómu}{5ñïhjšÞ½ùݶgó¼I»c4èW×}HlëŸT"QóÕ??ÿ£²Gú;-üëªÝèO¸“xðèÙyøzë¡c*Ú£ºEñ:ïõq„:z븛½íÖ8iÎJƃ¬lA«³rëg}¤332Lfn]¯3s{¹ÓÏÌÈÀÌÜöÀ½ìŒüAv¾ÛBà$ˆý1œQ9jN»*O-M]6íÄñ|ìO4#IS%*ów+ÑçX|lÛýÍGÁøuZªÙ@˜º²{4º1+À絕Œ'äV{{r‹ˆÆË:%0E™r{W*yumÐg¸öû jO%êFÙ ü:©›ÊÂ6µ(;Þ¾¼›'Ö gÏîhwäQ>ü[@ï‚Pu„ÈFåÃÖ™J4fD]mG-ÖÍ;¡åùÖÒ«Rv)UöEl™p]‹ݺTß?IÈJý%lg‰;š ©rQgkñI—Ô¸Wž6Õcc|@Y—šÛÚêÙ?ýzqÈRIQ%ö’Ñ3ŽíÏ­D.æ:$€mõêwÝŸt=ê÷ƒu;½åÝÊÇ—÷K%æYÕÝ…zHh*;”î€Áôµ} Ûÿø„‡?üï{ÿ?ÏB̬z6}YU Ÿé«îURÖö%+CÎÇ´YoÛ¸ÿ¼ endstream endobj 1968 0 obj << /Length 460 /Filter /FlateDecode >> stream xÚ“MoÛ0 †ïþ¼ Y“d˶ŽÝ°ë©[] @Úƒb«±ÍVš èc©ÀÜuKO" êyIJd°—ÁÇ"øð%NAQ•ŠŠˆ³”ÊDB–ä4Q1lÉÍajJmu‰,'·³™œuyh*Fœ‘÷.ðÝ´FÏÆ91”‡÷ÅUð¹~pÈš± Ê.ØÞ3¨0~ŒÆ*‡ã’ÕA’æx¶p| ˜¯–­ªVTc±qg”Å™+úN¹¨?_ƒm$#ïNmHF"w”mczëì¯×îÔU5™y^ßfñŒªXœÁÿÄÃä­þÐípˆ¯òã3ü‹ßâ1ä’,OòÖÎI\ÿWâµ6œ.O°¸èO÷~a²Âä¡wÆ85½Õ»Ö8·¬õ¤K»ÐÑ=6m‹V®ÈÎ'LfÄVpŠ¦r'6v~XŸû It{ðnã%ks*䧮LÙtÚó†©ÓÖ%Ü1Éž6›'üÇ1NàX›É#6òZ¶6+æÒýi°œ*)]ßåP$òÕp_.L¨Hß¼o*"\0îÿ#4¡a” A>f;tn kkGgµÃ>ÄMÝ7ý›©’„çêe‰¿áÑûà endstream endobj 1972 0 obj << /Length 209 /Filter /FlateDecode >> stream xÚ1OÃ0…wÿŠ7&9ÎgcÇ+*uAP3U¢Æ´•Z©´‰øû˜˜ H Lw÷t÷î}Œ uÕí“qœ8Äwx·-Ù`{¬«Õx9l»¡«ñmõvM—Ò-ÆCŸêFsuS„×tLÝ5•Á®7q©£úP:?cèbnɳÇö¤ÖFŸõ%˜Lhñ9m`]›ë+õ¢ø'è\yÝY÷o«?YmΩ¥ êÀß‘a¼¥Ï&ña߇Z Õ©žÇá<àœ,ƒ~¤ÛLÆ endstream endobj 1977 0 obj << /Length 2076 /Filter /FlateDecode >> stream xÚ­XëÛ6ÿî¿B@¿È@¤’¨Gp8 )6MŠëãw@Z²DÛêÊ’«GöÜ¿¾3œ¡,yM÷P°ÈÑp^üÍp(áìá|·üü}%á)é$“Há«0vŠãêÓ¯Â)þ½#ü,‹Ãut¢8…gí|\ý{õf³zùØ3?‹ƒØÙìœ(“~ª¤g/…r6¥óÉýöÝëŸ7wÖ¿n¾7ì2òÃ(ß B?È”yfRÿæÝûë@¸›»»qÑên³43V‰Ÿ„ÑsÍœédàQêÄ2ô#Òúöý¿îÖ^¤îÝ7^¯#á~»yÿY |  ?ˆCøcét¾GÄß­/Œ„‘íÅ¡ŸÄìÓë=*ÖR¸‡jÐÅ0vš$ó>€…Ù,B’ú8K!9èµÊÈýEˆ æ±^Kåþoèòb¨ÚiÊ-Ú’ß> ®¶»ïiJ ‘;´'âlwL°¢ßm6?Ó(oJâùøƒ%ò®×]ï¯=%kŽš­!™ß£rͪ‹¼c¤S¹¥.cs_5{Œ:+¥Ÿ)Æ ©cwlþ¨N'ä‚i–½Ó¿ºhÜ/ÛŽ8:ÝŸÚ¦g¶2r¢WkéîhØèB÷}Þ×±rÁXeì¬@w^²ÓÀËN³Ò±á‘ %ÚcB‰„=ÙÀÄí‡NçÇ[¾½ïõq[Ÿk bÔì«Fûkâgah÷¼…AšºG7f˜Š| b¯‡BÃôª!ª1 l‚!’’0ÉÒ¥ÀH/‰ÑDžÔ0…6Ivƒ _]1ß­åîÏWê-ú¬…© ’}#0Ø&( `ß Î(ÀL {š¤™dXy~$P—ÌÐð Ú·–žeÕßÓ¨bÁEÛ ][×–sË’Éat£µ¾Î›ý˜ïiSŸQ9®kxB à ðÑn÷²hÀÒÇEƒk@`&.ÀÀ/0]`ºïÇãç/y]A~`Ý ²R*_B¤Éaß1XWœF ÈÐm;"6í@ŠP&üa¡²†NÿhaY§¼ Ja Õ©z  `ŠðDZKļ@°!œ_“Ø}Û–'ž5žÐ“ U©s,î,íŽþ˜‰r·•q ÷ä@"¡P Äô¦jÝ픚H' €¼žfÖ4šµ&5a›—¦†!•­¨Ûaâ2Ú–‘€ÇüLƒ^k–hÐ Ï-kßv-­ñBb*ÆÜâR«DFˆXò-ÁˆÎð,598ÖG&œ'ðªÈZhÔ#oÕß0Ó•’Å@ü%¦…ÿÈìZìþØ,… š°55]â2`A=YÏVd“³Ä¼áùÉU]mÞ Î|Í‹æY¥Ÿi€¶Ú•ó’O6ÏA3ÖžýØåS™zœó¢E¥ÊÊc%ú—,õJ}7òš©$Š§c(c÷Ð"Ìp’¸ä`GoÀå–È9lJ"i~ æžèe‹§ò™ûÆØwn©Àã·bœ’£¦MKä¥Ì’ |³¥’ï±#‹-b¡í‰\N¼ ±b¾Ìv)Û‚£™-ô‚|pxPö½épB6á­ÆgÝ6{+vk¥t6KcZà¾9Ó›Y‚°QVÉt|ÖÁSÒãÉý Ýž‡›ÇŸ=gÆžT‚aQ:ð»jXžRcSWGh&í‚÷»iÅ’±i_,%Xm³^‰¶ŸØ+:¯OÅJk‡&|ýuµ= '³Ãèy6}LP ˜®ÎÛ¶åÙ3žÝ:šbá èŠ9^ÞPû Ö2°Rè\¾hÓ‚/õþÃÎþù ²ÄÓàF:Ñ,áq‹‘M‡Ûü@—u• ŒÙ0¼t¸8AkpPÜ2Ã'væ †AÕô'Í÷³öÌ+L^€ˆÃ0œ>u¥›á³º$Ìä;z%B"r9aq^÷--@œ²d¦P¸ÌpêåÐäÉ “I ìðŸg±âSQM)`«Áóàè¶ð5Ä)(ZO"Nù*Uÿ/âþŠ }¡&è^€!ç}ƒY`{ï9x€jö˜ —@o™dËÀ\ÚÆö˶Nä§ ¥_V“©åe¸bó;Ý»LoŒ*Ííêïl€‡Ó8<ãÎüãmò"UHÂøúÞŒ4îõhÒk¸ìä³·¤ØŒm9Òe&ÚÜ6RhJ¡T&_ÂSj'ø¨¯Û=wÀÏ·+5g0·nŒ"0 ¯¢˜…ÄØhÍK6mk}˜º7˜TÍ­œâZmF9‰à?JcÚ€k"~»ødöïãØUÜýs~¬©|Ö\‚«ÄM^\åÂ3ë­Ê¯Ðt±¬ãØ3ø¶ú,Îú•0yÐ óË_ˆâÔeH |•…×_‰Â,½|%‚”H5})ZÈHeà¤Êâø)ÂQ1`4e ÒÁ˜F0í1e¦%ó…”3-HŽ’@œZ¹vv7‹«/yöi>wAA*Äq„‰7"?¶CoíÅB¸»ÊnØ+ƒŸ@úJb}¢ŒXg¯hÅÙ|ÒÁÑ7D0­ŸÇœ@&|ÎDCnx°í¯.Æ`^EáðNŽ¶;/%‹™tÐóÕ7”ÀÁXhï˜ï«‚aß'Ó‹ÃAC°hon81khˆEŸæ³ÇdBù×T—j¦8_WŒ‡Ÿ1 T4˜®¼ü·€ðd:¨(ôeš>Ë2 $OK¸N(ñÔ×f¸äIqO~lVAh1Ès)¹èËL.*DâOŒNìu endstream endobj 1982 0 obj << /Length 1800 /Filter /FlateDecode >> stream xÚÕYYoÛF~ׯ œ °6{ñRŠHb Ú¦µ]ô!‚5¹–ØP¤Ê#Žþ}gŠ‡T˲ì‡Â€¹œÝ]îÌ÷íÌ;s;ïGo®F/Ï™ç„(ô¨ç\Ý:>u| 2ç*v>/ë"‰D%&Sêã?KY˜Öû:‰ådJðøÔ.d*E)Í C‘É—«£³«Ñ?#‹a‡åùØw¢åèóìÄ ÿè`ÄÂÀ¹Ó£–÷x¦Îåè¶ź¯˜;¦qñ¾£Õ G˜ãÄ»W³‹ûîF{OG@¨ã…ùÞ½»Ãe(à¡UAõ3 Øض¤³Lˆ0!Ýe”œû …~Ð(.¤s»S3îZÍ£NVó¸²ZÈKBÇÇ Bn,WV…Ëi,WÕb6™zÉòÆ4^˜ (K¹¼Iå ?ɪܴ„ye§öEV¦Ñ Êòþ{œ”B)€ ƒ“ Ð Í®îDçv;·I*‘ôvÕ‘¨}Õe•h!ÛQ_“Øn8*ò²´ßWg¥öÂ]g9t¨ž§ºœ!pˆ-¿T*\péü²ghöáé·pÀ¬>Î3-rŒ¯1¦ê°(ãp2¢2Ò¤4}l±‘Ý%ÕÂHbBñøû„¸ciú„éÈÄÒ ®)eF5ú)‰_Ã+G“)Ã||µ°«%½ij$7vr!µ«(‘Èâî>í¶š)l3%W›1;*ªdf†ÖÌ*Í ªYún¤Ý¥q5®æš³ÉWU’«Ù.6çϺ”1Ò.±Çã¹1âE*.Œîq!†rïNiWéRŠÕ»—R†ÏmŠQž `ÍÅ0m±7MóùL[€ÍC=ÄËLqAl1¿–å.ZPj”Óu˜¡œþ]æÝ»&ˆÕJf{”¾PjªõªÑZÈyŠ¢G6טùV®š§­´Î’_ ï©WÓ‘ƒñ¼°ý»¾*/"9]ŠyÍZ¦$A»¼ašð¡ó$››=Ç.™YbSPiʸsP÷,»…Þ¿p~k7»¦-dô­¬—GéÁ Ø‚¢Ò€}òň}bD=¦fxú ¶…m@D8büß8¾ËM.5'{QÛ#ߨp4X‚n|;þ¯ þ©y]*jÊ–,=­R¡¬¡šÊPê)þ¨ µ,féZ íÿŠ‰ ƒ´L–+ÐÝYÇÎS4™×il^oäì ä¡Š«øQÈŠ\Êî7?û†ôì,Ó%A«øiH*Ʋ¶©,l,´¨ª•j¶4¦¯ÿ«ç»xYÎg'ç~9ÛŠpò'¯:@W=ö½LâyÕðÚwhƒ*rF·Ò¶³€ Fù“;Üãˆ4§}µh®ñÚå׶mNN5EÓ߆® "ÕâÓohÚ> k°(ãTýá{õÚˆÊÕá²Æs|ÛC±ÌJñχ ŽùpÎì8Ô©ÀÓgG]»Ìó¡•ù?ê~w>L9¢T$Kw(T³0î}¨¤Oʃ­¸íL Â»_Åa¨Ä.â¾1ƧÂÞ6¢òb€¸¼j‘0a¡sXè!† ÃYgDžýê,ólh``çCƒ¶•Îäe%£ªÏžlçQ½”Yu(؃âpcnû\UÆ5÷‚‚ÁUåöªzSgqªî0h®‡Ð·‰+ˆ:e5CþJÝñ]–æÂNÑôóºIîAÔh ÆKs-Ì\3BE¦Kǘr—?dƒÅE-µ¢É³OUfŽç¹éÕ·^w¸ÖõÒî4)Àòbm5AV¿#óÖ9ƒ½C›ØÔ¢u¢_[W0<ðà}ŸÃÚ Ðaþ×wî±yÇ œ#¡NŠ3h¤d„•4r¥ÓÈ7¹–«\I=ÛXÆèXsûá\<ØÚÈL*©Õ0j©ë)àRÚ“ 8PŸësøá¦9‰¡NÂù¬•]‚=tþ¦Â^íîú‰[szSé_³%ó4yH&¦»LÚ&!Ísaœ¶*™d¿1}R>θzÝqáúóšjôæSý ùThE*¿ÏUÕ¬íO>põ¾³¸mJý6Ï”¥ç5\uê4ö¸x¨gïC6CÙú¼­Å2=$##~qºÔmHà=¾‡@=Í=æ6ì,Ó½ ­â§¹ ‰!ºq·ËRú²…)•´í-LM9m+$[Un=¢+°Î¾£úøžUv«YýòK‡GRÝ.V]Ò;<¶¼Ô”Š*/­‡ø¸úÒVïösÁá¨Ú7¨àœ=YX2ĈMœ>éŠ8Xz=ñ\ýËíU—Ÿ~³_W«ºšõnøCžË;ü;ÞÎ9E„Ø›’|p Êx8~»«ªùb80¥ãsm[%:k«bƒ þ …5Åÿ endstream endobj 1988 0 obj << /Length 1957 /Filter /FlateDecode >> stream xÚµYmÛ6þ¾¿Bè}±Š")R/.p@.ëM7Hº{¶ó¡M‹ƒ,ѶYrEy7¾_C‘²¥µì«ã XŽ¨á 9/Ï el--l½»ù×ìƹs=+D¡G=k¶°\ßCœqËgb¡kÍëó`º-Ó8ª¢¡Mý`ðIŠRSï¶i"†6ÁƒõÄDd"’B?¸ˆ"2ücöþf<»ù놀Fl˧ œ!ûV¼¾ùü¶˜oaä†õ\s­-æ0fÖôæß7Øì×ïÊ¥¥‰É»–T/@q-Ÿpï¬d”û|/½## Ôò¼yììî°Å8˜,4"ˆ¥þ`cš€Ï´Ô„ÒV£æ™ï¢ÐÁ¥°½’Æ莵+=j°ÜcÊ•ÊÐØCAÈ´í¡ía™ k±Ž£ e­ç}ñ¯DüEn×öS”¥I¤¼ÔÊ(ÛUÔ?ôD)þ„€ÐôsY@`Ôd «{s/ͳ4‡T² ÅijBšKÓëpºGSJ±žg»ÃaáÝéÓº´ÿ´‰ØT+ÃՆ:Ç3JÌf¢,ÓD±0zÐVï“^PržDiÇ«mþÅ–é›ÓSîáΊ Yg©È«Ó+¾|.ú£äã||¯>œ2¸&z?F_†P’ HÈmi¨g3®¢!ѧ!áƒ:( H[\ˆ(¥ «ãX—(ÇÖÜå®)ÊnY˜S.VÄïÓLð‹£\s³_z¯‰žXl³l7ôøDû;HÆ¡æ{^p’18‡GÝó>õ—]…d-5m$3‚_É8Ô|Ÿ™B”¥óUµ9‰d‰XDÛ ²¤Èéò4lD ¥€¬Ú™4º¿öeªIù·ÊÓŠ˜›œ—§‹TùYc“¿Ì4ÕË9Òx6x¿•Uòíz®ªª¨Ž´¿71›H«ß±ëË®Æù¡~,ük+deÏ‹dggé:­öxÖ0¥›"—âû·£Ëå‘x”J£ìÕÐ…‘Ñ~t)‡®?è³û)¸ |Dà„fy”'=*ô¼è}ÎÚë€ –jº5ˆ‹0Äê ÝRÓi#øu@Úen}9Ñaœ‰Ò@ݪª6ôòÝ Âþç©7Êgk¹ýpwÿaÜ4SEyè·~ø©uMSo̳L“ù©iÓž€V~½À.÷Òq°€ˆ×ƒ/—HbƒÛ³žìˆæ… rƒY:«Ò¦ƒ‘m<ë67û,Õ)¡éD'QÍL“Í&¨ZE•‘Ó@g7c‘8I¡î†ÏyVDIÓU«²Ø.WúáçÙìq_‹|ºÍç™*Rñã¸õ¥F=©¸°§Š& ¤¾(ÖóJƒÔäÃ/ÎñàWýXIuÁVW;Qëµ¹´Tu¨×Œ¸`¨j¥§“T–5X,‡ΖèÙt¡GhàÕÎìE_Õ¼A­;2§¨-£ó)B¯Jóýá bnZNsb´‹ÖÙ¥¨D ðÍ®B%-þ¿‚}=*µÔ|7T¢ t_èå>”jð‰õèˆ*všWNÇø†qz€š¦®Ôó©Eµº²CºÜàÇ~‡Ñ?/â"ˆìÌ#¦C (,¸(Æíº¯—‡Î—Yàå¬þTuE4îµtbÑÈ}¥`t)âØÜig÷ÇвL5ØÜÁÄ¡˜P‚GÐZ0Ê}]¸^¶õÓÉ[scy¾ºY@ÎC$1†ˆû–ÜNg/—Â?@<½Z'³Å¨OBg÷ñø0™é«çõ·Yá–}ÜuU¨Ù?MînGäΧ©³)‹Ä‰‹,ƒ«Re ¤³‘<à¼~ýŸyYÄ+hãqˆq$â$À$Lb²@›dÑwó9èûùaª¶Ç•SžŸŸQœÊ¸@q±>¿ÍÉøn<OFæ#˜jyFŽÓàÄê[YïpWr¿s¨ Ø–¢L…´Ó¼ËŽ–¨™§4†9ÃgC1rà’(¾¢UÐÔ³!Õ+ýò¦«ïf2£êã›w÷o›èx¼½ÓvHŠx»yen¾O ¥®Ðê þ š½™Ao?> stream xÚí\[oÛ6~ϯVÔš!)R—Æ6M»¢k—&ëK;²DÛÊdÑÕ%®7ì¿)Gvœ4ö|™Q!@D‘<’‡ò‡WGϯŽŽÏ-Ûð€gcÛ¸ê6ââYÆUh|2/‹4 üÜow°ãš¿g,U¥WE²vAó™"|`1ó3¦*Àµÿ¸zsôòêèëÌ Ôà8Ð1‚Ñѧ?  úËsIÙjdÛÏظ<º8‚s‚z ‚" å(Aý$¼)4£D=?Cˆc–u®3ž€˜**…ËI±±áŠI±‰žÛCÀ£jNþVfX¨ÿl«´çulÍŸ´Ý5ŸGu4£p^ó¬AÏ9S …ÒüHõž£Ü ‹Gx¶uóhIJÜ7ªõve†t^Ÿ‘EÖéw ÑNÙaˆp¡O°lÏ¢®µ‘ÉÙCE㱫ïe ‘ýhœ¥AtHËl$NNäÀr¬0ËÊÌÈQ‹8‘ņÈÌã”ç<àñ~–°½§%<Þº.ÜÓZÚ“¾QÏÝÊÃ<×ÚAÖ!X²Sv¿_î”Ø¡Â2»aìç,õã²My!˜f»µmF]Jw>_z)†EÊ ¡Ï‚Ð…È Ôã°@‡g¹É y–Ð.3™L@eš­SÖgé†ï›zÞúbŸìtí”™ô¦烘­ëNk³.ÒøçÌïæ­4È»×­¯ÝW³nÖÊx‘¬;a½VvQ놅]øâìôâüúô´%ºu夬Ãóé:¬Ó…^Õk\¬zÍQD¯ãs§þa C×–#º—Æžâó•G,WÞ’žß×`á#e‹ÒJ”‡6“•Õ´=àYîýZ®,+²íÌÌv'JZY@coM¾;aÕÿL¾%qØꞌEÞ¦Eœù̽‘ÛÊ‚R 8Þö|qy¬·²”–lº=s.Wì¸Ûò{ñd‹EÝ÷_§ý+ñ7E/"WÓÈ O'­"tOÏ/®_¼{^Ÿ=??ë_ÜàÔúÈ—¯ úh_ÑoÞÅIý(f‰?bÍ­·¹õ6·ÞæÖ»•;òQp@;Ìogçí²wȃbÄ’ü™ªÞ¿‹x¢*Ø4Y.–êMÁ‹·ï/_ž’‡ô€ÌK=Öó‘ë2Š‰íøbOA½>&·‘Éíõ©sPÎÍS¶)XF)FžlG²G±ýüÖâ—"l-ŒS¾úG–H"äxFG\=qoø`6¸ÁÙ48›9œ >¡  œMƒ³ip6 ΦÁÙ48›gÓàlš/ŽÍÇæ‹cƒ³ip6 ΦÁÙü€8q·pè³q¶öƒüfp6[„5lh³MÜEƒ´ù16Î6^ƒ´i6ͽ·¹÷6÷ÞiÓ m¤Mƒ´ÙÒ¦Ì:ئAÚ4H›’¸, ΃ɀ(±€pª52ùÜI($‡ x¥„B·DØ–F+o–]YaøážÌO6!À¢:óÓÛ2e’ãš~«Â¯g4S¥I”E,¢ß'm Í©ª¤EÌæ”…¼MP¢˜„¶âòK_f\"攪0i#hò"U5Žþ”¦j9×T•Î‰T"‰R_eu"õ¬Né4F‰nªDÉ‚|Y•ý\•Æ~–±¬¢Šxk0”**•©ß—dz©`±ûL ?ÕÍ£$³ Ÿ±’–+±\ÂHfJ¢óy¶d6-BÌž4ii`b™ ×¥¶((iDA'¹šQG‹•î™IÍžx«d…¡/W­tG®ž¡~FzÀ0Êü^\6šU§ÜpÔkeQQ×(ÝÌ2yO„|sùþ~YäãJ«û,!&2`:—W5½ÐìÌ'÷Ê´¹ÀÔÅŠT÷Ñ€¯’˺6ðúO9¼ˆ…¢äá•(”ºÿ%‰WO=‰W5òf²xQÇž«ñ…u0Èû²šþÒ´Õ÷©9(¢ò„P%‰ð'‚Eቪg,×g WÏ©tÝ:A{R嵑…ïwÂ(=¹•¥tÒÛÁÅK±Ðx:QûkI²zï:·æ{2f?©IˆÜ[6eU" Ê…-+*Ð/‹U˜\.½™ á}¼½9Þ!­s¶à÷9ó¾–@„ae!²àϬ-eódâÇ!¯™”UלjÙâqýi ý 噞״H2 ]ÕÞ‚%êǽëXB¥ÇºÕôêï9u¹Íþ·¤ƒ?³¤æ«Ë¬%GɧãjД ŠØOç¬õZŽ¦Ëâ³[j‘Dß¾dyÊü‘¬êéJ„ƒT¿¿ß+6푲áýénÕ#×®ÖØbïlõÄ‚åY³“èJkXoª–g·J¬ù[Ñ“ÇU,§HN—¯OÑ,ÌR…p–wSlœ«Uïü\ÜÕ}}0^ò~^FU:(æ‡ò·á$ÐÕ·Q/õ復Zú#©l„VÂö*_ ªˆZv+¼=–?r¶mj‚$KcDY\7Çg\FM“$æ~˜a¾ð˜~.¦ ¥DöÑÙB—µ$ŽçÒ0È#ƒ±E<óÅÐçU6Sdᨛçåv'I/¿‰H/vœTø/?O" endstream endobj 1892 0 obj << /Type /ObjStm /N 100 /First 967 /Length 1380 /Filter /FlateDecode >> stream xÚÅXÙn\7 }Ÿ¯Ðcû¢+J$EF€,p[ ‚$m<8Π Ì^€ôï{¨ÉÒYŒ«Œ°ïè^Q$I-d¦!2«É-Tó߈ðo ½êˆF!§)!wlãPrö†Î)J 4,ps9­)ÓR bÉ4“7rPÍÞ(¡â •‹ÂcÿRƒIÇ´Ð$-¨Q ­ùpÂ#eóI}Â`"Ÿ…0š¤ãÄ-é24P.>Õ@Å!ÍmdÐÜ–‚)\;nŽsë¤8.ãUªøHQ´ŒW…ÉháQ›÷ºBVz¯{¯º”òY¡V\!ÌQ|ÊÖq ¿—‚‰2‘[9÷9Б³ô^C«õÞ`†ÛË ­Ú[`§sÐ8£å$4˜š%ùD Éb® C²š«Á\sï…ä*] $[r)ÉÆ]]H6sˆÈÝ $妌91Ø- p©÷BÝB /ã;¤ 1´:Ù˜§”ζ´ØÝ‚ŽÂÚ['§«©,2t*Ê®“Z]wÅ uC¯iïÅü\Ô*p­ÇÜÏIÝ{5!¾“{¯"XI]Ê[Ë°!Ï ÏgèÄ ÝåÌÍEQá A£:'8Ø¥B®Ôçl­ 7³Oœ¡$âEÆ‹$ñ0D8Kê¬Ã=Bu$…P—‹” ×&ÈšÍ7‘ŸHDq½‘²"ÍÝ…‡¨Ùâäd1= gÈMF6¿Óïüà†*5ü´ºyÿþõâÑ£[€i$Õ"~È­ECdÌacô°šÂè˜uwº^]‡““0‚ž¢ºpZ<^ìÓ lý£¦ç—ë‹—Ëëp¦çÏNÃôjùñ:|øêßKtœÿµ\LO!|¹º¾òb$>~1½X^­o./–W›Õ¿ý¶|ûîüÉúc8Kø  ª¶ü_b´×œÍàÿ›ÖF9j#퀴H¤Zç¢%&ió@n)zQ™’ECMœ"×cM:æÊqDE2ŠµÕ¡ð¸‡ˆhÉö"—c#ÂW¹¡ˆØÞ» [#b(œcAõšE_f(ùѹšR¶èÕö ÜJö£Ù¤lÒؤQ6iÇ­B± à8×X„æXg£ŠÎs²˜vyú^îϺïþÌÇ»?Ë û·€·%ÓH“Æl2dÔ8›–„ô,ú‘ Š<ÈØÊþèÛË£I*ƒkà6ЋG-:ª%6äÜb¥y2.&*óÀŒeÐÏ ³@œ'b©ò0YÇå;Ê£„òÀ¦f¤Šu„¤qªÑ8³ÀBÈ:)ó@‚¢ ‘ÇmWâ÷bS°)£ljÚcSFÙ”6w@ O僙´äš"Û06”w<L§ìÃO5÷Rý8÷ F€¥»Q¤eŸ"¥ã)‚êcmo£h$’båö0kØ©ÞÁSû±yÛŽ6§æ}sj:ÞœJGšs¼õ€òmLW«5¤mî]\Ÿi;`1½¼ysÝß}·úg1=Y_¾]^váéõôóôËôôŒú‹ësKL¢úe[DeÁoF-`¬®-Jj€=îžx¦ŸÖ¯ÖNüá ß­WÑ"ýènÙr¯æÕð¶¼ÚI-Xòçq\p ÀeâÈå˜<ýZÑî'ií@”[ºCŒ´ûŒ‘¿W¿^5Šj¾²`Æý:3Šéá ¹yó9N¨D9*Fƒ¡²ôê:,¥bóaóÀ,†yúAûaö(v ¬ÛhYo´!&÷!„-fÅ­ìwœ¥;* 6+(#IëÁ¹øûüÃõòá±£w¶s¶O9ªwbè~ö+n=Ûð­çºZþJ׺~H endstream endobj 2008 0 obj << /Length 644 /Filter /FlateDecode >> stream xÚ­TYSÛ0~÷¯Ð£=SëôÉL§&¡0ÒÄ Àƒ°Eâ⫶ÒLþ}%Ë¡ô¤/Zy½Ç÷í®ƒ%ÀàÈ£üj%1 ¤ $ú,Ye]Ý`+ý À0Ž°¬*à‘’%XXŸ­ƒÔBSeÃ8 Hï€ù1…û ÍÁ•|ÜŸ¥“¹s“ž æÄƒÌ ¨¶w†:¢KŒ 1öÓó‹¹C±N&gÚÉš¤»0?„!óþæ³¼ö §#=“uvqpzœ8. #ûÐñ°½ïÄ ƒ>öv1I#‰øg—1:s5¬h —4e)2Y4u¯¼}l7wF¶oGÕ]Ó™‹½,êå»Ñ¢k®1¦¥Ò@OqIcFMhƒn>sb:@S.½ýÞP+ ) T1<…CE SþA9?²À•Ë¶WR¶{m6'ðmX–°*$ùUEß+ü(kªj]Ø Ì!¾½½JiÖtmÓqT䡾ýM¼D9—<ãœ=’`†Ä§¡¼—ÇOøÍíû¸½—æc%x.º‡ÖåVC«T7cµø¶lxÞ+Gò¶T\3Ûp£Ø@žÃ/í£õ¼jKÑ6E-Ý)¢˜ÐßòS]J’Ãä@ ÜwûR Ù‰^dPu}hùR¼JñK$g£çÿ™WpÌÔDO‹Rô¯Ã§öRƒ-”ïŠw÷oÀÒk0ŽîÒ ªgD"{‰CÞÊu÷34cQ"[w…Üš:¯Õd›köøn߈qYÈÕúV“JÕ ÝFçrû¦\›ç´ûc †fÃŽxŽÿA¾\…¾i¾Ü„,Žþpaûjñ²ˆOík2vŠÄþNn•ó;ܨa endstream endobj 2012 0 obj << /Length 215 /Filter /FlateDecode >> stream xÚ=oÂ0†wÿŠm‰¸>ûjÇk?@bj3!†¸m¤ µ$ 7HH˜îSï½Ï)ø+öØÃÒXðÒ[m!|‚Óà¨”ä „¶¼šŽ]Sµ(´+ùfˆÇœ­¦®¢@ŹñûX1Fj‰bÖì5°_†é˜Ìâ$rÐØv§ Mý5(i| §ËÖÈ–)öP±w¦þŒÎñF둤¶wKýËJÉ'ꌊފ !ñçïúgœQ‘¤(¬ÖümÚ‹ÜwM¼\ÿRÅq¸àÎ>öì/P endstream endobj 2016 0 obj << /Length 1388 /Filter /FlateDecode >> stream xÚ­XYoÛ8~÷¯Ð¾ÉÀŠæ!R’±]ÀMí4]l‘º.ú+ѱP[òêH6ÿ~‡"å;Þ:6 ˜"5'çGØyp°sÝÁvü§C`Äqê#΄/:wß°“Àú£(ÎSCµp|Â8w>w>uÞN:½G(T8“©ãG…œ8"¢ˆ`îLçνz?¸ ÇÝo“ 9ñóÕô!H0âx”¡ˆC?ºM†Ãš¾3œl[(x€æŸjá†JÆòA¥ 0…_>ß|¼îz4Ý+0õËxh&ïãw]»_»»XÕaDÀWŒ¨`ðÏq ØɽÅñu¼¤Ñå †aÝf‰Œ•ÑЈt9v¯p0:ÚØV ¢Bÿ„Ïu‘Ʋ’] îÆùB•úQ¸OiÕ%îÌL2Y¥]ÊÝÇ.á®2´­nýluûZwÃK`.3)ëå2/*Ôõîd––†k¡dfwÌ™á¬K« š)sð|í !b4Ÿ_æéôb÷ÁâcÓo!Œý–4Í*UL5íʇ$-T\ÍŸ»ðü»àx, ĸVÄyËZVJ‚k¶:ŸšQš,XÆri&O…\.Ua&÷˜ã§YÏÌ´œåõÜÊó2·Ú ¼ø Ä5&@´H€"°ÁD«R˲èÍUžÝcLêBYYieum§QnâÑ·0Ñ?»æXÛÊØa@7$C"$»¹Â¢p+‚€¯òeKFH¨ãCuD†”t‡Vqôl3`Ûþʆˆ0äý†½îpa+¸PÎô d¼s˜µc“öî3BøI:>_yd¶õâ<›¦fëÆ®ç©Lþ˜+/‘íʲPÓôß7½º,Ú¥ò¹ÔŒ€»7=UÅíò<•¬TóæQ«xÃáÔ*]ÈŸêÐzY'¹‘ÔP4O±r>oÂ}Èñ£à>C$ _½}NüS@´…­|ÖQ€´d¡=Èƪ¬çUižf'SD‰8 Ü ª Èñí €Öç€{CÍ&¸­àË€›E ÑÈß­IWèPr³Å€/ƒ¡áŒ¾ß®þN Óê¸ñ ažå‡€{;ú>nJç Ç/²|}ªU­Na¹¹}Ý£/[õn`-2hòÀ‡ù3ÔÉC&É%$®>åw˜|¥ãõ9x:Èö°Î(mŠÿ¥raÔµÕIÕºúœ’‚4âH€ÎsR†Žƒÿ9¡à¦†#zN n¨ÙLA+ø2)HCõ…µGúf zq‹_³ŠžåbÞÖŽUÁÁ}|ÔNßÌý˜‚^ÂG˜Ó ¬){ƒª—¿‚5(ÞaxÞqO†fCߪí%gam­fkVð…°æs˜Ú¾ã<Àß †î=Š mÑe—YŸÓ>ÃvÕ úz[æu+îÕ‡(îSAõMÖPüq“Mó?×Ôc«ôQ ‹é;ù0™p¥¾ÉÒjÍÐêT•Œg:Ôz&3ûP¶0à_ô-öÍgf„#ܾè%걦áC'÷e=à xÞ`<ÍlJ/‹TEžÔqãÃÖûnò%·ºÿÜÉÛeníÊk$¾•eYëöõâÉ£þN!³¸­ CW—eíÒ1E»‰ VPqG¿bq¸²éŇZHlí"Q°«ó?2¤oõ endstream endobj 2021 0 obj << /Length 1874 /Filter /FlateDecode >> stream xÚ½ÙnÜ6ðÝ_¡‡>hŠæ¡³( äj4Nê8/M‚€–è]ÁZQ¡´vܯïPCíJÞãõQ,°©™áܤ¨7÷¨÷òàéÉÁáŸ"ö2’Å<öNμ„{I˜’0ÞIá}ò?¬L™ËNΞ¤þÇV„^®ÊBÍFý_q¬*%[…A8a³/'o^œ|;`ÀŒz ‰‡$¡‰—/>}¡^ø7%"K½Ë~ÕÒ ãž•÷áàïꥄ|”ðXØÕ1ó Ll!7[bŒdQć=1J¨HpO¯ëÎÌ8õu±Ê»R×½ 'x9éƒzv„¯ÉFv*_ÌÁS¿‘ùù T :;Îü\6ÝÊ(œ”y*1²Ó¹4E;€5¾17JvÕbËecôŒEþ…ýsdº…eδYÊ:Wø®>É+½r6Ʋ£B5•¶â]-Uí$\µe=·ûµCáÆ€Mo¼ˆú óÒ¾'Ãœ‚a Ï@^ØbûÛDi‹I(R ™L8×ùÌy4]õ)ˆ(õßÕŽªF´æX™¶Ïf<~ÆJÜ£?Óˆ®„;OÆ_><›2¢·“äetë¦WÒC{šZUN”«F¶-ÂÏß>Ù͆ßÌæH×Ái¥óóõNÞ?{íT;¶ê]¶ð^§´%„&Ký¹3ðÞ”þÒÒY£(ÛΔh„>>&,ÀxêüEï¶[{· •—ƒ+våRµ\6?ÜÔOTÿ$ÏW‚#rµWu¾0º.ÿ•C‚;œøĆÓQäó8ó?è³n#±½²s õÓ”V Éñ6]ȹêݵ§’kØΕ5>‘ªÆÁ…%!M©ºRµ}žþÑLDþ“YHýg¸HÖR{÷â-AÔFèë‹øÂÄΪݕ u kÃØqÀ4K©G½wÀÓÕ€0ÂÄeQe &¬ª^Ñ   ™æ@æ 5¬Z$ ›w³F7V Ò\!¢]¨ªr`nʦ›J±q+GlKŽ`²ÑØå?ôsH‘À+WmÛK* VXlê«è\‘í5„ðçyî ¥ÄÔËQ]°¹0I,°b¡d1üL)¯ú-Ã= VõmU5ÒŽ¹†h¨fÌW?a°„òV¹¹µ8N?¨.6F¾M0¨n]}¯—^à!Ic¦ïgÈæÖãÎ¥e1ï[×5¼9ʵš Ô·k²3Ý‘^Ç÷BÉp°†kPåLj£_¯vg}g@ºÔ/ÍL$¾[°5N •ÑÖy ”׶q=ókí¤Ÿ¾(ÁF¡U„•`7Yµú|ï`›‰#i2il¬ ´ÆÑ:oÀà‡†»}ët<(êÕ`¤§›¶â¹MEzÝUØŸÝFÿÑ']dœ’˜ ODœ¤üæN2f3‰ÖÝä„FʸmR¯£hPÏmI0Ïþ@6@¶m̈MF(cc6&‚dI:6Ê;ÛIyÝü^{ö-.„T ªŽC×áŠP(c¨ë_fA ÕïjµD`û~pÞ;zP¨ øÿ¥oªji £ –' CÄ Ñä¦k(§œƒª<ÝÔ ážÞ‚q-ó 9øÝàaáò=¿Æ!±EÅZ~—nô…vÍÒô†Üö' AA{øÓÄ ß·¡Ù¦?ù ûÎCl7W-¢/˾žäÒ> ·G Oÿð\µnsÐúĵž7ó|¡à8ÒãtãêYO¹[8bÖ*ÀT5&2mq­Á±×à¸)Ö–_¼öŠ\JIÙû>‘ËÓ„0Èk7œ Òø>‘;b3Ž\Gøa"—gŒDbwüÁØ´ÿgDí¯à-;ó4¶ñ`Å­í¢ž«ÓRÖQGx”‘x¿¸ßöFöØUdÍäÑjh„|šÊeÓs{Á±å|UY¯¾Ø*µ[…„Ü\H €¸ZMêH6a^4çsG®œzü׵ǕËÞžTîçð{ÚpÛ‘DH²‡sv8&±³ÅÉ,ÅC!¸¸=Tjhy'Íæ´í µ>Ïk×[¶vøºk•¹(ó½r7§ ‰©¸W´° |7K;wØ<'_ã¢rÅ­?ÆíüZr˜;åB5´×E1ýg h‡…," BÎý-¦|À=¾•ÙÁ+Ù+la¸´'Îñµ(ó?8ÞÈÁ endstream endobj 2028 0 obj << /Length 2315 /Filter /FlateDecode >> stream xÚÍÛŽÛ¶ò}¿BHû 1—”D] ôa÷´iR4—înчÍ" %ÚV–T]²ñùú3äP²$;îq¼Å9X ŽÈ™áp®Œ©µ²¨õËÅõÝÅå+×·"ùŽoÝ--7ð ÷¸x!ñ"׺K¬{û¶­ÒX4b6w‚Ðþ£–B¿´i"gsFí—ˆ¸‘™µÄ‰KÂfw¿^ü|wñ׎ÔbVàq4°âÍÅýµÀÿjQâF¡õ¤Wm,Ïa̬ۋß/¨‘–BRâø®Zí3«‚{È›CçR\%Ô ðHïD)Ï@ö5Šûþç·|˜¹ÔñÌ¡ö£P VúˆR¥“åòpÚ‘§ÖÜñ€;7Ô‹”àºÝ¬EƒÐ¶hxJ³ ¡…YTV3ÛŦldb¶j í4¯Ñ-oÖf}/¼A n˲¨œ¤fošÇYkØ‚IGc›c‰\ã¤7ú\°åµ04®ÍYü)­›ª¨06¬þ”ïè?𗑃ú!ñ™kù®G|pªcN€¼wÔ9–¯\.ŠŽÑ –q$Á,õ²!²ícl"B²Qx/pI„áJZ˃”û¸2uôð+Uûž‰¾Ã‰ç˜èñýlîSjoÛ ½›ªÉ£¬r™Íùþýþ#å´ÍÅFâÇy†ð*Ž؈Gô!‡Î"¸W Æx‘KpŒG±’Ÿ ³Oî*!õZß衳½c…á7\оP0ÉS¬d¤æ‘EƒšyÄH±_ý'¹HEþÆÌC‡øÔ9˘9!„ÿ´1ØücÆ̨ëû#ƒ8<_Éæ€AgiÞ~™¯¥HdUïY4ùÿ²èÓoißXx@B÷mÚt¹£7 ©] !Çò3ÙÈ.Ôk-è„„˜>¯è«P@‚¦oòJ•Øç4–'y‚K¡Àcçyó!ïøÇuÌ\âQÿ,Oرz‚!üLžêR>2ÌË¢l.sLÔk÷r‘æ— êFT²N ã›3­ôd î_$Ž“øš•ž^Hcµã¥y*šÞ¡æàÍЈÇó´xÌWËFצPw%ÅÌáöSž"Ió•Bªj.Á¯RUN_šJÄù蛺VíDÑhQ-@¨ =šÊЪŒ3 ÜVµ9"â"ÿH©³j+9^!s±È ÎTpkœõE['åò°¬d)*9ñiåü)*êÿõÜ@[Ð9þëQFB?8n}.ƒpÎñß›¡ÿÂÏã¿P’¢Ib‹\¦xÚ[çxŸòþîý”6ëy‡œ›Z»þq þð&Õl‰*ÝßzcØO~}‚<òy˜‰çËrÀY1çô[ß7> á'qRftC—p·ošµãƒ+±Ð–IÚ „ÞÍ"p5ôn²› ¿)oÕ~ÉLc ã؉‡6âKºQ%»Âæíf¡CÀÅGÈ­Rlê!½H5ºªƒfžýf‰ %°¤ÌTuª)˜±­1* Ùª@v(,è\FÍnkr>U]ÝÜÞª ·çˆë:p,´f)E£¸kŽ9rtF!JÍDËLV¢ÈãáSMè¨Å†c¿-R½ÆößÁ Øˆtº¶›³Í¤Ó¥‚•.õ£ËïúâuQ›N•°T÷¿„ÓÔ:RÝcÞUýi>©zHš§§DN—Sâñè¬Èé@ÇM™÷wyÛ%ŽwVé3à3.}òóÄN׃â|ò ¶Ö…,EtW¶›nì; Hwk™^ëëSÐu»\ªûWðU–O"Í"ît{ÑuSÃ?ÃA¹ÀÜt?âðþÕ«—üÜÌ(­+eK°×•a¯¬QM'ôºz1_é+ÖŸ» R9‚Æ@·¢=ð€äë…øÁÖ‡Ê2bcÝA,ù¤>Ðh…tM—Š8j|±•õ ñ­PAµ²ÚNón”ÎŒ[|Mï}NLŽ¨~$˜.º°¬iôRäºo‚®»ÕûgË‹“SŒx¢”†EU‰íawÊé. ô›C;àÃ\eQÃËÜèùÈeÝ°;ÈD'Cž†Ì˜×=í ØŒŽ]3zfäfôÍ<œ—ö¿!dí…NzñÿE¯Á ×¸yã¼uc£ñ¯>ÍŸÚk¼R-VáÌ$4†4wöqf?™Ehq ÃnË g˜vÛfã0ã¦Ç „ (V†„èè—ë·· ’èÐeÔ¦9îvlUmd†šÛ¡|‹Ñmÿ}:îÞÖ`£I²ËªPNì²A£Ò¬»Çèx¬ó—‡ˆv*‚È ñ#“ ¨'|ÙOå ÎzÌt}wéFÞnóøF‚Ž%¨õC•UÚlQ»Ä1útða€·uojˆa1È÷·Š¾!å€r W¹¤F˜z‚¡¬ƒ~*‚ 7Î,@B̦49/+À)0ÕÀ9ÖU‘§ÿ–É8ßôéòýíô?"‡ çÇQúS¥iõÍ—gQ˽¡ÂÜîünÙ‡MÅf Ѓœ²Û?k;î~xÞ˼ﺟa14-3k“ÌoábUyûöZU’ùî·WåE"Fò~sÚ?Ù×÷"Pp‚ç{Â<ÓlÜ6Ei¢užt9H¿°Nz<³_uF}¨Ö»ìÅWÅQ¤éO¸ÅÇý „ƒ¿'ðº–á¨â×qü²àÈ éðg =LXMÿn Å endstream endobj 2036 0 obj << /Length 2283 /Filter /FlateDecode >> stream xÚÕZëoÛ8ÿž¿BÀ°2P3¤$êq»9 MoÛ.Ú —8·²Á‚±i[¨%yõhêûëoFCÙ’ìMê(=Ü!@D 9rü‘2··Þ¼™œœþìúVÄ"ßñ­ÉÜ +ðBæE®5™Y·öu•ÇSUªÑØ Bû¦Ð9µÞUñLÆ‚Û¯ˆp¥WZš^\æ01º›üròÉÉ'”qKp<°¦ÉÉí·f@ÿÅâÌBë¡•XžÂse]Ÿüó„CyÝ—/,j\½kIõCæ × „d¡ð•€ò@n¥wd„±üH0GŠÇdpËñ˜ëK#BXø†Q Û§´ÔDŒ ÑVƒt/pY„à\[óƒ’w‹Ñ}Ö^ô+/ú^ãEî3’ÿ:ûœÛ§Ùºcý÷ÂEpéut£n6øÃ"‡â"9Ò~€—‘ý é™j=£V™ÁÓç¶ iÅzZ•f˜¢Ç\·D\L.?Rë7.ù…YZ¢\æÙ"WI§ "|Té¢R Cé™fI¢ÒYÑÒO ®WºQ[.M£Ðeµf£±ë†öy®ÕήÆã<.i¢¿qî¬êÜ~ˆW+jYÜžg«-…±ngËßêxÂÝ«¤`A ËXa=0®„¬”¯[%ít%±/“­¾ç°0hõßjôßÙk\wrÈ«¿PzQµUº¡†þeí|›Ç«RçÅ¡4¾Æ¸M«D]d3}ÆïˆãŒE A‘ij³3>Ko§ØÚ#¨ýá-=9=0öðyqóéuÓѶÀÔ¡×E/ÒÛugy\nÎø=ÝüÎX£pînkêÄÚêÄÆz°;5oY^]{›<¬DpûQÜH¼X’Q5Óøø‚jOIIy ag…î$-½TÅ6™·‰ž–ë&÷³luLnËR@ÄÜ–d,ù£k-\æqHv·Ô´ÓÛ~™ü–AÄB<½Ÿ®M0çôü)ÙüŽÔß!±õ߇…îñë¹ïVá<.â¸à•ÒßÛ^¹½É*j¨Ü#¤òlÓD#=kôaš¨¤^À¢ãRq?H]€#¡üîAºSóý‚Ô YÐ@¤Åÿ×Q95¡[ùé*ƒÒ{ªËéi3hÛ`•4Ø!Bÿ9Í™€xæÌñ]äðë)ì¯vÇ-‚ZN³ì{f‹œa¹þ2rp‡ŸÖÈÎSŸªU—KÌ€†tž¥ˆÒU®Ê8KMÔ“E½<ƒ]Ø`ænš¹ž´Pü0’Ò.ðÕ·g‘=’ “;Ôì r›°oÚ3 &>,5qÈ#'áG¤T…éª÷ì[eÊH›ˆÉã{œwµ‡°øêúšÅñç; ®-»W€(è=N‰Õ·j:Vg9Î0±…ö¯£7̱#“±5m28%$aŠ‚h´{"ÁÑh÷Z[õdÔÑ™¬îqÑš éÎÓF<.H-’z$½Ê•a_ªbYÏ$²?¤hu½›˜=i£3çx˜w=añ¿k‡8[g qbèÂ^«)­zIãVYQPO–®6ÔŠçÔ•ÛÈ=¿¼¡Æ⨠^•‘ójÕpªÄ(Ò3˜ =„œ„h‘Á‹±¨JèeM£=e¿9ÍH.üOoÌÉ©s¦YŒ0ØAÖ—&õðϽ.Ìö²Öù<ËŒ" ÐÝ!å£kP•š6ü˸,vZqÌÖ–S«^ Bbõuö;Zp½ÞÂ2<¿Áô p‹nv ØÆÜíµŽ¨:ˉ—D‰ zjœð×2¹­n¨»„Ð*5\ ›Ð |­´®àŽÉ²š¸ÒŒoœ#ÂÚ90‚Æ*RI£fëGjÞ0iw6¶Ä*1­õrcà>¾ÑÚÁÈ"›¢¾&>€™IÛ³æ°N_šu§lEŠÉXt™qÊzU-P~ýOħеCúå¶íŸã¼ ¢V±ÅWØãùfr:ÿO5ƒàjBmwoOLIÞX8ÝÝkcûÙÛÍæ½ñÆgê„:êž¸Ó{ F¹Ç3Óã;¸Ã| @Q;-Er_D¹(44Åö=,ï›jŽ zõ•V@ˆµûW#…ôY·æ`ÞÞÓ ñÖH+$ò¸ ÞhSj)°cu%دŽáv¤?ˆŸ÷¹ï ·#›± 5w‡r…&h/+lpLÀa’Óªš+Û&Øñ%3ç% hlÝÓº¿2·u` 7í¯ú—XÔî:V?’ÏûY1Š—»'p¥`~ÐÜ•ÙºW%`Ú¦¶UÈ š—MUIÔçÝ¥ßR¥‹fßj*Ó–õ¨â9LŠa×.V]/úÞ—÷-5ßíòÞu]æÁÿÙíýñØÈ‹y€Ã 6ì_/øsã{¶2׋ØE›#wHß7؈fÇôeÇ4‚êtòÛÇ#Ýk¾¿èÁëyéÚ“¥aéŒ »wBƒdÑœÆjs!› ¡¢Z#Î3Û~VüSVi hÖ+ i–Ž»]e®êIãô¦h2@¢ÝN_:z¨e À`YJ§ÅŸ^4¶?j 7Ž)&pT­`H5iéé@#ùeʉÊd ÿG¾. `C˜!Ìîfo³Âìú ó­ÌÁ!ÍïU±ülû_q>@‘È?ªÎ½Éf­ÏnÞ^„59oZ×ç“Ë®:”WsÊ Þf\Ce‚BóMŠÅžb·Vüáò_ÞŸ(qŽVâ%ÏšØñsrÛê›Îñ3ñîÎx•Uéì*pˆíÉOtŸ9cèö׺AÈáÕv¯ê£ ¾^Ž\æyÿÍÏjdKÿ3ÒcŽÿÍ¿—9øƒÀÖB˜Û‡s¼?ö¹oŸ/Õºl~Ï',ð¥ãØ7Æ^¼b†~‚/ðò^å=êëé¼£êýÌÛÎ endstream endobj 2044 0 obj << /Length 2541 /Filter /FlateDecode >> stream xÚÍZ[Ûº~ß_!ŽÆ/º9hŠ¦éÙ 'išÝ¼4 ²LÛêÊ’£K6>¿¾3J–lgÇ»@±Xˆ‘Ãá\¾’æÎÒáÎË‹\_¸—*p¦lÈÀ¹^8* ˜ïùNèEÌ›*çzî|]5ešÄu<žÈ0½¯tI­—M:×ã‰à£'Dx§3Wš^“LŒ?]ÿvñëõÅç 3rG8¡æ yè$ë‹Ÿ¸3úogj9w¦×Úñ‚ž™suñï n¥åæ[¹t¨ñîek±@('>‹Dp/ç&ýŽû€G$@:.™÷±€ÎŠy<°„ƒ 5@®CJo–)ãBôfA²*6 £–o©ÅQÆ;U ŸÆt"0dà¡!QÍl‘ ÿ<žœÜbS»y¼‰k¬”;Ks7¯7}œ,èù×õö©7‹4Ó3<&ɾ1Vö=ÅD®ÌC“TØ &hEM{î Z "Å¢pJjySŒ¥?º‡õùh[4ÔˆKMRÇó-5ë‚žU—55Û°xjTô…ØÕ(*<ÏqÐ Lðè±=´7Í£¹høÌ ‡>Zuhcœ2±žÛT¥›Iœ¹ºNܶS×`ÛxÝúñ¤õðö½lòuP…¯wEy«Ëê<¿>݇®p6åÓŸqlÎø3g2P8"0K8$¾Û!¼lêû²U» Xä…-ºo6":8¹õdše/v¸3‘ð hØ‹"¯ãĆBlƒÃ°²4/Ó\›\=j&(¥¼AJP¥}Ÿ¢;& RK^[®o­Ê’b=ôÇÕAº€Ux´kRàÂÂÁë-8Óó#Z€ D3â²,Ö?¹°U]ožºî,+–,ͳ4Oã„åºv%Òå¡+xçÝ“"Ÿ¬I¸Ioê¦Ôð,ç•;¥!›*›¸_åc˜JŒêUZQkI)›¯~ƒYFos]%e:3ßø¨©Ò|ÙŽµý[嘗,m@z±bã ” À×öYéXŒ:>=ãªjÖ–¥A\l¤9àj–éùÞœ¸FjmÊb£Ël;|¨6`Ñf­Æ«i­}Š[иÊÓ‚ü=Q)Xi™âû—±ðGDïÌí°u<·ã@õºe×446ÚÒªp¤‚5ûàݯã[¤hêv8”ƒxô„%Û9çk]-ié'Õ»…X]@wcLâyDUÁz}§ä(2¤‰³r”çOˆz?>œp_œ“£zÓôs”eü09 ×ø!>P‘ª’(àÒŸˆ‚ÑyS嶄zõæò_O©©ë•g›¿§ù-§&šŸïßv&„lp8‹¨ÓÀÿYüïÍòóÙîtk:°J>XçyÂb9ù*C£ &JL·²ôÇL…×äuº¶_ `ЭŒËTW-'zšêµßš¬µ/ŠõÊåaehÙ.Çþ(Fqü2öýQÕMˆpzR”Bu1åçE© A§Ê»ß®J±vcgDioš~”Zƥܦ6~˜›ù"]¦ð.­W«æIš'YïYkQ×RÜ£Ý;wØõR×wSêEúõV¨-©ÚV(Á<-Ÿa¹Ú’Mý ^YkóåK\‹þu|«Ñ«f^XÀáääç…÷énpàÈ"¼ŸÅIá õxµ»4aýµ~i«hö#ç’¬+§Ò†64âuñLíbAÏ*™bCÓfELÚž ©PÁ.P¨`•bXôl¼}oÀ–EDXéRi`Ί¾¬·ôésÏ©•­€±£¶“–Ô¸½´3+°Šèѱ¤E" JFhñâí{†]!DOy 8‰Æ¡Ú^[Dšé¬¸£ÞU{Ì×ö^m±>Ÿ§uZäí„iŸÖ1’l‡YÑÔ{¸:T2¾Lªôûq—ñZ×@¹Ù 0§<¨ž#yÌÉ(`Þ÷N!| ý¬b¤7Mæ,ã‡9a¨"ìÕ¥ `" †h1i”¾ˆÝ+º!Ðw0†\²²]£ÙMú¬Y€uem7_ÈÛÙ1¼JV:¹…bB Û=/ΫÓyàSÈBʇ«E$ðåvÑ×&ÔÔ …Ç[•­ÒuM/k»g¨¨c¯f€ Œª‡œÁ ¸RØzd[†¨ìÄØU;Ðaë³/ŠH¨ŠÜb<@AšR3kQÙiu ¥âº†A]ÅeÌÒº_êЉ›Å‘Cpîða¿À‚åß<‚³¨d§XYFÓT§TTRB«ó¥ðYèùß=âSyÔì¦Ù;›CÆ5Rr&„…š«7—7oÞ¿¾y÷êÍË«g…2/þUÜwxwì.íáÑð˜îÙƒœÐn‰C‡þý,N 1 ”ívß²Ø;u6%Gœ[ÏÁ·"¤zB_šÍœ ¢Ÿ„?J©,8@Ó#â l<ËôpGC§¦e,ÓÛV‚nWtæÑ7…I/:+¼t˜úÁc‡WošG /³’Á±ðBÍÿßÇ×é¦8ô4·>\|ù ¤ß^í˜àð¤=K“ž²a$¬œØ· Vèaãí’6«Õ.Á+ÔÁ˜K»cèžVô)iÊRçu¶¥×t™Ãv`N}î(—Ù´b³—©•9ì«L.m.‡ÇY³›éHÞÄUµ;ó(‹f¹Æu‡¨„XÝÍP7»ª½;åÅ—çoíQ î†Zé˜ 3q¸’Ø/ ¸£ce<-?rcÏOÐ̽óÀDâݤzt0ÙMóx`"ñª×n—1ŸÁ¨ïL8Ø Ðkmðˆ /øKÛÍøª=;¬[N;w1[ã&¹Ïáß‚ÓôM0µðÒI˜Sóþ|U¾¸)6:ŽnªvÊ?ti{ÆûB@Ê‹1%Z'5÷y«´½é£}êþ»¼Ne\n‡5•íjqu®q“Õ½UQ³(÷X÷¾-Œo'üþçóëçˆê7W¯þó«…äüKZùZçÝ ”›ÙŸÎ„ä“ú0®$Þ¶«‡ƒd;±HôöFÊóz:]3iÓ˜»χ}ÎçFãY)’ÑMÌ•´g[zî.¢ ·¹WbÝòÞÝL!ײø¯N,¯4Ÿ#D¡—áH{Åb+USÓÅ ´ÁtÔ«*õXØ⌾¢ˆô;—#ð›MfÑ&7ÉÁܸ\v‡-»ü2ÀSô1ì´ž…£ëñTúŽdêº4>éìÞƒ˜]gç}:¼A°»VÑpë€âï]¸žp×ésºë¬žºîRG3Ãeá%® rOêd3oÖ›ÉRÕƵÖsÑ\OíMkŸû¿'ò=&ƒþ9ÑážðøXÂ^Çâ'Tý P,²!ìx¾€U©ö°Lr1„úëÏð endstream endobj 2051 0 obj << /Length 1775 /Filter /FlateDecode >> stream xÚÍXKsÛ6¾ûWpz¢f* ÌŒvb»nãÌÔK“Ž‡!‰SŠTùˆãþúîbA‰’•´écÚÑAà.°Xì~øvIæ-=æ]œßŸÌ.Cí%A¢…öî^$¼HÆLBï>÷Þûw}SÌÓ.LEû­ihtÕ¹™L9ó¿%Á­)MÚzðÉÏ÷ߟ\ÜŸüzÂa3æq2.ƒˆEÞ|}òþgæå ÿÞcA˜ÄÞ“µö¤Žá¿ôîN~¾™HæŸM8çþý$ ý³ÛëwWw×?]ìƒàÁɧœ‰R.¸ôâîõh¶PÌ7šûX4uµ6UGBr¼)Ò¬4í·$kL»1ó®@ÕGôÛ€ÇZùÁv³(HB—ø{t8„IäpÈ¥_´4·uu—–4L×u^á¼zA²µY×Íó0•t™[Ú·&§Ñóƒ2c#i÷ªæõÚ=)“Ι MGϘç`2UL ·Úâ7s, Vr¿]¥Ý4d~:oêÖÉÓ²¤îÞ¢Y%\`@¸KÇ„û¸ þ )*0a0OQÛCTÐôÛ¨Àÿ6*v*É2·™‹ h(*èõ6*v-àûØ+˜¿N»¢®iV÷#Ö/ì‚Ø’àSlY”•¦Zv«Kà3 hP$]±6m—®7-¬æFž¹ ÚæÀŽIZ¶µÓ¹ø[©‹?Í(r)þG`zó üT¯1†prx L;Ò¸轫n—¸jéÈç39¬vrE”©h§"ZA‚H„*ö³‰`~¸sƒI ™edN·®óâc‚r òÓ}$uE x®{<’]“ÚTàò9)7MO¥AÄÊÄ¿^¼ª;X‚ÂÅì\`ÀÆaeˆ½Ö¡à=€yQ—e;?¹2î“ö¥ÛhGŸ¯€Ùô³.:=vp¡ô͹Cšåm|†OéOË›óc¹ø´ Öi†6¤øO·!”>׃ 1iNc €»4$€k„"¢Qô ²I!¥Í/à>4 G…žžŠnå ›^“àÍvÒíÖG:ñ0;ô%M–þ›œ·KŽ„ÏU¢½[@áõ½^ÙÒÍl=n– n¯ö‹¹ŽÍCOE*¥øbA æGj[Ô÷lÄ\xJ‹8ãK6`v°D8ÜÃøFðí¥d´M0ÎÇÛ úƒ ‰âÁpc¼ÅQËCrøo{-¼z-]O¢´ ÛzýîáæáywŠ°ÒÌöì~‡úSñ(‰uÂc9š2Æõ)t2Ñ‘HFF.ßžYö‰“¨Ý Ÿ¦ó}iðœ®K§*èßt+å$Ó¦¯€ƒÌéSÝübšÖæÿX$¾ˆ%ÀÇñ_HçKTiÄê«PµMOÀ¡CdÐ!®Ðö/…·»î—.Š2(¢ J(ƒo qù’ÚÚëjµ»´ßA_ OHØAÔ'¡ÕPñ´FŠ¶ôMtët¤X›´r[èQVg]ZTtIAžœ‚ÇQ…Ç¢«¢¡è‚ŽˆHSqCPù¢/ì‰5Åây»ÕTÎë ‹É²o¨‰8B.–B%ýåÎü⊪‚§[ >S(84 a쪅#¤B¨ýµàèÄ ƒZ…à±÷^z™¿êºÍ«ÙìééɾÙK¶ÌLP™nVT9‘À#±K;ËŒJò4Zˆ4SÙ‚¥"IÒ,IÌBJžeÂLE¬:€Æ±ÃòÒ?æy=|7ë¾$—¨ ³¬¬—í¬@ ÃÏÅ™`\ÌX4!háuu ï{Ó¾M§¨˜îÖO鵤í ‡YmUÐÛ«i8[N-ÍƼžìW¨Ñy?ï¦9¼–euÝ­fG£røµKI€ÕŸþØuôkœ管L Î4ÓþëUºé†q\Ùb*ü×æƒì5èûÆ}û.m—9à Þµ÷œ§ ¿ endstream endobj 2061 0 obj << /Length 1875 /Filter /FlateDecode >> stream xÚ½ÙrÛ6ðÝ_Á™¼H3!D<ýæjÜÔi뤱ÚI'ÉEAS*8þûîbŠ¤œÃv¦£±,–{{Á±v–c½8sôøï‡Ñ±¸ºVÈæ‹ÀJ‹³wkð—–Ãâ8°nVayAcnÝœýqöÓêlñ3 Ç,ÜÀZm-/æ,ò¹Ä.ãŽo­6Ö»Ùò—‹×«Ë7ó«— {Lx‹ø6Ì‘e»‚ÅœþÍÕÛÕåå5âŸ]®Æ~ÈBá=TÂKÁ]pß €µG ¯®A¼‹¹çÌ–««ësÛ £Ù_W4ùóúê-Ín^-½\)¹ÆAc‡¹€ÿ"àV ö<¾yqºyŽâh‚…Vòªlë¹ë̪M—¶YUU}( s<°ª4"ƒúdŸ¬L%JäÎ8óhòiÎý™¬ ô!á즫³4iÚO“’&yÖ´RÍù¬­¦qº2ûL³¦Jÿ™sg&[Pnè‹$MåAÓª(`£¡Õ¶® šµ{-\×Èzîû36·EèÏV.QÖÏé>)wr¨«¶J«œVYƒÆ@­9g±¯oÑË›W×ö:i$ŠGZ&˜¿8œm«ºHZVÛÑf4+dÓ$;¹O‚®¥²Ì6U©1•UÔ!ïd)Á”®™f”iJÙ¤u¶&éÂYVþÍe>Ò°ûô¼À/}G[))¹$ÒW¶‡yšä¹b…p}ÐMJkÅF0*’ø”m f¦I“QðÓª«S='ÍVÓÈ'][Y3dyG Û½Ô”ºÃ¶Ê­Ì•;ê²XÒke˜êk¦Ø®Ù@òMÖ$ë^€µæº‘[DNº¼½—ÁßsÛUGØ¥4ß«ó„qŸ ¿‘£$ÏÖ“²iªr¢ùùÈ-0ƒ”â¦ð½ëúc¬w¶ï izDÔ¦aÙ³¬“ZkVŸu™V0ãs£)-'Þ–º|`pô ý zúHœ‰u¾-¯½‘sîËÿ.¶š½w|G Sþ(]x?îÚ=èÒdè8û£ÕêXËKשiŸ‚c“­Ï%UºÊz¡””õįW-þ0¨d€Q "ÈÂ1èã†Ó<&âè˜ÇB…¡ß粈»–ˆ<œfë! À̉]M‚[øÙh²Blbæ@N°A¸Bª#C¸–Öö^ÊΤÐ0£JÉŠ!¡‡é-DU€—©’Ckï0&Nï“´9W0½½Ÿv8¹x,÷ øÕƒò=Áx=Âʧ‡ $<ñ ÃYkT  µ‚€ c­+Ìt3X«`an•,[šMÊ°ÛÜA9Pý ŠM|À(>Ãú6ÃÀÏTn$µCF‘YjêӔؚe˜Ý©@ ¨¼ZÀ_ K þ6Šad@ ¥loœÙ€ªöÈ´*ß;Ž»ëê>Ø—rœ7ÜabPÐÔ2Q¥˜Z© BS‰IQ$\20Œ Ôo8á_Ò*cX¥-ø¾‘­Ž|$Ý4†JL0ÞIM©+)²ªÅìt'6·ù¬€IAk ¬ ýAz»øý7­L¯bÊËi¥û¹<HÔâ>sãàIQËæDá×ýIøzž´\†A‹èþ ˜å€†º… ó¢ŠXYÔ‚V* ÀàÐœø1!éÓ?§8…ÇnNe€ôl U&…Ôhi×€71¼}&&>£AyN¨ÈT³ŠÆæ Ól{G ,ýÕ˜·².á†Òù<-4>ø(O.”Æ,Š~\dtÎBs¿Ñ±UÏ 'wÄâƒNH(clÝœÉùе9="yw%T„±i©b †0vÔ›ÀŒ«}Ÿ&upjÔgÅÚ#Qì™ Ð=Óp‡Ö*ø(‚øý­ªdî4¬–XlQHÒÅî@¦ÖÌ+ˆÏêÚèš`½Qt€´ÛêЉ]—©Ìk™¶T‚öu÷TáË<ƒl£ ùÄ_•‹ Ø0Ey_95Ua4ôƒµhÃò‘ÌŒR˜þ¡é[“ÆÄúüBÓdŠÿÛ:3ÚC {ªæ õ>U~šs9öÿÜ#¸Äà!êQ` |£>öàÈöm{h΋]Öî»5>@0ˆ!‹¬„d•%é´v‹u^­ÔªPj™Ǿo0eY9•R8T]ûAá`>o÷sµo¨˜ÄãœÛŸÆÑøÇf²oÛª´Ã3>­ßmCò{ *ëüæ_6gÎ#’uo¥tÊÖôÉ°IÐ…=H£¯ºØú6)ÑàHŽÀ±·,àN>º‘Y>ªŽߵr .LÉ°ü† ¾Ü£½¯ b.ÃòhŸªkd¢ï~P;}CÔî* =ë˵¼ME$ŒÒÊM¢žÝ6©»²¤â Jµï†ë4cU2öQ(kŽïà­lðÎÑ¿Ãl«<¯Ð<·ðÅ‚‘fcã#”è8ÕÑ’ž?0eyÒ·¸½hCzÓgW߃3øzšþê»°ï ¸ª®å¹Œs­„ëˆ)Ïÿ©°£ endstream endobj 2065 0 obj << /Length 1856 /Filter /FlateDecode >> stream xÚÍYÝoÛ6Ï_!tµZ¥H}ö¡XW¤ÅºnÝšìahû H´MD–T}$͆íoß‘wt$[M·À†y<ßiæ¬æ¼<ùáüäñ :‰›„¢]í»jYS§U›ºÀì¥\–Ö]ßÈÏ*Gã´ÖMÛÉ 9¤•ùq+Vår±’öCËž¡RG̪oà,Wöàn×Óîh%)"õÞJµåH¸‚Âçñ…ã÷›z‘U½Ž”ÖzhŸ?5„TÕÀ¹Ï¤µgkñ°hh oä“?æžÞÐø½|«­ô"J@—‰]…´nîAШ†ñ\«nM\k‰¤º©´O®ïs¤Œ}¼mÖ¨º# k•­±i` †Ëtƒ;úøEÈÐ-DàŠ@€¯Œ nÛ yG0$n…–ÕÁI2{F†ÝÔ0±ÀN öRà: ‘®Çp•ç&A€“ûÚpæræ¤LÈ]F–õZnSQU—´……ÂÐzB'Bÿ5+o_Žób»¡'œ€%n'wæÆÒglóãHFìqÇg ´¼Cp3æF¡O2&”÷ EËðytHÙF& '. Ð3BcÃ>ñíí-Âó]áC cð @ ÁâQ\¶x=09¾˜c ‘mrlÔÍœCÛÔãboÁ×€"â{¹ÏÔ嶎×ñ-±¹jdÖT‡Ø‚•¹-9)7Z™û ¸žëEÞW¡8}ß½õaèFpMû ,3qüm0\pH–>EESUÝ÷¹¼PiúOþÙ‡tÓ_d#ž /¾t%a®›pó¼]Ê‘òöôõé³³Ók$@v¹3ñÍOúÿ$¬íé}϶ÝVýš&Ø­olÂñØtÿº'!pÚ’c É4çÙ‚ûûT,üòfî³Ùù铉êM7ô·…ÞO¾E•òÿ ð{Ÿ–ýC "DøŸÔ` ÷©öø*ôQu¡‹6ŒW ™g‘Ãks|/ …}OR| s ˜Ç+Í’ªÒ2wJ¿"\éöèr­L©mzŠAˆ†+®ðXÏ.’ËG­¡Œ üê:u8âÏÒörÌ:xVP»FêpÐ3r|`\ê‡HoVµÖ´Gnp“Ö¯*…y½Œ…¹VW}‡uª=M¨ÓR1Ÿ5B¯!¦6±6£»–²$~c64h ð”²Öû@¼JåÆ`84HÞº_‘ŒÕ|®H2~ṳ̀_äßWåCÓ¤&å´b æ)-UÝΠ鶞lÕªLoŸºd¹R6Ø$£JÕ)€…?aÛí ƒÇóy ÇXYBU-‹íqÝ<ÍK xÓ›Ã@{ë`èÑÛLK¤Õ„½nŒ0ɶíÙϯqCX›)[Ï[E$ŽTuGåÚÞCOˆÛ”»X˜V[e—²›HÐQâFñöy%%+§r'Fìîo ožgü‰aò7ªHBž3ß„€Åó5\öíO ^§2ä|ö£¾Ø§Y·Å”+e/;±uVe:"Èà¡êÿt´UÛ endstream endobj 2070 0 obj << /Length 2360 /Filter /FlateDecode >> stream xÚÝZmoã¸þž_!ø>Ôbš/"%-ÐEq}YÜèµI®@‘[ŠLÛêÚ’O/› ŠÜo¿!‡²%Û›,ï¢(DÔœá3ÏÌP¦ÞÒ£Þ»«oï®fÊ‹H¤¸òîž‘¾ô?$~$¼»¹w?¾­‹4‰«x2åA8þ±Ô¶ÞÕé\O¦ŒŽ¯‘p£×:.5¾ ›¼¿ûþêÏwW?_1H=æ˜û$ —l®îßSoôï=JDzvÔÆóUϵw{õ+êVKm_±ô°qó®ÅU…D1áL’©9 <;î!ƒÕQN$÷_⣡w,˜gþ`aØ€…SZb"Bk‹1t?$ †q¡½ÅIÎûÍè>íQ*î…p”Ê7Gi6š*F>žbÙœ¢9J|ºûg6µKQÞýTQ:žâ'%}9Ì9èªãùg¨r¬Æ¢^¯1(ÓeÙ‡9dðoÖÃNãÜ¥×YúË0Ýó䃮,õ”:j¤/ Ã3íØ߅ಿwFD-ì‡Q¡OX{ßUd’ŽÓŸñºÌ±µÍË2}Xk|«µÜê$]<9âÊõššDjÇí'JùZgñÆõÇ ÷bÂÂñ²Þè¬zã¶ûÅmt[ I(AžRÜ‚ÏË'ÁH(‡ ^KJñ,ßËžRŠ0*/ xÿ .öJ¿?B꺬òÍ Œº„£÷6¯c#ÁËúù9d ÊWÎÏ3ð@‚ËZOçÑx—ÒHgLr#Äø)¯‘ö˜Bà°­Lë9ΰ”m‘O˜´‰2Õ8"É7Ûµ®yW+7 wV®«8vßÚú^…$}аcêe‚c;úÊ6F5CÉd*¨ßMB:v‹žçäCUO(—6èyS!C"•7…ƒ‹¤s¹ê} å ½(«cÈCJ¾8¡+Ì'8C×^8ÊD£a©£‚½ðõ¥qt/å‹á(ÿ âhÃ->"ª‹ Cß ;>6èåAp1d¬Ìw)óYbìW¨v $$f@-«¸¨ôÜzM伺“8ÃþºtÓÑ/ «…sÇ#)ÒmuÊŹO$œÁkÌà‘ñX_ÖIže:©PrCtK1½›MœÍ±·:Ðé: Q~À‹¼@¿ç¡" ŽŽão“xëŸBÇUß$F’óI°Ù0 ^¶%©HÄÃ!Þ×Óö>Çø2î'!帵EžW¨Ò¥.Þüú z`×€ÔàpNxûö-3‡2]¤&OµeØ*ßèكΒ•.g†Îž›í­6[$žây['‰.Ë78Ö½™ ê )ñÜ´iî“3ÏuZVÃÊO-”±…žhýðØ öF—C4?R§ŸþkÂÀË-P…ÜU(Ì® eS¯«tk+ c/±ë1­Vy]aÏ£‹8­Òl‰½+Ð(t <`ÿE -àîÉMÂÄ =8¥þ¹¨Hc{>¦Òœ˜vëA‚‘;þKé"®´£¯óå,^ëbo`-TÚ­_(ꤛ–‘.o6†fÆLËŠ1yZtæžÚÚΰ3r !.‘G©eZ+ŸqB!¡éòµ¦ŽëB†!-S>mŒé—Õ¬¯_žP8~(óu]¹¤Ë%™­õ ?kJO»É²£t;i+÷ÁÏ Ê³ß=]Êö!Ë'\‚AØ·Eõ†m=®t¡kaŒu¶½j¸?ha«¨3²Ó* ‘p È.W=·j¿lêduJ»f]›míʲ©ÍwÆwïÑ¡Žb•ïÖ|_)‡Õæ>çDúŸ)ž`LH£!a­%¦ÖãÞaBubV ©8¡>–›ÊMúünèódBîD»=ˆ”œÉ¢&ë±âì‚e{!‰"prvR‡‚“l̸Äõ@VotáÖËÍØæŸeÑ¡S§ì ÁNtdœÂúܱÝC·ð£Ë…0ê΂c4ØyîblojIû„Sëy®ÏqfIB%äÌ" °oì3{ë[9œ¹%¦ãÌÈøë9³€RñèÿÛ™_)l—[îç]ÆíÿûA’×YeŽÈ¯ñiHFͲÕwoÚŸ*L_kî§RqÓ÷þù2€Óß)Ž}X(Ê.8Brâ«èÀIê¢Ø][µ“ÖÊôÂØ A‡Õ¿‚ÂS¼¼‹p4tù´—ÒFÇ÷+"‹„5á+"‹½TÇ“¿Pèî ïÈÖÕ.+똣 ùd_c:6ià Ä9  ÉÍñs˜n,áFoö¿_€ŠYøpæhLU‚©Úíù¶N×süA“©òÚýxÁÖQ¾$nR‡Ý±î © Ô\~½;Öw&ç`‘uÿ*Oò5¾™ËAóœç‰­ *Xz†Ïª™¶È×k¬_lEb9ÅKÝ3êú°PNဈ­ÌÌUUmË7³Y¡ç›4Ó$ßê,Í9Ô§ ˆ ó¸JóŒäX¡Î`ÅÿJ¯œ5¥Ýì1ýÎ~ÌÒ_þ}»» üæïb8¬ÎðBñHóÕ ¹Ø_î«5aêøÂVóÕ¥ÔxéhTÒÛ¿ý  qÓõ©N —æøšfüÍÿ¹ÿð„ϪY[© œQL¤l¾|—¥æêGdö¦b™¥Â%c¼èmñéèØá9 ËY¼¸ú¬W*°’ßs€ñ†ñen89dô­½êVì¡IxFuaÌjä#‡Ñó©I`»I…®êb?燿â”ó1²ÿqY…aáóËÝõ1ÉÎ× [5¿ahžó<Ó® Úh_t<èfB ÕSKg’™¬wˆ¡‡bÿg¢ HCì|/¥mæŽï×Ke˜Ï!´‡g¤2é"Nô¯’.Y¸´|Ø™Ýέ2S#lô<8)jûýb„ÕQK2ÔJÍ+»nË/òýèqgtôþ¹éÿ| Yæ+ 9Ö*Æp‰‡•œ]è‰zì5y`'¾Ï|-c4_8+“½¬JCìÏÚš‘7jŽ7.ܽýÞNì¨Ý´‡ç Õ¼½îfCNBß?+¿vÏÎor%$óêÕ?É=þá°¹¥ãP’¹–Li>ipÞ?Ÿ îÓhÌ©ìì5ìão=y*ê endstream endobj 2075 0 obj << /Length 1278 /Filter /FlateDecode >> stream xÚíXKoã6¾ûWîEbš¤Þ9h·m°Û¢E·—l´DÛBôªHe»Xä¿w(RZÉ6'ÎæPLjHÎ|3ó ) [ [—“–“ÅÏŽoE(ò©o-×V@­À ‘9Ö2±nìë¦Nc&ÙlNƒÐþSðZ÷.›4á³9Áö™\ñŒ3Áõƒƒ("³Ûå‡ÉOËÉßÆ°E´r8°â|rs‹­ä,Œœ(´>µ³rËõCh3ëzòÇ ¸«7–î\]´ú!ò‰cÄC!ñÕ€ñÀëµt„„Z~Dç{éÀuöˆQA,õ`ºÀö%3„ Í(¹8( ÂNqÍ­õAÍ}0…eýŸŠÊXre2ëS+„Ìún—Yì£0ruf¯Þýu>›ûÛ_¦9‚mø´TwRtO.ñpx¦ûÓ¤.«nw´¸gYšÌã-ïD“÷KñC7¥æ²©‹N>ýý—éCËçøp(ò¢Ž›q À;б(ܪ=]‰úÁ0 íù0œ7Æz(3»ôñÞsDÂðôÚc¹RáøÏb9{4.v¸GC‰÷”¯‡í*fÕü#Æ4ãZ— ?Ó]¹M…îmÒõìûñlIÐz4>¸E~J¥z.iCúh( ¥ÈO*Õa©všŸ®ÕÝÁjÀéÃv5ÏG’¾vÝqíúž‡ˆëëD]\\Œ¹SêhF"i'«lêÙÈUÅÔýµ¶GUc7ö|§0q;êÂä®]4’èEë¸2^wŒ±¶¼£… l[æü9ˆ÷p8´NR°IåIëËT¬OR°âìDâ$‚IÁŸåÚÕñLòΧ̫Ӄa4qLÌ ÿLJÅo?ö§[\æ9Ħ?ÚýN1xÚW¬Þ49/¾‚_¦e#«FΓ´î×-À±E ®_¨´,ç_ç(2/!@ª…"ÆÂ$wa„”ýéà bøä‘>5‡åºÉ²ÏZÄ’„'ºÛVoÛ“¥n³TÈéÛÞ/@·ƒàémugOÝÁóŸÙRwŒ hò¼·¿Aý̵©W Ç#T&ÇÓòRœdì@™}[ú´»Î7%²ÞrKÊ|¿Ùß¿kß¾õ §…?¸›Á¦ub0v£úǺ¢æÞ¾ÒEçoç{·Ï…@„Ñ«Ýt<0zìrËk8S7²ÕuFµeapÃ)6¦[êve†bVs8£ô[Á+D®˜6Ó"Ñ-QO†zc3Þ*Œ¤0ÓšL¦UÆûq8ö¸_•¯™Lg  ¤2îNOͬkªJÑÖyK#42ב®Zõ†©P}`Lšçš3e.PF´$ÎR ú"M¸² Ã1-û4#€­ãÇ;V1cDè¶ ¬ç•1ݬRcaÅ×emTÉú³Ž<,a¼øÞÀbYf |o–r«µÞ_Ïø[fLµCÔ ! µ ÚE7c••ñ]oZÀƒrŠK=Ê´[ÀB#ÓS;x`d­[©ÃDì ¼R×ã´l„҃ΖÉZ™aP´Ië™×¥†r.·¥ÉL'à‰bïùaÏ›:æç"®ÓJB}>ŠxÐEiñݯ®3ªôÝÏtž‹¨ôWºƒŸ]Š\Ô[Xû³9õÝ ´ßmY%»¯ˆÄWŽSj¿/@ÆbÙ&AܧÝ'Ç"ýG÷®ËxF±}Çå.ôqÛÐ endstream endobj 2079 0 obj << /Length 1260 /Filter /FlateDecode >> stream xÚµW[o£F~÷¯à­ …Ùá2`¤m%obo½ÝuÜ`­Te£ŠÀØ-Ê%iþ}ÏpÛK×®úâÁgÎýûæ Pm£Qí㈪õ¯‘+Õ,Í·5ߢ„9žïF·wTK@þI£$<í±ÕÚi®7†5ÕÂÑѻ¨$ðlO[­57°È˜YšØÄ¢L[%Ú­~ùëd¹šÞw«O­ºåÇõl©o:câ»L3m‡–…úáôët±šNÒb4]õsô˜O|Ç=5Ç£ .cÄ–ž,‡¸òËda˜¶?Ö—†E©>1Õ?NÃ6J,(ŽÛsà×ñ,­„Ö=Þ|ÉrœÖµé9Ä÷ºzšRÄQ¡·®ÿ?ìÓ·HÀX›>…0ðoÜyÿcq½ çaÏû»™{ ˜ØP¿§©ŽïÁ‘¦ã‘1µÁ U¼½^®æ׋ðš¹ý°œáÓlþÙlP½;±GÃjLÑt2Å6îÕ4¼¼™·±eõ’”µï3¤8ÖE%W_W·b³EAÁËu^î¢,渵àõ#À®çåwÔ˜_…¸5_†ÊK–¼¢òâÖO¸ý%ÏD—"Ûà.Ï6"ãÄ€òýºàª…ySbø#×¹a3ý1㉬Y‡mÂâó.q¾Û5™ Kõ²Éð!Ë3³(óo”Ú5JÖy“%Q-òìõ–ãC—ÕçYÛ©„‚ã¢mÃbúÞ Ê¾QF¯çá V‹üGÐ>úŠtýã²g€ç¾Îsû]@3 ~¿­W¢*Ò¨ßÛûRð5>6U´QÝÊeä/o±2<¦“AÈ^~æ>¦OGÕg~=3Ëj Ê¦Úƒ’«´»“pFn1˜”M¥ †Âû"ª·¿¼U‚GßíW°”©‚ª ïXœI¦nš²Ç,j§üŒÔW§¶ueøTçUýb2g$ðpr’`Š‡>ð,ºO¹Â|——}Ðïój>‡°ÿd0¦+ü©‹¦–È’ E‘*£]“Ö¢H•×ZìºP0 ÞŽyéËÿ‡X7Ýäj-â¨Ø·)`êÀîJJÔSÉ£DMéŽr]ýe¾º:›“âß«Y 7RóSKŸ¬ÁPæçv#É€­à@$WÊ|ˆ£ µx6´tuLC^mQ¬œÅQ™ \àÝפJžŠïR ôñX»05•O3Ñb±FqÅhVW(-—µ8¢–“V¤éK·b]>õ'Š }4$ï<*ꦣôŽ×Û<éæ¾-9 F"•‡î  Í–,ÏÁv\lÞþ…êç÷ €õÝ[`›ð°à%¦;.2Öååd‰O’Ö²”éó5Š²פ½©dHe\á / í…&ž ;æ ˜ðªz—…4ò­ãiø„A“T݇æôg¢E¼ è”*+ÄÁm¾dõü®!žË–0àbS¯ß´–8Š{†$çà­MÉ[^¿²ÇˆÏœSAv)»ƒ|§íЗGÁ:ðÕ±í¶Rx8;(oªvŠÉ­ÉìÏ¥|+Ÿ.Õ/›®”e†ÛŸEÖü ,a¶Û²DîI–Ƚc–H¹d‰”WòÂ<¹/°‚!÷SQÕ¨‘+OÊǨÜR ž]ÕЮ‰ÍG}’Ÿ¢ÂRT¯a9üZd.¼zúÃE'ÿà-ƒSglk.|ÏZ6&nSó;Á4 endstream endobj 2097 0 obj << /Length 2117 /Filter /FlateDecode >> stream xÚ½YKÜ6¾÷¯ÐQ XZ‰z/œ=$ö ’lb±XØ>°ÕìaÔ¢¬ÇNf±?~«X$[RËOÈeH±‹õøêÁ"'pŽNà¼Ù|»ùÛM”:…_¤,unNÆœ,Îý¸ˆœÛ½óÁ}7vUɾõX–»ï{ÑÑìÍXíÅÖ ÷-¼µà½ Èg~¸ýtûÓæõíæó&aóØÏ‚Ì)O›Ÿgë?9¹ó ¨NNœæ0ÖλÍï›@+LNã…ÂaàQF {ŸQ.± Q˜ùEEòòó(FÐ4 ·ÚÿCéiÅdcêYìxaèIB»ßŽ ™ÀÖ¦®Asy q¸Ó ¿Þü¾pÞ¿~ÿš´LœþøŠÆ¶“Û0qÿHîý­ý/ü‘~Û‰KZ9õPµµþ}¨N¢÷&ÌòX쀸§A ”ú§Q:TµhøIøÝX‹þ¹0ýkDèÉr L@°e;T²¡ù£iRr½Ò‹&œ†AÀjÍáÁ2í«cDZ=Æ`Ä܇»ª¼3TuM³ÞWKN¢:ò(@¥nÉѪ©L^èR5 ¢G~ª¯€þÝ_}dB& Xgè ¢-t þBÃd2L8 ~˜?XÆ øc ¿¢"ø ‚V,ü0Ò”õØW[ÁŸ¢~ܦ‰«YuŠä¸M\Þí‚^«~XØdü¤•œ£U³ÈÌ+½V?íµ}Õ‰rÝãõ‹‚‚4‚eªã0œ«\Á•³pE9 Wô¾ÂÝ‹Ö…‚jy$«!B %'ÎS÷ÇÃŒsáòº|ÿH;îø–ÚC3õ¦b¶¡;x Äþ3¥ ?òAÔÁ·‹ÁÐ5?鈉2·‘M(t2wì)pRw÷H+“S ¾ªTGhMtœd Jd@Pb± Àr-ç,z¹1%èpE™F?q½¯êiÔé’Ùܘì÷4ç¹à¥Â{¹ ‘˜|L(a8»Q}j±Ó Wb“ë/èc‚ZbSfdõtûB€6ϼ~¡‘I¯+³êÕ×2Åî˜`ò«ìN¼®1:ãDyGŠÝêθr¶¿dcé:š•²ée-0$ÓCR­Þc@ Ñö_ '!²,ǶRgvR$î¿·!ì" —@¥¼‡+ ^¥­^8HÍUª3hÅóíص²§Âš¤.oÔÙV(¼µÅ8)kIî‹ûpm•õÁ”T`2õ~âöƒl{Ú˜5Usô);UlNtÔïÄ ¼§q/øIjŠA@MoŽô“Շܼ4’bö„ª… >,ÍPbO3viª9ÁÂŽ—÷ÇNŽ $0R7µÉœêò›ù®Ö»I#|šùZÿâ‡òG@JÞß÷FÂp'G­ë¾êáÜ‘ÍšãÔÖ”lÍÑöŠïoΦ³Åƒ­'¹+GQRøY–Ú£H~õ ‚ôó´˜+:é²ÜX²ÂÉÆ(óYYKgzÍ„Ä‘‚Œ`êrâMËL×—™N+3V†mñ…ÂT¡éÖ‡­Ê¼zOŸuE ¬¹HÁÛÛEìÞÞ©ú…2åéD±£¶5zËT?T =éåÖÎCWõäêPì:uºh1¬¯µ¶û6>&®}KtººòNü}÷°„ ËÙ‘µþíW°@cCýb…„XnÝÈÇAÚ.,Sv2í’S˜úy–¬õZ0°ÈÏ Áà…iî§q2?nY•„xß‘0gÍ«¿vâ´£<<m'A‘ï³ Çë%t\àÅ=S{¥0*&°ÂÃcá”òN”÷ýxš|éìëLoÓëAóAuÎŒ¸éŠV]sÑöT”\â%P|mÁþî%’}½\‡ÀQÌayG}vhºr†¥º/á*E(Îøa )ƒ8®†Š×Õ¹nIã4vÿ9©fý‚å™Ëü5W¨¿g_:)‚Ž ë}HR¯U*VøAhkL½§¾ð„êÊg¨…{†€ÇŽ**#QÄ|–äsp®Žc[ŒvÅiqèçgs¾{©èžðs”®y-2FES¯E‘KÒ‰@Ò8Y2ž O&Ðç-= tVÌ„Í•#WjêW&¹'ñ·¸2bìÒ• @¹2²±^Ë3ÕµÌÀYú÷Ï•$¯­öX-Ÿn™ž¬©ó~É\Ý»jPÏA̼ EggâªzìcäIüQ¿¥„®Oá¼p’¬;OÊ€Ùóìò4¯•“εè²ëbL?bEFY¶7,žßÛ"ÝbÃâËo¿°õLiLdúŹ€Í t††ÄOº¸Í™ûLp¾ëêîXã~~ïå⤨gFfŠ Ë®÷p‡©Ÿ{ï|ýG5,oÛZ+z©êÑô)g«H¢mêôbSÂ’ؼèâÓ˜5ùüªvúpóöbЙ÷L;_MOÇó{€e§-ÀÛÌUú§Öƒ;TÇgk[—gýZ©°³žæë{l#¥\ìOª†ë¶@ßÅÍ#f5\Ãn¬ê½‡ýìþikþ¸Pq‡tÈó ²%\<©Èíç<&a~i5\ˆ=Þ¶h):já ûçZù30Y´cýض²ŒgAB–œÝŽâìÿLYÊz‘AËE%±7öoýOÔê¿Êb懡¾ÂÁ¥BUº(Î.°'àw¼ÌÍ*hà¡4þbmÕ3;øá¨þ›¶¸z€Îÿ“j endstream endobj 1999 0 obj << /Type /ObjStm /N 100 /First 976 /Length 2263 /Filter /FlateDecode >> stream xÚÕZ[oãÆ~÷¯ /Ƀ†s¿nZÇ ·ÀXo€¦‹E@Q´ÍX"’Š½ÿ¾ßÙŽ%Ë%nÐXÛ‡äá¹_‡+cTL0£cÒE"98Ì…0‹\Ct%§lÕApåð®VÓ4³ªú.;;=M²³¢¯š:»Ê~zÿ=ý|uÛ÷Ëo²ìþþž×];çuÕõü¦ù-{×Ü×ó&Ÿuü¶_|ýí·'øG‚¾cQ] D{ϲýüo8õ<ÀYõj>ÿô6¢‚ç§Äß‹ˆlàfÝ@¼hêžž²ìB“ænýÆ©˜Y_P#DÖ ´H ‘]¶MqUÂz,»|wÁ²åCÏž©¯=p™ß”'Ù98•ußQ©K”Éî]³j‹²[—¿tïÇrVåß5,¹ÊIŠÛ_æ-Þ¦*,׈ɯ§2Lò¤2ü¨'@?æ ° Ø’qp” ”soP´á¨¨'#ÕD‹=*Jæs¾¨z^ÎVÙ¢ê:Â+šÅbUWENouYñyZ¶ÙùÕ‡¢i—M›gÕ¬ü-Ÿg³¼Ï³‘thÈ„z*vŽ[¤Ž±’£l Ðyn…:X™E~_ñ{ÈÆóÿu™®³._,ç岩ê~r‘¡Ø¨K9õw4©p‹È­‹Ç%iÙ·eWFÏþ¶D´þõdzóówçcÄ”IlP:<õ‚ ¹Eq4()N»/%åe‘//ªyÙÔÃ~h‹¨"¨¸ò¢L¯¹æ09;´º£€ ·y{Ç›ö&»Jî?Ï—ýª%©\QŸ7†SûGûæ‚BÖrô—ÃE½©úÛÕ4YV]µUÿyÒÔÀtÍ|µN»ÍI»ŒŒÞmï4)Þ[ˆŠzï¡õøèª+Õëª+ÅaU÷¥*Rî×y§:Çkàvh`Fh`zmq‡×v!Y䛽xعRa?¢ôŽÓ wxÿ–(âu3?ÚJîðC<ÞJ ôÃâ[~ØB¢¬íjF`²ÿöÝ1©aóV&ýÚ¾C«“òC컉„9»ýhŠÐ0¢±î†AÿÜQTï()Úoj=´¤è­j¡ÐÍì0ë¼´ÁÛø%¬cÌkëu˜u^ê:>áæib7rÜ45ÇÒL{6×´öGÏ 6S'±³éØE^Íû樽ZbÀîÿ^ç˼/‹[ŽZ0¥K§Ø èÐHC*Ú×F<NçÍ ¯êyUWyAázš>“"ë0©`]È1«LŸ7‹I±žºð·u#¦îh9-å‚c†Õ2p:Ã’ö QsW[Núb9[-–“›¶Y-³y5]Bèl‰<È°NmÏYFL¯ DăÁÖæ Ú`¹–_0Î=»£Éšx|îÿ”rá°ã6áuPhïËXm°HIGscúq§%FÜLË×U=+~¹¦Ý&›–6Îr­ò©^‹\ŘOc,¯±zO§ªœ¨@ç)ó±á­m䦴Fp:Öˆw-_Öš éR.Vóò!…9¥m—U´-àž²ížóVi<Í‹»ÉmÞOV]>¡“õ»“ë¼ë»žžvuu}]¶RÜL–m3[ýdV.š'ÄiÓô·£Ó[ÔNëÓ@Jç‚Ú®üÔ?e¶:UÚÍ9ÐÂ^ÚýˆFlËãÔŽ.nGy°#ʃuOUá©NØ0®5£éÑñ›’t¦ ÒÞîÑî•’Ü7ªq<õÀç¦G16͘²Íº¢­–}÷ü°+^€èŸãNKèUb§ôyÅ*n}B3Œa”Nùõ<Ÿ> ZŒRôKñH_eŒåCb! ÎŽ²-q÷×Bžo§œšrnÈ"·…ôæB½…'MàÑü·ÒÒ¾NK§ß'œjÑÍÃ~ÁXÉ°QÏ¥ûU€Îå+Ž6;LšÎ«WÍùQõK9´Cú«1àÏêVúd‡ðRñð,jËÙ¢ªKÞ,˺ª¯›®,®›U=K'ü餭íW°þ½p­ª«‡_®šâ®ìÿÃöMÑÌ_%^&qs+G˜¥ÆŽ»OÌHïïH¯óþKE½9òtòOW4îPÔP4 týâ[5w éÍš»§ ×ÑíG4X âDt1:ðÝ‹¨}ਰûñ,挵Bo HKèë~D‡Ê!¨¢02í.ÚÛˆBr=@gI+M 4}VóˆùýQcyØÆ{#^ô„·Óh+Û¾Äâýë‹öø>òø}wyl,uÝmE¦‹ßÛŠƒ±;`ç¢ÿ‚é8(ÍŒv<å,™òŠeÿh>4 Nø "õ4ê¯ÙVáî³ÿ?XÔI endstream endobj 2118 0 obj << /Length 1932 /Filter /FlateDecode >> stream xÚ½Ymo¤¶þž_ÁÇ)x ªìJÛn¥ÚnÒÉ´÷J{W+ž…j ÙTýñ=æfØI2·ª" ÆØçý<>Ç¡Ö­E­ó£—Goθ°B &¬åÊâ¾ žëY¾7äÖ2±>Ï®•ÆQÍmæ³ß*©ptÞ¤‰œÛãÄBf2ª$¾pˆ3ÿ²üùètyôÇ‘©åX>â.ñ©oÅë£Ï_¨•ÀüÏ%< ¬ÇvÕÚrEÏ̺>úõˆiéPjá¤Ö4J(÷Q`ÛÎÒª¶ïåÓc¡’J ;Ø`G$(®û9ʲ¿âêᯓ{½ãÝ—VîŽ!Ø(쵈ïù–í8$ô<$ñ‚Þ)TMYª– ¾ª&“8ºŸƒÉäÜñfOz¨e$[GúÙÌ%!Õ}r>RR5ùºHdµOâ~û+ÎqÐÒ?DÀJÖ¶ç „èl^z÷öä!Êùn¯ÙÁᎵ¸–Z Áf:8ŸÅEþ?JÙm£¢:-rœ|˜3o¦é“¹Í]_GðªÉðÛªPH ÐþxÐ?R©4Ió[\pUiŒK&‰—‘ŠÖ²–ªÂE©™¯ïää®V†`v¦9!oŽ±ð-ZÛZÐ}¤b™ÉcôC]à3¾‹ò[Kȉ\éXŠšÌ¸5+nÍ—Tɸ.ÔÓƼúOÝZ8XœóSD8ÜàI'{sÔ‡<ð½>OG4‡Y‚r„î>°š2C±ôȆmwfÀ&$Ôq†lô¼ësúAGXIk5IyVÆð¬"‚"/mp ¦g6Ám ÚZ^[݃Û`ë·o"õ¦^—­µ§øçr0|p€ñv}$Dè½Æ‡/ÂZ/ðˆ'ú,—ùmšK;Ê£ì©J_ DW*ÍÁ’,©¤ÆŸ _t‚qêÌzº8»Âg’®tV¯¤’Ýî ¢Ì,LÍö6AôŠ‰ã(OÌd›yi Yé gveÎ/ýé.š3jÁH‚²¢¸7d çžäú ×ö°0Ji*o[¬MÓ íã]d2¸7G›ô‘ù~c¾Ôv¬~1,³ÎaMž~³«"¾Ÿ„g߇Ã9ìÆ“Uš=Ì#ec¯þÖ–,œiìËÌ8ªð‰ ƒAeoZ.ñÖŽµ*2œÖ’¶'¦ö§|v¹i9 ˆª8Ãpc0û£EÉÁ/¸v¤P?xÝÒRáyäÐâúw9 F¨ët»[ÇÅz­ãl—•p ~è-l©ëðp±l•JÀqüìD¨9 Ê8*í›fÉdWéŸr"(ê/ô7Q¡×튀øŒåÆÓzxjµì0üW[Ÿ®~ze"^'bÓå{§­G)m|0À,àÂõá›sˆrY¯£rB{×'ë½ûùíI"ÒX>S&2FBÇ[à4nt6pµJTÖ2/-®Á³„z€Æ™u1¯§ÝYSµ‰^ñétù‹¶L»+Çç™’òÇëfRáócš7ß e/ð u;ÓáK¤ßÂ+Ìë0Ker¬«”k«Å î€B5Uµ¬T±Þr¨1/ú½z¡z´ò)Z›’´Ǧ’ÉA¡½RÚpÿ†KÛ˜=ûº¸øtn:Úø¼õ·1=ÒZ¥èê·GÞ7t¼Sëml?mÁ°zt/Ó®îïN”ÿÏÈvœ5xvšLˆÏc}ÕŸ&ûÑ#t‰€>ôøÙÛðÇ—‹ÿ€&õS9 †Ü!íÁðD/{®uDLu./S¦•£‡=óé«*š<ß›4?mú Îæ…‘ÇWBaWÓMztJ'éƒTµ­+”½ºCíì»cÕMŸøY[’aðaË¥}wuöŸ®uiûzÓÒŒ&ÑíóͨAW÷¡p¾—÷ø±ÀcÌtÞ8÷aîÒÙ{ýÓ9?RI ¬‡ $bL4M¦*eœê< ÆÖJFküf‚ÌLö%¥Ó@%3ÀeœøÃÐ Ôà·e6ž©¹àÀˆeŒƒéé.Œ\~Ë»¾ê-7ˆ´Žž¶KÜQ¦—@£•–ÜÖéºC@Ð*é ‰iÆëwpê³7…šë {Ž<*£ZÆw¯m}†GÇž¨%GŸ:¦ø(=¾¼¿º8Du™"Þýk:,çÜ›Aqþ_ã®Vƒ €dx¥”ï°Û†sñ¹£ÿ% ÎèØß±aÜièí1MCÕ&Ž»íÛÏo½øò÷_@ÂeÄqLѦï)Á‚±Úúxr!þyÐ×+Œ†ÛRý §g: endstream endobj 2142 0 obj << /Length 1200 /Filter /FlateDecode >> stream xÚÅWKoÛ8¾ûWè¶PÑÔ[ °‡¶qÝišõ»@Úƒ,Ó6Zt%*iþýER‘ÇÈf±Ø‹Iœ™ï›§ˆ­­…­éèÃb4þÄV†²Ø­ÅÆJ|+ SfµX[wö¼©h‘‹Üqý$µ—5©ÔnÚÐ5q\ÛïÔÁŒ0’×Dý <çÇâËh²ýy` [žR¢'V±ÝýÀÖοXYj=´·öV§°2k>úc„5P܇G€=Œp(ÀîRÚ…K~ï’ç¡,Š@C{å¾¾xÃu›’ Aján(@ú„Nì¡ØËŒÈï³ÉtòWËÙ€×f=pF±ïÃFkåþtBlS±“ŽËl±#j4Ú•å¥Ú?òF¹·ÈõI N/„Ú?ìh¡µðÍ‘6ÉF§z $c^ ¥\puZ5%rÜ KìÅŽÖÏÑ45ѧ-s¤ö“_ùþÀˆôø`À´Ea)xŠÁfý”\pî6z]ªu'ÄáÈŸƒ¹~ˆ2H%×KP&rŒBÔLøêséä{ ¯AZ™ÏÓx•ó`×jDoÀ´’ìí &e¾b­·Ħèëÿ¥¬©ˆ:hã#ñŸB¯v¤ªxåD‘Tæƒ8æºDÇÙdHµáÕ~›ŒJ¤* š\úX0ž¯Ñ9ЮƠ ?9úóòö,òyIúy4@iä‘]0ÞÎ5ØæÊï sù”úT…&²o]Ûß1ö¡`eyAÝ?¥ª\‹¬´B°½ZhÖ #£PÛÛˆv K©][£Êì^¥|dïrÇÇƱ²»^ŠüÄÓU¢3lEHiŠö©Ö&DðGM]G+½jP".r=d™ ʨ ¤þOêçÓÕõd®Ôû›Kµ¹¼šM>.äüü6»š këå<ï×ظ©«1ãEÎÆDc3º zÌ÷ì\.yQŒÒ¬û¸$ª7L_=™¦ÙUë°T —Ê8o›ª'£"¾ ŠA!ô¸Ý· ä¿mGí,+/@™ï½Èj»Ë‡5­àk„WN,GË¿ÌB¥nL$åôU}TÏ‚[ó] ïiM8ü&ç î\us@7¬n,@ß2P¶°^pòo„‘]íalu]w%+°ÙjÍFÆ䢛ÔùÙôfä›]…‡>ºù&KbñbA C£0H‡ûîûÑ@Öºs#|öÏ|¯yÜÊVq<¥»ùžd‚Y`¦ŠÖñ!в¹‡“H~Öã.m]º®xÓKííø¤ApÆ =¯ã4ï'ÀÿFK§áizǪ(„äxõ{êäƒ/„Çš§»†ïáv`Q„RìwSr—„yûÇ…‡ŒýU½CRpUÐN loÛ7!~âæ¿…í• endstream endobj 2153 0 obj << /Length 702 /Filter /FlateDecode >> stream xÚ­VMSÛ0½çWèhâJ²åؽAb Iiã)‡”ƒpD¬A‘‚ìÀ„__9–´CQ9i-­ß¾ýЮ XÎ{Ю=dV`0@0 a ŠMoyÁÊìO Ò4O­ ˆâĬ,zß{§yïË™QOƒ4Æ1Èï@”¢ !Ä)$ _¥7Ÿ\åÙÿ&ŸÔQ„QŒý>&J³†AŠP«Ÿ]œó,›7?ô²ü˜bLÁ Œ>Jñ•Íp@‚  ƒ¨µxâGÐNçß|½ëËltžÍ²y¾°”ÓWöC~ï7D —TÞûÆèíÕ®je×’µÂBù˜xO\®»-ý¢Ä­xÝá÷¼ý¢rÕ +Uì6LÖ´æJ¶[…’µæ·>†Þ®Ù­:,Z·RI›³GÏrØÐë´¸ÕßUÌš^ïxw¼UUÅoûzÈBW-ÅAš|¡A†¸uþÆäXkÙ'z'r¥µFÆL?+A‹~e¦˜#ˆdý3ÁvÖÑ©O)QÕš:KÍ«Zm»ÜþôBM²ØV²„|'\#ª5³™]lõŽ áDmÔ&ÛºR)M½UŸ5â´)áO@º.©®M»*Ó¼hQ.Ù­P悸Z+KE(·8©înИ>8A\¬%-¸í *‹’=;…dB«®)\T¥—W¹Ÿ˜Æ³¦99!)C¡uiÃk76Ó¦O¾Ü†š1ÁœsÉlŠûG'"3ªmc_(qȸ#JÍ­7ã¦í0G˜Úº3l[ ú·ÚÇïâØ 1Qò~C¥^””‰èÔŒ&“#3iöÿ66q.™™¨znífNÍ´Ÿð Ó•c³™óB‰—ñôpËÜ«»!;£’5Õ}\oß9$ p> stream xÚ¥’ËNÃ0E÷ùŠY:1cçagI­T ÚÀ‚Ò…IL‘Giõ÷qëV¢/••í‘}æŒur@˜8£Ä¹ûÄ4ŽxÉ+"4ˆ}H2Xù°.SÕ+×ãB’‡N¯ín2”™v=†äÂfºÒªÓöàSN™»L¦ÎMâ¼;Ì4C`PÒÚY,2SŸR?–°Ùݪ!ˆ¤Y+˜;÷îEñH8þ$,¬/A0¤è +ýÌy¸ë~x /D$wEY•«•q ‘Œ]Tfœ£{4öùÏ Yûb!·*¬µËB’·ß ü_PC×éÊÒÆCÕ·ÍY˜G7BR¦}»¶¨éP•ú?¨&ÕM¿×ÚΧšü¬¯zRia13ÕÕ'ŸtšŽ0 <ús8¾Lo`’ÇöNœqÓ:–" ×…Zõ‡ð2I]/âœ\¥.GòÖ´Û 7•Îò]¤umfïNM?ê¾½K endstream endobj 2162 0 obj << /Length 2443 /Filter /FlateDecode >> stream xÚ•YKs㸾ûWð¶T•Í!øfròLÙ“™š8“µ7©ÔÎh’XC‘ A­£Ÿ~¢(N*{±€F£ÑèÇ× :ô¶^è}¼ å÷ß7 ~COyyäå* Ò8óÖû›_ ½蟽0(ËÌ{#®½—dü¶ÞóÍßo޿ܼ{ö2(³(ó^6^Rª H•—•Q ÂÔ{©½_ý¹ÿúòðóê·—ÏÄ®’ N²ùï")üÆA©ó?}zzxyxx 7/—*fiäqòGUœœ ËA”¦^¦â á¿|úððôüðL'†‚Ë„A”Åð7Δ7€©®ˆ?¼ñîâ2#YwYä™èÿñé—Õ]”þGÝé¡jyòõøºR¡ß6kžiÖº3šg¼{gk†`—"(áÖ$÷+¥”¯cš¾9iäG·üûy§þ±Ó8S¾*KÅôýá44ÛÝÈ ßà/¨²(oí¹•ÿ¸JSXŹ¯5¯=÷›ñ­b’å×úý±««ÔŸºu°º‹UêÛDPªî{Ût¼ûyñã­eKR¿ÙŒ;™¶}?ÐMeý}oF< …Q*(S‰¬¿Þ#K臑RáŠCÅó_žï%ÚÊKsª<(ã˜7?üŽªéáÔ³ÑB¿1ü{ÐþG]ótìùwÝÐô'žU,ׇæu…þqI"ú ´w›-òûÞÙ[ د{ݱ}B_$‹˜]Õm›n+ —Šw½ª¶íWQê¿é:øƒAÍéBFŽÄjq™á×AW{Žäyìιe¼íe—‹óÔÞÔà,ó7àj"ïÁÉL2o(¿d‹ 2¿Ö¦Ùvè$£[:Vß‘Ý2£åyÿ‰)§þ8ÈiƒÖu¿¿Ünv烺šide!6#„uVdþû“,öÝ8TÝ“„98Q/…&ƒ@M@ P °ðÅùȃ@lºQw5EP)ò€º=VC+š§|#dp7B2s+{#$qÍÞ‰¸‰GS[‹¢ÌJØ;“×qX¼âH> ÕÜe!_ù(‘§C Má…éhô`ÀÈICœØ­În8±vñ³I;ZÊ+\!—¯Œ0ÓhŪúèz¾RúCÇÁÚOˆ^féÞ—×âRÌì" ¬Oz8}àáaè·Cµgæ·]o¬€ã¸ëÓu¿ßSfO '= ) ã0ó¿…iøÜïõÕ)|IÜþ|¥êå%™vq¡… [xY÷¸Y°Í¢ãëÉ‚™ÀG> ¾hcH%$º,€‰Ëdš"_Ó™QWu7SXKBÿ_P 0¢@Õ ¾ÛO—hQZ’aœmn-C¸ÛMêÀ?wš¤‚CHÜ7 @$†êÜæ P¦ÆBÉYèö±‘gÐ= Ó¹¨VØl•]Ö9è 6@ŸÆ±ÿ7V~Ú;ÇÙ`®o0³#Ï؈38qÁ“´Ž%­aƒëª‘i'²4vVv5/±aéŒ9±`¯Š ¬¹’ëdÇØaPæYQ+­ÖÖE+„.…CV‹wqksÖ¥2ßç³òrÀ·¹”.°lÀ‰<Š°Ÿ2–~y+ÜÍ‚i«‘¸† y­‡±Â]Øм6m3r*Wi°Ž°#yBȯ2$K¦ã˜J.žºÜÍáÛaÁëf3 Ÿ}_7ó‹¡ÂålàèÖ8ùOµ?´Zòk–‡É5NÍá”KHüãzÇ£J²Š“Aä¾í´”[Ìþj©á±ÍÆÕI¶o4«”ž}4’•Û+Ü‘|O•ЮE?ìž~ÔŠEEê0*¸öL Ma;.•M+,0ˆR°gÚf¶XÝJÍèPJ‡,¥·êÝ÷·?‚ÓB;€ÀÀ)²ˆâÙqEË{nd3{g>Ôm'à³l˜ý5ôÀûNZs&Û±]Á¬5¢6—Ú-: 9ƒV”¦®!IÎÎñ[Ã^°¥CÏÌÐÿÌŸøñšL¿¬¨4 ¢?lÐiX+µI×ï\•*µŒöÑê>ØàJÓë\ä'ÐÂá`Ò¤ˆ§‡Gÿã𤴜N`ÇHf§îå›L_¾`”]³«LsÂ8CÊòÕv…é@®Àˆ ÂlV¾ðo쇒…g¼„ížð`‰w™¦@äúÜ©õ#â¾5” aÁp ÊÂ×^GÜòË+ƒ(5¤°*s.¸¸dD–:$û œáÕð÷œ³¸ßá=±PÚ’ gÃÊ·¤±â˜Î4—¨ ÂÕÈb×OÕðqzZJ?†Á,·Ï\' £KBÍTþ§e_àaŠ•ƒ>ù†µ¼0§wíØkþ¢Ýq÷ƒC¯óÇ«<â“6 å¬ Τ¡‡ß NÒ³SŒð&ˆ™OQfƼÞróÓÀ¤ô¿MWµ„®ÃÖâóÉ‹ÈI¯­&ŒC©Ý8ôõqÍ_ÄR(+Gzo.Cç#Ši]B&éä6Ib#&I&Ïg˜±„³AC¯ÃoŸËy‡q<¶²ýU~g¡„âpµT1¤–p8+åïxBÞN°”“»àOßÔölUc¯>X"9%Áê},øÂ_0÷!· ¡½nN® ñP‰¯äšÁ±©d7¢ö¯œì´‘.ÆcûÁí–?˜X-ȼ6€~¯–âæ À^ªz¬òæ8t½:sL°Åž™¿øñöMpt–·U­/÷ëVWÃüõq’treÜÏ­~œÐßWå³±¸>‡B‹ÆÄ$/þP^V“FÕ}f½[?¾.?klå8 ž,4#î…!\7ÒÐ_(lk¸j©t¹Zç$Y”\WçÅMo¿³§_qçÿnI“ mþß–¸,þÏ¥QÄEä%Q ”|BŽT> stream xÚµÙ’Û6ò}¾BoKUyd¯øɉTb{íIm¥’<`(hÄ …‡ùûí ¨á¸R[ÙFßÝT¸¹ß„›·WßÞ^=§›bW¤*ÝÜ7™Údû|·/âÍíaóKðiê«Rz{­²<øi0=ÞNÕÁl¯£0xÆMmô`ø%Þ©]´ýíöû«×·W\EpX¸‰ù~—…Ù¦l®~ù-Ü`þûM¸‹‹|ó… šÍ>ÍáYo>]ýë*BÃ]ô…;•ÆF›M~œ¯E»"I”½SîÂ8ã;ݾþøã'&ôå»W<øîý»W7·7ïßÉ›÷퇟oÞ½•[¾ºùtûñæÛ-Üû'„¾ÀòãûW7on¾{¹-€–‘öÏßì}N‡›kµª&*Ü!0^x0@u¡Ð}ª8g¿~¨¶QPš–ø ïú|®+#‹c‡Ï8Ðí6J‚ž<÷Ý}¯^ézžìÆɦ¾à•ºþw^ørªÊ/”];êªÜš'Ûn¬J9û\ëÒxþNN¼v÷?ôÕýiäµSW쩃~¨Ú{ž¯FdÀæZî|Íä›7šçÁáç¡ƾºÛª0˜F>=¦Vç–˜¾xØíZ%3oMkz]óˇ鮮JÿPswÛ먿µÈ~U*þÀŒ„áþ™¥©î¶*¦ Yþzs4½œÂòÈ}yäÁ01ƒs'¼|¸¼6Ê)*r'D€èÀó‘5ËîÀ¦kˆ8‚Þx¢1Å‹@¦bÀéË aIr—Á`{…øŒ?z”1¬Þ´$NÄ„Ã õ@ØZãÆ/ßÀUsT$=.8“2gª Þ‚"9î笥ùB§s«È¢ožŠ|˜M#ÓYpîú±Bú T"eË.„äûöwpý T_ŠGMw¨~ CV-Ï-è؃(jí4ºjá‚+Š¡[gº!p¬½Ÿô=ik˜¿†IøOÓ›ªÕGÐþíž]ô^9ìr¡0@/2È°-ëéÀç†Dr7‚¿jªÑß%Oa`H6Æ#ÔÄå%QÍv@RÄĽ֬öˆ•LLP€<×®y8ôf UVIèŸxÊC7j·-۱Ĭ—¥¨`5²SŒSçêâ uªåI«~ È¢¸Xú¾1À‘ÁáÖåÝd±7<™0TÙ¡.ˆBñ°J®žâ}LœÌ‹™›â`Í!) iñ¥eë”›ÝËÈWÅ0«y€Z‹Ï~jYùñ…d§Å¬ü8‹”á“nB{ ²£}þìÃ91#@ôÓxžüØw‚iͲ«G<âájë¢éÆ ßŽ¦WÕÖ†±!wÒ”l7M|ó‡Iq‰8$É¥©(0@ÎfÑ~*pQg?í([ŽüO_†œ“Ê(_K—sɪóErŸÏ¥_.…ÎÙÒ/—ÌžŸDOè%bî¼T9Td®±’–<ë/n¬‡N5f\Í_É.ýƒ5p ‡ŠîõÍ¢K°‰Ràc¾T:Hu“¯õòÝ>u‘YSº½¢¤Ñ.ÚÇ+Jš'A3 t=ˆ£z"s›³Àœ3# p\“zÂ"¹d˜,Á(x ØjÅɬÌîÖCXMÖå.á0al°‘.ˆðM¬ÙfýXùžYzV‚" svKö_3/ÿwöß=Íþ4]e¿rìW3û#Ö\-Ô]9¦)Ë´hÅ”Ä7ÀS²ŠgKUVìù©«["·tÖ½¥lnùpò>·ÐŒ™¹s(%³³à œP`º¨}°ž©Å¦Hý›ß\ó}Ó` ¸:fo1ØmÎG5 ‹(¨™|2Ñ”ôÞAT²G¬Æ#y­B¤#¶f±`@7ž‹:žãV(¶yYÈ'kã©£€ÃY"øƱ G܃Š³Ç 0ÚoA>X4–„Æ2T"IóàÛi\âÏ,þô)ük÷tC ‘-ô(eLm²3¬Y«gæ¨,ua¶–@žîeΊ3éºf™5Ìק<ž§WZð)Ì#F®cŸè Š†ÄOuPW¾-)p…œ×«EÑzH> stream xÚË’ã¶ñ>_¡[4U;Z|WNN•íØ•¤’ìø²}€HhD›"d><™¿O¿‚gkÐh4ú F»—]´ûöá/Ï¿Iò]u¨r•ïžO»¤ÈYšíŠ´<¤U²{nv?î?ÍC[ëI?>©¢Üÿ0š[ßÎmcŸâhÿÿ6Ñ£áNrP‡øñççï¾~~øí!†£]¼+ OETìêËÃ?G»àßï¢CR•»WšuÙ¥y ßn÷éá_‘P­¨®ªK 6)wE¢¤`¢R*£ÝݲߤáIaI^ÁM>þeDë âXÒÂMúª®íåªûÇ8Û¿=>%y²o'üªýk;¢ùó:´Ódzµ§G•íOÀ¶”X•Tñþwé®mxþɲ^0"#'MçÁn¾=Œ±C2Y¿´ˆíw$L&T*@вÏUÓÛcž9 ˾<µ>ëá1.÷/‚§·È•Ý3â)ŽU–1;.v I9à×tÒbÿfçaµeòs<=]Ï@Ñ’Ôuo#BÛ1yÖvzÁΚÓà(œ8b6º¿%ºÓbÿW± ‹¶úˆHÖBšr¯†ÌCxøœÏÔæ*~W%±³‹E`Ù 'ó*ßp‚0Üß²Ïkûº›Y.Wá ›MtÎÚMÝJ°æ0¼» UÒyhÐs6ÙùŠR’tøÛ^›Ž•ŽÔÌòöBÉÁ¡qÑ¿°ÍRt}¶7=Ý6ô‘¾ÒÀ©ý¯(``ÎM'¾ehŒ–¿¶_¶¤{7´opÍÛ8™‹['džÛú–ÎmƒªöÃŒZ²ô ×#›A¹hù3ŠQFÓʹ5~•yϘüŽýŽœL¶é•2fD‘o¤«…_ïe2'‰…@.º‘ùÇ7—}³æÂAøä0JzJ˜\Ôˆ½Ó`/ÜÒ¼¤1cûÒ³%Aðµ ‚×[’ŽôÈç^ÝêW>DÏ@¨!ý½Ðî¨å×–*™¨Z–ß±@kvdEÀA50Ž»8#K¸¬åè טn” dþ+îÌ:ͧ^]ï¯jÅ”â”*§§Ô&!ƒ±;•„1´Xgi/Z,jÙ UàX‡À%Þ$À0Ñeãë9„2¤}ð°(صs{lYÊ`€Â€w±¾2Ò]²& ö])OT²Ü*• èVºhw–DHäsvÀ[N@ qcœÅ<ãÛ€å”ßxívÝ(gG0칆 4y]$80°ä…8tÔ”~à^~_êðaÜùa+øgALQ±¬úâ²4v•½4h–Ü4âš7v8×[þ6–GûÁ•(AH ^±,Ю”át?«ÆòŠÜ3ö9?LcïE€u¸ˆ¹ÁQ˜ó7n6¸”U€¸È×*¼ Jé@ûbš«& Z¾osï™oÚœèP*ålÎך hPKá[æd@`kî¼_åHõ 9‰Á¥† ’=”RŽr%”Ä%ƒ0\P „êÞV·NjäuZ,Ÿy%‹·OJ窠Å[BÂ/ç¶>)d60ë””wŠß-ǽ1 ÷Y¸ˆB$^L ¿Ë$›RÚ…&ÇD„XñúÞl‰!ÅŠÊÅŠÐh!ý"ô*.:§yp9.VçðXÞþ©˜¯Où„=^îhü‚¼j¨[·Åù«u.¦Qâ/8ßF{&쥨D½Jüãê$\ÛwÊI¾m°t[{U\ܸh›ö·“—H“E«õóQ@ñNl_)_†þî´ª£ä\G¡ºÎ€a:}½&‡ûbÈ/sórae©$’Åz ¤7x/ä÷ÖeŸÎ8É,0£4·Hòý .Î̤^b* ¿>=.­,âK‚N×^ÈUºèO¾ÎÙ,çyžhCd0›Ñ†¢\iœÀ€3Išîp¢¯\™ë'¯g#dJRv噇‹†f‰’a+ý2LjB"]üºTC +…r5 B×Oƒ·6¹‘wÞ‚‚S$¢‰—¬$Â8•°¯nÃXcy6³6qúVÏl,\Ôø@ÜW×’èË·&ÝK¸’’¸r="нßøÞæÅk'a'®np`A9¾ƒ%íeîÀá;sÒ˜+—úäXëïZ/º#Ã\:‘û2¢ì°•ÌU ¨ˆK$šx‚ë–ˆºÙ…ÜPêê-¹¤·øåÙ¡NnçmbøÉê&®>™”›nB.§X»-+@}ž/%u˜Ë—®±4.ˆBM\À¯GÞ‹Évì˜çN܈Vp(.›bÊ‚¤»éíéD¯Ã5w%œD*u4ôt%ÍKKÊx»!hJ.ZÞ:uåÄ“'4Õ K*ÅWøbD¹À‘±Uˆh.åƒÓµ¦Žóˆ¡w¸ø¡RHþJå,âÀœènÜûѺ:P;¹g¤æ§|Œ]Y»óŸˆÂmÂé:ñR¢ÛY´UV㇫̀óÝzi¢ò0äÇ`F‡+3\N¹¥{äJ¤šŽß³éôhKÿT.)Iú˾ØÈc:H¥ï©@\Ï–Áºêù2R~@ùOæR‚ÌN҆ś:ºz£swƒÏ6}s[ Ô׫ãzpŸ®$âqe-·{¶îµñ‹wp·íL*Á‘ÇõýIÀÿ9Ù’w©œNWNr ÷ Ã®¿tB ó–STå"¶¾™kYšPÁ ‡ Ü Âgy3å#PâŒÖWfSÈsëN·9‚[çöC× ±è–ÁñBÖN%O* ãZåj=Ðâ}ðσÄ;œà™3?Ü»ß+p˜/Z 3ƒ½àT"à§&µ¬Ã+§økúä÷ŒpŽØXÚeõ³Ä]þ~cs4ÓÛÍ>‘{´Q…¼r•u̸7-2à åËŸ [¼ Xõ ç£öx £Æ^;yúº)Ì©Â=(üͧ7`ƒG÷œ×¯N"Äñ¯NXðÚn?éš}!iw”ß° !wOxôž€;ô®–'/l£âáL¬$´@Ñãbò¨ØGmk §C‚n‘ƒ”%IÆÏÉ‘JøÎW™nݲÍCÂ{¶ÃÇÆöl:¥Üß².zÊVìùÅ…0컹£°yæ"«T€L7! bºa+ÎöTQh¡½¥¢ ?•˜Jj0J‘.A'aäÆ‘}^º~-<Û¶Þ~ì{ö®õØô‹æÇS·¥Ó9#\wF»’Œ'Á!<‚€˜uY<@ì\¸vIf˜½mùeÌ°o‡þx‚Y¶ÿ.LªxI0õ±äظ’˜Þ?’Á J)°a×kƒÇ „’xÅK±€´á=k°öºüô28P$‡cîAÛTÈ„¯w ´õÀëÜ «½ßð %Ÿt-Há?Ò;‹›Ga™'ÖH¹°¾[’ŒHShÐ çÈm*¨‡-¯3¹¿Ç<ŒùòH’¬f5 Cè÷˜Ü½n£a¡ø /Q_ÏXñZýõvûËk–TþżÞÿ— (Ruˆc (âêƒáÏÁ!}ûäo\´åü¿ÄôóƾúË Ë*/ö*ÎnÉý*=# endstream endobj 2176 0 obj << /Length 3190 /Filter /FlateDecode >> stream xÚ­ÛrêFòÝ_ÁÛŠ*[Gw r*U [ DÇÇ•äAF¨‘àxý÷Û=݃.–wó°/LOwÏLOßfÔƒ6xhƒû«ÛèêËÜtuâÎ ÚFÆ`dUkb¢dð»žËlŸâá1+ë*- º?gI:¼Ñ5åšAºOã*¥Ž©ª>ü3úåÊ®þ¾Òa1m Óä–:ÒFƒÍáê÷?µAø_šjNƃ7ÁuXÎÚý ¼úíJk :éªkªfŽHÐ$«Neö244å|ÊŠÑ•}vÈN±ìkJ:Ômåß›ý9ÉòWb9í [S6Å9‡IÒJìÉQªB²Ä'âè_%«ˆzLKXî”&„.òý;3ðòEIýøPÈåÅšC]Áe “'¹ì¹B%‚nt]Ø6mµÞDš¨ÃŒàᶦTçÍŽ  ãšÀÓNÐ"Û¤¹Ø-t²|S”Ç¢ŒOi%™ÔRôcfȶԾ•¸Í\ÎÓýR$ïÛO$Pq__æVÓõp—#ub²çM˜§euPÃX³U°Dbʼn¡ÌËT@ºÛÓÛ4—’†Ú%'r?Àuˆß‰x<¿ì³jGaØʬ¶8O¾“1Ä7êüÀ9ӲʆhåŠb³Ð’`ø}š§e¼'ì WÚ\›¸¶eqàÙ!ö¾ám¶¬~g4-Á«‚oì± ñ‰GüE@ÓÒk…tH~Ëö{¢½¤„©ÀÈû¸$$Q Ø–p—w)!ŽeZ¥ù‰°%ÀÏLÇR8,ˆ,TŒƒpl›–D •ŸžâlÏ+„‹“–¨ÚꉀcY¼ìÓû”0º|‘oÒ2¯Ôˆ;¹±ˆ ðŒ†àˆàðÂk&ì/È9¡bj0ì!aœÁU(oèzwMÉχؤm+*Ús¤x["C°*‹×2>Ðøê˜n²?4ÍH«ÖZÄãy±¸L)…®} Xßvì²Gaññ¸§36…¶±E;c nNÀ†aÆ9®ÿNˆ=䆒À†XÀf]“˾g"ïb4>1ñ*;Š#Â[j·Å~_ó’>›ü°ä¡êH¦M²y3öÓ Ø…dÖeNÎÒmYû”!üÅqh c+õ–)·ìØK³…H@á!$9 8 ª“†ÓNC˜¶m‡<¤9Cí!€M a1@Ó‘(á4[^7þDLv˜¾–ù¤ s@ cjWòÀ¨õdwÝÔÆ£õ<Muá±ðÞ9'X]uÔ…´Žºþçqw¾óÂVÍñHžBÝšÉÛÔ,ð>‘û5Ž h‡"±ãòT­àá´jkc–Ë9 öM·´Eœ‡xyª7¾tØs¥ö–Ã)F°Ët ™øš ÚeËÔxDãÓ¦½a+ä6ÁqÎpé)Ûĸú‹€­¤ˆÛLU±·j6Û¤¤9ª¶É€Ÿ’…wA»)ŽÈò^f¯;º™6¦tzó6…&mûº©9®÷æ ø=~Îñ4ú/9êLýÞ¹`L¬ŠCŠçqE£ñ_8–‰|KÒ@€Ûʬ‚±… s4ey.‰˜@ÔÊøñQŒ¼/<á+Þ¦‚;Ye¤Øsñ¾ú<´ÇtF—?(­Ú#mcéŠUpµ;WD–Ãb!IZò1? ™:ª;# ±¹öÄ0qGî‹xÅ¡8}”®ÚÅ%cÇrÔndç*mOÐZ£©‡ôðJ—.¸y;xã7ˆ¦ê 4ÕpLüÔpôA _Á=} ‘V Î1¦©Žƒæö—ôyó4ãNƒ`êGÏ´¦|LQ†s³h0q_Šš¨º.3Ô­;›â bºèB%z@>VÁк¦DñBjÞÌõC÷ŽzóÀåË9afÓàÞ½¾L¸ñÀ‡›ÂþÓP7ê]ÑdË –‚2¶åx ÁÄ¥@S¢¡>VPUc–‘î÷Èõ#B®ÜàÑ‹"”I·Ï„ž®V°™é킇,¦Cø}Â=C%÷ûÌ]ED}zp}Â.QÜjîÉ yx '¦2êp1µz‚ÆóñÖ•§À‹<ÿž:¤rÛPfËÕsàÝ?D„X.îÜ ¤ÎÔ¿û"´p½¾¶B§úHä¹ÌÏZÂÑöÍ»s[+éãobÃ1˜#¤9½/]}[xò¢‡åEÔŒ6”ph§>#~õü»k]¥Føû*pCò#ÆhïlâÊž?[¬ï@S¢o*·ˆrqŸô@…÷xÓ«q²º1b/¹æŽpx=ê4·#4iŽØÝ\Û'#ßz wŒ0 s/òaKÜÁ 25-+ÍÖ‹)“Wëà¦/¯¬–¡«R&a‡ö†/ü• ´™`“aÐò›Ð*jÊ;Rb 0@ÎÇ©?cv±Ùzü¸í)Hñx5ô‚ž‡&p¬Õ>õ‡à+ aâ1{ŸÖ™³Î*x&Ê;wg‘÷M$`áE¨3 Ãõ£Û™u¶ #‚Èm± É|wvAåÛÊ3ÑBðÃ1ÆƬßm„ËáÅ0pÉr^@ý%·³e „KÿŸ\ÞLIuê DFcG€¡CÀ:îõIër¢·¦Á¨ú5¡1¹Ñ@oN˜p={ ˆrÏWwÖvÆ£ÄÕ€[¦îÙÉT÷›'®"“Ï©%¯ŽÜл¸pƒƒdC¨4œÕá2ÿiêwýîr^B§’!zçáYþ?  ü’z£¯ñå íôxÜË t£]*ŸQ"T(WÞ!ò4þþ‚®Ÿ6&]•XHàRCûÓ¤uÖu>M¼m§”4Ê9{øŠ§5u)‹{¶~y…˜l¼FÛüÄlµ ,~4µk@ÈGƒÅb¤}¨èÚ#|*ê Uäíîk 2O©Äªj¾Œ8üÆh ³ O!ïx÷•bE]˜}£ûn"ß—ÚO(íPéþi¶à–ñÿ3Ñû§ËPuo!†î±M#q,?xg»øx’ÿïÐ'¸ãòV]uü§¤§ endstream endobj 2182 0 obj << /Length 3129 /Filter /FlateDecode >> stream xÚZYsÛÈ~ׯà›É* ‹D6•*ÙëC.¯íHTR[»[å!8ƒ­0¿>_O÷àœòæEèé¹úÜÅÃÂ]¼¹x±¹øáu/R'ýx±¹_IìDa´Hµ¦Áb³[üº¼=Õy¦Zµºô“õò®Ñ5CoNùN¯.=wùœ7ºÐªÑ<ßñV¿oÞ]¼Ú\üqááFwá-‡‡Nâ&‹ìpñëïîbü»…ëézñhVa¼Æ·XÜ^üýÂQ›¨Mc'Å9‰ç:n0±›}Þ€€À[ëê¡V0Ò_îx˶η+ß]žZ½c|^òºv¯ØWGmQª•CZ^ü˜c¶²æÔèûSAb¢¥Í3ÿ¼Þ¼ýx·áÁÕ‡_»ò°æêææêÃæ—Uê/´'·û [!6ð|éyNE̘^ùÑòëÊ‹–´¡Ë´!è:‹œ8!ìã Qu­ÊöÌÓÕ=Ïüüêæå[\¸JƒåÕ‹ë÷׸šÔ¼àõõæëÛ[|¼áÙ+"2¯nV±»Ü\¿¼{%ÓŸîn>}¼}åÌÑ|«I>‘JÀ›wèRתàÁ§Ó¶È3†ßç™.Y~O¤p¨jAít«ò¢éïKœ4Kýeåùê„•îzÙ@”é×M–{EJaññl­3÷2Ý1Vñ'«Ž$Æ3o&–¹À\Ðqe˜è¹ C‹ª|à5¤`{˜±I@b¨d>,ñžW–UKöäaO·zN¼m5‘îëÚ ü¶ºoÅì±YÊjóª|ÎÈë2sŒ<{†*¿ÆèœG¶²äu~o¨'°¨ š]ãUÓv§þ|Å_ׇ:.½À•£ïn¯Xm—~hë];ý«m°µßÅœ¦Þ”Õ¡¢í_ó†U“Zߪ-Â[Æ)˜\wùRœ©Îö-ÏýæFîKüñxïY«š¡R4/1NŒ:!$Ê,.F¾YÂqˆûõ7fÕA7¼Rü È«·ßßm^½ ."ÄŒ}øHÑ7Ê¡BX ±‡±í™3DºüÜôöHø™CŒÇ6…b!XyÏ ¨8(Iè‹EbŽm7´Î Ì£.ˆ9¹¸bd­‘Í©L®g˜Y„ß[#Ït .ÊÎgv9ùWó£ØshÈ­|6 É£@<öhßæb: c¿Š–çcïI›pmÀrÃK†·aøø™±LžÎg2ßÅøØøÎ`»*q„³ë\µBÍQ< 1²Ø¦ýx˜–âAZ è³iî#%XÜœU§º!ma(ÙÙ|Ò£[Nfà Î¼p+H¨0Ùp­ÃÝ)}ÐDXój”%%#¢¡áã3þÑÑÊÉ|öªâÀPŸ=wÄré¤Ô`ÒfŒêP‰Ë 2ú"§K׺<Ù¸¤Ío¾?îIÝÁ²°9å6ZA2õ(¸ÎFâ>Å~Щ?@âT&öA· ð‘i”H•‰B,?ß„ ü¾[Ç€ñȪþÂ#ÕÈÉ<²ºæÈE¸JNëoj²}UÏ¥2“  *#é8ZÊL+´6ùC9º² ²qÄ$4\ýrNY¡r¢È÷ÉNs•¤¢\RY‰ú§iTmˆ¢€… ßj[-ØcÓ’‚ü´„U´zzÅíæ{RÈX†Ëjw.Ék ° °tMÉ;HâÞ0J IcPP00–š$§›–Pœ#,{#]â&ìçI&{ÆkÈ4÷y¶çU6y7s¾TM£­°ZTǼ@.” G‰5\ksµ-IÞ©ƒÝúVe|I½ŠH3Åí_ÉTT{²*ªD‘›Õš+ÕˆRmUþM-7_!ôI™í¥ët~lùÁáMW¶ãþAE?Õ"߬Ý$ÓÅÊ8NtXcbWiY*‡aSÄ`:/³ª>V5*?S8cZ¢&ûÒ hh»’ý&È#'ÕçѺ†l&nJ¸Ùƒf´j¸Icþø4§mb-/åm[äÛZ<‡$·%e' GsYI–5 g4ÍïœÁOFÆðíd%øæž&FÌa7’ZArÔ?”¼)EO"æΧt”’PÓ@sO‰®¤ìKK5-¥¹^±ÖaËî]%Ösj¾ùÚ{PccÆ÷½üò²iµÚ ±§r˜Ž/\Çóã…ëøq@}„Ø[Ô=O7o¸Ýá…NÆ>u …`í¤”^Ö÷•(ð=øÅáÀ¢¥¢°í -üòCUÒO„ò'z –ý›l†ÆuC*á/èä¶ãÑ …͆—PÐÛéß\×/íôV\8P3y+æ_¬PY¦­À\o¤Kõ`ª\™,gNâ©-=@%$KaüÍð¨`XžÎ­il s²YÄ>o‚¡&iÉ75ÉZ¤%F‹L´°²hº3X[OPîžY@É™DŒ@š ¾•%]Ï7{H­‰Äô„ÝÞaîïw])#]îIÂ$Âc­M‹JŽPü¡ç2½I±^0T¬+/¨‘dO`]¹#3rfäò›“¨°áOï4UÍF{/•On"¥ÊLóØèØ5­”5Zm ņò\ª)ž±™K˜æJî1|É)CÖ)؛ĨîøJ„¯ä)_=‰[6òŸ¶™°zºl•6iCIx»¯«C×9à,0Œ«½øM»…uÛˆ*.zä…Ú²eðQE9ê‡ô¢üÿ¢«á¹‹®³ŽmYgÒÉA óøC/†~âØ3ºyRIN¡ç;a˜‚ žïðœIè ãéŽ3ÜpÚ©#7€“¸"¶OîIRÇs#»ë çۺ銄iÓ~€3zü¤÷ ¹ù6?@C5c­™Íœzå‚î&½J ÅHUrÈV5vòt„¤M½&äÏã:ZÒ:ZÒÚ ´i!51r@4: 1õ´¾Ö˜ÚQ¥Fô‚@á‚2½CP¿ú¡š ÔúLÈâ(<€gŸAº~ÌQãiu¨v9Ù’!*”6ðŠ‡xŒ—Æ€ªõ§¼fÃÐÔ_4”ÂÞiBÛ!Ÿv³BÛ¤Ðk4ì£"Mìu!Ęڿ?ÏëÃÁ¨î芷¦E*÷„ºØ<8(sgßö’ êÒfE5“€Z…&¦‡kûÃA: ã@÷Ê£Q.w(N ·nh`ŸÉr4Äfú´Ú‚ar©ËEù~†)„½ªÞAðϹï}1‡V‹Åd4t+× gÁ¡.Þ2ÞY ”†ÎÈ>1úf7{xs.³½]e †ÁËZPµ.lš.¢B{†+eÛ©ü¤´q;?¨=LØDZhTú:zÕÏVR݋ǧ!, ýi‹¬(úâ;þŽ‚½5β¼/¨y8õ‰È½ODƒ(ÅÒN¦g™²dP 5ÝÍ6š'#±÷Æó$v-ðŒìË ó”Éí/]Rýß¹ð[‘™Ì÷h:øš†t»G`ûz:ÉA'Ù§ª÷ß o¢{Ú?mžðÙ?TrbÓõ¥í+Š³LhØyÀå~#˜nv—ú†vo ÃŒ;È~ì÷Mï!=ÍQg}öŒÅƒðµÕÛ ·>½}¶ôÂ!€þx—ù}ÿ«û’û=ÑÓ<:t»AÌ°ytì/Ó)ˆBT¢ßýOÿïG„¾ãyòœöR¡ø2î^”_¥iÓ÷0øžž–qOÀ´'˜tMBxòü¿ ˜™ï%S®ÿ qnÈ endstream endobj 2191 0 obj << /Length 2929 /Filter /FlateDecode >> stream xÚÙrã¸ñÝ_¡GªÊ¢yÙ§Í\•­õf3v*•šÝŠ„,dxhyŒ£|}ºÑ ¤è‰h\¾»!oó´ñ6Ÿnþüxs÷1L6¹›'A²y‹Zƒ N访ýýñ§›7Üøp˜·ñióÈM½tS67_~÷6ÀÚxn˜g›g5«ÙDIßzópó·õfçÂYäFq¸I}Ïõ”Ž\u¶^t÷1²¯è°"‚5÷Ãá ÊQná&ßðn¦žó¸ÍG”Ƕ«·¾Ó=j¹‡kNýÖÏ1à1 |ü(uã(ÐÛ7¢hZ8;¤O˜ä…=„(F b˜çŽl5ˆgûA´%#Õxê»2aÅûörª_TßpP¯xön±Ót­ц’š®3áƒÍN@;åØÜí.ösç#:AµCà9§©?AL7PO)u`”&¥,¥OÙZžvªÇ¢}ËmÄleE{^ôÇ6îØl,w³T'Ët…lº¢«x+ µåŠ.¶¡Ÿ ý™&Tò \M@ŠÝpžªà0drÃØ`ïd¬0ðœ74ÅÌ Q::$( ûœkãÐkåbÉoÙœŠ3Fkó(Àp\õlîj Õ#m‹I†?Ëñ¸Pf›oWV&u£p¡Zž|W·h kÊÐO%+:@r–eWéEFÜLS›h4pqö8LÓtÜóµP15Í.! N°ÎP¼¤3J1胕—@p/þ˜$§5™)J#‡AQû:#HIü•Öñmf\µƒ§”eN…29ˆ/(¤ëôp©&Å,ËzæB8­’é.tn„[Ø£€!(PS@‚Å£0ìå~ j4é- <ˆFRJÀÇ ¥™vkbÙbÆLÃX+zsêúÑ1ZFšjQ|Õ9(@-Æ¡J"RdÌ@öµ˜/åø#ºð€²-ë©2ª¨²Kø’Í<z¥â¨&SŒ^-.y²\ŒÊ7•7.I,fªb›Ð;ô]ÓYSë¢&!ãÆ8›2ÊfÕ‡ÖZ“1³f]ÝŸÍñÍ«Ó‹bNwœO¢…; ÔyOñöÖw^ Eý rýËv&Jˆ,—™@=V¼i X.8\#†©ÖQAd(:ï•Ÿ$B©¬ž&äÉ]~÷ár /³)r>L}·ãÑœ3\(T2ˆ.pÏ¢¯eÁ&6Ó¬ËØÖfšýÐx×Mm)ëù(Vð{_ôÈRbΓZ{‹4wjemU…÷¥…¶öÕ©2YFfÑk8®`\ï(†»v À&ê Ëò³¨ë9Äð´lgqD+H´Ge­²Ã6¶°Ï–kzÃY]]½JŒƒ7ˆ1†î>¦3+š»Á2W ’„±‚Æ\Æe£à•ÛÊA*é>”^6Jm3`“v@[‡´j¶R2˜nBZ€š¬h>KD`Rhô)»¾Z°Õíæ,?an¦#k¼1t˜–®´€%!–(Óq¯€Ÿ?Q•v Šà ÜÜK7`@Ý,âªäƒXp†}~ ‚„Z àHÏ™3òÂÐ…%QeO<(Lø*þÛsg+»X?ö…ãs7JyÔâôÍ—]ìy`19à €S*;KŒˆç:WÆ&Ûþ|–+ãd2T¹Énr+»É­°:H‚ËÆV¶[ ’‘_È鮼Ñ%­WÐd£v$3šÐ³ôb+tá)IJÊE=žw‡^hpÛµ»A¡‰&8ë[ |Ρc= –…æud•M Q²›}ÐRGùüØ_ê˜=rÃhØŠ¥³kkW–g½H¦3ì?­%Õák„Akswï«xWÌpð_ÀáÖÆØwž]-ìÚ7—9ýxK ƒN®)†šfR8œÙµõù‡ÙŽøþï««Wç‹3þ†·‹ÀÇ¢ÄUA%îk¼öBžº¿ œ¼ï¢¼f8ÂÕru¬ËÕqf—«ÝÕÐ'pSãL[0Ï3âÞ²*Z’“”-@æTÝ´'žæŽqœé£Lc4/ Óˆªbqˆ£Ð™§“ª²•Ì+[‰® ç±6A3&(K,S ªNA­ƒ H$úQ/¢ ÌÊU̳(—àkUÁ±«6„//+j[áé\1ôTÉßqçâ Ýk"Ð&’uÔJ(âEúq7J­VJLa3° =a”Ì A2C,XãmÄ&*,?nÓØ¥©‡eŽŒCÛÔãw~ô_AûžŸïQ’Ъ '™]NR~±ÏtMZ¦&|IÔ«}ŠReÝq–á ¶¯n KÂW4i¶ZAyfc±]žZq¡‡¨ ß J^ãKâ7ØÖ÷dÛa¤*hÁn‚z¥<ÉëwøåÿLâ2´WÿÍdõ0Qàú>»†ÀÏUÃ;S~}wDrð_b ¹Dû ßLéß!6‚ÿÔuos endstream endobj 2115 0 obj << /Type /ObjStm /N 100 /First 970 /Length 1379 /Filter /FlateDecode >> stream xÚÍXMo7½ëWðØÊåp†C²08 ŒhÀN¶†®-¤FÉd ý÷}C;-­³¬å =XžÕ¾Ï7ÃYÅP« .RNÈþ“+ÑþGG‘M`G*&à#$ð!j>J6!;ŽÅ„âXë B…:Ó‹I¦˜ÈI5Í]bÓLìR6Í$N JCMN“™ ì²6puEMO ®‚æH®ŠÝŠÑÕbzà&Ü5Eø€S¦ &GÍ?Š IÌ˘!s¾âñjR…”ÍGLf Ró™‘nNÃa’æ5Æ4·6’ùM )™5†TÍá;e“WÊÒž€Ý’£Ù€ñÐR&¦´š5ƒD6k¥17 J™šUœ ,xŒ«éh6)!„[¯¼‚„Ç4Ú³ 722ÈsV3fñåj$(.jÎ'Ü­­Öˆ…C+6À²™UvL—H#s3f+»ù`š ` …J–V+RsD+$mÚ˜ g*µ˜O0Ã9›T„K "‡ÂÛw°Vk»[œiÏ‚fáöYáš \ ô›ÄNäbT@¸«ÆµÝLN„3L…”- 3ÈÚ$£­åƒ*$mÆ@Élw+ß:Š2HiÆÀ])P/¥qR¹À2-õö‰êR@-bDô)h“È%ëÝ]`*b|ºƒ¦@‹Øô oWË‹“ùƺáíë#7¼›ܸL½ûëzŽçïç³áÌΛµå­)› Çóõòfu1_ßæöÝOóË«ó—ËîÔŒ(†l®ñ †ÎWxãQð^Ðv.}š\NÙ)õCàšpøXîX6Ö[Û@L±N e¯cäÙJ)ÞŽ²i XÔÔ$‹Z¦\²·)? Lêcêð‘1Qzò‹ø{€ ³Œkc4§Žì`Ö‚e…±®=…±®ÖÔ‘FXFSüߺZânWKøw]=.Kh;½]ËÌŸ¶•™°e¿!gÃËåêr¾jjÃÙðÃðfx… ìvgæÉb@ö|±¥.«Ït7·mQk•¸“›ß7Ð9üxµøs8<8h†Ã‹ÍÕr1œ ?¿±¿oþØl®×ßÃúfuuq¾9ÿîêrí—«÷÷plOß$øb[¥ˆo‹98“Ó3¸¶¾¹¾^®6÷]lŒê™€p8FkîÀ¡ÓI:pm-ÛÀT°µhbßöÜ WÌKíÀqÅró¬Ý†B ÞPöê6 ;Ý–¨¯ÛðV´s†¦ØIˆ@hÆÒÜ“š{ xzÌ#{CÒ=bîؾb8:205<=ííi¥/—p ”2ŸÈºÛ~ZR_»|>u¾B‡hIoÚ#½Ú›^}R‡Ü‹ùyø•Gø•÷àW¦çh—ç)nÖ‘ØdØRgqÑ1øTy•> stream xÚ­YK“ܶ¾ï¯˜#§JCŸÖÉQI*¹bÇ‘Ö‡”ä–Äì &‰1Úèߧ à,w´J|F£þúL´»ßE»w7»½yù–g»2,³8ÛÝw<ÏÂ4IwyR„IÉw·õîSðqêU%F±?Äyü6ÈžZï&UËýEÁ "|ƒ¤ãí¿ýéæÍíÍŸ7 VŒvl—Ç < ó(ßUíͧߣ] ôŸvQÈËb÷`¸Ú]’ðmvoþyYm£•Ö¥§5‹²ç ›EaÄsÒš…fq7ëåÛÄß(‹Ã$å0bxÿq<â¦x–Ç~ÏŠ@·ÔOEðwUÉnЖésgÔ"º¬©÷³e¯Dc–¾P2ŽÒ¥™[òÍ—=KÙ¥™½¬ÔYÉn¤®>Ò²vý§Ö¡ž˜F}Àw·È±°LSZª#دip)Æp)©öq€I ¤FèhVŽÓ€ŽÈÇÞ *@òŽÉš¨·óÚS¥¹9Éèäêþ4Ú…§®–ý7쮈&ºÚl-Zï©Ò]­F¥;`‹ÓÈ~Ç“²”_§»FUÔ¶«¯ –‡%·`¿6¿àÞÓ,¨õ”~è†Ñ€GŠ–èÔªªŒª[°`qÆs"ÿµg JO$ _©Ñ鑾yÒ40V²jÏÚœ9´Á’`;QÔtL+8ßN¨•D˜’;tkàä”{ú裺3îÏì8+q>#ÖplÖ;oì’pØ  )·û T:Ýè{+ÍøÂÉÔK»Ð¨íB'ñ안*²xŽ©#}k­º{bô”zk!‹›Ç@^ãK® USÏÛw_é»ì:ž?CÜ*Ž|°Ùw6γ@vµîÙ‚>[˜„$¥ù2 œÊ!ÌT}­Ÿåéâg@µ» àdÕ8Æ~9agT#áÎçì'³{è Ë@ªa¤Ñ¼‘Ìw°ê­Œ(HK#eZ§D§08Ì1Ž ;¸8²ˆ^"¦ŠÔNZ8Ë™ÓL.±Ûå66#£g; {(„žŒ|³Çï¸ÔxZ­ è<ëî°Pˆµ²Fæ„9˹®™ËËà¾ɆňÏQW¤/‚aã4Ð84K+vÁK/¬î ãý@2j9¨ûNÌë`èǯM(žGQŒàTwû<ÆŠ­} ë0ç^ãÄ/PMXü”Á÷£4“:üs”F~6˜küè —ÃS|oˆOæÊ÷o]ØøøåÜ•ãìäÕr—:}:¤¸¸îmfÁh”ÃTlüˆ2ÇÃçÇ5šxuß«q¶*Îíí“8³Y›týŒÉ¶2¦UªÓý…ܳáõe`G‹ø?3Š¶ŸOÆ@W¿4’“”€†Í,T«aéL_¸”!Ði½ÂNœ4.ö ôõû„êQ5…)t‚ ™bûHa…k/wÙf’-|ž/×fwá!| ú¢>Ĭû^::9ÊÓÛ°·¡*á^ŽHgz ÷.@û$›šZw–ϪÉWjr»[o¸s$g…ÎzëIÁHƒè¿ú“A¡¦¡#¥®-Q²öe­Rdâ²2°Íñpcó¬C¦¤ð°BjDHxPO”kÉU_¶Îõ+ê&Æ9ÝbI`ïE-[Ñÿá{Þ¶ËDßv™ç™ÑZ_¾©ïí¾€}ÃUª´i…•ùÊb8àƒ5šùü« ö¶ÀŠÒf¤!“$f9Mã•nˆ¶vÜ´_E3*š_Ø‹¶L༣[xÖç1:#ÖŠm…’­è°@%fÁÃIÚw–ZAÊMn‡ž¶ÔñÔëéþDA»+*_‡TZ)9ډ΢È>û!t¾ ,u3u#¹‡·Æêt1Ì=hÄ$ØQ_N¨t{žšéÞ@#í8ȨNP“…PƒGIð¾#"x$5\„„f·ìš6'«üX#œ¡¶Ì9 Ú²_÷wÃ6»pëç:Ð><‡DT5S;ÙØ&¯{V½k³¿u®i×K†úÌÊ:º¤ô‹î^ë¶E´9ç©Ç ‘ËÖ!ƒüÁU†ã;\hzp¿GÄïè9„TMB“°Œ Öä<,2÷2W%øÌAzÀ–WÁëù®tµnˆÌB6,žŒ•úøbÄBÏÂè‹ÿáÕŸ³0*.uf^Ž.cûl ¬6m‡ô…ÆêYú&—Ì«¸ñ†åsÇ^I^Æ‹×H§Å}lß 24ðY•VÖjj_“¨ËEñ¸üÝN«üé7ÊýLEÙú s‰`_ÎXæf`uêDµöØìKoä½, «>^÷vBó¶Í°Sfñ`¹öÒûdLýrÐúø.ÿ¯N¸$>ûïêǪƒˆ$sµnB¸9dA^c媾̗Ŷ¥ð‹KÐa¾ä"©šÿ_HˆïÁ{ûN¸ÿú± ûïŒw3Mò"bV^îú¿×ŒxX endstream endobj 2238 0 obj << /Length 2740 /Filter /FlateDecode >> stream xÚ¥ZY“ÛÆ~ß_·€U"ƒ¤õ”ȱ—œJ¤u©R’@`¸œÐ8¼ÚŸ¾f0ÀbW²ô²è¹{¦»¿>¸wçÞ뛿ßÞüõ§8ó»CeÞíÉË#/Oö»ä{·•÷Á7vº,†b³ò½ÿk¯:¦^ºR›mø/¸ã­ªUÑ+nÄ»hn~»ýùæ·7¿ß„pXà…¼y²ËƒÜ+/7~ ¼ úö‚]|Ø{÷4ëâ%Ù¾µ÷îæ¿70Ì>8 ‡A¶‹sØ; vAœ3×ÉŽ7«¼Û4ü6Û8KüÿmB໹õî\tŠÉ¿UÅuP7~)Õé¢^[síÚ ÈÐ/7¡¯àâCìçÙ6Ý_6iê÷ÜõF—ªéÕÚ^ÅõZ? ™ú—±‡ýn4í`S›(õÿØ„©¯šoæ…Ñ.Ico†»Cšò¥;U꫆pf”Â'þ_HØëacº¶N]{aªl/Ànî¸y¯‡³ÙFËÆÿµ.™–‹É{ïBJ°‹²eš…^xÔùö5k3¡·I¶ÛG‰·ãÝ>‹D÷T9è¶a•Jøó1Š2¦ÞZTQ5p“ž?‚®­¾Õwç¡Ÿ+ÃBo%ÀVÆg¾?«N-ÞMî(Ç{2­›²+™Æ 11 ‡¡Åâá\ L‰ PgË_£#7G³Á#¡Î™3Rýa®ÿV]òÝ!ËWmäÔâ‰ûD¢ØD(üiuU4¥t#ð­Úñ8 "G`0} Ò €?!ø'ä»®`Ý»¦0;³Ãg’¾–¿ ÕÿóÐ%Ÿƒ¾Ã«ÈÉ"“,•ŒMÅËĺé"u-¬wæfÖ”’¹)õã±€Kk׶“›­É l›á»«f*À/ Ä¿ÛæU{¹¨®œŽ»kÛ+³QS?¼œ ik¹u$­JR#Yä>1´&…¿ÄRú7çׇŽéú8Y6æûáÜZÎcÐyr0ŸjïϺ<¯q{åCäã62 Œ‘=%ÂÉîbж;PŽ$Ú#ã w3dÜ+`KË°ð…¤ƒÙ‡%_ØC|!akL06qÄMƽÃ=n¦è¦ÒüºAxÑ`~GóÔb[Hý3PÿRÐlãËJ¯*•+žýÕÀ{ ¦ÅedÆhî‚Ôs›8€‘ü؆L:ñw~¦1h E}Q߀•,Xª¯k½™˜ç‚9«°4ü”J=2hz"òifÏ÷êñJd€Ä–†‚¥0l±4²îFñ‘ ,à @;áÉý^C]„óÐ`m£¤‹” ×>ÖE)\¸¾š-xó»MêF@Ð76•²ÌF¬ß‡^Ьhåý·»Ð:¾j¯àòÁ¸Q\ö´ú¢ë¢s7ûÞ$x&ôH—¡Çº/Qˆu¡/& &Â÷ý&N;ôqZIPÂŒñŠig³è.ŽºÖÃÃføsÃ{"l1Ý]Âe “dË ŒÐÜ_›ZõÈ^ò«ßkBehöêZtdÏÐ&]ŠO(Î(ü£Œ±€`ƒÂp¡Ç){nwŽúŒvÆ4¸9Ðé^ke¦?ÚŠ™;T×?:m»Š‡VÇòY|›ûE¿ehÌQ_!5H Jx(²s.rmYÛ´üí6áÞ‡ƒ>=\ÊÚ ²Ïý{W °ÿd XoïÒ怠 £Y½‡ã¡‰ÂÄ5(°FsYÂŽ-P fªÏ†Ï^†5`µV•´*‡qh»LW¤¯•µla€J qÕÞ¿µ` vköDÐoGA›Úªù‹U€˜™‡À|=°òƒvL—g˜hlCøùÑаÊ‘xÎrðt92Lä1†V(I ¯d“¦m¶º9uð¸£Ò]A •ku1˜ÔË\FŒŽŽ= tÅðV•:|àËÄ!D>e9BÔjØÇ.³†ÃX1iŒÛÉ^À ¦˜ÔmbÆUGKÚÎceN³ä* ãh.Üþ¾™ï^ÑÙ€êÐvk"{fyëü1ï\çUìRrÜÌŽqZ"ëÓXK$l‚d3‚â|±LD'6¸})–'­gV áã³Yá<$ŠVãìgñõO DÌQ°Ÿ:A-ú…ß380ÂàT–ŠYq¯éqÜ ¨„î£ôÖå(Se?skî%ÿ슠£Vw•EÇÔ: qš[K_±×î·qh¦î ¶@íå°.;£Ìõ:Ø´6Œ â 'Wšˆ’>ܱ¿ª’["Ï&.é ÙÌlíÕxPú®cáè¤ø«0¥>+ÊÂcœî™Á8·Öd ‚$Äñ²íÙðÁ‰ð"D÷‹¥Uq)îÐ>°Q@ª@àN›R.gdMØÁšŽ” ½žjI8Uv¹#wÖ®gŽßÈò™ßȃ™ÒñŽÁs,g®ÆA÷¹è™8*^¢«þÐvÿv¹œµžáÜ™‘A4Ë óžQÚ÷DzzÏ•{1G‰yݾy<ƒ­Œ]Cæº'n3)Ùe-á\ ¾ &Y²€-œÑðB­,±lhÙÚÀV¶7°µr>ÃÖtR*°µrÍï±góº[PžÎ!Õ:ÀÔ¿§ ÉõÛ© k‚³È}Ðœª¦¤``Ÿ•ìplEå8Á‡®þÌiÌ?J—†ü¬»vj0Ë´œ#®þR4 ó›RQyˆoõÅLNªJŒ±Tç™PJÛË@ j©Œ+ñtíg}ë1~Nܸ붵îŸl逸²n7w£…qƒÓ ‚V|w‘Õ$ª”éÄ+™N¶Ìtn7Æ—EcºuCRÿóKú\ R‚Ì8ž2ÎxÊ8¡ÁEsÖCáŠZlòl$˜e èE§¡äQ^›Äˆ)¯„†MR®'Ô„æ·0Aêÿ³EÞ+W’ ÿ&àLèϪœÈ®äOkgë–âÿTÞ†HªY­#wNæmrü/í)SDÜÒ, eý×%¨ª«œßP¨tJîkÜΣ7[ÿBœ[ìŸ\î«GwwjPŸÙ”¼¤–ó;¥Ì”Tÿê²Û;E Èpÿ5¥öùR°Ò9qû“=¼S²ŒFÛZ0—ª…=wC²A©:瀋£Zª¦@I³¹ 5Œ Ÿ±¦,ú ÛŽ& =õ3”äÖž¨Š[þ_ÚˆEƒâ¯Ñ ñjäÇx¾¢ïr»XŒ?>¬jœŸŠ{ÛÃ.É’'*zqj¤Fk=ì¦ç‚¯©èŹ °×ª6HåŽÓ%Ó8{ÃC(8ƤRÚ òòÀ 1’WS”†-Š/X”­!@B³Â‘^©OkñFïVÙlÎþt±°S+ÊG¿€|ù'Ão(BOµUNWÈWk«”Ø`ØÖVÃ|ZãæO{‰Ãp«ºoíjzùåaè@·:0f°L)MVõ<ÇéÆŸò459øýž‹(°0ü™¸ÓòW‡“á°-‡=hÑŽÉ~R"Z AÊK&ÏO»4<»µ§Ñ%6/M¤Ü€{»Î‚ø"=ÊêÁÄä\ÄËÿHˆi¾úßVÿŸ!‰vahRø( ‡Ž3 …ö&[u¦_ì9¸ àܳÈX‘ê— þá^ÙJ endstream endobj 2259 0 obj << /Length 2189 /Filter /FlateDecode >> stream xڽ˒Û6ò>_Á#UÑ|?Ž‰O%•õîÚÊ!eç@‘„„=™ýúíF7HŠ¦²Wj/b£4úÝ ÈwÎŽï<>|sxxõ&JÂ+Ò0u''ÊR/‰'‹s/."çP;Ü÷£’U©ËÝ>Ìr÷§A(‚GY‹Ý>ðݯñN4¢ "/ô‚Ý/‡¾;<üþÀ‰¾8YÄc/ó3§j>üâ;5àp|/*rçɬj8ÍáÛ8ïþýà3·þ ×Å‚ë<öâ$r²À÷ü(#¦cÏœm79ö‰ï»ïE¥eß Àbâ»ÁWôMø›ò7ãoÙÕäôFõIîÂÄý´ WR ÕÊ®D²„èO†aJÐ?õÅZî°K}øhHrðºïjit«=û]éÝòÆÀfJ<›z?\P[‘¿W4.eÓØõš€#¯<ö£a Ágú–êaá–5±Z2K³–'4ÑI(Ñ1IÍ¢.VU“¤vܶc‡n.V‡þ¼ ÀÃû‘Fc׈a@Iú,a¬BÒ dð«‚5Í3;ÑY Q¯´²Ÿ6g^qœ…›ªûz:ˆÝR©²;‹DÐIÃ8ª…4ØPvgB$&l3‡›Õ´_Ï;˜Q¸ž°ÚX&Ø9kBÿ”¡¤Ñ/ŒÈ@°ÎÒv x”å© âZ*XsWK'Õ·«“ ÅUÀ±ÙM-âlXíº±âÿ-ôÀÝ H_÷C/_‡Þ÷p^¡Mšø›cë š´çÈ&uaLïBòüô².»ŠÑFCYæÖýxÔè,ybµ³“¶fmÑ îÅ@Á xÛ”5lHNÀ‘7J+¹ñد{Þ®D=V‚l¥ž& †÷üÇ )@¶×~ sÆëœ1šÕ8{âÌpaÄÂó½ð|˜Ó—RTõcÃKšé>Ʀaâ6qµ0ãÖJB÷ûÓê°µÊU•ÅKÊ‚¥ñÄ2ª ͧHžräìºú%8=ÎyöOŠ³§b†å I͉e"ž„•ÔÏw²µm ê6ÿiò~‰GG›ýÌ‘¡OæüNÔ}â…FYE <)O½ ¡£Å ÉËEçWÞˆ‚@Çlœha3*Þ©{ËM{Å<Áœ àf–ˆ]Â…oÛˆ{îM+¸§ïñyeˆ©áJ÷%zŽïègÛ[ðÙ©‚Y—ˆ («–zÔ‚jL0ŽžiëQX¢ËBíï(i©¶Ëôxí»›f'þÜLŒïO¼°\¶RWE+eC=‘¸ßÕ;Gi›D-Q¨Ê\p¦¼û"ˆ¦0_4®š{^DÛ¯í+·¨HAþª©%ÃYð$×Dï‚Ræ6sûÖÒ æ)˺¹aÇJŠƒ_áþ6Ô’æa#—@R½ô c:e_yõ&^Þ§Îgé0¯Õ.È]¦Aõ²Ù’ôk詹Áž“>÷ù‰±+–’Ri®*šK“Ô¼ö:UìŒ[ ˜_ý–í{¹b¼r>à¾ZéÛÃÉÚé;$Ud”ëÐb†M@LllÙ¤‘! KÛ¹Ÿ¬Iêvßp¡Å)'Fœïx÷…ºã(ieéRŠBèÈLa Iì&Pþš6Q€IhD£É g³`cšÿîý–Ä•¸šn®pM5Xµ˜…¤à&ð:"i—²Œ[,ÓÖx­¢ì‘MÝ@ ­àº°Pêf)OM’™âˆ;V†³•ap]4³ÍÜÌkïçæÚä›Ì‹×ä'Ie1£žM“˜0¤üšÙüšÝcg&f’ô,˜¼aˆ²å™¨Q|« ZQñŒåÜó+KÈ> stream xÚ1Â0 …÷ü ­Dãä’fºåŽÜ„ª6@%@@Aüý n¸Éö“ýü>‚,ÄÄ‹ñ\pè ð[° V—¨ßÀ:[ݯm]ݪ¼`[f?]¸¦nqo›’²Q¾Ã!T]HƒBF™oüR̼¸ŸÈd®Ñ’…ú(Ö‚&êK T®„G¿umÊX°_‚^A‡úæõ¡‘Í¿­þdÕ1§ä„ÊÌÏÈ ŒFGÏÃ^žî«ómÀ–óÂ0gŸmN]èzÈ!]„ý׈MÕ endstream endobj 2355 0 obj << /Length 916 /Filter /FlateDecode >> stream xÚÝZ]o£8}ϯðc"‰1`‚yXM[í<¬´Óìj¥L\cRkÌÇÚ¦3Í_h'm2Zhá âbŸ{×÷#°\Íгóo›ÙòÒ‹@äD°É@€"¹â9!rÁ&Ûù＿øgq³ùðh¸¼$p}Çó ¶fÐ÷ƒŒã¸µ»Þç·¥ÔÖòY7ÀÆ:ŒÚç>aLh+Ê>/\4çf›Ä)_à`~/_ßØ·±ÆAcç:Q´†¬ÌsZ¤ ˆ4—¢àm«¬Œ(‹w툌V Tè7GE€j œÜüx5ÛƒqøhÓÉÿ|FÏÞÏ!°ÐoÍk!S(Š¬ìê—]½–ü›Ò];îc†Åý2ÌQO‚S¡é­ä0å†3;ò)r|œ*v jÄì…Ìù è½¾º¬ó ²²ø„ÞMœ^´ôð²ÕÛaãt„²¦oR,¼Ø5BZP¹×BT.}ÃWY33%±ý4ääƒufSj¨„u!ŒáÚèq"vQO5ïTYWI|8­'úDÃ)äJ•JÃG¦'ŽY m ­*(éž+›lÂJ•¦<£k29ÜmEaóŽýÛ,Uª“-•ò;Ó÷ßãÏ7®2^ɪ.ò2åSŸ±X_ßdôáûlɨԆž •,ïm¢MÕ›Lëò&ßäÏ Z5T°»qª®?LnrZY¨9Yd8X9 yN°¯È©*F+Ø®ßdÖ Y7¿jñ'±=%Tdô:ø‰~º\GF¿\wq¦D±ƒLÖÚtt‹S,Òõ è⛼ˆÞì«Kl›“ôÀ ÿ¯©ùWÀ,Ò¶úïx>Y £O™Ïi]q ôk²¬µZ ÖëIL—Ðw´tW“äå´æ¦|TÝ­“¸M}e=Zô ÂZäµl²L(*=ñÈ£÷š•Ev(m¸aoò#|¬4!+­Ûߊîø8É9_zžÑaü+ÔåÃoÛdäóB_MÖš«$¶Ç)GZø~ÐÒ%Üe7ƒÜVYÛ:Hצ´?®&=‘Âë'¹\Asî¨Zr½iýÖ ôf¤šîSœÂ¿Þuâ=š“àƒ®“Wí.ž‰f ðï /<@Ö}­5wë'›Ù¿3·i"à‚ƒÀw0 ËgÛÒæöÛu´_åÀ'Í`€׳?»-`äx öo…×ívraì=ïó?æ$Í• endstream endobj 2211 0 obj << /Type /ObjStm /N 100 /First 971 /Length 1783 /Filter /FlateDecode >> stream xÚÅYËŽTG Ý÷WÔ2ÙT—Ë®‡%„ÄC$‘ IF,´"4†A"Ÿãêö7÷‚¦›ÅhÜs}O¹\®žœS)äœ4ˆý¦:~S×@yüCNdF YÕŒxçÛ·fF‚@)ºÊÀ %™O¦PÄ^Ï9”žÍàPñCB­bF -3jhRÍh¡uCÎ=ôlÈYC¯†Ì)(2SÐbÈœƒª!3JlÐ,°šas DF=S†UÌâ†ÜØâ0²d6?$DÜ €- žà )†'@~@.l(äÒ ”©’Ñ ×b|¥Ãr b´¡WAŒÖ 1À›z¶1zµDš,FA •ÁÈÚ-†¦j1F ;?<à!n¼4‹VaU²<*TsɪZ Ô†B&| Uàõ¡P…sß½@]-ZE\e˨^ƒÁŒ銑§:2C%Ш’–au8g«¥Ü(0£°øÍZAÉ´ñ´á4ÞhAd¬KCA•Ú‘JO%}pïDlF ’ÏΡXmÀ’PØ’G.¨½‘7$,5¿J+¦Tï(HµÕ@­×4JRS€x槄*íæ‡Òª²{ŠÊ-C~µÒÝ=-¡vË-k UwOQ½i”¯öÐPyˆRhŒÅÇ„"5XZ%[D$ˆÅP³Ø*X‚H¦öF'” ¬Ší`[ŽS ]ÒðÃÁ[=x°Z? '؃ ;ú÷°þãÏ¿Ô"^>ýôþý«ÕÇwû5øɼ_o±aÍ®ø=Ûžž‡Âú–±4ã…gØ^\ûþv‰ ÌìÞZ??Û¾y±9'aýüé³°~¹ù|&À—ÿ}ØàÁë6«õ€oNÏ?Ú{µþ}óqûéìÍæãn_¿ý¶yûîõãíçpb|+þÜ4¿B ×gxÛZÚ`r95kn©a5J‹»å†WŒþ6ëT{ E7ï(9ÒÇÒ{dtÂyÇ–bAƒœw¤ ªtÖQ´ÇŠV1ïÈ)êŽ y*/qD2í¶ ¾áXàØ–8rŽ]ȃ†U¬ ºjLKäAûFèY㔊Ju#i´Ö=눓.q,Eȃ36¶ò}Z÷›­€ë·· ËZÁÇ»ZÁ5§Ú)jï ±êõÖ‚»îé{ÒyÇRKÔ[Ë㚣hŽ6„Ì;V†4 ’áÑ®h#åX¨Ì;¢Îc]ÂåmŠ™w¤%-p$È#M8V$ÓNè½=ó÷Ù>nlŸÒ¾nû¬žnv²›JÏJwFÛ ×ˆŒWVëŸþ>Ÿ}wúïjýx{övs6Â¥WëŸ×¿¬ŸœÐø` ß 7 <(cÌ@ÄÑ&Æ\±¡Æ!ÖTáöh¨ö"¬Ú¾ÜþÃG¼øn{ÑéGSê^ˆHÂVÆB"‘lÖ;"0§‰Ê“|LÅ„!bñ#® –¡ÐWñÕYúÂxÅñ®xÍ©ªÄ[›Ðu?t«RúÇ;å5Ç¢èVmAÖ(¥/AÌ8õòŽ¸®Ä¾È±` eÞw5«±yGRv“þ.­¥ñÍÖÒèÛOæ–ç óÖܾ5Þ5³+páe°wÑKͱyslSslnt7toô乑Ý`7Ä GîŽÜ¹;rwdudududududududududÝ#ÛvoÙ vCÜ(nT7šÝ G&G&G&G&G&G&G&G&G&G&GÎŽœ9;rväìÈÙ‘³#gGÎŽœ™™™™™™™™™™YYYYYYYYYY¹ÜëiM÷OWŽ2¾ìj±`W’Ø]·N° c»¿ãÑ®;ömsȘ ìV3ËŽ÷È•À™k_„NJàš,òýJì9LJÌqÈ©ß¿¢÷þ !R…ånzÿBì)L:ÌQÈI æ7;ª÷:HÇ$›å¨±§à:ÌR8L=Îó‹!¥cÆù >…ŒA ‡ÙÄ—k>îZì9L‹1Çá ‹Áµ_R×ã®|ÔÕàVcjì‹BíGæPr$LŇÊà”ZÎÁ+b–ÃAÚæ›h׋I Æ5³æ£ökç0)1Çá0J$ rI *`EÇUbÏaRbŽC¦tÿJàŽÅþ‹ºW °¢£îçàJÌr8H¿Ì£C¾¤Dµ¶Y‰=‡I‰9‡Q‚1<Ð%%0v—ã6L§0 1Cá0:$Ì/¸ÙN:`è®G.ˆ=…I‡ ѺĦ:fîvTœË0Ãà gUÌOý’ 6qw=ê™á&æ8äÌ Æ×Ê…6ö7=êTG´û/íÄ3·Ö#¯ÆžÃ´s.Õåÿ¡¼Ë endstream endobj 2479 0 obj << /Length 1097 /Filter /FlateDecode >> stream xÚÝZËnã6Ýû+¸´€P¦(YÀò¢mtvM¾Ôé_“A졼‘(BϹ¼¼÷P$s€Àmï·Iopc» 0»`2žã›N`ƒI ¦ýû’³ˆHb@ìùý¯‚ò¦t[²˜ÐBý«¦âŽ&”Ú<Ø&6-ãaò¥w=é=÷,ÕVóqÇô¢´7}@ Võ_2íÀßë·R฾º'à¾÷Wm 6€–à!ð,d"ÛkÀFyš’,V†¨Ÿ°Œ6¥¼,Ï®j<ÈÄȯ:ôuu|pÕÃ^åÝmLëÆ^Ӭš:ùàw0Úù´‚š´“á°a[ð£˜xØ_Ö°O¹„EÎå¸jµ:ïàÓxÇð^œ•Ü™ÕmɱvPY&)ŸjÒˆŽ/‘ñz8ŸÈS’$?²<£g%ëYÿ²Éëœå4’9_uuhýcœù¹eû\Ò²…Ïâ‹vfÞ2.ˆ\\4QÑý†NhFRjò2¡â¢ý¹¼ä´º¼wܸ°Óv\\i¿W®Ø6]·¿WMvD"R¯*½Aù§†ú†±Kf° ÑS•¹©œ†#%}+uÆTÐmj£mÿ®à?õK–Äe³\·¤Šöí“ù:§þoiÝfÜ!ÜLDŽ˜J¥40o`žGQJx´€‘‹öl¿ßo™0ʳ*ÙÌ;`'•k3Ѽ`ÅçZÅÝë%)ÉÉ O³¹Š}d$Y &~¹éߟVjѤ"WØê’.‚f‘'IËŒII…¿µ…ÞE=çyY„£ú6ÖuJnL¦l )ç9ðÕâ% ’¢€ YQ^%gXð\æ¢+Ø%Tå‡Õ÷ª˜óX„õb?Ë£§uå‡ÕÑÙñ2Kó˜v!Öx»V’<"‰DÒ˜ñp°¬Äᆃú'K£©ÊÑ´y"#…2K´èT*SR|Îâ眸‹ˆ°YÍ*à³6â ö/ GÕuÜYxn¢žq–Ía””B¶fgëkkw÷MrU´FU±ÞS³èàÜeq£ù·~LŽ; * N+°/á |p²µ\+[Zó´O]° ²½¡%Çá¨I©‰m÷ܽlûfàcàÚ®‰­Mj,-•Õ!+Dæ˜X‰(Ïfµ4£2:™«¾*VåÕh·{ÛdN; aø(òõ/àP›Hô~+åᨺêàºíí¼icÖc1kJµHÊ7ž´¿ðþgÛ|º›bxN_sÙ ¿^µÎ°óàÚO»ëÛë4×½ðoÃÂö†Ž6·åuûÖ¹.ÍE\ènÜÃç«4ߘÝ?#¥{ÞØ?ç¤{Â8|VIwwæ] l¢«b¢Ô= / w¨[^ßwu»GŸê>xìÜÁ¦eá†;ÆN}Ç©*±§ÖÕfqý£àe “Âò#Á4 endstream endobj 2358 0 obj << /Type /ObjStm /N 100 /First 1019 /Length 2366 /Filter /FlateDecode >> stream xÚ½[ËŠÉÝ÷WäÒÞä͈ŒÈˆ™² 6I ÛB YÓ˜ÁC÷ ŒÿÞ'òVÔí¥U ¢·«úä¹'ù(Ω‡8S ”É ü(b‡Ü‹9h÷H(…ÍÐP¯—JèŲ̈ÒõZ D]î`u@Ž« p)ÁH»Á3ªl œµëU Ô»¡°¦ëUü`(?ú¸•m î`«vŸ1¬ãª}Ά’ñÒõj`f(YB6B°4dQã’KÈÚÔ¬r¥q_ ¹IǹCˆfx’‚ä€EAX Y8H®ö’ƒ(û$HC R¯WKN6®Ô ézµ¥Z0†th<®j *bžqÕ º 2zò/$ÀÔšM¥PúÐF9Ԥݬ*u# ]+ÔÄ…B•q~ªÚmˆ’C­¦u†ËkSC)æÜëÕñ@©¡ñõj -·ÒCÓqµ¦ÐŠÚ•B«ãjåÐ:JÍ¡'µ1ð]:5C©z¾^E‰”º^¯¶ÐA߬zW[ &Æh¡DÃGp %V“­!ˆf&¢()™sàS„åõ†³6³Y°v÷Z´¦áHÐ&¢ºÜL £A¢«?˜DZ‡‰Ñ¨&#†`™á‰®úň#;ˆÁÍLŒÆð°™mˆ £±à'KÂh\r¾ƒ‰Ñ¸Â01·ë -' pIbijù)I-½ú01Ñâ"a´¬–/’0¼ÄfZ*6s–ŒDïðÖ³gw—7ÿýù>\¾}xxü|wyýå_ŸÇç¿þøðŸ»Ëw¸ÿø6¡<¤w—?_þrùþ-w—W÷>‡·ÔRÔnŽŽõQ‹ÉœbÒ†Û¾ Ïž…ËëpùÓã›ÇpyþðóûßÇþÇðÍ7wøw… {£À©F1—Í(p:„PHF$dŠH"T†Õ²¼Q,­/BPÇvR¢ §ÎQ£·úD ­ep­ÎÁ•˜q8G æØ‘¯»9ÇV¾Â¢ž „sp%fFÇ+b‡œ|¢Dê±ëÚ˜Ø9¸3§Ä„T$7%¤•˜¤®UÂ9lJL9œ£„RDƒuS¢p¤¼X çàJÌ8œ£×hð®Dn‘ù+,Ú J8WbÆS;A‰”£ Þ• ‰hy~ŸE>žϨéÆaD—µÔ;‡ÍS§x½äèñv% ØôÅJ8WbÆᔠżÝ”Ž˜4.­U;WbÆá%’uRO” KÕ¥ÊÍz˜L„"&NK½±sؼ1å€á J¨õ07!0h*KÔ)¸3 §D%&Öè`n:€L—Å:l\‡…S*6“õ/78Ç”eé„Ã)¸3 §è@ Ý õ]BïOœ—ÄÎaSbÊá% :¨ôD ôþLyiHì\‰‡s”mémW½N‹•p®ÄŒÃ)³q"ŒÞÚM ëý;/}~î\‰‡Sž-T}"„M?/ §à:Ì(ü&"ž‡·œUý*\þþôfU+z_~úéÝïßh „9öD¿¾ñÅãÃç1ô Ûü(íú/lÉŸuû`íh)ãþêòòãã‡×÷øRáòòù‹pysÿËçðî×:½ù»Ë÷¿øüÉv1lóé•ÉñéñËÇ÷ãwõú»¿Ýÿðãûï CÁ‚a±ñòýGüµmrl7õ?aà±b|ÆVÈfôÍ(É ¿§ø=%»!n¨ÅêFsÑ«#WG®Ž\¹:ruäêÈÕ‘«#WGnŽÜ¹9rsäæÈÍ‘›#7GnŽÜ¹;rwäîÈÝ‘»#wGîŽÜ¹;rßm7c3È v#»!n¨ÅêFsÑɑɑɑɑɑɑɑɑɑɑّّّّّّّّّّ³#gGÎŽœ9;rväìÈÙ‘³#gGGGGGGGGGGGVGölÏ&Û¨Û GVGVGVGVGöÏAñÏAñÏAñÏAñÏAñÏAñÏAñÏAñ”-ß´µm‡ÕTb³MÈm?¬¦ËmÍ’¿ï‡9ß›r8´Ép%JãØëM‰Ò1a®kwƒ+1åph“±+r*O”(˜1—µ1áv%fΉ‰¬‘4ß”@Ó“´®Ubã°+1ãpŽDý¦cÖ,k–üw%6»3‡NË\ …vDÇ•ÐŽis^ÎÁ•˜r8G‰‚ÖߎF¹Óf.k•Ø8ìJÌ8œ’š17¢'JhŠB‹•Ø8ìJÌ8œ£i,é‰6SM‹•Ø8ìJÌ8œ’9;ÞãJ$Lœ».í'œÃ®ÄŒÃ)ýzáh‡Ù\ ©-–¯mÎÁ•˜r88;jLݶ‡Q·1 .1M)Ôíš)e§À”cïeNáX!î°³§hùí/ßÑN?¢PÅL‹Ú FÅd~ç€Ð°ùè”ñeB%VµÓºx€aöI…bµ“ °²fmÓÖ¹+óƒ¿ÃÿSÇ–‰ÒbGŠfL~øºØÞÙ„á(iQH tj;…®±£…c#Mœ-Ø ;‘# ¥JÇÚ{Få%;Ö¶¾*™ii熵¡jŠ­ª¢j.ò…%Â8̱q€oP*§ÎNk°íÈ},¹mBÆÉÖݹB8ÚòhÎ1—m}8‹DmkQa;z2Ã#\¡B …2g†*´(3ÁEzçÐz¬ÆiÆáØ¥-Ùᤢ½W¤¨å §XjYT¬mãåFaœ¸*s  ¡1Ù-¨Uš– •„HHR¦eO-{ÕÀ)à¡e¯”L)z ÅHŒ÷$šŽ­+ªd¬ â³,Ê ‰d¯69tûd«3Ç–ÊbMF›b/E¡P{ŧ %«ª8ØKGΡ!6”çžù!ìD éJ£V!7ØJ˜ê¢¥2 mɱQÀ÷‹=ëœÃ¡Bp¶3UöOs Î56 ‰’b_¢cžÑ, œ½Oañu÷jSLÛÉÄØmÔÊbï´ |"‹â¡€ƒ´‡6Î`Î9ûÔ€ŠG.±Ù bÖF— ¼³æ¡aOìzcPmI¨Nų̂ö¢’’P•àª˜‘Û Œ‡jþŽ¤þR{7€ endstream endobj 2492 0 obj << /Length1 1606 /Length2 12101 /Length3 0 /Length 12928 /Filter /FlateDecode >> stream xÚ­wePœÝ–5Ü]Ó¸»»»‚%¸5Úи»‚»w‡`ÁÝ îîÁÝõã}ïÌÜ©ûͯ™û£«ž-gíµ÷ÚçT5™Š“˜)Ø( ¶ubbcfå([Ú;;*m™ÄÁ SÀ»“ ‘ŠJÂhäd ¶•4rò´€¦I  €ÀÆÇLJHÛ¹;Xš[8h5>kÑ100þÓóW ÀØý?#ï'-ÍmÔï.@ØÎhëôñ¿>¨œ,€3K ñIå«œ² €VFY ´:*ÎÆ K€¢¥ ÐÖH0;@ÿ0&`[SË¿Zsd~Çsí€&–ïÇ€n&@»¿BŒ; ƒ¥£ãû7ÀÒ`î`dëô>'0ÀÒÖälúw¿øoBvà÷ ›÷Ø;˜ ØÑÉÑÄÁÒÎ ð^UERú<,Œœþªíhù€ÍÞ3MÁ&εôwìæ=êddiëpº9ýUË0µt´¹¿×~³s°ü›†³£¥­ù?0€æF¦  £ã;Ì;ö_ÓùgŸ€ÿÖ½‘ÈýïÓ࿳þ‹ƒ¥“#dÆŒÈÆþ^ÓÄ齶¹¥-"Ë_‹"gk°±þÃoêl÷Ÿ1 ÃߢýkgèÞI™‚mAîS "‹2Øé½$€ö§2ó¿OäƒÄÿÿ-òþßÄýWþÛ%þ¿Þç…–v”lÞà àý…½1ÿ_®‘%ÈýÈþ×D-à?þO rNFïc³5—‚•™õNKGiK7 ©Š¥“‰ÀÌô>£¿ý¶¦@¥-ð]Ë¿Ç`bceý—˜º…¥‰µí_CçúGhkú¯Ìßåù›7‹Š¬–¦´ ÿ¾¦g©¼«î¤în÷Nì?úP›þ—ñ†¸8Ø àÉÄÉ`bçápó²xyؼÿ‡jðýÓV2rr°tè¼·ÌÊöwãÿñû§¥÷/0R¶&`Ó¿¶DÍÉÈÖô}±þËñWØÄÙÁá]Ï¿ïú{Ãÿiÿ½â@ Ðqql"d•’žêT—Õ?*©ÓÝÉÝlWT«žŸëW îðM Ýà+3|® f®ãmrŸ=´{Ù‘§ßìÄÑt$Osˆ½)èºr1V©[xvXô‹PR´"<Ïf×a´¹Y5w7GU?ë> káp€?»£ó£pÉõæ¼µCõ1IþÓŠ^YwxD¿wKÓ;4Ðß×qÛµCÄ@%`„ç“xH–àänèp]kò ûèÂ㌺Mß ö²XE!Ë¡<ü²A4µŠ3Ä2¦¶Ëß–‘>(Ř•Jˆzí;+æ´p@k_ ÕÂ%lMsG|ÊQY«‚d¬œ7O`…Ä5êꀕWCYÑ:g?~«·½D:ðpSÊG£¯¿Vì¢ 0ƨlQ_LÊs%ä€ð—ªã¾°U…t±É?xæüÞï~í‰â€f6ÒNÎÖ>‘+Ü·¶J Î{Þaå°7‰¡øD°jž§öÑW´nïžµ““>‹å؃f§"“¡ç|å4y—hÀ‚ÑFÄo‘ßrLÏ©¥¶2Òzt. úþý¶¿®Wk_Ü-‘X™a^Bìahðñ) cɵ{,+Ø,`4œòp<¤9ý(dz£Î)ó©ÅëºN€€_ÍçD]BE"5¾q.h*›=?š—l„å}oä á ‹œ—±±Ë-ñŠÑŠTŠ¢—¹~€i~‹ÎE×ûÀ/ÙgKÖ&+S/^3Ö5>0{Ì@º….0­ËÂÔ?yI§âSÿ+°ðì.€R¶%z”FÍRþÚá3ì"¹Á#{zÛ ËèHd¹jøl¬«³KºŽ:s³d >¿g/xùÀÝc¥C œé¦K[ù©YïNšM¨?èõÛžÓڊ皦ØýÙ'½ ÿ¹‹ç}PÿðfP ·D‰žØWQ«ËŸ0Ô#Löi›Œj-"’Íin Ê:7q‡\ Æ´PûCü˜åNJ>‡{G£<\ª9d:8OŠ$wïM“íg%%½’³ó ¯õ-[)zwNLä¶Q)u”:†Ž3v¬û4Y1ƒÈ“B4w3~-,öüª¦Ç¾®Tq|³•9"”§"7|"ŠAÑ”þrž_þ„ü,âMmQÎæÕùÉѺû$ÓA±e–/`ë5`Ü!×7oó e§qQ¿yW˜öä§y„0gÖ/‹sÜF¨…3ãÉá¦ûWßIó ²«È÷ëYçú“íyØâÉ:–­>[{Â~Ò*æ5}Ûì”dÊjáUKÛmPÞEåŸÁRŒþ|jWTÂDX?«”ŒqIú¼Í_xÄ›&Àxƒ¤íÎôÍÒ¢6¾áÏNÇqÇ% g1X9„¼ ö¾mt&ˆ‡¦M©É­åæaQ$« íBE‹<Ê0ס?è\¹êV.-~v¾ÌÂÇ {y1‹ÏÅo;Jx ÏDƳMÛÜ)AëæP«*/2 |›™M>eðK2Ïô1–X=eŽn–À/´±˜5ROÿð¸ÇL;Z1}`GÞþÚï¼c°¼è?ˆ%©â-ª0 ô»øææi¶%+ÌNøâXú s¶ 7œZU˜ã¡_.™Zs(ÕzÞR‚cQÞº¤±¼ÛÍiìÝpè@ͨ?í¨ÿÊÛ“Ëyør, C¿FV'šÿ#W 8x²G–›2íìûZ–¾¹E3‡JIÕhR‹êì[XnÂ(áœ(–Nž`Xdu¹¹Ïù-ýß©Êý¤÷Õèo$v¬¿„ªÒuŠÉì&Ï5£Ùîï ¡`,4b¦˜úÄÅJÇírýñ¦¾‹At•ˆ×&¬"·Gxã[ ‹Ô­´jH‡ ¡§—÷Ÿ‡þ§',ˆö#­ñKF¯fÚ¹>êKõÁå8–Ó.»;–Ù›ë •Wø57DÙ^hÉ|J£×Ìzõgºq¤•$¶ É«{íÞÚË+®åï5Œ2Ø-°sø"Ç—ÐŒl¢–Ö¬‹`êé&¿I¡4vº"ÞOÞd¶îRW[¡ÔTÓNe~ÿ\̈àü´,ŠEFöaÆ´ú5 ”‚4­~„CHîae5ã׌Ã$);S¡\Š…I¶êÛ½W£šàZ=QñP¶¿kI4ß&™Œc$·.‹3ÉL¿â ý¦á™ƒØÔ:‡“ŽÅðåÝçÅtþÆÌAÌD{8²^¬æõ{ìÛ~_¾æPñV 'zsõu†àmц9ÌôeçŠÅp积 ýYl2š£bÏ'¶E?iÓrcèˆ/ÅŸÉpŸ9…Þ„è2‰{\E]£Rå×ê:zIÏðÒ2'mÖL=…µ (·ÊÊÚæ¶ÈÙ¤ZÔn‡ŽÅlJ ®Ú¢ÈéF©áì„O)¡^EhvZôW0·ÓÁÁ?„.·D+µš‹LØ£Mf½ú̇o¶Á¯1:@ËõfãŠïûA¡èU¤uYüñ«çOùsÁPúdäÖií>¹Z»À¨8…iw'G?dÚäJ°£†³\ž„¯ëƒ ¹Câ îD´~æÃDœà5†—0ü F!ŽŠnµ[ûÎR{"j¡‰`„ô °¦¾qZÚ€&TØ”Wš|H5¦w}åñ‹ÙüÚ$T ¬ìT7$‘‚ŒQ=½Ð)Ç™KÝ`nxmèúy=ĵ“Ïãa¢ùå‘Ë[»½ßÏíõm—I$/øÐë×EhÁÎZ3É;ÂÑ;:|q2F(?fO²é²åÁß|pºIw?8ú±ç2Á¬£‘a* òv¶ý³+üªf ¢`fàæç!ÓÞýoqª£„ KªB8±nU‘\Bk¶¶ÎÆ¢ú`s) ]­÷þhšôkª.ÚYIô“Ö¸è« îÀÉÿl±ü8B•.3µÅïiž¡£åà«AÞ 7|b¾¡ÆeEÖ‡?›Ž1 í?]I2#„P2 ”zz;éa\v1àÝE% à^ñßúÞ¦ßzÑçVm·_ÌTîl{ä¹®»é3rn¡ãºpËö‡XÅIkb%û½GÉ(‘Ѽ£ïx >Il’£,MFµyÆ.°¤=?iÌ>:~oD•Ù8lÙÚ[vÒ¤â˾êaŸ‡â\ç.£eGå½Ùp½…%w»¡¦‰Ñ#È\ËTνÖâûJo•y¨ùÑ’÷vSæàRå@spÔBQe}[xF"¥Ù½ÐÞšIè¾õ¤¼&ò²–qˆ¢“bÒ­ŸM î[¶»å*ò!(É2¢ªru4Ò]YW"~à "Ä„ }(:=‚k$K'zZW±Z÷e™ÃÉÁ;CÝ(uñtÈüHžÓÚ>yzm­6É'{§/ôM:°›Î ³/RSž^QÊ\¨ºã÷>ÅUI1ÚGŸh¯¢Ÿh nÕã³²MÓögÊ·Ú*ÒÁœ\€“åUT“õ›²ks£6ú„´µÐï;kõª íLP±xSYçyIùùe ?Çz&VãSº,Cgé*±?MrÔ”¨\Nh RAöSÚqjW=ïâ‹¢"]—Ëòî8•D“vz•×Ñù0 Pâ:r^†…›òr[¯¯C„ÑW>ÿ´ìYx{F$"?õäƒ2ñí냈ەò‚Ø‹>¿RVJ¥à"|¥› t‚Ü‹Q“Aß„®ÍÛÚEµÂWöÕ 3ˆþ‚UãÓüT儼tBZ]S¸þ­5Tƒ˜„Ý“ñ L¬çFé3åŽV”â€úóºjÙ:Þ3ÇÂ?‹-1áþÖ °—ßæÛÙoß¡äÎëXK9> ‰¯´ýî8¥÷`@,Àgº«$:Ôæº}KÆOüÂúA{™ä“°sÚñCGj}'NPeÿ­Ðg‰'ኂžcñ ™*ÌaÍ›B1ÐNýWᯩí ßÙ6šýPÆg,uU?ªÉ œÌemԼ͒n&ÅØ«>²R\çbYŸ‰réstP{ң߇Iü•&UâèìÙªï—QÙ…âЕ“BãÞü$žÇÛ¡R‰3µâçi•[ÊWú s37å;µ>ÙÞIÕº”‘p²`‘kW…žÊ†+ÜÂX0ÒðÇܲ$„9bÿj¿¡ØfäWV–œv¿L¦Z%Ñá–v-Š„U%‹Í_‚°Ø­BnrèMì^¡ÊZvå|V±{'{Þˆéoc·ÐÊÏm@žÍâFßØYìV…Õ(‚U8HŒ½¢òOjšì’P$H#àÂUæp›Nj­ü«P$’³äc”Î1ݺðT"½ ‘…>¤þ¬SÛ9GBìQ¾*Òš}O ?ÇC/¦ kí¿ìÃÈÎ?Žû;:†œœº¨Ùí`5ì×¾ŠÆTFP%ÓX®Lpqõ<ÎäÊ/¡~(JPÚãw2÷Dçt­d×ôÛóAnlº5žï4Xk׫H*nH5K›>Úa,´ž¶),XÙt oéU qRA"#¿ÞxÄߢò °Õ1Ÿ{?Ë ²ì=âè¸÷=7Æ?·&–•5ÙëÊ1ÐLLwP,ÝËBØ¥V,¸þPÜ„ÓmG¥æ¡, ò’%{ùÚØó±Iа‰Ã¥ëˆüë·%¿V*|Ưk4 äD _[´ã½9‡Ò>æͺ#ߥM{|Öj$×N„1z ÿ0ˆÆŽ_z§¯¸qq^Ç ŸýùêÃy[P­à:"ÿÅ·ŒôÝ‹L¦dWû l<T"‘&„‹ ß(DüþÖÕªéZ?“¾¥fè”;Ñ…–é×Ä'“Z—¾S®iÛPáÚyÅ…ØNôB‡†CþO§­®@½ùùßfßÍëW5~ºb º’½ú¿ª°}?dïyЯDµ_ä˜ äéc~¶Åõ…à *·Ó† ÍÁ¶á‘’¥:Vûõ¶ÒsoñºøÂœ7î0e"ú)-!»¹a»1ï¢ñgð’’,Œ–梀Ïñ×&Ø«º\¬Wz7UT§hŒ{Tç¡÷¶¡ƒgÝìaWžŽO£ˆ7Ý&PDr]„!Ñ|™YïSmëKqí—«¬ó-†f3±Èµpð¡G8¦ÍNÝiïå19L¨^yhø ò )SZ4Ëô‹ÅH^,Yu.ê(:·¿>0b_ræ|µqÒ·G1ZæøSL =¨(ÆÚOÖº~ &z@ršŽ9nÀÏË)«ÖdÒç)éÓ&sÕÇÊö‡fžx•Ò/Útì­pæMOËÙ ÷ÁÏSn¾Éò‹g–´­ÒCgâ‰}©Â‰\1º$-ô¾ö« ª4ù·+&Áo÷%÷>GSÆè¾F¾ü¹[áÉôlJÆFßœtq#iø‹¹ÉÐ0I [Ú‘›=‘„¿¡NÈ^xù$…×·¯áß–×7çt$I‹ù£e™®¯¢õ|g*2Ês–œ^´W(d¸‚)»º”3ÁÒï_#õ<7‡¤5ÙÙ”_cQ"älˆvPƒÊÚ)rÐú6?Ò©ÝzâÀ°ä˜½þëX@J\±È­«‘Ó¶¶ RyÙ)8ë þJ~c°bH×5ZîÁB~£Éòka–Bû•o1/Èw jxÖà‰} Sûm9žä¹°™ü÷^®{ÅîÍi»kŠû 3à „–Åq¶!¼§_®Ö†ÙÂ÷e5;ûa$µ¯]”v¼ØKŸxfõ0öÊiv衃Êß„žÙ-çhÒãr¾ \…™Ü±ã¸Í*Íýf€&U€x¢ž=j h•÷™™‰jó\úB„-¥K :¦iNtmKì­ïuœ£×t#ë@ñMõ¡ù[SU½«ˆBð?q¿·¸%Óc'',ÃOâî²8Z>±5„ÊID:›™8UͦÞosXÑÉL7ßTØ2ËT§Î«K]¥¨»_,p8\Ckuúz:ôbàG/(–÷£›¸”iñ¼{ð–ç ô^ÚÝ ´¹—DJ6XI#´ä"ï¨ÐêÓêßÚSQáÍâCÌÐÈ3m›GÒõ&«Ó$÷hPéÈÎxÕá`eÕ„|tew''(nŒ‹´ñ»ûC ßiòìKÒ›‘õßgR¾yv¶<«6D»5¿ #\›äGyïíkã¿?* ¹±04žÝp¶Ûg˜ÀJÎ#ÌÛê ¢#WÙ&¦z,6~À%D—,?‘ z§ž ;€È §§vó1®Á±ò£·¦ Ä±žh£kFø›Ñ:^G[;˯…B~nÞó?Çû çHoûy‘è2¤•b*TMRºîÈŸ{³èYké¢úÉ'‰4PV/ÅO8hÎtU1üûÚ͸ܘl-Ò˜Hm¶á©9ØÔ(ÓtÔÕÍÐQoÛ‰{у±ì)¹&‰Îæ ô2yW#€TÁúÅ‘•è`rˆ9 m¸ çfüÚIE¯Â(§sñЦ ”æžâ2N(ÅŠä&¡¨ÄßÔ‘{è×jkd5ç?µ‡É ¸Qù‰#ã®–ˆº0_t·¬6bk£¢z †(zñn\¡ÐÅxCÝð¿©Š²hôD!gÛŠÕ*‘P"Ø“ùÌñ™:»]y–x…·ÑOlßÿⵈÙÒOBŽA/¹4\›Zi¶_ °]f½‰¶)¨¾â]„YÄ,¹ü©µ'V‚­•hq:Q¢²õ%[yç<Y4*“åT_¯ŒK)ÝZ@~+|‰ççÙMæ%UËÏBÎ(ú­æf÷ý1ªv{…|#ˆÝFø~Zñhöè3Ýw½@Í“?²–Ͻ‰ 7û7ƒšïŒæÔX~¿2z¯Ád`b‰k1/Ìœ¬ÄBЀäb‚g_1ÄÃ’µgU±¹¥{Òþ¬4„“†ö°ç¢.®ÈÓ6š›ú—L¿ÓKß+þõóŠP¹‡ˆ‡¼Ñfü$`µû³.ª¦õXfïI N²·pØž·þóR¢!–ü%ÓÍRÜKÅ ƒM%K´NÇ‚²˜’˜™˜Šþ™]­šÛBN~û>§d+…/Š»ˆ¦ð÷)_K~nM£D¥ C8OÜùçພX±¨¡"‹Þ±0:àüÌxFõ]ùÝ(DïXL/ß$8 9k\ôÏ~UÛJE]F÷[–ĆI8-= 3#¼=ïøQxÄÔ¬Û°ˆákûúV ØX)åŽ×-³Fâè0W š43@j:›CË@]sL×BT´Íí`IQòZÌP!âË Š“EµÝ5A‰Ï=xཅ¬Z“È×[<˜Á8Æòª‘•€óvGÇuHs“X²ÜJ È´+Õ‡)YP~t²Þ %{ Ú˜ÏÝ<²LÞbü2Š´ìð÷qà ºÛ+D³JŽm†v*Ž|Da Я¢àÅi¾ŗhK÷îqÙÍã…”Á4ùôeb—Á>g›·©¹Ö;rBˆÃZ“ä8JªÒǨë|g%‹u4ü¶ Ѿ„¬#ÚeªÄêIŠ±n4±+º¹.A!¦¥Á_ö¨JÏf“Ê„ÓžôÉB-›aƒ‰ÊpH^ é1¨<“aÜæŒ \"NbŒtui—S)ée –—_&U0º«)ro'Œ~Ùü6¾«üµËlÊž”]½÷Ù, eµ4ÜËa„‰/ÅXsoSüµå¬À-Sk ÑnÂdš ›5¥œ©.“iœuU¾¾_#“Š ÷Zïw›ZÌ¡ _‚mjÙÜ%Õ¸³–ÑN{îOOý( Ü*ï®ß^Ï-çwm°ãB·ÔMW-9þ!‡_ý¤öPÒl¡Ö8*˺V™Ñ-²ÑE\R Å±ßXöf5‰OŠÓò0?ìÎÔÔ’èÞ07ZJ0ºxbÌ­Ý8:¸o°‰r\?fk­–oÄúO?¥òkµ; uììéMIn¼ôfY’v·|d 2'úÜd3Š­¶Ú »Ú\Áæ…÷½¼Œã­jNèÞ°e¬âí†ãÔs ƒ8[S'8øEP£ï áýÇ鋲0µúÕÓA ¦ lå!.ªƒÂ:3_Œ^¤©ÿ÷ô&“ÐáUúÍ€¾…”"Aƒ•G©ÄB`ÚÂ/5‚Cá²sÁÚ'ÚòÔ9÷˜a^½ˆ PzV¸£¬ÏŒª‹í’¤cÒºµi%øÃ~:©r¾0”»t¦”MîG ’ Bžn…ÐÁßBóŽ_"Íû­ ×ÉûTÒoÝ£rwV¶qíÉá5Åç?¬)øGd‰vÇ‹N·œÇ呱aŽÀÚsßRl]@lOhµGô9”JŸã%é »”ËuîýXG!Ø$Ç#õ(ÿbðPìôp(-ö¯:þeæKÒ““"£ÆŠ¡H$W ]Èþ$Yõº¾ýñ2CĶzïíá8°—aGwá*gÅ9’øÂÏšdéâèA•BäÚq¶âãý¢»,„Çøô‚tÒfׄ­41×ú†CMÔý$Òþ¬ MK#°EªKU¸€ 9Øq »zfƲå Àyì!æ·ÈXŒ8¿åqòÃ<ãÀº·Z­h·õrÃèúż>A©ó¬OäMíÕE¾ïÞUËßí¢G^‰l0þRâÙöÁ{fZà vÁ̇¹®½ex'RÀ<¶›š¾w[‰‘ã•é<ºÚ9HôjGÁ@DC>œþHù%e´ÒC>[˜-‹wM..Ñ$ÂÐöÀhísoá¯~*ìt#'ÕÓ8£kù²™¹P Ž£†%¤M’šíó––VÏz©ç‹™Q:ðê½ÍÔ?Þ¬º/àC"[L=Äë±l T»™Hhèž+LÌ #ŒúÒc¹ñ|¾EÓ—oGò¨œ=¸›¨;æ³ÏCÃpÞpnh¹z+¦°¨c°;·~õ$•ú{„±¸ú‰8_"|LlY>7}ðŽ")§:v–¶Ï>e,fÉô¥»gA¡Áý<eÉÞ€eJ{..ù ¦€2ÿ4—¡`¢‘Ÿ4B/Ê;^p‚7–l²¤…p_ç«i8Lwê’Ootƒ³Ý’nªEçûËO\LÚÉW¥W¡¶+R±åøòEdne—+lòóÇ'TM¼}T_Ñ=.Ø„*6UQn¦µ –L±ÑO´5±<Û+-Á;ËÞ™`: 5¾BÕèÖObac¹ mƈW;\»9`ú÷çôðWÃ@¹zö«æƒb:,HØ1eÈÏK¯R{¾½Øö¯:ì¾Á~”˜h…2A‰örÑ•SÕ‘ã˜k1ò\Ék¯‹ù´·VÙGÖ?ú£ÜlÃÄsäkÛ»våv V®ÍÚ;âÛƪoâSåuO.‹Þ£‚²ó:Ü ¨ ðY­ S“>4sÅ´Œ,¢\²•ÏÇ!§a:>“KÞ6“‰fxÆß»®´üæ(rQ«O¯ø7?¡¡Pðèp­8“•‡Ä•·\ÝOI¤ôHùFeéRͨ̕jÁq-VöYlMr8n’Ñ Ÿ;ª—¨¡xPmÛ^;¡ÖkCÏŠdðOLÒµl]õ~u±‡*_+}žU3[náAE܈#·F—^…}¦.ç[X›û?ݯ 0‹ÞðlP„jìËç}˜K}ð7a…id¹ùb‡oË%RY½žØ¨1,ñÓ¹Âô¡;=„Æ,(FæÔ‹d™¿¥:(rÞ‚h¾Ø_û¥€¦Æ¹?ø|œ!´¯jæ >„ô©“4ÌìNÛ‡(-,•7Ö(…,¼©K/iKOq…gb'ÎBmä^¡£VÐ ¹y¸QwgæHºÆ#ÉÚ¢Y¾Ïæ}Ú=ˆ}’m‹Tl†ÙêtQy”³kÕÎÂôã¾xÞôæŽó#~jÁ՛؞òî/S˽'ŸoóˆÉ즦P[Š_«Ãú ¤N¤th°Î}#gÆš‘© Ç_l€biREÀôÞ Y‹šß_FîuÔÁÙía6Ã….Åãí n>«Ä¥V¦Utl>Þ‚Ý¥É;: ý¡Ž5\»ã9]¢GžCŸ•¼rË<äØÕÎ_Ùä…î]£†0Îsu:"_]‚<\0ºFmðŠ€ã'RÃ-¤hk-• OÒ{*¶’0±H&Ï%‚†৻”‹Ì F”Ëɇ†ì[OF>6×ÐÙ>Œô¯á¨&žDFžðlEìÓã.™ÁŠ¬±KÊ K·†«èêð\\oW?Š”+ê6ÜÜS65›èUwÄ\aô€§T¶¶ç9‘!EìV²­ã°cÄmZSjÐ×é/çiµIŽ˜µË&ršÎ¹Çô…Ãqç ¨Šl¿iñö‹ïÔ4ŸEˆ›P2úñµŽ'#—B»ÉÊ׶”4•’#¢Ô0”l#'¦?|ÙE%…Ýþ~7í…‡ògÓ•^qY_lb—î:BÌ£û'º ÷@ö¾%J)ï»Ë*ö)LËʯ; ßbÅb§ð8úW^N$ZõéúT¥M?÷ªé®šD,Éâû­ÚPH×_ÉIWÏB»ÃE|jªöBÙuÑckyu/Íì$4„mÑô¯'šZöšúsÀwX¡™¿}îRfæì^Ñôg “Y®1Í‘”÷y °ÜHé1éJÿ™ŠuSdÜ0/èôã€èWÊ4ÔBšk«×ø¤ÿ æQ4M:ׯFÑPågÔõU¦UŒ‰”ø<êmýâFô5¤³+¨(†iJP|*q6‡á—–ëælkÁ¢g íÌëd?¥òÏу’ö…‰Dó¾(5Êcné3¥9î-uS³Ð Ë™_±f9´£yÛ-Q;c…½»6·%£ïð)ºÙFk×»¼G:“CïÏ‚`”Ä)¢Àšé˜R‹FÆà¿€¿ùµúÖPŪûÊ%Ž\ Pö»ç$Ÿõ)Úyáú˜É7>MãqÏ)Ž}³}ÒŸHs¤Q€¢ƒö_Ë?¹Qc!ON’p¹Œ´H7‰Å›ï‘û)¹£S›ðI³/pòD×ÂÓó$†³¤£¼~ˆöã…«Õ“õœÃ'”C#ô¥Z ð ³ñ#ÉDÖ˜ÏYÃ,‰àÙÏÞ¢·QÿìÒ çšÓuPxG‡b8˜>ƒg­ Öü$¢/Òôúóg%2£x0"ÞCµDA‰9%©jI­´qz­<®?d k–˜Dq[š ?ƒ6„›S¬ê÷+çƒ ¢Æãp]>FíÄ}xð£Ôð>öŸÈTÁ¼äÍ2 (<NGÐ| Žð¯D¡Ö¦ieÄ*$à(Áû#ýê®#åÔCѤ„`}º"F‰ Šk-Šn[ "¢_ul%ÜaÞzv Cš¼fJjÄ”cÙËÙ`é·­‹fçÌ3*!»\&¾§;ß{C%ícø¶7ð¬o™»¬-¡û!gR­[ãE%œ«À”^h|?|Z ¶rrF¨: +OcÝ]•Û,- ö5’8ÓU N¾fI:©¢RBÎû÷ÖÄ$tc}ô9sÃŽåîOz­žŒé©¹Æ…ЖEßeÁBu+Z ÈÖOoçþwæ¯ÈÎE0m@*ÏU„:)‡ûf±ß¬¤ƒÐáÓ:ëyA.7“?ïœbàø ® ­˜FsºÂ_Úª$òûfÈ£FWü+8\ä?Ñó¸©k[ }󽣡ð‘ó@3ò—²¡¢ã ‚×™#'¯Sxí<®¸¥òòe¶¿'kú/YC² ñ4í%v\¡¡c°ÝªÔˆãD {ü“3”«°¡zI8ž¿GaÿEOb¯p¢7\›ì«Ÿ9®tŒÒo9'œ.LˆÛòª€-ó®%;œzÖ•Lÿ§Õ²¯…ç[kRB®C±évsLKcW¿>®»Ï |qA¤>BDƘ—yi°Ü”Ç*ò, ’¯ˆÇ]=õð‰0/§§ØX¢÷~Q¥b?ÎÁ rþ‡Ô %¿{`7ÕÆò‘;Œ"kEPrêf ñg^üÚ`üw¿þÛe‘ïäZ^ÑíRåŠÒk]-yaG¸ÙÏQLAŸØ­ÕP´²ýE«ºÏ1ƒ`š!¬Â[1Rǯ¡®ÊäÄ)Š@ó±é˜>袆BÈRÖûWæa_•lô}~íçêá³pÝT5ƒKÔ'ßå[ˆ½ûó¤nZý”Ó‘(0c’Ìt·¼¶=Ìo¨\AdoH¯DÝ´ˆŸ„dq³¾?ùy£±ÔÁ9A2mêHÀ‹ Çcщˆ¾‘±C¹v}ÉÊßífÒj{@pI >ó§ÔI a‰íÏ<û!Ë[ŽvîœÛ‹Jù0ª¢o[K-Ö»V#U­ÌöuóóO îýØÐ}´ç®«6´e¯Xµ;ì_§Ç§`žVwÊ¢žÇÉ®>íX¥¯]¸Wz]zv›MŠ[) ÷ayäW˜RN‘’~.‹?ë0ËÏ.Ösd,œòÁ¶TÅ€Ôe-$¶àhëÿ˜Ø&;z7ž‡è#ãÌ4‹¦Ÿ†6Ö»û,5’/|ÊM mÞOÏí2ðéÞLwA#bôıVÈbY™gÖ˜Oæ6D1­0t/˜§ÞF&/^>¹«–èã†^þ:ô¬8?x»ÒZƒˆXßëñ|o0Š©i@ï‹\–z ÕÍÍ1šS Y+M¢n0‚áªLÆŽXv÷2ojJ\BJºÅvëãþ¥ý7ÄÝ775ži®4û!t{OûZrnÄö'ˆž·-lª'Ó†ã7´vÃìµb´f&CëÀ©hÄgœr™Ç ìù°,Ø¢æñ¯3ÊœáÑy3 56Rª±Ó¾’or36§¹5aøkXz“D‡ ÈIŠ”9±’ž—V‡’Nv’–ká¿>Å°T‘$¬'¯yð#ÅvC^ãA­ï}‹3¤Uí «ŽÐz°1L÷ýæ€9ÒÂà2ϦÿëÎŽÀa­+×IE,´ZÉ*?ÛAmCl=»¬E/g ¥Æ tHQd´ÛwïÈô:MKMz>wÇTjÀæ;Äk£ôxÄ£®ÀÄEbù³šÇÃé}†æÄè€ÇŸ©=ù,í»P¹ýx-/¯¥™O41FR§GðjMÂÞ4Óȉ¸ Pƒ»ívcÍ!ŠÎµµ zsGVE$£u±n‘þæ#«ZqM£œWA"òÅæeÍ—›åõdžFo¶ŒcS~hÄ!4Ø­Üé$Øš_îA_³=õ"zÿ´tâ³ endstream endobj 2494 0 obj << /Length1 1612 /Length2 19753 /Length3 0 /Length 20593 /Filter /FlateDecode >> stream xÚ¬·ct¦]°-«c;ol[ÛVÇycÛfÇN:¶mÛê¤cÛ¶sûûö9gŸ±ï¹ÎÝ?ž1žUUkÖ¬šµÖ‹œXQ…^ÈÄÎ(ngëLÏÌÀÄ·°1rq’³³•¥Wš¹þÙáÈÉE†Îv¶¢†Î@€Ð 4°°˜¹¹¹áÈ"vöŽfæÎ*5e jZZºÿ´ü0òøŸž¿;,Ìl\Övö6@[ç¿ÿ×U€@€³9`ja ˆ((jIÉK¨$äÕ@[ £¡5@ÑÅÈÚ ka ´uRLíÖÿ±ÛÙšXüSšÃ_,!'€!ÀÉhlñwÐÝhÿ‹`t´±prúû°p˜9Ú:ÿí³ÀÂÖØÚÅäí¦vÿ²w´ûaó×÷LÑÎÉÙÉØÑÂÞð7«¢¨øðt67tþ'·“Å_7ÀÎôo¤‰±Ë?%ýëû ó×ëlhaëpº;ÿ“Ë0±p²·6ôø›û/˜½£Å¿4\œ,lÍþ“Àhfèhb trú óûŸîüg€ÿ­zC{{kwÛýõ¿8X8;­Mà˜Yþæ4vþ›ÛÌÂŽñŸA‘²5µ03ý‡ÝÄÅþú\Žÿ6ˆêŸ™¡þKÂÐÄÎÖÚ`4…c”·sþ›@õ§2ßÈÿ ÿ·üß"ïÿ?qÿ«FÿÛ!þÿ{žÿ+´¸‹µµ¼¡Íßø ð÷†±Èþ¹c¬ ÿ_á†6Öÿ‡ ÿ5Pø$ÿ?p¤œ ÿ6CÈÖì¯ L Lÿa´p·pš(Z8›L ­ÿvê_»š­ ÐÑÚÂøWÑ›  gfbú/>Us c+ÛZÏþ. ­É%ÿW¤©3 +ÉIÊJÒþ×;õß(Å¿Ú;«zØÿ%ö?J‘³3ù_‹0„…íÜ^ôO = +'€ãoB.ffŸÿC¶a˜ÿs-gèìháÐù[2ó¿…ÿï?WºÿFÌÖØÎäŸYQq6´5ù;^ÿËðÛØÅÑñ¯ªÿžø¿ÿÏõ¿ƒºáVíŒyƒ-Ó2Òk±r†'Euú{™Á‡CìKT óý«ízüÒ·¹+ ÞkB§y>Û<Ní?ö¥iF{1­){R€—yø>¤Ô}ù(œ´Œz%égQ^Wó²[ÚLê;“JÊzÅïPÓ¬Ž0WOÔþ¤®ùþèdöˆ¾Æ©õ±È ¨µ§g‰ÇO”ƒc#ÃC=7}ûx´Ù±°ä¼†X¾É§ÄIÎŽ÷ ÆŸ¯®œn;¼JAÈ•à gI­Q>£ÎDWZCBM^BÃáœùÍ–Øäé³J~ÙƒÎe*9˜,cEyþD‹âMÔÓýL7Sý«ØFXrvêí–GtÝ-#HºL˜3~Žõƒ˜ïî¥ûî‘l{¶M"½‹?9vƒInÚI$yÎ]Ú£­³ýzWAk`ÜŒÄùÃÞ•±ÝÞÉ:®±ö¹Š™K'%ꚶ¼{²ã¨ç«dâžñ×ieè`C€ÞÞìþœ?¾™€ûŽÃK¸tºàCè ¿7DÒÓ’­ÒR¾:;ZüúšÍô …ƒâÐe¨9|çÈN³õ•&¾³eÍb Ó®FZníbå’ºÓ_Ié"¨Õ(aœ­e]·®Gêý:ó’†Í’!zßkàMø’´É/$¦B¸.æ…z.×… „ñW®'X–qcvÅÏôú‹GÕöES™/øóÎ:ùÞ€*½O±Ç‘§¶kè…MŽ§§ñæx¾9–40 J&l}i.­Gú½”ïŒð:ÌÛ/¥)È “f¾%>ßð¨Ìq›*Q8" ¥´ä³Àý }·•&$pïûR,«¾+ éÚøÖ.Ë«ÍÕî•b·Ÿ½:6†©¢î"·™ñÂAû/E~„ØòX…Ôm.b+ÑÀ¯+ÿò‘r9ý©ñsÀ^t-9W}degr‹—!„FÎ/QñÀU£ÁufdÆ—Ë}?ë%‰·l \ìD-€Á*À©²COÿ÷5PÒ|ó6p–íw£ ³VRsrJÄÆÑñÁögæÏTž°JÄžUúƒÖl¯$Ñ*Ñ”šæ”nÄš± OalõºÞöýÒ0Óx²*Ž´&Q½À¡™vyÅ wyeqFN²#JþÃmÄà¼e^Ë(Dš)‚³6_ú¥”æ@#æ?D¿©ãOâÖo×:@(^ò”z!Ìcèz‹ÞÉÕ¥À®~ÇÐ턧Œ¶$æ¶"¨Ú‹YÕD~?‰3²¡WÕ›ˆ~oùý8Σn8΃×~ê5!´Ð{¬¢‘½+€‚ÂÀ<¼µ|rÞjŽG ¿·äyÅšÓ¨vàý„MOT;Äáòí  (ÒÝ6 $ì'½¡kûHœÚªîœÃWSgÉB:?=Ÿ¼HÉšöÖ… Ÿu/~áSÆê"—pë‡ïéb5ãÓ)Š¡Ãð_äsíÁ1Žøù[I«Îa \~í÷±áP¾ýŸ01¿).®ÀbKÙ祺]¾™¾±wš®\J|VT Žo~t—šU™Wx,úFk»ÝÖíݤù€G#2Ÿ'ª¾§LsÉ8y+Óz‹:綘љ;^ÍÌ?«7ÅAÚ$åŒZÏB ¿}&ZBz ŸdnœF5X†ý¢ð¥—œ¬64P!Õ‘1©V)rJÀçþ(²;†” ©4ofÜ¿vqä¦4åàbžl51ê®)4Þ{ºæxünD"Ábxtå,?ÁmÏTl ‚½* Eîi„4Õ‡P„Ë<Šù‚Œù'æØ[á/m™ ³ƒñ{£SüöKJü½í±×ã F@Ú«©PÕ.ûy Ɖ±¯q7‰Ì~»ÌæGиH˜MćMC5Ñ!ÛD*01°¼pôRÔ)0d´FupÓ3µîôXcLʆ–*‘”Þ<×rSÑå•Ø÷Ùv)8a†½8™z<+C3Û[@jf R/49Í­O6ÍÚ(L\Ãæ‡KµoFß D&u¤`ó o»º/\Øÿ»‚¿Þ*M±X!½Àfv‚X©‘çv߀ŒžU¢ì™YŠm†²ÂÆ—Ñ1-æÄÞ™®ØÛ¢4Š8Òûln¹yë~ÛpG Ê@.&˜híµ®!ÿœ¶¶k/¦D„* Š_j‡+ø£CÈþõR}¼$Úë¾Sß´û<KÌ6¯I‚IJ°$«Im£0¢f´ÅÒÚ†Ø%×íÜ.ûñU­a÷d™bÙ“ü`0˜ïƒgýÍòöõ3Â[Fæ{:ƒuyäà˜©¥2"C¶ü{S6½ŠB¬pdNÚaLüzbànXZ°n^u–­P/$§À®(Pž×]J3@"óZ‡›fl[2iEÓìÛÖ¯OzŽØuæwš´õXÒNRÓ¸åÔ]غaˆ0²û*Îp PÁõøxÿÉë˦Õ¬jüUà;†r%é°JªþÅ=ĺØúG_Ø‚7p&Û.Ë$àú‰ÈñK¹´p4=,‡ë(5ÔÅ>XöbYžê¦õÇ‘ž\ošòC£— -QCÒ}éØd¤¿où¯ùåeÌüh¯Í‚B GºÚ<"n³žuE"}œ‡–r1Ý|26`“¾:8´$©®5aÔ*Ð[¿¥ïJSØ = mÈbžåÉYð~"…€íóKÓsf$ƒD?æ¦ ŸÊ!tV\F r}<±i>×-êW ÇW2x4Šr[]ùÏ@ùøîÄT†¶HGØíj‘4³§}_xM(¤Í”ù±ª9Ë‘)%Ú4 í +kæRRU%žÌÖC^ðçÚY‘ß@A»<ö~XÅâ­%?ŒÞEÆóœÛ¨²µüc ÿ–$ªÚ†Á[cȺÓyŽÆótÐÑž†<ˆ|·Ý ø}ÈÁiø(µô`Ìï_¯BüO±v§Xq Ür¥h”ÚÝÌf‡íµŠÓ«GÀ̇bŸ$U{¬Ÿ;óâÁÆJ5ÒV¾3¨Ô+ípfN£{å¸YÉBvݧÙ+ 7«u¦þþóŒqRBÚËåé•ß‚„kž,õi]qÈf¿ˆ-Š:Ž&¶eè¸õQ´úó?K•¤c¥©GÀi¦4L £JY1Qü{¥V)Hò½<¯¨ )k4н.ïÄ,i–i‘ Li˜#+ü¬,+®tÖo’¯4l|òO¥Å‚EÑ5ÁçEÔ!UJfК½^I>Qb²ÂVwä=B¿qâUÓ…Ã…L$ÿîÕÇ£‹©!ýu+ž˜úñó5-»µCˆ6'®OíG÷Cyozò´ˆØá‰TƒKá€äEníPß(l/ªS¦æ–ñpü¦/³eÚLÙ–0Åßt-ƒÝ´!àLÑ€M/äúí3¹;uí"uaªÏ†_Cš6– ¦©ÊS›û =’­s× ËlÁjp—–º¬3¡b‚ÍMȶž¶l#û&”Ç3%/2ò"þ«†@}¶öŽ‰ŒM›»ïPÀí·„^ü„¹ui¦WÕ9ÓŸ²FÌRÅ3!».Nd9ðH0åÒ6"7±&õ;(J¹÷þàžÓ0Š½ãFŸÇFWD’Ñ[0øíU¢Ž2uÙgè˜ö=´:i³iye­ôa% º–e>p‡'L~ÌKÑ …H*ám.IÔ•kˆ€•1Òû™ÛPýäÒwÈdG‘ø|f½Ò^‡ cü)ˆS7ULñú×Ý.‹¡ÿàŒ÷¡  «‘‘ Ä cùr º"x\NŒlG'ÎL,˜=Ñ?«C LOb”~ª"4šæ‰3Ü3-G×ýeCA×ßV­—EL ro5M«&3lfô±U“,çöã3æ“M>”mP¢0ç_¸ß‘J–§T6ë‘æn`’;~^$WF<'[F%êØÆ…M–Â"[ %a±g# Åiu±À|΋ZH¹âã\=-ï½½ˆUIŠïa2™²pÒ_œ>28ÅW‚j;²1]Ê…Ú8˜ʵX"9´´Š$ÄPâ—cXÍÉmçy4¼ÜžñªÒèø¡&òH‰gÄVé™ÀÅ—Udåï¥ЫŒ\78pÐBiòÄ$QxÔxÕ4ŸWô&mŸ›¯ÎAê‹^q‡gâ‘?[…ð__@ <°¢è=âž«>¡äœ1’æÐÄÝ^Üs–ÂÒTئ}Uˆ`Ô”u²Æ S¦è]–;vkiVêAƒä w̬! qøÒʈ ·=Ç;.drišÖÿ¶Kr[k²æ½ŒBM“‚¿à÷ ZYÇeYEhɱÅ2hiåØ]ÉmÊa¦á›…eyw#@¿¾¥ ö8ÂŒe”‡Œu3G©ß¤UѼbÍ3êê’‹‹aeID@Äû˜a?+Ÿ'†Ó÷/Hðz­¢/‘\1Ur‹†?qŒè°oEH4‡„f@ÜÓok]9ã-ðnóÛgܼâb\„È›œ¸üt°žjqë>›æŠ£rÄW ½7AWxøXø)°,ks·ÍˆøÖáœå’¹|‚*âÆxΙªàj'bVLÔè¤8Æ~¬€L¥¡Ï¶]Úº'ÂNÜlõ9èàVYg\(W•f®÷l%Õý#•éUDµ 4ƒÀB9)ª/Bã0‡ ?m´¬ >LaAgÔxÊh'“íYp¦j'#›ûá·««+8*±ª%<Ìz4mÖyÄš’2‹^—"Ù–Gª—ù–kUm?È] ¢åEG‘8d¥@…†k[ÏUñáfÇÀ/]@Æ}¯¬ ³„ä[C¤ ¼m©`,*ÙWÃ`ŠÖÒ\j⶿cgh¯½ah+¯<]¸ÄÅC1dÑÒÑ‚Q2tæ"£“Ì)W·›šÊæ‘Vè×ê 3%Ê"?•IææÛ:V‹½bmíõµoQ[ø̉áyù.lÍ•Œ(–>ÌÞ3÷Ìee5<]l•D¿‹zÃ<€<´Yž) ®—W#¥„^Ô+e—ê_¹‘¹ ìñ¯)ÇAi\c‘¸¦SHŒ­ÅH‚M X¸ÖM òOvjð¾q­ýLî^\OýÓ‚vÞÎ8ZËc~söƒrâ•åªã.z«Ä³ž/¶Áoµ§wÓ/žÖÄðõÙzo»ÇðŠY[¢®Ñý“ªÆ’Í Q¤L¦ÝlŸZUØ‘m‹]<¸AÃ6žù¶V6shh(ÌM„1$mAõêµI‹;ýi>âö6ao刺ïûåT;Ðo:;®Iû[Óé~ÔÑÅaÖ#kð]eÆÍdïgéVtÅÃwèôÅ1!ÓÊÀA JQB60Žþ7ûMš=uÊK% Ï¥÷¶OÝËwÒ_¹ÙVWÕÇNkd S†b@!m&·zx©PõzP&aã«Û[Õœ+)¨¸L<)ˆéEÆ•Þ1§VúEÑž)ŽtÂoVÁÍÈ$š»…šÉ4e*Aô°òy¦Y *Ä, #Ðë‡ß^.³¡æÁU’pè(„ªÜ|ÔyŽRࣱtkêÕœÝ8kéÍ=TFL Çl=?†ýŒ7º×æ#9Q{çäœ}ÒfW“é÷Î2'xЈ‰'ð3è÷w„¼N™™Dšªûp:™4KaÝ…¿ÁÀ??—+Q8Ië`Æ}ã9xC/G:tûwH÷ñM5|¦)ñ‡Í¦Bœôº¼qö]$IeØfjDÌ”ZxãuÓ¡K+ ·Àî®qYÍp°ïùýñK‘FÙ÷‘NøbZ„[ió§‡Ôp Ìî°"³Ãf¸ýœùÁ²Á0tP2k¥4qæ<ÉW³ÆDÿ²k Ü“INCÎÒ3Mï´fÏG¼?ÑÝ–¬R)™NtÎ-,¯Ô_âI×™d†–ç­ØT°p•|Dô™`79ÐVpíX^ÎP:Ój3å02,J(!gëqG•J7 ÖÔ\‚¥}{^~·GÂAM6Y¸šRpOACt}›´¶\4A¡ÒÒÜ›õ¦Œ0˜o‚ŠÙJŸß´Js=WÈGÎZ¯½+ýUš¨O2&ª !‹8Ýï8SµZëý0¥åaÐrYÒ8¡ÒCÏv¢Rám zšh$i¾Ë½Yz/’RQÕ*3ÖÞûµ ŒóM'»ÔKAÀ9ZW]?‚Ö Bij‘Ó×Ø–²¶œ|º:vQ€¤¹÷¤lôÞ°DLR£à"‡¢‚Ð÷¤ º¡'¿‹t[² “Á[šþ†v®)pK19VÕÔ~ œÝnŒXÐg'ãžl¥b7g‡­pë £…쇂ÿR˜ŒvQÃŽú¸\;笟‰]Pbë¦SØ—~ïPó‰1+ŸZ— «•òú ¥(W÷zyyõá•^]pÛÔ&7q¸^Š¥l{¦ÜÙÕF*’F:hò Öœdña1Oï&êf·Rï^E&;Ê  ’*€7>ݯž©DËÄx±í[t†'l’©¸Èî‚«ûε‹üà`PiótµÁŸTð•;Øàð@§ ]õ˨UA²K® U³*ÈÄÉGµ¥>“g]z‘týPxÆ°4ÓÂäá× ‚œ†oScÒÀ$\ZDWnÁ§9‘ÑÍ@Sýmº.ÃÀH· q9‘§~¤bŸ›ÃÐË"Ó[@ô “ÑË->éœÖbÕ6éöŸ¥3¹·x«±œ­gHQq¤bÝwxÊÕôý¤•˜w3å›Ã3f=î¨Ï4Ö, ¶¹¹\ŸFÁ{ýþCh–!¢Á¿›×ÉêÜ ôjBî°™.õW÷nøHÙ·åE˜”^‹œ[ÉR¸;~gNa×pèÀ“4Í|Î4åqˆÍX’:l`“A}u觊üèRë\kp\/uW32ÿ’SHŸeȪ}æàÀ“‡‘]-ú3RᶨH³òüÇ,µÝX|öZûÊqY%¾Hdb“¶:%Nç“sÊ©˜}OÒÉü!q†2Z}vùþ*Çó–ÅÀOñˆZ™‚ÃÃü’H(WþóòäzɽǷW7ýÈpV8öN´¢vœ97…Ò~õßfa‡•"¨2ÂôßçÆÃeMV™ÙÌýëñ+ÙwI›¡­êâÙ}áM æ`ÝcûG˜øâ ^Þ'!lx)T·±nöa¨p6ê\Ác‘_ôqä‹ÔŸ… À‚ˆ‘Áà>ÄécÌ÷«•f½Œ­^æøm;ªíÛÏ9Ǽ8‚c*A<áålº;N~ªu¸æÊ(g}¡Èš¨ÊJ¦\ǧèÖ”#^é…:ÌiÞ3±£ªû|2TŽ˜\WürجÁ Ï®‡F+“¡„2 ù1gˆñYƲ÷,‘À)g–ìn~Ïí_0lqч ,d)Œ AZm‚סÛÆÈpNüh-ƒÑLã80|%¾ñècô:š0>ËÓÐêùf”~ÅÅÞ:O¸ÁÙw›ßÃ×ñ‰ä™f„èÍøcgìÛZ´¾]ÙQ(õÝpcO­ÄX%¶Åê-Û~™No‡Ó5Ǧ«–îLþ±:Icä¹ãÅhIZµÿ<[-a诸X-˜ÌÔˆ‡È ÅBþZø¼OÒ¸ÕÂc=Gv)º³uAžƒÏXhCJ)§mß><¸ ?;fh3‡å´t@(AÑP4x!æ­ÈMSÔƒ|ÒÝÚ;&k¸o´oñsì`îº ®ûKLWY(šÔ/ÿÏ:ÓÂVð–Æ ÈÉŠ«zA ±›/ª\È\2×íDµxflpÈMF“k‡’ŠmÇ«vîˉÁÕ¯o£~6ŽË%Â3ŠNåOI4hžõ·N»¤ñUçY5 1Ã!*Ýúƒ‡ƒ‰v‡ž¡÷ç?n“ò&ü~œ`ùS|”€@Ð=ôTUò{þÁzéifèÒO'·8©^[?¹«x=_\þ<&׺–|J²ðVm…³>#°SZþy}0Î 0⻬&}hS †²3›–:=$ËxÀ–m"0²ºÕÀ½5©m*7Í Ä"Eܬ&Sù»Æîùé/2³Èï,ÞG7*_ˆáp™ÂD|%RÝÈH¤,~¹qd¹¤è $Qeº½ sD¯rÏßIQ: ŒÛƒÏÍD,í`SGsåVa05$‰a1Á#0¨~S&)h!3“n~ëdkuÉ0ÊÚ÷UÞ3M\4È™€ˆ@¾[Cf®MC^;ñ¼X¾Î™Ìã1î ð?PÐ$œÄzj:=}KÄõvåo¯üØ7ˆ3 Xhמœ ¿¨Oîéf滞¢®ŒŸûãì$ì_Uw.C_™¡²ŠÂÖrE1‹¸­r*Ã|Àm-ÐΉ§UGŽ`êrÅ$°MD¼™@oqÑ;bÞk#7’±Ýæ"nÌ8P¢PˆÄ“ŸÄ9†ÚÒ .R²î)`‡{šŠûÞ …3ž<›z‚´ïl:i‘=®¹Ê'‰kX@[Ããú>dvž,sãLïBOí=n ¿L2ðÔdÀô»æä=:QÐIÛ!JHãyž¿'…‰ÎG?o¡k{8JT)8"< ø— iöÒâ ;úvžq+ƒ:W‚ä‘–BÛ}¾2Ýtáyî[Ôä†+³êªàÉÈþTì¦9Âò¥ !×B‘ʪK´ø? îñ'iÛ*ýVL Ïù¹Âlž|õËÒy˜à¹Üc°X€ þ¦š4kS5^¿ÍD5ƒoŠœÅ}•A³ßQsî>ßÀ‹í%ü1tÌ6ߨM˜ýl £u¢TÈ8‚-¨ ;0¦XÔ­R† ³P¥xbƒ7Š@ôc–À£g _«ö&;Ö}ãâø?ø zÎ8Û…ÖÈ5Lh»ì¤Vö<ÈAþ>Ó†÷€¿m¨hD¾ã–évßãí¾Ní=䪘–Èx2þ@˜ïN¯¬½D£ŸTSÄä¼²ÚÏs®™Ä@èq }`XªqŸ]•,²ü)$xö—¶ Ñ+gmxñkyÊÙáôSu„Ø ½)³GyKFœéºìûJ§%ì4ç¬éDH4ês E‘i”èwÉö»¨y™~V/ô…=£Þ(ŸSè —³—ç‹ŽaY•wv¨FêSâ c&„­J– £ÃÝé÷ÒtÊ4¼{gb¶þ€ß›WdYÒF,C5ì$¤ž¡]®nÆjŸlŸ‘“¿èYºa&ÅæW‚ûLã,zbXëðÁÝD´µ¸w|<1õC‚ă†wù­¿ ß(r'•¶ôÅì, oŽ‘ôC\ÝRLÂ(U"¦½ÈD¯³Š)ââÖµØÚÓÔDó I‘ê\"+Ív„óŽ0M–mkÈIZù‰è:ôS¯¥ÈŽ'ÅÅê˜OQ),¯&;'åOx/v¶«}Ã]c,à_s+ÚÓRùjmÊ©Ø”½((ád0Õ¸“ºÆF¨oçõÛñ•à@¾9á¬à•ÿÈìðJ‚´‰{Ô½–•¨˜ïDmk‡' Þ_²Xr*ÛHÌ(l  éh଻£L#<];¯÷„w#û†£5•X,0M]¨Kûm"ùq €XŸ¤6?u_ÑKµÓÁqBe+ͱˆ>æ¢Ë)Æ°¹( de~‚jyx>÷fl¹ìÐHÇÈr]ìÊ{¦¢²!£|óî4lg¤Ñ]ôä¾|pKÕŽO{ qº“ùÅ# é´¿ÑjmO[‚#ÐFOÜá¼Ü!+u{7òÎkÏ;}rä¬_ÌYÆÅúNI=ÂG=wUtJ)—ìD¡ûÕ·Ñ„†¡[õU€7%z^³PͤïÏvÎЇKìmÐ:Eø¨yÅ(CTD •Ñ'M þž³(‹ò€bê| jX„Zu"_‰4ïµ”î‘ÏV¾n…ÿpÌÕæu® E g9^ô‚Α!Ú-ýµDO€;×9Ü@(½Þ²îK\òФß癿í†E…(Ð9^ø…~¨ÕÐ%ؽ¢ v¬Ì Q.®JÃ=Ľ€ÁWiÞ•c»ËÊVzµƒ³‹º_¯üó·äM?ŽFb²ë·š:D\°u«óò¢¨,êƦšÑ“<ƒ¾¯Ê×h’ó{šn¾†¸d‰óý¥¢¨0v»ÄÔwèûGïoúè&u> ê ˆèœ«e0Žì€òD+ Y°ÅC²än›-o(hG33‡÷Lxþ‘ÏÝ6âœcŽ öY.DÅz=¿R®i¿O3Í -©ÝKx íÜþ=<¡JqË&‹æ1ù$7ßä\_ªÚÔ†ùòt’ ]ûÌÉøï ü,çoe”xa¢¨Ó{LGj/"uÂÜ G"æåN]9 Êê÷Ç_’c´,Ì'b²ìò)’ÖPíctÖÁ¿¬ ¸jÉáú¨è;×îÅ‘~>ÿ9@«£ K¢¿$Ì:cˆXS«xåjT2 ÂŽ»sVÓžšÕö-·  tË®†ÙCÞUú·KºQ¡Æˆ¦åUpó­?)ø²¡86CQ™/]ZŸêðËcж®.%(ŽÈ›˜^”*ûÕZ¾ÝÈÜJÃÛ\Ó!§iŪ 3-‹Ìà êh•7 æê÷ékÜôÑÑ¢ªc¯ým qÂ4Ê72™=—#ûŠço³M攬çyÙ§¤¤HOì†7‘ûGªäx:Øà¼Q©òFû!c¡¾G¯ñÃèl­‡{ð4ÔW1S=ñ\]fî@‹­åÏ'×0N?÷Êj{Í/ÏoÊtú€ï²Lq !üí½LÇ!ÂÆê܉…rþ°´ —ñ¤·ðüNîŒNÎÉÂ%§BÆávͼ©sAU%Õ©ºöÉ…–²•B¬oS´JÀ4 ž<-» /ý„Êû(ÍÑ…»/¾ä/ïð!u ,B2vF³RÂÜÅ:Ø2îýtÕòÖ`ßç3Ù‚°ûó=•¼ýêFŸaÎP̽!€ˆÑ̲Õ<ñ]9)Bû¨ŸÞwiäP£Ƽ_o¬lâIAÄÅ%*ƒf{þæŒ24~UÝðÀéÀ_?òÑ>x“ÕÏÓ¶WwM/TïFµ2Ç^Ä( ÷Iá¢-_ºV‰«vÊåz{”HôÒÎƳW×N zU DI¸Š–ÉÆ¢-àÅ”ITšÂ5¶Î…z>öǽSõÂuµméü«ŽYW$ºè\‘N 7ŠÚpd©¢îZÝk¬VîÏë*ÕŠ9ý¯•s=¸iú?=´Ò˜4T)SšÅ Ê‹nûBGHä«k“ ²H†AÂk¾0xph¦ `ày7×»ÈÅ#t¸© Õ($Ü  E.øÊÁTµ¡0šÞsB(àä3šÒƒwejÑOÄÏJ¼‰èùZ¬Ë3o"D, ‡N\Eêg‡Žq ÷¿$œ¸Ï•ö@¦Ÿ(ˆ;:„0ØäR:~' ÄÍ`k€ä^7J Æ0Ý>Ùoª¸BÝçÄ«utÂ[ Ü4Â`t„·}´£œê2R¸[ܶP‘Š²%Ác¨Maéè î+×ìL0CÂí5ïØŸÙû+õú²UÍÏ=Ð&Ww‘4ÖÆ*i¤Ÿ3^؈L¯Gõä£d5<Tr˜›MŒœ,vWO\33W‚øÞð´²ET ¨1‡E÷¶«Ë»Ëãb2@4üâ“Ù€F|ýjxz☪ò ǤÄ)ÐÆ•lM¯¿©P~×þ¨ù}<>®åžü—9>ùݶVE¢Ÿî|ï5[ÉéIt?ï‡Ä)…<6}‰ˆ!„ä«ÐGZ· Ⱥ¾‘yaa°ªÛm øE˜M¿¤V_‹9¢-ŽÝ`„…$þª·Öõ§‘Æü˽϶¡C·ûnÅÞšÿâ/é EPÈ 5/‰çì¯GJ¦xò¤ÌN#ø$mWVSŠÜŠœXÆÊà~p^½IõP æ)=PA}}Vï2*a—q¸Ãe%z´²¢K+¡äÐOƒö§HŒQmPðc4KçIQæ¬xŽ4·Å£¹SÝ´éŽGaD’|~Çó¦§iœ*Ã@ÉûÛv“7Þ¾VÛ)µ?€ÙçjqJ¯ø¶$—Ï+Y@~_NÀü[ûê¹lÁˆ•VZ`91Yºã;´()êÿ®¿¼°y3”%¡kσezyƒ‰+ëšNúLêWYºüZdÌp$¨ÍmU…×w@73”–ý°9dõNr”Ä€ÞL-´6ÌÀ #„K$2 õ¶¢ÕgJ5gÓ·ìZ-&ÓÖÄuÉŠ³š¾}vÏ·ðSªÐÉÉWÓ§GЋóÐÀ«Ï¨U(>Zí±Ÿ1D®ÙÅçË¿GIeB%?_Y11T‰Žeš("IoShð`ÂYEŒUŸ‘'B2ÆfÒù^ó§÷P™Ë@já×Þ`Öø$»7—bÅJ0µÙdd%Û°¦jÞÖÃÛ)ýá³"cç;?Äo¬íQåGè}Î;”0xº)zýQÞËCZŽYu¹Íø U…)y2D’”>VNåx;ðó}º½†µßU®N0?Œ0ÍLß‚>Ïó;ìÛãmDÝñ¼ú¸r~7Ï Ü/ÞUíBÌ2·³`Õ Žsôö+ìb~¢žèî9¡üH”ŒÙ8cdù.è°_a6LQp"BRÚ3ßÀWB7k¹«Å°#¸àF©ïÜíS0u½Oˆá-Š²h©“z7âZ u8î¹ñâ“Rÿ,X[ðÚvç¦Ìx¶$ŒNL]ž^Ýçã@¡E3ÿ²ŸF)<ñ÷9V1Þ"¼šýNÆnáû-ÈêÀº moÿó%Þ÷C˜ï>n_°P¦ÜËîǹæö—-R—Ë‚°í–?;•âò–ÚÑÎ<œT¨2ç9Ô^Æ0Òl×Ñ1öË:iEVv¶§O­Šz{†)Áa¡kcQúa”’ ΕmŸ:¡Ôwk)È—,žŸ¹ÁÄɨ.« +f1ã¬Hãгëê;‚Þ‘ÒÈcô‡|ˆÀB¤Ã"ì~>‡§(ÖçŠr*&©Añ’%ªÕßô›QU<ØáòG¦~ì%î·’bµüGéÝ› þ3ñÈá •‘;㥠ZÊ}J/ ¦3¹xWÏ™ªfÑ”¯Âg´NwÛSJÔ v/I·œÚÖ]¯ec@Ìþ³˜c3›Òh“(“(tÚµy7 )‰+;†KQh£<áAWxÙ?QÉ0Ž¼Ê¬,‡u~Š®Á«K0Ùlö.ü[M&_ß·3…T*wM¿êDL™´oÊŠLéõý\tkèÖ~9xUy›ZOÖmŠìOšë&æœY¢+dΦñ ÞlœÇùºîSÖðH‘"…/¿‰ézÍ@òE9o" ¶eX4]»û€¦àYTÚÙÞ›pâa[¿ýN\Ú˜ïïéÃrœº3Én'ÎLK:몹áôwŽyùébá²YlË1ù"×ÁÐå%vÒà14`w©i>fæ`›’áÁ‡Ò„Tý4B{ƒ+±|ƒWÙ«±™^ãÍBz»”99Ç–ºmÁ33²…bFVštâõ™K·™ŠÚß…æ…ñpêhe³ÿÒQb~ë•81ؘ¹¢5‹;v©BC9Ê,®gïi´L½“ÂïÞ&ãÁ¥5òÕ î¯f/ »²ïႽ+•É—#›|J3vŒ{‘Ô<ú¦nyøŸuN–KH¡_8áešuqõ«~®å ÐæÍO½§Ã]‹|©šÖZÑ–Dfà„'_é…1–g!ÖtÈÇ4†á«y‘ayÙÕb\ÅÃÉâ´Ñ$ïK"Q`}ý)ÔaE¡Ÿ¡pc: M£È #G·Î Ö†Z9bå—à×ùïÁã>ŠžþŽ³ù+|{dè•ç~ðAFr™¼Š§$?QùföI¤À—r å¥Åq¦úÈà=ÝóVÈV–þb] —RëŸx2¶ãÌè¿™¬VÊñØ×ñÎ4É@¿‡Öó# ÷‰®U dÁCFý€Š`E{¬T;¡Ýu~Š ºÂ[óéxY ÖPÿ=€ÔÜðO=5s¾š!Î)¯ Ǹª!&ëg–F\뜮E,ǬäU«±F’tW—ÔÊÉˬûR O÷Põàh‹l¬µ¥’õæh7Ñ‹”ö•êòäì¡Óä€lVQ=À!|Põ*ù$xÞÐ-ó/z-—gzÿ¤×[ëôKé¿Ê—GKau†\Ü#XYÇZÌ£RAµKZÈÝè¯41È6Û+}I Ê×ÊY/\˾€ô§m$RŸlýSq:A‚‰QbƉÓÄÇõ{&ûÉtØöwË)§Áç–…}†?‘V¡ä˜H4›ýG©Ù—¹ áÓÏöªVH‰¸²;ÀØWì§F=´‡Ú+unSd}r„ÏJ|ÒìÙË8‘Þcf¦¯¼A‰+uc©˜Tí¸¿X–è‰ö{ý.J§=­(‚Fk§âÜÙ 4Ó˜b^ãà˜+Wõ?çLJW†®y}H€¢“§ôh»àN¿Kuº\cI¹åFu*¼þÁ‚Æ-’&“Ú—†©ºž@êÆÂs­Mß8 ™`™óD®zòèK28Åjn2O©ï<ÚïZ¬Lù:Œý×'S,hÕ¨þЦÖm‹Û…fÎÇé˜?[¤)äy´êvžvbÍRp±>¦áꌞ±èòlYitÒµàb+n©r6¶ï#°î«NY»ª—å ÷Ç4`uM¨ë`Ž3ô‘.dÜ?Ò••ªX¿Iö8§—~öÄãÅ/o*.™¬çØPãëÌ#OqÁ²¢nRá ÊqŽó૧&¼9ÛKN™4°áì±³õtˆ™EÈ­* ^×½SƒÔOÞ|÷Ã9öñóÄϺ"Û ›¿?«¿œQEýÁ‰Noƒñq¤HÁHÑ0ÂK¶…Õýåø¹YGéÈé’ÍÒ·Žc)Q­_nR¤®ÐZýHcº<Ÿê/fºç1Yt³H»|Å ¾y C[((Ûþú'Ⱥ£èZ-çk5ó ÌëÉ!§ÙÏ۳”ҹSd€@*ùÃÕV „x¢í(Óö›nãuAm’€‰¼}å74{òÿhÿF·êbJUïƒâ˵?eÙ]ªR,WÒÐHàán»–¢î&zó»ƒQÿ5ê“À=L@Ôà°òÌ¿9TtWÆ)ÿswËÍçcý,?û=ŒDdëfÈ3«i1rÎè—2<Î?ÏÄæ D¬å>…é0¦}Å»+¸ÓÞåïFLëG`ªìWñË­Ê_90¼˜SÒúrUºëq;ë…qåb‹àÅ»´ã¼4)6l­óØâ³ñÐè%ÜÝõ#óÅýOÜÁ?3…æg˜›¡)ÏÅo†äÙ$ýfù ÀˆÆ–kÖäÇôf\¯YTî–ÐÃçw-mù¥0á¬Ùad…K_ Ö¬;ÝêïÒέ@âpCäõÛÒ9Ó†•É…"ÎÇù€ä>9œ>kAר¶Â«ò±¶î.é Ç^ã}Íš´<ÐÈÚvuO‚ÜuÔÀä¼;‰¬KJúÄ[Øí·û’à$™îÐG1Åèú­©ÃXítßø¾Ì~&^>×mK­J9•Ú³Z/>½Ò°È™í£»ø+Öp=ŠŒÓkѵé_*If ™(xt”L6ßœ5‡¹Ûfœ7jĽ™Î×Ä¢ö·ªÿ°ÐÔü[Ÿ‹t5½…P[N»)K¶H—ê}r}ÐÜ͆ù`>JQݶ¥)5šõš*¨ìqCM㢽†hj;;[ `ýüN1î8¥µ#«-®ñ<—¿lªÔ8èq‰òöMKç‹(`ŽÆd kMÔëIàòë{‰l–Ï5ø Ó3@Jû³ÿqØ„æR£;Ã7;çݹ{s‘@Šêöð”¦ÖØÑ¢±Ìí% É–~Ä ñ%©5ÅrºÌ-¬±Š[€×!ñ.é)+ew?W<^ièÎç}ßþ±—Ï]Œ¿óÜí^ºÄ£] ÎžAxq™gÚôoFÆã&r(ó>wÜ`{öÇT£{ˆ@YWæ ›ÛÙ'Óâ g»^Ü‹vÉúãET$ñ/{rkÍFRåµ±²:Í¿´ORD|.ë¶@8BîöEIWˆ’Lù燙 nÄi€Ywä²ø óó‚#y-"¶UÁÛÆÂÍíuf×ïÕ5EöERÕ3@d\¡ûz¤eP䲣ƛÚÓã9EZ‚±‘èÆ%l]\Œ¢Ò=‰Ç“ÚˆÝpÇ„Ô'ÈZ»¬Xúb8ò龸˜ }ìÀK&ÉkçmT6Pù*>Øœ-³s„i¿ ŸlG÷Õó”F—QFѲ‘§EbâlV¦´&t½°&@ØX:´<£6ã¿hyç§sB›ê“)¯gÂ?ÔéÇZ‚ORàöTV ~ GNÑôo]áU¿Vkgšq'eÒÝ`ZüQ'¾Þ3†¹öš‡ÅeĦ6ª]Ô«Š'øÙ§¥3L‘”\Q(pÛ%K¤)I™)ƒò*Æ„”|@‡Œ%Ê‹½]߉²„vÏ™~óv>ç9ïÏc/T—&©øÔ¤½D)¥,G±Jò«PpGê4›G]2hòæzNz œ£kþ,ÄWÄ åŽÏXg¢Úâ·eV²Øòiÿ¹] ½°æËEŸ#P§{ü2Ïšo˜E°ñ–§eõŽ5†L¤Hö d—Ûr*Ø´¼Éfù²q,7—M¾µBá•gXm‡¸Œ·HXÍÌ ðq­-­ŒMüË“Y™+V5¦wªºÖ­hŽ†äI‰°()°-Z!ÍÏÿk³â]Þß ¨øq¢%½óJ ËuyHÝ,¸PÏÙwæñúÐXL GJ 5ž`<ˆQV|‘zvXã À1ÁS-Ã8çW…Þ|$É#óú•ò¦žy©?}&ˆì0¸Õ_o2O/7s‘  m;Sž1–PR¶%˜bxÁgÏN,H²æT3ë®w­7‰%† o÷ üïªj¿X1?-†ä¾S R$\‚wpˆn .À¨» ²â/tòõ0Š\¥²bkTVrfê/¸ü¨Ý¿ØpÝøÁeU‰ªÕ}ÉH¤v¾‰ähˬ³\RAñ?_v”4&Å x±#õ¤ÌAŽˆ0vwcW`V”ÞüœÄ2ä¥ïÒ‘ñÚiŒµºçÛaPá¯ÃG”uqË0þÖïrpð:—Ó¸—¬ Œ•wѯR`;Sù”~âÓI·y0‚Â$¿ÇÖøÂíãéiìš2¯ûÕÊø£áa}4¿Õq­ÝeDQJò¦ˆ{Ê÷K%A2k}õIOgzSÞ‚ÔȺVc]§›XçßœO#PœÜ¯Éè$r4(ÒರL8Š&s|q‡Pî×k¹`µq°Ô¿]ÑȨçjÝ8 ©»nÈYYÂ[“²š»Í‘©Ç›õ‘b3W‰ÙcÈ/©×÷sA¸ºh€5¦ÐøZLÔRBb= · ‚„px©ª'ª', ÆO9Äoårqîzw7²[®j=K-a¾ī÷D´öÉëc±P¾” |qò\œE}Ág åΈœ”øŽ‚xt¶XgÞ}Z óSKé¾°l `íi9œÎÆRÿêpÐÛç&ÿákëíÑÐ<0Š2ôIho…hˆ¡x™^epRƯXÆF9æV÷Æ[ÐŒ!É>•GH»#2¶ZûëH|è‰ïîúŸÅ Ew° endstream endobj 2496 0 obj << /Length1 1630 /Length2 13390 /Length3 0 /Length 14235 /Filter /FlateDecode >> stream xÚ­veTœÛ–-A‚{p+ÜÝÝÝ݃îww î ܃»wwwwçܾ}{Ü׿ºûGÕøöšËçÚklrb%UzaS{c „½ˆž™‰ `ikìâ,oo'G¯4wQ4¶±|ìpää¢N@#¥½˜ÈКĀ&37779@ÔÞÁÝÉÒÜ RWѤ¦¥¥û—ä/€±û?‘KgKs;ÅLJ+ÐÆÞÁhúpñ?6T ÀÌÒUTÒ–VPI*¨$v@'#€’ËG)&9K 3`fï°ùÇ`bogjùWiÎ ¾„Fg ‰å‡ÐÍèðDp:ÙZ:;|,æNFv €ì–v&6.¦%ð!7³ÿ;!'û ÛìÙ’½3ÈÙÄÉÒøˆª$&ñš"lgþA =3 Ó?ĖΖn@S%K‰ÀÌÈæ£gËÕíLN6–vÀnÿnë‡Ó¿aj–&Öv‘ÀþhgúïéÐõwòŒ:Âbj:´ÿ݆ý[Séc@jî@À„Ñ”·7ýÏÃ_~DDìÝžôÌzVN''€‹™Ùû¿‰ø·æå@N–n]&&&fÀÇÿ?ÿ:éÿ›q;{Ó¿&Gddgú1lÿ)ø 6qqrúàøïûÿQô?Ï=è4[œ³7á ²JÍHUaåôŠévw2Cô;תýÈ÷ûeßᛶÁ]føRÌP7ÆóÖì>{äðº#C³;؉iCÙ‘ <ËÃ÷&¥îÊG]¥hå¤Ý `üZŒ˜v¬åy>#·©ÃÁ¤±»9ª¬òµèå3ÁX+«Ìù=µ©k¾ß²;$“”šXŒß(u`hUGlj÷w”½Cý}—P];x´Ù±°ä¼FX>߈“@î†N7µ&oPO®œß6y•QÊ!Ž“š¢¼ADçÚ}ÂõžÂýaœù VØäi“ʾٽ RÕL–¡Â`®ä*ÇÏbmÇ2ô«¸iØ@N¦6NhŠN~kÇkõŒg+˲ç %ØÓŠ j–2•ÔâŽ@¡Þ¬lj¢Iì?²Œºk-þ*Q:BAeŒo¶„p˜q½™•e8Gµ›ÄñÞ¡¥žÈ›ŸÑ0·`üntÔ ­²Kê9®–ø0I ^äýBWÊhÊÍا0y.˜° ?Úm¶®!UdžðäQb_#yøüI Rj_ÌEÛŽ³‘÷ %ŸKUlÌïÌ9|ør©õç J¤h¦c»ré|æÃE”]ešrlí0™=éæ爒w¿ ¿½¤›Ra²2í¾€†ps;ó»4£'ɣǦˆ¹ÒÑú»{ÆN#9r´µxÖŠJ’×Vp&'„+gŽ ÄÔIö­¯Z<ä¡À ‘Õ~»‰©\Æ^mÎëE‚?‹¸¸¨¢2ây«£aÜcB¸:ùýò褕â-‡¢ ºwt ëùDî™ñÂ;úÔ>Çë¾|®=¿ö­BŸÖ=3{pöÝùjK›ÞÓUÀS…=‡xDî?3áúíC÷«dÍ þ³0™ÿÏÅ1ñîåöå&÷6û‰OyL⹸IŒ]yß=?óqÄ^Ó^_ò­‹¦×ùlt>þ°Ì>aKÚR›¡Ç&Üúè]0 É@i$vÃ~ëAMxá}ÍD‚õ(S@×*CãÌ£1|Oò{ÍNŽþi›SŠÀéôâØm‰,E®9&v+e(µŸK¬¤F0ÐÚ‘Hà3!—¿¡~'å)ù¹H‚áï>^×xöÇ€oC¢,¡ÅÕC*©ØJ+¯?ôå´H°µûŒ¡@}?qŬ8­h åÃÚÅ!­‚7Rš]äo¬Å6_éÍù¹›DË&fho…w/ÁÚ|¹mˆ"ÇñöfOÃF=ð„m ·ª1ˆOuwÁi’W¥¿Öq½Ùïþv¯ÅŠJýªcK¡»Ë'%Zë5UBæANÄE[LóGá—nr]Žó:††ëÂW+²,FüîÞ°ðÁ[âK±‡c»Sՠ鹿0ÉÝ%9Štñù:ÍÊ»»ŠÌ‡ŸÖÉWN¢w3§ºžB¢10"Á›•ï„¾áU„ŽLâÓ©…l:®ÉäåãÚ¼ pð îÊ·Ç_j4uꮩƒ0&®JÌÛÌñѬù”*ÁK·† \ZÔ1itj{n’”U–õUÏR|(QúØM6*äßOTBøN“Õ¸¦(¶UK_Q¢ßt *lò1ÕÊÇO¼’y®nº.Ha…´D=‡‹±Þ'Œ"¹³(ßVPÁV˜ÐaB8†ÔûìÓktbRËáçÅaç4ÆÁ÷; hÀ#Ku•FÚm jº÷?ºQ>3èüV©…ØÍuÜ“7±¬8ñ<`ON1* »8]JV-,5LU®Ô›» ÏfW³ØAÍÃjçg5õrès¶ÊÁER‰J­òEºrÈ.¬ÉüêŠÃ-pŸœ4¬ýa‹E§* îˆ9iwŽ¥’ÀÉ{ÞÓ3ʪ·SÓôKÌSÝ³æ® ¼›.³¦â‡¥ÃHÂY¼µmŽŸ©€ÿ2"ƒvg»tïùB’Í’U7rXàèpÑI“yIHû,yÏähMh_[]yR¥²ÛìÒr†ì¼š†&c´ÌÔK§—5Îþ‡n Ñ@(•Žß†èŸ @qì̉Èüp5àäçûøÜ?Üq>x®T÷ð*g³á˹$Dâøl0(KdÔã-“YŸ­ŒbâLÖt;Ÿuí;[wF¨<óÈ H è\+ìé~^ÏRô¤´'Gê’ünn™¢$:8r&Ý0%ÚÔ¨ïÂq´r‡±¦pzönÓÈ`ú9ö$"v.‹ªÞ¹©׆鸯 buM<ms»íT^"-­WÃTI¢*ÍŒ¶¦›­ºƒ x…¼x&¡¤ä³ËjcxŸøHú6…–„ ãã(É}‰CÆm,T|?<÷ýq>Z€ÀîêrøuÖšs!Wy¦½ja¢\E‰zF‡bÐzD¥1² Y“?ƒMyø½C•’š‘Â3¤ú‰¤ZòŽTê™—Våf!Ú}µë]:à×¼8Gsó³éI”ÑjbàiÔ|»ÔK´ šé˜M$7ªÐ(ÇP e—eÀr#¸§VwP¾HEÌ(÷­Ó!ˆ;ym nƒLk|Ö1‡jº±­'35±‹f ®™'·æ ¶M¨6q o@è$.×µ}áÍ)$–#fçDߧ |Kbb§³“žOÆÄ"å˜Óa]ï¸÷ôçÄŸBSbJ"ëÛæs°^I"ѤûM'¯Þ÷ÄÊïßÍ¿¤z׿ٟÈD`Ò.¶R ;©¶Djáïkû 8ï³ QXœŽþÉ.í¤pPaPÐö:šWZÎ,²Â¡âG©ºm­º¿Bp 0”…¸a7}Õ}A–Àéjqb5ã|¶%~¥eký ý"ÕiÚK:Èôúe°œ½‘}Ѷnì¶ÄXÓiò°¼8/Çbã&4„U½,QÀÅÞn¡F¤ÂÃ^CJÙÑù]?#ƈä¥÷浂Èb)€§Ab¤àM1À!otè:Áƒd¢¿ß¿òšÑêôÏ­“ÙAM;©¸Ù˜içr´(߯µ„ªÈšâ,MÞªo0JLûËw 0?²sðÛ‰9 îÏ…©aî(ÂÚÁ“0#Èû#r5·–\tšçÞhÔÛé' Êäo£ºHÇ:m9a“mpVlÞ¦î–(F‹£ìê‡q»ü Ò2Ke"χ(UìŒá÷E„ÌóbAfMY=Ò£×Æðƒ7K p…J ¬Œºv´'d®w—•kÜ íÚU±0ËšY<ƒHQëüÁ^‹²¥ûIIæÎ=™7‰-ÐBýreB}mÅkË ×˜òΡýþg¥)}»â®¶d¬0i&F÷ñHt×w¡?ÍCÕ]íI5ÓÊ]oE]æ.´1úçtBø·xt_éÍ’¾F1i›y”©½¯BŸg”âôJf’6 A® Øþ zHn}µÉPÑyW,-g0QÙÉÉ.·×Í=ÜÞïüGWÈAª÷Ó<½` yò‰¿?ÝkY¯æò —„êG|¡ß‰ä#<ˆ+zeÔnK‘÷žèð½¸o]•)µªK ŒÓÖ|ûŠ´nÖE —–ôÅÞ¬¹¯£PøG<Î’°t­` „†ñÎ/-MºNÝÛeFÔ_°â4Ù€nrXJ}«zÎô£@ãD¦°Y! JÆwb`wÅ­ Ã¥ªºá¥$ö¯¤ £ÇŸOÉ¡+1â†u¢±Môp¯:1Kþ\µÖÏðj})à"&Øv Œ‰ÕX|í¤ xŸ‰,wí¥.Žà±o¼ðù ¿J†›N Ç26ènš;Eâ=ü’QZt‡ªðÓ¢3”+Á5Ì–Eð'°B¬ž=BpßmE4ùǸÕÉ©1èÀ‘&‡^ ¤ñÖJJ-S‚P>¥í«’n³ÿ&¾„ßåy: ­Ø¿q—¿ªÖþ¡`É ®-Œ9Ù#åȞ%ºfX°ÏÞ³ÌU[Œ G{„ÄðÕÜPJq†í1S7W ÒÕJ‘g¯J‘J¤lõO•¶L«ÇôŸ…îO|$—‚Ú Äò‰Ø«º[6:Z÷àqX¬ŽfQµò[Ȇ6Þm ø·×®n©©ÆfÙñfcj¢äŸ ŽäÝ],\ñÛä×û‹ëOóB4HûêÜÊ…™w‡K9D°òžÔcÏ/¤ô*㌽‡zwÔ´ø˜šiyV!P饅1¿ñêý$@ø¡u4uáÅØC»ÐŸU´€dcõ©ÒWÙ7dªî-ƒùw8ƒá6V;3L·°£H5§òÜt!ã ¢Iž*Dÿ)M‰ù}©cuOÁ/z„•@·FÖš?ºóƒËê4 |Y\LH¸HöeùMSÉïÇwI¯4Çb˜äOYÎ'æuT¬ÂËCsSµ~­Äa».!=¥.ÖZ˜±9Ïš£Ž)òßyÀpýdTIíκ×sÂV{!ÌòŽæÕi@5ßÊÖ*nž€âT×ëíó.lìf›-©°Šr‹Ì¾‹(k®_J“éÉ3,³åÝÔPÚEóZÛ“/GƒšÙ+Nø‚‘ª+I,-.,ß7©ÛêÇšM úËÕΆg>ñ±Õ'U£M›‰A>MŸ Vëõ6Öt¼-£·›Ngó?‚ ÷‘ô´áÉZ1T€[G ð¬“y4œ<;<,&߸ŒHNi—Cþœiú'¸‰´IÜÓȲÊCa«Â /9CøëH‡A-›«çñȨ'å¢Q dþ™§Ø|¬NoëW%¯œ]à(žjM^oC 3©”ùBr9l6ß8Â2J¸À#ˆ“Òõ«3šºa†RÒçbVcå]ÏÊýÅbsÏõ-¶Ï}úÓO1Ö YiªV•ƒ–û_4F¯rWæ!tD_®Í&!µª {]êdnƒþìâEEöõ”kÖÊOöºþªOݦá¥÷E ²JH_ e¾_ˆúA#·yã ï •ŒóæàJWï/JaO²bÚMŸ6H‘fÇ=ù‰—9þûlñÞ·Êb’¬ÏÖ,ãõbCrjS›ñŸâÁÓŠ¤ÙÎÚ%ºv€n^:¨|á¹yOà ¸bu,–ö~$Eæ3)_D¨ì¹S…ã1bÚ ‚óÒòÉ«1ÛñۉΘ›óÐsSO&°R=4Oœw+ tö fK¾Àë½Uf"6¨poÎ…®¨";n7ŸÁÃ…1b‹xl9¨FÆûR!¨óRTqË bzt´ÈM‡ÒزW4 w-íÑ+7w'S-Ë‹3ïH%Á—¤y¬ÈŸúgÕëR#{Ô®ÓŠ­¼kDùà›¤Ê3Ïó e¬ì02ál§–VažMþ¢ùDÚE®ŠMÄÉÐf2ÂKvÆ6"Šõ$†hÁ5Œ‘znè¹I`ˆ::nÒ•êb¶~w¤™¥þM(•0“—âxSp¯ÏŽÖ†æm‭œbv]jYfcAhZ¦z9ùjo*tE†¡è1³0À©3éýÙž§Ðþê«Qáj𷇩ڴ5O©ÖÏ¥„g$­þfŸD#ðLÉ@+ëÝóH¯ë±Î•«±ì›7TËû "®&’ ð‚›¡Ä,!Û¥êÔ]P¤Fk\HU‹·R§3«q '_Å?¹ç5-ÅØã;¶¾RVàæ±6xÊeu9§˜¯}W±µ*ŸÄ]ƒ#(ÄZ,¦ˆçlFÈy,©‹ Ç Fæ_DŽ›Æú[VÀœŸ¡ë÷ã©Æñ ¸«Û—ìÌì½üp0§ýrŠrƒP–%Ï’ 8Ææ  ”ªZñS¨OÊH¿÷CŸ–!ïs_L„‘³ì] ’¤È'yØ·DIª<¨ßïMcJ#Ÿ:¦ïmYÕÂÓ—0Y¥^©9j Z€†tðTÕ~[9û*Ó¤VR(mVÓÚéàc]ËÃñ,ù¹çNfv¨æ;è§â¸wᦖQ~²à”o­'ÌÓ ¦Ð@Ú‰ûsKB¾;pPØžA9tΊýç< ?â;ëŒÿ¹W´w¬JK_ ~œêwÅO'ýÇíqœž Cò7+³ø/b랢ż—6•BÜ ³‹â¬puÕ ÚÝ„=ƒJ€…‚i¤¹÷\õÈÍ;¢3÷3B5H!=³(,å8É<1¿œ©4ª7û’Ïö眽ó'ÊᨄßîàÅ•ü[ôòï·îß©W2‡–°• ™WDÀ¢9¤º™—övPζ3æË„u!d5|9^øœºZóž×âú›Žfì÷·mx8¿þÚ^í}Ž•h{®¯&& :‚¾J‡é‘B3Ûó5 ÛâXMGæÛ›Ÿ‹ í'´LÏbÚÏxl€Ä«³±ÞÈîY®ï0WØoÿç€eI{j¼ñ²Úç‹õ[‹‹°oKì€-s‘q}3x1d@„#Á;‹¤›Qgüä=ñûªÖ//9¶YUêÏ"èÍ>¬å@†ž™ßï ÞËÅnâFG¡˜ÃÆŠ~_‹«èVÅx¸L_c·C¿EUê¥hö3Çi£þ,½W.“æ½÷É ¢@4KmÇS^P`ÖÑoÙÞ(¨ç¬´àËö.šýjJþ?–8´¶÷¹ñ³T¢¬õ@øßI뛫ÅÛmÃÒÉ”’¿TLÀ[|GgÌÆç%Nq&ÔF èhoƒâöCOì‡|þî奋óú9¸Ï¥nH-ÐÓ¨éU»üçVCŽjQË”1Ç\ƒïîfœóF}ë‹öº-‚8æ¶Õ¨Âg ÍeÉÓÜ!“3»º#²|\áü,A?63{†ßkíU#kζ}pÊ?‡Ø sµ'„è¿šní`õ7ÈC®›ÏAÑP@_j½ï`üyõvÌ"Rëþ´sGéŸ#¹““'ÀL·Ôe“kV™!0P“ãJ„Óý{ÈÓg¬8úÝ0Yy«F”®Ö¡L¨YÏ$–±$-{㈩ªk·ùòÍÊ Ë„0Ùa™ø)XŒE¡˜‘e2ƒ3½“¶“CnGßâpÛ‡¹µ×΄ú.ËS$ÍZ5c÷„U#Hr‡Ì[æiÑé¼b=”ƃš›K ‘<Èï¨gÅírUm7C1÷;÷¶ë• ‹©\']¤Î|È.6Æãe¿Ìa0<Ç¥~þoö¦ ‰g~b6±pZ3B„{¨Ö-ôïÞÔAÎçøðµnK† ,ƒíŒ·!èþѶøŒ‹ÌEÝ%øÅóA¿;ø¼ü΀`e¾;ªÆ8lêÕ q†¾#ù£Æþ»yÛE›»{¿ßSv=Jg/1ÑÊJ<c”^Ÿ[Z vÝzgÍ5dâBBö¤@E¿xtF½x¿* <*Ý!íC3¦~_[ŽC«qTt}ZÒ'ˆ¹†öšfvá3•ÁÔ:ïÌb¸Aâ>Eâ’ÏÏŽ#‘K3炧ŭ °ø~HÛš@”o^‰µ³œ¢ã´ŽcÄî-ò@yRåð<‰ÚÝòõ$;x/Á‹§(XÁaDå?âs_ ,Æd”>3Iù¦2•M‚ˆ]ÌDQiöå„ïËT™+º¯:)†D¢‚ ¾KÍ=9V{Ý Øä}&zÚ‚ ËãËýFjBNõ±×ø‰©ÃL$Yþ'½.‰X@ Ï{G«Ge•6Î7º ¾t£º ËæKõùãÞ¢Ãu8+Ê$˜â½sû9_ÊÞSð²ÎBIJ¿Îm[}#‰„aðp7Ì5¬¹ŸWènŽyhEœúl Ï gÁ7÷âÇ /bS~?íÍÜ·ã‘ø!âR¶p¾ µ¹·­YZ~v‹ÅGïÛúžz}Íý²ô_júC™–¶ ŸÂ=ߥR¬Ü\ÕæÑe/Ö.;£mÌ+húá÷F».HˆYŽ$´¼]üxšàL­|¢bá(Ûúêê[ÜÛ$À©8Ö·¼¼)Ç$§u¸¹ÉŒEƳŽ‡à¬$:y:QøIiRZüÑD»‹ °-ŠµÝe&q,1¼ ™–ø4‡êb¾ãû uP“¿à•ûùZíNŒN`]Á€¬Ì!Üߊ@}¨ªxµ†h&wàþHÊöc©’žk Ù…bãM ÊÐÒ.´ÍÓ'ÎVqÿñ-[î$»´²¹+ ;Wppúf}ZDÎ-îÆݨÔOtŠ¨_Ùù Úÿ˜ÊE]•®¹£š½˜Öl ìÅGŒfÇ?dÓÁŠHZGì=n5:Óp€%r{@žC5Dâs \9`¸ý~YLDø‘Ž¯,±~JPÐZS¿¹Í;û- œÜû¶w«ôÈMA³ÆãYέ/%ã&¥gÿܜѸH‘-·ì›°Á„aãQ„z*~[øzݺž‹>”׃”u­©’•Ö†ajÚRü½yþ°ÏKvÊ¢i"$S< Ý=Uí‡gº½ñìÏ‹v?¢bn&„cD=}ÿtÒ’²–¤ðÐë›bá“È«}+Ñgt1 Û}Gš®§×kì]~2h?nHdùE)¬G0ûëKôÏ“¥{Œõ0L…îOxÊ™HV„Ô2šUö½” ¹VR$ 0Œ{¿pBžA,¡ LsoP¿Æ¬œ¬[ãSùþv½Yï¢Úð %OXs$Ò­¹…ÂUwFfÖ8ìÂÂìCʯDPö!¤- »6ó©Âdza´Ö ‰Œ=<×r./¸ ¤Ã¶–«{?ÉvòrvCÓÊM(§|2‰—ªô6ÄyÁ$)I‰(~ïì1!lˆ)‰¶Ö–#Ü?gÛß(T=ÅÇtÍ­™1¶Iñ݉Jii°}3ž_¿‚gŸ¦Ç$¾tQPLõ°O8qí%œ ÿL‰P>Ç5Ô¿Z_£ÃämëIÅ÷ñý5w¹ñ%èŽ×ì¸&ÕÑô“8ƒCOhÀ eWfQbÏ~®ž–6Á³ ¦Ö©”ç¹GHŸeX>¥L†19Ê{#;}‰ÞT›aÛ{¬¡Ï1‹™Õ¯"â†=Ô÷¯þËôé%ÝË*»*¿òs%‡"ðKa5æwíؾ-ÄâVLyáÑ:©is¦nk²û­tóñK›à&k…¶ :ŸÝÒŸšBX›kðšSZŽÛï‘´ˆq=SŸM'?$G&\s¢D*¤ŒÑò>ÇÍ»« öSÊú?QàÝÜØáAä5+bÊzç#ÏO½'¼@VÓƒ&mýªûÜãÜ~—^ ¬˽ŽMÚœ^G–¶+º^˜Œ·¤)ÆlŸ{¡÷Ä\°4>z›Œà„fên™bJJg.OÂ<¦û^*OÿÙti2ˆHÐÅz§A)œ=-ÍÇRÐòFöã5Z¡ib%_Ǥ[éÞGÉ/)ôøÒxE¥™J£lh‰aÔ…‡nýØbÎ.íe4»Œ¤Ç´ûcÒ‡˜ð}Ÿ·õ1q‘Œ>…^ÜœRåÙtAÇê ½§a}¿šæ¬»|C®rÙÁ¿Ý rÙк7æÖn³Ç.L¼7¿ÉoT•{ôÒ›ݾo« þzò߆£&sT#iãpŸ —¦5kilG3v‘y‘|úÂx ØPG*$ä–"&´²ºúzòÆÁj!·týIî"(“uZ Õ'‚ 5=öÛA÷ñ‰=œ x†âw~c=ãb|öPζ1–nùA«ƒò/ÒÂ=#Ó[_J¿´Å÷[ÓØ7ˆœfðîœç“ºqY¡¿Á~ñ3D[!5¬I‚³gd{2†'*>óEy…”LàØÛÀM\ÇîNâJVw<µÃŒ.Hmy°§ ¡k¤«Á¿ê2? `§iñ6 y½µú Õ¢è\‡-㈻”q®žÓZÝj=÷g¿°–‘5ˆ5z-Ô‰uö”ã’ñÃÊÒÌ“`ŸyIÿ¸àr/D¯Ð(¾ÍøÊhÓrPòßÎ_O^6…“ šê¡³¸bìÛGÊ4îBçŒ7+ ý <36jU€ m,ÚÙαÔÆÞ°^’g¶U*\)1sžƒ–•v9'F»,KÓ}Øuêàº+¼¢#µ5Öi€b,ûc”·©SÚ”¤Cùæ>AêåWÌ\|õjÌ€Û ÐÀïD 9y¢•0ñôýÍì5‘ÕÔnÚÜWB*©Â$<ÅbÀ’Lm‡YïïT´0~FÆ^bòKúÖ­CY‘ÀL¦ÍVÍ+!½µí,aÏ=w¸Qo&¹TÈá+…aàbþ9ÇSÐÙÕïŽøÄC$áëϽ%jsáb&°ZœÕ£z¡b9¸K‘*ðÍçsÈYp£öAä΃eF!#…öAòc.~•ö£=±›úõ·<-()îtÀ{ŠÈ!ÿDQ⢛ºGdŸô‹‡žÙèÞ öʵýƒA$¨žî;ДfòÃ~µ8:ß©Cˆ~½ú´–UGú”Æ¡× p 3”e‹Nv1…:ßùb=Æ Ý/Š¢³8(m ¯ê´8[N„Ϫ û) T»õÊ©Âk6ÍVQ^£¡Ra&ÇÚ×Í:¹úÞgH æ¢ô†^9]†ìHmçE‰Á¶põ‹Ñ2ÒHƒ³ç[Ò·3·)ê|³`¡þªÏ¢¨¿X½vaÔø œø¶ãbF Û7­ ørØô†0ï¤ÓX?€sßµKÎœàQ>ÝÁtù}õWÞ‰øc`×{C¿ˆ«% oÄéC÷‚8êÉÔ6ÌhkÍX)YzW“ÆnOΞZ“È;ƒFŠÐ…7NÒvöáœ2¾ñ‹¯&í¦HlÒ ªý`,®Œ¨ýd3Ëwܬ.WÁct|Ù&¨€ ºShdÐôÒ=ÚáÐÆ}ß¹P®(ŸÐ¯¶]ŒíƒŠ;ͱìªú2+'õ|E@ÜË‚ðç2õ°j[ûìœ0!Ó'>ÿ—ƒÅ^úÄå :,ÉEÝTðݩ˺q­¾ý-\œK:3½­¾ ¼4áÁ£$9©xYym F^RKÃ7Èœ}ßnnÛÜ$»1ÖÈ»7¶´aqœþâÄɼ ^–3¹OcE€ó #/+ÉRRŸõÞ+«XýÔ5°{?ý­×ó‘™­Mù ™bjá¦iéϧ·ã[ÑWÝYV9èŸ0-‘c˜ÔóÜ|É^.Böz¦Ô²Ald‘#¥}ê…Hà0†Ü}±±áyǯlyä˜êðÕ±”á~µ…LH—ìXìtÜIs•¼9süQ7­ÂãìÆùím ͪßWb¯š,:œÞÒ¥Žå¥ÏE=VZ?=?–4t~–ç@GÒ¾w*± »ëÛHT=-­%žî$ÑvÖ3dÁpÚ"8©ú-¢åzz–3ðÄ"沞ÎÄ Âyeã¯H s·Ú >qôªR²œ»™(\N¤`UÞ4!–ÉR8¼øÑ\¤Ü0¼ê[Ò>~²žg«žBѧ°Ç¥ÏjGxF¹{Ä@ÿÔ›UŽí&ÚϬ 0?F&î9H[œÃ×s€óa¥V*æ]ô"¥ýE½"óÍàW¦ÐÕp6™u#HUŽˆcѸ A­™Ýç6àê¡Áã]Y‘ Y+RÏ›åU>ý¤™4Sé‚a†=òþ§w=¯ÓTáT:"¢~·c¸Rë×åB‚…~iKÒ/î‚,2§{cÆ<|ý£Ë3·RÎ]ßó ƒNæ¢'T`O4JÀv!Û&·ª~þr67æL"BH¾Ò¼rÅVb SV¹H!ßiFc=Žg}–¶øS*·šÃú›IAºÛ ³Z2€I=5@‘¨yŒ²½»¼GÎØ’­]¤”w ¦ ýó­ûL’×.z=‹LTB jLˆ?Jøš„̓1(­Ù—MæyÁâ¶æcÒ58ŽÍ Qžà{ÐÖäjï/,Ò¤"RÁtÑ«ß ‚ƒFºr²5… ’ ùàÛÖh§Ö Å‹QkDW+èÎq!úò¯EäÛ-Pþ°€HƒÍåh,qr&ù%Ñj! öCu˜Å6ÞÝ7av·Ï·¢¬r(³Ú»ì.éP€ugË@ï<§¾ õEFï‰|kÝæÑ·ªGõZ)Q LOç”ÇUÔ'7œÇøRò^îyÉצS=«Ÿ‚e¬?¡í¾PÚÐS¢tGRX9ð÷\^àÕ‘¼ßY]°oᢨ측>§à'¡Ñ4:{§s®²œô8ãifÿä/]C§J vX°Æ3¥l÷lüW20èà+qÎ$_ÏÙ¢ÏQ^:½ ½êÿ%Š³¹WÝ´£##ÈÈrtÍ`»YjÉ~Q¹PVŸáq}Òƒ}&€¦!‚… GHö ±`1u¦ì5¢küs+hû“/–•vÈɃõ»OËPš]`UQÓ , E ‡#ÍÖãRèóÁä þV ž>y0òàEDå:l’ÿuF­|˜Œß¸Róä†3 ÿñ d6Gcÿþùjš}+—µ ªgÀ•[ë‚kù°㦅ýk[;¼#(Ý‚ª2¸Ë¶}zud“tŠ­7,)¨ò.”÷lŠÚVòn×ò7熑$¬Gj8Š8ú1™6a6ç-EV6,·‚‘ñ]€ÓiZa7wÓpãÍ?&Æ÷æIq¬‘§ªê83ªo¼þl0âŠÚYž¹åš6Æ~§Â2\¯ž§ãçÎ#k8”öœ‚oüfÞ^âQ…_„Ûú\Ä×Rí±0|‰5¢øZô^;qc&Ó!ag¥ k0WË…ÁóxB£±’Õþz>Äœ«¼‡@Ž›µìØ öÕ;å(èÙ†RÙ6¥|˜KíOôXÏFí'c¹Ö†˜‚­ !©M; ºùúÆÔ4«2…Ì€PþÕ¶39'>—ø –Ü3Ìq»ž¢íJãxÖ0}ü^_á“D½uÞ¿ùO¨Š‡WvañòàáçrT!_•UVW`}2IUu[ß'c¨Ô•íÖTkøR%¤å¸ÃÕ½)3縃ßqÕŒ¤?§CÚ:a§âl›HX¸ œs*äNÞ‚qäBÌwS‹+RtJŠäASªJœéÀ~ûÖ¼ëqUæbjz¾yŸn‚ÐîÎç¢!àõ:#µóÜ2_€&÷œê»+±ù !ðÝ[K”¤1ÆZÍ ¦*˜Qh5F¹ÙyÿL¯/óbÜz%Ck?6I7L¾g>€,ð—ÆÜËžgÿgîëSꊉšAl‘ÅP™¦ÐM<æji…vÑñÕLÛ¤c ¢¼%¿¨Åüï®m¹ò¬<µ};/?"öêZØŠÓÍ,pgÁÒ;ð è™ïXàZCÒÎ1$ÇÆHr²iVQµN ŸZt/Õg¸Ú!%ÑMY9§öWÛrTwG˜S˜Q$çyi+:S±>w$'r¥*¶ØÉm¿ŒëIy ¹=H7 €ŽrTrÞ8K%<Áí¨4 )]†k¯´¦Ø³ €ÉCÑ–ÄÈ ¬„' øxsf íÊú ²Sàp‡¬V÷¿JËï“A”›õm„ü²õÌý°D* %>×G˜‚5 Ób]„ôQ‘-˜Mk…]~ã˲5µ…lá‹+ÔÈþt-Z+÷ö• ¹™7"XÖçY/«F4TëýgÛµlQПÖiÕêS}èøzº<óâNS»ñì3)h—Ë€@5»^o9DX0÷§-*.ؤ6Ág1p’vb„kqÜ]«wõJq¡@†º°<ïž´æâÏ:¸âÁq FYcJÙâóž ±_ŽÐÔ?aþ'•7µŸªÃÑEõ)8o¶Ú¹ª\š"…¤—I°@IÙJ46þ] L+†CuU Z„+·=gÿmÊQS°Y´®ÝA¦*-C|»·°"<\©–Ó–šì¨%• 9êºNÊPQÓÛ‰cêÐÿ@i;¤sŠ©Ñ´Ö‘>¹YEtOR…B=u5\•e¡¿ ®_ú ˜¯ cùl™ýõ>f$n×í @9íéHÊè?ß:âæÕ÷{¿'É®÷ȼºè@còÉ ç¥…µ¯ˆ!6‰ˆc›dyÙ)Ñ:gøÝ L{Ððó{^Ê–û6f×-Š!Õ¤ ìj†–‚¶¹nááõ8µsèWK;÷µY!²>˜)ÏÆí€ÆP6_F¥!>A»Šz{ÕM¯êeÿOçØ?ë¡Øä…û[ç´Ð… 4&'œ°X~I÷OÅaεFrp$îR@þ'Å“)]ó˜ã¤Þ™Ûx¹$ÓêÈ_;:œ4’LÇà•Ü;ãõgNTe.ÇoÝ´I%JA,L%÷’FI–T‡ø¥7œû5˜]º~™ê ¸bJGnÔIŽÛc`åá\É–8lÐØjV¶7³ßÿª;T†蚆6„çøS%F6˨«/õKÂ5u¬¬‡Z¦¤ 56¤ú˜4 Bv„f>Ç^Ʀ-,ÕŽ<„ëBn×O"—Qù6#W:®?&HÂäeôn^׺€ƒ¾6”ñeq4ùöÝ{ú.&ź¶FéºÎ˜/až¡Úçæ™”n­÷×þ¯ F#Áù*/×æºÖÇ¢Åw]Ì;âûyXîµÃ5ñ9z†99Ž˜«ŸC•3M–„…SŸöĤªÅYäÛù̾é+â\Ãø±!߀‰ËÖÆÞY-Ì{"ݶÄ¥¤ºdr,ÕTÜ¡@‰Ðñ½…• J§‡c +Œ‚gßLHoÜù#t‡BD¼”:‘õóÝGjSÙ¦tV óöši~6#º¥e梥¡å5;‰+|FÂb®D%o»ºÁQ»é§…aÉûe½•?ç²2­uŽ§â™ˆR×Þz•;w€—±Žú%4™Å±óv$€–H?Sã7%d‡áiý€¥±eQºïZXV¼Üf "³ùd¢ŠecË,¼ìüMT±I0÷Ì×â…üAdÄÞßw|C lý,âzénœ2¨Ð\´SÑZáCÎmch°µ*+ÝÒ}K…çSýVŒ‰?$‘ ½ü{Î$kñÆt =~d±¨PgÓ¥ð Oü68,boÿ”* XêÐÝ?šE¿í(÷&î¿Þwe[!븊~<Ö1‡ÙÏò5ˆ­‰'„>àÞüáìé3±îÁ´»ˆ}bì…€©Ãs²Kž‚æJ“üÕi-åtlf?°Ü™çsõKO²„ƒäüàSÆÁ¹3ïðÿî廵 |Á\›1èm‡âÔ­ªá¹®a¸Ê7RŠìÅ~,ôyá–=ú!À½_ˆ€àW~ÛTJø4L·µ”?€¢Y:j*c.1îçþ¯û:Á endstream endobj 2498 0 obj << /Length1 1608 /Length2 12515 /Length3 0 /Length 13349 /Filter /FlateDecode >> stream xÚ­veTœÝ’5Np‡`¡q .ÁÝÝÝ¡î\ƒ[p îîîîîîÁíã}ïÌÜY÷›_3÷G¯õœª:»vÕ®S«É‰”éMlŒ€b6ÖŽtLôŒ\9•‘“ƒ²¡µ ¥ àÃÈON.l4tÙX‹:¹ê@€ÐÀÌ `âää„'ÛغكÌÌTªJêÔ´´_ÿiù+`äöŸž› 3kÅLJ3ÐÒÆÖ híøñ¿¾¨ ÍS% ,¯ ))' —Sˆ­ö†–'#K1@d ´vRLmì–ÿ8Œm¬M@•æ@ÿ%è08ØA×€®Æ@Û¿\_¶@{+ƒÃÇ7ä0³7´vüè£ dmlédò»©Íß„lím>"¬>|` 6ŽÆö [GÀGV±ðt47tü+·èà °1ýˆ4±1vú«¤¿}0^GCµÀèêøW.# Àä`kièö‘ûÌÖô7 'µÙ?|ØÍ íM,0ØuçŸuþ[õ†¶¶–n߶ù;ê¿8€€–¦ôðLÌ9?r›¬áþIkSã?ì&N¶ÿésÚÿÝ ª¿f†úƒ„¡‰µ¥Àh Ï gãø‘@õ¿S™þß'ò¿Aâ‹Àÿyÿoâþ«Fÿíÿ_ßó¿B‹9YZÊZ} À? àcÃ8dí˜ÿ/ÖÐ déö?Dÿk :ð ÿ'IGÃ6Z›}HÁHÏø#ÈA ä 4Q9›L -?zô·]ÕÚho ²~hùwtLllÿâS1[XÿÕtvο]@k“eþ!Ïß¼Ô¤¥…$¥iÿu›þ¥ð¡º£Š›í±ÿ¨CÖÆä¿a Ù¸<蘾±èX¿}<6F'+§çÿïo ¦že íA®í¢™þ.ý?~ÿ<éþ Œ¨µ±É_s¢ìhhmò1ZÿeøËmìdoÿ¡è߯ý£äÿ<ÿ=ä@ +Ð~iÞƘ;à{Rj²c%Nfÿ¨ˆvw'd mAJîoŸr›ï¤M΃—Š@úÚq®·&·¹cÛ×])š½ÁNlKÊŽày6')u×o´5Š–o´{~ zHÉ'êá³2PZìŒj{[£ŠJzù/0„ã-,öŸ.î©}Hû`’ÝÙ"{'VGaµ¢Ö‚¡WæŸPÄÞßQö ô÷u\AwíâÓfDÁ‘sâxý:&Žwt3°ÿScüêBWΕ8FlÜ=CÿXA†ÐIµ'ˆ/@h~®›Ä˲j\¿ì5+|€w$Åž¿ÖÌÐ*¨–Ÿ F¼—'â^è§É÷õ H³þöðïÓ¬äñ^ß{™“YH_œáÌT5ÊÅp_š=t²/¬Þd3.ÙltÕ'ùèPDÒ M_];ÁªLL³I«Þ »[7Ð5LF <5®âÇJ{zYZ ØÅ•fE`h’Æ4EÑýJsUkp¢©³¾QÎNÓÓ[¢YÓfˆLìù}6gìO&ЀÎBŸG• écG×tÌ¡†aø#"¹q„Ê™‰ÏÑ#nKbNÝ:?òÍpc~aÈÙ^ 5ŧÚÀC _áb_33Cˆèký‘°;ŸÿeÅŻǺ1‹¿p~ ÁeÄpñsØ8¨p×#OÏæçŠ&â ê[µ‡9i(@Éé@ÓÄóFjPWÁ?\…n)Õn³¢¿—‘Ç„"ͬâ[PÏ«6’ÖÉyH¨,âAiï’×òÞƒ!ø¡P1þè¿{gÈÍújuÞ,S9ž «É_Ò5ØŒ&¹D Ä †'”1.Ð0…à n¶”ùýXÒƒJDªÙ~×Õ§¡Ì2 S4âÆkè'îdkü.Ø÷²õîX #Øey1žÛá³E—ä3L30R›z'Úõv=Iú Ž«fÁ ™!PtÈ:©×Ë;ê3øH¦¼Øùn\¦—ÇFÅvèéÒ]£’äíØL$¿/kU‘IÁ#^‘\›íˬ£“B¡½Bñ8ã­{Ò'÷wrgÃÁ I¨iaº3f <«ÑðikqÆÞò±.ØÈç Ëi§ZŠ–a:Ä6¡TKaN¢¾ØÌá#žÄ!õãý-+®°ìóvÔ]î™ ÊêkyØ^½µnÔxº-°2µ¶ã›ÒsTæÂZiˆ}ÈOqçŒ ñ¨Ì-•² {Â1ƒ?VS<Å…žÜWsUdß)æ Ý–¡@]?|B¾sÌš5,å+ë'·;¬ìßn)Bòs‚F)N¾ÁYžMíø¤™ŠtÌÛÿ.g&ÿÅ»•;†é@ÕQ«Vcý8¿H€äïKÞŠé3ß8vZ­ü›ñùÒí+ÁëMceß÷,ì0ðâühM~’n=ë¢éuÛÆ–¸Ñ±CÁé&ÒÚÄ£¯]½`{3 w¿Á9½á¶x)ŸNu¡ðÓ£EÌzûúŸ?òtð"»îÊhÛòcµj”…R´Ûn6Àa¬ujº;èp6d¨ÔM;­ ͱ612&¶i†žëæDÊ1ÄvbR•F+J2 !J¶D”²MX ¦E4Ŷé.é¯"Fh_L6_ôŽGm÷<<,Ãc¶Ü<u£O>‡àÀŠ¬ÄXì(·Ê­döfÏ0š)uù^œÉ3ȃàÙ$§ BÀÕWxôÇ´0}àù—Geô/MFnš­\Y‘ C—ÌdQ*q?6ŸW÷ƬhJ],ð…ДÄi¹?sσԪ¦©P •¦$ù „ŸÈr¡. 3 5X·jÚKÚiÌçRuR „¤ªÎ–€yIâÕƒŸÝ§ìrþ_»Ûï9aÁÉÑ3Õ7.r>±bÕ›SéÖÜ=î *t›˜V/CøÜÛ}æfd¸¥ÎÑ„$ί´zŒûé_Ðoð©\´:)= J•œ‘錮ÈÿèªÌ¦¹"R[k‹|4¹%-c8ZK!ëOÕí ,õgC{Œû ¾kˆÎ²GŠvØ:»¯ñËWÜßé(†<5¸‡®4ð”¾5ùè”Bò·{*'9´ªëÚåÂüØ;îèiÁÞ¨÷ƒ§Dç([üƒKÎû{2‘…åÅ8‰”3,úA¦´3Ÿ)PZ™$ƒ~?zǤ©ÉáBž!b”t$ùbŽ± Žye® m.’VÓB\8êòq_FÞ/xÄîˉ0YÞò.Þ9” Ùïç¾!–(ç}ïD…†“Ä’¥|Áµ-Ù+uKf/îµ”Jš1­ùLï°a/üE¹„ˆ] Ùò{*]µÇYa"[³ 1‚èTë\šºb£¸?z-8eÂma;´e$WÐâ):Ó«£á†!»ÏI´5¨êÎj땬҇õ^„çªççú``‹0Ì•ÀÝ)û.}O«LŠ1ƒò%ô¨jœÀSéQ~PFóƸ£b—ΫÃ=^¸ˆõ©‹ÃK‹5‚å›O÷´°üîFP=ƒØöÚŽ©ã\µÒ ~êO G}— žÉç9sX6á£:‡7V$*©õMö8ä{5´€ «é&U=ÛÍ©¢ÃÄW7ƒÖÊ‹r#ÆHv²^Ó mɪ%–,žw"½ý]¾I ÅdÂr³µ1¾“•c^·Þ`=²_> vceÕt-]v ØEøììé~sv%÷mS2n ªVsÜ,U¹P<ôݸp表– œô"EN½…]éÕò«‰Et ô–j¹µ¿ ·™"›ú¯ñéý¦2rfYÉÔ÷Re'œxÈéÑ v ZƒP´‘ºn¯lô˜¶ˆ'ejï‰(µªJÊièßTîÈa׋].ìF3KMñ«‰ÍèŒjóù¤N¶3 ê…CEž4›>)Ý*Ö@_Zåê©P£ù,·œW9bÃ9oãhoð¥QÊ·ó=[•Q5þd¿cra¤QãPÌy©Éòd bçÃê̺Ê4$³;ÆbCjŸö>ÌMJ,|742ŸšPâ1ËŒ¬‰é@¨™Í">j¬Êù¾¬P'%°©´E4åÏÜýþÊG‹Ž.õ²2çb;çÀ8:rMö'mî¤Ò™[BÀ/=Ò]ò5¾(Ñ>(¥pQ•,Þï€Aª„»­Wbt˜Á-vJù}¾Þ=‹‰ç¼7/ꚣ™sͲANY¿k—õµY‘3‚ÉBŒ¡Hw«`A]‚*&¬¤OŸ}4/Öx`‹‘À É·}±ió)ÄÖÅ:« U¨Ú’©#CàÙñjÎ’Ñ›&óeo~×ï$˜ Ž"æ“A‘î.*MjZ&ÈUÝü>çñ­wîN1ƒußgˆ<“w6ÚR¦ Xió°¬7Ž™,èa 5¿ÃM$ÝÑù•”×¹üd¼Ü.a7 +Ä—òÅSA-Ð/iÖþ4¸»ê¼W HORhuˆEÊèÃl6–µ1üNv)ªX]pì2´,Ú{FM¯Q3µýXbt*ÃÍ€»"~KEûÄ™0 ŽˆÝ|¡Gˆ!)…<Õ„Q3‰.zñT‚˜~upºJ…]Jˆl5O ÐÒh-ËÕÞUcþ^t†L§Fü”ºRév^{ 4ÒÔXä.8 cÔ¥]¸+ÌÀJ8™…Ô'Í2æ¥ ž}Œõ úæIåRtQ:.ô\áE/Lþ2û=ò)A»§X„3(b’Tºô@•xŽi¥d|ž¯b éa(eIìÕ–§½–ˆ á’{¿i:ØÏÈÝG£a:®Ri( Ý>ÐN¯é7€Â¨ðêOwÕòáSöµ$ï^œD m ‰Ÿ-weSϨNØCPŠ³ò<nèz‚nm‰ÝL^çì=ÔSz¢—šDk¬‘úBUÝÿýÜ LV_Ùôü͈­? ÞúRnná]±’¢©ŸX&{à³7E8w|€$ÈxÊ_Þ@ð j‰–þ¥ùúÜ^Ñš $ˆH\àŽ)«/b–èEh­í±ø&¾Á*õ?fRÔë‰é«¾C¬‰æ(fÚ±ú]íZV í_qƒê.Ö~2‹ï½,qáøä8-&ï=µø&tYÙåag¦£?¾qZ³óÉV4ì&ÜUýA¸3ú 1d#ŠmÊ^.ÿ$¬™“ëó}ÿ…Ù¸°Ö» ›98ƒ/Y~Ë»˜á/œ÷©ðÉ!‡Ùå² /Å.úÉñ8¦{3¿XÈoêæ"íÌ…®Ä›Ð†æªn¹kš¯“¯=Eu*Üuį9*Øyc²†zÃI_äáGšc‰„‹äô™'’QÇ¥öH$¼þ¨@é§[«l ‡h]ËP*MGª Þñ$ÍÝÇÁ²ªa(b­ èåZ1b4÷‰fGÞ»+AGð“…ê ¾/šxÕ^–ûúû‘ø¾hò‰ÞÖqÙöÃB—``Ô=Möˆ½Ôˆ Àx €¨ÚÝÁ‘Ó3‹¨b¼Ç$Œó³»ý_&Ç µ7Ÿq’ÆÆãÑ+É,¦¾­7ÐîéœgÈj3|lÈn‰÷*XÖ'(ø{ˆO4D{¢yôÊs]c25zMF·Ä T9Ý Ui› }7«sÆ 94ã'‡¢È¦6Íy[À$ fÀ$¯˜]¼ˆô11s·b“½ÌŽäÒêš’ß{窰zŸâWo½)Ì'hUvŒ.=uÎÂwä8ÒvMøÛ |À^’ÈÀ›&Ø;X{oëÛK°¨ǠݶòEOçnÑgó—›(‡ïض7‚ˮޮ5(XO³å^ ‹<²s$[îhÿ¸×\Ý$,ðýyäè r$¨:ýõäŒI²pW‡ÜE4,¶Êë!#×ãô”w‡Ùyû’`ÛvóÓW@ çG/‘;£IÈ°èÛŸÍD„íÌÍØ Îõ<ÄÓBé[_ö×Ìú{êŠÐ¹ï¨ðóõõHN#ÉTÆq·ÒÀiÖS_8ŠñÜNß“Q¸ôÔýÑ¥¢~õ¹ü‚y£7[|ÝÃv D°{†iˆgi1ƒÂîæÏÊ›ض¡iaqdD7/‹>°Ô¢¨G¥"t…Ó7ÇÄwôõk D5ü†åu&Í×Ç òÄo×Þ(ü>H?tµaÚ—“£¯uJÚÃÄcÓ·Oèϼ¹)7;§Úþ(ÄGOÛ]†Îú åßÔ.b¼PÓ¨Óʱñá°” KÒB-Xz¥o`HoâæEÈÎSNPd­°«1«)ĉ¡G6Wx¢•ä¬R3Mî„Çëö᳈:¦¡°$4žšÛRáyü°—ÆÅŒÃN-ËxÛ¨ˆ nbÈÜþ“V¼Z0¸þ¨ez™†âi Ó(:ˤäc™#iŽ)(d «a?HýË5dNi)À| ½‡‘lë,&¼×.ÀêIfê÷çCh;7Ó¦ü¢³‹£Ê,yZ½„µŒêCôéghVOÔÏé+/˜³l.“ÜM æ¿Êug2ÀëªØð¢!^ësH?ÍJj 9ˆ@1ú ¡*Q½J[Ý~]E·9ÝÉq¦{—ëûÎQ®ä2dTìû‰~¿‚ ™–]û!MÛ,&ðîV`ðv=;¬JŽæ§£¬þ¤†æûUÒF¤†-)rz~J+Xw²¨S_ºŽ|QôHEÚ‰Üþä g¶ y{„œ3Fº˜bI¹|UÔʧ‘Àºv…jç®5f|~­ïw²§…<ŽlÝmÿ¯>Sv´¸üMtÄ-Ág®ái¾Ú5ßøÔß 4åæ¯aÒÑbÁ!DÂÀ :—ýÔ×È-ùG«‚Zö;+‚àÕ3„£gí¬òG&Ý!plà_áì{œ9ÎËkh×”.Zcd$ÈÑ|Ò•í©!Y2âôaׂ Ão_Ë4RìUê2dÒ<'ôFýƒ3Ò„¥ÃNþ¬jÁLGQu³3¾Ï¨}®6¨i¼8×ðeÉ'ÚPRû ÙNÁ46T Lõhôyl¡ vı{¬ÖÔ)®5øªå-™BK5çQT“îXKZ¸Œ¼LÎJ&¹Vô.ß ~NL·ð×Dð9ü ŒŒJx*2V'Û[RÇçy±SZObø{]4Ž•£‚ðµ¤n£¤yZ;#£‰C£6Jñ• ¿ïÁl0°åWõ"«4xÓC•ê:wŒ$[ã¬@–heb=’æúÜ°œ>DºËøãk>iVQô]t27º¸â&Ùè›–D®º¥ÆÑÇ 8¸®fûÈ’ ¸.¥µ&ÕXê>Ír`™ žÊ‡*y=šV]ã/ãµTz)ïK'|Qã=%(åÙ‹ ãÚF®œ¨º”9¯Ð9Ðítœ^BÐok¿Í2éT‚â8z©~9Ü :èãŒAóBïAô6,”’xr0tñgÝ{¿\›ôt=èÇ]ýÚ9ª­°ƒ ¹VáÅøIö¨&*‰fhÇåºèÍâÕuk›®ý¶$Í >AƒmÈØäq5tG ”«‡8ˆG(Û4Ýþ!ŠÓß!¥Ç"å Y–é P€þ<µ2Ã4ôGÓð#v¢S,îj»•Á¹[‹:ìŸHßH+Â<¬Ê6³ïÞChµoà ó/ üÊÙþ˜¿¿ 7‰—/e€inL>”y1°›¨{‚$uÔ=óêÖhv……óŮןÞçýL«D ¼³Ô¬Þü(…<¸r‰¦ V!N±”ØÑè[n³¼°õ)¨Gõù0`_ßo£gÃУà;e#˜ÍœåÖ!ŸR­øfPdš½[c{BÿÌ A'²XÑÌÜÌ[‰™ÂÁâÙN*cã$ɇót†–Z‹+$ÎÇ’Ô™K_HeªœÂ—†%álgÄèÀ±Yã }!ªHH¬Z¤Nk÷_¨ËëPú®AÓ×»s–eÇêúuC§6|Cƒ‡þ7b¨}^¥†7£át9½Ž£ëþ'à÷ß~m@%ƒ+'RsìRú‡©ˆ:ò0cbûÆ>)×°ß(Ž–µiÐÝ1ë)>!³÷£Þ°X"ã-Srˆ†¦3û᥻^-­ßUŠ ü¸-—ÂkÚ¯÷)7qÉo'R#¦:7ª/I­~9ܔ땭¤.PyËÔç|«~\ü ŒhUp¾;êþÖüë<ÚÛûÇ® &85n–aA'ð¥ËÍo1íXuþf"÷ǨÎîÝ4Ê·bŠ äDi~VSµsÙ#_5UËÓç‚Bãs—±Š¯š÷Ÿ?3,t2Î=§Âm'ÝE¸ä§ó^ëР‹kß(žáKNŸÎ %Qf^ý)1r?óŒ#ÌTâWX` ±gVL=J¶†ÕψF$âOsGùEÍcUµÛ¦'˜Ç›ÏV°bÂ*Pm3©Ìíe(í­³þ,”è?¬«ÏÔfErÞl5’9È!ýnÃûU>Áþ#8ÃñâŠZ{4 ýŽf.‹·&C½,bN d­Ëã1’‘RöM\. 4V|›8/SšÎò"y¨§:ÛœIßÇNC®”‰Sç‰PªEV$L6׎@…&§ ïJHNp4‘¨v3›ÁQ‚ôƒØdËÿAöå “>À·v½ QÆéó‹Èn|ƒÆÙ‚e+ÑN>aæ{§A¤+sùɸŒ÷BÁ§—ÉQ¬pÒä#þ³Õ‰Ù1Luդ駙rŠõ‡ø :羜׫œÎQ'¾`§¯Íw4ù'aãÊyIcróóŒžÞ½ÉD„Ý 9· LÜì€+›x^ØkŸ±D– ªL0Ö—Ó´Ê.è¯ ibÙ¼’’.ʸ?:³ÉwïAÁË.ì Ç`“QqåËÀƒ¶vQc?–05¹¥ç‘l‘Š{Yu =ñeÞºw ½&ªöm¾ !æY qïüÚKâà<_é•‚ŸÝf­ð)£»ðõ§¡ËÕ=r™qòçª+½¯ØÄÞéÈ)Vã3üž·ðT³^q©`Ò’bÅ0èC£¨¨vgâ3xthb$FÛ–_p%2)ÛcàWÖøÈÜîÄ»;§iЖ©dàOš-â‡ðh᥸_Ÿ* ·ºu×SÅQ~¹ÄDZ¢'ú oÿ‘xˆã«b¯ökHAß--\i7¥¬é&(ùÆÔ¸„"±¬½Ž/˶ài¥& æjGyPJ=BŠ¬PÚ›¸™óíû™Ç± ég ³~¹ôìºè-¾Îoáv`kÍO^ýðÈ‹Â.v©†<†ê`ùQ..•P;u›™Ûbœª$¸ÞœGK áb…}IÙÄ8}Ž—¦o›–©[0 Ë–#ˆÇVY8ŒéÁ×Ãi—Ñç—·à aœO–a¿@¾ØÚbpŽ~l¾ÖGÝÛØeZ[ Âö ½¼Ì$|#c3º×ìnFö_Ø‚Ê»T ˜R<£Ÿ4‡>—¾;Y÷—Œ/waØ-y²Ñeð”G»(ðòG•‡q`F„q-›…îžJïÎ%G*+ŽýlÐpßÔ ÉÓ>æyicˆÐDçÌËh~Gs2µke¦b2_b¯t΀¨Q%doc7§Í Œ-Ö)ìë ŠYN÷ ¯š_?­Ý y>u˜þÒö\P©ªèM8¤ ñ‘(·pÀçû ϺìVà?fs…É™\€iû- ‰ƒ¤ }]¤»oÇu,ÍDZjAºž2°.|ç(…É]Ù÷—]8À¡µ°"ºý«Cîëó­êïI €Jί¤¡U¨¿’!ÎKYøÑœˆ>LæBX`Ã/TV*&e¸{4æ»'UÉWj#Ûø{xBu/Rk³oÐ’jåiÎf*œŠ½9a=KáeWGdûðøoVÆñL xÞÜÞõcö½é–¢‘©?Èš:†Øͱ>ϳET¶„çÂ÷¦Œ07OT¸¼wóÍýå<àÄä܇[›Ë¾› Þ„¡æ 8M°ÂµE¨´™¤­bÏ ?厯¼»;èZÈîË„Æ?ó³&Þ?À<¢)ÐØÿF tì{vmGW›;Ô²ç•ÏªÑÕ ÒÞzp¾©`îÕþ‚pŸ(ṙ…¿©²%=(Âœíª%( í½eŒ™ltÐ/b~ÖÇDze:Ž+Wõ‡© ²–¯ÅuÚLcœ¼¶ÒÇ\hîþb ùÙÃûÞôä–é]ÇÔWé^eiìJ×€Db%ʈFNƒ’òn†À0AãÚ—ÝH¸lÓÛ,°Üädäž“Ÿ0_Å‘&¢Z+Ñü÷À©éÏɃÀęļG0Díá®Äk¯Ò£OPq½´¦´~Ð%?µVcmîÉÏÐá¾²©¥'&Ëâ—e-¸ûÛ{§E^év0âßÉH‘ÓLæXÇiBÊ7a×*~÷¤®­47–.Ä-rÚMĨL;êyªïT i„y¨'ïJDÏ®-פù0d€2ÊvŽÉ!Ü‘ ArÌ(cCß‹ßíZÔš-¦ ÂùöÉý n_Ê"óOo–ÜÛqwjøÙü+,b‚ŸºÍ*›ZYÌ1XÉ|7Pm?Ù?<þqˆJ'‚Já¥ó"ëF7â.×ZŠ3/3HÀð´wË™ÏCñ¤]s§Z6®ž¥ÍÐwo¯-Z†²Åk\‰(iÑv*N,Ýï3>$5†´ËØžºY>©\a™Ð-¨ö´¶4h 5ËÑ„˜ö\’“F؉ÌÒŸíI­°œ&H/ä\ö™ƒ&ÓBxaÓU\·¿ „Ä%ªR^sÍ>AÌâKª]Ä¿ÇÛCOŽzâ@õ$vZ°S”¬šMØ.­G–¼FÀسà+®† ‚3 Å`¥ŠÉæϵ7­ÐÇ°ä:W¬ã²4Q‹ê/¬s[Ø¿ÀàÎK|ÏM³øI•Ô$×oõ[ ÄàÖ¿S"½ë‹é¦oêêym÷GJÒ}MZäèuÕéæ«OG{ùiŸH"¶3ítFõ|”Ë=¦8Á˜/úŠÉë*¿M ªrVœW•®Ü¹|x«³\¦¤'‰Vy Æ Œ@®žiÀq Ù:šÀž­<ÚŠTh^ýòK KIòäð,OS Q£ï ë$"–¿­ ¿¤–ÀOÔŽ»›nµœEåÃó)X5‚æ"#ÀA’/k6²]¹TÕì"£‹”Á»«‹Gío}ôpä üöxé£yìÄåC ë´jüë—©ONC‚ØôñqK•ò¦_ž|–Ç–ÅëT€ÊÝoÃR0è6ª•S½<½y»bò?ƺݸÊÈžÐîtø+YBæ²0¾ëÔ,¦V¥v`)£K%í]†ó®ïé[¤v‹½¦$|ÑÆñ CáB‘c;V<ˆ½X<ïùüÌ SRR&1©«£ÏÆ{Ú§1óc¾ï){Œ`:§Ý6Œ³-þºã'Ém‰çLÙd)=2Í|ʉslBzmð‘Œ_«¡šv>_Óhº¶ª[ ÏØ2ŸÐÊ0ÔæÁäM+ÜÐoe ñJÝó&'f×¼Ûž ™Iõ*=–‚æ·]½=;M•|ÙˆéØéMAË„öJò‰Ñ„ñt;a±à7Œcžì~MEZ¥ABZ}f?·î§#áRö= šMa>Y ºñ®´Å…øÅ-ØR$d8û‚?¶³ûjqÒÕuœ ¥æÝBÙ¶-2éjf4‹O€L¡E£¦×Ò/ Âä¼sx‹¦™Š,æòWñ YêP1aÜöŸòŸÜãC¸tp„Õ—?é7p)%27¡|m²t°~ú×ðÇsŠ§cÎkÒµœ+;Flo–¸´™Ýð¸a. $SĤÒÑÙ¢_A›K±H™€-˜Æ! o`¤Fžbõx«nH![ÐGZl|h1uGìê }à³¼CRnKÂúÖ[ÛØà‚–<‚ýÍÿØ]i¹à¬~Òœ×çÚØÝ°Ÿ7ôL¯&$öÁüñ0Šì’ŸT›zÔýfóü¨{a …ŒêÍ,èá1÷ìò¨Ò`ò²ã|E“«u¶Ñ™w:ÄU2r–€·yŒ—®—²jhš­zþäÍH‹ú¤°­ >ĹÄÕúÄüÚh1©{Чw·I×+Ä3ETÄ¥Ñê½ü,¶Ë8ªî,~'Ge“ŠÅÇ@­MVöȶõ±qW8e»Í°K¹ÇÉÛ³ù#zšþjùüt,.e옢¾ŸE¾v\稚ô 2úFp.þý×ÚBÂQ‡]Âä‡õŽã yMCñ™<@U n‚yq¬ç'NùWÀÏÎ,9Óø#¼Žµ‡w'á³°|r¬dÂtŠÚ"ã[}㘡$än€™»à]âÉ®Õcäoö ý|å´~Ì,>CAÁg³£ºnKß¡*mt¬ÔnÌ0#{Û\ŠÌ?a¥I÷NÕâ_-Àtä\™Ó3®s'¦ÚÆëáZ¿ºmR°RZY/‰lrð¡qXEüt,šQÈuŒ_Šª{¾ùÂôÉaú:§ˆ¼×dÕ×GUz"øX¿%•øâ%ÂsÇ>]WàÅbQ\h‡ ÖAéàËg¿¹G/OUOrM°6å ݯ*©K¦­‹ÍŠñü©+/¥© }T,»€Ïòø&jrkȶEX<"ŠÁ¶yÌlΣ¾LwùhúýT©Ée[‡Ëu_Í+ÙKaC¼›ƒ³AÄÿýó}<3SÆÞÀ[¿ÀÝ`¼QÌåxGÕYïœAYæ÷>‡?Ãn–2:yHÖ€q^ÌÉþ®º¦ÞîHT -ðE;ÃêfyOÿ`§ê’¹q5{Äí8zßµ†w÷Ïb{³øÈèL_ Q› û ð›*ΙâÓÇýá˜@;G9xiÀû"¹é|ÂÅð2˜+«‚‚¡tâeá]Ôu5²Êѽ•m·²…!БZÓÐ`âÑly:v6漜ZWâŸà¬a3¦¨Ö®.hÿá|øXw] 3Ê¡ˆ0Ÿ9+ScH©Öw½ KN?±VüYa6ñëÛï¾A6$PÙ娟Bͪ•”‚XcꨃW Ì¢ddhkæîãçdí£@‚×µz;t!=f®pG_X—xÏ–Ép¸œyÀGhaEÿnê=ã瘟d’~ ‹'Êwå>à?ÚI—‰xŠb2E’gmÅ×ɜà ñV3ÆhŽÏ÷Ò¸ ä¥~XµìŒw*õçÂ€Ø &,œ&ªàì]äú2îGZ°ª¤Ö:Žû}A)ÌøR!ŸwàÕÛ³³ü…9PÝÌ×NY¸µ#l2§»IÉqdP5Ôµø À¼qxÙWÚš™àE¬gªìþ¦v—+È`æÄÔŸX‹y–.uYȦ¹Þùe¼¬ó¾N£´½ºPžìÇû|E&?‘˜|Ž6.©Ó|“£äOøи –J2W–ò²ø‰1q6üJt„ktšwÁ‰Åæ-â™°Ûb Fù÷â}ÌÔ~¥•=ìËäh…"µ¨û µòj*“‘ £•Çæ2À›Â¶4óÀh=ÚÅÁð¯ÈyåJÔôZýO'†&V3x‡+ûàJ„v+¡úWx|qu ·ý µàª¾/:DzÚ+|߉›¦Ó~¶¡©L¦AÃÏ{“R?Á:”H£—µ‚b½ÁºÂ•ª÷vi]Hì …0#È ™± eç·ôð™@6Ðxn‡~ûÚLq¸¯Í¡Ü²“Wý®“À»õk?Æž}*#±ûî¬ b;ç·ùY a0Dͦí̯߂ýèÔ÷ó†å.ÙjvÝßÓ±¦~çÃ~#‚*2fë(xO†¸È¸ï{N)„¸£¡60’¦ˆºLwsS+W>×lÕ"úÎÙ®¿‹ç1c üÜÉ<(m§ï~¤J&ÿ$†j½J`ôIMüŽõYqíuçÕ¨;Ä_LÜÑ9s:nIð%êVWQUÃSàX¤i¿¥Ïöÿ€ T endstream endobj 2500 0 obj << /Length1 1625 /Length2 5977 /Length3 0 /Length 6802 /Filter /FlateDecode >> stream xÚ­UeX”í¶¦D$¤»;¤KB@$f€A˜Afè–F:DJBRº‘.)éîn8£ßÙ{Ÿë;û×9ûÇÌõ>ë^ë^÷Š÷y™èµu¹dP+çâãæh‚­\`º–ç\rP *ÜÒ€„p˜˜äA–p0¢` ‰ @@€ÈÀÏàÃaÈC<œÁ¶vpëK6ÎY~»¬<þ "a`[€ñà r€:9‚ pÅÿ9PÀí@° ¯¥m¤ª© `UÖ| PA@Έ"´]¬ÀÖ€ç`kbØ@ÖPü»47‚K°Àœ@Ö`DÈÝäôâ8œÁ0â†l-!pDàPbíàü-a·þää Ex8"0™6‡Y;ƒàDVm¥¿tÂí,á¿sÃÀµAx¡Ö.¿Kúƒ!h(Ü à wøï\V  sr°ô@äF99ƒÿÈp!¶ÿRÀ pÙZ:@0‚Áý»;ÿªð?ª·trrðø ýãõO `8 ä`ÃÃÇÈi Gä¶Cpx~/‹*Ä àãýËtqúæ rþÓ Öß;Æa „B<@ &ŽH `ý¿M™û?7äÿÀˆÿ#þŒ÷ÿ7Ü¿Ïè¼Äÿß÷ùïÔJ.š–Žˆøë’ nà9à÷=ø}Ñ€­ÿWˆ¥#ØÁãßýÝÑô—Ðß\Çþ¢–…Ø"&ÂÅÇÏÍû— S»ƒ€Ú`¸µÀÆÒѬ?ö— ÈÙ !†ú§Ÿˆ >¾¿azv`ë×ßÝû À¿kGÌér}Eå—/Õ8þÝÕúÇS±p='à¿¥h@ÿ<üæ‘“ƒº¼¸øDD\¼b>>^€˜€Ï¿Éù‡ˆï_g K¸3Ø`ÂËÍËË@üÿã÷¯“Ùßh!ÖPàï¥Ñ…[B€ˆ=û§á7líâìŒïŸWQö?Î6rYãLOB­%‚ì“SSàåä™]?LÚZøP»‚ *õòrüK¡Í~É¡‹b_,nË‚¹«Åïë<&¶îVÕØ×zZÈXšAûÙÔ>OÙZsÏ37ˆp¬½å1/ÀOÙ1ˆô:¾€f,Ì«¿¶ôã…Žyþ-Í`ƒ€3ÖÁ›ÿS×Æs'_뤊hÒFÂ*$¢òÜíæ¸Í‹s–ŽÞî®Îæ#ôÖÕ'ÑØL–ä¾ Ûôñp çÓJë;7®Rñô¸àzë¶ î«2FÜF´5Ù'ÏhìöÍ’¥­¿ÍøŽËoPm©ñÒ|5sù@ü-è{/gU/`Åô››®Þ«þîXì˜Æ¦·ÂÆÛrJC†lB+û~dçòÁ=™¤d¨ƒX¨þ1 £Ï^½Û¼¼B2LyÅB¦Î:#y3fZ«¼®I”Jþ}¶z)wŠ]W_öåÅÊz&9U7¨pt'ˆ—’•ÌDpn}B•»>7t ùÜe®â1÷¤'% Kx_î!Y!g ùÀö–Iíþʃùþ/6nHáóIôZ4ÍÕ“Ê,ák÷Kéêp¬ô(Ôƒ7CòYkÙ&>‚Ä™xʪ2‹ÊOÈ.ƒÈlqOCi¶.­ÕP‡¿û‰Ñ |LHÉ#$NUSU¾ê{#›èyöý\Ùðý¡^GôkÃí–uM¸KªûßbQt†ÃoaôõiÏRVÖÛ/ŠöµÏPÞ¹„ÒŒ,§3xëÏÁJ¬å¨Çt]g˜4XeÛ´ÃÓI3”K¹é7ŠêÔßÖó{ i~®•KµUmÇußî±´PÒ^<ºÌ*²î£Ð›÷©eÊH@Wff7aw3N÷Om¤öþðYëgaüGÇJ£[á|Í­ZÁ‰ÛÒlØô´ºâ—=Mv‰#“ßFk¬ð:ã•åUE•¹’®E‹Ìö¯ô&wíóXlÿ 2bš#g.í=:ð®D5ðâbùi,QdÄ㺩9½ûë8͘7V• e'!´dÒyŠÝ!î œê“'>ø˜¬Þ+ r«€®TxÅ~µ´K9‡Yô FâÔöÓp±Æ/ÒZð:`ª”6U°ÿCA“Èf^>ýp¨RÉÆ‹ûsÑŒòå{Í4˲ì™ä“òúAñcÂQÿF`ÈhêÇ*¾x¤Ì3ܬ>Š¶ .—þW1)RØ%m±b”Ój}þj‹¥íBaÙ2ŽMeeàÝFüÏÏÈK¤{Ûc¾ÚÁ5Ë”Bû^SãÏʉpǨh˜E£1GŽ¿1õ¥šWumé1×R¦¨ž—3‡UÚñ9ÿì<%ÔodÓVá=ß0 àæ"]0"ͽ£ŠG´ö(í©%VDz~ïöa1yÝÕhò • ©„?ÉW‘«÷}(y¢Òz´¼ÓMIynåÕŽñ|)«F%ˆ]ÑLJi‚ñ ÿ"ËC`¦Å:yù‹Õ>õª±ê°á ¤{ ·Ôe´×ý¥—xmÛi"eÆm‰åt±\eû{×ŨæS ³˜a:«¶nÓÈgX¡6d¨žBgð¬BfÙk‡·Ëu…Š€¹Í½=J ¶gV†\7Qåq˜_Ø{q.ø†Po ]8d›H’aÝùc²¶±DU°‡@<´Ü~Lv¨w7;……S‹rBº;Œ%¯OaizEÚνËs“¨Úêéþg§òC “-_–åÖ}t¼F¼‰GämÇÝsæ ¾xcÒ1 O±zÒÙý*/ïe)©žÔâÓÄ2æ3RÃD²@‘ 6+žuÊ VÌž»ØàÃèöRG9‰Å]™¶‘œt¬h(F°W½ ÏhÁd#oª€žeØ×£ïߨ6ý(1´®š6‘ÜÖ½¶Q)«ÇÑUM<³ï>û)Ë™ù(Utsø•ÕýlyÒùmöëU¿ýkÌ¢ÎÏv³9SY%wN¿ª-ëI¬¸…á?!×4Þ€õ¥ç“î«(Ó9Hφ9_é›6Èÿz?]Qp²lý•A “ãÛY‰KEŸ,ѹ¦<YÕö¨e퇚½½NÞ/!û}tðå¿Ízî\´'r{ΰY"Î9Ö^+ûÀ°Âà㲂8…å²"ûWNæ~ybñ©j—vºËìÏD ƒ&L×·6Ȳr'~®ª$~êÖ1d6šB‰Ð{š£©ËS,·ü}uI*B°·|Ÿ>Ä.K€Vð^¨ƒ„8#Ó8Ó÷AóÂ&ç+ áQ0 p}añH?[ˆnÔôŽ†íHK¡9ÂW6YÒ÷!ÙØjÏ¢½tÿÑËoaÁÞdÃ!\ÙS“^œÜt6Œ²¾¦×Ô–«’‡Í,/Õ–»äÓ„hn¢!Yj3çGÈOõã)Õ±ñÚÇj²wo-åïìäreu²¯\kò©ý†‡F%hIE¶K§'#ò-ƒðT GÆÖ}¶c²¡çq_^iÀűËvóçüá*U‘Á«–ô(,Â=^ö;.Ò†¿é@šD¢f´m4´Û‹¦ûõ}9¬˜QÖ™:ËJÎ’>ø!¯6°)P§Gž‰«vŒø6Xïd¯ÔÛÆQa£3©Œ}JÌïêúâÖgŸ€§¼Ÿßê«5Y´œQ_²óñâWp,™zÒ9O17ÛkU´ôa¨É3⤴¬åë«mPI–“”L˜þ]Ç Ø(¼1CqÛNêHWxس½êBa1W•xOý–¼ó8ÜàÝîùÙ†=±°å·™òãJŽ¹!æë­#'Da·vw·ùòhÜíñçÌ–ùz ¸×Çlš“ÏAíp¥†„¨åºÖ›"ﲸ)ûGwÃÖ_¥¦RªúŒ_² ½sÙ!­ÅÍ=2L×ç>Œ_Öøã ÿêçÅ›*lï¦îpwâ’CßMO÷J¯ÅhèE@¯p Sý¡Õ=]Q]Ç$WRÒ¥÷Ë‚ŸBÊûĪoóæˆM xZQDoL2Ę3¾ â_/ád³ŠkÚ·å³_’sløyÑDŠ’—«´J òðíY¶KÓg!® ¥…ŠLØfªÉhÑ{NÖã[‘R)ƒcHÒ*D ë¦_ùŽ3Ôa|6 !ØšÉYìô¸“ö$™óUXa³ß•¹>7#aa¶£¬XòëÞÞ3Cºº%9 BaiþÖu›‹(püQêÈÁ·Ú¸¤bOŒÇïq~i,/¾ºò”~­@ ¯›<“Ñ8EIr™%ÑÆ)cxî5*¶“w'=HãT¼jÕÊÁ*[iØBÞž5ÝP|Ã7”ô8úŒý)•dG·]¶•CƒM\œWGöv~÷Rñ¨ƒ;£8ÊüE|áž³·™¯Ÿ0ö‰ô¶Jñ€áÏoñvëž•n]ßÉFžÄ)ês¡mø>+O¢«Õ¾¥@g&‹R†¢Z"O½ŸÅ¼¼Ž›ë|i'Þqþ†±zH…߯h<¬ÉKõ÷Y¢RÀ „ujÄo=ᜦŠÆN ÓûÆ'x¼cyKÅ)È– Ùž"e à…IšÔÈëüdü–Ê5ˆR\0G¿ ™K®M5æ/§i!ߎ۽IäÊwŽ?c) Âìé‰BåT{Ô© zÊà[•·Œæv¡Ÿ”¡é®)H”RÁƒ^°«ÝkåÒ%<7 9ð\¦VPÑ1sRÚ;­$G­Ç`ˆ¼bÒÓˆI1¦€[Š—2%,"±ØeÄ0e{„;Jg§žB¹£Õp;³Ãõ˜O®G›Dýp›Ío½Ž„{v—–È¥Lñ‡Ÿ°©Iü„W¥úMÕ/ü6«§Ú“ÜͶ¤KÃg¼ßæg—RÈSÛÓõiTºwj^;šAïPb6ëÄ«™“1‚\«M å^[á…áÀ1Ìw>°y‡w›“|}TÈT¥ñ 3 37.à+é\Æç=Á;´2ëczN£å–n &PËÚ&LÝåD!gͨ„lÄvøVu×fì×-_ u5.L牶"ï ‰S•d%õl,ÆŠ˜nìj°væ%…²ú(T|÷dxÁiC±ô¬q`½˜gûô×ÄÎóÒÙp×½¾ïeÖª”cpvJ·cˆ´bEdª?Éj¯µàDŒÓü˜Ðf Í‹?÷ÐbŒ¤†ßo,Ê ×-^Pòl¾TD››1¤ØrŒs4r½òQäWääc¶Û}³ÉõG©$±ÉÙpÉÚ~V‚ ®Ô [0ÑĦÝYH‹(·“ro•;x ÓÃF—äPZ™èÔ4È~F¥hχÎ?)b™´¯nö®kφÀ36ùkÚ™ÊçP¿Ö¦[<3 üµ†FŠRB£I¿¥ïÞwUYò¥/hQþÀ›{ã8¯(ã”æÀèý!ò“©Ùø'v |r¦6ø™mÕ•É Ü™-rf"SþÚ¦ò1BïìÒE˜ Éh×meÁǾ]Ü+´ÙöëôŠÃãV³í¦·h/Ñ-¤¬nà–œ.^§Å÷Y—9’t¶Hëbæý ¼û ÊækÂmu¨ÜeîÈœLú‹‡´p»AJác#@{³ ¿Rýí„÷ÌNŠÌ÷c’›ôÍ;syWÑç*ÑΗ˜¶éî̲¸û´óó£´˜gÌ7m—+œA.‘Š¤*žÓùNÖa¯¦ †—P?Ü4ÒÜ¢9—œ-ìdrN+r^¦fCÌ[— ;ØUàä× ¥â ±¶ì¼ >·ï ÞÚ)wu/)|ˆ>·ú´OÙ*ŒkÜ ³ã.¿ßMUëTFÍ»jÑ°MäÖWúØ«jLëÐ=ò0×"¹KůŠr¡sY6Ò|0~)¹C%wµ‰°‹ÓÂÙûc(Iÿ¡\ëAõšlj§ÿÑÌg/ee=H¢|Àþãø« ¨–>l!£U ¥“- Ü.©¼íŸ«[Cûvä“`uWŸMãÍ•ÉûÍø"LŠÏ%uÞ¶ ’u^¬=Þo§¥™œ£^˜2“¡EHçU¬Œ³ÊÜðÌ÷ØþêQLK@ý"ÉY>¾á¡ 8áeˈ4»û ¬©˜ß8òç²¾hÊWx÷äq“‚_„\ñÕÉž¬¦¤®@@!~Úœžk¸3ÀÇtà.K›‹¼qq„2™©¼/tV@è›>e»¡UC`š ¬ðlǨÍvãŸØ¹Ío€˜[碰§>¤O•ÇŠ8 ̨qûÓbÝŠ¡c?°>ý*¡bÍIÙ$´ô_øqòï¬e»ÕCt¡œºÑ=é} [¼Fb‡¡Ïq’Ýú m|v¯£lc¡Ÿœ É*•ËhÉш™=^ Çô²ÙçvÔF£ø7ÇK¢ùËi1 óÊ 2(Ë͵óöîc¸Èñ€Ú ù})›ìâš»%¢ é[òZÕÞcã­ñ®™¹6ԗ›ó•ž’)à2Œ¬‹Áâ”Ü>!Xi¯H‚x£î׉À`ihôweÁ’aó1Ñ ŸÇ}ýyÀoú(KÄ×t6ç6'/¤üã•äÓàÝÔëPÔ®{VïîGÐ]ûÈ¡‹DbÚíêzá:ŸK¹RñµÌ:. Ð3`¿c¶•“`˜£qËfÈʸ Ym^œÊâò‘ƒÛz ºågj·¥-‰ ç÷B;QÍ:ËhS±b2^y ‡TÑS<[c»[0|–S„+…´á¾¬TYÃx8ª>LÅK6½q`¦ûÕÙ·Ôhé®o¯¢;¯M^ñ%ÿ`eôÚ>`“J¤(p+ Ûë ¡C’£´q°·áÁ¦¾á¬l$vÄ)ò<—Xï3bÜzP—#Í0rwÖÀ‚Ó›¨KÒ¦U*-dÏ”@ôœ”V ÑÄ'†—ÍBb=qˆuXìÜ÷ð³›·Ù¸ªfD9‘ÌkM¤—拘=ë=Ù¾P™Ñ>F;q ÓȬxç Æ£ŠP *|û£¦v13ˆëZ«‰!M5kÓ•KrÛk§b&–Dž[JrT1™æ’Ç÷cè«êeÌÐ:²j9ÅšùÕœ5Udûtýx¦´Á"®Èð2kÝ;á@&åhyú«¯Ö6*îhhxRÿwXÛñ×EúA.Øã~PDÃ"ñn(ì$:n( Jcg+ã•>õ#ILÜN[ïÎ7bû†‡_E Ðý%HÓMò]æ–²)+Aè‰b–j™EEQ:ÿùLŸß\*·.N}БË1Ïî)É·±AoF¥g|#f Æ|LÎGÈÓz$üëM…NÚÑÑ\r"“Nj+ß{q¹VE\Œ1t1ß«Oƒ¢éúÄŸ&¥Ö”‰O{Æ6èð±«+¤Õ"å×]¨s¬ Vwv8ÖN}±·ù×3aTDŸ@Ë|kÓVS.iœ~þwoQg4_íø}¼OfA9 ršáiì¯k‚ǘci>HúAir|Çn®{“IÍu>ëîxVi"AÕPnڒ៖âI_)vAÚÔ¶|¿¥³åáLÃiX{jÇÿ¸¹´Ýq·ßHKŸÜüÂÑÛ•®)$y±Ïrõ©Çùô‰ñ¸¯^LV¤oSæ/Ôª›ÃV öT3“k9¬Îpº<&­ŠdÜ-ÁÎ$Þ²uº¡Uš·‚&éc’í`·Ày.!ùn·œÈÆ ¾‰òÕ}ÿBkK–ïwVâdb¤Ã§lê<ùØ@³%ßhØâãCǽÉït¹ø…Y°Fú cÌÀ4NóòQ ”zhðbƒšitž×gmáIuãÔ5]-[ÀçRxöz[4Í 1”¯›®Á§|Uè5ýf²Bq!«ÁþÃk<‰_×ñš;jÑhaQ¨¡š ïc·‡nß–Ñœù/êo0è›VhjiÜÞt“wãÚû`¹P†WTyôúÈ€–µ¶ÝúGS~Á×ðp2v…eRˆ¢õŸÇrŸµ¹¹ÅŸé“ûÒ7x<ÎYªUŽùÌ—“îÇ•(›(W!ex0XtPGfÂÑ©vw”«=6õ>d¶_}ÖCfMz6ODΛ£E³¾Újd;ÿÂlåË endstream endobj 2502 0 obj << /Length1 1144 /Length2 6158 /Length3 0 /Length 6919 /Filter /FlateDecode >> stream xÚuTu\T[Û¤RºÀ¡»[ié醙™fh”A¥A)i)AnA¤S¥»»Áïýî{¿÷¾ï÷;œ½×zözb¯s@¬ú`~Eˆ«=TÍåÁ/, $Ô…#í=1`;”6¿!ÔÑxŠÛ@ Gpô?èB µó€»¢Tìÿt4<ìpE”#â_c‚cÔà>Pˆ>ÜÃÁéOcü‰¡ |qP}W ü÷7 äþ÷È îà‚‚b07îûƒ‚¢ ÿH©Šrp…ÀQŽ@°ÇÿìпiO4úf<\ÐÍÙ¿ö0øMP¨Ô09îê ê\ÚpZ¦ÈèÍ¿Ô/Ú.atüËó® ½ €Ó¦KçòŽQ,ûHêuºŠ~“B©Å-[Øa±ŒªQ’Þ.ÒJ”Ï(p¾`Øø(§+C¼KÈ5¸'ÔÎI—”¹¦ìÛùp‡µøØ ¤ ÜGs¥d>5_Yu×Ãgd)~[r[ouœ[šæ`úÈo£dRï òõžÁ»ø§‘+Ø£e¹(¢­ðE9:Mtæ6îœ;épÛôIc•Îô§&Œ¸÷¬êˤé+¿7ÛÇ^œè ¯.Ʊ¢‰|»“jëvì¿ë °¬c¥ÓÂö=-êpÝ®®†s ØÇ{ƒ¹ÊENÙNpÍd&ÛK0ͱUlÛ46VÌ¿V„¥cMAû–›Á?b²óû~¦ŸÕÅ+ û!WÂj`V0¿?šÏÅÙYŒ^w܃Ÿ1¸[6U$bzùªx¿¾”@Dx+?Ïoñ{usó¤]ÌüÊoæŒù(aryË6c­²´YÍEÿøÓž<…bq‘*÷§†‹ýªa²›ŒÖ‘Å`\j EÅë'¶¬AŽQiÛI'áe÷WdãE&wM°«¤fÜG„Õ¯*߬›ÆK¾t’¬]€H5æ Ædyx,¥áyº(å`0чe`?©o[|fè­xöù£ý(ƒ¢ RÛsÿ¹}Yh; øI´Twîvó{,ºZkÔU´žõPÔ1…noƒå¾l/pIæãITo¤Å—†i²ºqÃ¥rÅ6ÒR+Såàqr¯ã)¦iÖº½Þ(~7[¯˜'àà2öMK©LêŪzÞð“F£˜m-ÚDNò•ÜpBLKž^À{˜ü8«ìIH¯âÊ5µ‡ÉHR¨¡ÍÞr/nØuÙ7Ú=©÷Ý Ãá°•w ÝfJ¨‘á‚ñ[Û¥ƒ^m’Y‡‹À®Þwq‘]PÞ‘0 QºÃ÷¹V-œ…6eñÁ~„³¿ÁžÀ\d1Z̵œ±ó›ª„#ªóÚ»…fÁ ½ Ã1Œä’õzyçg6g§U§Ü†)¾»pΗŸ«.‹à^GoÕªÆãÇ<$P5=ú"—ž ~­OIrGí;ÁûS§a¤ÂÆà|Ñjûi¼ þ8c·hÛ­…{ßâ³¥ËìüeBÔ?u£±>¾wsuxË*Ù$naí&*5’9îŸ]¿Mœ5ßB.­5¥jQV©$BYÅo{ÔÛ ûæ/U⟃ñû"ùæûê"X(ò^’ËW‘1Z€øÏ/UÅ€éþd Ü^_KF⊟1æSßÄx•ž™ÞÁm «â“=I!hŸS£ ×\Mò®/UïcÔy[ì!«­ïª§i.Ùr7—¹¹¹ú…Ç®"» Cn‘]@“R|/¹ÒÆ|`pÛ·ÉC†¾ó‹3†öCÚ6R’KÝ µ{ ×\ çë ¸‡‹¥[Þ±ô%¡±w9»×Kg$æïVíHñèý²ÜHÍß1¾»¦(ªÛEb%¹¦Å‹Œh+‡ÛÁ ™‰Zu…ŸÈŒ†MŸ8ˆq4…Ãà}Ž#zâî ßÜ2dxËŽvéèù>«…çˆÄµ¿P]Õâµä¶í§àôá_¨‹L»M½É[õ]÷«RPœ&Û&Ùgf}ëÍGŽÖAA‹½Ï'ôÂ&3MÁÿ÷ôåùÒˆ–!N™z\Å!9w™k73§è~*7²Ïã™NY¯çê0¹[ ­¯ºáæ˽áý´‘W‡·×]+GËJ¶‰cõuN_щ* N§û5³ž³(Av®@—âWø Îžî]”HlŒu»Úëö0ƒ×&òùu;¬÷ÒÌ‘Œ|:þn’Jõ²ÌW·ÃC’æsÇìfI‡£Œ–Z&_¸òTzÖð´P)Ïuâ“„[ <Õî8^,-ƒ¦œ(PÉc¿yb>dÅèKÓ¸Ôq¤Qµ6Öh¦Å< –æiŒð' (= n~øÎeØÉžùL¨²,¾={×â¡a§U“°õšçCûu´L¼dÎë(Ÿ¯ ·:”¯îS@ÓÁ#ÇtæÙ:!éWvÇÖZï]ÊÊ…ùŠöyó—3—WC„àã,ÞòÆòÒ]2Ò×H‹/k Š»!Á-5 ½â{}’ Ï’Îþ•šì0ع4júü Ì'(jlô³àä—ë(¾è Îa,‰\Øî”´êc…Ž`¨XHñþГȉF£ÕëW§½åË]ýÎw(¥}_qˆÒ€?ò9Ó²õ¾ŠÖ¡»:%öt3­‡»£'ô»mÐâ‰ëä^ÚÂ;?„• Á[cõ:ªIÌš ZGóõ´a(^'¨ÑŸ{uÓÀù¨Á±ÈÞnó2¤¹®l)î; ‡•íºéíÍ ³rq~Çη…C(¢þ¯ÒZ9e]‚âN ;eɢ߳ª£€qC]Q…÷NmNTÉÓFÍ]‚ùfÅíš‚TGªr–‹^œMÙ±šIÌßßtK}É° ⽦dí8u"Uõç>ölõS¿7ÔF]}6¬6›Âî½Ã{Ü_6Ö~`hÖø8XF²à)“Yñað‰Hy_·¹šä.tæœB@&õ%;Q`ßÜÝ—ÝE.Pvü¹ØÐÇÃÛ¶B åÇ Ÿ” Éfð Yi{ËBå—BiBçÄT¸ö´ß¿ =xû°ÒÉxhÍñÝ-—².‰,ñcÞ#<äÍ…(eÝqoûÚNEVcß‹÷TË…ð)O_µ?øḈ×e|6~ÇJ0,5?zàLîééÛej51ÜÛ‰Ñ,Ÿ^žóLf\[’Òöbô»®ç-çç RP‰‚ 5˜F;f>´™°þx¡‹¼@ýzI ›nÇÄ,šï1ÿBª +–pA‚ÛíIq¶W•z¿K:×°"gP1¦‡åŽ=vþȪR”(Ö³d£šæ¶£ZÁ¼¢©f:„ŠeyôzšX«_GCôUŠÞš{Y‚0¼äuÚ.ƒÈ¯Ž¨ú´™ Âø†Þ¥,µ¤[[M˜©ºQÁ «Öši›†‰Ó;'—ºß;}ö3B¥ddq5-+ªm*ÛJKj¢ÖLmÚƒ¾lkýH¼8$<(*ë¬ßL@bMRÈ™Ë äŽ8-©ŠoúáÉM”ê£ñªþ³õþ«»‰Ëe4ÉÔp΀Ìy½;¥g —z§´R3ݵ—d%¶þžló • ÈGóÑýK~Ñ-ØÆcƒ¯¾o»°øY¥¯sUT´º6'àî| ¼.6 CC;)‡2®iŠæ,·öÌêù*Ðä½9’˜JÉá^­E]´4%,î¸dmç:£þ!ÓclþÐg±çw|§óg.ߛΕ†»Êoö{™h£ôDöCü+žò³ÒŠ1øc+x9 ‚µcZ꜄†ßÂ0…|è×vˆ·þ=Ùª;S•ãq† ò<™yÉæúqLÝIkUK•Æ ¸²A™·U—&¿,eèu¡s—%?l¢­¤þjD?=o&îL§&Ÿ{oRö*Gy,ÝkÅ8Ô¤?œz\Ó°¥®QOOà¥=vP}³¦C€3ú3´êÁ£>î½ÅåTãDY l ÁfTÿtj¢E…’“ÃsÊ$úƒ«ôõnþc28Ö<1Ò\%ÔyrYo‘ø½2ís[Ú,ÊæÓy¯wç V¦‹v0Á³™?ûE×€-{»èÇ;[ÂJ<®1*v5ÊãÈrëGõÖ„›Ým“¤‡úfµºËé.ôCw<¹üB©ÐÝ°(cû.é¾4ÏÕ -¡‚ôÏS¥¸ñ.ã„#àÕ2ô--3Zõ<Ï ™ —· f T~uݧb ËãƳUYŸ4,ñ3›âB<·Ø2ÛÂz}Þ< ½ÎH¼ ä áṼ¨WŸ¶r”‰îBk¯{uNÑv†\êî|,Jï:ý¨­Ô<&*Þ )?µ:7}}̦˜œY³ ãMxÛTéw1P’”ö:4Š ›(µÀyÏÐè+dò=jÄieÎOÊ‚°­ŸDåMŠÅ¨s[šÇhCo-ôD$:êÌ6)NUÓÒ(…pØE±ó %(ûkž¤mL ò5Å˵’ñbÙ1:Ynqj–oÌ»_z]zI®÷ÝÔÆqùóš ð&Y^-¿pûƒ:6ãéžn¹¤œžœwÏ6Z@YݯT^vf¹8;nÓ.„R÷|i¿w0é+²¿ðxÓmž#ši`Âï´&BLEÔ9!Ó,ªÜC‚Ü%¹} Ñ©²"æñw#ˆ”z#™âÌõÉ: à^}§©ˆ—Þ{¬‡Áç)ö’Jù¸ÎTij<»É²wWMÎ?b`è5m@¨Œ4§Ê’5öjÑÇêj\é–ñ#Ö'Ô!ªu•fQüæ‡;ÇÝÕß“ H¨{uÜM ÔñˆNÇ+Ö§D›©Ì8™?ƒòrÎiðZܾëÊS`VâĈLJ»—2®]S…¯Ùð¼>1 ª<4j–‡³éŒ°­]†æFÔ)Aj*édnŽùL~¯t¶ø•XäFz œ^ *z¶muÐ M¶ý$D­Ú™™O‘j”Ç丟“œ¦ÍãqتދՕ0)†‹L𓦜yÉ?¾'£æUég±$po‰»¸Ü]¢ÚcËnü@åÐC! s’§Ì¸ ±SßØ+d}Ô|OªyÏBR­;urn1~ÅS®GåEaiÙ“âðQÿµhÑýL’îodôj>ó,[€'úòH㔹©£¶pš iòÔ/w…û¶E¯ª’üO†*³\äz@¦„-“<ý¶;Ì»Fµ”œŸ‰Í¡Âñ~øW"ȸ¡P^ÉØ"¶+ÁCÂO÷¥¢^2î&UɬƇò'÷[ºãMÉ„³M•·ªY3‚¤.9 Ä—‚ªßH²’Ôî:Œ„µ-¤úFûðʼaµäÿ¢:S_H®&ïU¬)Ylì6Š»s÷ŠF°¿#‡åñUꀷ»oÔƒOÞ$yIñÎ-IWì’Æ–¬7~Þ½¤©öAÏiŸ‚µ^âÎÞˆݯVÂùB½Ô\ÊWBYS4‡8þÍ™¹_ƒ$ZEg/©L!Á]˜<úííÝÒ¡ØQ§LÏ–Þd4nݾjÈŒ^ÍþÕ¯ÑêL:úoï1-Boýa“¿(ЃX-ÝS6K_'Éï'1¯Ò×ø¥"^ê·f}âýœ“³JC•0‘ÿ »©­bä 3A¤ ï#z °Eò#Ï@îh@i»õ5©y³dó>Ë / ¬ Ñ­-;y½6¼hVzB„|z'~jä ‘,†îÖq¼Îø¶aò*íz(-;¢0"$)Cdñ%<×|Á6Y§¾ö”ŽÉô¹5Á›7á1Q!ÕÓÉ_ÕjyÊkj4Âì}ü&¥êÔÄ”¹Ö*=Nv9ËSsí!z¦ˆ¢ÌéNz˜DÒmJþþ‹²¦ÂÐÃ.d±üȘ­~hvÝ®;ߥ³K»ïvÄZ€}|fWâí¥t5ý³%n¿µ:ï¼e¶.§]{“U ÛØ]½ˆÒz܉:uÚУÄGåqa8…MdŽ­AOÔɪP†~XÅ·re‹ò>‹ÝÉr|1 Gÿ4‘²¢DEÑÔéИÈi¾má=gÀ á…ã* ÆEK2ñr*y?\'ŸçúÇwÈ|.™ü§“lâlm«R´KÔCøHæ~d»á iŽÏà -+·ò¿Ý3ìcáÇ„ö4­¼?:ê‡äáY¿QªéÜvÌÌ&5¥¶5ÉK–¾0‰7êÿé¨-ÉóPÀ?ŒÊ³fv³Š¾L|­Åèé&'íð¢=SH®`é˜JOW…¥CÂÓQ­e?©°5îÌgK~KIã3‰ú#†nÇ–payäË;íž)Ôiš ßìéÔˆç“b+1¥XÍcÀ­tšo£±px¹*V3qãã¤úž¿Ú8¨yó­â¼æNE¾OôûÞnɽŠ³ã›KBã&,à[Ôw†ç줊ÎQ¶ž \M/ÎXÍHÑ+ûœ—ûÁÞ¼:'ŸÛBAD¾ò•§¤Ÿ‰dã#WÃvÒ@W3xÆ{K¸C¥G籈ÝoE-ëž ¬3&ÇëOkÚܶð/ÒÞæ‘àέâr‹Ý­ÊÕíúÐÍ¢5SiÃí_)êhÈÆÙp°@ñÈùŠ7ع/°X§‡;«ƒ6X¼aE]$åG;\·.‡à±ôwèŸb•ÞV„èÚ—Äš€t)~uõáÚ1-,ð öÕUádyåõ©ö®½?îùšj=ÕÓ·ü…ƒåð*Ü´7Hc"9“ë' ŸU–+I¨ú,š¸óìCº¥ÍJú6gn§„s3í3Ã…zóo»ÈÜÒôv” KUð|ot§ÄÔúe«IÃÕk³ÿXãw£é(Œ\ô Ë2VùÐ Îÿ4q_d endstream endobj 2504 0 obj << /Length1 1626 /Length2 15958 /Length3 0 /Length 16811 /Filter /FlateDecode >> stream xÚ¬·ePœíÖ&Š»»Ó@pw'¸[p×nÜà4ÜÝÝÝÝÝÝ‚KpNÞ½gæ›ÚgΟ9ß®z–_k]ë^UMI¦¬Ê(´7IÚÛ¹0²2±ð-mM\Uìmíyå@@KÀ_='%¥˜ÈØÅÒÞNÜØÄÐâ S€•—— fïàédiná QWѤ¥§gø/Í?.Ïÿiùélin úûá²±w°Ù¹üMñ¨ \,@3K@LIY[FQ @#¥¨ÙœŒmÊ®&6–¦yKS3ˆ`fï°ù·0µ·ZþÓš3Óß\"Îc€³ÈÔòoÈÃäð‰àr²µtvþû °t˜;Û¹ü‹=ÀÒÎÔÆø€¿z3ûrp²ÿëaû×ö7™²½³‹³©“¥ƒ àoUeqÉãt±0vù§¶³å_3ÀÞì¯'ÐÞÔõŸ–þeû›æ¯ÕÅØÒÎàòpù§– ´tv°1öü[ûo2'ËÁpu¶´3ÿ/ '¹±Ðäìü7ÍßÜÿLç¿úüoÝ;8Øxþ+Úþ_^ÿ ƒ¥‹3ÈÆŒ •íoMS—¿µÍ-í˜ÿÙ;3{+Ë¿õ@W‡ÿis9ýk@4ÿì í_Æ@{;Od†À¬hïò·$€æÿŽe¦ÿ>’ÿ(þo!ø¿…Þÿäþ'GÿÛ#þÿûžÿ3µ¤«¢±íßø÷ü=2Æv€¿w øçиÚþ¿BŒm-m<ÿ¿‚þÓ[ôo´¢ö6Àÿ´É¸ÿ‰ˆù_ZX˜Xþ­´t–´ô•-]L-fÆ6çõ/½ºädciúËë¿F `deaù›š…¥©µÝ?pþÛ²þ'ü¿Tý <³‚‚Œ–‚8ýÿá¸þËQù︨y:üÅö?ZQ°þ/áŸ4¢¢ö/FV.#;ëß·÷/‹Ïÿ¡ä¿±þ—¬`ìâdéÐýÛ7 뿺ÿ¿ÿ’ôÿ#„©=ðŸµQu1¶þÝ´ÿ¥øÇlêêäô—à=þ¿]ÿOù_;y€LV—ìMùX¥¤§ºÔàfMˆëöõ°B;׫äùWÙwû¥„íð–½U35Lñ}´z.ž9¼ÈÒŽôàØPw'.s‰|(h{óÐ7©Ú¹é™ Š‘SÏ5#½®ä·¡t¸X4w'¾©½ÁOµ³;Á]ý¡õ§pËóÇúòè€âkš\ÝÖ†Q“vNòç‘z`txh°ûº÷€>+ž’ß×7ñŒ,ÁÅÓÈé¾ÞôúÅÛL}ÔÕAGvUŒ)ØØ–¦`V¹Iç—ÎÜO_©Å´»X]õxg«¨¨)jûX$þ͵úd®Vʪy``‘¬>&¬úE=¦çOT£ TèèÑ# 7 's ´,{EM M¸yfø)#)T‰œGÌèwA6ÎÄé‚€Z_NÅ7!“´ÃŸ ÎûÞSp>ÑÞ (í´ï+×#¨&0k…Zep7¤Q íË®x“Ô~¡)Y|ò9¼kßi®·FL†S s0`„ïùcãhGµ~Uî˜ðáŽ>’ç¿meó1VÍœ¬YÁ{"àNY®-a¥n%iÝ›W0n~ ~.á3?ƒ-ÎÊÓ_~H¢ŠÊÙ X^%‰Ëì‘¿9ŒÓñš¯styà0â åšafx{qû7q²Àw-©ò‡“Sr.’SNI˜z±¥êè\^8”,—0sŽ×Õ=\Ó;‰•"\‹g涔œàˆ3"~Y3uð ·xsù SÞ7TXø»bvÀug„«]0iÍNIàÄÒ Ï©{YJ³\ÀlƤØÌ|ÎêK{6ÔñÇXÍ?JÅ ø£˜Ê5d ôæÕ`^{ƒÖ™xò`]b2ÏÚÍàûìº'„VìN^·Áô?t~ÝÇ6zgÄTo›qK!úï”3‹ ~­K?½ùiAløaÖ=Âì\1f›Vt_ÿð­ñfó’Q•àÏX•ý+‡i¥7áü²5#“z4wzw^Íœ>Üì6Ôج•þ`ãZ#⤋v÷8+BÁ¯t5NÖ¾·t‹ª®1Ÿ:g9ûu‘=ˆñz²?‚©ÂùïÀ'ƒÛÛmfjK—벿ë¾ÔA.Å¿î÷áuàl}bî¦ô5’Y ?“-\d§ŠíK…z`Wü¯= »~žb<„–˜¬)Ô6¶W{HMµF*ðQ˜›7Ñc3ôZÔ·Æ@C.Q²œý÷Øú6”.LÇ™LñVýg¯#>ñüЭåTꟴãÐ]?V–¹È#Þ|‘3~–ŠÛj#kÆàÚ•àHts‹±®À£:ð×p°CÆ=÷u=­R9x33ô©¾9æÒ6`ùÏkYÞô<æÆßä#@$ñòç}9Þî$Åýâ'µ«njâ8™zøA‰;g–¡gýò–Fu†b:ïÍK.B;+¢‚yüæŸ_éaŒ/ôYVчÕäü¾9Àí Ë㮊³ÃΙ먰¼H“ñ³]íÜG´!OÚïI_cRnœWº?U•mü¿älç c¬œPÈ!ëÜß¾ÖÉ_‚oé˜Ô›~ d¸9Ñ_•ËŬd8z^f4j ö¸+­ú jZ»tô¦K}·ÎÀª* •fg ìҾȩ¹ü ñç°ç¦þ K aÇö”¯Ÿ˜´[¼½@1ŠônÙ1ã•uˆzŒn”ì}RÔ¸i¬xQ„õðÊò ÎÏÕ]Ê?ÄNÇó¯4ª-›î)Zc×ÆsµŸ8ê«‹^[GY±HÊåÉ FÃë…$©6=QùŽ˜¢P‡B¦ûÞôà”éæÂÙZ“‰òo…zpÞ–†kF-˜$çtûŸOèx˜,qðøÜ«ÚVc_$¡,ÔFw0äS­ŸÊW¡´”Í×UŒÆ»•;Ù»Œ´›ùÙúxÉ©¾¹§ç–rd!žÔýg™ø/ª½ëêâ¿ÕÍ–êr¬ Ôhíz¿¿ïû-ÿûfE¥ËvÊÕ.0Ë¢ÚœËgN„‚€!…>¶{«wÂv,]úyup‹ pÊ¡³¥q>‰$>÷ŽäµÜ×)½­'=VÊVùÁ¯ŸÆâ|Å“¾/Ûó\X?ãN½¬S¿MÞß³ ‚7ÕÇn˜—FÛÞ Ÿ@å¨(w"­¸Q…Ýï3ƒXL‘òPã ¬ZyYóQç̘<Èþ8PâÙçY°e$Ã2*®êôûÄ £(Ñ&tOSUÃÕ¼é®Þ:öýtõ+±89Òa«(E â}0£v5˜^çjï£Enñãÿ‚âä¬ï€t…ç‹õ9Ñï½J`Î ?Öƒÿ傧ûÎx%Ëhµ]g<ßýµÛ¨~§ ƒ„6äð«Óþ8B¬ˆÖ’ó-ãÜ™Áó´H@àŒî›[g\³ù®V.½©›‹ä“½FõóOìê/Å*2@+r©®Vê(üïú=a4ª¤¡¬³$…og¢Þt¾=éÛÃËáêašâÊ2oņ#Zí#ÅÓæÒ[Ž~êþNCÝÔóâ˜ÁŒÖG}uA÷,F§¡á±¼þŽ…;‡ÜÄüРöúvF;D‰‚ý{2 9«ô..fàžœâb¢tŒ×õò'©õ‡)·$~u*!fCp½éž¦y?ú@ÔSô¤¥%û$éLôKjø¼uêAÓjÆMy縀åªS<_sxmaÒ°Œ¤<‡’£ÛÚHÚÃ(ã’ÍŽ$E4“쌡¹2á<êèñ¾“Ø`­õRè…¼T;üfüq2""oyh³ÍÇàÒB]OÈœP~¬"'gÐâ/òñ¤ÜôtžZ ÈÚ+T|wèNA˜Eݯ™xý÷”¯u«]5Cà ˜Ÿ±G›¬¾å4 –]û±Ð[¾µ—ð@Õ`”0IV Oœêa¼ƒm>ÈBÖ9ý QxÕô¶!wT‚6zdöè*‹cÃ'ÄnaNxï솑u"]A(“FEÐhWQ % l”q¡ÀQxw?HÃP¡ðÝÄ/N¢4åîGœ(}I÷ý–øÅ6¶J3ƒóÓÖ’IóÑEQ½m§£ËŠ™Q0ò‚09KÒ×ß&=>k×ìë cÖ¥W59ÕºW’AV¶ŸæŽr²Ëò©;ÝêöÂc¡*NÙ þË/]tN±ûÇ N*Úä£ød'SDxà=o–c;Ñ•¹z3½\:,Óü*cÅNqL(.âr3úàƒÒcªÂÍÓlÎtçé ‘V1Q†™G)}•m$b!î<~_ïBð A‹.Áù·”"Î=‘­í×x~Ñ"Ö°,Çxާߣ5è¬_F I1úŽÔtïA½§fq‚“Ä3sðÇ:Ã7qž'Ä;òz\Ènîoˆý”†àФ¤˜Ït,¶>‹Þ+± r÷Sôæ)šs­`pÎV2³Ÿ¥l” =vÐÏ]7ây”EÄ)¯±nzüvÝ[ʺˆ„'qäQžÊ¤9Ì'ÓÔ÷Š|Z½DópaÒtÄ0!‹åéšÅcÔÁÖÛ€KxáÃ~Yèóô±u a§MÎåÒ¼O®làé³~ιw48ÃdÝà¶.À‹fåÀ¾z±T—Ú‚oŠ¡½HcË%col‡ã;ü–{h{X^5qV/ô‹ˆ±\C,šx¤÷áXþz31¥ÒúÆë ¥?Ër¿-lhF*"\„4Ðz…¿ZTsoe¨p_ÓÜ7 p”1ìXŪʶã O3s^ÛNÞ‚ÖvÊñ°o§å[O}¦Q£ÖøNôKºê2»#²GûôZåÖmÌízEs[ôÔ?âb|BOŽœîCÔ¿€ ½¦ÑÁBâ!Æ{h„<ω§µpün¸”_{Å‘»{C,ÞQ6< ³¨¡YìB9fa'm¨ãL¨]Q¥Ä2©s3EÌšˆ¯Šá‡ÚpèCŠžçÀá²¾g‹GF!|Ÿæ¥â YNƒ¬£MRµ§dó¿yñO×øXLr%Ù{@& ߺ[ÈŒàu×V/Â%‘s,d¸¿’¥(ÞÆ•C+mcLJÐäYrñdúƒ|L0ì³m‰¦怅R¹Óß}/w§…t­,Ö2gxœlú¨í õh‘¬c:‡øE!'à‰2w³:;KR“V‚üe9nje,­»k²|á*§Ô§˜ Ç|_lkIP™øf˜f£¹ôåY# ‰Ž5szxN9V.ËÎ,QŠƒloR­ýWw¬¾°MmœS…Iò[Ë[çÀÕµO@òâBë.Ÿ¤}Ô•lÄÝx*sÓÕØL¥+›5ƒX]ëTÃjÛy° C¢È~ªÉjn¤N/Rù$Õ·6yvºv2Ò!é °°Ý…v.×¾YõLvŸ¾!¤¬ßkÇ•±ø™F¢Ã ¿-DÐ9/ƒ×…(|Îçè>ÅpÐ"¹ N1Ask”ŒóÛ×Ù“QA?$*O{Õ„?$ù5h =¶…b×m—<°QKy{¸LçÙ %d äcãõĵƒ 1ŸÝ0ww_~ª©Ù¾iãô¬JÆàd$ZZs»@oÔÀvL1¹±_‡ ¤†äëB£šlÏ]œªÕD–vr©+E:sˆìRQ”/z x4$>m>üõ¡xxñ‹µ ÃPö6nn£!;(Å,¹«–‹‡ðkóÓ 4²úD!>1RˆbcÒényYEôîme)¦ä%ýO"½J}Ç‚Η¦l'zO8K ;Í­>K–¾Þôù®gYã º¤_“¤„»þ»m2m8ÌÜ‘K~JÜ |?,×GÀþÚ®šõj¡êsMy8YZ¿S“‰Æ¦áÜ&gQG_?&?´¥âvdŠÉ³›ø­‹äf4«×þ€JQÙÈͶܥGÓ7ECÛq&ùš]˜ŒÓçÍüë{é$'SŠŠ`0¬rf"V¤×ù',RqôHNäŠ UDbsÃw¾f°üÁêc‘ÂI›»”ª„¥ ÕäôÞo»×¦(ŽÝË7Ë¢;65R"9W*ÅŸ[(—äÁ­¼±é>²ÍÌA¸F©“Ý}ckìûKvVÂg0Êäã8¬Í_á%<´/ª—HÜ-(ì{ Xd$–ÀžO6n³ÛZ1ß0]±¿ÈàSïŸmõ®ç4q@®ÒQBø.HÓ^¹sÏeJ³da¿iÀ#Þ6Ë6ä‘][¥¡7ÌÛèw©8̹üzö’tõ”7A¤`y×myèÐ.B5÷tè .»’]à ñ/ñPïEã.zAG^äQxNñXa~´jD›ÝèÓÓeúR«Äp”á‘{)Eȇ2ŠpÇКä$Ý8{%Oœ"“oȶÈ)}„. É"ñê§-”è8Ë¥Þšù×€šÆÅMÎ1¨s08Âk„Óå:؈׽P&>§ à–?ãh ûêÞüò§A-ýy@t$+Θôªgo~a}¨x¬ûëx QÚi'·2¿73n Ÿ‘×L®--Í;ÚÚ8øÖjW¦5Ì0Lü|x‚ÊZÛH½¼­ ×Á(±%µçeêþû1jB'«I%—µÈJpg«äçiˆN5Z˜§öàËd²_.27pÔ nÊ2ÊŒËC(µï?~ëĶ$îàñjá€ãŠÉåGìD²œœîÓ·÷©w˜dhBO[’ó¾É±ó|í¿~HäUyŽáÔ‚pÕížäær•H0h‡|tk¸œ€À@Á9,.â^kv{hU‰xåMá6 t–ÕTå}rÞý¥³Àö³êõ(>ê=<•£>ëUþhäLu;t8Èôæ+«KÛµ –"ݱä vÑ%8É ýd¬Ðnù1ßã%¹g¹.¨¶®BåßR$îÁ©¢>s¦;mVK‡/õ@èˆß Uä+™ÊXX¬4›_3g ×FnfytWnbG%Ã{Eö©göIvÔU-žÀ»^¦wCÜî7³¬ªA‰šKä,ÍÀ¯QÖÐ0Ž»ê¯BÔÒ+aûH¢ íõOŸáÍ×r÷bLÁch¿ì,ß »ÐÒùj‹—ܳáZ(Ëèù¶3»Œc$¦|ÅÝÚo ¢”j Hþ0~n{öÕPrƒSN¨Óãq¾¢ºürØ9¹8¢Ê¢z4íŒ>BÃDöñ´¥­aÏIm ±Ê6I+ ÑfW>¦¬ Ùµf£«†Š¬÷W 3™,ºÒ›…ah1PäQ‡ýC^ÐCŒ r>3a똇;ØùAž5»ó©¼x2sÉìà ^ dàÀbMiõÍ‘1—¼X–3ËÃ<°Æ»äX5#b¢Þ/I¹~¡Úié>;©—´RsÓeÐ(ªÌ«í5üÝ^±ë”(N/Çß~´CHÆ®ëa¸ÁQÈ€–¨¨…!q!—>,Ê?Ò|³ÑAœk·gÏüy¥1¥w…ªGŠN(ÝsLúAlœÏKÙצ6—>Ÿ‡:𶫸ü}Êy)KÏ°®Xòkò¾ïÐ/_ 'C]„Gël9çAÎYF/ˆGÐ÷â÷±$òG$ °æ¿W´yeO£Frø›(CÊZ—¯¼TÅ–¸¼‹ÉÑ4%Œ|K#E¯½UÇŸxÏÀ°¦K¨ß•·ÀFÃ+ºØ~\è}Ј™’,(Ø2æJô~€Þ®ì˜Ø9ûã/B¸ž?ŽYÛ“}jJvQŸwd»æV‘£erN¯Áʵ’oîG¹iõy+žО'ã¡ØŒ‘^oÄó:šû 4÷æ>M[Òß;Ǻ+@¤mÄth<ÄPK5íc@¹”¢ò½Ð  `ûXRFvqr§¶z}.ÿ¬xç Ý=ca+Í"rñ ‚v>!kgfªÛéˆêlt^(º+ˆ£F%’ÜèYÓ{Z!•O Ðµ7¦ÓÕ$z111ìvØKpõýh‘[ú(UJ[¨(Fuš÷§L›wMy)_:ï',‹„¿ë“ñ†hW‡~C¿–b).±JddCáYgú(œJ—П³H&ïzÚ÷¦É[DݸáÎljÜÑË7ÿ'TŒÞÛ0ú/'HÚ?C\£y>·ð%ê­˜1]8pŒ+‡(‘QþŒcfÂJpíÌìB<ŒZä夅m),ÅœGM;የ3›bÌ`qZBŠo |³Âô5½êúöÚH¢®¤fÜø<-w~Ê9†|ó)¼ ¬(n0s‡ŠÙÓn‘Âí«‘ÜôÉ\qÝDZÛzS{¿xbHé>žºß¹n³á3j…æGrüÃge61BÛÆ~ã’ð'ÙµíT›æLð÷àtäS½ë1!âÓwço·v–a¹‘hbQ¦Gcdrp@õjàü±ŠËÑ*#ì8^Ì3;FÂ}öã[8Š3øn¡±•’îáOíd>Rô14d8y'üè®Ñmnèz&e|'yFÑäσí«`€xJÔ„^Ieáƒ@ž¹ñÜ…Î è1?õ!‚17¶J¿23fzç))VKH¿Hv‡þUZܺ:³FÜßc†Á“°sóÀ:±ÆžÙ}#@&[†BÊRèù›á&Z;¼rüñËþ]Q®t²ù:7SBåÈ:§î(kç~EÎk'F©u†õÓ¥T- ¤zBîÇÄ#ÂØ¢Y\ e)F}âØ”­²ŽäZÒÖßlçJ2…‡Ô~ÉéD†ø’’°‰;´ºAúÝ7ë\a8?ŒJ3s¼ðØÍžúuÈ¿D#·*.†”OËj7éE].Ê’ÿ< ÊÜó´©RFç^ñ|KþØÏu˜³¬¿½Ô%øqÆ)T‘Œ,ŸÜ8°T7²½|‘ 2P„Ò]™<ûqj¼½ß÷£õqgl•!Z7ϱ*âù÷¸à/x§"hLÉìºÐD9¯ÐÔ\£mœžÉ÷}ª}ç쌭ÚpH~~M 5CçHÙ«ôe¯Ø•yŸ!Rkק¯`Κ!®yŒ2#h0ï±}J‡)þ,‚:jק*µ»6~ÓE@ëgXí?õ+ÇS\Ú&U‹j¡XÁ0%Ú>͵ó#$?:ú}µ edLXU†¾ó ÷b QÂÜ&£E7ØFL»Ð7çƒt*å,¶ª¨Å|0{R%¬êÉ}ê âC-P gH›‹²F~½e7îª÷^Fà_òþB[wĺÎïž!k=w{[ ߨهìŒì}›í£s'C¬µIû£ó{¢ëŽž!ÁmJ`Z`¡êÑ™aí…’¡·H×h¶ìÂû‰?L=Fóï“Ü=Àz­AŒö3w'GO—£™»,¨{Ú’§SV¢yä]…Ýä$\Ï”HýÏ-úÜÕýºyp{†zUŸqL1ºRòШ…þEl³=¦’ŒøX“W'¦ÅhÊ£cÍ‹`'nYwkE/ºÃB–ôDuÊl3òwȆ{âOeã¯ÓKXG+Œ¸³ó» "ßÃ|¾O°Á{Àû¹ÎszK#¯s­áb‰ì®VPÅkŽ†Î §\ì›P£¬;d}W!øÂq¤ŠŽŽj“£i-V°@n7‘Z]4gloδ d"½ôj Y¨ŸPÕx3ˆá'Úà3¬Ê½ŒåuI(›‹Â¼™+žˆsf…!÷36M‰%DÝÆZÿ•7¹ôðŠ‡ÿS’QÏŠ¹bΈùÊò€:a–‚Ư ªösÂã3DÛ©Ðæê@j:WK gvuŽq*xk&)Ëêê'XF/Ò<Ñ"ƒ‹61r®¡-‘ŸñÈҪسNÞ—·É‡Žù*6U,˜a”ï¸Bó¼¶ø1óŠ–¨ÓåØ=ðTÔ~AG<[€¶>Ù±t*¤"Z~¼…v?au«™iYÛÖ j·1kM©ÞäìºÚÑ;¹p¹ôÕøúœSX‚7.ložó+™Z§hiDî}ëaUü«GÅÍŽmSC‹‹½h2‡Ä)ªO!’²Æj'v=ycKýx‘PS)2DTtµ2¹ß@­ð~»/Gʲþ E:äo Ó©+ëRQºH߶MÑCs\w®3ê3z¢4;é3W\«ªp-SµÑWsŽØí8îÞ ñŽñ#3ŽûSS1Š€áÍã«pŒg”ÅÁ¥2˜äï˜OJÒ Wüøík0â:8“6[§¼‚Ö&(×ù¿] `zs»p³µ½~¢„)¼HUX¾,ïSžŠœÚuPÀDøÝòè| Ôý2™^Kf·æÕŽ\1ý‡(xéj§¸Ë´ŸQeõrx«bú _~&ÔË:Ä “ºé‹ @w»|í&-ïæÉGuŒDY5÷—|…ýEÚ‹sÃWÄäO,obTX×ÔðÝL‡ç×îÌê©lËiGd¯KN¬'©:µ4Çh7U*$8àÎþ6¼6' iÍ篚^»Ù6C¢ðÎßùc—Ì&ÊíîWÖl5‹t þÕâkÂI¬;Ÿ„6º¤\ÞÒ$EFY: –Í NÅ üaÐK!ÛMÂà ñù¤dPwlº_¹“5X)F »}°l;_R%`|~ŽÝD¹A6T–ÆÚg YA÷[ˆ^”ÚìGk1WíúI¡ùŽL¸JEœìUm[ªSíp™u!>1 Ì4­ø§Ý(s):DÛe•žëúÅ¡Yª»¯Ú·ó۸γHh¼R…wй”²bùíÍ€*k?2#*œÀY-r¸†{% Â÷^$œ„;{Ä®_Jú â,o…kÎx~N™Ä,J“~L ¦NìùQô=¼Hì 7õýQüzn¾‘½S¬tS¦˜ãux¦ߤÇÌ©q.)‰fSŠd¶6Y­$(ÃÛ3+°Ã§Û|rÍ[œQv¬ ÑaÏâ¿ûCAòɳZµ‡”Fw^Q·¾ÌSféªí~ ÐÇÅ€ ½]û…eÕãqMÞиògRLWc@´ã«Ã+\ÅÏ9UÅÕ+kvŠfàçùƒ±8S.ô7,ds•Du9Q#§]Ý?VxØj®ô?ƒÒ,Õõ¤Ÿß­;8?èý Uy,E1¶’㘅ì!™H+òb7‚§Å—çä̳¿BíäסÒ¾“»0¯£9æa(Í*ËmåàëúHÎ…L]µ;F7ßãA%ßÆÙ¼¥£| 0™-C¼ÙT;ËF²ù(¿…ÌÓ(#že²Ò(Ëßb’^[V»hv¢w‚;W~±ó Vú&8QÈwÍBðÝI(6NÚ%¡îPq…ϸңM}wÝ®7Yl^™ìý±DúÓ±B†ó8“åªøKJ6šmðVž]p¼3jþ#¶u¬Ò ƒŸ'äcØDØ¢òjÂ×¢KÚ4¥í¥F‡¸&mX™Ã]êªSï2y혫c⨔ÚRÏ> z:¢î;ý=˜\D¤ÚI"žáÁ[<6#-;Ⱥ¡› —˜?AË•P-}~i®¥°¬êŠÃ‰•8i*ÜQªªçâZjØBfžíÅ{Qº!-â„8 [Byz‡DëÂXm¨¬Šõ°'XŽãçqMÞùí`b KÅÍ …`í@XôuÒqD¦®ß@÷ØæZmUQ˜í6Ó]æ0—–œ¡IÌÞ¤ÇÃŒ#÷‚£0Ó [–Ü€zò“`{«nâj[óÍÛå›4)¹Ðµ$Ö5®!JÍFëÊ66EB:¸ç´Ïgâ!Ôo0c¸ÓZ´É=²o˜2?ëI[qÝ@±J¾;gkïSÒè|‰OeÍÞ,ýÛDù¹fÓ[™1ælÌËàŠ}?ÚÛ ÿž÷å¡%Ar¶qRQÚ€H>æ{ÙÓ6„›ºôÈSæŽñcHΛÔΣ5Þù[¤àl47]?Kø„/®L4Ì“‹¤®pêy=ý~2V¿I"ÆP¡#q5ÂWøo°}ƒ„ýÇ?ù°½¿Åaê8¨ãG˜yIJ™|ÍÆq6àßFZ9îjdýV—È¥›žÅŒr&3¼¦ª#0™ð@~ñV…Ô¹:ʘú@£è»ka›íty‰„B®›ålcîvÜè5—¿iÐ &0I0gKÑõÖ ŸÌƒ¿«Šæ_‡Çw1ƒý¦ÞÃ@û‹Éþ™Õ»vx|÷+‡„PÞ¬(âA·u1wP†sîòçº-š6¯ƒY&lš°#Küô%ó:΄gŠGåŒÁÄX'ØATûùûcµoÏ›‰6–´¹”ºútp“‚`éÀÇE@Õç7G˜¿ùž/'f[#Tw‘³ÐJ—OÌÆÖç(r2á 5,Tü8,[_­»Â:Þ)1³ Õá+J¶Ðf´° K, |gß›t|ϼ§ƒýtÔ”éF©‰|ÞŸ»]–±¥+NTn‡•Ún£±LýaJ³÷ýÎ.ü!Ԅ˱<ˆjÐmçìŒrP?‡÷£Æ6TNÌ.òPßÆ”"XGÖ k0éÜóó‡[ãñÙÕW'ÍkÂ,2à&ÈKM«u=zvqGòZ¦‰q9•bubRó¥óu4;]äñV¥á.δH(¤s¾¶€¡¢˜rF9ly ¡o@W›"8¢xFKËN]=÷Üâq^io¹ÿ½X«g¹˜h³+ vj‹1à aÀë­[ØYŒÿVzÓ„a8ŸŸ==n¸ÇÈbc¶FÖWZÂßoélÊ'NÒ\ ?_úé‚’MÕb˜ÊÍ(JðUÁð[•ƒy³ïɽFŽ”µ.Òc¾-”¸œ3#LÜrüoK}¡Àzé-¾ 'qyó7z$pð-‚¶z D‡ÐyZ7íè"½+f©)‚†Òw“ðFJºMœû·)…¯ÆéøÐä8ðò›Uzº@4ÿËH—Ø2Ŷ‡k00½Õ\°U>A^•–1”2äáÕ E¯ÒN8ÉñÓpyt¤Ø%‚ã }ìÔ.£IS/^VšGm¿eWXüµ(šK T;ÉYOò°½ ™H¨ïê€_‰›¤+Oq9*êÁ±ªå6gÝ®8Äd€1n ÎCVQ­Ú‚u”僮m‚ôϦ(´6€÷aO7^ œSbô6¿Yšô’‡ ‚+¤¼Œ•òÑ8AãÊXÛ…ó.ìÛ‡DÚ'RëÏrÝç›F.aÎO=¤â¶‘.wp ¯ RÿÙåe#¥­¬¨¤Í’7:ù?{ ;öþ~½ßCx«—¾¸e²áTÈ1Àðúæ¾,ùÏ ×;\X …„d~:b}±™„ÿ¢9JQÝz?OÒeÊ!/T Ë3iEÎOÆãK'øŽÆóù|¢]W!Õ戞¹ͺӵˆ òð¥Ô8oâz'¬CüJ'FŸÅ­ò']Ê!˜ÑšëÀàpÈ6Nù¯Ý/±Ls@KÉ<ýhDGsè®âÀªí_üú ÔÔxpmòÔ  ÝXfíb"˜Ã!>5Bìú´¦·À¡i”ïñÆ3ÇÒ«í±5˜q°n,³¤>~çgІ†hq0¦ÍÕ.$  ò‹2¤AÐã©{b¥86ÜÄ'œ?óäTÀ|/%TÒOf†ƒ|-µüÖ‘DSÖCEñÕ|Ö Ñ£ÄÌm¯+Í—â~5À+º¸[þ9¹52ýI~åÈQßõ勘ÛøžÁ#á+ÍI…í·cš¶V·^Bèú!‡ÔfC…Ž“šÀ°•h>瘤r\]80BïSÈ‚pF™Îq¬.¬ýZ#¨EuTÑ1ʲ¹Ü†6ä£5~m#–E²™]Z¬Ë —ç(h*¼»óŽ©à¡Ú7d…؇<~’à ”Šx¹³)o\);jñ‚[¹ø<9íÚxÔc~WûIó‡3¸¨Éá‰Ê :cÙÔ|ØÇayŠZŠÁ#erµ- Á½.„’‚ï(eðCŽO;H‡è UÔh;ôzÜmÇ}?Hl_ÅÜ_IŽµ¸Öåj)÷ˆQÃ-†Äåƒo#r.ªÿ |FV»FÑ8w*2 ŒÍ]ùúN¯ÙÕ5dJ6¦ ã+Œ°fËÖlÌŽV½q Hø.¤õÙ^!ݨN37y9Ÿá?'¶Éy'ö±SFuÔêoŒ,ãÅËÕꦗGô7)ÔeĈBýÁ@}{¢ëRaÀ[ ¤S?¤O«˜ºg„ƒúA?ŸÏªD¦#ýˆñUSÇ6YϧXIÉûø·.¨ÊÅP}X+ø3wçµf^¡V_Ï/ûZñµýçA(üò8sKB”Œ†”æJß}oíZzɔܓfbd¹sS׎Æûç““$æ×çÜÄ+Êï·øÞžn²Òƒ _dÇGÇ¡¹&~ aÝ’g{z_æû¼RaÕkˆ?ÿ­Çq@%H˜Ð»7Gk½›ñc½ó~ß5)cwŧ¦&Ë6Ôa C"¤ÍäÇîâÎuë¾¾‘|<)¯ü`•‰gêÉÍ#Žãð2t„`ò¾xé|¡áÑv\AlÉe O2ä¬ÉÚ^Òá³´¨¨JBÉM³÷½@¯¢E# È̺ƒ`²«ÁH¬É¥G rO ‰ó}s˜o¹ŠôwáOX'`$·Çáý æ©¿±“ÍßæJ/Sžeþ~þþc¢ž46m³D§ÂKZÏ›×ð¤›NeÒÆ.ÆöLb?Fºæ êÍÔ Yÿ¹xÚßy…EZ6÷Á  ö*”ŽÚ#Ì|§ÚN{„cµ‘\dñÒVŒOßlÙ„ÜeáSéïpY㾕ɶ¼‰V³îO‚Í8cöÓÍeácQšÞÐE dû·Íf)*™¬ë[U‰ „gŽf'³xË۔ЬIÚšŠìHxU)Ÿ*Œ:üa‰–œ¯rùBL|Ç´g“±*qÒ#p♯J3¿gÒd¬ŒÜCsŸŠtÞ …÷‘=CÐL¨POž¶l ýBkK:žC<¥¼S˺ã|²ˆ¯‘Xî^ˆñYá÷ö~’©Ý-_wÞ\ ™¢»JÓ€ªA±ç`‹£,™öY™mÏxê‚A±kc0ALˆ“4ªsúm)ÙL›5¼™µ¿œæSK–sÕ(²$᪘C7øÎØZ$”£ì úGÁ?t²å×"­I°¹§E.b ¾˜r ­·ÑÆP² !è÷­{¸:<Ž~Qï{`j‰ù1/Áùû7º5õ=­ËOŒÏ/kz³ø úÙ«i÷ËçÊ{ÔûÛ¤l“úÅ‹¨ü–B@ÈÚtÉ6Ƴ@jÀÂÒ—d8x] ÙZb©›µ…[VŒ7äº7J¬‡"ö&í±šÎ“°“]SÕE´_PvÈìarKÜP&=H|[ó¸t‚_P¶3‘Ň8áU­ÛOm¦6¬ˆ%ìuW~}£a´íD½ˆ[fåºuLˆY[ò¤Ð ‡r]z†>UZ æÆ|ÃéÞ‰Å>(§àšå‚ùb‰É$üRŸÅ2Ü÷¡ÐF*–Á*¾Ö„SÛ¤(BËïýÑöl‰{§‹¤ÑËœ²9S Êƒ1¿ÎèZÇ-¤ƒ‡!Õ [„Ò£Dã‰q-B>üõGCÃ:ËéÉöÔU<ënÒ?1´Ú«‹@¯xœ5ï®›õÚ™ØÆN>áͶì3 w>Ÿj ”Îp–혭8<)þE)•SƒJØçƒX°^·þ”­Ua%tù”À'-Ž‰Î~£VÂ\…”…Ç!”Ó bÁ/r Œmpg9ŠIŒ—•aÃ’^šŸ«ìŽ-§f¼o†#…QE>}‰ŸsXÄŠ5H:‘ü­ .±‚X©Ð6ŒŸ™­H4ABYùdâé4DÙåS ÑÜ8%Ýè¼¾þœÃ1RèfëWÅõ¨¾ÝWßvÊn>è$/mNtÅ[ŸäùÚÆ—&Gh¬^²Ñ%« ±Ñê±=¿.aZ_–ëÙH…Õýc×,`ÎÛñËfõ}oZe»ûÖ·UÐĶvIw;¼É-ªú¹Žùí¸‡åu´P÷óµXÓl‹(#J#2ù=La)àáí62%fÿ å£ä£E¬šã7Se!Œ ËÄ1^^¶’ÒôUø«ï•ØÃÆ ¯×…ôkó–£ê‘œA x¼ª,ËË?ó°£½!#«‡qöèK×D¹?DÐ…ÒuDTð]ØM1Ôjôõ¸4gã"G}.ö–鼚¡â±?TÉL„ÒÃgÂí3’×ζð:x/tr]Œõ_¦"*†•¿éóŽÖ\ŸŒTD™5j*²$$qfÀЖ<À¨#P5J“90¢Æ¿>=úÞFwÉt+Êñ‚-GÇÍ'¨5’ ]…ù n†ö’<ñ4׶a傉9ƒ²6©fÕ!½MzðÖ³QìÅ#ÑÆË“.…§i]Ö9 KU\v¦#ëŠ,ð¾1°ÂþôÛg¬ûÃ_wt/ÐÓúYÐGC°ÚaâÕéõewãîŽjÆh¬M¢¢äõ–ï6tšÝŒ‘RbÜAØê£t4†G¹’òF@äZRÒÈ"m‰|¹…wÚ%l|}5)“Îok inó\ÍU‘\/göWŸ‘KæÀ}‡‘G¥LIH:Ò«u\ÒiÛƒ?;k\Ï»é:¼´þõƒ \6’ÄØäleù]ÆA)dõ4‚ó,S\Ñò.J šW#ÉfâU—F©Æiðõå“èœÓÒš]2G6ÅÌa_EŽs=™y çl<×æ4i¾9ª×5PÜåMÔ$FXâ/,Z½¶jóÚ£®šÅ©UFo¸¨é$¦5‚—V´¼ mSW.˜AÉ Ášaçg¶„ªÌ‰¨R¿fèr•]½ÆíX•‹¯QçïÙœÔbŠ Ýigþ²iõô¹M ǑлkŠ$\èÙ¤?´-T7œansú$² •|Ï[&Ô¿IíÇx Þ² &—Ûp÷¶73¨a³õmþCiý'ß%®Ÿ•76_?¬-ORþrÜ –öDÉÍÞƇ ðº“³,gæw;ݬŒÁ2YZÕÔE0F¼"ÿ¶.l¶8Épóù°!-ß‚ë¾)«qTšÜ]ø Á@#ÃŒÚHD\xqF ^…Eønä’O”‘²hgÛªà8»Efoø°ŒŠƒ‰¾0áÌÇ­ 1N”g÷`/ÆÃ&ƒpGÔsËcÍ:Þ–ñ²-–”lÜ’oÊdå¤`v2Â#?´ì„}“û¨'ãƒï \µÓÁ3„:(TÜ\.­±ŒÚ}ÃJbŸMQªÒ.äI¡ˆÁ²»;͹)áøìz ¸âÏç6‡PxaRx¼ÍJ󧲒•¾k ]ôüŽ’y~˜M#{-û’õa²æQ©CÍù!‹0ó£óõžEF6˜M:êž v@„–ÊJVa–üº™¦}½U?מּŠòžXþ/§ƒÌ#.ÂEË\¶¬Þð©*ûY ®Ø'ƒÒ®~ÕÐ%H1É´$(úPŠ51å굌ä~“¨û»ÙIÓ¸Ì,sÜNÆýSû[ù^é…|ó“úŽçoÑO>:­Ÿ;äs.UŒb‘9÷´–ô6¸·:ÊÍvDò{n ¥uaL22±›¦2·'}(¤k•b”F—u+¶…·|”RcÛÄÈS+°œ¨ ¶'ÑÐÅ^x…§Ï\¥šRéË%fL+L~›´ÞSÉ„\}ÛsôTŠ¨Ýik͵ø#­0èÛF4ÊÜŽ¶ï°Îr=µL¢[õ?ð|–ðbzñÖ!%3ˆâ›·ÜÇ´W°î”‹ßtíÙð‡œm0¤ïæQªxÙðª>fg¤ì³uD­¥Ô+Q`¥ k_½È‰’¢|€*F°GRÑÞu2¤ûÑ3±¹Í¸sôÆæ\ÈXŽTT±¡ï {C?=úö»_»+ú®ŸÒO ,”(Ǹ÷6ë>ïj •àÔ©‰e­EiÇŒÏ_9nèâ?Àࡲâ-º¦Fp2ßÙÆôÅݱÁ4Cª ¯Òn9k€wV¸_îý¹I'DvbÐ žñfLëÙöÈÅÈ<®mÝà÷Ü_ÿBœ’bÍÓ´`tÃy½Q½·-yÁVŒ—bDŠ©ñ„cç|'é”:,á 6ÌŽ±¡þ¹¦=>ö³h/i]̱ÿÆ”PT‚lX}^Nt€*A]† .+|ƒ&ùщFXB5)8écb¢°Ó¯ãï˸»0± Ybü%k ]†aM`ì‡rÂ!žŠ¼qímQ>TYãî\P^¾¨’G>v *»“'ð«E(3œ£oÞ¶˜œ_¬·za@î‘©–š$ZêL#"ͽ!vVílŸ¾ûgFšÍ£Té<µ+ÌÅJ¥ä~IÆλ›“gi03¥ÉÃ1Fx_Õ7kƒØl»a‚rxœ™¹¾7D‹©99ïPA2=Q@ ÙöÛ^øå: üx“âÛ—³ÍìÆ–€9oöÞÞÕb2\Ò(úÜ­8}÷m½ð¢$OÑR±jÝ"ž¢ª>¾ ¯5ÇP@’9ÒÀ. ‡ŸÆÈ€™U ½‹ñº¥¿9[O£æ¾À2¨…bÛí8 ªƒB˦xÌŽêÍü½"€¨nŽ½Äûõú€›n^¹IÖŽ)×û›g\æ¢-»§Hèæ0¸@…—0ÑÞrfnE.TQE²S¡/%Ó› RàÃ/®‡‚Ô/‚ÝÊòãna6gÛvŽnì;¼. îslN’#N##öWƒ¨yÒUøáæ _ÊÁ2tˆ|š8Ú¦$ú[L?fj÷[|éO¤À jœ#§ó‘™¥i£¢Kª%DeW¨7kÄ2´ËÚë ]•Bm‚§ÓïöpXé7.]¨±ˆ6)óMå!RŒ¤ræ9×*9ÇÔ¦"G’FùôEË2~ !(öýX&S>Ʊ¾£âÙEÊ/‚½.¥“}PبÐ?‰.•«2Ü"¡‚ÛæŽþDÁaDRCS”:˜|ÅCúI *Ù}uÄ9ÆRÂ#Ò†°èçÃú‘”¶ì0êÓòz°#·Ê½.gzÀZ[Çóæn yz£äVb8«vI¶°I<Ïã^ƺnæ$ëåÂÔϺÐmCš¿oÇÁÌIJŠ‹ÿ}ä¤ïáËžZÚý°Ò ÜT'z)ŠŸð›¥™‚6ú›ÂÐKB¿ùw 2^‚K?22—7;‰™"ðŽ:ŽôanánbÆ è¨f!Ý«ç;mä¥ô-­9O¥JÿáÒéŸW^uHmM‚ç°9¢AÝvCØ=2sˆo´¿Ô²Éw°ÇÇÐMóÑ>ÇüZaÚ £¥RIØvcÆolåG`Å‚…ãzÇz£í$aÔ€?ÚÕ†øŠî= ¯ endstream endobj 2506 0 obj << /Length1 1630 /Length2 20880 /Length3 0 /Length 21729 /Filter /FlateDecode >> stream xÚ¬´ctfm·&;[OlÛ¶Š“'¶U±mÛ¶TlÛ¨ØVpêý¾Þ½{ìÓý§{ÿXc¬©kâš÷$'VR¥6µ7JØÛ¹Ð330ñ,m]Uìmì¹åèU€æ®€¿zv8rrQ' ‘‹¥½˜‘   4ˆM,,fnnn8r€¨½ƒ§“¥¹… €J]E“š––î?5ÿ¸Œ=ÿÃò7ÒÙÒÜ@ñ÷Ç hcï` ´sù ñ¨ \,€3K @TQI[ZA@%© ÚŒlJ®Æ6–&9K 3`fï°ù·0±·3µü§5g†¿XÂÎ#€³ÐÄòoÐÃèð‰àt²µtvþû°t˜;Ù¹ü‹=ÀÒÎÄÆÕôŸþêÍìÿUƒ“ý_Û¿¶¿`JöÎ.Î&N–.€¿Y•Ä$þ]§‹…‘Ë?¹-ÿšöf=MíM\ÿié_¶¿0­.F–vΠ‡Ë?¹ŒSKg#Ï¿¹ÿ‚98Yþ« WgK;óÿ¬€à47r2µ:;ÿ…ù‹ýÏtþ³OÀÿÒ½‘ƒƒç¿¢íÿåõ?k°tqÚ˜1À1³üÍiâò7·¹¥ã?»"mgf`fú·ÞÔÕá?ln@§ ˆêŸ¡þ[„‘©½'ÀhǨ`ïò7%€êÿŽe†ÿ>’ÿ(þo!ø¿…Þÿ7rÿ+GÿË#þ}ÏÿZÂÕÆFÁÈöïüûÆþ#;Àß;üshlŒœþ1F¶–6žÿ§¨ÿê­ üw¹ÿ0i£¿c¶3ÿK Ó¿•–Ζ@S%K €™‘Íß™ýK¯ng t²±´þåö_cÐ331ý›š…¥‰µÝ?$°ÿÛ´3ý¯ü¥ë_õ3JÉ©è(HÓþoì¿•þ.‚‹š§ÃßÚþG7òö¦ÿSøFDÄÞàMÏÌÁ gábþûþþÄÍÂöã“ò_@Ìÿ)˹8Yz¾ÿ훉ù_Ýÿï?%½ÿ#ngboúÏ꨺Ù™þݶÿ©øÇlâêäô—䀿]ÿ‡ü¯½=€&pë+ö&¼ÁVéY.õXy#Sbßû™ÁGBÊšÔŠ ýkíûüÒÃ÷¸« ßëBšgx>;<—Ï>ŽdhŽÇú1m(ûR×ø?H© Q¶)º8iõË3.4£½o–äv!t8˜4Ž÷§”UôKß¡fºX`nž©ýIÝ ýÑÉž¾ùš¤5Æat#7ƒ Ö_P$>?QŽ ÷ÝAáÑæÆÁ’óaù¦œ'»x:ýn2ù„|sãt®^ÎnÓ¬EIRw÷Âû³âJDö»‡ÆœqÅJhþ% zÈ$´b'ë~ ËRœ(@G4!:«&£ßн"}±Æ±qÙ(À“nµÆk ÿ«9jE2´˜}çEƒJHjh)K'4ÁTJƒ‰ 9CY[#Š–“­W\\à[”P½ÿxeò¾PIŒ~—ËBþ^µôŸ 9Jô#ü–àô1Ì¿Ü#;ò1 i[…Ò\D?A¿©T°Å ðá‚¥n7cŠTN[U/Œ¬CB ¦·Äö Ô¹Ë^’³¾á„¡HmÛ6ñDKç‘?ø<¤è·õ}ïéMgD\4œ=l–-݇ñlÑ–ê½)—…ˆUÈ÷eKѹøø¶d\7ÜÜL÷=êTw¯ /»S$5«/’ã ™— ðtÆy@á&¨^:êiým1v¸UfôрќÉæL¦V ¶ÀÛ¥…ýݬñ¥ RÜ,ÎxmßOî}z Zô˜†Xr•ûV~‡C¹Ã!¬›[Ör|~^ éaáòG°k‹w (–ö|‰®CS†ÃÖ¬Töfj¼E±±õ˜I-f*(šÚ´@r‹ ^…Gž›‡šõΓ\¶ò¤=PŽ\3šWÖ‡¶¯FÒ”´JkØOª±D.G¬†ÝÙ6 ´Ü Ä£ÁYùÉÍ#Èù±P‰UD ÐÊý[ Y éAøªXó¥† 2’ÕÔTÛ 8÷@Y Ì4_aâ½îê)Q‘>¿æUìèšÍŽÕÙÀÎÓm?ZØó>nÓ\`ÀŠVàR¹Ø™éki @ÜN t\A/÷L.D÷¯ýXìWØýAEÞZ¨Î’Bµè·ÅÌþt}].ÌJz»Ÿ¼Üög¦Ìd[Z~;°‹kæg7;ÒƒAÛb¬õ²ÅçÓWM'‹Ïý9:¦¨ÕLï±½áÄàØJšY`3ŸFº±>$Fe¾Î\ Zµ˜ ¢%;ïe’ßJiã÷(*+¼œÔêh°½f¨«­v‹³سOW%Õ°¨3srðÞnu~½Å½¹K^dµLƒRãõ;³b0onÿh”˰§›ÃÁ]‹b«g§e·IJ÷]7âÌÒ6˜ŽqÀÿÆÏà g6þã\«,Ÿ­i®ît:ðÊŠög¾^ìÑ»·³ðÄþú3¿=;hSVµ9 ;Ih9ƒ¶áÑ\TÌŸqô¿dGlÊàc6ךøéƒOu¢~Ÿß·l™ôâDSÒÕYæ‹Ys„›nò°JÈkÒ˜¢H™$q*¹g¯Å+yPó»—€j…}†g¯%ðïäñB€fï­’ <©à÷(®a(ÚË›"½ÊÀÃùJ fö „'Óíþ½+dûx©¹P§õõE®Ôô]\Ö…;—‚†}#2U§MSÆî· »S`“Y½åî$-] 4ô©…'v›úÛ($„6ºÍ}.ñ0·”ˆ3í6,–p$§NÞÆž½´ ÌÓ‡ [PB~žÈ¶V{Ð<ÝFdM<©C±Æž|¹âá™à:<…ßîÆ1=‡1 h“3czt£qáîN„Ð#jì@;ùZ‡ù·î›hÞˆ#ÎîZruuhÌIC´ØØÉ<&QJý¡,ôÑ^:jÕœé°á¥¥oÓ¹;Øž+Äî–z‚K eµXÀ¦d.'ec±aíÈ£¾ÔÜÄàÓMO$îÂÀYõô£Kæ¼q4=ŸòWʘQìq)Šƒÿ f0ïV~>ò Û<0p«PàƒAÖuÙÓ¼}]û |p7îÃqożú ¹[müF'möQ'ª™CKߘ7ÿ­8õÙJG4T:ÙØ#Ë“‹§³Öß›¼es©Ã™8ž‡#=bÛéHâ2eŸÔ¯/ä7”bÀ½Ï¦bV/YdŒD«!ˆÿ5¦X#½˜êª®\(ä')wŠq¨Ne`è…ÞwK—¤ÖJ·øŠÝ7Ãr›Ôœö&ÈåNßnÆŸqm5Q&³h\o÷­4ãκfÄ)ÜZs²@[Òa—ý~¬C¥Å–¥ÜöuA¤ulóbêtóW³3¾âKp–7ˆÂÒ„Zx¬‚a³WIÌÖxʵ¹îw3’üÐÍ3âôãrËø¾Š=[€º¬| –0 ºPÞvèœé„pHT1zÝ;ö⎅q¹$%X=“Òå@”ºöAÚÔÕVé:ic¿7ç©…ŽóÆܳE:¼Ë°_®÷t Þ]d:Ô­þ¤[–N*híûôÑ;ÆÍÓ˜eéo ^ÔAôõ\‹;´ázr.ùXïÜ&σ!Cb®tʃ·±°ÍÛHÑ’ínÍ4O/¢yPÑâ3¯Õ¬¹?ATH4£R-\y&lÇOÿe.ÒÃËM[•Ö5až,ëΪä2[Ôš¤¯ŒWQ‘Î&›Ù‹ÙV9YŒtgÏ)Ô<,£]½Cv°©ÇZéMÔõ¤¶Ëy²7m‰CG‚ù)+ü¿³ìÈ_ˆ;2Z¬ö´q0ÙÌÝ5s§±ZÊý0 [XV.Bè6£O§Ï¢Gí½2"m¾ÐÞÙ çE ’°?ßq1=|M2éüÖ‹sãÞtâÇg—â\²i"´iu‰¬sÁbl.cÂ’TÞ »ô£Ù58‘• ¬Nœ|"BQöè܆çRMìæ²nšqàüHÑfAÈ<1Ò@7U™3)6ü.§¿=ÿÌ\‹$‹7øѶåŸÖ¿^ÿÊœyWçU»T®›”–,~:\ѳØ"ï‡çé5ÃÅi[ßø¤aÊÒ^Püî!ÒEj(èUx\xK H/òÀÖþú‚T/ÇÑ·ó­Û£Ê _Ö¸³žÌí)5)i¸%ïÞˆå›8r/õž"©M÷hd\Rʠ┬¸Z©~±Z/Q ´†ñOÌætňÞÖÊÙvEDªhó¥ð·«˜¾¯ÄÞL²Þ%ѳMA‚óVž3…ËÑZ q-ŠI©!Õ³réŠ@:w%ïy`y' A„% ýƒC’˜” èÁ{^œ¬§öe"1i×»(ÐœT;£´p„O´Ë&<±–Èä‹ÅwÍ‚·8ð6›óóôÕ nê×”›°»­¾3;åG¹¦6|$UÞ¡Ü»ûCm¨Ùl†/o¦Ëœ£ ˜kž.±p<ñCò·çÕü6ý!ÊwK0`ÛAa5>$áñOÓáëOuÿü1 ?˜ƒôüHÕ©ö“WlMKˆý¡Og]L»Ô ÀAÙ†ω†¦‡ ϳ6ÜCãóÑ)+#¬Ñºï÷,Aé4m}â.£Õ!”¼QÇIïü¼€ªl&ra¿yÁô¥5\Ì›½9÷˜‹×"“æcÅ\PiÄ¡\taŠ“‰‡ ‘Çì-›w1%“š°×³mÈÈ·D0ú’PÖêY#âÍÞvŠÙÇÏÒuWœ°¦„‹<¨`~D¡iM_}dßn13t§Ècå7>Hïäc. ί è€Ü·£b °¡ ´(‡Ý˜ Wa³BwVß‘ö|fˆbŠ‚ŸhŽç/Ðc+\óv@Œ¨$ Þàî˜CAÙ¡Ð2D/ÒyYKwX®«?v¸F/ y9Cm|YâD³ Ó(ülÆÞà–ÍhšGû68é\86 ´½Š_ÉNvù;Å¿07T/+çyi¢”ŸŽáy'–âMHÙrÑÞ‹CS•Š8ý{{CSáFØÔ=¬r+É&$ÑŒAûŽäm|¹tÆuAØŽçpÏúŸr$ _öxw…Ž¤s€ÞŽýâU Šíß»K.¡É§¾·–xŽå•òl¶à{ŽzqFRï"rCNB~ ]_Í9õ-‰\Äﳃ–åWµ„Ó†Mxø±áÈaé°—PÙE0âh»Hæ¼ê˜Úq-í$A‚‡{ýxÁÏ¥ö·¯hô'18q­ÛâÙ"€˜m´Ë߬KãñxpurÑeš(;Í9™to"°ùsZ•Áñ©Ì¦@Ú¾­cnW¸ûFÄú¨ÃjGÿDGmo 4¡§Ä>ØÚéùÏ®žŠt5¼ÈãؾµQÆö¡™­VÕ%zH§urèOÓ’ô„Òˆ|yó3B•USÀÄPN81‰Ú4B2l˜ó(Útdqfõê¢ìe€‚ûk¥§‚fú“GÉÃ:32ÇûÃbfr}#o: ºDž©Á¦S˜²±{ŽZZ$<-mEk>“bX™sD~&G©áT:“GP"d£¨´rÅاn;ÖŒGknKÉÍê¶B³#Á¤XvO°“°Ò\Z3w„%ÄÒâ%?Mü¬Šk…Š_4Ÿq~-Yé·ÜXÀó×é÷Lô!ÁE…2ž7˜™!ðÐ[©°Œ0˼vTþ«4Ør×z@2ïÛÛ°íäQ!2*ir¨çì_-J@Ÿ„>fÌk³Å'¹«j Ç‘ëÞ(Š ˜ù¹Ň˜SúAAÚiLÙx±íA.§¹il*›í–S©“ Œ&tt&ÃbÎë¼°=£t !EAâìždt&¡ÖqU„ó…ÊÄËœïé!0ô&Ãdé{›ÿ¾Ž‹é¼½{³ GW:ÎO´œ/†Ð·êÈ eB÷›™ºÈ§™[¶¶tãóÊJ°G3¯|>Ðð¹¼£ù÷þúEv¹pxjÑ3c2Ò˜FÍ¢0^ŽÞÌHõ=àïÓű vâ+ÍÊ Åð?ÆUo^>îZÙÞÐL²bG1·¦ÅÔ›'ÏÀN¸¸ÌŸ²Ï’)ød¸ ’ÏÁ}Áè)«öyÕhОèî£ùn‘E;ysLK6 M­?ëÖTw àgÎòUW>'Ö´»²jàïBKq¬#ÞÛÅ<3¨š7ܼ¢çÚ¼*+ÅO> ròÔa ¨•YNj9ÈÑ™€E›â‘ênb­e>rÇñÔ‰‘ EüjÞ””Ô!¤Úà "“Ó×EÆg“²“k2Wñˆ«HâX÷/+ýuWwÙv?‚ŽÄc=ˆAVµ mWUzŽW‹”apòÊEÅgXV°»Û¯ZÎΤÜ5ÇL½û«Ùé„[kݼæjf50g×ÎÃs늃—…¯ÝÓ²^BÏ´ÃZÕðÙ¥"$Õ©ö£M¡?d¬N+rï©Y`È)qÌŸØnŽ?lŠ¤'ëêÐ$¹üMßi¢>ðûϺ¨s'“—ª“÷G/®Ã˜§VD~x=÷äx9„}šrvt%ã=’í7'É:a­x/ºÌ s©„67Ä Ùšö¥Zatäp»¯•àz‘”ÐM3äwBÆGA¨oÖ¢»õk}1ë Ê×€Zøíu-,3[ºé΂¢úòéüf¡ìè'¼\½ÌÓ¶ó~Ûš›¸ÇCëSôÊÐýU~b×*†å/'px±ª"Ú4ø§À‚•<&ÈúäWX‘sûìÆõ Íb&¡¨wšû§Ÿ/\^øñoÓû?ÜÖý›…ŒÌ ‹×cã‰XÛËûÒŠÖ~ ȬäD( ¨3NÞпò¸ÖCØxÊHr|kAýHAT‡›€!BÁ‡¨Ì®H0a7÷³¸îäW‹¤yó÷¦ñû¾“Œo÷IçÑj=QyEgH|`þ:KßrãÕé, Eb츯¯ N—y -‘kH Tô±40¨ä[¾ÀEÂ{£Ï<ã×Æ”Zäµ!=ðËÄÞkW‹ºû­¬Õ郅7f3'~¶MytÏßwܘif©AUî)=(1 e‰y½=29r[2êº4ÍN\ë0ß~TC¯âQì´À”áã>oÓrŽ8'Û=;Zèž™‚¹ÊVñ•Ôô‹ÂGGá{pÔN›u˜ Y®x”!–î©£oÄäL»Ò‚j4Û·'tFxÝÇxûŒAÇÖãŽ_è+2>NœTì—2]Üeµ“C`(ØÛ hcØ}¿wXé²AÎÌÕOPÃQ|p;ƒœf÷Ò U¿/œs¸î܉©&–”åä >2û„ˆÎï9bw¿+züAc5ŠPêP]¸Ô³eܵXG‰Ä’LðµÊ#Æ' †§Åˆc®©–hå뇿^Ôà*<ÅЂ솊iÓ\yÝ*¬Uƒ B¹ò · UÆW÷jB;Ó/oÝæ±A=OÃ\qø“0NŸ—!z¶ÙTè8øbVX‡–êbÝt;zêZn½t«à33äjðD̶›edm]º<‚½E]Žt-(¾Ñׂ Ý4ºšN÷:%*„_}¯wPe&è±t†þ±Í-ýfû“²†±_£¼-]µ‘‡™â„ |Lp¨­'{Kmð‘‰êÅv?åbâ÷EúâL÷è-®ãWc<áBŸöÏÓ¯Âw©‹-*NÞ¬‰0‘ŸpZ’<¬ÍþªAÂz×WŽiåBO?Íw0/ßëN–CžœZ¾¬;æEOa,J_¹gûÑj3UÕ‡%î'­È˜äÇkYqñ+üî¦Ä$6ÅÏìµ³8`ò˜ìš+Ò,sì¢äµ$"d¾ZÿpH8 ÎŽå\xHÝR2ˆ Tx€†Tu·ºï¯¬Ôч$~Jlñœ,gøü±øÀ-Ÿ®£Ž=›4¨U`‘šLc¬¨Ñ\zŒ´c ÃS6 Ç÷íÜÎ6jA–(uQÞlðsÅæE¬9¾…SHƒ½y®¾Gn*è1G†c”¦½9 ¼‚* µ1zpŠ§UÀ6~$£/J5/]ÔÑÊŽû©¥ísb}tMµÙ¼¹Î¶òF¶æµúbüÑm]Ð8/N¥DÝ»àfŽáG w5!ß‹˜ü½-E>o ì±"` A7̆ ˜ã" Ñ¦¾åïÈbyv+K®ë¯Rþ³«2sÌ8qì>zç4I$ìÐ÷&å¬Hð7ê”Gzª†{R8IûFœJ!Bd–œ<ä4K«‘®†ÒnLŽÏ´ÒŠ*Ki„Ü]”7”jIØ0‚Î2Km ©zÿ$NRÿàœ’/• Ž#^HÔÌŽÅ´HíÓ%ÆKÖ²­CÈÔfŒ<à«ÏBÒÃýEëçmbVà\±7©âè´¿A £ß¦árvö¦B”æÃFè#w3¤B‘Z¥µò";Qù9ÕNªòBüÁôtÕÙŽÜ÷ìžžÑm야ëdc¥¥×\.¸}7?Õ¶(22wg £Nx¶G·½TˆK5©ÑU ?Qùª7„©dÊ Æf‚}rýÔUúû]‡Æk²æýÂÅ(°µáHHtûªaj¿bÊ÷ ËiÜoa@9†­œìŸBÜP¸ÁÂû]¼É5S\µ^©Ÿ6Ï é!v1 Š´‚\t<®½¿=KÌ;›ÜD7<šÂ¼l/‘ Z`‚Œµìˆ³Õ/ÈzÞW½‘ô‹XR™ÔÓB*@æ´Ð„ 5æ眰ÔÈÃ2þwi—¥f<ý>¶ÿ¦õäõK+{OëÀ‹Ø¦UʆÖù=_a”eå1(˜lW²1W¹².ö(ˆHʼn“²;xr”SUê^y\ºý`Av¤iaZ#,[v+J¢ûzR²¥†t.pJŠsUñ+sQUÑXmeíR©à°ÏûÀ"­M‰¼TQ ±¦ÐªÌ}ºœêÊløžæèÆÕÓâ('^ùZµßlÌóH‚Áaàšy „¶26v©Jši}+‹¢m_yûö3¬[‘ŒÓpI¥Y{ó*S¨á†ÇA‡5¸.éü<äðžKȸKE=—1jãÉfc¶ò“cŽÈËm[¬­PÅ$Wk?Œ„¸íû3š:zI‰E¼ÏK0û`ÕÒ§ÛeÍÐ㨨¸Ížf¢¥Ï-%Œ]ﯤˆ·IÍJ<;ߘ ؈5ÚLà„Ú°Q/ïŽð™Pð$½j8Àòá¦è§ƒð‡Ò@ýa;oŸ ) 7ÂTƒù#? _.¡š» &*gØÄ„ß!3>ÇHˆÌ)«‹Šì'±êÍi ÇJ öïP¢·Ú …I!»QfQK†g%~¾¸©ýG§5ä«qæW¯O G [Póf±*0K¼€7MK[èöí ¡yš$[‚îüù߸_q|ž4`ÈÅð%M`$$¡åéä&±;u"ÙÊ³Ç ^,§ô”pã>“|Á]$Yß•P}r T¥Ÿþ¼ýéÂÜø9¤oq¨~į=âåè’RZ½û38î;¥"š  _À ‚¨ØÍ=ÌJ߶pŒ¢U'b¹úL̸+ÙQ± wIGÕ—Œ“ áÿ:6xõÍ³Ä ¬¦Vaq`샸%‰§÷ êp/±ö3æ G'ÓóÎÿRFì(­ìu²®ÅÃ,H‘³1ÉgÿC'ü"´UôP Ó$wŸ5B‹Œî’ /í©ºŒ²Q3ÌáÔZ¼)¥Cy¢Óë#ù§íšØ—*TV$í0%ò¢p8•a¨T°£Bõ'i7~ÇQ /)F’È,¬Óâê/“Á9¦…UdÏÖeΌ㟴tcɤü¥V;Ÿt?o<ЖÐr¸s#)ÛÉÓÚ¢ÂíûlcÆ=5Ò@™G_káÖÚf¡ I}42ñ%sŠÒ%åè Cp@SšŒP–]?$)'z„g%F6­ïÖ2š%qWfˆ ~'/£'D&¯)`¸yÌùêkZÅ "ß2_áUå1[Øm¹úÏPL¤´¨fCsù*nÖ±®û¾<é^RÒ2¨Žš‹*ˆ¾YneÝį|&¶*¼Ë¨çfÂ,úª6þÚñ¬Ñ¢òm©3DŽàØôþ$Ø?øJö:øpw,`ðÐuMCš“H¸f \Nmɪ¢0Brò~µ©ëwøÕÕ ¿ë#š©‰é´†u;ìÇzÈMÚMƒxòV’Iš‹«Ç'i/†¾¢rb#pM:{‡H§ ßÛ¦Uò%]šœ` r/PaÈB}3…¼%ò3ûónƒD˜¶[ø´mY®K߸ Ì´ ù„Í” 6¶±öÕƒ› ¤vÑêçC¥D°fìP˜Â5´CØzÿˆ”™DP¤}‡ÃjËÚQ6uèÈÑÖ æÕ«X"ÀDüèBß!$á$ß½ö†¾»°ù w ‰¸¿ÿá€ÿx´F¿ŒG5½6uvv˜Õ ¦ ÊÒØ0@>¤-ê•4šPo‘ÕuVTEˆ´Ãjú]ŸÐ¦\ò#t^éõµ|Gªiœ/×·²3^M­Nûl»Þl¼r½8\Ž„F8"víPh´S@Y¥(ygi°ªÙ¾ôÄäÀ[ýmaàuøhû¶›û£Çëã˜BëjD€Aû'jgp2Îâ0=ÇgO‚¯Áp´¯n.ì9sŸÇ݆é„Y(v²ëæFÑ >ÙtúMžœ[„åj•<&|ˆ×‘Ì=û#ª¯;ûG¤‘éÚûYŒc|Ÿ·xó‹9×m¿ø™ÖíÁÒ Î§4@¬¿_±ÀŠ‘uksgE/h ”«Ö¼µuŒn? ò0¢&æ‹å–›[˾æHù~ ®yë3ù^NìÎEö·>~ª¼$µ4µ ©œ;T{„Ý„97’ô9å2š:Î>uo ±%IÄÀb¦Š9ÉÛŒpÛ?FûœÈw Ç_Ψ"çäÉlÃ- ›B×2§%•…3»ùíâ|º®S·Mòª/ȃ…8núHÖ¸e£«1+W”»ñR.¿ô<Œ8‘Yz¥Á˜¥~d…yóÐÙE¦ þ&ö¡Qµ*t¬f»vàtr}¼œ~üLžD† C.ÀÞ›ž¾6øÌä«÷ôFÆ8‰)uÛ—õ(TùT Ý©ï)0]‚Œ’àë¦"s5]QœHmþõ(–±†žÎ ­ ™ûÅmLQyq|ú”Fnߥ]50ª²¤½²}=ìIë–‡¯>š—3õ:©rÏ!mü¡Ÿé«`2Çô=ÍV·s®„+ßoB@ìZÿVÀ[f–I&P—+¨Øþ¸_âÉõ4É`‘4Ÿ“ˆ‚c•ÊCóeÙÇä2YŠa2yBV—ÿˆK+ ÆO ¬*%­ü©miLi»Eî@9×ÑÒùîj•‰çHäy¿"d^±D÷xÒü‡Xd‡Pƒ 6e…›-¨¥W×bÉï©fu)ÔîÙõÝÓ7dJ!ç 8y{n>Ï@Š˜µNR—zÁ½ÛrÒ‡¥üèªNŸs· v`]ÔLJӞ€Øß@“à­“úòæe-ñº¢ÈÍCÿ~ŒÄX ŸaÆBÁsÇòü«É…}¿û!iRÂ4ïåš½‚×—²¢ÛYVuV®é¡ð]ˆ²Ž.ŒGd€çË™f*«÷>”áGÕõÄøw$øç4±óAµ’†¼E?°À¯þ÷gAU¢'#.‚ñ *­“„/VN¼‚f¦ '“H‰3¼³‹™÷ëÃ4ËxðÏôM‹s¡¡PêoÄ)$dx33-t¡‡f¦LGŸ?³%Ōϱ6—ùÎ>ëéUŒ¾'}­&FÇÙ’5õ&>;ãEÁø (˜l–ÑÒXxŽ<êı¦º­ve¾*ö¢Ö©…/5=¶P—I*" YX²±ˆº„P€±eû::{&©cÕ0Á…Ü–„h¼ØÁ½B×}`ò4~uÜÈoè%jºÆ"﶑Y&þÇ'z\{ÞaÁÝ]Ë™‹ptV¾?éWq„¢¼JX[H4tß´éÔŠ©8•[’Y©¶FJI.:QFV À›ãtŠºŽ¢ÿ¢viçÑÑM´-~ûöúMRˆ®»ÚéÄgËv.«Êñ»»Û!%±Yu?Ú”úmQ¡…6 X~Å‹³ÃTÀñ@È&ƒa|kã™$œðÅÜ”­c¡éíæÌI€¥ÁÚ¢¦»m¾¦˜Àím9É 3eÞi×&0‘Õ$/ÈËå¦M«MÅw,˳n#åF)Á&-ÉnÀº÷¾«üôWhui”4j^oÎQ d“|·–™GFNßSÍ0>v€ˆ‹¿9ßg#Ÿ~þô­®ñk[¥Ÿó:˜S¬¥E•ëÃÝE¼Þ¶1+€qãPSмӘÃÕ\ÐïŽMTBÌvZ€Ú2+žj´ë V’°;"» -1¸½#®ªa§‘Íwntv5æ:0ªfhP8 šÐ¨ø•!.îð‡9±š«uBw³—‰äv'ö¥ƒrËFíòÁŸP—\ÌŽ!ÎÉv–ÚûòWRs3 L"HåÛŸ$Q69~.QÏEaÉçy“:¾fòŒóxb¨ ¼›ó[Sé¶"i$Ø>Ìöy0;¡ÂÛ'¿ÂÚ÷^™1úºë»V§ a^çPÑõ-5‰äò,ð­ öN)1›$"›‘+äX7Ý°$ôc–µð²l6?(þ/-œÖvu…bLí¨fP¿­pŒBÒ™mÙ”ÄürÈŸ«ø¦ækRÖá#  ?K‡vŸBoÉJ†–`‰M=i¸½pËBµØÖƒýRåT©ņØZ¸ŒÎ¾¹íà_ÿùшMÃÓeD± lÄ-±—6ã^Îh1N_@ðÞs˦tÇ‘µ;rÖóE%r§TÃÅZŠjÊŠ9)÷°I} ÓÉQxð$+»ÙÊ*Â:ûÍ"ÌÊ µ EkT1 ömõƒ|ºƒË¿P¡¶æα¥ßýh'„²å껯ä3l#eî¬Óþ¥gÑQÐÖÙô_kôOXϾU±Ž-x¼Å¬òQîéšVT…„kfo®ÓÜ5.^Dç^šbF(ÌÎNPpÕ Ú×ñÇ7Ý[óÖÂ%¿XMš‰Ðú1‘³U;Ðæ,PÍE›ô*ÇÖiH‡¿ —+Þˆ?SS½rTi ai\\ féUáÇÞ¯ë#ô²‹ôíÜç]<<åõ`– þÒÉ ¨“…ȪB<ªz,w?©ökF)°È~¸†]!3±r1p®Ãß¾ð*´,yÚ‰üqP]šÎ»nY‡4zѦ ³ š•:*|>#×:öÒù9R|µmÑUa¢}}Oöáñ »‡9|[ã.TzlÆe£m:ÖzæE$›^/ù¬[c¼ öÓ=Ø‚5 |C‚ãîÉoæ-¯_‹È-‹9›k‰íM69W•6ã Žþ;‹Í¶Š^ÊÝ»¤G÷Ý¿ ãvlé·Çt»Ì3ñsÿLØ`ç;Aªº…ÎtheÏåmg5EWý‘níX¯d¢'‡b»ÐÈǼi[/ùë J±Ù ÄàŒŽ»Â!uG;‡¦ówØÅÒΤpÍžs”íí–žqܾ”EÞ ÔÚ, 6º… ”¤Ìo~{å°1ïdÍð‚¼2‰.5à°û:vB×ðžú^†b;Ä>ösü¦!ø¥‚2àœ$š£&³aÄ.‹³$|î·UhOõgƒ­~ö«eš[@y8ÔØ/VÂÜ‘è„G¿Ãøp°K®ª%Äô(иÕâ~ÀýÃ@LélK:fDy÷^a˜rhå,I‚+!=Bß•~ ·4‚§é颦Øõ–™}Âï$X˜hAKŬ¿êêŽÜà^¦zt1ê2¢ô4CŠ^Û2j+3Í¡·°®D½Iw˜29žÊi•{5KÉ+6®3„—äcyp¸óÐ:ø³4¼i_gi!£§ÓÜx­SÎ%A̬Ùø ¨qäc¹@h•)CÉpaȺ‹¸0G³®«øËUæ ×®H¯·r’›VîX×¼ÓlU¬*HñõtÎcÃv•‹OÓK‚Á¡·d¿¿í„¼VJ•B2¦ùߧ™Ê„ ƒzì «%³S š[àÔsyOž:ÌIˆ "âN… ïdš"ͬ·Þ¾ß˜5öpÞ:U ;}í†Ä$;ªÓb«D]NÚ_’ãDŽ¤ FúØgNÎc yôp—ös•lkT¸OJ½´Sf&°“ÆÜ|HÔ×½E¯…?f8è¯É!#B/¡\xŠçwlÓ4 Žæ0ÕËGH¡Ò$%Òål •€šÔ¹tîT`5D´Åàå§C‹˜ ɳLží·“ÀoœËG£hžQÒÁ.(qÝç)S-™Ê¤'ïjʱ–Âfé"œu%'¬›¹ªÉ/Í.È“îz†)ì~X°gH+¢±0ù¡Å£p-¼ã×2Ò}û#µ¬(dd¦Ô(}ãN`¥r™mk(vkœi™TñÉà ŷz#,ì+«z5rÔALÚšD½3çúìQÐ(õ´@ºõW´ç|B— Kú| ÞŒÅÏíu÷@Ý·HĬðêWö§ÈDΛlpú¹ÉŠ2ŸK†R(ñ«Î¾¨ñU´‡ËßçBy<ƒ9øìF.íe‰Mì“1NiŸÆY$t„yqŵ "%úÏiÑCÖ|Š›é~—¡ïw Óõý>v¯F‡:³ëß8BÛ;œ¾¿18]—ûâÚ\kÓÕîºÏÃ……XBQÔ; ÞoZÉ¥+›í|<ÙÊÇn­Ð  ,¨}¨Ò¶”MíÛ”»ð¤ïåZØ®FÒ…wdZ¹É…ÌÛ?Ž˜Ï9"óždQRkѶå PÉÓ·1)#­‚¥ÀëPÕ£[—‚MÇs†ÈÞˆêH²»*( [ÔBj—ø?}{Ò_l/Å h…WÝœ ¢¸(#S?F`Ýã|dÿ¶Oj»SyÈcw‚Á¶ÂŽÈ¡0ϘwÆ­ýbõ e­ºzo˜Ê5ÆÇÉÏmÈçxù¿Nhæ±IüÎPó­;5;rõlÅ`ѱӤyîœyN«'ì,;’àJ7Ô”‰˜ ‘yávW}î{çÉÓ1 Q¨»Õ–ÁЧ*=Àþ&3*ìÁe›»z· Š3–öÈwŸUŽb6]DžŸýù–žÛÞ‰À8dJIPHŒÉÎ%íÎ/, Í.ù¯i âíÖ“#dÐÛóÙ°Š@D¿Ê õt³ºnyE帎tyï"Ce ·ÑˆJUÏÖ¤X.¾< ÌP%ß‹Ëo ‰n‡wÏߌˆµ6V[#Ô·f–Œ°ÚüÄÔZŲ¼á0>aS1¬[9‡3¼bã€{H9Ä#›¸=ÒO{v¦Á½õ¹IItuG߇œœºì½üKÍ[¦æa›-“‹ )Ô–xG¨3 ¼ø‚¬¹²ÏDZÈ{zÛ œÀ ‘”Œ”nÕÙ6— µ­ý’6P9°º„@»Üšèª3Æ.ÁU4|Ån`(Ì"nkßÀï©á_qÇèDqïpý vi?ieUNÎtü”ò*6= ÓÅd DˆgNý†š®¥šx/M`­2ðŠ95èy.…àB]ú¨­w‰=0¦²Ç±©¯l?2!(&A€D{tˆ%c2—>%1êÙ‚“$Ã{´è zh!\»øÙTzTtjc _Ù'YÚ28»*É`NœS Ó!•¹q]*#¸“­~/”]™Ñ¶êtú~Áv»oe€Õ¸Ò¶h;G…7ûœŒZ&F¢Œ,EàsùTÈ/‡Ð³;•hJ…¿ÛQUÔìAbÚ‘éÎô¥}™Xñ°…è‹Ä$çO)¢T Ùx4tÁ½üH$*¤·§„(Õبv·§Ó‹å"ÍBBiývì‹Ûè¹]ÓºÿJÝKæii6R=+âV!«¦’5)ou‚|,Ú³a\ðòÅm‰ÊYp‹ÁhÒ6S|)Ö ì«$8禕ç‹T¤Û¿^Í ¤XB#¸ªBȃxÆx°hŸ¸¥ó»‡× ŸjÅf€}kïý±€ÝoŸë:5Ø5ƒy*Ôé>ý™Cí—¥8=ݨܗêØI^ïkÈanßžÅÏ Y"K¯¤ÁÅ&øÈŠ7†CfKÄ„„¥€ ê SÅÐY=F»—•uµW¿Æ™ù»uŽ”¼z1 ¼Šÿð-Óðp{„H)x<0¿Pÿ6ز ŽÊÖ­¡Mg‹¸þX¸×“ù­©ýÏŸÀÇ?†'—6~ËsìÂZ‚Îü­_Õz<ß´9¾©‚ˆ ŠnX”ÕÐøi{?ñCf%à}ó´='W_ä%_õuÍï­Ç ¶÷ 㥂'‹ŒæÕ)½¶õ™tëT°smW:ó\Eà™G—t‰PBÞ¡êëb=‘9“T’ '¿D¾Å‰ ¥â~ç§!v•Ô@í¥=逯l›½¥åÍÀðiŠUÕÁqä|9SŽ‘NàãÚÜ™#®^´‰¶¥«2Lâ~^'Ü縼ÛN„iÏ%óORp#‹†êïà;uæGÞÝüÙtÚà¦EFàºp˜æ{o·êV×ZGv‚_­ïz‡ÜgY«q‡cz/~”w­¨/DGŠšB ®^‰æp£ƒcq„Xz«íÃÀ×$ªWHFÖdŸ X4i)ï Ô:œèämP ·Dj*•[§ÙL~˜/ÒíÂ|‚é@·ˆÍKà`€C0£¿>/°üªçÊÙ÷ŽJ‡ÞÍ۽Ñå㙥ý>û œ½4EÕŘ”ŒŸIL9¬þr⣠ó+Ú•À_ÿ»Ö5#WR²¨ØDÄÒ{jl'Éعsê¸ê±ÿŽ~ê·ûfgħhqÜ•qÄîØØ?&Πy#--.Øäb'Ÿ»ÇÖ– }$``о4¼¾¼‰AÊ‘¥Ã¸ó­Œ:SŒPlÊíw {z\…H>»XÕ @—Hþªß¡HÎß`-fô`‹’ÛÕ¸j5]f‚gyN“£¸ èØß7¨÷A`Ϫy2Ë6–qd(2³$eÿYðÍL$ŠÅ´=lä•Þ‚畇™]D¼"oà]`îa¡~I µ6°*î1]8Ë4ã`ù"bbfåîà3Þb ²™œlݬ äþ ŽOe ‡† â ª§ÆMüƒ{ÿPòI2gVƒ€ŽÎÉ9N]0M‹Zcf=Ìnø—4Ã÷ “×ÑÛW–bë“'xÏæ2©RµÏp$Õvµ3T¡ #ÙÄ”ÉY{œ«„VÁª8ÀPçª_äB¦üÔé¾’5R6®]´' ¬¶ ã^Tx¦kÍ<±¥;¢°­¶÷ÍF5{Pú,©\öƒ:´5ŠûCy¾ü¨öh6IB™]ˆ‘c£í#lÄ–iœÊòMZ3Fo²+û;z2Ë^l£é•uv»ß…‘tUïG…å{R# dŸã|¿Úñ¯Ñ^=8ãê,O”½VŒ·@#|t×M©cZ‡!¥MFÖ 0…ã–‚öz\ÉÈ(þâz”s›®÷Üü…„&ÏÑßÖ§×W¥$C›‡ÿŒ\%¤è†6b¬èÄÌŽË\ÿ#Ödë gG‡²ÏˆS\ 55wÀD_Œ òë›üK6¥oígÏ¢Œ˜ ¯pIsŠ˜äìx·¦>ªYœ>Nwä[—€e­Ïë.Ô/ÎpRt¦k|X¦œ)­måßêÅþŠ¹ë‘6z¨C’IoÕˆ¹#} pÜÞµP^iÔ²8# ÀÐi½Voä4X]ÓÅ$Å”¢Ð‡ÔBqL°%GhÜ#Úá…pwSô)âöó ËU%/®˜Š¢$Ê.±¢Vç‚ù¸Òª ,£qåü¢e|¸‡¯–“eÁÎåYJZ±{j²ç3lsB6ìªôª±ÙƒÜ?#9š^äwÐø_LöcFÉ”.죪>üen³YvÝŽrþrÁÁ„F>Zö&’//K< !ËǺČÑøvP–ÈHì­ Ûâm')*U»¬ŠO«Í»æ ¥3ý…Ý^%/› vCåëxþGl’7ƒÇpBhߢ~ɪr@´Ï,ÏÄ·Z<¾2Õ/Þ &ú-¢Px7Õ€;âŽJ7÷ˆ×%EÛŸ$n”†ì{¡²Þn`ÍBûóÂI–à6{þ D°¥ãÏøœ¶Z€•‰ª„#\îÐóä=ÍéëÝDn笡ˆ+LºÖÁ½ÅÌfû©ÆýAps»>S³å–Gñ²E˜ß®ºÂM –|¬£{Ôrå˜/|ø3K"Œ¹ÜàA<ÖT½xÑò:Áó†ÿ"üի fj- d!©Ñ[|çñ`‘D…šóæB¤Ú­Q|¸î‡¨á'§Á­l;³jÃ¥œ#náh5°(.ÒGýHÙo‡f{„xìÉSHX ™À}诣í8»ÉB>ÎaèÎN¼‰Š4“VŸLáÍï {5ÚƒÐá|ÑŽßp¨sz¥ç¡Á²¯è„Ö µcÚhÅ\ðM@÷ ½žÖï€[Àߊôé¦ÍúM÷f Z­4ÿPýÆY§2™(6$z«íJÒ!#ÆJáæ)Ë+.ZëåÆgÚ'UTðù(_oÊ®²ï®BØ…^áþ»áœ¾ÓE"È}µbÁÒ n€ÔX½ &¥ VèæˆHfí^æ bú¢ܶzÔ„r…²j‚½µJDJˆ(÷ýGcúÝÊ› Îí­¶÷«d«o\Œa§‹Ï oj|Cç¿ž4ü4ÞÆ6–& v…‰%NNªùBùÇ%œ:Œ¬É2²‘;º’3S'íÂú<‰égˆkÜÍjóDV”vµ E7´údèïO:–Ë¡vLèh RÌm’c¾òi/7±Sï[移 ìwÁÕoœì†ÌþG²!A¼`Ͳ%Ëô ÇW®k|.Utþ îuca´ñ1µz½©‘Þ U§M 9UŽÔQä¨d_•ÜÍér¿â¶cj!#6 ê„”'r0Sô‡-‚„‹ÃõçV}ŒntÍïû8°§ SJ-@ÝÙrïÆ¡F¦Å‡ïí…ÌÝÜ|˾^\ž.Èœ›Õ¥Ã„WÕ%o:Ï#›*?\¡½ø2ê³!¬f¶Ð¯ð(Æ”k{XaI:àTÖ©±VØžvŠ,[”9ü±[a?VTJâÆUœ.&aþ0³!ôe`òðS–™ùñfÅ€ñÍÔ|Qž#­î~Å +z}q)Ý(‡Röð{]EÓ É­5Àãùª5u˜­2ßÎ\#g-{8—¹Ô¤›“/à3b ùŠ²ëcŽx3æ$©“!±’'îÉè#;(­Z`‘ö£ô~8úݲʀôÏ°+Z±jŒú”z œl¸ ¡°%1ZÅ.cË@ˆo‚DÎ͹Fqd^V)¤µQôlûXQ|,>ëð¥âÃÞ"çò4éµÕ¹Ý^Є–åe*0¡pIž`xbŸ×R%o3Qæ!PIŒÝað˜e.2£dòh­²€Šì0°qAmÎQ<ºvËœÿšÄÒž Ö/7Ú²ioÃÑ;ÏEàÔÇÉ7dLH|"—¥Üñ-twMé¹¾¥4£ª{çP·ô+TÚ“A!“¢¸÷yTúb„›øS¡²®./:«þà%-pUÄ‹ù²4i6²«ô˜ÄY™IˆÇ‡tÝr›üRXRÝ9×hOÁ‰˜¤è^ö‘몭óô,}äþh§× Å‚ž±¼*|ïíÞ7¦f|s / óS wԡ׎ÙYpà”†c"7)Ô?KeÃR}STéuçBÓI¢zH4Ÿã¯¹A¨ƒt6zK‰mŸûúã…ôòô |]3#K/!~É HHâ£â1êò~Áì ÿ.æ_Þ~wµ@„Žnª½Fªð†6–ð2ˆ•P˜_qοôdÉΠÖ8XÌn]÷4U)qE$³?z¯jþ³¬³ÿ…×®”Ìé”f>í[u~5_ñ#UCÚ‘në'^Ô¾ˆø$”¥tàxŒÑ'ÙÍñè‡Èæ°^_™Õ óïd#~'¥÷rïã99ž©šéÖe·gª9Áo»ì!=G#¯©¤PíI纋H ÏÒ÷os?ºžKy¹„Â_úHæTÍ«œîòõaCé­»b%QüªOÜR}õN!ìªr0Ä8pµŒTaz†÷±éRÿ@È~WøUw[Þ»Ÿ²Œær•Å×ÜpÝ!Ïú~UAº¨6x¥ËÖ-Íwÿí .Æ# Ò»šï¹£ÀöÞ¨x$›²3Üfm]ÚŠ‰l.p5ɽ´¥< KïËiæ‹Zï“!Œ³Í2 ó§ʲ"ïœü«ç¹ñDpQò„…¯ŽˆÓm\²”~ߎèºÎãY¨xôÿ äìš…Pæ`áPPï5õ»Â¦©ÞÔRÊÈžh'Iy MK­I{lú›À/®„è™Û{䣉õ®ãç³çèÄÈÛñÎï%k¦­Èía(Rˆ \çni×·„®€Ñ÷íû[I«ÑzØëþ 6ЕԑùÏ\ÚŽÐ×ÁŒ»Gd 9"QÊ[½ÃÿqŸñy#³ì߈Ïi×­ëì*NA¿AÂR©ÙD¾0éÍÙ °÷âÃ2½Kߦx ÛöÑ }vš‚¥¡*—‚Äl—Vçi:ÔNôt¤ÿ®uÈ{Ž>Éu þ#}ÿ¯ìEÆñݹP<Û‚žƒ†Þ\ï[Uü«µÀyê6Ûé8&6ÁÆ,sã°ü|ZMžlÂD“ºÆXf^_8+„õ~ç SxLÊ‹ Ú $ª’¿¹p"|þõÍ~ä¹îèö’4cEJRŒ¡Êrá¸9 +Ï´éeä¼>ôòf0à$k)ß B“õëj}ñ‹ð 7lxnÒè«S+ýhïzñ—ËïV–êŒ5 êÇ»{ûä ž{ˇ3šH>¢ˆî[¢›S£Uw°|‹ !›  Òá>Æå ¾õÇKµFaªQ‰Ñž °‡ƒžýuPýž½¼´Ã® ÜpÔ\7©H{…@w{ůÀË«ÔÀ}ÂÁ]VÖ½›¤ݪ춟ü뢇,HuùéLýFÃ×-Ÿ(f VÃvËnÀD¿ ¹!3+ËmÄ&·¼–Q÷úÂ×ÚG3÷Ït†ÅV♲WѵýóÅZ‹›Ï×fª8ÕØB:Kƒk0¶RЇܶ>–°¬¯Ç»D†ç0¿Ô°nÞ}ÈÃ,m¥0ZàŒ_#ÙI¯ƒ¬»BNêñèY_ÜX"šÇJ†nyH„ñâÆeEã¦az8ëè]ƒSfÐ$²S»;y•±Æ<ù!šác&ÇÑøÂ^ï”$>šIäFF>1ûÙ?iÿyP„ žÀÁÔJysÚi(‰¦gqN««ÿÌ'dÆÜ£úÔ­DjO£º•r R]ä`²×!Aöv^76²½V‰;=®pöÌÝ,_»î˜ï¹ZEM¼ò¸ŽšîB˜n±/<ë­«q?B AížÂ[x´É­0¼E –avGHŠsXEæWŠ|D£]¾i*¢•HY“”dö¦ÏØ`‡ƒ3RD#ì|.´%‹J4§Ä„F°‰Š‰ªø–†ƒš=xîKQ#¿ñôKœðWSO¦x …©çBlÑ/4Ý„G/Pá‹5Ì2Böž^šg#ŸF°D—w ÌÌ ö¹*;S¢åPÉB4L.®\ bº±-$vÔ®DO Èt"[“›ž tG$<[’'~ó®îHq0F˜ÄZÎ AyC”te2°`dÁv–¿ñœpM”­SÃQÈsŠø+&êl/Õ¨aA—Là’ïcëm¼;È.ò$è Sˆ4«!da±ú†yLPe¶ KüæC6hä.?r;IJaè½ý~1G“á ‰¡ÎåÛBû ¿Øø \©vå¸üü¥ w’F›)k´{ͪÖæ–!®ÈŽ!ÓLý½î®”²\=VÐÄ%BU<¯z9èš³PÁ{,p<Ú¸ºà¨cô0b%˜fGÔ 7‹ŽâQ_öµù,ð…SJpl·?aa¤‚–ÒÉ+°C×”u¶3üβ-(nT½¬œÚ©yn¨«)Ï 6"h—¬ndŠ4Y’¯™"p³>øÕì)P,§jÇ/fóŠû_[8He9ïÎHsÊn\<úûNBmtƒXóYiwô/‹(ÇOBuÁ…¹Ÿ@)˜„qøˆvˆ,µía_± "ú¿áSHvÂES—x%ˆIK"PÆ –}ËÒÎpÖÄEoV»ZJÊòñjsC™f‚s:ž(öYÌY‡rq Þ$~Lj L‚M3æ UHô;C‰<Žß¡ÿwò¥ b‹R£~ĆºÓU|ŠY†ÑËÐFßj0q~ ^Ò뫉·Ÿ1"« Ú>Ñ’æÁç HULÐL»‡E¤qµ!ä?÷†˜Hee¦„2Þ,¡'¡è—3ì$d¤ƒ1ÌbãóbPõn,r‡ÝFVé*àRø¼…+xrßló›@Dä¡ Ú$så^Ô97GxbÙXÑ¥jy¤8™Ð쾘½KÐÍT)b8¨Ž[“ ¬¥SþØ(~R^ÂRÈÈWúm›‘ãö/é-ã|¼NðÐ('ßò®Ž©²×c ªÁîfâµà1ÆBëK«×`ÚŠíùÂEêBÓßü¸M@¯!¹®ÙGÍ_}Ø‚Æs,2.?–ÐÌÈóÐYé¥aAò[¼¯kH§·pµFí¬ŧ[©<äRÉÈ!u­,b#)U-«$¤U[ÈËÌ"|@š´‹OÞn+¨B¸d-:FG$òÒv·ü8®®¦¡«âŒ| Ñ9´àñÀlñ¥¨Ý€)£†A‘sèg9(*€í€êPÔRZ¯Š”ŸðCÈÌ_Ûܦëœî€ØhÝzöǺ L¹» µ­ ¼Š©£Å~ÜïkVB:†/ W?ëó­–Ç`*– â`—³ô«æ÷ÆÀo‰°¬ç{=†£ˆ4h6½È>w˜.tûÇ*-Š–¢A0êÓÕ‹M;ÍB7Ç….ìk7ÍŸk–¨(c±Ô@×YY'Å0kH@D•à¥>7o¾ª%uÄä~ɠ滊qbB½‹gVôÐðø‹)·dK˜uëºÎ‚BÙà” ÇC&Àwð¶Åèºò®²ö)ÇHt  ;ø=r’±Ú'ž!"uñ¾š´uŽ4_¦†5D༿)àLiÐÓu>½´iÈJ´ø8ºdÃ>‚P!»#Ä™+;VÇJ˜ a òysÆå?çßÜÙòýc*u³üP!g@ÂÃû5Ö5¨¢Ó¹é”ò Úöwýþ¤:>5€¥¯d:Íþº4 ¦ÁWÕ”É0e¦ £ñ¥_;_µ,ÌQ+)ÂR¹gÎEx¾P‚¸ ¡™fóžc†+è9Ápcå3ŸýÝTc!/ ëöä˜Õo4zCyi³S|~^ôñìï‘cXí.±‹c-Š)ž ZÒÉò*]îa/tõ#6†U”Š(àUVIe:¥QF×¢ädEÇm~4t’|WiĽthðn¨…5¦0ÊQæ<•W«\UÎúûq±uœ”O÷.Ά*{ê®AeqË3Ÿ;ójãø`r'dÊýêƒf®£¶°ŽW —Ӷ̙O)atøkMeg@öÒÏlvH5ÿS¶>¼AAÒ -ј6çõQ¨ïƒV…Äg]u‹íX(¢¼îþç1I罌ƒ­h¦¹Ì6O*:ƘÌC´µ&b‘ú5M¿âªš§¡†=Z×X=z10™ÕN<+¿‰6ÿùã79ˆU•iÃËoHnžgRð%úä€óD3‡£¹hÆÏ ¶¶ð’äU<†Ùß1,Úžçåf4¢ç?U-ˆ¤3°5Ðòaº²¡m Ãr ¬«{vI0z 5A,’¬8q}#ÃÒ WZž†mo¿èÿrù%PÇàÅÛUCðw;äªw~Øø€²ÐnñžlMT˜ÐÈ\¬+)ïyÎí(M0æÁ,Nè‡CÔ1³-‰÷ŠÔôót’u~ø8™Ã}"q’ÀÔGhî£É•¹!6 AAÖcMdRQãxtDQ G¨'cŠ»Ènzÿ0Ü­LìJNi«ñX&CH}:œ¡n¿¨JÀ®¨º7:pj‡ˆ6S1u+üIáîà°Š¤nâHZc›Üå.ý7äËú–ÍÈFßçgßàXÁJݔͷ£œ»ãç] Øc5"¢`ºÓ-l–BYìaÿ ö]Fv²yž7ðŽ`e]ršÐC킆~SI™Î‡·®îc^ú³ìÜÕŠ ®Ž úˆh¯4Ùa b865xÁLyzEnæßVEEd¼Wqåx¿ž›+AÀ9Ãam">ÈöMZbVq^cë÷½ÙÍš˜¤Ñ¯«Ó?¯dä±h ·¨¹q5÷({²º»_ð£üä<ó‹'.Ç´2÷æ,È’ä›íáã/ØðŒµf<{£z ±È”ÆZ‰¦9Ú©Oïê1Zù¦kî•ÜJ¿ŸvzöòÆò×à—:S¬Ÿ×¨º{Eð(=ºô õ _Ç…Š è>q<ÖÂSôÑ_!’åሠ»Up èYG5‚¯]£#96|šrðnbÊ¡>æeRÝ~äTE×çÎSBž±,'‘µ2HHu ¾Î8bbw»£x%"]㥠œXMü‚ â¯ø]ñö ç\tH^©šÖ[Šð®Å¬ñ1ÎAÄãäÁíU‡LÓ¶áðÃfwÐå¦IªaÜ‘ÈjAýקã¦y!ML£LRÁ?ŒE½¼ý¾N†cb u,ïó\ñ+¥%Nù‹FŠ=û3Ö,la;Ó–ÙØ{ô$7gŸšŒk‹“5¿äânŒ˜¿§5¸JŸåêþ©h2ScÀLùìÂ|Üý¦‚›ÜR ºÿB$óé¬{+ƒ#¦š9"Þ’Ö!óËH@øܪ¥ºøâ@ò¶?3D$ÿ/É_“¬0²¾:¦Ö`؃Áúˆ"ü©yÈ¢ø÷Yn6H ’“®*búÚhÄå *YÔ|7ì4Û eRîg jP%fϹ1^æ|í%aìM{Œ5,ÞZm²Ò¢»j œ¢€´)ŸŠ_ûCØÚ¶‰æ¸Éá;³oR‚à¡mªteØGàé‚ý¸ÿá'©wSº¨]Xg©WËcã’z=B#Ž»,½œ‡,àщàá¿Î])ŽÀ ¦FumOa'\¤ñ@àä*o²¦ííRœzÔxh výŸ_w·W¦þx‰f%VOš,MÀiÌN9V¦H‡ê–€ÅÞ€øM XÏÈ×”yÃ"_½/„]Œ€lÒ_¶ðm^èþe-1êØû”D„ Ñ\î0[û}5Ï+Ëéóziÿ»‘ËfM¾Ø`‘1%ÝØJ¾àñ§_.cH˜ÝS™g´Ìð@5e´¢ll($#Óè$<á5²AIL‘T<ÏGý„¿5j7±V±|ßSI¦Jv%9U@þš_Ngñ±Ý³ü_È*EÝ$(‹VŸuwæ- w˜b­~¾ðQZQŽR,ÿo¿Œä×ãú|²ö‘=˜§w ÉÐZ¼o‚’Bùkw7x+tI|öN ¹pžÕal’S6.zZÙ®Š¼¶€HÑI#õ”×x]hŽ²ÄÃg8úôõfˆúbÙUÔÂR9êª  ¨ûäYåé “ÓH‰§„ ¸©É(ö$y+€˜!ÀýÞë®ikýYõ€}–°Àÿ‹Ž‰cºôÚ:j(”¨,üŠvê]þ§Ö¦áã%žÕE{¯ì`x¾—°L7ªÍeë’yÃ/ƒ!µ¤0\§ Ø·Zi˜´-"›ž.ƒ þ”Ï Qçü#©Öîb¡_Ù9‡éæ3î‹ö@û÷J“·™ƒ0*¢Ì%Fœ8ȃ0³{-+À=_€š»_✠…&e0Yf–Ù¶—<ʯã]̧±oÐc*ð×ñØU…(r[^›ªûÐâ¿2žÛš½–f‹Åô*2GåÄQèÇ­˜ Š#]î®T7%X5’3j? Ü:ÑôŠÄcŸ–یղ,úÇã¯ÞüÌ•d)ÓRP³Ä¹<õ+øšEìë³(! µJs!³,+þÈ­Sù3-µ-döË°49^^âÞÛÌòf)[é*bKv©¶@i­$ºÊ¸j~­÷gûsAÿ‚¥÷™$¬ðœméiom" £Û•¸6¢%iYé.B«c´Y£[àïD8O#{bwÊ€aoÍ<¼&øÍíªÔÝÊ ±NÜ'”îmªBaø¥äŽ‰ cO2Ø7½ÕtèQÚrG^"wê°U—\›°2ׂ0Z¨+yñ‡ÇiøàæåÜ#‹¥˜7œÝñ­³ærÆ'{v ÇIŠukvrbkÄM¤Æ¶öøË@=ü•BðožÛÜ T‚ê endstream endobj 2508 0 obj << /Length1 1647 /Length2 17026 /Length3 0 /Length 17891 /Filter /FlateDecode >> stream xÚ¬¶eT$Ü’%Š»»“¸»»»»SXâîP@áî.…»»îîîîP¸ÃÔwïôô¬~oþÌôÌ•'vÄŽˆ³ãÄJ e53 ¤ƒ½+ #3/@ÑÊÎÄÍEÕÁNÑGžAhá&ãjl ø‹qÀQPˆ9]­ìÅ]¼- @h `e°ðððÀQĽœ­,,]ÔªZ4ttôÿiùÇ`âõÈßH+ {åßî@[G; ½ë_Šÿë@5 àj ˜[ÙbJÊ:2ŠRj)E €Ðèü· e7[+S€¼•)ÐÞH0wpØþû0u°7³ú§5Æ¿\".c€‹#ÐÔêoÐÓèøDp:ÛY¹¸üý °rX8Û»þ½W€•½©­›Ù?üµ›;ü« Gg‡¿v±¿dÊ.®.¦ÎVŽ®€¿Y•Å%ÿ]§«¥±ë?¹]¬þÂó¿žf¦nÿ´ô/ì/Í_ÔÕØÊÞà ôtý'— `fåâhkìõ7÷_2Gg«•áæbeoñŸÐœÆÎf¶@—¿4¹ÿ¹ÿìð¿uoìèhëõ¯h‡yý¯¬\]€¶æŒp,¬sšºþÍmaeÇôϼÈØ›;X˜ÿm7ssüÌèü¯ ¢þgfhþalæ`oë0šÃ1):¸þM  þ¿S™ñ¿Oäÿ‰ÿ[þo‘÷ÿMÜÿªÑÿöˆÿ_ßó¥–t³µU4¶û;ÿÞ3€¿‹ÆØðw×äÿ,gÀ? ÇÊôÿjlgeëõ þ¯ÞZÀWý?9ÿ+üï"öb`á`äø·ÙÊEÒÊh¦låjj 07¶ý{yÿ²kØ›m­ìEþ×ýþ bfþ/˜º¥•©ý?jpüÚ›ý×þêö¯˜¤Äµ”µ5éþÛö_ÎʧÂUÝËøŸ™´Ìþ×á*QQOÀwN+óßÇø÷9ò°²ûþÿ¤ýËžŒ]­<zÌŒÌÌ,€¿ßÿñùÏ“Á¡‘°7u0ûgŽÔ\íÍþŽÞÿ2ü›º9;ÿUü_Ûàoçÿqþ×#=¦p«K¦|ÁÖéY®uعCâz}=,àC!Ž¥êEþ5Ý?ÒÃwx*ÞkC›¦x?y-ž9~ÈÒŽô`ÙRu§¯ò |Éhz P7);¸è™ K3_/ÈoCèr2kîN¨¨–¼CNu°9Ã\?Ñø“¹øc?:"ù™¦5ÄaþFiA«+<;§L:yz¤ì¾ì=À§Ë‰ƒ¥à3ÆöK9#Ivõ2r¾o4ý„|uçrƒ÷@üŽžñáF`Ošî Vï=÷ÂêOÝQz4¥/šæÒ¸jÙÄì}=to)&@#yÏäò ¬#‹5 ½ýƒrÐÇ÷€ÌL²E'«‘Ùé®íÿи’Šè#ÉDÍ–y!ãykœ§e¬ÍnÙÊ'¹F­ºN˜¯ö(ê¦Òrò#1?{Ùub(¦;†¸¶A®·±Ø^‚*áä-ª`tËãDºÄGaX}† Õ6˜Í;!÷õ”ôñÂYTµFÍœIð¬~½€¹¤Òz5úÖû½Á’KÚoJ£ =}Î×p@¦ Ôgø†é©•¥¥¦@Üä®ûXl«§$Œñ~Œn&´å?"7MBEs ›+%uøq]ÙS 8f/f#p«è;TÍåûåÒˆq* Ɖ’âjÃ^‹ùÍ•)Ú{ÔÕDèG&½È¶”‰ƒ±·]µ†¤‘uŒj›f=*Ùðelö*;¼¥øO0qR’-­qÎÐ}ˆîˆþ=D[£ñ¼alð»:Ý êÕ#¤G6Hòk~Z^Mpr®ŠWžn¬l¸ Ø_=yx¬ ·SI:²¡%E:B¥æÂçs³G4Uì×À7&î®c|šœtål^´¢´ÍXh’ºõlyA¡· (•ÒÇl~"3ˆô’>í,ÏH#¬)äL ˆw0TÓR! B²Ñ+ÞæNUíP(z¦,%ªÔBÇ­iÌö0™(lrXÀ;GÈͶŒ©¯Àxël§«º+Q»_ É¢ ]‡Þú GåùŒ–éƒ]Òh.õ|%f˜ûɆo¤1Ù]cþDè.%ïÐ;É–,öf¿%+‚ñ “z]qyFÂ&¦ñÜ…šZ¸—œ"Z'FaÆÚœ •ã†Ì«U=>ßM¾xI 8†–˜6+ì¾Ì7CÇ7¬ßࢨlW„#’ý‚®bûË4›EïéÒX(õ°#ÎDeé?q׸q[™0¡êÛÁ >6eèvû®óÖµ!^dç<Ø«n;ɇAáé;X”|°©2“Û¾Ã]{¿ÕªÊ™†û}ÀÉóØr¢¬íÕÑ‹§Ú%zŒÆá+ö§Qx¡•yI,˜^jˆm¯ÁR"¶ãäUÕÃÎè3ÒÐM{åw‰]t5Å-iÔy=ÛrÒÔ³D®ŽŽÂ)M?Œ /1Oø\ó¹F}"ü]õ»ôA(^«“¡o \»~Ï17ÇÏPë¼ ðX‹½É Xþ3ë懹x.m»" K iSp볃Ý*ô£ú¤ó]NVšX<[‘¿¯.‡Ü³c@‡fÍzNõžjÔ‹@ÿu}†ŽÝÄPgáߥõ#}“¡ غ³ÚmÙ Cn=m¤¡G#”è9-?åñZ9嬿¡½©î}u©^ÈJp€P¼g·K£uÔÍ„fÅò+õå¾û[Ãè¶ü…²8Ä@ôØdÒögù…o2·)Íâë”pç“×#ØcÿÝÄͶ;§| Å—¬ÛCkvÙìnH vr¢u6+jq­«°-8&¨+i¾ûëóÄMÚ–Ðm¹þ¥$ƱsŒ90á0>ý ½Ô‡¹Ü§/ù«öY«Pü™NÃ@QA ìRÅ2¸¬?üÙ›l¶í>„6Ý•hOÊŸeƒ*²òŠ7BÛó 6FÅ5výüà‹p5ôôšy¾© äÎNð¼óFeZÌa)ßpr ‡Œ?¨øwÞé‹Ë?á… Ñ…ã#>„Ðõ¢®üÓŠPŠyˆÂu õé%àuh<•ˆ¶Õ§,Š“æx À –"±úøò౩Åò>ñ)Å Š¯2Òð«… ('§ö T8¹H|Âß“#BÕ6M¾ÅÎäŸep|o;Âv¼+kk«ï±ÎfÞ¬Ùಖ&Œ¥Ã)„Y–QÀÄ€Ëü„1RŽ ò¹\^ÁÊ=Z¡²¶yHŸ±¿ÁE¾Aô£ÕŒ ËÜx=]‹¸õÚÂ’zß2~q_h1©Ï:pQgÏ xOÆ#¡Y—‰MÍã$b®øZ+1€ãHJ&$â˜gê;‘BòdiA4$-¦kŸ‹°ç$o£¯â5òGEá~ Ji*U¼z3G¥}ÀÔÅÌ?qز/Ì8õJê§ìèÍ>¶€WñÓÒ _‹Z¸æv>|ã¬ÃÌÜøþp†4A‚±f·™€™hУ«þhѹƒdÑÛs9\Žáü]³ù–¹HGÚ)‹ps`â;-ë@ –‡(Ÿ‹÷#l(nÃKøXi”—ßЄ°5[±QçGº«Øo!²uþO†¡QJ´þ ¹MÌ¿j³$rÃ8#v¡DKqW¶S!ÞŒüÛÌt*䯤‡éueJTNn_l¸&¦”—ï@ˆWl¿o_²‰!Z¸×A-ôÊç[Tž!Á‰˜cT­MhÊ´¥Ö½o'Q˜múœ1¦èiöµÊC;*ÃɯÖÁ~Á©ú”º£*°dMÐÃÊÖ8`>h¼æ ÷åƒu—&¬ä ÄLi‰yÛw8ºÔ3 <´übæ”rª!ßÈï -„Bòô LÆ]Y ´-¢+àùw¨,ÈXÍ*ÙuÎsJ†ã öÎUêó΄×)hB¯6i*·ÎÜ5GËí‰ç—D/‰ŠDdtsÞ‘g/ÀêÄç4gÝrj§?[Ž7ÆÈG¨rhBT·YÂÍËó ~–îŒPÉp!Ó¯QŽ9ÐãndqôqªöBÑ~§H£Á Ø°œ®aã3MçÇÒA¸;PÈXë(‡µ ~Ò…³œ>î›²Ò ©Òc%Ÿ8¾)ø­[žÏœ“ß^z!‘ï%ú÷¯ð’g…m?_!>¨;g 7å©îÆÔvŒôŸÚIô9Š·œ#|kß›ÜïOçÙŸ³ø ¿Õ$æã·:ép<ì•ü†šŒÐ-›µƒ dp^†„tè>Ì齑õ£Œ¿»ÍR}ë ëó‰])§©¸$½„•Œ`–Æ\-ÞN{ÿrVê1±é=|ð!’ŸSÜK>ÓòŠ ;©bö¢‚–MÇóñ춂ÜéÛífp@ çµâË@ìs(6Gà¦ÊÿùkZ.fuÊÙ¯kªÔÑÛ5zÔ#[Þ> ã—¶åô)½…Óumlö»'§ÓsÓðê~\¤Òø¶ ö³`«ó¼¾«šdÈë[,Sþ6ůWp(0]A«”âHòj‡ü‰Ýî-2ÅDœbà'uª:AûÅf;…L@¬¹œ/Ú·dÖÁ¬úïÂIä7Ãâ½°O@M¨sÀÌê8-†+;òZóÊ~ùbøs\M”Á¬Ü‚¢+ ½Ñ[ÕšÆCún0Éjì>Á$,YõÈñbë ö†þÚ4y•g•ë2nª,Ãgí¼wJuÂ3T·ÈÂez«ü{>b£"à9“[›ª5i§ª~²­KŽîèùrWO/¯nÖòÏOíbñû&'T~±ÝŠTé#Å€s$¤\¾$¾L:ïê½l¢·wž1fªA‚+a¼ öVEMès.vïqðO¤ñ¬…’?ñ‚ÜÒê=³=z¾–^o:igÛ8q ÇbœoÞ\FZJ¬RÒ¬mäò”¨92zïëF;•ËüÒh!L›E³û;äOÒ­kVèÞHÄû°Ó ·ºõ{ΆRá±q¯ûœxkFœ¨)²”Y¨~<¼ƒûÔ@q£sÏß+ W·&ßkw° g‰‡Ù %‚øD º°ørR•,Ne|ˆ·^Š˜µõ§ýâ5?l- ÛJݨg  ŽbI\ÆBCÓçH¬äaÕ%IJdÖËm•Âq¥Yò—MR£ñŒ÷kÅäÊnüÎÖ'³’b°ƒP h‡&Y‘#-l#Ã×BÊÎÛ= ¥óŒ¡Oùi‹ e±b¸vô[‚ µ>²Q=¦˜eö}`óÆu&BEé„xÜusÚ p0+ǽ4—+"0˜²ýìoêP25 ªM¯ ·§~<ç\œÌý”Âò„Š9Öæ¤Á¯˜1‘Ÿ3Ñ/ÅÞ«æ’¬ÇòºDd¦öéAÞú /¬Ù.I4'¼Qù0°I,…]#)ªbh;þ)†šæjEÜ )í.…ê+Zný$T%”' °ë(¼Jm’ìy…ZŠ‡ßoJ“bwÁõà9Ô7?hÑú0Q‰dX_tKÉJÏlÆzÜÄQsrWG³Ä;ÀÕ| ÝÎ…[**.î1fÝaš‹™ÄDG¢æFFñÀÔZŸ[µ½|òŽJý™Ñ°§Œ°Y´®À%s8®í+ßøÇÿ—¿£U9DtœŠc1 ±‡Hº4 `“öàû{Ô|¦*qû­yg½Ëè×l’ŒãÂÌ×–|ƒ°Y¯"ñÕuV3GcÃ܇߬¬Bg‰¾`·…ïuvÔ©<$]¹Õ^ÐUf—fK’§#ÊÔÌsAW<)b¤Ýÿ¼òÒOçm@s—¢ µ¹k\„êóáõE¬Ê~²çãÀ6ÕtÄ"§Ù¥ÀóðlzÀúLGHßå˜Ñp„lpóʾ ¼| ODά‰a·Htá NE±€r'Ÿ±µ€OJž£\K;DÓf½É«ý¬v_JQ1YvtZ žŠ˜Å'ÛD`~IÁjÐñõ›Í[;Дºy‡ _Ývt“ÎÎÀ¬Ñà RÓ‡§#ÿ躖þªìû=àÙ¬C´Ò•sgãc»Øð#‘ÍlD^°2®ý³Îäí‰kÞíúÑxø‘ „F¿ºÀBçã*‚IÚÏFr{! mê„Œ0CÄ4š:/ ñ5½àáv~19ŒfD’·wLš=Ó—¢ªd¿úVhUEÊ´maÎå0}V÷¥gjBÉP/Ðúrë`ý‚òÐB1Z}ŸwKëÂ?EÁÄ´Cã`#Œö!pnìM.wüáa!¸­¬Ð`9,¨ä©%zHJ+­lÑclPÄ™N‚¹u¼ÏÕù'-Ô¬0øS­½ÑaBÑoÉ°) 7–©Æ: …`m ã%ç|5Ê~o½æ§Üòw@ð1f…¨“_±×±†“­¬¹ñ1†^]I‰d…ÒÝE„1ÉÚº-.N÷p…8©C[…–ïòåyrbIã1äi³IçÅYèi›¤Ï°ÌæP,Ã; ¯&œÞ ŸÖw"Æ2ÔŶ9–’1˜ì1‚S–¯J-Û¸ýÌÞÌÑBŠôM¢ÖÆÏØŸ±¢kèåÄÞ_Ê”„]r OB³ìAèy¢Õ¨º'è_ÖåM&›¦:6@ÜÊ•.ÕaŦ8úbËÅÿ1àypo%ëô* 3^£ci=0WÏ9õ ^sÙcÚQÓµv¾kРòú˜s Æ ¯înc äºeV l29ÐÅt…|õìCU:¶‹¥g37}3’Zül»*dÛîõ/Ë«òÇnßÅÅî”1JI²ù 3yS71ÈoGfŒúòíÀLc‰!Oñ¦5ãZ£^ƒ«(•|ËÓ@Þ‹=½'hÙó93®By‘!DvfäKûu*_ó"½3N·õ à\Kä…”¶tE¼Ä³M›ˆé¿Ùmtõ⃬%ý¹FkØÕÚÅ…-TêuqK“õÆæÇ©Ó•~eÆÎǬl{9Š˜Æ6-H[J%d–ÕVžG»™zòNÅç/žjn½–G-Û2DØ:gù¨ûs;¡Æ3nïj:ób(÷LÑë!½9‚DXŸ€÷ž”µñu-6vsªðF7ÿ˜ a؈ n÷zŸåÊÈ”-g@Iú@--ÝP2—€žÕ›q'<œ5—DÑä[Þ¤¨t½Îža&%Ñg·0ö@ÙA—î^»Ü‘±%ùèsãmm±e̘,¼‡3Å*&45éJž6Q›g¤_Þ' Z·1jR”]i´åì#é“âõØÄ„ßFÄáPúUÀÏORoàÞqd 3ü-ä!è—ý gQzƒþ-D÷M4먙ñ‚!z½ÀY±$ëèÏ„â?÷ŸZO’Ò8ꬽvoÆûòH5ó«Í,©bL›xamÚÊ-#íùÃ*”àfô>ÐYDWnù%÷¿Í’Nƒ3,nOÔêØGj~_á®- ]å˜ëË74NY §ÛšçÏ»•«^Ä1)^Lª×Ö8èhüú“=^…=b³ƒ (Æ‘X¶\y~#A|p%/'†˜=~±GWK¯㼕[\˜A …Õ·ê³ù)–EÚàV:÷a¦ø‹È“ÄÙˆÄY*/k˜Ï…šÀøµ«þwHd8þ„ß86Éb;¢×S‹väG½X|W0Á…#® ̱èHV\ø“×fç2‹½W6o_åå°ÃÍTjÁøN9k] .Ë] ì9×ÑEƒÑÇ})U=œ«”†ç#Èm¡éº÷‡ ºÓ¶ z›Ç¨l7Jil3¯€ƒ³ ã¾ä×0êyÝqâT&.õµ±ð{1_ÖXm3j ó F¤Š,:Fý%Z vF*jÚ‘ã†(¦3}léÍØW^ß'PÔç"nʸ %ížE´䞨y$á³:@7”&C-·2ŸáíåTö`oÇÝË ÜG–¾ÒqúÅB?, s3ïþJ®rÒ~0ï'ÞIh¥•´5°Êù|r{Œ•œ—Y?«@V¨•dvæйþÏÞØ7`Žk(9nq®äYÉ&þ‚xQD͹²–.wÐ%ú,×öþb²n4‘”…EœØNT<´ò²|6øîòœÃ×àHœÌ{‡5%É=qÙª~•Ùøî‚Þ6Л+í™hš8¤‰dŒr¹ãú‹BËœX›˜3­_g­2ìï‹ûŸ/4öà§)ÚÝŠ?‰?@lBžÐùYà:’övž÷‘2ë°ÑU³/o`Þ5œø+š‹ºŒîOFëªï“4_,ê—ê´Úhæ³<†¥V¶I[2Ä—¡êܸÉ\.2a°5¡qbHe fòDü‚-u š¦?C0¸TS³†¼J²ÐaæÔ÷© ¦Sí%$:fég³ÆÒÀ­*Ô–ÑÜéB¨Æ÷¹ÏlÇÃD¡ƒKë8ì;Àé̶”Û;î;›H_×Ë3ª1[b‰·TÆç”]”»œ4ãwk• ì&ÚšêÛ­+œýL}ü"$°ï]&‰µü…¬Ì.lO¶Y/EV£ÄZ<ë6,dZàuT “B¥Ýs·ó &Ñã bÒÄeõEUy¬º©(×g@œ6+Ù§¤Ð&Ë“R%A[/„wѵã€I÷‹óê‚Õég—žÚNNRà­M­{f©{힌}ð‡a¦Ÿ"°¹D‡è§ôˆNKH¡ïº¤Ú u¸K:§«K™ã…ð±_ ÙXGé ÝqfĤP Û¸_û8ªµNj­BÎ2õLh†¼5˜³ƒ?=ƒ›Æ¾*Z»7–6ô±ñ›225 ƒKÄaÅh ‚8YŒ#N³ÀG$oô¬ÊYRø#¥PóLPr -íSlõœ §§¹Û|ý6á=djä·J¨‡ŒÊäk½¾çÜý‡„/~a¤‹?úÙ»zçhû1ˆèR_¼ùršD®W¸;öáÑH9º6¼;:A1 Ww‹ÕÒ’~ìõ½¥§’q½ ƒ«C‡æåïhA=ÉŸæÛÐB…'íæ…Lž Æ?­ß{|2‹#ÈlDäøFjÈñ¹WôQy?¡9ÝæXÔla¢œ¿Ò4’wtÒŒzxí×gÚÕ  |{LP„}róç®Fƒ8} ¾4ðgѬÍÕêV0ªˆÌUÅó£÷õIde˜$µZ‚½-+"¨[±Ü翺_ÔëQsAsH#£¼§ƒóá›9©tÔ”T¿…uÇý½x¸ÊÛÙèàÿ†Íyìw9­‰Ð£_u—ÖŒáY,„ú²7ªh2É`ÈÊVQ³Ÿï|31®o,’õÍjÒ»{SrUÄK9ßeK»ÜµûÓ‚Ô²qõ1öáT2`Τ>ó1߃OÉæ‡~j÷"}Øٛѣ9,"IÓ­ ’¦2—y ¯iH!ØžHÀ“Ì×85ôÿ,ýÝÏ”Y¦&iëtU·KRÙ„[ÄÚÈ×BøB±úÓX>¢ÌÜŸ*þe&³†-§¤ÛìÁ™PÅòšçú%L>Ëû’¶Nmv×v/_ þÜ÷%Zx£BÜÁŸý¼`ÌxKt9Ò¨å$ù Â¬Ø ¯žZ8Žw?»+”Q¯4ÂþÌ•”̬Éfó,/ˆôfâe$ŬbgX²Ða5±o¶õ>ã.¤W‚TôbØLˆûµžlrèMú>­¢ ,åº*EdìåÈ›zfb€)¥D¼LOæ².Õâ¼æÖZW§‚#Tñ) N·^º7\ž¸,µúŸü0¾†Pš*Çõ}ÓV[.”éÈÎêÎe=_¼<úýuxÉ=µÄI‡þ®7ªr£ ±úð*ƒWb+ü\ëÀ ×Æ #Ò Ö¶“­µ¾½P— õk ìL)ØüŒ Š°h+úcJ Û££ÌGäöR ÒZg×Fpú†¨?+û+ú­1£ø.j±±ŒÛëÚ?BW‡H«k®† #©X‰¨Üq%ÒÙ7Ó£A3]®hJøýœGAÿ›{ªÜdéàe²ãní¿ÉbÃhvBw%ó¥ê§iýžº*kÀõžßl£ÃÌš?€HòÀ=½7¨¤D×߇°^ÄÝúá6²’ôÁflt“ÙnSªú Æâí%³=(çÚ¬um…ü÷a58!YºÚ‡•EbÑýüË©Ö‰Rå·;—ðj·ê‘•^gSkb'â8P" .ýõL1ž×¾ògì|ï´÷ˆ¾2°&†UFTÎ8rqN”jÞ0´—oËVŸ®¾:éK ¾’ÝZK?‰C¿ _k´LóDÁ}Í´¨òï†ômœßÈf19qÕpL „VYš<6u8Á_¢¿E˜ì˜xÓ½Œ‰ÒŒ@œ &â+½ËGxú!·Ü¨<òg´ï–‚@³£…3ÌR_û‹o½¿ÜõÞ2y–ð‘¹2Uth1ct1!ñjʼ(ÖˆÙù[uZáˆBé 'Ž“ŠÞ¸XÆ3‰Sí¥v)~€`1®õd(èe3c¹gÒˆ[Ìêz¦¦Õ»µqÕ4ÍûâYÒˆcK3«0›,5ú€HXÞþ g¶@ÅV™öÚ3¦Ê#æ³–熣(ƒ[¶ø>?Q*ï?‰R-müâ!ðŽV£’ûü1 )Ìäo~CÌãð¯×/Ù1c†;wÑžCV©õéKš¨iõ\ÀÎcÈPübœ†tc£g÷‚=^+kÉ?×V‰Œ÷|7HgFïAžÚµ{%þX;Ž8%?•É¾†—-c¡H}¨ã©W«nÐÆà“ƒæ°H?k‚«郞ƒ ¤=“AÐÖØI0üÈbÏ´Îíu…_·[¡køYîxPNè-}0?ý%³ýN—.—Q2æ§è,ºÜMr†ªCqÜAì½òùqù¬TêÛ<õ•âågµ:I;Jž˜¬™P„•fÿ}!íéȇ¦: ”³né{}hw±í¢Ù½îsŸ:ÜŸf„p˜¹ZHüÆÉ tžQ •6âÚK߃÷OvéËrbìz+¥éßs0sâÔvJïÌXíÅE]Fü†H­ȉñÍvæ)z'ƒs IΫ{ñ~ó”[QÚo•©¯ñãÚø~ù¶ M—ôÃ`HrôtPˆ!7ajêÒñUž§2ˆ¸f&Sûçkÿ¸“eTQINЮ]ù|À’dmÍP <Ž§(Ù$€ ¡©ÒúYyŒxþA±Ç!*×VÕyº¾u"³ˆsYlŽú¢ˆ«Ã”¶¾tLúmÖ°ºòD¸4^€I½ºüÑŶ§U‚EÎ?)DTQî»5À‹Fb'%` z»2ǘ•".Œ0â2ão¨º.>BÞ1#¯}¢lè+!™0¼ÜZ «l…ÞBe¾zà'ÓÞ,þ´ú…tB7gÐrH0C§ä €ÍJn®6MÆ»I”«Vä=Õ»çMÖ’ö†07ºCÛê'oÄÇ…¾[u´S4v.P¶É0ÖŽâµcä€Ðâ­«^|åçEš¼ÀûÂ&—Ù¥¯‚„kgÓ—}·Ö+zÅ·i8‘oÝR[÷ùiñÙ ¿f¢ñAþ *t|¦¨DkÃçõjãX+ÄÞôϋц†ëP}ì+j)û)Ô“hí 49BaØ,õíLvüiÕ ˜ypµ1‹Pƒ6¥61«8áj,˜,¸ç‹@/k»"…re=ìýëmJA°Š÷o™ ä$š9— ª}Mw|¤@Õ“ÜKæ)Œ ˆU± ¯ñpYõ7 'ý†üE¹+½¬KÑ|‚6z£ãÀ7ùØu4}¬1[äÜ$ Žv`¯oùyeÜËå¬ÅÍŽÕΣFRP,›_´3Ø#Ç0¬:¯ücpº+UÇ€uœCÆÀ$œZ‰ªÍ@•¾‹nQLÞážÆ”‹?jbgÏK“L­V)–£½ÔðChBã]/2iÅCý.*ŽQúkRngq'æ– ó¨[M©ÇÉÏ£7ø­aLŠðœŸ=½až{¶0âU¤²‘ÐP…-Û±x"“SÿÉÚgkÀä>åõÄ/"M SdR¬Ǩ•}c"(ñ»g×\=flÁ¨+ é²æÜm”à|þœ,ÂÐM4—PŽ¿«E$î0ÿâŧå˜j¿T2Š/É7ï@3ÔzÔÛ, N Øì$½˜%¿nÿÓî @lz ™¾¼ªA…Iî%Š¥æxòE¸§¨êVÁ,âI¢hÑŠñ…°CJ~Ê)/hzò|ëÊézÇ"srôsp|å'Qm²è : c=ü¸,’oÒ¼yg6ý»É OÐ Ÿðâ{º0hÃR¤”QbÎFÄ[¨ßµ šý{ÆJiU¡$4€œÆChvhwOv¥cw²¹úÁ…ølC„fôê—Š(›_qvê–Zítè×÷…L eäÇBu¿Mú½¥Ô.Tp°²²²9UŸ^Eì%ˆgÔ^Dth[ ~*;Zô?F,óY…¨oM¸ŒüÀ±îÆȧ‹lÿ“HøgÓ’¹ª †ip™”àš˜6 k]8 …aß¼³Ägåf ßLïnÃjêƽ¤ªoÌT¾X;4Î=!ù#»! 2ÒÉ ô4;®a¨d)<(//¡í…Öc ñ=ü:ÃÕ&úÛí %)¼Ÿ`;cí2VŸü¥YÐP±1Ù?óÊùâŸÆwj¾-1š¿à.oÓ*5æÍ"é*;.ô=šì¸åK*ż)‘£K½âÏО¯8ÙqV¼ Õ¤¼ðVíO¿¸çíß­zWk¡C¼Ås§7±ä#Öí†fŽùç5ç€ù8ÍÞ“XE`æØfåÒð7/ßyú>­.ùË6Ì@Fàšk`Þä@Ðé^>ÝS=‰ÑwýM…ÙÜÝ¥$3ŠÑðúv4=±:=‡Û)ÙÁŒþ$Ušlö~~ßt³$D«O¸­š+ðWý©Ún¬]Y˜â[ì#_ѽTÞÉå÷HÙ2Õº½Öµ'eF9¬EÊz.JÿQÉïEi\2Ÿ Ÿ-c~ºà…«NK•_Ó,)-Ð ‘²„lŠDŒt…4J›}ÂÊÜßó.z Å4ü£>´*›ØÈD¦· ­†K¨Ú ­ñ}=q„çÂTzá·H2&“(Ÿ·.Wr"VðÜK \²;âw8õ¥þÐÈjyé£Ez=ì¸J˜–-žíÕ Ü w})HíÒ4‚VºÀÖ¶bœYVgè)XMöØ‘IIÝZÞ’¨ë”%ô÷˜õôâ¢âZoP»àÌ0 Á‡SùFÇaO2Ÿ0ª ‹v‡e¬×jë‡Ä&ÚتD0¡ç²óóѳé÷Išô­XàáFyr§½\hcˆcwMUGAÑCú…;”û;t…'Êójx8ÖÞÊ©å`ô´71õÖŒÌ.}ÿÅx0å^o&—âÒúÖdEGÛ”Æ'©%¯»»ÿ„–cÜ**„\è\“}»£¿€1‡ä 9§7)Z>ðöpu¸mióÍ-·¿Ò<,#EG–öãÝÙTl w ¸K¡‰• ¯>™,\"sø<ŒWa?5ä”×f^>géK¥?§\OÁó‰µS2|ìfÏÈ°+XÍ!¦ÐÆ7Þ4½Lòm6êN³1F:±wK8´¤œâ¹ÇçÎJ CS°”åçËçüC »”U°ð…v<†}ßl–´oÙ@ž®3a ‰»]Ù¯ö£Ö3}‡{/Þ@¸x^l· ”ç‰v½NÕ ÷AD¦ðL8{¡ŸÙÛXùX5ïS3}S3æäÜ>/ØQ¹åì¬ìîþ¡}Ÿ5—Íüe´ó^ cÇø–Rˆ5KþÍp?¯- ¶8Æ.<`F©^» àL:niÍÿG"Q…Õõ~eŸwœâ[É$r÷Æ/=g!H:¡¤eÐô?‰ö®±ÑØVœìÔí|‹~¿0íÌèáA¤«7µB›‹Æ6î‘EŒíhFè eÇ45a³UksFì]fæÒgÃÊi—ý‚cª¯WNb'î“®•v“¨®Qm±SÄ\*Í'Dá•~ÀiÁ9Agôûð÷R%=šOâbyÃ%ö%S½½E |ÜbÛuþ,ùZ„óÛ^0L± lælðOÞ{ ¤ EÍá”'~?åTQ@ßfz]ÐG¹Ö­ŸÍ[(À‰c©€È%Ùjà‡Šâ|"¸¨YÜ:©é%ò±ÁE8IÓñk"!6ôöÊ~ø¶Ý}6ǃ3™¾ÃÉ{ õéÖu ),¡ª›Æä,y%‰6(šJ‰:£\Ö²óOáH”¯åÒúHÜX(;O÷Fhý<ÙÛ Å÷§â¥D»_&þKlì÷Ä$÷T±ÚÝy0ÅÝY›è\ˆ†D¦Ÿ½‡8ìV§Íâå,]úŒø-éΙma6•Ï‚äq¨?Þ5…rGëTp"kŸ¿îWêpÃÖèŠ6¬XjýU÷;îÀ¶¸QŠé÷#QºúWšGÜâ¬Ø̲jæ@ 8þÀ)ž µ‘ 3Gì„c ÎGà7Ôû'CàšÄòš_Û2´ >¸gIGï'Vµ ŠÇJá…ìoåîe¬í×ͱµÚüéä&Oí#‚†ï Øp3ã÷79f>|,Â#ªˆž ¯ §k fQÙ5ý{!º“¯=ãÐÁZèr 1ˆ)À¨?9Þ?ï–"®XmƒÈE“¸:Ù €1Þ dÛº0³ŸÉ+oY ¿é8Z‡ usRDŠ.–mv j_ÒÂ!ø%ÑcTä¾ò _‹ˆ8%’ïë-?Á×#h°ò8c=@_]ÏJuN}|Y$TDãmZÔréÒº:ÊÎÕñÉI”iûïÖð›G‘+ pK³ùðûgÏÉ?œ?Þ@ë¹ ^çxp”‡ŽSO$N}“Ç„jrw:¿Ë•Ü…Ï„œ.ç´"BHQçñ(Ä ÔVŽœzµ[cÐ'w`¼>PÊÎrÈy_Xl6R°R„%0¶¿txV™Ä~ì—¹žl**†Ñ}2@)æœÄóJT(Œê¨ŒÇÙè¢õê©Pa®Ý¤9|ÚΑq¸B÷Ôfà’½ß å±Ç Ãš®ç¨ýT½UÇÕnýéð*hÑ{)¶žm)AöŸ×U„=Ë3ˆÇ6c4%0ŠÛ7sÚu¿;WIñE…¿*!Nk·CP'§ñÌ 6Ÿ¼´N¦ÁßõvG6a=À’és’wùC†× BwÞ'µpÞ:.Â^þ$½ÏÔKX†C°/±Lÿ>•f¾×]¡«#)ÝÞ’kÜú6(\Õ1ÛáL4^—pt± ‰ú.FFÕÀej¢‡È'ߘ•Ï½LxŠý=#¯çV N´Ä$Ó\IÈŽZ¸,Ïc&oôæÅÇšåž|VhÂÓ®TåiýS‘ÄÇ(14{ä‰[]ØÅÚÀ0½Cl{¾àî¦æ”„"e¸‚Ý— MæU$fkʵ€m75xZ¡2“˜©ù9Êj,ŒFú7‘|N•8Z-Ik}pÈöÜggõnxA“Ý@ð~_l™0.qú "»>èþ~5ÈÛj0 L¾¬+&A^}=øÇX×6d U0ŽmÉBX÷½•9Íüª*žvÁþõ™I)·0ñó•IâÕoÛ]ÀL8‰Ô·H%ŒPoK³BáH4"ѶIm«3x±$pããðӤ슻©í¸Öñ c'£!SW•üE+ÅnSòÝÑ eÕHnUxN~×>ïKAxX$Úµ$Òן´g™Tk‘ vÏqdYC›_WyüÇ ¾›®›]”ó‡ uePé?<1žöà“‡ ݵãDê?’Jª£tô¬Éòe´¾<¢2üáA»Yê'ôÑâ'¯Ë¤kóŒî=+KŸ‰¦þ¸qxg—Êe\ÿIÉo¯q³ ÷lv˜"aÍ8™º\eÍΆ`lG쉢kC‘ýµÉ «|#z™H{ì$Ú\I˜e«1Þ|÷‰&ƲäšSšÜäŸbUO½©u¦úÎÅ‘è­èH Ä›£–ëËðß5}}C¥Ôß±CÛ—c?´I’!j­Û¢Uùº{*…T—øgs·„™Ø#çlj&‚øn–@ØmßЄË!‡ÁûÀÐfÕŸFa¡Fšá†!Ó Ú\“OBt©½LÞߪ“<±‹:$ï¸zŽ³"ÁŽŸyÅÜM.9äž ( ¢?8³Õš3>AõoÙÑçã¢â¾ˆÀ¡¥q~jð!-ú—&»W3¼˜/Ê6"M_ fX•Ô|_æ,„F]~ÃØõuæïmòš­©$c¸ëç|ôZZ9‚Æ?±£Áâ¢ÌQÄ$$ô™6}b(AžY¨øƒ*¸œh!†[Õ!œžv‘N1bíߨ /þ½3ð‚ζ4ɱèfĬ‡‡{í™a±„严/r6ÊÊáhÍ›'¬.ý}WÑWRž4ÄrOùpÒ ¿ÛcZÕÂ/}ûµâjú1ãF’í÷´”Ùe¼5¤UmÄ(lÙR«–S7Qm³vBÿÓŸ?y#k¹C÷=´>ˆºe,'!¥zduÒïžýï6KïDÄQ4Ì?¯µ†$àìó„Œ6ؽ›px¥¶“ã—ÀÓ•*U˜3#™Pߺi ½5ˆR–ÈÓ?÷•‡sû¤,ÚŸi+˜í¢Ð ™ï Nyï/9Æ*c“³Žg¡P‰Õ?“Ü ½ipý½‹èÁܯœ¾Xs¯™¼îÅcÎn?†Ú,•].áñ¥îrbaÿŒßÍÚÅšx¨H[]|۽ᅠR·…DŠ pD›J©„ν‡>2&y”ì+Õ£ûBÜ‘®êq¦S´¬Õ_…¯EoÈiÚ£ñf_…îsÕwK;(‚ÈÝ’ŠiÛ}£ÄŠ5òÕ@xœÐ^ŸBˆX râ™@M뉷áê¦/åÜwèN@ÄM”4^²O»«†kÌx,ZQò lO¾íåÎ…X;A•Á«¼2ôáš6m¢ÐÒw²{<<]HDŒ5pàãÑ;ó–¸èŒxJÉÒ²™©Ú‡ìЯ|~סҿÉ"mìžRĹa=O.»Ë³t?g:‹Ó“ïN… ï S`!\…kF¿À¢ }ŽjS*_¤•žnëžUa my§Ï  /ÿ:ÿUªÄF&ûÕtG)8±Ï"áëh 0u ^l]Š‡ºT@×aÉ'º<ĸV ¼Þ/™&WcËÇ-²ÍøÀõ•B›ÙWà`¹9%ˆ€SiýµÍS帖i’ÒI›3¾!‘°NgÔ¢J‘l¬ê¡€Ô®Êí!~ÀA©Ž^?nòp*ZR«mÛLt³(–dh%·FšJÎâ†?ÝZôï Ÿ¬¾ùùªïˆÉ̼¼ ã;*².˺u;Ïýn»\YõuÕûzmç›]Ì@zžÌ³ÇÝ¢5aqÜïù†Ý8‰€qÞn&F´K}Ìõ‚µÄ ™ËÜC”¹ ΘÒ>š4½Á^‚­PÒ[.†å©ÓùRI )$FÛ©p‰í5·<€RºÞr1¥ß î'ÃÐÖm0h Ä©¯P =EkmÌp=à̲xmüº—«o溯Öß“ìÜ|ÁcÜâÇ™ïq£®zå)à×øÝ"û RèæÇE2™ÓN}Z˜Ê&Uò>c8Ü­ý!ÅyXÂoƒBÂÙ_žkõ²õ1åJr™$…¾¿/Hj÷V ºRaÙœy-î‡÷OÊ{ÃÈëbÂ:×¥ØöÔiŽÂ„ðùCZVq”±”590™]¿HÛÉÅBšEˆ3|WDòШôÐøà¨þÁ[ N{ýL4nŠrì™7MÏç!ô:G6 IÞÂuj6Ðne.Œ™OÀfsɶø¾ˆ~ÝËöO€ËQ@ Å+0åæHÇ4Dኋ٫5 ëÚr£ûíl_sâ4;視‘‡Mmëÿ»‚%œ::?@Wx/WúÆ͵µ0ªu¶a,“æ»ðïü )åò4ªÇþ a=xÇ OŽ^ý N™X"í77ËžZûTîkæŸí†E— ’Ó&{³ƒýBE e²óÇ9T¥‘D¾pÓylÇœ#w ­D†Ö«j÷Ûž›•Ë¿ZT•#ЈÔTóÿSŽ[Æ= Ö ![‹fŠ5¬Ð± ÿ·>ç4Ñ)-aïHªeó9V¼2Gë~f{¸>(rØ3ÂÊM9kò¹`Ö)P¹Úòoqý>sˆè]w„—Gu"dØ y¿6óø´o7L‚D[n ò‡¥0” +â¡ÈË6°äh^†RŒŠª•gmþ&“»±}4À¾­*TßýÀï;Ãôõ³œÐ†—Ï[Ž€úBQÁËBeDT]@ô8ýFÍ[¸!îÍ2Ø›žÁ.ÌÒÙY3Ut  CÚôN—ïÁ)‡ @îNQf-Ë"ߪs¯‡¿9> /@{Š¼Û¤S §«ã¸õZe=t (ij ¸RnÝb%Æ¡9–¯éX S8@#^–R¨²¹‘eoTÐ*¸‡­ÏS\©øžAnBQ‌ºú¬m&r­¬­i8š~ñš«ã4 Æþ¢¶‘‚ M½9Ó»{\‘—P96ÛèG¹mÁ@…Û«L††ï…m.ûrÚþwì7ƒJîÙÕÔFÂDš¤n“Ãí#U°ù„<Ó7ô¦ïXŽŽ÷ßß$ÜS,–n0OÃ8é1’ãÌüUä-Gçùi.Ïùf—Ù+I+æCÐ0$x¦ûvŒ¯}ä(èï&[ãÍ?…5(ÉÞ“§I3wÂ~Ëú»ÌôõHSŸâoi&oÉEŒ]øV³`0ÎÂ4EVC²RThu…QL¾anGOhbœÅªg†Y­Ÿ)™s—Âõ£MQ¨Î½îøqaÞI¿î´Äp°_$ÙûmÛ×7x,®eñ]Ž<5¾ÑFÛ@I|9¿ÝtE&õ)‚%‰„š¶ûcF×dµ0Ò`€JÿŸ¶Ö§Î9õ¿x[Б5 ¡$Ü8‰ìWkÞƒÉC.‰÷ !ÙTÅ'ÂL™Ìƒ1ö‘c\ê÷S:¨„u¼%åÏG”1Àvê„‚”®'5óKd¨µ?‘‹û„² “ÆëY"CM«Ó‡<Ä'swÀ1eã'¤ÑñŒ{êå˜ä"EÆ!©Ê$`È´pQ2L™ÉNÎ\ÇøP)waù†AÚ®\ñîh¬î‹d‡UõÉM(Ùæ¸nº©QGÁ½"Fv$áÕ„'pø·¾ØÕ.k¨ìã“ZÛ!.§Nò endstream endobj 2481 0 obj << /Type /ObjStm /N 100 /First 1006 /Length 4102 /Filter /FlateDecode >> stream xÚí\ÙrÛF}×WôcRSFï[•+UVdÙ/qä5Vù¢`™1EÊ$•Øùú9·AŠ"$ÅK CéDy©§® 'ˆ’AÀ^4„-Z‚€è'ÁT¦k2B<ÌGC2ô ,0Aô„*dTè?Í8j€² œŒÔ‹3Tèöîßß㯿_”Œ?˜L¦‹=þêòd‘®Ÿ&_öøþtvZÎŽ<‚øÈó'üçc™.öøQ9\°c©láI[BªƒISR" Úvÿ>ã¯4}=eü€ýp18+‹ø#ûé§=üï‚p¹`Uá¢ï„ D¯ \¡ˆQÉ»éB‘„,@­ÝÈÁä!8]Ȥ™ýÊÁÇ‚Ü„ô`ˆ£®€GD(¤‹»‘Æ¢Ø!(á  t`èWÑ ×at"§)‚!+÷…’»!„€@‚¨!(;qÝú•ƒ E4d•¦ÐˆVÒÛ"Rvàl¡ìmø>I ",1D eØn `Ÿ¼ô•iUrÅÉ0¬.´Ø‘ƒ%)}ª€•Yt!è•dŒÊSd%Hä¤TIÚì&`( Hñ ž©H'†ž=%€ÔÉq‘¢t¥iRÅBG½#WI$ô Š‰U'†~%€$¥n®°šl""§(ÐUoQGèÓKQÚ—Æ<¥X]”è…©<\ƒ%0¶rÂB9[”¡û$Ʋ”•Ã(•PÉcD]`Å·MÀ7Óz²F ¤‚ËÖúÕâ…À:Ø‹ÂQ& +‰°T¨õz7R@¬ˆÞd”=DêBЫYê =l"„´ø/,Táa>ìÆUë Xeg Xö†0uaèU&¹E¬–a˜ •!å–‰õëN,‹íBЊ=¨Ä #cA2,#øÝhÃ(`ÀµÁ ‘W¦. JŠ>%AÙ›gXNKyBE@¬#ªÝاÁ²—‘! £¢ç'z6ЈÑ,=ƒƒ1¤‡REÀŠjÙ»Ö1Â0}ƒÁ · D‘. ½:lmà„bÎЊÇ1ŒB{z:IŽ\íd‘‡òéƒ!»1ô* ƒ5Ÿ éa_Ìú0Xk r…°~7Æ第ZbЦ!tcèWXY8d÷NiÄN 7X*I2@#và ƒ±K F œ™n =[’'z,áÈ8Bƒð›È8wd”¿©òšêát„^àXë!›#„(„€6èA¡&¹ˆ™înB(¼½ h0ÀKXgº1ô9 ø‡$Û"Åme!¢dÙ–Ò»b„)`©®A¯„Ь¤Q=\·÷LÐ2“ƒ•»Ö9”Ðf¼H/غ0ô+Dq©™u£è–ƒ{2e ­Ün C Ÿ- ÁBÅn ==4gžAÒ’®R:zÙFù„Ü™«”éU_¾RÄný‚ž¡ÓECïbJ- a"vºÝÈœ¤×Èe–´èêÄг Áu Þð˜pT‘²Å,–>ÆÉåØ”Eȃ‘À}7†~³š¹Wô‚h$á‘_"0T+và òŽÈ ”iZ/»1ô.‰H/è…N IÐ:Ì"׶vg‚ˆÒ4H¡AÏÑSÁ™‰²pH´éÙ±Èh¢ÝQô$§¨—à3´ì†ÐoZI9--}){HK®zÀLÉ`ÌŽÖ€@O2x†@: ô¾Ì€¿6^)†&v ìnÖ±³ÁPÅÎN=ç`í².µ‰È2‘Ú9Wl{xÛk¡È.!8ÄRÚ¬ÔaÍ.ر‚ìÐõãïûÀh7¥÷ÚŠM.Çã¹âát²H=Òn*窇ióTÝüÐÅ´}….Њ¿œM‡¯J`eüåÁ!ã¯Ëo –:<ÆÚˆý{ìüø¸wL;ˆÒ."‡Å¦|Ï1…dœÊtˆê.¼¼ ¥|ªKwT"Éæú\Â7§}cžü‚MýÒèIíújÔ3êÖ}Ó‘ÛtM}ŠEù°ôv© F‡Ç€t¤kzÓƒt’8p?€Tׇª]]¯iW—Éùæ¾é~Aí‹Ë‚l€’ [€›2aPÕV.:‡Z í#©€>ÏíPöu›Ôø/™ïjÿJáŸ=ªŸÛ·Xiw#«ÊÒ‘ÑfÕÊÉéÜÄ‘)äÜiK¦¦ý¾"Û\å'ZýgMÛaëútÎþå&Gî‡úÈݪr¾é¨}Y¾Î~-á«}RöcíºùœýP¾Nõè~ö5´)„æ…³©}Lž4F>·çÖø¾ú~Ë?-çG2¯ûÏ}Æ´ƒG3õeÓÙÙÒDFN!¤-1ÚÿÛ\[n«°™–­ÕV«=ÑP€ äºÕÝuàªVÕö.Ñ­î7Ó-Å´+t³>‘´žâèFb¬éc­m¤I†×‰Ðë¿É7ê£9ˆoZ4qncܬù‘âP'IðMÜlÅWR»Ÿ4‘v§yÖUž!W g]E¸úܾߴ©ËMàlÚL*Ýú¬MÌô9íȇÑÙ*±N¸,û«Œ«sºX¡\®ist¾B–:_X#‹ËIÖMÉ"ÃR÷F„NßD#Ü•+M’•ŽVáŒj™µýMö1Ù7‘ŸS—3?rûÄ•–Ok8U·kS%åXµ>Ú>©QkK öºì7Ì;clËd*ôýEå°É7™´skUhÞm6~¯aÊmSßF»­Ô—$á°²ä¶f¾k‘à.™ïª›• 73!Ÿ3ûÛscÀ!.£\}$/cåiõºõB…¶…6œòfe¡’¥Ô×BåÿD[M»„·-Ÿ:Puð­´E?í•Mc2+6‡Šíî–¨²|˜B)Êùp6ºXLgÕC‹ƒs|òòñ»·‡/ÿóbt~r9><»·?Ÿ¢Æxp6g¦ªº¿?ýÆŽïÍî>‡àª÷1óa9Y0§PñçÁÅãrtöyA¯oö8 GŸÝ“Êíñ'‹Áx4|09—LìñW‹òü--K÷øûº‘Ñ}|ÌèÉÈü€òWü5Ãßò?áC~ÊKžªòOüŒŸÍÊÁ¢œñÏüó÷‹Ïå„ø>æç|§|:)ùÿÊg|Îç£o|ÁŸgeÉNù%¿œœ–³ùp:+ùüOþçýXMôp|ÊDEÏjVŸG]/Âý_Ÿ?~ö¸-£òìr³¥‚5íBp’+"´«"ômM[‚$è¥ð}þ3äø’|”•ý—?åÏøsþ‚ÿÂ_ò_ùQ#áwü=ÿ€¤çÎ`rÊóáh4͆—çUy1Ÿ–(Bì£ù>X@-'ƒá—ùx0ÿŒÒŒŸÌÃr\~ZT¥YÒ¿”‹æ6ÊÕC>œŽ§ü>?@½§Óñd-—_/c^~ŽçPù§Ñ%ÿ4½œmVþïIýãr>O˜Œ@Éåù &3:[râb0+' J*U@0c’3GÓS~1¾œƒ<_/Ëùb|_/§‹òôdÜRû|Qu‘®ZÅùˆôT°<U—+²Y7-ù_ålºÆMsn~xpðúÃá:796óÓÉŠŸž¾žxw~‚ç Cõ úd#7KÂmbÛˆUÖ\Úâ7–Äisæ–|YÓ{Öñ­´ën£Ý·OŸî?yZk÷Õ`«ó–Þ[Ó×2ék›ÑÄ¥n!ÛºM—n•¼Î÷ȶó±Zý=ç3HúmR^å&§$Orµ/ßÒtùÒå×N#_Þ¯nV&Þ‡a‡[©þá£7oþ»®zÒÓuê÷¤þ˜¾Ì¢ÕwUË´¥±×à -¡‚$òJ¶ó¥TVfnSsó™¿~óÛÁÃöÌ·„[¸±{Š¾i$„\›µ\µ\µ¾†ô¡=e¥ÛS®ÿ´á81|™º$➣íDå2§«Ìù“_Ú­r”çÏŸ¼~P íhzþbŸÝ{^ž^¤ ` } †’ÌHzš@E[nér)7¯u¢œÜî,Ú®";Šwµ“¸¹ƒ¨¼Ã† ñÆî íÚ;ÿÁž¾% %?~vôáÅ“5%o1R² YÉÕ÷¤k%û°¢d+WŒÃÝÀ8Œÿ@6zÛôäJ]tqêJ*zÇÔsBz»Õ/1o•§<:x÷òýÛ Äܯ\¤Å&-‚å:9]\!'].SѨ×ã•Íô$R7ô4òîô¼ê††Ó‹ï•°ûÌXnÁ—›%/›R–»éC²òp2œž"ÿ…6FŸ>•@7,çìX¥ù™–í™i ªY_µ¦[¯³!,ý@kEÑ8„d4•rjç4$±ž¦”DJÓ®t“•Œ# ¨ÒdRF¶žlGIU•gÈêl,Þè.oÅM-×:m‡Õöƒ-]-í¾qTéÆï+ Ç×&»Xê·å3³m–<-¸ßF¯Ú‘Vœg°Þ¥I|¼ê&Zûzè&Lq0/ÓVšëŸH­¸—êïÕùáh6_)3ÊGŸ ê Iyì»Ñéâóœ¥?”“*g’VŒf£ÛîÚg=WÀÙupZ¶Á™Ðçz·u± ßé-ê^^»^½.®ƒSml”Z4Ø¢ìÛ¶Õ>ú›EëÔsm€s–E?¯[÷\§· OɶbM/ض-/®À³7×m½ÀÛ–_ço/ö¯+=ºq»uP>´„èoñåଜ#!š^R‚µ‡ë¥SÊÊš¼OG§sÚ\™º£ï,¥sõópNolÒ{£êœ÷ñNƒÔ¤dµe³ÚU1+UuV²>û»bu݉­ÏõŒl=¨«xÀœŠwÄéºSmþtõ`ÎåsµCÔùåLþ¬ÿkŸ endstream endobj 2511 0 obj << /Type /ObjStm /N 100 /First 927 /Length 2111 /Filter /FlateDecode >> stream xÚ¥YÑŠ,¹ }ï¯ð„±eÉ–aYXò’„·‡… á²Yî]6Ÿã.©Ü®øÖ¤§^¦ÔÕ¥s$ÙrõÕCåRL¡ªŠ4kÈ1­8rhƒD ­H(±ôg)Ô¨0pG“„ Ñ-¥B¸M-$Jx2eü¡‚G‰sHè)Kìð‘¥Âjø#…ñ‘ñ§ÔKñ\­p“(E`I[‡4Fœ _õŠ¦@9´RÄHðŠè©dÀ+8¨28Z¿§ÜAK ÔD:|Bæ…ns9ÀG dª%B9+àQÈÜà–‘B¤@’bȩ‚G­±[@Ñš»Å!·¤¤^Um7X%pÚ|kàÜ’¤°´t«æÖï!îéÃJK‡†à^L®¨rf€ÕÖã¢ÀZù†Pü—®YÎ2ž¡€Štˆ`HÏUƒdä›.œQä#k/ ¤ÝÕ“"ˆ4R A |ƒ P QHBåè¥%4Kÿ 2– ”=B„Ò@9ˆSJ(¹— ]S ?j‚‡{¾„‹h,µK…‹"eB‚¥!/B‚¥¾£×ØuA‚5á{B‚`7hjF^„k®5õÖïF‚U $õEP |¢ÃZ†ÑÛOÖGAßàCmè±15ævCŸaÀ5AíŸzßh¯jêë#÷ÕOåØÛ3\{E´“&ÆÃwRÆÃwR´§Öšnß|s{ùÛ~~ /ùá_¯_n/ßÿû—ŸÞB¹áóçWX÷¦‹á¯·—?|úç—ð÷¢Ü?öªÜ¯ŠÝ¯Ûc¸ÖíJ÷ë?nß~û?™ÉD¢– ”±kÛ®b÷-#EŸ~œ¤n¨e¤jXfÍ2ëûчIZÚ"n¤Û5Ëve#±Ìš\Ȥ•-“f·jdjd–QŠ[Jc·Œu+托‘Ýçš,ÏT%Œ¥éԿR¿ÓèUß î0iK†µ0†änXæ€W¨ÄaŠ0mK±þ•63Z½@…1¼ÁPr#[zÄ~gë¹~HW¨Šé@5¹áÀÝð;íU³*eOG3È*™³ü\òD•½JY,½\¬µ³mèŠè†\¡²¡ØvFΞ¹¡¨8;0[²§Çžû’ãz¥€ì;Nyϳ¹øÚ“-áR‰W©ÃÌ0rÌ`rãJE¬Jb#è~B6Ã9}«}®€2Sy¹ÄËUìÔèJ7ÚªâûxÉÉ çd+`ñ݇¾+T^œÍhžU³æ¬Ñž©)] ª^;Uõs QUϪú–\Ë­jñÐ}C¯êTê Í¿jzJ½ üÄ…ónrÃïÕVós,3•7Ÿ¿pƶdìä£:Õ“Í~ òâ4Ϫy2Í›³ùÎÞø U‡±c §ò Ö|‚5½RÀ¦léQ´ôðF“Ü3(~œ ޜώbxŒf”Ýà+TÖìx÷¬l¯Ç©c«%Sú;Ó3Tu¢ÂFn0âxv2„áTÕïT¹B¥Ó¬J”¬€dë€ÈÚŸ¨¾{䤯Seë@²y“§õ'›lGF›lxaß(¶óTŽXªoµ3°ÚÞì”Üüø] ¹ÿdµ|cñS²ŸXÓ~PÝÏ—¸²Oñ죕íùþ ×6uýà,rE¤ûbÛx£æ“/ù\Ê>5ö=]®p)ﻨï™~LiÍ÷›ìÛÂû=œø‘«–¦í3ÉÚìþ“Û{‹"=FOÓÏþsÆþ⹟ÿ÷cØ> ÷MéÿŽþ¸Þ5LJÇÕiW‡Ÿ?ÿòö㧟ºëï?}þòlbÿñضØwÔ¸»~zûñ5ØëÅíå;˜ö¾=‚Nvãóë¯Á^lŽîiwgÜýyóÞN<o®Ã›O½-´?½þövÿms•V<ÃÊúˆµŒ+·+—5–yÓÊ{”4¿SÒ8¥eЛˆ{œ&c|”ñw|ä:žrÒTÊ¥¨4d¡ƒ,´J˜Fé)ž‘Û ôN§„©<&ìŸ,átàLC¢4K´“lù¦U†iH”èÔ{RÈö»Ö(}Ô3¬X&¬U\qT>ò)Ö¤bZ-ˆ8T‰qµyÇÅ ¶×—Z9ÕT§P¼½LSsÓÔç…i*GNœUœÄÚ(®"Þu Õ3o}ÔÚBÒ:°xeÞ«H4ïóõPuÓÇÚíqÞkçqzíò³½ê¹^ò¸ƒy:°!D=î`<Å¿J¿!Šžy—Iˆº¢ ! ŸbM²,ã*C–Ï°dR¥¬–‡ŒrKYc™÷ª¾cèÒùÐ¥iÜìíb "Âë÷µÅ5&5&5Mó‘V‘Ƥ¦Ã¤>zO:¬&5IM‡I}Àš&õ:®1©é0©¥[Mj“šÎ'5ÑÔªó¤¦iRÓù¤¦1©é8©i•áÆD|ãTú|ˆ1>ƘãÙp¥1Ð鞦"/“šŽ“z5iÌfJ§¢$•‰|š<”&Q“ç˜ð˜át˜á;É–ïrVŽ©M>t¿â^Mmòù]g:Á²ÿÏ8Ö*®äó¤cÉ)Vž°Ò ‹V:ÃÒö€åQ°âŽåƒöˆeÞyáíc±{çÓþà¹ÜÓ‚Øã´þ˜D9rUêAž(ë*ß:t¨rêý¨ƒý"tÄ:Ôt†U&Öq J=ÅšT©+UÊP¥äS¬GQ<ÊÖ¨¶œV[ê„% ,µ—ÓÚËTû²ª½ŒÚËiíyª½¬j/£ö|Z{žj/«Úó¨=¥ö›7¯ªÍ£Ú¹®§<•Û—ª­'~üÕÁ{wßoï?;üZ“»d endstream endobj 2522 0 obj << /Type /ObjStm /N 100 /First 942 /Length 3470 /Filter /FlateDecode >> stream xÚ}šÛŠ$džï÷)êÒ-•çˆ!06ƒÆöÑÅX Ò€u`v,üøŽø«»*£3³`w§'*|•™½1Ó¶˜óF´Å$úQÿ¦º¥XõgÜ’Ù#mY’þÌ[©y‹A¶šXÖ­û=nø“ÐF5n’7NúWôOÙ¸nÒêÆQ›å†ibІنå­ÙtE6ms [‹&!~ªÚ®´´ÙtUåi“ØBÑùõ'Õ­h;*mSý‘Õ®M¢¨NsA´Ÿ¹Hª 1‡Oö(\VÙdK¹ñ¦­JÔ&U§ªãè'ý§5|Ò§Œ©éÀ$öIQÄ\ío9Iù¤ŸdË¥Ú(9l¹Å`Ÿ¢JkdŸ’ÁköIÝl#guD'¶OêJ 6žÂ)•M¹úThÕñ˜u K l#— ð‹õÐô¯õ( ª’ÍVòV©ØúO•`š‹…‰Lkû¼…¶¦bì“¡RÒ9, ”­]Õ@H0ÏU…fíjÚ(Ás •`ZjшÃËZ5´Ù´T 2‹Í«1äÐl¶Êš‰uEÏYlä47š¢M˜ {ÕÀ1Ö7 ÉFÑPHÍÉ}Û&$uri=xÓCsJ¤X_ –œÁ\"KÀÔL¿¦E %Ù–†¡²i¤¢)›«š_1°Ø¨ŠMóµà£¥nBniâÆXˆt2ÍŠ›˜UÃ#ïu¶Ø&Vé1%²)8[²WÓ âu¬‚ö¦1"ª4Y F {!+ÖÙrÉüéë¯?}õÏ·ÿ¼êï¬ïíß?}õ‡Í²ÿöòþúó‡ef¼Þ_ÃKŒß¾}ý߇¾Sûoß|ã+ç`Ñ ŸÆ’YïpôNtÙ»öJ4ãXúžcåùX{ï© é£w”+(™œ’ûo~{ÿüqÊüëËçSæWüå¿:ΗùiÊxÆ!ú8ÝGÝïH-âžö£èg;÷Ïçí3÷$&IÕí²îû`¤I0ºý°N‡Ù{Ϊn3¼Õçã#¤÷›:N]|±oQñA™xt]¨º½é„È<^ß¾üôúyû×ïþôË÷_þããåýã¦GL¿ýî/¯?ý>Þt}M½!Ü»6¦Ö›LÔ›²™öè;UõöÓÛÇÓÔGÃïžõí F(ý &§¦ÁäÔLN ÃĽI`’gÇÜG³¹¼d¨r7`2T)„Þoû °3%˜\Ç Sïh*0Õ©¸t;[-´UtS%L=”Ä0Io2N)önes½ÌµÕÛÑh®-Sìµe`Š½¶ L±×–)öÚ20%§ ®ï¯É Îæ>š-äSêß N©O§Ô'b§ÔûUŒSߦÀ÷}MŵÛÙl.®Tê©€J=•P¹§R*÷‰X*÷ŽøžóTžÍ}4[Ȩ܃*•€*½¼j zr J/®Â÷²G·³Ù\\¨Ò‹«UÜÄUúT¬Uzè ªs¾×yÞÕã•Õf yUÇUû¥BçÅ- ¤jïV©Ö»Áù6‡gSÍæêH57 Hµ^©ÖÃk Õzx ¤ZŸ±·æ+ŠMýh5Çèݧ˜Àr—öý/¿~¼¾a›[‰Åa{²ìëÓ“Hç˱ÑëÚ gƒœŸ6°õÙhh‰žŒ—Ÿu^yn©8ó¸ö:ú¶kÁlãÈÓàÊ6?{¡#>ª†‡Éübo*VmxSµŽa©´G[×Bí­xyO)o³Dá§p£ ¸»óë˯ȈGq³4!êXÈt“í…÷Á&?h4[ö6㘋·e³Õèl6r¶ CŠž Ά+™àHÅ k3'gcØüôöÊeq ÕÃö(%î–€¨¤…È嚥Kt<,£ÕÆÎfÜJrÎØ{Ëcc¼ÛŒ[)~<,³Eæ2MÁÙp%ùçC±P=êí» K9¾êMËNP7r‰‘‚ÃB$ݺ† ‘ Ü| ¸ù@&pJ+ôb ¾q«>6Vdªç2MÁÙp%Ó¸Õä§2nÕ‡27'Òê½X³K +6c-.1¬ÚŒµ.XÚügÃ…H«Nc­.¸VžÆÚ\p3¸5Ê nä7r±É±/N£LSp6\É7^UÙŠ›¨€›¸Õø6¬··p«>ÕF ‘rë.DZµ[rydåªÚ¼LãÖ²w†`óÒ[+. ¬ ­.òÒœ 2UQ«nr+[c#'¼‚›d7vÉRÁM_«F#…8Yo]»•ÆŠüì†ü¦gå«Ú|;ÃFÉ¡´š4Rv*u¸6––çüG³…F+a#ùðX ©¹Ì²"VmîÕ±ê0’'Þ@ͯ– ¸ÌU¶s{lËí±›xIÀ&~*”Á·“Ûþ•qgӮͿóÐj±ï´s{¤åöHÆ}l)ÁæâHÆ“Ë@2nì_'ª°ù¾‚ë"+éÜir2nìÃKàÖ\¸‘“ÉÆÍ bpóE„,ÖJ:·G^nlÜÄW0lÜijdã&~ibã&¾¼cã&¾¼c!u!“Ïí‘—Û#7i.·X`s2ÕÔ<#1nB.àasQ€àÅ+Îçö(ËíQÀ½ pó/Ø)'xæb‡œàsZ6Ç\ìÒ¢º”s{”åö(‚!úéÕw_Y1Öž,vf ™œÍŽŒ¡Tg³#`¨+…ÇÞh ç “Rp5E²ó€Úš³¤[SHòí’ƒ³¤Ì÷F(8®dâ\åÞ+XÉ-i¿].Žå~½\};Ü/W?.˜ûæ?.Dî7ÌnÅIû3yI¸cv[xÚ/™Ù·Ûo™]lâ~}:?—AÁÙp!S§èݯšÝªœö»f·¤¦ý²Ùèn›suI€ëæÕYâ¬ÑSZÕ6(ùhë¾v°¹ÑÎ äÖC;-«©¬ø¦6cÒ™‰ËDTüäŽWÙÞç^—|µ`Gr¡µIÿ.[µÍ‹“l:’/¯rÏŽì–9;prJ›Y\Åá ¸¸^:ùjsÎGºåU¶i‹û„±³»t±“»ÈÎ~ç¶S»Ä³’š{È!«¬ÌÊvÛ‡ÿìBb¥¿§‹ÍÒ¿·VöKì½ÑïgËQÖQ¼®ŠB+øÅB­Ü·X±/n°R_Ü•ŽúR{€V8ß7õAW=ÊÕº¦tÄå½UøâÖy«ïÅþ­ºÇ´;Šõ°Hüz”¨mU¡¢°îȈº>¸Õe}p%ªú8+²ü‹"=,ê©v”¦mU™¢ ­÷QÏÇå|p‚ö«®tF1Ü*‚â<ðühÜŽ’”V) ùàŽˆ¨ã£»†AÝ;Œ*>ºÅE|ÌÎd¾ß/Mytì´ªDQÀÇÚ‡õ{t›’6ªn…Gõ]­Šâ=º5Åx\lQt” ¼*œP¸Gé_:ÔíÑí(Û“»ÁBÕžÜeŠöäÁ(ÂÓbÙåcŸâÕ>…‚=¹@-ÕÕ!(דËMTëÇ7.» —ñ¾c†i^Ïñ±YÉj³B¡žÜ%°;½å cÁí±; .aÁÝñâŠPŽ½AV[Ö‹}¯ÐãßjpÞì›g0‹+˜ß`r)÷ö›}0ϸ—ÛÙh¢êýå‡÷—_üâ~÷ß}ÃÐ=AìÎ÷ô|‚K›vîêÝÜd[Çùëj;Käî .›Úįò¹Ó¥[X [› Áå]›ˆÇrÝÚVíÖ&(°·óμ{­]¹Õòmètér˜Ï}§{‚Û‰4òÅáOuòw%LžàúeaœåôI¾rKÚmètå–­°œFîð)…Q9ÞÈô8s|~ýþãí—Ÿ¿Ø¿ {,{+Î@gDz“¯"dÊ|Áî)–¡GmÕÙ±=nù;;¤Ç)©³cù~„å´Gónð"™uðÁ«rÍ/<È6Ö ßJîQ½Õ¥£v«ÇFåV|<¾Â:­¶Ó–´Vžo¾õ…pÛ‹ÇôÃj7#üìMoWN«±-ÏlídYç¿Ój” ­uËÍ·^ë¶Ch­ƒC[1u¿ [ã6„Çö¸+âA¾…¨®&¹|IíJ>þsGãxæÁŽû%–ÁŽK# ƒG;.d;Pæ;\¹{'òÿ$È(÷(a”‹K¥0ȵô¯$ÂåR¸r¢Ýž:\8A¸— ƒ„»©0¤ á~* iC¸t CÚ.žÂè.Ÿ¯ÝÀ»ëpåî­ÂÀœÀ<Ìi¿È˜£ŒÁ|Ø8^ÌNÐí©Ã… æq`Î`ž'ÌÓ蘧Q.˜§!Ö x©¬ÝÀ½ë7þ&yÌ° endstream endobj 2590 0 obj << /Type /ObjStm /N 100 /First 1045 /Length 4213 /Filter /FlateDecode >> stream xÚ•\M¯å¸Ýׯðr^€©HÔ) È*›`³H–ƒ,j:…¤4:•ÿ?â‘uëY"í×›?ÑÏ!)J”íKEÚ*-±±^БZÕ‹t”Q>˜!*G«Q/êcÆM|Ä”p—±Ä¢W툵µOTC8¢H:úUï¸êDµéUäJz•ûŸ i@RÔ«z¤@A¯øHpŸ)IÑ«v¤ÂÔuÄp$.^±#WtäØt”˜Žœ“ó‘++–2·¨ãÅztȸ’”mr”JŠ/¶£H•®£ÃèzTJñ¨‰ÑQ ´Q:*«É*uK…¤}û-L,zU.÷q·cÁ(rpcŒÒ¡»ŽnDÉèÛéK­Ú7Ñ!ÒsJG‹I1w2-Á~©»CÓ¯êÑ„pÕý`¥î@‚qºGB‰ê’Ü]ŠÜ]šèP™ºC #䤾-¸Ìý²ÂÞ¹ôËëðS¤XpÙµQV?ÖܵQãvm$­~Âÿ1Ŭ7t3÷H‰K×–j¿ìÚÒ‘®2æ˜pC×–ㆮ-W ë¬bVw[Tn¥k+©–®­vm¥Â³=Lc‘¢Üz„Åî=Å[»¶n6ÕV»¶ZáÓÚµUɪ­vm`ÓÚµqʪ­û"r\vm,1wm¬ÁЭcŠB¢Š¹k“nj½ìÚ„Jœu"ŒË®­ûT÷ù[€W;×x:¸GMl„9À][KIÃCº¶–ÑMtªRò]elý2éÎ:‚tmM²jë΋­ÁYÒÿ„Pqo:Q½ìÃô(AkïrŸ~÷»O¿ýŸ/?}ý×ñ¿ÿñ¯¯?|ûñŸÿøÍçIoÅØáøÓñ¾½¡½®í½¹”¶µÜÍ[{D»lí„vŒó—O¿ýïúñÛŽëÚá/Ÿ~ÿ{‡DK:\7ãª&£=níí´µW´§­Ñž·v/UŸ†"»v¸£›§ÕŠ}ˆVL©[¼Ô°µÂ9oípD.[;‘ï´·¥ƒÏ …ŽUgâ¢%*ÖÕ ‰´uõAR¶u!këƪhkq±ÎåöèUÇZÃ=±¶nm]ƒ:éÔ¨ëÔPàa5{Vçqö×·ëÝ>åMÚ–W6YmË+›¬ye“Õ¶¼±Q+Ip+šËÝ7ÀÕ´²EVÓÊYM+kP(°r,jZY#¥¨•Äs¹ÛÇ]Ô´²©UÓÊjÚ¢¦•Õ´EËjÚÒM«Ûž¥•µ5ºÀÍåîà¢C­¦-M[WÓª›Ãʦ½u5mÚº`%mõÓJ¹¤÷z—T4NÂjC “p5áçø¹C‘¥ Dë­„æ%Õj³æÃìÛû]œŒ»=Ü*ÕUiI¹Ú¬‹R^%*¼5+ %wj³Ž]ËÖ¬cWoY=1]ï÷ $aÄiQR€TÊÖ¬H¥mÍŠ´­ƒT¤¯J[3isq Óõ~Ÿ@UÝi “ªVJq‡T´yõ)­tš·j àЉéz¿O @Þu+5„Ò±®ê•°6"2¯iðt· p½ÛÅu¨¼(í=,k’¶ê¤Ýïí°—,®­Â’Nµµ[£¹Àæz÷ðmÇØó¡VŠk3kóŽR´y‡Ù3m\òooîDs¾_Þ®w߀§ 6ôÝhyC£+Ó†û©µQ×¥º.K7¨ÉåîÔº,mðº­x‡¼×°EÚY+ŒÏÈ:ëÿ3¦r¼³ö»U w»°Ñ×Àe Y­Í@S64Y[ëÚZtoãjúp.·ß@×°­FZÞ0jЮ“V`Çu" ¸7Z[•{«>ò÷KªÞí¬në4¬RË»·j)·¦~$mz¥øÿßÏ_~ùò·_¾üü÷¾£Ð<ôŠ®«H“ÑèeQ®½ËÎãz‡æ²(/}ïv1HŸbˆhÈbNÙ"úR±…êyEáE8Ö1lÃlô´˜^oѹÒ^+Â*Š#ET§/v³… ÌNÏ a3oо” fˆL's‹Ž'³È „Ž©t®¶Ä–«{7£<ñ-oV׺iLýÒlÕ#Q™Î¤ÛB Û ºe„,…è±í¡tO¸®·t˹ ”mÕÈR¯C§Eˆd•È"g%‡‘žA…\-á(B¹¥{â6º>Ð5H(] ‰‚D[ˆžB¶V|•õ‹pÝ[ˆó»Ì÷tw·tõœZùH…8 ÌÍâ<ÐÊUí4T¬ÙâÎJdí4TäÛ¹{â6ºÞÒmÓÒlª“,J¶… ZŸá˜BM”l¡ê<ëì]X ,wtOÜF׺c’Qvèªw©:ŒÂ=$Ïe¹–8å­^°n‰|O”V¿>/ºçÊXŒäx®‹ÅH^çªXhÇšÃj ˜C}®f‰º®Já†á‰uïwG0÷ëƒ;KiQ™"­fŒ ÔêKQhÕ„l „w4ï{ö|à°Sù^f.Âa±…ºÏˆÑŽä÷jqjU³çØ+žOC|¶Á û·ù<‹VâB”¸%9Rô-Ù‘‚TñFN(ž£-EWãXgÇnt}¤ Õ™lÕpvÃýÙ! ÷g‡/¿§ý¦P`©GºéÍêúH!Ť{î9ÚB¸A!¬(ÙŠʹâ8 ðH·½Y]èŽ# ¦êQI“=EGAMv"C)Ëf>­¦ ‘j+Ó=SÞ2=†1–•ÊÉÔª¹Z‚)Ò\-6VÍÕb3Ôó§–M‘ž'µrËöÈ¥ÇÀ¥p@™`ÇAæ$¦±@9‰i$x2'1Oæ$Fº©ÆÑÊŽzïxÏ ÍÈìçĦ¨3a3ýb^³8¢žÔ[d[Uv¿²¦=^ÑñžcÁ‚ÐR´õ&•‘-Óç”LŽŠ‚)ÒŸl[ (…oI¸{Ç'’=~¤ÚX«Šš)b=h·±öù%æ&©h‚lÁÚ"âqOKòÀ°¼ýî Ö±%f~­cGb´…ØÓQ°…ØÓ‘ÃF§lHÕ<¸Ÿ—u;Y:»>ÒųˆÌ¶êñDÂç¹ÙB]”C±myb÷Ã3‡ð»µÑõ‰¬NÂl[Yç`±1é3¶ã¡ÃhbG«È¶\7\kOþLoF¿'‚:cÌE|lJBS†À­Ù”!nÙeËjmèy`¹íÚãm®qZÎólâÊy´¿?$¾ÈÆbœŒÓ#žÕZ2¼ÉçQwŠ÷{ ¶.)üXtóyýýÉòU†'RF•Ìçat2Ÿ·‰Ø”A‰)OÀî¸y/½GÇ{š£$IÉ‚›ÜĦ p“˜2ÀMÍ”A_¶ôÕ¡¯Ð-Í´Ö¢ü¸²ðH{1ÕjªÜjÑ37U1e“‹)ؼë“×TH·4ëêÍÑñŽ&îÐ^ŒÇF“-T6¥8ˆñÐÓ(C ijO£$€p<½ÛÃOÜF×Gºx”J]<Í.°™B8Ö(Iä|ò–Z1eˆíÛÅe‚Þ{>QÕÚ*ÙDÕÙxì"ãˆ;f'Ô¹Ú×-D6Mp¾›r;MOÀ{Ç{–#éFãdRÎäYÍ0ɳJ5e 26e2["·ñ-MÚ§iúü·ã4‡™j2k’ŽbʲfÊÔl˜õ|”9ÝOдž[·Çlt>©ÆÎæ| ùýÙßKü›ž ‹Dt¤ R²¥È€éýžú"KÌÝÎènu5ù^îÁCûèÐBÍ1;Ò is¤ùý¶â"E HŽÁs2'ìŠÞêüL™$y´‘K<¡èÈÙéKxE¢8´ æ.m‚¹Ë3my3;?Ò&xìý¶þ"…ÇŠãO‚ǪG «N“èùKu„°¶Ä'Ö”ßÌά&ë„=Fpb »£Â›Ùù™¶:¬xSL?.ˆ¥8K¨ÖɃް¹ræGÆŽŽù‘anûqòŠÞêüH;Ãcì@Ïð˜8FÉccè%¡32vv^,dlíâcg+£åd´Œíaô|¢/Ú{ËSÃ’c±‚] 9î,ØÇ3· v2é1Ƴ•ÐÊZÁvÈ%6Þ[ô Ã%^¦ÖObõÖ{ý!Öâ$Š¾ü˜Ç‹•Ñê2C½7ÅcÇ' yóƒÇÞÓ“ÂÜÍ1ýgy¢ÍVFãd4†?›3ÅûPo;Âã S:Þ4%'Ž$@êÌ-ûÑúHÛÊhòŒ&Ø(''+ 6¦Éñ¶dH£ˆzŒ³'Ŧߛ s—ÇŒ&VF“d4ÇŠgõñn°ã±U§oÃû¦Þ¶¶áµÎè,ù ïuÚ/•¬è­Î´Þ õB±áÕNr¦€~*ª_ ;R5™$›6ÐvR)èµßñ[Ñ[ŸhS¨Pà±R©@Z)h;‘BãMz'R(Ž7“Ÿh½Õù‘6ê/aÜx‰Ø!Ç[ÄìHá1g Ô_"Á‘ÂÜ[r²ê/ú@ýE¨¿D<«ÃcÎ6ŒP‰³'Ô_â,Q„úKšcnÔ_b ¬è­Î´QIó Ãc­9R¼·%j6f.?O\- Ù©)µ,gíÑÊJœ¢Lë*qÎPU…f[EUŒOYŠÙú’ Ut"Mƶô'0¢m#”ZÑ9 D¥}^/Ô>MU«’jôH…Ú÷/Báx#×!‹÷šé¯ôDr¶R¨¿(¶x©’9Ìä'‡s×@ó‘ UcOºü€‚ÿåóT'“8™ÄÉä|…ægrt~÷+>@^¾í›Jir¢É‰&§¹BÕ¹BU*¿ús»—iÿ™¨æ endstream endobj 2707 0 obj << /Author (OISF) /Title (Suricata User Guide) /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.40.16)/Keywords() /CreationDate (D:20170215085501+01'00') /ModDate (D:20170215085501+01'00') /Trapped /False /PTEX.Fullbanner (This is pdfTeX, Version 3.14159265-2.6-1.40.16 (TeX Live 2015/Debian) kpathsea version 6.2.1) >> endobj 2691 0 obj << /Type /ObjStm /N 16 /First 149 /Length 556 /Filter /FlateDecode >> stream xÚ­•ÍnÛ0„ïz ›•ÄårI†€¢¾5MŠ¦=>(‰ð"ùз/Éh(ìz¯(~3Cƒ" µªI ¥µKÂ(2œ+có#«X|¢¬ÏÂ)WgᕧüVPÁˆ"W×J×ÆQé¸#×i÷&«“2J I±ÒÌ””UÚ²IJ¢[,Eõ}ýÔ«{’hïW$DÌ( ] /Length 6766 /Filter /FlateDecode >> stream xÚ%›y|iyçëÑÕºlI¶uß’uµ,©uU«[’mI¶%Û²eK–ïK²‡ ÌÃ:›I'l6 ÙY˜IÈ$!Ó[Ž™’J¸BB˜ôÒ!@ Ë0!K˜0»]ÃrLeûûó?ßO=¿÷­êª÷ù½ÕÕo=í8Žóïæ8uN‰ã”:æ”>Uܲ'¯–8U¹^4%h×ÐzKAYQ ­›°T • uF@%ZZ'a¨FkAë ¬µhÝhí„{À^´shm„u ¾Ä)y¸ ­•°ìC+Gk!Ü EÑš AÚ´&B5÷()ìES´ íÚBPñLKßÖ€¦ÃëbºÐn¡í#Ô@G¨,Z¦SÓ ö¡ißzÂ~p­M—5ÑtÎ{ ‡À0ZMC2¢hóhµ„£àÚš†s Œ£)oÕ„ VÔÒ5hJÅ$˜BÛ‡VI8 fÐzДÆYࢠ¢UÆÁÚ4š,I´“he„ó`íšì³£]D+!<Ž¢É²ÞXF»ƒ&Ÿ®€c%NyUñÔª²wƒh•h»„«` ±ÏкÐnžëh#h·Ï€³h3h7 7À9´9´„çÁ&Ú ´ë„[àÞÍ^#ÜѶѮ^—уìBá*Úm´Ë„:Àu´4í¦/žUypí"¡N¼¸[Å=¼›ÕGê¢wÑ¡] dÀ2ÅÉÞùÇ c4pÎFÃLÎpÈ03ÜU2ÌÚŒŽÇ\ÍpçÊÜá WßÄôý[ øÖ}²ð]ûdð ûdà{õÉÀ·é“{ß¡OÖzÐöý ðe˜¹P¼ŽÏê#Lèß0gîcÒZAh tnÐzAèÁC`Œ€(‡À &Á˜3`¸ æ@$Á-Ä*¡Ë°J¨‡±*s µ/>kÌYþ„B=‚ašP^ø%Ä/!Ž±@¸ßœ“êÜš@3Àa›9ë©—„ä2ì4çÌý3Å*!. qIˆKB\â’—„¸$Ä%!. qIˆKB\â’o+ŸÑ1HH.à s¶>ªÏÀ/!~ ñKˆ_Büâ—¿„ø%Ä/!~ ñKˆ_Büâ—¿„ø%Ä/!É W̹Óg`šÓ„$Ä4áÀC!~ ñKˆ_Büâ—¿„ø%ÜØ"Ä*á6Àá%sî¼^Ÿ¡\^צ oÌb«„ˆ;<Ö:ÀÌùÙÿ¡-¥ñª9wÿ@a)¨P ª@5¨µ 4=S7ƒvÐ F¬áu»:^YuñÞiO|Má~°×œ×~YaÑ9å©r¶­¤{б’÷—¨‡í‡˜=>«o5ÿ1‹Vš +ý›?TChµ’÷¼Sa›•mÖ;V–û_ {@§•~ê¯v>Ђ0†À(èµ²/ý£öæÑ墕?”u¬üå#Ò&Á!+àã ÇÀ8˜1«x‹çXÅwÛÕê‚)+ÿás §Á ˜µÈoý­´$ˆ[Å ïV8xŒ/~deÿóÒ–Á¼Uv¾WáX‡ÁQ°d•Oßq¬ª¬¸[Õ¯üwõ;V¬òݯVx ·ª¿ZR¸fÕ]UÚZ«Võ¦¨Â“à8mÕ? m œ±ê_¯ð,ØçÀy°i5“ŇŚO¿J]. V3ú}…Ûà¢Õîü»cµþÏI».[íJ…WÀUp p›ËšíýÇÛû^uÙ7mïÛS oÛVÿÅâç6Œsg-)Ș»Vÿ?ïª –/¨Á¬ýÓŠýÞø\þ¯Ò°w¡ÔþÓý}Ëv,0 køѻ۷ô@?ü uaª¬á‡ç2+ u ÖöšQ…=€©QØg•ºü?( õÖh2 z|+a,¶Xãï¾Ã±Æo~ɱ&÷Å"ÞÜ¡ÎL«B³5>>ª°´ñCÇ:“®ÐaM“«ê‚Ñ ½·p{á豦Ïש æ/`þæ/èPÃ`Ds¡€Û ³` ŒYÓW¿¥`ù–/Ęœ×ÙÂí…ikú—ÿ«.<Ãùdµ0gM/iJæAÜš^üS… d ¸ñ°raÁš»¿®V<^Àã…#Ö<šr¬ùÃ_-â¥ûc¿–¬yø.[ËÈ+´µ ŽYów¤ð88a-¯zVái°f-ƒk q{ᔵ|øb꺵<øŒÂ3ଵ|ÿi…›àœµüùêa¶ÌZø€c­ïùÇÚ*O±V®Ö‹`ËZw»^ÛÖöÎ_V¨q¹dmå_UxÙÚ>µàX{Û…LÂUk{ü%…LˆÂuk¿ö»Å.–vÜ´ö–j…·¬=ûm‡u…;Öþ膶vÁÙŽ;ÖÑðIu)±Ž7¾¨­(NgŸVXÊA(åË­ã_YÜ÷[§Ô¥ TƒP öJëøù¿R—=`/¨õ ì·ÎÒu9A“uÖï:ÖU9¦†vÐb{>¨°´Y÷È!…ZHé°®ŠÏ)ì´îÜŠc=í?,âB…´>ÐmÝý- {@¯õüç(ýÖÓö{ rºÔ!ëùúÇ‹G)<¯†(´ž{/+#Ö»ú!Çz_.Žd_Ó¢ÆÁ¨õ|¯]á!0f}ß+véßZ—6&¬ï;_S“`ÆÚû;xøÇj˜ÓÖÿOá,pAÜ>ûÒ@ÂοKaÌÛÀÖý“yÍ¡¡ ”ØÈ÷+, ”ÛÈÇSCT‚*°ÔZ´·C­{ÀPgÑh ­ìûAèü„º4ƒÀ½=Ú:@7è]‹¨³Ö{ASÅJÂ5 ÕÁ!0ZôÈ[µ›–GÀ(8ÄÓNwŒ[tõ¤úMÖÿ¢“€U¿¨kÑ˯ÖY°f,zîþ,îEã€%½è‚E_ûN€Ã}ø׬ÜE—ëuÑp gÁªEßPÐkà$8NƒupœÀ†EùŒö8´¦PÍÖEp \7Á¶EßòEu¾ ®ùåØ·,ú«êr›ïZyc×¢oËIÃHi¶ÒJ@©ç~_ŽH×ZPnÑ'4tiÜ”Æ>iì“Æ>iN2MâÓ{,šþKõk˜&_Ò¸)ÝpN«¤õ€KÒ,§[-ú¾µ/¦Ic®tÀ>é^F£Æ¢?§.ø ÝoÑ<¯æ4ÎI³^œÆiV‰ÓØ'ÍÚpG¤µ"Œ#Òó`Ä¢~Rв°ÖñFZ«¿˜!­5ßÐJ¯–lI|Z µ$>‘ÒZßÅéÝó‚ŠUÒØ'½j£&ì§Û辟*\³±G*µ…iÒë6Ú2ªo¤ñAzÃÆ~ö¬4­*[G¤7mü™'ÔŠ‡ÒÛ€y”¾lãŸyðFÓ¤¯Ûø?ü³4\’–-vXl•vËÆ?ÿ²¶v-6Ç´/¯*fãßÜPȳ^U¹ÿÛºc㯑V Êlü?¥°Tq¦{ØÚµ@á^P€›|³vãwTÕ>°46Ðh/<£.Í ´‚0úA»M>¯~ ô€^ÐÁˆƒ6ñòÏha£àã`Ì‚I‹•å´Ç˜IàZ¬ö¤â@?~t©‡Á¼ÅŽ¨u,‚£` ,-ݱXÓ_«ß вÿq° ´’œ'-Öùiu>´~¿´º¿´Þ¾i±ÁŸªŸ–é/-°_±ØøE5h þ`•=¥$ß°Ød\­·¿\ùÅRžâ=X¶Î¦û~ °”ZlÉWX°@**AÀ%©Pk±Ó£êŒ#R S G¤ôSšÄ§öYìüýOà )¬’j$>Õl±«ïT+fHµÌ"Ó©6‹í¼C­ø Õ0Cª‡ÅôN@VS˜&uýTŸÅ^õj톥RX%5Ä¥ê¬ðF ¤F,ö†ÇÔ«¤°J «¤tÐIà‚˜ÅÞô õÃ*)¬’š³û5̃¸ÅþË+ÎHZì¥iiØ'µ`±Ç¾¦ç¤ðKªh•ï5HÃH)Þ¥Vlòs÷…sRZÏn°Éo|SöI­ÚäWJb¸ÔI›*ûŠBì“:m“áQ…x(uƦÖ4ÅS.µaSGM!ï…R)µiSO}N†Ká°Ô6¸hS[Pà pÙ¦þô­ ¯ —ºfSÿçþeéaç¦M}t\!+|Ynº¥vlºyW[ÜKRw,n:ç›.0›ùª4¼”ÚôÜ#ŽMoŸ§ÿ[³pbPnÓ35 qg°dÓߨUˆ‹ƒ*›~Û=…Õ63þ’c3÷Þ­‹µ6sèbÛ[x2¨³™_ÚVötâû¹¼`Ñ Éf¾PPîaŽ Zm&÷„4nsÞ :læyy#À»Þ ðnÀ,À§AŸÍ¼ð‚º`à86À±ÁÍ„¿¬VŒŒØLáÏbà`Ôf_÷°c³z^~Ælæ§ÿ¦pœs>`³áwâØ f³þ§âì+ø4˜±Ù}H Ü,pë pl0÷æÕÊÝ1ÀèÁ‚¹¯ÎKÃÀÁs¬SˆîpÁŠ¹ÿäHÃÀ·¾gÜõ‚5s¿öµê‘]¯f”îzÁº¹Ï/ª•Ûa€ŸlàÓàœ¹ß¾¦VÞ_˜5À¬f xW`̇—ÍýÁÏ©3> ¸1Ü1¬p; pl°ÃÃ'7·àŽ¹?YÓ FÁ€Þ-–½Q,z•¿¶¡Îu Úâ•oUXxgx—„÷š@½Åë?ªÖÀ[Á{ûÖ_Ô¥ 4[¼å!õk­  ´ƒÀýïÞAÐmñ®fuæÆx¯ô~0,~ðauC@ë‰1µøèϨuŒƒ 0 &->yE­S`ÌXÜ=.m¸ æ@h!¥™­Ep,ƒ‹Ï?­}‚Ã`¬X|yG ÇÀ*X'Á)pœà86ÁUpÆâ«7t”-plƒKà2¸®ƒà&ÐÛæk?{BûÞz+7òòAñ~u•lyÇ¿úZma†|‰Åwûj‚”åõR¹ÂâwŸUVÉë¥rÅ:ïXü÷~^ ˜&_eñ~ °ÖâÏ–96ç¼O¡^Móøo+l°¹±ß*¶¾0 °ì·¹á?TxèÛ,1÷¨4ÇRùVK$2ÒÚ8I,•Ç*ùnKTƒ¾W1H¾Ï«{¤á¡<6Ë ’²ÄF—ZñP‡å£¿äYâ®ZÇFÊc³ü$ÀCy\’Ÿ±ÄÕשÊã¡<Êc•|Â;_RkàºüÀMy½1fB䗾ʯ\’?j‰—µ/FÊ'–Êc©<–ÊcšüiK¼&§Î˜0à°<Ëc®<¦ÉoYâõ÷ÇKå±Tþ"ÀWyì“¿b‰G~U]pbþÀfyl–Çfy|•ÇWù~'sÉ߱ěXâÜ ”€RPÊ-ñû]@Ä¿ù +~rWƒP ö€½ Ô3`íl©r`Ÿ%ý¬°¨¡¨þ ¨ê ô‚vK<Þ©=TfÐ T\Ð TR0ŠÎyâÔ¯PCpwP9pwP/p—úw£–x×£ê< (¸;( ¸;(¸; æÁ´%¼ÏhÞþß¼ó¿¼é¿›¼ß¿» ,ñÔßiEpªÑŬ‚KüùÓêw §Àš%>‘RÃIpMóÌcÒÖÁØg-ñɨá¸n€‹–øì€.ƒëàØ7-ñoRëm Š†8‹–•Š.ù²N#‹AX«dK-¹V%­DŽÐ" +‘,ŽàL$[ôзާÎ$‹‘ŠOÿ‰o¿QZ= çÙ¢7^x¯4¼Á-<’%ÓÙâ仨ÉM¿ûgªj‘â½äÿÝ?!‘Å9YJK²ý\‘Ž¢j‘KÚ+ÔO%Ø"«’|U¡ˆª@F,Yí©¶ÈªZD¥ Ó@…“–<ð/ꂲ*Á Y•‡¨ÎçdUݱ–ìè×8‚šHvÙ’ýò51Šo"TïD²«–½ªJò¸’ HvÝ’3ÿªAMV$»aÉäŒ4²OyR„â¥UMÊ"ÔAE(ŠP9¡¤*B­U„"¬ÕYʶ"ÔsE(«\Qfv,yä?êÈwÐ` ”‚2P*@T‚*P j@-Øö‚:KþI‹Ž7,y~Sá>°  4ƒÐ Ú@;è  tƒÐ ú@?8†À0˜ƒ–¼Ó玀(‡À fÁ”%oNi7ªù²ú´9àZrgY q :žbâw¿#-  wŽXò?|V ªíYÇÁŠ%ù{5¨˜ç8aÉ_/‘¶ ¨ÞY9 6ÁiKþö³j]gÁ8ô’†Ñð”²-KzÛê|lƒ‹à¸ ®€«à¸n€›à¸ v€ü‚A˜3•ñJ,ùåã I”Wfɾ¨«xXÅÃ*Vñ°Š‡U<¬âa«xXÅ«õ `ƒxÄà ñ0ˆ‡A< â‘A¯Ý’Ï\Ôçâ—x¸ÄÃ%yó4.¸ÄÃ%.ñð¤7ð‹‡_< âaƒxØÂà õÆ,ùìu}¾ò¦À4˜˜Æs¶ð°Š—8ÂÃWð[ò ó:Ê€K¼€<¼á©” x*àÂñN²ïXÀÃðάâmï‘xÄ{$Þ#ñ‰÷H¼Gâ=ï‘xÄ{$Þ#ñ‰÷H¼G­©Ë —•—’f—R—Ê—Jc·PêRp겸çRöëR[ëÖ þ\ª]êŸ]\*Q]Jm]~»Ôÿ¹übq©…p›…Ñ.•Á.—.%‘.5n' lÕ¥NÚ¥8×e ØåmË÷‚Ë‹/wP¦ë²Xã*[]~ͺ” º2Ò’%¿xKWIÍq¶Ï’ÿzR!¯~ÝI0¸¸¼õug â€2X—u=—Ÿ(.Åx.Õwî"àÉÒ¥øÐå•ËC‚» VÕ†.Ë1.5šî*X|9¸*Ú; Ö¥îY@1žËš¯Ë Àå}€K¡¦Ke¦Km­K1­{ \”gº”ï¹”ï¹Ô¸7…|.ë*.¥¶.O î. û¾êªÈ¾Oö}²ï«®Šìûdß'û>Ù÷ɾOö}²ï“}Ÿìûdß'û>Ù÷ɾOö}²ï“}_•vª„!û>Ù÷ɾOö}²ï“}Ÿìûdß'û>Ù÷ɾOö}²ï“}Ÿìûdß'û>Ù÷ɾO’} !}J}RáGøzÝOÎ}rî“s_oúɹOÎ}rî“sŸœûäÜ'ç>9÷ɹOÎ}rî“sŸœûJwñ^òÜ4¦Ë¶ðýŸh‹DùøÀÇ>>ðñ||àãøŇ„¬ÝÎØ|OA[gmþuÏikÃ柺¯³ù¯¿C[çmþGïÒÖ¦-4vikË.­hë‚-¼ÿ~« ²ûm±ôõz…¨wÇ "TUY­w2ˆY‡k¦¨šTõÔc¶X˳hUŽ,äÈBŽä8@N¥ò Çr §ò~ã9²# 9²# 9²# 9ÕÕ“…YÈ‘…YÈ‘…œþ@rú/YÈ‘…YÈéd!Gr̼©È1â9F<Ljçñ#žSžJôñ3/ÇÌË1ór̼œþŒÁÌË1órú¿3/Ç æTÊÏÌË1ór̼œJùõf^Ž™—cæåô¿ f^Ž™—cæåŠ3¯ºË±Å6Æ´ºË@ (e T€¨U Ô€Z°ìu 4€}`?8Ah- ´vÐ:Aè= ô~p €A0†Áˆ‚QpŒq0b`Li0f â`$@̃°ƒ#à(XË`ÇÁ ° ÖÀIp œëà 8 6À9pl‚-plƒ‹à¸ ®€«à¸n€›à¸ vÀ. ñ÷Š‰?ôÏba5‹…Õ,V³XXÍba5‹…Õ,Vß#ñ,4Vß#ñ,V³DXÍ›ïjÖ «ïÕÙâèžâA'ºÿ“øÎ_ endstream endobj startxref 4009759 %%EOF suricata-3.2.1/doc/userguide/initscripts.rst0000644000000000000000000000051513051004444016061 00000000000000Init Scripts ============ For Ubuntu with Upstart, the following can be used in /etc/init/suricata.conf: :: # suricata description "Intruder Detection System Daemon" start on runlevel [2345] stop on runlevel [!2345] expect fork exec suricata -D --pidfile /var/run/suricata.pid -c /etc/suricata/suricata.yaml -i eth1 suricata-3.2.1/doc/userguide/what-is-suricata.rst0000644000000000000000000000134713051004444016677 00000000000000What is Suricata ================ Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. It is open source and owned by a community-run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF. About the Open Information Security Foundation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Open Information Security Foundation is a non-profit foundation organized to build community and to support open-source security technologies like Suricata, the world-class IDS/IPS engine. License ------- The Suricata source code is licensed under version 2 of the :doc:`licenses/gnu-gpl-v2.0`. This documentation is licensed under the :doc:`licenses/cc-nc-4.0`. suricata-3.2.1/doc/userguide/licenses/0000755000000000000000000000000013051004444014640 500000000000000suricata-3.2.1/doc/userguide/licenses/gnu-gpl-v2.0.rst0000644000000000000000000004321413051004444017352 00000000000000GNU General Public License ========================== *Version 2, June 1991* *Copyright © 1989, 1991 Free Software Foundation, Inc.* *51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA* Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble ~~~~~~~~ The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: **(1)** copyright the software, and **(2)** offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ **0.** This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. **1.** You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. **2.** You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: * **a)** You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. * **b)** You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. * **c)** If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. **3.** You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: * **a)** Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, * **b)** Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, * **c)** Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. **4.** You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. **5.** You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. **6.** Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. **7.** If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. **8.** If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. **9.** The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. **10.** If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY ~~~~~~~~~~~ **11.** BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. **12.** IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. *END OF TERMS AND CONDITIONS* How to Apply These Terms to Your New Programs ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type \`show w'. This is free software, and you are welcome to redistribute it under certain conditions; type \`show c' for details. The hypothetical commands \`show w` and \`show c` should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than \`show w' and \`show c`; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program \`Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. suricata-3.2.1/doc/userguide/licenses/cc-nc-4.0.rst0000644000000000000000000003525113051004444016602 00000000000000Creative Commons Attribution-NonCommercial 4.0 International Public License =========================================================================== By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-NonCommercial 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions. Section 1 – Definitions. ------------------------ a. **Adapted Material** means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image. b. **Adapter's License** means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License. c. **Copyright and Similar Rights** means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights. d. **Effective Technological Measures** means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements. e. **Exceptions and Limitations** means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material. f. **Licensed Material** means the artistic or literary work, database, or other material to which the Licensor applied this Public License. g. **Licensed Rights** means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license. h. **Licensor** means the individual(s) or entity(ies) granting rights under this Public License. i. **NonCommercial** means not primarily intended for or directed towards commercial advantage or monetary compensation. For purposes of this Public License, the exchange of the Licensed Material for other material subject to Copyright and Similar Rights by digital file-sharing or similar means is NonCommercial provided there is no payment of monetary compensation in connection with the exchange. j. **Share** means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them. k. **Sui Generis Database Rights** means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world. l. **You** means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning. Section 2 – Scope. ------------------ a. **License grant.** 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to: A. reproduce and Share the Licensed Material, in whole or in part, for NonCommercial purposes only; and B. produce, reproduce, and Share Adapted Material for NonCommercial purposes only. 2. **Exceptions and Limitations.** For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions. 3. **Term.** The term of this Public License is specified in Section 6(a). 4. **Media and formats; technical modifications allowed.** The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material. 5. **Downstream recipients.** A. **Offer from the Licensor – Licensed Material.** Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License. B. **No downstream restrictions.** You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material. 6. **No endorsement.** Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i). b. **Other rights.** 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise. 2. Patent and trademark rights are not licensed under this Public License. 3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties, including when the Licensed Material is used other than for NonCommercial purposes. Section 3 – License Conditions. ------------------------------- Your exercise of the Licensed Rights is expressly made subject to the following conditions. a. **Attribution.** 1. If You Share the Licensed Material (including in modified form), You must: A. retain the following if it is supplied by the Licensor with the Licensed Material: i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated); ii. a copyright notice; iii. a notice that refers to this Public License; iv. a notice that refers to the disclaimer of warranties; v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable; B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License. 2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information. 3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable. 4. If You Share Adapted Material You produce, the Adapter's License You apply must not prevent recipients of the Adapted Material from complying with this Public License. Section 4 – Sui Generis Database Rights. ---------------------------------------- Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material: a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database for NonCommercial purposes only; b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material; and c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database. For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights. Section 5 – Disclaimer of Warranties and Limitation of Liability. ----------------------------------------------------------------- a. **Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.** b. **To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.** c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability. Section 6 – Term and Termination. --------------------------------- a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically. b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates: 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or 2. upon express reinstatement by the Licensor. For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License. c. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License. d. Sections 1, 5, 6, 7, and 8 survive termination of this Public License. Section 7 – Other Terms and Conditions. --------------------------------------- a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed. b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License. Section 8 – Interpretation. --------------------------- a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License. b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions. c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor. d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority. **Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.†Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons†or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.** **Creative Commons may be contacted at creativecommons.org.** suricata-3.2.1/doc/userguide/licenses/index.rst0000644000000000000000000000052313051004444016421 00000000000000Licenses ======== .. toctree:: :titlesonly: gnu-gpl-v2.0 cc-nc-4.0 Suricata Source Code -------------------- The Suricata source code is licensed under version 2 of the :doc:`gnu-gpl-v2.0`. Suricata Documentation ---------------------- The Suricata documentation (this documentation) is licensed under the :doc:`cc-nc-4.0`. suricata-3.2.1/doc/userguide/suricata.10000644000000000000000000002143613051004506014655 00000000000000.\" Man page generated from reStructuredText. . .TH "SURICATA" "1" "February 15, 2017" "3.2.1" "Suricata" .SH NAME suricata \- Suricata . .nr rst2man-indent-level 0 . .de1 rstReportMargin \\$1 \\n[an-margin] level \\n[rst2man-indent-level] level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \\n[rst2man-indent0] \\n[rst2man-indent1] \\n[rst2man-indent2] .. .de1 INDENT .\" .rstReportMargin pre: . RS \\$1 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] . nr rst2man-indent-level +1 .\" .rstReportMargin post: .. .de UNINDENT . RE .\" indent \\n[an-margin] .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] .nr rst2man-indent-level -1 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. .SH SYNOPSIS .sp \fBsuricata\fP [OPTIONS] [BPF FILTER] .SH DESCRIPTION .sp Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non\-profit foundation, the Open Information Security Foundation (OISF). .SH OPTIONS .INDENT 0.0 .TP .B \-h Display a brief usage overview. .UNINDENT .INDENT 0.0 .TP .B \-V Displays the version of Suricata. .UNINDENT .INDENT 0.0 .TP .B \-c Path to configuration file. .UNINDENT .INDENT 0.0 .TP .B \-T Test configuration. .UNINDENT .INDENT 0.0 .TP .B \-v The \-v option enables more verbosity of Suricata\(aqs output. Supply multiple times for more verbosity. .UNINDENT .INDENT 0.0 .TP .B \-r Run in pcap offline mode reading files from pcap file. .UNINDENT .INDENT 0.0 .TP .B \-i After the \-i option you can enter the interface card you would like to use to sniff packets from. This option will try to use the best capture method available. .UNINDENT .INDENT 0.0 .TP .B \-\-pcap[=] Run in PCAP mode. If no device is provided the interfaces provided in the \fIpcap\fP section of the configuration file will be used. .UNINDENT .INDENT 0.0 .TP .B \-\-af\-packet[=] Enable capture of packet using AF_PACKET on Linux. If no device is supplied, the list of devices from the af\-packet section in the yaml is used. .UNINDENT .INDENT 0.0 .TP .B \-q Run inline of the NFQUEUE queue ID provided. May be provided multiple times. .UNINDENT .INDENT 0.0 .TP .B \-s With the \-s option you can set a file with signatures, which will be loaded together with the rules set in the yaml. .UNINDENT .INDENT 0.0 .TP .B \-S With the \-S option you can set a file with signatures, which will be loaded exclusively, regardless of the rules set in the yaml. .UNINDENT .INDENT 0.0 .TP .B \-l With the \-l option you can set the default log directory. If you already have the default\-log\-dir set in yaml, it will not be used by Suricata if you use the \-l option. It will use the log dir that is set with the \-l option. If you do not set a directory with the \-l option, Suricata will use the directory that is set in yaml. .UNINDENT .INDENT 0.0 .TP .B \-D Normally if you run Suricata on your console, it keeps your console occupied. You can not use it for other purposes, and when you close the window, Suricata stops running. If you run Suricata as deamon (using the \-D option), it runs at the background and you will be able to use the console for other tasks without disturbing the engine running. .UNINDENT .INDENT 0.0 .TP .B \-\-runmode With the \fI\-\-runmode\fP option you can set the runmode that you would like to use. This command line option can override the yaml runmode option. .sp Runmodes are: \fIworkers\fP, \fIautofp\fP and \fIsingle\fP\&. .sp For more information about runmodes see \fBRunmodes\fP in the user guide. .UNINDENT .INDENT 0.0 .TP .B \-F Use BPF filter from file. .UNINDENT .INDENT 0.0 .TP .B \-k [all|none] Force (all) the checksum check or disable (none) all checksum checks. .UNINDENT .INDENT 0.0 .TP .B \-\-user= Set the process user after initialization. Overrides the user provided in the \fIrun\-as\fP section of the configuration file. .UNINDENT .INDENT 0.0 .TP .B \-\-group= Set the process group to group after initialization. Overrides the group provided in the \fIrun\-as\fP section of the configuration file. .UNINDENT .INDENT 0.0 .TP .B \-\-pidfile Write the process ID to file. Overrides the \fIpid\-file\fP option in the configuration file and forces the file to be written when not running as a daemon. .UNINDENT .INDENT 0.0 .TP .B \-\-init\-errors\-fatal Exit with a failure when errors are encountered loading signatures. .UNINDENT .INDENT 0.0 .TP .B \-\-disable\-detection Disable the detection engine. .UNINDENT .INDENT 0.0 .TP .B \-\-dump\-config Dump the configuration loaded from the configuration file to the terminal and exit. .UNINDENT .INDENT 0.0 .TP .B \-\-build\-info Display the build information the Suricata was built with. .UNINDENT .INDENT 0.0 .TP .B \-\-list\-app\-layer\-protos List all supported application layer protocols. .UNINDENT .INDENT 0.0 .TP .B \-\-list\-keywords=[all|csv|] List all supported rule keywords. .UNINDENT .INDENT 0.0 .TP .B \-\-list\-runmodes List all supported run modes. .UNINDENT .INDENT 0.0 .TP .B \-\-set = Set a configuration value. Useful for overriding basic configuration parameters in the configuration. For example, to change the default log directory: .INDENT 7.0 .INDENT 3.5 .sp .nf .ft C \-\-set default\-log\-dir=/var/tmp .ft P .fi .UNINDENT .UNINDENT .UNINDENT .INDENT 0.0 .TP .B \-\-engine\-analysis Print reports on analysis of different sections in the engine and exit. Please have a look at the conf parameter engine\-analysis on what reports can be printed .UNINDENT .INDENT 0.0 .TP .B \-\-unix\-socket= Use file as the Suricata unix control socket. Overrides the \fIfilename\fP provided in the \fIunix\-command\fP section of the configuration file. .UNINDENT .INDENT 0.0 .TP .B \-\-pcap\-buffer\-size= Set the size of the PCAP buffer (0 \- 2147483647). .UNINDENT .INDENT 0.0 .TP .B \-\-netmap[=] Enable capture of packet using NETMAP on FreeBSD or Linux. If no device is supplied, the list of devices from the netmap section in the yaml is used. .UNINDENT .INDENT 0.0 .TP .B \-\-pfring[=] Enable PF_RING packet capture. If no device provided, the devices in the Suricata configuration will be used. .UNINDENT .INDENT 0.0 .TP .B \-\-pfring\-cluster\-id Set the PF_RING cluster ID. .UNINDENT .INDENT 0.0 .TP .B \-\-pfring\-cluster\-type Set the PF_RING cluster type (cluster_round_robin, cluster_flow). .UNINDENT .INDENT 0.0 .TP .B \-d Run inline using IPFW divert mode. .UNINDENT .INDENT 0.0 .TP .B \-\-dag Enable packet capture off a DAG card. If capturing off a specific stream the stream can be select using a device name like "dag0:4". This option may be provided multiple times read off multiple devices and/or streams. .UNINDENT .INDENT 0.0 .TP .B \-\-napatech Enable packet capture using the Napatech Streams API. .UNINDENT .INDENT 0.0 .TP .B \-\-mpipe Enable packet capture using the TileGX mpipe interface. .UNINDENT .INDENT 0.0 .TP .B \-\-erf\-in= Run in offline mode reading the specific ERF file (Endace extensible record format). .UNINDENT .INDENT 0.0 .TP .B \-\-simulate\-ips Simulate IPS mode when running in a non\-IPS mode. .UNINDENT .SH OPTIONS FOR DEVELOPERS .INDENT 0.0 .TP .B \-u Run the unit tests and exit. Requires that Suricata be compiled with \fI\-\-enable\-unittests\fP\&. .UNINDENT .INDENT 0.0 .TP .B \-U, \-\-unittest\-filter=REGEX With the \-U option you can select which of the unit tests you want to run. This option uses REGEX. Example of use: suricata \-u \-U http .UNINDENT .INDENT 0.0 .TP .B \-\-list\-unittests List all unit tests. .UNINDENT .INDENT 0.0 .TP .B \-\-fatal\-unittests Enables fatal failure on a unit test error. Suricata will exit instead of continuuing more tests. .UNINDENT .INDENT 0.0 .TP .B \-\-unittests\-coverage Display unit test coverage report. .UNINDENT .SH SIGNALS .sp Suricata will respond to the following signals: .INDENT 0.0 .TP .B SIGUSR2 Causes Suricata to perform a live rule reload. .TP .B SIGHUP Causes Suricata to close and re\-open all log files. This can be used to re\-open log files after they may have been moved away by log rotation utilities. .UNINDENT .SH FILES AND DIRECTORIES .INDENT 0.0 .TP .B /usr/local/etc/suricata/suricata.yaml Default location of the Suricata configuration file. .TP .B /usr/local/var/log/suricata Default Suricata log directory. .UNINDENT .SH BUGS .sp Please visit Suricata\(aqs support page for information about submitting bugs or feature requests. .SH NOTES .INDENT 0.0 .IP \(bu 2 Suricata Home Page .INDENT 2.0 .INDENT 3.5 \fI\%https://suricata\-ids.org/\fP .UNINDENT .UNINDENT .IP \(bu 2 Suricata Support Page .INDENT 2.0 .INDENT 3.5 \fI\%https://suricata\-ids.org/support/\fP .UNINDENT .UNINDENT .UNINDENT .SH COPYRIGHT 2016, OISF .\" Generated by docutils manpage writer. . suricata-3.2.1/doc/userguide/Makefile.am0000644000000000000000000000405713051004444015015 00000000000000EXTRA_DIST = \ conf.py \ index.rst \ install.rst \ acknowledgements.rst \ rule-management \ command-line-options.rst \ initscripts.rst \ public-data-sets.rst \ what-is-suricata.rst \ make-sense-alerts.rst \ setting-up-ipsinline-for-linux.rst \ unix-socket.rst \ capture-hardware \ configuration \ file-extraction \ licenses \ manpages \ output \ performance \ reputation \ rules \ setting-up-ipsinline-for-linux \ partials if HAVE_SURICATA_MAN man1_MANS = suricata.1 endif if HAVE_SPHINXBUILD man1_MANS = suricata.1 if HAVE_PDFLATEX EXTRA_DIST += $(man1_MANS) userguide.pdf endif SPHINX_BUILD = sphinx-build -q html: sysconfdir=$(sysconfdir) \ localstatedir=$(localstatedir) \ version=$(PACKAGE_VERSION) \ $(SPHINX_BUILD) -W -b html -d _build/doctrees \ $(top_srcdir)/doc/userguide _build/html _build/latex/Suricata.pdf: sysconfdir=$(sysconfdir) \ localstatedir=$(localstatedir) \ version=$(PACKAGE_VERSION) \ $(SPHINX_BUILD) -W -b latex -d _build/doctrees \ $(top_srcdir)/doc/userguide _build/latex # The Sphinx generated Makefile is GNU Make specific, so just do what # it does here - yes, multiple passes of pdflatex is required. cd _build/latex && pdflatex Suricata.tex cd _build/latex && pdflatex Suricata.tex cd _build/latex && pdflatex Suricata.tex cd _build/latex && makeindex -s python.ist Suricata.idx cd _build/latex && pdflatex Suricata.tex cd _build/latex && pdflatex Suricata.tex userguide.pdf: _build/latex/Suricata.pdf cp _build/latex/Suricata.pdf userguide.pdf pdf: userguide.pdf _build/man/suricata.1: sysconfdir=$(sysconfdir) \ localstatedir=$(localstatedir) \ version=$(PACKAGE_VERSION) \ $(SPHINX_BUILD) -b man -d _build/doctrees \ $(top_srcdir)/doc/userguide _build/man suricata.1: _build/man/suricata.1 cp _build/man/suricata.1 suricata.1 man: _build/man/suricata.1 # Remove build artifacts that aren't tracked by autotools. clean-local: rm -rf $(top_builddir)/doc/userguide/_build rm -f $(top_builddir)/doc/userguide/suricata.1 rm -f $(top_builddir)/doc/userguide/userguide.pdf endif # HAVE_SPHINXBUILD suricata-3.2.1/doc/userguide/manpages/0000755000000000000000000000000013051004444014626 500000000000000suricata-3.2.1/doc/userguide/manpages/suricata.rst0000644000000000000000000000226013051004444017113 00000000000000Suricata ======== SYNOPSIS -------- **suricata** [OPTIONS] [BPF FILTER] DESCRIPTION ----------- Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). OPTIONS -------------- .. include:: ../partials/options.rst OPTIONS FOR DEVELOPERS ---------------------- .. include:: ../partials/options-unittests.rst SIGNALS ------- Suricata will respond to the following signals: SIGUSR2 Causes Suricata to perform a live rule reload. SIGHUP Causes Suricata to close and re-open all log files. This can be used to re-open log files after they may have been moved away by log rotation utilities. FILES AND DIRECTORIES --------------------- |sysconfdir|/suricata/suricata.yaml Default location of the Suricata configuration file. |localstatedir|/log/suricata Default Suricata log directory. BUGS ---- Please visit Suricata's support page for information about submitting bugs or feature requests. NOTES ----- * Suricata Home Page https://suricata-ids.org/ * Suricata Support Page https://suricata-ids.org/support/ suricata-3.2.1/doc/userguide/manpages/index.rst0000644000000000000000000000007713051004444016413 00000000000000Man Pages ========= .. toctree:: :maxdepth: 1 suricata suricata-3.2.1/doc/userguide/rule-management/0000755000000000000000000000000013051004444016114 500000000000000suricata-3.2.1/doc/userguide/rule-management/rule-reload.rst0000644000000000000000000000122313051004444020777 00000000000000Rule Reloads ============ Suricata can be told to reloads it's rules without restarting. This works by sending Suricata a signal or by using the unix socket. When Suricata is told to reload the rules these are the basic steps it takes: * Load new config * Load new rules * Construct new detection engine * Swap old and new detection engines * Make sure all threads are updated * Free old detection engine Suricata will continue to process packets normally during this process. Keep in mind though, that the system should have enough memory for both detection engines. Signal:: kill -USR2 $(pidof suricata) Unix socket:: suricatasc -c reload-rules suricata-3.2.1/doc/userguide/rule-management/adding-your-own-rules.rst0000644000000000000000000000267113051004444022747 00000000000000Adding Your Own Rules ===================== If you would like to create a rule yourself and use it with Suricata, this guide might be helpful. Start creating a file for your rule. Type for example the following in your console: :: sudo nano local.rules Write your rule, see :doc:`../rules/intro` and save it. Open yaml :: sudo nano /etc/suricata/suricata.yaml and make sure your local.rules file is added to the list of rules. Now, run Suricata and see if your rule is being loaded. :: suricata -c /etc/suricata/suricata.yaml -i wlan0 If your rule failed to load, check if you have made a mistake anywhere in the rule. Mind the details; look for mistakes in special characters, spaces, capital characters etc. Next, check if your log-files are enabled in suricata.yaml. If you had to correct your rule and/or modify yaml, you have to restart Suricata. If you see your rule is successfully loaded, you can double check your rule by doing something that should trigger it. Enter: :: tail -f /var/log/suricata/fast.log If you would make a rule like this: :: alert http any any -> any any (msg:"Do not read gossip during work"; content:"Scarlett"; nocase; classtype:policy-violation; sid:1; rev:1;) Your alert should look like this: :: 09/15/2011-16:50:27.725288 [**] [1:1:1] Do not read gossip during work [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.32:55604 -> 68.67.185.210:80 suricata-3.2.1/doc/userguide/rule-management/oinkmaster.rst0000644000000000000000000001121013051004444020735 00000000000000Rule Management with Oinkmaster =============================== It is possible to download and install rules manually, but there is a much easier and quicker way to do so. There are special programs which you can use for downloading and installing rules. There is for example `Pulled Pork `_ and `Oinkmaster `_. In this documentation the use of Oinkmaster will be described. To install Oinkmaster, enter: :: sudo apt-get install oinkmaster There are several rulesets. There is for example Emerging Threats (ET) Emerging Threats Pro and VRT. In this example we are using Emerging Threats. Oinkmaster has to know where the rules an be found. These rules can be found at: :: https://rules.emergingthreats.net/open/suricata-3.2/emerging.rules.tar.gz open oinkmaster.conf to add this link by entering: :: sudo nano /etc/oinkmaster.conf Place a # in front of the url that is already there and add the new url like this: .. image:: oinkmaster/oinkmasterconf.png (Close oinkmaster.conf by pressing ctrl x, followed by y and enter. ) The next step is to create a directory for the new rules. Enter: :: sudo mkdir /etc/suricata/rules Next enter: :: cd /etc sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules In the new rules directory a classification.config and a reference.config can be found. The directories of both have to be added in the suricata.yaml file. Do so by entering: :: sudo nano /etc/suricata/suricata.yaml And add the new file locations instead of the file locations already present, like this: .. image:: oinkmaster/suricata_yaml.png To see if everything works as pleased, run Suricata: :: suricata -c /etc/suricata/suricata.yaml -i wlan0 (or eth0) You will notice there are several rule-files Suricata tries to load, but are not available. It is possible to disable those rule-sets in suricata.yaml by deleting them or by putting a # in front of them. To stop Suricata from running, press ctrl c. Emerging Threats contains more rules than loaded in Suricata. To see which rules are available in your rules directory, enter: :: ls /etc/suricata/rules/*.rules Find those that are not yet present in suricata.yaml and add them in yaml if desired. You can do so by entering : :: sudo nano /etc/suricata/suricata.yaml If you disable a rule in your rule file by putting a # in front of it, it will be enabled again the next time you run Oinkmaster. You can disable it through Oinkmaster instead, by entering the following: :: cd /etc/suricata/rules and find the sid of the rule(s) you want to disable. Subsequently enter: :: sudo nano /etc/oinkmaster.conf and go all the way to the end of the file. Type there: :: disablesid 2010495 Instead of 2010495, type the sid of the rule you would like to disable. It is also possible to disable multiple rules, by entering their sids separated by a comma. If you run Oinkmaster again, you can see the amount of rules you have disabled. You can also enable rules that are disabled by default. Do so by entering: :: ls /etc/suricata/rules In this directory you can see several rule-sets Enter for example: :: sudo nano /etc/suricata/rules/emerging-malware.rules In this file you can see which rules are enabled en which are not. You can not enable them for the long-term just by simply removing the #. Because each time you will run Oinkmaster, the rule will be disabled again. Instead, look up the sid of the rule you want to enable. Place the sid in the correct place of oinkmaster.config: :: sudo nano /etc/oinkmaster.conf do so by typing: :: enablesid: 2010495 Instead of 2010495, type the sid of the rule you would like to to enable. It is also possible to enable multiple rules, by entering their sids separated by a comma. In oinkmaster.conf you can modify rules. For example, if you use Suricata as inline/IPS and you want to modify a rule that sends an alert when it matches and you would like the rule to drop the packet instead, you can do so by entering the following: :: sudo nano oinkmaster.conf At the part where you can modify rules, type: :: modifysid 2010495 “alert†| “drop†The sid 2010495 is an example. Type the sid of the rule you desire to change, instead. Rerun Oinkmaster to notice the change. Updating your rules ~~~~~~~~~~~~~~~~~~~ If you have already downloaded a ruleset (in the way described in this file), and you would like to update the rules, enter: :: sudo oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules It is recommended to update your rules frequently. Emerging Threats is modified daily, VRT is updated weekly or multiple times a week. suricata-3.2.1/doc/userguide/rule-management/index.rst0000644000000000000000000000014213051004444017672 00000000000000Rule Management =============== .. toctree:: oinkmaster adding-your-own-rules rule-reload suricata-3.2.1/doc/userguide/rule-management/oinkmaster/0000755000000000000000000000000013051004444020270 500000000000000suricata-3.2.1/doc/userguide/rule-management/oinkmaster/oinkmasterconf.png0000644000000000000000000045634413051004444023760 00000000000000‰PNG  IHDR7WÑVø>sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ _:åï IDATxÚì}gxÕÕð9÷Î쮤UïŪ–-÷"÷nã‚+7°M ¡‡„„„$„ò&$ùBH#¼@B %Ô€é`°î½Y¶Õ{׶™{Ï÷cvW+iw%Ù&oö<~üH«Ù;·œ{zA"‚„ !Aþ-…¶ !ABâR!AB‚„¸TB‚„ Ä¥B‚„ !q©„ !AˆK… !ABâR!AB‚\.— eP… !AþMýò¤?ôÃuëÞFÀÐ… !A¾<°;쯼òúø = øý4<<<...Ä£B‚„ _*8œaŠªyÀ?—BD þB‚„ _2ôÈj” CÄ^¾£Ë“Ý?¹Ì5xG»²#ÿ‡žè—ºÛÿ3!IBðßÊåÓCñÒuMÓÉbQðÊÒD”R ]'d&U¹‚Té?‘â»Õ\"]×S8gÿWîë^3ºÐta2©Œ]1½ÅÖø•ˆ¤”š¦+Ê•§ø=­ëÒAHfMÎP[*Ú4„^«¼—©4ûå:.—†Šª öÌuˆ#â³ÃlõÍð N˜ÌÑ©‰LkihÑC1?!Áô!_JץåkšÐ5¡kÂårêÒœ?fÂÔ!q$”Ì ó¾>7DZOäÆ .M8]ºî\s:|¿¥„'N˜;÷ªV—P3ÇÏ^TÇ¥$Sd´Õdbîçz|‹Ý©éšæ}LHété.»]ƒ˜ ³§ç'™AÊ+Ë¢ˆ@RÓ¥® !„ú•rö¡=ýúÕc³#X¯ ØÝ;¬kšqŽº®¹.cJäÒx¿±³f¦[êÝ!DÕœœÕ¯ÅÂHJ‰n²ÉDÄuê]?Yœ¨I@ÎPH h?¾å“7¶Éï«}ëH§YKÌ4H«?u¶¦] §ÜÁÜ0S¸56Ò®ô,š"‡/YºÐ¼õ±—ÏB˜ eŽ]>;½zÓ'[Ê%g¾“$TÍá11V‹bHÛ HWÜ‚„àßÒâ ˜ÃRãõío¿~ªÚ E{cU]SÃ+Ïm™è¦@àÔ…”Ä@r”œ+À•X€9:1Ñ\½õ£ gª] ·7´ ºÔ„D’aR0ƒðˆÖ/^øÃNÝ¡†Å[¬Qq±1@à°Û$sDd0åƒaíyZ>¸àøÁ3§ZHJ OM:6³ìu§î¨û룷(fs˜.HÓ%‰ UÆ\œšfQP1™š”ºËÄÑd kjs…™¤Ùl º(–7φ£›ßú¸\MÌNãq.%¹„IBA@EEÄ6‡¦ 0$΀sE×…”$˜$’ºª*ÈU—.¡ŠBD(€95@*œ3®±|" ýÔ»¯å"lô²ÕcÅov®ÁÖÜX×,¸:’ä ¸ªèu)‘ÝÅ-ašFI"$© )&3çŽ/^úÓ.©……‡k%ID J®*ŠÍ©3$Pq®ã½×l¹519ÃÒý¼%*1%ÁiF‚œB"I© 7Œ‰„N]<Œ£äŒ1E½R†Ö„ ÿ¾\Ê}ÏEÛų§Ž•:P5©¦ˆ”ë¾µzTÝ¿~»Ê+„;XTáìyWmVE[ù–u¯l9ÓJŠÒ…@é¨;öÔÑ; ªf‹EU"̸uåô´pÒ4ŒŠÐNí`ÖüèÖ¶§¾õ|% -jÐÌ;¿WØPqa×;/^* ƦŠ¿h™;)#=îLc­‹E&¦äæŠó[«›¸%ã|íâ›O|t´Õš9òš%3%Z§š½oýíãòÅßùná­Å±Cfß}ãÈÓÿøÓëÇeüÜŸÿϬã?ùÍ{RR7FD§ZêK?{ÿ£%n9É9G®ð¬«—\=q@²Ea­%ß|ýý‹6Ó°…·­ž˜d¶„9Jö¼ýƇ'š”¼i î\2펶ÒÃo¾õá°ìºùc³¢@k=õÙÛ¯t¢%fÎ÷Yn2Aë¾õo}°ý¬‹™00ÉG¢¶Š‹-ºfNmµµkÏ×:ddúÌ5kf JæÜäªØóêkë/èIKÖ®™•ciom?¿ñ•)7ýà¾Qj³]šPoªªuFÅFGFZ\ÅÛŸxâ­R3ãþŸ/´¿ûÄ«‡!ú ×ÏËfv»TTgé›Ï½x¸Ò•;uÅ 3 b#LÐzñƒ—^ÞUÝg>ARoo·!èLÓ„¡Û)ñý—^·`LF3™š}ôâ?wkÎÇÓgßv×Ê\Þ`#ÎÅ™m﾿épƒ ©A¾\J†ç,½ù®É­:ƒö㻶î9eRè²Ã'!‰õ>eNmáwÛÊÔW]·lþìSç߬–JNm’jâèå7EOoÓI¶Þ¼iëõÆ5sõo<µ§L°äšq†R@º® @äJË©Ï?üà‹¢F©;xlÐÖXz²Ò:8+õð骪°Äì¡ý[Š7U·Jà t]’”ÜvâÓ×þ¹·\íÜœ`nýìµ¿í­²Œ»æ†ÑêùuO¿Ô7tí­ ®ññŸöéº.$Z¢¢ÔÖ3o­{ïl[ô¨y×Ï3èüLJÊ÷}ø‡ÝÿÔ•ÄY«VÌš½ó­â¾±(4GXòï'0>£¿RQ¥³¨ÂiÓ6lùåÓûZÃ}ï§kf>µ•Üþ(f ‹+ÝüÄÿn³YÓ†/]1Fcí;»+%ç!6‚ü÷s)¶êò’ÒF ÑÙЦ2$ðu‚3¥¤ddå§E¬ˆãâÖØähÇYk¯n'Φ¥«±²ìbi“ÒÞd×dìÈ‘¶Ž—Õ tTÕÛµ¸îŒ@w9líívDdÁ_àh#='gˆå¦»ò$ðäì4y1ÂR*IwÙš›Z9çŠH8[ZškëÏ«œÙÞ\[SÙ~þt+Õ/÷Ù}¤ËÞÜÔPWßzêÔ…i£„¸¼Q³Æ¤E‡Å¥¦D^ Ç>1½­òâ…0)h3gd ÉÂ’ó232bîH`ΊI¶$D¨è]"’p´Ö76Ø›vì)?:33lOE{讇 _ ‹Ÿ«þÈîí‡+]„HRè,¦‹>D„ŠªÚ*Îøâ@™“#IGsC¥“÷ÊšØZvh÷ö#.@ )0Ra@B ]Å_@‚”R`ˆœ÷ðÚù#ǪÆÎ4p€9²lËéwζš;fÀ9¸Ú/œØ±å¢3ظA´—ˆrkIëä9¹íá ÛvÔD Ê)“׶÷ÕJ!¡ñ\jŽ†²3{kJO9š>vÅ·–ßpìÜ{ Çú3w,±“ºn«)£ä·.}zó¦/ÕQ‘“Í^ãzB¸ªp´kB!I ¨xÔ#DN ôYU @Î5Úºó< [·8jÊ)ÝyŽw㔺@ä éÐ@Qy 40)c ¯[0Îïß}ÂÑoÜäqà+"‰¨çq”Â^sdÃg‡X¸ekýÓ²ˆqÆH¯:ºkó©f•ã–­ÚÊëmiù@$¥Ûð'¥R€îté’+!5*!øêp)B!!"‚o9Z]’“`¦³µu•Ž!±ÒÞPtºApŽÂîÒYÏtQQTW’ÒtòLëUG :ÞRä4›ÍÃÂÊ6‡†ÑIÑÑQ–v'è6½'žˆ²úÔÞsNš™Å°tó嚊ܣc ƒöÊŠ6GvTnÖ¹IuÙZuW[ñ™¦‰£'LÕ*?étÍ°œ‘sç×mýs¥P{ ãGRcRâÁÞîtÚZj›x\N,o*®mɱš[kJÏÔ¹IÝ¡™òsSLmï>r¼)=cZSmC-¥„µ–_lŠ 4›ƒÇ§×ĺªeþŸ%©D¦'FÈ}'<ïÒ²†ŽN@’’¸5Ö¤"õ8 ‘º®sÁ™. ÉQ_ÑØ2$Ö\_|¦N㪪;Ú´èds„Åb)•ð¸«¥ ¢óGe˜ÚöT9BjB‚¯—2  ‘IJ$„”Dˆz]Iió„iSúôÔþ]ýš»,eXC·•ß±óh±Ø””:D ˜|Õ‚¼ ÀU¾á½Ÿ~rðú©sW$m£ÈÌ0qÎ&@ )Ó«‹Î–Ÿ:}áò¼²’s>ßSNJЗ‚ÊZì>6}ÄÂŒ–½ïª%®"éBJBtUîÞs6mÆô57äUµj&ÇÉ·Ö–¢vßÑšñ׎hÜ_VßÐTYÓ˜õÖU{JFÛoøü9èpêÌ’’“]´ûó²¶Ö¦Í;2Mž{mì°Ú6ÝUµgó®’º}Ç›N_´¤eÇ«MÅ»íÍ`&¨Û½ý@Æœ1ËVô«njo9·wý1]áŽK'Á¢8üìµÐpj+:vøXîÜå7¬¼PݦBí¶ ;+‰„Þ0<Bxr ¤¡¬Òx§RH")IHÊKRcÍ'ŠêrFÎ\3Ä–ç¬r"RKmEmÄŒqƒ÷Vì©´ë<%Y !…ìx„„”„zá}G OZ»6­¤Q³èç>ùø@ScM•c\îÁIµ¨Z2G_}Z™‘ŸÐxòýc•.dH¡Š„à?øÏ~ö³îŸn߶õìÙ3¾THh͵ՕµvÝ›#mM•µum.{]UiMk«­ªª½xþBu³Mꮶ¦ºò²Ú¦Ž/6í¸Ú«ëÛZÛlv»Ín·Û[*+ëjKÏœ¯nÑ„p´Ö:zôèùz›&µöÆŠ’ŠŠ&ÝÕTSYQks:m-õÕõÍv žâŠ€ˆL´ÖÕT_8uüØ™Z'¸m[¢­¹¾¢¼ºÍ©·V_,.¯sÒí-Uå••õ6â`«¯¯--:q¦´Åéhm©/={âð…FÁ°§Î&DÂÙnw ]³·5œ?²sÓ–µ eJÊ›ºtÙkk+jmUg.ÔèR³—ž>~ôty³C×ì­UÕÕMN@` 5%çËkìBꎖºÚšš¦öÖ†šŠ’Š‘tµ4Ô•U5´é½dCF®ö¦ª’òªF§ ­µö\ñÅÈek¨­®¨n´9]mõåõ͉ˆ@zs}mEY]“º£­®º¢º±Mr4Õ••TÔ¶KÝÖ\UVVÝäp9l U•U5MNº«½®®¶²ªô\Iu›&A:k.žÙì|]›¦µÔWT·:Ûjšº ŠDÎÖÆŠ’òŠ ‚p´ÖUWT5´¶ÖWœ½PÑ.@:Ûj**+j[mmÍ5•u-­-Mv–5jTTñ¦}eZKÙ±mÛwž«wA( =!øw]×-¾&---ˆIÅþë_ýâÃ?ðI&…n霞Ï:}âkÃñI E "Év Þi*F&fGŽ­g$p¿ÆÈbuÿ{E†ÈwÁÞYùdÔúfõ‚7k·ã+dLØkf Fd;Åðf8CǼ݋ Îy½Þe²Îyµr½J­ÏôƒÛкœc×wÞAcÿ}ž…®ÛÔùGŸÌßÎ8åó°O lrdD`¼Ð» ÝçÒ 1Ü{,*sɽ·eoäwmŠÊÝoñ¨„àßûSO?[X8æ²,~nï¹ïMGÏg>éFåº |p?¤»S˜Ž×`”Ο:Õù ÝÖÁJ ÀR:•Íë!j1…ô3o ²Lð¨|ÝŽ ÛÞâ%žcÀMôÿÂî;Öùí~Ø]ç_{¡ò¡û? <—®»µr½­©©Å ÈX/e—„ ÿΠ„¶ ÿE@²½bã“¿E 1¨„à¿™K…JŸ…à?BH‚ü'^ÜKáRšÃeos„6/!ABð¥‚Ãn—Bö™K9«íâóLf„:„ !A¾4p:¦ð>s)W»ãÑgþ˜œ‘jÌ‚\>x&É€F©–ÿøUyè†$ÿûhˆ;ÊÐÓG.Ôzóòö“+JŸ¹(ªª¨JÏgE@@$…猡‚™ÂÐÈïÆ]2ΑgìÿÀ‹@$¥0ÒP9çF¶q,#" ïcŒ+ÌCÝ-8‰$I!ÈX|]¿²WM éί&DÆŒîÏz]ÑÞ=QG΋Bé¬<~pû¦£6²Ž¹áš‚¤ð+U½‰HJ!9ãþq¤”’°w8ê-ð-%ÍVr`Ï[ÎU3³˜ÿ„£äèûÛœW_?.òJ”¤÷ÜJâ ÿ?wAR[éÞÏv)q$Œœ4w˜5të¿L¸¬Ê1H®¦òûÝVÞöµ½öÑ9§³zãþø›?Qj#gÝžWŸzñãÓ®¦=?ðûÝmP}ðƒ'ñ÷Ó6ìÎó®4Gê>¤^¶ó“¿}÷{ß^q×Cßybëáááµ@8Ëvú—{¿uïuwüèþ§öœ¬Õ|"ê.M5žÚñü]÷=õÒ[Hóü ƒýôçÏï÷\{û·–ÝñÍewþæÙÍMNj«>uàdi•ÝP.Ì‘±Ù9âãß>{ ´]PÀv[>îÁ¦A ëϾùØ3ë·—ˆµo}鱗ζˆÀŽ¼ï‘5'^ùí³w•tW]щ#ÇjeÀËKígw<ùûÍ‚®GAYòþÏo{²ÔBÅû/½øòÞfŒ U‰ü²á2#ÑQ¶”íøã~õ®ù®ß}wœÝwàdû´Áå'Žíøgeê¢)g†×ž;y6©PºêNì9–צ½¾ôäÁ²±z·±|z¯xSJ;Ò:€€¼ê¶—»xš/Ïväúv…Æý[ŽÛâF.¿:¥ø£×½¯2îÕÿ–fê‚ô¤7Ù~Ì‘5ý–Ò<û‡_<¨?ü»Û'ä‡w¿D ZÊ÷­ûû«ÛËF¦V‰B}…A4•_8g´hÍ챩–œaU‘ÔìI·üh"¹ñZÍ86ËžúÃo>]'tuc9"yZÃôTºH”صï|ûâåÉŠOSißœj­µªèèÙ!šôè%ØñZO'j y~×˵åéIÜ éžì½Ž$nKLáê»F‘!ºzD6ìX ã&“žù¸_áo ;F—¥{W…€„îÑ ½äÀÖ“íÂó¨Ç€ê;5ì`HÙï]r9 ~Ì:­‹ÜYŠžO$ºÛ={æjäôËÒ#Ô‘×,¸qAv R¨øÖ¿5—"Q[´ïÝÍúüßýeÙì(€Ãfˆ ýòMg¶lž:zk´Eh+Úûâ·~²9rtFˉ3¥kž}|åø¸–/ÞzöÉ·öžnf¦˜!K×Ü}Ï‚8µâóמN¦6–ÖS¿kþÁÊ©)®Ê£/>øÛO5’9îÖ»o^;55’wc*‰×þèûÆÏ#Sðâ÷_.«j––Ðu"椅<°†*ÿè`EEƒÈç]ODEÛ6kî¿j¥é´S„T©¯¸Í™c²†>6Õ«­”~üÈ/ùìTÓà;ûàêýüO:«÷o|áÑ÷7É°´y>´znn„Š¤ÛKž¬…Äã²L=hRŽC›v$_32ÇÂ^¾ûÓ~÷òá’ K_øðO×Låýñ©7_ßZVç<¾ä„5aÈ­?¿ÚÈ8­æÄ?{òã­œö—wßßYÛà|xÎ5öúS|r[££ógÞõ³¯ÍcGþù÷g__aÇ°Ì ÷>þà¤,¶íþ¯=w:,Öâ¨(oÏ[üµï~w¡Õyáù¯ß÷Éþ²:~îþ^+\°â·—$„pÿß™Kµ–ž©W’–ŽŽÒ‹¶=÷Ún°fÎY5\K3>ªñèÖ¢Áá¼ã!‚îâñý¯úÙO:÷?ËýÛ®9#ç…eŒ¸îÇ…·¥%ºÎnyîOì91~ÞpÐí1qù7 <òôc¿pÁäé'ßxý}ç”GÖ- ;õÞcyoë€ìeWe+¾.§NNNG}yqcXZZrdw¯”ä*K‹.PVvJZ ï¦E!‚ãô†[‡-žªmýÇIg¾âÀô–¢Ož|üâ'Q¨ÆŽY|ÍÄÑ)ý®~ðéCýíî€AD핧>xú=Ç¢‡ž]9À~à¹>ôüð¡ŽÍ´êmUëóÿ>óþöîmqÌ[ˆà*Û´çTøŒÕC¢µž?öþ3Ჟ=·4§mï_ô³g† }pá÷1ñªWþôÇã‹{h|‚™8çH{^~joCþ=ý~^”hnÔNÏ„è(ÙpðBÔüÛE2j)>ú᳕e?yjUúñßßýÄÿ¼7ø¹ÕÙó¿ý‡Â‘?¶®®ã椎¿îî[ýÛc}x`áôEˆ€ ¯þüåwß,žúÛçNÎ8·Ž%˜±ryÌËÜwjÌœáa»^û$cù÷^=To¬Ó¢ÂгôÇ¿^tíË–žþé‡hUjlzï•=iw=úƒY 5›ÿÅÏŸþÚýùÑN»Ã;îÇ¿¹/ÇÒÐÒÍ©AH¤5ì}ïW¿=µøÏš]Ñx±.:Q­=²íƒ7eÞý뇧›wýúÛOüê“¡O/@ fνáÿÝžZ¶þŸÞ^T>c\nÖÿ|}ðß|+bɽ߸:'Ž³PðÄ¿7—árHnŠ h‹ˆ«x驽YW €ˆ¤þC­%»Öž®ôþ‰H‰K/mŠ8.Ùõt¹]ƒè0­èýw¾Ø_nok¸pΖÝÖN (±‰©ƒsbb“ûEêÅõíöæ³Eµù oœÌãÇe?·³¬´ÊFÙQ]ªêŒŠôº#›ßûhö²Û¤™Ö? ý⎷?«™´rÙÐì·ÖQ–ÁuñÃç?§‚Å…‰»¶@G±½þÿ¾PaÖÈè˜T#ÃÌ™¢(A[P[õéÝûζ4<óÈF†¢¶²¤ñB½³0ÓªD$Ïyàþá2ÅX¬#"D8üìËŽÁ7 ÏB’-U§öì=ãhúë/×#ŠêÊÒö’×È´pEáȘ¢ªLU€ µhgIöÂÛ ‡fZ¤d{E4yø™Wä°;gYdsMé…ö¸©‹'$§°Äµ3þ÷ÆÝ-+Ó#,\Q8ïYÁcâsåÅÇĦfFŠ¢ºvfVûéc¶DLúöcs­ªÜß/'Ó›•‘šžî²Ù¤§~Ý®ƒ•öÖº ´­6ÄÈäœØ¯{SVŒš8nx† 9WHሌ›TUe(õ%Ç÷ì9füâ›$5•áÍ"?ÈdM1yâð4+ktg“¥aÙÑ]ûN6XxÝÌ| ArjóÄö’–±t}úõã^zpWs> 2¸_j|”LŒs´Øœ€V…3DÎU õ.û·çRˆª5ƤWW7‚’9zÙMå¿ø "[8ìèïßÛ—ÆãPA ŽruˆÌ`0…«¸Â$‡ÆmϽüÙÓ˜ù‹Ò°lÃ+Ÿê‚€q®˜82ΤRÓ),\eˆ šLœ4ÍèFÔMýYj÷;/nq»îð-¹ IDATîk+G‡3Ãîãžvã³h/Ý÷Ò/^ ›¼fáÌQ*v@õ˜Ì¡¡èäÅ’s'^©Ø"*N¯ Ï~Txÿâ¼V}UArkÆ„ëV,‘ɸªðÀõˆ}*ƒti,*}ÚÚUãbI'\~¯5½B“5wâÄÜó²¿a¡ö³W?¢q®éÒÔ˜Ìñ7®*Œ–:±åß´öËŽ`¾²šg¶.§T-ŸÆmDˆXµþ•OØôg ã,@Ð* Á…S`Øfœ+fãJ"€[s”eÄÝ«+¶ì=|rjʘ8tG>2®pDÎpY·åé6•EŽ[°8…ίu³.% :ñŽ`ãž³'½ñØÎk¾ñµ…yØaq{Žt§‘6`æÍ«† ì†è¸ìDÀÅÕmb^±²ËG©;uiéØB#®˜MÀÔðpÔë…$¦ZT†F´ãcPý„âò¸É’^·åÝíN¡ÛÚ]BºÛê¢)¹ÿ ‘¹M_¬¿@ Ð…mõ• ¶ö¶†ÊMŒ61ûy/22­þìÉê˜a“篼jDA´ø £#4E¤%†Ùuª¾ÝÕV|®¼Åka]F Öóû>xf]uܘ•k&Æ*.O+%j8uxç†CÕMN$©·œ?ðòC§/^¶¼0Ê$u! H4ž?½ý“­:ÅŒ\óã~뇷­¼yÁ¸QiƒFÏ™J0û*"WM&³Åd¶˜Î \VTÎãŠêS97"’ÛëÛ QÊß/3š uäÌ)ã&ÍHIŠc€(]mÅ»vïÜyÞå?|‚ˆÉ~ä™WÊF¬š28Fe€áñýÒc •§š9eܤÁé)‰‘ÀÒœ-í­O@xúÀ¨²#GJëmš½½©ºÁ!©ýà“/W];¹ š3dá1 qPâ@¹öó›÷ØâûÇGp†ÀTUá ™¢€—w©Ÿ @I—ß²fÞ(m㟞ª°w¯¼Ì\õ§OTÇšzõòYÃú'B‹Íh¡)YìØk–­¾÷ÆQ±í'ö— ƒ×¨¦µµÙ*ÑIIR³æŽ™9y̸‚Ô„ØpëDD:þ§†“‡vn8\Óìd¦ÄüT<¶eoi›Ks6WÕ¶Ûed\B˜½êÌñZÝÑtvëA‘2 & ;DŠÐ½þÕ¥XLöÈEˆ=ñ??Ý8!º~/dHˆTË 9!}àÌ ‘O=¯!@Xþäqñ[_}Éu ²âpEÆøUfÿ#v)‚MjbÁ°ŒOÏÜøºC/Ú~ºŠ2ìT™P5gbÔÞ|þ‰jóù½¶Ì±#FdYüŒßºó™gßù¬~Ô’¬­ÿø˜'^77?ÕŠ νó÷ß¿¢ßöüÃsÇXÀո煿ÿ}›¶rDÕç/½,yê¤k¦ ȉåà<¿aݯþßÅÇ?18‚%>gH<@{tå®ø¢æìþéÖŽ®&!ø*r©Î¿’íôç;/ß_ZZêܶi³2`ÀÄÑi }Ú¬¤wßxõŸåãÆMÝ¿ß¹ssžúëþV6Öê¬,¯JXñðšÜX®Ûj6ýáŸésŸz+ÇäOZÍñ¼gŸûÇéIVÅ°RÄd ›}UÆóOýá™ó£Ãåõi«Zm2'd§Z7m|î mtÞ …鉖+o}lÃˮϊa–1÷Ö«j¼ð¾ð™é îøjŒÉ(˜~æõŠAƒÆNœ2tÜôÂ=ïýùt´@i.«×þ`y2ðSv_œyó™GßR¿ñâC³F&"3%O»¸à—OÿüÉé£âZkpÂê…#ÇܾñÉ'`WÄ¡uÚÔû%žõ¶ïÁNÅM½‡à_þ» ~ööÇ“fO³FYƒ™˜ž4däà ¥¦¤Ê=xñkÆôQMÖ´ùY™Éѱ)™‰¹ãÇä¤%ç-0ÙEæ”yK¯Ÿof݈¨FÆf Ð/N!TLICsó‡d…9j/^lŽÈ6uñØÜý£-Š)¼ßЂÄh™™’•—Ÿ“™?"O­8WÉÒG.½uáð¼hæÇNâhjá1ɱf.\N—.,™Ãò“¢Ìˆ€\Í8¸°\¤ ¤ÖbãY1à°k.§Kï7$7).œ 7Åfæ Û?¬“Q™‘Ÿ—“¨„ºE|uy3Å¥å éŸcñ`@ûÉ7ªçiùVlijÉÃ%Z€š5v Õ–U5`bNvFzBÊð‘ù ®òâŠvŒ2kÚ þ fÎ@ ‹ì7lpÁ dÕ@ ÅŸ¾»®jÀ½·Ž6+†Uš™­iÃGäÆ8Ë.TÙx°«¦äÆ›8ªáqéi­ÏW4RZ~ÿÄ5*½``Žµ­²ªÙiÊ5j`VØùÿùNKáý_/´*Ì0‘ó°èô¡I¬±¬Â™»ä–›×Œˆä²úðþËEbvÿ ¨)i0gåå¤D*¦°ô¡ƒ“¢MÈ”È䬼ügañéCGö³&¤õKR¥)&-'=53+7/!":!'?ݬZ‡Ž3>ÏÜV]RÖÕø¤cûèŸFZcyius»Z0oñ‚ya  K4ÐZsîBukDæ€~I)ÉY#†¦˜[*Jëœa©£fOËˈR Sãrûgõ‹f ’j\þÀ¡…y1VyxráÌá–†ÒÊ*[tþ°¡#r’R2‡ö·:k«›”Á«¾¾úÚ<r5¶ÿÀìÌ8CÕßo@^l„jxcóäfÆY”Ðeÿò/–ß|ÁÖ~ó{¿y(9#zbS´•]Ø—î ÄW d†Ê1»|¡ÛäζóÛiBÝæÔÑT;Y)CXõÕƒ.XàÁ èæ§å¤_”ërü¡®tÔüð㊔iWOè§rìÞÁ^Ün¸*ìµ{ßý¤1öÜQ)œ¡;{ ýÖ[éëî\®qÁïô°mÞýïòåÉ”ÝFó=¿Ž½êòí¾Sª\9‹_¯v¾Çdþ|ÕO“ÅK·µ@ îƒ=Ï¥wOߦ‚!õ•5õa˜ ý>Ø‹û€–øÑ×­íE< Œ¾~>îú ³$Ž_µÖ'ŒÐ>_M¾|2îwzØ6»#ö‚ø!Hþúön°|ù\JQÕ·Ç$ÄvV´z¬ÒÒ¡&OSvOýÍ^"6~»GB\Á8ði}`LO銎'd‰ÊèönŒÔÑ>ðrܹ÷ÔËíBdÝD"IFUDCl–]‚ã«ÝgƒRCDÈ Ðµ' "dÌßr:4o÷r¥§€cÐiÜuz:e)Écå'ï™vÚRI‘õˆ3$e÷fõRJD†¬ã¬€HJɺιó2ým!cŒ¡’1&taç …tGãpÎ̶SV")%1ÆÐ=O4*Ð" ¼.¥4J"0ƃ ƒpÎ=ßYô‰…ëÍM÷†ºvy<Èé-HK$½'ï¹LHK=±=_æJ=/Ç•0Ûðou`¤ÿÐdFqÞù]ÆYËŽÒãO z¾/½%Œ6Œ §‘ѧFõøjò'^$Ä@íµ#x*®I! §ŒMˆë— {ôxêÈà}%Iò‘€À3, Œõ^èrº<ß#UQghœdŒIÒÞS@µ‘ó@k‘Ò§øé@ÂÛ žÜ|@õåc¦g€.t…+RºQÖÿfH’Æþ ÷s4B’¤ªšD"’Dš.8c€î¾Æ,ˆH w+>s©.Ù'™yý¸^ƒ9Aî"*Šb±Xt]7™L=‹{My]Ø’/ó&p;†ýš¼ü„“H@BŽDD%pæ©Ôéë íñ2 "çL×…oñi_uú Ú¸}Å u ¥$BŽŠ ¤¼ï0Ö¬ª DÇò‰zïˆ@鶩ÊSU•1æ½uA§£2Æ4Mó=Ð( cÌ`Á¦^(æ¾®uw9Cr4²×…Lá,uî³Âp¡iȘñ¡q‰‘t!9BrΉ &Ç/ùĺHH]>ì-u*ëz¥ó»`‚ï§Hs2(¦A:ú|w˜jZ@ÀÜìÊiî“ç90UJ1¯å­£¶O–™{׉ˆH'bAX”A ”îaô4óµÙù—W£é!Žˆ1f(IÆëâ!™aµ÷šÂ‰#2ÖéSzÉ¢zyØèÞBω¸Ã°gs\' kè[†!¥'E~Ût»ÑÇœ@Þ'ìiÕ¾Ë'àH@ÈòC~ßÄ4ÃÁà_/DdW$^Èpot¼Tè(udH8r2~™\Êx…Û{À€£”>¨±—³ÃtCÁ:zõÚÉ“1©.W¨;£ .3öE "0Ìt`hL¾, ‰`¯a ºÌ€ ?œÇ5E’‘”Ä9'o‰ïKeQ–ùÎâ»W½Ú™.1Š—-òt±õ•v¡Š¢(ŠÒwc¦QÊÝÝ\$ =ŠB_w˜‚Àˆ4CÚ@ r×yGOÇ 4ðÈ#_K¸hi^Q,øay?÷0¤®§Nma(¸>í}WïX£_wö·FHH€ {D¥×"yÀÈ»•ä-=9vx ØÖ›itx^evEÌÉ{JDÁ"'ºž1úœàØM¾ ôB—rOÂxÒ°Zx _^Ýârú## $Ù1ˆá—hT”nÆq±]?òp,ê%Òu¹Ã}µAu7†ø¢EwþÌtƘ),Ü/¯½2’€4,\'¥4™L†é¢÷”Îý•  ’ °×e'Íf³_C¥®ë ç#— ñ² +( s«èŒym¡R)î%};YÎQ! 2 !gL ÁÐ0v¨ã}V|;1?º{Ÿü¬½R›.µ ¤ðåQQ¯s8¢ }à ù¶<è-Wö¹ì 2FÒé-ð†ˆ€pb—ÎBW0¨!ý_õå1`aè€$Jèõ¿.uiøj̃€;RI^ŠÍ¯6mèÖ5š|'e¨Pn9&øÍñ5åuÆó{Ìîü¿½”†2çÕ¢üsu7½ K¿aD¤+r·)@HâŽíø£Óé ³Ñ€ÆfcOúeï Û=ËÁGcŒub‡žZ_€3téF )"gFÂH©ªÜ{¬}ºA ™” Ð0ôI)ºÍq—FU¼‘«¢ù=ÌUvòÆ_ì"O,¢äÇ^ §⼧ÿ¶®‹nåÓë…ã’5 2¢iTD†HˆŠÔkŸG”nSŸ_È€™Hˆ$݆b`iUW:„Êã!c¾B³oLï¿"13”D€$$cž0j’½ Jï¨7bšÁ„‡)1nõç-\Éâ"¾Ž&ò÷1úþ1¨ÁÏ-qûÜjfÜX%U:y TCBr[·„=í§êötHÇþb:üüŠ—bèïèl}Î0æö—tÚÂ`LŠˆŒ`<#:˜bîY`ðx<#Ý7x@Îy/]‰½4 1D’B)© Olu_ß‚Fã "@F@Æ€Œ”/{Ö]cI|Ŭބ¤Èö»ô"H¬s°é:qÎH!WXƒr‡C€” óhÃä‰B2Œòäqí\âþwÐ@ rwôgÀ°6"ò+±,ê’íêž·ÛX ^GÔ¿¦vpƤ. 3U4Ô”=ªrE¶ÃWfÈ;“ã]é»ñpGÊÈ•Ø& $¼ÞæÞ꽜&v²9ø†Qø%U=ˆäèq;Qð©y’ ûâÄöi ÝKÉî’OÜ'¹<ámÌ‹ Æ_ÉE‰Áy9Áy‘Bk„ŒÙgÃ+æÍçjRãF>Mð{ÿœ®“”F ê¨;—†Þ„h„=’»[÷2¼üw½‘¬»š…=BÀårîKúbw3€ç6`O–“+ÁŸÜÉé:H2Ä{ô о^y" À‚ÇpõÎ$@`8@xõˆ 0Dvzÿv±£tJÜÛû/cQ#·°èVFÑÃø{r\.—òîŽèäÞW©¸BÛ$¥ä’@ôÄ:Û°§Eu$ÁøæÆw)ä=¥š""ï£|HÌñ*v~M”ÃèÍmAfdgùÏ Â3…Ñû5[õh5220¤º®J!%(îæ°þwƽϜ#(‚ hèÊŠÂóŸçÐKÖåµb3Ƥ4ö½õØ%HˆÈ "#ПõιÝKɦ‹ÙÙwù^ŽuiRö¥…ÿø«çÙ‘ViÖÞòT"ÂÈöc¾±ÛÝvÖ])`…$€ž}«†›½ÙWÊJ¸§¬Ófþ0ùKŒ•äÎðH‡ˆ$y¢DŒ¶¸ ÖÃT”@tA×tðWA' £à)/A´ÑËõ pNÄ°OIŽn» ´Ñ½,3Óº†WBÀôeE~ÿÚW²ÄãˆHy?é½òü-k*JéSý¬3ZøR Ÿ>?ùºA©¬ ¿nµ>ÐJís·éø{wù;uâëãÑ#pê­ì|9Ýíà/ÌÏï—Ìi.ûFÓ¿èuŒ…¨ÇÚØAê¥{$¤à… Ð“×ÛÝ ƒ>„/#µÿ_Þ}4Æ:õ;ö^gé6>ô‘Kå ÊŸ0k2t«ô_YVQV\â{=Þ&ìýîz¯Á•H«ôܨ>ò¼@‘WA.Mû¹‚è<`´¯e`‚ï?(ݧ5‹×(Ö)P;0—ò eT]ñ*—‚N£ÞævîÔ½5.‡µ÷²¾IoDŸî~þדÂKà‘—kñë¥(ÑÙñæ7y¨çiw#’ÿMý‚ãxªÌr?¦|ñŠßoºïë™ùÙö6›oñ±¤Ôä‹EçýŸ3ë¬7Ó¥÷ûr¨‡Š–}¬Aæq%â%^±]›OQWrlEŸ t„á SïÿÅï1Ûõ¾Ùö|Ëåé6üþä¡EiQ—˜åMD,ñ–מrnŒâ’ºˆsûsomªØþÔ_oJ‘šìñe$ZÊ/¾üiýá¾ý“) ¢ã; þø0ì±2AÃ2Çýô¿™.}\ˆD„昫ÿú]«òTDú¿ÃE.–>÷¡7|Qýéÿüh^´¦I)•èŒµÿûܪ9©üËIéôÅÏQHž3ã[Oüô¦ÅØ‹£ëQ¤–~óüÄ{÷¾³éáAa(èŠe§º—ö¬{^þí#3â-œüâ–æ ŸrÇÃûîäÁÑxå^ÝeßB‚/ ” T³VÞzMvë‘Ý Ã®É¬ûäHç bªuÔÝßùÚÕVkRrxCiælÝñÂãû¬ÖðJ¡kçœ!Iá,;¾c}Ee•Ý]ÏÊS3ËhõÄ ‰!…½õâî/¶X+IaÞ+ânU€ÌxƒŸk$5—9gþ½wæ\xý¯oLE5ÜÁUºî"÷KÈÝp9Ẅ¤ºÀÁ¥2† ÁÏ™;¬™4›È¹ãÚ¡r믖®;t¾Ù*’Ðu#l‰1…YmRJ`œ3 ¡ b&¥ö­oß·wÜ57­Í41ô.Ýfüг·—üõ/ïl8åRÍ\éjf6rù]ßÿÙ<¥ª®¹¥¡è³×Ÿvk‹B "DfD¿!ˆ GÒ5—Æ8çŠÑhO×íç>ÿ°¹²Iz ÷\ÜÇGR×Ýõz˜»!B êeì ãŠûè¥Ð£) ÁÏh@ÂÙF#ï¼1íìs÷}oË…ê6‡¢ ζ†cŸ}ŠÛÈç„€Œ!rΑt3Æ€„À8cˆ$t}‘s…¡”BH „Æ̤îäýfßýÇÿߣ/´©ŠÂ8 Wý…ýŸ1×ù6rÇè‘îS6p€HèJAÆ™úß’.=fʤñšÖÝ»öÃ=u6qw@¦xP—H AÞF—Šâ_ç!B—ÒõˆF÷DªßÿÑÖâ2»Nž¥$`\åÀÔðk„Ia@$t¸Â@èºQ\Õè€gFI¡ #ÀÕÀgD"é¹k€LQ8‚Ð]Ñ#¯¿çŽ¬÷øÝ60+IÏ%ò<麜‘DÈÎ1ÔÜ6WŽKIÍîR2’ÂíMEÍaYµçöµˆ~]Šé¶¯üõ7ï™cFÍøö÷ƾüП‹kÍÕµi·JfI±xåähSéžíÛw_Ј¥M¸~î´dl>^&Ü^qIjê„iÓ¦äYÁYºsÛžýçš´®ñá$uL,\°`LV‚­äàoy_SLæ¸SòR#UÅ7l;UíìúETbûÎ^1gÌ䡱̀ùÓN|ðîºr âÖÔqË×̳RÑ[wªÐ¹5uÜÕ3 2­-gïܸ¿ÊFÝHIÉ­ƒ'^=!ƒÕœ¶2wÔ·ä©…S'L*ˆ '?ßràt ™â§}}ÍÌ%#úAôÔåzÜÁý›ß;¤e ž4k\NJ¸«¾x×Ç;ŠË[ÕÔœ!£³‡¶­áƒ®™•{úóõçìv»ÍæÉ–9ý†¯Í1¤ {ÍÉc‹Îì߶éóRé±—ºÝÈÕp³íì¾ùLqÂøgú,M IDAT¥?|ø.Û=¿{¹ØI有SÇëo±WÙ¸åhq3gL¢µàêeý—„·œÜ³cëñF‡eO»~ÅPEo:PáykD|ÿ±ÆO㶲½Û7o.r¢9sî‚&»šžÈ|¶ùÈ…&ò×$…Mi#f-ŸEu'vnÛ|¦¾UÆä?wlz„³t÷ÖÍÛÎkhɾzQ¾b3edÇCí¡õ[Ž•´˜Sòç|cñÔ™Y)U…s×Fݶã‹-Åê€Ù«–æ3gÕ'V $¤šeŠzEB @€èEô.0`ŠÁ6¶±¸_—Ø8NÜ'±orÓoÇŽãW0˜Þ{5½7BHõ^§žsö~¿?ÎÌhT)ƾ߽¿ÌšµŒG§ìþöçñ´•‘©=¿wm&§ÝgÞHÈÉÓ\—>ÚøùI'aÄéjËI'ê N¯ÿÌÑݺ_ÙºôË#H Õk.îZüÙ%Ûȧ^œÞ-!$Ÿž>½ëåßÞu®±ëÄys&Oè»òС:)8‰Ô©÷Q}Ùáÿúû×9Qs‡ÏKÐ'Þ3%Ñu`åÊ=U–´yÏÌ™Ð?îì–«G¿X$zg$ˆ}›>YŸ[ÏdUæÙ'¶Ôd¹^KÛKO ë±éhm¾*ÀQê:ÿHñ–]ñ‘g`fêÕë—m¾àUTY¢­’YÍÔ7“¿F¯ÉÊ—ïH í:tÁäÈ¢MËWqF ¼÷ÙÉãznüª¬:±~ùÊ}ŽÑO>?5sT—-Ù¹EGV|rÉÝov?ð…Q[z~˺t{å˜Á‘oÜ6³ßšÝÇ ŠºÜã[¾Xé°àŧÒ;…n®òx[ê8²-yʬé)ßXðNV-LŒpÖ‘®³FMqïûÃ?¶DNxùOsî½íÐ^¼öÒáÍŸoÃ~ñ‘>±öí—ª®îúð 5s¶íЖ•Ÿ¨×%&Q-ÿןªG™pÅ‚Ú{ÕÇV¼ö7oŸ‚òÈ‘1~ÏhÓH6•^QÉÚx|ÕêÍÇÊ©U"äc{6d§C¯Ocî¨Î«/ž9²«¨\Mé!Ÿøjé–¼FE–cŽË»Ö® ©iS|™CÔÒeðèAò¥?¿ýQéõøë›~fi ឺK{×¼¿Ãæùуb–\¬óh¤%ôœviÍrìÊ•}‹¿Ú~…¨Öðþ#Çô÷žþÍ›ŸZ>óÆ£zV7•òÓëÊwP£ú¥YWªuDp{@ íÒoÌü»‡†É\·w‰«¶HL’dEU£’ªªÍ—ÏÇdYQóÓÏ05:>®!û`IµËÁ‹®–x†ÅuŠP‹¹Û]{Დ2£¨ŽÛ"-2h¯ LaŠ"1ÆdUUNekl|LUÖÑÒ:Oc]AA¹‘*cwTåž>S§3 ·«õè Ö£³­fËŧ»±ôBžsÖ ä0rÁMUUL'°ð¸ËQs)ßàæj-†Dª", ƒ‡öi(ÏÚ—SÉ)“4gM]C”³œ;ê íŠ5¦{æ£óRcÎ"»÷­Vp]9|ÖõÐìÇ_íS–}bÛêòj—`²âë”EU5AÑ` Ãzu‹‰Ÿ÷@×ÛSmX—g±RB€0â<½3»ÄMq» òÿN¦û¿?×/¥®µ$Ú•RS^xnhrR˜^ž>.*D4v"Î’]{\ׂ}Z~GaˆQtø?¼ÜoìÈq÷ÜóÔ£ßûÍ{»²Ü´%3¶ANŠüÜ’¿þñHúÉ™3xªWHíëïÃö(ü5"ؼm‹…ᮼpð½g{²\ ”2&ÓÖ):'¥@ø 09×õê½ï¼õÉŠSNA0&Qb´È1±&f>zg+Ÿ½òß»«ç¾ùÎFÁ¤¯1…”l“‚΢WY 4wo ƒ¿i¾©–šÌë÷Ô;5¯»|ÛÛ¿[¼5ÇcòPR)¤k7Êe€R™aè¼%i¤KÏ ·Í˜¶ý—¯­?k¤>þñ/2˜ 9ˆ»Í<~$È5!V™ ÑàI%@™ª ap3-Q éX±9&•ª„Á0Ib”É*óE …o>™ÌX uwxý ¼ÄÛgî“™Ò’ß¾úÙ)mÄë_ýÅêßØDæÜ‚Æÿ#çÜ—0Be tÃÊ(n*QgvFÍ\JÑ$=B Î5½½M‹„ ×8ú3W$ ¼ÙzfbE0/Í ¨·æ⺥­'ß¿`ÿïß?t­9ZjTÆ]óFàáמYU zå/? à­=¿â_é54sÒ¼ÿuuþËäºtç@Ó»uOuÞ‰OüËCÅ^bây2j²?¯IÛýoùô¿ôƒ·å÷ÆPÚK-zêÅWœXþÆoþõõŽõÿøÛ/žúÖTèÍwÔÐ4]ç‚ C×uÝ@B-I)ý{Zò÷m^±xk³†EZÚ„@ÎuMç\ 7tM7`‰ýû¨u9»-Ú~ªÜ–ÎÚD „ëç1ñaÔd¨$Ž›´áÒÉK¼Wæø½ÂcÒF K‰¶¶œN$TVCãò‘óen9mt¿¤.!…×åvs[DB•c†MI †ï.]sÖÈä®Q2¥æ¶FÝãj\|ˆ"Ñ>k(•ekT\·áSï(%g뮪ҬyÒ€éãûtˆOî3fXç0Y Ê©½ îÖ)!±×À£üÊÕ:‚\7‡—†îÕR‹MÕÊ ó.WÑØ´)ww:¿Î“Xh®ÂC¹0öÞCbmÖˆ.ƒÒb¬FYa¹Ûk@F·¨„n3ú:²Ï6z¯‹Û‹†®k:Èu]Ó á­/((—RÒûõOŽî6`ÜØn Om ‰’iHBïΑ1J›G÷Ë?ÿaÖé2á˜A•šüs‡ÏO{ú_Ëæälxýéw/”y˜+ËÆüžûý—Ïîýüí¿þý$WXËð¨]§ÞùÚ€ñuÕegW¼ö÷Ï.q »ÿúØ—þãÕåÚÑ]ya×[/^¬¥Ì¨c}¼ü÷b=·~ò_»ª,IÓñòc·õLî¬Îú×Ô—ò¿zöõÝûö^ñ£7v¬«-)ºZX/ÛU@,6Ua@PÙbSÛ*vÂ=%»¾üSÊs ?[ò´**/ûËÏŸß³ycjòcúd¾¬W_÷·÷9Ñ&Y}O#L¶X-ÌÏ_*YmÅôj¢ÚeÆo~öà˜îÑɉ8aÑ5—?{âÛ7¯ÛÑýÙG>úüþŠüÜìJR*óìeæþáÅ÷o+½Rb Å\s‚b±Y›*]¥ç6oÍüñ—kgTŸ»nUJ)̨¾x,Ë»ð½/æÕæ­üó¯¾\G|ñßswí’h7¦Œ˜ô§¾|æW[öm^2öÕ…K[©vaõ§Ë7]pK)²Õj• f±ÙÕä •‹E1Ãœ@´üë–ŽþÙK+—¨à9÷õÇ›·]ò2ÉN™l³)R{î@™(^û×å ùÚ‡?¶:®[þû %†­÷ÝþäŹ ‰]âåÿúbfù®¿¼¹lo½dµª2BˆdµÙ „HŠÅn³0Oá7«×éýä«ó.®°Y­²¯m“,V…WܸoÚŸþ°èÑÆ’"W” Lf †õ˜ùøîJ·©è-ÝóþÂ,—Ž„PGÑ©Se3ž\½ú‘ÂCo½ü—ýY9Kþ¸ô‰—_ywa(uWœ\ÿÕ»ÇÏ$Ôj·û· õÿˆkî:Þ ¿·½{æ œV_W+¼S$¡kn·–1a䔹Ó~÷ã7dEnñV›]ò4¸9A‚À,V• ¯ÇÑ©6+ÑÝ^ØÂCe¦× ÍÝèÔ©b³Y™¡0¼N—Wã­œˆ²Ífµ(~˜!¡7:]º![B¬ (r¯×íòrAÚ©µB*)V»M’@xά6t[ Y¬ªðº5J–«"1‚†æöxJ„æq:¼Ü祒Åj³)Dè®F—ÁÉb·)2#hhÇ­#fµg£“ãÿ’€Ô÷Ægñ¿Îº%‚* n‚!ü=.÷‡›¿6nÄMH©)e…¥”RwçãÛRM<ÌØDÀ½FP /*ïó¸a ¼íCr\Új Ñ÷lléÐ B`¿†‡3È©j‚ _ü£~~¿`¼8èøQ&}— ¦Üæ­hv›þ7øFÌèCˆŸ™Œ®5ü´¦„À6+ŽƒÇAíoþ3 ze›”Ñ43f@Á$×4Ÿlmh·òþ~höZ_Pô´¦•#D³a-Àg¢{˜4"%Ô¥‡u:2ró«¿ü¦›­¤À+š¦·ÕôùèæZÍŽo¡6)Pÿ"lBÌ ^<þÉî@¸4F«–4kkq/…Àø5§ŒòɳÀ@c`êýù1¾¶7íÝ&¶oÒÆf#ͧ¯õ‘ ×k½PÿNù^OÕÿYsáßRªñ ä `^SJµëñÓ¼šîÕ‚qütM'íÁ3V˃NÀ¦È,D"EÙ `”]+(vÊ»þØ ÑÔ ºûFC…ØìiíÝŠ­¡p°ëHÄ'm5ä:èQÚiÿõ=?0?˜mã-w?rh¾ ´™Ò •\4ë«hkäEÇô[\õuuŽn‰QVoÞÆÿ>xðŠÁD­^ØNÛî~;7¸`­$ø†k¯švG;øé×ËiwúZ=ªÅ˜·ÿo~²ÃóQ41´Ô™LƒÕ§ø7®õNù^ÄÔuesZ©ÿóRêÛ‹ÐBѽ‘O{ÔSˆhp£ãg¶+¥žúùsgS™8 ›_ZXÜ^Ï›5 â[ÎMëÀJà ¢@ß“³¯óEÍì¿ïq×}o¯ká¾Õð˜dIû¦§yBÞ²–WYÖ–eg7aXù?0 í>û[¼´…ÚüiHJ)\ßHúÅZ»ì(„@áÏâÿŸY˦5ß1tkµn|x¿ë-ÙšªæF©s!\øµ Œ»>†ô¦X ˜tCÅ‘SB;PÞ:N•mûeŸ½ùÑÉÇü~º€#‡])dk¥ßrnp`~_ž«ËŒ˜û„"4;û Ïüºöj#7Gøt£ë,‘QaÄY×èÑ:l•C¢c"CeÝ]_UVoÜr…hNfOiHtTo¬môêß¹Nj2²·®Õ±ÄÆXô††F ›¯c3ó§½E/Úçë2å×Mø‚(cßnxoÊ…ÈÂ;EªÎº—q ,ÁÕL¶E†+hÒ¨†F†)îªJ7Þh“Y#¢£"­Äh¬,ªÕ jXD¨ä®®r#K|Jœ…ŠÆÊÊÆF7‡ëŸó§Í\\D°„E†‚«®Þ£8Á9¡žÊjHDuÔÔÝx‡nèXD!èõËÝk-ã ‹–Þò[E5ðÊ"!ððma _ap½r Ãh€¸mÎnhñ_¨ý\tÜΛaAÌ¿”wpÇ>‚DŽˆŽ²—C·DYEnB›S "aJhB·„(Ù<;ÐðVäå×¹ýn>?¦‚_èÜÌÌݾÄkL‰a(}çLÕªKktB¿'S˜žæ-+¬¾ÎC¹I¨hZäôžî³õý¿~Sáäß2‚̥Ȯ½BªóJ\º@Jtש?¦ïŽ7^_Y§(†!‘¬Ýoð¾´c¿yí]•nD‡F9:uæNÞX°õí——: ¢Ø{Íùá÷ÿöCš (§ÜùŸ?“Ÿ÷é[~°¹Hg×êfêBˆ6˜w—Òn{ô?ÿúàÙóˆ%J\÷Tµ,§ØË °u0÷…»m_ÿç;;’ü]E«ðFܦe|£¢…@#€ðDÂ(ÈŒÞB%>ÌP(HÒqr!| ©@ Âu÷²ã”qS®·–K¤I¡@¯­.\ ©)ež,B°.s˜ßµöøÚ‘÷u[þì[YZKvš0ê§oÿ×Ë¥óU‚R­æÊW¯üç®\Ï-ÌM­®åê øö[P³vng*Ìu¬ÌÔ¯A§T/9¹w3-©ò0ó<¶¦œr§¡C³£?»û£j/úâÓm¨/7ïÑê2îÇæà'?úëL TË?¼{³§¢Þhg B[ì íº®q¼µó'Ùf·š¹ãþè}Àw#@ó¨F ŸR[bµï¼'g÷Êÿ𥮂B‘Se º:rÝ”ùÂB’o{þ§·g¿öð5DƶÖ}›ËÈ,ävœÝº»4ÏašÚmÍB»k°Åü ðFOÿÝš)L}~ƒJ›Í*gñ!„p­üÌÁE¥BòA‡uL=ÜäÁâѳÏÈžµo=ú“¬2ͧÞÒ“ûwä–p³¬[»ðæÝÏdÿêÕÑM$Z­{ÍOà+|ró§­ð²s{7ZJʼH|ƒat¹÷Íõ}_òì™A!Œ©6›E"þò? ¦£¼‰VDÆõHW IDAT€RJÐäiC!PdŒ|{ê]!Ô… „¼&Ú]kCJ @BÀw/%`p€p+b(”ÒÖRª ü¥…1óí>`¢kN·-)+òsJ¡7¿pì|­!¬¥I„Dx*²Ö®~ñ¹EFäºW3 ¥û¤i·Ïé-9´tÙîã%„9®Û„É}—“K"E¿ølëioܘ™÷Ý;&*/]¾çH¾›£Ô¡à!=§Ý9²{Ÿ$RS–Ÿ}†È;ß[z¶Ø¡Fõ¼í‘yºYŠlß°üP…†@hüü§çàÎüN32úETì\±rÍÉKò¨{ïž08Þuqç’w7k¬xÊúÌzáî)‘Ž+»K³|(ãÆϘã¬î=aPLÃ/—~s¼:÷žøÄ£3GõL²;Ÿ«G奭‹þ±£F³÷™9gÚ´¾JÍå=‹×½T‹ÔÔAÓ‡GÖclïáýÃkÏïÛ|ÖÞwX|÷n±Î³9Uñiñ%›>Ûz±FM˼}Ú¤^‘ÏÕ=ë¾^|¬ÎÞçîçî;id÷8|êN5eÇ?}s]Qzß™£mµÙ[óNúì-BCÓï¼oîm©¼àÔº­¿Pà°ö0jÒNÔˆë×rw~þ­U(“6ÅIHê°;šÑ-J»¸yýæÍYNfO1g¢RZÛ/³¿½xëûKgWršM°ßú±%ô›ûòÔdµjïW«œ¯ai#çþpjrˆ+kÃÚÍ;ŠºdŽïá¼°ñ`>!…Î3çdJ'Ö~SÜh4©ªÈuûÀ‡^¹sĨa‰ö> ßëY•¿÷Ý¿n¯óBdïQó~8¥³ÝyzíÚí».µm6 „t:kÖÔ±]¡>×¢e‡Ïºú<ô@BÎæ=GKåäSLJY¾³Ø…q'Î{pB’Ú±yåîRÛÀ|ÏàÁý;wêúÒ‡}]WV¿ÿƒe5$!cüŒ{&tVëÏ®[¹~ËE#uîÃ÷w‰Œ¨½xU‰‹Æì¯?ÚYeévwöæ®8}Ô—'…%¿o~fF"©½º÷ƒÏöç5j:‰î?fúü)="µœkV­:饉»„sHÕ¨³îwß”hKì}¿ûÍŒÊs›¯=”/²°®ÃþýøžäÜÒ7—]ªöò¸‘w=xûàGöõÄ—%ˆrhò„Þ•‘g”åX²jN]+_#F<öļ±½ztVúÝokŠ÷ñ‡Õ%¡£ïy趾 õ¾Y>¦Ø¬Š,hZÈ!røôûî 5G—/ßs芫ٖD$¬óèIƒlG÷œ(õRJ†§ÎýaÆé-#cÞ?+Î]¸guöEBXFÏ¿'súD»úè›rV[öáÆK‘(q&?5eD|ã‘/ÿ¶¦Ðþ·(O;¸-psª¥iKÎ5ƒ(©¸ÙE e:ë€G7äîó•Qø·/"a „@ >w ~k)êùœ !ôVÏd;cɽ´÷Yõ³ŸÞ¿à—¿ÿýÛON{öWo~üx¼î­}B(twcUyEeEeuuƒË鉞òÐ# gI¹'ÎVÄÜý_¯ ëaEBÐ=챚ٽrçêϸ$5jÌü?ÿ~ºçøö}Y8ýùGn—Ì8o™pgMzû”d…G:oVL#O™5®›®±É?ûùèøê#;.ÅÏxðɇûK†@Â"Fϸÿµ×ú{Olüb{v©ƒ%ôÊüÉKó¹ö.ßZÒûÙŸý:3Zh­ ¸ºwé×ný“cU‚„€;dô}¿yPÝ»hë厧¦ ìa÷”ùô³5[N•œÜóå[­^~²ÁÅï|öá‡3N˽~ý‘î± ! Çv÷ìÏ‘³~Ý®orõÈ.Ó'‡]<%Ï[8¢ʃ¦gŽîh¯8²këæKqýñ'u±ê%û—}½v剼óÇ×üýƒÏ?Ý[é0ˆðfoûbù)kú¨ôN‘ !˜%åîgÞøqïœÕ›Jâ§üäµ™½U%¦ËˆÇ ë¦íX¼]»ý•§îKb-ÔwÓ–ˆìúÀo_ì®]ñéÇîš’ tÑRyD¡+)“Ÿ\øؼ.9;v>ïŒé‘"¡ÔeÒ”Ai‘5.mø¤A‘*°Ä~¼v¿=ïà¶uÊ,ÔB\Ù[>]ºfÃ¥’‹‡—üå/Ÿ«m4B‡Ï¾ÿ¥:;.½€“^}Þè5xâ¬aÔ°|tfŸ9lê¬^ŠÞP¼ý“·Öõ:"Y"ºÎ±FôšÿôÓs¬‡-ß{A‹ ‘(ŠászñޤƳ{w]ðÂÝ3R€ $7t ¤Œ‚påÜðñ»{« ·øÉ¿þ¹éLv¡DŠŠO™2Q?y¨!ãÑŸ.n“ >{ßÚGj:ß…q$‘cúC/NK7Ž­ÝtôB½ÍÚvÌÀh¬>»äËeË¿)Ì>³òŸ,ùô@µ—ºó{V­:ÙÐyÜØάmR £îüýïn×Nìøæ¬>õ¹GnŸÌ8ŠDœG§Ž˜2¸[¼ÂuÃàhIî3-3…#^¶doCòÐA]­€@´Ús[W}ò¯£ Îüï¼ÿÁ;›³ò %)µÇ¨•ÇNÀ¬W>Úè^Ýð•´ÝÊ kS”!ð…`s›NWønà€&„p!H ª|)… À$)¸i‹BÔ9" Nø¿þ‡ "!ÂORI)JÐ-3eà-þ#Jø¿“n¹ºÑŽ-Ådãʺ÷~×p×Üþ{ÎÇd®Ý¾~÷±ËuLn =Ž,²ß¯,:ù¤ rý¹Ï~ýÒaSZ/}³þ‹UÅê…ðn¯fôK=‘›%!—õüo6lÞ±5ËCª1S_¡ïÚtàDž}Æý0½σ * Ú<üF±!?ëðÁÚÚ˜Hܵãü°gº†©ÑãÒµ}¯~½é¤ã*íüôŒ±Ý>>ž­$’»hÓò%{¯6 &É sÆö'ÇÞÜš[ˆW?ß0é÷szÆì?\¢ùÔ6Ÿ‡‘€³êj~AµËËš–Š@íðò {.Ô矜5nx|§0š]R—WTRë ¯¸r1G¨Ñ¤±·õòX´qÙΆøšÎ¿¸HרKUe„0Ù›µeŦ½; Ö®2òŽìÞcõh¿Ó[ŽbŸÉ¡P›ujåš«a e…;67þhÂа¥ª®^-*ªqÖcqvNž!›¤÷eWò‹êܺomPk§ÑSK?øÃ’u¹rNì·Ç§§¬%Ô(É9»kÛÉ#^çú†WGô¶-­hA–8¢ ,~¸”å\}]ceáÕ¢2§ˆ h¬,<)ÒY–›s&«ÚáñºÜ­OVDÃ[w5¿  ÒÝ ^Ê)n Z}yáÕâJ—ÁvJÌ°‰¸뾓W¼1gÜCéýÒ¸Z©6’¢òr™>½[TjÊ°á#ú¸íöFWò«4án,¸zµÒá‰ö©Õ\«/-¬²ÖèFüÕ³ç/ÖéH•(Ê°¡ðü¦E«¿ÊûÆ~Ï»ÓE¼{¹Ô¥EéV‡©Ìüœ€–ßô¯ a>1pC‰sf¼ ¡¦È(12â‹&qAnØ6lŠE!ê†0% P#Þ@,…0SûEb„JÀ@¤œ#•è·´^)¥HZëþíz eUÛRÊ¡ƒ¦NOO‹ kèѯK|˜&×Uy eÐÂX@ÇÕCþüë=Y6e•<<&BnÌ.kltjÞºêŠÆÔ˜pZ‡—T¹ N%Ê¥¸Ø8Kô˜™?ì/,Wª6ídÝãÕ5¯Ë«¡GÓ9“%9*%TÔÕÔxõúâ2¯Ú5.„\¨„ˆÆó§Kk]Š²5"!)1§Ý)gwV½GÓtMöZY’€èšÆAV€P HÐhªìŽ‚ Ýãщ @9Ä$  -Ñqᢶ¬ÖéѽµÕµF\”£øJyyWJ8爺ÇkpÙáÕ]n† I!‰½FÞsÏð$¬©uÓäPŠ!’”ÜçÖõ—E’à‚Q$T !W²«u$FiQa ·Ê¨;œÎæªÓ¨ÕÎ(ÑbÝR5*‰:*j꽆—Ô–×ÒÔ¨(+œ; *½²KãÔ"K  OŸIýŠ\o(ªhp¹±Þá5$Y–,‘ñ¢®¢¾Ákx ¦¢AêÉ*.×Û&ôNî3éQ—rÏÙzbɾJ&€°–{ˆBà# C0jˆÓª¯ÔÕ»Ýޚʲ:Ú%Ü.óJAQ†Á" a§õçr `^B J Î5MgºnnloÑÅõë &Þû`?·òô¾­«÷äT²bFV„nph  Uµúêê·ÇS]–[déňax\n¯îmôèn·—Ùˆ@Â$Æ•e‰QÝõ9›6}b죯4%{>[²¿04&**¶{Ô¨»äAD’TOÎÁ"·Î‘HæA(87&É üä5þ"Y Âë©Ï/ss.*B±™‘"ð¯ÿÁÀ³×®rï˜^á®È;¼jý 5­êšJ–ý •*ÙÚÃg1ÏPC£c;YGÎ|°ÁÑÒXžŸ[é„ Aõ @ÜÕ88¾ûÐÔ±Ãbk¬5§•ŠKYŽ@h01‚@}d’Ä8'@ ‡³¾¨Ò ÄQé[ˆE¡Ô­ã-qBµ¶xËXpÞ">hÆ“‚ÖëŽ÷äÍÞš¾>JA"„s¤ÔW1&Ò‰¹¥KC`@D1 \øl5 ôúû. "P þ ¥Ípšø-K­‘4¡’à’<¤”ùŽ¥ )"©sŸ‘#lž¬N£Ò#E¹d U°-È0\5%—Ï^t+2!¨£êÖPµª2dÕªz¼º „ƒ ÝnhnoCé¦EÿXzÑÀ@á:#E‘!”oÎ, £LVCì÷:¼BD¯!Épƒ†®9ª /íxóO;+™""A’$ä†Á9G&Aû¯C4}Á„IbŒÑÇ>Ñ݆šಢ(Ìå6| §nÞ¤56 HÕ¤#FõƒÝoüyûe=îá¡šÍ"íþÊZhc°½’Â$‚V»…q×D6orµ—¡ÈÝPbU‰Je«…è^Ža>64Ë1 Š#¢Á¹)«7²HuO#U-’„RŪ¢îuT‰N£FdЬ]R—Iâ˾*iÐ BX»>ŸVÝë”-VI¢ -» 5ÛcpIP"tƒSI–(¡y]:±XìV.YfˆuadY–eÕ&3 â*ÛöÏ·.öê™6|ììÛo÷ËY_ê&“$™pÃëјªª2/•CÃQ×€!ÂtÔA LçýP*¨»J¯ù{Ήžé=G>ý⣟;ûû|î¼zðЗ\V안Ð4/_*/“$½})ÆÍ6=7¡æ¡) ¤üÐÊòwIë5fþ³ç^=va÷Ûä¾B3êex=žºÒ­KÞþòœG3Pð-ì=2½rX_p¥Nœ6T®»|Þ;8³ñÙݢݣ Yf”R_J4M B6Å-¶¤š…qÌ-eŠ[ˆ  $e·\W~¶™•€ˆ”2;2J)€/€B e77hŠ(î3€L…£>F$pÝ.?n½ßl¢Üw¾3EA)û6?[9@r !ìÛÔt—’¥ú}|yðBÁîOW>qæàêe_¼»òt%i#YˆOaòafTŸ?S*õ>l\Fßñãõ$Ù9%œ0A9É@Ñ[}öxnç¹s'LëÒ³×ÈÙ“úôˆ“o-›>¦þI©ÍºX58sDŸCFNè®]9wÕIÁðb˜¹ùB¯¼r>»6vÊ÷÷éÙ¥Ûqf c(¸Áy fŒ ³*ª5$"<,Ì&‰êPA)5ÿ‚5R´’Sgª#‡’1pàÄ‘="j.×Càhn:€©äC®1¼š!˜=yÀŒÙ Ks4@XlZ¿¤¨H›Ä٪ʪ5$"<4ÔF=•gÏ×õ¼ovFzêè;ÆÅ6\Ì/®ÕÐ?<íéÌ@€gé¹Rµçðñú É6(¢öÒù2/£M‚ Yïé+ùæ›J2@£¾ð|UXúˆ±úfŒÒ?¤êÒÅâºÚËÖQóûæ|¶GêÝ?Ù›[Vãh»¤ …»ÑiMèÑ'!*ÒF‰^uõbC§Á£Æ 0jô>jUNv•NͲnþìÀÚ çs •!3g Ô³çÐauµPOe~chJ·¸øÎiƒRcb,„9:iè„ÁáX_VPÒ s*AB¸®ÕW©ñ]{öêmS©ûÊ¥BWlúðÌé#ÇLœ•æ‚Mr–†€d±G%ÄFØ%YµÙÂìª*1ÕÚ)cäî–š+¹ÕNÕªÎÏÅ®C'ÏÈèÖ3mउƒú&6mPÓv¤Ô<ÁY^£Eõìß%>>Ü¢ÒægÓ§hµ…FE„Ø-²%$<:Üf•ˆ I£ÇöHë‹‹Êj(±k)ýM€e’ÅbW}O³H„  VYí²§tOëŸcOÍù“9 ³ædŽLKí>æŽ)}Óâ•À_ä5ÙWô˜þÝÝgr K¤¾q¥%‚HÖȈ°p›b±ØÃÃCÃí>цÒZÑ©W¿ä¸¸PE¦ÄDn‚¦EÉ9Pf¦˜ï¨Ð<‹c¦9ˆA=º¡¼ ó9B.€š’OÁ…ðê\78ñEhH¹êzžð Báù˜ í¦@%AB×a“?KÜ'àÌ'°ˆÙÖoåñóÉwÚt¿UN¿örü„a¡P˜[Â’K ®\­÷ð6)ø뮪ò2¯YB‚HcÞì5_ï ¿kÒ<;Ž»‹w~µïL…@ÝSSQípsÁ»iÙ' ?˜òä³Sת/n¼’ÕFwÕTÖ8Wmujº³®¢Ú…Zá¦7ÜûÀŽgŽ«§W}¹¿ŽP Â[Q\îÔ¥’L Ç•Sëß_5ïáéýj5<9ûV18 ySDXMšõús’â#£Éí?ZØïôáuo¯vÖT•rB guY•Ã­#‚Bk¨«¬v˜ @’Ýg¿Z”òØ¼é Ÿ!Þºœ5+Ï:€€p;*ËëÜ^áË6Ü55^.XUI½ÓðVWÔÖÕ埸²¯Û‚I/¿<¬ªªäÈÙ¢(‡iU]:~"?=óåW2®üø¯kÊ°Û]o<Ñ»S|Hdò?í<ðàžµ¬?±téæîä7CQ¯ßý¯õg¯Ô“WmY•Ãƒ@Ðh(-¯prlÁ<@Ð]qnÅâ£wÎþa_jÎï_¿æ¬TOuEY@ˆÖPQRãörl‘yL@–¨»²¬¦Îƒˆáª)¯öÜYxrù×æÞýð «Ï|³vÃy‡ G/Õõƒý»óR'\¹X˜][ïÆ6Wª0 O¾0òž9¯½2*këÛÞ^—sèëUi3ðø…TžØµis¶Û§†!1wJ“Eõù‹×YLyè磄§êàâ/²%={Ųª…ÓÿYzY-­¼\¬ ¤–ïÙÝƘ^txûÞÃUD¦ ¶ø­,§¦ÕoY±ÆrÇŒY?5Wð†¢íŸkƒú‰ ×_¾äò]?x&}Ö™õŸ­:xÙë(¯¨vp@wUYq½GcÇϘ9ol÷øÅùã¿ ÉZùÕò-Ù¡]Ï?'ÔJÝ9›?;£µXîÆÊŠZÃTØ )%söÌÙ£ºuŠ±Ê³ŸÿËð3K¾X¹;Á{qûž¬Ô;g¼ð\¿ýËßÿç‘Ü­«?Mzpê“?Ê$Â[uq}þ9$Ä<ß9š”jÅ'óŠ‡JgOå•E=_WVZGXÂô_<7¤s|T´4ù‰çzŒ:¾á)Tí_ºbò¬ç^Ì(Þ÷Å?×çxÜõåšKAÞX\RÜ ˜$I>Í ï Í/P Å  Þ0Æ:.xh}ü„„é.3å%ÔoS²¯Mb”¯Y‰¨‹â~ Sh‹ \ "2h ¸^³µ~› pÇ›{äÐgíÝôx#ÉM×D¼»ùlS8ÿúG¯m\º( ¹iïÙtp¡7»€á’Â#fâVr.8H¦¨˜ ·)¶Fpˆc~5Á ®ëBR$Ó¥/ Ãà$E¢šAdUn²Œ¹¡qPUf‰¡¹4’$3@Cו ¸®é‚ª•Qax?ê'ª"!rMã’¢HàÃûöCO¸ÝT ÁĶ@õ 5!|â6ÅzM >JH3¨Î&]-øš°§4P´-=+¨¹M{Ê%%€Üh‰=a *"¸á3‚ÑV}‹$”Á‘P‚†Á) ”õ¡B÷jTV£ŽrÝ«qªª C +%ÂÐ ƒ IV(r¯f0Y1ýe‘P†Á SÉ´I=:ÊŠEfÀ ÍàD–%\3PUeg•ëšÎ‰¬H€B3„,+#ÜÐ4]PIQdÊ5ƒ$Kš&¨¬Ê¬Iynš4 Ýà„Qàܦ(2ÿL C7dÅ$Ά×ôøI ÝfD+Põd:‰šæ!ük–ßøñk!Ø-øã•d‘vÀ‡[àü‚oå6K,ð¥;#jb˜`d4-tÝ@‡ƒj"PóŸ4)KøtsUø:FRÂ5MçD’eF ç÷\’Ö䙀[›2 N[“¢úœsI’Z€éÓn•ž° ásRšNy~Ÿ!õ_G|ƒ‚2£”vˆC „p†!ˆ¬D3Fï?Pf>){MI zuÃœ!Y¢,¸°‰ƒ ŽH( ,µ+W„š¦Y,„6ë³àŠ¬tÔ=ÇDêc”OD]árº>Ù¶dظá7^/ågSíÀÆô×Ä ‚Ð 9IpÙàEÞv.aFe‰ø:Ù6¤sóV˜`'¾U&„à†NÐÕT’˜$tÍë³×çE@BpnjMŒ a†"@”1jp®y<”ÎeLPjR6hÈŒ20tÍË) ’Íô‡@ÿƒqƃf¢eqk‹JæVß››¯¶„êlã¥Ao *–lc¾Úxkfà›ñ¶UQ¦m„ç?<^~_{}Á^ÑNI/7 áCÊhʇ‚ºW˜µ(”Ê&LŸ,º¡£ ¦°€¢‰*Q¢š—SJ„!“|Ö=^Á€2h‚ô¦š×k0@Á HŒ Î9¾]„BB}2{+ ]÷±Ê ‚J2eŒ"×t¯‡S €’Â!æhpßòlb™ÆÖû¦ ÛÀH[ßücûp­a[Ø÷M;ŒCÓ>õ'€äÛÔÐò.( ¨µMZ•‰°E‘Có Žœ Ô[GÂ9GA†/À$FÉ-ricP¥’)qZs0tä¼òg¬sŽ”Q¿Cȧ€£/ˆë³ ¥@¸yv± "Ñ |'ú|0&U°½×&—t›}7%m…Ú‡ˆŒQ4ø·§Nö-ð¶B‘,ñÂf¡ù[îñ»^EYG¯žúmVe²Ÿ0˜ú5DŸ»€RYQšY@˜,¿þ T’e¿0N©¤(Ì'ð?“@BÍ'˜‰1ß#°éÿÏ>m—o‰Ð’¢´d†`’lf„1&û™2ð„PIõO‘o(“ä&óɲâû3•™/ÍWHÔŒjM8e¦šOЗyg6ŒI2iÎOÌ—“af«Q J²Bƒ–!„19( ˜¤0@¥²LÉÿ*°í@JÅ5ïë c0IZ¨ô©ù”¸ÆÚ>#¾5(T36&ÚVÿüêkåkÞÇZÞô ŸæWòÍì) •ßë§Dä¶<×3èÖm Ô‹úFºåM¥­Ò|Ì)óóQÆ(iw ƒ^ðµ˜Q`RÀ½B}ÿn¶èZ7Ì~Í›ì™%@€íÁaßzb¯ Éßñ.º±§• ñ9ù‡ýuu!€ì«a×^N×=mô¯»GM>Ò  ²½,§4{²édS¤€Ùõ©¶3o‚ÍVš,!¬.›6Õ ¯fˆë‹Ef7 ’z=`¾@}T|ß­”BÁ}©·1Úžã˜ÊáI]“ÂÐ[™¡Ä¡ò@Lqê÷}€¯Þ(8ûÂ0šîQ¦Ú"c¥šÂÒº 8PŸ¢]eôÚÃÜÞAÇ çœ˜™?A"ÞÔ3‚—•»yDÕw£€ Tâ{u‹°hµUeùÅúÿŒ¤B$rXdLŒÍ[^RëêhǶHa2O5:±s„3ïRðåSëm/0.k ó#Ðœ¨Ã§!aJxRb˜£øj•Þ,D-]¢×Ó‚æ¬4çÀ$êwØ!Hjx§DÕURYãŪìµ)†ÁAò?­1·E%v²º«*jô6CÅ„)¡ñ¢XMAãfðé:RóüjÇýÛ±PAÁ9&1h«ÛæÜØ+(¡QÓ:Û‰^[PP\帹ÝÙbw ûÍ?IÍýÞ­ŒbÖÓø9crgù{qõqT;2å¡GŸyùþáhàÿŒ1…‚„œpÏOÝUê9œM›V²$Þöè¯_­z ¿ÂÕ—nóeJ§´QS‡EYÞŠ¦«‰½ÇL®ÐÖP°’=nijÏ?=5BÓoåÈ¢0 yÔô;DZ%Ÿ7 IþÈ‹wLJ`7xp¢à2îö;ú†[´CINpú ´PíãÚcÜÿìÂ'Ò™ÆoôÜFD’>í -ÙÞ±Òž²‘½†™fEüŽifÀß/ó¶{ºð‡3û±›TÚŠè8Ï;mÁ5 ×ññŸ×zfË»H;¿_{P˜aló þ/¥¹âÌ”Èv}zÍ?7Zunè\7¸Á9¿F‘ÁµlÅŽ`!¤®ã'OÊìŸÚ+cæ]ƒC YFc@SP£»§õ¬Xö׿öÞÞ* Œ1Æ̸P c@Á÷e”I”QJ(ˆØñÿò¾”0…1 @€2Åf³È”RS!6¹°‰hJ?‚sι™ÆƒMùq‚·õv^ÿ%¢ù]‚s!Pȱ~pï˜Á]ädP Pºë«=J5#襤Ùûš= [_f¾¡†íx!%õG/ZòñÎjà ޷߅¦| ¢åK †×Ÿ¦ëš8"0IµZ%‰²…¦¿)ýËÿ€9Ûf ¨bµÛdÓF™™Ý‡í½Wçjê„i³§÷“Á÷4s>úû*‚šÖÔÓ ™oꬡskÏÌÛgNé-ÑüN‚ $ÌbµÈàçY eS.Kð°µXZm´ƒs馫~rÞèx•6= $‹U–ÌÚÐ%ƒ'5ðÚàÇé†uÈ“?š›£Îo½ì‘€¨¸°wõž¬¼FŽØÔئ¶ !ST‹Jç>Œ5!ü*«EJøÑoIk¼ù¿LvfZ¹ñx‘›BËìwnû}/áä› Il}KP…9|›çw|o°)Ù±Ñߎ-%tHžöü[ÿyÿ]ÇÜùƒ'~|{¿Éw=þü´Coé§rV_\»jæcå¹ç7}¾xýŠ5.Ök@ÿA]ÃBÔð.ƒ†wM°AÕÿî¦eDïÙ¼}û¹wãåý[¾^rºÁY´ç‹¯¾^´?¯Øõÿ±÷QWÛSîݮ޻êÑ;ØcÀ€mÜí$N}“¼Ž“Ø鎷¸WplpÅ€éQ%!¡Þ{Ù•¶·[fæûqWBBÂ&qIò~ž_ÒîÞsgΔ3sæœçpAaãb:ŠÎš³7ßuGš†áØÅÖÞœí*?]Tl·j㬜1ñÖ- '´ÝüXµ¢k „H6ï¡­3B»Nï+Å ðÝ{²õ˜ ÍžR°b¼§ìÔ‰KöñëoËM æò½oVÓÒY}üðÇo|tòlÃYª÷¾½³’Ÿ>>+„G¨‹ÏZðàíSüÚO¬Ð,ûñƒwfè ž0µ`Y¶çòÉSâäu+“"´ˆ×Þ}G"m<ýÉ‘Š&»r$Q7¨Žž°j~Z¸óô{;ÇÝqß}¹ùΚø âýãV?|{Œ»¦èÀEš*sãw–ÚsG÷ži3 *B‘Ö/|rŽXrª9°ðÎû§†ûó*ú®:|æBߘ[\6+CˆÕ†qËÖ.›—â->rðÓ Feͼ÷ÁyrÕ™S'›â¬\º$CÇ(„a]êÂÂðê#E 6¨âçß´fý$©áJ£-xÒŒ`@cºü‡¾7#ÑS~¤Ä“0ó¶» 8Æn~ìû³£,¥Wuxy?BÄé3—]ÜSÔìe9{õÚÛ `cqi=z÷…‚0B¶š#ûNõ¤f$Åè€a}BÚâ—誎+2_¹(?'Xáû¼>qц‡7Åvœ¯ê'A3¦DBŸ2iál]¯ÙÁÜL5‡u|Ç¥ÓÇö\ÇÌ^·q’Fv4ž=´ëÝËvwç‰íïîÜq¦©Ë£‰HžsÏ] âúÎ|t°š›{ï£Ë¢õ2aÚüuK’Üåû¶VÕ¡G1å¬ÈÓu–—·X9N=gõÛÇu:rYžsçMyY¡„DÊÙŽœ¸jëÚ%Éý—Nž¯ôä¬[ŸŸ±nÆ][“`ó©_i°¡Sr0½þWÅa~É‹½á‘/£Ÿåâù ÎRˆgm{_ù£uýú M+"—NéÛ½óPq»«À “E[gGW—Ùë@]Í­ÝNF(d”„è2v•ÒbOýñO?Ò@UHqך[­’ì6¶´¶™%  !àèª=ðξO:Î6½¹1]«·.ÌÔõil6Úm3N˜œ»ÿ’‰ˆ=5Ç>9pâx ãcpDÐ'‰—c?õã·NÔ°‹âÂw[ól-`ÔRrúì…Ë­²#}ÖäÜq‘§ëë;›»NhìíhìpaBÈ{W‹#Ò"únÐ ž˜:>´ÿøß>Ñ€Ëé‚×ÿgiÔóu€’¾â“ç.”ö‡úϘµ"2HWÕOu`­0õ¶·X®XíNz ¡ÜÕPqìà• Gó˧W>±,æÅÒZÇ0.A€.~N^¬óãmf+jkêKÍËM 8Pt¡èxOdÛ.·£Â´¨°€:‹Z«£ŽÖ.S{scE±ÍI%mú¢¥ÉÞ#;ں͒¹Þ4gÅôdÿ³­nÕ0-1ÈkâÍÉ4½»ú{¼z;Æ@ái˜ôTÝóÁ‘"зú‡“¹‘K–$8öíèµRgeîÒi‰ú2;mšaÏ£ÿ8p¾—)yŸjC€ê°ñ[ÏBÇ~ÿþgUN‚Ðèy§…$Ož” ×ì­jr¤RFŠ/gTñA¬ ÐAGMGgŸ½±©ÄêQ²‡#®îâ÷w­ìõ‹i‘:57Ê]ùq]› kÔzÞÝÛÝ×ÓÐ]kµ¹½”„P´÷žÜþþ‡ewá’GÆûŸìj¬ºìè 1ð®ÖÆ>5sŒêHŸ :/ÙÿÙg¥ ˜rgAXõÇMf«èiíËÏHψї4x5kzBÑ®wMNBùðœÉãøº3Ÿíø¤+´=|Vn "D›U8USþè‡GÏô†Ø"Ó¿7%Õo_eÚÄY Møñ{=^ Ò! (å‚âfO8ôj™ÅK ž0=M×|æÀ?>mDcÕ 'å¦.9/Ø{:;LwØP¿»TüÙÁ¢:£V]¸$5<&Œ/·3  É^ðÃŒˆ3ÿûƒ½%ýRh2µ·U—\lï ÓŸ9u)=¿0ˆÃrã®Ø ·58s'§†¡m¦³Î"oJB•9~æ¾ö©‹}lÜ{”=¿85|w§]Dè©-ÞùΣÌj”N ŒO™U˜Fk·UôÙ%¨‹Ê+œ(œÛ]Óã–HM'ÍKKsêÔásíŽýÙÃ?|s©j÷ï~s¨W€P,9{±+<$@Å5µ›§¥ÄGT3Ú×pþÔ™ŒL?kyIMlØŠ˜U‘½gví9×äÒŸ˜»æ{iãâ/”ö؆ïÖ%Uò‚¥é°òÓæV“ ãNGf^ZäášN½´Ö­–+»SºfJþ·§ÿóet+%‘€i›×å¤egdèµ 61Ó¯¡3«îJ}9Ü_ÈÂQa„²±×a±Ha裷Yd¯è2¹!‡d·°Šó Ò"òë“e$¡»¢ÎH€H=Ý6«M†ÃÑà}!ÒüUÄÞÛO0æäÎz·:ÅO‡`®>—$3(y=!,X{c;¬5øó’Ýd¦sbgƒWcÐ@˜`÷PÊe”q#*ÙÿýÀm·­þÎlÞÓR²ç]ç# „Prz]f/€X;$õ4?v†2ã ¨Ž;ý–[rd˜Twº¸eßzï÷nklïuòI‘Œ¡ØråÔ‡g×mÜððÈŒe;~ÿâ%ªÓ…ÌX°"ÙN:ëjz=#µ„:8Jﮩµc^B€ÊB Ú<^›¡ZvËã¹àØPƒÎ0kÑMinʨÐ\ÝÐ/¨õ~zfµ:< û 9 ©µ S³,m¡A:r¸¯š‰cÆOL ¶¿}ÎÂ(¨®‚¸Ÿ¼ÿÙØõß}r:”ûϼüòžó]. 0F…în›(¹*Añ¹¹ct½§\´1ŽÀÛZ±ó½Ik7Ý3“¦K‡?ܾ¿QT&ŽN;à0õÈ ©Ãy n»i2›l(4Ù`îRXÛ±YÆ>! Tk AÑþiQK6ÇÆ(µTŸmp0Ę:t줴Àî×ÊZE Fï§ÇŽn§KÔë±4Y!C†(è0[%‘l3{@f˜§ öÇÆv«H‚ˆŒmdú”1\óžên‰¨Òè‘ÛäôˆbÁÕßo0p #¨¡ `î>7U‚(‡yÔAá ñRWgdœ?¾Ô/2)¥ †¥Dd‡ …-yäWóEsŸC>Ö@MÜh“HíW®¦1Rùá‰^eYðtt:ÙUØH觮œæ×QZ~¥EdÓøúû'.\炀ɽÕÕ]"BžöúÊ‹M[×OzêËnáÒVß±eíx•Ód'Icô­Jˆ!T&² 3B@ˆÇ2k› ‡C@Ñ~Z5€’}[bè¢ÓFåÍZ‘M]mUÍf@œ'ßÞ·iËê‡fñÞÖÒ}oì,jp`ô­eúz݉Ÿ#çF¢Ø¿ØJA@œF7#ÁÑxÊ1QìhimîõÒŠ‚ŒÊ”1`G¼a%€@ùŒ ï‡CŒ™ÛlœMŸ½÷Ìó‡Í2¢2…<Ï+Á |}%£‚Û)s†Ð  £‘,N Ðià œVgð³Ø¼ƒ³ý*¯Pp;©*!ØÈý†'ªE“K`êôa¥å ´uÓáíOï‹»èþÍK——^üK)S+bê­>TÇd IÒÊv§‡@(HÑ0 öµ˜œÛý]¹‰@J€Ú˜É,H.ÿËãÏmÙ·?ÿÔ$!’¬µ{ßþó™½á cgýò‰-÷_~±×ìutíxñåOª½PB‘J=òº”RÁjôꦎщŒFÅd çÛi I䥶n³ÛÑ°ío¯}Ö(RŸ4}¼Ëƒýý´* SŠsRÑ^ñöϪ~è•Vž«Ýq¼ÕËF‚…1¨Òed‘†ƒgª½c£2…ˆäõdÄÑxúÕ”…E„»ë—ß•_\»»Á-‡§`0¨ñ?=ÍS½ûB½€1 €¢ùü›OWïˆÊœ²ážÂ–ËM‡èÕ]3„€1ÂçÌžØ{ê¹ÇÞ¬g±s}~>78Hóg’èvͧ‹žz|·EŒÞœ ŒH]¾Øsñùf“ !b¢ÇåU•Sˆ±&̤Î^Ð0¥24h hvÈ«‹†óC€Ê!ÈpptúâY–sÏuÙ(H§—êüt*ŽRÈ©ƒÝ}nB¯*††dI(¡ ’¹îàßûNè“Ïþ´ºìá=¶¡qÓ¡‰‘³çL–?þÎcǫ͉·>ò½%WÕéÃ0*ºúûºšNýá‘w[95¤„0^£†3‡#!0>2yF&WýIiS/2Áép™{O¾ðøßë T&WaÈeM™5/ñô!ÓÖßßtöÎ]Ýê±³—gZŽïxëõ#ö¨w=vßÕÜ7ezûPž€(xl0’ õó÷×a—[e¦Ð¸C6”ãê· îºÏ¶ýííóvRB¯â1l9¶ãÉÒáqc>pç⥞,¦èÛÔ¿b`þ-ïݦqØY±ïd³­ïüÇç:Û›J>ðiQ“  Ï =¼pCR_ƒ‰…Ž“œœ˜=)/?6dØ Ÿ-æFˆËÍKŠ3¨øã4šÚNiò›³zͺŒÜü¥Ü133 °.}~hw{ÕþˆÙ¬Ÿ”Wxÿ¯ò­Ç÷w¹(c 8oéâų¦.?9E(©ï0Áa´¡ä )ÉÉaà´Z¿@†Siõ†@? ÏŒ-õ•ŽØ9÷®ÍÍŸ{ßÿNé?z Ç} @^Ÿ·iÃä´p> @Ê]~¬R‘ÆSG§,ܼr\Œ^kÐq²ÇîeÃ/i!„N›—ÓùFDŽÉ[¸fe°$ù†þgý¥ òÌ[7o˜5>wÒÒû¶,šŸ­g8xìä…yÞÓï{‚`ÑX~¹%dfæ¦&æÌX8]M(ÆžŠÓå8÷–eyÓf-\;YÓUZë ÎÊËçû³üÑÍy“3óoZ497QT©“ Ç»Ï|Z¦$Xab¾|¡YJ›9o圩K–,,€Ueu"Ej???-¯Ri ƒ¿ŽŽAãKF„0"»ÍmGwþå`èÆ_ßš¢Bƒ€þ>D]½NYjLž6YFP /ɇYšL4>7?)"ÌOű¾¦+;ÃW>öÐìÉiÙ ÖÞñ³u1ZÏÆð‹u?aZ˜­¡¼¸Å yÎÔ$<øýÍ+sÓ'M_ó£­3s ácgnXÓñÑóßùó‘˜û~¸5Í\V;5úûE$ŒŸ=§ ßϬ ¯öÄàÞ‚Ÿyç+s ×-ËÒµÕÕ·9 ÄÕgv…OÊMKMŒÓª< ‡µG­XóMÓ3ò V<¸eêØ`†uS6mÌË×éý Ðc÷o Î?k'R@‡¿|Äù½ñ‚ýë_üôľÃuÕý)Y~M—:tþ´»êJc›ƒ]75ªCÂuÞòâ: ‚^£&N™›¥{kºÚ*/·t» Æ/*\ÝUQÓn®†xzŒr̤¹ù¹~–¶v£ Ž ôT]ªìqpÊX¿Æ‹E =uõ&A?® `Ê””Pd®¼Pa²‹HŠÛËk:ûÄë5YvZzÚ,ã§MŸ‘Ê×ì~ëùcV;þ8Ù,Ƨ'ªkv¿ôl«H"“•EŒŸ<­p|„ÆXYéJZ¶jó]7¥†Jš 1ãgeq=­Í5ÝŽà Ó¦M ¯|´íÅ“Ý.æ—0Fß_W]Ý%à€ˆ]oEY·•DMœ=gá´‰¹±¶²ã{>)µxɈS¨‹›•¤î6†OžØyàïÏìtR€èr8äÀ´9³'¥©Ë­6sK}_Ä„©SfNJŠÀÆšªÚê–¶^’0qaA5ö»ú;Ê‹Ê»|LNþìE&Ƹμ÷Î?Êì„ô×Õ:51ã §OÌIиÚË/ÕÛ2JœŒ¹ýJ­ŠÕa±¡öºŠ†·wï5u6tƒ´3&çgEjÍe•ý¤Mòl¿ú:ÙǽDmmnuôä)Q¨«¢«­²¸±ÕÜ]ß韖›7+Kße϶ƒ&,•—;ý2&çÍž”,·WÔt{ó6ßšmüà­šd¬À2G{›MöϘ5=#QUÿé{ûŽÔ¹YèüŸ|gÅŒ1•6$)3-=ÌZViÑGDcÓùâv/ÒEÇX›kÛ<†ÈH½£æâ…ÖÖòÖÐü©|o«ÈHoSs¿¨Ó¹š®tp‘jWÙÅ ®ðIógåfØ[ú,]—ÏÖ¹„žÞn12w^AþDk[[GswWcÍ™67|Z°½¾´¢¢ËK€>&Noo¾RÑC”w8ï¡­´ä££ç:}ÜÌŒ8ÚZšœAæNš<.€ôÔ–Ö“°ô‰IBÑ›U´k«XÎœdcñÙòzwhæ”é³Ò¡³£ª½¥ìr‡§®-o¡|Sƒ‘jôÞú*ë˜üɶºæÈüÉIàÂ;ž8ßæ¦Éaqñ‰¹…óóâõ-••¦¾ºZ3 ʘY0iRr1V\¬îwÑÈÜÂ9 §Mœï(?±çãóu¶Žß–K‘eyå¦ÕÑ ±×÷ÏvˆûÕý?Ûóݼš£AbD–Éçf]aŽÃP’¤Á n¬Rñb”0 (‘eB!˜|­(Ä«U<öAc3ˆyÊ¢DÀj5G$Q¦ "ŽãÀjJ$Q"”)Ò¨$_Ï 2p°Ã¼J…1`²$ ²èå þôä ùØk/èu1Ye™„vp¼ŠÇPYEŠT*}ñàÉ‚ Ë Ì«U*K¢ 3¯Â€È2aó¦²DÀ¼Šç€È’$É#Ì Ë_zçwŸûÅŽË„’(ÈtÈÑ…WñˆÉ‚ QÊ Â¼ŠÇ2F‰$É2ˆãÕ<†ŒÈ" ‹eó<çÃâEŸY€˜çyC(‘¥ëã¦@Ä©ÔAˆã9dI¢ Fdmæí¿[gÛùÚþ‹]J"^9`²$ÉaažÇTe¯VI)€œŠç0”e‰ˆ0Ï" ¨s*|—ÕÑ9«XèÞñÌÎrï˜eŸŠÄZF$Y¦"N­òiH®ñj‡!£Demüä5÷ö½õÌÇUâPiˆãx‡Àà@E¼VÍ ¸÷¥’W¤˜S!&J2ˆç9FeBâx ‰$¯Q"% b ˆD$É«x† v/¤òÀ :%e”‰ Dòu(âU ’BÀ ( .xð—3/=óÂùfçð‘¥0 ¥ù r‰2@§VcY(ÀœŠç „2(‘àyL$‚xÌa#4ÙßûÙ4ŸÞõç2ˆUyµ¯‘0Ïó æÖZ†V©ñ7ׂ¥½ ^ó• "æ5·7¤Ö¨ÿ{ûTènmˆS©¿&¸mÈÚ>Ûõ"êUiÕàÛò«0BúW°'Bgy#/úúð¼Ù.Ž/_ì5vä8nÔ×|Ñ[n-üzÚx:ú[®ô€x]ç×pYüJ*òM½ÏÓçW»”q_CÅ¿2Å~µÃ÷æß0v©op€p_}cH!8[®€}·€ðë]t¾-ß`QH)ÿõ ®h«¼ ×3hêÐ1ɉ±ÔÓSWÖê‘ؿΦÃeÔÇãÊcP?&Œsötô #ÄÒ«)Ã_v:  Ø¤hdjí¶¹äÏù!ï–” m©hnøµ©#RSâ#ü$—¥érMº®yWþdžàˆèÒ×Ög'ˆ×ǧDY[šmn2”bB˜œap7võxè׆Ôþ%ÔI¡\j<èjìvzÈ µcŒq¡)SKW¿÷«P,¼&"&‚Y»{-"üz¢Ÿ£Hžœ™¤»ëšº»íB¤ HL ékhuäëXÂÈè¡D´ŒQèÍY»z,véKv:cŒ!}dJbt„^´t6Vtx èÇd‡Óæ¶va@í–˜=ÆJý-=öÿ¼yðmùjÊ`¢2§Î(ÌIŒ‰™¶¢ ”z=^aDñ /“qÇã?Yµz~Þ´d=÷%Æ £”;sÙÌ) HÁ¾aò¦ïÞÿÀü¿QÄJ’$Ë2ýÒ…H";oÝÝ SbÔT&×ý!š„I›¿³Ø1BnP4¡€—ž»xóãÿx4+ ýRÅk´éöÐðÉ ¶üxCZc ðÁc·þñG“µŒ a buêú‡ÏŒôm`ÿà g®ôÉõ±úˆÓÿ†‘usûÝ­óâ8ô•(0Î?ã–u«rùšjM’¸å?zdãÂey‰±˜1À˜*ðjê;,ˆ8%$møö‰ÊÓÅMž=ÑÖº¨^F<ˆˆ¢(ˆ²$‰"E˜ÃA…xY&’(r¼ sŸBÀ(%²RåW@À|áA”R1ÇaÈ .ðB3œ§òÑÀRYVуˆÃJd[Õñ¿þBíÏ3U"c ŽÃ)”é„0Äswå§Uuå.»rÏÒÎBJ)`lèõŒ¤ÊÉO×4¸Ô,!žƒ€‰¯$˲$!ÌaNy=öâç~^M­2ô%¡ù@®ÄP ðsS*ûÀÝ€>¾vU!>i0Y"C%Ës£ŒB|pÓìßp€” %q@#’LdH‚׃(êk8œ %’LcÀ‡¹±@F ‘)a<Èk8¬n‡}avƒ}ŠGe¦a”PæÃŦT‰ ÅЧê Jv‘ 0‘²×+ˆ’,I2…x`²ÁºqVª ‘eªÔ×GçÃg @Œ9%[ÙÓ©´=k^î„”ËÇëåÏIº|Ä>("NgD’ˆRêF‰àÕŒ[Ѷãî§>lñ1Tv¶”¾ú«ÑæÈŒe„È„ ¤aA@e`ŸB•Ï|ŒoÐÁnCz+—’ć¦N_œhÚ¤YjžS «yé7*Ñí̬†˜ÃAÀ 0…Iqׇå–E91UÛtìí§w]1R¥‘k_ÿi¶{€9:ªv?evzîšÁ†fl* üƒzûö€õŸ^¾ð¨Ï]ï¼ UÉã²’Ãp{@ZŠÁÛÀ…kŒVy(»|HÒ¬ïoÝ´1±áÜ#o7·yù—»º`ÜìÛÖ-^ª“­Õ{w½óóvª'nº±ÎãÔ&¤…Ó®soüíÝS6Ž¿*A.,gÑÖÿY›5.Ù Ç',½»ïì yò L7yýoóâã íÇ?|å¥Ã…dÍ^µuyzœŸ·µüжwO\é¿–¬“1†´1SÜrßÒ±!Xh9÷æïÞ®ê•(å'<ô“åñÎ8!Mo=ðúo_)Ï\ÿè–Û2mÿöøβ'CˆM[óÓ{ ǨZ›m‘Ýÿmû±J>÷Ö»ïÝ2Ng;þ“Û·õJŒxü]•Ì¼Ø?:œkÞ¿ó­gL›wÿVÍŒÓkäž’S»ßÜ}¥Óá°µt(ä0@¿Tꕘ6FÓ½½Ê 1¯¬]ú˜ßÿåòàP©éì'¯îºØâÕ¦ÞüûGóg_ýí?>i“cªàÌ¥«×¯Ÿêçh½Òçzí‰'.±¸©kZ—zºÜØýΟުî#qÓ—®Ý4/!„7WœÞóÖÇ%Í.¤ šôØS[„ݵ3’cUõï=¿ã“‡†óüÉás7n¼ezR”Fèk:µý½ý§[ùÄIwÿt´ÚBã¢XÓ™]/î*ë¦þc§nüñmƒ<5]!!ÚÒ‘·ŒˆrÒ–ßþz‚Fë'{l.uTPïŽG_*îW_³ñÖµURÓÑ=í8Úb–¹À¨ü_ý~™ã@oÄ´øPPñÖÓï5ÇÎZ´rma| ì¯8ùîs;ëÍ×SÆùe­ºwað¥×ß8e•u“7mšÙ½û¥{‚sß½~Öø(äl;þò«ûÏwº½4fÕÖ…a=Ý„œ(Rqðé?gH“²ôÎ_®Š ”ÚOl{{Ïév™ÊÛ°eÕ²tr×îûð£EN8vê-¯Ë‰Ó3·éôO|RÖ/ò¡ÙK–/¿yZ¤Nî¹tø—w·ÙrwU›sù¼ä¬Ä³uu2ŽÄ¡ÅQ€ý£&ܼþ–åéz^j;ùÞ¶—O›`TÁ­k—.É20{ávl;iö.ÿÛŸr=M$,>t{ù}ûÂf­Øz÷Íãs‚´!ýåÖ–/íج;vÉÝ?|0Ç_®úãwþVÝíŒÀ q‹ï\¿(?ÒÕÓë”PÅû/ì;'­zîá{O|r®/jÎÖ…ö·ûaá~üÌÏ"N]$2ÒB­'ÞÛþþ¿Â –eê³­dןߺжô{·-^^¥³}Œµ¯ò'ß*mp¦Üôè=wf‡xN½ò»ªAdˆ›÷à]Kò£8¡ÿüŽwö¨ðFf/ÿþÖIžF{tF¼¶û½Ÿÿéd³HáU†!å2âU/ýnÅ´”>ç™Ó«ÏúûŸ÷ôÇ/xì7GÆÖ}ð»W·Õzèµi4Fö‹›¾aíüÙéþÌZ³ÿã÷v³ ÿñ.ç«Ü+JZöÿ_–õ [{=Lt†OYûƒ»ŽÏœºð–Í3¢Ò –­™¬'òP­2$kgÑÓO>ÿÒ¾† Ç_øÙ¯žùÓgvœ¼rÝÂ|¿â7_þû®ê˜å› ²C ×Då$ëÌGŸùë O}PÞ%¸ç"–Ú“¯üòÅ>«,ùpû?úâ[5n™†tQ†î“»·¿w9`ÆâÌ$PÅ.}`-_þÉó>kÑ]+"ê?~áW¯û­yà»ÓxÔÇ&ËIrûû_òô'EŒÑš½Ï>³­ÌÅøé0 r~9·Þº,´fÛoŸ/6©rbüt<LÕû^zê…“’>„WŽh£cÇðeÛ_~u{yxá‚äHÀZþ½'ž|úñm­º +Veª¯ŸÒÅqÆØëõ*Ô;^¯à®v75»€²Ëd@B[Ïîzv{“:{Ù†iÁLô6~úÿ¼¿52$X` ‡M˜±líDóþmo쨊[œ¦a4pÚ=[2¸šÏpŪ;%AËAMDö-·ÏêÙûæß{¥JL\¸¾ É `]\jÖ´ôºw^xæ‘—Ž•…QÈ1qvýãgþ䧅ü[EûóH¥O˜:Ö]¼ç?¾Ý˜]87A­Ÿ±õÖ©®cÏÿf{7¯V¸QÎ9Œ2uHDWuªœÅFé¬eU©MBî†9µ;ß|í…£šÜ…ËSÉ2@œRzvvdñ+}úÑ×NUØBó-[–ѽû•§³Lž´ööiúkOSÈ‚µÏ4fÊø°BÇeáÝ=fS°õ¶iÒ™ÿç×/}`óð­™1zĘ*("qÊ„€úCÏýèÛÞ/± «Õµùä«/ï-e37/càC&ÎÙtsì¥×_zã á…KÎIPñ~)+ÖÌ.~áû?ÿâ‹H(?ÿ¦%scëþñü³|·5`úÊ•Ù„Bog¿¨ Õó#8I!ŒÉH?wíÖ[#ϾôÌ3¿u®É+I\¢UK Ã+w¼ºm{iàüÍó§F@€‚Ç&ùÓ¦ÿøôgÕÚ‚¹Hû‹½ðƒßhv\ÞöôŸ~ôü±sm2ðtœÚöäŸ>ìaz5‚¢ÍXsËìLvòm.»Sædè080&6ÀÀCT~!Q< >4.mA¡T´ó…ÿ}úÃõv‘:Û¯ì}ö©'~úÌA÷Â{š‚M§ß~åſ|aÇÿ>þ‡_í¨jsZŽ¼øôë¬Èß_ÏÆÔ$-Y½y²{÷Ÿž~ûÓî)ëWLÆaMxj¢hzçÑ'Þ7MÛpg¶žƒP"K’$I¢(I2PÛÑßþæïûÊëí~óÑ?¼ùÚ C¬ûì‹¿øÝÎÊ °PÝè| YyÛ…c\Gžûë‹/ŸÖN]4#+ŒöŸn£ ’Ø'ˆJà·å†ÎRˆ']û?~Û u+Û×8vyFÇÇž¬èqB,KÒ`H„ŒÉÕgêï· nÔ×ÝÓç"ŒÈšÇê9×£±$Lšš>.æÐå~!´Õ_wa(ã þãrÒ"·_ntJœm%–´ö‰RYô’»¥èøù³e¨'4ÚÂœh¿ê±©ªÚ³§N•õ0crA^zZJС"É+rA1cÓbZš*Ë;\^ž9)+= ™¹YœÈ’u|¹W@p¸=ToÐk8`G¼ظÂñðÒó쾄 ÚÆr(’à©pëù³‡ŠZQOØø‚©™cøSuÔem.)­olrT˜Þé™Ýãì7C‡H=f“±«OA‘\fS¯Å-ø|ËD™=>Ús哳‡‹ìñ0c^΀“‚« ¾Ý<ÈÛtøÈÑŠ^0ÄÃGêŒ)3 iUac3ü¹sís¿É!xÜ–ž^£aÀ„’ÓÜg²{…ŸU`jv|ÿg¯Ÿ<_%Ô¨f,¾7)9¦ÄÊ$Koëù¢†&³ééÞMIz®ÔI D˜S\ê2¥ @œF£ÅáÍÒc4›HîþÙqÝätÑ%M›‘Gи¼©ñ88,fŒRðîKÆ/Ü®B©~ݴࣽBÈ‘îÇoÔZ)‰̽ÿ®‚)S2±Á/=>YÔ?¹³~×yB‘‡qC8L­ x^‹„N·(S* §× W#„ÄjvZ€xTw¤VŽ|£¢Í#‰„"JdÈ!ÄùGi€×#2¡£ýÊgÚëœW/S\ˆWëxê±Ú%8ÁÔ#©´¼²w=F£› D BH¥”Å00y­V…ŒýL°{D·<Ú”ðMpÉ%B¡ÊEöO_ûýÍ!¦š£—yž>†žëC¥V«].ÆX£VF„Ü#®ìòzÝ"¥Tt;)fPaúVþ@œJ«‚Éî’l]N :PÏËíNP"º<‚SbñþaXöŠ„!H{+ÏÕÔUuŠPÉÕÖî’)âáHÞ3˜ÌBfßuÇ‚¡£±Ó« P@ÀÜ‚$À¡ñ<§á5Pì6KR§Ñ)Ž8”±iH©L(%¢Œd™0ÀiÔZC ìê$ʈìu 8D«Q•gw¯Èd pjNdÁ+eKý™«Êí2 `BOÓ•]^z˜Yš ³µUÖÚql€ž'V…ó¬}ßs•UíN `²Øg±{DI–T<0™x¬™1ìqŠèU*­ÖëpK„2"z¼"¯Õªˆ­aÏÎþó3.ªªÚöì;g9½NC$§H BWé±+¥åEC1•‡­ƒŒˆyÆ€…º^zÀ «õZ,õ{‰R$x.^‡ ²,º% @Ák‘ƒé l( ¯Ó©¡Çí$*y½n³ ñA³[hY–PÄ„ÖV—¬È€º¨ô¥Ü6·W6ZdÊ ¯¾:ÑÀàä¿Æ¥ c«tÎböP¨×å¡A«æ±LEQpŠY €W#C)5 < %p€CáwéÕf*µQû¨Ç"¡l­Ø¿·½Ü8 %ñ¨!Ê%1!„çùQ½qptšÑ¿bWõ¿à¦ÀˆBDf¤þ i_îBȨÙGדö…où§*ðO[)Åžê6÷Œ%½—›"óô5•WJ,@Ð/ô1ŠŽ~;É öÓñVM@P¸ÁRí¤”! `¢q„+ Œã” Í2¿º AÉTÛÛ—Xöñ»Ÿ÷r*FËS ú•ðtŒ©ÇióàÀ˜=4Êi©jg‹Å%QÂûö/û‡:Èl½‹‹d'âK¿ð@} ”;…6ë*Á÷(ŽUuT~zH׫?{¶´_[ø㱫ãHˆ 1Õ€}÷Ñ" ½ â8!ä±ô(3"S«ÏçdžèUñ ^[Ÿ“ÁÖ®JlÑe³CHd¨¦ÞfˆK"}T¶uö{Táþ*^m òQCFSƒ¹ËubûÛ—;¬â9 ©‘(aŒRŸ>¤dI þ)ÓgDÔ?÷Çí{« ·§dMPY%†ßx»¬‹ W{«]QQjµ}4i2ºº2( „€xí}ªàÐ=×t!zÙauèŒHÄ·pIn«­ßÔl=ý÷7‹{ÄB ‚Q,+qöí^9w¢‰f:J_nuäìíé· Çß{õPŸF«Sk9**H9 û „ž ªåPp¸ å}›¹ß/'T¯æ¬À/(P#´ÛÜ"ñöV|úTµJ8ù‘º%ý³ —ÍV«©®úÈ›Û*û)@X§áeYq=è ½Áæ‘|žW—B²à6w †´ŒPm›q* ¦.·Å&iƒƒü |/0ø‡ù;šlÊx\Ã)£’$AÀ8Q"QXìðZ-’¬×r‚Î/,Î`d PI‘^ÍAÀéCto!”Œ "âãÀøô¬Ïþ‡žØÓcZ°:ˇ”È("&1Š•{ƒ*9Fª{·Ýj£“BU¨‰†ëh¿Ý)È0¥M¤BQc>2y84†‹J2U«xÀ(¥*уD¡£g %¼š÷Ét»í\r⃗še¯VAJ „ŒmXDˆ?íoïsxÄ‘¦hà@IGý|Tëõù_ɲ<"%s”G0"SB€ ¬)lHÒòÈHû*0ìÆ…ŒGO¿ž4I’Fõ9_}Î#ÿœ•ÂØ]uä\Îm{÷^ÆKì¥ÇŽ,ñBŒ  ×žt®5;<í+9S_pWáÂ5öFuÎôq¶÷^h# ÞH½ €PtYÍ–„‚ñ©éfKOW›pí bjl£J /‘Ímu%7/xèöÆw»æü<§Liï IDATg× ½^ˆ0qÞVÅFøk´|pTTx/²[zÎk½åþ­K{w–ÎaúŒ¤Òú‡EDðCx|Œärš;\#î€lkuƒ¬Ø”x[ò„… ƨK}Zò´T™Â¦­œm=UÓÔdtzƒ ñ3(èuöÞÖ6÷䤌ØД˜¨ˆôy+Ùý­çÇ[.¼Yïâõ¡ÁAA~œ!8"*Ánî1·UU4­º}ÑÝ«åêˆõÓÔäSNí­9vƲuù²ÙžØàÙcÃz“- '*Ð×?°6ðh«a\ª¿§ùÈß›?7ÐBÈ«TÌcì6±Ð„è˜ ¿‰Ë§MPìÓ5æJÖ–s—]Þ¹0½»jÆüôРK×Ìz!Ïsdäå)•zëK:C~´dÕìH{âŒ,VóÖe£Ìs(‘’ÊB†‰­¢¨4æú[6«¶¤e;Ë÷ì<ç~;!TkpÛá³–Z¤2¿ûz«4Õ;çþéoiÕ¾ßÁ'çÍ <ñÌ;5Îá!- ÀT†±sV,hТ¼‚ÀþËÅ=W]í¡ÛV¬h«å'ä%8Š>­´ª‚Sn¾i k)mb)q¸ÿ²Eöš./ËûÑâuºœ1EdgâÆÓûUˆèââBxkG[³“(Ôjèšé#ÛŒÕ{Ïxþ|÷ƒ÷ŠGêUÉ9ºóoî++ª›ñ`Á‚uýÑRú›¨O™066 á®- X>«pƒˆ6£ ÊŸ¹(×x¾ÓÒgv{q@t˜„ŸFkŠˆŒŒf‹³ìBÝ¿º}U5³e-KõE5m.–!u˜aÌ!(36,-A%óªƒôºPN«Lˆì3šn2Áh´ß<%wR¯±§¹¹©éð¾ºmÞ°Á«¹Ô†“&%vîþ¨¨®È|Æ]?ùþJÏ÷=u¢¢ÿŸòª);Èö«|D ~–)ÄÀçó»ÆéøµVàFíÄuù{s½¯þY®‡‰~t÷š*KF¦¶®Ô¨U{Ú®\î肃iCò@QhÉ9ƒrT^nB°×Vt»ü§Ü´(+ÒyôÙ—Ž\2R„ZÈuUÖtôK×Mo„µÏªÍ™¿zýÒÌÆ‹çzpx¤ÖÖZ[ÕîbÚ ½¥îJ»ÉÖXT‚S§Ï»inf4l»p¶¬Ö$,´ÐW€lïk»Ò¢?ÙŠL×¾gþòÌ;…}Dgj¬¬íc@Æ6qÓß~{Ë”IöO13;ÅÐYt¶ª¤ºY;aõú™‚©_‡ì•E¥F>eÍc?Y3-Æá6L]± 7Ë¿ñôe!$Jeª¯©é°!8HÕSYÑÕU×!&-Þ¼*/…Ôœ¬ïí¨«(i‚²¥¡Â;uúy“@ÓåÆÞ~ ¨8ýS¾cDd†ØŒÌ,¾òXµbÈi9jƒrçNðœÿhÇ[g¬8xòÖ{|àæ1¼Q›0uöM“HÝ•ê’Š¦&gâœÅIö#烓էmë(.¢&.˜ŸDmvÑå¼|ôBÉXy®!|úÂyK¦ÅëìµEçj[lóúèX]ó™âFi$5 „B„©©¶Æ;nñMËç'¸Ë›jKª,TŒŠ+Íè-Ue­m Þñ«·nšh­nëo©¼t®Ñâ”Á##`Œi"â‚úk*ŒcÖÖ¦ÑOÓ[}¾¤±ªÚ™»æ¦©ÙúÒÛ?Ú[/`1oˆŠ„µgÊZ$„ DÀÛÑPWc Ë_°hI^œÎ\zèds‡ åÚð H¬&Ÿ@›‹í»b(==%XÚÒM+ò³Cú./.mw Tî'›j®´É3ÆÃþ1áBsoÔ¬9‰â•wŸy¿Ñ,=-•­xÚº¹Iìäëoï;Ú&aN‘:óæ¥ —NÀ¥ï>ûìi£‡zZªëšœñ³-X01t_ºÒâ‘€úÈ(?Ò[yºÊhÁhn(„Çq#ï¥>‡iþz_ÁÁ5èFñyE¥Êå ô¥PükÒ¾Ä#×À¸ž´/|ËU€É’´â_ÀDÿŽ?ùäïïk5Z„±à(cZqÝ^ó{„BP–d¯WÐêu þ)¥ @ò1¹2J)ƒ!ô…DLAG)ù1tø‚Ñ£1cŒ2¯WÀæxj÷ÿÃPQJR‹/Ù B9PB†bAóÑI~ŽªÚ¾äÛùÉlóÛOn?[ïÃh0FŒR¦TÈ—_âû‹*N€¾üüfåÕ)QeIR«ÕBA ÀQS-ZšÑ±ëÕÓ„€d€Aèk%ξ.Ài‚™©©Oy÷»/Ä¿¾æ7»úpxr(0vtKi›ºw¦û¯?­ËAeƒµSzFi?ƒV¸æ®sÑ<Ø£ðê• m2a%!†2ß%Ä晦„*E ‚€R!£¢(##¥f&\AòÂKÏØ5Mm.ø¼¬2Q:zð• KeB¨¯ƒÈT&L¹òÁ@ß11BPI ˜ p ™J¾ë°º¨_°y•¡áÀ§›$t-!$2"Š¡AFÃ<1VR²¨‚VT¦dT&a_j–B êìà€10t<\`l„A2µý¦ÝòÝÏ:þÈOÔ‰¾9yu $4«ÖÔ7‡"(ƒCÅm0 L¨¤H’k^Š12jM@e ¢ï âd õ‚©‚xžóéÜ7¥G°a1FWG™²0(z£Jª1€p`® ¬p aC­Ñ7114XcÐõK ‘e‚x÷=ÇkX¬ ^·û•ý;&ÏœúOÆøA“FŠ·Bx=¯%DhXúœ2Fñ5&á‚…B<4~^}nðO!Äs˜óåÒ^G.j ]×z†Ÿg€\hÆ­¿Ù’ ‰³mÿ U¶z±o¸—uUÔU©ctÍ&J£Õ*û µZ-BoÙÉ}ÝÀM” <⬠‡ë–1Jù ô÷lYŒe§ñÒ3Ïïí#”h¢§lþÁ’qÑ*±æЫš¼V]„%Q@*¼~,Dh„žáÐ&_5ÞÜÑEô€ÒBIÕjµJ…CbŠÎ®ÕãÈ&ŒžápÕAx­ê”ÃŒ,K<â¯Vnçƈ¾Š¬Qv‰ø‡ž×rn×.ê²Ih”@’DXÅ!Çá Ùˆ†©ÚŽau†\;ž‰ÄüÇ.xxìœâê.y[qƒ¢„À8Ž²ùöð5s]£€!•À£émÄ:€ ¾úTEžãSî‡ìÀ‡-‘}7Ì ùj´…f”YÏEQ¥R}óùIƒoW_Íèg!Žÿ†(„c’$)wáß¼•‚ʲìs$2ö…SÜ·ŠPz½R þMåëy5ô4Ÿyé§uz5"n»©Çì–ø².(¥^…°Qf(\ÞàäWWéÎçÛê0Æ“ŒÝrÒÀSÑeé19 ÌÎÿ·çB!Àÿ®Õãß;ìo̳øµØ‰ûqjÈæñK[)%zXEx£êþæ Bè+œ½¦¸­uö5Åáñx†~‚1# Ÿ¿h¶‰NS‡Ã8¬ºÔméi2mÂH*¦ì­þ²ç/¿L(eBø ïìè@¨¤òö¯ÉTÀëôæ(Mæë÷¯¯ˆÎþ6Gßåp ´•(ÕðÈ}s‹ÔPåÃoxü?öÎ;¾ª"müÏÌœrknz/R€PCè%ôÞ¤(v]׶Šnoîûnßww-?ÝÕ×ÞV] H•J „Ò{¿ý”™ùýq“r#èbÙ}Ï÷>aîœgÊ™™çÌÌ3Ï€¦i›Îÿo6{ü!õ÷ê O×uBȺ+k)AØ71+¼šÒ~ s‘oVr->s‚©Ò«S¯]Cdà»òkn²#c cü5Oé&îW®'úO=P_mêÁ¥´+õ¯å' $šÐy%Ç׬#Cä×ÿ‘Ý•z Ó}­Ó¨Î |M ïZ¤~e-E¹úb|£Ì€·+A¾„Uèµ­Ão6ßlê_¨m+øýþ“$élxßà'æÿñfÿÍ6¼/ñê…kžƒoäÛÄÀÀÀÀàßƯàjñÚ«tJ©ªªFÕ\¿Ï÷ùFp_ÉÄ]>a`````пúo”ÿröïÆxÃÀÀÀÀàÿ2T¢íZªû¤Êxýª‰+EÀF|k1´”¡¥ -e`````h)CKZÊÀÀÀÀÀàÛÉÎKuÞå œqLBü*¬Û ¾z-Å(ÄÍY1+É{¡°5sNÊ?¿Y¢b()ƒ¯‹þVüpªêBrZ¢ÃÂxXÚ›·Éph8=20000øfçRLGá#æ.ŸÒ约¨ÔpÈh``ð-ÓRHÂ-?|5ÜêN<¶½iä²”S¯¼q¨¨Q'Ro rbæ‚ÿpAC¥/ó§õ猤­¾ó¦U#Ô²Ão<õÒ?k@DrüUÞ;)Il-üç“ú¤¦MF’oÿé÷fÅ™µ²÷ŸzöãÝ5¸eÀ°E?Ü<'NG%Ï?ôð>§Î ƒ×wý’Ña¾’½¯ü¿7?ª‚L)Ã×>r÷Ø8ÒtüOþyW½K.¦Þóع‘&ßÅ·þúÜÎuÀš>zÙ£äÆhpîÙïm>àá\ºéõó†Ù=çv¾ðÌ»; sZΆ‡nÃkóÞxê¯ûš<: 9ý_ß?9Tò¿ò‡ök`B†Œ[¾ù»“#ýZñ3?’çÇ@qûÃëfeZ§?~ö¹ö5ëà‰7=xÓ°ZuàÕ§ž8Ð꧀ÍCúí½lÄYðüï^:x²™q1yåCwŒ õú ž~èGu2ggóšÜA¦Ö‚÷Ÿþßy­€À6"÷Öû×e:´Ò=/=ýÿòœ*Á6ìû¿ýnŽ·{ú¿_>ZÜÆ9„çÌX}ߦQ!n×±§ýi>“"Öñ÷Õ¤$±éøÛO¾¸ïD;„Œ™wûwW¤Ùüçw¼ð·g»5Ž$Çèÿö®Ñ2j>ôø/^;yÑÉŠœ8wí=ë‡Y͇žüÑ/ À$F3ß(èåmúKö½+®/rc‚¶;üÊí÷¾tŽË=Í'8çH49ââ2se•KÕ©¦jöØ„˜ÈÂýîæÆ–v!@¢)4&Ú.#ÍÓÚÐ࢔s@bd\\¨„˜ÒÚÐètë€E³#.6Dæàkª¬r3@Üj!ÜïlllséK¦°Øh›ª§µ¡ÁÅ(ç€ä¨„‡€˜¿¥¾ÉåÑË–ÐػĹ¯±²ÒÃàæÈ؈P3Ö}íÍMí®Žhá1QV TwKCƒ›1ÎÉÑ 1!b¾æÚ&·6ÙÂb£lcÞƪj/Ç€™"c#&¤{Ûšš]"˜¬‘±‘fWSC£—3Î6E'ÄØ ¢ÞƺfO@šÙeõ4TÕølŽŠ‰1îimlv{(³="&Ü,p¿³¹±) ˜c¢íéÞúš&ŸÂ8¶8"¢#,ÕÝUµ>„¶DdžÛ%Ð<--/b ‰Œ3 Ü×ÖÔØìÎ9"–¸Äh+Í]_ÓâS,Žð˜3¡š«¡ºÎ°1—200øJð{}ßöJÎÔñ_LKýøöG·½³}îÏþ’~ᕲôCÚŽ¾óòŽ:—¢Ñ K?WÈw¬X!ªëªªJ¢ˆ ,õ¡ŽÅÁÎÄB¡®G»…ô”Öœ±Ž;¤qÎá Këj/K»ü`—4„ „º ë#-†;Ÿìõà5–,0¸4Öù&Æý<Ø+ÑîÒx rûHC††200ø&µTûRºÏ’2ˆ—ï”s”†¢Kõ­> ‘ ãU‡&¹üOÇH‰1lÉtFƒÎÿ na]Ï  ÒPÏ$.!„ø–_DZuŒ OX°X×Rúœz . wš_“ºÕK/)(X½êb```ðÐß¾ÆкóuU¶Ø›ËÕæzís?©ûÛ\ï,ÖU†]]!íÊAA_ÕUF3000ø¶h)@ÀÝe'Ïb‚[ZÂƺÁ·GKŒ–‰ñIm````ð-ÔRß.ºL<¾B­ÙÝŒ!_ØcaàžÖ(ß –¿œ‘^™è÷ƒ;-ÕcÌ 6v_{ýÑC"ïÜïGŒ˜®³¯flå Ψ®QþÅ“A8 ,J ºÎ(ãüQœs„‚Þ‚ûþ@8ÕYwÛƒo'Wº¹£Ó<`(ÝgzÁ;£¿6îý: ¢;GGrLa97ßÿýF…~~9£,dÈÊ_þÏóû_ÿÕoVEƒÎ¿\æ9Ã'þr÷ûo}ýž%Ä~3n9PE½ù±»7Œ¶KÝsÀ¹®Z¦ßûƒ_-O‹‘ e``ðï­¥˜‰×ßýÈoœ›;çÑ¿o„‰õ¼9!:}Ùß_{æ±QàÓyásÆc]ÇsçrXW ¿§3„sFuSÒœÍÿóè“ §¬#p]iºp¶¨¸•Ô%Šw{°CxÀþ§ݳÀ9g*$¯Z=)êì“6ýàá7ë!¸¯ÂÎ4º§Ü=}à€Ô¦}÷Ž\óƾJÉaî<ÍyŸ²÷Èë8ÓÕOf»?ØíÉž…í8p0ED…9d q9ïø¨ÐkÏœ>QéöÓî%êH¬{¡X¯÷g```ð пÓ|*I Ç-Õ¥u8_:q¦"3^‹~˜¦j:ïÆ¢2³³Ç§[ôÖ‹‡ž)mçs$DeŽ5*ÕNrí’ÜY’iÃwæg%›ë1 àÀ™FÃ'_ãƒëF§Ç'O^tÛ£ëD\õx•R]ñ{½~¿Æ‚Í8eæÔa ôóû7M´1U ‰vØä”eë—-Ì ‘˜‘6sýê¬kßUQ„…ˆ‰Ë¿ÿ³Ué¦ð‘soxňväH™xãk—±Ê–˜ã3ÃÙjp@’5#wRJŒÝ›6÷Λ–Mc:ÁœzË£?ýõw'¤Y@‰‰µ)4sîºï<²fpbˆ-.cÔ”, ÀBü„ÜÑ™Éé3—ßzï‚H+઻g.^»iJB¸À±š½~à cìŠFYÌ„ ÷¯’`•b³æ|çÎó3añco}ä¦ëÓ$㾃o×\ aÖ^zîLÅÀxùü‰KŽœÁyûöV*èJûXœSpd/˜–ì-~ùÉWË,£7~ÿ¶ #ÎÖU_¹H¬øðù'vÔú›Mô0®—n}õ‚ÏåE)®ûîÏ2xÁgöüSã†1çÁ_Û¯#cí~Új<2%20‘bÈ2dæô˜ÓzüÝ<÷È÷¯™=5qË«±9ÿ“|P—̆þdÌ€Ôˆ‚Ò*ÖmJ„8h<|ܲɵûž}bKSô”Û]9&íƒKGꊶ¼/dMh;±ïí϶`"~lü0üÅ{v¼÷"]¶"¿6cŒn&AÏ”qlŠ™¼<×vìŸï¼Vè³—ßó»•ÙÃò.¶' ‰õœzzËKgÀ‚Ú¡—)xPݧÞ{ëœâR…°©7ß‘=iˆ}{•Æ‚î»°ý…·J]‚IÒõèÑcÑ ßzñ¯ûØæÀ]`®Êc¿øŽ3mÉ=·eÆ9äzïÒ¡­q3§Çu8ê îšü"ÿ£+‡›¶íŽœ2&²éäùrwü˜ù3ñ‰ÿ÷úîRœRvÇŠE±?Yá5ÜP|k´KâÉÛîñ´ÔWT+¥ÅgÎ9ëÅ_éRy.‡¥$XÜe5õmN©¼¬Ô=:>\Àm éöê7OU4x(¿ ±é³oœoÇš•–&^4™ETÀX§ƒ#DºiÎphZªÿô|½Û­V­Ô¦ÄÇÛ¡…3OñÙz÷;Ý>Ý$›d ÀzÍ¥ä¨äX¡eoYCS»Ó_^YGbBÔ#"`ŒÆD ˜ôr¨ÔcTo,?S\¦Å£+BßIeWÌN{Ž­Ñ“cmñ³×?’‹@t©Õ9k­ºp´døô•7[+/æúAê9]AÀ9,†dÍ]>i¨‰”ÀÎ…š€y8ÓZNî+kÑÖ=nîÈŠŽŠÐ+Þ˯w*„¨ NN¹ Lo½PRÛتØZÜŠd BÁÝ&¾Þ²ý…þë Ï‹WsxwM+Ÿ’š1PXss:ˆlo¯®Œš ¾UZJ§ö‰7.ÌÉêâ²"ÉË6}RMþÉÚJÀÁ¬€  lÁ0¦SŽ !c,`JçT×9ŒCœ6vÅò~ø÷¿þ´Ö4úÁ_]‡;¶rþO»&Á!Ó8B0„8 ÜØÄt†q‡ŒàÛ(œQ „„ÂÌ(ûBõÅTê¬ÓË §ŒíÁDÄ]êsà†ˆ3]WÛ ^zꉃm"ÎUUMgy/?Yydè°ñãgßó«}ÝïÞiÔ»—dIž~ÝÒÄm¿øŸƒüÙ›Z×å]ë._Ç„!N)cˆˆ"ÔÍ„ž3,4û5¬gºçÒÑÏÚÖ,]>LÕ ¶T·xXRê ¾ñØÓg}"Ît]Sû_%ÁWð$¡ùŸ?øÅ»{Îoûëïî<²û¥çþôÓgÔrÝ&*:Ô$‹Ì]W|Ñ5jñÄ”pY²†¥ O1 Öèq¨®xß[ïã:HÅK8´ÕT”Õ«rtê°Qìæ2÷rN¸§ºººŠœš›–›”’/£^™íXÈ%¢@Â8ðYŽÕ IDATAÀ5wõ¾­Íã¾·1I)/©hÖ¨¿æR¹Ë’š=.Åb2…Ä¥¦fĉÀ e``ð-šKPUOð•}`J뮯*kvª”ó‰ÎÃÒæÜýó.Àˆ¹[¶þæç[ßùçà”M7üæ×”Ñö­oä×0ào¾”yÿ†Û~;‘jžò¼í/=¾ûاǦÜuϦ6µk!¡L£ R[ÊŠN™Yû£Áóêóþöø“çSW¬]´`|fúÀ8)æ§ÏÎ:öüsï.ùðµ£›Ö?ð“ ˜¹.í|jO#á]Vá¶Ú}”B¢à:úú»÷_Ë'Së¾ä\sÇ}Я9xâòËÃ>yõŽOÆ\wׯ3jÛL͸YX@íy[òrî]þÀŸ'ÿðÕ^(>üÊ›é?¼ù¡'ç©pwÑ›¿­im ¾êÖ¥#l:Dí“·ÞªP{îK¨yJw´<¼é׿lwùCB0kå]Õ~ùú ½þì¾7>Ž½kÙCOÌö«¾ Û_yþtX…ä‚äè¬ ?½93uhjBæ¿R¼{çûÏ}X®øª?Ùêþù£Þw·Õ5ù1敇?ý()zÕí?úÙ&1_ñ¶×ªŠ*£¯|ôs¿Ô›ßùÝÐÓ0§zÀéCŸ!›#„‰É$ ¸+Èçvy|ªÅf7[dÄ™¦(šFäD”$IÀÀ©¦*ŠXL²€R T×:œ>"™d#®û}~J$Y’„Ns®ûýªF’, L×TEc°(I˜ú ˆH²À´ŽKåû™H’$ ˆSMQ5½cÅK²TÓtÖ¿¦BDEBU¥Û2!M²( F)ç «jàFv@D4I"ALSü~ °$Ë’€3]S$I Î4UQú=GL$“$`”1®«ŠÎ“Id~¿ÚÝ3DI’ÓEU1™Ó4r,H¡ŠB1YL¸S RMSý ˆ˜¬2SU£—…™$#èYK׿×÷ìöW¿ÄýRÀ4¿ŠÒýZ¯yDOEE™×£u»ŽO§€SMñ¹õ®yê¨ú5õòdSÕçU{è„€QÕ{9œªŠOíù)0êq:ê­EñuýéÿÜZQüÞ —ÿ¼'¯ú¹Þ‰ô‰§ø}WõÅ{UÅïótÿÿåJ»œ¶âó^]•ôf```ðU ¨*cìK¬ø]FÓ4¸’›>Î9!D¾nßµ¢(BŒ×l```ðï Œñ¿¤¥Öp‚ ôç*!D)ý|eøÕaøD0000ø÷åŠ#ø•´çŒ1„c !ŒaŽl````ðõ!|®†)26JP|n-$ÖÑVZåaÆ•½_Ÿ·ÈNœ³|íú™£³'¯¿Q¼À K/ƒo‡–BIöqŸ³ÉcO47–ÖhƒqƒÁ×G?+~T%ƒÖ>öÄÚ¬Ì8AÉÉl‘r31…þåÑWšS—Ç:ÃrÁÀÀÀÀà›ÐRXd?ûuíÚ±¥Ÿ ›;YùôýmyÛˆÐKš¦‰¢¸þ!„!Œh×™X„1!ÖŒa‚ïº\!‚1B(ÄAü¡rF»¢aŒ1º,­ãŠyB0Æ}®4Œî”¸É£#Zi [Þ¦ýHãœ1Úñ$à+K Dë(|·RuJ£Œv–=fi¼ë:ÃàÒpW“Ö;Z×EŠ¼#œR°äì-à#Ñø 100ø6i)Æ-iã²ge„Ùpe|Vr9+‰‚»]C˜ Î9ˆ¢Øää¡ öãE‰—¾ôðƒ;ë5Ι¹þ»·¬ž¡–|õ‰Þ©ɉYk~pÿäd±¥àÇÿ°­ºUFRî}lóœx‹ZúÏ'þþÑ®*`4jÉOGáâs<¸Ç©02ôÖn\š껸çŧ^ÿ°2 ¹îûߟ@šŽÿãñ?}ZïÔ‹ƒøïï͈2yÏ¿ñççv|Vˬ™9ËøàŒ Î=sÿƒ<ÀÅá·=´aá°÷ÙOž{úŸ;€ Kú¸ Ü>&j¿öøŸ÷6yt9sóoœ*¹‹_þýs»Ž4röW=òÝÉ‘Švú©7çù1Gç‘õ³3-ÎÓ=ó̇ûZƒ5kʦ‡6ˆ¤•û_~ü¯Úü9ë¿¿’]h?ùì¯_8p²™sÍžvýÃwŽóùN>ùà£Gu2çÜÿýuÓšZO¾ûÔsŸn¶Q3o{pýPµt÷‹O>yØ©rl#~üûûÇZpëÑ'{éhqçž3k̓·d‡xœGßüã|.D¬úášÉÉbó±üõù=ùí2vÁ÷­J·ûÏmþé¿skIŽìŸþþž1&ÔtàÏ?}õäE'g(rê‚îÛ0Üæj:ø×ü¬L‚ÑU ¾‚{Hzô–_ùÃMó/OÔŠkåA‰¨¾`÷ž}¯¿w¼¡—ÃYÎ9 A2ÙCÌ#Ü×ÜìSuª©ª5"*4ÄŠ¹æwµ»½ "ÙB&QÅÝÞî LE„°0‹\ó´;½~ H¬aafƒêlnöì5D»Ãn5]–‹’lµ˜%ŒtÿeiŽðP ALs··ûü ([CCÒššýçERˆÃf‘1S|.—ÇG‹²-Ô!®ûÝN§? M p˜1bª»ÍéSÒL¶0‡ s®¶5·¨)†hµ[$įÓ(–L6GˆL¸îwµ;Æ8 ,9Âf Tq¶¹•–ÌÖÐæLmknVÞÌ¥0›YDÌïqºEÀ²Ùî°K˜k>§Ó©2Îa)4ÂaB@•öV—ª¢Yl»ŒUÚ[ZҰ쵚DÄüî6—?¨Éb1W½N§KåœÂrXDˆŒ€úÛ[\ªÎ€È[¨]B”ú-­*¦_ ~¯ïo[_þIýøñ»ý‘ÞܾìGî{±}ÂܸŠÿ|m«¢S|åG×uι !]×UU•e ã¯gz%Ô7°Ct  a ©*ÂXÅŽE°AÚ—ÎÛììÔWÚUfãk“´Â ¾~-õ9>ÑmV~¡’Ç®.¿PÒæQ)&ýW¡.UÑ- õ%û>xAý ”ž»~ýÒÒ¾tÞþ•B}›¥šÉÀÀà[B¿7ÊchÜö»§tŸž±ôÏSQ_¯–®{ÛÝ!UU~üŒÊ20000øšÁFZÊÀÀÀÀÀàšk©Þw´wü­ª*ç<8¹ˆÜíOÎë:¾ÛñŸît>Û#à‹d_¾7ž1[C¬ô”Â9G‚dsX0ÀÕ\Å‘ Û;¥€Í!6‰ Þù謜¯ÎÅT èØb·‰ýeºNóvÖÛUÊmv‹I¸êg®$Íb1‘k íJ‰²Õj6‘^ #ð_,›-6³€_;Ï_ã~Éj7Ë×Tn÷FßíõaÙl·I}ÍM¯VØ—í}צi]‹ú@‚lûœ.i🭥8ãrbÚÐá㢣.0Æ;,(§z9B¦ð”‰‹sÇ 2Kêøyccm˜3!"mÄôë—-X‘›™hã ‹ž±dñúKÖ-]°zé¢V,[7oâ˜h{òÜUË—¬_±týÊe7.–%|<\MwÀ–ôq9©‘B‡[Ó  ÷ýõ¡Ñ"êÞC8pnN›tß/ÖÇšð5ò¬Crüåõ‘ Ö9'–¤Ûžøå´!ÖË ‰sŽ2eþHæè+íLØ”|ãSÿýã ^oT>}\r”•pÆùUÚÃpªÈñ‡»× ³Š×``¡Š4ù±?Þ¹j°ùkØë´%,ݼù–5ƒöú…é(añ÷þüæÑñèZ¾ÎPHrîÿ¿qIò5_©àXN>jpzŒð/BÂÂüé‡üÅÕgÄ7bî¼E믛»hRF’ýkŠŠKjΘô"»ú¦õ/wIÎ-™SîýùÚJê?•Ï'äΞQ}2ŸN½.âõü¢&èf¦Ì‡¤Ž»í÷·ñ=/þàö§ëB'ßü“ ¯¬ÎoOž±úÁåɬµ9fÏúÌÿ®Æ$&¦šì™£s† y§**ë¡åbCƇîOß·ý¼Ÿ!®¶¢Ó¸s®=ê;ÐùYÈÔ×Ë_å|&š$ aQ’ED5U¡HB0àLw^Ìý™’f•u Õ”ê”2„HÛEÎÕ)gŒƘ3†ˆ(Œjí玼ú´­UïR@Œé”2Ž„‚°(KˆSMQ!‚Hp]£$föÝ?‹øÁö#­ª ˆcdØÐtÚõ™/c„8gŒê”1Ž!Á8Nu]g€PG4àŒQªé\9‘d)ˆtà˜îE‰KîßPü›ßUV6ë¢,8cºN)„‰(ààx‘$p]U5atåM×(çô÷èåZb QPUU5 ‚pÅt-pžp’ÅtBŒ2@‚(v8¬¢T§ƈˆ€s¦ë”1LD¡3š®S&†Q‚ë $ˆ¢„@×4…b"A(P·”q@˜A!Ä¥ºN9ÜQRàD»×çŒêº¦caQ„þ«#7èx}Œé:Œe€…þÞ§ •G,Y9°~û …—Ü‚Y’DYÂL×T…AAˆ_ÎÆD0êÓ“8ãÈ‘{߃³xk«DLK°µ”TœÓ™®3@¦OB.·@Ê8ÂD T¯®SŽgŒq ‚H¸ÂmÖ®±æ½QY\é•L¢HPv@)"pª© K`”ÒŽªì–(åë3€ê A 0¦;/{óoç›U†zwpŒBΩ¦q@œ3@D‰qHý?BKqb²†Çf$‡²ö—as•º%3Ñ•^Ç¢âŠ.X#GÝÖŽ3äÈ^ôö– .`Ø:xÁºAkã¥æÓ;^ûèŒ;jκåã§äFÇHwýù7î†Co¿¸ïB•·‡CΩFÒ7Þ>-Ò¯Ù¢bôâηí¹àg$,süìë¦ ˆ’ÛÎÛ»eϹ:E°F_¼xæø¢¿áä–>;^áæö”ɹóUêËM„² +#$tè¢ïÞ»`TFzÊý »®¤`×Gn­$&¯[>)+Lo)Ý÷Ú‡'.4«,È÷9lÆM¿\èà-'>úhϱJ Q#'ÎY:)1Th:up×J›UÔkàœ˜b2Æ/œ=6+ ùë½÷îžNŽHXƤu?Ykqå¿ûÞ®cÕÌ=aŪ‰Yò–Ø»gG~#uŒZ·f¦P]=|P˜óÐ ¯(jR„ðÁsgÏž™)¶W—5ÚpÕ{l«GòøeóÇ Ãí•ùl;PX« ö¡‹—Í›6ºÚ£,-¥ýÎ'„°ôé·Ý7Íîh-þìƒ×÷6ø zÊu geņ ®ª3ÞÛYXÚÆ5}Þ¹³2CDÞptïΔ¹%jÀ¸å ƶÒÏ^{÷èÅV]Ž9îô ÉÜãÁa\ 2×æˆ#.؇,Z2wú wòɾ}gܦ¸œVe•mqYI–†]O¿r´ÌKy·À™Æ#&Ýñð¢ñ“FÛ½‘᪋?}í¥"àœÊ‰3îÙœ™lªþlÛö­'üÄŸ6qùüìŒpÖta÷ËÿÙ¶ ¢²¦_·jI"4ý¿®RTÆ9Ç–ø KçM›,xêOmݶ7¯L£<²)ÜÝl‹—š‹w½±õt­GÿíWü˜†ã§ßòØÃ+M7oåú;礛»æ–iªõþEà­­©(nÎœ”mÂÀ¸9.c`¸ï™K¥u %çÏž÷e¦Å"Õçu{¼~•êšâõxÜ^EcÀMaq’$' ˆ¶Yîk…ø ó¿ÿ·û2Â$t!æ¼°÷ݽËê.;¼ãí퇎Õ2Œc⤨æÓçš3×ÍžfGª»¡xÿžcM©c‡Ûktºn¿lá¢Áí§ó<ÛêC™IakÔ°Éc-—ÎèÖŽL¡4uü„œ´Pì¬=½oïIgƸ¡Œ€êòàÕçMŽ¬)ºè Ïš¿ajtˆĘ„ø0VY|É2rúÂ…iØÓrvÿžOv”x<ÕÞyëÇEõmjß9EQÙ'Îâ9•w¢\ýü„P‘Øß½&Ö{áØÞ“|À„%kÆ…‹¦KÖÝ<+äܧ;^2ϾsùèôÈÈ!cß²0Þs¡°T7+ŠÓ ‹Ì[WøÉ;jšŠ÷îÙþÎî‚âVd²^yãͳ­Å;>«¶ŒÝxÏœ´SðZ'bxF¼ïÂéK¾˜y·.&K±CVݹÜÞP”·¯Ø4,wñò‘v =׌8Î,)“ÖÝ°pRhéáÃù§Ix¸€8¤È´¥ô\ 0ÿ†ia&Œ%IbmEûöæo4gÑœ©ñÉñ“¦Ï^’^½ãã“êðÕ›ÆÆØ¥˜±³–Ü0ÕTö|sØì»—ÌÝ4âÆÛ§Æ>;x¾5bæ †ÈŽ¡“7Þ2Ñ{æxy»51#¤ß•7Ê-SìÐzº°.fÞMKç 86…HÍgOÜ‘×2jù “ì I#6Ü9];ìÀ®üšVM ˆXcƬ¿qé`þ֧܃×>¼d@˜5iÆâe+²Yå¹ Oèˆña\ï]€9ý¶['x‹*'SÖ/ŸšMD{êì™S¦DÿxÛ9Çì7í»@ò”ܲ«è\MEÁñÝo¼ÿP…À9²åŒ‹s_8W ãVÌÍ&†$N¼iã¬ä¶£[÷œ¥c7n^”h‚ŒÈL×UdŠ ·êmueemûÀ¬·ÍÏ~vð´o̲Y£‡8¤°”©·Þ4=©íø®B:鶻o"ç8|äÄY+ç¤øÎí}I½—;Ïï{w÷…ÒºÒc‡?}kûá£5 ›D rÒÄ铇˜©ŽìS6ÎÉ–|>œ8Í’¹i®¢¼cE®ôE+& 3fÍú™Y–ªû󎔸˜àÈžw÷¦Aå»>=pð¼ÛÏ AHw×íÛ{¢uÐØaVÆ­”%—ÎÔzªà’'zö­«Ç™ØF¬\”ÚVøižš:iÞü4r0ÖÿíçRX µ»>zÓnÕ‡ÿ¤(~~vó¶÷wç—¹°ÐWg€§ábaAâ”QQ‡tà™lV“à÷ª”!D5Åë 1cp:*Õ5µÉ—.œÎ+tc `·¿óÆ6g¢6üÓbãÃÄSåÎê³…i­‹‡w®Ðè5c_KuuùÙºÖ¦6 líMo+;¾sŒØ8áô§û<óv Q«*Ïœ*ÌjŸŸÌ½Ü4`ÊÔäÖ]ûèõ<’ßՑEwõÑí[·t5:2–§¥Xé©êsgšäzEÑÏå/QQ‹™Lך ÚóY{¼%{TnL¨¹^Î\bθ=)Ò,4´5}–Ÿkü ”“2$ź÷<ó¹´{w³®ÿaFxø)GöШ¶ÂŸ{ã¼)O3šëšmäüEéú‡yÍ-mêðô±ãSG -;øÁ?¶6;*“sîèw7 c½ºà³Þß^$׋ƒoš26dkYmÞAi@ŒÝBký“¦dFÉÛ¼&³ÃªÖÔWž©mmjuy¹}àà™3´¿³½Ñ¥À‰³Âê9C’ÀøÁ–ª#¯¼ðVmDIøäl+ 6£%Ö£F:Îì|÷íâ…¨Œû†ŒÊ*Lhl³^ºx*¯ÀIÄ`“Ú\YRT6gü¬¡¦£—&lÕøáÿ”+ñëdG¸Ž­mv"Á‰FŽÏŠßQÐ !ÿ¥ƒ[wìÚQA A‡ qöšÊºŠ¦3-í>0øÛªÎi››Ø+Ðpü„Ùúñ—?~c—3².æG›F Œ,lá´©ª`ßg‡:•ÔI+%ÛPA`c.õï­¥(³Žœ;eôØÑqÑ––¬1ƒbíJT˜ÕWXÞs\GëÍgΡcG¥¸@uJyÇ•€1ƪFƒoË"$žã¿îü¨MãÀT¯Û«Œ‘Vµï½Gw¼#™eò9 ©Ó)R·ñž»Ký”é>Ue‚ ]~“.§'à–[Ž\“{Ó­9Í %{·½÷Ñ —LOQMãyUª(šÎ tì$]N -*ÔL›šÜŠ¦ã6§³ÑøEszÜm^RÅKA…ÀÞ<êÌo,õNÖßâÑ(c:¥\‘¢Ó£’&¬Z5’€^™_è±DD……†OY¼zňë%%U ~i„ºë[5îê¢fH îP xç»CYÀ&{¨I«(sFjcm;³:ì²€@¶8æªiñ댺ÚÜ~a–CR£¤ä®]­0à U,÷é½> Øá°wYM£Æí0eº§®MÕ)ñj”‹"Ææ„ak¾{†ÃïS…„A%2àL÷Ö¶SŒt¯Î“ [CBÌŠ³­Í¥ëOCI;B‡§Ä†ÚÍ38ƨœSoYi½‚­aáíMG¼*W=®–ZWL¿­ùÚ]m>¦soC­i\ˆHBÆl¸sÕ”(î÷¡„é´ŒÁ_Vôþ¶)K6lÌv:+ïúxË!·-*:2\ž»jõt„«;XؤH©6Ñ]×æòèšìj,i·k½ˆˆ6‡½µ¾UÑÓÝín5Ån7KÀ4ÍÛàbTÎ%³@pð7ˆ ÷–-OE³W§ºªi!¢d ‰ŽŽŽŠ\¸zµŽÐò=…->Úó¥>Õüg;ûñ aãÇN_±ôŽtë¯~›÷Õµ©˜NuNA2Ùfõžòe”ÃLè\×¼•­ ëðÙ¥”wôkâ@k®/+¨˜:?79ÕºrDÝŽ‡ËSv¤=$!cÒü¨!:€®´\¨jÄÖ몚šÚ8g´åèî·óïX·ù®Ö–Ö3[ßÛ¶«¸ÅÏQÏÁˆ›VÞÖäTT¦»N·jÐt¯ÏçQp]åH”ECAýh)Î{tlƸq²3/fÒ0»ZE³MBœsÀÝL:^6ÖÛËwžÔ~¸hYÄÌÝÜìR‡DÚ%qÙd ­=áº|ïT¯„gS}C«Âˆ Œ1pŽE“Æ5ŸÆ‚Ís.îÆè½t@ðäXCþ›¿8»31iÈì%knX]|âÌñr¥?5pØ­¤=~çÞvŸ.„XEÄ96ɲCîQ+tZ‚ðÀ­QœÞ¿žB=¶1´¶êúSíßñß…M:æŒ#bK7ÙÓXðøÃ?ÚÑn9Õ9±FNHõrQ¶ˆTdŠ²}ŽM.ê0£\6Lõz©†5M,« z|åAË‹-afÄ—,²ˆ[Ú jkÿîî'.99b Q¶È},˜ßåSÀluX¹9pÆ:j¤kPàˉcæ ÅÇwÛß.xBWüügc.›Ð@×wןO“Ã,fÂÖ84#î¬oqÖŸþÕ_ù¬Ž1αǵK±2A$ÙäÏiEr¨I2Î1¶†«ÞJŸ}ÜÒå y?þÉÛ»Kì3ïùÑwâ¼ÕÛ~û³#IÉ©ãflÜ°pFýùw/´¶4”žyô®§Š‘Y`T2h­OdY$–ÂÌA99Õý>Ÿ#Ò„8gD4™$­Á§hÝZº’I5ïÝì»W9ç\÷µ5U;ø½»^¾$˜0£ É6¥! IDAT‹ˆ»ëµŽ/F™§úâá·Ï–T“ï?2l°ƒ—ðî¸æójØnG´J'aqfÝåQh‡ëÝLÎ8¿ü5ÔgU_·¿À7pñÜ1ãÆŽŸ;gü`‚+cÀi[¥’ž1(#àW{´ƒ{Êv”„L¿é;‹FM·jÝš[çG¹.î>ìš÷Äck'§$ Ÿ²þçß™”Rwñb“5#gR²3vãªP]ëO<â¾Ö6ê<,Öa!€zjœR&þðŽIçݱ4¥íxIU³ÄŒ˜ƒ ¥Ì½nÆøa£ÎÊ kÈ+km9··1cùÍ·Í:$sÊÆ+oÈäz¯ @ÚN\,1͸yãج„„‘“rŽék%8Ó}nIhô¨Ùs%µÂÂZÛ™¢r5sʬ¥3¦.ß0Û¢R,´úä˜<û[gMÌLŸ0sÍÃ7·ª¥ç ͣƦDJáÇÏ ë·~5 Ï1zFΤE7ŽªÌ?Öîlóë’Y¤<|Øœë'¦$Éœƒyà°ÅæÄHÂuUuÖv1lÍS?œ52qÀ¸…·ýúÎa!®ÓÅuRzVZzlDú¤E³¬º¬%P÷ÅâK¶%kf0bÖÜÉJÕÙó-:¹ÚþJU—%¦%&DËÀƒ´6ÄYkù©#uÉþòð´aI©“¯»ýW·²÷™ÝÓ²zÓÊåãde/üîm3GÆ÷µ;AˆDLœuý²²¯Ea3M×tÎ9Õ4M£Œ3MÓ4 jåÁ#m±óM?*{áÜñƒ\E¥ ÆÄéßòóŸÿ¼oè®-ÛÏ9'Ί¿˜W+ԟοXæâ汄L^ d OHK³”ìüìR]ƒ'}BÔùxOáÑS.1qæú2qÞߟùpo¹8ȉé±jÉ‘SUBÄ: mè„yÓæçæ.š=cùÔ°–² ç*}\t$=:ìÄ»û½4¸ÇnD}ÕtÀÌ%koY”Ó˜w°Æ’68“_Ú™WGMQYY EEBÚú'~{÷ª[H´ëW̘‘X¹ïX»cðôë¯_wËâ‘Iþ}ϾtàdëcEˆÍ‘ƒÒÃÊè©9Žšýåbj”«´–ƯúÓoî\>Ò’”»öºÜÉq凎œ=~§N¼nÝähÁïlöœÝ ²]L3¨îÈኚ’'Ö交 ÄÝÕõæìUßÙ°r–¥âtI]SïK›C‘#GG¶ž®ÖL1ƒÒ뫪o:º.uÞŠë6.ÎI7Õ+,ª®/>} ]qï¦E F‡´Ÿ=q¨¨ì|EƒÓ>é–›—ÍŒ¹x¨¶ä°j¨|þ•ß¼yì|+ísc$&{ThSkü¬%ÓÒü;Ÿ~éЙ&ÕÙxöLÛÐ嫯»aþÈ$¨8vôLI íaä‡ ¤¶Tœ¯ÐÆ]ûõÓ§$4äí)*qG匱V;u®B’ÒS¥óŽ]ª¬†Ìùî¼~Lj<ÛÜ\U|ª°É‘54ª&o÷i7‰¼¥\MúYKÿÜWô¯Vê¯9 +´ç/TÝWÕÚ þ“´”AÏ ÆtÿB„9+ w•p„0ÁèZŸÁ¸E¸ÇΣ€B_ãwa—oa@¸ÃÇâŒ2Ž0þ:òµ½"ÿ³Ò£Œq$ˆþåçœg”q(àø)`‹É8 Œp`êðÖ8à0ÉèßV-Ń-•ÿ_ÒP{Ô€$¹òLÂÛÁ˜øšˆº@‚EKRZœ³¼¬½›!I`s)4-Ëæ½T[ïg_Ë"çhMHLŽ˜³ìTI»ÂS!*m@¸»º¬É¯2¸¶£ãNÏ B€‰`ŽIH÷—œm¢ü_,<ç –ÈÄôÄ03k®(«®n§€9,1)Tk®ýÿì½u|UÇÖ>>3ÛŽŸw!N܆┢EJ)5ê¥rëÞBK½½uCJi¡ŠKqwדã¾mæûÇI Fo¯¼ï¯¿û2Ÿü‘O²÷ì™5kfÖ¬YëyŒ&C¤ î‘Á¾!·°Å)’¿òh/´ÿÈÌípÝÍ]'vWבéöíÿÛKÊòoïRuJï>:¯¹ÁÚ+¢öè£ô]£T‰ƒï¸/úþjÿ£I˜hú >$-˜#²ŒýPª²éÂo‡àò·<ùôãr]íAÝÅõ¼mUFékë~ªþ·úNÅ¿ÿþi}PUÁ…Ÿ+jl¼$Q9háí ¾{kw…‘ÿ8=ÑšøƒRݧ÷^ñ’¶”aH…žz÷ĺøÍÝÒôŸýâb'Î[uO?{eåÙ?7×ÛeB`XÆä;†Øüðó®zÈpúøôÑ fOž›¸mÖâ g›„¿ºßrAq}ÇJSJNSÙ©c¹N‰ü‹û9PÚÈÞ™rÅ¥œ:ÜÕæÏŠøá#2RÃ5”¯¡àÊÅóåNtý RêãûÈHTÓ>cÞ¹§ª|pcŸºQþÕ] c&q̸±úê󨉳Ô_É&]ý_²àóa¤`i}NfXˆäóú$Œb Ž£!Á¼Ç Y%CC,ñ¼Ju FÎó>^Ä †S*Y„ Dòù )" "†¬R­d‘|.—L«P± îz‹‘DD’(Hq*%’|"a8‰$øÄ*h n ‘$B1 ¥‚F@æ}> ‘,J2 ËÒ`‰÷6žÙùZ™Z€"y½Ë2†´B¡`i˜×Ëc@шQ(ÿTª;–1‘e¤‹4cD`Õá]›$—÷zÝ'dX…’£!²àr¸O¬yä u5^‚È¢À{H1œZÉ ë~FðùQ&b –¥‘E¯—0 h…RAÓˆˆ‚ ˆ@,I€b•j‰äñ0úhƒùÀÓ/~z̧Ô0ˆð¢Ð´síêã€÷ ×ÂãåeÀÐH&”BÅ!YD™â ²àá1§TÐ`Ñ듲(a@+TJ^Ÿ Ê šã8Ž†Xtó °Ç¤yKjOo>⢴*5K™÷¹K¶ýÒQÊË´úA –¯O1¤NÉÑ$’èã%H°,Äpœ’¡º;ªb0–aßôÚ}ïå(4j¥’!¢ÇYxä›—/0„'4‚„¯?»{õñªþ/ò˜´w¹Š>/ÈÑ µ‚F, ï0€ˆaJ®;­ôÇ@¥’Aó^P,ËQ@–x¯W”@«R²ò0ð>Q&€b ãóä½>Q¢¥’ërŽ'rÁ‰7?óĬ¨šý+TI#'¨ÊŠ¿)\^A"„`Y&íj}^^’0bX®­2Ùëö–&‚(bÄ*XJòIÁ1æ·ž<ž/1•ŠîâöÄ„Kuß4ª¸ÈJõœ?sBßïßù`sè,t¤î5õŽ›ÕÕ$õÎ/–d>}çû;[$ÜyŸ"XòyZ¡`(( >AF\÷¼QþO”ë{« EkãC³I ‡ÕÕfÀP •ûçyBtäÐEk~zel€ `™‡Oܸ`qa£~uCáÉ=—xti%‘ ^ºþ«…cB!DñS^ýáâ0Ø9–‚4!îmãåGkm\wo¯ Bdºß#/¿õ÷ÇîýþçýuÇ7¼1AAMâ°U?oÛ[yfÝƧÆ$k»#q#X’5}ÆÞ³îëGßzñÇÒ“{Î}5#3¸ï“o=ÿÌ”LE ZþÎÚ)‚ u÷›Wûá·—þ¸å™‘ *ŒÔ½zeý<½{ßþ¢__Ü?–DUüØÇÖ¯<ôÓO·‡Ð"ùP¿çÞ{盵k÷íØ»õ™»†¨)™@*ö¦Ÿž=¶ëÄço|óÉ/W‰×CÞhoÑCwÑ…Cëܲiߕ⚊S¿mþâÇm¿•HJÐ0ü¡Õ›®ÝøýÃ"YÒê÷ÿVpbïÙ¯–ÌŒc„ÈDÑcüâ5'¬>¹eçkcBÅî !¥Í÷ËmE'öœùüî¹éœ„i}꼿ÿ°¿áÌΣk§ g$4ò–Ç6~óá÷l.8öóϧ)}’—ñî÷_ÿúÖìSWü|hÿ¥÷†E*$eÔ’÷wíÏß÷éG3bü ¡QƒWnÙ}¼dç‹Ÿ}·yÛýb4¡ãç¯úäé›RLëRV|³öÕ*ˆ‘*xÖÛo¿üÎcÏíÞ³¯hÇkË°&îÖ÷¾ßVxò@ѶËŠRCEÜø×öü¼îÓÉi£îÜ\“»o×â¤J vÇÛoÿäý,¥ØJ¥É…fÞõõÆ•'6o%«O"(hÈŒ5ë?xnó¿üpͼ$=”;ç~,ˆiËß8½ïÕ{²†½ðíÑê½O­ª”}SßÚrùèŽýÏN%BDˆb8ºß‹aéó>ü~wMöîcïNïÈ@YF—=ùååãJ}ñáŠDU×Q „Г—}þÁ¼P5’´ÉËÖ¼vÏ¢^ŒH4‰#ÜúÛºsû.¬[ÖßÀ@u¯¹÷pêðÞ‚kžÊÊ„`M‘«¶lÝ]yú׃Ÿ,ÑÍ(C¨LïÞûš _mÞøÆ+Ÿ|_ær¤»Ÿ}ãûÖnÛ´«pÏ;/L ¢EBˆ.eüÓÛ¶ï­:úõ7ˆQ¦z¼úãOÏ~àûwVŸøríÜÑ3–ufÃK«ÆN~êí=Õ—~ø|\‹:Âj@àó>_ùìGo}½nõÛ?žqÅ舺¶Û*ÎùÈKï®þjÃêÕ«jÍÀtñŒ†¿¸í“)ýâ2—?·æýÛXI¾qã,Õ¡ÈŠ›þÔ» ¤Gò¦ÞBXGßÝW¯þb¥9˲~ ÞÞ\^M²&LŠùýë*ÝäE}©‚å|ÒÜûgŽÖxùÙ E¿¹KîSô̾+”Ê`9 @+4:½êBÙYuvýªÍ&ªÏ£k^Uø·WÎؼ€ ŠèÑ7¦âýµ÷½î ôItøœ'î¤N}õÌ[Í=&Í™|ß´š§7V‹ˆêꎠ9CÏÌÛ±Õ3¿öªC$£/\­ÕÒ ˆ•N¯`(€¨ÀÔh¼uÃÚ·¾êw׊I³{e¿“Okõ=Æk6,¼{{Æ‚‡oÕ§ òHNíÙ¯¿»xö3+ƒ©Öœ Èh Á±æ­/?ý}ȘÛNN:”›çH\ðÐMåß¿þ}]ø­OÌÑy•èϲ´raY–ý1 ²$š¢Pöˆ£Îoý|ËÞáKfLš‘zùã+î¼õ÷Nß=üùÏÒT~¤wÂÆgŽš7ùà¡ÍUÚ„HºÃÀ&°†›~h„êò~fa2àT†Ô÷,ˆ¸ðúì5Ú+—=>Óø·õ4”îÜüîûk6ŒyuõÒ¥{^þ¬ú›O>w`â¢Å×}°ù²Gtóiúõ¥ÛO­yz,Ç2@©ÃFÝ¿|Œû×'–äe<øìØx=MAJ¡Ò´ €µA§ePª½Ò(×ÆwžÜh¤‚XC)Nly}]©WŸ:kéMÓ§T}ùãÉ÷V”m›øУsWßóY–\.LK[_0¯èî‡Çq~~YTì‘tþØ»wåŸ=c匢Uë}Œ"jxò±ÇŸ~¦!bÞYãÆ^¨ØR˜ ib<¼åÝ+ç®r®‘sô<(=%ú`Žñ* ogð½ö›£Ûm©u¤;EÇ0j&(®§Ž9kó yù—v(0ò¸¥N†±‹FŽhq "âc£ãƒ{o¬¨TwË‚d«<º÷hy C3æQh;úVä–ú¢ y•56m±spŸH-Ê#»Ní;Sjä¥ ÇÜÁZšØD¯ÓnwKRig‘[r.”TµXâ[ÜÁ:«'—|u ;צ ;;|û§-@; ÜAèGÃͥ矾pETô;)"\ /;DŸÝjwû®Ð°(ȘIJMI°–ž¬0ú£î:Zñ0º°>}¸cïî>u¶A¢(Ò¥öï£+ø~ËéÜfÚuxú77'Fí6R€¯«¨È¾TWC]8å“ÇQÕ.—Ëép ¼à³ÛìV¥!„wÙN^jåA Œ!®_urõöK9®ú½yÓâe®_ûÖS¼×X˜{äØ™ DÍȈo±³Ãož¬ÖÄĆ[b£T¸Èns8]¼,ú« 2DŸÛápò­'q‚%UʾLé{G._¨Rò±ÃžÚ3¾@ XráBnuµÝ[gDQÁ¨ä;Û >·Õîñ ¢Ûi3Û9ˆˆàrØ]¼€¯‹÷24môð8enÂè¹ÑD¡5ôê×+â» Þ‡imL¯´ØúËt梁ÆHíÁXâ%UdBFßÊÒâ Ù5žŽÌ”‘œ€„¡c‚$ulTXPzåöbÑ'èSS{6æÔÚ»ÍÛvÖåüòÅî)Y£æñà¨ýÒâ™ÀÀÞQÉŠ0wsKÙƳ´÷„C°×V{ùBCÖ¸~£š¦§Ôí{¹ÊC5*Ê×ìö X^Ó§Ñ(PÇ·®‡E©ŽJŸvßÂÞrÙå"“Ô⃠¿g›È‚×Øì cÌê#9ÁÚÔ`²¹±Ã~¼ä@}‘ ^Ïm-;m6«ûa6:펰øUDÞ'd CÊÉ…}‡ –dŠ¦ÚR=:Í="¸<’Œ,c‚(Š¢Ô¡Pp¹½2‘y—Å‹C¯.G×Òÿ© '¹½>1y i–‚tŠú†P6–ß°…ÜoÀ- '-´íZýöÑr±Ë¥4¤X¥ŠñÙíndŠUªYl2z¢Ýê&Jµ‚¡ ½>Á#ˆ$ŸŒX6ôù6ê•6Hßò j-–˜x°Ëì–ø.Qí€x±×íj1yei"c*0mÄâ{&{Š®4˜­NF4ƒ®~«u}k]ã:öžÎ a„J‡c"ºœ>Â蕈":=‚„!’ )Š¡ºc¿öxí ¤Ë(ÐyÃbT:p×VµØÜ‚—~|óXA£Ïí8±{=;jDÊØÅ&™s7¼÷}‰¹û ¸NÒ ^kñŽ~`Ç$O˜:ò¶[.þöÙ*­šñXš[š,n`ËÙWm¹\ÀR¼õÛ#xX˜Éý³ÆænY¿åpu'p  æíå¶~~þXtBlòÔ•Ë™“wñK‰àöJ¢ ‘%HS¥ T¼œn IDATB¯Ë)`Œy§S¢#µ @ì à«®r دªäÚžÔ*©î•— ¸Øñ³nZ¾ç§“f†ôÕˆCH+Ž.RD¿pVľÕ«àq§ál ä--&Ÿ&*FÝ`t òÝMÜ(ÿ7w)Å–òJߨ,cÎQkD?mYIanU7Ô}@Â[ª‹óJ§Lxbqdîoçêx‰w™mRßà š±+ ![ Ë¢ !†¥¡4Áj†¶t{9cˆIë“(}àãÍùbGfÎíMà5gõÕuɦ£%.o÷Öý¹6J¡æ”ÌC„®“÷‡ÛL,ðªY£QéÙ¦?8Ût>‹ø]rØ-cBH7 B¢¹RVõ 40”¤ ŽÒQø*5’LµF“÷_‹oìcèo–e™@„ˆ·)çè–âóA ½§¼þú´¬ïO~Z/v %ñ9í>uDTˆ*Ï!Ð ñ9-*=9ˆ>ïb#£ Ðawñ²´‚HÿÑ9´“–ec"¹mVžKJÐà KHl §´‚EAƈ¡YšP\PŒâv½z„lHÊ€(!ÿÍ÷¿¨Àq‹“z§^ýˆ,!š¦ Æ2n%r2Æ„"ËSxšÌ^UH¸ž¡ª5ò¶8eÿÁxþA¿ü½ÂËþ¨ DàeZ¡¤!ÁÙÒdqØNoßt̆hN¥edŸˆh{é‘5çtÑÇÍ{hæÀ^¿”st _ )UÁ´B©1p2Èž†ÜÝkC¢†¿øám³“Ë.5ÛìfgÞÑ6•X£TÒËᦜÝ_éÂãÇܽbØÄ”ßW{;·"šUkYÑÕR‘]_% _2+5XMu™o8ìXª¦«EMX0'8Lž6£CêˆÍ À˜a(@0u´’Zñ–ÖÜüùæ#¿ì;Tê•$€@”’¨p545ºdBRF 7kÉÓþMÛN™ý̈QÅ„q¼¥¡ÎéŸ1aFö¨?º×5jDR^}^ƒÞHÉý¿¼Kuµî¬ïòGûÌžSÿ[659Àž{pﶳÒ5‡Bescååò{îYpiù«0ÄzùDñè#§/Å5lêÐxÛ–Ošª|c†â2fŽLÔ¶P!Ð ŒˆN«Í£JÜ@DèÔ¹ î,‚AD³ÇÐÈ?C-§N—Ü:ù»tGJH`¤nþýëÝ ¸Sã €B §P0BhZ44 }†Œi2…É詯€AŠS(ŠBÒ4§` "šá,BˆáCÑœ:0:%.¦OBphx¯Áý vsunÍrf(ˆ¢YNÁ Jn$EÏ° !^kÉÅå^ …..3Yë®Ë¿Ò(#Òú§£²ì"A=’“Ô¦Üü÷ zÝ¢H‡k"Äüõ›úÑf!!äð‰ÏÊzœ«×Ë’(ʲŒÁ5¯þˆ6"Š‚D”pÛó„ ·™Z¨õƒÈí2Ò©ë¤òa@®¾HÚÀŽm¸Z[ûOt·ìo`û•€«>7 Dn{Æ_-åg„€"€ü(–}`4€~¦(ä‡ÇìX €¡ Èrë¦tµ_l¶>ÖÖÙkÕbÐ MOÚž׺® ^_¶­þ›ÎCÓ*òSÙuì"ÌöCpõ»W‡ž‚4KY„´¶œüƒ1í0.ðš ®5n—NíØ…N;úéëÊÄß<ºÀÛ/ÂT—þ¢¶Qè$s¿lñ?ÒÉ«JÞ¾§íûEu'aª£jÁVÕí^ç¯6ìBµ 4îXD€HN®uî¾_Dêf\ÀÕ~Qö“èªj‘voImMò¿r½ÎÞ(×;Håò®"0Nó×?Qý)LtÄ0± q»ÿØ_ÿGÿ‘¥þÝ?);òç^!ÿbã¯ý‹ü£?þ™w;>/‹ÿ'ÿä»ÿì“äßhé°j‰ÿñ1ý3Šô/Ëü{ÚKþs£@þ iüËŠDþù)óïwê?8|7J‡¢¸fxýWÜKµW‡iqœÀó’$ÿË]$7°‡o”åF¹Qþ׋€Wéñßµ«wˆñÛ @sVÖsÏ?÷Ñ«ï>xœS( „’(B„(ôG¤×Ë„Š¢2–xB Ñ4Ͳÿ6ΚŸj Ñ]@$YBR}ÃÎúÿ¸ K"†MA?m@ÃþÛpå„H~<Šbú¿æêK’(J šc©¿¾‹`I”ÅÐÔ EÿÿA±ÈüË®Æïþ»–Ä»@tTTÆÐa¡Q¿”M1j@–xŠ¢D¢ì¦÷ ËcŠa ÏdÌ3rT2֜۲«ÀŠÿÕŠH bü„^Š†Ëg m¾ö%¢×G(±ÌÕË3HdI"ˆþ×W4"˘@Ê|Ü6Ke™ ôŸgåøO¯&Ë2@…àÿ¬†bìO »ª V¥.½ÀgÞ193Vk¯*8´õˆIì°CB0–1 ¨?a¹@@2lä¼IjkÉ•C;NZ$ô¯‹Rè? ý¡øþyP|\ìa7Mɤù–së¶}ò_Ùï@cï7ºŸ¦àÀ±ñ"Ë2€QèºY „Yö#†ADQ‚°Û' ‘þÌc­JE …nDV`D¤ðóÿtåôç倀c&OÞ+%}Ò’‰QŒ,ÀÖ_ZC%!€‚1Á»ì>)pè̉”Œ‰Ÿ2þ_ù!K0|ôÍYY½€`|õ‹8fé¢ñC{p’ˆý-ÁX {÷Kó#9p[óÚþuµµþäwÿO§oAÄ$ŒŸyëì …Ÿm@ÕoΊ©}µPÂí_iWmëë­ @]ÿØúÝNrhmÁ`ÿó×ZKpG9ûkk³?w«Ãß±LTÑÃæÍœˆÛ7 óÏŸ«­s3Zå«“ݲlr¤–&W£Õiã'KË‚Çêðщ3îšεo„V›8ë¾¹7G3‡¦ÃG ñw™°è²8EEò´Û'³WkëôÖµ%íåvuLÕ!ÃçÍ™82Š’pçÇÚiB·µB:ý±Ý c©ÂÝ2wÞNIavz½µ’ÖN,zÍFåø{ç÷‰T¢öãÒ±m]†¾ûíúX7#ØUD ƒ¾µ)C—Ú`"Ì™5&…•¥nÛví/e~Û‚±CÚ¦d—ÖX]ø€y‹ï{õo¿ñزEƒB”tž‰‘aàÂe÷¾üԪי?wp¸_Ùº,Ë2ÚwÚ¼±¢a»ÅÜ}OÛµùgG‡ÅÍ/ òG/þU~þ[ ýfŸ(Óñý3Ó•¥1ahtù@kôA¬h±zdÄé *âs¹Ü"`8mŠ¼60&¢¥±¡ìè!SŒKž!ÿ‘K–q{t?Ù_—s–$™PÚЈhñZ­6‡—°†ð©#fNf/Hf“`ö8MfQ¤é5jÚ⸪»ÃÜlóÊ´:@¯©”Ðg759DBH‡D÷öáJi†Ot¶„ogJ&Ž™0´§±æ0P·Ý%?8« ä$»ÕîðJ~<Jª£(ànjrK@ ­ÐjU4o³¸1@Rì)N¥P±ÜÖ&³W‚\P È)9Jr™­·@ Xµ!Ô  ÏnµÙ<2!".(Tí¢"P¥€¼Õâ‘CrÆÐÉYÓÔ$×ðöf“E誷„ŠÓ„8{m6»Ý#¥ ÑÊY â ×b²:x¤Ôéâsº ì+ïﶌRG”Üpz«  Uú `ŨYˆe™È¼åÒ¶•%ìбI'«‡ eXïY÷Ýäxí D”Ê g€ 5K¼–«6è9—Õ.ÈH¥×±Äë°™.nÝ^[Î ÈL¹†(„¥Pëƒ *ò«Åâ’ „Ñj5x·ÙâðŠm}'ºø~£'d”}wT€BŒ:8H¯a¡,8&‡W¢Ô:­Š¥(ŠS0¢Ój6»d!d4!A:5#y6“ƒ—0!€Ò2>i5–xv§¤ ïÑsäĉ½ /‚½¹Ù%É„ÖèµR¯e°ÛflñpA”ÛêôJˆÓê5ÐavóÎn¾ì¹¢DÚñ…!FhÐrDpYš,>™9^¨e\v«Ù)veŽ"€Èh AAŸÝj·¹%ȪôJ Aµ–•Ý¦F‹O&Uê µš2ï2[n‘JÌAB+XÀ»¬&;/ «  RQûõ "‹2àt¡qjä15ZxL@ A ¦1ï4[np†ˆ)C¦NR]Zš}f¯ÓÔâÆ]x…•ái}"¡©±Ž„Ž|ðùXê¡w6U󸋞2½DÉÕÕMläÀù‹#Xç'?aÔ1×BF¥Jè9 ++¼ÜSeE‚»Åhô…Z W)("úf«Û+§Ôk™Ð Š–¼³ÅåëÔ:B¤ê€`y‡*h§ÙäAÚàC‚1=–f›O&7Nm]Š` íÑ;½_jk¬ î¦ 51Qúa³ŸXþø û[Ti‹ž›ã;±qæ<:aàìWŸHn8«Jíg€–]o¼òóaï_KB£ ŠŒÔkÐÕxrÑÖÜÔl祮BD7ðÖ§F%$èkÿñ½Õ¿XÂÇ?öþÂô„H”Òs¤¢Cß½÷Yèe+gNbаËß]-|þÆyÞÔÛÞ|lˆ»Ô¬ Ë6>ûαR7&±šˆž±*wcy‰EneÁ%X"¡ƒ³™š_Wc„üx”:hèàè‚û+Ý1sž™K6¿ûåY'K`Ïy/>úX²åÛw?úb¹  ã_úp6;»bÖÆ<€•áC—Þ9:ðÄÚç÷z¶ýnAh]âø[—®ÌŠV#_sÑÏ«^Ø_Iõ~ø¥ÛâÜvhˆ §K~ùîÓoN8e.yÊâeËG‡kAÓù?~üÓÅjÅj{¿öõ`ÓyvtJ¼ªlÓgÇZ’çÜ?=)2÷|4s‰½à×7?ùºLè J U=g.»ýöá¡*\jÏoÍiðÑœ¡ßß>(þxY529FQôý[_í4§Ý²xÉ‚œµªÐѼöÅW²=€L”I™ýz‡”þþ‹Å#C.pð²—ÌÊ€¶©Œ§ˆb¦ qš˜±Ó8·=tÄ,3¥œøÌ3CØz‹.5-L*ùö­OòV=>`óä[õcV<Áïùû{Ç%†aXº½a•ÁéSo™sÛØX=4ç]·æ›œF^•0fÉßöO ÄÖú³ŸòýÁ2¹õìB%ŽKמÀ]Æ«‚XGé¾O¿Ù{¾™hc&=þàôÑ,Ë·~»nýïMNŸ0aáK‡÷ iZ¿ò©9N:ñ¾¥S&&+sî¶Mß~õ»-tÜ#ï-HOˆ‚=ƒÒÆO*>¼î·Oó=„ÄQ›ûóëùD–eÌ$Ìxùæ íϵ|ç¬/ø’M/¼ƒ%P£á¥©“µ?Ø:£"2a}o^ùÜÜÔ˜pfxhâwÝ¡5«ßº¤Èœ´dùäÌDìnÌÞüæŸÏ9 ì5摆:-rprŠÞ–¿çÃ~9ç¡ÛÅÀØkæ¢;–2¸ª.Ö'ô=öÀvøüû–1 VgÐzϾ´ìíK5ž±a] ‹Tôø{×Ü‘™àiN “–bÅîÀ2”ÿÜC³,M#?ì™22>ÑüësÖ43QÖ!ÿ‰+Y*(þ¦žºy€cÿÝÝ´û‹¿¹¿ÚÚõa¤ŽRíýo¥Ì»WÝÜ'õÈÁ+?ÝÓ‰û?~’;¾þ»oO¸8R¶¿úè¦õý¶;ù¥¬‡rœˆå¸€ Z¢p|þÉÏní¹ÉE÷üÚä•ái ?x65ÿ«GVlsq¬ßD—¸#§&¹s6Vš}­k{ OÑ7ýz¹Òâ 0º˜Ìô`.—ŽGõÕîˆ4}Þ¹¢È˜°À0½E«U ).R×xø›š;GöQ4‚@¥Ï‚£T|Q‰‹øo‹à5c1²çÐÙcá‘wîû O›žÈC@ bJmý†û_¨ˆŸõÔCzü–](¤Ì_9±ì£çÖæ(g?}ϼÛÊŠ^=âãÅé"Ó3/,ydm"›êÞsúŽ—‰¿¼·îH%Í(8®·$  ï}Û]#s×>»»4pþ³Ëç.(/}ë„¥ÒGƦ|²ôÁ·ê”!$`ðÌi3.¿÷ôŽúôÇ7=Íþ[C$6md¿XEÝ/gË$¦Œ\4'f×Sç°c[3ýî, ä‚“nš~ù£—맀ȆÇGƒÚ]Ï?üN-èÀ–eü,õÃи(y"Ó‘cfÜ23µè“¿­¹ÂŽ~ð©E÷•W<·/îÖeIžý¯ÏÙaRFDÑÖ6`[‰è£­øìb³)¥>iæüñÜžåc7ù2“·L„¬&Š-|í£õçÕ ?zóæ¬mE?xÇ­º/¢êë—ž¹»àþÅwO»tñó H†M {ú‰UµŠ •ä48tº×ü¿Ý=èÂó÷¯s°¥’ N’R³ú¹{*Ž ²y ÅùÉÏD4ÃÒÝÁü@.$qâÊ¥Õß<úð9UÖ³o¿´´hÁÛ•é“ÇÐyõÑ]—ÅȘP@mwa˜ DBˆÔ½ÇÜ5zwÁ]ÙVu\焈 ÒÀÚ¢µÓ_xcÏ÷ :œwÐëk>¿á£Å•$qŠ§ºté—SP¤v]Ü»öÍËŸºsYÖ•Kì™ï¹Yxù–å9Þ€AÐ%H  cܦoî}0ö•M+ïøû½§¢.»©—gË£”Œ[ùøÒÑòwœûéÁ‰Çîþðiõé ß~}Ì¥Ð(•4$„àVX`è¿Ù%Xòó­0 q´é|µwÞ¢ `IÀ€È@¨öêFwÛ¡æغG¦Ÿ™õÄý1ß~²é" CsžšÃ_³®´A3xÎÊ»oÍ8WpªÔ R÷¦Úòöû/¾aeôZ¶KÖ;¡‚ûŒœ~[¿ºoŸ5;â¡ŸßâN#IJ¦]<½ã¢Šs÷]Ók›­Þ[Ô_e—‚ãÎÿúÕÍËnK:½µ2s~zцÎTII W¶‚‚Žh§Öʃ;ö7øÈ77K2ùÇtJ”ؘ¿á±%®UD0€¡î`l€9ûÈéìü–+*iЫ!r¨T*†¡…R¥Uˈ†€0 •ZÍ"H+55–ý˜¡bc]ùñ³N :6luÎgØÑä“ysåî7>8n+õùw\@ˆ„ÇM¨«Þw¶Ä-ˆ „ÈLÏ… ùKo—ÔóyL5.UrJÚ¨ ûî zýŽmq=pá†+ú™aa©™=³¦Å•þ²Û¥µ\¸”g¬œ”–”¢{Ûæ]¿TiĆK…ØŽÚ-{«7nú- šKGŽ]nÄ€ÈÆóçªm^OsK‹=Ó VpýÃí—·ž.m2ѧV'ɈS*$±ñø·Ç ]€‚M BV¥Q² UJµF}àZÙ7Ðxþ̹Š&[ý™õóú÷ŠQ-%ÈÞê#ëÏ”zím4êGÆD+k/;ÛHZ6m»÷.¶µ:.")33Ü•ý}~†Ðc(zjPúu@ÀD žé:öìaÇÐ~ˆ_䪽t~ÿÉ"'áPu5 þdz³†Ôôžé=‚?~« ‰¶÷Rïs74i& Ÿ¾X8sìÔ¥+-2AÌ㨹ËÍÇË5Hˆ,¸›L(iì‚{|Ù'ŽŸ-uJ2‚tä””Ö‹¾ð²Ëö¸Ð ¨3ôµ_úìLmC³eÿÙ›†Œè€*]P¬”·yÇ‘ yš¼@¥F¥TÐét 1þlY€EkþÁ_¯Ä40Öµ`Yÿ'E &<}Dÿpƒ~úcŸÌÄ ÄÞ+âãK³ >÷Ÿêä…Ã:0.ëþ»†Æ(Üe7~õ{­Emf#ˆ›|ç|ݱ³çNæ7;‰&ÊSÍÑc&@\Ǫðã1ZkZؾSïX¶T§1DF(› z}²¥¥ø|¾Ëàr¾3k`F08dn1ÒYÓVÌs§M¿'N)’#} IDAT­ Ž‰µJÜQ¨îèνçjm¤MnÐö“PlX\ Kîúí›=†u[Œ¯ÆB¿õL3Úž·,œ9‚=ðÊ–z;F7Øÿ"»”Wˆxl÷¾)ÑZzÊ\Y¥§,zlZõjv›Ý#BûLsìóù<^ýû îàëéþ(%³‘}=÷ÒÔA\ÛYŠiÜññû練à®?É'C!DàŸDðÇ2""ÙKÃ1(¹ÍùûEùÁd6ê¦))Î Û‹Ë̶‘¼EÜ|[–gç‚—L€ì³5Ô #†‹«µ‡'LΈSÕ9s)~æ‚ éAQ‚Ù=n8/œ4;k YãÆ16wxJbŒZöUø(D·o·M0b.Ýÿî›Í£† »ðµÇîÛ¾òöïNHYÀmFB"N$Q&!„E#†c 2ßlõð  ¾žcõZð„b•Ø_DXÅ°~a,óFF€(šaY’DŒD»ü† Ûg`"S`O¢hˆ(…RxB„DrŠ×5M†º¤aCbò·~Þ ¯±a/:Ý„B¶øIò‡Zb Ruæà–w5c"9mÍ<·½ónýàAãF,}}öÔ¿ñÅ^Æ‚¶ÿ’¹†¼wÎ4:x@ ]å¿|¸ªvÈ°qÃïûúî韬Z½¡ˆ€%Lp¶;„U±@D€‚²(¤ä!" -RÛ!†\Wâ²hwI~¤õëŽK[dl[?)…Bl)ÝþÎßÏ:iÂïÖˆ¶:WÜóÕóµÇ¼ô‰·ç¯}äÍœf‚ÝÖÂ{mzJ´V[=2€/;òÜíÖaã¿ûùÙÓö}ööº™Œe¾mª@J–õÃî¹gn?||ú\[ÄØ¥ hšL°„KR*Žx ÷?µ¸eØøÁ£xùÖ);>^ûc1&XÂ’WB1!šc)"ˆØ?SdQdYº»YI­ÙGö5*)ÙQQë’@„` ì1~îÝ7“7ú&ߊÛdÑ%Äs½—=¼x¸gÿß¾\çi«¿Jwù"$D‚§üíÑI•{6|S Òo¹c…”lN‘—BíðÛMI„h–%²——EAÑæq­ÿ J3ó樊õï.òÀ‘„]Š¥-Ûž}É÷ðó=êvTÇŒJqåïÝz¨¬Aby‰Ök)‚5ú`¥´[V:¡.H‚ŽD „tV*ˆDKÕÁÏÞÌÛÜÆק±¢É…¯ÛeÿÁC?Ñ;ÆQ$S,ËŒ1€!€ JW.Qõ¢õÔµ8eÅi"Rc•žÆŠ‹ŒPß³oŸ€æs?ç6»!   MŸ•KƒŽ|¾ÚG€D´›lsF7ý¶Ë˜µd×ü{³±²ÐÈMÉèeÊ>QCg-ì]ñåÏ6ÙxÙ¾0½þ‹GuCÓS so¥"  ˆœA5–ÔÖ9eB°Ç˜³kK嬟61z㉪®AÔ‚©‚×Þ¢,ñ°!±!Ðq¹Å ×L0&*9 Ë2h=’BZ­N‰„¦úª²Ï\M ••‚*4&ÛJÍÕk“|6“ TÕ8ƒSáb A\@¯ÉŽÜ-Ùõ˜F`ÉÝTN‚ÕH£AEmn9Ñ'Ñ*ŽCÀID¦¢ Lдì¸Ø€®iAgĉ0«d(€XU`¤UB!X}„Uqgs³…ôPÓž¦ê‰Qi´$@SBí¹ÃUÙgŠ­\œ™¤¡ÏúD7cFÏÆ}oå4{¥Ö AoÃÙ?ž9zÉ÷ѳã ¿”uµÎ‰£ºÑ«Žbóìú˜(pÔÙdÔÊ[ßEà²Ìp ¤¯½SÏ XôðQ³„0º½B)´õÖëÆœZË"&>sÑ;:ÆàÙ’Ý‚X•ÖÀùBqÈÝPxäû‚‹çK—<½0%Y›ÛìyGåÙSUWc.A âëó~——}¹ñ‘z'$ês ;ËsA ‰æË;ºäŠ7páz ­Õ$EjNZu±ql¯¶`†…Þš+û¾ÉÉÎ3=~O||¼¶¤–t’ÏÒh–Ó¢# ZÎ¥ ‹Ð¶œwøQê1,K!ˆeŒ) ‚]Ù§ Z•hM⸠¥ŸüòãœzRbÒ€?Y“4iÁâq̉uNåZBPƸ车²êj?Ì ˜  šÈX@VF¤$(«w;}<êŸÌk®F°w´¢ük’"zPo¦¹¸¦Ö)É¢ÃÔ"jbµu†ÔAÁÄG–)}ò„ÛÆHvl>P/x#gì/´K!È×6C'ÿ|‹.Ì\‘{1çJ¥PŠÂâÚ;g.¼‹Ô3ÉI1Z…üΚe¥V%µpÊÊ•ðlî‰ÝG+½íM&\uyëaWËv1 ÆŸ Í°~k ¶âbËì17/ÒDåœ?v¤FB€/æ4M™ñði%y'^¶`YfGÏ_®uFN(ØürSpÁI³^y$±xãsîv³ „TúÈaRIv^¡YjM‹‚LÌàeY®íËÎÚ%¿šc›Éb”º0)ÿ½‹s¬æßÇ#XJ …‹ ~(±ö© ¦›­N쩵 ïq”*õJª°§ÒŒ¤ä¢æ|þfݪ÷?<ë=ðÖ™ô;Ö&éKÏŸ1J †e BÅ° ‚€o¹t¢púÄ•÷¦Yؘx9ï§sÍ2 D,Ƕãã…±¶Þ1kî¼ÛâÊrwø‚©[•Ü@§ @•)ã{‡ZNo,ñø%D2—œÌw/Ÿ|çmMRä´À–r? •ÌÛJòÎ\õP¯¼ã{w\i& ý‡¥¥Gªš½íÀØ Å°ô5ç ñëÊmÁ“–.HhQõM tÕ!@’×RZb»å–ÇÈÌ;¶k[~Ñ‘cWÒnúÔã½*ì¬Ae<¿ï·_r³æe%s"‚S yG=2š˜)“c.ýúS­ÙÛJŨc²æÎ襰ØqD&(8XãðJzŠ¦YšB@ˆ–Æ4#UÚ^xÛŒ¥+zY4ñ1ÖsÛK„‚Ò ×.CH$¯½¶ˆ$ŒYø(ÓT~òÀþ §ˆÅ0ÌÕˆòVž.=nö<¶B; %P[ä×.×ûÝzëíw2}.ž:pº &ÿÀ¾Ê%÷<ñР /mÐÒ[ßþÅš28+«vဨ@{Ñï5Ò-‰ÛÉ¡2¡ïœÙÃi·‰L&%Õ5n@#šm½>ˆa9š–Ì¥¹õ©ý†M»3€îÕ7†¾„ @FšÔ±·, oHŒ6žú¹Ø…t½Ο98llªP“S[ïE³LkJ=bYŽfõüîÓ½ï¶àÉH;‹ò6æÖa¡`/+1÷3y‘&²ðʹcGk$ÆívdH¼è™Û’߈w £\µ'wþxÁ!^Û¦ü7ÂPÕkùë+z4·Ž›5’o.>`k¶ƒ B‡ÎøäÃØ]ϼµú˜Õmë57ÕoÊš¹P™ÒRüûþ#MùWZÆ ?C‘LÅ L§ üv¢X–¾†ýë¿*ã"fþQЦÇÞyï´] .fW÷ðÔáeBl8‘+!åð™wÜ4ºGÃï½n¾+;ªNì>ßdo`³ÿ/꥗^ª®¯/^·n’(VP>`@Öôé¿ÿ¶¿(·JË9ËóêœÖ†ÊÂÒ«H­Æ3 Q»ëÊ Îæä–6›¼Þn®Ë/4¹„c,Ë2ļ©Á*ªu´»¦¸Òê”@Gâ>@Hm/iÇÞ »c•e•U&ŸH$­±¬´Å. "4×5zB§çk]Y™C€cMW SA[MYƒ›‹è5(ŸÚ_!ªìçwüúÓ%«Ðú,ºò Ë+lP?óÞ¬šÝ[Î9Z/Ühmú­óo–~°¡mœ¹‚èkiª)¼˜w¹Ì*8ò÷œ¨´Š^›×U_xé\¾ÑÔÜT^–—[ËK¢×l)˹TR\c±‹ÏæÕZ…Vr=â«Ë¾TUçÄNcP3ÄUºë§=¿×ò,ØÊJªê좌E—©¶´ÒêpÖ—ÖµNA÷>Ræ_«ˆè3äÕ ×¸~dÅh•zƒ†ñË*jÜþ Ék«¾RT]çÄÁY[Z´zN¶æîßôx¥@æ=æ‚+¥ ¢?D°¶4V·•†r5–{Sâ¼ûöæÝ¿"¾ñÐîC¥^©5˜_vÛjë\†ð`ÆÛ˜2§àJau½‹ ûõU6MH'Ô˜µýÆOT¼í×ÜZ¾ýQJâ=Í¥å -¼?DŸxn]hqÔžÊ-Î/®©s`e¯£¡Î© 20|}Y±ÑÖT_WÑ(0zš*óÎç5Y}€RtjnÎ;}pgv‹ ÷;g$·mÃZ«ÔÊÞGDœ.0@£-Ùûwl»brɘ`OcmeiÃGˆà¶VÕ4ÚM¥¥vY¡Qã•Sû·Ÿ3ºE‘%wuia™U¯ê¨äsMn& @ÃøjKŠM‚L–]õÕ••-³¶Nä Z…§æbAñ•ü’¢â ë°Æ ¥ÝMUµ Syi6ª‘×Tv.»´ÒÌË”J­ÓëYÉZ}ö—]—ŠmØïH¼VJ¥ÒëbKùÑí‡sJ¬2’ÛÞPTRc–!À’©¤0·ª¶¢ÉE”ÆU[’}ðREII£™Îœ9Öwæèÿcï»Ã쪪¾×Ú{Ÿsn™v§÷–)i¤C€„ÐKèU¤* ¨ (‚ˆ¯¢€€¼¨ø‚Á ½ ¡†B¤gzï3wæÎm眽×÷ǹ3sg2€à‡8ëyx˜ÌœÝËÚ«ýVSz·|ðæ??êŠHáMIMN4¢í»Þ~ñÝmµ’Èô·ì¬nê“ ¤ÝµsÛ¶S][WÈHôÊîšUϾúIµ_cdv·u…Е˜ Yþ–êê>5¶»(tÝ…æÚ®°%¥T‘þæêmí¦‚±9|DB’'ÐÞЉÚJZîÖº]í¦S™-7ÖÖûíX[ÄßÓæ ©In鯮©io®í°Œ¤”è©Þ±éý«wÖôZ@2ÚÛY³³¥?¬âlˆ*Ú¼ac}Ó€$²}mum–‘芶nL™&V,{­¥xd__Ô"MÓ…¨Ûш¨¯3—Š(«(ê?¨àáI2’¾þñ½¶eŸtþé¹Eù{UÑ{k×¾tä‘wƒo,¿ôÒ»xà¦Ë~öÒÒg Íàšˆ„Â\× ]sdfi™¶Œe/b\pÁ@)3%&\†¶m›¦i:°,[Ótm<§ˆ}$R–-qÁ”´làšó7£%c¹ˆ [@ʲ,[r¡i¾é‡œÿóoÑÿ]u×[!Mš.b÷)iÚŠqMã ”È^xö9Ù«}©®Ïff´;ë ³OÛøâK÷¨±IIÛ–À5vÔÍAZ¶&*ÛV 4ŽIp°-øÐ;””5kB0D$Rʶm[ ‹!‘², \$m[1!8%¥mÙDˆ‚ áDᓲLuMÃQ²¨”–e+&tM°X#–&œÌ·@¤ÔpmBƉHY¦dºBDDèIÍÉÏu›wÅ鿽RÜÑ=ïçœô£Ão¼øáöî‘p"%cC@ŒoEZ–¥…0*ŽÎƒS)Ë´Fòï0¡é÷L¡ÊŠŒ¤aÜq ²£Q:DÃuÚ¦% ×5AlÂcùĘÐ8Rʶ‰ ÎÙ¨ôŽÃGÀHÊ,,ô©®n•wâ¿ÊòâÛŸï±û$Ö-®éâkrá·‚‹úëî'õÀ®´¼Äüo&ú^ A(t …®Å¸nŒUÎ2&t]íéQʹÎÅ¿<dš6t“1¡ëñŽ‚šÐ„£?Ö -¦†Vfx ³ln¸]ñ¨IˆL8è@ˆ(û>~é¡ ¡A{(õ5b´oÓsÏÚÁਠcd\Ó±k.×,ª¨V†åÓ¡)Òâz ÈFJ S›6f¤:чñá#:vÝž¾bc¿Dd\‹_.Ä=kCÄÑkJJ$•,:õ´còÐ ¶¯¼ÿáw Ô{= Ëø4Ãè8Wã´Æ„nÇrb6­~« ¬pd”ÝÙW{”Ò ¡íQŽ™(Æ3¡éC‰Èl߸âùõáˆ5Ò[DŒÿlh©Dlùâg™0Œ1ÃÂø7j#ú’ íáΪ|¼m-t—ØcÎF9ÚŠÏ:?ÃÙ£þ¸c2¼´È…W)2Ðѵ˜îr kܹfŒÝ•ÃµÅo®i\Ó`¼ÁjŸÒ_ÆuãZ ¹Ün1êæ';ä€ËG¯‚(âÑÈ&wÅ5:Þ„#ãš>ÞÕ2T÷äíü9§–j2Ü»é¯-ë–4rŸLÐ×Î.õ D¬þhé5ëQ¸?+°‚A †•ÎË92h¯ü¦"ÃúUþvåŽÏ "Ñà|ž q’ðZáõoœJGZ¶Ãÿ­ë·Ïo?]O^þ“˜ÞðÿÓ<ð¬isç/¨L '´»ßYòb}øßšZ1Ô¾éwl|Œbç¿ ÿ™ ¯—"RÊŠZ¦-‘s!´m]‰”’–MB×¾„ Dü  5m©qaèÿ)q$MËfB㸷cˆˆø™îLDJY–š6ôùo]>eÛ¡œÿ‹›ÿ¿/C»qÝ;µ«V„¦é € yª|%|ŠÕ¤eÙ¶dšË`ÎëkØØ7A_3ú"8ÓDdY±„‚¹—?öÀC¯üåÇçäfÿ/ÙåG_{Õ™s\–=ª*e›‘PTÆ;¼“2Ãá¨é¤½¦/vÚ£á°%Uü¸¤‰D¬}©I™¶ïèù§åþæ¶KfúÈV_;%‘m¹æ_tÅuÇeèø¹–‹HšÑHÄA³!"tåMÿÎõNÊÔÔ—ÀLvx0l9PØ_…2HY‘pØܳ~"eGBQS~uK¨¬h8lþ‹sEJñâ…ç^wîÂY)(Õç|X‘PDíËÜ’²£¡Hœ é«’a¸Ð ·áJÉ>ð»—_õƒ™ÔŒ‘ßWÂ2õŒÃ¯þù}¯=rçýWOO&ü׳‘Œ†#Ž_ýý¹T܉ÂŽ9ãqCmuìzᶿ¾ºª¿|V±ÆþÕ^_ñ¼ÙåY¦<¶Juú5w]>ÅMvì×dëyçÝqËwÏœçµ-}Ù?£þÛR¶Q´ÿÅwþêÐ))4„¨ƒÜ˜qþ57Üpd‚”ŠöJC³€‚Öÿcé­ueÃiÈ÷ü~¯}Ûs«6Û¾•ÅµIË2í!ïñ·0ŠÊ“¿õgå’åÜåZbú´¦¤xøðìï[7öÖ[I<ðWÏÞväät¡äŒøgÏÛ>Í‘’<¡ð¸ksû™IÊrvV¬´R,1oÑ/î¹üì21Þ¬íSýŸÒ["R”{ÌE7ýîœl Õ¾M ì¥B’ÒŽ8i-p· ‘’ “Oøñ]?Þ/‰ËØØ÷:¹DÄòæ]q÷u§žÏmùÙó1Þ¯aßw%Ù¦eYŽg$ìë¦üœÇhx›’åßøôüݪ¼c槸—‚û¶‰H¡pí÷ƒû_».ŸÙðy¶ý¾þ«xá§hüDFeïjlêŒê)¹…YØZÓ%tUó΀+73Ýmo¨¯k郞omP™ŸñŽ³lŠ×)1.Äx:2"æòåL9pJ’êªÚR? ¼ù•Å“ž5uVz÷!ó½ýþºmÕý”=uþÜýæL×ôŽ?ëèjÚ½ÛïÊ-(p“íËHâ‘öêÚŽž¢Qù°âc%O)ž3rzhU{`èï’û¦Í?8·ÿÕ—À˜wÒ”ÕL(ÌðéÁ¦š¦™œFíõmJ¤ULJï­«êîoinJïYÙq70#1¿¢4-I w·4Õ´Ú€(’ KK S¸ŒöÖÖ6wXjOm$±Äü¢Â‚t]¶×Ôµ÷F´ôòIņƤ¿3êIuG»Zûlä y¥“JÒ„9⫦«?ªj)éYY‰¶äÙy©ì«ÛQãë™e¥yib°?(­hGc[ÐæYå³ ’[·mhès i˜–XP˜ËÂÑ´¼TlÞ^Ó5‘ÄÝiÙE“rÜr ½›{°¹®E+U6kþ~SÊü ‡4fvïÞÒJñ”¢Šý²…ÕÝÒXß–„\OšTžavÈÔÂT/ôÕînhd iye…©^êh¨©ê°ˆëi¹…EYI^n t7U7ùÃàÍ,ž>onå~Sƒïo¦7µÖ×76As§MšT˜íE3Ô±»ª­/"i$kb¾ò ššÏç––ªúî€I DrFIEa¢®üÍ ÍM=Ò^6cÚÔ¦WÎL™{h[ qÇÖΰ¥€PO.=àØÃÞ®Þ@îÎ*/ÍNw[}Õ­¨Ò}ù™IèNHt“¿±¾¹Åo7R‹K‹r“ ØU·­Î!Wf^–Ï­Fb¢lk¬­ë¶ÉQªJå)?àÐ)PÿR¯æÎÌ/”åb*ÐÚÔÜÔFWZQž·¯¾¾Ë”’Ê‚hã©<9™^)¹Ù^»£agU‡È˜ZYªµmÛÞЉydI‘T8¹$+Å°]͵­}AåÉÌ/,L÷éj®ÞÝ&wnEQù‚YSfÎ7zûšvTw÷ÛÞœâ‚4NÁ®ÖÆÚö=µÄJ8¨@6ÖvZ€Bó¤—–ægzd[ͶÆKÎ/ÊLòy! ЗÎZwÔô Z(<9å“2S]V_{cuKÀ$æ.™\ ­žÂ¬4#ÜZWWß#ÔüÊâTljÃTOGÍîÛ“_>9/1P½qg·r0QϪœäéIIÆ@GCUsÀT€º¯¤¬$×3ØÓíniï0÷€‰'"–TP˜ª™–;#;M 5VílŒäT„›êûBÊ›‘—á µÔw´·Ìv“âX”îNÊžT’åÓÍÞæší-abš¯¨8?/E#³¯±¡©Õ?6Óó*Ë çO/Ÿæ}èAyÁŽ][›L-%¯0?7Ygv µ¾¶¦Çf ‘'&³¨JÈÌLaúÝ»ÙÑÜY^V˜®õvê"ØZ×>‰9e“òR…R$ÍHG]}}@ý×è'ÅÞ%ØÄï»Öxê濽6˜1÷¤KN³îûé#MQ–yÞu¿ž]¿vç Ôó Ó©-ûýÏŸÛÝF=qêÅWý¤¼íµõƒy³§ÀªGZº®ÛS~Ø%ç9Eïé »‹÷36ÝúË?øËæΞ\™íËLœ¾è ¬Žw´ZD,{ò!'/Ž¸²2õ–å÷>øÚÆ~=Á7óg¿ÿ¡öÆÊ:䆻ûý¾.;cÖ)§:;Õ ƒËe­ÿÛ=¯­îÍ\pÜâù 4èúॿ?½Å›]~À!•‰®Äâ9sYVÊ&««±ÅL½ø‡W/¢¶NSÓ[Ÿþë k[Þ:úýcÌûéMÇk;wÖ†R‹2Ckžÿëß?2sºì;s 4›t—ÙüþãO¯nL­ÜÖ´Éi élö¡ [ÌúÝ]a €'dLY|xúÖg>¬Š9G}áÙSEÄÔ]TÿÚ½°;uÖWßtBÛªü,9Y6½ýسkjìü…'Î k¾´Áyøï'vÊ÷ÎÝú‰_ÏÊMñ?û›?llq°ý0ã°C§¤¬zr·­ˆ¥–öÓK*<Á`#ÛW¿þüŠ:-ÿ«®˜¾â×7=ÝiL¹èúk÷ý¥Ufþñç^vtFsU«ä\k^ÛTßÁ³§Ì;éðùe­Ïÿï’×Þë$Áˆ%Ï9ïÒ³M õ‡•ÝµúéW>Ü(9ú¤S7î^l IDATæ¤X’%å$îzø÷O¬´r*§Ïœ[’šæ«\p`BwC¸µ¡Ë¯JŽ;}ñ7 ÍÐ#;_|ü¹ ˜æ›speÓú%;[£Ìã›tôigž\A#-½cÙŸ~?댟žSœhF ÝÔ&SZžYòЫ5“Ž?÷Ô# ™­t]Õ¿õìS/l¢–wÉ/o)ßüîN OtÛýa=ïø Î>"«·©[æ-˜úóO/µ×›W9Ñ‚Ã'ÉMKþçWë¤Á§žtûm%ÕïÕõ»ò ŒO.yê­öä‡ýðú“<í~-ovYÛÒ_?ðƇí4Ž»»˜rÁçV†v×õsËíáÝm§ÞxUõ]7-ß)9üœ3¦nÿóÿ¼EÁãg‰2÷;ùŒË·mwŠ§ö©?<ùz#¯8ê¬ËÈÑ`Äò¯]ñÌ?×ì±KÔ‹fÌœ=;KhÆôCº7´Õ¶½y3N>}a©n–h­þã¯os;ìêSsºv5…ÀȦþõƒŒ®™ø£+U-‰}r×U­ïñÌ>ðÀ2—¾©GÐûÈn¾7`NÈR¨¹Ýš`À„árÇ`P÷úŠS«ï|àOîÜÑ“OÌ),/ÐcêLö¹6ó=¥V:†º¶<}ÇG×?ö“³f¿øÁ[kžù{U=$ý°à¹[ïÚdº`«¹µÅÈð«žyìï«Âz7Üi)+þïÞ])‡ÿü¶ãæoÛÕ°lg\™3:ç'•µÏ¾ÛeÊ؆䞂™³§gu.ÿßmQ`ÜQú¤ìwÈaÙ]¼ÙÜg:~÷Ì•˜œïÝüË?¬i$¯—xñºÛ%9jn·[/™4ߌO›Q³äî77N=õ¼Å'ºyeCÿìG×^ùãÛÝ™él (÷£ˆlH?è‚ÓKÍ•Oÿé­î¤Yç_uÌŠµïr}`ç/5ò݃Ûß{¹³òÀòýŠ3óÎÑO¼ú;³.~û£M PKHJÐ"ïÞûð®€'Ñ­2>ãðƒ2v=rÿòlú·®8ó‚£×nz&°û£×w.ïîæ~ÞÅ‹æ¾üIÕ¦Wî©NΊ¿Þ¿|S»Ô4îJÎ]°hžkÝ÷oz.”Qnö›jüdošÇmwlåžWøá—^uÒ¬´§·¨Y‡/žc<ÇýŸô¤wÅù;oÛÿ|áÏ­[ONË:n÷’ÿYÒË\NPO*ž~Øþ´ò¦•ýÈ‘²øÎbmÝ}KžÜžsâ÷¾{òQï½^FjêàK?òn{Öùÿsé‚ç×öû?ç(ß'KîúÇN>ã‚ßþúÌé+ªÛ4—Ëm|õÉWksÎúíÏæÍËù¸¥EIoáüÃÊ iÕîz?sN=f¾öÈþº¡R¼l0Ì`šËm"à.·Gg €€»<^Ÿ^¿ì‰—×u'§»ZëŸZ‘é×NwiÒ¥ó¾wéôOî¼ãù÷[ôœ,Ö$íÜøÚ[{¡äÒÿûÅ…½µæå /<¾»F%þdòk·ß½¦Oêœ#²Î o?÷vsoHŸyîO>nΛoÕ÷€²Ü“šžÝõêúšA%’ ¦}æ¸âÞ¿¾Òì=èò›rÖûÛ>rëÑ]o¯è›zìB¹îÑ×J¿]‘Çßã'\pˆÿ‰»^ú ³àȳÏ<áˆÊ[7é^_IÊößü~euÔ› Ü%yliËÒÛ\í:ý‘“ç‘Ƙ€Î5/=\;à½úÄ„aƒs'][Þyâ‰ÚYW\ü¢ÊWÞÌ:ñèÊ–×ßúvÚÉWΞ“¼w+Ô“ûO® äó£Ÿþàô•ïü!2ÿÈÉ©íOüî;{uŸaEÕžÎñL[Þ[úȺm¾Cæ§üãW¿«—:ãLKî«yï•ÆÚúTêþWß}Öù3ÞûùÚ0€žœâb5ëyhC‹JK6šxBöÁg‘ññ7üñãŠËo>dºGp¦ºkW?úk´„‚#Ï4S{wy£ÿEàìûèãGq‹"ÂÛ_]ýIg4¢"@tÜc>…ÙpÞ¶ìÉNWÌ¥,3Øá|l9D´û;ëW¯ªkíîz¯/Íq æÄ£Š)€!1®qÆqÎ5ÃLXùÞ® Ô4zrò²´Qi5¯zýîŸ|Ð6æË~@¬æ£FÅtDJ²¼#žÌj^ÙP¶G̬ý›^Y_Õoô†1%ƛѓ„¨2½"ݽøÌÜÃÁ›‘ç%ÈJTÍõ5µÖ“/;»¦ªjóš£ös1‹'•Ï™š•gÎ;᥊yrÒSÁg(%{›[›û›;ºrÌʤìÂü)ùFè€3¯ƒàINÎËHô8A?f붕«w…@o—™wA®Ñ¹{ãºê.¬xÇ™†È…àœ!c\‚˜SØjرismK³»¾>”“ä3€Âˆd‡›6,ßÑ!펦îW<©²²P?ñœüÅš‘âÕ)3Á?÷Í:é¨Â —î+NÏíJ6 Gt|E9!4ûªk:O˜wÆ÷¡~÷ŽõÚ¶rô¢0§„¬HǶ]ÝÁ°«ÍÁ¬D—ÛU6+¯0uáùÍ“<½,·¥úÜØj Áãš&bˆ„Z¤ƒçeU¿ùç-QÁÁòVNÉ }¼fk{gG`í¶ÞcNòñM@áO6íl…ý]M­áIy…ù©³¦dz­#/¸á(‚¦gg&jBuUMÍÝ‘ §¥ÞœíKæÐbK±ÿŒ¬pÕ㻂 잶ížEß>#c{õŽu;ÌQ'h´×åß½vå¦v›¨§ÓDDdœŠ+å)•e9½Þöæ®® „?0äz¢‘T°ð¬R=(Ó\ùE^1ιàŒ1.„N~vÔò=õ˜4/OÈ/L‚–$F½•íyá´ù»š#ÈXRvåÌÉ™á¾ÅßÎ S‰‰›(ÔÕÓÕÙÝÐÀ†¶¾,^¢i¹ çNNm?â” ç+#9+ÁÝŸŸŒüøåµÛ{L‘¨^6·0Ójzú­í½}î×^ë›cg;oÚg_pLO/,ŸZ™Óyèi,˜žHœ¥&òªšþcgþ­S²?Ù¹ý£-5¦ÑJ1ã 4æš&#%yRþôÃÎ>Ù£qWÐ#.¶& €‘¾†ê7T Øëh‹ƒ‡S<1§,“Ö>°®Í?\µ£ëddÎ5ËS*æŸõíéÕ÷Þ¹|[”b‚KÅTÞ1'þ\0²ºû:‘5è¤y‡O1æm%zÕ¯\áÒ‘1»£våŸó×wú I’Qb å°g(íaZÚƒU8&áØ EäÊ@sÍÚæáMLZ6gFvÿ{K> á¼_É[pÔ‘E½ëŸ®ªë#öÁ&³{ÀCa€±tÝH€CŠC±Œ¾¦÷×n~ùþ‡kÙÑH°¢Ý/üâòªù‹æôk°ô®?¼¼»SÅX 88šÀuFý_|îŸïÕF IÚ‘AïâØæ%EDˆÈØ}k—.}bgHg@’‘þþ bn  [RÅð¹@P¶"D Ed«Os­‹’BÀÐh)¥Dd*bAîåŶ)íRSl±l³oÐÁkGθ ¶Í«^¸ç©F[C ;è•\zãÅy[žöµ¡¢Å—]RÊâŽþŒ»iyóo¿lšuÀ¢Ž¼îüc^ùõ-ý¨+è$ ­%Ž(•:èVè&4°‰ ¶”À’ŠPãΪãPÂ+dŒqMXþ¦·xhEÓ¨?Xƒ]ý9s@Ù pȱ@K˜½`?½ù“MäÈjÞxÏÕþ¹‡ì?勉;júÒ;îÿ ÇÁæ#`b˜e!)e%ŽÄTìyÌ8gd†•3ý XbÑ쳯9ͳ|ÉÃ˪£órþñàG\y)ݳ¿sÓÙýOÞ÷Ü{uÉ ¾{áÀ½¢ãÏ="°ì‚,È™ÆBm»Þ¸oÉÚAM I3ê×æ02ˆÀ5W¨mçk<²µÛ †úQcHVw¿b ˆCä HÚŠ1*j}Êë–$‘$ˆAÕ3` ¢ÒÉ hÄ¿1î ζaÅH”˜Kª³µâón¨ø2è¯Þôò½nëHšÑ@?³>zê/·l™uÈ~ëû‹{ëÖ_-m s‹aìʉÃS¹;µ‚ùG{ñü†¥þcÀïøŠåC‡Ã¶#±T8¬md †|"GTQ…œ!ÙÊAß'¥xzå¡g•òñs·½Ö ñ_å2Ïö*Q$aF¢›qWjAŠ1:b|Ôº2MSOH0ôñü!QhïÜ}Ó%?¹þŸÜpáO®¿àªrçsµOŸê8þDÒB¦%x("Ç;M)[¢Ë­k|øè±´ƒæ¤Iy%ù>êéî YÀóJ8bF’`1·.Lœrølؽúƒ&)bV1L>gŠ·eãGÛ:Ãl/«d›fXêîädî¢iÃþŒÊŽJáNNq9àEVóº-;#Q t÷ÂqTD‚ »¶-ð/wß»B•ægexœœòÉEåó™âdÐWSÝŽYy)èë X€£€:c=E9ØÞÐ¥fÌH1{{z{%CŠ{% &3ð×5ûÂòÜÄ_Vi^FŽ+æJ¥”Š9}Å'ÆÔ ÷vö`jAi±Ï’=m~šŠq8RR ]wÇ|æIA3ØÑÚ!2³’mw_ ,‘ƒL,,ô…¶¼½fGM&'z}®XeʲHKðÆp–¡îÕ"uë^ºû÷w>¶3k^q²Wdzæ”ésç´?iîiªñääx äïö‡- •ã5*-ÍpéZÌïB)£è³£Uïl÷ Ž€Œõ×6’ +²=nwú¤âdÕ×ÐK ijEaN²753/7i°§³µ¹±5è6Ù3ØÝÓ×+5z †¶+½dÆdWÕºu5~Ƙƒ&hèѶ5Ïþã¾ÛÿVÅ|¥ÉÊŒ†#èÉHF¥åNM3Ä^¬¼1_ÅøÿÙþ†Ö`Þœ™¥éCó¤${¼.¯/+•ÚÞ{neMó oJæð™$Û"&œCJaÚä ÖüÑŠõµÍƒ®ìdÃ-€Ð=ûG祿¿du]X€’ƒ ]–¯²DtõøL4âF·9í–uí*3'zúMâL{K ­d°«mPÏš>5MsgÌX˜í°ŽáÑ@,iâ8ÛK…úÚ»£ûÍ-òèzVI~Z–k(OÌ+™sè´†Ã\8þØÉHDjn.¸7½0y8ÆŸ¬P¼I).ÁH³¯­% ÒK²±¿«·Ðf:WD‚;Ú±ã­ï½ÿ/¯tg§'ë@¤óUNŸ³ "Å« ½V lSq·Çň€˜–’‘ɺv}ðú†–+cFSq³A£c K›:sÎÁåI€*ÐÙ> fïŸoWáÔüÄd‘H™~ò)óó»žx|uF|­ÿÛe)dáÝ+kþ½×y¦U${ûlË2MIš¡khY–iÒBZÓîm^|Õí¥Í›žùû£[úÌ1{˜Q¸·£‘F;ùTʸævÅ@w¸Ë³ý`¨½ºEuþ×Ïüdëò§–×´E0Ú³ekÇwŽ?ûª²é[V¯øçË­@j@?èÒßeÙ©I­+^ù¨:H P/>ú[·ý~Úõ—lè³AZ¼òÈË­M÷mÆ.~Bäû-:8¸õm;ûI°á÷Üåqë1BmMµÛç|ïºË+ëgø ˃@gÝÎΓNøͯŠÖ}øÜß–7u}øâ[GyÝsÛüèѺ·¾ÿä=Ëñ /?ej$N,-éZõXCk=SÎøîm?N¼¢âªmÔ©é‡^-¾ê´+ï\Ô7H£÷åÛnnÃà¨.Cp!t—K…[W<öæ·^sË´Ú®¨Ë—Ðùâ®ÙÒŽB3\’'4«æÕ'Ö]yÉE?Õn&ePê©“Ž½èøÒ™³Ë¦~ëß–UkV½¹‹é.—ÌÄ5—G×Y¤zí-øÁ™wÜv@‹åYÎ:“쪫Žžuê÷ïLÞþÉÚç[c1n¸ Î…nCIœ¹Ëch1D†áÝï¾õþÔKÿæÖ9 ½Âëj_óÂ#}òá†S¸øÒŒ#’Êçæ&÷0@äý»Woa‹¯úQÉÑ[×¼þÆÊ ÁÂ.¸haF@eLKûø©í= ¡žzðU×\>gÇEónkB„Âårâ"× ·ÁȬ_óÆ;‹¯½ø¶_vvF½)´í•_zfm‡ûë7 /¼âŽ´ÖËŸ~lc·göAûgµ¯[Ñ=h!0@¦QÝk¯¿üœ+~vØ '#¡ýµ‡«‚* d?N9ëÚŸ…iXõü£šÚ¬WžÚðã+n¾yQ}%zqÇÃ×?Fšn¸wÆ¢»t²³Xœܵ|];i±LGîÒYç}ÿŸÝÏÒrº?zs{ŸrÕ®©?íâë®ñlR³‹¶â™1üj&¥0uÁåßš1mÎŒÙ9Œ’*¶|øø+;¶|ðàó‡|÷–_Üèî_ýÄKk«¶om=ìô›VÒ ²æe¸=:CdÑð±gßò³i[¶¿óÜ+ÛZWm¬?âÄk®˜Þ …óJ“xà¹ó.=ªÿés7,D$ÕW³é•eó.½æ–_žÐlê)<°úþ{{ —!çºncBs¹ XÿìÓÕß½üg§v+]6¬{üÎçš%0—Ç <Ø ²«jÃÛë\ðÛ; vt{Ò•ê#)µÒcN8øà™3̬Ú÷ÿgú¶e¯¬¬BÝív,OL†K‡h燯|pÌ­WÝ\º{ ¹"ÇhŒ=À5éøs~÷ëI×Mýþf¿íV¡†ÎG”?²禾“¾wyæ¾¼¹ÞV „v¾ù®:õ·¿™ññ[Ï>ú^õ¦•Ë?œzö·•T·“;)ÚøÖ·üÓ8ôôo1ÉK–‘‘¦v¼ÙÚEDÛÖ¦_výÏo¿ëŒ[ßÝÖKˆHÒlYó±ÿ¤Kq×Ï?þQËŽíGŸzþo®­é÷N*s±~%¹ËÐuÏF¥­Ï¼ò¦kî¾õôÛWïî·›Þ~iÃÁ×ÿâ–ÙÕ‘ìi>±^)òL;è¨ N¬ˆ¬;æ‡WEÑƵ/½º¼Ùþ¯áR{C›½î¥¥Ï%gO)H`‘~©a nGs˜Ð[¶_kØQ=ð‡š'kRY^f‚ì«Úºµ31 Ê©Ú÷À8àî„Ìâ\­³º¡ËféS¦æõWoo7%×Sò‹ |šÕW½­Ö?hx|ÅåEI|°£®ª&:íG7\Ÿ¶òæ—ý "ÒUW×Ö9h0OfnI‰§~CuÐV–å=ô7¿=Ž­|ðÿlêWˆDD,q¿ŸýíÊwÞôϵ]Næ8"dÞŠýŠ£U;êC*–P€»S³ ËsÝr £[óy:ªvv[Š€ of^qI–Ëî©ÚZ?VÂãË//ð%ê vµ4·¶XJfñ¤¼$WáæêúTðÄÜüâ<^½¾.DDJê)ù…¹y©n&ÃþΆêV+¹"ÏÝÒNËKìê“ iɪ­¡=¤¥åût°B½íµƒa[KÍÊÍv÷Ô5F‡wÜ›5©8'yѧ-N{ìçÚ5à)›S‘䈌B­Õí¼ 4ÏjÚÖ„܊2£«¶¥oPyÒs K³ÜœRNþÕiáŸ_ûÛí êÞÌ’âÜ  ¶ïÚÚljI…%©Ý5 &KÍ/LÆÞ¦†^)\¾Ê)iþíÕ-Ž½ˆÐ•’‘Wš—â*è¨oèè ò´‚’’,úMέ¶ª†‹@‘;»¤¸$#…:ëë[’â ¯ÁÌ@wڮ§–ç$„ª67G@ñ´©“½}õÍAž˜]˜§·W7-p¥f•å$è\†úÚš»z €ëÞ¬ŠŠœT Ôoý¤·äÛ—_x(õÎ?¯ªÆk'¦'å–gø\Ö@WsM³r;ÿ¦3’ýû‡)[š›{"™îÍ()ÊÍLäÊèhj¨ëayÙIª§±eÀvùòK£õõm©—>ù{ãé_-y±ÚÒO¢;)RIz²2Ô]ßÐÖ1`)¦%¦N.ö‰PG¦$õÕnk ™äÉ/Ê2‚Mõݶ=î¹ÓÒÝ$;äoÚRÕæöV¥'i2ØÓ\ÓÜ Ù…EÅiš=ØÑi©š­-a›€‰¤¼¢â‚4M4ì¬îö[ÞÜIE>MH°Æªþòïüø†é[®¸~™ä ”UR”•æf2Ú×ÒÐØ9…I‘¾^ËHóaWK(©0ѪmèWR^YQZ²­Po[sKSŸÌ[6½TÕl¯ ©¡ D=1­ ¢(……¢Gþþ—ew\öƒYѤ‚ßP¹Ù³kwC—ÌVb5UwHofaNR¨±ºÓd®´ÒIÅ™îpêÌœ›¶ì-ÿ°¸HÈÉ-.p×o¬t€ “KJSì®ÆæáÊHÍ-)Ï1ìà`ÐꩯÀÈ(.«Èr[Õ;šûl=Ñ—SZ”ž¬ƒênlhi`©¹…EÙÉ B†ûÛë;{ÃH “&•ø¬–MýŽÿ>0ÍW6¥(Û+­»·· DµÔ¢ü숺ºyJBOÕöxjiiB¸­±upDS¨0¥¼2/)Ü´£9‘ÂY^^‚Á‚Å7œåÿó K7·ë¹•eY^$ { µª¦.0®¿ß6P?Ðç¾\oÞÚìCËŸ·hþ¾r©.¸à?ôó‹¯yõé—=÷HC}H)ZE)EDL)iÙ–®éñŽžŸƒW ›£ˆ´4Ê6Ü´,9ç€È„wê%Wý8ñõË¿Ñ““bÉdk9Ÿç°¾[ës+W¾ÂhQBáIËÎÍö2RV «¹©ÏVûºtèJÎ-ÌôhHV¸»µÝ0áêBÀ=©y…é.2:ØÑÔ1¶÷}¤!R¿°Ã'|c3wd¤Ñgc¾£ t ˆÃV*‰r‹­W|©‘ /"Z"Ç°û8^ÿ3uÄ5½æ HˆÃCƳX+4*° fHˆcf¿¢ñSœI.6>'v-®Ã1“ÞHçi¸ë{ Ê ²Š)¥ÿ›â÷'迈 H*ÑHQßF%ˆ(5%åÞeˆsš®ÿâ{×¾üøónÛæ%g• ~²¦kÆ•oÞpßÖ—C IDAT(ç£Qî1)áOÿÛó³zû",Ú[³äûW/Ûîšþy}üDbÉ¢S.úéÓóÜÑŽ†·îùõß_k7ÇŠAË2cBh{}“¢„IÇþàÒÒÆgxf£ïJ" ¦œ~Ë '\š"w,æÑ{_ÞÕýÈ•1ýÄ .ýáaÅòÇ|kiµõ%f牙OQ™¦MÈ5Á¤—~xü$ZTQ”•ž˜Â J§r?«ß±Ó/Ç,"¢ÜúÄŸ CÆ;Þß|øién ÀèFDõÔ¼ÿrCõ‚9ß^ô•. ‘Î9IÛ´¸Kg0¬ñrÄ!ƒzá`{i;]d¥T(B1Ý‹ÁFYq¡ý1RJŽˆDˆˆ €€¤m¡\°h ¥¥„ÑéQF‰‡7Cå¹"×ÙP¬(Ê9܉ q¼³CÎP’ó31vˆ¥~wœ–82Ûi9cNØD.Ö š o —bœµ;¶7L*J¨þh§wþŒ5ï¯Ü¼¹1ÊbO{˲4M‹iÕDÊÔ“¯{dí÷ýÛþqËuïL9åÈ¢À†¥w?ÑàžuîÏ.[0»°úÍZ"àzpÇ»Ë_º~éFù¼D’=u[Ví8Ἷ/ÝoåºÕ¯,{{usÈ’lÜðÆßÝÅç^týÙe…É»‹Ž=&û£ÛþòÆÐÌó¯þöñ‡ç/{°Qéd“%ë—Ý÷ðÎn%4eF"»jûMOnYë?±AÅ¢ïFYïc šekÙsfå³ê—wö’jçŒ}Õ>ÖȘ‚•e™¦mhb„{9ö?'Š)RCö6Œ¡½ÑX?|"i[ €”"ü”L•Ž±Ç¶L%‘)Î5¶´Mi³8µÝ—Ë“IÙ¦¥ÐÁnÂa® Œ1R*þA8[õéØÆ44#0²£¤’HvJãMÐýs)"#=ƒBýá`wsM“5erÛî-Û«?© #gHD „3T¸cûÚ§î]gjZ´g—R s=ÁƦöŽþ~£©©qpV®#¢êª«Û]Û´¸&­qôeí®zõö_×Ì1u¿ÊE7þaáÛÿ{Çÿ®T¡–vÿ@(jCÌmžZžŽ] Õ»µªÅZ”›ŸHõ~ƒ[VÕu†, –5ŸM#,iT›'Eð´i'üàDOÕ[¿ß 0ª8}Œðo‰C7”“FÌ´,‹¡ÇƳ{ÐhíáÜu¤ Ľ9–;.BÄeýB䜓’–mÛããòèÏ ¦û´Oñ¸QY_&ò IiÛ 8UŒía“Žº“&­ š ÿ.eËÄÏ;ï¸ÃËå­iåY®AcÑüŽm;>hÐ A7û›¶®zõí°¡É•%ÉÁ&ç–SÒ¹ @ELiÙ0\~ìí $Íæª ÛÞ^¾lõõ¾ùä’‡6K%‡½‹IÙÀ¸#Œ\ C$“{*9Õ)¢Ñþjc®PžRzÂÏ®Œ®ùñwšü²rî¼ñ‡¥’¸äÖó7ûRùÓð¥ËT"M)mÉgÈdÌñ‘HJÈ<æy“EˆñQ\‘1&%1Æ)ÎM/¶$§.CD@RC' »M\0&¤´† Ë÷@ãIÏŽ#þyC @XLÅ°ÜNN¥cÃ~|qS1,Å)øö`ŒñAÚ8öÏ1ÂøD8ìõIJJ©€qþȉ4Aô•q)Mø—ßýœî+ËßüXÇ~Ç–t®}á‰w;`o æ¾´“=™½U5þù3¦–Wlb®©S*] ïu* Ëzñ)ºt¥æMž‘¨k걜â´{,¹l;2Õ»£)rÖ”¹e»Ì`åœ"Þµ¹qÅù©}È6mÓNËJqi""¥RŽsr<\ æ;ä’‹æv¼úІŽˆ‘˜¤‚ˆ L:ð²o'lフ ELó&ø2’ M󤦥øCý!û˃ "[ÚŠˆHJ‰Œ1L¡,˶%pàÈ8#%m‹À1^q”ŠHJÛ‹'.8CEJ’B¥2dŒ)iÛŠãœ;¾$- D<Š=2!¸eIÛ"å”2%-”ãw7:~‰¡ã’§’rk‘$”Š!’R¶-¹`,N‰ŠÈˆ”mÙ$8cœ)iYqæ48€ßRJdœ”’äðK%I©Ø>CT$‰b†4©HRR!s>QR1JRŠ!"*iÛNf2 eÛv¬"BNJI[ãšÀ š ÿ$.`‡ZRbouÌ™ÚÓ\WÝÑ´çF&%#‘ˆaÓУWðà'/-û¸ðô®¾:†¨ëÃÍm’˜¦ìh$jËOÁ˜A=!kÖ)gNrɈÒ|y «YRßo™‘hÔR@ÒŠD, ­yý¹M§ŸüÝ cpÕ?>èTœ1RáP8ªâ4^ £=uÛvqþ‰—ýrnçægŸ©>:VÛEè­<þ¼ƒÓê>^xáE‡0³yó»Ï?´ÒœXò¼‹¿›ýâ®õ6F‘–R²àä³Ï_”š’öƒ+õ›^¼ï…ÆÁ/SèxZ;ÐR1[ç:€RÀ˜`¨¤tòQ MpŽJ:ìi‰ÇRð"×4 BEȸИR’bÉzr!`È „4ÅŒ mH(CDD.¸#H2!œ”]CR%BcJ: Ž†d)® D&4]ŽQ±ÅrÞi$ 2'Æ.&@qÁ !"6 A±ˆ)Ç¡k:ÉÉœ †HŒ "2¦Æ@Ü4)"Ô5>Ô.á„ 5Aôu%7OÉM—]÷ÒcË +s#=!W²a­=¥"B®{32SXKó€BDÛ¶¢¦JÍÍÏÉK*âomí{Ó3¢½Ýý!9®Æ˜Ð“²2S} :'3ÐÛÞزÀ•™“Âý]~ Ý)™©ÔßéZÜHHÍÉHNÖ@_Gk¯Ã›ŒÜâlÕÖÔQ# ¬À]‰9ÉÍô746í)K%TdŒ3îïnmè±õôòBÑßÞÕ”DÀôÄôœÜ²r&#mµ­!ûË‘¥½3MP 8]Ç{[)p2"ë:ˆP˜&H Œ¡K˲ †Ü¶ †¥‚pˆ†k"][LSF•âœi†+¶.–ÖèÚˆ M#Îqi”¤ÄhÇ~¦0†k”bÊÙØ’|=í?D0a—š  ú÷ÓgâøíK-}Îëõ_(Ÿ~³Ð¤7ضmš_$sÇç%˲cq~ÿÁDJQ$ÂVdY %(á0$$„B ëÀ˜&B€”dYÁ– ˜ËÍ€ — !MûôÚÁ6MD´ˆëcR¢¦R`ÛàrWÛ0¶Ãð¼ÞñûfY Ä×6A4Aô…¸”˜˜£¯ËK^Ób‰ãâ$$ăÛSnœƒ"R91è·;VpÏÚÇ©s…(¸`cŒ‡1ñ®M×cµ ?VL¼Þ½öÍaTcj›  š  úüôE¸Ôp¼Ô„ëî—ƤóáLR1‰dHŒýÒ0Ʀ¦Ñ¸1âlï|év-¸—Ú@ ¹×# hiÚ0¬È^ksÈF×ñe5-Æ Çœ  š  ú2¹T\Ö¿¬O€OÑæ×uÃíb¶iIõ/Ø![MpPÒVjŒIƒâ±FÜ«›¿Xk{÷—_:Ê8Œ«êuF‹ˆ$¥­¤TÄ„.bÞ Î#ù .G @£‰ñÿw€ã™ã¸ÿ1Mc$m \×CRÒ2­‘•'úl„Kd¼IÄ/gM¿,ñ7n³í[L‚ƒ¾Ë…¦ eGMIôuF±q¼.¹(-KÒgëý?cBö4/Œ_ãßí½áÏùœ ¯-—""-5+Ý­BÓ“žhl ªX°ÔÞ¹Iå™yÆI'œ|HžÖýÚ/o­ÑÒþ…Ý£L,»èÊʼnÛ^xôÍ–þDo`FFIúýþ° ¸%#³¬ÜÕº£)"?÷ãÝaîôÜtO¸µ¡×†%2’ó C}&}•'Áq¿–2†Ãª 'Ò˶m¥9w€a¥´rΕIPá̈ð¦ç¤‘¿£'`~E$$Å<©ÿ½ïŽ“«8ò¯ªî73›sÐ*'”P–@Iˆœ3"G“ ÆÆ`Î68œÏáw¶Ï>§Ãé°qL° 6`r!„²Ê9lŽ³3ó^wÕï~3;»;+‰dãûèýa/Ooúõë®îêªúV}Õæ·íØÒ¸ÎXÙ¼Ë/—xö÷÷ÕϹî¢SÆóºŸÞúãMq•õCRy5#ªuÃŽB´§ -¼þÂyGäu¬úŸÛ¹=©ÞG‡AEÊëj¢~KýÞ8ã‡7}"B:¯¬¶² {÷öf‹Z¶V 2tÎñg_xüø ú¯7ÞþÔúŽ9uWtÐø“n8·â‰ïÿü…¸·Ï•,©ZK]-ÍÍ6WD$/ZR;¨¦ª8B¦sÏöm;;8W1DŒ– ª\Ó¦iËö¦öDnd°ˆ¨XiMu$ÙÔØÚ}°ÂýÿÕk_\a5äØÓÎ^4ò”9çòøÅ–m`\Š,§ mƒ¸¤kß|ƒØýÖ£ýþ‡6c~Q?`¹ˆUÔTW)1A`ŒuÀhNBùIŸ¾ñ´…c½dÂÝd$«NùÂ× õLØ0s&‚À¾–ÓÇ.É\Ù CtéìK®¸ðÔCT>-X2ýÄkn:íÐ!1ë›lnf¶&ðc9«Q6AøAA¶[c §‹_ôÕJ&ßȤ@ؘ •Lv'}WOœ¡°µNƒ13‹‚XËÖ®l}vô'®ž?¡"cb‘akü ðc\®5„ý6®3î‹„ÝlÆšžÖPIJ4÷ä+>yJU¾7Å‚ŠêªÊ|IÔ¿z÷ï~}ײÂ1CbY’åÔ½*¼ðßþ}Ñ‘e D¬1¦ç¥"Ì&0Î|dk ‹íÞûÒ/óÛß®*]¥þãæ>!}ˤŸ5Í(©{ÆW?³ ,ô~ @¬5q­ý[ §[kc­ BYbp^Ýü+®þÄ^*i‚ô`Z~•ï›–ó?_y ³¬²8Og—˜OÿÊpzbØ×ÛÌ—æÐzý ›2Æø~à‡­ g}{¸ˆÂ’½¸—ömͲP$V:xPE?È´–ýXؚؔ”sýu§,ã%“éuÚWûä׌=ñÆ«¯üô}æ†[¿}ÃÑ 2ÉÜ}ž6ÿÜ oýÜ?ÿòɇ ñr’ˆ®}áÕ§1܆Ëz–•ŸYé-ʘPªsÓ,¸Õá~Zìݼû¾ïûAz0ꌓ-…Šb%£‡–Br§©QšØÞÄ‘²ISæÕ¶=ûÒ–D¤zæãÌηßz»‘*êÆÏ;¬¨soÉÈQ…е橧Wmjéjû!åÀžR*›>IØZ+ý‘Ê"¬ M?õìÃóuý[Ë—,Ùè—M;낳fŒ÷JO…òQ;6-éµö1 çN:â𺺊“¯»jfó†×ž]¹'U6qÁaƒmTTG:·,~ri}ÜQF¨H~LÙT"az ëbò†6}¬z÷×w#9K¼ÂYGMIm|f[ctÚI íÚ%kêCÂŽê)'ÎW_¶øÍ•[ÚDU2úø“äE¶<ò§wZXD Ÿ2eXÁž7^Üège›‰€.6vÚ¼)µEÊoÛ½â±ç6·©ÁÇœ:./%…e¥yfçŠekÞ©€JFNyä¡ÕÅØ´nÍò×ުﲠcu'Ÿ˜YÕXrèàJ¯aÅë[»«¦wôa³ÇÛ¼s#Sê×<ûÊM¶WíwWÄ_•Œš2ûÈ ey¶áÕ«–nlK1ê¼Á'Ÿ>Ý_ÝRvh]¹ª_úâ’µí%cuؘ¼Tã¶úü’`éK¯î1 ŒÅc¦>ÞßòÔޮЫž2÷°Ù#=“\ƒí ÂÉήΎDŸM@DEK',8yzÓ¿¹1€yùc>¼ã¦lèàR®_òÂë{KVûÖKK›’±Ñ3gT™ÍË—îHvvuu&­d{Ÿué¨qS›TSí›ßzãåµmê‚ÚI fR‚‰¶-‹¯ÜÜ’HÔN™;$ÒðÄò¾RyEµ“>vp!¦:6<óìêíñüñÓ§Œ«"–T•$w¼ýês«: yEu“š=²®Ðoܺú••Û›º…¡`ƱGW7í¡Ç•™íkW¯‹læÔÁ14MkV¬X±¡Ý«?ÎhÛœªYõo>úÒ榔®uè¬)£†aª}ÛŠe«Öîò¥hÊ¢Ù¸.)¥Žík^Y±½9*oøœ9Ó¿aÕ²+7û"‘²Q3O½fXÞûÚ#/no7¢ŠF6còä!Ñ më²e«ßÚ”N;ë‚ù³gŒ‹”Ÿ,e#vnZñâ ÛL?ƒJüøÎ%O¿ýî¦zS{æÏvÅ'^Xú¥¥Aÿ}BÚ7½ñ×?tݲ Õ¹ÙÞP•Žœ2÷”£ç1¾xôéÕMo[÷üs/ì¢Á¦Íž8¬&Ït5mZºüíMFÐ4zþÔª„‰V ©ËOì~çå×ÞÞõII‰”ž0óȉe¶yÃîüAÞŠgŸÚìM\0oöˆÒ<$ˆo{éo¯ïiº?¶” ¨îè«¿~Ûy§9ë¤3οö„‰‡ÞÕÇŽš±àŠs'åGó‡uÁYófÔ(c#Uøåö?± ÊcÊ+/+‹HÔA• ;æºÏþ»_ºí;_ºí;_ú·ïýûµçϪ)Ì-¥“fL?¼nò‘|æ±µã'RÖ° üd"ø@là'“F„ýD2™ ˜!V=úØÏÝtñyÓ" >糟¸p\¾Fˆ” ;þ–ë/½prÔØ,Û¨`ü) ŠÖ.ÝØ®\rªH´|ôŒC¼ÕKßÞkJ§žyÆ 3˘Ik Æ~ÅÉ×^tÞ93‡”+PZ2÷Ê«Žœô‰[Oœ^¨”Öš¨¨vêigŸ<¿R ÷ý¤²á‡]|å9'‰EòÊÇNQ‚Ј3/½ü³çŒ­Ê/?÷¼«O®.R«>ñ³7?wxÙ ±Ç_}Ù©G…ÀÖÃ/»õó_¾br]Ä`^Ii”ýDwçô n8gʘêÚ© /úì%êb(A2‘4†m$)ß猽“é."Çë7¾ðà³+ÞÚ¾ûÝ•/­GËŠôž¼½+_|cé–Ö¸Ù‡—–mà§Ra¤RÝI?`f)3a̸¡E5SZtýYÃ+<ˆtöíÿvÙÙÓ«òu¬¨¤¼Ì“~K$6xâq7^sÆ‘%C§]üÍ/^qá!y„b­ |ßx53ž}銂ƒ êãcK‘æ–5‹_\WÆ»^Y[ºpæ»Ï?ö›[õÌñ¾#É6~à I‹Iµ®zöñû~»Ö'ìÛý³ £·¬{õ™ŽwÓ¬Š‰Û:’¹ “»Þ|ô®»ÖëéW~ñ²‘Ã*Ö.yçÉûâÃgOŒ¾öÒc¿µCEaý+ϼ½{Ü%—~é¾ßêd*.Ó²ýgîÿÓ¯·yëÛçÿÓ·ßi3*V4lÚ¤Qy«gNé†s̬ÈÆ{Ö4Ç ¹¢}U‡Ÿ[Þ¶fíÛÍ)cwlPW¹~ø)GEÿü›5µceñý‹'./1rƼiu‹WW•Åß|î‘Ž‰—N¬­èž°`dÃòw¥¸Ììyb}7*/»èŸ€WZ5xTië¿}à×$âqýTÚ»ç/íu'Üt˼š’X ÍX0¶ûþ[~úÚ®è‚ë?ÊñGÖýuCƒÖø-{Þ¸ÿÎ?·±§5§âñM{hÐ!CÍÓO>üÒV ¯Þž! ¢Á³ŽÖò»[öÆÞücoúüqÇÎyîÉ-õÖO6í|ý¡Ÿ>ÖlRÞäóÏ8´`û÷wq|è)SŽ?)msÁ is&5._±¦™)¿rÜü)Þºüðg[` ¸¹fÀID*9óÄIÍ÷]µÊDµvvŽíÚ²âåòT‹(OaádRÆy§l¹ q‹E“Î?´¤þoÿuת¶Â1Ç\zÕÉGÿýñÍå“'àŽ‡¹ë™¦¤  ¬3Q¬ïM:gîнûÙæ zÑêñ£KvÿõÞ;Ÿ bQ0É$“0'w®yùáŸÞ\ÙRöÿfÏú×xÂÙãvüüŽ_ý}kù¼«n½náØ——¶°Âvówß·lK=k‚-íÞ¡£R+ÿí}iâ5±AWëúÇïºwÅ®ní‘IZß7FBŸ¡9\MEu“N8qئ}õž• (ÛóŸ<ûÐß¼üæˆÑƒŠZ_ûÝ/¬jã ‘i…bƒT*Á¼ºáK·ý×÷¯oö l€W ¦£qË«yèWë‹»¹û²éåØ°kÍ«߸ÙPÕ¤3?uõ¤ 5+¶ÛY¿æéGþüÇõó.ÿô'æO¸gɆ¡#&nøü]ÜÚaØø­ Z·/~èîn(m˜ù‹Ó§ü¶í°Ó¨ØþÂÏÿûO» g\rûs¦ _ûø;OÝ×9dÆ¡K^zìw¯tèˆ+œHѼ¨G6Húa$åE”êº#?qt÷+7½Ùä "(OkµpŠíرæéL^Ýè!ï¾ðȃ+•j{ãéGV)°AdøüËo:aÌâMM-‚¸wñÃÿù©-§rŸÀº€7xҌك[ÿ~Ç·ßU¾püé×”êÞðúÓëŽ?ú¢Ãf.¾÷á {’p°NÉÇDK¡O IDAT xU­b¶«~GGQM²qí–í[÷–ÏBȵ̸½a×–m Š‹ÿgǯ¸¬ßÙ´—éÀRÐÞmsü¥s{CGGÂ¥ºãh9‰\õp ¹†B%wÃñßÑݲµÉjâ-kºóO©.Vï´Ûî+tÊ%L^4æ9ð›Ø„sŽ­i\öÄš­)FB¦!GòðmwÞ¹+΂ÉæmÍ0Æì9ù§}jäš¿u­ì|á©åƒož3d쌞RºÆãݱÝ+·mß½R5{NÅŒ“ŽòáWkj½®w×6ƒRØ Ž‰]›ßZ²÷øOýçwç¬Xóì£zðnéÚÝâæÀZ‰D¡t¤î¬ohNZŸ›w5ÂÄêê"¨›j]¹¤- òØZ@¢°–:õ82z9üU´r¶ïijñm šw7ãȪÊØ &ÙºjY‹HÖR¤¤¢Ì¶nÙYŸ4º}óÒF¬pËË™tèÜtÏs»’JÇtAíÈîú•­&EÍ{6´VÉÀ]<á¸éÑ7þö|=j/äy—ΦÆÍ›Z|@¡Þ õ…ò +ʇN;sÖô…g1ÛĶGîñ¢¼õñçôw¯üÖ¯YõòKÏüéÙ·wt°@”.¼é$^òí·÷t‚';7=ûzãy·ýâ/'­|éù¿Þûìº݈ljw$E8ÙÅ‘X„Jëjc¯íh7ÆtîÞ݇•Ñ’&FɵKwµt[²,®~-¦åÒˆ~â›7íhK!!§#û=²Eˆ?yÈÿ>t* Ç6çÅ°õÍW×zó•ßû¯yK–¾ñè£O¿¸ÙFj'|âg?8sb~û²ß~íÖß¿³'ÙþÖòçÎùƽ?XûÆò—ÿòØ+K·1ˆM&;v4[‚îÖäjÀüÑG\þ¹«ŽŸ3Ø#Q |Ö0&žŒïi @R- ©Èøá°xùÒçÚ¿ñÝû'®^úæ =¶xùN0ñ–»SlÚwwB¬Ð+¨TFmËڻߴ4ÖwN­*& ÇÃI`º rdü×~ýýs†æ%ÞúÅ¿uÿãÛ˜"•ã}ù²ü_ÝúÓÚŒÂ÷ÂDÙÒ'!™˜Û@ÀZ)Ÿ|µŸ»èˆÉ•ŠtÄlÚô¿JÐl]·kwcBP1[è©M“Æêx…U*Þ°eg·XoÓõ0=ì•.q̧NìxñûXš”ØAzç‹– LÉ‚ë®;í„ã*SÍVñS[»·ýa‹ Tˆ:ëLÁ½Ï¾®¹0»*<}ÍvaU:dÞ¥×Í?4âLoTºñ…?ÞóÀ«»;rš^9ð;Àat[úÜËì*ª#Å›NÌ«ŽB*€Q¤ ]­R‡™­wÒÌÈúGWmÝ“BÔ@EÇ^wz쩯¼Ò`E€ýö†ñšSçV.y~­³àÈj³nÛº·¶&N=f‚Ú¹b¥™sôؽ‹—´›/u ½ðÈõ/,Ù8yø¨qE¼ù=¢ÂASÖÓ#•Úóú/ÿýúÇÇ:÷ð?ûãÛ¢çÞqgdc¿!ˆ·a¤T“XŠÆÐv%}À(ˆIqo.D éæÃ’ðˆ€H âbãœìR‘EÌ,¢ ’Fœp&6`­Iù:‰*f†he¾£*9äðY%õ+z­…< Â&ÑEžV(€ bº²7WIž@ØÄFÎõ츉Ó;ñ”Ûn7­7ÿ}UÂßûîÝ—ž÷b’Ýq yÍ]üÈ´C§Ÿtæ¢Ï\ùþOžÜf2¤·r hÐqŸ8cpýc·Í½g=Œ;÷+wÔx*B‘|-–Á+ðÐÆS ˾{Æ…š>yÆ)g_rËEê;?{©%¬ÿ˜1RIƒÑ¨&°Œ¤#ÑT*HóŸs(lˆ ’Z÷kÏÿŽB°Éx7 K´züI7^1vÇŸ¾ð“·"‚\Ì" ÌÖíá"w©™EÔc¨rHz uÖ§Nñ–üïuWµò•rk„ŸBÍ×l}‰Tä¥ ;õ¤ÓÎSµùþo?¼-ˆzJ" ?.q©ˆnyôÿõø’ Oüø×Ͼ´äù{ÿÓoÿnÉÞ ÑÔ;d|¥æò¡#G/ð¨hRT2aÖ°‚¨v…®û¸âmó–§îüæ7?óÕo}ö«ßúìW¿ùé;~vï{¼xkŠûzð°ª’´Ò•KG}26xøó‚#ëÕ_xòqÇO‰±ÔuÌÄ¡j÷šÕë·µ@, L%ó/œŸzò±ÕÛÚ@@¡HþàùG>¶¾¹ìíÝ]‘/G u½½lkáä“æŽ6zÆñ³«’›ÖµXÕ „ƒ ÞQ6¸®¤Ð‰[Ž³B¢¹ʇÕDtÕ!‡*/÷Bé÷·w–6¬¤(J(»×­j¨=çË—NVQ3nÎé×>¤@Ž›:uÎ!ªiÓšZU,!çRLuuvµuÄ»|—>˜7jÂÂ…£ƒï¬]¹)NäEr1‚FºÚÛzðô#Ž>¡’•ÖN;nÁÄÑ#§7«¸cãÚf(9dòÑó†%¶½µfõÖ¤RžGýÉÊT°wõ[m%‡9uêØQ³ç6ÍÛ¸yƒˆIuûªnXEi¡³6l"ÞÕÞÑÙ `¬vÂ)Ÿ½îèAÛdMþ A•ù ¥?X½‚²êºòüX´ ¼²¢¢8B"‚U§ý蟸tj¡ÆPqI?°ÃFVj`f"ðÛÛ:ƒ¢±GÌ™ux‰XÐ&‹ÔžõÓ]¾hb>!X¿~ÛæÆâ ϘY;vÎŧW²1AÑìóO9ºxéý.ÛxËæÌ0~6—EvoÜ¥†'êwnÙÔÒ‘2Jµ-ù‘õŸúÔßÞ¾«›w5w§,Š í~Ò€~ë¶WžXwå%w|ç¸Õ÷ý÷Ýo®ïì³~Elª«#•ke÷Y`¦»³ËKZà ÙÙ‘ôTÐôò£‹G^qÚîš·î…ù‹Bl|ñGŽ=ù›ß?n÷+¸óo˜SmÝ*vÈ5ÿ}\¹·ô·_¢Á1pDòkÆŽKÉúTþ´£§ï\õ› »’èhŽÈ+Ÿ}ì‰y/}ãñ½82"Ž75ïZ³qW°cókÛ6æϯnHabû›ÛÇw¬^¶±Å¬Ù´-ÕØ–d¿y÷Úõk·6l}£qÛIÃÍêí "€­4±`u¡FVyƒgžxú'/!©u¿ºûÁ]F0èêèêöY@¬ßÝÑe¹sý¿xî¢ó?}{u¬ýá–w‘ŠmíqÃ"”.ñË_Y=õ²¾³°uý“?ýíýÛ•WT7nm+$IîYûÀo^?÷²ÏΈ`ëÛ¯ýåÏ«J+¿½µ£Û¦ÏÁî7ž|DÍ9WýÛ¸¶††eùÈl öèÓëüwîYÕŽ]¸mÃë?uèi_ùÖÉ)¿¨¥}w<B›lXóè_vžûß?fÃC?ùÎÓ»‹¦O›Z¹ûµG;-f|úÂÉÎ®î¤ k¿ƒ¤vmx깦S¿üs÷4FZÚâ¾Ú®=«ÿþÔ‰g|ó'®¿ÿÇßyn×Ë>\¦O9í†/Ÿ Ü]¿øþ{˜%¯öÐ3¯ZTQ¤ýöÏÜ»¸+àè ÇLægþs]sÜbHÙ¡ ꦜ~æÅÇHü5¿ÿñª¦.[•êîêôtwtùVaë‹ÿs÷ëÿôO·mÛžúÍ{R€(ÜÝÙÞá§C€€dâõo½¸Æ\÷¹ßü²kÍ~ôƒ×Û¬Mtwu%3xeÔæ9ò†K¿ôÃ] qlßÓnA J»ýþc7^~ó׎Zõ×»îæÕ Ïþìw%מvóÏN¤Àß³öÉ·E$Z=õŒÓfŽÌNìzò¾×ßêèåRUg¬bÚy.ºQ#¥6<õÈ’5íPP“ì舧ÁïhoKRPÿòCÏW_|Üçî<¢¥ÍoZ²)0ÝX6õ’oKlyú×Oï (?¿zæÅç,ªÐˆÉ5þiù;Pn’ÝΠô;ÚÛ üwº÷…ÒE'ßñe2Ý;þ~ï+«›@H-‹Ÿx}Ìåg|þ®ùë^|è±ÌïWB*ª6sÞØ¡PuÉ¿O¤Öußùõ¿7ùý4!àè㮽òŠ™Ã•ÉeW—Ž}áÁïܽºÐ‹TOœ0tG±vtÕ@”ÚûöëoþÉ ¿õ»3v¿òÓ;±ñÉß¿xþ9Ý1ûÔævl\¹=a$HuutB—Y¡bµ“&”½S¤ móÚ×`èçÝzÇ {¶®j¶hÙPÕ¬ICÇNþ™Ïq=›¦e¿ýîƒë÷&büþÁ×>j¢ÿ­ndMª--ŠØîxwÂ"åWVW–FüD’™“í>Fb…%ÜÖЙ`DtÕf#Ñh´°¬¢¦<’M»â ï¯c¤¼¢ˆ’m]¢EeÅoíJ0­¨­,+ôRM{÷Æ¢å5Uw5ìiQ#æ^rûE±û¾uï;/h­ßÝ„,Ñâê2ÏïhnêfU5çÓß8ñÍüð•u@ˆ"­šwãõǵ<ôµ»ß¢ÕL‘‚²Ò<Œ77ûeÃaÃΖn ±òŠRêjnçhaI´6¶YÁ‚ÊjëŒKQe1tµ¶Å z¥Ck±³±­-Å"¨"ùeåe%yšl¢µ¹¡±Ë2Ä*+¢©ŽŽ¸^AYyA²­¥;0F+×Å(ÙÚÔXß–°‰Äòjk‹â;w·Z¥‰k¼¼â’ŠšŠ|m{›’,¨"y%ÕEooiI "€¨XQemyLKwksKKÜ ©XUmQjoC[ñ¨cÅåUeE±Š7}ö²ëïø%œõÝ›Ë_ýÍ}§Ûf2‰Á+,­¬*Vâû)6ÉöÖÖ¤s6EŠ*«ª‹=Ó²kgrØ ‹NŸ{åÎ_-ÝiÓ$S¨ *ÊT²½½3H‡ R\^UU~Â÷Åúm­ ¤hqEUu±ò›÷îêH¬ò ËªË ¢Šýî¶Ææ®n£‹Ê+*Š¢Ý­ ­ÝV=êükŽç»¾sÿŽ6›Ž{ WTZQQõ0ˆ·5ímKÑE%Åy˜hkOX•WR‘'m­m) HqMUI¡gº;ZÚ’€.­ªôâMÍ “®áŠkjJ #’hܳ»3°â—GL[KW¸Š —_V[Yà™D—AHµ6vŒ‘âªAù:ÕÖÐÔÖ ò *«ÊKbÄA¼­¥µ%Α‚’ò²¢BLª³©©­Ã—\™²èå•UUæk1Éö†æŽ¸:RX^êÅ›š»,æW×–ùÍ{ÛÊ+©*/ÉWA"‘òÁ$ZÛã•×<ð}üý·žx»[Í ­I É+«ª(ÌÓbmõÍÝzÑÂòÕÙÔg,¨TšlÚÛ0ÆJËË+ 5§:›Ú»çàÃhAyUEaúÍõ{»úän‹€ŽT *Rèü´ÉÖú]m.3°Ï‡ÅJk«*¢ „6oÝÝØmP—¤ãÍ­- ›ÎãhAyMeaTù{öîí–HayuyATRÝ)k%ÑÑO2ÅòËK¼xkGÂçL¾> W:¬Vu4µ¶%Ù-ðòªÊ2-X0î朽óÓ·üçz©¨©(É‹(B ºv5%|9¨¥>ÜëƒÕDÏÏr¬ˆéHÿ'Ní_ýÃ(_’]‘§Wý£ Q¹ uaûÙ_ƒÅç_zÇø³[~øbÊÓ=e²Q À¢*&MlX¾1$'hé¨)£ü k¶·=¼Â¹Ê»Ç<ö©ÔSqª¬ÖŠ°eARJ‘B`GHˆDbe–ð1Æ8Ç ³ y‘ˆÊêOï—ôïD¿‡Ò0˜yܱSûqU3uNùÓŸ¿ýÙ†¡SgU5½ýn}¨í>oŠÕŒSiÝ´vGTÿŸâþZës;Ç÷¿E‘ŠQki÷º FrHFÿfËä*Ï“³öV¿¾aÿÇ`rÊC?,In²›\X¦ìeÒCÏÜçI¨»îOßOþø–?¼Ø ¹_Ù·µK±wßúÀuð@ú›{ˆ¨__úJCîe™kIfßëSb­×£5“Ž>iîÛnʧ;rÉÿíoëŒÀ~½=¯\Kéýí¯=Tݽ+Äõzl ,Ó‡1£Ùm`ŽìõŠìMRÛÞüËßa‡Uԋþ×OmóÚ7A)V)D”Të†×—¢c$ÌT$Ëù1ü}~Ý/sYHY ³‰ %=¬ŠÀ‚PÚSÃmÁ@ŒxŽ8ŠƒTŠÅ(ì À@Üÿ|ô¿Ç~¼³³S•¯ô›žý¯ß<» ÉÛ¹êÅ‚Ùö7»ÙCÍÉúwWï$¥²k»åøé­í·¸`Ž[ì7­_Ö”F{â€Íç”­ÜóŒÖ7<À%°oyÈ-íº¾0×}¢jеü?›­ñlhî³µ}.ÅYïý@T‚¥ƒ‡U¥ xX€»6.y«58ÀÑÌ!äºLû”ë ’ñ¶v)]Ëí¯~ï»;…uÒÇ9.õ¯ïÊDI5l]üÇM {Ѧçx’T:òŸÙC{nýc =¾D@Ö‚ #ÛuÄNˆ!-!Qø‡;xžˆ(çIÈ9?¨¥þ{êÈ¿F Z+D¡BÒ|ººBF¨Ðæ#H$€"‘šŒT âqt_Ë ?”Ïu¹—ÞÁÕñ\Sé6õ"Ç›ëãÍõ˜9ÿXØ7º*Ïã –:xå´¥ˆ\rSøßž‘ôöòC~~_·{$Ñ(DÖÀÁå\[Ã6Íú†¨”¦ÈÖX¶O#¢°k‘È¥r Ô‘Œ†@ËÆ—BŠ´ê´rÉ– 3e];º×Ÿ¾ #( »Y¥#ÞÅÖZfq«RÄXÛ—œÈÓÚ5ÁÜk«'ÒJ2³XczòYúŽ£O³¨´Ò*#¶(Ö÷d‘†#’ûH3Öž¢EdÙ²5–Ay™ýU¼ù.iV)½Þ„5,!ã)!`X¿ØñŸ)íyžçy:]±ZØN” ï‹8âW@ÄôçØᕤCx¸ÕÚÓŠH{Z{žBç9ùPý¸ˆ®"±†~ضÔÁë£[î™ Sx$UšÐôh¶ÌŒ:ªQ´vfj¥¡0*% €Jk@DB"¤À0xHJ¡ˆ"²Ž}”\=ÕRŠ”"ÎêBFI „{tÈ"”U" D¬RDˆ¨@)23¡5 ä!‚â”±¢”cW€,6ëmHJ +IiDlöZqK’ûù#ÂzçîÔÞ»Æ,)E”U77Ë'åÊ"“Ò¨Pi üp+RnE2"3ï÷ŒAØZfñÒ‡[éûÄ~ÔóþæȤíIn0'2cª"Â@)Ô=)¸9³+ÓY‰²S§å »*²Â J*Q&¬+H¤´@Ÿ’Òı‰4e’ôÜ~þO†óŠ9½ŠéïÌ™ýª‡°8Xúü&Ù# Ö@pÔDଠ»*4Ȭ±ŒÊSŠ€Qi%&°–¦Y \Žj¦¾¶k.}b°A  =­‘ˆR˜Àª¨—éBî<~Ì O·í)DRHé óîÅ„(¤ô - ˜'~ &TÏòê©öåêÙïSOÔRO…%‚ˆˆJ¸ïÊVœØ†zŒD+B*­Ù \uöÊJ¯Zey'öéšq„ÊÎáÔ× %–Ai •”;”súm" ¨ÉUɬŽ832…‹€-³€BR’¥¢2ƒ`?xð„”±–³'D±}Êù³± á@‰ô)xVJ}n [ÂJ)"—¬•)Ô‚i]«2£w !Bwr¶ YæìLWYß#tté,NÉ!°eËâÜWÖZf BpÔ™…”B±=>HRš@XÒus)@ìU±œm`ѵÒm£ûv0&ÒŠD,³ POºb¨#D2š¥ Ä}%éžPBÊÀtVzî…yÚ¤„³…Ãyù”"c [v«"½šÜ”Yc9ì}Ë«Ç(bëdC!%EÒˆ[‘&’ûÃI8’ÒÊk- ’¸ñ?7£rD¬!E™òÛBÊÓœ2Æy8°­,"N‚„a$MØó‚°—¾µ–½¬åÍÖ²›zçÕ ¥ …kˆˆÀ9@ ‚¦Ðž½]¢Ö ®Ö&N†i/4"*tjXÓ’œ­ë8ŠA8 €À6›Ëzüþ圙;9ì-1~*•J%S©ÀšU!Ö÷SÉdÒ÷ƒÐí݃·îq‰ˆ»jLÙtTØ°–QktÜÖô2.œ£2î„ðDŒéí²oI“î¡ÏÛp_ñ_ÙïŸÃÅѧñ\÷8éÄš •J¥R阹‹ÓYøá]Ë™›A`Ò:Ðé1qÞWwCz.+ ´ÂLÈK0‹óÜR&ti¬ …çhßó}ƒHŠŠ |cDØŠ+ƒˆÈÖŠ ;ï1¾o,Rn?v»;Û²ó4÷ñ²’B6–­³L¸Å¡sš‘RŽž1œ; QÄf&Cÿ¥X?°‚J)a`¶ ,§¥Ó©gÒ”&‘s4=ÀlZ©åTHë“ »ˆ° ß° iÏÓ.Ú·t ‚Xc%•° Œe4{¹¯2~ÀúälàVœoNkD1A„¾ÊìúlÙÅ{²DHkíæÎ% lÃ^9±FBIã§Ò•U$» "ˆXcE„ߊ°s Sš›k G-ösYRHRÊ@b ˜ÙnlH…êŒÃ£ !NÿV):ðóA[ê_R‰)/â!ˆ |?àЭ¡"žçhr‚@0â)=¿l™"^Ú ø¾µÊpÞG´›YÐsTb £Ö„`{D›Ái±Ì.,"Ö0¢Ö Á~ñqUe‹Áõj IDATf{MÞS³ ¼Xž‚xQgN0~*•’HD+R‘¨riñ}ßó"Z¡Žäi÷«P˜” ö<…ÂŽá•­ïÖmM(iNªžˆuÖf™Ž©‡^à4t’ÉE p`…)tƒ ´±ÊÚÄCsعӀH{šDDlÊgòbZ!:fvE‹•&!„U¶Õ˜ñG¡RJ¡"p¼Ý^hDIYÒî$Ý· XhG› ªUhn ˆÒ‘<añzaß÷9ëQètTŠ8ðS]˜÷‘ë±þzI‡ R Vž¢Ð…ÖOî%$W%$`“Ð=~!""ÐÓ¤ˆ„#³5¢"˜–:HÄ&|Ë‘HDeûÊÒÞ‰^—ÒžbßèúU÷ ü”q©h¿cf»(úi˜4O¬Ò !M¢Ža|ÓEGÒ”²ûs˜;±%á”M;C”ö9 6 žV½¿…­Äù^n*Iéì/éÙe{Í‚XDåyŠ­ñkY)  ¿º°€8í,™ÔjÌÅÆH „2äóáþ¡¨§“ÎE•íEÝïXúžúÃÓ‚Û¹EœÚÎàEM8öH*D¹öR8ØçÏý½§=Eñ•[@ÖZãû¨½}3ðâC—åÄG@gŒDT!¬5Rí[p~ ö¥”°1,¹öäôúp‰*&`ËLi7d,£¼ UAôØ“Æ*E DLbpÉ&(–­;‹Bfá”ZJD2&ÔAßGf29M$ÂÂ’I× D †¶µB°VB䎲†ÙZ±Vˆ!› `"°Æíc¤=b*3 `z@ðD؇0hÂÂ$~Ò±ÒiCLØP¤­$6Æ Dl ‡çLRŠ”&±Ì–,‹(¥1aÕ=v‰±n D+äðñ÷ÒMÙD!=í°²¤ñÅânÌaÔ…0i­@¬µ‚@Àl i…(lÙ†1NøÀŸ…”ç‘6Î++lØ9ÄŒÎK%ld²sÒ(°\.úm¨7q,âðá‘…5–™Å@ÂSŠPÌaN„D@ÒD5&ý¼KÓ!0­4šze…md¢ THx|!Bfk *B‘m/lM ò<­ˆ”Fcq:+D¤² ¬(¥Q˜­CD‹µÖ¨H”ek­%Èh8¹caHÏ©dà€Òß¾ÍÖ»ˆ‚ˆîà‘ ÌöŒîÌ|pÏR@Ò¶*ÄCRˆ@Jah?a£ÛGÕ 3(J¿Š9]Å‚H)ÅVÂÓP:P™ù# ³"ç‘o¬± ˆEØZb)]ßADÐáaÓ`þ4º”3“æ¢x.Ó½‡FÛIK8}Àiì:ç·g D@\Ö¡1AÉxaf ÀvŒ”BWW@Ø„yÿx×ýh)gðaÚÂÂÅÏ–C¤ ä/ Á°â< ? ËKÆ W[îc˜dÒ}œ%@½2üVIgu~Ô : ‹WZBH”RŽ÷ÑX¶\AB@k¼WiOi ¬Ú–gåPßi@6)‡?øC˜-38e+Bè¼_™Ýµ—ßBAˆ‚wû 8@A¦‚ @ÊÓ`,QNÔƒR a¼$HNU„(%¶iÈþGû ‚e!ç©Ð ]âŒS9Æ2‘“8Êd­€eãpø¤=íÒxÈÌÝjÏe}9â¾P‡:ˆ/§TJ)D&BkLx7âef¤©õd“ ‹##Ë.Í›´Ò„ÚkÙ!í9SH”§Å0[+„ʹî:E‚ŠD 0Öu”H‘V¨<µÆ jg&g{¬2BÅšñ–XP)f!ÔZ[k¹¸Ï%B¹!BEƽÕ°PQînöv©QÏ)¢Âni/:€ˆ©Þ=q<:Gº<‘:@_ä¾äPqûkD@GÒ`*ê˪%ý?Ü<²8”é×jßÏí‘>Ü—$ !*EÖXf *â°”JR€ P9×R\¿bPD d†Ô˜0r€.6„ZkmÓ­  BT™íÐmòˆh­X‹ µeZS.S)PJ3„­ií€p৬…(’¦›+ÄA yjBYÊŒ™Ê!ŸHJQŽpM¡ï9—²¸TST²‚£èuýâiéÈüK¯)UQÏcîS‡‹7jˆ-+MZD“Ó˜ÎÃsÛ±³:t5 +VÔBFc ‘A?˜q8t¥µŠ"d¦ƒÂÇB4Qƒ"=¥$KÜ”&°¤ê€JGÀZ°”R:ÌVAh÷¹ÍBG0# # CÖV °'ns°6DXhMðêø1ë‘Çœpbõž¥Keá9Å¿Y²¦©¨3¿rÒ¢>}ÌÞG^(eºê·¾Dé)¦ŒØCªÛ“…ÎýÖ(F«Fwó'èzûÝf]V;ºpë–?n³ Î`ÎXãHç=¹A™¤ït È4í¬KÆn½gÃÖfæ‰ôUŽ˜?êÄOœUÞÞD«‡žwÔ’ÿ½óOî„þK¢¨nÖ¥7\¼0ú® ŸsßâNûa–Œ &Öñ{ßáÌ÷Ø«°Ž»=*çbßo@ü }xzç½ ÞSãïq¤(Œï«[˜Å{XcP+ñý0wʘpMÌ€ÌÀ Ž<Ó1j@*ÑhHž™õz@šxÓý‰ôm \A À}¶¹Z‡3w g)̽ú¶_Yy/ÓNƒF• ÿÑà ¨‡ˆBJ)6lmÀŠÙÙ¥ŽË0BYòýpd2Óa-Š€çs8Î"èyJk±±o@‘Ò"Ž@öÙôi-=k!áj¦ÐS€Ö¹[Ë¡« "øÉÅZ ÊÓä’À>VasTÚà 0Æb4ª(k:²g9÷8;fTÇ3çp‰Šh­u~~ø7Ù­Y{ ­s_ÈLnÎÖÜĽ§ÖR)H¥z$*íà*T¼w-e’jâ'õà5ãØÄÙ—æG1qFÝľqÍÏëu¬’D€"¥5Cë’ϦÚvo F_ò© N«}ê‹7¿?÷º›n=zÃçž\Õ¤J?eü;¿ÿÑ•lNU噾”Í"~²ÛTN8||uÇžD¼3ÞmD”Î/ª=´ä‰ÛnûÏúô‹¦?¿üåõùgý–È+?ºõ+GöÚë>µãKÿþ|B¡Ê/}â¯}îŽËoIUVqãŽÝW=õÌ)ŸùÔ˜­÷ÝyÏR«9öƒ KÐÝ€0"rªµ5ÑoÌ„tiU] ´¬Ý/«ˆì|f…?½*ï¯ ©3៳¦`>Î(št 5¥µÊNüpK½1×ÇG„‚‚^9W›çõñ|Bf›Ë\ÑhÆÚGký_Jùùàxûn-CEý¡ XÚ…·êñ,ö<5ý§#{œ3w2㜕±ùù}¿5çtXk9d`ß­õ—}·ÖGBá&¥#ûžªÜZ µ—XõË/_»ç’óÇ¿õÄæÑgLÚöÐC¯¼Û”ÒçK³ÖªL]2Ê<óÔkÿcšU^çúG~ò½·fΪK,{þÕ—–ïŽ%^<|ÖÄqCŸYÝHªuÅS<³b}3{­mØ¢e[6,¾÷—µçž~ÝçOfÓµóù»~óÌ’v@j]þÚÚÍ»[½Ûv¨Ê²|*›9¥dûßþúʺ >üíÈ ‹fŽÉze2 ¤;Wþþ‘ç·v¦¤«…… !!i€îÈÂAàrúù‡•ì}ö÷kSýÃH:–‡FJ\ôÍ“Êÿë{-–êò¢ÿ²Ûû~Ž™’•qÆùÏŸ­¨ú^peÀÄœ^؇\¹ÿü[ƒt6Ù@"Õ¿©B¨?‚ö?‚>J_ešÀý|ÿ<ï³5ìkEìÿ¥ï©µt•ÃýNTn-• ª.øÎ×L?fhþ˜±s+‡çíÒÝ]ßûÅK¨É¥¼désÛµãÇ|ÛS Ï“ «ÅTåQjo"e@üd¢3QXsMÛúÿÙûî8«ªsí÷]kí}Ι9Ó‡¡Wé]º"( ,ØÆ5Ř˜˜võæ¦ç&1æÞÄD£Fc4@A¤¨ 4ée˜Ê¦—ÓÛÞk­÷ûcï3A1ÍÜïÇþfÎœ³ÏÞ{•·=ïó´GCa‘Ÿféd dÝŸ}¿°ßàþÃ>óÅ›¿±²ü¶§´K*¥AÒÈc™¦ŠEc€¬hDŠ9>¤R¢¦&!;ëT.ó.vV¶z9JC—Ü|ýҼï¼°£,œ¦bè Ç e[À!rxËÇ3ƒì:¦-Ëþ?+¶éVÀ”"G—GÔuF…ƒð‘J#7ÅY!±ü´¡ï©ûB?}ÄÛþ9gþ‡Nœƒ§^Þ¿ipüqCy&OþLFíï<ÛǾxê—~³¡Ü;ëgÉ{ö¶Øþš]Û«,»åðþÝÛ5lj¥Ù¡xW 7$; 4·¶·´CImEÚÃ2#?ן!DfvNaf0sŠ\zíÞ (2nø|Ü6TìÝýîÇØÑù HFÚšÛYv~F`3'°Æãm‰ÿÛ’Ð.ʬqúpA;ZRn ÑY qö8{œ=>åCœÆJE÷¿þ΄eŸ=ùú.vYN°øíõ¯íŠiÖ››«½‡i2J®Ûö¿wlÖM³ߠꌑçöoYw줃Žg⣵VÑßoì’[æñº“ÍqcØ‘ƒ«"²€s§1Ä¥AFá#»Kø¬k¯„Ãɱ— hÝÿRu’3È]À.ƒ ¶†Ìš=»š—–†U— ÎaPc#o|øÎsZwžÌ:kIÿ`]Ù¡]• @ÍŠ–ÿÏ£}ÞúÉï߶TÛ‰â½Å .½ùöÃÂ3¯òì|skJÃÿ±lX-Q`.—’’’˜‡sŽ€ÚJ)…Ìà€gS}g³ÇÙãßÕJðÌTÕîê:kpÙ‘ºâê„Â^wd²cÍÇöíËhTn[r¡«7¼¸ÆõåKæ ´›w=óôž’0ªh[ÉÞã mÖéeT( Õ·òys/šì¥Hõº'_SŸ¢ìȱ̓1 ƒ5‡÷§Z-ÒíoÿæIß­K.Xâi=°ù¥ö'"èèÁí»âÙ5ì²Û‹ß}ûàè+—Þ:ªeçãUá„<õøu :ÄúN¹¬ˆa¢z]º«<Áj+¯ÔÍQEvsÙ¶§ŸË¼õŠ¹‹6½ôÓ?½V÷O0R]Ù=cä¶("¦»Â_t§À6ë”fˆà(ìA§ U:‚tºƒ ÈU¡b :„tÈá.’ÚípÕ×΂þÎg³Ç§w`¯œß½ë¯=÷’ÉMn -5r! ~>­,K’0=–•ˆJ Ótd‰I+ÛRÌ0Äiˆ4IÛr4psÃc ʲ$1Ã4”´m¦Á´ŠEcÌôú S8-Ò:•LÇkvˆ”²R–ÒÄ„×ãa]S¡iÖ™Š§tGh( Ók8¼.V"IÂc.á8)e§,©¦Çÿ@å°¥€ÖÒ‘ qt!ˆ{½BÛ¶¥È4MÆHY¶Ô(LÁ´²!CÐÚ”%iÛ É‘¤-m ¦×äè¨OcLk͸!„stˆê¥s™²$÷ø ˆ¨ì”­¦pËxÖH=ÎgÞ‘Œ'þ°þ¹ófòX ˜áõ ¢ËGs:+‡Lx¼<ݺÛñ27=f÷fqdÜô~t)‘¡áñÝ«ŽžsV£óGáÉÈ`ŒuáeGæéçv9'žŒÓ@ÓvÉëïí ÈÌn`JD.Ì aþ“ÆŠH*©A˜¦Á”MJ:ôŽ®CH©5iÐÚ–„Ç4¸«eç98sˆ‚s©RR¦Á‘¤•”6ãîòy;¬C§í¦s9ÏFRg³ÇÙãÓ=ÎjõþûNjÏ¥~:ë6h.ÿ4tJt5w]>ЩR×!†îšÜ3²>gMÔÙãìqöøt:ÕAš[XK[’C¾ùwó´º4(šØÿGF–>Yä‚ZºÒ¥½Év=¯–¶EˆàÔ'ºÞG„¿·"EZ)L0Ðno9‚ÿÒ®Ò«r¸HÿÞ³ý; <8Â߀ÌÑ,ÿ·¿b¥Iø³›³Ç§o¥´´¥ΙVš›fG²ÈéêÅ3c0#Rd ]þµåƒ¼våæÍ;÷”EÔß±‰eÎX± ²cCI]ªûåÚɤ6}] S¤¥m:uµ¿eÛ%--KsCðÎM‘´²”ðxø?p•º†àÌ´ìˆqÓìBkä@ü»kR‘––e7ÓãŒÜé¾™¡ÃÀìè'uè¢ã)ÛÒ Œ´|6i…g/?Ÿön:Fƒ§\¸tFV¼åК7wW‡{ØIR¶e“á1>ÖsA"MÆÀsæfjF¸ùÀê7öžŒþmþI+e£éøæµ'-mKqÓäìL !zr‡^pýÂQÙP»ëý-ïMhöï»ùi…}λt¼¯ñðîãÄÇ5}k;™Ô†Ï<½A#-¥mK¥É‘'‚áiŒ¹¶-ËV€ÜðüôNŠÓY!L“áÙŒõÿÇG#¤ oÖeW\9ò¸‰ËîZ:ÔPŠ°{¾ˆºö õÂIîë%êË›r'Íž7wt.×ôwi°¬Y×]9qXf‡¾¹s!ªï¢ûÿûsƒ}jBZ{‹Î]qËâ F0rh蔣óROé§"ÂÓo¼ÿšcó˜êÐea¹‹¾ö¥{¦eqìüD¯§íí‹€zý*`Œ!¹RÝÙÆ&Mš´vùˆZ)Ýɳë>¥5)ç]À͹âÆ;ö!K¦%zŠe¢ÃüÌH)"tÄ^¢ý^Õiz²g\sÓ•ËF›¶êÐkbƒÎ[qãùƒòM+ØÖP“rÞüÙ#suÒu­ýcç_ß2…&ø¨/rÿÓÉ`kc5bÞü™Ã²Ô)c×å½_-‘²ÅÔk¾üÍ…ƒóL<ƒööb¯_JDÊì7í³÷\?.ÏÔ„ÔMž«·ûJk>)+Þ\ÕlùÇ,Z6=Sô2QN÷¥§wz¾ïŒÁ½h‰E,¼ô²IÒÓ=RE—=ðËÛ†¤—do6÷vñ<üƒ'þïþ‚I…\kêÍ5Eîuåß}úÿüÎÙã E¯€ˆˆòÇ_²òÎËÚ…ÓͨÓMéz”gö±³Ç¿$–B -•:uâèìª`lÐŒ ¸ß¥ZpÒÿÂÈÌͱ@ &ÑWX˜mµ6-@#+'Ç‹6ÏÈö*ÜÞÜÖ²ó¥7 ÇOœuzç&­F×½ƒ—3ì­ˆB„ffnÑ`ŸA©@k0¥¬‚¼Ìñs^3´ô¥,im ÙäË1zÊ… †Ö…K›T*ÚÚÒ’4róüc¦i0koÇl·oªóÌ]ø>@Œž¿`úˆöÊ7®L!eŽ¸òëË‹þøËÎÍSÉH4!ýtîËï“-8E›šãÒá¾^vN®)á@8áh‡ÈÌÍ5’¡HJªÒÔÂð™ÙY9>A:hk YÀÌœ‚’’{LHEƒ­aIZË*ꟕi•¶S¸àÜ—åÏe–bÙ¹™ÌŽ·4G³Šúž}Áü™Ñ†Š+S©¶¦"ÆyOž‘YÔ';ƒëT<Ðœ3θ73+ÓPij²}`ÅÛ›Û“RdægùÐJØD2[Ž:h_¿‰s/ZµÍBffõ)È6UÒo2°UàÄ‘w­A‡æBš£Xþø‹æMXùŽÒÄ3sò¼2…~¿’‘` ™9v°5¬Ð“]˜‡‘öH[Ù¡­uö)ƒ½]BF@ž‘—Ÿ“å;n ÄRŠEFV~A¶ÉÁŠ†CpʽZ°1Á-ËÆ´<õº”Dhdfåd›ìX$زËèSèÉ}†N†ZqK¡ÈÌÎ/È2@FÛ‘hJ 72òóL™þ“ëhk»23úŽŸzÞâižc‡Ã áXkk$&þ?™^¦bm­íÍË @ ®@øsýhÅ¢‘Æ}¯mˆÛýÆ/å]öo™Y¹ùÙ®Á@0”ЄÈÍìÂüLŸv2Òˆ$å)KÃQ1ýùYÈd¨©5–Ò"'×orf“¥Bí`R˜Yù¹¹'+¶Gm FfvŽ‡‘7ÃÃU¬­=³4!ž¬Â<¿Ï ;nj §œ|†áïÓw`&$B`(I(<9}ò3=ÌŠ†ƒíQDV~Aæ„9 ¯Yòâû,ik Æ=Õne 4¼Ð¯)mË=ãºûsßûCI“ìÁ§„(òg]þ•{Ï+_·59êüë?ŸL>¶æpm Y×ÜiæÉ+Êqîì evƒX"ÐHJòæäf{9Ó©p(ŒKM€ÌÌï“KaËÌËô1+ØÖJ*Ý=4t´„òós2¹´”R±pØRè/êŸãC'ˆ„‚„>›úü¬)ô?{òy“‡øÑÁ3Fe…cŠOZÐ-Yç):çÒ¯ÞÞºˋϽӖ" Ì1fD8y¤²-luˆ?óŒÂ9³•nßx¼6L 1³ðü¥Ë<ë|½~ÐÍ_^"ö¿ü—-•!D†Þaóü¯…Vvÿ#ß¼õ•#)­2ûL½úŽÏß< vÕê_þ~c,¥HK1úÚÛ>Ÿ½õñ¿¬ wUh­Í3?{×ò)#r(«ZÿÒ3«ö²ì!7þâA]de¥N¼ýûçÞ9ó›¶ò«×Mì#@G÷¿ðܺM¥Á„ΙvÉ·\¨ò‰¶Š—žÙ5öŠ%ç_8ux¡uíwrÛëv=õëõÙ(˜yæðY×Ýõ¸F*¼ç¹?½ùNe8®óf.¼é†YɆ֢Á}xKé_óìÉÜ o¸kñ9þd{DäyªžøîÓ¥í‘bƒç^’8²nw“fÁ¤·~eÙ` Õ&‡æe|Hȸ0 Þ£„HDZgŒ™>u\vñú=Á”MÙ_÷ÍÅžŠVoÁ€"¨ÚõÖê|WÞ»¨ôÑo<['Æ^õo˜Ï?òüá»Hë¬Qç-½iÑø¡9˜ _¿êÕ7ŽÆEþÌë?·xÞ “¨ýÀ{oüyíáV-Ð7rÖ’‘ÍëŸ:Ú±)sÈŒ•W.\0ÒT2R¾oÕcÏrÎÿö]Håm[”«Ž¾üì_7”«Œ~|þÖKgL5ì|ûõ¶”7[ž¢!ó~d^èÝÖÌáy>½ÿ¯/6κô³™ŸÏ]“Úk¶<ûìöýA‘7hé7îj7D}ú˜á’WžÞHó¼,õó¿Ñ„ƒ—ܳÒ[¼æÅ—Ž(ÓèBKO¤5Ë:sŲŒô *ÝýÊ«*Zí‚É ¯¿}~¿°õ>ûìÚýͧxo@ÌStîe×Ý}I?ƒH†wüü§k'-¿åÆùý“mßûÄúÕ+'#bÄò›¯¼`PVO4—o{þåwF/¾îþËhQY9fàï½²­:h˜¹øÚ;.ì#HÛí?ùé›Ç,Èzîâ;ÇÈ zûÉÇ^kˆñÁs?{í ³ 3yªñø¦§^Ü^aN^rõ%‹§g˜ÙK¿úÅXëžWž\¿ÿxºûI‚Ç®]]B2³rg^~Ïw– ïï/i öÈž ‘3qÁŒ¢Ã/óÞ–ã“?üÑ…Çì,©=aw‘Ø! %ú·òªù—Ì6_ñµûÚ›½ð›Õ­8ñÚ;/Ÿ^àõ`¤úð¦çVí* 3áyÿÏÌÞ¸#6jÀ€¬ÖM~aõ¶X@OûFϹú®e u{ˆ²½í/ÿôñ}õ8åÚ/\6Þ@î0ØWúÚã>ö¡%øÙÌâ¿ÜJiÉŠæ\ÿà-ÓF$Z†N훯›û-¿&üûGªÚ{à˹é/,Ìõ!€7¿°È/ § ïЉùå?úÑÞkí7È›<®.úÍXrûí3|¦;à:Üüæ/~¸noðÔ˜ÚÈË1ÂÇ_ÿÃÚ ·ß}ñòÉ›wo~÷nÚj¿²zä¾ôõ£a œ¡Þð«*–|ù¾‘Uùß¿ìÑȵ2ÍœÂÂñ-?{ôCœq÷CWÌÞsèÍmJ‰s®¼íkà¹{þ{Ó¾JS$e8oTNóÚý•aÍ#"àþ ®_ñø÷Ê¢vŸV(š?° oN +;Ón·‡ :ü\ôY“ ¼ ˜—‘ aá€þxm¥1lˆßlà0OK9LW ŽÇ“ÉSø²pÁÕç ¼ü“ß—Äü}ETrn|ë7ϼ¼ô¡¯,X|ìK×_{æßVhÓà=«0H€Þ¼soºiIή¿².gåC_¿giuÅS»Ž‡˜/«ï¤ÉÉßÿÕ>ä}Š¬`ÞEß¾eXpÝS¿=2ìº;?wI§Ž´ÒY“ç]RT¿ê/'ãÚôš÷ùk¦·­zðçGÏ{ø§Þ,qºÌ.h–3~ÞÔþXûþþ*'wǼك.8¯å?üÃ/ÊÀïeÂ;¥  ßÏI˜Ù…}=ƒõRÈ×ysï¹s|ðõ?ÿçNœ¸ôÖë–—ì,Ý›9nÅÊñ»~ü£­ÅVŸÂŒ¨íˆ®òŒ Ï1m?X¶eŒ;ÿÒÑuk~÷ê{Á‚Aý’À€Ð?`€¿ñ§þ­où}·/õÖæj6}ÁMËú¾ú_Óî¸ñ†Šê¿nd =¶íýï}ý?+¬¢‚Œ@Cݽ»¾ü­óv|ïG[ë‚1dL䎛zNuÅoöãÒˆ¯0+eNÊ*Èœ áÏÏóùM쥲bžó™«—ÌËÙó§ßìjî·ä¾›/_xôwϳâºþ—þð_ï§rûçÅ¡‡š Ëê3nÙ²©úÍo}q3ŒžÚ7, ÀÈÊ/ž±ùÉG·†ÆÝþð Ó'n>¹#š¨?²î×/×…½³nûÂå×ÎØsp«ÈÊu^Áš…_ÝaÌýúà ç×V¿üžpÅåcãk¾ûí÷ø˜)E1§Ç3øëžv•œxË=‹&ÜÒp$û3_¼–oúÅo7fß}÷go¾àÐCkÞ{æ±-ï¥V¿>þ‰/~íH„€3ÆY—zµ{¯‰p„ˆˆ Óçç±ö@( §*Ýz²÷˪}¯6{ú\Ÿl—y}‹ò}¼Ò¦Îä "3¬ê7ýù}wÞuÿ…ûy4Å ŽÈ½áŠÝ/m:Ò"û\vïíKW”üÑö”Á<ýGΚùò?x¶œæY1»{=˜HêœY·nŠgç³ÿ½=ç²[¾pà ¯@²"ÛûÞûùS.¿ížÙ ¥M²³&êÓ°RÜ”•¯>ö½ø׎=ôfå˜ÏN¬xñ…÷Ž¶jnB‚äé†G%nZ³ùD’àDyäL`}¤¬oýá[ï=Ó Rñ8õö5º½öÃ-ï<Ò&÷4ÌšW”Í œs†€œsÆ ãŒ1DθàHè@Ú?ÜUZ˲²*5qDŸ7´1¦ÞßøjÊbäÊf‘gÌUW[‡ÿ·¤6É!jÂÜñÓ.È­úݺfÔzìdrùà¢Q“G^´hpÅÚM©¬ö}ïl©^0rä(ÏùWOoÞøf}AvªøC9N-ô|øû«ÿ«tJ~¼ª1±zê\1´ƒm¶§hâÜrï‘cjâqM²¶ôÐáêö¨>y"~î ¢,dʸŒO¼r ¶¿º¹æª›†ì³ëp¤ê÷ozcOÐÖPW È\¹x†\p®zâ™ý§Ž1?üí+‡êBü¯›N^yÍðùûJ‚<ùákoìÙj«RÙ—ÎaûÉû¥ÇN4mýð‚1#\¼ME‹WŽW‡žÞß 4yó†Ldozh}yu*´îÀCž¾îé4öÜIÁ}ëË@È ]µ~ÝÆÃÍ$QdüØÅO¤Tþ̳ Œ½çÌ[Ù—ùúù‹†Nhîlˆ"ìœÙ³Ú¡¸äHI]H3¤ÉÈxÞœ!;ÿôt{\#CÇ’lÐÔéSZ•>Tf€HÉhÍž½'CáìŠæÔü‚\_föÈ‘öîÍ;Ö4ëÔÞ’ §Ž]` êxóž·×­O"¯© 0GÑœ9ʲ®ž9"—°y˾² ˜¡H›9dÊÇoiÊÓïÜi£%[Ï¿´2úçxûâ5Ž&ÚÛ½“ÇL;?TräXi}Acþ‚Kgôóéö›ÞÞ} •”…Ù”13/j«^Þ¶|èˆa9»Šˆ1rìÌ 'Ž8XoiâÀ0¸ÿÝvì¯p¬bn~¾ó¦NÈkX³ñꊤÞX<붉çø×´E9çÌ‘Jç\iíé?r报sÔozæOÇ“Ž",1ÿˆé/am{ùhu {Š Ó<’Èœóÿ³ë)Ðèñ ÎTÏ„ 2Î8CƸàL2"mµ×'.X´ìü,Oß¾9Y¾Á9\7B`ïó›?lN1¬ cÝ8ÁHùGÏËÊŸÞ^|è aî84ëB÷Zê¼)‹oÿ øëïÖƒ8›îû4¬TÒêÿ¥×^]<çüK/¸iÅ-°ëùG~²&Š¨l šÒ¶ŒqÃdº=BB0°â É<§ØD*IÙ ÓØŽ¥=õi»”K_¼0•ìÉNÙRg{Û¸c+xÏù”LH©ì'¥ °k¹ÕAmËžzß/¾ZóÌ;[šé! ìxŸJÖµ(Æ¡£ѹ$‰Àë÷0Ù˜TÀ˜JÙvÔrÜ&Kç-þÚ½3¢[uGÐ>+mó)Y)h}áK_kùÊƶ¬*ëwñ¤äáµ}»ªŽNňj%SŠ‰L)ž74Gàél TÄ Î9vªv¥j¶üù‡eëLæ~”d²¹2ô 4¤YZV´ùÆ9Bç&€¹çôõgš\ååd×ïŒ!hôõ韟 ¡Æ¶xR0ï¸/Þ1`ǯwTYŽ³§dOšï %¤î®B T·Y™ûû næôÏóz€û^|鹩¿ß[¶ªH[{R ïkêJ+gp®ÇI?s­ Í4™ˆ˜/oÂùç>ÿap7PM—«Ó7KZ§l2²¼ 1«–aªô*÷l€È857$–ù¬¦ŠÃU!ãŒlÍ¢ÕÞøÃþMkß»í»×;·ïÖ#•Fÿ¾“¯»4°åÛ•AáäÊd¨òÀ[ïß²fÜŠ?2}vßí•ñ³¤´çOê“ááüùù™Éª@$ÕÑêàvKwEN Ž®rLoIÛ¶Ñãe†Ï“™ëÑöVK§  ÑÖÔŸè³ÕÇ˃Œ Ž¤4!Å›÷¿ñòþ7^ßu÷ƒ7Ìå{µ$†=¶ûÝcÀD i8´îů½ôÖ¼üƒc37´žºnYߙýUyqÃÞ:5a2¢à²´`êð“E|……¹ÞðÑpÂ";T·ïµ¿ì]óòÛ?Xóð•cžÚ´;¥Ú\íj¯Œ²…}‹¼Ø 3û÷3¬@cÔL×È9:.2f›J6¾Y’ž[|ƒ—÷¢÷‘2[8c¹ŒÜ\³Ðßh¥­–šHF_Yº1œµ,R[v´¬¼1‘v8ˆHkíX+Ü^{4°ðŠÏ- ²hhF†áºÅÂ0ºSÿ!ÅKÔ]´ò¢«îñíÛ³{û{ÕvŽRÒ‰ÖšÒ¶Úž>f/?¦éxàN‹…3ݨißñà’ew¯|¬xߎâú–$ÍõÍK.Y*û·žØùÁ¶ eŒºäš»Í1hBnÕŸŽ5€Rbì­

Õ-7«Î7{PF‘™wÑeãËßzöÄÉ1† ­`ÅÖ­'ï»÷¶eýN _2¥ÁNp´AÍ%¡ V^mþÁʃÛ÷jõ¾db^ËÖ-¥qA‘raš´Ö ¬èÉ}5Þ›o¹¦t{Ɖ}òK£TkÙ‰ÄÍ7Þpm¿Ã¥{·:z䵿ßvý]·)nWùY‘·}ñDî¨e7,Î Öé‚Qƒ±ýÝò€2|ýÆ_¸tLÕóß=f3$­3ÆÏ\°hVQª-™=trFõ–â—›¦pÚBŠ—ïÙQvÍçoý²Ñ †MÎ;¹ñùm ì™4#qè5IEgCä†AŒcìà†í±…wÜ‘U’6c@Ý–§«SŒ3MŽ®Xö…•ƒïÝQ\ßœÖy½dÉìK¾öÐ Kú–¼5xÑŸÓ©–=¯o)©€Öš™C´,C×o?ùÓ[¿þ­‰‘³ù‘ Õ%5#—ÝôÈ7‡ÿçÜD$iMÑÆêXæ+ߑŠý 6îkP·Í[±°¢ïEó†d6pL+3LS QX1f¿æÎo!ï{ó¾u,Î «rãºâ».¿ö–Âizð´þ°%mÉsÝ{4®/š:ï3“Íe‡÷ïoTgÖyGî`uýJ@Æœ¢išM‘ôì3@tÂöSỎ%‰túç ëMi~éŽ?:rs.Étg(éþì]“óõÿËê^¨ËÍ@kýѦŠ?òÈ#§¾ºeíÆ’#'2y¸âØÉh ±ª¸¢%`Q—;î°R`'ƒµ'ƒ”•Ÿ?²ioeñ¡#Gêã–D’¡êªêÚ î ËC®¯o +O¦)#'*º»6~ÄM2Üv2R}èx[T‚–ÁúªÊÊV‰È¬–'ÂÞl6T7# É µ4…µ/7;¢5ñþ_:¢íèá²+X»sõ›‡ÊŽôi;TU~ü@U0fƒÈš°òú%rã£ÏO:*ŠÄ²GÏ\|ÍŒÈ[Ïn>íHI¥±`Í‘»65××–”;z2%íXsséþe¥Õm­õŻֶ¥¬P8Rwè-Ç["í5Ž9Þ—€@¤¬`MUñê„&D­mðdø³³D´úðÖ5ïV7Å•´cÁ–ò#‘$‘l«­¬ªjn;Qv¼NæfDÊv½þü»q¤¬T´©¾º¤&š”J#ç l¶¶m3;K¨öÊÒ&KkRJK«­ôø±U¡˜­´­9QÑDÙÞà‘í«ÿ²­º%IŒ’±¦ºš²“qKk¥”N¶/mKˆLkAnFb÷Æ“ES®»jä;/¬-mL!­•ˆµUV7S~ÿB^»ÿÈÑÝûöí¯ Çm"¨k H¯ßÑæêš:ϼ¯}¡_źu[*R)¥!C$eEk*Ž7Eã £u5uñÌ‚lUþþ¾ã;r2šÒ@VÛɦfæd@¨¾ª±5(;V×f{23¸ª=t¨¤²9)Éôåädû(Ö°çM{5Sö ù·_=lÿ“¿[[ÇLá䈵.ÌŒLSG¾þúŽ­PZ±¦âãõmI•J†›jÊJjB-å¥ÍFN6Fëv¬YÿÁÞÚ„ÐÊêŽkv¤¨P[á¦ú€òùý>l«©njÙRÛ±p]IUc[B!¢l©<Ïî“k·VûàPñ‘²Ææ81J…Ûê›RYyY¯ÐR)­‘ Á@IÛR`šÒάî1 Æ´3 HZ)Òʶ<ƒ§ŽÌµ`ÌU7-Vý«¼ª‡/¸ü<½þù-­ ‡×Ö¶ Ã@¤e‘ ÁHK;™J)áñðì +î›×øú+{ËBš´´m…Âc PÒ’Š!HM\¦à¤µ²mIZ+¥Ñôy ÎÐm¬SšãN^Ɉ´¿‰C“öUÑ[4î²ëg¶¾øôÆ2Ókr΀H)é<âf†ÇpMi@† ÉNY S`º¯Úñq58+œ´ÒÀ8c¬3ëC¤µ´R ÓµJÙÄ„i PŠœ‘V©DÂ&áõNÖ;gªÖNØÌЩ„j­•VÊVhzLÁ0}Wé¹Û‹w×ÑwØåmŽ«Œn·vç´t¿ÏY£LdŽýÜ—¿;r×ßÛµ\(Hׇ{Ú³Y) …)4ºŸDèuIž¢-¯•Öš:zÎZ–vÊ–š¦!8hiÛ¹))%-K ÇLI…\pÐÎ ¢0MC )iKEÈ…ƒ¥bà´Ä»/®L )ii4 ••’…i w%3¤•Q4fh^ª­59xñ5WÎRÏ|ÿ‰m’´¢.ÀBÆœîRJCfzM£9L+[*@aFÚJÙÀ@†!8C %¥ÖÀMƒie§,2<¦›×Ê7e[’„óD"­¥´•fÜ0 @v*¥ ÙÁÖŠ9sòμDmÛÀgŒ”´m„Ç#²lâ‚iÛÒ(ŒN¶›¿Ô£G^Œ¤mIÅ<^#‹=±þÏ3æÏù¤]½ÎtለücÃ7d±3ÇéŠõ"2ÎÙ?"bDÎYZE‰wë¹ââÔ÷Št©ŠQ¢µÀY”Ý IDAT¹ÕŽi\tƒ*v\ 8ôÚj+ê‚úQÁÒ×WËH¨Û}u~{—ç„œ÷ü¡`Ý_êù¥.1,çÜ©M8Ý™lîx–Rk`¦i2€tìï°ª9)V"`Ž <ç=8µ+d\0†Œ9ã… ÖiLiÙý¾ˆ€sŒì”Q0zÁ-³úåp­gÕ¶`<%Kw¾VkÅ„à$öÀ]¢œ  ¥GîúÈ…)”ȸ¬Ýü‡?ÇÃIgî0†¶RZ †Ü09h¥´ê×5L““–¶¥qZ‚–Rc 5rCp'OèÌyæ´¶¥Ô.’KÓ™‰rˆ3Ü0Óæ²ÛÝ ëݧÛÞÖkú²Ã¬»°Á˜¤®.K/U¯î/á)/á?È¥ÍÇG\õ ƒ!©$i@!ן´-]^8&„è¤Öv9Úx‡ú¤“ ÕZ’›Õ9“r ÉT,$i]¥€›Ð%?7Ó–wß'RŠP¤Õ#ÓŽ!pÆ€ÐÉu>Nê´£=`Üpºæ‚´WÝÏÓ‰Ýî†Îh8@+Ç&çFGä«”Lûš\ˆt¸Ø•;ÂÙ¥"ÎœÞtÙÚ±;L˜nh§ÞHºÀœÆ­²_© Ód¤•"Ф”´%˜“#(iÙR*4çZK‡¥‘ ¡¤…NŠR*ˆ@ʶ Ó49#%%9ü”¥MÓ0L;•”J¹uýŸ—³m@!„àʲ•RJ˜Â0„V „éá$mKjfšg m;%©'v@kiK0<@$•k)1‡TÓö?½h0°, „ipTÒ’$|¾Ø¥™.µ“µTšPÁ:V+Z‘CtáæŔҊ4"çÂY n¤Ó =aŒÓJIäÜàLÙ¶L%¢a[ *iKâC ©”%¹a ÎIÛ¶mK@Ý´s£eÛŠq.º1ÜkuêjGƹPÊRJ1.zëïÖHJ7ŒÎ¸Ã‡CgßEM]¦52Æ€k%¡Á ­lËVœ3ÎçJºm-‚3EÜ0 †½!øº_‚ƒV–mK©¹É…Æ”$Á8!h%¥Ãk ²S)%9:=› ¬”-mÎM”–¥¦Á(Û²ü¬))50†¤‰âÔýTÛ–TÔѪ„úÓÒ¬¢´'¤¡ç¨•"4LáüU¦l4Ü5©¤“q¸Òÿå–•Ð7dÜìãï­ù R~$m”£%¬9ãŒu¤'PsþbIIH ¹ir"­¬”­ãŒuìŒJ “wI@¸Ù""íxœgü È)5ó8MZJ*àÃÎ4“dâx_ghˆÎ4ôdhwÁ„Ÿ éÀ5—tšÆ8LcÄ?!n–¸a27ÄOWfl+eÛ€¦`Ü10Ž8‰eÙŠ™gÂpŒ6vܳÒÈ´&7›ƒ0c@Ji§å¡{,½;¤ÿÐKRú RJÁOWQœÇïdÎPYŠt”fЩÑ@ÇþŠ@Rj†ñ1™OlQ¤J§>™0IÙ‘ 5LÿäãŠnÒMôb‡ûÅܵ‰é¼ˆƒ| Ý5ßQ!Fn0NDÊJJ¥sq‚1­5+)eWÈ”Vvg&ï4—îÀÈ9Óʶ,ɘa˜NiÛÆõ1:û¼œt"Ò@¤,‹œ’t¢Éœt¹ðâcz\ÎÄ1èžtÅ®n‡&J׶  õQoçpÂW䈌i;eK‰Ìä]çb—jãÂ`\+)m™0 ~&O‰ðTƒjŸ:ü?§„ œqa0Lór}œ( ã‚+-•Ö=AeÈ9çIAyŽ½¡ètFª»õýÇì]Ø«/í„(ÒJ©N2%m­‰€4Q‡aúú­ÄGøð’<ÇPžò€-u bØíùŒúã¯þã5îĹwÞ;ùÕo>YÕšh­©ˆ+ÌÊËÍ/ÌæÚvxÇOé#þœ<#ÕHhæÍÉó©x4·ÑðfägúØÉPSKLšþìܼ,e<FRÐsê 3‡_ò“«þ÷áŸ7N='.1ÑÉ¿túØÂ5 ¾hÖPõlœÿÀýËÇV}ë¡ÉÜÑØá啽xȼ¹ùy9^F*hG’Úðús²LP"#“Ù‘ÖÆ ¥yý9¹Y^¡íd¤=KH`FvŸ|A˜BÇÃö¨­ùòòór¼¨U¢½-¶œ}Âôçö" mi Ú€<#·° ÐÏd2܈'óæ6dаÁ|ØÁµñ@$ÔÜ,˜7¿(/ÇËU*ØЈYÊE_@º4žFWIìd¤«'n‚Ù©e‚ƒcúĤ w0Œš”²•’Ýne¥¤aNu\l’”ĸÑ)[Ⱥfò´ ÿ›V w}pÇ:uýõoôvÒýGäT±!RéÈŸvÛº«;ýÚξdHŠ K´„È€1 Ù5Ö`Œw®•Žÿ‘¦Gh­•mÛ¶D{©x¼íw×±[[ëšÌf¦aºiZD £ÓeÆ?‰›Ñ5²êŒx»ì%DZk©4ºÓ‰ˆˆlÒB8 Ú4­i@7QÐqaÈ’¤ÞCÇX "Œ´V2•”Â0â'WRíý&µ’RJ \†ScêR•ú8Ï‘ ¡m[)›„É?u†È‘H+gëî8¿ÓëÄðïDú;«íN[0<<­Y£lKa IZÄËž–m ¦.ºjîÜ‹¦äŲŨA˪f/œ²}ÃÁ8ŽƒÎ9GPÑ“UÅ5P` ŽE‡T>z¼1e§’ža³¯úÒµS6qY½ã©_¼R¦S=CVÜþ½Ñ{î}ä½pî¤[^Ú²þO/½Õ<|áõŸ»y¢ÝCïÿåß8çCg/»õ3“epj:ü—ß¼XÞbw[YÀ3Ç/¹htås·ÿzCsR±IQŽ.©¥S§änßï{ÙÒÌšµÇÛr–ŽÌiß»vÛ¦­¶yÌ#@«^=jsЬ»¾¶¯ 'H´ozeÕû"æ_÷ý/MnÚy,˜sÎôþ{ùúK„òf-ºjɹýýˆ^:¸ùÙ'7…øÐÛŸýe¿Ò'Ø‘<ðÒóëÞoòsþþãêÂd(¢uý ¯n8liÍó‡N¿ú¶BÕoÄã­o|mÕžHÖÄÅ7ݳh¨µ€À®u|r›=`æ•w,1p@ŸÅK²G-þ`ÃÚuqïèù÷}e~<qòÕ§^}§¤5®H+Mœhí.b%m©Ê“‹«A% ÓÅ“Î~ŒÓÏznƒbÝÆYS¤•´pap$­‘q§h%mIȸ|&7c.8J­ 8‚RZïd5qÁÂ쉞Wæ¢ñº[·Ó%Õ;îåÔ;êñ;¢SQFÆ‘”æ–ó”Ò„´–D Ó„Î;HiI„(8j%¦“×ät¦:Ð&¸ûf,Òes`ÝYœ;ŠlØY›CMRƒàœs ©%0d¤4wj/DŽCÒ)…N`Ûõ9gRI¥™pcäD抜QAÆÜžKìõwKÏvieˆ¨”Ò¼ƒQÄÅ›(¥ZMd •VZ3Æ;²r¤•ÒÀ3L³ƒ‹Ã–™08P¨”vĹIiB¶­À™ÊnpפD’%vÆc\Œi¥”Ý¡¢µê®ÕhìVæd¥rIºHkMèl‰Z3a t‹Eè†n§G— +Í¿…é]Æ9×ÚAÙvä«ÓWÒ#É„à–”R1#ÄÐR*a8CÙËüï†òë¢C§#Ì=M”Öñx¨3cï  ˆ‹4é:)íjŽh“tÆžþn+„ÜÛgøÐyžP‹oØØœöR•™ãc=áîmtÕ“Ê?mÅòiͯÿü…¾soøÊUs§¾ÿÒ{uú”P¦Ïãt°sÓë19}G_<'·â™ï|¯4$³Õ¶tÎ+¯˜h–­þÉëÕzز{¯]0sHå›åݳ´FöðaEíÛ_lIHP¶ ¡Æº’Jš={œgSÙìÚßx?o>¸»vÊ¥WÞ1äÀîûwmÑ)Û4!ŠÜis¨øòUl4ó X,lç†7“ÚŠ·>ýDåèï¼ø¥k&½ñáŽø‰ýžØj û&,üümóÇ Ü¹«‰û³uնמ³aâM÷~æŠ öî^E3æ_6ðؽWý©-³O>†#6x…)[¿÷ÌË ¾ñ»«¯¿vOéœ[®ÞöçG·X£>sûç>3éÍ=[Ë6üæ?êò†Þ[ûÌS«7§¸OFÿ¹/(ÜÛÏDrûåS(A\TRIÛb@¤QÁI[Ri™“ŽL¯ @JÚZ3Òîœï½0ç–ºIiEJ“)%1Æ@S:RqR.éú4b.í…’Ä9`„Hº\îtu ƒK)m@8ëÍ©–h­%i’R1Î8€RJ+§ènçÌ…÷;éÝ9DD}¬I)8ió¥IK‰9È`­¤BÁ))I»ÝcÂœ)JjÒNU…Á¸µcâ†smZÙaºo˜sŒHj©m­Œ.á4þ¶ Zrª@šÒ8MJYš1ÐÚm«".´²¥íV¿9w`㌣-m­™{ARjPD¨”FÎQƒ¤²-Íœ¦-ÆrÁ¥m[š¹]¥vˆH* „Zkç¡hBÔÿ½÷Ž³«*÷ÆŸg­µO™Þ{ËdJzBÒ€ tÞATà‚(ŠŠ¾*èµð"*¢ àU. M@z‡HHH#e&ez¯gúœ9eïµÖóûcïs¦'!àýy_³?ü1ìì³öÚ«=ýûUÚÎä@iIäŒs’Ê4MÎÐ>¨¿³´P¸ƸÁAZ–¥•äg´’Š8º\‚Gã0ÌNkc ¸m§¬a´VC+Ë"§^Ž7"ºŽ]5UÖ\dX1Œl…[iÒDJJ&¸¶‹¤Œ´RZ1͵FRÒ=dœœ”eYŒi`Âœ1B4F %¢iõ,"š€“RJI­4YRDª58gZGòôµ²óJ,)9cà,»Ã$IÉȧ“&`v‹I¢‰ìmn Q­5cZ);PkE´VÊ.Õ³”e‚6„°«¥”š¤”ÀX$Ó&ÒŽ°¯Úu”š”ÖÀ8"œ[R†í僌!C­¤EÚF¯TJ ƒ ¡¤´,­œd%%§#”RèöX5[ßß™ß_ù^G9ùkþþ‡;šF¸°£Bˆ‰¸èÿºRJKR‚u[ª«š»]®µçÎ+Hç¬MëC[”*8ÔSßéZ{څפ7ïßµµE«˜Ü¹³ gf%uCV¼™%Y¡ŠØ1ÒyÔ}ëv¦ßö©;ëÄêïjÙÛrüqK2sø©å]›¿Ó¦ ¼çÙÇžô­zia¶ 2ŒÑllÇ÷€“2™.ûV4ï ˜ç1>š „ÈAØjS&d‡zsEâßHÈ¡ÝÈØØó¡P8ÉmÂCÇŸb×p1dÀ Æwc4“ œ8’=¦œs;ˆ„€œÈlŸ`¤º‘„ Š. Œ@ÝpõAaDB ˆ´ë3 ™½9q<OòÔRÊ”Ig~÷ÛkW,Í‹óÍ‹ÍH–Ùrh¨ñ¡ÚÁ8d£ŒsÊá_×JªÑè©\Õ¶'ÊÉ©ñízê¡?6.™3ÖÙw^±è[ûŽ!X¸iÛ¦w_Ý TÒò·µL6Ë´I(L暬h~·9ØÑXÝ»vùœSbfûÞù]“$äVwÍæg›ö¼Rºì²›/:qþ5ëZ&¸d ´Ï¿ø^÷Ò%e³Ï»nÍ’×~àõ6 ¤´¶"p‘ˆ 3Ö|íêUîº÷_{Óç“~Ç1¥Ù@Ä ”ƒ;^ùù÷Û—.)ŸwñWÖ,úÇx»‡lXw A2†\F!©ˆˆ”Vš„`Ìžb“ ‰dÿÖüò‡-‹—-¾êë'/|â¯oìUŒƒ¡ñõÃ㽓 £î¡É^²išI5 öéc_öä”3OíøŸà¬³_Ç'¿mr½î§‡¼$dJA6©qŒ’ á$È;„À§HŠ-WG@˜Ôeœ ¿åPB€hë³$¥]²©5—Êb;?-é̬a8å-J¡e 0Xd2L Z"¸#²KãíLBdDÌ‘[ăQ)²,Ãà¶zª5HÉÖ\Žâ"%˜¦Ê @Ú²¤¶ ¬ì°ØÑ%ËB¥¸ÝÛhÙ;0àclq‹"¥Å|Bµ>ÅTÛ6ãvéì4¹ ÑZ[dÈǯ1`´cflÜÜáøߌ©‰:h®íÕ#MŠˆ1¥Hg€Ì–7LJçYÃÌÎËIPŒ Ã.Æ)QJ´ n…PdJe†m™‰n—SÕ/%(ÝÈsZ#` nO(-”PB ã, ˆ@k0lUŽ1¥@)PB€p²¦™T@LƒacÀí"{¼&@k{U¢ý¥ÈÓ–ó˜ÀÐô§–Rxç·¯²;îžYÿ÷æâµåC;_zú½Ö‡>ÃýmÁcóò³2‚Þ¼¼‚¸ŽíýŠ&ÅæHGÂ"-ÕÃ¥¥$¦{»‰˜`‚7¼QùκšÜn=!ÏýJ}cÛH‘›t6ÖöQLb<…ä¤Ý(÷ínð~ãÔÅÕVv…\‰qjxÐ?4ÒÛÔÜÒwêñ×ä¾ñ³ö0(2Ró³] øûGLíq‹)Ï.#Ÿ¼Y±ùã&ö£/fexÛôÄ\PíÎœQÓöò¦MìŽ]QêJöÚÒÉ•ž^P’XÛYœÏü­mÃàŠåÁºí¯íÞôq»ç®Ë 3ÒÜ=zBº ²@g“–æ'ÆÕXyy™ñr›/„h'ʈ¸8·!0¤ î¯ÞòêŽ [}‰?½ 0=ÅÕØœÈVõ)s¤”6¤Žâ.âá[*ˆø3ö>…Üùô¨ÌŸªñO8?ŒÆñˆºeç2Î "KKLX¸Ý€¦ ¦…ŒR pZƒeç@„J× D 9µ”À9¸Ý „ÃŽq,%¸Ý¦ R""(¶8QÊn ‰@)œÜšÑÖ ÚšÇFÔŠ…v\;­ÖHäô-—ËÄ0.n4±`ñS”IiÏFa8”:óùd½^b‰“ó/8H­LÅ9C!€L„pfÍžŽpØYWö8 –…‘ÉË‚˜ P¸2OZ“Œ‘Ö@ëÑÖìŽi-ºT@Jðz‚Áq/唂)[³¯ñ­áäÖ¢KeüŠm,‹8³ýðŸZJ!“f\Z¸æå`jéPKíÆæ^“MÏö5¯Ãà¶×6,ýöYßžÖË3‹]ÞÕ¬ˆá¸ì ½»´\ÿ…˯Ó݉Çeº«x\úÜ˾tRª¿Óï™=«óãß6K«kãóï•ýŒ+nÏnì°R²Ü;yl}EçÄ@fó[¯<½ö‡_ýé7*j†b2pûcÏmø¸6ØÕÖÞ¸æ‹3_º£É­tü⋯X9+~°}ÐÈ™QßúؾîI‹•EÒ⓾¸vÆ o0aî¼Á}o¶u “q53dŒZöìô­]yò9ÞrOÙò¢ÚLD¦ÈXz92§<¾æùÃî´5§]sbn¯o8yaYÏîÛ»CPŒ£ñ0dȘ]žß<ÿús¿üý…2-?¾}Óî¶aÀ‚í{öùÏ<çÜË2 +wlݺc uÕY_\•æóÒÏhÿäãΞ0|HD´qˆøg°UŽ^ÿœ+Ç„0”V– SGårA8 JçÎ9=Â#bb °us0 ç1ÃÓĉ­9Ç“ýÇ„ÖG[s¹F_:¡5p¹À4mïH`ÎÉÈØÄÖ„öùUXp!˜}ÜükQè"!cmDN™ }Ð8ú‡ý‡ÍåmÎ8ÛhsLŒ=¹èñ@(DZsÃà†;"<€, m÷­1æh àõB(ZNî„5ð©Zóx vZ‹®([‘Š¶æ,-=šH2­º6%ÚìWoéÉwæ®,lèKȉû:º{CÓèŒDFRFYyJãÎ*˜”²ÂaÊ*Ÿ;{^¾G ·Tîkh³™&g{»2ç-œ];ÔÕ¯µÙÓÒÔÞ#“f”——dĸõpsÕž]m!Ò˜_\:§0ÑMÁžöªŠºþ…–e1ÆDÄü$Ò:&kîÒÙYɆÙ×^SQç kàIy…³æ$×¼ÿIŸI@,.§ ¨´ -Ñ¥CCíûÔ·ÒTIË"9»|^iF’Ëî®ÙUÕÕâ ©y3³¨ù@c¯2²™ŸÓµog«›]º°,3^ùÖêm¬í£âÛþò­ö¿?Qïfg]Ue³_+5oÖÜâ´$—5ØU½³ª{ ,’Òófd =ªj IDATXû[È•½hNFûÞݼ™³gÏ,Ne#½õ{öwô…íÚ##µpÖ‚âŒ8å«ß[±·ß•Q0kîŒÔDÃh¯ú¤¦gh\ýÑëÿ¹‹¦ÌWœàrœÚ¹5öæ”MþÕgl-j6LÈ›£seDG¦qýóÚÿ'ô‘&žÓ4g“G~ʦ™Ž#lmòÍɽðÒOÕ·ˆk7>üÆãKOXþ)¥Ô×¾óÒãÏÇÆÆâ˜Rƒƒ}4Œ)¥4MÓívsÎ'`NŒJM‹706wr*ø€ñRjlòé˜|Òñì,NÜaLêÔ}›bL"ùÐÁ˜Ö8/ÿÖ_¾¾ó§ß»b8šÇJ‡ÑÚt±“)è"'/î£ÐÑëèuôúßyRJÇ/šª¯µ–vävÌAˆ‘’…)Îûƒ›‘ÃCúŒ÷ô‹/=íOGÑÝðpšò—ÓòÇ©Pg]ÓPPâÇ·f—ÁIËTQêV@Ãp*"´´,ÝÒÆfL“Ò–…@€Üâ÷èuô:z½þ§¯Oƒ‰NZk`L^ŒýßêB@ÒÁ–§ú{m†€€˜‚1ÒJZ–e1æ椕)5ç稕%¥Å„Ú´4w¹ »xW*4 ŽGÅÔÑëèuôú7”RÑ4K´T .&û ÞÂh¥‹“÷üY¤LãÇú2¡gˆGtŠkà ÷F8²Bá#“ß\;¨h_Zk n£ýÛÕ²Œ*¥”"(8ÚùÍ ¥ÒšO•±ýÙ¾ýˆ‡h WÐèm aš•s@2NmÑAZû sú9Å”ü„Ó®fKÈó/Q™xLþŸƒœeºäÓ!OøTÍáTìÿ#›èèu¤RŠ€yb¼IS1.sÈÁ‡I“Q|Þ÷/Ÿ›×òÚ󯾶½Wò#Ÿo"`ɧÞvUÿKÝ\å·˜DlrŠð÷ IíÄëˆ Ol,WÁ@ÐôÙ¬I,[}êEÇå#;þËëûŽO–ˆÀŸœ@þþ©>W‰@„Âç2‡‡ÃêS4ìJ):åËç/ÈIعî‰'>Vø¯{h .ºê„¸†õ¯lê>”ä±))b¸gPêéSöI£áKŒóº¹6CÃæv'&»ƒƒaÂë…àPÇ%Äź‚–á‘á`Xq·7>9Îà I[Aÿà@@i4ããí›×°]oïm±™ Fcå\zÏŸO­~áÞ°-¥”rç÷ÅëW¦úvïïÐÄ9Œ4® LC2}•gΩÿqËñÔV×Ò §*ÞU|Ão¾¾²u˦ְ†1ÐÙ¤µ&MvÞ(I¸S,66ÀGcÞ5iúfLo‰HK•|æ7~pMrõ¶º rHt„Ëmö-ýÎñ­Á( +ÙÀ„Ñû¤-WÞ Wã,µë“æa íª|ŠMEIÍí¯r(ã H†|M=2®ì„ÅƦwwT„jIGVTde:D~:Ê`9mÚ-iYöWEÖ½]6kíè9õFNg#_:¦5{aIVpþ•§ù÷~\Ù;2:ºcú6º`¬œ‹õ×3«ŸûÀž¦Ã¤5‹+9ù WÝ|õ¹²|EAÿÞ}ì¸ÞwéЖM­C”âÕ_ùò‚žííÇ|ý;·ÝrÎÒ“O\sæ²,èmnèM\xÎíøÖ9§¬\~æIÇ­Ìóï¯hî”e7Ýñ­ï]½öÔU«N?é¸Sç©}• žÓ~÷ÂÍñíû«ªû³V^|ݵ‹…{â·o»ð kNÿòÕgžµbÙ)'/.Tín ¨ yh¤uÖòK¯¼rvû†Oz$F˜´ŠŽdäãµÖd¿èº™<16Ñè¶Ò‘éßOJKž{õ…9…yGbKóÏHsS¯L*Îa¾n‹a‘ ‚¦ÈÜ1i…9žžúŸÅSJçäŒÔîk³,ŒÍ-ÊIÀ‹OOq›ÝMÕ ý¾†_Ïp¡¦#K“O•ÆØÌ‚ÙË ÜÊßV×2`™3‹2Í*(οrY|wc]G’ -œ3¯$'mÁ1½î@O}MÍpLaQV¬@—Û#dkKG·_‚ 'e)McWܳè¤cãz·µ5õJDŽ@ÄXÚ1×~%·úš=,·h†ììì)DæN)-ÏâëÛ·×$" æNÊÌËÏ ¶·5¶õ9ÉÞÌÂ|÷@KÇpP‘ÈP¹éÉïWŹc×<ôè¬õ¿øË3-ÁÀ@ï€9ö !"Íâ æÎY2kælœ¿ri¼ ñ@kÀ‚ÄüÒœô8ƒ+wG{KoPj`<®t~nöæ$Çñ‘¶úæöaK5¾ˆPÄf¤'°Ðˆ©U¸»©Í/EÖì9™ ¶¾hoinÒxÔh;)¥%f¬¸ø+§¬:ei¬?3eY^iBãÚ‹zßþû&?3Æ>èÉ*;û§·?}ówŸôÇÞq÷wv~ó¢?î÷ëòk¾ùíÓªö¶ç¢îíß<ðQø´ŒLd,:ùŒ5ÅF”T64´ëÕ>iLá‹ÏZvÁåÅ2© Ÿmÿã=zs¤xéq+O*‹‰?ö g–ûv¾òÔ`'/;þìãçÍÊJÈ]¾6±¤ç“§ê÷çÜðÝ›×$µl©ð{’cý{ÿòËÇû%i–}ÂÚæãÎ?¬mqÎp#1gÙÂä=OT6öãÌá-úÂ…Ë<ü«æŒïÝpmâÖ?ÿî…Šn…LÄÍ:ý'œÒž° éÆ5n65B\îÊk¿õõ¯d6>ýÜ~út@’’ž¥WÜü ã?ùóÖÚÁqÇ‹’Þyg\wûé™8<°ú7¾þø³…gÞøÄïc·¾Õn&æÒæóØÛ©ËÏý?¿¸ØÕÙ)²³úÞøóŸþ¼¾¾[¥,;óÆÿs¹§z‹/@"Ôýòãå­9qÙò™ÙYæÊ Î*ëÜÕSß”j¼éFÄ\©ËÎÿî]g‰¶N‘›Ùýâƒ?º¥£_¥¬:÷–ÛÏ¡ªOBÀí/>ðxß‚/ÞòÕc=¾p|AYJÕ]Wܽ§;Œ$]eg®¯}\4\1ù§]õýo¯òWµ†Òæe%­;ˆNBRV¬œ_ÈwýeOX(J:íK?»>¿vÛ r³Ž=ë^ß–üµ^ºçWþ¦Þ8æÊŸüÖsÿW·¥6<±!¥Ó×\òåk–Äiɼÿ'/?xÿ;ýÞ‚s¾ó­¹æ°ŸBµ;Þ|ôÙmJ !±”%«W»÷þ~SÛPH±¬…§ßòÅçºû{B²»ö¥_?°«;᤻ï?G﨨 d”d¾ûȯÿ¼M§•_þÓÛ& y¼Ñ¹õ™ûþ¶©zÄ›[´ö·\2òêÖ&.Wí«Ï4zæ­>}Q~^†qæi=­Ÿëðõ™"¥ðâÿû³cÌýURP°íí'Þ2ιë¢à·o}¢^pûÞOyð¡í’Mp«)£èØs¾vÑ’"wX«ý÷ÜÿqõpþÚënº¶Lö›¡O=òÌÇíS9ŠO¿æ–› 7úÈëÚÿë;ŸÜ>Rxéß¼°È·}O01/Ëh|ø{¿©ì`å]{þüÂë5÷>ùðc¯uwݽ7ÍÝúöÎPbvÒÀö¿?øüŽvwÙÙ×Ýpý졆^ˆáwÿè™0%Î?ñì„rWVnÜà¶ßÜþûª>÷Š[¿tvfدc=#[ÿòÀ“ëEKV¿¶,Ö›tì¹g•÷î~õÉžþ‰ŽwK&,½tMbÛ{yü½†~EcFîÔ§R°³µ©¦qdÛßE˽GP¡áÞ†ºZŸó®Ài‰¶£Ïìl:PÓØ+™ávÇt×w$–”–”fÔk @:8ìëõ÷óø¾ ô´·64›l¢©GZ¤Ì9aõÊãJ³ `Åyg–tW>ßÒ‰]zÍW×äiry½äÛðç‡_ØØ-Ü óî|è×™o¿¼G¡7nø£'Ÿ|¡¢?0ŽI„¤N?åòÿ¸é¸xOÀ“[žÙò«ëþsK§»äÄ3V•pæÎX²¦ ú‘ÿ¼óÿnÓ?*™Ç–B÷÷‡!8д«=fYúþ-Uƒr’¿œ´¶‚¡°eƒa„Ó>˜´ ø[ߺ÷Þ­-ÁØ8#$íi'"+0ÜßÛ¥€£°?žâÉÁêõO?ú\ã¼/÷âæÇ¿ðâGO>ôÁÇÆÒå%ûÁO*‡9Czÿ¡;[ξõæ’¦'ÿðÄ6Íi— ›ƒu>}ÏÃûõ¼kôåãç½Û°¡E+‘{ÂY—_#[wÔµRIóÎÏ•Uoíé°8ã@ÄRÊÎ?3ùùŸ½3²ng«¾$9± gÖܲÌÁ=õ)¡­¯ü-PpáüŒ¸%‹³|U]1‰)Ã;ŸÝ)ãRb wâÙ—¤ìÙ·8ÇlÜÜ=02ñó-J?þ¤ ÿG¿ýΣ Á˜Ôx”ÈIë‘Öžýï—6Oºí{'®*Kø@®¾òŒ´·ý•{wǯúò¯î:gÑ{›»ZIZ U=÷øoÕ'†éð®ÊÊš&¼bÿ¿¿ó`­v¹›LòÅc2×\yJòk÷Üp_Eìñÿñ›aÁ†Úî]ZZ–ÜóÔ#Ï®ob© nüÒqC¯üîWÏȹèÆ[®Œ·g™´©²Ï8u™®¼·rH’+¥èôKŽúã¾ûtçüÛï™u.gÓÇ•'gññóú+wWø8 è°¥ãC[ýó[;ÁåqiÇ›¡ ©´  ¢)B/=ïk'v?ú³{^=À ×Ür×™ÇåmxÃ5ó¸ò‰ôQM(>1LmO¹—²¬õ½ç{‚š ¡ü˜93ä»÷üì…†â’1(H†šö¼ö—ßlŒ[{Ó7Î_æ®ô,?ù„˜Š»¿õçz(ûÊ_9aí‚Š,­• vØôðo÷ƒ×cÈàÈÎ=»oýþÊÍ?ýåúö Á92 ­Á°š7¯{äþõ=ÊðºXò)2´l¢$3âÖ+\RÒqŸUfíüÓ íÎ<éÆ›O>ý˜Ug®]Ùÿþ=¿ýÝ3&1Ž…¿B(23<—Áx|ÊÌÕ -÷ßñ-<';I¶äHû®×¼GpÎU?¸aÞœŒ½]ž¼ïg}=Ã!œsùwo<åØÔ7^R¦Åú7=öŸ÷×òùß¼÷º«*ëÞ.9~®~ÿ·w|‡‘“ Ã6þ®9ðÚýª E×|çÒÙ¥ÉUÃ9ç]2kç=ßùûæÁWß~åù§¾ÿÎC›Ÿþ¯ [Åò•³ŸøÁ]Àœ1ÎHÉp0hiî‰áÚ“^œÞÓ +ÆXĵ=¥ë]ôÓ‡žýfÃ;ÿö×v´{—`ÒÂÕ_åõ«-a6½r߯÷š””uê×ï[zeX‚Üû×;îß Ú*7t&Í]P2Òß0c˜ý'MNl˜Ío>ø‡ýµtÝð‰ïýn¿%\‚!S›øÙºîž &¬¹ùûgž2ÿ½ oû‰t(PmÏÞõ—z¿ð¸É4'ÒH[¼ð¬ëÖXï=ôóÇv¦œuý-_Í×(Ô·áÁŸ½–3¿tgœ¨~ñ¹ý¦`ì¨!uXR —lk8ÐÞQ,·m\œ±wç[ëwìí3~¸‰.*EÖ#‹MÍK‘»?ª(¨¬ìÀ%Yiqë pË}µ]š3È´’‚ø‘=UíÃþ¾öêf_çLŽÙô,¸î¼äÚ×wÕö‘HÈÊŽ lÝÒbÊpõö¦áÕÑM0¹|îübh|q}ëCápYû7W5õ„a8¬Ý‡v“V5^ÉŒâ»ÿ°öǸaèþ@2 T7îlκåþ_®Þ´}ó›ë¶ï ‹Íš¹ô÷¦ÿ¬6q®ªlè=á’Ÿþ¢ìýMÛÞzoÓDm…û›:ƒJ‰Á ÅãbÜž¤¬ÌêÍ]}Á€îhn.ÍÈHòP70=ÒÛ¸{WŸ‰ÈÃ!ȸŒ1Æ…àÂf‘ DÐ=- û«»FˆV h¤Æ´¼ìÂç¯^pÚåpÃ+:ŸÜb¸tý‡—ý¶Ÿ”îܾný†õþ ’b3nÿý]—ÍJ”-/Þ÷ë'þQ/‡û·Ö%Üñ£_'lÚ¹þ7ß$@@hé J¤D¯³W\zýW×ÌȈqÇƪ_ŒašP÷²¿;„Jù:¡<#ÍjhØÞrÙ7ü«´v®{ç­wú †j;ºú†yo¯öz\˜:+u¬«ë ‡ÂíUæêœühìB0@Æ„B‚–:~Þ —ýâγrMØ{ßµ×¾²a’õ´<¸£ÙDÚjyî¯oÓgÞt…É H/Ç@sÕŽ?=^5ó¢o_•îVÄppï»o?µ±kHëp}ûä‡ám/vœ}þÜÂúxêð²4Ñ&'´ÑÖ¹!qÛ-_~ÎM×\¹$3Á› êßÙãAíG ml_×4¨€éP"¡úQ®OJšY”¬?Ð64Ü®mêjM‹f‚Æ.½æº‹Ò+þøÔžÖ;Š#s˜RÊ”)çþø‡g®^™É»KW¦¤yÙ`ÂoZ߆M;¤5cÌ GAå]£t4¤IM=6ÁY…4;,2#÷„K¿råBù…¿çÝï{·bhŠèH€—Æíþ8Pë‘;“e´áæDÀ87H;TÇ–¨Ø †Úê–wÉ•ìþÃú¦0ÙT슥”/ZZV·þÉ~IˆLwUµ˜'—ÌöšÍ žãOœ9Pùâ@¸õÃà5'­Ö{«‡K‹f”'SǺÊæ¹çÅÎ_|béÀ›{’O\Uøä­¾‘ðh>}Üží|ú—_Û1gÉÂ%§œqãÜì»ð×^'—$p”?—‹‘²,¢:爠ÖTz4$'=Š=IM@@¨‰€¹)Mˆœc„©@…l.q[Ib6ÛC´m$"È]vÑJs×ï÷tØÆÒ@ ‰&º9¹v?¸»ìØc’úö½ñQ'qæpŒ"¨‘T£DàNŸP Ž¦@$ €” 7<õó»ß¬èÓDʲ̑€[Ö=þíoo_<îq«.¹­$ýÁß=·±—y“sWœÓ³ùѪAŽŒ“ï“ç~òã]‹æÏ[±â¢Ÿü“oüc‹Íî]=6…¤æ mþ d ›ÍPÍhREùûìˆD%È´TX:L„ÎðØ#9†‚’hô›@2ÿ'?ðèCïö*AZZÁ`P¢ÿåßÜU=wÖâE+/úÚܼ¿þâ­ÓÏ>ðó÷c…{ÛÛ4«ž¿ÿöʹó–,8þæ{ç|ýÇÔ =úÄ4E +¿xËòÚ‡ïypKKÊI_»î‡ZÒˆá¤Ir.B½Oÿú;»æÍ[²ðøoý¯ÝùP‘R6®Cî® ÍØE6ñ²ÖQZxí· Ç`cÅ+w|k£GÃHû ÷wôçe'»\ŒBvÒ i*;‘C“& ­¤Òj ªbë;­>OÁ·/\9Km«&9ÔÛ°eã;oµ&.ûï«®Ÿ¿óç{ Ô]·ç£û”Mmî@λßýä´[VÎŽõ Qv.íÄtv;©ˆc N¹ò²¼u¿üá–š‘¹—ßzZVaF[Ã!_V0nahéàíÛ¼K_xímÇ¿ýøº­Í¦†£2j +zjïëžûÞÞѲþáGÞÙºgÓ³O=üë'wtb¢kðH†Cþ‘T”…:~ÑI¹ÆARƒÉ èø¬ŒÔÔ>U]iÙññ‹þäW÷ÿèç¿_<´¹ÆO‡™ûNË’ž"H)‡†BZRê´ÌxFJi{¯`êâcgÏÌI+]6Ó[ÓÒO¤xöñg\zó™%Ù±hgîko9Íÿ÷G÷ù¤½Ã4¹³æ-œS`ný¸š‡Úö¶ù‹Ê‡7U¶d-žã®ïP}{Ó)P]»Þî,œ?Ó;P×ÔÛ_Û…'\sÒÀ³¯úãÊç$ôvu÷†4ÙËN¼ò–ÓR9hÒ_Z’"÷¾óÖº«(33Ökë(€gÍcÖ@]«Ztá‰Å©ñ%Ç›m]=ÃÆ°FŒÙZ2lzâÒ’…´¤£!(QxæE—\bn² eÀWÓ‹.\•S¶fE®ÕØæ²ô8lDÆúìïò–-+ÏÈ,(;¦ÄH(Z´(µeó–Ú!dS`#he êÄÒ|Ã%Kòãã ;5€dpD93Ó=œ#ç¬wç®foÙ’’8›äÍ*-ŠgÈRóócZwlx÷åÝ,.=Ó šÅd”¬¾ ¼úÅ×;CH¤Á“ž•™åíÞ¹ñÝ—?l™ÙYžÉP%$C]-mq‹––$¥—Ïšáhmé7£Ü¦ã~¡­qoN¦GYÎr›ôˆ …DVn×qé9ù% —(Ép8àNËJIðrê:PÝã™1»8× JoVAVzK-Ÿ½U›_~mk­?)/Ù&»w5×U¨ÚÛÐÓæö¦–äyúöøìKï7ù¥IS1ç¸S]#{ö7õˆœYY±±ÂÖ%âN8}eYRVù¼òòµuøYlÚÌ<ÃWùÁ³/mh-,KÌþ¤q³Fý•MáܹKf¦¤fÏZ^âêohö À éJËH5$Dôûª÷Uï9P]7¤ô}ò^¥U²êÄ祦¦äÍŸW¯ƒm½,£hV~jzVñì,ðõ†#¾66~Ôàš³lYY²ÇVX´ô·¾õûw“ξjn–AÌðÆ&&$$&$$Æy\Ì zËæ­ïµ%—Ä{ŒiÝÐ`d»úŠ›OO7 ªK+3䊋ÏHÊR@ÀcÒb,_íîý#qùsÓ\Ò˜ÝñÏ»ò¤+n:%…!cƒ5{Û]%ËfgfåÍ\0»(ßD`įüâ¥9Íï½øò®îa¥é3PÂÿ»ÙRˆÖ`/ÄÆôUW›Yå=-5U­íãQf6Ã0œBEhoŒIDATHÒ`wÕ‡'^z÷Üûƒ±Ú4¥£¸KËïpg:°aÇŠ¯œ|ù³~ôú3OT†Œ'†×æpoÇPï¸ÔìÉÙá¶ã>lƒ Ùʳr´:ߦw·œqÖw,©ßöÚ³¨÷C¸·qï¾S®>ÿÖŸ­èÚõÌ3O·AÎê/ÿÇJO<¯ÿ`ó~(bKO8ã"ìÛ´­¾}„‹Ÿ»úÂ’Ü^ԀĒòç¬XÓºq_Ã9xùþ†=¾ð"8°µ¦wQÓP0àèp§¯c°­«¯þ£]§Ï´ªšU¸e_OÊÕi{³A~¹¨©­Ï7(¸².?ïê¸-¿í“DËWžwJY¢ ïiÙðV_€X¬¶LS !´T@Vÿö¼¹â;ç|ëÞc1=ýÀËOV6ô+†¤•eZzœì×=õÍêâKîºcémÏ?ö¡Ï/µy'žqÖ1ÕuïîhïS¨gëso{Û…·ýê8‘‘¶ç¹G÷5 *DPÒr¦˜Ð­ë§ðÊsnø?«ÌØh–µúø¼=¯þ£Õ¶ 4Ëßöásg_yýíy]¢4™µÊV¦­ÞÊÍÕ+/¿êÛE«*ÞyúÍuiËÏ,€†ç¶·KÕ)”eŽBDû›ÖÜ~ÛUßýù‚Þ”d wÚl'dúöl®;ö¢/Ý^Z¿ãõgÖmly÷¿^ʼêäk´ÂT(ªž?°¿?>ãØË®œé al«ß½cWxãr–¯YîÚ|÷ºNb.@D<µpÉÅgÌKQ–+Ö[ûî{; b•i:ØSZZ¦$0Û?ùàݺοý¶mÛ^ú :À„‡tôɨ8—}u•µ¡So¹5³¶~óË/îØ7LDÒ´”ŠBLê¡ûV\ùýo´zSAvH@ážúÊ}þWßõC_Åó?²{ß«¯|”qþê›n[<6D`ë“O56ög®8óì9^D—7fhËóÕæÄÍFlöʳ.X”<5q÷+5,MÒ²,© Èþ*Å°Û†­«»áæ’~+9Ëcöi:Ø»êÆoŸ"ª6nÚRt%–Ÿpö¹sc‚R¤z?~éņ "’¦eI#ÐÈÌÆ7ŸÞrÉ9_ºå$òºG6=µ¡Kq†@¾-on>ûŒ;îXܸýµg>Ø_?cD&"2:׿ðzák/¸¶äŒ Ò<øXkMÍ/í?벯Ýòí1ü[þñQ·bÚ2-EH]û×}Üõ± s·h+l)=¼å©Íƒ÷.XZP)͘Y§~ñŽ²‘0i5¼÷±Ç^’fXÇÞmïïí9a‰ÔÑIÓfÈ’c·Œ+cÁ²s¿˜¼ã¯ow[Î^hªlð_~þß[Xµó¥¿­ïnÝ´½ù†so¿mÕÏ÷RØç0Bi3¶h¼ÖìÊ^¼òÜËÅ–¿¼×£PPçû½Qü¥S¿òÃ%AO÷wi ›²ðÔU½ì¼[KH Vo|ç­·$?êõ/¦E›ýÛ[³Ž-nŒÏŒ ÷u÷ô…ajXV4âÒŠ”¥»üÍ:%©wÿΖÁ€™Z:+Ç3ÜPß7Z÷J¤ylNyiAN¬é«­ØÝ%¬4€Ð;¿$X·Ï7¬²g榄tš@7cÞìÒ4¯ÕYµ§¾«×—Z4¯,3ÑìسsûðâŸÝs±óí÷k,jêôÛ¬ø¢™…™Ð±¿©oØ$WÊò›¾qµñÊm÷l“Ì®za)‹N¹ê†Õ¾Gî~bó0 Hkž<£8_t׶ª„̼tl<ÐÖ<£tŽg¸©ÝGÙe9ÐÕØÔcIù æx«6U‰‚’\÷PSS÷ˆ €oŽ·§®µ;Àr sy{Uˈ„Øìå³s<ꨮnm’Ì›^VâéÜÛä“ÑÒ“]XZžÏF+÷¶v…ЛSœ­ºš;zM`¶A$Í,//Jô‡MéïmokÖÈÝ©Åå%3R¡ÿÀ®]Á0ÅdäÍ(/LŽÁð ¯aCß°WP>³(=ÖMþÎ溪6¿E8ÙgÅ]ñ¹3JŠ3bÝ4ÒÑ°¯²-(1®°8Ëèl꡸ŒÂ|1ØØáñd—•—e¹ÕPo)ØpSUoÁ5·þ ¬êW¯÷ÆóPǪ–Î!%܉y3Kf¤y i¯Û··#¤0nÆÌ,c¸£©+ˆñ™E¹ÐÓØÙâžäóËÒ…¿½©¾ªmDAlÑÜÙ¥é1²«jO}Wo&À¤Ï,*Ÿ‘™â²†|u•õ}#–Ÿ9sÞŒä8>ÒÑ\_Õâ×Þì’¢¸Æš® Y3‹s¸¿ÏŠK½U5¾0"°´yÇÄÔ ¸³ òÒã\¶åeöTVÖ %Î*ó´î«÷K#}ά îoÙ[7 §-Zï«hjiç(äñ¹ù3òŒºíµ#*â!ç®ÔâÒâ¢T#ÔY¹½v0DIE³KŠ’14Ð߯Põ6Uw™ÜH˜µ 0°·²ÑqåÛ›!1¿ 0 k·×4 h2’ æ”d'2£hÙéÇyŸ¼ó÷úDá’c²cçˆ:äk¬®©îWÿf™èŸ =&&&ê™>ï„"1Ç +•²LÓårÙÜš8¡JnÐÍ]vŸ-KrÎçãjsm¿Ðh}*Aô– Ëñ«sÍwúýkmÃQä§èW8•Å¤-8a‘¹sãÞîS±"µtÁÜb]ùÎö^%Ød¬¤ƒ(èPr ­`b6ZÜg ƒ¾>ö—E顆(Š¶>i@Æ–#FŸœ¶5RVììS—Í°zû¡ìÌÓgl¼ïþ÷xѪ…Ù][7TÕx@*ç}…Ö‚±ýRq³Öœ‘Ûºáã&_p;ðøO7wÑRI˜ôU0ñƵgßq§•»*»ùÝŒ#LìîèÑ´C>~Ä£ãˆ8ñÆ>“ç%òÖQÔ 1c>ñ³&¯‡ÑÖ§ÞCcgtŠ^Lø“¢œö„,¦üÚ[4sëWï\ï·l6˜i{1aˆ¦ïÛä-9í2:N1ßhk<ÂNœ'܋ܳ-#ÃØJ¨È¤©­¿äÆáO\n‘¸èï´Sú<±&×™ ç6)ËSzòŠ2è“EkO_ÈvýáÞ{ƒ4±·ÿ~µRŸ ý„£çí<Èo?§IˆlƒÉîÀÉ/'‰õ`íþZé +Ç­¾O^ ¹mxÛ¡«çÀ¶õûsÁæ‹œFPáä0FdÏ;a'mJ˜ìõžê„šª'õÐÂ4_:Ýq7EÙ<‹™wîÙsóEÇ'ï>õØûÃa ûׯÛÇ8Ëo‰ckîÇ@Ôë‡9ðþ3ûçÖÈd,ŽÃimº™p#ì«þàUL>qú2ãßpÐqœv4§ÞÓLü¬Éëá ¿S/iþwª*kýnÝgGŽÒçÂa­Êiú†‡Ûå Ã{ÐÝ…S`9YLS îTOqFMžÕ)6N½apš™ã‚GϬ3¾°°Øݳçýgþøfo€áQÄîÏàñ‹ðKÎq<ús,¿Ô?µë“ø¥Ë SaS"·91þu¦Á@ö9’–~î=TV8li È…ËmÍ—ýü –À?oJËÔÌíŸfvmDFgÄþÿsòFÇæs¤I &0)Ë [Jrn¸\œÝD€Ÿ¿ÔÿcR™»ÝÿK »'ú;ì½OŸjûˆvÖxòMÇoÇ OŒ1Þ-9ú*w.9¥ 0?ê`'ؘ_EŸœ€[s„àø_F?dòëŽàE4&çx°~˜CñpÞ™÷¨^ùOÊVFD4\žO=®ˆHˆ MSpaÎ>#zø乚©î€+O²h¢Ü©‡)¨¦À^›šlIKi)MÀ\.qd‘#dÂcŒíåç|`LêÕA˘e{˜‹ýóÑ?ƶrX¨÷ÿnRê_Z,I+,%!cœ3Æ"VJ+Kƒ! »dÇ®ÝR*ÛŽÔj%¥R@D( Ã`ʲ”Öv‚""7 Á´Ò–%#»˜1Ác@Ê’š´Ò —pÌLGE mY–†¨ê^)%0ÁD­¥”˜Ë°}€ˆ¤¥ei"E&æÂœVR*M„(¢-)i)Í7Ä "M‹#­Ë·|µVZI¥…08gN‹RRIÂ=–µ5.‡…á´–vR©sîpÃØééÏ>žöñ¢&4ŽHšÆâ ¢––$à|JÀ†èq7Ѧ­²”íyaŒ‹ ª8 0䣿=lZ""’¢ù¦DZF1¤˜m£j¥9 e܆¸UJiÛÙÚRŠ€1­5"g¨1Α–Š´ÓrÁi­çŽ&RÛÆ‹Ò„-ÛÔRJjP–E¶sSF¨—ˆˆ ƒã¸¨mÕjÇZGÎ’Rã\p$ %%pÆ¢“e/­Æ1l&«È²@{ý2d ””JÛÆM4iû»”Ôöbœ³ñù®¤µR6u›£*!Ü¡7Ó¤IZ„LpT2Š:ÆlM 8çJ)­%2Æ#¶vTV!‘T)ë±óÛ7lç·B†u i)50!0²­ì-ϤRDÆØhž´¤&BÆ@kÛ¥É!I©41&8#e{Àá<D!€HG†Î’š#û·È”¶÷ )¥ âèfÚv§"Ggýjm;Q§Fí˜BQ>*þ%ãÀÇŸ“dç Y¦6MKÚÈ3‡›¦eÇ{ÆÔk‘5«Éf¿SRkdvXéÓôlf ÍC‡ÌP21ÍÚR‘D@´Éþˆc@šÆ'–“ŽœÝ4ဟÖj§Cžð㬒©9S^š”R¶ož´’–e™¦iZ–Ã=hû^,Ë2-Ó²¤v€4iÅÍpØ$2ÎÑþ|‡O+B.8N®î™ wF+£$ÎʲQæÔ'Vʲ4"cŒ#hKJ­Áv9é7 m£€¢±@""Ë´¤ÆcÚ#)iI; Ý>9i‚ÆÌ8j©”htŽ8[FD΂²,©9c ‰äX%Ël¶OO“œÙ8 ö°hgi9ñN<”÷†”Œ,{é Ñ"2ÛÚº'ì±—RšÊæ’B>1haKS%%¡QÒR„ˆ ™=È IJIŒ1†¤¥%•½®™† f¦¤´¤ÒZÏÑŽÇ,A†Üö{+©§ZÒÑ¥dû*bÔÃh"ÐXªaDdH¤"‚Š´eÚ¸qÌ1CmE‘O뜟[’RêÈŸÊÁiѶ gT¤´é5íÕ¡¥’R€¶,)µƒHØ1æ£&ÑÿJ!f'àk--K:TòÀ„Á‘´K Ð%8:HîZ) LQgŒ–ÒÒŠˆÙ¢å¬wR„³•e)5 Î#*>h¹ˆÀ)©Áv–+üt¾©i¬#€1§MLì¢) šãâŸ};NO¤¥iš ƒsÆ…‹¡½Õ¥4M \.ÁP.N£è±¤”iIàcÂ#¶ÐSÿ_{ç’ìºm„á~€::•}¤Ê#ï ž¤²”½ÛW@£ÿ?¥£ëº¸ÊIõ7“D‘ °Ñt/ ÑŽ÷,õMVËåûYýò2h¦f&f»se­‹UU3ỡwÏM|(×ËК‘dŽ„µ*cB¨ 3Å6wqÌ ü¥]º' wwu“¹ÑL—yTÙs9óM…ÀK•OÙ}¨"7wwŠZk7Y^õßš ¿eE¢b¾y#çèsÒl³kýíË‘cRÝ77±Õw¯ÆÇ•VÕv5K‰1MÀG‘A$×H0ª@Núm·™«› 3æHÜn7¿j7|Ù¦)²+¤3™f¯7ŠfÅ캵ç2Ø¿0¸кWSÁ úÑÕzš8m·Dÿ±]Wͬ5¥=Á½HúÚ D r,Åyié1AoÞ–ëšI 9±mºo7‘¼—RsÌ~ï+Pæ²UûpûîC(`æPÌÑÃ&±]7W®˜²Ñ¨ŒÑ“ Ò0#R“pAæ0“Œ4d£ÓÉ3Žê²H9– F´¦yïÓ l}Ð ˜ çìôshÀoHÕUb #iЉû=ìFIS匘©"Ùïè¦}¿«÷_?ýó—ÿ|Ñ¿)–þá:í1 þ,1Båÿ&ãåÌØò¤ óùËýã±ÿ—Øíû—dÄòCœ…;(bjï…#–^?]èå°§_Èc)%Dm¯v.ƒÆé)8w¹\þq6[)²7øRõeÅ^wÌO‡<Ž<­:{’¼ÇG{çXÚOt Ìû|¹÷†@€6¿éÀ¯ª ~êUdò%»Ì:—E«^;ãéº$¸{ñvgÓå×£cE@¨îs½ÇS$’\nëgÛõ9/É¥KÕ͈| œºÁù@¯íÙ‹ÆøÓ^u]fúµÕÚÑ)ëT—ÎO7{yp\ÖÛ‡ýÑEoʶòõ9’y܉îg]®£}Ü_²)™­jùx½^æÊ›Ñ÷¹ýúð_á’GÊŽÇ!惄>uµ¾Ú²BÉu*?.AÁn㻾gÞí:‘ßÌ‘Çd<úmQà“…ø¼‹}Éw4Hž_8f†ÌüøÃ÷ÿÛ'¥Š¢(Šâ¯@EOEQ%¥Š¢(Š¢¤TQEQRª(Š¢(JJEQ%¥Š¢(Š¢¤TQEQ””*Š¢(JJEQEI©¢(Š¢¤TQEQüõøKš»yzÐIEND®B`‚suricata-3.2.1/doc/userguide/rule-management/oinkmaster/suricata_yaml.png0000644000000000000000000026047413051004444023570 00000000000000‰PNG  IHDR«QEzEsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ9Jý¶ IDATxÚìw|ÅûÇŸÙÝ+¹»ôÞ$!H-ôÞ›ÒAš(Ò”* Š J‘"½÷ÞA:HHOHïå.¹ºeæ÷Ç%騿¯¨ûÖ׋ÜÝÎìììÎgŸgÊ3ˆÒ·OwùïÁ€ `±"DDDþ³ È‹!""ò_U@^xíq„“‰5™Œ‰T&“Ñ4õ÷•™ð,«3r˜ ¥ X ŒJ!¥ýœKESH|RDDþ­ È ¯Q@AÔj Ër C ZMÓ666 ó÷èF^º~8°½#mýa³©Å{mqÌwÛOñðE™BD!„€B0¡(D0!R+{‰º¸D@¨êì˜ @æÃE› @($J¥ˆÈ?M1^)¸¼¼‰ŒŒðòp/*.ùíúuµZmmmÅ0ô«•…ç F Œ1ÏaL¢JÂPÏ <&ˆ’H(ŠB ˜ã‚MS ó” Fcéß³Wˆ»°7!'._×´†·uV`©LU9!,ËDI$4á8ŽPR)ó0„ M²÷kضuÓ@gÇaŠaCIÌõËg¯Ç—#÷iK¦Ù&^ùvå®RÌȤHà™€ˆvm›†ù9?¾zpÍö N‘ýFôŠð²•¥ÜÙ¶e_L~¹ÀFÂü&²ˆˆÈÛÙ€¯ô‚ Ëq-š5íÛ»MQÀÞÎnßÁCZ­N¥R¾J)U‡F·ô·Æ&õõ£ûÝÉpöoØ»W[G1jœÛ³óRº€¬Z઒ÓÙ±;vN+6bL9×k9¸w”#ÒDŸÝ»çr:0t¥uE™ÜÞÁFb[34Êͳ,³¨Ú4c9b>ä½N®ŒîÑåƒ[O%ðR—猲Í}°á—£¶ýföLù~;r‰G¯¡=ù;€±x߆-ÙÀ‘czhξ®mÔ¶¡¯2²Ù6½‡ûX­YvŒ¥\ƒ"ç|UW´ÿ«Ÿ£íÚŸØ'0îòá/ÖÜך zyð”Á-ðSŽfŽ˜5f@Ô£”ëöú¸Z¿-^m¢EsPDä¡€Â+½`žš ¨„`Þ8ìðÑc,˾2!̳}AgíäÖëƒ~q÷¾¦\½CêxëR+”®íFLªÈ¶'YÙ¨U¨‡¶8%WíÜr„¶pú†³ŽAQŸ|Ø<.ÁÖí‡O¡ s¶Þ** $Qˆèò²ÒŠKÊ´&·J䮡êo£N/Ð+#ûMP箸JÛ8:8,iRkgûBšÂr[ŸÈ&ALfRfq‰†•µ6fÙbl#åk7][µ„’ßÖ&únÖ#àÚ>à Ù™YÙÞÂkP§ )M»E~èäyîä©GŠzþ´ñHblafÊÍØŠkûú”º»¸(¼­¥±%zs·$%U:992‚®¨° Ù8*8u©Æ¢8Šˆ¼; HÌÒöÌ~iIiÃ0cš¡³Ó3@"‘¼2!!ˆÒ–jU¶t…»9Ö´A©ÆËëW\qïºxLßZŽ(I€‚G7W®;Þø“o‡û9Ê0ñ s¶BÔjZ"`Æ/´¶‹u ÷œ{íP°÷÷þòs¼!›:Uκ“_¤¯ýX]N€(ÿˆúªßâ_R6öë’MȶÑ0_áÖõ⨞ÎÙñG·n»Ý½aË„K¹ùˆoÝÂÙQÅ1Vo/æ@æÑÔ]&/˾qúrnö½G UþrGDàX ÂV° ³È?³~Y¬"?[]Ù¡ˆq­fýÇõo,7•$&eQî5ô×Ö­:˜@DûPDäÝQÀW£T*L&Ó©Ógììì›4KHNùyÝz†¡¥Ré+l@,‡&£Æôq½vøøÃbâ[3HJ#³^"ƒžÅ‰„B•9 à+ÊYÚ•¡‘Ê4˜ŠŠ5¥¼ædnJQZ¶Ô£MT‹pà㉫̆¢"•†)XX2ÀiJyÍù‚ m~K Q=¯Ôˆ¢R:Xc¡BÃZPˆ3hXR%éÄŒ¹( !D©(JþíüÕk††-†Û+… BÑ2™cÊÂÖ‚èÕjmQN20 ™-VLÙ82‡¿ŸwÍTcü¨^5É£E§ ‰„""ÿ¤iÚÁÁcáÄ©S/^6²F;;;šfL&£Á`xy:$SÊÁ¤Í+.×[òæEBÙñ¶µ“Âð0® ,义Óo¯{ïØZ³89øµzÊÐäµF¬tuö´Mɼ_dèîneºSŒ¥òÒ),o™”ÏÕqömÞª)ãôü•"lPë)Ê‚)¿ŸghãZ‡s‚ÂÊ©A3;Z““S”¥Á~ξ‘‘MrËr$f'”ÔlÑ®µÔ®µ—¶8:ýÞÍ{mk5hÜ2jEÕ‘ÅŸMW„ ˜ÔÁþÌæmw ´4BC.oý P(gáÔ‹€aÄ™5""ï¯7GL&“V[¡²´ ©ß$22¬a˜½Édz¥üBPxs÷ÅÇ’C†íN•ä˜ÞLJ>»õðm«F=ÆŒ1¼g k PH*¡¥Z*¡~w(ÒßÜ},WîÕÖߦ ñòÖ}—™úÝ>óÁˆ~mjØI©8³a×ýre׃»øB~^±ûýêuÒÍb‹Zn6m5z ÷¾gI¦UÍÆ} ƒÛ÷dT”Ùp$‡ví;|øÀŽõ•¦¬í¿ìŠ-·í=|P”eæþ½Ç²rb~]³»Ä®ö‡Ã»BÜùíçb( ['MUu †¡š¢(J"¡¥QþDDÞ-!¤y³ˆÿ¬ &õ›µmîg/åX#”~çÌηXq¼VDDTÀ¿€-‘ЊF@/˜xŽGâê‘ÿÌüú«m9sÀýþK‘;âÄ ‘ÿ¼ øêIÑ""""ÿZD¢ŠˆˆüG¢(b˜h‘ÿˆÿ"""ÿeðõ`Œu:½Z]þŽœ˜ãï——kÿ;•N1±\yyÅ»<E1Œjµæ/)$!Äh4ýU¹‰ˆüÿ* Ï ¦§ay‰³¯="˜ é=ò³N.Ôhó¿ç©–€œëDŽlç‹Hlœ}í°€$46¾IÎ&“‰ã¸êÜ8ž7™LFŽ²ñð¶‘Ὺ½Bxž7™X“‰}útd_³Ñèµè7~ñ}-ûK÷(ËÈÞýÙÓ?ž‹¯x­ªì|œŠ_{•_ƒ¾õ…ûîóþ{xk®ÿ–®~æ0¥­£·³‰qÐMäW@™¥}]o¼oÓ)¢MŸ•ºõ§—(«0ayLLQ˜¡h èW¨ Ú±N˜<û—ƒWò0NWf€å0Ƙ ÌrJØûǶ>äô¥«ƒ§—§ÎŠ3æóœÞÂÒæ Î“µhr'&»BŽG=x3ŒÆ¢íK¾²  #•ó<L¡(BÒ±‚‚‰Lf0òH0Z(Uf-,,^UM' o~çðÑÛjÆÓŽC Æ„å1‚@PˆPŒ‰3$4Â4#ÅL¡ F@€71*VÀ€1B™·% e,Ës@ SŒìµÇt÷/žI–0a}†Éº–\¢-+в€G 0JÂbŒ¦Áœ‘’)06×*FˆÁ4´DBñ®¯çË)12š fFÀˆåB˜¡)D½¡Ä#…½kh0Ù»ÿ¾ù}åèä›{%­Œ&f ZòÄæ„ ˆ‘ˆcq"ï–peIq  h‰¼A¿Ñ㬎òki•M´WÄø^ e/·±Ž?¹åLtžðºç¸¼(#..U@ˆ¢(†‘¶ê×'ÂÍ 5YºxX$Æ’4è7j¼Õñ‰¿ªÀ-¢÷Xo¶àÒî#©¯r‡õiçJºvvWÒñÌË}µ°H\m¤ì‡=C·gÁ±½_d·®a-¨’Ã[÷YtžZ/oÏŽË)µ[ S/sæêkÊ€6ËÆz}:cË+Î"³ñ²“/ýv7ß$ •KÏ^,),WQ9W~ÙuCç>¢[¨TbáªÒí]ýs´Æ2rÜ´ÞŽ¥ùjCʱM'KÜßØË_nÒ³ú˜=¿¤(kD}üiˆÌÒ†¤Ÿ]»ã†Ž~¹â|AÖcBhÁ";#%µXzô=Ð[NÀÂež]·û¡[ÏQ5Rehó.ï>Yæ÷шŽ|q‰ÄÚF0è“ÄÒÎÿôÃö4p¼h.웳/õŸ1% ÊL2SzpóŽDETëÎõ=U–6–©gwˆ.|+¿žc9“ðļ#”,¬C÷–5mxKõ)[6¬¶BýZôø¤cœB=­PÒ®ì:ø[©Àˆ"(òŽ) C³ßÕÁ {°tÑþg­ÊnàÈÞÜy«®[øv›Ñ7òNܾbî5'kØi·MM„˜nܳû:ôlësm˺;YlV½ßÎÎ˽¶kó½ðÚ<õ¹qL›šÖn–9†…Õ6\Ù’¬'P©&&Ú¯G+ÿÓk–ßÍÚÛ)Èfw|‚[ "ÉNž.ulÉ%¹·£ááõ×tŸå]Žæ†OûⳫ'ŽŸ¸Ã1¾u#Bw篻ƫjÏ[1®éÅ›Grî­^yM ª.3ç¶kìxÿ,çèåžqvÍÖëžGuÛE…//Ù¯›'}êÅÍ›îq6!_ÎÐàÔ+š·peƒ6­[zeîÎ{‚UÝo~ßèâT³“)fËúÃEXà,|ò²+~9‡¼š|>®ñÖÙkçÈEÓšÕ:’ö°:‰•we÷¶ë™Bx×­nä^9²õ<Ç{6è0¾EÀá»ùoñ¹¶_ô]„ùV)­-ïü ´Uí65¨ «Wår¶C>ÛÇïðñª+¬m¤ÇÖoKýgŒo•‘¼ÿN©ØEÞ1T?X·æ¨¦ ¯WSçgÞøJç@[™ãû“ƒú!ЦÞE ¯SÀ„ë»wžÏÁú 5Ø·³1–eç–šX‰Áø‚è©ó<ÿ±¥±ñaBj·Î-­ooâ»sM~2NC;Ôªáëï5íËa@~‰T›•Ì·ªE³\¬Ëï[Gz+Õ.Vwod½ú$ÄXx`Íò«þÁmÛö™¶béF{ȆKBz”éˆBáZ¯éðn6´ÌÁVýX†gbYV •.Žö©·Jõ¦Jÿ€ð&£‰ÕfÊNEÛ+ E;:¸¹EÔ^Ö WM[Hs&–e1Bó&–3•X† &cqr)ò·‘SO÷ßÂq,k2•—ØXJ‰ÜµÏ{}Õ°“02›² o7ØUrcíO—Œ Á­†9Hƒ|ë4œ¹ Èœ1ÓJñ»úäM&“‰3>¾xßÔÉÍ^ G&òn) _‘Ÿ—§g$€Ñ“¼Ê4X]92÷¬Ø£Ã€ˆÀ›wà}õÉ šâ¼Ü<Á¼O*feþ âµÁÏáÂHŽãLd²WuH!€Âø˜ÄÞ#{·Î´·.Ý­ú¢©´¬0mÿª5 ecŒŽ“q¹\TTh+6öÐUߺ5M#¦³…¯o£Ñ`Ê¿µ%=cø„ñý$WXmÑíß¾Ú}ŸÐ /Dêòaÿ&÷ýp"“ 5­õ3…Ä‚‰ãÝ,¹ûå@SÕæ€Ì+ߪùÌòº¢ë'¿:˜Hhš"Ð _YE€ êe#X8ÔéI?|}™ñk2¦õ“;Ž Ìë†pYMnvŽ‘‘€s¹É Le%iwVÿ´WÍQ HàU1s9Ž3a w§#¢ü‰üM¼Ý›®0‡àpœ±ûbaX¿‘µ|Ü|kù¸+Þdi±¥“¯Ÿ¿¿ŸŸ¯‡ƒEùßò\†¼ß»¶¿¿‡óT@ˆ{œot‹êV'8ÌKþúRé3¶Ÿ+m;ì*)6›ÿ][•TD_+téÙ½½·«K@·‚&ĤŽÎ4 œÜÓ”t;õÆñž«>·@ÿšAgƣÀî-kÕ¬Ñ(²yiº†NMIdõU×Ýçq}GÄDZ§nM+•µôùZ5=ŒKqí3iPÛúµ‚Cÿäd!>!YÙrØ€µÝ=|#B€ÿ ÆW«µsõp°±²RÊÌ·ÃÄ ÊÀ0%ÿrãKî¥Éêíééæ\ÇXžãEP/•@0± éÕ°v‹^Ã?¨©»Ÿ.ˆ Qäo‚ž;wîæM¿àßëbdÖ261!G (³Ý'QZZh³féJ²‹¥N¾ NM¾}+µª\ËÇN““ž[jx• H@jëäkçP£¦@Mÿ@_›Ì¤ä¤¸8ÎÞ/¢AmkT~÷nLZ±©<‹^“™¡·ô ­åÁh3ó ¯ÓeÐfç2ÖüÝ· Ê90ïÖng­N‹+ª0å$%ç€ð gIœ­ç„²“£•îò™ÛeM²Êtíq¡îÕf˜LaáX+48ÈÝZ¸ylÿ¹t-«Î{˜®ñ ­à.3%§f%d[„……Xj³îÝ{˜Q"XØÛÓd”ò!caæÝ Cz¡Á~Ž\Aj¦^®JãÒ5ѶNÖù1÷ó ¯·ƒ,¬mô9É…¬©$û~z…wphÝ7F—Ÿœ®¦­mèâ”ø<¢$rcLJ+$´ÌÞšN{”¨ÆŒÜΞÏxø¸XPÚÛV¤Åæjˆ¥eqjR©K,TŒ® &9¾TâÚ4"Ô×IñøÑÃG¥º25«òuE)¯´‘)™Âš*M(À2¥ .KÏ(*IMβ¬Q·Am?Ú”’S®)7È=}¥¹%–Aá¶:µÒßG©>¹cÓ­Äa‘¿ DiÕ²)/ˆ¯a‘ÿ„Ð5;çtyê–tA>‘–,"òç55èÊt¼¸8ND´EDDDDPDDDäŠ¢Ê%¢!qj¾ˆˆÈKQÿÅ‹Ì HQocxË ÿ>ĆˆÈ?¹B"êÞ(ŽëBä!„ ˆ¢BÁ˜Põ¯ñf!„wÓ?{GËf~(ª öê²½•ÅÇ>¾qñȯ»ì»˜Y ÇÚǧ¶OÎÔ‚3î݈É(«È‹ÿíz" 6–Þ8v!Kÿ¿ ƒD¸Â¸»gvî=°åÐÕ[YÆsΟ9´y÷‘½2òµ/¾MHYZ̉_géÄNïX›påÀ¦ÝæÿOº¥1a(¿w裑{4€è×~<©ç©Ü_rÆ”ëW2ò_»W(K8è–öõ#ˆ¸ðÞ¹˜„büG%®,ãÇi+2+ÞâŠpyÚ©W4¯ŸÉŽ5O߉ÎþhÙ[±í‹ÅÒ+Þæ.fŸÞq±”ÿöþ¾í_>¬çÜ ík®íÍPÈ?´pá—; DŸÿ0“+½»rìçß‚Ýuú~^iÒÅ­;¯r°6{Ï·ëcÊÿW2Wzrõî{É%º¼‡+Ü{±ðyõbÕqÇw^.Õš_ر`îƒðbüþüº¥_MZ£gk¼sGéå-?®üÍ@BˆB”ùÍ®ªÝf–¥ úè»É |íÿš’v.ßUdxY{¸ºî«}e¯mɦ¬í3—%þ‰ÇIbí6pÊW¥äÍ“Ew˜¾¥èõeËÛ1áËèâ?áBJ”Ý>è®| ,}ôãÔ_rÙÿÏ'…’…ö<{É@‡7ˆÇû¦ H*–~¼¿Þ'óFŒ0`â¸í‚VöŠ¤k1eoþÁú‹cúõ4|T§N ?:Ÿb À%o˜=¤q».A>›²9SÍ!ÿë]¦Ù§^ÛéóT˜0¯/>þÕ´Q=#GìºøøïR©óÐUßLŸóÑàéS'7+¹)ž}NßäŽáS×.1~È“G)Sïçš^TfÂ\\ÆÖðvU‰zónbåÚiH¿žÃúµkf%£²NêÒ®gïíš—˜ì‚¾ôÒ Þ‰ê1ð§Ã œù¶cCêØârÓ«‹Œí‹K<Ûzªo|°ç§Qám»‡öøæçK&,\\3g`ﵩI§Ç4j×㽃Z „¯x°yá°Æí:w[¼âŠÎl!ÿÔÆ+’n-8Rˆ¤œÞ8:¢C×:m&¹³Ä€Ëâ.Oóƒ–ÃlæÕ±]>O1{{t»÷‡,›Ü®G÷ºÝw_)ÑßYÙ3¤}ö ²ªl@®"g×Ì =ê¶êÝ|ôñß2aÍß'¤M÷^߯¿làðƒÝ_궬 ìæÄÆízôÙZŽqéÍÓÚtéR«Íû]f^NÕW¶ "]Ý·ÛØ»s W‘ü[{&6ëصNÔ¸‰?e– ÆâøyþÈ(eùâø/N7îá¬AÝÞ_õy×ÞÝëtZ{²À»¥gýö=ZM­¶ [vlÑä¾!mº7´óx"Ù+ßLÚ¶kí΋–W„Œó+‡všŸ«‰žÑ®G÷5e˜hb.~Ñ£W—Z­´ÿìL¢îùÖÍåžìÝíRKŸ_?eúVN0œ;¡oý6Ýêõüîç‹:_þ~Ä °Žm|ûL2´cãÉ÷Õo1·yÃãØÜØ»å^=ÚUDß| Þ%¬E×zDáQ£¶4}Û]×[<Ã!5¿8:)gé ïF.hbÚ}ÞÞOìå†có§»ÐdX7+NO‡MÿbA]Ã7“6d”¶·I»p(ÖjÉ…ýpoſt¿6nò…¯ì%Yk2.= üzùJ^îø«³ÁËÏQúü¸"îÌÒUÚÁóÛ&Ÿ{EßQJ“ϯ›[,§À»q—Nkyöü~‹ã¯Cæ¾TË2¯?d»àøEáõÙc \î@—½jøŒ¨µ?õˆôxYB¾$få²¢;Z«ÐfÜÞs4sÔ¦m~ÒÌ•Ó·]êÞ¬ýØ‘QÞÆ'/¹ü§ pɥͳ¿Í›¼uS}\˜ËÒ@¨Èܵ1­íŒO¤`º½ûDãÉKßoçQ¢Ö+%è%Æ%¯+aGnüÕßR¯Å* Û÷\è¸ø³ÍÕ¿¦n[ð[i貓ó­Ø2“Ô€ª×w̪ LYâòûÓº5 é?c[Cÿž­N¯¸µ®†ˆÎ5xĪŸ=dé;çùùÉ­½­À†âã»â;|µÐUìÃ-›=}¹h`¦Dm#CÀ¾Ä…MÏë½m솵–; =p»ûêçUµ%!oïxÍ=¸ÓM¢­àQ5: ûn¨— ¯›½âAZã–­?Þr" Oä¶E7¶+€ýß[¼|’‹eîÑå£Ç ;5Èö÷š$qŽÚnñísÉ‘Ck$Ÿ¹6¦èà^£WŽõ””§ü0oWJ×F@ÉÂÇM 83óJмA† 'c !ÍT±Öh …Œ’¹¹^=|&º]°-’Ø´éå=oÞ±ßü¦›EØ«”²P'Ó±|Ž ¢ûvÀÌÄ|=ÏR=¨¬dÎn5|$Z%§1 |vªmHh€›­À4tU_,øºÓ/*¡æÌw«n·^º®£'õÄe÷6.:Ø|örK=gžæïXy®á¢yÁö±¢Ð¼³Èl¼C[„«h°ñt|“-G²nÜÛsí£cÛ€ðÚRô(Ÿw Aê;ïâ¯R+«W€©‡Æ6þtn° T¤\¸vôصKçC¹ ÍdÛ»ZY¶jÝx?:é»Ï¾N)0 À„`^àŸtLSR•ÅËG/)‰œâMO,4\|zëîüIŸ|x wk‡§+Á\6•Y¶1£Ùô.ïßÒŸ®,±ðèÒiï–ᶕ•@ÕúÍÏ;fÔ³Ë_ýÉŒ[Éæ°m„Ì ò¼=öò=1UµI°ÀMUáZ²fGCÊÝ-ò|ºÖr“‘â³›·fNÜ{ðdìáþíÁ<!Š¢¢BU'ª¼„¿Fi熣߳<¶|KlBúã‡É†ê:‘y˜R/õBO@iãAÒb£ã³oEçaÕë3'k$ GR}r_ú ;sœ¼kjn\¹\ððìå|‡Ð:öÏI  ‹þyáº%íûDTdf–”è€ùäÃÛfMÚguâµY[æ®1„÷ëÖHQ”U`2÷]r%‡&M=p•‘Ù¬jDIÒ~;u9©0ëñ•='2Œ”ÊA¢ÏËÉ«à8įSS‹ «Ž_J,ÌJ¾{á¾N¬¾s7jÞÀ§º')õÒuÎ. UߎΔ‰å°T©¢Ôyù!'>±0ßðf—§¬7(*þȞؔ¼¬G“’óg¤-휔e‰×cîV^¥°Uq¹éY–€`–§œý,IÉÙ½Í=dXsátixóºÕ½méç/häÞ-ûvõ‘±&OK-e\Y¾ÚX’žùø͆z‘kÓãóŸËº¼ßY%edr)ʩÄHwÂÐÈ. é ®¶ :vŸ8ýX—9Õ”¿p”FV|Ž–Éd4e6ki³õÝÛôé»ÙºM œ¡D&£ ‰LJ!p®ßzX'ÅçM;ÌZ‘0né0·çÇÄØ‚ƒ¿ÜŒ»~lvÏýû}½ôœ)Ïz|ÿv&KØÒè‹Ço[›ùM½ú]z}Wú`UW×ð/VŸ8ô›7°è«]ZÎN×°î‘]?yÏíÇž]{GÞWÃPOFBJÊ_2IL1ûöúF4SJ*[‡Â5ä£IíO|:¤gø€Ÿ&š3aÜÛîˆgG4kÙiw9F– ýøS«Ã‡öl4òX¬›ºfž)°“¯Ë9óêΣ:öi·Ð«ï@7…­Fû0nd`óo·>°p±®4Ædriu76_º{Pï¨:}O:2$ Ñàþ‹³uàÕkv¿Ðâ©­:xIrO¹tíP§`lãÖ“æ]·©ën6Ðhç&“Æ:-iÑ"ªÍz cÓmt×üY=º4—fcm© à2~]–éÙ£ž¿euÙŠ›Ö¡K·ðÏdG6¨mè[·užÛºÃŒ¯¯H=í*Ë&•Éªc_ Ç'jæÙrûÁó“šµìÙrJ’ìÚñQOÉâî=tœÍÒNmßï.ŸÓ²Íàѧ¬Ã|Ì Š¶¯?eJÀÏí¢Z5ÿ®ÉZöï­ŸØ)tð-=²VVvÏózMâí„Š*á¢hihh Þ¶E¦våÒ¥sCõĈÖ~Õ&ăA@1R†F”T.a%“IÍ6’²^—®Ö‹;wì?âÔ+涙gDß(;¿DD°:zåÔíÌ v‘þáw ®H^1hIýïˆò·x×^¤DŸ¹aÜwÎÓw­­ø'¼ä1¯×^Y½ôêôÝäÈ¿|¿iD ·¾Y"* ˆˆ¹ãL§Ö`K{KæOÈá¥ÅF+'É»{„&u‰Aé`#ýGÄEáŠwöz­;åÇÏÃ|¬þzǬ€¿^ÜK€¼É_„„¼Ý8BOé?ù U[Œ˜¿DÌe©þ£ú°Ê´@^IÕßÞ¼tÕO9¨ÞEãé/á-óùu­˜Âóüëd£RhŠ"„`‚ß´õ›»Ù(„±@DÑ4"‚€ P4€`ŒE# XÀ!š¦ˆ `‚h† @¢(O~Ũ: EQ‚Q4e2,o{½jÍ`åòFs „Ì5ó²TO/;EHÔ?‘*ÌÛŒÌf&øí÷7û"‚EWºô›-JTõ"U›ÇB•ªRJs ª2AW’„Q¢Ì†ÞüÒžèáëRÑ4]@T@‘ÿˆšÝÕÊ™zOoùø&)q•r!cb–³˜"˜Ì#Yfë!‚±€ªÜcòTN•Î® àÊy}æüÌi!@0®Tkô|Úè{ZûÞÖÇù÷+ TÅÃyKW 2jÑS^gõ|Gó7ȬcU~ee`eˆ›'¿=e§zò-ªB¨RV\Ýø†F©¨}""¢þ?ñlŒ®Äìzî+ô”€½0Æ×ó™¾*ÿ׊ ø4ˆˆü×÷ PDDDDT@‘ÿ¿ëûÂDDDþ» (—ËÅy-,ËŠ• "ò/T@q³à7A¬%‘ b?àÛ+ X""¢Š(""ò¯ò‚_¡m[ëç/ÒN»“ÿVç° jÖ®C%IÚ·ê¼#$·nÒ¶~ÂÙ+¥FLhûv÷ó–°‰ö_MQ‹÷CDDä´…Šè}G²Œ.뺽å)”QSÆZ=¼pâ‘9R+¢$îN2ó.‚æÎÞcj ¿Æ5íÄ›!""òwÙ€HéW+P©5(ÜlTTa|¬ÆÒۃόÏ6Q¶þ®Éq…šÜ¼²2ýÓóeh k¯@_[%£ÎJËÈ*}~ß` gšuëùÈ3ÊÖ^™›‚¥wýzÎ9÷¢Õ&ðêœ<µÆàýT*‰ÊÎ;ÐÇJ%é©™¹”¥›—ŸŸ#ų%ɉ™%•;Nцð<þ&ðˆn°ˆÈ¿É$„Úoäçßþ8¥]ó Ú¡¾6Ã'ÎêåHÈBGÏü¼•êÑ©¥á£'мfhã!ÓF{¾`{:ÚBeïâ ”J­]¬HbéR£ö°Ã<¬$/)’¬ÕøI}{†…79c„¿Œqð:{BëðÀÀðˆÈÀ*S‘vê³à³ÆµÄ[(""òçl@„ J_vsǪ}åd º¾.©u“îmUÛ>XW ÍÇ|UÏíAf Š¦˜chÓ.dWÔÐîÑÉ—RLJbOª¨ÝÄû¥ÙÚ¶lU]7a]†VÞyú”µ­78úÛ,ž¸½Xx*, ¥ jј?¾C¼…"""Þ A÷HÿÆN%íRËÛ×wÀì™Zø”ÛZäÕsìû‘}Æî•›¦Vü‘¹{ýr–€)Qò]m:yõü æáþmG¯çàÏì+Þ?‘¿J?ÙWs¦e R8XT—`\“@(MÏÏJß½hÑÃB¡:‡¢Ë‡_?†æXî K@ÓU[SòÅ©ù©V¿Î]˜ª~õÜêå·ìl}Û˜öQä¹ë{õ”ÊÞš+ט8,ÞE‘?ÆËÆ‚ùÜèLEûž!õB»÷ô¯îù/,(ôŒj^ÏÕQE—ÎÄÙ øtp£æMûNYÓˆÀ³F“ÉĽd€‚R¹¸yùº«T*W_oW7;!'§,°{Ûðð:Ž¶R(8s³ØgÈ„~á-[œþQC…Ü­F÷zzøÕt©È,®\’&õ™zâ—nM=þ÷U&Žƒˆˆük çλ~Éj"°†Šô”¤ìÊ‘VCFRªÁ½¦¯<áôíÇÉqIIÅ@E~nvt5•däVdÞ¾k°t÷÷w6å&ÅÿÚǶmùñèYÖÌ.¶ Qÿ6[Dseã‚o¢­¬ª|ú}ÚÏSúÔÅ;† ™ÜÍŽƒª*JÏ|³|÷î;Fq»‘ÿ¦õ#÷¦=FÖ¯†“Åã3;V}¿ß¦çêé£ll섘 ÅÁÆo{O¿'¸uøx|ïöµ$ÚìÓ‹çïºZăELJ[–^PÔ“Ä®š¹,Ç­çç û:êSSË\3ÏÛ¸?¹Ù˜ïÇŒSÅÏ4øŒŽ€CX§ÙS:dêTõý¥w–/Xy0Yâ:þû™áöúGŠp‡ÝƒzîÕ<;-š®=úˉ}kY*IòÉ]?-?XîñÞ7?¿_ËËnÆñ݆œ‹Ÿ [ãÝwʘ;xºËŸÚÍ%o7ú”¤I¯Y3¸ÛѺì[f-½šf©}‡ISt pÅG–}»ïÄcó…[¸×·pDÒê¯Ý-x®Z$ÁK·n!Qîç*96süÁd·³'´ qF%‰Ûæ|}.V#õï8óûá~¶2Í£+?Î\_î:ùØZϲ …­Uúém?þx²Ùµ™ðÉ°¾Á¸<ÿä’¥;ÏfŒž¾(R¸/«]ËÕxøÓI»îëi·&“VL¬ç*JS×™q5ÛÖmóѬ¡Á–ù·Ž­ùú×Ô"Óó·;`ÆKkÝ»AEúX\[øÙ­ú“>çV¾·,KÖrþÆO’ÆöÛZúìŒ&äÞuÔÔ÷]öüøíž-1|ÂÈa2Þ³vÙÒ÷ÄV$òoPÀ·îÜ’öŸÐéÖ’éß$rÝ'Ohzóaí^-hzïÒ_~éÛ=Deòì×þí˾ßðÞí–oœù ég±å@ITáÃ/¦,1I- ò·ldü¢Ñóc¬FoZh.ÃÕŸ>K(ùjmÏ'E“YU3ysPŸï?kiw4;xH¿ºW}º.5túב/Ž@ò¯ì^p(KÍ©zÏ™Ó8äúá«Û&öIYypè/ÇÝÓ#(Ùùí˜;y›·Ïî0#ƒE`‘yoçWrK¯ §Ln=ᜢ÷ìu’— ^’Ë)-¥fÃY×n=}tDâêoNßËIµÑ2{éÎ1ãR*,TR¦Íç‚ãÖO››*>iÊû±cÖÛ~ð}}þøUdvö&=Fª¿öóâ}·ùQ_O ÷¹~_Õ¬K­ò/ºåëô\ðÙ{×/@)ì 6 EuûbÕô–Gž¶í3:¤|ÇgžçíÝi ™Ïû ?Ê^9}ÕmM“&¶oS{ÍÎèZý ?—“ƒ>ý¶„±’™<ê¿ö.×ì?¥wÌò™ßÆè;Nü¤]„÷Ö›\‹(×M£Fß/¢ì$â–)"ÿZТõîó³ÄþЫێç—øÒžÍ[¶jԽɞI ¾°óæ4%ùYZMvÖ–A!õ†¾¿y d ½¯=[Ĥ~tëN™CåÕ<Ì1sɵTµš¾q¹¸Æ9~ZYˆ.!1E- B5§ð³´PÖðT]\y'¿ÀpãBÚ„Ê4ª÷žYàÖ¬î.è+<›}±¹¿Ÿ£¥¿œVÀóÛ{<ó –º÷]1«e°MKKîÝ•S²Z}" O,OÊ.ÃPVn®. ÷ÁS?¦Rׯ»”Ââ—m‚ ožLÉÓñ S[×jìÑwÕŽiˆÖ&\¶UàÜs—ƒ~˜6ÃáÌÙí;.fÐ`ÊÏO}\$ «€«ç¥Êû•ÇǤj÷ WѪ–J¬¾q3·‚•¤•1®rJ(ºrMò駳—Û±íX¡¼µ¨a²m8š¸åW^r[±æÖáØÌr D'yí’Ú=2ªyˆM£]ã Ð ¹Ÿ{póÅÔlµãŒŸ=tâжSbù·(à³ÙøÛ˜å@Xí #V—uûØ”Á_¤h*;‚©Ür“„ÇÙïûÓ™¿oƒ³U¾gbA&“ J¢|Y¼¬§B s(-(*ª“è ïqN ب֫ƶ9:þ½£·‹ÚÎùÙÙ,TžíÝzê3aìzOb³ZŸ>ñµhíx„€µœD© ž8Ù|ÙÁy+rZŽ1üƲ w/^”LxW™·À™ØÜŸÛuÝ–Ä?ùýüÂÑ]ƒC[µêµdµrú¨#Ñ@K‰„ R©„å0fX‰Dˆ‘H@`+WÁ<©„ÀxÝˆÈ Zµèµt¯×‚žkî苳î,êôÑݢߕ‰’ÊàYö‰sËkÙªŒÆÑÐOF¸ !Õauy±çgõ›_ö¤²vL344²{Ϲó¬FûU´Eþ¹¼b$„˜J s ‹Šõ/¶%r.Æh;÷Š°wtªß±]m7«gL±ÒÜ´Ž›KÍnc»Ù3ÏJ.~x.Å­e÷0׺m;EÙ¾Q‘9mLbYÛ ÝjúvìX³êˆ¾¸°0·°¸”DKl(-ÒP®M¢:¹˜Á&m9±«d+a*am‰Qææå®b„%¡qYF¶^âÒéý@À÷ËQ‡ƒ#ê¹;ùÕ©]Ï›N—›þ`÷ÄÙt›áj¾Au¹çn»ÍìïâV7²U÷p%E¹uìæeQ}öJŠ^*WH@âáÕºkÍ¡’»ÅYÉò†MÃk8·nî¦~[úüÀåЬM=WSüåß”Ð*k©Pxó\¢[çÁ­]œkEµ©ä €áSfOŸÖLùb[U(ÉÖÚ6ih£°‹hï[ý(ètεüm-eR ç]¹]ä×¹oSÇzíÚ{ÛQVu#kÓܼÃYÈÄ ¥"ÿ|Ëž@>wççË]'o¾¸ãÓaaóÆ ƒ‘tj­žç´åF>õðæ%GШ_·­ß1;ÂNËc@Lµ¡: —·óÃ9ʾ_®YÖ2÷z!&¤5f_=¿i^¸,tÖîGû‡5°Çœ©¢Â@ˆ`*WëÌFoÜ°‹íúÝ®yNZ'p/Øç½ìúO+’Fnß¿iuÛ¢s‰:Pž¼aul§MŸâ(1w^Þ°K?ñÈÑC»{©¸âý«Ž9Ìß³ãÈ\ëøÌbµ¢½²tõ.ͨõ×íš^Ç  &­Æ`ø‚[‡§õ.}¡X¡.×ó¤J™o}3g}JÝÏ÷íX»vl€¥Q À84˜¸aÓ¯'æÛ\üáÌõb0æj¬ÚŒ^»kVÙÑíw2*Êâ®n9T2ùðîÙ#}6ÌÙ™ÏoÐit< œ®¬Ô€ A–CW¬ÛrzYãد7îÎ"|ÑÁO¦”„ŒøùÜî9“ÚXIÌ&'méîéáaEW—MW®ÑòÕ6`îáí;¸Öžþ¶F™ºLm0[™7/>P¶ßtiׇjR|þîé‹ ÍÄM—vOÕDFc@ÒÀ.üxvߢ) ®9iÛÈ?™'ë‚1ÆfÏëŒÌ©† ÎS .ƒ—™ÿã'Çn•½^¶UŽ>vBn1n0yчü£'òÿÃó<ÿGF Ý?Ý<íʬiw3Mâ)"ò7õþMX†ô_ôEkFwçš}÷ßh»8Æ©î˜Õ}­qI왯&'óâmù‡Ú€ÿ8žØ€ŒSë\¤æ¼6ýÌŽKj^ ""*à‹À#„!¼ 0te÷EýÁþtR  UíŸþÌÞЙýë½`‘¿‰×HÇq<Ïëõz£Ñ(‚Ñh4 <Ï›L&½^Ïq˲:î Õ cŒ 1KžT"1 Ÿ€q¥ˆ=…CŸ¯öli«x ‚€( !@€ ¼ Oå†:|¹ªg”Ç+…TÍ‹yëµ`vÁ½¶eF_Í;ÚÑ]A‘¯YBQEQ E¥ÑUVÃ0oe7aŒÍÖMQP9gÌ6CÓfDUƒÚ{֖沯È`Š¢ˆ@ðSÂEÌÿaŒ«ŠŠ(Š¦^n"0ÛÄìÆ ^{EOÿ\{`PPÂ’› )„þ€€Šˆˆ¼+ øŠ†OÈ Û6QzÔ}ï³êyÊbömÚ±ïŽ}«IC¸9ÉŠîÜ"Á¥«¦lÈâä=† }¯±´(v×üUw xi£Y jibü[´°È¸~ñÚÇBÑsGÖ ’nÅY¨l;y%'bøÂAÝ]ÔwÖ\¹ÃX4Ô3Tãæª;½tʼnEDæÔiÊg]êPwï”9\ýjÎe]U1 ˜+Ÿæ£g ôdãr€z €ÜÃ;ø¸«.<ñÃÚ3wr€RÖë;xÐ{aÒŠüËß}{ð¡àù(ÿòŽ3>‘—kš´mÀ><óý·gÃ?“»qé½t¶Åˆñìõ7KŸ{iÈkv4tP„¼8n÷‚•·óy8w˜2¡C#\¸kî²ÛâÖN""ÿ/cü"ù#MyŸ+îóÉ ÛŽC[;©Üdé÷.XôˆÈO²Œ"sk7pî0‡£óço½®øúÀ7)ÐNZuld»yÜÄ¥ß/fíºþüƒóã+·•´×ÚÍQ76Í™¿£¸N;ó2©•Ch¿È²Ÿf®Ø‘9tJk LóiDö¦%»ZF4¨çÄ §¼lŒbœû¬˜'¹½sÕÜ  •žƒ§öOÛòÃú]fq’ E`“ #ýÍú|Ù²Ãå¬@€àçœqÚ³U·.¾¥Ë†N\»õ†A¸׶S2ÈÉ/ÀÁê› ¸¶îÿÅ— æoýM¶pßXw)rì5ibë¢õŸ}ùÓžxe‘wTŸiœÿcÇÌš8zD¨ìEˆÜÚ¶mh¡ò í?¸­•Òªq {²Óâcî'Üyɺ¸Ù4hT-à.]ûY”ût«ãD6©/=–Vb(JO-cêt¯›zëùÔ+»wѼÄ$ºÛϦ™r3 ¶ÞvJUƒ`‡S ·Ü»½kÀ So蘧=¤¦ãÚ¤™kúÙ¿¥Ûxø²¤NJ£Ï^¿t:¶Â#ܑ¬¡œ•D„¹2…×RÊ ŒŒg bMÚž]ç ´Æ¬”,ƒéuæ%©V_PCíÎ]ùÉ+¼:×s¦…ŠR½Ô¹vX <ëúƒ´þŠF|ìDDÞ}/—Åܺuáúí»¹ø)ç·ÚLã³oæ ..ÖP[Àê¾26efÕªï‚+Ô¥ez©JŠqå¨kõ?BQR|…GíÚN ;Ÿ: í^í"VŽ×²ºœ"Sx _K•u­Fž!c¾ðÁíè«w¢c5!\—atvwQ ¹³w-k`*Šl<Ýœ-U.žn–¦„B–ImÆ鵫—¯¿Z³u ¢(J‚h«›;ª˜ß(W_‘Q«§–Hjïêg‰*åÙ¨1Êíœ,¥ —•UXÏtšòr“D)ÅH­Uìã›»/^v‚›º‹ñXEDþ6 !O)©Ö Ê´vþrsÈä9-Y±ùû¾þ©ü9ÓíÁჷ¦8óçn<Ç›ò¯¬˜•]Äý^ÏtIæûtêÂ’lÒ&ã:ૉõë„Øx8ÏXÝèâ·+ŸOÿŨ†ö¢’Šˆˆ ˆRØ8ÚËÿ§…#¦„3'ví-¬ß&TñJS˜’[9;YT/î@ÎÍW_Y$ÿ‹‚¹ÜSŽËCÕµc΋ˆüOyº­¿µÂ(íüë8X2%© )‹enuü´±¨ìlL±×t˜¶ö©àïDËRïÆ€r ³aˬ\\CiBt|± ²Mac*IÎÎ×9„մιü[žyâˆÄÚ±¦+·qTpYb³K@[xÔ«ëe‹ŠŠXy~ôí¼ç§˜P2Kßzµœmdš¬ää¤|^êd›ñ(ň5‚}Jcé¬ÝkºÛ`•µ ´iÑqE:žÕj5j=›'¹ÐJ¿ÁζŒ.;5!!ŸÅ`ãÛ°–sÅ™sYæä5B[Õwqñjж…½:÷ÖÕTîEšéÚÈŽ-±tveLe‰÷“eÁa²Ô[™Åœ¥w=;>=#§\[Znâž^.‚”.^Au¼¥¼.+æQv©Ô©Vm_w+ʤͼ££0ˆˆüÍ6 4rÌ”¾Ýê;y ˜2¦®·¥gÛ Ã†´kùåÒq:t<¡W ƪnÔ´CCƒ<ëtºha+ daŸ?sZo•£——µµuèäÅ Šð ë4uí¼v‘n@ÑŒ]˳¦„Ê€uÍ° ?LoêmáÑ´Ë”‰R \¢ú.Xܯví:æÍ7§©ò!­÷áÌ!"\¼jtÿô“ȺŽ@Ë› Ù±žƒKƒnÃ7c(plØzÚOÓÂÝ•Í{Íš©xþ3ÞC¿üäÓ¾A }÷U‡Fv€(‰mxßo61(š‘0!Z"©Þ€éùÂ4˜õý¬ý|œTžÞ6ÖÖáó¿í¢ßλ´ö}þÌ2瀡3?jRÛÍ/²Óä/{ÙÓ ¨ÝöËeÂý\xýÔ©‹}‡W{ðUüΉmÛamÝ“Ë›ú;oݳYÜŠù÷gÖ€&m{Ø‘]u €›sMÜ›½<$d÷K Ï$â=óˆÎÍjÿzéÄÎíçWΛÔH­vzÑÄ$ „`äÏ[¿>` 0÷Ü7¬ñªßN.Ѻ*C§¶½2¼ÇÖ3¦ãië_éÖúÀ™Ÿ2nŸ>q¶>n?Æœ|ãÄÁÊcf†]ØwðŠ¹ ­^úõ§]Û. Ê{*Á:UN ÿ³àT9äó©]C¶®V£¦zæ/~È°ÙÅQ]Æ!ùÓP6zVÿZ±{–,>^<3V ¨üÔk¯uPÀ}4 ÜsUµ*ܪª$g'/¯J•ê>?²a.Dnù%MSVm¹÷“5-ŽyzCR¢‘ØÒ£Œ>¥˜è,é¹€pÌIÖé=]Ø €È¸›ßÅÖ©å„Y]C£¶.^y•ûVööê4âµÆ ¨·$@ú¥3áº`ߧ©Ú°YñFMFð ôb`,T¶€:{:Ï%ZÀt/Zjè!1–Òa3¢*–«_µJ-êœQ,ç/ÇÛ0íø¾OZ¿¥.¾ž"'ËlQÃó[Tª0‰0g_ÉÑþ.T„ü¸CSF\Ú¹¸æ_`̨íó¸yùÔ}õÍ7'58úÚGŸr‡8äϵ Åf³–®s¥þöóE—çßÖ¡{—AÓÇ´­UŒÀ [ø¡3^#&Ò£ËÀ§­(³ß/mùÁÚ}ÂÐ.ƒGôi$#}P½°!î’[p­†µ}‹ûeÕìGn4œ=ù™g{z¢V~ærÞl #|ÛnKŸé¯u~¢Ë€Icº4¯*{ÕîûL½-K¶íüpk£ª¹1  ž3ò©cŸ–~Û~1@äÜÌr¯Ó©W§ažÔûŦÛ-'¼öÄÀÁcÆD;k§JuÃjVó&† ZB<œ@dÇ_O­ÔýÙv Ú+hË•Çíùúå>¡¥ÜWË­ý7C:u­ßªë]}íð¬f_¾fm?úÙvmë¸êIÜå£õžš<²g§~ÏŒ[8º¦¼Zv1ò©Çš7x,Ìùö…ûŽäb‡8ä6oÞ¼ßÿÂ{ÈŽEjìÙ³Y’WP GNlä•+w3³³ w’â“2¢#cî¦%߉¾qíVø…·À wÙtãȱ¨Ø,hËÎLŽŒLËÒv±â¤Éà烱÷ÔPqû@D”hؽCe{é÷ ö¶ÄÜIÌ4e%'ÇÞKCnËNIŒº‘u3â¾àMo§û´ð½´}Çb,U½~!²B¡Tô$ž¿:wæcN¥—ÄÞ$]«ßR²ìÒðÉïut-³ ¨ÊUúi¼O–dY’8·"Õ2Ê‚ýNqªÙvúÛ=ÝKŸq¯õìØž^윀OíÆ}ÆMû߯kóuèøqHyZ°Feªj“‰°#¦P‘É6N±€êG+¢ !(%œ Æ9ÿOE¾šè]=œl™™6,qÕJ)!€€ˆ„€@ô¤˜åŽÈÌ4Z°6J)Þ¬…„pÎ)ABeBØŸ¡IïîB³2K­‡Èªöþö·§§‡ŽºiýC ›[«ÕÇÆÙmèé‡;Ù!©'F@(p… $8­Þí¹Qã{WñqŠ;þúv¸÷ùhú+®®>ìæo‰5ê)>7=\Té5aÌ“íªKæ”ã«ßÿü@œ ν¶ÿØÅxHªªK\÷ö‡÷«<û朧=rî&XCîìœûéÎ[m_]ôÊÈÖ¾· ~é@.‚oó'çL2:Ö¯érmý¢¾¹¡¯ÞvŠ)\so%ºµòþfÐÓ[ÓU£„QJCžš?wV«:¶ÏúôØf ¹×œ±y>$%U®êŸ¸ïÓdÕ¿:s\óZnJîýƒË—}s<£ÅÜ¥o×ͼ̼õé»Þž¿ÿöÞóËÀŒc‰:?§ÜßZ}ñžÙ5¬íœ¹ý"¢i›Çü²ö­óѵö£'~¦>S²Om\³iGDAãç ¨yÛdðu6[¾àë©œºµç ãª7Fmx{ùíÊSW¼×ªü8 ëútRÇé u®,KʵﶬÛpȯýˆ‰³úxé½ÞܵÙ|÷»©cwY}jö›:¶k³`fJ<²bá¶ß’Š«ý:¿ZSW¿‘—Ó a€éØWo­¸>ñÃßÍšÛüÆ’Qfν”Q”¿ëêœ5¶}=?–¿oé¢ïN¦ÐjÝf,VÝY¯2eÁ¹dG{O‡ü—P³ûÙ³¸f$¨’sýÇv;µ`ê’›J¯é“»6 >‹Ö«ß|s{~ÏJúCq©1?-›ÿy’ѳÍà§=yèÔV¢—#>2›tykáÜÁ‡|ÀR®ÿ8wÑÙj×÷Ðúú‡ˆ>È߸hÊä¹Ù.®Ô¹J›'›“•CǤWjÿÖìgkþ@ Îw6 ]›UÿÅÏ׌=Ýaþm POŠXüÆR“ä6›%æ½7&÷[;'?†\\ݹ᭠‰6çQs†„œ:hÔۉßþöô‚gFÝ´ úV/¼ðxú÷ó]ÕŸZüáäsO̼žU’åÓß'g㲩oÆ9¹Ê|Ë3¸´1´ÍíÏÞž‹ÖyvÞœQçŸ[ /Ž¼óÑ´wN‚·f9x¢Cþ»hèñãÉy-./ëÖù3pb7Š!RE•Öèб{ûþ]ëÉèoÃ…š•‘œŸ“›y?‰r7o·š¡š²c‚¦&fTóaçÓ-™‘áç2-ÖLÒ©©oìâ3w3,ühjíR`ØtãVt&'©™Š¡¦A6Ô¬âzhå¥äTÓé#1<Œª„q~äØk )žžÚõé}(ž¾†Ö„„˜¤«ÈÊåÎîÉ«óÔ÷†õo( ?ºQ‰Ž¦šmþ›iö‹An_¨qáWLŠ%îä·¡Õô@Ûðýç“-„X¬X·¿w+ú~¦%3òžèÝÐ.¦?—£òÈ« ~Ï×ò¥·ã­Ù7ΞÍ0«%6 U: zsvïJn:b¹~~Y±‡";שS¿ÉóÏ};€€’ìA¯—OjÜ•#çîYlŠ%ÝÆœËC@'¯†aušöØ´ëM¹q—*¹á…}ý¿™ýŽÇ¾ý[>ßë¨Áåÿ.ZŽ íÞW`Ë1K2"Ca#€Ht„2® ’›u÷äSž›vÓ(1ª×‡½¨uÎ#mÖ¤ï‡ö]¾/æÁ^–ô(W‚ˆD1[Á`ЪwוjBÌ×Ä ä6=\ªw³»zÉÙÖ¯óW™Ø²Ì„ sÜ„hÜ«ƒ”]ÏT’[³ÿן4ÐÌy.þJ$nðӡͪR ÔÉÓ‰0Woà)ÚÜ¢æ$ ÓÉ„‘$E³ ÀàëL„“« µZ´,=!„M” '>Ýõ÷ZܳÛÙx6bÅ;ù]?ÂjMÚÑÿõUÇÓ s>¦wb6s¾µ…‹¼ËDäJ™œgåD!0Ïm$T‹íþÝ®( '~8¼ý¾ÆÚ÷{ÿ Ÿw}öKŠc“8ä_,eøÑ–‘’š˜’šn@(0'`z ‚H”˜ƒ—²j÷z¾ƒw@¥f}z5¬ìQtn¸x·ùëÃoTç±þŸñ“ìM‡ -¦Ó"Ü êüL«à&O<Ýɳ"3F[ÎÅÈŒžo_¥”øqTsLàäãâYµ~P7û§¶Ô{¦€ÐÆU<Üt`M?q&­÷â -ë7lÓkhwF+=ѧA€õÆ©³·Í:'gæ›qÈ íQ{´0Ñšçd tI_ÍY@žx}ý¡/G¿ÐÛrÒ²slŠ1)#ËfÍHMÍU¢wo^øµiðÚ «7Ln K˲r³UÉILÌÌå*…knÜ–¡Ó Ç”åó[Þ=–Ì…]¿üôñŒFXgòæð­ƒ{s«)=-P1¥$a;¿iÖ´N‹>›åššcSm€Hòã™ !(UµwÏ'+ú[ü‡n:³ãõMP(Æ” …#rŘ’nåxqß÷÷¼òÕ¡Mí}m1·R~ÿ§ë½–~8¤fÄ©?¤«Q1§{½±qi{ã[¿8¯›%=õþiŠ¿¼eó¥k?ž=¶Áö…_%ª R~¹ÞôíÕ¯÷€Ùƒ7'« Lɉ٦<—‚ðòO{>ß8Ê¥ê³Î|7sLg–z`çaœñÍÖ÷Þ‹ýõ¦I+E‘zvñ‚k?ݶmë‹n ÞúzÝ;»è°uV}<¾®”® *éݽÝòQ ¹bL1ªy\•ÌÃ?\}yݦ7Ç6N»kåĽeö·­Þ^ûɆÞî`»²qÙÜŸ½GoÚ°êÃQ5e£"@èª^²zÝŽ¹UŽ¼¿c_¢C vÈ¿[1'Då6¤ve€`2+'•ÍjS !ŒQ­û°,Q• ÎÑ-¤ž§r/•üèí¸Õö„ËD‰« _5>[ÎxˆiåèE7T @P’$ 1¿;{‰ÂGŒ1•«²$}˹‹ÇÇ/|ñ£xUÓá‰ÇÀ{kÐ{å~#™C©Ñ0¤ö qÓ«ž³è”Çê‡ü¿¶>¬`ÙaqB ^G)%‚Ùc¡)!‚€{ãË<î)gÞ´bÛc¹\”JTjòúÆ)µ½11üûùnl/¬—]nšJA5™ Î$Õi¡ÖT ƒý8Ä!X"Ô!ªÂ†DÕHP’¨®lܱXUJQª¨œQB)ADEEY¢À9êuT#UuœósŠµD·²OÌÏ ÎG@DTU.€ D@ÔË´øàŽ¼`‡8ä¿Î)aˆy„+/Å­œobDåBöNäã…  ±GÌÓ¢”–˜»öµâ‡üåQ`‚¨Ĩ\àG*—»IÓë$íG«ÆÊÓë$ƒ^rÒË’Ä¡yƒßïïØÒ͹b“¡%I¹ói8p⮘³?_ú¤…/+2âƒÿýKž:·Z{çܱ¤Ãj1ÇŠtˆCþé˜=ùò§8·ø阾cÍú«j+Œkß®é×`|¤”’‚3”%¦—©AÇ z‰ü%D’˜N {zÛá(ÇrtˆCþhÁš¸†4)¤S¿±“úy˜b\úÁÞ É y·÷úÀžµ¥ô»?Ìž»/ÆájvˆCþVԻ߼éìÄg³Ç,sê<¨c#gÿªxíønѳiÕ;Ùc/5qªüÄ‹o tÙ1sÖÆ_È»ßÖõnÔ¶Súá£ß}ï»$›Oßõ+=#¾\²þ^»ámý½àøúé³7Ý«YËC‹t“]½êõnzŤE›n z£‹+‘ê9¶AäGs?snѨ^o©‰¤.AU+“ãáÙ¯ŒÕÜu«]›0BiNLøš ÓW~|ñ©ñ/ø«gVÔªMkꀸxºKL®Ü®¥žgéݔëß{܇)íg<ߧ*`÷:}_|Âôí›ÏMÞökŒSPƒ㻟Yþöâ•¿u™öj½’õvêÕ°õãÝ7óÎü÷sˆWX} œjøºçÀîuÚŽÕlÿœi+6]yîý‘¡ðl×ÿ­Aâ³ñS}ð³ÉáxqˆCþ|(‡¾òz* G6¬?g-¾­ƒºvmî“òøóµ!ÀÇǽ†ÏÅ}ã*¦5˼ЮI G“†Ðjl1ð9½LU;×÷[h5þöÓÞ»éH&ÝzÕ»¿qÌ‘èDùÛý+—b(3;zø® XœÅ«‘·³[Óz>p9"'eWdÏçµcôÍFkóãúOo€)îòÕ«žÙõ"¯Ýu}¼²T«Ñ(u~ñgW/Ï`Ï =¤®“’›”bñhèøäÂѧ—m©U—Å•”’s½å³=û{ë=„!!¹ €jì¯+7]È@’‘ Á^ªè–ýÔ³5ˆ³S¥k°kWJ`ghË>¾÷§;©f„h å>• ºíƒ<Üê?;¨>sgAMÚV•vädf@ã¦[\>ñDŒ£UœCò§# O:~ðH`n|‰ö8êâc»°}õÆx3€’›SeBåÈ…@ ²dÐó“[¶~y&6/Cs¦PmæÌû N®È͵ 7g”Ö# U³ "P‰1ÉIGÓ2U´d柢Ä=hs‘•¤È(¸(ˆÀ¨Î¿Í˜7ºï[°âBŠ§gÐËÅi£jLI>ÍÂZ×0„†¶ óŒ;žâ7úûÞ[ß\¿öš{¯†|ìÉJjz®°[/%·Ø¿|±zŸ"`ËJ´f•¢œª6sFNÅ# uÎN7~Ù³å³ã°eZ³T î=(ªÛ€^ãÖ‹_2ä­oSñŠqÈŸª‹Ì—"Â/]¹–ZâfSãNÆñU\­›ìîîT¼Bª°ÞIiܾ–3Q”}*û°ba+<åÆÕ̆ }j4léS‘£’sßÔ®{Owï­*çç§^»~éê¬fK@çSK‰½r1âwöñ®ìš7Tv–êêå㪓)Ø2/ß“úŒí}wçéú½zúÞ;ž ~uüÒNî9“˜%×nT¢›6ûî}P5?Útñõ’µ $. ûô¬S½”4g´¦'«.>Lç]£‰·6¶L ¨â¥×I -æšO­êž’jS‰›¿CÝ=ÜÌÑ{?Zµò›¨FÝ«ÉŽ•ë‡üÉ°<ɽ²}ýñ!“æv#BäÆl{÷YŨÛåïwþ6}Ô¬ý@±åÄZ1óŽ¥I2Ýúäíïߘºà1ã}SNNHÁ/¯œÚ4¬¾W`ȼO;ü²`Ù¹¢¨i:±mwëÅ“Þo—‘`sçX¡væØCw`ê´då Oa'µÄrû‡íñ×­|òÚÖ93E]H«1Ìõƒ9—¼žé¶í|Ž1kóƘÁ —´NN3‰œÙ]æí£?¯7jÕ2¢r%õÒšÉÿ˶H>O¾5ŸlâèS\¬W>þò™é³ç´¹eÕqí¦5óðöósg-_urõ[ŸÄ^<´¯Í¨©ë?6Õš¾zÊ'ÙµZŒßÇÛ™ÈÜøþ5›cå:Ä!„üýý‚I ¹§'–®sß7}ûÄ ÌšJ 8'Á//XÝî»A£OYÿÂù:rBâÿ:ÔJ؇¤ŠŸ¥UÌG2B¨wëáƒ:2xUÓŸÝz>µ"ãèBZŽÞÒœ­Vn$¶,½hâû½±{è@2‡8ÄÁ+"Š¢¨*Â…Á ¯ uÊëGò[€Î3($Ø]"<+é~j†¥"~¢s ¬`Áš•*ENºßÛˆŠ¢Ê²D*p!è‡üGPÛÿªª ¤€ §ŠP?!8!Šd£@”²‡Ê-)(«B\8éÝ=€ŠÊ…B§“(-k*tˆCþ5òК£ÂfS‚SÊÊAA(ƒâB±˜7õiß‘CÃtå kïi‰‚’Zù#ˆ¢p!€BST¢¢¡&.AM†/˜=eÑØzžtˆCþí¨N²N¹ IDATé­z½Në¹!Ë’N§«ØY¤4¢D€hT´àgDvrv®BJ(ÍûoYH+ÿxóÞ¨“»®}²e`1$( !8Gñ ÒrïG|¹ü§À^]ª¹:Ð!ùÿ'a;ÓZž3Æ„@IbªÊ ž•ê4oà!'G^¾~+ÉÒ¼~˜‹33'ÞG_oË…_#²…äU«^ÝÐfJ»~ò|’ X`ëvÞÖTÏÊ•¥Ü”˧/g ŸÆíxAzR†Þ’|ín|N`ƒvõç.¤h©:¯JõjX ^•\”èðówSÌÀœ«µhVÇÄÅ™|]â‰QµvJyÊ)}µÇÛùñ\ƒ§[ÖÝk×®%pæœ|â«)«"]ëûÚŒ—Ï<¿Ää[µ^UoîêåN²ož¾o´)ªƒ“ *”¡rõVÍ$«5¨jO‰9ؼqNÄ™ÄLµrƒ¦<ázb†Õf±‚L"yÖ¬Û n3§Ý8y>1Wu®Öâ±j•\À”yül¢ÉËì‡üC@ÍùK)rÆ¥†vãg´5D^¼¥<3¹­~ÉÊœ#¶ŽN¨Ó­ò}FÿêÕã'~§ï2kf§+ûÃyõîCûûMz}_¦Ð5›¶x éûßž¶xú¹¹º‡Ž]ò¼ï…cWéàa]N.™òéÎ[ªÅÄš {#T¼|ú@.‚{ͦ£—¿pbùú¬:§´ušòÖaŸnÏ¿ûFØžm—[¿2°û|Ào1FÎ)“l*×IŒÔ£ë{ žÞ¸ýçÄ®¯Opù`Ññë7Ú|œÍÇRú÷60âÜäñÉó»ï}o}F­ovröæA#yà¦VNÑ霺¾õþc1»~ØwúzétÆ.“ÇGÏ•˜ijýü0Ë‹ ¿_äF¹7è4cf×›‡ÏÚBº éç÷Æ„½Ø~ØœYÁû¿ W«5¯y!ÑôOÈiS¸%/¡ÆÉI{Ä`µP ³WUPUYÍDl³F‘õz{±"ƒÿ„sP”BÃ* h‹üaË$ÿB@¯/4,c Ë…æ¦ÓVÓ§Üa˸dI-Æá.Y°Ùʹd«ÕÞ»ðo¿äüaÿØK.¾x*~ÉÅOñK®øâÉ¿äâwR’ÊD@—¯›@ÉMKËU¹H•S‚:­‡Wǧ;9íœøã #À1êWÚ«äÞ8¾ÿPB»!Y{÷¤TÓ#¾n{ÛÞo~ø)ÜÒÿõ&óþ5-ç~Ù½{×@<[Ïì·«Ûš}w´é¬%…¤D]¸p-BÌD:¶ý»ãXÛ­ïòFþNámº7Ž\0wó¡¬ZN-Ú÷$’$£NÞ¾®2áÖÌœlÐœyvß'~IæUÛ´lRóøõsD®Ù¦§rîì}+V DìÙºãˆÕ_}æЈº œÌ h¶(y&Jjµ*„§ïÿj×ÏÇhyx‰ôX×öâàÎ~Š—”ö&7 8p+´–Wúá_wÎ4›-ÖHM$Do0²C¡ƒdÙ¾ìòE_Ìí_ä”âŸäï«ëJ÷ЃTdØG˜ÛŸtÉŒý¤ø%;9ýS.ù¶ø%¿“ÿÌK.u5_|­O À{ûW,?nE"(‰Ù‹2ÿÚ~í_x¾¡)‘±F¨œ«ªUáVUå 9;yyùyÕè908Î~üC¢@ØrÓ’5$ •| 9ÙÈxúmc)iqhI7qÂ2'Y§÷pf·â-”`ztº‚ËÌÐtøØΕ)úzÕÿ"9€P”Ü 3X²^^Κ-°Nÿƒ:f1ÿ@ž•©sfxyIÄ(€Ò‚z ¡jfzZFv…ͪÌÓËÏ3¬Ç€JYpqÓO‰V‘ðݧ;«?;òÝÖLÛ½ríÉhËߎœc@¦K‡8´àÒÿd‹üxá- ªbµ "(™±ü˜ž•œToÿÇk/&ÙyMXý"À¥³Ò³¯}ûñæë€ù^g%¥ƒŸŸ#²W5¸Rö¢Z³L<4Ä nؼ«zQDJ©jÍ _½è "U˜^ïáï íâãŸi 5ž|qj¾tò†[i6Àó¨áëDÀêáë'å¤åh1;Ô¿²·%ݘe²²LI^Ü"€P¬œF˜ÁS¯! ΑÚãˆÏÌL˹óݺϯ˜rÄ—so¸¸y5™³qàóûÂ]SÿH©â2µ`äªM\„”+Ô|#íØžðgŸ›:ÒçhLpýêQß|^ä|a;ûËÉÞïOkØmñlÔ\þì ÷М €ñÒçßdõŸüª.Âðt=vr71T{¬nÕš^²gõ­Æ\½^/¸-ë×—ûÍžöB¥ µºÕ@8ªZÛ,& œ#UÁɣ݀ÁIî)í;é÷¿{[öylܬÞQßoëÙ«Ž5åøwÇ©^¿qc©ÕÇ_¾º”€ÈÜë¼½wÞþW'î¿Ï)ë“{5³Y×Ή^r‹&îû·[ò¯§D÷Ïe8wü·¨ó‡Nö]8~¬no´Ù«a ù‹©Ÿˆ/ô­j¹ÄZ„ZoJu”6uˆCþ9ÂæÍ›÷ñûBX€Ó¼B ‰D°¿¼`wîlšjðr×gܾvõú½¬Œ´´ø褘{)·oÆÞNŒ¿y+ül‚ìé©SW½“-ÍiI÷#oe䨀€-îÄ1#º8™îÜ—êcÔˆ(µVë&>¹Qç"r]¼\L±±IÙ© ÷ãã3„jN‹‹¿{')9*òÒ]ÞÍ®ÔÊ÷â¶í· ²¬(%DÖy4îß3}ïwœ_ü~çÙˆ$Ndkv’1[A¦¸ÈX¹F£æâ֞댻øÅÆ#I¹* °¥ÇÅݹrÇ¢"¥”榥&DÅæZ5¯H¹qÜ}Ý1îôžs·£îf™U–˜“—Lo7)ûîÍäܤ»ágãeOOYÍŒ¦h¹õËAsšRÆ ¹q·Oë³´Îè:™**!€ÈjiËÿŠÄ9·Z­ŽÍà,Ä­6…P&„:¹(>4@Jû(ú‹ªªŸB„róLѪpT´%&"Ú®“iÆ›åŒ$òà„@•#£v.H RR•ÿPQl’$ç=8ç6›£ä C°°PB¸ÊIùêÒ£Â_1ä-P# 4üUˆ==Žºxû¹˜““ÍX £¤%ÁS^ïà U¸Ñ¹xxûºnMOH± )ÄÝ×Ë–•iUÄŸtÇdŸ*ND˜RRŒ&åoyêˆvþîGyšÃÿg~m¯þ7_EÞãxÄiüOóß eY‚d™éõ’^/KìAíòÈw­0do,Ë2%T–eâÞfð´‰Ê¨º¥™&‹‹N®h/Ϫu:¾0zÙ‹z“¨Êœ:¿2´NáO¼åÌ­qß^£—¼;ºkõÿ'ûñQ³ì1!ÿçaOý—gæÝp,ë]â?›þ oˆ²Ôœöt3lœ{BùSC‡“¯ù:Žµ}ndaײoÍ:n5ÿ‰vž~øÃBx5ÿûžº,— ˆˆ…x¡(£/a§ž®}$F„@(… UàADb?=÷ìfßßSЋi$·Š)%¢¼[aŸyá+L1 !åÀ<¡””^ÅèÁýÏÓ«Š°ERöù¬¬Ñý…!¯töwÕ¥]Ø¿nÅv×Þk¦ qrò3Ü=W%L¬4í´¨ÞwÒÈŽƒ$5óÂÆ%ŸîSÐÐsÛO9=ꓧÕ4mJGçÌ{é¤ZÔ7oºóV«!ï yµ}pÜ¢Á/ÈEðmþ䜙O݉·†ÖòŒÞ²bŶkúê­'.}½¶”y7Ó¯•×׃ûíÈ,²™ÿð;[ÅŸ02¾qÑæè ÚvÄÄûÕ•P‰ÜùéGŸœPŠ={Vãéå‹û*+^uòF&€!¨ßôIO4÷G›ñІµ?D„.XßéÓ!Ó"’Õ6£g?aÛ÷ÎgŠÃKƒ¥[çT:~Y©à«ÿuÑÜ„þï»ñæØ †'?ZÖwÿô±ßgÝ;,¬÷K/½ÔÁÇÀ’ÎìùhåÎTîõä¤ };VVL–kë—­ýùÎý"*{3&I” Á ¥XNIš ¢6„FÙ8ùèE)E!òNbEU¥ù1 QµÛF˜DGB´ý]Ì·°”8&PÊ¥(¸*ðÁ8šºàÕüµ@esJ(E.°`„X±›È$J !ˆZ E‘‡màÓ”Š4°Ð€%ZQ¥Rùc”«\»éŒ.øƒ+ Œ_iþÿ(þR4Ô0¢ÃñEo‹RŸš<¡kÓ 3h½ºóëcufHÿèKeÐSÜÌUži“õË»COóàΫ¾žyúÄøKF ²Þ{nɤÅ6Ù¥*SŒ˜õÊ·WÝ^ù|©vïOožwǼp]¿FÖ¥üøÖ{éuú¯šÑÞçÛ»^ìWýĪéŸÝm<}I[¯ÒŒ˜¶«{>]ûõÝî³ÞïئfÜIק:z}6aòVoê;}ë}}òR±î•üÎîɃ_1/ŒJÏ¿Õ­ÊÙ¥#ÞKR .²UII85 ^£Àˆƒiuøý¶>¦4E—9[·ž~7Wï,©õú—w']ö{¾ÑÏógžKûÏۭR«vl Ë_‡Îî$÷¯_„×Jåh{™`AöD#/}+(¸ÊóÇ ŒpOBB(cDŽ¥)!ª@ D¢  ,È'Õjvƨà eG Œ€(‰D)窆䨡2% *Âìè#ÐþBË `L; "I ʪÉ&¸*“$¡ª„PÊ(D.D¾º#¸ ÌwŸg]Ô^@ˆ,A @‚#eŒj¯¥ŠØ¢QQ-Í~·Apž¨Œ1 ”±ô§ðßD@C·]Gç´ˆXùô“_ÏŒ•ª´oß©u¯¶»ÀrêÖק…šeLMIÈ1e%&3îæíV½VÃdž Ú>Acé•=é%# Åxãü…,+k6­ÚÈëÞžó÷²ìÜñ”ÐR–Rî­Û±Ù‚¤g©Îµ] .Õƒ]Ž®º’–n¾p,FÔÓŽq¼ï×Q ÏÌxªÿA7åÆÝŒãÂ|?*®ee_}@m]ÆÝè{ôvl¶KÃJìRT¹Éi†°>¥þ¸ènR–€, ‡®î?ÿ\Ãzô¼ZÛ%éàÝŒRNä)á連9˜³‰SùÏ j§vÝ:?Ùñq0=¾~[dâKØêïVþ¼kÏŽÍ?ÿáOÝfYZf8 •$ª¡¥4OéÓ0A¨%;ꔾÿ“Eœ£,KBU¹IbA¡Tp{ h @Â(!<¿’.¥” $”"W•$‰jsD$ŒQœ3‰¡Ê±d:ƒ‘PF¸*eUå”JŒ ×ÐP‰Q• F‰È?Œ‚ʹF‘´RI„JŒR^ª:L  .‘(U¸Ê˜Ä !Ú=©)*Pʨœ3IGÑ&¥D ¥„«eŒ!ç(8µ|s˜”§}#!”Q¢¨œ2&1"òuaJ¸¢"¥Œ±ßSfø߇€–߆?Ñ_¨ä–X@˜2î†ï]óÒ[7ö‡öbMˆ[,‰?˜»ä§è‚J" ä6UÛQhÎ6ƒ³A!ˆ“‡Þ0¤ŒW nU„— z÷|gIî·ƒžØ'Ú²Ly:ˆ“‹dgW›Uå–"2 @%Dr-¨ %ÊRyNšEçáNáˆqDç¦!Áõš??} ¿œ¿§òÖPê¥}×» h[ù±§úvñÌ_òeùû”ìK×Ó»OP7´^Ÿ^¡ùå,iiÉiéF{| sónÕ«[åMïQ=êÎ=[ÊÙ ŸÆZÕªÕ¶c=÷Äðd`K¹g¬Ó¸ª‡[‰ˆ–«ëwú=9¼C³*¡M7«ÉrãîÜÄÐyü.ï½hÕ&H=»®X;ebk§’7ƒ’t;˧uS·ÀîjäÏ6#ÛR«u]ow½LŽý· Qßþ­ý+·Ч¾¿‹Î'¨UÇz昫‘·îSƒô·è&ˆ‹Êí g7íq®b¹¾€y¾¡—jÎN¼oD´åÄǤظrùóc[ÌZ=AŸ”­(¶15;WqkòÞ'oéO|~àDÏŽÞúá¾63ÌžÔrïÊÍq6b‹Þ:çÛf3V|ôánÌÐú9[méÒ¤æ¸ Ÿ®Ù2µº ˜Ã?ü`Ãg,]´úÕ*.6kú‰Ë©^ _Ÿ¼e-`ó¦š+¡%16!5?ýWÜÛºvx~ÉæÉì襸„,Ž@¯ïÝ{ֻϊ¯—>õxð¤­o¯–»Ž^±mÅsƒ¬\E«w´tǦ‘ÝÖ,;ü‡+çÔ,kçhl ý&5"†@£´Ì!´ qÆ(cŒRPUÁ˜¤å¡^„@B+'CÙNýò”MíTD!€0FóA @ AjæÂRý<Œ1Fι‚#Pm (RÊ(µ£ ;aC!€2f7ËÙ¤ü¸Ì¿^ŽÀXžµÀyyøTø߯ŽŸ¢¦Ó¼ ./méÁ—`^³2´_»½/… F“˜$1â?ØóëÏê˜Î9¯`û7§àú¾jlª¨<|Õ¬˜öœ5>Øu%n3æXÛ_I­f,x1cÙØÅLzÌØ÷ËÎ ~´Û¥ó îÿÞ¬z{fÍÙmÄK^p…sB°˜‘«  Á|g,ôbbñÑ~ÇÝ#EF/ôíe; òÝÓÅNA+úuXæ%²5çrC|´¹aAwy¬ð;øåÏH’(Wù6*Fúó†.¥¸6°lY79ãðª÷6_4VddæWÌg³êùá½#_ÍYpû¯+·'ùáËf7?¿'ÿ»2 <Ç#å1 Â`…ýy6¨GA, ÊK-/þ YÐJ‹òyÈ/"©g–ðáb¡ Óç±$Mù?[-ò!8 "jùóz½¾\rÇ9/[K*¢.•¶F+8ÈÊɪì ,õ}ü ò‚m6›,;ò‚â‡ä€Õ×¼Üò*(¸xXŒµ;7%D–B‹—$*¸]Alö[ÔŠÁÒÿÞûÑ‘eå–¬@‚ðïßrœsuKÒ&¾ýßý¨ïáaC±”fÛ(Ö|]aSHdÉ×Z®z K4/hW£œ•KŒ–¡Ñ—Žé¬Õˆ)3§÷§ 'Þì7åªñÿ ¬ Pâ¨è–ŽVuÒüŒÈGFüޛ”"„(6f‡o_d-ß@TbdF´:WÂt•cꉂèXðWÎ…ÖD¸F~fã’þßœY¾£Ï?ù©ëtEÍ>²,3‰9öƒCþ<-Cs^ç¥ "Z¬ Å?…(YWu­Òä•yZÖtÿlõ¦/Nú÷|{Ìðʆ¤G±qÝÔE#?¸k3Ôaôk¯tÐ%]øä÷O% }»E«¦Ÿ íÖÃ5ñüÊËocÓI+&Ô£×^rN;³î»ƒ1[3ê…àŒKÎJ´xÖo?ò…–þ ÚVÎþáí;ÓÀÜþÛÏ5eÇŽù˜š0yõÍà7 y$ƒ{­nõ¢Œ™»úÒs“ººQ]Óá£FÖ8·`ÒÖ°N­jž2c"O•ÕËL/3'¾Ùø·Ü/o™üÜ„­ûnÛ€9õš0¾…å×yC¦|±ÿ®·Av6`ì-3_÷Éq§·w÷’%ƒå¦ÏÔÞöÚkÿ»QâÔ¦º<–YÐDÆô®Õ{>Û1u˽FúómÐüƒ|%Jˆl¨â¯/~;‰SãIsuåÈ)Ÿ]m0ö½g<%VsüŠÐ´ïg<ÿú†o¯›ÿôâ!¢_‘+6›*¨$­Òªªª@´§îkÙõX’“Q+Ù-¸È H‚ Í•ôà¯ù¿r!¸öKáõ.PJ)(6[±,W‡ü¥f@D L’eIbÚâ Ônš"”öà…ô`a ³,õ‘¡°Ç„­lGÞêB¡r{7ŽË+?òRå ±›·KÅ`E!a¯Íꪇø_V­õZžUÿîîÓÙ%… [Ó.ŸÎÚ´"6Þä–W°ƒ˜#ìÏ~yÍšAW×O›züç¥ÿ œóê;›7GìÝòIT¢—!zëõ$3jï† ©ƒÿKz¨Â(Q• "ì–c¢UfˆU•£@"§ÆErÂìU¼• !D¨*„¢á˜ˆ\UA%&8Æ(!BU4½UEEBµ*[.+Šõ:Bˆ$Ë€ÈU¤„:! ð\A‚¢U.ä\ÕØ!á*'Œ F)AT…0I*¦#Š¼¢@ZYÇ<ã! ´dg¡ÅØJ@᪠„cŒ«‚H,ÿD@•«*ªHeZ¡œ‘o£,‘¥‘U-/¸È @Í' Z‰ ÉÉEEEC¯å;ïž¾ý—û¥¡0"ZUaÐI@%!T‚¬òÐ÷–·üvàÈSõgJP–*Ú\ *J~Éb‚ˆ”€NfB Âía:‚ §æ‚_¿`®r PfF Î9G£ ÚWcTM)æÖJR‰WaŒ®jò %4/s…ÐÜí\UIRá ­p‹ý=Çd‰‚œk…«ö:­„RIbˆ‚«Èx~Qp¡•rpÒ_iZÙ ;1\É둢VÜsUÂ$F)pEˆ”IZ¡ ®r{ ˆ"”JQµR‰yª€àŠŠÚ‰€(T.µ%„‚«ª ”2FTE¥’ÌòJÑæ­XƤŠy£óaÈŽbŸ©¦9w$YÒ*åûz!ž­‡ {ÂÙîääæó)e ÂRB.œBZŒÝÎ’£Õ¶}¶ð‚­@Ž8AÁ­h¬B €H&‚ÅÆþ͉’œcG)“ò‰›*ó ³àŸŠù)´fï6È G"¼-ag¦²\ÊW3Zó*±{B ùFŠžî@¤¿Þl\ð¶B%-ªXX ¬P:—Ý÷U2P¡RÁκ„´üÊd–p!“ ä[ZÌWFëê[‘29 æ}–$‰Û™0ɇ'B5xùû¹0ÂMé™Ù6,šz'僨p”tΞ~^Î:"Ì™ÉI™6®õòÑà¯PÄNEpYQ±€k¾g4ÿ×qÀ¢yÁ*(i!ùÊCD$æçÏëõú‡ª£¥!`iè)̉±ùÆ 2ß+„PDTÌYIÖ4•ë$ ”ÉUÚ‹¤â™*ö"'(Tõ¿½ ¨Ö u.Æ ÜÒ’ÏÊc餤Ï7RRÿ·2Êo•q0”^ù \Æa¤¤ ,ñô ÞŠ²Ë=„Mî÷øhÍŠŸUÁÂ^%>‘ß¹fŠòÊŠÊÓëõ $I’Ä+ÃnXþÜZ<÷ú˜º’Ž•eJ!$F4W;¥T¯“t²¤qÆÒ¿‚¸·òÊK¡rÁ¯$D¯“ ÿ0½Ìty?Ú‡n¡níÇŽ}sõ¼!Zëþ1ë!Uàÿv§¿õô¹Mï/9½`ŸüƒžHE¡¹sØ#TQ-BÊH)R„6’Ò‡’•X~€yÅÕÞú:”4ªyã©Ý'ÿ»*A‘}líÚ7ܬѤ†ü_E@’ן“üÃö-ùƒ¨ÞÀ‰/€E~Ê æE §¤síVäŸæ¤ä¾âs/wÌßU!UçРmÓ@O9ñʹËל«·mÒÐÍ…å&ă¯Wî©}粄äÖ¤I£Ê,7)âð©„\`Á»úY’¼«V“r“Î Ï@ÿ]šù´¸dÉ|ÿÒ­˜¬¦Ý‡ª×®Û«ê}‚× ´8û»)·ŽŒJ2äZ«m›P’oõuŽ9rðnŽ¸Õh×ÁëòþsY*xU«WÍ~!2¥f‹.aU³nFå÷&îÛ43$=‚¼iôÑ_“¼4P¯¹fb•šµ K?u$ÚÆ<tjâgPÒâ.üv>ÍRÂÍt®Q¿u€é¾¾Vµ@}Zøáëj•Fžé'.&ïÐí¤#»¯•÷&¹†µoU½’Kv̵ áQ¹*8ûWkÒ¶¾—M½~é\D¬ú‹]Ã?‰Èï£ä/Ì»˜ß£©áŸp{ÿ ä‘üÝ+äà€…EßaâÌž-ý-ªK¯‰cšV÷l?´O·F¡¯Í>´EëWG•<šö˜óî€@÷lÞɪ§=èšLœ?eÂSº¬+q6¸x´zkùÀîUY@›IÍìмä¦ßÏ®úÔø1 œ(€[õFÃOh$¥`•–oLn§Ücлs:{8{?=sê›;ÓâdÏ­Ë´É…è a¿Wš×õÄìÔDSØsÃ_ª“§\³ÀÞÃg/›þX%ž–­óñw©Ú{ИîÞ@ÿì}wœ•Åõþ9gæ½wwÙKïMz³ {ï-šXR»&‚Ý£±%K”`¬Qc‚¢bADAzg) lc˽ïÌ9¿?æ}ï½{ïÝe—bL¾¿ûáÃgî;ï̼óž9sÎyžgÐé—\¶+¶§ÜrÉ# >Þª÷°ÎÙ«¢±xÿcÇ?zç1C¢Ò±k«£»ø”~àõ3þö#[gÙb¼þ—ÞsÁ©Åê}.úÍq‡õP]r͘Á…Ûê°K®ÑÝŸºô}`Þ)[ƒ?J3º3æ/u\òß8!˜íÏ\¾û¼ÔåA¾ s;w+ŽÄ+Ö¯Ï^->øøƒ£oMøti9tðŽïú5K¾úhêÆ1?«œñgÿ|o–,mÖÃ:äÌ8pìÅ÷ÞñâGU½ó8ð˜ÐíëÒ­0Û¼~Cl[0åK5tdO×TÜ'Á«xÓŠù´²Ú6ØjÖ}ðÏISª"{›~Xl=¨¿YûÁìÏ¿©ª®®­·žò«?}î¯ïn¶€½ÏÚÞÓ(~ù5ý§_ðÀ¼u¶Œ»Ÿ°Ïýᆶó–¿=g5UÛâ»?-³“Dò£2y)î–ìºÉ]ÕX]@Ë\˜–;²3†w¥­ÂƦe÷PÙ!_¾ ¨{î±½ÖM}ü±o2!»ºýí‹ GydÏ8@ͪ9+Êa8XkLÌ·qc,è¼hëÖíò;>º  >ð•R_i­!^Wµi iMª¸s1”m©­¹|uU;"­5¤Ã$V^kв¨¨‰æ©ekc\±&ÁApʹuYùÆcO/ñÁ_ùîGG±WþÀÂþ²èÝÕé%ٚŋk}bfÕSw;ôÈ o;²À”¼xß“ßoÈJ%Ïõ VÙæ>4ÕºK—é=æÈhT3} KìóçÞ>åäÓÇPT;ïý§Ÿ™º-þÿCóÿlF´kGl1þÐ'Áÿ<ï¾Kš°€þ’gXæ0ÙþÛ”--Û2äÓIç”NËÀái–Á/¯Ü[ôîߟ[œþ,Ã#˜­(Ý :¶VPiÓ§5|ߌ%bb•µvh÷XkÓ£u8Ôج'˜ iE(_þ_pÆ~—ìïÏüõÆÚF$5o9æ³Î`^ûà`mKgþã®ï¢yEcxî1oÏyµD ZåÄ7—%-§¤ð2Ÿ1ê@NëœÄq–­ ‡¼n]L/üפ7%·•’éï<þí”Vú^qç9]^ÿbɦúݺ¤ZB “þ6Ü‘{Ke‡—õÎ*ȹY‘Ýf€þ#—gæRš3Ʀ2!ÂMêNoýüÏO>kü¸®_­íØ¿Ë—^*O÷âßLþüØß_}EáÇkcE‡ñÄßü­4-gQ5÷Ù7ŸuݸÜùú˜~8°UÿÑ{öÔ.ÒvÀÈÃ*VÌš“Nœb¶}>廓®¿þüîßwÛKdZÐÛ2×+ß°ª¦çÕ§ñSc—@ô ì?¬WÿÖ­: yXíò¯f­¯MowÝŒE|ÛO˜ýY·cz!ÌP=/¸êȼ’õÛ ÷ï²ñëe嘳ßõwÞwÜÂSölc–ãªlY²ªæ¢#;Ú措p¡û׺­Kâ]~vÂ9ËæNÿvÜÿýe7\¯§Ìtî^9{Ê{-?`Ü%ÝkVÕå÷˯Z_YçïöÕä+Í[y²«­þ ïð®º/î¢à. l2¸ÙÌ ›™µÀÝ6·Íõ|±%·ÞngÔoûÛ¿Þý¨«Un!ÜÍ®ýö›Òj‰jÙ´øû…‹×VnÞ°©dÕ¦Ë×/]V²dõªåkW.]ñÍ׫­±ÛʾÿdúêÒÙ¶~ͺÅ+*kœ½òKg|¹©Ž¨ryit,›~ý£µe?Y–EGPDDDE~FN ™ñ‡µh;öò7çϤißùÁ¦hÇFýƒÍXc«³õ2rS»¼o»K1½ùŸ¢½N³Wša×ÜÚ»—^öÅÊØv/‰t~ÔPùfAü„{oéõâU·¼Sjg-*âËä}hâòÿ=TÔ×׳áÄró<íÓ´Ø! Þ£‰­¾ùóµ3 „,(IzÁM]›r×fúÂÙ]ªÐÁ”fww%¦¤ÜEvƒÕر6%ÛÅ;,iô€ÒìEØÜSðó±13â쟤·}òÛ[g4Ãü€Å[íuây‡JÙ;þþÝ­,–ü :øpnÔk‘Eà†å!999øI3Ó™ñ EéKŒˆÂW˜YiÍÆ°$ßmå)1V¶g³€” ‰›ZÓ@ˆŽè•Ò(î†ØŒ[é(IÜÚ¼"€Zi"k KãÇjåiEdý¸ ûI„Â’y"s5ó÷™Ñ jŒo厥SÅ ³¦±Ém mìéTÚÓÈÖ²ãUZØdmIù»é[¸&þ‘”"G¸Ódg2û¯´§HŒo¢²Ö—”&q\A n‡Ê‹ õ³ûuÞmO]¿Gá™c(âÄdÜÝôWÙcM@tø)!áÀÓÁ KÊ #A"ì|®ô@‡±Âblè0cEI)§×*B‰@Øø¾eÀ@PQ€A,3›ÐÏIÅi{ûœ5,"YÎ)VÝûç*úœ-ÌÆ÷YÁÕïK°r‘!:%+™TÖ¤”c|'>Ib|ßXQšAÄZcA܃p*=ÁÜr²°Öú>³4Dã@ß24ôŽš.ð÷lØ(pRx„}ß°*tlÞÖpÖH§;9qð`”XëûFtì"ÖØ,N=’£gFÒæP¬5FȱÛi­88'Šµ n«Mi “kFÄÚÄÓ+?%Ó¨–½c’e'€Rôó*>yò¶Ïl¬emCË#w¼dÒm cµV’¼­þœzÚmv4MÖ÷Õk«r<á¤ÿ.óGZÑ@–`F2f‡}”VJ¡ £efEÞ„1¾‡ï›Œf²–›8zu?Xæ˜%•Àæ"Xß$ÏUaŠÑéÝ)‚¸oxÍ¥lØÎ×…Ù˜D‰)e>9c©4±ï[Ö½¢šÔØp5bÚÜ 6ègö´4•?IÄù|ß*Œ¸CrZó™³ á¤fùÔ»còf%CÜ¢©ç„‰í”ZÓ0Έ¨ˆØ!¥ˆõ}RZG#6k–´!}fÄ7é~ÇŸwÁù¶ÎñªþôŸ^Ì;þÑ_ŸçE:¬ûbU—øìù×O—=N¿æâ}ûµUR·ä…ÿòêòzÉ=éµYþaM^U±jâ=OU¿`üå£hëºXþK^ºõÙ×—Ž<÷¦Ÿ\|hŸM<ïü)5íF{ÛÍÇ/]VÙ«o»u¯>rÏĹ­ú<áþKºšòµõ]hýò™'½RŨZˆŒQ×c~ý¤gO»zÎfyÁ͇чœ4÷àK®9ã¨^(°úýç}rši=à×]¸ç!{}ÿ×Ëzf>CtôïÿtçÞµ_nðÚã'÷Ýù¯ée Ìxà­wžµxqu¿>EµŸMzø]¹vüèG¯ÿseÑžw?xâÓÞ±4Ýlc^ß.ºþì¾ms5W}üÈßúbcîžçL¸õð|˵kæ=÷ûÇ•ÿЧåx<¯^_Hƒ0ÃÐ57òÞ :Àg ,id?nÑ"¹*{"+’]ÊÜ…rˆÓÈ"–E+…¡$lêÅl™4*"R(,Ö°R P 3S ä¾iÀ½9$I–X!¥(p‡\…P¶B$±V„<¥”êu°/¶ ÌGH¤› Ü«”V ,Ì¢´Ò B}céÒ𹀡03“"BRÖ[ÖDÔØþîf†Ð¡ D€‘ B!ˆˆ@,Ì ”ÖNx2›øK£GE Ql¦ßDM¤0”sú—€ÁA8ÝŠ[ßÖŠL I”ÐIÂ``ó|@LfRúš7䬟ïÿéïn›¾Ò{ÍU‡ïÙå+‰-xãÅÏúßtÖÖ·^ˆÿ䘡…5½NÞgÓûwÿa¦írèïÝðéÔK¾Ù Êóª—ϸ÷Áã:¼ž·Ü}ê¬k.xm~«_>ÿký›ïYm Ÿ8%%§Þüí=åýOyäƃÚ=¿läONêòñC7<·fÄøûj Q‚€"p67|ùÑ’K‡ìÙ~·Õ{Œê1oâ ¯Íðc,œxíø•jÐõw>ø…Ïæ”/~òÖ[†NøûèÐéC¤¨?ó¡q¯â˜ëºùgŸŸvÿVæŒìFÛ篺éöI+jròÛ ß^²½ø˜__Ðá“îxw]d๮:çëoksÎ/xúÍ·üe®.(ô·ýX‚…ÖúÙ£€Áò²ÖÇÄ;) ÖJèjWéâˆÖ7Y|4@wô¹iщB4rö´H„AæV€/` 3°Y:i m<.,Æ2!a"T¾ŒÙ ûFX¬ëQo66e‹ës6 m±Æ "pàiZß8!Ÿ  cCýAD÷Ö¡#åõÄZß²°8CËÖf ÂZ È<Šß'"1>³€X—t°¡ãÉÆOÄÐ5A²À!‚% `}«D|_ܳOñ9e*8ì!$hfdPØ÷ÙEèÄ1YÂ6ñïáˆL0Û’˜ö,WYAD— ’E6ØÂœ° ˆï‹€€ ‚Ä°NFIDÄ"‘ÓHwK Ä37es{éÃGÏ{ø¤^¬Nd¯v÷CFœsÊ?Æ1°”w,$ض®rÉœ¹Õ1 ±mºg¿¡EkÿõݺšJõíô̓9«Ö¬Xµ¾†yk•É럟›×»kÞ¯.ª¨¨›;½„‡9ûœÿ“w>¸x0ðÌ[N»ô\n®®¯‰¥à‡mªß-H@žV!ªˆM8öâ×o‹müÇ)¿zv~ «Âô‡.;ñAûîwÒõ÷QÝ¥o|µõ?ž FDÚÍjj»¶:·9¬ñøcíüîõöcÞ̈ »š{rçg&³…æ·™µ ±EhÅ&½Ä+¶lÝ´¹¼"É 0ýºÊõSg•÷?ý§‡¶ëØù€3NÙ«g†;dcßÍZ1ò×—¹OnC÷»àöó;éD7ƒ Þ<ûÝùŽ:gLÏQ'~x³´Ãůþöû-GN8{Èàa§œ0€XÄ2×—o)Û¸¥²Ê¸É¨Ù¼b£7ìÚË{-zgF­`|Ó¬­íö:ô€þýGR´af™Kû¦Ä E¤ø¬kÆî?äøkN÷¾{¿¤Z±ÝÈ£ïyì~í6?¿sÝeа®Ýó½cÃ&ì6`X¢Bj×ýû“ê“î½rä î=÷=òÄó+ ÕãŒówˆ¯˜·¬’"ú?_“ˆ®¦Òd§åÁe½'?ØçÇŸ†ß.’o×B°1°äÿ;¤CؼyÖÛ9¸ø°«ÿ¤.¥ÝòÏ÷Ó~y÷‰E‹¿xæ‹xÝæÕ› ¶^-][SWcW­Úê—LûÇí­.¼è¶{Îä­ >øG­¢T,_l«|—[öÚ/®½ú¾q·Ž\:oêFßðz^þüÝ{ÁV¸ðá÷O}ﺛ>ÚV±f×W,_´>fÍœ‰Oü¥û„«ï6kI…ß7æÌXÜ°R”Xû\S>óëÙ#:Í›<§í¶UÏ?øæ%×Ýtozó®KCN»âú3ÚF,ŒùÝ߶þ‘3Æ‹˜µ/O=þÖ¶eŸÜ~ÝÛÕ `ãuÛªj9éÖV¯Y¹1ñ«¿uͻמּä™ÇÖÍ]¸äó¥õ® )¾ìŸ÷xùõw·æÉ«¯øtÞ÷Þï_uþï€ IDATmU_:uÒSqßo{êÍ¿k›Ÿûê&ÿà 0Cå Z‡qñE©‹‰0Ô_I+YÀ–¼Ÿ»Î05W¤ÝD{Øø;õº#BJ=c*”e׈´BãÛ6n»zWÈeÍúQJñÕ%º­"´qc“=lþl+¥!³qñ†Dgˆ”öõ=Mö£ Lˆˆ$,ž¢¸aJô%߈xªÉ÷M|“,CR ³Ú¹ÝG´‹¯,ãî¿úó Ëï»bòìªÆ“ÆX+È"ª¨ëàNfåz{Э÷œYú‡K\ÆaQ—ûÛøÛÇ„Ô××'j_ˆHé¼ýïøãëîýÙë­ˆïûaŽD£Q­ÿ§Õ2­×ÇD@{J]:¸A†ö<…ÆXq D” æ¸YÀ ä=¨#kXÜ 05|†HH€ˆ aËb4°³ œÜ ‡ƒyP­´"c¬*¸|hÂV¡0ádñ”»Ò\«Áûc-3 ’r!ø„4{p?Iͤ7ìj€g`€ÔÄ¥[@â 3¨'±ì†–(pƆò„Dž&ËÆèÜsvp$… ÀÌ€„.˜: g›‘”§•Xc­M@/ÜbBÅܽ;D 1¥r–H!º¤^˜†½C$¥5[f¶¬"bß †£.’X\„‰™Iö”8ˆ‹C„€9åà1á£'"À,»æöC?QOE=¥åD”ˆh…Z¡R¨(øãéí7"QíJ]J&ü“7èÔG¿øhê¬ ?zhêìÊíÚ}BŒtzåKoL]òÖí¦ßü—ÙK0›ÜÉ=KÏóÜ ”r?§– 0ÿí@ÉjÏó"Z{: ôF¬5ÆÒ)"ÒD®´Ž´­’ö‘T†Àž+ QZ“R¤•&Ä FË;E‰äy„N3#ê ”xÉÓ„€JQP2”ɈS( ”³I{r=u 8žGZ)…¡'¥5ºØºÅ÷î†É )’ç)Brzߨ´Räå³x(žBDåJ‹\‘$*Ï#Ìj*‰!x×9TZ«æNc©²ßÁw{8 _PŠP‘ʘ4Pž&rÀ5@íšB7ùä)7+aRB’Û)¥‰´§IyÊáÛÜ„°°ƒi9ƒçôÊ)Ñ´"$RáÔIjz DÀÜ`Ĥ´§ÃL%ªÔ‘´BÈ^µî¬0‡å÷’ŠkX·BZ¡«¦Ïâì6é‰O“o8êípXDâ†s"Ú2Ç|Ž(HÕ´d渕¨V`ŒÕ #é²6œ’ J®"§– ¾o£ÕD1s}}}GDÑh4Ãß4¾ï'f)//ïÉ4&®TC0æ“ ŒƒÃ•bÃeD£efß°ç)ëû‚J+4Æ’RA)¾ò"Ì,¤ˆ}“Šw5Û$#HÀƲö4Ã@ü¸q‰ç)ö­ ñM8Rk%îب=m}#¤4‰1 Hž&ß7 #0¾eÐý¸EÑhÜ-”FaPˆ%cÜ)eý¸ó Ø÷9q Ö¶%¤=bßgô"žXH£õ} :Ÿ¶©h ¾o•ö-+­Ø÷™¢òã ‹?´&ãÒ¬R®¾H{Z˜‰‚0(V¯$—=)ÀamÁó´ñ zZ™°È\ÂÙ÷4&fRE¢©¨8¥=% Pk¤=-ñ¸åy`eÑÚcO‹eD±BŠ}ŸET$"Ægt·0εA/¢Å‹QŒ±i. )MÀÎAS‘š¸/:'±˜ò< ¶¨=m­‘¬Çråi6 ªÔžr%2 <Ùù€¨#š-"ø&%Ũ›D4@]ÜZ+½S¹Âú¸M4›¹CÅ mçÌï`:Iß­}dlÇ•ô>À`b‚ÈEÀ< ‰à*% Ipá$E’Åaœ0eÓpqPl:]›øjÊ¡Ì͆¡‘`9¥óšüO|¤êë—~l^l{†µ‰O‹ t¦aÅL"y¬ŸwËg=÷Îü´Þ–ô—çÿ¹¼;ê#¯¹éĽºìxÔΔ>{öùW\úŠ Q6=àFê%„ÙqÀkP$8Å4@œ±e+AH.£V˜Y„Y˜-3³@°6µq÷D¹?`‚"0#»ÀÌÒ p¢ñÄm‚%n€îƒH’›Oˆ€# Ò’îâhš0ˆ6º£Gœbk­ËYpì)-7 ZBdk$Á b-g#ß & ~CÔk­e¶Öp6§:(ZÅÄsÆ×Rßv6.ûƒ"àØ1 ’*Â.Ûá˜/ØIØË@ˆÖØäqÏÑñŠ xÆ\U)€ãIsóD ’7 ƒ„Ù§`m±q$6* *£0ÐÔ(š I%óc(ÌI¦ k]^'13É-efvÊôyÝóÏ¿úõ¿ùåAùô9宇ޛôÊÇ÷]yû&¾ú›Þ9”7ìgãŸüâÝI¯Ý9º³»Wt̃Ï^uëå}þÖÄWnÖ-é|À-¯¿ú⿽ôö?žqt/{Í“/¼ùÇ‹ÏëＪ6ùù¾Æýýù¦þõŒ};äv=íÁg^þdâ•w=üô“ǤùÔú¤‡¸dDà“aaß«þÍ è8ò˜»Þyí¥O'ýü¤!ùo¿Ïu¯¾öü;<¢_Ac¦fèÙ×<ñÉ[/M}üäC{d™¬ÜöÜ÷÷çÿyÇ)ÇöÜBÊrþ¯ŸøâÝI¯ß5¦›qã}Þñó{Þ{í…×' /lУ3ßwÁ!?ý·W?›xÆQ]³Þ·Ûy×=û»Ã~õij/óê5'tÚãœqëG‘=þÌ‹çgs#mûýò‰g^ùú­;&×6 ÇÁg>ðÑ¿^ùòŸ.<05œiƒÓ«4rt•¼m"l­M±& Žªì8à2-B¸N$*˜ÝË-‰š 7u±ÖZk%›µ°ÖºL¥$¸JRXS8@JÖ7éxÛ€êΙsËÉn;«¬#§IÐÙ3fÀЄeíjpÓÄ7³Í 7pƒ]glÀ$Â60 Y7'g!>”Ĥe9µrƒ§|3±‡kD<ÎÎ'(%ØZcœÙËÁfw;cÂÿu¿†Þ•XÙlöÀÍCЙäZ织\4ÒÎ$1í’¼P¤Á¦žüßlÙ ¨:žqÛUUÿúã%§M¨ßû´ÃFtŠoöÖÄõô/šõQEÿóöÊíuüù¿>¢öñ‹~yïó[n~ã×=s€ò{ Þ³KìžμîÚ¿¯©ípæS÷òä?M¸söàS†¶ò`êC—ŒûÃÜöò\ÎLE[õÝ{á-¿gÆ©W^€Þˆ ù³vŸÜqéý±>Ý»vÊOK­!o[VV¸×¡Ý¢mºuÎÍíЩ[NÕ¦è?½â¸¯ïÝåOõ:ç¼QÅ€ÅXõÀu|aãÕ_Ü-Û!¶Õ×^ua箽âÚËžZ]íeq,ëÊþ>þ¢«þVÙ¦8ÇýocÎùõQ手~q÷ß7^ÿêµ½r)§m§^#sŸ<ÿç^yà…¿®Ë>¿rß“ÿû§Ïüâçg|á«“×eµ€^a»þg_¼eÒ­uí{‹êta›­#@9­;w)ÌB& Úžpÿ}Eß<}Å©×,nì‰G DôG}}ï„KÏÿÁÌõ;_ˆ…û’¡Îµcm¦ÉSdÊDdíîb©Ûÿh*~W_ŽMê“46oYH{Øäslúéà`žÓúÐD&$2äš[Oí Pòþý÷}‘©ÞH]»_‡þãŽ}»µïÓf©©/]³t1nÙ¯rÞÂN‡ŒìT4|ØðÜBÿø+ÇWl»÷ÔþÕ% ±Š/?˜RRƒŠ5Øé¨#û¯âõék6é·>:§G#‡âšÙÓ¿(‰Cd}}ш⼂ÛLyè_ Õl}{ÉÉçµÑn>¬Àò—î{hþêiËrǺ±ÝUÇl¼÷[¿bß먽wn}ÎEÃÙëÚ§ÿ¡}#/lûüÍ·¦¯Ž/šºbÂM{w~tíê´Í9gð/N.{ÿ²/f¯1°fCs&˜¼!{îÙªµwåe Û@÷~C:üe3ð¦Éï¬ÞZQöñºóí¥¹~³l†Äç<ûþ—kk–lUÇnïÑvØï”CŠ+ù¸_ —ÖÝÛñš."««*í^ÇU“3kÖ³¸At;DØhÀ ÑôFšx.îÐ ßµÂê9’‡ÝSÿ¼«v˜%²±´ÌŸ¥F°¥–w‡Ów« rc7¥¼òŸÏü£HÝ–¬âµ˜STµô³G®ùýšPvràO  we¥š"^ýäûþô·/×\šÈ<ùõÕÁ5ÉB]]\8Vo¬ó6æ;Ž …DžÆÊm@bÕ‰PalÞ Ï¬Ë®)Äç}¹¹ûùcûΚÓñèCÌ.Y5r‡­žöÖ}7`p^FZËÎÙÒcï}{t4òÀvÍša¿fÅÚšCNÑ®¸Ã>÷Lð¹U•¬\µdåšuuÕ‹çTSûö‹ÕcŽ´±´´~å4Ûy؈A[¶î9l@±Ðz¿Qúu¾gÏšùóK3§¸~Ñ¿¾i?æ˜>‹ò‹;vìÜ@LU=ôØ1/'[a+›•+6ì{òèÞ‚!·Ê>ÁâûܾC¾N’x=ÇwÆ™Crv¯©¬ÏíÝ£•í=¢sâ«Ém×6?/G+äÒoælî}à¡ ò[uè»G—€ºc·Ök¦½õ×;,‰¶ÉSÛ_Ò. ž¥•J0ƒ`FD™]’Ñ©j¸$\ÈK)¿PJž*HBa6Ç1¥h45¿ ™ZD ­aÐ9 ãïy±D›Òh^-ˆ‚IÃ\Bj3HÞ‘È\6ȼ5•ˆ û–ú[Ê/ g†¶ÓT³0'††éÝn0ÉÇ^Øp¶ÓÇ‹ÁxÓg*9¢”)¥ä ÂùÄÌ63~T*y¥Þ iÜÓ:–HB'g,mÍ„?+í ¤a;;˯[ôÒ£ïÿâªßŸ¯ê7-xöÖG«Ó_[óý¯¼×÷ò›þq†gk7Í}ó¾¯ç§Ë”×-vüónºotͪµ›*+ÀëqéÄ;÷íÓ³mÛA½}â»ãoû<ÝÊÔMþ_#ÿtíŸݶtcžÉ*1a·,šQ>¨~óš&W^|fÙº-ñ²M¯¾9üÂ{¼HsMÉ×^¹$²msá)ü¥gQÍGwݳh[–DÓÆÞõï^ןø8ÙŠÉ<ôÚ†rášÏ^~Üý=vþ·ÜððÒxÿËÿtÕÀ>½ºFÆ?ºçÊ/þÍgï¼öî—ÝøÜ©ž©+ûþ­?Ì\‘Õ©ÿõ¼n¼íñ‹JÿõÐÞ›V íwÊY?ðñǯϯϲÛIé´O¿:oüý/¹p];%î_Ë–ÍZÛöÆGþuÌ×ÏÿîÉIKŸ¿ùÉK®¿ñ¡+¢¶bÅ+øó†­¼ï…מ¼o;„ºÙ/<]ON”ïƒÖÐÐБŽhMDŸÓ¶ÜBf ¶SëRyÖ2*­XÃŽvÔ½š+…àÈšAyʇ9Êy¥½ ,–‚¯'Ïéža$OLÌ‚Ò±±@*Èê¦r  §)€¢ÒJÈS÷EiEÀV\Y5i™1©Ð“bû•B¶•²~ºL¨ëŒ«gW2¤=ñ}‹J)B¶‚ÀVDi®\>Kâ‚„KˆÄež•cþôE¥° ¡K‚k­•`8Cå)±&“MÔáùG)%Ö8uk¬Ò$H·'*Òƒt‡8é+7@dDW4DJš¸”BZß’Šh1FDÄ ,£"Š²¬uÉ$ì m‚9dF"k|‘àW·Ö\]"pÄ‚Ú=z$‡ì$ˆ„j¥˜0¤•DÒdߺBÄ@†å„¨‚zlI9z¡ò”° Zÿ?¯LÑVžÔûÒêøûÿ}óúW§nlF&’‘ú8öºø÷þÊyWÎŒÿ€þ_Å#)""1&‹b)M`Œuk”qšeÆXÒÅ’´k$(èWL܈ŽFÄø 4ÃHŠÄ+ÚóØd; ’ò<òc¾ ñÄXÐ$¾oI{ÄÆgð";ŠÐ m!ö­TÚ1¼“ò-£VbŒÑÖ£ƒOÎ""*¥¬ñH+tW¡Òžß0) lŒeÔž2¾@ÏÓÆ÷ݲñ x4qƒJ²eô¤ª)9É9cIy }ß iå`?HÚsø ­ÝŽéyÊK^D+°±¸ï¤‘€IXÁë|W­ÉûÉѦ>hyi4Æ¨Qp¥s;ù6¶õ³‹O(2تÈ|6iöææ\é6ò’+ÆBÌw­yöÞy»Ïü±5€H¤àýCJ“Rè‚€ˆ»…Î*Ðe„fH1ewEâÊ”çc[4@Wfç¸æ5!;"‡”!¥4 û61LÉ~4ir ‚œUÚÐE\É_–âH@¥\l" Xâ0¦D¤"N£7óèLlƒ ¸1F)ÄúIÚXgµFÈ*•œ|"Ì& +UZØ4ÈÉü,a f‚DŽµBZaÜdOµc”È^‰œØrË- µ–™•"‘ÀEßI#X1㹧E 8¶­º¦®Y³_ûÍßî]¬Øúšªªú†«Ü·Ö‘ö¢-êFñ£Ž?sÿdØNâ '¿3õó%¢Ôÿžô¼ôL[‹ÊEÓe»„B.1"J‘¬)AaEؤ.DÂÍQDš€}R¤„Ù1ð 逈P”FñTÚ;ÌLŽÏ$S‚I)b÷*†PZB°—§Ñ#@‡ð D\Óý5!ZË @DN¬a䧉 `–Zq@œ,„5¥Ê˱µµÖJ2´ˆœ¾f"¡àª’éepgmÈáÅ$)8! ³ÕgêõŠµ"˜  fÑ%TçTm,ÉvM‚N…t¨ü+ÀZ+rE„MèÛ¡&å+Íèã+Okâ´ÕéÈ°…Âc­cç ø@)j¹bz<'"q_Nü°ì…ï7%êØYv0…'N‰@4i6† ZjSÛ²Ö¸R~åE¨¸ÿ™S0@ÑKäÁ¬µ±úX°“5Ê@¦êÉñ, ߎœJœ)QØëÀaT ,®°Ó†uLÉž3p8e6>£Ö¡[ «t²ž­r”PÖZw. ð*î'‘ UJ¤ s¦,7)­Èé…ÚÔ1:RQtrñ®ÂVPkrFžÝIJ!p d%’=m˜±%§ÎŽIÐmEN42X"tðêë A6SÞ5¦@ýÝsæô©h8Û¤=ˆHfDÜ`(:AJQ)§sˆ´+B›Ù¿¯«©iîzãÇÙZBe™ÙZ$ÍqËüäuê¹÷ÐΔٔ1ÂV!0‹Rü(™aЖÿûww?ýüòý:ï@ÿâqÈR=†?Ò?ÂÖÞ½·pÀ2„ÿ®?jµô Ë®ïŒüx:Óü?º©CeB JØñèi­ãñdâ!§¸ë>cèÑ.ºnöW³¾+iÕïÐQ{åëm%k¤sûÚio~Ua½öÃFŽÚ«'T­óÁg+Ê@õ<úÄŽuëÛï±G¤zÃô)_n•Î{@{Ú´zƒW»væâUÕ½F¿Ï°èš5ŽdNû#‡w«kÕ¡Ga|áÔO­¯]0ð°Cw¢’’úŽyËÿýö"+VkñE«ÜþGÜzÁçß:6ûh›Q‡ X1õ«ºö}÷³W›¨¿ò«/ç,)Ìë´ßégtÐßM™¶rkÜ\Ä…ÂH9í÷:zL¯ŽyñÍ«¿žòUYxEöáʡűJÓö'7\Ø# õ'îߦ&wÈÑwÞsl![ÃÖwº( H*ÒþŒ;~~vߪõ›¸}¿ù3æº[ÖjÆøá—]>j@1¶yÄÕþþðÞ±ÕËË Ûå´ßû‹Ží Ñ=?á€S—S®¼ýºQRQY4öÊ+¯: t«ÃÇßvÅ©}6-\Êö¦Q»ƒOÿÈïèX³reu~qn§ÑG_xTgðz~Ù5£ ²"{_}÷icÚmÞX»ïϯ;ª ¨Üc¯7¤¨®tS}‡m©/t¢¶´è7„þjÏS;À‰ aÔÞ®Ê)QÊv!éôöº¥=/âeddãEJ#dêÇ£þÁ“c¨wÝìíøv¥:Ø]‚ÜÕ8‹@#L^˜ú«&ÎŽaK(–`æêjР&€ñE .)Ê/’9´°?ņ««‰`™î|ȱGôYÿÉÄg+l…fÖU»>mósöµQÁ óf,Ù {ƒµÆÄ}7ƂζVmïsp7kíûwM\]ëb|µ7»žQa‡6°ys•ðËWW5‹“XE­@Ë¢¢ž)ÌS+ÖÅØÆÊWoWFÅ‘^c?°«%ïýmÒòòY3+¯8üÐQ[Û½ïþ«—nZ±„:Œ)(n;x¿Qõ e3>_½™¡3l+)pÍÖ­¶ 8Q)``` ¥ˆdõß~7ýçGž3þÐvzãówÿy~^ï¶ùÑ^{ï[,›?}+ÞæúE‹«Ã7¢jÁwó n9|È”üA9¯<¸ÔæöoŸçÉ{ïÓøãI“·ÆÌÖÍ[ªëšN;ÕÍ_°­ÙÑÕ¦{‡<ì|ë³xéâªÒøäIÏo¨ nÝmön—P[ЮUl¨°JihÒiì¦9/ÿažŽäüÐËüÚ¼÷—”UŽœùÚ‹_¯óÃ\04P¡–m«ÞøŒ&\qX©]÷‡UVTEi ·þú—?MÂî(’œÄ'ZT\àÕoÙ\›¤êM6+¾a•€¼¶yþP¬IHÃØ­+Kk`ữLYž Ô®üìíǦÿ» çžn?¼ø¹/6Ƹ©|‘l ”RL’°µˆ®Æ ­ï;ƒâ¸óýO¸óÊkÚM_[×jþõO^ód©ßðUsÿ6qݹ®.Z€‡õÆ™ @ùC߯Ϟs: ;è¸ú%_ÎH‡›mÓþýÍq×ßtI¿ùíÍ29KÖáûëç-öªm‹^™^0qLÙ_7Õ¯›:cËí¿ºñW߯¬íÒ'ÿ£»ÿZÂ=ºô:¿ºë^µoNœ³‚¥TøŠö¼àêc[oÜT›¿W×u_,ÚÂåþõÁI§Ýxu÷oÖµïÝaþK/}±xsƪô—½ô~ÎGë¿Ü_ilékON»}ü¿úͶH‡¼øüWÿ &K\+ÿà;ÿôëŸÜß·d©å³o;ûÌ“Nn_px„8X^ºT >ñÌŸzËç|úí¼ÙÏ>³üü ¿i3}E~׎k&¿ùÑ·ecÇý¼cízè0Ö.«J±Pñ8x^\°“qpØЦ QaIÌ$,ƒÆ¦3áï„`C&TN9s'¬bXWë~t6üp¾S¿h@à. )– {1wpž“ŒófjoªÕ Ô´S{8Ú½{""&É_UÝ©è±ã7v¥Ôa< ÀÂöÈ„$œ2I•²Å$aŒ;ÿ‰°1i+bYœÖ¶ñUðM±,Î5O‘HÆI“¿! °ñ"­PÀÕ9ÚL“/éüƒ)œkIîü0I!M†%ñ€ÃxIc•°HJ«@™³ ­8ß·H"Z W“Jç [÷Ö¿MÙm›—Î[a‹ûKIYî€îfáÆhïîU‹¾/•¢^ýúõí¨LMåú æo0 :î³odÍœu[7JåµéÚèÇ·¼ø~ù 1û|¥ñµ_ÏÚ E}»F-Xyí‡-Z2siµÕ=÷ѳXùϾiÿ·Î>wrLG¥ðîSØgfÙ;hd÷õß}_QÇ9Åû í[…º-ëÎY!m»öë\à´+ªe³æn©c (¥%~9] é×>Ç“ªµË/.3è¼6½‡öoWèÅ«Ê–Î]VYgr»õÚºbÖüòäG…CZ¿tÁŠ’rŒt8¸w×"mk7,_²jM%£×kxßÍ‹—l«OX%ÕnÈ°>ù›gÏXëöˆÜž†·Zÿõ‚êÐ*¯ÇžÃ»ñæñâ­³¿Zí:xH¯Î[VÌY¼¬#½‡êØ&×ÔlY1éæ*ÓiÐðÞ] ÀÖ”|¿hmYMŠLÇÇêc:f'œ…î.ض€Ê.ÓpÁé±Eí9®^t*nÆ’F.†äÚ²W¼ÞªˆFæ@X,Ä„`£IW 7Èq´9l”*¥ ³CÚ§ù4^Äs¡=wþ”0FèRÒ̾orÞ1‚‹^D;Ïßqˆ¸‰µ@ÊÓ䢉NËBPE¼@?3ÍÍr"ÈNs’´FDk )/ÌÉšX\•§ƒ°•ƒñkì$ÌÝØÅ:ct£‘L¯B·%8L+*’@ìÑ ˆòmjàßa^\ÔIØŠ‹ R@JeêRZ«Dg2’¼ZlˆfFåET0½èFÐOôÔ8IiÄw›*OŠñ§ž™±N²òÓ¥ k¡MŸ“vl÷"Ú¼à˷ߘ]';h€¬5ñ¸¯µ¶Öæw²WßœDÂ^ìæ•ËV®-Ï´nÿ«¨¸´T@–™$Ã*’>Ãí•òa6vÏâ¿ Þ"M-ŸF6i¡ÈÄ¥JdÉ`ÊH%iG¥‘«y”“_ pxˆˆÄì g¿°‰‰jÎ6§d²évš³X›î¶4N1-ýš”cÏÖç„óß’~¦ Ù1 "¢õdë f½p{0)«k­uHCWò;nß³oLspÁN¦²i hŒâÏB|-1FÖÚX,–piU$·m‡Ö:¼5Äjªkjãÿw,àö ‰e×dv …€¸ƒØ°F( _Èí­Ú€Î Lâ`ctÍ»Š¿¥t—<£ÝZ¿koˆËkf·[À ãÁÌ–HµL;8åtÙ˜L#ŒÕÅÝ{·©Z¾¼2s)iíemªE–H˜©UQ¯öñ•%壥__±iKTy—‰¥+¯SŽk×Õ'$BTN§>½ÚÐÖ’5ʪPwëS\½lY%ï~ûÇ E››ñ&%:žÛ¦Ï9/ùnaÅÉËØè[´C`ÔFÏ+;0›ÒÉJš~Ûw¹©’Ýiªv_·wÃRà´”ZsºMÛ·^ 5]D­µÖžóôÝ_I2ô&› Mò4e^§ñe£ñˆ.>¿¤=K½ª% ]ºtÂMWš‰DÃO¢D-ÞŽ—Óú3Žé”Ÿ ˜8ô7¿=Ô¨!:ä»Ñ´vÜ/.ùAV™1¿êMˆÒ}E½÷>ìæ×ÿtp'½ó=ùñ l³ôæÿþ|Z²ˆw‘IhF3RñÉ_oþvŸ7D*øxžgwÿ,sMÙ+ü-Õ;hקgîìw'þuzÈ?/•Óžºá3àÿ(;Isžo¼bÕä¼̵cÿÇÞü¯mÿk§åÇ0';³«']xöiÃs•Ž—ÌzæçsŽ亳‘:µ-ûjYû=ô‹\ÿ98ûšŸ íšOd×½ùçÇ^Y“Üc^zïèÊ)[¡PU•¼ôðÿcïªã«8ºö™™ÝkqBîîîîV(…BR ¥@iqii*´HKq)w×@Bˆˆ»\Ù™ï½7DÊ×·}ßœ_þ¸7wwlwÎœ9sÎólϯ7nÚØê45‰;VûiáwûžÖé?cÐ[«e®1"8ƒsƒ®‹>ì’àè‘uü«•ß?ÔVm=sÅh‡œÔTä×Än÷°>{ o9²í±eS£_ß[|"ˆk­%k{mŸ°Úqð„žmŒsCNmXu´uzÎßÚÉÙIólÿç~|TrK§­9hÞ¢öj½AÊ|¶wéÚ{é.“ƒwF\L6é„ÌïVÿô\oÕzÜøÎM½ ™·mØœG쎞8¤£77™òãά_t8˧LJó;Tõ3-¶(4É ­7oÑð•|­,öëpcï®ãgŸÖìûÁqjæm2äDÀšª=†½=²Œù‰7¿˜¿³X%víñö{ýª©UX Ù–¬¸®}ú`“˜Óqyj¿ë³máÙ^ ¬V=¹o­Lág7m8f°ö:rýŠ¢AoˆøzÝ·WSJ{¬VãîõO¸Á­låØ;_¬ î³ý‹ø…cŽßÏé¿|3=¾bÿÅxKl˜Ù¡v«8Œµ ýdÑ'7¹µ-Ï¢€YÎ_¶þx"yÀÒOšyžH«Ù6аùýyiØ{òºqí=OŸqi5y˜ÍWãÞO–l\¬rШ#KgܺòK±ú;+æç œ8ÝûÞ’5fðÁþu/°ã·ƒÌW¨Ü+ QýدÆ뵎Öy¥€±¬‡6^ý)G¼Æ|;¶Ÿ…#nztbÇæŸcZ½ÿIËf•ÃË'4éÄk¯¼pxoÕä&®Á×*·HY1zClx™Ð‹‚NL¸thë®»H£–ŒV¯0敳ؚÝ{ÖJ9³tÙÙµùçÇfÖ9:.¡]ÏFôðð±‡ôZ;1W.ßQ–Ë¿Qj[o?2³Àã/‡Ú[’IMðjÒ°Iý¦»vQÆ[a»9£y9™Éyúì´t5³r°öñ­Z³o§ïÆQàúLG À YQ!ò$R>q ¨jóìÀã¤üLòèFZ¥26‘ù1ñIù eåÉ{+­®¢›öÚîÈìlýãϘYZ øåÐèjÀo/<úB╇´O«¦]mG÷ÏOX‘ñ|›ÕïÒ­^“¶œ€þ¼“YwC¢RódCX¼8º²«p'«˜¦‘ãýÅzÛŒÜnÝ1*‘2SrôóVžNùúÉ ©ù4%å’Ú^ê³O¢æ]µ{Õ•Ó§ÿt25·t%(§¿‰4RyzÀV¯Ùk`RÑ/¨Þ¨~?“Íìdƒîž=?cögßÖ¿~ìð¯{Rðò™V.ÿ: h¸2eÀH@Î/u³Ü”øûç7˜–aÞ‚VVìª×'ŸŸ³ôÓÃÑŦ/·€Ÿ2}N>X[kÑ:jޤŜÉs¶Ö¾à–üÃ㜀K¹zˆ½m³ …í‰o7éÔPqÿ!ÍI=úãÊ_¥Yf½WgP;èªÒé>[_Š×ÑøàÛé=NUª[¯ûŒµý £~8 D-j¬TyjUþ YÎMz°{ó²E» NÜ< ØÁI‹Àø'f½l42µµ5CY®Pßø{?]>iÞ¹ëa»æ×RLe¢µU€ÊÚÎh”@´V«D DÐi„Ì<ʲ"7Ÿx´zµ†ý‡,›—=vÆy#ÒXë¨ÉTjÀi¡MNe¦dƒ!Q'PË3`ÜB!˹!?ù̼5ËvNê>2©ñ­*õëvžµl¶Õøy›#XùT+—¤¼Š1]ÊÎÈLËÈÌ*ÝR` gn¦W0º½»g…C6ðs,~5Þ½QÖ”.|½k5óñhw±D†`Ú½Ã!‡µñiÜw@{»7j²”s'$µÓüᵪ×êß»jA³1+#3-#+[È‹¼ŸRÑÃÊpqgL­îU“ó£ƒSÝZêSÏÓ·Rç CªYèZ Ü& Q¿.~ÏNÝN,9I‰×€‘ ü…„ˆçzµŠ Ĺbûžm=›¶lîð029ýé)¨ó NÕ<ªõ˜2¬’š§Þ¾é9pêø&ÞþU:¾ÝÃù¹òžÅ„ª4«­¿Ÿ_óÁ*”8GŒRNˆ”Ë‚Þ™æ¯(#låдWw¿Ê ;ö©ªJõúw¯Ø e]Ïœ ±FmÅJí:Ö£ÓóEb9hRûÍس¦UKoA^ÒsT1À;7nÚÆݼ•2'Û5èPÃÙQ\~pëqÝ©ïölæïS»éØeã*¨[ûn]9¤ÅÄe#"âr°\þ¹B>ú裯>Ù¤ ü>Ö7nˆ¼êÓyÀ á½T)7/ÜË·ª¨Ë —=œÒ®G]žÝ0´|wb·–NW~z*ç?º{'½úÀ^Ö ÉÍûwH;þõ¯‡CLıa³z+ÿÎm}.|¹íò“4¤ujØwÈ°±=½hè¦O%)þEb]­i@ôÙËÏÓ´.â^50åεDó€ÐôØŒvÆuk‚Â/=~x;.9X^Øõä¦oOèÛÆê¡{©ÑOî§:÷|wl§Ö•ò\¸z#Ž;Ué9alŸMñµíë7]É•Ë'Z¹üCå?Ϙ®õ©ë&G%SŸñg>ùdʉ{Ù¯WÛk¸K‘Ïhó—÷[1åóhú7­î÷¬ ›÷öé°ü\Nvuä‡üí½mvZ«À™Fþ:wYDjqåN©‰±K¢ 'ä¾ß•/Q.åò¯õþMbU­÷šÏ{¸©R-šuî^ç¯ÄŽU'l_RÇ“?=üåŒÍ™ú+V/ç¼xH9WȾÿÛ:T°‰—Ö¶Âé tE©­%¤ ¾Ý‚êÊgF¹”Û€›pÎe™ÊTF€ÔjÕ›D^+s[™Þ¹J»ú×k Æ€±—ž?¼ÿøiÿä«í½¶ Ò<ÎRž†háúÃ^Ê› !„ˆc\®ÝÊ¥\Zæ ¥€”vLla¨ù}úB1údY.ôõ' <=Ϲ¶kÝËÌZàÀ8p¦ð%²ÛŸÛŠ3FcGô.ÚMžÕ­¶Ç_Y¤éégmmùñºü‡ûfÊZÚE…ÀÌ—`y%‚m^^)¡Ð•…ø˜,èð…®$/‰.ÂD( BD¸H™ˆ 鑹1/É3qÑÆ`R¨ „‹])”u¥’9Ž 5¦Ì¢W\FŮȟ',—ÿ È9/#JÆ6 ñÜŽDœ›÷nkk¬úòìχ®­Ÿ±|Ýî#ó´XW{Ü‚îœùùØg­<•B4í¾Ü=sÙûßß?³ëàÒZ^j•g‹ÏÎœ<~nÍŒ•_íîgÿ°ïôWS'TW€cívKÖ/š¶ç×}W¿ÒÄsºŠÃ·ì9~÷×9k¶íÙÕ׸²•+4_íûþ°½{+h1eEŸ6ÞȯÃð/¯ývèΡùc›!@šªƒ§~wûÌÞà=j»PÙ„¶áÖß>Z1qÓå{Ï~ѪjI”Ô¸tÇSÇš2¼¾Ž`MݳöÞ?ýÅ+6ÿž;ÀºšcæýpçÌÏÇVµõÔõoغbâš³Çöû°Ž ×Ö[C‚§o7aÇGoíÒµ"x4ìµúÜÑÃ~[ú~«Òwób5{W.±â䡃·vöjàÖtíw û:#]—/Îk¥-Íls­ßõÓà£oî}w@m ĺф»Bν¹{B ·Â+Š R©T¢ ‚ ÒL@NY!¸aÎ{©(9£–•¨à·3“ú 8g”üÆ™rVSèÊŒS®ÜXdyâESP §…odœ²—h ùËKY¡`o¥…›ÍÊj6ðB?ë`‘‘áEG†ñ¢UðÂCQtHËå?#ÂkÔŸ,!¨T³Hð¸xJâöF^ɺdjû:áá:«Çw¬9½›fÃá„ÎÃêjr9­YÚšAÌծ90;®õ§1z¤u÷«NOÌoÑ)ßÊUÊwõ˪ü}s¦Þqñõä¼Û¯s/zÅ–>jî‹·ú ù¥ê°•ïµ?teWå ‡Xÿ`èí–-s±Ñˆ(Ðl§ ¬µwÀ"µ•­F- µ}×a­‚ç¼{ö)«hK9€g‹ž“;‹ŸšéÓeéWïGvYšmR;¸U±±^:pà pRK‰ÌŠ¸øÉ°MIÔcâ’1uîD>’ê ééºzðpÞ|ܼñN!߮æµÊ^;h˜¾J¿U¿ÌŒm»N´qp¯ Ëû õ˜÷è µç®8?!¨cυ˵'?ÿùz¼¢ÝZŽé÷xãÜ¥—Ò+ºjåÒ'm}—Ošç`‡M•íìm´`º¤ß[ŒœÒõÊÇSק¸LX0¤é¥ÖËÞ? IDATÇwíŽí©[×c@Œèâ+ç6æe£¸ 8SË°Ý_jÌâ$¿E!òŠÁ»)úã+¾ñ"_‹i¿ŠÞXö… þPc^qá«Sô{U1åòÓ€ªZs—ˆ;´ì£s%¨m9öj׶©gS©'w®äïáçðD6$>‹|JÒ3²?qo×ÈÍ®f­Z¶žxð¼@ì‘—wU—•1qÀ™WN'åRž—H]Úw¬”ðå¡›ÏR„£§‡ù”¡‰óï]¿ö\M‚Ñ®Ž­FW«ªã‰ Ã#ò³‡Ž9`Æ´í—-ëT¡ˆK?{`,Å„‘2² Ù€ÞìÌço€͆n>ÎýæÎbcåëSË …ç«8“îŸ:ŸÆ %yÅeCž¶×ÔéÎÖ¢—ŸË#[+[›†¦Ç×ï†'bùBl×–€ÅêµkÛyŠƒæù`'Tô©æº1Xò©ãñYiç_Œê^Q…¿ù4+%¿Y·îÙÂõ›ç¯Ëtiò¨KÆdI¥GºÊ¯{´jßÎ êøxŒ›Ô˜‰^Uü$õÍجTîÑmL¿k—.]¾˜_Âß+çå9¼åR®‘"¾]¿Å–€>M_ê¬PYe…ž_õÖ¢IT‚QªSˆI”½ `‹‚þIJµÛ.¿(¼î1É$å9BŒ1¬ÖªÀh”83åIJ€K‰sXNM2@fnYL078ç̘gäŒcù·¶nŒÖ!dH5ÂKà&P ³@ÎÝ5wî£özŒü`pç#cÞýVäKŸ¯]»û:Õæ†ÉfÊÉGDDœRÙTìP˜ëê½·zø™ÓÖ^zÞoéFŒRid…J–òQ0œZ±rËùxKõšÆÀe½¤X[<[EÖvbùìØ–íºŽœ8¨oƒ©Ö&昈ŠÆŒlZ0Ž´¸¤xQ³«­b/ütæ·™/mÙ;‹†ؼw÷þóÖ®;ïíÕ÷h…Á¿ ¸\Êåoñòü¸ˆ¸§ÑqñÙ¥@ê"ÄâÎÇÒJ[V±²±õ®QÍþ®3>Hl2°M §­«WíÖµ¬°™´X9žz+¹bƒ¦~¶žA›;™éZ_å¬.åEÆåµPßÅɽIkbÑ«±Q1áÑñ/ôÜžÆm]°¶B`mXôôu|vùè7«¶&ZÙk<‹ˆªÜ¾I [Ï µíDDMAš¤dK°»&;64,;T«ÑÈ!È‹½oPÝÛÕÖ;(ÈÝ] LŽŒxÑ ›@O{[W¯Z­kY—>À\217wÁìÇnži÷N·tMµ±RΈ‘®Î¸ íZù” $§%lü*¨ÔõÚ¹c‹Ëѳ •Ý­´jŒÁsÖàR³~­ Övþuk8«`ëèãŽîøé«o‚íª»Ë6.‡F.—r°„°²ˆóŸìZõ넹ŸôvRë_Üß:oCN‰çã»÷ûM›¿{†æ>¿ñËŠ‹÷šmJ)Fˆ2†ô‘_OÛ¶xÅšÏõ‘Ï3S@ô›úóÊF¾žÎvµ¾<5ðдÙç^:x”ÝZþ¥öÔÛ4úhÄ™r‚©L]If¢€ô÷·ê±hU½A!zC´FÏè×Ì höå­ŸgSÈ=h_•wfïÚ®¥ù ÷,»|Çh’W¸”„‹âìf<åâñ«]füô}~òScz6çy1øI³%¿|ŸúìÎ}ÀBÿ²ßÊüÝý5rÞ‹Û{W\/MÒ‡×îõühé·“ö®\zèljÐÀÉ#ÚV‰áöO[_dˆMÝ “*}råbliæÒÓï~ÈÜúáÆ:á·bòÍ!zÜx÷·«=Ö-Ù6 ú›Vœ¾yïç=µÞ^¾þ--ÊŽ¾¼frXž£wïyÓÚè3c¶/Ý¡/ýËå^^­×ƒ ”©cqAxóLÅîSοAP,A¢³S³<#·í³n“x`ö¯g“_QçÜh4a•½eåòÊï¬X^mçàÉלc cQ ˆ1NW‰äÕEQÉ@•âç(£ B„b1F>¼bý~‰V§‘ ›Z½[aá„oóþϽŒœB‹M1cÐ%‰~_Dt)å(ý3g ¦¬¨33kí› Uƒd2ý?@pAh‘&!,`&ÓrEóïµYY/!çÌá{¯ÆS ð…•È¾ñèIý]Öj g¸“öú÷˜`ѳޤÙ݉Dm3¿úèž ›3$3„c\_¯—ÂŒJ…=8§2¼q|!RÛ¶3±ž/m­îÙ™÷¯~8áJNHÑi$ˆ"¦&#+4tEè_•×@ùŠ i!ÂXNes  *LgX”CÖ’dS:Õ$²°²+Ä[‚ˆ8“ËÒ,ÈB9Î-  ç²É„ÌùKÌ––ëÂ]⥈À’…Y¢©á‚¸ð•/ s›Ì|èÅn+—¢ hvóR’9 ½§ç\¦œRF…⊠µF+ à²Ñ`’^¥ìRQkU€É&ƒÞ¨ä°*„œœsÉ2{ ÁBÙ§Ü"e Œ*¨K¶M^ÇÉ™ç¿Þõ !¿hV5•H8“M#ý×Dw•´%Q%` œâÌd’KÑ€&³±Œó¸2*3ˆ+‡`”s¤D5#`²Ì!‚ pFÍWbB¦²¤h"  è2$ˆÄìè¥2-jHd“ QÄÀ(¥¬Äˆ#"ãŒ1Àæ2¥@DJU**IÊC'¢œ#T’9‚@87Ç+÷ÿ @¨,3X¥€RœÊœcAE8ãÀ¥Œ¨Tˆ3¤ôQiŒd’‹"ÈåHT T’€„˜,Ór%ø´‘b©•¡$Þ‰@Q¤„à2Bmú\ãklåh—K£Ù E Jœ-ç2eJ“¡ôꊮë¨LþbCO =ùzÃI6êeã¿ìüÀdQ,–æÃ3Ãͼ&LÁ@%™c"`Â%É&©P9 Â"Á”SJÆL¦ŒRB§ V†a ŒÊ” ¢ˆE8¥2C¢H• o70!À©,3"ª™3ÆJKK^FqF©Ì8&f*‹ WøÝ&˜Ä¸’§!s¥u¥ÿ˜M"‚¹Ì Î(“9`ÁÜ6‹aÉeIF„`Œ©&Nˆòc ÌFœ` &Sh9“ÔLð›(RåwØ™0ÆAožojÛ|ôü™uÔoвÂg˜!•(¨D" ä 3÷QY½Cÿý‡¢i›N˜²êÇ3¦õrÒ½drF¯ôÀAÁÐðRºF\1Ø =ƒ’ ð«ÛŒXSbÝ-»á L*‹BäT¦”£”r,A(é<1[µE4hˆ Ã)/VIa/¸ ˜(e!%â›ÿNWf¹ü'4àŸ¯#‚ŸÒ¤yéIÉú7ß‚‰™Õ!„Á„`ô·h1ìÙþÇG_iÿß72B­ë¶Ovþ²Š×_Ýúùœ÷O9U÷9eŒSJ™,É¥g¥ „Ͷ@aŒEÆceÍ@ŠwŒWô(༨‚C/ +„FµÑÉ‚Æqú{•9ã–f(.³û‚3™½ JË9£2-M#@À9C%rC9§ 1ƒt”¦ú .qÆƈ1ÎUΈxyøå?yüZQ;x5êÜÂÛYãµ[1ÖÕ:5odo#æÄDA·¼Ó{.¤Sѽn³fý„œ7ÇäpÁ¯G_ý3×J•ÅìgžOaž­û´tCIQ/TùqW†g´èפ®]FôCåe׺û5©ë£·q÷³3†~ø,DÛ ÎjU@1Ñë'‡÷…—‚NCÔþMZ6ªãE³Ÿ_ÿíR|–ºQÛêaç¯eqÛÆmkFœ¾˜&!ǦZZǤ9Öñq%aG÷ߎ2yöZ9?LçWÍ–f\;|"&]U³sÇþöù±÷/œ¼›iÒÖê×ÍQÊu«èžrÿÒÅ+OUÞM»og¯óì·Õ ó­Ñ¦ ŽÇAÖéW_NqkìGϜиWîÑÉåÜ/·rXaECs„uµºwª訽öø­ #×8ûµêݦ¢“&ùáóçîgëe*3‚±²áF©‚'ÃåTŒ1•©¢ÄŘ`Sö³aŒ8åœ1F0AL‰ µì@‹¹öò/J0FÔâ0㌖…`Á™¹Tf#L¦ â!£”`„1ÆdŠ!J>0 „0ÆX) CŒÉa©Ì-ŽJV$G‚•,s_,cÆ8&„1Ê9p*+C²D !8g¬Ü ø/µ5íf/lá#= Kk=iRƒ@{×ý[¹ÙôŸ;t@ _¯aƒ«‰z,YÜ=ʯÐnͶ~Īo}0e\«”Û×#ãóÚ®Ùò]k /¤ê“ÖNnä ‰a7ñz#†VR!+¯ªƒ—¼í—x+¦Íl¥ìÝcÔÒ÷kæ$Ú½÷θ1µ´¥u­á°÷§wÌ‹O§vîDãÔf@GG+‚uÎmtqWcâÒ~ÀÔå³Yìí;I‚µˆ@ð1}Ê{=¥ð»"²°F0eÝø>ž OŸ9÷œ5d@ ‚­šM{¯mrå\dówÞªêeeH¿v.$Ϙq?øÜÅ ¥Á„‘ Þÿhj­ìèXÜôÝi3ZhT›4»Ue øvz«~u'@Ú®sf×wΈÑw6!ÈS§ó¬4pñ„€¤[1²ÏäÚj˜rçò•øŒäØë'Î]½™L9õ˜9}l`âãð•·›méÏѺJ½QË—ö ̹ñ[«ìjõîZƒ.5‡Ohí Ñ3œRÎHÀä5“ù$„Ç;õž?rXmHÃI¶ð“î\}D5Ž*Ä8Θ¬`š($J™ò•så3•Í¿rƨ,+V£”JrÁO”RY6[€ü('Åþ,W2K…fh‚’J9–¯fì5™Ró+T#•ÍÈ”æý‚ŸJÖnåF*S˲REá^ps@©,ËÊfcV¦–ÞqVð[©)ÿû{þ^ab»ªA­ò_„>N-%îÀ¹M×&Bð²HCD¿àÍ«¹–ò"î^:“ÑÑ+ûÌ9תC}íUo˜{îü“™y+{ò˜:®ûÎ&Èy—¼r3Œ€Cóº _Úÿx>^´ißFA¶ËK}þ<©H`‰éÁÙ}"xBȸžÕ]µ—›¶¼½ô£Ãçr¸µkÖÝÜZçêAî:€œØÇO²h‚Æô}üë¬#Çž(oª`Pj³#öÿº÷ZŽyV#ÎîŸ=xöBˆ 65W¿ë÷tî—iéÔxòfïÆ ¬ö£‰WÏ\Œy˜×ÏÃÙúA\ò³˜d‰ê#£cõ¥íg4žý‡ÖˆúyÍóùù‘sÍßëìI>Þ÷sÖ€¶ÕÄ°gõºxD®zÌ\:´®.;›—'Æf6oWÕáû40…œÿõBþplÏ:."‹ONÈÏ2äŸED§É€hÝQVHB\lòí[Y´LwWê™m›O'SxàѶÀSVF”§M•wß«:w[JšœwäÒÀ¶M­zlå¤Mú<5.<üVjžþ¯?í.ß–Ë?sLœê4mät5¼4 (8ùÚi‘³o6ANصˆGÉÐ(¥²I¦&Y¦ hÔ¶6¶²ìPÍ€ï_°%Jáð1é³’Ó” Hl]ì -5‡@V\N؞ܘ¥§ˆ2NÔ‚¨²Ñ’˜Ë~žm™È‚gý¦ Ü€?Ë {’Å@íä©ÊIIÝþ‚æ?ÐÁ‘s_$)ÅÖ.î*ã ÷€{òàcåÌ$™ô2§ o Ž46ÎZlrò8@Ʊ­!iF)oÏ.íûÍÜjd7±Yš%xØhWÿ@)·/<ˆÈnzÙe•PŠ’ /ö¬ÿEÕµû䩾îòÏ.»QjŠ7EG•TeáÉb+gwµ)Á#°’ ˆ?þK¨žš®oÙì>¨ù¨…ƒ´ÉW7¯Üù<³Üs_.ÿPŠÚ½%ªìŸå¤Ð´¬š÷¼“`žU›}RzV¦˜rùàŽ0(éCV¦bÆ‹4p÷p ÷2UN• ä ÜÛ²13ÖõÕÀ££Ÿ*0wlyðò*}b´±v7)nvIŒ`QÔX½ì5/ŠU°Ë²^Ä™¬Ó®=x×¢\°si z•;›çg&äq§G¿<û’w=;¨^Ø|²piQl.—C23=n:jYhJ=(ÒT–~dcøQ¬®¹æä€>WÖ‡QÑÊÖÁ†§$æðÒ:(Ë2ˆ¨í´¢¢QXØÏYNb¼Q—qýð¾/mpcèÅï?¾„Õ¤ï×z~ž™Q>mÊ¥ü$ óÚ¾“]û/˜Qåa’£—Ýï,>3˜éæ±Óm–L™éq7Éhå]1ë›Yß'3 rlÛ3|îÎá¼±» ضnV<µõÚ€Ð3Š+ç\8z£óœ«>qlî]Fèƒéá¶oÚÏóŽÃ}=Ÿœ<~ýIz|ŠU÷Á=£$o?Oõu0?â‹O͘ýá¸+á`çšù0øà‘øRôRfô•§Žý§ó}øðÄ‘â®@SâÞͧÎXönÝy*'1çÞž/OfËÙQxÊ$ñÇá2 H¿xüfÇa §‡†¥;yY]Ùü}t©Kγ«éVcûûäòé³IîÆ÷¤)¹ªÕžÝû9A£§­zK?ºéêç¥E˜eÇÄ&»>,__©‘µ.Õò¾ =OûôΩÓçb>ÿðäìùKß¹Êm]³BNíûåN©4P%g!woSÔɤüò9S.ÿMò§¸â­½w_kÑ”“ó$–ÚùÙAB†ÚßCŽLQ{yæF…§p/_og˜²㢣ÒeÀŽÕƒÄ„Ð$ C9R;Öô·AzŸÁs´gì<žÐ(ÈÞŒ“,%>Iæ6>nbdDh«T¶‰yk@÷ªU<í0Ôµ¸éÁ!#Ï•²Ä‚“¿·§7fdžEeäÊÖîÞþΦœlÎi|hTE:ßʾjA@¶5êÙ%?ŒO±è1¤ò¨ZÙÝQRè¤tÙ#¨R~äãô\êê_™¥Æ¦çJaW¥J¾ö‚!ñþ­¸R¶ˆHt ôr³¨!96úyB°õðñ÷ÕD\ËcDkGŸÊ>v:Á˜gTÛù¸«£"AãP¹²mìÃXâZ¥z-ÏŒx’.8{ú»jU\Ÿò,âi’‰²®àèÁߎS EG÷@g),<ÍÉ':z»i²Ó²¬­¤°»Ï"v[¯@O7k”–.#µg•JÎvjdÌ}™”ª·õ­âçe'`šùôÙó,ú×1%ñr?`¹ü«5àï~ã_‚_™˜À®þ€ú6áÏhåѳÚšòÁõ¸×燨¼êôl¤ ‰”ÚÍšèðÃŒO‚³þÎ!û/àŠ+ÁÌÙ—e™qT††â©,Wåò¯Ýÿ~õÇ™l†)瀈¨()+͵ES?’|ñÒÛqo”Gós . ZøCâžßŸÊúçŒ&Ö¸ÔjVUW(4%;!*ìñ3™ÿ³f:¥ÅIÓ1!Dá%BÀ-ØE™ Á¨l†n%„ `ÔަęƒU”ß be° ``æ(ë¢W*)(Œš©²00²`ô+äD@e™[jGxJc˜ˆ!D!À˜à"Q¢ü”A,Ä-ÍÆXÀ˜•Õl" Ä-ýŘ`à”) ^ôJFÍD˜T@‚ Á¨PcR´ƒ/S.ÿX3‰s€#¤BXP”cF†"o¨™lÄ‚ÊüY2j«ã½ÊD¢•­¶pZ5ôùFþ³uL&“(ç DpˆS‰–´Î ìA^¾ .—ÿsι\ƘcF`€aLBˆ#¤`i˜«  •ßà­g–<$`ŒsÎÍ3ES>E×€ªÎég°7ÐG”q¡Ïá^ l|+"ÃiáY‰µöþVÑž¿Qò:—ò²JáWzÍMضZÓªVÈôüö½Äÿl©9'X¹V*—ÿy-[&EPcĹĘ!! #ÄBœß¼>s^£€°$Ë”qIf’$›$Y–™å`éªwÜ?@õ&:3]ðÉ,BnÍ&~4ȉ0*¨Ì* Ÿ¸ ¯æ–ˆaÎ9ç‚“o×þuÿ¯*©ì+Tºlf— äïyêŶÀ–G]„u²\Ê¥\*›fÙ¯p„¸Ù4dæÝ, / 6Áã"tÚ‚™Ã‘Éç2FÀ°JT‰\!•V©D•ÈgJ1¹—¾^¼ü¶¡ ŒÍŽ*ô²TB D@…é\_ú­ŠòU›Ù¬-t¸aÑ! y×z6˜ŠjUcĈ¤ ÝÂ4ñáçËd½,¼ T¤ƒÂ«°¸67FTЄDS¯8“X”e!"ë26ÿçÿG–K¹”ï‚KµÚ̳…sb½e8â¤ÆÀ‰ý»T% Bi¡?¬Ù.vÝø~Ê==2o„:h~}kæT}øŒáþöHÚ‰Ï7n¬M÷½çºdþ–`Ð@ö‹Ÿ7ýdjþîôaþùI)šŠÕC·/ø~ßÓ ûíZ'ÈÁyœtY¼¸Wè­h·ÀŠÒùoW|}Ï*¨ýìeCUÉIYºJÍl÷ éýKš‰s`/ñP±ã°cêG}ntr·Mýfáú°Òâ­‰›xrä¨K>ûÕµå€^Ã:º8;ŽûlIî³ÖÞ@Ž]&/¨­vòÐÝýüãí'žãªÃfÏlÑÄçÉ[ק2jŸ>¼»—Ñ$Âó«_}¶+Á`Ýmúûmjèòõ4áè[?*m5vžè•óÛ³<ÎO>ðÕ¾JÛ¸¯ì¶õtF­‰[[änúrÇýb¬`ëÑuÒ[M+Û1,êï\¿ñœÉ³áŒÕcíósL’1dÝÒ_žüˆrå~ºrùŸÖ€@äÜ„6ÃmðBЕÖuú­sjîü›ÏH§©ÓÛÕñ¼Ä Žür!páÌC{òGw®a›íß½RøþåÛï2ç&›N-¬}|ÌT’zyãç%¢¦‚ÿ’Å®Œz T;n×E=<´9Q]qKŸB&”!jßg«óªôÞ´¨©óöðz;ÛZ=ë§gµç¬iÑ8‚‘’|_ 3…ïÙv(±÷òõÕ*»Dã*ê‰;|kpµüÝ®>‡vŸýyM4ªS³ö¶Y‹b €E+¤f·¶Î>NëOY=gô™ËŸÆ…ý´n峕Kjš»¬®Ügx³s§ž ç£V.o\õô‘H]Ýšês–<É-.3] Bê“«Ÿo¸`"*N5•^÷TÜkµmd½jÚ^ƒUÕÙߌkùó…Ûµ·s¸6jÜî,A§1ýÙ¼4IAŒËzè%ÿ‹°kJ1þ1Æ `7¼¢Uæ£ÿß±£F„+‚áô0lBhi7A`ÊÑráÞþ5À,˜DéåAˆ`ô{…¹r~ ŒþEÓŒJ”FÌeÆþL¡ðWw—|I^=ª!öº¦¿BjZ|³ïý:ÀC·ŽöS>"…Õ¼×kØ ÎŽGÆ»¡g4?7;+-ß‘©a:{«ŠÞ•ktkµu”<%ËZGfʉ }’/ÈFäPÙêù®'©ú,z;µ p–÷"ÕÀQN>ÕØé4º .š+;¢óó wXåm°²gïð*Àï.5á²€™ôiÏÓ83ädR­ZãÓ¤NÇŽÕk7§ù—ì€dÙ "ÀÊHñäó7“³òÙý[9¶Ã]mHœ¾È;*¹ I±±i¦<—]ÕÕFº›ô R;oÛg÷®ß>³çЭ'¥»D¹1'.44Ob ½>#ÅÑ»N­u6w ¹á¶8ýÎõ«Â‚eßÖ¸éüÁí'2 Š|§Ôwˆ›é«àvV˜ JUQ£QU¢l2!"â”|PüX ëà€çðêמADÜŒO0Îä"(¤¬˜5 eœPSß´ŒÆÊ-DD­ÂF£ôêbQ‰ÚKùŠTR"B0(¸å€^aS#Œ0pZfPFó,_^(t‰¿A³KmŒ²º!Œ ¨ÄE«xõPÛ7p 1+³ ¯Ümp,˜B}„篽™ÝR! EA%‹õÍ™3绵[Á¤¤(V©EÌ95™LPâe߬«tèVñîásió]NÕÛyÁÃX›A¦óO­ÔJ¹åØÀ5åþÕð Î(¸¸@zõÓ>8ò(V¸Ö»Û¨÷~<Ÿ‹+uêiáá“ ÐUmݹRì‘#1­‡“jÚóg½_çŽnWÜójÝBûø­’uPë®Uüfä@Tj§’,s@šêýzÐ+‡ž$˜|štÒ%݈ÈñnQ\;sW_H#ûjÝ{¹^üñl¦  nÍÚ¶ïí?—Êm«tîUñÖÞÓ©F.8z·máréð=ÐTlקú£Ã'ˆ¾#3 IDATsy`‹VÏo?ˆÉ,ZÙ;¸øTsÍ þ-D)ž¨T@%Ër*øõìkrôa´’R¦ò8ØîÖÞ»ÑÆÝ=ònÜ IæĪn÷ôÒÉé+5ªá”zñZ‘´l$h으jÕõÓ_;z1õϬªf¼=ËãV°Q‘b× (DŠ1AŒ3Œ1£aÌã à}2„‰¼´ÐÇ‚YZj3Æ™B« 4ÇLcT€§üZ¯ 2ƒ³š±Z9BØSfN…ù!L̬¥õ#FK¸Í…BA/¿2Æ¡ ©æê â¡h sCÜfJ³-’ˆ€3ÜlÑ*ÌCQÒ²‹n~d… ðT)?rnÁ¬-h6âŒò—áÌÒA¤ (m*^EáûŠµUÔ¹‚…êc37–TÛL£àªaA$À  r \$¨DŒQF)ÂH00®à¬1%„“#Ì©\lL‰("fc ‚À8``2c ñ GQYBŸ–{Ê¥\ÊåOË9€8ÑN£q'„PIB‚À$ 0!g ‚ˆ˜$sA%0YF‚ Q£ÄµÈM&Zƒ$b JD=DÄ)e\ˆ,3A$œ2aª1o¾sΩ,+lBT–‚¹LA°,Ɉ¨0HÂœòGW.åR.Z8À!&ìRyIâ¸b "Tˆ€æµ§nÛ„7ŸY,ágŒšLc"ˆ¢l’NTŽ r{›#Œ„¹å®\Ê¥\þ„ÞGRYF+$Ì ¨4:c€ò×fŒ–‘QÅ9Uø”LÈ0ŸÔA!B+ôÒË‚Áˆ!‚9“…ëÕ«g<}€ƨdH£ߟB´0j9DŠÁùš ®0¦sŒ ¼ª/¿ºbÃv­|µD}ãêÃ'éìõË`[¯f:[AftÈÕKáfaäQ¼¹f.ã7Xµ¨ ˆpNÁL_Šx¯ÊpDóbN®a´£ã—1œ1J)ÆH¡´/É[1Rxš1ÁŒRPH58/ð|)@.­‚u¸`•geP®b‚pJ™Å]ˆ0Æ9¶„=r…øWqk³’>;„pÀ'…}vŒsŒÍ•ŠûR¡Á–ö(ճNj–£oscÌý-è‘¥5”qóa§¥¾Ò}”cbås)g·a„R:k>jWÈåK+aŒRÈRÌ}1?Bcà ¤n¾ü§ùb&Ýc”qscÌCjyj¥Œ°¥ï–+1ÁÈâtå“T¦G²~…òÄ9R©UŒR™1*SAg%Nˆ˜Ì˜ ˆ•$Æ8b 13ùK)ïªL‘JUL2Éœ1‹#—rΨQT¢€@–¤’gY‚ " O47'[0Æpeç-r&Ë”£¹ãÆß}¾¬¼`Îçp%(c¬„9£œ›ÌNs$`,¾Ñ¬cŒYhaÌ[Œ¹…$AÀH’dµJxþuKoŠ8ƺ.ü;È<9“%nž£fuPpã+Jø/À†)5/½2ðß™ŒÆÊA«àX&&˜š¤¿›)SJ"¥¯øàÁV£rýw ‹ðÚ7!•Õ [Ô¤.8ì~Ú°b˜b”qι,ËcB,ô¼oRšÒ%œ­ç,‚ßA厰 zÉ+Vž$ñßè›Bgry®Ÿeî;1(—Ò³â8¶éüáÇÛ/ÿêó ŽjÅ´*+ƒ þƒß` '­lìÛÞ³àV¢sºòË=—÷²¢ƒŠpδµzlÙ>ÔY|3¤Øx:7/_#l•gÍ_LuÁ¿O‘çGÇêÎs×m?ÿëê/†8š€fŸnï¨84Õæþö둈㓫ý5¨b:wo'{M鿉¶~5*ªÑëWkÁÙÏÃÝêwu[¥*­ºbYÓj¿ã~ÑÚ·š·æ ª½½+Ú½ l†{½ž.¸œsºÃJŽ¶ñôv´-%ÐÒ·õÀMNœ‰ßßÌíOæ\#1_­[ѬP¸êˆwÜ8¶çô/Ò8LX·¤VEëß3’¶þA>jôÒ(æ@:~ôyïv^½ëƒQù•1Ûº*Ö]8¶÷ò·½[ù™»ûæðÅ/;ô´ýÎÙõŸ²ÃÜ©××'Ü°ª“¥MÄÉä¦ï‚£.íúuN%'•è8î«ÁQWöŸ]×®ª#¨‡¯ùúø¡!Mº½½7âگߵѨš-  Þºe˜¥kŸæŸ<}jÁ”Öˆßß}5Ï®c¡ÇgŽ¨Wêr\kÖgÁ¡¿ôîÚiý…àoïL¸ºÍú“mÞÔ׶̷‘x·¶íÎÅãw~«KA¶²rvÒ©_3ñ­›igwéÊí$p j»<ø·à'Ásßn®!P­ß‡û/,rÑ6ÚvíôÉñv`Uwàšó§N…ÿl^skK{´Õ»¼[óÊá£Q@ëÕdñoGƒ£®lûb¢¯ ÂÚŠÓ¾Xà, [ï©Ù $pÆÚŸÖôšwà·Q§Þëê$Vuyçî÷køØpL0Âbý·í ¿qþé=* õ§®Ü~ãRâùÙšë0x´™uäÞ¦ÊM¶Dß»tuž#€6 ñü‡/&Þ:pòÓº./šÀcëGìØñØÄ9G¶“¾Ýb»Ö“Wn>Lå‚KÕ·¿Þu1áÖ/æùØ ÄOábíê÷\ñüÅÄ{öΪ¬èL]¥éûŽœM¼{øÌšFîr¬ÖaÕå³^ÜÞ²~œ§ ":ç·¿w'Ýüeïì@kеßqôÛ¯>ü1ôÚ‰3‹ª: Žc/ÜÞ¶tß”-'" ë\D›±Ÿº»óýw‚TcÎ)qìùé×â/­ú~Û±“o;aà²ÄJBˆ<—‚†•å.0!‹]Yø«§©”r°JPpX,qÙEh`‹-R,&+ÇfU'zÖûpÃФ-3G´ÿýåÌÒ´*‚¬ÍoÒêÝënoõï€@h2vDÔ–¹}öÿêçûz‚³OŸ¾_õí7´ëôßî$ùmt“+æ ‚R¢áÆœq}ÚL?½û»¾Õš½7iwCi‡Æ÷°&)¯`'ŠÛM˜R-åиæ}¯>mÑÜ;;ÖŽlÜ}þ†§ã>ìi/¥ÿôÁø®½v_;¶m@`“þcÏéLW>ìÖbâÕHªl‚9vé³jaæÎEÃÚÏ65ß¾±BÄÆ×îÉÚ÷÷\îÒ©ƒk);néÁª9jŒNde9 ­|ŒVcûèAãÆn©úö芮+N>¶{Dï*¯ÒÚ Þ­ñà‹=É&bÅ!³†Ü[9uH§é†½ÚVqÝ·´o«Sô7Þ©Ú¤}§¯³Ô6~Û÷þŠ)ÃÚMÙbî&6­Ö~´ü«h= 5'ÎaÁ+5ìóÙ–ËÙ „U5ÆHù@”ؕΣUûËóFõ¬7æàÃ|)ô‡Žm¸dÀDI‘ öíçNj»nЀ]Ý{N ôGÁ {õï×ä=ÒzT³zîIçWõ¬7=<ñÚ”Ê Z6[‘HàYgWÏÔ ÷ŠƒlõÖ^æ• ©÷hôìûѲZ¥V YWª˜üÛèªmg.="c¢ÖjT*µZ£QëtB ß"êZ£&O«±¨C¯ÖÇÍ>8ßW'x¿õa7Ýáñ »½;óçd*  •}¥1skßÿf¦ bϦWŠÛ3¼~÷EkN3¬R©E•Ze)SPiÔM:º`Bÿzý6?¬±lU;-`ŸIŸÔËÞ9¢vç÷æîO4pà¸îÛ“Rw/îS»ë꯯æJÆÌï¦ ±4TÔa•ZL8¹c`å.?\‹XÖ¾EÛ Ï@-ßÿ¢µoûŸ¯é-gÑÈ®ó’ ÝÑÊÇ Y–ÂÓîŸÛ£ßàN‹œ»¨WÅ)öäÊÞM¼È¹1Þ¯nëv_d! ñ'5_±?[­Ñ¨T°U›eŸvÈÝ=©ÍÛ‡T£fÎi¥µ]^ø±¡A½Ï©:µlî%ˆ¢J-ªT*#Œ‰¨Vé*ÍZ3.ÿûYÃ[ŽÚrü…FgUwÂÔw½Î¿ßzø·Ok¬ú¢·-A‚ÖV£Ó²÷šØNý‡iU¹;:4›þÙÁÐ…}[zuýñ·' å|7µ÷ïŠ:•J° Tï5x€÷ã‰mG^IævÚÒ½M«Ô¢(`P£R‹¸ääÁD0$Š"Q0£4*•Z$–Ç$ªU¢JTªT¢J­„&1Â!*)¬÷˜¨5*Q-ªÔ‚bŠj•J£2kLÔ*AP©DÁ *‘¢¨Vb9 q¨R¹BÊ™•ûæpH|[ª!;ÞØtÊ´¡®:kO]ìC7Ñ/2ztïÛ‹\¹~êB¾ØŸ–oÓëág¯^:÷G-[›ÀšVÇ—Ÿ‰KÈ‚„TÀZɺZ«÷'uN.>QÎ"Ï4½fƒ€ì«7öMÙyòNÊ zùbr#_OÉ4Ä<½™–G­3L6N*”,aŸ‘ïMíZ Òn¯Y°ýEö°lT§†Ã‚… TÞU+4÷nÝ—ANÞ;}õªpªÛ´…ñÌÂóWìÔ¢‘_¦nZ»øW°ó³>þ¸Avo\ÛíÁ{O„åsH~iÖ¢ž•š¸§oþ$‰°Ì¨XŸ>=úäØÝq)Ù„Æ\›µm‘¶ï½ c¶èÀâsq/Òù‹$,ª§T¢f4A²Ñ˜›b¬0bBw[•ƒT·&gsÂB5C; 7‚OÞÈdX¥sï¾&û‹ÇÎä8Qs*ÉÌŒ’Ä$'¢ ÌkŒ‰’õõÒš°XÀuÞéýìø°ë÷bd€°JEÁeð‚~®¶joÝm-“Ò͆çT’‘H¨$1¸¬Ä¤h\[5P]šyäiXnìÆ3íf6¶W?âÆüˆ›÷õ†ìÈG¹•ìNf²%ÿqF©UEߊ¦»3wÜÊ’ðM翽42õùWïÍ©Û¡C÷‘³ú5ß>fÖÁ?äEÄ3©Pì‚Oó>ÚóO&MK´oýå¶Ö›¯,C +8 L–”(.„})š&ݹኆKùɹoªþŠe¦b<ÚÿýŠOš ? nˆ¾v ^J„Æ-ëÜÝùm’€DmâíßV¾½6A_dŸP¸‡D$L¯/HæÛ°³)äF¬ÙwÆÿ›¹ä^‹öC†|4¬ÇêqÓn¼(*Tè5¥dÒR`•–Pƒ¡ éܪþŒ £®¾ÿÞÊk ½m$ܬ”= À à9ï­•™>ƒî TsýA©!‘©FŒ¹¹[ÏعEÑÕ«¸gïv~VÏÐ&1>  gWz…Dø8;)TuòvǶËç5U „=[¶±Ú6~öéwǤ„Т©žôÛ²·Þý5ÏÉ£®‹¹ƒ””œ !ëØã+N}¿'¤×&‘>ÞÁ¡a¾ØÕŸ¥\NÊSü›5ïàgžãZy9xºÔ{[™{ìêtWçàðn÷v×NÚì:”ãץɨñ÷ßßÖg¬8åjŽGì]½b¬VkT›ÆžP~ñJI×ñ=ÃcïìêtqF‰ ÈD¤¹Q×SzRJó^íBý}Zwjâ¬âjaV³áœ çìUõx*L¢Œjl&Á¸@ˆq\I!çBÚKÎx½1nØOÕQ\ëØC!ŒêÕ•¤Ã•Ãlœ-éè³ušõéÂí󟾧©Š qâxzØÛëW¾5³¥äÜgoŸ¹`é×ß>ê”m5üðûë–.Zÿªíàæ„ô âìÕãÑçÿ´êç»þ¼d_9à¦c&/Ü÷ÃScZLxïë?‹õªëÓ ¿nâ…¶½ÿë«Ÿyàv|×üo+ÚMüú§åï¼5ÆÏ•$ý¥¸õøÅ;ß?°Tš^=‘´ùtyÛ÷wüøõGˆ× ¯~¿îýN݇~y`ýÛoÝmE©k^û¦Ñãï-ÜöiDچݿ¦üQL|îZ¶ê»å/·è<æ«?¼òÜH”î]¾Çí¹oox³C#¯’ă+7§Oœ÷Í¢Íóž| “ B<;MÛÔ÷Z§ið˜éN‰{’³íPZqË¿ØÙqÆßì\òòsƒ|]ÈÜãó–Û¦þ¸vÙÒ»ÝÊÎlùÆ…ï±hÛW“‡)ù œÒÖ¶ýè¹Âªjƒºßûæª%ßm{ß÷ìÇÏJ­ð·CùS/z}æ@÷J­ž@Ãí¦Î\q`õÝCºÌ\±bÁ/G:k™k__zÐúÒšåßoý°Gko™½wívþü«¾ž;Ê9½€KRÚ²O/Z–;eÝ«Ö<ê!õ#[vÿÚ÷Û¾ÔÌOçRHðîyÏ §M?Ì°i`$Ót@ Î4 )…,ûu鱟-œ3çn¯²J3ʽòêÜg7õûbÅÊU÷{ÉŠ£ßÏ_ž×îÍMk¯ÿpT÷ ȹq÷‹¿_ú˼aÚª¥+/Ûtu×Õg÷djBpƸ”ÚÖ¹‹åS¾Ù·föÛc<¨Ð—•—¿{÷àÈù+–~7Òl[¾¯ÑûË¿ßüa{g¬IÜ[|yŲå{æõÊ[¼nóU!QdÿÞ_¿|ÉΕ#?ž¹\¨úµ~{ïÖ¯žkÑü®7WœX:,œHÁÍäKœº½òÞ‡WŽÜûíM?Ì]ö|˜‹È\ñâú a¯ÿ¸rѺ·:7õÔS·n;ê6kÝŠ?jÉ*ÒuÆ…dÙÇç..zróƵktÐbüÔeG·L»§í”O¬<0'Ö³dÛkï_Š}jî/ßLnt`á¿~*Ñ™±ß93®å‚i“´áà‘£Ç´¤B—Ù2Î~1{{ì+Ÿ-Þóýsµ· Û‘ï¾Ùæ}ßœ_–>Ý·øƒ§Wås»Q‚àŒI!tƒ¡BJn¦HÕ¯õ[{·Í}±m“á¯/?ºxp0œß¾n/é>oçâ¡m8c˜75¸î ¹Òî@H¦ëLÖ,B0 „¤Îtã‹€A ]Ó„\Ó˜¡°›MA@2]²ždšMçœk:ãR2¦3.¸®ë\H]Ó…”’3ãÿöpq„‘„ßË ¹Uê‹«úS9!Ò9fÚº×/N}pÛ%ÛnƒTï›÷ºòÅôoŽ”ÿ¡.hRb^iû[ÈRŸÿz5|õËŸí)þ{ƒÅ\›>ýÃÌã=¼ûJå­eù·žP‹»+-/ÕBïzò£AçÇOÜjØlòô‚ѬÀÈ ùž¸»©~ÿYý¢·¦öŸ^I"oãÓ/¤ÅWþ™|0$Jö¼ûV^|Ù«„1ÀÐÿú–úäÃí‰ÅwâÙk§ÏLO¨¼•ðñOH kôèçîðDÔE_ôѯå-Žö½ÿ¸¹ø³°JºUn´Ø ÎüÙtXV–r±ìÏçÔ Ž1!T×µëÃ;f×gs4U&_N¹âo­·$ü™ ãÊüøóùÿ­D&uànj ¤#’ô_Ñ–7÷…™†ÝMˆj;Z  v¬jÛ¿VÄþusXþ”´#^`¸‰lÜ[åß_mÓˆL 0ŒìfmT76¥Æ¯¡#`:“7,~¤IÕ‡¸ÝëdøŒªä©4aãäM,#i,«}~ÿ¼VnÜŸð{£„ÀÃŽc‚˜ŒëµN~ç£0¦#Y×…zƒCZOóD X¤z,º!y‹¡ ÎëEÓùû§ c‡uxs %È5hð oÍYûÅ}cb%Ó p$!þc4_Üå©…_ÏY9³©™G‹cÆÏÖ/ô¦„7ñm1eÞü/×¼Û£…áíÅ>C_~ôÁ¦ €Übø„Ö.xû“G#]ÿC}4I€P‚1Áur§<:ŒžóIW{çü:˜ÒáO­åƒk¹JªéýQ…^‡÷^ŸÑŸ|4oË¢§&v3#nú€ Åè¯LÏ"¾Í§|=ÞÆõký]D(Åýâ‡YœsYGÁ0ðâ¯S\› žµlÁÜÕÓ#ÍxpÜ{êôö×ÍþFŽÜ¬Pº`Jn`¤àõxÏÿ9èˆxsðmÛePLò;“f,Yu\cÂÀ3#„ü‡(€–VÏMo|yÁ+}|±Ì4bTd$äæÝT2*ixÏ=#ØòW|ãÀù£-;1-­T g×-~îÁ%Nͺ*èÏo Öƒæ­x<ðšz³qoLÔ ýžæ£4}iþ¬7ò{Š!Æabü—¨ –TUA¬8;>¡„¨Š¢ª_ÿƒfNmð€7_{}TmôŒUUTÅȶ¥”¨^¡Ó~Ò1Ê“PJ¡ªB)–S‹WtŽ\ IDATEQUÅ¢Ú—*Â2õ´gÞš}Àî`L¹è!%QU-ŠBªF@ω«7=áO®%>0UTUU)Á«.ï7RÝðÚÄW~9ž†©¢X,F³[œT•*ªJ& %SE±g=Õ\+Š¢Xª›A,ª*Šª"„UT‹jd)˜:,&fp ƒ¶ÝË&ë‘Uv%«ª¢*Šªlêæ€0U<{¼ÿrù–ŸŸôÕU3 ¦¥U航Ù?¡V¯1qfì01Ò0bŒ‹1”cgÏôÀHQs1¬(f1VT…ªªªRDQêÉM¶7†˜éŠêdQŒvÖÿ¤…`€ŒE¢Z, DTÕ¡ÙFb‰jg覊EU, ²›+ªªZT@noÛöòÙd„H`Ÿ‘ƒ[(A]õê×Nͺ˜VH£z<²W«Fžy—“ *iÃñÖ¥Q ö ²èÙ)©…ªODï{F÷é×Ѧ§p‰²ƒ‹[lÿ~ƒ:ú•Æ'dCpÇžƒÇöoÛ"°är|†Þ¿±µaß]b­Ùq %:¢‘]ú Ý·MlXeVZ^±æÓ{Üðî=Û¸ëy©õc¨Á­Ü3¤{ÏÖ~J~ÊÕ"®Xo5²ß N1>zÊ•lM:·¼w|»F!]õ‰ô´¥&esÅÚcÊCCµó×+]Âý2Ç•:‡ºwt›(œyùbzV€jm?zì€^Í\|šÞÖ\»r1¿¶-¹txxʈA·… Ž‚CËS’s*”NCÇõjëQ˜w%±ÄlªSdÿ1O¬Þ‘c¸(±KþƒèÑ2Ú-÷rr©nn8'gj„¶^Gšt;Žüºåç³9€,¡]û Ó7¶™_ñå+…8°ÿƒ£{öîܸ¡_`t#oHMN)•ÄsG¿!£û¶nT’žVPj:9"zNhŽOmÙsQ`§ðN=‡ÜÓ¿]ÛF–¬ä”\[p÷þÃòãÒtÖsÜ0kâ¹,j›Q#"#ÂûŒØ,Ô)%!ݧÝèу¢eIÒ‰£i6Æ¥êrûè‘u‰ ¡IçSÁÖ}ÔˆþCº5kdÍ»rµŒX{Ý7fààî-šùû…7vÉŒ¿\ìÞª×ð»ÜÞ§ŸRœv5Ÿ #[ÛO虼qÝoåºôêÐkTkìÒvÐÀ¡|J.¶éÃ.§–âàŽï ¿r:ÝÆ¥gDÛ¶‘•{ö]Â8ÄÅ·ë˜Ñ†vu¯LMÈÔûD·°™|û½t@)g®æ‘†ý†ݧu#ÏÜø¤Mmòà£Ýc¬±ýû´ŠrJ»”RÎ$uóiÕ§ÿà=›5òÎON+,Ñ­MÚ›8²ãm Q^Zv±& VB`ŒKŒ±Ò»iסãß~GKµ,#=³”¸…ô~`lŸþ|pQÚÕ|A=»ŒÚ°Y³žƒn·Ê‚ä”|ç°&C'O0°—Vîã™x8Îæ;é©1‘Þåñ§.”q\"zOÝ£SñŒm\xõj1ŠìU”b®3nò+Œé BR…r]ãQŒ…ˆJVÖœ—÷Øp;Qì¬ë!d`©rMç\H@„bÉdUR°«Æ-˜ªª‘DT*¸À”gÌ|ïˆ}€!H2Æ °VB°Ð5]•HΫ2~)’F’1]…J£N!ŒÐTƒK‹iº@#Q%±_ϼúLPÞÉŸŠ×-jÈð'>œÑ2ëäÉâÆ÷xµKÑéã¹þýf9Ü‹åýº~ó¾ƒÉWŽÜ°ô‡£§ó€o»ñOOë•sòHbõ°Ú¿Ø}BÇó{3 –ȶSg ª8vðØ…Â@/ ¼cÀØ.^X‚SLïÑc[»*§vSž}ldôÉ7Å%J¹gÞèyß½MÌÈ`ê2púó“{8?xB÷‹TÀ90(ÈRtb÷­Ù°ÏÞìà"ÊOíعsWRò™#¾[½÷p&âß©­H9wäpZ»éo¼Ýßn…öë÷â]ÉÛ·Ú$òn×ãñÏÿÕ†Äÿ²íŒî¤úµëz×a%´Óý“osrÈô ”HÁ,_ž34þõbôØiwöŒ” š>5\KüõàE¬ºb:„8yÇÄFê[ŽdŒ1QCGOyô©1eÇ÷ì9"§FO~òÄHÿ ‡Ï¨ý_|hR{ Ø.løñàÉä‚Ã[×/Ýz)­Xqž8ë1kÞùó©dâ“Ã}FM}óY¿ì;~ŠgNNcŸþ`F«´c'Ëš?0ó~®ÄÒô'†Œ:¶ñ õîçt €&ƒ§LÐò⾃™Ü3ÐÓÙØøÑY÷[Ž^Ìõzòƒ‡ÂTƒoB‹…ÀÁ}ÞZòrPùå#Çr}›6²`KÇ7ækN/ðÆ[½Úûrë9}Jk5å—Ý)ëïJ+²®îYµù|¾íì–u–,àÀ .mZ¶šôŽ vášÎ…S‡W>œØÓ’˜åõÄ‚zw Ç0Á¦UN ]˜P…Òº&4{>£½OÔ}ªÚOz#v9$BpͦK)¹Î$ŠªT3T‹9ãUjܵít¥„`)Pµò™Î ªØu;xäØIœ~źM'K%$YžÑôòê…ºÈÙ}€>7(ÂcÛ™Ìôœœ"­¸0+-‹Kp >ð6²çýl' iÙÐ¥‰ÿþ¸"ik/9T à ²ô¾]ñþÃégÏÞ\ àè.–ˆ‡F…üöìS{~­8&ú¾>è·M[eiщ]{R/çŸ8ý@@ 7œ-.ÎÊ.®ä¶üììôBãòZ]PjŸ?Õ§×A»žbç1q¥Éð·Z™ò#´]û@WÐs/ž9_(@”fg–V²Âì¬ô\c±–æçä3p¿Æü:…ŒÝøÊú/Š/Þu çÃ}CÜ÷ÆK­¸ %±–q»¶è þ¬çÕí •@Ünek– àĉòñcšù¬;˜•_XQ®d§eJ@–“F^Xû̶Ÿâ­šSï^÷we;_:Y€¨ªª¢(»°2óê3YEŽl¡œ1Æ9“e©k¯?}1U×QÉssòʪµoïàö-ćӖžN/f»"n²úº¤ÏôŸÞÃSJK+§™ÅåQEÙ©†‰!qå2µY˜§kîÅ3Zx£¼+yu5ÊmÛSû²ìûËäåK–(8ÙâÔ¸%2âí–> L˜–l$9—`íðÀ8ßßf&ēΦµjÑxÕÏ9'žWPVž¼çjz…Ž(Æ\’ÈaSä…u©ù €@™_VíÚw®M?˜ÿÎbc—·íkÓ»“§åH^VVAq+ÌÉJËÑuв_c×ü5Y:‡ôl§îƒ’¹§8Î>µbýÆcåXI²<þZ‹K«çé¬dïËÓƒ"<K)ã~Þt).UÙ^Ô'*„@Q›Á­·|9}÷ÞØ{Œª4¢û¸`-uO²&çXÇ÷‰À ΛÙØ„;§1ÇûŸž3sáÏ%ŒRºÅŽîþÓŇÏUÈèÛïˆm²ãl²–÷Ëî㉹^©%=‚ÝÕô¬ÊüÌìR]²ìÌÌôJXyfjFq…‘¢‹{Ì=CܶŽúú狸¸çƒÃ0¡&ÛP•ŽIR¥ÑÎc€YW=¾T×bò¥:üJ b:^„”€$Øâ¤`(Ÿ¨åg@R.%!9zQAÊÊ¥”™¬ a$$H)ŒïpÁMîÖš6qG×nù•Dc½"ÕÅÛ…c//.DêÒ·O¤• p`)Æk„;ÕTO«Õ R­”'œ˜¿ÐïŽaw ˆðO_õñ§«¯ÔZÞBÁ9+.*È/faBè/Lþ¢:«¢$§Ü†!À¹€†}G=9&êà®Sež.Ø¢)¤¨™T®Œùò³–);;“éæJ &R²ø º·å‘Ù/§i€H¬<.®Ân›F€’œqjÚ˜ªõñ öU*ˆ›ÕC²²Äƒ›Ï^¾uîÊþºŒ8Až^7û“mšà{ßÃÁ{&ì+×9HHHà%©ÌH«rµú[l©«_Ä­ùæR‰.¥¹Á«ºÀž! Åž>Þ*‡/OM×…^z9¡R€N<|\i òò §®˜}4£B6VYdC3Ôröpç™…%vmFX|C®ôòóÑ9ì™»ør&³k:\b ªû„y”%$–1n8Ò…‹7)Î/Р„’Ò Ü]—B%¹Yàè‹ )JÓ/±²kõÆR†)» "ÞáznvI¹ RÏçzöhåŽ.äsŽ 4+Ëæàïåž¡Á¥¹Å¼f°‹ÎtÆä_‚›#†õ1·âœ,Í;ÒŸ²tÖ&Ÿ# ·ZbUoœ›Uq£³L8(C¼vÒ7cÌ>›’ñêØ&Á«“ï ;f_`ªCvŒUq+ÕÌ^ àæ·8ã€@2‡ô~"A2ÎLPBT«’ÒD±’qy­x@–·iÁöØ™oNo}¦yвSß}¸¡¨Öf-<¼vs¿3Ÿk~)×ÛßùðÂï_©¥%éG6ïìöÚ#3Â.äÚœýsæÏXU÷Kq_¼wçw?ñbë"†®ìÞ¶û×}[öº÷•g®${ûÓ_þµàdvmÐݼ=›¾úÒ´÷Ÿ¾”V©Š++>ùiÕ§¿¼ðøËvÍiÐz}Wé ÄçxD4ít{ËÆ-¼¢ƒûƒ¨_Wÿ´mÕá·_|ëñN‰Þm¬âÆÀ¦UÏ΃ºFµ÷ö÷ºcÈŸã?lI(T~ñ·‹næ?ÒòÔŽÕ«ÖÎÙöâô7žìWA½dî‘sw–=tÂûÏx?Ñù«õ kì2´‡ÇüY»Ì˧¨Ø¿fÇí¯Ïx¶á¹îêízuѬ¹ òÏ>Ö,„$ÛyäDÞ¹¯¿êóÂ}û´/·mÓS¹ïh¹ÿûU]q‰j1êîÞJY‰g“&Ç·,¬žºûXñçÝzXípÚqÑÙÇ=:Œ½³iûfÄ7xèƒúùÝ{Ž'dlÛ˜ðÀìo;—-¥ëßY|åì¥^ƒ‡ŽH êØáTã½²¤ÃNSÝû¸K≻»¸yïÿȽÁ9n]ÛXr®ÔªÇñÛ6Ô 7C‘”‚³ô#ç î7ááPÒ¦)Ào†8-L;ok0qÒt÷‹7í9xæ«÷Nzá¥À3iÎ>îqëWo;˜Öïé§bH´FÈ+g‹4N­ Çö±,xqOE}; @Eâ—/m˜ñì›O½,\­ù§·¯YyX“5ÂãJwÈ9ýg3u_¾æ…Ïâk&4"=÷‡9›^{yö3ΖOR|rñ'{êìaíà÷žxø1k«KÌ"}»:îüî“0íùw¦]Í¿Ûò_$ØÔ°i›¾Ižõè¢uqâê’9{:?3ý½ä(K:¸~ù±o>9üÐs3}.ëMZ䯜ys­Õé# j×±SëÈVCJun¿ÿǃóÿuøÙY¯YŽç5ˆdçd­€6TßÏèáƒõ éïý|³O^ëWµÚ†j‡.Jt#uVå{D5EY éU)–Ô#$,À×ôòüôÔôÌ`ñò rÕ“ÓŠŒîŠV”“x)ƒ[ÜB¢ÃÝUYRds÷Ð.ŸNÕ$ ¢ÆD[=Ôò설äj ‰Š°b½´°#-+½8ä¥ÅÓ~~áÙÃWʪV§Å?´KA\’}ñ`‹L?7(Ê×=ÜJ/Íd€߈È@_—’Œ+WSK:EGXÝ-¼²$=1µ¨L·FDúº"aËNJÎ.¨ˆì3~zöüŒ#‰Ü¶ð(¸˜žkG‹@Š_T”ŸÕ±Šìä”Ü‚ È584e]É6ŸQ=|â‚œ¨,ÊM¾œ¡Kp ‹ ä©ŽûÅ+<"ÈÏ-?=53«Ü³Y3Kú…ŒBæìí²2²J¨¾áá¾®¬¼ðj|J¹&¼ýÂ"ƒ,˜Wæ\MÈÒ%RCZDÛRs Ìš-Ö ðp_ yÉI™9e ¸…5ŠðpÁ%)©i…\*A1ÁEW¯–3T’šZ¦ ê×¼±L¾[*{hxD—1Î\+M:{¥\C›Dz*Ü}ìç}3žyç³Ó8…ñàŠû[9¯‡Œ`À(èº.Ü:Á˜b°(ÀK±DvÑY9ŸLú=wÙ‡O|u ¤ÞÇþ¶Lߦƒ!áô…¬?S‰Ô©]Tñzæiš†1–6Ð…RZ/[fÕ_¡„`Át!äM±ebJ%gÂBÉ°Ÿc¿öÝÚj¿í7²[Ø(ïJ¡ß}ï?¸wâØ g˯՘ßC7%ÿ,Ä"hëO Êzøý¬8…R&„´¯}„ÆØ.+ÿ«2áXqn¡sç–±ììçoï:XòolIî…C¹º=ãðáŒ?5G&‰¨”‚3ŠëË;“×»ª „1fl‡ЪP¤ëLäݳˆ¢*ˆs“¤Û.Së[é†NQ(ÓõêàjŒªY€ëd‰!ÉYê‰}i’׌ԨvÒyx× Ò°ŸûÈquØD5j©ù°™gßmµùçÛiú%¥²‹1nXª“Œêÿ~U/Š… M¯6Î96Æq©ç§Ê€ØØPÛÖÇÙkˆ?‡†!BLçŽtÜ”Ó4ìøõ:çW!­óuB)#аÎÖ»ò$‚*wéð‡À³L(A’W£R×þ&›<÷Õ•ÐëêÿS°#7|ÆüGž¿mQ<üE!jï ¢(\×%"KÆRx•œñkŸ¿›„¨e—`æ«!®k1B†¯³€FÀ™À”b,ABUº(ÂÈQ| ŒÁA–!„…a0ÇX¥DH)…àAœqÀ ½vº&&Fæ†dŒ ‰©‚1HÎëq:"L(AgBª`–3Î%U©iÛgUARÓ"† cBHŒ)!B7iª(X ÃpÏ%¢ÔHl@R×uDFHbb*Œ˜Dˆäœq¢ 5ndœ L‰ q®éaB0ÂÈèÂØ_àBHL(&HJQ+ð^°ì3矒6©iL°ÝÑ`ø[%&¨÷šR$™©ÕS\×% EU0sHäÈ(Ô¬£†·cD#Œ2~6h¤1Š‚¹ÎVU¤kÜœ&)A ÆÆ„©kÌ.œ)²Ï"Äm£1„`˜«‹Ts~±}͘ƒ/3†7Z™ìÀŽÌ·ÊfqdHv\¾AÕÌ"„¥Lgœ_?ß ¾2c²êüZ ¦sIl„€H! *¥à\ Î3Tœë:Çö@\쀛ŒŒD0^…ª`p„Tí+à:ã\T[%0®ÓD)‘œ .1¥!B€ëõXK¢PB01AàBJ΄PŠ¥àL¦D6B c:“€ˆ‘l Ì¡à‚K°3'!$gº ” Œ)FB×¹”a ‚3.EõQ#¤`:C&['2:ÈŒ F‚ !Qˆåf„¼˜ÌÒ¾`ÄÃ1Æë@7ÃÇ„ „ Á´=VHÉ™0ª©B§Œk(U°ÐuÆ%%!ŒP / L BŒiœ1.Œ0ƒ‰LbŒÍ)“€§MÄgs™Î ߮ܢ0—LÓÍ•`+ƒ”Œ !„ýZ …92¸ê(FHHÃ8‚`\D(¡»÷îÕlY!]Gð-épÖ)AVÙÁФRÌ% É aŒ9çŒcÉ ¬ƒR"F4/æ~2-Ã5í€È LJQÜ!fX´0#Rp €tU™¸nÖ ŒaRH` ™ ¿ZÍ=«ƒQ¹@3ÝÞ„YU•éI!@'Æ0 ŒŒîÒ¹ƒR)¥M3#tkÝÅ$ Võ¤@HC$’`‚3^°™FM£Gæ‹Fã«û…˜ý·À0’RHà !5 I!@Ãæx ¬!0Ÿ4ć³f„tÍì!BX×ì7;iFK)5dÖÂ8’U*­f hYS–öÉ]GRJ¤;\]¥„uMVºffÌÙëG:FRJ]G•¼ÒÁs$g\Ö¼µÚ "`XŒ!B)HÎêe¨¸Ø BÈ¡/ ‚›HѵLÀ˜$…¨Fñ'”]3vcæ$ãèðøø[BíºTÝØßùöÿ §ìÿGkÿ£Ç¹¾úŸw4T Q›:Ä$ÕCÒ!¯Q Τ¤ FH)‰Iõô;N !„Xd)L T'áU…ÅQÓF²iª‘L3c±9` B«ôù["àV¹Un•¿¢À %g\$!¡¶ ;Ø\`;‰> IDAT:Eq©`\ؼ·jsÁÆý×0D¥R Á¥à’"«œR ”ι4pí9uƒaï@¦ùaJ”tKÞ*·Ê­òçËa€,êa©?;ôÖ¿¥`Œ¯cJ½gÏþtÖ–Í¿³ð?©˜ VUTC<à?põ• n¤0¼5³I1m‹é“ÿ)%€z]‹–Wò«“‹k}I)cÝÞ⊻ Uÿïˆþû‹&æ6åÖtÞ*ÿÛåWÜÿªª‚ÄXsÐjoÉ­rKþ]×Æ¿i;êep룠Š‚-..æs[¥ äQ IÆDduª¨ÄdºÉz#€ê#ÙA”RŒ L—ºv˜ë¥µ!L fœ×½&bBŒ89#à«Îk”RÌm6þ']Ý\Œzÿ½ÞÞÿa¾¦ùŠã“ù¦B¿“ásKþ©-§ý…„J”Rê`ËG€„·$àŸ(˜PŒ ’HTøWJ®Ù̸|Œ‰e 8“&2¹œ‹ñ€„b^©.@ˆ¨ D7Æ€(¾9&U©4ñÞ&aLŒOÔÜ—œsÎ9ƘR\GJÁ˜ ÿ†Ë½¼®üª+³~WP^K¤¢›‘_@Xÿ»÷þË% ”ò/”€ŽJ¥éí&„ ®3(¡p‹½ómaNWpGB˪t}jq¢Rr]ã„ ®3#ëŠ n j#ª%8P‹‚9×™„°”:g˜P‚‘Œ„й Š‚™FÁ™™‡%¸Àv¸úµ„%ÿØÐÔ¢I–Z“Çü]WÌ¡ß“ÎòïiØ- ø÷!ÁŒÿ"„¸àc·$à5‹ªÖΊ32Jè}i@¯¸¦ëÌÈ@öƒ¨ê‘k:¸® „1!ª‚9Œ$ºªífgŸ¸as 6lÿ9šVyóÂëúÂñ/¿É¢›lÞÍöý¿u;ýÇ_ &B )%!Ä8»uþ#‰†ìs€Å¯sÖ¢QÚ‘\nˆ ÄDjsêJY;Pä“×Çb ’‹êGþ4ÏíëH‡k yÝ«±ü=Q%oR¢É¨³ÞOHøŸŽ„rÄÚ¨±·«[T«(\gL¨{ÃÍ­Õ+,"·®˜ñjÔ󫶧oRë—È«çô#G¶þ Á6!‚ cÌ)¸Õ Ÿ=a4«®sSñjô¼Y‘Öj7¦÷˜÷7ÿ°þä¢ö¾n÷¨žÚDÛG Eyták]·£Ö°H_7õ¯<¨Õ¨'~ø~Õ©Oß^;$•úD¿0ÿµ†îÔAÞFmóâË&¦ÌRH“W¡¶8ª!9—ÆM–sŽúu—!Š¢PŠ¸¦ !…D^XöØ}-@J)8V#µ|Zõz÷ãI*rP:¨¢Ôm˜`@€)%"~QQ~îC¾"5ä…e5 ² Jÿ*þt5XÇþw|aÞ„ ÐuàŽk%ˆÉ’ªè2éјoV¾£ú0–ÿ% TBÇ~ðlÓ&_úpˆOŒ<[ÌüñÓ;BøvxðÑ)}œë\  /íš5öõsÅú?ß J)+HZ6çÇ2D tÆ'CòòÏ«fÜýAҟΣľíg-y®å¦–ízÿ£½šü•'–8gÔäïמ¸4NÆêѱcUÈTun³52ØçŒ1ÆL…AQïþ1ˆ2˜Î¸€*ˆÜÄ `L70]L%³v{˜®×ÛN¦éL×9@]NÖ%ص ÀFJÉlÓ™JêUË5Yã¯U?K–¼sF­·ªŸ‘×¼ð¢úþÀ <€®ÝÎz¾‘êJÃkÕó_.I`Û¦øLO„åèÁ ý†ºì;øó£ûö§ïzæþ–zßp óåʽI¿¼<©£ý_"]µípÉ¥ýg÷‹¨Ç I[>ûé·Oú*ÈiøïϺ3L høÔÒõÇK.í:ùMÿ–¾†J×váî9ŸNùòؾݗ×èàa¹ý½©‡V,{ÈJFXÜú‰ÖÄýº?sÏ«ÓzÚòˆ~xɆ=WvL{µW×çoN9¾ù§w:`—ÆϬߺ;óÄú­ï¶ó«G©é3só‰øuþ:éÔCÏyƒàÑú…m»÷œþvPïçþ¶æ¡¥ßMŽrØwEæѧ˜¶aãÄ­÷¨£Í5›ùãœvæç”–}·õÉ¿A~·3ëè_jìÎÝæ¯}·?p¶xöÛ}œëÔlôÓ?^9ºrÉÔhÏkjDjƒá_:²ûÐG·T&}·nÁù×<ÓЫž·œCcߘÿ¼¿+&þ­Þ[ùNC€z÷ã«ÝÅq6=ÒÞ€Z}¸ä—¼ ;v½ÛΟ ¸ã“cGœYÐ'üšŽZâûÊ#6Mì Ôã¾?{´‹H§FoÇÕ©v÷B‡lÈ?:mòÀWÝ,m˘~aÿ‘Ÿ,ý-÷ÈëOt§YZŒŸ±13nß…Õc;^ãÈQîÿæ‡}ç7¬›ÑȲNÚ¶ëóÕ‹öÆ}ýñÝ>NXiÿà+¿dŸ_³ã«%^%@Âz|üØî#ó†÷5F±ãìy?~ùÌ¢óÇœú¼“?Pƒ[¹é`á¹å‹‹t7ˆÐËà[埔€­ïšú¯UÓ¢,Mg¼>R6š0ù‰>nu/ ¶¸sÈc‡öèF$ ýÒ„co<2´Û ®ý'tjì]wI·wï`´qRI'Ê„ €Âî}v˜ûãbºŒ›øeBI=ê‹[™¡6 q¡î¾ CÈæÓù ïùâÕ :>þúчßíÁ@Ãõ rûbè:>¾ïJ…mÿó½ÚNÜu®’ q†1)<·ýåAC‡´›’ÝüÞníýÀ%Ü#ñ«çîù^ðè{Ûz×ÙÛÈ©ýÔºm|²ËÀgæ–Nš39ÈB"žx?:ñ«q-úL}q­I|[³¤ýôΠ6O'äšÙºkç $`ëm ½0qÆüŒ§?èë†(8ÿÍä{†ÇŽ™ŸÞê3ÔÌãÛ¿ûù¶O†é5ðÛuÉu´¹¤¸t¿POט֡þΚˆ“‡ƒÇ>ô`ÀÿkÀûóFxdÂa¸Uõ¡5ï6ãÆF~>jÄ+sã]Ã]kÌzuï±_÷ÀEcïš¹ÚiÆüI~.>Ã-Š>ýÙ˜æý>Üu÷Ôθ³C5D$FgÛÞwÏyªy—áýŸÿ-ÃصÛËoÞ%WOŠíõÌ"ùð¿ôs}tý'9sŸ3~…ÿA×0 Ïf¾§¦›ððò¾/Oij);ô[rŸû;º"äsû ö™+÷_¬¬}T¤njmÿɼ­¯w¼½]È«v¤€Kˆ_þó¯^}CÜ”à®Cî/wí6þáUƒ?~º•G=Ã4dÞü&¾Û¼ï;?GŒŸ>È…"ÅMMÙþUÿ;ÎøôŽmæëÖiì`ß—{öyû›Ëî!®€€§ìžÐö¶§æeˆ*a¤x4Ô^ëÒcÚú€IÏt²PßQ+—ûì{oD³þ Ï5;©‡zKüý¿,¦vzã²½CZ]üîmи¸_M+ÕE=šDQTU(*A°wëF®)óœÏÏÇ'Îiêµ'® æÚR£Yµ4>)-wëé§b@_¼¨Å œð¸<°eóžüúnlzêù‹¬iLð•ä†ÖÊ« ¹åœ¸ø·ôج抳wpðE_Jˆ„[âÒJ8”8î Š –€gš÷ÈW^ öR½ƒ¼K½= òʹ]¿Æ§fžËÞ=J=^PsG9ûvêãôôçÀzùøä…xBü™SC‡Œ½ßí·íÛ~+¹Q“tñÍ{O&Sœ€î‹q#Ûò  õ3ÏŒpS¬¾äR¤þÍö;5•§žÉiÖ¨ç o5ßóöù– ?¤4èá{â»qI9—×îŸzÿP·í¿ÛKøÎYgOžK)Mûùâå šFƒj‡nÞ†ÅGã®Vfn.™xwTÔÅá=½Ãz½¯ ξäRC**ë.DZµ>*s²²œZM|öþ=;~Ù±U—ð£ƒ\ÇÎl9¨·Ÿê™Ò·QæGfæÐ [sš_£Á¥Ç÷oþ-½Âåð%1¤sY¼çPþKu9à1¤Ñ™O^ͺ1ãJEÊŽÎ¥û¦ô±:aKóÎ ;4yâ‹V€ƒúÇÓÓ5­4È»ÑÐîAþÑ“^ï%°“¯’ÔÈÍrˆç_Gª"?®3EùWâ|Ûöê¨n:áßûŽˆ¼Í'Ë}{šè’’ ¼ ì±(XÁÕ!]Ž"”s&$Á¹~M«˜Ð bl&¦ªªˆ«sî¸3U‡kpå8¦aDám°%î›Ú'ñöáwŽzþÃQM§>ð5#2{ὬI6€„¦q„1håz• ’PŠ¤¿Æ*…„‰Ô3O.ùÍð=e`þ‚-ÙµãÝÆX•kšR,¸:3pˆ¥4”TÛž½5{Ñ¡ZÚUu &T¦|6ö¾Ÿ2ì’û˜AÚ@:/5|=GwÀ:„¨¢0Ž€W2¦D$}8æ¾ÙÂш01âxP}ÄF˜RÁX•ËÄàØœ#¬`TZ«*0Í0§Ö ˆ8ç ¡UõÆ0¢—"É™Cë Æ–×0n" θ@õ}±ú]å áZm«ÐS¯‡ê´ ]»ƒõüÕWf¢c€²co?ùñ‰%>õÀÇ[¿ûPßG¶%ýþ¹!òÏ$ÙB[·kàÒ¬Ecçøô"V’VâÑ8ÀÕY®%'g·êÚÀEuiÑ1J1lqM[E¹æîúvÑ’Ã¥1ÞõZ§’Ï^°t½óž{ÃãÖ,®.™çãÒ‹xƒ­|üœ®uYp¼"'oW=ëòÅL°6oß3ÈøŠsƒÆ[GøE7mäkÛŸ`Ð r5kH„¯‹…ŠÜcç+†LbµF4nÛ½¥ Æ^mn³ê‰;æ/\‰Xƒ\ë­¼ ¼Bƒ])©ïöB¼,•ç/£þ=GÇØ'©ÙxH˜—BëãÈ˺Ø­+[µ:§2´™¸|.·ürBa›1½"ƒýcïìì·;­DËM­ðléäìÛi@0¶{(ŠÊDD‹PW'‚‘-y_…{x€·Å3´qX¤K-Oˆ=>ù º«yd`«¡ýdžOêãÕ¬ííÍÕ¼ û’ZÅRϘ.½T“ B0¡&زæ×Kù€ôôÅ/mîüÑòkòFüäÚŽ7xø»Ý ‡Å†4S®1Ýf,[¹î·¥£Ðº…‹ãë´åIq§xd'ïÇNÀ•C;ŠÛ<°áèú‡îl,Ê´jkBØ(Ô:ü›e«·Öµ×ÈE'w~ôáý>e¿~·4oêšµ‹Þí””'ÌËo5uöÂe3 ¶¯=’/Ù.¯œsjÌ¢U+—óå‡>ÿt…6ðíÍk¯ys@[o ȵù3—-[¾ëóN©ßmý9³þ(8·àû‚É6þ°î¯º“V‘¶òëCæ¬Yüã¬ðÌB»þÃOí?ÖðéÖX<ºhÝ*K²³…ÌÙº-=+óJÞ‰Ky\?½rÉz4ä“Ÿ–=7°âÇWår?ïëœîo,ÚðjDF¡ýÕŽmÚ£}wÙOŸ÷ëìÏòŽmÞ]>ó‡•ï½1Ø­¼ä¼CzŽÈ?+§|¿äí‰êܧ¿Í,ÉZýÈÓÉ-'ÏÛ·qá÷3ÚƸcbg!ÄðÛòÒœ„Ù;xå©ž–r(~Ñ÷¼7gÍÑ ÏÝIÞ|ýˆ—üüö;[,#>þyÓ² ïôŽµbÛÕ¯î›ÝìåùK~|60»X l2Ðq!L")9+Ie]?Z2wÎ=‡?ûö|)’œ•Z}(Y9qôG&¦¦£5R ‰xÅ¡ŸŽw˜½`ÝÁ…ƒº¾LMB1„Qê¡Í‹¢6¬[¶sî¤U‚Âãjm™å¬~dú妓¾Ú³áÛ%3ÚŸ™DmBpnXùpEúáõ{*_ÝøÃÌ)my^9"¤ÉˆI‹OþôúƒÍï½hÃé…½ë[êKîy´°ëó÷m˜»`ZëW@Ä֭ϨÑ-œ1"þucÛKSQäúôTcn'ñÀ˜€4ÈV$Â5‹jèM„`ιŒB‘”¬š “µ!Œ€Ù}ôa‚3†06(•„AXB°´{rÆ„c‰¨b&Bv¢.ª(Oêò·¡ …U Áê¥5×™³0œ3E’sÎ87¸· rÎ2%06~mκ4Æ—`ƒdàïFÇ’RÚl6Îÿ2{„¢(ªª^?"×Hý;ºó_€Ž¥iš¢(UãÃ9×4`C;Á˜¬R°i\QUÉu.€¨ªÔlÂdX@ŠJ¹¦‹zð0®²S8ZcÁ*ëŒaB±ä:—„*HšF¢ª"uMH„•rÆßv3LÞ9mê¡+5‚6¨‚eµ‰¨ªñ¢¡Ü!Œ¸ÎB@0’[HÁ1Å’bš.k\» ˦”B0.ˆ¢×…@„bÎ¥j¡ª“3«¬ðjÕûù) f=º ‚U2“lQE‘\¯'ŠQJ¤ÎxU7«Ú ˜(ëšXQ‰ÐtSŠ™Î$¡ &…Ƥ¢(R¯RK¥¸Š&”¨*0““(T2&SŠ˜Î¢R]Ó:)ÅFœ¬`LDUÓ… @UUèš4~Vd—UCME0NUÊlšDÄ`=EŠJ¤nOeD v ˆ‰B®Û9ÞT*4ì BÆ8R,ª!û¥ß%HÚ90¡„ ÁÒP]ÍLrTU¸® ¤Z(×t¡(Š¨Ï5Mb‚%g¨J…¦ ŒJ¤”œ1 æP#¢à·Ð±þ !u¸â¤4¨ªHZ¯/ÕeU*ÛuøÝ47“z¨®M Ñïzø±1¶=sÎ'W @ˆTq!‚k²Ú_ ¹¡\K)‚KJ)gº„")$"D²K.F`F}cBìqÉuQ…àZÉvR Å­ÛƒÓz·óÂTœ\¶°ìº©T†²llh°»ékGŒKaP¤¶s –Âl•4ù.jªrvê]Lˆ¼~¬#ªËhÌ’R0fH#Ä‘é a¢(DÓ8ÂËj·gº!=çµ½ 6ãkL­¼¦2P3ý±fF¥¸Î¸DI0˜ø…`Á…œ ^­K1]GˆB„¬º Éu]E©V /€R×&”\S¹”·tÀÿE@CH©ÚÈ:Q(ˆê¬8¢ªPŒl…EèºÝ]ˆ…bΘ¸1èsiW^8ã$¹ ú¿ö®-FŽâŠÞ[u«‡Y›õ cG€ 6 ‰•@b ’mÄã‡"%ÄKB %ŸHDŠ¢(‘ü‘D‰È‹‡'B<, &ŽË(ÂÁ(ö²ØëÇîzgº7Õ3;;ÛÝS3;3ؾšžžîê®ê®3÷U窈Ð9­­IvÚZT/çUÕÉ#icãýD—ÁIl(ru%P*i¥HÙjÌ(I‚u@´¶HJ8˘DV€J%W™½_LÖ <² V3£ÂZ‹’ pNkÃBEhbÛ`?F$MÌF)® ‹ ’R°M ? E®–¤$z*2m@’°s¡b”Š³K"¹(II¶Ú:_¹|.Q‰ NŸƒ‚”Ø2Ia\hý$R€s «I6Z3#)²ZsãÕ8k­q I8㸥AIª~"‘t¦á/©¤ÐY­-Ô C×Ý¡^>X*%Àim}Íeà¬±Æ R¾Î›Y;‚ˆÁêعz…kRÒäßg4H’BøzšÎ2J)¥`kö”Eµ¢Ò˜ †>ÍZ¤añ/FF¼Ï[Á&ŽSUÈ9%+±º±‹´CùaÓ,’Ìã”Êø)Iè$äØ8!ƒþKP1GÞÓA"Hj4էݜî™n®OD‚s\© G&á­Á¹¾?ö5gÓg„³y!ì¢'ÜöO(„ÀÆXÈf£Xؘ[T¥sÜœ~øƒ.Ó3° }/ ?àR”§Äg›FÐY:cÔ‘yÖ{M¬«ûsÅ¥:¾7—£Y¬é…¡8° ®»jóèѽÿ›„htÓÝ[þ÷ûß½»ì²Í7|{Õ°<1¶gûŸ_;@ô[o”§ª—~í"=¶û¯O¿|Í-W¯YÚýÊöþç” ¡3ÉV*U[<†Bº€AE éåØ&Vp´jí-›Ö@iíÆ;¾{Á©^~ÑùË'öíxîMÚôÀÃw­“êòÛïÛzíð«¿ùÓžw&,Еw=x Ž=÷——Ž™¡È'ûŠ•7ýñï?y䪡ù· ”:£{RÔ´[¤(!„zKœ9.™I˜¶ ž!ñsΛ²$ÑìÛæ÷6¬Ù¶{ÅÆuÓÏüíÃYv»^Ûõ•õ##å÷N~盾 ÷·Óžøí ƒ‡ˆ"Wѹã{vþ÷DB 'öí}ÿÀ±F [b–s®ÀµþÍk BÀ%;·ó嬾 ¬’ºÜÓ¾æ-AK»™üÖÚürzŠa‡µ¼«þpS'8ýÁÛoÁ÷·\~Ωõ+ž}ü€C·Þ{ÛÚÃO¿8³ªäÁÉž<~âäLí\óƶ_ ]å÷ß¼òÈΟ=úÄ'SÜÔŽ=´£ÙëÔì®öË9 $*ä3„† ¿rð‘á퇷À °Ûl¡Ýþvw$»xðb$!¬zþå™kî½îâeÇ^?8ƒ¥‘ __ùâcÛžú•w§QfÔ ˜úø­§~ñËŸÞóÈ¡ó¾úÅÑ2ȳ.üÒyç.kzqWjR­V‹2F§Wâx°cÁƒäK ÝØʘ½?õ¬=(_\¨eUÁŽz¹ê*çö®©îRþ€„ëà<ŸÓ¿i»é¹g5õ¥ v=³}æ‡?(?þóc³xò_»Æo½çNØ_]ý­‘Œ¬šhÃÖ®8kj–Î9òö¡#9¼ù׸bÏ~è3Å+d))†Ø{Ý©û- ]º–4ÚRWÛ›y¶ëÑ-[}Éùîèø§G§P”—¯ZsŽâxê$—Ϙ9|pÒ‚^sneb|¶¶ ihtõèpY =1>>y|–äŠ /šýd||º‘·ªR©Ô aD,•Ry!’•Ò]÷ѹ:`óºàÁʈŒ¾PÕ „§Ï`ê$Luü¥zÐZ:±Ç~ÀvS öf逽( ?¯_ýYÒ„€årYá¡ÄÏÃûŒ-ׄdq´˜Sþ³C!ØjS—t´…€áÁ™ m‡ <,0¸‹íVsîSF´LÖåRÈ’°Ž1xÆv ¼,ÒÐîJ7±ÕžÆý‹ìqïú„€J)H¨;°ƒòE7¬¹Ï±qÏîaá6‡AdxILÎ5ÎÁÀíÀpPÓ°Ž-ÿ…$‹}xu°.›…œF8#œéKr;xpµ˜6»z¹|§[=ý©å4[êG˜añq§@Ìïg§If2ÎÚß®÷ƒ[5ÙâV€¾® fàÆ5Øu' —.’ÇÒÙT”R"Û¦¥ò’"Bç˜ ·QÞÊtô4«mœ”"õ•@)¥÷Ûn.A$ÙÄfñ’¿‚Kàé!×ÂnÜ[»§`ØWì´qnóB[_0'4Q$H€ "pù%"³çkóD~*"pΓÄy_‚Ö¦±Æ  Sk!0‘Ô—`§c ¤””ÂmDRŒB€6V)%Ƈ8IDATˆ•5Õ9ö?#Ök=™ ›s(H mP•¤´—"ë‘…R>m•¯'†©É5!á úéÿgqvC–Š]IEND®B`‚suricata-3.2.1/doc/userguide/capture-hardware/0000755000000000000000000000000013051004444016271 500000000000000suricata-3.2.1/doc/userguide/capture-hardware/endace-dag.rst0000644000000000000000000000203013051004444020706 00000000000000Endace DAG ========== Suricata comes with native Endace DAG card support. This means Suricata can use the *libdag* interface directly, instead of a libpcap wrapper (which should also work). Steps: Configure with DAG support: :: ./configure --enable-dag --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Results in: :: Suricata Configuration: AF_PACKET support: no PF_RING support: no NFQueue support: no IPFW support: no DAG enabled: yes Napatech enabled: no Start with: :: suricata -c suricata.yaml --dag 0:0 Started up! :: [5570] 10/7/2012 -- 13:52:30 - (source-erf-dag.c:262) (ReceiveErfDagThreadInit) -- Attached and started stream: 0 on DAG: /dev/dag0 [5570] 10/7/2012 -- 13:52:30 - (source-erf-dag.c:288) (ReceiveErfDagThreadInit) -- Starting processing packets from stream: 0 on DAG: /dev/dag0 suricata-3.2.1/doc/userguide/capture-hardware/myricom.rst0000644000000000000000000001005113051004444020417 00000000000000Myricom ======= From: http://blog.inliniac.net/2012/07/10/suricata-on-myricom-capture-cards/ In this guide I’ll describe using the Myricom libpcap support. I’m going to assume you installed the card properly, installed the Sniffer driver and made sure that all works. Make sure that in your dmesg you see that the card is in sniffer mode: :: [ 2102.860241] myri_snf INFO: eth4: Link0 is UP [ 2101.341965] myri_snf INFO: eth5: Link0 is UP I have installed the Myricom runtime and libraries in /opt/snf Compile Suricata against Myricom’s libpcap: :: ./configure --with-libpcap-includes=/opt/snf/include/ --with-libpcap-libraries=/opt/snf/lib/ --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Next, configure the amount of ringbuffers. I’m going to work with 8 here, as my quad core + hyper threading has 8 logical CPU’s. *See below* for additional information about the buffer-size parameter. :: pcap: - interface: eth5 threads: 8 buffer-size: 512kb checksum-checks: no The 8 threads setting makes Suricata create 8 reader threads for eth5. The Myricom driver makes sure each of those is attached to it’s own ringbuffer. Then start Suricata as follows: :: SNF_NUM_RINGS=8 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers If you want 16 ringbuffers, update the “threads†variable in your yaml to 16 and start Suricata: :: SNF_NUM_RINGS=16 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers Note that the pcap.buffer-size yaml setting shown above is currently ignored when using Myricom cards. The value is passed through to the pcap_set_buffer_size libpcap API within the Suricata source code. From Myricom support: :: “The libpcap interface to Sniffer10G ignores the pcap_set_buffer_size() value. The call to snf_open() uses zero as the dataring_size which informs the Sniffer library to use a default value or the value from the SNF_DATARING_SIZE environment variable." The following pull request opened by Myricom in the libpcap project indicates that a future SNF software release could provide support for setting the SNF_DATARING_SIZE via the pcap.buffer-size yaml setting: * https://github.com/the-tcpdump-group/libpcap/pull/435 Until then, the data ring and descriptor ring values can be explicitly set using the SNF_DATARING_SIZE and SNF_DESCRING_SIZE environment variables, respectively. The SNF_DATARING_SIZE is the total amount of memory to be used for storing incoming packet data. This size is shared across all rings. The SNF_DESCRING_SIZE is the total amount of memory to be used for storing meta information about the packets (packet lengths, offsets, timestamps). This size is also shared across all rings. Myricom recommends that the descriptor ring be 1/4 the size of the data ring, but the ratio can be modified based on your traffic profile. If not set explicitly, Myricom uses the following default values: SNF_DATARING_SIZE = 256MB, and SNF_DESCRING_SIZE = 64MB Expanding on the 16 thread example above, you can start Suricata with a 16GB Data Ring and a 4GB Descriptor Ring using the following command: :: SNF_NUM_RINGS=16 SNF_DATARING_SIZE=17179869184 SNF_DESCRING_SIZE=4294967296 SNF_FLAGS=0x1 suricata -c suricata.yaml -i eth5 --runmode=workers Debug Info ~~~~~~~~~~ Myricom also provides a means for obtaining debug information. This can be useful for verifying your configuration and gathering additional information. Setting SNF_DEBUG_MASK=3 enables debug information, and optionally setting the SNF_DEBUG_FILENAME allows you to specify the location of the output file. Following through with the example: :: SNF_NUM_RINGS=16 SNF_DATARING_SIZE=17179869184 SNF_DESCRING_SIZE=4294967296 SNF_FLAGS=0x1 SNF_DEBUG_MASK=3 SNF_DEBUG_FILENAME="/tmp/snf.out" suricata -c suricata.yaml -i eth5 --runmode=workers Additional Info ~~~~~~~~~~~~~~~ * http://www.40gbe.net/index_files/be59da7f2ab5bf0a299ab99ef441bb2e-28.html * http://o-www.emulex.com/blogs/implementers/2012/07/23/black-hat-usa-2012-emulex-faststack-sniffer10g-product-demo-emulex-booth/ suricata-3.2.1/doc/userguide/capture-hardware/index.rst0000644000000000000000000000014213051004444020047 00000000000000Using Capture Hardware ====================== .. toctree:: endace-dag napatech myricom suricata-3.2.1/doc/userguide/capture-hardware/napatech.rst0000644000000000000000000001561113051004444020532 00000000000000 Napatech Suricata Installation Guide ============================================================= Contents -------- * Introduction * Package Installation * Basic Configuration * Advanced Multithreaded Configuration Introduction ------------ Napatech packet capture accelerator cards can greatly improve the performance of your Suricata deployment using these hardware based features: * On board burst buffering (up to 12GB) * Zero-copy kernel bypass DMA * Non-blocking PCIe performance * Port merging * Load distribution to up 128 host buffers * Precise timestamping * Accurate time synchronization The Napatech Software Suite (driver package) comes in two varieties, NAC and OEM. The NAC package distributes deb and rpm packages to ease the installation. The OEM package uses a proprietary shell script to handle the installation process. In either case, gcc, make and the kernel header files are required to compile the kernel module and install the software. Package Installation -------------------- *Note that make, gcc, and the kernel headers are required for installation* *Root privileges are also required* Napatech NAC Package ^^^^^^^^^^^^^^^^^^^^ Red Hat Based Distros:: $ yum install kernel-devel-$(uname -r) gcc make ncurses-libs $ yum install nac-pcap-.x86_64.rpm Some distributions will require you to use the --nogpgcheck option with yum for the NAC Software Suite package file:: $ yum --nogpgcheck install nac-pcap-.x86_64.rpm Debian Based Distros:: $ apt-get install linux-headers-$(uname .r) gcc make libncurses5 $ dpkg .i nac-pcap__amd64.deb To complete installation for all distros stop ntservice:: $ /opt/napatech3/bin/ntstop.sh -m Remove these existing setup files:: $ cd /opt/napatech3/config $ rm ntservice.ini setup.ini Restart ntservice (a new ntservice.ini configuration file will be generated automatically):: $ /opt/napatech3/bin/ntstart.sh -m Napatech OEM Package ^^^^^^^^^^^^^^^^^^^^ *Note that you will be prompted to install the Napatech libpcap library. Answer "yes" if you would like to use the Napatech card to capture packets in WIreshark, tcpdump, or another pcap based application. Libpcap is not needed for Suricata as native Napatech API support is included* Red Hat Based Distros:: $ yum install kernel-devel-$(uname -r) gcc make $ ./package_install_3gd.sh Debian Based Distros:: $ apt-get install linux-headers-$(uname .r) gcc make $ ./package_install_3gd.sh To complete installation for all distros ntservice:: $ /opt/napatech3/bin/ntstart.sh -m Suricata Installation --------------------- After downloading and extracting the Suricata tarball, you need to run configure to enable Napatech support and prepare for compilation:: $ ./configure --enable_napatech --with-napatech-includes=/opt/napatech3/include --with-napatech-libraries=/opt/napatech3/lib $ make $ make install-full Now edit the suricata.yaml file to configure the maximum number of streams to use. If you plan on using the load distribution (RSS - like) feature in the Napatech accelerator, then the list should contain the same number of streams as host buffers defined in ntservice.ini:: Napatech: # The Host Buffer Allowance for all streams # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back) hba: -1 # use_all_streams set to "yes" will query the Napatech service for all configured # streams and listen on all of them. When set to "no" the streams config array # will be used. use-all-streams: yes # The streams to listen on streams: [0, 1, 2, 3, 4, 5, 6, 7] Basic Configuration ------------------- For the basic installation we will setup the Napatech capture accelerator to merge all physical ports into single stream that Suricata can read from. for this configuration, Suricata will handle the packet distribution to multiple threads. Here are the lines that need changing in /opt/napatech3/bin/ntservice.ini for best single buffer performance:: TimeSyncReferencePriority = OSTime # Timestamp clock synchronized to the OS HostBuffersRx = [1,16,0] # [number of host buffers, Size(MB), NUMA node] Stop and restart ntservice after making changes to ntservice:: $ /opt/napatech3/bin/ntstop.sh -m $ /opt/napatech3/bin/ntstart.sh -m Now we need to execute a few NTPL (Napatech Programming Language) commands to complete the setup. Create a file will the following commands:: Delete=All # Delete any existing filters Setup[numaNode=0] = streamid==0 # Set stream ID 0 to NUMA 0 Assign[priority=0; streamid=0]= all # Assign all phisical ports to stream ID 0 Next execute those command using the ntpl tool:: $ /opt/napatech3/bin/ntpl -f Now you are ready to start suricata:: $ suricata -c /usr/local/etc/suricata/suricata.yaml --napatech --runmode workers Advanced Multithreaded Configuration ------------------------------------ Now let's do a more advanced configuration where we will use the load distribution (RSS - like) capability in the accelerator. We will create 8 streams and setup the accelerator to distribute the load based on a 5 tuple hash. Increasing buffer size will minimize packet loss only if your CPU cores are fully saturated. Setting the minimum buffer size (16MB) will gave the best performance (minimize L3 cache hits) if your CPU cores are keeping up. *Note that it is extremely important that the NUMA node the host buffers are define in is the same physical CPU socket that the Napatech accelerator is plugged into* First let's modify the ntservice.ini file to increase the number and size of the host buffers:: HostBuffersRx = [8,256,0] # [number of host buffers, Size (MB), NUMA node] Stop and restart ntservice after making changes to ntservice:: $ /opt/napatech3/bin/ntstop.sh -m $ /opt/napatech3/bin/ntstart.sh -m Now let's assign the streams to host buffers and configure the load distribution. The load distribution will be setup to support both tunneled and non-tunneled traffic. Create a file that contains the ntpl commands below:: Delete=All # Delete any existing filters Setup[numaNode=0] = streamid==0 Setup[numaNode=0] = streamid==1 Setup[numaNode=0] = streamid==2 Setup[numaNode=0] = streamid==3 Setup[numaNode=0] = streamid==4 Setup[numaNode=0] = streamid==5 Setup[numaNode=0] = streamid==6 Setup[numaNode=0] = streamid==7 HashMode[priority=0; InnerLayer4Type=UDP, TCP, SCTP] = HashInner5TupleSorted HashMode[priority=1; InnerLayer3Type=IPV4] = HashInner2TupleSorted HashMode[priority=2; Layer4Type=UDP, TCP, SCTP] = Hash5TupleSorted HashMode[priority=3; Layer3Type=IPV4] = Hash2TupleSorted HashMode[priority=4]=HashRoundRobin Assign[priority=0; streamid=(0..7)]= all Next execute those command using the ntpl tool:: $ /opt/napatech3/bin/ntpl -f Now you are ready to start Suricata:: $ suricata -c /usr/local/etc/suricata/suricata.yaml --napatech --runmode workers Support ------- Contact a support engineer at: ntsupport@napatech.com suricata-3.2.1/doc/userguide/conf.py0000644000000000000000000002352313051004444014257 00000000000000# -*- coding: utf-8 -*- # # Suricata documentation build configuration file, created by # sphinx-quickstart on Fri Nov 6 10:12:25 2015. # # This file is execfile()d with the current directory set to its # containing dir. # # Note that not all possible configuration values are present in this # autogenerated file. # # All configuration values have a default; values that are commented out # serve to show the default. import sys import os import shlex import re on_rtd = os.environ.get('READTHEDOCS', None) == 'True' # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. #sys.path.insert(0, os.path.abspath('.')) # -- General configuration ------------------------------------------------ # If your documentation needs a minimal Sphinx version, state it here. #needs_sphinx = '1.0' # Add any Sphinx extension module names here, as strings. They can be # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom # ones. extensions = [] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] # The suffix(es) of source filenames. # You can specify multiple suffix as a list of string: # source_suffix = ['.rst', '.md'] source_suffix = '.rst' # The encoding of source files. #source_encoding = 'utf-8-sig' # The master toctree document. master_doc = 'index' # General information about the project. project = u'Suricata' copyright = u'2016, OISF' author = u'OISF' # The version info for the project you're documenting, acts as replacement for # |version| and |release|, also used in various other places throughout the # built documents. # # The short X.Y version. # Attempt to extract the version configure.ac. try: version = os.environ.get('version', None) if not version: version = re.search( "AC_INIT\(suricata,\s*(.*)?\)", open("../../configure.ac").read()).groups()[0] if not version: version = "unknown" except: version = "unknown" release = version # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. # # This is also used if you do content translation via gettext catalogs. # Usually you set "language" from the command line for these cases. language = None # There are two options for replacing |today|: either, you set today to some # non-false value, then it is used: #today = '' # Else, today_fmt is used as the format for a strftime call. #today_fmt = '%B %d, %Y' # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. exclude_patterns = [ '_build', # Documents that are included, rather than in a TOC. 'partials', ] # The reST default role (used for this markup: `text`) to use for all # documents. #default_role = None # If true, '()' will be appended to :func: etc. cross-reference text. #add_function_parentheses = True # If true, the current module name will be prepended to all description # unit titles (such as .. function::). #add_module_names = True # If true, sectionauthor and moduleauthor directives will be shown in the # output. They are ignored by default. #show_authors = False # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' # A list of ignored prefixes for module index sorting. #modindex_common_prefix = [] # If true, keep warnings as "system message" paragraphs in the built documents. #keep_warnings = False # If true, `todo` and `todoList` produce output, else they produce nothing. todo_include_todos = False # -- Options for HTML output ---------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. if not on_rtd: # Attempt to use the read the docs theme. try: import sphinx_rtd_theme html_theme = 'sphinx_rtd_theme' html_theme_path = [sphinx_rtd_theme.get_html_theme_path()] except: html_theme = 'default' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. #html_theme_options = {} # Add any paths that contain custom themes here, relative to this directory. #html_theme_path = [] # The name for this set of Sphinx documents. If None, it defaults to # " v documentation". #html_title = None # A shorter title for the navigation bar. Default is the same as html_title. #html_short_title = None # The name of an image file (relative to this directory) to place at the top # of the sidebar. #html_logo = None # The name of an image file (within the static path) to use as favicon of the # docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 # pixels large. #html_favicon = None # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ['_static'] # Add any extra paths that contain custom files (such as robots.txt or # .htaccess) here, relative to this directory. These files are copied # directly to the root of the documentation. #html_extra_path = [] # If not '', a 'Last updated on:' timestamp is inserted at every page bottom, # using the given strftime format. #html_last_updated_fmt = '%b %d, %Y' # If true, SmartyPants will be used to convert quotes and dashes to # typographically correct entities. #html_use_smartypants = True # Custom sidebar templates, maps document names to template names. #html_sidebars = {} # Additional templates that should be rendered to pages, maps page names to # template names. #html_additional_pages = {} # If false, no module index is generated. #html_domain_indices = True # If false, no index is generated. #html_use_index = True # If true, the index is split into individual pages for each letter. #html_split_index = False # If true, links to the reST sources are added to the pages. #html_show_sourcelink = True # If true, "Created using Sphinx" is shown in the HTML footer. Default is True. #html_show_sphinx = True # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. #html_show_copyright = True # If true, an OpenSearch description file will be output, and all pages will # contain a tag referring to it. The value of this option must be the # base URL from which the finished HTML is served. #html_use_opensearch = '' # This is the file name suffix for HTML files (e.g. ".xhtml"). #html_file_suffix = None # Language to be used for generating the HTML full-text search index. # Sphinx supports the following languages: # 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja' # 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr' #html_search_language = 'en' # A dictionary with options for the search language support, empty by default. # Now only 'ja' uses this config value #html_search_options = {'type': 'default'} # The name of a javascript file (relative to the configuration directory) that # implements a search results scorer. If empty, the default will be used. #html_search_scorer = 'scorer.js' # Output file base name for HTML help builder. htmlhelp_basename = 'suricatadoc' # -- Options for LaTeX output --------------------------------------------- latex_elements = { # The paper size ('letterpaper' or 'a4paper'). #'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). #'pointsize': '10pt', # Additional stuff for the LaTeX preamble. #'preamble': '', # Latex figure (float) alignment #'figure_align': 'htbp', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, # author, documentclass [howto, manual, or own class]). latex_documents = [ (master_doc, 'Suricata.tex', u'Suricata User Guide', u'OISF', 'manual'), ] # The name of an image file (relative to this directory) to place at the top of # the title page. #latex_logo = None # For "manual" documents, if this is true, then toplevel headings are parts, # not chapters. #latex_use_parts = False # If true, show page references after internal links. #latex_show_pagerefs = False # If true, show URL addresses after external links. #latex_show_urls = False # Documents to append as an appendix to all manuals. #latex_appendices = [] # If false, no module index is generated. #latex_domain_indices = True # -- Options for manual page output --------------------------------------- # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [ # (master_doc, 'suricata', u'Suricata Documentation', # [author], 1) ("manpages/suricata", "suricata", "Suricata", [], 1) ] # If true, show URL addresses after external links. #man_show_urls = False # -- Options for Texinfo output ------------------------------------------- # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ (master_doc, 'Suricata', u'Suricata User Guide', author, 'Suricata', 'One line description of project.', 'Miscellaneous'), ] # Documents to append as an appendix to all manuals. #texinfo_appendices = [] # If false, no module index is generated. #texinfo_domain_indices = True # How to display URL addresses: 'footnote', 'no', or 'inline'. #texinfo_show_urls = 'footnote' # If true, do not generate a @detailmenu in the "Top" node's menu. #texinfo_no_detailmenu = False rst_epilog = """ .. |sysconfdir| replace:: %(sysconfdir)s .. |localstatedir| replace:: %(localstatedir)s """ % { "sysconfdir": os.getenv("sysconfdir", "/etc"), "localstatedir": os.getenv("localstatedir", "/var"), } suricata-3.2.1/doc/userguide/Makefile.in0000644000000000000000000004776013051004467015043 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ @HAVE_PDFLATEX_TRUE@@HAVE_SPHINXBUILD_TRUE@am__append_1 = $(man1_MANS) userguide.pdf subdir = doc/userguide ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } man1dir = $(mandir)/man1 am__installdirs = "$(DESTDIR)$(man1dir)" NROFF = nroff MANS = $(man1_MANS) am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) am__DIST_COMMON = $(srcdir)/Makefile.in DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ EXTRA_DIST = conf.py index.rst install.rst acknowledgements.rst \ rule-management command-line-options.rst initscripts.rst \ public-data-sets.rst what-is-suricata.rst \ make-sense-alerts.rst setting-up-ipsinline-for-linux.rst \ unix-socket.rst capture-hardware configuration file-extraction \ licenses manpages output performance reputation rules \ setting-up-ipsinline-for-linux partials $(am__append_1) @HAVE_SPHINXBUILD_TRUE@man1_MANS = suricata.1 @HAVE_SURICATA_MAN_TRUE@man1_MANS = suricata.1 @HAVE_SPHINXBUILD_TRUE@SPHINX_BUILD = sphinx-build -q all: all-am .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu doc/userguide/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu doc/userguide/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs install-man1: $(man1_MANS) @$(NORMAL_INSTALL) @list1='$(man1_MANS)'; \ list2=''; \ test -n "$(man1dir)" \ && test -n "`echo $$list1$$list2`" \ || exit 0; \ echo " $(MKDIR_P) '$(DESTDIR)$(man1dir)'"; \ $(MKDIR_P) "$(DESTDIR)$(man1dir)" || exit 1; \ { for i in $$list1; do echo "$$i"; done; \ if test -n "$$list2"; then \ for i in $$list2; do echo "$$i"; done \ | sed -n '/\.1[a-z]*$$/p'; \ fi; \ } | while read p; do \ if test -f $$p; then d=; else d="$(srcdir)/"; fi; \ echo "$$d$$p"; echo "$$p"; \ done | \ sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \ -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \ sed 'N;N;s,\n, ,g' | { \ list=; while read file base inst; do \ if test "$$base" = "$$inst"; then list="$$list $$file"; else \ echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man1dir)/$$inst'"; \ $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man1dir)/$$inst" || exit $$?; \ fi; \ done; \ for i in $$list; do echo "$$i"; done | $(am__base_list) | \ while read files; do \ test -z "$$files" || { \ echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man1dir)'"; \ $(INSTALL_DATA) $$files "$(DESTDIR)$(man1dir)" || exit $$?; }; \ done; } uninstall-man1: @$(NORMAL_UNINSTALL) @list='$(man1_MANS)'; test -n "$(man1dir)" || exit 0; \ files=`{ for i in $$list; do echo "$$i"; done; \ } | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \ -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \ dir='$(DESTDIR)$(man1dir)'; $(am__uninstall_files_from_dir) tags TAGS: ctags CTAGS: cscope cscopelist: distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: check-am all-am: Makefile $(MANS) installdirs: for dir in "$(DESTDIR)$(man1dir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." @HAVE_SPHINXBUILD_FALSE@clean-local: clean: clean-am clean-am: clean-generic clean-libtool clean-local mostlyclean-am distclean: distclean-am -rm -f Makefile distclean-am: clean-am distclean-generic dvi: dvi-am dvi-am: @HAVE_SPHINXBUILD_FALSE@html: html-am html-am: info: info-am info-am: install-data-am: install-man install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-man1 install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-generic mostlyclean-libtool @HAVE_SPHINXBUILD_FALSE@pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-man uninstall-man: uninstall-man1 .MAKE: install-am install-strip .PHONY: all all-am check check-am clean clean-generic clean-libtool \ clean-local cscopelist-am ctags-am distclean distclean-generic \ distclean-libtool distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am install-dvi \ install-dvi-am install-exec install-exec-am install-html \ install-html-am install-info install-info-am install-man \ install-man1 install-pdf install-pdf-am install-ps \ install-ps-am install-strip installcheck installcheck-am \ installdirs maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ ps ps-am tags-am uninstall uninstall-am uninstall-man \ uninstall-man1 .PRECIOUS: Makefile @HAVE_SPHINXBUILD_TRUE@html: @HAVE_SPHINXBUILD_TRUE@ sysconfdir=$(sysconfdir) \ @HAVE_SPHINXBUILD_TRUE@ localstatedir=$(localstatedir) \ @HAVE_SPHINXBUILD_TRUE@ version=$(PACKAGE_VERSION) \ @HAVE_SPHINXBUILD_TRUE@ $(SPHINX_BUILD) -W -b html -d _build/doctrees \ @HAVE_SPHINXBUILD_TRUE@ $(top_srcdir)/doc/userguide _build/html @HAVE_SPHINXBUILD_TRUE@_build/latex/Suricata.pdf: @HAVE_SPHINXBUILD_TRUE@ sysconfdir=$(sysconfdir) \ @HAVE_SPHINXBUILD_TRUE@ localstatedir=$(localstatedir) \ @HAVE_SPHINXBUILD_TRUE@ version=$(PACKAGE_VERSION) \ @HAVE_SPHINXBUILD_TRUE@ $(SPHINX_BUILD) -W -b latex -d _build/doctrees \ @HAVE_SPHINXBUILD_TRUE@ $(top_srcdir)/doc/userguide _build/latex # The Sphinx generated Makefile is GNU Make specific, so just do what # it does here - yes, multiple passes of pdflatex is required. @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && pdflatex Suricata.tex @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && pdflatex Suricata.tex @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && pdflatex Suricata.tex @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && makeindex -s python.ist Suricata.idx @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && pdflatex Suricata.tex @HAVE_SPHINXBUILD_TRUE@ cd _build/latex && pdflatex Suricata.tex @HAVE_SPHINXBUILD_TRUE@userguide.pdf: _build/latex/Suricata.pdf @HAVE_SPHINXBUILD_TRUE@ cp _build/latex/Suricata.pdf userguide.pdf @HAVE_SPHINXBUILD_TRUE@pdf: userguide.pdf @HAVE_SPHINXBUILD_TRUE@_build/man/suricata.1: @HAVE_SPHINXBUILD_TRUE@ sysconfdir=$(sysconfdir) \ @HAVE_SPHINXBUILD_TRUE@ localstatedir=$(localstatedir) \ @HAVE_SPHINXBUILD_TRUE@ version=$(PACKAGE_VERSION) \ @HAVE_SPHINXBUILD_TRUE@ $(SPHINX_BUILD) -b man -d _build/doctrees \ @HAVE_SPHINXBUILD_TRUE@ $(top_srcdir)/doc/userguide _build/man @HAVE_SPHINXBUILD_TRUE@suricata.1: _build/man/suricata.1 @HAVE_SPHINXBUILD_TRUE@ cp _build/man/suricata.1 suricata.1 @HAVE_SPHINXBUILD_TRUE@man: _build/man/suricata.1 # Remove build artifacts that aren't tracked by autotools. @HAVE_SPHINXBUILD_TRUE@clean-local: @HAVE_SPHINXBUILD_TRUE@ rm -rf $(top_builddir)/doc/userguide/_build @HAVE_SPHINXBUILD_TRUE@ rm -f $(top_builddir)/doc/userguide/suricata.1 @HAVE_SPHINXBUILD_TRUE@ rm -f $(top_builddir)/doc/userguide/userguide.pdf # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/doc/userguide/partials/0000755000000000000000000000000013051004444014652 500000000000000suricata-3.2.1/doc/userguide/partials/options-unittests.rst0000644000000000000000000000113413051004444021056 00000000000000.. Options for developers - unittests. .. option:: -u Run the unit tests and exit. Requires that Suricata be compiled with *--enable-unittests*. .. option:: -U, --unittest-filter=REGEX With the -U option you can select which of the unit tests you want to run. This option uses REGEX. Example of use: suricata -u -U http .. option:: --list-unittests List all unit tests. .. option:: --fatal-unittests Enables fatal failure on a unit test error. Suricata will exit instead of continuuing more tests. .. option:: --unittests-coverage Display unit test coverage report. suricata-3.2.1/doc/userguide/partials/options.rst0000644000000000000000000001344713051004444017030 00000000000000.. Start with the most common basic options. .. option:: -h Display a brief usage overview. .. option:: -V Displays the version of Suricata. .. option:: -c Path to configuration file. .. option:: -T Test configuration. .. option:: -v The -v option enables more verbosity of Suricata's output. Supply multiple times for more verbosity. .. Basic input options. .. option:: -r Run in pcap offline mode reading files from pcap file. .. option:: -i After the -i option you can enter the interface card you would like to use to sniff packets from. This option will try to use the best capture method available. .. option:: --pcap[=] Run in PCAP mode. If no device is provided the interfaces provided in the *pcap* section of the configuration file will be used. .. option:: --af-packet[=] Enable capture of packet using AF_PACKET on Linux. If no device is supplied, the list of devices from the af-packet section in the yaml is used. .. option:: -q Run inline of the NFQUEUE queue ID provided. May be provided multiple times. .. Back to other basic options. .. option:: -s With the -s option you can set a file with signatures, which will be loaded together with the rules set in the yaml. .. option:: -S With the -S option you can set a file with signatures, which will be loaded exclusively, regardless of the rules set in the yaml. .. option:: -l With the -l option you can set the default log directory. If you already have the default-log-dir set in yaml, it will not be used by Suricata if you use the -l option. It will use the log dir that is set with the -l option. If you do not set a directory with the -l option, Suricata will use the directory that is set in yaml. .. option:: -D Normally if you run Suricata on your console, it keeps your console occupied. You can not use it for other purposes, and when you close the window, Suricata stops running. If you run Suricata as deamon (using the -D option), it runs at the background and you will be able to use the console for other tasks without disturbing the engine running. .. option:: --runmode With the *--runmode* option you can set the runmode that you would like to use. This command line option can override the yaml runmode option. Runmodes are: *workers*, *autofp* and *single*. For more information about runmodes see :doc:`Runmodes ` in the user guide. .. option:: -F Use BPF filter from file. .. option:: -k [all|none] Force (all) the checksum check or disable (none) all checksum checks. .. option:: --user= Set the process user after initialization. Overrides the user provided in the *run-as* section of the configuration file. .. option:: --group= Set the process group to group after initialization. Overrides the group provided in the *run-as* section of the configuration file. .. option:: --pidfile Write the process ID to file. Overrides the *pid-file* option in the configuration file and forces the file to be written when not running as a daemon. .. option:: --init-errors-fatal Exit with a failure when errors are encountered loading signatures. .. option:: --disable-detection Disable the detection engine. .. Information options. .. option:: --dump-config Dump the configuration loaded from the configuration file to the terminal and exit. .. option:: --build-info Display the build information the Suricata was built with. .. option:: --list-app-layer-protos List all supported application layer protocols. .. option:: --list-keywords=[all|csv|] List all supported rule keywords. .. option:: --list-runmodes List all supported run modes. .. Advanced options. .. option:: --set = Set a configuration value. Useful for overriding basic configuration parameters in the configuration. For example, to change the default log directory:: --set default-log-dir=/var/tmp .. option:: --engine-analysis Print reports on analysis of different sections in the engine and exit. Please have a look at the conf parameter engine-analysis on what reports can be printed .. option:: --unix-socket= Use file as the Suricata unix control socket. Overrides the *filename* provided in the *unix-command* section of the configuration file. .. Advanced input options. .. option:: --pcap-buffer-size= Set the size of the PCAP buffer (0 - 2147483647). .. option:: --netmap[=] Enable capture of packet using NETMAP on FreeBSD or Linux. If no device is supplied, the list of devices from the netmap section in the yaml is used. .. option:: --pfring[=] Enable PF_RING packet capture. If no device provided, the devices in the Suricata configuration will be used. .. option:: --pfring-cluster-id Set the PF_RING cluster ID. .. option:: --pfring-cluster-type Set the PF_RING cluster type (cluster_round_robin, cluster_flow). .. option:: -d Run inline using IPFW divert mode. .. option:: --dag Enable packet capture off a DAG card. If capturing off a specific stream the stream can be select using a device name like "dag0:4". This option may be provided multiple times read off multiple devices and/or streams. .. option:: --napatech Enable packet capture using the Napatech Streams API. .. option:: --mpipe Enable packet capture using the TileGX mpipe interface. .. option:: --erf-in= Run in offline mode reading the specific ERF file (Endace extensible record format). .. option:: --simulate-ips Simulate IPS mode when running in a non-IPS mode. suricata-3.2.1/doc/userguide/reputation/0000755000000000000000000000000013051004444015225 500000000000000suricata-3.2.1/doc/userguide/reputation/ipreputation/0000755000000000000000000000000013051004444017750 500000000000000suricata-3.2.1/doc/userguide/reputation/ipreputation/ip-reputation-rules.rst0000644000000000000000000000153713051004444024360 00000000000000IP Reputation Rules =================== IP Reputation can be used in rules through a new rule directive "iprep". iprep ~~~~~ The iprep directive matches on the IP reputation information for a host. :: iprep:,,, side to check: cat: the category short name operator: <, >, = value: 1-127 Example: :: alert ip $HOME_NET any -> any any (msg:"IPREP internal host talking to CnC server"; flow:to_server; iprep:dst,CnC,>,30; sid:1; rev:1;) IP-only ~~~~~~~ The "iprep" keyword is compatible to "IP-only" rules. This means that a rule like: :: alert ip any any -> any any (msg:"IPREP High Value CnC"; iprep:src,CnC,>,100; sid:1; rev:1;) will only be checked once per flow-direction. For more information about IP Reputation see :doc:`ip-reputation-config` and :doc:`ip-reputation-format`. suricata-3.2.1/doc/userguide/reputation/ipreputation/ip-reputation-format.rst0000644000000000000000000000214713051004444024514 00000000000000IP Reputation Format ==================== Description of IP Reputation file formats. For the configuration see :doc:`ip-reputation-config` and :doc:`ip-reputation-rules` for the rule format. Categories file ~~~~~~~~~~~~~~~ The categories file provides a mapping between a category number, short name and long description. It's a simple CSV file: :: ,, Example: :: 1,BadHosts,Known bad hosts 2,Google,Known google host The maximum value for the category id is hard coded at 60 currently. Reputation file ~~~~~~~~~~~~~~~ The reputation file lists a reputation score for hosts in the categories. It's a simple CSV file: > ,, The IP is an IPv4 address in the quad-dotted notation. The category is the number as defined in the categories file and the value is a number between 1 and 127. 0 means no data. Example: :: 1.2.3.4,1,101 1.1.1.1,6,88 If an IP address has a score in multiple categories it should be listed in the file multiple times. Example: :: 1.1.1.1,1,10 1.1.1.1,2,10 This lists 1.1.1.1 in categories 1 and 2, each with a score of 10. suricata-3.2.1/doc/userguide/reputation/ipreputation/ip-reputation-config.rst0000644000000000000000000000346613051004444024476 00000000000000IP Reputation Config ==================== IP reputation has a few configuration directives, all disabled by default. :: # IP Reputation #reputation-categories-file: /etc/suricata/iprep/categories.txt #default-reputation-path: /etc/suricata/iprep #reputation-files: # - reputation.list reputation-categories-file ~~~~~~~~~~~~~~~~~~~~~~~~~~ The categories file mapping numbered category values to short names. :: reputation-categories-file: /etc/suricata/iprep/categories.txt default-reputation-path ~~~~~~~~~~~~~~~~~~~~~~~ Path where reputation files from the "reputation-files" directive are loaded from by default. :: default-reputation-path: /etc/suricata/iprep reputation-files ~~~~~~~~~~~~~~~~ YAML list of file names to load. In case of a absolute path the file is loaded directly, otherwise the path from "default-reputation-path" is pre-pended to form the final path. :: reputation-files: - badhosts.list - knowngood.list - sharedhosting.list Hosts ~~~~~ IP reputation information is stored in the host table, so the settings of the host table affect it. Depending on the number of hosts reputation information is available for, the memcap and hash size may have to be increased. Reloads ~~~~~~~ If the "rule-reloads" option is enabled, sending Suricata a USR2 signal will reload the IP reputation data, along with the normal rules reload. During the reload the host table will be updated to contain the new data. The iprep information is versioned. When the reload is complete, Suricata will automatically clean up the old iprep information. Only the reputation files will be reloaded, the categories file won't be. If categories change, Suricata should be restarted. File format ~~~~~~~~~~~ The format of the reputation files is described in the :doc:`ip-reputation-format` page. suricata-3.2.1/doc/userguide/reputation/ipreputation/ip-reputation.rst0000644000000000000000000000516313051004444023227 00000000000000IP Reputation ============= .. toctree:: ip-reputation-config ip-reputation-rules ip-reputation-format The purpose of the IP reputation component is the ranking of IP Addresses within the Suricata Engine. It will collect, store, update and distribute reputation intelligence on IP Addresses. The hub and spoke architecture will allows the central database (The Hub) to collect, store and compile updated IP reputation details that are then distributed to user-side sensor databases (Spokes) for inclusion in user security systems. The reputation data update frequency and security action taken, is defined in the user security configuration. The intent of IP Reputation is to allow sharing of intelligence regarding a vast number of IP addresses. This can be positive or negative intelligence classified into a number of categories. The technical implementation requires three major efforts; engine integration, the hub that redistributes reputation, and the communication protocol between hubs and sensors. The hub will have a number of responsibilities. This will be a separate module running on a separate system as any sensor. Most often it would run on a central database that all sensors already have communication with. It will be able to subscribe to one or more external feeds. The local admin should be able to define the feeds to be subscribed to, provide authentication credentials if required, and give a weight to that feed. The weight can be an overall number or a by category weight. This will allow the admin to minimize the influence a feed has on their overall reputation if they distrust a particular category or feed, or trust another implicitly. Feeds can be configured to accept feedback or not and will report so on connect. The admin can override and choose not to give any feedback, but the sensor should report these to the Hub upstream on connect. The hub will take all of these feeds and aggregate them into an average single score for each IP or IP Block, and then redistribute this data to all local sensors as configured. It should receive connections from sensors. The sensor will have to provide authentication and will provide feedback. The hub should redistribute that feedback from sensors to all other sensors as well as up to any feeds that accept feedback. The hub should also have an API to allow outside statistical analysis to be done to the database and fed back in to the stream. For instance a local site may choose to change the reputation on all Russian IP blocks, etc. For more information about IP Reputation see :doc:`ip-reputation-config`, :doc:`ip-reputation-rules` and :doc:`ip-reputation-format`. suricata-3.2.1/doc/userguide/reputation/index.rst0000644000000000000000000000010713051004444017004 00000000000000Reputation ========== .. toctree:: ipreputation/ip-reputation.rst suricata-3.2.1/doc/userguide/acknowledgements.rst0000644000000000000000000000121413051004444017035 00000000000000Acknowledgements ================ Thank you to the following for their Wiki and documentation contributions that have made this user guide possible: - Andreas Herz - Andreas Moe - Anne-Fleur Koolstra - Christophe Vandeplas - Darren Spruell - David Cannings - David Diallo - David Wharton - Eric Leblond - god lol - Haris Haq - Ignacio Sanchez - Jason Ish - Jason Taylor - Josh Smith - Ken Steele - Les Syv - Mark Solaris - Martin Holste - Mats Klepsland - Matt Jonkman - Michael Bentley - Michael Hrishenko - Nathan Jimerson - Nicolas Merle - Peter Manev - Philipp Buehler - Rob MacGregor - Russel Fulton - Victor Julien - Vincent Fang - Zach Rasmor suricata-3.2.1/doc/userguide/index.rst0000644000000000000000000000102213051004444014607 00000000000000Suricata User Guide =================== .. toctree:: :numbered: :titlesonly: what-is-suricata install.rst command-line-options rules/index.rst rule-management/index.rst make-sense-alerts performance/index.rst configuration/index.rst reputation/index.rst initscripts setting-up-ipsinline-for-linux output/index.rst file-extraction/file-extraction.rst public-data-sets capture-hardware/index.rst unix-socket.rst manpages/index.rst acknowledgements licenses/index.rst suricata-3.2.1/doc/userguide/install.rst0000644000000000000000000000725613051004444015165 00000000000000Installation ============ Before Suricata can be used it has to be installed. Suricata can be installed on various distributions using binary packages: :ref:`install-binary-packages`. For people familiar with compiling their own software, the Source method is recommended. Advanced users can check the advanced guides, see :ref:`install-advanced`. Source ------ Installing from the source distribution files gives the most control over the Suricata installation. Basic steps:: tar xzvf suricata-3.2beta1.tar.gz cd suricata-3.2beta1 ./configure make make install This will install Suricata into ``/usr/local/bin/``, use the default configuration in ``/usr/local/etc/suricata/`` and will output to ``/usr/local/var/log/suricata`` Common configure options ^^^^^^^^^^^^^^^^^^^^^^^^ .. option:: --disable-gccmarch-native Do not optimize the binary for the hardware it is built on. Add this flag if the binary is meant to be portable or if Suricata is to be used in a VM. .. option:: --prefix=/usr/ Installs the Suricata binary into /usr/bin/. Default ``/usr/local/`` .. option:: --sysconfdir=/etc Installs the Suricata configuration files into /etc/suricata/. Default ``/usr/local/etc/`` .. option:: --localstatedir=/var Setups Suricata for logging into /var/log/suricata/. Default ``/usr/local/var/log/suricata`` .. option:: --enable-lua Enables Lua support for detection and output. .. option:: --enable-geopip Enables GeoIP support for detection. Dependencies ^^^^^^^^^^^^ For Suricata's compilation you'll need the following libraries and their development headers installed: libpcap, libpcre, libmagic, zlib, libyaml The following tools are required: make gcc (or clang) pkg-config For full features, also add: libjansson, libnss, libgeoip, liblua5.1, libhiredis Ubuntu/Debian """"""""""""" Minimal:: apt-get install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ make libmagic-dev Recommended:: apt-get install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ libcap-ng-dev libcap-ng0 make libmagic-dev libjansson-dev \ libnss3-dev libgeoip-dev liblua5.1-dev libhiredis-dev Extra for iptables/nftables IPS integration:: apt-get install libnetfilter-queue-dev libnetfilter-queue1 \ libnetfilter-log-dev libnetfilter-log1 \ libnfnetlink-dev libnfnetlink0 .. _install-binary-packages: Binary packages --------------- Ubuntu ^^^^^^ For Ubuntu, the OISF maintains a PPA ``suricata-stable`` that always contains the latest stable release. To use it:: sudo add-apt-repository ppa:oisf/suricata-stable sudo apt-get update sudo sudo apt-get install suricata Debian ^^^^^^ In Debian Jessie Suricata is out of date, but an updated version is in Debian Backports. As root do:: echo "deb http://http.debian.net/debian jessie-backports main" > \ /etc/apt/sources.list.d/backports.list apt-get update apt-get install suricata -t jessie-backports Fedora ^^^^^^ :: dnf install suricata RHEL/CentOS ^^^^^^^^^^^ For RedHat Enterprise Linux 7 and CentOS 7 the EPEL repository can be used. :: yum install epel-release yum install suricata .. _install-advanced: Advanced Installation --------------------- Various installation guides for installing from GIT and for other operating systems are maintained at: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation suricata-3.2.1/doc/userguide/make-sense-alerts.rst0000644000000000000000000000525213051004444017031 00000000000000Making sense out of Alerts ========================== When alert happens it's important to figure out what it means. Is it serious? Relevant? A false positive? To find out more about the rule that fired, it's always a good idea to look at the actual rule. The first thing to look at in a rule is the description that follows the "msg" keyword. Lets consider an example: :: msg:"ET SCAN sipscan probe"; The "ET" indicates the rule came from the Emerging Threats project. "SCAN" indicates the purpose of the rule is to match on some form of scanning. Following that a more or less detailed description is given. Most rules contain some pointers to more information in the form of the "reference" keyword. Consider the following example rule: :: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS \ (msg:"ET CURRENT_EVENTS Adobe 0day Shovelware"; \ flow:established,to_server; content:"GET "; nocase; depth:4; \ content:!"|0d 0a|Referer\:"; nocase; \ uricontent:"/ppp/listdir.php?dir="; \ pcre:"/\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=/U"; \ classtype:trojan-activity; \ reference:url,isc.sans.org/diary.html?storyid=7747; \ reference:url,doc.emergingthreats.net/2010496; \ reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Adobe; \ sid:2010496; rev:2;) In this rule the reference keyword indicates 3 url's to visit for more information: :: isc.sans.org/diary.html?storyid=7747 doc.emergingthreats.net/2010496 www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Adobe Some rules contain a reference like: "reference:cve,2009-3958;" should allow you to find info about the specific CVE using your favourite search engine. It's not always straight forward and sometimes not all of that information is available publicly. Usually asking about it on the signature support lists helps a lot then. For the Emerging Threats list this is: http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs For the VRT ruleset: https://lists.sourceforge.net/lists/listinfo/snort-sigs In many cases, looking at just the alert and the packet that triggered it won't be enough to be conclusive. When running an IDS engine like Suricata, it's always recommended to combine it with full packet capturing. Using tools like Sguil or Snorby, the full TCP session or UDP flow can be inspected. For example, if a rule fired that indicates your web application is attacked, looking at the full TCP session might reveal that the web application replied with 404 not found. This will usually mean the attack failed. Usually, not always. Obviously there is a lot more to Incidence Response, but this should get you started. suricata-3.2.1/doc/userguide/configuration/0000755000000000000000000000000013051004444015702 500000000000000suricata-3.2.1/doc/userguide/configuration/suricata-yaml/0000755000000000000000000000000013051004444020455 500000000000000suricata-3.2.1/doc/userguide/configuration/suricata-yaml/normal_ids.png0000644000000000000000000002037713051004444023243 00000000000000‰PNG  IHDRz,¨CsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ$‚O¸ IDATxÚíÝyxLgûðû>sfÉd%±µU›–Ú)ªˆ´–ÚkßUK)­­Öj«¥TiQÛ«j)¡ºY^EÑÖOðênkíAˆ5DÖIf;Ïóûc’I,EH"™ù~.×Å3gfîsÎwžç,Ïa)%ä=%Ä n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nq€¸ÄÍÃ&¥¼uÚ=¾6úàIŽ;Íú¶³s¿áíÞº@–螊v¶Ë'Ž^N¦»U(ûÜnžs!) nî 3ïZÜ¥f†Mš4iܸQD›?½v‰³ø­AÿXî4k{òÉÅ¿%ó›nÊ•ã=Õy{Ûqf.%ŠÿùñǪ5 oÒ¤IãgŸmòÖ¼ ó½èÚOó?Ú~ôŽÅw¬™3?[$3]<¸¹ýó›<ûì«ï-·J$âƳ¨c¾_DEEíÚµ{Çú™ï èb%&¢„¸ ÑÑÑgb/‰ÌŸ]kòµÓ§¢Ï^ˆ7Î!9îÜ…k©D$ÖsgNEŸ:`qH;Ûü]ûž·»·–ÿô±òµ¦já©3ëÕÒQ;£¢¢víÙUùÔœ×??ÉD–s*:úÔé‹“¤”R9.œ=}êLŠýÆŒp¤œˆ¬1?5ë<É?ÄD€¦Ïløëì¥ã¿thÙ,VÓ];ã´¥ÛEV:I~êû¯¦ [Yº#—j6H:ñ9Ú<Ý|Ó3±Gÿ×.¢q33OlÝð“uÿ;öû†¦µ[_³e}é ýºì¹"uD;0eåõ„«KÞé5xþgJbšÂéV›»ë¤‚÷îܪ#"¢ÇËùíÑÓì½ï+³Óš-^Jç¯kg§”yª¢Ž¨Ú?}—˜hIê±·¾l;Ë6±Éª± œ·¤{ÍRԦɉ“ñ›a⑶=?Û¸÷[¢;¿M­1 UµÒ•}@Ô˜ùÑSKùø™ž|¬˜)ë i¤#Ñ’è´:“c÷~{ëk[Þ%•¶Üsíj‚Ýak]ü?¿¦P„þÐÎä»FöQˆjÔnmba#ReÞ Ë XØÿ™2D×g~bÒº‘¾Vk¿7Fu¾´Ø€ Rg {ì1wçʵ»†™,wŽÞaÚ:>TJÉhà n<)n’NíÙ¼%šÝ#õ^Û>¸<‘<¸ çˆ=ÎœØ;Ø”æêœN´66›ˆHJÓã•&"½Y?¾ß€j-J¸ºT çµXÒQ`µÁ“Š„Ê=ž²NØâ6}¿IØ…)¨Ôº}{M’ 'ë4uÜ´éu+± ‚Dâ ò8±”eœˆ’ˆÿž;â$;?z§ “våº0XSRØá *¶xÎ8iÕnz#)‰Y_ÿî eé;~^ÃÞ5®|EÜxO_*¸Jë¾}«d[´™«c—ìüòQ‹ kœ‚ˆ¨j ¿£W’Z„3'­übWŸ—Ú:Òì3·üûi¯ásw|:,¢XÉÇ“ÓÎT¯Y“ˆl)qª_Àé=7­RòÖö, M‡©tïî½³å3]:¶¹|ƒa=›Õ#aûû7$RŠVÕ]ڨɡ ó¯ÿ]Ò¸£ɧ†ÍYþ|\­ƒwüº,HW¶œî‚¡ÂS5}I:Ó¯[Uvœ¼¡>R2Ó¡Ïû¿w¡ÛÎï_pµw<¼u³};…‡“^ïúú^˜;8u}š†[øýšy/. ô;ùý®sÝçLÛ:®ÛŒE_ ìÐù„©„k½ÐÔå­/ô›G¬.V!üò¡E·mÞ­ýKÏêW.YçЇu¬p¡ëˆüæÈi›‹ø‘‚J¶^6¨x±Ë‰|Giÿz×Þë6þ÷õž-§}y€Œ>º«ç}µ^¸êÃìL=öÚʘFÇfÏž={öìùë{xë¦2Éח֬Ɉ]ò®ƒq,½ìУ”R+|ó%… bVX AÌ ³Ì8þ¬0 !XQ˜2Ë(Šû DÌŠk&ÙžODRŠìÕeæB°9I©I©S”Ûÿ”ñU˜]p}÷4f–RHb…Ùõµ]%"ãû³¢pf=”Ì™g²=˃-J YýýiÑ"êÙÓ{:Yy7—.Q•*äpÜ¥+›ÓBßÇŒœ¾Å5qõ€r¹t떚Þ¯¢N—³—9û`:·m ýkÅ|}söªJ~~9køûç¬V:)’ƒ·’‚‚È`ÈÙ[„„Ðĉ”–v›Å@óæQïÞ:y7RRjjž´ïož÷ýIL¦1#FÌœ=›l¶‡¼¸®^¥ÔÔ¬‘BÐùó9 ÁÄDJIÉÙK.]º¹¶ª:vË–­Z‘Óy›—¤¥QrrξxBiZžo³QjjÎÖ””ü’IIN'Y,9K‡ØØ] {ŒV¯¦ºu=»u“—»Š™Éßß3Êd7ÉLJ||n7‡‚‚rüªZµʇµ%$ФIwèLQµj´t)U®Lf³7t©T¬…§%Z¨VD\ŽpõëÓ‚F¾¾7ÔÊÓwß nòKx8MœHaaäççU)ƒ¸ÈwëÖygʸá¼tŠ7€¸@Üâæ¡zðSÛµkW>F!’+ã×LÅÅŽ2hh‰ÐÒ·ùþŠNŠ»Ÿ®ª(ì¾üçþ\:¹biÑ"A¿\S?üèì…8qKY8c„š{ªÃƒTLQ”:Õž|õÕØ>=ŒW?w6¦|“~5"ÚÜ6´~Þû†OZž†½›¿¹xéJ¡ˆ›C§¯´3Ën½yzJbJܹ“VËóÓ”õFÚõéˆW±u"n )Íi×nw­(3iʇ¸NG¡ÝOJ§n-—pؘ¤æÈû&7ã¤dÏ„]Å€¸Ä ÜŸƬÊèµ Ëðoý) îpÍT~庢¬]»®dñ`÷MÓ^yåUÅ"¸%kˆNŸ9½|ùr-sŒ‡ÃÑ·o__×õÓ€¸»þ\ÇÅÅiŽ¬ã=z½>&&¦R¥J(έÒÓÓÏŸ?/2Ç»Ò4-&&¦J•*¨ :Sp? ]OJJ©7˜°àqù‘7ªÁˆ2â7ˆ@Üâà~á¼›l˜¾{«%Õ˜Ú¹KíÌê]3j¨SÕéL¥žî߸KGrHf–Dì¸þÛŠ‰§OD³©Ø-GÕz¶Ž&ȳO†e…IjÛǵŒÏxl,^µEƒîo˜U’Dz:¶fÔg¶¥–^ùÕmµž°®{£Cº)ë ºT|»Î\¯jXç7ÞIJyy™Em Û5Êúb”Içºã¬°&¥·˜µ#Pï`rþñÙË_Í:ÝgÔh‡“R¯Y;w~¥ÎÓ;ö¨&ìW÷Ìî¹zkµ^S–éÁ&siÖ´òCÖ×*k")ã}ùݨ†•úF6¬S‘H³&¥5ÿdG>ë²qɇ(ÝžšZã­íýÝ·!e²)ï æ½óWUî;ª„¿}!>«•"Iïãc4è}ŠÖk×=éô)»B*]ûqÖ´Ç^ùo£¦ æŸ"•š½¿34¤x’Ý[ê¥3ùÍs@©¯õ™òÁé¥]R‘dƒÙlô tÿQuì*£j6e›€k¢7Þ6Ä,¯žNN¯VίIg~_²BfÛT#©F2úÑ‘¨ÿ–ªÑXuRzÌï×Ì54î1îØ>|š¿Þ».¹t}w.Ò´H‰€˜ØX×e•ª‰ôî?FŒ\èLݼÓF^ß0H/HËš‘ÌøÛëò×û&¦X˜Xç#¾Xƒ2Æ¡>5pÉ*ÅA¬òáå£b ÿ¡‚Ÿð6‚qã¥ûm~ü)6¸ÆÑß¾9A¤¨zÿ½¿kó|U’¤¥+—üUÄ@$Èzõuo5j0ý÷>~ÎT‹Ð9Üs f¿£ü¿6‘-δ’þfI-]é¼ä@CV»QØ$)D•XÚœÑÛdEEÖ n¼5n6ØœÅ>îÊŠò•‹n]0ÉÚt¯BD$œ$""cɺ*h±ûOVl\ÝÿÞþ#¢FvÅ +|téЀNóJzWÿTJ©×Ž$\¾R·T)g/—»Çåzš¹'K`]þ¯w`Á¬Àö—©\¿tåú¥+×/Y½‘"WbÏ_u¥Þ‡ô&2˜ÉvvÛ‰h­xåJš¾üsýÚì›ÛöØñXƒ/étdÍ_ö]* x|ºd¬7F½|Èqå×õã_.ÒrAHPÆO—kºûªÇúhݸ· ûå?Ï¥ö|«‘ÌØ £QýZå7¬øö‰÷k"ñ뵈‰œv}±ju†}õD)Ö41¥MÀ׿®ê»óÃ+ŠÞ¿BÓ]gÔgÎÁS2¾EˆÈž–¼R̓ K§ÕX¼zõçVkPO I¬i"qMÿªYcñIgé&ï·ën·$ ôž7(J]yÀaËŠ &Y¢Ûê×U²[iÀWG9s;‘‚œ‚˜Yj²x­n/Öë¦($‰„ƒ4Mz×’u#ÿv·â\5‘‚˜Ù!«e/—‹ÐÈî —6FkV) ‡¿7^Ïas¥LV‘F˜Éiý·”b"ÒÙNyÇ^b&Òl¤Ý¦ÿZ®ÌéÈì»@Üâqy 7ÆÄ äOÖ“Ù€:âò!oHÑ¡ €¸Ä â7€¸¯…Càðà¼åš)!4Íé¼i"3K!4Ä-ÿuL$è¢dÝZ.»-MsÞfzîÿêÔ¼ûjÌL}á>âæ!«S÷éÍ[~HÙyÚ=%Ýjݽ{³BDßov/«©ªê4MÜ÷gp:Ï ! x­¤”c÷Ú±õ#÷æh³ÛwïÞƒÖ”¬(ت_«ª¦iw¸êUJé~ fvýÜõ*YfžØ¶f³ûËþËl)cLŸ›f•ñv®wbBZ!nî´ Mš4)û”ÄÄDMÓtº|=äÎÛOÁÌuëÖ­[·®{Jjjjöm»€økÍËïn*Ó²~1©ÙþؾöJp÷W¸—F ßq0Qú•m¯EUÿ¢[¨{í¡¤¨ç^Þ¹Oüï›þ4·Ý³|(Âæ>Û­Þð% ÈFÎŒµ4CDpõ®Ã† >r̪ÍÿgŠ^£-<4¢iÓv½G^³ W;å¯õs[>פ󫓮;n˜Á?ê=|Á."J½ðGŸöÍ"žañÖcZʹfÝ><µ°G÷ÏO¹ÛN¿~¿oÊ7?¾ûæëŸ~½µRÌgÿ$¡úhÝ€W¦s’Âþ:ºðý{‡Ã†mPQIÞݸÍû»~|?qã„wÕÛ´í'û‘Èz¦ý½ñ-""E}>bƒ½ãò¡—÷µúùÎõ?¡­1ÿ‘]+^-=YùhY·2îÖMý>£\»íþÞðááîO¢ìˆð*¬;·}L›Ý*Iiµ$…¿ùy0µôÈøí¿8/¥tƇ8ˆ–}wø•QÃTUU«õß¿N±ºï›ž©ùÅ´ŽDtâÐ.-!ú…Z‘° Zº·}]fEÕ)ìn”±cÆ»oï‰ú_½ï¨ØÕŒ¸ÉéÞœ‡¾×VQð÷»8Ž‡ÛÔ4MÓn<´'µ2áï-^™˜UƒQ%)gtlêÿö—&3ª×ODv!t·‚`UÕ‘j’'/qü¶Èã“û=®’öòµ_Y1½³æÚ¬¨¿]tÓªÂÌDú±“?K4¾WøÖÃõ[VA qsÏ‚‚‚ÆŒóp7!)e``!XkýüüF]k¥|ý²ßJFžŒs«ZÊh ßfMJ¤ukRêÍw¨^’-{Â_ŠÚùÝDgºÖ}ø›a̓[u{믵Ó*>^ÿŸYËTC/•è¯¯žh½¨I)t®w%ffþ¬OóØîŸ}к]½vÝÇlBpª¸yØ÷cæB±©°VšÍb±:oZ¨/Ý®i¸oɲoNŸÛàçæíÇþ°eÆ¢nS‡†7¢˜ËÏY²€ˆÒR’ìN*Qÿ¥©Ï¾ÚeÜŠo?ê·fìÉÏE¢«òÂà™å‡iðß-Úužûõ;O»ÚEƒ–}õñ˜!g\’¤ï=.²q#:S÷¹ÝåÇNw¸|ü1­XAƒÑ믣ôð Œ[³gûÙrO¼í33¹Žºÿqó«nx˜9÷;= Jëƽ.ÌžM‘‘tà@Öt€kœfþã6oûÌ›_Ç·ß8Ç»?rܸSæÓOiõjúóÏ›Ÿ`6{o½íö\˜CbâƒvE¥¤øø\Èý””ÜùFK.¬uIv>Œëïii¤=ðå&Y­÷¹Œ4:t 5ЙºçU°{wÚ²Yw§×3)vº©ÉDÌ”ósÄ¥”ìã#ÓÓ™ˆŒFRUb~ (×é2>Ì}ÏDÓhÂêÝq“‡Ó×_ÓâÅtåÊÍÿ5}: x§Ÿ)__Ò?ð¥uçînØ„ s?üu(´)—Ê•iòdš<™Ž£•+)2’ΟÏêL-ŠÒCA`Ò4!ßäÙ5SîÆdXM›F±±tâCåʑú u“—¹S©͘A3f͆º u“/¹c4¢îˆÄ n7wQXÆñ Œz@a”[×Iž9s¦B… ¨'âàN:õ|Ùèw—‘14§CÑé\·ÜÈ m"žéÙ½ –Å=Âà¡P(]¸p>äÑZu;Ýe$“½#Ãê„—z$O6ýß‚QˆÄ x>!´»Þ+Ðu;Ã<º¥ æ$)±ë'°«õFä¥ nt‰¸ÈeŠê_²b•:W†Ò¡¸è²`.,”7€Î@Á"‰Xgȸ•¡f'Í)qX qëQ#‰9áÀʨo>O§"dO4—kñÚûþ*v#nr³#nËú¥^œ±»X Óå]3ÖÏü´÷„áØS€¸ÈåæÍÉåï•ë¿#È$v&¢àzc_iLZ7ˆ€\æ¼tI)ÿ¸Ÿ{_ 9l„¬)€ÐÞ„Bÿ“Y¼¸ˆ=cqü ‰†ÙBÜä:{idÌâ~i6Rt¤è(íìÆeC^qJ´nЙÈeÒPªGËv‡7N¨o,ù”ÎrΪ†ö˜»R%ì»AÜävë†H–löAïָλqÚHh8ïqW‰Cš²¶BÖHØwˆ@ÜYÇ¿%Q¶£ß¸!â —1sê¾×W/ÜÃ,%¥þµòg-6 {o ì*ˆ+LÄœ¶?râè.³vùèñ;Š¸È;i‡"Çî2ëg“ªHGÜä‘r(r|d•7w k 2´9Á#ºS©ñ=fn:<³ùE‹dÜ$q‡qÚT5íõÑgÛ'6³hŒãRˆ€<%Ù÷Éžc†¬ÛÖ!‘8öÝ@¡ç6æ…G‚\W.Jw|ñÍjik ¿ •AÜä2¹LsÖCÿR•PÄ @îuœ$øe§…|oX›Õ›×çèý»“¯_õ+Rì¶ó0øøÚÓÓî?æô†ë×â°,îKtq¡p:vü8gÑFJ¹pá‚›åŽcÞ°¢H!ä3øúúÎ<ð.¥l×®]­Zµ°tкòDXXö‡Bˆàà`”¥ Ñ)@Üâà>`ß xf6›Í÷3!BCC±,þuáÈ@.’R2®EÜÀÃ…}7€¸Ä â7€¸A qˆÄ nq€¸Ä â * ¯ÞåІEÓ×í½a½—Z¹æS§ô)â nrSÊ•sÔgK:m•ÓQ™|€áµÀ›HIÿ2ÔÞïHˆ@g   ŠŽZ÷ÅŽCê )-´ÞA­0¤9â W]9öçÚu› ÙÉ ç¦žˆt¦röÝ nÀà4?@Üâqˆ@Ü €¸Ä â7€¸@Üâqp\!`8Ä @žcæQ£F1cˆÄ @¾$Š€¸Ä â7ˆ@ÜâqˆÄ x5UUQ„|†›ö‚w±Z­:îøñãÁÁÁ‹eèСãÆCe7¹¯víÚûöís?LNNö÷÷GYЙÈeRÊ!C†¸–)SYƒ¸È›ö@T#EÍ‰Ö @ÞçÚ‘ÐÈ΀þ@Ü:S»˜É’f9sæŒÕjuM‘RV®\q¹ïjÜÕµk×:N×CMÓ=llSÄ @AhÞÂf³¹ãF¡Óé<ì[bß nq€¸Ä nPÈ8…ž3ùtb¢#¤lI"&"J>Ü®i¿¨¿À’eu$‰YJÉ ;RâR® Aª¹H`ñ$$³Hˆ9¦¹.ÝbÁ/8 $„DÆü’/œ°;5¢l×4™Š…”,f?—šbÉ>]õ/TÔŒ%‚¸O$%±öË]/hæ“w•ó͘üçÂ7®}²xÔlÉŽ\I.ÓoÖRIÖqÌÆQ?ý°/¤L£Q±\=®«ÚmÊ\#Y£¦õ“UŸ2‘=õrÊÕØDÇ£=¦.ò5(D´ï³á—}ÊdåˆZ¶MD‡fçv|úûÁs%CKe\\)µàÚck5(‹Å‚¸OLf‘rê”íÒå‘uŸ­í=²±«}C¥šmT­4I©˜yÓˆš1'ãž+žô¿?þp¦ë¼ II:#íÿäùí‹W¶ÜIJ®ÔczÕWû†N-ëü͘!ýæ,R˜ˆ(´åÄðšå³_²-5"’þO´mѧ¯&°(7àé˜)îçñ¾OŽ5× “_uÒ¨“êîP13“$–öt»Uø±J‡ön¬Üñ“ EJbfÒl²ú°Ÿj0 aÉ>[ᤊý¾þå@“¸t{I³!ã²’»%!nÀë:R΄Ÿ·Æ7›ßˆUQÉ,öI ¯èúß³ß ßð½ž4kÂŘ*×>RÒÀ:‘zþZ¹vOIÉîD"IRß’bR*A¬œ³•,o â³_¾öõw™—[µ¾+žx2”ˆ¤fw¤[œ­©3øêt¸Oâ<±ic9¿…‚+–`‡æ¤:ƒz}5kŒœ³˜™ˆd¹îóë—DÉÑ?ÿ0§“ÙüCµê¡¬°Ð4âÌ«)tkÞHID‘NÍxZù^Ÿ7­]Æ=–®§pòþU_Z“1Y³U¼£^˜‹qžÖ¸!G–~"Óü"G?—@$âíZˆQGĤ95'‘_¹çZul»ú˯«ÖP¾ÌÕ“¿)O6Ó2†…#]S} ·&™HNZ…Sf¾8…óÖ.” ¬órGì»AÜ€§÷¤X$8”\ªï‚MúŒ‹¨eìâf?®ù­ÇKÏÜøD¾v1^õ+KNªÑyÕ§“mø|Ù¢,%)ªøsÆs—_ï8¸}öÝ2Lò¯­µ .&l ˆ@OJ¡¸ß¦”jnÈjtp™~3œc†;úî&¢sëÆnÚf )Sãc­‰©->˜-œdª2¨]ß„Mï~šÕ"2WlfEgðÑé)‰I³pÚœ»”¤¨½Á(¥d&{Z »^£èôªÑÄ-r¤§Ê›·6˜ý„=M#Õ`È…5ª‘–l×2¼^öñnZµjU¯^=´nþ/¥êpãW ø‘âãw›pÆ“ÕhPÙ¦3Ì·y éo77"ÒÌ:,‡œÀ5S€¸Ä â7€¸A qˆÄ nq€¸O‚K4áar8WcgŸ¢iš¦iù='+$æYªÁ”ž–êñ‹PÀC#¥dæï¾ý&ûă=zô¾†¤x€Í€ò† ¥,UºLÑ¢EÝ_PäòFND»tÍ>1¨HQE§ÕŒ§sIDAT* ºù 7àYЙ‚‚»7yÎh4úøøäó®âH¡ªž¶yâȸv ²ÆSK¸€|‚]Å€¸Ä â7€¸A qˆÄ nq€¸Ä @Žý?_öàœolÁIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/threading.png0000644000000000000000000004177113051004444023062 00000000000000‰PNG  IHDR áÙwösRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ .S*¹­ IDATxÚíw|E×ÇÏÌîÞ–’@I%¤ÐC¯‚”" ¢QõõQÁF±€6P‘" "`@@:„¡‡ÒûMrËîμlr õrKÞóýøÁÜͽ7»S~sÎÌ™3„s‚ µŠE€  ‚  ‚  ‚  ‚  ‚  ‚ (p‚ (p‚ (p‚ (p‚ (p‚ (p‚ À!‚ À!‚ À!‚ À!‚ À!‚ À!‚‡ ‚‡ ‚‡ÜÕ\á¬5x‚÷ÿP øUeá.} BˆösEyYYY9áœW]­5 ^­Â´+xŠæ  £í»l©¬Q§Èª2B)­ ÀcL•Ë_õà¡l«@y©·â¯_$@jYÅ]û r=èÊå†\M1Bˆ’“Ò5¾U^-é„sN)}mX¿“BÓµÖ¯O^Þ¿‰½c»áöZ¤nÀ9!|Ç‚©MãÛôé×·C«ØǦü ¨8Ú_WÑiÿ(åÙcwI/¨ „¸l¹¡ÀÕ@ É9™2ïû9ÏMþ<¯B¬-½Ÿ!©ÉG _|i¼ŽHž¯½2Ö/Ù”S‹*Ò÷¬ùã?g|òå’%K¿ûæëÂu³­ÞŒ­úzÚ½6[ñã´×7È!•Å颈X_5¡$÷Ìñô³×éh-Ñ7MÞÀæùÖôw[DiÕâ2N@gp«Ef>²¹Ð3éþ®- q‹ö“šž.Êç®Ý]]Æø%‡–Nÿv뙘`ƒ‹ß,Zp5rQ£; úî»/ŒiV[,ι>tÀÀþ~”åŸyîãEú hã^›ÖQû {m÷Ê×9眳üÌ3»ö óñ#¨nÿË9BÌçSÆNÿkòÔÙA‚ÅÅo-¸¹¨ÚV›µVÍÝG'gMžüOʶ­úÌyåjÏ$<'Dt@y¹ù¹qOdœ9Ðjľ]*­;T¹«9§Œ)*Lzú±~Ò7Æ´Xqõ†‡\¡÷á–Ò¢IcÜ–nŸ»2¹™¿¡* Ò…½ë»jÕƒn3?ŸS‘¹cà  ?wnüØÀÞµä oQ¹QzfñlMÚïo)8öד‡ÛWï¿Âx•K§”=7sý€Öµb!•,¤E«ý“ÆgIv‰ òÏ>šùèCïêuèÓ\³‘»ÅÏŸÿ³öR):?v`÷·¿þ1ØCtYÎ õîS/xðõHª?=sóÓWþe­Xfàhû.ý_|®è¡{;e•Ø$7¿Á?3¬GOŠ תµ»ÍZRT`µÙÀCtÙf[µœh½Õ†¾ÿÿ¤ƒsÎ VTX`±É¢ÎP§Ž¯àêûŽ\ ¦Èy9Þu뉂ëF¢À!ÿOG¥+ºThÀÝÀAç\Ö]¶ÜPੵà”*‚ (p‚ (p‚ (p‚ (p‚ (p‚ (p‚ À!‚ À!‚ À!‚ À!‚ À!‚ À!‚‡ ‚‡ ‚‡ ‚‡ âTðÐ䮄s®(Š‹ç£&„ˆ¢ˆG< À!È‘›“={ÁÚr;sÝcš øèÔ c‡™LnX_(pr\8Χq—àºa®|“Yû’‹ òQàPà䆽?à.l¾UyÒŽÓ¦ÇP¡Çz;ÁE¹…*,I’ãgT7´à¤ö`.5ÿ½îoÿº`µZï»ï>,8©%”•—m?™âåã 6›-$$$!!‹Aj‰‹*Š¢æ¥ªª*–ÉmçàACACACACACACAAAAAäjàf{¤vÃ9ª#BÕPÎ`* ÕsQ!œs-æÕ¿ι–Ú 0³ ‚Üi• ã÷‡¶ÚdJuõZ>Ы¿Àá_‘"„3&¹QPA¶]5'%!œ©Ä#€”ç0.P”7tQÄNóÉBç÷yoÁÀWç(§–Ù²ŽTYmœsÎJôÈâ7¬ßN4#­êºvjWÕ+âæmûúž¶^”p,W´àÄePí¶rP˜.aàËü¼,¾s²Ì#'vü­¨Ä?¦{¨ŸîüéóÜ´³Qb¥èè‘mëU…ø7íÖ4N)>~pÃjE¥~»ûùZCú–”ÆÍÛˆ¨qhÁ!ˆ‹™sÄèãf,9bàÀŠÙ~M“µë•¹av©èP¿ž_xŒd¶.˜w_tÇ~¹[>.1«[g?®ëݨSÒÞ/Æ3¿* AÍš ¨nhÁ!ˆËÁ90¨N"¹Rsß)W‹ Š*¨ÉÍds«#òÙ'/˜v-¦—R5û§ôsQ];7a¥üÙÜe‰É["fÇ ‚‡ wÜt£"@R~!G h¡cªÁ¯aLï±Ø*òϺûyg!TïÒ¬ÏXªX­Åç}}‹€¨@€ŠÄ|b«Ú¨%ÕÏDÐEE;¬oÖó{3íJßöÛŠ™c»Ü#+î¦ÜÂì,ªšw/ŸG0¦pfQH”›.3÷|¶ÀKv-š]áÞ=¸Î‰ƒÛ ÓV}õ&H:Îl²Ë-8qx4lo:»ùÀZT×yÒªú!žªÌÛž±é‡7÷[ŸÿÕë‰_Dë¿æ}Ù¼e‰s7ÌžpЮ‹ð¦»IÓ’WOüÄJ!vì27AhÚ«Õ–Y¯÷ÿ®^­¡¯Œç@ß–‘M[G»‹}{vý“ëçV·Áu( Péß@_U ô%„u@¨2¨ '‘t [9Ryݪʈd¨z©0AO)Åz]¾û“çêsöxûÖ«Õ:|øðØØXÇo'L˜0kÖ,­¢Ì¡‹Š 73„B¸Š½ò?Î4qà X¹ÝLØ-œsdí:@ˆö’3„R&ƒl§lcxþùçÇŽK!í 8¹%ê§ýPõêâ4!#ÿ¾v\«)œóÐÐÐÇ{lÙ²eX(pRÛ¤•sÞ¶mÛÐÐзß~›Tm«À’ACÚCË–-ÇŽ;eÊôUQशqœóÀÀÀ–-[~óÍ7X&(pR«4N›Ý»ÿþûãââƾ* ‚Ô68牉‰'Nœ;wnõ‹X2(pRKÜÕðððï¾ûc€Qà¤Ò¥K—N:1¢2V88©Fœ¦h5zöÙgqÍAj§¯Ú¦M›/¾ø×PचrIIIœ6mÆÇ¡À!H­B“³   îÝ»/Z´ Aj›£ ‰‰‰^^^Ï<ó úª(pR 5®wïÞ/½ôÒo¼¾* ‚Ô*ÓÜÕ ôèÑãÏ?ÿÄ2ACZ(s]»v ™>~ĈüquãÛƵÁ3» {;¶.©ªj6›½½½UU=wú„¾¨Ìaæèt:W»ó¢¼ì'qš–5lØ0((è믿7nîåBCjƒ´9:ùÌ™3ׯ_¿xñbh—ÐϲÇbÍÓ~[PX¸vÕZI¬a{&δ‰<)ñ®[ljŽ*<øàƒû÷ïå•Wf̘qI!(pÈÝ„Öu-ËÎ;~øᬬ¬)S¦˜L&ÐëõÝ»tp¼333óÄáý®fÄÝŠÉ2ÎyBB‚^¯_¾|yÿþýèº&8‡¸.V«õ£>ºçž{ºwïž••o¾ùæ¡bŒ1Ƹ‹·à¸,MËš4iâîîþÉ'ŸT·pqJ¹›üS½^Ÿ‘‘±mÛ6íÊñãDZXôèÑ#))iܸq„€€€ÒÒR´àÐEEîuÓºëG}”’’²mÛ¶ÈÈÈððð«9b”R///I’\ö‰ôz½³nϱ„=`À-xÖ¬Yo¾ù&¶œKË ÍZÄ5Õ1F)}ûí·_|ñÅ)S¦ÄÇÇ?òÈ#WœlÒüA›ÍæÊ& çÜh4:k¦LûžìììÞ½{€K«ÕMû;RÍpk˜®ÿ¯#w¢äo m˜ÍægŸ}våÊ•Œ1A„K`¾Äe» ¬ §ª!„Rº~ýú­[·öìÙÓÝݽoß¾¨nwÞ‚»¢‹qÛÖ¹]°úk~K®ß¦¯ÿ5ÏtÒ¤Iï¾û®$Iq»wïÞyóæ:ujÅŠX,·Uàú¥5_2õÝ·vJ3D)Y©II½Ÿxb¬£žnCk>—qö±ß1¸ûÜqkŽ¸óï>ŸYó¯ê?üq¦÷׳O‰ {’/>šÁ9\£b«r:uÚ¼y3vÎí_„EQ4S‹EC¬a™BUÎ5ÊÔñ†?W®JÞw6£˜wH?ôá:ª T„“Oxiúš ¸¿¿Žo«9§O¸gÔ+¢8»Ó"¤ü:Û)_åݲÛȧTÙåÜR£l˜ýÀu©›Ùl~ï½÷6oÞŒVÛ y¾ŽE½Ôš Ü%åµ]N‡¾2q‚7¬YRR<%ŒAEq¥­ÒàÕ“yY£Ç=÷ãןކº¨h­0[Ë€©w¸ô˜âœ›PeÙjEv½&ÆsõvQÍ3}ýõ×gÍšu·øÝ.¥qPmŽË­FG±Ùleeåë6ïðöto߶•H‰¡j ¼ê_VXX(JzOw7BȇÎôì<Þ?8œ©œ±Ëꀃ—_PëGg>4lè¯ Ý¢ð‹ȵmŠÛÕ0ÈUgUnªj\΂ƒ+<"\>:RJ{õêµfÍmUá:KÀjµ2¦^é/¸‚ èõzT™»CàúUŸûýÒõ;žm?ðÙsK¿Zí%½[GvìÜE{OÆ™SÛS3~^¾¾~TL‚¹aDxj¹ûúáL½êbç\§“¢û¿œ²kw›Ö­þÿ¬uZ,Ö}ûö9zuDD„··÷-©qÈÁM¨¡öipí µK(++K=tÐf—@UÕèèhíñnv»}êÔ©kÖ¬áœSJ¯_â_xõ-ÿÈæŒ)®Y¹ž‚ý™Q¸¹{ ÐÜçð#^x}z‹‡Þº·—6‡Õ¢Ûœ«?­]”™ùóÐaü¹bÅ‚Úõy߸n@ 4?û¯ôÔvýâìZK¥„Æx@Dü²õ?Ä6‹ÑB"k½±M””¯^½Ún·kVÌ€n‘ÀiÕgô¦Pm`«àüFJ˜s.º^ÎU~Ÿ"……EË—/—UûJi«V­ª·¨#FÌ›7ÏÑ6®ç˵7_(´µ3Ô^¡¸¦ —½?¹¸¨È%î†F¤ÿ‡§É ¥ô…Iÿm1b†›É ™cšƒ œ&ö{(eÍ‚Ö'}¶pýèw>*-àŒ{Ö ôöTÕëj»:½¸ÿTÖĉ/9ªeË–Z`g-Ÿ=©*Û[Âs®w§¿=[ÄÃt‚Å#¬s§G&yz€!À™ö§ 8ãœJpUû‘ äÐ;}<žZj®Õ¼Êà:äŽÃ¥+é•È²(´ºg•HÚº/³òH»‘ãtòv/=r4Ç‹˜Ü^²wÅ—²Ú¢ÿpAå„ðë™»D»5ÛmÖ¬Y .¬­3ˆX•¢Îúþ;íÿfÝÙ=z*‰<}ã{ïN¹c\qaÚÅ?(äusŒN&¯½GÀÅ&É ?'…§3Û·mµ}ûv??¿ÄÄDÔ&gŽ“Àí`5ƒ[ýVôÐ1vjá–J’}uå¤{ºÎ\{æ³ÑöÄi!yËRö§6,YTH»¶èâ±ìíg﹧ýú¹ý°òƒ?ý¹r|íç!í¥§ö-û¾Uÿ17Ù )íÝ»wrrr-žˆ¨¨(OÙ•R7 ìv{§Nî¬Æ)LˆNìj·¸bYéÜaËžßJ9p4íLkz…æxÉ•,à`¶Øc’$%''·nÝZ´ãœ.t„Q2Üð—Ý\ÿŸoßòjØ07ãDºÜ衶õ**ž 躷_iùÜ»î¾à?kë®]ížeòƒ?•Á©;Ï/£ô Ú* $Êobó™gžINN®Ý5[RZú÷ß»½}ê€ÍfssskÑ¢Åâ¸K®¶s¸«á70Éu>;/(<úVçÕShÛãþ‚ü<íi‰QÝœç4Î Œ^Ä^rÆn=L’óáÞ˜îk u‚hi–E¡üØ®'|L:»Œ&È-²{…Ù…&w(±r¹G@ƒnã¦wôU#)ðo—Œ±O?ýj{šF@ Õ6B\9›“+ Οs¿UÔÂâßh?Õ~k‡\ÎA¯7”––¸{zÀ… ìv»¶'[€Æ•løp”Ä Km½_\wÄÑÿtývµ ü'x{tHJœ;º»ÉË»íãŒúï²é}6ó¿Ä©}‡5ùñé{-lâi?JD)²uÜ¢7†KrNÜ°onnØ­¾|Tëk›îõ©œË8÷×_«ËË+ÀÃãk×®5ÏA——IáVUÊ6~ÏèIÉófÞ›Ú<.æÜöÝ}“îõ«€^jÍÍ {9ë3íïÊåö n-ך½ƒà*ØÌÌ'aøãs†sJ¨<ô‘ÏW³ƒÙ ÏI!€RÁ!ñ±Q]ãŠT+qFó¤P\R²g÷«Í:®]»v·UàJˬÀoC7› =™;Ï=wâµ~?¼GLlü-Ö8Î9P‰´ò)¹ªz­ÕÎ9 a ²» khöò‹æË(%UW8¡T°šÁøa+«Œ“£ìe•ÅB¬U¿BqCœhê ¢ (ˆ¢è”¦%^gß „°Û3WBÊ]¢„€Ð訄F¯NmÎ;þõní"AöÚ¯ŽgKÆb“ÄÆWIÑ&æ+_àT$Y›¾1G>Þ(ˆª¬*f¶Ú›9gœWºcwܽRbõ+xe`ä¦=¿ï%èv!wôúûFxý@EBngÎHN1ðûž~ëãï~³Z­·V0Nζû7izýûi‡çT$zè DËÒI(Ñ™@§'@¡ô䆜R $#àœSÑ»(θ¥àLFúqÜ5ûƉ¶œÅUYV‰ ÅmaAj»Ài´Ž>¸õïÛÙW+J8‹MDàV§ä¥Ô-´mdëîá­’št¸8ï4!äBÊÏ?=Ûí÷O¦)Bì…GOèúç?‰F ‚H èô|íô¡GNæÜÈ©?§÷̽¶ï’<Èî™ý7|4zF±(»b¥s̲ë»ÿ¬>4#»B Ó#µ_à´ôâ-ãc{ÁÉúÍ!¾S¿~÷÷_·n,Ëp 3žµ¢°¬0¿¢(·ôÜ&£›­Ø²ýïƒ|¸¡Msºiî¢zbá«ÿéüÆ?Q°vñÌ_¨^\Ù·|–gÇIÍùY<íXQô˜WmzsÏÎìæc¿Š>-.Ô[Q¹ë[BšoÍÌiV·f}Ÿè}`ÿQ@…Cj·À9L6O/ï¿¿‡1õö{[œs“äZ¤Í›6Ξ=Ûl6_-=MåŠeG~ßµü«½+>/´5Šˆo«š» ’¶þçôÓ:œ\õMÐ=“½ úÑyz6ãÄ-kÍkG÷îoÔ¤™Ýb¹qÚ‡Û<– žÖÿ¢®*wK˜!ýbÅ‚Mk×–vïÖŠkc ‚ܵˆ×Óî52âñöO}D©PeTUæ;'T›œç,pyd<‘íÐáþ1rÞ–âââ9sæL˜0áV8˜ɞÍGv¾7ÞnW(‰D*ÎI^²§Ýg‚[t;ð×b›\¡“<˜ ªÞÁÑÅ;ÊÝ#Ç4ö:p`÷®ŽZèŸô¨ÁÝCDàbþá-—”¡‹›pÔ@3–?Ïê¶Î9‘'”®9xÈ¿I‹æØIZî¢t8ªÿ”o}"ó…§p ‚ŽœÙö›U¾ÈžªtoЋ$„”ç¥fž¹<2žPUˆLè`·Y)¥%%%¿ýöÛ­Ð ®*¨ *H„àÜÞÝᆆD†ùËjµ‡ÆõÉNý©´¨¸èÔ|𒢪î ¢[uÎZþnV©âím8}ü„ÕlÛöå [þÞ/IÔVQª¨ì®Xdà@tØ·â`ǧ_лîÜI¯ú…7ÂÔf㜗™Ío|øÍÐ×~,¯J2^|jÕš÷Gd%\0ÀÁ%SËeÎH ‚žœZþI#:½¶¶‚”ç ê+í3Ñ’¾R‚ ‚Î%{²ÒÎPz‘wÄ9xøøj_²³³+**œ; Çdè5¡y³Ê,â„0;Dõ› ·;²}ƒ•xº¹ëöéЭ[ê_ßžöeå‡gž)myrÓÆNƒ‰Eæ”úå5CËQ þ»-˜sΉc·Z^^^NNNƒ œYŒ{Dwö¨ÌïT©ª‚OtB¿èª W ê%©G*禈W7ÎU•ûFTf=‰îý „qêQ¿íƒ/Æj’…œhIÓ¾ûî;“ÉtëŽ#„p™û·}_ÛQÀ çÕæŽÒUýép rK,8ÍRè7ôѨؘ‹’2ª6߶O´ Ëß°t+¡’6¼TØçžÿýF—|).À/,fä¬ÁAgRÖ`±\X»cc*È¥%¥^¬,ùƒ§ôšÔ,Ö{õ'/Û`eiû×,ŒíÝ_µXb;¾èÅlÒ,"*šWkâ”’Âì ¾>¾Úú©ªª6›ÍÙ¥A.Y»Ð2Dû®ýž“ê3kˆ#ŒV{!„k_Å+/^§ÙUVVVPP_ íå‚ ÜÜÜbcc?ÿüó]»viË,Î6å´iUàŒj¥ Ë‘8­<óóóµ'­Þ oø©9ç$cå¢î †põ/¾ê÷W¾ ðèðZbÁBæÍûèÔŸì–K#àíæ¦#f¯ùlYï@ˆ5çdF¡žž¼'H:ž¾;ÙC§×yÖ jTòãoVõAS½Îlí÷E>p iY~þ/)¨GT|S¦49wôEk‘™€.²Ý°†-²ö¤§,›c+ÎüåL´%ŒÊ8{A„ôƒÛtz‡Ž”––Þ†ŽV9X½ÛUÅçÁÅý¤ÚÛª>ycqÎSSS322.¹®(• SSSÇqqq|ðA¯^½®(R•ÿ¯Ú™pÝéq."GÜþøã©S§véÒåõ×_ˆˆ¨~TÛ dZ"IEË^{Üb³qÎýšöë4ôIQ¸l$#Dg»åêßLgL4R `·Ö:£’sp,ùWÐ]ö@縨oNý`ÊòQ¶ŠKÝœH~‰÷ìNÙ+ ‚ªZ$·„¾Þ±Z€«oЭo/ιwx#Ÿô»Ó<<â}ü7žÝ³1 ¼Wöbà ˜¢R8"PÑ3àŒÅ þoHá’õß~5è?ãˆúoçu°üó‰/<3V˹LÉÌ̼†áysáú'ÅþÝ–u±'Å^µó†þ:!¤}ûö±±±— ÜÈ‘# !&“),,ì×_‹‹»ŠïF8p¹"Û8Q2ÜáLÙW§°°PU¯uœ ^¯ÏÏÏOOOOOOÿá‡`þüùIIIžžž7–ËžTKIѯÖ\ðÆŠyß zlgÕç?ˆ%{ÿžMÛ; } ª€T[Óô4má„t¹kï‡îW”Z¥o•êÌf.¶YÊ€HÏ:’NÀIõmzÕ¦H®1l::†¢+n¥Àñ¦-Û;¶…þ{•Éœs<¦Ç ?^{0ß*¹ù55Ù·íß°×ß߸á“'›=µ¸Z^R¢øÕ‰êýÀ¢o§w{þç¶-׬\ñs¯ ó ¾ÁrÖ£9ƒxÑÁâ¢rÉÃKf2cšýÏôö¢€>ñ›>èôÉ{ÄUmf€“>øÀÀêå ®áÝœ={6,,ìV(!@E’šücd—Ñzñ_;1Û¹C;êÇt–ôT +J;’šÝ´}G~#ŸV?¯ zs¡Ç!_ÿ:D‚Ž£^N]ý q n9l²É¶°¡ár}ÎÀ#¤…NÔ Þrø´ü"‹c àŒMYêa¬ÞêÖ­{›oÖ¬Y‹-†þä“O^­î J1à¬ò8<*°ª$"(¨ ˜‚L怊øÔo¬™TàÀT Dð¨SŸ ´dn×pæÆ÷•s¯2%Ø`2Þi{‹wïÞ=))iòäÉ5?}•È9¶épº8ôÕ(àP’±}ãÒOCþ3-k÷BCÄoO]æ¡ ^!1;æ¿žwÖrï;?¯ýÞظݩ-+t}&¸gîö¯Jꌎ7Ø2·dæsÿv|ÛÉgjÃÍŽ®ø2+Ÿt9ŽT0¸½'I]ëY**üëEð‹Œ!œ{…¶òò©Ã Æ%ÿ„¦]é.zF´~øõÞOOnШ‘jçîúõ}aº¯‰ª¢³îL”«bƒ&]î×Iœ÷‰îÞý™÷º|Öϯg\Ð)0¤çÜÝ?ªNý„·ºÃ7Ñé‘Où[>—¢Óé5G–e»Ý^§N«PZZZVV¶iÓ¦qãÆBFŒ±{÷îKöêsU9»sÙŽEŸÝþ¢0ÎYáÉm)‹>>²s3Sm[ôMIñ…““‰ïXø1£„J$cÓ—¥ut«ÊÀV”¶wég»þœ_f.ç œ?ªuÏÊEi›ÿ(·äe§Ÿ$T¹èøßßo_ôEn~±¨#©«>ËÍÎ>ðûgûþ^s[/™é»Æùd@ÖÆãÂê?¿ý:ãØ‘¸q×óñôlØ.®K—¢Œ”›öúîÿmªìåë^¾mÞlvjÑÚåÛšuíñûÓm¡»ç½fI*Ú=gÛ؆{WÍaZ wÆÊ?~MŽé~ߦG0öüòYî­¿°ãרd?´äUðM(ßõÎßg΃ RUõã?îر£¦nNZWábΉ:[~汃"“ÎÛcò Ðé½ôz8µn½D-ÙÇP…ŸË1þ'9ªÃ@/ßàFýg6jÓ^¯×‹zOQ'Ô0îçæ>®-¯ií_„L›6Í`0¿þúëGŽ©ÁÄ4/Í<Ñù!ÊgÀ9¸ûESk‘*ñÂëÊÊdžŸ¾«¼ÜÑ¢•OHŒ»‡tú¯v¯Yæ¹ù³a™Ye'Ïε¥à`湬ˆ„ÉP7¨Q³3zNgu½ ¿;’›n÷9yײà<<=/œ<Ù¦‡ãпJ©çŽáh'ΡDµsµZϳWh+ˆÀYÕ”ÓÙRÕ]+×®àßC«MqêŒdÃâyòñ¿â[´±Zm„’’’üü|UUSSSóòò®fòTyðàÁ+VèõújÓ[$ûÀ¢3§²Ä&žÛ³*Ý·~ˆ1Ïš ;úhûöío®¼k™ÁƒT.K$Q Ü@¨PµbFhPTã §3 €Þ7.iRhˆÑßN>PŸ D Ÿ"¨%ˆ{½ü¡4¿Ø£mPh÷§4<¨V€H]FàŒnçî"ô×åmŠ«:†¯L^Ã!'„lY¾@w~sD£hMÝ8ç¾¾¾¾¾¾„¤¤$­\ƒ9sæ :T77·‹» Lx¨^K’w|«9c‡GâÙú7}¸AB[µY‰äý0ïÔÐï¿2Ú!8°dÕo§€V%Ô×’šPQ'ˆöì½Ûvvè¥(Èr9Ô§^HQ© ”Š:j=™žæ=jr°;sjç BÔÈN…7õôµ%l8žcrî|!æÃ+¶eêz º·~ËN~ÙKœ+¦T{hIUc Æà˜D‰›nY™zøg3µu›º'ÿšC(¡Œ)*pÆTEåªÂ9JáØЇ[ÆùgI¡”X­ÆÆ*¬” ¼üŒÂZrzRQsù°øv‰¨ÕPÚ¡‚ûæOª¨=?©,(°À­YB§˜#«>¨ ¼ŽTÇUˆjqAhѱý‰u³­¡M[ÅíÙ÷OTÜ°¼ä7Îɽê'‚HjÖKSRR:uêèïﯪ*»ι ”R¡ N§•‰Á`عsgXX˜§§g æš©Þ'üBz6‰nÈ0»Å&îÆËŠŽ)x•sƨÞ@½LáÄ-H>g¯nWÍ&sk)t™²%çðêUïÜg³èÏZ*¿+³âµg1sϧ â[WÙzfgtH}à„Cõ¨%Þ¨Q£k«ÛÙ³gCCC¡êüÍKgå ½°ýë+¶$Ü7¦A×ÇPÅB%£fÉ–R™‰¢Ü‚ν*ë#!ˆªUÖ¾†I^I//Í>°tÝû÷Úê :n¯^ÃZ5+œêµ]TÒ“3QÔk3iN¯hÎÁ¿ÍýÒçã½»ÊÓgg><ºá¦£¿Ù·ßèá%H:AÔ5h½î‡w=…l¿ÖÏ׫cÛºó 9Õf¬Sÿ|Ú“—7ç 3y ¢H¨¨wóÔ¾3(,rÖHV¹¢ðøÁs,;uÝwS rZýVcE*̹›¾˜’wê@âË¿\8™DV—9º‰cT4˜–MìÃh1侑c8ãî}aígÏ/ø«Ä3¼S÷n YE¶yÏwGzÇvy=íëo˜åžØ¥CS±É;Þ?ýgáÄ…ïÈ>¯tµîÏÙ6ÿ»óMÂ#£núŽÚ´isµ(N-ñòu¦êŽ_¼xqDDDõÁû¦»jPƒ;f½Óº‡Î‹ÙËóÿl¨ßMá„sÅf1ËV[aFZ`+ ÀµjiqÁþ}~-¦mõìCNKöÒ\&Oï> GçœËzí·—Çt|cî°÷û/{®CÖsXÇí $¯=~~0õ­cV£ÁpGZ&„€èÖrQª(é\[{¥°‹æ8BCCµw:Ôí¢&OļSG¸ñóQ]š‡4í·yÕ‚†Í#Ïmš]æÙ"¡‘ºá—•{¶I™ó9 H"QŠK r-º‚¿¥)õ0E–‹s’Ïh?úÞO…ÏÿàgUÎ+ãdEaœë˜*xi_ê¶c!ºÝ‹¿oøĺ’#_VE”ªÚÚ±s×úíÒaÜWÖÒR•£·‡b‡Ä!ÿµË\§‹B9zmñoVª‚ÎànÒ¬WL1—<[«M&!1ñ*ƒ¨ö÷A$bÚ?@8ãž-ì]¢€Ô¬×“åå6KƒÖ­='J’ÁÝüœ±~ïN£Æ©ŠN§ƒ€¤W@Ыª LG€Ëvß¡®¨ úP@±s „ ž÷Nü^¶sA"LæÔ=¨×Ûë9Ðãùï¹ò:ç¤Í£Ÿ·’êY¹©ÙƒÃßÊj04]{Mÿâû8ß³gOõ%õš¬¥rÎ õãú=;iïÒÏí #ÀÜã;?ðawÿÞµ3óütAñz½žŠ!%g””?&ÄÜó[ Ž,$†À¶b ÞËG~¹-'Ü34ÑÏÇèêt™i©Y =Ûïøj’ÑÍàÝvlýÛ«nð?ãàz'õyºE÷É?¯·VÜ#ŽZlµ¬ÂÇGU™„m6Û /¼àëë{µÕñËçk.foœ4'÷˜phé§ñ~Ù8ëüªûDvìxOO}‡Î›?yü÷n5ü‰ôõGí <ðÂSɳ†xƼgÌA„нÜâÛ$üóñHUðî3á°B@Dœ@¹Î+îôú&¾Ö8ÆV>Þ˜üá³G*Xt߯£#¤Ò&ÝÜMWAôiî[t”W3íkZÂZßQ"™<%.çœJFƒT­!3"=E®pD2y€I yᜠR¥ù J•;‡™¢ÑK¬œ¸ Þ¡1:“»$R¦€JM!M£IOT•‹z¸Ô檪[±Wü{ɨ-Ë@aJõ9bàTE»^91ÌÌÆ®Ô4°Ë)÷õµóû6¦p÷6Æ´¢ç 8#„Rð‰îÛ«IÎ1ͪÓïõ¯D7 :Ϧ÷?[Ϥ2•ðkÛë¹6@e„¢ôk>pÂBž î c„ðÛÝ6ÄÿÙ6Æ?><íÐá†1üN­“ŸµƒÊ9Ó̱GyD ©aI™ê6¹ê2 [¡y׎–RÙý©¦}žRe­œ1©ë¤y‚¬0å¨ýWÁ#vÌÃmÇ0;È*ÆÇLUì¼~‡Q zŽ¶r€¸^ª èt‘£¾ùÃf†ö;ðë;åWJA©›…7à¿LUáº&6‡Ø¿²ë„!áÒIÍK‹è’ ž¼Ê³½Æ`pñ7RAjØë!¦TŒ²½Nû¡}5›È‰KN$É¥3½Wúé %tÙï$L.KÕ£Q¦¯Lƒ@)eŒJµfC9.ƒOT+¦ •eC¯|Uä)£•ŸbÜqdÉm.@zíæœ?ûä£äØò¬³i:Ã8£×àæI´ÕEQ{챘˜pRd£­Œ[Ë€)`1sB)—¹Å vke,†láÖ2…¨}ƒ À¸Õ v€ ŒÅ„«`5kGLç\U*ÍLK)gªk±örn5s•iÁ±PÝÍ@;ãââÉÙÛךcoÐ2ÜÐg™rQ§Pe ¸¾öÈü{X©¾Éººù Š…ÇþÐGÇáâ­ŒÕíÓ꟪~¶‘«\åQúö”ÿúž[¹aÉOÎrºÎßG™â˜¶0™œéUûEÕyqmq‚o`T#§ä]ZKŽÖpiÕVkÚ÷“K¯4Yt{]7½7]:ªk…%K¬#‡+ˆ/ǽæˆ6@ÊwEK¯çI8çÏŽnT‡Àm ?<¼ñ—´ýëe[9ç·¥­«v£AÒþ(ŠË—/¿­…zñþùZÖDƒ¨7@ÁÉMi;;{tUòOìÙ,êÏßqîBXrÓv.IÛµÒjcrîîs©ÛϤŸAK ¹‹¸Þ38ç=zÞóÂð^,}[ö??ž;ºûö¸Óõëê$Ç 9”••Õ6 ‚ßá?n/ÌLO;]7ª•-sM‰]—±`R¹ RæM·+ºÔuK¶òññ9¶m•œ¶vÛªå>uë¢ý†Ô*sø\œóظ¸V­ÛDEEìOþIÔ‘[v´U•õ¦ÈÇ·¯ÒéôŽ{Ð ±ÚœˆÎ§^\Ǥ’ŒÔ´}Gì6!nÈ Ô?weÚ4Ð_8°bù´Ç“¿žr¾X&”Ô‹¿××Ët òÐ!ȸK|ÕQ£FuéÚM(;_a.¹EG[9°[+ÊÏD±º’RJ±Úœ8“RræÐÞä%aíúEÅ5U©ÓtHÖÂáÑP‹MÔnô7kùpuë–qŒ ®·HŠ Î8‡ÆuîÜù‹/¾šùä=^~·ê|Rι»7|ÿÚÐ6í:2-üÆ‘>{—“ʘP°äý‚KNü½ô­±¹…ÊÑÛ÷z~ñ=½ý¸Î+¶u³yãz.˜<Š¸­Øjµa©!wâÍ},,<|Ý¿Nžóm—_Qàj˜‚ äÐÖÝaÞ¯À9À:s–íf-d-Ým-€3–lVE(HO}BÝýý¸_ü€Ç:%zMïCÁjÁãÚkÁü{Â@dDäèw¯]èæE.Ï£½Gg$Õ¯;Ì=Iÿ?L¿ü g.›žØ¾½–­[{§¢(Z¦œrŠLZQŒ‚¥„—ƒl» ÓSCÛ>d´7(/äåÅ€€ ¬tN‘Ú.pÕõ«g×ï÷öƒ]:Œ,Ív*¶ðýWì6ËEî„XËK—|:E”.u65É#EY>í‘ÍãdY®žW’¤àà`ZºG“e¹gÏžp·œ‹ÞÅ?!ÈÿO«Þ Þ{æ”ÉodüµŸ‰FÕn ôôïÑŽRÁZQžüíŒgf•w@o$ÿü¶¨i !¬Aƒ‚ü}é«wÉ*“Ub'”PIOT7‰Gz<ëµ´Ùl—¤œ—$©]»vÎZgÐ’/¹‚§ëäƒÿ\ÏwçW÷‘QF—8GK5šL£óË/¿èt:€Ê¬{Œ1½Ñª¼zOÛQÓ{ú¤¬^\qxett´ªª^Þ¾Þ>•í[Ëhä˜ÈÓ–M¡ÚJôîÝÛà´¬MœR ´*A+¹Ù¾[³J¡æ}¼*+Zã'ºòF©ð?Ž_BƒqeÓ4(&&f̘1K–,1›Í’$i9çžž£‡ Hùz\Ú©ô¾}û†ÇĨªZ}ô–eYË0~I‡ºÙl¶6mÚhæ›S:CXd4IY\’½CKÍœŸŸwäÈÑ›ø^o·Yk¢%„ÙZ¦6¯¹å!mü8áرc™™™¤ig %ÜI¹ê(¥:¥‚“z—\Ÿ;wîèÑ£QÚ»À‚Ó”(**êÉ'ŸÜ·oßòåËÝÜÜ4™³ÛíåååÑM'¿=mݺu¥¥¥´*…6ØíöAƒ-X°@ÛE'·ÒΗ2dHBB‚³ÆyÎyppð'¾à¸rìØÑ… Ýl‚ý;™„8,Öš<Ô«“^t¼üóÏ))»DQñX Qõ’-Ý»w;vì7ß|ƒî*âêœãg//¯nݺuìØqïÞ½[¶l±X,Æ öññ€‚‚‚þùDZsn0"##ß|óÍùóçkçœÚív-k3¸¹¹=ùä“NŒ ¹¼#©*ã7}VcÍïË}û’oОȅæã®ôŒÁÁÁŸ|òÉçŸþÔSO ‚PCm¼¡²ÒrܸÖ]U.è;ÿ¶D' GõxŽ¶mÛ¶mÛö+£mÛ¶‡ÊÍÍ•$I;G#))ÉËË‹òÄOØl6ÆXVVVVVVݺu½½½µsƒnÏðî zàÄÇ䮥pWv]Fc—.]ÞÿýW_}õFǵ7—–––Ûìå ÇâRÏhµZt®T æÂC[þRl2p¨iÑ‚ˆwÎÞpƒ›Én­pºÆ‰NG·9®»¹¹7îÔ©SË–- 6l˜Édr¼_;¼6""B;DãVtûÛ ,5¼ §tQEQªÏ¸Š¢h'ªh+666,,¬wïÞÉÉÉ7tÃÚ›ìÝÆv`®!äܹŒcÇŽ×Ĩ&@9p'®l{¸™|£"\g¤™ýþdÆ*ýŽ‚ÂÂysçZ³³Êà¢Ó jØü{vmoµ9y;àíÎ Q}”®áv.§ßËøs5º¥»b>«zÕ3ÆrrræÍ›7qâÄëϤpùŠÓþýûW¬XáRϮӬݒÕj>|xµ“yïp£ÊÌÌüòË/]Íæu„OèõúgŸ}ÖÝÝÝ…,¸›+î;Û"«Ç£¸TßíÖèuV½6ßÔ«W¯>øàå—_¾éÇ”eÙ¡&®Öc]ó6Hm?enz«–SÜØZ£)ÈMÏc8–V›7o>a„‰'î5¾ƒ TM׺N|F«¹ã’§™u‚ Œ;öÓO??~üM˜Õ„www—GAŒF£ëÜÑhlܸ±³+:7ªÑhÔÂckzW8Z".åº8p`Ú´i .¼Q³Z­ååå.û€Œ1Œø»ÝÃ' âjJ§ªê‹/¾øÉ'Ÿ\¢}‚‡ÜõvçüèÑ£{öì1bà~U¤àùˆ+·UóqM›6ÕörAµ”Y8#(pHmÐ8 š9sæĉ9ç+W®ü駟ЈCPàZ¢q”RÁƒ¿ûî»ýúõûí·ßEA#¹±¶„-qM4_uÎœ9š£ ¥¥¥Zæ4å´à»ÞŽ³X,k×®õôôÔ®®6 (pHíÀh4.Z´hÓ¦M¯¾úª^¯///ÿý÷ß±XtQ‘Zâ¢:þUUuìر»wïÞ·oŸc‹¸ëG܇½x8ä®Ô;›ÍVTTXýW»÷ìùê׿$ÑåÜ‘ˆ`ÿŸz”Þ®Œyyy™™™ñññØZà^Tä.Š ½^_]Ý4Õ[°pQû1ïÙÊ]n¨ÎÚ»êÂ…ó!¡a·Ú€>ø`öìÙ3fÌ@CCîb#.΢ :Ž ÄåÜ2Aè-»'‡º-]ºôÿaÆ¡Š‡ÜÅFÜ= ©€ ôrv¢OÚ½{÷Çk/µ<An롃‡rró@–åÖ­[;WzÜÝÝ{öì© \bbbll,îÛECÛDiIñÊ•»¼|ê€Ýn×étΚ Ó„Ò`0ôêÕkîܹ%%%#GŽÄ(èËÁ88¹•L;ìK!NÉ.YÝFûñÇ-KQQÑ!Cžxâ ´ÝЂC»˜ê+§3fÌ2dHdd$ÌŸ?¿†gË¢‡ ˆ«h\rrrÛ¶mµ69çZä3ª ‚ÜÝÒFùôÓOÍfs·nÝpÁ]T©=ê3gÎ8p`DD„Cï°pЂC»XÚîçï¿ÿÞ´iSÍ3EiCCÚ`¸i7mÚ4__ߤ¤$§Š.*‚ wÇ,ÛO?ýôÀDGG£í†‚Ô*çtõêÕœóF9÷pe8Aî¤s S§Nõññ9r$nÃBAjáÆ9_¼xñ}÷Ý׬Y3”6´à¤6à²yóæBâââ(¥è™¢‡ µÄ3%„L›6­ÿþ111虢‡ ×c¡@(hZqE›¨òâÕÍ%ÎÁ¤át«Ê’œœÜºu똘MÚPÝЂCkÁlegRååä0gXÃ.{ˆÊÀ!œsbô$–”’«úœD  Û¹Gªú¶„¯¾ú* `РA¸ -8¹.ý`öò#»÷6OžÐgŒÉ^öRR‰ „ðjÊE$áüO<.¸SRÍ4»ÄLãœزkC2!à,®z4ïgŸ}Ö»woT7´àäúS@ˆ è œJÑ^´eÙ›¼ªÇý}ŠÎ3—”Éàk1g+²¹ðB‘·ŸOIÆÑr³™H&ÿÍDÂK³ÓÊŠ‹¨äáÙ¤<;Íœ#WØT“^tŠ 9¢y7nܬíÄBЂCÕ r4íѹøÔQ{ÎÚ?g]^’[xàÇ5s¿W™Ê¹l·”•Z¾öÇ_Ê‹sòwÌ\;©Z”²ê»ïKsÏ^ú~ÊÖD©-% ãNP7ÇÂÌ™3‹‹‹¨íÄBó -8¹Y¡Óéöÿüƒoâ &Û õÛZ·þÈŸHÀ£~ÓÓ§øµèÇì6SdÂgíóÙrôS ë…6lÙ½¤„RÙÌžF‰s^Cr8§ß~ûm¿~ý5j„Ò†‚Ü´§J€€h€sÛ¶º‡4¶”ÉFwA”8ã|ÁÈmÚ F£aIDATû,VntwD‰ƒgëG&€­ÄdÐpAoÒ$N˜{«ü±|ùrŸF†ƒ À!ÈM‹ŠªÊL¶Nþríêcñ½ú6éÚ8ë@jLÒýõ}íi‡Oy pF%iR/+-+®oáüÉ )*Úϲ•:7r~ç/Û×o“D †šQõU…éÓ§<s„ ‹Š 7o½I姞x/0Õ£AG¾ü[`LèúNü‰¿žÈ¤úÃ?_¢¨²Á+gÑÄWMQ8­ÿ쇿RõG~ü´I€mþyü[Z§ÕCoŒVòŽžýõQ)|wËPO™¹™{©T·U«VõèÑ£U«VŽëXQN®v4»ÿ¾þFÇ߱—õõA2¡\ÙÊg•¦˜ €½‚q ’ÕÎE#! ˆrc@$”€låœQ&cÿc¾lÿ_?ês÷zûÖ«Õ:|øðØØXÇo—.]ZXXøøãÃ-8A ùäœ!r‡J{‹ƒ™A ³¨@(®Ø  ª6'J+VNQµuSªÝ 7éˆwCuCC›÷Oÿý 2Zä šB.ûáRß‘\ñêM¡ÒvKÁEAPàAPàAPàAPàAPàAPàACACACACACACAAAä΀ /‘»-®,Ë–2Ù^aÑ..‘EÒn³ê±’PàäæÐÒá¸ÿþÝ—R€1vøðá²²2—¸=ÅìÕ„‡ 7OûöíÚµKÔ~VåÇÍ™™™®qkÞ˜‘AjjÇ9t„TÅ‚.2 Èíô¦´à¤FpÎUUu–*9åà`BcŒ1†µs»Ç<ø©e”••É²ì”¯ÁYZÉ«S§ðŒ‡ 52ß\VAPÝPàAœ.2 ‚‡ ‚‡ ‚‡ ‚‡ ‚‡ ‚‡  ‚  ‚  ‚  ‚  ‚  ‚ (p‚ (p‚ (p‚ (p‚ (p‚ (p‚ À!‚ À!‚ À!‚ À!‚ À!‚Ü(ÿ¯i/Ig6¯IEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/balancing_workload.png0000644000000000000000000007057713051004444024743 00000000000000‰PNG  IHDR7ŽägµÙsRGB®Îé pHYsÄÄ•+tIMEÚ 1 AÞ IDATxÚìÝe|Gðgî.w—\\/w!!¸{p‡âîîP(/n…¶P(P¤@‹•B¡PÜ)w'Á5î;Û}Þ—\.ÚR¤ôùàövgggf÷™™Ý»eˆ„BH™$ " „BQŠB¡(E!„¢!„BQŠBE)B!„¢!„BQŠBE)B!„¢!„ŠR„BE)B!„¢!„ŠR„BE)B!¥!„ŠR„BE)B!¥!„ŠR„B(JB!¥!„ŠR„B(JB!¥!„P”"„B(JB!¥!„P”"„B(JB¡(E!„|Q  .Èû·ðÚyŸ`-òÖ(œH‰‰bÛ–Úû„…³´R.Tn¤Ì2j†X ‹iXÄ_„P”z‡SÅ\ÙÕ­qEcÌ$¤^Ç_/F 2ökßš"Ëå¾õr,`,6Œ±˜!ÆtmØ€)úEÈØa5–žMeŒÝÞ¿ªYeÆÉêvrée c|ö= 3Câ&–.ƒg¯CƱïº×ó°1fHýÈ êf-ä-ù×$@ÆX»ªæó‹*õ½2.Ι_Jç?Àý«#–0®}v¸‚³¹oƒáŒ±˜cóÅ¢n?œewV0ÛÅ4H†¨q¶dÇf²÷ÕÏ!ä¿¥Ëzy4´Å(ëfS³xD>iBCójßÍb @lfáÖwæšÓÆÔ«ò ¦¦Ra¾„Ì­˜™IÎIËVÞVô©k¹o^­þKjOÚŒˆ˜ÙÀêYxà Lò -¤¢§šœÄŸ]tbÕŒ‘Ç€ÄÌÂÒLbœº‰™…•¹ôC”(cO|mïÞ‘€ÌÂJjò¦U™ÀÒÚZD!ªøZØ2®uýþËXãG~Ú*m3çÉéÕºå“Öt9½}H]to±uÝŒâ7­]ÿs˜B,ÊŸ™^@ªiBQêŸvYTct þâøšÏ»ˆ€Y ˜³yfPz·ÏÏ嬡Í6ôn|wØÓ9óÆݘ¿NVw÷²ƒ„Q}æöYwmf·Zæ®ó6žè*=7eísÃ()=×ÿåZ³÷÷M;¿ÜÿEæA•—¤ÅÜ®7êRãcbb“R3rò­UÆ$¦£.;66^Ÿ¸:3-.66.>Q¥Ã“nœ:;I©³²0‰‰MÀœ &d¦$ÆÄÄ&êHIŒÍÔðéÉññ)jýFú=&§eêó€¼6;1>.&&61Y‰ú…¨ÍNˆ‹‹×jy££à•É 111ñ‰©ü§ÞïF:3>.666.-Sc(.N“Ÿ¡æ@›ž–…b‰@“’”ZÂX+K™Ÿ˜Ê`vR¬RÃg+“ccbR”úÝqYI±É¹m˜ÓDÇÆc‰¸ìôԸؘØØ8e–t™i)Y*‰N•šœªNËDf–•–¥f抆u*§JŠKÓè²Óãbcââ“´¨ÿ±õZ› U) æ›´e‡±±±j¯ßNŸˆqq±©ÙÚ|-0;):>Ý0˘ªÖ7ueN£Õ-—š“ÓÆèzHÊèÔÈ;àQ{ÛVîù,K›o±âžaM<ú,É]ˆˆaîÖ›ÏE!ÆÕ65i¼‘®·¹'EŸìÃEõ·\ŒI?µXèÚT³m¾Ä‘Ëzàeoy+3|ô[G'Çz«9ÄÕZV¹Ä8õ£ÃåçÏ$¦_\ædëàîî)—Ë=:©9G7//wvöòõq–ËÛ­¸ˆx{–¼íÔñõí=«e"fÝ_ë)—»ùø¸É!á)ˆF¹Ã´{'Û¶¨ëêÔØb÷FúÌÞÝ¿fEgg×ïî¤!âÀ¦Š1_Ì°¶³¯8èòÜ ª~Nr¹—§§ÜÑ®óWç1¥’¿‹\îêçíéìd_gì!DDTÖvuvV¸{¸x…” ur¿šÎ!âªþ ärO¹ÜÉ¿ëF?]<ªë•ln¾nrgWÏÛiZDÄÄ3¡ö¶.nnrg…‹ËÍDUÔïKëV ¬\{Ê—[ŠK+zÏhgG'ooO¹Ü±r‹/qw[—Ñ ‡¹;8º¹º;;Ù7·c6µtî±C¿ {ÉÒ%$«Ø³Ÿnomïäîáí)—+\Ün%«“N®lP1įRÍÉ ¼·ntE…¢ZÛ®+ND⣟ľí1v_‡qÛ*z;V¯YEîäP³ÃlDäym¨·ýÙ×êï'vv³qjÝoäÅ4®‡Û¬?žë÷udY› M¿DNäë2j×­|ÙHÜãd^1šCy̸çbîqE…êȽäNnÞÞnr¹"¨n"Ïó_Ôt’Ë}¼=åNv'Êß )+à·O|°ßÉÃ7]ËÙÂ÷ kâ9À0ã—1§}9k‰×ÃL,1JñˆØÚ¯Ò 5^Y9Ö©Aßâv­Rr¯·ÿZáèüùÙdü{Q ‘oæoþÕÁˆˆš¸:Ö6ßÜQ¾Y×ÃÄ·w2""¦>?ë(w}”¢ÆÛ³dffóEkµ:^“àæ¸ÿnœ>‰5ÃËWí¸ÒèôæñÉ™å>!ýõÿïÞįꀅú¿¯~Yݱã^DÜÆϧÙl­–ã1j['›ºóô‘¹ÏÂÚ/‚Ǥ]­ `Š~.3êÏòÚˆüæN¡Žm¾Ñ/¼³ïK{g¯«ébLkóQˆˆÊggnA©êO9NíÛ2løRýß›;ø4\z…»ŽY{E_þ·Wµ¶ ©BÜ1µ[«‘kôÝš"&Á_asäA"bÖý@¡õ¶ÜÝÖÅFúP‰ˆ˜±ßÜÊë’ê-¢"v¬f9úuׇ;´Ùõ÷Mï>b¹~á”0—9¢æE)';Ń$"fßÙlâRO—¥N?ÎDŒ©bâ¬?¶Ømí,êè[uZ;{ÙWÈó|†R™­ÑGJD®²¿ýÎë ˆø`ÿbÊmË ñtÜu#Z¿ÎÆ1+´ZÊg?ð°“ßKEDŒþcƒShSº’²IôÎC1^ XÞàÌøf€r÷ÿØOc€À5¬Ùï÷ñ7û‹[ ÀG?¯ý…‡b1ÿü•!qýì„@* ±èg¿Ä2Ÿo7/ªcówç-R~»ö&tcKD`&Žî^Ͳ1_6îAïI‹mÑʳj1÷ë£Ôi¦iÝvrg!@vì• ­ôþ‰ÏN!K'¾8êÖ³ç¯Ó!h¥þó¦÷A^?EŒpÙí›w@æìÈ_àõ“2í:ŒŠ„Úo枭ܼ†Ëy‘H[Ž%n½‡ó>;€Ÿ÷ôþÍ];÷˜x~ŭ䯶u3D„Ððnõjp°°.?F4qT³ju¢^=ÐÏS}ª÷1‚ƒìÍ[?5ÐiDß®½w?é ðâò5eã×—/¿ -'ŽÛ£Z‰˜3ùYä­)Õó_Røúu‚l™Ÿ}z,ñ,€óØ•þ€æ­§t]´'~õÛœ ¿]NNwíÚù­/…¦<êÛjn3æù‚-Tëÿy€­¥ÎN-o|*èS·ïä#+ÞJàñË »:¿“YXä?yA0©²ëò×:Uj}dý¢ ½/hR®¦f‰ùmùY€%³”—û˜¸/Š4“&NŸ:vh½bï Ð7YºF>­ûR–¶îjµ.FÇn‡0Æ¢/,lܤ¿Š°ì¸0wP÷êæÁú>–†@¬À-”Üó#õØŒQã@@ "éÑ›l£Õc¿¯Ö}ÌýÉÄ«2ïe䤮J³hpc@d ¿(°üwÓ Í»Ç?ζò´` ÑÊÕÇYÆÔ*W+s}„úÛáód50s;ÀeEóh'‹D"‘H$t©?}Bd"…ÂÅÅÅEáhS°@‘Kd ¿û÷H2ojnȸÇ)¹…X(‰D"Ó~ 6´GŒ9Þ²’›[P­Yßnâd ¦óZ¹LÀc ‘9òú›P£§Ï´÷cs6a&6ÝF/ÒñøéÞ™Bß¡›O¬Ÿ|as5W±kXãm÷ÒcRÕÖÖfB}•ˆL=f}9ÕJø ib#9[qníÛ{øÙ‹È mÑËÏ*îIRþÊJ~dcïò‰®ööu; ùùèÝ*öû°dö}âÅWCææesìÒ‹»­Þ»˜Œ!vûjøÅkÔÚ›‹Ž;|=ÖËŽâÐNšÛhj͘<6wÎü^Ç&aBÇ*"sÅÐ9cô,!)ƒÞm,ÅP,÷kc–6àËÓÎ ×?õËÛ>kéS³ÅbêÔ…ÆJ`éi«~t?…Xëà c¯#Eí½¬t_M96æÂ:@´nÜ£VöŒ±[ŸüÐË77qî·6sRËÊàA*ÈŽÀÃNý0!7. cìZT¦ÜÕ:_>ܪX%ýøŠ2Æ..uºêìr6æ‡G0Dd¨9Íú»Ë€Ë¹ €‰¥eÏAÃíM‹{xêt„Œ‰]† ^òø°˜…&µÜùk~í‡÷öCDé[×í uÌ©ÒG×uûë)õ@ykïwû¯c>"éùWñ̓m” /E"õ«Ó÷2ÇÍÿnâüï ù–oPËãÓƶ›~¢Í•Ý¿rÚªr‡µ®8õmûÏïû£$©bÛÁ­Œ±ôÛvF››üEBRê&±«2¬c¿Ïße•@ÄïW O "2¦>~.5¨¿;Dé{>€™©©a êÕ´i?¬¾—ÞÆ`»U÷JóÐ",ìÜxÛæГWû\>™3X/<Á¸ ©í4qÔö›ûh-ü…ÚeÀ0…±Ä§gŽßsÊÇ_™Mûfí´oÖjžîw«8zÈô•…tI$ŸØX ‚lÝ™õ¯V6~Íá¨Øø„øØýËG͹c½õç>%&m:hFÏCãj{ðjÈOW^ž¨ëP³Öî};›õøM,Ê——s#íHNKO‹}0¤Q³#Y^þuÿNM߉R*Ób”j±ÔžB)£s(ïüÜ"jŸï­ìëîæêêêî\}ÿSþžõþñíC†®,úa-Ä“‹ûûx{ºº¸¸¹{†5Ï#˜xwÝسJãÄ_žúÖÇÇÛÍÕÅÕÍóR›{)9÷ùìÈòÞ®w¹"“Ot¬º¯»»›«‹«›··ïö;‰…ÖáQ÷¸u%OW…«›gÏ¥yDñº1.nn …‹wPÅó)ˆÈã½…–•&åeˆ®W!ÀÕEáêêÚqúöÂ{O}tÜÅÍÝÙ¹Q&âÀÖËÅè—ÇèêÕõ"Žé0wÇkC9üñu/7W…ÂÅ­\ƒ«Jä1ëV•@…³³Ü9øç“g\å ÷Z 9ă¸¹¹¹¸(šÿvBEÿ"žùn°«›»B¡ps÷¶þ6ÿ ?ªÅóˆñ]jøº»º(\\B%hyäyÄìQ-ÂÜ]]\\ÝBÚÌÐ?ÊódÇ4'…¢r“1Ŧ¦¼T=ØÓE¡puuŸ¶ó"¿»­KëÍ›†yº(\Ü6öî_Î×Ï6 òÇ€@(0†93é =O‘»0<Ïñ<cB¡AÞí[£§$1†<Ïñ< …úÉsf4ßQÄÈÀ"r——¥BÙ@Ðg› DBAÎUã9ŽG4l¥ÏSîa"0Æ×ånU0YD`Àé8ÌÍmà¡e›çt<êó ¹{à8™@(0žÓñ¹æ¤,Ê™xÒ§¦Ï0c¡PÆ3AŸ^§ €!ê8„Bc97û ÇJ&çÑNÇ¡¾f‹Kç9žgP À=íÜÖv9y¤§ŸNÇëK>§E@^uçµÝâ>œ„"‘>ŸúV”s'6÷á„*¯ç<0‘¯mëOP$`ð(Ȭæêè¤V,¯5Âœ?7iñ£E»?— ËÛ]QVßðrèÙ òÉÝ—Ê™gÀ˜@$ä»ç’Ûä‹|nH¿,çúWdù·eHPtâEßôÉɉDE¤ž/£lç®!æ]Ø æDÿ_£­ &ËE¢B;*XÆ› „"Aþ’aF‹ŒþdSf¬@†?í+¾$óWká’É)c¡H¤½S®Y?ii:äEν.œ(Ìß® µQ¨róµmDU£Úu”ï·B–¨ÁÍËK¤B‘!Å5?V¸10£çd ´íœLâ©Ñáÿ;óºÎk`]°%ÎKmÞúÚÕë‹/ìчõmá†GH™;둾qN>å m^¥Rñ@$•˜ˆ]Q=s­W×Ýâ/'Ô*U§ J¥â÷v©ÇÄ;\ˆb7”‰°Ä'ÆuÇ1÷¬Z3ÈéþN¡(E!„||ô~)B!¥!„ŠR„B(JB!¥!„P”"„B(JB!¥!„P”"„B(JB¡(E!„P”"„B(JB¡(E!„P”"„BQŠB¡(E!„P”"„BQŠBy_Doµ6Ïó7oÞÔétTpoCCCe2!„¼†ˆíôôôŽ;vïÞý­¶"¯_¿¶°°˜8q"!„¼Ç±T®\yÀ€Tpo%""âÈ‘#T„ò¶è¾!„ŠR„BE)B!ŸÁ€ˆÉÉÉ/_¾4^¢P(Äb1!„P”úøQêÒ¥K"Q^iëtº¶mÛV­Z• ‡BJ@3~.PX" ©X!„¢!„ŠR„BE)B!¥!„ŠR„BE)B!¥!„ŠR„B(JB!¥!„ŠR„B(JB!¥!„P”ú[ ýÞw¡ßÿþX°lfëc•–PyX\uþ5w|YBÞŠÛ[áœN«¸Ì—|µÇÒ?ØSÆbAüû…cX‹JÙ¸ÌÞcþe¾e!%ˆï^¤ï©N ü_¶£¢W@}—þí ô-J!0Æ´k§õóqW8¹zu°LÍX‰ 5?Oëîªp®ÑqRœ>[ÿaŒew÷4Wärr ø⧳Œ1D`Èez)ÌkÌcŒ¡QëfŒ]?³’Ÿ§ÜÙ­Q×qO2xý&¥·ÄpgKCÞü*7Ù?ž1ˆŒiÆZ+òqö­ÑRÿ)Ëzy±oóªNr¹{¹ZËöG`n=ë3Ÿxgo»:åÎòàj-¶_xªÏ¹íS!W¸µ¾Hú:RNlº=Æ8µÌzráú»lmO©7êÅþåW>Ñ;WCuL…ª|¹Î»N]±V½œ?awðÎGÎË|äÒÙÞ?xÂíF×nÞ9>³oX¿„È’ž§;œÒªZ.»· ¾)$?<Ú±[ëg/×ü:»;ȼóuF–Æ4bÉ©Øœ 0ÉuB+=…lØz¸’ÂäÀº¹U¼<Ú->¹©¯©×.§Î¼ûɈ äïŸXߧQð¾Y¿®ÑH/ƒgÝÖÁÑÐõaB}ó‹\Ó·Öç{{}¹éÆÆjÏ.þÖµO½=~¼õ}dÀ¾ë´àdâ俬jòô¯C;Vü¦zßë{Wè/,ŠA+ÿ[G̓òõ‘?óý¡ÙÝ{»M P«nµöÊü&y:‰¬´Ž´K-¯§6Ÿ¸tÇ’eíZ80Àëdz÷žx7˜üèÁ(ƒìø;µš÷;|îªÜLˆ–xuå>?¼µ‡ðÇVŒíZ¯âºÈ]€ðÙKO½làœ×o[Úå”ÀÓó+ÄLË_Ÿú2£¿§,§Îc·ž§¨ƒmÅ ¨^?8&&¥}9ã5Ù?ŸlÀ©Ž¬ŸÙ0Ðgö‰{cCÍ€WgöÙöh|XÞ…¦`&xü Ž€1‰õÃj~yàA-7D°°ÈÐiv_xàe‘—¾Ä:§RF†{íqÛ°íT¨nû×£ªúºo<ó¨UX·ÇZ CmLí* W»æ$B ‡R>«ÀþqµnºÝköÆ‹?ÖKzprtÿ†k¿¬q÷ú)1 ¾À qÆkÕ—\nü%À©ñÍ>çúß[ÓC­á™P¬OÓ¡×ò³_ÔÓèP«|9ºu¸à•ÈˆÝR@‘©©Õ½W^m¯A<2¬ÁL‹I·–µÓhyHò ̽¥R9eÊ”ü˸{u[Ïç-Éì#­ûU"ò<Ÿo]žGD>ÿ¾Ð ¥ƒGL¸beåsG­ÿ¶­¯dþ¡$üîÝ»>ÛÈôéÓ¯_¿þÁ3’ÕU!y4ÓPÔ7÷ôBDDݼjÎ!3.´¬î2aÝŸ9%Èk?¯áåþÙ7£$ânnSØ;œ•^ &ßYB}köÕí¼’~ý[K±ÇùtDTó·l¾-¦p #Æ”s–­:eX¨‹ûÃÕÚòj”¯n›fíöDi´Mö³æ “6ó.#r_×÷«´ðd^ÔÆWprþüä+ýÎ;8 GÖ¼—Jxñ¥Y•×˜w¤]}œìºkø<3æš³Â%*Cg8ŦIZ¬{ctŠhz‰ÂçE "â³`kñ‘×ÅíL=ÒOVoñM?Oçï/¾ÊY¦zæeíúE[ïÎÛÖ»¹­—gøx…£g¬ªôNÁ¬›ž¶æ·’óNìûÛÚËk$k1¥‰-›sµø&ÄÇ9ÉN=ShÒ®º9ØNVW¢4ïé¼JŽÜæàdúYF^ÃäRY÷ßÍ#">K7ä«£ì¦Î‚Åg3 ÿ?Ô¯’Kï Æ×ÕïýCg7T¹:Âù~’ ñq°Øô—hãÔ2êÉ…k¯fŠdO—@A;ðS!xÇ‘Ÿúdî ܾ¶/Ë›2]¸ÿäª Xâ¥n*HDL(±í4b.2†ˆìÞ|IÝqûæ´c"y*c¿Îéi+eLè])ü—+‰¥6‡Ê :âØÅ!4§_"ªP#$âÜ º™7!ƒàêb£S¦fpʨU/K‡UP>`Öƒú5´Ê[_eí^5ÊÄP¹ˆŽºuö4Ÿ´ùÊ{”æ$k^i|«äßvD”°^ÜÏßJzö¯¯0Ü…8ÔÛ°e“£©¶-ý¶^ïÕ>yM ¥^ WL¹±ãsãÌçôsEëú9®¹û½OTk³{ï5—›\}âô´>o5ìTf¢s€ã_NÆkŸŸÝ˜¨ø~l…ÑÞ¦³¿>jôk³xæÉÉ_eçLÝj×Ï:8qIöþZ"t\$>½•^ºÍeéÁӣǎ³Èk¥0hņe½«è>ÔÉ´gÒh놫ëyÉs0 ¬—\“ºtL–Ê©*8"2¥–û^«DïØ@Òâ^ Í$Af@f8ñí‚·èÞ¬[ZƒéêSƒAóºmÅÊ­Vw:4<„bñ½ËCçÆ$n‡k_Üòðì U%ü¹v|Û.-Ú¼¼f¥3™””+3µ7\÷ä–Šs©Ñÿõà„ ’šåÔž:qƆÓ^U[É^ßú‰‰ìj:JeÓº òšv0qQ+{ÈŠ¿œ¥—4¯>€ÑÝ‚·‡iÞwf}ÝâŸÝðÆ’¯ìÝ!°2Ü(6w(ß:<øĶ[îVI ¡AÓÖíàé±lÄo5Ñh;Ó! IDAT‚„!†ÔIIü=¹¨ܶ&ûáhŒµ`BáË3¿næ®Ü‚ëÕ.ïZ Gå;¹o£­­=­j·ïÖ½Cój•«V ´Ñßa+öD$ßØ¿}»50Æßø}íóF_\êl«ß„‰Äg÷ïH±É»ÖhÑÁÓJÂœ;¾]î"‚Ào{Ì®>ëNÆ ò93d(téá ãn¾YUËEŒoÎlÕÅy¢÷Ü/Šd"“GÉéu=̘Èäá‰ÛŸäÍúUi\Ù·¤ÐËÂC»·;™æÍ6ü¬““Izì‹Ä.Cò.A DòJÚ|°“*eË®ÍmX^ ‚DÞD$ѽNÎR˜ýÓI 72ü8µoK)E©·¦Óf0È QˆÈÀߺ©úíÜ`D`b·Í¿L lòyÖ°ƒf™|Å«ÆØ·pÈW­œ²H}ù2Ú©6åÇõÏaœWétét:€ ·7EB‘V£ƒÿ6D¶¥…ø{ HÜ}Êýxbÿóä%vŽÊDC›…LÚ¹æD«éuªT+a¡ñ¶¹³%ËNÖ˜¼ïÖ)ñ|Nç1éâ®Mswˆœ<¸wëð ø,fj]ÌyËgfó›Bš˜IA§UÕÁeB ãt9DÏŽoÝ|ÉЬµuºz”J”B„eîN8³|ùºm«¾š÷0"Õ¶î«{¬MŠ‹SL H¼ºkó ±>Ä—/¥µ: ó®eâ?~ÛtCœ·ÇZ-<­Äü®e›‚ûßQØL_—•‡OF”od(‰!!.?Ÿ½S«{•óÇ÷ûWè"Ðñ`/bŒÓ8„&÷oN‘åÝ2mcú—QjïöÍR¡¡$M‚Úvr2IWi™ÄTd\x¹!¿ÈÐÏG?}œÉ Páé#3¾ûÍÞ ^hg*(œ[`,]ûϯ91Kš‰æh`B{W¿¡¿\u4ý/~wèÝ¢‚ÌÒY§åÓ9^&èc,õéá¯7F.a— Af  LìTCÈ6fëÀ í½lT¾Eþ¯s¸ ·%98Æ¥•Ú]ys™•Z—f˜HW¥[Ë,þãQŠWgö:¤û®>3¾hbÂõ…LMŸ´²Ù„ –XˆOm‡é¥ö¡Œ½RfóV2¦ŸvÐ?8vóØ‹rMÞn㣢íjèsé7vË¡îòí¯²ŸdîùÇ W%DØøÕlQ£½«yØ*Ï_ÏèÞLfL!ƒä¨hssEQM,êÒ Î«‘þ²ÉkÕ çï[Q¿ôR§ÎÖ %NAõ篪Ïd· ®Ùu]òÑ‘ÅžgœÎè¦Cƒ\r®»êë.²V—ŽmeÀ«2fn<Ô̵À© ðxû¦hÙ¢ê6_H¥¦«·™’¥`äâfw~ß½Êáõ?µú^Éá…÷<ŒgÈ©Ru:/+ðꬎKάò';¯Ó¬ýõŸUÁ!·­µ0úy"ø:&QYö½ÿMÝ>hÑï"ú0YÓZ…_s@~ÍÑk <-ß9òZVvÔœ<õ¿`ϼƒeÀ©“ãæ¦)ùcçßžK˜x$~F]ãŽq øŸyìÝ"33…¯gvúÌ?’ŒKìâ·£6JavžRîu¼6§4µÊ<Ú‹óu\LÜ­ ó¦ sݾ}kAX©=åìâæ­LVªsNYxéáSõ}|Uâß„§ÎÎ?7Îì•9»½ˆ‰‹‹‹‹‹{¾rÜ…#”`fWI&­¾9Oo+§÷ w>mò˜:ï÷Š†ÊÇ/ªv¬RÂÁÔýßhñùY·Ó€å|i†d/^»šã€UǾ•Ï~33|yˆÜú¥‡k1ðwÇg_ü´ÙÝ…ï¹öªW}Ö^0Ü«Ó+k«î^Èú» ñ)o‘û«íØ|ȦR㸤}µFlh»{Å5µÑJAS*§­<ýàÔêgÕ¦VüM2"Ö©UÒPëÒ½ˆU*·ãðnÃ%‘Eo›÷Ͷ{vÒ"›–ùO‘o"###>jàiY·Á¥#§×8¯O6Æ--â§!j¨íi/ÊÄšÔ `yûJOW©Å_<}‡:u9S 5k”YÆ©)3Õ •‰)J7³ß·kо5~¹«Ô/H¼¶±ÿÕ´mÿq=ÿ€Œ5[.ë;¹s»aÕ}E¾Š§Ì¨¶¹G?ýùsz¥}`¸Æxr÷Ý.tfAµfFŽ?’ ãÈÞ#\×~•ÿã_š*¾%K]ªÏ’šˆMÄb±ØĬêð®.q«ægb«s›ú¬ïV{åé7 À²N…$¯ÀòIæm†×ó.ý/Ä!JÌsþ|sí·ZÕùZÑA‘³DhjQx}æ9¢…¿¬M«ÁÉ9_šú×~“äÛ¢² œº"íì/õŸû0Û1½ÇØ_´k.Ö÷U —³ôãZW½‘nÿ}{ÿÜ~ Še&EÌÖ½ó€¢ãÌ>±+†m¹¥Ìé#ô¾âÈþosó‚çx]\ºáËNhVÔÁÁ=»ë7 ‹Åb±‰uË…µ£vl¹m´Š°yµ “:*߬ñû»Âæ/.ïüªrËoÚ®9%—æd["cEôNJ,>sË"ŠôÛ¦¾\3uèÊ?sjS÷°ýÂ3½¦¶*2X²’þûªBzþè”v¿R»ÿér[ÚÍSš/ˆXyv«y“ÖAÇ7\Ø6êyŬU0á?jO®uù­ž8ÉÚ»Þ2ïØ>HðÉvÀßñItýS¼'Ö~n!y„„y›ˆ­§n8­~2ùÎ.³à*5ËûÈåµ¥è‘Ç»sÀ¦KΖ¼jæg!Ö.µkV1·”¯ýãE©>Ž)‘¿;Šdu6R˜Š¿øåúÇz’²ì<‰ÞÒúÈÌ·ìùo¿§æ+÷ßæµ7÷­«ÿûƾ•žÖgï  aåìÍÍjtìkëUå—kQ¥·ø*¦ Ê=ñLí}¦®Ø“Åé˜zˆ$Æ8&.)ú6¤ŽײœHfVÁGacæ~áM¶áàŒ—»Vw1³s+æá shzüA<"ÈÍ©è`"äÞ-1mÖwzd²á›Êfæ`R  g^Z-óüϳ¤"¯ÀŠa¡ÎÖ’ª]§§¨yCdF]’šš½NÏ{}´ê¬xeœÂäòàQg$"">v7 \j}æó÷¾p¼¨ÎW­s:U±k0ñ™5ÈÎe "ªÎL€ÿMEÄìø3f&VÑ¥ù$ú5;3‰!kö¾Õ¿ß})÷¢‘\Ë DJض«ÑÆ1Îb8öÄèIôÔ‹VfÒ‚1¥êýñ=;»)ÐFèàîV>Ø\$l7am&—÷=NýÒN _¿§'ÑyDäSŽi"¶p)æëjgfºõÏ'úƒåyäÒžkhbéV¡‚¯‹u@“sÏS¿Ëñ{'Y‡UÆO¢/©fë>éP;ã‘KyÜ¿žØÚ%¬B…µm¹V—_3„ßÑRnÙ}Ë'ó$:{«¿ÓÓÓ,X°hÑ¢qŽ1œòÞG*……È9³|À@u÷Æ]°põs5žNÕo¥ÿ;áEÄóDupÅ æÂÜ{¥1å«*»Y J5õ·pÿþý±cÇÖ­›7ŬÓé:tèP©R¥Û#É9|£mßh4a‚9¿\€˜s«àyÄí„ ‹o¨‹8öüƳ’Æ«¸¾¼nZÅÖZNþ1–÷,âE¢™¢œ¯«ÑÁälšüæÉÓèd Gï@O{ý²’[B {,¤Ï&âÎÝt Sx—sµ•ÕMÞ.rÏÃ'yõ’WAPâ §–·ÞÚði©Ýï(¦¬J®ÓœlÎM %˜û txrÿfr¸Vp¶`yi*Ò÷rÓ d%¾Šx+±R„ø»æ4P£2O}öðU¢™k°"ÿY˜W%ùëȸ$ mZôÓGo’ÌíÝ‚¼óŸ¿%mû¯¼Mñ¶QjÑ¢E , Y²·òðáÃQ£FÕ«WÏ°„ã¸:„……QáB>yï2Eo»§Ó§OϘ1ÿë?ÜúvŸ5žñÓ¥*T¨@…C¡±T©E)àyžJüšþ6 ñ*IBÈÄ»Ü!£· B)»þQ*ùØÂc¨² !„¢Tb˜a[=tÂþȪlB>äéWÂYù齫—P”ú'cWVªàa9ãl²~q‚{úaöu{™T$ …B@ ®¿ùä=¦}K©mÎ$úÏrF®b÷fŒéÿojff" …BÆؼGL›vÉZfj¼…€ :Wê¿}¥KY1µÜÒD(ùTmùÛ…§Œ±¬Kßç¦&253妶ä9](J•!]gÿ~æöÿBeô !œÐBjò ›ã8ŽçùÓÂgõn<öà+Æ“I`ömÎÿðûX®'"rÇqJoKv6šã8gø0‘¥LúRm´ò»šX""cij”ÛtKtî•Šã2¿íî2®mùõçcÌjŒÌM-ÞÕÒävRNj½h,EQª¬L9 ™ƒ«§§§½©€Z%!Ev&ègøj÷œy}ߘ_û7ŒS匶´ÙÏK£ßêÏD`Ù™šŸge1hûex·kïþÑ×Z i7aÝšN>Ÿ³Ù° ¯ÉB`Y™ÚÂû!¥>EBÊƹ€Ö¡Ã¥’Ì;Q©¥™4ÀϯŒØŒÞÕÛâ»ÃF}ÓOƒˆŠ€òA"2‘©•Hô"-@&˜˜Ùýá7ÎQ×lмþM‚JêS‹Äv3‚‘ÉÌŸ6—3MŽ‹Rú†x¿«W ±tt "§(E!oyDþU9έRƒ†®†藺ú«¹ju:H O… áx&°¿ý®^BQŠB Çd¨ËRêt~6ê4aí‡}›wõ"Ïuí7´ð»zí$¯¾÷¼wõ¦êØeÝ‚}Ûƒ$Tðÿzÿ‰oõòœNÇÑ5!/B0OÏÌâÜB\,J7õFÂ6l߬Ãþ}$7¿ÿöà©7…¨ÿæXê_øHëwði¿Òz7!äm®Yé".ûàši#—rèž­IÎGš¬ôôt£Çú˜ÈÒÜ´äô23ÒÓ»ÖB©¹™ÉÔÍKv87n2ÖõÀ×=@}ºËªKŸ/9JAê¿¥ñÊ•+ß~ûmïuÛØؽ$‰™™YqÏÆƦ¸¯ˆ[ZZŠDEgO$YXÛ³¶¶..3fff%ÊŠD"@ ä^ú¯%Rû+®™Ñó™ŸFMrLÔ¦¢' ÏËCÂÝ|TÍYŠˆŒ!'0YÓÑ{ÑÚiÖíµOÖ¶Õ¨Õù® ˆ:düŒ–ðXiEâñž ®~íÁë4óøušPÀ´jUï¥Çæw­lü2EFM¯ú·vuÞö-ˆÓ¦M›>}z­t:] Wœ~ü»„ õ¿#þ!ÓÌÌÌ,¶—™YäcÆøÅQddd@TTÔ¶mÛüýýsäêZôënõi²b^uªO³ÈÌdddw€Z­¶¸|êÓ,.0dff—¦N§ËÎÎ.ùØ‹¤R©Š«&žç³²²ŠË§•••q°7&•JMMM‹ÛÐÆƦ„4‹ì1 b },}笄>Vq½±X,“ÉŠÜð/ûmÅ»>ÍúmÅ}dnnþÏú‚e¯Óh9HÄteÿôÃGGG*¸·qúôéŠ+–Ðû¥Þ‡:(%ô$4Mqã¸ÒT©TÅ…ö’ÓÔjµÅuAþq>“’’ŠÛ0::º¸´Zmq>DÔh4ÿ <õ? ñ¶iê;|Å Ïó%TD ùÔjµÿ¬rÿYš%ä³äò,!MDÔjµÿ Ÿ:®¸ÊeŒYXX·G ‹â¶X,–J¥ÅíÑÒÒ²Èåáááááá.J‘ÒÅ£÷K}˜>—Hô>*aBÞÍÖ~J™Z­¶„¸XÜtTqÑ‹¢!äC£õ 011)疋›W×Þç'ß­KKŒMÍP1‘ÄÉY.=çGȇ9ý ˜YMý¯˜y"ÿ-Üb?ÉM°à®ÄQ}Û÷ßäþ¾2Æ®­ïP¾JÖ­êÕ¬ª¨ÒWÉЃ>„|Qfßò’;8999999:8Vïy=QËDÆR›:Ëœòq¬1e‹Üij幓•ýâ§L«¼ê&wÌ·ƒcÿÓéŒ1`ŒÙ4+Ì×ÙÉI^»ÝЧÉ*ÆXöµ …S³µ´ûþ%…¨“Ox,Å0öbøçîŒ|ÚÔIý{Œ™»oã̶Të„| :õ®+/ËY#pªÃ?LoRÎwú±{Â,´ª¿¾šTÁ0P ‘”½yÖˆ1Æ0±V¹Ê_y\Ç]ŒfÖ™LÀë^yâ÷Ó ¶40¬ÇÁDï¿](o¯Û¶hxÍ÷ vé\ k(U9!~bCÿæÿ¶ dÂ÷¢ÒK3i€å‡þ3f¬ÌèÍ–oZ=¸¦Ž žÆRe= MÌLE Ž¾ý¿¡=vF\šÙ‰~'‰©‰d"“ÇÉéõ<̘ÈäþáÍ›î>çk´¬àTR áïÛ79J ÁHجGOgeÌ‹Ä.Ë¿¹CèT¾m3*rŠRÿ‚Éd ÿÜ2³å°UaMû<ŽXj+ /sò1C•ˆ1˜ÐäÉ™={Ì §«®•cÕ¿ŒR'ì‘ QJ\¹KOg“ µŽI¤"zsE©_bŒíŸZwÄ®´£/j;èû†„|Ìê²Su:/+ðê¬v‹öÌ|›7wð:ÍŠ­¿zs‡ÂÖFý,|óÞÜ‘uwòämC/ò‘RÁÿë}º÷¥eEî¹9íú£»µû}Cz3ŒP>øA¥2 q)ÝgìXÅ rÛí6 ›Ù›Ÿç-ÝùÐB¥Êø9qïö93²Uµ*¹‘‰h6âçƒ¨Ö ù`d¹sz~YÐ{ÒòŽë/Ës‚ŠÍ ¤þjÂeEŒÑ–¬ŸæáÝo gà†q €itXôgŸÛ,©ô)J•qÞ5»lÛdü‡háäMUNȇ¥«´Æ#€£_Íù?ÜÊSÃ8S3CÙTã³´íŠIÛsÿç¦dêŒ?E2Så&ÊI-GµùËý™¼ýÙS«š·jâð­—³•èùÃÇM'¬[92Ü(æñ©)iýp&E©²ÆÞ=¬‘;U1!"3­œ˜©*r´„hs>‹Úõ?NL­F0<ÿ€hbU#53»È·=$õxq'U.~¡NæF¿™„(»'§F>í(•””‰t{çm<{ö,333!!Á°„çùçÏŸ÷>$BÈ?bb*…äבÉTe\.ïQ Ÿ={vøðaŠRo%666))éÉ“'ÆQJ*•¾|ù’ ‡òZcXX؇ˆRŒ±ªU«Ž?ž ý­Ü¿ÿÆ5kÖ4,Ñét:t¨T©!„”@@E@!„¢ÔÇch—NÐ8¼Q÷‘ó’u@•„BQª¬)ÆÒ†¹ýø\1f„ Ô}^íâ£0Eȇé$ßw,öËõÅŸžXbg´ˆh‰]Rº P”*XÚí“;3\ïîœß¶e«™?_®£;¸þ¸’žC%䃜 ³¯;Z˜±\¶a3VìÍ}¯nJ] fÂòñ¾’ÝÛjø¯™¹¹ ÷﹘6í²­…,ÿ¬ã±4ý›³£nŽîÑÔZÊcÎ5ço¹À˺¸Ò°¦ÌÜÜð÷âçt (U6drÂv-šçvœVV&š,5U9!ŠP&>åPï܆Ñû¿îß}ÝÆ“ŠaA${²z†ôÊýŸÊK†—“rþ3Ó€ Í¥âØ|[àî¦VˆÈtÏšÔ¬÷ļÎÃ4DÄ]³Ûü4©é’cOÍjŽÊ]1Ma.ŒÌÈùÏ$/KQ”*•ÚnY9‘‹‹ýsÍàcIu´s æIȇ”ž–óGpãAO.83µET¦J/x:æq0 ËHÓŸ)Ó ÙØÚ£küïð3%€µºþocŸón3¬Ãk”L™¦-¼Rö‰>ù#äµ±u«WËÒqÛÎv`ôísB> ‰g‰Ùœ;Q).~EŸ„ÿìõo¿ß¼9|þFÈyÁc ë~s"õ'G(J}¨S"§ Å.^FñÀõkà6d¡çº©Í(Lò0%6BÑ«ô,™@*ÛÜ·Âo†+j»ÏØòEçÊ%$ 0‘t¨&dyQoý…ËÕd ñ1™žA®yoA4œà¢(J•íS‚]þuʪóÁ›¾ëÀk–«òÛ›H€æTë„|¬Î£Q,`ÀkTM&¯íhˆ9¼“—ß_l¬ÓÎYöƒ«ÌÐeRÈùq>é-ˆ¥þ}l­‡nà ¯€œ»vÁ»ÛÔp ùH³Œ×¦gê´vVZà9çrÕ«¿Í[ùò•«z ¢“Üôùýçè›÷ÄÄ=µÂW­»z¢œ˜ þ_ï~ "ú5íÛÅ%ÅÌ¥Rï~}+¹ÈnȺ/_ ‘B!ül` ®¬¡Ä°r Yé¦Þ±jÅUë×0ý#|ìä׫nò¢h,U¦1†hµòäÝé÷Ïÿy/jÔôeÕ}mè¥ò„|гP Œ¼}ƒ³àT§¶~3çç;+/Ý·ê{ȸ‡7nòÎGNhS5Ì«ÄsZðàöts£Ø'ó¬h7ì§5ÛÜjTëaýó—}-¤Â¸û‡úýtmÞæBªŠRe>N1—«Ý¥\¾%„rŠlóFõäy§à†7£öøJôsîÌZîrfaß3F«+-›¿º°8÷k[¡ñé,²upš6¢ÑÇù÷vtD øóѵ®[7k°NË¡ÔÌtÔ–[“š{æMî3­ˆ~µ”¢!„:LríÞƒB‹õoA´úõî‹¢62¼ÑþBÄ+0z ¢È¢ÂÍ{÷‹Ü0@Sßç"xžG&Xþ· š(®F<º)ý_ˆRˆxûöíuëÖÑ϶¾•˜˜˜¨¨¨k×®—$/!„OR•*UÞå-Eoý~)WW×:uêP”z+Ož<9r䈇‡‡a ÇqaaaÁÁÁT8„O›ƒƒÃ‡K€]PP•ûÛŽAe2™qUét:oooŠR„R2ºŸH!„¢!„BQŠBE)B!„¢!„ŠR„BE)B!„¢!„ŠR„BE)B!¥!„ŠR„BE)B!¥!„ŠR„B(JB!¥!„¿ç­ßÕ{ãÆ 6Þ(ˆjµºLÄ[€çù²YÊÑÑÑŒ1jm„ò~£”¹¹ù²eË8Ž3,Q©T›6mÒétT”%«Q£!„¼ß(Å 6^’™™éìì¬Õji¬@!¤ÔÑ})B!¥!„ŠR„B>%¢wOB«Õ–Ù‡ëÊ,žç©Ð!ä/1Ã3åÿ "¦¥¥Ñ£ÿ Ü,--ËBÈûŒR„BÈûC}yB!¥!„ŠR„B(JB!¥!„P”"„B(JB!¥!„P”"„B(JB¡(E!„P”"„B(JB¡(E!„P”"„BQŠB¡(E!„P”"„BQŠB¡(E!„¢!„BQŠB¡(Eȇ…¼N•”˜”¥CÐd¥'&$iÔÉ)™:,n+MzBJ&•!¥È'Ð#>2ðM[Ïòau¶¿æt«øW­ÙöŽͪÙjADq[eúܽõ£ÃAªSBrÎ):È'!¡–8hafb}“ž“´–6žž§t²€oó¶Ç•} ÉJS3ssS!+2Êj³ÒTÌÚÂôÁÑoÚNyøäÖzªQBh,EÊþ øýkæöêÙsÈÄyñ¢¾_u`ͼ^½zŸ½2¾Þ'ÞZ¼ G¯# |±Ii^/ú|X>ØwT#» HÊŠ_0~Hïþƒ½¥_sîØ®G#ô©ÂëýŸ^u·¤œ*nÉ´1½zõ9åËx-ÀšIýžJ$ßè¹õyÚ€^“52õèv=nªáÖoSçì|Í& íñX©ÛöÕ„nÝû|½å}:\äæs÷fÞÚ;æ«Ýš´«Ý»MV^[Úvè¹]Hnã°® /¥@äší<ÑäÏÇë_ºLÛÁ'Ý3 {ßã®%ç/¦¬š;¾gÏ>3—ÿj<Þ$„¢!¥4Ògìûþ•ÇlŽ¬U¿¾kÖYO÷&ñcŒ›ÕÂÒÞ¨ÚõêJŸïtöiø<šôéožÍ5ë?$ÄœOÿ°ŠkðMΣaÍ Í#êvXt€¿|þTµ°ÆÉò°*¾V#Ï:‘×ΪÓo—ùòâéûÉÅ)/úzM´¯W¿®]Ò ÏV‰áÝúÚªµõz ©ioÚ¿o;¡Šu6ÌCñþ¼ø0.œ;;¨nµË,¨U£rG´ú{åɔݗ:‡YñÚ¬„„d®@F2žœ>øC‹Ï&‡5jëoõ¦©w@lÏXL+¯-„õë×|³wŠwø„,`§È¿µ»JHY•ÒÄJ´ô±þo~æÄqO“uÉÇšWêeXc@]ÿ ›Î#&Ô‘:žÑ ¸»_•àá[ô§=ÞY±Rk-fVs·šúË-ý:чÆ89ÖÏDlSÉfÝ¥~aÄŠÚ¾#N—9þùÁ6þê ½šŒˆ©-¬mv§ê—=ð’ù?Ñ!"îŸ^®Öÿî bõ·›®è?¾²¬†W×£<¢æô(³ÚsñÁ‘oü+ÖÚ·ïÔM×ñÑÑYî!=8Þø€Œ<˜+•x^ÌFžçQ›îîâ|;NuíË.Öõ' "Ï#bv9w‡½÷¨=‘#ÅiR†Y·ë^efu§‡#¾èßµÕøùK¬¥‚_ÏFZgÞlÙ¢9Àâ^dš½ˆð/iL°õNÒà•!Xúvºq½@¦N•Ý¨^˜þ‘ ûÚã…š)j`»ƒÇ<[îú®Zäë·®]<¹û‡µèomÌkZ”óʙʙ EoƒÿëPµÞìSù×™‹ëÌ~m´bÁM4®ÍjH€ò"ÆD¿_{ݱew` Ä­íÍDƶ ¶§&Eþu(J‘2<йúâ ù‘Ë}Õ£Ýò”Õ©ç1* ÎÀCëÇç_7±ä¤ÔÈ Býõ9Ž‰‚œÉ;ýG|þ91^Ç—û^îqàÒ ó„Aí»vÙÙæïγ³¿žig€þc&›ïp;ºù—Ï|ß|f€P\,˜ ãËÝ €TÂT% !eÝ—"e˺޲~ç»À)ßüôäÉÓpoÙÁË÷kzܸr×Ð(ìë}wþ2©zŽ6{n<Ö¤Œ7ç|C³DRÉ­«€!H¹yGkinpBàíz\Bš;Öîôë2åúÁzvhb'ÈæøÒ½íÃ*´kÍzu˜ÖÌ&7–O‰Ã5]ù‘+·×ý›ÝÌÏZ¡(EH©2+o S›¡ÇΜݶlüù¯kzyõ™Ú8yWÍVƒNœ=ûåÀF;®J;7-€À²OŸy˜¨Á"e“·~õìëþƒgýpæèŽM»Y·^n „ÒÚÏZ»gçÚÙµ[Ìm²t€ÂÚeñìq—ïGþ4»ÏR[ ¹«àïtãGï<tíHƒÐàD^üøaô»T꧑OyèݤÕˇ—›ÍšˆÀ€¿:ÕÕ¹Òõ_N,òM~-?óUë³Ïœ96´Yõg|6åžž ÿBÂÙ³gS)² AØ¢KgUÔí={Ä猿„Z#J;öë‡ ~Ýy@ØòÇ«|̲`/î·Ÿ~ñlÑÙË”– ™O÷6Õ#Î8p6²Éài?MnÆ@³zÁ—Ë:¾ùtDFÿÉßÌéT[·k¦}}ãçû-«ôØ6¿‡¯»O€‹y‘ñľbãöi?®^{ù%L[¹½²UʯG_ti×ÐÕÛ'$´œ•ÄÞþ¡¡2;÷ àP_¹ÔÕÝ«Bù+SH,]‚‚ʸ[0SßÀ'k—øÈK¿Ÿ‰iß¾¾ÀAðdξìcKû ™þ“•‹_¥Š¡¦ÆÝK±­¯Hù@&ðôò )'•8tïÙ61òÜ®z5îýËÖ¶"Ôߤ"ä_6§Bßê%e:P!2f<ÓÅ .DÆò¯Vì0%o#™•¾{˜U×Ö°+`ù“BVÂÝ !U¿¾S0ÈÛ[:¨ÞiÏ£+‡¾kÑ!…(òoEOO²ÝÊwmeE,dÌxÉý%­îJ¸"#?wÛ‘Æ^ÖR«²:i9i'®_·cLË%W%¢üiòš®_ü4¶}h¼½c0ÈÛši‚Ì¥‰v·_úwe EG!ŠÐXŠ26ð*i,•;pøëPÒ ïkˆ’—=ø;ÃDB(JB!=ãG!„¢!ÿ@±}|Ï»-3/!„¢)»»¶qªØLÆò[ý’½çݲ†¹ÔþâÝ"„¢!%Š$ö•šøõÉáï}c"57“©ü ùèèItRÖ!¯+<ÚÉN}ù2½BX0 2uâ•»±å«†J´Ê¸‡Ï£5XØ»ø¹;€:ùÑ£LWw“¸gÑÉkE°·s⫇¯³Ìl^N àÙ­kv¡URŸÞKÎÔZ;ûxÉ-wŽŒq/>LÎÔXØ)ü<œè«G„P”"$_L*¸ÐÔ>kÞdéÿۻπ(Ž> àÿÙkpÀQŠ¢‚‚b/ˆ- ƨØk^»F“h{ì%–X¢±G£±›hì½÷ *Š ˆ½a¥—+;ãPc$! øü>qËÝÞÝìì>3³{³gb›—PÎîÛf³ºí¡ªÒŸsñýÔÑÑY%§øÇ·Øûë€ñ‡uØZ^{|³{qËËW®´èqì`%áÂÕ;3÷]oïïôCÛ&ZsÿîXk ÿ`Ø—¾nàa|kÆxŸew>¬-_<¾[¼í’ã³Zü³0R Š Í­pwwwãÃT­WäƒÅ,Ü"v)Wµ~àþNßï0‹{Úˆ¢Öô3«1óÚŽÎÑõÅï^Oj£g»ÏÄ<¼ª’Ð’!ŸMŽxþ0&’HœÙ°ìogoµ÷w’ÉSÎ_/u;z ±½_ñÝÚ%6¾Ý“µmÖÉ»½ˆû^B¤î\¶Õ™I-ª+SH)""’÷=±qa¦.ë\”ÈeDœskÿ¯Ìòk0jþÎNDÄy•oÏ=ú–H“~öÌOŽ*ÔADDœx¥ž* ‘•…ª”[UÃu=혞‰™éu¾o˜ÎÕ¶éœ*VGoß\ÿã´pßòÎÇŽ9 ‚ÞKšºærzõêæØ.H)""&S¸–ðxÓ77ç”S©j¥Ì0 DüéŸC:Œ•z5 ¬]ß¿ÜqcØäºý#b¦¹s‘l]-²»F2¥•<%AÌžÈßMä>þ•kø:"­ÆÊ@O6 @Á5~ðf˸¹¾Ï¾ar‹nmú'1F”>¨Å°:s¯žßÿç”1ß5*覆+™$jûâœsNtýî}^Ü]àÙñVÏ“âX¹Ð&¡¡¡MB#ŸµV£m€¾@615aßž]Zcæp½s™º%µŸÖì3zÏýF-;otï5içúïÙZKÞ¾‘’®JyÝoî¹Sð;åÔüðâ.Gšlö²Ò-èûibÍáŸØÒ²ìë³øûѾa+ö5öµ;µfÂÔõÑßL…«'RDD µ½‡M˜49g‘>#¨ï:áÌTVë»-9çsVÏ ¨?3|p“É·ÕoÚÛwjŠ™ºÌ†åÓÛ´þ&ä‹+Â\K·2¼ÔÊ®˜[fÖÌèV.žnjs"Ò¥gt™9}@‡¦‰izÇ*‡G‘ÚÑÃÍJNœ3Ï^–ÜêòeëÑ©•«ïÞ‹$¸  ÇM0Û,¹î •ý÷ßfJ//Ák§8¬Œñ…¯ÎAžëŽSH(€‚…óRP„Ú\oº¡R^CåõÛdäºã" })€‚tûòyEé*ÅÌPH)€¼Àˆ ¥R€”@JR )€”¤R RH)¤ ¥R€”x¿Hóôl­V;mÚ4†»jç‘N§ëܹ³§§'Šà?L©ŒŒŒ/^Lœ8QE”Ý»‹ŽŽÞ²eË7ß|ƒ¢øSŠˆd2™¹¹9 .OPbÿ ÎKR )õÞÂ%'ÿ€EP8ç×®]Û¿¿q‰(ŠUªT±µµEá ¥ ?¥âââNœ8a\¢Óéìíí‘Ro‡?@J ¥)€”¤R )H)¤ ¥RH)@J¼÷)Å9uÁ{òõøûù± «4ø[6ÿ«ÍùÚÖ}ÀwªmÙ•ç¯jÇ]ù +ÌS-Eþ¨RŠs"·svpµ²2Æ“• ¨?k[Ìûp(ãD™Ï"šÕô¤‚­gå_DZ»v2–æÀÌ%,‹ ¬ÜáòsÆ9çĸæv1[•`ß*™1n²£?;ÿ{»àêVr1æäU±ÿ÷ c*øÛÚÆÓ#œ­­„ìêfíR¶Ïˆ%†ÊÃØË ‰Âø?Æc¥¾˜Ç¢VZ©Õƪ:!†iÏ8X«Xn-÷&2Æ8§”‡Û†Ö²R0Ƙ£gÅ/gîbŒ¥šg|¦J­6¾Ûô[¸qöG•RŒ¥\_SµãµúÍÍäœó¤™=*OèÖðDb¡ßB3JT7³átQ'†ÏiúmÓVQZö‘]2¡ïQž%ùšgJøç&1ÆÑýõtvÕ¼¤»v^JÍ*&ÆÒ£Vú6è­ªûÅ­d‘s~lÅè;;Fû´ýQËr þöðb.¡º¬êváωWVj:ícŒˆÉqüUnêÆ‚þÜ·sö£ŒfºÓϲŒò&bs™äQ®Wð?ƒÕœs–T§)«ØåN*çœïßßôv·_SÖìŸýÄD'sºšœõ`êîG”Rœ(µW£~5§œÛµ#"2kÖúÔêº^ƒ*BòÓ»ÂÏG\¼ò2#»ë•öàlÔ®I ?QGD¤‰ºtî\xì½g”Ÿ£rLw|éK¯ ›q¦ãÚV¼ÿëŠhc?ácmá’65-kã)KþôEpäÑðL"âéߌ<]wÒòš>%7lßEŒ'Ò§…4RmâÁ_Fvµ“•®Ýrû…Hý©WÈÐ…wœ”õ‡{Ö̾0-ì^ '"F,3…¿V=‡–DÎXJ’æ•6qrâëíd6»gÿôOƯŸü…”ˆ¸H¯•=êLŸ¶ÞøQ“ĉ%'i_xÿýË;Ê3ͣؽ¢íÅnDœ#bœó^;÷""¢§û'”i=¯¸§ OKŠO¢ ·b\ÝYÝtÀÍviv%ûD\Þ×µTÉ ‚¥ÙÓ·¾Þ¸éû†Äó§Ý¿gã ¶"âÄQ™2Î\=NT[ˆ8猱„Ä ‰T"e<‰9¦• qÒÆ•ñ_´)ãûÖ F/®Übüx׊Ĺ¡k̈ˆ9 ÷·½àD÷¥mPŒ‡ƒ'¹K˜B9,òáK7oÁ0¯UKz{뇽©]½ë⥞ÓÖAŒñjv&¼Ëêà#èKQÒË{2¹ÄF*gƦMV/‹Ä¶ýgŒX}22"âòõØŸëkªwÜhh;¥œXí:ívìå£ñ šœ,;îF̵ón]{`j¿(CuΗF\ê 3¹±ád­´y––ðѧ1‰Ô°™žFmï8}Sƒæ eD7öŒ–˪º«då}WòÑ¿DèQú“s"w±¶ð\»:û¤…×ÓSçtØ{ 1Å$r‰ä~r æ–‹ÂJæp+6zÕ™·gŠ 3kàkòŠÞ'S8QüÓ'é%ʸA9\DúR¹ZC,W#Qúk·\–5ñäœcM&Mÿ¦ú¬d}QºmãAu,eþøãeŸFãG9I¥:OÉÓ?®’¯O~Õ-F\Ÿ}p&Î M­»U¢P®mi½Dc¸,JÑjؼ_Çt"J7äPµùŒHÚÀyïoK¿ è#HäDº×› ¢Nä‚?b€ÐJJçÜL*!"13­ý²È/ËçüOeçü7/Öe®ØsÒÝ2gwV²ˆ‰:½i?+{8†cpï£O)N*»™Ú{±œTÈbìÞá­‡ÆÜÜT#ØZ1bDœHbîÄØK­HDDfVR""Ý$¡RÍZµ]”†Ca­ß¸¸ä[ŲU;¦i^3ôyê3'G‡|{‹™i¶hg×LÇXR¯ŸØ«SJº»Xýˆs‰T)½»[O}Ì« ÂȧÉZk)1–=|"®Yçú5R òv´àLÔ&¦i5åìÔDE•sIww–—5pW7wwõ+‹í\-â.ß re³œ=^[¡ÖÜ5×OV£à?ü¶õ¿ìÂ˽;Ù%t¼ÉpFŠsNÄ— _ô̳­¤XU{YTôsC'†Ò¢·ke~J™éëÍxhcXÅàààààJ§÷¶VçSÛ‡“ké2)^<ÉjRѵ+KWmðѺ^“‘»7L'ö,v(^õEBrrrrrJJÂÝ•týÀŒK¤°.SÇJì:~sVDeܨêæ¿éØÞ¹1O§÷¬‰@ò…ˆ1:8íóI-eþ®½SJ?Ï›+æ‚ØÖI¿ÄÙTGD¡/EDŒ“ÙO‡6x—kÙÕ1a@ë@K‰æЪ©³n:;ÔŠˆÕr:püo“{±—Ñ[.þláUó\/—ô[2bZíú›¼wÖòTïž3pþ!ù(–OÝtF‚k­‘~IÍ®Ù:¦Éý=“¶Ü«ÝÚC¯†9¥.›º¥ìàë9§šU!½ëI·Nž3dÝ×ëN­¯P¶Ysº7²[¨ÊlHÏ’=š¶“ø iZƆsŽaø›½P"=¶gû] N¢æÔæ…³·ÞYu1ÊRÈú×ÍÛ·=Êy²NîRùmk„Ã{¶]7=ˆØTlZÇíóEËÖ” ¨ØÌláØnŽ*iܙͽWFLß¼#~H)Cp©c£›W·„¶Öqõ-Él\Jo»xÍ_Á9§ù{N÷þìÓРå\nQ±ï⥭]9çLn_®”‹¡eåÿÝŽoöíÕ21]§.YõÈÉÕ<ûr²üh¿ Cw]:R£ÒsµÃ¶Ó‡‹}ì×ü®¥}l,M;ÐLãà×&›¾)mºC‡õ~tõ"â6 .?ºÒ£e÷îí¦i¹•µSŸ© ÿ4àÛ?šÍlSû¼µº™yûúmX8Ý°7:” Œ~¶¯83D‡à^¾bô¦3Lžž¢ªo’RR/ï²rfQæÞåʯž?#W«ìЦuÜ8/±ûÚ¥¾-Ûöé´-MËÕvc¶Eèl¬ÒŒIK{—5—"±>̶Nž&HNNž4iÒ”)SÞÔ$g¦Ýûì,à¹.«x㥧&©”ï!bºö|Ì¿¼ŠŠŠ0`@```N³Q§ øP:\,×ÆÕfj…LÀ5Tð^VR\ƒþq÷¥AxsŸÊô{Óò7GD®¥ù^¯L×^ˆ“aH$ƘiÑI$‰DòÁ´e^ݸ2Füáý­¤¸ýýkDü‹N‚4¯ï´wïÞÔÔTzž<þ<:::99Ù´$£££Q8P´5iÒ$$$¤€úRŒ±I“&¡Üó$&&æË/¿¬[·®q‰^¯oÙ²e… 8µèKå_J¯(ñ¼Òjµ¢(šN§Ójµ(øü›.Ò"_:Æ /Ä«'àhžH¥¬suR3+ßJ•Ô2Ã9q1úä‘x]®Óx3«ÚÕ*‘á49O»yåIb† Wz•ów±–emkÃ)tMBdäõ„4Ì\åí[ÁN)áœã·ÏŸ¼“¦ÏºLó,WÊÅ&»’è"Mà¹ö…}ñê>žØN¬È§gŒé"†UÛ1´>¶÷{,iH»æ÷½­dDDš´Ä¸›âΘ+A%̉t »‡m<”‚ñ‚T¥kÅ£[–pN”[½B'²bvVfÚŒ”û/"Úfñø¶”}Ÿr×°¹UÊ[FÝzND¿Lâ×pЬæ®Yw-ãܽñÐÃügþy®õ0Æ9·,Ñp|yÖ}üQl¤TÁiþKìƒÇñÓªXá’,©#²*Sµä³' K$Jõë]åÃÓW+>ä&Éú} cœ1³ÇÃCÊÚ=ýsãí†ÃåüÀ“1NT?´çÃW2s×|Æ‘Ðj@»Ö¥e¯\a){½kH©|ýzR™\.—búî“•R•–ò‚ˆHδW2µÆñK·µÅ*¸¾ÒË¢x7MåïÅ^ù‘¹ÊÑAŸ–öèMy£p,!M¼o¸òRbf±¤¦é²ÖÃ7â 'EÀ{+)%ÁBí@D$ŠÕ×¥monþJßÆEÍžßyùJçþh½]‰’¶66²Ô›ñD¶¦³tQfJ*“Éß8ó~ÆÃÛ:ìúŒÔ§øŒÊ¯ö¥TèKçœèEÔÙ{ekÕÉê¥%¾ö,ܽúóÍK_f=Ÿ8'NbÓO#*Ñ´Žr÷Ü?‰Qöd•œ1ºxz—½S1›Ü·áœ‰+gpnÑ>; ™&åÕ´!¢RðqËŽQ¯[Ú5ôœu—¯êY½ú¿œl!Ûæ‹}­NNþí4Ë:/E)7V>K[U-KDŸ¾qÄÑgšìßÉ1}üÑÿõýµþàÙ§˜Xöªùã+'G³å#jï›õ†_×áÄ@ȼ/$æVs›z,²R*)Q}$vIÖ–˜pyhu9±¡“9GÅœR‘åá £¼6Û>ß¿S›&ñÛ7¹ZwÚáÊÅdœs¯Æ_oÿþlk?OWÿF?ñ‹9´~ǹ¸r½æ.ëèD$ÑÃy]= DĹ˜™®íòËéZÅ, Ãz…ù¦.¥·™´âR,k?¹¼ ½)¤TþÓ¤&§dê°±ßo6Ë×dwî©ÂÉÕU)eœˆ‘lø®s_Š¹‚3©7¯406®íþ-ë¿iS©í¾©aeÝ ?âœ×ýzÕõ6·÷oýýDÔ-÷à¯/ õvµ3ü·ÇÊ=-5bv?MPÙ:9X+³çžPÎ>‘Îs4ˆ‚96@!Œ°äõþRS§N8q" .OnܸѿÿWf›mÕª•¯¯/ Š¼½sÇž={RSS9èóâùóç×®]KLL4-ÉëׯãÎPä…††è;7nóR_eÂûQ3ß\Wÿêé¹þ—¯3N·ñú[ð7­Ùd=ü¿ú’&ã/?v Ád…üŸ©ñY9åÃÿr 8~ ¥òùPÀ˜f\ˆw¿•w;uïÕ°ÄãÊî¥wÝá¨hPèõàèòFÕÊÉ%L˜[¹#VD0Æ·~“=±­D­Vg¹ý#}ëÅ,å9óÞ*íJ¶ûncDŒ1WÊÆBšk^\´ìJÖý©‰%Ý:h¡R+KöÕ0–5ßFÆMg™¹µuéD-Ë:\sÎtñÞJ + ÇÇ™ùôÃeÆxzD1•ý©Ô.ÞÝÍ7üŽ±—õl¤f’\»ôóXÔjãC•µµñ{MˆaÚij6j!÷7mµ7‰1Æ9%Çû¤º•‚1Æ<üzOÝÆK;=ÏøLµµµñÝfÜ2™€˜Ñ R^ ¿bŒrŸ=Ýî&gã·ßdŒ%^^]ß¿¤D¡[:µ8Ÿ1Âá)•Ÿ!•spJ¤üêÅu[‡õ›¸nXs§Ÿg.Â\lP¸{ôi»¯*õ˜¯Ñs=ç{î¹â» ½q‰êf³¸AêU K«ä¬¼µ^®P4ø5){¿±}ôÉ㆜È4ìÂrÒN䦎t+oè0¢KkG©‹×´Í\=^à M4Æ,,­ì•©§%¦ˆâŒ==›`åhia‘¯»‡`&ðX]Ö§ŠÜòã ÃC8Î#b2A?.*×ÇŽ]ПûvÊ~”î¦Ðžz–õ`”7Ì¥ÂÃ\¯àƒUœs–z¡n`seÍ^÷Ò8çüà/ßÓyüÖ«Êý³Ÿ˜àhÆ£²Ëô;\]ÌéëÖš…ÿÒ{e,ãœ1Öí³%û,ÝÔ“2îÖ®õ¥÷+õ™™š{û’wë57‡¤T> (1YS;°ªãDîNÅã“Ÿb“C!»<7&¥ÚÈ>õ9çD¼\£î_×ðÿ3òñÿiI)D””ªÏ©ÊDºŒ$ã\jöèè•znOlö¿YjÒëYȈs¢'#§E¶˜·ÎÍÂjññcM$óѽ=-º`|ƒˆßÇ»w)ùŽÁ)ÙŸ­DÕæûÌœÙúnŠ!AYf m¯5¦Gg,%IóÊ·JN|Ã7Õë+Mã «Ç÷TKˆˆ—oØuUÏÀ™?®7>GÔ$sbÉIÚ×߇1Æmªþ¾b؆‘Ír·êó?ï8®œñ?Îéelä=k§y}‰snã7àó6gŽ®EýEJåçÀŠSåæû_–5¸¬½¿ôÏA5>%tÙ¡p¹8JOMYy&5-ƒ#†l;¾0Ìçí¿”gÌdW͸¶ÿ¦yp›œ‰K˜ðzõ'Îس3û#T¥§Ô·žb½ôûeZcíç¼Ì×s^ÎôD4œly:iö£CýþÛv#'™K …’E>|™¥¯}ì¿YÉ›ŽX»/Eöl×–ˆ³ìÜ©2n{±qï8¼Ïˆû|òE1íIDAT6=ØãY•ß׶wáÞ-rÎY•Š8ºO‰1¢÷ã씨¿H©üX¡¬Ÿ’ѵ#=JTN š<³O嬚 PXìZ-×añ·ÍËx—*áQêÛ)Ë“uœèm·®béÅÑU\³9»Õ ^z|x…¬óL¥º[UWSc_0FŒèÀŽy¥<‚TD?Œw|°àð‘/¡0«äUìþ™+/ˆ±Äð}×<Ê×VüÇs]2ΙDò 9ˆs«…ÍL>´‹ÃÈ•§ß>/ÈÌ‚Êš¼ÂÕëD 'zü4>ÝÍÛÅd×f¦wÊ)ÿyBw}™´ÑÂ~ŽÄ‰8—šYyy¸Nÿø±ÃØ•×ûŽŠfnÁ+ʳÍrNL÷2´RÍã·t«Žù¬’û¿ùý3@>UK^ÀÒø/Ò“_Fìÿcâè^?ù~É5‹ÿåKDÏ·Û~ëàLDÄu›§ö5aÄèöÛ ÓßêÓ“§ï»T,çèií &âDñ fk°û‘u ÏR6›öý¤g=ã¡yʧ%ï8÷™_ÈÁ½+|‚†iÅ8þòtÎͤ"3R;­º:Ðϸ?r µýß¼X›ùû±ËÙ÷ráDöJ"Æô:½i?‹g%à _þÂÙ%ý­Yúî/£žêk+%Ã)cüñÁZ!½/ÇOš[ÿ×ãÄí›Ü)AX®˜2×Þ¹VÀÏsÖ3\ÂGÄ6MXrDZvù»…'{Ñ·Mç g;I¾ÛqÔîæœak##ñÅÕêí—M9öxl×O”BVáãøQðŠìˆ#º~õ˜æa¤iÿ©bûñÖŽÂV‡Bl>Õ™¾È­x­ö#l·¯­2co^ì:èÌ U?çeW”˜I511i¼”’1bRÙÉ]“mrŸ:ËòíÛmßp²Áâ? ÃVDD®½êûݶrK“«$º×­ÙÈÄOºÎÿ¯vC‰ìනJN¢æ̶¥ówÜ_¹ÛÒpÄ—ÊbmÜ`’šZ…[‡Ïª¿mm‚dïÖ —LîóÅl«´làÞyÁò5¥+UüTþóènÅÔ²˜Sö]}aæ¶eï4âÇØÆQÝPÝsZsâÄÝ~Ó®RÎaÁW/í綺ˆ K#²¶Úͯup5Tb¤T~5Þxýž¿$÷üåõå÷ƒBl>qYÀ娣:øߦé™zRÙ:·ÿiÿ¤ÐRÆ4¤Êòå}e&Ã.åüSíd&+Qµé¸nù·ìÓ…DrŸ€j§þXtÊäßiźµtzžèÝù»–Ž¦ÇéN­»Î¹Eòê¾~¾ñ–Ãÿ÷ÓÙç­ú¶%"Ajá[ÞGš;‡`^¾Rå]«v<ïÀØc]²¢CRªbµØ}‹›<=Å*È$¥¤åÊû[ÉM.”åý+mY¹8׈I«– Ü9/¾óÚ¥¯ÚuØ£Cª†Û88MÜÓ«–“ñ»3&ó)倫½é»%Y´ëáÈyûå† À¨lÅCO‡Î›¾h\ƒ$_/—õëW´óÕD¤Taì3y¼ â?ü0yòd\žDEE 0 00иD¯×·hÑ" …E ¡ ï‚xöìÙ™3gâìNžÄÇÇß½{÷äÉ“Æ%¢(¦¤¤:t…E[íÚµkÔ¨ñ_žç» úúúvîÜ)•'ÑÑѧOŸöóó3íK…††š.(’,,,þÍËó|^J©Tâ>èyõìÙ3¹\niii\¢Óéìì윜œP8ù™R”W¯ðÁÏ n÷ÓÅ/˜¿V›=%„ʹt›vM,³vÃŒµsæ>ᦗ„µ_½ÿùÉüm<÷|‚\ÏkvXUùhþ¢ßõ¹q¼ZômZRa8çñ2îì¦}g’5ܾ„oû %œ´/ý´æ<÷!¢N¬Ûó›Êêüýªœ#ñù®;b¼ZØ×nê_Ò:ûËÄ%SVí7Ô_•ÓL];{šg›áóĽ:å‡\íòE×Öák{ªÍþèBqßZ­Uæœ3–°hÊâ:_õÍiôjVþ4£BÇá⩹Çnë_Y›™½{ŸNÍ‘Rï-öòúÞŽzî¿òÀÆ«öÜßVµ­^Ç€¢}4cò$¿úMT2"®½ð«~£ÏÝ:SN%eü6yLbµVÞÖ9sO8ÛT oó³ç•r(óð¾ƒåk‡Ø+½†{u"½äÁô)?T©×Ø";ڸȥ E"bŒm›Ü1lòáÆÁA¶füæ’齇V¾±É9íùÙóáJ¹ÀÅôCŽ[› ºLîóy~·†{|~]¥z]*•÷tÎHx8þ›^ F¬^3¢¥á6%sÇŒýºs®”Z>uTãêCnGFDdÑ“‹Ç"É=8ÀM¹¹C?óëŒY)e”µ9‰Ú”y‡MkûëÉyí$ô|Θqêÿ™¦”vÉÔQ]ê-q)“ˆ?Ž8%õþÄßEäܲxhïäERRÒСCùAä<=¶´Ü¦÷ÒpÎùµÕ_[JKœH)œÏråÊ•† Ž51räÈððpPt‰iÜm-/¾àœ‹"çœóy-=UåfpÎùËOlÙ¸sâ_¿8¾œ“ÅÁ›™ÆšÄsn61 oØÑ_îÿÞ̲Ô'9 ;Ö,ÝpÌƇúÌ{^Nê³4ÿÑ7ÍxvÙÚÞ¹ÿšèìOÄõOÏ{8;öØx›sÎù-¹ÙÒ{¦¯H.&L?–j|¼³k€k—¥&OÐÏkèYaô>ž]xÉ7Ösq¾¨å<ÖGn¾6×-LRê:KK7ɦ¶eKö\_d*RQ¾sÇãðS‰Þeu Ne;ÎþÌçÙ®ÝÑÀ(ø½‘q¢^Ë÷Z'¬ºþ83_wt0åNcg5pÈéÛ,ø¡[æ¥+™õõNLicYü?uðξ« ö•O­ÿ|GßÏ^hó¡ð8'3ûšœ ÷Ó4aí)Êw”w¨ÚúÚÑ]DĉQrBšÚY@á$'©y13¹ìÊ“¬;wÈÌòzçnö†É•4·®Ý®U'(g?ÆUõ†Û4VQ@—"§Ì]þ°ÞÔR“IØ9‘]å2Yü½çÿ~¸‹1Jyxˆ1}„5§(Ÿ—’ÈÍmåæ¢.á›þ__½tV¶ä›Ú渀 °†7¬˜¬Õ‘D©šZU:ÊØÕàúþóŽÌî[÷mmj¹²´RªËŽ‘›HH®oõ$)M´v°4Ù³ózçŽ#©wÓeíJš¿ÒäLž¤ÿóÝË-š_œÃ9‰Ú´¨sg½{¯/©BJͱYõ: ì¤/Wí_uêa:ÅS…õ ¢ÞIiFDú´Ä¡çùpßWûRoIQ“v#]WüÕƒ–­¥Kx’J–9»¶øâðþ‹ê7°+€£:S7Ó^¼™Je¬M¿×g(Ú*þù'0óìVN§çœ“ýˆ™¡~œó¿<|ÝŸ°åyü²&䔺te]ºj;Tš9cy]q¸(„]’‘þåéÌt½_1¢d"¦Muhãï:?,=•èÕa{e‰RnGOí^£‰qßןP?d¿lWß̪oGçc§Š¡“YÖa‡3Æ^„ÏÏÌtp·WI$‚^£7Í`½VÏ™äíë5/W¯}‡F¹Ë‡Ö¦s­M§çY‘=}Sd¿clÏì0ª³ÎÛÙ«Óµ©8X$Yv_"õIl V gxZg%²×ÏKýM@&½=JS¿h¶~ìð÷Ò²÷ýÌ>ƒwUèûgu©Þèߥ·–NÝ~1{ª:–z÷LP“yÓ¶ÚɉȭºŸr÷¢mÆ ~rtÖÙ¤Òu+*þQÿÇ£b9óÝË÷×öpÿÔK)eªûÈ‹joªèö¥ˆªv|9uÔ…gËYJYæu[Ž„.üG €‚k,*,j¹ª 7–›[ºz¶¾²¶ qNŒ˜™Å¬ ÕT1çÉɶ­øíe9»°(¾º6©¼¢“J4yU]˜x°³[‡Y³Ï4íXÑŽvXý²–¿ÿ²Zcá¾_W“NùëkË·ïHÜÌÞ?jÇ°*­CgöêðYçWn9s·LÓ1t÷4ÜïjÒœŸ|š÷tÚ\¡kXõGá;v^|Òñ¦Ê Ó¬_ è¬[e½a”ˆfΚX¡m'×u]šU¹wnëÞ+/­ÞY^N¹WW„jQ^çDŸ4iÒ”)S>Œ˜b¾¬_“›¥µa“6ÏïÈ ãŽÐ¯Ï‰®ÓéÂÂÂ0':aœs1W60A3ìš\¯=6˜D"_¬EAŒi¿¶¶ìuJâœe&=ü}Íú» ¼JHÛO*3Ž'^kº¶|ÿ¦Œ1Îù•£›wˆ²põëÔ©™ZBƈ$ÆHÔ„ïûsïù8[÷JÚ„XÈ$dr÷p.êEbAÈI`½È™ yýî˜YkË<³{ãÁˆ[ö¥*wjl.LÖƹ^™éÚRïñNÂÓe¦¥eêdfærIaÝ\ )PÍÒWå…qÀyóçyíýË‹ówmï¹<øI¥Ì ¡¡ÆHJ•"×’‚§P($‰iÑ1Æ -ùµ»¿²óÖçÍŸçµOÄþí{åçÚ <ÂÿË”âœïÙ³'%%ûDž<þüÚµk‰‰‰¦%yýúuÌ.E^hhhHHHõ¥c7ž0aÊ=OâââúõëW·nÎ/õz}ëÖ­}||P8Pä\_Šˆ´Z-J<¯222ôz½N—3E¿N§ËÈÈ@ÉÀÇàßœmP|ðÞBJR )H)¤ ¥RH)@J ¥)€”@JR )H)€<¥¤R)J-¯  àÈ[äH$’ðððÁƒ—èõúøøxÎyáç­ ˆ¢ø~–rrr²­­-jÀ›RJ¥r×®]¦KDQœ>}ºV«EQ¾N§C!ü·)õºôôt­V«Õjc(MÈ_¸zRH)(Jþíy)‰D¢R©Þß~_/üÓëõjµõàíØûp9À›;(@J ¥)€”¤R )H)¤ ¥RH)@J ¥)€”@JR )H)¤R RH)@J ¥R€”@JR )€”¤R RH)¤|`þh¡ÃÄ ii’IEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/MPM2.png0000644000000000000000000002070713051004444021624 00000000000000‰PNG  IHDR74_6…ÊsRGB®Îé pHYsÄÄ•+tIMEÚ 'Í&¯˜ IDATxÚíÝw`EÿÇñïìµHÅ„žH `0ô(]¤‰Òå| رë£úˆŠbCŠ…&((Ò‹ Þ!¤Kzîvç÷G „’CŸ$w¹÷ëñ’ÜíÍÎÎgfvvWi­ŸdPR R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)))) ¥ ¥¤¤¤€”€”RRRR R @J@J@Jüš"°´ˆhm™¦¥µ(e(Ãf3DkQÊ2=–Øì6E)1–€"É(­ÄóÜ€–×W,W"¢LXÉðèš7 Ÿ¸N”‘OGT®3ê׫õAçþ«)uR þ¥æŽëõúÆ°?ÈN;“™™>ý™¾3ž¸eÅá éòèœéck_­úè¾Î þö¤RŒÌH)øÓ¾NÚÒ¡óà&UKh­Etóþ Ž.5í·"bwºç¦û²NÚ””´iën·™µiÝo9Z‹È‘}›vw§Ý¿!iý¦Í;Ó­s£&+{ßÎ-IIIÛv"Ý-¢ÓömII·ìæ鶛"û·¯ß{Ü}vt•yl톭¦Ö’‘¼në±27'%Îðˆˆ˜i;·lZ¿~Ãîäãy13ûí›7&%%íØ4ß ­˜y @=Ô½YTý®‡<¹ÿgimåÒZO[ïÁµZë?~~¿tD¹òå£+V,ߦÿ¸È¹-­õËCkµhR¥ å›7¯Y®N³{sL­µ5®stùòåkÄÖ¬U¾ll»£Zïúx|ËúuªÇ5>úÕl­ÿÞ®ì]§ä~¤ç·C¢[¦Y–^7®ÌM#^íZ¾|Ôus7žÔi[ÛF•.]¹rÔuen·ÀÔZçlj^¾B…U+D]Ñç¹%Z[Å~1– ´–ç'¾—±¬féÈzM[u8rê›”RÍËþ`›G¿IIÙ›œ|°[È\gg¢œA;æM^½óÐÊ•ëvÌ{ùÀþ¥ÇrLYÿì ?„/Þ²cÛöäÃ[»f/~jUmг#o®S!®×»oŒq¼=™«?[Óþ›{ÞR7â݇úž¸é…Ý)‡÷8°ñÛ7Ö½?tÕ±ìÅÏ?·;®×ÁC‡vì;4÷±Û}ó¦HñŸB$¥(¥ÄÙtá¶Óküï°íÃ3v=н^™ÚÖË>ÿKg¾™÷ÛõÏ>ÜRkÑÚvïÝ=3²Ì³?²²+6| BˆÒ¢KV­js[–ÖRÿ “T3X2Nݶ~urŽ-ÛÔ"bZZ[¦÷íÉjñÞ¨¦%‚"Ç¿™º­Íßj-ÿaáÂ… 7§G´°§OÙxºüu¡GwnøhÖOÉ'³Žšxì—/u¬Ç`%:€€å9zøhXd…š ÛÖltÓHÉÙ×¥vóÎ>=ùý°³¿’¼þt™U$wÝŸª©<Ö¹±˜e‹¨$"JTîšvþù„{G½8§dT¹ˆ²‘ÚrUýó›!"Z‰:x0+øø[­UgßÖV+ή­Ø{?ø0yÀkß;>ù.×ðߟ|zG³*Zó) `èQ?ºß9¿A‰ˆh-Îèÿ#ÆŒ€€¤E$²njíÉ ¥Dõä†:Æ„äýZTÿ61Ûžzuµ%Ÿ|4-4È[JmÙÿGõ„Êf³ÉÉ%3÷9m[îçÆÙQrÚoÝ’H_L›âºô «t»µÜÄOçþÏ™¤ÏËW®¹=U¿6¸}“~O†Ín··îßÃyæT³øï(ÆR’­õ{_LêÙs°+dFÛ6 ƒ¬´_W®ªÔfЂ±ÍDÄ“–n™"A/þë…Non»²{ĉŸÝ•n0Ý8 ‘œ¬ô É;GåIMK×Úºó¾^/t|´‡ãTM×ñù¿ž¬_æ‡G†oÿæíëÂ\g}1öaû„—ìÑ¥w×Go¿ãd_ǾE§£nÈ>±CDÄÊ–´Ì³ªeÔs“çuîÓlMÛšÁóg/è9vjíp£êýÞëp_­ÖZ\úÓœù†>ÞÈ!RÜgü×BÜ•ÖJ©Ó»þvÙ&³T³›»ÄFç^™tn¥Ÿyòø™°RÆÌ/¾,Õ°{;ûì]&ßµ4HΞªÊ½R^Rh•ñûôsŠz·‹Ï9¹ÿóY+ºõ½½L^òåg‡ƒêô¾¥©]IúÁ_§/ØX½uïV5Âò†v*÷š(¥ÔÙw•ÕßÍØò»ÕæÖÛ®/eœÝ(ÉXðõ7ÓTÓŽ=⢂s­˜w'H)T4ô¹¹•ÿçýë…›¿›:¦…ˆLÐhæÉ¿ýòíÞEâ‚·;?ÌÉ÷r^]öãäÒ¿=ÿçnkÁ[¬p^ @@»¨WE–¨7¦ÎT³î.Q6<¼ÌÏ%{ó•×]ð#u¹—/¸«à·R—yW¥ ÜTÆR ƒ­ #@F0¤WÆŒ€”€”RRR R R @J@JH)H)H))Àµd§'YYYGŽáP^„††–-[–”€"0iÒ¤Q£FQ^têÔiþüùþ²µÌø(V…àÍfó£­e, X‰0`YåEݺuýhky¢<­µ¿œº#¥¾‹óRŠÿ¸Bð_Œ¥Ë–-ËÈÈ  bšfË–-ÃÃÃ}pÛX= øÛ¸qã±cÇ(‡‚X–U§NR Šl¬`Yåà%¥|¶|˜ñPü:uÊãñP^RªlÙ²¾y)ð]¬ñRüu¬žP¬>|xÖ¬YÜ!© ZëjÕªµmÛ6@S*''g÷ÞýxË|»Ý^-&š‡IJ¬]{öY–€ß½úõÑv;-fáùòË/¹'ºwíÚµ Ü”š;Ác/MŒ©Ó0 v¹2l6,^±pVXXÀe?q²SÏþµ›uÔ¶øà¶u/Ñå–®ÔBã_7ü.N§ÓŸÆW»Ïl6ëÒ¿E—~µË »,ú@DX-ém–!¶Aëž#Ÿ ´ÑÔú…S5—é®^½zEEE‘U^T¨P!€SJ‰Ö·¸][Ü(ìÏä”ÖZ®nP1 ]dddÏž=)‡+ÖL9CÁ?8~t5~ÔÂw£‹”ºj{×f£0q†Í¸l£ÉŠÐÂ4eÊ”ÔÔTÊ¡ §wïÞ¾y¾Š†õªD”¤¦¦}òÉ'ÁÁÁù÷úM7ÝT­Z5Ê'Àþïæwä÷ îÆ]«V­æÍ›S8…)55õèÑ£”CA,Ër»Ý¾¹m¤ÔUjŒLÏÁƒ].WÞ+¦iž:uŠ’ pZëßþ¾ÿþü/úæóŠ7—ËJ9Ä4MÃðÑe ¤ÔÕT1‡ƒ+T NI_áî»ï¦üküÐ})À_ÇŒ€b%55uïÞ½>{–¥Èi­ÃÃëT©BJ@˜>}úСC)/Ú·o¿`ÁÙZºŠFQÅ c)ÅJBBÂèÑ£ýë¶ß…Ik]¯^=R ŠF5Þxã Ê¡ø Ž))Eƒ+©ý3~Š9¥Ô´iÓŽ?Îå½ñx<}úô‰ŠŠ"¥ œ>}úرc”CA,ËÊÉÉa,EÃ4M‡ÃA9xKY–EJ@ÐZ:Ô4Mfü¼QPP)E@)ÅåSþ‹5~ˆƒ'ÙTÆRŠ•¬¬¬7rŸ$/Ê”)CJ@˜:uê!C(/–-[æ/[Kw\óˆËW ?­6›=x…щݟÆ'Œ¥ÚÉ“'?œ<ù¡±cµÖ,B¥Ô«¯½6v̬ C† q¹\ìÇ‚p·ÙÿgN¹B%ÿqa¹Åý—Ž­µr…Š™©=š¦×›ô´´¯üÕãyyÜ£ûWOß°+g˜Yâöœ¯Z‹«„"ÙéÚÒÊ*¶|»_›âÎKD‰8‚ÅfHNº¶Då«z*(TÄ#YYd¶¬X¿ca§Îß7ßï‚*&&fòäÉÝWn%ýd·úØŒŸR6µï¹רxu_œº/NÝ{£sÂnI{³Õ_{—Ì—Z©¥{þÄNÐZ”• ³^:²rõmÙåŸzò êéÛTÊ÷}Ç4/ùÞÔŸœv•·+îÍO5tnXê@º²9Ý3oqü£‘[‘î««éÚ`ΜŻhm¾Ó»òýñ%—V:ßèAï{alãà§~Ôi£o#.WPâßßëСƒRŠ9áb9\ö—MõÁóRÊ®ÌîSõ»[ô»[ô[KvÕÞ>ëÁ›2="åHq»þTS£”ûäìQµâNhä´Ö­n¸ÃSù駟ÿ9¡lÁ®²»fLM·Ÿ«J[¿8³ddPHIC‰ˆØƒKDÚúÁýî=qƒ¾­Sôª—{/ß'JÄZ²tpÒ'_k€µzý;ï9ÃJ;™)Ê }‘ 1U:>üùm·÷ÓZûuP‘²~Í'ÏK)åÎðd¦ÚED;ªt1aÝCãN¦fVŒÖZkËÌœQÊf’ûO­MË´D”2l†¡.ª¡–éÖ»2U[¦eÿM­Å²Œ°0mŠ Ìi­¥m¯a›W/|vÂóÿ§ŸLX:¤}y=uݶ‰Íb”ˆ›ìúåã°F#3~ëüWËIÍ<#S´–z#¿þmqðæ9Ë›h.â©×|Û–‰¦ô²‰­$3yáöœ:UböY4 ç+FɈr­ïŸÔ­{Ϲ³gúïÉK¥ÔG}”œœÌDnA<ÏСC+UªDJýOÃ=»C´åÑÚpÊϯ´›ÿý¯Y–afK©ZFMœ"ZN,ûþ!)‡›6#,ªYßI ª•»¢„S™†½ùó0¥$ãt†Û­CC̬íÈ^½~û¶E#%K2ÅÞúžwC61g1cv‡‰»bʸ7¨‘Ç£óõ©Ïý[›aUZ¸Ô˜””3ÆñÙGÊÖˆ µmò¥ÞäÞ½{¬²µÜ6²H>½žˆ'炆>84¬×33[&´Yµr™5sœŽ"¥®Q½R½pdΘw&/»ûÍ¥‘¥Ë–ˆ,µd ó ˆ .cÏ8žiI e¥¥ìÝsäúøÚVö™öÏM¯W-uñ”ú³f.zG¢á·²Ë=°pC™Ü+Ó ±âÎ÷i¤ 6C[ºF½–ÛMóžáÃßï=Ÿ®¿‰mÒï»·'x’{ì3oRK¬ƒ}Q—–m^…Té\×ñÓÚÝMÏ.]g´oÞø͇*†Ö§ëÖñÿmØ°áÚµk¹žR—qpç¾²±7Õ®QÝm‰#cßÎßmÁ6»\wëõ‘wý8s뀵µ!Û¦Œ™ú]Ú_LK;ƒCÄ2âé»&<8dCë=µ"š:ƒ­_µ¯Sb´Ç’£s?ûúÉ϶çÎpØEr´GÝÙsT5¶^}4eøð{Þ{ï}_nÊ5êzü_ó_ýWµ>%í/ "-©{ß_yIë¿Öƒ}ÿgò²td¥ÛžÕ¨I³_V¯Ô>9LIMM]´hê(xîDGFF6lØ”úßY¦ç²§ñê´h:ëñ7§}V+:ìôÒé“uÉÒ'f¼v´æC†=òÁ¿?Ú9¼œµqż•Í'ì4”X¦[‹ˆ¥ƒMhÜtÖ·/½áõWÞÞæ½Ößßut”m×ò…KºŸ’%9ÊesìXòÉ”–}Dp°¼öHK³Nw¬ýÉ5xð]<Ùç‚êìµb×î” Ó—Ÿè3¢±Û̽ðÀ}ö(ÓcYºà:¦E‹­â=שç÷Ø:½^$+ïBxS:²Ò]o.mÖªíªe?‰ïÕìÙ³ Ànò¢I“&kÖ¬!¥þ׈’*ÌËR—Þ/RëÐ&?þE·ŸçM?£ÜóáFÛ›—ΚcZžJŸz¬ÅÝk¿ý<]uÿÇÌ%béû¾ÎPv%Ú’nϯ3-±L©ÜÆ“]¶¯ýî« [û‡¦}ê2Elamî÷ìÖ}©6n½{IŸ«aÛûËWíÛÀ?ŸâCAeId›ÉO¶R6K´%qÿÜ]Û´lv—ˆ8˵?ï Í.–ÛÞñãã ‡ç2«öŒ;ßß)Ên‰ˆ ¾wJ²Ce‰ˆÄ_W”›œºRÅ°;œƒ^û¡A£&Ië~õµÍãÉñWä_MK)›ÃuÙî½hí*S«õ 'DD[ZÊÜÐaØ –)ZkGÉ*ÍûS"–uvÁÚ¹7QJDlû¹ÔsDÔjÞÿ±³¿©E)ÑʨÚvxŒËbÆïâ•Ö:ºvƒœÌáï¼ó³O?õ¡m3vãrÿV†Ýá<÷²« ïe³;Ï×·óÿÃî ¯ò'+†Ýáè÷üìøú 6¬_çSCíæÍ›O˜0¬ò"::š”ºV‡ˆè³ý\%"ÖÙÕêg_×y?(ø-.øM•÷’XZˆ¨Ë¶G–¥k5n5ÿ“×&Ož|×]wqÎy]é¨ mïyuè°aLšä;£råÊ=öûèŠbî6‹âS•WÎý<&ܽÿþ•+WrïQÈÙ[ÈËþ­f>?°JåÊ3fÌ bøc?ƒ”‚ß³ÙÕª¹Ÿfm™×¨q¥Ô‚ –-[ÆX J©”Ý[æ¾4è®aõ֛7ož2eŠÏñé×x " ®N™7ù_îÝ?5hØ(o~`áÂ…§mÛ¶”OàF”!¶møñí‘=zö´,K)¥”Ú±cÇ'Ÿ|2hÐ œJRJÍ™3çôéÓ컂X–Õ¾}û *RðZk›]Í›üzÚo߶lÝÆ4ͼvÇf³-Z´È²¬›o¾™sTÈ°É®¤5³^Ø·ÿ€ÜˆÊ«{öìùôÓOsWûZÅ8rä÷D÷~ȧ¦¦2–‚ßÔWe¨¥_(–µh•˜¿%:[iìö¥K—fggwéÒ…  ¬Š¡ÔžM¿|ùLŸ;ß}iÅ0 cÏž=ü±®²QJ±êïŠ;—”Blv‡qá®(´úb™bYTP»SýøÅD{ʪº7Æ_Úåó¿üò‹ÇãéÖ­»ïZ\ìEU1´%¦yAÅPJíߺöÇ·ÿ~ÙˆÊûLš4iØ°a>U’ƒ âzmï|6ÅI©¢W÷Æø?{qwpHÞ+îwÊá”ì¬ìkýÑîœìš­z'ö™wvÙá’™_PÉ+ë7htÅî•oÎb+U>³íí·ä‹(•|(9--M]ã´RJ—‹é;þ¼Î6Ù´féc»víšø²ÂŠâ>î~Úƒ”òƒv»víÚµk—ÿÅŒŒŒiÓ¦¥¤¤\ë1øéS'7Þ'JDŸ=5çýW<{—4mÖ¢ ÎrÞä@›6m5jČߵ3ûëé½øÕW_mݺոÆwÆ5 cþÒuybØdû¯Ëç¾zWß~¼DTîRºZµjÝ~ûíT RÅÄeäÌÌÌ܇¶]ëãÜíñˆ8rÛÃP‹¦¾tl]½f-¼41¹?j×®]Ë–-i‰ _nÅ(„”Ò¢óv÷Žu+æ¼2¤_ÿWì»DGGßqÇT R¸Êœ.5wÒ+a©›£kÕòÞ‰HÏž=ëÖ­KK ½¨ë–®þt¼÷ˆÊKD”µˆ(™þúS®cë£ë7ð>Š‘^½zQ°Ëöµ‹×|öDÇí½Ÿ‹2M³aÆ·Þz«øÆôœœvŸ·vßnϽʔ‚ÏÓ¢”úæG×ÖkØØ{ö(¥:wîLDJD¶Í«ÖÌ}Ä}ûy(­uƒ n½õV©ßÿ}§N؃^Ô­[wãÆŒ¥ð¿SJ¥¥¥×þÙ±†Í¶û·5-o¬Ó¨I^£µ¾¨¹ÉEuïÞ=>>žˆ*Z†a\ë]`Æ'þðÖ}}ûõ×ZçVÅKï3”ûJ\\\÷îÝ}§bðüÃ+ õ§‘;ÌEDDŒ1¢>(++«W¯íñññù§æÌ™³iÓ¦¼GkmYÖÀkÔ¨AD¹~ýúÂu?¹k84h÷Y†a,_¾|Íš5¦yþ]–e5iÒ¤k×®>U1Ê•+W¦L™’%KR[ “;pÚˆÂé섆†¶hqñŠ>Û… TJõïß¿FâW÷Q.®‚ƒƒ áS´Ö—®áÌÉ‘ÖÚ4ÍÖ­[·oßÞ×*F\\ÜñãÇ©*WÜÅœ—‚?…¢—õìÙ366–R À*áý\T«V­r# Åì¨'¥à7]­Ü‰¾êÕ«SÈ_1´Ö ~QÌTû5R —çñx† VµjUŠù¹Ýî:$&&úQÓ¯”Z¼xñáÇɪ‚˜¦Ù±cDzeË’RðC‡%¢piDuîÜ9!!Aüí$åîÝ»8Àô2Ülܸ±o¦ÏêÅÅÒÒÒì_«€P,ËêСCnDùãÆóÄ^ï)å³÷Œg,…‹ 0 ÷ÑàL ¿Ü4ûiÅ4hÇãa'zQ8ËGI)\W\ß…@®~Êétrµ¯ŸbÆ@J@JH)€ó£Wyõ„eé‡öÞ•”ÿEÛ“ûÜÏkM‰*œºˆÍæ8süˆTŒ¦ê{qæÄ‘#»~3MOÞÎò˜žÂYüj6Ë2‹ä[KÞ,¬C)TIII‰‰‰ÜmÖ‹ºuëΟ??@Sê涉۷l²ï—?·~^¾<++«0RJ©¢ê ”tºœÎšÔþ‚DD”êÕöFÏÎÙu>9Ö­[wôèѨåv›ÇS4)¥µ¾¡y *@aJMM=sæÌ™3g(Š‚DFFúÑÖ^唊ˆˆxlü㎮¬à7ß<}ú4+›™Ãá3fìE/N›6mëÖ­T \õÞªˆQÞ‹(@Sê²}I.ùFAuƒBÀU—žžNïÇëì‚'w@‘ ¡Š Öø`ÔÆRÀ%˜“A¡Õ´#GŽ¤§§S^TªTÉårbJ)¥¢¢¢J•*h»Üãñø×BšÂ•‘‘QTkÃ0Š¤‹­µæ~ó…oÖ¬Y)))”ƒ—jÙ§OŸ¸¸¸@L)Ã0úöíK%À¥GEbbbbbbÀ~}†’…©¨:%TH?H)  A6_…¦eË–ÇŽ£¼¤T•*U|ô`¡€|·KGJ|+Ѥ¤àŠ÷ÉP´<8nܸàà`Š¢ +V|ꩧüekY= XY±bEBBåàEllì¶mÛüek™ñ0–€BáñxöíÛg³Ù(Š‚¸\® *Rü1ã ¥ ˆ0cäטñPü}øᇠ¼¸í¶ÛôÉPô-ÝÎ g½7}v½ ) ø+[¶lzz:AU˲J”(á›ÛÆŒßÕöPMIDAT€â?P Ÿü)ð]¬ñRRR R @J@J@JH)H)))) ¥ ¥¤¤¤€”€”RRRR R @J@J@JH)H)))) ¥ ¥¤¤¤€”€”RRRR R @J@J@JH)H)))) ¥ ¥¤¤¤€”€”RRRR R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”R\;ÿyºå´Ä,ÃIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/NFQ.png0000644000000000000000000010334513051004444021535 00000000000000‰PNG  IHDR 6ý&ðKsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ; Š}Á& IDATxÚì]w|EûföúåÒ{B %”$´:„*M@AEEAñU@,Øᵃˆ"ˆ`QªÒQ¤wIH!„ôÞï’ë;óûcïööRxÕè~õC®ÌÍÌî>ß™yÊ<ƒ(¥ B„ˆÀâ-!Bä†"7Dˆ¹!B„È "î`nðF-J)÷úO0sñ¦2JíM8›Ïø–„%ïdØ/¢Å}kq¹×ü‹ß¿¼£C—®ó¿×Õ—2(  lIÊ‘Åî¼wÞOŒ 0¬{ýù åF‹^Ç:;Œ\ýÄ«¦ì€1†ŠÂÌc¿½tùòµ¼“•*5žÝz1bôˆA†R@wô$ûã'=˜‘¸¸º©ä ÌI>å×Lü4âþ%ÙIgŽýVzÿÃÜ]ìeù¢ˆ—Y@i¨«®¨ÒJùu ‡H›š´åeezÂIµ—¾°/Tx&@›ÄàÞ!{=ŽþØ–#vÁGöÅ!âU+;%í8*¶šÊËËôf¶ù°V]iY1Õoݺ+úÍg=ˆÚU(‹±±¼¢Bk°rëǺªÊª:2⇂±…ÌëXªèäïÎ]ryÖùwÿûþoתâúŽß‹dÐÖ¦$žZ~äPüœ—>û€ D…ãïâ/2ßös_YƨÜ倢B!x=åܺ ƒÆðpBEÉ.Ü{†a7›¦øª0Ɖۇinø¶‹)²/é[YïÛx"¸þ3Ûš\PÔÁv;ÓP3È1·¶`AH"•âVGj„¥2¹·§GÖùƒûÎ ™}Owj¿ ,‘H{‰T®’Ü÷ŸùýÛx>Me™Ÿ}ð^|™dî’wGèàlñµ”m_®Ù²á™ÜuÙS÷ J°¨tüåv*Nš(¥ŒLâëéŠ1r¬kÒ×”$]NÈ+×ÙDÖh4înjW7@µË¡9?;#!þòõ‚r»9 •IÁX—–˜‘omkI@÷;]UqbBµ „0(ëXÝÕÔÄË)õFÊ 27ÒóJmúÐU&&ħ\¹¦'ÐŒ*vîYr®¤$¥^Õ™86J w5ÔØ–xùj^)(dÔöx°´çà{‡wb¾^·)½°ž[kAë*5èZO„RÒtöðOG¯ÔÏxê¹G& p£”PJ)0Á1‹ß\:²³Ë¯?¬ý%µ!‘ךŠ“CaÚ›¯½©Œ{tɬ©ØPöÆ‚y¨Ï‚‘Ê3ï®ß_oAW׈>c—½ýj|½ü™wTú»+ÛGÝîÑ?-bºrjÇÛ+7ç”V›­T©ÒEôZ´ìý¸.€(ÈäªÄ#ë–½óu™Î"Sº„tëÿââ£BZ†ºìÞ_yøLr]“Iªpé÷¢}"Œ-¿|ÿ“ï~®ÑêX$qq÷4ûÅgbEX`3£¦5)K^y÷TZ®Á`Æ2¹«gà´ÿ¼ṳ̀XL«¶¯Y±¿&ô©?xgUBN™DáùÄs‹§èN `lØûÅGëw©iЛ­ÑÂÔXÀLÛs/rê2ùžàK ÞÚ°uÿ{ vUJh›·º]t•â/{„v20Z)±üÒ»uœ>uôÅÕû/^89¦ÇT‰äø[ü¶ñ”“Ñh²Z)¥Äj6žÝóñ›ãGÏ~eý'o÷õ¹v~÷ ¯¿W% >}ÑŒqý(ñœõì+/=7€^;þÜ3ïÖÈB-[½í‡Íó§ m¸vîÃ×Þª`°ÂÃœ»ý…å?„Ç=ºö‹ÏŸœØ¯:ùТ·?Í(jh¾z×ÝX¼xÉÎÓÙQ÷ÌÜøí–—W|ñç×ßÿ<»B‡1¤íþlź]®¡}–þݦ_‹ôa¶}º|Û±„1oÁ±M/P±pæ‚_3k†Mž÷Ͷ«Þ˜"kØ°tÉùâ:„(erO>÷ú'~Cçüzúì†OCeÊ·ß~—Q¬G˜îYÿÞ;›"MÈÜWß_µì9—êKŸlÚ¥5²m #µè;tò¨~—ì:Ÿ^ȶUŽÐºJsuiaa‘ …ùÕVÐéj KŠ‚»º¸"› aŒ‘ýûöQIHéÒ&K«ñ×Ìü”ïxͲĈ_¾zÖÈn0xø¤¯^lí‘_Ž'<0}Èè‘ù׎_Ò_¸¯¬&mâ%Ü#nÉ+/êÝ¢£{)ÙúOOä^«„þJ™Lõ÷ÌÿdÅC`èÀÁ=ºwzñµ5?žÔåÑ¡ÂœþåPbzñØgÞ}ç‰ÑЯw¯^Ý;ÎyêýïOM\öPäéÔ‹:IÄ;[?í г½û;ë´˜ XcŠ83ÌË.^£GLÿ`ñ4€¨n]ý¥÷?¿2õZãÐv ‘@NVÑÄ…½;÷ž0{QeÅ»ß'5Ôךä†_Žž”û÷^¹ù‹(€Qƒû¼øÒ«GSJWm#€=œ>ã|ü’ßÿØ7z‘§¢•Ê¢×¾9¡‹ì:`³¶lܪ_<êmÑë µOß`,W8Í ¼C#ÔO*ÃƦ³™€T }ø{¹á´òêØcÌÈn¼Êú༧¶ý¼0%åÊô! &#¥V­Þ@AX>fþ–Ñ__/ SmuYe½A2Ìr:® +;Κ>ˆ¯ªSôÀè®{“.[¦uX|HeÖ•„Jyßçgâ»Òmðè¸Àã?'ëîëîëæ‰-Wömþ…Ü-¸]wôèVfá' ÞLB‡¬ZÕÃÅ7ˆ«õMºü’* †°öqÞŒ|º=0¶Jeåj/)¢ ®,¹v=«dÐ{_Gy!!„|»‰x&ýÇ?¼i>Qqÿ™ûà¢ß~¼;î™ýZ®ž¤JÍ+[¶öÕØmW€€˜5Á®¶;À™©Ý9d› ‘ÝvNR,ÎÿÏÜ ·pûÐEdšŽîP\WÉûyÿƒÚÛOŸ—~pÇÏ…%eµµÕEù¹ÙyÅrï6ûÅ õê„ g+7•[ ›&³±š›‰@««¯mR+Ù¯>|›5ÉjjL-ÐêM×ÌöäåCkæáÆW&ìX_rõ«Õz§gG¤QDíwà‹½Sžu[úÌ$5~ýî‹ä"ݘ9ƒÝÕRAÐ+ $÷k„LI§>ÜgÖ0Öd,J;úî;XÀõ••fK;Bv›íò©ÍçG Ë2š°ûî{eí¶ÅÓÆÌY¸ BR¸vÃv£B£RêA–%p1bŒ[Œ-ï{G. _^pîñWË)æÃo)a)a@§È»G¸OuȳK^¯ÿïÊ£ï?vfÇÐgæN u—f'žÉÈ)³XLl@—ÁJ+KŒÄ‰ã¶Á,[¶ìV]Ä »ž[àݹgïÎíÁ¢;zp¢ãýOÞºcýšÏ¿Ü’­÷œôÀŒ—Ïõwa°®²89ñ̉3'ãÓ¬÷MÚ5@pþøƒ‡OŸ>µ{çöBþÈäé¿OHÎöïØ?*L=~ÞŒ!í2Îù~ûž‚FåØϾ:wJ § 0ÃxuìÕ«‡·”2jŸþ½:ƒQ{ä§ï¾Û¶ûèÙ¤À¾“V¼:/*̛ӵkw5^?²qã7»~:Pju4c–R„0u i×P|uÿO»Žž:ûóÞÝ¿$”OyôcQvÂù#WuÝÆ *ÏË©ÏQƒûº«œµ¨®²´¼Á;h`€§&´kL—©±æøÁO$õûÈ«‹žèÐ.¤{tµÔ‰hÓ⥠— ¾}{µó÷ΰDæÝ©G¸§ûè}¢ü=•`6™ƒ:FÇöéí!uÒìFZ•Gðà1¾Þ¦šÜ};¶íÞw8»¤±Kì¨'æÌÔ¥þwÍwêö½{uôG-"šEܬ¨ß|Œ:XG k4š°D*“ÉŒ Å/ÏÙ>çÛfh«Ëj´©Ràãˆð37¦'Å'_Íu éßÈhÐW&¦dTèH‡N]£"Ô”|þtN;°·ÜÖ–¹©º¾‰‘)=Ý5ü€mV)!€l*2­.+ÑÌR¹ÊÇÏO!AÂ}5•eÚFEŒÆÝÛÇC -vM¥c0k³®ddæ–¹ùG÷ìåë*+ÍNŠ¿’ç×%n@7o³Qof‘R)Ga„!¬Õb¶Xå ƒ±­2«¡ªF‹d*oôM(„UQBÀþžÚ^ìÎl§HB)¿¸"„:íåpÄP \±½¶¦^ga©L¡òòö” ¢ß÷åùÀ¹c»{‰šøßÁ ¡:Èßm}}ñ+ófiCfnþhV "A³i¡h \Í 4+Ãïábc©s°mK¹Õ¯À9—ÛuÚpÍ×0ΪÀ¹o¼S¡yÔ;AÙlo“mªBŽ û!çVøøÆÕ;[ZÛæÔB9¯¹(è—¾!x(”’†ºêz7C³rvùeóGn‹eç‹rÄÖò[2(A è@[BÓêV þ­'a|:ß숓G­PµÖ° 8·ÙÞ&°…𢖷…‚Sxr³]ÎË*§-#­ZÔ%üïârŠKÊ]ï{ôi“{Ÿö”æBlãŠ]rc[_uüFzîÔv‹´Õ·fZ/Ç ȱÝuîÜŸ6ij›âh¡å/šâ÷A-´9ê·11ÚxM‘óÆ‘%ýšª!,kÀ #ÎÝÿÿh>-èûûûtqnim¡8VÎ#ÕÍ \-7¬6ߪ*BÄ;o´ÜýêØzÊíO¶å°Ïèö!ì&…› þN[gÿzóíô­"îV}Ãþ˜»_9’ûFR¡Ö{Ë*!%Èî”þ'íw¶ká΃‘HŒ7cÍñǯdæ¹õ{`Ö pÞÅ?î¤ã»Ï^)wêöÐý#øÖ²»!„k².l;ž2ìÇ¢ü4ÿ dÈfŽhañásÍ‘}[w¾@ÂJÆŸýÔ‡ ˜µm‚¦Í+—ÿ”el×{ÊäÉ#‚AäœÀ)ͪÌ3¯þÊcÐä(? ¿öpòÜ„"✑ EÊ'Ÿ[‹¥Ž#ûŽ]U²u‚ßÍ÷ÓÌ!H„¬VsYq!È=‚¼³IWĆ[ˆ5t\¾áû„sæ82‰¸›¹!tp›­$¬]„€GÒ®uÌ9,`×ÚƒÔ«ÛÀHŠ¿Gqñ°üøݪÍ©mBy‡BˆØ$—Øò;![¥Ô6Ê ýÕD¨Î ô Þ‚@ùù¿\MüˆëŸ–ÙûëU„çE¼gì?„(±·NI}MU½VÏ‘ë‰8oüstqd5›}ºöîTl8S˜œQ ½‚%0‚ú³Û¯Uw6«‹áPB ¨‹,FmqQÞ…SgªÌò±b¢:º¨ÜXŒºÚìŒäóñí£ "ÌVÆÉz£¶67#þlB–2 Ãиí¼<åR†ÛÓª«¯­ªmP¸ùz»Úiè˜X«EWU|9þRFN©Â;tè Øà RÊO7fCcyaæñãrï؃ºµVÊ%(!ÈbÒæf¦_ŒO4)üã†PH¥\"B«ÙPžwõ̅ߪÌÊþqƒ»´ q×(¸i¢¾º¬Î( öS—æݸxöD5x4¨[x \.auå97*¬ˆ¾.?¿ÄÏÏG­ý)ɶEü¸å8\sÝñ_)•÷}c¬Ë×û’ÚuïÙ»c7\&ì;tà\ÚCO-d¯Jªztêp9†¦²¬/>zsÁKäÔj ¯nß¼éXrI§È(O£Šœ„w^]´|ÍÖÊF}ò¯?n=t¨ñzAÅÀ‰Óºùjb³Ž.[üìGߟÐôéç­_÷}ƒÌ7²KµL‚:ðÕ[÷=òl†%húÈ^¼EˆK"J,Æsû¿š÷ì+G/ç46Ög^úuÕ§_¤1}b42™êò?_¾øù××—ëÍùé¾Ý¼õZ íÙ½››J®¯Èþdù«+Vn,¨Ñ秞útÝ–ÖµL7…7Vlþdé oš]R_SºaÕš‹7Úw‰ òr@›ßyjÞgç]ë.¿üÊÛW«¯_úuÓ×?”Y]{õêÎœ_9ú¹OMÖªâÔ{/G÷Ž òUw.èm@—»ä™ûî›ÿ©™V/ÚmÆ››LÜçVíúåóŒx¢È¢ÿ|Á¨Ó–j ¥æê/–=Õç£Ýg´ZmCíåã»&ë;ãÅ5• F«¾æ½ç¦öè3싽çkµºÆ¦ºÃë÷ëÓ§ÿàa»ÓK)¥9 ó§¸ðãìâ*­®QW_¶õ™ÝŽÚz:‹+´í͇»öµùxªV§ÓÖ”nûäõžQÑï}†Rãú—¦÷Š¼öÇ zC£¶æÇÕÏwí¾ñ|µ6ý¸îõÞý†­Ù~´²¶A§ÕfœÝ9&&úg–çÕZ(¥Û?}-nÈÀ>Cü9%¿Q«­)Í]¿t^ϱŸþtÑll,ÈI›÷ÀØyKÖWh›Lf áû*âÎÃm'hAˆš›L^ΞvêTNµ«Ë2’Ó;Ýûx06[(FPq#ëì¥Ìˆ±ó^œ:ØU£Ñ¸zÄŒ˜øèäáY—OÖ4Ö•fý-¥çħçMè¡qQ«ÜÇ=³rJŒ¿ÉÂrÊjVJBz¼ðÊ’]C]]5ž¾AÓæ,ÛËíìÅßjuF 5`ü[o/{ll‡U”Út̨úŽzøÙyGyk\Ô.nþÓÆw6˜‘A§(>°áÐõ‘³Ÿž9¢»ÆÅEã0ùÞî5ÀdÕ7Ý8½çLfû¸ÇçMàªT¨5ž“žXüè°öÙ¥ZKcÍÉãz|èɇFùx¸ºh4‘ƒ\¶hrAÆ…”¬<®y]}ÓôßÛ#T­Ñx´bþüÞá.§Ÿj$ oo)FR©ÊG£’I%àPwDüCô ÛÚ…5[BÏ ùlÞ/ñ7ºï\~#)­Úké¤.`!œ¦‰Ê˪uú{âr{€BòÈî˜ Åu&7CfI¹ò¡ÉÃÀÅ Å ì»#ñ j*+Í·ªýiunBB9×*µjÁŵº°¬Iowo>³':àL­€hÚ?ùâëV£6?çju¶ªäÆ©ýñž§”\=–ܤÔÄFu ((ú<ûê[TísãЧõMÖ¡÷O•Ø\õ q ZøÁ§Ϻꌢêúв̤$ÊÚŒ :•è›*J«:± yÈÈ~Ἲ$óëÒ+¼Ýö¼ZƒÑs›r ±0 Æþ㸔¸zµ ¼ôË!ËøΩgâ½"{Eù¨Œ|“ÁLXâê£\l+ÈÝ\”Õ,Vcº…z`›ÜE^n[žX–µ˜c¸ñí—ŸIy4iS£Ö#¤=€Íúc‹ðµ¿:ÄÍjH<µëËÍ{²Kë5îÞ>~A>J)%¶ìE5¬K4*9?ÕP,÷ò €T­ÁbQth§°»_;w€â2Û¤K½°¿$å0µ«Ñ,±zøʸLˆJ_O‰ÃÖ†@ì¦0XšLV²–AQÿ‰Ü $jר¾1§ö§§^¹r¹ ?ªû£® 9P7ä Ã`mµ‰R Ø–8ܢרD-eä¦6§Þâ0öVÕé—(3™q»þo-[è*åWs‰T"•©Õ*Û¶¡Ø±» hAö¯‹ž{?xòã«^Ÿà¡Vºº³)«÷-<ÁqÈK µ4™Mv>9<¹ÉeRl(n`ÁnÓ%`‹cAŒ¹ºzdÁ¼qÑV‹fˆ‘Ê¥¹B3 ¯j ¬ÍÕÀ–×[äŒ\ÊàV”âŽî»Þ¿ÑÚªŠRõŠqcKwmÞR\J{vë “:<á@àãæªJ½p‰bó°æì¤ùþÃ}ã£f¬Uun!½>ö ‹aåì9ó «WøbùÑ­)˜ ŒÿŒys.?§‘K yú/ IDAT]tŸ9O<üÉÆÏ?~ÆÓË‹è †ØûçÎ>ÎEŠ ëò‰Õ«¶õ›å2a@7No¶! Svýˆß¶·V®þäÁñC±®ää±sf•›J—~îøñþ]ÛE…{?ñÚ²¼W—~¾ìÙÞ^2d©¨ªísïÃãc(¨Ÿé…¢¥m\:¿?cÑUT5ÆLõpL(H™ ϺVðᦠ·yø¨¥PW[%÷‰ziÑë=Û¹%fäÒ±o;ëÎquQôÚ†&K¯13ž8@ÂÝ;l½šynçþÐazø¸‰Uw,ngÿkmMµ)¼=ÝŒÀjn,/¯Syú¸»(1P ¤¡¦¢‘•úy! acuቓ§Ò¯åYÆ?,"n؈.!^¶*ŒMµEgÎý–[Rɨ<{öÛÙ§¸¨ÌÍ7@#c(BؼôøÓçâ +ë$J·Îѽã†ðV˸ÕHnúÅS¿eF׿«} Äé ”XM©gömûéh~e½‹gP߸ ³ê»ë¿oì»f¾ú¼‡'Ä0´7Ž;žy£Œ0òЈž÷Œæï"'„`Œ›Ê³ÿzúZ~‘(ÛGÆŒ5Ä[-åbAôÕ…§NžL¿V`$ÿƒâFD…ùp3¶Ջ>>`Ù»ëÍì3G2oX²CTÌèÑqÞJ†PJ,Ƴû6½ó`…¹ÝŠÿ¾Þ/:XäÆ?‹Â46‚·7S µZ›ŽáÖ3m¾¢”Ïk”P@Nír¯ÍzmMC“ÆËß…KœL-••µ.î^J™¤ÕÔM7ÓçVzd—ñm«­Ú×´wÏgÁò¿å¶Ñ“ŠâB=UøzËeQÿGÙ©P‹l7NBCí'â ²8Ç„7ÏSÓF6ÛY+Èæ~pÊ7"·ç7ðŒbÁ'ö3”w›Wï8n™zÀSK…}uÌF¶Gð¬àx)<@Ù‘ùD˜:H0CÚ9f1éu"d©S Díã 4;{]Ä]½¦ÑæÀaßUt=íz9é×7Z%“´‘DN„È=„YGUñÖ7D´Ê G&gJ¡yÒâ¼ño_SµLð+N"7DˆøgA<`W„‘"DˆÜ!Bä†"7Dˆ¹!B„È "Dnˆ!rC„‘"DˆÜ!Bä†"Dnˆ!rC„‘"DˆÜ!Bä†"7Dˆ¹!B„È "Dnˆ!rC„‘"DˆÜ!B„È "Dnˆ!rC„‘"DˆÜ!Bä†"7Dˆ¹!B„È "Dnˆ!rC„‘"Dˆ¹!B„È "þnØŽwúHlöžrîwþ­SIJ®x*øÒö µkI¶Ôöm½´y‹Â¯ù×ÎW@[éR³¿Î­;jpºÞVZ|$Bw¸¾ñg’!!î•maƽç^Øõ{Y°—ä\,ŠRJîàþÚ*@On{}‚m= €qÒ(h‘G‹ÈÑuj]tÍÖm»uþ"E¡„?DŽÊEÜÁúÆŸN(!< ˆm¬D6ù'„P° 4e%m…‘½(¡”R‚@ˆ²Ä.i×⤸J-BL×<›çe’bk‘RJ ÏlD±½„p­s]ãš°3¡•Öí¬@¥”»^„[hz"î0Ë–-kuÌ· ÈVýéC ~Göë!—`§ñæø‘ùì‘]6lWFÑÈÀ¢=wpã×{“ÛEtôrQ™›ª6¯_yârY~ÝåÒ~;ºqãæ ìæÀ”uqçªG¼ÂÂ<4ˆêmûtóÎøÎ#º!TŸ²iãÆø¬úž½»H)Î>·jÍfªñ ôc°åÌþ¯×ó³WÌ @ƒŒyß~¹áÐéìný{©1j¨ÌßøéÇ×ëq§Na2%ÙûŦmzupD°7B5»¾ýjçáKa=z{(pù•=Ë?Þ£iâ㎠éÐöu_m>ÑiÌP„êJ³·|µáâ•ê®‘䦾ôòû|Ù(uëÈ Ëé[¾ørkŸ!Áj 2•îÙºáÇcW;ö覑KÚ²¯×®LÌÓwíÑYŽPòÙý¾ÚZ+ ìêÜ´#âNŸ7ì+ ,˽·L ,WSÎoß¼=«Þ Àê³âïÜs´¼¾X“öÄáû9k@ù×Ò~Ú½ãbF5_?»uÇÁ‚Ê Ôœ|vÿŽí‡ª@[•wèÀGŽ_²š²«Û·ïÎÈ)"¬™IÇ~Øúc^Vqòç}?í?¡£ôÚª_öm?wùŠ™½‘™°kÇÎÄëå »xúç?þRa°úâ‹[¶î½VZ@M‰çÿðÝžJh¬+=vøÇ_Ž_4X¬ÐX›»sÛŽÄÌ\{—Oþ°eÇ5°Ö^:}p÷þcµF˜õ G÷o?v6ѹ™I?îØq)«øŽ’ ºFïRHþwÛ¡€¨Í_ÚïÑh X¢I‘Cg¸…»Œ€˜Í&“™•«T2Œ(P‹É`f‘\!—`†Rb2ê 0J¥#°˜Í&³E"“Ë¥RjµMf"S(¤L µ˜ ”jÀ«Éh$Q¨ˆ–µf™\.•H€R‹Åd²° •ZŠ€k4˜XŠ”*%ÀRÖd0"F*—É¢³Ùl±Je ¹L”5MV*ƒ±šôFV®THk2š,V¢tQKaF#`‰B!G„µŒ&‰L&—J€Éd°XˆL¥–a @LF#K°B©ÀQÊš À¹BŽ,“Él•Èä ™ôNš7lJ¯}ÁÝI^Ѽ½aý÷¸a{VöJoµJÁ®T;¬0¨™Áƒ‰Y󶿤6=5_þµÖJ³zœ¿rúaÙÆå5«²EAa÷„Eoízï •ƒ— t7»¶þÇ«hƒÁ±?O p[üãc«SðžrV›…7Þ8Xe·C9¶¸ÙÙ‹ÎFDP àwº² fŒ±D"ac,Кo‘¶¥ý##£º†¥|¼=$ 5› ±w-mnyMÅfyDÜ»õëñ˜‘PJ–ïvýl"Ò.‘CðíäŠq7¡™.nsm`Ì`Ìe-õUù߬^ùãéäîS—?28€Ú·#‰ñ/âgÂå\ÚÊüS¿Þ±k_½ÄgêÞYôèhJ l×MnŽ"b¬áÝk(¢ÕyÃÚ‚¤?X™Pd>aæ¤ñc»…xQBÀñÐÑÍ’‚ß/ms¶Ü/î¼{lÊ~«ûÅy ƒm¿8/wEœc²Û¶=¬´•ýâ@ùzíÃC‹çV÷‹#° ØInoÝÁdç륨åõÚ©âZõÎå'Q„"‹±öëßKo ^úþ‚¾Ý¤œPcL2ùÇѶñšÆüøm7 Ø„Â\bn×·½$ðûÊ[™7(!Ô^!J P@Û¦J)E˜k‘RbÛ+n/É…asO¡€1¿ RälÖhÖº€í=8_/JØC¤©ýß:”$wY\Æ¿-ìT@1ݵ_÷¤VM›ûŸA‘6b]ôVtq„1©*ÍKNJ­6°! –ʢ촌k:£¦VcîÕÔÌì|+ÂC]uizjJAE=Âi¨ÊKNͬm4BØ’¼Ì”Ô,=`Œ‘©±6+3-;·˜Ë\ o¨HMM+«®§€0"•Åד“ÓëL€1F¤17;#ýj®°uÙWRóŠ+X AmeQjJjIcŒ‘©ðFVjFv£… †ú¤äŒ*m²µž•”t¥ aŒ‘Y¯½~5=+·ÈB( dnªNKI-®¨å®·²87))­ÆH0BˆŠr3Ó3sôV¬Y=3õz^ ‹ƨ¶¢8-%¥¨RË‘KÄË ÛŠ ëÜåÒ’¢ž°—½cbW|ußôc´/Bô;¾\1jÀÈ]¹ZSõŽÕOŽ›ö\b~0Ö½0çÞGç½Ý€Nìûúþ ãßÿþ$mºøÓ²¸1KÍ¥Àj×/›1zìì« (ýØœ“ç½°Ê€ 6;aÇØÑ“¾;|ÎJÀ¸ýÓEÆL>RahL}åééS^\deAeaúSÞ³ô³­:Бí«Çÿùþ(~oÉÜñSžL­1g>8ü½¿]€úÏW<1lÀ”4(˹ôüœ)s_ø°VoFå×9níŽ#,ã÷Ÿ½<¼ÿ=ûKÍúk+_9yÆâëõ:@HWÿÜ£c¼µ¶~ÙñÙıãVî>N[ôEÜ‘ú7!„ }`•ÿ@Ì0N}h—îÐì£?¶"+îyàé È‰ÑÁj™ÇØÇ–…Ž–t ô™Æï¥åëôŒ¯€ö>eOw¿Î½²ÇÈùßø7ÄF´C€ÕÓæ¿s?~–¿ÿRɘ°¨q_llß¹{/€lÜŒW‚û5ôñb”‹–®¬7»ø3<ý;-ûøK•tÐØÇÖ‡ Žß9 —«£îrÜûñï¾ß;º=¸LzEŸñ¦Nà½dù'¬ÜßM!¥Þ¡që6}ÙÈÇ?üBhŸÇzúJ¡³¾;Z§ Ѩ@íøê{{¸ @0hì#kCuëy+fwZÙ÷÷ûK¦ßÝWÝjiGq>å”ýK‚æK,Ø›Î%aÇJy'PJ`U‰P¾(Ø”˜Ö:CRŽ/ äÔ¾SëàÐ €°uê§,è(B¨PNY#mÚgðÆ –e7|óÃå*éð)Óõº»I"Ônpbë——v uOSc#ÆØb±¸»»?óÌ3jµú6çßËËÀ'¼I…ÃÙz öÇOí§ "„m‰2E6–8¾t~‡…U ë„0µtÁ¦ÝóÂÍ ±°R.ß/÷ÂŽ’6Í[PÔ‘FQXÎN §:ù-üUBv µÕ:ì“Á·› CÄß½¦jý!!ÁIg·²¨â+uzg{Ãýƒšµßê»f- Œ´q+ªA‚ÿZ¹AQç^7¿h§:ys­ÃfqË­‹Ä¸ãuq"DˆÜ!Bä†ÿ+7ø¨ö£*€:Þ–-ñ"þ]Ü°T‘K¨Y*J‘=ψÿd´‡Ë…U±•¥E%Z½ÅÕË'(($ÐÇÍ9ÜP„ˆ 7ìIo "4óì®O¿ÚÛ$uõqST•¨ƒºN›»xt¤¡£– šEˆøGsÃî÷ÃúÆÜu+¿Ð…xqþŒ@/uMιe¯¯úìC½y…¿½˜8uˆøéö5讟=W¢óÀôÞÝ:øûùGz`Òˆöy¿¥‹Œñ/]SÙrˆ¨ýcÞ|㵘è@þsm½Ž`µ·—cé%Þ;ÿ.nB@‰&8úàhšŸ‘p1>µ(/íX:zrñÛ}”`Oú)*ÿf8o8D§ýNºd>ZϱUìŽ"k5ÖB¹mhW.oÛ¼MK,ÒÀþýc‚Y|›GÔˆøGÑÂ!á¶mÀH°¯³ÍͽÂ0Öf¡ÖÈ@pä)ÿÿÐ7øaÌíãDƒ¦<ñÃþ=Ÿ¯ú Fž>íþy—‹ ·¬†Óf§Ô;E/8kÑq=´rÐ=ÄÒS*p@RþÐ{°¿ ‚Ã[émÞ¢ðkþµóÐVºÔì¯s뎜®·•ÖÝ9ñø­Î#Œ‰ÕTojª5›š#§œm¥”X fs“ãñüaS¶½ü;‡äfv*îªPÙÌÂZÝU%—»¸É#û}~ÖŒs¯®=}âb¿Y#nÒÃÑ"—ˆ¹þ1¹FÔT“wi_qî5«•e¤jψ‘bË¥ˆû(ÁgO±M5\f@¶áú¡+׌½Æ=ª’ÛsÆ8ȃZq@(Ka¡ ‚såÅR¦™Ê¶'"ïôîÿ~ðIn½ž—H™BN¨TB-\Az#×cÛ óö[㘉—Ì€/@%íY  (b¿‡!J %Ä–¡ÀV©c_¡Ä.—(± 18²Øë[O¹¢”Rû9qÂÖP[붂@l%ùÖíW„ò¬à4Ø[oV’Ü=÷ XcαõÉñ9^qá1£Â;”žù8ùô –Øï½m²ç9²‹˜Qzø3È$—[Œ›€0ƒXÝøï>©¬¯ÄØ1/!{Dú˶¾à–f* ^r=íäÙt¾›;Üc‘©B{¿Eý aLÊ‹s.%Vê-\.…ò‚+‰©W f„0±®e$¥eæZÆÕV''%Þ(«C!`ë+rÓk´z@QkQnZÂåŒ&À#£®6#-éJv÷,šÊ“J*ë¸\ å…Yññ)5&‚FDw-359=ÛH˜ ºÌÔË× K¹\ Õeù‰— «0Æó®_ILÉÔYB ¯ËO©¨oD!°åf\º”Úˆ0ÆȤoÈJO¾’ÏåR06U'^N,,«æ®·¬0;þRb•-—‚>ÿZZrZ¶ÞÊkÒ_MO¼šShEc¨./LJ¼œ_QåRàFsSñ”œNc§w4.¬×èŽCê>j\MÒa]“ɞÅRnµÈ¶Ü^”¤î׹ߩ„P ˜A”°,kÛÈPÂZ­„n8bMÚŠ¬¤&£Õ¾¾ÂZY–µËë_µmž+šÒ|"ïŸ?¡ë×ï½øôËo¾võ“S†o¼X3iöS{ÊèMo|.…Ý›Þ3øžoèLÕ»ÖÌ›8}ARAŠ_zjÒ¬gV4À©ýß<0qÂGÛ¸\ úßö¾=bÂìãi7(ÝËgŽ›8‡Ë¥P|åؼ™Sç¿´ÚžKaç„qS¾ÿù<—KaÇÚGœr¬Â ИúêüG¦=úrKAUQúÓOX¾v—Ká×k&ŽŸ¸þ@"”|øú3œ›Vc yg?rÏCûâ³ aýŸ5äA.—BENü¢¹>ýÒGµz¨¸~hâ=÷~¾ó(—KaûÚWG w Ô ¿þñO™ù’-—BMÞ™/_×€ݹvòø ï¾wO.ûJ‘‘H åYWµu5 A2…Ì·û#Cf-ôô”g|3i×–ã % €škG¶Øhª=õñØ}ßü¿q{6ýªÍZ·{ÕÒF#–JMÙÞùñÍI»Þœ¼ïÃy¥%*½¸i»ßºo׫c|÷Mc]uÎñïo$m~§0¿ØêË›žÚñú¤Ý¯Ù¹|^îµÔ¥@îqïïw¾Wä rÿë}cDÞè?ú¡¡}½Ã¹Œ ÊÞcí×öè‚»<ºà“!0(ÿˆÁ¬Ùˆ”þ\.…ÝïÝò]·ð®Q ùÄYoF kìîÍåRèºäÝϵfUƒÀ+ ó{Ÿ§ôë f€½wÎæ®ã‚;G€ß3¯¼wíâ.ÀíbŸþ釩‘=;PÍcÏ8xª¥3x‡ö|ëà ¬Ì×])§>a#¾ýaspD7.—ÂäÙ¯uZéÇåR›ûòêIMŠ0W5¨=‚—­Ù‚4í4Ñ!÷Îþ¦ó(ÿˆN7ìNŸ7(P$s ï1z¯ß}~(i—GP˜oÄ€ýÇ{…#‰ÒM¥œ°bF&Sk …{PÙµŸ£¦o  Ó^ÍQ¨4R5Ôžÿ()±dø‚ï¼Ý¥…'ÞIÞý•÷¬—ìpÿŠÈ݈1ïä²é9±£ºüFzeÔìWÂëÏ/IJ‡‡Þ?ì¡a36ͽvéHH‡9,ý+5œr)ðû® ¡¨ÅÞ~‡n 7›jÄ‘Ÿ €ËpÛ¹„©Ô~?—‚`ÅÇçnk®ëÁ-æR |AJt›"áž^§õæïäRàìYwe.ûÊËëòã.ÌHª)Éj¨7tûÚ É#³6?– ON9Ôb„šÜ“I§Nž±(iËÓõ²G&={«7W%n8Ñ8iÑ —>˜aî<{ؤ±Ä ¬¥¾:çŠ[‡~J)k1Õu&SSqâÆ%~~Û£]ÓÁ÷VF/XîF(K­z“¡Áb¶äîY^¦è3êá¹2F —Û_’KÏ ‹ì)[i‘ !€£äMX¢Ž›%H¸•\ BSÎïåRXÏB#ø3r)8l'¨E.®F@-RßþA.ô÷æRhÕžs["„‘YWV_¢÷ o?ì‘Ž#1iugÖ%ŸÛRÑ»g¨°/Ñmˆ»…a+µro1S•ÞbÕ¨½8ÅË܃z bõµ9'¿¿ž–%Qª$2bÂ*ŒFqL¥ÉI¶ÖéX¥»ÆTZB;ö›íðÏ¿{-Îûkq­ >½™~ ?ÎlpK¹šµÛz.ô-Þv.…6 :êúŸZÿ«WTü3®n£Q cdª¹¿goÔÔ%#}Y3(½4íz ËIL6›M”²„¥2¢¨¾ÄØÈ"ŒVP Kåþn*¨«.•*eÁR›{51MjRÎ'÷zpnP‡î¾íT¿>Ý׊¥SÌH±Â?x³D}Ïاö ÷/úîåÄZÀ6öüùwOÒ–HÿÞsq—{µ¡…yçfÇ]jsðh»zkvÆo}«nÀ(ÿv!¦ê+9Z\£½½,šíÙﮦ…h )vm2ùŒÃ@‰ÕIJĶž$VÖb4Y ë=“nڔ௠•_Ù÷e“kÏÈWÖЈ•~KÉÉUk²ª¤Ñºz«UBI]mYƒ% °¥Áj¡r•ká‰çŸeC½Ìf¢”3E³lÙ2QbîDZºÿ-âç#¿¦§&w‹ŒDBÚX#¥41%½TÏ„w²˜íb‡ìf~©º]dZ—Uz¾0õlEA¡Â@ÌÔùî®Rwÿº¼‹×/.Ë/úŒŸŸÊ3¨CSMÜ«Op{/‚µ±Ê`Õ¶ÖvwS5fŸýéFrÕtî9ea».]îÆÕãÛ³/]TE>Ù±!ûr^`·0äçþvJåߧÃà¸êKÛÓO¨Ñûu>°2ýÑtòkˆœz2ä¥%6•d†µï`1›¹+U(±±±2™ìvtqwÌèn ×»‰ £[›4L&ÓÛ}ž]6¨³ç³s÷õ .´„ ýn^C›>.‘Z­‹ÙdÆ2¥BÍP³„¥0b°Å¨3H”J©LB)%VÌH­@«P„©DB­f†RÄHYÖh6›Y…FÃ`$¬Y¯,“+å¬Ål5[…³Ùh‘ÈÕ˜ALÆ&³T¥blÑ7Q‰JÊ0à8Øä/ËkØÒAá<”üU‹ªÏÆ®iƒ³qé2Ž ‚SZŠíÁKŽsnœ.ïæãC›—C¿tþüD»•¦BÀæXÿS/–e5nn§L6é^\öñ³³§öêÕ["‘ g§ôï6j‹XÀ¬Y‚$…T”²&Îü@)a¥rµŒRj5Û¼á¬E¾( #„0¢Ä‚‘D©emMÂ2…+jµÆr©BN)$—«\ã,(äj¥”° QhÀnáøÓ5IÛ«ÊæÞ¨¿u‚¡ t¢ðG;´é[±9^F…–N+G¨K›Ê› Ñ› ZÞj1ø}%Ñ.‹­ªÎÐؤ?pø×qm™î IDATÒŠ*‡Áú¾­ bR’Ó¢ÚÅuˆ‰ ëúÎæU1G~}vþ|ooï›Ô=±±àü 5·MrtãÝfÂO?;:ŒŠöšl>^É„XÙÌ’Ôù—\ðŸOV¹Á‡ãq±]Ë,³¨bºudþK£­RjÉNNHÍÊóé;<6áâ ’섳Ʌ½†Lì$k¬-?îL•Ö"ì¥T¦öŒí? Ôß#0jkóó®g_ÏkЛ •»OÇN:„‡¹(®­†Ê¼sç/*‚†ï‚#ÐLI»Oävï7*º½‡ÅÔ”zéDf^=#ÁÎC/ é5°O¢×Ó/$d÷v_D€Lh«ÍJü%9Ww_„®*̾ŸÒd²6S~A¢ì;xh‡@ï–~+N& ‹~8t®]ŸÑ`µþ‰·ºÓè™! :¢TªZüæÉŸv½¼|õ0¢c¸‹Æí§)u°å+Ç„éPPœÆgÃŽ}ágn[Mv›xk)^´-LN`üËç û±tÀu®¡øêÚ÷ÞÊp¸oõKð׬©ìËéÜÏ;V~½×-bÔúMŸö TóÏ)ûÂÞ%ÿ=ðæ—£:ÉjËs?yg©Ö¥s.íø($JˆÊ;$¼kÏðÆòìo7~yäÂUµ·¯«JŽ€45ÔTêðÀ±S<ý°‡ *?y劗¼ÇlÒ;H&qØåô7¾òê‹?ŠŠnïa6ÔÿôÍG{.£¸¸îRÁÜ`µ‚qïÛ¿§ èÅcÛ_ûä—w¾ ³Ù÷(„Îïÿlù¶ÒåßÜáWέxëCϽ"B„c3™{û¨Þ‚¼[X8®2 Ó¾[tßqãˆõϼۄ£žp>] :éÁëéQ_ÿr¹ƒëå1Cût‹îùg,äP¯o²$jû‡èæªý«l¸à'Ú=[7JÈ êý—ö`G»Ððƺ´ÕŸ}·þ½§Õö“'.n. ŒDêîw%ÇŽx`„°T®ÐnxïÍí—êf-Z4iX/ÕU?°åó¯V–h¥_$2•¯°§»¢Ùa™[`P€F%Œ°ÒÅoà=CW¬xÒ9=‰TJ¨5AjyóÑÐÅÍ'0ªå2…ÊÓ7dÚ¬ëÑ,Ý´L&C¿«XÍf½(û'¯V«Œ :Ú±«_p‡ê¢ÌuÛ~~NªèÜ¥‹h¶Îàn!ë…ýßù-¯]_”ùzCˆÕ‚ÝgÏ»o㧛· òä˜H{Â,ê´õ‰‚D"U*UòJÛüѶs¾²fþ´þüJHÒù‘ùo }Óê}Öoøs£¼(ÒÚèH)4jƒ‰R©T¢fߤÐj-\𩣿$R™J©jõà†ÛÐgþ·Yº¾H¥$ýÌ¡ØPU»vðW·ÞEh%—[7cE)Ç?ùüÀˆföîà÷wiâÔb1÷›:wF/?û4»¾õ1•He²ÖØš³éhŠ&tЬûc±ÍÐh7õ 帉Sƒ=d‰×™n: 0ÄH¤ÒÖ{z+S;Ëm\ÊïÝX†‘Hå þ¯øŸþ—+#EB]V*G…Ùß/­¬N ô«­­YÑʼÁïH£”è늾X·I5pƬ)qk.~ïˆiù‹·À#J ƒç¼´äìÌ…ï®Z¿zÅ3ž-ŠH±5õÒ±o,…|l`yØa½™ÜêšúàA=ý$ØnËà$÷¡¾>šÒšª’&á›h™Š³6#‘:v²Â("câúGßü@-e¬Oí3–Å;*'¬ÌÕÄÈ‘ʶn&aÙÒ¼lÙÙc”¾O„’ÿ%Í ¥TãáÕ¾G_³bŒôãšÿ’âä>‚½}ý222 úõë7xð`†aDn47sPšŽmÛx¥ÁõšÙ2IË3èæLöÿ« žh‡Î}|òÛwýÔ#êɆ8+lH‚-WS/–ä$9 kŒ ¸´hOÌäªâ7¢8ˆ U©ärk“Õl™“‘«-QC ”å¥ý¸£À1mRb•ºÝ¯é2 %7Ú¬Kkêodz“%¹·ºEFÆ ðP¶u:´Ÿ9a`AÁ†á¨ŒŒFÃé3g,f3ºm«.¥5z˜¸x]@XûúÊŠŸ˜Ü¿gD‡Ø”‚Éd–ÉdƒáäÉ“)))O<ñÄ¿|eÕš.('þà†§§,YízcuÅJ[´ uË5.Jt«#•Ó{§û6ëV~6lÚ¬sç.ï?¸øˆŒ`¯0Pb²ÈFMžùÈä~iƒ°w@¨*ÿ¨T‚tz»3„ÚMï€Õh0™¥2F®æS0 °%Çne!Ž€šŒÐµÿÄ%‹§+uÈ ’xxûµìµ½ž–“1še÷ÍzaÂÐÎHà‘©4жíO¡PL¾ï¾f÷R"•éõúÛöx`Œ2 ë*ËÊs’Sn˜8z‡§—Ùlæ/Ÿ«¹¦¦æË ªtfÆ­‹È A†ˆÓû¶ç阤Ãß%´2Ä\X µ ä·Þx3¬ç˜gfOT2ôæCÔ^Vô{¹š •»„Ìþéç^þhû᳃åN_ÄxùvŽèØ\@ºtòwW%§¥WY¯Ô¶MQ‹®‰Õ¸(šò ªªk\ºŽ QB1˜ÌRÏ8ÀRP»ûDtl/oU?F6Š1Í댨àPJû„Dtì·¨Š7 ¨©©ijj2 ··à¡”b„ ºú”C}UÖ¸þÿ×ÞuÇWQlÿ3³åÞä¦'¤÷@JB)*Hч¢y,¨ >Û³£òTìè³ ¢Ï‚J¤ƒ¨QDÞC ’ žÜ¶mæ÷ÇîÞ»÷&Á€ú{öøùÈÝì윙Ý93sÎœó==ù€@A¼ÇqúÇqN§ó葒ؾ]LÙÐfJ5 ¢÷ˆ»žÎ¬ªÀœâh<]ZƒB:w땘¦ϵ*òÏÖ‚±Á›<Â÷„ ÚFÝÅv|ÇÛ§-þ¢>3Ôoë'É’(S+ëY(¥1íＱ߆W¿ÿjÅŽ‰7õVUÎ3{~|cÆÚÞWß…ßGßÇðœÍÂ:k ;é)px ¡ÄÖ.ÈóBˆ"K–æ­Î8„ f±¼ö @ªþGÇÖ±HK†‹Í½²æS‹¶&€ tÞÜ´„v’àŒM„‰¢`Œý`‚!Jˆ"KÇ_Ê»*¶™á Ðuàˆœþ3¬«üÔ¾ŸËPÖÝ÷Œe)àsË¢Œ0VÊK‹JOT§vëgã¨"”—–Õ⬎íC­Dræïw㈜ÜœŠÁaˆ½Clà•×ŒÞ¸õµ-[öQl<|õ„DxCýÙã¦'oÞ°gá»O²ï<6ªDw¿ª×ëf¼÷¢³®nð“ïÝÖ- âÚgd¤%þ°eé›/¿¾¦º¨Uæ¯ÿhɆàøý;…ëÛ, TQ“Ž4Ô ½¼Ë”™KV~úÎàžwŽÐ¸kÙû+w–„÷x|x¬§¹ˆR ”4M[‚ ž>•7&@)%„¨Î³çýÉ#ÂB…Jh5Š¢BºtÉ ©/p‰¦løîJ3ºv‰¨£®¦;0ÆŒÄv.Š†sɌɓÞøvòž£v‰±jÉÇN^e›·ì‹ÁÙ)îúÏ=8ºŒò㯳¢€º U•Õ¥­?<5÷Î[†ï™ôQ¹]p‰Eª©®²;Ý*À‹>Š(¥ê²üäkï2ïLù楻Në2°Gv×îÚ¹[²„„Er5%%§»¥Æ„#KÂã=à~÷ýçî=«gÿNi±öÓ¥ÛvŒëòô³$Y(J)jÖ­ühĶo°aï#Kbb׫_41;ÞÊ´ÿÛûŽ¿ôñÜ1Wõê9ðª”HKÉ]» +»]qó«ïW_ , ÎúS_~hÆ»ã]ïfîø×ó²­é ÃBþ<+¯0¨¿].WTTT¿~ýúöíûåìÔqé.gñ¸Ôç2ÙUx`_% ïß5K>m½‘ «lߧR0O¡ìèþ’jÜ¥k§H[€$:ó÷îr£ð½»ðT:Qt¤¸¢>÷²>a,¢ Ùa1µçíÊ«v‘öú$FqN{M~Þ¡°¸Œ´¤h–Ñüö=©¤4#šì:ZppÏέ»òŽ*|Hçî½úôîî>ôàCÿNþâ'Ž „ ŒE{uþ¾]¿mÞVt¢:0"®{ï¾—õ陬V§ˆîc‡÷—ž²cÆWÛ!$ ,¦KÇìF $¯+/Þ¾cûŽ]{Î4H iúö¿¬G·NÁ¨Q÷õ•'.q‹²ß‹–”Ü>»Cr ƒ[ûNE©««“$éO´ʲ¼fÍš¢¢"–e%IÊÉÉ6lXTT”¢(ŸÍ˜·«yõ6M–úïÄoøb!œËfÊ󸆈Ǧ«¨^€,O|:€Ÿë:ñ¸y6ñ×uÿ‚Õ«Icˆ¦¦£ñŒ[aªÖ ”x^P“zÔ}ÞY±§ÎÉ¿ú¯8VReÞ¼y‡ ëׯ߀T „ÒrüÆ%!¿¿aS@ç³®#zljÁQ ÔqÀ‡éµmy¸b_Œ_!×á»u`,£ç³f]HÓÁëIN}B/ ²ÕRo=]£àY¯¹+üSW4ù»IºTÏÍ=ÕÙÖ mûÜÄ[Áƒÿc¾¾‹wj~ֳɆ)@‰$ºkkêd/.Å ÓŽ3ß I—¤lxμё_–<õÊûB`$«9;KpÚ”e_e5÷£&]š{*@”²ò“R@Æ]÷ a©B€0¬-J_xMñ0éÒ’ Ê7(BeÝñì>·Þ:ÚêoÑPOÌWgÒEN¾ùþÔ\¸TëNNŽµ‚[”T  J´¥Å˜ÁÐ$“.Ù #I¢TYR[xÛý·ì×·×€!#ßúbÉiÂH þGÈ4ášt©É†Š§àª÷V—Ÿé9ò¾©ò訜ES_}tÂëå '‰1— “.9]œBÀ[ozâÙœÁ7tÏh^Á8^š»úÛÅ×>ðîç–ê µñâ>Ù¥5'%0&Ž28ð‚AP÷˜òxÏë1â>.„Æx·½ÞTà¹íá~y¯õ‚`(ìó¯Z+õÀÄ6d¡:`$òë¯1·9ë´Ùuƒ JH`hêØ{ïížÑŽR @iÄÕ×Ù¡ôt¾ì&­ oh¬ÆÙ°[ÍFïÍ®ýÔG±ofqÁ !J‘ö/Õ*¡jj1=_¹M{TKËF‘?G„(õå¨ûçúqGH;þJ}ëÔjõr÷øúúöšr§Ô“,ÛûImoÝ@€0®)-œ¶è²ÛŸxûUˆØ·,ç¹Ï‹^|û•¡]3Òøé«,ÝÌMýqV'€²¼u/½9•‰üá”'A.ܾè±æÝþØ3c®½œCî?÷éâ’ç-ËA㾉Þ8RŸ4uÎÛI,®<ž÷üÓâ.ûôC·‡°xí7SÞŸ¾öºG^{ä†ÞN¼ýüË á­/>êÉoz÷Ž¶Oxûµ/ë´î³ÉO,ø¡þã­KsNÙþÆä7ÝáýßzýÑÈKÅáÆ=øѵ÷=ñИkpÍûï¤ióö=µdåõ pòÚ+G¿ûßW:„7V?ÿøƒ(ãúW_}$ `킧Îø~Ðø—'ÜÜ¿Mù¿ªÛ»žÝ»t.©*Ün5á’ËéÜî?*€P–ã!„(Át@y«åÈžíÑ¡Ä)–mF§Ä•6ñýÿNÿ|ú'/>ð†]mß뺇}ìÎ@¬¥¶B×?4 ‰HHH°q1ÁaÑñ±«:3lTt,a4ˆŽ[H|\BDpÂV[DB¼=çTÕ(4"6>U³µ±–Àè˜x&*T}·Ç'ÄÛT}<(,*!Á¨Æyc>**¶1 ’E*CKtl\xh°ªi‡Æ'ć©'œLXdt|,X0Ξ˜dµhÜÃcUî giç S&–³Å'ćª%ƒÃ¢ãmjÖÄ…GÆÄ ‘œº40|TL<Š Õ¸…ÅÇŇ[õMh› „B·Ž¾¡[§cÐC7ýöÛž={ÄüÑ% Q¤à¿ÐÛE{g'¦¥§;ŽóÆð‰7Æ\#„I¨©®v²-84""”1=‡ÏH©¬È²LXžc1¦”*²¤`9c ”H¢s‹(²"+ fXŽe€RE‘$8–e0¢@IV(p<‡¢Š")2Ãq  D‘d…aXu##˲L(Çq F”Y–ÅϪz³,K3,à Š,Ë Á,Ë2 ¢D’dBãX„%²(–eYŒ)€"‹²œÅ D‘e³«îÓ$YÆ ËjÜ%Y¡,ϳQJIR(âx¢TQd™"†c Ü–c™?=ÍéU3šûÐk֮ݴiÇ^a?Š¢x‚%ÿh¼8ò¢ !B)æ,íbãÛ&0äƒk]Ê]JV{™êg9ž-TaÌ[,ú`†µ°¬§$fy«÷AÌò<«‡8#ŒyÆâUxÖÂèµ°§^¨PNï-‰1æy/G†å•!!NO"J)Å geŒÍ¶°œ^i•hu2ŒEÓ‚Tî<ËyªD,oÑ»D1f0Ï4åNHòO3¦ûåC$Š¢êy„7 qÞMõÇnkŠZ`88Ç”¾¾–}ŸÇ¨Î$ò¿ Ðb6N¿p~,Œ‡¸I¥ÆOnH6‡ªGêi .¨V‰œ­NoÇ Už;BH…bi+úF³}7ÆKþ.°bó˜°ÿ‹î Jæ\ÏþP³è¼¢Iý@-a)´ˆºÐ6µðÛ¿¤Ô¸·Ò&ˆÍEÐ2¸àï×yžÜÛÐ\Ü´ïêâ)‚Ûíæ8î,šÆ80 €4IĆ0’dEÅ¥þÿïŽ,ËN§ÓpÒtÎç&™t¶–”””••u¤jŒ±ÛåÊ;XÈò6J}lPŠ"ÆÇD¦§§B÷LìO'I’8Ž;O]Ü$“ή˲ìv»Ï6ײliÑ‘—§­¸j콂Óë®1S~ìDº\xÛÍ£äÒÞö®Iû- Ïó­_ Ï–_Ü€æ„Îq«fÒÅIDZ,{öÀr,Â,o‹£†Ý1f€µÔ"‚Úˆ îœeCµTy’›é \¨Ï¢g†6]’*?M½å’ú¤¸SâÉtžšñ_ª·B6ts”–áœRY]n70|€ÕÂ`ì ‹iÒ¥.'çþäÿ^6ZO¾1±ÊP ˆˆ%{7mÜœô8±„ví3ðªAWÄ…²̲)!&³T ·Ûm·ÛU‡:uý b¦mJˆ_Þ&=–‘²_{éƈŽÃ®è)œØóéÿÞºÿÁ×^¼;L[:Lá0éÜcTPP°ê‡B@?«~ïÕ´0àŽø€Ç>ünÉæoÑ9Ì}•Içµ;uêTþÁ| W–åÜÜÜøøø¶ÙÞ¦~¸€²7®Ù\>è_O¥…i>7<ðrε•1 ´5_j“.4]ÅàÐZý¾ Ȇ¦j ×ñýL`ZJDá®»3»õÎÍʤD1¸&ý!¥£U¾Íï©ô&ÚË«‰èXúÙ¤©Å'ÃcbÏ+A¡1#îxá…qôø8óC›t±+HÍþU$Áîh„”ÏWn\±dÉ–]ë®Nå¾›þïov:u ‘V“»/»! ™!¦œê™û¨ñ5,m@ Ũ¦*é?(õÁ‚oïÏÑxÛóÛ·´™&ùýëËÝ[ƒö]V^yæçyS&~þ]DÊ ›ÿÞãN0µ‰ÑµdúäWŽXVlGPµdêC×ßöÄžã§Bîú²gÿ9jÜï×!„úeåÌ[þ>òÝ¿Bˆ:¶­xmØÈq?(„iüüõ{F\{_BÁÉüŸ¸û?û¡ !„”#;Ž¼vô׫7Ë!ä^ôÉ„áCnZwFF!ÇþçÿuÇÍw=wR!AeÙ‡o»îÕÿ~ÓHB°náG7\wÃgßï„œ|çŇn¸å¡ý5RòÛ”ACÇ|»]eX?mòýC¯¼åB¡3E;žþç-=;¥Ö% €ÓGV]ÿ·ë?]ü#A!÷7Ÿü{ø×}_!!„³èƒI÷üã®gŠêì€PcuÉw_÷ÔkŸÕ#„Z»è¿£G^ÿÁÒ­ž]›9"Û² `Ø£ÿ9Aâ¯þj̼÷#¢»;îáñ J›þkA44 B¡íRÓÓBx €™¨„´dKÇf¸¸ÄTžV‚B"’SÓÚ…Ù IKƒ¬ê ŽˆILKãÔ Î”˜œÂDE©°†¦¥¥†ªè ¡qéĦ¢'`kl|²Ë!Ž·&$§FE…©np¶ÐÈÔ´´ÈÍ€‹ŽIHuAÆÀF¥§§„h0 щaêËÆ&& ÁQ ÂÀZ‚ÓÒÒ£B‚Õé?,"6=#-Xãη‹IJ!<Ãfø¸¤t¡ö78,*%55*$P{ñ¦h´)‹³ïöHCSP£BÈöúº‡›  å0U©Ð9m)UY!”aYFMê®H Eš«3%²$S@*–QˆŠ¥À0QJˆ,+À0ê”"Ë„R–ã0Bˆ,+a–cBÔµ¢²"B–S«‘e™R¤ÇSY–fX«è !:G"ËŠ B…"D‘U°,Œ¨¢(„¨Ø zËbXŸA‘eâá®÷Wã®È PûK‰¢( fU,EQ‚1ð̅î…ãÙN>øÂ'+®¾ÿ9·y >†ò’×Lî”™êÁx•$é–[nÉÉɹ| }3Ø@LpxTp¸G9Vtkh³Ðj,ÌrŒÁrÅ°^4„± _ b Ìðºç@ Çû pzIŠæõ{1Þ ËzJ„§.6^,/GFcÓŠ2ªiX ¬;Rëô`)[†1Ëë£õWÇRà8Ícc–£"Ñ%ð‘j“gëǤT5=ûÓ—„Á7öè9‚)üa)`hK–úb) ¶„¥pË¥ÿm”(ŠÔü‚(”rä7b›lL]q8G0Káܸ_ ‡*nÁ½zÍ2e‚‚‹ ò­A”øë±Ç78Å#ÇÊ0Ã1,o³ Ð K6L2霉ÁLUeåüÕÛú]wØrreÉ¢ ¡Qq=G=†¨ÒPW·é›wúvË>oÄAS6Lº`öTǽóv†³þv¬°çˆ;Y–SdêÂò–ì¾ýËŽ”l]ñyŸœ ‰‚ ´å®aóëšôÇ÷T`±Xï;æºÜð§½$‰"ËúÂÉ°¢íë~X3õážщÉ)Š¢´ñ®á–Ìg™'LØ“üÖ ]BШQ£ž7òû÷ª:]ÁrÈc® Ž@ÎØ4Ê IDAT–Ì.\ùѽ‚BBU ^Zló†%¢(Íl!¤¥˜0É$£ÁhÍëۯ߬ô´‡žž”{Ó³Ññ!΂f½ú4s&oЗ˲ìç'm‰6eŽðÇnS;YsxË7ëvqœÕcŒÆ˜e9¦]rÇ¡Wôæ± Se´´ã ”bŒ+N”><á¥ô«ÆEƧíúa&Ws077×£`¨ëŒ¢(ýúõKMMU…’˜˜Ùv†Vó²Q¾eÁ„–[lÚ©keí'~Ü´{ðÝ“?}åNÎ “ZØ\á(pËo?úlz½ÌÅ£ä¤Es©Ô$¿© ]ºt6lX»víÚ躡e QEÔ}Z)EV+·ðñï þò³·2cLÉ0©5‚*,8´xñb‡Ó©¥d0욨æ­È²Ü§OŸk®¹&  m ­fðp›¶¯è§w½²üå/§ÍŒ¤ê©¦‰ÁcR네´´ô»ï¾«¨¨ð€…zn©À¸Ã† »ì²Ëxžoâ{ò?&Ül—¨êФÂW¼ûßùƒÇ=:$3’Rb"·™Ôzñ ”¦¤¤Œ=:==]™öè$n·›çùÑ£G÷ïßÿìI ÚŠlèŽL¢Àº•ó‹‚»Ù¥€U7%ÓŒ{¡SЃó½‘öмÛm¢]7»é~ÃøӆR;f̘^½z9Nõ–(ŠÑÑÑ·ß~{×®]†ñ¸Ò4kØm¶)-ýŒÝkæ.5¼ŒßñzÄ-ÊÌ0ËeæöìÚ!¹`×–â'Ü `ø€ôŽ]s³S˜Sûn(„8Þj Ù¹õ·§8àÊk‡ÅÙ©BÊó6Ÿ H—*ö—U6 €˜˜Ô¬ž];[0¡#txëúCµnQ@8¬]b÷Þ=£ƒx51*ÈŽü}û—IÈ’Ü¡sÜ<¢”’êÇ÷ìÝ_ëtJ Å1)™={v å5Ø›³ëÍÌË/¿ÜÂÈ&Å{6M_úÛ›oîÝ9Ñ°wÎgb“eQDÄ°!A”Ì`„¥DI¦j8 ž@³ ¢ˆ‚[B ÖÝ‚¤0,‹Q" ‚["À2‘·€°£'‰nAB ‹¨,ÃbˆR"‚B3؃{€PIDIÆ ƒ"Š,¸`» ˆ2Ö“& ¢[V(£>F·K €Œ@–DÁËJ¢ ÊžþRÁí– UcšTîTkË_eýSQŽÕowà×ÅOMxqÓwØåa  tã‚)“?[l'œ»¦tå’%;Ná!ý:ªšeÍɃS^ù×üS RïÙ´ôÛµiý³âl‡¶Nùb¾SÉílhhh¨¯ot¸"â“SbÃg½òÄÒ#Bl­­«//Îÿvù*Ý¡½­nݶC öªò¢e_Ï?£l´±º^ÈìžnµÈòÉ&½ïŽûöë¹ À·£¶êäš³·;r{t ±00ûÅG×wqÐÐÐPWU±qÝw¿åWvíÖ)$ЂO}ûyßn«½ªôûÅówœ/ïÃR%oýʾš¯ØÂe·£±úäŠYÓ÷a Èå[¢G›¡”Ùm_üá3½ŒZ·ý¥”*D»Óz"„PJ©ã›Ï^Ôgð£õ”Râ:3ÿ½qÃG?´£¤‚Rê¬-}âîkÆÜ;©–RJéOK¿¸þêa“çüD)¥¤ñ·Å/zÛš½G ¥T®ûøÅ1ƒ‡Œ=H)¥´tÿš{n½nüãï:(¥T:´uÞ°!#f®Ü *”Rç¼½|Àu«+DJ)mÜóô}ÿ¸áÖ'ŽK2¥äÔ±½ãGyáƒ9õ¡”¬úúÝ«‡ Ÿºl;¥”Ò²ÉÏŒ¿ú†ñ{Î8)‘þòVߣ–lɧ”R¥öã—îÐgÔ>J)¥‡·>r×õã«Êᢄ”¬>h؇óVÉ”RêœûÁS—÷ºü„@)¥ö·Ÿ¹íº[/¬i ”ÖŸ.zxÌ°G^üHíïªyümèÐÿ,øÍø¾þd"Úÿ!Tt~õʽÃþñð]·Þºè×Rõ~Å®%Ûµn_ƒÃårÚËw-¾¦Oß~-£”ŠöÚ/Ÿs÷„wž¬u»Ýµ•åÓßxdȨORz|Çw·=þÊÞâS¢(xHR¥î7oòÏ™;%QÁ^[ñÅä§Æ=ùfYµCAk+òÆ8sG¥’[E¡”žÙ1÷Îç–l[1ö‰IÛËeIt»ìÝö¯‘'M[£vãÍ;®}gÁ¯’( ‚ ‰îËg_;dØüMG)%Ó_¼cÐȻמ°;Ý.Gñ}ëïúÛÀ§go¦TÙ´pÚøž¦Ù§|„X-,ËÏyž§£:^f®Ð¡4³‰t@)`†Á:$ äA3Ð쬧$ÅkQcZ¥ §'ö¥`À( !̲Øh!À؇#oà¨&h%YÞ°¬z(„1‡u2˜7p÷é¯;¥c#wßv¢¿Àbë”Ç?ýÂG·^ÛµÚNïX¹ö¸%R{²píú]#þùLB”µ™ÑAÂP³w%µs(€âÆ5; Ãr¦‚ì+9é¾/žW(™„fN~çÔHnc]}»ÈC²VPx%8ØUV̤Ô<ºrþ¬CÝUËfÍpóâAÇ8‹¾Á¶dòóµ[÷ÇA¨Å+ÿŠ›†·ªÖf,Ø­¯§µ%[]%üýýZ8ÒMÎöM_¬mì5¾î»•+ÅêbŠí‡” ïœiã©£ºÀ¢žìBµG ;º÷îÒ.”sÖH’`ÑÔ‘¿çPHr&íiW.úèáì„pJ½pfÅ›·UzßóoÔÕjPÓ—õ놂.ýî3h‚C(¢[Æ8dö®IŸ>9º? bã²iÿùï”i9Yo´ ª=^çcŒ·`wÇÅ=!9ë ì-cˆ¤ ÷¼t߸BÀh¢ƒs“ “..Bà—i_Ûc#wÞ¾}ˆ·„‡E<\è‚~]2£vnXÿ7a„" ðó×ÿùtWêŠùÝ2û÷~\S\Z—ˆb@®Š“_yeÄÓŸ e BqÓ£ÙQ—uËŽJ>ûùº&öc»Ï°wgÇ㜡Z·KvýÜÈ&&ÅG€¦q`õ!ÄwïqEÄ÷Ÿ”7Ö\vyç‚YëŠ\C3<òUºwóášvãFfÔoþ9®Sÿ§¼~¯1­>7é¢ Ð÷Sî²›f^6þÙÇøüóÏ=3á±»GÛ±§´Ö}ÃØÛ¯š6w}ª ÖÌ\´÷Š[n´Dv¿öšÎô‹O§W8 ­˜3·Ü= oŠ$Š„Ï1Í.VBCµáp]?ŽòæhgoàÄáýÛ11ŒS= €8ÖÌúàƒY?õñ÷ä`í!¢(÷$„¤Q ëqým}m“Ÿ›¸íH­j!¨9úÛ‹oÍé?î©ÁÑÔ)QÑíl¨£M—ößu}2׋_>@YþîÒÓüý^í9½MÈîÙ1`ÞÒ'Ÿ»æÏÝwòÓ÷&lX–e• I»þ‘Gþ–M)µÅŒydBÅÛ÷@ZûŒ¥ñHщ”+nÿ÷ØAT‘1ÃòSlÁÐPWËØB9„(Ü®ÚÚZQVT«-4,$ÈÂbÕ§öôid µhÙ]]]Cù ˆ° Œ°èl(?^r¤¤LfS3:¤$ÆÚ¬,¥ 8\RXDÏœsJÁ&q zQã>Ò׳È|hŽ½ C<4gÍÍL¥ú1¼îÊâqñfQÍe­é>­™?7ã.Ô¼S­‡• €èAAÍÔj°&P]Õöx¤éNbàqSóÛ-51<ÙPß%cªÈŠ(Š’¬0ÏsÇ2„„°÷XϤ dÝðúvy ,R]Ý°wÐæ@_g–ß›ýàR}cpÄôz¢f¼fõ…KoîëIUK”ôüÞûwÎ ª¶åuCwîu5žÙòËÏ›wì=Um‰NìÞwÀ +Fa òÔ”“.vÂ~ò®Î,Dv¯›ûÞËS¦Û“† ¥”M}í…ÿL[áÖSæéóI&]´Ô¼º³¡bÉ‚õ=F>9yÂm ŒenžµüË-cn‡ÌÌ[&]z놮÷"6:”ÈÈHÝ|££ƒÑÞ`÷Ù šdÒ¥²nx´[pÂõ#{,Xµè‡Ž ½2¢ËnXòãÑNWÜvU0ó5št‰¯.®Åöä¨/}ëÙ'Vï.çyVr6Dö¸cåWÏrDÏ¿bqMºÔöTˆR@Xê¾yïÅU{ëGÜù臾{÷#!æµ}¥`=„×ÄR¸ °L:jâñO(¥Å¿|Ù½sÏ?å{þ¾û›ÿôÉíøÖ‚ž¨ŒÖ†ýQ7>¡>×^ŽÞKí§vI|‹z«Ñ‹nQ-ø€6BGüJúpÔê3pôaG Uê„øÖIü¹ûð7²k¦¿Ô™gRÛ!ì''ê©ÊÉ|tbçÌPÓ4tØ7ÀT]‘'µ~»æ0@yáÀà†æÁVЀ´› ÷¼™þ¼Ç9êŽ>“3ò+éü€ ÈPTo6°^¼ˆ >ujø">ýõ㮃Ú4Ó_mõ3w©myO…t;UlfŠ»®úpQ9¨I"îØá’QdX*Þ#ÊV’(¸í¢LEÁiw8eB€Åå´;œnÕMA»½Ñ-ÊꀑE·Ýîô—£Ñî$ˆ(²ÓnwºT\nJdÑn· ’¤±p;=Ê.§Ýîp©[¢ÈN‡Ý%êöEÝöÆF·¤` ÄítÚíN™RJ$ÁÞh%÷F‡‚"»v‡ËM5³žd·7jw»¤9›*n—ÃîpuGE§Ãît ª„$ºµþš#±ï©ôÀBêª=þÂCû¹é‹ÅëŽ)\1ý?î¼lÄÍä7È­ù׋9æöÒ•}/<¢c)¼;nØí(® ”:kŽ=~×5·ŽŸ¤ÆV®[:mäð¡ox°–¼0`è˜5{üZÃR˜óÁS{Y^æÅR¸öÖÇ kê ¥õgŽ>tëЇ_˜Z£a)¼Í!oÿ¥X &/±þF+„€>$ñ±×ßO\°`âO–|á Šˆ8òžÇŒéÌhû VqèûÜ.>¥k÷ܨKk—˜™Û‰²r€9kFVN8“¢¦à‹Šë’››LHdj·\>"H §dãS:æ6rj„¦Å–Õ± ŽLdP@H»œœœ˜ˆP„€‰ŽÏèÚÍΫh¶ô¬Îœ#Ú‚x‹-«SnDB4ƒÂ£“rrs4ôKRzVCƒ8 ÖФÝìQ!÷Ôìn=æB@pûìÎBp’ËDvÉ͉×΂Ò»u'‘*?&01=»‹-<€e€a­í;æ „õ½‡·KÌéÚ5±]ˆgjµU®îOE0€"ËNG£K9k`-€eÝtw¯V-LŠ¢(„2,Ã`¬Â BU›YQ!–a!ŠB(Æ Ã`PÑÊ0Œš,ŠY!ˆeŒ@«…b†c0¥”Y!j9Pˆ¢(Àr FˆR¢( ¥ˆaU,)J0f´’„‚0Ã2(Q…P`#D¨Î]ÝG)ŠB(Çqé}¤ãSQEQ¼ÜÕþr,£e`‘5î© Tï¯BB(Ƙas,¶õó ð8.#Í¿ŒùÕ½g­›á|]›xZú¨ŸÆéY1w}žkâ]éWÏYœ"[ϱÅ.ý^­ï¯é¼ÙÖ× ï'Ô?—Ïg3¿¡I—´l˜d’I&–‚I&“lœ;šúq˜dÒ¥¼§òI á (ÓËФKtÝðä‚ÒU!U#'Ä£¦›+ˆI—⺡ú@PŠWcí±£‡O4¦gvLMŽ ´¨ÈS0é Öo+…"€*‡·ýðŸw¦æWCRT@ÉѲì!·ü{£]âik’z˜dÒŸnP@Èqjß#ãÚÿí…'ïI¨)Ù5ñ©g¥¬1_}òT¸'ͲéÝ`Ò¥£ohâprûêøÛï¹£sj\XhXz·!»áÄÎåëvÔ·Ò™Ê$“.2]\Ó#ª+ªy‹-"”HIHå@.?¼¼ˆ &™tÉÈBpbl‡g]Õᣰû†íÛ$Ä4 uÔSÐ$“.]\Ïê ½F^Óñëßx©¦äÖ^¡;Ö¯X±zgµBô픹§2é’Ò7T0aJøà„‰“?¼"Q^1ëƒg&NZµß=ññdg­*x|kªö3ðÉ¡îsI—úOõÀ§(¥†ÛMNí)Ph Ÿ`àh,éÃQIõpôeg„B z>M£”ús§Í‚14ÇÝ ½`º¶µáuC5ÌŠ€(¶äîïÍ\x8ÿ`£ÌåtïRõÓçG„%ëú÷šµ–‡Ç˜¶Þ3Ø<ÑÚ …kƒ¦ì{îú uæÄGš½•z2Öù>¦£ û%¸÷rôâ–`·›rcMo¹kÌÍö×—»/`ZÅÛ°lhØ×€œÇÌû±ëðQ=sº«·VoØ(rQúäÀ9Z©(Õ"Îõ+5˼>:(蘄P@jS“¢”O5¡ %ÂD@ P5y¯wÌéE)Õn"”P};¨¢5êሥ„R¬¥„‚§-Fî( Œ½‚J©¡Ù„Rä)J"-‡žQ¨šp×f%Óضˆyùå—›Nø²»vÆägW¸/¿r`0v®ùjÊ—w½óŇf /Výï~E €0–ölùqÉâµ|‡œ8Š}ϯKW¬/ˆNN ´Ê®Ú•‹fo?XÙ¡K&àHÞÖeË¿¯ÐŒ„HDÅ’ý?ÎY¶54>!*Ɖ{Óšù+<ܧk0Buå…K—-;XÜÙ1Eäôñ½sæ}GÃâÚE0XÞýëŠE+~ íØ­•AâÉo—,Ý´ëXZnVFöšòeß|}¼%%Åó :´ë—%Ë׸¢Sbª[·rùÚMâ2³By\Uôóç_ÿb‹‰ FàÚ¸fÑŠ•;ûõA¨¡òØw+ï?Z›ž‘Ì3¸±òàŒ™K¬-9>#yç†ï/ûÅÖ±{Lƒ¤ÊŸXúÓ¶âÄÌ4Ϲ«V,œuè¤;µC*Ñ¡Ý–._ÕÀE¥Ç…#­ ¯2é oh§Ý$ 8ùŸÿK9²úþ±·ÜqûÍßþ:yè½/Ý7\Kd†ÍÈÙV õCKy;~žþùôü@vømÙ¬oV–×Ù@v×­Z6{ѲŸÝ¨øயgÍÜ°¯‰ÇþôåÌEŧj¨°íçE3f,©€ºÓG—-œ»|Õo@¤êDÞÌsö– òþ-ßõÅÜ£v@¨X³â›y‹V5P ŽºÓËçÏX·e¯HŽämž5sÖÖC' ~Úå³æ-;å”Hͱ_§}1ÿ`™ÊPض~é—ŸÍ;öêß-·|ÕF§$#U…³¦ÏÚ²ÿ(öm]óåg3 ±jÓÚEs®ªq :k¾[8óûŸ· àÈþ­sfÎÜ”wÜø¾Lj#Ôì¹8P TrÚ·;¯À.áø´¬>=r#ƒ­j9mm õ¼D>^TPT\Õþ²þIÁU„²£ûKª˜œ®"‚dÑq`ï. ïÙ;‡zúDñ‘âÉÙRc€È•å‡òŠs;dž#"ÍßUV{ ê à¬;uàÐdm×½{6CICMÙÞ¼ÒäÌì”ØhŒåÒÃû‹Ê ˆµbj÷î=d—»÷íjCàvÖåíÝgm—šÕ>™Ç¨âøáÃŧâ;té à8¸/¿²r{õã{UÁ¶ÕY¹9IQ¡@Ä#÷?%õ:0 ÀÕX}èà!…ÌÉÉ´0ØÕX±cב¸ŒÌöIqÉÇ(*­ËpyB rcA~~¥ÓÒµg—`Ž“„Ƽ=»QP|ç.,ˆV”9RRÞ9;9Ê ªlÓ²áÉógL–:Ö!a zöÖhŽÔ´i"h!ÜÖ?zÛçºÉM¿œB-ÇðúmýR‚Oh»–Eü<öýšbÐ~—ûYº¨Ã¸™úF^7ŒƒÞ75Ô¹Â(ø?îqÞõK¾F‚o¶M¯›¯oQß1jHiÕ书ÂäÃÞ7ñT“álHôЄOÓšáÞ|•MJ6÷’Mj£²a’I&5£‹›d’I¦l˜dÒyÊF“D´é)ßä&™tIèš®«Ž{Œu°\OtM F^•Õ 4é ¯9ט·Ü“š,Iªó.˜á€&]LÄ6¿^èžÁ‰‚¼Ó`ËéÊaŠ(B²,V*ݱcœ:°gvhHǨ(º ‚-˜âaÒEºnìúŠóÌ[O>Z”8xÊÓãÃ,˜"¤¸jWÍùø™?Ø¢x¡¢¨2pÂÛSîš‹=^§¦`˜tq®šŸ:©9qtÇ®=y{¶¬ÞRÐuÜõÚ8•nZòöWk®ÿÌý7 K(UR5IDATãû·Ÿý{ê¤I²æöO ÍÝÄ”“.jb§Òƒ.* v/œ7oOÑÄpX?¼œõ¿|÷K`û¾7^wutxpxTÜè{ŸÊàŠ¯ÚjNS0LºX× -j<ã²k^ÍîHãGŸ³K’*5¢»úà™Ú¤ô>ÌP>863#¹h÷Vú³šƒ®©p˜tq®šyÖš”À3šïâp¸ÝBP¸5À 1˜oìvVÔê«PS0Lº(e4×?pDÍ™í½'"QŽeYŒ€"@Ž‘‰(xbQMÑ0éb• ÕÒÔ¼½‰Á˜E²"˪¢@DIf0Ç!Ð|j½Z½–‚ñŽ‰¥àWÒÄR¸dãl¥ƒlÖ‹½Np Ú¡©ªÑaµÅ…k¢¡‚}î5í/}Æ…7Q½÷ š&1hLôt÷Ú†ÐWìŒW¾%}Y ù9 ,ŠGDü*A>Ü=]òí/øĵKš¾ Y6(B¼5ªclxÙ±uÕ.m®sW;™Ø­/¯é)þú†!‚V&äY—ô}X“h ¤o°¡ÇmE»Pçk¤E"é|´µÏw-¤• !ï“ž’ԃ뀼ÁFž+¡Úiä-hŒAÍõWï„A¡Ó£Cü‚¤Ð™ô¿¦æ°Àà%;Y¹Â“5´oW ƒX– "u+–® Ñ}r3¨Ÿ?åµµEüÏ>˜Ê«“ õ fÃHÚ³yí’Åkø¹q6dÇž_—,__“œh•œ5+ÍÞ–_™™“É#8²ëÒe+k 4#! X²íœe[Ââ"Cl˜º7®š·òÇ|K¡ödÁ²eKkÈÊV±öÌ™÷ ‹‹ŽÀXÞ½aÅ¢›B;ukgÅH<¹bÉ’M»KÓst,…ùsKQRR<§a)¬vZcR5,…ek7ˆËÊåQUÑOÓ殌ö`),\þíŽäþ=5,…å‹÷iX •gÎXâd‚’ãÛiX K¶uìáÁRX·µ893-PÅRX0óP¹;µC*PÁî K–ýPÏF¥Ç›X ʺᅼEo±p¬öÉ0—=äÆoøÓœ)ãÇ×ýsÖ—ÝþèÓý“‚4ó-õî©tñ’òvþ2óó™ù5"€âÈß²|΂ï+T,¡aõ²9‹W¬×° vÍŸ;gÓ¾*–üù«YKŠNÕR âŽõ‹gÍ\ªBÔŸ)^¾xÞ·«½X ³g}½ïðqK!oëÓ¿úú¨§Ö~»`þ¢Õ–Býé gý¼uŸŠ¥p4oóìÙs¶èX k¿3…†¥PºiÚWß:Qîmë—}õÅ7§À^}òûåóW¬Ö°ìU…³gÎÞv@ÃRØ¿uÍôi³ 5,…êßÖ.þzñê* K¡öûųøi«Gò¶Î™={s~™:•˜‚Ѧ¨E?\͹PŽ8 Gg¦$°Œz6¢£&oÏî‚’rÂÚ:dçtïÒÁÂ"#h™oò‰’#%¥Ué½.Kb‰"–ç—ÖàŽ]²#lVYtÌÛ+àð®Ý;ò@Ï”+*)Lê™M‰\Sq8¿Ä‘Õ¥ctX"bQÁ¾ŠÜu`Ï`gý™‚Â"dì’›ÉR¥±¶<ïà‰ÄŒI1QË'ŽæŸtfõícÅ Õå(tH9½slnWÃÁ¼ê.èÇ•Ëç$¿+¥ÿ-›s‡ÜÓ`É|}í?ÝÚ'¹#½LJ§!%R”5J;Ðë)i™UîfÓq߬$ @ ŸÍ‹ÐÖÏìܵĤp5¢«Ž„äL{~Ý°ŸOŒ ÙÞÂôó˜[L<ÛÐoZVg"1´h4ªŸ­ÌË.$»õ?CGý6Á­Çd;»Etg<üÇÜ“ÿ 2ËÖ&ök^íC/ãó¡ž<ø®–ËôÞŠuZŒŸ2ÔNò7ðl{ÀwÿþµsѸVv#Q „$Þ;f’lÕG›°qÁÛ$òo^¥ ŸÏÞ‚êå³È®Ó¬fÀ )qá[gö:uvæºY]Ù lI±¯ÞPuázL$áÖ>ÿqÿ^øûG™^2!ª¥»ìV×<ˆMzºlBÏg?íø±]µRâ·bÌëHâÝåëÆÕµ"´ª['·µo~*äÄNƒɆK|ùV,´k-íäîrÅÝ0[êƒc¿MÙ?h¸+öú‘MÍüÏØ·ÁVñÙuJùü…ë”9M­D  N‰>²qJÀé;{ÿœ üKãRÞFD%ÒÓ(íç5á¯k›-òêÄUDÿK_ª‰J)!*Ô²z½–­[êºûí;uä}»âî‘É®÷æÅ›XNC³rŽËéF·aïRY“ÊÕ$Çp…æÑÇ2{ç*ráíËðw‰*Fª°s¨bª`HÔ㿆)LÜ}êXµZ¹ŒÞ¤°ÛÇãkßÖ¶]îŸ×âϸûû{§×ÜÆÕÍ»N^ù:©S%c –˜ª!¹MŪ–J‰®Ý.ªâž½x£ˆEy{;ëœ]JU\ÄóW)Nµ\d áUqa/^«yPZÚV©` ´±¯N_¾ª4Ðܽ}§ZÍ:&éNÔÎí6Ù3×^­ˆÚ.Þ9µÝ÷²Òã»Ö5ÜZ¶öÒ¹V‡ÀŽê '­z°\ Pž~Ç‹`d^¾ª½u†kѨ—a1‰*‰Â´²c%ƒœ®¥~tû‰A%s€õ"<&IÅÈ í+W1‘òæñÉ¿_ØÝ¿céPÅÑZ™yè…¿N¶˜±gd ¥Ðʻ֑výn¿ˆµ­aùù•\ .ÍZ·©˜îi;{·mÒuÿµ¡A •@ :òù»øTJ$*W°P¤÷¹”°ðˆhdV®Š½uN1Ó¼»ûà}:fr\JXXD²šW˜X8V¶c(ˆšäÛ×q }pïAUǶÙÌK9°lßæ§ Ç¾Ç°‹”(•Òo‰€´QC³£ŸRpýwwÛ‘K*×qw1ל=}źë²“½ÀéÅÁÓ÷<¯ÝÈ=úþå¹GhèbC½Rª¹íW·éåd‘R*fœUÇmk¸í‹¥Ÿ !öhãÚ/&e]ݳS+½›6"Дg+­z®ÖíÈÿҶޠЗ”Òí߶h3nŸ.õÞá¹>­Ç$Pºîû]¾û‡Ò¤1mëùã’në¼¾A3èþN{r°¡gËG‰ZJéÅmßøuœÃSJinƒPQ¤4éiÇ&k.EÒRCê˜æMGm½ çZ±ÃΣÈÈ4JE1éôœÚû½Ð¦ŸiÝÄ–í'(¥iךÔñ»¡¦y¸–Èm[4û›1#zvéµáÄ}!ëª>#÷Z97ØðRïj“ηlXkïC-å’7¯^~áYœn¿½ÃÛ´½ƒRúø÷> ».Ò9 &|··{ç{<}²½OýRJWmÞjÒv ¥”Ò³ ;yõY©û›ª"Úû¹m:I)U?ü­AÃ!‰éçL7H)¥±ý¼o¤ùøΞµŽDQ)oí  @ òß›1UÛ•»zõ*È$Š*šäã/Sj›‰"J6{G’R „hßÞ7|„}›Éƒ<ìJÏê €èÛg÷J#x "—z>tÓMÛVGzÛ¥õš÷aÏÿSçZÑÏ ZÜ;ß̱¢£(TÝué"ÀC ¬äõ•?Gn~óûž-vr ‡÷ݵªápçÚ[a ¥ìÛ¥Û(!«û¦ïç2¥¥]H~ýàæ5U³Fìç_@Á°p÷È®fÔ‰¯ö®[W®ýì@g)iß!½O<õû±·iœ¯M5Pp{v?«3ð{9¥TêÐõüå®ð€H${Ü£msl~OB)Ô}¡aU‚ï]¿Ê‹@@¨b`zíáý`;A¤¨¾…(¥„Ѓ™ž3z:ɨ ÂŽRâFüâ#Ÿ\¾’ P"uê4uQÏfººû×Ü N%~5tˆ{]kÍ‹÷ž¾IjµŒUè†(€fÕsYÚÓ¾ßü)U§Ä¤‰º´8•ÀGÜýqöš>`ÃØØšò¥aV–a…û×.½•ŠÔÀÔnឳ”ywÖÏoŒu@ß!]¼-L ¸Së#¤Æ©eµ” @öeSŒüí¹çŒ ã3’’U`xcãOÙôeoLUûÄ¡€>4!Dõêl^ãk-\8¬Yé’(÷âá%!Z¤Œ´vÏÙ¿uóÑéîÖ‚–_Ò~=ôkº–iO`Ï…G¦‘Kòp-yê¾"¤jU\š„ ±*{~mæìé®Å0åm¬D!?3!„é2x!„˜@¿ÀîÞ£š8~~±4ìæe0 Tbh>pé‘Ž)¢‰êÕ¬c¼sóQýÛÛš;ot!ð"ín£¹2Y „ê\K)a4‡ÝÇ·‡ÏëþÍèÙ—CgË€:ZËdŠÖ{—ŒÏéZÚ<­óëĹ®S~õ· ¬²ž‚ü™P $hI‡ï`9LõôÂ+F¹qåýóV  )÷ýë7Üü(P‰ÂV)múÝÆÎWúOÚ~A-SÏÚûŒ×åz|Å7c–]¦@€ˆbšDy?“hH(A®ôbž Ìa#)«Õò:¡x|hÕ ­B•$(üÞZ>‹B.­Y×kDPÊšØ1Û_g =¼hÜ? `áѸÆ鿤Ÿâ핃ƼRñé'ЦÈô ƒR½4±ëâAžözCX¥êqK yØF>)AçoV¯ØÀ•Ê AoþÞÝM÷Ò€I¼áçÚhgx CÛòÇm­ þ7xFð•Ò©C_¦ç¾Éè «®S @yµ$‡çX1Ñÿ[4i‘ÎЪgÿœMáümK²‰$¬ô1 Mø©É‚J`: ÷‹ØðËc5!‰ÕtéðX—‡q9È',_“xbÆÆïd5½»tzLz扇«¾ú‘ß0ãç~gF ðó27WÆh”“Ö¯pxÌkÔj *xî˜Ðo@­“¹w›ÛáÒ˜MüìËE…½¨ê;ȧŽ%0¨Ô²ŠÅÆÖÞÍ;ÌØ=­•äšÀ£‚Z­V«ÓLø!…÷)ºþDfEÍc4)ç{2åœsN Ìø+«Åœ+ è΢.½÷Pä=œUÌÃ\z§Ëcj½ð™•¢+»\÷›Ýx ®ôçDKÂKJ“k½§€>¿‰²î2¿ËË´K>þ“Qƒ ò4]JvOËÃY§*n†”}•BA߉Ž ‚ J!‚ ª‚ ‚*… ò©Yµ .\HÿçË‘ªRèšòÅòÏ?и1X[ÃĉpîÚÑñ!küž>…]»@"ÉW`ÌÍÁ(ÿïÉåËç{8(P®Ü{„ê#ø|ø{3ïá¹ügk®Ã³-é}ïា‹gÙÍ¿äk¢?™¹>þ±À@Ø·/[ÊäÉ0z4XY\þiN”q• A,ðÅûZmQ×ÏV µ,ûžZTÀº‚(@ (Í-$4û#*À0ùn¾çú ã # £âo-Ø8IA90 Èdùù™¬ &!`hXPþR)týFF “åkd†3³‚òW(@©,èpssJ º•‹0ü­_ºŠÍ4¨ï¬¿ ¡ôÉŸ_¿¶èݬC‹2/S”RÂîÍ…K{ÿxE©¥‹¿[—‘¦F@)B^Ÿ[töð©ÂCìZ÷ÒeçCÅt_Éô=JÇN³–Ë};“äk?éí:+±Üì\Ë  ¡"LÞôo¿=~?¨uë6”RBH1#!É\Þó.HŒlêzÉ „[¿xðüÉ^|¬ë¤îÍU›þ&ÕÒô£¢QŶí‡Évg,y¶·ïÅÜÖ­*~A*EXx{rfï— ~m¢” ©oŸõçéN߯6SH€P.5QáÖ¿aíj‚^Ó_fk%‘w÷ ò% 4îÒ3m;,ªlÃ¥ [ýØJxõX¨1Ö¤DDÓBÁk’…lñ„´$­VËWóé30áþú Éõ§»»ZQQd ÊXq{džˆšW6ýêØu¡­ÊJv”¦jRÍýgתhL)ˆ\ò‹ã B¾»ÔeÁjS ÿðºÀ:ÈdLØ‘Y—ÿþŸT«áx!¯â"q–î9äѺ©B¸·gæ_áA, †¨¹“êÆŘ־V9úr3gA55.F°µ`ó¹P‰SãŠ{®Þvswæ9½û%¤Š›ãùý—šwn!p¥Æ{þ[]d%ƒCΞ~àÒy¬»· ðªè›!»Æïp´ÅÍÝDNÅ ŠÆ½Ç°Œ^аe-½zL+>Ý29ºÚ¨Æ•Ek*Én1†í;çøõLÕÞxÎT(Ã]RÂ0_/Ú½rÙôGî7¡è…ŠJdi—õ¹y7µ~QŽV¦Tqá-ã·7·É±’«“‰EÍÆ­Úë‡GÖ¼&5}ƒ&†0í­ß' Þsê9+R‰2§±Rõó3O~®øyÍ[Ü*EwqÏ—*·‹~1@¤”âԸͩ_¾}òô•GÝʺž¥¢BÝJu bŽ£]ê¹Ð7W©Ö´šo¥ªÒìfJR2° {WSSJ”®Ð#5«T·)02î%Ë©+¸WrµÏì;XªÇ å-›T²e3Âm*PPVq«èb)R @½'u¿|굋 „…¨ÇÇ• æI$šORÛÏ;va¼ožÅ Üü;¤RÀêš ëŠ”Ø Qý1kyB¿fÒÏ?£Iy(W»Ã­ã ¾à“#Þ.ïT;îÉ jV§ŠRú&âyËê¢È½yxÉ´Š§øîv\|ŠÄкœcM FnCÉŸóÄîJ1éAĹ}%Ùë§ÏlkôR†|ǃ q1‰Ô¶4ˆŠ~õ X#ójnJyéÄÿ»áÜÕ-柭f#áyJ©êݶüÁŸŸ< ¥nctA–°J{×&¹KÛÞµ)0áÝN!®|=‡º®B^štÿa¼²cyåm À€*ê^lt,c`a]½¶¬¬´2ïC«¦]ÆÎ>ºa©tÅò#G¥PQòbûø›a+B­¥ Š”âè¨\3þÕÃKÕ«´E RûJ®Ms €C½òÀÊÔ‰†¯ä]ÉÕ<Ï“ÐÈÒú-LPHŠ¸›K‰ÔȦ¦Uy3Q(¾@Zì}©äðë/·acÝ N4m:q-Phe…,t „>;p¼ªïRF¤÷–5¿úÌ°bCáÝí×áþ3ŽÛZ•6çÿYQ ÅÑÖò`Y¥åקЛwÝU5Ú ›¦˜YÕI2r®]ËêjÈTƒš#:öï#JëX—{øø× š¢¶ŸØ¢qb/¤•w3©ökå 7ÿMiÞ­Ó× IDAT@ ¼¾8çêË62í³ÚM|£¯,_mÞ}ñVC¶Ôw³ˆÂ/mSÚvw°–ð‚nèD u˜êï™A*dSH~v”.†r`RŸ…î¹p¿RmÇè;g³€Óf1ð±mF¹\>tØ0¥‘òs™‘a™¸¸ØŒ&8Ѫ¡EŸ±¯þýÃ?Ìš5«¨„Š`è{·«xÿh-¡"M¤‚ \@± ÷,\ñQJÈ«³g̫ד4rGߣÿ{cß°¹6üÅík5hØ b± ¨·JiSÞ¥––å(J)"Sd{siºU$æÜêãL³üX+ŸÁß) eÚw·"yO‡j‚*F¬> Ã  Kc)aáæL¯‹—îõèèΗÈFwÖ&³=VCª~šñkBˆTxøöE²M‡:@_ï})ójiPà íë4­¹©qúN"1¶0åb£ÓHU#ZdJR¾®˜”ZÅÚC(MsŸÖ+ ‘ Ñ £!Ë’¾îl@ W¥M÷ž”O6n½ÌIû°Z°w¨óòò1R­=#•ÀëãV?Ÿ¯eËP 65ýŸŸÚJ % +…¨Ëçÿ)gÁ¥ŽÓ‹éCâÞ%Ú—úË'<‹2jÚŽÉh‘H €d8¯&ºâÔ‘gÖLÈ j"W©Ùd§šv…:oŸ6¬û„`¤—ôë.€ÆœÚ0uvD²¶²‰ì#hÃædóú5ü»}FKöéj¢Ug©‘(Rg·æ/”æÚ…8T$BEh¼&6ÑÊÑ¦Ï ‚^ %\š.™¤†ÿsbÕK=#3u{Ì´¶(LK€ÇÏ”óþ^ø´òþ“Z9Tµ€° Áç.îvw'W -ö¾”Èa]Óƒ$ì\Ý÷{A*Æ€˜ô_>_ÎX;–¯R!3ŠÄ˜-\ASmü3 oca£%ÊÚ~~÷Nýñ >F¤ªb´‰*ZR›ÀT _+yƧH‰ø&æIÂǹrìÅM×PQ›q>„º~ã]_Axˆ8}Ʋ†'ËÃû{í¢–R–aõÛŽ@õ¾—úy#­HL]›Xž¿îرŽ@ª:Uy ”Pƒ†V–÷ž<âë:PÞ¦R-‘§DQ΂j^q"°ª»×¹zØöDתR‰¡Z ¶. SOlá…!R–›6R€RF¦ @8¾,|–/ð”1é~²Â›m½›Å „•–o÷˱ò kd]µ.Kh¦›vÄ“•rçŸÔ˜î @9»V ¥[¾¾ “™Z¥–ì#Û:„¹‘±¡©eVÌ„«Wφ7ìÔ¨TAø4Ý PA—*רÏÍ hÕúø±£EÓ£ÒŠ"0²ô.Õ^ý£O\A‰”1¬Ý{õV% 5².ïèªgd"“²… ¤ ‰ ã=ÇØQœ›vxøwè… o8ž×FÄŠšâ ¤Å­RR…5HMN Jš÷¾·Ð>^¶~á«L)ýëúåž—*Tó-åé.p®”¿µuüWFnÁõ|ÛÉß¼:R’¿sNy°kÒÇÉ4óNxáÚÖ„ C IŽNeä”°ŠvÖlä$h(òøÉÓò~?ˆ”’»ìdÖ26E¥ªÔ-UMKIe9Úbº¶Üg‘Ì}†$ÍÛ–Öi®.vJ „‚Hì*¹¼¾zªžƒ]zF#‘B®~+€ȔҌ.šÌÁË:ea´Š³—É€°äÁ~~Dj`R^óè6ma k´ã¨®ýzdæð#5¯åßï¿ÌBR€¨#abý&V"CëŒç'dr™¨ÖiSœf®‹ÿÏÅ–>2¦ŽŒxp»~`w‰ŒìÐxÙqS¾PÇV¬îZ® ½.œ9®46þÄ7ÇXÊ R"áV- „“¹}lÜÁc¶dî'³®áÐ_¤ÿ%zá[Êuµ715)trûT›¦Z*•Š$îad\ñŽ3sݘ9ØHØ+g.°R„ ZhU ÕpŸæ~$ðâØ™í½ˆÑwÏVÕÛ çP³a¹ªÎZÕ—õp8¥P!`b“þ3}ûÏôí;ÙÅÕIÔèª]Lì+Ρ¾=¼¯9D¨ÔÙÜJõöq¡”BÒÃW*óê• ³ùýç[ðG¤fÞ z"êm®Ñ@'·ÚQag“ßÅ­êT3áß)$G±võ”ÿ{ý )»O½SluP‡/WkEB)àT M¥•êÓäOàÍÙ&Nu¤Bú£ü2}LJHIN•š›Êé§÷yšÞ @EJIFJúBY;ÐôÝÓŸÒÛ”áÏ„‘çÁ¦s·É³¥°üý„$C&ûS†é9ç5‘G)•ŽYw±¶›ï'~9 R[;——7Cˆ„èŠ/=ª5Ÿ¦2¾¥¦ |Òµx41×ÑÕ£|Õ: ²Å¼­¸k!%J¿ÉÓ„Ë3þ±F-‚Lrˆ¾¶éȺPƒju¤™-8™¡\2½RƒÂ<HIâµ{±jØ)(‰T.ŠZ"‰’nmÓJ¸TN"û‚_ºE^nN²îQÁ(P U€LaÄ0r#™¤r]ýä^ž ‰ŒJ£<[¥ŽÇóÃ?‹ )ÉÃý¿C¹Úv†L’øy†­(‘šØšš¿}|/GÍ!@ê„ÝŠ£R’¤.ß°Cô‘-9&›)–¾ýâŽlÖ–Ý•èT„ŠM‡Û3/öÍù6Un2h¢¯Ÿ^5›SI3³!¬,{M”)€¼ÿÉnJ=~\ιmÆSUÒ¸'{´2"‘CÊýc±†–ΟÜkCÒ® Z;ç÷sóZì˜õ•–™Ä˧·úsJÏ?uÜ2¾Íµk ¾Ý1´Öãw€0llèèZ­XÎBží»}î\JèÁiN­[òç(¿Ð«Ì«ßW ë­”¿—üÀÉþ÷ëØÛjFJ"NÌØþgè‚Á!c›ìYö“(ÍY ÒW4ðtÒÆ+Í»|ñiÛ  ~oòjßž…ÓãTDf2$=;vxùƦRæ>aeºMúÿ HK¸¦v¬â,ˆ@Xc†á8-Hä@âþw?ü%Õ’b\éZìóR”J¬:O¤BÿÜ1l™@ä‚ šVª_Éç;Ïvm£@(¯N{¹1hùŸúBdŒüû.Z(ÉxšW§æÕ%±7Ϧ•,J­\ÛUüûð– Í”DZ¹c§Á=¶Íò×–ÔÝÿÃXbQ]q¹îHЪ8ŽÏzIå…<=Lä49§¼Z%ä¶CŸíÚi×l9Ë@¼Û²nÚ*a9ž#KÛ>fˆA…æ=¾›ÃJÓnoø†5··QÔ^¸rüƾ )¯°kÒlüò<:'„ÀçYãO€HëyÚ†Þ¸äݨ)§Q‰Y·L™Kµª¯®^}ÇkU¢ êZÉ jµuæNVUé˜_McŽƒÿ-úA¨ÚÐð J!æÜâ½ÛÇÕn´Û¢¢MÌNÍkˆ‘»µN­É›Û” ðöÅU ÷]ˆDaý.¡ÿºÓ¸g÷X©„H”-÷];v³ßä¥Æj·œØuÑoÞ¥ê6À2ÚÓÓ}C·¶éÚ«aî·ÝBX‰ô«ŸB:ô \1{‚¯ï§*>jP«ÝìB–úÖUͳ h mjÙÕ îÙ%˜ÕR Dà41wÖ® þ=[ññÎÁC 3-ù¼C ÑÆ?JHQXÚ™¥ãºNõꜚÙÌÌÒR0tj7bžY3Cæð£`RUJ×¾PT ðŸØŠ•¦ÏhPžR!"Uv\w5Ï.§¦ºhHI… -/D 4G˜šûLÜx- ¢Ì¾Å÷û% ‚(…Á›Gƒœ¶8ž ÿ åæYÏÁ¡÷E5ÍlÔSQâöóy´\úÕòi³Ua„ŽÏ~ý”²†._m~"h@Ì0/ØôÚyj²íLâòÝEÒ]Óºï }õ«¥ÀkW›tÚòxàyÊS ·zÉ€ˆ<ð|îØB2^ºòy¬gÒvÓ hµ0lãu^ ¢˜~-¢†ºM»ÅP€&7D¨àðíøÍÀ¥ÏSÖ®åð?ZrŒßá`”QV´á_AKmû¯É¯¡@ˆhà8tÿú§(íBEÁ½ß"¯AÀ0¨¢˜nX‡V³†·›•[€ø4*!ŽõXüÐKŽËé“”XõÙ|ƒWS]ß´ÅŒ %=Y(A›þ¬dQÜ/iX­†1§/£Ã#ªv L‰K“:mLVo‹]ª8\}qekDßoïþ#웥;EÔÛ'l£Ñvº6^…š~DE³‰Ž ‚D ÏOœ’×ò­d˜œš@$•›v}ºFÛcmžB(…¡óvöêÛ òéÝOµ˜‚`Mj4¾–•‚N,D^÷ö/B)õœ´«1“Gû!c ðƒ6DèªyŽâ“•óºé¤nO 2·¡ë½¤@úmèD(Û*"Égª„ŠÀkrë‚„üŠ%cG^Þ`˱€Ò·B¨œ^^º3’`ÒEHí†Q ¢ÞÕê,“Çõgžu¹*+¢&›—êïéÒ„€ÑD¾GúD(m¥é½éŽ1¹½¸Å­ÌaNVû6FS«¹Ï±¥÷E¢¾}?É©e}Ú°ü›‰¶¶ÛãÊTRÕP‘5´,À­“R8îÙ‘Íe¶þ€µàyIónHiÕªiªÿú«½{÷véÒåÓ UAÅ—îüùÒ‚CJF5Iß]ÔéG•Ù?¤,BÐH tHÊZHø”zóîÕ.Ÿ1à-> ˆ´«mò†ˆ˜„˜4cO–V ¸tô¯p›‹ê3\zÄ/ا•†y­ž¿«SqÂPà49×é¦ïb^=Û4­ç˜C$ÉÍ›7SRRúõëW<ïú+à—;O0êøm¤z%SÙ²¢EØñ㢢|üÃóÛ¶jDS»zÊ[g‹6½L ÀÔ¾¶ðvïí‡oíœ=„‚& ˆ¼ÈÃ@¯º)·ÏGă(xuaË­k‘¹æ(Ã×Ïïmþ®sÿÞ]Y––eŸ?¾xñb­V‹E„*…oã… )!ê”á“T€&¾‰ûç‡-3†Z5zÛ÷ý^GqRTç€w'/ß*€@bUÝRû6&An[ÝšfLLæ±¢À¬ž™Ñ«C“ƒOþ.­;®±—üÈ”&GWMÝ?µõáM»ŒìIv‰"„D>¹³kVï¾}zjµZ½¡{’˜˜8oÞU®\¹±cÇ2 ƒ«'°/… ’K]2Þ*›þšûÕþ? x™rÖóãÀi5 ƒ=Ú·jfjf¦“(šm—,DQtttìÛ·oú×ñ©)ìK!‚ä)QYZ“þ.Ì-ú öÞIJbÚ´6Ö½»u453#Ÿ '¹¥”RJ«U«Ö¯_?Bêö¥Aòê¨=D§Bè¯U/êç:fì8†a ÈY×Áòööö÷÷Ç.ª‚ _.Õ«WOJJ*&É#$-MãÚ¯“þôR\\Ü»wï²½å™RBHÛ¶mÝÜÜðÝH¨R‚|Ñ´k×®8O׫W¯)/^œGÃãÅ‹ð?7þÉ°Lp$„œ%•J¿ýö[©Tú)‚@LJJ\÷Ç©*Ui7]†_ÑÁJÅ!C†ØÙÙ•ö®FžÅö|çÎÇ•îTnÿ—H$“&M*ŒÿɼÏ ¹¯©´Fákȳ%Åq|™±|ŠÅµyf VkxA`ùïäxç\ý\J‹¯,Òêù¡ AK©YãG)-üØH~ßÇ,3辟V˜ÑZAðÓêB¢(é‚ eP¥ààᣌTQðÀ:‚Æ¿…_Ù.6žç÷„06³xÏH{«Z5]P¨@¤°s÷^#ó‚?D152ðôpG£!ªÔ‡5„¶5ûÍZÃi ÚM*ƒ ¾-Ôëöÿ+%¡—ý6ʹyßÖÁã Ž£¬6Nî^WÂr_l×Vb{±©ij»mºŽýI,p©‘ÌÖï*‘HÊÆÄuTÀù6T©ÿŽ¯¯ojjê§ÍS„‹ˆÐGbD†xzx°lQÍ»sW¯^½ÉÁËËë#&=yd~ê©ö½ƒR¢FFF¾¾MT*U±UiQ½½½?>ŸjÕª¹»»Âçö£ÞÅÞ?uç½.$ð`llìíí­Õj‹ÔPR©T")Âf¢µµuÍš5‹íźÕâlçyÞÖÖ¶¬†f''§ºuëgñI$’â\ë_xÿ/’JÒ¸qã¢0âŠc…º%VÒºu›"­)9äâââââò19”/g}üÑñÂìifjêëë[k)Ã0íÛ·ÿ„†¿|ròNaö´°°hÖ¬Yñ„†"ÍÿÓ°d±”Õ[ûäþ_z‹¯Ô¬ñû ‘/ê‡ ?ûPCá­Qzkñ'7ò‡–Ò{,Q^ZÚ ˆ·VBîW¢#‚ %¸[YŠt¸¿´à ó‡-¯&.ùCÏBŒæZváÂ…ŒÞû )¥U«VíÒ¥ËXÀ¯_¿Y¶lYŽåj-[¶¬[·.zÞ/#"W¬X¡o4Žã†®T*Ñ>‚*õ±P )))ú*%Bî÷ ~!ˆ¢œœÌó¼¾f¿xñUªOHHÐ7š 111¨RRü|óR„®AA•BAT)AU AAP¥AU AA•BAT)AU AAP¥AU AA•BAT)AU AAP¥AU AA•BAT)A¤ìRj¾(Ï2 ¨„BH~?K”ÒÜÿ!Ö L.k”y·ÎÓh û…º‚ J}zfÍþéà±S =|9­:3ÑÕ¯›À½ç@צgö,Ñ‹Ml\ô[å©¿ûôéSKˆâÛ¤Y%§Ú&&&¢ÀëÕª¯.ÓÞ{¬(‚•Ccÿ\¡4=zKåïþ;v¤²l»5!¤|y›¶Ý‚äR)¥bºÑ4šÆFgüÊžƒ*u›ÿçL¦Ñd†×ÎðððtppÀ Å]iF],i¬Xµvç™ûAS–H¤@EP˜‹% •¥ÿÁ0°oÍ¢Ø;Çƌҵk×ÒÛ-8ðëë†íã4é·ÆkhaZ÷¬V¸!%Q³ó—1vFBßžÛµkWæ»sÏ`³º›wëžÞÔ)œÑ(¥¬„°R]âÞÄo_0²Ne˧M¶³³Ç ÅLÉ—9|È‰Í ~î\%âÑC‘^C¡zJA«¦¼b_GßÖ©ª4ÊÏÇS­V—Þn¥týú߇´©5«›{jB²ÀV¢tKN œžß¾³°o]ÿºöÎUíAøœû¯›ý«Ò%Ã:§¥¤Þh„QH7ÚõG– lè[»‚µ9Çñ/U*[“V&“=öT¼º~æ ©¬°Ý>J)Ë’ã[…Lï<(¸·±Òˆ–òBÒ UËf¾·/ŸÙ5«÷½K'$Ò±†ÖNéùhß¼¯úõß;àU† ”öéÕãø®u¿~åñøaHá$~ vK¼±gà€~­#‚ J嚀a˜§OYüý׋‡·IŽ.Ì¢Aà—í$‰ºÖ¥C[†)#3Þ:k( ÏžuÕŒ¡Ë‡¶ŠzYÑrèùÿü>¾oçÖÆJ#”(A•*,”ÒÃGŽµ­a0'¸±Àsº”ÌM ŠÂº©îìž3ð«þñãääÔ£G/jêAP¥ŠÛ·oïÛ·O÷€ª§§g@@À_t“./^†aÚ·oß A µ£ÑhÈb1LŠFCT)A)\Y‹ ‚ J!‚ ª‚ ‚*… ‚ ¨R‚ ª‚ ‚|Ñ*E³¼S½Ïxg$ýÇ/%\õªÜìÕû½l²’Öôlâ2ìÌXç~ƒ€%T¤ PÊ0 *mšnÿZðÃE™” º/'t˜¹áÇŽ¶Ýj4¦THhSã lëô:il—Rô6Õ‡Í+v=ópdÕ¬¹{|Ï_Tu/-è×´C¢VA$t6¡ ­¹^MÿQ»ò ›ˆ”0 z üyŨ&6û—a %,àT ŒEõÀ¾#¿Ôª <¦Ê½;àáùãª[×<”™iêMÜùzïÞúkôX¢0` P*êÌ%8·;£Ò¾Þk#Iÿ€‹H)EÉè]§Ué_½s¬¹¹œªJI²rtÿê»9}=*`h@ÔD-&„kÍîz«ŸÄ¯ëߪõO;õ“·©¼û]^Ç¿ië^ûÈ+ý”è únsþMÎü}ï¯Yn5=wDdí!ŠbîŒDQ)͹E—–=5÷áºCóÊñ=æã¶.õ×<Ïvä_“ƒýÆ,ÐßiS÷FÖÜËëpU‡óšûú)ÉÃ||¾=ô(ó÷‹Ó+½]=V?Ô蟣ð6EZì6ÉîÝáÆu|®$맥ýа÷¶GúIc|ªO?ŸÇáiÏN7öiòŠÓO{ØƹþF=Ÿ<½rDƒÍ.%dÝP~.”§!rïžÇáy™K,s!HÙ ¤ÍKñZJDuj=1•Š¢V 9Û×;S 5§w¨•¶óÍÌî!!$éè玿D?ÚØÂÛÓ³Ùì­çtŸM$D½û—q~Þ^^žMGÎÙ–¦K#ä·o|,¹1gPÛý×B¢oí îØÂË˳U×ÁÇ'ë5‰kÖÔÇ«I‹Ž+Ý !„œúµM‹©—7Lë[/pê'íµ‘P­*¯M©"!Z•6§5Y;Wj6|PCnךKúhÍŹN-Æ'¾>Ý«uO&Ûé6Ꭿ™êïãíåéûÕw+“(!!ç´žquͤ^õºÎ&„$?=þu·Vž^^Í;í¹ñVw(4ÛNhîëåÓ´õüWB!7w÷}òðŠ1 ¾â‹©'—*P†OKɽ!E•@U)böÑÈ4-¥ÐtØB»Äsg"€d¹Ðã ]ë:pçØòVM<û´þãÏÒíÂÇ/ÿn`/ÏÆ>-§®ý›Kw!á«Ž~ ½öM o“oÿ!„Ü;¾¶s€¯·—W§þ¯Eq€‰áóF÷ñiìݼmŸ½W"uóœ?Ü{øÊ?ökÕhÐV|?‚èoÇ äFú¿Y9ó©«¢ 2’l7%S*߆þø×äu»°Bô·=»~#üµ¸Ÿã¢‘ÝO¤6ܲç/–ˆgŽì7.n×âQ 76 ;¾¼Ûœeý+”O¾$pÄò…¿o¨neôârî-Ìö°OÛ¶sBûéÛ÷ÎfT‘ß×ì\Ò¥š©R{â7vÂøã+Mdú6!Ä@Â|ÚAX*Œ$Û7eF†I—†.n´tÛ~“ôsP‡ ÁaÛ7uwÌôÛ?F›·ï1”2GVMêôúàÖŸd ÈM”©ÿûÍø»ï»TÒDßéüÃ7K·þ\ÙXó¤_p+ºöd·†²é]Ô´uÏF;ç«þ_'þº~ˆ©û`í“Æ#nªñi\C¥þoé§õ ÂPJY–ÕO“µåke\ÀzÅï|¾Z”Ðe%! Ñšvõo`ø!S}²´E­_hÖ%KŒŒm¼j}”MäŠÌ¿Ÿüï÷ 7FîwËÑШ•ãçö)/¡Ìzë:vѲä1ëÚYà?ÚÆÂxžoÓ"`Õùí*N”Ɇ0jÑ¥©« éù- £°°­X®œ Ê•;rê¬ÌÄ8áÞÑñ:5ÈVÖK7lÐzõ›!> a¹äÿ·wçñQÔ÷Ç?ß™Ù#›cw“%( P¤¦BAå²þø ZA{@y´` ?)EDìQ ¥åR)¤‚€ü¹ªÁj©\*þ<QR A¬¤Vr4Çîη„»™@0ˆ¯ç?,ßÙùÌwçý#»žÌÁ½Rµ>#iâN Ýú »º i-^ CÓFNn_Í¡|ã“Sò¿¸dâõÑ×¥ ©,¿dÈϺùµVþ®×~»å;›6Œ¸nðôe«R/N7ćSFõL³sŸH¥D2®ïý½¶éZTÎÃV‚?µyz²)i7ßó^Ïñ†Ê[0ïÃoõ_1´«ˆHZï)o¸gÆœ{×MUJ5kqyß+/ãÛ5s“R•%zúŽÝ?¬sè°|x¿gšòyT²zd¯"ZD”aR/úùôm¦µŽúuðHÊ·ÛTÿ:b³àÅ%ὶûèî_ ôQ©Ëë6u¸Ò›|yõmvaoúU"¢´nqݶúˈ;:ô’™Ù§gçDC>:xØ::jäH%"¢ìÐq£âÓOÊE´-é=¼ ü0yƒ§8ËõÝ›wK«myeò°‹›TçM÷ é2ÙQfRrjﱸµUìP؉—v°¤j—šhQ[ËCâ-90udfΉóX {¬„gÇ´m¤ww‰(­ýmº ýîÅ¿x»e·ÌÌ̾½®iaÈá#ŸZ:ü»»îp)-"J—Z‘w—ËEÛw žfMNÖ…Š]+ví®›á³ú^Ó¤QŽZЯË|-"b˜î”æ-XñTÇx-¢ê&Y¤y÷fUk¡u›@ü梣üãMý=Rhú¼–aW–»:ÖÜqNKk+¢”Öïº÷º·÷ëÚ©M×›33}¯K†¡äݽ%ž‚í£îikQeÇ? —˜¥ZÄǧwŽé½)u)©(©M©H…Ý´1£–~s×Ü×#­ÒÖ¢”a˜–i8ÝÌvb1ZÄŽØJ)ÃøbìãZxöñÁDÔ¡UY—¨™§2̪¡µÿ„'W‹„÷oÿÿ… X4«òÑç6˜¦òZÏû¿Gêžkr{ä1Luú5©¬{Nëò°ÝÄ]TÏ ‹æ èTÑ"Ê0~'I×ÖÄŽˆ(—§bêí¿,»iÉÆ1]•R_l[ùƒi+ëOXêDM¼£}vd$|0oóÎ4çð¤?¾ÞÞ4 Ë?cÞ£)®Ú«>.|úåjr²ré—ˆÔ¹Ç/Ô´®ÐÃ×¾;¢•¶µ(¥ Ã4ÍÚ[Iëw! G´aúhÞð óï˜û×]ÒD©Ü™ƒFVÛ- èîB—>øÜK¡PùÎ/>ìòÈüµ?í."®¸¤`’÷tÇñþää˜ÕõÄ'L_T•üAœËqï™HŽ‹Ú†*1ðzN½YË­ö rûÄŽJï»þæg-µ–™‹–Þ;aú¸-úú_Þ?ñ•ËÆ=if«µ+\qI$OUMšwºñé¤isæ.;R—ÚöžÇ_½å ¿Özì“/·_úÀì©*”ïÚŸL{í}DÄp'ýqg.,Üä`ôM}*>LŠª J&Ç»•Óa·; FZzõw uY ÿ]}}¿ýí=Ç%õ×ϬÿqFœÈÏÏùß1³³6¨äÛ&Ïw•þüçÃîÏúÓÊÇ&%ú¾ªM õ&.¹$cÁœÙS Êt³vÝŸX¿æ2h}éÒW^ylúÔ)Ÿ6Ò2'ÿùÖÿú–ˆÄ%ø“|TÑŸû³s7Qûjj-5M µÔ¼^ªÿ[s]»Á‰cvÇ['všbå¿þ{³î›‰>«ã0{­ÅégÅ«¯X¨“¬Ÿ4úÒwõ´ujR»v'šNR“ÚežfMtÞ¼w~³eqÜùW““t¡êåÖÞÚ»¾Ñý¬Ñ]HŸü†…Oþò??^ñß9/ Z·èWÔOUÿ:l­¥^¹¢ë¯ëàXê«ÃÚjíÃ:TC-±“Öùø68ñi¼™†g_µßu˜RrýNçÔ«‰œFMÔ…X“Æt!ih}ûÙ©»ÐißRçP‡ÚÀ¬=œ›3~ç†áo׳‹Éç>JBËWó}øåMËèÖ‘oöÎ ÅßÎß# J ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R €³’RZS_Ày–R5áTT$ï¾+Ç‹ËE¡_‚uÆ’I©´–ìl;V¶n=ñ¬ÏG¡ç.¥ª"jùryøaÙ¿_ žýr±øSº‰WB!yüqY¿^Ö­k8 -0@âãŪŠ‰‰±JIb¢¸ÝMÇúafΆáÐhš±¦)–{QÍ4Î[š¦Ãû4Mñx½^‡Æ¸8‡Æøx‡Æ„‡7Ÿ”Ô¨uÃ#à›{,årÉ€²}»\t‘|þyƒŸü$‘P(vﯵD"ÓÛ¶ÃÍŽ;LÖÐ<cöJ'™²1 ²m‡)m["‘F­û׈Ëåñqq±Ã­ÅçsÈø¸8‡8÷ùâ<>Þ¡1!A|¾Ø’ÆÇKbbìÒÄïwXP0è0Ï””3pRᔎ£«ªA†c£ã¨«¾ú›C)‡Æª)«æ™à0v.¨c©š±g8,EE’•%=;M ÇŽ}…ƒßú-Ž+ÕPc#ã°ñÒèû_ü¯â†É’)(ˆsY™ÄNéØ É‘#±;ÐPHŽuIÆ.(‘¢"‡ÆââØFÛ–’‡Œ/-u(KY™Ã”••çø“§œCÅ1~êÜ;•ÖÎõCζÅ0ĶeÚ4?žý .è”r´c‡¬^-óæIqñWžRhâð_ZýƒæŠ ‡ƒûÊJ‡ÆPHB¡Øˆ …¦¬: QÑ¡PìŒD$Žm´í“o¸òJIOgKâ›—R5{ÀÍ›eÉÉÉ‘]»¨5àüH)Fî€3ál}C8S R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R R @J@JH)H)H))) ¥ ¥ ¥¤¤€”€”€”RRR R €úþd^»¤›÷ÍDIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/NFQ2.png0000644000000000000000000005034313051004444021616 00000000000000‰PNG  IHDRzLJáàwsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ $0?» IDATxÚìu\UIÇŸ¹ —nÁD¤ [;V]ìzíµkÕu×®]wÅ^±»;1[1PQ0@éÎ[çÌûǹàQqWÙçûñÏçΙ;œù™gfž!”R@ùúð° A¹AåAåA”APnAPnA¹AA¹AåA”A”APnAPnA¹AåAåA”A”APnA¹Aùú¾äËŧ8B*­DË´(½2ïY¹”SÂr~—Ä}^þñÅߥyß–B>ÜH•’›“ÿó\créòIùHûƒâòÑv@ ôj™b=æòŽ~e¦çÞ;ÚtØâáûoŽ®÷Öiòíž^r¿±Qé¤Ô³Ã~X𔥵/…îPלµãZneãø*È{ֺ׌²j•Zv™°{jON’Ó+&.9reXJ)Âçókxlûc”ÒoW”›ÏÀ°¾sáÇŸjBr㎌ úëెšÿ6@Ê홇WãöǬïU¿Ì>K1ÖãwüÙÚ Ô‡|±¦Jk kdëN X0pZºtº½¹ž<+îïÓN‡ïlÙ8xûé3uµ) â UCn(¥>37øTИ‘eçä(±¾(€³6{7pàsÿKVúÂrA ÑÕ××ÿjíšÜëA.Órúö]­T=H}ýß6žµ·ÛÐ}{ͼ|r‘ÇTÈ·D帊Kø ’/ž=ñà¥*RÐÑÖ-®kC)g¯Œ¼vùÔ©3÷ž%}^¢‹ŸðäìéS·Ÿ&½Ÿún˜o\9sár²¬DaTÿQd\½xölHXš>ìQ}}/âÔÉS×"£Õ²§ê÷zp-äìÅ°æݽUfÇ]Š–1È ·,ž¾*8#§PÉR¾@(Ò2úqÎÎÉ­LÈ›­ÃÚ,~~`Û¸ñ“%æH±†¦†ÿ ùóF´ a¦ és%êµ\&cô«Õ›ÙÞ¼ü>+²\7Ìy𚣫¯öØ´ÖgTþÕ+'<~ßÙãii J›Ï˜c|¢×®“W6€8REz7|¡X,sÿŠÄ—ŸJ_¼éЕ+—w­™g"{³lü€$€&3NÅþò£gCŽMç0Qkן¸áÐþ§“®\¿vpóÓ¤u ¦Ë»þR²ÅÆý'®\¾´d5س»Vf!Nêñìm«¡¿?rñôÑA.ü™»n‹>æ<·î·ÚÑ@{ç”a/sËîp€·'×ü^’?w…s©1wï±Zu:Ô(kö‹€:µÍ5RnEÊñGªÞ`JÕ†ò3ç­oé\W_ßÀÚ³ÝúÀi²Â„9kiè›V3ÑãêÕk˜é€×‘i ØM›0°º±žDK§®“߀f…¹ïš  t±2×70vnÙ7phS^aÔ¡³/J¶-ùï#—JĦÁËFÖ¯a¤­kèÝiÌÏmm3#Ö„¾¥ð<öѶžÑ£‘¡Ž–ŽAµî“–8HYȼ_ò̸L+GÇ‹æשn$‘hÕ´r™7ÆŠ¤2¶xÞº Û/ËÚ»Õáh™Ô6¬#Í}É“ûfIx–À2`Ñ°Žæ&ÆÕj ^¼ß£¦¸"ãÏ¿·ÌÔ挟·³ì)$B2nÞU’MÇïr‰9‰¹mrn#Ñ•ðróñGªªÜÈd–¾vק7qocÅ*“o|¿©ÕíûÛÖí›ëhs/g&!öÞ…›™%ÚšÈÍœÅYÙi ¼{O”È¥ ítžX«é¯DõJ'ÐnBgž?«ºÎ4ÿq¿i+Â#Ÿ)ðDÆÇ k_[ã½Þ5pï´cûæö5U…Ô7϶SÂB.mîÔ€ó„±H“¥rR"…^Ïù?q£K „¸6P°‹R3¿ñm$]Z¶ûfRYrÄ:/¹q¿$÷Žå /’yyžw¥B"-!>àHÕðݼ£×PçÝT0°7eCÉe?ºzlÏá×oÝIÈ($B-Ëj¨5FS'BÔ³ªiªEÓòóJ´(iáó³N´9¨T*]~fN€¥w¿9S’dÛOî{n C¡žSã^}ø»—Yž„GW¶í9výö‹„LÂÔ±,±f†e©†Døþ4"7‘žGM~ñŠ"B¡A-]¶`Biç_7ŠhýÇŒ™m/n~ï „‘åˆßw™@ ; rìÍ€†jsOœ‡R „MKÈã×±ÓÆ©ªrC RÂw @žžG†¥ßÛ@lû¿ µmÝ~úÍËÝձʼn¥—^S³ÉŠ£@¥8 'WFZ%šáñ)e«÷X¶ºIÉöHM,­€ ×”?zMä˜{'O¾~óæÊycCR¶¬ïß°Ty’#¶ú^]½®½¯qs¼Üœ¬²êº4æãÕ§m”¾ÊO³¢™!iéZbG¥âÕ³ûµ¿ñ—ÀsnüŠÎYSÏv̱ õ›þφ«on…ñ­èTkSéÕÏs¨ß O|¾‘*;˜³wŸ§2ÜÔ.¥@SDä Lê »hÜÅŠÌÌ‹‡ >UÂAåÓ÷çÊY(È~9xþaʯۥ]ýÍG 7? †âùÚ3ÏRU[ùcÇMµ`ŸP›À¿{rÝâùËã¤,wkEΛ4B šíûÝE‚¯­+,.“·zÃ3€/Êê×êj9á³OF½e€«|~bþŧŸ°¸ŽÒQK¯!”¦%É*Þ¤`üçúÙü‚”>þ~7^$K ±øqõÄ–uöÌó:³ ÿâõ6:#UGn(Pu·«RÜ@3j‡·«gç.Ü=š¼“íÜ~\s ÀeO]{ö&.‰´©SN“þò÷2#  `Øh¾üM@SÏfzôìÒÖ«U™@3pÛDÞ{‹ß|š´fS¯÷œ¼îuBRä•Ã¼šF‰ôÀ¹¯ÜäTI÷rñ§T0ãàam±pÑð^î®®ÞŸ›<³;%¼2›:á ø%'É ¡PgñÔ†ðÁ;a.—&€±]Ç“Û“™‰ýº5ñötuuu÷ôX–*ÐÐ D{þÞœŽÓàÈ7¡_Ðá~uawXŠfŸÞ]y„LíÞþ|ŽGäù¹»Ÿ²ób¤P¿î„¹‹Z44¢@ªÈîäß5R¥V›Ë'g V8ü0¨ÀhþúmN²Ð¶Ã—4LÏŸÛWì=¾%0$òuM§æc‡t©çïñ¤\á !·ƒ×ý¾ñh–l|:Λ5VO¨²¡Lö«Esæ_}Ïç‹Ü[ÿ8wòAÙÎrqͤ‡"h œ³q€;iݾ/Ã2Žœ¯–vðÚ›½˜hª¾ÿðHHT‡þ½Lyªý§7o;p鮆©õ„I£ŒDïJX²CKnæVK)º¢”µn-w§%÷µ7wN¯Ûý:U×´–߃ú´q„ÂG?t¦ÑzÊîÝñGªˆÜ¨ÃÉÍ­ós…e7 µf£Š›ê¼kbôßÙXXº[÷Ÿ8{>D£†ó@—wÁnŠ]0Ùi)©éòÒ;ߥ¦¦e¼ ³”åg§¤¤æI•ðþ‰ eqJø}y)©™Tít…œÌô”Ô4©òåûyªû€[‡Mx|Õ'E©9™é)iïÿ(A*Sn Z×¹±0øI²ÚæIå¥ãW\¼šŠeŠâFKI‰¾äçæÖ²µ»¶m<\þ:r“ª¥$ïmdŸ–Î-Û´mëßÚÍ¥Õõøìâu±”•e,ÞѳqËvíÚ6ñrôÛÖ–tÛ£‘»£mƒYL©1!dë»V?LË qvoÚ±c× Ë‰¿Õ­q£æ~mÚµõ÷rqžµùCT>×µ¯×¨Y¯b‡!ä—N­êºŒ’’{ùϺÖm²ôô"öMihßü-!@HΛû½›95÷kÓ陸˪ãw)ÁÕLòuä†%Õ­u$–çdƒaž¹˜ÌoòcO9û®ÙK߆tò+c\cæ_A»·¬nê\ëȲ137‡B(6ý¾_»añJ“.#~Ûºim/É?vÈWw—äÃzt<×yø¯{÷îÙÍ÷eHP—®‹EAÏÐÀÐШÌxx"‰Ž&“Ø&`V†îÝ{õ&$÷n×Þã3Äúã¬Þ»#¨ƒ¯õ•¿ ûm—›XK·”¿IC[[WGš]7®š¡YPÐÀ³ÏªÀy†ÒÔM¨Qkê’u{¶­mj[kÿÒÑS¶_Çs¤,çËwx€oã&I2&yÿÈFn.±Ù,¥,¥ôðÒ±N~£•”ÛÖ˯¥”Rù”f|}›æ3,eUf¿þ¯½«S» ¥”YúƒW£¦ÇR(Ërôøx?__߇žSJï®íáî¶ÿnfñwŸ[ìåí»ò)KYʲlq‘Ø÷ ¹k„—¯·÷ÌSi”ª¾»°k+/÷ÙLqn›gu÷pó‹”SJé¦έÚVÏa^¯ÎNM&ª®âÛ;:NøýŠVð‰©M™_JfdeÞA¤«/R2¬F£AƒÔO›ggJ´u1¸‚”¢²¶h€êÖ5M÷-7AÚÆÏ¿T—€ˆuT“±Ñ¯ä*ÿ4X¸óŠR`×Ö]üúw“'GMÜt§ø+#¯(îÞ ñµæ¿Ú¿óf ­jyvbvËÖíŽgò”·îæ½bR2°–@¿éz¢¬¸$kÖm%B‹í U.6»¸÷›’[vnÕÇ8CöÕÙ©ENw˜?¸[S¯®o‚Zƒ •Ù»¡,Ã(•Åí|r·–]“ ½üí5¹W;Ë*• 7láÚºc[«Á½Ûtôjâc©%½û6cø²­F”RÏ“›î9¶y\Ï+¶5 4’b=˪o"ˆæFO6Cÿh|ºÍʉ—Ü<íëUûøÞµ»Oôì{÷ªÁÔHï&>Ïór\Š¬£Ïÿˆ,RÚwýŽÍÍ{LèâéëSÏîݸöäUfÛ‰Z€mãÚŠ©ãWŸZ1¦}ÞÛû“ÆÕ A®ÞCâee¾–’ÿÚ±ºiŸÎÍ;zxyÖ7EÝŽxôø媔t˜'•úú{¹©½„@ÂËèÔ\…Y­†Õôê&”RB˜g+„: ­ëðË:§á_:KAPnA£ù!‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ Ê ‚ Ê ‚ (7‚ Ü ‚ Ü ‚rƒ Ê V‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ Ê ‚ Ê ‚ (7‚ Ü ‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ò ÉMvZš‚b!ò5å†R …÷Z¹¶}¬ÄCä3|Lh€(ÈÍÚøëï`¬‡C/A¾–Ü"ëäé’Àj‰Åbˆ±¾ùzƒ)Ñ¡Ð{áá›F´–±X]‚|µÞ ‰Å ò)ú‰ùš½A”APnAPnùÈ #M{ñâEVÑüVòÛ×1±¯UË”Y鋘˜¸„4•eajì‹Yr•eÒ›W¥,ã“Ò¹$eAJì‹ÙE‹ã_ÅľVª, _ÄļIÎä’ù)±±/rŠ,â^ÆÄÆ©,™‚11oS²¸$y^rlì‹œ¢o_¿Œ‰cT–ù/bbÞ¦fsI²Ü¤ØعE–o^½ˆ‰/²Ì{“–Ã%Is’bc_ä1”Òø—/b_ij*ËÜ11‰¹ø,"UZ1žïžïàØòœ~6Y·çxzznˆÎá.'÷iã`Ó⥒RJi^¤‡­S—! ¸¤Ôk¿zzznyQÀ]ŽéÑÊÁ¦eM|mU–šf5xy¸X˜êãË©ÚŠËiAW1‚ U V¢îÈËÌ̺qãï¯ðb±¸Eóæ„|»E?~ü„@(ø‹víÚá` ©|ÌjXxu¡Ë¾3§!×OlNOzóÍ–pßþ?Ï_nëÙê»{$d¹Ò¸[áááØ»A*]=ƒîãgIó¿³b¯\ý–K( mùu5ï»{$²Ó/.T)Y¡ïA”A¾!¹¡¼@ä?Éçù|?껡„JÓ.‡„ç]ßÍ4…ïqâ©âÈåò-[¶°ì»(pmÛ¶­Q£Æ·võm‚ƒ*A*QnÀ†«odƒY ¼ÚM‡ ¨Ã<¿¹ ;7‚Tò`Ê»}g'‹–P<þ¥ Ë'¸ZAJ•JiŸÁ£¹ÿ äÕ¥¿÷½¿c82V‚ •#7E.}Jibà¼ßvŸ¼nÝm梵Pl©äÁ¥”rjËÒ¥ëv1öS÷þØÂŽûëAÊ“J ¡K‡¶Ûù@9xÂ_“úøq«üPk©d¹¡„„-¸ï>³ñøéFÕ€|îJ½CÄ­Œ(©¼[7X2éßµ¤ÜvùJ·T¯•R–¨ãHÕæ#á+C_™ú0ÈzõøqÇ£èo?õ6„Yâ•   »érB!äÜák×lËb Eò†5k÷ å’ Þ\ Ú™©ä.OضvÍöÎRž°aÍÚý'¯qIyq!AAd3Ü剽[×®Ù‘ÇYÊÞ­Y{ðìM.)ûå…   r)wyt×–µkwæspÙë µë_¼Ë%eÄœ[´áq>ç'‡¶o^·vW!g)}´vÝÑ+8ËÔè3ë×o|Z ²<°uÓºu»¥œeaLÐÚuÇã8ËÄǧ֯ßø¬p²²wóÆuï•s–ÑAëÖ¼Zƒü§å 5'£ ëܪ¾ý©3~öªÏ¸“4áÊæÍ›ïf¨©œ;¼kýÚíYÜjAyÒ†uAûŽ…rI…o.mÚ¼)2KuÄÁ©;ׯݞ£²LØðwÐS\Rîë ›6m~£Z·~|ïŽõkw¨Î4Çoü;èÐÙ›ÜUöËó›6m~”§Zxt÷¶ µ;ó¹+髽x‡Kʈ9»iã–¨¢ ‡vn]¿nWÊòÅÆ¿ƒŽ]Žä’R¢ÏlÜ´ùI¡Êrÿö-AëvK9ËÂç׋⒣Nmܸ9º(†ÌÞ­[6¬Û-ã, ¢7®:uã)>‹H•§¼ðZ”‡޸ŸÚóÇÁÔ÷2˜²²qüõȃï1ÞÍïƒõïÑAýy–H$ßÎ&†#GŽn8y÷{Œw“•šôS“þ²ìˆ#>cCùáå Ž>u0õïPk‚¥²ýW-IÉO*Ͳ‚åDÿÚ` AåA”A”APnA¹Aù‡äFµŠAšñàîíGϹèÇAÏ¡üá”vÉø~.?*T(ðµ ÍOý}TgGŒ? HåönÈÅùƒ^M˜ºêÀãÇO¢n_îån¸qñ´‡ ‚=A*y0µéækIÛ)½š6¤ aîñ†µ›üûkˆõ† HeËM¹ÿú+I©È`tZ¹¸R €; ©|¹¡Ôøï#Ç éÚ–.c'ÄI÷®T'§þƒP „§zÓP ”­HÐ @XþW™ O°ôV IDAT(-„„»$Xú56Jð¾Ú«|W1““%W²¤h&ªš÷@#å›ð½¨5ÿÅælNäö1[F8oésqï.%CáãGÓš|nõØA RñGTí^”!lÞ‹3Ç~õÛ8Ìeç/bb^ Tõó)%<’òãîõ·É܅˪Âß äí–UgVüU‰r“Ñ»S›õa1*q¡€‘1Àã ?ýgSõÿ«]RõǪdÒ¿kIK»Ò,Kµ_ZV}›ð„ôįm Ñ€õ‘C×\ÐÍ>¹gÞp"ªÀs©]ß«]WFYÑñùyÁƒÝYRµµæñêVGV/µ X7tÓ½ö}»ß[ß÷À†-„O„Âôýý¥ó¾†@Èÿì 1Û´+ä}JMP$úJR_¾Ü˜T7ÑÛ² (TÞš¤kû.d‹êù øÔ7!D™ñ&_8úþ­Ð°[ªÀLîµÐл^pIŠ¬˜ˆˆˆ·ªÄO"o††ÝRÅfr®…†Þ{üŠK’e>ˆˆH(d¹Ë¨»7BÃnË8KeVDhhäÓ8.©0ýYxDD’T«øáí¡a·UÑ‚•™¡¡÷Ÿ½QEJN‹¸–,SÍzpëzXØg©H {“ Š”œò4<üZŠ\eyóZXøÝ"Ë´ˆ°°G/“8Ëœ¤Çáá×RªXÅ÷®_ ¿«ä,å)aa_§|û òv[rj½VƒúóXÊI£‘ëô“îD%—ÐËbÑTWO¢U×­mWª¤e .}ïÍDO(,[„iUèòò·{nÇÒ€?BÚYQØtéxV#zùÝ[/ž@XÁ—7W‰ô½J,2#|AqM–þÖû­økW.¯üÎóÆõ3ôóBÛ7oé׺Ÿ_«§®±tíµ¤gÏKÄì6mÚ¹)w¹yù܉cf¥pQ†¥/§Œ›´xÕ.)çÙ®iÓ~¾˜¢à.ƒ~Ÿ=q̯iœeáóÉã&ýþ÷.)óñöiÓ~¾œÎp—ký6qÌo™ªhÁO§ŒŸôç¦\RꃭӦN¿¢JƒógM3'[-øÑ”ñ“wœå’înš:õç°U±—Íþeâع¹œeþý)&®ÚÂ%ÅÝÜ0uêÏ×T±‘a鬙“ÆÎSE5λ3e¤µ‡Â¸¤ØðõS¦L¿Y‘sáÌé“Ç/PE5ν9eâ¤õÇo|D«ºˆ÷øåó P–Õí¸î–PéÛ-üY>!„OLõLÏV Yê{çà¢-£œÃnÙ0u¤@L€ÔK“vŒóÞ1Égû„f^d@NøoÛÇùì˜Ô|ÛOÞÛçL ‰Ù3=GÈ»ý÷Ì$)6}÷”æ[òÝ1Ækûx︤œª0È"ìÓ-Z¾k…|R4rF¡íìÝ*êöŨ¿I5Ùëk~MW¢Ìºµ}œÏÁ™M·Ohú(. øù×öOðÙ>¡É¶1Þ»M£B <’x¶ÇÉã!ÛÆzo¼@ ž„ýÎjf^^=¯€ȸ¾kŒÏ¶qÞ[òÞ3ç„$ÿîÂ|·Mjºm\ãcÎó¾òÊrƒ‡€q˳—C\»v7ZdTÛ¿}›Ú¦zŸUWÛa|pðHM= w9kÅŽi ªÏý<‰Í±ógøB1—dà298xŒD_u9wín…Š,Ÿ?Ãi¨z_Ó‚ƒ'HôU¿bÉÆ= %Ñ犦åzüܾX“K2÷qì˜BK•nݧdˆw¥Ýèø¹3‚"ËÚÍ~=~L¡e *öª]”LQžº¾ÇψU?¡ßìãÞÊbËu{1,Ñá,õš?{Z¨¡Å%Ùw˜¢¹R[We¹ñà† giàwüŒw±å· £íß¼ã™sKýïèŠõÍmÚsôrVÊÊ~p€µž§è \{‡d„>¹q˜Ì¨Á{ý®)ä)“ì˜=Ô&èÐå“Ç=Çœ¶±®F̹±vÑo–Ùö^u±¥ÇÈEÕx6Aj8lð̾„@üÖ^w<©]ËýÞ‡•½Jà×Ò DøX Õmëäo|b»~Éóm½ÇÌ7¤„MºÐwEŸÙ‡>tÍaZ»“˦ÚØggkwÖú‡ì iÝ£%!‚̈•}–_ðUÍUÐ&#~Ž8¡ùØß$|šP£ýê<”÷~÷9²û^×îµo;í?Ｉ¾hÖ¡É-^z_©Íû—äFe!–¸µèìÖBÍ÷ôYÝ~žPÛÈH»øRGÏ@íù}ÈRWß@=uK¾HÇèÝèêªYŠÊ±Ô3ø ¥@¬c$þ¥ØH-M ¡k¤ñ.Qßðƒ–B5KBHIK #õ\¾éFB-;/âŸ_˜›–pçÈ-ïìnÐ~é£ÚKm}ºò¿X…rãNJŒ[H„eA`Ö½×ï~º,¹'Ô€¼„W O$ˆk°Ec T·ñŽa­€ÍËIŠ¹ó 6šU ÿ1¡ÊM”ÐcLVTo4ŸP D»†1ÜeùôuVŠBïɱÛÑ,ÉWTÏLºÅç·`4ëŽ ïäžU.ÊW¯¢…­§yP4è1ñɦ-´•úƺÊ!úµ-¬^¿|^·þ¿*7¥‚{ãŒÔ–ŒÈ#©Ú ­,$†ZVþ¬ÛŽ¹±´iÄŽs{Ù}`4Îò…’ý£Âd¢åJ¡”ò´ Xn ¿[§Q{K—¦¦ÚkK=|Š×;ö­X¥Q«e-{ï–†«†ÚðÄV–ÌÃKÜú¹¾ëÜxó(VËÚVÄ0%<B=õ‰`Âd+†Î-Å pjn¯©Ï°DÃøCSÆT‘£ Zšb JÕÛeóY ðHQ«Ö’ˆRe2ò5'1Þ Rá7rÂÙÐ}AXJyð4ß (åñ ù§ Ä&Šô+|B(%%|+¿^…q¡Ñ¡'åÚV-Çý®«A€ÚæÕjY÷˜¤¹wNmqrrRSKêîóÉ[µ ¥»¦ªwK(%„Tp>ñ#§hr‹b@XXÕ& @xVYú¨Ð22àŸ÷îë”_@e(Â磠À#|>0JJ)QÙ+¥ÀUûþ ÿø)šŸ:?[æ)š”RŸðx@YÕÏWå\ôó?P—ENU–·}±8FÁ­])ý-nW Ÿ_¢¥¨ÄS4q0õð¹Ы÷¡ƒàË×.Âi £ä”‡ûmX%°Ê¢‹ò3`K|`•À2@€£ EÿáL8û"Kúoï  8pò_þª&„P%°ì»i¢öó?ô=U…3™¼)οhkVéoq/‹Rø&|7ÅëE¿ö«¸üÿ—Ú”PNeš•È³ôO+À~¤°ÊÍ䣥ýg–ÉF=}~øNº­Mff&|&¾enߺ•§k£kXíÆëX™_En(¥D™º10ðÑWŽäG ›æéèä´!2“wQJ !föªÓd·-àÑÉ_íìJâeÔ¿+ªåÌi ›ó¼oÇñ`h^«ÎÀ…Éá7#Ý_aîiï-> Àéê鉅¥5—/ÒÒÕ)ZÌêêh5êÔǶºŽº°¬ 6áÒµtuußo¾]]‰Zi:¨Ti¬žÖ{cSgÎÿ4nb%ö" áeggSX–þyöõêM‹ÿ7lØýÈH]]ÝÏ[ þ}aZÃR[»2ÙŒÔäÑËÛäÂÀYë r2õŒ«]¿âáéù_¨Ì@n(µwö¦ðá?µ]…žPÌþ0=øò_]áEJÄ= °([¥czÅѺëÏqÐR-ÒOHþ£ííGµ^;bÓ Rñ}_”ñíÐÅÑ싉DÔsЀš°œ>cÆÂ3d•Ú»aAV„–¶ƒft=ÃÔÜðâ™ã¾¾¾U»‘¬ ì1ñ/v=*7[¹jÃhêèo¸™·0hqT¿÷#ïJ$Ô”/LQ ~iô¢àaý äÿÔ0•§spNSæÆ’“Ï2Ô‡TÔª»çßL…ŸÖìuP®wÄM hÙØ<°¶àéß·ò¿å&¦‚BV™ÿ˜’Û²Xy9#ð൚,ËV圣Wne*dï–ÚB” h7hú¤ô Œ.]º„ޜϗJ;lÐ çQ ñ6ü'kQ¿å"/íù½û¥*€T¼WE)߸A,;öu—t¶ PoØM`Ù¹_^ÂJyªþÅGÓ¯ïägâ16ƒ/¿&¢ðPdž“³ ©>s0E¬Ýû®F§›£ZKoïúG‹Fé²c[ü[ ûóâÑé­ÊRÊüA~~êØ‚:ç#6H€¦¼ÊªÛ¬n?‡= ± æ| r¨°&‹'ôYU2F«ß äàÚOÑõü%K ÔyìÅe]þ•?<¥”QÊÛkÄÆÆb3øòÊä Èî%ã_ß>ýô VÈçÈ ¥ðöðŒmWv†ïåÿ+EžÅÚÿ9öY=ã\·³m¬ ÞO¶õðÔ¢ïÆrjÁP*XЖµ¿†P"€²â&”ãú°hà`®¯¡Þ!:Ÿè>áÙyxJh‰‘‹°Ù¿Ò6B²|t{A~âìÙ³wïÞÝ£G† ñxϧ 'sZ{óq?nnÛÙ²eÓ§OÇ:ùd¹!ÊÇÿûóüìý!6z´4E@ öòÏø Ðzþv;ÒfÖÐI¡[J·_¢ùóâE5Ëþ Å·âRÊjj“«dŒë}ŠR({Œ™ÙÙÞôýv[ñJ`y’Ÿ/2/«ñ—Ê$7;ëï)½å»ÍŠJ…ò 'ªê8xµð3w#…\:®YµáC˜˜x³,«T*÷ìÙchh8~üøª÷|Ë劳;ÿ¼wùˆz+•Ê/Y*(+Ì›ºñ¼\”RMm²|twyòÓéS§–ee2Ùܹs]]];uê„sUŸ2˜ÊÍ‘ÁÜ~ÍgS „/ÒÓÓXÐÒe¦F½Gáÿ™A1¥°vë¼6mÇL_ÖŠ_ú/GËþ8ÙÛ_cêDõm „¬¬¬ùóçwéÒ…Ç«RÍcêÔ©;vä©E©ËÍÍݺe ù‚Ÿy-"âîÅ“M:Ä?‹ Ýzpÿ>&-œ†)þkRJïܹ;zôh‘H„*S1¹Ñmu0Ø¥ØÛZððhÏÛ~Ú|¶ý§ÔežkÞE—T5ÂùÀ«ž=¯Y®6þšÝÀ„€Qî}ÇÜxtìÌÉ«Ž®Ëå)M{ТûVãÓ.nÊc¬;ZQ ¤f#C>ÿæãÈÁ-«…¬§„ÀÎ-Ïx` Y±Ÿ¦U¿%¥7û=)„BQNzþ/ݬìÒβ•Ã0ï›1 œ——WÅqõˬ¬,#ccÞ„É”H´´õÇvÔ’'M?X–UÿëpÿÏÎÎ^°`A³fÍZµj…BS¹áIÌk¾[GŸ¨Ï²T¿š©ù'7" „ä?ßùóŠë¦ÿÑ®¦&-™~;†™ô‡ˆôŘ1KlšÏÜ»Lýh:aW¨ßƒ× D·Nî`è»z^ï¾³¶têÿrÔOC[yØPQ…½O¬BVŸÜ"á–ùAý€uWn[vR¿Î-M´ù±w/¯XòÇÓLþ‚aƒU‡ ª¸|ö¼[2ž ˸5mkª#øÚf™´pÍç)cG0 Sªm¨ÿx<Ë2Ø*>Ò[þÙlèÿ†š™5*Ç»zõª®®®‡‡ÖTøMÊÈsrrŸ»JC™j?VÕÞ¢î\¿|G¡ $Îd_½|¥¦LµÁT)ÍÍÍU¨ò'”ò—NlÜyF¯Põ*VJsssÙ÷pì:M=nn·pIà´¡ÜJEïÔ¢gÍ”sc{ö Üüw“Z:”ÒKwIVÌÜxf[ ×éZ ›úçÈ®µŠ²Räæî[µ`O©Á«pyz÷øz”ˆÖ^8¿lúÔí¿ÿ¼y ËÉ‹q]ÏÅ;·ú[I8Uc”…y¹iK&M(=žRä/~ÔÆFû«þ Åä ãXJ†!åîf†Ïçc«(ŸV­Zùùù)Šòµ†R*•J;uê„Z£î© ò݈ç3ÜlLÁb!—mCËÝ}@9ÉÑ/A¤UÛÊJ[4{¼Ï¸¥ö\„`Uôõó§y2]cóz&ê¿ñ#áT' &ïYôË|9˜ZÔ37’üQáG+ô?þÈÏÏÿœŽôïÐõ—C‘ÒïmPÅPdee-_¾œ÷5ÏàþâfffÔÔT ÊË @ñ]P‰(*Þ»!ïýçÓSpŽ–ˆE_N‹*Û¦üÝ÷ Ô5³wR÷6ÑásW¼óí…P¨eeS«Œ»},œ‚º _»­ÃûEþ¨L|´B…BañS[YÈår®³C)U*•VVV䞤ªý‚‹Åb±¸r;q\G†«L®;Ù´iS\^üùƒ©*Ó¡ûlÑü·˜0aB¥ç¹téÒÂÂB‰Dýúõ«_¿þäϯ¡¡1sæÌÊÍ3##cÅŠÜ«ÅÀÀ`Ô¨QB¡>÷Ì”¤ Â0Œ¥¥å°aÃþS/á¯! …jOš½½}÷îݱSƒrƒ”€Çã;ÖÔÔ_Â_ŸÏ×ÒÒš8q¢@ ÀúD¹AJû¦NŠ/áÊÂØØxÚ´iXÉaü)^LŒU Ü òß“›ô·±Ž È'óÑx7d`[ßW…ïÌ93áhX3¬:A*UnâÓ² ÍÙÖÆ^ÊRªo„õ† H%Ë …´;Y2ÆÚÞÖÜ\èXDä (ßwCòÞ.`ôjÖx§58{Š È×xzýµ@Sç‘}Ý]<ºör"2]Å‚T¾Ü\yœCoõœºnÚµoËê…0ot¯ó‰AOå#®âNSgyójzÛW§lÜÜ­Ú7î±aþÊÖkÇaÝ!R™rcåèaÅqÄuzº‰wdFaÅ!R¹ƒ)Åã‡Rr¥êΖ< AJïÝ›42Ûyôù?ú©bÎå?Ùw³°vÏNŸÓ2òB™R¨¡)äI • hJ4y€2RÂjjˆÊ°,,P²¤„¥@¨)ËȤ2¦ØRZXÀP¢©©n)Ò ‹-Eš5K‰¦&)²ä Dœ¥R&•3" ‰€e[ E"5KM‰€H (¶TÈxB±†HŒR&+²¤”J ÙXþë(䲸§1²‚¯ ðxôë„ï"<ž´ð›AȲlvZB|t¤Z¡¡²â.úYa6+B^f*SI¬Ë=Ö`nïaA+NÏž9¼£,ñÁœ_~Ë7sýã—ÖŸñËrî-l5âÄð=—‡7Ѐéƒ;»£8ùäJm>@ÁÃÆný̽ŽoýÒoÎõsö§ƒ¡CêhÀľ®<¢gž\¶àäßmì>¸V³GÖO€äðÙ'^ôÚ !üôc»ëÏøž„T'¹×}°j3|ÿŠqé—n?_™rüFŸ†ums÷•Æ¥'L @N¨¯×›Îcw/±ç~˜þó™[¦;øE%h_y|Έd…øúNtì9eÛÜAðøÄäþsoκp³»@oÿ–1iú¡Qgô @æYß&Ó]ûý²iF/ˆ<<á‹î̽t³‹@ÏVÍãrŒÃžÒ!é'|›ÿÚèóþžØí_o”Ò³'ƒW¬øSý³Û·o³låL |¥òk…^·4ÑýPÔ÷oîÝ8~,8=l}ñ'OŸ<ÍÉÉ©$µ%”e¿’ÜPJGÍcûŠrClÿ¹§þŽ‰‹wy”ðøƶÝϯ¥ùY‡uñĆ–ºBÕðÍÄÌܲ¶BP”fYËÒÌÌ»âkYXZè T–¦ÕÍ-sA  Â'¶¨eYÝTu¢&_ÓÈÂÂBG•fÕÍ-eEQ!yš–––ÕLôT¿Sblia¡]ôsÍÌkÖ¢âw–µ,«©,…Z&:E±%«™×ÌJTW|‰¥e-3C]îJ¤mjii¡]4­^ÓB®¥£ºâiYZZš¨bž‹µM,--´‹ò¬aa¹†*K¾–¥¥¥©¾ö·Ð$!Ö ®]·NýQ[¸p¡R©Äíã_ÎÖmÛÔ/·oßþòåËï¢ä•¢5P‘Ðè%#{SÀÅÅÿ%¾k¹)34ú·Ãw$7ï ?/4úÇP¼ÉAä3Àx7‚üC`ðPä#0 C)ý÷Ê)•Êo¼xßé1;Ÿý<Ür‰”OnnîwZr‰DÂãñ¾M¯ç­¬™©¾ðzzz(7‚|» ïAoInÔ{@ØBäóø˜«˜R äÁ…ÝûÎÜHÍc,mÜÇL¬ÿYËüÁÞM¹²oáà~“VÉt-œm-o¯íÚqŒ‚ìâ ò©”ë*¦/w7þñ÷'‡56åëÏöc[Ì>÷çæXw‚TžÜ¬úÃßO-®‡­ÐP-(¦/=`tÍë[cÝ!òI|ÄwžžY͸¦27úéËB%Õ51¯kï„sç‚T¾ÜÈ Õt^ul2-_Û\“¯HOM³h=áà’A”:‹ù$>â*f6vÿ¶–¿ì¿tþô©3¶Ï²f¶ç¨5‚T²Üð¼‚Úƒ'ulÈ Ÿ¬ÛOê^]ñ4d-V‚ •,7±‰MMP Îòé™™~~mOf¨,‡tiß¼IïÎ2ó‚_Óæ“Vå,û¹U«vg³ '+ý;¶kÑ´og™q¦u³æÓÖŸÆ…ÚH•§Ü™)”Ô=°'°Gßqšœ  UcåÁÝ>ðaý¨<'55µ@©Ò©¬Œ´”…* U¤$§ˆ2UXyNjjJIKÊPU.)É)’,Õ9¬,'%%µ (ØvfzZJ2Ÿ)Ê%5%E?[eÉH³SSSJZŠU±F¨,59Å8»€»RJ³ÕóÌHKKI.d‹î—šœ’™£²Tf§¤¦¥AzZZJªò]ž))™¹ªQ§¼0+UŸ-—ÿKIDATÝ255%»¨3椤dåáø©ú|47åÍæde1 Ð××%ð9“àê¹;]RR¹dÒ¿kI¹Ê©tË’ƒ©–ØÁAþãrƒ òønAPnA¹AA¹AåA”ADnÊ™#ÇésA>•¬»éÔÔåMéC͈R«ÞðXw‚| ¯åíÛ,)ÿݹ¢„ÇKzv3E #‡"RÙ½›Rä=>æÕoÍŽëg…ÍAJíݼƒR ù“GÎì4q¿‹ë A¯'7„ œþ¤V§«ým1P1‚ _Mn(…Œ«K7_³÷n\Fäs¨ØºBÖý¾ZìÓ··­˜j ‚ _In(…ÂÏ?éÝ{E±Aä«É !çWîL¹vof†]A¾î`êøí{ :¶7„/Vž“˜˜˜§P­âÉJKIHLQeåI ©9*KYvbbb~QðÐÌ´ä„ÄFݲ(Ì(#ËNLL*¶ÌHU·”%%$¤eª‚‡*¥Y‰‰IL‘eJrBbj Ë¢€¤ÊBÎRUìô”¤„ÄTVe)MJLHÏÎç’…™‰‰I…E–iÉI‰%-3ŠÂŒÊ 2“¸à¡”Ò´ä¤Ä¤´"ˤĄŒ\ Šü ¥²-ÝמŒ¦”¥_@Ö­ßÜÜÜÖGçp—{µ²mÐô¥’RJiÞ=k»NçqI©¿¸¹¹mzQÀ]Žú¡¹mƒfqœeîMk»n#~ç’®üìêæ¾-NÎ]þ¯cSÛ-J)¥Ùá. ízŽ[Á%½:?ÙÕÕ}×[.öóolgÝ*™»ÊºäbcßgÚß\Ò³Sã]\<ö%«Šýc ;ëÖiœeÆ9û¿må’ãìâq(MeÙ­‰—½&g™~ÒÅÖþ‹öpI·÷tvö Π”R–e;z{:ضÏá,S¸ØÙøë0EªÎœ9奤Ï#S‰Q›Mµø_Ò½¡ŒLÊ3soäm¡%€Â‚<óº6>Mi`r ˆ“›»«C= L¡Œ_ݽ‘wM  ò-êÙú6ñÔ ”É-ä9¹¹»ØÕª,Tk¸7ò6×ä@A~^-+;ßÆžb@•¹…'wg›ZÀ* •bsw/ï òòê4°óiìQd)tv÷p²¶à,Yšî^ÞÕÅÀYÖ³±÷iâ!" Ì•ŠœÝ=­Ì€Q‚ÄÂÃÛÛLŸ—WßÆÁ·‰»PE®TÃÙÃÓ¾nu`ä…DËÒÓÛÛT¨²l`çàÛØMÀYÊ$.îìj›áË©Ú`¬bA¾%ß ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ H•‘ ϼzîtHx$[ü ‚ È'òÑx7dÉ„¾Ç¯EçÊ)áiéèû ˜=xsÀ½š‚Tnï&n÷Ä#aQ#~ßsïÁƒwoÌèázjÓœ ™{8‚T²Üì;'ùölfE(Pž¨óÀ*Í={&û6‚T²Ü¸Õð¥  „¤Ç¾`yü:v¦Xq‚|*ånѤHÎÜaνÑìÑ©¥ ÿmðÁ“ö½¦Nì‡ ȧRž«˜` ¾|xÿ¾@šš­”ëk%!‚T’ÜBö 8’`pìÊåšb€Ì‡‡;˜™¢¬¾r˜3Ö‚ ŸDù¾›ü›o³ý&Íâ´ ~ì*~|9+AÊ•"“*¹ÑP R%ä“×"«{ˆ¸0‚j#¶w K&ý»–´d±+Ͳähµ„%>ŽÈYn4,Œ¯.ú5*µ°ñ;7<¦ =úêÚbBˆ<-288øY¶‚B¹yùÌ¡C§ó(¢Ì8vèðù°û\’,õnppðó\†»¼rúСÓùœ¥"-øÐዸ¤Âä;ÁÁÁ±y,w~áÔáÃg T–)Á‡_ºñ„KÊK¸u4øØ‹Ê]†ž;yøðY)g)O >tøòíh.)çÍÍ£ÁÇ^®Ø—Ïœ8|øœLe™|øðÕ{1œefÜõ£G½–ª,CN?|伜³”½ >|8ìÁKÎ2ýåµ£GÅË'+N;rä‚‚³”Æ>‡‡"UŸrâ³”fôïØÜÛËÓÍÍÍÍÝÝÛ§q÷Q‹ègIϺ3ß××gÓ³\îrÚ€ö®Ž­_©B£ß÷vrë>|1—”v}Žï¶—…Üåø^m]ýãU¡Ño{;»Œý‹KJ åãã»+^}T÷Ö®Žm¹ã9×¼ÝúMYÃ%½™îíÓx¯*l:Ò©•›SûUõ«^.nƒ~ÙÈ%=?3ÕÛ»ñÁU±û·káæÜ1³Ì¼èåâ>tþ.)êØD/¯&G‹B£ø5sw霥 ~ÚÛÕ}Ôû¹¤»Çyy59‘© þCó&®Ýr9Ë´cÞnîcWøÙH•çc±Š)Bržœºx]©iæß±½±ÆçLKQúî¨_îŽE—€gX2éßµ¤Ü*J·,9˜*a‰¤jSÐ蔂Z3À)pA¾šÜ ‚|}W1‚ Ê ‚ (7‚ (7‚ Ü ‚rS´zXñúEL|r6€j+‚ ȧ"ø˜Ö3[Ì]¹7GN¨Q=ŸåkW¹™k.HC¤{7È£-~]}Ü̲QQ·B¸j&þ4th!ÁXÅ‚|2Yæ×£CÓ,‡É–táv=“¼G>û5snI73¬;A*­w-Ï“µh^·ñG§acˆ¿p+AÊ•=‘Hpûq¨6Ž(ÞÜOf¼ÅŠC¤råºØZ&í™zàV¼\.—Ër–Œ“¯«¡deXq‚|*åûn(™Ý¿sÈ«L–aÈÿÛ»÷ ¨®;àç,o¡ŽSÄ':iGkDØÍ„e£©M5MÕ´šLkÒ‡í¤ÍÄió˜N[Û™:kÜ5 $¦±IŒ©F«á±㣠ê0B$wï½¼Ë"‚ˆÀ¾Ø÷rûǹW—F›–Ð:“|?yöüæzç ~9w÷ø[…"Sû䃎½'ÓÖUýÍ€µ€)Œ"Š„©™¥T¡üz…Ö£zöà_žÁÚÀT>L]þèÜY®_¡PÄÅÅ)¨‚\·6xã¬Ú€…€)Ž{é¿ýÅ&GPÚçÜõJ\úÒ­fMâÜMtì*ÏóCþ(öv¶Ø¸– »Ð¸O°qmö~6ñ^åyþF`œ -6®5$JWl¶öžkl*ìéãyaXº ±·7Û¸Ö°Tél¶ŽÞA6t_áyaXº énk²qmr¥Gà¸Î+Cl*àêåya$,ÝvWKÇ·EXeÄ-p\×ÕlÊ?êàyaT®ìl8¾]®t ×Ý?¦ÆFzx^pF؆Qìh8¾=*U:Žë¹6ŠŸEøâûŒ^ÅÑk®¼ÿ[¯ûé¦M?\¿F¥Ì?ôÉð¤Z‹ÎK/jµÚ½r¯â-›Öäe¯–{[ rÔ?½CîU\¤Õj÷˽Š_xâ;yÙ˽Š?Öä¨7>[,÷*ÞZ }àïr¯âÍ­V)‘ú»ë59êÿîM©WqÍ ø@îUüÔ£ßV)×H½Šç4¹êŸýé]¹Wñï5Ë+¥ÛþÉ#+Õ9ëä^ŧ5yê_¾x€M U¿Ñh–[ä^ÅW=¨ÎýÞÍ^Åš<õær¯âŠçóóWT˽Š[¹â¾¼õn¹W±Fußs»*ÑȾ콊E‘Œ Õ¯®³Ùç-½íwW-LO\ÿЈ·W虳D9'%ŽboF½b–Z™L ‰z­¶öįdd-^@ »MÝ£sïÍ™¬ „tµð.Y¦V&QB¢«­#iú¬¥‹2 !!WO³Ý9oiά$!¤£™÷øi¶:;‘q[¹ÎäsîýúïÂìÜôx"Šb Ï# 9ª¬8JHxØÊ÷¦Í^¸h~:~ùÁ—ú­bò©®æhß ÿ«¸ø¼U €¸Ä â7€¸‘ÉŸ_Å~Œ%Þ®àsÅHiøDiùðø­8„Ðà˜³¶òðž}‡»¯»DDü[ŸyîF:BäÞWÿh©õŒ2AzñºíÀ÷µ'9)AAI8NÑ<²ø :¹Ç€Ý(Ò¨ôÔáW×l~'5Iqs¯Cü?ý×´{ž”FÁ>S…ñìÅ66é9o6é–¿RôdõcÙ1黂S…ñÜåN65Ô]g2YzäÊãG,¦òãÒ³hÀn6ëx;~á ï?k*ŠDúÝ{ë?)°?µ~R?à¥ßÔ¦ÄVÝîa*¶á1ÛܼÌÍ‹Nœº»•"[œ)¯œø05¡@ÜÜ­÷n7€¸Ä â7ˆ@ÜâqˆÄ nq€¸Ä â7€¸@Üâqˆ@Ü nqð_ù'ѽMˆ¯©IEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/grouping_tree.png0000644000000000000000000006302113051004444023756 00000000000000‰PNG  IHDR7¶ N0sRGB®Îé pHYsÄÄ•+tIMEÚ -$X7³ IDATxÚìÝw@MýðÏ÷®ö.••Mh(+3£ì Y½÷cƃ½C! %›BÑ2Ú‘’´çíÞûýýq+IˆŸq«Ïëç©ãÜs¿gô}ŸÏ9ß{.¡”B!$’¸ BaJ!„B˜R!„0¥B!L)„B˜R!„¦B!„)…BS !„”B!„)…BaJ!„B˜R!„0¥B!L)„B˜R!„¦B!„)…h÷õõÅ퀦ª‡(¥•ÿ­£òòò>~üˆ»á.À”Bõ!dïÞ½„Üqìر£Nï//¯„„„:½ víÚÕ0ÿ 0¥PðæÍÜWJJJnfffqq1þ`J!„B˜R!„0¥B¨!(“P'Ç&T¶½Þ¬À”B5t„¯+¥W'Ç&¢;s$»­ÿÿVTĜȥ¦B¢q2\GOåëMPÕÙñsì&f“wø[ Ûºyë žÈmL)„þvÿ((4QTöM+ª¡›¤¢{=‡Vk(ýjã¿ú¢š^Y}A”ÒÏ.jÑÚ¶¨Öµ“|ž¯¯*¾õ*ú韭— ¯Å^¦_4†m`³…¥´††Õ¼[(Ô4'€lîûVµ‰5·öË%SZþÔB¨ž`s8Œ¯œß®2Ó[à(Z'ú”R€»{—¶T—a2™òM[ÿw!–ê5¸Ñ¼Gû·Ñ „(kwtòŽý¼ß¢äɹ-U¥ÄÅX†ƒæ ë ¹ïÖBˆçr]ËÁ½[©’‡ !ç6Ïj®,Á`‹5mcî^H€äxŒ’è·‡@™‘lù¦”Þ±Ó¼{UGMBˆB³¶kÏD×>Ì) tñø~²lSBnÌ‚}L6Î÷•[zîDo5Bˆj‹Îûn&~Ù;“Â7¶ýº° SLIçÀÅbMgÃev³‘{š·T&F'ë¦6Sg°8šízžŽ,!@3Ý,¥‡/_…´G Å–\B®k<눳e»&„%­öŽ_~w".ïê ¥Ì`s$UtgîBxf“N«!¤(Õ®6aŠ)jï÷Ü!Þd*!„d±UÛÝß=^UMÉ0²\”Mâp–žšŒ¸„¸˜œÆˆÕ—!ë¼’cŽmßÕ3fœì/;ìTykS%!Å·†7seňDÁš’ýüR¶M™ââRÊÚS¶^%)Þ:¡¿¢SœAôŒúGe”ü’뇘R¨îžâ=¾séСC'/\/ö:™Á.ñsœŸá@¤¿ÏaçCç|Êj†í÷x(ÈO:ììV/‚n=|ÈÕýj6¯üÄ07â±»Éå É~µçøExyñPH<¸røàÁ‹¾OkSúP P”~ñô±Ã.®1ée•”“qêØáÃG‡ÆfÐ7׎>/„8/Ÿ‡Ï¿Òåó± ×ËÏvKsv)á—7Ïÿ²óƒ×EÜœ7‡_†üx·£GŽœtW øÎY0!>ÎßtÔÑ7Ïç?Ú9jßš‰„%.urÖÚÎFSJom²qæ°ô*éJ))õé9Óc÷£Ì’RÞ¡áÜà”l1&¶”³ƒc§ö/ ý§øáºi;‚OGæ ÊJ/­0_1¸s>Ÿ–¸”»âÝÒRR€).íñ說C(¥ì÷-’ȯm˜Býÿív*Z)¦PÀ/Îí’÷$CB XâR.SV/òŠ£”z­èµâŸQ™Ÿ/’rdþ€8•1e”_špqÙN¦‚4p¤•øgީࢇãòý–Í;éù²HÀãºÍï´h°I)!„%!-QQ§¦´”$0Å¥Ýæ­çA)õs¹uŽuêwÎGøËæ®}4JPÆ}{k­§ƒu.—CLB‚Çô¥8ªŒòK3y­ØÅP¾—DÑÛ•‰ƒÞ§§ó‰ìW‡ÏúfB¦ÙžNAY%Å%¥±g"wÛæ€Ã½\þɈБj„°Å¥ÄÙÕZ LñÒ‹ö¼þÛrß]€¢×Ý»M½×Ÿ_R’áölÿè½wRßÜ8²å1?±˜_" “ތ߀`J¡y‰ŒçifV w‡>yêy`©r‡¹¥@ ýîûG˜w»x;€x-ë=`ö¶Ðð0‡ñí­üìoŸRBrGê8»ö8è–µ¾ê¦uë’r¸ðþÞú}‡F™yÞ~ ¸é0°›Ýê‡Ã½¬ÕnÝï=!tÐÑ3¶|1™‘+6€§Gv¯ìoûï¡àà S,ÌgûNWC)áÆëël>y-øáÍQ]5?0ð_ŸÖk3ðòýßË;·òË& Žx™TÀd±ªm‚àC“Û]~líøž‹w­?.û6®ßÊ–“¡/óJ3««´:î}7$ðΨ®^/Z’å°~SQEJ]=¾îjdaifüºu5šöõ¹sn—––qTùÞå>/>úYzVaëQë>¼ ž5K:0ª5´[k/•°Ê·èíó§áááááaiy‚Û>Ûô™h©+N)trDO•Yq-§Ñöß±æ-%9Ì›|ú®ÛjÞ˜”v±[®Ç˹œÊýÚÖ¼yŠ‰5²h†rÖòÙµ½ZÉ/Yì–âtv¥”.ÙèPZ(<·Ù±ÇëIP“ÉŽ6¬¨ue”_ðôIxxxøãˆx€X§“y{Ý–P ”Ñøô²®\ ezF«GëH°™[®vÚÓµ(5Ÿ¼R+?Í+Cðµ¦Hßm×I €¶µb’ìÛ· ¾Ùr0è›—Q©r;ÙøøNžS¹m·œÈÙwv¥@‰úéeÆå à3ßc@Ô45y%\PîNi†•»¤07µP\L¬¬”E%eßzûBŽí¦i}e$8¯ý®ç·0 ^›«8¢kŸ€ûƒW’›[Ìÿ÷f̳ –¿äJ5 »_iJË[¬›‘üîÇo¡¿þ7® Ÿó>ce¿ÈÄñ}v‘ôúÓW n[þ/EI©²õ+¦n¬ü¼Š‰+–¿Ee•Ï»}hÉØ¥'%)É+6Êã×6Í:p ýãÛ²Œ×¶ö„Ëc°X Aµï¼SãCg±LKKWlo}ñüá6ª’XK¡†I±k÷¦ËÌZ;½œÅ“ò¾qUUŠ ÅêÃl´²bÎ2e‡*°¡´yHÎÛÁò¥¬Í-,,,z÷xÃõ 9`% E 6»¼,Q<^ ðím*èÐ\š@(€Åè)o"<¾Ñ ƒµÛÄPí³ ýûSW³¾}¥Ã'1aƘA”S1T¡¨`u»W{§÷›¼&øeZß­W÷ŽÔ¨ú’„€Óæ½,,,,úM9 )§_õkÉBÄVüÛª¢Â);°/dòcltì+윔Íh÷þÁÝܯ¶‡))5B 0e°eðó'ß©f¯ÖkvpTÌÛ÷YQî3ç ï÷‚H Iª¼$ûây–šžú¿7‚CCBBžÍì×XJ^£ðm4P PTXR%7Ê/©ŠI¾xŸ@(¥%ÏÒ˜újœO£ÊJŠ+*UòæIJåÛEGfª¨Ö¶g°FlnqùÕÓœwiŒòž:!0¡b™‚×/rÔô”™Ò†„†„„<Ø,Y…‚Œ¤òá$ãy eTÙÕå« ž[± …ïYújìòÖPnQ1©xUrXrå*ÄDg©ë7úvËeZ[DE§¼ûöØyûô÷ßW º‘TR(üPÙ°1)ÀøZ÷ÎŒõÙc·ÿYjAvrB\ÄãGâe5Wœ ´°¨²µ•« '£(Õ´khhXXhhXX˜ï«§ŒðyƒWŸŒŒ‰ý¿Å(¥K‡ Å_;¦ª‹÷¥ÀÉëeè•ýë4n¬£Û9³„°%„3”å)¥Ïþ°€³äô5////o“¦œn‡#@(£ò]ÅøŹÀ¨œ,!&Îå×ôW\1ƒœÄ§k8òE9ßyd\¿LŒ#@¦PP±ÿ]rôXƒÒ™ƒÚ7ÑÔYv÷³ëWšÆ£¯]ñòòòòÜ3òÒËÄeXŸÞQºrÓpØb@øe% ¦ŒXe+ťŸù¥ðµU „0*:Y ‰²¢²ïìƒÂ»:ÊM£òšt0aqy‹ˆž“Ã2(!$=ðØžôŽVrUߪO/«Ð€s‰ (`å«4Þ—ÍùwA—K+Ö$R „d³2јLŽ;7ø~¸yÚIêóÁ= ½y¯Oï}-<5ËìÛVãÜ3î½# [÷±Î3xHRVúKùaJ¡º‡=<~¹t›^»Ýnæ|HhÎK¿ŸYu9½îÅ奔˜ÓYcï "!#+#####Ëh¥ªú"(%”ÿÇ«~Û@²‰9ƒ†–¥”DGÜVoÔYxÎËã•'eòËd‡)œÿÙþ ´üŒøÇžI/o¯B;Í[Ï —Ã/ÎJ"¬#ó¼£K&,uzŸqg¿•û´yüªý*[¬|¤Å@ßRõÃõè¢ò 8¾'Cµ^„©lÑ(ïÀÕågôoo…•é™Vœ¦3ˆ°‚ ‰1åß'Â+.M¡€RwEê´hò­³î¿lX-Ö­[©köè¿ê`€Ö VØwj¤¯ßR¯ÏÒ¥.—´ªŒF&@L&_[ÕÉ@¾q+ƒ–mv*hIqØàçåñ„óÈ=ì€,=÷ˆs{ŠVKmuù) {– (-Ê-(æ WAy”ÛNÐSnÚÊ e[ëmû}%€ÊZêÊðÖÑmÕJ[ýléÀ¢´ò#¶ÕÜå3Œéë·lÑ}î¼C—u¿sC°ýöcôµjÝZ³±v3›Í½Ô%eEÅù%°ð\ ¤ïÔæ- ´Õå'ÌïÉ%^QN^å" rK¸Ü®#¦é$œoѦCû6-‡yiéjÉÙô˜È¥vZYc :žK£rÖG: .j·he ¥v™Z¤}(+,)?Ó¡ bòôÚêyídõ[µn¢ÐDo¡÷4Si‹IËÚ¤_QkÞ¢µžBoדwIÿ¢ÓR„DÝ’%K>Ÿß¯ gȬ­¡OŸy¹8¨)HG~(¡Q Å,J)PZV0¤™¬Å„õAáOö.)£;°RAå«”¦^o"©2ǹð_»nMÕÕ¦äÓç[Agjù üÒ)må» ž{?ôÉ™m ”¤›^O§”Ò¼G •ÕÚyDÇ<ºhÖIS½í@JéÙþ**râŽ=º;kp{ÎvÕÚïççwþüùOï/ ¼—'T$Ôæo9pö‡^K ¿´bŸÙfÚö;'(Ìÿêhãf†‹ü”®éÝqøF·9yÕ–¹¬Ÿ~ë¾SýBŸ¸9ÍR3ÐQp†R:ȨÑQß á ©·Ë)éí¹p'ì× ¶}¢”ÒÒ÷ÚRJ#ÖžŠO|½q‚Y£¦jK<2òbï+5RSï:ìʽÀs»6‘’:œSuƒQJçÍ›WõW@@)ÍÍx—™_*œæ3¢¹Å‰hÊÏ‹ûXPF«-‚ÒŒWA§|ùÙ©q‰©”ÒnÍÅo$ò¨@P¹[*—\øñ]l\B~™p‚@ PZ–û&ãÓvðÔÎt×}J‹ââ2òJ¿|»ªŽ=ýù(¥é) o>TNô¬ny>‘–åÆÇÆeñkZf©÷çxMŠýPH“÷i>ݵê‘U¹ ùRcã x”RAÅ»q“ãcßfTÎ~ݦEÏ#áTP—™Ïýö*,\¸PøCqvZll\ZVaùÁTÑ°+Gœã49>6£¦°ÖüÇåÓ ¼aIñ±oÞçQJËrßǧd(”ÆÆÆ–ï“Ò¤øØÔÊÖ Uw}ù¢¸¹ñ±±é9¥û‰RJß%'Ä%$•ÐÏ[÷ÀѨ^ñéswo¯ßæ¼lÁ ¥f­÷ÝŒk«,‚îsóËOÚYRWâ£7ý»~õâEª- Üß(I…·²+Ðx`äãÓËþÛ¿ÌWbâÿ;ciTº9Ì3(_á¸DÆïX³vÓò…2M[ ¨J)Ó[ç-sq˜-®Þjÿ…Û·}‚…Kì~úI»G;V­>ß¼Ý(÷U”Òo ó#zÞ`o9è¾Ê9`ªóäÜðæRL­ýw7oYíæ´ªˆ%k6Æñü‚^0sõÔé›:5RÙ2µ_Õkž[o=ÓZ»Ðqùâ–½Æ>tˆï{«1Øý³D_KR8Gãn‹}ˆí:½Ã«ˆmòÏ.‡y£(¥„ÓèiàáEOLþç|¿É;®ØDä6“ ,eï¥=¶n[[$ÑxÓ•p{#9úÍAĵ“UÑU©VÅ €!­­#]å6Í'òâÅËmF¾X·¹³–ܱÕ;ÓôVZ4gV¾©²dIEu]Ūo¬fÚº_  -ßî;·Ö„÷šj}9DX²Úº²_Y&§ðù‰îÝ %Y+W?ÜåLøQ°j« ­ÜXW¹båƒØ5¯‘Òþ‘U—WÓ­2¨²aÅ/Nv7}´y#ÛsåÊÛüœA8œãÓê’*ïB4+Ã’m¤-\]–¤®®vå5«¶¶òf !Ÿ–Ç®²¡*fPo¦_¶k)ÔÀj©Og…_#øæÌO.í7o_y]{UUY?£ô›Ëøt"YÃbÏöW±öJýÆÛU«¥¾X”àËIŸN‚k^lî°n&÷ÓÊO¢tR\˜÷ÍmP­bùlŽ¼Ø{ªÚmy‚š_Xc-Uã&¼}Ö÷’¿½SʲbÖ-ž9iÒäM‡. j±¿!òÀâUW£j9óµTÍ Ú<ÕñQú·æ(¥¾§vLž4iÊÜ“K¾]}ûížìšëp'®–sWÖRßh˜ßé“'Mš2gE@bÑÿÑ0Ñ‚µª›·¦¾w’F¾13¥þ™'gØ]¥ÑŽšR¯Óù .>Rá|sŸN$kX,å•ñè´í‹E‘šÎ¬Œÿ=b\‹¯÷øE½ÇeCÿÈÛu\°·ã/ý‹è5na¯qÿÃD ¦jˆG©Æ…ð„j#~îOšRjw7ÛNøìœ?õ#0ÌÁu¸ÃgíøÉw§TV·×Çäx\ Ñ„cü–bÿ×Y'ùüzýŸ[…¯—f?ºx< L)„BS !„¦B!„)…BS !„”B!„0¥BaJ!„B˜R!„0¥B!L)„BS !„¦B!„)…BS !„”B!„0¥BaJ!„B˜R!„0¥B!L)„BS !„D¥´ò'ܘR!$Z!E/w+êÌå‚[S !„D1©˜Lì¿…›!„þJW<.>x)¯k4µ˜‡ÿÛ8bÅâ».ãsøFƒ'õi«B)%Xca-…B¸xººyLG›µ©ÙÙ/mѲ»˜Ž¶43½ð$åCb¤­±îÞà,Œ(¬¥BèÏK\ãè}ðQÁĶL d[&[¡=°Y9­G9±l ¬´šÞfȨÉï}¥€I…µBýA1nQÒV6íX@LßfG(¯¸¨ïð@((Y¬gG}ÈçcDaJ!„ПUZ*àHV^¿bˆË—ÿD)‹¥ƒ"àðtL)„úÃÚnöÎû~vù‡¥ž=% Lq±ˆ{‘”({½Œ+//÷b>ÁmB¿Rå½ÒÒR11±*Ý­ñT+­)½9n^"ˆ¾8ÿ 0UKÒyå0 þîN kVl0Ùx_‰ý“o-ÜÝÝŒ?Z~HHHXYYaJ!„PH¦¬¬,OOÏk×®%&&†††V›g•§ŸÖ®mž·+è™?I ¸å€ ,?§·_̉­3Àþ¿3óíÛüôHtBˆ¦¦æ"Èáp°–B!Ñ §ÒÒÒ€€€Û·o{xx$%% ÿ)))é³B €TÖnáF»…å¯h§À òší·:Ÿ­XäÏXŠÒ­[·z¶‘1¥Bè'BÆïææVmú­[·455k|Ág¡ÜR^•ÑøY©êpôBý|-uøðájgϞݯ_¿Z/M‡©ã >L)„ú $%%+UVVÞ·o­õ“Î+*', 0¥BèWR„kkksss`±X©©©„¼l÷ á})„ú™|zõêÕ’%KŽ;¦ªªjjjªªªúòåËß=à S !„Ð÷#ÊÎήgÏžW¯^^ÜkÔ¨Q\\œŽŽ>ÎS !„þf>…„„lß¾ýСC**Ÿ}ņŽŽà=L)„ú[Áºuë!žžžÂ 3 S !„DBBBÂÈ‘#>|(!!ù„)…BŸð‚ŸÏŸ7o^—.]žtìbú4,°ZPBÆ÷‡Ûù»CS !„ª Þºuëþýû›4i"‚Íc0³Ž¶7ìZ5¨!jjjõl_`J!„ÐgfÍšÕ¢E //¯Ú?èèçÊ5ÿÀÐ2.·Vs’þ!ÛÏ?PÀç³Ùì·©©Y0çhhgcóà‡÷˜Lf=Í)…BŸ> µbÅŠË—/ËÉÉÁo¾ÄÇçóg-u04Öîûã%[ 8õ ‘¡@›™Û󸳘[ôypç:›Í®¯A…)…BÀçó7oÞÌd2ýüü~k UU3Ý6&–¶TðóKàÓé‡îöì×7À÷&ƒÁ¨—A…)…jè%TBBBÿþýcccëÜgu !¥EôŸ}wL»÷yô ^î#|&:B¨AGÔرcýýýccc¡n~VWøö"*!àó1¥Bèï… @æ‹ëÃûv321]s¤¨YÄŽ>Mr²“‡vé1oË'‰wFt’ä1Ý 6%Ô!Clll|}}ÿâU>Âd±8PËûR„@e’R <.1IòŸ]÷G7ÎËË+Ô×ýŽ)…ªÍg0’’’ªNqsssss€Ù³gïرCLL¬jDñsâ—O»çbˆrÛ®Nf@€Б#½ê–ÛÆqöQÜ¡s¶Ù9W(Ôßï‹Â”BÕÙÙÙJJJÕ&¶mÛvçο¼âY½zµ®®î/_ÿ´´´Ê_¥¥¥õõõwîÜinnþe¦NfñZ}—&ÜÒ7Gì@U“5sú¡àä<Fº¥~çöE:±‡-ñØøt*€›!ô·(((¸¸¸T›ô;Æé•––þŽU6•Á`FDDäç燅…™™™}9#äz] ;~v#¥ ¦ÝÿÖj=áJRnÑ’®:,Jj—)òšžQ‚‡¦BHPJ§L™RõS¨¯_¿–’’ªCŸj²°°xýúuqqñãÇÛµkWQ6}Ù~q!YÍ{ê“ò‹yMúX3(¯”ߢ“:PB(°dZ±Xܼâ2<6*á?„Ð_süøñ   „„MMM8wî\‹-þâ`"e…Ÿ¢­EñGAAM,3<@€p?¼¢DLÈ~Ïu%@ETÀg³˜xl`-…úË ЬY3—fÍš]ºt©oß¾666u(¢ªÖLµh3íÉƲÛ=^Á¬™W„ÿÀ”>uø( ~ŽöyVª2 燵Bèï„'NÜ»wïÆÂÎRjee5lØ°ºQ?¼î ³oß½lÛß;ÖŸŸò¸ù)…§3€_FÅ’Üšt¼ÔFúÃýh¾OŒ¯xÝÜ­˜R¡:///oþüù#FŒ8uêTåU2"üRôßù™Ü¼¼¼äääÖ­[ÿÍ hkë¥r'ûú…*tk¯) [€/(-Z|>È0-øi*ßÇ¢€Öfp}MÁâÅ‹ÿðÓfåääÖ¬YƒµB¨Î—P·nÝÚ°aÃÇÿü×ã*((¬\¹RCC£}ûö1§p”, ¬6½¬TõèWæÙOb0»víªgµÞ—Bý Ý»w—‘‘yøð!üçñù|]»v½zõJÔ¶Œ¤Œ,«Ž_æü­;S !ôO±àÚµk¶¶¶þþþ¦¦¦ñå\.×ÕÕõèÑ£ ¢óÜtJ™>±©âh L)„Ðß8ÅnÙ²e“&MÜÝÝÿüU¾Ssûöí§NJLL™MTþnUtÆ— ƒÊÑÑqÇŽÑÑѸ³DŽñCý²ŠröìÙ+W®xzzŠìwæ ƒÊÙÙÙÆÆfÙ²e:uÂ}‡µB¨žçäää >\UUUxJ”?Ÿ+l›»»û¦M›ž>}Š{S !TŸB|éÒ¥Þ½{ƒ(]âû¶‹/îر#&&w"¦B¨~VQ|>ßØØXIIéÑ£Gu(Ÿ*ÛïæævøðḸ8‘½D‰)…B?ÉÝÝ}ܸqþþþzzzu±—Þ£Ú³gpx:¦B¨ž”PУG¦M›ž;wŽÍf×¹*ªZPý÷ß®®®ñññ¸sE ŽñCýX>B:}ç·SwóéË š?þôéÓ[µj…;k)„PTXX8nܸfÍš0¥Bõ/''ÿ+ÝjáÜî½á&ªEØB)ݸqãéÓ§pƒ`J!„þŸÿªÓååý¢8JŽˆâKVþŠ¾TÎÎÎ/^¼À ‚)…úÙˆ®œl)ASF}³/“E€û1¶w‹Ã”j4aã%Bȶ>Ã$ÙöºúGc ε»ÿ?¨¶mÛæääôìÙ3Ü ˜R¡ŸèIáÆRS·Hé·”òó_¿»àš')Î8dÝ-Ùp“€Çå§y‡:Ž9Kï¾í\\v"öåÔR"UK‰ra' ª'NlÚ´)<<7L)„ÐõðP–¶Ð%cïíóJ@)•>¶~Q²‹XB2²ó¨¬É‹¢2[(à”–w¾¢ÐúwïÞÙÙÙÅÇÇ—––Šlb ·•‡‡‡““SDDs˜R¡èB¡87M\ÊHVØhÙQ…WÆX}/Œyqa=E9õ%.÷D´b0Î;×¢E qqq[[ÛŒŒ >Ÿ/²quþüùýû÷¿|ù;L)„ÐWJ'J?ïÁ)p$ÊJK Jácbƒ lÙâã“’Óâ}ÃvŒXxàÑÿ_OürL&³ògwwwUUU ‰þýû§¤¤/µ}¹îßš¿þƒbÕÞïèѣ‡Òâð“?Ÿ6‹PÉ'BH~~¾§§çäÉ“?ÕRâMWÛßwë_ °gý¶› ÅærMÍï¤;vå°”[ê©ä—ÿͳ?-­öï½xñâÊBçW),,¬6…Çãݾ}{À€§OŸ644¬ºþ„¤Ûvìv#>ƒEù2Mô®†´VàôW×h÷Ï@×ý¥%|ŸààVÒL€ß’©ÂàܲeËÿý7vìX<,1¥Bå‰òöíÛ±cÇðx¼ªCLñ »ÐªU3ýsÊ$C¥ï´¦9g¸ qâÌÜÖæ 7;´¼” ™žÁóðZkdÏ2ëépáú8-ÉjC›6mvìØñËW-33ÓÅÅ¥ò×îÝ»/^¼ØÔÔTYY¹z”òøàæGúæ<= -µ'Žù·«”lßSùÔì<<—tëÑíßÔˆíœß¶/„AµvíÚ•+WN˜0AOOOL)„z>½|ùréÒ¥×®]€ &T½J(KZÛ7¥$6úW¢qkF°w=P ƒJ³gD¼LåÈ©è4J)em‹Î³}úJ[Cü'Zò;V°¬¬ ,,,Æ7|øpYYÙªïU­ÚST’ùðòÑዾÖý{Ϻž0 €ò‹ m–®çPJ cä÷¥§:&çnk!÷džƒÊÑÑqúôé³fÍ>•aJ!Ôó)&&fÕªUÞÞÞ‰ÇÕÕõ‹‹uå?·hÓ¡jW ©Ú¾“*|ÖåKvêÔQtVS^^¾´´”ÃáT]©¯\Š¤Úc6]Éaï;´zÍÄp ËcçNõÑ‘ðjÚÒ”¡@Jl),*9Îom¶0¨>lcc³dÉ’Î;ãûûàè „D!dܸqmÚ´©Œ(1bÄÞOqµþEò1-QßzÑ•»AùÜ#CŠ­Mgò˜lfÒ³÷„RJJ“¹¥DZŠógv¸»»oݺµòk>¸\.—ËÅ£S ¡QK¹¹¹ÉÈÈTíÏž=ÛŸá{pu¯‰Kye\ni‰fS9Ž¢ €p¤m_\Ä/ãçm³î[¢¿\Kö¶ÊÃÃcïÞ½111eee***Æ ã÷×Â+~‰h-yyyL&S À”)StlŒÞ°Û«SÛfšW ¡¾bÐ 7Ê+*e­§ÑXS’E¨x›—/3ÿøù„««ëªU«Nœ8‘——wýúõ¬¬,|ÖRÕóZ :wî\RR¢¨¨Gý‹ŸÑyòäIÕÁx!¶(U9û$-.öÕ«W±oÓ£õ8‚²Ž£×|xÿòuìÛ„ÛòÆ_ÙF'OžLKKþРA·oßåE ?ÐúàÁOOÏS§N}ùLØžU222~~~%%%ÁÁÁ999¸Y0¥ªE!„˜ššúûû‹þçv…ÍsrrjÙ²¥Õ—ÄÄÄbbbäååqSüÿðóR‰„Î;‡……È|?am²ÊØظeË–;v|úôi={(ÂZ !T^Hñù|###aDÕ9ŠŠŠ!!!ÖÖÖ¹¹¹¸7€ ðŸþ–OsðqJ˜R‰vDXXX„„„/úÕŵ`³Ù^^^ŽŽŽW®\OQë˜zñôYAn+L)„D8¢²³³GŒñàÁƒ:ݳ ïK999%&&nØ°oS}c—Wéz…}oM_6ŒS !Qˆ¨¼¼<[[[Ñ÷CA5þü>}úL:U8d÷rµ}„<8ýŸ¶‚8KBnº£»€0­õ–S[&ö`ÒÈ çå'ï Üv˜Rýåˆâr¹ÖÖÖ¢ü¹¨Ÿ*066vvvîÙ³gII îèj•u}á y®Û}äçêFíIb1€%©pÏqÁ;Ó-|J¯,m?s°á»RŽBÁ”Bè¯å“°CïÑ£‡ðéõl\!„Á`øûû<øýû÷€°*ö<X±ýîø-GG´’¢¹&à—o^»ù{§™PãÉÛÆÈ–.¾û·¦BSçÎ+ŸÑWÿÖNxõÏ××÷ôéÓ/^ÄÛT­ÉÚkëPB(CRN[ þ[‹^­*æá ï£õ ÿF0¥ú;…¥´K—.¡¡¡õ¼K&„RºdÉ•±cÇbP GIÈp$³r?–ÿÆ/{_qŽ’™”U9ß›ølÙ¦øY`L)„þ†¢¢¢îÝ»‡……1õÿïN˜LÝ»w_³fM÷îÝ|P 0ÍH{ÇÖýe@€÷ÁG ™å‡AîÕ­ /zåcÎêQÍñS ¡?íÇÖÖÖ>l@3! §§wçÎAƒ¥§§7ä€PÚwÇkÎ-Õfí‡ô7Ó³3/›G4ºwžÞImÐ˦Úu°Tåà%Òªð Iýv<ÏÕÕ5,,¬>FˆÂáp®]»6zôèyóæ™™™5Ô˜"”*{”²êi@|ž¤OCáä@©Ž6áÞ.÷ï+î;Û®¹<>k k)„þ46›ýï¿ÿ6ØÞGx¹ïÂ… ¾¾¾'Ož„†:ðO¸÷µ;š÷­ˆ¨ Ùž}ûµk.õtL ¦B"Mø°¾†Üû×ÝÁÁA__ßÎÎGýUbIÊÈŠ³q;|ká&@ý±´622rvvnÒ¤ÉÛ·oëî£ áéêxõ^Å··à‚µBu—Ë­ìÙëYE%++›˜˜Ø¥K—¬¬¬†¾›+’ # S ¡:æìÙ³***–––?W´bnQ^;11±ððð 6£^¹vø@„)…ÐßÁáp~h~qqñÌÌÌ7n˜™™ÉËËÛÛÛûùùÕêìœ(C Òk:7§• &I@)ݽ{wjjêêÕ«…ÅDÇŽoÞ¼‰UªïK!ôÛñx›6mRSûü(BÊrßE¾z+`KvÑÿÔ€obãße¶„^ë6²bŒw‘! EÅÄ°°TãN’LÙÎæææïÞ½³±±þ:sæLWWW<ü¦Bß=Ù‡9]u}r¤›(˼×dÄ‘û»‡ç®œèkͺî¥>>ùÁÆCÿtÝô D[]*5>®ûúë'þ1úÚÒJKKèÝ+ç—““³±±Ù¹s§¤¤de8}–…„§…4n=¨q“fâÌÒ|iy¦$ Rü6v{LK»)ÍM‹)é˜w!Ú÷ê{B}.¶n/:)VQpòäÉ™3gáˆ0¥ú¦²—×âJî¾IÖ•‚¬ s&Ë=†ÀûÓKľ7Pd¤ßÙ³ŸÇãý®>WZI¿4÷B¢ðóFPöè#‡Ã€²[v7ê6tÿÙ›…%Å–Z¹Î/‰î¶®Hâ¦M› xx÷î],§¦B_Å”–Ú·iÆ>Oÿ¤ä¤;7îæ+(ê|VkÁ[ûl¿ÓÎø%%Å_bu=½cK…šk©ÒÒÒ³gÏþ®>—¡ì¼ÁtC/‹ëA‘¯ž=:÷¸‚ƒì¨c6óÆÄ'½|r/âu²¦~øñ‰™E<­Q*7QïÞ½°–B€£'ª¥T¢Ã%§é+v->’]¬¤®sôÚy€‚FútV @Õº= u;{»c^cíÖ‘A»Å)…š¢HRRRFFæÚµk–––¿<«(¥æ{oJýßìq%LÙ9ûÎt>tœ°/<Ìfì|«L)%óigÖn 3g9Øôº6IGR¤+ÙoA˜R!B€Ñ?[îMý m´öbÅi  ouÃÏêÓ _ïUíììÎœ93hРßÒRJgî¾0«¢`nT¶õÅ«w?•~”R«-7¬¶”·¶ne¥”ÈÎHË-ä295T™%ßå0åYÅiòbRM7"@0Û0¥ª¿”°ïÕžØ]cŸþùÇ–¾Õ9;;;†‡‡ÿú„ø¼¡_¶MØqwuDü´áüÊá³]Ôä‹ó>òÛ®H¹>7zç?ëÓåž_ö%ÊJeE9ŒNËã½0á[§ ¨ÎÁûR}*•!¾¾¾ææ榦¦¿ü-dee9²~JöA绂޼zq_}úDGGÿŽH††† ,())Áq?N¡©¶„Ó¤Qç}Ÿˆ)¶ŒOz¥*I@~Ø sy l¹æ»Éö‹ñ¸¥0¥ª'¸\n»ví¤¥¥ÛµkçææöæÍ111¿#E„±çççggg‡åÔg<œðZ5ºó©µã K¦ÏˆÙÅ|9UYáÖM…ÌälÜV˜RÕbbb³gÏ.,,¬:ñÌ™3êêê¿5E&L˜àëë‹ÛÿÇ2ž›äæ4lÆòkžÓ‚ç™Á—|’rRü£*Êbþ…[Ú™7Çm…)…P½9=§Ó§O¯H3gδ³³û½½-!VVVŽŽŽÅÅÅxÝïGÎ)XûÙ®9˜öþýËÈèeešÒ ÀŠuùg÷õ·ïRýÎ:/¾m nUL)„ê…ÒÒÒ™3g9rDø«®®îÁƒÿLrøúúÎ;¯ûýÀ)4q?¿ýîŽÝLLFL]o·;ÀHU‚RÐã¨ñh}ïî=æï¸ítû…¶4›âHôúG¢£†XBB?~ĽósÚ,:zJávÀZ ¡zr&Þ£G.—{îÜ9 ‰ª§Þå©q„qqñµk×úøøà0ŠŸ#®¤ÞTY·ÖRÕùêòåË—.]ºuë–¸¸¸H=®_¿~£F2d~5-BXK¡†¨¸¸xÚ´i™™™§OŸ»{A)uss³°° „`E…ÖR¨ayøðáš5kîÝ»Wù˜>Qk!!DLLlÆ ááᆆ†¸ËÂZ ý2¼¢¬Ì\.düPR&êJJJ† VPP Œ(¿˜fbb2vìØÂÂB,§”B5wíU»øZŠ99¤Ë¼@ÙKÏ;¢àw¿]í«“èèhSSSÔ‰û=„—/_âç|”B_í&¯o›ÖsœÓÏõ’>AÉÃ;ÊüÐÛZÑ©ß¿¿¶Sf^Ïž= žW»ËD÷U5• ¿ò|HXB…„„L:522²²©'ÛŸÒ}ûö™˜˜á)ÂZ U'Ñ´‡ú.‡'ìÃü/4nÖKÊ`8#óbn)%Ŷͥw¾ªnôõ¢c‚*'ŒêÜ|Ë•èßÑBBÈ€rrr*#ª>!„ÈÈÈìÞ½ûñãÇQaJ¡OCZZÄó˜X¶¬þìV󎽎]ôY3aà’ó°ïøqµîÃUò;p¿â3mP¯Gšcþ­~GIÐxÐ\{ñƒN<|®.ÜöF‚ÎÄAm¾ÑggEGD¾¨ýu-áœ<:tèµk×ú÷ï__¯‰QJŒŒV¯^Íãñðº”B ÿ´åöeÜo<`.÷M¸â<-òîUFGÛȘ ¶‰[ºm IDATlJ gß³D·5ý®_k1rÅó{nÐb䉫ÿ€³»_¿VR@9»½=¸ÊúþUµá›So«1)ôqæèâöåoÓr^¨ût0>{VïfnÞa?Td Â1 ¨¿ß'$\¯+W®ôë×Ë)ÔÀá})TqÂ"Ó|ŶCP~ׇӹÿøÎýÇ Oì„ßl!Ù}ÄŒî#>•5*-[€®~»òî•%ÝkÄŒ^# ò…  ®ÿi¤…DãŽD²ñâ-jÙ66›}ëÖ-www))©r·†Ãá¬^½úáÇfffx|"¬¥PCWÙíB>ûVî*ÿPídÿkEÀ—óãíjãùóç'Nœ””„󕬔ÒÞ½{¯Zµ*??Ο?*”BHäèëë?ØW† WöÁƒ«W¯¶µµµ±±Ù»w/Þ¦B˜R‰@Ð`×=88ØÙÙÙÝÝ®^½Š·©¦BH$¯ø™˜˜p¹\á”wïÞáfA˜R!‘@¹{÷nÛ¶m+§”””„‡‡ã–A˜R!á8ÆŒÕS‡›š˜Œ]´§ €äúͲÜþìÅåÍn …[æÚ˜™™ÏÙt–þ†¯Ë"„DFF:::VNY·nî„)…PÝÆçó8P%l~.!Êzê¶Jmj¹eëÕÄ“†.!‚Âw/o®µ?rÒ¸éƒtšßëµqÃÚ²« [Xïýå7„Oó[±bE`` pŠŸŸ_C¾K‡ ü¼ª‡Áœ9sæ̙ӻwï1cÆØÛÛ‹‹‹ÿðRÊb“³ÇWü£ÍSýóúw^'çF¤=ù"á¶&ªé ”íÓ)@Ï €>†ÓJæi‹ÿâu&Ÿ‰‰ÉÇ{ôèñüùs¨x’!îh„µB5ø󃡴G®|>ºŸŸßôéÓ%$$,,,<==?~üXë•`·ê×M»µºîÔ%¼ÃRG*ü^›òð$&¨m«¾”PJiË»á÷´Åã–QPPˆŠŠ=z´FÂZ ¡êÉ$ìµ´´þ𻧦¦®Y³†ÇãÕ¾–ª6ÅÏÏÏÏÏÆçââ"&&ö½¢ÈaŸÇÛ’Ÿ9|t÷ºY³k¼{y€UþZ*¨|È!òrr$dåØ¿íÄOxõÏÝݽòêßWV¾àÙÓäÖ†­ÙxÔ"L)Ôpò‰RúòåË:øúúþù”ÒÐÐØ°aýÄÉÉ©òg&“©¨¨¸råÊ Ô²$„ð’\;ð ?µÄñÐ’M ºbf¡ô«ÔZmõ»­?q`A\{6Þ–tQøí5¥©©é·fâ=Ø}ö³ÂǪ5%XÞÇlqE%Vb¨îÀ+~èû)..ÞªU+Bˆ™™ÙŸ¿â÷£ïXVV&üAFFæäÉ“<ïýû÷ , ”ÖþŽKÓŠŸu§ÿèùÏO4ŠÛ¶­IÕÇ?Qè2qAÇo}³‰îî'uz‹;ÙEDûÉ6:ú¾…x\#L)T/ò ÝynçÇ_.u»}h4PJþÆ®€´û‡{w10.9“_ÙŸ=‹ºt6é3âQr>ì¶lÿ\’½¨[§ãq˜T¨ÎÀ+~¨fçÏŸ_½zuÕÇ›Š‰‰µiÓ¦NŒ.c2™#GŽ¬¬À~¦Á„1YUÛÙ+l«Ä6CBYC¢b`Ëô3§ç˜ŠþÊ–!äí%ímNl?sÑ@üíО£¸2Í À¥]'ß1¸è|°ìÕKƒ¶7ß'M:rÉ»mÿ±'/k*G8”Bu»j×®]JJJÕ‰AAAÂouª+þÿ4ýü ïä'fø#ò¦Û»Ø{&Lê«H¼7F·˜À¸ìñ¼Ï>¿îÆÒ`Üõ²t{ÅRž\ J5tµÄðGu^ñC5÷ï¯_¿®œ¢¨¨Ø±cG| ·(ÊOŠ z)P´ù þr¥\>À|§¾#廿ó «B+=e<%E˜R¨ÕR„]»víÞ½›Åb€§§'4°/Ψ+û ƒI)—–ÿ|ž€èÞ‘Qš¿|´Ñ“{ôUgãÆB˜R¨þDÔìÙ³íííçÍ›÷úõk--­^½za!%šu/H«÷Ë]{9 €!ÏÏ{ˆ‹± ¯¯~;ßl‰Aãæ¸y\›?ªóÛw*_ã£Ùý¼€jˆ¨éÓ§/]ºTWWš7ož€äaRnln;ÐÔ6tž©ä G×gM8RÐ>Û¾u«eW‘øk{/?ÝêoÀe³¸Ünêí£-ûk)T7#jæÌ™+V¬ÐÕÕžnWŽáÆí#²{M±ÝôWÆ yªƒcbßF_W{.Á×ý¿¬¸èâƃŸ¤dNè  s"øªzR@ )„µª›5wîܹsç6oÞ\¤Š§GáúBP*¥¬3•ðËD(ˆÉ%lýî#×w)ܽåy¦kî¸Ùðyµk)T#jÁ‚vvv­Zµµ.¬S§NcÆŒ¼›ò­¤úôóçÿ/ÿ틹0¢¦ªSµpáÂ!C†˜˜˜ˆ`&--=f̘ÄÄDì[”B ´Š2dˆ………h6’Ïç>|àÀXN!„)…\DÍ™3ÇÖÖ¶wïÞ"ÞÚèèè+VÐŽû!L)Ô "jÆŒsçÎ522ý³X, ¸¸8¼î‡PÃcütDMŸ>}åÿÚ»ï°(®¶ àÏÙa—^¥ ˆH‹`CQDŠb * š‰ØAD F±'±k,1Š%o{Œ%±%¶ bElvAAÙ2çûcÑøE—åþ]^^0ìÎîž™=÷<3gf>ýÔÉÉ©FŒøâœ:ÔÝÝýüùó¢€ZJ‹)çõðmW.°]çÏW¢² T—â\¿ÀÎ…*ñ FT||üˆ#jJDQùÍj322RRRQH)mvûâ¹Ç-''œœ4 Ów AÝ?^ùrýÞý‘²_ýˆò¬óÙª7qxEI‰‰‰111nnn5«(aŒÉd2]]ÝÇãè@mP[÷øqnâÙ¶KâœX—†ú}>ý^œ#ù[oþ·þ]öûæ1e¿=5b»üÎëO§Â9W_ºá©ù<ýûÓ¿>;Û×QIIIaaa>>>T3Ï›7n\XXئM›°ßµ”¶cŒsrpt”>¼Gtsm[ç‘gðgÖCc×NüÜÄ^"•Ú7é´9ýc,¦©ÃU+dÛà‡{Œ1¶kÅDWK=Æd~áÃΔeÒ¶ÅÉÆ2&5î5lN1"VzíÈûí½¤RÁÔÁ{ÑöôgºÕœÃ냼lc–nþ«Þ¦×QÇïÖ­[»víjò6_°`ÁÀQH)í'¡¬Žd¤ZóÃËzö–D™qéƈ ׄëYóèÞV­¶š°OT(vk2ØÏ3ý_™~¥^>Û}óRo *:<.jìšïΔp.×6#äHÆØí_‡ šñûÁ|9WܶH›»Šäù­Þê&ï>>.\À~?¤”V~nIúÇ ÍÔ,¬Ç¯:5öëÕê¿”RÏÔOûÚšìýn½i×èÏ{¹ç #g{™mú=¨D$zLD¤œôáÊÎK~ñ³‘çÃæ-䧎VÒð6n«¯Kœô?_øm@3ýÂËûòë8­Ù‘s2ó0!ÞoÓìÅ•öñÝ/}¤¬c¦'W(÷™~ýRº„±*ïw+ÇÅŵiÓF;–a\\\LL Ê)¤”6ÅÆÓÓòóïܹsçÎí›yy—ã}ôÊ:t÷ #ºzó²³µ§zÓÚŸÌ»ûä’¨8Y@Ýšª@2'?‹û‡/#ƈ5¬÷VnÁ*úVëo¿JžÔ½‰³s}7¯¶ÛÏ?zMUÔ!CÆŒãåå¥MÅdž "##ñ5@Ji!&ÑÑÑ‘ª B¥v(ß67Ð7/,¾©îçÑÅ; [S=õµ¥‰ˆ˜`Æ(»@®~ÑÃ+÷dudÆ"¿SªÞ¡Ç”÷rvü–¦kf'ʯŠå£$nšêQùtNäÙ{âµÛyéi«¦v l”YÊ«°:¨¸Grrr tþ’lmmûôé“ŸŸo2RªváD]:úý±kóY""FtvÛÅ ¡-«ÿ*%"&?Äaþà *""viûŠLdžV²q]õ?Ž[FĈÑsãÇÌXmçÒ±èAÆ/·ÔUØý߬õîܟIJ´c%»ëeˆºæu¬Z…õ7--½«¨âˆJHHˆmРöˆãœ÷êÕ+00P¡PàRJ{<*zð ô9gÔrŃûäDĈ›ø}´êÃzM ìßéÚ¥®~ãÃ~èêiBdâ`ysPç÷ö‘wÊÞ0ó-C:ù7í;Ú’UQ·Ô#-ó&»xtiÛlð²kóSgÙ[{gFör´èðNW«ºw>û2º>q±à~¡HD†„X´vt éÖµ‘“‡CØGo=)Ø^=¢†Ù´iSÒÆ›5¨?ÑÉ“''L˜€TZ©6ž/ŹÎÜ\N;#ŠsnÓç7±OÅ™O¼ÏÔ-á‰Ù‡2®ÕûîçÎ9'ƒ ç¯ýv좷!7X²?glæñ‹ùÊõ­Ôƒë §îO;rã‘ÞÛm¼Î9ç-úÏ)qàÏ,s—5M8çÜÄ?¾«~Ñ”u§b/¦gäÔõhîaoBĉ½úg,‹¨ÐÐЀ€í^ ºººúúú§NjÖ¬¾ÒH)-ØjKü™ szúêR+·vAn•§ëÙu²SO ¢zž>õÊgP1+wo?÷gfjP7 ]Ý¿¿®úg+—¦A.O¦UID%$$DFFj}D©Û0%%%88x÷îÝ8Ï@ËดöUŠeÃ% T"ªâSÿôÓO#FŒ@D ¥@Ó ‹!C†Œ5J},ªö|j}}}SSÓ?ÿüëR 4´ž ¢ØØرcÇ:;;׶1oœó”””Ù³gcM@J&öÑê 6Lû΋zÉrŠs>wîÜ=z`}@JÆETbbâûï¿ïééYkG0ÆêÖ­‘••…Ó§R YÕ³gO???ÒÆó¢þUkDEEEGG«K+¬H)xó•„Q‡ÓÞ½{ãããTH)xÕ”yÁ$ÎÿÞÏVL¨tÓ¶m[´fEPz{{_¹rÓjºW:«W¥Ri춪 /ì¡8ç*•ªº· $‰¤bã€Hôí¼öª‰œ$Œ+|>;½µ íºãTžg·O~Z‘lH´µ¿Ã_TŒˆŒëÿ°ëWÿúFݱzй««+Våg–ì AƒsrrcÈ*€ZšRow3sj,V{GÿB7¯œ[2clk¿ÜH©  `òäÉ‚ TÛE±oß¾¾¾¾SšÏ9tc–äÐœ˜Õ¦ã¿XT¼\[l;}f©±ôÞþi1ÓO®M‚ñç3|õD©üD}ßÑW2UôÅ3gÎ455Åþ^NQnnîĉ'Nœˆ¨¥)eéèÞkä …\ã>Õé}?Êå¥/Üܶ°°˜7oÞîO©@:Æ$::R齬õuFìt±0àÄm:ŽÙòVÙ=)¤RA*HÚ̼ø‹"ƒò§#¢þaù2Æôôôþøã___4@ õªÇ¥D‘¸&þã/¼žfv[¯÷jé@DŒç:ŽŽ¶D$!ùؾ½Â{…·käØz\²ÁÓýï?,ßäääI“&1Æ>ÿüs3334 @íª¥ Ê»¶=üuù¿Í9gìрФ[—ˆ$>o±žJÇÈÆÒH‚âé_ùôÓO¥R©R©$"¹\.“ÉÐ&µ¨–‚ªÄ¹yƒpÇ=þ÷ëñë7ò¶ÍœåÜB]Ô±±¶µµ³4’ xú7ÍÉ—,Y¨Ž("zã;xµTYUZú¸¤¤¤ò$}}ý—õ÷̳ª®®¾•£½‘”ã‚áÏgoLÙ+ãF³ÐO}ID&îØœø÷”Jå—_~YyÊ´iÓF…–@J½a ¥rݺuÇŽŸ¬˜RZZš˜˜haañ”ªþ‹j7lØ°yÿ)ÍÕE#"Ù¤e›'Uz@»I[°¦þ—•[G'33sðàÁË–-SO),,|üø±®®.êQ¤Ô›-¥H©PÊåOFŠ¢ø2Ï“H$oä 8Ôô:¨¯=‘ššÚ·oßàà`õjPPP`gg‡Æ¨)´yG«Dóß*ÖÅ×T:t¸y󦞞MŸ>Í€”Ь-›âââ>}ú>>gÎœÁ­Ó)šTÉÉÉsçÎE9Z ÃÞÂ9¿yóf5¿¨©©©Á«¼g;;»Ó§O7nÜYH)-O©ëׯWó‹Êd²WI)ÆØ”)Sú÷ïÿÍ7ß` Rê…Ä¢Ûy"/ߨg‚¾™­®LÂ9½ä†¾ªøÎ…ÌÌÌ´ú›C"‘´hÑ¢&†«››Û… \\\PNUU“2Æ?(È¿ÿ3ÁÜÊÆHWB\ÌÍ»nïhçÚ5‹ºÆú‚òQÑ­üû¢Dfeg«'¡ß"ÞxJéè}?¤I>™–õ–\T2òhª[LmÇnÛÛ/<óÞ F6--ê\ÌJ{ÐÜݘÝÞ?`ÑR³ «æTlör‘c—ºœ’J¥qqqׯ_¯[·.äJ)"æ´ã·?ŸÄÉLÛ¿¯¢©‰ÏØttF¥G`¨rÕ·³KÉœ¸—þ2uòËé{§wØšYrÿؾ{¬‚ûõÝ6¬Ù¾íë,ê³7Gà.Še;V+Ÿ¸Á6 )-Õí¼qXÓ?®=²"nÑŒ=½æÏ’Ir3ݼqC‚î¡’èèè?üíðê™ÿLlýã0 †¤”Rnü^jfs§gç¬*¥°EÙm‹lýÁ)ò›ñ6¯sùÖû û­ødּǗ=0호úª•‰Ô´ó̸¸¹’¸Hu{nŽ_ôqÑeàÖ‘‹V 7ŽÜc†~›Þ¤Ž„µKYæ*ͽ|ù&:ˆÊ8çíÛ·?w@M÷öøqÁÜÁã9ÛD=ë}'ú0Uĉº~²@T‘ȹ…[P×·‚ˆ“('ŒíêTlª2™¥½«ºç5siÛeX[â$ª¸z†‚Y㤅\$UíñE1++«š—™™Y•Ö,)))&&fåÊ•XÅ)õò½'q±lœ#Ue]*•ÿLÿ´Û¤ÒÃÊé™™TIÿ®§§WÝË@§ê—ç¼^½zéééMš4Á;@Ji Ƙ³³³v|I“& 8pùòåX¬PsáxZ‹sîää„£S€” -§Æ?zôhìñ¤h¨.]º\»v íH)Ð8œó¸¸¸ððp4ÔPµzôDqqñ–-[ªù:~­Zµrqq©ž—Sïë9rdAA¹¹9Vw@JÕ$‚ 899Uó5ÑŒŒª¹œêÑ£‡··wFFVw@JÕ$zzzþþþÚýÕWöûâ‹/ q¡t¨qp\JûqÎ;wîܾ}{4 ¥@Ë)™L6räÈ[·n¡5)ÿ¥ÜyÝóïÓ§Ott4šj\!é)¢(?~¼š/ÖàââbiiùºË)" ÍÎÎvuuÅy¾€”ª‘cÕü¢úúúÕS®ÅÇÇGEE}ÿý÷XЀ”ª©)¥­ácœs\(j—ª]œ’’²`ÁD ¥@qÎ222p¡t@J&–S'Nœ}Z„ììl´ ¥@³0Æ5j”––VyïR 4+¨6lØ€¦¤hhP988 )€”¤R RP»ˆ§÷ï½V¢DCR 4 眈ϊ~o_¾‚žw Dþœ‰üïäüÿ¹}"çåÿ•?óŸ…{0R ž`Œ­loú«RÙÊiì®óŒ1eþ™èàfu,mÚ½›\¤cìÄæÙ^õm­íæí9qÆØá5Ÿy8XÕuj:ÿçóĈ1ÔØtûÙëƒüzOûkM/ËQ;8cœ8c»Y³”=ÅLùðË¡=­­­¶ ?uí!cÄÛ;­Y§…—¾MìhØæk܃Rð”v^ ÒQMÝŸ9¹ƒ+•mêì# ›Ÿ—s~ÝÁ·œ[((÷ùûyõ±‹Òvþ>áý¡¿±Õñ! 3we\=½wÁ⾭Öå‘ÌÀ<¶“ŸeÌâé1î&Î-=˜\ª"Æ™â蜟ea“:èòtØ‹E©ßIDAT „_¸xiÃÏwÖÝœ¥$"‰Ž^Öò°U:á{—÷Ââ¤<½ìez‘TWO$;§ÌUt³,>PÏÀ4jöáÚŽì»'OæÚµéÐÔÊÐÄÖëPæáQ^ºDæm<²qç*'3}K—À“'çÿ9iÀc"bªÞVMÒÝÅF×Úµ£NÉÝ…rb´`ñ¯á"]»Ý(àà—Ñ&ÆF§¦„û|»þG""Æõt~™çÛÐ {üà¹pGy ":v9/ Q_"bŒˆ¤!6Ò=Ùw—O˜¼Ð7ØÒy­KoÿnQ£¢ÝHuèžRèõ–½úY\TÜ/R*8‘JÞÄݽl^ú6ÓØÇ_Ÿ=úiãí{ÆîÝwöØXÕ­cööeÏ’?(27Dý|Y“NÄÞЭ )5d=H‹å%êè!â÷J¸¡®@Þ¿fß½zæèþ¿¯Ñgý‘åÇ×{\d~\žm÷œª¼¢.ga³&o3êa×Ç̆ìq¥c'k·ðŒý_U~|YéÄ°À?Á¿ÚNЈ(,ÀcÛÖír""F¥y[ Š{7r˜ú~Û˜9ÛêyùFÇŽ\ÿMBî–5*jáá|û»Ÿ¯¨Ÿ{`V°‰÷dñ™9rÒ­÷ž…ôÔ‡ƒ– EDž^-¯œ?pI^ö÷^MMG¬<Ò PKÁ?c&úªs:' j3d~¿ï\œÝÚÅõX3sŽy‡/ütÝ#¼¢¢zdÔÒüþÜ/ÿ&M Z:aˆoïã .Ùs÷×sã%DJ¥B¬8®Äˆ zŸ41ùdß½}ˆsC¯î_w›ÔÂÒñ£ÑY?ç_Ó‚ˆ¸J©T‰X €Z žƒ“lQÆ_½èêKuˆ¤‹äZ5ÒÄÄnÙÉ[§6“pnÓsjþÍ3}šÛ×q ß‘°ìè¥}N®ý´ÕþmëUbŒ)õ&É&CÚq\²áðæU䃛/#5åáw£zùÔõòöª7âÛ5‰2#ÎãAÇV6«W»®wOæD¦¨:}»æ òmÑ?ÞÌ7\>½i}ïº>ý?[ôÈÈcW¦u³éâÕ]Óý[êe–®Á‘Çÿþç—ÛjÎè–©ªü´Á-ì5±©ã¾U§‰ˆ))ÛæOðõöªãÕiÐ÷âƈˆ%„œù^ /¯:MGœ~œ¡hNÿX»jƒ}! # :±¶{ˆ^^Þ­Þy%<™1öøôZŸ™å°W:{¢Ÿ6&*<î›/†5,Jœˆœºô¨”rñ´9çú²ÙöçÂuûv­¥îY}ž‘!ráÄ~¾u½¼ëúšòkœ…Y›Ø‡ç6õhÙ N]ï.ç?H3ÔðÄo#½ü»…§pFò©õsZ4ôõ®ëÝkôÜ0½Ê¿ýCÿ ÷…ž_X¿A‹G¦ô*gŒÝÞûËÖ„€!^…d>úqCJZèú½×!&6ì1'b,èäÆ÷Z4ôöñ©×¤Ëú“AÖCŽÉ‰+¿áW·v¿æ‹v]QŸI¦&Þiçé9vý5ƘáÑ­)ƒ;ûúúøù·ýe×ebŒ16²•ïÜׯއ…¤/Ñòm{Ž*«#"*ÕräÖ%_ œc0…”ÊVfƒEëèHœé?àŸ"NŸ9yüø~§sËÇ/ÞIŒî.ïóñò‰«=s|¨Ûñ6ߦo.÷ÍQáÀžßòjÙê©~»7nû‘ã'Nl«»ÐýƒIDTmòÖžÞnžÍGÚµÎ>­ÛÊ8çºrÅòåܽ˜œ`”œ‰èøÚ‰ßmÝzèøɳgGùé÷nP‰Œç»µQaìº'Ný6¨ÄÀîƒÂÓ½6%do÷Q«~ع§Y 1æêoï^4á·¿Nž:½tlí»¶º«ºú¼·ifKUªàâùfž6¯º‚¥»tn'1Ɖ©V_,Ù¥“6ÇÖÐbÑ:93¢i#ç~'OŸ<~êhÙ‡ÛFÍXNŒñðõ=̲äÀéSÇ'T¼Ö¾ó†t¯½¸~úøu‘{¬swd»Nølõ ûŽž8}º_éÐïW‰•ùÛÈ6eJÔtäÐ΂ÚgG g¾oÙ†¯u,'µµ&ƒYD-#ŠÞÚ½ÿÜË?vìèÊ õÙOœó©zÿ¥÷:qæ̉ý+ö~?tÁÖëé^;¶s×Â#×ÌîV•”Û½š÷4·›sìØñ“»çšÚgÜî8"úaí,ÁnÑ¡?4/ž®7ÉCo=,ïUâÇ ýš4 è?á§8Nœ0˜BJ½a’½ã“©e×ü‘;ÂÊ ë_Žûæ÷­K'W- ïV3ïµBˆèÏi‹óü¶Ž›V4ã–ÿ6£³úäÅÁÛ¾»-~åÊÅœˆ÷ì?Öyâ{Q’$¡Ë”±Â™“§Ä1FLQLwd³w” ¢&íÏ·/ÿú´úÉH_"òœ±oïÒ¼v’Ådð¨Z_oÑ›ùÕUjø¨“W#IÅ[~²iѧsêü‰!æB`Ÿ)–ï­_ÒHÝúÄéŸëGˆ 1&ˆ’”v°qNŒ±ycÇyú®ŒÆÖëƉRÿl‰û盿»—÷w"â®-]:Ö¡˜ÄYuoêísæb Éagï÷Ї1QçPxáÂe­½‹X_«ugèÝä›%«0¢›ëׇ•÷ý¶}iI’È¡üÄ/»Ÿÿq–‰ˆD‘%ÓŽ9FD‰)ªÃ¦¹“jôœ°xñ/µ Úõ˜DŒa Eî&½õw°bç= 1â$êJU®3cùbO'ήìZúùë]J–suÐÃIe9‘ñL¯Ð+_ê+ºxV¯LDÄKøÞ÷¦écýЭv†QÔ´é?´þæðˆ€Dt{ÑG}Αࢣ‡FËsÂèñõÉ{OžüÕž¶ûZˆt’ÅüþoÛúzuLrÅ8ú—Cö.åûõ;GD)aQ âªþ¡×–,üJ²½z™’¥¥WNW2ìð—£þ¯páÔWÖãšx ö’`6Yˆ8Yƒ*í5w ¿?¤ÐÆѾÛöëX"²×ŠNåü¶-û&ãÁeÊ´Oä”ÇU«urzÒ*ZÊÙË )…¿7J1Ÿ=yqS„^ïäQÁ™s"®üt>F+‘¶mçsëOY;¢râ…æ>þWŒD\ÑUV¯Í„Ï{”ýtøÇDDTÖ£¬tbË­'kΞ½õl³›³§¸ªdhò#¢¸»1 :T·n:wb‹F "Õ§FÑЛ!"Æ8c±ƒ}j/¼GŒ˜>_‹Q}»¯^:jí¨Ž",DNmý.Ý“z¤œ=|Π¼hÑgDÆ´?Sñóm? ‘ˆç¸iSÅ’ÉG–ðÇINÕj°^ÿýÌ};‘‰m潸í\êxÔr³—ßñd"RyéÁÍÚš9ÂkÚ~&"¢b5«j®¾üäÀK>}â*¦¡M÷7A·qÇáu,Y¼xñâÅ‹?kXÐÙ/ð·ŸÛæ:?FܨϤ`ÿßµåÃׄQê%#î>Hz’zñ·$ÈÖ!+§gWW2"¢ê•«_;¶¬K1£NœO)ܤ" c©·žŽÕò¹šçMÕ¡fÁ][7vnUz⯇Ö¬ýÞ¸Ÿ 5îÖsä½åœïÞZ¢÷LO;ŠxòªŸÎºò^ã÷>ݲæÛN£FêðÉ@5²WMwñøŽ5w[ïõLj è\¶œßºè—è>9iž„ôã³3î%I–¤„åó ù5ù=îÜ §íÍ­šæ[>þƒ|Ý]Ù¿N(Û4)áÖòÕë½ÿIßµ-:ôÖ¾¡çÝSÛï–hõsY2…[§F)_¥ÀÏš¯þÁ×·~Uoì"û¦½ß{­E­’·OîÚxJÞvhMÑ._if\>wöw»~ä[Ê:âO¯šqFjÑþæ¬on¤6$Rá‘c8æèû™hª–*A 'O©_jï–5M*m[vaÅ_GúŒZT±iû®ÃÛT)xjÏ–¼&Õw¢óDÄ' òEד»~üÇ–{ =¦åÀ¡£’{{—²?½{ýC݃~Õ´Œ\ò?¸õ×Â…ÉÝûPÀA´ö,4š´¥\ã"1)g5º]:x,ørÅÜ¢vyâ.n)Ó´^þk«¿?^iÂä÷õûbÀÿÛ9Ç__0dÖöv¤<|’7%æý6½é€~'íôk8ø#ÏmºêÖ¶1¼¾iëŽóv|èS€œŠâÑ3¿˜ë×°ã°eÒFoý&ŽßÓªGßá!µË8Ùµ£|à¸ÚÚ 3+Ûˆ_~ùå[SLekשPÐ)c?]жðŽxĺŒœáߨ•›óØ`_§–Wï÷Z(±‘M‚_§&t÷""Ù¬w(\½N¥ĵuÔ{ôðRɪµŠVðéÙºú£÷b-žÍLÛMàœU÷­NIñFѵn-ϧ2…ý}-JÒ9T¬îYÜÅNÒjò»W÷(a›ûÌb6æ)R¶V•²«ÉyÆœLÑ#âku5´kÓº•ú*u|Z¾WDHŒŠK.Y§Ã×_Ö‘b2êJ׫S†8+ߨ£}ÌùhÉ£b™Rï÷m¥F‡†E'¬0{þ$w#NŽ*æ— É&©JïBORHŸ(8¹ºè4ÚT`_Ë»†6'4&½±¤gÍJî®Ï•Pl×¢>:,2^n7üÛæM[–Ô=~/Ö©íÕý½vRBTL ¯ÓzÐçýˆH±¤üU¼ªº×ÔnÜ4þá…‚åj/WëýN^±!÷Å›*ôœùy? qFT¡†§¤OГKí:5í2K"ÕdŠU®]¶ˆM޽ɮŽŸwžŒÝZîX¾±9û  M‘ÚÓÇv«UÁãq|Lª^¾õ[µ¬U$âa„¿ü¸ïæÖu×WõfV§n];Á¾PźŽñGî‰~ž%ë´îéálz¡:é?njGÏœsÆ\ë{KˆK(X¾F•¢Îi£7®+عg'ËãÈ$‹Öÿ½O&÷ °É«x¥ãx|Ölî6 H)°:~œ?FR6i×.Ê—jÖ¤Ù³éöíÔ¸øòöS û€ˆ¬·¾t‰Æ'*\˜–/§ÈH&SÙ¸1:s†Ž%!‹¢1o^rp°‰*,Hvvoÿm0Fnn¤µ{é +†³ à…'HzQQÔ¯1FŽŽôÅ4v,1†åõO¶l]ã7b-Z”e)•þ©/ù-ãœco¿¢–9å‘(¼ Ê•£mÛ¨R%T"{Sêmt D£'N\4cöô‹$}:iÒÂéÓQŠÿÃW?þØ·oßÒyóþëWʲM ¾ 2l ð9éõd2ÙDM’“ßìÞ‘$Z¸~ý5“/,H:Q·nÔ¤ N®§ËÖÝŸý {³»ùe»%)ÉÞZ‡œÉÎ`èÿH)É6nûâäDNNØÙÍÝý™¿*D^^4mÕ¨‘šÙðvR ÒwÙ{ö¤9s¨P¡Ô§ Y'œp9 )ð65mJÝ»Sùò×:!ŸRoçÔ°!–ð½>|ª Yà …”¤R R¹’¢(ØÍ/Á9G‰þoªª¢o”í>1KÞç<,,¬xñâYøkÚ΃A³ä—RU5""¢X±b¹²D/ªcYpä3Æ"##]]]µYzïÄñäYl7ðÄ^¤Tv€*Tö,R®ššY7Ÿs•«\°ÞWø5ŽÝ,ùcZ9éоÝ6R"‹ÅÒªmDzUjªJ&Ýy•«œ“øz·L´~š0+Ž&rÖÒÜYßØþq¿níÚM»æq-𲆘#žM¥#D‘b^ô“íWoûî}?-^V¬D™ÿ»nY.äþOG@›žûØèç¥8çÅ«øœ±TÎìÞ=×N‰ ¿ïߥ_v¾%A¤¹CZÛT‰œ‹VòüµbÉä«—ïÖ'Åû´ë‘½}Úóý¨qÜGDFÔ _°T¹—ÄÏÎeßÕnÚÕ­DÉìyK¢†N.ÈÕ ¬Ð|¨g½F™4(ZZýíÄncgdsN9ÙýO¾@Je/UQ,&’3» Ÿ*›UE¶dïýù8·­‹\U ešR\Uˆ+™~éM¿©œrè+²ù%õaŒ‘*[²³†<‡ÜÀ©/¨žõþ>Š9û÷¦ó}¹ÖøR )¹ î6ûo"]’“SRÒ¶pÎÝÝÝ­+›Q"RdŠ׌Æôóåˇ½³Ùl0 éKÈsuuEe^‰OJNŽ‹‹K¿ÑZ:xH©wˆ³“ý?þhyö9žEŠ:t(Šc=gîYVÒG»ŸŸ_Ó¦MQœ—cݹsgîܹËÓe f̘1vvv¨Ï«ºGòŽ;„„¦ßX½zõN:¡8H©w­-ÉØ5CO-³ =­‰(Š(Ñ¿¨{Z=ι `Nþÿ<ð0|Ï5pR )H)¤ ¥RÿN.ø¼'bZ{â ™M©Ÿàœ‹:&¥{þ”ªl~ú Ή‰$i¬w:'U!ʼnrÛ§+8‘ÆŽ„'¿ç¤Ê¤X8¥V‰´™üÎ#©jf_âd2¼‹ŸAáœ3‘¥-D\!ÙLÜú%Î%;&¨d6§;¶¦µ#³sÎ${b2Y,ïôgw¤'¡b$Y墖‰™Öšp"¦±'n!‹… “4d1æ“ÞÝ”âœYÂ.™ò‘Pâ£Ó†q 1"ÆØÅ…ýÎ^¸¢‘4Dd1¤8ñôh5©v½*ÖG#Jø™3ïž;’¨·ó—¯_¥ýøjÕKÉJ®:9·ìþ°ñƒdƒ$‰\µXdM >M‡yÖ®$Ë\#ÜZØ1ÅÞNH߀ªJËo/”(·¦[Àc.ý—äü}‡Íù„›Þ±ˆ""Sð©Õs‚.K1r’ÍŽÅj–n8Ä·M#n!Æر)m"Ü;w00õi”Œ¥m]6sj༿]óȇ‡•‹n}¬K‹âœ¿£M çêÎqB%¨ «úùY¿Ršk¿ ¹’§÷g³9qXòõß7ÌþÁk®ª•ŠDžšµså‰^ßÿ© —¤“(ìÌbçŸÑy!áƒK¬Q«s­Ö£÷¸qŠJ‚Hw6M:´ñʵ÷9é$f ß5¡ERÁÖM¿>W¼¨F•éŸ ãÿÐÎðñ¾ÚÕ ç¶¬³/ÞrfÇ~²JL–oþ9ýô/½âún¬ï[†HD‡zsþ®Q(ãXŠ8“tNÕ??ÓÐCPù;=–ŒAÛƵ7— l=ë²[A"•ÂŽ/>°|TŠeAó¶ 8‘¨u4šgŽIA£±sdDÄI´s’¤wzXÀ˜Ðfö6iU`C‘'4ö­õžOÌpwãæ9?W¬jE'®’ hµvöFA.J)N’ô÷®àÚszFþ°êî…ceZ(i­ªj1HåÄ9­ÙZÝuÆ(+NöRè‰E1Ú2ÝÆÏЉdJ!â¼lûY\WFrVså>æ²Ñl E%"©lë).ù\vmú°ní1F²‘̆ç›""Å”d2äI?x禭ÝݽsòÖê9fŠ@ܬgD¼@í!Ü nåT܃çõÈF"9…??…àÏYS=Fì¯åᨪ„ZBægaÎnE^“\¢VyWæÓÅ÷Þž-&í3ã,IG’ŽtN|b…¨­˜ÇAÇ4uf§®ôH­Ä¸õ´`Œs^®å°R¥ÜynŸ—áœòlÊ’“BâõŒç$êHcGÝ“ÿ´DïìäÔ󧇆?ºtЩ‡Œ=9Zˆ1âöîåt"OkV™¨ÕÚ‘&í?¥{ÕK`ÆË›¾[~ÐfŸZ…8CÜCnKqNLC7Ïí)\e&©¤«1¶¨à}á|’wU'bŒHH¾½eñ MDL1$’Sé†c×kEbdIŠ18Öö`ôì¿cƘ`_Љ›'˜Yaµì̸š§ÓU-8dà·ÃE•ˆQÌ©oÛ¥e–¶dãjžeUõ:=%$?6;6.“PjÜÕí«LL""•å¯Þ¡»V%"!öèìöNK*0Akçè„Æåe£«„ë›ÇoHTJ»—)ÉU I!—¦c$Äï þÇP­}á˜7‰IùÊV=°ÈÇs<çD¤:yté3~¬Â‰Ë~ê×½ßðIû+•Í£±cæøD¢¢é#ˆ¥.ÛÊõƒ)Yo&ÑÞ^""ÅÌ}\¬YˆÒFOŒ“IÏ­clSÔ­è$)ík‡Œ•}Ǻü:­–%'$s*Àˆ7ÄÞ¿eÖj˜rK©ÔÉšRjÿ Ýv“Ÿä·>øàêo¦ qyIY-)É¥¬pnÂ_ßë>å{“§SŠˆß^¹Hqqº¾dеÔÜâfËÙxNy¬_WÍ&=Y/þôàiÅÞ?Vü¢Sþª\^¡~+Ò“ÕÄŒ)Iûº\¡›1}È5½Î¹X>{k(Ë2éŸË"âT´ãt¿òÏ\—R”wëôPeG׊e]^O­ÇqU,ê?j!q.&m_2nUºo3šô¤'"&Pø¡%ªã3M‡[ÀâEpj¤¶´•Þk×ýþŽé¾á^ÝŠ%91þÁß÷nFÔî÷³‚ú¼¬tR‰ÖÕŠ¿sÊðª^Õb/ÿ©)Ó¸¤Ñ3KFIÕ”lúÙ‚µSÆŸ¬Zµa½2DŒ+ Wv/y2©ÁÅ¢-:ܧz4èH©lm‚/;•aãâÅ‹£¢¢ˆ(""orrrùòå³ù]©ªªØL#"Šâîm›3lü믿Ξ=Ë u6›ÍeÊ”Éþåˆv¶E‹-[¶Ì°qãÆ7oÞL ­K:S©R¥òäÉó?¯hÖŒQxyEÉnÒÀ»ià 鷘L¦Y³f‘$IGÌÑõ}*ñìî¬TÊ¥ƒ\5–z~£,ËŠ¢0ÆÜÜÜÜÜÜrDkøVJ$‚»»»53pˆÿ˜µ›_­Z5Ôð5«g±X¬¥3™L¾¾¾²,gÿôx.|Š)X-(š¼¬­ªH)@J¼URz¯‹…ˆ¸-!³¾+a49ç6uÙÖÞÏK(ŠbkW¡ä¬Xx™={Ù/àå”êÁË1ÎyN9 ,KpppÖ !!«Nª *pÎma"žs.Ëò£Gl­DE‹µ‘½²Q³."ý¯'˲ÓJ„"EŠäˆ34,,,kš¤'«Wþû²®!ÂE2¤À›‚ëR€”@JR )H)¤R RH)@J ¥R€”@JR )€”¤R RH)¤ ¥R€”@J ¥ §’PÈrC|ø£"Î9‘ éòrsÔ œˆ½þO1'…'•,UT|õ·rΉ1Fœcé¶c”›ÂItr-˜ßÅŽsÎËéV-IÃãR+̘ j\ r¶“þ]…eýýÐØb%Šiö:%¶VØZé4±aIf™¬{šHpÈS¢«ÍÖMŸŸòäÀ$Qk_ÀÍÍ^¤U7nŒ½%—.éö/yòƒŸ=2ecrhdLÚ_cœ î%‹kL°'û Ë„œ_ÖsÔo…Š•qÙÃÔ¿Eã÷C­[#¶Ö¯ê{>‘sChÛZ>³†rÎyÒ­?¿m·bùýu•|ºÅsn ;ÐÂÛkÍ#W9¸Ö»jƒÝ­¯¿×Ý·Ò¬ƒ9ç“©™œ;’ZaziÇ„e»v˜MD¼Dß=Gß'ÙKRÙbõ÷ƒÌúâ·ÂdÓ„æÕ‰sb®[÷#&Rt(X|¿÷†ÔŸ²y„Ÿ3úe“¦qÇžÖ™ÄÂïõn?wÃϼã—Ì,ãÏUX¶˜éÔ™óófÍÏo¼;rèèö/Z<ÖÆgKE!uÒôï?O;›4f^•ôŸ¼=€ÉúĈød£T^Ô&%$óäãÇ,åÊö®(ç¬dÓÓ§1‘Y—%ÇüÝaȼ™köø‰äµ_¯.:äGÏkJDD±{×,'â:­3ç)ŠB$O7o¯*¬ÁÇKknüdôç+7ÏìCÄÜœ©X·IG¶~ößʼ*ë#»í×ÜßžIö5{t›ÕñxµwË ¶×Ø_,c…•å~æ9üÀ¬^ÖÖòôªED\”\DAo2éž©0qVcÐOÏL›ðñœ=KÇQ'1_Ã^»¾þ‚ÎdzW ³F”5Ęc™‚Ú”èd"Û­0w,Pmÿ–EÏþDÌ8ÿ鎽6¬\™ˆÌ.oÞ¾—ˆœííͲÞz¥¯›lºMYvá»!£^62€H,âÄ+Yµ´C™ GæKúq¤^;~Ž¾¨†Q¯˜3@ à 5z˳g%#"å‘^Sªbë–›ë§ÆšE®ªnÅ=˜Ùx1ä1cÄXÒ‡>UÇì "dmÁ¾­«}úë¯öÇgLÞxHhßÑãæÖ=qO~æ±›.=Ô³Ôy/…?i.¹útõÄÓº™côº²UÝ­[Nl˜§rbÄ«xz$…E^OP#Æ"zTñ˜qÕ 0fqôèÖÀsκ%‘«?\v"ŠHXöÜ’5)OúWÛ׬ Š53ë~âr¦¡e8±ú~¡^vˆ(Œ¥À†Ø éÕéëÁãotJ¹yÀÐpF©b—ÿøv\9ó¯:ðý6Ôô2Ÿ ×ÕÚÚ¨ …g©'v‰ù3?løÉÈÎmvÔj÷]¯ímÛ7kÐÀ'òâá¿#ò/?Ô…ˆ¨§»ýœ!=×ëûõÄVnÖ&Á.µ)í=>Úög÷Ò®ô($2©ó”E•Ä\~FùзÉØÉE^Ô=<þ°Ú¤5Nïùî“2ß/\2¦aàè®;<½u‘ߎ/¾6°%}’8gÏŸZàè#wùûÛ0°[Ófõýýož<ó@š¿·=#"×J%íÃ?è6Ä«Ûg_–Jmtu•?ïí;yH‹•%+ä3…E$ôŸºªtŽ¬›Ë€¡ž#ÇuÚµ :±£h·™¢8nδ)ã¿:§ûúÚ5®Z«väÍ3¦ÊÇUµS/sëŒìªþ2®u‹O> 8»ºÌûK¼·¶iÙúRßjA§ö]OôØ؈tEjäÕü1´ïÀÃçõ÷Iÿ¡)~ÿä}ç’õ4h^ÙÃòGÈr¦ä¨;Á=*WÔôÜ ¿+:Ñè·pù’n‰÷ƒ¢’‹UªV@G1a÷#b“­c©òeE"cÌÅ;qÕªU°Î†Þ¼˜`_ºr©¼Œ›CƒîÇ¥˜}ñ2eòèë\Ì£Û‘ñ&וŠç•ÒÍ€Qlxpdl¢Ê¤<ÜKΛ;î=¡˜boüY®ZûŒ&ÆèQȈÇz;çeŠ¦D?¼ïV¡Za{zù ìQiìK”+ï¢!2'^¾Z±J%@D,òÖåGR±jeó3Rƒƒb L²+Z²t>GÉzÉÇá÷Æè]ŠV(•_—~‡Æ…‡Ç&r’ò¹—,šßÑ–+œýða¬¹²GÙL>ÛDꃻ·ãõç‚Å˸»Æ…Ü~g.]µª‹Ä#ÜI0HöyJ—+iLj§„]ºo®Qµ41Rï_¿$»V(ïîDª!ø^p‚Þ¢±s*U®ŒƒÈ‰gz÷Ÿ¸¹pÙ*nNé÷O ¹,ç­VÆ -R r*\—¤R RH)@J ¥Rð¶áCxïl‘m|×£h9îYOUyÿ]^}~gÙr3UUÆŒúÈÃÃ#×ùq|¨Ñcœl§ÈñcWüþ«V«µÙ¢)ŠÒ»Ïûyó½Öͳç&°&£aúôiî…q ¤d£èèèhrë2h†ª¾â;o]V¨Dù µ¾é·dÔ'/øyÊüysrM‘—._U¬ÉˆR•j½üÛ4:Z=cL sdóK'¶ÿ~òı€FMl¶hׯ]ånÕkõÿÊïdŒÖÎÙ{ÒÓ›}KBƒ¾ûÓüY_¡ÝxÌøÁ›™Äxùc 2~/¼ùý6Z ì¤ ¥^FŽytïJ²‰pøÍ1=Š¹Å9ŠüúÃND áÿÄFE0BÝRð®¶Äyä–±»æ 9´þ0ch ÞH‘záûn{æ}lÂÃÉ_cÄâ}?pûì/ ꎔ‚w´·Êˆ)gÏ]óí?1úòR…ˆ½¥‰xA3{{ËÝ«7Ä·4ye0RžõàÁ›­›1òh‚\²X©yk´pˆ»’(¿I?&Ër†#SQ”ÈÈH´H)ÈŽ†ÀuåN²TÜY fŽµI0:6…ÉÂŽ[ó™Ñ£‹KRH|TXµå.oߦè°Àùuc­jç=XŽ Ž‹=ý\Žýþ‰6Q7L÷!¥ »Hull÷èƒKCîÜ/çNÇ^1Óœu-—“O\Š(YDtnÿƒ‹#Y}פµW®[Zº—ÖM8ræ¾S9×àû ¾ð—Þ¥ ¿7;ö±ŠºÙ^+ðƈ†›Ç÷GÌž\*qNĈ7¨°jÌWQöä×`IUÖô3A˯v½†ÚY[WF1Ç.ï_R«üpYE^X·û§×Û—ê\»Í€'Ã~ÅpqËÕ«×›Ô¯¦ §0–‚wÄã›—òùt*éDŠL\%.snï[Á»bô­‡ˆ¨,Áõáá¿=?øÜ^%®¦Ù£Ã`þ‘ž¡ðâ†O2Ç%Ôìÿ!R7U½?ø8ñÒy‹ˆò`,ï ÏÍ=‰Ó“æ’1FäÕïT&«pE¨0ðW"RÓºÿŒ)ÞmG{R/¦Z´uG®Êù…ºµA$£<K ¥)€”‚œ*“õRXëûÆ‹Œ¿NÕ8ê–`õ¼é†€‰Zº¿÷Çk§O˜dÁµBS¿®uBö<õijŒÎoøáAÐC¦Ë_ÊHmÿZŠ‰3,ò{iݘÀ”è3§7.‹ŒŠÓ8—ôh5ºRÕ¢ŠŒºa,ïPC@dŠØ=©Þå»r•vcüºts _=ºMphþ–UcÆëK~ÓÏ\¨¡OϼZwJ>>qå73U‘¡È/«›ÄülÙß8U ôë5©FÃz÷W´Ùºr“QKÁ;ÔPØ®q1R`ÏaŸÌ‰¨°‡³ô£Ñ𘑠ZЬèW’vþú»çÐÕuk””UNœJÖmpá÷Ÿ“M”Gƒ÷…u£˜“;מj3ïP1R‰Õ,íå{zó£Lv(R Þ¢h¼{ðzù‘Ë…¸u…Sñ–:ùYÖ ÅpÇh´/]±¤¬#FŒd“Cõ£Q›—×-öÎE­[Å"ö¤1bD¤¨EêvìÚØÌøÁ›¤õFM^g ™ôGr¢ªæÓjp¡ïß±˜ô¢èJ¸@Š”‚wºò.b¾{5&ýÕhAÕsw}κsXWJÒ„$Æ?}’<'âdG‘_ÂÙµ°ÑpŸSêº>k­FÆùH)x‡†R*ÛeÈ£µƒ£b¢D‚HLM<3»ÅÞ-E]Ø¬é ˆöEKºç9ûç ™˜ ’ ‘wnÓ°zAÉ kÕ^R7—*M šî=ržD&ˆ$J,ùþ–C:Ū(šmÁu)x£Mw©üAãÆçþšâïTÂ'^ ¹rÁ®Êà.]+Ü 5K0Î4 &mÜóU—Õ£W®ì#$Ü ­<`MIGÎ9JüºÉ̽å´ß7N±|—kñJUŒ¡çc›NÝæŠI ¥àÝjCU*Ñõ·­› zÎYÝ÷œì]˜…#£²®Ä\‘›MÚiLŒ³Xdb¢Ö)¿ÎNÃUŽ¿¼n¢SåîßîÖ'=Vd•­KÄ8GÝRðNµŒˆ“ÆÁUãàúìVȲ3""]7»§£XÂtßkšD¢CÞ"™”l®KR )H)€×Â9giu©FáœD;Òhña©,-2‘Æž8OýÔÆDw÷~uÝ´Ö£”ˆsb¤u ÆP7¤¼K˜ÈÂwwûiÚ&2NÄÌ¡}Xe׶S‚ˆ ÔYWd%eå ª7®Ç2Ɖ1ÃÝõ¿ ¸õ ‹^NL>õc÷z‹Âg"‹:úÍâzÇ%YP7[ƒ5~ð†ûA’£ÎNCD¢µ÷‹¶RÇ¿7(®*Xå—•9¥uÈ#ŠŒˆ™ÂvmZ°¸ùÔnyÐ}eÙ$£3#FŒEš¶oH$Œ¤RðnÒhvŽomßqKßâ\Åó{ÞH›«¿·aóü¥m§íru9ÇS_³nBÄ®q/°î_-‘¬ øQ¤¼kÍÉÑ»>mmðœÜ®ai£ŸGy#EN¼öÛ™Ý+<§^pu&Ž¶ö5«Æxľ‰G6k9ÿ°Æúq^ÔÍö`ZÞx_•®po3Örú‡ ×£ÃÒ‰72º{3²N÷®f L‘‰1TøõÈ W‚ W¯WêØ¢yªÄP7¤¼“¸BeÆUñîÔą³ úD&[cÈ©¬.²¥V×ñ•ZLlîoX;m†™°RíõÊ&º¶úqía¿—Õìؼpç¨R ÞÑÆ@%"M©Ž]†õúkJ‡Çz…ááY_dÎe*Úñ÷ÚÎmþe•`‡®ÀkV¸‰ê|¸¡`ð×;w\fꆔ‚wŒ*§˜Œ"â*Ï[¥OËÖž[&õ‰IAa²²©5ë…gÚZãwº…ý´ù—•NîW”M6é“8q"RY>ÿ/¶wô8rè²(¢4¶«'àM¶ woµ~x;28cLUyá¦3†µ'YO ¡eU‘EǾˮÉFRbŒÅ¡éÌ“"#“‹(^Fqò¹ö˜IŸºØ„;”ë±òYÈlÆ" ¤¼³þǸLf9u]cŒ8™SˆÒàÈeOZåÞv‡™õOEƘb"%ý½Y¶½—Q°Ôÿ™Ò×È’úW–¿ ò)o£wOt÷â±}¿NO¿œÏl6«ªšá;Cn]rtq½uvï‹~Ž(ˆªªü÷·$[Ìf“!7YU”“[~¾{¦ÄÓ-ªj6™2ä± JA—Ol[8EU2/#ç\%žE¾ób­2ùl<¢®ßÅsúMY–-–çÆOìþÕS.øRUäLEGfrB—-h4R­ŠvÛ±îWU‘ÓzŠ’$nÞ¼ùÁƒ MAŠ¤Ï£‘Šhb_<bY³r]C>­[)Š’;&s8çÇŒlßòcO¯>%$į\¹2ÃwŠ¢f'—ÐÄ*‚ò²fV¹˜g‰"EÜŸï‹ØŽê5jlZ±0ÃðýÌ™ÓgÎœž½ŽÇ ‘L%´±Š,¿p$fAÑxr÷¬%Ë ¦‘R­<<<2lq/ZÌ`4¥?9çEÜ‹ªªš=Ÿ ÊMÚ´þ"•«TM¿166¶`!7zv®sÞ±c'K&c…73³ሲª\¹J†-‘QQA÷ƒÅgWMpλví–=uS…”mjEAÞt‘eYF#ˆºå\X¬ H)€3~MdY¶µ‹¹o¾ÑÖ–‡pÎå®>°¡¢ÙÚ‘iƒ' R r9Îy“&MîÝ»÷ßÛPι$IY0… ÊMEΟ?@@€ ¶TªªØxÝ7nLD’$ý÷#SÅ,IEQªU«†vÊáÕðŽÇg®¹Bn³¿ ‰¢ýÂ[Ü ©¸{—~ÿ{ÞN7-56û» µEÑrfJ]¿NsçR¹rT¾<­Z…=ÏË–ëRi•eŠ§åËéÓOÉ’î¦ ¸ 1¼µ”bŒ,?ž–.%½žž¿ºˆ”€L䯞xü˜FŒ 5kPk€wË;ÞûÊô_‚ðö+£ª´t)õè”J'*Š-¢;èÂ…L¾Ú¬íÝûÌàÛÂ9=~L²Œódd6Sb"ž·‰ädzîNä@ªŠ&s&oÿm´nMnnH©çÀz&ý5ýôEGSÚÇýš7§={pô@ÆÁg6ⓧLžL¡¡”@¿ýF..Ø`c© ­‚‚èáCò÷ÇΛI© q•Z6”R/€'wR )H)¤ ¥RH)@J ¥àÝ%¡/zvÿ©‡ Ïwê-v康©Ž;"¥Þ¦[;VÌÜ{Wû\L%èÞ )õ†án³¯ð8èú?ÑÉÏ¥¸®ˆO¨R àíyés…8ç Oz“°zà?ôôQ‚7 ×¥^DlÏ„n£vßÖ=׫O*ÐëÎþqèì#¥Þ&Q«s°·~õ„b¯AqÞx'×¥^N•-fEÍdr‰:-úúH)xWaBRH)@J ¥)NcN‹IDAT€”@JR )H)x•äädEQP¤€-š;wnXXꀔ°EZ­OæEJ ¥)€”¤R )H)¤ ¥RðΓP€—ÓëõÁÁÁŒ±ÈÈÈëׯGFF2ÆêÔ©ƒÊdÆ9G^ÑV>{“ÙâÅ‹‡„„ ,Ù3~¯Ö¬Y³ôõõõEMR6sÞ§OŸô[ƲdÓ(3~¯d4ííí­vrrJJJBM0–°vvv½{÷¶þ¹}ûö(R À¶¤ÍòµmÛ³PÙ3~¯Åd2ÙÙÙQrr²££# ’=ðy)€×¢Óé† váÂDÆR¶Èl6oÛ¶-00¥@JØÎ9cL–eQ3|ÈR¶T¨R €+Ñ)€”¤R RH)¤ ¥R€”°Ex¾@¸zí† à&¤O9;»/æþßo΋”ø¯?5|Âô*ÞMP +QÒÜ9»ûÂáKØΫø6oÖócTÀJ£%CìÃ,ùQH)€, *"<àiϲê”Àê °]H)@J ¥)€”¤R )H)¤ ¥lî6 ÿ7NŒIReRT²>Gˆs’t”öL!Ή«¤ÊœžÐC7àzãº.Œˆ ,æä¸mË©y}>êÖ¿¿9~÷⟷Zr¾ˆ'bLPN~×6(¹j÷ɳuêùe]Þ÷ùùºG&H)x;Åc§öœ/^¾^ÌÉY¼ÉŒ1"b’Ρd·ùþµË*œ¸9zߌÁ[¢¢z4Ô"“FŒØþY§X^µñ'[òç±3?¾vtÁÇë÷UíòÕrIËDÉ¡Ú¸ýÕ 3ÎÉ}áØ‚þWÖVj÷íêÙ:Hí]´.Zç<¥µûîhaûˆCÿkï¾Ã£(×6€?ïìf7É’ 5ÒBÒ)´M%ÒAˆˆR"pDPQ0("êáØ"½wŒ†.‘j( %¤n™™çûc—ÍFúw°Ü¿k¯‹0³3óÎlö½÷™y3»l•‹Ö’‹»Þ`Ô<‹t']tÎÓõ!ı9£Óµõº}² jÕŠ:w£kŸz5lÝG¨æGø¦sIë®7xjî:·(iÔߦ÷:i ê4ìmŠïCJÀŸ€tuí;fÿ¡•«FFðî%ÉÎW„F§Ñ‘F'4.t>õ\éZz…˜ N]NŠë­W™ˆl9¡êªuHšá]¾;}iž°_‹òhÚ5:s×ò,É©Ðq!ÓÃvé©Ø% ¥>â‘èÊÌŽÍ)T«]o/GšHVGÇCûpg˜4Z:³bø¡tÏΣ’Ü5…—ßàIÁ?xøBŠIX3vîʈÚTÍ£ª­G¦|’”Óc‹‡Î6\€/.¾d½žYÍ¿z†*·ì0º¿l%Rn*ùfŠÕ™ ¯. "Ù\â†\}›¹Z’nfS)W"׶¼ÿÝÎÉŽ8S\|&|妱b6åf©…¡¥q3Êæ[y^>þdÁVSnŽ}8ƒÐº–ò°=ïâ’}³¬0ZTUÕzV{à¨Öœ[=æðöãq7´ÄŒŒBJÀŸ£Ê½´ÃDž5jV’\ÈX=¦M>{>=Ô·Šm~å¶ccÂkªÌ–ì Gæ^9y\¯ñIE?Ì91U13i„½–â 1¯µj+«Žù’Þþ³”{rÍü‘Ë g¸•ï=õ{!HUí£5–”%CËnz.¬‹zá‹ÿè­DD•ã'6oj=Ašë)ŸoûñÈ6OқϤ¹µíÓô‡÷Û•}ƒ§›DÔ‡”€§ŸR.tn唂¼EC"ˆ˜ˆT™®Ø2öa±uߥ\ ž²JzCéØw×æ ݹi@ó¦å´·¬ô“¢f˜cˆ6IÌ’¦øÎ=÷àÆ/"³m»îzƒ§V-&ÎŒ=z¼6Lqš¥(äZΘ“ö«QIÈú&ý%"º1`BŸö§`p7”+_þñßH)ø—e8€”@JR )H)¤R RH)@J ¥R€”@JRêÎñE[ÿ[Nkà?ÃzþY)åè=ÿN}§Ï5«å?|gæørI!,ǧúûÔÝ“'s=Ù‡&Ôñ‰Ú¿ÑÑ<ŒîÚ'”’Þh4>þÑq¶Ë§_6ôvy’%„È>¼ ëÏo›]†­ÙÕ³’ãe¥_>í;bišF !X8oslRDø®tøËÔRlë³®\ÈÔ´E++ççPqÃù3¸„mŽ©÷8#g›À%|÷*ïW2óN»9ÿ—hÝNSJn·fÖ–ökÛ®¹Q*y?î^'ó=6*„H[=¼qâ± ù§ˆÜô]£–ž6eArrròÎ-oÄ”öò¸Û$PMÀ_(¥„5ëlLtý4.7µ[ýÖßQX\Ø»b`÷6u‚êø?×sðúCé¶NòÚ5ƒz<XÇ/È¿vL»ÞsH¶‚×M¯M£z¡a¡!ÍF}ºÔjûðž±Ø¿JôÆßjY? tتQÏv6_[8_?öÉÏéBˆŸNIhÖðÕ÷gæ "b‘³+Ì»îªsG»4 «Ýej‰'î˜IˆÓ?ÌéÓ>¦vá±£>œŸÏ¶' w—ìO^ëT§v€ð_ŸšeBˆ3붾" [//è[-ê€I9«cýð¶íŸ÷n¿ºþ¾µ}Cº w¾@ü1ÕEΈöQ-úœ_B“˜IpΗïý«aX``P``½ÆÃÞ›~SBˆì_'ÖlxF(¯Õ÷ °ó  Ÿ},S"!Žm˜Þ»]LpppP`x¿7>ºl±×»?iP§VÂõ»6ê^1jóþõ*8ç— ú}É‹>¦C£êÌÄ÷ŽI*fmZ~Є˜€§†šÊÌ̧Z‡ú/:ÃÌÌæ“ñÂOZn›=ÿ­Ä€è.§f–{Ç78a™múáÅïÖ‹è|\efÞ=¥oHÃN[ÏY˜™¯þÜ-&ì…I;˜™oojÛ/±ëê=©'/åný|Tt‡DùÎFOnŸÖ(¦Åå\N]ü^PT«E‡³˜™s¿Ò"¢ù«Kef6hÒ`@bÛ¹?ñßÈ ˜ý¹ÌjÁ‰ ›$¼›Å¬ªjIM:5³sÝèN›˜™9çxÏv1¤0sö‘#C[¤yrò·ÿnÔªÛµ<™™¯\ÙdÚ–3ÌÌêõ7;ÅÖíþ_³m«>ùö—9xýìmPùæ¦(ÿ¨…—säiíC›¼¾Ûéu¶ök6nÖAxJ¥–""²°–™ˆÎÌzç|žÿ˜·ž·³ë=))Ðœúñ¼‹DfÎ/¨^Ëß–†!]“öíYêKDdùzlj.F·ðqa&z¦ÁÐÄŽ§SæÈDD’F½ahòa‡HÿÚU -Ú7Î?›¶ñº}£¿,øNç“XÑ@ WoŠŠÐ=Ä“˜ÉPçÍqCLG¿ÎÈS‰„ÄùWkNèW·–wù{œñûmöX“¶ñkÝê³®j£)#‡Ôõò !ˆTkÓ©‰ª0“§_‹*:Ýþ‹÷="·ƒ‡¿Ý9˜™¨\TpõgÎf¤Öª:ÚöIâÂÓÕ–.ïItqéG®)åB}ôDÌdð]°öÇ·{F=èö“wg×NüUê¤%‹½Ü5D´}Þ´ò>ÏnYƒ˜I”;}¼çÙÙ¿œ·s­Ž£§L\ê®3~EVY¨àÜ-©¬Oi§Mju¥Üòo_Ç9xZÿê¾²'%C­Ñ­JaÿçXE¤þvˆ©CâsuGLphoPDÓ^ìû¬‘˜ˆä+99¼oÝ—ýwÍ´­Âz;CÎÒÝbª@$[EH³ÄD‚©ZÛ>>o1-%~|4åî™™"%®î!èÖ¥Kæôœýûo°·À”Ͳr=ß\ÉHªBáñAE»ã»É{“¯Q­Á"‚™;ô $"ù±nèCDB ›Y½ï!ð ¯f_„ÈUr±(²#£v3aþó’Í+Ÿq½sA¯ Þ™Z¶ÃÀ¶öÔªßý…¶Ñµ‹»ˆ%Ä%Íë4fuŒ§m„ùÈ‘ÛmÊÀþýí9¦Zt%ýùTt,ôÀu5Iš»>¸°Š÷ üuSŠs-B£×Y©‹ÄV1µùíÖ6?mØ‘²÷ç¥ñ_NŽè6ê›ñ‰ZÕ¬¨JÀÆѾ¥‹´–Ü\m# XëîjëΑ¦ÍÀ„5S>Î’—]^»-ßÇ/±¦–È"+JÙêÑqÑå‹·’—»m_¤Rnšû&kŽEH:]±}¸s/ý‡\Îiá¼H Ô¹ç}¿rï³|)iúîÙÿŽ¹WL1ë¼"wlY»vÃÖýûS>Ô~bÕè)Ó¦5¬atz ÊØkl…II 5ÙòÙÊÚŠuãZx;`´hÑ2ÔÇðð/¥›·§zðR–ÓÎ+Ö|“«Ñ ïø릔6À[£ì?S@äJ$ˆ‰ò®ÞuQµm=rå F/5~yèHSê÷­zLœßkLDEw½ZÕ¿A¯îADÂ60šîŒDÄä46Í7›4°å†Äo .%ß8ò믑/NèY‰ˆšÇԘܿ]G?Ÿ*­åÊ…Óé>ñÓã<ˆéýiã»Å÷m•pÄïÙJy™ÿzéÕ9#K: 5ttt„ æʾ«ML‚˜^=nO|‡–í»Ö¬b½}ù·_Owš²ÂMK¤J|é˜ÐKJŽÖS»èõÄM.”ç·lZ_£OÜèçf¾Ñ¯s`mo2e¥¿8iáœ2x—ÀÓ#åžuÌ,Äå#?n9pÖàU«KÛÆ’§ömß“z^&}ͺMš„xÛV+„|ðÇ­ÇÎe($Ê{ûÅÅE¹13 $L×ؼýÒ­|÷2QÍ[Õ*ïÆDÂœ6wööz½_òptñDòõE ÖütˆôsÄŒ ü]7ÍÈ–ô¡š‡T+ÃÌB¹6ÿ›uµºô./î—$ˆl_wô ­¡|Óøø*nDêíÅß.÷jÝ£™·;[×-\ÄA±íC«‘œ‘ºjë\Eò­×¼amóÜÙ;ãú%Vu1¯™¿XÞ¢m`eÛšw¯]zÍ£f—¦áÊýs—§>ׯo%f'¶ÍÛq¾Q¯—‚¸X~ïÇ£â†.ØÃ9?ðùßÃÞ%/üt\bç6sn¨ywŸ…snÉÙè\dùá÷7¯9çÕ§¶†ì(±ñ#/è¡+²]œó}_Ü–^)rÎ?}pX·Gßáœÿ»‡!<¼_•sÎ÷ö Ê·_çk_NéüØnÎí£};^Ã9O[ürd¿© þºSû7p€Cc^aŒ<’&e•=¸}óïÛ¶¯þy~›žšðȻ߿u7#7gäª FIÿlŸ6!D´äýå±}’37¯H9c¼§Qûåþ’Á7¿È­DDeù§wý¾“Q>Åe7>JEDAº+µÎD_'êáo?!§0žaƒôwº9¯Èܹ}Ɇ‚*g°ÞùÝ¢ƒ=ß ùß²eD¤Né•õÜóÏ|Wð ¹Ì'§ï)nND>~¥'V½»xÍäQ7ÍXž1ƒˆHòðV}2¿Û£S{vèW\^HD_ý{Y›A]Ž¯ÿ_šÄAê¥W,Ó§IºgÆTÛÀÏÌXßæÓÍiÞî“c1øþñëFæ&"Îé–»':±å‹)w=eòŒIŒ‹kWyó3ëÊiþÂW^}àfeüMÿ÷í×£Ûú|óÛ–¿ÿãÍ™·¼ð´õÁÞyï™éevrž^·Þ.qN¦Æú¨‰ˆáÏsŽLQ[Z^›6œ³øÎAò_E¤ 3T—Øê ÿð[ÓŸü =¨ÿ`φåíëg‘582 ;. ¥®âìaÍí7üñ¨¹[ g@h[9µÒ%žóÊÚÿ%Õ>Cç¿÷(çœ1Ú½esxrгFü¬[Sþ"rWŸŽ\½úšzxDDÔÖ[ý{•¨m”ÁÚöÛ3ã8cŒ\…ë7ç%èÍÃÆß7ñ§ªg‰hëÝmŸ&"¢ŠÂS‘Ã^vÏ3D´ñͱ£ûáÉ[O/xå›#5N§³äتqSî´‹‚E|<ˆ‹n—cÓdz‘[”®µpœ”š‰<ï|´÷»wN·9v›eþÄþ|{ŠÈa5>þ*·è¶Tå=²ÁBNm[ôÚà;s8í»-,ĨöÔQÁä®ÉýQew8Ìn£ÄÉCI·?s{úç-Ë09®üƒKnžv/§Ëï.(³>ŸYar8KŸš²+ìÞ»#Îúõè.],Y>yòƒçŒxÔ™*Š°ãúRWÜiáœ>Ù‘öâ”n)m”ã\R{wڱˠ$¢Ø6 •}üâþW~J_7®œ…Oý}inï s5JΔoüv$Æ“Å|üÑ¢¶ÝÃÂ_EÅ}ó—)ùÍ ]þVùsÀY5Ôûñ|¿6í7÷÷}õõ™{žÈöÒÊŒƒ]âcããîáÇ–ÞFDÿ}ÿ¡áƒcþ¥$¦i»áAýfŽ}¯Í®YóÞü駤˜è8ƸäöÞvt?‘æ‹>¦Ýk*KÔëñoGxÍØôMöÀ> ZB4ïn:¤Sœ5vžÓ¹%]ª~ÿv¿Žm8‘MŠØvx ÕŽd©íeÎÛ ÝÚpœ;‘‡ov\¸A°Æ½ù†sÎs9ì—[PªôZ¼Œˆ$·Ãæõz½pæÊ 1&¿^r;lv·J«W+çœ#ÉmµÚV¥VWé´*v&}j§lKÎXÝvÿ ‚† ë®ìÔ.³Û," z¼JƘËasº¹Î ˆ¬‹Z«W Œ·Y­gZ½^Ájß,:ív§¨Pk´j¥\ ƘèrØgý KKœxÃÒJ.‡ÕéÖé u+¯+þ÷ Yz÷æÝy¾J&LOH)h&¼jÚä»6þºîƒ•·´Ó!‘)-(¥œ?.þÁ·ý!)!H)Ô´Lx¾ ¥R€”@JR )€”¤R RH)¤ ¥R€”@J ¥)€”¤R )H)¤ ¥RH)@J ¥)€”@JR  1)wuœˆ—ù÷Û ŽV{·™1g^J çœ9~2ýïůÞÚb+¢øȯ{k±Šý¹Dt8ïxç«vÙ Ÿÿ4íÿ>|K Ƙü'VÏ»ufij_>’Ì¿ÆŒç$‡?8é¹{¾ú²§{@KíKqNæïFô=æòëÚµ«¿3½o¤ÏÛ;j#î¨Ê/®nŒX¼ðZ–Øøa-ËZ³i{JJr”N]ÔäÖiéò¥G­cœˆ8gÖ´õoo::>YM$®_»ªÔì&ª^·|U¡ »@ îK1FwÝû΄…›>¹=…sÎØ#Óû>Øuü¤‡ Õö˜»µqΉj»$õ²7\DÄ9gò,dì›7ÞN~áé賫ÍÉzo9wÍœ¯íqÞ`³‚Îó±ÇoØ9ôl7AcšõùÉM³ÚÈ%Ú¸þ§ø¤®aØwZW_Šˆ ™ÛƒÛå(âDaÃ_úðÃÙ "×ÆYÊ?cŒ;~xõ/•: ýMGŽ|Á‚f0ÆXÅï̧CÑ‘Ÿ’#}T*¯™o¯”#Æ ý2,%R«ÓúEu^¸é$cìÑŽ¾>ÊÑ~Á óyñÂÁúq_2ƈ˜”·y&º³®¾9ðþÿ{u*ó›ÈsWg>5±—F§ i;à{r#ÆØŠgü#‡ž“ŒçO^"íËïNÿ×ã^r+ÿï‡Î·¿H;@«J)Nô渄¯gJêwë’Íi«•4“'ŽV0"¥^ï¡%¢oNþDzŠb—³tÛËSFÌÕz1¥§TÜç‡r*]•«·½:é‹í5d9йë=ßÜi·ÙOþp÷Ó#zï³Ðûi%‰•âŠò¢{ÂS{xÔgþ•ÑÛ“1¥A±éÑù™3~BT>!¡Cv÷—6û÷Ý!+uùÌ Ï?z¾?@ª©©®ú“I"âDC_×*ö§Y#ÊYòENÛïà ;@«J)ÆyÿWË:´åöTa΄Á ñ 1ñm8a«×i)~ñùÿYÿ?-qòíù݃]œbm—ÄͽÚò.‘±wÇþæ*3iÚÈÍxqx(ùôx(³ªÆFDNÎÈå¾X1ÌÕÝþ·àéÄp¿Üß~<7êÇ¿%¢ ~Ï×wñÏ+‰(¶ÏÝÎ/Ÿ~¬Ï]™ŸØæŒðè¡…DŒ“R4ÂKûü/'ˆhõ7ë¢F «=Ã×Wã]—:sGÜá™w?ó¶hª®\3Æc;ô;q"@~-ý˜>¦¿É|Ç1ùWÖÚwk<â Š¦qŸúzðÈ÷‹,æêÊ*·]}™‡xQfÞi{ÖVÿÚå.gÈ]Åfê9gü”~E‡w5ø£ˆ1"å›ó‡EL{Ù6cɪÕKnºû"ŽœhU})Ƙ;+%6ú„‰8'b £—ÿä§J’ãHµ£¶EWë4öšJ"NDœlÅõ;œÝê EÛ>ï0ùíg>ývã¶? JJã ÎómTήºUqVwZ6 Ýø²3*«kŽ¾7ëÜ.T½L:Ï%/öºéÍHÕºý‡V.Ýøà= ÐÊRŠ)#Œ’ó¹VÊyÁ•î]ÌDêè­©mÿ=n‹Ï™÷ö^yPÞ³olU)/P¦8y<#"©ßÐ.í‚|¨`e‘EP*k7¤R)Ütü¸œU{~]¬Ó4\UJמ™7í2×þsX¼ö•ŸN0ÆÊOïÚ²3í|•!œ¯‹HŒ8‘Ïðøˆ'îžã1éž$vÞŒbzÏsÞ -¦/Eœ ›×¾›óéþÑ)ã&Ü2¸gû¡¯ßûþ– ‚‹v«ÕIDÏ·øà«ý†Þ:}|Ÿ[r$'5mfK]£n·Yœ.W!£{¿ôðßç=6½íí_«|ôoÌûÈ#È»âééOm­ä~cŸ‰Èz½ï-3ž:äñŸÊ]•Õœˆ‹v»UîuqM¨es’úúN›q_Ï]i‡§Ÿ¼%ˆ¶>mÂäÙ ÓHtUefgýìµÃÜ9ýë¹!i‡OOws½>·XÌ¢DD’›WVÔ{§Ï=.†þÀ5g oÔC~ùâTÖÁm{2 ¼BoêÛéìۖļ“Yñ1–/ ì>>a׌øo»ÿøHíEÎ9±?ïg"bd_½|…:¼ë®1æS»×n¹)U4çý´fO¿›Ç©ˆ±ŠÕ?­×Çõ~¦ãóç½PµWʪO.ÿõ@pÊž >õoØ:ë~©³o´jØ—bDõ®Dñº›³Î¬àü©.¼Nhž”º¤ÿŽ ü6èõuoÞBR͘Þ}nyç׿j‡š?¥8çŒ[ß}çëKv aÿüø‡Ec´´”¾TƒL:wš"€fK)€Ë‡çKR )H)¤ ¥RH)@J ¥)€”@JR )H)¤R RH)@J ¥R€”@JR )€”¤R RH)¤´FJTÀʼn¢èv»A`Œ1Æ Eݯ8çŒ1TúRÍæž{îÑét^^^AAA!!!>>>cÇŽýꫯ¬V«QœsÔR  y0Æ8ç6›­¢¢¢´´´ªªjåÊ•wÝu—Á`ðððh×®ÝË/¿ŒZº^•C€‹Ûµk׊+ÊËË‹ŠŠ222ÒÓÓÏû²Þ~ûí<ðj )ÐDÎ{婲²rçÎiiik׮ݰaCý_µmÛöµ×^?~<.Y!¥Z„ï¿ÿ~Ñ¢E«W¯®[2|øðÅ‹{yy!¨R-¥¿5bĈuëÖÉíªÁ`8vìXXX‚ )Ђ²ªmÛ¶‚ èõúšš"BP]5Œñh¤£þ3QtìرiÓ¦I’d6›#""QèK´¸NÕ¨Q£Ö®]+I’$I*ô¥ZP§Šs>sæL9ŸfÍš•——G¸ù)Ðr‚*88XN¦ŠŠŠO>ùä›o¾‘$ A…”h)AU÷ƒB¡8qâÄþóŸòòrR ²Zm›7oN?z´¤¸Øív×ÿÍ& -»ÝþñÇ;ÔùåÃœè7„=ûö¿÷óŸÀ°Ì[3ömqXjRS;÷éžÚ½[jûvíÔN§Õju*• uuýpÎÝn÷çŸþðã6RpÖ¼ÞûÛÐI݆NúsæFÙDÇ2k2önÎ<¸õôþ-Ù'§ví>x`¿~}ûöéÓG£ÑÈϪ ³ïøÁÜ?Wý)QQQQIII`` *)l+‰ˆ8Iœk ž)ýǦô+/Ý.·ËyÄí:°Í”{lSîÑ]…œ>¼;&6~àÀôïׯ¿‡‡ëZêïÞ½#GŽDU ¥à²ë …R¥PÖž÷óê;ªc¿QŒcd·:¬¦ê½æª-ËÒ+‹²+ó2Lå9Çt:M¯Þ}ûôêÙ£Woô.Iu—Ë…ª@JÀµ·©Ä9ÉúUj—_ —_ ±ŽÝ™@‚@‚‚ìV©¢8wkIÞÿ>ÛTUZ Y+ŽrÁV!ˆÎöSºtÒ)"2uYwX I’ `äZ K)œh^jµŠx#~£‰‹$‰D.Á?$Ê?$ŠsΦP  AA¢› ³²VgûbãÒ¼ÌãF ó7*h)Å{è©çËkì Ð,*J‹’†N»Þ_sâ$ºI<3Ð= 4: 4šúŒ "AA em€åŸÊÿ~ÿž¼ï>;‘¶[«R´‰ o„цФ)EDe5“ŸyÛeG4F.'Qó%Jrß‹ˆˆ|Ã|ÃR㜠&(Hî¥Vüoó¶ÌC?ß·¥¦¢¬K—N=»$wé”ܶM¢Áh4 zƒA£ÑœÝ«Ãy¤Tcí£’ärˉ:€?»_\"Q"ÑEDdðôí<àæÎn–³‡1b•3úµÂzâ·-'÷o9}`sfúN©Ý† èÛ§Oï^={êõzA … +”h¢ô¢3W¿ˆH£Õ'õ‘Ô{Ä™n™(Ib¦è>™æÊNÿ=+mGÞ‘í§ÒvEDFØÀ€þòööF5"¥š P ©ÔDÔ¶Ûv݇#ÆÈiwÚ­æc6ó_ Ë ~/É<\‘VšuD¥zõî3 _ßÞ}û†„„¢‘RM‡s"NœH©R½|ÉË—s×N0š $0rØ¥êò¢}åE8PYú‹£ºHª)k E»%)¥S·®©]ºt‰={8aˆ”¸>äц’H$’H$‚O@¨O@¨œ=uƒ5$‰Jó‹væg®úvgqþb[yžÒYá©â>Þžü±B¡@M"¥®wO‹3Ƙ@L`DTUZQY’_]š_^\à¨)á–RÁV¦6—ÇGÇvé2²SçN)))¨7¤ÀõèEcDIn²™kl–j»¹¦º¢¤,'½*/½:÷Xeqn§Ônýúö™< WròÔR àú…I¢$º]’Û%ŠîòÂÌÓ‡vœÚ·éÔÁmkMÛvI}zõ>bä°IÃaÐEzZ¨H¤@#ô“ˆ甓¾ïø¾-'vÿ–±›ÑÃ#*",<4422ÂËË+^Ízµ§^íë²g×®];wîdŒ ‚ ÑhÜn·‡‡G\\\lllTT”N§Cb!¥.í¬¡ Jr9èäÁ]'÷o;¾wcNÆAÿÀÀ ?¯ ßà N£T&öï4~H7ÆXݼkŠy¡(ŠV«•ˆÊËËËËËÿøãùWJ¥R¯×+•J•JG“܈)Ř P“To‚L ДÜj!óh2 R(I¡¢šrgæÑÝYi;3ì®*+ò2èŒî©S{õ£G¸^—Ø/Y?¼§üà{Îyƒ¹@ëÿóâYr¡ßºÝîêêjùçÂÂÂÝ»wË«ÕjµžžžDäåå5~üxìBñ”Šð”¶¿7G’¤º=&==ÝírŽQ®?›Õ6ôÁ7:÷kÊÊsËÊ“Ì–TœNÏ?y¨0+Ãa©\²U ¢M¯Óúøúøxµég0¤H’Ä9—ÿ_·Q¯kNþA’$ù±Däëëêïïïáááááa0° ýÅSŠsþÁ{ó,|÷ÝwM&>€&WPT^˜“йñ¿Úòi:ùYS’D•%eE9åY•¥–Š"si¶¹8ÓZUìãë”Ø&D£ ”ê©ëå8×k¢Ïú™'oQE•Jååååïïo4 C@@@PPP@@€R©lðbÿùë§Ôy?f—Ëår¹°4·ûšÎ[ÔNÿ*<¬ÛEÖš Ku…¥¦ÂTQZœu´ø䢓kÊ Ã"£ÂÃBÃ#"SƒÓV’å¾QÝ—Ýáp\¼qh”4’·(I’J¥2 ^^^‚ x{{GFF†……Ÿû^fÛÁ”€V†#Ý¢Ëåp;ìn·³,ÿtVÚÎ̃[³ït;íѱ±‘áaÑÑ1aÁÁ!÷o'uoS?$<4½›û =¦N¡PhµZùÑÁÁÁqqq‘‘‘W}$ H)h~gŸ sÒ÷œØ»åøî_O¥íôðôŠŒ‹‰‰ñððhïEíûw¢þ꿽iNÓÕƘF£EQ­VGGGÇÇÇGEEùúúâ£DJ5ÅŽׯTwÉa“NøýøÞM'önÌ9‘à¬ÑjŠvC{*Gô!jê'6ÕVÎ9W«Õv»ÝÇÇ'666:::""B¯×+ÎÀ¥R×WbbbýÓÓpý=½Ÿ~î±´u‹¢BüÃCCC‚ü8×U&ÝÔK;vP]*P“\¡i0–A^¹Ëå Œ‰‰ Ðh4:N«ÕªÕêïÅ$¤Tu¡ÆŽ‹ É<õÄìúÿ>>rÉã¼üüüð֑݇RÐêÔO£º¨ÓjµžžžžžžJ¥Ò××7"""$$ÄÏϯÁN€”€ÆŒ¢T*•N§Óh4 …"444&&&""ÂÛÛûrÒH)¸¦L’§m•ç×jµ¢( †èè踸¸¨¨(£Ñx9#¤ ¥ ÑÈS3øûûÇÇÇGGGGFFªÕjAA`Œ]hœ7¢è2ÕÉÉÉILLD…\å^ŠÛ•nØ^”(Šõç¬#\@jTn·[¥RÉ÷u=ûì³uu+IR·nÝÆŒƒ*ºxxFS· –®YýËš5kP9Ðô©…~RãR*•sçÎEÑívðÁõ…èK5Õÿ¶‹¢xòÄñã'NžÙË/D¥Õ«µ:µV¯T)‰'"~þHkÜ”Úùñœ¼]·Äív‰nQ£Õâ[ ð—d2™rrrž}öÙ•+WºÝî ½ìÖ[oýþûïoðºú‹Œž87EŠ ìß·ëÝû÷ïµXl:ß0•O„Î/ÜèêåhŒ½ePêc}<‘$QíY»z+ágÏÃy]e¸Hå’÷¨iº\.—Ë%ï²jµÚ`Ðãt,@sÉ3sáɵ+—É㥥r:O<ñÄŽ;Ž9R×—:ï促Æ'кûRœóŒcééééGÓÓs³2¤²H³¤q3H„_HL@xl@XŒÎ(œÅÐ0~ZÈ_¡T1†[×ZbHÑίßxçùÇt:ݵçÓž={æλqãÆ¿ ›0aBTTTTTTdd¤ÑhT©TF£1$$AKìKÛ1ª¨¨(ÈÏËÉÍ-ÈË+.-+(«Î)ªÎ/­T錑 É¡ñ#º?Ðwr (RÝ ïú+qX[ø×€‰nìŠ-óûIâµ}?嶨²²òþûï_¶l™2Q«Õ&&&¶iÓ&))I©TFEE¥¦¦ÆÇÇË·ZczKL)·ÛUUUUYYU]UU\\t4ãäáŒS‡ÒOæåæ%tìÞ¶[|rϘn£#ôæ¦."IÕYM ›~|ºÐŽ¹·oßÞ·oߺWAAAÇoÓ¦Ó锟Èåt:Oœ8!ßüÔ·oßàà`OOÏs;p7`z5CJ9N§Óép8ì6ÛƒwíÙûûν{÷ìñð HèÔ7¦S¿ÄN}‚b»ùEQÿ¡ÔW:늗ÈnÆž­¤'ÆØÚµkGŒ!ÿÓÃÃcæÌ™F£Q’$§ÓYw<]ÿÿeee?ýô™ Øh4FDDèõz¥R©T*‡ ¢P(šëÏ‘5eVE ¡Ië° ®K>}zÛ¶m[¶mß²uk~nnÛÔ¾zÇwê›ÜK¡TŸ·÷ƒÞ.´Œœ¡?¾û×{/=¡Õj¯´Qâœ=z499Y1~üøÎ;_~“{ÞWÆÆÆÞu×]MÛ$¹À9³ü2#ø?mÍÿÖºSªwŸ¾ÙY™a1I½cSB’½|ƒ¥J©R«ÔZ…RQ7¼i-?¥V¾óøЮq=öØU¼;  ¢¢B’¤3fDDD\Q‹× q–Ï öë×鍊njÚ*¨áóXAù(#q·Ýì<ôê¦Ü|ãŸñû~ñwV«­ººº   ýøÉ´µÉ8UVV—”Ñ®{lR·˜ÉJI"‰"InvñÙƒš—(‰f³é*Þ˜ŸŸ_VVFDþþþ—Qr2Ésß„……%&&FFFêt:Æ­éУ³_=p4³Lw{ŸXym+>~ድûŒa©ÿú÷óáZN®Šñ·>øÃò¯Þ|tÆÎlç¸ÙÿºH"*ÝòôSGï}!aËÜ÷–kBRß|ï…gŒ‘”óìÃÿ8˜opÇßžšÒC^'/Ø2ó©w ÝÞ¾üÖ°6> gŒ>¥W¿:y¬ùã&”0ñ‹°uïÞND5Ç~™ó‚r—çô肋7­xï®ôöïõÍ}çõeûÂRFÏùUcôC?¥"""ê:Iãë-/--ÉËÍÍÎ9U°ySIYeQ…)»¤¦¨¼Æà韟‘Ð1 Ô[Ir“2Õþ{Ù¬nZgEú¶ïçÎê:óW½ÿ|ß•§›ï¬LKŽé:öŸïß5HýÉóãVnaÓü™UÇ¿OèüÐܷߨ̻¿{ÔÓ?gŒ{üŸŸþtÇ-O>Û7@-:µ=Ññuÿí>åÍþ÷­`^úÐÀÈô%{ÿ14¡8çð‹o?4bƒ÷uxwΣÅ°í¯Žn‰}©ÚôœÏ# 0 °s—ÔË].×±ô£GŽ9º~íá¼· ³1½é™Úéíá©Ö™¹õR“·´u#ô.r¯•|ÏÓÓ³gÏž½{÷®ß£ªGzï–© ¯l}mvgNÔÎhŸ³äkqÔøw÷UÉý2@àtëdWaü³óV¬xµ—ø¸Ÿö<’¤#týçû¶eR·vDd9Y³tã³jÎÇt¨z/&¢ÕOŒ‰xéð¿K ¢É·vŒÐNØ?æ’I÷ÝôÙÉ¿Ýĉ¼J²¿Ø°v拽$Þ¾gP=9Î迳Ÿžø~æ“ÓB‰h”ß± »_y2ocÌà›ôõ?ï#¢‘>ë4¦–œR—ìÕÖÅŒJ¥ê˜œÒ¾C’Íf³Ùl.—Ën·WT”çååïÞýlj5Ëv—ådŸf •dÛ€˜Žþm|‚# ^¾Fo£—ŸÞÓ@T;Ùkƒù#šÑE®ú×ýÊÇÇgÈ!IIIõ_Ü°í_g/Nˆ#âŒSÇñsO…»ßT+»{3"bœ¨ÏÀqß­^OŠn$('ÆÔ>É^P«Ï¬Šó3ÔòšU*‘sÁϦÂô{úýȈH$'mK/Zœí³lb¼¡Qó>EDTsNñ3Ö üiZhíŸ0îɨÛû§»ˆ$W`òÄ3­„ÆiŠ›:¥Ün·< Óé,,,ÌÍÍ=}útQQ‘R©äœK’$ÎÁ Vk:$%wH"Î ‚ÀAŠíÅÙÙdåæäæäåæeE&DuìÑ®[x›.>jN¥Ñ©4Z…RQ.>€B>ÅÇwÈùt±ÃkÎ]r1.¹mNN¢›H’›7FÄq’άü¼›Tœ½Xr¸Ï®Þv›O½eÎÓÿaìÏ ¹67éÏ3Ÿ¨HŒ¤ÚMË…—$NDĨñGÉ_÷”✯_¿¾¬¬,77×f³)•Jù.úŸ–|¯µüÄ°‹|¢rŒ‘ 11±11±g¿¦€Nä—–fgeågge9ŽøN}â» ŠëÔ'²mª P0Æ1:{^ó–Ðýâ’Ä‘¥-1N„F-·9½zõ>|øeµ?JÍÈ öѦ¼ÓÛ£cKß:D÷‡Uv)@'Ñï;‰y‰®`8í½ùÞÞ{ÛK©DD«½‚ç¦;Ó†zW½»©êÓaÞÄhó¿î~àTÛã_>qÎ{Û ‰*ühiù§ýˆ˜eýüÏAmÕ´ÿú|MÑ—êÛ·¯$IÅÅÅyyy'OžÌÏÏEQ·Û-ÇÏù;¹WÕ¹ö÷÷÷÷÷O=³D’$Iª¯<}xiaaQAQqAIEA~®htBçþñûÅwêãP7Å_³\ñRièí{xiçn²å0›MzƒAh…:]N·Ë¥×¨u²ÛmŒ 2Û)\Ir+’#1¢ …Ñh¼Üˆ""R¾ôË‚˜NCÈüçȨŠ¿?õÚ¨·¡FÙR;}åßs÷ß7{ì+œL΢Ë/É­_¬|*ùæ‰æ'îíëóúÓsû?úv(ÑkËÞê0¦³ÿß_ê¬84÷íeÿ”G$1æ\ùóöäñ=ÎŒè`O½ýbÏzø¼˜ª8úÏW¾}aáýõ;Ph–ÙfåAìv»Ãá°ÙlEEE¹¹¹YYYjµº®ÃÔ(éÕ O&ßáírÉ[w:v³É\VY]iv”W[¬VkLûÔ¸”>1ºGwHR(åáò×wȆJKŸ>:|Ì°.—«%W·mÛÖµkWm+|žHAAAaaajjj+m%ÓÓÓ5Mll,£¹hµÚ¹sç^é»vïÞݽ{w"š:ujbbb]ë'Bbbâ”)S.³I‘ì"çðŸ.DD®Êý“∨¦ ã«…Ÿ§ˆ#o»gT¿JÎc…ÇwöÙWE<`ÚŒû{µ &¢Ü?–¼úÙúi¯Ìï£-:T¤II"âyGw|¾ð»RpûÝ÷öjΈÊóÓ«XT\¨žˆ¸5ï`ŽªSÛ ÖšR jÿ¬Ã^§Ól6×ÔÔX­ÖšššÒÒÒÜÜÜ’’—Ë¥T*å Wuo¹öØ œy¼!缦¦Úd2™LfSu¥Õávp¥“´6÷ðöOLOìŸîívÕNk{í#æUZúôÑa£†¸ÈcfRטREEE]ºtAJ5«ÕZ]]ýטқs®×ë+¥ˆH’¤îÝ»=ú ‹ñç'ùZTý%gÿãjàÚœ½ùî­?iôçϼþèü«ÙøekæÙfϵZíëëëëë{î‹«ªª***ÊÊÊL&“Åb)+++))1™LuW³ê¼¸Ì“_VÿT›Á`4ŒÁÁµ¿ΰX,e¥i9ë6ïÿ¶¬ºªReðUyª=Uz/¿àˆ€ˆøÀ𸀰(•#æÈd2eggãÁɇ+o-ëý|Î’«J‰³Ú'vž•;{I½70ºÆ·–”º"ÞÞÞÞÞÞ111 š~»Ý^\\œŸŸ_RR"g¯ªª2›Í.—K¡P4?sE±!ßg'Š")•ÊàÐàкî—BA ÆŠ‹ŽnümqIa^)Ô>añ¾m½Cb½Â<}=ý‚=|<|ŒòXyIˆyøëcgQ¸!RêB1£Õj姇ûbyÈFfffYYçÜn·[,– X»ÒîW]ÌÛÇ×ÛÇ·]ûv¿5Öꢜ´ì½yùyù¹™!ÑíÂÚu KèšÐÉèí§Ñ5:ƒFgT(„sïlo™O§”GZ¶ÆãÖVZòÖ[óu3ýÜ°]¸qSêŠ{ÙÜd2åææž:u*;;Ûb±( »Ý.ŠbÝT%W‘^gu¿ˆÈíV(òˆyyµg†n”²üߊöåæääegž9‹m°ŸÄÄÄõÝÈÎÎNMM5þ)çt:ÕjuËß Nœ8¡Óéä+2y|i3>ኸÝn½^ß©S§º%òy‚ú§¸[šììlÎyý:oÕT*Ò)Õ¤<<<Ú·oß¾}ûúÚrÀäääœ8q¢  @n\.;ÿ™Ù+ëÿÕ?º §‹’—4èá…„„Œ9²EUZZZÚ°aü¼¼ê–lܸqРA-ÿãÞ³gÑh5jTÝ’ŒŒ ¥R×*vW‡Ãáéé9dÈúQLLŒŸŸ_‹-óáÇEQ¬_çîÎa"¥šG]/‡s®T*cbbbbb @D’$¹\.§Óér¹ÌfsAAAvvvvvvUU•V«•Ç¯}Àa+Úõ[éyÖ~ºï¯Áb±H’äááÑz |ˆH©· ‚ Ñh4 çÜ××722²gÏžu‡·V«Õl6˃5ŠŠŠrrrJJJ$IR(>b µ+,,t¹\íÚµCURª)LN/ŸsÛ«ªª*+++++-KuuuII‰«ûUïÞ½Gír¹Î}r )p3Iæt:Ç?þøÈ#8Žº‹OjµzæÌ™¾¾¾çF”¼»ÝŽÊDJ4r21ÆœNçºuë–,Y²jÕ*‡Ãa2™t’î½÷Þˆˆˆs#­¾ÈÈHT,R  0Æî»ï¾E‹I’$IÒ…^Ö¾}ûáÇ{zz2Æä|:oD1ÆDQìÖ­*)Ð8DQt»Ýç.÷÷÷ïÚµkTTT@@€Z­–$I>éw‘ËNœó¤¤$T)R  ÑLœ81((ÈËËËh4êtº¸¸¸¸¸¸o¾ù†sîv»åær7ëâÃ"8ç!!!·Þz+ª)Ð88çcÆŒ3fLý….—K¾Š.oÀç\’¤ÄÄÄ;î¸ã"׫)pe®%Qä@✠†áÇ'''#¢Rp 6›MÅ+ÿ¢’Ãá°Z,Jeí>#‚Íf³XÌ—3ó‹N§S(×Xr—Ëåp8®îOv8f³¹n‰ÕjQ*•õ—\ˆZ­V«ÕRóN§³îèûŠØí6•JU¿´6«Õb±h4šK¾W£Ñ¨Tªk,¹Õj½È¨ ½åœ:·º\®Ë©s™^¯„:íÀ…¦;ªQªî5J¥²sçΣFºöÌ»A0»Ôfèˆ1ê°N’èn²-VW”LœúäìG®q=/¼ðâöÓfAP4Ý×CP¸«r]öe£¬í¡‡Ͳ{qIl²òsÎ# öοÆõtí38 M¯¦,yI^Ö¼&´äë7ß}÷ÝE"G¡Ph4š &ÄÅÅ¡ÿ„¾\ȸÁ½âr4Ý ³2ĬÕ×¾A!LxäUA©jº¯‡š~~ëñÆZ›Ö`œ<ó_nWòKÒþ¯þvíë ïxóœ¹MWòŒýÛDwvKþ‰¢(ŸÊ«L ‚Ûín׮ݠAƒ|}}åÎ." )WØr5qÿ¹ûëMÝõç^M\|ÞJKN-þ¯¯o›6m<== ƒÑh ÔétƒA§Ó5ØWQH)€¦>ð ¾í¶Û.ò„ScÁœèW „¾üÕ8쎪ªª³ö<¥Òh4¶ü’K¢d·Ûìö³®ãyyyµ–vÊår™L¦ú£:FcÝ@ÍœdµZì3žžž-vÔ ¥ 5wضïÀ¾… 6hèï½÷Þ–_x“Ù´à“îz­¼Óé|衇<==[EågžÎúì³ÏꮑH’>eÊ”^l… Ø¸~c©Þà{›mÒ¤I‰‰‰øB!¥ÿÀØápÔÔÔüÙA‘¤àààVQt.IÕÕÕâ™»…8çu—Ç[·ÛUSSS—Rœó«¸[®YúR6›­þ>#Šâ•Þ³‘Ã\T ¥R€”@JR àB8'F‚¢á­`"¦ QýámDµ…oUS,×~­hbhN­f'¤´rŒmz}î`ߧ‡øÔý7··v_YK¿§•sþù¤ˆù_­W*Ø™?…¹ò?yº¿_…½uÍÀª–ß÷èø{UúVSj5?ü|gý¾jLÐ÷KÁ¥ÚHA© ïòÂg¿¸E^w¨,¨Z|±Ý:³ïK¯ÿÛ4}ˆŽˆ££ï½¨êñ¯ž¸D­¨e •ZÓºn”})hÒvR©ÒÔþ§Ö­ gCß Rm>v¸š'ÎÉY¾2zt4µªˆ@Jüq.I1±m÷ìZ§1f-ÝéRj; Oþh=pÆ.M²¯ùô%IªmÜE)pÈ̇4-|žƸD#&õúç›ßZœ¬qSáÏO+cŸÖª'ô¥Ð—‚¿TL‰6s•Ý\-ÿg3ÕðÖÐÌ3Æ=nz9J\ñÇ~»Â]¶jY~¿§f0DúRðW;–ñ½eöÏš¤ÔÝ* ÎÜ.¿v}»_÷UO}X±GT¿DÄR  …©ÏÐkÿ³ñTœÃ7êAâ„ç×´®£dT\FŸä<ÝÖ1qÏþ³+¿ûð÷”Çž ŽˆjÒݦî1€¾´6\tZ²vým`½çêŠÖ.š|kR«h)].Ÿ”a©'78'9[çGà¶Ûm­kø¼$ŠÕßßbüþÌ¿mú)o­ýLáÄ÷ RÐÈ $ôÿÞôs¢‹D±uœ<ã"ïñØÆ^³Éíh¥§û¸÷„…M"—…·–ÇØ;YÒ‹{ϾtÉItàt+ ¥ ñ»"Œ8‰®óÿ¦•üŒK$JÄZkɨµ•ŸÑùöD\\—¤R RH)@J ¥R€”@JR )pù0Ûì §8?gÓÒE¢ëÏÙ@A„˘ ”1FŒséJ·XYZØ(ÇCN‡cËòÏE½–‘R¡¸ä9çz£—ÍRsÅq •Õlj¬š·˜j6-ýBë& ç‚B!\ƬŒ1A©]WüÜ Î¹ËÕOË(È>±iIý’“B!\×Ùo ³Ox0CRꆴðÿÞ5›Îjyÿý÷½{÷^²Ñ1›ÍĘÑ`¸Ò-‰|S:\{ÉçÍ›——›S‰ÕjY°àSA.ÙÊóî7Ó¦MãWþ ¾A]DIj”šãÕWŠ‹‹þüî)•kÖ¬9zôè%kþøñãf³¹K—.W±ÑA}{ðk~üà ?°ÛmõÃoÉ’%EEE×o/MÐ3¿Èø¶RêFÑ`In^~NnÞ%ÛúÀ ª¨¨ðõõm®’ƶíÚ×_b2™ƒ—êNÙl6VÌ›õq±>¾¾>g×^ø‘£%¥e—,^~Ä) 0¨¹ÞSÿŸ’$…„†‰gx\èSÃÈÊÊju 缬¬ÌÃÃCqç[¦‚‚§ÓyÉäÜèöíÛ×êÚJÆXfff=DQl•_QAE‘s®R©°R àb’ÀÀÀªªªF9oÖd}2•JUYY¶jÕªVZíÁÁÁ^^^Í{Æ)ÍÙ^Mœ8ñèÑ£‚ ðkCDV«µi Ÿ‘‘e4].×eþ¥/¹Óél¬’;NÆØÅ·¸hÑ¢äää^½z­Y³æ’/¾œò7JÔY,–KVæµ×vƒµÁ‰áãQÇev€&OžüÁÈI#wS®b£ …B£Ñ\{>Ùl¶‹¼@¯×7nùòå6›­´´ô7Þxë­·8çZ­öÃ?|ðÁ]õFä_>N×(}A—ËuÉ|üñÇ<òçü£>š4i’ŸŸŸü‘¥¥¥uîÜù*¾¿jµZ©T^cµÛíö‹oúûï¿ONNn×®]ƒýçàÁƒ©©©WWíZ­çn@ã¤P(ôzýe6O+W®|à>ùäyIAAÁe¾÷ºd1v¡­Ëmè믿þÜsÏÉ/‹ŠŠJHHp¹\žžžDäp8T*Uó^ì¹H8猱6mÚÈW"š3gN¿~ý¶nÝÊ9/--u¹\:®¹ªý"›æœK’´jÕª{î¹ç¼‡DÍ^íкàÀ®¬yâœÏ˜1cöìÙòQyZZZ‹-êï¿ÿn0RSSëZÏ9sæŒ=Úb±TWW_Ýá|Ó#jÚ´iÛ¶mS(Œ1¹ë¶xñâqãÆ1ÆŽ=Z\\ÜbK>~üø~øá¼­ëz— ¥ˆ1Ö£G~ýú½õÖ[J¥²¼¼¼¥4–˳ÿþO?ýtÖ¬YuÅ“#vëÖ­ãÆÛ´iÓ€233[ào¹¡æ™gæÌ™#ŸY­öÒK/½ø⋇n)+—|ìرüq]²6xA#^„¸*kÖ¬yî¹ç²²²L&SË)•$Iœó;vÜyçuÿ<÷mÚ´)..þî»ïZ`ÅŠ¢8kÖ¬C‡[xÙÞ½{§OŸž““säÈ‘Uí‡cÀ€ååå*yZZš1ÆfÍšsúôé‹”üàÁƒ Í[É€3~pƒzÿý÷'Mš´jÕªóždk‚sMÅÅÅ#GŽÜ²eË%·~àÀ’’’º7fee-X°`РAòÐê&.|—_~yÚ´i555)ƒ¼ü³Ï>“Îàœûí·ƒ^±bEså{õÕWï¸ã›ÍvÉ’Ë»Àß*‡*€ko­\.×’%KŽ;6qâÄyóæÕo›®kÉ9ÿúë¯SSSýõW§ÓyÉ–––îÝ»·ÁJ6mÚT^^¾lÙ²ÔÔÔŸ~ú©)›øòòò±cÇΛ7/++ërÞõóÏ?[­Ö5¿pá£GNœ8ñ™gži‚š—¹Ýî &<úè£ÙÙÙ—³ÅÏ?ÿÜív7×A´j¸«§G^RR²mÛ¶‰'ž8qbéÒ¥»wïîÝ»÷ìÙ³å9^åS¦Lñ÷÷¿œ’/Z´hÒ¤Iz½çúàjN†#¥ ±”••mܸqòäÉu×!-Zäp8ôz}—.]ºuëu™$gLzzúºuëL&“Óé¼å–[FŒq9­°ü‚ôôô¬¬¬‘#GžûzyÉÏ?ÿܾ}ûº®Y³féÒ¥Z­Ö`0ôíÛ7%%%""⪠o³Ù>¼iÓ¦üü|›Í–””tÏ=÷ÆË_ÕÊ•+;wî|¡i>ìvûÒ¥K§M›&ÿsïÞ½_ýµÓéÔëõC‡mÛ¶mTTÔ…ÊvIééé»wï>pà€Õjõ÷÷¿ï¾û¢££/s=œó¯¾újÊ”)×>Ï ¥¡Gåv»¿úê«1cÆÖoÅöíÛ÷óÏ?oܸ1"""<<<44488ØÓÓÓÃÃÃ`0¨ÕjƘR©t¹\N§Ón·›L&“ÉTZZšŸŸ_PP™™Ù¡C‡1cÆ 6ìJ›ZI’~ýõW__ßnݺ]ü•;vì0™LC‡•'*¬[ÿ† V¯^ýÇÄÄÄ„†††††yxxÈ…W*•‚ (•J·Ûít:N§Éd2›Íeee………………™™™žžž£G?~¼‡‡Ç•ÖjIIÉ/¿ü2eÊ­V{ñ?ù‹/¾6lXhhhýÂïÚµkùòå»v튌Œ «+¼N§“gKEQ>yh±XjjjL&Saaa~~~^^^aaáðáÃÇ߶mÛ+ é¼¼¼_ýõ¼3P ¥ Ù‚Š1¶~ýzÆXß¾}Õju]‹yn®”––ž:u*//Ož B¡P‚àíííççy‘ÞÉeveòóóW®\9cÆ y‡K¾KÅÏ>ûl̘1r¯å"…/))9}út^^žÅbq:‡C£Ñx{{{{{ÇÄÄÄÅÅÕý•v_ä×;yî‰^æÖ¯_/ŠâÀë×ü¹òóóOŸ>]\\\]]-I’(ŠjµÚÓÓ3<<<>>ÞßßÿkÞétnØ°A¯×÷ï߃ú)-Ô?þÕ­[·¦l¤ä6‘sn2™V¬X1xðàËo(åW–––®[·näÈ‘¹õ纒$iûöíÙÙÙu'ñ®èÏ_¾|yPPP=ä › 'ê6!—¼²²rìرÈ'@JAKïT‰¢¸råJ³Ù}ºŸŸŸœXWÑáœ×ÔÔ|ñÅݺu»ÌÑRcf³ùûï¿ŽŽ8pàÕ=\X^ËåZ³fÍf›4iRƒ˜×ï³þá‡<==‡ ¦R©Q€”‚V“U‡£¨¨hóæÍ^^^7ÝtS#ÞBÛàÒ×Î;SRR:vì(Ïz~-›¨{¯Éd:qâÄ®]»:tèпÿs·Û(å/..^·nF£éÓ§O```cµò‡#??Ó¦MþþþÆ Ójµ^ó6›míÚµUUU Á( @JAkÍ*"2›ÍyyyùùùEEE!!!qqqõÇž]©ššš'N=zÔÛÛ;(((22288¸Ñ;=uk+//ÏÍÍ-,,,))i×®]Ýæ®"P‰Èåreff9rÄår…‡‡‡‡‡7z_?ksrr JJJ"##ãââBCC/T¶KÊËË;qâDAAAPPPhhhdd¤<^ý'@JÁ_‡Éd’}—ËU{‡9‘Á`0 z½^©TÊ£þDQ”þY,³Ùìv»ë&Ûöõõ•­5nÿærb¦¼¼3g6†afpqAEDÍ7”4I4M[4KÄQK­ô–ÚMSs/û•7³ò^Í¥ky33û•XJ¢i¦ÞÜeAYf˜åœçþ1ˆÃbY©h~Þ/^¾ÆgÎœ9ç9Ÿó<ç9Ïܸ.H)¤ ¥R€”@J ¥)€”¤R )H)¤ ¥RH)@J ¥c¬ÞB'ÔÀm%  ê²Ùl³f½ õðP‚ÉT\ëY…JyøÇSgÏ;ìöÞ½z >G·í4‘sŽZ¨«U›vß9 Piê6§œŸ¥šÍO óÔã’$‰¢8cÆ wwwÔÀ­…?€ú?vdã‚gE=ÝzŒ1™œ}¼lö£C‡ˆ¢ˆº@JÜiŒ±iO'<¸¯îSœóì_ŽZΦk4\š@J4LJ%%=ràÃ9»­VǸ›Û¶x|ÿþq¨%¤@ƒáœ³g÷Öei «.!¢wgOìÛ=Ún·».,—ËQc·Æ&üZsJ.—é~dïî6]ú9‡ž—_-ö¶fëtÑ® ,ÆØîÝ»A°X,={öô÷÷Gí -p'‚jÒä)Ù{× Êª±¬mÇŽkõÊd²C‡eddœ={p+?ƒ‰ðë8çWJJº>}ÍîÏß{­¥G™J¥ªwЄÃáHIIÑëõR€”¸£¶oßž^èíu)]’Ä…YlllLL ê àBÀM5§dg>Ÿ3gvÓ¦Më=·ãœÇÄÄà´m)€† *ƘóßE‹™Íæên=ç‡hÒ¤I:€¶@CœÐ1æü—sž˜˜èp8\ŸŒŒDD ¥îŠ¸jÑ¢EDD„³ Å9W( è–@JÜ-FŒ!“Éœ€ÉÉÉø¤ÀÝeÈ!œsƒÁ€¾>€ÛsOÀål|ü5ö¥mÛ¶çÏœ€_Àíƒ1~p§ ”ÀüšsIú d.c2Î%¢{épÏ%1Ìè»zÑ\ü)ÚRõÐ7jÚkòRÑŽšh;ÿþ½¨@JÜè\ž‹¨‰†!:p‚÷Œž¤Àï‡?€ûç\’$Q¬1m® õH)hxÙÙÙ .tß«ÑhÒÒÒR€”€»¢-e·Û]SÊËË ÕH)¸[8§Î­-Tܵ0zRH)@J ¥î !àuž¯nàú€×ZnŒñ¨¢P_Y;,ª»¹<úVÊÃîó㻯ÍꪯšýœÉXÆŠ‘•mž›óÒá9­¾T­ö|wÁúíkIG}ò³A‰º@JÜjŒ$sqvë;¯*ýšYÕžíÛ‹G×­ëöÒhNŒˆd*:™±½ÙÈÙ‘f“E´#›ùj‰ˆ¦R àv‘DHChÍ2EÄ&ï]¿‘)Æp;粜÷Oeõ°5" àvÃu)€ß¹±Ç`áâ—ˆs"Æ~|ï#uïIMÜP5hKÜÑÓ6¡øøîS¦ë¥ ïî륕<"ô”}»rs§¹CIÎœ<3f•ÃÆIÀÄwH©[q.LõN£y£òØ@Î#â®ßM~­°féÖà\¦ÖÕÙÁêuB½˜ >óé¼ñŒÙféí­–+™2¢[ÿ ¬Înï—Ž ôpswS{êLûˆ1Æ.¥2F¯ÓÃbPz?ýæŽI¶ ð÷Q{“Wv¾cd¨ç°»î¥Ë`ŒÛìôÉ06¡ÝõŸ1±Sdjæ _MPyi¾5ôo~×/Šf“Åb'"âv¿´¨óõ×&?ô²$CƒàÏõ3Ý?»j;ùÅKr"'¢ËçîiöÈ—©‘Dôꨄœˆ {ÆÙ–?ñ@ûÁk²v¤¤L™’ôι‰DöÔ¶ú©ß”|ØÏ7ýo);Uý**ISÛ<öA֮ў3¬÷UÞȶî¾\ÑñÙ'WŒûIüyYʺ3{O—Gø°Ó;WtÝLâ?™²rÛ¢gOgm2 ë§õœ9sÚ7' [ºÑ”^­ïÌì5)V®”½öÿ˜õ­ŸÜ;®oZñéTw7•ì›3{xø’µ±†}ôbïQ‰#²ì~¶Ó·åýóß{“8oDÏjU­óú©ÏÏÞ7\ëóŸø¤„î=bz8¬IÎùìí»5MLïLd“«*·ŒQ.ú¬lK¯]‹‡l·uͯüFC´yÖ Þñ³Š3— —Óc§þy–i`ˆ‚J2Z6ê³÷åÇ{’\Q|áÔÀïr×…›vMm5tè ÿ>SkÌü0mØ/Ò¤]D´aóWJ}ø½ôbñ›q€³ÚÉE3gŒ#.xÏ?ha"UVV B‘ì¼ÓÛönœ*+¹MýÐ’£bÖ)'«™ãúÚR7E2_¸pÑ)'¿°(·ˆq"*ÞñÅ™¤¡=2333ëž„sÊÊؘ4<5Ÿ<ü<¯*|ˆˆ¨ë‹›ææOõðùó9Íû=³åÃ¥M=¼vn~kä´Ù1¯œ/¶é|°eò ¶?äQÖÖUi»”œ“GF“M$"’+®asÆçLºvê-‰²ðhgΞ$¯¯ªôú];¶Œ|!ÿs§«dÎu*£;ŠeåE E„;söç‘!Ì_¬uA_¼”ëehÔ9nx—GQåÏë#úNxЀq}jÌ4'Ú(ˆˆ ÿ[ª¹°0u?IÎ#p£èpn'F¶íËÒƼô/ß½¡B’WÔeÕM™ « Ï ¥þä)3E{óS…•DzwÉ>wëž~Þœãö²¬|s ªøø'“?¿ül'O"Ú¯û€ˆˆ*ÍåãÞتˆh͘6]ºÌÊ;±@ÓnØžŒÑDTrdchÿ„9ç[è˜8nå?ŸèÈ9g$åfåú5RÒ÷¿q—É¥Ó‡ Y Ή1Ó“Í/r®ýšÂuÔ|Þ¦U±AœsFŽì‹ùzƒêMÑ~¼Tlæ&pN¬àl‘\Qs•Ž1ØiK‹ª&¡Žx*¬Ù‹ÅÅ…DÆ Vm—w°Ú1xÝž”Æœ1^y1«ÄèK§v¬~fí‰Ëæg&õÐ+n¦’¯ßì…;´àO¸ïJtH”[l#2ö‰Ó/|áMgÃfE|˾?JTr¥\æIDdÉy1CîL¶c÷œºÆùò¾=[ÈåL°h²¯ˆˆÈ§Y{AäDôü‚A;Sžú¥‚cyûßoÛ'‘nâ(-Shö¼ñcŒm?ð„~ro¿ê'³^Û4<±ÈNŒ±ã›æEÄO~ (ž‰{ÎJÄ-¿J­­uΡ8¤ß┥ĜÙ|%}þác–ž½ÚSýw {=Úaõcc‰1Æض‰±'n’•–—yù9ÿPJ÷¾rêªÀè·MŒ±u«n;xhKÝD&™ËË®bŠøŽ”0þáüaÇ—ÿkgBçèàÆKÕd¹ê?àÜŽþDìÅä‰-›û(­ò°5³ÂG%wÚ½ïÈÌwW~Òª«á?Ë52»©ÔcïéI©˜?¶ý€ð  ? SqïY›:¨ˆz,[›68:$(ÈO[Tbû›cj"›Ãb©°9ß[´U–WT»íæò ›ƒˆ®9RÇx„h)ïj`æ©×dDVK™Ù*§Àøu¯ ia0ê<•ù¥êm‡ˆèá÷ŽÆF5mdüLËÊÛ?ñR«²åRÍÖÌ”5;”Syùûûº“ÃZT¬Ü°ÿDw"ò‰ +y,¬õëûO s˜m6"✆ÍùôÀ÷‘!M=b.oýó‘T"ŠN×vv³&a-Õdm>üˆ–¾Ã»È;<ÑZzm"w”VV8SKmeåÎâU«†òIšâc¼÷‹ß÷s\›(¨¾n(çC^”Ÿk—¹úV•^Î/µ Æ`"ž›ë¬Ë9 ò.Ù™R¯_[Ò|¥¨¸Ìêîà£u^‹âŒ±ÊÒËEW­~zƒ›À9§ê÷%ª~LŒjo˜­ôrA©=ب—ל!ÉÙ*/),©p‚•Œs"ç5¬¢ü»àìï麧ä²oŽŠ’K¦r™R£Ô±êx$KN^±¿Á¨–¹Ô'ÆÈTgcp@Õ61âù¹92o ¯V¬(É/ㆠßzö‡ˆêÙÍÚ=~£“§ÄL\!â®Ø†:c³Û>žÿxßÎm\¿ÔQ§ÓM˜0A&ÔO€¶TÃdñõYµ\{ÈüõFªYä©Ó{^+0„T?+×^ÒÍÛßÍÛõ­©=u!žµßÍõx]½¤k¹òú«j -sr÷ p÷©¹KD®[^kD™s ‚ÖǨõ©½ˆ\R{GœOùûÖ^ÓBœäZ£–n´?õ£Çþ8œ:R )H)¤ ¥îNªî°ÂK¹§ì¶ê»Ýá÷Ìp.“É%.Ý£õ/‰‡­‡€”¨ßœYÓKL—]KŽ9úÓO?ÝCwV1ãÒ={;<£n‘á˜RõëÚµk­µF[i³c⨠Ç@J ¥à¯×¥ á‰¢èp8p]ª¡pÎ- êîN÷Ç7wÀÝÍn·—”” ò@À˜N§Ãö€”øÐÇH)¤ ¥R€”@J ¥)€”¤R )H)¤ ¥RH)@J ¥)€”@JR )H)¤R RH)@J ¥R€”@JR  aýË?p¡˜AÞIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/Normal_ids_ack_d.png0000644000000000000000000005501513051004444024321 00000000000000‰PNG  IHDR7©þ΀WsRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛ•g¨ý IDATxÚìÝw|ÕTðç$wt·”QhÙ{oh){ïQöFTP†Ê¢¨ˆò¢" Ke*‚LÙeï]öJwïJò¼ܶ”ÒV @oÛß÷ó~^KîÍMrN’_Nr’f&‡$¡)€”¤R RH)¤ ¥R€”@J ¥)€”¤R »¦TâÛ‡UU=þüÍ›7ñ>b€LJ—õéÊ•+›6mÚ·o_dY *P j 3Y£ÁÌBˆ˜˜˜ &DFF.Z´H’$û¢ !PÍH© Ž¨ lß¾}Þ¼y¨W€¬!Ó_—²GTPPPÎœ9—.]êîîŽJ@[ÊQ"ÊjµvêÔiéÒ¥žžžÏ6’zþÈñ(MKü·‹§O‰’ ö¸{æIk—ö_µªÏ4›$„ fzb ñÃî¾ò@«T½¢!ƒÏMÚÎ<ûx„›wÞ’ÅòKñsÿÌ¿vîðM×Z• >K {I$-{UD…^¿|3T!].¿bEòy>gý¼¤ÌvôØ-a²B6ä+TÜ/§ëóÎÌ…3‡$¯2ÅýÜž½Lž(ûš¢™._¸mÑ;¹-UÊÓ(ž³fRÑŠª[·îîÝ»Ÿg<Ó[wÉY4§«Æd‰ ½ó0Ê­H³?þô¹Ú•–½ã+~,ŸÝ:Y~¦½÷oÖýËÍ+ò=õið¢±#ìÕ Ÿ5;WåÉà¾,oú·¼æ[¨§Qc2Eܽ÷(&wõ>Lô\¿¾yPïJžùsø³ìI‹mÓðý_v.ô~²Àlû¢ý¸?½|‹æ”ï_½Ñý³eC›Ï€u,bKãfy•(ã®cbõÞÛQ‘Ö.3þQÛ+!`ŸÉ¨¾u õüò­²ÏR&¡¿úøBýùµM¶ÆéÑbß=}ñbn_½ôŠ®û÷§H(È2k?{DÕ®]{óæ͉ÿ|ö±+÷3³[ÍøÄžéY¯Çˆ?‡Îh“+•ÖN²=Òÿä$´ÉGyóÍ«¼ô‚’/ ‘|IŸüg’•…™“uíI²ûØw×'Ë“Ï~Ûïϸ:G¶îLDdý¸[àÇSþ4®&r ²¼Ly]ʾå4háÂ…®®®ôüù8É?áZ®M€ËéŽ1‘åÆ÷z·«Ó°YËÆõ·í»îT4 "Ç6|×®AÍÆM4j÷ýú£O´F…8¸äÃõº}  A|Ñ¢aݶíÛÖ húÙ’`!„s§_§A&ç;½;vþþ‚štVó¶ûü™½œd*Û„’a&]Žšu*Ïl?ÅD±!›tnQ§Q‹ê´è2pÇe1‰¿ý¯e½š›4 lÖeé®KÉJæß™Cü[¼s>’i˧OhÜ ~»v­[~µò¸Âtûdç Qšþ|çö–ÝKÆà5ë‡}•"&"*XT}—qe¢©s¨†-“)ö¡Y!!öþ2©E óV­kÔtǼ‘‚ÞU4o®ªQ¶áæûÌÌ–“?W¬Ü┕Í{Æ•l4Ac¾{è§Úõ[¼«2sô‰ïjVoy$œ™™•sAefïgf¾ÿ[Õ =13³–0ÕD·/«Ø)Ô–á…Þ¿fÀ„­W“̤eTÓ2\cæ©#úŽš±Þþ½õoõÎ$fV/̯V¡å(fæ¨àiå*wºÂüèŸw˶þ–™Ïÿ3½VÓN—#™™oí˜ì_§Ó33GlV³ÜêÓ1̬]™WµÚÀØø‚I^2šÆÌÊ‚·›Mú=CJD ß\»|íýÑ‹$tïÒõZÜ‹U8|g›†¶DØ¿x³G¥ÊSNš˜yñ„®mßúÆ>tá˜VÍûÎU™Gö©=nÁVc>íP«×”u̬©Ö÷[7ìÿ¿ÕöonžòVÍìOy·íˆiÿاŸl~LQ¡·lœ7ªaÓ7OZ ;ÐeÆX½qãÆW_}µsçο¢.„ýÿTKøÒÉÃV†—ú}X"ê3v^_!âÂ<Šµxyå‰1Ÿ°±ØõÓ&׆M›æ&"6Tè}üHo’ÈJDBztcGÇá‹ç¬ÜT%¯D¤¬ør…ï›_Uõ"""¹t“•ü»êô!‹H³$N;vÛKFØbïÿ0þÍæß*DD£¿Y,„ˆ »a²öñ|x!œˆ×·!gÇ^5݉‰Ü‡Ÿ:2\…IwŽþÖkÊÖU­-äBD¶ß¿^]|èïEœˆˆÈ³j`ÁBûöí *×ÔbUí%ãòTÁØ+÷à¼?œÌóûì.P$üàÂÎQ}»Ìð\.29×]¿µž åþÝPU¯«^Øvìøªà¼õxàÜeöñúÿïÏþ çìd¯ÞfW‘á[Ƶ#"Õt)äþÃQ}‚ìßl:æý©e†ì±Pm#)kª-qÂI]Øõý )›Ysjúöø †”N1ດ#œëûä“OvíÚ•ž½Î¡ïÇ5[¨c"’ %k¶øee¿â:&ÛMšüó¿•êµ,–×Ó|õ’,]~`ööð$"û.A$œ%u5î÷Æ&ƒkÕRyœ™YÛÙ{tï×Q¿$\Ò0Çyù—Ë\%¼mRÿ¦Sd":§ruÚ¯^ÓÓ˜H¬œ:ò»Çk5i^(§[ô™»:É—ˆCBŸîwã ;L×èmo »Û¯i!™™…ˆ;ÿ@º2³OàÌø/Xâbý*Üû¯Š6ÏÒyñµ²ë¶MÍo¤çê­ð\lcÚ55HDDÎ^¾­†ÎîT[&&åÒ{´øuj^ÍÃÍp>FÏDDîD:×Ï#Q²#ÉphÙ˜ ¬oÌkhÿŒ-¡ŠÎí“Ο$œVŒÔ"ŽÜ¢ÚÅÒ*“Š­'îi=ÑópÊû]߸ùÓç‘Q€”r°ã|!æÎÛ¼yóôõKæ€÷fLïT9é€H….ø~y‹¯÷màID·7Í]ynårÓG›LDDLL^›Üÿ«w|ñΈ÷~ÿn ‘œÏK÷]øS—2OL,ƒv¯/¦ÙË>­í“¼dÔ+?ÿ±eÀüCý*;Ñù…·Ön¶‰¼nÒÞXóãÇ„‘Å0f朥c^Þçëîe‰ y\µê7~×À+Yɤ\=DBX¦ôi±/W·= v"¦Œ+Ck¬~ξ-•¤dE"vÍšuÄ©üÁõ3ìg¬Ÿu˜ˆÈÝËÉú0:á{IúMx”h>ûC¯A}ên\WÝÇ td±ÌÚ{¤šñVæKÇöGz®V,Ýr5¯ßxÂ_ÿ0 BNA—™zOØ/œ>}ºGéY›ûñ°CwbmqH„{óMaÓ½õÝ ¼¯è J—vÿêÝ7ΔظîÏÑ#»ýùéÚ‰³š0tzÇ?[thÞÖ¿RñS‡äëõqûu)&"·‚Mgõ-Óëͱ›wÏ­ôÎEÖvlt°©é‹{6+º6¨òVòÒÿ<¤ÿ»õúOy·^{¢›ž›¾7Ú+ߎ7ß ŽoÐXGÍŸSÙÙŠ¤UPÀ§=g½ñ¡S åÜÎØj“úø|ɸŦ½?v\ퟴ¼¶¡¤þξ‡üú¯ÁžuÌDRï™Kw®7dR¹'¶óQ—–ÃûÜܤRnËλŠ¶™Ø¹-Q!÷6Ïq`§ŸyÚO5’ÔfÚüµ­Ú4i¼«Dñ‚w®]ºî2}Óx\“‚ì ÓÜÕËÌQQQ:tؾ}{ú~I={à(UÎ7ÇSSd‰8qê\Œ…ó•¨TÌÇõú©·¢äªÕ%ëÅ3§ïGšœ<|ÊW(n âðÝD=ÿRÄ$„vzÿ.5OåJE½H‹ 9uöa´EçìYº|9/£°ŸÀºyþ؇¦Ü%«—ÌmHœÞ¹c‡ÂÍŠ°_šgÖT*Z3ÐטQel;¹ç±TåR¹\ž.Ž{püôÅ8E*PºJ¡œúKÇÞ7;Õ¬YYÇq!§Ï†ÅX\sø–/[D&RœÞw͵^"Ì$„íø¾=N«—ös#%êÌ©sá±6ƒ«wÙŠeÝd&&âÊ©Ãw#­~åjÉ̤˜#Ž;§&Y35E” ¬•óµS±íáþ}ËÖòÒ¥pV2üæ¹³7Âd§•*—әß<ïQ¤B¹¼îÖˆ['ÏÝ0³.ñ2…ó¸ѹû$ïò¥ ¸1‹Ø;ŽÞŒ ¨j Š¾íÜå[VMäÈ[´l±|Ä,ˆÈvøXˆMv¯^½¢^J¼¹J%æ왈8«ÎèV¤T™Ün:<{RŽåçŸîر£››ª ›ÈL×¥.\ˆˆ@[Êá0óÆM&S§NpŠm)ËR!–/_Þ¹sgD@Æ0›Q€”J‹j Ã\»FBPÿþ´mÅÄÄÌoú¤ÔK°jÕªvíÚq–Ü$°C¦`?±x15nLîîÔ¶-]ºD6 ^ùª—)vý+V<|ø°Á߇›< õëINýQâ^^äìüÜ Ë”;7éž¿¿³ÑH¹s¿È‚yya„ÌáÜ9*ûÔû±<<¨\9š2…ê×?äÂ9yxÙ2Á]½6›­H‘"#Šˆþþ›Þ~ÛñçÜJ$ˆôXË’0½ò{seù¹÷•:ÉrZÇ=©1H’ž{r’Dz½}DBBNò*™´èõ$Ë$=ç)!Èh|‘ù”errŠÿ;66…/DEѾ}Ô åÈAQ§NÔ£VrÈ^)ÅÌŠ¢¼ñÆO íÓ‡úôqüÂ]¹q£,ËÝ›7w¼¬0½@MPX)ÏÿN#«•ÂÃãÛµFã˜iÓf}ð©ê›òž1íÝ1ED¼È|ª*EGÓ3¦EÒ)šÍ/س 6–Tõvlì7ÇϨ[÷Y'ÍLqq/r¢XQÈj}¡£-+iZZ 'åËG%KRÆhNA¶K)!ÄåË—+Uª”¾ÇËf }LŒ,ËŽ8gÎ/ÔžqqIÿ”|}©fMlx×ðÛ·gϦ)S}FOž¤J•’‡“§'MšD｟È'x2Aï‰?þøÃÃÃ}ÐEñâ´|9ݺEááôÞ{ÄŒˆ‚ìÛ–"¢Ã‡»»»£ª2´Ñ'¨zuêÓ‡:v¤üùãO‰dç” 6¨*€ŒT¡:”<·^=G?ãg±X ,ˆz@J9¢ÈÈÈÊ•+£žRÚ–rvvF= ¥‘ÕjÍ“'ê )åˆ4MCt€lK‡"xujÕªõ:#6SÜøܵkWER>>>mÚ´ÁJ€”¢÷ÞÿÀª fíµMQ‰ˆ^Ã…Sì‚ÐéžéQ[·n[¶j”{+I’æÿôË+ÄÃ÷gNŸV ¿ß Œ»lÅÊí»‚_ëƒê…$iÉÒ¯aR÷Cï.øa^®\¹°ã¤”#º+µ=ÝfùσMÒT’3UÁèô´ö»O-‹N÷L1Ú¼u[õ·¾ÓéSN)UÉd‹ŸÌñÿlÚüïÀ7û½À¸wj8x¦¦¦µz°F’œ)KæÀŸ¿=r¨Yó–ØñRÊ1kª´ÿz ixèÍ=ëµ}÷“×ØèJ/•ˆ5ž§i¤)VMS ¼•ßé>ú«ÿŒs‡¥©¶ô45[ZÏ}½}ùô™½›šõ9KFÁÉ>Èt$ÁSaÆJæÝC§Ÿ ÅjÁjêê¡iŠÍŠr@J ¥)¯^‡×ÇKñµ^ü:{î9lÉèt(È\p¿T¡¨ÊôÓõOîƒüüüºuë– #jëÖma÷ŸXÑuº¾}ûzyyeç•DÓ´åË–?q*éÀÚµkûûûc ¤¼bLÑQÑz½.é.)ÛÞc¶˜£££“¶¼½½#""²yJ1ql\l²’¹qãR ÎøAöØAã¤R )H)¤R RH)@J ¥R€”ÊBŸ«#èñ›p†1' Oö¿¤£$ÿˆŸ|T3ÅÂ_ñ .f6µeOµLžë‰ß\2ÌI§ÉiÍ’HV'Q:öÕàé9x<„S;¡öŸ=µáÙž6›æ.HYGWþ™qjïN“EÕ»(ÑüýJ5J)VBè¥ëkG09ŸØ‘Øâ* Ùây¢Oð("$ì»0&b›®Ú„5Å=’~[È‘»ûvIçOçë„c½ì›™Î}ûAÞæ­;wUíK(„õÑõßL¬?ñŸG«»œ8kN\@ûÎT5kŸy`ú» _Oø€XçR±Ýø//®}òôy¿çÕœóV«ÑwR>O¡ BÐÎéms4ÿ­bYwYoÝñuŸ˜MZõÀ)T‹ ˜S;æO¹÷ 6w¥. »÷–÷믙²twýÈ‘u¾ùÍ‹“vðûÝÁJ»áC¥TfM§Ù>®[±ÿôsyâ²Î¼wbGŸ¡«ŠætALR RÙM©ÇÿœúnŒGíÊM9%kø•ã‹zœÞֵ˘q²IRMáa9{}U<§”ä¸YË‘K諾ç_ÀD$Å]ÝzpÏÁÚ=Æêeb–s9'ŸÄý“ûÉ©L"ƒö²i±ÆFXL&IšÕ¦ÚÈ7p˜SY+‘y|ù±‹‘ º$ff}.7ï€Î#4"I§ÿeì£2#kUͧi,rÉ‚s»ªÝ®3±f‹ºü÷_ãêÕûpMÉ95"‰î†^°•îsþ÷æL%_É+ÄÓ­a}xhÕÄEƒ¾¨›ßëÞÞYË&ëôÑÆ )@&MäË‘ûÚ™ãqµ+º$fò.\2bÅ,El¥gN%·BÄáà[ù›H²˜¬‘S±ê®;ƒ¯ëXŽUl‹€”‚”È:óþéoÄäx£Û‡Ã$…™IHMÊÖØøíÌ 7le|õö”gé}ŸzçžK@!?"¢H¾JûŽç¯XßI/=½ƒ2Ý:¿Ó³ÊlĦ¡×/Z­ŠÎ9gî¢åô“Z4Lî…k»ÑýÐmt Vn v².•‘¤Wî.³EûÖ(T¹¸¦=Svõ)P¾1³\­¡v¡Þžõ»KëÀ6²]X[¤{^7:³yeÕX6=›ò:{{óG\â〭Y!¿â¥.m{ýRhé>ÐìÄ*ù8¾w5UêÍDd¹wãâ­¥‹Ü=w­`y?[èÝka/'¶…ß ñ+_=âòᘫѫ€OᢤPΪ½".´5ÿT'È|ïÐCsñ†› _ÿ±_üd úÆ@D¬Ü=·Ï³H€úàdxxŒÎ%·O±²²`á°kÀ˃ëR©²]Ýxú~žï½/)L$„Äd3Tl6~a™|:~¼›zjWñl×X$ÇÞ9V¦~a¡Ý_;±íîU?Ý<½cÿü¡K¿ú† Â!Nõ$_8ñò~Xhå+‘ÃzKDB»´~KñzÕ´X*õÁÊ"yuªª¥|ô b®¼çת…ÐH"ƒG~Wçk7®H´. ¦‚Uª<º½‰“s|ËüÏþ/èè–ß<ò¨Ð0בý7…DÂ|åß'üºý±£çM÷mù¶÷Þ£×dA®y« Ó¿QÑ Š:5mÛ«6ÏùäÒ±†U´ëÁM0“fÛ÷˸½sÞÛºq·%òæ¾…ÿY¾R' ÂÙ@@[*;‹¾uKçáË(ˆ3 Yè ‰'¾„ÍÂD$d¾üÛð0çÇûn͵VÓ·»Iʳ…ßZ~×½QkORï])ÚxbùÖ­ôLRŸwW jpúêÈ ù3üHYD^½áë]OgÚ¢´—TL$da={(̳zY%Õúðäm%°PQ™8­I5""ÚXÒË°Öåò·EI‚2æܘ`Cñf¹-x`£ Óüô‚$C‘‚¹4I—¼9).Lc’ȹrã>_¡¬/1“gwb•ˆô_{⤭²ŠJ¤Ùò,§©L$œr{³å‚M##¶R@Jegn¹r+±±&ô³FÆ ]1NHteíÐ݇7 rÖèZ&Ùu©gI)&&-äò ¿ z*Qì‘I,Ø]¦Ýû¥k• jĉuŽqQŠ>åË5ìšxîÍúp÷‰M«Òõ‹šM±š˜‰„”Çhã¦M%+“D1Wˆ²ƒ\ ôß "ÙÝÕ`ŽQ)§Þ~`ÍN¥\“ûkìŽÂ6ÊU£Ç¾åK”úcôD$éô‚ˆ NÞ\ ÷n\É_œˆ„lN”¤=yÔl³<¦_C"bgïÄ3—îï𲑢»+IB愱„ãõµxE^ü\>§t;HÚ·¹d.Î¥ù(7·ý}^HBÁ*[ãÈG6«ò~]©÷"êüÊæd9¼üß¼¿¬Û²­OÑr¹ý°ÇØJõ›JV"’Ž¯ý³«L›¡¦±¾%´V%ïÂÅÅ­£×H"f"%æF¤RÈÏWÕ8yD½¶Rdòðó瘿bb“µè‘±rƒÂ!'NÉ:‘Ú¸äàå²÷úõäÃ5cUŸÜ§ÎŸG'?@J½ØnV˃ý{ ¼hIšfè6i÷£,ÐûH~ ‡ ßøö–U(2\„A¶\Z÷ÑÞ¿z”¯‘x£ªl” ΤwJøŸ3ɺgè?!ÈvmIœ_7"’ݜըÐ3éôtðÛ&Ù¨Z4Id“›:YD>î[Æ׉‰™HçDz'’eYH{©±´ûû~;î&)T í°˜ÃïG“Ñ•"ŽÌ‹ˆv)\²8'm]Øo³}mPË9Šä•Ôû>½Þ{ÖhÛ¿!Z8¥6.‘Þ/oá{'ŽJɆ«ä[¤rèÞMh7Av–®3~¬D^8wÑüÄ™¾s1ä~¤-+ì;5v/Ý·ãP·C—-é?‘$*œó–mXõíßÊW-­Ø˜HSlчÆU:òD$Û 5ÿªi§ÖñTP­Vs,§ñÚÅ« 5]&ÙHe]åÁßüjüü÷f;;9—ê1¿ÂÞÁ‡æ´ÐOÜ^%¿œ‘9m‰³Ùž¬JV­¦˜¤Ñ©ÙÌVs\Ê£›clÊ+‡j5Ù,–§Z9âáñš{!'I Ùzþ—ÝÌz½¦*Dû¿ïÿ“jËÑqîæœNêµÕŸ-3»\…%{Ôi|uóèjV"}®Êu>þ#‡óSG¯õ8I°ä^¥¶û¿{Ï–o­ZâbŸ("ç@o—7Ï ·šb·÷Ô8«É’p¼Çeý‹.Û³­bM³ÍlM’´T¼J™½+7 ©‰Í£ªZ|ɱÅbŠcD ¥²9û£<ÊtlV±£¬?:×Rm¬(DBØÔâ}W_xúx]SÈf%!ˆ˜½ü©;ÐjJ~•DS¥ŠŸ%+)* ARîfµeb•lå–×Bª‰-Ãî‰BÔÿb“¤‘Õ’0̆< Þ]b‹cNx€O¾S‡t&«‰“ͨjÕÕ™{Y²‘Õÿ 3WúK AVó“ßeö®7j@#²™™ˆTC©¾K?Qª‚lq¬)ºZ³Î×ÑÈba"¹X»‰¥ºL”i*)VÒø©z{⤠IDATö'îê_Ë1ʹ»nê'“ÙJÃW´°ÆÇßðƬR‡Ù!¬PÍem&Ò4"fgÿÅÃê’5ŽIfáRwÚ Æd³Ñd5%Þ*Çƪc†Ô"KõžwB³’¢sáGÿF–XfÂS€”BT ÒÒ”Ò… [\j£%üG%«)…½¥¤š&`ÿ§%±ß€`…ì¿2v'¤šIM:B“5.ÉÒˆ„Y}jF… ÕôÄèBÕúä&ù›ÿ³‚R,Ua/±Ç£3)æ¤Aöô¯}EQɪ’ {%YMDü¬ªJâð„#¡öI#«™ˆÈª&m ÒÈj"!ÈfJ2.“%ŽP€”z¶ñ¶9Ÿ|è%ÇŸØ‘%å„͘å ŽRÌ"Wž¼9uñÍYV\%ÜàõžñM)Õªë6äý .‰âî­þõ>Ê2ò KÀsü «7§)€æ8\J±¦šL¦'LÃVSœEÅA,¼/~]Š™ý‚ŽžJúÄ4f×o\´ŠŽ²am)‘ô®ŽÇŸþ൧R RH)¤dû”zú}Ùã­}àð)ÅDBpTÈæ·;5 ¬ÓºçÐC·£…È)Èø”D¦ë´îñQ“QóÖ¬ùcÆ°:£:6_ÖŒ¥ ãSŠˆ6}þ®ÝÔåÉ“§DÍ{mþûo”)¼,éysGÌ®ªÔ¹0%¼|½\NÏåî9ì¢ZLqë9IsP<ý@Òèð渘¨°š¦¦+ÿ%YSÕ×óÀSYg°˜b‰<žñûª¢D>¼'ë O6Ž ÒéSldX¤ÍbzY³'H0ók{öklÔ£~ºb³E<¼Ÿ¬ê“>H%&â¡96:2,ô¥K­ŠÚŸ-{4,¬l™"»¨ƒöO6dÇöíÁ{öd™VÓ´g||bžÜ¹¦Nú0ék×®mØ°!<<›4iâííý:'*„x¡èééiï~ùŸß,Q¢D@@€N§ËªE¡(JÑ¢E_`Ä *ÄÆÆʯ±Ÿ$I¯39ªW¯þŒ+ RêµBȲ\£F ¬öÌ®U«V–_ÆêžÎXC2 ÞÜñ™e̶%USŠŸi@F¤”`Å´tê°†ujÕª]wÀ„9af ‡à )E;>j¿8<`冿þZ¿º»÷ΆoÌGÀK”žÞ|ëÚC×òN¹rxQã‘Ë÷›•Ìót$ÈÒm)&Ñ}öìGçVª8dÂ×;^õz¼©"¥ˆHŸ+ð§Õ›oh[ZšôÁÛM‡-ÃÃ'À!RJh–³‡w›–œr¶è3rëŸ_ðöÅ! Š^št\—’” SÇ)4 u «l=²qž\£]1Š ¥˜]Ǯܷú‡/›?ÛL†2Ý6Oé¬cÆI?Èø”ÄD¢ã;v|'It!¢àåIG Ž‘RH)@Jd©”JxÌž7Ž–RLB5ß ¨úFúõ€Ãµ¥T5ìÖ~a0FÇšÌ*J)¥,÷/NŸ¹”øÆì)_Ž@I€¥;å+=qPÿdò'urâÒ8PJ "²)š Í–ðOI)¤ ¥^d‹“‰èñÍSRLä\ ~^·S­µ˜¹3¦à¥K×›;ô^U6ì:œZ*p”¶T²TBD€C¥R RH)¤@FHåmkÏ÷6Nø:¿Œ—·%ùÜÖH)€ìMˆ›mJ”®Z-^ÕjÕú ÿúÊ#«x¾!?w(Ýa±x–—·1±¦Ü¿¡¥’QBˆ]?¼UµjµëqèŠ H)€l¿M99¹uýþïà];wîܹsÛ? xkçæ}ÏkÏבô.nÎúgj* 2…žèØå SÊm8}ä×Ñ N¹ºº"£)DDzgWgW777W7Ï\oÍø£’Ç™åkn &"Ú»î§O>?á£É«÷\£ÄÓq1WÏœòᄉóWí|ºI¤ÜÝ>aø¸pˆ(üÜßL;nÂœ¥›ì ©Ø]c'GÚùGŽÞž¬•%„ˆ;æ‡^~‰“}€”€d1¹ºº,Q1DÊ’÷š^\¸RŠÅ=Œì0uý!›/·mÖ}˜¾|™BÇ—ÔyŠ¤?a}x²K›¹Ú½_:‡umg`ýÞ4ßzµ+ßÚú£×Ï£42ú”,å¬i9¶lSÈ9i3ŠÑß“ú=h4⽚¨ Ȥté—M11 É:£‹³¥ ð8Ÿìÿl½½áô5Ü ³ZµÏGK W+œÛ…‰‹\ß;jÇ®±íÊûfhhÅ‘&ue¢ž]k¼Ñ{Öik·„Í)ltž~ÃÖ oèKD¦Žòh7ë›1DÔºY½–M;m9ùv§*ùêTñ›¹*ªQ“ú®I6O!„éîÖ)u¿ì Š»qUÙ0¥âÆ5¬µÓ¦d+8jåÜ7PšD$Éô÷øÁ:AD¬ÙÝ»]wÜ]‹‘\¡Œ÷‡#¿®i¬Yâär ‘mÃîèJo•Œoþ*.þ}>] ’ô<á­®æßüЧ1“x´ý°Õ¥ÑÞ™32“$TW{¯ÞëT%_ ‡LB¹7 ç'£¯/(S,j²aJ1»Î̤©Zäµ=Í[6Ý~!‚ˆ$“0ݶ‘ª=îÊW»ïÿ¦Ï˜9kÖ¬Y³f}õá "ñÑ·?v¨á…Š€ìÒ–€”h±QQfõ©ŽßLÆe¿|/hxÿFS¼›¾=ñ‡…3»4ëÙ´wô–_§,™£=´Ùä(Å·b‹U«'xݶÆFÅZ‰ˆ\Š-[úq£ö*çÝÚ¥Ù¨¹œcd§†LšKž2¾_Õ°¤ùTè^Ì}YÓj5Gÿ¼«oåšJ¬)ÑÑÑ茙‘x)`yu.^¼ø믿~öÙg¨*È/ÐÚOÊ¥øÑ}“™É>ÄÞ›5$¥™JëCÇ&eµ=ÄýûÔµ+íÞª@J9@ãÉ.8˜Ú´¡|ùÈLJV®D½d ™üŒßæÍ´v--_N¨K¤”4ž¢¢èæMš>-Jõk7nPHÈCþózUÚ_HûSIzUŸÊòŒ›ÆŒIRZ?.DZ?.éÒ\7tº´&ö§î€×’ROwVxºÒËwà DW®¤õÞ½_k)JÉrZ/ºK-ìH-˜IÓH–SÝãkZZA¥iiåkڟڿ🦧ãè.¼p¸ ACZ¿o4¦õãF#RX¥^O..i­îî)Oš™$‰¼¼R1I"OÏ´–ËË‹œR¿Q×Í<=S­ggÊ™3ÕIëõ”7oZ%æë›®ýÀ+M)f&R§Œ¸éÈõ¢Eü®Ÿ¹ìÛpÀ¢©o^éª(5kF—/Ó;tà}û-§œd5k¦°‘¤¶­2“Å¿ãNq¢ ©jªs¥(d³¥:®ª¦ú©}wŸÆ§Dd³¥µÓOãS!HQÒWÓHUS­-{F¦=zÚ»¤´³ê…“,.ŽÂÃSm›ÂÃSýqM£‡ÓZ "#IQRtL Y,©NÚd"³9Õq=¢¸¸´V!“)­ÙŽ‹KëÓ´×OG0x0Í™ƒ.¼Ö”BÜ\7âÃÒ†[ó "º×¥Q‹9ëëŽhWôutxÍ—‚‚((ˆ¢¢èÇiíZÚ³çñ§KÊ{í4ò3a"ruźâp<žD˜¢¸ëtÔdié¹B`]9ñÃó "bbŸ€BÅŽœÚûšîÉH\Ý=üo°µÊÛt,‹çY@Ƨ”LÂyÞò5EXM7üCoo/ÝxÀR*¾É$½sû$ð2àY5€”@JR 2^«V­üüü^Ýï3žá@‡"x1ÿlÞüÇÚ¿²êŽ<2<ì—Å‹ŒF*R™Òº¿6×8SU²fNí^·hÛÎÝ-›5FECfM)û«¤ö®¿üŸƒ&M_¾Nû¡}šK¯áýRŽä?WxI¦_è9þ[›%S-î*ÌžRBˆ3 ß½É}ěݼ¤˜+¦¶ ±lú¢Ê UUP¯;¥ˆ”à¿N•ë¶ S«ŠDÔ¸Eó»lx<¼Dééã§ëñÅ!35nÛ}ú’ šs¾Üx±8D[Š™=ÊôÚ¸®îÙ³§wþ³¾nÅɵMû~H”)dOÌL’pr!ÕD65Ó_ B\¿~ýäÉ“É–±R¥J¨kÈ)%H ½ë•§`ÍúkÖo5zðò€¦“/ ú»8nÁ‚lI²ûôû©‹K Þ׸n¾L¿8’8yò„)&2é@I’|}}sçÎê†×&‘Âá£Ûwüxå¡Ø˜˜˜˜˜³«>åò ¢ ›6¤ˆ™÷¬Ý]¡Å€{[&3s8ûm2ÅE%)„$läYRJÊõÿë<÷}×¼I£ÆM›MÞ™sõº)/{þTUÅdŠ†›ŽÞ ÍU¥ÿP¯°ã7¢5¼Âà¥HG?f½[¾±Ó›tØËîãg6›u:Üz O¦¿}èÚòsOgõö¥¶-þ³Ððö¤¢Ë+@¶¥R:T|éÛ¤ÅbÉ•+ê 3qÔÅà暥mfÍ»êõÒ7aš@—W€ŒlK½ž•$___Ô82!ÑÃ3h:yÛ—mâÈ|îô™Tä@N)f¾qãFË–-QOàÈ멬7\±¢Ø€m%\˜™„¬^ÿî×Y‹jÖ›n´¡|Ò×VqèCT!BCC]\\ðpäõ4bïÜ‹\6 \YgÐœdÞXâƒ<úŽßFédå¶ÅÄÄÐ3<Ð ›ü£Þ«CÛ/Ö Á¬ÉA³Ï’B6´¥²vJ%»õÀ›ü¬UIz,%„ Ålÿ .Ž~ƒÞ½{÷PIH)Gܹsg\”@J9¢¥K—vîÜ¥RŽ(&&·ôB&‘Ðâ ÿ#¼Çà%HOï Ë/Ç•ˆ¿JGô{™ïì°¿®¾téÒ¨!È ÅBw7¼kÓ¿šGqíþõÛÞ•û¶z÷M}ü2.¥„gîsÉ‚To§—;[BˆE‹Õ¯_ßW¨'phBD]´qÍñ&o+^ØYÕH²†ýóYÇ=ÿTiи Š £RÊÐî½á¯nÎ&MštíÚ5Ô8>É@—þ˜™»Ó?…ò9[ÍDD {7™¼Sh¤(,㑳”R¯ 3‡‡‡;Õ™#¥øÑÝ[ÆâU|/D !4[ü(€tm_8OBˆÙ³g÷êÕ }Ð!S`a4èmf #‘²~J1sLLÌúõë=<™”åѹÐÛöšÅÞ<z'ýû28¥„$©7.ùnj“:=†OoTÑ°vŦçmK1sÏž=×®]‹ˆ‚Ì»=<üå–5ÇI""îòÊÕÓFÉ®Þxu@ú¥³÷+y1 AÌåsäXýàÖsåS\\œ¿¿ÿO<ƒ,!úÔ¢õKV·ž´ÉÛCžèÜ–""6ºË tª*ϘODtüøñ~ýú>}ÚÕÕ5™Ÿ}fɦßÿm4áOD€ƒ´¥H =IäÅ,„¸nòõõþÏ|B!Ö­[·|ùòU«V¡ +‡oÙôËn§Â=òz!¢£-%œùв-W…rðêµÕêÿgD………ùùù•(QbÙ²e‰æÈôlÎAS¶ç³®Y;w)3aÅp„¶› ¾[øÖ’æ ¶< ·µùÝ€&ù’èHì3}úô'NtíÚõòåËNNNè.Yk"Om½ šƒ~Žý¬Åß–jÕ¡º¦ EÁm)ÒT­UÿOÿÙ±çȉƒûÖ“™“m–BˆFùùùyyyEGG¯Zµªk×®F£‘Ð]²ˆ4)w½qËÍ[Þ¸úJn`dænݺíر€”zA¡[F·´ü•4ñ„ ¢‹/¢†Ré“W$gÎœwïÞE% ¥QïÞ½—,Y‚§RŽÈßßË–-¸4€”rP~~~¨$¤”ƒÂKRŽËÛÛ›ˆpi )åp˜9Ož{îªöôn…*õDùR*#¹»»«ªŠz‚ìÌ2|È0?yu–Uª:5xV=” ¥2ô(RÓîÝ»‡z‚ìLïQzÚ¬9Oµ¥X¸EáR*㡃do,éÝ+V®œògÌØ@ k{ñÞ‰÷0áf&€WR(@[êE›87W÷ZÙðð²¾(G€WEË£Ã:4';¦d•ª|±}z]” ¥R•;pØôÂ9Qˆ¯–f  ‹{:¥"m(@J¥E‰}xç…ð 1sÕÚòt*âºdq麫7üØâ/ìC!¼Bi†" RH)¤ ¥R€”JfŒ¶¢àyñû¥˜¹PÏÕ×z⎠p¼¶Tb2!¢ÀáR )H)¤R ²}J=õ’^¼µàÕbæ3gΠ)õL[‹|aû’NM«×ðï<äËë‘ ú¤¼Rš¦Í›7åH©ÿ&„ˆ9¿¨ÿˆ¥ã–î=Gu뿘Ÿó­95|ôLTkØÂ% ¯k*‘ŒR€ŒnKżB%Kz‘ "ɽR•ònˆ(pŒ”’ÝŒcVˆ’v›@ÿ pˆ”rnUËõЉˆ… ËÙõî@ÿ xiÒu¶æ˜Ù9›öyûÃ; JzìÙð«±É˜@/)8D[Šue7o^VÓÛröÒíê½¾\1±-ãŽ)pŒ¶” "ò,9pÔGá-àm)¤ ¥RH)@J8bJYc9{Ϊ213_¾pæNžŠRÛo½³ûf fAd»5¬O÷#QÎ(SÈð”bÊQ~|5þrÑ"!ˆnýú†ï€ÖE>žR‚ˆš}8Ʋá!f"2Íy¨ïˆvRü)22¥ˆ˜ >M ûÅmþ÷¢záïçŽ âÅð¥ã9~‚…lÛ¸ÈÐí{ÚºÜÒ•|·§ÄhK€C¤ "ªðþXz#>¿  ™;½ÚàåJ_²0‘\¾UmKrÑ.t„×v€ã¤”=”t2—¬Ù[&&¼¶^ª?ãÇDBPÔ¾™s6K«7 \’ÇI)a¹Þ®~·ëú|“Î-Ž|ÇjK ­ß¿ÿq» e /Û‹_—©ü ñ)€”¤R )H)¤ ¥RH)@J ¥)Ž†™9áEز,˲œô#”dm:€ƒBQ÷îÝíquüøñ»wïZ­Ö¹sçæÉ“åH)Èx·o߶ÿ}ñâEOOÏ\¹r1³=ò*œñÈ:tèôŸ%J”B ¢)¡ÿþIÿ9~üxD ¥ÀQx{{רQÃþ·,Ë;vD™R ÈرcítêÔ ¥H)p Ììï8"!Dþüù}}}‰(((H)p8Ó¦Mkß¾½^¯GQ@6û¥2 fîÒ¥K… P€¶8!„$Ie˖Ń‘m)pРB!ÚRH)¤ ¥R€”@J ¥)€”¤R ExÚì`f›Í¦iŠ EB£Ñˆr¤ÒÏÄuIDATT†mí:v-R¦Šª*( €§6é܉CëV.Í‘#JRCŸ³H­·?±šQÉÉ:z0ïKEUQ€”Ê0¬iª44¥RØÅC]’唆[HQÉàJ"Év©©¤XgY£Y㘅 &ÙH:9ùü'™;¡3’,k¤XHcJ\fÒ9YIQŸ\Ff&ap%%–9µeg–ŒBb²Y“+ B'‘ÕÌ8×”(66¶c—ž>…ŠÓ«ßßÞ môî7D$„Pî<üëwÆ÷ûvÇAAÌ/³R„w/lÕç—µ‡w2&Œx»REýôsSÍFo7$"&’8~UâŽ_ÿá»®ßìàX"Ò˜¤„Ù1ǹ/:¹«ê£µu›OÔœœeAÄZTœZ©V‹Ñÿû²ZN¤d®„"’$%ôØÚ#ëܺv›Yuñ«V¾õÐòµtÄBˆ˜K‹VL™®Ñ“[dÎjoN™ýë;u¢cÕă¾øXÑŠöœ¿Î5IÃ[ÈâѦNCGöë¨*iºJg¶n[~Öåªy7Tíøç͹wðÁ ûë:ü¾ê²”°-Ú“„YWºns;¯H²°ãøðeß[×°Š´$¨Q´«›$iªâ]6¨vïÑù|Ü™‰Xеù³fí}gúO‚I‰¾üõ€ó—]{ÍÝà,'?BÄ^Ûº{ÑwîGês” |kJ‰ù÷“’¬SÃÜaEj%5~b÷#‹»?wíØpá>9åP'!.ýÐí·íôVo•“|Gˆ[+ßßu©pÏQ#4"Ä”]LL´{ÁŠßŸ¬©¯~b‚lfN UáþŸÿ2´gU''§-[¾äIÉzWW—'kY8»ºédòh5ãl+ûmý^}º¥_ÂWš¿EDD§æzg¿qï’/G¶H:½ðþéàŽ’ñ¢¿|§Û˜7>ø{Ý ½$Ž¡žÊÚ¤[ÑÇh"ÙÑ[ _b!ˆŸ>PK6~u«3R* 6¢)Çgv8rA©:`VË*%… G'~Þôý§ ë5¢‡¤‘ zCþ37y蓯ËÝf#"I¦“Ÿ×>S|J¯žõ%ñTEâZÈ’0Úr×DYMyú4G²mD2ºyÊOžZ–Ü NFVÉ«åÚ­ˆˆ¬÷ö®øbd‹/öåñ &"¦ºoi±!+Æôüähá<Â>\å›z'ÏÊíó/lИÛÎ.ìòׄ^mç­Ï#3 qåÀ ß²ÍH#˹y¿Ïø5_ý–Æ»gR<ÔjȦ¯‡쿱UÖ«?/›Ô™§í/áÅ á¬+ß½å²Í'êú—$Û ¦Q¾.¸Ÿ70wÊ;æb-Zî˜}‚u½…í‰ ¸@Ý&¦à5ªD’Æ©› ›Yªª(Ò´×1­¤Å+„`'ý~ôîÕ~÷ÎáïðšË_³Ä²æ8å齱ɪ&?5ódŠ#r±¯*îCßêýûÈÍÇ '.Üèž5Œ-—9÷Õâ]œóVúýwUrI$DXÈŽ?žzúN”sÎb#'ݲ¢‘àÓóÊ ;<;°ó›ßŽü~GÛ’¦YŸŽ[¢Ê.õ»™4¸½Žˆ„¸üëØÉóoD¨e›ôž9ù]7">7¿ìû¿oÔåÿíÝy\Tåþðïóœ3Ãæ€"Š²¸ ©(¹ïK‰˜»eeejÛuO»÷v½j”¹”i.éO+ëš©é`.èUQ sÉ×qCA@EY˜9çùþþ˜\®% à÷ýâõJN3gçœç|žç9ÏsæÙ[¸{pˆkí"º/UÕ0–ôÍ'Î¥túÐØ¢E(Tôh6ìÅÈz£R,Ï ÄØþÖ«Š¢×ØW”‰[g.[t5=\˜R÷/Ù:ûµŸ ß¿=†90Æþd§õQŠ‚O,ÚˆvËm/P Ð4õS Ëç÷%cÀ!)ñ°W›~˜y•÷œµ§uHÕ©ÓeûnßÁWÐ kÜÚûœq]aU´ G:œÿÏM3 0ÆÙþeÃN¸xdÙˆ«ÕkÐâf|Æ$ÿ㛿¼‘¼ûóM3"¢NMÍƯ;Ø'ó·+YÀ0yqþlË=Ñ3_¹ªvðWO]¼kk”¥î·õ—³wO­Šž¾éóqSò [–¤¼Š ³˜ñïßúƨ˗.•nD!0çb½ëz JµW€ñâíÙÉm÷ªÙÁïÌÞ¼%zJ¨óˆ¡£ràöÖúŽvâ×ëׯÿnêó‘C_Ùy€9;8dž™øÕ­ïÖDõl¦_þ^ß8CÄêuFãšokÿ1¿ç¤8ðSä«ÿ^÷ÏÅ«~Ùhìãqæ…A£L 2'GmÖùqso|»fChc}Ù J©*G‚ôí ÍÕ^ tÖf9c P[­‘_Pc^!LvÝ$?êMdqé¨ìÒYç(%¬µe]l@÷áÍ{½”}àSãâUˆ%K!"H q,üág¥TT è$Yæ|Ä¥Ô«56uFdÕ{¿]Ã]ú«Ðráô]ï¦ ™àåÝ0ëöáÂâÎ@ªëî•~ål¦u·åÜN:cœoñëÓ´…¯Oëö—[kº¹w¯_Ø™ÄZtx}Zm÷äÿ~:BETUßg=Nî¹ ˼¸w×âÕ]_uÓü;ûÅïw´¿omP®'Ý5Ôðôñ®QÃÛ÷½ùÛ·Ìè  ¿_ÕnâÊà€ZÕ«W8ñCçËgâÒrs%Þš;Öß·¶Þ± £„züª^y7/Þu j©A°Þ_ʹyÅl±õ÷;yÖqÐj“ïÇwçvýÞ]¿ìÑ¿õ#}„ i§®¿‘Ôh?º'?Cu= pÏO0nÞŠ^â„•´ìÐ?ZbÅ9‡<ÞŸÉe.`ªÈIø!=Ý¡A‹z{bInP/ àÃor š•+œt:Û8'ƒ9?XA£¯W'ð©]¼ñ\rò îÐs€"9ôªûÅ•,ðÓpædjÛµ»@V­ç€ƒ–˜TtaÌ;¨×‰mËEÏ%.aNFÀ˜õõ€Ðø%ÓòÅ–ó50ÆYoÓÿe ‚Áðºvó¦Œô[O:“Ë?¨\<—.¤9æ¯?" €s‘Ëͱ³Cý@è¼;AYß`¥”ª‚ÅK Z,Ýføû’÷¯¤g0Æx›Ñ?Õ¯ €¨¸õ›µÕUc×ȤG=ixFâ¾ìæ_Ö½»óÑE¯_¹~ÓÚ“]üÄ=-taÁ6õ* <»pȉÇh.0‰ý1·Ç¹‚µ ÕÜpÔŠúž P=}¼~û—„å‘šaÖýc_K-ÑÛÃ{´þuÅÔ @Xœ=›ªˆŒ1UÕtôŠ¹è7 „¢54GÆkµL¨*‚Zä­™•¯ €pð©é !s©ÝÍ_gç(®2€Ïö2&8g¢<†û6SÐAçT+êôËV=Îe×bÒ,‹Û×ÌÉv’pέÐ(¹¥Xx‹OUT%82ëíéq^¿9à$ç|zXÐb× ÛðmýŠ9ãêú¾~ç•¥5õ÷šLQûN[6²®‚öï¸\*ûãB=~U®¤ æ\;ÿĶ|ë°Æ»OÛ2|ñ¾·lÕób5.&—䢟G¼‚ $nºáÑÌ× ˜l‰™1äŽ×ÐS7 ™ÝçÅA–]`9³û, ¯ð£À:á zOX6~iØÄoÏØݶu*-Y é>õšˆGê»” .<+ÇÄlqÙY9ŽîÅzÛÊõ"ðÕº˜ãÇ|õÑ—P¿UÏjìùöÞ'c¶Ç9qpÏæw7qKÚ½-ᶹØé+g/÷æèy?þvððïûbW¬XçÙáE'€!#G]>âÇèØcG­ú|bÿá¤ä–_‹ŸRªÊÕ%—]ºµ9µìÅmÆMY©¦ŒÔ´øõÆÉa¨÷õ®ée+tLäfÜÌÉH-üɾ¦þÏòˆ.]>éÕ¬" ìëæn¹vè´Ùt7ëìÄ'¨yy¹Ù™â‰”kÙ'—óQ.²mÞH^fzÎ[¹ÙÙJîÝ›9é 2†7㎹œl×ççTÏúOŒ1.73=m÷Ôsç\Z¼Ô ±øt¼ƒBïìû®äÅŠ÷hèï—”žóÀLTÁ­Å[æß–˜„\¢&¡y}›I}{Iž)+rp`øË/Y£›Íæ Àc<CÒºøÔò–‹OÌ0øÔ68Ú-boŸÚΚûœCn¯jÅN:ÉɧVMíÿlƈüVÇ7¾ûé'3Ž‰àŸ~þRB ±pÖŸù‘SÿoÓ™Y‹>ùàý j¢qóÅиøÖªÎmµ¸šËvÆ4Î::oöŒ™ó¿qêðÁ†99bã°1;VL>°vQä'ŸÈ Ú³ÿgY_»Võrèñ£º\Ì)¨=hqD—S‡VÏ6þ+R s hßtÔ†€u%n½€«BÜÞ:½w±Ûâ¶x·\ø«YUŽÈŕ礓 —®ï½ø­ÕüÂ"殌ûø…õ½9øs£‹ÖîZmÎ/QÌQ1«ŠZ¢ ¨Zòïw1÷¼UKþ½AÈyÞé_Ž6÷…m´=Zbg½œr'‡"ÂÆ)/¨ù¼ãûºä\;íÔmV]oDax!2ê·¯'­Ù’¬¯Ûµß¬µùÞ¿j4 Î4.´J¾°›Ñ#бI¨ÿ–˜S @Š(Øûªb1CÁˆ ­{Ž“ÒSBT‹Ù~ k¤ÓNº®ªY)ê'EÕbF h”_ùö@ jØgámFcß{–••µ|ùò‘#Gþ…ITˆèÕpàÚõíg¼"ºL[· gÅ!rm­åÆ­pï´XÄà7¦¬³›‚ˆˆZÏîk·t”)´ŠÂŸ{'ò¹·‹ú!ì½aï¼¢Õ ¨¨A€0x‡q°ícÁ¡Ú»S¾x×n3€1Dto¶`EX±N Ÿþ;¢ú?`qé^Ñ*v{6!!aåÊ•Ó§O‚ÛÐçµ±ƒ?œoɯdåÎÚÍlu$ªmÂ8"2ΤûÕOTKaÙ®Ž (÷y8ìªí‰D̶*TAUAÒc Zì‹%È Ì(°è I%WŽŒIP-PâALÖå¢è H ;Z@Ŷ $- B uÒ–¤)Y”…0YB¶Ñ|’µAUî[úÉP-ÈeT ¶™Ä¤‚Aõªb-å [ÿ‚‰ý’Tdsay¶- "cÕb{µmÛT–y½\‚K¦7r3999íg!Z¶lÙ·oßG\É)ïük~Ÿ÷g–ϬÞ{ãD§gŸ½Ú¹_v:®ÄW8lØ°J4ÛúŸÃ;š[ýù;M«F‚ÚRU·ç@¨jÉ…Œ1@Pï? ÎV T@…{êHŒ1Õ ób«b Ea?·ßöúÂ5ÝgåÖ»Ö–âï|Àò‚Þ3uhŸu9¸ßH?ÆŠ¯Ø?>ƒÁCÞ¬¯´Ûj¢h³‚!¶õÛ¶Âö«b)ö,g€ Š¢WÛ½÷é¹Ä5ÅNWe2 „A±‡+""çlÎðÐçÚßQÀ9OLLŒŠŠ0`@e ªæíBÕ@÷*snPJBž0I’¯ÄïÙ½p¢}×N^^^zzz©V~žé­¹[¬séQ’ØÚ/&ôl÷Œ««Ûƒ±øøøæÍ›ûûûWŠý9d䔪tzPJBž0//¯_wý·Ä³O._¹²råJÎKy„ש³çNÄmkÚ¾Èf\4Íß9ÇÕÕçáí$ƒÁàççGGŠRê¾ý\§ÓÑq"¤jsvv.±ÄÉÉI«Õ–zJid tômXò‰œr¨V«6Bˆ‡D”»»ûèѣ雟X TüM¼}û6'BH©VÙ±Ý,‰{Z·mÿV"êõúqãÆ}¥Ôýétº²è›&„<µãWÏ?¾~NÇÎ]å_†ˆœó1cÆP+êɪè=~ŽŽŽz½žŽ!¤T ॓û/Ä­}åå!Š¢<¤&LÐÜ÷ˤ µ¥ U«VmݺutœyÚ!Ô2À˜trÇÊ¡᪪Z?Â:SÛ¾Á„ˆZ­vܸqTE¦¶Ô#‘$IQê7Q !Y```xxx©|I’8çKÑd:EQvìØ‘™™YQ’$EDD¸¹¹ÑQ ”z$ýúõËË˳ŸÙNy<óÌ3åð)f³yçÎ…Å ¯[·. —¨ *A%$$¤°šC!eÄQõêÕ£ˆ¢”úúôéCÃü!eMZ¿~}ÔG)õ縻»ÇÅÅÑ¡"„”iDuèСmÛ¶•è©²”R…F£ùæ›oèPBÊ.¢ºtéJE)õWH’píÚ5:Z„R'ËrÇŽ{ôèAE)õ×EFFÆÆÆÒÑ"„”þEó6mÚPDQJýuˆ´ÿ~:Z„2BE)õ¸gÉd¢£E!”R´95yòdzx>!„÷Û¯ªzØ3£Ú@æ­CSg-9½é³¹ jÎØ €-ÑiÒÏ “§OmUÓG%G.÷ÐO_½q¿¶Ø×4À¶H=opì:õ×÷ò €‰"ÓåÝ_½`þçþîÕú³õûG4u@zCThX…BŸŸ<¢Q°_Øî[Ù*ŠŒ1‘1&Š"c¢(ŠÅŸHÿ›ï“¶Lû¥c˜X2EÑÒoMb»:^~uƦ–úüÎÎ9Þ–JÛ¨y"cŒéÔ·Û{»úGü~=·¨ )£Ÿgôrµ³k4s3ž,;³jf%kUÕ)[‹³éß-ÓÞòru {£O|.o¼>‚¨°TÔž©Gš/hj""""€&>þFDDdR{A›“ŸY ""HûFD>91>!)ݘ•±!ÃÌL³2 ¨jd]o1ïvº†(HOÔä8øµhTÉÊ”+"0Øsè[¶,÷äÒmº’]CDŽ“4°ÛŒåmSbÎm9{ÆDE¦Âv„³GZjˆˆê;õˆŽþvÇùô ›»´lÞ*2z‡ZêU„3Ó‡tiѲUTtt«æÍúùäfrž¤3Èd†¼?WÎnß¼i›¨èè6­[D¿õíïçt Ku ±‡þÍÉNOÉÜjùXË%—0NΫã2 Eš€ ¼Ûn;xòØΉÜc®Â$AÈq ·Ijª³rOì>)é)=²ÉÍ?mÛ8»Ù?Îä1ä¥ÿuüôÅã?÷4vûá¢ÒJ‰ˆY—¶µëÜwñÆ=œOí½Þ ´ÌÞüí¼6oöÜŸ á ¢þÇÉ]LüâX¬¾Y‡n"«Ý8¼{Æû}?Xø›`fM!Ê]ìÌÄÅ´¿?šþùeÓGC;[!€µg`ˆ•evÆ™Aý†þ°ã´Ñ¸A`"0°­^·aÓ¡Š'zéÿ¨öΚìø„Ké¥ì*‚ ßMÙûn*;º{yzz—ÂÓAÕuÞÆXê…í!ÞήÎÎuûÌJ/òvðÉ“º†ÚX9ŒYs¡(·_ñuR…DÍÊ6ˆŒ±»;&ªÀ:¤ýØxé ¤ƒ­|m8‡ZëϤ0Ƙ&±m wOOWwwwwwwGGG''{Ïa ÿ‹ýAâ= ª8»¸¹¹¹8;ÙÙ¸G˜ðÛ‘‹÷“Ó u<+é$2ún¦þú°3Š1fÈê=BT§%žØ¼xì§?mŸñÎòŽI#BðIÍ\D(Œù+¬ßpªäFóÛ’›×ä,~j,NÊE”‡7‰ªémË%š%¼€•œÈaLP¹thÕXbÉÌx ‡ê–r³FNÑ¿ŒI›u«Xت2¯ß É©ŸF}òKáûSçvnàÆŠ¦!0tp­Ô~ä¤G§ï¹¾kÃ¥³k>É°a PüsõædÑÔ’¦3$7åÜ’<=îa>¼&®E÷1tÅbMâ¤Ú˘!+KeÁñ®5'OýÔÙºøpŽ“=êErSJØc˜—)èt*w@a^æỪvêß¡gÔÆ$S ÀC…À8™ü‘6 J“K >ãô‚?cœz¶ 5^ ATXþõºTÃeõ»T1¤ìÚw@ ‡Èq"yFµ q ¨u!E§pðnáížzýÄéätŽã8Dä8Ž“]Û6ÏÛ ».Ük(®êÈÉd¥L-mÜá…~ÏÈsè:¤„ÔìPÉMÜö¿î¤íÓÐC0\X²ç¾¦Ðªu¿j%Ï”37ÛD^—›rªÿbsù:íû4 r2 AuS~­DÆÀ½fÔà>Ÿ­žÑ[kæ¾g/3¿™:bË™˜ÊÝ–…º«€S›5hM‹é#úçW~ߥ–Äø~àèùÎo¼×¡©™”ÈgÌ6ÐQ¥,j’ ú¸Û×cS ÍÆ,aÏ|ë´{§EåOvïéÔ®ûˆñôjßÌËAeÈÏ8spÛ—_,:‘”2ìÛQAÅ#T(óv~ÕãÆZAjè1¡ 'ãÖõ;¹ô·fþk` ‘ ‚äæŸÑ ©¾¡ÂÂB©ËLË<<ìË(¹mœ×ÀÀaôÜŧc‡øq‚Ã7“+û9§ÄÄ£³GíwZ<ÄŠcŒW䇫Þ÷å}ê{ÙºûYñYÔ¼‡oà”YóÚ†ØH-&•R©Phbo\‹-QˆÌÖÁ£Ý¾Ëç 4ÞS:NYý»fH¿ Ç/}2¼ó„|¤MÖvöŽ.Õ[ øå‹>LdÀ!È ¥J¥ËJ<§N,ÊRfaéQ¥zÛ–ƒ–Ìì/“f0yCTè¶F…Z¢£Ö¡_`µ’+¥5Rs£05fýÏÛëDwn\Mnœ.Í‹â 2îܱiÛÞ“©z+GïfQ»wjéi«(ºü­Óû6ý²íbL²€ÊÀMº÷îÙ8ÌAD䘨O¸w¯@/–¾‰œÌÚÞµ’§“ÑÅcôÑ Š…1—ÎþyàÐ¥›±ê½¥C@h͖͛ըYÍNa’JÆ49iñ2Äׂr¥ÊÑÍËÕδ6Ù5ÉÍ?kÝ`É?[7æ{9cCiÞ÷PzÓ4L@Ñ8‹³D‘g*ë }CÆ9QLê ,:ò¡”¢hT4:kHJ’› ç§1ScµXÌjv±QRÉn³¼ˆ›ÖxLi))*”$† ¹!‚(h¤*A$7AÜAÜArCÉM…:ÛÝhìY;ÕJ'|-qæ…Ro ArS@A»wù‡ºúýL<>óZ ˆÈg\ütô;ßq&¥ðµ¬á€ ÿæƒ.ý‡IÈ¡©Ä“Š5E„Äk'víMl9èÃg3*õêÛ]´>Q`a¡sz¯°z³«Å”+íÞŸÓûc= ð#Ⱥù7‚‰WŽ_LÓ6ë9zÿ¹mül“= ‚ ¹y.L1µÙü:šBµN¯Š¨Ö <È×J.âðw¬øoÑox„“¥¨;‹Ë(.•:Ð8ýçÍ>Ïâ|Lÿ°‡TÏ‘ HnÊTkL w"‚6óöÍ[÷3òÁ5Sª–.Îö 2K;4-á`œ*…Æà˜ÆEgE)¢¦i½?DE³B1&š\?ˆˆ fߺ[P<¯¥h-%Br£fN¡q½>D5YwnÝŒMÊ’ÂQ™¢}¢é/ä§%Þºy+1-À4ŒœÍÉÍ?ÝTB<²n|õÈ·ÆlødpÍ:£Û¶}³Y£7{O¾”b@,LЭEûw¿R:+VþNÕ È/ökÛ´y§wb3d bÞƒa½Z5jÜxô–"2@ŽKXóaíú ÚNÚÉI»Œê†ˆ\êùmM«G,Ùsåþ¡eõk5lÓºó¾ÐÞ>Ò·^•þ_ogÈ)EvÊù^Íëu²L#b)‹DšB*hR–OìY»n㨶íZ·hÚ¨e××âEcÐM†®ïëÕ¼QýÈ–mÛE¿Ù¬A½¶CŽ&j€’‰CÜüÓäg%'Ä^7ªÇ°Ïs©Þ¢_ßnAÖ…çvÿï­O&‚Ì"$¸Z€¯‹h<*Õ¨[ÍÓÝCV˜wíÜé‹éiÒ’UY çO_½{çîþ5{L "͆½bï&ÔjhÖB2ZF¼&÷NÌýÛ'ê2t極ƒ»§5¢® á΄Œœ"×Äß»—ÉÕ”2¨cߎŽœü¿½:—jýßÚ±¡ÏõÃ{µŒútÝ 3öÕªeï]gî4îôÞ°¡oTuŽ?ó[ߨN×ÓµHʉ Ú©HòWŒl,³ñýzÇUc$ÌoÞvstvñZ´ï®)‘ö«mlœÛ}¼ÚÀcìöÅNJ—+JÜÞÊ٣ϥÍÛû§Uòð¬TÉË7¸Åi1ÆXn|×È*nuÏÇæ±¢`—&î[ìíääèôÆ°%E-ó.ïlæ-¦¯ÌRf&oäçX=êÓ1Q·yh=¥G•×Ò¤Oÿ˜ÓÂÁΩýØ¥E™dœû!ÔÓÉ+¼Ý¥¤|ÆÔãº4uvó›{8©èº>𦳓ÇÄÝ׋blEÑüGõù•Û~·E±‚Åø…ßDó»Výz'Wžd¼Á ¹dš o¯ÊÓ^ûu¯tø‡2 «Œ×0/;îè|È̼ÿ 1ÇÅ+ØÛÛÆ´ZV©" mÖ-x_ñâCö.Ìùì/[ß7æ~5Raú2œë ü´{xÚƒ+[O&‚ IÕå¢Ò¡¾­é‹ÑÓmÜ´¶g¸·¹ÛŠ ¨1õÏÙg…Û訆V2äPR§ðæMšZ¦9z?¿Ø]RÔŒñÔË·0-f×ÑBHÞ~"ëty;º§µ6ûö©?y€¬[;Rrs½ë rW£T•VmgÓö®–2xÑñ;âñ g9;Ï&ýÃA[PhBÃ7ëÝÔùq×b@æÚ"ÐGÔ$¾;däúûoĦj,ýÃ[·n]ÏÇ–¢2‘Š‰1^éäíhŒ1ÉPZ@\äájÅåÜJÕBÕÁ6À²Ë{MWÏ‹?{ íjÇþNÉl3%ÂÃÍÉÕ™]ºu¡Þ:¿ýtn–¬ÃûmŒY>$7Ͻm9™iYâç¯úÉ×RJÙýÝ«„M6·DCL®ÍH} ‚|èÜe:ëé߯ÿííNëÝ}*yúøEÔoÖ®snoVgÀ€œ7ÉÍëhM /¹t‘I+/ˆŒœ{¨J"ÀÈANŸŽ¼~íðż»©¹–ãkúƒ½m]W—Woëòïì¹”ãÛç`s«¨´Æ!‡%ÈHó¤S–ÉeŒkív›xêK$D¬ÌÆoÔ¼µ½Fß½~éÜî¿í:pjÇÚ ¿nØpeÍÎÙíB9‹ ’›ä,„ÔËx–¯Kž{%!&yDøX=|càáå*¿xîÜþì»ù6Îa~n Wöjé½zõ½¿ï»—˜Ôlh[x|”ÜÇvC›­ƒŒ(èÕñÑ.:Lg° ìøÁ‡QëcŒ †¼Ü<‘³pñ©éS9²]¯9ÍÝ?¿Šzgñòñs?h÷£Åf ÈwóÏciËí[·#=7Öõåûwž«v~ÃÛæáÊŒJG¿è@Äs‡þM;¾3sB¯˜CÛS-ªwk_[¢&;#³Ppvs³”sRÿ:êsÎÛ÷û®Ãñé¹hi^÷öí¢B½íLÁ81õÖ¹;wž¿_ ã-í\k4jÕ¡uS?7Û'D×#’›WbÝ<"øÜ®oúuýèÂòß÷ néW"µ('bšÕK&2ä0Íj2&šz´9,6¥)×ü·è0S”Îâhœ¹éÉY:+{W7Gk³>r&ÝjD(º ioé(›¦y›fWü¯äeDÅ õL¡ÙdŸKWZä8( ¤[ô›“¦F24kE2@ä¤u¸ DìMö°uƒ%£tr%ãv2ÆÐÎÕÓÎÕL8Œ.–b0¿ŠÒSÅÍ †G .šzNÏ.Aró:Ìž‡Ý¦ˆæ"Tâ7–®«}ZJØJçúÕ0ûý°<>Z¹*lâ_W¡Uãdœ±EB‹ÀùnÊÌ™cöú7úe‚ ¹) ëKý¦‰‹ArCAQ4 ‚ ¹!‚ä† ‚ä† ’‚ HnèArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜArCArCÉ AÉ A$7AÜAÜArCArCÉ A$7A$7AÜAÜArCÉ AÉ A$7A$7AÜArCArCÉMYÁ˜ô»è/}Oñ/ËaefÈ JZƒˆô=Y7ebÙ 0•p÷^rC$ë† Hnʤ …Œ1äÕczu™¶ôW=Y7AróªÛuFo E¼ulÕá›I¼Î@ßAük—£sAÌ»vè«•oܹyâÄu'§¯‡ Ⱥ)“¶h’ï?tônr¡›¯» ÉeCdÝ”mÃso5äÀÅ! M8^³v{òÙY7ebݘ»„5…:²m‚䦬¬ú2‚ä† ‚ä† ˆŠÃ¿¼³¹äˆ¢ñÉÆ}¥·‹v”Þ~ÚÅe0Æà–X<¢ºd‚ç=Á§æoî8+y ¥.±ÔY7P\IÍæ@àcþ>=›§ÈJüóˆŸÿÄK/vbÏœ?”HV´ù˜ ‚äæ‘ŠsóðòFOØp࢈ˆˆ˜srÒèqÓ¿X‘&m²‚õK¿øpÒ´ƒq™ÒŽÌ˜?§}ôág_oÔHÛò㢣GLù;_Úo_?vä«^‘¶ ù _Îœüñ¬E‰ùziϵƒßŽ5áç#W%fÿ5qÔ¸™ó4Àò×.ùìÃÉÓ$wdÜÝ5õ£‰_,ùYkL´rÁ´ÑïO½l<áÊáµcG~°úè iûü®ÅcÞŸ°íl “N0ýðø÷ÇÍùfS¶ñó~øjö¤fx –v¤ÝØöñ¤‰_.ÿUgL·dΔ±£f\7HÛü™Ý+Ç¿áÌ=D@D­úöÜ铦~²4]'H%œÞ±hôˆ ;þŽgdÚ/ÓÜ(‡d\ÙéÐú½/ _En¿Ï© oM_§“¶€Ü¹ñ5i“OîPÃg¾)í¸µïCÀ%¸K†ÈcL¸Ø²²Ö¤HŸë¶-è-?Ù$m<øËÇ Àªò©äïÊ¥k:°¬V3ÜFÉ1@õý+×có<‚B‚¼œtÉ'NßSØ:WUf¸uåJVàW­º—Tbvüå›I +—5‚eÈ ®_º–™ÃÂ7pQ€˜ùàÎ{®Aa!^Nùv|¾wh57{`šû'ÎÆ«Ý«[ÑpýÊå\ ó¯îacÁ5Y÷.ßJQÙz„‡ÊP̽|áz®†«Ú¸¾“ „ÔøÛwÕnÁÕ‚Ýí  U_¾|“çlª×ªf)çXjÜå; >aÕý\mɼ!^°©QåÆÌÁû’ëÝ0ÆL9”öì–v¤–rÄ>îóÇoKžÔ²/Ë.ÉaóXW1­@DüËä† rAÜArCArCÉ A$7eIqt)³Î²¢ ê?#ˆŠNùéhÀ‡™â€1B ø ’›——ÆD@N_~ùì‰#GN%fó•B"Z´l^3Ø‹cŒÀÉÍ+RÆ1/öðÈwÇ®?v¯Jx57kî~ÌõT½Ói‹æŽé¬B²m¢bS.|7ÈCdZõ¢É·^̘¸äçS§N9vâÄík(W~:a÷Å$D$Aܼ´uƒ€¹×öžñ©ýÎÔ÷ÚÙ+cÌ=,òó‰#|„?¾(é}aAróÒz ÏŒOÊÍömÔÔ >càëçëbÏî¥åÒWE¼Ê'Ž¦ ¾Ž[Q.•–Üs ítôü= 'O™Ñ™Ãñ̹³1iŠU}¤;CñªêØɳ’SRñ¿üD!Ô«UÝ××çŸ+°\¸Š —6`È€!ˆñg¶õí><Ö¡ê®=»#¼,IlˆWE^~~»î+×W(”ÿÙ›P˜«®ê¤ýjÁüÿšucüƒÒr1I×O¬Zºàû Ê‚ÞøjéŠ/KZf…xµ¯8ï€Ð–CÆ)”ÿÍ—d§¦eýîŸ,T^N¾{cƒ QÔ¨7|óÉÜ…ßÅiܺœ7sâÐ@'%Eä8£D¯Qàu(Xüg*F÷7nÊ…Ü0DiÜ Ÿ~cÚˆþó·Çv>mÕ¨AuC¼e’' 9²n¢¢S>S’y£Ï^òñÐo¥,ØvhBû(Í—Bóe,ŸÛºyÎÅCŸ¶ýê}Á3À²ËhñP¢¬¾åòaÝ0@„¬ø¿Vï8WoÀš‰ík”¬/¨5R @››šš©±qru²³BDäóÓAiíéí¦` @ÌHIÉ× ŽžöJ9äµ9É©jNiãéá èÓ“Só4àîçk-cŒ&7#5#ÏÊÅÝÕÎ0A—œ”b¥‡—»’C†¨ÉIIÍÒÚ:»9ÛZ"òyñ‰œ…‡—«±Äää|½èäáig,1;95›³°õtw–JLKJ)Т›±DV˜›˜S IDAT‘–‘oåâáf§bùÙÉéY:{7Gk @Cn|b¦ÌÊÖÃÃEÎ!=)¥€gζ 94hÔ)i92•‡›#ˆ K¹Ÿª1pî~>VcŒå«Ó3² m\<\l,€ÈkR’ÓTyz¹É _œ®ÖÛ»{8Z)©6þ{<8Ü?:¦|Œ*F€¤ ç1Ëø½Ÿ×©[‚Z5k [}ì…µŽ®ì ÓùU W‰N*ã•gÕðp¯€¢(:ÖAUÂrd S ttó  ÷u°–¶e ëà°ª.Ê Î˜ÂÁ£rX ànoEí©“ÜÜOL<|ä°N«5o9„††–‰aQ>f„3Æ9|r’˜þ§C@³m‘2 ÍN1fé1‘1@Ž{¼ïæåJdŒÁC%rOÌÿ‰¾š§æ%|7¢ÈK”ˆXáWeËËË2a΃¦*”vÿYåÌJ‰ÿsá»QmZi4ó˜ñýúõ þ÷Z7ˆˆOöÎ0ÓÍç{4Ìõ‰1(YOŒ•ŸA©èV`JoV0"¥Gf¬†Æ×½ÙŸWU"¢YzS‰¦O—q~Ï¿éV›]Š¤¥æ%’uCT`¹1ò{z’—ó=2ÏâÏŠH• ™Ô›é¶uû½ô=ý>ú­ÒPÌ»³ë“SšØnàúõÄÑ Y9‡œöÞ¡E½gD:ÐØñÃÖÕ6®X#XáFí:x¢0eÇüîo%ËQÎ'ŸX6pvK×9NlºöÛeZ&–²wHn/5ˆŒ1LäõI7N®]±|éwkþº’ çŒ1‘"1¯ßuÃÀ¿ÁPYêïK:†mX¾"5=Ç`Ð+l<üBª)Xé‘PÅ° —6ÿôg›ÏŽEµ2èEÉ÷"ç4'¾|!Égôî‚¥ÝòËݺú£/D¸º}ö½wû­MúêxÞ‡³ß»¹~êÙË÷Ã/‹Šl`åÞqüÆ_=þîÏvn=ßõûØ…'ò¦}5ñÞ/Ÿž¼qßB†åü­\^V󓬘̫»FŽ·í\’½ƒ„lu®{¶‹V~ש†5©ˆ×ü”c"8G ò™ËÅ£»n˜¿xã+×ÊÞÕÛD˜äïøÄ£íÛ~ò[d¸³†A¶dÉ#hSN]Øw«íòí^–Php‹šñsþòŸ“ÒÁ%¬]·OgûZózp¬5 ªëG¹0QdŒ1&@ÎЮR‹®sÞ¯ä`ÐMwjzŽÌÎçe€@¾›gsÙùi³'Œß}[öÑ·¿MÜÚ t~ülìôÅ#ß›V÷à2/+9Ðr~Äk|HÊнF‡èˆŽ§@vÌõË®9³gÓšî ûá—JŸ‚–~nV@‹â½šä#òÞî*=Ï8¥gäÀy‘¼†aD7Ù­Sç·H»~ÿÒî;y^­e¥²ãܪ¿%»{úÂï+São$]Úu3˳IEBWŽâLe'Ü}êVÈ[Sf nmÅc-~<¨uXVÂћɅF+ˆ ^›uÈÒÏïjB6'°5³p«Údè¼ASæŠçïž³þi†¢Yrp¥œLÐ3ÓÜX‚X•'ˆºKk‡~?}ìÕkw­¼êD¾¿"Â!C`%i`¸µyÔ²†_¼xCåZ½ñ¨u \3±ÜÃrbÝ 0½"¢aóˆ·µ¯€‰ŽnÖ¼%Vˆ{IüÛõÑR}yõ=§ž£[cžè S9pr•ÒÒÆh¦3ÆdrT'Þ„’k"–|]Z¸7´×­NÉ,ô²±Ò ¨O=±ú“i§ÿrnëž°÷wto_ €bÎEA_êDD}úÉÛ{¯êÛ' xYˆ·D½`R-ê™zªï†1Æœ«µÝ´ûàG­*ƒhœkG¶oÜzÆ5¸y˜·-õM¯»1ÀÙÖî?éî/ïmúvUÜÍó)±îüµî·…¨B;V­í*wp—å¦Ø¿#¿0;ù¯U»ÿUD{|vVž-";ï]ôéí»·rœ<ðÍÈTh꣰´Snü“£)L»~`A·³éN†œ†2QÏ,ÌËÑÂÖž¥Þ¹¬Vj²nYÐá¯$'Cv¶XîÍÿr²x¨q±Ž“Ö‚IîìRù„̆ch_¥çîí˼­9ò¯Û¸a¢•Zͪ3lønÒå­’Ïסò[Ãç|j#0­k·>ïnûií¸kë° ‰zgZÖ±Àq2™I²“ZPÚ6Ÿ¸)eÊ[«ÇlA(íÃÞ[:SÅ,[œüãç“¿Ü7˜²ú;«Þê<î—Y}½Ü…ùî<¸qQ¯6ÃöhùÁœS?Xø×Be!o¯íÓwÒú}Ýmþx#² ã˯סÜõœ1„œoÇO¹©ÕÝ8ên×nð”y{Ù*€‡xU¼ÀòZEó–dÈté‰1,=T†|&Jm( N“›§sô µV\ š<Ædhc…¹LþÇ)9K%ä1@D¥‚e&ÜÔ‰–Îþþ2D‘qJd™éÉÉÎÁÎNº‚‚¬Ô[÷K.?ñf>oãìå#—hsÒ$*œ‚\œ-õ…ÚÌäD÷@ ÷ì•ä?º¼–ùR}È»‘ ¿Ðç|>¤ýgó&ÔoÖpPSÒâµ6ù%ÿ ˆz˜…ƒwUéÙÕçƒqâ$p¢”þnÀ z4è ¢¹E 3@¡CÉ82èÁÖ#ÌôÀИ€)œ]*9KŸ¢ÜÚÙ;DXº†ZCÆ“Ù;W²—Ò€Låì O[¦Ž|7¦ï2;5îÂÅ›¹:±X‚”öú÷óá3÷_½K;Q>šTÆÇÕôSj3iiù⧠Ó›¶Jæÿ¨ÿ‹ÇÜ?.M¹…+/bxfóÂfõÚí¾•a rJ™R)g¼ø‚=SL j¶i¾^ +µ ÛfùJo?´ŒI•ø´ä/žÿC×ðˆ HtˆŠ,7Œ@p• Uâúm§ÁèŽ8ÇÛ7©\éEu  A—¯V« tzã>¦ÏQ«³s ŒQS€æ媳³µ¼QÔD^›“­ÎÉ+4Mð òr²Ô9zSЃ®P¥Î׌§/ y9ÙÙ9y¼hŒ gÐæ«ÕêBc¦ËV«³ó Lªùˆ³ÍKD± 7G]¢Äu–ºÀT¢^“§Vgk¤ÞODuÙjuN~¡i|+ÈËÉÎÎÑ™ˆMv¶:7_cº"!?'[­Î5˜Þ…zt‹xãÚè"Ÿ›£ÎÎÍ7f€ Ó䩳L%D…¶n¯ú[Võ9º|ìÈ…Û󢘻eþ{¾ûÃ5èÍŽ ƒ^xÂ"ý¡_ O•IRœ)Hû)ħrƒ–ïÄ«vÖ¸>­ªU«÷¿ ñˆˆˆ g–Ô«YµU׉¹’éÊnèÚÀϵæÎ,Éôå¬ûÀÏ«òûÿÛ+¥×e\jÛ¸FD£.W³4’-}àûÞÞ!¯Ú'•ˆIk«x5Žž  fŽêñfxõú?^2îˆ;ùU½šamºOÊ•ÎP¼>¤C]?·Z{r¥ ûVŽñó®=gÊ,èA™”øpœ©’ùÃËÄ™‚Ò1Â)ÎÔ¿•ÿjGxq`Æs ¬Ù1°¦Yõ}ñUƒžgª(èÒKE}zdœ),ËgªhóÅãL1Š3E”åmñÐÒqq·ß+Èú¡\ÉÏ(ÎPœ)â¿à»!‚ä† Ê E#€ÈWMrCe‹Z­¾ø÷ß`ŠµD¢CrCeÅõÛw[wî½à˯ z}‘½C·…ä† ^= ¹¬ËðYqŠÀþÃÆü먹CºCró­tã» ÊUôöÔÏ{ÅåßP_XYJ¥’×kDumúî¼ißlž9kÇq¨ÂPN£hbñ’h¾<ÅËiEñø‘ç¬DƘ3–E÷\hê¬~ÉÈ}¬xÍ _ã«aÙŠÕ7îÄÉä²2y1"—žžnSå ÞJKÛ¾/=w`{÷·ß9¸w‹7[•ÏIÜ<{í6“ͼórߨ^¸ _6Ki­êâѱÏ^—M±öðÂöå‹Vm½–… Upã>šÜÐÏöÅ”‚!¢?¿Oûùµv¬Ÿïã¨|aÅ1j “&µ¾À5¾2ŽŸ¿Z½Ó8K+›2ªö~–Ö¼@àYíæu ZÍZ8nߟ{?ûb¾¹™CPcê™ë!cˆ ¤ëÕ¤V¿Yߦ¼ô²è§~Öºç{§s8‘=çÙH#i bõhP¹YßÝÌtõôt¶†›—6ök?òË\Ët’ 01#1ön\2/¼¬õ†‡VnÝÜ¥üç¿ÆW‡Œ“YÛª¬í­lÊèG&W2Œ1 Kë³Wd¹4èÒ£ïõëW©ÇŠ¬›ç¯ß ÏšØmÈÙB{w Å 72Š^uê¤kç¯0µL1f t‹£dlrózÌ"¦L>îàͬž_ü±bLsc fLÐyݦ#ëµøiP]€G—˜Õ`¶æë­qV#–ÿÒÉ`çn¯|Ì‹™ÅžD“«äÙf<¸ráªs®`v¥³,ó63…š,; ÃüŽJgбˆÝê·éÞ{hÔÔ±ïöîÕƒj5Y7Ïô( Tµö-½6Æàï/aÙ "c¼>-]]À#Ô©YÙù¢i(ä5iÉ“R3 ÒÄ'ÓI˜W DÐœ?ô×Õ=ü8¦¹ÜT…9k×E›WÜ }Àò²RcÓy‘±Jo(x—^ÀKNÔÜ´û‰©j€/ÌJŒOÈeÎÞþ~ ÎÌ)n(LMz˜x?%]]¤5¦{ƒ…9™î'&&&&§fŒŸ2‘ק¦eäˆ òY)Y™9…R˜c@4¹)Iî'&ÞOJÉÕ;¦+îë¿ØßeæFDƒAhÞ{ôŠ•«ÌšÏÉÍ›QRE½¿kN¿éÞþô‡^ƒðêÅO»Ý<Ìyð¢8Ëœ¸AÕÛM]iDÄÜû§& î^¿fˆ¿Ÿ_µÚû Ÿ~æ>oœÃhþ¤"@~ŽF_(ZÙÛ@Q D`Šzs>:cx£B¶z|¯À°aIzãëÒnüR§rÀà·Ä‚ÅÝ›Ôî4;ñú‘÷:5 ò÷û_[Ø¥aHÓ¡‰j½T‡rœüpH·ºáUüü"µ6cE²P4W*÷ïfumÓ$$Ð? ¼NÓ^Ã?¹”¬AD>åfd¨ë˜ïX¦]îæÜuîFˆÈÅ]7¸{»Z¡•ýýýªThßcð†#w¥ë{}í­Wl戢(“CAŽzÍŒ‰þ÷ÛÖŸc¢(ým5¦÷ô€¨O<:pÌ\¿®3 ®;ýGX¼Üå¹ýrðòÁÌÞ‰_®=Ð&ÔUÀv½ÕrÐñl—ÁCg4uK¸xp銯/^¾¶å 5• ¹R ךÕü|­™6Æ]קMÃZ5ªXrƸæo¾?ýMc»”ÖVà`É™½„9™ÒÞm”2i =K[—;¸ï4»ªonQÏžÿËFe¥µæQˆÝÙ­Íà“:ßá>¯îc}õж•_¿~'yÇÚ2ÝîÅãÞž²)´M¿Ï—NvPð7Ïî[µö‹Ax`ÃTG·Ê[^ØõÝÀyÇì–ýt02Ô4ç–¶ì*ï³n’RÈz9W"2¦P…×Oô²å,¸vx¨ ÈŸ5nÎ…|Çù›ÿÓ<1†u î_wÊŸ“¾=½gzdI2ÆйÁ×KæD÷ýxýü‰Û¾wtuvö«Ñ¤ÿ€AšUS?ÐLr]°‡ˆÅ+V¡27þ¬Í;³?Ô^ 楆 È™6é³ó×~ÿ£WmwÆûw—gwZq|óŸQM=t[×íDŸÖë×- ²U2èÛË)£ÉçŽ$Ltr² ¯qÓÂ)¬CëV¯âÀ„_¾\îëú±wu/Æq` y\³…×ΧfÖò´A,?Nž:åìöµ*Ë¢.Š¢FSøªì Ž“…¿ÑÅÁÝGº§*î›±]ýí *²!" ƒÁpðàÁk×®õìÙÓÙÙ¹„ëŒ ¹)R`ŒaÛœ1ßÏÝxd^%€øÒfzÌX‘¥ ¤%Ið¨Ò¤WÃÀ"GFøˆ…]?õ=±eUêôH÷âªhtî2ÆZŒ¸t¹Õì9wáïÓ§NX¿tïÏßYØy¶êÚöœÃìeÏVy™ÒÆ}øû=ìe¬híwéúuIÎÞŒó­Ü¦uM£dq&ŒV¼gm r+—O¶Ÿ¢p´³0¶ð,¼ÈŠ—Œ—d[€Øñ«-7?çüý¼Á´j„ 0@fZ¯¯LªßÜ“bbîJCï$rsóöì9®Óé^ÞÈA€ôìœË¨hÕo'‡“;¶ß0¿I½ZÞ>>‚ ) ¤¤¤,[¶¬E‹’™Säè!Ñ!¹1ÙˆIg6~ðÕÖ6³öv­éaÔ ëÔ=ï8®G¦Å¼ü̼\G`¸½ÊXcàý†ã¾³7/B+,a™V¶S¹Vî6hT·A€¨ËØþãâ¹K×Ûº´Ñ{·nüèþL#Œ¥uPƒÂ¤°Å¯muAbFV¡Sí7íeEgÅ\šõ˜ÝÌØ1åå¤Óäß¾päÈÑcgÎœ;qêTz!³±w{d±LDGo?;]aæý«Ç>uæÜÉ“Çn%Ø[Ø–i[84,,4,Ì|fff\||Ñbq/Irj†F®àønlwKmJ.DQEö° ‚°ÿþ³gϾû¶¶¤5ä*.iÝ€aǦu)`që×q£G5zôØÉ¥Y ±§góÎôߘ©ãó%Eƒ(2N¡*ZöNÊÔÊNÅDFÿ}Ąħÿö!{™ý6k3Ê,8ä^Ku¼ r¶œiѼâƒQÔîùß´:!þuÞì¹|Ë‘B•W¿÷§ô®ëRhx¤™ÂäãkÚ5­åÖdÊ¢µwÕìnïÏéQ5_Çʨ+_Ñ·óÔbî]=ýãøNÕ½­ÚwèPÊ%l¶ª™ñdÔjõâÅ‹=JƒqȺ)K¥ Ú!ù÷®^0ââ3´(²®_:_èúªžeK 'K•"7/&Ÿ# 2`xçRº…<ÈÏá!uþøá»Ëâv½Ø6Ì©è¹fŒ¡Â³Ç°Žßþ¹¬0ö:@@‰- ‚£Ö‹ìÎœY*\¬-ÚÔ+Zèª2š7ÈÒ®þzü®£Ö•óŒŸ¹T^»ÿùõ_VqP14«ïþ´æêcªPAÂÐQ³oÜÖ=Ú£®»d %ÿpiì†ø ý°ZÈ9™úfë-cZ­ö©~DAÒ²nHnÌMqy‡÷æµÀ=) !gFÇ°­NÝV®[ä#7:&^ü‘Aiì³tw®äâx8îâÅÝ›~Òƒ¨½ºâ×eŽÑ]jùð9dŒ¡Ì²f­H7áÂòÕ¿¿9oEñ2šÀY¿[gü›5CÌMÉ“gqêÏc%ͥǚ\N®¾^®Îï¸;½¦qmòÝ‹§÷^tbá‘s^ê¸,µöí÷†Wq´dLàù; 9J¹í£š¨ÍÌÉÊÏó‰èܶ®‡dÀÅ›iJyñÊÆ®2Æœœ[·Š2ôE ÝG^‚dÈèõú–-[úøøÜPcê¡w—•SŽŽ¶övJ Likoé`g%ãa>oŠ×‰‚”_}Ð&=ööèÝ+DÄì»ßê?7ßÎ}ê´n¥[%ŒquûŒèÛÔûØŠ©Q]‡î8y£Ð ‚¨‹½xx€ö³~»gÙdâìöv\€—½žú`ÒO†ˆÂÉŸ¦Ž_zH|Æ!.¶¾Ÿ¾]ï~üÍ!=Ç\ÎbˆwxÅ´_.x†¶ñUx¸[;YZÿ[¶NŠ‰µd\¯g²,e:¹Ù@fƒFy•½•ÒÆ*éöå›ÉùÇ!â±U_wÉV)æ½ãâ?Vý^UAR>³•ŠX&+_Æ IDATWªÎš\Ë Ì¶J¤7ÎT*ŒSñ32ŸÏm>¼ôÓjZȾF³™Ù%dOô³¾Úò?Ð1 2™,**ªqãÆækS<¹hkk«‰ïŒ»wOš²‚ˆì=œÌ;U¯ÏÌb3¥…êò‘ß,òã^íÜV™Œà5WQS§Õþ·|7eïzdt<|‰|ÌþÇG…šÃçg®@ÌKEž3‹q÷Èk4?ÕðJ=¸¯·ÅˆUªT©V­š¿¿Qü©ƒ€¤”M›6kÚ´YÑÎûyÎòÊõ[µø‰-¬@Ÿ—e•uÑÛÛûßçoæy¾¨ï’ä† ž$ÐŒ±Ê•+Ãs:d2ƒAoõ: ”’@0tÞ ×ëÿ•Ý[ÿä´2’¢b[7¯¼ª”X‘Œ=]§þ=m€²‡¿»’P?w‚¬‚xAÛêß׶*ë± åGnžÐOôˆn!‚x-/ÆÇqÖÖÖ¯¼f¾ö€Yˆ¨R©þírÃ!C}~|b²N(1d8•¯Ÿ… IkˆVéi7|ù   Šâ+¯í¯×hBD;;»2zµ—¹A†€š¿·½=pòƒ•ÙúLf°åÏÕ],Ⱥ!^¦ ŒõîÕ{Á‚þ~•^>OŽãlmmÿ•·ë?ИbqqIR5am¢ݬ‹GÿZ;Û)É¥M¼T3*99yìG³“ z½îɳ4èþÕrƒÀǦ¥¨™Ã¨é Ú†;—ˆ@Žâ%*OfVV‡îoœ·åĶ5@Ñë£|X Æ¥ïtÉé1‚µ›‹­iI64yÎByÏÛ~ߺy³cŸa=§ÿàìáô¤'ˆ®²§œ,Àô†ŒøKkkQ}ójšŽgJGKJóª^LÄ3[4’9|ñï ]›¼òw{Q?f¦%ÇÉè¾ý7ä†Ctºq¹¨KØ62&!Y£ÑòrÛQ=¦Îþ4*Ü•‰%@Äcìš"­Ùºeó’M‡&¯ü““©˜ÈN&ßôËf7W×RÆ "^¸pÁ7²:ÝÀÿŠu£ÕgÜHÔäÔþÅâÖµU¬àìÞ _,Z?x`Ò=›C]•ŒÌ♵fÁsöß*èóÑb90@]!Ô‹î›w+óá6•AmÂüCk‹ÝÅ»ÜHχBå8tÚôw<ë÷n[Gr)ÕªÛÀRŸõþü½?¾2§GÝ—\û†øï(ÎçŸ}v5×±ûØi¢PÜÏÀ³qtsiü¸cyõH”-åÂU,= JÏï ï]›+Zvä]ÛwuÈÿõü](Zh ž(7 ¸©ólÞk¤(HJ‹]9Ld¼÷ƒH3°þr#…”DSo3FM@°vu°²Ujòu¯¤”R;J~fÖñŤíG&5Ï‹™§/ý§,KdOËŸ½`þ»”%–Û.BQGŽ ªÞ®UŸÁL,±ðMÑ|NDxÜñ±n/o_Ò0¢éºóŒKÑ1ñ)Y|íPx¡žJóŠÈÍfÖ¡´)×)—^Å«i¥M¡ï¤Mé9‡q4å`öˆ—M‰¦O—q~Ï©k@Dé K”XnM€õë×_º¯©Õ»0_Š¾PþÍš5«œ´·A·ì›Å'îÊ££š9YÉQȉÿzÞ¬í7¸93>ñ°A³å0Ÿ£™á¯3×µ2kG[õIœNHËs­ä©DD0\?úÊÍ{œ£›£¥5ê{'N]x¡õôr“!"\>{êÒ•X¿[9"²ÌÄkºœ¯°õp°ADQ—sæäÉ» 鎞*9Ç2âΟ8s]§°sq°áQwÿ೉y Dõs§®ÞŠ“9¹;¨ˆ¨ÉŠ9qêï¤L­§·TbþÅ3§._³õ°‘!"ËH¸zâÔ•¥‡ƒ5"&Çœ=yö¦`åèlg…ˆ¬0ñÀÁ3ÉÙ:7o7"2ý¥3'¯ß‰W¸¸Û[(±0ãö‰SSÔO/W"²œs'N^»‘hàoÍ!¢˜såÔ¹«ZK'7[ D4™§Ožº—˜éêéi!ç!éîÙ“goŠ6ÎN¶–P.Œ±Zµjå$Ý=rô¯àˆ&’uüòç)W@ìå³ mªù”ƘM½zõHA*¤uøWo?¹넃K»õ0ë‹ó¿˜5 G×9ë/t=§u S“ëù38¿íãöQm>f\§-óÎÑß:3Éh‚çÌ›<ì­n}¶Þ0îH¾²¡oÏ®ïû2ßh$Ì×/ªm÷c9ÒçÂù_FE·ÿlë i[¯¾3j@÷žýÇÅäh¥Ïl™Ü.ªÓ’m§Œé;:F·0bŽ©ÄìÏ?Úµ{ßßn%K;’.­íÓ½ëðñ‹ Œó½™£úF·íu"ßèÄ<ùëÜèès?+mZûAÛèŽ+\5FÅy°¥]ÛöïN\˜i<Á¬ÙcÞéÖcàž{iÒŽÄsß÷ìÖuôÔe…Æ×' îÝ6ºïYcÔ=ý¾Ÿf·‹ê¼pß©–¤þýÞÛÝú šô ÐxÏö­ÝñÇ£7Yù^bfüøq-*«6Í Èÿt™ˆŠKùè™’Gn3äË_¼k.ûáç]?¯úN>á_¬Y8¬OsKSX•Ã-¨q§.Ž•½âª èع“µ_„µQ”u›¾)xåWv²‘vX»„´mÛÁÊ»¶ÂØf[?2Úà¬÷6.Únµ»v.¬ìiÔl ‡æmÛg2/{ ãP1÷à&;»DzK´ èØ©“]P}S‰õš¶ä|5AŽVÆ]C£Ûw°óPOÙ¾Qóh™‡àeÜæ<ƒêvél¨ä.mûV}£s'Ÿp_gã-±®Ü¹c'šµ  ª~dk«PÑÏΘ¿­{x»\ƒ«¿otjÖº­k¨ÜÍx~2ßл*kWr1>V®oF·/°²‘s¦#»vò«êíå5§©é#ÞigÿÓÏ˦wý…Àþ¿½3¯¢:ûøsf¹ÛÜ%7¹Ù“›BØ’°#›¨ˆ,¾oUÚj­kµ¸P­Öj«Õª-êk[—‚¢~´ˆZ¬¯Zµ.¸jA@P(…„›²'w›{ï,çýcfnn$áý}¾ÎܹÏ33wæ7眙s~ ÈY–p¦“ k²Ç›Q)†æ7ÚO)ç ! HÑPXT±Ú3ϨZßÀÎrjÜã4Ûݼ ¡¨-ê/g†£B }üz}âö. Ó¢Ó!ÈØkÓ?c¢×ÃÑâ÷‰w’ñ{‹eõ„ dzqMÑ&£yïÝwï{ìùe¿­»çP`X8\W]µóß'Õ È›,å[?*õÚ³³³û¤322–-[† rúÕn á©¥”3Y\&KÂ9ÄÄo_kL~õ33 Z[R”Å$ôHPJ&nݤ¯šht@©áUÇ"Ãôw{dÆÞ—¨ûg4+~o¼“ŽŸ°Œ¾G £KR<ã°­Ý?5¡”þà‚ L<÷ç‡oøé=ÏQ¨ÙJ¾Ùø†\·Yl'V¢P˜Â§¥¥á+9ß¹é×gwnÒ“ûˆä½ëwæuÕÄXG7iI€S•‘/>`ücíJŸŒÃüª‹Ÿ0 ŸŸ‘•½äŠ¿Y½‰ay Àò¦¼¢1n—s`aQ/¾ ]Åý.è{¹â-ÀY¤µª&L˜ðì£|éÞ+‚=ƒƒ‰çáw­vƒ C.:ç-\ ï¹sÉÍ«>dœ§ åANY«JUÕ%?ü‘ =¸ÔäÎÎNÅJ Ê ‚œš ŽÖý·`á¢ìœœsæ/û“‹”$‡DÙªÒÎ ³ÙüÛßþ6%%E–åÄ·–!ìÉÀ0LâˆsäôjLQBR Œz`Ç'ï¯ÿ´¬¶5){ÌÂ^zÞ$/5ÞÅiÁ‹ŽÍf[¶lÙš5kšššðYÕ÷°vc¼Yψלּuþ¹üéåë~¸ö‘ çÏ»÷Å/•„wÿd¢C)å8îꫯ.**’$´ú¾É ÕFâ=o¬üå½k‹~¾r÷öÍ6~ºùóT$=õàí»›ÂZåA{®ý8f³ùòË/Ÿ2eŠ,ËxX¾OrC€R¢†Ûþwí?Bž’Çï¹&Ýee¸ó¦Üzç­%鎺¦v õšÚM¼ÏeÉ’%£F²X,xdþ?þ0N ñ7o^<ãüàœÇ·¯]je㟨Š¢2 ËÀÆ2äç]?%ÂcrJ.# €ØXÝÔ8ãì’@Ý7¯~ðiCGØ–œ}æy‹¦É&TÅžäÔœwÈ÷Mn ÔÖ­P!ôŸgÞ³6äÌ÷&ó- ¾»ï¹ÿæGþñçëÏâÑTANs†ÑS@)39lÛÿñÏ·?³qýëÖ}ðÞÿñDÛ3wÿbãÞcj(APn Ës ÒfÞòð¯¯()ÌMMË(óƒå·ß­yöÓ]€bƒ (7C…àq)±Èˆys<Ñ棅㋲2ØÝ•-€¶v‚r3x(P°y‹2[›¯]¡@P  êGÃ’'U€AûL h¿Ïû–û™ÅõXX¡!4Ö\_SQq Sm>åPסʊʦΠ6+±*Gêjª«kë#²ªe v6VVTî22JÝÕ•5uÍFFùP½–QÒ2ÆÂí5ÕUZŒŒÑ¦º•5Eû> vª¬¨lî RJ¥þöúÊŠªVX‹Oc]U•µ -’>g±Ü\W[]]Û1â‡ZTWÕ5¶*šY)jTVÖUíûª¿½©²²êpOX›ßX‰…|5ÕÕ¢ Õæþíi«¯¬¨j ˆë˜ÈÀkÕjÞ´á“çJ<‚³ðì'^ýhÛÖϹõ¢§0qþ-Ía™RÕpˆ¾¸Ä‘ç5^6´ä7©+æ2\š)Þ %¥y©.#€môØbä[y½¶èL+œPÊñ8ôŒ¦”’’ ÉEy¦xƱÅ4”j52Ú3Æ/I™kd´æŸ–]z™8Só&––z=úœÞI™…‹å,à Li¥ã&äŽÌÕm©_0j\‡MI6â[YÅÅ%# §-"Ž)šy§¾}LJzÁ„ ¥¹F@–wŒ_Üm*4±úîÌQÆÓL—8!2à+}˜Ìëwš ªnò5ø£’‘涳 ¨˜ŽÒ¤T‘•2 Ëè¶+ª,«@ÇjW3U•RÊr,ÑMPTEQ ! «_mª"«XŽÓŸÆk+0,ËèvŠ"SJ8ŽÕZpª–‘erRõק¨¢(ôˆŒZ@ TåÈøDÛ ãÄ'Èñ)¨ªÕfªÊ %„cY}4~BÆáé3… Üœ¬âhý”½÷Î^O5lŸÁb•’RmÜV¯+Ѫ\G®šËXÜÇ`*q2§S•ñèÆx}<í(HücíÊQ§=CÓVnŽ¼ Ž8çA¹A9ØGåA”A”APnA¹›Aû€L{ 09}.³ùB¤°¿¥£ûh#©Â:ò²Üøê ‚ Ü Ú@ÝÆ'‹/ú}ôhŸÑìÛ”ÆÇQnåfðM) Ò§,yáï920ñFò¢oÛ_V¾X|ã<ìdBÓaòVq|hT?_»`UÅØÏ7ü-×ÎàXÁÚÍàŦÿÐ(­¾³ëÍ'ï_YýÁŸs탚€A¬ÝU{t»pÚµóüÉs×þãÕ{—辇hŽ X»Jµ!šÚÄÖÜrÝ6ëü-×- ñi°-… §3î–PJtWòÀúú ¯\Z”!uÔA¹ʺÞeüÞ÷-ã–þêN+ã ~‚r3´bÚÌ–/ß÷ZséU÷̱Õ\a°fƒ (7Cª6€P^~èõ.gî¯.›Ø»xhjNG¨[ŸÏ:Íiw&zôX4qýþNeFz¼øt€ñµ+}2âhd` §®bm*Þ`ó[{+ÝÙr2( Aï0"~P²ÁÂB£AàL®$;C€†þ¨DmN§…c@•#þ@X‹Ëi#JЈJÔ‘ì6 R4FM‚Ãná€R%ÐíW€uº, $&ú!Élwf-c¤³3Hx³Ó¥eTC~T›ËiaPäˆ?f8‹Óa#@ä`O *ƒ#Ùm&”•"á@(j²;fž ûƒaÉâpÚL5ÒÕ$&«Ói므àtšõø¢ß/2&‹Ón#@Hž@L!Îd· (CÁpÌìpÚM¥”ª²ßïW ïr:´éäca ,[.›‰Å.{dà½%ÃU¥*m9°aRnòÌ 5ÿ©›K%ðñª ’lž_üõmÝõ©ùùtkrÑÔ‹«uŸ©¶ëΟš‘5råvÝõ©vËŸ sÓ§œ»¬KK®–_9¯H`¼oµé.MŸ»Þnv_ñÄ{ºKSË×sÆåä·«U÷™úpŹ,ž[žz_ÏØøœÇì;óòZÃÙêš…“3³G=µ£Öp¶zpdnÆô7é>SòžKÎ,´syïèåèºU×:,îŸ=ó‘V~íùv“çîW¶è>SÕO$ñ®I‹njÒ7ðÐ¥sK²¼ã^ØS§-¨ÜpW^Vú™ÞaøLm]8!ßiµ^Ô÷`íƒ?uÙ<ËÖnÑ}¦ê>V”=¢äüêÝgêåûαsžûßÜ¡Pªª*Z&!§«ÏToÏ Î}ëEBÆÍ¿Ø¢›ùÁ”å-6A0q†‰ÃÙì‚Íj1Z’Älµ BŒg &Æ$‚Íb2¶Œ1[m‚áH< É.Þ8z„±XXt×–·vÁÌÇ¿Á }3Z,6APxݧ†·ÙlV‹ÙXŸ±Xm‚ Ç¿ÏñfA°›Œ¼Ùbï³G¼ V‹‰Äã[­‚ Æ÷ˆáL‚ X­ñø¬E°Ù“ñ}›̂]0óñ#ÀÚl¶ˆÙÂèÇŸr&‹`x“ ƒhÀ §v8¥T9‰É¬ÉfæÈPUÚ)‰)oæy–*‡Â1°›™P ÑHDQÁd1s ª*E#0œE¿€Õh$ª(Ôl³±¨"KѨ̚ÍfŽ ”¨Q1B1[Í Bˆ,‰Ñ¨Ê™Í<—‘e-ÖoËHÎÜ/£ °ºSV,UôŒŠ‰ÆTÞbÑ‹Já°DXÎb5 @i4QT0YÍa@Ub‘¨Ì°œÙ¬ÇˆQU³`ÓâËR,&)œÉbæY­:‰D‹Õ¬µhe)32bc 9íåæH£¡©Ûôß·W}¦úô™B¾'µA¾Ë`SA”APnAPnA¹Aå‚ ßG¹¡´ÿð?­ˆëä;ÀpÄ@)BõY´BÍ6ljMçž[’ã¢Ænør‚ Ü ú ¡bó3¼íÎ'ÿ¥r6žQáXÉâžyú¡i9vœ§A°15Dµ¢†×üqÙOoœ}íÿ|SÝÐØ\ûú£ËÛ×\zå=-¢‚Sú!ÈéÎ0Ä vÖ^}öœ/™Ù»vü3•×šNÑ¿^?ÿž·›ßÞôõ‚1Iøk!Ön†E{"ªÍ–Écæ:ª¦{Ý’DE1†?‚ Ü ISŠ€`Ï9kŠ·¹zÝ[ÿ.S€BíÛþÆëÛÜÞâ1yI Oƒ 6¦£6ºe]´iùÕ=·µ#ÙÄ1j¨»3æ™þÒ«kæŽpö#Ön†@óŒ^à6_M[Œ•À”–í-ðæ&–SÅšÚF™êª„ ÖnÛ˜¢@ÄŽ²Ëæ-Ú*½óþk“²Ý C#]M÷]{Ñê¡—ÖñÉ™XÁA¬Ý ^ô!pð³··Tµ^xç_gŒH3™8Žãi÷þXãë¶E­A”›!¡«3‹ ã ]4®@ÉO S{¨=‘(úL¡Ï‚r£ŸËÙ^—3¸þ£o@ëÍ¡Êvì>ØÂÌŸí»¡9*†EIQ ÿ 9‹É°/Qc±¨(FÃÏD¥JD Gc½+HÑH8‘ï+Š$†ÃQÙøhLÅHŒê›MúgTeQË}3¶6ªªDD1‹õfŒˆa±Ƙ‘Q•¢á°()jbüHTŽÇ—bQQŒ&Ä—#¢˜¸G±ˆ#½GD–Ä°“m´ˆJÕhÂQJ)‹²ªâXdPÝ&ÃÁaJ¥4Ö]ÿó¹ùÎÔ‘?àC”RJw¼ñç‰crS2ÇoªíÖ®…ßôÂÕ£GŒ¿ë¹uק–WJ ÆÌ^xýAýRë¸ãŠE&ÎX½Ë§-¨Û±jæÔÒEßÙ­ûLUýòdzGfOý CwiÚôò…Þ17¯Þ¨•Å¶=ÌS_¸mTþØ[_úL+¿»â’Bïø‡ÿõ•î3uðùѹ£Ï»ìw‡µ¥ÖeKΙ8uîkåÚ‚šÏš6±ô¢k–ô¾þéüiEù³ÿ­ûL‰o®\6zÄø»ÞüJ+û·,ž=qÆ9WÔúµc¦¾ñÈFæŽäýÝè3…œæ>S„JyWîãÏ=¯Üú›w]ºvù•*%œÉš5bÂò—ÖœYàÌM5ÒÓâ;X×ÞÖËJ ÎW—$´HF¹½¥¹®¾³'"keYìn¬¯ZÚU]’¥ÖC¾&1¤è_Ú}õumþþ¹knlh¤Ö¨¢×ÀÂ=‡}¾ºŽ€¨—e]]˜Ò"[7ÖÕù{¢ú)ÒUßPvI´¥¹Á×(…õ2ˆ=m>Ÿ¯- ïB°ë¯¾®3Ñ?–zê|Ì¡v=•[5Ö׫˜¾Å’ØY__Çdv{9ÜÔàó™"F*ÐÝêóùÚƒQ­¬ÊbScC‡Ù#«ú¡®C¾†º®PïÐÈÀ/ôaòd ˆ¶%D•Ävß¾7ïèˆðã§Í™Z<Âe5i2@'˜˜ØãÉÁn³˜¢Š]!šœnK¨ øc²fÚË‚fq kr:í €ìñG%êHI1,tCþPÌ,8ìVT  ø»{T`IN–BÈÑ3r&W’ƒ9VF¿H8³Ó)h=þ˜Ž”d-c, „bfÁá°ð4n¡kwZÍŠØÑbM§KÐâü~I¥‚Óif5_ª°?ax³Ó! ’¿; )àLIÖL{£b0–,v§ÝÂk­±žž%œËå`€ÑPO0¬XN›‰ÃÆr:ËÑsä4Úìd(<§Ðg }¦”›c_TýÏyAPnAŽÎUŒ Ê ‚ (7‚ (7‚ Üœ(ôÈöe#ÊÍÐêLŸ!…ÑPÐ÷¾£BQtä´g˜¿PJ¨©ßü«»­jì’TâÌ(ºã¡GÏå¤*% àl7‚µ›ÁCPBÀ÷ñ“ÎøÁ[[jìžÌœtgÃÎwÏ?sÎê-Í„!g»AÓœaòš¥”ˆÝû/?{ñ—áìw7¾7-/™µÍ·ýªó—ì·žóù¦µyvk7‚µ›Á« ­;6n«­?û–ǧç'k³§L¿ýÖuølë¾B°ûAPn† -ÐÒx8tN/MÕÀŽÊ+ÎR{¾:àôMAPn´ÇNv§`6Êk;õE*ЦCu=2ÙßÒ?‚ Ü M[ ²§Ÿ9"=yý÷UUBaˆÔ¾ë¡g^Y-=atÑD”›¡iKQJiRîÌ{óµæ‹3F—^ºô7\µdìøsËÉ)&•gYü©åfh¡À-þÅŠm›ÿya±yÛ¯¾ùÙ/õ_,³ÅÄl·M¯!rÚ — ¡(a½¥‹þ¾~Q|ñW¯<Ø"Ú®ÈIÓUipp6?œÍù¾×n´ÓWìª\ùÐïŸzkBT•ªäÐ×Û>ñ;Ò&yV¹Ñì•Œ&PÝËA_ UýJ#Z›ŽS|}•ÒÞ‹¸w}#‚ªŸ!~)ž¢ŒñO¿7Þ1ãÃ1â÷ÛBUUÚ/#j 20Ø?üáà)²î² IDAT”Eìøó-ׯþ¨|áEd»­„ê¯Þºû¾gܳo¼kéB+¸¥B(vßÎÍ[÷Šœ=Õí`!±Æ7l­kñ§åe™! •íܺ§ü“œá¶š!bWÍ[¾nl³rÒYB„voß²ë?ù#!„¶×—mÚ²;À92ÝBˆíÙ¶ysU]«'3Ó± ýàŽ/¶î‹˜©Iv†mظa[}k0Ý›©eÜóÕ—{*jÙ”t·ÅD;|±egc[iDª«à¼O†(Uãm´ñÉ8,î{K÷™j^í1»FNúqµnêÔúóE“Ó2 Vl¯Ñ]™6?<"'uÒÙ7tê>Så—Ÿ]hì7ÛtŸ© Ï.µqÎËW¼«•Ã-;gŽÎòŽ>û›Ö ¶äÿ.¶›’o^õ¾ž±áÙdÞ9úŒËôrËÕó'¦eŽ\µ£V[pàóåùY©Sæ/ëÒWØsñ¬Vâ}§S÷™Z÷äÏ>骧?Òʯ.Ÿgc’ïúÇfÝgªj¥ƒqLX°¬IßÀC?9s\Föè5{t«Êõ¿ÍÍHýƒÛu«ØÖóJsí|áGa}Ö>ð‡9ù†µ›µrwÝ'S 3 Æ-ªê‰j®vkï=ËJ’ï}c‡‚nIÈéí3¥õ¨ÌÔ«ûÀ’±|ÕŸ~ø>cqŽš{åß–ÿqJ®M¥”!„tCRÖØ™³”‘Ù)ú·Mé3fÏ´ç±èU ~Tñ¤3L,»¾ÀâÌ6m†[hëè’©³ÔXŠ^&I…³æÌ,ÊNÑ[¤œ}´éYkçõÆiRöø™³ad¦[ÏhNŸ1{fRÑh=˜ŠJ&u áÌxFWî´3Îpå‰mÌ„iœœl”ÝYE3çÌ(ÊLÒÊ©ÞâYs-ù©N=¾5k朙YÅ#Múê¦1¥“ÅTšn3럻ó§M?#}lþ„8Š'OƒdÞ­—™Ts…iN½KÏœ4iê=–B+«·¢RóJfÍòR¼C#oÇ —1SFÇ©æ+Fb„å­6+CôM$›>ýšZ‡4»•Bÿ2@ŸïS­‰Ö'x¯RÝo8¾¥”$F8‘Œ‰]¼G ðm[HM!‰½Çô¸ñ¡ßõ=|}P»†œÞrÓ÷\ï{BS½€ (7‚ 'ÎUŒ Ê ‚ (7‚ (7‚ Ü ‚r37J{Xf 2žõþÅŸ APn†Flôùo¨¢¨jâèjýBb‘HL† BBÓ€a÷Þ ¥Úè±—Wݨſ¹z¯½× „DÛö¬zò¥²šCDH)±ø—לÏiï|A°vs (mæ J{ÙŸV¿°cW• i !Ä_öúyÓç-抺†ò­ë~Óç-{2ÀCA¹9j¡ú¼1Ê® Ï_´ðªÖoâX}üˆ¾aÙݤðÅõŸoùü³Í_W¬¹}ʞ׸ëÑ-„è€ (7'Q»! Óüö_²9næ’Û¶6vÓgÔ`Kõ¶•íÓ]²xr>Ë0Ö ë7‚rsBµ i nüªÖWµ¿ü³×V8!ÿˆ4ïyµS±Ž›u©ô!Ù|jÖ”ŒŒ–ƒ -~Š½7‚rs‚µB²VG¶7ÏëÍÉÎJgÀ˜@4~½‡òlÁô,­¾„Øgា:1d´¸A¹9~í†BzgUQûkGW}ÃX=Ð&_¡Xo2')ÑÃA9®J‚ ÜœHkêÛP$˱@¨1Ë•ª²‚õA¹:¬n¥¢_ý±7ÚR8†wXÐôAPn† 9¼ª,Ò^Ä @bûšc‹£Ànzü®›#Þg¤}?KxáQó‹¡G]51M\¿ÿŸS™‘/>`ücíJŸŒ8%ò•íÔΘzUŠüâsí¤§ißt¨Ó•éͱ'éuž£HLï…qÊ|¦è©ó™¢Çñ™¢õ™¢'î3EûøLQô™B¾ËrC€P ¹E óSè¶Í¯ø‚@B|ßl¬¨o;ùÌtG £ÝqµNå@‡oïÞ}m~ !„È]û÷®‹†€Òä«./¯hKZwµj«Ø_^]Û¤‚¶B´¡¶¢¬lB! @gãÞ²½õí~ a•ÄšÊòýUµ¢Dµwm¾½eûšÚzF©³¼l_eMC^uA’Íó‹¿þËð™z>Ýš\4õbÃgªíºó§ef\iøLÕnþS¡7}ʹ7ê.OJù•óŠ&÷-Ãgjãß®·›ÜW<±Îð™úzθœü±óvÅ}¦Vü—Ëâ¹å©÷%­ÜøœÇì;óŠZÃÙêšS2sF=µ3î3õÀÈÜôéçݤûL){.9³ÐÎåÇ}¦ÞêZ§%ùgϬ×ʯ=8ßÎ{î~e‹î3UýDŸ4iÑMqŸ©ŸžU’åûBÜgjÃyYég^t‡á3µmáÄ|§eÔzÃgêå‡.uÙ<Ë^ÞbøL}:­({DÉùպϔºöþsìœçþ7Ñg 9Ý}¦úé! oÍËÏOOvöÚVSrΫ_!ž?<»fé;O« _P¼øµ•«æz(¥ðíc4-®ô¼|o²Ó¦—YGn¾×™™ÆëU Æ“‘•›ksšõ£ÁY\¹9^G†‡ÕGÞ“‘“72j3ê‚{JþošËj0exs Í0³úVWº·À›Ò›Ñž—ïugyŒÃÍx22½~§Ó¤/à­I99^wFŠ‘OËÈÍ+l†/”Õáñæ{=FF!)#„×-˜ÕyÞ¬ôdcu65#+WVí|<~rn®735ÙˆoÎÈÊÉy«^&‚+-¯À›b×2¬%+7W°¦óF»Éž”‘7²'Éf@pd -•áX1¦T¥T–$²,Ë2„^ß„%ØÕÞÒÑCLŽŒÌTÏR½½uLµ¡T‘$Ye8Žc  Fc2! Çs€Ê²¬ªÀñ£Ov¡È’‰+H²J)g2i—'UeIV–ãt}¡’$Žç´á¤ZF–ãXF[A .£ªÊ²¬2Ï1TE’Êr<« õ JLRÃðœ¦/Ú×ûÄ—$…0,§ C*K’J g21@¨ª(²¢2ϳ„R @eI`xC°3¢Ö ß¹1œââöo ÷R͵­ŸÛ‰Þk°cK×ÙÏìíHó¹~ï鱌Å}·$qŽžS”Qûó-ñõx'ÿX»Ò'#ÖnïPíæÛtÏuA¹AùVpjtAPnA¹AA¹AåA”<‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ Ê ‚ Ê ‚ (7‚ Ü ‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ Ê ‚ Ê ‚ (7‚ (7‚ Ü ‚rƒ ‚rƒ Ê ‚ Ê ‚ (7‚ Ü ‚ Ü ‚rƒ ‚rƒ Ê ‚ (7‚ (7‚ Ü ‚ Ü ‚rƒ È÷”ÿ`ŠÿÖ»1 @IEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/grouping_tree_detail.png0000644000000000000000000017221413051004444025305 00000000000000‰PNG  IHDR éí€sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÚ &Žç\º IDATxÚì]wXW÷>wfv¶³°K/JQ ‚½5ö^¢Æ¨éñ‹‰1åKO¾ôž/Ƙ˜öK3šøEcï¨Ø° ,‚Šô¾Àö)÷÷Ç…qE4DÅ Îû<ú,³³wî {^ÞsÏ¹ç Œ1È!CÆíJ~2dÈ N† 2d‚“!C† ™àdÈ!C&82dÈ N† 2d‚“!C†Lp2dÈ!œ 2dÈ'C† 2ÁÉ!C†Lp2dÈ!œ 2d‚“!C† ™àdÈ!C&82dÈ N†ŒÛ¤Ä¬Thöz*ÎÊÕjÿH~F2dÜ^C¹ÿßè€1/¢Xo’ˆB4B C+®@m—"C&82n¹¿ ¯1ÆN§ËårÖÔÔ9räèÔ¬Ü\G]­gÓØk´–*¥ËN ‹@À˜£žVØÕV­—E©¯eT¡â:%öêES”R¥b ™õd‚“!ãã88šsáB¾pö¤³0¯øØÁ’C{hNŒ7@ŠÐ±À @BИž0` “Õv!ËÂ¥ÛàTøµ ì™dl×…´Ó´i×5:Â×ËÓæšÔ‰2ÁÉ!ãÆÀÎ /<ÿü¶^ô²&© §My5C«i \Tv.2Ñ¥?ƒ»:ÃÀ‹Ø΋ ¬ªŠR~Y«Ý¼?üàýგ.gX™àdÈqôš‹ãÏ?wêà¾ôUËJ×lx<u ÖXÀnô„ê¥ ‡(Úyц±KÄœ€1 " # M!* ©)¤¡)š"ƒ †q.Í`p ‹ÎØÒh®<‘0hH»Žq¾&ã•D¥Lp2dÈh® '·fÕÊë—¦oì§tÄhiF¥ XÄQ'TZEVá4(ϳž• Ðxû)ƒÛ±Aa O`uCa­Zåtq.NÄ€(̉¶:®²Ôy!Ç^”‡mµ!ØÖÎUÓ–?-«Öªˆ “A¢h¶Ú÷»Øƒº01ñî1Ήo—F9d‚“!CF³8ŽxŽÿûEWÊÊ'QA”©UïJ„Âà´Rû ¼Ù˯ϴâzõ ñ Ôëu!š¦iŠBu9ñX­VAN'ˆ¢¨dYÇÙív‹¹:ûôé´5^ýçHÌÐM1 „0±kÀì·ØØoõ±ó¿üªsl¬¬àdÈÑ,ÕF^œ+(Ê?zðÇçÎ¥ ºúkA Œ($òBV­Ã¦÷ÎÕúýδéгï³ 0zºÆó¼Õju¹\V«Õn·›Í梢¢¢¢¢²²2«ÕÊ0 Ã0„@EQ¤(JE !Qy÷ð0„„†‡†íKKûî§%CÔöI¬ÙÏUÓ†“šŒ0D¢À?vÀ:yÊÀ=×¥s'Ë6ä• N† ™Ý.zy/\D/ÿ⮚œ8…‚a0Æh÷S¾}8jÞ‹¡ ½M!a¾†ÊÌÌ$ß>¢—Ir¯ŽãÇ–ü¼=%$8ø¶Ì#‘ N†Œ¿rK+«?xîɤÝKF‡ê‰¹ eWÛ¾WD&¾øáä±£‰#º)######++‹()ɵÄ ‚€1öññ‰ŽŽnÓ¦Mpp°^¯—ÔÖõ0‹ûgEQ´X,EEEçÏŸÏÎÎ.--%3Q*•yÕ‡ö *=2'˜D‰SY]®Oj=ýæ½?ûûc¸½8N&82®Æ6‡ë™!=_²BU ˆS|q¦®rò¼çÞù@§Rò¢(ª²²rÍš5.\ wÆá8N­V÷éÓ'**Êd2©Õê«ðéõpq£·ìv{mmmffæž={¬V«R©„òóó+7þþUT3€0¬.ŽÞóʯ¾ŒE‘¢¨Û†ãd‚“!㊬QTZúH׶ËÛa5«À#f§°°NñÖwSÇŽ–Öæ].×Þ½{7mÚ¤R©µIÞ(ñCz÷îÝHmÝq¿ÄáÇSSS‰÷ʨT«¾ÿúsCyo…P=í(³˜úÚì^&)/p[„d‚“!£i^Øu mûcc_1Ô(š$Íî8_—Öwâ çßîÓA¢€ŒŒŒ½{÷JI¹$àp8zôè¦T*ÿ²\‹zÙõ+‰wþüù“'O¦¥¥Q 67ãHÛ´µïtÐažÜ ì*µþÑsæ>™ïíi€Û"æ œ MðÂù ïõ‹þº-%ùkg¬üñ÷¾þÙB%ËJmýúõ a÷å6“Étß}÷yzzJ‚î\¿oÄtPSS³xñ⪪ª¢¢bóº_~¦1F!À¸DÀ cï}ë‹EA3óe‚“!ãÖà5òFÖ™vZEcD¢⦠~CïY }- 7²â–››Ë0Œ{’š——×€âãã¡õíoo4Ÿ'N¤¤¤?­Ü¶ìC?«š¦Èû› ëRÏ~á¢Û@ÄÉ'CÆEûÇWT›Žèþ†¶”„!:lOþ÷±'ž$™¡ÌÌÌõë×›Íf…B ù¢(&%%uïÞ]«Õ¶Zjh´hµZ;öòå¶-ÿ[èUaT±¢ñÎÛÊÁsçö_YÁÉq;P›äcNèñ¥®È_ÅvÊq ?'¾ñü3OKçœ8qâ÷ß'ÂM2„Ðã?îããs«d“¹Ï°ªªê³ùó³–~ýK°]E×»äÛ+]»§¾ùÚóÏIOæV”r2ÁÉh)èVœü³î{(ã·®&-©«»æ|í®{^ùä½wÈ»¢(îÝ»wóæÍîn)Çq‰‰‰£G¦iú–»wwf_ôó¯ÇÞyêëP‹„²ñ›ç¸¶o~;cÆÌË9Q&8wµµœ 4ÿÆ^Eí½?¸ìžFά¶nñì³ï~$eºmÞ¼955UŠÜ݉'véÒ¥9‘„V[¤HšÏúÍ[M²®·ˆ‹€“Ž Ó>þú±Y3àÖìó Üè…µÐø§OŸ #¹`-4ɼáƒgåä$Oíÿ„ÁJ¶*¸?J'|¹f½F©$ÁÄmÛ¶íرƒä‚(•Ê™3g5ßì™[+¤¹c‡oÝíéh]CÉN\ôÄÛŽ3ºÎù/!7~¾S““ãr¹ZðO%Beeeǵœ‚C={–lxºáƒÏŸûÈt¦××/ç*_ùþ'ZMn'%%eûöíÄ3%™½F£ñþûï—Ø­9S’x0==½a«¾÷ýb!Œq\×xfÎ[iu"¢HµLôÊûõÇÿÛ²e ¸¥ÂÈ'£u!//㸖ûj'®EmòóóA¸áþé„YÎ-KõÒiB€ðci–ÇÿL‰ mC.zðàÁ””R¨Að÷÷ôÑGþ–ã&-ÕŸ8q¢&ê]Ý+а!¨°™…ÌB0÷å×^¶ðœ€`€Ñ&Z•±{מ=Û¶ms_% NFë[’¸Yþ…›Ü[h4ó&mà+]­I†@9uzTÖæŽ&5!š3u|Ÿÿ|ƒE!TRR¼aÃé|’é6sæL¥RÙLÇÿâT/óO1Æ5U¼p ei4œXêˆ/¶Ñ’Ãøb‘éþ®í»«³ßSÌ-T0õ‰e×ÆuÓåääÜZ+q2Á݉¸hK—Ã×FH—ŸO’ÅêjkÌ5u ïþ—Wq§H÷Éâ+-Òד¾’å]l´w)6}ùñ(ºx@ˆA_Šýï½cŒ(ª¦Æ¼è«/Ý R²,+mQh挋;.;!têØA«ƒwªQ_„ˆÑŽ5ëëǹ¨AĤU´;ã××þ'…ŒæmÐ÷}}þª"Æ€û{¨§˜O¤fœ\ºt))OâÎÂ2ÁÉh]ÔvÑ–.ùb£«øJÍñ%ÅA8~`ïŽÔ <€>?«Ò‰P=•þ¥êq;Õ7Gn°`صjq‡¨ˆ·¾^›±qñc÷OèÒwHf^Y¨+<¶µk‡¶÷ÎœsøDöÏ‹^1ûûóÙ'tkÿà« …Š¬Ÿ]"rÖç^ùÏ©Ôu³F÷‹ë9˜Ù±ÜWÅ`Àˆ†…gjý¦Î ðCíÛ¹õ“ÞGãîz?ùä“>>>ðôî=ú…w—¥¬xwøãßœÏ+9²WÒ¤Çjm¶u¿|Xc>ùäƒÜC;ž›92".qV…;iÑZõÃÃÚE¿reY¾‹ãÿûÎ = {åã%‡ïßõÏE$8v®pÿá~¼µôäÆ_æ¾ýaö–^xYóþøÇ™-o´ïû…Äé£{÷™8!ôå»/††µ;UX:Í\£Š1ž8íÞ¼nà  xv¨:ôì!›Ó¹xñâ›ì \Ùæï0‚3Òöí™ëå×æžþK¶eÏœ2jź-ÝÔu[³‹íê?||ϸˆŽC‹ÇÓöìH=\Q\Ô!¡Ç?þŸ¥Î–Ø-qwÊ1*1zx„àdÚ®­{*ÕJÿèó¹cõ¬+çlŽxÇ~ íÿÜ°íɦü¶r§‡ç¡ÃJrÄØÉqÁîFxô|Ñ×_{þlö‰Y¦ÿçãöŠ6orÆ„FûÓ/{džýùã—ÌgþñÔçîŸþÛ×µñÄÉ•_)ª°ÔÔÆEE%Ù9s>_µâÕûç]p¨àZ»ëxÜЙ½z¢ÈÙj6ý±˜ò¢°@.*ð\`‡ÞY»{ïéŠ3ûBÇ>ÿZõȇ{+µ9ã 8¸øùþÏ,îNß´'Ua©DT^VVx.¯Ó¸g?YÔñ¥O¾êôÚëjªžx6ëy‹fóºåY§NšÍæÒ¢“”Òoÿºï{xeD×1ëé±Ùûç~½ê .É\žºïµI£ü_?5cÏ…¶ž|^…D®¼º¶þ䣷V}ûf×±Ïõ>»öÑ/·õôô\ñó×k÷î8©×õ/w"„” …ß}O­aÛX_€Æ0ÈYRSSÇ0«W¯3fÌ-‘ö(+¸;iûv–ÛQb|LUqžUôn¤zÿ¬Ê=!ThåŒSç¶ Ê>‰Zö¿ †‘\¶šêªÕ«×Æ'ôömãçÚ)Ü0á®!ñ½Bkì]­ufÞŽŸ{}Î̉C|ýßzïýäÅç>òÐÉìó÷ îýáû¯½<º ™æ«¾¸$ ¸¬_~õω´)¬­ÒìåÕÝ|úÙgß\â æv—“cÎÎñe™Ç–®\}®¬bë¦ôÜÓ©5áo?}^yo)Ž·ÕXêl£¦>ðð«_±àü`Á ß}ÌÆaÁ×®•ãÈ‹Õ›·¾Ñ†}¯ƒòÒ(’ŠóNŸÉ  úþûï_yå•ÖÏqr¢ï‚äääž={j4ê5¿/.¶áêâsñ=ºsTðÐ^í¾úr‘V°¡íÃ3'RXܳiùé œ{hK×~wÕ9MM¶ø«Õ ª5[ž~jÆ_̧ Á6j¨GùOÁFM§~ãGî1Þ³gO—.]´ZmêæåÏ”WÏLìÝ'õhNÇÈÖ§#äîÒt<¶oŒñÊ_¬Ufzr@§qA&å=cýüí"—BSmv=pß„wß|¿m‡ð쪶lÙŸÙÖ‹é3ù‰¡Ý£ %%¥g¯^¬‚¥TU›F¯Mÿ7ß0`r¬¿A¯ÓaŒ±Àm߶¡ÐñÌ3CÆMŠn@Öå–Z¤Ò²4- œÍ)赪>yS¹ä³é&ŒE@v:•êÏ7Æu옒’Â0Ìž={ˆlEÛkÃF>8%>L«×“‡Y˜}|Ïù2uYÎ9eÔS““È%x—Ý…R!ŠPg³tš›WRþmÛ†„™Œ††€Ÿ~þùþY³JË+ü|¼Àn­^»j§§Wú…ê—þ5Ë}‰²²ªÚä©«³ *aJÉRNǨXºþïP‚ÓêB*5K œ`¶ZMž†È8d¨o_yfBÊ"“R‰½ªÚš<Åa·ÇÇÇ?Z÷.YÁÝY@=úž{«ªÍ*­A£dD+ÌãO=YSkõ4Æ#ïüãÇÿcüÚÝ›8<:À@MŸ=§ª²Z«÷T«ØGžzÝb³{šŒ{¼ÔÜ´!ñ½< îñX„ ×‰«•jF¥<¤ÎæL&#爱»QÑn^¼l­§Æ㉗úõèûx¤Ê\«÷4ªXú£OÞ©³ó&£çÏ‹>3|è!ƒ<õ:Lv‡a „ŒF/Àbâð‰Œ—^Í¿ ÑŠ®]º•–ŠŒ ò“Ü5•Îƒ˜"Í(ôŒ0öÑ{IJ,² øuXÖ­›Ën¯««+--•T EQ=úöï­Õ³Rd×74"Î…„  Aí0`„fX5SŸˆ : nŸÐ)µ:m½îl¸2'?o’Ó¡Pê{Ô9¸Ý5ô¢NŘŒ^ ×*ê?…”*Eý+„L+µjr_ ÆÔð‹â<7!†í]óÕXÀ€E´œ-3×µšœœœòòroooYÁÉh- N«Õ6r+°¤lb›$n0õ #òÁQ\ší±gÏžÎ;{xxÔÛ¸{K34°ˆ…Ü®P r­úÿ° R4Õ0¥úüˆ”””^½z±,K¶H“­/ctY"Hý—Z<™ó§S†=V´K¯d‚åçkÏÎ[ôüœÙv»ý»ï¾+//'[²DQÔjµsæÌÑjµM?"B5Òì/»r“sû駟î¿ÿ~h‚Š0ÆF6–TOo*å¥~Ýÿú]T÷í÷ÒȤÏÅäÈYÿ°¾ï]}û¸\®^½z1ZqDU2Üa îÒÊ®îì&ýé—ÞªO,Åõp½Ù!„!)ÅôòÞìõ$…rÏÜÙ êùëRr$³j0` € œ…KSÃê•\}, 7ÁÌý2vCçmÜ¢W±€1âÂ*õósf€Ýn/--%z1Ƈcøðá»Ii4XʲEH jšW¥¹5½0ÖèS€á6t¥_Ÿ{¬åJKg7x›‡†eC‡Ž/¶¹È‘V}Áéâ†9xð Ùl–£¨2ZÇ52䦠D‚õE¬ ÃrëÄN j\Nmîvè¦à»Ë Eé¤!$µ#1{ •ìçÒI]¼"jêNá…W^ýw4Mè6³ÜòÔ§Ÿ“㇒®(B\\\\\œÛôÐ%c^>ƒK×èÿvB!ÜHzºQ_>yÊŸ54P!¤F8ž¯t:!AöíÛ­xwªLp2šD£ýÕ÷]ûU.5•âßBŽ³òØÁ6FQd¹´¶cBOàyþàÁƒLCð”¦é=zÜZ[/[BC~UG‚È@T _-Zj€a˜;vÜØÝÁ2ÁÉq]È**½×‘˜&Žy1ÄÓ?<Èqœ¤RýýýCCCo¿fï×à¨À„{ïÛVd'{a#Ô¨øl)×®ÑhÖ¯_/»¨2d´Ù—¯C bŒ±ã’°xƒ‡Þétfee¹‹Ç¸¸8–eá¶hzý˜;gΟêB`|؉={À(Š"j…çùÊΩ¤àÈ Ú'Ð`À" P?›GQ4Ð4½wï^h•[d‚“qg¡´¬,ÀR&‰“JVoÒiDQÌÌÌ”Òßôz}`` ìœ6q‚_'«"€€P°Btq<PUVVVSSÓ ÃÍ2Áɸ³ Õîpj°³ÞE·€ýû÷“˜ ñO{õê%?«F"!$è¼8JQ¿ã C°8yžœ P(ÒÒÒZáÌe‚“qgª£ÆìÉPõéx¼ „v€3gÎH-†ñóó»FoK*Ž1ÆXlèãÖTá†N«)åIö7Œ"''ý•””´B§^&8wœµU:$ ú}f"ÖÀn·K'¨T*R‘üZ¼-·M¡»ÖW˜]pq³í­Íq^|ž†Íi~” 4ÜMÓÅÅÅ­ðåj"2î,¸ª+õ `„Å…uzžãjkk%é¡P(T*Õ5¯—cHí\ŸzºÌ ¶<ñ{tbÛ̬âûî¤fnè>ø›Op^žy²êPñÀ±)«öíÚ¸,åTm˜²ô+65¹«öÒžX­*¥ª–VBCç2µ’%Õœ$ñZPPÐÚæ,œŒ; ´((¾õ6^ôòÐUWWó ‹åDÁ‘–€Í!5éj¨jªËHˆï9þîpç&=02iäøêÊóÐÔ:Ü Ù vsøQɲÃJeí4¬BÙ™!(**’]T2þIp|ýÂ? pb$ˆBMM ÏóRë,Ò¾¾9CIëtRŽ«  Ãøù…}ôÎBKÁ‰—æ¶÷U½øàӽÙàÞÓá þ)B¨¨¨èرc×ÀS¢(FDD´oßþ&<:`Ü´° ê Õ¥ÅÒ㪨¨ N†ŒÔga±¾20x1`±9\.—(ŠE7S£Ñü¥¤’JŒääääææîß¿ëÖ­IIIï¼óø·mÿáK³Ÿ)Ù²û÷W§Žžüú¿•ùyýûu¾rûzl0:uêtmÚM§ÓÝœGçâ9 ðÐPwOÄ80 (ÿLöM’2ÁÉqeU¡äjpzДÕéä9N⊢Èûæh7„ÐÉ“'I_‚I“&½ýöÛ’‘GÆGÆÀ¬g_ Ô‡^4µZ­V«½õ&äg8]œNp6T¼Â O//ò‡¡^sœ $_Z&82þ‰o¼ÁËÚPüÈ"r IDATkØÈ¢êÚ:›Íæ~ÂÕ· ºµ¸Fãššš=zÔÔÔ|ýõ×üVrr\÷¾õ5…ÿº¾Þu87%û¬ÆlD. #²‹8ÔÛä®Ú‡Lp2dü“Py-ˆX  !K-Ç —H¼¦ìÓòÈ‹ãÇ:ôî»ï>~ü¸Éd’ š7œ‰¥:ê¨%5ÖMkÀ\]SJ R ¤’RiÕ*÷rÇlj¢(»¨2dücP{šÌ|CÓ*Š¦ŠÏ:¹¾éë¹Ç0Æ+V¬ˆŽŽ0`‰·’«—µ¤¹zÑâ‹zð:é馕ä4[¬QJ‹õÄ]ªÐiÕj÷ŠÇBÃÎ ™àdÈø€1Ð …S¤ê逦QNP´;Y\Ö@»wê)((8xð`Ïž=ƒƒƒ%ÉæN`îtsuÞq8$£˜„_].×5Ú0ð,Û¢Gh‹²Õ*±€(ÒWC¼`ѪTî•"Ñ2ÁÉñ!ðõ6Sª‰Eª«K¸K[ ‚ÐHÍ‘‹åÔ©Syyy“'O†Ë’à®$÷šœ!‚Oç/œyß´à ¨¨¨ÈÌ̼ùƒ1 ˆˆhQ‡1¦*Š”œX€áuuuîgz{{C+ëÌ œŒ;KÁ‰ ;fÈà÷R·¹ì‡É®¬ÎÈ–Z]…¼Œc\[[[^^>|øpNwõ`è•ŒYZ–êÝ3±wÏÄË?õóÏ?Íš5ýÐì'îëà ‡¾¶ÍöQQQ111-J+eæÚ„ª,ª ‹Œzú÷ k+‚û&„PPP¬àdȸ‰¤æÎP’·n\Û1>qÑÊÔ§"YÀÐÞƒÍݹ9<¶³Íj¡(Š¦éÐÐP²3ôêÔÖ腛ܹÈ>@vk"t±Ú%ùÄ‚O?Ôjµäã¾¾¾III×hà ÓB´"‘æÖ)ÿÒÛ@T¡Ì;Lçéi·ÛËÊÊ$ý(Šb```kûÈ'ãvf7Éìm6MÓJ–Õû…¿óö›vÞØö?¯¥hŠeéDgùñ율6A¢(rçr¹þ’/È ›7oV«Õ ¤’mƒ;[ÿîîä?£ãGø™Ô5Ôùv–°!–e›³Éÿf;õ ä•úÃÓ<”#\Å㢎}=t:su5 Èv3 ͬ£'œ 7F¸•——¯^½zïÞ½žžž}ôyW¡T+ThÀÃO–,}#H§ÞÑEíÞ9ý^Œ±Óéܹs§§§gsìÿå—_ÎÊÊŠŠŠêÓ§ORRÒ„ 0„àtÚö?wgFÑù«6Å$¤g|¸¾L „1Vuî]¾Ò3cÔ4¥»+«¼ ‚ °,Ûµk׿\£(Êh4 ‚PRR’““óôÓO‰VpöôËv̽7é¹×¾3pûKï‰3Ôýº!}æÈ„+)ÁëLiÑøiVÊæžJÆ @"Þ¯ }$!Š‹‹EQ$!fQƒƒƒ¡õõ~– NÆíÉÀâââÂÂÂòóóW®\Ò(‹­W÷îÕÿð-`Œ{©\ks2{R•‘‘Aª¼ý%}ôÑçž{.>>žìC …‘*KÎMš8.:¾ÛÃc¶ÿ±¢âág‰´|óÛz€„Ë›ÎÜ´Z ׌œŸ>¿ßHB€ð¶bkï×þCŽïÚµ‹°¸\®ÄÄÄV8y™àd܆ž©ËåÚ²eKHHȪU«ÒÓÓ{õêÕˆG0ÆõÝO<¿éƒ‡µñÀÂU”ÇñÝ\|"CQN§3+++::úê×ÂOœ8ñb7†znÅ^Þ¿,Þ¤Á5K×çªÅâEKãÙ|Oï®ÐTÉòÕ“á†ó#óɧžž!¥į\~+¦N€¼¼<«ÕªR©B‚ „……IKŠ2ÁÉÑRÔ&B~~þÎ;‡ Fú7GFFŠ¢ØˆGÈ‹G|àþùoÊÑày?þɽ»û º[„ÔÔÔèèè«X¬{NœÛicsÿغy•|½pÑ¿Nì­.3:¸ÉÑÈÁsçÎ¥¦¦^[šHLLL·nÝn8µ!„Žg±­ú®{=v^Wh›÷ÕJrΖ-[¤¨ˆ ½{÷nRT&8·<µIëPV«u÷îÝžžž3fÌ’3®´PEÞÿî¿Ï35L1Š0°³÷]èäã]XXh³ÙšÙå³Á°IÃ)Œ€‰Kè—ߧ_¿Änþä‚pÅJs¡¡¡d ëpà x)a„6~÷Å·í(ìªïÑSݽwBƸ®®®¦¦†¢ê«Nét:__ßFë­rÛ@·¼j#T•““³dÉ’ž={öèÑýQ€{EÆËÍøîAƒEô¬ãD„ôi´rÛê•œ ò<¿gÏž¿E ˆ4ÔC í1Æ÷Ìžç‡/Îå*$¥¸VíŸ7ö©À™Ó™ª Qƒš+vâÝF›¼¼BgÎœ±Z­’³ïééi4›|È2ÁÉq]BÌfóŽ;JJJyä’Þá¾­êJqFrŽF£îÿì›Ç Æ€Çÿ 0Ÿ;“EÊ­HÍ·[DþC m»(Êm+ +“ãõ>Šû§!ôö¬É‡¨(ŠŒAà¦W|þÆ+cžç9Br˜Iü4,,L­V·Bù&œŒ[X»†JOO?tèPDDDß¾}o&) 2ä]/"„¡Nj¬Ø»În·×ÔÔ¬Y³æriówX‘¼2£[åÁBþëñ×ù,‚!$ñþy碵ëÉmäææž;wNzz¢(6¬ÕÞ‘Lp2nUí†Z»v- 8d€ÛÚÿßRk¶¥ Üm„1Æ4Mÿ ¿.^LQTEEŲeË®m휜îö!Ôš©ûÓûòÿ~‘ús”—¢xØì‚éÿnIÎÙ½{7MÓäip7dÈÖéœÊ'ãƉ'’““Û·oß­[7©Ùµ™ùÔÖ¯_SâDäGŒvUîMÞ\RV¦R©ÒÒÒDQlµ6|cýý’²2óÿ½?Æ›Æ"Æ#-×u¸Þs$}èС3gΰ†(ŠjµºK—.­Ó9• NF«PÿoÎ÷•¢œNçŸþÉq\ÿþý###¥Î/×–  }6iÈÐ ñ“,YZ‚v:öÁš#9ÙÙYYY,Ë®\¹²>¶x;ÒÜÅüA ã;?CPB”½t¢®ïkÿ ðñF™Íæ]»v©T*É9íÝ»·^¯oÍE&8ÿ­nÈþǃ›\É`ŠŠŠ6mÚÔ§OŸøøx…BqÍ>©»r!ÿÓõÉ7ÿ7ÛìƒFÐ&4uEî¹óeee]»v]²dÉõèÄÖÏqÀƒûímkQ+ a¼$»6ü­ïG J"·œ‘‘a6›IvÆØ`0ü»f–É“ NÆÒ ™Ø†¹² egZ}5!–Ú§ˆ¯pÔjµ#FŒ ¼WášFÇÿ’’È :µê‘ïÿ˜wVtð<Æ"|£×­ûî—¥K,Û¿ÿ½{÷6Ì[…×$ üúÃ3^¨M£) #„œ±pçG?úè#‘wóóó·oßNœSŒ±ËåêÖ­›Á`håŒ/œŒˆãtœ½®xÇŽƒ b mûce…š^óÒëõõ{æ¯ê“Jî¤{ëÒ«Ø¡¤AztŽõzð¥MmýÈþ0RmÚúëüÏ„„„´k×î?þp/r«³¹MŠ¢Æ<íØŠNzcŒ0Æ"~ÒüÒ‚oȺ\®åË—“e8òA“É”””ô—AÿqÈ;dü€¡ì´íß-[g·Ö|b.øoiyyxûg÷ï8çðäØ¡4à¿ô+¯®Èìv»´¡>³¤žX/eFRá ÀwO趗ù7ZúúX?cDž­~ì×O_7ÞzíÕÄÄÄÕ«W6ŒeÙÖlØÍþE€Ýéz~Æ=/—ïŠõVcÂÕ6×ó®ßž žÛÚµk«««IeMh~øá‡á&v,”œŒVmNî ´ÛºäÝ=ýò¼Ç;9!•¿_`tǨŽî6”¾‚Þ¢iº9U‰"[¼xñ¼yó6oÞ\SSÓPÔ7aÆЧ&Šâ;/=_4ûãÏÕIUx¿‰ÑùþúÞ;ï¿›’’rKÇ$b*­®yqâ𧠒{˜ÔXÀDñ¶ãkkwyª•äœýû÷;vŒÔ}à ‚УGÖ/ßd'ã晓Ä;çÏŸoÓ¦ BÈ›æ«Êjpa± A§¤áñÁê÷?ýÊWå¡P lÂrrss/\¸Ðœâ· ÃlܸqõêÕ_|ñ…J¥zûí·çÍ›GQ”(¸–ÿôÝÁÌsÓ|¤ôxú©‚ó¬ÖïÑg² F2UQg?þÄwë¾zv”¿ŠT²}"˜ùå§×ï;qâ×%KX–]·nݨQ£.D·„v«Ï‘>zì?‡® ±0j0 „€†ÄtjÙ‘Õ!þäœ .¬_¿žaÉ9 :thë¯ò$œŒ›jTf³955uþüù/¼ðBXXuſt_}+¨<“:wÈÚ¿q{Ai×^ƒ„â-ÿ[ßöž‘LS.ª¿¿lllsŽ¦éC‡;w®G3f̈ŒŒ$žÍ…gweä$õìvòÈñ-K~¼ç•O«o;šy®Gç¨F#<:çÉ×ÌV¼â½ázž¡iŒaf¸ÆïðÒ¦YûøËÄÄÄäääþýû7jçÞjmÞ}b"Æÿûí·Co>±®-Š8çE6ç[(r}Î_/Orraaá×_-9ã<Ï{xxL›6í–pNe‚“q“ ÂòåË.\xðàÁÁƒßu×]DЃ"^yóD34…°(89^¥Tb,&pÙ>~¹ù¨T*__ßf¶/xúé§çÍ›g2™¤ØÐùO›0æBÞY‹¹ÎàéÕ½O§2Ue±ÍÞ¤ê|û•w÷ëõúÌ!ïµ£#ìÂCõÝ.lùpxB··¾1xàŠ+ˆÁC£7­Ø-­±ÙîŸrÏëå»î @¤ÑPaåÞõíÿöË|Ø­ººúçŸ–Ø c¬V«§NêååÕüŠòœŒÛ_¾1 ~ìØ1…BñÒK/Ñ4 €ÐŒ‚¢ ª~q !Šh¢&í‡ô7iNÚÆØÛÛÛÇÇçb¸!„pmUÙ†Í[AtòöÚ:så7_|ûûâµa~>J}Hò¤_ÿqŸÿù`¶HòãƒI©ø8Ðf}nÜkO=Ñ©s—+VL˜0!77·5³›PÞ‘²ã©øèßkvtÑEÑdÊë ëþ4êË5[½^’Ü^°`é)#q÷€BBBn­¯Ÿ¬àd´¸i ‚àr¹~ùå—µk×vîÜ™nˆ„º‘×E»âhyyyJ¥²gÏžj%]΃—K*J0†Ï~äþ’JË1m‹sOÜ=j¸¯84<<.ͽs/f9mìHrEÿ¹Î×—ÅY0æࡶçŽÿöÕôí»°éà±cE-_¾¼Š8Im:v|Â÷U~û)F˜1¦(äpr?ÔªðãŸÿñÄ“Òäóòò~øáÔòìÓ§OŸ>}n‰À‚Lp2n†]‘ÿ)ŠÚºukÛ¶mûöí;dÈ•Ju=ëÓAAA ìZµjܸq¹àuÙ[õ?‡G‡…iÍ QÖÔDPCšêèaCƒÿXóêÜÇCŽïûº‹»0ˆî¡zW¨Î²V¾l¢W¬X±75µOïÞ­a1Îý #„ì.×ð‰÷Ì+ß?›®õñÀ"À…NVÛŸ·úÏ_»­]D„Ä\ééé7n”qHNï°aÃú÷ï˱›ì¢Êhq·hÓ¦M&“)22´Z-)DqÍÆOÓt×®]#""–/_Nj.J¹ÍÉØ@õÊcŒÑqÝ•X$«}èªëVã®;¿3¡uäC“NÓy\¥éX=³6^ûu´êݧ:°¿Ê\Óè)Üä¿(ñ‚p¡ ðçÏ?½ÇWµ­fË8ÝGÉ`#„,¼°ÞL=~ýé ‘‘‘äÞEQܱcÇŠ+xžwo4ѧOÂn·bÞŸ¬àd´ vKNNnÛ¶mTTT#ö¹Sá8.66Öh4&''ÇÆƶk×îïì·Gî×Ç#D¡«Š­K8®k×çæ>ñ«ŸïSScr÷¿Œ´J`„yüX;ËY‘üð€ éÁ“|èá“—›¿ ý¶TÿùKZêlÙ‘’üÓ·í2Sú¹Jf%hS¢€) ˆ;KêÖ÷ôÊk? *}Üf³­X±‚T ƒµÎ¡C‡ÏôV ›Ê'£eA,¢¨ 6„……E6Ô»QBÆ :tèÎ;ÀãþîPÍá[wŽëܹ³Á`XªÓ–uê:nÛÆ)¶3·Õb°€U 3Ê—Â.Yõæ’ß:Ûc¬:(âÓwßh ÖÉîûÏܽÑòjóGŸÁmX|·«ð5òÐQéÆ@1¨ÜÆ=žËþà‡7&ߣÓj¥Ÿ8qâÏ?ÿ$MNÝ—/'Ožwë²›Lp2Z„ÝAHNN êرcK¬I‘«(•ÊÁƒ''';Ž¨¨(R\¤…ìÐÝÂÃÂÂf̘ñçŸúMµöXÆÏû·/ °‡0‚QIƒˆÚ¨©ç´òþ\šê²èÝé/¿Ù}ॷ¿§ÁÃhð€†61×\ßÉ’Wa®±›«+Ïùá£w*Óö/Œ¦ À qÝ`^À¬®ýª€ÿ™âVí]ëþ먭­Ý³gÏž={H@h¨B®Óé&NœHþrܺì&œŒq—víÚÕ®];wí-³8MQÔ Aƒrss7mÚ4tèP)?®% Ò]Ú„„„Ìš5kÇŽ.—“éÒi~v6}ú°wƱ·:jX"Æbî Õß,žZüJþoС‘g4¾ûtaáíEÁõÕwª¨µ¬\½zË®=ÑŽŠDKž¾²PUQô±§ÒÐÓÀ"F…„Ý…Ö¥¼×ˆ?lß{ЪÑî.í¶mÛŽ;VYY)í~#œÚ·o?lØ0“ÉÔ¨-™Lp2ît°,»~ýú€€€·À\ Ñ(Ÿ¢¨èèh½^¿k×®=zú‹-gRXÃÓÓsüøñJ¥r̘1S¦L‰=¥¼bpçõkgqyS|ép- a#Duôöè€18ò:ógצŸ;Í­,†}øŠGP@xÿ!Áºùµ 7ôzNoPkTE«X–çy‹v‡ÓfµXj-Õ–º²ÒÒÒœ¬ó©;rh£ïñc~÷U"0€ôó…8AÜ^j[¢ë:ã¾ÿ~Vò=ÉÓËÍÍýý÷ß].éæ !„P÷îÝGÝÈù½u¿2Áɸaày~Ó¦M‘‘‘111-j!Úe‰¢¨T*×­[—””äïïߢÆé¾øµ|ùrA–.]j4G5cæ¬âZëì£éú ™÷(ªcÕB[« ¢‚ž<„kÙgôðL„¸ZÛÉ¥uG~±8qùU¢ŽRò- aŒDA‡yƒè2R| ]Xв´žU0=4€D±Ác¥_éä²xE:ãSÛàþ¿ýnÏÁf³åæ榤¤³,+56%ÂÍÏÏoìرîÝ-nií&œŒlöeee111111¢ îDÓr|g2™ÆŽ»ÿþÒÒÒÎ;·´ô@?~|åÊúNïUUUüñÇ3Ï<ã¥RôíÛ×îHÜXQ¹¹¢ˆ.ËWŸ>ËŠ³ÚhX5 "ƒ€@@´F­Ö¨Áp;c­¸ <¹`°{(@¬”€¢§æ×ý‘ú„Î&NðîÔ}dTûÈð0÷©¥§§çåå•””P律çy¥R9räȸ¸8)Kñ¶ùZÊ'ㆹAAA¡¡¡îÒˆãñ]½½6% I&ËÆ$[U©T Ø¿ÿ¦M›† ÖrÄJF[ºt©Ùl–¾úê«:t8yò$Çq,C‡úû¢?Šê††OÞ““óZò6ƒ³v®‰c¢4+V  E!Œ14Î5&ý*DD ‹"ELvRP"ÅdÙa©EµÖªš>ãÙן{ÖK¯wŸ¡(ŠÇ•••mØ°¡  €d ‡TòI† :uªÔiá6ƒLp2šµÚu%vhôÖå{HBN§3+++22Rj\¿Î--xKAëGCwýÎ}ûwŸ>}2226mÚ4`ÀrÅ–ouuuŸ}ö™tÄÏÏïå—_€ÄÄÄC‡;vŒçyš¦EQÄNGdxXì“s,VÛáŠÊæ:­Í¬­.±—ëUžœUã°h—KS Bj!—CEy€'DP©Y0úÑ¡”wíebýC˜°ö¾AÁ/F¶[@îÀqÜÙ³g+**Ο?_RRRZZªT*­Á ‚@ÓtLLLbbbxxø•~›2ÁɸýOÒ“.ñ‘.?!„¬Vkaaa#N!þÑÃ?l0†:bĈ¨¨()€*-ÌÜš’sßôÑäüšêj•§—ÿÍyJ& :u2›7oNLLLMM;v¬¤\né3FÚ‹«W¯&oƤ¤¤;v?~Üét2 ÃóRÖëõsçÎýå—_V®\9nܸë}:tè@ÞݳgOrròøñãG5räÈ7feeÙívA¤é "E·üÈê’“ $Wq5u (µFãáá¡R©$â]ÎÒÚšÚÚÚÚÚÚ’’’ÂÂÂÚÚZ ãSEâ!R€Wb|QišV©T¡¡¡ãÇ'ù4î•–o×/°Lp2®N{¶®]¼n÷à½ÔqÆÏ¿_ßwZYÎÁÀˆöfË¡éS§jXDúþ™L¦®]»Jm$TUUÍš5+((hàÀmÚ´aY–pÁÎu+Ò ì|ÙI‡ðÑ‚Q‘±™Ùç8ì6ÛuKNùùùG€Ù³g÷ìÙSŠ®^ÿàß|ót¢¨éÓ§{xx÷ðÀ¢(.[¶,88811q̘1.—+;;»°°0''çÂ… …S´óX©$úE…Œáœ] ÎÉÎË>Mˆ‰0£4sš¦©†4:©Ã9¥× 1Þ~í"Ú6´K½öTXŒqûöíwîܹiÓ¦ ¼øâ‹?ýôÓ y"GýñÇ¥u:Ý¿þõ/ò:--­®®ŽpPiiéùóçY–‰‰éرãÀÍfóöíÛ8¥¥0€ˆ1ué-b@¨ÐŠMžžV‹¥ùŽ¹»X#áÐh4!!!ƒ6™L-6ªUy{³›Lp2®æ‹I?\È ëØ=¼.?§0ŸfÔOÑZ²ÿpÆу¦ÍšaP)B¨´´Ôf³‘õ5wã‘´Æ%üŠ 1íÝ»¿Îa…2N™8~õ¦]¡:MqIE\¸Ïõ˜™MÓƒaêÔ©“'O>uêTUU•Ñhlr¿;Ƹquº+sÊG}ä~dÕªUd»Ýž––澞5räH‰P|||¦L™RYó]@X(Î/¤¨FÓA€ä 0G IDATü务ÄeîZ«ÕjµZƒÁбcÇÀÀ@ÿË›·=£É'£¹¾Xƒ= Ž»—ì¾íºvÑùš=¼¼z`ÚîƒÇ{öÒ+YÉzDQLOO1bÄUœ;·94îÞmÉÛ¨¸þ½j- Jg>ð ž+?]tž ÷Q4½kqhšŽ‹‹#¯—3;+Ó.0ÑQ‘µ5åEy>!mÛú4“ô‹ŠŠ~ûí7é`bbbRR¹â™3gÊˈ!J¶_¿~¦ÉJ'ÏÓ‡4v/=Tˆ¢É8ÈâÃ0d)M¥R±,˲¬F£1™L^^^,ËFooï¿|2Áɸ£µ¸e{ð<¿|ùò=zŒž0‰œïaí§„µ¯·Œ¡¡Â‡Íf+--%ç›43÷*çÈqÞîÞƒ¼ À¢x£‡-3eÞû{rËÕíd 3ß5tèéu;^ý÷\oƒ¶9£%$$¸ÿ8þ|é«W¯–„*Æøî»ï¾üÆ 8Î…íÖ&%#Ç‹—ËE dp­VûÌ3ÏÇSMŠí4ùëkòÞï@È/e4Am¹¹¹üñÝwß°wï^???7ÖC]43ò4(¸îÝ»ïÚµ‹ô!½RÊK¼¶†A.}‰¤]D7Dºÿ¨öðò1h:w‰ï ï8höƒ÷÷ 7”U[®’—"=™Õ«WWTTHÇGŽÙ­[7r;¤¨‰TIt¼¿ìM/±YyQíi^º4éöBÓ´B¡P( ÃwɯÀýÙ]š–x‡«e‚“ÑØ-ooïÏ>û,99¹OŸ>ü±{`T2™&‡¦é»îº+--­ÉhC¼Ä[šÂ\kPh”Ó\´mwjifÚ霳9…%:â/ŸŒËåZ¶lÇqÒñ)S¦:UUU‡&ûŸ0ÆF£±C‡©;x—¬µM^Ë‹*O#kÒ—¦=I™Èd‚“q5yn›ÌfóÎ;_}õÕØØØ M<Í4!Q½½½FcAA䬵–öïCphÛªü¬‡zê´~Ñaû7¯î4p\ ñJs”ÑΞ=ë¾ú4cÆ rkYYY6›Mò(Û´ic0®B=œË WPpë< ¸à$Uþ¢Êkp2®]¸Õw'±ÛóòòΞ=›0f̘ &ܱæ9-22rûöí&“I§Óµ¢e ‡)ð±9sÀZ|¶_酪C{BCT÷ê*ép?¾ÿþz9Æó©©©ä6EQdYv̘1Wb<Ï#‡ôMÈF‹ ê< ¢Á@3ûÀÊÜm¢¶Zf³yݺuE‘¥7Œ±ŸŸŸ´°ý·.­×ë{öì¹k×®›3óæ>=È-»Bí:mP‚»¼» RRR$F€qãÆRÛ¼ysUU¡3—Ë5f̽Êh\b7¸îŠ¤Õ… ìv»{jH+ôÐÿò„_ý533S:2lØ°¾}û’×[¶lq:Ò&„„)Ôp•‘V«žešŠÛbŽ¢HÖ´û/‚¸¨2»ÉwÛ¬‹AVê¦ÙO¾RY]W^xnçÞ4b.é©»Š«le™›w-ÆGÓtVFú…âr„PYѹŒô™g 3$¿øò6›óJ~¥û¢Ûöïßß«W¯Î;ǪÉlƒkƒB¡ˆÝ»w/\ZdüÖ‚ÃáøùçŸÝ}Æ—^z ª¤œ:uJÊGÓétÝ»woNY‡Í¢£›>ÁI1pÙ-TôIvQeücà¶òòÊŠ¢sËW®1h¨ÜÂ"emA‘+æöôwq.WêC§÷mß}ºØe5?þʇ{–~âðˆÏ9¾´oïÄjs-Æb“f&QXEEÅñãÇY–9rä ' I¿„„„dgggddtêÔé–«ñ/µÔKNN–&%%õêÕ‹¼•íp8(Š"uqûõë×Ì¢LœµNGA“ë~NJˆj4 ½[%K2ÁÝ. 8(ºc<í:ß¡sŸñ#ú~öî¿K-žï|ø†ËÉå$¿V쪫XqàDÏþƒDKe©¹N¯÷5izšªÌΘºwOÔjÕMR 9²gÏŽã:vìH2xox90÷®wÝu×–-[‚‚‚ŒFã­¸ŠD:°°,»dÉéÇ””BÙ¢(ªÕê=z4sLWYG7ý–fÑîì&œì¢Þ†ÀX´Ûji¥wiáÙsg29Æ‹ák²sò6nØXl¶‰"fJ£Vß%Þ×ËÓ[§!Š DQ°Ù­Wâ«ÕºqãF­V›””$m¨j!Ò‘*ùtëÖíÌ™3ð÷£±ÿ¸|›?~II‰tðñÇ÷õõ%7òË/¿HÉÌÇÍš5«ùKB]­ž¦®@p  .ùu0 s¥D_²‚»Ua í×î8­ õ>·aÛÞq3f+jò7o]Ø6¦{·{‚\Á,ò;tÈê [ž!Ažêã *¾×(žöع}g•ÙjôÔ^²Á[222ªªª}}}oNE0bíÞÞÞ'Ož<{öl»víþnXö„ÅbùᇤU*Õ¤I“H@³¸¸8//OÚyáããó—Y «Ug¼|õ'¥@¨1÷ɉ¾2ÁÝ^ò 0RyÎzà„è S9³ BüŽêD3 ŠBF_xð_ÑE@D‡.ãˆ8ž9¢éFÌe6›ýýý»ví*uNj¾A^"•0z÷î½ýÿÙ»îø*ŠífwoMrÓ;é!ÒC ¡ID¤ b¡ ‚]–§>EÖŸEPJW¤w …’B$¤÷zûÝß“,›BK`Îç#ÞÌîÝ»;;óï9sÊ ÃôìÙ³Cð¸Ý»wŸ?^üsäÈ‘±±±äóÉ“'- ±¾@pp0qUûÇÕ‚œ Ó빫üDHe 3ö`p<ÏÓMª¢Þg‡Çq,Ë †mÊÁ9™Œaš`–8“HKSÉd2–aZèƒÎÎÎ …âfýÿF×:Az}†aÊËËûôéóÉ'Ÿtˆ7 Â+¯¼"mùí·ßȇâââ””iªønÄéL¼PË6ò— XRÊY‹ÅíÕɆ•¶Y¯ÿ/$Ãm ÷4‘5ýyMˆáújéõƒFó/e^Èʳ¶°¤ìòå‹Ù˜z.¹ºNûüV«Ý¾};¤§§744´scÃ0[·n½|ù²Ø²páB²6úF‡ÍÓG}ô¦ÈÂóö,†Vʃ±¨yõÀûµ UQ©´DŠÛe/“^¤¾¾>>>>44ÔÝݽ…&%~HŽ;°ïTŠ Ǩc¿þy½Oøcòú\ÌÆ´7nÁó³TJù?R<;;»µk×0à…^8qâÄðáá…F‡1F¤0¨X.î¡™NyjkkûÚk¯‘›5 ‰‰‰ÄgPÎ;Ã͘uzƒHù…fH†ÁXÏp*É¥ÄHû¡~¸R[•P6Rj³m†3žçµÚVWqqñÔ©SÕjõÃ?üÄODEEY[[·ÈÃc2JŠJ»ëìl¶˜lÇŽX¹îÒ»o={éb°7z'jµzáÂ…¶¶¶$¥Z#åĘxžÇ2¹L,“z õnƒ(Š… 6HJ"ÌŸ?ßÛÛ›|^³fØÿ‚ ˆÅºnüúZ½ÞL­:ÁY0h‘B-Á|Œ1)g4’ÜýmÒ¹´qãFA¦L™Ò¶« †¢¢¢«Ã¶«ªªxž/,,LHHðöövww lq#Œ\ѵkHÊé\½•IæŠX¥¾¦ìbnAâ™Ô‘Þ Ã×U—²´3fTUU]ÙHE¨®ò⎽™Ó§!-•¥¥WWšJBßí>/,,räÈ©S§ ­A×VVV;w¾Úá ¶¶öý÷ß 8p 1?IÝ80äåp,þŒ\íÒw²ÎÉÍíñ‡nÙð›OX¥Œ»ÁÛÉ£ƒƒŒ0˜u5[7nª· ŠÙ gãþØ÷ȸñ¿|¼Øáá§^ž0š…{`¤cYöìÙ³©©©bËàÁƒIü¼ gÏž%›Â䄆†’Ð…›z#Z­ÖÌ­-«hn‚1µ p÷!ƒ#U„Ífó3Ï<v‹¶ù«ç¡ÝÂ… A’€¤Y&Œ±›§ï˯¼Jxš›`Œ{ Ñcàph^÷þÆavoZg´ò³äœ¨®·Ý°ëÔ°¾¡)©©¾ÁQÝúƲ÷Äâ„1þüóϯLŽÛºu+陊ŠŠ³gÏtÁÖÖ6::ú¦\mDÇ–Å´c@#—^ clmmMçB›…w ž;w®››ÛüùóïÄΣ´ô\‹I3š\s¡y~‘6ÃOÓì>©"fà±c‡±œ|PÿˆŒ¬ËZ“©œœmc¸‹ Nì„?üPÚNjÊGÞµk—´ÿŸzꩶ­.ZƒÑ‰À¤@ x0€cb[¤¡qZàîCîF†xMMMvvögŸ}¶k×®ÐÐP) Ýâ•¥³îZ!«M‡¯$aºJx½Ñé+6"`Ó￬øîwLI§ý}=r2Òõczfá]¶¨‹é*¥ôÍÙÙyĈ„våååeee‘¼o‚ ·Z ïF”ô½Á–€f•08A ÃJ{UÊਊz_é¤â”+--MNNŽå8.22òé[MMÑhlA?!ã~c¦(OŸ– àíQ]œ›UX±à……rs}fi­žÌ]ïöE‹ét:±ý¹çž $ݾ{÷nŽãÈÉÇÅÄÄ´ßÉÉ5ååJ^,yÝ[)dC¥å©ƒ¸ûA¤qš§OŸ6l)k·©n4/\¸{ï=lQÓ?¬¢WL?‚xÛpŸ`‚}v}Ü€ðLt»½¸¸xÆ b£­­í¢E‹ÈÑÔÔÔââbÑ1ÐÇÇÇÏϯÍ?WWQªà˜VÁ±Ü j¥K±,+F¼RŒ£*ê--ãWµˆW’à6™¥®©þÁ?…Ü•¨««;sæ̈#ˆzr[ÔÝÜÜJKKKKKÅ«ÝK¤kʬ~Egm4÷Ýj&á6wûÎ;‹‹‹¥ô,-‹%11‘P*²½@JÙ·YjKŠ­:"¨´ ¥R%`¤*P'8 p·¾Ž[LÆÊÒâ‚ÂB­Þ(ªR€%IpÉlêp3|Dõ MÖw|ãLúgaaáÉ“'ûõë§V«oïl8pàáǵZí½gW¥ŸCMjÚíÍLwƒ ®ªªjîܹb‹ŸŸßÒ¥K ¨UVVæääˆY]ºtñöö¾•Zˆµ%ùÊkäJª°€¢y\=)óLg'¸Û 6åÇí}~ñG+¿_ñîK+ªë‰ñ½IQB¼Å’y!K@pe£_©—ÐXàY>ýòÿšæ',ÜÈ4ë‡@iiéùóç `kk{Û³ì*•ÊáÇ'''c ٤̞yæiRò?üP|»?þø#HRxŽ7î³°Ôæ)¸ÖÓ]–ñ¬ªyä©\.' Ž ¸[}e‰²çäÿ¼ÿ¿ƒüRqIFjܾƒ ºªâ­›~?•’Sœ›¶tɲ:£ñLÜÁM[ÿªj0êêÊ·mÞŸœÆ[Œ‡÷ïÚº}·Ùl®¨¨Ÿ8¼gó;jtf„®GäD”!¦¦¦†p7±ÈÈíåYÄç€çùââbjºµþÌÌÌcÇŽ‰í¾¾¾ oäÔ©S&“ID·ØØX++«[\ujŠ‹['e*x$8Œ1±ÁѹIîvô…LYqþð–MrJjílíÿX»Ì$XÞý÷+—µËÞ½T/8:¹\>´~íþd…¹ü—-»vþúXÙÿ{ÛŽ?¶¥]ª¶æ+6ÿù7B¨¶¦ôÏõe— Š®ï-&*ùùùqqqýúõ³±±¹s©(†‰ŒŒLLL$ù0d'ÚÔ~üñǪª*±}ôèѤæ©Ùl>sæŒø.d2YHH‰Ójs¥1¨­¬®õ¯W™µàBà(Àݾ%Ýb² Œ1|øÛo¿ÑÙÓÉÖ-"6¯Ho=aÔC½49 f_Ïm¿4qú#'U•l?Y8tø°ù _0×åõîÑ+fðhCU‘€±S/‡SI©µ–&wÍë2(//ÏÉÉ:t¨½½ý¶²ÛÚÚ†„„œ>}øR›¡ÚÚÚåË—‹-ÞÞÞ'N$êjvvv~~¾¸ ¸¹¹ùøøÜújë`P‹ec jMH©TH—–eŪ]T(ÀÝâxgÔÖvV;{;[`8™Jãèe£ÛuôðÑ SL@§Š²²IÓ†øé§][7¹{Œíî¶÷o¿X&·÷KLI:vô •ƒ—L¦Ôë ¬\Fìtæ,4r¾}«¨¨8uêT=n°&Ó-Nið÷÷çy>;;[jþ{0UÔýë_ÒÇ_ºt©ÑhA<(ÆÕÀôéÓogpµ·ô€A€‘ìê4¿HŒ¦Ò¡4WÄgÀËÍʦÒòxܤ§–{÷½wϤeÌ}íÝ`w—Ç&õ Ÿïr®²Þ452JýÏMzº³o§ô”äz‹|@x·^=£U*·Î>EzðÒZ8tJfÑ} O:5xð`â”pøù•>}ú=zÔÏÏïÁ$¤ŠŠŠV®\)6FEE7îÀ Ãdffc¨ÅbéÓ§˜êýV~·¼¦ÎM@Z1]`äÊ7ÉqÃ0ÔG„Ümµƒ³ÆÆBÈÙÕ!`í]úƺ’Â"¢ KXtÓø“Çö@”‹°èÞ„¬ùxu„¢zõâØÕ¸ÚÌiUÜ­ªª:wîÜÈ‘#U*Õ][¥ÉO+•Jooïøøx’nûÒUŇ6mšT\¼x±¸=úÛo¿‘õ‚ (ŠÜ–.*«¬t“]Ó’WX!I*UQ©Šzû'?Q š:nÊ1Ûú$iòŽk ¸!Yh¯ÑHÞÆ+ ‰ÅÊËË @rRßÑú/­ÞyçÎkkk/]ºÔBk{Ð c— ¶äã ÃìÛ·TB £ÑhnËÛ)¯¬tC&æêA…Á¤²iQ£Vtô¥rŸÜõÛºöeÿ!ȼŠǒ[|KØQŽN:Õ·o_z7‘E´ý1 3tèÐ .Ì„ĉ¿mÛ6iÚÞ7Þxƒ(¤ âæ©B¡ »]¿^QRâ&CÐZšƒYi%u+"D›ÜpÒäÛ m- ÜúäÁ¼Åd2M&AÀ&“ cÌó¼Éhäy\¾²²òÔ©S=ôhw»ËEXD¶(“ɺtérîÜ9éúqó8ÒáÕÕÕË–-ýýýÅ´½•••åååÄ´Ï󼟟ŸX!ûÖѲòr7-·Px›ª‡ˆšLqªÍÒ‘lp Ã$&ŸcdÊÛ’)LÀØZ%ïìï+uyE]¾|Y§ÓµaT±,ëíí-—Ë OþýÃ߉'—ˆ½.Ÿ?éÑ× •ïKH³sï6iÜ09‡’““leeuwê“^ªûúúæææVTTìÛ÷7Ÿn̘1ÒöÍ›7“${;ÓTtQ&“M:õ¶ ~£?PUµ»üêCñc…ºÅØ&‘ö§î€#Csùê-½',° ·~A‹…WTÁ×$»TD)h܈;úîуºæA÷¾=œO7ù‰Êª:}nvXtÄÖq#Ç:Ú©ú÷ï/—Ëo¶>é2E‘JÌ;wî1b„Ñhtuu½¿õS8uêT||¼Ø8dÈÎ;“IHHV:t¨ô‹·.åµõjÂàP Kæ råµ,3æîs€#/˜áävÎN¦Û€oÀ[^{ 5¯`„jC‘–TN¡T(•J…’žå¸Œ³én CZNÚÈdžÚÛ[!±Â&Ü»,’ZÑØÆÆF¥R 6,22’¸Mܯ3Š<×¢E‹ÄþgfÚ´iÄj2™Nœ8!fµ´²²êÚµëíí µŒeZٵ¨ԌÕr®E®šJäRQ¡)©ÎmɆÖé´—/_F #—ËÝÜÜÄýx2¦ëêêôz}[TiÀNNv µº—§ëÆ_ÖzõôèäÜmX¨\!úÔ¶‡!+bœÑh\»vmBBB^^ÞÇ܆\µÚB**JšÜõ¦f‘B¡øG µµµ¦]áH³â÷ƒ3›Í«W¯æy^l\°` ’«ªª*((‡888têÔé.ôyû-6²¤¿(-Šú`nR÷ôÏ9ÄÛ"ksá˜u”[(ƒ¡ÐÐÐÔÔÔ>}útpiLÕΟôù‘#GöìÙ#6Ž7nÔ¨QäM={V«ÕFŒ±‹‹‹­­í] ×äâÒ}Ûb6›iA†àH3Äô!†±Ø Bc«4‘xy,õüºÖ•5„PEEEMMM†8Ã0:uº:¹›øëÎÎÎçÏŸ×ëõb0C;x5jmÁ4AÀ,‹3 ´{ýô¥—^’6~õÕWäV«%ù‘È“ªÕj˜ubKDË M÷F®ù NÚñ“Vk4i냇<éÙÉ““`±`†A BCÍ铧{  fÌpð€Œ5U2k¸î"0dkkKð·¥[[[xElU(¾¾¾ÙÙÙí¿ä%!õlü¡ø•Ò&2:ôôÁ¿C{ *ÎÍ.®¬‰ì3(6ŠiÇ7OúvÓ¦M©©©bãÌ™3Ie,âû&¾žç‡ZVVv7ïÐÚÚš$©oÑ.ƒ²[dpMAZæùÔð>1™çb‡H?´Ó»ç¨’ä½õ¼}°¿óÆwŸî·ðGŸ&ëòu0N.—§ÛË&Èx þí·ßÛŒ¡w¾™ ‡·oSGíjÃg¥§ž(á),‰ZnÚä‰ç2sÛ~µT„Édzíµ×Ä;;» ·`2™>¬P(“ruuíÖ­›´:ê¾7Œñĉ¥–A©°,KÑíÁ8@ñƺ⋗j² ¼òŽÿPRëPúÛX¼ã⎟»ôì}pÕGŒµüÚ›;2nÿ ³ÆÁŽ)áQ•ZaeÓhAjm>WTTˆ…”nö–œÿ1:Zĸ޽{Ÿ>}zРAíy#„™rÄãO8xð÷ì‚ÎAA½º¸ƒƒ½ƒƒ¿— ¡FæöÉÝয়~ÊÏÏÛGŽI>ÿòË/d_ˆœgÕC0ë z­JÓ*éÀ¶nnö+ááá………vvvív•FËyl2b ò IDATÏ $] ° óâ+¯ 3,Dz¨8‘øÄÇÇK‡Ìœ9³k×®$±`fffCCÇq¤d}dd$Çqwà¨P€»ÀÉzœÌFˆÑ×Áˆ×ÿïbÚñ9ßZ…ÿ Á¹©gzÍ_É ØˆÔƒŸ§´²MßÍ˺…øÚÃËX_ƒ-¾6B‘$B:N,z³³ËÚÚú:ºªÈ/ìììüýýIM†öˆq!ŒY–cr{˜¨öœLÖôít•tæðáÃÅkkë+V—[[[»oß>²Ó-‚››[¿~ý(P€k7z0Žî^XÀ€lãá"æ¡ñìK¶I±€­\CØÐi ðØ­k1€ñõmã‹¥mÆ8¸¾ºxM•Jåëë{æÌ™˜˜˜v»’*ˆÔšëOHÝnÚ™+œ¸T,_¾œÔ$2gαç·mÛ&- 8~üxŠàÚÕú,ú»5ÖuFv0Æ šf æaÀ@Ë$ƒèZ‰ÉÔÕh4w4üJXXئM›êëëÛ©Ï:Aé¿’v1¶ê§õõõ?üðƒØhoo?cÆ ŒUVVvñâEB±Aðññqvv¦X@®ýN@ñ/hnšmä¨åÙת@œ¡ÚìxIvnô‰¿Ò£G„„1­”·HßÈ+øᇲ²²ÄöG}4""‚Ä*üý÷ßâÀ÷éÓçú1vT(ÀÝ'‚JLL¬¬¬lC1JŽãbcc¯lµ¢Š1öõõÍÏϯ­­mÏÛ©è bŒM&“´¢³J¥Z¾|9ù\TT”››KzXOOÏÚçà”õ?<<¼Í廤•nÊ‘“ýüüŠŠŠlmmiÔέ¿A„ÐÆ333ÅÆ_|ÑÁÁ:}ú4‰ñÄ ‚p—}ߨP€»Çë¿”‚Ý,Üà&¹Ù9ãì윔”äïïO’,RBq+èVQQ1}út±ÑÓÓó­·Þa˜ÒÒÒ“'O*•Jââïï/–›¡½GîÁš'%%%•••móøõõõ½©0/šœœÜ§OJ(nå­Àÿû_éŠ5þ|µZMl7n#”J¥4ÿ% pÐÇ—––ŠEN@¥RM˜0 [ZZZee¥˜Õ2 €”×¡Ë ¸v4ˆ·%6ºÚEUš²ü.Ç$ÀðáÃSSScbbè”kC’·¶zõjiÚÞ7ß|³K—.dsüÌ™3DQ%Ö·^½zÑlkàÚ—èj«ufƒžAèzôµùþaJ˜ :7‹ºÇ×ÖÖ^+»Ã?‚¯­­-#)#}StcìèèxöìÙ††âGc­o¶ëêêH•,"^^^o½õéÀ²²²ÔÔTºÀó|```PPP¬¥T(ÀÝAyô¡Uõ ¡ÇOTVU1 j3ÂaŒÞnN"‘ ž¬¬¬ªªª›uÁËåò>}ú,Ø7‹MäL–e=<<²²²¢££[;*7Bß–,Yb0\© .Í’´uëVâÙKöpHèí[ píHA˜1uù\Wšwé’Q¬½ÖÖeŸ0SMÑß³gÏÛB(n ›Äó»uëväÈŒ±Ñh$yÊ(ÆÝ }ËÈÈøòË/ÅÆ°°°§žzJ¬X\\LRžç{ôèÑÞ bPyÐŽÐ+q­00 [tÃHª(´XÒÍf3Ïóm˜c™LFîöf1ŽÄ7.44ôý÷ßÿÇìrTD÷ñÇK#OŸzê)q»fÓ¦MljU®{ôèAŒq´ë(Àµ¯UZœí=zô úÇÉ#CÂNñUEêëëkkkÛV“ÁÝݽmƸ†††%K–œ>}š0VâJ1îßoqq1 À"bkk;wî\rBBB‚¨·bŒƒ‚‚:uêDª)Àµk]5""â¶Oé*)çààp+œ¢ ß²¶¶^¿~ý°aÃòóóµZíuÒ½R‘ªöŸ}öYii©Ø¾jÕ*kkk²yš––&®[<Ï0ÚYím*wN:K—ꪷwªˆ!VÒp«[¹ZÛ¦k@@ÀÑ£GU*Uuu5 7Âપª>ýôS±1""b„ $Þ®¬¬ìܹsäL‹ÅäææF7O)Àu]õÎ]üîOX===¿úê+’TŽ*Sÿ¨Ÿ>ýôÓÒö·Þz‹ Aøù短­­ÉÉVVV“'O¦ÐFUT*÷XáÂwïÞ¨›È tWbbâ¡C‡ÄÆàààáÇ“~KLL$IÞ7’”œöepTî%‘ÉÆMZ3níCÓW0Éö‰1&n}â9÷q_Y±bE}}½ØþÚk¯‘ºôf³ùèÑ£Lc±j¬P(ÂÂÂèÎ)8*÷˜•èêjk´ÑŠ‡›ÚE~'ýЄ€ˆäö$)Žï{-L|ü‹/þôÓOb{@@ÀÌ™3É ‰‰‰µµµ¤Ô”¡›§TE¥rÑ v}ûɃíÒ·^M9v VP }¨uAæáSi} rs°Ž;¼ßlíÙ'2è|r|½à¨ÁuÁÝû”e$6(]j ÒœfPßî™—rj+üƒÜœïOwVâ—.]*- øý÷ßt!!!A|ä|z²©¦hDZ”!CbS3¢»ùj<,åéõja Ï»zw>²ùçÞCúzù¸ùø³æ†šêF¦2 ®][ç>訤¤¤´´4±%44tðàÁ¿Ž?.Õ[£££Å¨^:ƨŠJå3¸ÈᣫâÏôé3ôäÁ5z«Ùó^Î:{âü…¢1“'„¹q»þÞ/tyxâðÅ…]9–qttüèëï=}ÀèpäÐ!ìè7vÄCe¥Ýí9é5ï?ýtùòåuuubã»ï¾K²½kµÚÔÔTq+†a˜ˆˆˆ{åØH…•–³Waë4jÄPùèÒÞwH89 0jÜr^'O Hîß-@n?ü‘ñä——ñ£¸/§´L&‹‹‹Û´i“Ø2nܸ±cÇ’çMII)++#ÕŒFãˆ#ìíí©;!UQ©´wµ¿ˆþq¢’ÕTqYœ¶WNnlºoíM,Ë.^¼øÊf˜wÞy‡<°ÅbÙ·oŸL&#½çèè8hÐ Šn਴;EU´ˆ#iîâkOÔD S*•[¶l9räˆØ2lØ°ÐÐP‚ïÐëõ¤ëÌfsÿþýáþ5DR¡Gå~“ªªª?üPŠwï½÷)`V__òäI’”cìáá!epà¨PéræÌ™äädñÏ=zˆ…8 MPieeEé8*T:€œZ¿~½´qÅŠäPCCCvv¶x¦L&SÏSúFŽ •ö.¡Í›7§¤¤ˆ-¯¿þzHHÉûvæÌ™ªª*‚nF£qÔ¨QÄk„Ò7 pT¨t ™7ožøÙÚÚzÖ¬YÄÓM¯×oÛ¶M&“…ÔÍÍ-::š¥oà¨Piïš)¬Y³¦²²Rl2dH`` Á¯;v¨Õj‘è 2„j¦TˆPG_*í]3Å×ÕÕ­X±B ÀbYöÃ?$™ë+**.\¸@ Hß7???êûF…28*ƒ¾!„:tòäI±}Ò¤I¢ ÈñãÇM&i·X,½zõ"›§´÷¨P€£Òè¼ôÒKÒöo¿ý–|¨®®NMM%yzyžwwwïÝ»7Ý[ BŽJÇ`p¡µk×ææ抋/¶³³#{ñññZ­–à Åby衇 ­%ͨP€£Bån£[EE…”¾¹¹¹Í™3‡lž–””=z”„1‚Ô­[7ÊݨP€£Ò1Ð cüûï¿KÓ"…‡‡{yy‘*Y»ví cËd²¾}ûÒ½*à¨t!èf0Ö¬Y#nžr7oÞcŒ(ºQ¡G¥c BhåÊ•åååbã_|Aâ,K\\Ù qýúõ#Y’¨P¡**•ö.!N'õ}óôô|öÙgÉ¡ììì¼¼<‚h‹%$$¤S§N4ï pT:}€'Ÿ|’çy±qÍš5â¡£G²,Kã¸Q£F‰°H{ 8*í¾%%%mÙ²El‰‰‰éÕ«Ñ[Ï;—••Eö,K=lllèæ) pT:wãy^êÙ‹š>}ºF£AiµÚÝ»w[YY‘C¶¶¶±±±b¶8ÚT®/t“Ê=ænãÜÜÜ­[·ŠJ¥’DžbŒÓÓÓu:!k$ï›XS†28*”ÁQiï !ôñÇ××׋۶mƒ¦°­„„Ã@ÎôññI±T*T(ÀQi× .))iÕªUbË!C†Nà,11ñòåËbvß1cƨT*j}£BŽJÇ oðÆoH_|ñE|<Ïïß¿_&“8³··ŠŠ2›Í´ß¨P€£Ò1èÛ8 ¶ôìÙ“Ð78qâ„XP„îÝ»“¾T¨P€£Ò¸›Á`X¾|¹4òôý÷ßW(¡ªªªøøxŽã}S«Õ}úô¡ýF…•#ùùùRú5räHáÂ… õõõ"}‹ŠŠ²¶¶¦=F…•#S§N5âŸbèÃ0qqq¢§› ¤ê*à¨tA­_¿>11Ql™9sfHHItàÀŠŠ ¢œêtºI“&‘{ÚoTnV¨£/•»-$;ÈŠ+ĵZ=yòd²‡ Õj:¤P(È!Ÿ®]»R×*”ÁQé0ômß¾}ÇŽ[:uê4lØ0òùðáèI0Æ]»v·¤ÙA‘¾} pTî༺ÓsìFBDÍfó'Ÿ|BâˆìÞ½A¨®®NOO³Z*•Ê˜˜ñOñ^ÿuT‹Î¡xGŽÊm›Wþþþ¢Óìooo¹\~Ÿ S:>>þðáÃbã„ |}}ÉÞBRRRuu5¹a“É4tèPº ‚š¯¯/Çqw}€ã¸   ¸3®âSDFF¥½;ƒŸ.#‰»£Óé¯ONóöö–ÇÊÌÌìܹ3Ƙ0;žçIiT++«E‹‰WK;ß¹g‘þÖû )•£G•ÛFOîíõ j|óÍ7Rt{ñÅÈ¡ýû÷ ±hÖ˜1cD, 'ˆèv‡Veñ)î(€ŠOAÑ•ûJjjjZlžN™2…Ô¥/((8qâ„L&#‡:uêHìtR,èЉ’î4€R¡GåÞ(ÈdV'&&¦¤¤ˆí$‹çù¤¤$–eÅ™}}s*਴æB0náÂ…Òv²yŠ1nhh¸pá4å€S«ÕÑÑѴߨP€£Ò1BhÕªUééébãâÅ‹ÅÒ {÷î­©©!í:î±Ç#[¥”ÁQ¡G¥ › o¿ý¶Øhcc3kÖ,BîÊÊÊRRRˆBŠ1 j¨¢BŽJ‡ÐOà‹/¾())§NêïïOôÖ½{÷×ògtt4u]¢r»„Æ¢v$Ôá´6U•••ß}÷Ø(—Ëßyçò /^ÌÉÉ3Yº»»wéÒ…¾n*à\k*ߎ1„èJ+†+aE0À' Ôô!„DW‹ÆÏÍ}/¤`$õ5»u0%WسgOvv¶”¾yzzg·„„žçIÉzžç‡ ÂqtLR¡wŸr±:!¿¤¤¨°0¿¤Ìl2É ZY]…¬¡š5éY³‘±˜L:­©¾Î\_à Øbâ&l6òF¶˜‘À ËÊäŒ\d V®`d2F¡”kìdÖ¹ÊJÉy™‚—«,Öö&[Gƒ\­V*=]]<=<=Ý]mÕ*)*Io¯ÍG¾²xñb±E¡P|ñÅä³V«½p႘ÕÒÅÅ¥sçÎpçã.¨P€£r›MJ‘ÄëôÆz½þbÎÅ„c‡öÿž’j+„ }gÎÔ[Õ2– ‚ €Ì0„5ábX@J€FD°6cÐæxÀzÀ5càA@ˆÇ`AÈ‚Bf@ fÈ42 E:Veè˜À.=†ŽêÑo Ÿ¯­µ•R!B^›ÑmöìÙÒÐ…¯¿þÚÎÎŽÚ²e‹Ùl&¦ƒaÚ´iݨÜ^¡±¨wΤ•Ç¸¡¾¡¾¾®ªª2þÐÁøCPe±OY¶G]u'%øÚ0>Ör•• Ñ>ñ ¸Iå¼eÚØxŒ`–€„ôZSžÖ”['䛡ÈÊþ¢³¿ÌÅ3fðÐÞ²³³³±µµ¶¶f›3;hm»S|ö‚‚‚ÈÈÈÊÊJÒîããsðàA___„PVVÖªU«”J%) 1~üxÀD…2¸v m-" Ò3Ò²/â‹©8/SŸ“Öš ´»Û gí䜌<4дÄ`S!À#FäML@ÃÍRª–Z'Bâ•p€¨ò`…<Ø‘ü’ ÝT’’ðÝŸ{?A¥R‡D«ü‚Á;HÖµs`tpçk…Á‹Ÿ7oÞ\UU%ÞÅÈ‘#ýüüÈWŽ=JêË`ŒåryXX˜´÷èp¢B\ûåkñ‰Iï½õf~zÊ‹Ž¦Çíyoa± c0‡˜Æ€æ†­¦¯7 4NÓ¶A‹—Fo¢U8)(¶¼ïC!Ôâ’‘_—´X06ó˜gXb·T³ßk5ÎA]—¼ÿA¯îQ­vHuuu§Nôz½ô(oÙÙÙëׯ' Ê1Æööö¤*E7*”Áµ/¾FþÌ/*Î/,*>—Ÿ_ð×zér‡nJ°`°Ðär(¢ ùßÕ}0è-B…¯ç¡Î"˜,ØÄÊMr¥E®2Ë­L2¹Ž½E0`°YL™€™ ™Ló¬À3Ï`Å‚ [T R2 Ì*Á¬ÌVÀ+@PpHÃ2¬YFÁb„ܲWôÙFØÈC “1`ƒ-ó\øy¨¬º2íè¿Ê8ßG¦zwqèéÕ©“—»y¢+VHÑM ³ÇŸ\¨1ýVÎï-µx‡vë6dtHŸ~~¾>Î.®&£±ºª2//O«ÓÕ×ÕUWWFñš Ã\ ²7`C×9DŽêõú­¶A§««­Ó_¶ägË+F¸pSÝä~ø+Zm‹”иY˜°?„0Æ)µ¦Fõ‡ù¤2Pƒ wÅŽÕ„eMN4èÍYµ†‡oS†W¶ÆÓÕÍ}`¿Ø—£#}uEe~þå£GŽ­$B1 #zùKÑêÖ± Eå…B¡T*œBLTÃq¼ d\Êœ‘UUZ+Ó÷æt°ÞV_í,CV2…œA€‰KP—ôn§G–7<𦴯Z‘ÃØØi4.åûù¤¦¦–––’¼oã>}úh4ŠnT(ƒ»7ÐF&Þés©‹_u¼!w0_ê`ÒºY+€a°ÐÂõ/ ³éŦUEà6n΋]£¢U.nJµuqaAfzšV«­ªª2 &“Éd2,»–‡í?²Ë;èä®0Æ:£É`2óFƒÜb¨.,(:sÕUÌuãƹÊe!šíQ\¹1€qÊ‘|vÜdÓ¥gT„F­Þbáy™L6cÆ ///j€£Bî®*¤äƒÑhZÿËÏGÖ~š›ôj 8óR%ÄYIvçë„} Ì›Nú˜1£† ydÄ0Že òó333³³³sssB¤^|¾Z}Ymxƒ×WZ¯óëcŽã E½NŸ’‘™—“Q•Ý“Óq`œ”Œ‘W¹7“M #/ü_VÃQ+w¦[Ÿ®ÝºÌ|öYZ€ ¸»Šn §ÎœMùkSêÏßLQÖÆ8*€“‰$¥™WÀ ÙU œæ²•ÛÅ€^.!‘?1ÍËÝ­®ªêâÅ‹YYYééé$‰eYtÙêd¾ÊlרB ‚@Â6 2Êår¹\Î0 Ã02™L&“) •J¥P(8Ž#4Pt(ã8Žì?ˆ×Ád2éõz£Ñh4Íf3Ïó‚ ð½Ðªf„Rï)å,4w&Æ7ºžpðÓ…úc1Ï°Ì7$ÜÁVsýh*T(ÀÝ„1 !¤3ó_~õ•°s]¯Š´þF©”ÝJª^`6Ÿ¨2n®f½&ÍöHTŸXW;›¬¬¬ÔÔÔ¼¼¼ŠŠ AÈæà5>>...Ç]]| …švo)L«:£˜…œçyN—››[XX˜‘‘QRR"“ÉD¤“œÌŒ†´”Ó…¤'pñ“þÖ`ÁM=ܬ·€­ðC¥Ìÿ•O^™?(}£B® ŠXU]}FRÂÒæü.öp³þJ4(éÄ “ÉR`rŽß(‚^_úil÷(Þb)+/?tèPJJŠ”³´Ê}ˆm‹ã8¥R©Ñhlmmûõëçíí}ÒÔᬖ-(žÅb9zôhnn.Ñgõz½ÔlÇq0ì¹Ô´3Gþ×UÉ<ŒŒcHÒ”æø@aýwŒÏ;k6x‡ØY[ÑV*ànHó€å«Öâ]¿tÏ9k ¹¬7@€Å›rö«¼yõßöá½b"à Ãòóó @ZÁ³ÅÜ#–{ƒÁàààзo_777[[[¢{^xã¾1bJŸ¨¶¶¶¶¶¶¢¢"==ýüùól“`ŒYŽ|± Ðº¦Ø˜xO¬" IDATd†ªn€Y`I\cg"h0˜×òqþ}='Ìš=cÐV*à®q%¥¥oÎnì¹?ÆùX#‘hÊæS Òê-ÔØö^ðæK/,$sõÈ‘#‰‰‰Òèú«­à⦵µµ‡‡ÇÀ½¼¼¤}û ÌÌÆ;ñy:”žž^RRB‰ó0át;¸tú]Ws ‹14¾hÜ‹À#ý”«ÿ£Sï¿mvuv¾¾)€ •à¤ ¼ºvíWŸÖÿüé"³•• ó¸…‘Ûd4­±ìtŽôŸøìœçž“ÄÅÅ¥¥¥F±Êz hâ¡fggçííÝ£G‘¬=ÈÓïꊺºº”””ôôô‚‚âm‡RÈåÕ:CêÙ3²NN°nfƒËJ2}Ʊ¨^g\VƹÏûà±3Üœ©ÆJ…Ü•iöÞ·?ª×:R—n§€–vsÖž­Kî?pþ¢>Úkl²²²Ž?^XXh0Dm´…•äù€^½zuéÒÅÝÝÝÎÎî:ZÛ‹q-°Þd2UVVæääœ>}º°°P­V“nЊò.1g=‹ŠyZc³d!iÌÌ Éº¿C¬&/|aî,’KŽv2•à®`€¶¾þ•™3æfnïálÝܘ…:½TÀ |ï«™ON'¶³5kÖ‰Q­îŸµÎ;7®Å£óíß‹Ø?¥¥¥$å¯Åb!í2™|Û¾/žZårZ„}` ˆ…Mù k<ûoÛ½—ådt›•Ê p&‹åÿ¾[Á¬ýx_ìïh#¢[c¶n²ªu[Õ¶Í5ýYog‡ÜÜÜäääääd²õy55À[,A¢¢¢‚‚‚‚‚‚T*U«ê0•›âwgÏž­ªªBÙX[_.)+H?×íâ©Ù&?9Ò/bQaaÙQõäk/½ü ÐÍ*ÀIGynAáûsŸžUz““C*×AóRîææÝ¥K jwSRRR222NŸ>­V«þlÂé°K';lUW2V‘ׯ»ÔP5v΄·—z9ÙSŒ£rÿœt4‹cêø#þZÜ2‚£•¦Ç|÷ãjF#ÂÊ•+‹‹‹»à*…T…BÑ«W¯!C†sq ãæ.¼SAt:ݺuëJKK†Á‚ðýÊ•?»Ô s– <Ã^Éÿ*ÍxvûÍ©L7A®ŸU… ¸ŽmAøéûïÊ?ÿ×›ÞHjpP 5}côðzeÉü'§ò<þüù?ÿüSôÂæÞ <Ï«Tªˆˆˆ~ýúÙÚÚR:pÏ_.¤¥¥>¾   Þ`¼wèÉš³=­ƒ»Rø Á®rÓþ“>^±J&“Q`*म¶‹å¹þÑŸËs52kÛ5–>Ácë_Û¶ÐCƒ 99ùÏ?ÿ•—«JCL&›={6±µ­\¹rÆŒ …‚ŽöóºÉ縸¸={ö0 s>-½GòöÅ>œ4(…€Ál‰.t=wÒÅÕ…và.¯ª–¸°ïÙ·Ǽ ;låŠfÓ…}yõñ!ƒ?Iø!¤s@eeåž={­­­¥Ö4ržç¢££ÔÄÖ._·”…ÅÆÆzzzž|ø¨Gè€n>vMX×,ô˜a˜Aºº¸üû岓›¹‹«Ãü«.éÃÿ½nƒ³£#åq÷½´Ç˜dÜ$<ÆoŒ¾F ':s`Œ ¯Th&ÿü÷#£Fäååýøãõõõ- “ccÆŒ™8qb‹C÷îÁ!—·=—˜œ’¥ãÙNþÁ½zFÛÈÆ8ûÌ‘ÄBÍ”‡#É›0Ôþñ×Ñþ£Ç{jÐÉÃû+äÞ#Ã÷ï?\\ctîÛËVδf)ÄX3þñgAµÞÞÍ·ßÀþN*1¯Ÿ‘&-Çrß.á½¢º)Ùƨ(ÈLL:WRÕ SkºFvõg¡qµk(Ë;•XTÙàÐ)(Â]Á0èG‘åÏ=÷ÜrÌþç³Wþã‰Y–i2áaôzù‰wæ>½tõ¯Öj ˧w÷HÃ0ïÍ›ýZÕ)¹XAcŒd01C¾ìÐþ@¯sçÎmß¾],œ.Íf__߉'¶ÏdGJÂÄÈsŽîÉm˜ëkÍŒ±Ý꣇±dÚ4máÁQOŒP T•ºùá ¯fëä½C}Ο{§¿þûöüñÑã%GÌK°ë«Eó?Y‡}ƒñoòˆ7Þ\f3x„µÖüëy×ÇgîÛ²..«â뽉Án¿~ºèe«L®!Á6 S+†Œ´â»/ýlÐÑ-_¿þw—)G’‹6”¥ÎŸ¿à׸ាܯß/=^íðƒáRj9çmÇÇŸ¹Ôïéø¿¿T’4ÍÐ…e-…ÏŒ^ ^îLéö]G½»Ï>|ôk;ŒAëÿõè‚/¸wu2žÍ«0zÚÊo—¹¨PYÚú±¿pÆà<´g@VÒÉ:µës¯/{gö( 8/yÏsÏ/:væbxïîù ‰.a}jêÍ72ŠÄaóÚ¼Ùùy?6eä=KsQél='cû¤qc¶ïÙÏÐX.ª¢Þå” Ûûï¾ã·oM¤-{eË cxî˲cgºtÌÍÍݸq£Ùl&["ñ<ïãã3cÆ FWÅi·ƒgðìóÁÃ=*³»8MyþÝý'Ïæ”ju:G¯XN&S+ bΘ•n1‰é™íÜ{æÀºÌÓ{8µLÂ_ˆíܘø¥VDMx%ó\üÎý'w­xæï¬|GkyµÖJË_­í2{ÆÂóC£ÊŽÿçÝ/b^û=?%noÜùê¿_OÞ²ú‹5Û0'“«•²F;B¬Z­f@*+›üÓGL“RRK>½u™îäW±/ì%¹Šš›å¬ñ”Kìü½[]·yßöŸþSqö›N0¨ô¯7žø:å‹Ã©)Ç÷:•º{éÌÛ×}»ñü2oAaØlCqÚ_nÏ((›nS³mÇŽj3`³nÍï%æ åÔ8x0¿¾n UViƒñFT©N0fäˆç6ìùWŽKÉ wP¿[÷ôS F#E7 pw\9Eý¸î×ÀŸÌé¬Á|ã&¦˜ÿ”+¦üoo?Ÿ¤¤¤5kÖHK(ïšL¦¨¨¨gŸ}VôƒkoÜ ?ÛphÛ/Kßž¹‡žÑ·G÷ž±CF¿óåÏõÆ+¦y¿åÇ¿Ë­_úï7ÞV€1¶êÿêô~f¡¹A 0\»²PçöÊ'‹8ŒqØ°é}C½ù&fÅ›-¡SÿôúHc8óéœÂ®Ó¿|a$Æ ئï+o?½ïÏÝFáú÷θÀåß¼©Œ16÷©ñý+v¼ž¢…– ¼Ù}Ö+SÈóú…¨Tjs >üîÏþ#GMêíKÎìõÌûô±üyø¤ðз^ùºx‘˜®Êz£Ù"€®>wãÏq ÖíäÞh›¿ôkgåÍ-œd0Œ>,léÚr ˆ#c#Œqo;®ÒÖ>\BªÜ^ÛôI…ª¨·@ßZ=ŸÒðßfº)šâL`ŒähEþÁÅö½xñâÎ;¥€(bY¯^½ÆŽÛÂÅ·]0ƒté=¬Kïafƒ¶®®îrÖ¹M«>]úúÂ"…ëO󇋧žÊ¬kï!]D>Ò9* YŽ7ï8H2½÷ÙO%V´Ö:;ÇU6ÎRËbÃ}0b`ÿÞ’^=‚”J¨Ñç®{ÐâĽ£«ï÷ ¾ñÖ!Q!ŠÆð'ˆŒŠ2Ø]|ÉÚÜ¡E0 6Ñ]™F—5AÀ1 @]a^EZÙ&W»ÿ5A!cÖÕ°ýóõzï?0îïß~9v:å|깳ɵ6˜¦ªSéløÔP›ÆGÃ`¯qs²Q·aጧOž¸EƽýÜc†Ù•“ÓI>{å’7³ì?ïÒbÒ”ÁÝ)©Óê¾}jÜ4Ï9þC®é⸗Æ?úhIIɪU«Ä•VL{ ¾¾¾>úh»Ä5 !ÈK‹ûü¿Ë2µ2¥•ƒ³{Tìˆ%«÷ü0ÓmÍÛëDTA<`€æ›Œˆi ƒ0/a{1RpBˆchò F€Ah:“0ZPM /H¹ !Hü·ÚV”es¼´\Å,Ýz6åR^FFFFFÆ… .^.ÌøýcG|?+jØô×ÿÚ6 ÷¨Ÿ]ŒÞ£¸Î‚€áF6Ý+Fnö7 „0Æ=6Þ÷ƒÛ*Ì"ÃGa̬ŒÖd¯ýrõºŸyž­%(ÀÝÓB¨¼®áÝ #Þbò¤ù?À±r½á™w–}ðÞå˗׬YÃq©¥ Ž?“ÉóôÓO·ûú Š³Î}øÞ¿í½Ø4÷!ÉÞÍ äœ8¥€h/;¤ËÛ“Yßd½ƒìÄDc®R{ÕÑ~®láŽCzh´ˆá†œ²2NZVÒÕCF¹Ç'eëu‚è€q:)ÅÝÑ_É¡&½ c -.Ö›µfÄrÚô„óÄh@TÝÄ32Vî꯺aë£K'—:]™µ­­k£¸üµü“¿OçàÌ?o(xûóÕ§âö}üæ‹1¾V†b`PØ÷‰bR~<§‡Æ¼ä¨º¦¬¼^Ûf-c^Æ¢æð†`ØÌiÎÿÏÞu‡GQ}ísg¶eÓ{H ÍÐ Hï%4é½w¢ÒEŠH)JQŠ€ "bè½C€@ ”@! é}ûN¹ß³;™D>šÜ÷áÑÍìl»s潧›¼•“›Ðƒ[/ÜM¡”RA„7¯9uƒßí_gl8Š(„zrmËŠ-ZuTQ P;ïí¾¥ÖPûݼ9FdÍhC”'Mõ½  tïðš Q¼[ϯaÏLb{¦¤Mé×îÊÙã;ö_þŽÙ8uâæ?õX…x”2µ…+IGzî(p³“Q4¨í¼»o´±G›3é B±šßÍÈÒá—–4„B&›·dÙpuÃBƒÉ*~˜¢ƒ -´ÏÚ°fõîÝ»¥ ˆîU½ogΞå7~å^ÑÎ*…€Œ,3ÎôÓæm`ýúõ‚r'JÇq+VìÔ©Óû2û cŒ\BÚÒ»×È~-j»yx¨2ƨÍÈÑFô½°oË’dòûŸkÚõžòa•*ž®vE:ª]dÇ?ÛGK”8ÁMn[±Ëú9‡}·4 Þ˜”™ß±Ë„!>¨òY‹…ß|<àïÍõí˜ìÛiʉŸ5™ÿÍîÑ㽶­›;z¼37ÆàèmÌMuŽ¨¨…Òñÿ±U0ÆçϺ؜¤– E2ê¸([=8³s¯_¥J•jÔ¨AØ¡ à¿Œ6ZÆbååÙ òZFâ?ЛM_è½Æì9]90`ëÖ­<(5åa˜°°°>}ú¼‰Žûon茅‹ù—/]~”’©52¶Žn~þþµêÕ¶£0ÎO{ó  ióÚ2#é2î:y­ÀˆÂ·[«:ûiÕ¬Îþ%ÞcDQ~ë̉k ¬Â©e›Æ+§ØŸ¢:uìo9Ä_8…ý>¨âë.lcæÛ×®Þº÷@ÇÐ~AM;ʲàß¹}=®À~Áá­šÕ¼~î|p­W[ãôaÝË}´gî¡¿¤åÜ}‚›·l꤀§ò|qêk ùê¦> 0CQvÌ8ïÐfA®c@˜½}æf|’Tþ!¡ÍÕ”aÌcXsöÈÑÉÙ6Î^M[„xá¿·í.TöéÑJ yrïü•›)Ù7ß † d%ÆÚûVò²EÇHÜÝ{[»7ú.Çf¾X´h4#™Òt6iìèªU«’`Bp/Ÿ kT Ž È.ÑõÁÌyÕ¡ºõê9sæèÑ£ò’c.1Æ^^^Æ “Ëåo¢'Äœª……ð] f(ùý­=Øê>²ß¶Ûk»‡Oü0¼Ñ×GìbS{–Ô\÷Í ï±témfleФtiÓ\ç;ðèîy”5N!tuG`U²¤‹iÕÿY .š>¬ÇÎÌ*¬*}‹ûŸˆœxÈò%%9·BPüY—êïSb¹$—JzÑ«ˆßO¡¿52@-?È42Ó¨j•ÚvøÞä¿]ò,}“Cp»{6ü}A×VúIý]•ìé}[£³<6n·°B%>ùéOD’#ÿ´’<dz%¦bh²ÔO“*ýYèY±Õ’¯}öãß•ò+¾¤ø ’3fÄ°9·®_=±ª®»(K^jy¯Ç1Ë/xzzx 8ÐÖÖ–p!¸—²¢Â‚ûK¦ ’ ±pgëŒæå.Û–­HNNÞ½{·´{¥¢R©†jkk[vÍ €0  +ÿmµõÇmû¯èY÷Šµþ:¶ Y]Ÿ’ÅQc@JŸµÿsÛúûvšxYµˆǾZ= 4¾‚®MûW­åPö¤c<ëë…ózÇV)ºj+§)a—ŨK Ãí„“—nººêÙ³'a7b¢þ?P#„Â+‡ÜôÎk7¡kt½86…ØøóÏùùùRvš¦…)oTæþóÁÏÖŸlÉÎ-AgÂX¼\(ÌuG¥(òu)·<¶ä'—±E”«+·îÄh9ÈшyVWèŽÙ2Ý­N—^m[·nÓ¦ á¸÷o;MD$¬o.ÜaŸ2±/ § pÛï68ÚÛ?q"77·”iÀ0L‹-„¦e»—õ‡S%»Y“ìKmP¥›šY¼j¯…Š„j`åвt“‹ÒU?<4aÀÜ]w‹]¼¢`¡MZJÂýèË—=zDØÜÿ®\uØþ]¨“J°€…×´êÙ³çéÓ§¯]»&´ -S†a"""7n,V/”m™{Ê)&z½Ð3Î+yæ«ø§žù5ÊêZ‹Î¸yS&Æu’Q¨—n¨Î õ™½,Æûöí3¤ÂÜ‹Ú§6®êåhâ%ٹ®3KÖþ”}æÌ™RI!c??¿ÈÈHb)¼!CuäóãܬڪÀ}èÇP»Ÿ\›—_EB „à^H˜Î?çrx³§JfÉ3À{ÒŒ3wEùyyíÙ³‡eYQqÛóvéÒEìÍK„Œàµª~~~ìÀ™—òŒÒ… ýæ­¹u÷Þõëׯ_¿Nú›‚ûv3süèÝÆV²KÁÂ<.àpLDφMšÅÄĤ¤¤Hº“[ú µmÛÖÛÛ[m xÍހϦN^ꈼ æQm;𺙢éC‡¥¥¥‘Í•ÜóÄè›ÿ}]Å,;ú#mÏFÍFNÒiµ{÷î-UÅó|:uêׯÿžT›¼Ç¶*|üõ²Ïïé²T÷#J u1%ݹu‹e˜èèègµ ã´Œ Ïã¿ÚÒƒU€ruƇ‘ãÚ4n¸mÛ¶§mggç¶mÛBY›¼#¶jÓõ*N]›­‘`´÷¶÷¸vØÈñ×®^½{÷.EBp϶OûqUMÍc±8Â=@K¾[tñâÅœœé,áU­[·¶··—ê€/óé’-ˆh<—ãZôtÛ³ZqÏ.„ãÏ}àèßÙÚÙïÚµK¯×“v#„àJ‹NvAу_–5ô²³æâ#Œñî ÓÿvìÓétçÏŸ/n–10 S­Zµ°°°W7 $­ —à¹ÛpŸÏ•Fb ˆB[Úø8È[&Ä?Náyþĉ@&F‚+åݘ5vøWÞðßÆ€dWoþa³Ç‹&ây^­VwïÞ^K~)Bº‚ÄQƒ?Ë,2‘$x¾Ëþ7ç‹\Gà9d© ^ IDAT]˜ÁÓ}=ŠC ¡0©l”k‚C]¸ãyy¿»½µ FÜÓãÂÖýuš¢óçÏ 5§Ò— 0@.—¿"³Š9F{㮉åŸy S©Œÿù÷ƒi:ä‘8Ó˜Ãó<˲gÎœ!iq„à,ÄÁ°Ü¥ß6$çYlm±ƒ8–™ ñž>rèÖ­[mll¤[¨Öëííý*Ÿ,n€É ×¥BE!@Ì=°&ƒÎ`KÅ&S‚ÒrÛ¶y³¨ uu,+:p)Šä`:rð€­­m\\\BB‰6”k‚ÓÖ´šB÷+„€ÖI¼>É°rçž»wn–z¡^¯ïÔ©“\.AzÚI‡Á¨]5­wˆ¯‡³»Ï€+Ì´Rm£þñ£êS&­àíåîÕ°ÿ(=Ø“€°›e*[»É³/h,÷„ãANÊz™qÉ™YJ¥rçÎbF:Y´òHp¢áøq÷¤šB€‘0JNofr›ö¯ÍKaŒY–mÙ²¥§§§XÉ𯌆Òëõ999â[!À¡¸M£gl{°õºÖ¤M¯øøXr‘ä§>Út2ïbF¾&7Á/~EÄ´ˆB@HŽ ¤• í»tKŽª˜ò€…åå·nÄÊd2³Ù|öìY LåÙDEÌæïÆibÖn…Áá\¶vßáׯ_c‚”¨ÕêæÍ›ÿÓlS1 !*ë¬,Œ XLµðàÞ]N'ÕÝ0Ænnn¡¡¡ðÏ9½E=|øpóæÍ>d†ã8øàƒbbbhš-Œ”N*eìý»Á1¹É¹f3°FSZF‘ðî·î¦)UvŽND ž-À°ø×G“5H˜9\Çžöx| ärùøgN¿&(ÜáÃGk 6¥…}”T×X]¿~ýΟ;GÓ´´a/ÏóÕªUS«ÕÏwjLš4©qãÆâŸÕ«W?|øp©˜=Bàªb1gÉ–DŤÖ<Ž7²²³K [ (J(;I'Bé^Š16 K–,‘Ëå‚«V«ûí7__ߧ¾`Œ+vþb×ìFßÏÓ±ÏD·È™ZV—Q só×%ô»)ý»8jíΉ˜ãHýÁÓ&ª “ ¥RÑ1‹Ã˜wPÔÑ•>wü˜J¥’ÉdQQQ@z@”+‚‚ZŽ?±;@I[}´GÒK~X}âÄñR­AÌfsÿþýKí„Ò®pZ­výúõ_ýuóæÍOœ81dÈ[[ÛèèèÐÐЧã­kâСöZÿøO§ÄßKXÕ#biwÇmë9»ênvŽ¼;°ïöi‘¸°ví"ÏcÑ´“¶×´¢Å8â¢äo_Ê×èQ¿páY®wopªÖý{÷ê<Ûâ½:3ëÛ©oaAÁ;wT*•´¿›———¿¿¿t$´?ÒÆïÝ»×·oßQ£F OÍž={̘1»=cóÄ’“ÌiiÊÅ_c??4}ääÕ>Ú­q,Z®ÒjáÇuˆçaòdL¨ÿŒ>]"‡Îuí¹ÅÎí ·m}­kÓ†Ç%$$Ô­[W¡Pˆj¹ 8á2ÿ4oö2…T{ÈÑÎm{lØ°A:êT8?44Tˆ¨JÙÍl6çååõèÑcÚ´i‹/IšH@@@@@À?ÊBÞÞ0gŽ¥ñ«s!à€ììà“Oxžˆ$Áó…9tôôŒÍ“½ìUâàZW¡M62õäJLLÔjµÎÎΤ~«¼˜¨¹mƱcöö6Â(¡±e”ÙÑÞÕS§Ó‰#,_‚¢ÂÃÃK½Ã‰'–,Yò÷ß_¤! „Ëb)¨®Ád›Œ`æäÉ“„ÝÊ‘‰:{þµ5UÀââiž,ëÔR%/%<χ……yxxTŠ¢†ùöÛoe2Ù„ Kq™4oþɹûÔè)éK„‡Ï;ÿíj–¬æ§¸ Y wóÞÄÐ>rG¾Ø"UpsÉ­X³Pë¨*NÒô6ä]/(°S« Å7"##U*Y®²¯Á™YNõè–¯ƒ\R€/çèºO™yïÎ](åy>""B`ƒÁ°cÇŽ#FôêÕkÖ¬YöööRR+sw¢ ‡â ×Nœ4´gãFš´h3~ö²ÛIO8ŒcÌjŒïÖnÔïˆfu¾VÍ3ÙYYZ#Q_D‰›±pé¾T“ÔORÇQžrí‚àoÁ_ºt H¾Hy ¸ÔôŒöE€+ƒÂ{XçðÐ>LIÏó...þþþ°bÅŠõë×+Š-[¶T­ZUÒ—éB?µÙ•SµéÜó åÓ©k·Ž­>,¸òsõ*׎JÈh™L¦ Ÿ²[KþYüCIköéÕ+Þ3ø};w˜µõ¸U¡-¶ýÅ÷>Ëè/>(žTÚÞ.+]”1ÆA•«ð~Ï‹Ò[A-sÈ|¨7B2™ìîÝ»@òEʼ‰Š1N¿í˜Î’HËÆy‡%Ýçy^(¨ÛövêÔI«ÕvíÚuõêÕ•+WFO™“eXbBE'ç¾åxï96ÌlfÉü|ÞGcƒ{¼zðÍ ¶6v3Wì€ÀjP"kËwË‚(ÊzÈÊ×€°C”œ mµ€ÙôôtWÑÊQ!¼ ‰aó<¶¸LÅ·ÇBÛ«â7E`é‚O}˜ð„ÕÔ~_Ù !dïà(oÀ݉¢‹·ô±+³"9µzHÏó¹¹¹= "´R– !ôøö­š<ƒ±\”ô “œ~3.N˜W/H EQƒ!***//ï?þprr*• RÖ];nOÀ<õáÀfÂÒ!C›ÿmosqîCž ç™_X˶^üY3 €Ì™{~Ýy<úظt<ÒæôÆ(>j_9b–}<µí¬/L±G¶E)b•Õ#šîÓÅY-Ã!¬¹tôØ¡gÓr5r[×:Z÷îÞR¡/\;wŽ–GwþúiŠ&uá“®ýýãïq^ßÞMà(mVÜœëGÍú&¬‚mü¾ ϘÖ.èõËÒ¥‰fׯæM³Ⱦwq×¾ƒ·Óö[wìÕ¡ây ¨¬{Ñ{÷¼qÿ –ÛÕlÔzp¯ö64¼×™†‚Lª”Š¤€ZLüA9æŹ"5ìe¹ã©*•8Îd2™‰WfMTag;úóªG%ÍŒS•¶U>ø 7'‡¢(a³^¯?qâ„^¯ïիׂ Ê»ÂPµq%ŽewÌœ—”%ÜLGψ#±GÂmm€g¢Oüµûh< (˜Ü­óè¹?˜ÕnŽ8ëÓaý—®ÛtàäU€;ó玵S{üß6ïjµhhš¾wïÇqÄ W658›²óò•¹OîJÀ–È€ÎÌVìuòÔ)1òÆ÷ïßoÛ¶m¯^½üüü <Œ=}Jî ìÖþ«Æ\˜øó­Om÷ôôü ¢õ”©Së9SM!š–Ëh .íøvÇÕÔy¿œ™Y ú\ßmô—´ð¦¶|Þ7*iâ7ªÆÕ¯Ð`о‹«¦ôBL^Ô‘c>õÆŸØ=óU§|ôÓÁ?¸jvh­¤–xT«×¶y} (Z.£%_ŽzŽÈ”Žš‹ñì›w>UMš6×èÖçÊ…ÕÐñ‡Ùc¿žµµ÷G!ñ›îfsoŸìæ \˜çÀa3ç̸P6ôlߦÎ`èê ˆC€,JxKG>ñqJ€§Æ8//¯  ÀÍÍ0KÔà„›aßÁC#œÀ”5JˆÍˆÂ‚'%QŲltt´ÉdêׯŸ­­m¥J• Üä* YÉñ‡Díß¿ß_ß|’‡aŒ‡¯8ú9“G5«VpïTû*¶A o=ΣŒxô÷#´Cƒ~‘•„… oÕÊÓA%6²0êaì j+‹z…6¤MfÙ¹­Þ}öòÁù欴”[1—Óó1 eV3ñ>H/@Aã\NB€žre¶Ük%«ä(n:Àk‰ÒR´#•;¹oÏãq™˘LF£^ëR½ úWï ô ̳rŸpwËMT€Töç¿êÝÅÊYsf³)+'7tÌ—f<?kèn7{ÇŠµZmøq±—~ïËá„+5ó›ïŽw¯Û­²¬cw%ågÌc8NFQ …âÈ‘#µk×&ù…eÖDÕžÞ‡<–û#DÑl£¶ÅŒ!DÓ´à†3™L;w†rVGãÖƒf>4³ø˜)û‹O'ÝvnýÇü€±L®°“ÉÕ¶Žã—8y=äø¯g5ïn=U.—É‘6Óª9€I‹¥EfÖí¤ä§š RzE¶¿Qà?çóoê„V ªµbÜ7'øçÒB˜eXÌKïoʪ)””&Ó¸(#gÛ3d ï¿ö™YpöäÉ+Ñ—vþú‹oÐ…kÉk(ÞëHªaÕCÏ(”"_#„×ÁùùfF¦R"„ óóó ¹”AUcfm³Ó€¢,·4` ñª<›`Ÿ ÒÓ0ÆŽŽŽ>>>åi©±5ÕBä¥-Ê}rà—Í×sx±¡;E!Ú’“YäVµg=]Q#€}´ãZ‘…ÄpjüC½Aþ/î{”›ž|ÿJâÜ£'ÆôëR7¼š“½27+SªžWÂ-Ï@fÜU½ùÙep^a•ý¼ùM?5ÓäKQ½zv9›ujóªé³–ëNMÛ}ôéÜEn_W6íÊ}÷¾—&ª­J•\°x]€ðä ÇZT™ìòåË@2~ËÁ —óÀ-]iÀbõ'Ÿ-³žI[7Œ±»»»^n€$ÿµÜïÔŸ/þÂ'ïRŸ¶­~ü㔑æêþuÍ[wQ¶[<ª0œÈAýGfÌi3'Ì5è>™ôI¶Æôo‡å6vŽÞ²ý? d'WùfËæd€9£·|%'— ú[×ÏA¥½¹í£QËA®B%ÞMài÷ƒºµ¼±~ü‚-Ç9ûúÄÉcöŸdÔð`r/­ýqÑü•û€Ù¼~cz–¢Y¤«•ÑßoÕ26Ä' ÐÄI7}>Íš…s(ŠÊÍÍ’ñ[ÆN¸œ‡ìoê¦ÑAp&C×£oÿÔÔTT\q'†Þ—­û ¼-ÆrßÖçÎl©æÊ|;©—“B¡°ï0êk¹o½®òsP` œ\=½\Õ`Þóäò±ù1Ûr¥Ÿ6¬ssW'N&hËÈÍÇ×NQ<'[aëäãé„ró 1bì½Íƒ=ýƒý½+Lû[;é“1(ñPõÉCÛ…]^=²J«!–ÿ°cßö¿ìäoçìÐéÛ‹Ö¶ªì§”#PØ;ùúxÊŠÕr˜¸òç!-ªošÝW.“9·y"op<ù€3@Ûñ‹‡´ ݹh˜B&W¨œ~>›õéž›Ý\,ù¿e㞩ܨù]=WœAÈ‘5²=XǧæææjµZ¢Ä½+Ž¡×ÅÆôY“sqÖ:q¾‰-ò^¾=ñÞiƒr†aFŒñΦD®_¿~ðàÁJ¥cKªK©:ÿ×î¸Öš’š‘“σÌÕËÛ×ËC)§0ØhÔsXn«Vf&ç.ŽÔÃIrÇ a•åMÚØ5µês °^£•Ù¨Ö<–1Ì`§fúð™“ÒrìÝ}C*ú)ÀtçæM“Ì%¬z°Ì˜ãÖ}°s«D#Ä‹îÇ?(b¨€àÊ^ζ:­Vi£–Ñk2Ìœ­-eÍm„pÉR2ò”v.!•ƒÕ2k#o~ò8)-;ŸVÚù»9¨¬…e¡íÆøô¹sY#›õò±åá±Æ4Õ¦v½]LF#BH©T2ÄËË‹(qÿ9^[!”›—Zøñw7Ç3<²33ÄþHǹ¹¹¹¸¸¼û«c2™ê5h¼rÙ¢-[•à£×u·ˆ-Cd6¾A•|ƒ¤êFa@*[áе¿¾ë1c×OÇ{׫ÏíJËÏþèƒ6ÆHmoV?>ÆX&WÙËůLyTò ¨dýÊjÖ³ð”ʹf½ëi˜V9T«QGü¶vvÂ2¥Ê^ Ò©˜òòñò‡R+ƒ‘Â'¨²OP©ãe'®èåé•èà‰PñÀÀ;ù“Øvéi2@§Óåçç{zz‚+;‡1.Òêü™BKƒpûò¼Þ?Tn2J¯4ÆØÕÕUèƒôŽƒ5?hÐæ—£q,˶iÛîµ×ZHgä”Þ/Jº¾0@Ë~Ÿ´ÿãÊ´^ NuïfoJÛ³ï×gŒ€ÒÓvJišÿø×óN“|©ç¼žõú§Þ=óýß_O\oo­whc…ëƒ1F ªP£ã ã'OžT«V H?ª²äƒ3 ¼ °x[bÀø±žáY¶Ô™žžžï²§Œ¢(ÚR|#3›ôÍLÞwÛ0wÖ4iÃáÿÀ•`_qË®½;7}ߪAͺͻnÜy jÿ*7Ì7Ï[†£­Ií,q*"à¡•;”–!”ZÓ4}çÎÂneJƒNS¨ÔkÚšð„P:ƒí\±¤?’ðÀËËëMl­EEE“’(I½ÑKiU(55õv\œ\©ÐiŠ3+“A­ÖÝ¢Ã_ÎûbîÁ™ø¶]?€€Ü±Bƒ¦J±±8чà­Aîîɤc@èÍ£Hg´æIº«³ÐO)++KtÈŽ++W”¯Ô‚ÚVì‘óÈrGglÍuŸ7”¹q㆓wò*V®òŠ³xu¼Ç†Ã7 žc|4ÖlžÃõÚv»qÖîóÿ}ýåìÏlÔ¶oy~Þçè­CT•EŠâvÕ¸¥‹bzVfCª:æ8ÁHMMõóó#§ì\Qn¶æ,Á` Xlì„)¥¢§R©Þ„˜ç«6é^µfmŽ{U6Á`mÆÏa„kÆ5>lýäQà¨)Ÿ/÷™‡—÷+Ë®Dñ²F ¤ª+}ü>-vŠùÄ¥²2„ˆ¬ô3^Eƒó©È,š& RP”¦8ìÀó|rr²ŸŸÑàþ[¼ÎJ†'í´õ„ ËÀ¨ííyž/uårù›J.ã9žÌ¿Ò?ž,¼‰•®=‰çÁË?¸v¿¹Ã'ÍlWûcÌ™ F«7ò<kWr!ÊsŒ¦¨Hk0aŒ1æ z¦$ Fs1»ñœA¯Óhµ&3‡1FÅ̉1`ƒVS¤Ñ2,û‚ìöT£`‚pss}hà÷€(!8=kMe§(*//¨×e‹à%¨eT±„d*(©Œ0 S¥J•÷t±,]\ZŒ]‰»s›zðävÒ“ J7a°cÁ7ã öÞi€INˆ»›Vqá’  Õà¢ìä=VO8uQᶷÃÊÀš%ÄßNÈÒúsÌ€æ®*Á Š‚[w»÷@Ž Gcx‘ŠPá·ìY1èÀSkg©1²JÃÝÍõ„™[ WÓÓó<¦­™:@©e@ƒõ—' ÷läÒñ( QÙËh™”Άy›Ö[f³Rèîå“nÞ¼Åõë×¥sZ_Š5g•¡ÁhËé;‚Ñj¡¥¤ßŒ£""8@ÅóØy-%LTñžôððrâëf"Þ Ó´:½¶H¯-Òk ZA÷ ÿ´E,à ël*…’Z1q¸>þhD½:Bº“B¡ˆ]·nÃ0<Ï¿¬¡ÊVoYMuþ«}E€F˜7‹¾\§ñ`_àK,U¢ª èòž¨"ÿð@qxʹwÿf‹~ÿÄœ\´p…‰§õ…ú¡E‚cÍP}ò$ßÏšî9~·FŸ°ßg/íÒç'uIZFØLÙ·Ý´nùÓÂ_FæÙ²zí Ñ›2¹^øàom}jW®Šáñ³\“†K‰¼SXE ;Þ I ëÙòŒe£>»¯}ßú³ûY’Êu€ÐÅÁ˜l©ÓY€c™QØ Þ?\^~¾kIåŒÃ@•tÀ N«÷j¯¦2ž$\7g`¯N,ki®[ª3 °,ëîîÞ·oß*Uª<Ç·ˆ1´<ëQjfZZZ®`Eº’ç æÿFØ÷7“~`ñmç¶áô³ßã)^Ê¡9}rë´¸û·æoûs‡OªUÿihŸ·o*Ê1á  öâñ˜»‰«r+O IDAT¥?!(|üùô~¡ÕŽÌ‹<ýH„ºˆrœl£¶a¸ àKµ>`Yö« Þ‚ÓŒê’Gx H¢ÂYƃ«TïÑêÈÊê½êTõ¥(™”ÚÄ ªÐØ××wàÀÁÁÁÏœxiíÕž2Ú/yߟëvýSsÔ—.ðL9lX•„Û—bš Œ0Æõí¹~ÛùRg"€ï§õ½ÂÖøùè…îŽ)ŸÍZ¤a¡œ}¹89iXNºE©³ ŒFã¿*õïÁé Fµ¬ÄèKÑt);ÎÖÖömþ¼—3Dž¢iºFxX©VRã8. `Ô¨QNNNϱ”%$Vb&ƒe#°JÝ?hRI¾rûÂFUw>‹ç‹«¦øçöFÂóâwë7oâö¯¿Šáë.ägù¾ý ÚWõÉÛZ8>?bÔÍ””Œ‡·¦ôxÏàÜzØ`˦•[”þ$“A(vӌϷ$ÌX½)ÀÉiå¡?³.^»?¶œÛ_r…‚Ã¥.0F’7Š¢Á•œ³£}¾¹È৮®L&{›?/$$ä%£_¾|¹N:OUŠ¢rrrâãã‹ŠŠB<Ïׯ_¿S§N¯B¦6¾´i›ï¥PØxŽÞë×#÷z}3FxÖ-$¢5ªM)Cµ|#…m݆Mت‚½[©ÁðÚÇ£Ú, wöMšµtw(a ”צC‡¿ú~}÷Æ t¬¬ZÛ®KÏî P·Ó8›Å;š}xlçí3Ç“ÌÃ6þ=.Âó¼]P›oZ´ûÈAcתr|çè4]B?`uGëvˆ‰ú{™^W>Ú„ÄŸ…, ·Î’(¢cùa8´z›H,¹Æݺu k›ÿKˆBhÆ T*•OÜíÛ·£¢¢ôz½Ùlîرc“&MàÕÜɘcÌ,/S(i€1DZ Ë+TJ 0âX3Ë#…\†ÆÌcJ!ŒyÆñf†D+ä2ÀfÌ ¢er-T9˜Í -“ˤ÷¤ð½{÷f%šÎžÃ*Y«6ª1(7à5« 'réYjOwnèPê×mr–ÁèÎ.4”¹sWQ­*å×P­W«F´ý}$WˆúÛ_yðW½þÞÅrœ‡ fooOˆæ½×à\œœòL%74Ž+Íž4M¿ÍŸWªŽâÿõÂg¾V˜Z-—Ëûöí[­ZµWFƒh¹’.&WZ&§eÅ&--SЇàs߈Rˆ' „)¬- ¸/Í×BŒeË`Ù2¹³³lÕj¤Õâ­›‘·7ž:üý©jÕÔ>|IÙ–ÉdÄD-;G©í…º8Õƒ­ ñzT[3›ÍohâÌó·Ýâ‡äš¼šÇð<åÓV ‡Šè Ÿ ÒÒ²‹—)‚ëmT”M1‰ å\”…QñìgÁD}Û×!ÖTtîÌeƒ™#BGð*BŽÊÉÉUfXÍZOÝÊ7{ººðíèèør&ªt˜®F£1bÄÈ‘#6lظqã&Mš´k×NˆÊ üš¸g~Ýñ;Wo:\ËÍ´rî„GEÍ›>_¶oÕÊÝ ããñcçmÛ0õCT¾ç§ü¿vñ¤›W+«å⟀ÁàìiÄ ()BBÉ(#‡Â"j„m,dÅk/]!#/ÏÅV Ëd²èèhooï—«ÙBeee•"Ö¸¸8__ß®]»‡ä1T°píÞA_¬Ò¾!,\ºèdÀL©'͘޽y}X9á|·533¦žñ"Hðb[8ËqvYA.™‡ #S3ˆ–vJây^Pß»•‚³^k¤ oìM h {p_¤eºT t:¹\>xðà—þŒ›7o=z”¦iGGG__ß•+W6kÖLA‘ÁTj4v ©*Pºû¹*” ³QVðrRYê†{ëµEùàåD¤à…Ô·¼Â"ÏÄ»ðX"T˜H–9(KŽ(ÂW¨P,Z™"8Aœ›tмbg«Ì>Œ±¯ìty[¦[Fžç_:2 `Ê”)5jÔhÞ¼y u €ϲ6Ú¤´wùýì4o º" cÎhÖh ‚Ïí~RRA«ÉH‚Öàþر­žS‰ ‹P´ÜãC¥‚—%<Ï‹“$ þCP¯W YóææòV¶Á!%æ| yØJ‚ 䧧¿ô§Œ?~ñâÅC† ”ÆO¥-vÂn3z…­ùtÆ= €mËfedm.úêûmZ–c5‹·îøpz $ŠJð‚XñÕÿêúØS…®æ3®¾þRvdÒßßHUbÓà0Æ­š5íVHB<æ-Íc”’g<÷@žçóóó}||^òËdÒH¼”Ý$¦2ŒkLÚºäÑGjÕðràÂ>êÞTOÉvpjíz¿Qãj^£î~ts«mM„à_Ä;ñIzS5bh€PðK6´lÞüñƒxJRsMQ”¯¯/\Y"8a-Úe§w·‘ sW4¥ÊMÕ›L*¥R¸äÕ«W¹Ó‹ô ·hq}\¥ÍÀŠ†‚Á“‚ ¬_›~Î÷ôlÕbÔÆJÒx›ày_Þ¹õéCDà_ñ×Ñãs|0°’ýÕÄ0¡M‘T>yžwtt”Ëå$„Z¦NÔÆ›õž4÷ »B˜½ ]Üå3.žoÖ¶=c6cŒ…T7{íOŸFJ3Î9>Þ9¸îжnE‹FŒ€Æ÷©/¿ Öh v-ÐhPBD‚Çó²„XO…t”NÓÆ )ÈË•ŽXãy^˜™ûÞÏ]#÷´n…1vñ÷×;»alZ-Æ5ÝT·ï°­Û 'effj4;;»7xí›5„1T­ 99‚ÜEÚäÜ O=„ÀÁ®_àyDZ>üôzƒçÃëržG´µH‹‚ƒFµR‘•c*5~ApÀõ?Çk¾±…ýÊ;(8ÑÑ!À`þÌ£í Srò…Ë“““ŸŸÿ–4_Dü!ŒqÛÈ!õ\U%\¿EêQ þU°u…ù…—OÒ”d\$Ï@îÎN¥Ô4µZíììL­ œ “{¹8G9……©À¼ôβä[×iZ.Ô¦¦¦¾Á¾IÏœÝ)iÊýpO‚§6¿þú}g5/ pEçÚ “””$Íy«Õj'''¢»•A‚¹£]§È­uˆ¶Ãò±Sà„[&ÖRçpÿþ}²úï>ÄÁ1Û—/jâe ’ŒËd^Ö°i^^EQÒ&"NNN¤QR™%8#ûöþ> ²ÊÆÀÃTWC\B’ ™™™¥Š“ ÞY½=Y• ˆÆ’`]½Þƒ¤$¥57@<îääDù–q‚€!óç'fY:ž"„1Sƒ}Îc¡Œ!77·TU)Á»iŸ@ÔúÕ]=m€Çb“.@pݵJQA¾Ôï1f¦nݺ@R|Ë<Áu0è´ÙF„·UH—Ñ2Œ±J¥:pà‘‚wÜ>€Çéê ûi¥[û"íÊ0ÛT­¥×jK¢É)ûçáé•XÃÀñ`½ØEU,|’™•ISEQZ­–ÈÁ;Îq»öìîbÞ2,!˜Ÿ›Šzvh­×ë¥Æ©Ùln×®Y´rApJ…Â9rP¢ž‰ PÞ½S®T"„8Ž‹‹‹#×€à]6Q&“òÒy‰ÒÀ¨GÚvþyçÖ-Ñ:4;¹\.4€ ÛvÙ'8èйó9Ö^5 “˾rÓ^¼s_¸þééé<ÏC•à¤6‹RfЫ/TË$-|1çêߦmÛK—.‰ù½Â³ÎÎÎB"Ïå‚àBüýnWn ˜ÃVÝs¸Ÿ‡Œ~pCµ•œœl0ˆÃ‚à´L±œ2|H;'°Ö7#ÌãtçкGTTT©P)ƸZµj–žÒDžË<Á ׸ٰñ qV%Qj’r -----í?˜”J@ðsï>õ·Ÿ‹cÀÖþH´TH‡îqqqÒÆ6@Ót`` ¡¶r¤ÁaŒ{¶kåU§@o.îaŽqk•.åÖuš¦•J¥K%Z=Á;hŸnZºpc [Ì l¤„ñ%ß:þžžÂs©ºçèèX¹re²zå…àDÃsÕŽÝûž…}ÂÁšò ô;f†¡(”———žžŽ$uTï‚}šœ–ÞæñŠ¢ÀcŒâ MacfÞ¾[ʯÂq\XXÉï-w&*ÆØÞÕ«ß’,‘ 4Tž{ù•šçùèèh¢Ä¼;ꛥ;ùú5s­Ýð'72Û±s³F$HÙ cÌqÉï-&*BÈÁÎ.³v›l.vX`wW{Ý9›ô$]&“ݾ}[˜xO”8‚wA}Cåæå¥m_êlSì FhsœnñÖ]·oÅêt:ñ¸ÀnU«V†a.G'^ìIŸ|:2ìS!Ìâ-¡ªØ«WxŒM&Óõë×¥þZ‚ÿPƒ€Õ߯øÄ® 8xŠ±‰ã´M[5lÔøêÕkBu½Èq,ËFFFJ” ‚%F­÷úò»“O4‚N‚À³¸¯öÃ0ãøøx“ÉD6@‚ÿœÝBç®]×®›_ÁÅAœi„’ÌȮ〘˜˜ŒŒ iúÛÙÙ•ÚÔ Ê Á —|èàÁß+B€ç¥â( Z(uÑ'ŽªmÔIIIyyyD‰#øÏÙÍhf6/šÿM¨½0Y $'CsœûrôèQ•J%Õõ $$D©Tõ­œœˆÉK×nbÄ–h;Æ•MÓ®ÝM|¤V«7mÚDö@‚ÿœãîÜŒí—|ZÆ#€!DὊÆ,Ysçf,˲Ò[(ÏjР8™—¬a9%8Œq½?|R³5¢Pqa‹¿Q§ÞÏ#J¯×_¼x±ÔÞH@ð6Z‹,{h˜»iWRR’؆ZœžeggרQ#4þ%(¿&*Æxâ ~Ë}Z§äkEÀW³§#Ò®›M¦¼¼¼›7o%Žàí+n¡{Ñ»VÖö²µêg9lÓ²ŸŸßŽ;Dï›–e#""T*•¨Ð”k‚ðÛ®À–&"!ÐXÛ“£ìììN:Åóý·­*–¦"„x² {­ÑöíÛ—••E¶D‚· » ’oûx`{W™àtb E&æ€wƒeß~sðàÁR{1Æ<Ïׯ_ˆµA®4Íy¹¹F.\ûýC’!Œ±%/Î “õñN)Š£G ñx²7¼QQœgcF ûÁ£Ñ2Ú„L¦íùtŸ¯¿7 W®\ªèE"3 ýû÷wpp ìFîÙRÕ²aÄýn“Ϧ •[€1 VËúçÄÄÇÇ'''§¥¥é!x£º›ðß kV¯Ô^–Qr !Œ ÀÉzöq§ñ ë×Û°aƒÐtZ<ŸçùjÕªù$÷ÇóüêåËN51pœ((˜Çým=Ïÿ“t`ÿ~¢¾¼Ñ]!s+.ã‡ÙUÕ4¡—…É>Ó{½hÑùsç²²²Dï›ð*Š¢š6mJ*O Á=÷ƒ) c6vÖþ"™Ø„(£Üy°ÿ~̦$ xí˜ßµÅ\/žB€‰mŸ3ÚO^)ÈË»hº !ƸbÅŠUªT!¥ „àþÅF@uìp¤ù¨èl¢,yG€0LWç>¹“””T*9¢Xd•©5|f±û¯}EEE»ví²±±‘ÕcŒíííûõëG Bp¯¤Á!„œìlglû«ºÈxkZ9¼UÔ"*aÚ´iW¢£IÖÁKX¦Ï/›1uAÞ¹Z®vÖ=aŒ9€oéJ‹~Ýi6›ûí7ƒÁ Te‰ÊB¨]»vööö¢¬’U%÷’>žŸþ²{ò#9…ykü0†šNò¹EW¿Y0ÿaÒcÂn/ÎnQÔOË–„íûÉ߆i 0¦,ËQ4›³ÔËÓóĉIIIbv› ,ËV©R%<<œð!¸×Àq‚P6iܨãÊí«óä–R|AÚ8èæï0âá‘yÓ?•šä<ßï€ÆŽPé—™=*9ˆò"Œvw]S{åžn‘í=zæÌ¥R)Ýk9Ž«X±bß¾}%ݧ Á½¡l×¾=š´ô»Ø"ã,±|:y(;ßØÓ¤]¤´6\E‚$ãy3§OŠÙÔÆËøâÑã`{6ô÷ÙVÍšÞ½{÷âÅ‹»IÕ7{{ûnݺ‘~–„à^³'ˆ×øÃÔó×íI5@1…aŒPÏ@‡ùi‡‡ d–Té>~ëÖ­4M‹®7áÌÂÂÂ=z„„„¼BpoV›0eêú&ãNgh…”%˳Úº+;_ÜÒ©m+i'BBså\q«g–çù)þºµe{̃¤Ìd±†‰‹G—™™¹oß>“É$-›G±,Û³gÏÐÐPb‚{[ñŽU˯ ]¼;Ý(¶ëœr‘þŽKóÎMú¨£FoÒ9š(nÖd£¤'ic;µu}[5'%Æ–5c„ðïOt×zþégŸåççïÞ½[£Ñˆ¯æU«V­W¯Éz#÷ö¤öÓO?y2òÛm4H.Š#`–¯â šòäøäÖ rŠ´$¸Ükp€JÏÎYÓ·ý—šènöXU@°)Åhœ½qîœÙyyy›7oÎÈÈ iZ:ùˆã¸àààÞ½{+ R’Eî-Z¬Oþä“s½fÿfDÅù!®h§üEÔ³’güýûBC9ÂqåÐ2ŒùÔ””¡ø~M?ò–Ó,=,…f!Ç pʘŃÉËËÛ´iS~~¾L&“bŒ]]],âz#÷Ö$X¿µ‹¾Ž±hi:B2Æ‚ @c8ŠþêÓlù«HCù´L`ݺu¿w?J+dE‰Ò,Çù@›<õ§¹ŸNÉÌÌܾ}»´¥Xê`oo?|øpÑÿK–Ü[Ôà¬L÷ٔɪõŽÑRt)k”šæ¬­¼qÚ¸'‰9”ÝMLÁ3sV…&Mqg1%“8j1 ˜ùDÖsÿáûgddlÞ¼9;;[ÔÝÀZK¯P(&L˜ààà$¹’ÜHsã ãÇõݸ·Ï]ÎÄa°B¨“»b̹Ç÷í‘“ Pì]&—¹¬Z¦¡Üüün-› >ømWoDQÖúeŒbxnhºcç-‡ÃÃÃSSS7nܨÓé¤1S!Þêää4iÒ$)ë‘&÷pœ »Ý»v°î÷Ñ9ηµ ’Ç<®éb39~Ïöþ­·þÄO\FyMd·Ÿݶ¾SÄ:Ãå*nö˜i ‚˜Œ¢EÍ>Ùu¸YȘ˜˜_~ùÅl6—°Àó¼££ã Aƒ„Zz¢»‚ûïå[ ¬.;Nøù÷ÞYnG3MÒ9Œ¡²³ýD&Q1³ÇâÅKÄܲiVGû.]m›¥Êt·Q!T‹ÁJád¿ºfß™Ûö…‡~péÒ¥¨¨(ŽãJ•÷ å S¦Lqww—æÁ‘E&÷ߪ㈈ˆm{£–º7ÚšnÄc, ¡>¾ªÖN›Þ½ÃÄG¤–°l(n¢ \¹qsz—ÖKÓõñD¸Xµ„€çÙ™°ªÝÌÛvà#GŽkÖ¬n¸‹Ý0‚;7â¸âââ;¾õ­«nûÎJµö¿FŠRó$8ÆáclªÇþ¦ÜòðÒšÍO=ñ7}®ä¤éü1OüfÓã·å“çsúªÝ‚åžÌJÙ&Ÿò›%_}ûpk–ÓyðàÁ{ï½×\0͘„M&“‹/¾îºë° FpçÒž¢ªêc=ÖrèPèµß>WÉDgFâ8„€AiO þ‰M»õ‘'.]´à,óÊÁ}ª·kßÛ¿úÊõf§Ù.Ã}1E½ñ8¿a×»Õ3gÀæÍ›»ºº2nf)¯®ë7ß|óôéÓÓMÉQpÁAœù[—$éÎ;ï¼zÕªÒ/|ó’ÞÜí)Ê0GÈ™ø€b®‡fÌQÄãñ+®¸âòË/7݇×7aRz8=óÌ3ÝÝÝ¢,¿Þ°gæñÆurhV/ñf¶Ey2GŒM­ñ–鮽gC~匊²’ñ¯†üùßHÛ‰^KóÓwý n¸åú)N <Œ|5údÐ z(Á^tU‘Õëï¾ãvUUÛÛÛ·mÛ¦ª*ÏóÖ¹6ó¯t]ÏÏÏ_¹reUU~eÈà2ò žžž­[·Æb±PBQý¾Á×ÿçç…juŽ s§¶eò$œÔÚhòN{ÉS½ñ—ÿ>¥¤ã¸+vë }ëö¯}>rtæpG•Ì²h½®#OãÙþþØýA×76=W³à¢Â\ï‘#GÞ|óÍþþ~J©µ­©ù—”ÒD"QWW·`Á‚¬¬,´r Î:^xá…C‡1Æ8žßöÚëŸëÙûíIb4Ú›´‹£8¨A¿w4ÎV}åïo»}Þܹãgsp}h°–>(þ½æƒÏlø™þò‹ÍÍr£0ZÓ–~>0 ͸oÐA×|õÁù¹9Éðꫯ¶´´ˆ¢˜ÎI3^\–åµk×–——£ÚóKpãC93èíí•$1WöïÞµ2ڶʫu‰ÀqæI%f¶42N8ÐâÉMƒp$¿jñÍ_›uÉU3¦KÉf8¢Nëý¤¦kkkÞ½sßüëì¸ï‹¹`˲ƒNǚΛm`8Ýx?¬ît–·Í¼ôž*òf½{÷677›nÖœÔ|q³ommíªU«2jDð+@Î#Áe˜(™L¶µµÕ×׫ªÊñü`(¬úŽ½½ë®»üá»~2>ˆ;?G×™D罿°½óòŠhGarhF–(ñŒÍ´¥ŸÏ±W{¢OÇí7?òTõÂ%•å“ÀÎ;»»»£Ñ¨©¶ñÿP<¯­­½êª«ŠŠŠçI‘ó<‚/ ]ן|òÉ¡¡!³×+/Iÿõû— µÞ]lä ,K æ>¯ÌÑÅxÚP~Ðm|öï¾ôå;¾ë.(t»Ý²$ψ'üxËø¤ŠªF£Ñžîÿü冷žÝúäl±Úk:®ƒ‹¹¸,š2‚Dz,æfk¾öÀOÌ‹F£»víÚ»w¯Ã៚Ómàt:¯¾úê .¸ÃgwÆa {öìimmå8ÎápôOvu:N©õY_*yda¤í’å„MÆáë %Þýe3ú§^¨MŸsãõŸ¯ª¬øиfâÝ*à`kÛö·ñ-ïvPÒß6ÇÍf;‚õÒüæ8ÀbÉÇÀ¾äšŠ¿½iÙå+ ³ÝÍÍÍGŽ9vìX*•JWYgì?Ñ4Íét^|ñÅóæÍK/&à0FPpg¥º®÷õõ½ôÒKýýý¢(B JC¡Ð¡ýoÏî~w}±Xã•ÁÈH‚FÊë£4ÊXPeÛ"R‡³Ðqå ‹.¹tÍ—MHÍYï e/¾üJ㞆Äk/ÌÒ‡VØÅ6ÎÉq0®ÆpìŠIp /¶eXv­ùÒ—¿ûÃòÉ“@ccãþýû‡††Æw1²nºRUuÅŠ .t»Ý8û‰ àþè`¤±±q÷îÝñxÜlØ/ð¼BÙŽ]¯‹‡*V§ˆz6’ÈËWéå ÌPÕíCÆýýÜœe—ÝrÇ÷‹'OrääÙŽ,‡œ!ü9'Â4ÊX,©$q%<~ìèoŸx´­áµïѺ<$ €º83öçLÕé°ÆNˆY?p.ûÂ-wÝ}7…BhhhÐuݬk¿Œ`8o·Û‹ŠŠÖ­[gÝRŠjCPpu §“x<ÞÖÖvàÀ#GŽ˜Ó@²,‡ã‰c]=EÑ~Çñƒ¥Áþ;¦;y‘ƒX× ÆBÆ€#À1Dy/ %vijÍPvI[a•‘[tå%Ë–/¼ðC3¾¿ÖE8í{xuÏ[¯íÞc TóûÔöî”27GÌwËÀ¸Ñ~T–+™^‡æY,®>Ý™RfÍŸ¾êF¡fÁ5—.M&•}ûÞêëë;qâD$1·Äe^ÃQµ ‚°hÑ¢ªªªòòòñúCÜ™:::êëëÍSÐÍQG)a ض}ûJº3/5#K8Î2,Ó£ûï1Œå  ²ßõk¿¤RA銵7_RwͤҒlÇåü(ó\é”Ó$†Bá'O¾¹ýÅמ۬øו…’["bÉ"Ù¸ÝlŒ18Ptãh$õhÌÝSZ³a㣟©­Õ4mpp°¾¾¾··÷”Ÿà¸pÌlÀËq\EEÅu×]çp8À²ŽvCPp[DÓÚÚúÆoøýþt7žçm6[ÿpðø‰ÞXKÓg´@žnç¦ÈÌé'fùÌr5!€ RZwD9¦„ëõ”œ”ÜÔÔdM©!œ ‡Âý~¿4pBž,ñ·ÏµkJœ¢}lFO#fltaÂ2}À€1U§}ŠÞ—baU×E›âÈV\ޤͥ 6Ýéa®l#+›¹¼†ÃEmN*JIrÈ"Çq6IA–$IÕT*¥i†aÄU7 M7bjŠ×T^‰sñ‰ùXˆDƒB"nÓâ6%j‹Ùa^W½6¡XäJl‚$ €¤÷t˜ïÈØ¢ÊØEâx¦'µg)'’}I]þÜ…%.3«–èîêlkkëëë4÷½gì·†o”Òd2Y]]=wîÜòòòÜÜ\œeCPpŸ\ÞjŽ´;v˜'Ñ¥wDRJÓã–p|ÇñŽ†?¼<%¼·\\’ÍSÆ7®˜nÄ–šWf:,Ñ‘erkìI£9\Ø`A Qƒ)¢:3$‡@y"‘8°s`vÁ±Òh³n33<ÅV”n¤êoä|Ù±æàV#3ÆÌÍ»%°?Lïõ‹ƒ9eŸxbñEUUÞyçMÓÎ’„¸£Nóòònºé&ǃ^CPpŸt4wJ~GéáÇÛÛÛ»ºº€ é¶<Œ1A$›-0jéìJ„‚UÊ@‘Éôç豧Xëây À,¯ÉF¾Š±}KdÔxÖªëS3ÞÕX¼5úö¡Ÿ+ý¯€åœFÌ÷A,¯ €¦T£9¬¶„™‘Ÿ/TÏ×K§*3.ÌŸ4yþÌ*Oz{{»»»ûûû»»»EQ4KmN3=g)Ö5©¬¬œ:ujeeåäÉ“Qm îSä»X,ÖÕÕÕÐÐà÷ûS©”d–JŒ†$æ6Ó CWÕh$2ÐÕ1ÔÙîÔãK¹ØE²2Å!–ØQF|”žä²„Y%ƒ>ÎÈóAX:|­tá($’joLm‹ÀAÑÙì,u•-»fÍÜÅKsrs /‡‡µíëë‹ÅbŠ¢dQv¦~f*šJ¥rrrjjj-Zäv»Ó× çÚܧÈqé±X¬¹¹y÷îÝæÙtÖ!jíV&‚À󪦣ñ`46èë‰wµ†OöO²±K]l™ ʲ8@ @8b‰ÌÈGóÖÞ²E{#猙½$)€N@¢¢3èŠÓ}q®!i÷¬jîü¹u«ç-Z\ZXàq:MMM~¿?Çb1n8]³ÜŒ6méKÁóü¤I“–/_^ZZÊóüù³¡ AÁ“šË™>ŸÏçóõôô ʲl= =žÍ ‡çyNLJ#Ñ“Aÿ``8/dJ‘È¥Jh¢ž’Ô„MÉ©$o¤ˆ2.‰óˆ¼G 2Pž#2ÏqdB8"!c:e*¥e)ƒ¦ ¦ ÖhDÕÁFG–èÍ— Ê8wŽÊ‰aNì¼3@¤B¯wÚôi•eenWV4 ø{}¾MÓ8Žãy~üZÁ™.…Yꡪ*Çqåååeee………ÕÕÕYYY: € (¸OoX§ëºaÑhtÇŽÇŽÓ4Í”BFúvڴΠ”1F)£Œ`”cÌ,ã¸eô‚‚›‘]GGGOOO[[[4Ç㺮§'éÎÞ;süWcŠÒ„ÂÌ}ë@F&îcÔ<®`”RJ Ã0kVÏš©¢5}ÿN>tþÑúÙ(‡Ãn·—––N›6­¢¢";; nâOÒ™$“IŸÏ …ÌÇP(F9Ž!mœ³gmò—õçÄJ{ ÒQª®ë‚ äææº\®ŠŠŠÜÜÜââb³5›õɦ!(¸óE|ÖÞŠ¢$ ŸÏ×ÔÔÔÑÑ!‚a=¤:{f÷çä}gù[ó›é'!D’¤9sæÔÔÔäääØív³($c+¦¢ î|ñ¬„ÃáÖÖÖ`0˜J¥B¡P"‘H¥R‰DÂ|žÚ7»nüiaÚi7­ 3{I†Áó¼,ËYYY’$Ùl6—Ëåv»EQ,//¯¬¬<Ë"ê AÁ!§ÑÕ †a†a .™L¦R)UUý~¿ßï…BÀqœ9¿fœÚ&Àª¼ŒÿM? „˜©qºQnnnQQQAAÇãEQ’$§Ói³ÙxžO/œ6iE£!(8äOôN+]×UUUEQS‚æò…aé@Ìì^”0‚`³Ùìv»,Ë6›M–å3²ß"(8d‚¥Ì(5dÂÀá%˜ÂÊÈUÏ~ËÙi·[!Fp‚ Á!‚ àAPp‚ (8APp‚ (8A‚  A‡ ‚‚C‡ ‚‚CAÁ!‚ àAPp‚ (8APpx AÁ!‚ àAPp‚ (8A‚  A‚  A‡ ‚‚CAÁ!‚ àAÁ!‚ àAPp‚ (8A‚  A‚  A‡ ‚‚CAÁ!‚ àAPp‚ àAPp‚ (8A‚  A‡  A‡ ‚‚CAÁ!‚ àAPp‚œ§ü?Œ%à3%õIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/inline_mode.png0000644000000000000000000003531613051004444023375 00000000000000‰PNG  IHDR C”V sRGB®ÎébKGDÿÿÿ ½§“ pHYsÄÄ•+tIMEÛrØè> IDATxÚíw|TeÖÇϹeúLz£$$B¯R"*¢(b×µ»kÙ]•µ£k×uQ×µ±®Šºê꺊»®ÝWP,HBIH(¡¥N¿÷>çýãN&“IP0!™IÎ÷ó¾l¼sÛsîóüžsžŠD Ã0]‰MÀ0 Ã0 Ã0 Ã0 Ã0 Ã0 Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0ÌÁaîðÝç“7ü<6Ã$ˆ@ù×üO¦<¸nR±pýÉt<ýúÁ#ÀÊ•à÷sn<¨J¡=w¶7«—n"m\2âÄ€,ÃرpÜqpÙeP\Ÿ-»I1쀆X¶ Âap8Àb¢C07Øí`·²ÜX­àtòG•$ðx@jŇ%lþoÓ³d¹ÕK˜®Y—µÌ‰ p± 3gÂÅCŸ>ÝÈÉè4ûøc¸àдˆ­ ã—øGBü—[ˆ_ò¸Š*€ú™ì^ò—e;D¤C¶"Èò/y–,›ïI^DÑA½´ÅòKRgµrUª Šrh#U«õP¥ÍPÍn·ᡦÎå:dƒ ‚Ëõ3±ÙàÅøë°apõÕpÔQ0t(Ë\”öîd8æXº #â*ªTE¯úe‘ã/ÅÖ.!D|ó½÷&Ò¿°îªÃˆ®ò‰Àç]?äbæóA8,ˆžxãÛÎ=WU”ƒzV(¡Ð/IW pÈWÆ/¹J…>k!@E]ÝV¯žuÔQä÷‚Æ™_J×#Õü¡ä@ŸìgÝ»vî·›Eíp œÃ%%É^{˜oï_ºT0‡ éÔ©“ÚûˆV¯†óÏÿ%ž`WAߺµá7`öìÊÍ/¿ï;gfÂï¿úäåEüvߣÀA×j}ïô´˜/ÐñYVˆÈÿucû)ªsñx`à@?¦O‡ãoVvV†éFÇpÁ_Š‹áöÛaüxèÙ<žx]ã ÃÇ0ÉZÉ ¥¥M¢ô•3Öµðˆ†I.¶?1"g,j,p Ó<8–38†a8†aXà’vœ˜AD”œs˜ÛþÚÉ›ö„ÍNL§Ð5{QË˶êmÁ„ˆ%ÅýBÁÀæM¥mŸÌ̬Դ´ŽI{8Þ±½Òø“äb³…"7¦b[yÛK¸¢Éúž~‘éº^¶u‹Ôó…}ÞúaC‡lݲYü²©5`FÉ€“|¦•‚Üõê¨ÜðÛo6æ-l›ÆIDÐVûH’,kuÞw·Ãáè€>ÿÝw?þò;«ÍÕÆ7—$©-;rY)Ûôã93NùÕçuÌ׿óî{¶ïó»\í2c ‘H´åúêý{†õ¸ýöÛXk؃kj«÷9 ÇÿÍ;ºÄ0± ß¼ô°®…»ÀQ ¨ <í¦´™‰Ps©À‹¶–ÓaOôkÒÈóoq§e&§—$¨ÙQUùÑ£,4,píè•¢…} âu„fN“î€ÂÁ-è!?vàjC$ -Öl‰‘%üÜÇw˜Šzç¢ÎXK !aÒÞô:Ý.ùÑ(•U¦3h6A'~î¤ã<À°Àu‰ åæËr b÷éY“$ìÎ%¼Õ.]îWåµëàõy7mÚdoìE%¢ÌÌÌŒŒŒn¢nÕ55•þ˜U*Ýnw^^^—/á HTWïß¾}»Ïç‹OMMÍÉÉacë"쮪zãÍ7,kTàÜn÷¬Y³TUíòi—eeýºu/½ü’¦5LLKK»òÊ+Ýnw—/ᆮoØ°ñ¥—^ ‡Ãѯ߷oß /¼Ðb±pÑ`ë"1ª$IÑ(µ»5¾˜ºM¾Y¶»‡ÿ‚(¡"ËFÌ×W…àXàºZ´ݾO“ܷбp'Ã0,p Ã0,p Ã0,p Ã0,p Ã0¿ˆîÚ‹J@@€(Ë@„ D4û·PÂèÈssµ$!(ÒÖx‚¹ãh’ž4;QQ+i$`N¯äV’" ‚V~"0 JÆR"Œ|ʸ¯iþ‹Ñ´Ó(!Jˆ˜(’1x¨. \"‚€ªV±jÁçŽÜ‘ùFÈh.ÿû6|¼«¼22W_u¦“_ÒKâD­jãÖ5ËêêÑkôÉi kI“Ñ %¨/_ZQºÈTÝ©}ÆõRhøH·}ó¿úºú¦eˆ„d+wnŠ=Xö͇^Ÿ—DãO"$ÜÇŽXùý¶ÌÜ\ ¬­ò½ûdÞñ÷O>s $«Pþö-Ÿ¾¿Øž’isYÃuÕK_þÓÈßÿûˆÙF8I<8IºÍ_-ÿÏ{©…CU ëªuù?ÏÄéw<žîÒ‚[¿x}GƒÅã´F„ŒÈÓ²†Ÿjm(ý약†ÇcWÍŸH÷J½KŽ8a°JšyG ‚;?}ôšŠ>›;E-èoøêÍ¿M¹ýå>Yvàß³ì‡ÏÖŒªJ(‚»Vð×™‹^¹øÕíýG œ¥ëÄ Ç—heÂÞMË?v3'g烻÷îw䑹šš¡gyåÙ—N’¥¯ßúé—¯×plªS­úæùÏ>øaôåsG3Âj#`l˜ûÏ^”y×»½óœã7#Ž…lëyâ½sÓ ¾bÃòWnüäÑ[N½é!— z Ôÿ²¿O9";uOB^Ðý Õ{ûßøá”aŠN»ÒÁWOfØž¾; ”ÔàŠ¹×îÑŸ|×]EvDí¯]ñÏÙ_<}ÿŒûö`4zl\9:F·i°.« \‚é@¸¶¼¬L=ö²#|Ÿ¯þnÍ þ=‚!SúPèá Z!=3 q?"’ðo^üNþéw1q„¿Ÿå~§ÞéTáI³@’NG"PPÓŒ¿öÅý³ÏÞ±­r@¿4@Ðá€Â1ÛZA€(i û|5™a£™/œL«c€bûW¯wÛ ¹™v `êгç”Pu Õ”BIRAn,"BQXÌXà’#BAÀš­Ÿ+EãrX?ä؆'^ÜqÞIÙ€fkyxß–íë¾#Ã[±ê£¯N¹ÙãRI«¯ÞtF‰¡EÚ ‰ÈwvÑÆ­’,ÿcÔ;1Õyý{ìÚ¹kPÿ4I–Ê–•C¹&"-GnQQDÎT›jC‹\Nêz2yp «°wårÌ(IOÏ0 "Ù‚²`uX„FD€ºooÅò…Ùì{‘À yj# \2D(ŠCÛúÙü‚ÉO+Ì,——ýزù?œvÞ# ¡¿âÛÕŸU¡ª ›ê ƒ$á×I–-*46âÄL-Lâª=êz)Vw8’QQjV½·z‹M˜é"Ú3)§o!(nç–—.ÞeQL‡UëS¦>sêä¾ÁP-ýƒ€ †e«*É2XÔà÷/ÜZº¥R’$YQúž|߈£úðî,]ôft-;Ò½š¤²d°À%xy°€¾þåueÞôîûÚŽ²Ø¿?„«çîŸú\ªÈ©£.<å‚™$€hµk>ºÿZÙñáCS­J8è÷¦ad;2ņd€¡'ëÚ^‘Qj¶{ú¥AF(”Ö“FölŠC „NÀð{N¿ÿˆ¾ªfÐ唼P˜’)ñ$ÀáÖ¼»u-‹®«Å§^›Ù°êÃGîõ×Gn³ä ?ᆧkéukß¹{K \bË¢EÒ¾þàÓÔ¢É#O;0€l=~碧ŸÙUV–:¸@B!”ÌA½z*{·VH#{d÷Ë[µô»!C{…ƒdŽPíÁåÏÞæ™2»0?+y=8—•jGžÑË @@2tCCÑ-Ó]5 KFŸ´1Ís¦º%Í8@¦Ž™j}ó–íÛ‡ î+Hvd”8l²CŽéG$„Fã(9£m;í2B7›É€ˆ«Ê7•öœ:»ÿè E£Ž+utï±çŽë([±¬q`„†.„.H÷nù|óÖ@F~ kñq—‰e÷¿ÿÆ;^¯×дp}ù²g¯X¹¡Úæ°'_Š †.ô`ݦOÞ¿û×åõÈŽ„ñº& MèšÐ5Cׄ€FwuAlÿ—Dî+ 2ÜÆOµüwm\»NÓ4aèáúŠ5ÿýGƒ]YHHSôïe.QK^Ü)ŽŸ>.E3»M‰ ?æwÝ—ý½á¬™F°¾ò‹‡^ûv.”= O™=xx±”R2mêï¥ï?xyþm€’âÉ:õ”;~“îŠÌ…HŒ€·a׊ÿÝÇß=ê¤iª `-\·ùÙs·XÕƱ¤ÅË玓¨ÝíÐD’@@"úL{Ü/¯y릥{÷É‘Y|ä±×ÿ³ ož0@h^om Ŧ”´@íC×ïñ4V9¸ŒÈ°à”¿\{ªE é•rö9õÒǧ Šƒ/š7èsñY$Y•-é€B§”SO0U‡ˆ%E±($ÈHuC¡SþIüõ”ÙÑQ^’b•Uº ”S§üñsŠ[•‘@’U!Kg<½kXOn†$ ‰œE“[xì5º¡$)ŠEC'”0cØõ—Î!Y‰|YDP<£.xækI±Ú&Ì^2-{r,p‰¤ÊD§"! DŽƒÒb¥|ƒ¢"DYmÜ]AJI5%E• Y‡ €hv6¥®%QÓ%õÌFÍB!%Y‘䦯I$ID ©Í3¡$+"Mº‚XຸÒ5…,?ta+­0jIžtwæ-ÆŸmý;¶’@lù«[âÃË%1 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 ÃÇ0 Ã0 Ã0 Ã0 Ã0L›é‚sQ $I’¡q5@çM%IÆŽœ´H()’ ±ëtVò%ÌeÁ;2ù1Óç;9ù($ËÀ; ²Àµ#OêŽÒ ^{1 E3½‰ÎÙùJ’Ñ[³[’r;¦LÉßòšÕ‘«øÂq Ä@’ѶeleE©Ø´6Óîè€]Ç"k{èáÅóŸwºÓb“oÆ¡¾€$ˈØÆU|Q’êöíT™ˆ¥¦“êêZ¶7sùÆ „0koÔu}þüwvíªê”åÑér;ÎØ—´Ûí³fÍRÕößÄ$ Vl+7ŒHòeY.++[¸pa]]$Iÿ¹c¶ÔiCÚ ¢^½zéºMKSffæÅ_ìñxÚýëûý¾ò²2I’¢©Ø³{÷Ûo¿mˆC“øvL~NN.b“/„èׯß9çœcµZY€Øƒ;d5!¢’âòý·ß}/H’¤Î ˆ"+Hn…%"›ÍÖ¿d@s7JÝXºÉfwD‹}cªÛá^=ͼ¿Óé¡Š}¿L¢IK0Ã!j{âóùB¡Pg5Bµ´vXФiZ}}½¦izÂììéõzÍȱ”N×õp8œ8i'¢`0HܱÊ×^ùIUÕiÓ¦UTT´]àEi{Q!¢Þ½{Ž.ÔVŸ5xðàýû÷†Ñv5‘$IÑö·ÊÌÌôx< nDTXXxâ‰'¶ý«™A@»$¿gÏž6›»:"Vè5Ibæ¤{«„-HðbÓyÝ•> \Rª[¢å§Ä|+®áø­Xà†a’žlÏ0 Ã0 Ã0 Ã0 Ã0 Ã0 Ã0,pL›ùéa†ÝqâO'9Ö5J´ÂãTÛô=ì¬|ãéÿ•ûlr³1ëÂ¥ ˜ù›ƒº¡A‚õÛ^zj^½êlf2JŸ®??EévÙ½nñ«ÿùB¨Íø¡ {â¯;žKP[P؇›½ùü7ÕµYq6 ù'ꞧùv¿ýâÜö,©YM®±L¼êwç§t?ƒìߺòó^Ðm®Ø,‚º·.ÇÂÇ\b‡cˆÞÝ•U^-~±tw^¯lg7ÜqIè;´øæ"ÉQP§t¿Ù™a_ÍŽÝÕ—H%½oïtÞ“‹.qŽ~r) "ênk?þÜ s"ìF%úg²@7Ì!í w2î üs¿rý'olÎ!ìÁ%KæD€WÏñÛÅûR,Íê#Tßç´W–¼p:t«m‰±aÇÒ†¿Ãž¶£ï·½aý¿{u§½ôˆÖΟsÚoÒíîæmp 5¹7Ô¯¸xãè6À ‡‘çÿvö‘^kó^TÒC©6©`wÂâÉÿÍíw×+Ž¸^ÔšŸÒ-ócΠ£fÝv‡P,ÍŽŠPØ3¾{æöà’¦‚&”¸…¥Y’¦ ®{™„ÛàXà’?Ž=¸XdYæFÉVaŽ.)Žˆ·IjæÁéºÎvˆÅÌ>ŸMÁÇ\ÒÇbìÁÈ2À³µXà’ÌÖ[›îgÜ7³ t:¼\{ä16AäÚåË—744ÔÔÔ¬_¿þÃ?BŒ7.;;›CÔhˆj–ín¾–T4íV«•Í—êóæÍ›;w®yä駟¶Z­Ë—/ïž[Vc‡‰p1ŽM¾Õj5 C–e6 ‡¨‰^'ÑäÉ“UU1bDQQQ·5ˆ" z½^MÓ¼^oMMMYYYuuu7/ƈ‡Àb±ìÝ»·²²²²²’[âXàºZ–$iÔ¨Q=zôˆ;v¬Ýnïž×ìG¾êª«ÜnwÏž=o½õÖôôô¢¢¢… vç’l¦ýùçŸ÷x<ˆøî»ïæåååççÏš5‹›nYàºZ€ÂÂÂF^rÉ%ÝÙ&²,OŸ>Ýì(4éӧϴiÓØÓ?óÌ3Ýnwìñ›o¾™  \TÎçwžùŸV«uôèÑݶaÅ,É&LÈÉɉœ0aB7_ÉÝÌYYY3f̈´Z­cÇŽå•. œ¸K.¹Ä,Ã÷Ýw—äž={Ž;6zpæ̙нGE˜iWå”SN‰ú¶wß}7¸¤qâzè!8ûì³£}ÿÝÖƒ€9sæ˜GÜn÷ĉǵÀ)§œâr¹X÷Yà’¯T_tÑEÇOOOïæ}ÿfòûöí;|øp2dHNN†0%ÞívOŸ> Ô³gOÖ}¸¤ÁívßsÏ=f Ê¾àú므뮻ŽóF,—^z)y䑇ƒu¿­µ)×m/°x0EÚÜAªcW…ûùwëD«¨¨:tèÆsrrxDk¬ôgee=ñÄ\p‡¨m„g2´=S"l«Ü …DNˆÈårõÌË1ß­…íðE©™™™÷ÜsOJJJô`²hP[ŒówˆüñÇûöíËêÆ\B°wÏî‹®½-wÀM `Hœ¤X¼+_yúO£v$ ÆuØ#’ô»›?k Q»'™=¸v ¾¾Þ“•?å’«Þ„¨-lN|ÿ‰;}¾†¶œYÀöì®zûí·£s¿»9Á`ðŒ3fôìÕ«\0üàýÿÕÖÖ²ƒfš$##óŒgrˆš¸Ba$D~:m —ͲwõîI+ëIKöô|>ß¿õáÞj‹0!â×ËV¼¾pcAÉ–7$Üøî¢Þù£Fb.QCýÈÿC§WÉDí';=iƒŽž‘š™F¼9 ‚¯Áض¬J¢ ?fà¸c¹à€$C02—NaŽiS3Ç¡6ahBgÀÐÛÍÂÐ ‡€‰Ãµî) \— ™}>Ÿ¹öNTÝÌ!ò\¨˜î \פ¡¾áõ×_OIM‹=8a„Ø L;úÅl‡D8XàºGuuuÓg±Xx¿ôö0,@ìv®ˆ¨( Ë\ÛÄ „a«²ÀuYx¯vF–¤½{öÌçíP¸©(Úl¶©S§vóåžÚˆ¦ë ,ØXZ+pÇw\nn.{p Óa•úý¾õëÔc6³ÙlGu \›üb!¶–•ycvƒB 4(77—=8†éx¡‹”:sü=Oj_ö£=y5†aº,,p ðÀ1 Ã$Ü×aDÖRŠ´/ bãRK-Ìž¦IWD1>x«s†aK8Ì•©J!Y EÖÿÄ¢Þ¨‚`!R q”#ˆaBˆ¬¦ &èR–QŽŽÒŒ}M$Óu¦–•!¢)èز~Àh-sÍG4ÕØø hýsÛd®h:<°ÍcNˆÔ™­üDÿ+ÆTÌM$úWÌ»DªìDÌ“,p—9Pìûîßsn5<£N™õ—;€lMï޻胅6O* ]³gxÊuG”€N(ah蝹Ÿ¼ºeõ¡°²3{ÀqÃO»ºGžÇ0¸°š%M’¥õ(DtÔÕVŒ$t"D¹EÆ$„h,…J˜²fÞ5NVQ@Á,ì’`>WBYa$±ÎEw)Æt$€ ¢VmÞÜz’‚-ë Co¬;QnT¯Æ{š†•aDÎ$”QF: ¤@"£ ¸ŽŠO Œk„ó.,ÒÿYY^á˜ßXÓ’³`â´î² †dlšÿwÿ¸5%÷™rhÿÆÏ».˜?sÒþâ‘€wýüû?úÓ¯&ßòzAO íÅ!ˆš­+«÷î5—2”í©i½§g¹µ¡„(öo]ôµaQcCt´xz š`•÷o]ü¡È1ž‹”š?2#'K(Ô÷Vnߺ)Ö$‹+½pdFºCÓLݫݺdYÆ #ÝnWã+h»W-ÒsÆõÎqy+Wí¬ÖóV“¹å@å–V¢ÊVgvß¼~ù&C‚±oÓ÷uÕµÍ<<#ì*žÚ#‡¶¯X⇣G2tµ xô0H *¨íÞ°¬¡¶ÐâÈ*Êé×GÒÍ}÷ê¥aOQ¯üÞ@@„’ Þò»k=‡L´Êáíß.p÷?ÚívrˆÚ}[߉´à¶«œöLÞ¶­«V~5dà…ME[¶ÊÖT4~ì·ß•ëë '½jù ûS¦^øûe "Õ–=é7TY§Qôm‹Ÿ[¾b[zf&éþ€×G äuÝq§ŸŠ²Øòå“×ËEƒlj“Éžâôâ غøéYrAKãOD–’i·gädJRhëü‡–|¾$YµÈZ0(ÀÒ÷´{&L:’¨òö%sïsç¿L#þõïÜã›üjßÞ®š•o,ø¶þ‚»“[à@½î»/žší.a‘)ì«Ñ4]ò žtÝœÜ +á-Ÿ=¹¶tªÛ!ãXò]|Ba~hí?ï­ +)n7™?=ufÿqC€Pß÷í'OÞQí5Ðâ’DÐÐ Gþ1Ç_9Ûã°(JðÇw®peïÂÞ¤H*ìûú¥E+wL¿o¢]õ.ŸwKÉõï{Xຩ¼"¾Uõʉ½=Šã¤Ú…¯ÕÓ¹)(Gš@ô`°®V †ËÒïRò'få§K¨úvAñ1s%¡„HD䎻ôF3.KìH A`Τ›ÎºðD]$سæÃ/ž»ÿƒ†à´ËÏ’uIudO¼ñ_ÅŽ¦+„ƒš¬¦wË›ù=œ1^T-ùû—Ÿ¬sÅ£ƒŽiQ€Â¢béó_þûñÜÁ¯õ˱HªÍ)5‹ÐP¶Ø @R¬ªµKÌ7@ÅšÞÿÄÙof»ü{¶®ßgs~;möÓé$]œóÔ'öé1>\¡„Jï“î8õìãI1xÄžoßàJëèY3ο,-€ nÛŠo_ûóª¥K™r(»¢*± ’bS¬vs DÕæä͈,pSHØ7ÿ!µ÷É«"ç ëáÞöí¢§ž”¯€þ²…óoÿEخ⣯0Ý‚‚ 5”íöDËõL¢9Ï4 ¼8¡Â~0t€Ô§L>ký¿ß|~ÛÑÓŠ{#éAoØïˆswÍF -èûQ'ÀðoXônጇ‡Ž©…(B@Ì=âÊ3‡\¤Ø-†J÷ÉÎ$´€VT"’ÜE#/yºú'n\¾n¤Á(¾BZ³FZE¯ËþcBIDAT@á@È`45 È’¾qÉuxÄ™—^æ0(ä°e:ê·óH²¶ÈÏв(Q§r°Àu€G€¨ú×-ù¤<ëTçþmëdÔ9…›ÿﱚÉuK@®’égÝu€t¨\ðÄ‚¿LÕ~ýú°1}T éZ¸1Ê%B"”))<¸f΀Ù㎶¾4¿v÷FêF]åúªÐŽh,¥zú¤çfDJ°®Z(ªo’bm]Uxxa?Ý ‘„nh:JŠ, CV³à×m_¿Sß¹LÁP—®>‰Úz ¸¹r­€¡(K¡½›vm’4Ý\…Y)=·_!6šÕЈŒpÔ¬hë·®Wß“m‡€Ha ƒ`¶„J’VS±«t•Ð5­jMm]Rd>¸ŽÈ„² åïý³Áš•ãß¹ùë­(;sŒýKÊ7ì6$Ç,–!˜=­ù§Þ0nÍ{ë—/4¢0{`ÁÆ ›Æ5,$ˆdîþú=½×1y9©T3 ‘ˆÉšiC34"I¯Zý™ÏѸ£ …ÝE33zd÷~ý·k•Hàƒ$Û‡Ÿûpß^>Ù¢"HàÛ:ÿù/‚Õf±;=EçNºät0ŒPÕÚ…Þ2{ã=µº¿ºî˜ÁH—0*Ö4­.„’¢úË–llæÒN¤ëêÐœ…€ªeÏ’¿½»ò³#”Â^ë˜1ó¨p0l+Š¬J/BÕ_Ï»q×Δ­JÊègÝâ@Yì\UúU5‘I–¼»vKèacÿ‘ªJWã~ï¤ËÒ½D€Š<;Æÿ¸dñà!gÅŠ€ ûvù•!vÐ ïÈ+W̹sé„S& ²‡B€ˆþÿûdÞœÁW ê™—zØÖy><–@Q]Ú Y6¢ÐZ2íƾ½3c'W›ÍChËÕ3=sS#¿ ʪCÒª,²òû< ÐQ0ãŒû¦)*n˜ÿ»Õ[¶“ `ª®’©×õ+*0»nÁhøjÎr?tÝÉðˆ d¨)wºÇ!’ ¥»lÒ¤!-&¼X€4-{âu'L;•ŒPÄ°’ÅÐö—·¬Œä$YÒÆ_ùœ W}ùß'ß2€4Í3xú±gŸN:¡b‡²×o^´z' {oHDµ•ß—o¦c¯? ü‘ö4#Œ…3¯^öÈ‹ûÎ9“´ WÙº_‘Á0¼[¿Ø&9zÜ‘ˆ”Úwò¸«¿úø}C§gg§ÝÛV}[pâM#Æõ¡„×>øf-Ÿ.ìÙé…%Hß›T$‚ fÍ’'[-«³™2Y2²‹26.[Z'2ëN PÜžÊW/zêõ¦¢MF0}Øugüa&HÑEž›ìCDBÊ9þ‘¥‹½äÓ»Ž| Aq§}æ­w©‚‚ Iq"bãpIƦ _,pÝZë"Ýì?WÒ°Y#ËX"¹àØ«Ó†ÕF")ÕáÎퟒj×4DC*žtÓ\!˱Ž‘’–™!dϱ×ÝŸšæ‰]SÀü[„)mÌeç>coEY8–¬nOnÿ”t5 ÔŒü£ÿˆ'7«±‚ƒÏyÀHË…(uô…SŠu«œÜYˆÔÔq“ÿð4I2 JÖÔü¬‚\ h)>ñú¼ñÞæVª£·æµŽ¸ô!J)£Y3+KCwsÓüaëêêAVí©½Ò{堆ð >ç.Íу Ó¨d„1sⓆ‡\ †kÌUÛó2³ºeccåÊàÊmæ˜êZã"˜’;dB«-v;ð f+»F¦aJ`„•´Ì¾iÑóMu A®ÜAc€¢3 QI+ B-³_¬HûTϹ'’¬Ù=†dÇZL„LýGÉÓc°§gk×é”Qµj“¢¡£»ç wÏƯ"aÆ §Žhº€ÙsJ칂ˆ,™%ã"¿ò\T¦Ûy¬ÔÊÁ­&Òä¾R+Njãµñís§5ݳñºÆhµÙ“{A‘˜®¹[O¸ðÀVmeün“Yã.ĘuFð@+QêX.‡ ÃtÙ ‚MÀ0 Ã0 Ã0 Ã0 Ã0 Ã0 Ã0,p Ã0,p Ã0‰OÕjZB’t-ÔP]ð…—U N\/K Ù -„’? ÃÇ´ "ÊëÑsê‘«ç["Ë+"‘X»vÍÞ½{ÍGn1Ïò—€€éŠátõŽ]£ )4W¬ìîúpLµd«Âa^9“®°Z­W]~iÌ—BÃ0Þzë­ 6H’ÔI¥±½Š#ªV›jY»ð?SoÂv¨5Ö-VÕÚlcì®ÅGR@Q­,p‰\·cœ !̃%pQï²w=¨Ïª×gÛæö}$ËòžÝUUU»%¹C—U3Í(D'¯?®kšCi‡E2ÓSëVþí»µïGÝöP(TV¶Ut¬G'¡„’dèzçŠ+†Þ cF°À%¨ºuÕw#¢û›†ú¦ âTU]¸p᧟~jµZ»á·&»Ý¡ëz[ KƒJŠŸ|ôCoÚ™yïž=ó^zI9Ò­eEµXXà˜NðÝž”hÉD›ÝaµÙm6[¾`ŠßÌUëíöfÛ]{}~«Í®FG~YHöµñXà:MÓ Ã „iFFDÓA8øž‡+#vš"t1Ÿ=d¥ËK Üá4«¢ôë×/·½ N’¤öj{*..nŸ~U†aëæ‘Ýĉ'Nœ˜hoÙÙ ÍG<Àá0˜‚­Ê—9>½¤¶«›ym^^^jjªÝngS›Øl6§ÓÙÆ›8ÎôôôDèdHœÜ›’’Òö÷A®4˜Cu1ü~‚´"%Bî•$ÉìSncÍ؉‹ý¸fGVs sÈu;7äuÇ?©c8†aº2¼šÃ0,p Ã0,p Ã0,p Ã0,p Ã0,p Ã0,p ðÀ1 ðÀ1 ðÀ1 ðÀ1 ðÀ1 Ãt¸À™søcÿÞ’a˜®!pæÖæ:'ˆPW†¼ Ã0É*p-=µ;áÕWáè£aÈðzÙÜ Ãt$m^²ÜtÓÌ£ÚÊ•ðõ×ðæ›ðý÷  í¾rÛN®ˆýX Ãwh¡èæÍð¯Áþ›7Cmm³Ó„€`”æS”VTïà·LçRÚ–Åp•Ð²|[Wô%!àå—ᯅ5kxšªB~~¼œ)J¼ä!‚ÅÒŠÆÙíñ×JØíñÙ®ÕŒ(I­l©­Š¦ù>-¯m¹¯»ªÆl6°Xšu­ ‚ß@Dp:ã* ¸\ÍÞ‡T<žøG;àpÄ?:5l¶øG«êAõóRa>È“[=í üµ­F ­Þðàv%¥fûå|ù%¼ó,ZkÖ@Ë}<³³á’KâåŒ4-¾È -÷÷nucЃ|sD‡ãO6 ðûãê:ñ—khZ¼Ðh´Ü)ŠÃh%æÁ8t=>ÕæS„håÑq7$jåeˆâ{uGv«•‡é˜·ÔÖV+¸ƒ’Дõ¸j†¬ÖøìÐJå!IàrÅ ŸªÆ$‹Üîøº\­<åpˆ¸,Ç”åVjzUm¥v´XâÓbÖÁÑŽ……,píQ9ÔÕÁ¶mðßÿÂ[oÁÚµMç ßmÞ]­=i)£¦(´ê¢¶Ü–vkyíÎlyC¢VNkyÐ —Z=ó`*íƒÿÖ­šÂç‹WR!ÀçkEÁøƒši«xâôB¡V´>®òˆlù âj£Ÿ¨2㾂iØ–O9mãÒ ACC³G#B Á`ÓÉæ¯^o¼‰ h%Õ~+¯gFÓ¶-k¸p8’@À‡†?ü¡{:qíäÁE›*bk§mÛàÎ;aÁس„%KZ©!Ù?OÀX¸}31>ÄÁhëOÔŽq>5·Áêëá㡲®½c·`†«„ng1nƒkkÆúf[—†aº”Ç0 ÓIðd{†aXà†aXà†aXà†aXà†aXà†aXà†ac†ac†ac†ac†ac†ac†Ža†Ža†Ža†Ža†Ža†Ža8†a8†a8†a8†a8†a8†a8†aXà†aXà†aXà†aXà†aXà†aXà†ac†ac†ac†ac†ac†9üGD‘ÿ¡–¿4ù£ùÑ¿[9Ö^4{ :ÈSË›4V£‘ZÚóp?šaXà D4Ë("Tm]ÿÕ— ,übÙƒ€ˆˆuËVü¸Ë×-ݺ«¶IÊÌ‹ ߊïo« ``碯¾ÙW§–„ }óÚo~¬¨CDü¹ä€·rÁ¢euAú¹sÛl:"@ÄPuåÒ/~õ튺 @¢Ãþh†a;$•o>xõ¹—üúOO½ðÒsõû+Î9ë†Ò„å_üuî¿¿€^˜ýß%[cÝ;}Ï3Þ³à‡ZØ¿äÆ[î^·-€ˆq^Þ|­È¿M.$5ÿ‘o€(‚ï<÷Ç×>ÛçC¶~IÕ¢Yw=±­Öˆ?'úÄægã49¬ë¡„ >>ï¼ îü¯wß|ýå7Ü_åÓXÛ¦]PÚIÞ êû?ó^é}o}<©ÀP³úªKo|ñÙùÞx& M× ]§kýŒPŽˆ’nðú ÉšnGC×t=½f~³h†,ɤùêàq¨õõ È®”T«D@Bô7Ô5²»S,ð…e·Ójz:$DÀï‹Ó®J€hø뼺âv9$$¡…A—ÛsÓÊ ô¯ßáñhÞ:_HW­—ËŽD¨‡^_@²8<@š¦7FŠHz¨Îë„6§ËaQ =ä n—€@ ÔøÂ.—Û¢H‚ ÐP'9Ü6EBDÓ7;2›¿"Rͽ·ÿ±øìGÿ|Õ1þwí÷÷Ÿ:*ï'.g¦Cª«w-¯_oWä¿Ó†=úìËAGŠÜx‚¬à›_uÛ%'¾ý¯<õð‡Ëvd妤+IRaקçÜðÖíþ}Làï—?ºã¨A¹u!ß¾åræ‘w?øë €Òþvÿ¼O•” kÊ€“Æ6,Ø4ü©;g4úSÆÿ½ðð’ 9}üßW=·¯ÿ³ßëR¶.ûðç¿{ü¥ûþóàoêüaÖé™?ô§‰Ã-\Yî }k÷Y¯þÝSF†êw>q×m?48²\Ž#G¹¤¨t׬{øOOý¸W÷XŒʽñž;úVÏþû—?p«M•Ë?záêç]{ßcÓ(ÐC»ï»ææ“ÿü×I½Ò¼Õ_,ü6ŒQ€FöcO:>×i†¨ «ÞþlïðO¯:³Ÿš§ëÄ!*Ã$Jˆj LɈ ­?^~Ñ _¬Ø¸¯¦N'HéÙ;;Õ[Ljö4ø5@\óå+/|´ç¡7_~橧pTþ¸% É_Õî½!Pòÿ°|YÖ¸©³o»ý‘YWnÿæÅ>i€êE×ÜûÚˆóf¿øüߺ¸à©ÇÞ« hï%9¯oÆgÿü¶Ì[¼ËKÊÝ Hb˺Ïër'f`¸¶fO/ HÚö¥|a<2ç{}îšÌŸûç€ï_¿ék}äÓýËcÞºgífE‘ üä}\è7穹?ñÔù#BWÎzÑÞ³ÏÞò²}a ðÁÒ5jQΊ? mÇòï)]NBBlØ»eþ믾ÕÄ¿^yõÝ !@ŠÆµ[—¬IÕý;Ïž6yâøc§ýýƒ@–¡Y;%Ã0çÁ!ÉÙCŸ™÷Ê믾öè­¿ HάÌÜ#ŽŸþ«sNÎq[[œOk–¬ì}ÖUý-V8æô_õ{ufCžy†”žÛçȪªZ ³í)öš­eÆæPjîÉSGKHéÃϺxܼOżôí;:cËŸ¿ƒ«F.[¼Ã6àWãú•nÛ1¦sõÒS® ºˆ ²7ì¹fÖi2 ŒŸ>ð¡¹ÕáOþµê˜›nÎpÙí8á…o¾’©vë7_¯;毯æºT"eô §{ž¹cïwc T~Ó»~Ýæ†Kï¿iÙÜpò¦åë ”¸=3¸D¢¼’IóæO:pˆŠPí£ÐºO?ésÅ#û‡¯bùý÷ßàIûÇyú˜^ Ã0êÁEÛì=½†^sû#ïüékbÖåS–½6göc¯ù[qE´=µZ¯ŽÈ•»-ÅJÍ]I±)’jª"U ~«šâqDN(–+ ãDbz¿Â^¹µ\·tu©çˆ‹OéütíNÔ+—RËÏŒ½=©v· Q’@†Ý[ªíé«))éˆÁ@ÍžGï|‡©¾6«'ÍYWZ#“õο7h¾=î1§–ä”ݵ±bÝ7ÅCŽrJ’ “MŽl’tŽºí†ó÷3ùœËOñþâo£ªÍ0Lg·Á!"PõÎr¯-+?ÝI’%7¿8· øeëªù¡ÞߊªÚ-è ê‘2 ëÑ¿[ñ#ØTEÁ0Eû÷{cZ©ÐÒç´~=Þýäu›¼óä+Æfªòþ/:S3s²œ -Ãj0…•Àî¶éM7}«@µ@QìN5\ç7dÒõpP³¤¹`hÿQþ½ºìä“Š,²J)9†µbÇÖõKwN¹¼ä¥`ûÚ¯þõ] ª#ZÔ…3ž}û¥ ½R£ïž? K[ ¹\©ª0çK†Iðó'wñïÝV¯!" ÞðþÇ¥©y9vK¼;B ÷Ïýñ“%~ؼâ«Ê½$K?À>Áº=7Q¯Ýôö番"ÅHÀŒ‹Çm^ýÑ‚Šü³‹ewV^²òoŸ|‘]|l†¹ Æë¦ù·¡QæQ#m«W–Iâ£?Ê2 5£`È÷wÿý–‘%¶÷>c½:ntOG¬zæ 8þ?ÿ_”÷ßÿòÓŒÉóĪlÏcgؽà­o+Ãû¾úfù¨~}›‹0Ã0èÁàé·=±áŽ»®>o†3%Õ!õ ^ÉÙë¦?^›¢‚¨«÷†Àï­ ‡4 sÊ…?»í¬™+ûd»RÒRì©Âë ƒÜ_]ÖÈ[]So˜MldÔÕT§øÖQ§]9~þ#מõÉÈ’Oí7±Ïš ˆjŽº¼xûŸìw\6J’7(ÿòìGÌ» €ÈÛPë è@¢¾®&m’ 7ÔÔb('Ýxϯ{ðÜueX± €jwïRÚõwÜqûló{iŠÓ6ïmz8RÇžššóÉg—_t äøéïïrÞýJ¬|’¬XÜËÛà̽îa~q˜ií™Ñ%;'øÔªìsjósTÂ'ÄÎ;÷ìÙÓ AæR@¬<1ãâãN.>!Îï­%.>!>!Áä˜)*¯W_}µü(s)à¤ì¢·¿|EfãÒ_æÐÚŒKePE¦S………@ >>žJ±C'¦Ö¬›–ÆõŒ¥T~~>•*Wå´6 Óëõ(%¶eY¶£Ex]î]ŸËù'R) ŠOh×½éÓ>Z¶~ËöüÔmÒ²kÞƒvÓáˆR¦±yÁ›s •Ünع­‹Ó¥Å)ÜÿïyK½¦Òi=.ëÛ°ø´A-VáÁ·ß_b*ÝãÜ! “} 0ª*D©Pb˜2ë¾Kï~}]B‚϶-­Åølåü™ÿº³~æû³¦4N4´öäÌzè±ÏLipÁïÞ‹3DD´R{7.}è‘GüJ‡®ƒ?>N%"ÊØ·eþÃ?m8μó† 32T œãœ‚RÆOQ"?uV…RzÉ=çNzç‹ø8í–Ý&?óê[o¾4nPÇx¯Ç»yæ¹7U^í„Zvº4d‰–ì…Vä›)Ó÷åúÿóZ”2ÃËöåZ‘)¹uátS´“8°v’‡D¹3þÅ;†>{)1rBÁËŸYy{fr©e çm¹mþAS9ýþüü“£ºmQJ·œ4müÄå½ÞP½0kÊëË&ìQ#=#-Î1}ïlϛءº#âñ†>{÷¿"É"Z™Þußn–RËí‘#3gek#¡íM7ú\üñ¥s) lçR†a–NBöO´Â0¶L›hk ØïyVÐÖJIäƒrTõ³nï^ÃÒÞÓçÛq^;®ÞM™>%úµ?צÑfîƹ۽fj½ž“(b¼’µÓ4E´ ·é“_”ï¶óÓH˜KˆÌ˜‚^ÿø¥=ê—r&ºvª7Nü‰½¿À+ÿþFÄ×îæ‰5•>vN¥”h}ñ_¯ºàÃÖÎ%«Žx:ÇÙݯ§WN /{æHø¼TCï[õÙ!¿·qjç3Ç64<·åµÙ7t÷*ç« <~ÓãOmgpP T @qŠj7LÏÈhöËÞ/*XWhŠO:³Ž}¿TJ5̬éh¯}è‹o‹:Ÿ®«§_`Ë4¯±}ç¾Âõ“V¬Yï7¬º¿»Â×(Ùc>ç;4ÿËC“ÛÕðmZ5ϧëkLƒ@¡ á? i³ÃùJ‰H ¿çÇ/ÎiU=Þ«•R…9…"Ú›T§‡×Ó¿xÛ_œgýªO•ÉðÖ†§z#×çlþbß“—õÞmÃnB£@¥ü&Ê0ãD‹H~ØþqT”.Û"Zûâ}"JqG5Qÿž½.^íøϪ§z³óëÙb˜×vw ßk7{÷ýwñ!¿NH»ª­W¸ì:¨€ßÄ—xºáˆ¨Å[Ž'<É´6rþw(`ØvbÓ† ZD´Nù¯HþÂéÛV/Üêøꥧ'…,•9~°áÈò¹ŸoXþ¿Pœ§fýV©–­9$*à·pT•¿K‘eS^+4ÌïO×Z+µ|ÊÓ…3T³G÷ºZ‰ˆ•Ò5!ÞŒólýç“Ë}^»i› ‚ŽÖ"ž–£kúßÎ…Of­õ«p£ã-‡FJø­™’®·L6”$ä¿÷Ò⯼ÇÎwÐJyœon™÷×pþᢔ`HDDi%žaõâµ/~Ñçÿ3ÂN׋{i­”Gש[+ÙŸûÉGíPÊUã2h¨€ßL;þÚ½FŸ®åzóˆkî}ñ`‘Š÷Ùÿ}ç©þ½‡äZêhQ³¿\uÞ±·[)QjÜݵ­E$×æ¢ ¯(%¢­Ë[T·´oz»~É|¾"¨€c©ÉËÍÍÉ9ú“oÝ-A)]————g9Çþ¬Œ 3?¹0ݶB+ß{¦ß™é-Ú_7é¥#ENŽ]÷ß¾ÞØg‰:~YIê;±š.,**Jj×®±{rÎØ^ÁüÂ`Q~«Ö½œŸ‚*‡÷K¥JkIÙüÍ>%**†µ:ÉKmZl;uñš/´¯¯xº£D,'qò¼Õç¿óê» —lܺ+`u6ëÑûì±ã†'é-ßK¥Å²ë¾8ã­Â“X»Q t¬‹JŸïÇß#w=ï÷=/ãóš‘Ï— CŽÖê‡ßR‰ˆnÞæŒãS«ã׶CG¨€(õN¬pÐ ÿà?“áÂç•úe¼^o‹-’’’X zRSS÷ïßÿãs‚¨Ô)h­'Nœxã7F¾fM€2ßÌ*¥ÆŒÓ¡C˲¨Ô/£”:ýôÓûôéóᇚ¦I¨ låõzg̘!"5kÖŒ…³Õ”ë6ô‘Î?þøã¹¹¹£FJII¡UP³ÃØ»wïO|x8.õ¡j­ËÿH•»ßÕ»téÒP(ôè£Ú¶]&Ϭ¬¬-Zx<îÛ¶¿ø⋶mÛR©ŠräÈ‘={ö´nÝš¡(­•ÇóþûïwìØ1»ë‘k­-ZûOÕôôt­õI†×4Íòßw÷Õf•R~¿¿I“&e²ìÙÖ—¿ýû÷3ìû Ú»w¯»Þ)Ï íUâ$#ߪU«ò߉¯ ×Dïß¿™Ì¥Pþχ72È0Œµkך¦ÉPà”;ZëÁƒWÀZZ v4h0dÈBUÉvÜÀ"@Lm„GŒQ!‡`]pæ½÷ÞÛ´iÓ¶mÛ&Ož\ê¹%ZëÎ;{<žwÞyGÊe2…2 cèС­[·ŽœbM¥Š‡F)õÁ 6,Dn¼é¦›J­TdÔÚ·oß¾}ûùóçgggçççÿŠ©•RÊçó%&&ºèì ¯×›˜˜èÒWê Ãðù|®>A. FÖ—>~¯×ëõz“’’\q>BäÑ&''‡B!7uRR’»ÎN4M3%%¥^½zçŸ~d#S!€XÜŸ]Îœ9³äíçÄcРA¿eC¡Ð­·Þê–—éµÖ‡þóŸÿìÞ­|~~þ-·ÜâÞÇ¿{÷îY³f¹z|ûí·‘‹¹¸åÑN˜0Áã¼oß¾ÈûgÜ8’ }e؈ÁQJuìØ1’(¥Ôe—]¦µ¶m;##ãç̇~ãìÄE'¹†Ãa7¾qä„wõ)[–e¹ý€¨»V!—®ðZk÷>U+üŠ'G¤gÏžëÖ­‘:uêìܹ3>>^URlÍ¥"g:._¾\DZ´h‘ÇB€*+¶æR\°`RÊ4ÍÕ«Ws¶0—Š•Y”ã8mÛ¶µ,Kk½`Á‚ÄÄÄ 8åÑ4ãâüåð˲æU‡RÊ0Êcc[)·-žØYŠ;vìØ¿¿ˆ ÇûôéS§N'zëyåÛ¶ÄÖ±YÏ z 6l(¹ŽU«VJEóéì¬_¿Þ)qR¨Çã9ýôÓ©~NÂPž;û¼Š* RP)•€J@¥T * RÄOåø5´_²xJ¼«Ý J(¹¨ÖZÅ'‹ÒR˜_òÒ¢Zk副W”ˆmI( E)­µ?IIH‚!­”­E©ø$±ƒ I\²œðÉNP‚¶Ä'”ò¨‚yÚÞiU¾R¦/<£¿ïóC²DD´á;­çÈKïþW½T-J)µÿΞ§1Mþð-_XT$kJånzëÝ©müßÚ°6ëµ;oÀuOŸÙ±±RêåaMì _{é9–£ÅT‡–=ððm yvKf÷ø‡»Õú¶P쟾Ýpü‚›Z/}Ýq¦ˆBb°°@´X¶\û±ÎHe€*_)Ñâ‰oõPÎõƒ|":ôíë7õ}ÒÍwýsJØ–üO&ZIíkÍÛüE cz\äºÁö¡›8¾ã¸©“Ÿg¬œþçÙwõ®7{wƒ8ñ&$^SY=õ‘{Ÿ½øåýgµLÐÎa¯)ÃæèþÍO˜KóÊÖ¿‹Hè඿^ÚÿïŸæ'û™K@¨TÇ¥œ¢œ@žòÄò6¼päØýÛ6zEtxÞÓKžÞ¼é†eó=¦Ñ"¡w®û}Q‹†]>ÌKX't;õ¼Óo>½LËŠ2$wëÝrÿ9S¶÷h‘P|eg¥¬‰ü”ÈÁˆ}ìy"ȳ#$QÀ\êGÓ*­•Rá`P)¥EìÂo¿,r®:«¡y¸í?æ¼[tÝ¥f‘r ²7|×_œá8Z‰QNH÷|ú@%vñ§áE_¾1yüÄþîèß6NËÉ‚£µp¡g R§ LŸéQªð›e¯?ûd£öJËUwj§Cíjq‰—ßTýÅ~+ÖOïÕ´߈R‰>D"ù@GŽ^›Þýú#ϽkÆŽÇ'%eø“—Þ–þÉ÷g`„Ü›ÕãŒÓø\, R'M”áÙ9¹þŸïwDDkoë¡“ÿ0a¼í>˜²°á„/S’Ey{¶éRwëÿý«oËkŽÏŽ÷Gk­ åñˆsÓìÙC¦î¬·óÁ© 8{îr_¨xºä„ ºÞñ¿Î¿ŸG%Öl@¢€J‚v¬¦wì½æÜ”â?ÚbYÚ¿qSȯ=íæ‡E‹6Œ3ûƒ°ÿOBGëœ`8Éï+þˆwCY}Çô©»nxáM§Åµ3Ïj“j·žÔs^ý'&™“9p€ß nûà‘eÙi¦^¤J¼~§”ö¤ž1ᶋ¦LìÖiÞuü¢Loöª·×íþþ>Ž¿yÇ^íÅa]*õ“IRÕÓ;«To‰›”•½nà .ÙZIñ('(g »g÷â­Ú#’Ðý®™½tïm3—=k‹7±nëkÞØ\×Ô"ªF“¶NµÈ+‡J;ºÆÙÏ·ÿ𢹳—_3¶}ÖgYùÒg%~L0eHǾŕRfBýæíMNø*U’c{ú>¸ì„Uí7>3;òåñö½ñÚ¾¢-;¥ë•S² SDDÛâh‰œ"qöÿ[G¦SJD]òÈ< É%-)åLJ‹ÿß›ÚêšÇæ³V•*JDœc§Ÿ3€XÃ5ÑT * RP)•€J@¥T * RP)¨€J@¥T *•¸Ë>Q^k9²ïÛ};¿(q‹ÖŽSf?@‰ˆ­£5Üþø`Qâ³ë˜Û¸HÎÁì’Ûí8Ž”áÆÀ0¤ 7V?dz}…y9"¨TëpFÆïÚ,óìYxü–®üleþ%¢£ùLhݬ¡eYl€˜R'-mÈYÍU‰mËÑÜܵ«ÿWPXPv‘2œ¨UJD¦V«”Û—U*>>ᦛ'–¼eûöíÊô¸kv¢µvãºâض –|ðeû”SQœÄŠéñ:¶í®·mË °æ”áÊ£”ŠÞªèñúÛM[L¯×û§ 7–¼%;;;9eÖ‘#GH8•‚ øý¾öuÕŽwþzü–P(ôùçŸFÙìh-¯ÇŽæž ×ëÕº¹[<))©–?øõì{J쉫M›7ç”ÝFÓï÷£·ƒ§[öá¹*…rYQ<žG}´ä-ùùù<òˆišîšÅºeÚíóùüñn|óÍ7·mÛæ¦ù·ãp¿çøá×o€\÷Ò¥Û·˜ 8˜K¹òykY–«Ÿ ¶ÛŽ—UD ˆêùÑžÜWŽ“)\_©¦M›Ž1"ªKÚ4ͨ†¤N:l€XS§NAƒEuÛâóùB¡Pô¾jj*•ªx^¯·mÛ¶<£*j"ëÒó?~w=`7¾ÊêÞÇošf¬l[´–H,Q•pö~¥„„„sÎ9Ç0\|h399Ù]xÀ€Íš5s﮽ã8Í›7ç¹ó‹)%'Êÿ(K||U˕¯]u<žÞ½{3å©~ýúõë×gª¢?–)SDDºu“ýK22ªN¨bkG˜3‚àdV®”¶m%>^Ú·—O?-¾Ñͯ»i.åñxN}FJv¶<û¬øý¬«"bÚö€+ä*÷:˪>Ücóf‰æ«d(¹°r¥<ü°„ÃUëWJöïÿÁ-EE²aƒôî-))’‘!wÝ%ƒçªÒíë«9˜™E¥§§oß¾ýd÷{÷]¹øbž­%éÈ5rª±ª³Â—..Núõ“áÃåÊ++Ùo¯ø¡PÉ+UPP‘‘ùDŒûî»ó&±R©íÛ·§¤¤=zôí·ßN¢Q©Tä`’eYá“ ƒÁ`077w̘1Í›7ü«ÌÌÌ—_~™Å(UÙœã·sçÎ6mÚ$%%ä>GŽÑZ—üÐÛ &<ñÄŽü”²9­nìر¯¼òÊ/úV™™™•þŒ‰E-Þ²m{ô~=Û¶?þhá9çŠÒ¹‘–m_=zÔÉw>b–ÖzÚ«o £úSŽ>¼y󆞽úFã›û}¾«Æ\á®7¾üÚŒüü¼híS{<ïÏ›{Á…CÂQ»&ºiš7Ú4MÚPÙæR©©©‘Þdff–º€•RëÖ­;xð ã8‘UaéÒ¥:tX³fM%Õ˯ý»í%w…ƒQ¼æX—+ŒÚEüÖ}úAÇU«233]:þ¯¼óÑ9cïvl+z?BÕQmZ=…E  cÝ{O_9òr¿«>§æ¥Y ~7öÛŠVEºŽî½×±£µ4•Z5÷¹Q—ºîCœ©ÔÏåõz-ZäñxN¾‡ûÜsÏE®Î¹nݺ6mÚ¬[·ÎëõVÊPÅ%$Ö?­I8èÖÇÿíö®^*IÕjÔozº[¯Ä«ä›ZuÜ7æ©Õë5MZG¢®z-.ÉsÊøÅ„¢¢¢Sî­\ýõZëvíډȖ-[úôéÃûyåQ©Ÿ)òiééé"²råÊ«¯¾š(±R©Èäiûöíqqq"2mÚ´œœ¦S±ˆ½‡ ~õã=<†%Š^Ú*ϘW,OÅ>ý^{íµK/½TDúõë·fÍ–GlíÂÆÆJht§{÷î^¯—Á)‡Íe~^þòåËKŽ¶ÏçëÒ¥ ƒ=`ð¿ÿ]‘ðý&ÒãéÖ­#S+qÉ%—\|ñÅsæÌY»vmNNNµjÕX$1U©U«VM›6;ëÆ)´KëÔí̆õºvŽR¢”ºgHφ 6KOoܸáð¬PêÔùxrôé×¼–ù:çÝQ.Ÿ."×´mrË}£5jtZÆ͚5ý`{Î"¥­q]Z5jØ ½IÓÆêßõÖV¥È*͹ԶmÛ233Û·o?gÎœr˜Zi‘Ñw>ÕCý¯qºí:utåÍ‹Öí÷z½JDöf]ùÊᬯìúz×ýëmxäã"J…öf·™¾}ã矷ôö]/Ý=fÖîÍë7­xãÎo–?!¢ò^?ew—/÷Ìþî»mK_Zøà¶8Jêt‡„Y)%JD|qK>IسÿÀÞC‡æßÞù²Ì?æ—¸ÏׯŸŸ2æëý‡¾Û¿oã;÷<~ÝÈláp€Šá)Ûo—‹)6Šc\XX¸~ýú¡C‡ú|¾=z\}õÕøÃ"¹*ói–Ñ MÞ^spïÎ-7¬ÿíéC»7iÔyä'ŸN«U·¯ï‘C{¶¯þdÖþ°²µˆˆ“Ô`\F¢ˆ6›µ³ÃgôËHÔ"Õk5¶µ#¢§Ü·¨sÏQ³ÿõ‚¥ÅôXg9Ó7ض7Åcs‚þ·>ìÑZ+Õaüôf÷×]sàxˆBÿ¸oi·‘ýÞœö‚ñùtËжٻd|ž,\[©È&>wêÔéxbǶmÛN¸% eeeeee9rðàÁ—_~ùˆ#”Reš«ð'ïÍozÎÅ›´¬Û´ÕÙƒ/›òäú{>ùúÄI#Òî¸bø?ç™Ùÿ¬ŽÝÎLñ0ñQ¢µ(CERwìñ­‡u5ÊÉÍs´QCÿzOó¿vžçèºé)Z‰Ò"*9!Ñ“—ûýÃÞzج¯ ró‚Zkuåßî9#‘g 7W*///²‰_·në†`Þ¼yóæÍûýïÿÈ#Üzë­e÷½/Ü4´ö”}ÿR[DDkI=£Yã¤PQÑÖ^šþ…?»;r¿ÿ=zûÅïÕô„žõ»œwvM‘ÇV‰›Ÿýc«ó3W­YÚ¢–Ñ?®»uiõ‘ã†óTàÖJ)¥ÒÒÒvìس¿d¿~ý–.]úƒ_Ûã©Q£Æ£>zÅWH‰Ó(Êôè”>çOÏÿ_Â#÷…B¢<>_½›ÖwKÕrÁu¿ü™¶-š9†wð½s/°vlß‹Îýòþj©ÉÇÆÔ“Z-9òP 75%YDT«›?xrÇ¥t[Ž·z³÷?û$2CúÑò0SSS U<ºêöçžêñûÖ-žôÄU[üö5ç?î;P4â? èÖÉvÄŸÔnÓÚ;D$>1%ÁoˆÖ5{=ôÚ-_^6 KÐÒžÚ²V¼ãv𳣫À{a233³²²"_׫Wï…^8ï¼ó Èö–7²q×Úq-JE®¡uñá&í8¢”aZ;ŽÃ0Tq0•DNÅ‹,¥ŽwT)¥ÇÑÚ0 ¥¤”F•è–QZ˱ "ÿFDDÆ532:7§û¹êûIddmP"Žãh-‘AÒB£¸v.ûŠŠŠZ·nýôÓOwîÜ955U¢sR_©³LQÊ0Í’7û»c·*e˜ê‡ÿæwýÁÍÊ0Ž3UÚ”’[Úøþ%¿Õñïì–’gÁ(Ì¥¢(777%%¥Üâû6úQb§³›$0¨¿WP)¨€J@¥T *•P)¨€J@¥ R*•P)¨T @¥ R*•€J¨T @¥ RP)•€J¨T * RP)•€J@¥T * RP)¨€J@¥T *•P)¨€JPþþWãÄ»AøIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/overlap.png0000644000000000000000000006544613051004444022572 00000000000000‰PNG  IHDR7FÜ)sRGB®Îé pHYsÄÄ•+tIMEÚ  ;}XÈ IDATxÚìÝw|ÅÙðgfËUI§Þ«-ɽwŠ1c0ݦ$B5%ðB€@HBBI$„B/†PMSŒmÜ{‘å*ÉêýtÒÕÝçýãŠN¶ì@À’ËóýPN{«»Ó®4¿}vgg"!„rTâ´ !„PJB!”R„B(¥!„J)B!”R„B¥!„B)E!„RŠB¡”"„B)E!„PJB!”R„B(¥!„J)B!”R„B¥!„B)E!„RŠB¡”"„B)E!„PJB!”R„B(¥!„J)B!”R„B¥!„B)E!„RŠB¡”"„B)E!„PJB!”R„B(¥!„J)B!”R„B¥!„B)u´CÄÈ^~àÃC|{øaø‹Ã}Çy¥ŸôÇõ>:ìnú/[«Ënú_¶/ôàÿŠr bô;}´5‚Œ±nŸcŒ!;Ì·#"硃Ⱥ}¹Î·AD> / þ¿s¹"ò‚$Ýï¥ðS‡ÛG‘ƒÎ @àÝïòƒwSçë#ÀßúS>Äï!”RägiD{Å=7ܶ¾ºEˆÕ¸ô³/½úÊóN¶JÉѹv¨ õ bÝÏ}_}æì9ãóÁU‚Ë;W îxÆÙí!"0Zqû—¿á:éOç¤ýrÿòEo>ùÜëõ 4Md ›vç· ˉ;x! EÖ»éÓ§~û‘ェçÞG]V`ˆ"’gû1Ð<Ë>]øä¿^ob)]së¥3ÇZ¥Ãår¬¢c䣬@ûcãÏ€sæ_~É%—\8¡Ðöæ#w>øÒ§í%³ÐQydyðÇÙ¸£l«G‡ð!}tD"0ÆYåöuo¾úÖÞ:'c …@DÆõ€¯µrýÓ¿¼£±N"uS°6V”îj7:ãâKçͽlîli÷Çó¯¸qm«qð>DÁüè²›ÊK·V»ØG]V@`œ³¯_yî½¥[c 0˜CLw/ýàÙ¿>±°ÏI³Ï›¶ðá;ž}ëk·®‚ 9ŽÈ´ Ž¢Â6Ô>1I– O¿êÒ³Ô€ŠÞ\ôÄ}볓&œ:½¿ŠF ÕÙ00&6Áf–„ÔÛ[›<:‹sěΓxè,¾šÚ6Gr‚U•˜¯ÃÙæXìq±6€VQ²æƒw¿7eå&‘$‰!Þ%ÏÜyÿkßWVÕMœ#ÑI¤îö ˆ)yúEWŸ’ehBúÅ9£gN¿üñ—K_¿e<®Öv¯¤˜Ž8™3dŒé~ok›K2Å&ÄY€s.…kYŸ»­¹]KIIT8C¡µµ:¨$%98€æoßÿOÍp6¥–#9^B€Žúý_-úÐ<ô¬;n¿Ù!vçe߬X1gú8[’v¡ZŠôÀ{ðʸ¬Ê³¤fäšÛëÜ­n£~룿]pîY³Î>ó¬s¯¸yÅŽ*šçóçî™5ó¬Y³Ï¹öÿþ´¹¬Í¬¨À˜à{þÏw>¶ð §WcŒ­ûøé‹ÏuÖYg]pÙµ ¿ÞäsÖ~óÍw›KÖ>÷äs+·—Gò”“.xè±Gf&è‚ÌWWq‰W™«Có“Õæ{ ôÛ×®œwþ™3Ï<ûÜ ïúË ÆXíŽ%wßxÙ™3Ïœ}þ%½ò•€ðñ@{Ýöûn]°hM™Ì™«nï¿»iÖgœyÖÙ×ÜûT‹Ç¿îÓ¾/Û¿á‹7xl¡/¼¸5aò9ó¯ºxz¬ RV¢…~àE(¥HO²sÕŒ kùú•ßi©E9EÒKÿúÛ'»ùýO¾üá;ÿ#—>ºh¹@,YüÔ½OýƒÏ¼þäýŽªÅö•zŸ0)ŠÂ}‹þvû›ëœg͘’æ°ú*?¹ãÞ&\ù‡÷ß[xåDûßßÇûcfÏž1|ÐØën¹~âà‚HËË$5oø”‰ã&çÆ™>:\D),üT¹zÑæ _Þ„XÿÛßý… ¿ôãÏ?zôÿæÖløìí UàÜñGÿÞ7êÅw>¸çìÌ—þöàw¥µœ3àR uÏ ®®ŒqáôÑL4}ùÎÓ_íd÷?÷öÂÇom_ñâý¢ÿÌ9S óGͼìþ;/7‡ßÛ—|Êœy§+rÖ׬ÿò•ç—î/:&)ÎÒy„CÈñ‚Îø!«þ|Þ¼Õ€¦·ÖUÔ¹-7ÿiöÈ$‹õìëÆÏÍè“•j2)'¼¼É Fû;/|Txês¦“AÜðý›5•.¯f3³OžýýŠ¯7_ýøKåJïÿöniüÅ×_8UÑü§\|ëÆÍ·,ÿøã>RlsL\,^b]ºR{w¸¿klëÚw¸fó3®kž=›7ÆŒÿÅŸçf0/¿ùOÿ,2:%F‘.ÈYët»¶-_¿·Nºôêsæe \ðpeóŸü?0IÖëÿ|Ãm_4öýÏk·$™ níÚ•Ÿ-;ùêǧÉ•Xþü¹[÷Òëµ ¦ZTÕb‹‹³w^!äœèue ¼çÑw¿S2'Ì\l3Køß:B)E~†u09RS’¹/ ÒsÝváÜ3ƈŒôÔ-[·mY¹¸ª¬ô³·ßqž1\x›·7yûž4\@d…£N/{W}Þ°ä¡»UòoZ»åÜQ}ìÞW»ë¾¸æ%B×Q>¯4.SñƒEî»éÁ ÑÝÕŽÕë(ˆÜdKJI±¢×wö‚¹¿¾ñ‡Â’”›\·òëZj¶¬ûîëÍ—œÆªýjFzL´_}ÿƒðú‡±»ž¸&ЌèX¹²²hjvUKó²5ûmüáuïØ…@­Ã•¯©!¼“‚],Ð0š&¥õ»á‰woø[Ãßn¿î©'Ÿé—oqFÏÚRRJ)rD¾í™ÇNê²ÄhÜûô÷¯k±Ÿ4yÒèóÒÖç0I2qôiž`ÊxÛšÛ[]­˜5ñÎknëß´èÎ'^^=mÔ£Òâl¬pÔÌ?Ü1W¸=Àëñ¤dç4¬ùRcÝ·h ŽXSéŠvì^ê×½.ÇȳïxøÿÆÆuY^¿î£›îú[Æøs¦Ž4ëÂ"õóOe¡É\Bá×ÑΠ²d#O+€@‡ãäß¼ýØå?ô«7žýÇ'ýÅ,KÉé™3.¿qö¸B¿O ø:|ÂÜßf]$:ï› FUsíž>øªh¬É#r@I™{ÅœU/Þçê蛑 Ñ9¾Ðu©£ñ(]ÃïtGŽÙƒÿoª,_·¥fÊì¹ ~uÙø9m®˜“&Lߺæã2§ÇÓVóùÛÏ>úÄ‹µ.¿=§ -#côœù'«/¿¹¨Þk¹è¼!µûvkvn6tÔ¾ñüsKJ:]Ó5MCa´wt¸\®öööööv—«]×5@4‚æ -ýùx½Þc¿+Ó<.w;°›v¯ßP挹å®;.œ=3Ë!75ÖuèJaA¾-P±nû¦6¯¿¥zÕýwÜñUI5ü #OJ‹Oœ5ÿfGëºçþ³*'¿pÔ`ûþªú˜äôœŒ¤5Ÿ¾ñò§ÛÝB´€ÑÙ;‚inçÒ÷_}ùÝOš}>·Ë¹rùz4;Ò¬)\©Ò_¡ZŠ±ó`Œ[í1…E"c,%7ìÐŒ%¾©ºÊZ*¶-ßRÓŠß}²bÚ¹×ßøí¯î¾ç7÷ÆùW®ÚzÊUw¤zeVz áÒùWürÁc.?mþ-Œ\9ïÆko›6:Dz/ü93æä›ÛWÔ oÝ—¦“ O‹æóÃÃ0pР,I5ƒî_ýýr§ÞLIOOöµË¾Ù°»ÚõÝRcÁYgNþþÍ—ž­/]]±æëjË ;ûåmøÊbÁ$å ?ï̉ÿzã_gŸüø¬¹ßûÈ3wVíˆ÷ì^±µmþŸe“”ô´ØÅ«¿»(iÖœS,š[|áEÓyñÍûôÚ8_õŠ {ÏœgaJBä–_BŽÒý÷ßO[áh98µÚ’5.iðС}â¥`‹¼tĬ‰ÅýûmµÛK÷%N¾ö†ù™Úþ&#û´S¦ŽUP·o¯KXO9ÿò¹çMOPylRz¿üL‡Eq$gæ¤ÙÍöÔ¾ýÆLh©®köM8ëÚëæ'jÍ ­.‡ÅØVZcNH6Kºßë ´@  i@×Pr$§ÙÐë üÌìv{FFƱxÆ/2ü‘¢Z³ò õÉŠU!z7Ù2û÷ËŽ«Øµ£ªEæ¥Í£7Õ%ŒŸ9s’]ò”—×&Ž¼öÖÛ‡fÅʪ%§Oqÿô.)Y™YI ¶ø”>#FŒÌM­Û_¡Û2/¼îÖó'IœedÆ»›ëªÛL' S€+–>†¦ªû+ª sÒiÌ¿ôœ©±f9|•®K‘ã¨a¤;ÕÎCuˆŒÂ³¨sä·ƒ¿§ëÁsg =¤ÒAU‹Øºu{IéN‡#„¡iº®ëѱ¡ë†j³«šÛctÿ¶?ågÌÎÎ9rä±»¢6Tdh½ðnêvêíèÿr}QD Ì~78p¦®ŒÊ)r<¡3~G]DEÚšHïpè¶3iºŒöv`C,ª[yø»º´[º.8çh^·;Üq,RÌ1D”eÉðy¼À9£Áá—.‘zC» »%D5n"°H¯=µë!8vë<.çEC=2ƒË0zÅÈH³´·¥ùk£r6éÀÃê𢃷£…;hý®K£^£›>àÙèϱ‰½ÃnàCî&ÖýNêfƒF¿ÀXñp¯øsí-J;B)Ez“$Iœs®z¼©ïýæïXï ô]B)ulzWUV665ýÈk;líšµ}ûöINNÖ ýçÿTBˆêšÚ–ÖVEQ{8¥°Ô”Ô£aï躶ÿ~—Ë%qŽ‡ÞVþ@ ¤dGAAÃ'„8¾ÃI–åì윸¸8úã%”R'ŠWÞøO#O‹‹Oú \°´YöéÒþ#Œ´l¡kþŸ½¿@nWk‡ÓË%­‡+)ÔŠ¥jÜøÞ?`onq>ó껆='Ö/1®.ð{ÝW|ßo8Æ'¥£8nÇßeº®w4ì™9~àé§O§¿\B)u¢pvx“ÇNNLO?bÈê€}ú”~2Šj#UKÕWìqiÛ$ÕÌz¶–Òý¯fÀQp¶MÓt¡f œšœ|¨càu»cÊ+RúŸ”œ•kÇm-ÅÓ5ïþ ØÑÑN¶„Rê€qÎ9W~x“ŒˆŒqÆ%Î9çê‘iÌ ÆY🞾·†jL¦^Àã\â’|˜Ì¹—sιÄ$ùøˆ11FÝØÉQ…FHê9Á™X¡ËÔ·¡‘/£W?Òçhñƒ7…õüûþ°ÏZÛ_ΣsïBµT6,tuäfj¹Us™¦ëm:]îáízÓLhœŠÈØÙ‘â%º%:ø]Bw_EµCQ}ÿXt²v¹éç€é‡÷ cݼP»£¤ êºÇ ¡”:qB €ç „DàXøËnÃ#ºùîì9Ý5¤"ÍIø.^0xÉ)4ã¡Üa¬Ë›!`d8¾qBƒ)@ä>Òp¦FÇ‹z Äx[)B{{Gss£¦ÁÇ9‰‰±Z­ô;ÒÛ ÂÐ[Z[[Zš-rدªê±8î"¡”"?ª @ÍÛâéhV¬©fkã y½î6Ù’f¶Xà¿¡{ C‹¼¢$[%IF!cBè†æ&K²™1&tŸaø7I² ÀuÍ×Ü$I²ax¥È² —@膮#€$«‘²/¸Ž Œ³PŸz4t=*±8WTF(;D@cgiéG‚!Bªëú¨Q£FE¿#½^Fy¼Þ;7(²1 |>ߌ3òóócQ„Rêø¦Õ|ÿï?òȈËÿ9ë²K,&Øûå?þó…!?{úù3ÍêáTƒ­¿ÊõíËþ³{ÛvÝ A ‹Ï=pʬ”D+ £­jÓŠE¯c\ñÐSÎËé“ܶoËêO?€Ä!£Ngñ•þù[_%˜=tpü·o-täMÊ: 40ÎkÍu{¶TWV ”b3gõa–40Æ…ßY±vïΊ„¢ÉÙ}ú2°ªž]k¿n¬w€`j\úÀ))™YLsÏ8î [€³­µ¬¬ @°s]¿~ýè÷ãhÈ)C×›ÊËÊ !‚{‡s®imB)ub´’Éd‹1Y,Š ¨«ÅfW%|º…úL C²lToþt凟ÙRúÅ9ìöšµ½XQë»ü¶+¸Û[³qÑ’7gÉC•”âÔüiVkLãÖOJê¾Ïè?>>>sóËw-[ÒqÆÐK¤À®åï<;IÎ9œ‡OïIÚ]ß½½sW ¨f“$jv|ïì¸rà̬ؓs® «~ûW;V–äHYi…CÌ`X”@Þûv·Ä¥æÈ’!üÎý[× ™ûç‚ì8áq"ðÃtsÆ$‰#pèv\(Ò«õgœK<2àíB)u"µ ´ö†½•Û·¨ŠÔP]¥ þÃDU‹)&m켿ŒÛG´o}ý¶«*W-Üï¾"ßh¯Ø¼Ò’Z`J°Wo[Ý:~RzjÿIçÿ²âÑ¿•”ìJ“·.]Ý?vî¨)cåú ‹Ýa²„n“B³ÕÜ°îû¥õ™ã.ÉÊM³™Ðµo骯Ÿ“l™#FHsU¸¼,©h»bSsëÉY)v!š$ÙdI(4ãJ‡M_méW/–|örêüßؤöã÷ÎWB¥Ôñ~ jø]»¿}¾zÍ›Œ1ÍÓèöÚ~äàIÈd“Ådµ¢°q`LR%þº {J÷§ ž““Ö¶gÛŠ–º‹“ãó²Æ\4dØ{[¾{WÞÙØ®ñáÓ.KŽEW Fwà lGe™š64Ø„«ŒÅÇ™÷l©ØöMÿìZuUÉæ6#cèÔ‘å‹_«-¯NN€ [,q)öXäRÆÐñ¥å‹¶¶TWس¬àóÒ=7„J©crÙ’Úojÿá#e™7–~´yu©øQ]~gèÙðöo÷.ŽÕÚË«¾~3çe›µK>l3b'žõ«<÷§¥«76T•åÉÖô§]VúÔ?¶ì«’úüjÌÔÆA#Y H²VÓÑæ±'æY-’¡y‚„’Ù¨ªu·ûìÐÑØÔ*%Œé3xŒ^þ}I鲎â‚Ô$…0BGCc1ÉÌXå ´ ´»RLB~:º«·‡C ¸bÍrúIÏŸ6ï—CÇ5«ôù1Æe“¤ªæø~ã/{àô ÎÖ+¶n. 0׎úê­£µ¶rŸOGDÈ8937Á㎙øˉÄÂýÈDná×u.B}ó¢a\’%Yòµ7:›ê%á®(Ùâj÷®}-ÍBD2ˆ3ÆKšÏ LU$3gÇí­¯„ª¥Žw,xKŠ¦@f`èÀróÐÙw—(¶d“*7lß]×P«yaÛFÃãw7–í,mhvçgÚ­Žx›Ã.ÔÌ¢ÂÄpvÈ8—$Î%Px«ËgÝ_µ­©v\Nf¼ª ow6×VÙÒ.ŠµRS]meƒ%°jSíÍÝìgŽgñüIbœ™YÛ®5ß1{FLB-THB(¥ŽÉJÊð¹œõ•^·;øµîu¶5VyÝÞñˆ(ÀdOˆ‰Ïhh¦Š-®V×Àsþ4¸8„§jã;Ë¿ù¦¬ôÂìÌÑ&(˜LˆhÝ·tÍ;ÖZCƒô±sr&ÌÚ÷Ò%ß¾¡aŽ¦]ËýCÆŸb‡æÝk¾‘ûžÑoì8+¸Ì²«äÛ/œ­­ºœÁ7<Õe«ß¯Suî/ß¾±6oöuññÜpkÀ¨F'„PJ{Ô´±¿¸á™Sí)}%z²Æ]ÕcçÙ’ûªò©=‚÷Ý2aèšе€Ðƒ#-áo¬ÚüŽ†ŽšyQŸôÆYœMìXzîµ+†c¡ô@ rõ Q诳rÝ–º­Œc Ý'úLÏ?óÔ‹ß.zë[5nM|ö9)Lq¯[»ÕÝoîE#ö›dŸÌo×ìÝÕPŸ#„Ð<õ>Ô™5mØåfç¦1o£@Æ8ƒÃÞØK!”RG!frdç:²Ci!ÀìÈÍqäF=èïd z꤫ÿ=î—º¬Úƒc1²5cê-_M¾IR,6D:¤ sÍ+§3É,+Ø¡'͸õýSoB“ÅjàæÜóî]t¢~ÿÞº²Y1qÅä­ÞÇ“ÆœrÕˆ¶¦ƒY­‰Ù »$ ´ñ1gþz$WMZs “¤Z’§Ý1C0I‘Ÿu× ™"2R ¤š˜ð@äÎ'Š(B¥Ô1—RуçÇŠþú‡Ü>)«6Y èE¹bŽƒÎeÈ%Ådu„ WÌ1JçÓŒqÕlU…a¨«l2+ª98Ö·ÙŸ `¸‚ƒø1®(f0ȸl (+¦ê½ð@~4!9!„RêØÕz‡ÿ^ÄþÛI²šýîRà e]tý*zæŽè‚ñL¢È€|‘O}˜ª/êå)¢!”RÇbHuÓzGF;ïÕ¦½»„ ¦í5B¥Ô‰RÝÏ<Èè&XB¡”êeŒ¡¿½¶r×vC;j#"˜yéùy&“‚.æB¥ToƔ޶÷ãg\ fGlBgBÓ cô5ç^}ªE1m B¡”êÕ˜âŠ->#3wÒuÓæœo’†’916Öj@]!„Rª·!" #àõ¹[Pò ”câR%I¤ S„B)ÕûÕC½cï²—÷¯yP ·¼ü“Ïœm‘AÐu)B¡”êõbŠÉÖìÁg˜:Eá~!äÄ>ƒåÐÝJÁéS„B)Õ[…À$sZÿ“'Ï=Ï"ƒ yÀݺ.€¦î&„J©ÞÅCÝ[µéãÏŸnU¸a†É‘[0ò$Gl,Cš”‰B(¥z•Ð}íM -Moí_¿¿?¶ïisr:± ]˜"„J©^ƒBJtÉ}ŸLÇÈÅ'D&YT‹ êŠN!”R½‰1.Û¬q¶ƒâ«s€sB!”R½SˆÈÌ(`4ß!„t‹fþîIìÇÇBcÎ"cÁž}GÁ è„BµÕR]ãˆAç×t§!„PJ õC(X8®¢ç$„B)Õ[ Å t4ÖîÙÒ°§NL² =8=.•S„r º.Õ£C­y×’/ž¾ù­?ß²eÝ”!RNÑö!„J©Þ )ÐýžÚ=[kkí%åÛV·¶‚$…rŠz£B¥T/ ¸›êöm7Çåôܸ{MKmrdÈ(¦!„Rª÷ º÷Ôì+Ë™rí¨ “µÆ5Õûuc€ (¦!„Rª·0` »›wÛÐ,Rú LIKaÎò;Ý^-xS/]š"„P¿¬¤h{—ét5nzýžRÑÒêrùJW56ŸeÏNcS„B)Õ«µ”Þ^»¥twmJþ´ìBIfªI®ªÝR¹³";-M‘Ð=S„B)Õ[…Â_³å+—3éì'ŸqŠ¼~ÓÛïüí•Û¿÷Œc¡„"„J©^ƒÀ,iý']2xÀð‰‹ Hî;mÂ-ºµ¯‰2B!”R½“QÌÜwòÕ…Œ!Jº@ŽÍuî € Q¢³}„r0êãד0AÀ1@@fŒà!f™Âà¿‘ ¼v}*¸ü'vf}Ä_6ô¦]ß1ô!0êQO͛չ! ë>ên‡v÷TxÒ=ß„j)Ò#)~ppÙtèi;r¿Gñú„ɦ›Mœëƒ1†L€½.Eº%FWd?í´!c "g²î7ùý ™=f ¾'c Ô€OрɦI 0`ˆ€ 9 5à“ ˜¬Fs‘DmV@dÁÉZ Möû¸¦1@d’a² UE„à¥KIóJ~?ˆŒªY7™‘CíVÚœ„RŠáCêz›c¤%?̈‚ù ž_0í…kÏùãÒÿ×g ¶WÈ€éíÃnë;j­kËo>\qÉ ¦1üiQ…ªT–!"©~KÞÎoúˆô_ÙÛ!x¸þ†Z ÖDLÕýJöº³GpÅÔõm³ŠB0”XBke<ËoN²Ü´#e€À&´×Äwð–d)·|»U²O"µ¬š?L·@ÜÆ…S¼GÊ™ýù¿Ö/|ǧ?.oû×Ô‡0sœ»†?qKŸRÿê?}½ðòwž{שoœðÈ]IuMÀ]µ$”R¤'š+Ý×Ü\µ¹±jkcå–ƪ’vWK¨ 9t-%8ÄíÝ_íßsæ|o "q÷I+)@×¾lç7]w+ìþ cW•!ý”J ƒgïX\{c^eÛ¶ËS“nËþîÅ5ÕÆD^C)O´õÒ|;_ã²ax†,YŠšJôøñë/š•Q¶y¸/ÑÃŒ`œžè»=¸³8èÚ¢·Ÿ÷Žr|¥ IDAT¿yùM·7å¦j±ñ ÎY±à>Ÿ¯4¡Ì·ù½ôÚ˜µ¿}÷Ø¢€ÍÖ6xšëïmr´ÇT;CaOù¥9•Ñ\òÑ?~1þÑ_œúøüSÿvåôWúÝîÒ]ðP±‚ @ëpì\a¶/smmŠ?uÇVÅçGÀ˜ÎÛ Þ|¥câu[&ö÷Y¬¥KA Ÿ^û_´ðµ'‰e8w;L£¿IŽß=ºòþµ)õ.]æȘY¸úîÞ¿ÏÛ¶¦ßè¦dñ’ïLL¶ÂÝ•ÿýò½Ù#vlxv/]-ÛâˆÎŠOࣆ*˜w|“¶×¹wÊdŸÊår•vl›xý‡ÿ^TŸÐœ¶t±¿pÚža±¦v”tT]èï?ç‹'?Ý;¼Ò,™„RŠôÐQµ¤XR‹&›sÓ¸Ó¦{w~ðñ3—U4cÝžñC”¦íi¾o=mÿé£j†JÙ´2¦­˜×¿P\[rÞLŸ#«¶Ovü¶ÏìnŒÏÛýøJ*ø_f5‰‘{W• SÃõ}cgZeqS“UÁ¤ ÷þ¬v£#9¯Üš¸§o^Fõ·é~1O¯Íj°íéÓ§'P×76§üÛl¬Î®§Oz lum ¨~‹9x!/´]€34{£Ç—œz˜§"Æ% 'B)Ezò Z±çŒ<çŒë{þO|Þ9žŠe»6nòûx¦Ž1Á vǪœõ{¤æÝ|ßÔnÞùyÁ¶* Ac¢ï{‹Ì€æÒo|òìsÆ•mÍÚÕ¨™ ÔÓïGæc€È¥T£¶ï—¼ ›G¬þ<]¥nv—îs°XffÙe»c+ö$Wo»ì{|1U»rêšu@ÉS´k…¥­=mÿ¶W¨þ„ê]IUûQ6ÑYªÈ¾7 Ð`(€A°ËcZ{ÒÖMÖ—a’$¤àÐùŒ!úâwnŽ­« u¿ 3~„RŠôL9…B×ü`Èæœ!§ÄÇ°ÖšR¿æ=×eU.u4f¬úÚ“áµ²ä­k¹=Ï™Éó½göûå¦Ý}6mi:ƒµí‰ß_ÙãÜjcÁâ€ÿ­œC‘ ·/‡×ª¦4VËeeõ™²ö¯ÎiÕÌ’¿ ±Ì™BÅÄò­íJaS¼kHuµY²%åYú~½¤­ÿ$­cGr]sƒ%F‹iíÛToæ¦ÐM]'r ˸…}ÝfOjUJ¡ëLÈAnX7æ±ÿK+w7 Ì·•m÷€¦0ˆWÉðgîÉ]·•·ÕTä„D=Ñ{:¢B÷ï ˜l—eÙÐ=Bˆƒ×æúÊÌ­åõ毻öVðl&^7þý·«o“[–'W««ïdOžE t§Ö¾§ÿªwÓÊ~YÊ”ÀÿÒ‡B ÄĨūW4äÏùìŒóÜžf¬Oý¶ ?}¿OMmÀêL/¯Þ6éêOGø=-†d1eàøåkr'SòTjCÊ»×/Xåf¡ÄÙÜŽUä•–87pÆÄ ~Ò ×X gJùø‘£Þ}²ºÿÀ=£³˜]…AO>™^Zµ5xkÒlüàÞa¯±ô—§û,Ü0AÞ¢w²×n¨Ÿ"¸D=ú ¥陳>Á‰KÈ hþV@‹Wce.ܲ1¡ÅíYëSw~¹+Þ¤øL »gœ6êýOÒ6|mÛÿ›·¯¦®€ ÀZ3þ´Aß=‘¾ê»šó§@àhÖP%GÞ›»³yóÍ7VË•ª-Ô@fC‚©ÝfUqŸ“¶Ö›ÐÄ—¶äŒ˜PóÌp_eêóx±6IÕÜq¸ßâØ—6mÏ®‚6_s’ "p‚ïõ`ßIÕ/ïšwwΪK&Ý5+gêì¦GòŠÏ³7¬Ý{í[U…fpºmÆç½ÈVziÕ bÛž5_~ÔxöC#@p‚L )B)EŽüA5Cš·½£µÝßTWºô}—×<¨`˜ÉdÖXÑý¸˜0ŒØ¬]ç\»ox†ì.{Y xÖ†yhA-c̪‰çj¹Àp“sÈÙ›Ïïp;ÅáË?¼aC@à²ä/+[5~îúb“\¯q.#C—9ùûg$µ:¼òÒ §WÄɲ¿ƒg¨¶|1yª·a·–}Ò¶§xô6Y çhxõÒ´A–Ž7bNô[¦X°®E@=qȲ‡^ê÷î‹É›³«òøm ^*™}*ø‘™w_þjQþª5™+«å}—ý¥tÎ\·Ma†úÄPRJ)rDªQø=­UÛ?Õ°í}ÝÓÐÒÐ’}Ò5F R•à¥›¨ŒB&· ›^ß_G¸À༊HÚyÅí àB¶†²‘Hî·íªß0¦¢¼Œñ£Z4 á«4¨š.Í{¤`y‡`æ …ã¸0™$ ìçÂ+Ù¿š|d§ç’Ê}¾à™=ŽXçÈÿrHG¡‡NzÈ'áñ9d }Ù£·^S¬¶»e]èKÀî0$” Æ„=§üÜ_לâT|†PÕ@ŒÃPd&Dè®`Š(B)EŽ0Éš2dÒ·ê 2@yXzÿ¢±§¥$:P`7±Â˜Jx8†€Š=T&aT¢ —PŠA õû±§ˆ‚ë IE€HËê”sƒóÈ›±Îëk€²nˆ‘!°HW4Æ IŽ¬¢×Á±E‚¤£Pc}‰±ácä"´ï¹@dæ€#-€¡§˜ŒÆF"”RGáuäóÀ1"ƒ ý¿Ü¨‘‡"Ãå‘—Â#|g·eŒ:íªáQ9Ä%Yß(ź;Wià‚ƒB0`¡º*RGE­|¨õø§cÈ‚—O»Aƒ3¼Õ¢²38ôQק0ô¾~"ò-¡ÖùĮ벅#»F„ú£cd,Y o+oOŠ*B)utx††à>08:ÿµBtžá!Nƒ±Zä#ÚXqI:¸£D$¡ºo‰Xøß.¢?ÿÁËügüº|W—­qÀ;FŸ|êîÃÀ†NV…7Cô¯#cákV¡dÂ.;#£ˆ"”RGÙ'" 2Î!àÞ»«d[é^§;`²;Š \˜-³ÎÓYWBÑ‚íµ·µö›%+Ó†58©}õ²ïÊÛƒ ¸bÍï?dÄÀ>VUBì£ÕCæ ë®Å'ÇeQÕe_G&äèf^vÀ³„PJEµ2Œ1ô|¶ðÉ'_û*¥p`vjœ³bË?ÿá¾ðžgnšž‰”¨Svpm„¢½jÛ½¿¾ùäNí3fÏßúsCêˆéC³ MÛ·éûÍUúu?ù‹iƒTÎzà–”ƒO*æÜ&!„£1¥"mukÅö—^ú0ÿì›ÿtó±à…»Ï{è®?^4ý…Íëôc¬ÍäjëP­1V÷{:ÚÝ>IµÄÆØxô%(&)Žø›‰ -³pö·Ý6£8ø¿¿pæÏ->oLQR¬éÈwDCÆØ'ü ˆ¾rF!ä讥Â<g»_g´Þs®üM[â*¯Í;?ýëguŽLxù£3æÝpRVï½µ|Ó.srá9Í:²ŸEáѵQçlíBDúÄšóÊ¢}~]0õ@þjîÆÚò=9»â!¨±™ÉŠ¢Ðï"!„)¹ÂœÒ÷¤±©Ÿ¼ýšÕÛP”—‘šš–“W|ëm£õ}Me‹½Û°Â® :×ä)ûçßžùhCë¤q«6}ÿ‡ûkbûãÄþ™œ1ăÎõ ÃÝÖâíhsût0Z—mÜŸÜg´E–#]æŽàÏÅŒÖ]ïÿãºk…l±ÚmŒ¡¦aæ¸Ýúë´EètÆBŽ‰ZŠ1@À,Iù×ÜzöG|·æ«U_$ LŽÌÙó®>{ê™KàçSîëŠa‰¿|mcz÷ßÿuæ ½qçߟyG¼‘3vÀš°§L½èºÿ›ÙÿÀw„Ň1ÔÝûV¼Ö¼ë3ŽB0ë so?íT³ÄÒx¢„rPÅr~¦ÐØ<V«¼áÓ·^}狦ŸaBÛ·npG^q&jP0qsfFJsõ¾ïVn€º’åÜÿàŠ’ýYÔ\æÂÐuˆÂ0 ã€i21¬‡&>gL¶&dgÊ,™U4Ô‘Ï#FÓÜBÈ1TKõ3íŠ37¾úŸÇ¬ù´ +ÉÓX¾eGùÔ_Ü7s˜ÃµFŽ±[‚A[ ›»máˆýlL¶æŽ:wÖü«L²‘1® „@`ÔBŽ…”Š Ä•„ ¯¾©høøûj<š!åäž4ûª ÆÇ)(~×Mn l©—^{KášuUMygÌ:fâ ¼Ö9=,³gô»ó÷$›­Ž>¿ºîºØœÌ.aس? ÝU»k÷ú¥&I†,ÉÉùÅ6‹…Q!E!ÇDJ…Ûs@DsLÊØ)3†è†`’¬*Š,qD´%õ™”€ A2„„ìÂ驹Mç²¢ª*w™ž“~=»…®ù…!.ƒ$sÍçö¹=¡{#ƒ¸ ˆHQÕ~Ð6F@Çm/L:×L¨–:qºÆÅ—[4>…² h@ÒÀ©*±ª\‚¨Á“Ô¸„tÕlg¸tDf2“$Æ8㼧›^‰53>¢Œë «Ûk’b²'¤Ê&+“ŽçÃ:Æ€ Gš“PJP¬fyó×o:…@Ƥ¢Ñ§jê•ï>ƒˆ\R2MÎmkmîÒvxÛ›·-_´sµúsFc‘¹Ñënóv´±#ƒ‡í€×ð1&õzk(+²ð¶nþêõXG< À…Ð C@ÔeB…¯£mÓ×ÿ‘C]1î¨àœ…fSëÝ#*Ãh¬Ø–lRÇu#9ÖŽŸè¸éHs:nñPûã÷ûׯ_¿fõ!ã‡ì|΀áo&ziF+™3Õ¤ß]'Ÿ|ò”)SzôS †Ñêl hÆ8Ê’ÒÚÚòå—‹+ÊËÙ½YŽt«}t¤ªŠ¢(Jdï0Æ.¾ø⢢"Îé¡ZêxçpÄ…Gîc~¿¿<Þa·Y àžç½K’¤¤ÄnŸcŠÌq1M6 íB(¥N²Î%AÐ 1­§WN#°k¥è½šÐ™ö!½Jøm mÚ;„P-u ¥/ÉÐÖˆ—Gχ9z>R¯oÚ„RêÄÛ責ªª¢/G#"çœóÞévLèÈõyιÉdêõæ˜1¦(ŠÉd2™LtÆ/H!IR¤3$”RÇ?EQŠŠŠ¬Vk¤™î­FÙét677K’Ôóo›œœ HDT%''§w÷Kp_ÄÄÄŒ=://ú³Ev–$I©©©Q¤×þ6©¢ïÉ?x8šN÷ïÚµkÓ¦M‹¥çòòò† r´mêÒB‡P-ubMẮkš<óÖó)¥iÚѶ}"…U ´q¥9¡ãóè,ß#ZaÚ8ä¨B'ß !„PJB!”R„B(¥H‹º˜}]§ë5žÃ_ñÁ²Òá¿;_£Ë}¯ÔO”r„Pï‰cc,8¾çÑW°C7Æ¢` c‡c‚ÓRDÆA®yèL„ÈK»uÿœOWUE’¸¡-ø™¨÷!„j©»–bŒq¾íÕ‹2“ I©)))I‰™}G>øÆRÁ8g FGÔÁãü0Æ™ÐJÞüCþÀ+œ²]aáJ耑 Ž"à×爂1@d†›…ËMÛž{øî+æ]úØkKôØ,` QPDB¨–:±k©àa…¤Ä$g^zí]cóŒCMɲÇï¹´ªîÉ'~=‹‡*ŸÎÕ‘1κ.äŠÉn·É 0t¦#³ŠDÞ @ðD¹ùÉ×6ýâO·{¶¬Š €™UæÚ½òµ¯v'Ž»àŽsÍUë>ÿëãîùWÍKaÍ¡ú‹B(¥NìšJ€d{ê´Óû¦œvºQºúÙ%ŸÕýjV†Õ__S]]Ó¨s5%=+3-Q‘8 £¥®jMC”ìü¾©qfÊ$P8x[]j\bb¼IðVÕÖwxôø´¬x‡Uu7×5ïÞ°nóôV—%cLéÎ=yƒGŸ06VÒFÆïýÃÓ;*NMÎ73C§½C¡”"ÀþðÙ9Ôv“a zÉò~÷ð³­…>Í1øö»o?sT^Å–%yüÙ²z—fIÙÃïüý±²²ÂUñý²eÖÓOβ©m»¿ûjÉÊ]ÕzÀl #f]uaº÷¥¥üкfñד‡e†‘ PN>'lÜçòKÜ&q.ËÀ}-ŒB~º.u¬Ec(Œšò]%;wîܹsÝÒ^ZR1hÄ0»É»ré×,÷ôÿ,þâËwþß¾nÑÒUm>×›ÏþÝ™6ù…w?_üþ³±µß¿øŸ%ÕÄPTïÜþÆkoj)C§MdÏ®Mkwbö% ~÷ì¿¿`ˆé‹[ o¸jN²­ÏÅ ®3»ëpÆÀ«W±˜$‹<àÚ»u]µ¹oÿì Žuó#„P-EG_û+{è‹8€p64$:çÆ+çÅšÔÓ.¹uT F¯­Ü²g·ÖT±nS¥|í53Ó¬Pp÷ConRm{ÝÎÆçÿz_ceˬùs¤Ž¦¬õˆvkLv[å¶÷J½Ùýã>ý¤¹¥Ùˆ0t€E&³BÄšEíÞí+W®ÝT%θøŠD©Õ0 Î與B)E™b?}úÀÔ8@¡Ú’§Ìœ•eÝïmÚ¿ó›u{‹Uk­*«i*–dOke@µ(ª@à€¹C&å‚Øýîw~¿®ØÒLjÛ[ZšŸ6Þ®:þ@cóÎÒ¢4 Š&Œ‰‘†Á€ÁžˆÈ¸dÒ%ë6-[·;`O¿pþÙEÉ<àó—¨÷!„RŠ¢`ªõŒ‹.?%/>zykÃîçžø?éòkN™"{KÖ99³Æ¥1o›[78¶oÍçK*ù Cq$¥Ýpß_㶽rÿ³_•ä÷[£šíyESÆõã†/;¿Y]oµ1Ö qY˜ ç¾Ûkaôìùà ÓãÍØÑáF]Ó AE9è,ͱF] ¸œžà… ÈMNz ÐÔЛš?d@^}ŶM;v¶4¶XÓ† Í‚×^}kíŽ}û¶,{ø¡¿¬Þ벨 ØÍYý ¬ÎkVlª„Ü$uߦÕnLŠUv¯þzÉÚ%6 # µ¹ÜFœÃaÀâÌÆŽ­»œÎ6ÝY±iå·‹µbå†zƒÐí¾„BµÔ‰ZC‡vP¬±iéiV5<ÁnxЇ„ÔüsfOxò©»Îÿ -#51¥hද?\9cÒe×^󻟼ïöe²áQR‡üñ²Óì›ßHMMeHŽÌÓNX÷á¦òæSO›5{ß3Ï}¶ð¹oeÑfÄ]zÓ5v½ÅŸšdkxíáGÎ9ã4;oÖ8z;t±uíŠ}{¶2¡iÖs®»%ÁªõD'„4Wï±TÀ˜¯µac[jvnŒYaÁuC»½mõÛ¶noìÀ¼>…ñ¦Àî½5Ùý†¤ÅVUìÚ¹«\“ìEýúd%û å®ôœ‚ê²]¥Û6yÜ>%6!Ϊh-5µ m›”™•î´»bmjSíþÚv–“ßWÒ;p™éí®öO;G䎤$³Ì~ø؈˜=räHÚ¥„J©ã«œŠš†.4Ãw¸œÆY7ßú–PßD\Ï0ô;J·m/±Ù¬hh†I–9@p?M×c Ê²!DÔøIŒK’ÔåÐÐ øÃ'È£”"„üptÆï؉¨p „ÓŠAx0rz/ÒɃ¡*´B_„¿1ª0c Pã„aˆàK0΃#,iºZ~iaèÂ8è`‡1êãG¡”:‘‹Þ¨Qö¢ÇDï`ˆÈ0*“¢ôc‘µˆ“à8µ‘—ˆ¼Aðe:»¡3v¸)Å…ˆŠl*ÁJ)Òóš”#:Ÿ6ÍÜÁº®Ðݚဟ·Mï­„ÎÒ‹€B)u¢ V BˆÖV§×ï;Ô\SB-­NŸß/zþÊ$‚³ÍU×ЀFÏ«„—âE¡ZŠcé8œzO—Êöí}æÅ7êÛ ÕlEÄnƒEÔ5MÓŒK=Ý^#pIRU{öuw,¸jøÐÁœÓm‚„P-EzUsc]@/:mvL|Š8¸·ÖX]¶wÓR“Õ®ªìÑIáÑ‘’•]<\Ñc)e²[¿]øÏ6W ”R„PJ‘^§ª&‹Õd±šºÍ`2›dYRdYV•ž9TÕd¶˜±Ï÷™-`6›8ç4Ç!”RähÀÂÅv7ÆãÃzTðcAÕoˆÁ°ÛB½þ¡”"ä¨À9?à¢õú#„RŠ£EG‡ÛélãœGê*“Éd±X¨!”R„ô&ÆQ¬Zµ²µ©·Ùzæ-ÝrÉI&\÷»«Ïyâ‘'Oý·m­»_~úµq×ÎK1„<1ˆB&É’ÄP×tCÎ%EQ‚³n- ç²,sÆPš` M׸ª* E  !㊢ð¨A¨–"„¨Z&ü ÍÕà (™IBjÜU·Ýÿ‹sF–/~kî…·îhØrݬK/[öïg|âwžýã-Ýôï}u~oݦ»çŸ3`ÀàÙWß·¡¼@Ê7}sëÜÓû÷›6ûª–ï`ŒíøæÉ3oþó^>oêÈ!“ç|»£fË—/ž<¢ß¨“Ï_¸¬4Üi“j©ã“tÿý÷ÓV8þÔTW–”7Ú3‹M{·WµÀíji®)—U“$÷ô=C{œ#9£'ßQQaï–u²§!ÖntK’”’’RXX(ËtRá-¤ÂƒvX8ß±ñË÷ohëð~M7R ŽRœ˜˜”š"mÙä¼í¹§'gš·¬[üÚ+ïùÔ´™ç]å[ó«ëïWûOýÅ%³yù7>ÿɘSf˜ÛvÝ~Ó‚šÄ)·_?ÏÚ´õõ·¿È>5™U¿ÿö[öú/¸ü²äŽÍ÷=öâžZqɯ®Iöî|å­ïÆŸyVš]îþ8Eœ„ŸS °ØÜ¿½÷÷Ï¿úæòE¯|ðª/)3wÈÈ ³çœ7º_Ƹ1ƒãmk‡õËŒm/óÔÕ' ?û÷¿'_ÿ¼ã!WÁ)¿»r^ZŒeúèŒ]so|ýû:5yÊ7ŽšvÁà¹Ø䩨~µ±£!WÁÖ:ë=OþazQòÞé½Oî¹öÑggdBY–´ãO×¹¼CS-´+(¥!¤{œ¡³±AÊ÷C“›k*ÊËËwïÜòÎë¯Þµeÿ3OýÙî÷Bø@h~5}TßÁù* §¥®Y‹Ñ+ß}õ @1ɉý@b–äìñý“¿x믟qÇg8— IDATSëÞÍ5^nRdн˜9£ÂÝ'†ŸvÞÅ›J¿Zøφ’A‰1&ÍݺfuùEóo’mn÷ĘXÓÇ‹V$‹OôØ‚×Ô™ç]¸öO<ñأË2ö­û®JËÌIqèÙÅiÊÊ7ž|u@¼(Ù´±MÃòÒò¾yJZŠC–8È&kzz’Ì*fKBR’Y¦£íãõñ;>Q¿P¿#YK!ÈÖøÆg%Úü>¯a j‹Ÿ:ë’ófNŽ•Q2Å$8̆Îóû÷)èSX›oG„ØÔìaƒ Ñçqûô”¢Q—]1¯8ßž“ãniáöÄ‘ã'ŽÒϛԷxàðÁýŠóS̪d²Æö< ¨o¦‰3Õ›WÔ¿o^¶M¥=Hµ!„$t“."Æ&eŸrVö$¯' ²ÉbQeD&{ê™]áõë&‹UIKàð~ˆJvÿ1÷âñk&‹M•9šìñ“fœ7ÂíFIµYLhh¾€¡šÌ¹¹Áo1ÉÙÓNÍ^Ÿ²'gŽJÎ >AwõRJBÈA•‹Œ7êIa²XMQ¼n%)f»ÒåÛX0§€Iª9F5‡VÖýŒ[í1¡%ÅbQº–n]j¸ðË¥!„t—S¬3 ºFEäq—ÅÀ:OCG?|pˆ^{Q+vyc!éøEW !?=¨ »¨`ÐÝbu¥ôàpaÿíM€’‰RŠB¡”"„B(¥!„PJB!”R„B(¥!„J)B!„RŠB¥!„B)E!„RŠB¡”"„B(¥!„PJB!”R„B(¥!äÀ®°ëŸçå‚BÿŨåˆáµ¢Vø™F<ðÁzê‡ü ]c7OÁ?æñæê%„üX¸9ÎLÈgÍtôŒ…/9ø庬ÓõK&yp:ÅP81,Òp³ÐS CsÚÿ\“%2vÈOþ¿=œ³8ô!Þ˜,4s1ëºeXäÇÄCNI)E!ÝÓ` ˜ÔP™<^Ð5@ŠÒ™^¬ûÉã;—ëèÈ pQSÕ  üjÁ÷bh@@&"ÿÌx$T´èFçr.¢þŒ:è¢3Qdd)T±C¼cººJ\YI¡(2èìú‚â £”"„C¶àŒ¯þù0,©‡§‡,G—¼©ÝO>‰pË(H­¸’…3`Ñ¿à¥%pÙÍ0{˜xgQ¢wÀﮊD¸ýv‘ª¢‚¹¸c)üå9ÈüÿöÎ<¼ªêêÃï>玹™C`˜APfŠŠâŒ¢Vm-Vjk…Z«ýìdZk­¶uÖÖ¡Zªu@Т  *ƒ(Èl˜ CdÎÍÏÙß÷ÞL­ÊzŸˆ/‹‘ã¸è|²¥e-:øûÛ!Ô¬ç¥2÷%^C•¿ÅV{—s׳üç9^y/±uÜ˼1›—_áñ§ÙXŽýõÔ‡ÅóØ£™þS¦Ïàò‰”Ìcúï©°‰T²b)øÙÿqý ŒíÉ]¿aæ\DÁIwá÷wð“y¤;æTÔ϶Uä$ÍË’¹è+U+¿_ühñO–|Ȧ*† bÛVJ÷RÞ$E¯¿‚7— /bþËüx ùî¤Ó¯Œw>༛Ùð,‹W0¤+n³ýoÙé¦K/N‘ø7/‹ïÍ`Ónú:HÉdà‰ 0b8å+ød5á)8̶=~Àã¿â­<øoÎè0z ó¸õ®¾ŒØZnù—ßË]ß3šÁEüf6kw’;ð±2D¥‡Ž¦VWy‚CƒÆRf8§s­ÏeG#.+’^]å  Z[ÎÔúyÓ°mÛóû**–¥”Òš¨7ß“ÂÖÚþJR¡ÑJ9ü|Žh­P*–’È-ˆºØwåþ”êöÑågå²sm•háäÛ<܆”RI[*ÆÛ‹8q"cÆ0÷jÞÞΤž Q9°¹ÿæÜë(ØÉ“‹ùè» Ïk+¦ ÙÑìV,%å¾:>ʶR†õÁˆ‹Q„Ù³ù~8˜ïÜÈêmœÑ7±×/±1ÈS“xuo¾ÍÔsÉ÷ñut]¢a‚a”M, :“æEk´M(ˆ Ñ0±a/y¹É€¥Zûc¥ÌzþRÜØãôéìÍDzôe6çðÄä&U;q2ßuÓ!mƒ’è áÀ6ÌœHùøE³Ý£ÎãÒJe¸†ÎZvêEk=áüú½g¼3DzÓj¼·i¤G¢uÇövŸžåÇ€+/ø¤2;;jGÝN3Õb÷qcÞìÛ%ö•µB;I_û¯3ß®ïÙ?F +âò××õ;wãÄ)~oEÏù.^UV_ØÙ2”¬J©1¶M™¾cè@›c$èé(4¤Øùkª¸é$Î*¤ÐË¿_dÒ¯P #¬yŸÅ~®?×Jþô"‹ßeøE¨ƒÜ~Ͷ{;Ë×2ôj¦^Â[ÿdáÎ:•, ¶ÍbI€×~IïtJåí8£/(òÒB:§O7êN㙇ٲ—üžûÙR&ëóÛ[ FØφ œ0‰¹ØE¬ž9ÏQ½;Ƽ»ŽnÂë8d¨È®2öàüIñ&Fã´&=é×®gÙ: 9.3ék׸ӹâÒ¤D *%ãRZ©«®_i©U8`͉§¬|ʶ¡Ã ·Ì;kч·/5Xݧl_¨û¨‡œöÉð1e]3‡½÷ŸA{«†³°~gw:lÿÖ„OµvÈÉþLûä^éñئ¡¿š»\›xÊV®ÛQ>þ’-gLÙ>vbuŽY<û¾¢Û-g0kã/Y»N¿xë™o{^´âf>–âÐF³'|Í$¹xáÒbÔ¤22÷çR£¼Fj'R\Øy1V¬`8#Þ¼ª4ÿ7¯`“ŸîD,úôdö ”V&NtïýdOqˆ}6]2YúNbßÒu¬ÚD÷nT ½ŽÝ,[—”(ÝÎwRYIeµ~´bÿJ˜Øø먨 ¢‚@Ÿ‹u[iˆòP‘Q¯3ùãVW,FLˆá4p5ž5^%;†<=ò– € aOZyQŸ-Ý #ZoõéœÞÝGmZžáƒ@JöÞnÇoé’ªc±=Rú¼w·pЭ1̆¼ãvô´»n—a¨ª4£GÙ ýuêþên$íð;tÙ?dP%P›Ÿ½íǹ۶˜#z[fj]—eC†M”1´Æ½zòÍo¤úCõi®6¨…¯Õ݇JD.„Kyo#×𫤧±{{÷3k-W ¤¡’×ßaüär¬*ÖîàÀJöî!¯8>Ðhé$}€2¾ÆÖÍüívfû(ÝDŬ¡o!u¼½ýa.»;Êö5ø+™µ‡ ;Q²‰í»Ùô4% ±jÙëç™yÜ8¹ÅÜ£v!b1äLú#Ê› Køù/yüU®?G—_Áÿ]N$Œ²ùÏ#ÜôcObHQË Hþ•J†—» Ú¸Œ„yä?ÀýbìUç0û ‹J¸Cc~z€â“? Ï1Ñ€‹J ½Cíˆ=¡ ¡ì ɬ­ßßmtÀfa(m9ÃOP™Ø¹U{Í´®åi1e*v‡üžPÀmªËcFæ.V¶n‹²¢N?N5­Hêž-¦N­.,²±ÚŒ\~sØF,”»z] K¿€Ï£Ú»-þ‹Z£ «W°n×ßÄ°~X1¼3¸çž{‚«îcã«”gððãdÕ€‡²÷øû\>ÚΉÅIG5yüÎÃM¼Q”©\z&iQnù-¯¾ÈOgÅr¶×ñ§§Èµ@Qs€ÿÊ sá-¬ø€Þ§sÁùd™n&.à—³X?ý=íïó¤àu‚ ¸˜,7»ÊÐ1LÒ|(p»  æïÔ5T/“3¥òz0 Ë_§üÛdä&.rÛrîŸÉ)?dÌÜ9%Ëè22Qt`O¿Ì´¾ÉÛùæWwQ)ËT˜û`qª×V*“pN}ê¬ïŸZ®S¦éôï<å…;{¥ºœ&j*ê{]°*7=dÇ´Ó•ºzö”†cA—ÃÌ®¯ÞÓ÷•ž Ûê+Ï7ÔÊðìÿð¤&FˆªX8åÀîú¾“K‡ôÑÖíÖ… ³óËP*TÙaÍÚ ¿œ[—áRV"PDêðzü Þüª?S¯e`~¢¨üunšÃ²ðàß0‘kÎKîs ËWðÜKœ1”.Ik¦VVˆ–PapËÏ8¯o¢hÓÜþë73Ý.bú·‰Çî…«Ù8ùoðÖ©¬ÜʈI\{Eb—Ð@þö~ñ(ÿ¹¾]Á±›Vóú`aGY½˜õ5Ür**‚¿Š%ïÓ;ƒH;À¿î§ÿº´˜àÜôè4ÊÇu3øþüúV®ýÅùìXÃí71àý˜ž=´éÂ<ÝùÎT>ü„¤´«•}ü0J>æûÓ ®þ%ç&¶‰î=X°Œ{7 5v _g~3ƒNi ]kg©FCŸ³ù]-<Éon ÃG]¹#ø¿I7¡ŸþŽðï¹ï·<™A$„;‡ŸÎ _ç¤îJŒŸp̨”a¦n;qÜââ‚ÊY28mÚsN=ç’ U«,O‡’áùT$b¦ÄÎõ¾Vܧ–ê2dÅéï©Ûc(•¦ëÎ}ë_£—.Y?mJUŇù•æ©(mG3Š7}ûš*#jhå¨ÛÓï™;ºÍý×–!Ó´6«Œßx錀i)­œÕœöó Ý–}T1e¬¶%Ìï0[Rqò˜q;ÞL|FS4D·‘<õwR¼Œ9‹¬\ht>ñ*Nk '7)-¿0W “§rd›M6PÞhé'Ó’]Ðìì.NžBϱ¤¸A‘–‘ô§2ùÉøC8“ãgíÅÔ›˜ÀNfBrºÉÍ#¬®\wSƒM£l¾4òrq‰tGm<: ŠS'Ñk85D-œró阛(,êÇíaï>BL'Y¹äã1ÛÈþ'*%|Ã;Å ËáŒ:]Qmãô†”GEC±PX)@ÙWÔåÂV†ÓušF8¢b MGÔéŽ:]Ê0BxµÛí8±-«]†´rXnGÌpíM¹\ŽpDi@i‡3ævÆNCcgçëhȈ%Ó ˆD~L“O>ÙB›ºtM¶ÉÍü]Z“–EZ&‡òX)ƒìÜd6ÕFϘ›ÎEd&̯ÆÓyÓè–Ú¬Þè&û,'ŸœöûÔšœŽä4¿àä-.ò:‘×VÑÁž…& ÆpÑé8:%?l }Ô`]@vÇÏJC]TJˆ¿Jʈ…³÷íèâ „µîÕg/z+–Óµ3”‰rDrʶt%EÙvw*GlصmÈ9UNe`»kÊ:íÜèðïsšj ½¯ï†-«ÏûQU}…Óøª“”¶ 97™ªÞ°íÔ z¼·èÀ¤2݆ñîÛÖaÃêCk;\8çWƒÝ6:AÛ˜HôÄáïá4÷e%Ý}mI‰[ŠYëÜÍÿU-¢ÿZlF“橃줉\?3³íWºÙ/ZÔf?ÕBÏZ¡14¿é›ç}çX˜2%*% ´˜:åu^þÂ…ËT¼æ7ô{vò÷ÊUË“¹5ÇwÜ[›&ZkùqÀ¥óö˜Ñ²Œ®¥•¯Žyj™Rqg,1u~íÐú«Å0hÃVÁ‚+ºnpçeJ+ÀNÉÞ=áæuÇ[Fyuï…s¿ë}4 ;–ÙcÙõ×íîÑÁ°ÈÑÖÇiѬ*ÚhmÕ ü}ÜL·i6(Õöö‡:W;.Þñå‹Ú¸¶Bó]ŸõÄ$÷„p,`ØV•#畳§©¦ù•J»|AÓvXvyzÑÌ ®krª+GÄåÔà°c+³†¯¹zHÓ¢l†#êrkÛúªáJ©(5ƒ§-øëÔfÑ_¦åñÚ®HþŽI·•N¸¹É[bº£—²µÒhCÆ¥„ƒÍ˜Ï­ZK HQ)áhÆÆŒ¸Z;XËF)K™–Ë{°ùÄ gÌílù²[*¹LÛ—~éã‰nµÃ=¨z*[+”íöZîV×C2Õì1‘3Fø¯%J+¥>C’IR”’Þ¨”pT›Smš>Ê ÅÈ@‹ÞiB«Z×j…ŠgFÿòž7•ìת¶F,âÖºÕÑš¸DÉl)¡¥Y®“‰'BþÚò²²šú`Ì֦ÕÙ!· ?Ïã4l[,Qb[‰J Gá ý_rH@%ó}5©hlZQ$‡ã5æ!ƒRBÖ†A ¦lÎ3Í~ç£`Ìáp±HØ›S4áÛW^0~DºKµiÉ£;ZúÐòAø‹”RJ[Áåóž¹ÿ¹EC'Ïxò¹çÌ™ý‡ÿ84§ö¡?ýáÍ%*”U,+XSV^³$a±¨” Âa2¤”R:¸óÜ¿ü­Ko¸éŠ³òÒ\@‡nnºý–oe×½6q­åùÙGž›ÿþ£ºõ®ûgVý„‚¨” Â×I|JÒ¾›Vm‰ž9f µŽ/ÌDzß3Gõ«Øº¹®¾¶dýª'½wñöP^]]ѧ£ —áN} ¶–ôŒÉAÏxHEÇN™Æ²ªH0æ0•­óo¾ýÇeÅ…LÆ¥D¥A=…וêµáXRŸq«5•Ût›.3 t0¾wAfSXá¨A<~‚ |sÑ€*èVÜ¿(øÖÊm‰Ï4†RDw,úp]jQqv†×¶,Óåµl;¹ £ŒK‰J ‚ ™ÒÒ±ÿ9œ;ÿ¡?ÌZ¾S)e "ÿyô¡9«#ãÆŽÎp¸lÛNÎïMRâñ;zŸ ß\”BkÃé{éµ/»öç—ŸùÄÐS†õÈ^¿ü÷K¢?¼í΋Ï9jtcîZ…L •A8Œ:Z“šÝ妟³ðõ÷Wn¬nˆ <ý»×Þ9~äà¾Ï%WÞÐ2ÀiˆH‰J ‚ >KxØZ«”ŒìÓ&^~êù‰ ¥hmk­Ü£ÆLÐØZâë•A8\–T< ±Öh”jÒ x¸¹J.R¥!^(Ig6$zB„v²ZšÿѸÒì—;ºõ¾ÍƒîZàµ:uë"Õ(HÍ#÷TËÕ§š’Gþ÷÷ø…®íÇ<èƒËÚ>¾>FæÅ–¡¬–xöñ¦0‹}%¢çT릶ͬÁEê3ŠÔ!‹Ú: J®üU#÷u¢¸ ¦?ïÚ^W7áÚ*jœ¹Õj9Çäj#‰17Y«Wá¿Æ¦¾– tÈH(Vc3jÅð×cd¤a SáP l4B]ÑX¢½6tÈÁPhM8@ËNléô•‰¡Ð6?þ¶N4ñ©é¤¥$µ³ýñ3ZÇSw³¨‚Gï%7­E3z`ÝG}×M§(«ÉÒ:ضʷðçع§‰ÑƄo3q<©Ö¾ÏCOÓE­É(àâïqÆt˜·fñâ|B6 ,‹â!üè*ŠóÚÍàh<΋3÷cœfB¥z bÚ4ŽË¡a7O<ÄÛ›Hõb[˜Æ^È”3ÈJiëhqí¥h¨æÍWxc1udrþ¥ŒŠÏVÄ¢|¼ˆÙ¯²u/žLN;—sO'?íØ©Y2.%B»H{73óef?ά’dAr‹[xòaþñŸln¶nm¦Ä©*çµyì©¥k7º£*øñ™¹ »Kxf6éùtêDaGÊ×ò³x»CóÑ6l';Ÿ¢ÎtÎcޣ̸›¨n·pˆÆË[ú&+6Q؉ÂB²Óx÷%~ý'ü©bù"Êüu¥¨ î w\ÏœÅXÍÌ&ZÞ½RPÇ#·rûCÔj ©ÝÎõ—ñÏ·@¡c,{‘ŸÞÀÊ=aÔsÏÿñÀ“TÞÅc G†ØR‚ ´‡…ovW½‡§'™üþ/L}¯N´ÇVkIéNN:Ë>fÂpT²©nÓ§m|Ù\1k/ Ž3Oæ™qÙh …Å_ nNì]ˤ‹¸ïQÆÝI(ƘÉÜuS¢aûàANþ-ûþH‘£Çolƒ“&ò—ß%þ}ã_L¿“õ3èeàËeÚ5üøü„]7ŽEïsÉé˜FËá¥Æ‘'˜ó0OÌçÆ{¸rDëyàFy€IcQ[¸í6z_Ì·“¦@óÂ]<ô6ãÇsjÿx@½ØR‚ Ÿga4öèß|‡§0ýJöü›%¥M¡U{xýEΚʷG°xëjú”ðû}¦áàÄ2ÈÊÀ0m|cÛpàM%/lÓlÖ w“žù5µÍO§“ÌL\4(£Ù©x=q¿àAvOw á u ÔÕÑÐ@4ÊŽÔؘÚ¤¦žº:" åì*Ç:ô¹ƒa‚2Sq&­5ÊÀ“‚©¨âuâ£iv”Rx<8ÇÎÜc±¥Ah­ÚÇâÕ,_ÂÙ'áñR¾–2óK™Ø…` °ªžÁ#±j()¡OWö”‘U„V +¡u°ŸÃ˘s¸ñ;C˜]¯æ‘û9o<D¼\=ƒŽ.PÔîáî_p×9ñq´¦ÿH~ü²] øî¦\ȯðèÄCm_Ž˜E¯¡\7ÚæÓåüú6}kºáNåŒ \Ñ J1òîxŒQÃXÐÂôiÌráó’êfo%!p&%*XËËÏÓùéÔï¦ T"r=â•Yä÷gø\æ±P¹Ä–áKÓlÊÎÚ•¬ÜÄe×ñ³ŸsÍÕÜ3“þŠ§žØöŸÚÜú8×Oã†[øÅ•øײ¾4iFµ¥ñÆ:=—¬,Ò3¸pµ{¨¬ÐyÉÊ&+‹n=Þ‹];ØW…a’J^™YdfÒsÅé¼û^RGÛó¾ñúÈÉ&;›œôïOG%%he’™Aª—¬l2³øÖÉØJEÍAóv“WÓ¹˜â®,“úšÄu*Ø¿›OuŒ±£Ù»•5E€7÷=Ê'[±9´*¶” BÜ"PI¡Z¾˜@7¦}ŸÑ}ˆÅp:Ùö*Îeû üûït?ƒ[® E9 aõFf/bÌ0ò\mÿ+…¶Ù¿}û†piþ<›”":åP©0,¶nÂ¼ü.zÑ­mS[É–Íd¹0l}¥»ùÁù_C÷Þ ¾šm»QQ´ÅêwÙ° ´±b”ícï~"ˆñÜ?ÉëE§Üƒt®ñÑeñƒosÍyøY~t1¹iTì⯷á=ãÃ8sþÆï¦èwtÏ#XÓ÷ô1°?n3i”‰J ‚ |–T)ê?æ…gÿNè…R8çLä7ÏrÿM<ñ×Wñ“ ”IDATÍp8RzqB?y†u“Û63¼Ú6å[¸ó§*iœµ_ƒ¨fþß6 4ÚÆ“ÆÔ¸r,©ÛÁÓ?á±[@ ‘×›?ÞG÷¬Ö’ ¯Ÿ†1Ó¸Kóó;˜ùW ;°g v7þõ4¹.èÆïåúëu½zRSFµ“;îaxäÞ7?€BNþfòÑò%/.\Ÿ?üü´¬|Ûj»ïßµeÓG ݾ4—Û{XDZgåuë7ä°U=­ñ¦²`棞Šµ;vPʈ_†Óéìß¿ÿÙgŸív»¥Î|YÏW<ûQˆªÜi¤ùŸ+…f_%^7¡(Y¤4{Èþ:‚¤gáq5Mœj~Øh„ª*"V¢T+RÒÈLÃ46PSKÌN„©d¤¢mê¨ó7M¡5deãq6¹ËÚ‹š ü¡f½}'™Yx\Xj«ñG0’a!nY˜f[¿D:vPh‹òí|°”]•÷çäáäd4¥ì­=ÀÇËY·ì"NI—Æ!SŠ-%üO¶%‡˜àÈ-¾Ö~÷‘8­ð5}‰oÑôÛ1Ùø’T3ݶø²SÓIMOlß:F+œnò Ñãðáõµñ¹2HÍ$5óï@{%I2;ÙV‘é";ŸìCÈy‹kPÍ®Jƒ¢°õhötSÛŒ<Æϸd‘MÓC“l³ÂÿzrÈΖj¶‡{uR">lï—n#Ŷðõô<]íÓªZ§:?è‹ù̯êP5æsk’R_ÃÍþ÷§P‡~&­ZJŽnÊwNË¢øo#©åJl)áÙz²m[k[kÛÖv[ïJÜ“¢­w NüX‡é¼­M±Û„£´;©Zé\[JßZã•Ì—þwåI+¥\o¸¾rï†}YÚN¨T4„#‰Ú­¨Ú·{ßÎ é™9N—çë¼ £Õð§ÕU„ê*)^ N¯¯¢tS‘ObQ)áÈvÌ”º÷ì}ÚÐ{öì0ý»3­Jwí,Y³Æ0Ìø'áp$ ‡ªS£Ž¯ÓÎІ¡u EjÐúÀá5m4Ú¥TfÇ>B.UED¥„#fNù|¾É“'µú|Æõ³^še:*©gÊP¶m½n·æqÆGÖç¦T4µm[jˆ ˆJ GR¢â†B+‹AkÝÐG"¦eË–„XQ‚ *%­p›Í±J"JQ)áh´´dw㣇 ¢RÂQdci­mÛ6 #Þ@·‹Q¥ ÃDǾ`´ÞQ"––eÅb1©‚pT·]Ò£Üaá’™ÓŸØû½;®ó¼÷ìÓÿ^P¦³†uéå•Ì{q½;Û±öuzäi]MÃP€m…¶.~þ™çï8º >ó»—œio}kÃîýµ{·®X»ÃÑuÔ—_Ø·£We’p¨À}AŽd­ÞcW¹N]¾öÝ™/-ï0æªßýöGJ=ÿÆÚŽ#ûÅ6-,©7\fxýÂOìâÑ™¥‹f¿½íÔkn¿ý'¢Ÿ¼üÒ›58ÔúÙ/oN6å‚Á¾¤0XU2÷Õ Ã¾ëÝ7ÿ°»ÅÜyKÞÈÒ…KË3F]ÿë_ËÜùì¬×öÔÇŽ¶EŸ¸/‚¨”p¤šgÈÔnÝVšÚwĹãwí9øü3•oÚìxÊ ´²×֘͋·š£Æ÷¨Ø°¤ÊÓÑáß½£ÊèÐ!»®twEY¥Ýï¼+.<{P÷fb]kíNïzÁ´©ƒrc5 N_ŠÃ¢ùƒF3nøq]zž5弚²² ¿FÜk‚ |Äãw¬Š”¶b‘¨òzÝ.¢á˜3Åësk±Ü“N.|zõG›Íý¹Ã§ubí{µ6EÁúÚ@$–V|b¯ââÀª·2R¼X±hÔÐIS$Z_öá› jÓŠ:g™5AÛÈP¶vfú<.±XÔt¸Ó<±P,Š¤{Al)ásÑÃéÍHwÔTí+«‹9ìÀÎÝå:+Õ¥È|ZÚþ÷ž_XÖû”3”JÉ+ÊÉé8òôóÎ;ûäNž`uu­åpφ×ǧŒª ÿYYÕiÒw/;gܨÞ}Ѩv8¢{Ëö•W6hìªò=ûCÞL[$J±¥„ÿF¦ì˜#­G¿J¶¼;oöܲÎöÊËŽ™é5\)}ûøžzfGέ½rµitê1Ü÷ñ¼^ÐǹÊVn¨>y`ºÇ \DñàOv‘7V¶f媴êM®ÞktÉ«¬÷Y{6/~sA`wζß÷ô=½s^ªˆ” _óÖ[o•§p bÛö}~ËìÛ+¿a÷æÍ{‚½FŸ3vp¯C+Ñ’áMë6pH÷Ž¦/« kQfyÉú=¡´ag]pʀκÁofäuÉËt›*‰83;vËKOéЫ£*[µrc$§÷©ã¾•V[¶w}vÏÅYjÏνÞ£'ÿVŽGÅM¯ŒŒŒÂæk ‚ É=qŒ‹ÅJJ>]»v½/=#Åëqš*6C– àô¦ûÑ:ÐÖ  §Û“âõÚŠ„`ÄáõyT¬!±l\^ŸGEý¡˜žÔ4¯ÓˆEBá©>õñkϾSêŠRØÑp}$Ôü ¬«‰ÿ§@ÛÑP 6HlaÑP (eDC ÑDB +X_LÇŠÄÜ9]z;LG¤¡ª*ï %f&ɃATJøbbõŸTÜüƒCÍ7ŠÙfAÏAÈ|YAD¥„£ ­›Ë––Ä‚ ˆJ G­u¦P€.‚¨”ðE ž&ÿ©åù ‚ *%´­qSG5ãˆ\’ãU„ÏC"Ñ]+ʶí#µÂ“iš‡C$JQ)¡m•âHg?®AQ)AAøòH¶YAATJAD¥AQ)AA•AD¥AATJAD¥AQ)AA•AD¥AATJAD¥AQ)AA•AD¥AATJAD¥AQ)AA•AD¥AATJAD¥AQ)AA•AD¥AATJAD¥AQ)AAhoþ?Úc[ËJÚIEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml/flow.png0000644000000000000000000003705213051004444022061 00000000000000‰PNG  IHDRzBpësRGB®Îé pHYsÄÄ•+tIMEÚ ..“Ï Ò IDATxÚíwxUÛ‡gû¦mzI H€ ¡7)Ò¤#ÝxA^DETÁWPT@@¥#U‘*Ò¤…)Hï ›lóý1ÉfS@ yîË+îÎÎfÎÜç9ÏœÂ8ç ‚xúHèAº!‚tCAº!‚tCé† ‚tCé† ‚tCé† Ò Aé† Ò Aé† Ò A¤‚ Ò A¤‚ Ò A¤‚ H7A¤‚ H7A¤‚ H7An‚ H7An‚ H7An‚ ÝAn‚ ÝAn‚ ÝAº!‚ ÝAº!‚ ÝAº!‚tCAº!‚tCAº!‚tCé† ‚tCé† ‚tCé† Ò Aé† Ò Q ç\ükyð¯}s9OýÛÿõŸMT;dtžŒ±¤¤¤ÄÄD///'''µZm¹ŒcÖ*‚9ÿôés&.e©B ½Ñ̳W½ðš.6†{YQ1·rój{§ZAAj™`2Dݸ‘“wÏÌÆì=ƒë*ÀQôíúÜ´K7bMf“èYðº7£ã‚Cê«TÝTbcc›4iÞµk×eË–‰²øÈ;*%W0çgy¥ãg2’“ïÞº:¶oÛצ.7Y™.íìÎ}‡\¿’˜˜˜˜˜˜˜¬(ˆéÕwàÝL¡¼¨Çòk-ÿã–‡tÒ‰G ¡«‚ pÎF£©2a6›ãââÊá:uê|þùçûöí‹ŒŒÌË˳üþGú÷ZÞ}bC‘?=ӿ٣မ?Zö|§kðG[Nó{©í‚\VDnÌ<¾Æ»vX\ºÉ²ÛÝ#kj6hžb°úÝÕ zaÑÉFA87Þ»s3.ßÄ9çÉ·¢ FA²ãâîf‚`4Äܼ+pþˆÿ¢ºS%SF£qРA111IåŠÎ¡œè **êÝwß “É4Íüùó'L˜ð¨Í4«¯àbLÁÁu‰Ñ¿^q‰Ü3²h ûpݾ ³ÆÌ`à‚0'G 7q“ÑH‹?S"QÊËû.A;}ø€_ÏÝ’ššMþøíç÷õ}{O0·YÃœê=¼:óú_]ß¿³cÀFu6ñ<çn®]»¶cÇŽªõ›}}}‡:uêT±mRñ<Žè°ìŒ4Eºö88·u󷌹©©,5.úBAž`Ò}3o¾oݶîî*k7ÜKŽÑo€œqÆÍ®¡}¿ùosŒI£Nÿ±åŽLÔï2`Á°ð¯7ŸïÝÔG'oö0^+Ю'¦#寯¾6ÌAº©?Z&“H$*•êí·ßÖh4•§Yêää4qâÄRy™6mÚüç?ÿiÙ²¥££ãã&ŒK%Þ˜ÌP`´VɘŸš­sW1¹Úþð÷ ãìL‚ßöoíyëÿì%%"µ³ë”Ùóœ¥&p.·÷€€IYÜÕÃoÌ™(ç`ƒ§L{kÉ·§t8>{}N¯AÊzãÇ䮋×åž^»«û׳ÁÉ6D5ÐMá£V¿óÎ;•êW-Y²$::€F£yá…Ö¬Yãïïo~R—(çÜÙË]s⪡ÒB‹ÛòÞÔ?|Žû¦>/sä¢ÆXeèÀ`å‰LR¿¾§²è¹>»°±f4HÄ_ÈÁ$2“ Ø»ÕðÉß½|§½>Ý{®ìÛ·zs¬û(wWÎÀªM[*)))++K.—Ëår©TªR©T*•L&“Ëå2™¬Ôyï ‹Ÿ+Ý0 •í'Õ¨Q#33sÅŠM›6 °”¿'^ƒÜ%è­Þ{M¸°w¹‚1 iÖû›G.?ƒ‘1‰Q_~öçA 3ó ÚO|où¬®+ÃÎ¥KZ¾´*綞_~±é×]C1bK¿Wì‚ú¹:)çb®:°páÂeË–©Õj‹n”J¥R©trròõõuppèÝ»wŸ>},‡š\óꦲhÑ¢F•Î<‘"(SÚz¹HpÎÀØÔU›¢º÷©U·qˆgŽŸm1`ڈΠŒÚ o»ûŸ[©ÒÎÇËSjýs˜ÜÛËS&16îÖ+ðûðÖ½B\ó®æ×ÜÓ» =®ù¶Ï£}|]]™ÞÍMã÷êe5»¤lmmÝÜ܈w!SRRJÝXµjŸ)S¦„……Õ¬Y300P¼•AñNq)«Š½H¯\¹æääáççWy~Ø¿P¤³Ioâj¥¼ÐhŒ1nJOIÉÕêm]]¥àœC_P UÙÈ%÷ýÁ¨V©‹,òuz•J%a fCrRR óôòR‹ÁÚ³ZÅÀu•‚¡5¥­V«ÕjÍf³¨­V«×ë³³³#""vìØqêÔ)³Ùl})ÙÛÛûûûÏž={È!ÿNÁ ÝT;Ý< Á1Ë_ªEŸYÕ’™™qêÔ©½{÷^¿~=++KÜîèè¸xñâÞ½{»¸¸Ð©!ÝD]cù[ªey÷îÝÈÈÈåË—oÛ¶MÜtôèQ//¯jnIU9»Ö¨ö&žq-m•ïX¿êííÝ©S§­[·šÍæ=z(•Ê˜˜ooï„„„j^t+»nJùE|‘‘A—‰J[b-b‰D²gϞ˗/‹/7®šI¥=gÖÍãôôôÓ§OOž<¹FŒ±_|‘snggWÙ1D©¹œóÚµkoÙ²@rrr5?8²J{Î,®ùàƒV¬X‘‘‘a2™¬÷Y¿~½§§'•o¢ò«G«ÕÒѨ¼º]ó÷ß÷íÛ7)) €B¡hØ°aß¾}›7oìââ¢ÑhÄÚƒR9Aº©¸hcß}÷Ý„ ĈfÊ”)o½õV­ZµÊ6¸È5Aºy,Ο??~üxA|||Nž<éçç'Nùb- Anž½zõ!((èï¿ÿvvv¶dû ‚¨ºTºk˜1výúõÄÄDË–-svv¦“D¤›§ÅŸþ)>èر#µ›‚tó±µµ •Jår9!‚ ݤ‚x*äåaÆ ?Žøxˆ-q‹}H=¤‚xÂ-© ж-5BX/.4Žeþ1âYS½ç*NH€ÙLñ9A«-<•ÙÙÈÎÆ´i˜6 ýúað`4o:B¤›gŠŸ$88P¤ýœD7yy¥7nÛqJ½ÐP¼õzô€ŸU0¤›gTÆÆ"42Z‘â¹ ÜÎÎÎ8ÎÎÐj¡RÑA"Ý<‹š€Z  œ;WØȯZ.>W”-;¦Œs äBPÖA\©oé—8Šæk$`€ ”x !¯LM«Å!HH(±Q£Á»ïÂÓJ%ìíé‚'Ý<ÓkU¡@ãÆUï÷ߺ‚è;0s8{¢Qc¨€Ã;P cIa4sx‚i‘’³Xç3x¢A0¤ éñ8wfsqPФ-<5`ÔáÔI(ÝЬ~á«·Ïàjz¼Tüí)×pî6ºv‡´2“¼<( “ÁË ˜5 ݺÑE^y¨Þw¦ªh~× 4íŒ\{%&@ï¡; 4Hë³áåìm1u8¾ûÎNÐ8Éx¡ŽFÀé_1p l\áàh4I c™ø+èÐ}†#·(ÀÙ4=;ãh~qôj(zö@e[ÁÔlFAæÎÅ… ¸pþ‰nÝ(+GÑ ñ8äcêZL]ÝÀsÇáÒ·Óд=h$°sÅ MŠN/ƒ_0Z´X+lŠÃ‚¿Ð!RÑ¢T%ÛSŒáünŒÜ„+#pñÚÖ$v³Ç_¡Ý 0ã1®”F£ARRñ?„n~StC<€  ¿oAJ./\ý~N÷Ý_í 6¤àÌßèZ³ÈDR”›6}¦´E÷žXº»ðm&KWb÷Z_¬@ðPhÔ•·lí2醨èpNAÎ1Ôò†w Ìýù RÊm4(ÕX2~~ðóƒ‡; ðv‡¢ŒÌ%øøÁ×¾~ð •;` ñß#Áþn0 û–9Ë e+´5âF2¸?ÂòÅ0+u™,C©'_Ù—\¦¶¬ZËÁ”up)wb ;V ÖDŸGG9»õ43:Ã,@Î1ª®ÞDã p¯‰Ý{ 3g¨épÌß5°pô¸‹ƒ©èäZôíƒÍð €´ÚHa~þs"´2é¦TMƸ`ÊÌÌ2 €D*srr’JžßÂÁrЩ‡_üѺ’ìq=¾|ÝpΞ -l\¼6WÒ u#W£^ÝâöçÐeáÏÔnŽˆÓ€AÎxoÎ} fZ÷Ãûï£ÛPtºª.À”š’ûÎHË”j[½ ÀÁʬþ$,Fº©z5=×¥Ä |¥z¾À;ÿÍ[·øº¨žç4¡Æi±˜ú~x‡­˜êbþ”l|Áªqa2¡ hÆ2™¬Dî†1ܾ‰[5½§pKÄÏh1©_và ]<†ÌÂÆ£0š*W› 4¸ QÝwÕ»8•ÿÏ`µ­cͯ~^ê Ξֲ̿Èoµ5NUÖ ‹¹v$*>…K¤’³u×’}ýŸÛ“ÉØãê~´„Àïáb‹ødLZ„†5Á(láçS¼¿g¸Ø?­ÙŸ¬Å¸p¨í!¹_ŸBk˜¸ ÷â³¢²à…^ž‹» pñ‚­Ð`B3ü¢EÚ`‰­ƒª}ˆM™éizpp³Áh*-‰D*“Jâo6¯åÿÍö=ÃÛ×眳ÇH ‰å133S§Ó©ªqÏfV Û^»ví¨Q£c&“éA 0pƾšÔæ£7%ÎÁ`2Ö}gí‘ÿôxnk^”¾áR’ 7ÃÅv*Êƪs°uÏ`ë[6‚LŠrËb×dë;;¥ÊFéí¬ Çp1Ю™ÞÍÑÙ½éÌY£$¦âÌ·ÉPp;2bë¶ßsµrÆî¨6DÜè xœ€îâÅ‹M›65aaa‡rvvÁìT#ßðÊÇ?þ(ž³Ùü€ÝÎ9m¤‚—·{½Æ[‡×óòö”)›$rι ðçÁú¯ðÜÿsŸ ú r…—·kóvoݧ¼÷J;g7Oo/ç†ÞÑYxE™1c†å¢›>}ztt´Éd*<Ÿ‚ T3X…o„3àÔÇÿ¹¦ò0åtžº`P»`ƒ‰9©/½úŠX?¿!©õ_ºïû¸ @sùÛUŸnÿ5Ü6S€*ëΟñ)&ÎøãTê .ÀI ªò‰'HÊä2ùãæw-ŽXºtéüùóïܹ³{÷îY³f‰×­[·nÝ:©TªÑh”J¥³³³½½½ r¹\¡PH¥R…B±yóæ*—¬Œº±œAÊM‹7®îNM/0@ùö¬WØ̞׭ϼSƤÛoÜy½U-êŸETX3`ÈúëàU‰ÄÑÖ%ÐÝKõ˜+,=Qh4‡úõëÏœ9óòåË«W¯>pàÀµk×Ìfsff¦¸ÿÍ›7Ë~Hûöí9Ru#©„¢WìåœËî3ë•xÞš=Ï(WØyÕê\ƒs€#°ëL7[A)Ó}ñÉ6PlC3iüI^2 `L"•I%‚¹Q¯ ßMï#ö6b¼‚EÉ"³ÙüÁ¬Y³æÎ;–W_ýõ:„††zxxxzz>äGUÙ6ê³Îr[Žà;wFŽ)º¦GÛ¶mS*•¥Ž/±1{à‹­ßÎÌч&eÔX·ªÏ,·þÜÃMîÔÿôŸ+TŒ‘pˆ2vós‘J»²³p™ ºÌœ{̬|ÚýýÇoG^\ÙU„ìììN:?€ƒƒC£FæÎÛ©S§r[[ÏmÒñtR+Ó£éôéÓ]»vµ/šJvöìÙ:®Ü=ÅmIQÇj{:»9»Oßq£ìçOiiãîéíQ#$"6‹ ÔŽx@7?·ðVc%•ávìÍ£?t’Ê==\ý‚›¾^á¾”‚ ¤§§‹Å{Ö¬Yñññ¥:øU“rú Sf³yûöí©©©f³922rùòå–—üüü¦N:eÊ”û6P9ÃÅÍŸ¤›äj•tEÿº‹L¥w±sñqPr³.}Çé¨FÍ(°!PÛJe*Wyé:¯0gÉÐêJ]fÜî-ûšNZ±›SŒ±¿þú+22R©TnݺµgÏžBÑŠ–^Mî¡>Ý;vlðàÁ¥qR©tÓ¦M=zôP©T÷)ÅMÙŸ¬=«”KÌ&#SÚÚ*Ë” }® ·c ¶lÿï fÕzÀ?Q±[íhÑc”ïÇkn§ëò3âð·srr„„„ôìÙ“s.‘Hªg©|º ¬[·nFF†ÑhÌÊʲ„õ¼ÕœC›[ ð6§Þ¼“©ó«âé¨fÀ‘/Ö¾0ïkEE‡UÆ (lllDõˆcÒŠÂ[îÐí£¨ŽóçJ{çt[`` j¯õ;éŒf€«lL€´üd½ââªUØ´ HM-ÞÁɉ.ͪ•â-Ѿß>òºGn\ÀnR¹B¥’§ôcpê»o¾³¢ð·3.¯õÒ»¼ì%w/ïìøêÂ.]šEÛãÙ}îšFdܽñêÔmUéÎA5wü¼wÞÆ?:ze½:eé‹Š4ÇÚÁ»7ìzoݾa­¼>Ýc[ŠWÛZêÏ.Ýy°SMå”ÏHBÃœ²_ÓïÛ¸ìüÙ³±IªK7šyD¯è²¬ÎíÝ3×¼7介ú&A®Û?õŦ?†{ßØ÷þ»ÿKtoîeŒþý´ñà_;}„Õ×WþGœ»"Æ‘U™2ĘZã¨FÉñS÷Éþ‰ûÛkœìÿ± ˜Í8wŸ|‚_-‡ TÒU\5¸w§NAöO¥š1@j[x³éAIѧ=~Iœ!ðÜ嬰QN»rÆ!¨YÀW¯ÿߊí×;Õvƒyzà6—_{ÅK&Ë;ùûø´„0`@ݬïGuæsïøÞÑ©)M%Ô@ûå‘È—½“¿Kn·o€{>7å ï7ù]ÞçÆæ™–¾5`_ ýµ^Úö¯toªýc¥R¡à·¼¿ùÚßW.{ÛbÖ/ã›Nú°ÏñLà¹ú^þ€)ýBr]Y./„)Qñ´RÑ ceƒYöû?Ì!‰GóæÚáÔ)ºŠ«ÙÙpu}’72žþOvSó­Ñâ~öÈáF­\ÿ¸í>ÑɆs0©oׇ˜Œ_g£¾Öka;;Yƒ`ÒÕÝT˜mle2UfÊ9ÃÅuõ‚·š9ýx¯.‰‘iÃú÷kí‰_¬3IÔ±ç f“åù·£[+W[pÀóÕ^3{¥`†¬û õÅ}öv Ò;ñ§5hð8Ñž¬ZMΈ‹±x1ÎœÁ­[ЕYrèPØØ€S‡‹ª@n.³TÊ°½ÃÈŽó÷Ÿ|½sháF}LŸ~^=$玮ÊÑ r©„s0™¬(‚ç…Q¾´p 8ç‚YÚûóíߌh"¾1/Ñ{Þ¾§3‰šÈK‰ÏTÕ`%ëk™\%sL€r ¸R*X±l9‡T­>·jS£·×sÎYE×ü©Þº7 bÍèt¸{bÆ ääï³d ÜÝéB®r×pU)œóú}æ&Ïoõ¦§Ïò©ÝL‹'þŸmp߯F£»J¾û3êãá9×~Ýo|×Ï_ÈÉ,Õi‰á‹ÿ± ÜàY«ÍoƒFD ¸ð‚?¾×û„÷¤Ïú¼º®Û§ÿÝA¼÷Zßö ö4áœKÄkŸqð fµ)Ÿ]ˆÉjä´zì;ò¶}=e¸c¥$Æ$vˆßpÃóç¶3ƒ”¬ºMË©R©P«‚‚0n._Æš5س‘‘0›+ãåTêÇ?Ò5f™&ŠÝçB-þ(ÎJÌòRÜ/©¨~«„×vê$Å9cLåðûo¿Œþzƒµ¹Y« èpèèrǨ%û^éÒ§åWΙIoØ_ÛEšž¯ð÷vÀ…­›‹£Z"Uø8mqqwRÛz6øáƒBƒý¼õÎö~Ð^£f_ŽvoTçѵùè~M³oÞ9³vÒœ‚ü™í<ƒÝía²oõ† èè`¯ÊRïÙ1‡j{—¢ á]=üRn¯;äM5Šæq®Ø™©Â«h>íŠÑd•+¨]¶¶•®˜ †Ó‡“·šèÜ ¸zR!³RƒTž±k í¯:h߇`Àï{qÏjä¡­=»ö3»€ñÒŒƒ1äGaýi ê }‘ X¹]ûÁß™ºl?d‘?{öl™W<×Jfz—*]œDÏ3ܘ––eëäf#/N[—žÅz‹¸›© 7Skvwu²lÑåeæenÎâÞ¹Y\açh§²ì`ÈÏËÖÜÝ\`5Uj©ïzœ–E7÷©EéH¥ +YÛWžèF‡.õÁáam$­µGWã˨d¸| APËarC³ ¼: êÃ,€±×Ð}¶|ˆ‚\¼1¶Pu¨ Eî…¡òœ×ñÓ9ÔJGsH߃qS‘¼s»;§bÜrü*5WâXÑîìêVt©sˆý9˜ÜÍÝ]ŒgY‰·”ýâg¤*{w5³.ÕJ;g•Xºc€ƒ“‹Õl; °±s·)*ì¼ü‰x3uNº¹¿tQ]BÔ°IDAT«¤Á9c8½Wj!í @‡º^xsV®Ç@ ÃÖxÁ.ÿ…€—piá{SÃsâgÕA0`ïEÔ)Üå`ç] Åôñ×b`@5`np€é1÷w¸Õ‡„ÊÊ“9£ÅcåäÖJ-û~V²³ûJüûToÈQy©šuÈOGB*üö'ÞémÕÔô†’%É"r5Ô¬fÖ¾Žš­0ë\Ø„”¢% B€;ˆÊcHOD¤SºÀ,Щ¨Á.Ç£ ³|†nªbùZ B¾¾¨„ïÂ1õÀË›gƒIôê×GHBCPçe<7ØiгBB‚:øÏÅ'‡1`$B^‚1W¢‹JŠS›`Ö¸aC™NY›JÒOŠ# I7Ä“öÌÛ/##_ÌCÁ98«ðÕ>0VþÍ&Mm,ý‹áÓÑÐ+6¾¤+À”¥øb-Âç_`Ê ˆ¿è ´¨ˆ›èƒ_îl6bÈ<œ˜#ph†6A®žÎD%‰n˜>uüØ7¢3Y%Ÿ»‹r7U²:ÃúÏáßmk¡ßpôŽÍ#ñÞ'ß²²‡Ú^*|ÖÞ Aca˜ f^ìˆú%w<·&øa&ô u°þ+|5¡P[® áªGÊ || £}iª©'& ËÌÜV7%Jo±LÅR´½h ¤ªV-[jT¥ÞZt'«¸P<㙟H7UiÆ-À…o!c8"nùf±kʧ8œµ(ê¿-G¾BQ³ËÖKßÁ/ѾðÔtÇêTt+Š‚ç ÆСð‡›œZRO A0ÆÞ¸–œ] qó®TCnºyãZjN‹—í/èòÒ¯GÞ2 ’Áõ½U`H¼y=>%SåàV¿^-¹DÙ´ys[9†üë×®çèoÿ /gpíÅK±¾nö7ãv®!õ‚”’gv÷ƒSU3w3à´£†!Ð ¿È±kYñåè‹noŒˆO+~¯/Ò£q. Ü ƒ]áë??øù¡~œZŽ½êx@ÇU; Q(þû òó‘3ÐlþŠÀø•—‰SaàCTô\2Æþúòÿ&.\›xûÚ˜]þûËŸŒ±µS¿·ìç»7/èÔaæ0cêàn·‰8lo»–£Á®­›Ö~𬘻)k?ùÖúS0§ö{¥Ïõ ÆÉ=:.úå·¸ËÇ;´i÷óùD‘íÛ¶ù¿Ö¤%ÇÍè×ííÿí{–wZ+áÌGâ\DŒ1³ÙLó@=h&0]2ß³‹_‰ãœsÁÌq®&sñœHVS%ýWrƤE©Ù™¬ŸZN ­ø˜Ókq>­©ß‡Ïš8×ùþãñ”Ó5‚êGÞÍÍÊÎã·WûøµOŽ:X³Áõtçæÿ}4ûï¾ cíWWЛ¸!'yþª#Üx7¬AèùTž¶™OÃŽÙÎ9OÚ4Þ·å4Î/yúÔº–É9ŽOðë´ z-kG<ðFlÕ+=Ðãå¢-’¢f¼e]ôÂ[à¬d…VÔeµÜî‹¥Ç1”Üny ‘ e`4¹jųpàlâ²¥½‡Zd« lÑ÷§oÇÄŸX¥MMîÛµ%8—HÁlÕ:¯vS{ÖèÞ´¡«‡×|ÛÌ!ßÿо}ÿ¾t÷öoüÓ†•0$‰mèsQQ>nÍíåàÙs¼Ë¬×ó £•j{µÌ€^ª’I(wCÛæÒªESf0ˆa¦  uÿ~y×ví=Y›ƒ&¬žÏÌ\óËï‡ÙÎ#¿÷éÿúwóLðnûç¾9NÀü!¿¼Ú¥5“HêôúâƒW7tê:²Ùúy2•Óîß6Ag TI‡ðc‡¿ë7zà\ƒÙµÙë‡çõ†éZ­À¹¸L’Ê=ÔÏùJÄ㯠"‚õZ—/_îÛ·¯‹KáÖ?ü°Üe ßkÔçää®"îf2ääæ>7 œó‚{yyÚ«=̹99z“`•÷/|Ť/ÈÍÓZíYâ¡ðì²ûÝD#Ëcñ© ))))))—/_ž3gÎ;wÄ}üüü&OžX»víÌ™3SRRÄ-®®®¾¾¾ÎÎÎß~û­%©Lé¦âƱN¹}öÙg«W¯¾}û¶N§³üàË—/ׯ_ŸN!Anž¼€bbbbcc###SRRnܸ±bÅ 777:…Aºyò‘Êäü)aL¤‚ ˆÒÐôZAn‚ ÝAn‚ ÝAº¡C@é† Ò Aé† Ò A¤‚ Ò A¤‚ Ò A¤‚ H7A¤‚ H7A¤›JeÁÏ'37ká§ðR눖·¬hñ®¬_±¼Pú¯e‡2 ‚tS5ÈÌÌWqµH§âêaŒq.® +BɉâKM_ø…Œ1X¿Â8çâ&ÆPêe€À€ÓtóÄÓ€¦FZpÎÇׯ_¿   ™L† ¯ZÏ9gìÎÕߧoˆßôáXñ½BÆ~#ÞýjÃ.sì®qojÊnçQûÝ™³Ú5ªÉ9ò“o~}|F¾‘`Òæ}Þ˜1~°“’ƒ3€ úÜwÆŽ¹t'£È5zïc׿ïØaÜþ¿|m§‡xâȞˆÌ#_ÏOFséÒ¥Ù³g¿ÿþûAAA;w>|x‹-*ò c€¾ +êN , › n\Ô›aÊIN òëäù&ä܉xóåÖ#¿¿0½›‡Ù¨»týæÒ|Ù=nÔþwìèQÑw·ýošŒ‰ÕŒùÆ™£Í¿<;Ò'ÇÌp¥7tÛ®FÞ2 `–Eu8ŸSE,hõ¢ëF,û±±±Ïð:(((‚õõ×_+•Êo¿ý¶M›6îîî¾â0+õÏ‘ˆO9$n5ë†rÎYýÐïF›õêÿu:$À˜oÍÀú6Œ­›Ú¹æ¢“Z=×(XaèÂM.~5BB¬>1¾ðè &ýÍÈë©9:ujšnÄ84ò1ä^¾Û E#%pûF„sP{%¹†¨¾º`0BBBôz}eûaz½~ôèÑr¹ÜÑѱ]»v?ýô“R©|"Žµx¶ÙË/Þ›½-3ãž;@./ÌÑ»‘gg'•J·ØÆl¶s/¯L(ðË'c—]túxìKóß›à×~Š!éûžÞ{|qÓ.ó¿ŽçüŒcºtY|:>̦0þ!ˆjªιèšZµj)•Ê??Å»yófYß1Æ›7oþÚk¯uîÜù‰ÿ00G£Ád20@ÆÌk–|í®4ægÄÿðÓŸãæÿd'/ÞÙÆÝÿƒžóÁž§÷ºšá&QH²¿^yhÓ¥xGöRCV£ùµó5S'ÜÃùM»¼Ô`×çû'L¹åøRmÎÀ8(ÓCT_ÝXعsgppð¿¬ιD"iܸñ¥K—,ííí'Ožeã'³Ù6¼kƒÜ_m™ûÚ‹›þ;6¥V[/'•&¬sô[jŒÞøj’ýæþðQmT€%D¤›gx“{„ ¥q¿MÆÁ¤öÞŸÜÛ»÷˜Áë?…DÚdÀ§›ç¼Ê¥Æ½FÆÙÏ—E@œ_Ž»âe#p©\U·^ˆŠÝïGÊ‚ê6pS•ÌûÈ]BƒkuXøËÞAýG¼¸jžÜ»ùÙc?Ø€Ûø×oÒ¬çÈÚLxïåMì(´!õÒx.»ùéõz•JàÆÁÁÁÿ~tó¤;þp†¢Ôä3™R)—rÎPö¾Pɯ¶N×”Š•ìGci! ùùz5¬º0[øƒ?— (ºù—¢›ÇŠeÊýH+?¨Ô6–DL¹J+3¬ál¹û1uQW¾â(¦‚íA‚¨ºc¦< éù™a•|±$bžÎÏ,Ë&|¢ZD7å¦Zsrrt:Á`ÈÏÏW(¢h$zJ¤›Çn¤œ?k©É¡³²•…aÃ0jzõ˜1¨_~~ !u¤›g@~>•€jÉ„ß~ƒR‰3P£ÒͳàÆ ˜LTžîÝCÿþHH(Àº¹¡N|ø!Ú·/‚ÒÍ¿xø×'ú#ž®n¬íš=]»¢vmxzžñâõÑii,ÒÍ¿ •¶çA€·70z4FŒxЧ³Oº!ˆÇÂÎ{÷Âήø2¤‚x*H$Å®±š™L%:Etˆç­LŠ!Ý<x¹ÏéÞñDKu$ÝŒs¡DõV´&ZâáLòEE\W Ïë"¤›‡ŠÁ“lŸÖ’¢üáÈUqÊ-:µÄÃ5¿Øº ýÙýQع¾ÔoÌÖ}ÇRsò©¥ö˜TéT1ç»wwéToooÜdxÿÇÆ´¥åd‰‡ÇÆÉÙÞÍÃ^.1›Lf¡ô:ˉôʉÝoßë¾g÷&G5§Y ª¥nâb.ÝNÓ“ Èdòœm³çë`Ãè(ñH˜Œ¦&ûµnè'‡öVäå³ç.d˜S¢Nµxåݘ?¿V‰õ²êÝììmfHäªÎmêí;|ÎΟqñösú2FE‚x“±MÏQ³F´,ûRæ­³ ½ž¢5\Z;÷›Ÿï@…«bTÙE{1A³íû5J•.þÿûp‚¾@/•«ÏüµKk_¥¬ñ(Æ„²Å àÎ5›¬œ12;ß(W©Oü¹ß Pn°zé†`Ð9N#1æÖéñ–cpÏ)af—Þ‰Ž¸›”KéâI3Î9ã@­Aíµ\"ÉOK3`T‘U#ÝpÑ%úi‹N89+ïÞÛÀù3d²ï®<ÅãÝOL<2)Îe6¶RFÑMuÒ g`Ú´äóÉI2˜];v´¸{p?OW•L)ÙòÑRT_¯1Æ8=˜m£L¦àÐP£°¹:éFìX“r÷BJZ†Ù ôxwºàœ¹ºzú{y€I³âŽ5€Qú†x”‹A*-§Í¦M¼6þ‹uµTÇ=Þ|ç P©ª(UòΔ˜•9½rFŽI!ÕxŒëP œ3¨œ^oì·ïj‚#ò—¯ßßéýžbˆCuñ®‘]:¾g%Xõ6äç\øû¯?ŸÎ¼§-09þôûo­ÜiyõÒ¸JoÄ»ßÝQ¸Ûû·¨ãeÇYáð…—LpøòwæåtyûÿRgöt“Ñ’¾ÄÃ] ùÁ-+~ß`.Ý0‰L¡KY–Égû_ºÕuGN‘pªKcJºrðëõÙ;ÁߪóU‘k@Õyb/“9É‘n&PkŠxè&:Óæee—$++3-%9%=ÛQ–2ªc³^ÃÞIgŒY—7â9ÖMáðK®Û¾ï¨­R¦Ë—uÐ:5%9999%%9%%9%-£Q§¡r˜™ Ý²ç"¥oˆ‡DŸ¯ýø—˼<®ÝÔ&,íÙk»÷~³ÀĸØx'žïÆ”8wRAbü©kñR&UkìþÓ³17[÷Îb‚I‰TÂ…Í›¶®œÖƒqÆi`ñE L››U¦zã`¬Nó—7ÿÖí«ñálO=±ó§ Ó_oR“r‚ÏCtóàþœ1yvM|&çœ Ú¤„Ää$¥¦gèM“HŒg7¯º0r Qáê1±;dý¦}ãª4É¥ºïWŸ§ú«ÊG7œ—Në–“åå ËnbJ™ÌÖõ›5_ùºÚ—6¨TvkÛÌË"Ý$?ÎødÔæYÊìá1±±u¶µ³ËÍÒj£¯é¸TI݈–±¸F¯×÷ïß_|),,¬dhÆ`º{|T²TéàæÐæÅ•åDµ>zïË6ùR§ä˜Ý ™ïú9ÉhLñí,ΓÙh29¸ÔÖ‘ŽIUmLY»æ«¯¾ª[·îÞ½{|þùç¡¡¡Öm+чV-΄=ôi¾í¦;+ oT•FÓ¸Ó 5ÌÏÎH‹¹s—‘kˆ U…Åí{Ʋ"·§gé“ÐðåV(HCTzÝXÄl6§§§GFF.]º”16iÒ¤Û·oÛÚÚNš4iúôé%›Wœscê¢-WìÔ,=×g·íÎî3]ñØÑ/ &3ò³¿9tŒÑœÄ?‡úrEé°Fü+3c÷÷ì>_P(Ì6ÞS;Õç4’¡26¦ÊÍȤ¦¦8p`ݺu999·oßÎÌÌÔét⫃þä“OK ‚ƒánÌÅèŒnæ¡CßhŠ¢ÔqÙЗ³ÚF¹ÛlÌ1JûiÆ;/»T触|¨iu¸ÊMÿ›qb£}ÙšI—Ÿ}3ÏÃúܶCþÓ À¹h>l*•L7Œ±S§N <8??_¯×çåå•ÓôÑhÛµk7{öl???ñ|—–8À.ü¾-ßÄÁ¤£^é ”?‰£8¬Î¡FÝðš^ûndhرÏ6&|:ØçÑ 5gÎàÅaoOåùn3qΙDšw=1ö~åB0™Y³Ó7þo¢´P6TU>ݘ3gN||ü7}úôyÿý÷ƒ‚‚P&slu¾cرq“\a'S»tj\GìóW¶†)¬v˜}ßÞm~¿±S­ñ¾°g©aÐg ö@ÅXÖ]4›qô(>üW¯"5‰‰¤›ç¹Z­±w°•ß'±À W¨ýë·~wÖÔ6õkÉÄL¹¦bÁÇ¿ÔaüøñYYY:.77÷Þ½{ùùùYYYiiiÖó§y{{ôÑG/¿ü²››[¹¸9?_Ï$Œ1©R¥`ÿ¥€q^ Ó ¨TŠŸfQŒecv6nÝÂ…عz}ñžÉÉðð ‚R¥¢•Gˆ<ÊVlØU$ä™Ê¬›rO§Á`ÈÊÊÊÈȸyóæ™3g6nÜ%¾äîî>lØ°Å‹—~»ØÁ“YEÀl9—ùÞ2û $X½[·âÒ%ܹSεk¥’ JÕàÞ=<µú1Ëçv£„MenæLGDD̘1ãÒ¥K)))‚‚‚Ο?ogg‡§´È†XîÚ…ÿû?¤§S9x~HO‡‹ ÒÍ?{'99yÆ ï¼óŽhœèèèGˆu+fœœ$$àèQL›†üürv[°ŽŽ4þ·j Óaòd”™%‹ Ý”©rÎ[¾|ùĉüñÇ;w~Š®±¤‡EÆš58sÑÑ0™ 7fdÀÙ™ J•¡Ô9%H7ŽøW´Ïºuë†þ jÈ[·°q#/ƽ{HL„—‚x|*шpQ1ÖM§g3ŸJ…zõðÁÈËÃ… °µ¥RBO‚û¶³ƒ8F”zÄsÝTž(«tãŸ\C¤‚ H7A¤‚ H7An‚ H7An‚ H7An‚ ÝAn‚ ÝAn‚ ÝAº!‚ ÝAº!‚ ÝAº!‚tCñ\ëƲð §E, ‚tóı6Ëüq¿—‚ Ý<™ˆfÕªU~üñÇnݺ%%%1ÆA`´ ATeX% 8ç&“é•W^Ù»w¯¸eÚ´icÆŒ©Q£†mÑš––eÅ ‚ ÝTÜ5¢GAØ»wo¿~ýŒF#©Têïï߸qãðððÑ£G{zz>à½An*âI“&8p ..®  Àz‡¶mÛ¶nÝ:44T¥RÉd2©TÚ«W/:£Aº©ˆkÄßÆ+((HHH8{öì¼yó¢££A¸ß»èŒéæ‰;Î;wíÚµ˜˜˜‹/ÆÇÇ3Æ CFFFbb"µ§‚tód\s?›pÎF£\.'×éæßk‘q‚tCDµ†ÆLAº!‚tCAº!‚tCé†A¤‚ H7A¤‚ H7An‚ H7An‚ H7An‚ ÝAn‚ ÝAn‚ ÝAº!‚ ÝAº!‚ ÝAº!‚tCAº!‚tCAº!‚tCé† ‚tCé† ‚tCé† Ò Aé† Ò Aé† Ò A¤‚ Ò A¤‚ Ò A¤‚ H7A¤‚ H7A¤‚ H7An‚ H7An‚ H7An‚ ÝACû*´–þõè?í­8bÄœÙ4häDÂãñÆ f$›¼t}÷Ú„ß˸aÓ¦'¥uÙéìô¬uÌ¥©åY£¡ã–_= ãÂì(JMބ÷[[—ÚÃBèô²Ÿ'l»SÑÆgä¸ñ!ÕàÉå3®š7²Û¥+õt$Íú»°7l;л]‘ˆKÿÛÀÈÈÈPRôNü¾K´ üq¢â÷á÷¿îý7–¼,‘ÕÌv‰Vêd£¾»qÕ¹Wèƒ}»&¿§‡Ai1Æl¹]Å©í±+ƒí«²‚z^­·î;RIzmõÈó@ÜÕ¾‹q#ãÅý$´Qƒ:€™§±¡BÚFŠsÇE?H¨eïìgiÄÀyøÜ?åÕl›5 ©c-/Ù×b ˆVÅ\:yá%³ snTƒ‡1BˆÕ=’_Æž=}æÉ»¬Juš…V«h\¹0B(áEì…sgŸÆ¥›X× ²¯[c@ç%(¥¦ž­tuqÆë×FL™Ê>n>f‰cEÙ¬Qã¥õï3–µÔ/„ ˜Ë@k´``jïy‰ÔÌFIìïA§*öYÅF>ù³´À"|8,x䙺‘­´èüÖmÛSš¼”¤wy9Yn_]°4Š_ˆ§j±gcNo@M‡ªÂÕ7Þ$Ø,ÜûGÁƒÊ¯_½fâ kÕÑžˆÏ02uéa'Û½²Ï™õ}õ t·µ°°” QI}ƒ/1íØ¡V©HNTäf§Ý¾|vÞê7†²Bê ²äé3À-> 8tŸ¦¨:¦>—"B`ÑÎLüÇGÌ›£?çj2`ÙÄ¥'— +n”hU]glìX·Úˆ 0EB ëRõ¦Ì— ÀT Õ÷Ç @F…fUóåšC—¸ÝÚ=}À¼C|‰ÌÌD.3†øX=÷¼€;RÓ¢‹R‰(¦H:êlJ®øõxÑ[ÍdæZŒñ¨MBŽ¯³öØ®U¿ý5?WM ƬØÛÕͺ¸!Ì¡…ƒ§n¿%10231–µñ39u[Wt†¨4ã0ð ‹®Óñyü²&B ¶ïÑ7øÄš .tûhƒ‹¬«U ˜w¸±»ûµs_‚@ZÕ‚´ëïˆN¾зà³)î€M%qñSüóTµaû~ëÅÍZ^™tøl7i7 ˜"ýW§%æAU…Âi˜T­À¨ó~š>ÂVTšÅè(Æ&¼ßŽ¦ý”¯Šè±xô æQäEš)J¸¶ü·ý={Ï[14ˆýñÕ®î§n'—ÕPÁÞ’w3뱆B€1 7ylôqv^¿YœºÔjü/³Ãeù+7wþê5xqÓ\Ôs{´‹XvÀ:ëꤚë äßÃúFñ‰yõÓçšBŽcf!€¶ÕŠû·‡÷ÒŒnõÔîœE—]øcJdéG®¾Ez]åà¬?sÆßɶ°žÍ«RÇ€òÈ~ýŒèF†Úü4JŒÚjçè¸ü–†‚AQ£;bmÎÛºø³‡yRs–l*)o²?¦°Ý†xñEÔºñÜT,B—çÏýH!Œ-Œëļ8v*VýÑ'Ðrä„síÒ%+écMõjÚ¤M‡_Åbóó›bBŒï3=‚câRÒÓRvÎèºæ2rÿUž¯4Ð*v°²¯‡xüsÏ’1BÀP9ñW»-½Éã#-¹>ÙÀô¯‘­æl>÷æùÒ‘íçœ|l>Þ»ºˆýèœé æ{…Æ\ÐÖö´Ì¬¬ŒÄÙý#®*Œ"*¹¸U”ìšÔíÞÛ´ÌÌÌøÇQ#Æn’Vªk[¢ÙX5®Í¨r®¤i3º¸Û{ïËŒueVê1½º‰h÷è¶Wî÷zûœÈÑ“„|„ßc)[’Cª5ÙÞÉÐÇ®Ö!| »ý«Fàì·aÞÞãþÜþäuü›Ï*Ö¯ˆ§ðª†1 ‹ß…NÅ—H%ù«ÝØ nßÖÒ=#º·Wii¡XRÁ¶Ó…-0ƨ¡µðNÜ)gÇý+ÎÞðpžTßòò’íæ©5ÈÈÔ|á†É¿ôšÕ+Ä~ÉÁ[N¾~R³°èà¨UóN­Óñ…b›°!ë§E°‹tÒááj 1 ÀæNViZÓúèRŒø’¾swôp‘–5ܹrdñk‡tiMÑŒP$‘Uo¼uï*ýF½‚öZ¿ålÓeí~iá«Öè€Ç7µ®¹yãà~}—{:»Ÿ»u'’J¥LaB ¥R©T‚ãmGÎ ëq}Ï’è]X,ÏÜu2áïß55JÛé%oZÍ\RŒ.c_¤œ½ [7f00«X½z3Éô*°tì|éŒÿ°^‘·­½¼wO(–T®é9®wQSÇ=îpnÃ(Ò²¿DGÿ/ú˜üv†1FXáîŸÓxèÉ ÝKWÏÙ»ùU® ¢[gS!@Š·1çn½®jçã\Û cÈz~ã“ìа@™€Š6â÷î?*¦Y~ªôutTz)^½ö4£¡GP+ Äß:{'CÚ<Ä‹W¢¨ú$JÓéñç,u^Õ—xÆ€¨Ô“.XÍ‹¨ò²A¸ñQ`ÔäÁ7¡ "†ø÷ioüŸ»ºüÿüßíÂßEfdĈHŠ€€èT„_€…õ±’ºÙG;õ•‘8Ñú~ï37ŸÏçñþ 3’S©)ÉJ-E¦WË—½_Œ4s~»Qlb=ùÄTYåÈñ´Kó¦ûo$š(gÜNmg–yyN%ÓÓçÅ¢šý>`¢”ÎãÃ|À¼ù$¥æÃI½/TJÉL—•ò/,‚ÿ7c»ÞSU9™WU ßF‹hmJ ðÎîXìÞó«Æøùúúúúúúùv¿žÂúö„1¬ÛÑÇ×××××Ë=ôn–me+GwôöõõõõõñôY}öiA3UǸxôÿ­dÖ”ÏØ;ܢњ‘­¼=¼÷&q[^¯l˜àåÃedØG¸¤U„«G—¥ÏãÎ.ññõóõõõõó_zæu0PÿÑ„}Ð×'àìë<}60l™éÃÉü¡ ßFmð­„1BCÛ‡o½šPÉ!lÆìMDƒ[=WðòÍš!þÛ¯¾öj7hÑÂÙŽU·Lë3zõY=y0Í0LéŽÚ#þñ…×_ϪïäYM €Ðž_C]wÁÊ©õï‹ExÕ¼½o^³“‘¾ãOº<§Ë´=݆Μ4Â’ÑîžÞýç½ïc   ð¹þN1x‚9ã+ò¨i=ÂVßÍ`wjÌîÜü¯3OÃ{-úsé¸Am¥ª7™ Èlšÿòs{­ólÚyÔð!it?ÌʿÃ-½ü›j0þg^S¿llÌPC¼=üznÇ´ÚÛÛÛôec¬¾ãëãÝnÉüg3ÏMööòØþ(cLÅ,ôòôw° BÇù9½=¼¼;þu cühÝh7Wǃ÷Òó¥ëáâä}73c†Ñét:Š.™½¼G§ݼý#æÿ’ýü¢³›Ç Õ1ù¿¼83ÇÓËgÃŒie;g7oo¿“iz£ûÙÏÓÇ×_‡1ƒñ©ÞÞžñ**ÿÙŸBÜ]Cò(Œ1næïÑ|á•|QÖÉ nÎ÷“µl=¹8n~1ÆlØ‚òg¤qŸéšt&êàü÷ª³U¥›d~âÁÛk(5kl®ÑÌ™yéØo~©æ„‚ÎUxÀÜðôf<ÆØDÀÓ‡F`"&=ºGCðÃ4­Ži`,ý^RP­‚bl³R†ªè°ààÂSÄ©(## R#ÍTÕÇÆ€¸[Ï ¯mHpáV+–ð©„û€@XÁ³p¨Q £_¨C]?aSHð–B©SˆÇ§ÒÕ5ò‚ø{g×mÝ{åî3Mkµ:Ùu@¸À—Îìj>òØ\ï9³oðk åÒ @Šì¡Æ€ÇGbÄCX]¬“-lBðª¹F6µ§‹L]ÛJeTñ‹tÛÈÀ4²wªh¨r©™>ò9£-Ä@`k!Ž)`àЪ»‹y1öÕ0 ­C^¥åñÌjEtîëß$ NÊšÀŸÿ&-Œp QÏ™š¿GžIËø‡Õ¥Ø mãкè΃wZ¦–”§ç‡.S¥5oâÂhÚXrâÍ‹ÄLª¶ Ÿ‹Ù¡ºŸƒØ³*Ì-LÖ]»òšbÔ)© #Ó ŸêÉSÍ­6VÑ¥K÷ÂZWjjšPfXêôóC fºíAAu¥Ø G×°GB¥t9©™j3™PwsÆËTŸu‡[6ä"àè2ø¤y‘y*nâVbÖ¨¢V;³Sg¡HØ¥*¯X“­Ðlñz Þ˜¿1þòo½r´Ô¸H{p÷«T(î9li~ÌŽñæS®yýl/ŠÛ¹óVrþªñ½ÃC»%òx¬Ÿ[©Ë ¥ÂÆ;R›×áÅüû_›ÔªuÄu×MPy©³.*ô–Õiø1„ÄÞÆ€¦ÊP̬'ê‚wE¶nÕ<|°PêÓxLSö•Ìò#§œØÿÇ'¶E970fh6'@’™Ý+ Þ•.ª3$Ÿs4Ãpa0ù•—ö¨;xó†°½ m¼~ò(C‘+õú¥IU#Œ‰]fu¨7j÷Þ€àãb¡N£LVÕu¬Îäa Õ;Í :tkɈŽ̬mjW|û0C‘ÕnòºZ¤¾ççÙœÚ^Z7¡ÌìÊjx.è^òîI¡gMë7¨›ø06Y‘câØ?Ì„Õž€/­vx|ó«æVÕ-EÏ_Æ+`ŒÁsÚùÉ€ÈйEõ†•Å>ÍÉÍ™ñ÷! *µî)ZÛ{ø¼½M4T¾5räÉñBðỬƖF‚GñÉUüßØCæpË¥ÉU(ròg%J­P(ò44fØéJF¡Pä(uŒ~î2ýEtÿaNŽŽ¾áÜxMçÏi2 ÆXñ.vÎØŸ»vëµpË%Å(ssrÕ:6ÌP·Ž­kàéààئçÈ;o2¸ß1ÆšC#ûûmkÉìi’ŸÌ™;ÿjJÁ/ Ã`ÌÄÇžëÙ:ÈÑÑ1 UÏC7ßÐìï´²³kxßm9‰†t uttjÙsÔ³´ÜBÏbF§:±nV€‡³££s¯³â3òò³ñúìrwgWWW'‡A öÓ8§…Ÿ‹›Sã331Æ[û¹¹»7rŽT’ÉÑßØﯸqP<"NaqÑPÅî,,ϪÄ=’¢ ¿')FÕÞÍ_é0âøÚ®èJJ–=­ƒÖ©µ_( x¦u-–ˆÂtžJø"©DD†rg‹Š·Šbí¬èúÀ…åè½÷ ÷$üÞ¤Ê.ÀûžeÃoò…R©0ÿw$Júup$É Iƒ+—¶8Á $–BaõˆIJHÄbcëŠF¤27ˆNE@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸A@@¸Að%€ñ{}ŸSs©¿à½wô‡Îþ-šÌûÃð¡·@±·yWé™þÿ¸mñÌ¿ú‡R@͆¸FüZv^cç¯ ®%D÷¶9’Ψò£_cè¼ïé,{Xj»)^—§e€/1 jÝuÅì‘`YK—µ/ìï,|þ¼°±y¶Í^šÜ~ø¡'³ö\jQÏ,Ô­ÞË «sƒµ¹púåóú ¯Óu»–G¶qr’«Õ1€¬ê8ô=½WH# ðòð’–ÖhUÜIU“J-{ ;´Ëëö¡• þÚ}óqO"wkÒì—i3íÌ1 ”ó6Ê£åPM^.âU·ñüeášðZÂÿÃqÁ$|ÝzjPƒ?n\üc@“Öý0Æë¦ØM¿]Ê#K[¹9¥b/´/Úy{:žÌ`¼²ƒ_ŸcYÅîfô‡æt óÙ!ÄgôáÂÒ^eÜ‹¬¼²pÙñ§gwpªwU/zqã`ˆ£íΛiã—ÇVzô™•ÿŒâÕ%ÿÆŽ›Ñã[Ûƺøµ:ïÆk³®fëüPŒq—=ÃÛå?unÝ(/ßV?öÙ4ß:µ2_#iÒ²{Vn®~øJ­-õZÃ="4­9­¹ñµ­g¹aHÿ{ Á†¯Ï:—ÈŸµduê·Ô‚s±) H¥Ôåß Öm»èW—}2?±š.­fŽh³â¯ úÑŽÊOߨ†oXÕóØÈy6hvôœ]›ØV5ë;õ÷6Æ¿ þÕå0¿®ttN±7> ¡Ô@ß6áôßë+7òÍW¢RQ)J‘¿Ñ•{¹Â ì© ÀËJjõ¡CÓ׈ZN2°j]¹õ<õýç7Ðק†%utppO¾q+‡k_Çf¿88É¢}s«×1×…v.!V3øôœ˜ôúR1!à©_ñø`ðÿ¨mip? P²¥WÝej ˆÇ¯PÓùÌÉÁl4^ÄçêVw³&ßÎzöÐa@½c}Š§½ºµë9µvMÛÚüêZg(ßЗ_Š «$€õ±ISÖº@›š•¬¼ØniDé¦øÓM¶¡¥åÀØTªLgG4êþ¾Úµ×³I {ÏÝi/…;éo*šX{HjdªËUeð°&oÓÆ 4ƒâðæõ5Æn|Ð2Ô©{lz6™kÍëmÓsøö¿ÿì ˜¦[m{6Å¡”q3 MÓ`ZÓkç™u 9}ÅfÞuM‹÷ÓI»ÒÌ“3ûßò1®bLíY”¤Ž°—ˆcŒ`ûÚ Aã"K9(2Õ ÔÛv/Ös?¤Þ;Ü{TϖǤ2ó\õ«bC¥ÑðD"k¹Ó4M3²>37´ vþĈ7Ê¡½¡R~X—ž;~¿Е³7TZQѾK¿ný[˜1+8;$À¸˜Á±uʱ}K)¯Zy…'ç'vu°.™““iu»˜—F`ÿœ¿náêdL¾‰íC`Út®ïø.öH<@e.(=F½¹±Ý²:Û‘XÙ·_±…Œ§_ÆW`oHDŸfhŠ J¦¹ýeú¤Ãª²'3 ®üsùÙ®kº·KRW -|hC~b/oš¼øÀà5çKù¢²T ¬âþ«7ӷ׬¿7M2@éO÷wbÈž+ßU%nü0Ð(ó„t…mdd‘ðôñ5ØH@«QéRwsÁéžØ´ÉÊkƒµÊ\5…Kònv­3´`}C]gÂË…Š·IÆn•Œ8ãn;Î÷þ:·[ CPæårç"t`Á¶°aÛóÓÕb~—::À²¶Cÿßvvr6Ç ¥ÍSi ½VVËBsró¡.ZõüãïôуÝÙ»xºSé/câÑ°yºÔç0tžRù]t@díïÇ06ŠÄóþyÞûH Á‡ßTäI^Ò^%Ã(_Ÿ¿Â;e¬ËºóL`diS¯w‰§7¾;õ       ‚ïd]üÃÿeQìÊ•Ëý`ݨ‡‡°+Œ„å„qqqŽÎÎ]:uZ¶lÙ·yï€?=JaäæV?P]ñÂkí#’Þ%q£¼pcò¤I»N]·åÞ«ƒ3¾Ù{ ¤M:EV©k÷Õ•HO¢öª\ —/Gû†Mß~sL»ÙñO¦Þ½{ç˾ˆa°““©ðÏáFþ6°ÿÓvúrŠÜÜ܈ˆtÅÆ›îå©r1Ô´u¼rÈjÜ¢m_öE1Þù'ÚÒÒ’Ôù§r#Ä]µªQäš"Roßh¸Ø´qÃÀQ“–O tXÇY–:-t³ü‹¿QùŽÇ#ó–ø˜ºà¶íkßÝ÷×®7©´o””Kë*W’eËÎ'Ðüß7lÿp i&===Eäää¯1n ”÷/?ñÇÒ]FRCRéß#† è5Á9¸#¥Ã„Ÿ…B±lÙ2†aòÇáVªTéËŽpdÁäýçïV«W•!Uþ­°c箑m 1ÏN}Çãq³ù „xz°áqcˆ\y @ñì’×)¤Æ¿ÜÜÜ23Ò;DD¼ÌB‘36 ÅRý'‡”ø—_|1N•—›™™Éçóó111)ÏC–à#È—ov®ë[w{°gï^…"»Jå þ2ض« s÷ôõïÍŠÔ±ó½½½¶¼á‚‘Eú¹¹DèØ\½^ííé±ì·º4¨}¨³}ólV”²ÛËÍmæ±V4sPk'»6ÃYg=]F­9ùñ(‘H&L˜Xx6é«*rD§ú8ñ„&&rῨ1s JeÎ% 0´°°0rßØ´BEK•„ñ ,,,%\Þä¦,-µÜ}<‰…¥¥\&æÔ cs +Ì…±GB KKSc.ú¤DfjiYQĦˆ–æ¦F¬Hh`baa!æD¼Š––Ò &Ü›År )×c Š*±™>y# ™€Ë£yE µÔœÛYÆ•…{ÌÔ¼¢¥BÁ“ZXZK¸<›V°´Tñ‘¾,–&2ɧ¶W_____ßyóæ©Õêüíììò×¹¾ÂÃÃËóº ‰Ýöãùóç;vì`†ÇãMž<ù+½eäˆF?Þõq!Uü)¿y3 3hÐ +«OðB!{Ë~`Ô®]{òäÉfff¤*È<A)*ÖСCáû Klq‚ï—'„„„?"7ð{/þ£ø(ÿ ´òêù³I*¡›pc>ký‘ê#(×Ü@N.ê=sÿsn¼˜?KZ±ñéý«H¸‚r­Sa€Œ'&ìzì5x}tTTTTô©Ý¤'Üë2ù "ºAyæx|k¿@^o~—zìY…•\ÇÙ3)·’aƒ ¼ëTUÚOª$+d_à”4­PhDꎠ\sc\Õ.´*»%z{iùÖ$IجY$À!A¹æ†~'„@<¨Cûûi:‡® ¦É 3Ê»NÅnbÛ=½×ò3Ïx vœù«ªL@v¶”{n`Œ=§“ïxÙ¼­§šÔ4d§§1ô x`£¢ahºìNcÌ „f¾kÕ£,n ôä쪿ãL·ž?ÖPÌÎڢϭD\ ¡ÊWÉXï“GôUÒÿAû q}á±ûtZÂŒ@,uüwú?¼.Œøè醀7•¶WþHúñÅ€µ[*•½gäʶÍ2Ø0qô¨Q£Fâ0yÞ†O}B¨G‹f!A}(Öª½.<,d݃t„Bhx·6¾s(ùï°à E矲¢9ûøû´KfEYçB§lbEçD6ñmõ‚F€òî„ú _°›^74°I‹»ZHó:Ì7 ÷¨%¬(öÈøààfQJH—ÙÜ?0¢û$V”|mvhXÓ££kÚ¬ÅV¤~ôgxxØ®8 {Ù»UóàÀ^Z¶,o7„‡†¬¹—ŠF÷j×Ä·S6›áÔaAA¿Ÿ~ÀŠ~ÝÕߧm"+ʾÚ$`â¦s?î ,„W§ÖmñŸp.rÅ?}VÞìðó€èE?«e‡Ú]XtË¡Oôx­FßÙ¸šb²•˜:s.©ð¯ÆU”}>õeé©©)J¡>äFnjJjžŽsqÎLOKI‘êý•©©©96(2ÓR“5\ŒFš’¢Pr ò))i¶C—’’b¥`C$€:/3%%•KÓ©))â¬öJ§ÊJMIÓè_––œ*5Èæ2¥Q¤¦¤ªõñ…ÓRR”Ò Ü….755UIs¥§¥¦(xÜ\—ššš«ãò˜•ž–š"ÒS•ššš£æHäd¥§¦èÓ`4©)©ÙyêX¡J¿K×´¨$Æ:ŒHëwô NÔ(Aœybç¶ûÝÇat€Ó£·¯9Ósê´§»ºæ4Z.Ê®9«ºrBœÙ"K@(ïéžÓ›7!s‡Àa³ F<”q{ý¥û)0¬×rº½K½×«š¦ði3ZêÆ®c 9vß½]C‰j†NtñuÐ óåQ†¿ø^ü©šÑ©~Pêþâ<¡úàp¯a]›ÖÃí|¼ø °á˜„ƒÖÞþiÖtZ8õÜÚÅG.\øhsë÷èÊýí}›gœlù¦ÂºÀ J™wÙq­ÕÄ¿t/öÚ|¤Û²ýÚû‹¬»ÔzÒZ¾6ñà”þ³®4eùµYí©§k˜ÊpÒ¦ís·´˜¶SÂË=:¥{1§«”ÌØñ/s·ÌéÝOЩòÿ,lµMçû}õô Ð:Ió¹—âo캹wÌ­Í´ÔؤfËy^>ö¥Ç;AŒiÝ­Z3Ø G<žúÚšm®3oË08õñŒ‰MLƒÊÖ­ZM`l"åñÍœ««“2èFæF<ÀBmÔ¤åÔö¦f†ˆ_Á­.ÿqºJãÆ7šÃ% xŸ&À ß°šWßêÞ})M^îËÃô6®x©A©‘å0-­äÆ0úØZX“žBYø[èfPÃÞÆÕžoþòÙ+­*—ÖJ«U=øÆÕã¶>ûà±V•KiiKßÿ«-N@ð>M ùÈä[÷ñy€1ðEr›Î\̲Þ>.1ÐMþ%Txª ñDJ¥a ÊWWÒs¨»s} Ú·œ°»ó‚ >55Å´˜Ç>Qû5·³Ó¼sÁ6Âÿó<Áûfp­|‚”ç~{Ÿ'_ˆøŠ;Oo¥ZÚ:§K‹Ó '†—Ñ;ÂÒ›VtpÐ^ÝvN(>äœ;*W$LŠ×Õ ” ùº[oøHÁñ'¾UÕmm`l$’òo¼ _œ‹Ñ©¾£q£&íÇNØ?Ãóª¬"1ʬ\—!{êXñ€×Ü®êâ-ƒBÅW=´¿6ë* `´¹:ý´$£Ë¥(3ÐhÀ7“Â6ݶÂêô Íæ×€ùПwLð}d.×jM½ƒk\\ÞÊqÑ! +Í…I-<'ñ5nÓLï×ÍÕ9ü€¦µÏ¬o›6÷DÉW‰€Jâ|þ<·ßÓeÆ<‘̘‡Ø^óx ÎÍFB™X, !àB šÜ,Ä—Š¥b†Á!F›«Õa±¡ÂX«Ê0ê…ÈЄ‡ëò4ZldŒÔ9Y"™œWTUûFóTeŒ€øb™Ia«a ì³[U{ð»›»ào(t';eÇJDl\$1”³Ê¿Äˆ{Ê$B.jÄÐäÿio虧¾}ýòµÛõ½ÁeŽ!Ø4¦Ãê /sÕ <#SﶣiI¶¨ü·Qæ¸â®ïX|>©ÿ²ƒwîÇÞ¿wó÷Á~—÷/<£@dì (çÜ€˜ó[ ª5èã^…€‘È·u¤F£:~>Œå\§ÿ~kì{‹A¿ÏA›“Äã íÌIÝ”wnV¨l ]2|øöIìæ¦÷ªNªŽ ÜëTù†‡Eµj–æÆÊíÓ«§ó¾Úb$ÁÆ Œ…GŸ2û+W÷¦ß¾9f"Ö8Aùæ†vÇâ¹»N?*`‚AÍεt9o£É.A9ç†èÝÅÛví☀1€úfO,©ô©o*´9C¡åCŒñ%ú*铆øCêTÍöŒpqîÎËH³}Þè;ؠä‘Ÿº8Žš4ìç¦qþâï 4ðÀ‹lΑzÂÈ~‘㔬#uÆÙÁl½ù†­›?®oŸÑé¬(çÆ ~ýW¿ÍŠ­›Ö/rD<ë/®z2(²ßüͧYѵóú÷öD‡iß Žì7eáVôüÒ’~¾­F€(Å°¾?ý2q+J¿¿vР!Ñ Ö_œúeÀÀŸ‡ýÆŠ´¯v <ød’–½œ2b耟¦èز$þsùr‚²Ç)å«ËÑÑõ~Ò²Wwÿ¹zó•”sïVÇGGEUlùw?¾÷Ï¥+n#¿.%**JàÖ½zóøÖ¥‹É¹lŠTVÔ¥(E%/V”üúnÔ¥§ý8Ïleô…¨*47¹¦HŒŠºÙžõîƺè‹Qµ¸zФ?ŽŽ¾ÈeŠ¹­”f²tγËÑÑÎ*n'éÍ+—_+,vWòõåèèÚ‘\cn\»òTÄ•Eó.:*ʬÙ`öêiÌK•j6Wº´¨KQàІ´ÂïeïÃå¼™é¼7o“±PZ½Š5‚Ïñ_'þâðŸóÿnñöárŸ/«^³VÁoŸÁBâ/þqéü0öáÁdBŒpƒ ¬]·þÈ‘#„!„űyëŽÕ‡owéÔ˜7„E  ZœÚ¸ëoƦ'Ož$HÙ5ö‰ +;EõUÏ¥)äH\hr3ÿïb3ªx¾d.‹$X0…Z0ïVpƸŒ$œïß\lN»pà5õÁ™ðž={]¾~cæKU«2O…1T¬R{åµÌ…óÇoߺyÓ–m„_†cD)&Œ™æ7îp«¯—%¿ñ§ðEW=¬\3Ä'¿!„æj½ò…Ç«Sã`Õ¯Wž|Dë¨ÂÍ‹Ñ*®¹7Ì߈mâ/î[·cß•›±ÙjÚÄ¢šW“о5°rS¨êwlƒêtÜth¶[Á»z»¯S«Ùq7o]ä>YéÓi5MéŠE·§´õcŸü-@êåòÆzôã¿»™ ½7µqçí›OÇ8U‘Bîg÷‘:¦‹&¡Ì6¹ýHâÑ×nÎ=ý@•÷%û­@£‚ˆ¡s“Þ<‘ÊÚHNúwÜÀ!´ubŸ ÿ$US~e=O$52’?X?üJëK^U ò{^±Tf$³‹$YƒÅŒét…3Y½±0F¶Nîñû‘G6¾Í†NêZÉTòîŃÃïîvlïˆÛ{øT@ÈÈÈHV"´Oh`hÄŬD<±¡‘ñ°Ùó*ó‹ôߘoÌ>&3442(]/122âs¹Jšžì[ל)¤Â0Xl^FKÆhU_«’-«Õ[}3{æŒQÛ·o[³v¡ÇgsB/ÏüñÇ¥wô-LZ‡jXU:`rÔÑEÒ÷|6šgìîæVj àÛ{§/<þ²ÛÔ cÛØbŒðì9hN¿6ËÇG:9ÝHô J¡ƒ§g½]3µ;{:Wþ®>zòÏÅåCCÿ!Ÿb‹—l–yyyZ­ößè< Æ/c®-êç=pðóí´ZmÉÖ/‹wïÞÝ°aȈ>Ÿ_ÎéÁ+óC[Õ©£{svËÖ­[·nݾï„HÀ»xó–û¿ÙØÑ~ò*»Jøç±Ë±à£ô ~ _3|vÏ @z;¡Ø³;ÿ‰ËcRï®~ˆë¸÷ÀÀã‹0f”™ÅÂûæ%*}ì~1 ÈK‡"®H™œƒ ßמsSÓ£ úNŸ9ËÜÜÞ³¬É ><}ú47Ê70¯Âšû ®³ž8õêóçö~•?Ç#'W‘MßØÈ!Z“«ËŒ$äå((O!ŒÅ+çö ¸lŸÔ™:~D¿-=õç#— Yì±|D3ö·Woο¼~eFf^wñ/Þ‰*´­ ‡n¯L§ƒÍóI§K·6oá]¨]#¡ð½D·Æ†s/o¼ŸÒ×ÎB Ï/5~éM Ô©RQœ¿pÉß—úF= nÑ4ŒÁ8_úÀXݱcÇƵª¬³0‹^ê4ZDi>Ë#§cHp‚²Ò͘ƒBx½*0bC¯ §‡9T€AšÝz%½úè´1*EÁ0pìtbí¥øRH×ô‹\2âõ˜Å=÷¯éÚ3¢Š‰àYŠVÌÓ=Ž§ë7q³o¼Á«6œnÓ;Ìãu·ÈÆ5-Ò_ÇnZ·Wg\eùÎ…û9031²Ÿ´Ø42fþX½ÎXˆZ.Ú¾'<¬O¨S“v}ÓÞxy£þãø¨qãðÔŽëc \O1ƒz­Þ×ÖŠÔAy·ÅuW£žæHëU© Å70™Þ" ÜÀÀdÝIŮӗÏm[‘ÕD@ì¥ É HÜÈ­1ˆùN@¸9ÉiH$—¿Ü×ÔÏÅÞÑ姉KSótÄ' ¶8¼ŒÞÔyì_†æU#:´‘d=Ûsø\†J°ûÂéê|r&AùæFÒãs‡od÷ïÑ–½i’||[[Ø÷Ù·v ©>‚rÍ’80ÄóÏw5ÏïßNª <ÛX•“«,âÈ"6#Ä'uGPιöŽ oÞóg–'tæÚS9«„†9NQEQX¿JBQ£µhŠÒéh}øXš¦tºB".ß½“)"”NGÑù"ºP‚¬ˆæèÎÐE1…EÔ{DU Âtá —, ýïÊBðƒq´1S“Þeb\ZNÊë»Z…$É«.^Ò º%ÞÖß×ݵ#ÅÙø˽==VĤ±WýڻطÌaMÒ/7÷¹§±¢)ýZ:Û‡&±¢ÌSž.®c6žgE«'wvv|ƶ®¼›Ž.ýgmeEÇVFº:ùßdWó5/½\: üÝÛ?ÜÝÍï<ñšÊðsr o;š3®.Oòôô9Á^ææáëß›©cç{{ym~à ¡ýÜ\"tl®^¯òöôXv›Û~7("Ôžy6+JÙíåæ>óX +š9¨µ³}H›áì³ή£þ:EZá÷‰²c)ÈëŸÛoÚ£ûØÞÛ`„ ÍÜ]aöYnb¦ff© ÷ßÀÌÜÜ@¨Fnbj^A‰x3ss™˜Ë›¡ÜÔÜ\ÃÝÇ™™›IEì•¡ÜÜœâÔ;$477—Ë8j±ÜÜÜŒ ïøfææ&ÆœŸ»@llfn&Ò¿ÌÌÜ\jbÄ]ÌÌÍôù@¦æ扜»ÈÌÌÍ¥úðè&¦f¹B}333!—GcSssa¡²˜Š¹Œ›˜›K¸4ØÜÜÜÈ@DZál‹u˜Ädî–€pƒ€€Ø„„„„„ß=7ØyÞøûQ;vî{–ªâ½APPöúP¿»Õ¤í0c ˆÇ3«pxûLRwå|ÜÀ²ú¶ù©’MËË—/_¾råèÆYï^œ™qYEÆ‚ÿ6Ê:· PÂ?§ƒÙæµãcؤŽÏ¢±#Ô¨©>‚òË ðìîYåy ßF%ðoß ¾Î)? 7 ñ~œ‘©Ý¢^Mö?×R ŠD5‚†mžÒžƒ œÛ ÊRå<½sIÜúÜ… /^\=©ýã GïN “UåB™H+®±û¯‘P(6 ù¹[Eåý=3ÉNu‚òÎ ëFÖRs¹Hø4ÏÆÉB«Uº#(ïܨïÖ^÷ö ÍcÍÓiÆÒOž¤*´‚¡Èaõø‡}•ôICü¹¡šG+WÞÛÞ-{ØGrb¢T’ɽY•””¤Ò‡INJTJL¹ mvRRR.÷2HMNJT`ÎA˜ÊIJJRh¹ÇÒS“E…Ê’”¥âÎÏNOMLTÒ¬ŒQ'%&fæªH+ü>ñ1>±ÜJ†Z™Gad 3à}–Ïx!§s €òS`3ð㈾JúdèøA¹A@@ì      ‚ÿÊÞ£~fñཋÇÁgDf-™Cª \sC™–˜XølÚôtÊŒÔÁe¬ý•²d«M ñk¹ñL—úRâøGP~Ç"ÄÀ,ë!ü¥KRwå]§* Bïn¬Ý”`µ©q' Ü(4•>xÈÒð)Ç%„„…µ«Ø# Ò-ÏlQ‰ÜD@¸QÈÒÀ™“g·ï¿ #B ÂüAãݳ¯E•ÿИ å».~eÛ²Š5êÔøwÄH~—ŸÂMëñññ ½?_jÒ»¸ø$în:7>>.KÉùÊe¦&ÆÅ'ê}åT qqé9œ¯œ"#9.þw1£Iˆ‹KÍÌeEJEj\ü; çܧKˆ‹KJËfEÚ¼ôøø»ž‰éwñqï’ÙS“VgÆÇ'(in´LŒOx—ÊÚ¬øøø\îelY’¹²PEÊ’V¤,y ñq™EËB.‹‚øý}¯ÀeƒÁtJ3‡ÞSNcÌàžîNmµlÏ—¸º8/½›ÂŠz7ó³k–McŒ1~·ÅÅÑaƉ¬h|ïðÆ Þ±¢ôcζö#מaE+Æ·³mäó˜Âcœó³]ïi›XÑá¥=ím½þÑ`Œ1V=wihצßVtgïGG3¹cŒµiž6ö͇³¢wÇ9»¸ÿ†1ƘÖ8:{xvgEʘ9®®®^©ØËÖ>Žv­5l®^.wuvZ|3‘õkÕĶah&+JÚáâà0õð]V4µ³Æ šÄ±Î8ålk7låqLð]‚?mÚ´25*F¥2¨Z;´Ep%cÁ¿8,¬¬¼ý½Ô¯‰€Ðغºsㆥ¨`iåáãÓ°am>àˬ«Ù¸94¶2–€IKgO/›†u„€'µ®VßÞ²¹™XØ:{Ø6¨+AHl]µŽ—‡s5+3Uh`ïf× ž ­«Ôðñv«YÍ„fµºÚ7¬gÄ@|«ÊU}ý<ëÔª|‰iµ:NŽ ê™YVªäëïU¯^u@"yåZöN˜‰x`aeíåï]¿A-Y×°siܨ¢*XX¹ûx7*(K#7[k¹äæN^6 ëˆ ÊâP¥‚1飿CŸX‚gonnnnn|ÜÀïù›€à?‹²÷SaŒ¢OìÚpéÆCHlœ½{vi!$!\ þë(kíc@ê‰ÃÏÆóÂ[´4F9§îÏ5÷:ü'©;‚ò=na°ã VIDAT ”xëر—Ì„];Ôø¹g˜g«3¯¨'{IHõ”k{#[‘ÊÈ}kÆ€1™TšŽ”Lꎠ¼s£Ž­¯¡êí¤ù4ioYÂËúw©NLr‚òmoÆ€T¯Žùwž¡ÎUÐÀ7’›]q¼»½„¸Œ”kn`MJL‹.¦~‡÷igŠ²ö­_½ÿÆëå/zZ¡Ay7`ëpŸu vç÷®À0BÌØ ·û¦Ç÷þNª <ÛôÓG K‹Ú€ÊêkªÒÅ“º#(çÜà;¹W‰}»SsîæS™†r»ÏxYnŽB‘“Ç T´F¡Phh. µ27G¡ÈåDŒV¡P¨uœûµ*/W¡Èeôžß …B¥áŽÕ¨rŠΕS …"OÍyfë4y EŽþY:G¡ÈUr§ËÒZe!“£Päèke(•B¡Ðq®ä8W¡Pä(9õ’V+ -÷2ÈËQ(ú²0…B¡¡Ê.‹Z™«Pä.‹R_‚ïe¸Š3X“ò ÄËÉ'°óþ“ÎØק…»§WPt&f>Ýu¼©›‹]ãVzñÅNöÞáüÅ{„y7ªÌù‹'lv´µv<–ýÚ#¸AßÎ_ü¨}#›akN±¢ec[7¬çùXÇú‹_·¯ß¨Çä ¬èПÝlº]çüÅŸ9ÖmÔ²Ï,Vt{÷@[[×Szq×úýÃfE Æ:88ïMåüÅýlí]ܺpþâ÷f:::®Óû‹·ðtµmÔBï/¾ÔÉÁ~Ñw¬(²¹oúœ¿xâ6ÛÆ“ÝaE“"CÔñÑû‹Ÿ´oh3dùQâ™ý}¢Ìx¸ ¬ØèÔ¹c3'Lß½~9… öMŸ^Sò9¡ }‚‚24fÜP%«RÇDÌ^¹ùT¨/âr#­ÒÈŠó¢¶uóÓ˜è¤ì…È:$4´QMKöª¶W˜ZaÄfD`Vݦ+²®ãV{Ï0¸i˜yý†¬È¤ŠSh¨‰%Ÿ-¡((bªT±æÓêø7ok¶›»e\(©;‚r=n „b/ØõÏüûB˜5@ÊÍ͇Ì>= 4Ä„,”o{#jË.ËF^aÜ®láÒÙ+ÖÌ9ˆåš8G‰çéì:zÍ)Ò ¿O”+°¬öÙã:´ܵusàÓ}ò’Í?Ï-ÖÈX.rÞÝÀ—Ëåwehl,7‘p<±±\.ržÙ†Fr1GbžP.—ˆ9gl±ÔHn¢áîC¹\nhÀùz %†rc}ñøÆr¹‘Œó9ç‹dr¹\¨™ÜD.12à.r¹\ĉ‘\.r|©\.ó9™‘ÜXÎ3âj/‘Ëå—GC#c¹I~"¹ÜD*âò(•ÉåÎË å&e!øñì n¶J¿} ““77ˆ½A@@@¸A@@¸A@@¸A@@¸A@ðrC?¡õ¾³ÆÉ|A9åF(§³ƒçEeÁB½æ×Nþþþþþþ¡£u$ÐA9ãÛÞÑ‹³ë^ŠÅ¸€*xEïWSG/Þ²wýôæJhx²*HðŸà#îA˺xü$¡t” ôtAª¤{ë_ :­<ÞÊQ PíЩõ~Íš{W7Þl‚ (7ãF?÷mß¾sýü_Ôú=£ ñÞ6¡ù'1ŒÅ&µkhu–ì!uJP^¸1’[T²¶¶²¨hZØœx{ý®ØP,d7"HXƒ¡.“:%(/ÜxŸ ¡HÌðe…“ªd„œEê” üèT¥ƒ/äc  0:È‚ áX6¨HiÕ…~`§ >Ÿœ^GPî¹QÙ£¥&'7Eo”­9“Î7pï@ê” \sX××åeúíëG®x²]%–LýÕõO=}ûŒ3è5É÷ïÇ$çq§k¿|òà^Ìîðn]úý˜˜„,îÌïøïÅ<Ò²"*û~̽7© V”÷ô^ÌC5w`y^ì½{/ÒXQVò‹{1ò؉5F{ïÞ“W‰¬H™ñ:&&VÁúcêaLÌçoY‘.'îþýØL6S˜y|?&öáKnXT&Þ¿?MÃMÕ={sÿç®I¹?&I_–WOÞ‹yÂ_®Ë¸ŸÉRžðªpY÷ïÝ{B"}}¯øøã–³ž^ppñ?ŸÇ<Ž1~qæwOï6#»´ö÷t˜uæÃ)´ñóqwíÀ/þb¹—§ÇŠ{ìQÞ¸_ë gûÜùâ‰Û=ÝÜfŸzÈŠ&÷káhòŽeœðpv³á,+Z=©£“}Àö¸îœÎýfnaEG—Gº8ùßäÎáiï1p+º»o˜››ïYî|ñt?×°6£XÑ»¨‰žž>ûÓ¸óÅCÝ<|ýz³"Õýyÿkïîu›†Â8ŒÿO“æ³I“4Äq$®©U %,Z.¢+·Ð[`•!$$n+(ò‰'i’¦Î‡ª.!–"žßdëLïð Žßv»ýúëdùúìÑÃ{»G«ýâ§/Ûû÷_|¶Ë£ãÃ';Û«ýâ7ööN>|Y?½»ýøÛò(ú´¿³ûüÕG6yßLpïo1ØnTkºùµUTƘžúþí;?.ݹý›Ý¾µó$åº c¤éÀv‡ÅºSΤ$…~'ž™fËY3ÒlèƒBµ^Ég$E¡?¾LœV3m¤ù…çG¹RµVÊK:‚ÁxÞh¹ëFZ\zö,S,×+’ƃ°w>Ýj¹Y#%SÏ릳ÅF}SR<: ûqu9H2·žoÒ¹¦S“4›DÁ÷ɦãSR’t¬M̺ëÞ’´ˆû~8*5Ü´‘X;»še6°Á°¸å”³)IaЉ§?g™<¿_¨Ô+…Œ¤^è®fY\x6Ê•W³à¦ùË;±×ÿ©ÀÚqð½q-­_<ÿ{m´€6Úh  €6Úh  €6Úh  ´Ð@m´Ð@mÿ¬K}‘¶'‡|IEND®B`‚suricata-3.2.1/doc/userguide/configuration/suricata-yaml.rst0000644000000000000000000024135313051004444021137 00000000000000Suricata.yaml ============= Suricata uses the Yaml format for configuration. The Suricata.yaml file included in the source code, is the example configuration of Suricata. This document will explain each option. At the top of the YAML-file you will find % YAML 1.1. Suricata reads the file and identifies the file as YAML. .. _suricata-yaml-max-pending-packets: Max-pending-packets ------------------- With the max-pending-packets setting you can set the number of packets you allow Suricata to process simultaneously. This can range from one packet to tens of thousands/hundreds of thousands of packets. It is a trade of higher performance and the use of more memory (RAM), or lower performance and less use of memory. A high number of packets being processed results in a higher performance and the use of more memory. A low number of packets, results in lower performance and less use of memory. Choosing a low number of packets being processed while having many CPU's/CPU cores, can result in not making use of the whole computer-capacity. (For instance: using one core while having three waiting for processing packets.) :: max-pending-packets: 1024 Runmodes -------- By default the runmode option is disabled With the runmodes setting you can set the runmode you would like to use. For all runmodes available, enter **--list-runmodes** in your command line. For more information, see :doc:`../performance/runmodes`. :: runmode: autofp Default-packet-size ------------------- For the max-pending-packets option, Suricata has to keep packets in memory. With the default-packet-size option, you can set the size of the packets on your network. It is possible that bigger packets have to be processed sometimes. The engine can still process these bigger packets, but processing it will lower the performance. :: default-packet-size: 1514 User and group -------------- It is possible to set the user and group to run Suricata as: :: run-as: user: suri group: suri .. _suricata-yaml-action-order: Action-order ------------ All signatures have different properties. One of those is the Action property. This one determines what will happen when a signature matches. There are four types of Action. A summary of what will happen when a signature matches and contains one of those Actions: 1) Pass If a signature matches and contains pass, Suricata stops scanning the packet and skips to the end of all rules (only for the current packet). 2) Drop This only concerns the IPS/inline mode. If the program finds a signature that matches, containing drop, it stops immediately. The packet will not be sent any further. Drawback: The receiver does not receive a message of what is going on, resulting in a time-out (certainly with TCP). Suricata generates an alert for this packet. 3) Reject This is an active rejection of the packet. Both receiver and sender receive a reject packet. There are two types of reject packets that will be automatically selected. If the offending packet concerns TCP, it will be a Reset-packet. For all other protocols it will be an ICMP-error packet. Suricata also generates an alert. When in Inline/IPS mode, the offending packet will also be dropped like with the 'drop' action. 4) Alert If a signature matches and contains alert, the packet will be treated like any other non-threatening packet, except for this one an alert will be generated by Suricata. Only the system administrator can notice this alert. Inline/IPS can block network traffic in two ways. One way is by drop and the other by reject. Rules will be loaded in the order of which they appear in files. But they will be processed in a different order. Signatures have different priorities. The most important signatures will be scanned first. There is a possibility to change the order of priority. The default order is: pass, drop, reject, alert. :: action-order: - pass - drop - reject - alert This means a pass rule is considered before a drop rule, a drop rule before a reject rule and so on. Splitting configuration in multiple files ----------------------------------------- Some users might have a need or a wish to split their suricata.yaml file in to seperate files, this is available vis the 'include' and '!include' keyword. The first example is of taking the contents of the outputs section and storing them in outputs.yaml :: # outputs.yaml - fast enabled: yes filename: fast.log append: yes - unified2-alert: enabled: yes ... :: # suricata.yaml ... outputs: !include outputs.yaml ... The second scenario is where multiple sections are migrated to a different YAML file. :: # host_1.yaml max-pending-packets: 2048 outputs: - fast enabled: yes filename: fast.log append: yes - unified2-alert: enabled: yes :: # suricata.yaml include: host_1.yaml ... If the same section, say outputs is later redefined after the include statement it will overwrite the included file. Therefor any include statement at the end of the document will overwrite the already configured sections. Event output ------------ Default logging directory ~~~~~~~~~~~~~~~~~~~~~~~~~ In the /var/log/suricata directory, all of Suricata's output (alerts and events) will be stored. :: default-log-dir: /var/log/suricata This directory can be overridden by entering the -l command line parameter or by changing the directory directly in Yaml. To change it with the -l command line parameter, enter the following: :: suricata -c suricata.yaml -i eth0 -l /var/log/suricata-logs/ Outputs ~~~~~~~ There are several types of output. The general structure is: :: outputs: -fast: enabled: yes filename: fast.log append: yes/no Enabling all of the logs, will result in a much lower performance and the use of more disc space, so enable only the outputs you need. Line based alerts log (fast.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log contains alerts consisting of a single line. Example of the appearance of a single fast.log-file line: :: 10/05/10-10:08:59.667372  [**] [1:2009187:4] ET WEB_CLIENT ACTIVEX iDefense COMRaider ActiveX Control Arbitrary File Deletion [**] [Classification: Web Application Attack] [Priority: 3] {TCP} xx.xx.232.144:80 -> 192.168.1.4:56068 :: -fast: #The log-name. enabled:yes #This log is enabled. Set to 'no' to disable. filename: fast.log #The name of the file in the default logging directory. append: yes/no #If this option is set to yes, the last filled fast.log-file will not be #overwritten while restarting Suricata. Eve (Extensible Event Format) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is an JSON output for alerts and events. It allows for easy integration with 3rd party tools like logstash. :: # Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: yes filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above #identity: "suricata" #facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug #redis: # server: 127.0.0.1 # port: 6379 # mode: list ## possible values: list (default), channel # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting as to be reserved to high traffic suricata. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entry to keep in buffer types: - alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) http: yes # enable dumping of http fields tls: yes # enable dumping of tls fields ssh: yes # enable dumping of ssh fields smtp: yes # enable dumping of smtp fields # Enable the logging of tagged packets for rules using the # "tag" keyword. tagged-packets: yes # HTTP X-Forwarded-For support by adding an extra field or overwriting # the source or destination IP address (depending on flow direction) # with the one reported in the X-Forwarded-For HTTP header. This is # helpful when reviewing alerts for traffic that is being reverse # or forward proxied. xff: enabled: no # Two operation modes are available, "extra-data" and "overwrite". mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used. deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration. header: X-Forwarded-For - http: extended: yes # enable this for extended logging information # custom allows additional http fields to be included in eve-log # the example below adds three additional fields when uncommented #custom: [Accept-Encoding, Accept-Language, Authorization] - dns: # control logging of queries and answers # default yes, no to disable query: yes # enable logging of DNS queries answer: yes # enable logging of DNS answers # control which RR types are logged # all enabled if custom not specified #custom: [a, aaaa, cname, mx, ns, ptr, txt] - tls: extended: yes # enable this for extended logging information - files: force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256 #force-hash: [md5] #- drop: # alerts: yes # log alerts that caused drops # flows: all # start or all: 'start' logs only a single drop # # per flow direction. All logs each dropped pkt. - smtp: #extended: yes # enable this for extended logging information # this includes: bcc, message-id, subject, x_mailer, user-agent # custom fields logging from the list: # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, # x-originating-ip, in-reply-to, references, importance, priority, # sensitivity, organization, content-md5, date #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] # output md5 of fields: body, subject # for the body you need to set app-layer.protocols.smtp.mime.body-md5 # to yes #md5: [body, subject] - ssh - stats: totals: yes # stats for all threads merged together threads: no # per thread stats deltas: no # include delta values # bi-directional flows - flow # uni-directional flows #- netflow For more advanced configuration options, see :ref:`Eve JSON Output `. The format is documented in :ref:`Eve JSON Format `. Log output for use with Barnyard (unified.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log only supports IPv4. Its information will be stored in the default logging directory. This log is designed to be stored in a binary format on the hard disc, where it will be further processed by Barnyard. Barnyard can store the output in a database, so Suricata can work on other important tasks. Barnyard can add the files in the Mysql-database, send them to Sguil or several other output options. There is a size-limit to the log-file: If Suricata generates an alert, it stores this alert in a unified-file. Suricata keeps continuing doing that, until the file has reached its limit. Which in the default case is at 32 MB. At that point Suricata generates a new file and the process starts all over again. Barnyard keeps on processing these files. To prevent Suricata from filling up the hard disc, a size limit is enforced. When the limit is reached, the file will 'role-over', creating a new file. Barnyard removes old files. To every file, Suricata adds a time stamp, so it is easy to see which one came first and which one is the latter. :: -Unified-log: #The log-name. enabled: no #This log is not enabled. Set 'yes' to enable. filename: unified.log #The name of the file in the default logging directory. limit: 32 #The file size limit in megabytes. This output option has been removed in Suricata 1.1rc1 (see ticket #353). Alert output for use with Barnyard (unified.alert) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log only supports IPv4. Its information will be stored in the default logging directory. For further information read the above information about ( 2) unified.log) :: -Unified-alert: #The log-name. enabled: no #This log is not enabled. Set 'yes' to enable. filename: unified.alert #The name of the file in the default logging directory. limit: 32 #The file size limit in megabytes. This output option has been removed in Suricata 1.1rc1 (see ticket #353). Alert output for use with Barnyard2 (unified2.alert) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log also supports IPv6 in addition to IPv4. It's information will be stored in the default logging directory. For further information read the above information about 2. unified.log. :: - unified2-alert: #The log-name. enabled: yes #This log is enabled. Set 'no' to disable. filename: unified2.alert #The name of the file in the default logging directory. limit: 32 #The file size limit in megabytes. This alert output needs Barnyard2. A line based log of HTTP requests (http.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log keeps track of all HTTP-traffic events. It contains the HTTP request, hostname, URI and the User-Agent. This information will be stored in the http.log (default name, in the suricata log directory). This logging can also be performed through the use of the :ref:`Eve-log capability `. Example of a HTTP-log line with non-extended logging: :: 07/01/2014-04:20:14.338309 vg.no [**] / [**] Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 [**] 192.168.1.6:64685 -> 195.88.54.16:80 Example of a HTTP-log line with extended logging: :: 07/01/2014-04:21:06.994705 vg.no [**] / [**] Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36 [**] [**] GET [**] HTTP/1.1 [**] 301 => http://www.vg.no/ [**] 239 bytes [**] 192.168.1.6:64726 -> 195.88.54.16:80 :: - http-log: #The log-name. enabled: yes #This log is enabled. Set 'no' to disable. filename: http.log #The name of the file in the default logging directory. append: yes/no #If this option is set to yes, the last filled http.log-file will not be # overwritten while restarting Suricata. extended: yes # If set to yes more information is written about the event. A line based log of DNS queries and replies (dns.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This log keeps track of all DNS events (queries and replies). It contains the type of DNS activity that has been performed, the requested / replied domain name and relevant data suck as client, server, ttl, resource record data. This logging can also be performed through the use of the :ref:`Eve-log capability ` which offers easier parsing. Example of the apperance of a DNS log of a query with a preceding reply: :: 07/01/2014-04:07:08.768100 [**] Query TX 14bf [**] zeustracker.abuse.ch [**] A [**] 192.168.1.6:37681 -> 192.168.1.1:53 07/01/2014-04:07:08.768100 [**] Response TX 14bf [**] zeustracker.abuse.ch [**] A [**] TTL 60 [**] 205.188.95.206 [**] 192.168.1.1:53 -> 192.168.1.6:37681 Non-existant domains and other DNS errors are recorded by the text representation of the rcode field in the reply (see RFC1035 and RFC2136 for a list). In the example below a non-existent domain is resolved and the NXDOMAIN error logged: :: 02/25/2015-22:58:40.499385 [**] Query TX a3ce [**] nosuchdomainwfqwdqwdqw.com [**] A [**] 192.168.40.10:48361 -> 192.168.40.2:53 02/25/2015-22:58:40.499385 [**] Response TX a3ce [**] NXDOMAIN [**] 192.168.40.2:53 -> 192.168.40.10:48361 02/25/2015-22:58:40.499385 [**] Response TX a3ce [**] NXDOMAIN [**] 192.168.40.2:53 -> 192.168.40.10:48361 Configuration options: :: - dns-log: # The log-name enabled: yes # If this log is enabled. Set 'no' to disable filename: dns.log # Name of this file this log is written to in the default logging directory append: yes # If this option is set to yes, the (if any exists) dns.log file wil not be overwritten while restarting Suricata. filetype: regular / unix_stream / unix_dgram Packet log (pcap-log) ~~~~~~~~~~~~~~~~~~~~~ With the pcap-log option you can save all packets, that are registered by Suricata, in a log file named _log.pcap_. This way, you can take a look at all packets whenever you want. In the normal mode a pcap file is created in the default-log-dir. It can also be created elsewhere if a absolute path is set in the yaml-file. The file that is saved in example the default -log-dir /var/log/suricata, can be be opened with every program which supports the pcap file format. This can be Wireshark, TCPdump, Suricata, Snort and many others. The pcap-log option can be enabled and disabled. There is a size limit for the pcap-log file that can be set. The default limit is 32 MB. If the log-file reaches this limit, the file will be rotated and a new one will be created. The pcap-log option has an extra functionality for "Sguil":http://sguil.sourceforge.net/ that can be enabled in the 'mode' option. In the sguil mode the "sguil_base_dir" indicates the base directory. In this base dir the pcaps are created in a Sguil-specific directory structure that is based on the day: :: $sguil_base_dir/YYYY-MM-DD/$filename. If you would like to use Suricata with Sguil, do not forget to enable (and if necessary modify) the base dir in the suricata.yaml file. Remember that in the 'normal' mode, the file will be saved in default-log-dir or in the absolute path (if set). By default all packets are logged except: - TCP streams beyond stream.reassembly.depth - encrypted streams after the key exchange :: - pcap-log: enabled: yes filename: log.pcap # Limit in MB. limit: 32 mode: sguil # "normal" (default) or sguil. sguil_base_dir: /nsm_data/ Verbose Alerts Log (alert-debug.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is a log type that gives supplementary information about an alert. It is particularly convenient for people who investigate false positives and who write signatures. However, it lowers the performance because of the amount of information it has to store. :: - alert-debug: #The log-name. enabled: no #This log is not enabled. Set 'yes' to enable. filename: alert-debug.log #The name of the file in the default logging directory. append: yes/no #If this option is set to yes, the last filled fast.log-file will not be # overwritten while restarting Suricata. Alert output to prelude (alert-prelude) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To be able to use this type, you have to connect with the prelude manager first. Prelude alerts contain a lot of information and fields, including the IPfields in of the packet which triggered the alert. This information can be divided in three parts: - The alert description (sensor name, date, ID (sid) of the rule, etc). This is always included - The packets headers (almost all IP fields, TCP UDP etc. if relevant) - A binary form of the entire packet. Since the last two parts can be very big (especially since they are stored in the Prelude SQL database), they are optional and controlled by the two options 'log_packet_header' and 'log_packet_content'. The default setting is to log the headers, but not the content. The profile name is the name of the Prelude profile used to connect to the prelude manager. This profile must be registered using an external command (prelude-admin), and must match the uid/gid of the user that will run Suricata. The complete procedure is detailed in the `Prelude Handbook `_. :: - alert-prelude: #The log-name. enabled: no #This log is not enabled. Set 'yes' to enable. profile: suricata #The profile-name used to connect to the prelude manager. log_packet_content: no #The log_packet_content is disabled by default. log_packet_header: yes #The log _packet_header is enabled by default. Stats ~~~~~ In stats you can set the options for stats.log. When enabling stats.log you can set the amount of time in seconds after which you want the output-data to be written to the log file. :: - stats: enabled: yes #By default, the stats-option is enabled filename: stats.log #The log-name. Combined with the default logging directory #(default-log-dir) it will result in /var/log/suricata/stats.log. #This directory can be overruled with a absolute path. (A #directory starting with / ). interval: 8 #The default amount of time after which the file will be #refreshed. append: yes/no #If this option is set to yes, the last filled fast.log-file will not be #overwritten while restarting Suricata. Syslog ~~~~~~ With this option it is possible to send all alert and event output to syslog. :: - syslog: #This is a output-module to direct log-output to several directions. enabled: no #The use of this output-module is not enabled. facility: local5 #In this option you can set a syslog facility. level: Info #In this option you can set the level of output. The possible levels are: #Emergency, Alert, Critical, Error, Warning, Notice, Info and Debug. Drop.log, a line based information for dropped packets ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If Suricata works in IPS mode, it can drop packets based on rules. Packets that are being dropped are saved in the drop.log file, a Netfilter log format. :: - drop: enabled: yes #The option is enabled. filename: drop.log #The log-name of the file for dropped packets. append: yes #If this option is set to yes, the last filled drop.log-file will not be #overwritten while restarting Suricata. If set to 'no' the last filled drop.log file will be overwritten. Detection engine ---------------- Inspection configuration ~~~~~~~~~~~~~~~~~~~~~~~~ The detection-engine builds internal groups of signatures. Suricata loads signatures, with which the network traffic will be compared. The fact is, that many rules certainly will not be necessary. (For instance: if there appears a packet with the UDP-protocol, all signatures for the TCP-protocol won't be needed.) For that reason, all signatures will be divided in groups. However, a distribution containing many groups will make use of a lot of memory. Not every type of signature gets its own group. There is a possibility that different signatures with several properties in common, will be placed together in a group. The quantity of groups will determine the balance between memory and performance. A small amount of groups will lower the performance yet uses little memory. The opposite counts for a higher amount of groups. The engine allows you to manage the balance between memory and performance. To manage this, (by determining the amount of groups) there are several general options:high for good performance and more use of memory, low for low performance and little use of memory. The option medium is the balance between performance and memory usage. This is the default setting.The option custom is for advanced users. This option has values which can be managed by the user. :: detect: profile: medium custom-values: toclient-groups: 2 toserver-groups: 25 sgh-mpm-context: auto inspection-recursion-limit: 3000 At all of these options, you can add (or change) a value. Most signatures have the adjustment to focus on one direction, meaning focusing exclusively on the server, or exclusively on the client. If you take a look at example 4, *the Detection-engine grouping tree*, you see it has many branches. At the end of each branch, there is actually a 'sig group head'. Within that sig group head there is a container which contains a list with signatures that are significant for that specific group/that specific end of the branch. Also within the sig group head the settings for Multi-Pattern-Matcher (MPM) can be found: the MPM-context. As will be described again at the part 'Pattern matching settings', there are several MPM-algorithms of which can be chosen from. Because every sig group head has its own MPM-context, some algorithms use a lot of memory. For that reason there is the option sgh-mpm-context to set whether the groups share one MPM-context, or to set that every group has its own MPM-context. For setting the option sgh-mpm-context, you can choose from auto, full or single. The default setting is 'auto', meaning Suricata selects full or single based on the algorithm you use. 'Full' means that every group has its own MPM-context, and 'single' that all groups share one MPM-context. The two algorithms ac and ac-gfbs are new in 1.03. These algorithms use a single MPM-context if the Sgh-MPM-context setting is 'auto'. The rest of the algorithms use full in that case. The inspection-recursion-limit option has to mitigate that possible bugs in Suricata cause big problems. Often Suricata has to deal with complicated issues. It could end up in an 'endless loop' due to a bug, meaning it will repeat its actions over and over again. With the option inspection-recursion-limit you can limit this action. *Example 4 Detection-engine grouping tree* .. image:: suricata-yaml/grouping_tree.png :: src Stands for source IP-address. dst Stands for destination IP-address. sp Stands for source port. dp Stands for destination port. *Example 5 Detail grouping tree* .. image:: suricata-yaml/grouping_tree_detail.png .. _suricata-yaml-prefilter: Prefilter Engines ~~~~~~~~~~~~~~~~~ The concept of prefiltering is that there are far too many rules to inspect individually. The approach prefilter takes is that from each rule one condition is added to prefilter, which is then checked in one step. The most common example is MPM (also known as fast_pattern). This takes a single pattern per rule and adds it to the MPM. Only for those rules that have at least one pattern match in the MPM stage, individual inspection is performed. Next to MPM, other types of keywords support prefiltering. ICMP itype, icode, icmp_seq and icmp_id for example. TCP window, IP TTL are other examples. For a full list of keywords that support prefilter, see: :: suricata --list-keywords=all Suricata can automatically select prefilter options, or it can be set manually. :: detect: prefilter: default: mpm By default, only MPM/fast_pattern is used. The prefilter engines for other non-MPM keywords can then be enabled in specific rules by using the 'prefilter' keyword. E.g. :: alert ip any any -> any any (ttl:123; prefilter; sid:1;) To let Suricata make these decisions set default to 'auto': :: detect: prefilter: default: auto CUDA (Compute United Device Architecture) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suricata utilizes CUDA for offloading CPU intensive tasks to the (NVIDIA) GPU (graphics processing unit). Suricata supports an experimental multi-pattern-matcher using CUDA. Only if you have compiled Suricata with CUDA (by entering --enable-cuda in the configure stage) you can make use of these features. There are several options for CUDA. The option 'packet_buffer_limit' designates how many packets will be send to the GPU at the same time. Suricata sends packets in 'batches', meaning it sends multiple packets at once. As soon as Suricata has collected the amount of packets set in the 'packet_buffer_limit' option, it sends them to the GPU. The default amount of packets is 2400. The option 'packet_size_limit' makes sure that packets with payloads bigger than a certain amount of bytes will not be send to the GPU. Other packets will be send to the GPU. The default setting is 1500 bytes. The option 'packet_buffers' designates the amount of buffers that will be filled with packets and will be processed. Buffers contain the batches of packets. During the time these filled buffers are being processed, new buffers will be filled. The option 'batching_timeout' can have all values higher than 0. If a buffers is not fully filled after a period of time (set in this option 'batching_timeout'), the buffer will be send to the GPU anyway. The option 'page_locked' designates whether the page locked memory will or will not be used. The advantage of page locked memory is that it can not be swapped out to disk. You would not want your computer to use your hard disk for Suricata, because it lowers the performance a lot. In this option you can set whether you still want this for CUDA or not. The option 'device_id' is an option within CUDA to determine which GPU should be turned to account.(If there is only one GPU present at your computer, there is no benefit making use of the 'device-id' option.) To detect the id of your GPU's, enter the following in your command line: :: suricata --list-cuda-cards With the option 'cuda_streams' you can determine how many cuda-streams should be used for asynchronous processing. All values > 0 are valid. For this option you need a device with Compute Capability > 1.0 and page_locked enabled to have any effect. :: cuda: -mpm: packet_buffer_limit: 2400 packet_size_limit: 1500 packet_buffers: 10 batching_timeout: 1 page_locked: enabled device_id: 0 cuda_streams: 2 Pattern matcher settings ~~~~~~~~~~~~~~~~~~~~~~~~ The multi-pattern-matcher (MPM) is a part of the detection engine within Suricata that searches for multiple patterns at once. Generally, signatures have one ore more patterns. Of each signature, one pattern is used by the multi-pattern-matcher. That way Suricata can exclude many signatures from being examined, because a signature can only match when all its patterns match. These are the proceedings: 1)A packet comes in. 2)The packed will be analysed by the Multi-pattern-matcher in search of patterns that match. 3)All patterns that match, will be further processed by Suricata (signatures). *Example 8 Multi-pattern-matcher* .. image:: suricata-yaml/MPM2.png Suricata offers various implementations of different multi-pattern-matcher algorithm's. These can be found below. To set the multi-pattern-matcher algorithm: :: mpm-algo: b2gc After 'mpm-algo', you can enter one of the following algorithms: b2g, b2gc, b2gm, b3g, wumanber, ac and ac-gfbs (These last two are new in 1.0.3). For more information about these last two, please read again the the end of the part 'Detection engine'. These algorithms have no options, so the fact that below there is no option being mentioned is no omission. Subsequently, you can set the options for the mpm-algorithm's. The hash_size option determines the size of the hash-table that is internal used by the pattern matcher. A low hash-size (small table) causes lower memory usage, but decreases the performance. The opposite counts for a high hash-size: higher memory usage, but (generally) higher performance. The memory settings for hash size of the algorithms can vary from lowest (2048) - low (4096) - medium (8192) - high (16384) - higher (32768) – max (65536). (Higher is 'highest' in YAML 1.0 -1.0.2) The bf_size option determines the size of the bloom filter, that is used with the final step of the pattern matcher, namely the validation of the pattern. For this option the same counts as for the hash-size option: setting it to low will cause lower memory usage, but lowers the performance. The opposite counts for a high setting of the bf_size: higher memory usage, but (generally) higher performance. The bloom-filter sizes can vary from low (512) - medium (1024) - high (2048). :: pattern-matcher: - b2gc: search_algo: B2gSearchBNDMq hash_size: low #Determines the size of the hash-table. bf_size: medium #Determines the size of the bloom- filter. - b3g: search_algo: B3gSearchBNDMq hash_size: low #See hash-size -b2gc. bf_size: medium #See bf-size -b2gc. - wumanber: hash_size: low #See hash-size -b2gc. bf_size: medium #See bf-size -b2gc. Threading --------- Suricata is multi-threaded. Suricata uses multiple CPU' s/CPU cores so it can process a lot of network packets simultaneously. (In a single-core engine, the packets will be processed one at a time.) There are four thread-modules: Packet acquisition, decode and stream application layer, detection, and outputs. # The packet acquisition module reads packets from the network. # The decode module decodes the packets and the stream application application layer has three tasks: :: First: it performs stream-tracking, meaning it is making sure all steps will be taken to make a correct network-connection. Second: TCP-network traffic comes in as packets. The Stream-Assembly engine reconstructs the original stream. Finally: the application layer will be inspected. HTTP and DCERPC will be analyzed. # The detection threads will compare signatures. There can be several detection threads so they can operate simultaneously. # In Outputs all alerts and events will be processed. *Example 6 Threading* .. image:: suricata-yaml/threading.png :: Packet acquisition: Reads packets from the network Decode: Decodes packets. Stream app. Layer: Performs stream-tracking and reassembly. Detect: Compares signatures. Outputs: Processes all events and alerts. Most computers have multiple CPU's/ CPU cores. By default the operating system determines which core works on which thread. When a core is already occupied, another one will be designated to work on the thread. So, which core works on which thread, can differ from time to time. There is an option within threading: :: set-cpu-affinity: no With this option you can cause Suricata setting fixed cores for every thread. In that case 1, 2 and 4 are at core 0 (zero). Each core has its own detect thread. The detect thread running on core 0 has a lower priority than the other threads running on core 0. If these other cores are to occupied, the detect thread on core 0 has not much packets to process. De detect threads running on other cores will process more packets. This is only the case after setting the option at 'yes'. *Example 7 Balancing workload* .. image:: suricata-yaml/balancing_workload.png You can set the detect-thread-ratio: :: detect-thread-ratio: 1.5 The detect thread-ratio will determine the amount of detect threads. By default it will be 1.5 x the amount of CPU's/CPU cores present at your computer. This will result in having more detection threads then CPU's/ CPU cores. Meaning you are oversubscribing the amount of cores. This may be convenient at times when there have to be waited for a detection thread. The remaining detection thread can become active. In the option 'cpu affinity' you can set which CPU's/cores work on which thread. In this option there are several sets of threads. The management-, receive-, decode-, stream-, detect-, verdict-, reject- and outputs-set. These are fixed names and can not be changed. For each set there are several options: cpu, mode, and prio. In the option 'cpu' you can set the numbers of the CPU's/cores which will run the threads from that set. You can set this option to 'all', use a range (0-3) or a comma separated list (0,1). The option 'mode' can be set to 'balanced' or 'exclusive'. When set to 'balanced', the individual threads can be processed by all cores set in the option 'cpu'. If the option 'mode' is set to 'exclusive', there will be fixed cores for each thread. As mentioned before, threads can have different priority's. In the option 'prio' you can set a priority for each thread. This priority can be low, medium, high or you can set the priority to 'default'. If you do not set a priority for a CPU, than the settings in 'default' will count. By default Suricata creates one 'detect' thread per available CPU/CPU core. :: cpu-affinity: - management-cpu-set: cpu: [ 0 ] # include only these cpus in affinity settings - receive-cpu-set: cpu: [ 0 ] # include only these cpus in affinity settings - decode-cpu-set: cpu: [ 0, 1 ] mode: "balanced" - stream-cpu-set: cpu: [ "0-1" ] - detect-cpu-set: cpu: [ "all" ] mode: "exclusive" # run detect threads in these cpus # Use explicitely 3 threads and don't compute number by using # detect-thread-ratio variable: # threads: 3 prio: low: [ 0 ] medium: [ "1-2" ] high: [ 3 ] default: "medium" - verdict-cpu-set: cpu: [ 0 ] prio: default: "high" - reject-cpu-set: cpu: [ 0 ] prio: default: "low" - output-cpu-set: cpu: [ "all" ] prio: default: "medium" Relevant cpu-affinity settings for IDS/IPS modes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ IDS mode ~~~~~~~~ Runmode AutoFp:: management-cpu-set - used for management (example - flow.managers, flow.recyclers) recive-cpu-set - used for receive and decode detect-cpu-set - used for streamtcp,detect,output(logging),reject Rumode Workers:: management-cpu-set - used for management (example - flow.managers, flow.recyclers) detect-cpu-set - used for receive,streamtcp,decode,detect,output(logging),respond/reject IPS mode ~~~~~~~~ Runmode AutoFp:: management-cpu-set - used for management (example - flow.managers, flow.recyclers) recive-cpu-set - used for receive and decode detect-cpu-set - used for streamtcp,detect,output(logging) verdict-cpu-set - used for verdict and respond/reject Runmode Workers:: management-cpu-set - used for management (example - flow.managers, flow.recyclers) detect-cpu-set - used for receive,streamtcp,decode,detect,output(logging),respond/reject, verdict IP Defrag --------- Occasionally network packets appear fragmented. On some networks it occurs more often than on others. Fragmented packets exist of many parts. Before Suricata is able to inspect these kind of packets accurately, the packets have to be reconstructed. This will be done by a component of Suricata; the defragment-engine. After a fragmented packet is reconstructed by the defragment-engine, the engine sends on the reassembled packet to rest of Suricata. There are three options within defrag: max-frags, prealloc and timeout. At the moment Suricata receives a fragment of a packet, it keeps in memory that other fragments of that packet will appear soon to complete the packet. However, there is a possibility that one of the fragments does not appear. To prevent Suricata for keeping waiting for that packet (thereby using memory) there is a timespan after which Suricata discards the fragments. This occurs by default after 60 seconds. :: defrag: max-frags: 65535 prealloc: yes timeout: 60 Flow and Stream handling ------------------------ .. _suricata-yaml-flow-settings: Flow Settings ~~~~~~~~~~~~~ Within Suricata, Flows are very important. They play a big part in the way Suricata organizes data internally. A flow is a bit similar to a connection, except a flow is more general.All packets having the same Tuple (protocol, source IP, destination IP, source-port, destination-port), belong to the same flow. Packets belonging to a flow are connected to it internally. *Example 9 Flow* .. image:: suricata-yaml/flow.png *Example 10 Tuple* .. image:: suricata-yaml/Tuple1.png Keeping track of all these flows, uses memory. The more flows, the more memory it will cost. To keep control over memory usage, there are several options: The option memcap for setting the maximum amount of bytes the flow-engine will use, hash-size for setting the size of the hash-table and prealloc for the following: For packets not yet belonging to a flow, Suricata creates a new flow. This is a relative expensive action. The risk coming with it, is that attackers /hackers can a attack the engine system at this part. When they make sure a computer gets a lot of packets with different tuples, the engine has to make a lot of new flows. This way, an attacker could flood the system. To mitigate the engine from being overloaded, this option instructs Suricata to keep a number of flows ready in memory. This way Suricata is less vulnerable to these kind of attacks. The flow-engine has a management thread that operates independent from the packet processing. This thread is called the flow-manager. This thread ensures that wherever possible and within the memcap. there will be 10000 flows prepared. :: flow: memcap: 33554432 #The maximum amount of bytes the flow-engine will make use of. hash_size: 65536 #Flows will be organized in a hash-table. With this option you can set the #size of the hash-table. Prealloc: 10000 #The amount of flows Suricata has to keep ready in memory. At the point the memcap will still be reached, despite prealloc, the flow-engine goes into the emergency-mode. In this mode, the engine will make use of shorter time-outs. It lets flows expire in a more aggressive manner so there will be more space for new Flows. There are two options: emergency_recovery and prune_flows. The emergency recovery is set on 30. This is the percentage of prealloc'd flows after which the flow-engine will be back to normal (when 30 percent of the 10000 flows is completed). If during the emergency-mode, the aggressive time-outs do not have the desired result, this option is the final resort. It ends some flows even if they have not reached their time-outs yet. The prune-flows option shows how many flows there will be terminated at each time a new flow is set up. :: emergency_recovery: 30 #Percentage of 1000 prealloc'd flows. prune_flows: 5 #Amount of flows being terminated during the emergency mode. Flow Time-Outs ~~~~~~~~~~~~~~ The amount of time Suricata keeps a flow in memory is determined by the Flow time-out. There are different states in which a flow can be. Suricata distinguishes three flow-states for TCP and two for UDP. For TCP, these are: New, Established and Closed,for UDP only new and established. For each of these states Suricata can employ different timeouts. The state new in a TCP-flow, means the period during the three way handshake. The state established is the state when the three way handshake is completed. The state closed in the TCP-flow: there a several ways to end a flow. This is by means of Reset or the Four-way FIN handshake. New in a UDP-flow: the state in which packets are send from only one direction. Established in a UDP-flow: packets are send from both directions. In the example configuration the are settings for each protocol. TCP, UDP, ICMP and default (all other protocols). :: flow-timeouts: default: new: 30 #Time-out in seconds after the last activity in this flow in a New state. established: 300 #Time-out in seconds after the last activity in this flow in a Established #state. emergency_new: 10 #Time-out in seconds after the last activity in this flow in a New state #during the emergency mode. emergency_established: 100 #Time-out in seconds after the last activity in this flow in a Established #state in the emergency mode. tcp: new: 60 established: 3600 closed: 120 emergency_new: 10 emergency_established: 300 emergency_closed: 20 udp: new: 30 established: 300 emergency_new: 10 emergency_established: 100 icmp: new: 30 established: 300 emergency_new: 10 emergency_established: 100 Stream-engine ~~~~~~~~~~~~~ The Stream-engine keeps track of the TCP-connections. The engine exists of two parts: The stream tracking- and the reassembly-engine. The stream-tracking engine monitors the state of a connection. The reassembly-engine reconstructs the flow as it used to be, so it will be recognised by Suricata. The stream-engine has two memcaps that can be set. One for the stream-tracking-engine and one for the reassembly-engine. The stream-tracking-engine keeps information of the flow in memory. Information about the state, TCP-sequence-numbers and the TCP window. For keeping this information, it can make use of the capacity the memcap allows. TCP packets have a so-called checksum. This is an internal code which makes it possible to see if a packet has arrived in a good state. The stream-engine will not process packets with a wrong checksum. This option can be set off by entering 'no' instead of 'yes'. :: stream: memcap: 33554432 #Amount of flow-information (in bytes) to keep in memory. checksum_validation: yes #Validate packet checksum, reject packets with invalid checksums. The option 'max_sessions' is the limit for concurrent sessions. It prevents Suricata from using all memory for sessions. To mitigate Suricata from being overloaded by fast session creation, the option prealloc_sessions instructs Suricata to keep a number of sessions ready in memory. A TCP-session starts with the three-way-handshake. After that, data can be send en received. A session can last a long time. It can happen that Suricata will be running after a few sessions have already been started. This way, Suricata misses the original setup of those sessions. This setup always includes a lot of information. If you want Suricata to check the stream from that time on, you can do so by setting the option 'midstream' to 'true'. The default setting is 'false'. Normally Suricata is able to see all packets of a connection. Some networks make it more complicated though. Some of the network-traffic follows a different route than the other part, in other words: the traffic goes asynchronous. To make sure Suricata will check the one part it does see, instead of getting confused, the option 'async-oneside' is brought to life. By default the option is set to 'false'. Suricata inspects content in the normal/IDS mode in chunks. In the inline/IPS mode it does that on the sliding window way (see example ..) In the case Suricata is set in inline mode, it has to inspect packets immediately before sending it to the receiver. This way Suricata is able to drop a packet directly if needed.(see example …) It is important for Suricata to note which operating system it is dealing with, because operating systems differ in the way they process anomalies in streams. See :ref:`host-os-policy`. :: max_sessions: 262144 # 256k concurrent sessions prealloc_sessions: 32768 # 32k sessions prealloc'd midstream: false # do not allow midstream session pickups async_oneside: false # do not enable async stream handling inline: no # stream inline mode **Example 11 Normal/IDS mode** Suricata inspects traffic in chunks. .. image:: suricata-yaml/normal_ids.png **Example 12 Inline/IPS Sliding Window** Suricata inspects traffic in a sliding window manner. .. image:: suricata-yaml/inline_mode.png **Example 13 Normal/IDS (reasembly on ACK'D data)** .. image:: suricata-yaml/Normal_ids_ack_d.png **Example 14 Inline/IPS (reassembly on UNACK'D data)** .. image:: suricata-yaml/Inline_reassembly_unackd_data.png The reassembly-engine has to keep packets in memory to be able to make a reassembled stream. It can make use of the amount of bytes set below. Reassembling a stream is an expensive operation. In the option depth you can set the depth (in a stream) of the reassembling. By default this is 1MB. :: reassembly: memcap: 67108864 #Amount of packets (in bytes) to keep in memory. depth: 1048576 #The depth of the reassembling. toserver_chunk_size: 2560 # inspect raw stream in chunks of at least this size toclient_chunk_size: 2560 # inspect raw stream in chunks of at least *Example 15 Stream reassembly* .. image:: suricata-yaml/reassembly1.png .. image:: suricata-yaml/IDS_chunk_size.png Application Layer Parsers ------------------------- Asn1_max_frames (new in 1.0.3 and 1.1) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Asn1 (`Abstract Syntax One `_) is a standard notation to structure and describe data. Within Asn1_max_frames there are several frames. To protect itself, Suricata will inspect a maximum of 256. You can set this amount differently if wanted. Application layer protocols such as X.400 electronic mail, X.500 and LDAP directory services, H.323 (VoIP), BACnet and SNMP, use ASN.1 to describe the protocol data units (PDUs) they exchange. It is also extensively used in the Access and Non-Access Strata of UMTS. Limit for the maximum number of asn1 frames to decode (default 256): :: asn1_max_frames: 256 .. _suricata-yaml-configure-libhtp: Configure HTTP (libhtp) ~~~~~~~~~~~~~~~~~~~~~~~ The library Libhtp is being used by Suricata to parse HTTP-sessions. While processing HTTP-traffic, Suricata has to deal with different kind of servers which each process anomalies in HTTP-traffic differently. The most common web-server is Apache. This is a open source web -server program. Beside Apache, IIS (Internet Information Services/Server)a web-server program of Microsoft is also well-known. Like with host-os-policy, it is important for Suricata to which IP-address/network-address is used by which server. In Libhtp this assigning of web-servers to IP-and network addresses is called personality. Currently Available Personalities: * Minimal * Generic * IDS (default) * IIS_4_0 * IIS_5_0 * IIS_5_1 * IIS_6_0 * IIS_7_0 * IIS_7_5 * Apache * Apache_2_2 You can assign names to each block of settings. Which in this case is -apache and -iis7. Under these names you can set IP-addresses, network-addresses the personality and the request-body-limit. The version-specific personalities know exactly how web servers behave, and emulate that. The IDS personality (will be GENERIC in the future) would try to implement a best-effort approach that would work reasonably well in the cases where you do not know the specifics. The default configuration also applies to every IP-address for which no specific setting is available. HTTP request body's are often big, so they take a lot of time to process which has a significant impact on the performance. With the option 'request-body-limit' you can set the limit (in bytes) of the client-body that will be inspected. Setting it to 0 will inspect all of the body. HTTP response body's are often big, so they take a lot of time to process which has a significant impact on the performance. With the option 'response-body-limit' you can set the limit (in bytes) of the server-body that will be inspected. Setting it to 0 will inspect all of the body. :: libhtp: default-config: personality: IDS request-body-limit: 3072 response-body-limit: 3072 server-config: - apache: address: [192.168.1.0/24, 127.0.0.0/8, "::1"] personality: Apache_2_2 request-body-limit: 0 response-body-limit: 0 - iis7: address: - 192.168.0.0/24 - 192.168.10.0/24 personality: IIS_7_0 request-body-limit: 4096 response-body-limit: 8192 As of 1.4, Suricata makes available the whole set of libhtp customisations for its users. You can now use these parameters in the conf to customise suricata's use of libhtp. :: # Configures whether backslash characters are treated as path segment # separators. They are not on Unix systems, but are on Windows systems. # If this setting is enabled, a path such as "/one\two/three" will be # converted to "/one/two/three". Accepted values - yes, no. #path-backslash-separators: yes # Configures whether consecutive path segment separators will be # compressed. When enabled, a path such as "/one//two" will be normalized # to "/one/two". The backslash_separators and decode_separators # parameters are used before compression takes place. For example, if # backslash_separators and decode_separators are both enabled, the path # "/one\\/two\/%5cthree/%2f//four" will be converted to # "/one/two/three/four". Accepted values - yes, no. #path-compress-separators: yes # This parameter is used to predict how a server will react when control # characters are present in a request path, but does not affect path # normalization. Accepted values - none or status_400 */ #path-control-char-handling: none # Controls the UTF-8 treatment of request paths. One option is to only # validate path as UTF-8. In this case, the UTF-8 flags will be raised # as appropriate, and the path will remain in UTF-8 (if it was UTF-8 in # the first place). The other option is to convert a UTF-8 path into a # single byte stream using best-fit mapping. Accepted values - yes, no. #path-convert-utf8: yes # Configures whether encoded path segment separators will be decoded. # Apache does not do this, but IIS does. If enabled, a path such as # "/one%2ftwo" will be normalized to "/one/two". If the # backslash_separators option is also enabled, encoded backslash # characters will be converted too (and subseqently normalized to # forward slashes). Accepted values - yes, no. #path-decode-separators: yes # Configures whether %u-encoded sequences in path will be decoded. Such # sequences will be treated as invalid URL encoding if decoding is not # desireable. Accepted values - yes, no. #path-decode-u-encoding: yes # Configures how server reacts to invalid encoding in path. Accepted # values - preserve_percent, remove_percent, decode_invalid, status_400 #path-invalid-encoding-handling: preserve_percent # Configures how server reacts to invalid UTF-8 characters in path. # This setting will not affect path normalization; it only controls what # response status we expect for a request that contains invalid UTF-8 # characters. Accepted values - none, status_400. #path-invalid-utf8-handling: none # Configures how server reacts to encoded NUL bytes. Some servers will # terminate path at NUL, while some will respond with 400 or 404. When # the termination option is not used, the NUL byte will remain in the # path. Accepted values - none, terminate, status_400, status_404. # path-nul-encoded-handling: none # Configures how server reacts to raw NUL bytes. Some servers will # terminate path at NUL, while some will respond with 400 or 404. When # the termination option is not used, the NUL byte will remain in the # path. Accepted values - none, terminate, status_400, status_404. path-nul-raw-handling: none # Sets the replacement characater that will be used to in the lossy # best-fit mapping from Unicode characters into single-byte streams. # The question mark is the default replacement character. #set-path-replacement-char: ? # Controls what the library does when it encounters an Unicode character # where only a single-byte would do (e.g., the %u-encoded characters). # Conversion always takes place; this parameter is used to correctly # predict the status code used in response. In the future there will # probably be an option to convert such characters to UCS-2 or UTF-8. # Accepted values - bestfit, status_400 and status_404. #set-path-unicode-mapping: bestfit Engine output ------------- Logging configuration ~~~~~~~~~~~~~~~~~~~~~ The logging subsystem can display all output except alerts and events. It gives information at runtime about what the engine is doing. This information can be displayed during the engine startup, at runtime and while shutting the engine down. For informational messages, errors, debugging, etc. The log-subsystem has several log levels: Error, warning, informational and debug. Note that debug level logging will only be emitted if Suricata was compiled with the --enable-debug configure option. The first option within the logging configuration is the default-log-level. This option determines the severity/importance level of information that will be displayed. Messages of lower levels than the one set here, will not be shown. The default setting is Info. This means that error, warning and info will be shown and the other levels won't be. There are more levels: emergency, alert, critical and notice, but those are not used by Suricata yet. This option can be changed in the configuration, but can also be overridden in the command line by the environment variable: SC_LOG_LEVEL . :: logging: default-log-level: info Default log format ~~~~~~~~~~~~~~~~~~ A logging line exists of two parts. First it displays meta information (thread id, date etc.), and finally the actual log message. Example: :: [27708] 15/10/2010 -- 11:40:07 - (suricata.c:425) (main) – This is Suricata version 1.0.2 (Here the part until the – is the meta info, “This is Suricata 1.0.2†is the actual message.) It is possible to determine which information will be displayed in this line and (the manner how it will be displayed) in which format it will be displayed. This option is the so called format string:: default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- " The % followed by a character, has a special meaning. There are eight specified signs: :: t: Time, timestamp, time and date example: 15/10/2010 - -11:40:07 p: Process ID. Suricata's whole processing consists of multiple threads. i: Thread ID. ID of individual threads. m: Thread module name. (Outputs, Detect etc.) d: Log-level of specific log-event. (Error, info, debug etc.) f: Filename. Name of C-file (source code) where log-event is generated. l: Line-number within the filename, where the log-event is generated in the source-code. n: Function-name in the C-code (source code). The last three, f, l and n are mainly convenient for developers. The log-format can be overridden in the command line by the environment variable: SC_LOG_FORMAT Output-filter ~~~~~~~~~~~~~ Within logging you can set an output-filter. With this output-filter you can set which part of the event-logs should be displayed. You can supply a regular expression (Regex). A line will be shown if the regex matches. :: default-output-filter: #In this option the regular expression can be entered. This value is overridden by the environment var: SC_LOG_OP_FILTER Outputs ~~~~~~~ There are different ways of displaying output. The output can appear directly on your screen, it can be placed in a file or via syslog. The last mentioned is an advanced tool for log-management. The tool can be used to direct log-output to different locations (files, other computers etc.) :: outputs: - console: #Output on your screen. enabled: yes #This option is enabled. - file: #Output stored in a file. enabled: no #This option is not enabled. filename: /var/log/suricata.log #Filename and location on disc. - syslog: #This is a program to direct log-output to several directions. enabled: no #The use of this program is not enabled. facility: local5 #In this option you can set a syslog facility. format: "[%i] <%d> -- " #The option to set your own format. Packet Acquisition ------------------ Pf-ring ~~~~~~~ The Pf_ring is a library that aims to improve packet capture performance over libcap. It performs packet acquisition. There are three options within Pf_ring: interface, cluster-id and cluster-type. :: pfring: interface: eth0 # In this option you can set the network-interface # on which you want the packets of the network to be read. Pf_ring will load balance packets based on flow. All packet acquisition threads that will participate in the load balancing need to have the same cluster-id. It is important to make sure this ID is unique for this cluster of threads, so that no other engine / program is making use of clusters with the same id. :: cluster-id: 99 Pf_ring can load balance traffic using pf_ring-clusters. All traffic for pf_ring can be load balanced in one of two ways, in a round robin manner or a per flow manner that are part of the same cluster. All traffic for pf_ring will be load balanced across acquisition threads of the same cluster id. The cluster_round_robin manner is a way of distributing packets one at a time to each thread (like distributing playing cards to fellow players). The cluster_flow manner is a way of distributing all packets of the same flow to the same thread. The flows itself will be distributed to the threads in a round-robin manner. :: cluster-type: cluster_round_robin .. _suricata-yaml-nfq: NFQ ~~~ Using NFQUEUE in iptables rules, will send packets to Suricata. If the mode is set to 'accept', the packet that has been send to Suricata by a rule using NFQ, will by default not be inspected by the rest of the iptables rules after being processed by Suricata. There are a few more options to NFQ to change this if desired. If the mode is set to 'repeat', the packets will be marked by Suricata and be re-injected at the first rule of iptables. To mitigate the packet from being going round in circles, the rule using NFQ will be skipped because of the mark. If the mode is set to 'route', you can make sure the packet will be send to another tool after being processed by Suricata. It is possible to assign this tool at the mandatory option 'route_queue'. Every engine/tool is linked to a queue-number. This number you can add to the NFQ rule and to the route_queue option. Add the numbers of the options repeat_mark and route_queue to the NFQ-rule:: iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE :: nfq: mode: accept #By default the packet will be accepted or dropped by Suricata repeat_mark: 1 #If the mode is set to 'repeat', the packets will be marked after being #processed by Suricata. repeat_mask: 1 route_queue: 2 #Here you can assign the queue-number of the tool that Suricata has to #send the packets to after processing them. *Example 1 NFQ1* mode: accept .. image:: suricata-yaml/NFQ.png *Example 2 NFQ* mode: repeat .. image:: suricata-yaml/NFQ1.png *Example 3 NFQ* mode: route .. image:: suricata-yaml/NFQ2.png Ipfw ~~~~ Suricata does not only support Linux, it supports the FreeBSD operating system (this is an open source Unix operating system) and Mac OS X as well. The in-line mode on FreeBSD uses ipfw (IP-firewall). Certain rules in ipfw send network-traffic to Suricata. Rules have numbers. In this option you can set the rule to which the network-traffic will be placed back. Make sure this rule comes after the one that sends the traffic to Suricata, otherwise it will go around in circles. The following tells the engine to re-inject packets back into the ipfw firewall at rule number 5500: :: ipfw: ipfw-reinjection-rule-number: 5500 *Example 16 Ipfw-reinjection.* .. image:: suricata-yaml/ipfw_reinjection.png Rules ----- Rule-files ~~~~~~~~~~ For different categories of risk there are different rule-files available containing one or more rules. There is a possibility to instruct Suricata where to find these rules and which rules you want to be load for use. You can set the directory where the files can be found. :: default-rule-path: /etc/suricata/rules/ rule-files: - backdoor.rules - bad-traffic.rules - chat.rules - ddos.rules - .... The above mentioned is an example of rule-files of which can be chosen from. There are much more rule-files available. If wanted, you can set a full path for a specific rule or rule-file. In that case, the above directory (/etc/suricata/rules/) will be ignored for that specific file. This is convenient in case you write your own rules and want to store them separate from other rules like that of VRT, ET or ET pro. If you set a file-name that appears to be not existing, Suricata will ignore that entry and display a error-message during the engine startup. It will continue with the startup as usual. Threshold-file ~~~~~~~~~~~~~~ Within this option, you can state the directory in which the threshold-file will be stored. The default directory is: /etc/suricata/threshold.config Classifications ~~~~~~~~~~~~~~~ The Classification-file is a file which makes the purpose of rules clear. Some rules are just for providing information. Some of them are to warn you for serious risks like when you are being hacked etc. In this classification-file, there is a part submitted to the rule to make it possible for the system-administrator to distinguish events. A rule in this file exists of three parts: the short name, a description and the priority of the rule (in which 1 has the highest priority and 4 the lowest). You can notice these descriptions returning in the rule and events / alerts. :: Example: configuration classification: misc-activity,Misc activity,3 Rule: alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"ET POLICY FTP Login Successful (non-anonymous)"; flow:from_server,established;flowbits:isset,ET.ftp.user.login; flowbits:isnotset,ftp.user.logged_in; flowbits:set,ftp.user.logged_in; content:"230 ";pcre:!"/^230(\s+USER)?\s+(anonymous|ftp)/smi"; classtype:misc-activity; reference:urldoc.emergingthreats.net/2003410,; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/POLICY/POLICY_FTP_Login; sid:2003410; rev:7;) Event/Alert: 10/26/10-10:13:42.904785 [**] [1:2003410:7] ET POLICY FTP Login Successful (non-anonymous) [**] [Classification: Misc activity[Priority: 3] {TCP} 192.168.0.109:21 -> x.x.x.x:34117 You can set the direction of the classification configuration. :: classification-file: /etc/suricata/classification.config .. _suricata-yaml-rule-vars: Rule-vars ~~~~~~~~~ There are variables which can be used in rules. Within rules, there is a possibility to set for which IP-address the rule should be checked and for which IP-address it should not. This way, only relevant rules will be used. To prevent you from having to set this rule by rule, there is an option in which you can set the relevant IP-address for several rules. This option contains the address group vars that will be passed in a rule. So, after HOME_NET you can enter your home IP-address. :: vars: address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" #By using [], it is possible to set #complicated variables. EXTERNAL_NET: any HTTP_SERVERS: "$HOME_NET" #The $-sign tells that what follows is #a variable. SMTP_SERVERS: "$HOME_NET" SQL_SERVERS: "$HOME_NET" DNS_SERVERS: "$HOME_NET" TELNET_SERVERS: "$HOME_NET" AIM_SERVERS: any It is a convention to use upper-case characters. There are two kinds of variables: Address groups and Port-groups. They both have the same function: change the rule so it will be relevant to your needs. In a rule there is a part assigned to the address and one to the port. Both have their variable. All options have to be set. If it is not necessary to set a specific address, you should enter 'any'. :: port-groups: HTTP_PORTS: "80" SHELLCODE_PORTS: "!80" ORACLE_PORTS: 1521 SSH_PORTS: 22 .. _host-os-policy: Host-os-policy ~~~~~~~~~~~~~~ Operating systems differ in the way they process fragmented packets and streams. Suricata performs differently with anomalies for different operating systems. It is important to set of which operating system your IP-address makes use of, so Suricata knows how to process fragmented packets and streams. For example in stream-reassembly there can be packets with overlapping payloads. *Example 17 Overlapping payloads* .. image:: suricata-yaml/overlap.png In the configuration-file, the operating-systems are listed. You can add your IP-address behind the name of the operating system you make use of. :: host-os-policy: windows: [0.0.0.0/0] bsd: [] bsd_right: [] old_linux: [] linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"] old_solaris: [] solaris: ["::1"] hpux10: [] hpux11: [] irix: [] macos: [] vista: [] windows2k3: [] Engine analysis and profiling ----------------------------- Suricata offers several ways of analyzing performance of rules and the engine itself. Engine-analysis ~~~~~~~~~~~~~~~ The option engine-analysis provides information for signature writers about how Suricata organises signatures internally. Like mentioned before, signatures have zero or more patterns on which they can match. Only one of these patterns will be used by the multi pattern matcher (MPM). Suricata determines which patterns will be used unless the fast-pattern rule option is used. The option engine-analysis creates a new log file in the default log dir. In this file all information about signatures and patterns can be found so signature writers are able to see which pattern is used and change it if desired. To create this log file, you have to run Suricata with ./src/suricata -c suricata.yaml --engine-analysis. :: engine-analysis: rules-fast-pattern: yes Example: :: [10703] 26/11/2010 -- 11:41:15 - (detect.c:560) (SigLoadSignatures) -- Engine-Analyis for fast_pattern printed to file - /var/log/suricata/rules_fast_pattern.txt == Sid: 1292 == Fast pattern matcher: content Fast pattern set: no Fast pattern only set: no Fast pattern chop set: no Content negated: no Original content: Volume Serial Number Final content: Volume Serial Number --- alert tcp any any -> any any (content:"abc"; content:"defghi"; sid:1;) == Sid: 1 == Fast pattern matcher: content Fast pattern set: no Fast pattern only set: no Fast pattern chop set: no Content negated: no Original content: defghi Final content: defghi --- alert tcp any any -> any any (content:"abc"; fast_pattern:only; content:"defghi"; sid:1;) == Sid: 1 == Fast pattern matcher: content Fast pattern set: yes Fast pattern only set: yes Fast pattern chop set: no Content negated: no Original content: abc Final content: abc --- alert tcp any any -> any any (content:"abc"; fast_pattern; content:"defghi"; sid:1;) == Sid: 1 == Fast pattern matcher: content Fast pattern set: yes Fast pattern only set: no Fast pattern chop set: no Content negated: no Original content: abc Final content: abc --- alert tcp any any -> any any (content:"abc"; fast_pattern:1,2; content:"defghi"; sid:1;) == Sid: 1 == Fast pattern matcher: content Fast pattern set: yes Fast pattern only set: no Fast pattern chop set: yes Fast pattern offset, length: 1, 2 Content negated: no Original content: abc Final content: bc Rule and Packet Profiling settings ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Rule profiling is a part of Suricata to determine how expensive rules are. Some rules are very expensive while inspecting traffic. Rule profiling is convenient for people trying to track performance problems and resolving them. Also for people writing signatures. Compiling Suricata with rule-profiling will have an impact on performance, even if the option is disabled in the configuration file. To observe the rule-performance, there are several options. :: profiling: rules: enabled: yes This engine is not used by default. It can only be used if Suricata is compiled with: :: -- enable-profiling At the end of each session, Suricata will display the profiling statistics. The list will be displayed sorted. This order can be changed as pleased. The choice is between ticks, avgticks, checks, maxticks and matches. The setting of your choice will be displayed from high to low. The amount of time it takes to check the signatures, will be administrated by Suricata. This will be counted in ticks. One tick is one CPU computation. 3 GHz will be 3 billion ticks. Beside the amount of checks, ticks and matches it will also display the average and the maximum of a rule per session at the end of the line. The option Limit determines the amount of signatures of which the statistics will be shown, based on the sorting. :: sort: avgticks limit: 100 Example of how the rule statistics can look like; :: Rule Ticks % Checks Matches Max Tick Avg Ticks 7560 107766621 0.02 138 37 105155334 780917.54 11963 1605394413 0.29 2623 1 144418923 612045.14 7040 1431034011 0.26 2500 0 106018209 572413.60 5726 1437574662 0.26 2623 1 115632900 548065.06 7037 1355312799 0.24 2562 0 116048286 529005.78 11964 1276449255 0.23 2623 1 96412347 486637.15 7042 1272562974 0.23 2623 1 96405993 485155.54 5719 1233969192 0.22 2562 0 106439661 481642.93 5720 1204053246 0.21 2562 0 125155431 469966.14 Packet Profiling ~~~~~~~~~~~~~~~~ :: packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes #this option is enabled by default filename: packet_stats.log #name of the file in which packet profiling information will be #stored. append: yes #If set to yes, new packet profiling information will be added to the #information that was saved last in the file. # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no #the sending of packet output to a csv-file is by default disabled. filename: packet_stats.csv #name of the file in which csv packet profiling information will be #stored Packet profiling is enabled by default in suricata.yaml but it will only do its job if you compiled Suricata with --enable profiling. The filename in which packet profiling information will be stored, is packet-stats.log. Information in this file can be added to the last information that was saved there, or if the append option is set to no, the existing file will be overwritten. Per packet, you can send the output to a csv-file. This file contains one line for each packet with all profiling information of that packet. This option can be used only if Suricata is build with --enable-profiling and if the packet profiling option is enabled in yaml. It is best to use runmode 'single' if you would like to profile the speed of the code. When using a single thread, there is no situation in which two threads have to wait for each other . When using two threads, the time threads might have to wait for each other will be taken in account when/during profiling packets. For more information see :doc:`../performance/packet-profiling`. Application layers ------------------ SSL/TLS ~~~~~~~ SSL/TLS parsers track encrypted SSLv2, SSLv3, TLSv1, TLSv1.1 and TLSv1.2 sessions. Protocol detection is done using patterns and a probing parser running on only TCP/443 by default. The pattern based protocol detection is port independent. :: tls: enabled: yes detection-ports: dp: 443 # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow # bypass. If disabled (the default), TLS/SSL session is still # tracked for Heartbleed and other anomalies. #no-reassemble: yes Encrypted traffic ^^^^^^^^^^^^^^^^^ There is no decryption of encrypted traffic, so once the handshake is complete continued tracking of the session is of limited use. The ``no-reassemble`` option controls the behaviour after the handshake. If ``no-reassemble`` is set to ``true``, all processing of this session is stopped. No further parsing and inspection happens. If ``bypass`` is enabled this will lead to the flow being bypassed, either inside Suricata or by the capture method if it supports it. If ``no-reassemble`` is set to ``false``, which is the default, Suricata will continue to track the SSL/TLS session. Inspection will be limited, as ``content`` inspection will still be disabled. There is no point in doing pattern matching on traffic known to be encrypted. Inspection for (encrypted) Heartbleed and other protocol anomalies still happens. Modbus ~~~~~~ According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it is recommended to keep the TCP connection opened with a remote device and not to open and close it for each MODBUS/TCP transaction. In that case, it is important to set the stream-depth of the modbus as unlimited. :: modbus: # Stream reassembly size for modbus, default is 0 stream-depth: 0 Advanced Options ---------------- luajit ~~~~~~ states ^^^^^^ Luajit has a strange memory requirement, it's 'states' need to be in the first 2G of the process' memory. For this reason when luajit is used the states are allocated at the process startup. This option controls how many states are preallocated. If the pool is depleted a warning is generated. Suricata will still try to continue, but may fail if other parts of the engine take too much memory. If the pool was depleted a hint will be printed at the engines exit. States are allocated as follows: for each detect script a state is used per detect thread. For each output script, a single state is used. Keep in mind that a rule reload temporary doubles the states requirement. suricata-3.2.1/doc/userguide/configuration/log-rotation.rst0000644000000000000000000000073013051004444020772 00000000000000Log Rotation ============ Suricata can generate lot of output, so it's important to manage the files to avoid issues with disks filling up. A HUP signal sent to Suricata will force it to reopen the logfiles. Example logrotate file: :: /var/log/suricata/*.log /var/log/suricata/*.json { rotate 3 missingok nocompress create sharedscripts postrotate /bin/kill -HUP $(cat /var/run/suricata.pid) endscript } suricata-3.2.1/doc/userguide/configuration/snort-to-suricata.rst0000644000000000000000000001305613051004444021757 00000000000000Snort.conf to Suricata.yaml =========================== This guide is meant for those who are familiar with Snort and the snort.conf configuration format. This guide will provide a 1:1 mapping between Snort and Suricata configuration wherever possible. Variables --------- snort.conf :: ipvar HOME_NET any ipvar EXTERNAL_NET any ... portvar HTTP_PORTS [80,81,311,591,593,901,1220,1414,1741,1830,2301,2381,2809,3128,3702,4343,4848,5250,7001,7145,7510,7777,7779,8000,8008,8014,8028,8080,8088,8090,8118,8123,8180,8181,8243,8280,8800,8888,8899,9000,9080,9090,9091,9443,9999,11371,55555] portvar SHELLCODE_PORTS !80 ... suricata.yaml :: vars: address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" EXTERNAL_NET: "!$HOME_NET" port-groups: HTTP_PORTS: "80" SHELLCODE_PORTS: "!80" Note that Suricata can automatically detect HTTP traffic regardless of the port it uses. So the HTTP_PORTS variable is not nearly as important as it is with Snort, **if** you use a Suricata enabled ruleset. Decoder alerts -------------- snort.conf :: # Stop generic decode events: config disable_decode_alerts # Stop Alerts on experimental TCP options config disable_tcpopt_experimental_alerts # Stop Alerts on obsolete TCP options config disable_tcpopt_obsolete_alerts # Stop Alerts on T/TCP alerts config disable_tcpopt_ttcp_alerts # Stop Alerts on all other TCPOption type events: config disable_tcpopt_alerts # Stop Alerts on invalid ip options config disable_ipopt_alerts suricata.yaml Suricata has no specific decoder options. All decoder related alerts are controlled by rules. See #Rules below. Checksum handling ----------------- snort.conf :: config checksum_mode: all suricata.yaml Suricata's checksum handling works *on-demand*. The stream engine checks TCP and IP checksum by default: :: stream: checksum-validation: yes # reject wrong csums Alerting on bad checksums can be done with normal rules. See #Rules, decoder-events.rules specifically. Various configs --------------- Active response ~~~~~~~~~~~~~~~ snort.conf :: # Configure active response for non inline operation. For more information, see REAMDE.active # config response: eth0 attempts 2 suricata.yaml Active responses are handled automatically w/o config if rules with the "reject" action are used. Dropping privileges ~~~~~~~~~~~~~~~~~~~ snort.conf :: # Configure specific UID and GID to run snort as after dropping privs. For more information see snort -h command line options # # config set_gid: # config set_uid: Suricata To set the user and group use the --user and --group commandline options. Snaplen ~~~~~~~ snort.conf :: # Configure default snaplen. Snort defaults to MTU of in use interface. For more information see README # # config snaplen: # Suricata always works at full snap length to provide full traffic visibility. Bpf ~~~ snort.conf :: # Configure default bpf_file to use for filtering what traffic reaches snort. For more information see snort -h command line options (-F) # # config bpf_file: # suricata.yaml BPF filters can be set per packet acquisition method, with the "bpf-filter: " yaml option and in a file using the -F command line option. For example: :: pcap: - interface: eth0 #buffer-size: 16777216 #bpf-filter: "tcp and port 25" #checksum-checks: auto #threads: 16 #promisc: no #snaplen: 1518 Log directory ------------- snort.conf :: # Configure default log directory for snort to log to. For more information see snort -h command line options (-l) # # config logdir: suricata.yaml :: default-log-dir: /var/log/suricata/ This value is overridden by the -l commandline option. Packet acquisition ------------------ snort.conf :: # Configure DAQ related options for inline operation. For more information, see README.daq # # config daq: # config daq_dir:

# config daq_mode: # config daq_var: # # ::= pcap | afpacket | dump | nfq | ipq | ipfw # ::= read-file | passive | inline # ::= arbitrary = ::= path as to where to look for DAQ module so's suricata.yaml Suricata has all packet acquisition support built-in. It's configuration format is very verbose. :: pcap: - interface: eth0 #buffer-size: 16777216 #bpf-filter: "tcp and port 25" #checksum-checks: auto #threads: 16 #promisc: no #snaplen: 1518 pfring: afpacket: nfq: ipfw: Passive vs inline vs reading files is determined by how Suricata is invoked on the command line. Rules ----- snort.conf: In snort.conf a RULE_PATH variable is set, as well as variables for shared object (SO) rules and preprocessor rules. :: var RULE_PATH ../rules var SO_RULE_PATH ../so_rules var PREPROC_RULE_PATH ../preproc_rules include $RULE_PATH/local.rules include $RULE_PATH/emerging-activex.rules ... suricata.yaml: In the suricata.yaml the default rule path is set followed by a list of rule files. Suricata does not have a concept of shared object rules or preprocessor rules. Instead of preprocessor rules, Suricata has several rule files for events set by the decoders, stream engine, http parser etc. :: default-rule-path: /etc/suricata/rules rule-files: - local.rules - emerging-activex.rules The equivalent of preprocessor rules are loaded like normal rule files: :: rule-files: - decoder-events.rules - stream-events.rules - http-events.rules - smtp-events.rules suricata-3.2.1/doc/userguide/configuration/multi-tenant.rst0000644000000000000000000000661213051004444021002 00000000000000Multi Tenancy ============= Introduction ------------ Multi tenancy support allows for different rule sets with different rule vars. YAML ---- In the main ("master") YAML, the suricata.yaml, a new section called "multi-detect" should be added. Settings: * enabled: yes/no -> is multi-tenancy support enable * default: yes/no -> is the normal detect config a default 'fall back' tenant? * selector: direct (for unix socket pcap processing, see below) or vlan * loaders: number of 'loader' threads, for parallel tenant loading at startup * tenants: list of tenants * id: tenant id * yaml: separate yaml file with the tenant specific settings * mappings: * vlan id * tenant id: tenant to associate with the vlan id :: multi-detect: enabled: yes #selector: direct # direct or vlan selector: vlan loaders: 3 tenants: - id: 1 yaml: tenant-1.yaml - id: 2 yaml: tenant-2.yaml - id: 3 yaml: tenant-3.yaml mappings: - vlan-id: 1000 tenant-id: 1 - vlan-id: 2000 tenant-id: 2 - vlan-id: 1112 tenant-id: 3 The tenant-1.yaml, tenant-2.yaml, tenant-3.yaml each contain a partial configuration: :: # Set the default rule path here to search for the files. # if not set, it will look at the current working dir default-rule-path: /etc/suricata/rules rule-files: - rules1 # You can specify a threshold config file by setting "threshold-file" # to the path of the threshold config file: # threshold-file: /etc/suricata/threshold.config classification-file: /etc/suricata/classification.config reference-config-file: /etc/suricata/reference.config # Holds variables that would be used by the engine. vars: # Holds the address group vars that would be passed in a Signature. # These would be retrieved during the Signature address parsing stage. address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" EXTERNAL_NET: "!$HOME_NET" ... port-groups: HTTP_PORTS: "80" SHELLCODE_PORTS: "!80" ... Unix Socket ----------- Registration ~~~~~~~~~~~~ register-tenant Examples: :: register-tenant 1 tenant-1.yaml register-tenant 2 tenant-2.yaml register-tenant 3 tenant-3.yaml register-tenant 5 tenant-5.yaml register-tenant 7 tenant-7.yaml unregister-tenant :: unregister-tenant 2 unregister-tenant 1 Unix socket runmode (pcap processing) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Unix Socket "pcap-file" command can be used to select the tenant to inspect the pcap against: :: pcap-file traffic1.pcap /logs1/ 1 pcap-file traffic2.pcap /logs2/ 2 pcap-file traffic3.pcap /logs3/ 3 pcap-file traffic4.pcap /logs5/ 5 pcap-file traffic5.pcap /logs7/ 7 This runs the traffic1.pcap against tenant 1 and it logs into /logs1/, traffic2.pcap against tenant 2 and logs to /logs2/ and so on. Live traffic mode ~~~~~~~~~~~~~~~~~ For live traffic currently only a vlan based multi-tenancy is supported. The master yaml needs to have the selector set to "vlan". Registration ~~~~~~~~~~~~ Tenants can be mapped to vlan id's. register-tenant-handler vlan :: register-tenant-handler 1 vlan 1000 unregister-tenant-handler vlan :: unregister-tenant-handler 4 vlan 1111 unregister-tenant-handler 1 vlan 1000 The registration of tenant and tenant handlers can be done on a running engine. suricata-3.2.1/doc/userguide/configuration/dropping-privileges.rst0000644000000000000000000000267313051004444022355 00000000000000Dropping Privileges After Startup ================================= Currently, libcap-ng is needed for dropping privileges on Suricata after startup. For libcap, see status of feature request number #276 -- Libcap support for dropping privileges. Most distributions have ``libcap-ng`` in their repositories. To download the current version of libcap-ng from upstream, see also http://people.redhat.com/sgrubb/libcap-ng/ChangeLog :: wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.7.8.tar.gz tar -xzvf libcap-ng-0.7.8.tar.gz cd libcap-ng-0.7.8 ./configure make make install Download, configure, compile and install Suricata for your particular setup. See :doc:`../install`. Depending on your environment, you may need to add the --with-libpcap_ng-libraries and --with-libpcap_ng-includes options during the configure step. e.g: :: ./configure --with-libcap_ng-libraries=/usr/local/lib \ --with-libcap_ng-includes=/usr/local/include Now, when you run Suricata, tell it what user and/or group you want it to run as after startup with the --user and --group options. e.g. (this assumes a 'suri' user and group): :: suricata -D -i eth0 --user=suri --group=suri You will also want to make sure your user/group permissions are set so suricata can still write to its log files which are usually located in /var/log/suricata. :: mkdir -p /var/log/suricata chown -R root:suri /var/log/suricata chmod -R 775 /var/log/suricata suricata-3.2.1/doc/userguide/configuration/index.rst0000644000000000000000000000023513051004444017463 00000000000000Configuration ============= .. toctree:: suricata-yaml global-thresholds snort-to-suricata log-rotation multi-tenant dropping-privileges suricata-3.2.1/doc/userguide/configuration/global-thresholds.rst0000644000000000000000000001253313051004444021775 00000000000000Global-Thresholds ================= Thresholds can be configured in the rules themselves, see :doc:`../rules/thresholding`. They are often set by rule writers based on their intel for creating a rule combined with a judgement on how often a rule will alert. Threshold Config ---------------- Next to rule thresholding more thresholding can be configured on the sensor using the threshold.config. threshold/event_filter ~~~~~~~~~~~~~~~~~~~~~~ Syntax: :: threshold gen_id , sig_id , type , \ track , count , seconds rate_filter ~~~~~~~~~~~ Rate filters allow changing of a rule action when a rule matches. Syntax:: rate_filter: rate_filter gen_id , sig_id , track , \ count , seconds , new_action , timeout Example:: rate_filter gen_id 1, sig_id 1000, track by_rule, count 100, seconds 60, \ new_action alert, timeout 30 gen_id ^^^^^^ Generator id. Normally 1, but if a rule uses the ``gid`` keyword to set another value it has to be matched in the ``gen_id``. sig_id ^^^^^^ Rule/signature id as set by the rule ``sid`` keyword. track ^^^^^ Where to track the rule matches. When using by_src/by_dst the tracking is done per IP-address. The Host table is used for storage. When using by_rule it's done globally for the rule. count ^^^^^ Number of rule hits before the ``rate_filter`` is activated. seconds ^^^^^^^ Time period within which the ``count`` needs to be reached to activate the ``rate_filter`` new_action ^^^^^^^^^^ New action that is applied to matching traffic when the ``rate_filter`` is in place. Values:: Note: 'sdrop' and 'log' are supported by the parser but not implemented otherwise. timeout ^^^^^^^ Time in seconds during which the ``rate_filter`` will remain active. Example ^^^^^^^ Lets say we want to limit incoming connections to our SSH server. The rule ``888`` below simply alerts on SYN packets to the SSH port of our SSH server. If an IP-address triggers this more than 10 or more with a minute, the drop ``rate_filter`` is set with a timeout of 5 minutes. Rule:: alert tcp any any -> $MY_SSH_SERVER 22 (msg:"Connection to SSH server"; \ flow:to_server; flags:S,12; sid:888;) Rate filter:: rate_filter gen_id 1, sig_id 888, track by_src, count 10, seconds 60, \ new_action drop, timeout 300 suppress ~~~~~~~~ Suppressions can be used to suppress alerts for a rule or a host/network. Actions performed when a rule matches, such as setting a flowbit, are still performed. Syntax: :: suppress gen_id , sig_id suppress gen_id , sig_id , track , ip Examples: :: suppress gen_id 1, sig_id 2002087, track by_src, ip 209.132.180.67 This will make sure the signature 2002087 will never match for src host 209.132.180.67. Other possibilities/examples:: suppress gen_id 1, sig_id 2003614, track by_src, ip 217.110.97.128/25 suppress gen_id 1, sig_id 2003614, track by_src, ip [192.168.0.0/16,10.0.0.0/8,172.16.0.0/12] suppress gen_id 1, sig_id 2003614, track by_src, ip $HOME_NET .. _global-thresholds-vs-rule-thresholds: Global thresholds vs rule thresholds ------------------------------------ **Note: this section applies to 1.4+ In 1.3 and before mixing rule and global thresholds is not supported.** When a rule has a threshold/detection_filter set a rule can still be affected by the global threshold file. The rule below will only fire if 10 or more emails are being delivered/sent from a host within 60 seconds. :: alert tcp any any -> any 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; \ flow:established; content:"mail from|3a|"; nocase; \ threshold: type threshold, track by_src, count 10, seconds 60; \ reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;) Next, we'll see how global settings affect this rule. Suppress ~~~~~~~~ Suppressions can be combined with rules with thresholds/detection_filters with no exceptions. :: suppress gen_id 1, sig_id 2002087, track by_src, ip 209.132.180.67 suppress gen_id 0, sig_id 0, track by_src, ip 209.132.180.67 suppress gen_id 1, sig_id 0, track by_src, ip 209.132.180.67 Each of the rules above will make sure 2002087 doesn't alert when the source of the emails is 209.132.180.67. It **will** alert for all other hosts. :: suppress gen_id 1, sig_id 2002087 This suppression will simply convert the rule to "noalert", meaning it will never alert in any case. If the rule sets a flowbit, that will still happen. Threshold/event_filter ~~~~~~~~~~~~~~~~~~~~~~ When applied to a specific signature, thresholds and event_filters (threshold from now on) will override the signature setting. This can be useful for when the default in a signature doesn't suit your evironment. :: threshold gen_id 1, sig_id 2002087, type both, track by_src, count 3, seconds 5 threshold gen_id 1, sig_id 2002087, type threshold, track by_src, count 10, seconds 60 threshold gen_id 1, sig_id 2002087, type limit, track by_src, count 1, seconds 15 Each of these will replace the threshold setting for 2002087 by the new threshold setting. **Note:** overriding all gids or sids (by using gen_id 0 or sig_id 0) is not supported. Bug #425. Rate_filter ~~~~~~~~~~~ TODO suricata-3.2.1/doc/userguide/public-data-sets.rst0000644000000000000000000000077513051004444016657 00000000000000Public Data Sets ================ Collections of pcaps for testing, profiling. DARPA sets: http://www.ll.mit.edu/mission/communications/cyber/CSTcorpora/ideval/data/ MAWI sets (pkt headers only, no payloads): http://mawi.wide.ad.jp/mawi/samplepoint-F/2012/ MACCDC: http://www.netresec.com/?page=MACCDC Netresec: http://www.netresec.com/?page=PcapFiles Wireshark: https://wiki.wireshark.org/SampleCaptures Security Onion collection: https://github.com/security-onion-solutions/security-onion/wiki/Pcaps suricata-3.2.1/doc/userguide/setting-up-ipsinline-for-linux.rst0000644000000000000000000000673113051004444021524 00000000000000Setting up IPS/inline for Linux ================================ In this guide will be explained how to work with Suricata in layer3 inline mode and how to set iptables for that purpose. First start with compiling Suricata with NFQ support. For instructions see `Ubuntu Installation `_. For more information about NFQ and iptables, see :ref:`suricata-yaml-nfq`. To check if you have NFQ enabled in your Suricata, enter the following command: :: suricata --build-info and examine if you have NFQ between the features. To run suricata with the NFQ mode, you have to make use of the -q option. This option tells Suricata which of the queue numbers it should use. :: sudo suricata -c /etc/suricata/suricata.yaml -q 0 Iptables configuration ~~~~~~~~~~~~~~~~~~~~~~ First of all it is important to know which traffic you would like to send to Suricata. Traffic that passes your computer or traffic that is generated by your computer. .. image:: setting-up-ipsinline-for-linux/IPtables.png .. image:: setting-up-ipsinline-for-linux/iptables1.png If Suricata is running on a gateway and is meant to protect the computers behind that gateway you are dealing with the first scenario: *forward_ing* . If Suricata has to protect the computer it is running on, you are dealing with the second scenario: *host* (see drawing 2). These two ways of using Suricata can also be combined. The easiest rule in case of the gateway-scenario to send traffic to Suricata is: :: sudo iptables -I FORWARD -j NFQUEUE In this case, all forwarded traffic goes to Suricata. In case of the host situation, these are the two most simple iptable rules; :: sudo iptables -I INPUT -j NFQUEUE sudo iptables -I OUTPUT -j NFQUEUE It is possible to set a queue number. If you do not, the queue number will be 0 by default. Imagine you want Suricata to check for example just TCP-traffic, or all incoming traffic on port 80, or all traffic on destination-port 80, you can do so like this: :: sudo iptables -I INPUT -p tcp -j NFQUEUE sudo iptables -I OUTPUT -p tcp -j NFQUEUE In this case, Suricata checks just TCP traffic. :: sudo iptables -I INPUT -p tcp --sport 80 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --dport 80 -j NFQUEUE In this example, Suricata checks all input and output on port 80. .. image:: setting-up-ipsinline-for-linux/iptables2.png .. image:: setting-up-ipsinline-for-linux/IPtables3.png To see if you have set your iptables rules correct make sure Suricata is running and enter: :: sudo iptables -vnL In the example you can see if packets are being logged. .. image:: setting-up-ipsinline-for-linux/iptables_vnL.png This description of the use of iptables is the way to use it with IPv4. To use it with IPv6 all previous mentioned commands have to start with 'ip6tables'. It is also possible to let Suricata check both kinds of traffic. There is also a way to use iptables with multiple networks (and interface cards). Example: .. image:: setting-up-ipsinline-for-linux/iptables4.png :: sudo iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE sudo iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE The options -i (input) -o (output) can be combined with all previous mentioned options If you would stop Suricata and use internet, the traffic will not come through. To make internet work correctly, you have to erase all iptable rules. To erase all iptable rules, enter: :: sudo iptables -F suricata-3.2.1/doc/userguide/unix-socket.rst0000644000000000000000000001620613051004444015763 00000000000000Interacting via Unix Socket =========================== Introduction ------------ Since 1.4 version, Suricata can listen to a unix socket and accept commands from the user. The exchange protocol is JSON-based and the format of the message has been done to be generic and it is described in this commit message. An example script called suricatasc is provided in the source and installed automatically when updating Suricata. The unix socket is disabled by default. You need to have libjansson installed: * libjansson4 - C library for encoding, decoding and manipulating JSON data * libjansson-dev - C library for encoding, decoding and manipulating JSON data (dev) * python-simplejson - simple, fast, extensible JSON encoder/decoder for Python :: apt-get install libjansson4 libjansson-dev python-simplejson If libjansson is present on the system , unix socket will be compiled in automatically - when you use "--enable-unix-socket" in your configure line. The creation of the socket is activated by setting enabled to yes under unix-command in Suricata YAML configuration file: :: unix-command: enabled: yes #filename: custom.socket # use this to specify an alternate file The ``filename`` variable can be used to set an alternate socket filename. The filename is always relative to the local state base directory. Clients are implemented for some language and can be used as code example to write custom scripts: * Python: https://github.com/inliniac/suricata/blob/master/scripts/suricatasc/suricatasc.in (provided with suricata and used in this document) * Perl: https://github.com/aflab/suricatac (a simple Perl client with interactive mode) * C: https://github.com/regit/SuricataC (a unix socket mode client in C without interactive mode) Commands in standard running mode --------------------------------- The set of existing commands is the following: * command-list: list available commands * shutdown: this shutdown suricata * iface-list: list interfaces where Suricata is sniffing packets * iface-stat: list statistic for an interface * help: alias of command-list * version: display Suricata's version * uptime: display Suricata's uptime * running-mode: display running mode (workers, autofp, simple) * capture-mode: display capture system used * conf-get: get configuration item (see example below) * dump-counters: dump Suricata's performance counters You can access to these commands with the provided example script which is named ``suricatasc``. A typical session with ``suricatasc`` will looks like: :: # suricatasc Command list: shutdown, command-list, help, version, uptime, running-mode, capture-mode, conf-get, dump-counters, iface-stat, iface-list, quit >>> iface-list Success: {'count': 2, 'ifaces': ['eth0', 'eth1']} >>> iface-stat eth0 Success: {'pkts': 378, 'drop': 0, 'invalid-checksums': 0} >>> conf-get unix-command.enabled Success: "yes" Commands on the cmd prompt -------------------------- You can use suricatasc directly on the command prompt: :: root@debian64:~# suricatasc -c version {'message': '2.1beta2 RELEASE', 'return': 'OK'} root@debian64:~# root@debian64:~# suricatasc -c uptime {'message': 35264, 'return': 'OK'} root@debian64:~# **NOTE:** You need to quote commands involving more than one argument: :: root@debian64:~# suricatasc -c "iface-stat eth0" {'message': {'pkts': 5110429, 'drop': 0, 'invalid-checksums': 0}, 'return': 'OK'} root@debian64:~# Pcap processing mode -------------------- This mode is one of main motivation behind this code. The idea is to be able to ask to Suricata to treat different pcap files without having to restart Suricata between the files. This provides you a huge gain in time as you don’t need to wait for the signature engine to initialize. To use this mode, start suricata with your preferred YAML file and provide the option ``--unix-socket`` as argument: :: suricata -c /etc/suricata-full-sigs.yaml --unix-socket It is also possible to specify the socket filename as argument: :: suricata --unix-socket=custom.socket In this last case, you will need to provide the complete path to the socket to ``suricatasc``. To do so, you need to pass the filename as first argument of ``suricatasc``: :: suricatasc custom.socket Once Suricata is started, you can use the provided script ``suricatasc`` to connect to the command socket and ask for pcap treatment: :: root@tiger:~# suricatasc >>> pcap-file /home/benches/file1.pcap /tmp/file1 Success: Successfully added file to list >>> pcap-file /home/benches/file2.pcap /tmp/file2 Success: Successfully added file to list You can add multiple files without waiting the result: they will be sequentially processed and the generated log/alert files will be put into the directory specified as second arguments of the pcap-file command. You need to provide absolute path to the files and directory as suricata don’t know from where the script has been run. To know how much files are waiting to get processed, you can do: :: >>> pcap-file-number Success: 3 To get the list of queued files, do: :: >>> pcap-file-list Success: {'count': 2, 'files': ['/home/benches/file1.pcap', '/home/benches/file2.pcap']} To get current processed file: :: >>> pcap-current Success: "/tmp/test.pcap" Build your own client --------------------- The protocol is documented in the following page https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Unix_Socket#Protocol The following session show what is send (SND) and received (RCV) by the server. Initial negotiation is the following: :: # suricatasc SND: {"version": "0.1"} RCV: {"return": "OK"} Once this is done, command can be issued: :: >>> iface-list SND: {"command": "iface-list"} RCV: {"message": {"count": 1, "ifaces": ["wlan0"]}, "return": "OK"} Success: {'count': 1, 'ifaces': ['wlan0']} >>> iface-stat wlan0 SND: {"command": "iface-stat", "arguments": {"iface": "wlan0"}} RCV: {"message": {"pkts": 41508, "drop": 0, "invalid-checksums": 0}, "return": "OK"} Success: {'pkts': 41508, 'drop': 0, 'invalid-checksums': 0} In pcap-file mode, this gives: :: >>> pcap-file /home/eric/git/oisf/benches/sandnet.pcap /tmp/bench SND: {"command": "pcap-file", "arguments": {"output-dir": "/tmp/bench", "filename": "/home/eric/git/oisf/benches/sandnet.pcap"}} RCV: {"message": "Successfully added file to list", "return": "OK"} Success: Successfully added file to list >>> pcap-file-number SND: {"command": "pcap-file-number"} RCV: {"message": 1, "return": "OK"} >>> pcap-file-list SND: {"command": "pcap-file-list"} RCV: {"message": {"count": 1, "files": ["/home/eric/git/oisf/benches/sandnet.pcap"]}, "return": "OK"} Success: {'count': 1, 'files': ['/home/eric/git/oisf/benches/sandnet.pcap']} There is one thing to be careful about: a suricata message is sent in multiple send operations. This result in possible incomplete read on client side. The worse workaround is to sleep a bit before trying a recv call. An other solution is to use non blocking socket and retry a recv if the previous one has failed. This method is used here: source:scripts/suricatasc/suricatasc.in#L43 suricata-3.2.1/doc/userguide/command-line-options.rst0000644000000000000000000000057013051004444017543 00000000000000Command Line Options ==================== .. toctree:: Suricata's command line options: .. include:: partials/options.rst Unit Tests ~~~~~~~~~~ Builtin unittests are only available if Suricata has been built with --enable-unittests. Running unittests does not take a configuration file. Use -l to supply an output directory. .. include:: partials/options-unittests.rst suricata-3.2.1/doc/Ubuntu_Installation.txt0000644000000000000000000000447713051004444015537 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ubuntu_Installation Ubuntu Installation Pre-installation requirements Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make libmagic-dev Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter: sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0 Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 Compile and install the engine If you plan to build Suricata with IPS capabilities, enter: ./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc -- localstatedir=/var instead of ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var Continue with the next commands: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install sudo ldconfig Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with Basic_Setup. suricata-3.2.1/doc/TODO0000644000000000000000000000011313051004444011442 00000000000000Plenty, and you're welcome to help! http://suricata-ids.org/participate/ suricata-3.2.1/doc/Mac_OS_X_106x.txt0000644000000000000000000000437313051004444013675 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Mac_OS_X_106x Mac OS X (10.6.x) Pre-installation requirements These instructions have been tested with Mac OS X (10.6.1). To begin, you will need an essential development environment much like gcc/make. You can download Xcode from http://developer.apple.com/technology/xcode.html. MacPorts is required for you to fetch the depends, so you will also need to install MacPorts, if you have not already done so. The online installation guide is located at http://guide.macports.org/#installing. Before you can build Suricata for your system, you must run the following command to ensure that you have everything you need for the installation. port install autoconf automake gcc44 make libnet11 libpcap pcre \ libyaml libtool export AC_PROG_LIBTOOL=$( which libtool ) Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS If you would like to have IPS capabilities with IPFW, then you should run configure like this: ./configure --enable-ipfw --prefix=/usr --sysconfdir=/etc --localstatedir=/ var and execute the rest of the commands the same as above. Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 You will also need to have an ipfw rule set for the engine to see the packets from ipfw. For example: ipfw add 100 divert 8000 ip from any to any The 8000 above should be the same number you pass on the command line of suricata with the option -d, that is, -d 8000: suricata -c config_file.yaml -d 8000 You will need a Suricata rule set with IPS options (drop, reject, etc). For this, please refer to the Emerging Threats rule sets. If you are building from Git sources, enter the following: bash autogen.sh If you are not building from Git sources, enter the following: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Please continue with the Basic_Setup. suricata-3.2.1/doc/FreeBSD_8.txt0000644000000000000000000000543013051004444013163 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/FreeBSD_8 FreeBSD 8 & 9 Pre-installation requirements Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. Make sure you enter all commands as root/super-user, otherwise it will not work. For FreeBSD 8: pkg_add -r autoconf262 automake19 gcc45 libyaml pcre libtool \ libnet11 libpcap gmake For FreeBSD 9.0: pkg_add -r autoconf268 automake111 gcc libyaml pcre libtool \ libnet11 libpcap gmake Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS If you would like to build suricata on FreeBSD with IPS capabilities with IPFW via --enable-ipfw, enter the following to enable ipfw and divert socket support before starting the engine with -d: Edit /etc/rc.conf and add or modify the following lines: firewall_enable="YES" firewall_type="open" Edit /boot/loader.conf and add or modify the following lines: ipfw_load="YES" ipfw_nat_load="YES" ipdivert_load="YES" dummynet_load="YES" libalias_load="YES" Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 If you are building from Git sources, enter all the following commands until the end of this file: bash autogen.sh If you are not building from Git sources, do not enter the above mentioned commands. Continue enter the following: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make make install zerocopy bpf mkdir /var/log/suricata/ FreeBSD 8 has support for zerocopy bpf in libpcap. To test this functionality, issue the following command and then start/restart the engine: sysctl net.bpf.zerocopy_enable=1 Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with the Basic_Setup. suricata-3.2.1/doc/NEWS0000644000000000000000000000003713051004444011456 00000000000000http://suricata-ids.org/news/ suricata-3.2.1/doc/Windows.txt0000644000000000000000000001413113051004444013152 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Windows Windows NOTE - A new instruction set for Suricata installation (and/or compilation from scratch) can be found here: https://redmine.openinfosecfoundation.org/projects/suricata/files also a windows binary - self extracting auto install package is available here: http://www.openinfosecfoundation.org/index.php/download-suricata Preparing the build environment The instructions below should be followed in the order they appear. If your configuration requires unique actions to compile the package and/or you significantly modify the configure shell script, please e-mail the details of your requirements and/or solution to bugreports@openinfosecfoundation.org. Set up MinGW environment from http://mingw.org/ Do not use the automatic installer, as it is deprecated. Instead, manually unpack the following packages to c:\mingw (you may use newer versions if you prefer): * binutils o binutils-2.20-1-mingw32-bin.tar.gz * mingw-runtime (dev and dll) o mingwrt-3.17-mingw32-dll.tar.gz o mingwrt-3.17-mingw32-dev.tar.gz * w32api o w32api-3.14-mingw32-dev.tar.gz * Required runtime libraries for GCC (gmp, libiconv, MPFR and pthreads) o gmp-4.2.4-mingw32-dll.tar.gz o libiconv-1.13.1-1-mingw32-dll-2.tar.lzma o mpfr-2.4.1-mingw32-dll.tar.gz o pthreads-w32-2.8.0-mingw32-dll.tar.gz * gcc-core (bin and dll) o gcc-core-4.4.0-mingw32-bin.tar.gz o gcc-core-4.4.0-mingw32-dll.tar.gz * make o make-3.81-20090914-mingw32-bin.tar.gz * zlib o libz-1.2.3-1-mingw32-dll-1.tar.gz + libz-1.2.3-1-mingw32-dev.tar.gz Download MSYS Get MSYS from http://sourceforge.net/projects/mingw/files/ and install MSYS-1.0.11.exe (MSYS Base System) msysDTK-1.0.1.exe (MSYS Suplementary Tools) autoconf-2.63-1-msys-1.0.11-bin.tar.lzma automake-1.11-1-msys-1.0.11-bin.tar.lzma libtool-2.2.7a-1-msys-1.0.11-bin.tar.lzma MSYS will ask the following questions during installation. Accept Post Install: [y] MinGW Installed? : [y] path to MinGW: [c:/MinGW] Download pkg-config Install pkg-config taken from http://wiki.videolan.org/Win32CompileMSYSNew#PKG- CONFIG Download and extract the following into c:\Msys\1.0 http://ftp.gnome.org/pub/GNOME/binaries/win32/glib/2.18/glib_2.18.2- 1_win32.zip ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config_0.23- 3_win32.zip ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config- dev_0.23-3_win32.zip Set PKG_CONFIG_PATH=/win32/lib/pkgconfig (e.g. by adding the Windows environment variable PKG_CONFIG_PATH in "Control Panel"->"System"->"Advanced System Settings"->"Environment Variables" and setting the value to /win32/lib/pkgconfig) Download Git sources Get Git sources from http://code.google.com/p/msysgit/ Unpack to /msys/1.0 Remember to edit ~/.gitconfig to set your username Download libpcre Get libpcre from http://www.pcre.org/ ./configure --enable-utf8 --disable-cpp --prefix=/mingw make make install Download libyaml Download libyaml from http://pyyaml.org/wiki/LibYAML Though libyaml does not support mingw compilation, it does work in static mode. ./configure --prefix=/mingw CFLAGS="-DYAML_DECLARE_STATIC" make make install Download libpcap Download the developer pack from http://www.winpcap.org/devel.htm To have the driver in the system, download and install a corresponding installer package from http://www.winpcap.org/install/default.htm Copy includes to c:/mingw/include and libs (.a) to c:/mingw/lib Rename libwpcap.a to libpcap.a Get and compile Suricata git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf Because of an autotools port bug, you will need to do the following: dos2unix.exe libhtp/configure.ac dos2unix.exe libhtp/htp.pc.in dos2unix.exe libhtp/Makefile.am ./autogen.sh ./configure CFLAGS="-DYAML_DECLARE_STATIC" Add --enable-nfqueue as a configurable parameter to enable inline mode. make If the full installation is successful, suricata.exe will be located in src/.lib. To test your build, you will need libpcre-0.dll, libz-1.dll, and pthreadGC2.dll, all of which should already be installed under c:/mingw or c:/ msys. preparing the runtime environment. To prepare the runtime environment, you must copy the executable and DLLs to a dedicated directory. Get the classification.config and suricata.yaml, and then edit suricata.yaml to ensure the directories are correctly identified. pcap mode If you have not already done so, install winpcap runtime and its driver. Then, determine your eth device UUID in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ suricata.exe -c suricata.yaml -i \device\ In the example above, device should be replaced with your device uuid. Inline mode To operate in inline mode, you must download, compile and install netfilterforwin, which is the netfilter.sys driver and Windows port of the libnetfilter_queue library. Download and install the Windows Driver Kit from Microsoft http://www.microsoft.com/downloads/ details.aspx?displaylang=en&FamilyID=36a2630f-5d56-43b5-b996-7633f2ec14ff Download netfilterforwin from http://sourceforge.net/projects/netfilterforwin/ Unpack it so the netfilterforwin directory is beside the oisf directory. You must omit the version from its name. Compile the driver Open the correct build environment from your Start menu Start > All Programs > Windows Driver Kits > WDK xxxx.yyyy.z > Build Environments > Windows Server 2003 > x86 Free Build Environment At your command line prompt, enter the following: cd netfilterforwin/netfilter nmake Install the driver Copy inf/* files and the freshly built netfilter.sys to a separate directory, and then open the network connections. Right-click an interface, then select Properties Click install... Select Service Click Add Click Have disk... Browse to the directory with the inf files and netfilter.sys, select netfilter.inf, and then click Ok. Confirm everything The driver is now installed. Run Suricata in inline mode suricata.exe -c suricata.yaml -q 0 suricata-3.2.1/doc/Makefile.am0000644000000000000000000000166013051004444013016 00000000000000SUBDIRS = userguide EXTRA_DIST = \ AUTHORS \ GITGUIDE \ INSTALL \ NEWS \ README \ TODO \ INSTALL.PF_RING \ INSTALL.WINDOWS \ \ Basic_Setup.txt \ CentOS5.txt \ CentOS_56_Installation.txt \ Debian_Installation.txt \ Fedora_Core.txt \ FreeBSD_8.txt \ HTP_library_installation.txt \ Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt \ Installation_with_CUDA_on_Ubuntu_server_1104.txt \ Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt \ Installation_with_PF_RING.txt \ Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt \ Installation_from_GIT_with_PCRE-JIT.txt \ Installation_with_CUDA_on_Scientific_Linux_6.txt \ Mac_OS_X_106x.txt \ OpenBSD_Installation_from_GIT.txt \ Setting_up_IPSinline_for_Linux.txt \ Third_Party_Installation_Guides.txt \ Ubuntu_Installation.txt \ Ubuntu_Installation_from_GIT.txt \ Windows.txt datarootdir=@datarootdir@ docdir = ${datarootdir}/doc/${PACKAGE} dist_doc_DATA = ${EXTRA_DIST} suricata-3.2.1/doc/OpenBSD_Installation_from_GIT.txt0000644000000000000000000000403513051004444017223 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/OpenBSD_Installation_from_GIT OpenBSD Installation from GIT Pre-installation Requirements Before you can build Suricata for your system, run the following commands to ensure that you have everything you need for the installation. pkg_add gcc pkg_add pcre pkg_add libtool pkg_add libyaml pkg_add libnet-1.1.2.1p0 If you would like to build from Git sources, you have to install the following building tools: pkg_add git pkg_add autoconf pkg_add automake If you use OpenBSD 4.8, enter the following: pkg_add git autoconf-2.61p3 automake-1.10.3 HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. Suricata Next, clone the repository and run autogen: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf export AUTOCONF_VERSION=2.61 export AUTOMAKE_VERSION=1.10 ./autogen.sh Enter the following to configure: CPPFLAGS="-I/usr/local/include" CFLAGS="-L/usr/local/lib" ./configure -- prefix=/opt/suricata To build and install Suricata, enter the following in your command line: make make install Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Next, continue with the Basic_Setup. Source: http://home.regit.org/?p=478 suricata-3.2.1/doc/Fedora_Core.txt0000644000000000000000000000423313051004444013672 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Fedora_Core Fedora pre-installation requirements Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \ pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \ libyaml-devel zlib zlib-devel libcap-ng libcap-ng-devel file-devel file Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS If you plan to build Suricata with IPS capabilities via ./configure --enable- nfqueue, enter the following: sudo yum -y install libnfnetlink libnfnetlink-devel \ libnetfilter_queue libnetfilter_queue-devel Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 If you are building from Git sources, enter all the following commands: bash autogen.sh If you are not building from Git sources, enter only the following: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with the Basic_Setup. suricata-3.2.1/doc/Basic_Setup.txt0000644000000000000000000000706413051004444013730 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup Basic Setup When using Debian or FreeBSD, make sure you enter all commands as root/super- user because for these operating systems it is not possible to use 'sudo'. Start with creating a directory for Suricata's log information. sudo mkdir /var/log/suricata To prepare the system for using it, enter: sudo mkdir /etc/suricata The next step is to copy classification.config, reference.config and suricata.yaml from the base build/installation directory (ex. from git it will be the oisf directory) to the /etc/suricata directory. Do so by entering the following: sudo cp classification.config /etc/suricata sudo cp reference.config /etc/suricata sudo cp suricata.yaml /etc/suricata Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Setting variables Make sure every variable of the vars, address-groups and port-groups in the yaml file is set correctly for your needs. A full explanation is available in the Rule_vars_section_of_the_yaml. You need to set the ip-address(es) of your local network at HOME_NET. It is recommended to set EXTERNAL_NET to !$HOME_NET. This way, every ip-address but the one set at HOME_NET will be treated as external. It is also possible to set EXTERNAL_NET to 'any', only the recommended setting is more precise and lowers the change that false positives will be generated. HTTP_SERVERS, SMTP_SERVERS , SQL_SERVERS , DNS_SERVERS and TELNET_SERVERS are by default set to HOME_NET. AIM_SERVERS is by default set at 'any'. These variables have to be set for servers on your network. All settings have to be set to let it have a more accurate effect. Next, make sure the following ports are set to your needs: HTTP_PORTS, SHELLCODE_PORTS, ORACLE_PORTS and SSH_PORTS. Finally, set the host-os-policy to your needs. See Host_OS_Policy_in_the_yaml for a full explanation. windows:[] bsd: [] bsd-right: [] old-linux: [] linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000: 0000"] old-solaris: [] solaris: ["::1"] hpux10: [] hpux11: [] irix: [] macos: [] vista: [] windows2k3: [] Note that bug #499 may prevent you from setting old-linux, bsd-right and old- solaris right now. Interface cards To check the available interface cards, enter: ifconfig Now you can see which one you would like Suricata to use. To start the engine and include the interface card of your preference, enter: sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 Instead of wlan0, you can enter the interface card of your preference. To see if the engine is working correctly and receives and inspects traffic, enter: cd /var/log/suricata Followed by: tail http.log And: tail -n 50 stats.log To make sure the information displayed is up-dated in real time, use the - f option before http.log and stats.log: tail -f http.log stats.log suricata-3.2.1/doc/Installation_with_PF_RING.txt0000644000000000000000000001466613051004444016435 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_PF_RING Installation with PF RING This is the installation guide for Suricata with PF_RING support and a guide to install PF_RING. To install DKMS, enter: sudo apt-get install dkms To get subversion for checking out the PF_RING code, flex and bison for libpcap, enter: sudo apt-get install subversion flex bison To install the debs needed for Suricata, enter the following: sudo apt-get install libpcre3-dev libpcap-dev libyaml-dev zlib1g-dev libcap- ng-dev libnet1-dev In the example you will build from the GIT repository, so you will need some extra packages: sudo apt-get install git-core automake autoconf libtool To build your modules, please go to: cd /usr/src/ Checkout the PF_RING code: sudo svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING_CURRENT_SVN Create the DKMS build directory and copy files over for the main PF_RING module by entering the following: sudo mkdir /usr/src/pf_ring-4 sudo cp -Rf /usr/src/PF_RING_CURRENT_SVN/kernel/* /usr/src/pf_ring-4/ cd /usr/src/pf_ring-4/ Create a file called 'dkms.conf' sudo nano dkms.conf and place the following into the file: PACKAGE_NAME="pf_ring" PACKAGE_VERSION="4" BUILT_MODULE_NAME[0]="pf_ring" DEST_MODULE_LOCATION[0]="/kernel/net/pf_ring/" AUTOINSTALL="yes" To close the file, do so by pressing Ctrl and X at the same time, followed by y and enter. Build and install the kernel -module of PF_RING: sudo dkms add -m pf_ring -v 4 sudo dkms build -m pf_ring -v 4 sudo dkms install -m pf_ring -v 4 development headers.(zie aantekeningen) sudo mkdir -p /opt/PF_RING/{bin,lib,include/linux,sbin} Next, build and install the userland lib.: sudo cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /opt/PF_RING/ include/linux/ cd /usr/src/PF_RING_CURRENT_SVN/userland/lib sudo ./configure sudo sed -i -e 's/INSTDIR = \${DESTDIR}\/usr\/local/INSTDIR = \$ {DESTDIR}\/opt\/PF_RING/' Makefile sudo cp -f pfring_e1000e_dna.h /opt/PF_RING/include sudo make sudo make install Enter the following to pull down the latest version of Suricata from the git repository and build with PF_RING support: cd /usr/src/PF_RING_CURRENT_SVN/userland/ sudo git clone git://phalanx.openinfosecfoundation.org/oisf.git oisfnew cd oisfnew sudo ./autogen.sh sudo ./configure --enable-pfring --with-libpfring-libraries=/opt/PF_RING/lib --with-libpfring-includes=/opt/PF_RING/include --with-libpcap-libraries=/opt/ PF_RING/lib --with-libpcap-includes=/opt/PF_RING/include LD_RUN_PATH="/opt/ PF_RING/lib:/usr/lib:/usr/local/lib" --prefix=/opt/PF_RING/ sudo make install sudo make sudo mkdir etc/suricata To make config and log directories for a more complete getting started, see: Basic_Setup. sudo mkdir /etc/suricata sudo cp suricata.yaml /etc/suricata/ sudo cp classification.config /etc/suricata/ sudo mkdir /var/log/suricata The information about the setup options for when you initialise the module: min_num_slots:Number of ring slots (uint) transparent_mode:0=standard Linux, 1=direct2pfring+transparent, 2=direct2pfring+non transparent. For 1 and 2 you need to use a PF_RING aware driver (uint) . enable_tx_capture:Set to 1 to capture outgoing packets (uint) enable_ip_defrag:Set to 1 to enable IP defragmentation(only rx traffic is defragmentead) (uint) Enter the following as super-user: echo "options pf_ring transparent_mode=0 min_num_slots=32768 enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf To check the status of PF_RING : sudo modprobe pf_ring sudo modinfo pf_ring && cat /proc/net/pf_ring/info Start up Suricata with PF_RING support: sudo /opt/PF_RING/bin/suricata --pfring-int=eth0 --pfring-cluster-id=99 -- pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml If you need to uninstall PF_RING or rollback your PF_RING aware drivers to their previous state you can do so with the following commands: sudo dkms remove -m pf_ring -v 4 --all Optional The following part is optional. sudo dkms remove -m e1000e-pf_ring -v 1.0.15 --all If you issue the following command, you can see that PF_RING should now be installed as DKMS module: dkms status Now go through the steps to build a PF_RING aware driver: sudo mkdir /usr/src/e1000e-pf_ring-1.0.15 sudo cp -Rf /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000e/old/e1000e- 1.0.15/src/* /usr/src/e1000e-pf_ring-1.0.15/ Enter the following so that DKMS can find it for driver rebuilds: sudo cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /usr/src/ e1000e-pf_ring-1.0.15/ cd /usr/src/e1000e-pf_ring-1.0.15/ After that, fix the path to pf_ring.h: sed -i -e 's/\.\.\/\.\.\/\.\.\/\.\.\/kernel\/linux\/pf\_ring\.h/pf\_ring\.h/ ' netdev.c Then create a file called 'dkms.conf'. sudo nano dkms.conf and place the following into the file: PACKAGE_NAME="e1000e-pf_ring" PACKAGE_VERSION="1.0.15" BUILT_MODULE_NAME[0]="e1000e" DEST_MODULE_LOCATION[0]="/kernel/drivers/net/e1000e/" AUTOINSTALL="yes" Build and install the module of the e1000e-pf_ring network driver: sudo dkms add -m e1000e-pf_ring -v 1.0.15 sudo dkms build -m e1000e-pf_ring -v 1.0.15 sudo dkms install -m e1000e-pf_ring -v 1.0.15 After that, build and install the PF_RING enabled libpcap: cd /usr/src/PF_RING_CURRENT_SVN/userland/libpcap-1.0.0-ring ./configure sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/ ' Makefile sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/ ' Makefile.in ./configure --prefix=/opt/PF_RING && make && make install Subsequently, build and install tcpdump using the PF_RING enabled version of libpcap: cd /usr/src/PF_RING_CURRENT_SVN/userland/tcpdump-4.0.0 sudo ./configure sudo sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/ ' Makefile sudo sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/ ' Makefile.in sudo sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/ ' Makefile sudo sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/ ' Makefile.in sudo sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\// ' Makefile sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\// ' Makefile.in sudo ./configure LD_RUN_PATH="/opt/PF_RING/lib:/usr/lib:/usr/local/lib" -- prefix=/opt/PF_RING/ --enable-ipv6 && make && make install suricata-3.2.1/doc/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt0000644000000000000000000000372213051004444024243 00000000000000Autogenerated on 2012-01-11 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104 Installation from GIT with PF RING on Ubuntu server 11.04 This guide is based on using Ubuntu Server 11.04 Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux Pre installation requirements Install the following packages, to make sure you have everything needed for the installation: sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make flex bison git subversion Go to your download directory and get the latest PF_RING: svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING Compile and install Next, enter the following commands for configuration and installation: cd PF_RING/kernel make && make install sudo insmod ./pf_ring.ko cd ../userland make && make install cd /lib ./configure && make && make install cd ../libpcap ./configure && make && make install cd /examples echo "options pf_ring transparent_mode=0 min_num_slots=32768 enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf To check if you have everything you need, enter: lsmod |grep pf_ring sudo modprobe pf_ring sudo modinfo pf_ring && cat /proc/net/pf_ring/info To check if PF_RING is functional, enter the following: ./pfcount -i eth0 Suricata Go to your download directory of choice, and enter: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf sudo ./autogen.sh sudo ./configure --enable-pfring && make && make install You can always check if PF_RING is build in properly, by entering: suricata --build-info To run Suricata with PF_RING, enter: suricata --pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster- type=cluster_flow -c /etc/suricata/suricata.yaml Continue with the Basic_Setup. Thanks to Peter Manev suricata-3.2.1/doc/Makefile.in0000644000000000000000000005665513051004467013052 00000000000000# Makefile.in generated by automake 1.15 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2014 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ VPATH = @srcdir@ am__is_gnu_make = { \ if test -z '$(MAKELEVEL)'; then \ false; \ elif test -n '$(MAKE_HOST)'; then \ true; \ elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \ true; \ else \ false; \ fi; \ } am__make_running_with_option = \ case $${target_option-} in \ ?) ;; \ *) echo "am__make_running_with_option: internal error: invalid" \ "target option '$${target_option-}' specified" >&2; \ exit 1;; \ esac; \ has_opt=no; \ sane_makeflags=$$MAKEFLAGS; \ if $(am__is_gnu_make); then \ sane_makeflags=$$MFLAGS; \ else \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ bs=\\; \ sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \ | sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \ esac; \ fi; \ skip_next=no; \ strip_trailopt () \ { \ flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \ }; \ for flg in $$sane_makeflags; do \ test $$skip_next = yes && { skip_next=no; continue; }; \ case $$flg in \ *=*|--*) continue;; \ -*I) strip_trailopt 'I'; skip_next=yes;; \ -*I?*) strip_trailopt 'I';; \ -*O) strip_trailopt 'O'; skip_next=yes;; \ -*O?*) strip_trailopt 'O';; \ -*l) strip_trailopt 'l'; skip_next=yes;; \ -*l?*) strip_trailopt 'l';; \ -[dEDm]) skip_next=yes;; \ -[JT]) skip_next=yes;; \ esac; \ case $$flg in \ *$$target_option*) has_opt=yes; break;; \ esac; \ done; \ test $$has_opt = yes am__make_dryrun = (target_option=n; $(am__make_running_with_option)) am__make_keepgoing = (target_option=k; $(am__make_running_with_option)) pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = doc ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) DIST_COMMON = $(srcdir)/Makefile.am $(dist_doc_DATA) \ $(am__DIST_COMMON) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = SOURCES = DIST_SOURCES = RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \ ctags-recursive dvi-recursive html-recursive info-recursive \ install-data-recursive install-dvi-recursive \ install-exec-recursive install-html-recursive \ install-info-recursive install-pdf-recursive \ install-ps-recursive install-recursive installcheck-recursive \ installdirs-recursive pdf-recursive ps-recursive \ tags-recursive uninstall-recursive am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } am__installdirs = "$(DESTDIR)$(docdir)" DATA = $(dist_doc_DATA) RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive am__recursive_targets = \ $(RECURSIVE_TARGETS) \ $(RECURSIVE_CLEAN_TARGETS) \ $(am__extra_recursive_targets) AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \ distdir am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DIST_SUBDIRS = $(SUBDIRS) am__DIST_COMMON = $(srcdir)/Makefile.in AUTHORS INSTALL NEWS README \ TODO DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ sed_rest='s,^[^/]*/*,,'; \ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ sed_butlast='s,/*[^/]*$$,,'; \ while test -n "$$dir1"; do \ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ if test "$$first" != "."; then \ if test "$$first" = ".."; then \ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ else \ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ if test "$$first2" = "$$first"; then \ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ else \ dir2="../$$dir2"; \ fi; \ dir0="$$dir0"/"$$first"; \ fi; \ fi; \ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ done; \ reldir="$$dir2" ACLOCAL = @ACLOCAL@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CLANG_CFLAGS = @CLANG_CFLAGS@ CONFIGURE_LOCALSTATEDIR = @CONFIGURE_LOCALSTATEDIR@ CONFIGURE_PREFIX = @CONFIGURE_PREFIX@ CONFIGURE_SYSCONDIR = @CONFIGURE_SYSCONDIR@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GCC_CFLAGS = @GCC_CFLAGS@ GREP = @GREP@ HAVE_COCCINELLE_CONFIG = @HAVE_COCCINELLE_CONFIG@ HAVE_CURL = @HAVE_CURL@ HAVE_GETCONF_CMD = @HAVE_GETCONF_CMD@ HAVE_GIT_CMD = @HAVE_GIT_CMD@ HAVE_PCAP_CONFIG = @HAVE_PCAP_CONFIG@ HAVE_PDFLATEX = @HAVE_PDFLATEX@ HAVE_PKG_CONFIG = @HAVE_PKG_CONFIG@ HAVE_PYTHON_CONFIG = @HAVE_PYTHON_CONFIG@ HAVE_SPHINXBUILD = @HAVE_SPHINXBUILD@ HAVE_WGET = @HAVE_WGET@ HTP_DIR = @HTP_DIR@ HTP_LDADD = @HTP_LDADD@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBHTPDEVVERSION_CFLAGS = @LIBHTPDEVVERSION_CFLAGS@ LIBHTPDEVVERSION_LIBS = @LIBHTPDEVVERSION_LIBS@ LIBHTPMINVERSION_CFLAGS = @LIBHTPMINVERSION_CFLAGS@ LIBHTPMINVERSION_LIBS = @LIBHTPMINVERSION_LIBS@ LIBOBJS = @LIBOBJS@ LIBPCREVERSION_CFLAGS = @LIBPCREVERSION_CFLAGS@ LIBPCREVERSION_LIBS = @LIBPCREVERSION_LIBS@ LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ LUAJIT_CFLAGS = @LUAJIT_CFLAGS@ LUAJIT_LIBS = @LUAJIT_LIBS@ LUA_CFLAGS = @LUA_CFLAGS@ LUA_LIBS = @LUA_LIBS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ NVCC = @NVCC@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OPTIMIZATION_CFLAGS = @OPTIMIZATION_CFLAGS@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PCAP_CFLAGS = @PCAP_CFLAGS@ PKG_CONFIG = @PKG_CONFIG@ PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ PYTHON = @PYTHON@ PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ PYTHON_PLATFORM = @PYTHON_PLATFORM@ PYTHON_PREFIX = @PYTHON_PREFIX@ PYTHON_VERSION = @PYTHON_VERSION@ RANLIB = @RANLIB@ SECCFLAGS = @SECCFLAGS@ SECLDFLAGS = @SECLDFLAGS@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = ${datarootdir}/doc/${PACKAGE} dvidir = @dvidir@ e_enable_evelog = @e_enable_evelog@ e_localstatedir = @e_localstatedir@ e_logcertsdir = @e_logcertsdir@ e_logdir = @e_logdir@ e_logfilesdir = @e_logfilesdir@ e_magic_file = @e_magic_file@ e_magic_file_comment = @e_magic_file_comment@ e_rundir = @e_rundir@ e_sysconfdir = @e_sysconfdir@ e_sysconfrulesdir = @e_sysconfrulesdir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ libhs_CFLAGS = @libhs_CFLAGS@ libhs_LIBS = @libhs_LIBS@ libhtp_CFLAGS = @libhtp_CFLAGS@ libhtp_LIBS = @libhtp_LIBS@ libnetfilter_queue_CFLAGS = @libnetfilter_queue_CFLAGS@ libnetfilter_queue_LIBS = @libnetfilter_queue_LIBS@ libnspr_CFLAGS = @libnspr_CFLAGS@ libnspr_LIBS = @libnspr_LIBS@ libnss_CFLAGS = @libnss_CFLAGS@ libnss_LIBS = @libnss_LIBS@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ pkgpyexecdir = @pkgpyexecdir@ pkgpythondir = @pkgpythondir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ pyexecdir = @pyexecdir@ pythondir = @pythondir@ runstatedir = @runstatedir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ subdirs = @subdirs@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = userguide EXTRA_DIST = \ AUTHORS \ GITGUIDE \ INSTALL \ NEWS \ README \ TODO \ INSTALL.PF_RING \ INSTALL.WINDOWS \ \ Basic_Setup.txt \ CentOS5.txt \ CentOS_56_Installation.txt \ Debian_Installation.txt \ Fedora_Core.txt \ FreeBSD_8.txt \ HTP_library_installation.txt \ Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt \ Installation_with_CUDA_on_Ubuntu_server_1104.txt \ Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt \ Installation_with_PF_RING.txt \ Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt \ Installation_from_GIT_with_PCRE-JIT.txt \ Installation_with_CUDA_on_Scientific_Linux_6.txt \ Mac_OS_X_106x.txt \ OpenBSD_Installation_from_GIT.txt \ Setting_up_IPSinline_for_Linux.txt \ Third_Party_Installation_Guides.txt \ Ubuntu_Installation.txt \ Ubuntu_Installation_from_GIT.txt \ Windows.txt dist_doc_DATA = ${EXTRA_DIST} all: all-recursive .SUFFIXES: $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu doc/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu doc/Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs install-dist_docDATA: $(dist_doc_DATA) @$(NORMAL_INSTALL) @list='$(dist_doc_DATA)'; test -n "$(docdir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(docdir)'"; \ $(MKDIR_P) "$(DESTDIR)$(docdir)" || exit 1; \ fi; \ for p in $$list; do \ if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ echo "$$d$$p"; \ done | $(am__base_list) | \ while read files; do \ echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(docdir)'"; \ $(INSTALL_DATA) $$files "$(DESTDIR)$(docdir)" || exit $$?; \ done uninstall-dist_docDATA: @$(NORMAL_UNINSTALL) @list='$(dist_doc_DATA)'; test -n "$(docdir)" || list=; \ files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \ dir='$(DESTDIR)$(docdir)'; $(am__uninstall_files_from_dir) # This directory's subdirectories are mostly independent; you can cd # into them and run 'make' without going through this Makefile. # To change the values of 'make' variables: instead of editing Makefiles, # (1) if the variable is set in 'config.status', edit 'config.status' # (which will cause the Makefiles to be regenerated when you run 'make'); # (2) otherwise, pass the desired values on the 'make' command line. $(am__recursive_targets): @fail=; \ if $(am__make_keepgoing); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo $@ | sed s/-recursive//`; \ case "$@" in \ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ *) list='$(SUBDIRS)' ;; \ esac; \ for subdir in $$list; do \ echo "Making $$target in $$subdir"; \ if test "$$subdir" = "."; then \ dot_seen=yes; \ local_target="$$target-am"; \ else \ local_target="$$target"; \ fi; \ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ || eval $$failcom; \ done; \ if test "$$dot_seen" = "no"; then \ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ fi; test -z "$$fail" ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-recursive TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ include_option=--etags-include; \ empty_fix=.; \ else \ include_option=--include; \ empty_fix=; \ fi; \ list='$(SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ test ! -f $$subdir/TAGS || \ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ fi; \ done; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-recursive CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-recursive cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ $(am__make_dryrun) \ || test -d "$(distdir)/$$subdir" \ || $(MKDIR_P) "$(distdir)/$$subdir" \ || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ dir1=$$subdir; dir2="$(top_distdir)"; \ $(am__relativize); \ new_top_distdir=$$reldir; \ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ ($(am__cd) $$subdir && \ $(MAKE) $(AM_MAKEFLAGS) \ top_distdir="$$new_top_distdir" \ distdir="$$new_distdir" \ am__remove_distdir=: \ am__skip_length_check=: \ am__skip_mode_fix=: \ distdir) \ || exit 1; \ fi; \ done check-am: all-am check: check-recursive all-am: Makefile $(DATA) installdirs: installdirs-recursive installdirs-am: for dir in "$(DESTDIR)$(docdir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-recursive install-exec: install-exec-recursive install-data: install-data-recursive uninstall: uninstall-recursive install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-recursive install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive clean-am: clean-generic clean-libtool mostlyclean-am distclean: distclean-recursive -rm -f Makefile distclean-am: clean-am distclean-generic distclean-tags dvi: dvi-recursive dvi-am: html: html-recursive html-am: info: info-recursive info-am: install-data-am: install-dist_docDATA install-dvi: install-dvi-recursive install-dvi-am: install-exec-am: install-html: install-html-recursive install-html-am: install-info: install-info-recursive install-info-am: install-man: install-pdf: install-pdf-recursive install-pdf-am: install-ps: install-ps-recursive install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-recursive -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-recursive mostlyclean-am: mostlyclean-generic mostlyclean-libtool pdf: pdf-recursive pdf-am: ps: ps-recursive ps-am: uninstall-am: uninstall-dist_docDATA .MAKE: $(am__recursive_targets) install-am install-strip .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \ check-am clean clean-generic clean-libtool cscopelist-am ctags \ ctags-am distclean distclean-generic distclean-libtool \ distclean-tags distdir dvi dvi-am html html-am info info-am \ install install-am install-data install-data-am \ install-dist_docDATA install-dvi install-dvi-am install-exec \ install-exec-am install-html install-html-am install-info \ install-info-am install-man install-pdf install-pdf-am \ install-ps install-ps-am install-strip installcheck \ installcheck-am installdirs installdirs-am maintainer-clean \ maintainer-clean-generic mostlyclean mostlyclean-generic \ mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \ uninstall-am uninstall-dist_docDATA .PRECIOUS: Makefile # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: suricata-3.2.1/doc/Ubuntu_Installation_from_GIT.txt0000644000000000000000000000552313051004444017256 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ubuntu_Installation_from_GIT Ubuntu Installation from GIT In this document will be explained how to install and use the most recent code of Suricata on Ubuntu. Installing from GIT on other operating systems is basically the same, except that some commands are Ubuntu-specific (like sudo and apt-get). In case you are using another operating system, you should replace those commands by your operating-specific commands. Pre-installation requirements Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make libmagic-dev sudo apt-get install git-core Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter: sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0 Suricata First, it is convenient to create a directory for Suricata. Name it 'suricata' for example. Open the terminal and enter: mkdir suricata Followed by: cd suricata Next, enter the following line in the terminal: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf Followed by: ./autogen.sh To configure, please enter: ./configure To compile, please enter: make To install Suricata, enter: sudo make install sudo ldconfig Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with Basic_Setup. In case you have already made a map for the most recent code, downloaded the code into that map, and want to download recent code again, please enter: cd suricata/oisf next, enter: git pull After that, you start again at running autogen. suricata-3.2.1/doc/GITGUIDE0000644000000000000000000000575113051004444012113 00000000000000Guide for using GIT Working with Git is significantly different that working with SVN. In particular, although similar, git pull is not svn update, git push is not svn commit, and git add is not svn add. If you are a SVN user, be sure to read the man pages for the different git commands. The following workflow is recommended by Evan and is the guideline for contributing code to Rubinius. 1. Create a local working copy of the source code (we did this earlier.) # See above for the exact invocation 2. Change to the newly created directory that contains the local working copy. (Substitute the directory if you created it with a different name, obviously.) cd code 3. Create a branch for your work. This will make a copy of the current branch (master) and name it "new_feature". Now you can work in this new branch without breaking the main one. git checkout -b new_feature 4. Edit the code and test your changes. Then commit to your local working copy git commit -a 5. When you are ready to send your local changes back to the Rubinius repository, you first need to ensure that your local copy is up-to-date. First, ensure you have committed your local changes. Then switch from your topic branch to the master branch. git checkout master 6. Update your local copy with changes from the Rubinius repository git pull 7. Switch back to your topic branch and integrate any new changes. The git rebase command will save your changes away, update the topic branch, and then reapply them. git checkout new_feature git rebase master Warning! If you are sharing a branch, you must use: git merge master Rebase causes the commit layout to change and will confuse anyone you've shared this branch with. 8. If there are conflicts applying your changes during the git rebase command, fix them and use the following to finish applying them git rebase --continue 9. Now, switch back to the master branch and merge your changes from the topic branch git checkout master git merge new_feature 10. You might want to check that your commits ended up as you intended. To do so, you can have a look at the log git log 11. Get your changes in the main repository. If you have commit rights, you can just use the git push command. Otherwise, see the section below for information on creating a set of patches to send. git push 12. At this point, you can delete the branch if you like. git branch -d new_feature When you're familiar with the workflow, you can use the rake tasks to help you out. For example, rake git will fetch the latest code from remote repo, rebase the current branch to master, fast-forward the changes to master and push the commits to the remote. This saves a lot of typing. Check rake -T git for all the git related tasks. Taken from: http://rubinius.lighthouseapp.com/projects/5089/using-git suricata-3.2.1/doc/Debian_Installation.txt0000644000000000000000000000475513051004444015436 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Debian_Installation Debian Installation Pre-installation requirements Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. Make sure you will enter all the following commands as root/super-user, otherwise it will not work. apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev \ pkg-config Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter: apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink- dev libnfnetlink0 Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 Compile and install the program If you plan to build Suricata with IPS capabilities, enter: ./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc -- localstatedir=/var instead of ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var Continue with the next commands: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make make install To make sure the existing list with libraries will be updated with the new library, enter: ldconfig Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with the Basic_Setup. suricata-3.2.1/doc/Installation_with_CUDA_on_Scientific_Linux_6.txt0000644000000000000000000000520513051004444022252 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_on_Scientific_Linux_6 Installation with CUDA on Scientific Linux 6 Hardware used: HP Proliant G7, 16 cores, 30 GB RAM, NVIDIA CUDA Quadro 4000 graphics card For setup you need to be root. Enter the following: mkdir /root/src cd /root/src Pre installation requirements Run the following command to ensure that you have everything you need for the installation: yum install mpfr-2.4.1-6.el6.x86_64 cpp-4.4.4-13.el6.x86_64 ppl-0.10.2- 11.el6.x86_64 \ cloog-ppl-0.15.7-1.2.el6.x86_64 gcc-4.4.4-13.el6.x86_64 kernel-devel-2.6.32- 131.2.1.el6.x86_64 \ pcre-devel-7.8-3.1.el6.x86_64 libpcap-devel-1.0.0- 6.20091201git117cb5.el6.x86_64 \ yum-plugin-priorities-1.1.26-11.el6.noarch yum-conf-sl6x-1-1.noarch libyaml- 0.1.3-1.el6.rf.x86_64 \ libyaml-devel-0.1.3-1.el6.rf.x86_64 libnet-1.1.2.1-2.2.el6.rf.x86_64 flex- 2.5.35-8.el6.x86_64 \ bison-2.4.1-5.el6.x86_64 gcc-c++-4.4.4-13.el6.x86_64 CUDA Download and install NVIDIA CUDA drivers: wget http://us.download.nvidia.com/XFree86/Linux-x86_64/270.41.19/NVIDIA- Linux-x86_64-270.41.19.run chmod +x NVIDIA-Linux-x86_64-270.41.19.run ./NVIDIA-Linux-x86_64-270.41.19.run You also need to download and install the CUDA toolkit for RHEL6 : wget http://developer.download.nvidia.com/compute/cuda/4_0/toolkit/ cudatoolkit_4.0.17_linux_64_rhel6.0.run chmod +x cudatoolkit_4.0.17_linux_64_rhel6.0.run ./cudatoolkit_4.0.17_linux_64_rhel6.0.run Make sure the kernel modules are loaded: /sbin/modprobe -r nouveau && /sbin/modprobe nvidia To ensure the proper NVIDIA CUDA modules get loaded on reboot, add the above line to your /etc/rc.local file. Suricata Download and install Suricata: wget http://www.openinfosecfoundation.org/download/suricata-1.1beta2.tar.gz And unpack it: tar -xvzf suricata-1.1beta2.tar.gz Change to the unpacked directory: cd suricata-1.1beta2 Compile and install the engine with CUDA support: ./configure --enable-gccprotect --enable-profiling --enable-cuda \ --with-cuda-includes=/usr/local/cuda/include --with-cuda-libraries=/usr/ local/cuda/lib64/ make make install Rules Read the information in Rule_Management_with_Oinkmaster Add rules to suricata: cd /etc/suricata wget https://rules.emergingthreatspro.com/open-nogpl/suricata/ emerging.rules.tar.gz tar -xvzf emerging.rules.tar.gz Make sure your .yaml file includes the /etc/suricata/rules/emerging-*.rules files (they may need to be uncommented). Run Suricata as followed: cd /etc/suricata /usr/local/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 suricata-3.2.1/doc/Installation_with_CUDA_on_Ubuntu_server_1104.txt0000644000000000000000000001113113051004444022076 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_on_Ubuntu_server_1104 Installation with CUDA on Ubuntu server 11.04 THIS WOULD NOT WORK ON A VIRTUAL MACHINE! This guide is written using: Ubuntu Server 11.04 Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux Pre installation requirements apt-get update apt-get upgrade Get the CUDA toolkit http://developer.nvidia.com/cuda-toolkit-40 Pick up the correct NVIDIA drivers for your card and system http://www.nvidia.com/Download/index.aspx?lang=en-us Go to your download directory and chmod the 2 *.run files that you just downloaded. Example: chmod 655 cudatoolkit_4.0.17_linux_64_ubuntu10.10.run chmod 655 NVIDIA-Linux-x86_64-280.13.run sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make flex bison git Run the cuda toolkit installation package: sudo ./cudatoolkit_4.0.17_linux_64_ubuntu10.10.run Close all windows and as you are logged in press: Ctr+Alt+F1 Log in with your credentials sudo -i And enter your password Stop the x server: /etc/init.d/gdm stop Uninstall xserver video drivers: apt-get remove --purge xserver-xorg-video-nouveau Go to the directory where you downloaded nvidia/cuda drivers. Run the NVIDIA*******.run: ./NVIDIA********.run Ok and yes your way out. At some point it will ask you to make a special configuration file to disable a "nouveau" driver that the system is currently using and prevents the NVIDIA drivers to be installed - say yes! Reboot: shutdown -r now After reboot log in as you would normally through the GUI Log in as you would normally. Go to shell: Ctrl+Alt+F1 Type in your credentials and pass sudo -i Stop the xserver again: /etc/init.d/gdm stop Run the NVIDIA driver again. This time it would finish and be successful.... Reboot: shutdown -r now After start you would notice that the display has much better resolution - it is a good thing. Log in as you would normally. Because the 11.04 Ubuntu comes with gcc version 4.5 by default we need to install gcc 4.4 since we must use 4.4 for the cuda compilation: apt-get install gcc-4.4 gcc-4.4-base g++-4.4 Then we switch and make ubuntu use the gcc 4.4 by default: sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.5 40 -- slave /usr/bin/g++ g++ /usr/bin/g++-4.5 udo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.4 60 -- slave /usr/bin/g++ g++ /usr/bin/g++-4.4 We make sure that this is the case: sudo update-alternatives --config gcc "" update-alternatives --config gcc (as root) There are 2 choices for the alternative gcc (providing /usr/bin/gcc). * 0 /usr/bin/gcc-4.4 60 auto mode 1 /usr/bin/gcc-4.4 60 manual mode 2 /usr/bin/gcc-4.5 40 manual mode Selection Path Priority Status ------------------------------------------------------------ Press enter to keep the current choice[*], or type selection number: "" Suricata Enter the following in your download directory: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf/ ./autogen.sh ./configure --enable-gccprotect --enable-profiling --enable-cuda \ --with-cuda-includes=/usr/local/cuda/include --with-cuda-libraries=/usr/ local/cuda/lib64/ After that you should get the following result: "" Suricata Configuration: NFQueue support: no IPFW support: no PF_RING support: no Prelude support: no Unit tests enabled: no Debug output enabled: no Debug validation enabled: no CUDA enabled: yes DAG enabled: no Profiling enabled: yes GCC Protect enabled: yes GCC march native enabled: yes GCC Profile enabled: no Unified native time: no Non-bundled htp: no PCRE sljit: no "" make && make install ldconfig Proceed with Basic_Setup After you start suricata , you should see cuda example : "" suricata -c suricata.yaml -i eth0 [12406] 13/8/2011 -- 10:14:39 - (suricata.c:622) (main) -- This is Suricata version 1.1beta2 (rev b3f7e6a) [12406] 13/8/2011 -- 10:14:39 - (util-cpu.c:171) (UtilCpuPrintSummary) -- CPUs/cores online: 8 [12406] 13/8/2011 -- 10:14:39 - (util-cuda.c:4504) (SCCudaPrintBasicDeviceInfo) -- GPU Device 1: GeForce 310M, 2 Multiprocessors, 1468MHz, CUDA Compute Capability 1.2................... ........................ "" suricata-3.2.1/doc/CentOS5.txt0000644000000000000000000000700613051004444012743 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS5 CentOS5 Pre-installation requirements You will have to use the Fedora EPEL repository for some packages to enable this repository. It is the same for i386 and x86_64: sudo rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release- 5-3.noarch.rpm Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \ pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \ libyaml-devel zlib zlib-devel Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS If you plan to build Suricata with IPS capabilities via ./configure --enable- nfqueue, there are no pre-built packages in the CentOS base or EPEL for libnfnetlink and libnetfilter_queue. If you wish, you may use the rpms in the Emerging Threats Cent OS 5 repository: i386 sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/i386/ libnetfilter_queue-0.0.15-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/ libnetfilter_queue-devel-0.0.15-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink- 0.0.30-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink- devel-0.0.30-1.i386.rpm x86_64 sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/ x86_64/libnetfilter_queue-0.0.15-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnetfilter_queue-devel-0.0.15-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnfnetlink-0.0.30-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnfnetlink-devel-0.0.30-1.x86_64.rpm libcap-ng installation This installation is needed for dropping privileges. wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.6.4.tar.gz tar -xzvf libcap-ng-0.6.4.tar.gz cd libcap-ng-0.6.4 ./configure make sudo make install Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 If you are building from Git sources, enter all the following commands: bash autogen.sh If you are not building from Git sources, enter only: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with the Basic_Setup. suricata-3.2.1/doc/CentOS_56_Installation.txt0000644000000000000000000000704113051004444015710 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_56_Installation CentOS 5.6 Installation Pre-installation requirements You will have to use the Fedora EPEL repository for some packages to enable this repository. It is the same for i386 and x86_64: sudo rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5- 4.noarch.rpm Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation. sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \ pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \ libyaml-devel zlib zlib-devel Depending on the current status of your system, it may take a while to complete this process. HTP HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library_installation. IPS If you plan to build Suricata with IPS capabilities via ./configure --enable- nfqueue, there are no pre-built packages in the CentOS base or EPEL for libnfnetlink and libnetfilter_queue. If you wish, you may use the rpms in the Emerging Threats Cent OS 5 repository: i386 sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/i386/ libnetfilter_queue-0.0.15-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/ libnetfilter_queue-devel-0.0.15-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink- 0.0.30-1.i386.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink- devel-0.0.30-1.i386.rpm x86_64 sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/ x86_64/libnetfilter_queue-0.0.15-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnetfilter_queue-devel-0.0.15-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnfnetlink-0.0.30-1.x86_64.rpm \ http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/ libnfnetlink-devel-0.0.30-1.x86_64.rpm libcap-ng installation This installation is needed for dropping privileges. wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.6.4.tar.gz tar -xzvf libcap-ng-0.6.4.tar.gz cd libcap-ng-0.6.4 ./configure make sudo make install Suricata To download and build Suricata, enter the following: wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz tar -xvzf suricata-1.3.3.tar.gz cd suricata-1.3.3 If you are building from Git sources, enter all the following commands: bash autogen.sh If you are not building from Git sources, enter only: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make sudo make install Auto setup You can also use the available auto setup features of Suricata: ex: ./configure && make && make install-conf make install-conf would do the regular "make install" and then it would automatically create/ setup all the necessary directories and suricata.yaml for you. ./configure && make && make install-rules make install-rules would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata ./configure && make && make install-full make install-full would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata Please continue with the Basic_Setup. suricata-3.2.1/doc/Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt0000644000000000000000000001701513051004444024133 00000000000000Autogenerated on 2012-01-11 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104 Installation with CUDA and PF RING on Ubuntu server 11.04 THIS WOULD NOT WORK ON A VIRTUAL MACHINE! This guide is written using: Ubuntu Server 11.04 Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux Pre installation requirements apt-get update apt-get upgrade To get the CUDA toolkit, enter: http://developer.nvidia.com/cuda-toolkit-40 Pick up the correct NVIDIA drivers for your card and system http://www.nvidia.com/Download/index.aspx?lang=en-us Go to your download directory chmod the 2 *.run files that you just downloaded. For example: chmod 655 cudatoolkit_4.0.17_linux_64_ubuntu10.10.run chmod 655 NVIDIA-Linux-x86_64-280.13.run sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \ make flex bison git Run the cuda toolkit installation package: sudo ./cudatoolkit_4.0.17_linux_64_ubuntu10.10.run Close all windows and as you are logged in press: Ctr+Alt+F1 Log in with your credentials sudo -i And enter your password Stop the x server: /etc/init.d/gdm stop Uninstall xserver video drivers: apt-get remove --purge xserver-xorg-video-nouveau Go to the directory where you downloaded nvidia/cuda drivers. Run the NVIDIA*******.run: ./NVIDIA********.run Ok and yes your way out. At some point it will ask you to make a special configuration file to disable a "nouveau" driver that the system is currently using - say yes! Reboot: shutdown -r now After reboot log in as you would normally do through the GUI Log in as you would normally. Go to shell: Ctrl+Alt+F1 Type in your credentials and pass sudo -i Stop the xserver again: /etc/init.d/gdm stop Run the NVIDIA driver again. This time it would finish and be successful.... Reboot: shutdown -r now After start you would notice that the display has much better resolution - it is a good thing. Log in as you would normally. Because the 11.04 Ubuntu comes with gcc version 4.5 by default, you need to install gcc 4.4 since you must use 4.4 for the cuda compilation: apt-get install gcc-4.4 gcc-4.4-base g++-4.4 Then we switch and make ubuntu use the gcc 4.4 by default: sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.5 40 -- slave /usr/bin/g++ g++ /usr/bin/g++-4.5 sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.4 60 -- slave /usr/bin/g++ g++ /usr/bin/g++-4.4 Make sure that this is the case: sudo update-alternatives --config gcc "" update-alternatives --config gcc (as root) There are 2 choices for the alternative gcc (providing /usr/bin/gcc). Selection Path Priority Status ------------------------------------------------------------ * 0 /usr/bin/gcc-4.4 60 auto mode 1 /usr/bin/gcc-4.4 60 manual mode 2 /usr/bin/gcc-4.5 40 manual mode Press enter to keep the current choice[*], or type selection number (as root) "" PF_RING installation. Install pre-requisites: cd /opt apt-get install subversion gobjc++-4.4-multilib gobjc++-4.4 Get the latest PF_RING: svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING Install PF_RING: cd /kernel make && make install sudo insmod ./pf_ring.ko cd ../userland make && make install cd /lib ./configure && make && make install cd ../libpcap ./configure && make && make install cd ../examples echo "options pf_ring transparent_mode=0 min_num_slots=32768 enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf Check info: cat /proc/net/pf_ring/info "" cd ../kernel cat /proc/net/pf_ring/info PF_RING Version : 4.7.3 ($Revision: exported$) Ring slots : 4096 Slot version : 13 Capture TX : Yes [RX+TX] IP Defragment : No Socket Mode : Standard Transparent mode : Yes (mode 0) Total rings : 0 Total plugins : 0 "" Check functionality: ./pfcount -i eth0 You should see something even if you have no traffic at the moment: "" cd /opt/PF_RING/userland/examples ./pfcount -i eth0 Using PF_RING v.4.7.3 Capturing from eth0 [88:AE:1D:56:90:FA] 1. Device RX channels: 1 2. Polling threads: 1 ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes ========================= ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [1'000.32 ms][0.00 pkt/sec] ========================= ^CLeaving... ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [629.37 ms][0.00 pkt/sec] ========================= cd /opt/PF_RING/userland/examples "" Suricata Go to directory of your choice and get Suricata: git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf/ Configure: ./autogen.sh ./configure --enable-gccprotect --enable-profiling --enable-cuda --with-cuda- includes=/usr/local/cuda/include \ --with-cuda-libraries=/usr/local/cuda/lib64 --enable-pfring You should get at the end: "" Suricata Configuration: NFQueue support: no IPFW support: no PF_RING support: yes Prelude support: no Unit tests enabled: no Debug output enabled: no Debug validation enabled: no CUDA enabled: yes DAG enabled: no Profiling enabled: yes GCC Protect enabled: yes GCC march native enabled: yes GCC Profile enabled: no Unified native time: no Non-bundled htp: no PCRE sljit: no "" Install: make && make install ldconfig Verify: suricata --build-info [1840] 13/8/2011 -- 14:26:39 - (suricata.c:622) (main) -- This is Suricata version 1.1beta2 (rev b3f7e6a) [1840] 13/8/2011 -- 14:26:39 - (suricata.c:507) (SCPrintBuildInfo) - - Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 CUDA PF_RING LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK [1840] 13/8/2011 -- 14:26:39 - (suricata.c:521) (SCPrintBuildInfo) - - 64-bits, Little-endian architecture [1840] 13/8/2011 -- 14:26:39 - (suricata.c:523) (SCPrintBuildInfo) - - GCC version 4.4.5, C version 199901 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:529) (SCPrintBuildInfo) - - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:532) (SCPrintBuildInfo) - - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:535) (SCPrintBuildInfo) - - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:538) (SCPrintBuildInfo) - - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:541) (SCPrintBuildInfo) - - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16 [1840] 13/8/2011 -- 14:26:39 - (suricata.c:545) (SCPrintBuildInfo) - - compiled with -fstack-protector [1840] 13/8/2011 -- 14:26:39 - (suricata.c:551) (SCPrintBuildInfo) - - compiled with _FORTIFY_SOURCE=2 Run Suricata: suricata -c /etc/suricata/suricata.yaml\ --pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow suricata-3.2.1/doc/Setting_up_IPSinline_for_Linux.txt0000644000000000000000000000603413051004444017603 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux Setting up IPS/inline for Linux In this guide will be explained how to work with Suricata in inline mode and how to set iptables for that purpose. First start with compiling Suricata with NFQ support. For instructions see Ubuntu_Installation. For more information about NFQ and iptables, see suricata.yaml. To check if you have NFQ enabled in your Suricata, enter the following command: suricata --build-info and examine if you have NFQ between the features. To run suricata with the NFQ mode, you have to make use of the -q option. This option tells Suricata which of the queue numbers it should use. sudo suricata -c /etc/suricata/suricata.yaml -q 0 Iptables configuration First of all it is important to know which traffic you would like to send to Suricata. Traffic that passes your computer or traffic that is generated by your computer. If Suricata is running on a gateway and is meant to protect the computers behind that gateway you are dealing with the first scenario: forward_ing . If Suricata has to protect the computer it is running on, you are dealing with the second scenario: host (see drawing 2). These two ways of using Suricata can also be combined. The easiest rule in case of the gateway-scenario to send traffic to Suricata is: sudo iptables -I FORWARD -j NFQUEUE In this case, all forwarded traffic goes to Suricata. In case of the host situation, these are the two most simple iptable rules; sudo iptables -I INPUT -j NFQUEUE sudo iptables -I OUTPUT -j NFQUEUE It is possible to set a queue number. If you do not, the queue number will be 0 by default. Imagine you want Suricata to check for example just TCP-traffic, or all incoming traffic on port 80, or all traffic on destination-port 80, you can do so like this: sudo iptables -I INPUT -p tcp -j NFQUEUE sudo iptables -I OUTPUT -p tcp -j NFQUEUE In this case, Suricata checks just TCP traffic. sudo iptables -I INPUT -p tcp --sport 80 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --dport 80 -j NFQUEUE In this example, Suricata checks all input and output on port 80. To see if you have set your iptables rules correct make sure Suricata is running and enter: sudo iptables -vnL In the example you can see if packets are being logged. This description of the use of iptables is the way to use it with IPv4. To use it with IPv6 all previous mentioned commands have to start with 'ip6tables'. It is also possible to let Suricata check both kinds of traffic. There is also a way to use iptables with multiple networks (and interface cards). Example: sudo iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE sudo iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE The options -i (input) -o (output) can be combined with all previous mentioned options If you would stop Suricata and use internet, the traffic will not come through. To make internet work correctly, you have to erase all iptable rules. To erase all iptable rules, enter: sudo iptables -F suricata-3.2.1/doc/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt0000644000000000000000000001041313051004444024136 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6 Installation with CUDA and PFRING on Scientific Linux 6 For setup and install you need to be root: mkdir /root/src cd /root/src Pre installation requirements Install the following packages, to make sure you have everything needed for the installation: yum install mpfr-2.4.1-6.el6.x86_64 cpp-4.4.4-13.el6.x86_64 ppl-0.10.2- 11.el6.x86_64 \ cloog-ppl-0.15.7-1.2.el6.x86_64 gcc-4.4.4-13.el6.x86_64 kernel-devel-2.6.32- 131.2.1.el6.x86_64 \ pcre-devel-7.8-3.1.el6.x86_64 libpcap-devel-1.0.0- 6.20091201git117cb5.el6.x86_64 \ yum-plugin-priorities-1.1.26-11.el6.noarch yum-conf-sl6x-1-1.noarch libyaml- 0.1.3-1.el6.rf.x86_64 \ libyaml-devel-0.1.3-1.el6.rf.x86_64 libnet-1.1.2.1-2.2.el6.rf.x86_64 flex- 2.5.35-8.el6.x86_64 \ bison-2.4.1-5.el6.x86_64 gcc-c++-4.4.4-13.el6.x86_64 CUDA Download and install NVIDIA CUDA drivers: wget http://us.download.nvidia.com/XFree86/Linux-x86_64/270.41.19/NVIDIA- Linux-x86_64-270.41.19.run chmod +x NVIDIA-Linux-x86_64-270.41.19.run ./NVIDIA-Linux-x86_64-270.41.19.run You also need to download and install the CUDA toolkit for RHEL6 : wget http://developer.download.nvidia.com/compute/cuda/4_0/toolkit/ cudatoolkit_4.0.17_linux_64_rhel6.0.run chmod +x cudatoolkit_4.0.17_linux_64_rhel6.0.run ./cudatoolkit_4.0.17_linux_64_rhel6.0.run Make sure the kernel modules are loaded: /sbin/modprobe -r nouveau && /sbin/modprobe nvidia To ensure the proper NVIDIA CUDA modules get loaded on reboot, add the above line to your /etc/rc.local file. PF_RING Go to your download directory and get the latest PF_RING: svn export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ pfring-svn- latest Compile and install Next, enter the following commands for configuration and installation: cd pfring-svn-latest/kernel make && sudo make install cd ../userland/lib ./configure --prefix=/usr/local/pfring && make && sudo make install cd ../libpcap-1.1.1-ring ./configure --prefix=/usr/local/pfring && make && sudo make install cd ../tcpdump-4.1.1 ./configure --prefix=/usr/local/pfring && make && sudo make install Load the pf_ring kernel module: /sbin/modprobe pf_ring To ensure the pf_ring module gets loaded on reboot, add the above line to your /etc/rc.local file. Suricata Download and install Suricata: wget http://www.openinfosecfoundation.org/download/suricata-1.1beta2.tar.gz And unpack it: tar -xvzf suricata-1.1beta2.tar.gz Change to the unpacked directory: cd suricata-1.1beta2 Now compile and install Suricata with PF_RING and CUDA support: ./configure --enable-gccprotect --enable-profiling --enable-cuda --with-cuda- includes=/usr/local/cuda/include \ --with-cuda-libraries=/usr/local/cuda/lib64 --enable-pfring --with-libpfring- libraries=/usr/local/lib \ --with-libpfring-includes=/usr/local/include --with-libpcap-libraries=/usr/ local/lib --with-libpcap-includes=/usr/local/include make make install Continue with the Basic_Setup Next, you need to edit max-pending-packets in your /etc/suricata/suricata.yaml. If you don't have one, download a generic one to get started: cd /etc/suricata wget https://rules.emergingthreatspro.com/open-nogpl/suricata/suricata- open.yaml Edit your suricata-open.yaml file accordingly. The number of packets allowed to be processed simultaneously can be whatever you want but it is recommended that it be 4000 or more. For example: max-pending-packets: 12288 Next make sure the following line is present in the multi pattern algorithm section: mpm-algo: b2g_cuda Rules Read the information in Rule_Management_with_Oinkmaster Add rules to suricata: cd /etc/suricata wget https://rules.emergingthreatspro.com/open-nogpl/suricata/ emerging.rules.tar.gz tar -xvzf emerging.rules.tar.gz Make sure your .yaml file includes the /etc/suricata/rules/emerging-*.rules files (they may need to be uncommented). Run Suricata as followed: cd /etc/suricata /usr/local/bin/suricata -c /etc/suricata/suricata.yaml\ --pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow touch /var/lock/subsys/local References PF_RING http://www.ntop.org/products/pf_ring/ suricata-3.2.1/doc/INSTALL.PF_RING0000644000000000000000000001503413051004444013136 00000000000000An up to date version of this document is available online at: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_PF_RING #Install DKMS apt-get install dkms #We need subversion for checking out the PF_RING code we need flex and bisonfor libpcap apt-get install subversion flex bison #Install the debs needed for suricata. apt-get install libpcre3-dev libpcap-dev libyaml-dev zlib1g-dev libcap-ng-dev libnet1-dev #In the exmple we will build from the GIT repo so we will need some extra packages apt-get install git-core automake autoconf libtool #Go to /usr/src/ we will need to be here to build our modules cd /usr/src/ #Checkout the PF_RING code svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING_CURRENT_SVN #Create the DKMS build directory and copy files over for the main PF_RING module mkdir /usr/src/pf_ring-4 cp -Rf /usr/src/PF_RING_CURRENT_SVN/kernel/* /usr/src/pf_ring-4/ cd /usr/src/pf_ring-4/ #Create a file called dkms.conf and place the following into the file. nano dkms.conf PACKAGE_NAME="pf_ring" PACKAGE_VERSION="4" BUILT_MODULE_NAME[0]="pf_ring" DEST_MODULE_LOCATION[0]="/kernel/net/pf_ring/" AUTOINSTALL="yes" #Build and install the module we don't build a deb as currently this appears to be broken in Ubuntu-10.04 dkms add -m pf_ring -v 4 dkms build -m pf_ring -v 4 dkms install -m pf_ring -v 4 #if you issue the following command you can see that pf_ring should now be installed as DKMS module dkms status #Now lets go through the steps to build a e1000e PF_RING aware driver. mkdir /usr/src/e1000e-pf_ring-1.3.10a cd /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000e/e1000e-1.3.10a/src/ #We copy this over so that DKMS can find it for driver rebuilds cp -Rf /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000e/e1000e-1.3.10a/src/* /usr/src/e1000e-pf_ring-1.3.10a/ cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /usr/src/e1000e-pf_ring-1.3.10a/ #Fix the path to pf_ring.h cd /usr/src/e1000e-pf_ring-1.3.10a/ sed -i -e 's/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/kernel\/linux\/pf\_ring\.h/pf\_ring\.h/' netdev.c #Create a file called dkms.conf and place the following into the file. nano dkms.conf PACKAGE_NAME="e1000e-pf_ring" PACKAGE_VERSION="1.3.10a" BUILT_MODULE_NAME[0]="e1000e" DEST_MODULE_LOCATION[0]="/kernel/drivers/net/e1000e/" AUTOINSTALL="yes" #Build and install the module we don't build a deb as currently this appears to be broken in Ubuntu-10.04 dkms add -m e1000e-pf_ring -v 1.3.10a dkms build -m e1000e-pf_ring -v 1.3.10a dkms install -m e1000e-pf_ring -v 1.3.10a #Now lets go through the steps to build a e1000 PF_RING aware driver. mkdir /usr/src/e1000-pf_ring-8.0.30 cd /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000/e1000-8.0.30/src/ #We copy this over so that DKMS can find it for driver rebuilds cp -Rf /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000/e1000-8.0.30/src/* /usr/src/e1000-pf_ring-8.0.30 cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /usr/src/e1000-pf_ring-8.0.30 #Fix the path to pf_ring.h cd /usr/src/e1000-pf_ring-8.0.30 sed -i -e 's/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/kernel\/linux\/pf\_ring\.h/pf\_ring\.h/' e1000_main.c #Create a file called dkms.conf and place the following into the file. nano dkms.conf PACKAGE_NAME="e1000-pf_ring" PACKAGE_VERSION="8.0.30" BUILT_MODULE_NAME[0]="e1000" DEST_MODULE_LOCATION[0]="/kernel/drivers/net/e1000/" AUTOINSTALL="yes" dkms add -m e1000-pf_ring -v 8.0.30 dkms build -m e1000-pf_ring -v 8.0.30 dkms install -m e1000-pf_ring -v 8.0.30 #Make the dir structure to hold are PF_RING enabled userland Apps. mkdir -p /opt/PF_RING/{bin,lib,include/linux,sbin} #Build and install the userland lib. cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /opt/PF_RING/include/linux/ cd /usr/src/PF_RING_CURRENT_SVN/userland/lib ./configure sed -i -e 's/INSTDIR = \${DESTDIR}\/usr\/local/INSTDIR = \${DESTDIR}\/opt\/PF_RING/' Makefile cp -f pfring_e1000e_dna.h /opt/PF_RING/include make && make install #Build and install the PF_RING enabled libpcap #PF_RING enabled libpcap cd /usr/src/PF_RING_CURRENT_SVN/userland/libpcap-1.1.1-ring ./configure sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/' Makefile sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/' Makefile.in ./configure --prefix=/opt/PF_RING && make && make install #Build and install tcpdump using the PF_RING enabled version of libpcap cd /usr/src/PF_RING_CURRENT_SVN/userland/tcpdump-4.1.1 ./configure LD_RUN_PATH="/opt/PF_RING/lib:/usr/lib:/usr/local/lib" --prefix=/opt/PF_RING/ --enable-ipv6 && make && make install #Pull down the latest version of suricata from the git repo and build with PF_RING support. cd /usr/src/PF_RING_CURRENT_SVN/userland/ git clone git://phalanx.openinfosecfoundation.org/oisf.git oisfnew cd oisfnew ./autogen.sh ./configure --enable-pfring --with-libpfring-libraries=/opt/PF_RING/lib --with-libpfring-includes=/opt/PF_RING/include --with-libpcap-libraries=/opt/PF_RING/lib --with-libpcap-includes=/opt/PF_RING/include LD_RUN_PATH="/opt/PF_RING/lib:/usr/lib:/usr/local/lib" --prefix=/opt/PF_RING/ make && make install #Make config and log directories for a more complete getting started see http://www.inliniac.net/blog/2010/05/10/setting-up-suricata-0-9-0-for-initial-use-on-ubuntu-lucid-10-04.html mkdir /etc/suricata cp suricata.yaml /etc/suricata/ cp classification.config /etc/suricata/ mkdir /var/log/suricata #Setup options for when we intialize the module (here is the output from modinfo) #parm: num_slots:Number of ring slots (uint) #parm: transparent_mode:0=standard Linux, 1=direct2pfring+transparent, 2=direct2pfring+non transparentFor 1 and 2 you need to use a PF_RING aware driver (uint) #parm: enable_tx_capture:Set to 1 to capture outgoing packets (uint) #parm: enable_ip_defrag:Set to 1 to enable IP defragmentation(only rx traffic is defragmentead) (uint) echo "options pf_ring transparent_mode=0 num_slots=32768 enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf #start up suricata with PF_RING support currently these options don't have very much effect with the AutoMode but see src/runmodes.c for more more options. /opt/PF_RING/bin/suricata --pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml #To check the status of PF_RING modinfo pf_ring && cat /proc/net/pf_ring/info #If you need to uninstall PF_RING or rollback your PF_RING aware drivers to their previous state you can do so with the following commands. dkms remove -m e1000e-pf_ring -v 1.3.10a --all dkms remove -m e1000 -v 8.0.30 --all dkms remove -m pf_ring -v 4 --all suricata-3.2.1/doc/README0000644000000000000000000000000013051004444011625 00000000000000suricata-3.2.1/doc/HTP_library_installation.txt0000644000000000000000000000112313051004444016455 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTP_library_installation HTP library installation The installation of the HTP library is the same for several operating systems, except you can not use 'sudo' with Debian and FreeBSD. Using Debian or FreeBSD you have to Make sure you enter all following commands as root/super-user. To download and build HTP, enter the following: wget http://www.openinfosecfoundation.org/download/libhtp-0.2.3.tar.gz tar -xzvf libhtp-0.2.3.tar.gz cd libhtp-0.2.3 ./configure make make install suricata-3.2.1/doc/Third_Party_Installation_Guides.txt0000644000000000000000000000066313051004444017777 00000000000000Autogenerated on 2012-11-29 from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Third_Party_Installation_Guides Third Party Installation Guides On this page you can find links to third party installation guides for Suricata. Beware that none of these guides is reviewed by us. Feel free to add a link to your Suricata installation guide. http://aldeid.com/index.php/Suricata/Installation-and-basic-configuration suricata-3.2.1/config.h.in0000644000000000000000000003606513051004466012253 00000000000000/* config.h.in. Generated from configure.ac by autoheader. */ /* Enable --afl-$proto-request commandline option */ #undef AFLFUZZ_APPLAYER /* Enable special --afl-parse-rules commandline option */ #undef AFLFUZZ_CONF_TEST /* Enable --afl-decoder-$proto commandline option */ #undef AFLFUZZ_DECODER /* Enable --afl-der commandline option */ #undef AFLFUZZ_DER /* Disable all management threads */ #undef AFLFUZZ_DISABLE_MGTTHREADS /* Enable --afl-mime commandline option */ #undef AFLFUZZ_MIME /* Disable all use of random functions */ #undef AFLFUZZ_NO_RANDOM /* Enable special AFL 'single' runmode */ #undef AFLFUZZ_PCAP_RUNMODE /* Enable AFL PERSISTANT_MODE */ #undef AFLFUZZ_PERSISTANT_MODE /* Enable --afl-rules commandline option */ #undef AFLFUZZ_RULES /* Intel Hyperscan support enabled */ #undef BUILD_HYPERSCAN /* Unix socket support enabled */ #undef BUILD_UNIX_SOCKET /* L1 cache line size */ #undef CLS /* Our CONFIG_DIR */ #undef CONFIG_DIR /* Enable debug output */ #undef DEBUG /* Enable (debug) validation code output */ #undef DEBUG_VALIDATION /* AF_PACKET support is available */ #undef HAVE_AF_PACKET /* Define to 1 if you have the header file. */ #undef HAVE_ARPA_INET_H /* Define to 1 if you have the header file. */ #undef HAVE_ASSERT_H /* Define to 1 if you have the header file. */ #undef HAVE_CTYPE_H /* (Endace DAG card support enabled) */ #undef HAVE_DAG /* Detection is disabled */ #undef HAVE_DETECT_DISABLED /* Define to 1 if you have the header file. */ #undef HAVE_DIRENT_H /* Define to 1 if you have the header file. */ #undef HAVE_DLFCN_H /* Define to 1 if you have the header file. */ #undef HAVE_ERRNO_H /* Define to 1 if you have the header file. */ #undef HAVE_FCNTL_H /* Define to 1 if you have the header file. */ #undef HAVE_FNMATCH_H /* libgeoip available */ #undef HAVE_GEOIP /* Define to 1 if you have the header file. */ #undef HAVE_GETOPT_H /* Define to 1 if you have the `gettimeofday' function. */ #undef HAVE_GETTIMEOFDAY /* Define to 1 if you have the `hs_valid_platform' function. */ #undef HAVE_HS_VALID_PLATFORM /* Assuming htp_config_set_response_decompression_layer_limit function in bundled libhtp */ #undef HAVE_HTP_CONFIG_SET_RESPONSE_DECOMPRESSION_LAYER_LIMIT /* Assuming htp_decode_query_inplace function in bundled libhtp */ #undef HAVE_HTP_DECODE_QUERY_INPLACE /* Found usable htp_config_set_path_decode_u_encoding function in libhtp */ #undef HAVE_HTP_SET_PATH_DECODE_U_ENCODING /* Assuming htp_tx_get_response_headers_raw function in bundled libhtp */ #undef HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW /* Assuming htp_config_register_request_uri_normalize function in bundled libhtp */ #undef HAVE_HTP_URI_NORMALIZE_HOOK /* Hardware timestamping support is available */ #undef HAVE_HW_TIMESTAMPING /* Define to 1 if you have the header file. */ #undef HAVE_INTTYPES_H /* Libpcap-ng support */ #undef HAVE_LIBCAP_NG /* Define to 1 if you have the `cuda' library (-lcuda). */ #undef HAVE_LIBCUDA /* Define to 1 if you have the `dag' library (-ldag). */ #undef HAVE_LIBDAG /* Define to 1 if you have the `GeoIP' library (-lGeoIP). */ #undef HAVE_LIBGEOIP /* libhiredis available */ #undef HAVE_LIBHIREDIS /* Define to 1 if you have the `hs' library (-lhs). */ #undef HAVE_LIBHS /* Define to 1 if you have the `htp' library (-lhtp). */ #undef HAVE_LIBHTP /* Define to 1 if you have the `iconv' library (-liconv). */ #undef HAVE_LIBICONV /* Define to 1 if you have the `jansson' library (-ljansson). */ #undef HAVE_LIBJANSSON /* Define to 1 if you have the `lua' library (-llua). */ #undef HAVE_LIBLUA /* Define to 1 if you have the `luajit-5.1' library (-lluajit-5.1). */ #undef HAVE_LIBLUAJIT_5_1 /* Define to 1 if you have the `magic' library (-lmagic). */ #undef HAVE_LIBMAGIC /* Define to 1 if you have the `net' library (-lnet). */ #undef HAVE_LIBNET /* (libnet 1.1 available) */ #undef HAVE_LIBNET11 /* Define to 1 if you have the `netfilter_log' library (-lnetfilter_log). */ #undef HAVE_LIBNETFILTER_LOG /* Define to 1 if you have the `netfilter_queue' library (-lnetfilter_queue). */ #undef HAVE_LIBNETFILTER_QUEUE /* (libnet_have_capabilities_patch) */ #undef HAVE_LIBNET_CAPABILITIES /* (libnet_build_icmpv6_unreach available) */ #undef HAVE_LIBNET_ICMPV6_UNREACH /* libnet_init takes const argument */ #undef HAVE_LIBNET_INIT_CONST /* Define to 1 if you have the `nfnetlink' library (-lnfnetlink). */ #undef HAVE_LIBNFNETLINK /* Define to 1 if you have the `nspr4' library (-lnspr4). */ #undef HAVE_LIBNSPR4 /* Define to 1 if you have the `nss3' library (-lnss3). */ #undef HAVE_LIBNSS3 /* Define to 1 if you have the `pcap' library (-lpcap). */ #undef HAVE_LIBPCAP /* Define to 1 if you have the `pcre' library (-lpcre). */ #undef HAVE_LIBPCRE /* Define to 1 if you have the `pfring' library (-lpfring). */ #undef HAVE_LIBPFRING /* Define to 1 if you have the `pthread' library (-lpthread). */ #undef HAVE_LIBPTHREAD /* Define to 1 if you have the `yaml' library (-lyaml). */ #undef HAVE_LIBYAML /* Define to 1 if you have the header file. */ #undef HAVE_LIMITS_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_ETHTOOL_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_FILTER_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_IF_ARP_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_IF_ETHER_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_IF_PACKET_H /* Define to 1 if you have the header file. */ #undef HAVE_LINUX_SOCKIOS_H /* lua support available */ #undef HAVE_LUA /* libluajit available */ #undef HAVE_LUAJIT /* (Libmagic for file handling) */ #undef HAVE_MAGIC /* Define to 1 if your system has a GNU libc compatible `malloc' function, and to 0 otherwise. */ #undef HAVE_MALLOC /* Define to 1 if you have the `memchr' function. */ #undef HAVE_MEMCHR /* Define to 1 if you have the header file. */ #undef HAVE_MEMORY_H /* Define to 1 if you have the `memrchr' function. */ #undef HAVE_MEMRCHR /* Define to 1 if you have the `memset' function. */ #undef HAVE_MEMSET /* mPIPE support is available */ #undef HAVE_MPIPE /* (Napatech capture card support) */ #undef HAVE_NAPATECH /* Define to 1 if you have the header file. */ #undef HAVE_NETDB_H /* Define to 1 if you have the header file. */ #undef HAVE_NETINET_IN_H /* (NETMAP support enabled) */ #undef HAVE_NETMAP /* (ethernet.h) */ #undef HAVE_NET_ETHERNET_H /* Define to 1 if you have the header file. */ #undef HAVE_NET_IF_H /* nflog available */ #undef HAVE_NFLOG /* Found queue max length support in netfilter_queue */ #undef HAVE_NFQ_MAXLEN /* Found nfq_set_queue_flags function in netfilter_queue */ #undef HAVE_NFQ_SET_QUEUE_FLAGS /* Found nfq_set_verdict2 function in netfilter_queue */ #undef HAVE_NFQ_SET_VERDICT2 /* Found nfq_set_verdict_batch function in netfilter_queue */ #undef HAVE_NFQ_SET_VERDICT_BATCH /* libnss available for md5 */ #undef HAVE_NSS /* Use workaround for old barnyard2 in unified2 output */ #undef HAVE_OLD_BARNYARD2 /* Recent packet fanout support is available */ #undef HAVE_PACKET_FANOUT /* Define to 1 if you have the header file. */ #undef HAVE_PCAP_BPF_H /* Define to 1 if you have the header file. */ #undef HAVE_PCAP_H /* Define to 1 if you have the header file. */ #undef HAVE_PCAP_PCAP_H /* (libpcap has pcap_set_buffer_size function) */ #undef HAVE_PCAP_SET_BUFF /* Pcre pcre_free_study supported */ #undef HAVE_PCRE_FREE_STUDY /* (PF_RING support enabled) */ #undef HAVE_PFRING /* Define to 1 if you have the header file. */ #undef HAVE_POLL_H /* Define to 1 if your system has a GNU libc compatible `realloc' function, and to 0 otherwise. */ #undef HAVE_REALLOC /* Define to 1 if you have the header file. */ #undef HAVE_SCHED_H /* Define to 1 if you have the header file. */ #undef HAVE_SIGNAL_H /* Define to 1 if you have the header file. */ #undef HAVE_STDARG_H /* Define to 1 if stdbool.h conforms to C99. */ #undef HAVE_STDBOOL_H /* Define to 1 if you have the header file. */ #undef HAVE_STDDEF_H /* Define to 1 if you have the header file. */ #undef HAVE_STDINT_H /* Define to 1 if you have the header file. */ #undef HAVE_STDIO_H /* Define to 1 if you have the header file. */ #undef HAVE_STDLIB_H /* Define to 1 if you have the `strcasecmp' function. */ #undef HAVE_STRCASECMP /* Define to 1 if you have the `strchr' function. */ #undef HAVE_STRCHR /* Define to 1 if you have the `strdup' function. */ #undef HAVE_STRDUP /* Define to 1 if you have the `strerror' function. */ #undef HAVE_STRERROR /* Define to 1 if you have the header file. */ #undef HAVE_STRINGS_H /* Define to 1 if you have the header file. */ #undef HAVE_STRING_H /* Define to 1 if you have the `strlcat' function. */ #undef HAVE_STRLCAT /* Define to 1 if you have the `strlcpy' function. */ #undef HAVE_STRLCPY /* Define to 1 if you have the `strncasecmp' function. */ #undef HAVE_STRNCASECMP /* Define to 1 if you have the `strtol' function. */ #undef HAVE_STRTOL /* Define to 1 if you have the `strtoul' function. */ #undef HAVE_STRTOUL /* Define to 1 if you have the header file. */ #undef HAVE_SYSLOG_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_IOCTL_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_MMAN_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_PRCTL_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_SOCKET_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_STAT_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_SYSCALL_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_TIME_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_TYPES_H /* Define to 1 if you have the header file. */ #undef HAVE_TIME_H /* AF_PACKET tpcket_v3 support is available */ #undef HAVE_TPACKET_V3 /* Define to 1 if you have the header file. */ #undef HAVE_UNISTD_H /* Define to 1 if you have the header file. */ #undef HAVE_W32API_WINBASE_H /* Define to 1 if you have the header file. */ #undef HAVE_W32API_WTYPES_H /* Define to 1 if you have the header file. */ #undef HAVE_WINDOWS_H /* Define to 1 if you have the header file. */ #undef HAVE_WINSOCK2_H /* Define to 1 if you have the header file. */ #undef HAVE_WS2TCPIP_H /* Define to 1 if the system has the type `_Bool'. */ #undef HAVE__BOOL /* Enable FreeBSD IPFW support for inline IDP */ #undef IPFW /* (libpcap version 0.x) */ #undef LIBPCAP_VERSION_MAJOR /* Define to the sub-directory where libtool stores uninstalled libraries. */ #undef LT_OBJDIR /* Enable Linux Netfilter NFQUEUE support for inline IDP */ #undef NFQ /* For signed version of nfq_get_payload */ #undef NFQ_GET_PAYLOAD_SIGNED /* Pcre PCRE_EXTRA_MATCH_LIMIT_RECURSION not available */ #undef NO_PCRE_MATCH_RLIMIT /* Name of package */ #undef PACKAGE /* Define to the address where bug reports for this package should be sent. */ #undef PACKAGE_BUGREPORT /* Define to the full name of this package. */ #undef PACKAGE_NAME /* Define to the full name and version of this package. */ #undef PACKAGE_STRING /* Define to the one symbol short name of this package. */ #undef PACKAGE_TARNAME /* Define to the home page for this package. */ #undef PACKAGE_URL /* Define to the version of this package. */ #undef PACKAGE_VERSION /* Pcre with JIT compiler support enabled */ #undef PCRE_HAVE_JIT /* Libprelude support enabled */ #undef PRELUDE /* Define whether application use libtool >= 2.0 */ #undef PRELUDE_APPLICATION_USE_LIBTOOL2 /* Enable performance profiling for locks */ #undef PROFILE_LOCKING /* Enable performance profiling */ #undef PROFILING /* Official release */ #undef RELEASE /* Git revision */ #undef REVISION /* Define to 1 if you have the ANSI C header files. */ #undef STDC_HEADERS /* Thread local storage */ #undef TLS /* Enable built-in unittests */ #undef UNITTESTS /* Version number of package */ #undef VERSION /* (bsd source) */ #undef _BSD_SOURCE /* Enable large inode numbers on Mac OS X 10.5. */ #ifndef _DARWIN_USE_64_BIT_INODE # define _DARWIN_USE_64_BIT_INODE 1 #endif /* (default source) */ #undef _DEFAULT_SOURCE /* Number of bits in a file offset, on hosts where this is settable. */ #undef _FILE_OFFSET_BITS /* Define for large files, on AIX-style hosts. */ #undef _LARGE_FILES /* Define for Solaris 2.5.1 so the uint32_t typedef from , , or is not used. If the typedef was allowed, the #define below would cause a syntax error. */ #undef _UINT32_T /* Define for Solaris 2.5.1 so the uint64_t typedef from , , or is not used. If the typedef was allowed, the #define below would cause a syntax error. */ #undef _UINT64_T /* Define for Solaris 2.5.1 so the uint8_t typedef from , , or is not used. If the typedef was allowed, the #define below would cause a syntax error. */ #undef _UINT8_T /* (bsd source) */ #undef __BSD_SOURCE /* (favor bsd) */ #undef __FAVOR_BSD /* Fake GCC atomic support */ #undef __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1 /* Fake GCC atomic support */ #undef __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2 /* Fake GCC atomic support */ #undef __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4 /* Fake GCC atomic support */ #undef __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8 /* (CUDA support enabled) */ #undef __SC_CUDA_SUPPORT__ /* Define to `__inline__' or `__inline' if that's what the C compiler calls it, or to nothing if 'inline' is not supported under any name. */ #ifndef __cplusplus #undef inline #endif /* Define to the type of a signed integer type of width exactly 32 bits if such a type exists and the standard includes do not define it. */ #undef int32_t /* Define to rpl_malloc if the replacement function should be used. */ #undef malloc /* Define to `int' if does not define. */ #undef pid_t /* Define to rpl_realloc if the replacement function should be used. */ #undef realloc /* Define to `unsigned int' if does not define. */ #undef size_t /* Define to the type of an unsigned integer type of width exactly 16 bits if such a type exists and the standard includes do not define it. */ #undef uint16_t /* Define to the type of an unsigned integer type of width exactly 32 bits if such a type exists and the standard includes do not define it. */ #undef uint32_t /* Define to the type of an unsigned integer type of width exactly 64 bits if such a type exists and the standard includes do not define it. */ #undef uint64_t /* Define to the type of an unsigned integer type of width exactly 8 bits if such a type exists and the standard includes do not define it. */ #undef uint8_t